From 981b44e418abc36162bd9c329b3d2b787eacb5bb Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Sun, 27 Sep 2026 12:37:06 -0400
Subject: [PATCH 01/32] Lead the CLI help with the v5 workflow

List scan, vex, vendor and list first, then the agent-mode commands
(get, apply, setup, rollback, remove, repair), and add a short
"Typical workflow" footer to the root help.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 crates/socket-patch-cli/src/lib.rs            | 51 +++++++++++--------
 .../tests/help_text_hygiene.rs                | 39 +++++++++++---
 2 files changed, 62 insertions(+), 28 deletions(-)

diff --git a/crates/socket-patch-cli/src/lib.rs b/crates/socket-patch-cli/src/lib.rs
index da5533f0..c6437920 100644
--- a/crates/socket-patch-cli/src/lib.rs
+++ b/crates/socket-patch-cli/src/lib.rs
@@ -23,9 +23,15 @@ use clap::{Parser, Subcommand};
 #[derive(Parser)]
 #[command(
     name = "socket-patch",
-    about = "CLI tool for applying security patches to dependencies",
+    about = "Patch vulnerable dependencies with Socket's security patches",
     version,
-    propagate_version = true
+    propagate_version = true,
+    after_help = "Typical workflow:\n  \
+        socket-patch scan      Patch dependencies (rewrites lockfiles to Socket-hosted patched packages)\n  \
+        socket-patch vex       Emit an OpenVEX document for your vulnerability scanner\n  \
+        socket-patch vendor    Eject the patches into .socket/vendor/ for offline installs\n  \
+        socket-patch list      Show the patches in this project\n\n\
+        get, apply, setup, rollback, remove and repair are the older agent-mode commands."
 )]
 pub struct Cli {
     #[command(subcommand)]
@@ -50,14 +56,12 @@ pub struct Cli {
 
 #[derive(Subcommand)]
 pub enum Commands {
-    /// Scan installed packages for available security patches
+    /// Find patches for installed packages and apply them by rewriting
+    /// lockfiles to Socket-hosted patched packages
     Scan(commands::scan::ScanArgs),
 
-    /// Apply security patches to dependencies
-    Apply(commands::apply::ApplyArgs),
-
-    /// Generate an OpenVEX 0.2.0 attestation describing the
-    /// vulnerabilities mitigated by the applied patches.
+    /// Generate an OpenVEX 0.2.0 document for the vulnerabilities the
+    /// project's patches fix
     Vex(commands::vex::VexArgs),
 
     /// Eject patched dependencies into committable `.socket/vendor/` and
@@ -67,29 +71,34 @@ pub enum Commands {
     /// Socket API needed.
     Vendor(commands::vendor::VendorArgs),
 
-    /// Wire install hooks (npm, Python, Bundler, Composer) that re-apply
-    /// patches after install
-    Setup(commands::setup::SetupArgs),
-
-    /// Roll back patches to restore original files
-    Rollback(commands::rollback::RollbackArgs),
+    /// List the patches in this project: hosted and vendored lockfile
+    /// references plus any agent-mode manifest entries
+    List(commands::list::ListArgs),
 
-    /// Get security patches from the Socket API and apply them
+    /// Agent mode: get a patch from the Socket API and apply it
     #[command(visible_alias = "download")]
     Get(commands::get::GetArgs),
 
-    /// List all patches in the local manifest
-    List(commands::list::ListArgs),
+    /// Agent mode: apply the patches in `.socket/manifest.json` in place
+    Apply(commands::apply::ApplyArgs),
+
+    /// Agent mode: wire install hooks (npm, Python, Bundler, Composer) that
+    /// re-apply patches after install
+    Setup(commands::setup::SetupArgs),
+
+    /// Undo patches: restore original files and unwind hosted or vendored
+    /// lockfile wiring
+    Rollback(commands::rollback::RollbackArgs),
 
-    /// Remove a patch from the manifest by PURL or UUID (rolls back files first)
+    /// Agent mode: remove a patch from the manifest by PURL or UUID (rolls
+    /// back files first)
     Remove(commands::remove::RemoveArgs),
 
-    /// Download missing patch artifacts and clean up unused ones
+    /// Agent mode: download missing patch artifacts and clean up unused ones
     ///
     /// Restores missing blobs and diff/package archives, rebuilds missing
     /// or corrupt vendored artifacts, then deletes the artifacts nothing
-    /// references. It needs no scan; for the combined workflow (discover,
-    /// apply, clean up) use `scan --sync --json --yes`.
+    /// references.
     #[command(visible_alias = "gc")]
     Repair(commands::repair::RepairArgs),
 
diff --git a/crates/socket-patch-cli/tests/help_text_hygiene.rs b/crates/socket-patch-cli/tests/help_text_hygiene.rs
index 455ac4b3..9b2be79a 100644
--- a/crates/socket-patch-cli/tests/help_text_hygiene.rs
+++ b/crates/socket-patch-cli/tests/help_text_hygiene.rs
@@ -147,16 +147,43 @@ fn vex_product_list_renders_one_item_per_line() {
 fn root_command_list_uses_the_verb_form() {
     let text = long_help(&[]);
     assert!(
-        text.contains("Roll back patches to restore original files"),
+        text.contains("Undo patches: restore original files and unwind hosted or vendored lockfile wiring"),
         "{text}"
     );
     assert!(!text.contains("Rollback patches"), "{text}");
     assert!(
-        text.contains("Wire install hooks (npm, Python, Bundler, Composer)"),
+        text.contains("Agent mode: wire install hooks (npm, Python, Bundler, Composer)"),
         "{text}"
     );
 }
 
+/// v5 leads with scan, vex, vendor and list; the agent-mode commands follow.
+#[test]
+fn root_command_list_leads_with_the_v5_workflow() {
+    let text = long_help(&[]);
+    let order: Vec<&str> = text
+        .lines()
+        .filter_map(|l| l.strip_prefix("  "))
+        .filter_map(|l| l.split_whitespace().next())
+        .filter(|w| {
+            [
+                "scan", "vex", "vendor", "list", "get", "apply", "setup", "rollback", "remove",
+                "repair",
+            ]
+            .contains(w)
+        })
+        .collect();
+    assert_eq!(
+        &order[..10],
+        [
+            "scan", "vex", "vendor", "list", "get", "apply", "setup", "rollback", "remove",
+            "repair"
+        ],
+        "{text}"
+    );
+    assert!(text.contains("Typical workflow:"), "{text}");
+}
+
 #[test]
 fn vendor_and_repair_summaries_read_as_one_line() {
     let text = long_help(&[]);
@@ -167,17 +194,15 @@ fn vendor_and_repair_summaries_read_as_one_line() {
     );
     assert!(
         text.lines().any(|l| l
-            == "  repair    Download missing patch artifacts and clean up unused ones [aliases: gc]"),
+            == "  repair    Agent mode: download missing patch artifacts and clean up unused ones [aliases: gc]"),
         "{text}"
     );
     let repair = long_help(&["repair"]);
     assert!(
         repair.starts_with(
-            "Download missing patch artifacts and clean up unused ones\n\n\
+            "Agent mode: download missing patch artifacts and clean up unused ones\n\n\
              Restores missing blobs and diff/package archives, rebuilds missing or corrupt \
-             vendored artifacts, then deletes the artifacts nothing references. It needs no \
-             scan; for the combined workflow (discover, apply, clean up) use \
-             `scan --sync --json --yes`.\n"
+             vendored artifacts, then deletes the artifacts nothing references.\n"
         ),
         "{repair}"
     );

From d891d3b3d49ef00d63992b3967188964c66bbccb Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Sun, 27 Sep 2026 12:37:06 -0400
Subject: [PATCH 02/32] Prefer the newest merged patch when choosing one per
 package

A merged patch folds several advisories into one blob and is the
package's cumulative fix, so the newest one the user can download now
wins outright. Packages with no merged patch keep the old order:
highest severity, then newest.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 crates/socket-patch-cli/src/commands/get.rs |  22 +--
 crates/socket-patch-core/src/api/ranking.rs | 198 ++++++++++----------
 2 files changed, 109 insertions(+), 111 deletions(-)

diff --git a/crates/socket-patch-cli/src/commands/get.rs b/crates/socket-patch-cli/src/commands/get.rs
index 86e0dbbb..ca54e1cb 100644
--- a/crates/socket-patch-cli/src/commands/get.rs
+++ b/crates/socket-patch-cli/src/commands/get.rs
@@ -4295,30 +4295,28 @@ mod tests {
     }
 
     #[test]
-    fn select_prefers_a_higher_severity_patch_over_the_merged_one() {
-        // The exception. A merged patch must not shadow a worse
-        // vulnerability: `z_critical` addresses a CRITICAL the merged patch
-        // does not cover, so it wins despite being older, single-advisory,
-        // and last by uuid.
+    fn select_prefers_the_merged_patch_over_a_higher_severity_one() {
+        // A merged patch is the cumulative fix, so it wins even against a
+        // newer single-advisory CRITICAL.
         let patches = vec![
-            mk_patch_multi(
-                "a_merged",
+            mk_patch_sev(
+                "a_critical",
                 "pkg:npm/foo@1.0",
                 "free",
                 "2026-06-01",
-                &["high", "high"],
+                "critical",
             ),
-            mk_patch_sev(
-                "z_critical",
+            mk_patch_multi(
+                "z_merged",
                 "pkg:npm/foo@1.0",
                 "free",
                 "2020-01-01",
-                "critical",
+                &["high", "high"],
             ),
         ];
         let out = select_patches(&patches, true, &human_args()).expect("ok");
         assert_eq!(out.len(), 1);
-        assert_eq!(out[0].uuid, "z_critical");
+        assert_eq!(out[0].uuid, "z_merged");
     }
 
     #[test]
diff --git a/crates/socket-patch-core/src/api/ranking.rs b/crates/socket-patch-core/src/api/ranking.rs
index 71ce8b55..0e828ff7 100644
--- a/crates/socket-patch-core/src/api/ranking.rs
+++ b/crates/socket-patch-core/src/api/ranking.rs
@@ -10,38 +10,21 @@
 //!
 //! **The order, best first:**
 //!
-//! 1. **Severity** — critical > high > medium/moderate > low > unknown,
-//!    taken as the worst severity across everything the patch fixes.
-//! 2. **Merge state** — a patch that remediates *more* advisories in one
-//!    blob leads. See [`merged_coverage`] for how this is inferred.
-//! 3. **Patch publish date**, most recent first. This is the date *the
-//!    patch* was published, never the date the upstream package version
-//!    was released — a 2020 package routinely carries a patch published
-//!    last week, and two patches for one package have two different dates.
-//!    See [`crate::api::types::PatchResponse::published_at`].
-//! 4. Paid tier, then UUID — pure tiebreaks, present only so the order is
+//! 1. **Merged patches** — a patch that folds several advisories into one
+//!    blob (see [`merged_coverage`]), newest first. A merged patch is the
+//!    cumulative fix for its package, so the most recent one wins outright.
+//! 2. **Everything else** — by severity (critical > high > medium/moderate >
+//!    low > unknown, the worst severity across everything the patch fixes),
+//!    then newest first.
+//! 3. Paid tier, then UUID — pure tiebreaks, present only so the order is
 //!    total and therefore reproducible run to run.
 //!
-//! # Why severity sits above merge state
+//! "Newest" is the date *the patch* was published, never the date the
+//! upstream package version was released (see
+//! [`crate::api::types::PatchResponse::published_at`]).
 //!
-//! The merged patch is the general preference: it fixes the most in one
-//! shot, and the manifest only holds one patch per PURL, so breadth is
-//! what an operator actually wants. But it must not shadow a *worse*
-//! vulnerability. If a newly published patch addresses a higher-severity
-//! advisory than anything the merged patch covers, that one wins — you do
-//! not leave a critical unfixed to pick up two extra mediums.
-//!
-//! Putting severity on the top rung expresses exactly that, because the
-//! severity of a patch is the *worst* advisory it fixes:
-//!
-//! | merged patch | rival patch | winner | why |
-//! |---|---|---|---|
-//! | high  | critical | rival  | higher severity available |
-//! | critical | high  | merged | merged already covers the worst |
-//! | high  | high     | merged | severities tie → breadth decides |
-//!
-//! Note what is *not* a ranking signal: `tier` is an access filter. A free
-//! critical patch outranks a paid low one.
+//! `tier` is an access filter, not a ranking signal: callers drop the paid
+//! patches a free user cannot download before ranking.
 
 use std::cmp::{Ordering, Reverse};
 
@@ -88,12 +71,8 @@ pub fn max_severity_order<'a>(severities: impl Iterator<Item = &'a str>) -> u8 {
 /// one advisory routinely carries several CVE aliases, and counting those
 /// would inflate a single-fix patch into a phantom merged one.
 ///
-/// Empirically, production publishes no merged patches yet — all 28
-/// patches sampled across npm/PyPI/gem/cargo on 2026-08-05 covered exactly
-/// one advisory each, so this returns `1` for every patch live today. That
-/// is the correct answer, not a degenerate one: the ranking simply falls
-/// through to recency, and the moment Socket publishes a consolidated
-/// patch it is preferred automatically, with no client or server change.
+/// Production published its first merged patch on 2026-09-04
+/// (activestorage 6.0.3, three advisories).
 pub fn merged_coverage(advisory_count: usize) -> usize {
     advisory_count
 }
@@ -105,63 +84,68 @@ pub fn merged_coverage(advisory_count: usize) -> usize {
 /// meaning of each position is documented in one place.
 #[derive(Debug, PartialEq, Eq, PartialOrd, Ord)]
 struct RankKey<'a> {
-    /// 0 = critical … 4 = unknown. Top rung — see the module docs for why
-    /// this outranks merge state.
+    /// `false` sorts first: merged patches lead.
+    not_merged: bool,
+    /// 0 = critical … 4 = unknown. Always 0 for a merged patch, so merged
+    /// patches rank by recency alone.
     severity: u8,
-    /// Advisory count, most first (hence `Reverse`): the inferred merge
-    /// state from [`merged_coverage`]. Below severity so a merged patch
-    /// can never shadow a higher-severity fix; above recency so breadth
-    /// beats freshness when the severities tie.
-    coverage: Reverse<usize>,
-    /// Newest **patch** first — the patch's own publication date, not the
-    /// package's release date. Unparseable or absent timestamps collapse
-    /// to 0 and therefore sort last: the right treatment for a date we
-    /// cannot trust, and the reason this is epoch seconds rather than the
-    /// raw string (see [`crate::api::date`]).
+    /// Newest patch first. Unparseable or absent timestamps collapse to 0
+    /// and sort last (see [`crate::api::date`]).
     patch_published: Reverse<u64>,
-    /// `false` sorts first, so paid leads. A tiebreak only: it can never
-    /// override severity or recency.
+    /// `false` sorts first, so paid leads on an otherwise exact tie.
     not_paid: bool,
-    /// Total-order backstop. Without it, two patches identical in every
-    /// ranked dimension would keep their incoming (server / HashMap) order
-    /// and the CLI's output would not be reproducible.
+    /// Total-order backstop, so the output is reproducible.
     uuid: &'a str,
 }
 
-fn rank_search_result(p: &PatchSearchResult) -> RankKey<'_> {
+fn rank_key<'a>(
+    severity: u8,
+    advisories: usize,
+    published: u64,
+    tier: &str,
+    uuid: &'a str,
+) -> RankKey<'a> {
+    let merged = merged_coverage(advisories) >= 2;
     RankKey {
-        severity: max_severity_order(p.vulnerabilities.values().map(|v| v.severity.as_str())),
-        // The map is keyed by advisory id, so its length IS the advisory
-        // count — no CVE-alias inflation.
-        coverage: Reverse(merged_coverage(p.vulnerabilities.len())),
-        patch_published: Reverse(parse_timestamp_secs(&p.published_at).unwrap_or(0)),
-        not_paid: p.tier != "paid",
-        uuid: &p.uuid,
+        not_merged: !merged,
+        severity: if merged { 0 } else { severity },
+        patch_published: Reverse(published),
+        not_paid: tier != "paid",
+        uuid,
     }
 }
 
+fn rank_search_result(p: &PatchSearchResult) -> RankKey<'_> {
+    // The map is keyed by advisory id, so its length is the advisory count
+    // (no CVE-alias inflation).
+    rank_key(
+        max_severity_order(p.vulnerabilities.values().map(|v| v.severity.as_str())),
+        p.vulnerabilities.len(),
+        parse_timestamp_secs(&p.published_at).unwrap_or(0),
+        &p.tier,
+        &p.uuid,
+    )
+}
+
 fn rank_batch_info(p: &BatchPatchInfo) -> RankKey<'_> {
-    // `ghsa_ids` is the batch shape's mirror of the `vulnerabilities` map
-    // keys, so it is the advisory count. Fall back to `cve_ids` only when
-    // the server named no GHSA at all — otherwise a single advisory with
-    // two CVE aliases would read as a merged patch.
+    // `ghsa_ids` mirrors the `vulnerabilities` map keys. Fall back to
+    // `cve_ids` only when the server named no GHSA at all, otherwise one
+    // advisory with two CVE aliases would read as a merged patch.
     let advisories = if p.ghsa_ids.is_empty() {
         p.cve_ids.len()
     } else {
         p.ghsa_ids.len()
     };
-    RankKey {
-        severity: severity_order(p.severity.as_deref()),
-        coverage: Reverse(merged_coverage(advisories)),
-        patch_published: Reverse(
-            p.published_at
-                .as_deref()
-                .and_then(parse_timestamp_secs)
-                .unwrap_or(0),
-        ),
-        not_paid: p.tier != "paid",
-        uuid: &p.uuid,
-    }
+    rank_key(
+        severity_order(p.severity.as_deref()),
+        advisories,
+        p.published_at
+            .as_deref()
+            .and_then(parse_timestamp_secs)
+            .unwrap_or(0),
+        &p.tier,
+        &p.uuid,
+    )
 }
 
 /// Compare two search results best-first. Pass straight to `sort_by`.
@@ -171,9 +155,9 @@ pub fn cmp_search_results(a: &PatchSearchResult, b: &PatchSearchResult) -> Order
 
 /// Compare two batch-shaped patches best-first. Pass straight to `sort_by`.
 ///
-/// Ranks on the same key as [`cmp_search_results`], but the batch shape
-/// carries a server-computed max `severity` instead of a vulnerability map,
-/// and may omit `publishedAt` entirely.
+/// Same key as [`cmp_search_results`], but the batch shape carries a
+/// server-computed max `severity` instead of a vulnerability map, and may
+/// omit `publishedAt` entirely.
 pub fn cmp_batch_infos(a: &BatchPatchInfo, b: &BatchPatchInfo) -> Ordering {
     rank_batch_info(a).cmp(&rank_batch_info(b))
 }
@@ -336,23 +320,41 @@ mod tests {
     }
 
     #[test]
-    fn a_higher_severity_patch_beats_the_merged_one() {
-        // The exception. The merged patch consolidates two HIGHs, but a
-        // rival addresses a CRITICAL it does not cover. Taking breadth here
-        // would leave the worst vulnerability unfixed, so the CRITICAL
-        // wins — even though it is older, single-advisory, and its uuid
-        // sorts last.
+    fn a_merged_patch_beats_a_higher_severity_single_one() {
+        // A merged patch is the package's cumulative fix, so it wins even
+        // against a single-advisory CRITICAL that is its only rival.
         assert_eq!(
             best_search(vec![
+                search("a_critical", "free", "2026-08-01T00:00:00Z", "critical"),
                 search_multi(
-                    "a_merged",
+                    "z_merged",
                     "free",
-                    "2026-08-01T00:00:00Z",
+                    "2020-01-01T00:00:00Z",
                     &["high", "high"]
                 ),
-                search("z_critical", "free", "2020-01-01T00:00:00Z", "critical"),
             ]),
-            "z_critical"
+            "z_merged"
+        );
+    }
+
+    #[test]
+    fn the_newest_merged_patch_wins_whatever_its_severity() {
+        assert_eq!(
+            best_search(vec![
+                search_multi(
+                    "a_old_critical",
+                    "free",
+                    "2020-01-01T00:00:00Z",
+                    &["critical", "high"]
+                ),
+                search_multi(
+                    "z_new_low",
+                    "free",
+                    "2026-08-01T00:00:00Z",
+                    &["low", "low"]
+                ),
+            ]),
+            "z_new_low"
         );
     }
 
@@ -420,20 +422,18 @@ mod tests {
     }
 
     #[test]
-    fn patch_naming_no_advisory_ranks_below_a_single_advisory_patch() {
-        // Coverage 0: nothing to prefer it for. It is also newer and
-        // earlier by uuid, so only the coverage rung demotes it.
+    fn a_patch_naming_no_advisory_is_not_merged() {
+        // Coverage 0 and 1 are both unmerged, so with severities tied the
+        // newer patch wins.
         let none = PatchSearchResult {
             vulnerabilities: HashMap::new(),
-            ..search("a_none", "free", "2026-08-01T00:00:00Z", "high")
+            ..search("z_none", "free", "2026-08-01T00:00:00Z", "high")
         };
-        // Give both the same (unknown) severity so coverage is the decider:
-        // an empty vulnerabilities map ranks `severity_order(None)`.
         let one = PatchSearchResult {
             vulnerabilities: vulns(&[("GHSA-x", "not-a-severity")]),
-            ..search("z_one", "free", "2020-01-01T00:00:00Z", "high")
+            ..search("a_one", "free", "2020-01-01T00:00:00Z", "high")
         };
-        assert_eq!(best_search(vec![none, one]), "z_one");
+        assert_eq!(best_search(vec![none, one]), "z_none");
     }
 
     #[test]
@@ -674,7 +674,7 @@ mod tests {
             ]),
             "z_merged"
         );
-        // ...and a higher-severity rival still beats the merged patch.
+        // ...and beats a higher-severity single-advisory rival too.
         assert_eq!(
             best_batch(vec![
                 batch_multi(
@@ -691,7 +691,7 @@ mod tests {
                     Some("critical")
                 ),
             ]),
-            "z_crit"
+            "a_merged"
         );
     }
 

From b0a2ce6b30b96cf4b6607b9e2afb1b4d6826d9cd Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Sun, 27 Sep 2026 12:37:06 -0400
Subject: [PATCH 03/32] Make scan default to hosted mode and never prompt

A bare scan now runs hosted mode: it rewrites lockfiles so only the
patched dependencies resolve to Socket-hosted packages. A path-scoped,
--prune or global scan with no mode only reports, since it has no
lockfile to rewire.

scan asks nothing any more: no confirm prompt in any mode and no patch
menu. It takes the top-ranked patch per package.

New --package filter (repeatable or comma-separated, env
SOCKET_SCAN_PACKAGES) scopes a scan to packages by name or purl.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .../socket-patch-cli/src/commands/scan/mod.rs | 206 +++++++-----
 .../src/commands/scan/render.rs               |  95 +-----
 crates/socket-patch-cli/src/ui/mod.rs         |   7 +-
 crates/socket-patch-cli/src/ui/prompt.rs      |  10 +-
 .../socket-patch-cli/tests/cli_parse_scan.rs  |  18 +-
 .../socket-patch-cli/tests/cli_scan_silent.rs |   4 +
 .../tests/covgap_commands_scan_mod.rs         | 312 ++++--------------
 .../tests/in_process_cargo_apply.rs           |   3 +
 .../tests/in_process_gem_apply.rs             |   2 +
 .../tests/in_process_gem_multi_platform.rs    |   1 +
 .../tests/in_process_pypi_apply.rs            |   4 +
 .../tests/in_process_pypi_multi_release.rs    |   1 +
 .../tests/in_process_python_envs.rs           |   1 +
 .../tests/in_process_redirect.rs              |   1 +
 .../tests/in_process_redirect_pdm.rs          |   1 +
 .../tests/in_process_redirect_pipenv.rs       |   1 +
 .../tests/in_process_redirect_pnpm.rs         |   1 +
 .../tests/in_process_redirect_poetry.rs       |   1 +
 .../in_process_remote_ecosystems_apply.rs     |   1 +
 .../tests/in_process_rollback_hosted.rs       |   1 +
 .../socket-patch-cli/tests/in_process_scan.rs |   2 +
 .../tests/in_process_vendor.rs                |   1 +
 .../socket-patch-cli/tests/scan_invariants.rs |  10 +-
 .../socket-patch-cli/tests/telemetry_e2e.rs   |   2 +-
 24 files changed, 250 insertions(+), 436 deletions(-)

diff --git a/crates/socket-patch-cli/src/commands/scan/mod.rs b/crates/socket-patch-cli/src/commands/scan/mod.rs
index 8a3c52ef..be784d8b 100644
--- a/crates/socket-patch-cli/src/commands/scan/mod.rs
+++ b/crates/socket-patch-cli/src/commands/scan/mod.rs
@@ -239,6 +239,14 @@ pub fn resolve_mode_flags(args: &mut ScanArgs) -> Result<(), String> {
         args.mode = Some(ScanMode::Vendored);
     } else if args.apply || args.sync {
         args.mode = Some(ScanMode::Agent);
+    } else if args.paths.is_empty()
+        && !args.prune
+        && !args.common.global
+        && args.common.global_prefix.is_none()
+    {
+        // v5: hosted is the default. A path-scoped, `--prune` or global scan
+        // with no mode stays report-only (none of them can rewire lockfiles).
+        args.mode = Some(ScanMode::Hosted);
     }
     if !args.paths.is_empty()
         && matches!(args.mode, Some(ScanMode::Hosted) | Some(ScanMode::Vendored))
@@ -377,6 +385,17 @@ pub struct ScanArgs {
     )]
     pub all_releases: bool,
 
+    /// Only scan these packages: a name (`lodash`, `@scope/pkg`,
+    /// `requests`), or a purl with or without its version
+    /// (`pkg:npm/lodash`, `pkg:pypi/requests@2.31.0`). Repeat the flag or
+    /// separate with commas
+    #[arg(
+        long = "package",
+        env = "SOCKET_SCAN_PACKAGES",
+        value_delimiter = ','
+    )]
+    pub packages: Vec<String>,
+
     /// On a successful scan, also generate an OpenVEX 0.2.0 document.
     /// `--vex <path>` is the trigger; the `--vex-*` knobs mirror the
     /// standalone `vex` command. The document is built from the manifest
@@ -387,6 +406,44 @@ pub struct ScanArgs {
     pub vex: VexEmbedArgs,
 }
 
+/// Whether a `--package` spec names the package at `purl`: a purl spec
+/// matches the same purl, or any version of it when it carries none; a
+/// bare spec matches the package's full name (`@scope/pkg`, `group/name`)
+/// or its last segment. Qualifiers are ignored and names compare
+/// case-insensitively (PyPI, NuGet and Composer names are case-insensitive;
+/// npm forbids uppercase).
+pub(crate) fn package_spec_matches(spec: &str, purl: &str) -> bool {
+    let decoded = normalize_purl(strip_purl_qualifiers(purl)).to_lowercase();
+    let spec = spec.trim().to_lowercase();
+    if spec.is_empty() {
+        return false;
+    }
+    let Some(rest) = decoded.strip_prefix("pkg:") else {
+        return false;
+    };
+    let Some((_eco, name_version)) = rest.split_once('/') else {
+        return false;
+    };
+    let name = match name_version.rfind('@').filter(|&i| i > 0) {
+        Some(at) => &name_version[..at],
+        None => name_version,
+    };
+    if let Some(spec_rest) = spec.strip_prefix("pkg:") {
+        let spec_purl = normalize_purl(strip_purl_qualifiers(&format!("pkg:{spec_rest}"))).to_lowercase();
+        let spec_rest = &spec_purl[4..];
+        let has_version = spec_rest
+            .split_once('/')
+            .is_some_and(|(_, nv)| nv.rfind('@').is_some_and(|i| i > 0));
+        return if has_version {
+            decoded == spec_purl
+        } else {
+            decoded.strip_prefix(&spec_purl).is_some_and(|tail| tail.starts_with('@'))
+        };
+    }
+    let spec = spec.replace(':', "/");
+    name == spec || name.rsplit('/').next() == Some(spec.as_str())
+}
+
 /// Embedded-VEX side-effect for `scan`'s JSON terminal returns. When
 /// `--vex` was requested and `base_code` is 0, generate the OpenVEX
 /// document from the post-scan manifest and fold the outcome into
@@ -593,17 +650,13 @@ async fn discover_selected(
     .map_err(|code| (code, "patch selection failed".to_string()))
 }
 
-/// `common` with `json` off, for `select_patches`: scan has no "re-run
-/// with the chosen UUID" path, so it must never get `selection_required`.
-/// A `--json` run also counts as `--yes`: it must never stop at the
-/// interactive patch menu (on a TTY that menu would block a machine
-/// consumer), so it takes the menu's default, the top-ranked patch.
-/// (It still keeps the non-interactive note off stderr: the process-wide
-/// quiet switch mutes it.)
+/// `common` for `select_patches`: scan never prompts, so it always takes
+/// the top-ranked patch, and with `json` off it never gets
+/// `selection_required` (scan has no "re-run with the chosen UUID" path).
 fn selection_args(common: &GlobalArgs) -> GlobalArgs {
     GlobalArgs {
         json: false,
-        yes: common.yes || common.json,
+        yes: true,
         ..common.clone()
     }
 }
@@ -1834,6 +1887,19 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         all_crawled
     };
 
+    let filtered_crawled: Vec<_> = if args.packages.is_empty() {
+        filtered_crawled
+    } else {
+        filtered_crawled
+            .into_iter()
+            .filter(|pkg| {
+                args.packages
+                    .iter()
+                    .any(|spec| package_spec_matches(spec, &pkg.purl))
+            })
+            .collect()
+    };
+
     // PATH scoping — applied strictly AFTER the `scanned_purls` capture
     // above (the prune universe stays full-crawl: `scan PATHS --prune`
     // must never treat out-of-scope packages as uninstalled) and after the
@@ -2840,33 +2906,6 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
                 return code;
             }
         };
-        // The engine honors `--dry-run` itself (a preview mutates nothing),
-        // so only a wet run with work confirms. `--mode hosted` is explicit
-        // intent, so a non-TTY run auto-proceeds like every other mode —
-        // only the mode-less scan below is report-only.
-        let prompts = !selected.is_empty() && !args.common.dry_run;
-        // Whether that prompt waits on a person: the tree may change while it
-        // does, so the embedded VEX then walks node_modules afresh instead of
-        // reusing the pre-prompt crawl (as the vendor path below does).
-        let prompt_waits = prompts && ui::confirm_waits(&args.common);
-        if prompts {
-            let prompt = render::hosted_confirm_prompt(selected.len());
-            // The prompt (or the non-TTY note) opens its own paragraph
-            // under the table's Summary, on the prompt's stream.
-            if !silent && !args.common.yes {
-                eprintln!();
-            }
-            if !ui::confirm(&prompt, true, &args.common) {
-                if !silent {
-                    println!();
-                    for line in render::hosted_decline_hint() {
-                        println!("{line}");
-                    }
-                }
-                warn_unreported_corrupt_ledger(&args.common, hosted_corrupt_ledger.as_deref());
-                return embed_vex_human(&args.common, &args.vex, &manifest_path, 0).await;
-            }
-        }
         let pairs: Vec<(String, String)> = selected
             .iter()
             .map(|s| (s.purl.clone(), s.uuid.clone()))
@@ -2878,7 +2917,7 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
             &api_client,
             &pairs,
             None,
-            npm_crawl.as_ref().filter(|_| !prompt_waits),
+            npm_crawl.as_ref(),
         )
         .await;
     }
@@ -2894,14 +2933,10 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         return 1;
     }
 
-    // Prompt to download. A MODE-LESS human scan (no `--mode`/`--apply`/
-    // `--sync`/`--vendor`/`--redirect` and no `--prune`) with a non-TTY
-    // stdin and no `--yes` is report-only: it stops before the prompt with
-    // exit 0 and a hint, never downloads, never creates `.socket/`. This is
-    // a scan-side pre-check — `confirm()` itself keeps its non-TTY
-    // auto-accept, so every explicit-intent flag (and every other command's
-    // prompt) still proceeds unattended, and a TTY always prompts.
-    let report_only = args.mode.is_none() && !args.prune && !args.common.yes && !ui::stdin_is_tty();
+    // Scan never prompts. A scan left without a mode (path-scoped,
+    // `--prune` or global; see `resolve_mode_flags`) only reports, plus the
+    // `--prune` GC.
+    let report_only = args.mode.is_none();
 
     // Smart selection. A report-only run picks without the non-interactive
     // note: it never downloads, so there is no pick to announce.
@@ -3071,19 +3106,28 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         return finish_human(0).await;
     }
 
-    // Report-only (see `report_only` above): stop before the prompt.
     if report_only {
         // The "Patches to apply:" listing already ends with a blank line.
         if !silent {
-            for line in render::decline_hint(false) {
+            for line in render::report_only_hint() {
                 println!("{line}");
             }
         }
+        if prune {
+            gc::run_human_gc(
+                &args.common,
+                &manifest_path,
+                &socket_dir,
+                &scanned_purls,
+                &vendored_purls,
+            )
+            .await;
+        }
         return embed_vex_human(&args.common, &args.vex, &manifest_path, 0).await;
     }
 
-    // Vendor mode: pre-verify baselines so a content mismatch surfaces
-    // BEFORE the confirm prompt (vendoring still proceeds for these — the
+    // Vendor mode: pre-verify baselines so a content mismatch is reported
+    // before vendoring starts (vendoring still proceeds for these — the
     // stage force-applies the verified patched content). Runs after the
     // dry-run return above so a preview fetches no views; the views it
     // does fetch seed the download phase, which never fetches them again.
@@ -3105,7 +3149,6 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
             );
             any_mismatch = true;
         }
-        // Keep the prompt its own paragraph, as in the other flows.
         if any_mismatch {
             println!();
         }
@@ -3114,23 +3157,6 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         HashMap::new()
     };
 
-    // Whether the prompt below waits on a person: the tree may change while
-    // it does, so the vendor step then crawls afresh instead of reusing the
-    // pre-prompt crawl (`--yes` / `--json` / non-terminal answer at once).
-    let prompt_waits = ui::confirm_waits(&args.common);
-    if !ui::confirm(&render::confirm_prompt(plan), true, &args.common) {
-        if !silent {
-            println!();
-            for line in render::decline_hint(vendor) {
-                println!("{line}");
-            }
-            if prune {
-                eprintln!("{}", render::PRUNE_SKIPPED_DECLINED);
-            }
-        }
-        return embed_vex_human(&args.common, &args.vex, &manifest_path, 0).await;
-    }
-
     // Download, then apply in place — or vendor (vendored mode, where the
     // download only saves and the vendor step below does the rest).
     let params = download_params(
@@ -3154,7 +3180,7 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
             prune,
             telemetry_token.as_deref(),
             telemetry_org.as_deref(),
-            npm_crawl.as_ref().filter(|_| !prompt_waits),
+            npm_crawl.as_ref(),
         )
         .await
     } else {
@@ -3204,6 +3230,28 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
 mod tests {
     use super::*;
 
+    #[test]
+    fn package_specs_match_names_and_purls() {
+        let lodash = "pkg:npm/lodash@4.17.20";
+        let scoped = "pkg:npm/%40babel/core@7.0.0";
+        let maven = "pkg:maven/org.apache/commons-text@1.9";
+        assert!(package_spec_matches("lodash", lodash));
+        assert!(package_spec_matches("LoDash", lodash));
+        assert!(package_spec_matches("pkg:npm/lodash", lodash));
+        assert!(package_spec_matches("pkg:npm/lodash@4.17.20", lodash));
+        assert!(!package_spec_matches("pkg:npm/lodash@4.17.21", lodash));
+        assert!(!package_spec_matches("pkg:pypi/lodash", lodash));
+        assert!(!package_spec_matches("lodash-es", lodash));
+        assert!(!package_spec_matches("pkg:npm/lodash-es", lodash));
+        assert!(package_spec_matches("@babel/core", scoped));
+        assert!(package_spec_matches("core", scoped));
+        assert!(package_spec_matches("pkg:npm/@babel/core", scoped));
+        assert!(package_spec_matches("pkg:npm/%40babel/core", scoped));
+        assert!(package_spec_matches("org.apache:commons-text", maven));
+        assert!(package_spec_matches("commons-text", maven));
+        assert!(!package_spec_matches("", lodash));
+    }
+
     /// The load-then-derive form of [`overlap_from_states`]: the unit
     /// tests' entry point (production classifies over ledgers it already
     /// holds via `classify_overlap_takeover_with`). A malformed redirect
@@ -3482,19 +3530,17 @@ mod tests {
     }
 
     #[test]
-    fn selection_args_never_leaves_json_at_the_patch_menu() {
-        let json = selection_args(&GlobalArgs {
-            json: true,
-            ..GlobalArgs::default()
-        });
-        assert!(!json.json && json.yes, "--json selects like --yes");
-        let human = selection_args(&GlobalArgs::default());
-        assert!(!human.json && !human.yes, "a human run keeps its menu");
-        let yes = selection_args(&GlobalArgs {
-            yes: true,
-            ..GlobalArgs::default()
-        });
-        assert!(yes.yes);
+    fn selection_args_never_prompts() {
+        for common in [
+            GlobalArgs::default(),
+            GlobalArgs {
+                json: true,
+                ..GlobalArgs::default()
+            },
+        ] {
+            let picked = selection_args(&common);
+            assert!(!picked.json && picked.yes, "scan always takes the top patch");
+        }
     }
 
     #[test]
diff --git a/crates/socket-patch-cli/src/commands/scan/render.rs b/crates/socket-patch-cli/src/commands/scan/render.rs
index 65af51bc..f9c28fc8 100644
--- a/crates/socket-patch-cli/src/commands/scan/render.rs
+++ b/crates/socket-patch-cli/src/commands/scan/render.rs
@@ -223,11 +223,7 @@ pub(super) const PRUNE_SKIPPED_EMPTY: &str = "Warning: --prune skipped: no insta
      were found, and pruning every manifest entry is too destructive to do implicitly; run \
      `socket-patch repair` to clean up .socket/ explicitly.";
 
-/// Note printed when the user declines the download prompt of a
-/// `--prune` run: nothing is changed, the GC included.
-pub(super) const PRUNE_SKIPPED_DECLINED: &str = "Note: --prune skipped (download declined).";
-
-/// What the confirm prompt / dry-run line is about to do.
+/// What the dry-run line says the run would do.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub(super) enum Plan {
     /// Agent mode: download `n` patches and apply them in place.
@@ -236,22 +232,6 @@ pub(super) enum Plan {
     Vendor(usize),
 }
 
-/// The confirm prompt for `plan` (the `[Y/n]` hint is added by the prompt).
-pub(super) fn confirm_prompt(plan: Plan) -> String {
-    match plan {
-        Plan::Apply(n) => format!("Download and apply {}?", plural(n, "patch", "patches")),
-        Plan::Vendor(n) => format!("Download and vendor {}?", plural(n, "patch", "patches")),
-    }
-}
-
-/// The hosted-mode confirm prompt (the `[Y/n]` hint is added by the prompt).
-pub(super) fn hosted_confirm_prompt(n: usize) -> String {
-    format!(
-        "Redirect {} to the hosted patch server?",
-        plural(n, "package", "packages")
-    )
-}
-
 /// The `--dry-run` headline. `refused` counts the patches the vendored
 /// preflight would refuse (listed right after as `[would-refuse]` lines),
 /// so the headline never promises to vendor what the wet run refuses.
@@ -268,36 +248,17 @@ pub(super) fn dry_run_line(plan: Plan, refused: usize) -> String {
     format!("[dry-run] Would {what}. No changes made.")
 }
 
-/// Lines printed after the user declines the prompt: how to pick patches
-/// one at a time in the same mode.
-pub(super) fn decline_hint(vendor: bool) -> [String; 3] {
-    if vendor {
-        [
-            "To vendor a single patch, run:".to_string(),
-            "  socket-patch get <package-name-or-purl> --mode vendored".to_string(),
-            "  socket-patch get <CVE-ID> --mode vendored".to_string(),
-        ]
-    } else {
-        [
-            "To apply a single patch, run:".to_string(),
-            "  socket-patch get <package-name-or-purl>".to_string(),
-            "  socket-patch get <CVE-ID>".to_string(),
-        ]
-    }
-}
-
-/// Lines printed after the user declines the hosted-mode prompt: how to
-/// redirect packages one at a time (`get` defaults to agent mode, so the
-/// mode is named).
-pub(super) fn hosted_decline_hint() -> [String; 3] {
+/// Lines printed after a report-only scan (path-scoped, `--prune` or
+/// global, so no lockfile to rewire): how to apply what it found.
+pub(super) fn report_only_hint() -> [String; 3] {
     [
-        "To redirect a package, run:".to_string(),
-        "  socket-patch get <package-name-or-purl> --mode hosted".to_string(),
-        "  socket-patch get <CVE-ID> --mode hosted".to_string(),
+        "To apply these patches in place, run:".to_string(),
+        "  socket-patch scan --mode agent [PATHS]".to_string(),
+        "  socket-patch get <package-name-or-purl-or-CVE-ID>".to_string(),
     ]
 }
 
-/// Printed (vendored mode, before the prompt) for a selected package whose
+/// Printed (vendored mode, before vendoring) for a selected package whose
 /// installed bytes differ from the patch baseline: vendoring still
 /// proceeds, with the verified patched content.
 pub(super) fn baseline_mismatch_line(purl: &str) -> String {
@@ -741,31 +702,7 @@ mod tests {
         assert_eq!(generic, no_packages_message(false, None, &[]));
     }
 
-    // ---- prompt / dry-run / hints -------------------------------------------
-
-    #[test]
-    fn confirm_prompt_counts_patches() {
-        assert_eq!(
-            confirm_prompt(Plan::Apply(1)),
-            "Download and apply 1 patch?"
-        );
-        assert_eq!(
-            confirm_prompt(Plan::Apply(3)),
-            "Download and apply 3 patches?"
-        );
-        assert_eq!(
-            confirm_prompt(Plan::Vendor(2)),
-            "Download and vendor 2 patches?"
-        );
-        assert_eq!(
-            hosted_confirm_prompt(1),
-            "Redirect 1 package to the hosted patch server?"
-        );
-        assert_eq!(
-            hosted_confirm_prompt(2),
-            "Redirect 2 packages to the hosted patch server?"
-        );
-    }
+    // ---- dry-run / hints -------------------------------------------
 
     #[test]
     fn dry_run_line_counts_refusals() {
@@ -788,17 +725,9 @@ mod tests {
     }
 
     #[test]
-    fn decline_hint_matches_mode() {
-        assert_eq!(decline_hint(false)[0], "To apply a single patch, run:");
-        assert!(decline_hint(false).iter().all(|l| !l.contains("--mode")));
-        assert_eq!(decline_hint(true)[0], "To vendor a single patch, run:");
-        assert!(decline_hint(true)[1..]
-            .iter()
-            .all(|l| l.ends_with(" --mode vendored")));
-        assert_eq!(hosted_decline_hint()[0], "To redirect a package, run:");
-        assert!(hosted_decline_hint()[1..]
-            .iter()
-            .all(|l| l.ends_with(" --mode hosted")));
+    fn report_only_hint_names_agent_mode() {
+        assert_eq!(report_only_hint()[0], "To apply these patches in place, run:");
+        assert!(report_only_hint()[1].contains("--mode agent"));
     }
 
     #[test]
diff --git a/crates/socket-patch-cli/src/ui/mod.rs b/crates/socket-patch-cli/src/ui/mod.rs
index ae9f7225..3f0f651e 100644
--- a/crates/socket-patch-cli/src/ui/mod.rs
+++ b/crates/socket-patch-cli/src/ui/mod.rs
@@ -21,7 +21,7 @@ use std::io::IsTerminal;
 
 use crate::args::GlobalArgs;
 
-pub(crate) use prompt::{confirm, confirm_or_proceed, confirm_waits};
+pub(crate) use prompt::{confirm, confirm_or_proceed};
 pub use prompt::{select_one, SelectError};
 pub(crate) use status::StatusLine;
 pub(crate) use text::{plural, truncate};
@@ -48,11 +48,6 @@ pub(crate) fn print_json(v: &serde_json::Value) {
     );
 }
 
-/// Whether stdin is a terminal a person can answer prompts on.
-pub(crate) fn stdin_is_tty() -> bool {
-    std::io::stdin().is_terminal()
-}
-
 /// Whether `--silent`/`--json` is in effect for this process (see [`init`]).
 pub(crate) fn quiet() -> bool {
     socket_patch_core::utils::notice::is_quiet()
diff --git a/crates/socket-patch-cli/src/ui/prompt.rs b/crates/socket-patch-cli/src/ui/prompt.rs
index a48df963..e9eabc8f 100644
--- a/crates/socket-patch-cli/src/ui/prompt.rs
+++ b/crates/socket-patch-cli/src/ui/prompt.rs
@@ -42,11 +42,7 @@ pub(crate) fn confirm(prompt: &str, default_yes: bool, common: &GlobalArgs) -> b
     )
 }
 
-/// Whether [`confirm`] would stop and wait for a person to answer — a
-/// caller's clue that the world may change while it does (`scan` reuses a
-/// crawl across the prompt only when it does not wait). Derived from
-/// `confirm` itself rather than hand-copied at the call site: the drift
-/// that matters is the unsafe direction, a wait nobody accounted for.
+/// Whether [`confirm`] would stop and wait for a person to answer.
 pub(crate) fn confirm_waits(common: &GlobalArgs) -> bool {
     !(common.yes || common.json) && io::stdin().is_terminal()
 }
@@ -543,8 +539,8 @@ mod tests {
         ));
     }
 
-    /// `confirm_waits` is what `scan` plans its crawl reuse around, so it
-    /// must never say "no wait" for a case `confirm` would stop on. Over
+    /// `confirm_waits` must never say "no wait" for a case `confirm` would
+    /// stop on. Over
     /// the whole `{yes, json}` cube with this process's stdin (a pipe
     /// under the test harness, so never a terminal), it says no wait —
     /// and `confirm` indeed answers from its default without reading a
diff --git a/crates/socket-patch-cli/tests/cli_parse_scan.rs b/crates/socket-patch-cli/tests/cli_parse_scan.rs
index 3cb0cd32..ff27865a 100644
--- a/crates/socket-patch-cli/tests/cli_parse_scan.rs
+++ b/crates/socket-patch-cli/tests/cli_parse_scan.rs
@@ -518,6 +518,15 @@ fn scan_json_empty_cwd_emits_updates_key() {
         // v4 duality rework: the positional PATH globs are echoed on every
         // scan envelope, always present (empty when no scoping was given).
         "paths": [],
+        // v5: a bare scan runs hosted mode, so its result nests here.
+        "redirect": {
+            "mode": "hosted",
+            "redirected": 0,
+            "rewrittenFiles": [],
+            "skipped": [],
+            "warnings": [],
+            "dryRun": false
+        },
     });
     assert_eq!(
         v,
@@ -611,9 +620,14 @@ fn mode_agent_is_the_source_of_truth() {
         "--sync == --mode agent --prune"
     );
     assert!(folded.sync, "the prune half of --sync stays readable");
-    // No mode selected at all: scan stays read-only.
+    // v5: no mode selected means hosted...
     let folded = parse_and_resolve(&[]).expect("fold ok");
-    assert_eq!(folded.mode, None, "modeless scan is read-only");
+    assert_eq!(folded.mode, Some(ScanMode::Hosted), "a bare scan is hosted");
+    // ...except where no lockfile can be rewired: those stay report-only.
+    for argv in [&["--prune"][..], &["packages/foo"], &["--global"]] {
+        let folded = parse_and_resolve(argv).expect("fold ok");
+        assert_eq!(folded.mode, None, "{argv:?} stays report-only");
+    }
 }
 
 #[test]
diff --git a/crates/socket-patch-cli/tests/cli_scan_silent.rs b/crates/socket-patch-cli/tests/cli_scan_silent.rs
index acdb82ca..31cb2710 100644
--- a/crates/socket-patch-cli/tests/cli_scan_silent.rs
+++ b/crates/socket-patch-cli/tests/cli_scan_silent.rs
@@ -225,6 +225,8 @@ async fn scan_silent_apply_flow_produces_no_output_but_still_applies() {
     let (code, stdout, stderr) = run_scan(
         tmp.path(),
         &[
+            "--mode",
+            "agent",
             "--silent",
             "--yes",
             "--api-url",
@@ -274,6 +276,8 @@ async fn scan_silent_apply_flow_produces_no_output_but_still_applies() {
     let (loud_code, loud_stdout, loud_stderr) = run_scan(
         tmp2.path(),
         &[
+            "--mode",
+            "agent",
             "--yes",
             "--api-url",
             &mock.uri(),
diff --git a/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs b/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs
index 532f076f..a82258b2 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs
@@ -115,6 +115,14 @@ fn run_scan_human(cwd: &Path, api_url: &str, extra: &[&str]) -> (i32, String, St
     run_scan(cwd, &args)
 }
 
+/// [`run_scan_human`] in agent mode: v5's bare scan is hosted, and these
+/// fixtures exercise the in-place apply flow.
+fn run_scan_agent(cwd: &Path, api_url: &str, extra: &[&str]) -> (i32, String, String) {
+    let mut args = vec!["--mode", "agent"];
+    args.extend_from_slice(extra);
+    run_scan_human(cwd, api_url, &args)
+}
+
 async fn recorded(mock: &MockServer) -> Vec<wiremock::Request> {
     mock.received_requests()
         .await
@@ -579,7 +587,7 @@ async fn scan_paid_patch_with_access_counts_all_and_reports_detail_failure() {
     write_root_package_json(tmp.path());
     write_npm_package(tmp.path(), "minimist", "1.2.2", b"x\n");
 
-    let (code, stdout, stderr) = run_scan_human(tmp.path(), &mock.uri(), &[]);
+    let (code, stdout, stderr) = run_scan_agent(tmp.path(), &mock.uri(), &[]);
     assert_eq!(
         code, 1,
         "a failed detail fetch fails the scan; stdout={stdout}"
@@ -651,7 +659,7 @@ async fn scan_human_table_renders_update_marker_and_vuln_overflow() {
 
     // --dry-run keeps the run read-only past the table (the confirm and
     // apply never run), so no view/blob mocks are needed.
-    let (code, stdout, stderr) = run_scan_human(tmp.path(), &mock.uri(), &["--dry-run", "--yes"]);
+    let (code, stdout, stderr) = run_scan_agent(tmp.path(), &mock.uri(), &["--dry-run", "--yes"]);
     assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
     assert!(
         stdout.contains("[UPDATE]"),
@@ -693,7 +701,7 @@ async fn scan_human_detail_fetch_failure_errors_once() {
     write_root_package_json(tmp.path());
     write_npm_package(tmp.path(), "minimist", "1.2.2", b"x\n");
 
-    let (code, stdout, stderr) = run_scan_human(tmp.path(), &mock.uri(), &[]);
+    let (code, stdout, stderr) = run_scan_agent(tmp.path(), &mock.uri(), &[]);
     assert_eq!(code, 1, "stdout={stdout}; stderr={stderr}");
     assert!(
         stderr.contains(&format!(
@@ -748,7 +756,7 @@ async fn scan_human_partial_detail_fetch_failure_warns_per_package() {
     write_npm_package(tmp.path(), "minimist", "1.2.2", b"x\n");
     write_npm_package(tmp.path(), "lodash", "4.17.20", b"x\n");
 
-    let (code, stdout, stderr) = run_scan_human(tmp.path(), &mock.uri(), &["--dry-run"]);
+    let (code, stdout, stderr) = run_scan_agent(tmp.path(), &mock.uri(), &["--dry-run"]);
     assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
     assert_eq!(
         stderr
@@ -804,7 +812,7 @@ async fn scan_human_skips_vendored_purls_without_downloading() {
     )
     .unwrap();
 
-    let (code, stdout, stderr) = run_scan_human(tmp.path(), &mock.uri(), &["--yes"]);
+    let (code, stdout, stderr) = run_scan_agent(tmp.path(), &mock.uri(), &["--yes"]);
     assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
     assert!(
         stdout.contains(&format!(
@@ -864,7 +872,7 @@ async fn scan_human_preview_renders_vulnerability_details() {
     write_root_package_json(tmp.path());
     write_npm_package(tmp.path(), "minimist", "1.2.2", b"x\n");
 
-    let (code, stdout, stderr) = run_scan_human(tmp.path(), &mock.uri(), &["--dry-run", "--yes"]);
+    let (code, stdout, stderr) = run_scan_agent(tmp.path(), &mock.uri(), &["--dry-run", "--yes"]);
     assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
     assert!(
         stdout.contains("Fixes: "),
@@ -905,7 +913,7 @@ async fn scan_human_dry_run_vex_prints_the_shared_skip_line() {
     write_root_package_json(tmp.path());
     write_npm_package(tmp.path(), "minimist", "1.2.2", b"x\n");
 
-    let (code, stdout, stderr) = run_scan_human(
+    let (code, stdout, stderr) = run_scan_agent(
         tmp.path(),
         &mock.uri(),
         &["--dry-run", "--yes", "--vex", "out.vex.json"],
@@ -1076,7 +1084,7 @@ async fn scan_human_apply_over_live_hosted_wiring_warns_retained() {
     )
     .unwrap();
 
-    let (code, stdout, stderr) = run_scan_human(tmp.path(), &mock.uri(), &["--yes"]);
+    let (code, stdout, stderr) = run_scan_agent(tmp.path(), &mock.uri(), &["--yes"]);
     assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
     assert!(
         stderr.contains("Warning (hosted_wiring_retained):"),
@@ -1266,18 +1274,15 @@ async fn scan_human_empty_batch_reports_no_patches_once() {
 // Non-TTY human scans: the mode-less scan is report-only, explicit intent
 // auto-proceeds
 // ---------------------------------------------------------------------------
-// Every `Command::output()` child here has a non-TTY stdin. A bare `scan`
-// (no `--mode`/`--apply`/`--sync`/`--vendor`/`--redirect`, no `--prune`,
-// no `--yes`) must stop BEFORE the download with exit 0 and the get-hint,
-// creating nothing under `.socket/`; any intent flag keeps `confirm()`'s
-// non-TTY auto-accept and applies.
-
-/// Bare `scan` piped: the discovery, table and per-patch preview print
-/// (the report IS the value), then the run stops — no view fetch, no
-/// `.socket/`, the installed file untouched — and `confirm()` was never
-/// consulted (no "Non-interactive mode" line).
+// v5: scan never prompts. A bare scan runs hosted mode; a path-scoped,
+// `--prune` or global scan with no mode only reports (it has no lockfile
+// to rewire), and `--mode agent` applies in place without asking.
+
+/// A path-scoped scan with no mode: the discovery, table and per-patch
+/// preview print (the report IS the value), then the run stops — no view
+/// fetch, no `.socket/`, the installed file untouched.
 #[tokio::test]
-async fn scan_bare_human_non_tty_is_report_only() {
+async fn scan_path_scoped_human_without_a_mode_is_report_only() {
     let mock = MockServer::start().await;
     let purl = "pkg:npm/minimist@1.2.2";
     mount_one_patch_api(&mock, purl, b"x\n").await;
@@ -1286,7 +1291,7 @@ async fn scan_bare_human_non_tty_is_report_only() {
     write_root_package_json(tmp.path());
     write_npm_package(tmp.path(), "minimist", "1.2.2", b"x\n");
 
-    let (code, stdout, stderr) = run_scan_human(tmp.path(), &mock.uri(), &[]);
+    let (code, stdout, stderr) = run_scan_human(tmp.path(), &mock.uri(), &["node_modules"]);
     assert_eq!(
         code, 0,
         "report-only is a success; stdout={stdout}; stderr={stderr}"
@@ -1296,13 +1301,13 @@ async fn scan_bare_human_non_tty_is_report_only() {
         "the per-patch preview still prints; got {stdout:?}"
     );
     assert!(
-        stdout.contains("To apply a single patch, run:")
-            && stdout.contains("socket-patch get <CVE-ID>"),
-        "the get-hint must print; got {stdout:?}"
+        stdout.contains("To apply these patches in place, run:")
+            && stdout.contains("socket-patch scan --mode agent"),
+        "the agent-mode hint must print; got {stdout:?}"
     );
     assert!(
         !stderr.contains("Non-interactive mode detected"),
-        "confirm() must not be consulted on the report-only path; got {stderr:?}"
+        "scan never prompts; got {stderr:?}"
     );
     assert!(
         !tmp.path().join(".socket").exists(),
@@ -1321,11 +1326,9 @@ async fn scan_bare_human_non_tty_is_report_only() {
     );
 }
 
-/// The same piped run with an explicit intent flag (each spelling that
-/// folds to `--mode agent`) auto-proceeds through `confirm()`'s non-TTY
-/// default and applies.
+/// Each spelling that folds to `--mode agent` applies without prompting.
 #[tokio::test]
-async fn scan_human_non_tty_explicit_intent_auto_proceeds() {
+async fn scan_human_agent_mode_applies_without_prompting() {
     for flags in [&["--mode", "agent"][..], &["--apply"][..]] {
         let mock = MockServer::start().await;
         let purl = "pkg:npm/silent-target@1.0.0";
@@ -1339,8 +1342,8 @@ async fn scan_human_non_tty_explicit_intent_auto_proceeds() {
         let (code, stdout, stderr) = run_scan_human(tmp.path(), &mock.uri(), flags);
         assert_eq!(code, 0, "flags={flags:?}: stdout={stdout}; stderr={stderr}");
         assert!(
-            stderr.contains("Non-interactive mode detected, proceeding automatically."),
-            "flags={flags:?}: explicit intent keeps confirm()'s non-TTY auto-accept; got {stderr:?}"
+            !stderr.contains("Non-interactive mode detected"),
+            "flags={flags:?}: scan never prompts; got {stderr:?}"
         );
         assert_eq!(
             std::fs::read(tmp.path().join("node_modules/silent-target/index.js")).unwrap(),
@@ -1354,22 +1357,17 @@ async fn scan_human_non_tty_explicit_intent_auto_proceeds() {
     }
 }
 
-/// `--prune` alone is explicit intent too (it asks for a `.socket/`
-/// mutation): the piped run applies AND garbage-collects.
+/// `--mode agent --prune` applies AND garbage-collects, unprompted.
 #[tokio::test]
-async fn scan_human_non_tty_prune_counts_as_intent() {
+async fn scan_human_agent_prune_applies_and_collects() {
     let mock = MockServer::start().await;
     let (code, stdout, stderr, tmp) = run_apply_with_orphans(
         &mock,
         &[("pkg:npm/gone@1.0.0", OLD_UUID, 'c')],
-        &["--prune"],
+        &["--mode", "agent", "--prune"],
     )
     .await;
     assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
-    assert!(
-        stderr.contains("Non-interactive mode detected, proceeding automatically."),
-        "--prune auto-proceeds through confirm(); got {stderr:?}"
-    );
     assert!(
         stdout.contains("GC: pruned 1 manifest entry and removed 1 orphan file ("),
         "the GC still runs; got {stdout:?}"
@@ -1482,7 +1480,7 @@ fn seed_redirect_ledger(root: &Path, purl: &str, uuid: &str) {
 }
 
 #[tokio::test]
-async fn scan_hosted_human_prints_table_updates_and_confirms() {
+async fn scan_hosted_human_prints_table_updates_and_redirects() {
     let mock = MockServer::start().await;
     let purl = "pkg:npm/minimist@1.2.2";
     mount_batch_one(&mock, purl, UUID, "free", &["CVE-2024-0001"], false).await;
@@ -1496,7 +1494,8 @@ async fn scan_hosted_human_prints_table_updates_and_confirms() {
     // flag the newer offer in hosted mode too.
     seed_redirect_ledger(tmp.path(), purl, OLD_UUID);
 
-    let (code, stdout, stderr) = run_scan_human(tmp.path(), &mock.uri(), &["--mode", "hosted"]);
+    // v5: a bare scan is hosted.
+    let (code, stdout, stderr) = run_scan_human(tmp.path(), &mock.uri(), &[]);
     assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
     assert!(
         stdout.contains("VULNERABILITIES") && stdout.contains("CVE-2024-0001"),
@@ -1510,15 +1509,13 @@ async fn scan_hosted_human_prints_table_updates_and_confirms() {
         stdout.contains("[UPDATE]") && stdout.contains("1 package has a newer patch available."),
         "update detection must run in hosted mode; got {stdout:?}"
     );
-    // `--mode hosted` is explicit intent: the new prompt auto-accepts on a
-    // non-TTY stdin and the engine runs.
     assert!(
-        stderr.contains("Non-interactive mode detected, proceeding automatically."),
-        "the hosted confirm must run (and auto-accept) on a non-TTY; got {stderr:?}"
+        !stderr.contains("Non-interactive mode detected"),
+        "scan never prompts; got {stderr:?}"
     );
     assert!(
         stdout.contains("Redirected 0 packages"),
-        "the engine must run after the prompt; got {stdout:?}"
+        "the engine must run; got {stdout:?}"
     );
     let reqs = recorded(&mock).await;
     assert_eq!(
@@ -1538,11 +1535,8 @@ async fn scan_hosted_human_prints_table_updates_and_confirms() {
 }
 
 // ---------------------------------------------------------------------------
-// Declined download confirm via PTY (unix only)
+// Scan on a PTY (unix only)
 // ---------------------------------------------------------------------------
-// A non-TTY mode-less scan never reaches `confirm()` (report-only above),
-// and every explicit-intent run auto-accepts there, so only a PTY reaches
-// the decline arm: exit 0, the get-hint, and no mutation.
 
 #[cfg(unix)]
 mod pty {
@@ -1643,80 +1637,18 @@ mod pty {
         )
     }
 
+    /// v5 scan never prompts, even on a TTY: agent mode applies with no
+    /// input at all.
     #[tokio::test(flavor = "multi_thread")]
-    async fn scan_decline_at_download_prompt_exits_zero_without_mutation() {
+    async fn scan_on_a_tty_applies_without_prompting() {
         let mock = MockServer::start().await;
-        let purl = "pkg:npm/minimist@1.2.2";
-        mount_batch_one(&mock, purl, UUID, "free", &[], false).await;
-        mount_by_package(&mock, purl, UUID, serde_json::json!({})).await;
-
-        let tmp = tempfile::tempdir().unwrap();
-        write_root_package_json(tmp.path());
-        write_npm_package(tmp.path(), "minimist", "1.2.2", b"x\n");
-
-        let uri = mock.uri();
-        let cwd = tmp.path().to_path_buf();
-        let (code, output) = tokio::task::spawn_blocking(move || {
-            run_in_pty(
-                &[
-                    "scan",
-                    "--api-url",
-                    &uri,
-                    "--api-token",
-                    "fake-token-for-test",
-                    "--org",
-                    ORG_SLUG,
-                ],
-                &cwd,
-                "n\n",
-                Duration::from_secs(60),
-            )
-        })
-        .await
-        .expect("spawn_blocking join");
-
-        assert_eq!(code, 0, "declining is not an error; output:\n{output}");
-        // The prompt genuinely ran (a regression auto-proceeding in a TTY
-        // would skip it — and would mutate, failing below too).
-        assert!(
-            output.contains("Download and apply 1 patch?"),
-            "the confirm prompt must have shown; got:\n{output}"
-        );
-        assert!(
-            output.contains("To apply a single patch, run:"),
-            "the decline hint must print; got:\n{output}"
-        );
-        assert!(
-            output.contains("socket-patch get <CVE-ID>"),
-            "the decline hint names the get command; got:\n{output}"
-        );
-
-        // Decline mutates nothing: no manifest, untouched file, no download.
-        assert!(
-            !tmp.path().join(".socket/manifest.json").exists(),
-            "declining must not create the manifest"
-        );
-        assert_eq!(
-            std::fs::read(tmp.path().join("node_modules/minimist/index.js")).unwrap(),
-            b"x\n",
-            "declining must not patch the installed file"
-        );
-        let reqs = recorded(&mock).await;
-        assert_eq!(view_gets(&reqs), 0, "declining must not download the patch");
-    }
-
-    /// Declining the vendored-mode prompt points at the vendored `get`,
-    /// not the in-place one (which would apply instead of vendoring).
-    #[tokio::test(flavor = "multi_thread")]
-    async fn scan_vendored_decline_hint_names_vendored_get() {
-        let mock = MockServer::start().await;
-        let purl = "pkg:npm/minimist@1.2.2";
-        mount_batch_one(&mock, purl, UUID, "free", &[], false).await;
-        mount_by_package(&mock, purl, UUID, serde_json::json!({})).await;
+        let purl = "pkg:npm/silent-target@1.0.0";
+        let before = b"before\n";
+        mount_one_patch_api(&mock, purl, before).await;
 
         let tmp = tempfile::tempdir().unwrap();
         write_root_package_json(tmp.path());
-        write_npm_package(tmp.path(), "minimist", "1.2.2", b"x\n");
+        write_npm_package(tmp.path(), "silent-target", "1.0.0", before);
 
         let uri = mock.uri();
         let cwd = tmp.path().to_path_buf();
@@ -1725,7 +1657,7 @@ mod pty {
                 &[
                     "scan",
                     "--mode",
-                    "vendored",
+                    "agent",
                     "--api-url",
                     &uri,
                     "--api-token",
@@ -1734,26 +1666,22 @@ mod pty {
                     ORG_SLUG,
                 ],
                 &cwd,
-                "n\n",
+                "",
                 Duration::from_secs(60),
             )
         })
         .await
         .expect("spawn_blocking join");
 
-        assert_eq!(code, 0, "declining is not an error; output:\n{output}");
-        assert!(
-            output.contains("Download and vendor 1 patch?"),
-            "the vendored prompt must have shown; got:\n{output}"
-        );
+        assert_eq!(code, 0, "output:\n{output}");
         assert!(
-            output.contains("To vendor a single patch, run:")
-                && output.contains("socket-patch get <package-name-or-purl> --mode vendored"),
-            "the decline hint must name the vendored get; got:\n{output}"
+            !output.contains("[Y/n]") && !output.contains("Download and apply"),
+            "scan must not prompt; got:\n{output}"
         );
-        assert!(
-            !output.contains("To apply a single patch"),
-            "no agent-mode hint in vendored mode; got:\n{output}"
+        assert_eq!(
+            std::fs::read(tmp.path().join("node_modules/silent-target/index.js")).unwrap(),
+            b"after\n",
+            "the apply must proceed unattended"
         );
     }
 
@@ -1921,63 +1849,6 @@ mod pty {
         }
     }
 
-    /// Keystrokes typed while the scan is still querying the API must not
-    /// answer the default-yes download prompt: `confirm` discards
-    /// typeahead before showing it. Without the flush, the early "n\n"
-    /// would decline; with it, the Enter sent at the prompt takes the
-    /// default (yes) and the patch is applied.
-    #[tokio::test(flavor = "multi_thread")]
-    async fn scan_typeahead_before_the_prompt_is_discarded() {
-        let mock = MockServer::start().await;
-        let purl = "pkg:npm/typeahead-target@1.0.0";
-        let before = b"before\n";
-        // The batch answers late, so the early "n\n" is certainly sitting
-        // in the terminal's input queue before the prompt appears.
-        mount_one_patch_api_delayed(&mock, purl, before, Duration::from_millis(1500)).await;
-
-        let tmp = tempfile::tempdir().unwrap();
-        write_root_package_json(tmp.path());
-        write_npm_package(tmp.path(), "typeahead-target", "1.0.0", before);
-
-        let uri = mock.uri();
-        let cwd = tmp.path().to_path_buf();
-        let (code, output) = tokio::task::spawn_blocking(move || {
-            run_in_pty_with(
-                &[
-                    "scan",
-                    "--api-url",
-                    &uri,
-                    "--api-token",
-                    "fake-token-for-test",
-                    "--org",
-                    ORG_SLUG,
-                ],
-                &cwd,
-                &[],
-                "n\n",
-                "\n",
-                Duration::from_secs(60),
-            )
-        })
-        .await
-        .expect("spawn_blocking join");
-
-        assert_eq!(code, 0, "output:\n{output}");
-        assert!(
-            output.contains("Download and apply 1 patch? [Y/n] "),
-            "the default-yes prompt must have shown; got:\n{output}"
-        );
-        assert!(
-            !output.contains("To apply a single patch, run:"),
-            "the early \"n\" must not have declined the prompt; got:\n{output}"
-        );
-        assert_eq!(
-            std::fs::read(tmp.path().join("node_modules/typeahead-target/index.js")).unwrap(),
-            b"after\n",
-            "the Enter at the prompt takes the default and applies; got:\n{output}"
-        );
-    }
-
     /// Under `SOCKET_DEBUG` core prints `[socket-patch debug] ...` lines
     /// straight to stderr. The live status line is off then, so those
     /// lines never land glued onto the end of a progress message.
@@ -2043,69 +1914,6 @@ mod pty {
         );
     }
 
-    /// The hosted twin: declining "Redirect N packages …?" exits 0 with
-    /// the hosted get-hint and never enters the engine (no reference
-    /// resolve, no `.socket/`).
-    #[tokio::test(flavor = "multi_thread")]
-    async fn scan_hosted_decline_at_redirect_prompt_exits_zero_without_mutation() {
-        let mock = MockServer::start().await;
-        let purl = "pkg:npm/minimist@1.2.2";
-        mount_batch_one(&mock, purl, UUID, "free", &[], false).await;
-        mount_by_package(&mock, purl, UUID, serde_json::json!({})).await;
-        mount_forbidden_reference(&mock, purl).await;
-
-        let tmp = tempfile::tempdir().unwrap();
-        write_root_package_json(tmp.path());
-        write_npm_package(tmp.path(), "minimist", "1.2.2", b"x\n");
-
-        let uri = mock.uri();
-        let cwd = tmp.path().to_path_buf();
-        let (code, output) = tokio::task::spawn_blocking(move || {
-            run_in_pty(
-                &[
-                    "scan",
-                    "--mode",
-                    "hosted",
-                    "--api-url",
-                    &uri,
-                    "--api-token",
-                    "fake-token-for-test",
-                    "--org",
-                    ORG_SLUG,
-                ],
-                &cwd,
-                "n\n",
-                Duration::from_secs(60),
-            )
-        })
-        .await
-        .expect("spawn_blocking join");
-
-        assert_eq!(code, 0, "declining is not an error; output:\n{output}");
-        assert!(
-            output.contains("Redirect 1 package to the hosted patch server?"),
-            "the hosted confirm prompt must have shown; got:\n{output}"
-        );
-        assert!(
-            output.contains("To redirect a package, run:")
-                && output.contains("socket-patch get <CVE-ID> --mode hosted"),
-            "the hosted decline hint must print; got:\n{output}"
-        );
-        assert!(
-            !output.contains("Redirected"),
-            "declining must not enter the redirect engine; got:\n{output}"
-        );
-        assert!(
-            !tmp.path().join(".socket").exists(),
-            "declining must create nothing under .socket/"
-        );
-        let reqs = recorded(&mock).await;
-        assert_eq!(
-            reference_posts(&reqs),
-            0,
-            "declining must not resolve the hosted reference"
-        );
-    }
 }
 
 // ---------------------------------------------------------------------------
@@ -2482,7 +2290,7 @@ async fn scan_human_does_not_offer_an_already_recorded_patch() {
     write_npm_package(tmp.path(), "minimist", "1.2.2", b"x\n");
     seed_manifest(tmp.path(), &[(purl, UUID)]);
 
-    let (code, stdout, stderr) = run_scan_human(tmp.path(), &mock.uri(), &["--yes"]);
+    let (code, stdout, stderr) = run_scan_agent(tmp.path(), &mock.uri(), &["--yes"]);
     assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
     assert!(
         stdout.contains(&format!("[skip] {purl} (already recorded: 11111111)")),
diff --git a/crates/socket-patch-cli/tests/in_process_cargo_apply.rs b/crates/socket-patch-cli/tests/in_process_cargo_apply.rs
index b85ef413..fce505b3 100644
--- a/crates/socket-patch-cli/tests/in_process_cargo_apply.rs
+++ b/crates/socket-patch-cli/tests/in_process_cargo_apply.rs
@@ -221,6 +221,7 @@ async fn cargo_fetch_scan_sync_patches_real_file() {
 
     let args = ScanArgs {
         paths: Vec::new(),
+        packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
             cwd: tmp.path().join("proj"),
             org: Some(ORG.to_string()),
@@ -337,6 +338,7 @@ async fn cargo_apply_refuses_on_before_hash_mismatch() {
 
     let args = ScanArgs {
         paths: Vec::new(),
+        packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
             cwd: tmp.path().join("proj"),
             org: Some(ORG.to_string()),
@@ -439,6 +441,7 @@ async fn cargo_crawler_finds_real_fetched_crate() {
     std::env::set_var("CARGO_HOME", &cargo_home);
     let args = ScanArgs {
         paths: Vec::new(),
+        packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
             cwd: tmp.path().join("proj"),
             org: Some(ORG.to_string()),
diff --git a/crates/socket-patch-cli/tests/in_process_gem_apply.rs b/crates/socket-patch-cli/tests/in_process_gem_apply.rs
index 2f5fd7d2..33d64d1e 100644
--- a/crates/socket-patch-cli/tests/in_process_gem_apply.rs
+++ b/crates/socket-patch-cli/tests/in_process_gem_apply.rs
@@ -200,6 +200,7 @@ async fn gem_install_scan_sync_patches_real_file() {
 
     let args = ScanArgs {
         paths: Vec::new(),
+        packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
             cwd: tmp.path().to_path_buf(),
             org: Some(ORG.to_string()),
@@ -312,6 +313,7 @@ async fn gem_crawler_finds_real_installed_gem() {
 
     let args = ScanArgs {
         paths: Vec::new(),
+        packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
             cwd: tmp.path().to_path_buf(),
             org: Some(ORG.to_string()),
diff --git a/crates/socket-patch-cli/tests/in_process_gem_multi_platform.rs b/crates/socket-patch-cli/tests/in_process_gem_multi_platform.rs
index 15d7ebf9..ecf70b37 100644
--- a/crates/socket-patch-cli/tests/in_process_gem_multi_platform.rs
+++ b/crates/socket-patch-cli/tests/in_process_gem_multi_platform.rs
@@ -218,6 +218,7 @@ async fn mount_view(
 fn scan_args(cwd: &Path, api_url: String, all_releases: bool) -> ScanArgs {
     ScanArgs {
         paths: Vec::new(),
+        packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
             cwd: cwd.to_path_buf(),
             org: Some(ORG.to_string()),
diff --git a/crates/socket-patch-cli/tests/in_process_pypi_apply.rs b/crates/socket-patch-cli/tests/in_process_pypi_apply.rs
index 91d8c7ff..8e9de4c3 100644
--- a/crates/socket-patch-cli/tests/in_process_pypi_apply.rs
+++ b/crates/socket-patch-cli/tests/in_process_pypi_apply.rs
@@ -249,6 +249,7 @@ async fn pypi_install_scan_sync_patches_real_file() {
 
     let mut args = ScanArgs {
         paths: Vec::new(),
+        packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
             cwd: tmp.path().to_path_buf(),
             org: Some(ORG.to_string()),
@@ -325,6 +326,7 @@ async fn pypi_scan_then_apply_force_patches_real_file() {
     // 1. scan --sync to write the manifest + blob.
     let scan_args = ScanArgs {
         paths: Vec::new(),
+        packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
             cwd: tmp.path().to_path_buf(),
             org: Some(ORG.to_string()),
@@ -434,6 +436,7 @@ async fn pypi_apply_dry_run_does_not_modify_file() {
 
     let scan_args = ScanArgs {
         paths: Vec::new(),
+        packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
             cwd: tmp.path().to_path_buf(),
             org: Some(ORG.to_string()),
@@ -566,6 +569,7 @@ async fn pypi_crawler_finds_real_installed_six() {
 
     let args = ScanArgs {
         paths: Vec::new(),
+        packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
             cwd: tmp.path().to_path_buf(),
             org: Some(ORG.to_string()),
diff --git a/crates/socket-patch-cli/tests/in_process_pypi_multi_release.rs b/crates/socket-patch-cli/tests/in_process_pypi_multi_release.rs
index 639d635e..18b866a9 100644
--- a/crates/socket-patch-cli/tests/in_process_pypi_multi_release.rs
+++ b/crates/socket-patch-cli/tests/in_process_pypi_multi_release.rs
@@ -292,6 +292,7 @@ async fn mount_view(
 fn scan_args(tmp: &Path, api_url: String, all_releases: bool) -> ScanArgs {
     ScanArgs {
         paths: Vec::new(),
+        packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
             cwd: tmp.to_path_buf(),
             org: Some(ORG.to_string()),
diff --git a/crates/socket-patch-cli/tests/in_process_python_envs.rs b/crates/socket-patch-cli/tests/in_process_python_envs.rs
index 29e1c4ec..95325a01 100644
--- a/crates/socket-patch-cli/tests/in_process_python_envs.rs
+++ b/crates/socket-patch-cli/tests/in_process_python_envs.rs
@@ -115,6 +115,7 @@ async fn scan_scrubbed(args: ScanArgs) -> i32 {
 fn default_args(cwd: &Path, api_url: String) -> ScanArgs {
     ScanArgs {
         paths: Vec::new(),
+        packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
             cwd: cwd.to_path_buf(),
             org: Some(ORG.to_string()),
diff --git a/crates/socket-patch-cli/tests/in_process_redirect.rs b/crates/socket-patch-cli/tests/in_process_redirect.rs
index eb77b79e..7299c758 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect.rs
@@ -44,6 +44,7 @@ const GHSA: &str = "GHSA-rdir-aaaa-bbbb";
 fn redirect_args(cwd: &Path, api_url: String) -> ScanArgs {
     ScanArgs {
         paths: Vec::new(),
+        packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
             cwd: cwd.to_path_buf(),
             org: Some(ORG.to_string()),
diff --git a/crates/socket-patch-cli/tests/in_process_redirect_pdm.rs b/crates/socket-patch-cli/tests/in_process_redirect_pdm.rs
index a42a8f6c..da069fcb 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect_pdm.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect_pdm.rs
@@ -75,6 +75,7 @@ fn global(cwd: &Path, api_url: String) -> GlobalArgs {
 fn hosted_args(cwd: &Path, api_url: String, vex: Option<&Path>) -> ScanArgs {
     ScanArgs {
         paths: Vec::new(),
+        packages: Vec::new(),
         common: global(cwd, api_url),
         batch_size: Some(100),
         apply: false,
diff --git a/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs b/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs
index 1d01bc2d..1ebec913 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs
@@ -80,6 +80,7 @@ fn global(cwd: &Path, api_url: String) -> GlobalArgs {
 fn hosted_args(cwd: &Path, api_url: String, vex: Option<&Path>) -> ScanArgs {
     ScanArgs {
         paths: Vec::new(),
+        packages: Vec::new(),
         common: global(cwd, api_url),
         batch_size: Some(100),
         apply: false,
diff --git a/crates/socket-patch-cli/tests/in_process_redirect_pnpm.rs b/crates/socket-patch-cli/tests/in_process_redirect_pnpm.rs
index 3ea3791c..a3a2eb35 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect_pnpm.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect_pnpm.rs
@@ -34,6 +34,7 @@ const GHSA: &str = "GHSA-rdir-pnpm-bbbb";
 fn hosted_args(cwd: &Path, api_url: String) -> ScanArgs {
     ScanArgs {
         paths: Vec::new(),
+        packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
             cwd: cwd.to_path_buf(),
             org: Some(ORG.to_string()),
diff --git a/crates/socket-patch-cli/tests/in_process_redirect_poetry.rs b/crates/socket-patch-cli/tests/in_process_redirect_poetry.rs
index 58813cb2..b26c7af3 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect_poetry.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect_poetry.rs
@@ -59,6 +59,7 @@ fn global(cwd: &Path, api_url: String) -> GlobalArgs {
 fn hosted_args(cwd: &Path, api_url: String, vex: Option<&Path>) -> ScanArgs {
     ScanArgs {
         paths: Vec::new(),
+        packages: Vec::new(),
         common: global(cwd, api_url),
         batch_size: Some(100),
         apply: false,
diff --git a/crates/socket-patch-cli/tests/in_process_remote_ecosystems_apply.rs b/crates/socket-patch-cli/tests/in_process_remote_ecosystems_apply.rs
index 3bb1d39e..6ef4aaa6 100644
--- a/crates/socket-patch-cli/tests/in_process_remote_ecosystems_apply.rs
+++ b/crates/socket-patch-cli/tests/in_process_remote_ecosystems_apply.rs
@@ -73,6 +73,7 @@ async fn assert_discovered_purl(server: &MockServer, expected_purl: &str) {
 fn default_scan_args(cwd: &Path, eco: &str, api_url: String) -> ScanArgs {
     ScanArgs {
         paths: Vec::new(),
+        packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
             cwd: cwd.to_path_buf(),
             org: Some(ORG.to_string()),
diff --git a/crates/socket-patch-cli/tests/in_process_rollback_hosted.rs b/crates/socket-patch-cli/tests/in_process_rollback_hosted.rs
index b4569c12..36d3b3a0 100644
--- a/crates/socket-patch-cli/tests/in_process_rollback_hosted.rs
+++ b/crates/socket-patch-cli/tests/in_process_rollback_hosted.rs
@@ -63,6 +63,7 @@ const GEM_PATCH_REMOTE: &str = "http://patch.test/gems/t0k3nt0k3n/";
 fn hosted_scan_args(cwd: &Path, api_url: String) -> ScanArgs {
     ScanArgs {
         paths: Vec::new(),
+        packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
             cwd: cwd.to_path_buf(),
             org: Some(ORG.to_string()),
diff --git a/crates/socket-patch-cli/tests/in_process_scan.rs b/crates/socket-patch-cli/tests/in_process_scan.rs
index cf4bf1c4..a63d8efe 100644
--- a/crates/socket-patch-cli/tests/in_process_scan.rs
+++ b/crates/socket-patch-cli/tests/in_process_scan.rs
@@ -20,6 +20,7 @@ const UUID: &str = "11111111-1111-4111-8111-111111111111";
 fn default_args(cwd: &Path) -> ScanArgs {
     ScanArgs {
         paths: Vec::new(),
+        packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
             cwd: cwd.to_path_buf(),
             org: Some(ORG.to_string()),
@@ -877,6 +878,7 @@ async fn scan_non_json_with_patches_prints_table() {
     let mut args = default_args(tmp.path());
     args.common.api_url = Some(server.uri());
     args.common.json = false;
+    args.mode = Some(socket_patch_cli::commands::scan::ScanMode::Agent);
 
     let code = run_scrubbed(args).await;
     // Non-JSON path: discovery → batch query → render table → fetch
diff --git a/crates/socket-patch-cli/tests/in_process_vendor.rs b/crates/socket-patch-cli/tests/in_process_vendor.rs
index f3140b4c..f9e66e87 100644
--- a/crates/socket-patch-cli/tests/in_process_vendor.rs
+++ b/crates/socket-patch-cli/tests/in_process_vendor.rs
@@ -3131,6 +3131,7 @@ snapshots:
     fn hosted_args(cwd: &Path, api_url: String) -> ScanArgs {
         ScanArgs {
             paths: Vec::new(),
+            packages: Vec::new(),
             common: GlobalArgs {
                 cwd: cwd.to_path_buf(),
                 org: Some(ORG.to_string()),
diff --git a/crates/socket-patch-cli/tests/scan_invariants.rs b/crates/socket-patch-cli/tests/scan_invariants.rs
index 2aab0020..f45d4b03 100644
--- a/crates/socket-patch-cli/tests/scan_invariants.rs
+++ b/crates/socket-patch-cli/tests/scan_invariants.rs
@@ -1705,7 +1705,7 @@ async fn report_only_scan_json_surfaces_hosted_redirect_state() {
     );
 
     // No mode flag: the read-only discovery envelope.
-    let (code, stdout, stderr) = run_scan(tmp.path(), &mock.uri(), &[]);
+    let (code, stdout, stderr) = run_scan(tmp.path(), &mock.uri(), &["--mode", "agent", "--dry-run"]);
     assert_eq!(
         code, 0,
         "report-only scan must stay exit 0; stdout={stdout}; stderr={stderr}"
@@ -1820,7 +1820,7 @@ async fn report_only_scan_json_redirect_state_splits_records_from_live_proof() {
     )
     .unwrap();
 
-    let (code, stdout, stderr) = run_scan(tmp.path(), &mock.uri(), &[]);
+    let (code, stdout, stderr) = run_scan(tmp.path(), &mock.uri(), &["--mode", "agent", "--dry-run"]);
     assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
     let v: serde_json::Value = serde_json::from_str(stdout.trim()).expect("valid JSON");
     let state = &v["redirectState"];
@@ -2030,7 +2030,7 @@ async fn silent_gates_scan_malformed_ledger_warning() {
     std::fs::write(vendor_dir.join("redirect-state.json"), "{ torn ledger").unwrap();
 
     // Control: without --silent the corruption is surfaced on stderr.
-    let (code, stdout, stderr) = run_scan(tmp.path(), &mock.uri(), &[]);
+    let (code, stdout, stderr) = run_scan(tmp.path(), &mock.uri(), &["--mode", "agent", "--dry-run"]);
     assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
     assert!(
         stderr.contains("malformed"),
@@ -2043,7 +2043,7 @@ async fn silent_gates_scan_malformed_ledger_warning() {
     );
 
     // --silent mutes the advisory warning; the run is otherwise identical.
-    let (code, stdout, stderr) = run_scan(tmp.path(), &mock.uri(), &["--silent"]);
+    let (code, stdout, stderr) = run_scan(tmp.path(), &mock.uri(), &["--mode", "agent", "--dry-run", "--silent"]);
     assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
     assert!(
         !stderr.contains("malformed"),
@@ -2075,7 +2075,7 @@ async fn ecosystems_filter_keeps_records_but_not_wiring_live() {
         /*with_record=*/ true,
     );
 
-    let (code, stdout, stderr) = run_scan(tmp.path(), &mock.uri(), &["--ecosystems", "pypi"]);
+    let (code, stdout, stderr) = run_scan(tmp.path(), &mock.uri(), &["--mode", "agent", "--dry-run", "--ecosystems", "pypi"]);
     assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
     let v: serde_json::Value = serde_json::from_str(stdout.trim()).expect("valid JSON");
     let state = &v["redirectState"];
diff --git a/crates/socket-patch-cli/tests/telemetry_e2e.rs b/crates/socket-patch-cli/tests/telemetry_e2e.rs
index cbfdb3af..9103a3bc 100644
--- a/crates/socket-patch-cli/tests/telemetry_e2e.rs
+++ b/crates/socket-patch-cli/tests/telemetry_e2e.rs
@@ -983,7 +983,7 @@ async fn scan_delivers_telemetry_before_writing_to_a_closed_stderr() {
     const TELEMETRY_DELAY: std::time::Duration = std::time::Duration::from_millis(800);
 
     let cases: [(&str, &[&str]); 2] = [
-        ("plain envelope", &[]),
+        ("agent preview", &["--mode", "agent", "--dry-run"]),
         ("vendored", &["--mode", "vendored", "--dry-run"]),
     ];
     for (label, extra_args) in cases {

From c1ee18ff987a220f72ea2ccc730aa5ca77da1074 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Sun, 27 Sep 2026 12:51:57 -0400
Subject: [PATCH 04/32] Detect hosted patch updates from the lockfile's own
 pins

scan's updates[] now also sees the hosted pins the lockfiles wire, not
only the redirect ledger's records, so a hosted project that never
committed its ledger still reports a superseding patch.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .../src/commands/scan/discovery.rs            | 45 +++++++++++++------
 .../socket-patch-cli/src/commands/scan/mod.rs | 15 +++++++
 .../socket-patch-cli/tests/scan_invariants.rs |  4 +-
 3 files changed, 49 insertions(+), 15 deletions(-)

diff --git a/crates/socket-patch-cli/src/commands/scan/discovery.rs b/crates/socket-patch-cli/src/commands/scan/discovery.rs
index 90b1f176..4cd7ce08 100644
--- a/crates/socket-patch-cli/src/commands/scan/discovery.rs
+++ b/crates/socket-patch-cli/src/commands/scan/discovery.rs
@@ -418,21 +418,23 @@ pub(super) async fn preverify_vendor_baselines<W: std::io::Write>(
 /// CLI_CONTRACT.md) is structurally empty and a superseding patch is never
 /// reported. Precedence on a collision: manifest > redirect ledger > vendor
 /// ledger (a manifest PURL is manifest-owned, matching VEX's candidate merge
-/// in `commands::vex_sources` for purls no lockfile wires to another patch).
+/// in `commands::vex_sources` for purls no lockfile wires to another patch),
+/// then the lockfile's hosted pins (`hosted_pins`, uuid only).
 /// Vendor entries are keyed by their ledger map key
 /// (the manifest-form purl, qualifiers included — `detect_updates` bridges
 /// the spellings); a legacy entry without an embedded record contributes its
 /// uuid alone, which is all update detection reads. Borrows the manifest
-/// untouched when neither ledger contributes. Pure / no I/O so it's
+/// untouched when nothing else contributes. Pure / no I/O so it's
 /// unit-testable.
 pub(super) fn merge_ledger_records_for_updates<'a>(
     manifest: Option<&'a PatchManifest>,
     redirect: Option<&socket_patch_core::patch::redirect::RedirectState>,
     vendor: Option<&VendorState>,
+    hosted_pins: &[(String, String)],
 ) -> Option<Cow<'a, PatchManifest>> {
     let redirect_records = redirect.map(|s| &s.records).filter(|r| !r.is_empty());
     let vendor_entries = vendor.map(|s| &s.entries).filter(|e| !e.is_empty());
-    if redirect_records.is_none() && vendor_entries.is_none() {
+    if redirect_records.is_none() && vendor_entries.is_none() && hosted_pins.is_empty() {
         return manifest.map(Cow::Borrowed);
     }
     let mut merged = manifest.cloned().unwrap_or_default();
@@ -455,6 +457,20 @@ pub(super) fn merge_ledger_records_for_updates<'a>(
             })
         });
     }
+    for (purl, uuid) in hosted_pins {
+        merged
+            .patches
+            .entry(purl.clone())
+            .or_insert_with(|| PatchRecord {
+                uuid: uuid.clone(),
+                exported_at: String::new(),
+                files: HashMap::new(),
+                vulnerabilities: HashMap::new(),
+                description: String::new(),
+                license: String::new(),
+                tier: String::new(),
+            });
+    }
     Some(Cow::Owned(merged))
 }
 
@@ -1048,7 +1064,7 @@ mod tests {
         // uuid. The merged view must make detect_updates flag it — this was
         // structurally impossible before the fold (manifest-only detection).
         let ledger = ledger_with(&[("pkg:npm/foo@1.0", "uuid-old")]);
-        let merged = merge_ledger_records_for_updates(None, Some(&ledger), None);
+        let merged = merge_ledger_records_for_updates(None, Some(&ledger), None, &[]);
         let pkgs = vec![batch_with("pkg:npm/foo@1.0", &["uuid-new"])];
         let updates = detect_updates(merged.as_deref(), &pkgs);
         assert_eq!(updates.len(), 1);
@@ -1064,7 +1080,7 @@ mod tests {
         // record still contributes its uuid — all detection reads.
         for detached in [true, false] {
             let vendor = vendor_ledger_with(&[("pkg:npm/foo@1.0", "uuid-old", detached)]);
-            let merged = merge_ledger_records_for_updates(None, None, Some(&vendor));
+            let merged = merge_ledger_records_for_updates(None, None, Some(&vendor), &[]);
             let pkgs = vec![batch_with("pkg:npm/foo@1.0", &["uuid-new"])];
             let updates = detect_updates(merged.as_deref(), &pkgs);
             assert_eq!(updates.len(), 1, "detached={detached}");
@@ -1073,7 +1089,7 @@ mod tests {
         }
         // Still the top offer — no nag.
         let vendor = vendor_ledger_with(&[("pkg:npm/foo@1.0", "uuid-a", true)]);
-        let merged = merge_ledger_records_for_updates(None, None, Some(&vendor));
+        let merged = merge_ledger_records_for_updates(None, None, Some(&vendor), &[]);
         let pkgs = vec![batch_with("pkg:npm/foo@1.0", &["uuid-a"])];
         assert!(detect_updates(merged.as_deref(), &pkgs).is_empty());
     }
@@ -1082,7 +1098,7 @@ mod tests {
     fn ledger_record_matching_the_candidate_is_not_an_update() {
         // The redirected patch is still the top offer — no nag.
         let ledger = ledger_with(&[("pkg:npm/foo@1.0", "uuid-a")]);
-        let merged = merge_ledger_records_for_updates(None, Some(&ledger), None);
+        let merged = merge_ledger_records_for_updates(None, Some(&ledger), None, &[]);
         let pkgs = vec![batch_with("pkg:npm/foo@1.0", &["uuid-a"])];
         assert!(detect_updates(merged.as_deref(), &pkgs).is_empty());
     }
@@ -1097,12 +1113,12 @@ mod tests {
         let ledger = ledger_with(&[("pkg:npm/foo@1.0", "uuid-ledger")]);
         let vendor = vendor_ledger_with(&[("pkg:npm/foo@1.0", "uuid-vendor", true)]);
         let merged =
-            merge_ledger_records_for_updates(Some(&manifest), Some(&ledger), Some(&vendor));
+            merge_ledger_records_for_updates(Some(&manifest), Some(&ledger), Some(&vendor), &[]);
         let pkgs = vec![batch_with("pkg:npm/foo@1.0", &["uuid-new"])];
         let updates = detect_updates(merged.as_deref(), &pkgs);
         assert_eq!(updates.len(), 1);
         assert_eq!(updates[0].old_uuid, "uuid-manifest");
-        let merged = merge_ledger_records_for_updates(None, Some(&ledger), Some(&vendor));
+        let merged = merge_ledger_records_for_updates(None, Some(&ledger), Some(&vendor), &[]);
         let updates = detect_updates(merged.as_deref(), &pkgs);
         assert_eq!(updates[0].old_uuid, "uuid-ledger");
     }
@@ -1117,7 +1133,7 @@ mod tests {
         let ledger = ledger_with(&[("pkg:npm/bar@2.0", "uuid-b1")]);
         let vendor = vendor_ledger_with(&[("pkg:npm/baz@3.0", "uuid-z1", true)]);
         let merged =
-            merge_ledger_records_for_updates(Some(&manifest), Some(&ledger), Some(&vendor));
+            merge_ledger_records_for_updates(Some(&manifest), Some(&ledger), Some(&vendor), &[]);
         let pkgs = vec![
             batch_with("pkg:npm/foo@1.0", &["uuid-f2"]),
             batch_with("pkg:npm/bar@2.0", &["uuid-b2"]),
@@ -1133,15 +1149,18 @@ mod tests {
 
     #[test]
     fn absent_or_empty_ledgers_leave_the_manifest_view_untouched() {
-        assert!(merge_ledger_records_for_updates(None, None, None).is_none());
+        assert!(merge_ledger_records_for_updates(None, None, None, &[]).is_none());
+        let pins = vec![("pkg:npm/foo@1.0.0".to_string(), "uuid-pin".to_string())];
+        let merged = merge_ledger_records_for_updates(None, None, None, &pins).expect("pinned");
+        assert_eq!(merged.patches["pkg:npm/foo@1.0.0"].uuid, "uuid-pin");
         let empty = socket_patch_core::patch::redirect::RedirectState::new();
         let empty_vendor = VendorState::new();
         assert!(
-            merge_ledger_records_for_updates(None, Some(&empty), Some(&empty_vendor)).is_none()
+            merge_ledger_records_for_updates(None, Some(&empty), Some(&empty_vendor), &[]).is_none()
         );
         let manifest =
             crate::commands::scan::tests::manifest_with(&[("pkg:npm/foo@1.0", "uuid-a")]);
-        let merged = merge_ledger_records_for_updates(Some(&manifest), Some(&empty), None)
+        let merged = merge_ledger_records_for_updates(Some(&manifest), Some(&empty), None, &[])
             .expect("manifest present");
         assert!(
             matches!(merged, Cow::Borrowed(_)),
diff --git a/crates/socket-patch-cli/src/commands/scan/mod.rs b/crates/socket-patch-cli/src/commands/scan/mod.rs
index be784d8b..bba25d03 100644
--- a/crates/socket-patch-cli/src/commands/scan/mod.rs
+++ b/crates/socket-patch-cli/src/commands/scan/mod.rs
@@ -2373,10 +2373,25 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
             }
         }
     };
+    // The hosted pins the lockfiles wire count too: the lockfile is the
+    // record of a hosted redirect even where no ledger was committed.
+    let hosted_pins: Vec<(String, String)> =
+        if args.common.global || args.common.global_prefix.is_some() {
+            Vec::new()
+        } else {
+            crate::commands::discover_wiring(&args.common, &args.common.cwd)
+                .await
+                .refs
+                .into_iter()
+                .filter(|r| r.mode == socket_patch_core::vex::discover::WiringMode::Hosted)
+                .map(|r| (r.purl, r.uuid))
+                .collect()
+        };
     let update_manifest = merge_ledger_records_for_updates(
         existing_manifest.as_ref(),
         redirect_state.as_ref(),
         vendor_state.as_ref().ok(),
+        &hosted_pins,
     );
     let updates = detect_updates(update_manifest.as_deref(), &all_packages_with_patches);
 
diff --git a/crates/socket-patch-cli/tests/scan_invariants.rs b/crates/socket-patch-cli/tests/scan_invariants.rs
index f45d4b03..e7f5e61e 100644
--- a/crates/socket-patch-cli/tests/scan_invariants.rs
+++ b/crates/socket-patch-cli/tests/scan_invariants.rs
@@ -1704,8 +1704,8 @@ async fn report_only_scan_json_surfaces_hosted_redirect_state() {
         /*with_record=*/ true,
     );
 
-    // No mode flag: the read-only discovery envelope.
-    let (code, stdout, stderr) = run_scan(tmp.path(), &mock.uri(), &["--mode", "agent", "--dry-run"]);
+    // A path-scoped scan with no mode: the read-only discovery envelope.
+    let (code, stdout, stderr) = run_scan(tmp.path(), &mock.uri(), &["node_modules"]);
     assert_eq!(
         code, 0,
         "report-only scan must stay exit 0; stdout={stdout}; stderr={stderr}"

From da1ccc5ecec2cf9c0bdd00a96723bab7f9ab150f Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Sun, 27 Sep 2026 13:03:21 -0400
Subject: [PATCH 05/32] Share the crawler-options and ecosystem-scope helpers
 across commands

GlobalArgs gains crawler_options(), is_global(), ecosystem_selected()
and purl_ecosystem_selected(). They replace eight hand-copied
CrawlerOptions literals, seven --ecosystems predicates and seven global
checks across scan, vendor, vex, apply, setup, rollback, get and
repair.

vendor's predicate also matched case-insensitively and accepted
for golang. clap validates the names first, so neither form ever
reached it. It now uses the same exact match as everything else.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 crates/socket-patch-cli/src/args.rs           | 34 +++++++++++++++
 crates/socket-patch-cli/src/commands/apply.rs | 16 ++------
 crates/socket-patch-cli/src/commands/get.rs   | 22 +++-------
 .../src/commands/repair_vendor.rs             |  7 +---
 .../socket-patch-cli/src/commands/rollback.rs |  6 +--
 .../src/commands/scan/discovery.rs            |  4 +-
 .../src/commands/scan/hosted/python.rs        | 10 ++---
 .../socket-patch-cli/src/commands/scan/mod.rs | 41 +++++--------------
 crates/socket-patch-cli/src/commands/setup.rs |  6 +--
 .../socket-patch-cli/src/commands/vendor.rs   | 39 ++++++------------
 .../src/commands/vex_consumed.rs              |  6 +--
 .../src/ecosystem_dispatch.rs                 |  6 +--
 12 files changed, 76 insertions(+), 121 deletions(-)

diff --git a/crates/socket-patch-cli/src/args.rs b/crates/socket-patch-cli/src/args.rs
index 499cf69f..f8820a9b 100644
--- a/crates/socket-patch-cli/src/args.rs
+++ b/crates/socket-patch-cli/src/args.rs
@@ -382,6 +382,40 @@ pub struct GlobalArgs {
 }
 
 impl GlobalArgs {
+    /// The crawler options this run's `--cwd` / `--global` /
+    /// `--global-prefix` select.
+    pub(crate) fn crawler_options(&self) -> socket_patch_core::crawlers::CrawlerOptions {
+        socket_patch_core::crawlers::CrawlerOptions {
+            cwd: self.cwd.clone(),
+            global: self.global,
+            global_prefix: self.global_prefix.clone(),
+        }
+    }
+
+    /// Whether this run targets globally installed packages (`--global` or
+    /// `--global-prefix`) rather than the project at `--cwd`.
+    pub(crate) fn is_global(&self) -> bool {
+        self.global || self.global_prefix.is_some()
+    }
+
+    /// Whether `--ecosystems` selects `eco` (every ecosystem when unset or
+    /// empty). The names are validated at parse time, so this is an exact
+    /// match.
+    pub(crate) fn ecosystem_selected(&self, eco: Ecosystem) -> bool {
+        self.ecosystems.as_ref().is_none_or(|list| {
+            list.is_empty() || list.iter().any(|name| name == eco.cli_name())
+        })
+    }
+
+    /// [`Self::ecosystem_selected`] for the ecosystem of `purl`; a purl of
+    /// no known ecosystem is selected only when `--ecosystems` is unset.
+    pub(crate) fn purl_ecosystem_selected(&self, purl: &str) -> bool {
+        match Ecosystem::from_purl(purl) {
+            Some(eco) => self.ecosystem_selected(eco),
+            None => self.ecosystems.as_ref().is_none_or(Vec::is_empty),
+        }
+    }
+
     /// Resolve `manifest_path` against `cwd`: absolute paths are returned
     /// as-is, relative paths are joined to `cwd`.
     pub(crate) fn resolved_manifest_path(&self) -> PathBuf {
diff --git a/crates/socket-patch-cli/src/commands/apply.rs b/crates/socket-patch-cli/src/commands/apply.rs
index 4b40c6f4..0e14f686 100644
--- a/crates/socket-patch-cli/src/commands/apply.rs
+++ b/crates/socket-patch-cli/src/commands/apply.rs
@@ -3,7 +3,7 @@ use socket_patch_core::api::blob_fetcher::get_missing_blobs;
 use socket_patch_core::api::client::{get_api_client_with_overrides, ApiClient};
 use socket_patch_core::crawlers::ruby_crawler::config_path_ignored_warning;
 use socket_patch_core::crawlers::{
-    detect_npm_pkg_manager, CrawlerOptions, Ecosystem, NpmPkgManager, RubyCrawler,
+    detect_npm_pkg_manager, Ecosystem, NpmPkgManager, RubyCrawler,
 };
 use socket_patch_core::manifest::operations::read_manifest;
 use socket_patch_core::manifest::schema::{PatchFileInfo, PatchManifest, PatchRecord};
@@ -386,13 +386,7 @@ pub(crate) fn is_local_go(purl: &str, common: &GlobalArgs) -> bool {
 /// `.yarn/cache/*.zip`, so a run that never crawls the checkout's
 /// `node_modules` must not be refused by its layout).
 fn eco_in_local_scope(common: &GlobalArgs, eco: Ecosystem) -> bool {
-    if common.global || common.global_prefix.is_some() {
-        return false;
-    }
-    match &common.ecosystems {
-        None => true,
-        Some(list) => list.iter().any(|e| e == eco.cli_name()),
-    }
+    !common.is_global() && common.ecosystem_selected(eco)
 }
 
 /// Materialise a local-go redirect for `purl`, or `None` if `purl` isn't a
@@ -1727,11 +1721,7 @@ async fn apply_patches_inner(
     let (mut results, mut matched_manifest_purls, vendored_bases) =
         synthesize_vendor_owned_results(&target_manifest_purls, &vendored_purls);
 
-    let crawler_options = CrawlerOptions {
-        cwd: args.common.cwd.clone(),
-        global: args.common.global,
-        global_prefix: args.common.global_prefix.clone(),
-    };
+    let crawler_options = args.common.crawler_options();
 
     // Gem bundle-store discovery, re-run cheaply (filesystem probes only,
     // no `gem env` shell-out) against the same ambient environment the
diff --git a/crates/socket-patch-cli/src/commands/get.rs b/crates/socket-patch-cli/src/commands/get.rs
index ca54e1cb..9797fc63 100644
--- a/crates/socket-patch-cli/src/commands/get.rs
+++ b/crates/socket-patch-cli/src/commands/get.rs
@@ -1265,14 +1265,6 @@ pub struct DownloadRun<'a> {
     pub verbose: bool,
 }
 
-fn crawler_options_for(common: &GlobalArgs) -> CrawlerOptions {
-    CrawlerOptions {
-        cwd: common.cwd.clone(),
-        global: common.global,
-        global_prefix: common.global_prefix.clone(),
-    }
-}
-
 /// Narrow a selection of patches down to the release variant(s) present
 /// in each locally-installed distribution.
 ///
@@ -1615,7 +1607,7 @@ async fn filter_to_installed_purls(
             .collect()
     };
     let partitioned = partition_purls(&bases, None);
-    let found = find_packages_for_rollback(&partitioned, &crawler_options_for(common), true).await;
+    let found = find_packages_for_rollback(&partitioned, &common.crawler_options(), true).await;
     let mut present: HashSet<String> = found.keys().map(|k| canon(k)).collect();
 
     // Manifest membership counts as presence (read-only probe: a corrupt
@@ -1901,11 +1893,7 @@ async fn lock_text_refusals_for(
         .map(|sr| (sr.purl.as_str(), sr.uuid.as_str()))
         .collect();
     let refused = socket_patch_core::vendor::lock_text_refusals(cwd, &candidates).await;
-    let options = CrawlerOptions {
-        cwd: params.cwd.clone(),
-        global: params.global,
-        global_prefix: params.global_prefix.clone(),
-    };
+    let options = params.crawler_options();
     crate::commands::vendor::lock_refusals_reaching_backend(
         cwd,
         refused,
@@ -2956,7 +2944,7 @@ pub async fn run(args: GetArgs) -> i32 {
         IdentifierType::Package => {
             status.set("Enumerating packages...");
             let (all_packages, _, _) =
-                crawl_all_ecosystems(&crawler_options_for(&args.common)).await;
+                crawl_all_ecosystems(&args.common.crawler_options()).await;
 
             if all_packages.is_empty() {
                 status.finish();
@@ -3198,7 +3186,7 @@ pub async fn run(args: GetArgs) -> i32 {
         let (selected, variant_warnings, _views) = filter_to_installed_releases(
             &selected,
             args.all_releases,
-            &crawler_options_for(&args.common),
+            &args.common.crawler_options(),
             quiet,
             &api_client,
         )
@@ -3237,7 +3225,7 @@ pub async fn run(args: GetArgs) -> i32 {
             let (selected, variant_warnings, _views) = filter_to_installed_releases(
                 &selected,
                 args.all_releases,
-                &crawler_options_for(&args.common),
+                &args.common.crawler_options(),
                 quiet,
                 &api_client,
             )
diff --git a/crates/socket-patch-cli/src/commands/repair_vendor.rs b/crates/socket-patch-cli/src/commands/repair_vendor.rs
index 1123c5be..52f0b331 100644
--- a/crates/socket-patch-cli/src/commands/repair_vendor.rs
+++ b/crates/socket-patch-cli/src/commands/repair_vendor.rs
@@ -53,7 +53,6 @@ use std::path::{Path, PathBuf};
 
 use socket_patch_core::api::client::{get_api_client_with_overrides, ApiClient};
 use socket_patch_core::constants::SOCKET_DIR;
-use socket_patch_core::crawlers::CrawlerOptions;
 use socket_patch_core::manifest::schema::{PatchManifest, PatchRecord};
 use socket_patch_core::patch::copy_tree::remove_tree;
 use socket_patch_core::utils::fs::read_regular_to_string;
@@ -1360,11 +1359,7 @@ pub(crate) async fn repair_vendored_artifacts_with_references(
     // ── Pristine package sources ─────────────────────────────────────────
     let purls: Vec<String> = candidates.iter().map(|c| c.purl.clone()).collect();
     let partitioned = partition_purls(&purls, common.ecosystems.as_deref());
-    let crawler_options = CrawlerOptions {
-        cwd: common.cwd.clone(),
-        global: common.global,
-        global_prefix: common.global_prefix.clone(),
-    };
+    let crawler_options = common.crawler_options();
     // Ledger keys are the manifest spelling — QUALIFIED for release-variant
     // ecosystems (gem `?platform=`, pypi `?artifact_id=`, maven
     // `?classifier=&ext=`) — while the crawler knows only base purls. A
diff --git a/crates/socket-patch-cli/src/commands/rollback.rs b/crates/socket-patch-cli/src/commands/rollback.rs
index d4f79371..d0b79f17 100644
--- a/crates/socket-patch-cli/src/commands/rollback.rs
+++ b/crates/socket-patch-cli/src/commands/rollback.rs
@@ -2348,11 +2348,7 @@ pub(crate) async fn rollback_patches_inner(
         .patches
         .retain(|purl, _| in_scope.contains(purl));
 
-    let crawler_options = CrawlerOptions {
-        cwd: common.cwd.clone(),
-        global: common.global,
-        global_prefix: common.global_prefix.clone(),
-    };
+    let crawler_options = common.crawler_options();
 
     // Multi-copy aware: npm nests genuine duplicates of one `name@version`,
     // so the resolver returns EVERY physical copy per PURL. Restoring only
diff --git a/crates/socket-patch-cli/src/commands/scan/discovery.rs b/crates/socket-patch-cli/src/commands/scan/discovery.rs
index 4cd7ce08..8546cb6e 100644
--- a/crates/socket-patch-cli/src/commands/scan/discovery.rs
+++ b/crates/socket-patch-cli/src/commands/scan/discovery.rs
@@ -102,7 +102,7 @@ pub(super) async fn lockfile_supplement(
     use socket_patch_core::vendor::lock_inventory;
 
     let mut out = LockfileSupplement::default();
-    if common.global || common.global_prefix.is_some() {
+    if common.is_global() {
         return out;
     }
     let (entries, unsupported) = lock_inventory::inventory_project_diagnosed(&common.cwd).await;
@@ -175,7 +175,7 @@ pub(super) async fn vendored_ledger_supplement(
     crawled: &[socket_patch_core::crawlers::types::CrawledPackage],
     state: &std::io::Result<VendorState>,
 ) -> Vec<socket_patch_core::crawlers::types::CrawledPackage> {
-    if common.global || common.global_prefix.is_some() {
+    if common.is_global() {
         return Vec::new();
     }
     let base_purls: Vec<String> = match state {
diff --git a/crates/socket-patch-cli/src/commands/scan/hosted/python.rs b/crates/socket-patch-cli/src/commands/scan/hosted/python.rs
index d24956c7..8f0eeef9 100644
--- a/crates/socket-patch-cli/src/commands/scan/hosted/python.rs
+++ b/crates/socket-patch-cli/src/commands/scan/hosted/python.rs
@@ -2,7 +2,7 @@
 
 use std::collections::{BTreeMap, BTreeSet};
 
-use socket_patch_core::crawlers::{types::CrawlerOptions, PythonCrawler};
+use socket_patch_core::crawlers::PythonCrawler;
 use socket_patch_core::manifest::schema::PatchRecord;
 use socket_patch_core::utils::purl::strip_purl_qualifiers;
 use socket_patch_core::vex::verify::judge_installed_record;
@@ -44,13 +44,9 @@ pub(super) async fn stale_install_warnings(
     // copy of the release (a tool venv on PATH) and warn about a venv the
     // project's installer never touches — a false positive that also fails
     // the same-run --vex. --global / --global-prefix keep their meaning.
-    let paths = if common.global || common.global_prefix.is_some() {
+    let paths = if common.is_global() {
         crawler
-            .get_site_packages_paths(&CrawlerOptions {
-                cwd: common.cwd.clone(),
-                global: common.global,
-                global_prefix: common.global_prefix.clone(),
-            })
+            .get_site_packages_paths(&common.crawler_options())
             .await
             .unwrap_or_default()
     } else {
diff --git a/crates/socket-patch-cli/src/commands/scan/mod.rs b/crates/socket-patch-cli/src/commands/scan/mod.rs
index bba25d03..048fd84f 100644
--- a/crates/socket-patch-cli/src/commands/scan/mod.rs
+++ b/crates/socket-patch-cli/src/commands/scan/mod.rs
@@ -14,7 +14,7 @@ use socket_patch_core::api::client::{
 };
 use socket_patch_core::api::types::{BatchPackagePatches, BatchSearchResponse, PatchSearchResult};
 use socket_patch_core::crawlers::ruby_crawler::config_path_ignored_warning;
-use socket_patch_core::crawlers::{CrawlerOptions, Ecosystem};
+use socket_patch_core::crawlers::Ecosystem;
 use socket_patch_core::manifest::operations::read_manifest;
 use socket_patch_core::manifest::schema::PatchManifest;
 use socket_patch_core::telemetry::{
@@ -261,7 +261,7 @@ pub fn resolve_mode_flags(args: &mut ScanArgs) -> Result<(), String> {
         ));
     }
     if args.mode == Some(ScanMode::Hosted)
-        && (args.common.global || args.common.global_prefix.is_some())
+        && args.common.is_global()
     {
         // Global installs have no project lockfile to repoint: the hosted
         // flow would "redirect 0 packages" and exit 0, a silent no-op.
@@ -1744,13 +1744,9 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
     // how often stale-token fallbacks fire in the wild.
     let mut fallback_to_proxy = false;
 
-    let crawler_options = CrawlerOptions {
-        cwd: args.common.cwd.clone(),
-        global: args.common.global,
-        global_prefix: args.common.global_prefix.clone(),
-    };
+    let crawler_options = args.common.crawler_options();
 
-    let scan_target = if args.common.global || args.common.global_prefix.is_some() {
+    let scan_target = if args.common.is_global() {
         "global packages"
     } else {
         "packages"
@@ -1805,12 +1801,7 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
     // gated stderr line on the human path) unless `--ecosystems` filtered
     // gem out of this run.
     if let Some(value) = skipped_bundle_config_path {
-        if args
-            .common
-            .ecosystems
-            .as_ref()
-            .is_none_or(|list| list.iter().any(|e| e == Ecosystem::Gem.cli_name()))
-        {
+        if args.common.ecosystem_selected(Ecosystem::Gem) {
             let (code, detail) = config_path_ignored_warning(&value);
             layout_refusals.push((code.to_string(), detail));
         }
@@ -1872,20 +1863,10 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         .unwrap_or_default();
 
     // Filter by --ecosystems if provided
-    let filtered_crawled: Vec<_> = if let Some(ref allowed) = args.common.ecosystems {
-        all_crawled
-            .into_iter()
-            .filter(|pkg| {
-                if let Some(eco) = Ecosystem::from_purl(&pkg.purl) {
-                    allowed.iter().any(|a| a == eco.cli_name())
-                } else {
-                    false
-                }
-            })
-            .collect()
-    } else {
-        all_crawled
-    };
+    let filtered_crawled: Vec<_> = all_crawled
+        .into_iter()
+        .filter(|pkg| args.common.purl_ecosystem_selected(&pkg.purl))
+        .collect();
 
     let filtered_crawled: Vec<_> = if args.packages.is_empty() {
         filtered_crawled
@@ -2054,7 +2035,7 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
             println!(
                 "{}",
                 render::no_packages_message(
-                    args.common.global || args.common.global_prefix.is_some(),
+                    args.common.is_global(),
                     args.common.ecosystems.as_deref(),
                     &args.paths,
                 )
@@ -2376,7 +2357,7 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
     // The hosted pins the lockfiles wire count too: the lockfile is the
     // record of a hosted redirect even where no ledger was committed.
     let hosted_pins: Vec<(String, String)> =
-        if args.common.global || args.common.global_prefix.is_some() {
+        if args.common.is_global() {
             Vec::new()
         } else {
             crate::commands::discover_wiring(&args.common, &args.common.cwd)
diff --git a/crates/socket-patch-cli/src/commands/setup.rs b/crates/socket-patch-cli/src/commands/setup.rs
index c530616a..722262f7 100644
--- a/crates/socket-patch-cli/src/commands/setup.rs
+++ b/crates/socket-patch-cli/src/commands/setup.rs
@@ -417,11 +417,7 @@ fn pathdiff(path: &str, base: &Path) -> String {
 /// value parser admits no alias or case variant — and it is the same rule
 /// `partition_purls` applies, so setup's scope never diverges from apply's.
 fn eco_in_scope(common: &GlobalArgs, eco: Ecosystem) -> bool {
-    match &common.ecosystems {
-        None => true,
-        Some(list) if list.is_empty() => true,
-        Some(list) => list.iter().any(|e| e == eco.cli_name()),
-    }
+    common.ecosystem_selected(eco)
 }
 
 /// Normalize a workspace-member / exclude path for comparison: trimmed,
diff --git a/crates/socket-patch-cli/src/commands/vendor.rs b/crates/socket-patch-cli/src/commands/vendor.rs
index 31478624..4618fcdd 100644
--- a/crates/socket-patch-cli/src/commands/vendor.rs
+++ b/crates/socket-patch-cli/src/commands/vendor.rs
@@ -346,11 +346,12 @@ fn orphan_label(unit: &vendor::path::SweptVendorDir) -> String {
 
 /// Does `eco` fall inside this run's `--ecosystems` scope?
 pub(crate) fn ecosystem_in_scope(common: &GlobalArgs, eco: &str) -> bool {
-    match common.ecosystems.as_deref() {
-        None => true,
-        Some(list) => list.iter().any(|e| {
-            e.eq_ignore_ascii_case(eco) || (eco == "golang" && e.eq_ignore_ascii_case("go"))
-        }),
+    match socket_patch_core::crawlers::Ecosystem::all()
+        .iter()
+        .find(|e| e.cli_name() == eco)
+    {
+        Some(eco) => common.ecosystem_selected(*eco),
+        None => common.ecosystems.as_ref().is_none_or(Vec::is_empty),
     }
 }
 
@@ -1832,11 +1833,7 @@ pub(crate) async fn vendor_records_reusing(
         vendor::prestage::sweep_stale(&common.cwd).await;
     }
 
-    let crawler_options = CrawlerOptions {
-        cwd: common.cwd.clone(),
-        global: common.global,
-        global_prefix: common.global_prefix.clone(),
-    };
+    let crawler_options = common.crawler_options();
     // Resolve installed packages with the qualified-purl-aware resolver, never
     // a base-keyed one: the manifest keys release-variant ecosystems (gem
     // `?platform=`, pypi `?artifact_id=`, maven `?classifier=&ext=`) by
@@ -5158,11 +5155,11 @@ mod scope_and_hint_tests {
         }
     }
 
-    /// The `Some(list)` branch of [`ecosystem_in_scope`]: exact match,
-    /// case-insensitivity, and the `go` → `golang` alias; `None` means
-    /// everything is in scope.
+    /// [`ecosystem_in_scope`] is `--ecosystems`' exact-name match (clap
+    /// validates the names, so no case or alias variant reaches it); `None`
+    /// means everything is in scope.
     #[test]
-    fn ecosystem_in_scope_honors_list_alias_and_case() {
+    fn ecosystem_in_scope_is_an_exact_name_match() {
         let unscoped = with_scope(None);
         assert!(ecosystem_in_scope(&unscoped, "npm"));
         assert!(ecosystem_in_scope(&unscoped, "cargo"));
@@ -5172,18 +5169,8 @@ mod scope_and_hint_tests {
         assert!(!ecosystem_in_scope(&npm_only, "cargo"));
         assert!(!ecosystem_in_scope(&npm_only, "golang"));
 
-        let upper = with_scope(Some(&["NPM"]));
-        assert!(
-            ecosystem_in_scope(&upper, "npm"),
-            "scope matching is case-insensitive"
-        );
-
-        let go_alias = with_scope(Some(&["go"]));
-        assert!(
-            ecosystem_in_scope(&go_alias, "golang"),
-            "`go` must alias the golang ecosystem"
-        );
-        assert!(!ecosystem_in_scope(&go_alias, "npm"));
+        let golang = with_scope(Some(&["golang"]));
+        assert!(ecosystem_in_scope(&golang, "golang"));
     }
 }
 
diff --git a/crates/socket-patch-cli/src/commands/vex_consumed.rs b/crates/socket-patch-cli/src/commands/vex_consumed.rs
index b8914f0f..5500e53e 100644
--- a/crates/socket-patch-cli/src/commands/vex_consumed.rs
+++ b/crates/socket-patch-cli/src/commands/vex_consumed.rs
@@ -76,11 +76,7 @@ pub(crate) async fn hosted_consumed_copies(
     if hosted.is_empty() {
         return out;
     }
-    let options = CrawlerOptions {
-        cwd: common.cwd.clone(),
-        global: common.global,
-        global_prefix: common.global_prefix.clone(),
-    };
+    let options = common.crawler_options();
     let purls: Vec<String> = hosted.keys().cloned().collect();
     let partitioned = partition_purls(&purls, common.ecosystems.as_deref());
 
diff --git a/crates/socket-patch-cli/src/ecosystem_dispatch.rs b/crates/socket-patch-cli/src/ecosystem_dispatch.rs
index ec2071ce..9be0519b 100644
--- a/crates/socket-patch-cli/src/ecosystem_dispatch.rs
+++ b/crates/socket-patch-cli/src/ecosystem_dispatch.rs
@@ -632,11 +632,7 @@ pub async fn find_manifest_package_copies_reusing(
     prior: Option<&NpmCrawlSnapshot>,
 ) -> HashMap<String, Vec<PathBuf>> {
     let partitioned = partition_purls(purls, common.ecosystems.as_deref());
-    let crawler_options = CrawlerOptions {
-        cwd: common.cwd.clone(),
-        global: common.global,
-        global_prefix: common.global_prefix.clone(),
-    };
+    let crawler_options = common.crawler_options();
     let npm_roots = prior.and_then(|p| p.roots_for(&crawler_options));
     dispatch_find(
         &partitioned,

From 62f07c780c95cead2067a12e5ca73af0dd7e4c01 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Sun, 27 Sep 2026 13:36:44 -0400
Subject: [PATCH 06/32] Let hosted and vendored scans take project directories
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In hosted and vendored mode, and so in a bare scan, positional PATHs
now name project directories: each directory, or directory glob such
as apps/*, is scanned on its own as if it were --cwd, under a
"== <dir> ==" header. The exit code is the worst of the runs. A PATH
that is not a directory is a usage error. --json takes a single
directory so stdout stays one document. Agent-mode PATHs keep their
installed-path glob meaning.

The changelog's v5 section now leads with the scan → vex → vendor
workflow and describes the new scan defaults.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md                                  |  69 ++++++---
 .../socket-patch-cli/src/commands/scan/mod.rs | 131 ++++++++++++++----
 .../socket-patch-cli/tests/cli_parse_scan.rs  |   7 +-
 .../tests/covgap_commands_scan_mod.rs         |  45 ++++--
 .../socket-patch-cli/tests/scan_invariants.rs |   4 +-
 .../socket-patch-cli/tests/scan_paths_e2e.rs  |  27 ++--
 6 files changed, 215 insertions(+), 68 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c905badf..2e853cce 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,12 +17,22 @@ into the new version's section — see docs/releasing.md.
 
 ## [Unreleased]
 
+> **v5 at a glance.** The CLI is built around one workflow: `socket-patch
+> scan` patches dependencies by rewriting lockfiles so only the patched
+> packages resolve to Socket-hosted, integrity-pinned copies (hosted mode is
+> the default, and scan never prompts); `socket-patch vex` emits OpenVEX for
+> vulnerability scanners; `socket-patch vendor` ejects the patches into
+> `.socket/vendor/` for offline installs; `socket-patch list` shows them.
+> `get`, `apply`, `setup`, `rollback`, `remove` and `repair` (the agent-mode
+> commands) keep working and are listed after these.
+
 > **Semver note:** this entry changes `rollback`'s default behavior, narrows
 > the meaning of its existing `vendored: []` JSON key, makes vendored mode
 > manifest-free, moves vendored cargo wiring from `.cargo/config*` into
 > `Cargo.toml`, tags vendored cargo copies' versions with `+socket.<uuid>`
-> (visible to the patched crate as `CARGO_PKG_VERSION`), turns a plain
-> non-TTY `scan` report-only, makes `vex`
+> (visible to the patched crate as `CARGO_PKG_VERSION`), makes a bare `scan`
+> run hosted mode without prompting, changes which patch scan picks when a
+> package has several, makes `vex`
 > refuse to attest stale ledger records and corrupt vendor ledgers, and
 > retries a throttled patch API (new error text, added waiting, a throttled
 > package failing its legacy-proxy batch) — all
@@ -233,27 +243,32 @@ into the new version's section — see docs/releasing.md.
   with no manifest is a clean exit-0 no-op whose message names the missing
   manifest (and the ledger entries `repair` verifies) instead of claiming
   "No .socket folder found".
-- **A plain `scan` without a TTY is report-only.** When stdin is not a TTY,
-  `--yes` is absent, and no intent flag (`--mode`, `--apply`, `--sync`,
-  `--vendor`, `--redirect`, `--prune`) is given, human-mode `scan` prints the
-  discovery report and the "To apply a single patch, run: …" hint, downloads
-  nothing, creates no `.socket/`, and exits 0 — it no longer auto-accepts the
-  apply prompt. Any intent flag, `--yes`, or a TTY keeps the previous
-  behavior; `rollback`/`remove`/`get`'s non-TTY auto-accept is unchanged.
-  Human `scan --mode hosted` now prints the results table and update
-  detection like the other modes and confirms once ("Redirect N packages
-  to the hosted patch server?" — the same prompt as `get --mode hosted` —
-  default yes, skipped by `--yes`/`--json`/`--dry-run`; on a non-TTY stdin
-  without `--yes` it prints `Non-interactive mode detected, proceeding
-  automatically.` and proceeds), fetches patch details with the agent arm's
-  progress counter and per-package warnings, and an empty hosted discovery
-  prints `No patches available for installed packages.` and exits 0 without
-  entering the redirect engine (was `Redirected 0 package(s)`); a discovery
+- **A bare `scan` runs hosted mode and never prompts.** With no `--mode`
+  (or legacy mode flag), `scan` rewrites lockfiles so the patched
+  dependencies resolve to Socket-hosted packages, exactly like
+  `scan --mode hosted`; under `--json` its result nests under `redirect` as
+  before. Only a `--prune` or `--global` scan with no mode is still
+  report-only (neither has a project lockfile to rewire); it prints the
+  report and `To apply these patches in place, run: socket-patch scan
+  --mode agent [PATHS]`. `scan` asks nothing in any mode: the download and
+  redirect confirmations and the free-tier patch menu are gone (and with
+  them the `Non-interactive mode detected` note), so `--yes` no longer
+  changes what `scan` does. Human `scan --mode hosted` prints the results
+  table and update detection like the other modes, fetches patch details
+  with the agent arm's progress counter and per-package warnings, and an
+  empty hosted discovery prints `No patches available for installed
+  packages.` and exits 0 without entering the redirect engine; a discovery
   whose every offer is paid-tier for an org without paid access stops the
   same way with `No downloadable patches (paid subscription required).`. A
   malformed redirect ledger on a human hosted run that stops before the
   engine is reported as the read-only `Warning: the redirect ledger … is
   malformed` advisory instead of nowhere.
+- **scan picks the newest merged patch.** When a package has several
+  patches, `scan` (and `get`, and the `[UPDATE]` detection) now takes the
+  newest merged patch (one that fixes several advisories in one blob — the
+  package's cumulative fix) the account can download, whatever its
+  severity. A package with no merged patch keeps the old order: highest
+  severity, then newest.
 - **`apply.lock` never outlives a command, and hosted mode takes it.** Lock
   acquisition creates `.socket/` when missing; the lock file is unlinked
   (while still held) and an otherwise-empty `.socket/` removed when the
@@ -338,6 +353,16 @@ into the new version's section — see docs/releasing.md.
 
 ### Added
 
+- **`scan --package <name|purl>`** (repeatable or comma-separated, env
+  `SOCKET_SCAN_PACKAGES`) scopes a scan to the named packages: a name
+  (`lodash`, `@scope/pkg`, `group:artifact`) or a purl with or without its
+  version (`pkg:npm/lodash`, `pkg:pypi/requests@2.31.0`); names compare
+  case-insensitively.
+- **Hosted projects report patch updates from their lockfiles.** scan's
+  `updates[]` and `[UPDATE]` marker also see the hosted pins the lockfiles
+  wire, so a hosted project that never committed its redirect ledger still
+  reports a superseding patch.
+
 - **`apply` and `rollback` patch vlt installs in place.** A project
   installed by vlt (`node_modules/.vlt/` or `node_modules/.vlt-lock.json`)
   is detected as vlt ahead of any sibling bun, pnpm, yarn or npm marker,
@@ -843,8 +868,12 @@ into the new version's section — see docs/releasing.md.
   prune universe is never narrowed (`scan PATHS --prune` prunes exactly
   what an unscoped run would), lockfile-only/vendor-ledger supplements are
   excluded with a `path_scope_excluded_supplements` warning, an empty match
-  is a normal empty scan (exit 0, no GC), and PATHS is rejected with
-  `--mode hosted|vendored` (exit 2). `rollback [TARGET]...` accepts
+  is a normal empty scan (exit 0, no GC). In hosted and vendored mode
+  (so also a bare `scan`) PATHS name project directories instead: each
+  directory or directory glob (`apps/*`) is scanned on its own, as if it
+  were `--cwd`, under a `== <dir> ==` header; the exit code is the worst of
+  the runs, a PATH that is not a directory is a usage error (exit 2), and
+  `--json` takes one directory. `rollback [TARGET]...` accepts
   PURLs, UUIDs, and path globs (variadic, unioned); only path-SHAPED tokens
   (separator, glob metachar, `./` prefix, absolute) become globs, so a
   mistyped identifier stays a safe exit-1 error. A path target selecting
diff --git a/crates/socket-patch-cli/src/commands/scan/mod.rs b/crates/socket-patch-cli/src/commands/scan/mod.rs
index 048fd84f..ae48f665 100644
--- a/crates/socket-patch-cli/src/commands/scan/mod.rs
+++ b/crates/socket-patch-cli/src/commands/scan/mod.rs
@@ -26,7 +26,7 @@ use socket_patch_core::vendor::VendorState;
 use socket_patch_core::vex::discover::{LedgerLiveness, WiringMode};
 use std::collections::{HashMap, HashSet};
 use std::io::IsTerminal;
-use std::path::Path;
+use std::path::{Path, PathBuf};
 
 use crate::args::{apply_env_toggles, GlobalArgs};
 use crate::commands::vex::{generate_vex_from_manifest_path, VexEmbedArgs};
@@ -239,27 +239,11 @@ pub fn resolve_mode_flags(args: &mut ScanArgs) -> Result<(), String> {
         args.mode = Some(ScanMode::Vendored);
     } else if args.apply || args.sync {
         args.mode = Some(ScanMode::Agent);
-    } else if args.paths.is_empty()
-        && !args.prune
-        && !args.common.global
-        && args.common.global_prefix.is_none()
-    {
-        // v5: hosted is the default. A path-scoped, `--prune` or global scan
-        // with no mode stays report-only (none of them can rewire lockfiles).
+    } else if !args.prune && !args.common.is_global() {
+        // v5: hosted is the default. A `--prune` or global scan with no mode
+        // stays report-only (neither has a project lockfile to rewire).
         args.mode = Some(ScanMode::Hosted);
     }
-    if !args.paths.is_empty()
-        && matches!(args.mode, Some(ScanMode::Hosted) | Some(ScanMode::Vendored))
-    {
-        // Hosted/vendored rewire the project's root lockfiles — whole-project
-        // by construction — so path scoping cannot mean anything coherent
-        // there. Same phrasing family as the conflicts above.
-        return Err(format!(
-            "path targeting cannot be used with --mode {}: it applies to \
-             agent-mode and read-only scans",
-            args.mode.expect("checked Some above").cli_name(),
-        ));
-    }
     if args.mode == Some(ScanMode::Hosted)
         && args.common.is_global()
     {
@@ -286,15 +270,14 @@ pub fn resolve_mode_flags(args: &mut ScanArgs) -> Result<(), String> {
     Ok(())
 }
 
-#[derive(Args)]
+#[derive(Args, Clone)]
 pub struct ScanArgs {
-    /// Only scan packages installed under these path globs (e.g.
-    /// `packages/foo`, `apps/**`; a bare directory scopes its whole
-    /// subtree). `--prune` still considers the whole project, so a scoped
-    /// scan never prunes out-of-scope manifest entries. Lockfile-only
-    /// packages have no installed path and are left out (with a warning).
-    /// Not available with `--mode hosted` or `--mode vendored`, which
-    /// rewire the whole project
+    /// Only scan these directories. In hosted and vendored mode each PATH
+    /// (or glob, e.g. `apps/*`) is a project directory, scanned on its own
+    /// as if it were `--cwd`. In agent mode PATHs are globs over installed
+    /// package paths (a bare directory scopes its whole subtree; `--prune`
+    /// still considers the whole project, and lockfile-only packages are
+    /// left out with a warning)
     pub paths: Vec<String>,
 
     #[command(flatten)]
@@ -1656,6 +1639,64 @@ pub async fn run(args: ScanArgs) -> i32 {
     code
 }
 
+/// The project directories a hosted or vendored scan's PATHs name: each
+/// PATH is a directory, or a glob matching directories, relative to
+/// `--cwd`. Sorted and deduplicated.
+fn project_dirs(cwd: &Path, paths: &[String]) -> Result<Vec<PathBuf>, String> {
+    let mut dirs: Vec<PathBuf> = Vec::new();
+    for raw in paths {
+        let joined = cwd.join(raw);
+        if raw.contains(['*', '?', '[']) {
+            let pattern = joined.to_string_lossy().into_owned();
+            let matches = glob::glob(&pattern).map_err(|e| format!("invalid path pattern `{raw}`: {e}"))?;
+            let before = dirs.len();
+            dirs.extend(matches.filter_map(Result::ok).filter(|p| p.is_dir()));
+            if dirs.len() == before {
+                return Err(format!("`{raw}` matches no directory"));
+            }
+        } else if joined.is_dir() {
+            dirs.push(joined);
+        } else {
+            return Err(format!("`{raw}` is not a directory"));
+        }
+    }
+    dirs.sort();
+    dirs.dedup();
+    Ok(dirs)
+}
+
+/// Run a hosted or vendored scan once per project directory its PATHs
+/// name, as if each were `--cwd`. The exit code is the worst of the runs.
+/// `--json` takes one directory, so stdout stays one document.
+async fn run_project_dirs(args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
+    let dirs = match project_dirs(&args.common.cwd, &args.paths) {
+        Ok(dirs) => dirs,
+        Err(message) => {
+            eprintln!("Error: {message}");
+            return 2;
+        }
+    };
+    if args.common.json && dirs.len() > 1 {
+        eprintln!(
+            "Error: --json takes one project directory ({} given); run one scan per directory",
+            dirs.len()
+        );
+        return 2;
+    }
+    let mut code = 0;
+    for dir in &dirs {
+        if dirs.len() > 1 && !args.common.silent {
+            let shown = dir.strip_prefix(&args.common.cwd).unwrap_or(dir);
+            println!("\n== {} ==", shown.display());
+        }
+        let mut child = args.clone();
+        child.paths.clear();
+        child.common.cwd = dir.clone();
+        code = code.max(Box::pin(run_scan(child, telemetry)).await);
+    }
+    code
+}
+
 async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
     apply_env_toggles(&args.common);
 
@@ -1673,6 +1714,14 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         return 2;
     }
 
+    // Hosted and vendored modes rewire a project's lockfiles, so their
+    // PATHs name project directories: one scan per directory.
+    if matches!(args.mode, Some(ScanMode::Hosted) | Some(ScanMode::Vendored))
+        && !args.paths.is_empty()
+    {
+        return Box::pin(run_project_dirs(args, telemetry)).await;
+    }
+
     // Positional PATH globs (see `ScanArgs::paths`). An unparseable glob
     // is a usage error, same exit-2 shape as the mode conflicts.
     let path_scope = match crate::path_scope::PathScope::parse(&args.paths) {
@@ -3226,6 +3275,32 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
 mod tests {
     use super::*;
 
+    #[test]
+    fn project_dirs_resolve_directories_and_globs() {
+        let tmp = tempfile::tempdir().unwrap();
+        for d in ["apps/web", "apps/api", "libs/core"] {
+            std::fs::create_dir_all(tmp.path().join(d)).unwrap();
+        }
+        std::fs::write(tmp.path().join("apps/README"), "").unwrap();
+        let rel = |dirs: Vec<PathBuf>| -> Vec<String> {
+            dirs.iter()
+                .map(|d| d.strip_prefix(tmp.path()).unwrap().to_string_lossy().replace('\\', "/"))
+                .collect()
+        };
+        let got = project_dirs(tmp.path(), &["apps/*".into(), "libs/core".into(), "apps/web".into()])
+            .unwrap();
+        assert_eq!(rel(got), ["apps/api", "apps/web", "libs/core"]);
+        assert!(project_dirs(tmp.path(), &["apps/README".into()])
+            .unwrap_err()
+            .contains("is not a directory"));
+        assert!(project_dirs(tmp.path(), &["nope/*".into()])
+            .unwrap_err()
+            .contains("matches no directory"));
+        assert!(project_dirs(tmp.path(), &["x[".into()])
+            .unwrap_err()
+            .contains("invalid path pattern"));
+    }
+
     #[test]
     fn package_specs_match_names_and_purls() {
         let lodash = "pkg:npm/lodash@4.17.20";
diff --git a/crates/socket-patch-cli/tests/cli_parse_scan.rs b/crates/socket-patch-cli/tests/cli_parse_scan.rs
index ff27865a..06863f78 100644
--- a/crates/socket-patch-cli/tests/cli_parse_scan.rs
+++ b/crates/socket-patch-cli/tests/cli_parse_scan.rs
@@ -623,8 +623,11 @@ fn mode_agent_is_the_source_of_truth() {
     // v5: no mode selected means hosted...
     let folded = parse_and_resolve(&[]).expect("fold ok");
     assert_eq!(folded.mode, Some(ScanMode::Hosted), "a bare scan is hosted");
-    // ...except where no lockfile can be rewired: those stay report-only.
-    for argv in [&["--prune"][..], &["packages/foo"], &["--global"]] {
+    // PATHs name hosted project directories.
+    let folded = parse_and_resolve(&["packages/foo"]).expect("fold ok");
+    assert_eq!(folded.mode, Some(ScanMode::Hosted));
+    // No project lockfile to rewire: these stay report-only.
+    for argv in [&["--prune"][..], &["--global"]] {
         let folded = parse_and_resolve(argv).expect("fold ok");
         assert_eq!(folded.mode, None, "{argv:?} stays report-only");
     }
diff --git a/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs b/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs
index a82258b2..dde9044b 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs
@@ -1274,15 +1274,15 @@ async fn scan_human_empty_batch_reports_no_patches_once() {
 // Non-TTY human scans: the mode-less scan is report-only, explicit intent
 // auto-proceeds
 // ---------------------------------------------------------------------------
-// v5: scan never prompts. A bare scan runs hosted mode; a path-scoped,
-// `--prune` or global scan with no mode only reports (it has no lockfile
-// to rewire), and `--mode agent` applies in place without asking.
+// v5: scan never prompts. A bare scan runs hosted mode; a `--prune` or
+// global scan with no mode only reports (it has no lockfile to rewire),
+// and `--mode agent` applies in place without asking.
 
-/// A path-scoped scan with no mode: the discovery, table and per-patch
-/// preview print (the report IS the value), then the run stops — no view
-/// fetch, no `.socket/`, the installed file untouched.
+/// `--prune` with no mode: the discovery, table and per-patch preview
+/// print (the report IS the value), then the run stops — no view fetch, no
+/// `.socket/`, the installed file untouched.
 #[tokio::test]
-async fn scan_path_scoped_human_without_a_mode_is_report_only() {
+async fn scan_prune_without_a_mode_is_report_only() {
     let mock = MockServer::start().await;
     let purl = "pkg:npm/minimist@1.2.2";
     mount_one_patch_api(&mock, purl, b"x\n").await;
@@ -1291,7 +1291,7 @@ async fn scan_path_scoped_human_without_a_mode_is_report_only() {
     write_root_package_json(tmp.path());
     write_npm_package(tmp.path(), "minimist", "1.2.2", b"x\n");
 
-    let (code, stdout, stderr) = run_scan_human(tmp.path(), &mock.uri(), &["node_modules"]);
+    let (code, stdout, stderr) = run_scan_human(tmp.path(), &mock.uri(), &["--prune"]);
     assert_eq!(
         code, 0,
         "report-only is a success; stdout={stdout}; stderr={stderr}"
@@ -1479,6 +1479,35 @@ fn seed_redirect_ledger(root: &Path, purl: &str, uuid: &str) {
     .unwrap();
 }
 
+/// Hosted PATHs name project directories: each runs as its own scan
+/// (its own discovery and redirect), under a `== <dir> ==` header.
+#[tokio::test]
+async fn scan_hosted_paths_run_once_per_project_directory() {
+    let mock = MockServer::start().await;
+    let purl = "pkg:npm/minimist@1.2.2";
+    mount_batch_one(&mock, purl, UUID, "free", &[], false).await;
+    mount_by_package(&mock, purl, UUID, serde_json::json!({})).await;
+    mount_forbidden_reference(&mock, purl).await;
+
+    let tmp = tempfile::tempdir().unwrap();
+    for app in ["apps/a", "apps/b"] {
+        let dir = tmp.path().join(app);
+        std::fs::create_dir_all(&dir).unwrap();
+        write_root_package_json(&dir);
+        write_npm_package(&dir, "minimist", "1.2.2", b"x\n");
+    }
+
+    let (code, stdout, stderr) = run_scan_human(tmp.path(), &mock.uri(), &["apps/*"]);
+    assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
+    for app in ["apps/a", "apps/b"] {
+        let header = format!("== {} ==", std::path::Path::new(app).display());
+        assert!(stdout.contains(&header), "missing {header:?}: {stdout}");
+    }
+    assert_eq!(stdout.matches("Redirected 0 packages").count(), 2, "{stdout}");
+    let reqs = recorded(&mock).await;
+    assert_eq!(batch_bodies(&reqs).len(), 2, "one discovery per directory");
+}
+
 #[tokio::test]
 async fn scan_hosted_human_prints_table_updates_and_redirects() {
     let mock = MockServer::start().await;
diff --git a/crates/socket-patch-cli/tests/scan_invariants.rs b/crates/socket-patch-cli/tests/scan_invariants.rs
index e7f5e61e..22fd29e2 100644
--- a/crates/socket-patch-cli/tests/scan_invariants.rs
+++ b/crates/socket-patch-cli/tests/scan_invariants.rs
@@ -1704,8 +1704,8 @@ async fn report_only_scan_json_surfaces_hosted_redirect_state() {
         /*with_record=*/ true,
     );
 
-    // A path-scoped scan with no mode: the read-only discovery envelope.
-    let (code, stdout, stderr) = run_scan(tmp.path(), &mock.uri(), &["node_modules"]);
+    // `--prune` with no mode: the read-only discovery envelope.
+    let (code, stdout, stderr) = run_scan(tmp.path(), &mock.uri(), &["--prune"]);
     assert_eq!(
         code, 0,
         "report-only scan must stay exit 0; stdout={stdout}; stderr={stderr}"
diff --git a/crates/socket-patch-cli/tests/scan_paths_e2e.rs b/crates/socket-patch-cli/tests/scan_paths_e2e.rs
index 954c9ec3..d338ccf8 100644
--- a/crates/socket-patch-cli/tests/scan_paths_e2e.rs
+++ b/crates/socket-patch-cli/tests/scan_paths_e2e.rs
@@ -213,7 +213,7 @@ async fn paths_scope_narrows_the_query() {
     let tmp = tempfile::tempdir().unwrap();
     write_two_subtree_project(tmp.path());
 
-    let (code, stdout, stderr) = run_scan(tmp.path(), &server.uri(), &["packages/app"]);
+    let (code, stdout, stderr) = run_scan(tmp.path(), &server.uri(), &["packages/app", "--mode", "agent", "--dry-run"]);
     assert_eq!(
         code, 0,
         "scoped scan must exit 0; stdout={stdout}; stderr={stderr}"
@@ -474,7 +474,7 @@ async fn supplements_excluded_with_warning() {
     // purl reaches the API.
     let scoped_server = MockServer::start().await;
     mock_batch_empty(&scoped_server).await;
-    let (code, stdout, stderr) = run_scan(tmp.path(), &scoped_server.uri(), &["packages/app"]);
+    let (code, stdout, stderr) = run_scan(tmp.path(), &scoped_server.uri(), &["packages/app", "--mode", "agent", "--dry-run"]);
     assert_eq!(
         code, 0,
         "scoped scan must exit 0; stdout={stdout}; stderr={stderr}"
@@ -540,12 +540,14 @@ async fn supplements_excluded_with_warning() {
 // ---------------------------------------------------------------------------
 
 #[tokio::test]
-async fn paths_with_hosted_or_vendored_mode_exit_2() {
-    // All three refusals fire before any network I/O, so the unreachable
-    // API URL doubles as the no-network oracle (a connect attempt would
+async fn paths_with_hosted_or_vendored_mode_name_project_directories() {
+    // Every refusal fires before any network I/O, so the unreachable API
+    // URL doubles as the no-network oracle (a connect attempt would
     // surface as a different error, not the usage message).
     let tmp = tempfile::tempdir().unwrap();
     write_root_package_json(tmp.path());
+    std::fs::create_dir_all(tmp.path().join("apps/a")).unwrap();
+    std::fs::create_dir_all(tmp.path().join("apps/b")).unwrap();
 
     for mode in ["hosted", "vendored"] {
         let (code, stdout, stderr) = run_scan(
@@ -555,12 +557,12 @@ async fn paths_with_hosted_or_vendored_mode_exit_2() {
         );
         assert_eq!(
             code, 2,
-            "PATHS + --mode {mode} must be a usage error (exit 2); \
+            "a PATH that is not a directory is a usage error (exit 2) under --mode {mode}; \
              stdout={stdout}; stderr={stderr}"
         );
         assert!(
-            stderr.contains("path targeting"),
-            "--mode {mode} refusal must name path targeting; stderr={stderr}"
+            stderr.contains("`packages/app` is not a directory"),
+            "stderr={stderr}"
         );
         assert!(
             stdout.trim().is_empty(),
@@ -568,6 +570,15 @@ async fn paths_with_hosted_or_vendored_mode_exit_2() {
         );
     }
 
+    // --json keeps stdout one document: one project directory only.
+    let (code, stdout, stderr) = run_scan(tmp.path(), "http://127.0.0.1:1", &["apps/*"]);
+    assert_eq!(code, 2, "stdout={stdout}; stderr={stderr}");
+    assert!(
+        stderr.contains("--json takes one project directory (2 given)"),
+        "stderr={stderr}"
+    );
+    assert!(stdout.trim().is_empty(), "stdout={stdout}");
+
     // An unparseable glob is the same exit-2 usage-error shape.
     let (code, stdout, stderr) = run_scan(tmp.path(), "http://127.0.0.1:1", &["x["]);
     assert_eq!(

From 60918330d5a8b43b259cd8aab9d6d860163149cf Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Sun, 27 Sep 2026 16:43:12 -0400
Subject: [PATCH 07/32] Rank [UPDATE] detection by the same rule scan installs
 by

candidate_supersedes still put severity above merge state, so scan's
updates[] and [UPDATE] marker could name a different patch from the one
scan selects. It now calls a new ranking::batch_supersedes, which uses the
same merged-first key as the selection and ignores the tier and uuid
tiebreaks and missing dates.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .../src/commands/scan/discovery.rs            | 282 ++++++------------
 crates/socket-patch-core/src/api/ranking.rs   |  17 ++
 2 files changed, 101 insertions(+), 198 deletions(-)

diff --git a/crates/socket-patch-cli/src/commands/scan/discovery.rs b/crates/socket-patch-cli/src/commands/scan/discovery.rs
index 8546cb6e..d9d51ea7 100644
--- a/crates/socket-patch-cli/src/commands/scan/discovery.rs
+++ b/crates/socket-patch-cli/src/commands/scan/discovery.rs
@@ -39,12 +39,9 @@ pub(super) struct LockfileSupplement {
     /// packages included), kept so the hosted-wiring probes reuse it instead
     /// of re-parsing every project lockfile. Empty for global scans.
     pub(super) entries: Vec<LockfileEntry>,
-    /// npm layouts the lockfile inventory REFUSED (Plug'n'Play loaders) —
-    /// packages structurally unreachable, as opposed to nothing-to-inventory.
-    /// Scan surfaces these as explicit refusal warnings: under yarn PnP the
-    /// installed-tree crawl is also empty (no `node_modules/`), so without
-    /// this channel a PnP project scans as a silent success-0 no-op in
-    /// every mode.
+    /// npm layouts the lockfile inventory REFUSED (Plug'n'Play loaders).
+    /// Scan surfaces these as refusal warnings: under PnP the installed-tree
+    /// crawl is empty too, so otherwise the project scans as a silent no-op.
     pub(super) unsupported: Vec<socket_patch_core::vendor::lock_inventory::UnsupportedNpmLayout>,
 }
 
@@ -184,16 +181,10 @@ pub(super) async fn vendored_ledger_supplement(
             .values()
             .map(|entry| strip_purl_qualifiers(&entry.base_purl).to_string())
             .collect(),
-        // Corrupt/unreadable ledger (a MISSING file is Ok(empty) above).
-        // Returning empty here silently dropped every vendored purl from
-        // `scanned_purls` — and since the purl-keys prune
-        // exemption degrades to empty on the same Err (fail-open by its
-        // documented contract), `scan --prune` then deleted still-vendored
-        // packages' manifest entries and blobs while their committed
-        // artifacts remained. Recover the vendored set from the committed
-        // ground truth instead: a manifest entry whose patch uuid owns a
-        // live `.socket/vendor/<eco>/<uuid>` artifact dir is vendored (the
-        // contract-documented recovery convention — see `vendor::path`).
+        // Corrupt/unreadable ledger (a MISSING file is Ok(empty) above):
+        // recover the vendored set from the committed artifacts, or
+        // `scan --prune` (whose ledger exemption also degrades to empty)
+        // would delete still-vendored packages' manifest entries and blobs.
         Err(_) => vendored_purls_from_artifacts(common).await,
     };
     let crawled_norm: HashSet<String> = crawled
@@ -258,12 +249,12 @@ async fn vendored_purls_from_artifacts(common: &GlobalArgs) -> Vec<String> {
     out
 }
 
-/// Vendor-mode pre-prompt check: uuids of selected patches whose installed
+/// Vendor-mode pre-flight check: uuids of selected patches whose installed
 /// files match NEITHER beforeHash nor afterHash — the patch was built
 /// against different bytes than the installed artifact. Vendoring still
 /// succeeds for these (the vendor stage force-applies the verified patched
-/// content; see `force_apply_staged`), but the user should learn it BEFORE
-/// the confirm prompt, not from a post-hoc warning event.
+/// content; see `force_apply_staged`), but the user learns it before
+/// vendoring starts rather than from a post-hoc warning event.
 ///
 /// Returns `(mismatched uuids, fetched views by uuid)`: the download phase
 /// serves its records from the views instead of fetching each one a second
@@ -272,12 +263,10 @@ async fn vendored_purls_from_artifacts(common: &GlobalArgs) -> Vec<String> {
 ///
 /// `vendor` is the run's ledger (`None` when unreadable — fail-open, the
 /// preflight reports the corruption): a purl the ledger already holds
-/// detached at the selected uuid with an embedded record — exactly the
-/// entries the download phase reuses without a view fetch — is compared
+/// detached at the selected uuid with an embedded record is compared
 /// against that record's file hashes instead of fetching the view, so an
-/// idempotent re-run performs zero view fetches in the human arm too
-/// (contract: "same-uuid re-runs reuse the embedded record, skip the
-/// patch-view fetch"). Nothing is inserted into `views` for them.
+/// idempotent re-run performs zero view fetches. Nothing is inserted into
+/// `views` for them.
 ///
 /// Best-effort and read-only: a detail-fetch failure or an unresolvable
 /// installed path just skips the annotation — it never blocks the flow and
@@ -410,22 +399,16 @@ pub(super) async fn preverify_vendor_baselines<W: std::io::Write>(
 }
 
 /// Fold both ledgers' patch records into the manifest view update detection
-/// consults. Hosted mode persists its purl→uuid records ONLY in
-/// `.socket/vendor/redirect-state.json`, and vendored mode ONLY in
-/// `.socket/vendor/state.json` (each entry embeds its patch `record`) —
-/// neither writes `.socket/manifest.json` — so without this fold a pure
-/// hosted or vendored project's `updates[]` (the documented CI signal, see
-/// CLI_CONTRACT.md) is structurally empty and a superseding patch is never
-/// reported. Precedence on a collision: manifest > redirect ledger > vendor
-/// ledger (a manifest PURL is manifest-owned, matching VEX's candidate merge
-/// in `commands::vex_sources` for purls no lockfile wires to another patch),
-/// then the lockfile's hosted pins (`hosted_pins`, uuid only).
-/// Vendor entries are keyed by their ledger map key
-/// (the manifest-form purl, qualifiers included — `detect_updates` bridges
-/// the spellings); a legacy entry without an embedded record contributes its
-/// uuid alone, which is all update detection reads. Borrows the manifest
-/// untouched when nothing else contributes. Pure / no I/O so it's
-/// unit-testable.
+/// consults. Hosted mode records purl→uuid ONLY in
+/// `.socket/vendor/redirect-state.json` and vendored mode ONLY in
+/// `.socket/vendor/state.json`, so without this fold a pure hosted or
+/// vendored project's `updates[]` would always be empty. Precedence on a
+/// collision: manifest > redirect ledger > vendor ledger (matching VEX's
+/// candidate merge in `commands::vex_sources`), then the lockfile's hosted
+/// pins (`hosted_pins`, uuid only). Vendor entries are keyed by their
+/// manifest-form ledger key (`detect_updates` bridges the spellings); a
+/// legacy entry without an embedded record contributes its uuid alone.
+/// Borrows the manifest untouched when nothing else contributes.
 pub(super) fn merge_ledger_records_for_updates<'a>(
     manifest: Option<&'a PatchManifest>,
     redirect: Option<&socket_patch_core::patch::redirect::RedirectState>,
@@ -488,42 +471,24 @@ pub(super) fn detect_updates(
     let mut updates = Vec::new();
     for pkg in packages {
         // The candidate is the top-ranked patch — the one the apply path
-        // resolves to. Both sides rank with `api::ranking`, so the
-        // `[UPDATE]` marker and the JSON `updates` array track what
-        // `--apply` installs.
-        //
-        // Caveat, and the one place the two can still disagree: we rank
-        // BATCH-shaped patches here, while apply ranks the richer
-        // by-package shape. The batch response currently omits
-        // `publishedAt`, so when a package's top candidates tie on merge
-        // status AND severity, this falls through to the UUID tiebreak
-        // while apply correctly uses the date. `BatchPatchInfo` already
-        // deserializes `publishedAt` when present, so the divergence
-        // disappears the moment the endpoint emits it — no client change.
-        // (Verified live on pkg:npm/axios@1.6.0, two free HIGH patches.)
+        // resolves to, so `[UPDATE]` and `updates[]` track what scan
+        // installs. One divergence: the batch response omits `publishedAt`,
+        // so on a merge-status + severity tie this falls to the tier/uuid
+        // tiebreaks where apply (by-package shape) uses the date.
         //
-        // `ApiClient` already returns each package's patches best-first, so
-        // `min_by` here is a cheap guard rather than a correction — but it
-        // is load-bearing for callers that build a `BatchPackagePatches`
-        // themselves rather than getting one from the client.
+        // `min_by` is load-bearing for callers that build a
+        // `BatchPackagePatches` themselves (the client already sorts).
         let Some(candidate) = pkg.patches.iter().min_by(|a, b| cmp_batch_infos(a, b)) else {
             continue;
         };
-        // Manifest keys are written verbatim from the *patch* purl, which
-        // the API serves percent-encoded (`pkg:npm/%40scope/...`) and, for
-        // artifact-pinned ecosystems, qualified (`?artifact_id=...`); the
-        // batch *package* purl is the crawler's literal spelling. Bridge
-        // both divergences like the lockfile-only partition does: exact hit
-        // first, then a normalized qualifier-stripped comparison.
+        // Manifest keys are the API's *patch* purl (percent-encoded and,
+        // for artifact-pinned ecosystems, qualified); the batch *package*
+        // purl is the crawler's literal spelling. Exact hit first, then a
+        // normalized qualifier-stripped comparison.
         //
-        // Qualifier TWINS (one package recorded under two artifact-pinned
-        // keys, e.g. a pypi wheel + sdist pair) both match the stripped
-        // comparison. `manifest.patches` is a HashMap, so a bare `find`
-        // would pick a per-process-random twin; instead: any stale twin
-        // means an update is available, so prefer the first twin (in
-        // sorted-key order, for run-to-run stability) whose uuid differs
-        // from the candidate, and fall back to the first twin when all
-        // agree.
+        // Qualifier TWINS (e.g. a pypi wheel + sdist pair) all match the
+        // stripped form: any stale twin means an update, so prefer the
+        // first (sorted-key order, for stability) whose uuid differs.
         let existing = manifest.patches.get(&pkg.purl).or_else(|| {
             let want = normalize_purl(strip_purl_qualifiers(&pkg.purl));
             let mut twins: Vec<(&String, &socket_patch_core::manifest::schema::PatchRecord)> =
@@ -546,22 +511,10 @@ pub(super) fn detect_updates(
         if candidate.uuid == existing.uuid {
             continue;
         }
-        // (b) The candidate out*ranks* the recorded patch, but "outranks"
-        // includes the pure tier/uuid tiebreaks and — because the batch
-        // endpoint routinely omits `publishedAt` — an epoch-0 date that is
-        // NOT real evidence of recency. When the recorded patch is still
-        // among the offered patches, `cmp_batch_infos` can crown an
-        // equal-or-older sibling as the "top" candidate purely on the uuid
-        // tiebreak, which used to nag a vendored project forever with a patch
-        // no newer than the one already committed. Only surface an update
-        // when the candidate GENUINELY supersedes the applied patch on a
-        // meaningful axis (severity, merge coverage, or a real,
-        // strictly-greater publish date).
-        //
-        // If the recorded patch is no longer offered at all, we cannot
-        // compare ages; a different, currently-available candidate is the
-        // best signal we have, so flag it (this is also the only behavior a
-        // manifest-only, no-batch record can produce).
+        // (b) "Outranks" includes the tier/uuid tiebreaks and the batch
+        // endpoint's missing (epoch-0) dates, so when the recorded patch is
+        // still offered, only report a candidate that genuinely supersedes
+        // it. If it is no longer offered, any different candidate is flagged.
         if let Some(applied) = pkg.patches.iter().find(|p| p.uuid == existing.uuid) {
             if !candidate_supersedes(candidate, applied) {
                 continue;
@@ -576,59 +529,11 @@ pub(super) fn detect_updates(
     updates
 }
 
-/// Whether `candidate` genuinely supersedes the already-applied `applied`
-/// patch — strictly better on a MEANINGFUL ranking axis (severity, merge
-/// coverage, or a real, strictly-greater publish date), never on the pure
-/// tier/uuid tiebreaks or an absent-date (epoch-0) artifact.
-///
-/// This is the guard that kills the false `[UPDATE]` nag. Batch responses
-/// omit `publishedAt`, so [`cmp_batch_infos`] falls through to the uuid
-/// tiebreak and can rank an equal-or-older sibling above the applied patch;
-/// flagging that as an update perpetually nags a vendored project. Both
-/// patches are batch-shaped and drawn from the SAME package response, so this
-/// compares like with like, mirroring `api::ranking::rank_batch_info`.
+/// Whether `candidate` genuinely supersedes the applied patch (see
+/// [`socket_patch_core::api::ranking::batch_supersedes`]): the guard that
+/// keeps an equal sibling from showing as a perpetual `[UPDATE]`.
 fn candidate_supersedes(candidate: &BatchPatchInfo, applied: &BatchPatchInfo) -> bool {
-    use socket_patch_core::api::date::parse_timestamp_secs;
-    use socket_patch_core::api::ranking::{merged_coverage, severity_order};
-
-    // Advisory count = inferred merge state: prefer GHSA ids, fall back to
-    // CVE ids only when no GHSA is named (so CVE aliases can't inflate it).
-    let advisories = |p: &BatchPatchInfo| {
-        if p.ghsa_ids.is_empty() {
-            p.cve_ids.len()
-        } else {
-            p.ghsa_ids.len()
-        }
-    };
-
-    // Severity: lower rank number = worse vulnerability. A candidate fixing a
-    // strictly worse advisory supersedes; a less-severe one never does.
-    let cand_sev = severity_order(candidate.severity.as_deref());
-    let applied_sev = severity_order(applied.severity.as_deref());
-    if cand_sev != applied_sev {
-        return cand_sev < applied_sev;
-    }
-
-    // Merge coverage: a patch folding in more advisories is broader.
-    let cand_cov = merged_coverage(advisories(candidate));
-    let applied_cov = merged_coverage(advisories(applied));
-    if cand_cov != applied_cov {
-        return cand_cov > applied_cov;
-    }
-
-    // Recency: only a REAL, strictly-greater publishedAt counts. A missing
-    // date (the batch norm) parses to `None` and is NOT treated as newer, so
-    // an equal-or-older sibling is never surfaced as an update. Parsing stays
-    // on the RFC-2822-aware `api::date` helper.
-    let cand_date = candidate
-        .published_at
-        .as_deref()
-        .and_then(parse_timestamp_secs);
-    let applied_date = applied
-        .published_at
-        .as_deref()
-        .and_then(parse_timestamp_secs);
-    matches!((cand_date, applied_date), (Some(c), Some(a)) if c > a)
+    socket_patch_core::api::ranking::batch_supersedes(candidate, applied)
 }
 
 /// The scan table's VULNERABILITIES data for one package, built from the
@@ -727,12 +632,8 @@ mod tests {
 
     #[test]
     fn severity_order_moderate_is_medium_tier() {
-        // Regression: GHSA emits `moderate` for the medium tier, and scan
-        // passes raw API severities straight through. get.rs
-        // `severity_rank`, `ui::severity`, and core's
-        // `get_severity_order` all map it to medium; ranking it 4 here
-        // (= unknown, below `low`) made the table's max-severity column
-        // show `low` for a package whose worst vuln is moderate.
+        // GHSA emits `moderate` for the medium tier and scan passes raw API
+        // severities through, so it must rank as medium, not unknown.
         assert_eq!(severity_order("moderate"), severity_order("medium"));
         assert!(severity_order("moderate") < severity_order("low"));
         assert_eq!(severity_order("Moderate"), severity_order("medium"));
@@ -829,8 +730,7 @@ mod tests {
     fn detect_updates_bridges_qualified_manifest_keys() {
         // Manifest keys for artifact-pinned ecosystems carry qualifiers
         // (`?artifact_id=...`); the batch purl is bare. The stripped-purl
-        // bridge must match them — decode-only would silently drop these
-        // packages from `updates[]` again.
+        // bridge must match them, or these packages drop out of `updates[]`.
         let m = manifest_with(&[("pkg:pypi/foo@1.0?artifact_id=foo-1.0.tar.gz", "uuid-a")]);
         let pkgs = vec![batch_with("pkg:pypi/foo@1.0", &["uuid-b"])];
         let updates = detect_updates(Some(&m), &pkgs);
@@ -934,13 +834,8 @@ mod tests {
 
     #[test]
     fn detect_updates_no_update_when_manifest_holds_candidate_despite_other_patches() {
-        // Regression: the human-readable table once flagged `[UPDATE]` (and
-        // bumped `updates_available`) whenever *any* batch patch differed from
-        // the manifest UUID. But the apply path resolves to the top-ranked
-        // patch, so a manifest already holding that candidate is up to date
-        // even when the batch also lists lesser patches. The table and the
-        // JSON `updates` array must agree; both derive from this function,
-        // which compares the ranked candidate only.
+        // A manifest already holding the top-ranked candidate is up to date
+        // even when the batch also lists lesser patches.
         let m = manifest_with(&[("pkg:npm/foo@1.0", "uuid-critical")]);
         let pkgs = vec![batch_ranked(
             "pkg:npm/foo@1.0",
@@ -958,15 +853,9 @@ mod tests {
 
     #[test]
     fn detect_updates_no_nag_when_applied_patch_still_offered_and_batch_omits_dates() {
-        // Regression (false-update-nag-batch-ranking / -older-uuid): after
-        // vendoring, the batch endpoint re-lists BOTH the applied patch and a
-        // sibling and OMITS `publishedAt`. With no real date, `cmp_batch_infos`
-        // collapses to the uuid tiebreak and crowns whichever sibling sorts
-        // first. `uuid-a` sorts before the applied `uuid-b`, so it becomes the
-        // ranked candidate — but it is no genuine improvement (same severity,
-        // same coverage, no newer date), so it must NOT be surfaced as an
-        // update. Before the fix this flagged a perpetual `[UPDATE]` pointing
-        // at an equal-or-older patch.
+        // The batch re-lists the applied patch and a sibling with no
+        // `publishedAt`, so `uuid-a` wins only on the uuid tiebreak. That is
+        // no genuine improvement, so it must NOT be surfaced as an update.
         let m = manifest_with(&[("pkg:npm/foo@1.0", "uuid-b")]);
         let pkgs = vec![batch_with("pkg:npm/foo@1.0", &["uuid-a", "uuid-b"])];
         assert!(
@@ -1029,8 +918,7 @@ mod tests {
     }
 
     /// A vendor ledger with one entry per `(key, uuid, detached)`: detached
-    /// entries embed their record (the D2 posture), legacy ones carry only
-    /// the uuid.
+    /// entries embed their record, legacy ones carry only the uuid.
     fn vendor_ledger_with(entries: &[(&str, &str, bool)]) -> VendorState {
         let entries: serde_json::Map<String, serde_json::Value> = entries
             .iter()
@@ -1061,8 +949,7 @@ mod tests {
     fn ledger_only_project_reports_superseding_patch_in_updates() {
         // Pure hosted project: NO .socket/manifest.json, one redirected patch
         // recorded in the ledger; discovery now offers a different (newer)
-        // uuid. The merged view must make detect_updates flag it — this was
-        // structurally impossible before the fold (manifest-only detection).
+        // uuid. The merged view must make detect_updates flag it.
         let ledger = ledger_with(&[("pkg:npm/foo@1.0", "uuid-old")]);
         let merged = merge_ledger_records_for_updates(None, Some(&ledger), None, &[]);
         let pkgs = vec![batch_with("pkg:npm/foo@1.0", &["uuid-new"])];
@@ -1075,7 +962,7 @@ mod tests {
 
     #[test]
     fn vendored_only_project_reports_superseding_patch_in_updates() {
-        // Pure vendored project (manifest-free, D2): the ledger entry's
+        // Pure vendored project (manifest-free): the ledger entry's
         // embedded record is the "old" side. A legacy entry with no embedded
         // record still contributes its uuid — all detection reads.
         for detached in [true, false] {
@@ -1174,16 +1061,9 @@ mod tests {
     }
 
     // ---- vendored_ledger_supplement (corrupt-ledger fallback) ---------------
-    // The prune-safety chain for vendored packages: their purls enter
-    // `scanned_purls` via this supplement, which shields their manifest
-    // entries (and blobs) from `scan --prune`'s GC even when the
-    // `VendorState::purl_keys` exemption degrades to empty (fail-open by its
-    // documented contract). A corrupt `.socket/vendor/state.json`
-    // (`load_state` → Err; a MISSING file is Ok(empty)) must therefore fall
-    // back to the committed ground truth — manifest entries whose patch uuid
-    // owns a live `.socket/vendor/<eco>/<uuid>` artifact dir — instead of
-    // silently returning empty and letting the prune delete still-vendored
-    // records.
+    // Vendored purls enter `scanned_purls` via this supplement, which shields
+    // their manifest entries from `scan --prune`. A corrupt ledger must fall
+    // back to the committed artifact dirs rather than return empty.
 
     const VENDORED_UUID: &str = "11111111-1111-4111-8111-111111111111";
 
@@ -1551,12 +1431,10 @@ mod tests {
         assert_ne!(rewritten[0].1, "probe detail text");
     }
 
-    // ---- candidate_supersedes (merge-coverage rung) ----------------------
-    // Production publishes no merged patches yet, so this rung has never run
-    // outside these tests; these pin its polarity for the day one ships.
+    // ---- candidate_supersedes (merge rung) ---------------------------------
 
     /// A batch-shaped patch with explicit advisory lists and NO publish
-    /// date, so only the severity and merge-coverage rungs can decide.
+    /// date, so only the merge and severity rungs can decide.
     fn info_with_advisories(
         uuid: &str,
         severity: Option<&str>,
@@ -1578,7 +1456,7 @@ mod tests {
     #[test]
     fn candidate_supersedes_on_broader_ghsa_merge_coverage() {
         // Same severity, no dates: only the advisory count separates them.
-        // A patch folding in MORE GHSAs is broader and genuinely supersedes.
+        // A merged patch (>= 2 GHSAs) genuinely supersedes a single one.
         let merged = info_with_advisories(
             "uuid-merged",
             Some("high"),
@@ -1591,22 +1469,34 @@ mod tests {
             candidate_supersedes(&merged, &single),
             "broader merge coverage is a genuine supersede"
         );
-        // Swapped: a NARROWER candidate never supersedes. Only reachable by
-        // direct call — via detect_updates a lower-coverage candidate can
-        // never win `min_by` — but the polarity of the `>` at the coverage
-        // return must be pinned somewhere.
+        // Swapped: an unmerged candidate never supersedes a merged one.
         assert!(
             !candidate_supersedes(&single, &merged),
             "narrower coverage must never supersede"
         );
     }
 
+    #[test]
+    fn a_merged_candidate_supersedes_a_more_severe_single_patch() {
+        // Same rule as the selection ranking: merged beats severity, so the
+        // [UPDATE] marker names the patch scan would install.
+        let merged = info_with_advisories(
+            "uuid-merged",
+            Some("low"),
+            &["GHSA-1111-1111-1111", "GHSA-2222-2222-2222"],
+            &[],
+        );
+        let critical =
+            info_with_advisories("uuid-crit", Some("critical"), &["GHSA-3333-3333-3333"], &[]);
+        assert!(candidate_supersedes(&merged, &critical));
+        assert!(!candidate_supersedes(&critical, &merged));
+    }
+
     #[test]
     fn candidate_supersedes_cve_aliases_do_not_inflate_ghsa_coverage() {
         // Both sides name a GHSA, so the CVE lists are aliases and must not
-        // count: 1 == 1 advisory, no date on either side -> not a supersede
-        // in either direction (falls through coverage to the strict-date
-        // rung, which requires two REAL dates).
+        // count: both unmerged, same severity, no dates -> not a supersede
+        // in either direction (the date rung requires two REAL dates).
         let candidate = info_with_advisories(
             "uuid-cand",
             Some("high"),
@@ -1628,8 +1518,7 @@ mod tests {
         // End-to-end through detect_updates: the manifest holds the
         // single-advisory patch; the batch offers it alongside a merged
         // sibling (2 GHSAs, same severity, no dates). The merged patch wins
-        // the ranking on coverage AND genuinely supersedes — the module doc
-        // promises this works the day production ships a merged patch.
+        // the ranking AND genuinely supersedes.
         let m = manifest_with(&[("pkg:npm/foo@1.0", "uuid-single")]);
         let pkgs = vec![BatchPackagePatches {
             purl: "pkg:npm/foo@1.0".to_string(),
@@ -1710,12 +1599,9 @@ mod tests {
             search_result("uuid-ghost", "pkg:npm/ghost@1.0.0"),
         ];
         let crawled = vec![
-            // The lockonly purl HAS a crawled counterpart — production
-            // passes `filtered_crawled`, which CONTAINS the fabricated
-            // lockfile-only supplement entries — so the lockfile-only guard
-            // is the deciding branch: were it (or its normalize bridge)
-            // broken, the find below would succeed and the detail fetch
-            // would fire, tripping the request-log assertion.
+            // The lockonly purl HAS a crawled counterpart (production's crawl
+            // includes the fabricated lockfile-only entries), so the
+            // lockfile-only guard is the deciding branch.
             crawled_pkg(
                 "lockonly",
                 "pkg:npm/@scope/lockonly@1.0.0",
diff --git a/crates/socket-patch-core/src/api/ranking.rs b/crates/socket-patch-core/src/api/ranking.rs
index 0e828ff7..395f790d 100644
--- a/crates/socket-patch-core/src/api/ranking.rs
+++ b/crates/socket-patch-core/src/api/ranking.rs
@@ -153,6 +153,23 @@ pub fn cmp_search_results(a: &PatchSearchResult, b: &PatchSearchResult) -> Order
     rank_search_result(a).cmp(&rank_search_result(b))
 }
 
+/// Whether `candidate` is strictly better than `applied` on a meaningful
+/// rung of the ranking: merged state, severity (between unmerged patches),
+/// or a real, strictly later publish date. The paid-tier and uuid tiebreaks
+/// never count, and neither does a missing date (the batch endpoint omits
+/// `publishedAt`), so an equal sibling is never reported as an update.
+pub fn batch_supersedes(candidate: &BatchPatchInfo, applied: &BatchPatchInfo) -> bool {
+    let (c, a) = (rank_batch_info(candidate), rank_batch_info(applied));
+    if c.not_merged != a.not_merged {
+        return !c.not_merged;
+    }
+    if c.severity != a.severity {
+        return c.severity < a.severity;
+    }
+    let (Reverse(c_date), Reverse(a_date)) = (c.patch_published, a.patch_published);
+    c_date > 0 && a_date > 0 && c_date > a_date
+}
+
 /// Compare two batch-shaped patches best-first. Pass straight to `sort_by`.
 ///
 /// Same key as [`cmp_search_results`], but the batch shape carries a

From 5e5f5ed9a4a5e136f800ca6a459f43255a98b910 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Sun, 27 Sep 2026 16:43:12 -0400
Subject: [PATCH 08/32] Default get to hosted mode, like scan

socket-patch get <id>, and the bare-UUID shortcut, now redirect the
package to its Socket-hosted patched copy. Agent mode (manifest + in-place
apply) is --mode agent. It stays the default with --save-only, which
records a manifest entry, and with --global/--global-prefix, since those
have no project lockfile to rewrite. The agent-mode test fixtures now pass
--mode agent.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 crates/socket-patch-cli/src/commands/get.rs   | 194 +++++++++---------
 crates/socket-patch-cli/src/lib.rs            |  10 +-
 .../tests/cli_get_silent_errors.rs            |  18 +-
 .../tests/covgap_commands_get.rs              |  31 ++-
 .../tests/get_nested_apply_api_flags_e2e.rs   |   8 +-
 .../tests/in_process_get_manifest_path.rs     |   4 +-
 .../tests/in_process_get_modes.rs             |   2 +-
 7 files changed, 130 insertions(+), 137 deletions(-)

diff --git a/crates/socket-patch-cli/src/commands/get.rs b/crates/socket-patch-cli/src/commands/get.rs
index 9797fc63..76fe2a8b 100644
--- a/crates/socket-patch-cli/src/commands/get.rs
+++ b/crates/socket-patch-cli/src/commands/get.rs
@@ -71,10 +71,8 @@ pub(crate) enum PatchAction {
 ///
 /// A non-zero exit code must ALWAYS pair with a non-`success` status:
 /// both are derived from the same predicate here so a JSON consumer
-/// reading `status` and a shell reading `$?` can never disagree. The
-/// historical bug was a `status` of `success` (keyed only on download
-/// failures) sitting next to an exit code of `1` produced by a failed
-/// *apply* step.
+/// reading `status` and a shell reading `$?` can never disagree (a failed
+/// *apply* step must not report `success`).
 fn run_outcome(patches_failed: bool, apply_failed: bool) -> (&'static str, i32) {
     if patches_failed || apply_failed {
         ("partial_failure", 1)
@@ -438,10 +436,9 @@ fn files_with_both_hashes(patch: &PatchResponse) -> HashMap<String, PatchFileInf
 /// This is the shared record-building rule for the scan/download/vendor
 /// flows AND the single-uuid apply path, so `get <uuid>` and
 /// `scan`/`apply`/`vendor` all record and write the same set of files.
-/// The previous both-hashes-only rule silently dropped every added file,
-/// e.g. the whole-crate cargo export where ALL files lack a `beforeHash`
-/// (recorded `files:{}` → reported `applied:1` while writing nothing) and
-/// a gem patch's genuinely-new runtime-guard file.
+/// A both-hashes rule here would drop every added file (e.g. a whole-crate
+/// cargo export where ALL files lack a `beforeHash`, recorded as `files:{}`
+/// while reporting `applied:1`).
 fn files_for_manifest(patch: &PatchResponse) -> HashMap<String, PatchFileInfo> {
     let mut files = HashMap::new();
     for (file_path, file_info) in &patch.files {
@@ -495,8 +492,7 @@ pub struct GetArgs {
     // `value_parser = parse_bool_flag` matches the `GlobalArgs` bool flags:
     // clap's default bool parser accepts only the literal strings
     // `true`/`false` from the env binding, so `SOCKET_SAVE_ONLY=1` (or an
-    // exported-but-empty `SOCKET_SAVE_ONLY=`) aborted every `get`
-    // invocation.
+    // exported-but-empty `SOCKET_SAVE_ONLY=`) would abort every `get`.
     #[arg(
         long = "save-only",
         alias = "no-apply",
@@ -511,9 +507,9 @@ pub struct GetArgs {
     // Hidden: it always fails with "not yet implemented" (see `run`), but
     // stays parseable so scripts and `SOCKET_ONE_OFF` keep getting that
     // explicit error instead of a clap parse failure.
-    // `value_parser = parse_bool_flag`: same env-crash fix as `--save-only`
-    // above — and `SOCKET_ONE_OFF` is shared with `rollback --one-off`,
-    // which already parses boolishly; the two must not diverge.
+    // `value_parser = parse_bool_flag`: same reason as `--save-only` above —
+    // and `SOCKET_ONE_OFF` is shared with `rollback --one-off`, which parses
+    // boolishly too; the two must not diverge.
     #[arg(
         long = "one-off",
         env = "SOCKET_ONE_OFF",
@@ -542,7 +538,7 @@ pub struct GetArgs {
     pub all_releases: bool,
 
     /// How to consume the patches: the same modes as `scan --mode`
-    /// (default: agent).
+    /// [default: hosted; agent with `--save-only` or `--global`]
     // agent = record in .socket/manifest.json + blobs and apply in place;
     // hosted = rewrite lockfiles so the patched deps resolve to Socket's
     // hosted patch server (no manifest, no blobs; state lives in the
@@ -1079,9 +1075,10 @@ fn forced_identifier_error(identifier: &str, id_type: IdentifierType) -> Option<
 /// Select one patch per PURL from available patches.
 ///
 /// Within a PURL, candidates are ranked by [`cmp_search_results`]: merged
-/// patches first, then by severity (critical → low), then most recently
-/// published. `tier` is an access filter here, not a ranking signal — a
-/// free critical patch outranks a paid low one.
+/// patches first (newest first, whatever their severity); other patches by
+/// severity (critical → low), then most recently published. `tier` is an
+/// access filter here, not a ranking signal — a free critical patch
+/// outranks a paid low one.
 ///
 /// - Users with paid access: auto-select the top-ranked patch per PURL.
 /// - Free users with one patch, or with `--yes`: auto-select the
@@ -1102,7 +1099,6 @@ pub(crate) fn select_patches(
     can_access_paid: bool,
     common: &GlobalArgs,
 ) -> Result<Vec<PatchSearchResult>, i32> {
-    // Group accessible patches by PURL
     let mut by_purl: HashMap<String, Vec<&PatchSearchResult>> = HashMap::new();
     for p in patches {
         if p.tier == "free" || can_access_paid {
@@ -1126,8 +1122,8 @@ pub(crate) fn select_patches(
 
         if can_access_paid {
             // Take the top-ranked patch. Note this is NOT "prefer paid":
-            // tier only breaks ties once merge status, severity and recency
-            // have all tied.
+            // tier only breaks ties once the merged/severity/recency ranking
+            // (see `api::ranking`) has tied.
             selected.push(group[0].clone());
         } else if group.len() == 1 || (common.yes && !common.json) {
             // One candidate, or `--yes` (which answers every prompt with its
@@ -1208,19 +1204,18 @@ pub struct DownloadParams {
     pub silent: bool,
     /// `--download-mode` value forwarded to the apply step.
     pub download_mode: String,
-    /// When `false` (the default — narrow), a PyPI package with multiple
-    /// release variants (`?artifact_id=...`) is filtered down to the one
-    /// matching the locally-installed distribution before download. When
-    /// `true` (`--all-releases`), every variant is downloaded. No effect
-    /// on ecosystems without per-release artifact_id variants.
+    /// When `false` (the default — narrow), a release-variant package (PyPI
+    /// `?artifact_id=`, RubyGems `?platform=`, Maven `?classifier=`) is
+    /// filtered down to the variant(s) matching the locally-installed
+    /// distribution before download. When `true` (`--all-releases`), every
+    /// variant is downloaded. No effect on ecosystems without per-release
+    /// variants.
     pub all_releases: bool,
     /// `--strict` forwarded to the nested apply (a beforeHash mismatch
     /// fails instead of warn-and-overwrite).
     pub strict: bool,
-    /// `--ecosystems` forwarded to the nested apply. Without this the
-    /// nested apply ran UNSCOPED over the whole manifest, so
-    /// `scan --ecosystems gem --sync` could mutate other ecosystems'
-    /// packages the user had explicitly filtered out.
+    /// `--ecosystems` forwarded to the nested apply, so it never touches
+    /// other ecosystems' packages the user filtered out.
     pub ecosystems: Option<Vec<String>>,
     /// Persist downloaded blob content into `.socket/blobs` (the apply
     /// flows need it for later hook/rollback runs). Vendor flows pass
@@ -1346,10 +1341,9 @@ async fn filter_to_installed_releases(
     // `variant_groups` is a HashMap, so both drains above are in bucket
     // order — which is this function's OUTPUT order, and therefore the
     // order the download loop emits `download.patches` / `apply.patches`
-    // in. Two identical runs produced different JSON. Sort the multi-
-    // variant bases so their warnings and kept variants are stable, and
-    // sort the whole kept list by purl before returning (below and at the
-    // early return): every sibling collection in the same envelope —
+    // in. Sort the multi-variant bases so their warnings and kept variants
+    // are stable, and sort the whole kept list by purl before returning
+    // (below and at the early return): every sibling collection in the same envelope —
     // scan's `packages`, the agent flow's `skip_records` — is purl-sorted.
     multi.sort_by(|a, b| a.0.cmp(&b.0));
 
@@ -1367,7 +1361,8 @@ async fn filter_to_installed_releases(
         .iter()
         .flat_map(|(_, variants)| variants.iter().map(|s| s.purl.clone()))
         .collect();
-    // All collected PURLs are PyPI; no ecosystem filter needed.
+    // Release-variant PURLs only (PyPI / RubyGems / Maven); partition_purls
+    // splits them by ecosystem, so no filter is needed.
     let partitioned = partition_purls(&all_qualified, None);
     let paths = find_packages_for_rollback(&partitioned, crawler_options, true).await;
 
@@ -1375,7 +1370,7 @@ async fn filter_to_installed_releases(
     // `api_concurrency` in flight) in the order the loop below consumes
     // them: bases in `multi` order, skipping the uninstalled ones, each
     // base's variants in order. Nothing here prints between fetches, and
-    // each request's `--debug` lines are released at its old turn.
+    // each request's `--debug` lines are released at its turn in that order.
     let installed_variants: Vec<String> = multi
         .iter()
         .filter(|(_, variants)| variants.iter().any(|s| paths.contains_key(&s.purl)))
@@ -1432,7 +1427,7 @@ async fn filter_to_installed_releases(
                     views.insert(s.uuid.clone(), patch);
                 }
                 // On a fetch error/miss, keep the variant so the main
-                // download loop can record the failure as it would today.
+                // download loop records the failure.
                 _ => candidates.push((s.purl.clone(), HashMap::new())),
             }
         }
@@ -1501,8 +1496,8 @@ fn purl_has_version(purl: &str) -> bool {
 }
 
 /// Does the raw pnpm-lock text RESOLVE `name@version`? Boundary-anchored
-/// probes over the three lock grammars — a plain `contains` collided on
-/// version prefixes (`left-pad@1.3.0` matched inside
+/// probes over the three lock grammars — a plain `contains` collides on
+/// version prefixes (`left-pad@1.3.0` matches inside
 /// `left-pad@1.3.0-beta.1`), name suffixes (`pad@1.3.0` inside
 /// `left-pad@1.3.0`), and unscoped-inside-scoped names (`name@1.0.0` inside
 /// `@scope/name@1.0.0`). The needles cover v6/v9's `name@version` and v5's
@@ -1943,7 +1938,7 @@ async fn fetch_selected_patches(
     // --all-releases was passed (a no-op for non-variant ecosystems and
     // single-variant packages). The views it fetched serve the loop below.
     // The narrowing queries the API: show that something is happening
-    // right after the confirm prompt.
+    // once selection (and get's confirm prompt) is done.
     let mut status = crate::ui::StatusLine::stderr(params.json, params.silent);
     status.set("Preparing download...");
     let (selected, warnings, views) = filter_to_installed_releases(
@@ -1956,7 +1951,8 @@ async fn fetch_selected_patches(
     .await;
     status.finish();
     prefetched.extend(views);
-    // No leading blank line: the prompt's answer already ended its line.
+    // No leading blank line: the caller's prompt or summary already ended
+    // its line.
     if matches!(store, RecordStore::Manifest(_)) && !quiet {
         eprintln!(
             "Downloading {}...",
@@ -1979,10 +1975,9 @@ async fn fetch_selected_patches(
     // (the same three checks, in the loop's order, over inputs the loop
     // never mutates) — run concurrently ahead of it, at most
     // `api_concurrency` in flight, and come back in selection order. The
-    // loop takes the next one exactly where it used to await the request,
-    // and each request's `--debug` lines print there too, so stdout, the
-    // per-patch stderr lines and the JSON records fold exactly as the
-    // serial loop's did.
+    // loop takes the next one where it would await the request, and each
+    // request's `--debug` lines print there too, so stdout, the per-patch
+    // stderr lines and the JSON records fold in selection order.
     let mut held: std::collections::HashSet<&str> = prefetched.keys().map(String::as_str).collect();
     let to_fetch: Vec<&str> = selected
         .iter()
@@ -2228,8 +2223,8 @@ pub(crate) type DetachedDownload = (
 ///
 /// `api_client` is the run's client (built once, proxy fallback included).
 /// `prefetched` maps uuid → an already-fetched view: the `get <uuid>` path
-/// resolved its identifier by fetching the view, and scan's interactive
-/// arm pre-verified baselines from the views — neither must fetch again (a
+/// resolved its identifier by fetching the view, and scan's vendored arm
+/// pre-verified baselines from the views — neither must fetch again (a
 /// fresh fetch could re-hit the 401 the proxy fallback just recovered
 /// from). The ledger idempotency check runs before the cache lookup, and a
 /// cache miss still fetches.
@@ -2264,9 +2259,9 @@ pub(crate) async fn download_patch_records_reusing(
     let vendor_state = load_state(&params.cwd).await;
     // Bun preflight (see `BunVendorRefusal`): this phase feeds the vendor
     // engine, so it must refuse the same projects BEFORE fetching —
-    // otherwise the view was downloaded for nothing and a package
-    // resolvable only through the unreadable bun.lockb inventory
-    // misreported `package_not_installed` instead of the real
+    // otherwise the view is downloaded for nothing and a package
+    // resolvable only through the unreadable bun.lockb inventory is
+    // misreported as `package_not_installed` instead of the real
     // `vendor_bun_*` code. npm-only, so release narrowing (PyPI / RubyGems /
     // Maven variants) cannot change its verdict.
     let bun_refusal = bun_vendor_preflight_with_ledger(
@@ -2441,10 +2436,9 @@ fn nested_apply_args_from_params(
         global_prefix: params.global_prefix.clone(),
         download_mode: params.download_mode.clone(),
         strict: params.strict,
-        // Scope the nested apply like the caller was scoped: leaving this
-        // at the default `None` made `scan --ecosystems gem --sync` apply
-        // the WHOLE manifest, mutating other ecosystems' packages the user
-        // filtered out.
+        // Scope the nested apply like the caller was scoped: `None` would
+        // apply the WHOLE manifest, mutating other ecosystems' packages the
+        // user filtered out.
         ecosystems: params.ecosystems.clone(),
         lock_timeout: run.lock_timeout,
         verbose: run.verbose,
@@ -2460,9 +2454,9 @@ fn nested_apply_args_from_params(
 /// its last mutation is done. Returns whether apply exited 0. Callers print
 /// their own "Applying patches..." line. `json` is the caller's flag: a
 /// JSON caller gets no human error lines, from this function or from the
-/// nested apply (`common` itself is never JSON). The read-only cargo-redirect verifier stays off
-/// and embedded VEX is opt-in on the top-level command only, never on this
-/// internal invocation.
+/// nested apply (`common` itself is never JSON). The read-only `--check`
+/// redirect verifier stays off and embedded VEX is opt-in on the top-level
+/// command only, never on this internal invocation.
 async fn run_nested_apply(
     common: GlobalArgs,
     json: bool,
@@ -2488,7 +2482,7 @@ async fn run_nested_apply(
 
 /// Download the selected patches into `.socket/` (manifest records +
 /// blobs) and, unless `save_only`, apply them in place — the agent-mode
-/// engine behind `get` and `scan --apply/--sync`, over the caller's
+/// engine behind `get` and `scan --mode agent`, over the caller's
 /// run-level context (`run`: the client the run already built, plus the
 /// `--lock-timeout` / `--verbose` the manifest lock and the nested apply
 /// honor). Returns `(exit_code, json)`.
@@ -2504,8 +2498,8 @@ pub async fn download_and_apply_patches_with(
 
     // The manifest read-modify-write — and the blob writes it records —
     // runs under the apply lock: `remove`/`rollback` RMW the same file under
-    // it, and an unlocked writer here lost their update or had its own
-    // record clobbered. `acquire` creates `.socket/` itself; the guard's
+    // it, and an unlocked writer here would lose their update or have its
+    // own record clobbered. `acquire` creates `.socket/` itself; the guard's
     // drop removes `apply.lock` and prunes an otherwise-empty `.socket/`, so
     // a run that records nothing leaves no residue. The nested apply runs
     // under this SAME guard (one lock window; see `run_nested_apply`).
@@ -2676,11 +2670,15 @@ pub async fn run(args: GetArgs) -> i32 {
         );
         return 1;
     }
-    // Mode resolution mirrors scan's enum (default = agent, today's
-    // behavior). Conflicts use get's established exit-1 report_error style
-    // (scan's self-enforced conflicts exit 2; get's have always been 1 —
-    // documented carve-out in CLI_CONTRACT.md).
-    let mode = args.mode.unwrap_or(super::scan::ScanMode::Agent);
+    // v5: hosted by default, like scan. `--save-only` (records a manifest
+    // entry) and global installs (no project lockfile) mean agent mode.
+    // Conflicts use get's exit-1 report_error style (scan's self-enforced
+    // conflicts exit 2 — documented carve-out in CLI_CONTRACT.md).
+    let mode = args.mode.unwrap_or(if args.save_only || args.common.is_global() {
+        super::scan::ScanMode::Agent
+    } else {
+        super::scan::ScanMode::Hosted
+    });
     if args.save_only && mode != super::scan::ScanMode::Agent {
         report_error(
             args.common.json,
@@ -2694,11 +2692,10 @@ pub async fn run(args: GetArgs) -> i32 {
         return 1;
     }
     if args.one_off {
-        // Honest failure instead of the historical silent no-op: the flag
-        // parsed but was never implemented, so the patch was saved to the
-        // manifest anyway — lying to the user about persistence. Mirrors
-        // `rollback --one-off`'s not-yet-implemented contract; rejected
-        // before any network or disk activity.
+        // The flag parses but is not implemented: fail loudly rather than
+        // save to the manifest anyway. Mirrors `rollback --one-off`'s
+        // not-yet-implemented contract; rejected before any network or disk
+        // activity.
         report_error(args.common.json, "One-off get mode is not yet implemented");
         return 1;
     }
@@ -2839,7 +2836,7 @@ pub async fn run(args: GetArgs) -> i32 {
                 // 401/403 the fallback just recovered from. An explicit
                 // UUID is exempt from installed narrowing (exact intent).
                 return match mode {
-                    // Save to manifest and apply in place (today's flow).
+                    // Save to manifest and apply in place.
                     super::scan::ScanMode::Agent => {
                         save_and_apply_patch(&args, &api_client, &patch).await
                     }
@@ -3945,10 +3942,8 @@ async fn run_get_vendored(
 }
 
 /// Decode a patch view's `blobContent` (canonical, padded base64 as the API
-/// produces it). Hand-rolled only because `base64` is a dev-dependency of
-/// this crate today — once it is a plain dependency (it already is one of
-/// `socket-patch-core`, pinned workspace-wide), this body should become
-/// `base64::engine::general_purpose::STANDARD.decode(input)` with
+/// produces it). Hand-rolled; swapping in
+/// `base64::engine::general_purpose::STANDARD.decode(input)` must keep
 /// `DecodeError::InvalidByte(_, b)` mapped to the
 /// `Invalid base64 character: <b>` message below (pinned by a unit test).
 pub(crate) fn base64_decode(input: &str) -> Result<Vec<u8>, String> {
@@ -3989,8 +3984,8 @@ mod tests {
     use super::*;
 
     /// The pnpm-PnP hosted lock probe must be boundary-anchored: plain
-    /// substring matching collided on version prefixes, name suffixes, and
-    /// unscoped-inside-scoped names (follow-up review finding).
+    /// substring matching collides on version prefixes, name suffixes, and
+    /// unscoped-inside-scoped names.
     #[test]
     fn pnpm_lock_resolves_is_boundary_anchored() {
         // v9/v6/v5 key spellings all resolve.
@@ -4197,9 +4192,9 @@ mod tests {
 
     #[test]
     fn select_paid_user_picks_highest_severity_not_most_recent() {
-        // The reported bug. An authorized user's package has a fresh `low`
-        // patch and an older `critical` one; the old selector took the
-        // newest and silently left the critical unfixed.
+        // An authorized user's package has a fresh `low` patch and an older
+        // `critical` one: taking the newest would leave the critical
+        // unfixed.
         let patches = vec![
             mk_patch_sev("new_low", "pkg:npm/foo@1.0", "paid", "2026-06-01", "low"),
             mk_patch_sev(
@@ -4309,8 +4304,8 @@ mod tests {
 
     #[test]
     fn select_recency_is_chronological_not_lexicographic() {
-        // `publishedAt` is RFC 2822 on the wire, so the old raw-string
-        // compare ordered by weekday name. With equal severities the newer
+        // `publishedAt` is RFC 2822 on the wire, so a raw-string compare
+        // would order by weekday name. With equal severities the newer
         // patch must win regardless of which weekday it fell on.
         let older = "Wed, 01 Jan 2025 00:00:00 GMT";
         let newer = "Fri, 01 Aug 2026 00:00:00 GMT";
@@ -4755,10 +4750,8 @@ mod tests {
 
     // --- run_outcome -----------------------------------------------------
     // The `status` field and the process exit code are derived from the
-    // same predicate. Regression guard: a failed *apply* step (no download
-    // failures) must still report `partial_failure` AND exit 1 — the old
-    // code keyed `status` only on download failures, so it printed
-    // `success` next to a non-zero exit code.
+    // same predicate: a failed *apply* step (no download failures) must
+    // still report `partial_failure` AND exit 1.
 
     #[test]
     fn run_outcome_clean_is_success_exit_zero() {
@@ -4905,12 +4898,11 @@ mod tests {
     }
 
     // --- files_for_manifest / files_with_both_hashes ---------------------
-    // Regression guards for the download/scan/vendor record builder: a
-    // net-new file (afterHash, NO beforeHash) that the patch ADDS must be
-    // retained in the manifest record, not silently dropped. Real prod
-    // repro: the whole-crate cargo export for `pkg:cargo/traitobject@0.1.1`
-    // publishes ALL files with only an afterHash — the old both-hashes rule
-    // recorded `files:{}` and reported `applied:1` while writing nothing.
+    // The download/scan/vendor record builder: a net-new file (afterHash, NO
+    // beforeHash) that the patch ADDS must be retained in the manifest
+    // record, not silently dropped. E.g. the whole-crate cargo export for
+    // `pkg:cargo/traitobject@0.1.1` publishes ALL files with only an
+    // afterHash.
 
     fn file_resp(before: Option<&str>, after: Option<&str>) -> PatchFileResponse {
         PatchFileResponse {
@@ -4960,8 +4952,8 @@ mod tests {
         assert_eq!(added.before_hash, "");
         assert_eq!(added.after_hash, "a".repeat(64));
 
-        // The old both-hashes rule (still used for installed-variant
-        // matching) DROPS the added file — this is the behavior we fixed.
+        // The both-hashes rule (used only for installed-variant matching)
+        // drops the added file.
         let strict = files_with_both_hashes(&patch);
         assert_eq!(strict.len(), 1);
         assert!(!strict.contains_key("lib/rubygems_plugin.rb"));
@@ -4969,9 +4961,8 @@ mod tests {
 
     #[test]
     fn files_for_manifest_keeps_all_new_file_whole_crate_export() {
-        // The P0 cargo case: EVERY file is a whole-crate export with only
-        // an afterHash. The old rule produced `files:{}`; the fix retains
-        // all 9 so the record is non-empty and can actually be applied.
+        // EVERY file is a whole-crate export with only an afterHash: all 9
+        // are retained so the record is non-empty and can be applied.
         let mut files = HashMap::new();
         for i in 0..9 {
             files.insert(
@@ -4985,7 +4976,7 @@ mod tests {
         assert_eq!(kept.len(), 9, "all whole-crate-export files must be kept");
         assert!(kept.values().all(|f| f.before_hash.is_empty()));
 
-        // Guardrail precondition: with the old rule this map was empty.
+        // Guardrail precondition: the both-hashes rule yields an empty map.
         assert!(files_with_both_hashes(&patch).is_empty());
     }
 
@@ -6050,7 +6041,7 @@ mod tests {
         );
     }
 
-    // --- coverage mop-up (2026-09 final wave) -------------------------------
+    // --- misc edge cases -----------------------------------------------------
 
     /// `merge_metadata` is a best-effort splice: a non-object record (or a
     /// non-object metadata value) must be left untouched, never panic —
@@ -6549,7 +6540,7 @@ mod tests {
     // The detached download phase must refuse the same Bun projects the
     // manifest-tracked one does, BEFORE any view fetch (request-log oracle),
     // and with the vendor code (never the downstream `package_not_installed`
-    // the alias-shaped lockb project used to degrade to).
+    // the alias-shaped lockb project would otherwise degrade to).
 
     /// A real bun 1.3.14 lockfileVersion-1 workspace lock (matrix capture
     /// grammar): 1-tuple `workspace:` entry, blank line between entries,
@@ -6868,9 +6859,8 @@ mod tests {
         );
     }
 
-    /// The nested apply inherits the caller's flags verbatim (`--verbose`
-    /// and `--strict` were dropped when its args were rebuilt from Default),
-    /// with `json`/`dry_run` forced off — one JSON document per run, and
+    /// The nested apply inherits the caller's flags verbatim (`--verbose`,
+    /// `--strict`, …), with `json`/`dry_run` forced off — one JSON document per run, and
     /// agent-mode `get` ignores `--dry-run` — `silent` following the caller's
     /// quiet gate, and the manifest path absolutized so apply does not
     /// re-resolve it against its own `--cwd`.
diff --git a/crates/socket-patch-cli/src/lib.rs b/crates/socket-patch-cli/src/lib.rs
index c6437920..cd18d33d 100644
--- a/crates/socket-patch-cli/src/lib.rs
+++ b/crates/socket-patch-cli/src/lib.rs
@@ -75,7 +75,7 @@ pub enum Commands {
     /// references plus any agent-mode manifest entries
     List(commands::list::ListArgs),
 
-    /// Agent mode: get a patch from the Socket API and apply it
+    /// Patch one package, CVE, GHSA or patch UUID (hosted mode by default)
     #[command(visible_alias = "download")]
     Get(commands::get::GetArgs),
 
@@ -106,10 +106,10 @@ pub enum Commands {
     // in `parse_argv_with_shortcuts`). Hidden: the public contract
     // surface is `socket-patch --update`, and this name carries no
     // stability guarantee (documented as internal in CLI_CONTRACT.md).
-    // Plain `//` comments plus an explicit `about`/`override_usage`: a doc
-    // comment here is what `socket-patch --update --help` printed, and the
-    // derived usage line named the hidden subcommand, and so did the
-    // `--update --version` line until `display_name` pinned it.
+    // Plain `//` comments plus an explicit `about`/`override_usage`/
+    // `display_name`: a doc comment here would become
+    // `socket-patch --update --help` text, and the derived usage and
+    // `--update --version` lines would name the hidden subcommand.
     #[command(
         hide = true,
         name = "self-update",
diff --git a/crates/socket-patch-cli/tests/cli_get_silent_errors.rs b/crates/socket-patch-cli/tests/cli_get_silent_errors.rs
index e829e461..61dd3818 100644
--- a/crates/socket-patch-cli/tests/cli_get_silent_errors.rs
+++ b/crates/socket-patch-cli/tests/cli_get_silent_errors.rs
@@ -1,13 +1,9 @@
 //! `get --silent` must still surface errors.
 //!
 //! CLI_CONTRACT.md defines `--silent` as "Errors only" — informational
-//! chatter is suppressed, errors are not. Regression guard: the download
-//! loop in `download_and_apply_patches` gated its per-patch failure lines
-//! (`[fail] …`) on `!silent` alongside the informational prints, so
-//! `get <purl> --silent` against a failing patch fetch exited 1 with ZERO
-//! output anywhere — no stdout (correct) and no stderr (the bug). The
-//! by-uuid path (`save_and_apply_patch`) already kept its blob errors
-//! visible under `--silent`; the search path must match.
+//! chatter is suppressed, errors are not. The per-patch failure lines
+//! (`[fail] …`) in `download_and_apply_patches_with` must reach stderr under
+//! `--silent`, matching the by-uuid path (`save_and_apply_patch`).
 //!
 //! Hermetic: the search endpoint answers with one free patch and the
 //! patch view endpoint answers 500, all on a local wiremock; ambient API
@@ -38,7 +34,7 @@ fn dead_env<'a>() -> Vec<(&'a str, &'a str)> {
 }
 
 /// Search succeeds (one free patch) but the patch view fails: the run
-/// reaches `download_and_apply_patches`' failure branch and must exit 1.
+/// reaches `download_and_apply_patches_with`' failure branch and must exit 1.
 async fn mount_search_ok_view_500(mock: &MockServer) {
     Mock::given(method("GET"))
         .and(path(format!(
@@ -69,6 +65,8 @@ fn get_args<'a>(uri: &'a str, extra: &[&'a str]) -> Vec<&'a str> {
     let mut args = vec![
         "get",
         PURL,
+        "--mode",
+        "agent",
         "--yes",
         "--api-url",
         uri,
@@ -105,8 +103,8 @@ async fn get_silent_download_failure_still_prints_the_error() {
         stderr.contains("[fail]") && stderr.contains(PURL),
         "--silent must still print the download failure to stderr; got {stderr:?}"
     );
-    // Informational chatter stays suppressed: the fix must not turn
-    // --silent failures into fully loud runs.
+    // Informational chatter stays suppressed: --silent failures must not
+    // become fully loud runs.
     assert!(
         !stderr.contains("Downloading"),
         "--silent must keep suppressing informational lines; got {stderr:?}"
diff --git a/crates/socket-patch-cli/tests/covgap_commands_get.rs b/crates/socket-patch-cli/tests/covgap_commands_get.rs
index be0c85d8..ba006e94 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_get.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_get.rs
@@ -1,8 +1,8 @@
-//! Coverage-gap tests for `commands/get.rs` (coverage audit 2026-09).
+//! Coverage-gap tests for `commands/get.rs`.
 //!
-//! Targets the audited never-executed branches: `run()`'s flag/package-path
+//! Targets otherwise-untested branches: `run()`'s flag/package-path
 //! edges, the `save_patch_record` failure ladder on the uuid path, the
-//! `download_and_apply_patches` engine failure branches, the release-variant
+//! `download_and_apply_patches_with` engine failure branches, the release-variant
 //! narrowing fallbacks (fabricated PyPI venv — no real python needed), the
 //! search-path `--mode vendored` flow, the vendor-step error arms, and every
 //! human-mode (non `--json`) output path the existing suites left to
@@ -105,7 +105,7 @@ fn default_args(identifier: &str, cwd: &Path) -> GetArgs {
         save_only: true,
         one_off: false,
         all_releases: false,
-        mode: None,
+        mode: Some(socket_patch_cli::commands::scan::ScanMode::Agent),
     }
 }
 
@@ -132,15 +132,10 @@ async fn mount_view_files(server: &MockServer, uuid: &str, purl: &str, files: se
         .await;
 }
 
-/// `view/{uuid}` served exactly ONCE: the get's own fetch succeeds, and the
-/// vendor step's in-memory staging — which fetches the view again — then
-/// 404s, tripping the `no_local_source` staging refusal.
 /// A view whose files carry hashes but NO `blobContent`: the download
 /// phase records it fine (hashes only), but the vendor step has nothing to
 /// stage from — not in the download phase's blob seed, not on disk, and not
-/// from the view it re-fetches — so it dies `no_local_source`. (Serving a
-/// good view exactly once no longer produces that: the step stages from
-/// the seed and never fetches the view a second time.)
+/// from the view it re-fetches — so it dies `no_local_source`.
 async fn mount_contentless_view(server: &MockServer, uuid: &str, purl: &str) {
     let mut files = good_files();
     files["package/index.js"]
@@ -444,6 +439,10 @@ async fn mount_ghsa_fanout(server: &MockServer) {
 fn run_get_bin(cwd: &Path, api_url: &str, extra: &[&str]) -> (i32, String, String) {
     let mut args = vec!["get"];
     args.extend_from_slice(extra);
+    // v5 `get` defaults to hosted; these fixtures drive agent mode.
+    if !extra.contains(&"--mode") {
+        args.extend_from_slice(&["--mode", "agent"]);
+    }
     args.extend_from_slice(&[
         "--api-url",
         api_url,
@@ -473,9 +472,7 @@ fn parse_single_json_doc(stdout: &str) -> serde_json::Value {
 // ===========================================================================
 
 /// Two identifier type flags together must be rejected up front: exit 1,
-/// nothing fetched, nothing written. This branch (line-level: the
-/// `type_flags > 1` guard) had never executed — every caller passes at most
-/// one flag.
+/// nothing fetched, nothing written (the `type_flags > 1` guard).
 #[tokio::test]
 #[serial]
 async fn get_conflicting_type_flags_rejected_before_any_network() {
@@ -1800,9 +1797,9 @@ async fn human_uuid_not_found_prints_message() {
     assert_no_manifest(tmp.path());
 }
 
-/// Human CVE search with no results: both the search label and the
-/// per-type not-found message (the `IdentifierType` Display impl's only
-/// consumer) must print.
+/// Human CVE search with no results: the per-type not-found message prints
+/// on stdout, while the transient `Searching patches for …` status line
+/// never reaches a pipe.
 #[tokio::test]
 async fn human_cve_search_empty_prints_search_label_and_not_found() {
     let server = MockServer::start().await;
@@ -3001,6 +2998,8 @@ async fn agent_dry_run_previews_only_the_installed_release_variant() {
         &[
             "get",
             GHSA,
+            "--mode",
+            "agent",
             "--dry-run",
             "--json",
             "--api-url",
diff --git a/crates/socket-patch-cli/tests/get_nested_apply_api_flags_e2e.rs b/crates/socket-patch-cli/tests/get_nested_apply_api_flags_e2e.rs
index 14950428..e55906b7 100644
--- a/crates/socket-patch-cli/tests/get_nested_apply_api_flags_e2e.rs
+++ b/crates/socket-patch-cli/tests/get_nested_apply_api_flags_e2e.rs
@@ -13,7 +13,7 @@
 //! file (the manifest records the hashes; the bytes are fetched on demand):
 //! `get` writes no blob, and the nested apply has to download it. Both `get`
 //! call sites are covered — the direct-UUID path (`save_and_apply_patch`) and
-//! the search path (`download_and_apply_patches`).
+//! the search path (`download_and_apply_patches_with`).
 //!
 //! Hermetic by construction: the *env* API/proxy URLs point at a dead local
 //! port, so a run that ignores the flags fails on a refused connection rather
@@ -162,6 +162,8 @@ async fn get_by_uuid_nested_apply_uses_api_flags_not_env() {
         &[
             "get",
             UUID,
+            "--mode",
+            "agent",
             "--yes",
             "--json",
             // `file` mode goes straight for the per-file blob endpoint; the
@@ -216,6 +218,8 @@ async fn get_by_purl_nested_apply_uses_api_flags_not_env() {
         &[
             "get",
             PURL,
+            "--mode",
+            "agent",
             "--yes",
             "--json",
             "--download-mode",
@@ -296,6 +300,8 @@ async fn get_by_uuid_nested_apply_uses_proxy_url_flag_when_tokenless() {
         &[
             "get",
             UUID,
+            "--mode",
+            "agent",
             "--yes",
             "--json",
             "--download-mode",
diff --git a/crates/socket-patch-cli/tests/in_process_get_manifest_path.rs b/crates/socket-patch-cli/tests/in_process_get_manifest_path.rs
index 04d30f83..152819af 100644
--- a/crates/socket-patch-cli/tests/in_process_get_manifest_path.rs
+++ b/crates/socket-patch-cli/tests/in_process_get_manifest_path.rs
@@ -105,7 +105,7 @@ fn get_args(identifier: &str, cwd: &Path, api_url: String) -> GetArgs {
         save_only: true,
         one_off: false,
         all_releases: false,
-        mode: None,
+        mode: Some(socket_patch_cli::commands::scan::ScanMode::Agent),
     }
 }
 
@@ -178,7 +178,7 @@ async fn get_by_uuid_honors_custom_manifest_path() {
 }
 
 // ---------------------------------------------------------------------------
-// 2. --manifest-path honored on the search flow (download_and_apply_patches)
+// 2. --manifest-path honored on the search flow (download_and_apply_patches_with)
 // ---------------------------------------------------------------------------
 
 #[tokio::test]
diff --git a/crates/socket-patch-cli/tests/in_process_get_modes.rs b/crates/socket-patch-cli/tests/in_process_get_modes.rs
index 1b30aa30..f2317fb0 100644
--- a/crates/socket-patch-cli/tests/in_process_get_modes.rs
+++ b/crates/socket-patch-cli/tests/in_process_get_modes.rs
@@ -70,7 +70,7 @@ fn get_args(identifier: &str, cwd: &Path, api_url: String) -> GetArgs {
         save_only: false,
         one_off: false,
         all_releases: false,
-        mode: None,
+        mode: Some(socket_patch_cli::commands::scan::ScanMode::Agent),
     }
 }
 

From 462a35b049225a0100772c5a948b6401f4622153 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Sun, 27 Sep 2026 16:43:12 -0400
Subject: [PATCH 09/32] Rewrite the README, CLI contract and docs for v5
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The README now leads with the scan → vex → vendor workflow: hosted mode
first, vendored for offline installs, agent mode as the older
install-hook flow, and the command reference in that order. The contract
and README now match the code on these points:
- a bare scan and get run hosted mode
- scan never prompts
- --package
- PATH semantics in each mode
- the merged-first patch ranking
- the exit-2 cases
- the env var table

The Bundler plugin README now says setup writes a path: source and that
failures warn by default. The docs/testing notes drop references to files
and flags that no longer exist.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 CHANGELOG.md                            |   19 +-
 README.md                               | 1049 ++++++++++++-----------
 crates/socket-patch-cli/CLI_CONTRACT.md |  211 ++---
 docs/design/configuration.md            |   10 +-
 docs/design/golang-hosted-no-go.md      |    4 +-
 docs/ecosystems.md                      |    3 +-
 docs/testing/bun-compatibility.md       |    2 +-
 docs/testing/hosted-production-e2e.md   |   38 +-
 docs/testing/pipenv-compatibility.md    |    7 +-
 docs/testing/uv-compatibility.md        |    2 +-
 docs/testing/vendored-production-e2e.md |    4 +-
 gem/socket-patch-bundler/README.md      |   12 +-
 tests/docker/README.md                  |   89 +-
 tests/setup_matrix/README.md            |    7 +-
 14 files changed, 746 insertions(+), 711 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2e853cce..33a44ba3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -65,8 +65,8 @@ into the new version's section — see docs/releasing.md.
   refusals were the vendor step's only failures (and when every selected
   package is refused this way, the human arm prints `Nothing was
   vendored: N patches failed (see above).`).
-  (The interactive human `scan --vendor` arm still fetches the views its
-  pre-prompt baseline check verifies.) Purls the hosted redirect ledger
+  (The human `scan --mode vendored` arm still fetches the views its
+  baseline pre-check verifies.) Purls the hosted redirect ledger
   claims keep the vendor loop's refusal. Because no view is fetched, the
   lock-text refusal now takes precedence over every outcome that came
   from the view: a package that would also have hit a paid-access 403, a
@@ -263,6 +263,11 @@ into the new version's section — see docs/releasing.md.
   malformed redirect ledger on a human hosted run that stops before the
   engine is reported as the read-only `Warning: the redirect ledger … is
   malformed` advisory instead of nowhere.
+- **`get` defaults to hosted mode too.** `socket-patch get <id>` (and the
+  bare-UUID shortcut `socket-patch <uuid>`) now redirects the package's
+  lockfile entry to its Socket-hosted patched copy, like `scan`. Agent mode
+  (manifest + in-place apply) is `--mode agent`, and stays the default with
+  `--save-only` or `--global`/`--global-prefix`.
 - **scan picks the newest merged patch.** When a package has several
   patches, `scan` (and `get`, and the `[UPDATE]` detection) now takes the
   newest merged patch (one that fixes several advisories in one blob — the
@@ -721,8 +726,8 @@ into the new version's section — see docs/releasing.md.
   already-redirected or already-vendored lock-only checkout re-confirms it;
   a lock that resolves only from private indexes is never looked up on
   pypi.org.
-- **Pipenv's out-of-tree virtualenv is discovered.** Agent mode (bare `scan`,
-  `rollback`, `vex`) now finds `$WORKON_HOME/<dir>-<hash>[-<python>]` (the
+- **Pipenv's out-of-tree virtualenv is discovered.** Discovery (`scan` in
+  every mode, `rollback`, `vex`) now finds `$WORKON_HOME/<dir>-<hash>[-<python>]` (the
   `.venv` file pointer, `PIPENV_CUSTOM_VENV_NAME` and `PIPENV_PIPFILE`
   included) exactly as Pipenv 7 through 2026 place it, instead of falling
   through to the global interpreter's site-packages.
@@ -1185,8 +1190,8 @@ into the new version's section — see docs/releasing.md.
     `--json`/`--silent`. `fetch`, `vendor`, `setup`, lock waits and
     `--update` checks now show progress instead of going quiet.
   - **Prompts:** Ctrl-D at a `[Y/n]` prompt now declines instead of
-    accepting. Keys pressed while a scan is running no longer answer the
-    prompt that follows. The cursor is restored when a selection menu is
+    accepting. Keys pressed while a command is working no longer answer
+    the prompt that follows (`get`, `rollback`). The cursor is restored when a selection menu is
     interrupted.
   - **Color:** `NO_COLOR`, `CLICOLOR`, `CLICOLOR_FORCE` and `TERM=dumb` are
     honored. Colored table rows now align.
@@ -1302,7 +1307,7 @@ into the new version's section — see docs/releasing.md.
   connect timeout (a blackholed endpoint no longer stalls every command for
   the full request budget), and `--update` maps only a contention errno to
   `update_in_progress` — other lock failures surface their real cause.
-- **A normal `scan` never creates `.socket/`.** Report-only, `--dry-run`,
+- **A scan that writes nothing never creates `.socket/`.** Report-only, `--dry-run`,
   zero-discovery and no-op runs (hosted or otherwise) no longer scaffold the
   directory or a lock file; a GC pass checks for a manifest before it locks.
 - **`apply --silent` on an all-unmatched manifest prints its error line** —
diff --git a/README.md b/README.md
index 4b77c032..af7fc5af 100644
--- a/README.md
+++ b/README.md
@@ -4,13 +4,14 @@ Fix known vulnerabilities in the dependencies you already have — without waiti
 upstream release, and without a risky version bump.
 
 Socket's security team backports minimal fixes to the *exact versions* of packages you
-have installed. The `socket-patch` CLI finds which of your dependencies have a patch
-available and applies it, verifying every changed file by hash. It works across npm,
-PyPI, Cargo, Go, RubyGems, Maven, Composer, NuGet, and Deno, and it can persist the patches
-whichever way fits your workflow: re-applied by the CLI, committed to your repo, or
-pinned in your lockfile. When you're done, it can emit an [OpenVEX
-attestation](#openvex-attestations) so your vulnerability scanner stops flagging the
-CVEs you've already fixed.
+use. `socket-patch scan` finds which of your dependencies have a patch and rewrites your
+lockfile so that only those dependencies resolve to Socket-hosted, integrity-pinned
+patched packages. Your package manager then installs the fix like any other dependency:
+no install hook, no CI changes. It works across npm, PyPI, Cargo, Go, RubyGems, Maven,
+Composer, NuGet, and Deno. `socket-patch vex` then emits an [OpenVEX
+attestation](#openvex-attestations) so your vulnerability scanner stops flagging the CVEs
+you've fixed, and `socket-patch scan --mode vendored` commits the patched packages into
+your repo when installs must work offline.
 
 **Contents:** [Installation](#installation) · [Five-minute tutorial](#five-minute-tutorial)
 · [How it works](#how-socket-patch-works) · [Common tasks](#common-tasks)
@@ -124,25 +125,24 @@ talks to Socket's public patch proxy, which serves the free tier of patches anon
 `socket-patch` picks it up automatically — see
 [Configuration sources](#configuration-sources).)
 
-**1. Scan your project.** From your project root, ask Socket which of your installed
-dependencies have patches available:
+**1. Scan.** From your project root:
 
 ```bash
 cd your-project
 socket-patch scan
 ```
 
-`scan` crawls the installed packages it finds (`node_modules/`, virtualenvs, the cargo
-registry cache, and so on), queries the patch database, prints each available patch with
-its package, severity, and CVE/GHSA identifiers, and asks whether to apply. Say yes and
-the vulnerable files are rewritten in place — each file is hash-verified before and after
-the edit.
-
-> If it prints `No patches available for installed packages.`, none of your installed
-> dependency versions currently has a Socket patch — the good outcome, with nothing to
-> apply.
-> To walk the rest of the loop anyway, make a scratch project pinned to a version
-> that has a free patch — at the time of writing, `flatted@3.3.1`:
+`scan` reads your lockfiles and installed packages, asks Socket which dependency
+versions have a patch, prints each one with its severity and CVE/GHSA identifiers, and
+patches them in **hosted mode**: it rewrites the lockfile so only the patched
+dependencies resolve to Socket-hosted, integrity-pinned packages on `patch.socket.dev`.
+It never prompts. The patch records go in `.socket/vendor/redirect-state.json`, and the
+run ends by listing the files it changed. (Add `--dry-run` to preview without writing.)
+
+> If it prints `No patches available for installed packages.`, none of your dependency
+> versions currently has a Socket patch — the good outcome, with nothing to do. To walk
+> the rest of the loop anyway, make a scratch project pinned to a version that has a free
+> patch — at the time of writing, `flatted@3.3.1`:
 >
 > ```bash
 > mkdir demo && cd demo && git init -q && npm init -y && npm install flatted@3.3.1 && socket-patch scan
@@ -151,72 +151,118 @@ the edit.
 > (The patch catalog changes over time; if that finds nothing, pick another patched
 > version.)
 
-**2. See what you have.** The applied patches are recorded in `.socket/manifest.json`:
+**2. Commit.** The lockfile edit *is* the patch, so commit it with the redirect ledger
+(`rollback` and `vex` read it):
 
 ```bash
-socket-patch list
+git add package-lock.json .socket/vendor/redirect-state.json .npmrc   # npm example
+git commit -m "apply Socket security patches"
 ```
 
+The exact files depend on your package manager — `scan` names them. For npm it also
+writes `allow-remote=all` to `.npmrc`, which npm 12 needs to install from
+`patch.socket.dev` (see [npm: hosted mode and npm 12](#npm-hosted-mode-and-npm-12));
+for pnpm 9+ locks it sets `trustLockfile: true` in `pnpm-workspace.yaml`
+([pnpm](#pnpm)).
+
+**3. Reinstall.** A clean install fetches the patched packages and checks them against
+the lockfile's integrity pins:
+
+```bash
+npm ci        # or pnpm install, yarn install, pip install -r ..., uv sync, bundle install, ...
 ```
-Found 1 patch:
 
-Package: pkg:npm/flatted@3.3.1
-  UUID: 5cac955f-eab1-4d29-8f4f-c408a6cc9647
-  ...
-  Vulnerabilities (1):
-    - GHSA-25h7-pfq9-p65f (CVE-2026-32141)
-      Severity: HIGH
+Every later install — yours, your teammates', CI's — does the same. There is no hook to
+wire and nothing to add to CI.
+
+**4. Tell your scanner.** Emit an OpenVEX document that marks each patched CVE
+`not_affected`, and hand it to Grype, Trivy or any other VEX-aware scanner:
+
+```bash
+socket-patch vex --output socket.vex.json
+grype . --vex socket.vex.json
 ```
 
-**3. Make it stick.** Patches applied in place don't survive a reinstall — the next
-`npm install` (or `pip install`, `bundle install`, …) restores the vulnerable upstream
-bytes. Commit the `.socket/` directory and wire an install hook so patches re-apply
-automatically:
+**5. Go offline, if you need to.** Hosted installs must reach `patch.socket.dev`. For
+airgapped builds, switch to vendored mode: it copies the patched packages into
+`.socket/vendor/`, points the lockfile at them, and reverts the hosted edits:
 
 ```bash
-socket-patch setup           # e.g. adds a postinstall script for npm projects
-git add .socket package.json # npm example — setup prints which files it changed
-git commit -m "apply Socket security patches"
+socket-patch scan --mode vendored
+git add .socket/vendor package-lock.json .npmrc && git commit -m "vendor Socket patches"
 ```
 
-From now on, every install — yours, your teammates', CI's — re-applies the patches. You
-can also re-apply manually at any time with `socket-patch apply` (it's idempotent).
+(Vendored npm installs don't need the `.npmrc` line, so the switch removes it again.)
 
-**4. Undo, if you want.** Remove a patch completely (restores the original files and
-deletes the manifest entry):
+**6. See what you have.** `list` shows each patch and the mode that holds it
+(`Mode: vendored` after step 5):
 
 ```bash
-socket-patch remove "pkg:npm/flatted@3.3.1"
+socket-patch list
+```
+
+```
+Found 1 patch:
+
+Package: pkg:npm/flatted@3.3.1
+  UUID: 5cac955f-eab1-4d29-8f4f-c408a6cc9647
+  Mode: hosted (recorded in .socket/vendor/redirect-state.json)
+  ...
+  Vulnerabilities (1):
+    - GHSA-25h7-pfq9-p65f (CVE-2026-32141)
+      Severity: HIGH
 ```
 
-That's the whole loop: **scan → apply when prompted → setup → commit**. This tutorial
-used the default *agent* mode, where the CLI re-applies patches after each install.
-There are two other ways to persist patches — committing the patched packages themselves
-(*vendored*) or pinning them in your lockfile (*hosted*) — and choosing between the
-three is the next section.
+To undo everything, run `socket-patch rollback`: it restores the original lockfile
+entries and drops the records.
+
+That's the whole loop: **scan → commit → reinstall → vex**, with `scan --mode vendored`
+when installs must be offline. The older *agent* mode, which patches installed files in
+place and re-applies them from an install hook, is still supported; the next section
+compares the three.
 
 ## How Socket Patch works
 
 **A patch** is a minimal fix — usually the upstream security fix, backported — for one
 exact published version of a package. Socket distributes it as per-file edits: for each
 touched file, the hash of the expected original (`beforeHash`), the hash of the patched
-result (`afterHash`), and the replacement content. By default, a file whose current
-content matches neither the expected original nor the patched result is overwritten with
-the full verified patched content plus a stderr warning (`content_mismatch_overwritten`);
-pass `--strict` (a [global option](#global-options)) to fail closed on mismatch instead,
-or `apply --force` to skip pre-application hash verification entirely (see
-[`apply`](#apply)). Either way the CLI verifies the result after writing. Patches are
-looked up by package URL ([PURL](https://github.com/package-url/purl-spec)) — e.g.
-`pkg:npm/lodash@4.17.20` — so everything is keyed to exact versions.
-
-**Local state lives in `.socket/`** at your project root, and is designed to be
-committed:
+result (`afterHash`), and the replacement content. Patches are looked up by package URL
+([PURL](https://github.com/package-url/purl-spec)) — e.g. `pkg:npm/lodash@4.17.20` — so
+everything is keyed to exact versions. In hosted and vendored mode your package manager
+installs a patched copy of the package, pinned by the lockfile's integrity check; in
+agent mode the CLI edits
+the installed files itself and verifies every hash before and after (a file matching
+neither hash is overwritten with the verified patched content plus a
+`content_mismatch_overwritten` warning, unless `--strict` is set).
+
+### Which patch is picked
+
+A package version can have several patches (one per advisory, or a later *merged* patch
+that folds several advisories into one). `scan` and `get` apply exactly one, chosen
+the same way everywhere, from the patches your account can download:
+
+1. the newest **merged** patch (one covering two or more advisories) wins, regardless of
+   severity — it is the cumulative fix;
+2. otherwise the patch with the worst severity it fixes (critical > high > medium > low),
+   then the newest;
+3. paid tier, then UUID, only break exact ties.
+
+"Newest" is when the patch was published, not the package version. When a better patch
+appears for a package you already patched, the JSON `updates[]` array lists it and the
+next `scan` in the same mode takes it.
+
+### State in `.socket/`
+
+Local state lives in `.socket/` at your project root, and is designed to be committed:
 
 | Path | Contents |
 |------|----------|
-| `.socket/manifest.json` | Agent mode: the record of downloaded patches — PURLs, file hashes, vulnerability metadata ([format](#manifest-format)) |
-| `.socket/blobs/` | Agent mode: patched file contents, named by git-sha256 hash |
-| `.socket/vendor/` | Vendored package artifacts and the vendor/redirect ledgers — the **only** state vendored and hosted modes write (the vendor ledger embeds the patch records; neither mode touches `manifest.json`) |
+| `.socket/vendor/redirect-state.json` | Hosted mode: the patch records plus the original lockfile / registry-config fragments each redirect replaced (what [`rollback`](#rollback) replays) |
+| `.socket/vendor/state.json` + `.socket/vendor/<ecosystem>/…` | Vendored mode: the ledger (with embedded patch records) and the patched package artifacts |
+| `.socket/manifest.json` | Agent mode only: the record of downloaded patches — PURLs, file hashes, vulnerability metadata ([format](#manifest-format)) |
+| `.socket/blobs/` | Agent mode only: patched file contents, named by git-sha256 hash |
+
+Hosted and vendored mode never write `manifest.json`.
 
 > While a command runs it holds a transient advisory lock, `.socket/apply.lock`, and
 > removes it when it finishes — the file never outlives the command, so there is nothing
@@ -228,40 +274,39 @@ committed:
 
 ### Three patch modes
 
-The same patched bytes can reach your build three different ways. The modes differ in
-*where the patch lives* and *what must happen at install time*; pick one per project
-(`scan --mode <name>` drives exactly one mode per run).
+The same patched bytes can reach your build three ways. The modes differ in *where the
+patch lives* and *what must happen at install time*. `scan --mode <name>` picks one per
+run; a bare `scan` is hosted.
 
 | Mode | Where the patch lives | Install-time requirement | Trade-off |
 |------|----------------------|--------------------------|-----------|
-| **agent** — `scan --mode agent` (or [`apply`](#apply)) | `.socket/` manifest + blobs, committed; the CLI re-applies after each install | The `socket-patch` CLI must run (install hook via [`setup`](#setup), or an `apply` step in CI) | Small repo footprint (per-file blobs, not whole packages); no lockfile edits; the only mode that needs CI / install-hook changes |
-| **vendored** — `scan --mode vendored` (or [`vendor`](#vendor)) | Patched packages committed under `.socket/vendor/` (with a ledger that embeds the patch records — `scan --mode vendored` writes no manifest; the standalone `vendor` command is manifest-driven and keeps only a fallback copy in the ledger); the lockfile is rewired to consume them | **None** — the package manager installs the committed bytes | Fully airgapped and hermetic, at the cost of repo size |
-| **hosted** — `scan --mode hosted` | No patched bytes in your repo: the lockfile is rewritten so **only** the patched dependencies resolve to Socket-hosted, integrity-pinned packages on `patch.socket.dev`; the edits + patch records are ledgered in `.socket/vendor/redirect-state.json` (commit it — [`rollback`](#rollback) replays its recorded pre-redirect originals to unwind the redirect, see [Undo things](#undo-things), and [`vex`](#vex) uses its records offline; `vex` also works from the rewritten lockfile alone) | Installs must be able to reach `patch.socket.dev` (no CLI, no install hook) | Smallest possible diff (lockfile + ledger); not for airgapped installs |
-
-Every mode pins the patched bytes: in agent mode the CLI verifies every file on each
-apply; vendored and hosted modes lean on your package manager's own lockfile integrity
-checks (sha512 / sha256 / contentHash / CHECKSUMS) where the ecosystem enforces them —
-hosted Maven, which has no lockfile, gets a fail-closed version-suffixing scheme instead.
-A few combinations have weaker install-time pins (vendored Maven, NuGet without a
-lockfile, Go's directory replaces, pipenv's Pipfile.lock) — there the committed bytes
-are the protection; see the [per-ecosystem caveats](docs/ecosystems.md).
-
-**Choosing:** *agent* is the original method and remains fully supported, but it is the
-only mode that requires CI / install-hook modification — **new projects should prefer
-hosted or vendored**. Pick *vendored* if your builds are airgapped or you don't want an
-infrastructure dependency; pick *hosted* if you want the smallest diff and your installs
-can reach `patch.socket.dev`. (Hosted is the planned default for GitHub-app patch PRs —
-it keeps the PR diff small.)
-
-Mode support varies by ecosystem — e.g. Go can't do hosted, Rush monorepos can't do
-vendored. See the full **[mode × ecosystem matrix](docs/ecosystems.md#mode--ecosystem-matrix)**
-for details and per-ecosystem caveats.
-
-### npm compatibility (hosted mode and npm 12)
+| **hosted** (default) — `scan` | Nowhere in your repo: the lockfile is rewritten so **only** the patched dependencies resolve to Socket-hosted, integrity-pinned packages on `patch.socket.dev`; the edits and patch records are ledgered in `.socket/vendor/redirect-state.json` | Installs must be able to reach `patch.socket.dev` (no CLI, no install hook) | Smallest possible diff (lockfile + ledger); not for airgapped installs |
+| **vendored** — `scan --mode vendored` (or [`vendor`](#vendor)) | Patched packages committed under `.socket/vendor/`, with the lockfile rewired to consume them | **None** — the package manager installs the committed bytes | Fully airgapped and hermetic, at the cost of repo size |
+| **agent** (older) — `scan --mode agent`, [`get`](#get), [`apply`](#apply) | `.socket/manifest.json` + blobs, committed; the CLI patches installed files in place | The `socket-patch` CLI must run after every install (an install hook via [`setup`](#setup), or an `apply` step in CI) | No lockfile edits and a small repo footprint, but the only mode that needs CI / install-hook changes |
+
+Every mode pins the patched bytes: vendored and hosted modes lean on your package
+manager's own lockfile integrity checks (sha512 / sha256 / contentHash / CHECKSUMS) where
+the ecosystem enforces them — hosted Maven, which has no lockfile, gets a fail-closed
+version-suffixing scheme instead — and agent mode verifies every file on each apply. A
+few combinations have weaker install-time pins (vendored Maven, NuGet without a lockfile,
+Go's directory replaces, pipenv's Pipfile.lock) — there the committed bytes are the
+protection; see the [per-ecosystem caveats](docs/ecosystems.md).
+
+**Choosing:** use *hosted* unless your installs can't reach `patch.socket.dev`; then
+use *vendored*. *Agent* mode remains fully supported for projects already built around
+it, and for Deno, which has no hosted or vendored mode.
+
+Mode support varies by ecosystem — e.g. Rush monorepos can't do vendored, and Go hosted
+mode covers the free tier only. See the full
+**[mode × ecosystem matrix](docs/ecosystems.md#mode--ecosystem-matrix)** for details.
+
+### Package-manager notes
+
+#### npm: hosted mode and npm 12
 
 npm 12 defaults to `allow-remote=none` and refuses (`EALLOWREMOTE`) any lockfile
 entry whose tarball is not served by your configured registry — which is what a
-hosted redirect writes. So when `scan --mode hosted` (or `get --mode hosted`) leaves a
+hosted redirect writes. So when a hosted `scan` (or `get --mode hosted`) leaves a
 `package-lock.json` / `npm-shrinkwrap.json` pointing at `patch.socket.dev`, it also
 writes `allow-remote=all` to the project `.npmrc` (creating it, or appending one line
 and keeping everything else byte-for-byte) and warns `redirect_npm_allow_remote`.
@@ -279,7 +324,17 @@ mode remove exactly the line or file the run added. Vendored mode needs none of
 npm treats its `file:` tarballs under `allow-file`, which defaults to `all`. See
 [npm compatibility](docs/testing/npm-compatibility.md) for the tested majors.
 
-### Bun compatibility
+#### pnpm
+
+For a lockfileVersion 9 `pnpm-lock.yaml`, hosted mode also sets `trustLockfile: true` in
+`pnpm-workspace.yaml` (pnpm 11+ rejects the redirected lock without it; commit the file
+with the lock) unless the project disables it or you pass `--no-trust-lockfile-config`.
+It skips pnpm's registry re-verification for the whole lock, while tarball integrity
+stays enforced. A warm store can keep serving the upstream bytes, so reinstall from a
+clean tree and an empty store, then check with `socket-patch vex`. See
+[pnpm compatibility](docs/testing/pnpm-compatibility.md).
+
+#### Bun
 
 Both text `bun.lock` and binary `bun.lockb` support hosted and vendored
 patches, mode switching, repair, and rollback. Binary locks are read and
@@ -288,130 +343,87 @@ rewrite them, and does not convert them to text. If both filenames exist,
 `bun.lock` takes precedence. See [Bun compatibility](docs/testing/bun-compatibility.md)
 for the tested versions, workspace behavior, and installer integrity limits.
 
-### vlt compatibility
+#### vlt
 
 [vlt](https://www.vlt.sh) projects (`vlt-lock.json`) work in agent and hosted mode on
-every vlt release from 0.0.0-1 to 1.2.0 (both DepID grammars and every
-`lockfileVersion`), and in vendored mode on locks with `lockfileVersion` 0 or 1
-(0.0.0-19 and later); older locks are refused with `vendor_lockfile_version_unsupported`.
-Agent mode patches each copy in `node_modules/.vlt` without writing through vlt 1.2's
-shared store. Hosted mode repoints the patched nodes' integrity and URL, first checks
-that each artifact is served the way vlt can verify, and removes stale installed copies
-so the next `vlt install` fetches the patched packages. Vendored mode commits a patched
-package directory for each direct dependency of the root or a workspace member
-(transitive dependencies need hosted mode), including one vlt gave a single peer
-context; after vendoring an optional dependency run `vlt ci`, because a plain `vlt
-install` keeps its installed upstream copy. vlt is detected ahead of every other
-npm-family package manager. vlt ledgers require the socket-patch release that adds vlt support.
-See [vlt notes](docs/ecosystems.md#npm-vlt-notes) for the caveats (`vlt update`, optional
-dependencies, registry configuration) and [vlt compatibility](docs/testing/vlt-compatibility.md)
-for the tested releases.
-
-### Pipenv compatibility
-
-Hosted mode rewrites every `Pipfile.lock` category that pins the patched
-release (`default`, `develop`, and Pipenv 2022+ named categories) and
-preserves the Pipfile, its content hash, markers, extras, and unrelated lock
-entries, so `pipenv install --deploy`, `pipenv sync` and `pipenv verify` keep
-passing. The reference shape follows the installing Pipenv: releases 7–11
-need `path` references, 2018 and later use `file` references, and lock
-formats before `pipfile-spec: 6` (Pipenv 0–6) are refused without changing
-the lock. Socket Patch probes `pipenv --version` once per run (only when a
-patch targets the lock); `SOCKET_PIPENV_MAJOR=<major>` pins the answer for
-machines without pipenv on PATH. Hosted references carry both the `#sha256=`
-URL fragment (verified by Pipenv 2023+) and a `hashes` entry (verified by
-2018–2022; Pipenv 11 verifies either), so a tampered lock fails to install
-on every supported release.
-
-Vendored mode requires Pipenv 2018 or later. Wheels with extras use `path`
-references to avoid Pipenv 2022's local-file URL parsing bug. Pipenv 2023+
-does not enforce hashes on local wheels; commit the wheel and run
-`socket-patch vex --product <purl>` (a Pipfile names no project, so pass the
-product purl explicitly).
-
-Fresh checkouts work in every mode: a clone with only `Pipfile` +
-`Pipfile.lock` is discovered from the lock (hosted redirects it, vendored
-fetches the pristine wheel by one of the lock's recorded digests), and agent
-mode finds Pipenv's default out-of-tree virtualenv under `WORKON_HOME`
-without `pipenv run`.
-
-Pipenv never reinstalls a release that is already present: `pipenv install`,
-`pipenv install --deploy` and `pipenv sync` all exit 0 and keep the installed
-bytes, on every Pipenv major. A hosted or vendored rewrite therefore
-protects fresh installs, and Socket Patch warns
-(`redirect_pypi_stale_install` / `pypi_pipenv_stale_install`) when a venv
-still holds the upstream release, with the verified remedy:
-`pipenv run pip uninstall -y <pkg> && pipenv sync` (or `pipenv --rm &&
-pipenv sync`). Do not use `pipenv uninstall <pkg>` for this — it rewrites the
-Pipfile and re-locks the patch away. `pipenv lock` / `pipenv update`
-regenerate the entry to its registry reference (a silent unpatch): re-run
-Socket Patch afterwards; `rollback` retires the stale record cleanly.
-
-`scripts/backtest-pipenv.py` drives the real CLI and the last stable release
-of every published Pipenv major through hosted, vendored, agent and
-out-of-tree agent mode, and `docs/testing/pipenv-compatibility.md` holds the
-measured boundaries and results.
+every vlt release from 0.0.0-1 to 1.2.0, and in vendored mode on locks with
+`lockfileVersion` 0 or 1 (0.0.0-19 and later; older locks are refused with
+`vendor_lockfile_version_unsupported`). Hosted mode checks that each artifact is served
+the way vlt can verify and removes stale installed copies so the next `vlt install`
+fetches the patched packages. Vendored mode covers direct dependencies of the root or a
+workspace member (transitive dependencies need hosted mode); after vendoring an optional
+dependency run `vlt ci`. See [vlt notes](docs/ecosystems.md#npm-vlt-notes) for the
+caveats and [vlt compatibility](docs/testing/vlt-compatibility.md) for the tested
+releases.
+
+#### Pipenv
+
+Hosted mode rewrites every `Pipfile.lock` category that pins the patched release and
+keeps the Pipfile, its content hash, markers and unrelated entries, so `pipenv install
+--deploy`, `pipenv sync` and `pipenv verify` keep passing (Pipenv 7 and later; older
+lock formats are refused unchanged). Socket Patch probes `pipenv --version` once per run
+to pick the reference shape; `SOCKET_PIPENV_MAJOR=<major>` pins it on machines without
+pipenv. Vendored mode requires Pipenv 2018 or later; Pipenv 2023+ does not hash-check
+local wheels, so commit the wheel and run `socket-patch vex --product <purl>` (a Pipfile
+names no project). A clone with only `Pipfile` + `Pipfile.lock` works in every mode.
+
+Pipenv never reinstalls a release that is already present, so a rewrite protects fresh
+installs, and Socket Patch warns (`redirect_pypi_stale_install` /
+`pypi_pipenv_stale_install`) when a venv still holds the upstream release, with the
+remedy `pipenv run pip uninstall -y <pkg> && pipenv sync`. Don't use `pipenv uninstall
+<pkg>` for this — it re-locks the patch away — and re-run `scan` after `pipenv lock` /
+`pipenv update`, which regenerate the entry to its registry reference. Measured
+boundaries are in [Pipenv compatibility](docs/testing/pipenv-compatibility.md).
 
 ## Common tasks
 
 ### Patch everything that can be patched
 
 ```bash
-socket-patch scan              # interactive: prompts before applying
-socket-patch scan --json --mode agent --yes    # non-interactive (CI, scripts)
+socket-patch scan                    # hosted mode: rewrite lockfiles (never prompts)
+socket-patch scan --dry-run          # preview what it would change
+socket-patch scan --json             # same run, machine-readable result
 ```
 
-### Patch one specific CVE, advisory, or package
+### Patch only some packages, or some projects in a monorepo
 
 ```bash
-socket-patch get CVE-2024-12345
-socket-patch get GHSA-xxxx-yyyy-zzzz
-socket-patch get lodash                  # fuzzy-matches installed packages
-socket-patch get "pkg:npm/lodash@4.17.20"
+socket-patch scan --package lodash --package pkg:pypi/requests   # or --package lodash,requests
+socket-patch scan apps/web apps/api                              # each PATH is a project directory
+socket-patch scan 'services/*'                                   # directory globs work too
 ```
 
-`socket-patch <uuid>` with a bare patch UUID is a shortcut for `get <uuid>`.
+`--package` takes a name (case-insensitive) or a purl with or without its version. In
+hosted and vendored mode each PATH is a project directory, scanned as if it were
+`--cwd` under an `== <dir> ==` header; the worst exit code wins.
 
-### Keep patches applied across installs
+### Patch one specific CVE or advisory
 
 ```bash
-socket-patch setup             # wire install hooks (npm postinstall, Python .pth, …)
-socket-patch setup --check     # CI gate: exit non-zero if hooks are missing or a patch drifted
+socket-patch get CVE-2024-12345 --mode hosted
+socket-patch get GHSA-xxxx-yyyy-zzzz --mode hosted
 ```
 
-See [`setup`](#setup) for what gets wired per ecosystem — and which ecosystems (Cargo,
-Go, Maven, NuGet, Deno) have no hook and are patched on demand instead.
+Like `scan`, `get` defaults to hosted mode; `--mode vendored` or `--mode agent`
+(in-place apply, also implied by `--save-only` and `--global`) picks the others.
 
-### Persist patches with no CI or install-hook changes (vendored / hosted)
+### Check for patches in CI without changing anything
 
 ```bash
-# Vendored: commit the patched packages themselves (airgap-friendly)
-socket-patch scan --json --mode vendored --yes
-git add .socket package-lock.json            # your lockfile may differ
-
-# Hosted: smallest diff — patched deps resolve from patch.socket.dev
-socket-patch scan --json --mode hosted --yes
-git add .socket/vendor/redirect-state.json package-lock.json .npmrc # .npmrc: npm 12 allow-remote
+socket-patch scan --json --dry-run | jq '{patches: .totalPatches, updates: (.updates | length)}'
 ```
 
-No `setup` hook or CI `apply` step is needed — the package manager installs the patched
-bytes. See [Three patch modes](#three-patch-modes) to choose, and the
-[mode × ecosystem matrix](docs/ecosystems.md#mode--ecosystem-matrix) for what your
-ecosystem supports.
-
 ### Run an auto-update bot in CI
 
-One command discovers, applies, and garbage-collects in a single pass:
-
 ```bash
-socket-patch scan --json --mode agent --prune --yes
+socket-patch scan --json
 ```
 
-The working-tree changes (the `.socket/` directory — plus lockfile edits if your bot
-runs `--mode vendored` or `--mode hosted`) are what your PR tooling commits — e.g.
-`peter-evans/create-pull-request` picks them up automatically; use the JSON summary for
-the PR title/body. See [Scripting & CI/CD](#scripting--cicd), including how to supply
-`SOCKET_API_TOKEN` for org-tier patches.
+A hosted scan takes new patches and newer versions of the ones already applied. Your PR
+tooling (e.g. `peter-evans/create-pull-request`) commits the changed lockfiles and
+`.socket/vendor/`; use the JSON result for the PR title/body. See
+[Scripting & CI/CD](#scripting--cicd), including how to supply `SOCKET_API_TOKEN` for
+org-tier patches.
 
 ### Tell your vulnerability scanner about the patches
 
@@ -420,61 +432,57 @@ socket-patch vex --output socket.vex.json
 grype <image-or-dir> --vex socket.vex.json     # or trivy image --vex ...
 ```
 
-The OpenVEX document marks each patched CVE `not_affected`, so scanners stop flagging
-vulnerabilities you've already remediated. You can also emit it inline from `apply` /
-`scan` / `vendor` with `--vex <path>`. Details in [OpenVEX
-attestations](#openvex-attestations).
+The OpenVEX document marks each patched CVE `not_affected`. Run it after installing, so
+hosted patches are hash-verified against the installed copies. You can also emit it
+inline with `scan --vex <path>`. Details in [OpenVEX attestations](#openvex-attestations).
 
 ### Work offline / airgapped
 
-Vendored mode needs no Socket infrastructure and no `socket-patch` binary at install
-time — the patched packages install from the committed bytes (other, unvendored
-dependencies still resolve from your registry or mirror as usual). Agent mode works
-offline once the blobs are committed:
-
 ```bash
-socket-patch apply --offline   # strict airgap: fails loudly if anything needs the network
+socket-patch scan --mode vendored
+git add .socket/vendor <your lockfile>
 ```
 
-`scan` and `get` inherently need the network and refuse to run with `--offline`.
+Vendored mode needs no Socket infrastructure and no `socket-patch` binary at install
+time — the patched packages install from the committed bytes (other, unvendored
+dependencies still resolve from your registry or mirror as usual). Agent mode also works
+offline once its blobs are committed (`socket-patch apply --offline`). `scan` and `get`
+need the network and refuse to run with `--offline`.
 
 ### Undo things
 
-Five commands clean up different layers — the first three undo, the last two reconcile
-and repair; pick by what you want back:
-
 | Command | What it does |
 |---------|--------------|
-| [`rollback`](#rollback) | **Fully unpatches, in every mode**: restores the original file bytes, unwinds vendored and hosted lockfile wiring, removes the rolled-back entries from the manifest (a zero-patch `{"patches": {}}` husk stays) and garbage-collects their blobs — everything, or just the given targets; `--preserve-state` keeps the local patch state for a later re-apply |
-| [`remove`](#remove) | The single-patch dual of `rollback`: everything `rollback <id>` does for one PURL/UUID (restore, unwind its vendoring or hosted redirect, drop the entry, GC), plus `--skip-rollback` to drop only the record — **permanent**, the patch is fully gone in one command |
-| [`vendor --revert`](#vendor) | **Un-vendors wholesale**: restores the recorded original lockfile fragments byte-for-byte and removes the `.socket/vendor/` artifacts — works without a manifest |
-| [`scan --prune`](#scan) | **Reconciles, doesn't reverse**: drops manifest entries for packages that have left the project and garbage-collects orphan blob/diff/archive files — installed patches stay |
+| [`rollback`](#rollback) | **Fully unpatches, in every mode**: unwinds hosted redirects (replaying the originals recorded in `redirect-state.json`) and vendored lockfile wiring, restores in-place files, and drops the records — everything, or just the given targets; `--preserve-state` keeps the local patch state for a later re-apply |
+| [`remove`](#remove) | The single-patch form of `rollback`: restore, unwind, drop the record and GC for one PURL/UUID |
+| [`vendor --revert`](#vendor) | **Un-vendors wholesale**: restores the recorded original lockfile fragments byte-for-byte and removes the `.socket/vendor/` artifacts |
+| [`scan --prune`](#scan) | Agent mode: **reconciles, doesn't reverse** — drops manifest entries for packages that have left the project and garbage-collects orphan blob/diff/archive files |
 | [`repair`](#repair) (alias `gc`) | **Restores health, not originals**: re-downloads missing blobs, rebuilds missing/corrupt vendored artifacts, and cleans up unused ones |
 
 And `setup --remove` reverts the install hooks that `setup` added.
 
-> Hosted mode is unwound by [`rollback`](#rollback), which replays the original
-> lockfile / registry-config fragments recorded in `.socket/vendor/redirect-state.json`
-> and drops the redirect records. If you revert a hosted edit by hand instead (e.g.
-> `git checkout -- <lockfile>`), also delete that ledger — its recorded originals are
-> then stale. (A leftover ledger no longer makes [`vex`](#vex) attest the removed
-> redirects: a record attests only while a lockfile still wires its hosted patch, and is
-> otherwise omitted as `redirect_unwired`.)
+> If you revert a hosted edit by hand instead (e.g. `git checkout -- <lockfile>`), also
+> delete `.socket/vendor/redirect-state.json` — its recorded originals are then stale. A
+> leftover ledger does not make [`vex`](#vex) attest the removed redirects: a record
+> attests only while a lockfile still wires its hosted patch.
 
 ## Command reference
 
 | Command | What it does |
 |---------|--------------|
-| [`scan`](#scan) | Scan installed packages for available security patches |
-| [`apply`](#apply) | Apply security patches from the local manifest |
-| [`vex`](#vex) | Generate an OpenVEX attestation for the applied patches |
-| [`vendor`](#vendor) | Eject patched dependencies into committable `.socket/vendor/` |
-| [`setup`](#setup) | Wire install hooks so patches re-apply automatically |
-| [`rollback`](#rollback) | Fully unpatch everything (or the given targets) in every mode and drop the rolled-back manifest entries (`--preserve-state` keeps them) |
-| [`get`](#get) | Fetch and apply a patch by UUID / CVE / GHSA / PURL / name (alias: `download`) |
-| [`list`](#list) | List recorded patches: manifest entries plus vendor-ledger and redirect-ledger records |
-| [`remove`](#remove) | Remove a patch: roll back files + delete the manifest entry |
-| [`repair`](#repair) | Download missing blobs, rebuild vendored artifacts, clean up unused ones (alias: `gc`) |
+| [`scan`](#scan) | Find patches for your dependencies and apply them — by default by rewriting lockfiles to Socket-hosted patched packages |
+| [`vex`](#vex) | Generate an OpenVEX document for the vulnerabilities the project's patches fix |
+| [`vendor`](#vendor) | Eject patched dependencies into committable `.socket/vendor/` and rewire lockfiles to use them (`--revert` undoes it) |
+| [`list`](#list) | List the patches in this project: hosted and vendored records plus any agent-mode manifest entries |
+| **Agent mode (older commands)** | |
+| [`get`](#get) | Fetch and apply one patch by UUID / CVE / GHSA / PURL / name (alias: `download`) |
+| [`apply`](#apply) | Apply the patches in `.socket/manifest.json` in place |
+| [`setup`](#setup) | Wire install hooks (npm, Python, Bundler, Composer) that re-apply patches after install |
+| [`rollback`](#rollback) | Undo patches in every mode: restore original files and unwind hosted or vendored lockfile wiring |
+| [`remove`](#remove) | Remove one patch by PURL or UUID (rolls back first) |
+| [`repair`](#repair) | Download missing patch artifacts, rebuild vendored artifacts, clean up unused ones (alias: `gc`) |
+
+`socket-patch --update` updates the CLI itself (see [Updating](#updating)).
 
 ### Global options
 
@@ -498,7 +506,7 @@ settings, described in [Configuration sources](#configuration-sources) below.
 | `--proxy-url <url>` | `SOCKET_PROXY_URL` | Public proxy URL used when no API token is set (default: `https://patches-api.socket.dev`). |
 | `-e, --ecosystems <list>` | `SOCKET_ECOSYSTEMS` | Restrict to specific ecosystems (comma-separated, e.g. `npm,pypi`). Unknown names are rejected. |
 | `--download-mode <mode>` | `SOCKET_DOWNLOAD_MODE` | Artifact to fetch when local files are missing: `diff` (default, smallest delta) or `file` (legacy per-file blobs). |
-| `--vendor-source <mode>` | `SOCKET_VENDOR_SOURCE` | How `vendor` acquires the installable artifact: `auto` (default — download the prebuilt package from patch.socket.dev, fall back to a local build on any miss), `service` (require the service, fail-closed), or `build` (always build locally). Covers npm, pypi, cargo, golang, composer, gem, nuget, and maven. |
+| `--vendor-source <mode>` | `SOCKET_VENDOR_SOURCE` | How vendored mode acquires the installable artifact: `auto` (default — download the prebuilt package from patch.socket.dev, fall back to a local build on any miss), `service` (require the service, fail-closed), or `build` (always build locally). Covers npm, pypi, cargo, golang, composer, gem, nuget, and maven. |
 | `--vendor-url <url>` | `SOCKET_VENDOR_URL` | Base host for the vendoring service's package-reference request (default: the active `--api-url`/`--proxy-url` base). Point at staging / local dev for testing. |
 | `--patch-server-url <url>` | `SOCKET_PATCH_SERVER_URL` | Override the host of the prebuilt-archive download URL the service returns (default: as returned). Mainly for local-dev / testing. |
 | `--offline` | `SOCKET_OFFLINE` | Strict airgap: never contact the network. Operations that need remote data fail loudly. |
@@ -509,10 +517,13 @@ settings, described in [Configuration sources](#configuration-sources) below.
 | `-v, --verbose` | `SOCKET_VERBOSE` | Show extra detail in human-readable output. |
 | `-s, --silent` | `SOCKET_SILENT` | Suppress non-error output. |
 | `--dry-run` | `SOCKET_DRY_RUN` | Preview the operation without making any mutations. |
-| `-y, --yes` | `SOCKET_YES` | Skip interactive confirmation prompts. |
+| `-y, --yes` | `SOCKET_YES` | Skip confirmation prompts (`get`, `rollback`, `remove`, `setup`, `--update`). `scan` never prompts, so it ignores this flag. |
 | `--lock-timeout <secs>` | `SOCKET_LOCK_TIMEOUT` | Seconds to wait for `.socket/apply.lock` before giving up. `0`/unset = a single non-blocking try; a positive value retries with backoff. Only meaningful for the commands that take the lock — `apply`, `rollback`, `repair`, `remove`, `vendor`, `setup` (while persisting `--exclude`), and `scan`/`get` whenever they write (agent-mode download + apply, vendored, hosted). The lock file exists only while a command runs. |
 | `--debug` | `SOCKET_DEBUG` | Emit verbose debug logs to stderr. |
 | `--no-telemetry` | `SOCKET_TELEMETRY_DISABLED` | Disable anonymous usage telemetry. |
+| `--no-npm-allow-remote-config` | `SOCKET_NO_NPM_ALLOW_REMOTE_CONFIG` | Hosted mode: don't write `allow-remote=all` to the project `.npmrc` (see [npm compatibility](#npm-hosted-mode-and-npm-12)). |
+| `--no-trust-lockfile-config` | `SOCKET_NO_TRUST_LOCKFILE_CONFIG` | Hosted mode: don't set `trustLockfile: true` in `pnpm-workspace.yaml` for a lockfileVersion 9 pnpm lock (pnpm 11+ then needs `pnpm install --trust-lockfile`). |
+| `--no-vlt-install-cleanup` | `SOCKET_NO_VLT_INSTALL_CLEANUP` | Hosted mode: don't remove stale vlt installed copies after `vlt-lock.json` is repointed or restored (run `vlt ci` instead). |
 
 #### Configuration sources
 
@@ -550,178 +561,123 @@ warning — it never breaks a command or pollutes `--json` output. `socket-patch
 cloned repo must never be able to redirect where patches come from or spend your token.
 (Full rationale: [docs/design/configuration.md](docs/design/configuration.md).)
 
-One more env-only knob tunes *pacing* rather than routing. `scan` queries the patch API
-with several requests in flight: against the authenticated endpoint, a quarter of the
-requests a step has to make, between 8 and 32 (so a step with 128 or more requests runs
-32 at once, one with 32 or fewer runs 8); against the public proxy, which shares one
-server-side limit across anonymous callers, 4. The patch-record fetches behind `vex` and
-`scan --vex` run up to 10 at once (4 on the proxy).
-`SOCKET_API_CONCURRENCY=<n>` overrides that, clamped to `1`-`32`; on the public proxy it
-can only lower it. Set it when an endpoint in front of the API caps in-flight requests
-per client — a self-hosted `--api-url`, a corporate reverse proxy, a WAF or a CDN — and
-a scan starts reporting fewer patches than it should because some requests are being
-rejected. `SOCKET_API_CONCURRENCY=1` sends one request at a time, the slowest and most
-conservative setting. An unset, empty or non-numeric value leaves the defaults in place.
-
-A throttled patch API is retried, within bounds. An HTTP `429` or `503` answer to any
-patch-API query (batch search, patch lists, patch views, VEX record fetches, hosted
-package references) is retried up to 3 times, waiting as long as the server's
-`Retry-After` asks (seconds or an HTTP date; a request asked to wait more than 30 s gives
-up at once) or, without one, 0.5 s, 1 s, 2 s with jitter. All retries in one run must
-finish within 60 s of the run's first retry (wall-clock: requests waiting in parallel
-don't add up), so a heavily throttled run gives up instead of hanging. `SOCKET_API_MAX_RETRIES=<n>` changes
-the per-request count (`0`-`10`; `0` turns retries off). Other errors are never retried.
-A query still throttled after its retries is reported, never dropped: a failed batch
-prints `Warning: API batch <n> of <total> failed: …` (under `--json`, a top-level
-`warnings[]` entry with code `api_batch_failed`), a failed patch-list lookup prints
-`Warning: could not fetch details for <purl>: …` (`--json`: `patch_details_failed`), and
-if every query fails the scan exits 1 with an error, as before.
-
-The crawl has a pacing knob too. Its directory walks (`node_modules`, and the Maven
-repository with its POM parse) run on a small pool of threads: 4 by default (fewer on a machine with fewer performance cores), because the walk is bound
-by the kernel's directory cache and more threads only add system time.
-`SOCKET_WALK_THREADS=<n>` overrides that, clamped to `1`-`16` and to the machine's CPU
-count; an unset, empty or non-numeric value leaves the default in place. A soft open-file
-limit below 128 still runs the walk on one thread, whatever the knob says.
+Three env-only knobs tune pacing rather than routing:
+
+- `SOCKET_API_CONCURRENCY=<n>` (clamped to `1`-`32`) caps in-flight patch-API requests.
+  By default `scan` runs a quarter of a step's requests at once, between 8 and 32, against
+  the authenticated API, and 4 against the public proxy (where the knob can only lower
+  it); `vex` record fetches run up to 10 (4 on the proxy). Lower it when a self-hosted
+  `--api-url`, corporate proxy, WAF or CDN caps requests per client and a scan starts
+  reporting fewer patches than it should.
+- `SOCKET_API_MAX_RETRIES=<n>` (`0`-`10`, default 3) sets how often a `429` / `503`
+  answer is retried. Retries honor `Retry-After` (a wait over 30 s gives up at once) or
+  back off 0.5 s, 1 s, 2 s with jitter, and all retries in a run must finish within 60 s.
+  Other errors are never retried. A query still failing is reported, never dropped
+  (`Warning: API batch <n> of <total> failed: …`, or `api_batch_failed` /
+  `patch_details_failed` in `--json` `warnings[]`); if every query fails the scan exits 1.
+- `SOCKET_WALK_THREADS=<n>` (clamped to `1`-`16` and the CPU count; default 4, fewer on small machines) sizes the
+  thread pool for the `node_modules` and Maven repository walks. A soft open-file limit
+  below 128 forces one thread.
+
+An unset, empty or non-numeric value leaves the default in place.
 
 The sections below list only each command's **command-specific** flags.
 
 ### `scan`
 
-Scan installed packages for available security patches — and, with `--mode`, act on what
-it finds. `scan` is the entry point for all three [patch modes](#three-patch-modes):
+Find patches for your dependencies and apply them. `scan` is the entry point for all
+three [patch modes](#three-patch-modes):
 
-- `--mode agent` downloads and applies the selected patches in place;
+- **hosted** (the default — a bare `scan`, `scan --json` included) rewrites lockfiles /
+  registry configs so only the patched dependencies resolve to Socket-hosted packages,
+  and records the edits in `.socket/vendor/redirect-state.json`;
 - `--mode vendored` discovers, downloads, and builds + wires the committable
   `.socket/vendor/` artifacts in one pass (re-vendoring automatically when a newer patch
-  is selected); it is manifest-free — the vendor ledger embeds the patch records and
-  nothing else is written under `.socket/`;
-- `--mode hosted` rewrites lockfiles / registry configs so only the patched dependencies
-  resolve to Socket-hosted packages.
-
-Without a mode, interactive `scan` prompts before applying (in a TTY — when stdin is not a
-TTY and neither `--yes` nor a mode/`--prune` flag is given, it is report-only: it prints what
-it found plus the "To apply a single patch, run: …" hint, writes nothing, and exits 0), and
-`scan --json` is read-only (discovery plus an `updates[]` array; no mutation).
-
-`scan --mode agent --prune` is the single command bots need for full auto-update: it
-discovers patches, applies them, and garbage-collects orphan blob files plus manifest
-entries for uninstalled packages — all in one invocation.
+  is selected), writing no `.socket/manifest.json`. It works on a fresh clone:
+  dependencies listed in the lockfile but not yet installed are fetched pristine from
+  their registry and integrity-verified against the lockfile before vendoring;
+- `--mode agent` downloads the selected patches into `.socket/manifest.json` + blobs and
+  applies them to the installed files in place.
+
+`scan` never prompts, in any mode — `--yes` changes nothing. Use `--dry-run` to preview
+any run. A `--prune` or `--global` / `--global-prefix` scan with no mode is the one
+report-only case: it lists what it found (plus, with `--prune`, runs the agent-mode
+garbage collection) and prints `To apply these patches in place, run: socket-patch scan
+--mode agent [PATHS]`. Hosted mode cannot be combined with `--global`.
+
+When a package has several patches, `scan` applies the one described in
+[Which patch is picked](#which-patch-is-picked). The JSON `updates[]` array lists
+packages whose recorded patch has been superseded — agent manifest entries, vendored
+entries, and hosted pins read from the redirect ledger and the lockfiles — and the next
+`scan` in that mode takes the newer patch.
 
 **Usage:**
 ```bash
-socket-patch scan [options]
+socket-patch scan [PATHS]... [options]
 ```
 
+**Arguments:**
+- `PATHS` — restrict the scan. In hosted and vendored mode each PATH (or directory glob,
+  e.g. `apps/*`) is a **project directory**, scanned on its own as if it were `--cwd`,
+  under an `== <dir> ==` header; the worst exit code wins. A PATH that is not a
+  directory exits 2, and `--json` accepts only one directory. In agent mode PATHS are
+  globs over **installed package paths** (a bare directory scopes its whole subtree;
+  `--prune` still considers the whole project, and lockfile-only packages are left out
+  with a warning).
+
 **Command-specific options** (plus all [Global options](#global-options)):
 | Flag | Env var | Description |
 |------|---------|-------------|
-| `--mode <hosted\|vendored\|agent>` | — | Selects one of the three [patch modes](#three-patch-modes), summarized above. Combining `--mode` with a legacy boolean flag of a *different* mode is an error (exit 2); the same mode spelled both ways is accepted. |
-| `--prune` | — | Garbage-collect after the scan: remove manifest entries for packages no longer present in the crawl (installed trees + lockfiles — a wiped `node_modules` alone doesn't prune lockfile-listed entries) and delete orphan blob/diff/package-archive files. Off by default. [Vendored](#vendor) packages are exempt from the crawl-based prune (an absent installed copy is their normal state), but a vendored entry whose dependency has left the lockfile is reverted (and any manifest entry it still had dropped). Orthogonal to `--mode` — combines with any mode. |
-| `--detached` | — | Hidden compatibility no-op. Vendored mode is manifest-free by default: the vendor ledger (`.socket/vendor/state.json`) embeds the patch records and `.socket/manifest.json` is never written, so this former opt-in changes nothing. Still an error without `--mode vendored`. |
+| `--mode <hosted\|vendored\|agent>` | — | Selects one of the three [patch modes](#three-patch-modes) (default: `hosted`). Combining `--mode` with a legacy boolean flag of a *different* mode is an error (exit 2); the same mode spelled both ways is accepted. |
+| `--package <name\|purl>` | `SOCKET_SCAN_PACKAGES` | Only scan these packages: a name (`lodash`, `@scope/pkg`, `requests`; case-insensitive) or a purl with or without its version (`pkg:npm/lodash`, `pkg:pypi/requests@2.31.0`). Repeat the flag or separate with commas. |
+| `--prune` | — | Agent-mode garbage collection after the scan: remove manifest entries for packages no longer present in the crawl (installed trees + lockfiles — a wiped `node_modules` alone doesn't prune lockfile-listed entries) and delete orphan blob/diff/package-archive files. [Vendored](#vendor) packages are exempt from the crawl-based prune, but a vendored entry whose dependency has left the lockfile is reverted. Ignored, with a `redirect_prune_ignored` warning, in hosted mode; without a mode the scan is report-only. |
+| `--sync` | — | Shorthand for `--mode agent --prune`: the one-flag agent-mode auto-update run. |
 | `--batch-size <n>` | `SOCKET_BATCH_SIZE` | Packages per API request (default: `500` on the authenticated API, `100` on the public proxy). A request whose body would exceed 256 KiB is split into smaller ones. |
 | `--all-releases` | `SOCKET_ALL_RELEASES` | Store patches for every release/distribution variant, not just the installed one — PyPI wheel/sdist, RubyGems platform, Maven classifier. Makes the manifest portable across environments (e.g. cross-platform CI caches). |
-| `--vex <path>` | `SOCKET_VEX` | On a successful scan, also write an OpenVEX 0.2.0 document to this path. See [Inline VEX generation](#inline-vex-on-apply--scan--vendor). |
+| `--vex <path>` | `SOCKET_VEX` | On a successful scan, also write an OpenVEX 0.2.0 document to this path. See [Inline VEX](#inline-vex-on-apply--scan--vendor). |
 | `--vex-product`, `--vex-no-verify`, `--vex-doc-id`, `--vex-compact` | `SOCKET_VEX_*` | Passthrough to the embedded VEX builder; mirror the standalone [`vex`](#vex) knobs. Inert unless `--vex` is set. |
 
-> Deprecated boolean spellings of `--mode` remain supported for back-compat: `--apply`
-> (== `--mode agent`) and `--vendor` (== `--mode vendored`); prefer `--mode`. `--sync`
-> is not deprecated — it is convenience sugar for `--mode agent` + `--prune`, the
-> single-flag bot invocation (`scan --json --sync --yes`).
-
-> Use `--dry-run` to preview what any moded run (with or without `--prune`) would do
-> without mutating disk.
+> Deprecated spellings: `--apply` (== `--mode agent`) and `--vendor` (== `--mode
+> vendored`). `--detached` is a hidden no-op kept for compatibility (vendored mode is
+> always manifest-free); it is still an error without vendored mode.
 
 **Examples:**
 ```bash
-# Scan local project (interactive prompt to apply)
+# Hosted mode (default): rewrite lockfiles to Socket-hosted patched packages
 socket-patch scan
 
-# Scan with JSON output (discover + updates, no mutation)
+# Same, JSON output
 socket-patch scan --json
 
-# Agent mode: discover + apply patches in place (non-interactive)
-socket-patch scan --json --mode agent --yes
-
-# Auto-update bot: discover, apply, garbage-collect — all in one
-socket-patch scan --json --mode agent --prune --yes
-
-# Preview an agent-mode + prune run without mutating disk
-socket-patch scan --json --mode agent --prune --yes --dry-run
+# Preview without writing anything
+socket-patch scan --json --dry-run
 
-# Scan only npm packages
+# Only npm packages / only one package
 socket-patch scan --ecosystems npm
+socket-patch scan --package lodash
 
-# Scan global packages
-socket-patch scan -g
-
-# Agent mode + emit an OpenVEX attestation in one pass
-socket-patch scan --json --mode agent --prune --yes --vex socket.vex.json
-
-# Vendored mode: build + commit every patched dependency (see the vendor
-# command). Works on a completely fresh clone: dependencies listed in the
-# lockfile but not yet installed are fetched pristine from their registry and
-# integrity-verified against the lockfile before vendoring.
-socket-patch scan --json --mode vendored --yes
-
-# Preview a vendored run (would_vendor / would_revendor / already_vendored)
-socket-patch scan --json --mode vendored --yes --dry-run
-
-# Hosted mode: rewrite lockfiles so patched deps resolve to Socket-hosted
-# integrity-pinned packages — no artifact bytes in the repo, no CI changes.
-socket-patch scan --json --mode hosted --yes
-```
-
-> Already-vendored packages are **skipped by plain `--mode agent`** (the committed
-> artifact is the patch); a newer available patch still appears in the JSON `updates[]`
-> array — re-run `scan --mode vendored` to take it.
->
-> Hosted-managed dependencies get the same signal: `updates[]` also consults the
-> `.socket/vendor/redirect-state.json` ledger, so a superseded hosted patch shows up in
-> read-only `scan --json` — re-run `scan --mode hosted` to take it.
-
-### `apply`
-
-Apply security patches from the local manifest. Idempotent — safe to run from install
-hooks and CI on every build.
-
-**Usage:**
-```bash
-socket-patch apply [options]
-```
-
-**Command-specific options** (plus all [Global options](#global-options)):
-| Flag | Env var | Description |
-|------|---------|-------------|
-| `-f, --force` | `SOCKET_FORCE` | Skip pre-application hash verification (apply even if package version differs). |
-| `--check` | — | Read-only audit that the committed **Go** `replace`-redirects match the manifest (for CI / GitHub-App auditing) — Go only, since cargo patches in place and has no redirect to audit. Lock-free, crawl-free, and offline-safe: exits 0 in sync, 1 on drift. Vendored modules are excluded from the audit. |
-| `--vex <path>` | `SOCKET_VEX` | On a successful apply, also write an OpenVEX 0.2.0 document to this path. See [Inline VEX generation](#inline-vex-on-apply--scan--vendor). |
-| `--vex-product`, `--vex-no-verify`, `--vex-doc-id`, `--vex-compact` | `SOCKET_VEX_*` | Passthrough to the embedded VEX builder; mirror the standalone [`vex`](#vex) knobs. Inert unless `--vex` is set. |
-
-**Examples:**
-```bash
-# Apply patches
-socket-patch apply
+# Two projects of a monorepo
+socket-patch scan apps/web apps/api
 
-# Dry run
-socket-patch apply --dry-run
+# Vendored mode: build + commit every patched dependency
+socket-patch scan --json --mode vendored
 
-# Apply only npm patches
-socket-patch apply --ecosystems npm
+# Agent mode: patch installed files in place
+socket-patch scan --json --mode agent
 
-# Apply in offline mode
-socket-patch apply --offline
+# Agent-mode auto-update: discover, apply, garbage-collect
+socket-patch scan --json --sync
 
-# JSON output for CI/CD
-socket-patch apply --json
+# Report-only scan of global packages
+socket-patch scan -g
 
-# Apply and emit an OpenVEX attestation in one step
-socket-patch apply --vex socket.vex.json
+# Hosted mode + an OpenVEX attestation in one pass
+socket-patch scan --vex socket.vex.json
 ```
 
-> Packages managed by [`vendor`](#vendor) are skipped (`skipped`/`vendored` in JSON): the
-> committed vendored artifact is the patch, so there is nothing for `apply` to do — even
-> when the installed tree (e.g. `node_modules/`) is absent.
+> Already-vendored packages are **skipped by an agent-mode scan** (the committed
+> artifact is the patch); a newer available patch still appears in `updates[]` — re-run
+> `scan --mode vendored` to take it.
 
 ### `vex`
 
@@ -761,17 +717,24 @@ socket-patch vex --no-verify --output socket.vex.json
 
 ### `vendor`
 
-`apply`'s **committable** sibling — the standalone command behind
-[vendored mode](#three-patch-modes) (`scan --mode vendored` runs discovery + this engine
-in one pass). Instead of patching installed packages in place (machine-local state),
-`vendor` ejects each patched package into `.socket/vendor/<ecosystem>/<patch-uuid>/…` and
-rewires your lockfile so the project consumes the vendored copy. Commit `.socket/vendor/` —
-the vendored artifacts plus the ledger whose embedded patch records [`vex`](#vex),
-[`list`](#list), and [`repair`](#repair) read (vendored mode writes nothing else under
-`.socket/`; `vex` can also attest from the lockfile wiring alone) — along with the lockfile
-edits, and **every fresh checkout
-builds with the patched dependency**: no `socket-patch` binary, no Socket API access, no
-install hook required on the consuming machine.
+The command behind [vendored mode](#three-patch-modes). Instead of patching installed
+packages in place, it ejects each patched package into
+`.socket/vendor/<ecosystem>/<patch-uuid>/…` and rewires your lockfile so the project
+consumes the vendored copy. Commit `.socket/vendor/` (the artifacts plus the ledger whose
+embedded patch records [`vex`](#vex), [`list`](#list) and [`repair`](#repair) read)
+along with the lockfile edits, and **every fresh checkout builds with the patched
+dependency**: no `socket-patch` binary, no Socket API access and no install hook on the
+consuming machine.
+
+There are two ways in:
+
+- **`socket-patch scan --mode vendored`** discovers, downloads and vendors in one pass,
+  writes no `.socket/manifest.json`, and takes over packages a hosted scan redirected
+  (their hosted lockfile edits are reverted first). This is the way to move a hosted
+  project offline.
+- **`socket-patch vendor`** vendors the agent-mode patches listed in
+  `.socket/manifest.json`. With no manifest (a hosted or `scan --mode vendored` project)
+  it has nothing to vendor and says so; `vendor --revert` works either way.
 
 Vendoring is per-patch: only dependencies with a Socket patch are vendored. For the
 lockfile flavors each ecosystem supports, see the
@@ -780,6 +743,7 @@ lockfile flavors each ecosystem supports, see the
 **Usage:**
 ```bash
 socket-patch vendor [options]
+socket-patch scan --mode vendored [PATHS]... [options]
 ```
 
 **Command-specific options** (plus all [Global options](#global-options)):
@@ -797,20 +761,26 @@ it:
   a vendor-owned tree or lockfile entry).
 - [`remove`](#remove) **reverts the vendoring** as part of removing the patch — lockfile
   restored, artifact deleted — so one command fully undoes it.
-- [`scan`](#scan) skips downloading/applying patches for vendored packages, and
-  `--prune` exempts them from its crawl-based prune (though a vendored entry whose
-  dependency has left the lockfile is reverted and dropped); newer patches show up in
-  `updates[]` as the signal to re-run `scan --mode vendored`.
+- An agent-mode [`scan`](#scan) skips vendored packages, and `--prune` exempts them
+  from its crawl-based prune (though a vendored entry whose dependency has left the
+  lockfile is reverted and dropped); newer patches show up in `updates[]` as the signal
+  to re-run `scan --mode vendored`.
 - [`vex`](#vex) attests vendored patches by verifying the **committed artifact** (marked
   `(vendored)` in the impact statement) — no `setup` install hook needed.
-- Re-running `vendor` is idempotent. Standalone `vendor` (no flags) is driven by
-  `.socket/manifest.json` — patches dropped from that manifest are auto-reverted on the
-  next run — so on a project vendored by `scan --mode vendored` (no manifest) it is a
-  clean no-op; use [`repair`](#repair) to verify or rebuild the committed artifacts there.
+- Re-running either form is idempotent. Patches dropped from `.socket/manifest.json`
+  are auto-reverted on the next `vendor` run; on a project vendored by
+  `scan --mode vendored`, use [`repair`](#repair) to verify or rebuild the committed
+  artifacts.
 
 **Examples:**
 ```bash
-# Vendor every patched dependency listed in the manifest
+# Discover, download and vendor every patchable dependency (takes over hosted redirects)
+socket-patch scan --mode vendored
+
+# Preview it (would_vendor / would_revendor / already_vendored)
+socket-patch scan --json --mode vendored --dry-run
+
+# Vendor the agent-mode patches listed in .socket/manifest.json
 socket-patch vendor
 
 # Preview without writing anything
@@ -826,13 +796,169 @@ socket-patch vendor --revert
 socket-patch vendor --json
 ```
 
-> Prefer one command? [`scan --mode vendored`](#scan) discovers, downloads, *and* vendors
-> in a single pass.
+### `list`
+
+List the patches in this project: the hosted redirect ledger's records (labeled
+`Mode: hosted`), the vendor ledger's (`Mode: vendored`), and any agent-mode entries in
+`.socket/manifest.json`.
+
+**Usage:**
+```bash
+socket-patch list [options]
+```
+
+No command-specific options — see [Global options](#global-options) (`--json`,
+`--manifest-path`, `--cwd` are the relevant ones).
+
+**Examples:**
+```bash
+# List patches
+socket-patch list
+
+# JSON output
+socket-patch list --json
+```
+
+**Sample output:**
+```
+Found 1 patch:
+
+Package: pkg:npm/flatted@3.3.1
+  UUID: 5cac955f-eab1-4d29-8f4f-c408a6cc9647
+  Mode: hosted (recorded in .socket/vendor/redirect-state.json)
+  Tier: free
+  License: MIT
+  Exported: Wed, 18 Mar 2026 22:53:26 GMT
+  Vulnerabilities (1):
+    - GHSA-25h7-pfq9-p65f (CVE-2026-32141)
+      Severity: HIGH
+      Summary: flatted vulnerable to unbounded recursion DoS in parse() revive phase
+  Files patched (6):
+    - package/cjs/index.js
+    - package/es.js
+    ...
+```
+
+### Agent mode (older commands)
+
+Agent mode keeps patches in `.socket/manifest.json` + `.socket/blobs/` and edits the
+installed files in place, so the CLI has to run again after every install. These
+commands drive it. `rollback` also undoes hosted and vendored patches.
+
+### `get`
+
+Get one security patch from the Socket API and apply it. Accepts a UUID, CVE ID, GHSA
+ID, PURL, or package name. The identifier type is auto-detected but can be forced with a
+flag. Like `scan`, `get` defaults to hosted mode; pass `--mode vendored`, or
+`--mode agent` for the manifest + in-place apply (implied by `--save-only` and
+`--global`). When a package has
+several patches, `get` picks the same one `scan` does (see
+[Which patch is picked](#which-patch-is-picked)). Unlike `scan`, `get` prompts before
+applying (`--yes` or a non-TTY stdin accepts).
+
+Alias: `download`. And as a shortcut, `socket-patch <uuid>` with a bare patch UUID is
+rewritten to `socket-patch get <uuid>`.
+
+**Usage:**
+```bash
+socket-patch get <identifier> [options]
+```
+
+**Arguments:**
+- `identifier` — patch UUID, CVE ID, GHSA ID, package PURL, or package name. Type is
+  auto-detected; force it with `--id` / `--cve` / `--ghsa` / `--package`.
+
+**Command-specific options** (plus all [Global options](#global-options)):
+| Flag | Env var | Description |
+|------|---------|-------------|
+| `--id` | — | Force identifier to be treated as a UUID. |
+| `--cve` | — | Force identifier to be treated as a CVE ID. |
+| `--ghsa` | — | Force identifier to be treated as a GHSA ID. |
+| `-p, --package` | — | Force identifier to be treated as a package name. |
+| `--save-only` | `SOCKET_SAVE_ONLY` | Download the patch without applying it (alias: `--no-apply`). |
+| `--one-off` | `SOCKET_ONE_OFF` | Reserved (hidden from `--help`): apply the patch immediately without saving to the `.socket` folder. **Not yet implemented** — the command currently errors up front. |
+| `--all-releases` | `SOCKET_ALL_RELEASES` | Download patches for every release/distribution variant of a matched package (PyPI wheel/sdist, RubyGems platform, Maven classifier), not just the installed one. |
+| `--mode <hosted\|vendored\|agent>` | — | How to consume the patch; the same modes as `scan --mode` (default: `agent`). |
+
+> Authenticated lookups run against an org. The slug is auto-resolved from your token
+> when omitted; pass `--org <slug>` (or set `SOCKET_ORG_SLUG`) to pick one explicitly —
+> useful when the token belongs to multiple orgs.
+
+**Examples:**
+```bash
+# Get patch by UUID
+socket-patch get 550e8400-e29b-41d4-a716-446655440000
+
+# Get patch by CVE
+socket-patch get CVE-2024-12345
+
+# Get patch by GHSA
+socket-patch get GHSA-xxxx-yyyy-zzzz
+
+# Get patch by package name (fuzzy matches installed packages)
+socket-patch get lodash
+
+# Consume the patch in hosted mode (lockfile rewrite) instead of in place
+socket-patch get CVE-2024-12345 --mode hosted
+
+# Download only, don't apply
+socket-patch get CVE-2024-12345 --save-only
+
+# Apply to global packages
+socket-patch get lodash -g
+
+# JSON output for scripting
+socket-patch get CVE-2024-12345 --json -y
+```
+
+### `apply`
+
+Apply the patches in `.socket/manifest.json` to the installed files in place. Idempotent — safe to run from install
+hooks and CI on every build.
+
+**Usage:**
+```bash
+socket-patch apply [options]
+```
+
+**Command-specific options** (plus all [Global options](#global-options)):
+| Flag | Env var | Description |
+|------|---------|-------------|
+| `-f, --force` | `SOCKET_FORCE` | Skip pre-application hash verification (apply even if package version differs). |
+| `--check` | — | Read-only audit that the committed **Go** `replace`-redirects match the manifest (for CI / GitHub-App auditing) — Go only, since cargo patches in place and has no redirect to audit. Lock-free, crawl-free, and offline-safe: exits 0 in sync, 1 on drift. Vendored modules are excluded from the audit. |
+| `--vex <path>` | `SOCKET_VEX` | On a successful apply, also write an OpenVEX 0.2.0 document to this path. See [Inline VEX generation](#inline-vex-on-apply--scan--vendor). |
+| `--vex-product`, `--vex-no-verify`, `--vex-doc-id`, `--vex-compact` | `SOCKET_VEX_*` | Passthrough to the embedded VEX builder; mirror the standalone [`vex`](#vex) knobs. Inert unless `--vex` is set. |
+
+**Examples:**
+```bash
+# Apply patches
+socket-patch apply
+
+# Dry run
+socket-patch apply --dry-run
+
+# Apply only npm patches
+socket-patch apply --ecosystems npm
+
+# Apply in offline mode
+socket-patch apply --offline
+
+# JSON output for CI/CD
+socket-patch apply --json
+
+# Apply and emit an OpenVEX attestation in one step
+socket-patch apply --vex socket.vex.json
+```
+
+> Packages managed by [`vendor`](#vendor) are skipped (`skipped`/`vendored` in JSON): the
+> committed vendored artifact is the patch, so there is nothing for `apply` to do — even
+> when the installed tree (e.g. `node_modules/`) is absent.
 
 ### `setup`
 
-Configure your project so patches are **re-applied automatically after install** — no
-manual `socket-patch apply` step in CI. `setup` is a one-time operation: run it, commit
+Agent mode only. Configure your project so in-place patches are **re-applied
+automatically after install** — no manual `socket-patch apply` step in CI. (Hosted and
+vendored projects need no hook: the lockfile already names the patched packages.) `setup` is a one-time operation: run it, commit
 the change together with your `.socket/` patches, and every later install handles the
 rest. It is strictly **opt-in** — nothing is hooked unless you run `setup` and commit the
 result.
@@ -964,7 +1090,7 @@ entries, vendored artifacts + ledger entries) for a later re-apply; use
 [`remove`](#remove) for a single patch.
 
 A wet run confirms once (auto-accepted under `--yes`/`--json`/non-TTY). Vendor-owned purls
-the run did NOT act on (today: a corrupt vendor ledger) are listed in the JSON output's
+the run did NOT act on (a corrupt vendor ledger) are listed in the JSON output's
 `vendored` array; acted-on entries ride `vendoredReverted` / `vendoredPreserved` /
 `vendoredKept`.
 
@@ -1001,105 +1127,6 @@ socket-patch rollback --dry-run
 socket-patch rollback --json
 ```
 
-### `get`
-
-Get a security patch from the Socket API and apply it. Accepts a UUID, CVE ID, GHSA ID,
-PURL, or package name. The identifier type is auto-detected but can be forced with a
-flag.
-
-Alias: `download`. And as a shortcut, `socket-patch <uuid>` with a bare patch UUID is
-rewritten to `socket-patch get <uuid>`.
-
-**Usage:**
-```bash
-socket-patch get <identifier> [options]
-```
-
-**Arguments:**
-- `identifier` — patch UUID, CVE ID, GHSA ID, package PURL, or package name. Type is
-  auto-detected; force it with `--id` / `--cve` / `--ghsa` / `--package`.
-
-**Command-specific options** (plus all [Global options](#global-options)):
-| Flag | Env var | Description |
-|------|---------|-------------|
-| `--id` | — | Force identifier to be treated as a UUID. |
-| `--cve` | — | Force identifier to be treated as a CVE ID. |
-| `--ghsa` | — | Force identifier to be treated as a GHSA ID. |
-| `-p, --package` | — | Force identifier to be treated as a package name. |
-| `--save-only` | `SOCKET_SAVE_ONLY` | Download the patch without applying it (alias: `--no-apply`). |
-| `--one-off` | `SOCKET_ONE_OFF` | Reserved (hidden from `--help`): apply the patch immediately without saving to the `.socket` folder. **Not yet implemented** — the command currently errors up front. |
-| `--all-releases` | `SOCKET_ALL_RELEASES` | Download patches for every release/distribution variant of a matched package (PyPI wheel/sdist, RubyGems platform, Maven classifier), not just the installed one. |
-
-> Authenticated lookups run against an org. The slug is auto-resolved from your token
-> when omitted; pass `--org <slug>` (or set `SOCKET_ORG_SLUG`) to pick one explicitly —
-> useful when the token belongs to multiple orgs.
-
-**Examples:**
-```bash
-# Get patch by UUID
-socket-patch get 550e8400-e29b-41d4-a716-446655440000
-
-# Get patch by CVE
-socket-patch get CVE-2024-12345
-
-# Get patch by GHSA
-socket-patch get GHSA-xxxx-yyyy-zzzz
-
-# Get patch by package name (fuzzy matches installed packages)
-socket-patch get lodash
-
-# Download only, don't apply
-socket-patch get CVE-2024-12345 --save-only
-
-# Apply to global packages
-socket-patch get lodash -g
-
-# JSON output for scripting
-socket-patch get CVE-2024-12345 --json -y
-```
-
-### `list`
-
-List all patches recorded locally: the manifest's entries plus the vendor ledger's
-(labeled `Mode: vendored`) and the hosted redirect ledger's records, so it works on
-manifest-less vendored or hosted projects too.
-
-**Usage:**
-```bash
-socket-patch list [options]
-```
-
-No command-specific options — see [Global options](#global-options) (`--json`,
-`--manifest-path`, `--cwd` are the relevant ones).
-
-**Examples:**
-```bash
-# List patches
-socket-patch list
-
-# JSON output
-socket-patch list --json
-```
-
-**Sample output:**
-```
-Found 1 patch:
-
-Package: pkg:npm/flatted@3.3.1
-  UUID: 5cac955f-eab1-4d29-8f4f-c408a6cc9647
-  Tier: free
-  License: MIT
-  Exported: Wed, 18 Mar 2026 22:53:26 GMT
-  Vulnerabilities (1):
-    - GHSA-25h7-pfq9-p65f (CVE-2026-32141)
-      Severity: HIGH
-      Summary: flatted vulnerable to unbounded recursion DoS in parse() revive phase
-  Files patched (6):
-    - package/cjs/index.js
-    - package/es.js
-    ...
-```
-
 ### `remove`
 
 Remove a patch from the manifest (rolls back files first by default). If the package is
@@ -1120,6 +1147,7 @@ socket-patch remove <identifier> [options]
 **Command-specific options** (plus all [Global options](#global-options)):
 | Flag | Env var | Description |
 |------|---------|-------------|
+| `--preserve-state` | `SOCKET_PRESERVE_STATE` | Restore the files and lockfiles but keep the patch's local state (manifest entry, vendored artifact + ledger entry) for a later re-apply, and skip blob cleanup — the single-patch twin of `rollback --preserve-state`. Conflicts with `--skip-rollback`. |
 | `--skip-rollback` | `SOCKET_SKIP_ROLLBACK` | Only update the manifest, do not restore original files (for a vendored package that still has a manifest entry this also leaves the vendor wiring + artifact in place; refused for manifest-less vendored patches, where the revert *is* the removal). |
 
 **Examples:**
@@ -1147,8 +1175,7 @@ Alias: `gc`
 `repair` cleans up the `.socket/` directory without running a scan — useful when you've
 manually adjusted the manifest, recovered from a partial-failure state, or just want to
 free space. It also rebuilds missing or corrupt vendored artifacts. For the combined
-workflow (discover + apply + GC in one pass), use
-`scan --json --mode agent --prune --yes` instead.
+agent-mode workflow (discover + apply + GC in one pass), use `scan --sync` instead.
 
 Like every other mutating command, `repair` takes the `.socket/apply.lock` advisory lock
 while it runs and removes it when it finishes. If another `socket-patch` process is
@@ -1226,7 +1253,7 @@ Each statement's impact string records *how* the patch is persisted — one mark
 |---|---|---|---|
 | `Patched via Socket patch <uuid>` | agent | The installed tree: every patched file's hash was verified against the manifest's `afterHash` | Trust the statement as long as the agent install hook (or a CI `apply`) keeps re-applying; ecosystems without a hook must be declared in `setup.manual` |
 | `Patched via Socket patch <uuid> (vendored)` | vendored | The **committed** `.socket/vendor/` artifact was hash-verified — no install hook needed; the lockfile wiring is the persistence mechanism | Trust it on any checkout; the committed bytes are the patch |
-| `Patched via Socket patch <uuid> (redirected)` | hosted | The lockfile's integrity pin points at the Socket-hosted patched package. A post-install `socket-patch vex` hash-verifies the installed copy; before any install it attests from the pin. When emitted in-run by `scan --mode hosted --vex`, the statement is attested **without hash verification** (the bytes are fetched at install time — the JSON `vex` summary carries `verified: false`) | Ensure installs still resolve from `patch.socket.dev` (the lockfile edit is intact), and run `socket-patch vex` **after installing** to have the redirected patches hash-verified against the installed tree |
+| `Patched via Socket patch <uuid> (redirected)` | hosted | The lockfile's integrity pin points at the Socket-hosted patched package. A post-install `socket-patch vex` hash-verifies the installed copy; before any install it attests from the pin. When emitted in-run by a hosted `scan --vex`, the statement is attested **without hash verification** (the bytes are fetched at install time — the JSON `vex` summary carries `verified: false`) | Ensure installs still resolve from `patch.socket.dev` (the lockfile edit is intact), and run `socket-patch vex` **after installing** to have the redirected patches hash-verified against the installed tree |
 
 The markers are stable strings (see
 [CLI_CONTRACT.md](crates/socket-patch-cli/CLI_CONTRACT.md)); scanners and policy engines
@@ -1256,7 +1283,7 @@ grype <image-or-dir> --vex socket.vex.json
 trivy image --vex socket.vex.json <image>
 ```
 
-Apply patches first (in any mode). When nothing names a patch anywhere — no manifest
+Patch first (in any mode). When nothing names a patch anywhere — no manifest
 entry, no `.socket/vendor` ledger entry, no hosted or vendored lockfile reference — `vex`
 errors with `no_patches` (exit 1) when the manifest file exists but is empty, or with
 `manifest_not_found` (exit 2) when there is no manifest either. When there are patches but
@@ -1267,7 +1294,7 @@ with its reason: `hash_mismatch`, `record_unavailable`, `redirect_unwired`, and
 
 A hosted or vendored checkout needs no `.socket/manifest.json`, and no `.socket/vendor`
 ledgers either. This covers a depscan-opened PR, a clone of a repo that never committed its
-ledgers, and a `scan --mode hosted` run. `vex` reads the patch reference out of each root
+ledgers, and a fresh hosted `scan`. `vex` reads the patch reference out of each root
 lockfile or config: a `patch.socket.dev` URL or a `.socket/vendor/<eco>/<uuid>/…` path
 carries the patch uuid. It then finds that patch's record in the manifest or ledgers, or
 fetches it from the patch API. The references it accepts are what socket-patch's own
@@ -1321,14 +1348,15 @@ You don't need a separate `vex` invocation: pass `--vex <path>` to `apply`, `sca
 `vendor` and the same OpenVEX document is generated as a side-effect of a successful run.
 
 ```bash
-# Patch and attest in one step
-socket-patch apply --vex socket.vex.json
-
-# Discover, apply, prune, and attest — the full auto-update-bot pass
-socket-patch scan --json --mode agent --prune --yes --vex socket.vex.json
+# Hosted scan and attest in one step (not hash-verified until installed: re-run `vex` then)
+socket-patch scan --vex socket.vex.json
 
 # Vendor and attest — manifest-less by construction
-socket-patch scan --json --mode vendored --yes --vex socket.vex.json
+socket-patch scan --json --mode vendored --vex socket.vex.json
+
+# Agent mode: patch in place and attest
+socket-patch apply --vex socket.vex.json
+socket-patch scan --json --sync --vex socket.vex.json
 ```
 
 The `--vex-product`, `--vex-no-verify`, `--vex-doc-id`, and `--vex-compact` flags mirror
@@ -1340,10 +1368,10 @@ Contract:
   with the command's own `--json` output. JSON mode adds a top-level `vex` summary —
   `{ path, statements, format }` — to the envelope (`apply`) / result (`scan`).
 - It's built from the project **as it stands after the run** — the manifest (including
-  any `--mode agent` writes, with or without `--prune`), the `.socket/vendor` ledgers, and
-  the lockfile wiring — and verified against on-disk state unless `--vex-no-verify` is set.
-  Generated for real applies and read-only scans alike; `--dry-run` skips it (nothing was
-  changed, so nothing is attested).
+  any `--mode agent` writes), the `.socket/vendor` ledgers, and the lockfile wiring — and
+  verified against on-disk state unless `--vex-no-verify` is set. Generated for real runs
+  and report-only scans alike; `--dry-run` skips it (nothing was changed, so nothing is
+  attested).
 - `apply --vex` and `vendor --vex` with **no manifest** still attest what the lockfiles and
   ledgers wire. A project with nothing wired anywhere keeps the calm exit 0 and writes no
   document. `apply --check` never generates one.
@@ -1365,37 +1393,38 @@ anonymous free tier, set `SOCKET_NO_API_TOKEN=1`. See
 [Configuration sources](#configuration-sources).
 
 ```bash
-# Check for available patches in CI (read-only)
-result=$(socket-patch scan --json --ecosystems npm)
-patches=$(echo "$result" | jq '.totalPatches')
+# Read-only check: what would a hosted scan patch? (writes nothing)
+result=$(socket-patch scan --json --dry-run --ecosystems npm)
+echo "$result" | jq '{patches: .totalPatches, redirected: .redirect.redirected, updates: (.updates | length)}'
 
-# Auto-update bot: discover, apply, and garbage-collect in one pass
-socket-patch scan --json --mode agent --prune --yes | jq '{
+# Auto-update bot (hosted): take new and newer patches, then let the PR action commit
+socket-patch scan --json | jq '{redirected: .redirect.redirected, files: .redirect.rewrittenFiles}'
+# The PR action (e.g. peter-evans/create-pull-request) commits the working-tree
+# changes (lockfiles + .socket/vendor/); use this summary as the PR body.
+
+# Agent-mode bot: discover, apply, and garbage-collect in one pass
+socket-patch scan --json --sync | jq '{
   applied:     [.apply.patches[]? | select(.action == "added" or .action == "updated") | .purl],
   pruned:      (.gc.prunedManifestEntries // []),
   bytes_freed: (.gc.bytesFreed // 0)
 }'
-# The PR action (e.g. peter-evans/create-pull-request) commits the working-tree
-# changes; use this summary as the PR body.
 
-# Apply patches and check result
+# Agent mode: re-apply committed patches and check the result
 socket-patch apply --json | jq '.status'
 # "success", "partialFailure", "noManifest", or "error"
 ```
 
-When stdin is not a TTY (e.g. in CI pipelines), interactive prompts auto-proceed instead
-of blocking — with one deliberate exception: a plain `scan` (no `--mode`/`--apply`/`--sync`/
-`--vendor`/`--prune` and no `--yes`) is report-only there. It prints what it found and the
-"To apply a single patch, run: …" hint, writes nothing, and exits 0; add `--yes` or a mode flag
-to mutate. Progress indicators and ANSI colors are automatically suppressed when output
-is piped.
+`scan` never prompts, so CI needs no `--yes` for it. The commands that do confirm
+(`get`, `rollback`, `remove`, `setup`) auto-proceed when stdin is not a TTY. Progress
+indicators and ANSI colors are automatically suppressed when output is piped.
 
 The exact JSON shapes, exit codes, and stability guarantees are specified in
 [CLI_CONTRACT.md](crates/socket-patch-cli/CLI_CONTRACT.md).
 
 ## Manifest format
 
-Downloaded patches are stored in `.socket/manifest.json`:
+Agent mode records downloaded patches in `.socket/manifest.json` (hosted and vendored
+mode never write it):
 
 ```json
 {
diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index 5901563d..55a3983a 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -2,22 +2,24 @@
 
 This document defines the **public surface** of the `socket-patch` binary. Anything listed here is part of the user-visible contract: third-party scripts, CI pipelines, and the npm/pypi/cargo wrappers depend on it. Changes are governed by the semver policy at the bottom of this file.
 
-> **Why this exists.** Until late 2026 the CLI crate had zero unit tests under `src/` — only network-dependent `tests/e2e_*.rs` suites that run with `--ignored`. A flag rename, a default-value change, or a JSON key rename could land green and break every shipped wrapper silently. The contract below is now backed by the unit tests under `crates/socket-patch-cli/src/**` (`#[cfg(test)] mod tests`) and the parser tests under `crates/socket-patch-cli/tests/cli_parse_*.rs`. Changes that violate the contract must update those tests in lock-step with a major version bump.
+> **Why this exists.** A flag rename, a default-value change, or a JSON key rename can land green and break every shipped wrapper silently. The contract below is backed by the unit tests under `crates/socket-patch-cli/src/**` (`#[cfg(test)] mod tests`) and the parser tests under `crates/socket-patch-cli/tests/cli_parse_*.rs`. Changes that violate the contract must update those tests in lock-step with a major version bump.
 
 ## Subcommands
 
 | Name | Visible alias(es) | Notes |
 |---|---|---|
-| `scan` | — | Crawl installed packages for available patches |
-| `apply` | — | Apply patches from the local manifest |
+| `scan` | — | Find patches for installed packages and apply them. **v5.0 (MAJOR)**: a bare `scan` runs hosted mode (rewrites lockfiles so only the patched dependencies resolve to Socket-hosted, integrity-pinned packages); `--mode vendored` / `--mode agent` pick the other modes. Never prompts. See [scan modes](#scan-modes-v50) |
 | `vex` | — | Emit an OpenVEX 0.2.0 attestation derived from the local manifest, the `.socket/vendor` ledgers, and the hosted / vendored patch references the project's lockfiles wire (no manifest required) |
 | `vendor` | — | Eject patched dependencies into committable `.socket/vendor/` and rewire lockfiles |
-| `setup` | — | Wire automatic-patching install hooks (npm/pypi/gem) |
-| `rollback` | — | **Full-state rollback (v5.0, MAJOR)**: restore original files AND unwind vendored/hosted lockfile wiring, remove the rolled-back entries from the manifest, and GC their blobs/archives; takes optional variadic positional `targets` (PURL \| UUID \| path glob). See [Rollback command contract](#rollback-command-contract-v50) |
-| `get` | `download` | Fetch + apply patch; requires positional `identifier` |
 | `list` | — | Print patches in the local manifest, plus the vendor ledger's (v5.0) and the hosted redirect ledger's records (labeled; see the `manifest_not_found` row and the action matrix) |
-| `remove` | — | Remove patch from manifest (rolls back first); requires positional `identifier` |
-| `repair` | `gc` | Download missing blobs, rebuild missing/corrupt vendored artifacts, and clean up unused ones (refuses with `lock_held` when a live process holds the lock; see "Lock lifecycle" below) |
+| `get` | `download` | Agent mode by default (`--mode` selects hosted/vendored): fetch + apply a patch; requires positional `identifier` |
+| `apply` | — | Agent mode: apply patches from the local manifest |
+| `setup` | — | Agent mode: wire automatic-patching install hooks (npm/pypi/gem/composer) |
+| `rollback` | — | **Full-state rollback (v5.0, MAJOR)**: restore original files AND unwind vendored/hosted lockfile wiring, remove the rolled-back entries from the manifest, and GC their blobs/archives; takes optional variadic positional `targets` (PURL \| UUID \| path glob). See [Rollback command contract](#rollback-command-contract-v50) |
+| `remove` | — | Agent mode: remove a patch from manifest (rolls back first); requires positional `identifier` |
+| `repair` | `gc` | Agent mode: download missing blobs, rebuild missing/corrupt vendored artifacts, and clean up unused ones (refuses with `lock_held` when a live process holds the lock; see "Lock lifecycle" below) |
+
+Rows are in `--help` order (v5.0): the hosted/vendored workflow (`scan` → `vex` → `vendor`, with `list` to inspect), then the agent-mode (in-place patching) commands.
 
 **Removed in v4.0:** the `unlock` subcommand (a leftover lock from a crashed run never blocks acquisition — the OS releases a dead holder's advisory lock — so there is no stale-lock state to inspect or clear before a mutating command; `repair` briefly owned lock-file cleanup in v4.x, and since v5.0 every lock-taking command removes its own lock file on exit).
 
@@ -54,7 +56,7 @@ In v3.0 every subcommand accepts the same set of "global" flags via a single sha
 | `--verbose` | `-v` | `SOCKET_VERBOSE` | `false` | bool | Extra detail |
 | `--silent` | `-s` | `SOCKET_SILENT` | `false` | bool | Errors only |
 | `--dry-run` | — | `SOCKET_DRY_RUN` | `false` | bool | Preview, no mutations (a dry run may still take the transient `apply.lock`, removed again on exit — see "Lock lifecycle"; hosted and vendored previews never leave a `.socket/`) |
-| `--yes` | `-y` | `SOCKET_YES` | `false` | bool | Skip prompts |
+| `--yes` | `-y` | `SOCKET_YES` | `false` | bool | Skip prompts (`scan` never prompts) |
 | `--lock-timeout` | — | `SOCKET_LOCK_TIMEOUT` | (none) | seconds (u64) | How long to wait for `<.socket>/apply.lock`. Unset and `0` both mean a single non-blocking try; a positive value retries with a 100 ms backoff. Only meaningful on the lock-taking subcommands — `apply`, `rollback`, `repair`, `remove`, `vendor`, `setup` (while persisting `--exclude`), and `scan`/`get` whenever they write (agent-mode download + apply, vendored, hosted) |
 | `--debug` | — | `SOCKET_DEBUG` | `false` | bool | Verbose debug logs to stderr |
 | `--no-telemetry` | — | `SOCKET_TELEMETRY_DISABLED` | `false` | bool | Disable anonymous usage telemetry |
@@ -62,7 +64,7 @@ In v3.0 every subcommand accepts the same set of "global" flags via a single sha
 | `--no-npm-allow-remote-config` | — | `SOCKET_NO_NPM_ALLOW_REMOTE_CONFIG` | `false` | bool | Opt out of hosted mode's automatic `allow-remote=all` write to the project `.npmrc` (see the npm allow-remote note under the scan arguments). Read by `scan --mode hosted` and `get --mode hosted`; other subcommands accept it silently |
 | `--no-vlt-install-cleanup` | — | `SOCKET_NO_VLT_INSTALL_CLEANUP` | `false` | bool | Opt out of hosted mode's warm-tree heal for vlt: stale installed copies (`node_modules/.vlt-lock.json` and the stale `node_modules/.vlt/<DepID>` entries) are left in place after `vlt-lock.json` is repointed (`scan`/`get --mode hosted`) or restored (`rollback`/`remove`), and the `redirect_vlt_reinstall_required` advisory tells you to run `vlt ci` instead. Stale copies of optional dependencies are always left in place (see `redirect_vlt_reinstall_required`). Other subcommands accept it silently |
 
-The `--offline` semantics unified in v3.0. Previously `apply` enforced strict airgap, `repair` skipped network ops, and `rollback` failed when blobs were missing. All three now mean the same thing: never contact the network, fail loudly when a required local source is missing. On `repair`, `--offline` and `--download-only` are mutually exclusive (exit 2). `scan` and `get` need remote data for their core function (patch discovery / patch fetch), so `--offline` refuses them up front — exit 1 with an error naming the offline gate (JSON: `status: "error"`), before any crawl, client build, or network contact. This covers `scan --vendor` too: offline vendored staging is `vendor --offline`'s job.
+`--offline` means the same thing on every command (v3.0): never contact the network, fail loudly when a required local source is missing. On `repair`, `--offline` and `--download-only` are mutually exclusive (exit 2). `scan` and `get` need remote data for their core function (patch discovery / patch fetch), so `--offline` refuses them up front — exit 1 with an error naming the offline gate (JSON: `status: "error"`), before any crawl, client build, or network contact. This covers `scan --vendor` too: offline vendored staging is `vendor --offline`'s job.
 
 The `--strict` mismatch policy applies to the in-place apply paths (apply/get/scan --apply/hook/go redirect). DEFAULT (v3.4): a file whose on-disk content matches neither the patch's beforeHash nor its afterHash is overwritten with the FULL verified patched content (the diff strategy self-disables on a wrong base; archive/blob writes are hash-gated to exactly afterHash; the missing blob is downloaded on demand) and surfaced as a `content_mismatch_overwritten` stderr warning + Skipped event. `--strict` turns that case into a hard error. `--force` overrides `--strict` and additionally skips missing files. Vendor staging is unaffected (it always auto-overwrites into its private stage).
 
@@ -78,14 +80,15 @@ Beyond the globals above, each subcommand defines a small set of local arguments
 | `vendor` | `--revert` | `SOCKET_VENDOR_REVERT` | Undo vendoring: restore recorded original lockfile fragments + remove `.socket/vendor/` artifacts. Works without a manifest |
 | `apply`, `scan`, `vendor` | `--vex` | `SOCKET_VEX` | Generate an OpenVEX 0.2.0 document at this path on a successful run; see "embedded VEX" below |
 | `apply`, `scan`, `vendor` | `--vex-product`, `--vex-no-verify`, `--vex-doc-id`, `--vex-compact` | `SOCKET_VEX_PRODUCT`, `SOCKET_VEX_NO_VERIFY`, `SOCKET_VEX_DOC_ID`, `SOCKET_VEX_COMPACT` | Passthrough to the embedded VEX builder; mirror the standalone `vex` knobs. Inert unless `--vex` is set |
-| `scan` | positional `[PATHS]...` | — | (v5.0) Optional path globs scoping DISCOVERY to packages installed under matching paths (`packages/foo`, `apps/**`). Purl-level: a package is in scope when ANY of its installed copies sits under a matching path. Rejected with `--mode hosted`/`--mode vendored` (exit 2, `resolve_mode_flags` — their lockfile rewiring is whole-project by construction); combines with `--apply`/`--sync`/`--prune`. See "Path-scoped scans" below |
-| `scan` | `--mode <hosted\|vendored\|agent>` | — | The documented selector for the three patch-application modes. Each value is equivalent to one legacy boolean spelling: `hosted` == `--redirect`, `vendored` == `--vendor`, `agent` == `--apply` (`--sync` counts as an agent spelling). Combining `--mode` with a boolean of a DIFFERENT mode is a usage error (exit 2, enforced in `resolve_mode_flags` — clap's `conflicts_with` is value-independent); the same mode spelled both ways is accepted. `--prune` is an orthogonal GC knob and never conflicts — but hosted mode runs no GC, so `--mode hosted --prune` emits an explicit `redirect_prune_ignored` warning (JSON `redirect.warnings[]` + stderr) instead of silently dropping the flag |
-| `scan` | `--redirect` | — | Hosted mode's legacy boolean spelling (**hidden from `--help`** and **deprecated** — `--mode hosted` is the documented spelling; this alias is scheduled for removal in v4): rewrite lockfiles / registry configs so ONLY the patched dependencies resolve to Socket's hosted patch server; no artifact bytes land in the repo. Conflicts with `--apply`/`--sync`/`--vendor` |
-| `scan` | `--apply` / `--prune` / `--sync` | — | Mode selectors (sync = apply + prune); `--apply` == `--mode agent` |
+| `scan` | positional `[PATHS]...` | — | (v5.0) Meaning depends on the mode. **Hosted / vendored** (bare `scan` included): each PATH, or directory glob (`apps/*`), is a project directory scanned on its own as if it were `--cwd`. **Agent** (and a mode-less `--prune`/`--global` report): path globs scoping DISCOVERY to packages installed under matching paths (`packages/foo`, `apps/**`). See "Path-scoped scans" below |
+| `scan` | `--mode <hosted\|vendored\|agent>` | — | The documented selector for the three patch-application modes (v5.0 default: `hosted`, except that a `--prune` or `--global`/`--global-prefix` scan with no mode is report-only). Hidden value aliases: `host`/`redirect` (hosted), `vendor` (vendored). Each value is equivalent to one legacy boolean spelling: `hosted` == `--redirect`, `vendored` == `--vendor`, `agent` == `--apply` (`--sync` counts as an agent spelling). Combining `--mode` with a boolean of a DIFFERENT mode is a usage error (exit 2, enforced in `resolve_mode_flags` — clap's `conflicts_with` is value-independent); the same mode spelled both ways is accepted. `--prune` is an orthogonal GC knob and never conflicts — but hosted mode runs no GC, so `--mode hosted --prune` emits an explicit `redirect_prune_ignored` warning (JSON `redirect.warnings[]` + stderr) instead of silently dropping the flag |
+| `scan` | `--redirect` | — | Hosted mode's legacy boolean spelling (**hidden from `--help`** and **deprecated** — `--mode hosted` is the documented spelling): rewrite lockfiles / registry configs so ONLY the patched dependencies resolve to Socket's hosted patch server; no artifact bytes land in the repo. Conflicts with `--apply`/`--sync`/`--vendor` |
+| `scan` | `--apply` / `--prune` / `--sync` | — | `--apply` == `--mode agent` (deprecated spelling); `--prune` = GC after the scan (ignored with a `redirect_prune_ignored` warning in hosted mode); `--sync` = `--mode agent --prune` |
+| `scan` | `--package <name\|purl>` (repeatable or comma-separated) | `SOCKET_SCAN_PACKAGES` | (v5.0) Only scan these packages: a name (`lodash`, `@scope/pkg`, `requests`, `group:artifact`; matched against the full name or its last segment, case-insensitively) or a purl with or without a version (`pkg:npm/lodash` matches every version, `pkg:pypi/requests@2.31.0` only that one). Qualifiers are ignored. Filters the crawl like `--ecosystems`, after the prune universe is captured, so `--prune` still judges the full crawl |
 | `scan` | `--vendor` / `--detached` | — | Vendor every patched dependency instead of applying in place (`--vendor` == `--mode vendored`; conflicts with `--apply`/`--sync`, combines with `--prune`). Vendored mode is manifest-free (v5.0): the vendor ledger embeds the patch records and `.socket/manifest.json` is never written. `--detached` — the former opt-in for exactly that — is **hidden** and retained for compatibility as a no-op; it is still a usage error (exit 2) without vendored mode in either spelling |
 | `scan` | `--batch-size` | `SOCKET_BATCH_SIZE` | API batch chunk size. Unset (v5.0): `500` on the authenticated API (the server's per-request maximum), `100` on the public proxy; a given value applies on either endpoint (`0` is floored to `1`). A chunk whose request body would exceed 256 KiB (the public proxy's body cap) is split into consecutive smaller chunks, deterministically (greedy, in crawl order). A mid-run downgrade to the proxy keeps the chunks already formed |
 | `get`, `scan` | `--all-releases` | `SOCKET_ALL_RELEASES` | Download patches for every release/distribution variant of a matched package — PyPI wheel/sdist (`artifact_id`), RubyGems (`platform`), Maven (`classifier`) — not just the one(s) matching the locally-installed distribution. On `scan` this makes the stored manifest portable across environments (e.g. cross-platform CI caches). On `get` (v3.6) it ALSO disables the coarse installed-**version** narrowing of CVE/GHSA fan-outs (see "get --mode and installed narrowing"): every found version's patch is fetched, installed or not |
-| `get` | positional `identifier`; `--id` / `--cve` / `--ghsa` / `--package` (`-p`); `--save-only` (alias `--no-apply`); `--one-off` (hidden from `--help`: always fails "not yet implemented"); `--mode <hosted\|vendored\|agent>` | `SOCKET_SAVE_ONLY`, `SOCKET_ONE_OFF` | Patch lookup + consumption mode (v3.6). `--mode` reuses scan's value enum (same hidden value aliases `host`/`redirect`/`vendor`; deliberately no env binding, matching scan). Default `agent` = today's save+apply flow, unchanged. `--save-only` conflicts with `--mode hosted\|vendored` — rejected with **exit 1** via get's established self-enforced-conflict style (unlike scan's exit-2 mode conflicts; see the exit-code table) |
+| `get` | positional `identifier`; `--id` / `--cve` / `--ghsa` / `--package` (`-p`); `--save-only` (alias `--no-apply`); `--one-off` (hidden from `--help`: always fails "not yet implemented"); `--mode <hosted\|vendored\|agent>` | `SOCKET_SAVE_ONLY`, `SOCKET_ONE_OFF` | Patch lookup + consumption mode (v3.6). `--mode` reuses scan's value enum (same hidden value aliases `host`/`redirect`/`vendor`; deliberately no env binding, matching scan). Default (v5.0): `hosted`, like scan; `agent` (save + apply in place) when `--save-only` or `--global`/`--global-prefix` is given. An explicit `--save-only` conflicts with `--mode hosted\|vendored` — rejected with **exit 1** via get's established self-enforced-conflict style (unlike scan's exit-2 mode conflicts; see the exit-code table) |
 | `remove` | positional `identifier`; `--skip-rollback`; `--preserve-state` (v5.0) | `SOCKET_SKIP_ROLLBACK`, `SOCKET_PRESERVE_STATE` | Manifest entry removal. `--preserve-state` is the single-patch twin of `rollback --preserve-state`: restore the tree and unwind the identifier's vendored/hosted wiring, but keep the manifest entry, the vendored artifact + ledger entry, and skip all GC. Combining it with `--skip-rollback` is a self-enforced usage error (exit 2): one flag keeps the tree and drops the state, the other restores the tree and keeps the state — together they select the do-nothing quadrant ("the combination would be a no-op: nothing would change"). The conflict fires whether either flag is spelled on the command line or sourced from its env var |
 | `rollback` | optional variadic positional `targets` (PURL \| UUID \| path glob); `--one-off`; `--preserve-state` (v5.0) | `SOCKET_ONE_OFF`, `SOCKET_PRESERVE_STATE` | Rollback scope. Multiple targets union. A token becomes a path glob ONLY when it is path-SHAPED — contains a separator (`/` or `\`) or a glob metacharacter (`*?[`), or starts with `./`, or is absolute; a `pkg:` prefix is a PURL and every other bare word keeps identifier (PURL/UUID) semantics, so a mistyped identifier or truncated UUID stays a safe exit-1 "No patch found matching identifier: X" (with a hint suggesting `./X` or `X/**` for directory targeting) instead of silently becoming a path scope. An unparseable glob is a usage error (exit 2) |
 | `vex` | `--output` / `-O`, `--product`, `--no-verify`, `--doc-id`, `--compact` | `SOCKET_VEX_OUTPUT`, `SOCKET_VEX_PRODUCT`, `SOCKET_VEX_NO_VERIFY`, `SOCKET_VEX_DOC_ID`, `SOCKET_VEX_COMPACT` | OpenVEX 0.2.0 document generation; see "vex output channels" below |
@@ -106,17 +109,21 @@ For a **9.0 root lock**, the CLI ensures `pnpm-workspace.yaml` carries `trustLoc
 
 **Takeover reconciliation (npm family, bun and vlt included)**: vendoring over a hosted-redirected purl (`vendor`, `scan --mode vendored`, `get --mode vendored`) first REVERTS that purl's hosted lockfile edits to their pre-redirect registry values through the per-purl redirect revert, drops the purl's record + package edits from `redirect-state.json`, and then vendors — so the vendor ledger records the PRISTINE registry fragment as its wiring `original` and `vendor --revert` lands back on registry state, never on an expiring hosted URL. The run that takes over records a `vendor_takeover_reverted_redirect` advisory event (`skipped` action beside the purl's genuine outcome; the human path prints `Warning (vendor_takeover_reverted_redirect): …`). `--dry-run` PROBES the same revert against an in-memory ledger clone instead of promising it: a clean probe reports `vendor_would_revert_redirect`, and a drifted lock or an undecidable ledger edit surfaces in the preview with the wet run's `redirect_revert_failed` code and detail (for bun, whose hosted rewrite replaces the entry's `name@version` spec, the preview first runs the Bun vendored preflight described below and then stops at the advisory instead of reading the still-hosted lock — a lock the vendored backend would refuse is previewed as the wet run's `failed <code>`, never as `vendor_would_revert_redirect`). A purl whose hosted edits cannot be cleanly reverted fails `redirect_revert_failed` (exit 1 / `partial_failure`, nothing vendored for it, the hosted wiring left in place, the remedy in the detail). **bun** participates like every other npm-family flavor: binary `redirect_bun_lockb_package` snapshots are claimed by their recorded package identity and restore individual binary resolutions; its text `redirect_bun_lock_package` edits are claimed by the recorded line's spec — the registry spec `<name>@<version>`, or a hosted URL whose tarball leaf is `<name>-<version>.tgz` — so a sibling version's or an aliased sibling's edit is neither claimed nor a refusal, and only an edit that mentions the package without being a bun packages-entry line refuses (remedy: an unscoped `socket-patch rollback`, whose whole-ledger replay unwinds bun.lock hosted edits; never hand-edit the ledger). The same claim rule serves scoped `rollback <purl>` / `remove <purl>` of one of several hosted bun records (see "Hosted unwind coverage"). Hosted → vendored and vendored → hosted (`redirect_takeover_reverted_vendored` in `redirect.warnings[]`) both work in place on bun locks the target mode accepts. **Bun vendored preflight before the takeover**: `vendor` — like `scan` / `get --mode vendored`, whose pre-download preflight runs earlier — checks `bun.lock` / `bun.lockb` with the shared Bun vendored preflight BEFORE the per-purl hosted revert, so a hosted-redirected purl on a lock the vendored backend refuses (a pre-version-2 `workspace:` lock → `vendor_bun_workspace_unsupported`; a malformed or unsupported binary lock → `vendor_bun_lockb_invalid`; an unsupported text-lock version → its code) is reported `failed <code>` with the hosted wiring, the redirect ledger and active Bun lock byte-untouched (exit 1 / `partial_failure`): the package stays hosted-patched instead of being un-hosted and then refused. `vendor --dry-run` previews that same `failed` code (exit-code parity with the wet run, nothing written) instead of promising `vendor_would_revert_redirect`. Pinned by `tests/in_process_vendor_bun_takeover.rs` and, against real Bun, `tests/mode_migration_bun.rs`. **golang** takes over the same way: the per-purl revert drops the module's hosted `replace`, removes the socket module's go.sum lines, puts the pruned upstream go.sum lines back in go's sort order, and drops the ledger record, so the vendored `replace` is recorded over pristine go.mod/go.sum (a go.mod whose replace for the module is no longer the recorded one refuses `redirect_revert_failed`). The separate run-level `vendor_supersedes_redirect` warning covers the reconcile-only case — a live lock that already proves vendored won over a stale hosted ledger record (the vendor wiring then holds the hosted-spliced fragment as `original`) — and fires exactly once, on the run that drops the stale records. Which way the live lock points is decided by the same lockfile discovery and ledger-liveness rules `vex` gates attestations on (see "Manifest-less VEX (lockfile discovery)"), for this warning, its `redirect_supersedes_vendored` twin and `hosted_wiring_retained` alike.
 
-`scan --apply` opts JSON callers into the full discover → select → apply pipeline. Without it, `scan --json` stays read-only (discovery + the `updates` array + the `redirectState` state block below). No effect outside `--json` mode. The non-JSON path prompts the user interactively in a TTY; when stdin is NOT a TTY (CI, a pipe), `--yes` is absent, and no intent flag (`--mode`, `--apply`, `--sync`, `--vendor`, `--redirect`, `--prune`) is given, a human-mode `scan` is **report-only** (v5.0): it prints the discovery report and the existing "To apply a single patch, run: …" hint, downloads nothing, writes nothing (no `.socket/`), and exits 0. Any intent flag, `--yes`, or a TTY keeps the previous behavior (prompt in a TTY, auto-proceed otherwise). Only `scan` gained this pre-check — `rollback`/`remove`/`get`'s non-TTY auto-accept is unchanged.
+### Scan modes (v5.0)
 
-**Hosted-state visibility (`redirectState`, additive/MINOR).** Every non-hosted-mode, non-vendored-mode `scan --json` SUCCESS envelope (report-only, `--mode agent`/`--apply`/`--sync`, and the zero-discovery envelope) carries an additive top-level `redirectState` object whenever the hosted redirect ledger (`.socket/vendor/redirect-state.json`) holds ≥ 1 `records` entry: `{ mode, ledger, records: [{purl, ledgerKey, uuid}], wiringLive: [purl] }`. It is a descriptive STATE block, not a warning — a hosted-wired project's report-only scan used to be byte-identical to a never-touched project's. `mode` is the constant `"hosted"` (the mode's documented name, whatever opaque `mode` string the ledger itself carries — pre-rename ledgers say `"redirect"`) and `ledger` the ledger's repo-relative path. `records` lists every ledger record (sorted by ledger key): each entry's `purl` is CANONICALIZED (qualifiers stripped, percent-decoded — e.g. `pkg:npm/@scope/pkg@1.0.0`, `pkg:gem/nokogiri@1.13.3`) to the same spelling `wiringLive` carries, so the records↔proof join is a plain string compare, and `ledgerKey` preserves the ledger's verbatim key (percent-encoded scoped names, `?platform=` qualifiers) for consumers addressing the ledger itself. `wiringLive` is the subset of this run's *counted* purls (post-`--ecosystems`-filter) whose hosted lockfile wiring the LIVE lock still proves — the same proof, computed once per run, that feeds `hosted_wiring_retained`, and the same liveness rule `vex` applies to a redirect-ledger record (see "Manifest-less VEX (lockfile discovery)"). Consumers must treat the split as exactly that: records are the ledger's word, `wiringLive` the live lock's proof — a record with no proof means the wiring was unwound, the lock is unreadable, or the purl was not crawled/queried this run (an `--ecosystems` filter, a zero discovery), never "still live". The key is omitted when the ledger is absent or its `records` are empty (an edits-only ledger asserts no patches), and error envelopes (the `--offline` refusal, all-batches-failed) are deliberately minimal and never carry it. A malformed ledger degrades to "nothing to consult" (no block) with a stderr warning, muted by `--silent`. Hosted-mode runs carry the `redirect` sub-object instead (the run's own result; the ledger is re-persisted mid-run), and vendored-mode runs carry the takeover warnings (their reconciliation may retire records mid-run) — neither duplicates a pre-run snapshot that could go stale.
+**Mode resolution (`resolve_mode_flags`, MAJOR in v5.0).** `--mode`, or one of its legacy boolean spellings (`--redirect`, `--vendor`, `--apply`/`--sync`), picks the mode. With none of them, `scan` runs **hosted** mode — JSON and human alike; the result nests under the JSON `redirect` sub-object (see the hosted paragraph below). The one exception: a `--prune` or `--global`/`--global-prefix` scan with no mode has no project lockfile to rewire, so it is **report-only** — discovery, the table, the `updates` array and the `redirectState` block below, plus the `--prune` GC — and, in human mode, ends with the hint `To apply these patches in place, run:` / `  socket-patch scan --mode agent [PATHS]` / `  socket-patch get <package-name-or-purl-or-CVE-ID>`. An explicit `--mode hosted` (or `--redirect`) with `--global`/`--global-prefix` is a usage error (exit 2: global installs have no project lockfile to redirect).
 
-**Agent-flow run-level warnings (additive).** An agent-mode apply (`--mode agent` / `--apply` / `--sync`, `--json`) may add a top-level `warnings[]` array of `{code, detail}` entries to the scan envelope (absent when none fired; each is also mirrored to stderr unless `--silent`). They surface cross-mode state the apply cannot change — never a status or exit-code change (hosted refusals set the precedent: exit 0 + warning). Codes (stable; new codes are additive/MINOR): `vendored_ownership_retained` — vendor-owned package(s) were skipped before download (the per-patch `skipped`/`vendored` records in `apply.patches[]` are unchanged); the detail names the purls and the migration path (`remove <purl>`, or `vendor --revert` which unwinds every vendored package, then re-run). `hosted_wiring_retained` — the hosted redirect ledger records scanned package(s) whose hosted lockfile wiring the live lock still proves (the agent run does not unwind hosted wiring — as of v5.0 that is `socket-patch rollback`'s job, or `remove <purl>` per package); the detail names the purls and the options (stay `--mode hosted`, or migrate via `scan --mode vendored`) and never advises hand-deleting the ledger. The warning keys on ledger *records* still live at scan time — a flow that pre-reverted the redirect (retiring the records) retires the warning with them, even while the append-only `edits` (revert originals) remain. The interactive path prints the same `hosted_wiring_retained` text to stderr after an apply; the vendored counterpart is already covered by its per-package `[skip] … (vendored …)` lines. `ownership_not_restored` (v5.0; `apply` and `rollback` `warnings[]` alike) — a file WAS patched (or restored) but its ownership could not be put back to the original uid/gid (the mode is still restored last); the detail is `<purl>: <path>: patched, but ownership could not be restored to uid N gid M: <error>` and the human line `Warning (ownership_not_restored): <detail>` (stderr, muted by `--silent`); never a status or exit change.
+**scan never prompts, in any mode** (v5.0): no confirm, no free-tier patch menu (it always takes the top-ranked downloadable patch; see "Which patch gets selected"), and no `Non-interactive mode detected` note. `--yes` does not change a scan. `get`, `rollback`, `remove`, `setup` and `--update` keep their prompts.
 
-`scan --prune` opts into garbage collection. When set, `scan` removes manifest entries for packages no longer present in the crawl, then deletes orphan blob, diff, and package-archive files from `.socket/`. Off by default (v3.0) so a temporary uninstall doesn't silently destroy manifest state. Only entries whose ecosystem this run actually crawled are eligible: a `pkg:<type>/` with no crawler in this build (a newer CLI's ecosystem in the committed manifest) and the runtime-gated maven/nuget crawlers with their gate off are exempt — the crawl never looked for them, so their absence is not evidence of removal (same fail-safe as the `--ecosystems` filter, which narrows the query but never the prune's installed set). The pass also reconciles vendored state (runs FIRST, under ONE apply-lock acquisition shared with the manifest prune — lock contention skips the whole pass without failing the scan; `--lock-timeout` is honored and a lock I/O error is reported rather than swallowed; the existence gate — a manifest file OR a vendor ledger file, both cheap stats; an emptied ledger is deleted on save, so its presence is its content proxy — runs BEFORE the lock, so a bare project never gets a `.socket/`; in the vendored scan arms the pass runs AFTER the vendor step): (a) ledger entries still tracked by a manifest record (manifest-mode entries written by standalone `vendor`) whose patch is gone from the manifest are reverted — `detached` entries (every `scan`/`get --mode vendored` entry, v5.0) have no manifest record to lose and are exempt from this leg; (b) EVERY ledger entry whose dependency is no longer in the lockfile graph is reverted and any manifest entry it still had dropped (v5.0: the check is about the lockfile, not the manifest, so embedded-record entries are no longer exempt; a missing or undeterminable lockfile keeps the entry, fail-safe); and (c) orphan `.socket/vendor/<eco>/<uuid>` dirs with no ledger entry are swept. The prune never deletes a zero-patch `.socket/manifest.json` (its `{"patches": {}}` + `setup` block stay). The JSON `gc` sub-object gains `revertedVendoredEntries` + `keptVendoredEntries` + `failedVendoredEntries` + `removedVendorOrphanDirs` (wet) / `revertableVendoredEntries` + `vendorOrphanDirs` (preview), plus two ADDITIVE wet-only keys: `skipped: {code, message}` — present exactly when the pass was skipped at the lock (`lock_held` | `lock_io`; every count is then zero) — and `warnings: [{code, detail}]` — `vendor_state_write_failed` / `manifest_write_failed` (entries were reverted but the ledger or manifest rewrite failed) and `cleanup_failed` (an orphan sweep failed mid-way). Human mode prints `GC: skipped (<code>): <message>.`, one `GC: <detail>.` line per warning, and `GC: failed to revert N vendored entries: …` (singular for one) for `failedVendoredEntries`. `keptVendoredEntries` lists drift-kept entries the revert deliberately preserved (`vendor_artifact_kept` — undo the drift and re-run `vendor --revert` to finish); the preview cannot see drift (backends return before the wiring replay on dry runs), so `revertableVendoredEntries` may over-promise what a wet run will actually reclaim.
+**Hosted-state visibility (`redirectState`, additive/MINOR).** Every non-hosted-mode, non-vendored-mode `scan --json` SUCCESS envelope (report-only, `--mode agent`/`--apply`/`--sync`, and the zero-discovery envelope) carries an additive top-level `redirectState` object whenever the hosted redirect ledger (`.socket/vendor/redirect-state.json`) holds ≥ 1 `records` entry: `{ mode, ledger, records: [{purl, ledgerKey, uuid}], wiringLive: [purl] }`. It is a descriptive STATE block, not a warning. `mode` is the constant `"hosted"` (the mode's documented name, whatever opaque `mode` string the ledger itself carries — pre-rename ledgers say `"redirect"`) and `ledger` the ledger's repo-relative path. `records` lists every ledger record (sorted by ledger key): each entry's `purl` is CANONICALIZED (qualifiers stripped, percent-decoded — e.g. `pkg:npm/@scope/pkg@1.0.0`, `pkg:gem/nokogiri@1.13.3`) to the same spelling `wiringLive` carries, so the records↔proof join is a plain string compare, and `ledgerKey` preserves the ledger's verbatim key (percent-encoded scoped names, `?platform=` qualifiers) for consumers addressing the ledger itself. `wiringLive` is the subset of this run's *counted* purls (post-`--ecosystems`-filter) whose hosted lockfile wiring the LIVE lock still proves — the same proof, computed once per run, that feeds `hosted_wiring_retained`, and the same liveness rule `vex` applies to a redirect-ledger record (see "Manifest-less VEX (lockfile discovery)"). Consumers must treat the split as exactly that: records are the ledger's word, `wiringLive` the live lock's proof — a record with no proof means the wiring was unwound, the lock is unreadable, or the purl was not crawled/queried this run (an `--ecosystems` filter, a zero discovery), never "still live". The key is omitted when the ledger is absent or its `records` are empty (an edits-only ledger asserts no patches), and error envelopes (the `--offline` refusal, all-batches-failed) are deliberately minimal and never carry it. A malformed ledger degrades to "nothing to consult" (no block) with a stderr warning, muted by `--silent`. Hosted-mode runs carry the `redirect` sub-object instead (the run's own result; the ledger is re-persisted mid-run), and vendored-mode runs carry the takeover warnings (their reconciliation may retire records mid-run) — neither duplicates a pre-run snapshot that could go stale.
+
+**Agent-flow run-level warnings (additive).** An agent-mode apply (`--mode agent` / `--apply` / `--sync`, `--json`) may add a top-level `warnings[]` array of `{code, detail}` entries to the scan envelope (absent when none fired; each is also mirrored to stderr unless `--silent`). They surface cross-mode state the apply cannot change — never a status or exit-code change (hosted refusals set the precedent: exit 0 + warning). Codes (stable; new codes are additive/MINOR): `vendored_ownership_retained` — vendor-owned package(s) were skipped before download (the per-patch `skipped`/`vendored` records in `apply.patches[]` are unchanged); the detail names the purls and the migration path (`remove <purl>`, or `vendor --revert` which unwinds every vendored package, then re-run). `hosted_wiring_retained` — the hosted redirect ledger records scanned package(s) whose hosted lockfile wiring the live lock still proves (the agent run does not unwind hosted wiring — as of v5.0 that is `socket-patch rollback`'s job, or `remove <purl>` per package); the detail names the purls and the options (stay `--mode hosted`, or migrate via `scan --mode vendored`) and never advises hand-deleting the ledger. The warning keys on ledger *records* still live at scan time — a flow that pre-reverted the redirect (retiring the records) retires the warning with them, even while the append-only `edits` (revert originals) remain. The human path prints the same `hosted_wiring_retained` text to stderr after an apply; the vendored counterpart is already covered by its per-package `[skip] … (vendored …)` lines. `ownership_not_restored` (v5.0; `apply` and `rollback` `warnings[]` alike) — a file WAS patched (or restored) but its ownership could not be put back to the original uid/gid (the mode is still restored last); the detail is `<purl>: <path>: patched, but ownership could not be restored to uid N gid M: <error>` and the human line `Warning (ownership_not_restored): <detail>` (stderr, muted by `--silent`); never a status or exit change.
+
+`scan --prune` opts into garbage collection. When set, `scan` removes manifest entries for packages no longer present in the crawl, then deletes orphan blob, diff, and package-archive files from `.socket/`. Off by default (v3.0) so a temporary uninstall doesn't silently destroy manifest state. Only entries whose ecosystem this run actually crawled are eligible: a `pkg:<type>/` with no crawler in this build (a newer CLI's ecosystem in the committed manifest) is exempt — the crawl never looked for them, so their absence is not evidence of removal (same fail-safe as the `--ecosystems` filter, which narrows the query but never the prune's installed set). The pass also reconciles vendored state (runs FIRST, under ONE apply-lock acquisition shared with the manifest prune — lock contention skips the whole pass without failing the scan; `--lock-timeout` is honored and a lock I/O error is reported rather than swallowed; the existence gate — a manifest file OR a vendor ledger file, both cheap stats; an emptied ledger is deleted on save, so its presence is its content proxy — runs BEFORE the lock, so a bare project never gets a `.socket/`; in the vendored scan arms the pass runs AFTER the vendor step): (a) ledger entries still tracked by a manifest record (manifest-mode entries written by standalone `vendor`) whose patch is gone from the manifest are reverted — `detached` entries (every `scan`/`get --mode vendored` entry, v5.0) have no manifest record to lose and are exempt from this leg; (b) EVERY ledger entry whose dependency is no longer in the lockfile graph is reverted and any manifest entry it still had dropped (v5.0: the check is about the lockfile, not the manifest, so embedded-record entries are no longer exempt; a missing or undeterminable lockfile keeps the entry, fail-safe); and (c) orphan `.socket/vendor/<eco>/<uuid>` dirs with no ledger entry are swept. The prune never deletes a zero-patch `.socket/manifest.json` (its `{"patches": {}}` + `setup` block stay). The JSON `gc` sub-object gains `revertedVendoredEntries` + `keptVendoredEntries` + `failedVendoredEntries` + `removedVendorOrphanDirs` (wet) / `revertableVendoredEntries` + `vendorOrphanDirs` (preview), plus two ADDITIVE wet-only keys: `skipped: {code, message}` — present exactly when the pass was skipped at the lock (`lock_held` | `lock_io`; every count is then zero) — and `warnings: [{code, detail}]` — `vendor_state_write_failed` / `manifest_write_failed` (entries were reverted but the ledger or manifest rewrite failed) and `cleanup_failed` (an orphan sweep failed mid-way). Human mode prints `GC: skipped (<code>): <message>.`, one `GC: <detail>.` line per warning, and `GC: failed to revert N vendored entries: …` (singular for one) for `failedVendoredEntries`. `keptVendoredEntries` lists drift-kept entries the revert deliberately preserved (`vendor_artifact_kept` — undo the drift and re-run `vendor --revert` to finish); the preview cannot see drift (backends return before the wiring replay on dry runs), so `revertableVendoredEntries` may over-promise what a wet run will actually reclaim.
 
 `scan` queries the patch API in `--batch-size` chunks. Authenticated runs POST `/v0/orgs/{slug}/patches/batch`; token-less runs POST `{proxy}/patch/batch` on the public proxy and degrade to per-package `GET /patch/by-package/:purl` requests in two cases: the deployed proxy predates the batch endpoint (legacy proxies answer the POST with their `400 "Unsupported endpoint"` catch-all), or the all-or-nothing batch validation rejects the chunk (e.g. a crawled PURL type the server doesn't recognize, such as `pkg:jsr/…` — the per-package path tolerates those individually, preserving the pre-batch scan semantics). Rate limits and over-capacity 503s surface instead of silently degrading.
 
-**Throttling: bounded retry, then a reported failure.** Every patch-API JSON call (the batch query, the per-package patch lists, patch views and VEX record fetches, hosted package references) retries an HTTP `429` or `503` answer up to 3 times (`SOCKET_API_MAX_RETRIES=<n>`, `0`-`10`; `0` = no retry). The wait honors `Retry-After` (delta-seconds or HTTP-date); a `Retry-After` over 30 s is not waited out — the answer is final at once — and one under the jittered first backoff step (`0`, a past date) waits that step instead. Without one it backs off 0.5 s / 1 s / 2 s (each step up to 8 s, with jitter in its upper half). All retries in one run share a 60 s wall-clock window that opens with the run's first retry: a retry whose wait would end after it closes is refused and the answer is final. Parallel requests wait in parallel, so each still gets its retries while the run adds at most about 60 s. Nothing else is retried (401/403 still drive the proxy fallback on the first answer; the public proxy's permanent `503 "Patch API is not configured"` is never retried on any path — the batch query still degrades to the per-package path at once, and a per-package lookup or patch view answering it is the same non-throttle failure it always was, so the legacy per-package path still skips that package), and a retried answer folds exactly where the first attempt's would have, so output is identical to an unthrottled run's. A request still throttled after that is a failure in the channel its siblings use: a failed batch is the human `Warning: API batch <n> of <total> failed: <error>` line and, under `--json`, a run-level `warnings[]` entry `{code: "api_batch_failed", detail: "API batch <n> of <total> failed: <error>"}` (additive; `status` stays `success`, exit 0 — the other batches' packages are reported); a failed per-package patch-list query in the agent / hosted / vendored flows is the human `Warning: could not fetch details for <purl>: <error>` line and, under `--json`, `{code: "patch_details_failed", detail: "could not fetch details for <purl>: <error>"}`. When every batch (or every patch-list query) fails, the existing all-failed error envelope and exit 1 apply. The error names the exhausted retry: `Rate limit exceeded (HTTP 429, gave up after 3 retries). Please try again later.` / `API request failed with status 503: <body> (gave up after 3 retries)` (or `(Retry-After <n> s exceeds the 30 s retry cap)` / `(the run's 60 s retry window has closed)`); with retries off it is the pre-retry text. On the token-less legacy per-package proxy path (a proxy without `POST /patch/batch`), a package still throttled (429 / over-capacity 503) after its retries fails its whole batch query, so every package in that batch goes unchecked and is reported through the batch-failure channel above (an unresolvable PURL, or a "not configured" 503, is still skipped individually). Before this, a throttled batch vanished from a `--json` envelope without a trace. Pinned by `tests/scan_api_retry_e2e.rs` and the core crate's `tests/api_retry_e2e.rs`.
+**Throttling: bounded retry, then a reported failure.** Every patch-API JSON call (the batch query, the per-package patch lists, patch views and VEX record fetches, hosted package references) retries an HTTP `429` or `503` answer up to 3 times (`SOCKET_API_MAX_RETRIES=<n>`, `0`-`10`; `0` = no retry). The wait honors `Retry-After` (delta-seconds or HTTP-date); a `Retry-After` over 30 s is not waited out — the answer is final at once — and one under the jittered first backoff step (`0`, a past date) waits that step instead. Without one it backs off 0.5 s / 1 s / 2 s (each step up to 8 s, with jitter in its upper half). All retries in one run share a 60 s wall-clock window that opens with the run's first retry: a retry whose wait would end after it closes is refused and the answer is final. Parallel requests wait in parallel, so each still gets its retries while the run adds at most about 60 s. Nothing else is retried (401/403 still drive the proxy fallback on the first answer; the public proxy's permanent `503 "Patch API is not configured"` is never retried on any path — the batch query still degrades to the per-package path at once, and a per-package lookup or patch view answering it is the same non-throttle failure it always was, so the legacy per-package path still skips that package), and a retried answer folds exactly where the first attempt's would have, so output is identical to an unthrottled run's. A request still throttled after that is a failure in the channel its siblings use: a failed batch is the human `Warning: API batch <n> of <total> failed: <error>` line and, under `--json`, a run-level `warnings[]` entry `{code: "api_batch_failed", detail: "API batch <n> of <total> failed: <error>"}` (additive; `status` stays `success`, exit 0 — the other batches' packages are reported); a failed per-package patch-list query in the agent / hosted / vendored flows is the human `Warning: could not fetch details for <purl>: <error>` line and, under `--json`, `{code: "patch_details_failed", detail: "could not fetch details for <purl>: <error>"}`. When every batch (or every patch-list query) fails, the existing all-failed error envelope and exit 1 apply. The error names the exhausted retry: `Rate limit exceeded (HTTP 429, gave up after 3 retries). Please try again later.` / `API request failed with status 503: <body> (gave up after 3 retries)` (or `(Retry-After <n> s exceeds the 30 s retry cap)` / `(the run's 60 s retry window has closed)`); with retries off it is the pre-retry text. On the token-less legacy per-package proxy path (a proxy without `POST /patch/batch`), a package still throttled (429 / over-capacity 503) after its retries fails its whole batch query, so every package in that batch goes unchecked and is reported through the batch-failure channel above (an unresolvable PURL, or a "not configured" 503, is still skipped individually). Pinned by `tests/scan_api_retry_e2e.rs` and the core crate's `tests/api_retry_e2e.rs`.
 
 **Lockfile supplement (v3.4)**: `scan` discovery is no longer limited to installed trees. The project's lockfiles (`package-lock.json`/`npm-shrinkwrap.json`, `pnpm-lock.yaml` v9, `yarn.lock` classic + berry, `bun.lock`, `vlt-lock.json` (registry nodes, Socket-hosted pins included; vendored `file` nodes are left to the vendor ledger), `Cargo.lock`, `go.sum`, `composer.lock`, `Gemfile.lock`, `uv.lock`/`poetry.lock`/pinned `requirements.txt`) are inventoried and dependencies with NO installed copy join discovery — counts, the API lookup, the table (flagged ` [NOT INSTALLED]`, plus a stderr note), and the prune "scanned" set (a wiped node_modules no longer prunes lockfile-listed entries). JSON gains a top-level `lockfileOnlyPackages` count and an additive `notInstalled: true` on matching `packages[]` entries. `--apply` partitions lockfile-only patches out BEFORE download (calm `skipped`/`package_not_installed` records — never an error exit, never a manifest write); `--vendor` passes them through to the vendor engine's auto-fetch. Vendored-ledger entries likewise stay discoverable on a fresh clone (the committed artifact is the dependency). Global scans (`--global`) get no supplement. **Rush monorepos** (no root lockfile, `rush.json` present): the npm-lock inventory falls back to the Rush source-of-truth locks — `common/config/rush/pnpm-lock.yaml` plus every `common/config/subspaces/*/pnpm-lock.yaml` (`read_dir`-sorted, repo-relative paths preserved) — so a Rush repo's dependencies still join discovery. **Plug'n'Play layouts are an explicit refusal, not an empty inventory**: a `.pnp.*` loader means the npm packages are structurally unreachable in EVERY mode (under yarn PnP the installed-tree crawl is empty too — no `node_modules/`), so `scan` surfaces an additive top-level `warnings[]` array (`{code, detail}` objects, omitted when empty) carrying `yarn_pnp_unsupported` (same code as apply's refusal; remedy `yarn patch <pkg>`) or `pnpm_pnp_unsupported` (pnpm's `node-linker=pnp` twin; pnpm remedies), plus a stderr `Warning (<code>): …` line on the human path. Exit code and `status` are deliberately unchanged (exit 0 / `success` — the same posture as hosted refusals, which exit 0 with `redirected: 0`); the warning is the machine-readable signal that nothing was checked. Pinned by `tests/e2e_safety_yarn_pnp.rs`.
 
@@ -126,17 +133,20 @@ For a **9.0 root lock**, the CLI ensures `pnpm-workspace.yaml` carries `trustLoc
 
 **Vendored group commit (v5.0)**: `vendor`, `scan --mode vendored` and `get --mode vendored` capture every lockfile / manifest / config edit and every ledger save of the run in memory (reads inside the run see them) and commit them ONCE after the per-package loop — including the packages that succeeded in a run where others failed, so a completed run leaves the same files per-package commits would. Captured: every file under the project root outside `.socket/`, plus `.socket/vendor/state.json` and `.socket/vendor/redirect-state.json`; artifacts are written directly (see the durability note). A multi-file commit goes through a roll-forward journal, `.socket/vendor/.commit-journal.json` (the new bytes of every changed file, plus the bytes each replaces and their sha256; deleted once the commit completes). **Crash semantics**: before the journal is durable, nothing is committed — the lockfiles and ledgers are the pre-run ones and the run's artifacts are unreferenced orphans; after it, the next command that takes the apply lock replays the journal before reading anything (files already at their new bytes are left alone), so a locked command never observes a half-committed run. A journal that matches neither side of some file (edited by hand since the crash) is renamed to `.socket/vendor/.commit-journal.set-aside-<uuid>.json` (keeping every file's pre-commit bytes) and stderr says what was done (`Warning: an interrupted vendored run's commit could not be finished as written: …`): the edited files are never written over; when they all still carry the commit's own lines the rest of the commit is finished around them, when none of them does the files the crash had already replaced are put back to their pre-commit bytes, and otherwise nothing is applied. A journal that is unreadable, names a path outside the lockfiles and ledgers, or would write through a symbolic link is set aside with nothing applied. A replay that fails on I/O keeps the journal and fails the lock acquire (`lock_io`, naming the journal). Read-only commands that take no lock (`vex`, `list`) may observe the interrupted state until then. A re-vendor under a newer uuid removes the replaced uuid's dir only after the commit (its `vendor_stale_artifact_removed` event follows the run's per-package events), and a golang takeover removes the `.socket/go-patches/` copy only after the commit that repoints `go.mod`. A commit write failure is the top-level error `vendor_commit_failed` (exit 1; the pre-run lockfiles and ledger stay — unless putting back the files already replaced failed too, in which case the journal is kept and the next locked command finishes the commit). `repair`, `vendor --revert` and `rollback` still save per entry.
 
-`scan --sync` is sugar for `--apply --prune` — the canonical single-flag bot invocation. `scan --json --sync --yes` discovers, applies, and reconciles state in one pass.
+`scan --sync` is sugar for `--mode agent --prune` — the canonical single-flag agent-mode bot invocation. `scan --json --sync` discovers, applies, and reconciles state in one pass.
+
+**`scan --ecosystems` scopes the crawl (v5.0)**: without `--prune`/`--sync`, a `scan` given `--ecosystems`/`-e` runs only the named ecosystems' crawlers — everything the run counts, queries and shows (`scannedPackages`, the batch query, `packages[]`, the table, `updates[]`, `wiringLive`, the `gem_bundle_config_path_ignored` warning) was already narrowed to them, so the skipped crawls could only be filtered away. The one visible difference: `lockfileOnlyPackages` (and the human "not yet installed" note) counts only the selected ecosystems' lockfile-only entries (a skipped crawl cannot vouch for another ecosystem's uninstalled lockfile entries). A GC run (`--prune`, or `--sync`, which implies it — in every mode, hosted included) still crawls every ecosystem, because the prune judges each manifest entry against the FULL installed set (see `scan --prune` above); its output, `lockfileOnlyPackages` included, is unchanged. Without `--ecosystems` nothing changes. Pinned by `tests/scan_ecosystems_scope_e2e.rs`.
 
-**`scan --ecosystems` scopes the crawl (v5.0)**: without `--prune`/`--sync`, a `scan` given `--ecosystems`/`-e` runs only the named ecosystems' crawlers — everything the run counts, queries and shows (`scannedPackages`, the batch query, `packages[]`, the table, `updates[]`, `wiringLive`, the `gem_bundle_config_path_ignored` warning) was already narrowed to them, so the skipped crawls could only be filtered away. The one visible difference: `lockfileOnlyPackages` (and the human "not yet installed" note) counts only the selected ecosystems' lockfile-only entries — previously it also counted other ecosystems' uninstalled lockfile entries, which a skipped crawl can no longer vouch for. A GC run (`--prune`, or `--sync`, which implies it — in every mode, hosted included) still crawls every ecosystem, because the prune judges each manifest entry against the FULL installed set (see `scan --prune` above); its output, `lockfileOnlyPackages` included, is unchanged. Without `--ecosystems` nothing changes. Pinned by `tests/scan_ecosystems_scope_e2e.rs`.
+**Path-scoped scans (`scan [PATHS]...`, v5.0)**: what a PATH means depends on the mode.
 
-**Path-scoped scans (`scan [PATHS]...`, v5.0)**: optional variadic positional path globs scope DISCOVERY at the **purl level** — a package is in scope iff ANY of its crawled installed copies sits under a matching path, and a selected package is then handled with ALL its copies (scoping selects which packages are considered, never which copies). Glob semantics (shared with `rollback`'s path targets, `src/path_scope.rs`): Unix-shell globs with `require_literal_separator` — `*`/`?` never cross a `/`, `**` spans directories; a pattern matching any **ancestor** directory of the copy path also matches, so a bare `scan packages/foo` scopes the whole subtree without `/**`; relative patterns match against the copy path relativized to `--cwd`, absolute patterns against the absolute path (the ONLY way to reach paths outside the project tree, e.g. `--global` stores — a relative pattern never matches outside `--cwd`); leading `./` and trailing `/` are normalized away, matching is purely textual (no filesystem access or symlink resolution), case-sensitive except on Windows (whose filesystems are not); an unparseable or empty pattern is a usage error (exit 2). **The prune universe is never narrowed**: the path filter is applied strictly AFTER the `scanned_purls` capture (and after `--ecosystems`), so `scan PATHS --prune` prunes exactly what an unscoped `scan --prune` would — a scoped scan can never treat an out-of-scope package as uninstalled (the same fail-safe as the `--ecosystems` filter). Lockfile-only and vendor-ledger supplement records have no installed path and are EXCLUDED from a path-scoped scan, surfaced as one run-level `path_scope_excluded_supplements` warning carrying the count. A scope matching nothing is a normal empty scan — exit 0, zero packages, **no GC** (the zero-package early return fires before any GC). `PATHS` with `--mode hosted` or `--mode vendored` is a usage error (exit 2, `resolve_mode_flags`: "path targeting … applies to agent-mode and read-only scans" — their lockfile rewiring is whole-project by construction); `PATHS` with `--apply`/`--sync`/`--prune`/`--global` is fine. Every scan JSON shape (success, zero-package, and error alike) gains an additive always-present `paths` key echoing the patterns verbatim (empty array when unscoped). One-sentence duality rule: **a target that selects nothing is an error on `rollback` (exit 1) and an empty scan on `scan` (exit 0)**.
+* **Hosted and vendored mode (bare `scan` included) — project directories** (`run_project_dirs`). Each PATH is a directory, or a glob (`*?[`) matching directories, relative to `--cwd`; the set is sorted and deduplicated, and each directory is scanned on its own exactly as if it were `--cwd` (its own lockfiles, ledgers and `.socket/`). With more than one directory, each run is headed `== <dir> ==` on stdout (unless `--silent`), and the exit code is the worst of the runs. Usage errors (exit 2, stderr only, before any scan): a PATH that is not a directory (`` `X` is not a directory``), a glob matching no directory (`` `X` matches no directory``), an invalid glob, and `--json` with more than one directory (`--json takes one project directory (N given); run one scan per directory`), so stdout stays one document.
+* **Agent mode (and a mode-less `--prune`/`--global` report) — installed-path globs** scoping DISCOVERY at the **purl level**: a package is in scope iff ANY of its crawled installed copies sits under a matching path, and a selected package is then handled with ALL its copies (scoping selects which packages are considered, never which copies). Glob semantics (shared with `rollback`'s path targets, `src/path_scope.rs`): Unix-shell globs with `require_literal_separator` — `*`/`?` never cross a `/`, `**` spans directories; a pattern matching any **ancestor** directory of the copy path also matches, so a bare `scan packages/foo` scopes the whole subtree without `/**`; relative patterns match against the copy path relativized to `--cwd`, absolute patterns against the absolute path (the ONLY way to reach paths outside the project tree, e.g. `--global` stores — a relative pattern never matches outside `--cwd`); leading `./` and trailing `/` are normalized away, matching is purely textual (no filesystem access or symlink resolution), case-sensitive except on Windows (whose filesystems are not); an unparseable or empty pattern is a usage error (exit 2). **The prune universe is never narrowed**: the path filter is applied strictly AFTER the `scanned_purls` capture (and after `--ecosystems`), so `scan PATHS --prune` prunes exactly what an unscoped `scan --prune` would — a scoped scan can never treat an out-of-scope package as uninstalled (the same fail-safe as the `--ecosystems` filter). Lockfile-only and vendor-ledger supplement records have no installed path and are EXCLUDED from a path-scoped scan, surfaced as one run-level `path_scope_excluded_supplements` warning carrying the count. A scope matching nothing is a normal empty scan — exit 0, zero packages, **no GC** (the zero-package early return fires before any GC). `PATHS` combine with `--apply`/`--sync`/`--prune`/`--global`. Every scan JSON shape (success, zero-package, and error alike) carries an always-present `paths` key echoing the patterns verbatim (empty array when unscoped; a hosted/vendored per-directory run is unscoped, so it is `[]`). One-sentence duality rule: **a target that selects nothing is an error on `rollback` (exit 1) and an empty scan on an agent-mode `scan` (exit 0)**.
 
 `scan --vendor` swaps the in-place apply for the vendor pipeline: discover → download the selected patch records **into memory** (no manifest write) → vendor every selected dependency via the same engine as the `vendor` command (under the same lock). Vendored mode is **manifest-free (v5.0)**: `.socket/manifest.json` is never written or read by a vendored run; each ledger entry carries `detached: true` plus an embedded copy of the patch record (`record`) as its verification source, and the run's footprint is `.socket/vendor/**` only. The vendor step's scope is what discovery selected — the former "whole manifest is vendored" re-vendor on an empty discovery is retired (`repair` verifies and rebuilds committed vendored state; `scan --prune` reconciles ledger entries whose dependency left the lockfile). A package the ledger holds at an older patch uuid is still **re-vendored automatically** when discovery selects the newer patch (its old uuid dir is removed — `vendor_stale_artifact_removed`); same-uuid re-runs reuse the embedded record, skip the patch-view fetch, and are `already_vendored` skips. **Legacy manifest-mode entries**: when a vendored run vendors a purl that also has a `.socket/manifest.json` record (a project vendored by a pre-5.0 binary, or by standalone `vendor` from an agent-mode manifest), that manifest record is dropped in the same run — the ledger becomes the owner (migration write); an emptied manifest is left as `{"patches": {}}`, never deleted. The migration is reported through the run-level `warnings[]` (stderr in human mode), never as a run error: `vendor_manifest_record_migrated` (`N manifest records moved to the vendor ledger (vendored mode is manifest-free): <purls>`) or `vendor_manifest_migration_failed` (the manifest or the ledger could not be read or rewritten; the legacy records were left in place) — so a corrupt `.socket/manifest.json` no longer fails a vendored run (standalone `vendor`, the one manifest-driven writer, still fails closed on it). With `--prune`, GC runs **after** the vendor step (the step never reads the manifest, and running the sweep last lets it reclaim what the run itself orphaned — a migrated legacy record's blobs, a superseded uuid dir). JSON output gains a `download` sub-object — the detached download envelope `{found, downloaded, skipped, failed, detached: true, patches: [{purl, uuid, action: "downloaded" | "skipped" | "failed", …}], warnings?}` (no `applied` field — nothing is applied in place; `detached: true` is pinned and always present; a `downloaded` record whose purl the ledger already holds at another uuid carries the additive `oldUuid` — the re-vendor the vendor step then performs — and its human `[fetch]` line reads `<purl> (replacing <short uuid>)`) — and a `vendor` sub-object (a full vendor Envelope). Patch blobs are held in memory (see "Patch sources stay in memory" under the vendor contract). `--dry-run` previews per-patch `would_vendor` | `would_revendor` (+`oldUuid`) | `already_vendored` — plus, additive, `would_refuse` (+`errorCode`, `error`) for npm purls the wet run's Bun preflight (see the `get --mode vendored` bullet below) would refuse — without network downloads or disk writes; the preview never flips status or exit (the human path — `scan` and `get` alike, through one shared printer — prints `[would-refuse] <purl> (<code>): <detail>` lines behind the `--silent` gate). Interactive mode prompts "Download and vendor N patches?" (singular for one).
 
 **Vendored entries and the rest of the CLI.** Because nothing is in the manifest, vendored patches are invisible to `apply` (nothing to apply in place) but fully visible to `list` (listed from the ledger, labeled `Mode: vendored (recorded in .socket/vendor/state.json)` in human mode, exit 0 on a vendored-only project), `vex` (attested from the embedded records while a lockfile still wires the artifact — see "Manifest-less VEX"), `repair` (health-checked and rebuilt from the ledger), `scan --prune` (lockfile-driven reconcile) and `setup --check`'s patch-consistency property (consulted from the embedded records). They are exempt from standalone `vendor`'s manifest reconcile (`reconcile_dropped` never touches `detached` entries) and exit via `remove <purl>` (which reverts them), `vendor --revert`, or `rollback`, whose vendored leg reverts every in-scope ledger entry (unscoped and identifier-scoped runs; path-scoped runs reach them only when an installed copy matches). The hidden `--detached` flag (`scan --vendor --detached`) names exactly this — the only — vendored posture and is accepted as a no-op for compatibility.
 
-`scan --mode hosted` (== `--redirect`) swaps the in-place apply for the registry-redirect pipeline: discover → resolve hosted-patch references (grant token + integrity + per-dep registry override) → rewrite ONLY the patched dependencies' lockfile / registry-config entries to point at the hosted packages. A dep counts as **redirected** only when its hosted-artifact URL (or per-dep registry index URL) actually landed in a project file — a granted reference whose rewriter found nothing to edit is neither recorded nor attested. Cargo and golang are confirmed only by their rewriter's own report (`confirmed_cargo_uuids` / `confirmed_golang_uuids`): a golang dep counts only when its go.mod `replace M V => patch.socket.dev/gopatch/<uuid> <sver>` and both go.sum lines are in place, never because the patch-server origin or leftover go.sum lines appear somewhere. A golang module that go.mod does not require and go.sum does not list at the patched version is outside the build graph and is refused with `redirect_golang_not_in_module_graph` (nothing written). Only the exact module `patch.socket.dev/gopatch/<canonical uuid>` is socket-owned; any other module path is refused with `redirect_golang_untrusted_module_path`. A vendored golang module is taken over like cargo and the npm family: its vendor wiring, committed copy and ledger entry are reverted first (`redirect_takeover_reverted_vendored`). Re-runs over already-rewritten output record zero new edits. **Lock (v5.0)**: the hosted engine acquires `<.socket>/apply.lock` around its first wet write (the takeover pre-reverts) — not on `--dry-run`, and not when the run would write nothing (zero redirects, all skipped) — so previews and no-op runs never create `.socket/` (and never quarantine: a `--dry-run` or a zero-grant wet run that finds a malformed `redirect-state.json` reports it as the hard error it is — exit 1, the repair-or-move-aside remedy — but moves nothing; only a run holding the lock moves it aside to `redirect-state.json.corrupt`); contention is `lock_held` and a lock-file I/O fault (a read-only project root, a file squatting on `.socket/`) is `lock_io` — both exit 1, refused BEFORE the redirect ledger is read or written, and rendered like every other lock holder: human `Error (<code>): <message>` on stderr (+ the `--lock-timeout` hint for a live holder); JSON keeps the hosted shape — top-level `status: "error"`, `errorCode: "lock_held" | "lock_io"`, a string `error`, and `redirect: {mode: "hosted"}` retained (NOT the vendored `error: {code, message}` object). **Takeover symlink pre-check (v5.0)**: a vendored→hosted takeover whose recorded wiring file is a symlink is refused up front with `redirect_symlinked_file_unsupported` — wet and `--dry-run` alike, before any revert — so "nothing was written" holds. **Human mode (v5.0)**: `scan --mode hosted` prints the results table and update detection like the other modes and confirms once — `Redirect N packages to the hosted patch server?` (singular for one), default yes, skipped by `--yes`/`--json`, on `--dry-run` (the engine honors the preview itself; nothing mutates), and when the detail fetch leaves nothing to redirect (that run enters the engine as a no-op — `Redirected 0 packages; rewrote 0 files.`, no lock, no `.socket/` — without prompting); without `--yes` on a non-TTY stdin the shared prompt prints `Non-interactive mode detected, proceeding automatically.` to stderr (unless `--silent`) and proceeds — before rewriting anything (parity with the agent/vendored arms and with `get --mode hosted`). The detail fetch prints the same progress counter and per-package `Warning: could not fetch details for …` lines as the agent arm. An EMPTY hosted discovery prints `No patches available for installed packages.` and exits 0 without entering the engine (previously `Redirected 0 packages; rewrote 0 files.`); a discovery whose every offer is paid-tier for an org without paid access prints the table's paid nudge, then `No downloadable patches (paid subscription required).`, and exits 0 without entering the engine (parity with the agent/vendored arms). A malformed redirect ledger on a human hosted run that returns before the engine (empty discovery, nothing downloadable, a detail-fetch failure, a declined confirm) is surfaced there as the read-only `Warning: the redirect ledger … is malformed …` advisory (muted by `--silent`), never moved; the `--json` arm always enters the engine and hard-errors instead. JSON output gains a `redirect` sub-object: `{ mode: "hosted", redirected, rewrittenFiles, skipped, warnings, dryRun }` (`mode` is additive so consumers can dispatch without inferring it). Rewriter warnings carry stable `redirect_*` codes (e.g. `redirect_npm_no_lockfile`, `redirect_gradle_manual_snippet`, `redirect_golang_unsupported`); new codes are additive (MINOR). v5.0 additive codes: `redirect_composer_no_lockfile` / `redirect_gem_no_gemfile` (composer / gem: neither manifest nor lock present — once per run, after the intake gates), `redirect_maven_no_pom` (no `pom.xml` and no Gradle build), `redirect_nuget_lock_unparseable` (a present-but-corrupt `packages.lock.json` — warned once, nothing mutated; an absent lock still proceeds), `redirect_cargo_lock_pkg_ambiguous` (several same-name+version `[[package]]` blocks and none carries the index `source` — transactional skip). Also v5.0: a registry override of the wrong kind (or none at all) warns the arm's missing-override code for nuget/gem/golang where it used to skip silently, and the ledger's `redirect_nuget_source` edit records `action: "added"` when `nuget.config` was authored from scratch (`rewritten` otherwise). Refusals stay fail-closed with a diagnosis that names the actual cause: a yarn-berry lock entry resolving through a non-`npm:` protocol keeps `redirect_yarn_berry_unsupported_protocol` with the entry's ACTUAL protocol in the detail — except socket-patch's OWN vendored wiring (a `file:` range into `.socket/vendor/`), which gets the distinct `redirect_yarn_berry_vendored_entry` code whose detail names the retirement path (`remove <purl>` per package, or `vendor --revert` which unwinds every vendored package, then re-run `scan --mode hosted`). Both leave the entry byte-identical; neither changes exit code or status. **yarn berry line endings (v5.0)**: yarn writes a NEW `yarn.lock` with the OS line ending (`os.EOL` — CRLF on Windows) and keeps an existing lock's majority ending on every later write, and a `core.autocrlf` checkout turns an LF lock CRLF on any OS — so a uniformly CRLF lock is rewritten in its own ending: every untouched byte (a leading BOM included) round-trips, and the `redirect_yarn_berry_entry` ledger edits record the lock's ON-DISK (CRLF) fragments, which the reverts match byte-exactly. A lock that MIXES CRLF and LF (or holds a bare CR) has no single ending to keep — yarn's own `--immutable` check rejects it too (YN0028) — so it is refused untouched with `redirect_yarn_berry_mixed_line_endings` (the detail names `yarn install`, which normalizes it). This replaces v4's `redirect_yarn_berry_crlf_unsupported`, which refused every CRLF lock and is no longer emitted. A vendored→hosted takeover runs these berry gates (mixed line endings, unsupported `cacheKey`, a non-zero `.yarnrc.yml` `compressionLevel`) BEFORE reverting a vendored berry purl — wet and `--dry-run` alike — so a refused purl keeps its vendored wiring, ledger entry and artifact byte-identical and is skipped with the gate's code (never announced as `redirect_takeover_reverted_vendored` and then left unpatched in both modes).
+`scan --mode hosted` (== `--redirect`) swaps the in-place apply for the registry-redirect pipeline: discover → resolve hosted-patch references (grant token + integrity + per-dep registry override) → rewrite ONLY the patched dependencies' lockfile / registry-config entries to point at the hosted packages. A dep counts as **redirected** only when its hosted-artifact URL (or per-dep registry index URL) actually landed in a project file — a granted reference whose rewriter found nothing to edit is neither recorded nor attested. Cargo and golang are confirmed only by their rewriter's own report (`confirmed_cargo_uuids` / `confirmed_golang_uuids`): a golang dep counts only when its go.mod `replace M V => patch.socket.dev/gopatch/<uuid> <sver>` and both go.sum lines are in place, never because the patch-server origin or leftover go.sum lines appear somewhere. A golang module that go.mod does not require and go.sum does not list at the patched version is outside the build graph and is refused with `redirect_golang_not_in_module_graph` (nothing written). Only the exact module `patch.socket.dev/gopatch/<canonical uuid>` is socket-owned; any other module path is refused with `redirect_golang_untrusted_module_path`. A vendored golang module is taken over like cargo and the npm family: its vendor wiring, committed copy and ledger entry are reverted first (`redirect_takeover_reverted_vendored`). Re-runs over already-rewritten output record zero new edits. **Lock (v5.0)**: the hosted engine acquires `<.socket>/apply.lock` around its first wet write (the takeover pre-reverts) — not on `--dry-run`, and not when the run would write nothing (zero redirects, all skipped) — so previews and no-op runs never create `.socket/` (and never quarantine: a `--dry-run` or a zero-grant wet run that finds a malformed `redirect-state.json` reports it as the hard error it is — exit 1, the repair-or-move-aside remedy — but moves nothing; only a run holding the lock moves it aside to `redirect-state.json.corrupt`); contention is `lock_held` and a lock-file I/O fault (a read-only project root, a file squatting on `.socket/`) is `lock_io` — both exit 1, refused BEFORE the redirect ledger is read or written, and rendered like every other lock holder: human `Error (<code>): <message>` on stderr (+ the `--lock-timeout` hint for a live holder); JSON keeps the hosted shape — top-level `status: "error"`, `errorCode: "lock_held" | "lock_io"`, a string `error`, and `redirect: {mode: "hosted"}` retained (NOT the vendored `error: {code, message}` object). **Takeover symlink pre-check (v5.0)**: a vendored→hosted takeover whose recorded wiring file is a symlink is refused up front with `redirect_symlinked_file_unsupported` — wet and `--dry-run` alike, before any revert — so "nothing was written" holds. **Human mode (v5.0)**: hosted `scan` prints the results table and update detection like the other modes, then rewrites without a prompt (scan never prompts); `--dry-run` previews through the engine, and a detail fetch that leaves nothing to redirect enters the engine as a no-op (`Redirected 0 packages; rewrote 0 files.`, no lock, no `.socket/`). The detail fetch prints the same progress counter and per-package `Warning: could not fetch details for …` lines as the agent arm. An EMPTY hosted discovery prints `No patches available for installed packages.` and exits 0 without entering the engine; a discovery whose every offer is paid-tier for an org without paid access prints the table's paid nudge, then `No downloadable patches (paid subscription required).`, and exits 0 without entering the engine (parity with the agent/vendored arms). A malformed redirect ledger on a human hosted run that returns before the engine (empty discovery, nothing downloadable, a detail-fetch failure) is surfaced there as the read-only `Warning: the redirect ledger … is malformed …` advisory (muted by `--silent`), never moved; the `--json` arm always enters the engine and hard-errors instead. JSON output gains a `redirect` sub-object: `{ mode: "hosted", redirected, rewrittenFiles, skipped, warnings, dryRun }` (`mode` is additive so consumers can dispatch without inferring it). Rewriter warnings carry stable `redirect_*` codes (e.g. `redirect_npm_no_lockfile`, `redirect_gradle_manual_snippet`, `redirect_golang_unsupported`); new codes are additive (MINOR). v5.0 additive codes: `redirect_composer_no_lockfile` / `redirect_gem_no_gemfile` (composer / gem: neither manifest nor lock present — once per run, after the intake gates), `redirect_maven_no_pom` (no `pom.xml` and no Gradle build), `redirect_nuget_lock_unparseable` (a present-but-corrupt `packages.lock.json` — warned once, nothing mutated; an absent lock still proceeds), `redirect_cargo_lock_pkg_ambiguous` (several same-name+version `[[package]]` blocks and none carries the index `source` — transactional skip). Also v5.0: a registry override of the wrong kind (or none at all) warns the arm's missing-override code for nuget/gem/golang, and the ledger's `redirect_nuget_source` edit records `action: "added"` when `nuget.config` was authored from scratch (`rewritten` otherwise). Refusals stay fail-closed with a diagnosis that names the actual cause: a yarn-berry lock entry resolving through a non-`npm:` protocol keeps `redirect_yarn_berry_unsupported_protocol` with the entry's ACTUAL protocol in the detail — except socket-patch's OWN vendored wiring (a `file:` range into `.socket/vendor/`), which gets the distinct `redirect_yarn_berry_vendored_entry` code whose detail names the retirement path (`remove <purl>` per package, or `vendor --revert` which unwinds every vendored package, then re-run `scan --mode hosted`). Both leave the entry byte-identical; neither changes exit code or status. **yarn berry line endings (v5.0)**: yarn writes a NEW `yarn.lock` with the OS line ending (`os.EOL` — CRLF on Windows) and keeps an existing lock's majority ending on every later write, and a `core.autocrlf` checkout turns an LF lock CRLF on any OS — so a uniformly CRLF lock is rewritten in its own ending: every untouched byte (a leading BOM included) round-trips, and the `redirect_yarn_berry_entry` ledger edits record the lock's ON-DISK (CRLF) fragments, which the reverts match byte-exactly. A lock that MIXES CRLF and LF (or holds a bare CR) has no single ending to keep — yarn's own `--immutable` check rejects it too (YN0028) — so it is refused untouched with `redirect_yarn_berry_mixed_line_endings` (the detail names `yarn install`, which normalizes it). This replaces v4's `redirect_yarn_berry_crlf_unsupported`, which refused every CRLF lock and is no longer emitted. A vendored→hosted takeover runs these berry gates (mixed line endings, unsupported `cacheKey`, a non-zero `.yarnrc.yml` `compressionLevel`) BEFORE reverting a vendored berry purl — wet and `--dry-run` alike — so a refused purl keeps its vendored wiring, ledger entry and artifact byte-identical and is skipped with the gate's code (never announced as `redirect_takeover_reverted_vendored` and then left unpatched in both modes).
 
 The rewriter reads a fixed set of candidate files from the project root: the npm-family locks (`package-lock.json`, `npm-shrinkwrap.json`, `pnpm-lock.yaml`, `shrinkwrap.yaml`, `yarn.lock`, plus `.yarnrc.yml` for the berry cache-config gate, `bun.lock` / `bun.lockb`, and `vlt-lock.json` with `vlt.json` and `node_modules/.vlt-lock.json` read only), `requirements.txt` / `uv.lock` / `Pipfile.lock` (pipfile-spec 6; see the Pipenv section below) / `poetry.lock` (every Poetry lock generation from 1.0 on — the 0.12 `[metadata.hashes]` layout is refused because that installer ignores URL sources; a Poetry < 1.4 writer additionally gets `redirect_poetry_stale_install_risk`, see `docs/testing/poetry-compatibility.md`) / `pdm.lock` (PDM lock formats `2` and `4.3`–`4.5.1`; the identity-losing `3.1` / `4.0`–`4.2` formats and unknown future formats are refused with `redirect_pdm_refused`, and a lock-format-`2` writer additionally gets `redirect_pdm_legacy_sync_required`, see `docs/testing/pdm-compatibility.md`; when `uv.lock` or `poetry.lock` sits beside it they drive and `pdm.lock` is left alone), `Cargo.toml` / `Cargo.lock` / `.cargo/config.toml` (plus the legacy extensionless `.cargo/config` — cargo reads that spelling in preference when both exist, so the managed `[registries.…]` block is written into whichever one is present; **cargo also reads every workspace-member manifest** — the `[workspace] members` globs minus `exclude` — and every in-root path-dependency manifest, recursively, reached without crossing a symbolic link and never under `.socket/`, and pins the crate in each one that declares it, so those `<dir>/Cargo.toml` files can appear in `rewrittenFiles`. A crate is redirected only when every declaration pins and every other `Cargo.lock` package depending on it is a planned member: one a registry or git crate — or a path package outside the root or behind a link — also depends on is refused `redirect_cargo_transitive_dependents` (a pin reaches only the declarations it sits on), a crate no manifest declares keeps `redirect_cargo_toml_dep_not_found` with a transitive-only detail naming `--mode vendored`, a crate every declaration of which requires another version (no requirement accepts the patched version) is refused `redirect_cargo_toml_dep_unrewritable`, and so is a requirement that also matches another locked version of the crate — each a transactional skip, never recorded or attested. With NO `Cargo.lock` there is no resolved graph to ask, so the dependents question is answered from the manifests instead: a crate declared beside any other dependency — anything but a path dependency on a manifest this run also pins, or a `workspace = true` inheritor of a table it scans — or beside a workspace member this run did not read (a `members` glob, or a member outside the project or behind a symbolic link, which member discovery drops) is refused `redirect_cargo_lockless_dependents`, whose detail names the remedies (commit a lockfile, or `--mode vendored`); a project whose only dependency is the patched crate has nothing that could pull it in and still redirects. All-CRLF manifests, locks and configs are rewritten with CRLF kept (mixed endings keep refusing where the grammar does not match), and `remove` / rollback match the recorded fragments across a later CRLF↔LF checkout conversion), `composer.lock`, `nuget.config` / `packages.lock.json`, `Gemfile` / `Gemfile.lock`, `pom.xml` (+ `.mvn/maven.config` / `.mvn/checksums/checksums.sha256` for maven Trusted Checksums merge, and the Gradle build scripts read only to trigger the manual-snippet warning). **npm-family flavor coverage**: package-lock / npm-shrinkwrap, pnpm (root OR any nested `*/pnpm-lock.yaml`), yarn classic, **yarn berry** (`yarn.lock` entry only — `resolution: ::__archiveUrl=` + `yarnBerry10c0` checksum; cacheKey `10c0` and `.yarnrc.yml compressionLevel 0` gated by `redirect_yarn_berry_cache_unsupported`), and **bun** (text `bun.lock` lockfileVersion 0, 1 or 2 — 0 is the `--save-text-lockfile` opt-in lock of Bun 1.1.39–1.1.45, 1 the 1.2–1.3 default, 2 the 1.4+ default; all three emit one `packages` grammar, so the registry 4-tuple → URL 3-tuple rewrite is version-independent and the lock's own version line is kept. Any other or missing version, or a `packages` section outside bun's single-line grammar, is refused `redirect_bun_lock_unsupported` — the detail is the shared version gate's text (a newer version: update socket-patch, re-locking would reproduce it; no integer: re-lock with Bun ≥ 1.2), identical to the vendored refusal. A version-0 lock holding `workspace:` packages is refused `redirect_bun_workspace_unsupported` (its 2-tuple workspace grammar cannot keep the hosted tuple through a frozen install); the remedy is to delete `bun.lock` and re-run `bun install` with Bun ≥ 1.2, which writes lockfileVersion 1 (accepted). A plain in-place `bun install` bumps the version only when a workspace depends on another workspace (e.g. root → member — the shape the matrix measured); otherwise Bun 1.2.0 keeps version 0 and Bun 1.2.23+ fail to resolve, so the in-place bump is not the documented remedy. Bun lock version, grammar and workspace compatibility are checked before a vendored takeover, including during dry-run: these refusals preserve the existing lock, artifact and vendor ledger. Version-1 and version-2 workspace locks are rewritten, nested versions included. A granted dep with no rewritable entry warns `redirect_bun_entry_not_found`, a grant without a sha512 `redirect_bun_missing_sha512`; a CRLF lock keeps `\r\n` on the rewritten line, and a hosted URL left by an earlier grant of the same `name@version` is re-pinned in place. **Digest-less re-saves (Bun 1.1.39–1.3.9)**: every text-lock Bun below 1.3.10 re-saves a URL tuple WITHOUT its `sha512` whenever the lock is re-saved for another reason (`bun add`, `bun install` after a package.json or workspace change), leaving the 2-tuple `["name@<url>", {meta}]` — the spec Bun installs from is intact. The CLI treats that spelling as its own wiring: a repeat hosted run counts the dep as redirected (no `redirect_bun_entry_not_found`) and HEALS the line back to the 3-tuple with the current `sha512`, recording the heal as a further `redirect_bun_lock_package` edit whose `original` is the 2-tuple (a stale URL is re-pinned from either spelling); `rollback`, scoped `rollback <purl>` / `remove <purl>` and the vendored takeover accept the digest-less spelling of a recorded `new` line (same key, spec and meta, only the trailing `"sha512-…"` missing) and restore the recorded original over it, so the chain always unwinds to the pristine registry line. Anything else — another uuid/token, another version, a re-laid meta object — is still drift. **Native `bun.lockb`**: when no text `bun.lock` exists, binary format versions 1, 2 and 3 are read and rewritten directly. Socket Patch does not invoke Bun or convert the project to a text lockfile. Exact matching package records are rewritten to hosted tarballs with the granted integrity, preserving dependency resolution IDs, workspace/dependency topology and unrelated package metadata; binary pointers and the package metadata hash are updated. Per-package `redirect_bun_lockb_package` snapshots support scoped rollback, repeat runs, superseding grants and hosted ↔ vendored takeover. A regular binary lock is discoverable even with no Bun runtime or `node_modules`; a dry run previews the same binary edits without writing them. A malformed, unreadable, unsupported or unverified binary structure is `redirect_bun_lockb_invalid` (exit 0, `redirected: 0`), and it refuses the npm rewrite before any takeover or sibling npm-family lock mutation. A symlinked binary write target is `redirect_symlinked_file_unsupported` (exit 1, including dry-run). `bun.lock` wins when both spellings exist. Binary-only projects do not receive `redirect_npm_no_lockfile`. Measured boundaries and the real-Bun matrix: `docs/testing/bun-compatibility.md`), and **vlt** (`vlt-lock.json` without `lockfileVersion`, `0` or `1`; see the vlt hosted-mode contract below). **Rush monorepos**: when `rush.json` is present the rewriter also reads `common/config/rush/pnpm-lock.yaml` and each `common/config/subspaces/<name>/pnpm-lock.yaml` (sorted for determinism) under their repo-relative keys and repoints them in place; editing them emits `redirect_rush_repo_state_stale` when `common/config/rush/repo-state.json` exists (the `pnpmShrinkwrapHash` desync is refreshed by `rush update`, which the redirect survives). **maven** is fail-closed via version suffixing: a `mavenSuffixedVersion` + `mavenPomSha256` override pins the Socket-only `<version>-socket.<hex8>` by rewriting the literal `<version>` (`redirect_maven_dep_version`) or adding a `<dependencyManagement>` entry (`redirect_maven_dep_management_added`), plus optional Trusted Checksums (`redirect_maven_trusted_checksums`, conflicts as `redirect_maven_trusted_checksums_conflict`); a `${property}` version is refused (`redirect_maven_dep_unpinned`), a non-matching literal skipped (`redirect_maven_dep_version_mismatch`), and an override without a suffixed version falls back to same-GAV repository injection (`redirect_maven_same_gav_fallback`, NOT fail-closed).
 
@@ -149,16 +159,16 @@ The rewriter reads a fixed set of candidate files from the project root: the npm
 * `.socket/vendor/state.json` — the **vendored**-mode ledger (see "Ownership, state, and reversal" below): wiring edits with verbatim pre-vendor originals, artifact fingerprints, and the embedded patch `record` — for every entry written by `scan`/`get --mode vendored` beside `detached: true` (the record is that entry's only source), and for standalone `vendor` fed by an agent-mode manifest as a fallback copy without `detached` (the manifest record stays authoritative while the manifest covers the entry, by ledger key or base purl; `vex`, `list` and `setup --check` fall back to the embedded copy when it does not, `repair` only with no manifest at all). Entries written before 5.0 by standalone `vendor` carry no `record`; readers tolerate its absence. **Schema version 2 (v5.0)**: the `new` of a whole-file wiring record (kinds `maven_pom_repository`, `nuget_config_source`, `python_lock_document`, `python_script_metadata`, `hatch_document`) of 1 KiB or more, when its `original` is a string, is stored as an edit of that same record's `original`: `{"snapshot": "<sha256 of the text>", "ops": [[start, len] | "inserted text", …]}` (the text is the ops concatenated in order: a `[start, len]` byte range copied from the `original`, a string inserted as is), and the ledger's `version` is `2`; the `original` stays a plain string, no other record kind is touched, and a ledger without such a record keeps the version-1 bytes. Both versions are read; a version-2 edit is rebuilt and checked against its hash (a mismatch, a missing `original`, an out-of-range copy, or any other `{"snapshot": …}` value is `vendor_state_unreadable`), so every consumer sees the same full texts as with an inline version-1 ledger. Records are self-contained, so an older socket-patch re-saving a version-2 ledger (it keeps `original` / `new` verbatim and drops unknown fields) loses nothing.
 * `.socket/vendor/redirect-state.json` — the **hosted**-mode ledger (`RedirectState` in `socket-patch-core/src/patch/redirect/state.rs`): `{ version, mode: "hosted", edits[], records{} }`. `edits` are recorded `FileEdit`s (append-only across re-runs — merge, never clobber: the pre-redirect originals a future revert needs live here; v5.0: a byte-identical re-save is skipped, which still satisfies the rule); `records` maps PURL → the full manifest `PatchRecord`, one of `vex`'s record sources for redirected patches with no manifest entry (a record attests only while a lockfile still wires its hosted patch — see "Manifest-less VEX" below). The `mode` string is opaque to the loader (pre-rename ledgers carrying `"redirect"` still load; a hosted re-run normalizes them to `"hosted"`). Written identically by this CLI and by the depscan backend's hosted PR flow (`github-patch-pr-hosted.ts`).
 
-**get --mode and installed narrowing (v3.6).** `get <identifier> --mode hosted|vendored` consumes the resolved patch(es) through the SAME engines as `scan --mode hosted|vendored`, so for the same selected (purl, uuid) set the on-disk result is identical by construction — this is the per-advisory selector hosted/vendored previously lacked (the old workaround, `get <id> --save-only` then `vendor`, still works but is superseded). **Agent mode (v5.0 lock + residue rules)**: the download phase runs under `<.socket>/apply.lock` and hands the guard to the nested apply, so download → manifest write → apply is one lock window (the nested apply never re-acquires and inherits every caller flag — `--lock-timeout` and `--verbose` included); a failed acquire is `{status: "error", errorCode: "lock_held" | "lock_io", error}` on get's legacy envelope, exit 1, before any fetch (a read-only `.socket/` fails here, naming the lock path). `.socket/` and `.socket/blobs/` are created only when a record is actually persisted — an all-skipped or all-failed run leaves no `.socket/` on a fresh project — and a same-uuid `get <uuid>` re-run rewrites neither the manifest nor the blobs. Semantics:
+**get --mode and installed narrowing (v3.6).** `get <identifier> --mode hosted|vendored` consumes the resolved patch(es) through the SAME engines as `scan --mode hosted|vendored`, so for the same selected (purl, uuid) set the on-disk result is identical by construction — the per-advisory selector for hosted/vendored (`get <id> --save-only` then `vendor` still works). **Agent mode (v5.0 lock + residue rules)**: the download phase runs under `<.socket>/apply.lock` and hands the guard to the nested apply, so download → manifest write → apply is one lock window (the nested apply never re-acquires and inherits every caller flag — `--lock-timeout` and `--verbose` included); a failed acquire is `{status: "error", errorCode: "lock_held" | "lock_io", error}` on get's legacy envelope, exit 1, before any fetch (a read-only `.socket/` fails here, naming the lock path). `.socket/` and `.socket/blobs/` are created only when a record is actually persisted — an all-skipped or all-failed run leaves no `.socket/` on a fresh project — and a same-uuid `get <uuid>` re-run rewrites neither the manifest nor the blobs. Semantics:
 
-* **Hosted** (`get GHSA-… --mode hosted`): resolves the advisory, then hands the selected (purl, uuid) pairs to scan's hosted engine — reference grants, cross-mode takeover pre-revert, lockfile rewrite, `redirect-state.json` ledger (merge-never-clobber), gem stale-install probe, warnings, confirmation rules (cargo via `confirmed_cargo_uuids`, golang via `confirmed_golang_uuids` only) all identical to `scan --mode hosted`, and (v5.0) under the same `apply.lock` acquisition — taken around the first wet write, never on `--dry-run` or when nothing would be written; a failed acquire folds as top-level `errorCode: "lock_held" | "lock_io"` + string `error` (exit 1), and `--dry-run` under a held lock still exits 0. **No manifest write, no blobs** — the ledger is the persistence. JSON: get's legacy envelope gains the same nested `redirect` sub-object as scan's (`{mode:"hosted", redirected, rewrittenFiles, skipped, warnings, dryRun}`); the top-level shape is `{status, found, patches:[<narrowing skips>], warnings?}` — `downloaded`/`applied` are absent (nothing is downloaded into `.socket/`). Exit codes follow scan's hosted semantics: skipped grants and rewriter warnings never flip the exit; infra errors (reference fetch, corrupt/unwritable ledger, file writes) exit 1. Human prompt: `Redirect N packages to the hosted patch server?` (singular for one; get keeps its confirm gate, `--yes`/`--json`/non-TTY auto-accept as usual; as of v5.0 human `scan --mode hosted` prompts too — see the hosted section above).
-* **Vendored** (`get GHSA-… --mode vendored`): the download phase is scan's vendored posture — **manifest-free (v5.0)**: the selected records are fetched into memory (`download_patch_records`; blobs held in memory; nothing under `.socket/` is written; the nested apply never runs), then scan's vendor step runs under the apply lock over exactly the selected records, like `scan --mode vendored` (no whole-manifest scope and no `[note]` about other records — that blast radius is retired with the manifest; a legacy manifest record for a vendored purl is migrated out of `.socket/manifest.json` the same way scan does it). JSON: get's envelope takes the detached download envelope's shape — `{status, found, downloaded, skipped, failed, detached: true, patches: [{purl, uuid, action: "downloaded" | "skipped" | "failed", …}], warnings?}` (`applied` is absent; `detached: true` is pinned; a `downloaded` record for a purl the vendor ledger holds at another uuid carries the additive `oldUuid`, derived from the ledger — the human `[fetch]` line reads `<purl> (replacing <short uuid>)`) — and gains the nested `vendor` Envelope exactly like scan's `result["vendor"]`; a vendor-step error folds the partial envelope + `{status:"error", error:{code,message}}` in (a pre-failure takeover reconcile may have already mutated the ledger — its events must reach the consumer). Exit: download failures or vendor `has_errors` → `partial_failure`/1. Human prompt: `Download and vendor N patches?`; `--dry-run` prints `[dry-run] Would download and vendor N patches. No changes made.` on both identifier paths (uuid and search). Telemetry mirrors scan's vendored arms (`track_outcomes_for_vendor` / `track_patch_vendor_failed`). **Bun vendored preflight (additive)** — shared by `get --mode vendored` on both its paths and `scan --mode vendored`: before ANY patch download, and only when the selection holds a `pkg:npm/` purl, the download phase reads `bun.lock`/`bun.lockb` once (`preflight_vendor`) and, when the vendor backend would refuse the project — a malformed, unreadable or unsupported `bun.lockb` → `vendor_bun_lockb_invalid`; an unreadable `bun.lock` → `vendor_lockfile_missing`; a `lockfileVersion` other than 0/1/2 or a non-canonical `packages` grammar → `vendor_lockfile_version_unsupported`; `workspace:` packages in a lock below version 2 → `vendor_bun_workspace_unsupported` — every `pkg:npm/` result becomes `{action:"failed", errorCode:<code>, error:<detail>}` with NO fetch (the patch view is never requested) and no patch record; other ecosystems' results are untouched. **Search path** (`get <purl|advisory> --mode vendored`) and `scan --mode vendored`: the records ride `patches[]` / `download.patches[]` with `downloaded: 0`, the download phase writes nothing under `.socket/` (v5.0 — a pre-existing `.socket/manifest.json`, including a record seeded for another purl, is left byte-untouched; previously the run re-serialized the manifest), the vendor step still runs over the remaining records (no event for the refused purl), exit `partial_failure`/1. **uuid path** (`get <uuid> --mode vendored`): the uuid lookup is the only fetch; the run exits 1 BEFORE the vendor step with exactly `{status:"error", found:1, downloaded:0, skipped:0, failed:1, error:{code, message}, patches:[{purl, uuid, action:"failed", errorCode, error}]}` (the `error` OBJECT is the vendored-mode error shape of the vendor-step fold-in above) and writes nothing — no `.socket/` on a fresh project; human mode prints `Error (<code>): <detail>` on stderr. **Already-vendored exemption**: a purl is exempt from the workspace refusal only when every instance of its `name@version` in `bun.lock` is already a `.socket/vendor/npm/…` local tuple (any uuid; the digest-less 2-tuple counts) — the engine's own criterion — so in-sync re-runs, `repair`, and a superseding patch uuid on a project vendored before it grew a workspace member all flow to the engine (re-pinning an already-local tuple adds no workspace-relative exposure); a wiped ledger alone is not a refusal (the engine path decides). UUID equality in the ledger alone never exempts a purl: `rollback --preserve-state` retains its record after unwiring. Dry-run refusal takes priority over `already_vendored`. **Unreadable vendor ledger**: a `.socket/vendor/state.json` the preflight cannot read or parse is itself the refusal — `vendor_state_unreadable` with the io/parse detail, fail-closed (nothing is exempt) — on the uuid path, the search / `scan` path and the `--dry-run` preview alike; never a Bun lock code. **`--silent`** is "errors only" and never mutes the refusal: the code-tagged `[error] <purl> (<code>): <detail>` (per-patch paths) / `Error (<code>): …` (uuid path) line stays on stderr with an empty stdout. **`--dry-run`** previews the refusal as the additive `would_refuse` action (see `--dry-run` below). Agent-mode `get --save-only` is NOT preflighted (record-only intent has no consumption precondition). Pinned by `tests/in_process_vendor_bun.rs` (exact uuid-path envelope, seeded-manifest survival, `--silent`, `--dry-run`) and `tests/scan_vendor_e2e.rs`.
+* **Hosted** (`get GHSA-… --mode hosted`): resolves the advisory, then hands the selected (purl, uuid) pairs to scan's hosted engine — reference grants, cross-mode takeover pre-revert, lockfile rewrite, `redirect-state.json` ledger (merge-never-clobber), gem stale-install probe, warnings, confirmation rules (cargo via `confirmed_cargo_uuids`, golang via `confirmed_golang_uuids` only) all identical to `scan --mode hosted`, and (v5.0) under the same `apply.lock` acquisition — taken around the first wet write, never on `--dry-run` or when nothing would be written; a failed acquire folds as top-level `errorCode: "lock_held" | "lock_io"` + string `error` (exit 1), and `--dry-run` under a held lock still exits 0. **No manifest write, no blobs** — the ledger is the persistence. JSON: get's legacy envelope gains the same nested `redirect` sub-object as scan's (`{mode:"hosted", redirected, rewrittenFiles, skipped, warnings, dryRun}`); the top-level shape is `{status, found, patches:[<narrowing skips>], warnings?}` — `downloaded`/`applied` are absent (nothing is downloaded into `.socket/`). Exit codes follow scan's hosted semantics: skipped grants and rewriter warnings never flip the exit; infra errors (reference fetch, corrupt/unwritable ledger, file writes) exit 1. Human prompt: `Redirect N packages to the hosted patch server?` (singular for one; `--yes`/`--json`/non-TTY auto-accept as usual). This confirm is get's alone: `scan` never prompts.
+* **Vendored** (`get GHSA-… --mode vendored`): the download phase is scan's vendored posture — **manifest-free (v5.0)**: the selected records are fetched into memory (`download_patch_records`; blobs held in memory; nothing under `.socket/` is written; the nested apply never runs), then scan's vendor step runs under the apply lock over exactly the selected records, like `scan --mode vendored` (no whole-manifest scope and no `[note]` about other records — that blast radius is retired with the manifest; a legacy manifest record for a vendored purl is migrated out of `.socket/manifest.json` the same way scan does it). JSON: get's envelope takes the detached download envelope's shape — `{status, found, downloaded, skipped, failed, detached: true, patches: [{purl, uuid, action: "downloaded" | "skipped" | "failed", …}], warnings?}` (`applied` is absent; `detached: true` is pinned; a `downloaded` record for a purl the vendor ledger holds at another uuid carries the additive `oldUuid`, derived from the ledger — the human `[fetch]` line reads `<purl> (replacing <short uuid>)`) — and gains the nested `vendor` Envelope exactly like scan's `result["vendor"]`; a vendor-step error folds the partial envelope + `{status:"error", error:{code,message}}` in (a pre-failure takeover reconcile may have already mutated the ledger — its events must reach the consumer). Exit: download failures or vendor `has_errors` → `partial_failure`/1. Human prompt: `Download and vendor N patches?`; `--dry-run` prints `[dry-run] Would download and vendor N patches. No changes made.` on both identifier paths (uuid and search). Telemetry mirrors scan's vendored arms (`track_outcomes_for_vendor` / `track_patch_vendor_failed`). **Bun vendored preflight (additive)** — shared by `get --mode vendored` on both its paths and `scan --mode vendored`: before ANY patch download, and only when the selection holds a `pkg:npm/` purl, the download phase reads `bun.lock`/`bun.lockb` once (`preflight_vendor`) and, when the vendor backend would refuse the project — a malformed, unreadable or unsupported `bun.lockb` → `vendor_bun_lockb_invalid`; an unreadable `bun.lock` → `vendor_lockfile_missing`; a `lockfileVersion` other than 0/1/2 or a non-canonical `packages` grammar → `vendor_lockfile_version_unsupported`; `workspace:` packages in a lock below version 2 → `vendor_bun_workspace_unsupported` — every `pkg:npm/` result becomes `{action:"failed", errorCode:<code>, error:<detail>}` with NO fetch (the patch view is never requested) and no patch record; other ecosystems' results are untouched. **Search path** (`get <purl|advisory> --mode vendored`) and `scan --mode vendored`: the records ride `patches[]` / `download.patches[]` with `downloaded: 0`, the download phase writes nothing under `.socket/` (v5.0 — a pre-existing `.socket/manifest.json`, including a record seeded for another purl, is left byte-untouched), the vendor step still runs over the remaining records (no event for the refused purl), exit `partial_failure`/1. **uuid path** (`get <uuid> --mode vendored`): the uuid lookup is the only fetch; the run exits 1 BEFORE the vendor step with exactly `{status:"error", found:1, downloaded:0, skipped:0, failed:1, error:{code, message}, patches:[{purl, uuid, action:"failed", errorCode, error}]}` (the `error` OBJECT is the vendored-mode error shape of the vendor-step fold-in above) and writes nothing — no `.socket/` on a fresh project; human mode prints `Error (<code>): <detail>` on stderr. **Already-vendored exemption**: a purl is exempt from the workspace refusal only when every instance of its `name@version` in `bun.lock` is already a `.socket/vendor/npm/…` local tuple (any uuid; the digest-less 2-tuple counts) — the engine's own criterion — so in-sync re-runs, `repair`, and a superseding patch uuid on a project vendored before it grew a workspace member all flow to the engine (re-pinning an already-local tuple adds no workspace-relative exposure); a wiped ledger alone is not a refusal (the engine path decides). UUID equality in the ledger alone never exempts a purl: `rollback --preserve-state` retains its record after unwiring. Dry-run refusal takes priority over `already_vendored`. **Unreadable vendor ledger**: a `.socket/vendor/state.json` the preflight cannot read or parse is itself the refusal — `vendor_state_unreadable` with the io/parse detail, fail-closed (nothing is exempt) — on the uuid path, the search / `scan` path and the `--dry-run` preview alike; never a Bun lock code. **`--silent`** is "errors only" and never mutes the refusal: the code-tagged `[error] <purl> (<code>): <detail>` (per-patch paths) / `Error (<code>): …` (uuid path) line stays on stderr with an empty stdout. **`--dry-run`** previews the refusal as the additive `would_refuse` action (see `--dry-run` below). Agent-mode `get --save-only` is NOT preflighted (record-only intent has no consumption precondition). Pinned by `tests/in_process_vendor_bun.rs` (exact uuid-path envelope, seeded-manifest survival, `--silent`, `--dry-run`) and `tests/scan_vendor_e2e.rs`.
 
-**Lock-text refusals before the download (v5.0)** — shared by `get --mode vendored` on both its paths and `scan --mode vendored`, after the Bun preflight above and the ledger's `already vendored` skip: a `pkg:npm/` result in a **pnpm, yarn classic or yarn berry** project, or a `pkg:cargo/` result, that its vendor backend refuses on the project's lock and manifest text alone is refused BEFORE its patch view is fetched — the pnpm / classic / berry gates the backend runs before it reads the package (coordinates, the lock and manifest reads and their line-ending / version / `cacheKey` / `.yarnrc.yml` gates, override and `resolutions` conflicts, the lock entry present and rewritable) and cargo's `locked_version_mismatch` (only when it is the crate's FIRST refusal; an in-tree `cargo vendor` copy still refuses in the loop as `already_vendored_in_tree`). **Scope:** only a package the vendor loop would hand to its backend is refused early — one installed on disk (the loop's own qualified-aware resolver plus the npm identity lookup), or one the lockfile inventory resolves to a verifiable registry source (a lock entry with an integrity, or the ledger-recovered pre-vendor resolution — exactly the entry the pristine fetch would use). A package absent from the lock and not installed never reached its backend and is untouched: its view is fetched, it downloads, and the vendor loop skips it `skipped` / `package_not_installed` as in v4.x (so cargo's `locked_version_mismatch` is refused early only for a crate installed at the unlocked version). The result becomes `{action:"failed", errorCode:<code>, error:<detail>}` in `download.patches[]` / `patches[]` with the backend's exact code and detail, no view and no pristine fetch, no patch record, and therefore no vendor event: compared with v4.x, `download.downloaded` drops and `download.failed` rises by the number of such packages, `vendor.summary.failed` and `vendor.events` lose their `failed` events, and a lockfile-only package among them loses its `vendor_fetched_missing` event (it is never fetched). Exit code and top-level `status` are unchanged (`partial_failure`/1); the nested `vendor.status` becomes `success` when those refusals were the vendor step's only failures (observed on the depscan fixture: 3 refusals, `partialFailure` → `success`), and when every selected package is refused this way the human `scan --vendor` arm prints `Nothing was vendored: N patches failed (see above).`. **Precedence:** the lock-text refusal is decided before the view, so it wins over every view-derived outcome — a package that would also have been a paid-access 403 (`[PAID]`/no access), a failed view fetch, or a no-applicable-files skip reports the lock refusal instead (the Bun refusal and the ledger's `already vendored` skip still come first). The human `[error] <purl> (<code>): <detail>` line is printed during the download instead of the vendor step's failure line (the interactive human `scan --vendor` arm's pre-prompt baseline check still fetches the views it verifies; only the download, the pristine fetch and the vendor step skip the package there). A purl the hosted redirect ledger claims keeps the loop's refusal (its takeover revert rewrites the lock the gates read), as does every purl when that ledger is malformed; other flavors (package-lock, pnpm-legacy, bun) and ecosystems are untouched, and `--dry-run` is unchanged. `vendor` (manifest-driven, no view fetch) keeps its per-package `failed` events but no longer fetches the pristine source of a lockfile-only package it refuses this way — the source is deferred to the backend, which refuses before reading it (no `vendor_fetched_missing` event and no registry request; a refused package whose registry is unreachable reports the gate's code instead of `vendor_fetch_failed`); only a package the lock resolves to a verifiable source is deferred, and one it does not resolve keeps its `package_not_installed` skip. Pinned by `tests/scan_vendor_e2e.rs` (`exact_download_plan`: scan and exact-purl get, pnpm and cargo scope), `tests/e2e_yarn_legacy_cachekey_refusal_build.rs` and `tests/vendor_rerun_no_network_e2e.rs`.
+**Lock-text refusals before the download (v5.0)** — shared by `get --mode vendored` on both its paths and `scan --mode vendored`, after the Bun preflight above and the ledger's `already vendored` skip: a `pkg:npm/` result in a **pnpm, yarn classic or yarn berry** project, or a `pkg:cargo/` result, that its vendor backend refuses on the project's lock and manifest text alone is refused BEFORE its patch view is fetched — the pnpm / classic / berry gates the backend runs before it reads the package (coordinates, the lock and manifest reads and their line-ending / version / `cacheKey` / `.yarnrc.yml` gates, override and `resolutions` conflicts, the lock entry present and rewritable) and cargo's `locked_version_mismatch` (only when it is the crate's FIRST refusal; an in-tree `cargo vendor` copy still refuses in the loop as `already_vendored_in_tree`). **Scope:** only a package the vendor loop would hand to its backend is refused early — one installed on disk (the loop's own qualified-aware resolver plus the npm identity lookup), or one the lockfile inventory resolves to a verifiable registry source (a lock entry with an integrity, or the ledger-recovered pre-vendor resolution — exactly the entry the pristine fetch would use). A package absent from the lock and not installed never reached its backend and is untouched: its view is fetched, it downloads, and the vendor loop skips it `skipped` / `package_not_installed` as in v4.x (so cargo's `locked_version_mismatch` is refused early only for a crate installed at the unlocked version). The result becomes `{action:"failed", errorCode:<code>, error:<detail>}` in `download.patches[]` / `patches[]` with the backend's exact code and detail, no view and no pristine fetch, no patch record, and therefore no vendor event: compared with v4.x, `download.downloaded` drops and `download.failed` rises by the number of such packages, `vendor.summary.failed` and `vendor.events` lose their `failed` events, and a lockfile-only package among them loses its `vendor_fetched_missing` event (it is never fetched). Exit code and top-level `status` are unchanged (`partial_failure`/1); the nested `vendor.status` becomes `success` when those refusals were the vendor step's only failures (observed on the depscan fixture: 3 refusals, `partialFailure` → `success`), and when every selected package is refused this way the human `scan --vendor` arm prints `Nothing was vendored: N patches failed (see above).`. **Precedence:** the lock-text refusal is decided before the view, so it wins over every view-derived outcome — a package that would also have been a paid-access 403 (`[PAID]`/no access), a failed view fetch, or a no-applicable-files skip reports the lock refusal instead (the Bun refusal and the ledger's `already vendored` skip still come first). The human `[error] <purl> (<code>): <detail>` line is printed during the download instead of the vendor step's failure line (the human (non-`--silent`) `scan --vendor` arm's baseline pre-check still fetches the views it verifies; only the download, the pristine fetch and the vendor step skip the package there). A purl the hosted redirect ledger claims keeps the loop's refusal (its takeover revert rewrites the lock the gates read), as does every purl when that ledger is malformed; other flavors (package-lock, pnpm-legacy, bun) and ecosystems are untouched, and `--dry-run` is unchanged. `vendor` (manifest-driven, no view fetch) keeps its per-package `failed` events but no longer fetches the pristine source of a lockfile-only package it refuses this way — the source is deferred to the backend, which refuses before reading it (no `vendor_fetched_missing` event and no registry request; a refused package whose registry is unreachable reports the gate's code instead of `vendor_fetch_failed`); only a package the lock resolves to a verifiable source is deferred, and one it does not resolve keeps its `package_not_installed` skip. Pinned by `tests/scan_vendor_e2e.rs` (`exact_download_plan`: scan and exact-purl get, pnpm and cargo scope), `tests/e2e_yarn_legacy_cachekey_refusal_build.rs` and `tests/vendor_rerun_no_network_e2e.rs`.
 * **Installed-version narrowing** (all modes, `get`'s search path): a CVE/GHSA fan-out returns one patch record per patched VERSION; get keeps only versions present here and emits calm `skipped` records (`errorCode: "package_not_installed"`) for the rest — never an error exit. Presence = installed on disk (qualified-aware resolver) ∪ already tracked in the manifest (record maintenance keeps working on hosts without an installed copy); hosted/vendored modes additionally count lockfile-resolved deps and vendor-ledger purls (mirroring scan's discovery supplements, including their `--global` gate). **Exempt** (no narrowing): UUID identifiers, exact-versioned PURL identifiers (explicit intent), `--save-only` runs (record-only has no installation precondition — the fresh-clone record→vendor flow keeps working), `--all-releases`, and the package-name path (already installed-derived). When EVERY found patch is filtered out, get exits 0 with the additive status **`not_installed`** (`{status:"not_installed", found:N, downloaded:0, applied:0, patches:[<skip records>], warnings?}`) — never `no_match`, which remains pinned to the fuzzy package-name path. PnP layouts are surfaced, not misreported: yarn-PnP npm results skip with `errorCode: "yarn_pnp_unsupported"` in every mode; pnpm-PnP skips carry `pnpm_pnp_unsupported` in agent/vendored modes; hosted mode — the refusal's own remedy — keeps ONLY the versions the raw `pnpm-lock.yaml` text actually resolves (boundary-anchored probe over the v5/v6/v9 key spellings, so a large fan-out never requests grants for every version ever patched), labels a JUDGED miss `package_not_installed` exactly like a non-PnP project (the layout blocked nothing — the lock was read and the version isn't resolved), and reserves the layout code for an unreadable lock (no judgment possible). When EVERY narrowed-out result is a PnP refusal, the human terminal names the layout instead of claiming "not installed" and never advises `--all-releases` (which cannot make PnP patchable); the JSON status stays `not_installed` — consumers dispatch on the per-record `errorCode`. Hosted mode also runs the per-release VARIANT filter (`filter_to_installed_releases`) on its search path before requesting grants — agent/vendored runs get it inside the download engines — with the same keep-all-plus-warning fallbacks (surfaced as `(release_narrowing)`-prefixed strings in `warnings[]`). An ecosystem this binary has no crawler for is likewise never judged: its results are KEPT (absence from a crawl that never looked carries no information — the same fail-safe as scan's prune GC). The human `Found N patches:` listing shows only the patches whose package version survived the narrowing (the narrowing is judged over every result, so an installed package's paid fix a free user cannot download still lists as `[PAID] (no access)`, while skip records and counts cover only accessible patches), sorted by PURL in natural version order (`4.17.2` before `4.17.10`); the narrowed-out ones are summarized on stderr in one line per reason (`Skipped N patches for M package versions not installed here (use --all-releases to include them).`), and `--verbose` adds one `[skip] <purl> (<reason>)` line per skipped version after that summary, in natural version order. When the candidates hold more patches than were selected and the pick was made without a menu (a paid user's auto-pick, `--yes`, a non-TTY run), a `Selected:` block names the patch (purl, tier, short uuid, advisories) that will be installed before the prompt. Machine output (the prompt count, the JSON envelope) uses the kept set, unchanged. The finer per-release variant narrowing (`filter_to_installed_releases`) is unchanged and still runs inside the download engines (and before an agent-mode `--dry-run` preview, so the preview names only the variants a wet run would fetch).
-* **Deliberate divergences from scan** (documented, not drift): get keeps its `selection_required` JSON posture for free multi-patch PURLs (scan auto-picks); get has no `--vex` (an ambient `SOCKET_VEX` is ignored by get's modes), no `--detached` (moot — `get --mode vendored` is manifest-free by construction), no `--prune`; get does not run scan's pre-confirm vendor baseline annotation; and an all-narrowed-out run exits `not_installed` without entering the vendor step (heal-after-wipe re-vendoring stays `scan --mode vendored`'s job). Agent-mode `get` honors `--dry-run` too (v5.x; it used to download, save and apply anyway): the search and uuid paths classify each selected patch against the manifest (read-only; an unreadable manifest fails closed like the wet run) and stop before the prompt, the download, any `.socket/` write and the apply — human `[would-add]` / `[would-update] … (replacing <short uuid>)` / `[skip] … (already in manifest)` lines then `[dry-run] Would download and apply N patches. No changes made.`; JSON `{status:"success", dryRun:true, found, downloaded:0, skipped, applied:0, patches:[{purl, uuid, action:"would_add"|"would_update"(+oldUuid)|"skipped"}, <narrowing skip records>], warnings?}`, exit 0.
+* **Deliberate divergences from scan** (documented, not drift): get keeps its `selection_required` JSON posture for free multi-patch PURLs (scan auto-picks); get has no `--vex` (an ambient `SOCKET_VEX` is ignored by get's modes), no `--detached` (moot — `get --mode vendored` is manifest-free by construction), no `--prune`; get does not run scan's pre-vendor baseline annotation; and an all-narrowed-out run exits `not_installed` without entering the vendor step (heal-after-wipe re-vendoring stays `scan --mode vendored`'s job). Agent-mode `get` honors `--dry-run` too (v5.0): the search and uuid paths classify each selected patch against the manifest (read-only; an unreadable manifest fails closed like the wet run) and stop before the prompt, the download, any `.socket/` write and the apply — human `[would-add]` / `[would-update] … (replacing <short uuid>)` / `[skip] … (already in manifest)` lines then `[dry-run] Would download and apply N patches. No changes made.`; JSON `{status:"success", dryRun:true, found, downloaded:0, skipped, applied:0, patches:[{purl, uuid, action:"would_add"|"would_update"(+oldUuid)|"skipped"}, <narrowing skip records>], warnings?}`, exit 0.
 
-`--dry-run` previews what `apply` / `rollback` / `scan --apply` / `repair` / `remove` — and `get` in every mode (hosted/vendored since v3.6, agent since v5.x) — would do without mutating disk. `get --mode hosted --dry-run` flows through the hosted engine's dry-run contract (no lock, no `.socket/`, no ledger write, no lockfile writes, `redirect.dryRun: true`); `get --mode vendored --dry-run` emits the same ledger-classification preview as scan's (`would_vendor` / `already_vendored` / `would_revendor`+`oldUuid` under the nested `vendor` key — plus, additive, `would_refuse` + `errorCode` + `error` for npm purls the wet run's Bun preflight would refuse: an in-sync `already_vendored` entry is exempt, as is a `would_revendor` entry whose `bun.lock` instances are all already local tuples; a purl the lock still resolves from the registry is refused like a fresh one, and the preview stays exit 0 / `status: "success"` with nothing written) before any download, and both skip the confirm prompt (nothing to confirm). In JSON mode, the envelope is populated with would-be actions and counts (`remove --dry-run` skips the confirmation prompt — there is nothing to confirm — and flips its would-be `Removed` events to `Verified` previews, so `summary.removed` stays "entries actually deleted"). `rollback --dry-run` (v5.0) previews every leg — the in-place restore verification, the vendored unwire (`Would revert/unwire vendoring for …`), the hosted unwind (the redirect engines resolve every inverse and drift check exactly like a wet run, flush nothing to disk, and claim the IN-MEMORY ledger clone exactly like a wet run — so the composed preview, per-purl reverts then whole-ledger replay, sees the same intermediate state a wet run would; the ON-DISK ledger is untouched), the manifest removals (simulated in memory), and the blob/archive GC — with no writes and no prompt.
+`--dry-run` previews what `apply` / `rollback` / `scan --apply` / `repair` / `remove` — and `get` in every mode (hosted/vendored since v3.6, agent since v5.0) — would do without mutating disk. `get --mode hosted --dry-run` flows through the hosted engine's dry-run contract (no lock, no `.socket/`, no ledger write, no lockfile writes, `redirect.dryRun: true`); `get --mode vendored --dry-run` emits the same ledger-classification preview as scan's (`would_vendor` / `already_vendored` / `would_revendor`+`oldUuid` under the nested `vendor` key — plus, additive, `would_refuse` + `errorCode` + `error` for npm purls the wet run's Bun preflight would refuse: an in-sync `already_vendored` entry is exempt, as is a `would_revendor` entry whose `bun.lock` instances are all already local tuples; a purl the lock still resolves from the registry is refused like a fresh one, and the preview stays exit 0 / `status: "success"` with nothing written) before any download, and both skip the confirm prompt (nothing to confirm). In JSON mode, the envelope is populated with would-be actions and counts (`remove --dry-run` skips the confirmation prompt — there is nothing to confirm — and flips its would-be `Removed` events to `Verified` previews, so `summary.removed` stays "entries actually deleted"). `rollback --dry-run` (v5.0) previews every leg — the in-place restore verification, the vendored unwire (`Would revert/unwire vendoring for …`), the hosted unwind (the redirect engines resolve every inverse and drift check exactly like a wet run, flush nothing to disk, and claim the IN-MEMORY ledger clone exactly like a wet run — so the composed preview, per-purl reverts then whole-ledger replay, sees the same intermediate state a wet run would; the ON-DISK ledger is untouched), the manifest removals (simulated in memory), and the blob/archive GC — with no writes and no prompt.
 
 The hidden alias `--no-apply` on `get --save-only` is **part of the contract** — it does not appear in `--help` but is widely used in existing scripts.
 
@@ -270,26 +280,25 @@ with no further human action. It does this by installing an ecosystem-native hoo
 matrix below). `setup --check` verifies that state; `setup --remove` reverts it.
 
 The properties below are the public contract. Each is backed by a test under
-`crates/socket-patch-cli/tests/setup_*.rs`; properties not yet fully implemented are called out
-explicitly and guarded by a deliberately-failing (RED) test that encodes the intended behavior — these
-are the executable spec for follow-up work, **not** regressions. Changing any property below is governed
-by the [semver policy](#semver-policy) (scoping `setup` by `--ecosystems` and strengthening `--check`,
-in particular, are behavior changes that gate a version bump when implemented).
+`crates/socket-patch-cli/tests/setup_*.rs` (`setup_contract_gaps.rs` holds the guards for the
+properties that shipped after the contract was written; a failure there is a regression). Changing
+any property below is governed by the [semver policy](#semver-policy).
 
 1. **Idempotent.** Re-running `setup` on an already-configured repo changes nothing: status
    `already_configured`, `updated: 0`, every manifest byte-identical. *(Implemented.)*
 
 2. **Ecosystem-scoped.** `setup`, `setup --check`, and `setup --remove` honor the global
    `--ecosystems` filter and act on only the named ecosystems; with no filter they act on every
-   detected ecosystem. *(Intended; **not yet implemented** — `setup` currently ignores `--ecosystems`
-   and always processes every detected ecosystem (npm + python + gem). RED-guarded.)*
+   detected ecosystem. *(Implemented — `eco_in_scope` gates the npm, Python, Bundler and Composer
+   legs on `--ecosystems`.)*
 
 3. **Consistency after install.** Once an ecosystem is set up, its locally-installed dependencies are
    re-patched to match the manifest after **any** of: a dependency added, updated, or removed; **or** a
    new patch added to the manifest. The re-patch is carried by the ecosystem's install hook (npm
-   `postinstall`/`dependencies`, the Python `.pth` startup hook, the gem Bundler plugin) which runs
+   `postinstall`/`dependencies`, the Python `.pth` startup hook, the gem Bundler plugin, the Composer
+   `post-install-cmd`/`post-update-cmd` scripts) which runs
    `socket-patch apply` after the ecosystem's installer finishes, so patch state always reconverges with
-   the manifest. *(Implemented for npm/pypi/gem via the support matrix. Cargo and Go have no `setup`
+   the manifest. *(Implemented for npm/pypi/gem/composer via the support matrix. Cargo and Go have no `setup`
    hook — see "Cargo and Go: apply-only, no setup" below.)*
 
 4. **`check` proves a correctly-patched state.** `setup --check` reports `configured` only when the
@@ -363,8 +372,9 @@ in particular, are behavior changes that gate a version bump when implemented).
    discovery + `check` (a fresh clone inherits it without re-passing the flag). Excludes apply to npm
    workspace members; the repo root is never excludable.)*
    - **Nested workspaces (implemented).** A workspace member that is itself a workspace root is recursed
-     into and has its own members configured. `find_workspace_packages` re-reads each discovered
-     member's own `workspaces` field (bounded depth). Guarded by the nested-workspace pins in
+     into and has its own members configured. `collect_workspace_members`
+     (`socket-patch-core/src/package_json/find.rs`) re-reads each discovered member's own
+     `workspaces` field (bounded depth). Guarded by the nested-workspace pins in
      `tests/setup_invariants.rs`.
 
 ### Per-ecosystem setup support
@@ -414,8 +424,8 @@ the model is **not uniform** today:
   vlt.json `workspaces` — a glob, a list, or named groups of either — or vlt <= 0.0.0-12's
   `vlt-workspaces.json`; vlt's declaration wins over the others and vlt never reads package.json
   `workspaces`). One repo-root invocation discovers and configures every member (pnpm and vlt: the
-  root package only — vlt runs the root hook once per install, even one started from a member; `setup --remove` also clears a vlt member that still carries a hook, as releases before vlt workspace support wired every member). *Single level only* — see property
-  9's nested-workspace gap.
+  root package only — vlt runs the root hook once per install, even one started from a member; `setup --remove` also clears a vlt member that still carries a hook, as releases before vlt workspace support wired every member). A member that is itself a workspace root is recursed into
+  (bounded depth; see property 9).
 - **cwd-only (single project):** gem, pypi, composer. The crawler inspects only the project
   rooted at `--cwd` (pypi looks at `$VIRTUAL_ENV`, `<cwd>/.venv` / `venv`, then a Poetry project's out-of-tree virtualenv(s) under Poetry's `virtualenvs.path`; composer at the vendor tree); it does **not**
   descend into sibling subprojects. A monorepo with several independent lockfiles in subdirectories
@@ -591,7 +601,7 @@ Verbose `vendor_artifact_reused`). Service round trips are retried on transport
 after 2 consecutive exhausted fetches the rest of the run skips the service (`auto` builds
 locally, `service` refuses).
 
-**golang service leg staging (v5.0)**: the module zip is downloaded, extracted and `h1:`-verified in a `<copy>.socket-stage` sibling and swapped into place only afterwards; a failed re-download of a WIRED, present copy keeps the copy and its `replace` directive (previously both were torn down), while a missing copy still drops the dangling directive.
+**golang service leg staging (v5.0)**: the module zip is downloaded, extracted and `h1:`-verified in a `<copy>.socket-stage` sibling and swapped into place only afterwards; a failed re-download of a WIRED, present copy keeps the copy and its `replace` directive, while a missing copy still drops the dangling directive.
 
 Coverage today: **npm** (all lock flavors), **pypi** (wheel — sdist falls back / refuses), **cargo**
 (download + extract the `.crate`), **golang** (download + extract the module zip, verify the `h1:`
@@ -716,7 +726,7 @@ to **six flavors**.
 | npm / bun (`bun.lock`, lockfileVersion 0, 1 or 2 — `vendor_lockfile_version_unsupported` otherwise) | (same tarball) | `bun.lock` only: the packages entry's registry 4-tuple → local 3-tuple with recomputed `sha512`; the entry's `{deps}` meta, the lock's version line and its line endings are preserved. A lock holding `workspace:` packages is refused `vendor_bun_workspace_unsupported` unless lockfileVersion is 2 — Bun 1.2–1.3 resolve a workspace member's local-tarball path relative to the MEMBER (ENOENT on our root-relative path), 1.4 relative to the lockfile, and a committed version-2 lock is the only proof every consumer runs Bun ≥ 1.4 (a deliberate over-approximation: a package declared only by the workspace root would install on version 1 too). The gate fires only on a run that would WRITE a new local tuple, so in-sync re-runs, `already_vendored` skips and `repair` rebuilds on such a lock pass. The detail names the version and the remedy: delete `bun.lock` and re-lock with Bun ≥ 1.4 (an in-place `bun install` keeps the existing lockfileVersion), or `--mode hosted`. Native binary support is described in the next row. `scan`/`get --mode vendored` apply all four refusals BEFORE downloading (see the `get --mode vendored` bullet). Bun 1.1.39–1.3.9 re-save the local tuple WITHOUT its `sha512` on any later lock re-save (`bun add`, `bun install` after a manifest change); the digest-less 2-tuple is recognised as the same wiring — an in-sync re-run stays `already_vendored` and re-pins the digest on disk (no new wiring record) when the committed artifact still holds the bytes the lock was written from — otherwise, as for any stale tuple of ours, the line is re-pinned and the fresh entry carries the new fingerprint — `repair` rebuilds through it, and `vendor --revert` / `rollback` restore the registry line over it (a 2-tuple at ANOTHER uuid is still `vendor_lock_entry_drifted`) | `bun install --frozen-lockfile`, cold cache (the local tarball's sha512 is enforced by Bun ≥ 1.3.10; 1.1.39–1.3.9 install it unverified — the committed artifact is the protection there) |
 | npm / bun binary (`bun.lockb`, native binary format 1, 2 or 3) | (same tarball) | Rewrite matching binary package resolutions and integrity in place; preserve topology and unrelated metadata, update binary offsets and the package metadata hash. Text `bun.lock` takes precedence. `bun_lockb_package` wiring snapshots recover pristine registry metadata for repair and support per-package revert and hosted ↔ vendored migration. Binary discovery and rewrites require no installed Bun runtime. Malformed or unsupported content refuses `vendor_bun_lockb_invalid` before download or takeover. | Frozen installs with the original compatible Bun reader; see `docs/testing/bun-compatibility.md` for the release matrix and historical runtime integrity limits. |
 | npm / vlt (`vlt-lock.json`, lockfileVersion 0 or 1 — A0 locks without a version and every other version refuse `vendor_lockfile_version_unsupported`; flavor `vlt`) | patched package **directory** `.socket/vendor/npm/<uuid>/[@scope/]<name>-<version>/node_modules/<name>/` (the extra `node_modules/<name>` level lets a package `require()` its own name), its `package.json` without `devDependencies`, plus `<uuid>/.gitignore` (re-includes the payload against the project's ignores, ignores vlt's links inside it) and `<uuid>/.gitattributes` (`-text`) | direct dependencies of the root or a workspace member only: the lock node becomes a `file` node for the directory, its importer edges and outgoing edges are re-keyed, and each importer's `package.json` spec becomes `file:<path>`; every moved entry lands where vlt's serializer puts it. A node whose only extra is one peer context (`ṗ:N`, `peer.N`, `peer.<16 hex>`: from vlt 1.0.8 a root dependency with resolved peers, from rc.15 a workspace member's) becomes a `file` node without the extra, as vlt writes `file:` dependencies, keeping its peer edges; revert restores the extra-bearing DepID. Refused before any write: transitive targets (`vendor_vlt_transitive_unsupported`), two or more instances of one `name@version` or a modifier extra, importer `peer` edges, foreign registries, a git, remote-tarball or local-directory node of the same package name (vlt records no version for it), a package `vlt build` would build in place (`vendor_vlt_build_scripts_unsupported`), a name declared in several dependency fields (`vendor_lock_entry_unsupported`), a spec that disagrees with the lock (`vendor_vlt_lock_out_of_sync`), a payload git would ignore (`vendor_artifact_gitignored`), a purl vendored under another flavor (`vendor_flavor_changed`); era-A locks warn `vendor_vlt_legacy_lockfile`; an optional dependency (or any dependency node_modules still links to its installed upstream copy) gets `vendor_vlt_reinstall_required` | fresh checkout, `vlt ci` with cold caches: the patched bytes load and `vlt-lock.json` stays byte-identical, also through a warm and a cold `vlt install --frozen-lockfile` (checked on 1.2.0, 1.0.10, 1.0.4, 1.0.0-rc.32 and 1.0.0-rc.14, and on every release by `docs/testing/vlt-compatibility.md`); no-op installs, `vlt install <new>`, `uninstall` and `vlt update` keep the direct dependency vendored. `vendor --revert` restores the registry node, edges and specs, keeping what vlt re-laid since, and refuses on drift |
-| cargo | crate dir `<name>-<version>/` (no `.cargo-checksum.json`) | (v5.0) `[patch.crates-io]` path entry in the **workspace-root `Cargo.toml`** (the manifest beside the `Cargo.lock` it detaches — never `.cargo/config*`) **+** Cargo.lock surgery (the `[[package]]` entry's `source`/`checksum` removed and its `version` set to the copy's TAGGED version `<version>+socket.<uuid>` — `<core>+<meta>.socket.<uuid>` when the version already has build metadata — with every lock reference that spells the old version rewritten, formats v1–v4; the copy's own `Cargo.toml` version carries the same tag, so the patched crate sees it in `CARGO_PKG_VERSION`; revert restores the lock byte for byte). Key: always the Socket-owned `<name>-socket-<first 8 hex of the uuid>` with `package = "<name>"` (the full uuid hex when that key is taken), never the bare crate name — cargo lets a config-file `[patch]` item (project, ancestor directory or `$CARGO_HOME`) replace the manifest item with the same key whatever its version, so keys any of those configs use are avoided and a re-run moves an entry off a now-shadowed key; two versions of one crate are wired side by side. Pre-v5 wiring in `.cargo/config.toml` / `.cargo/config` is moved into `Cargo.toml` by a re-run (`vendor`, `scan`/`get --mode vendored`) or `repair` (`cargo_wiring_migrated` note; the ledger's `cargo_patch_entry` record then names `Cargo.toml`); a detached lock entry left unwired by the pre-v5 multi-version overwrite is re-wired the same way (`cargo_wiring_restored`); every revert removes both spellings | `cargo build --locked --offline` on a fresh checkout — single-version manifest `[patch]` also builds with no network on cargo older than 1.56 (the old config-file wiring's floor); two vendored versions of ONE crate need `--offline` on cargo 1.56 and a populated registry index (or network access) on older cargo such as 1.41, which loads the index to tell them apart. Note: path deps build **without** `--cap-lints allow` |
+| cargo | crate dir `<name>-<version>/` (no `.cargo-checksum.json`) | (v5.0) `[patch.crates-io]` path entry in the **workspace-root `Cargo.toml`** (the manifest beside the `Cargo.lock` it detaches — never `.cargo/config*`) **+** Cargo.lock surgery (the `[[package]]` entry's `source`/`checksum` removed and its `version` set to the copy's TAGGED version `<version>+socket.<uuid>` — `<core>+<meta>.socket.<uuid>` when the version already has build metadata — with every lock reference that spells the old version rewritten, formats v1–v4; the copy's own `Cargo.toml` version carries the same tag, so the patched crate sees it in `CARGO_PKG_VERSION`; revert restores the lock byte for byte). Key: always the Socket-owned `<name>-socket-<first 8 hex of the uuid>` with `package = "<name>"` (the full uuid hex when that key is taken), never the bare crate name — cargo lets a config-file `[patch]` item (project, ancestor directory or `$CARGO_HOME`) replace the manifest item with the same key whatever its version, so keys any of those configs use are avoided and a re-run moves an entry off a now-shadowed key; two versions of one crate are wired side by side. Pre-v5 wiring in `.cargo/config.toml` / `.cargo/config` is moved into `Cargo.toml` by a re-run (`vendor`, `scan`/`get --mode vendored`) or `repair` (`cargo_wiring_migrated` note; the ledger's `cargo_patch_entry` record then names `Cargo.toml`); a detached lock entry left unwired by the pre-v5 multi-version overwrite is re-wired the same way (`cargo_wiring_restored`); every revert removes both spellings | `cargo build --locked --offline` on a fresh checkout — single-version manifest `[patch]` also builds with no network on cargo older than 1.56 (the old config-file wiring's floor); two vendored versions of ONE crate need cargo 1.45 or newer (`--offline` from an empty CARGO_HOME is enough there); older cargo fails closed whatever the index state, and a project that does not pin cargo ≥ 1.45 (`rust-version` or toolchain file) gets the `cargo_multi_version_old_cargo` warning. Note: path deps build **without** `--cap-lints allow` |
 | golang | module dir `<module>@<version>/` | `go.mod` `replace <module> <ver> => ./.socket/vendor/golang/<uuid>/<module>@<ver>` | `go build` with `GOPROXY=off` + empty `GOMODCACHE` (directory replaces bypass go.sum entirely; survives `go mod tidy`) |
 | composer | package dir `<vendor>/<name>@<version>/` | `composer.lock` only: entry's `dist` → `{type: "path", url, reference: null}`, `source` removed, `transport-options: {symlink: false}` added. `content-hash` unaffected; `composer.json` untouched | `composer install` (from the lock alone, real copy not symlink, works under `--network none`). `composer update <pkg>` reverts it |
 | gem | gem dir `<name>-<version>/` + gemspec materialized from `specifications/` | **Gemfile + Gemfile.lock pair**: the `gem` line gains `path:` (or a managed block for transitive deps); the lock's spec block moves GEM→PATH and the DEPENDENCIES entry becomes `<name> (= <ver>)!`, in bundler's exact canonical form | `bundle install` (normal **and** `BUNDLE_FROZEN=true`), byte-stable lock. Lock-only edits are a silent unpatch — hence the mandatory pair |
@@ -734,8 +744,8 @@ Ecosystems with no vendor backend (jsr) refuse per-purl with
 Bun's binary `bun.lockb` is supported natively, including lockfile-only discovery,
 vendoring, hosting, repair and migration between those modes. A lock-less tool marker (a `[tool.uv]`/`[tool.poetry]`/
 `[tool.pdm]` table or a `Pipfile` without its lock) refuses `<tool>_no_lockfile` unless a
-`requirements.txt` fallback exists. PURLs of **compiled-out** ecosystems are invisible to `vendor`
-exactly as they are to `apply` (the binary cannot parse them).
+`requirements.txt` fallback exists. PURLs of ecosystems this binary has no backend for (e.g. a newer
+CLI's ecosystem in the committed manifest) are invisible to `vendor` exactly as they are to `apply`.
 
 ### Checksum coverage
 
@@ -956,7 +966,7 @@ Restore the system but keep the local patch state for a later re-apply: manifest
 | Key | Shape | Meaning |
 |---|---|---|
 | `warnings` | `[{code, detail}]` | Run-level warnings, now populated (previously always empty): `reinstall_required`, `hosted_state_not_preservable`, `out_of_scope_copies_restored`, `vendor_state_unreadable`, `redirect_state_unreadable`, `cleanup_failed`, `manifest_write_failed`, `redirect_pnpm_trust_scaffold_modified`, `redirect_npmrc_allow_remote_modified`, `ownership_not_restored` (a restored file whose ownership could not be put back — see the apply warnings), plus vendored/hosted leg advisories. New codes are additive (MINOR) |
-| `vendored` | `[purl]` | **Meaning narrowed (MAJOR)**: vendor-owned purls the run did NOT act on — today exactly the corrupt-vendor-ledger skip. Previously this listed every vendor-owned skip |
+| `vendored` | `[purl]` | **Meaning narrowed (MAJOR)**: vendor-owned purls the run did NOT act on — today exactly the corrupt-vendor-ledger skip. |
 | `vendoredReverted` | `[purl]` | Ledger entries cleanly reverted this run (unwired + artifact deleted + entry dropped; previewed on dry-run) |
 | `vendoredPreserved` | `[purl]` | `--preserve-state`: unwired with artifact + ledger entry kept |
 | `vendoredKept` | `[{purl, reason}]` | Drift-keeps — wiring drifted, vendored state (and the manifest entry) left untouched; drives exit 1 |
@@ -1021,7 +1031,7 @@ State lives at `$XDG_CACHE_HOME`|`~/.cache` (Unix/macOS) or `%LOCALAPPDATA%` (Wi
 
 ## Environment variables
 
-All v3.0 env vars use the `SOCKET_*` prefix. Three legacy `SOCKET_PATCH_*` names are still honored at runtime for compatibility: on first read of any of the three the binary emits a one-shot deprecation warning to stderr (the warning fires unconditionally — even under `--silent` / `--json` — because it's a transition signal users need to see). The legacy names will be removed in the next major release.
+All v3.0 env vars use the `SOCKET_*` prefix. Three legacy `SOCKET_PATCH_*` names are still honored at runtime for compatibility: on first read of any of the three the binary emits a one-shot deprecation warning to stderr (the warning fires unconditionally — even under `--silent` / `--json` — because it's a transition signal users need to see). The legacy names will be removed in a future major release.
 
 Four `SOCKET_CLI_*` names from the sibling JS Socket CLI are additionally accepted as **peer aliases** (supported, not deprecated — no warning): `SOCKET_CLI_API_TOKEN` → `SOCKET_API_TOKEN`, `SOCKET_CLI_ORG_SLUG` → `SOCKET_ORG_SLUG`, `SOCKET_CLI_API_BASE_URL` → `SOCKET_API_URL`, `SOCKET_CLI_NO_API_TOKEN` → `SOCKET_NO_API_TOKEN`. The canonical `SOCKET_*` name always wins when both are set; promotion is silent and happens in-process before clap parses. Other socket-cli names (`SOCKET_CLI_CONFIG`, `SOCKET_CLI_API_PROXY`, `SOCKET_CLI_DEBUG`) are deliberately **not** honored.
 
@@ -1048,19 +1058,24 @@ Empty string means unset at every layer: exported-but-empty flag-bound vars are
 | `SOCKET_VERBOSE` | `--verbose` / `-v` | `false` | — |
 | `SOCKET_SILENT` | `--silent` / `-s` | `false` | — |
 | `SOCKET_DRY_RUN` | `--dry-run` | `false` | — |
-| `SOCKET_YES` | `--yes` / `-y` | `false` | — |
+| `SOCKET_YES` | `--yes` / `-y` | `false` | Skips the prompts of `get`, `rollback`, `remove`, `setup` and `--update`; `scan` never prompts, so it has no effect there. |
 | `SOCKET_LOCK_TIMEOUT` | `--lock-timeout` | (none) | Seconds to wait for `apply.lock` on the lock-taking subcommands (incl. hosted/vendored `scan`/`get`); unset/`0` = single non-blocking try. |
 | `SOCKET_DEBUG` | `--debug` | `false` | **Renamed in v3.0** (was `SOCKET_PATCH_DEBUG`). |
 | `SOCKET_TELEMETRY_DISABLED` | `--no-telemetry` | `false` | **Renamed in v3.0** (was `SOCKET_PATCH_TELEMETRY_DISABLED`). |
-| `SOCKET_FORCE` | `apply --force` / `-f`, `--update --force` | `false` | Local to `apply` and `--update`. |
+| `SOCKET_NO_TRUST_LOCKFILE_CONFIG` | `--no-trust-lockfile-config` | `false` | Hosted mode: skip the `trustLockfile: true` write to `pnpm-workspace.yaml`. |
+| `SOCKET_NO_NPM_ALLOW_REMOTE_CONFIG` | `--no-npm-allow-remote-config` | `false` | Hosted mode: skip the `allow-remote=all` write to the project `.npmrc`. |
+| `SOCKET_NO_VLT_INSTALL_CLEANUP` | `--no-vlt-install-cleanup` | `false` | Hosted mode, `rollback`, `remove`: keep stale vlt installed copies. |
+| `SOCKET_FORCE` | `apply --force` / `-f`, `vendor --force` / `-f`, `--update --force` | `false` | Local to `apply`, `vendor` and `--update`. |
 | `SOCKET_PATCH_VERSION` | `--update <VERSION>` | (latest) | Local to `--update`; the same pin `install.sh` and the gem launcher honor. Not one of the deprecated legacy `SOCKET_PATCH_*` trio. |
 | `SOCKET_BATCH_SIZE` | `scan --batch-size` | `500` authenticated / `100` proxy | Local to `scan`. |
+| `SOCKET_SCAN_PACKAGES` | `scan --package` | (none) | Local to `scan` (v5.0); comma-separated names or purls. |
 | `SOCKET_SAVE_ONLY` | `get --save-only` | `false` | Local to `get`. |
 | `SOCKET_ONE_OFF` | `get --one-off` / `rollback --one-off` | `false` | Local to `get`/`rollback`. Both are **not yet implemented**: the flag parses (boolishly, empty-tolerant) and the command fails up front with a "not yet implemented" error, before any network or disk activity (on `rollback`, with no identifier-shaped target it instead fails "requires an identifier", equally up front). |
 | `SOCKET_ALL_RELEASES` | `get --all-releases` / `scan --all-releases` | `false` | Local to `get`/`scan`. Download patches for every release/distribution variant, not just the installed one. |
 | `SOCKET_SKIP_ROLLBACK` | `remove --skip-rollback` | `false` | Local to `remove`. Conflicts with `--preserve-state`/`SOCKET_PRESERVE_STATE` (exit 2 — see below). |
 | `SOCKET_PRESERVE_STATE` | `rollback --preserve-state` / `remove --preserve-state` | `false` | (v5.0) Shared by `rollback`/`remove` (boolish, empty-tolerant parse like the other bool flags): restore the system but keep the local patch state — manifest entries, vendored artifacts + ledger entries — and skip all GC. On `remove`, combining it with `--skip-rollback` is a usage error (exit 2) **whether either side is flag- or env-sourced** (`SOCKET_PRESERVE_STATE=true remove --skip-rollback` exits 2 too). |
 | `SOCKET_DOWNLOAD_ONLY` | `repair --download-only` | `false` | Local to `repair`. |
+| `SOCKET_VENDOR_REVERT` | `vendor --revert` | `false` | Local to `vendor`. |
 | `SOCKET_SETUP_EXCLUDE` | `setup --exclude` | (none) | Local to `setup`; comma-separated workspace-member paths, persisted to `setup.exclude`. |
 | `SOCKET_VEX` | `apply --vex` / `scan --vex` / `vendor --vex` | (none) | Embedded OpenVEX output path. The `SOCKET_VEX_*` knobs (`_PRODUCT`, `_NO_VERIFY`, `_DOC_ID`, `_COMPACT`) are shared with the standalone `vex` command; on the host commands they bind to `--vex-product` etc. |
 | `SOCKET_VEX_OUTPUT` | `vex --output` / `-O` | (none) | Local to the standalone `vex`: document output path (required with `--json`). |
@@ -1119,7 +1134,7 @@ These exist for staged rollouts and the launcher wrappers. They are **internal**
 
 | Env var | Purpose |
 |---|---|
-| `SOCKET_PATCH_BIN` | Points the RubyGems CLI launcher and the gem Bundler plugin at an existing `socket-patch` binary (skips the download-on-first-run); also the escape hatch `apply` names when a golang-featureless binary is asked to audit Go redirects. |
+| `SOCKET_PATCH_BIN` | Points the RubyGems CLI launcher and the gem Bundler plugin at an existing `socket-patch` binary (skips the download-on-first-run). |
 | `SOCKET_UPDATE_BASE_URL` | Points BOTH the release-metadata and asset-download routes of `--update`/the update notice at one base (mirror or test fixture) instead of `github.com` + `api.github.com`. Overriding it relaxes the downloaded binary's version self-check from hard-fail to warning. |
 | `SOCKET_UPDATE_STATE_DIR` | Overrides the per-user dir holding `update-check.json` + `update.lock` (tests point it into a tempdir). |
 | `SOCKET_UPDATE_TIMEOUT_MS` | Caps the update fetches' connect/metadata/download budgets (defaults 10 s / 30 s / 300 s; the notice's fetch defaults to 2 s). Doubles as the slow-network escape hatch. |
@@ -1130,9 +1145,9 @@ These exist for staged rollouts and the launcher wrappers. They are **internal**
 
 | Legacy | Renamed to | Status |
 |---|---|---|
-| `SOCKET_PATCH_PROXY_URL` | `SOCKET_PROXY_URL` | Honored with warning; remove in next major. |
-| `SOCKET_PATCH_DEBUG` | `SOCKET_DEBUG` | Honored with warning; remove in next major. |
-| `SOCKET_PATCH_TELEMETRY_DISABLED` | `SOCKET_TELEMETRY_DISABLED` | Honored with warning; remove in next major. |
+| `SOCKET_PATCH_PROXY_URL` | `SOCKET_PROXY_URL` | Honored with warning; to be removed in a future major release. |
+| `SOCKET_PATCH_DEBUG` | `SOCKET_DEBUG` | Honored with warning; to be removed in a future major release. |
+| `SOCKET_PATCH_TELEMETRY_DISABLED` | `SOCKET_TELEMETRY_DISABLED` | Honored with warning; to be removed in a future major release. |
 
 ## CSV value parsing
 
@@ -1223,7 +1238,7 @@ Every `--json` invocation emits a single JSON object that follows the **unified
 | `vendored`                | `skipped`        | apply (every ecosystem) + scan `--apply`: the package is managed by `socket-patch vendor`; the command yields ownership (scan also skips the download). v5.0: rollback no longer yields — its vendored leg reverts these entries by default, and its `vendored: []` array is reserved-empty (a corrupt vendor ledger surfaces via the `vendor_state_unreadable` warning + exit 1 — the skip cannot name purls, since naming them needs the ledger). Scan `--apply --json` additionally surfaces one run-level `vendored_ownership_retained` warning naming the skipped purls (additive; exit/status unchanged). |
 | `vendor_reverted`         | `removed`        | remove: vendoring reverted (lock fragments restored, artifact + ledger entry gone) as part of removing the patch. |
 | `vendor_revert_failed`    | top-level error  | remove: the vendor revert failed; the manifest was NOT modified. |
-| `vendor_state_retained`   | `skipped`        | remove `--skip-rollback`: vendor wiring + artifact deliberately left in place (the next `vendor` run reconciles the dropped entry). Also the top-level error code when `--skip-rollback` targets a vendored patch with no manifest record (every `scan`/`get --mode vendored` entry — and, v5.0, the ledger-only leftover of an earlier `remove --skip-rollback` of a manifest-tracked vendored patch, which used to answer `not_found`). |
+| `vendor_state_retained`   | `skipped`        | remove `--skip-rollback`: vendor wiring + artifact deliberately left in place (the next `vendor` run reconciles the dropped entry). Also the top-level error code when `--skip-rollback` targets a vendored patch with no manifest record (every `scan`/`get --mode vendored` entry — and, v5.0, the ledger-only leftover of an earlier `remove --skip-rollback` of a manifest-tracked vendored patch). |
 | `hosted_state_retained`   | (top-level error) | remove `--skip-rollback` targeting a hosted-only patch (no manifest entry): unwinding the redirect is the only possible removal, so the combination is refused (exit 1), mirroring the manifest-less vendored refusal above. |
 | `vendor_state_preserved`  | `skipped`        | remove `--preserve-state` (v5.0): lockfile unwired; artifact, ledger entry, and manifest entry all kept for a later re-apply. Rollback's counterpart is the `vendoredPreserved: []` envelope array. |
 | `vendor_revert_kept`      | `skipped` + top-level error | remove (v5.0): the vendored revert drift-kept (`kept_artifact`), so the ledger entry AND the manifest entry were both kept. ANY drift-keep makes the run a `partialFailure` (exit 1) — part of the requested removal did not happen; when EVERY matching entry drift-kept, the top-level error carries this code (`summary.removed` stays 0; the identifier DID match, so never `not_found`). Remedy: re-run `scan --mode vendored` to normalize, then remove. Rollback's counterpart is the `vendoredKept: []` envelope array (also exit 1). |
@@ -1245,7 +1260,7 @@ Every `--json` invocation emits a single JSON object that follows the **unified
 | `unsafe_coordinates`      | `failed`         | vendor: purl/uuid would escape `.socket/vendor/` (tampered manifest/state); refused before any write. |
 | `revert_failed`           | `failed`         | vendor --revert: a recorded entry could not be reverted. |
 | `vendor_wiring_unknown_revert_blocked` | `skipped` (beside the `failed`/`revert_failed` event) | vendor --revert: the ledger entry was reconstructed by `repair` without wiring records and the live lockfile still resolves through the artifact — the revert refuses (fail-closed) instead of deleting a tarball the lock points at. Recovery: `socket-patch repair`, then restore the pre-vendor lock (or re-lock without the override) and re-run the revert. repair: an npm ledger entry whose `flavor` this release does not know (written by a newer socket-patch) is skipped, never health-checked or rebuilt, and the artifact, wiring and ledger stay as found (a lone `skipped` event; the run's exit is unaffected). Recovery: upgrade socket-patch. |
-| `ecosystem_not_setup`     | `skipped`        | vex: the patch is applied and byte-verified but its ecosystem has no install hook configured and is not declared in the manifest's `setup.manual`, so it is omitted from the document (Property 7). Previously invisible in `--json`. |
+| `ecosystem_not_setup`     | `skipped`        | vex: the patch is applied and byte-verified but its ecosystem has no install hook configured and is not declared in the manifest's `setup.manual`, so it is omitted from the document (Property 7). |
 | `stale_install`           | `skipped`        | vex (in-run `scan --mode hosted --vex`): a hosted stale-install probe found positively unpatched installed bytes, so the purl is omitted even under `--vex-no-verify` (see the gem / Python stale-install guards). |
 | `record_unavailable`      | `skipped`        | vex (manifest-less): a lockfile-wired patch has no local record (manifest, redirect ledger, vendor ledger) and none could be fetched — `--offline`, transport error, 404, or a refused (paid) patch. Omitted, never attested from the `socket-patch.vendor.json` marker. |
 | `record_mismatch`         | `skipped`        | vex (manifest-less): the record found for a wired patch names another package or another patch uuid than the wiring. |
@@ -1466,21 +1481,30 @@ as raw strings, they sort by weekday name.
 A package can have several available patches; the manifest holds one
 record per PURL, so exactly one is chosen. Both `get` and every `scan`
 mode rank candidates identically (`socket_patch_core::api::ranking`),
-best first:
-
-1. **Severity** — `critical > high > medium = moderate > low > (unknown)`,
-   taken as the worst severity across everything the patch fixes.
-2. **Merge state** — a patch that remediates *more* advisories in one blob
-   leads. Inferred, not flagged: see below.
-3. **Patch publish date**, most recent first — when the *patch* was
-   published, never the upstream package's release date. Unparseable or
-   absent dates sort last.
-4. `tier` (paid first), then `uuid` — tiebreaks only, present so the
+best first (v5.0, MAJOR):
+
+1. **Merged patches** (a patch naming ≥ 2 advisories; inferred, see
+   below), **newest first, whatever their severity**. A merged patch is
+   the cumulative fix for its package, so the most recent one wins
+   outright — even against a newer single-advisory `critical` patch.
+2. **Everything else** — by **severity** (`critical > high > medium =
+   moderate > low > (unknown)`, the worst severity across everything the
+   patch fixes), then **patch publish date**, most recent first.
+3. `tier` (paid first), then `uuid` — tiebreaks only, present so the
    order is total and therefore reproducible across runs.
 
-`tier` is an **access filter, not a ranking signal**: a free `critical`
-patch outranks a paid `low` one. Paid patches are excluded outright for
-callers whose `canAccessPaidPatches` is false.
+"Publish date" is when the *patch* was published, never the upstream
+package's release date; unparseable or absent dates sort last.
+
+`tier` is an **access filter, not a ranking signal**: paid patches are
+excluded before ranking for callers whose `canAccessPaidPatches` is
+false, so the winner is the best patch the account can download.
+
+`scan`'s `[UPDATE]` marker and `updates[]` use the same order
+(`ranking::batch_supersedes`): a candidate supersedes the applied patch
+only on a meaningful rung — merged over unmerged, higher severity between
+unmerged patches, or a real, strictly later publish date. The tier and
+uuid tiebreaks and a missing date never count.
 
 #### Merge state is inferred, not reported
 
@@ -1496,27 +1520,7 @@ Advisories are counted, **not** CVE ids: one advisory routinely carries
 several CVE aliases, and counting those would inflate a single-fix patch
 into a phantom merged one.
 
-As of 2026-08-05 production publishes no merged patches — all 28 patches
-sampled across npm/PyPI/gem/cargo covered exactly one advisory each — so
-this rung is currently inert and ranking falls through to recency. The
-moment a consolidated patch is published it is preferred automatically,
-with no client *or* server change.
-
-#### Why severity sits above merge state
-
-The merged patch is the general preference: it fixes the most in one
-shot, and only one patch per PURL can be applied, so breadth is what an
-operator wants. But it must never shadow a *worse* vulnerability. If a
-patch addresses a higher-severity advisory than anything the merged patch
-covers, that one wins — you do not leave a critical unfixed to pick up
-two extra mediums. Severity on the top rung expresses exactly that,
-because a patch's severity is the worst advisory it fixes:
-
-| merged patch | rival patch | winner | why |
-|---|---|---|---|
-| high     | critical | rival  | higher severity available |
-| critical | high     | merged | merged already covers the worst |
-| high     | high     | merged | severities tie → breadth decides |
+Production published its first merged patch on 2026-09-04.
 
 This ordering is also the presentation order everywhere patches are
 listed — `scan --json`'s `packages[].patches[]`, `get`'s "Found
@@ -1524,12 +1528,13 @@ patches:" listing, and the `selection_required` `options[]` array — so
 `patches[0]` for a package is the patch that would be applied, and
 `updates[].newUuid` names that same patch.
 
-Free/unauthorized callers with more than one candidate for a PURL still
-get the interactive picker (or `selection_required` in `--json`); the
-ranking decides the presented order and hence the highlighted default,
-not the outcome. `--yes` answers the picker with that default without
-showing it (the same pick a non-terminal run makes); `--json` keeps
-`selection_required` even with `--yes`.
+`scan` never shows a picker: it always takes the top-ranked downloadable
+patch. On `get`, free/unauthorized callers with more than one candidate
+for a PURL still get the interactive picker (or `selection_required` in
+`--json`); the ranking decides the presented order and hence the
+highlighted default, not the outcome. `--yes` answers the picker with
+that default without showing it (the same pick a non-terminal run makes);
+`--json` keeps `selection_required` even with `--yes`.
 
 One additive key may appear on `scan --json`'s `packages[].patches[]`
 entries, omitted when absent: `publishedAt`, present whenever the server
@@ -1540,10 +1545,10 @@ per-package results).
 > discovery (`packages[]`, the table, `updates[]`) is built from the
 > **batch** endpoint, whose response shape currently omits `publishedAt`;
 > the selection that `--apply` performs is built from the **by-package**
-> endpoint, which carries it. Ranks 1, 2 and 4 agree across both, so the
-> two only diverge for a package whose top candidates tie on severity
-> *and* merge state — there the batch side falls through to the UUID
-> tiebreak while apply correctly uses the date.
+> endpoint, which carries it. The two diverge wherever the date decides —
+> between merged patches, or between unmerged patches of equal severity —
+> where the batch side falls through to the tier/UUID tiebreak while apply
+> correctly uses the date.
 >
 > Live example: `pkg:npm/axios@1.6.0` has two free `HIGH` patches;
 > `packages[0].patches[0]` reports `0bc312a6…` (2026-03-27) while
@@ -1599,7 +1604,7 @@ Exit `1` when `status` is `partialFailure` (any `events[*].action == "failed"`)
 |---|---|
 | `0` | Success |
 | `1` | Error (missing/invalid manifest, fetch failed, apply failed, selection cancelled in non-JSON mode, etc.) |
-| `2` | Usage error: clap parse failures (unknown flag/value, missing required arg — including the clap-enforced `setup --check --remove` conflict) and the conflicts the commands enforce themselves — `scan`'s cross-mode conflicts (`--mode` combined with a DIFFERENT mode's boolean spelling, rejected in `resolve_mode_flags`), `scan PATHS` combined with `--mode hosted`/`--mode vendored` (same enforcement point), `remove --preserve-state --skip-rollback` (the no-op quadrant; flag- or env-sourced alike), an unparseable path glob on `scan`/`rollback`, `repair --offline --download-only`. `vex` also exits `2` on hard errors before document generation (see its tri-state table below). **Carve-out**: `get`'s self-enforced conflicts have always exited `1` via its error envelope (`--id`/`--cve`/`--ghsa`/`--package` multi-select, `--one-off --save-only`) and the v3.6 `--mode hosted\|vendored --save-only` conflict deliberately follows that get-internal precedent — changing the existing ones to `2` would be a MAJOR exit-code change |
+| `2` | Usage error: clap parse failures (unknown flag/value, missing required arg — including the clap-enforced `setup --check --remove` conflict) and the conflicts the commands enforce themselves — `scan`'s cross-mode conflicts (`--mode` combined with a DIFFERENT mode's boolean spelling, rejected in `resolve_mode_flags`), `--detached` without vendored mode and `--mode hosted` with `--global`/`--global-prefix` (same enforcement point); in hosted/vendored `scan` (bare `scan` included), a PATH that is not a directory, a PATH glob matching no directory, and `--json` with more than one project directory (`run_project_dirs`); `remove --preserve-state --skip-rollback` (the no-op quadrant; flag- or env-sourced alike), an unparseable path glob on `scan`/`rollback`, `repair --offline --download-only`. `vex` also exits `2` on hard errors before document generation (see its tri-state table below). **Carve-out**: `get`'s self-enforced conflicts have always exited `1` via its error envelope (`--id`/`--cve`/`--ghsa`/`--package` multi-select, `--one-off --save-only`) and the v3.6 `--mode hosted\|vendored --save-only` conflict deliberately follows that get-internal precedent — changing the existing ones to `2` would be a MAJOR exit-code change |
 
 `list` returns **`0`** for an empty manifest and **`1`** for a missing manifest — these are distinct and load-bearing (a manifest-less project whose vendor or redirect ledger holds records is NOT "missing": `list` reads all three stores and exits 0 — see the `manifest_not_found` row). Every lock-taking subcommand — including `scan`/`get --mode hosted` as of v5.0 — returns **`1`** with `errorCode: lock_held` when another live socket-patch process holds `<.socket>/apply.lock`.
 
@@ -1683,7 +1688,7 @@ launcher-gem legs are gated on the GitHub release — with its binaries and
 Every item in this document is locked in by at least one of:
 
 - **clap parser snapshots** in `crates/socket-patch-cli/tests/cli_parse_*.rs` — assert flag names, short forms, defaults, aliases, and CSV delimiters by calling `socket_patch_cli::Cli::try_parse_from(...)`.
-- **Helper unit tests** in `crates/socket-patch-cli/src/**` (`#[cfg(test)] mod tests` blocks) — cover `looks_like_uuid`, `parse_argv_with_shortcuts`, `detect_identifier_type`, `select_patches`, `find_patches_to_rollback`, `partition_purls`, `verify_status_str`, the JSON serializers, and the terminal UI in `src/ui/` (`StatusLine` redraw/clear/`println` byte streams, `confirm_with` answers and non-interactive notes, `select_one`'s JSON/empty guards, `plural`, `truncate`, the `color_enabled` truth table, `paint`/`severity`, and `pad`/`strip_ansi` alignment).
+- **Helper unit tests** in `crates/socket-patch-cli/src/**` (`#[cfg(test)] mod tests` blocks) — cover `looks_like_uuid`, `parse_argv_with_shortcuts`, `detect_identifier_type`, `select_patches`, `find_patches_to_rollback`, `partition_purls`, the JSON serializers, and the terminal UI in `src/ui/` (`StatusLine` redraw/clear/`println` byte streams, `confirm_with` answers and non-interactive notes, `select_one`'s JSON/empty guards, `plural`, `truncate`, the `color_enabled` truth table, `paint`/`severity`, and `pad`/`strip_ansi` alignment).
 - **Async `run()` integration tests** in `tests/cli_parse_list.rs`, `tests/cli_parse_remove.rs`, `tests/cli_parse_setup.rs` — exercise the no-network error paths and assert JSON shape via `serde_json::from_str::<Value>` + per-key assertions.
 
 If you add a new flag/subcommand/JSON key, add a test here that locks the new surface in the same PR.
diff --git a/docs/design/configuration.md b/docs/design/configuration.md
index a4d6486a..4bc48634 100644
--- a/docs/design/configuration.md
+++ b/docs/design/configuration.md
@@ -98,11 +98,11 @@ UX policy and are ignored.
   Requires teaching the TS zod twin
   (`npm/socket-patch/src/schema/manifest-schema.ts`) to model `setup`.
   Precedence would be flag > env > `setup.defaults` > default.
-- **Env cleanup sweep** (separate task, agreed 2026-07-21): unify the four
-  bool-parsing dialects (`parse_bool_flag` vs stock `BoolishValueParser` on
-  `--all-releases`, bare clap bool on `get --one-off`, `env_truthy`'s
-  `1|true`-only match on the experimental gates and core's `SOCKET_OFFLINE`
-  reader); consider `FORCE_COLOR` as an alias for `CLICOLOR_FORCE` in
+- **Env cleanup sweep**: core's direct env readers (`SOCKET_OFFLINE` in
+  `utils/env_compat.rs`, `SOCKET_TELEMETRY_DISABLED` in `telemetry.rs`)
+  still match only `1|true`, unlike `parse_bool_flag`'s vocabulary (the CLI
+  mirrors `--offline` into `SOCKET_OFFLINE=1`, so only a hand-set env value
+  sees the narrower dialect); consider `FORCE_COLOR` as an alias for `CLICOLOR_FORCE` in
   `ui::color_enabled` (which already honors `NO_COLOR`, `CLICOLOR`,
   `CLICOLOR_FORCE` and `TERM=dumb`); document
   `HTTP_PROXY`/`HTTPS_PROXY`/`NO_PROXY` support in the README.
diff --git a/docs/design/golang-hosted-no-go.md b/docs/design/golang-hosted-no-go.md
index b8f61912..154f6d01 100644
--- a/docs/design/golang-hosted-no-go.md
+++ b/docs/design/golang-hosted-no-go.md
@@ -103,12 +103,12 @@ steps:
 The token enters through the CI secret store, never a committed file; the
 runner is discarded so no drifted `go env` survives; and `GOPRIVATE` is scoped
 to the single patched module so sumdb verification stays on for the rest of
-the graph. This recipe is documentation-only — neither `scan --redirect` nor
+the graph. This recipe is documentation-only — neither `scan --mode hosted` nor
 the backend PR flow will ever write it into a repository.
 
 ## Decision
 
-`scan --redirect` (and the backend hosted PR flow) emit
+`scan --mode hosted` (and the backend hosted PR flow) emit
 `redirect_golang_unsupported` naming the remedy — run `socket-patch vendor`
 (committable, offline-verified) — and the golang dependency is otherwise left
 untouched. Vendored mode already gives Go users everything hosted mode
diff --git a/docs/ecosystems.md b/docs/ecosystems.md
index fc876705..d1d6d3ca 100644
--- a/docs/ecosystems.md
+++ b/docs/ecosystems.md
@@ -24,8 +24,7 @@ The backticked slug in each row is the value `-e`/`--ecosystems` accepts (e.g.
 | Composer (`composer`) | ✅ post-install script events | ✅ `composer.lock` `dist: path` rewrite | ✅ `composer.lock` dist url + shasum rewrite |
 | Deno (`deno`) | ✅ apply-only — no install hook (`setup` reports `no_files`); declare in `setup.manual` for VEX coverage | ❌ refused (`vendor_unsupported_ecosystem`) | ❌ not supported |
 
-> **Maven / NuGet sidecar caveat**: Maven and NuGet are fully enabled in every mode (the
-> old `SOCKET_EXPERIMENTAL_MAVEN` / `SOCKET_EXPERIMENTAL_NUGET` opt-ins are retired).
+> **Maven / NuGet sidecar caveat**: Maven and NuGet are fully enabled in every mode.
 > In-place (agent-mode) patching leaves the caches' own checksum sidecars stale: NuGet's
 > post-apply fixup deletes `.nupkg.metadata` and raises an advisory for the
 > signed-package `.nupkg.sha512` tamper marker it cannot honestly rewrite; Maven's
diff --git a/docs/testing/bun-compatibility.md b/docs/testing/bun-compatibility.md
index 3c45a880..d4748450 100644
--- a/docs/testing/bun-compatibility.md
+++ b/docs/testing/bun-compatibility.md
@@ -452,7 +452,7 @@ table above.
 
 | Claim | Real-Bun matrix (`backtest-bun.py`) | Real-Bun hermetic suites (`ci.yml` `e2e`) | Bun-less unit / CLI tests |
 |---|---|---|---|
-| Text lock 0 / 1 / 2 rewritten and installed, both modes | 1.1.39–1.4.2 | `e2e_redirect_bun_build` + `e2e_vendor_bun_build` on 1.4.2 (3 OS), 1.1.45 and 1.2.23 (Linux); the fixture asserts the lock version matches the era table, the v1-on-1.4 leg proves a committed v1 lock keeps installing | goldens `lock-v0`, `basic` (v1), `lock-v2`; `bun_lock.rs`, `lock_inventory.rs` |
+| Text lock 0 / 1 / 2 rewritten and installed, both modes | 1.1.39–1.4.2 | `e2e_redirect_bun_build` + `e2e_vendor_bun_build` on 1.4.2 (3 OS), 1.1.45 and 1.2.23 (Linux); the fixture asserts the lock version matches the era table, the v1-on-1.4 leg proves a committed v1 lock keeps installing | goldens `lock-v0`, `basic` (v1), `lock-v2`; `bun_lock.rs`, `lock_inventory/bun.rs` |
 | Native binary formats 1 / 2 / 3: inventory, hosted, vendored, repair, takeovers, rollback | `direct`, `legacy-lockb`, conversion shapes; dedicated `backtest-bun-lockb.py` | `e2e_bun_lockb` across writer / reader revisions | `bun_lockb.rs` and committed real binary fixtures; native CLI tests |
 | Version-0 workspace hosted refusal + remedy | `text-workspace` (1.1.39–1.1.45) | — | golden `lock-v0-workspace-refusal` (+ `expected-warnings.json`), `redirect/mod.rs` unit tests |
 | Pre-v2 workspace vendored refusal (policy) + remedy; version 2 supported incl. nested | v1: 1.2.0–1.3.14 `workspace*`; v0: `text-workspace`; v2: 1.4.x | `e2e_vendor_bun_build` scoped leg (deps + bin meta survive) | `bun_lock.rs` (`legacy_workspace_tarballs_refuse_before_writes`, in-sync / rebuild exemptions), `in_process_vendor_bun`, `repair_vendor_flavors_e2e` over {0, 1, 2} × workspace shapes |
diff --git a/docs/testing/hosted-production-e2e.md b/docs/testing/hosted-production-e2e.md
index 7a43b921..f8af9328 100644
--- a/docs/testing/hosted-production-e2e.md
+++ b/docs/testing/hosted-production-e2e.md
@@ -38,14 +38,15 @@ from the child environment.
 
 | Ecosystem | PURL | Patch UUID | Advisory | Used by |
 |-----------|------|------------|----------|---------|
-| npm | `pkg:npm/minimist@1.2.2` | `80630680-4da6-45f9-bba8-b888e0ffd58c` | GHSA-xvch-5gv4-984h / CVE-2021-44906 | all five npm-family legs |
+| npm | `pkg:npm/minimist@1.2.2` | `80630680-4da6-45f9-bba8-b888e0ffd58c` | GHSA-xvch-5gv4-984h / CVE-2021-44906 | every npm-family leg (npm, npm-shrinkwrap, pnpm, yarn classic, yarn berry, bun, vlt) |
 | PyPI | `pkg:pypi/urllib3@1.26.18` | `de58c8b8-796c-4b6d-8a48-539b5563db76`, `26242e35-f867-4da8-8789-f0d2ea49e0f1`, `e828efa5-5c6d-43f3-9909-03f5ac232b98` | GHSA-38jv-5279-wg99, GHSA-2xpw-w6gg-jr37, GHSA-gm62-xv2j-4w53 | requirements.txt, uv.lock |
 | RubyGems | `pkg:gem/activestorage@6.0.3` | any of `15e960b5-f432-4b6c-b8aa-534a2b419323` (GHSA-m42x-37p3-fv5w / CVE-2020-8162), `6c4141c5-1535-4fd2-9db1-b5f8e4834bdb` (GHSA-w749-p3v6-hccq / CVE-2022-21831, published 2026-08-19), `eeb6bf9f-96c0-4963-a0f1-2e88f91f8b1a` (GHSA-9xrj-h377-fr87 / CVE-2026-33195, published 2026-08-20), `c1a1cd3c-b670-4e44-b4fa-1a63ecd42db6` (GHSA-r4mg-4433-c7g3 / CVE-2025-24293, published 2026-08-20), `9c2b4925-b413-4a3a-bb3a-9990440fb446` (GHSA-xr9x-r78c-5hrm / CVE-2026-66066, published 2026-08-21), `01019627-b481-4bae-bc09-e93b5a5e4481` (MERGED: CVE-2022-21831 + CVE-2025-24293 + CVE-2026-66066, published 2026-09-04) | see UUID column | bundler leg |
 
-urllib3 1.26.18 carries **three** distinct free patches, one per advisory. Which
-one the resolver returns is a server-side ordering detail, so the suite accepts
-any of the three rather than pinning one — pinning would go red on an unrelated
-server-side reorder.
+urllib3 1.26.18 carries **three** distinct free patches, one per advisory. The
+CLI picks one with its own ranking
+(`crates/socket-patch-core/src/api/ranking.rs`) over server-supplied severity
+and publish dates, so a newly published or re-scored patch can change the pick;
+the suite therefore accepts any of the three rather than pinning one.
 
 `preflight_required_patches_are_published` checks all three every run and fails
 first with the offending PURL named, so a withdrawn patch produces one clear
@@ -71,7 +72,7 @@ failure instead of N confusing ones that look like CLI regressions.
 | Ecosystem | Hosted mode | Free patches in production | Suite coverage |
 |-----------|-------------|----------------------------|----------------|
 | npm | ✅ | ✅ many | ✅ npm, npm-shrinkwrap, pnpm, yarn classic, yarn berry, bun; vlt probe-driven (see [vlt](#vlt-the-serve-encoding-gate)) |
-| PyPI | ✅ (requirements.txt, uv.lock, Pipfile.lock) | ✅ many | ✅ requirements.txt, uv.lock, Pipfile.lock |
+| PyPI | ✅ (requirements.txt, uv.lock, poetry.lock, pdm.lock, Pipfile.lock) | ✅ many | ✅ requirements.txt, uv.lock (poetry.lock / pdm.lock / Pipfile.lock via per-release backtests, see below) |
 | RubyGems | ✅ | ✅ (this suite pins one purl/UUID: `activestorage@6.0.3`; the 2026-08-18 republish covers more versions) | ✅ full bundler install proof |
 | Cargo | ✅ | ❌ **none** (tier emptied 2026-08-28) | canary only |
 | Maven | ✅ | ❌ **none** | canary only |
@@ -186,26 +187,13 @@ integrity rejection, peer instances, and rollback across pnpm majors 1–12.
 The production pnpm test proves installation from the public hosted service;
 it does not test the SBOM backend, dashboard badges, policies, or alert counts.
 
-### 3. `uv.lock` — the `sdist` entry is rewritten to a wheel URL (CLI, minor)
+### 3. `uv.lock` — the `sdist` entry was rewritten to a wheel URL (CLI) — FIXED
 
-The uv.lock rewriter points the `sdist` entry at the patched **wheel** and keeps
-the original sdist's `size`, producing an entry whose URL, hash and size are
-mutually inconsistent:
-
-```toml
-# pristine
-sdist  = { url = ".../urllib3-1.26.18.tar.gz",            hash = "sha256:f8ecc1bb…", size = 305687 }
-wheels = [{ url = ".../urllib3-1.26.18-py2.py3-none-any.whl", hash = "sha256:34b97092…", size = 143835 }]
-
-# after scan --mode hosted
-sdist  = { url = "…patch.socket.dev/…-py2.py3-none-any.whl", hash = "sha256:ccc9a9e0…", size = 305687 }
-wheels = [{ url = "…patch.socket.dev/…-py2.py3-none-any.whl", hash = "sha256:ccc9a9e0…", size = 143835 }]
-```
-
-uv tolerates it today because it prefers the wheel, so the leg passes. It would
-bite on a `--no-binary` resolve or a platform with no matching wheel. The
-rewriter should either leave `sdist` alone or update its `size` alongside the
-URL and hash.
+The uv.lock rewriter used to point the `sdist` entry at the patched wheel while
+keeping the original sdist's `size`. It now drops the entry's existing
+`sdist` / `wheel` / `wheels` / `archive` keys and writes back only the
+redirected artifact (a wheel goes in `wheels`), pinned by the urllib3 1.26.18
+unit test in `crates/socket-patch-core/src/utils/python_lock.rs`.
 
 ## Running
 
diff --git a/docs/testing/pipenv-compatibility.md b/docs/testing/pipenv-compatibility.md
index d758b72a..df7a0144 100644
--- a/docs/testing/pipenv-compatibility.md
+++ b/docs/testing/pipenv-compatibility.md
@@ -77,9 +77,8 @@ import on modern Pythons); 2018–2022 on Python 3.8; 2023+ on Python 3.12.
   interpreter's basename on 2026, the full string on 2018 and 11). The
   crawler reproduces it (and honours the `.venv` file pointer,
   `PIPENV_CUSTOM_VENV_NAME`, `PIPENV_PIPFILE`, `WORKON_HOME` and Pipenv's
-  case-insensitive-filesystem fallback) so a bare `scan`/`rollback` sees the
-  project's venv; before, it fell through to the global interpreter and
-  reported success while the venv stayed unpatched.
+  case-insensitive-filesystem fallback) so an agent-mode `scan`/`rollback`
+  run outside `pipenv run` sees the project's venv.
 - **CLI scope.** The CLI reads `<cwd>/Pipfile.lock` and discovers the
   project's venv from that directory; it does not walk up to a parent
   Pipfile the way Pipenv does (`PIPENV_MAX_DEPTH`) and does not follow
@@ -121,7 +120,7 @@ rejection, what `pipenv lock` does to the entry, rollback after that relock
 hybrid that still carries our reference rolls back to the original entry),
 `vex`, and a byte-exact `rollback`. Agent mode additionally checks that
 repeat installs and `sync` keep the in-place patch, and the out-of-tree leg
-requires the bare scan to see Pipenv's venv.
+requires an agent-mode scan run outside `pipenv run` to see Pipenv's venv.
 
 ## Results
 
diff --git a/docs/testing/uv-compatibility.md b/docs/testing/uv-compatibility.md
index e8a5c414..86b3f4e8 100644
--- a/docs/testing/uv-compatibility.md
+++ b/docs/testing/uv-compatibility.md
@@ -276,7 +276,7 @@ record from the ledgers or the patch API, and verifies the installed tree
   manifest, reverted and half-reverted pairs (including script pairs),
   tampered installed trees and wheel members, spoofed hosts and vendor paths,
   record mismatches, and the embedded `apply --vex` / `vendor --vex` /
-  `scan --redirect|--vendor --vex` paths.
+  `scan --mode hosted|vendored --vex` paths.
 - `e2e_redirect_uv_build` (hosted, wiremock patch API serving the patched
   wheel) and `e2e_vendor_pypi_build` (vendored) — the REAL uv under test
   (`SOCKET_PATCH_UV_E2E_BIN` / `_VERSION` / `_PYTHON` / `_REQUIRED`) builds
diff --git a/docs/testing/vendored-production-e2e.md b/docs/testing/vendored-production-e2e.md
index 8ec8191b..0d694500 100644
--- a/docs/testing/vendored-production-e2e.md
+++ b/docs/testing/vendored-production-e2e.md
@@ -48,8 +48,8 @@ three every run and fails first with the offending PURL named.
 | Ecosystem | PURL | Patch UUID | Marker in the patched bytes |
 |-----------|------|------------|-----------------------------|
 | npm | `pkg:npm/minimist@1.2.2` | `80630680-4da6-45f9-bba8-b888e0ffd58c` | `Socket Community Patch` header |
-| PyPI | `pkg:pypi/urllib3@1.26.18` | one of three (server-ordered) | `Socket Community Patch` header |
-| RubyGems | `pkg:gem/activestorage@6.0.3` | any of the `GEM_PATCHES` table (4 as of 2026-08-20 — see the hosted doc's UUID list; each patch marks a different file) | `Socket Community Patch` header |
+| PyPI | `pkg:pypi/urllib3@1.26.18` | one of three (picked by the CLI's `api::ranking`; the suite accepts any) | `Socket Community Patch` header |
+| RubyGems | `pkg:gem/activestorage@6.0.3` | any of the `GEM_PATCHES` table (each patch marks a different file). The hosted doc lists 6 live UUIDs; `GEM_PATCHES` carries only the first 4 and lacks `9c2b4925` and the merged `01019627`, which v5 ranking now prefers | `Socket Community Patch` header |
 
 If a required patch is withdrawn, update the catalog constants at the top of
 `e2e_vendored_production.rs` **and** the table above (same procedure as the
diff --git a/gem/socket-patch-bundler/README.md b/gem/socket-patch-bundler/README.md
index d897673b..e30f56fc 100644
--- a/gem/socket-patch-bundler/README.md
+++ b/gem/socket-patch-bundler/README.md
@@ -7,7 +7,8 @@ gem patches recorded in your project's `.socket/manifest.json` applied on every
 
 > **Status: Phase 2 (scaffolding).** `socket-patch setup` currently wires the gem
 > ecosystem by committing an in-tree copy of this plugin under
-> `.socket/bundler-plugin/` and referencing it from the `Gemfile` via `git:`.
+> `.socket/bundler-plugin/` and referencing it from the `Gemfile` via a `path:`
+> source (`plugin 'socket-patch', path: File.expand_path('.socket/bundler-plugin', __dir__)`).
 > This published gem is the planned replacement; once it is published to
 > RubyGems, a follow-up switches the generated `Gemfile` directive to
 > `plugin "socket-patch-bundler", "~> <major.minor>"`.
@@ -22,10 +23,11 @@ the cargo build-time guard.
 
 Two triggers feed one idempotent applier: a load-time pass (covers cached/no-op
 installs) and an `after-install-all` hook (covers fresh installs). A digest of
-the manifest + committed `.socket/` files + `Gemfile.lock` gates the work, and a
-stamp under `Bundler.bundle_path` travels with the gems. On any patch failure it
-raises `Bundler::BundlerError` so the build fails loudly rather than shipping
-unpatched gems.
+the manifest + committed `.socket/` files + `Gemfile.lock` + the patch-target
+files gates the work; the digest is cached in `.socket/gem-plugin-stamp`
+(machine-local, safe to gitignore or delete). On a patch failure it warns
+(naming the failure and the remediation) and lets `bundle install` continue;
+set `SOCKET_PATCH_STRICT=1` to raise `Bundler::BundlerError` instead.
 
 ## License
 
diff --git a/tests/docker/README.md b/tests/docker/README.md
index dd056df4..67611479 100644
--- a/tests/docker/README.md
+++ b/tests/docker/README.md
@@ -3,33 +3,28 @@
 This directory contains the Dockerfiles and per-ecosystem fixtures used
 by the `tests/docker_e2e_*.rs` integration tests. Each test installs a
 real package via its native package manager inside a Linux container
-and runs `socket-patch scan` (and, for npm, the full apply chain)
-against a wiremock-served patch fixture.
+and drives the full `socket-patch scan` → `apply` chain against a
+wiremock-served patch fixture, verifying the patched bytes on disk.
 
 ## What's tested
 
 | Ecosystem | Real installer command                                       | Test depth                |
 |-----------|---------------------------------------------------------------|---------------------------|
-| npm       | `npm install minimist@1.2.2`                                  | install + scan + apply + verify patched marker on disk |
-| pypi      | `pip install pydantic-ai==0.0.36` (in venv)                  | install + scan discovery  |
-| gem       | `gem install activestorage -v 5.2.0` (vendor/bundle)         | install + scan discovery  |
-| composer (vendor) | `composer update` (psr/log 3.0.x)                     | `docker_e2e_vendor_composer`: vendor → fresh-checkout `composer install --network none` → revert (see below) |
-| gem (vendor) | `bundle install` (rack ~> 3.1, bundler ~> 2.7)             | `docker_e2e_vendor_gem`: vendor → fresh-checkout frozen `bundle install --network none` → revert (see below) |
-| cargo     | `cargo fetch` with `serde = "=1.0.200"` in Cargo.toml         | install + scan discovery  |
-| golang    | `go mod download github.com/gin-gonic/gin@v1.9.1`             | install + scan discovery  |
-| maven     | `mvn dependency:get -Dartifact=org.apache.commons:commons-lang3:3.12.0` | install + scan discovery  |
-| composer  | `composer require monolog/monolog:3.5.0`                      | install + scan discovery  |
-| nuget     | `dotnet add package Newtonsoft.Json --version 13.0.3`         | install + scan discovery  |
-
-The "scan discovery" tests assert that:
-1. The package manager's installed-package layout is what we expect.
-2. socket-patch's crawler discovers that layout.
-3. The crawler reports the installed PURL to the (mocked) Socket API.
-4. The wiremock's batch-search response flows back into scan's
-   discovery output (`packagesWithPatches >= 1`).
-
-The npm test goes further and asserts the file on disk has been
-overwritten with the patched bytes.
+| npm       | `npm install minimist@1.2.2`                                  | install + scan + apply + rollback |
+| pypi      | `pip install six==1.16.0` (venv + system site-packages)       | install + scan + apply + verify |
+| gem       | `gem install colorize -v 1.1.0` (vendor/bundle + system)      | install + scan + apply + verify |
+| cargo     | `cargo fetch` with `cfg-if = "=1.0.0"` in Cargo.toml          | install + scan + apply + verify |
+| golang    | `go mod download github.com/gin-gonic/gin@v1.9.1`             | install + scan + apply + verify |
+| maven     | `mvn dependency:get -Dartifact=org.apache.commons:commons-lang3:3.12.0` | install + scan + apply + verify |
+| composer  | `composer require monolog/monolog:3.5.0` (local + global)     | install + scan + apply + verify |
+| nuget     | `dotnet add package Newtonsoft.Json --version 13.0.3` (local + global) | install + scan + apply + verify |
+| deno      | `deno install` of `minimist@1.2.2` into `node_modules/`, plus a synthetic JSR cache layout | install + scan + apply; JSR layout scan discovery |
+
+Each suite asserts the installed-package layout is what the crawler
+expects, that scan discovers the patch from the (mocked) Socket API, and
+that apply overwrites the installed file with the patched bytes (a
+`SOCKET-PATCH-E2E-MARKER` grep on disk). The vendor capstones are
+described below.
 
 ## Running locally
 
@@ -46,14 +41,14 @@ docker build -f tests/docker/Dockerfile.npm -t socket-patch-test-npm:latest .
 # Run a single ecosystem test:
 cargo test -p socket-patch-cli --features docker-e2e --test docker_e2e_npm
 
-# Run all 8 ecosystem tests (slow — ~3 min total):
-for eco in npm pypi gem cargo golang maven composer nuget; do
+# Run all 9 ecosystem tests (slow):
+for eco in npm pypi gem cargo golang maven composer nuget deno; do
   docker build -f tests/docker/Dockerfile.$eco -t socket-patch-test-$eco:latest .
 done
 cargo test -p socket-patch-cli --features docker-e2e \
   --test docker_e2e_npm --test docker_e2e_pypi --test docker_e2e_gem \
   --test docker_e2e_cargo --test docker_e2e_golang --test docker_e2e_maven \
-  --test docker_e2e_composer --test docker_e2e_nuget
+  --test docker_e2e_composer --test docker_e2e_nuget --test docker_e2e_deno
 ```
 
 A default `cargo test` (no `--features docker-e2e`) skips this entire
@@ -61,9 +56,19 @@ suite. Developers who aren't editing the test infra never need Docker.
 
 ## Vendor capstone suites (`docker_e2e_vendor_*`)
 
-`tests/docker_e2e_vendor_composer.rs` and `tests/docker_e2e_vendor_gem.rs`
-prove the CLI_CONTRACT "Vendor command contract" rows against the real
-package managers. Unlike the scan→apply suites they are MULTI-STAGE: a host
+Five suites prove the CLI_CONTRACT "Vendor command contract" rows against
+the real package managers, each in its ecosystem's image:
+
+| Suite | Image | Tooling |
+|-------|-------|---------|
+| `docker_e2e_vendor_composer` | `composer` | composer 2, psr/log 3.0.x |
+| `docker_e2e_vendor_gem` | `gem` | bundler ~> 2.7, rack ~> 3.1 |
+| `docker_e2e_vendor_maven` | `maven` | Apache Maven + JDK, commons-text 1.10.0 |
+| `docker_e2e_vendor_nuget` | `nuget` | .NET SDK 8.0, Newtonsoft.Json 13.0.3 |
+| `docker_e2e_vendor_pypi_pm` | `pypi` | poetry, pdm, pipenv on six 1.16.0 |
+
+CI's `e2e-docker` job runs the composer, nuget and pypi_pm capstones;
+`coverage-docker` runs all five. Unlike the scan→apply suites they are MULTI-STAGE: a host
 tempdir is bind-mounted at `/workspace` and shared across three `docker run`s
 (networked fixture install + offline `socket-patch vendor`; then a
 fresh-checkout install under `--network none` with cold caches; then
@@ -84,15 +89,15 @@ rebuild `Dockerfile.base` after changing vendor code or the runs test a
 stale binary. Note `Dockerfile.gem` is built on the official ruby image with
 bundler pinned `~> 2.7` (the series the gem vendor lock grammar was
 spike-validated against; bundler >= 2.7 needs ruby >= 3.2, newer than
-Debian 12's apt ruby). The gem suite runs against the default no-CHECKSUMS
-lock — the bundler >= 2.6 `lockfile_checksums` variant is a follow-up
-(see the TODO in `docker_e2e_vendor_gem.rs`).
+Debian 12's apt ruby). The gem suite covers both the default no-CHECKSUMS
+lock and a `lockfile_checksums` twin (`bundle lock --add-checksums`).
 
 ## Bundler-version matrix images (`Dockerfile.gem-b1`, `Dockerfile.gem-b4`)
 
 The plain `Dockerfile.gem` pins bundler `~> 2.7`. Two sibling images cover
-the ends of the bundler spectrum for the setup-matrix gem legs in
-`crates/socket-patch-cli/tests/setup_matrix_gem.rs`:
+the ends of the bundler spectrum. Only `gem-b1` feeds a gated leg (in
+`crates/socket-patch-cli/tests/setup_matrix_gem.rs`); `gem-b4` is a manual
+bundler-4 image with no gated leg:
 
 - `Dockerfile.gem-b1` — ruby 3.1 + **bundler 1.17.3** (last 1.x). Drives the
   bundler `>= 2.2` plugin floor: gem `setup` must refuse to wire a 1.x
@@ -134,15 +139,17 @@ SOCKET_PATCH_TEST_HOST=1 cargo test -p socket-patch-cli \
 
 ## CI
 
-`.github/workflows/ci.yml` runs an `e2e-docker` matrix across all 8
+`.github/workflows/ci.yml` runs an `e2e-docker` matrix across all 9
 ecosystems on every PR. Each matrix slot:
-1. Builds the base image (cached via GitHub Actions cache,
-   `type=gha,scope=test-base`).
-2. Builds the per-ecosystem image (cached per ecosystem).
-3. Runs the matching `docker_e2e_<eco>` test.
-
-The existing `e2e` job (which hits the real Socket API) stays for
-manual / scheduled real-API smoke runs.
+1. Builds the base image (no GitHub Actions cache — left out on purpose
+   because of zizmor's cache-poisoning audit).
+2. Builds the per-ecosystem image.
+3. Runs the matching `docker_e2e_<eco>` test, plus that ecosystem's vendor
+   capstone where it has one in this job (composer, nuget, pypi_pm).
+
+The separate `e2e` job is the per-PR real-toolchain host matrix. The
+live-API smoke suites (`e2e_npm`, `e2e_pypi`, `e2e_gem`, `e2e_scan`) are
+not in CI; run them by hand with `--ignored`.
 
 ## Adding a new ecosystem
 
diff --git a/tests/setup_matrix/README.md b/tests/setup_matrix/README.md
index bd46496f..adf8b8a1 100644
--- a/tests/setup_matrix/README.md
+++ b/tests/setup_matrix/README.md
@@ -5,9 +5,9 @@ This suite verifies the **intended** end-to-end behavior of
 package-manager install applies the project's patches *on its own*, with
 no explicit `scan`/`apply` step.
 
-It is **experimental and non-blocking**. `setup` only configures
-npm-family install hooks today, so most non-npm cases are *expected to
-fail*. The suite encodes the **aspirational** end state and records a
+It is **experimental and non-blocking**. `setup` configures npm-family,
+pip/uv/hatch (the `.pth` hook), Bundler (plugin) and Composer hooks; the
+remaining ecosystems are the *expected-to-fail* `known_gap` cases. The suite encodes the **aspirational** end state and records a
 per-case **baseline** of what works now — the failing cases are a TODO
 list for `setup`, not a broken test.
 
@@ -118,6 +118,7 @@ and the recorded `baseline`:
 | `known_gap`  | fails the ideal, exactly as recorded — expected today, non-blocking |
 | `progress`   | better than the recorded baseline — update `baseline_supported` in `matrix.json`! |
 | `regression` | diverged from the baseline the wrong way — the only thing that fails the runner |
+| `known_regression` | would be a regression, but is on the matrix.json `known_regressions` allowlist (tracked, non-blocking) |
 | `error`      | the driver produced no parseable result |
 
 The Rust wrappers (`tests/setup_matrix_<eco>.rs`) assert the **ideal**

From d6438a3bf8d17bfeabca8e9da8636abb595d5eae Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Sun, 27 Sep 2026 16:43:12 -0400
Subject: [PATCH 10/32] Clean up stale and narrative comments across the tree

Comments and doc comments now describe the current code:
- references to renamed or deleted functions, files, tests and flags are
  fixed;
- notes about pre-v5 scan behavior (prompts, report-only non-TTY scans,
  severity-first ranking, PATH rejection) are gone;
- TODOs for finished work are removed;
- history narration ("used to", bug diaries, PR and audit tags, dated
  verification notes) is rewritten as the invariant it protects;
- doc comments attached to the wrong item are moved.

Two CI path filters that named the deleted vendor/lock_inventory.rs now
match vendor/lock_inventory/**. No code behavior changes.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .cargo/config.toml                            |    2 +-
 .github/workflows/bun-compatibility.yml       |    2 +-
 .github/workflows/ci.yml                      |   90 +-
 .github/workflows/pdm-compatibility.yml       |    2 +-
 .github/workflows/pipenv-compatibility.yml    |    2 +-
 .github/workflows/publish-rubygems.yml        |    4 +-
 .github/workflows/release.yml                 |    3 +-
 .gitignore                                    |    5 -
 Cargo.toml                                    |    7 +-
 crates/socket-patch-cli/Cargo.toml            |    3 +-
 crates/socket-patch-cli/src/args.rs           |   15 +-
 crates/socket-patch-cli/src/commands/apply.rs |   43 +-
 .../src/commands/fetch_stage.rs               |   17 +-
 .../src/commands/hosted_bundle.rs             |    3 +-
 crates/socket-patch-cli/src/commands/list.rs  |   78 +-
 .../socket-patch-cli/src/commands/lock_cli.rs |   20 +-
 crates/socket-patch-cli/src/commands/mod.rs   |    4 +-
 .../socket-patch-cli/src/commands/remove.rs   |    7 +-
 .../socket-patch-cli/src/commands/repair.rs   |   14 +-
 .../src/commands/repair_vendor.rs             |   38 +-
 .../socket-patch-cli/src/commands/rollback.rs |   92 +-
 .../socket-patch-cli/src/commands/scan/gc.rs  |  171 +--
 .../src/commands/scan/hosted.rs               |  466 +++-----
 .../src/commands/scan/hosted/python.rs        |   12 +-
 .../src/commands/scan/hosted/vlt.rs           |    5 +-
 .../socket-patch-cli/src/commands/scan/mod.rs | 1031 ++++++-----------
 .../src/commands/scan/render.rs               |   14 +-
 .../src/commands/scan/vendor_flow.rs          |  178 +--
 crates/socket-patch-cli/src/commands/setup.rs |   16 +-
 .../socket-patch-cli/src/commands/update.rs   |   12 +-
 .../socket-patch-cli/src/commands/vendor.rs   |  596 ++++------
 crates/socket-patch-cli/src/commands/vex.rs   |  132 +--
 .../src/commands/vex_consumed.rs              |   45 +-
 .../src/commands/vex_sources.rs               |   52 +-
 .../src/commands/vlt_preflight.rs             |    2 +-
 .../src/ecosystem_dispatch.rs                 |   57 +-
 crates/socket-patch-cli/src/json_envelope.rs  |   45 +-
 crates/socket-patch-cli/src/path_scope.rs     |    9 +-
 crates/socket-patch-cli/src/ui/prompt.rs      |    6 +-
 .../tests/api_client_errors_e2e.rs            |   22 +-
 .../tests/apply_invariants.rs                 |   15 +-
 .../socket-patch-cli/tests/apply_network.rs   |   32 +-
 .../tests/cli_apply_silent.rs                 |    3 -
 .../tests/cli_config_fallback.rs              |    2 +-
 .../tests/cli_gem_variant_mismatch_policy.rs  |   13 +-
 .../socket-patch-cli/tests/cli_global_args.rs |   28 +-
 .../socket-patch-cli/tests/cli_parse_apply.rs |   25 +-
 .../socket-patch-cli/tests/cli_parse_get.rs   |    4 +-
 .../socket-patch-cli/tests/cli_parse_list.rs  |   26 +-
 .../tests/cli_parse_repair.rs                 |    5 +-
 .../tests/cli_parse_rollback.rs               |    2 +-
 .../socket-patch-cli/tests/cli_parse_scan.rs  |   29 +-
 .../socket-patch-cli/tests/cli_parse_setup.rs |    6 +-
 .../socket-patch-cli/tests/cli_parse_vex.rs   |    2 +-
 .../tests/cli_remove_silent.rs                |    9 +-
 .../tests/cli_rollback_silent.rs              |    3 -
 .../socket-patch-cli/tests/cli_scan_silent.rs |   25 +-
 .../tests/cli_setup_silent.rs                 |   10 +-
 .../tests/common/update_fixture.rs            |    3 +-
 .../coverage_fix_apply_silent_mute_exit.rs    |    5 +-
 .../tests/coverage_fix_get_double_json.rs     |   12 +-
 ...ge_fix_rollback_ecosystem_scoped_replay.rs |    2 +-
 ...erage_fix_scan_discovery_corrupt_ledger.rs |   20 +-
 ...overage_fix_scan_hosted_dryrun_vendored.rs |   32 +-
 .../tests/covgap_api_client.rs                |    2 +-
 .../tests/covgap_commands_apply.rs            |   21 +-
 .../tests/covgap_commands_fetch_stage.rs      |   19 +-
 .../tests/covgap_commands_list.rs             |   11 +-
 .../tests/covgap_commands_remove.rs           |   95 +-
 .../tests/covgap_commands_repair.rs           |    4 +-
 .../tests/covgap_commands_repair_vendor.rs    |   19 +-
 .../tests/covgap_commands_rollback.rs         |   36 +-
 .../tests/covgap_commands_scan_hosted.rs      |   29 +-
 .../tests/covgap_commands_scan_mod.rs         |   50 +-
 .../tests/covgap_commands_scan_vendor_flow.rs |    4 +-
 .../tests/covgap_commands_setup.rs            |   13 +-
 .../tests/covgap_commands_update.rs           |   39 +-
 .../tests/covgap_commands_vendor.rs           |   13 +-
 .../tests/covgap_commands_vex.rs              |   24 +-
 .../tests/covgap_ecosystem_dispatch.rs        |    3 +-
 .../socket-patch-cli/tests/covgap_output.rs   |   11 +-
 .../tests/covgap_setup_gem_mod.rs             |    2 +-
 .../tests/covgap_setup_gem_version.rs         |    3 +-
 .../tests/covgap_update_download.rs           |    2 +-
 .../tests/covgap_update_swap.rs               |    2 +-
 .../socket-patch-cli/tests/docker_e2e_gem.rs  |    2 -
 .../socket-patch-cli/tests/docker_e2e_npm.rs  |   19 +-
 .../tests/docker_e2e_vendor_maven.rs          |    3 +-
 .../tests/docker_e2e_vendor_pypi_pm.rs        |   17 +-
 .../tests/docker_vendor_common/mod.rs         |    2 +-
 crates/socket-patch-cli/tests/e2e_cargo.rs    |   26 +-
 crates/socket-patch-cli/tests/e2e_composer.rs |   15 +-
 .../tests/e2e_embedded_vex.rs                 |   23 +-
 crates/socket-patch-cli/tests/e2e_gem.rs      |    6 +-
 .../tests/e2e_hosted_production.rs            |   73 +-
 crates/socket-patch-cli/tests/e2e_maven.rs    |   24 +-
 crates/socket-patch-cli/tests/e2e_nuget.rs    |   21 +-
 crates/socket-patch-cli/tests/e2e_pypi.rs     |    2 +-
 .../tests/e2e_redirect_bun_build.rs           |    6 +-
 .../tests/e2e_redirect_cargo_build.rs         |    4 +-
 .../tests/e2e_redirect_gem_build.rs           |   30 +-
 .../tests/e2e_redirect_npm_build.rs           |    4 +-
 .../tests/e2e_redirect_pnpm_build.rs          |    4 +-
 .../tests/e2e_redirect_rush_sim.rs            |    5 +-
 .../tests/e2e_redirect_yarn_berry_build.rs    |    6 +-
 .../tests/e2e_redirect_yarn_classic_build.rs  |    6 +-
 .../tests/e2e_safety_advisories.rs            |   39 +-
 .../tests/e2e_safety_cargo_build.rs           |   14 +-
 .../socket-patch-cli/tests/e2e_safety_cow.rs  |   28 +-
 .../tests/e2e_safety_internals.rs             |   29 +-
 .../socket-patch-cli/tests/e2e_safety_lock.rs |    6 +-
 .../tests/e2e_safety_yarn_pnp.rs              |   33 +-
 crates/socket-patch-cli/tests/e2e_scan.rs     |   27 +-
 .../tests/e2e_vendor_bun_build.rs             |   12 +-
 .../tests/e2e_vendor_cargo_build.rs           |   32 +-
 .../tests/e2e_vendor_composer_build.rs        |   17 +-
 .../tests/e2e_vendor_gem_build.rs             |    7 +-
 .../tests/e2e_vendor_golang_build.rs          |   17 +-
 .../tests/e2e_vendor_npm_build.rs             |    2 +-
 .../tests/e2e_vendor_pnpm_build.rs            |   10 +-
 .../tests/e2e_vendor_pypi_build.rs            |   16 +-
 .../tests/e2e_vendor_yarn_berry_build.rs      |    8 +-
 .../tests/e2e_vendor_yarn_classic_build.rs    |    9 +-
 .../tests/e2e_vendor_yarn_classic_dev_flow.rs |    4 +-
 .../tests/e2e_vendored_production.rs          |   43 +-
 crates/socket-patch-cli/tests/e2e_vex.rs      |   22 +-
 .../tests/e2e_vex_lockfile/bun.rs             |    9 +-
 .../tests/e2e_vex_lockfile/cargo.rs           |    2 +-
 .../tests/e2e_vex_lockfile/deno.rs            |    8 +-
 .../tests/e2e_vex_lockfile/golang.rs          |    2 +-
 .../tests/e2e_vex_lockfile/npm.rs             |   18 +-
 .../tests/e2e_vex_lockfile/nuget.rs           |    4 +-
 .../tests/e2e_vex_lockfile/uv.rs              |    8 +-
 .../tests/e2e_vex_lockfile/yarn.rs            |    3 +-
 .../tests/e2e_vex_lockfile/yarn_berry.rs      |    8 +-
 .../tests/e2e_vex_redirect.rs                 |   23 +-
 .../socket-patch-cli/tests/e2e_vex_vendor.rs  |   19 +-
 .../tests/e2e_yarn4_pnpm_linker_build.rs      |    2 +-
 .../tests/e2e_yarn4_workspaces_build.rs       |    2 +-
 .../e2e_yarn_legacy_cachekey_refusal_build.rs |    6 +-
 .../tests/ecosystem_dispatch_e2e.rs           |   21 +-
 .../tests/get_batch_paths_e2e.rs              |   14 +-
 .../tests/get_edge_cases_e2e.rs               |   15 +-
 .../socket-patch-cli/tests/get_modes_e2e.rs   |    4 +-
 .../tests/get_update_summary_e2e.rs           |    2 +-
 .../tests/global_packages_e2e.rs              |    3 +-
 .../tests/hosted_symlinked_files.rs           |    2 +-
 .../tests/in_process_gem_apply.rs             |    8 +-
 .../tests/in_process_gem_fallback_home.rs     |    4 +-
 .../tests/in_process_gem_multicopy.rs         |    8 +-
 .../tests/in_process_get_update_count.rs      |   11 +-
 .../tests/in_process_npm_multicopy.rs         |    6 +-
 .../tests/in_process_pypi_apply.rs            |   15 +-
 .../tests/in_process_redirect.rs              |   17 +-
 .../tests/in_process_redirect_pipenv.rs       |    4 +-
 .../tests/in_process_redirect_pnpm.rs         |    5 +-
 .../in_process_remote_ecosystems_apply.rs     |   10 +-
 .../in_process_remove_repair_lifecycle.rs     |    6 +-
 .../in_process_rollback_all_ecosystems.rs     |   32 +-
 .../tests/in_process_rollback_hosted.rs       |    3 +-
 .../socket-patch-cli/tests/in_process_scan.rs |   49 +-
 .../tests/in_process_vendor.rs                |   48 +-
 .../tests/in_process_vendor_bun.rs            |   17 +-
 .../tests/in_process_vendor_bun_takeover.rs   |   25 +-
 .../tests/interactive_prompts_e2e.rs          |   16 +-
 .../tests/mode_migration_bun.rs               |    5 +-
 .../tests/mode_migration_cargo.rs             |   11 +-
 .../tests/mode_migration_npm.rs               |   16 +-
 .../tests/output_helpers_e2e.rs               |    2 +-
 .../tests/remove_duality_invariants.rs        |   19 +-
 .../tests/remove_invariants.rs                |   20 +-
 .../socket-patch-cli/tests/remove_network.rs  |   13 +-
 .../tests/repair_invariants.rs                |   14 +-
 .../tests/repair_vendor_e2e.rs                |    4 +-
 .../tests/repair_vendor_flavors_e2e.rs        |   11 +-
 .../tests/rollback_invariants.rs              |   40 +-
 .../tests/rollback_multicopy_blob_gate.rs     |    9 +-
 .../tests/scan_ecosystems_scope_e2e.rs        |   12 +-
 .../socket-patch-cli/tests/scan_invariants.rs |   31 +-
 .../socket-patch-cli/tests/scan_paths_e2e.rs  |   11 +-
 .../socket-patch-cli/tests/scan_sync_e2e.rs   |    2 +-
 .../socket-patch-cli/tests/scan_vendor_e2e.rs |   25 +-
 .../socket-patch-cli/tests/self_update_e2e.rs |    6 +-
 .../tests/setup_contract_gaps.rs              |    2 +-
 .../tests/setup_invariants.rs                 |   17 +-
 .../tests/setup_matrix_common/mod.rs          |   16 +-
 .../tests/setup_matrix_composer.rs            |   11 +-
 .../tests/setup_matrix_deno.rs                |    5 +-
 .../tests/setup_matrix_gem.rs                 |   29 +-
 .../tests/setup_matrix_maven.rs               |   18 +-
 .../tests/setup_matrix_npm.rs                 |    6 +-
 .../tests/setup_matrix_nuget.rs               |   14 +-
 .../tests/setup_matrix_pypi.rs                |    5 +-
 .../socket-patch-cli/tests/telemetry_e2e.rs   |   31 +-
 .../tests/vendor_gem_lockfile_only_e2e.rs     |    5 +-
 .../tests/vendor_partial_staging_e2e.rs       |   12 +-
 .../tests/vendor_rerun_no_network_e2e.rs      |   24 +-
 .../tests/vex_e2e_common/mod.rs               |    4 +-
 .../tests/vex_e2e_common/uv.rs                |    6 +-
 .../tests/vex_pdm_hatch_common/mod.rs         |    8 +-
 .../tests/vex_pipenv_pip_common/mod.rs        |    6 +-
 .../tests/vlt_e2e_common/fixture.rs           |    6 +-
 .../tests/vlt_e2e_common/mod.rs               |    8 +-
 crates/socket-patch-core/Cargo.toml           |    3 +-
 .../socket-patch-core/src/api/blob_fetcher.rs |    3 +-
 crates/socket-patch-core/src/api/client.rs    |   39 +-
 crates/socket-patch-core/src/api/date.rs      |    3 +-
 crates/socket-patch-core/src/api/types.rs     |   15 +-
 crates/socket-patch-core/src/constants.rs     |    5 +-
 .../src/crawlers/cargo_crawler.rs             |    2 +-
 .../src/crawlers/composer_crawler.rs          |   17 +-
 .../src/crawlers/maven_crawler.rs             |    2 +-
 .../src/crawlers/npm_crawler.rs               |   29 +-
 .../src/crawlers/nuget_crawler.rs             |   15 +-
 .../src/crawlers/python_crawler.rs            |   40 +-
 .../src/crawlers/ruby_crawler.rs              |   22 +-
 .../src/crawlers/walk_pool.rs                 |   36 +-
 crates/socket-patch-core/src/lib.rs           |    2 +-
 .../src/manifest/cleanup_blobs.rs             |    6 +-
 .../src/manifest/operations.rs                |    2 +-
 .../socket-patch-core/src/manifest/schema.rs  |    9 +-
 .../src/package_json/detect.rs                |   17 +-
 .../src/package_json/find.rs                  |   43 +-
 .../src/package_json/update.rs                |    2 +-
 crates/socket-patch-core/src/patch/apply.rs   |   87 +-
 .../socket-patch-core/src/patch/apply_lock.rs |   31 +-
 .../socket-patch-core/src/patch/copy_tree.rs  |    3 +-
 crates/socket-patch-core/src/patch/diff.rs    |   23 +-
 crates/socket-patch-core/src/patch/mod.rs     |    5 +-
 crates/socket-patch-core/src/patch/package.rs |   19 +-
 .../redirect/cargo_lock_equivalence_tests.rs  |    2 +-
 .../redirect/composer_equivalence_tests.rs    |    2 +-
 .../redirect/golang_equivalence_tests.rs      |    2 +-
 .../src/patch/redirect/golang_local.rs        |    3 +-
 .../patch/redirect/group_equivalence_tests.rs |    2 +-
 .../src/patch/redirect/mod.rs                 |  358 +++---
 .../src/patch/redirect/npmrc.rs               |   42 +-
 .../src/patch/redirect/pipenv.rs              |    2 +-
 .../redirect/python_lock_equivalence_tests.rs |    2 +-
 .../src/patch/redirect/replay.rs              |   17 +-
 .../src/patch/redirect/state.rs               |   33 +-
 .../src/patch/redirect/takeover.rs            |   70 +-
 .../src/patch/redirect/vlt.rs                 |   12 +-
 .../src/patch/redirect/vlt_heal.rs            |    4 +-
 .../socket-patch-core/src/patch/rollback.rs   |  116 +-
 .../src/patch/sidecars/cargo.rs               |   73 +-
 .../src/patch/sidecars/mod.rs                 |    5 +-
 .../src/patch/sidecars/nuget.rs               |   31 +-
 .../src/patch/sidecars/types.rs               |    7 +-
 .../src/setup/composer/mod.rs                 |    8 +-
 crates/socket-patch-core/src/setup/gem/mod.rs |    2 +-
 crates/socket-patch-core/src/setup/mod.rs     |    4 +-
 .../src/setup/pypi/detect.rs                  |    2 +-
 crates/socket-patch-core/src/telemetry.rs     |    4 +-
 .../socket-patch-core/src/utils/concurrent.rs |   10 +-
 .../socket-patch-core/src/utils/durability.rs |    6 +-
 .../socket-patch-core/src/utils/env_compat.rs |    2 +-
 crates/socket-patch-core/src/utils/fs.rs      |   11 +-
 .../src/utils/group_commit.rs                 |   11 +-
 crates/socket-patch-core/src/utils/mod.rs     |    2 +-
 .../socket-patch-core/src/utils/pdm_lock.rs   |    4 +-
 crates/socket-patch-core/src/utils/pipenv.rs  |    7 +-
 .../src/utils/poetry_lock.rs                  |   10 +-
 crates/socket-patch-core/src/utils/process.rs |   12 +-
 crates/socket-patch-core/src/utils/purl.rs    |   22 +-
 .../src/utils/requirements.rs                 |    2 +-
 .../socket-patch-core/src/utils/socket_dir.rs |    8 +-
 .../socket-patch-core/src/vendor/berry_zip.rs |   27 +-
 .../src/vendor/bun_binary.rs                  |    2 +-
 .../socket-patch-core/src/vendor/bun_lock.rs  |   21 +-
 .../src/vendor/bun_lock_text.rs               |    5 +-
 crates/socket-patch-core/src/vendor/cargo.rs  |   60 +-
 .../src/vendor/cargo_config.rs                |   20 +-
 .../src/vendor/cargo_lock.rs                  |   68 +-
 crates/socket-patch-core/src/vendor/common.rs |   21 +-
 .../src/vendor/composer_lock.rs               |   28 +-
 crates/socket-patch-core/src/vendor/gem.rs    |  132 +--
 .../src/vendor/gemfile_lock.rs                |    5 +-
 .../src/vendor/go_mod_edit.rs                 |    7 +-
 .../src/vendor/go_sum_edit.rs                 |   12 +-
 crates/socket-patch-core/src/vendor/golang.rs |    8 +-
 .../src/vendor/ledger_snapshots.rs            |    4 +-
 .../src/vendor/lock_inventory/gem.rs          |    1 -
 .../src/vendor/lock_inventory/npm_family.rs   |   10 +-
 .../src/vendor/lock_inventory/pypi.rs         |   21 +-
 .../lock_inventory/python_lock_union_tests.rs |    9 +-
 .../vendor/lock_inventory/recover_tests.rs    |   12 +-
 .../src/vendor/lock_inventory/tests.rs        |   32 +-
 .../src/vendor/lock_inventory/view.rs         |    2 +-
 .../src/vendor/lock_inventory/vlt.rs          |    2 +-
 .../src/vendor/maven_repo.rs                  |   12 +-
 crates/socket-patch-core/src/vendor/mod.rs    |   49 +-
 .../src/vendor/npm_common.rs                  |   19 +-
 .../socket-patch-core/src/vendor/npm_dir.rs   |   18 +-
 .../src/vendor/npm_flavor.rs                  |   40 +-
 .../socket-patch-core/src/vendor/npm_lock.rs  |   53 +-
 .../socket-patch-core/src/vendor/npm_pack.rs  |    2 +-
 .../src/vendor/nuget_feed.rs                  |   52 +-
 .../src/vendor/parse_memo.rs                  |    4 +-
 .../socket-patch-core/src/vendor/pnpm_lock.rs |   64 +-
 .../src/vendor/pnpm_lock_legacy.rs            |   49 +-
 .../socket-patch-core/src/vendor/prestage.rs  |    2 +-
 crates/socket-patch-core/src/vendor/pypi.rs   |  139 +--
 .../socket-patch-core/src/vendor/pypi_lock.rs |   28 +-
 .../socket-patch-core/src/vendor/pypi_pdm.rs  |   43 +-
 .../src/vendor/pypi_pipenv.rs                 |   86 +-
 .../src/vendor/pypi_poetry.rs                 |   42 +-
 .../src/vendor/pypi_requirements.rs           |   11 +-
 .../socket-patch-core/src/vendor/pypi_uv.rs   |   92 +-
 .../src/vendor/pypi_wheel.rs                  |   15 +-
 .../src/vendor/registry_fetch.rs              |  133 +--
 crates/socket-patch-core/src/vendor/reuse.rs  |   30 +-
 .../src/vendor/service_fetch.rs               |    5 +-
 crates/socket-patch-core/src/vendor/source.rs |   27 +-
 crates/socket-patch-core/src/vendor/state.rs  |   13 +-
 .../src/vendor/toml_surgery.rs                |   19 +-
 crates/socket-patch-core/src/vendor/verify.rs |   22 +-
 .../socket-patch-core/src/vendor/vlt_lock.rs  |   30 +-
 .../src/vendor/vlt_lock_text.rs               |    5 +-
 .../src/vendor/yarn_berry_lock.rs             |   75 +-
 .../src/vendor/yarn_classic_lock.rs           |   44 +-
 .../src/vendor/yarn_layering_tests.rs         |   30 +-
 crates/socket-patch-core/src/vex/build.rs     |   15 +-
 .../src/vex/discover/cargo.rs                 |    5 +-
 .../src/vex/discover/deno.rs                  |    5 +-
 .../socket-patch-core/src/vex/discover/gem.rs |    9 +-
 .../src/vex/discover/maven.rs                 |    2 +-
 .../socket-patch-core/src/vex/discover/mod.rs |   16 +-
 .../src/vex/discover/testing/golden.rs        |    3 +-
 .../socket-patch-core/src/vex/discover/vlt.rs |    2 +-
 crates/socket-patch-core/src/vex/product.rs   |   33 +-
 crates/socket-patch-core/src/vex/schema.rs    |    3 +-
 crates/socket-patch-core/src/vex/verify.rs    |   12 +-
 .../socket-patch-core/tests/api_retry_e2e.rs  |    2 +-
 .../binary_fetch_error_classification_e2e.rs  |   17 +-
 .../tests/blob_fetcher_edges_e2e.rs           |    2 +-
 .../tests/covgap_api_blob_fetcher.rs          |    9 +-
 .../tests/covgap_crawlers_npm_crawler.rs      |    4 +-
 .../tests/crawler_cargo_e2e.rs                |   29 +-
 .../tests/crawler_composer_e2e.rs             |   25 +-
 .../socket-patch-core/tests/crawler_go_e2e.rs |    9 +-
 .../tests/crawler_maven_e2e.rs                |   22 +-
 .../tests/crawler_monorepo_gaps.rs            |    2 +-
 .../tests/crawler_npm_e2e.rs                  |  167 ++-
 .../tests/crawler_nuget_e2e.rs                |   20 +-
 .../tests/crawler_python_e2e.rs               |   37 +-
 .../tests/crawler_ruby_e2e.rs                 |   10 +-
 crates/socket-patch-core/tests/diff_e2e.rs    |    7 +-
 crates/socket-patch-core/tests/package_e2e.rs |   10 +-
 .../socket-patch-core/tests/poetry_hosted.rs  |    7 +-
 .../tests/proxy_batch_e2e.rs                  |   13 +-
 .../tests/redirect_golden.rs                  |    2 +-
 gem/socket-patch/lib/socket_patch/launcher.rb |    4 +-
 .../src/schema/manifest-schema.ts             |    2 +-
 pypi/socket-patch-hook/pyproject.toml         |    9 +-
 pypi/socket-patch/pyproject.toml              |    5 +-
 scripts/backtest-pipenv.py                    |    3 -
 scripts/fix-vuln.config.ts                    |    5 +-
 scripts/optimize-test-perf.config.ts          |   10 +-
 scripts/study-crates.ts                       |    2 +-
 tests/setup_matrix/run-case.sh                |   19 +-
 tests/setup_matrix/shims/npx                  |    6 +-
 tests/setup_matrix/shims/pnpm                 |    2 +-
 363 files changed, 3957 insertions(+), 5414 deletions(-)

diff --git a/.cargo/config.toml b/.cargo/config.toml
index fb6aa41c..e0acd1cd 100644
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@@ -1,6 +1,6 @@
 # Windows main threads get a 1 MiB stack reserve by default (Unix mains get
 # 8 MiB). The CLI's async command futures poll deeply nested state machines
-# — scan → download → in-process apply, or scan --vendor → the vendor engine
+# — scan → download → in-process apply, or a vendored scan → the vendor engine
 # — and in debug builds (no stack-slot reuse) the summed poll frames exceed
 # 1 MiB, aborting with "thread 'main' has overflowed its stack" on Windows
 # only. Raise the PE stack reserve to the Unix default; spawned threads are
diff --git a/.github/workflows/bun-compatibility.yml b/.github/workflows/bun-compatibility.yml
index 94ee2941..d5982448 100644
--- a/.github/workflows/bun-compatibility.yml
+++ b/.github/workflows/bun-compatibility.yml
@@ -50,7 +50,7 @@ on:
   # (rust-cache keys on Cargo.lock, so Cargo.lock belongs here) and re-runs
   # the matrix post-merge on the code paths it exercises: the vendored engine
   # (`vendor/**` — bun_lock.rs, bun_lock_text.rs's shared version gate,
-  # npm_flavor.rs, lock_inventory.rs), the hosted rewriter + unwinds, and the
+  # npm_flavor.rs, lock_inventory/), the hosted rewriter + unwinds, and the
   # CLI drivers (`scan/**` — hosted.rs, vendor_flow.rs, mod.rs — plus the
   # vendor / repair / remove commands the matrix runs).
   push:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a5ce8bba..4a260c8f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -45,10 +45,9 @@ jobs:
         # Swatinem/rust-cache instead of a raw actions/cache of the whole
         # target/ dir: it prunes the cache to dependency artifacts (~5-10x
         # smaller), which keeps this repo's total cache footprint inside
-        # GitHub's 10 GiB budget — previously a single main run produced
-        # ~8 GiB of caches and every PR save evicted them (cold e2e legs
-        # recompiled the full ~275-crate graph each run). save-if restricts
-        # writes to main so PR branches restore without churning the budget.
+        # GitHub's 10 GiB budget (a raw target/ cache let every PR save evict
+        # main's caches). save-if restricts writes to main so PR branches
+        # restore without churning the budget.
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           save-if: ${{ github.ref == 'refs/heads/main' }}
@@ -253,13 +252,8 @@ jobs:
         run: rustup show
 
       - name: Cache cargo
-        # Swatinem/rust-cache instead of a raw actions/cache of the whole
-        # target/ dir: it prunes the cache to dependency artifacts (~5-10x
-        # smaller), which keeps this repo's total cache footprint inside
-        # GitHub's 10 GiB budget — previously a single main run produced
-        # ~8 GiB of caches and every PR save evicted them (cold e2e legs
-        # recompiled the full ~275-crate graph each run). save-if restricts
-        # writes to main so PR branches restore without churning the budget.
+        # Swatinem/rust-cache, main-only saves: see the first `Cache cargo`
+        # step in this file.
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           save-if: ${{ github.ref == 'refs/heads/main' }}
@@ -292,13 +286,12 @@ jobs:
         # Retried: the install compiles sigstore/cosign, whose module
         # verification reads dozens of sum.golang.org checksum tiles, and
         # transient INTERNAL_ERROR stream resets there have failed this
-        # step on otherwise-green runs (2026-08-20: two attempts ~18 min
-        # apart, different modules each time — an upstream incident, not
-        # one bad tile). The backoff rides out short resets; a persistent
-        # outage still fails loudly on the last attempt. Follow-up option
-        # if this recurs: install the pinned release BINARY (sha256-pinned)
-        # instead of compiling, which sidesteps module verification and
-        # drops ~100s of compile time per leg.
+        # step on otherwise-green runs. The backoff rides out short
+        # resets; a persistent outage still fails loudly on the last
+        # attempt. Follow-up option if this recurs: install the pinned
+        # release BINARY (sha256-pinned) instead of compiling, which
+        # sidesteps module verification and drops ~100s of compile time per
+        # leg.
         shell: bash
         run: |
           for attempt in 1 2 3 4 5; do
@@ -325,9 +318,7 @@ jobs:
         #
         # `--no-fail-fast`: without it cargo stops at the first failing test
         # BINARY, so one bad file hides every later binary's result on that
-        # OS (2026-09-03: two Windows-only fixture failures in
-        # covgap_commands_get masked ~180 binaries that had never run on
-        # Windows at all). Run them all and fail at the end instead.
+        # OS. Run them all and fail at the end instead.
         shell: bash
         env:
           # The real-go hosted/vendored suites (`#![cfg(unix)]`) ride the Go
@@ -363,13 +354,8 @@ jobs:
         run: rustup show
 
       - name: Cache cargo
-        # Swatinem/rust-cache instead of a raw actions/cache of the whole
-        # target/ dir: it prunes the cache to dependency artifacts (~5-10x
-        # smaller), which keeps this repo's total cache footprint inside
-        # GitHub's 10 GiB budget — previously a single main run produced
-        # ~8 GiB of caches and every PR save evicted them (cold e2e legs
-        # recompiled the full ~275-crate graph each run). save-if restricts
-        # writes to main so PR branches restore without churning the budget.
+        # Swatinem/rust-cache, main-only saves: see the first `Cache cargo`
+        # step in this file.
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           save-if: ${{ github.ref == 'refs/heads/main' }}
@@ -418,13 +404,8 @@ jobs:
           tool: cargo-llvm-cov@0.8.7
 
       - name: Cache cargo
-        # Swatinem/rust-cache instead of a raw actions/cache of the whole
-        # target/ dir: it prunes the cache to dependency artifacts (~5-10x
-        # smaller), which keeps this repo's total cache footprint inside
-        # GitHub's 10 GiB budget — previously a single main run produced
-        # ~8 GiB of caches and every PR save evicted them (cold e2e legs
-        # recompiled the full ~275-crate graph each run). save-if restricts
-        # writes to main so PR branches restore without churning the budget.
+        # Swatinem/rust-cache, main-only saves: see the first `Cache cargo`
+        # step in this file.
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           save-if: ${{ github.ref == 'refs/heads/main' }}
@@ -480,7 +461,7 @@ jobs:
     #
     # Hooks: docker_e2e_<eco>.rs reads SOCKET_PATCH_COV_BIN +
     # SOCKET_PATCH_COV_PROFRAW_DIR. Both unset is the no-op default
-    # (used by the e2e-docker matrix above).
+    # (used by the e2e-docker matrix below).
     #
     # Pin to ubuntu-22.04 (glibc 2.35) instead of ubuntu-latest
     # (currently 24.04, glibc 2.39). The instrumented binary built
@@ -706,8 +687,8 @@ jobs:
           - os: ubuntu-latest
             suite: e2e_composer
             # composer is a shipped ecosystem, so e2e_composer's tests are
-            # NOT `#[ignore]`-gated the way the experimental-ecosystem suites
-            # (maven, nuget) are — the matrix default `--ignored` filter
+            # NOT `#[ignore]`-gated the way the live-registry maven/nuget
+            # suites are — the matrix default `--ignored` filter
             # selected zero tests here and the leg passed vacuously.
             # `--include-ignored` runs them, plus any capstone added later.
             test_filter: --include-ignored
@@ -973,9 +954,9 @@ jobs:
           - {os: ubuntu-latest, suite: e2e_vlt, vlt: '1.0.7', test_filter: --include-ignored vlt_pinned_matrix}
           - {os: windows-latest, suite: e2e_vlt, vlt: '1.0.0-rc.14', test_filter: --include-ignored vlt_pinned_matrix}
           # The named corepack pnpm hosted legs (pnpm 7-11, get-uuid,
-          # zero-touch, --trust-lockfile). `#[ignore]`d and previously run in
-          # no job; the pinned matrix inside the same suite runs in
-          # pnpm-compatibility.yml, hence the skip. Node 24 (step below): the
+          # zero-touch, --trust-lockfile). `#[ignore]`d; the pinned matrix
+          # inside the same suite runs in pnpm-compatibility.yml, hence the
+          # skip. Node 24 (step below): the
           # corepack pnpm@10/11 legs require it.
           - {os: ubuntu-latest, suite: e2e_redirect_pnpm_build, test_filter: '--ignored --skip pnpm_pinned_matrix'}
           - {os: macos-latest, suite: e2e_redirect_pnpm_build, test_filter: '--ignored --skip pnpm_pinned_matrix'}
@@ -1104,13 +1085,8 @@ jobs:
         run: rustup show
 
       - name: Cache cargo
-        # Swatinem/rust-cache instead of a raw actions/cache of the whole
-        # target/ dir: it prunes the cache to dependency artifacts (~5-10x
-        # smaller), which keeps this repo's total cache footprint inside
-        # GitHub's 10 GiB budget — previously a single main run produced
-        # ~8 GiB of caches and every PR save evicted them (cold e2e legs
-        # recompiled the full ~275-crate graph each run). save-if restricts
-        # writes to main so PR branches restore without churning the budget.
+        # Swatinem/rust-cache, main-only saves: see the first `Cache cargo`
+        # step in this file.
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           # Matrix suites otherwise collide on one key: only one of the ~9
@@ -1407,8 +1383,9 @@ jobs:
   # managers and run socket-patch against a wiremock-served fixture —
   # no real Socket API contact. Hermetic, reproducible.
   #
-  # Triggered on every PR. The existing `e2e` job above stays for
-  # `--ignored` real-API smoke runs (manual / scheduled).
+  # Triggered on every PR. The `e2e` job above runs the
+  # `#[ignore]`-gated real-toolchain capstones; the live-API smoke suites
+  # are run by hand (see the note in its matrix).
   # ----------------------------------------------------------------------
   e2e-docker:
     runs-on: ubuntu-latest
@@ -1459,9 +1436,10 @@ jobs:
       - name: Run ${{ matrix.ecosystem }} Docker e2e test
         # Every ecosystem is unconditionally compiled in; only the
         # `docker-e2e` feature is needed to compile the suite itself.
-        # The vendored build-proof capstones (each ending in the
-        # manifest-less VEX stage) ride the same image as their ecosystem's
-        # main suite, as in coverage-docker.
+        # The composer/nuget/pypi vendored build-proof capstones (each
+        # ending in the manifest-less VEX stage) ride the same image as
+        # their ecosystem's main suite; the gem and maven vendor capstones
+        # run only in coverage-docker.
         run: |
           EXTRA=""
           case "${{ matrix.ecosystem }}" in
@@ -1644,9 +1622,9 @@ jobs:
   # tests/setup_matrix/ and scripts/setup-matrix.sh.
   #
   # This is EXPERIMENTAL and intentionally not required to pass yet:
-  # `setup` only configures npm-family install hooks today, so most
-  # non-npm `baseline_with_setup` cases are EXPECTED to fail (a baseline
-  # of what `setup` must eventually support). `continue-on-error: true`
+  # `setup` configures install hooks for npm, PyPI, Bundler and Composer
+  # only, so the other ecosystems' `baseline_with_setup` cases are
+  # EXPECTED to fail (a baseline of what `setup` must eventually support). `continue-on-error: true`
   # means this job never blocks a PR — it must ALSO be left OUT of the
   # repo's required status checks (configured in the branch-protection
   # UI, not in this file). The orchestrator exits non-zero only on a
diff --git a/.github/workflows/pdm-compatibility.yml b/.github/workflows/pdm-compatibility.yml
index dc7ecc14..ef4401b6 100644
--- a/.github/workflows/pdm-compatibility.yml
+++ b/.github/workflows/pdm-compatibility.yml
@@ -16,7 +16,7 @@ on:
       - 'crates/socket-patch-core/src/patch/redirect/**'
       - 'crates/socket-patch-core/src/vendor/pypi*.rs'
       - 'crates/socket-patch-core/src/vendor/common.rs'
-      - 'crates/socket-patch-core/src/vendor/lock_inventory.rs'
+      - 'crates/socket-patch-core/src/vendor/lock_inventory/**'
       - 'crates/socket-patch-cli/src/commands/scan/**'
       - 'crates/socket-patch-cli/src/commands/rollback.rs'
       - 'crates/socket-patch-core/tests/fixtures/pdm-native/**'
diff --git a/.github/workflows/pipenv-compatibility.yml b/.github/workflows/pipenv-compatibility.yml
index 6d7d9c90..a24d9bd2 100644
--- a/.github/workflows/pipenv-compatibility.yml
+++ b/.github/workflows/pipenv-compatibility.yml
@@ -14,7 +14,7 @@ on:
       - 'crates/socket-patch-core/src/patch/redirect/pipenv.rs'
       - 'crates/socket-patch-core/src/vendor/pypi_pipenv.rs'
       - 'crates/socket-patch-core/src/vendor/pypi.rs'
-      - 'crates/socket-patch-core/src/vendor/lock_inventory.rs'
+      - 'crates/socket-patch-core/src/vendor/lock_inventory/**'
       - 'crates/socket-patch-core/src/crawlers/python_crawler.rs'
       - 'crates/socket-patch-core/src/utils/pipenv.rs'
       - 'crates/socket-patch-cli/src/commands/scan/hosted.rs'
diff --git a/.github/workflows/publish-rubygems.yml b/.github/workflows/publish-rubygems.yml
index a8e48b3d..01238d0f 100644
--- a/.github/workflows/publish-rubygems.yml
+++ b/.github/workflows/publish-rubygems.yml
@@ -144,8 +144,8 @@ jobs:
 
       # Phase 2 scaffolding (CLI_CONTRACT "gem" support matrix): publish the
       # `socket-patch-bundler` gem — the published form of the Bundler plugin
-      # that `socket-patch setup` currently wires via an in-tree `git:`
-      # reference. This gem is NOT yet the active mechanism (setup::gem still
+      # that `socket-patch setup` currently wires through an in-tree
+      # `plugin ..., path:` directive. This gem is NOT yet the active mechanism (setup::gem still
       # emits the in-tree plugin), so the push is **non-blocking**
       # (`continue-on-error`). A follow-up switches the generated Gemfile
       # directive to `plugin "socket-patch-bundler"` and drops
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7c2abcb4..3336c096 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -31,8 +31,7 @@ name: Release
 #      registration per package covers everything, on every registry.
 #   2. GitHub suppresses events caused by this workflow's own GITHUB_TOKEN —
 #      a `release: published` (or `push: tags:`) trigger in another file
-#      would never fire, which is why the old design kept every publish job
-#      in this file — but workflow_dispatch (and repository_dispatch) events
+#      would never fire — but workflow_dispatch (and repository_dispatch) events
 #      are documented exceptions, so `gh workflow run` with GITHUB_TOKEN
 #      works without a PAT/GitHub App token.
 #
diff --git a/.gitignore b/.gitignore
index b3a6faf3..d7c6d412 100644
--- a/.gitignore
+++ b/.gitignore
@@ -145,11 +145,6 @@ vite.config.ts.timestamp-*
 # Rust
 target/
 
-# Maven / NuGet launcher build output
-maven/socket-patch/target/
-nuget/socket-patch/bin/
-nuget/socket-patch/obj/
-
 # npm binaries (populated at publish time)
 npm/socket-patch/bin/socket-patch-*
 
diff --git a/Cargo.toml b/Cargo.toml
index b985c700..6a95c787 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -67,7 +67,7 @@ opt-level = "s"
 
 # CI-only profile for the test-release job. Inherits the shipped profile's
 # semantics (opt-level = "s", debug-assertions off, overflow-checks off) —
-# which is what test-release exists to validate (commit b96a13f) — but drops
+# which is what test-release exists to validate — but drops
 # the full-LTO link: ~23m of that job's ~29m was LTO-relinking 159 test
 # binaries, and LTO relinks are structurally uncacheable. release.yml still
 # builds the real full-LTO [profile.release] for every shipped target.
@@ -84,9 +84,8 @@ lto = "thin"
 
 # Test-execution speed: `cargo test` builds dependencies with the dev
 # profile; at opt-level 0 the hash/compression/bsdiff hot loops are 10-100x
-# slower (the self_update fixture family measured 403s debug vs ~2s release
-# on CI run 30289993021 — it gzips and sha256-hashes the multi-MB debug CLI
-# binary per test). Workspace members are NOT matched by "*" — they stay
+# slower (the self_update fixtures gzip and sha256-hash the multi-MB debug
+# CLI binary per test: ~403s debug vs ~2s release). Workspace members are NOT matched by "*" — they stay
 # opt-level 0, so incremental compile speed, debugging, and llvm-cov line
 # fidelity (reports filter to workspace crates) are unchanged. Dependencies
 # keep debug-assertions and overflow-checks ON — only codegen opt changes.
diff --git a/crates/socket-patch-cli/Cargo.toml b/crates/socket-patch-cli/Cargo.toml
index 9d9166e2..4858d339 100644
--- a/crates/socket-patch-cli/Cargo.toml
+++ b/crates/socket-patch-cli/Cargo.toml
@@ -45,8 +45,7 @@ windows-sys = { workspace = true, features = ["Win32_Foundation", "Win32_System_
 [features]
 # Every ecosystem (npm, PyPI, Ruby gems, Go, Cargo, NuGet, Maven, Composer,
 # Deno) is unconditionally compiled in AND enabled at runtime — there are no
-# ecosystem feature gates and no runtime env gates (the old
-# SOCKET_EXPERIMENTAL_MAVEN/NUGET opt-ins are retired).
+# ecosystem feature gates and no runtime env gates.
 # The only features left gate opt-in test suites:
 #
 # Enables the Docker-driven real-package e2e test suite under
diff --git a/crates/socket-patch-cli/src/args.rs b/crates/socket-patch-cli/src/args.rs
index f8820a9b..8ada7e0c 100644
--- a/crates/socket-patch-cli/src/args.rs
+++ b/crates/socket-patch-cli/src/args.rs
@@ -886,8 +886,8 @@ mod tests {
     /// `scrub_empty_env_vars` removes exactly-empty `SOCKET_*` flag vars
     /// (the `VAR=` blank-without-unsetting idiom) — global and local — and
     /// nothing else: set, non-empty values — even whitespace-only ones,
-    /// which are significant in paths — survive, and the
-    /// previously-crashing parse then sees plain defaults.
+    /// which are significant in paths — survive, and the parse then sees
+    /// plain defaults.
     #[test]
     #[serial_test::serial]
     fn scrub_empty_env_vars_unsets_only_empties() {
@@ -983,8 +983,7 @@ mod tests {
     }
 
     /// Regression: scan's vendored flow must build its service config FROM
-    /// `--vendor-source`, not hardcode build-only (the pre-fix `service =
-    /// None`). Under the default (`auto`), the config must permit the
+    /// `--vendor-source`, not hardcode build-only. Under the default (`auto`), the config must permit the
     /// vendoring service exactly as the `vendor` command's default does —
     /// otherwise `scan --mode vendored` silently builds locally while a
     /// plain `vendor` service-downloads, and the two commit different bytes /
@@ -1105,7 +1104,7 @@ mod tests {
         }
     }
 
-    /// The bug fix: an empty (or whitespace-only) string is `false`, not an
+    /// An empty (or whitespace-only) string is `false`, not an
     /// error. Shells/CI export `SOCKET_OFFLINE=` to mean "unset".
     #[test]
     fn parse_bool_flag_treats_empty_as_false() {
@@ -1122,9 +1121,9 @@ mod tests {
         assert!(parse_bool_flag("tru").is_err());
     }
 
-    /// Regression: an exported-but-empty bool env var must NOT crash the parse.
-    /// Before the fix, `BoolishValueParser` aborted with "value was not a
-    /// boolean", taking down every subcommand. Now it resolves to `false`.
+    /// Regression: an exported-but-empty bool env var must NOT crash the parse
+    /// (`BoolishValueParser` rejects it, taking down every subcommand); it
+    /// resolves to `false`.
     #[test]
     #[serial_test::serial]
     fn empty_bool_env_var_parses_as_false_not_crash() {
diff --git a/crates/socket-patch-cli/src/commands/apply.rs b/crates/socket-patch-cli/src/commands/apply.rs
index 0e14f686..b1b932eb 100644
--- a/crates/socket-patch-cli/src/commands/apply.rs
+++ b/crates/socket-patch-cli/src/commands/apply.rs
@@ -338,7 +338,7 @@ pub struct ApplyArgs {
     #[command(flatten)]
     pub vex: VexEmbedArgs,
 
-    /// Set when `get` / `scan --apply/--sync` runs this apply as its last
+    /// Set when `get` / `scan --mode agent` runs this apply as its last
     /// step (`None` for the `apply` command itself). Not a CLI flag.
     #[arg(skip)]
     pub nested: Option<NestedApply>,
@@ -363,8 +363,7 @@ impl ApplyArgs {
 }
 
 // ── local-go redirect helpers ────────────────────────────────────────────────
-// The Go analog of the cargo helpers above: in local mode a `pkg:golang/…` PURL
-// redirects to a project-local patched copy under `.socket/go-patches/` wired via
+// In local mode a `pkg:golang/…` PURL redirects to a project-local patched copy under `.socket/go-patches/` wired via
 // a `go.mod` `replace` directive.
 
 /// True for a golang PURL in local mode (no `--global` / `--global-prefix`).
@@ -738,9 +737,8 @@ fn manifest_targets_npm(manifest: &PatchManifest) -> bool {
 /// Print the yarn-PnP refusal (JSON envelope or human stderr) and return
 /// apply's refusal exit code. Shared by the pre-manifest gate and the
 /// package-manager layout gate below: scan cannot discover PnP packages so
-/// it never writes a manifest, which used to leave the calm `noManifest`
-/// exit as the ONLY thing a PnP user ever saw — the documented loud
-/// `yarn_pnp_unsupported` refusal was unreachable without a manifest.
+/// it never writes a manifest, and the loud `yarn_pnp_unsupported` refusal
+/// must still be reachable without one.
 fn refuse_yarn_pnp(args: &ApplyArgs) -> i32 {
     if args.common.json {
         let mut env = Envelope::new(Command::Apply);
@@ -909,7 +907,7 @@ pub async fn run(args: ApplyArgs) -> i32 {
 /// package-manager layout gate, the apply loop, embedded VEX, output and
 /// telemetry — over a `lock` the caller already holds and the caller's
 /// `client`. [`run`] takes the lock itself; agent-mode `get` and
-/// `scan --apply/--sync` call this straight after their manifest write, so
+/// `scan --mode agent` call this straight after their manifest write, so
 /// download → manifest write → apply is ONE lock window (a same-process
 /// re-acquire would contend) and the nested apply never builds a second
 /// client. `lock` is released explicitly once every mutation is done
@@ -1353,9 +1351,11 @@ struct ApplyOutcome {
     results: Vec<ApplyResult>,
     /// In-scope manifest purls with no installed package on disk.
     unmatched: Vec<String>,
-    /// Run-level advisories: JSON `warnings[]`, one gated stderr line each
-    /// on the human path (`--silent` = errors only). Today: the gem
-    /// config-root containment skip.
+    /// Run-level advisories: JSON `warnings[]`, and one gated stderr line
+    /// each on the human path (`--silent` = errors only) except the
+    /// sources-unavailable codes (already printed by the stager): the gem
+    /// config-root containment skip and the sources-unavailable reason
+    /// (`run` adds `ownership_not_restored`).
     run_warnings: Vec<RunWarning>,
     /// Gem-env fallback-home copies deliberately left unpatched
     /// (best-effort class): one non-fatal `Skipped` event each in the
@@ -1687,10 +1687,9 @@ async fn apply_patches_inner(
     if partitioned.is_empty() {
         // Nothing in scope: the manifest lists no patches (or every patch was
         // filtered out by `--ecosystems`). There is genuinely no work to do,
-        // so this is a clean no-op SUCCESS — not a failure. Returning `false`
-        // here used to exit 1 / `partialFailure`, which broke the npm
-        // `postinstall` hook (it runs `apply` on every install, including
-        // fresh projects whose manifest has no matching patches yet). Decided
+        // so this is a clean no-op SUCCESS — not a failure: the npm
+        // `postinstall` hook runs `apply` on every install, including fresh
+        // projects whose manifest has no matching patches yet. Decided
         // BEFORE the ledger read, gem discovery and the crawl — none of which
         // can add work to an empty scope — but AFTER the staging above, which
         // is where `--download-mode` is validated at runtime.
@@ -1787,8 +1786,8 @@ async fn apply_patches_inner(
         let mut unmatched = unmatched;
         unmatched.sort();
         // This diagnostic flips the exit code, so it is an error — and it
-        // prints even under --silent ("errors only", never nothing — the
-        // hooked `apply --silent` used to exit 1 mutely here); `--json`
+        // prints even under --silent ("errors only", never a mute exit 1);
+        // `--json`
         // mutes stderr and the envelope's `package_not_installed` events
         // are the channel.
         if !unmatched.is_empty() && args.prints_errors() {
@@ -2098,7 +2097,7 @@ async fn apply_patches_inner(
             if is_vendored(purl) {
                 continue;
             }
-            // npm PURLs: direct lookup
+            // Non-variant PURLs: direct lookup
             let patch = match manifest.patches.get(purl) {
                 Some(p) => p,
                 None => continue,
@@ -2115,8 +2114,8 @@ async fn apply_patches_inner(
                 // Local go redirects to a project-local patched copy under
                 // `.socket/go-patches/` wired via a `go.mod` `replace` (the
                 // module cache is `go.sum`-verified, so in-place patching
-                // can't build). Everything else — npm/pypi/gem and cargo
-                // (vendored or registry cache) — patches in place via
+                // can't build). Everything else in this branch (npm, cargo,
+                // composer, nuget, …) patches in place via
                 // `apply_package_patch`.
                 let result =
                     match try_local_go_apply(purl, pkg_path, patch, &sources, &args.common, policy)
@@ -2422,10 +2421,8 @@ mod tests {
     /// Regression: a non-installed release variant whose first patched
     /// file is `NotFound` (e.g. an sdist patching `setup.py` while only a
     /// wheel is on disk) must be treated as NOT installed and skipped —
-    /// exactly like a `HashMismatch`. Before the fix the loop only skipped
-    /// `HashMismatch`, so a `NotFound` variant slipped through to
-    /// `apply_package_patch` and produced a spurious `Failed` event in the
-    /// JSON envelope. This pins the apply-side decision to the same
+    /// exactly like a `HashMismatch`, never reaching `apply_package_patch`
+    /// as a spurious `Failed` event. This pins the apply-side decision to the same
     /// Ready/AlreadyPatched contract as `select_installed_variants`.
     #[test]
     fn variant_matches_only_when_first_file_ready_or_already_patched() {
diff --git a/crates/socket-patch-cli/src/commands/fetch_stage.rs b/crates/socket-patch-cli/src/commands/fetch_stage.rs
index c0ac01ec..e60bddb9 100644
--- a/crates/socket-patch-cli/src/commands/fetch_stage.rs
+++ b/crates/socket-patch-cli/src/commands/fetch_stage.rs
@@ -175,11 +175,6 @@ fn format_fetch_failures(result: &FetchMissingBlobsResult, (one, many): Noun) ->
     lines
 }
 
-/// Announce the per-file blob top-up that follows a diff-mode fetch. It
-/// runs even when every diff archive arrived — a diff cannot patch a file
-/// whose bytes differ from `beforeHash`, and the pipeline then falls back
-/// to the blob — so it is worded as a complement, not a failure, unless
-/// some archives really were unavailable.
 /// The disk stager's status line while it downloads what `.socket/` lacks.
 const DOWNLOADING_ARTIFACTS: &str = "Downloading missing patch artifacts...";
 
@@ -188,6 +183,11 @@ fn format_fetching_content(n: usize) -> String {
     format!("Fetching content for {}...", plural(n, "patch", "patches"))
 }
 
+/// Announce the per-file blob top-up that follows a diff-mode fetch. It
+/// runs even when every diff archive arrived — a diff cannot patch a file
+/// whose bytes differ from `beforeHash`, and the pipeline then falls back
+/// to the blob — so it is worded as a complement, not a failure, unless
+/// some archives really were unavailable.
 fn format_blob_fallback(diff_failed: usize, blobs: usize) -> String {
     let blobs = plural(blobs, "per-file blob", "per-file blobs");
     if diff_failed == 0 {
@@ -311,8 +311,7 @@ pub(crate) async fn stage_patch_sources(
     // locally. We honor `--download-mode` for the primary fetch when there's
     // actually a gap to close. Skip the archive fetch entirely when all file
     // blobs are already present locally — the pipeline will succeed via the
-    // blob path, and the archive endpoints would just 404 (current server
-    // doesn't serve them yet).
+    // blob path, so an archive fetch would be wasted round-trips.
     let download_needed = !common.offline
         && match download_mode {
             DownloadMode::File => !missing_blobs.is_empty(),
@@ -1127,9 +1126,7 @@ mod tests {
     /// A local package archive is a usable source (the pipeline's Strategy 1,
     /// and exactly what the offline gate rules), so an online run whose
     /// downloads all fail must still be Ready when the package archive covers
-    /// every patch. Regression: the failure gate used aggregate fetch
-    /// counters and never consulted package archives, so this cache state was
-    /// Unavailable online while succeeding with --offline.
+    /// every patch, exactly as it succeeds with --offline.
     #[tokio::test]
     async fn stage_online_fetch_failure_accepts_local_package_archive() {
         let tmp = tempfile::tempdir().unwrap();
diff --git a/crates/socket-patch-cli/src/commands/hosted_bundle.rs b/crates/socket-patch-cli/src/commands/hosted_bundle.rs
index 67fe2bb1..392ac771 100644
--- a/crates/socket-patch-cli/src/commands/hosted_bundle.rs
+++ b/crates/socket-patch-cli/src/commands/hosted_bundle.rs
@@ -11,7 +11,8 @@
 //! "presentOnly"?: [path], "symlinks"?: [path], "projectRoots"?: [dir],
 //! "pipenvMajor"?: n, "batchSize"?: n}`. Stdout: the engine result
 //! (`HostedScanResult`, binary contents base64), or
-//! `{"status":"error","error":{"code","message"}}` with exit 1.
+//! `{"status":"error","error":{"code","message"}}` with exit 2 for bad
+//! credentials/bundle input, or exit 1 for an engine failure.
 
 use std::collections::BTreeMap;
 use std::io::Read;
diff --git a/crates/socket-patch-cli/src/commands/list.rs b/crates/socket-patch-cli/src/commands/list.rs
index 65ab4bc5..6bbc5e76 100644
--- a/crates/socket-patch-cli/src/commands/list.rs
+++ b/crates/socket-patch-cli/src/commands/list.rs
@@ -28,9 +28,7 @@ enum Source {
     Manifest,
     /// A hosted redirect-ledger record: `scan --mode hosted` records its
     /// patches ONLY in `.socket/vendor/redirect-state.json` and never
-    /// writes the manifest — without these, a purely hosted-wired project
-    /// listed as `manifest_not_found` while its patches were demonstrably
-    /// live.
+    /// writes the manifest.
     Hosted,
     /// A vendor-ledger record: vendored mode is manifest-free, so every
     /// `scan`/`get --mode vendored` patch lives ONLY in
@@ -120,14 +118,8 @@ fn combined_entries<'a>(
 ///
 /// Events are emitted in the entries' given order — [`combined_entries`]
 /// owns the by-PURL event sort; this builder sorts each event's
-/// vulnerabilities (by advisory ID) and files (by path). `HashMap`
-/// iteration is otherwise nondeterministic, so without these sorts the
-/// vuln/file ordering would change run-to-run — breaking consumers that
-/// diff this output in CI logs. Mirrors the stable-ordering guarantee
-/// `get` already provides for its vulnerability lists.
-///
-/// Shared by `run` and the unit tests so the tests exercise the exact code
-/// path `list --json` uses, rather than a hand-copied duplicate.
+/// vulnerabilities (by advisory ID) and files (by path) so the output is
+/// stable across runs (`HashMap` iteration is not).
 fn build_list_envelope(entries: &[ListEntry<'_>]) -> Envelope {
     let mut env = Envelope::new(Command::List);
 
@@ -253,11 +245,7 @@ fn format_entry(entry: &ListEntry<'_>, color: bool) -> String {
     let mut lines = vec![format!("Package: {}", sanitize(entry.purl))];
     lines.extend(field("  ", "UUID", &patch.uuid));
     if let Some((mode, ledger)) = ledger_label(entry.source) {
-        // Same labeling rule as the JSON details: the record comes from a
-        // ledger, not the manifest — hosted installs resolve the package
-        // to the hosted patch server, vendored ones to the committed
-        // `.socket/vendor/` artifact; no manifest entry exists or is
-        // needed.
+        // Same labeling rule as the JSON details.
         lines.push(format!("  Mode: {mode} (recorded in {ledger})"));
     }
     lines.extend(field("  ", "Tier", &patch.tier));
@@ -265,7 +253,6 @@ fn format_entry(entry: &ListEntry<'_>, color: bool) -> String {
     lines.extend(field("  ", "Exported", &patch.exported_at));
     lines.extend(field("  ", "Description", &patch.description));
 
-    // Sort vulnerabilities by advisory ID for stable output.
     let mut vuln_entries: Vec<_> = patch.vulnerabilities.iter().collect();
     vuln_entries.sort_by(|a, b| a.0.cmp(b.0));
     if !vuln_entries.is_empty() {
@@ -290,7 +277,6 @@ fn format_entry(entry: &ListEntry<'_>, color: bool) -> String {
         }
     }
 
-    // Sort patched files by path for stable output.
     let mut file_list: Vec<_> = patch.files.keys().collect();
     file_list.sort();
     if !file_list.is_empty() {
@@ -323,23 +309,16 @@ pub async fn run(args: ListArgs) -> i32 {
 
     // `read_manifest` is the single source of truth for the three error
     // states: `Ok(None)` (file absent), `Err(InvalidData)` (present but
-    // unparseable), and any other `Err` (genuine I/O failure). We deliberately
-    // do NOT stat the path first: a `metadata` pre-check is both redundant and
-    // wrong — it reports *any* stat failure (e.g. an unreadable parent dir) as
-    // `manifest_not_found`, masking real I/O errors that owe a
-    // `manifest_unreadable`, and it opens a TOCTOU window where a file removed
-    // between the stat and the read lands in the wrong error arm.
+    // unparseable), and any other `Err` (genuine I/O failure). No stat
+    // pre-check: it would report any stat failure as `manifest_not_found`
+    // and open a TOCTOU window.
     let manifest = match read_manifest(&manifest_path).await {
         Ok(manifest) => manifest,
         Err(e) => {
-            // A manifest that exists but is unparseable (bad JSON or a
-            // schema violation) surfaces as `ErrorKind::InvalidData` — the
-            // contract's `manifest_invalid`. Everything else is a genuine
-            // I/O failure (`manifest_unreadable`). Conflating the two would
-            // tell a consumer to retry on a corrupt file, or to give up on a
-            // transient I/O error. See CLI_CONTRACT.md error-code table.
-            // Hosted-ledger records never mask either: a present-but-broken
-            // manifest is an error state, not a hosted-only project.
+            // `InvalidData` (bad JSON or schema) is the contract's
+            // `manifest_invalid`; everything else is `manifest_unreadable`
+            // (see CLI_CONTRACT.md error-code table). Ledger records never
+            // mask either: a present-but-broken manifest is an error state.
             let code = if e.kind() == std::io::ErrorKind::InvalidData {
                 "manifest_invalid"
             } else {
@@ -398,12 +377,7 @@ pub async fn run(args: ListArgs) -> i32 {
         vendor_state.as_ref().map(|s| &s.entries),
     );
     if manifest.is_none() && entries.is_empty() {
-        // No manifest AND no ledger records: nothing is listable anywhere —
-        // the classic missing-manifest error. `read_manifest` returns
-        // `Ok(None)` only when the file does not exist (its documented
-        // contract), so this is `manifest_not_found`, NOT `manifest_invalid`
-        // (which means the file is present but corrupt). See CLI_CONTRACT.md
-        // error-code table.
+        // No manifest AND no ledger records: nothing is listable anywhere.
         emit_error(
             &args,
             "manifest_not_found",
@@ -413,15 +387,11 @@ pub async fn run(args: ListArgs) -> i32 {
         return 1;
     }
 
-    // Records found (either store) ⇒ a successful list, exit 0 — including
-    // the purely hosted-wired project that used to hard-fail here.
+    // Records found (any store) ⇒ a successful list, exit 0.
     //
-    // Telemetry: `patch_listed`'s `patches_count` predates the hosted
-    // folding and its consumers read it as "manifest patches", so it keeps
-    // counting the manifest ONLY (0 on a hosted-only project) — folding the
-    // listed entries in would silently redefine the metric and double-count
-    // purls present in both stores. Hosted visibility, if wanted, belongs
-    // in a new dedicated field.
+    // Telemetry: `patch_listed`'s `patches_count` means "manifest patches"
+    // to its consumers, so it counts the manifest ONLY (0 on a ledger-only
+    // project) rather than the listed entries.
     let manifest_patch_count = manifest.as_ref().map_or(0, |m| m.patches.len());
     let (api_token, org_slug) = args.common.telemetry_credentials();
     track_patch_listed(
@@ -436,9 +406,7 @@ pub async fn run(args: ListArgs) -> i32 {
         env.warnings = warnings;
         println!("{}", env.to_pretty_json());
     } else if args.common.silent {
-        // `--silent` is "errors only" (CLI_CONTRACT.md): suppress the
-        // entire human-readable listing, mirroring `get`/`repair`.
-        // The exit code still distinguishes the manifest states.
+        // `--silent` is "errors only" (CLI_CONTRACT.md).
     } else {
         println!("{}", format_listing(&entries, crate::ui::stdout_color()));
     }
@@ -448,8 +416,8 @@ pub async fn run(args: ListArgs) -> i32 {
 
 #[cfg(test)]
 mod tests {
-    //! Inline tests for `list` JSON output. Pin the new envelope shape
-    //! so downstream consumers (PR bots, dashboards) can rely on it.
+    //! Inline tests for `list` output. Pin the envelope shape so downstream
+    //! consumers (PR bots, dashboards) can rely on it.
     use super::*;
     use socket_patch_core::manifest::schema::{PatchFileInfo, PatchRecord, VulnerabilityInfo};
     use std::collections::HashMap;
@@ -601,11 +569,9 @@ mod tests {
         assert_eq!(v["summary"]["discovered"], 0);
     }
 
-    // -- Regression: stable ordering -------------------------------------
-    // `HashMap` iteration order is randomized per run, so without explicit
-    // sorting the events / vulnerabilities / files arrays would shuffle
-    // between invocations. These pin the sorted contract so consumers can
-    // diff `list --json` output in CI logs.
+    // -- Stable ordering -------------------------------------------------
+    // Pin the sorted events / vulnerabilities / files contract so consumers
+    // can diff `list --json` output.
 
     #[test]
     fn events_are_sorted_by_purl() {
diff --git a/crates/socket-patch-cli/src/commands/lock_cli.rs b/crates/socket-patch-cli/src/commands/lock_cli.rs
index 6b804c07..3e9d01b0 100644
--- a/crates/socket-patch-cli/src/commands/lock_cli.rs
+++ b/crates/socket-patch-cli/src/commands/lock_cli.rs
@@ -3,8 +3,8 @@
 //!
 //! Mutating subcommands (`apply`, `rollback`, `repair`, `remove`,
 //! `vendor`) all need the same shape: acquire the lock at the top of
-//! `run`, on contention emit a JSON envelope with `errorCode:
-//! "lock_held"` (or stderr in human mode) and exit 1. This module
+//! `run`, on contention emit a JSON envelope with `error.code:
+//! "lock_held"` (status "error") (or stderr in human mode) and exit 1. This module
 //! centralises that emission so the call sites stay one line each.
 //!
 //! The lock itself is in `socket-patch-core` (cross-crate, also used
@@ -337,13 +337,12 @@ mod tests {
 
     /// Regression guard carried over from the `--break-lock` era: the
     /// wrapper must never open a window in which a competitor can be
-    /// robbed of a lock it legitimately acquired. The historical buggy
-    /// shape probed, then `remove_file`d the lock file, then
-    /// re-acquired: a competitor that flocked (or had merely *opened*)
-    /// the file before the unlink kept a valid lock on the orphaned
-    /// inode while the re-acquire locked a fresh one — two live holders
-    /// at once. Today every guard drop unlinks the file, so this is the
-    /// live stress test of the core protocol that makes that safe:
+    /// robbed of a lock it legitimately acquired: a competitor that
+    /// flocked (or had merely *opened*) the file before an unlink keeps a
+    /// valid lock on the orphaned inode while a re-acquire locks a fresh
+    /// one — two live holders at once. Every guard drop unlinks the file,
+    /// so this is the live stress test of the core protocol that makes
+    /// that safe:
     /// unlink WHILE holding the lock, and re-check the locked handle's
     /// identity against the path after every successful lock.
     ///
@@ -566,8 +565,7 @@ mod tests {
         );
     }
 
-    /// The `--json` failure envelope (previously emitted only via
-    /// `println!`, so untested) has the stable error shape downstream
+    /// The `--json` failure envelope has the stable error shape downstream
     /// consumers pattern-match on: top-level `status: "error"` and
     /// `error.code` carrying the lock reason tag.
     #[test]
diff --git a/crates/socket-patch-cli/src/commands/mod.rs b/crates/socket-patch-cli/src/commands/mod.rs
index f19d47d4..ddda23e2 100644
--- a/crates/socket-patch-cli/src/commands/mod.rs
+++ b/crates/socket-patch-cli/src/commands/mod.rs
@@ -69,7 +69,9 @@ pub(crate) async fn discover_wiring(
 /// from `load_redirect_state`'s contract — the warning is advisory
 /// (muted by `--silent`, "errors only"), because every path that would
 /// WRITE or ATTEST from the ledger hard-errors on the same corruption
-/// instead. Shared by both of scan's read-only consults.
+/// instead. Used by scan's empty-discovery `redirectState` consult; the
+/// main-path consult inlines the same posture so it can flush telemetry
+/// before the warning.
 pub(crate) async fn load_redirect_state_lenient(
     cwd: &Path,
     silent: bool,
diff --git a/crates/socket-patch-cli/src/commands/remove.rs b/crates/socket-patch-cli/src/commands/remove.rs
index 82e5f018..9ce95401 100644
--- a/crates/socket-patch-cli/src/commands/remove.rs
+++ b/crates/socket-patch-cli/src/commands/remove.rs
@@ -692,8 +692,9 @@ pub async fn run(args: RemoveArgs) -> i32 {
     // intact (mirroring the `rollback_failed` contract). A corrupt ledger
     // is a hard error: we are about to mutate and cannot know what we
     // would leave wired. `--skip-rollback` ("don't touch my tree") skips
-    // the revert too — the wiring stays until the next `vendor` run
-    // reconciles the then-dropped entry.
+    // the revert too — the wiring stays until `vendor --revert` / a later
+    // `remove` undoes it (a manifest-tracked entry is also reconcile-reverted
+    // by the next `vendor` run; detached entries never are).
     let mut vendor_state = match vendor_state_result {
         Ok(s) => s,
         Err(e) => {
@@ -745,7 +746,7 @@ pub async fn run(args: RemoveArgs) -> i32 {
 
     // ── hosted leg ──────────────────────────────────────────────────────
     // An identifier can also (or only) match hosted records in the
-    // redirect ledger. Supported ecosystems (cargo, npm-family) unwind
+    // redirect ledger. Supported ecosystems (cargo, npm-family, golang) unwind
     // per-purl; when the identifier covers EVERY record the whole-ledger
     // replay serves the rest; otherwise unsupported targets fail closed
     // BEFORE the manifest mutation. A corrupt ledger skips the leg with a
diff --git a/crates/socket-patch-cli/src/commands/repair.rs b/crates/socket-patch-cli/src/commands/repair.rs
index 58d0699b..4fb8ed4d 100644
--- a/crates/socket-patch-cli/src/commands/repair.rs
+++ b/crates/socket-patch-cli/src/commands/repair.rs
@@ -28,10 +28,9 @@ pub struct RepairArgs {
     //
     // `value_parser = parse_bool_flag` matches the `GlobalArgs` bool flags:
     // clap's default bool parser accepts only the literal strings
-    // `true`/`false` from the env binding, so `SOCKET_DOWNLOAD_ONLY=1` (or
-    // an exported-but-empty `SOCKET_DOWNLOAD_ONLY=`) aborted every `repair`
-    // invocation. This flag is also outside `GLOBAL_ARG_ENV_VARS`, so
-    // `main`'s empty-var scrub never rescues it.
+    // `true`/`false` from the env binding, so `SOCKET_DOWNLOAD_ONLY=1` would
+    // abort every `repair` invocation. (`main`'s empty-var scrub covers an
+    // exported-but-empty value via `LOCAL_ARG_ENV_VARS`.)
     #[arg(
         long = "download-only",
         env = "SOCKET_DOWNLOAD_ONLY",
@@ -401,7 +400,7 @@ async fn repair_inner(
 
     // Step 1: Check for and download missing artifacts in the requested
     // mode. Counts below refer to whatever kind of artifact was requested
-    // (file blobs, diff archives, or package archives).
+    // (file blobs or diff archives).
     //
     // VENDORED-in-sync manifest entries are excluded: vendor flows keep
     // patch content in memory and the committed artifact IS the patch, so
@@ -785,9 +784,8 @@ mod tests {
 
     /// Regression for the offline + dry-run leak: with `--offline` set, the
     /// download phase is skipped entirely, so even in dry-run mode a missing
-    /// artifact must NOT produce a "would-download" (verified) event. Before
-    /// the fix the event was recorded unconditionally on `dry_run &&
-    /// missing > 0`, contradicting the human-readable path (which only warns).
+    /// artifact must NOT produce a "would-download" (verified) event,
+    /// matching the human-readable path (which only warns).
     #[tokio::test]
     async fn offline_dry_run_does_not_record_download_event() {
         let tmp = tempfile::tempdir().unwrap();
diff --git a/crates/socket-patch-cli/src/commands/repair_vendor.rs b/crates/socket-patch-cli/src/commands/repair_vendor.rs
index 52f0b331..77df1be2 100644
--- a/crates/socket-patch-cli/src/commands/repair_vendor.rs
+++ b/crates/socket-patch-cli/src/commands/repair_vendor.rs
@@ -464,11 +464,6 @@ fn rebuild_reason_label(code: &str) -> &str {
     }
 }
 
-/// A soft (healthy-by-members, unanchored) reconstruction whose trustworthy
-/// rebuild cannot proceed: the entry stays restored WITHOUT a whole-file
-/// fingerprint — the legacy member-only state pass 1 keeps warning about
-/// (`vendor_inventory_missing` for gems) — and the gap is surfaced, instead
-/// of either failing the repair or canonizing the unverifiable live tree.
 /// The npm-family lockfiles and the vlt importers' package.json files as
 /// they are now, for the unverified-source rebuild's put-back. Read through
 /// the FIFO-safe opener: a FIFO or device at one of these paths is left out
@@ -498,6 +493,11 @@ async fn snapshot_npm_wiring_files(cwd: &Path) -> Vec<(PathBuf, Option<Vec<u8>>)
     snap
 }
 
+/// A soft (healthy-by-members, unanchored) reconstruction whose trustworthy
+/// rebuild cannot proceed: the entry stays restored WITHOUT a whole-file
+/// fingerprint — the legacy member-only state pass 1 keeps warning about
+/// (`vendor_inventory_missing` for gems) — and the gap is surfaced, instead
+/// of either failing the repair or canonizing the unverifiable live tree.
 /// The entry itself was already persisted by the pre-rebuild restore.
 fn soft_restore_without_fingerprint(
     env: &mut Envelope,
@@ -652,7 +652,7 @@ async fn restore_orphaned_pre_rebuild_dirs(common: &GlobalArgs) {
 /// unreadable ledger fails this phase loudly (`vendor_state_unreadable`);
 /// the caller's own degrade-to-empty policy for its download scoping is
 /// its own. `run_client` is the run's API client when the caller already
-/// built one (repair.rs's `telemetry_client`): the uuid lookups and the
+/// built one (repair.rs's lazily built download-phase `client`): the uuid lookups and the
 /// staging fetch reuse it instead of constructing a second (or third) one
 /// and re-printing its token advisory; `None` builds lazily on first need.
 pub(crate) async fn repair_vendored_artifacts_with_references(
@@ -866,7 +866,7 @@ pub(crate) async fn repair_vendored_artifacts_with_references(
             ArtifactHealth::Healthy => {
                 // vlt's `<uuid>/.gitignore` and `.gitattributes` are not
                 // part of the artifact: a missing or edited one is simply
-                // rewritten (DESIGN §4.8).
+                // rewritten.
                 if entry.ecosystem == "npm"
                     && entry.flavor.as_deref() == Some(vendor::vlt_lock::FLAVOR)
                     && !common.dry_run
@@ -887,11 +887,12 @@ pub(crate) async fn repair_vendored_artifacts_with_references(
                 // Dir-shaped artifacts from pre-inventory vendors: the
                 // health check above could only verify the PATCHED members
                 // — unpatched-file drift is invisible until a re-vendor
-                // records the whole-tree inventory. Name the gap — for gem
-                // only, the one backend that records inventories; the other
-                // dir-shaped backends (cargo/golang/composer) don't yet, so
-                // a re-vendor there records nothing and the advice would be
-                // permanent per-run noise.
+                // records the whole-tree inventory. Name the gap for gem
+                // only: vlt also records inventories but has no
+                // pre-inventory entries to warn about, and the other
+                // dir-shaped backends (cargo/golang/composer) don't record
+                // one, so a re-vendor there records nothing and the advice
+                // would be permanent per-run noise.
                 if entry.ecosystem == "gem"
                     && !artifact_is_file_shaped(&entry.artifact.path)
                     && entry.artifact.file_inventory.is_none()
@@ -1322,8 +1323,9 @@ pub(crate) async fn repair_vendored_artifacts_with_references(
         patches: records_map,
         setup: None,
     };
-    // The ledger this pass already holds feeds the staging harvest; repair
-    // has no download phase, so no seed.
+    // The ledger this pass already holds feeds the staging harvest; repair's
+    // download phase writes blobs to disk (harvested from socket_dir), so
+    // there is no in-memory seed.
     let staged = match stage_vendor_sources_in_memory(
         common,
         &synth,
@@ -2137,7 +2139,7 @@ mod tests {
 
     /// A FIFO under a wiring-file name (here the paired `<script>.py` of a
     /// `*.py.lock`, which the lister cannot filter because it derives the
-    /// script name without stat'ing it) used to wedge `repair` forever: a
+    /// script name without stat'ing it) must not wedge `repair`: a
     /// plain `read_to_string` blocks in open(2) waiting for a writer. Every
     /// reference read must go through the FIFO-safe reader and skip it.
     #[cfg(unix)]
@@ -2199,9 +2201,9 @@ mod tests {
     }
 
     /// The requirements planner writes vendored pins into `-r` includes,
-    /// so a reference may live ONLY in an include. The scan used to read
-    /// the root requirements.txt alone, leaving such a wheel unrecoverable
-    /// by `repair` and deletable by the orphan sweep.
+    /// so a reference may live ONLY in an include. Reading the root
+    /// requirements.txt alone would leave such a wheel unrecoverable by
+    /// `repair` and deletable by the orphan sweep.
     #[tokio::test]
     async fn scan_recovers_include_hosted_requirements_reference() {
         let tmp = tempfile::tempdir().unwrap();
diff --git a/crates/socket-patch-cli/src/commands/rollback.rs b/crates/socket-patch-cli/src/commands/rollback.rs
index d0b79f17..14806e79 100644
--- a/crates/socket-patch-cli/src/commands/rollback.rs
+++ b/crates/socket-patch-cli/src/commands/rollback.rs
@@ -496,7 +496,7 @@ struct PatchToRollback {
 /// satisfies that end state — so even a run whose in-scope targets ALL turn
 /// out not-installed exits 0 / `success`. Do not "fix" this into symmetry:
 /// `remove` also rides on it (it drops long-uninstalled entries from the
-/// manifest via its "No packages found to rollback" path).
+/// manifest via `RollbackOutcome::not_installed`).
 pub(crate) struct RollbackOutcome {
     /// No attempted rollback failed (per-package; see above).
     pub(crate) success: bool,
@@ -673,11 +673,7 @@ pub(crate) fn all_files_already_original(result: &RollbackResult) -> bool {
             .all(|f| f.status == VerifyRollbackStatus::AlreadyOriginal)
 }
 
-/// Number of packages that have files which actually need restoring,
-/// used by the dry-run summary. Successful-but-already-original packages
-/// are no-ops reported on their own line, so they are excluded here —
-/// mirroring apply's dry-run split — to avoid double-counting them
-/// against "can be rolled back".
+/// One `results[]` record of the rollback JSON envelope.
 fn result_to_json(result: &RollbackResult) -> serde_json::Value {
     serde_json::json!({
         "purl": result.package_key,
@@ -1028,7 +1024,7 @@ async fn run_vendored_leg(
 }
 
 /// Unwind the in-scope hosted redirects: per-purl reverts where they
-/// exist (cargo + npm-family), and — when the scope covers the ENTIRE
+/// exist (cargo, npm-family, golang), and — when the scope covers the ENTIRE
 /// record set — the whole-ledger reverse replay for everything else.
 /// Mutates `state`; the caller persists on wet runs.
 pub(crate) async fn run_hosted_leg(
@@ -1244,7 +1240,7 @@ pub async fn run(args: RollbackArgs) -> i32 {
     // Rollback infers what to undo from the three state stores: the
     // manifest (in-place/agent patches), the vendor ledger (vendored
     // patches), and the redirect ledger (hosted lockfile redirects). A
-    // missing manifest is no longer fatal when a ledger holds work.
+    // missing manifest is not fatal when a ledger holds work.
     //
     // Only cheap EXISTENCE probes happen before the lock (they decide the
     // truly-empty error path, which never locks: acquiring would create
@@ -2482,18 +2478,13 @@ pub(crate) async fn rollback_patches_inner(
     // actually attempt to restore in place:
     //
     //   * Narrowed-away sibling variants (they describe a distribution
-    //     that is not on disk) don't gate: an unfetchable sibling
-    //     before-blob used to abort the WHOLE rollback even though that
-    //     variant was never going to be attempted.
+    //     that is not on disk) don't gate: that variant is never attempted.
     //   * In-scope purls the crawler could NOT resolve (package not
     //     installed) don't gate either: there is nothing on disk to
-    //     restore, so no before-blob is ever read for them. They used to
-    //     be gated "fail-closed", which hard-failed the run (exit 1,
-    //     `Cannot roll back: ... Before blob not found`, `path: ""`) over
-    //     an entry that had nothing to roll back — the same entry apply
-    //     reports as a benign `package_not_installed` skip. They surface
-    //     via `not_installed` below instead.
-    //   * Local-redirect PURLs (local-mode go) are excluded as before:
+    //     restore, so no before-blob is ever read for them (apply reports
+    //     the same entry as a benign `package_not_installed` skip). They
+    //     surface via `not_installed` below instead.
+    //   * Local-redirect PURLs (local-mode go) are excluded:
     //     their rollback just drops the project-local redirect + copy and
     //     reads no blobs, so a missing before-blob must not block an
     //     offline redirect rollback.
@@ -2737,9 +2728,9 @@ pub(crate) async fn rollback_patches_inner(
         // (rollback's "had no matching installed package" warning,
         // remove's crawler-miss warning).
         //
-        // `success: true` — per-package semantics for the `remove`
-        // delegation. The CLI boundary layers apply's "nothing matched at
-        // all" exit-1 on top via `not_installed`.
+        // `success: true` — not-installed entries already satisfy
+        // rollback's end state (see `RollbackOutcome`); callers report
+        // `not_installed` as an informational warning, never an exit 1.
         return Ok(RollbackOutcome {
             success: true,
             results: Vec::new(),
@@ -2844,9 +2835,8 @@ mod tests {
     // The returned `bool` is `RollbackOutcome::success` — per-package semantics
     // only. Manifest entries whose package is not installed are NOT failures
     // here (there is nothing on disk to restore), so `remove` proceeds to drop
-    // them from the manifest; the CLI `rollback` boundary's apply-mirroring
-    // "none matched → exit 1" rule deliberately does NOT apply to this
-    // delegation (it would wedge `remove` for packages long uninstalled).
+    // them from the manifest. Like the CLI boundary, not-installed entries
+    // never fail the run (see `RollbackOutcome`).
     //
     // The `not_installed` element exists because that drop is IRREVERSIBLE in a
     // way a genuine rollback is not: "not installed" can also mean "installed
@@ -3308,11 +3298,9 @@ mod tests {
         );
     }
 
-    /// Cargo now patches in place (vendored or registry cache) and rolls back
-    /// by restoring from before-blobs — exactly like npm/pypi. So a cargo PURL
-    /// must NOT be excluded by the before-blob gate: a missing cargo before-blob
-    /// IS a real problem the gate should surface. This guards against cargo
-    /// being mistakenly reclassified as a redirect again.
+    /// Cargo patches in place (vendored or registry cache) and rolls back
+    /// from before-blobs like npm/pypi, so the before-blob gate must NOT
+    /// exclude a cargo PURL: a missing cargo before-blob is a real problem.
     #[tokio::test]
     async fn gate_manifest_keeps_cargo_before_blobs_in_missing_check() {
         let mut patches = HashMap::new();
@@ -3353,13 +3341,11 @@ mod tests {
         assert!(!is_local_go("pkg:cargo/serde@1.0.0", &common));
     }
 
-    /// Regression: local-GO redirects must be excluded from the before-blob
-    /// gate exactly like local-cargo. A go redirect drops the `go.mod`
+    /// Local-GO redirects must be excluded from the before-blob gate (cargo
+    /// is not — it restores in place). A go redirect drops the `go.mod`
     /// `replace` directive + the patched copy and reads no before-blob, so a
     /// missing before-blob must not abort (nor trigger a needless download for)
-    /// an offline local-go rollback. Before the fix only cargo was excluded, so
-    /// a local-go patch with an absent before-blob aborted the whole rollback
-    /// under `--offline`.
+    /// an offline local-go rollback.
     #[tokio::test]
     async fn gate_manifest_excludes_local_go_before_blobs_from_missing_check() {
         let mut patches = HashMap::new();
@@ -3387,8 +3373,8 @@ mod tests {
             .await
             .unwrap();
 
-        // Full manifest: the go before-blob shows up as missing — exactly what
-        // the buggy (cargo-only) gate left in, spuriously aborting rollback.
+        // Full manifest: the go before-blob shows up as missing, which an
+        // unfiltered gate would spuriously abort on.
         let full_missing = get_missing_before_blobs(&manifest, blobs).await;
         assert!(full_missing.contains("go_before"));
 
@@ -3439,13 +3425,9 @@ mod tests {
 
     /// Regression: rolling back a local-GO patch must DROP the project-local
     /// redirect (the `go.mod` `replace` directive + the patched copy under
-    /// `.socket/go-patches/`), not fall through to in-place rollback.
-    ///
-    /// Before the fix, `rollback` only had a cargo redirect backend; a go PURL
-    /// fell through to `rollback_package_patch` against the pristine module
-    /// cache, every file verified `AlreadyOriginal`, and the redirect was left
-    /// active — a silent no-op that reported "already original" while the build
-    /// kept using the patched copy.
+    /// `.socket/go-patches/`), not fall through to in-place rollback against
+    /// the pristine module cache (a silent "already original" no-op that
+    /// leaves the build using the patched copy).
     #[tokio::test]
     async fn try_rollback_local_go_drops_redirect_and_copy() {
         use socket_patch_core::vendor::go_mod_edit::{
@@ -3532,10 +3514,7 @@ mod tests {
     /// rolled back. The engine leaves `files_rolled_back` empty on dry-run
     /// (verify only — `rollback_package_patch` pushes into it only on the
     /// mutating path), and the JSON envelope counts `rolledBack` from a
-    /// non-empty `files_rolled_back`. Before the fix the go backend populated
-    /// it unconditionally, so `rollback --dry-run --json` reported
-    /// `rolledBack: 1` (with the files listed in `filesRolledBack`) for a run
-    /// that mutated nothing.
+    /// non-empty `files_rolled_back`.
     #[tokio::test]
     async fn try_rollback_local_go_dry_run_reports_no_files_rolled_back() {
         use socket_patch_core::vendor::go_mod_edit::{
@@ -3801,16 +3780,10 @@ mod tests {
 
     // --- Before-blob gate `--ecosystems` scoping --------------------------
     //
-    // Twin of apply's (fixed) "offline guard unscoped" bug: the gate must
-    // only consider patches this run can actually roll back — the
-    // `--ecosystems` filter.
-
     /// Regression: an out-of-scope patch's missing before-blob must not abort
-    /// an `--ecosystems`-scoped rollback. Before the fix the gate ran on the
-    /// identifier-filtered manifest BEFORE `partition_purls`, so
-    /// `rollback --ecosystems npm --offline` aborted the whole run because a
-    /// pypi patch — which this run would never touch — was missing its
-    /// before-blob (and online, the gate triggered needless downloads for it).
+    /// an `--ecosystems`-scoped rollback (`rollback --ecosystems npm --offline`
+    /// must not fail on a pypi patch it never touches, nor download for it
+    /// online).
     #[tokio::test]
     async fn before_blob_gate_ignores_ecosystem_filtered_patches() {
         let tmp = tempfile::tempdir().unwrap();
@@ -3965,10 +3938,9 @@ mod tests {
     }
 
     /// Regression (rollback ordering): a manifest entry whose package is
-    /// NOT installed must never enter the before-blob plan. Before the gate
-    /// reorder, its missing before-blob hard-failed the whole offline run
-    /// (exit 1, `Cannot roll back: ... Before blob not found`, `path: ""`)
-    /// even though there was nothing on disk to roll back. Through the
+    /// NOT installed must never enter the before-blob plan: its missing
+    /// before-blob must not hard-fail an offline run with nothing on disk to
+    /// roll back. Through the
     /// `remove`-facing delegation this is a benign no-op: success with zero
     /// results, exactly as when the blob IS present — so `remove` can drop
     /// the entry of a long-uninstalled package either way.
diff --git a/crates/socket-patch-cli/src/commands/scan/gc.rs b/crates/socket-patch-cli/src/commands/scan/gc.rs
index 58eee602..35b205a3 100644
--- a/crates/socket-patch-cli/src/commands/scan/gc.rs
+++ b/crates/socket-patch-cli/src/commands/scan/gc.rs
@@ -33,13 +33,9 @@ pub(super) struct GcSummary {
     vendored_reverted: Vec<String>,
     /// Vendored entries the wet pass drift-kept
     /// (`RevertOutcome::kept_artifact`): a revert was due, but the lock
-    /// entries drifted since vendoring, so artifacts, ledger entry, and
-    /// manifest records were all retained — nothing reclaimed until the
-    /// user undoes the drift and re-runs `vendor --revert`. Sorted.
+    /// entries drifted since vendoring, so everything was retained. Sorted.
     /// Always empty in preview mode (drift is only detected by a wet
-    /// wiring replay), so the preview still lists such entries in
-    /// `vendored_reverted` — this field is what lets the apply output
-    /// explain the difference.
+    /// wiring replay), where such entries show in `vendored_reverted`.
     vendored_kept: Vec<String>,
     /// Vendored entries whose wet revert FAILED: the ledger entry and the
     /// artifacts were kept, nothing reclaimed. Sorted. Always empty in
@@ -48,12 +44,9 @@ pub(super) struct GcSummary {
     /// Orphan `.socket/vendor/<eco>/<uuid>` dirs swept (or sweepable).
     vendor_orphan_dirs: usize,
     /// Set when a wet pass could not take the apply lock and so skipped
-    /// its whole mutating half (vendored reverts, manifest prune, blob
-    /// sweep): `lock_held` (another run holds it — the contract's
-    /// skip-not-fail posture) or `lock_io` (the lock file could not be
-    /// created or opened). `(code, message)` exactly as
-    /// `lock_cli::lock_failure` renders them. Never set in preview mode
-    /// (the preview is lock-free and read-only).
+    /// its whole mutating half: `lock_held` (another run holds it) or
+    /// `lock_io` (the lock file could not be created or opened), as
+    /// `lock_cli::lock_failure` renders them. Never set in preview mode.
     skipped: Option<(&'static str, String)>,
     /// Post-revert/prune rewrites that failed (`vendor_state_write_failed`
     /// / `manifest_write_failed` + detail) and orphan sweeps that could not
@@ -178,11 +171,8 @@ async fn run_gc(
 /// the latter's manifest records), then — when a manifest exists — prune
 /// manifest entries for PURLs not in `scanned_purls`, write the manifest
 /// back, and sweep orphan blob/diff/package files, so the sweep reclaims
-/// the blobs the vendored half just orphaned in the same pass (the stale
-/// `vendored` exemption set is harmless: the entries it would exempt are
-/// already gone). Callers must gate on the `prune` flag — when GC isn't
-/// requested, simply don't call this function and don't emit a `gc`
-/// sub-object.
+/// the blobs the vendored half just orphaned in the same pass. Callers
+/// gate on the `prune` flag.
 pub(super) async fn run_apply_gc(
     common: &GlobalArgs,
     manifest_path: &Path,
@@ -190,15 +180,10 @@ pub(super) async fn run_apply_gc(
     scanned_purls: &HashSet<String>,
     vendored: &HashSet<String>,
 ) -> GcSummary {
-    // Existence gate BEFORE the lock: `acquire` creates `.socket/` when it
-    // is missing, and a plain `scan --prune` on a project with neither a
-    // manifest nor a ledger file (a pristine checkout) must not conjure
-    // the directory just to find nothing to do. Either store alone is
-    // enough: the vendored half runs without a manifest, the manifest half
-    // without a ledger. Both probes are cheap stats — the authoritative
-    // reads happen under the lock (`save_state` deletes an emptied ledger,
-    // so the file's existence is its content proxy; a corrupt or foreign
-    // ledger takes the lock briefly and finds nothing to do).
+    // Existence gate BEFORE the lock: `acquire` creates `.socket/`, and a
+    // pristine checkout with neither a manifest nor a ledger must not gain
+    // one. Either store alone is enough to proceed; the authoritative reads
+    // happen under the lock.
     let has_manifest = tokio::fs::metadata(manifest_path)
         .await
         .is_ok_and(|m| m.is_file());
@@ -210,15 +195,11 @@ pub(super) async fn run_apply_gc(
     }
 
     // Both halves are read-modify-writes the apply lock serializes
-    // everywhere else (apply, get, remove, repair, rollback, vendor). Run
-    // unlocked against a live holder mid-write, the stale manifest read
-    // would clobber the holder's new entry on write-back and the sweep
-    // would delete its just-downloaded blobs. Contention skips the pass
-    // without failing the scan; an I/O fault on the lock file skips it
-    // too — both are recorded so the output explains the untouched state
-    // instead of reading as a clean all-zero pass. One acquire for both
+    // everywhere else; unlocked, a stale read would clobber a live holder's
+    // write and the sweep would delete its fresh blobs. Contention or a lock
+    // I/O fault skips the pass (recorded, not failed). One acquire for both
     // halves: flock is per open file description, so a nested acquire in
-    // the vendored half would read as a live holder and silently skip it.
+    // the vendored half would read as a live holder.
     let timeout = Duration::from_secs(common.lock_timeout.unwrap_or(0));
     let _guard = match crate::commands::lock_cli::acquire_with_status(socket_dir, timeout) {
         Ok(g) => g,
@@ -233,11 +214,8 @@ pub(super) async fn run_apply_gc(
     // Vendored-state GC FIRST (see the fn doc), under this guard.
     let vendor_gc = run_vendor_gc(common, manifest_path, /*dry_run=*/ false).await;
 
-    // Re-read the manifest under the lock (the apply step may have added
-    // or updated entries we now want to consider for pruning; the probe
-    // above was only the cheap pre-lock gate). Missing or unreadable ⇒
-    // nothing to prune, and the blob sweep has no referenced-set to work
-    // from.
+    // Authoritative read under the lock. Missing or unreadable ⇒ nothing
+    // to prune, and the blob sweep has no referenced-set to work from.
     let mut manifest = match read_manifest(manifest_path).await {
         Ok(Some(m)) => m,
         _ => return GcSummary::vendor_only(vendor_gc),
@@ -286,10 +264,8 @@ async fn preview_apply_gc(
         Ok(Some(m)) => m,
         _ => return GcSummary::vendor_only(vendor_gc),
     };
-    // Mirror the wet pass: an unused vendored entry's manifest keys are
-    // dropped before the blob sweep, so drop them from the in-memory copy
-    // too — otherwise the preview under-reports orphan blobs/bytes
-    // relative to what the real `--prune` run frees.
+    // Mirror the wet pass, which drops an unused vendored entry's manifest
+    // keys before the blob sweep, or the preview under-reports orphans.
     for purl in &vendor_gc.unused_reverted {
         let base = strip_purl_qualifiers(purl).to_string();
         manifest
@@ -297,13 +273,8 @@ async fn preview_apply_gc(
             .retain(|k, _| k != purl && strip_purl_qualifiers(k) != base);
     }
     let prunable = detect_prunable(&manifest, scanned_purls, vendored);
-    // Mirror `run_apply_gc`: drop the prunable entries from the manifest
-    // *before* computing orphans (no write — this is the preview). The
-    // cleanup helpers derive the "referenced" blob/archive set from the
-    // manifest they're handed, so leaving the prunable entries in place
-    // would keep their blobs marked as used and the preview would
-    // under-report `orphan*`/`bytesReclaimable` relative to what the real
-    // `--prune`/`--sync` run actually frees.
+    // Likewise drop the prunable entries in memory before the sweep: the
+    // cleanup helpers derive the referenced set from this manifest.
     for purl in &prunable {
         manifest.patches.remove(purl);
     }
@@ -463,35 +434,19 @@ pub(super) async fn run_human_gc(
 /// installed (or no longer reachable to the crawler). Pure / no I/O so
 /// it's unit-testable.
 ///
-/// Comparison is on the **base** PURL (qualifiers stripped) on both
-/// sides: the pypi crawler reports base PURLs, but a manifest may hold
-/// several qualified release variants (`?artifact_id=...`) of one
-/// installed package. Matching on the base keeps every variant of an
-/// installed package while still pruning all variants of one that is
-/// gone — otherwise `scan --all-releases --sync` would prune the very
-/// variants it just downloaded.
+/// Comparison is on the canonical **base** PURL (qualifiers stripped,
+/// percent-decoded) on both sides: a manifest may hold several qualified
+/// release variants of one installed package, and API keys are encoded
+/// (`pkg:npm/%40scope/x@1`) where crawler purls are literal. Otherwise
+/// `--prune`/`--sync` would GC the very patches it just downloaded.
 ///
-/// `vendored` (the ledger's purl-key set, see `vendored_purl_keys`) is
-/// always exempt: a vendored package is consumed from the committed
-/// `.socket/vendor/` artifact, so the crawler not finding an installed
-/// copy is its NORMAL state, not "no longer installed". Without this, a
-/// wiped node_modules would prune the manifest entry — and the next
-/// `vendor` run would then reconcile-revert the vendoring itself.
+/// `vendored` (the ledger's purl-key set) is always exempt: a vendored
+/// package is consumed from the committed `.socket/vendor/` artifact, so
+/// no installed copy is its NORMAL state.
 ///
-/// Both sides are compared in percent-DECODED form (`normalize_purl`):
-/// manifest keys come from the API encoded (`pkg:npm/%40scope/x@1`) while
-/// crawler purls carry the literal `@scope` — comparing the raw strings
-/// would make every encoded scoped entry look prunable and `--prune`/
-/// `--sync` would GC the very patch it just downloaded.
-///
-/// Entries the crawl never even looked for are exempt too
-/// (`crawl_covers_purl`): any `pkg:<type>/` this build has no crawler
-/// for. The manifest is a committed, shared file, so a newer CLI's
-/// ecosystem can legitimately appear in it — "absent from the crawl"
-/// then says nothing about whether the package is installed, and pruning
-/// would silently delete a teammate's patch (plus its blobs). Same
-/// fail-safe reasoning as capturing `scanned_purls` before the
-/// `--ecosystems` filter.
+/// Entries the crawl never looked for are exempt too (`crawl_covers_purl`:
+/// a `pkg:<type>/` this build has no crawler for, e.g. a newer CLI's
+/// ecosystem in the committed manifest) — absence proves nothing there.
 fn detect_prunable(
     manifest: &PatchManifest,
     scanned_purls: &HashSet<String>,
@@ -670,10 +625,7 @@ mod tests {
     #[test]
     fn detect_prunable_exempts_vendored_purls() {
         // A vendored package is consumed from the committed artifact —
-        // the crawler not seeing an installed copy (wiped node_modules)
-        // is its normal state. Pruning it would orphan the manifest
-        // entry and let the next `vendor` run reconcile-revert the
-        // vendoring itself.
+        // the crawler not seeing an installed copy is its normal state.
         let m = manifest_with(&[("pkg:npm/foo@1.0", "uuid-a"), ("pkg:npm/bar@2.0", "uuid-b")]);
         let vendored: HashSet<String> = ["pkg:npm/foo@1.0".to_string()].into_iter().collect();
         let out = detect_prunable(&m, &scanned(&[]), &vendored);
@@ -688,8 +640,7 @@ mod tests {
     fn detect_prunable_encoded_manifest_key_not_pruned() {
         // The API serves scoped purls percent-encoded and they land in the
         // manifest verbatim; the crawler reports the literal `@scope` form.
-        // Comparing raw strings would make every encoded scoped entry look
-        // prunable — `scan --prune` would GC the patch it just downloaded.
+        // The comparison must bridge the two spellings.
         let m = manifest_with(&[("pkg:npm/%40scope/x@1.0.0", "uuid-a")]);
         let s = scanned(&["pkg:npm/@scope/x@1.0.0"]);
         assert!(
@@ -707,8 +658,6 @@ mod tests {
         // (a newer CLI's ecosystem in a COMMITTED manifest, read by an older
         // binary) is never looked for by the crawl, so its absence from
         // `scanned_purls` says nothing about whether it is installed.
-        // Pruning it silently deletes a teammate's patch (plus its blobs)
-        // from the shared manifest.
         let m = manifest_with(&[
             ("pkg:hex/plug@1.14.0", "uuid-a"),
             ("pkg:npm/gone@1.0.0", "uuid-b"),
@@ -726,8 +675,7 @@ mod tests {
         // Maven/NuGet are first-class ecosystems: every scan crawls them,
         // so their manifest entries ARE judged — absent from the scan
         // means genuinely uninstalled, and they prune like any other
-        // ecosystem. (They used to be exempt behind the retired
-        // `SOCKET_EXPERIMENTAL_*` runtime gates.)
+        // ecosystem.
         let m = manifest_with(&[
             ("pkg:maven/com.example/lib@1.0.0", "uuid-a"),
             ("pkg:nuget/Some.Package@1.0.0", "uuid-b"),
@@ -748,9 +696,9 @@ mod tests {
 
     #[test]
     fn detect_prunable_exempts_qualified_variant_of_vendored_base() {
-        // The ledger key set carries qualifier-stripped bases (see
-        // `vendored_purl_keys`), so a qualified manifest variant of a
-        // vendored package is exempt via its base purl.
+        // The ledger key set carries qualifier-stripped bases, so a
+        // qualified manifest variant of a vendored package is exempt via
+        // its base purl.
         let m = manifest_with(&[("pkg:pypi/six@1.16.0?artifact_id=wheel-a", "uuid-a")]);
         let vendored: HashSet<String> = ["pkg:pypi/six@1.16.0".to_string()].into_iter().collect();
         let out = detect_prunable(&m, &scanned(&[]), &vendored);
@@ -761,12 +709,8 @@ mod tests {
     }
 
     // ---- preview_apply_gc / run_apply_gc parity ----------------------------
-    // The dry-run preview MUST report the same orphan blobs/archives the real
-    // (wet) prune would remove. Both delete the prunable manifest entries
-    // first, then sweep; the cleanup helpers derive the "still referenced"
-    // blob set from the manifest they're handed, so a preview that swept
-    // against the un-pruned manifest would keep the prunable entries' blobs
-    // marked "used" and under-report `orphan*`/`bytesReclaimable`.
+    // The dry-run preview MUST report the same orphan blobs/archives the
+    // real (wet) prune would remove.
 
     /// Write a manifest holding a single entry that references one afterHash
     /// blob, plant that blob on disk, and return `(manifest_path, socket_dir,
@@ -858,14 +802,8 @@ mod tests {
 
     #[tokio::test]
     async fn run_apply_gc_skips_prune_and_sweep_while_apply_lock_is_held() {
-        // A live holder of `<socket_dir>/apply.lock` (a concurrent `get`,
-        // `apply`, `remove`, …) may be mid-manifest-write and mid-blob-
-        // download. The wet GC pass is a manifest read-modify-write plus a
-        // blob sweep: run unlocked, its stale read clobbers the holder's
-        // new manifest entry on write-back, and the sweep deletes the
-        // holder's fresh blobs (unreferenced by GC's stale in-memory copy).
-        // Contention must skip the pass — the vendored half's posture —
-        // never prune or delete.
+        // A live holder of `<socket_dir>/apply.lock` may be mid-write:
+        // contention must skip the pass, never prune or delete.
         let tmp = tempfile::tempdir().unwrap();
         let after_hash = "c".repeat(64);
         let (manifest_path, socket_dir, blob_path) =
@@ -1049,10 +987,7 @@ mod tests {
 
     // ---- missing/corrupt manifest fail-safe ---------------------------------
     // An unreadable manifest must abort the GC pass, NOT be treated as an
-    // empty referenced-set: the cleanup helpers derive "still referenced"
-    // from the manifest they're handed, so proceeding with an empty one
-    // would sweep EVERY blob in `.socket/blobs` — including ones a healthy
-    // manifest (restored from git, say) still references.
+    // empty referenced-set (which would sweep EVERY blob in `.socket/blobs`).
 
     /// Tempdir with a `.socket/blobs/<hash>` blob planted but NO manifest
     /// written; returns `(manifest_path, socket_dir, blob_path)`.
@@ -1242,13 +1177,9 @@ mod tests {
     #[tokio::test]
     async fn preview_counts_blobs_of_lockfile_unused_vendored_entry() {
         // A vendored entry whose dependency left the lockfile graph: the wet
-        // pass reverts it AND drops its manifest entry, so its blob is freed
-        // in the same run. The preview must mirror that — drop the entry's
-        // manifest keys in memory before the orphan sweep — or `--dry-run`
-        // under-reports orphanBlobs/bytesReclaimable vs the real `--prune`.
-        // Note the vendored exemption set deliberately contains the purl:
-        // detect_prunable exempts it (gc.pruned stays empty), so ONLY the
-        // vendor-gc mirror loop can surface the blob as reclaimable.
+        // pass reverts it AND drops its manifest entry, freeing its blob, so
+        // the preview must count that blob. The vendored exemption set holds
+        // the purl, so ONLY the vendor-gc mirror loop can surface it.
         const PURL: &str = "pkg:npm/gone@1.0.0";
         const UUID: &str = "11111111-1111-4111-8111-111111111111";
 
@@ -1347,11 +1278,8 @@ mod tests {
     /// re-resolve): the in-use probe calls it unused, but the wet revert
     /// refuses to touch the drifted lock and keeps artifacts, ledger entry
     /// and manifest record. The preview cannot see drift and lists the
-    /// entry as revertable, so the wet `scan --prune` reclaims nothing —
-    /// pre-fix, with zero explanation (the kept purl was counted nowhere
-    /// and both call sites dropped the backend's vendor_artifact_kept
-    /// warning). The keep must surface as `keptVendoredEntries` in the
-    /// apply JSON.
+    /// entry as revertable, so the keep must surface as
+    /// `keptVendoredEntries` in the apply JSON.
     #[tokio::test]
     async fn apply_gc_reports_drift_kept_vendored_entry() {
         use socket_patch_core::vendor::state::{WiringAction, WiringRecord};
@@ -1559,8 +1487,7 @@ mod tests {
         assert!(clean_json.get("skipped").is_none(), "{clean_json}");
         assert!(clean_json.get("warnings").is_none(), "{clean_json}");
         // A failed rewrite in the vendored half is a warning, never a skip
-        // and never a per-purl failure (the pre-fix `starts_with("pkg:")`
-        // partition labelled every non-purl marker `lock_held`).
+        // and never a per-purl failure.
         let mut io = GcSummary::default();
         io.absorb_vendor_gc(VendorGcSummary {
             write_failures: vec![("manifest_write_failed", "could not update manifest".into())],
diff --git a/crates/socket-patch-cli/src/commands/scan/hosted.rs b/crates/socket-patch-cli/src/commands/scan/hosted.rs
index 7cf3cc12..156f8bf4 100644
--- a/crates/socket-patch-cli/src/commands/scan/hosted.rs
+++ b/crates/socket-patch-cli/src/commands/scan/hosted.rs
@@ -26,8 +26,6 @@ pub(crate) mod vlt;
 pub(crate) use vlt::rollback_heal as vlt_rollback_heal;
 pub(crate) use vlt::takeover_heal as vlt_takeover_heal;
 
-/// Candidate lockfiles / registry configs the redirect rewriters may touch —
-/// read from the project when present and handed to `rewrite_registry_redirect`.
 /// Fragment-edit kinds whose lockfile the package manager re-lays in place
 /// (keeping the Socket source) — a re-scan REBASES their ledger edits instead
 /// of appending; see the ledger merge below.
@@ -37,6 +35,8 @@ pub(crate) const REBASE_KINDS: &[&str] = &[
     socket_patch_core::patch::redirect::vlt::KIND,
 ];
 
+/// Candidate lockfiles / registry configs the redirect rewriters may touch —
+/// read from the project when present and handed to `rewrite_registry_redirect`.
 pub(crate) const REDIRECT_CANDIDATE_FILES: &[&str] = &[
     "package-lock.json",
     "npm-shrinkwrap.json",
@@ -98,15 +98,13 @@ pub(crate) const REDIRECT_CANDIDATE_FILES: &[&str] = &[
     "settings.gradle.kts",
     "build.gradle",
     "build.gradle.kts",
-    // deno.lock is knowingly absent: deno is its own ecosystem and no
-    // redirect rewriter edits its integrity entries today — recording the
-    // decision here so the omission reads as deliberate, not forgotten.
+    // deno.lock is deliberately absent: no redirect rewriter edits its
+    // integrity entries.
 ];
 
 /// Most hosted wheel-metadata downloads in flight at once, below the patch
 /// API's own in-flight cap: each one buffers a whole wheel (up to
-/// `MAX_VENDOR_PACKAGE_BYTES`) where the serial loop held one, so the
-/// window is bounded by what it costs as well as by what it saves.
+/// `MAX_VENDOR_PACKAGE_BYTES`).
 const WHEEL_METADATA_CONCURRENCY: usize = 4;
 
 /// The in-flight cap for the hosted wheel-metadata window.
@@ -115,9 +113,7 @@ const WHEEL_METADATA_CONCURRENCY: usize = 4;
 /// every other patch-API window ([`api_concurrency`], and with it
 /// `SOCKET_API_CONCURRENCY`) — an operator who caps in-flight requests per
 /// client must be able to cap this one too, or a `uv.lock` project's wheels
-/// land in `skipped` as `python_metadata_unavailable`. `api_concurrency`
-/// already returns 1 under a tight descriptor limit, which is what the
-/// serial loop's one-socket-at-a-time profile needs.
+/// land in `skipped` as `python_metadata_unavailable`.
 fn wheel_metadata_concurrency(use_public_proxy: bool) -> usize {
     api_concurrency(use_public_proxy).min(WHEEL_METADATA_CONCURRENCY)
 }
@@ -233,11 +229,8 @@ pub(crate) fn pnpm_trust_workspace_unreadable_detail(server: &str, err: &std::io
 /// The pnpm-workspace.yaml read, classified for the trust auto-config:
 /// `Ok(Some(text))` — read fine; `Ok(None)` — ABSENT (`ErrorKind::NotFound`,
 /// the only state where planning a Create is safe); `Err(e)` — present but
-/// unreadable, so the caller must fall back to warning-only guidance. It
-/// was: a bare `.ok()` collapsed EVERY read error to `None`, so a
-/// present-but-unreadable workspace file was planned as a Create and
-/// OVERWRITTEN with the root-only scaffold, destroying the user's
-/// `packages:` globs.
+/// unreadable, so the caller must fall back to warning-only guidance
+/// (planning a Create would overwrite the user's `packages:` globs).
 ///
 /// FIFO-safe (`read_regular_to_string_sync`: non-blocking open + fstat): a
 /// FIFO planted at the path classifies as unreadable (`InvalidInput`) instead
@@ -256,8 +249,7 @@ fn read_workspace_for_trust(path: &std::path::Path) -> std::io::Result<Option<St
 /// `artifact_url_present`, plus the percent-encoded form) so a writer's
 /// spelling can never be one this probe misses. Lets an idempotent re-scan
 /// plan the trust config for a project that missed it once (opted-out first
-/// run, or a crash between the lock write and the workspace write) — the
-/// splice-only trigger skipped both forever on such projects.
+/// run, or a crash between the lock write and the workspace write).
 fn pnpm_lock_carries_hosted_redirect(
     lock_text: &str,
     overrides: &[socket_patch_core::patch::redirect::DepOverride],
@@ -322,8 +314,7 @@ pub(crate) fn pnpm_trust_configured_detail(server: &str, created: bool, dry_run:
 }
 
 /// `lockfileVersion` major sniffed from a pnpm-lock.yaml head. pnpm 9-12
-/// emit `lockfileVersion: '9.0'` (single doc, first line — verified against
-/// real 7/8/9/10/11/12-rc locks in the 2026-08-18 matrix); pnpm 8 emits
+/// emit `lockfileVersion: '9.0'` (single doc, first line); pnpm 8 emits
 /// `'6.0'`, pnpm 7 an unquoted `5.4`. `None` when no parseable version line
 /// exists — callers treat that as "not trust-policy era" and stay
 /// hands-off (fail closed: never write config for a lock we can't read).
@@ -616,8 +607,7 @@ fn build_redirect_json_envelope(
 /// spelling of its key set (`mode`, `redirected`, `rewrittenFiles`,
 /// `skipped`, `warnings`, `dryRun`), shared by the ≥1-package path here and
 /// the zero-discovery arm in `run`, so the two cannot drift by convention.
-/// `mode` is `"hosted"` (the final mode name for `--redirect`): an additive
-/// key so consumers dispatch on the mode without inferring it from which
+/// `mode` is `"hosted"`: an additive key so consumers dispatch on the mode without inferring it from which
 /// sub-object is present.
 pub(crate) fn redirect_json_block(
     redirected: usize,
@@ -821,9 +811,8 @@ async fn installed_stale_positive_evidence(
         .stale_evidence
 }
 
-/// Post-rewrite stale-materialization probe for gem redirects — the guard
-/// for the live-verified warm-path defect where `bundle install` never
-/// refetches an already-materialized gem (full narrative: the "Gem
+/// Post-rewrite stale-materialization probe for gem redirects: `bundle
+/// install` never refetches an already-materialized gem (see the "Gem
 /// stale-install guard" section of CLI_CONTRACT.md).
 ///
 /// Judgment sources and rules:
@@ -860,10 +849,7 @@ async fn gem_stale_install_warnings(
     global_prefix: Option<std::path::PathBuf>,
     confirmed: &[(String, String)],
     // This run's fetched records MERGED with the ledger's persisted ones
-    // (the caller hands the post-merge ledger map): the persisted half is
-    // the fallback judgment source when this run's /patches/view fetch
-    // failed transiently, so the warning keeps firing until the stale
-    // materialization is gone.
+    // (the caller hands the post-merge ledger map).
     records: &std::collections::BTreeMap<String, socket_patch_core::manifest::schema::PatchRecord>,
     gem_artifact_shas: &std::collections::BTreeMap<(String, String), String>,
 ) -> StaleInstallOutcome {
@@ -1038,10 +1024,8 @@ fn pipenv_probe_certain<'a>(
     candidates: impl Iterator<Item = &'a DepOverride>,
     fetched_wheel_urls: impl Iterator<Item = &'a str>,
 ) -> bool {
-    // `pipenv_lock_targets` answers false on its first line when there is
-    // no Pipfile.lock, and EVERY hosted redirect run reaches this — an
-    // npm-only one with hundreds of candidates included. Ask that question
-    // before building the list to ask it with.
+    // Cheap pre-check: every hosted run reaches this, so skip building the
+    // list when there is no Pipfile.lock.
     if !files.contains_key("Pipfile.lock") {
         return false;
     }
@@ -1062,7 +1046,7 @@ fn gem_sha_key(purl: &str) -> (String, String) {
         .unwrap_or_default()
 }
 
-/// `scan --redirect`: resolve hosted-patch references for the selected patches,
+/// `scan --mode hosted`: resolve hosted-patch references for the selected patches,
 /// then rewrite ONLY those dependencies' lockfile/registry-config entries to
 /// point at the hosted vendored patches (the byte-identical counterpart of the
 /// GitHub-app registry mode). No artifact bytes land in the repo.
@@ -1107,8 +1091,8 @@ pub(super) async fn run_redirect(
             if args.common.json {
                 emit_json_error(scan_result.take(), &message);
             } else if code == 0 && !args.common.silent {
-                // Exit 0 without an error is the cancelled selection
-                // (`Selection cancelled.` already printed).
+                // Unreachable from scan (it never prompts, so selection
+                // cannot be cancelled); kept for a code-0 selection error.
                 eprintln!("Nothing was redirected.");
             }
             return code;
@@ -1154,11 +1138,7 @@ enum ProbeStep {
 /// - The artifact URL in the rewriters' own spellings
 ///   ([`artifact_url_spellings`](socket_patch_core::patch::redirect::artifact_url_spellings),
 ///   raw or the `\/`-escaped slashes an old composer.lock spells them with),
-///   so a writer's spelling can never be one this probe misses. It was: the
-///   composer rewriter emitted `\/`-escaped urls this probe never looked for,
-///   so a fully successful composer redirect reported `redirected: 0`, fetched
-///   no patch record into the ledger, and left the patch unattestable by
-///   `vex`.
+///   so a writer's spelling can never be one this probe misses.
 /// - The percent-encoded URL: the berry rewriter writes it into the lock's
 ///   `::__archiveUrl=` binding, so the raw form is absent.
 /// - The registry index URL and the maven suffixed version, when present.
@@ -1208,12 +1188,11 @@ fn candidate_present_oracle(
 /// allow-remote config →
 /// confirmation probe → ledger merge-then-persist → file writes → gem stale
 /// probe → warnings → optional VEX. Shared VERBATIM by `scan --mode hosted`
-/// — its `--json` arm through the `run_redirect` wrapper (which selects via
-/// `discover_selected`), its human arm through
-/// [`boxed_run_redirect_selected`] directly, after its own table + confirm
-/// prompt (`scan/mod.rs`) — and by `get --mode hosted` (which pins the
-/// advisory-resolved uuid), so all produce identical on-disk results for
-/// the same selection. The redirect ledger is loaded HERE, under the apply
+/// (its `--json` arm through the `run_redirect` wrapper, its human arm
+/// through [`boxed_run_redirect_selected`] in `scan/mod.rs`; both select via
+/// `discover_selected`, with no prompt) and by `get --mode hosted` (which
+/// pins the advisory-resolved uuid), so all produce identical on-disk
+/// results for the same selection. The redirect ledger is loaded HERE, under the apply
 /// lock whenever this run holds one (never handed in pre-loaded: a copy
 /// read before the lock could merge over a concurrent writer's edits); a
 /// dry run or a zero-grant run reads it strictly but writes nothing,
@@ -1343,9 +1322,8 @@ pub(crate) async fn run_redirect_selected(
             // level before the patch uuid. Recover it so the rewriters'
             // rotation-idempotency guards (which wildcard the token path
             // level of a previously-written URL) don't depend on it being
-            // derivable from the URL alone: with an empty token the gem
-            // guard used to miss the previous grant's source block and NEST
-            // a new one around it on every re-scan.
+            // derivable from the URL alone (an empty token makes the gem
+            // guard nest a new source block on every re-scan).
             let token = reference
                 .registry_override
                 .as_ref()
@@ -1451,23 +1429,18 @@ pub(crate) async fn run_redirect_selected(
     // Load the existing redirect ledger before any file changes, including
     // Cargo takeover reverts. It stores the originals a future revert needs, so
     // a malformed (torn/hand-mangled) ledger must abort the run while the
-    // project is still untouched: the old tolerant load treated it as "no
-    // ledger" and the merge below would have started fresh, silently
-    // overwriting that revert data. The malformed file is moved aside to
-    // redirect-state.json.corrupt (never clobbered) so recovery stays
-    // possible. Only a run holding the apply lock moves it: a dry run or a
-    // zero-grant run — neither holds the lock, neither would have written
-    // anything — reports the same hard error but moves nothing (the message
-    // then names the repair-or-move-aside remedy instead of the `.corrupt`
-    // path), so no `.socket/vendor/` mutation ever happens lock-free.
+    // project is still untouched, or the merge below would silently
+    // overwrite that revert data. The malformed file is moved aside to
+    // redirect-state.json.corrupt (never clobbered) — but only by a run
+    // holding the apply lock; a dry run or zero-grant run reports the same
+    // error and moves nothing, so `.socket/vendor/` is never mutated
+    // lock-free.
     //
     // Held as the ONE in-memory ledger for the whole run: the write below
     // merges into it in place, the stale-install probes read its records
-    // (persisted ones included — their fallback judgment source when this
-    // run's /patches/view fetch fails transiently: the warning must keep
-    // firing until the stale materialization is gone, not until the first
-    // flaky fetch), and the takeover classification at the end reads the
-    // merged state.
+    // (persisted ones are the fallback when this run's /patches/view fetch
+    // fails transiently), and the takeover classification at the end reads
+    // the merged state.
     let mut ledger =
         match socket_patch_core::patch::redirect::load_redirect_state(&common.cwd).await {
             Ok(state) => state.unwrap_or_else(RedirectState::new),
@@ -1498,20 +1471,14 @@ pub(crate) async fn run_redirect_selected(
     // entry; for the npm family a `file:./.socket/vendor/…` lock resolution
     // (plus a berry `resolutions` pin) and its committed tarball; for golang
     // the vendor-owned go.mod `replace`, its committed module copy, and its
-    // ledger entry (left behind, a later `vendor` run takes the module back
-    // and the modes flip-flop). The hosted
-    // rewriters know nothing about that wiring: cargo then refuses every
-    // `--locked` build over the now-unused `[patch]` entry while this run
-    // reports success, and the npm rewriters either hijack the vendored
-    // resolution while the vendored ledger still claims it (yarn classic)
-    // or fail-closed refuse the `file:` protocol entirely (yarn berry). A
-    // takeover must leave the project FULLY hosted: revert each such purl's
-    // vendored state first (the exact per-purl machinery `vendor --revert`
-    // runs — restore the lock originals from the ledger, drop the vendored
-    // wiring, remove the committed artifact and the ledger entry), and only
-    // then redirect. This ordering also hands the redirect the PRISTINE
-    // registry lock fragment to record as its own revert original, keeping
-    // the originals chain intact across repeated mode migrations. A purl
+    // ledger entry. The hosted rewriters know nothing about that wiring
+    // (cargo would refuse `--locked` builds over the unused `[patch]` entry;
+    // yarn classic would hijack a resolution the vendored ledger still
+    // claims; yarn berry refuses `file:` outright). A takeover must leave the
+    // project FULLY hosted: revert each such purl's vendored state first (the
+    // per-purl machinery `vendor --revert` runs), and only then redirect —
+    // which also hands the redirect the PRISTINE registry lock fragment to
+    // record as its own revert original. A purl
     // whose vendored state cannot be cleanly reverted (revert failure, or
     // vendored wiring with a missing/corrupt ledger) is REFUSED — skipped
     // with an actionable error — never half-migrated.
@@ -1607,10 +1574,8 @@ pub(crate) async fn run_redirect_selected(
         // Yarn berry twin of the bun gate: the berry rewriter's project-level
         // refusals (mixed line endings, cacheKey, `.yarnrc.yml`
         // compressionLevel) must be known before the takeover reverts a
-        // vendored berry purl — the vendored revert keeps a mixed lock mixed
-        // (it never refuses on line endings), so reverting first stripped
-        // the live vendored patch and then the rewriter refused the lock,
-        // leaving the package unpatched in both modes. Only entries the
+        // vendored berry purl, or the revert strips the live vendored patch
+        // and the rewriter then refuses the lock. Only entries the
         // vendor ledger wired through the yarn-berry backend are gated (the
         // lock is read only when one exists); an unreadable lock is left to
         // the revert's own diagnostics.
@@ -1697,13 +1662,10 @@ pub(crate) async fn run_redirect_selected(
                     })
             };
         // SYMLINK PRE-CHECK for the takeover reverts — the same rule as the
-        // SYMLINK GUARD below, applied to the files the reverts rewrite
-        // (each ledger entry's recorded wiring): the revert backends stage
-        // and rename over the lock like the rewriters do, so a symlinked
-        // package-lock.json would be detached — or a later refusal would
-        // find the purl neither vendored nor hosted — before the general
-        // guard ever ran. Checked in one pass BEFORE any revert dispatches
-        // (and under --dry-run too) so "nothing was written" stays true.
+        // SYMLINK GUARD below, applied to each ledger entry's recorded wiring
+        // (the revert backends also stage and rename over the file). Checked
+        // BEFORE any revert dispatches (and under --dry-run too) so "nothing
+        // was written" stays true.
         let revert_targets = takeover
             .iter()
             .filter_map(|(c, entry)| {
@@ -1738,11 +1700,7 @@ pub(crate) async fn run_redirect_selected(
                     // vendored state the wet run would refuse to revert is
                     // refused here too, and one it would revert is announced
                     // as a takeover — never handed to the rewriters, which
-                    // would preview against the still-vendored wiring and
-                    // fail-closed refuse it, prescribing a manual
-                    // `vendor --revert` for a purl this run just promised to
-                    // revert itself while reporting `redirected: 0` for a
-                    // migration the wet run lands.
+                    // would refuse the still-vendored wiring.
                     let outcome =
                         crate::commands::vendor::dispatch_revert_one(entry, &common.cwd, true)
                             .await;
@@ -1910,20 +1868,13 @@ pub(crate) async fn run_redirect_selected(
     let binary_bun = !bun_lock_present && common.cwd.join("bun.lockb").exists();
     // Read the project's candidate files, run the rewriters. Every read goes
     // through the FIFO-safe reader (non-blocking open + fstat regular-file
-    // check): a FIFO planted under any candidate name — pyproject.toml,
-    // uv.lock, a paired script, a rush lock — wedged `scan`/`get --mode
-    // hosted` forever in a plain `read_to_string` open(2) waiting for a
-    // writer. A non-regular file now reads as "unreadable" and is skipped
-    // exactly like a missing one.
+    // check), so a FIFO under a candidate name is skipped like a missing file
+    // instead of wedging the run in open(2).
     //
-    // Skipped entirely when no candidate survived (every reference skipped
-    // or refused) and no dry-run takeover preview is pending: the rewriters
-    // place nothing and warn about nothing without a dep, so the ~45 reads
-    // would only feed an empty rewrite. Everything after the rewrite still
-    // runs — the skips and warnings reported, a requested VEX still
-    // attempted. A dry-run takeover preview still needs the root locks: the
-    // install-policy previews below (pnpm `trustLockfile`, npm `.npmrc`)
-    // judge the lock the wet run splices after its revert.
+    // Skipped when no candidate survived and no dry-run takeover preview is
+    // pending (the rewriters do nothing without a dep); everything after the
+    // rewrite still runs. A dry-run takeover preview still needs the root
+    // locks for the install-policy previews below.
     use socket_patch_core::utils::fs::read_regular_to_string;
     let mut files: std::collections::BTreeMap<String, String> = std::collections::BTreeMap::new();
     // Rush monorepos have no root package.json/lock pair: the single pnpm
@@ -2009,9 +1960,6 @@ pub(crate) async fn run_redirect_selected(
         }
     }
 
-    // `mut`: the pnpm trustLockfile auto-config below may fold a
-    // pnpm-workspace.yaml write (plus its ledger edit) into the rewrite set so
-    // it rides the same atomic-write / ledger-first machinery as the locks.
     let mut python_metadata = std::collections::BTreeMap::new();
     let mut unavailable_python_artifacts = std::collections::BTreeSet::new();
     // `pipenv --version` (see `pipenv_major` below), started before the
@@ -2066,8 +2014,7 @@ pub(crate) async fn run_redirect_selected(
         // The only candidates the metadata fetch can still drop are those
         // sharing a fetched wheel's artifact URL. If the rest already
         // target an entry of Pipfile.lock, the Pipenv probe below is certain
-        // to run: start it now so it overlaps the fetch. Otherwise it runs
-        // (or not) exactly where it always did.
+        // to run: start it now so it overlaps the fetch.
         if pipenv_probe_certain(
             &files,
             candidates.iter().map(|c| &c.dep),
@@ -2079,27 +2026,16 @@ pub(crate) async fn run_redirect_selected(
             }));
         }
         // The wheels' FIRST attempts run concurrently and are folded in dep
-        // order, so `python_metadata`, `unavailable_python_artifacts` and
-        // `skipped` come out exactly as the serial loop's did; each attempt's
-        // opt-in debug lines are held back and printed at its fold, so they
-        // keep the serial order too.
+        // order, so `python_metadata`, `unavailable_python_artifacts`,
+        // `skipped` and the held-back debug lines come out in dep order.
         //
         // An attempt the client would RETRY (a 429 / 5xx / transport
-        // failure) is never settled concurrently. At the first one no
-        // further attempt is started, the ones already in flight are awaited
-        // (so the host is idle again, as the serial loop would find it), and
-        // that dep plus every later one are finished one at a time. A
-        // deferred attempt is RESUMED, not restarted: `Retry-After` is
-        // waited out and only the budget it left is spent, so each wheel
-        // costs the host exactly the requests the serial loop's would have.
-        // What stays different is only their overlap: a host that answers a
-        // burst differently than it answers the same requests one at a time
-        // (a sliding-window limiter, a bot challenge) can still hand back a
-        // status the serial loop would not have seen. The first such answer
-        // is what closes the window.
-        //
-        // Kept small on purpose, and paced by `SOCKET_API_CONCURRENCY` like
-        // every other patch-API window — see `wheel_metadata_concurrency`.
+        // failure) is never settled concurrently: at the first one no
+        // further attempt starts, the in-flight ones are awaited (host idle
+        // again), and that dep plus every later one finish one at a time. A
+        // deferred attempt is RESUMED, not restarted (`Retry-After` waited
+        // out, only its remaining budget spent), so each wheel costs the
+        // host the same requests a serial fetch would.
         let wheel_metadata_concurrency = wheel_metadata_concurrency(api_client.uses_public_proxy());
         use futures_util::StreamExt as _;
         use socket_patch_core::vendor::pypi::{
@@ -2212,6 +2148,9 @@ pub(crate) async fn run_redirect_selected(
     // runtime worker; `files` comes back for the confirmation probe below.
     let bun_lockb_present = common.cwd.join("bun.lockb").exists();
     let withheld_from_vlt = vlt_preflight.withheld_from_vlt.clone();
+    // `mut`: the pnpm trustLockfile auto-config below may fold a
+    // pnpm-workspace.yaml write (plus its ledger edit) into the rewrite set so
+    // it rides the same atomic-write / ledger-first machinery as the locks.
     let (files, mut rewrite) = tokio::task::spawn_blocking(move || {
         let rewrite = rewrite_registry_redirect_withholding_vlt(
             &files,
@@ -2281,41 +2220,28 @@ pub(crate) async fn run_redirect_selected(
 
     // pnpm >=11 enforces a lockfile supply-chain policy: it compares each
     // resolution's tarball URL against the registry's published metadata and
-    // REFUSES a lock whose URLs differ. The failure spelling changed across
-    // majors (both observed against real installs): pnpm 11 fails with
+    // REFUSES a lock whose URLs differ: pnpm 11 with
     // ERR_PNPM_TARBALL_URL_MISMATCH (ERR_PNPM_META_FETCH_FAIL when the
-    // registry is unreachable); pnpm 12 fails with
-    // ERR_PNPM_LOCKFILE_RESOLUTION_VERIFICATION, and its OWN error text tells
-    // users to rebuild the lock (`pnpm clean --lockfile` + install) — which
-    // silently discards the redirect and reinstalls the vulnerable upstream,
-    // so the warning must pre-empt that advice. The recoveries verified on
-    // both majors are the per-run `pnpm install --trust-lockfile` flag and
-    // the committable pnpm-workspace.yaml `trustLockfile: true` key; the
-    // `.npmrc` `trust-lockfile=true` spelling is IGNORED by pnpm and must
-    // never be recommended.
+    // registry is unreachable), pnpm 12 with
+    // ERR_PNPM_LOCKFILE_RESOLUTION_VERIFICATION, whose own text tells users
+    // to rebuild the lock — which silently discards the redirect, so the
+    // warning must pre-empt that advice. The working recoveries are
+    // `pnpm install --trust-lockfile` and the pnpm-workspace.yaml
+    // `trustLockfile: true` key; the `.npmrc` `trust-lockfile=true` spelling
+    // is IGNORED by pnpm and must never be recommended.
     //
     // ZERO-TOUCH DEFAULT: when this run rewrote the ROOT pnpm-lock.yaml and
-    // its lockfileVersion is >= 9 (pnpm 9-12 emit '9.0'; 5.x/6.0 locks mean
-    // pnpm 7/8, which have neither the policy nor the flag — those legacy
-    // locks get their own installs-work-unchanged guidance instead, never
-    // the `--trust-lockfile` headline pnpm 7/8 reject as an unknown option),
-    // the run auto-ensures `trustLockfile: true` in pnpm-workspace.yaml so
-    // CI needs no modification and installs need no flags. The same
+    // its lockfileVersion is >= 9 (5.x/6.0 locks mean pnpm 7/8, which have
+    // neither the policy nor the flag and get their own guidance), the run
+    // auto-ensures `trustLockfile: true` in pnpm-workspace.yaml. The same
     // auto-config re-engages on a run that spliced NOTHING when the root v9
-    // lock already carries a granted hosted artifact URL (see HEAL-ON-RERUN
-    // below), so a missed config is healed by re-running the scan. Verified against real installs (2026-08-18 matrix +
-    // tolerance spikes): pnpm 9.15.9 / 10.34.5 silently ignore the key
-    // (frozen installs stay green), pnpm 11.22.0 / 12.0.0-rc.7 accept the
-    // redirected lock with it, and the per-entry sha512 integrity pin still
-    // fails closed on tampered bytes. An explicit user `trustLockfile:
-    // <non-true>` is RESPECTED (never flipped — the warning explains the
-    // manual recoveries instead), and `--no-trust-lockfile-config` opts out
-    // entirely. Rush nested/subspace locks are excluded: rush runs pnpm in
-    // common/temp, which never reads the repo-root pnpm-workspace.yaml, so a
-    // root write would be config theater — those runs keep the manual
-    // guidance. The warning names the host(s) the lock now points at: the
-    // hosted artifact host follows --api-url, so it is not always
-    // patch.socket.dev.
+    // lock already carries a granted hosted artifact URL (HEAL-ON-RERUN
+    // below). pnpm <=10 ignores the key; the per-entry sha512 pin still fails
+    // closed on tampered bytes. An explicit user `trustLockfile: <non-true>`
+    // is RESPECTED (never flipped), and `--no-trust-lockfile-config` opts out.
+    // Rush nested/subspace locks are excluded: rush runs pnpm in common/temp,
+    // which never reads the repo-root pnpm-workspace.yaml. The warning names
+    // the host(s) the lock now points at (they follow --api-url).
     let mut pnpm_warnings: Vec<serde_json::Value> = Vec::new();
     // The pnpm-workspace.yaml content + ledger edit this run will fold into
     // the rewrite set (decided inside the borrow scope, applied after it).
@@ -2344,9 +2270,8 @@ pub(crate) async fn run_redirect_selected(
         // config even though this run spliced nothing — so a project that
         // missed the config once (opted-out first run, or a crash between the
         // lock write and the workspace write) is healed by simply re-running
-        // the scan. Without this, the idempotent no-op re-scan skipped both
-        // the config and the warning forever. An AlreadyTrue workspace keeps
-        // the re-run a byte-stable no-op.
+        // the scan. An AlreadyTrue workspace keeps the re-run a byte-stable
+        // no-op.
         let heal_root: Option<&String> = pnpm_heal_root(
             rewrite.files.contains_key("pnpm-lock.yaml"),
             files.get("pnpm-lock.yaml"),
@@ -2382,10 +2307,7 @@ pub(crate) async fn run_redirect_selected(
             // already-redirected heal root): an npm override may have matched
             // only a sibling lock (e.g. package-lock.json), and naming its host
             // here would point users at a server the pnpm lock never references.
-            // Same presence predicate as the confirmation probe below (raw /
-            // `\/`-escaped via artifact_url_present, plus the percent-encoded
-            // spelling) so a writer's spelling can never be one this filter
-            // misses.
+            // Same needles as the confirmation probe below.
             let npm_overrides: Vec<_> = overrides.iter().filter(|o| o.ecosystem == "npm").collect();
             let groups: Vec<Vec<String>> = npm_overrides
                 .iter()
@@ -2422,13 +2344,10 @@ pub(crate) async fn run_redirect_selected(
                     .get("pnpm-lock.yaml")
                     .and_then(|text| pnpm_lock_version_major(text))
                     .is_some_and(|major| major >= 9);
-            // Every touched pnpm lock is a KNOWN legacy (5.x/6.0) format —
-            // pnpm 7/8 territory, where neither the trust policy nor the
-            // `--trust-lockfile` flag exists (the flag is rejected as an
-            // unknown option), so the manual guidance's headline would hand
-            // users a command that errors. An unparseable version stays on
-            // the manual guidance: never claim "no trust step needed" for a
-            // lock whose era is unknown.
+            // Every touched pnpm lock is a KNOWN legacy (5.x/6.0) format,
+            // where `--trust-lockfile` is rejected as an unknown option. An
+            // unparseable version stays on the manual guidance: never claim
+            // "no trust step needed" for a lock whose era is unknown.
             let all_locks_legacy = pnpm_lock_texts.iter().all(|text| {
                 pnpm_lock_version_major(text).is_some_and(|major| major < 9)
                     || text
@@ -2521,13 +2440,10 @@ pub(crate) async fn run_redirect_selected(
     }
     // npm >= 12 ships `allow-remote=none`: it refuses (EALLOWREMOTE) every
     // tarball whose `resolved` origin is not the configured registry — which
-    // is exactly what a hosted redirect writes. Verified against real
-    // installs (npm 12.0.0 / 12.1.0): a fresh `npm ci` of the redirected lock
-    // fails before fetching anything, while npm <= 11 (11.x ships
-    // `allow-remote=all`; <= 10 has no such setting) installs it unchanged,
-    // and `allow-remote=all` in the project `.npmrc` makes npm 12 install
-    // the patched bytes with the sha512 pins still enforced. `root` is not
-    // enough in general: it only admits DIRECT dependencies of the project.
+    // is exactly what a hosted redirect writes. npm <= 11 installs it
+    // unchanged; `allow-remote=all` in the project `.npmrc` makes npm 12
+    // install the patched bytes with the sha512 pins still enforced (`root`
+    // only admits DIRECT dependencies, so it is not enough).
     //
     // ZERO-TOUCH DEFAULT (the npm twin of the pnpm trustLockfile auto-config
     // above): whenever a root npm lock ends this run carrying a granted
@@ -2671,14 +2587,11 @@ pub(crate) async fn run_redirect_selected(
     // one. A granted reference whose rewriter found nothing to edit (e.g. no
     // lockfile) must NOT be recorded or attested: nothing pins the patch.
     // A `pdm.lock` that is NOT the PyPI install driver (a `uv.lock` or
-    // `poetry.lock` sits beside it) is never rewritten this run, yet it can
-    // still carry a Socket artifact URL from an earlier run when pdm drove.
-    // That stale text pins nothing now, so it must not feed the substring
-    // confirmation probe below — otherwise an untouched uv/poetry project whose
-    // real lock was never redirected would report a bogus `redirected: 1` and
-    // persist a ledger record. When pdm DOES drive, pypi confirmation keys off
-    // `confirmed_pdm_uuids` and never consults this probe, so dropping the file
-    // here is always safe; `pdm.lock` only ever carries pypi URLs.
+    // `poetry.lock` sits beside it) is never rewritten, yet can still carry a
+    // Socket artifact URL from an earlier run. That stale text pins nothing,
+    // so it must not feed the substring probe below. When pdm DOES drive,
+    // pypi confirmation keys off `confirmed_pdm_uuids`, so dropping the file
+    // is always safe.
     let pdm_inactive =
         files.contains_key("pdm.lock") && !socket_patch_core::patch::redirect::pdm_drives(&files);
     // Likewise a `vlt-lock.json` the vlt rewrite was withheld from (its
@@ -2702,7 +2615,7 @@ pub(crate) async fn run_redirect_selected(
     // All needle groups are answered in ONE multi-needle pass per text
     // (`groups_present`), which is the per-candidate `any()` exactly —
     // presence does not depend on search order, and `confirmed` keeps
-    // candidate order. See `confirm_candidates_oracle` for the old form.
+    // candidate order. `candidate_present_oracle` is the reference form.
     let steps: Vec<ProbeStep> = candidates
         .iter()
         .map(|c| {
@@ -2843,15 +2756,11 @@ pub(crate) async fn run_redirect_selected(
     // SYMLINK GUARD — fail-closed, whole rewrite, before the ledger and before
     // any write (hosted rewrites are transactional). The writer below stages
     // next to the path and renames over it, which REPLACES a symbolic link
-    // with a detached regular copy: the link target goes stale (uv itself
-    // writes THROUGH a linked uv.lock/pylock/pyproject), and `--revert`
-    // restores bytes but never the link (git shows a 120000→100644
-    // typechange). Since Python lock discovery follows links, a shared
-    // symlinked lock reaches this point as an ordinary rewrite target; the
-    // revert side (replay.rs) already refuses linked files, so the write
-    // side must too. Applies to every ecosystem's files (a symlinked
-    // package-lock.json has the same defect) and to dry runs, so a dry run
-    // predicts the refusal instead of a rewrite that will never happen.
+    // with a detached regular copy: the link target goes stale and
+    // `--revert` restores bytes but never the link. The revert side
+    // (replay.rs) already refuses linked files, so the write side must too.
+    // Applies to every ecosystem's files and to dry runs, so a dry run
+    // predicts the refusal.
     if let Some(linked) = socket_patch_core::utils::fs::first_symlink(
         &common.cwd,
         rewrite
@@ -2868,15 +2777,11 @@ pub(crate) async fn run_redirect_selected(
     if !common.dry_run {
         let total = confirmed.len();
         // The views are fetched concurrently but consumed in `confirmed`
-        // order, so `records` (newest wins) and `record_warnings` fold
-        // exactly as the serial loop's did. Each response is reduced to
-        // its record inside the window: a view carries every file's
-        // `blobContent`, so buffering whole responses would hold the cap's
-        // worth of patch payloads in memory at once, where the loop only
-        // ever needed the hashes. `record_from_patch_response` is pure, so
-        // folding it early changes nothing downstream. Each fetch's
-        // `--debug` lines are held back and printed at its fold, where the
-        // serial loop would have made the request.
+        // order, so `records` (newest wins), `record_warnings` and the
+        // held-back `--debug` lines fold deterministically. Each response is
+        // reduced to its record inside the window: a view carries every
+        // file's `blobContent`, which would otherwise be buffered for the
+        // whole window.
         let mut views = std::pin::pin!(ordered_concurrent(
             confirmed.iter(),
             api_concurrency_for(api_client.uses_public_proxy(), confirmed.len()),
@@ -2926,16 +2831,12 @@ pub(crate) async fn run_redirect_selected(
         // retried partial failure; records are keyed by PURL, newest wins.
         //
         // Persisted BEFORE the project files, and atomically (stage + fsync +
-        // rename, like the sibling vendor ledger): a crash between the two
-        // then leaves a complete ledger whose recorded originals simply match
-        // files that were never rewritten — instead of rewritten files whose
-        // pre-redirect originals never reached any ledger (a healing re-run
-        // records no edits for already-redirected entries).
+        // rename): a crash between the two leaves a complete ledger whose
+        // originals match files never rewritten, never rewritten files whose
+        // originals reached no ledger.
         if !rewrite.edits.is_empty() || !records.is_empty() {
-            // Ledgers written before the mode-string rename carry
-            // `"mode": "redirect"`; normalize on rewrite so the on-disk
-            // ledger converges on the documented "hosted" name (the
-            // loader accepts either — mode is an opaque string to it).
+            // Older ledgers carry `"mode": "redirect"`; normalize on rewrite
+            // (the loader accepts either).
             ledger.mode = "hosted".to_string();
             // REBASE instead of append for fragment kinds whose file the
             // package manager itself rewrites in place: when the ledger already
@@ -2944,9 +2845,8 @@ pub(crate) async fn run_redirect_selected(
             // `poetry lock --no-update` keeps the Socket source but re-lays the
             // unit and drops the inserted `files` line), appending this run's
             // edits — recorded against the RELOCKED text — would build a chain
-            // whose older links match nothing: rollback and remove then refuse
-            // forever, and the refusal's own remedy ("re-run scan") is what
-            // lengthened the chain. Keeping the oldest `original` (the pristine
+            // whose older links match nothing, so rollback and remove refuse
+            // forever. Keeping the oldest `original` (the pristine
             // fragment) and adopting the fresh `new` keeps the chain a single
             // invertible link: replay swaps the fragment this run wrote back to
             // the fragment the very first run found.
@@ -3014,9 +2914,7 @@ pub(crate) async fn run_redirect_selected(
             // Dedup against the ledger as this run found it, never within
             // this run: one run legitimately records identical edits (a
             // Cargo.toml declaring the crate with the same line in two
-            // sections), and each one reverts one occurrence — collapsing
-            // them made `remove` leave the second pin (and its registry
-            // block) in place while reporting success.
+            // sections), and each one reverts one occurrence.
             let recorded = ledger.edits.len();
             for (i, edit) in rewrite.edits.iter().enumerate() {
                 if vlt_merged[i] {
@@ -3080,12 +2978,9 @@ pub(crate) async fn run_redirect_selected(
     // Gem stale-install probe (see `gem_stale_install_warnings`): runs after
     // the writes so the warning describes the project as this run leaves it.
     // Idempotent re-scans re-confirm and re-probe, so the warning keeps
-    // firing until the stale materialization is actually gone. The gate is
-    // deliberately EXPLICIT, not derived from empty fresh records: --dry-run
-    // rewrites nothing (there is no post-rewrite state to warn about), but
-    // the probe's ledger-record fallback could still judge an
-    // already-redirected project, so without this gate a dry-run would warn
-    // about state the run did not (re)create.
+    // firing until the stale materialization is actually gone. Skipped
+    // EXPLICITLY on --dry-run: the probe's ledger-record fallback would
+    // otherwise judge state the run did not (re)create.
     let gem_stale: StaleInstallOutcome = if common.dry_run {
         StaleInstallOutcome::default()
     } else {
@@ -3126,8 +3021,8 @@ pub(crate) async fn run_redirect_selected(
         .await
     };
 
-    // vlt warm-tree heal (DESIGN §3.9): stale installed copies of the
-    // Socket-owned nodes are invalidated (classified only on a dry run or
+    // vlt warm-tree heal: stale installed copies of the Socket-owned nodes
+    // are invalidated (classified only on a dry run or
     // with --no-vlt-install-cleanup), and every confirmed vlt purl whose
     // installed or next-installed bytes are not known to be patched is
     // withheld from the in-run VEX attestation.
@@ -3160,8 +3055,9 @@ pub(crate) async fn run_redirect_selected(
     // LIVE lockfile actually routes to the hosted patch server (see
     // `classify_overlap_takeover`), so a dry-run / no-op over a lock that still
     // points at the vendored files stays silent instead of pointing cleanup at
-    // the live vendored ledger. Warn (JSON `warnings[]` and stderr) WITHOUT
-    // deleting the other mode's ledger; reconciliation is deferred (see PR Scope).
+    // the live vendored ledger. The takeover pre-revert above already
+    // reconciled what it could; this only warns (JSON `warnings[]` and
+    // stderr) about any overlap left, WITHOUT deleting the other ledger.
     // Classified over this run's in-memory ledgers — the redirect ledger as
     // merged and persisted above, the vendored ledger as the takeover left
     // it — so a non-dry-run reflects this run without re-reading either file.
@@ -3183,9 +3079,8 @@ pub(crate) async fn run_redirect_selected(
 
     // `--prune` is a no-op in hosted mode (both hosted terminals return
     // before the GC blocks): make that explicit in the JSON `warnings[]`
-    // rather than silently dropping the flag — a bot migrating from
-    // `--mode agent --prune` must see WHY it stopped pruning. The human
-    // path warns once up front in `run` (before this flow is entered).
+    // rather than silently dropping the flag. The human path warns once up
+    // front in `run`.
     let mut prune_warnings: Vec<serde_json::Value> = Vec::new();
     if prune_requested {
         prune_warnings.push(prune_ignored_warning());
@@ -3197,13 +3092,10 @@ pub(crate) async fn run_redirect_selected(
     // records WITHOUT hash verification (`assume_applied` — the integrity
     // pins written into the lockfile are the evidence), while any OTHER
     // manifest patches (previously applied / vendored — and any stale ledger
-    // records this run did not confirm) still verify normally. A post-install
-    // `socket-patch vex` hash-verifies the redirected patches against the
-    // installed tree (it reads the records back from the redirect ledger and
-    // re-proves their lockfile wiring — see `commands::vex_sources`), or,
-    // with no install yet, attests from the pinned hosted wiring it finds in
-    // the lockfile. Requested-but-failed VEX (including "nothing to attest")
-    // flips the exit code, matching `scan --vex`.
+    // records this run did not confirm) still verify normally (a
+    // post-install `socket-patch vex` re-proves them — see
+    // `commands::vex_sources`). Requested-but-failed VEX (including "nothing
+    // to attest") flips the exit code.
     let mut vex_statements: Option<usize> = None;
     // VEX run-level advisories: `note_warning` keeps them off stderr under
     // --json, so the envelope's `vex.warnings` is their only channel there.
@@ -3215,18 +3107,14 @@ pub(crate) async fn run_redirect_selected(
         // Hosted mode wrote only lockfiles and config files since scan's
         // crawl, never a directory the npm root walk descends into, so its
         // roots and packages still describe the tree (the snapshot checks
-        // it was taken with these crawler options). The interactive scan
-        // hands none in when its confirm prompt waited on a person — the
-        // tree may have changed while it did.
+        // it was taken with these crawler options). `get --mode hosted`
+        // passes none.
         params.npm_prior = npm_prior.cloned();
         // Stale-flagged purls are EXCLUDED from assume_applied: the same-run
         // envelope carries a redirect_gem_stale_install warning proving the
         // installed materialization unpatched, so attesting that purl from
         // the ledger would contradict the run's own warning. Excluded purls
-        // fall back to `vex`'s normal installed-tree verification — a
-        // patched install still attests (with hash evidence), a stale one is
-        // omitted (and "nothing to attest" fails the command, per the
-        // embedded-VEX contract).
+        // fall back to `vex`'s normal installed-tree verification.
         params.assume_applied = confirmed
             .iter()
             .map(|(purl, _)| purl.clone())
@@ -3286,11 +3174,8 @@ pub(crate) async fn run_redirect_selected(
     if common.json {
         // Nest the redirect result under `redirect` inside the classic scan
         // object (built by `run`, threaded in via `scan_result`), mirroring
-        // vendored mode's nested `vendor` block. This keeps the hosted `--json`
-        // envelope schema-consistent with the zero-discovery and non-hosted
-        // scan envelopes — same top-level scan keys (scannedPackages,
-        // totalPatches, canAccessPaidPatches) plus the `packages` enumeration —
-        // instead of the bare `{status, redirect}` it used to emit.
+        // vendored mode's nested `vendor` block, so the hosted `--json`
+        // envelope keeps the same top-level scan keys as every other scan.
         let redirect = redirect_json_block(
             confirmed.len(),
             rewritten,
@@ -3950,8 +3835,7 @@ mod tests {
         }
     }
 
-    /// Lock-head version sniff against the byte-real heads the 2026-08-18
-    /// matrix captured from pnpm 7/8/9-12: quoted `'9.0'` and `'6.0'`,
+    /// Lock-head version sniff against real pnpm 7/8/9-12 heads: quoted `'9.0'` and `'6.0'`,
     /// unquoted `5.4`; a headless/garbled lock yields `None` (hands-off).
     #[test]
     fn pnpm_lock_version_major_sniffs_real_lock_heads() {
@@ -4110,13 +3994,11 @@ mod tests {
         assert!(!manual.contains('@'), "{manual}");
     }
 
-    /// FINDING-10 regression: the legacy-lock (5.x/6.0 — pnpm 7/8) guidance
-    /// must NEVER mention `--trust-lockfile` (pnpm 7/8 reject the flag as an
-    /// unknown option) nor the `trustLockfile` setting (pnpm 7/8 ignore it);
-    /// it must say installs work unchanged with no trust step, keep the
-    /// don't-regenerate caution, and leak no URL authority. RED-verified: the
-    /// pre-fix manual guidance headlined `pnpm install --trust-lockfile` for
-    /// legacy locks, which errors out on pnpm 7/8.
+    /// The legacy-lock (5.x/6.0 — pnpm 7/8) guidance must NEVER mention
+    /// `--trust-lockfile` (pnpm 7/8 reject the flag as an unknown option) nor
+    /// the `trustLockfile` setting (pnpm 7/8 ignore it); it must say installs
+    /// work unchanged with no trust step, keep the don't-regenerate caution,
+    /// and leak no URL authority.
     #[test]
     fn pnpm_trust_legacy_detail_never_recommends_the_trust_flag() {
         let server = "the hosted patch server (patch.test)";
@@ -4138,12 +4020,10 @@ mod tests {
         assert!(!legacy.contains('@'), "no URL authority may leak: {legacy}");
     }
 
-    /// FINDING-5 regression: a PRESENT-but-unreadable pnpm-workspace.yaml
-    /// must classify as `Err` — never as `Ok(None)`, which plans a Create
-    /// that overwrites the user's file (destroying their `packages:` globs).
-    /// Absent stays `Ok(None)` (the only Create-safe state); readable stays
-    /// `Ok(Some)`. RED-verified: the pre-fix `.ok()` collapsed the
-    /// invalid-UTF-8 read error below to `None`.
+    /// A PRESENT-but-unreadable pnpm-workspace.yaml must classify as `Err` —
+    /// never as `Ok(None)`, which plans a Create that overwrites the user's
+    /// file (destroying their `packages:` globs). Absent stays `Ok(None)`
+    /// (the only Create-safe state); readable stays `Ok(Some)`.
     #[test]
     fn read_workspace_for_trust_distinguishes_unreadable_from_absent() {
         let tmp = tempfile::tempdir().unwrap();
@@ -4268,8 +4148,7 @@ mod tests {
     }
 
     /// Without a Pipfile.lock the gate is false whatever the candidates
-    /// are, exactly as `pipenv_lock_targets` answers it — so the early
-    /// return skips only the list the question would have been asked with.
+    /// are, exactly as `pipenv_lock_targets` answers it.
     #[test]
     fn pipenv_probe_certain_is_false_without_a_pipfile_lock() {
         use super::pipenv_probe_certain;
@@ -4310,7 +4189,7 @@ mod tests {
         }
     }
 
-    /// FINDING-6 regression (heal-on-rerun probe): a root lock ALREADY
+    /// Heal-on-rerun probe: a root lock ALREADY
     /// carrying a granted hosted artifact URL from an earlier run — raw,
     /// `\/`-escaped, or percent-encoded — is detected even when this run
     /// spliced nothing, so the trust config can be (re)planned for a project
@@ -4324,9 +4203,7 @@ mod tests {
         cargo.ecosystem = "cargo".to_string();
         let overrides = vec![npm_override(url), cargo];
 
-        // The exact splice shape an earlier run wrote (heal-on-rerun with a
-        // pre-redirected lock and a missing workspace file: this probe is
-        // what re-engages the trust planning on the re-scan).
+        // The exact splice shape an earlier run wrote.
         let redirected = format!(
             "lockfileVersion: '9.0'\n\npackages:\n  in-proc-heal@1.0.0:\n    \
              resolution: {{integrity: sha512-PATCHED==, tarball: {url}}}\n"
@@ -4356,14 +4233,11 @@ mod tests {
         assert!(!pnpm_lock_carries_hosted_redirect(&redirected, &[]));
     }
 
-    /// FINDING-6 regression (heal-on-rerun gate, the production
-    /// `pnpm_heal_root` wiring): a re-scan that spliced NOTHING over a
-    /// pre-redirected root v9 lock with a MISSING pnpm-workspace.yaml must
-    /// engage the trust block (heal → plan Create), while a legacy
+    /// Heal-on-rerun gate (`pnpm_heal_root`): a re-scan that spliced NOTHING
+    /// over a pre-redirected root v9 lock with a MISSING pnpm-workspace.yaml
+    /// must engage the trust block (heal → plan Create), while a legacy
     /// pre-redirected lock, an unparseable-version lock, a pristine lock,
     /// and a root lock this run DID splice all stay out of the heal path.
-    /// RED-verified by construction: the pre-fix trigger was
-    /// `!spliced.is_empty()` alone, i.e. this gate always answered None.
     #[test]
     fn pnpm_heal_root_re_engages_trust_planning_for_pre_redirected_v9_locks() {
         let url = "http://patch.test/patch/npm/in-proc-heal/1.0.0/tok/uuid/in-proc-heal-1.0.0.tgz";
@@ -4375,8 +4249,7 @@ mod tests {
 
         // The heal scenario: nothing spliced this run, root lock already
         // redirected, workspace file missing → the gate engages and the
-        // planning it feeds produces the Create the crashed/opted-out first
-        // run never wrote.
+        // planning it feeds produces the Create.
         let healed = pnpm_heal_root(false, Some(&redirected_v9), &overrides)
             .expect("a pre-redirected root v9 lock must re-engage the trust block");
         assert_eq!(healed, &redirected_v9);
@@ -4432,14 +4305,11 @@ mod tests {
 
     #[test]
     fn hosted_json_envelope_nests_redirect_into_classic_scan_object() {
-        // Regression for hosted-scan-json-schema-flips-with-discovery /
-        // hosted-scan-json-omits-enumeration: with ≥1 package, the hosted
-        // `--json` envelope must carry the SAME top-level scan keys as a
-        // zero-discovery / non-hosted scan (the old bare `{status, redirect}`
-        // dropped them) AND nest the redirect summary under `redirect`.
-        // Built through the ONE spelling of the block (the production
-        // site and `run`'s zero-discovery arm use the same helper), so the
-        // key set asserted below is the tested single source.
+        // With ≥1 package, the hosted `--json` envelope must carry the SAME
+        // top-level scan keys as a zero-discovery / non-hosted scan AND nest
+        // the redirect summary under `redirect`. Built through the ONE
+        // spelling of the block (`run`'s zero-discovery arm uses the same
+        // helper).
         let redirect = redirect_json_block(
             1,
             vec!["package-lock.json".to_string()],
@@ -4449,7 +4319,7 @@ mod tests {
         );
         let envelope = build_redirect_json_envelope(Some(classic_scan_result()), redirect);
 
-        // Classic scan keys survive — the bug was that they did not.
+        // Classic scan keys survive.
         assert_eq!(envelope["status"], "success");
         assert_eq!(envelope["scannedPackages"], 3);
         assert_eq!(envelope["packagesWithPatches"], 1);
@@ -4459,7 +4329,7 @@ mod tests {
         assert_eq!(envelope["canAccessPaidPatches"], false);
         assert!(envelope["updates"].is_array());
 
-        // Per-package / patch-uuid enumeration is present (the omission).
+        // Per-package / patch-uuid enumeration is present.
         assert!(envelope["packages"].is_array());
         assert_eq!(envelope["packages"][0]["purl"], "pkg:npm/minimist@1.2.2");
         assert_eq!(envelope["packages"][0]["patches"][0]["uuid"], "abc-123");
@@ -5734,7 +5604,7 @@ mod tests {
         );
     }
 
-    /// REGRESSION (npm 12): every hosted npm redirect variant tells the user
+    /// Every hosted npm redirect variant tells the user
     /// that npm >= 12 refuses the redirected lock (EALLOWREMOTE) without
     /// `allow-remote=all`, and carries the whole-tree tradeoff disclosure —
     /// the auto-configured, already-set, explicit-other, opted-out and
@@ -5871,8 +5741,8 @@ mod tests {
     }
 }
 
-/// H1 equivalence: the one-pass multi-needle confirmation probe answers
-/// exactly what the per-candidate `any()` it replaced answered.
+/// The one-pass multi-needle confirmation probe answers exactly what the
+/// per-candidate `any()` oracle answers.
 #[cfg(test)]
 mod probe_equivalence_tests {
     use super::{candidate_presence_needles, candidate_present_oracle, npm_lock_url_needles};
diff --git a/crates/socket-patch-cli/src/commands/scan/hosted/python.rs b/crates/socket-patch-cli/src/commands/scan/hosted/python.rs
index 8f0eeef9..c43f7690 100644
--- a/crates/socket-patch-cli/src/commands/scan/hosted/python.rs
+++ b/crates/socket-patch-cli/src/commands/scan/hosted/python.rs
@@ -10,8 +10,9 @@ use socket_patch_core::vex::verify::judge_installed_record;
 use super::StaleInstallOutcome;
 
 /// A lock rewrite cannot prove a warm virtualenv has installed the wheel.
-/// Use the same discovery as apply (including Poetry's out-of-tree venvs),
-/// and inspect every interpreter rather than deduplicating by package name.
+/// Use the project's own venv discovery (`--global`/`--global-prefix` use
+/// the crawler's global paths), and inspect every interpreter rather than
+/// deduplicating by package name.
 /// Missing/unreadable files are not positive evidence of stale bytes.
 pub(super) async fn stale_install_warnings(
     common: &crate::args::GlobalArgs,
@@ -40,10 +41,9 @@ pub(super) async fn stale_install_warnings(
     let crawler = PythonCrawler::new();
     // Only venvs that belong to THIS project (VIRTUAL_ENV, ./.venv, ./venv,
     // Poetry's and Pipenv's out-of-tree venvs): the crawler's project-marker
-    // fallback to the global interpreters would judge some unrelated Python's
-    // copy of the release (a tool venv on PATH) and warn about a venv the
-    // project's installer never touches — a false positive that also fails
-    // the same-run --vex. --global / --global-prefix keep their meaning.
+    // fallback to the global interpreters would judge an unrelated Python's
+    // copy of the release (a tool venv on PATH) and warn falsely.
+    // --global / --global-prefix keep their meaning.
     let paths = if common.is_global() {
         crawler
             .get_site_packages_paths(&common.crawler_options())
diff --git a/crates/socket-patch-cli/src/commands/scan/hosted/vlt.rs b/crates/socket-patch-cli/src/commands/scan/hosted/vlt.rs
index 75167406..d819af6b 100644
--- a/crates/socket-patch-cli/src/commands/scan/hosted/vlt.rs
+++ b/crates/socket-patch-cli/src/commands/scan/hosted/vlt.rs
@@ -576,9 +576,8 @@ pub(crate) async fn rollback_heal(
         .collect()
 }
 
-/// The hosted→vendored heal (DESIGN §4.10 step 4): once a purl is
-/// vendored over its reverted hosted pin, the lock no longer names the
-/// registry DepID, so a store copy still holding the hosted bytes is stale
+/// The hosted→vendored heal: once a purl is vendored over its reverted
+/// hosted pin, the lock no longer names the registry DepID, so a store copy still holding the hosted bytes is stale
 /// against the pristine expectation and is invalidated like a rollback's.
 pub(crate) async fn takeover_heal(
     common: &crate::args::GlobalArgs,
diff --git a/crates/socket-patch-cli/src/commands/scan/mod.rs b/crates/socket-patch-cli/src/commands/scan/mod.rs
index ae48f665..e471d659 100644
--- a/crates/socket-patch-cli/src/commands/scan/mod.rs
+++ b/crates/socket-patch-cli/src/commands/scan/mod.rs
@@ -69,8 +69,8 @@ use self::vendor_flow::{
 const DEFAULT_BATCH_SIZE: usize = 500;
 
 /// Packages per batch request on the public proxy when `--batch-size` is
-/// not given. The proxy is shared and unauthenticated, so it keeps the
-/// historical size.
+/// not given. The proxy is shared and unauthenticated, so it keeps a
+/// smaller size.
 const DEFAULT_PROXY_BATCH_SIZE: usize = 100;
 
 /// Upper bound on one batch request's JSON body. A chunk whose purls would
@@ -147,11 +147,9 @@ pub enum ScanMode {
     /// Rewrite lockfiles so only patched dependencies resolve to Socket's
     /// hosted patch server: no artifact bytes land in the repo, but
     /// installs must reach the patch server
-    // Equivalent to the hidden `--redirect` boolean. Hidden value aliases
-    // mirror the legacy flag spellings symmetrically: `host` matches the
-    // old mode name, `redirect` matches the `--redirect` boolean (vendored
-    // accepts `vendor` for the same reason; `apply` is NOT an alias of
-    // agent — applying is not a scan mode name anywhere else).
+    // Equivalent to the hidden `--redirect` boolean. The hidden value
+    // aliases mirror legacy spellings (`apply` is deliberately NOT an alias
+    // of agent).
     #[value(alias = "host", alias = "redirect")]
     Hosted,
     /// Commit patched artifacts to `.socket/vendor/`: hermetic,
@@ -196,9 +194,8 @@ impl ScanMode {
 ///   Hosted mode runs no GC, so `--mode hosted --prune` stays accepted but
 ///   emits an explicit `redirect_prune_ignored` warning in `run` rather
 ///   than silently dropping the flag.
-/// * `--detached` requires vendored mode in either spelling. The former
-///   clap-level `requires = "vendor"` couldn't see `--mode vendored`, so
-///   the requirement moved here too.
+/// * `--detached` requires vendored mode in either spelling (clap's
+///   `requires = "vendor"` cannot see `--mode vendored`).
 ///
 /// Public (not `pub(crate)`) so the CLI-contract tests can exercise the
 /// fold without driving a full `run()`.
@@ -289,11 +286,8 @@ pub struct ScanArgs {
     #[arg(long = "batch-size", env = "SOCKET_BATCH_SIZE")]
     pub batch_size: Option<usize>,
 
-    /// Deprecated spelling of `--mode agent`. With `--json`, download and
-    /// apply the selected patches without prompting (without a mode,
-    /// `scan --json` only reports). Without `--json` it asks first on a
-    /// terminal and proceeds otherwise, whereas a scan with no mode and no
-    /// `--yes` only reports when stdin is not a terminal
+    /// Deprecated spelling of `--mode agent`: download the selected patches
+    /// and apply them in place
     #[arg(long, default_value_t = false)]
     pub apply: bool,
 
@@ -307,8 +301,8 @@ pub struct ScanArgs {
     pub prune: bool,
 
     /// Shorthand for `--mode agent --prune`: a cron job or CI workflow can
-    /// run `socket-patch scan --json --sync --yes` to end up fully
-    /// reconciled in one invocation
+    /// run `socket-patch scan --json --sync` to end up fully reconciled in
+    /// one invocation
     #[arg(long, default_value_t = false)]
     pub sync: bool,
 
@@ -331,22 +325,13 @@ pub struct ScanArgs {
     #[arg(long, default_value_t = false, hide = true)]
     pub detached: bool,
 
-    /// Redirect every patched dependency to Socket's HOSTED vendored patches
-    /// by rewriting lockfiles/registry configs so ONLY the patched dependency
-    /// points at the patch-server (`--patch-server-url`), instead of applying
-    /// patches in place or ejecting local artifacts. This is the remote
-    /// counterpart of `--vendor`: no artifact bytes land in the repo — the
-    /// lockfile pins the hosted URL + integrity (npm/pypi/composer) or a
-    /// per-dependency registry override (cargo/nuget/gem/…). Conflicts with
-    /// `--apply`/`--sync`/`--vendor`. Hidden from help: the flag is
-    /// unreleased and `--mode hosted` is the documented spelling.
+    // Hidden legacy spelling of `--mode hosted`.
     #[arg(long, default_value_t = false, hide = true, conflicts_with_all = ["apply", "sync", "vendor"])]
     pub redirect: bool,
 
-    /// How discovered patches are consumed. Without a mode, an interactive
-    /// scan offers to apply them in place and `scan --json` only reports.
-    /// `--vendor` and `--apply` are older spellings of `--mode vendored`
-    /// and `--mode agent`
+    /// How discovered patches are consumed [default: hosted]. A `--prune`
+    /// or `--global` scan with no mode only reports. `--vendor` and
+    /// `--apply` are older spellings of `--mode vendored` and `--mode agent`
     // Each mode is equivalent to one boolean flag (hosted == the hidden
     // `--redirect`, vendored == `--vendor`, agent == `--apply`/`--sync`).
     // Combining `--mode` with a boolean from a DIFFERENT mode is rejected in
@@ -552,24 +537,18 @@ async fn embed_vex_human(
 
 /// The per-package discovery + selection step shared by the apply, vendor,
 /// and redirect flows: search each patched package's full patch list, then
-/// resolve the newest accessible patch per PURL. Per-package search errors
-/// are skipped — but when EVERY query errors the step produced no
-/// trustworthy patch data at all, and reporting the empty set would be
-/// indistinguishable from a genuine "no patches" result (the same masking
-/// the batch loop in `run` guards against), so that surfaces as `Err(1)`
-/// with the failure on stderr. Selects with [`selection_args`]:
-/// scan-driven workflows have no "specify --id" option, so non-TTY runs
-/// auto-select the newest patch rather than erroring with
-/// `selection_required`. `Err` carries the exit code AND the message: the
-/// JSON callers must fold it into their envelope (every `--json`
-/// invocation emits exactly one JSON object — see CLI_CONTRACT.md), so
-/// the stderr line alone is not enough. `show_progress` / `warn` are the
-/// human-only output knobs of [`fetch_patch_details`] (the JSON callers pass
-/// `false, false`; the hosted human arm passes the same values as the agent
-/// human arm, so the two print the same progress counter and per-package
-/// warnings). `json_warnings` is the JSON callers' envelope: a partial
-/// failure (some queries failed, not all) adds one
-/// [`PATCH_DETAILS_FAILED`] run-level warning per failed package to it.
+/// resolve the top-ranked accessible patch per PURL. Per-package search
+/// errors are skipped, but when EVERY query errors the empty set would be
+/// indistinguishable from a genuine "no patches" result, so that surfaces
+/// as `Err(1)` with the failure on stderr. Selects with [`selection_args`]:
+/// scan never prompts, so every run auto-selects the top-ranked patch (see
+/// `api::ranking`) rather than erroring with `selection_required`. `Err`
+/// carries the exit code AND the message, since JSON callers must fold it
+/// into their single envelope (CLI_CONTRACT.md). `show_progress` / `warn`
+/// are the human-only knobs of [`fetch_patch_details`] (JSON callers pass
+/// `false, false`). `json_warnings` is the JSON callers' envelope: a
+/// partial failure adds one [`PATCH_DETAILS_FAILED`] warning per failed
+/// package to it.
 #[allow(clippy::too_many_arguments)]
 async fn discover_selected(
     api_client: &socket_patch_core::api::client::ApiClient,
@@ -584,8 +563,8 @@ async fn discover_selected(
     let (all_search_results, failures) =
         fetch_patch_details(api_client, packages, show_progress, warn).await;
     // The scan event's send overlapped the detail fetches; every caller's
-    // next output (the error line below, a `--json` envelope, a prompt)
-    // must find it delivered.
+    // next output (the error line below, a `--json` envelope) must find it
+    // delivered.
     telemetry.flush().await;
     let error_count = failures.len();
     if error_count > 0 && error_count == packages.len() {
@@ -613,11 +592,8 @@ async fn discover_selected(
         return Ok(Vec::new());
     }
     if common.json {
-        // A `--json` run must never open the interactive menu (it would
-        // pop up over a machine-read stream on a TTY): pick the top-ranked
-        // accessible patch per PURL, exactly what a non-TTY run does.
-        // `select_patches` takes the top-ranked patch without prompting
-        // when every candidate is accessible, so pre-filter to those.
+        // Pre-filter to accessible patches so `select_patches` takes the
+        // top-ranked one per PURL.
         let accessible: Vec<PatchSearchResult> = all_search_results
             .into_iter()
             .filter(|p| can_access_paid_patches || p.tier == "free")
@@ -714,7 +690,7 @@ async fn fetch_patch_details(
 /// The human hosted arm's stand-in for the lenient loader's advisory: a
 /// malformed redirect ledger the engine would report as a hard error, on a
 /// run that returned BEFORE the engine (empty discovery, nothing
-/// downloadable, a detail-fetch failure, a declined confirm). Read-only —
+/// downloadable, a detail-fetch failure). Read-only —
 /// the file is never moved; `--silent` mutes it like every advisory.
 fn warn_unreported_corrupt_ledger(common: &crate::args::GlobalArgs, corrupt: Option<&str>) {
     if let Some(corrupt) = corrupt {
@@ -791,10 +767,6 @@ fn partition_agent_selection(
     }
 }
 
-/// The `DownloadParams` every scan-driven download shares. Only the output
-/// shape (`json`/`silent`) and `save_only` differ per flow; vendored mode
-/// never persists blobs (its records stay in memory and the vendor step
-/// consumes the staged sources).
 /// The ecosystems a scan crawls (`None`: every one). `--ecosystems`
 /// narrows everything the run counts, queries and shows to the named
 /// ecosystems, so without a GC the other crawlers' output would only be
@@ -810,6 +782,10 @@ fn crawl_scope(prune: bool, ecosystems: Option<&[String]>) -> Option<&[String]>
     }
 }
 
+/// The `DownloadParams` every scan-driven download shares. Only the output
+/// shape (`json`/`silent`) and `save_only` differ per flow; vendored mode
+/// never persists blobs (its records stay in memory and the vendor step
+/// consumes the staged sources).
 fn download_params(args: &ScanArgs, save_only: bool, json: bool, silent: bool) -> DownloadParams {
     DownloadParams {
         cwd: args.common.cwd.clone(),
@@ -845,26 +821,19 @@ fn download_run<'a>(args: &ScanArgs, api_client: &'a ApiClient) -> DownloadRun<'
 //
 // Hosted mode writes `.socket/vendor/redirect-state.json`; vendored mode
 // writes `.socket/vendor/state.json` (+ committed tarballs). Switching a
-// project's mode rewires the lockfile to the NEW mode but leaves the OLD
-// mode's ledger on disk asserting wiring that is no longer live (and, for
-// vendored→hosted, the orphaned tarball behind). Anything auditing a ledger
-// as "what is live" (including `vex`) is then misled. Detect the overlap so
-// each flow can warn. Reconciliation is per direction: the VENDORED flows
-// clean the superseded redirect-ledger halves themselves (cargo via
-// `revert_cargo_redirect_purl` before vendoring, npm-family via
-// `note_vendor_supersedes_redirect` after — always announced by the
-// takeover warning, never silent); the HOSTED direction stays warn-only
-// (removing a vendored ledger entry means deleting committed artifacts —
-// `remove <purl>`'s job, on the operator's say-so).
+// project's mode rewires the lockfile but leaves the OLD mode's ledger on
+// disk asserting wiring that is no longer live, which misleads anything
+// auditing a ledger (including `vex`). Detect the overlap so each flow can
+// warn. The VENDORED flows clean the superseded redirect-ledger halves
+// themselves (always announced); the HOSTED direction stays warn-only
+// (removing a vendored entry deletes committed artifacts — `remove
+// <purl>`'s job).
 //
-// The overlap alone only proves BOTH ledgers name the same package(s) — NOT
-// which one won. The takeover DIRECTION is decided by the ACTUAL current
-// lockfile wiring for each overlapping package (see `classify_overlap_takeover`),
-// never by which command happens to be running: a hosted dry-run/no-op over a
-// lock that still points at the vendored files must not tell the user to delete
-// the live vendored ledger (and vice-versa). Remediation always points at the
-// ledger that does NOT match the live lock; a package the lock proves neither
-// way stays silent.
+// The overlap only proves BOTH ledgers name the package, not which won. The
+// takeover DIRECTION comes from the current lockfile wiring per package
+// (`classify_overlap_takeover`), never from which command is running;
+// remediation points at the ledger that does NOT match the live lock, and a
+// package the lock proves neither way stays silent.
 
 /// Warning code emitted by the HOSTED flow when it just redirected package(s)
 /// a committed vendored ledger still claims (its tarballs are now orphaned).
@@ -875,12 +844,10 @@ pub(super) const REDIRECT_SUPERSEDES_VENDORED: &str = "redirect_supersedes_vendo
 pub(super) const VENDOR_SUPERSEDES_REDIRECT: &str = "vendor_supersedes_redirect";
 
 /// Warning code + detail emitted when `--prune` is combined with
-/// `--mode hosted`: both hosted terminals return before the GC blocks, so
-/// the flag would otherwise be silently dropped — a bot migrating its sync
-/// job from `--mode agent --prune` to `--mode hosted --prune` would stop
-/// pruning forever with exit 0 and no signal. `--prune` stays accepted
-/// (CLI_CONTRACT.md: an orthogonal GC knob, never a usage error), but the
-/// no-op must be explicit in both the JSON `warnings[]` and stderr.
+/// `--mode hosted`: the hosted flow runs no GC, so the flag would otherwise
+/// be silently dropped. `--prune` stays accepted (CLI_CONTRACT.md: an
+/// orthogonal GC knob, never a usage error), but the no-op is explicit in
+/// both the JSON `warnings[]` and stderr.
 pub(super) const REDIRECT_PRUNE_IGNORED: &str = "redirect_prune_ignored";
 pub(super) const REDIRECT_PRUNE_IGNORED_DETAIL: &str =
     "--prune has no effect with --mode hosted: the hosted flow rewrites lockfiles only and \
@@ -889,15 +856,10 @@ pub(super) const REDIRECT_PRUNE_IGNORED_DETAIL: &str =
 
 /// The PURLs claimed by BOTH the hosted redirect ledger
 /// (`.socket/vendor/redirect-state.json`) and the vendored state ledger
-/// (`.socket/vendor/state.json`), sorted, over ALREADY-LOADED ledgers —
-/// loads nothing, so a flow holding both in memory (the hosted engine,
-/// post-merge) shares its copies instead of re-reading them. A non-empty
-/// result means one mode has taken the lockfile over from the other for
-/// these package(s) while the displaced mode's ledger stayed on disk —
-/// exactly one of the two ledgers is stale for each PURL (a package's
-/// lockfile entry can point only one way). `None` / an empty vendor ledger
-/// yield the empty overlap; disjoint ledgers (a legitimate split: some
-/// redirected, others vendored) too — so there are no false positives.
+/// (`.socket/vendor/state.json`), sorted, over already-loaded ledgers. A
+/// non-empty result means exactly one of the two ledgers is stale for each
+/// PURL (a lockfile entry can point only one way). `None`, an empty vendor
+/// ledger, or disjoint ledgers (a legitimate split) yield no overlap.
 fn overlap_from_states(
     redirect: Option<&socket_patch_core::patch::redirect::RedirectState>,
     vendor: &VendorState,
@@ -926,17 +888,13 @@ fn overlap_from_states(
             .collect();
     }
     // The records map can be EMPTY while the ledger still asserts stale lock
-    // wiring: a run where every per-uuid record fetch failed persists its
-    // edits with no records (`record_fetch_failed`). Deriving the redirect
-    // side of the overlap from record keys alone would leave the takeover
-    // machinery blind to exactly that degraded ledger, so fall back to
-    // matching the vendored purls against the recorded edit keys — npm
-    // `node_modules/<name>` (possibly nested), pnpm/yarn/cargo/uv
-    // `<name>@<version>` (vlt `<name>@<version>~<extra>` for a peer or
-    // modifier variant), bun `<prefix>/<name>`, gem/composer/pypi bare
-    // `<name>`. Name-level matching can over-claim across versions, but the
-    // direction gate in `classify_overlap_takeover` still requires the live
-    // lock to prove one side before anything is reported.
+    // wiring (every per-uuid record fetch failed: `record_fetch_failed`), so
+    // fall back to matching the vendored purls against the recorded edit
+    // keys — npm `node_modules/<name>` (possibly nested), pnpm/yarn/cargo/uv
+    // `<name>@<version>` (vlt `<name>@<version>~<extra>`), bun
+    // `<prefix>/<name>`, gem/composer/pypi bare `<name>`. Name-level matching
+    // can over-claim across versions, but `classify_overlap_takeover` still
+    // requires the live lock to prove one side before anything is reported.
     if redirect.edits.is_empty() {
         return Vec::new();
     }
@@ -965,23 +923,15 @@ fn overlap_from_states(
 ///
 /// Both directions are proved by lockfile discovery with the same liveness
 /// rules `vex` gates attestations on (core `Discovery::redirect_record_live`
-/// / `Discovery::vendor_entry_live` — every package manager's lock read
-/// through its extractor, cargo's `Cargo.lock` + `[patch]` shapes included,
-/// with the ledger's recorded files as the fallback for a uuid no read file
-/// mentions). `redirect` holds the overlap PURLs the lock currently routes
-/// to the hosted patch server: hosted genuinely won the lockfile, so the
-/// vendored ledger entry (and its now-orphaned tarball) is the stale one and
-/// `redirect_supersedes_vendored` is truthful. `vendored` holds the PURLs the
-/// lock currently routes to a committed `.socket/vendor/<eco>/<uuid>` artifact:
-/// vendored won, the redirect ledger record is stale, and
-/// `vendor_supersedes_redirect` is truthful.
+/// / `Discovery::vendor_entry_live`). `redirect` holds the overlap PURLs the
+/// lock routes to the hosted patch server (the vendored ledger entry is
+/// stale); `vendored` holds those it routes to a committed
+/// `.socket/vendor/<eco>/<uuid>` artifact (the redirect record is stale).
 ///
 /// A PURL the lock proves NEITHER way — a dry-run/no-op that did not rewire it,
 /// a half-migrated lock naming both, or an ecosystem whose live spec we cannot
-/// read — lands in neither bucket, so the caller stays SILENT instead of
-/// guessing the direction from which command happened to run (the
-/// takeover-direction bug: a hosted no-op pointing cleanup at the live vendored
-/// ledger).
+/// read — lands in neither bucket, so the caller stays SILENT rather than
+/// guessing the direction from which command happened to run.
 #[derive(Debug, Default, PartialEq)]
 pub(super) struct OverlapTakeover {
     /// Overlap PURLs whose vendored ledger is stale (lock points hosted).
@@ -1003,12 +953,10 @@ pub(super) async fn classify_overlap_takeover(common: &GlobalArgs, cwd: &Path) -
     classify_overlap_takeover_with(common, cwd, redirect.as_ref(), vendor.as_ref()).await
 }
 
-/// [`classify_overlap_takeover`] over ALREADY-LOADED ledgers: loads neither
-/// (the hosted engine holds both in memory — its post-merge redirect ledger
-/// and the post-takeover vendor ledger — and must classify against those,
-/// never a pre-takeover snapshot) but still reads the LIVE lockfiles in
-/// `cwd`, the truth source for direction. `None` for either ledger yields
-/// no overlap.
+/// [`classify_overlap_takeover`] over already-loaded ledgers (the hosted
+/// engine must classify against its in-memory post-merge / post-takeover
+/// copies, never a pre-takeover snapshot); still reads the LIVE lockfiles
+/// in `cwd`. `None` for either ledger yields no overlap.
 pub(super) async fn classify_overlap_takeover_with(
     common: &GlobalArgs,
     cwd: &Path,
@@ -1078,28 +1026,20 @@ pub(super) async fn classify_overlap_takeover_with(
 /// hosted redirect displaced a vendored ledger, `false` when a vendored run
 /// displaced a hosted redirect ledger.
 ///
-/// The warning fires PER PACKAGE (the direction is proved per purl by the
-/// live lockfile), so the remediation must be per-package and non-destructive
-/// too. It must never tell the user to delete a whole ledger file or a whole
-/// `.socket/vendor/<eco>/` tree: both may still carry LIVE data for packages
-/// this takeover did not touch — the redirect ledger holds other packages'
-/// records (VEX reads them) plus the recorded pre-redirect lockfile originals
-/// (the only revert data), and the `<eco>/` tree holds every vendored uuid
-/// dir, including packages the hosted run skipped.
+/// The warning fires PER PACKAGE, so the remediation is per-package and
+/// non-destructive: never delete a whole ledger file or a whole
+/// `.socket/vendor/<eco>/` tree, which may still carry LIVE data for
+/// packages this takeover did not touch (other records VEX reads, the
+/// pre-redirect originals that are the only revert data, other vendored
+/// uuid dirs).
 ///
-/// Per package also has to mean COMPLETE per package, or the remediation does
-/// not converge:
+/// It must also be COMPLETE per package, or it does not converge:
 ///
 /// * The vendored direction names the package's `edits` entry alongside its
-///   `records` entry. `overlap_from_states` falls back to matching edit
-///   KEYS once `records` is empty (the degraded-ledger blind spot), so a
-///   records-only cleanup that happened to delete the last record left the
-///   package still matching and this warning firing on every later run —
-///   repeating advice the operator had already carried out.
-/// * The hosted direction describes `socket-patch remove`'s full blast radius.
-///   It deletes the package's `.socket/manifest.json` entry too, not just the
-///   vendor ledger entry and artifact dir, and a reader who budgeted for a
-///   ledger-only edit needs to know that before running it with `--yes`.
+///   `records` entry: `overlap_from_states` falls back to edit KEYS once
+///   `records` is empty, so a records-only cleanup keeps this warning firing.
+/// * The hosted direction states `socket-patch remove`'s full blast radius,
+///   including the package's `.socket/manifest.json` entry.
 pub(super) fn mode_takeover_detail(superseded: &[String], current_is_hosted: bool) -> String {
     let list = superseded.join(", ");
     if current_is_hosted {
@@ -1131,9 +1071,7 @@ pub(super) fn mode_takeover_detail(superseded: &[String], current_is_hosted: boo
     } else {
         // NEVER advise deleting the redirect ledger by hand: it may hold the
         // only revert data (FileEdit originals) and VEX records for OTHER
-        // packages that are still hosted-redirected. The vendored flows
-        // reconcile per package — reverting the stale hosted edits and
-        // dropping exactly the superseded ledger records.
+        // packages that are still hosted-redirected.
         format!(
             "vendored artifacts superseded the hosted redirect ledger for: {list}. \
              `.socket/vendor/redirect-state.json` still records a hosted redirect for \
@@ -1161,21 +1099,17 @@ pub(super) fn mode_takeover_detail(superseded: &[String], current_is_hosted: boo
 }
 
 /// Detail for the vendored-direction takeover warning on the run that
-/// RECONCILED the ledger in place (non-dry-run, npm-family): past tense —
-/// it states what was dropped and where the revert data now lives, so the
-/// operator is told the takeover happened without being handed remediation
-/// that is already done. The warning code stays `vendor_supersedes_redirect`
-/// (envelope contract: codes are additive and stable; only the free-text
-/// detail differs), and it fires exactly once — the reconciled ledger no
-/// longer overlaps, so re-runs stay silent.
+/// RECONCILED the ledger in place (non-dry-run, npm-family): past tense,
+/// stating what was dropped and where the revert data now lives. The code
+/// stays `vendor_supersedes_redirect` (codes are stable; only the detail
+/// differs), and it fires once — the reconciled ledger no longer overlaps.
 pub(super) fn mode_takeover_reconciled_detail(
     reconciled: &[String],
     npmrc_unwound: bool,
 ) -> String {
     let list = reconciled.join(", ");
-    // The `.npmrc` sentence is conditional: only a run that actually
-    // unwound the hosted npm allow-remote auto-config says so, and then the
-    // "restores the hosted wiring" claim gains its npm >= 12 caveat.
+    // Only a run that actually unwound the hosted npm allow-remote
+    // auto-config says so (with its npm >= 12 caveat).
     let npmrc = if npmrc_unwound {
         " The hosted redirect's `.npmrc` `allow-remote=all` auto-config was \
          unwound too (a redirect-created file deleted, an appended line \
@@ -1202,20 +1136,15 @@ pub(super) fn mode_takeover_reconciled_detail(
 }
 
 /// Drop the superseded purls' `records` + `edits` from the redirect ledger
-/// and persist it (atomic write; an emptied ledger is deleted — the same
-/// delete-when-empty contract every other persist follows). Called ONLY with
-/// purls [`classify_overlap_takeover`] proved vendored-live AND hosted-dead
-/// against the LIVE lockfile: the gate that makes the warning truthful is
-/// the one that makes the drop lossless (the vendor ledger's wiring
-/// `original` embeds the hosted-spliced fragment, so `vendor --revert` needs
-/// nothing from these records). `Ok(Some(npmrc))` — reconciled, with the
-/// outcome of the `.npmrc` allow-remote unwind (whether the file changed,
-/// and its advisories for the caller to surface); `Ok(None)` when nothing
-/// matched (degenerate — the caller falls back to the manual advisory
-/// rather than claiming a reconciliation that did not happen); `Err` when
-/// the ledger could not be read back or persisted (fail closed: the atomic
-/// writer leaves the on-disk ledger either untouched or fully pre-drop, and
-/// the caller surfaces the failure inside the warning).
+/// and persist it (atomic write; an emptied ledger is deleted). Called ONLY
+/// with purls [`classify_overlap_takeover`] proved vendored-live AND
+/// hosted-dead: that gate makes the drop lossless (the vendor ledger's
+/// wiring `original` embeds the hosted-spliced fragment, so `vendor
+/// --revert` needs nothing from these records). `Ok(Some(npmrc))`:
+/// reconciled, with the `.npmrc` allow-remote unwind outcome; `Ok(None)`:
+/// nothing matched (caller falls back to the manual advisory); `Err`: the
+/// ledger could not be read or persisted (fail closed: on-disk ledger
+/// untouched or fully pre-drop).
 async fn reconcile_superseded_redirect(
     cwd: &Path,
     purls: &[String],
@@ -1232,14 +1161,10 @@ async fn reconcile_superseded_redirect(
     if !dropped {
         return Ok(None);
     }
-    // The dropped npm purls may have been the last package-lock entries the
-    // hosted `.npmrc` `allow-remote=all` auto-config served: unwind it
-    // (created file deleted / appended line removed) before persisting, so
-    // a hosted→vendored migration leaves no loosened install policy behind.
-    // Vendored `file:` specs never needed it (npm gates them by
-    // `allow-file`, default `all`).
-    // Its outcome (and advisories such as
-    // `redirect_npmrc_allow_remote_modified`) goes back to the caller.
+    // The dropped npm purls may have been the last entries the hosted
+    // `.npmrc` `allow-remote=all` auto-config served: unwind it before
+    // persisting, so a hosted→vendored migration leaves no loosened install
+    // policy behind (vendored `file:` specs are gated by `allow-file`).
     let npmrc =
         socket_patch_core::patch::redirect::npmrc::unwind_unneeded_npmrc(cwd, &mut state, false)
             .await?;
@@ -1273,36 +1198,25 @@ pub(super) fn push_run_warning(
 /// ledger both claim package(s) AND the live lockfile proves vendored won,
 /// the redirect ledger records for those package(s) are stale. Warn once at
 /// the envelope level (JSON `warnings[]` and stderr) — and, for npm-family
-/// package(s) on a non-dry run, reconcile the ledger in place at the same
-/// time (mirroring the cargo branch in `vendor.rs`, which reverts + drops
-/// BEFORE vendoring because `[patch.crates-io]` cannot stack on the hosted
-/// registry pin; npm-family needs no on-disk revert — vendoring already
-/// overwrote the hosted splice and recorded it as the wiring `original`).
-/// Without the drop, the stale records fed VEX/updates forever and this
-/// warning re-fired on every subsequent run (`already_vendored` no-ops drop
-/// nothing). The reverse direction (`redirect_supersedes_vendored`) is
-/// deliberately untouched.
+/// package(s) on a non-dry run, reconcile the ledger in place (cargo
+/// reverts + drops BEFORE vendoring in `vendor.rs`; npm-family needs no
+/// on-disk revert, since vendoring already overwrote the hosted splice and
+/// recorded it as the wiring `original`). The reverse direction
+/// (`redirect_supersedes_vendored`) is deliberately untouched.
 pub(super) async fn note_vendor_supersedes_redirect(
     env: &mut crate::json_envelope::Envelope,
     cwd: &Path,
     common: &GlobalArgs,
 ) {
-    // Only warn for the package(s) the LIVE lockfile actually routes to the
-    // committed `.socket/vendor/` files — the direction the lock proves, not
-    // the fact that this happens to be a vendored flow. A dry-run / no-op
-    // over a lock that still points at the hosted patch server stays silent
-    // instead of pointing cleanup at the live redirect ledger.
+    // Only the package(s) the LIVE lockfile routes to `.socket/vendor/`.
     let superseded = classify_overlap_takeover(common, cwd).await.vendored;
     if superseded.is_empty() {
         return;
     }
-    // Reconciliation is gated three ways, each fail-closed to the manual
-    // advisory: never under --dry-run (this advisory runs even on preview
-    // flows, and a dry run must not mutate the ledger); only npm-family
-    // purls (cargo goes through `revert_cargo_redirect_purl`'s on-disk
-    // revert in vendor.rs, and other ecosystems' vendor wiring has not been
-    // verified to embed the hosted originals); and only purls the live-lock
-    // classification above already proved no longer resolve the hosted URL.
+    // Reconciliation is gated, each fail-closed to the manual advisory:
+    // never under --dry-run; only npm-family purls (cargo reverts in
+    // vendor.rs, and other ecosystems' vendor wiring is not verified to
+    // embed the hosted originals); only purls classified above.
     let (reconcilable, manual): (Vec<String>, Vec<String>) = if common.dry_run {
         (Vec::new(), superseded)
     } else {
@@ -1329,9 +1243,6 @@ pub(super) async fn note_vendor_supersedes_redirect(
                 VENDOR_SUPERSEDES_REDIRECT,
                 mode_takeover_reconciled_detail(&reconcilable, npmrc.file_changed),
             );
-            // The `.npmrc` unwind's own advisories (a redirect-created file
-            // the user has since added to: kept, only our line removed) —
-            // surfaced like rollback / vendor surface them.
             for (code, detail) in npmrc.warnings {
                 push_run_warning(env, common, &code, detail);
             }
@@ -1374,25 +1285,17 @@ fn layout_refusal_json(refusals: &[(String, String)]) -> serde_json::Value {
 // Agent-flow cross-mode visibility (hosted / vendored state left in place)
 // ---------------------------------------------------------------------------
 //
-// The takeover machinery above covers hosted ⇄ vendored — the two modes that
-// COMPETE for lockfile wiring. The agent flow competes with neither (it
-// patches installed trees in place), so running `scan --mode agent` over
-// another mode's live state is not a takeover: nothing goes stale, nothing
-// is mutated. But it IS a mode conversion that silently did not complete,
-// and the envelope said nothing:
+// The agent flow patches installed trees in place, so `scan --mode agent`
+// over another mode's live state is not a takeover, but it IS a mode
+// conversion that did not complete:
 //
-// * over live HOSTED wiring, the agent apply succeeds against the already-
-//   patched bytes while the lockfile keeps resolving to the hosted patch
-//   server and the redirect ledger stays live — and no npm/yarn hosted
-//   revert exists, so the "conversion" can never complete without another
-//   mode run;
-// * over VENDORED ownership, the apply partitions the vendor-owned purls
-//   into `apply.patches[]` skip records (`skipped`/`vendored`) that a
-//   `--json` consumer only finds by digging into the per-patch array.
+// * over live HOSTED wiring, the lockfile keeps resolving to the hosted
+//   patch server and the redirect ledger stays live;
+// * over VENDORED ownership, the vendor-owned purls become `apply.patches[]`
+//   skip records (`skipped`/`vendored`).
 //
-// Both get one additive run-level warning (top-level `warnings[]` on the
-// scan `--json` envelope + stderr when not silent). NEVER a status or
-// exit-code change — hosted refusals set that precedent (exit 0 + warning).
+// Both get one additive run-level warning (top-level `warnings[]` + stderr
+// when not silent). NEVER a status or exit-code change.
 
 /// Warning code: agent-mode scan ran over package(s) whose hosted redirect
 /// wiring is still LIVE (ledger record present AND the lock provably still
@@ -1426,20 +1329,14 @@ pub(super) const PATCH_DETAILS_FAILED: &str = "patch_details_failed";
 /// redirect-ledger attestations on.
 ///
 /// Deliberately NOT routed through [`classify_overlap_takeover`]: that
-/// classifier keys on purls present in BOTH ledgers (hosted ∩ vendored),
-/// so hosted-only wiring — the exact hosted→agent conversion state — can
-/// structurally never trigger it (pinned by
-/// `hosted_only_wiring_is_invisible_to_the_overlap_classifier`).
+/// classifier keys on purls present in BOTH ledgers, so hosted-only wiring
+/// can never trigger it (pinned by
+/// `hosted_only_wiring_fires_agent_probe_not_the_overlap_classifier`).
 ///
-/// Silent-by-construction cases (each pinned by a test):
-/// * ledger absent/malformed or `records` empty — a hosted→vendored
-///   pre-revert that retired the records must retire this warning with
-///   them, even while the append-only `edits` (revert originals) remain;
-/// * purl not scanned this run — the warning only ever names packages the
-///   scan actually covered;
-/// * the live lock does not prove hosted wiring (registry-clean lock, an
-///   ecosystem whose lock we cannot read) — never guess from ledger
-///   presence alone.
+/// Silent cases (each pinned by a test): ledger absent/malformed or
+/// `records` empty (even while `edits` remain); purl not scanned this run;
+/// the live lock does not prove hosted wiring — never guess from ledger
+/// presence alone.
 pub(super) async fn hosted_wiring_retained_purls(
     common: &GlobalArgs,
     redirect_state: Option<&socket_patch_core::patch::redirect::RedirectState>,
@@ -1456,9 +1353,8 @@ pub(super) async fn hosted_wiring_retained_purls(
         .into_iter()
         .map(|p| canon(p.as_ref()))
         .collect();
-    // Cheap no-I/O gate: only ledger records naming a scanned purl can ever
-    // prove live wiring, so when none do (a zero/filtered discovery, or a
-    // ledger about other packages) skip the lockfile proofs below entirely.
+    // Cheap no-I/O gate: skip the lockfile proofs when no record names a
+    // scanned purl.
     let candidates: Vec<(String, &str)> = redirect
         .records
         .iter()
@@ -1537,32 +1433,18 @@ pub(super) fn vendored_ownership_retained_detail(purls: &[String]) -> String {
 /// block rather than a warning — plus the scanned purls whose hosted
 /// lockfile wiring the live lock still proves.
 ///
-/// Before this block, a hosted-wired project's report-only `scan --json`
-/// was byte-identical to a never-touched project's (verified against
-/// production on bundler 1.17/2.7/4.0): [`HOSTED_WIRING_RETAINED`] rides
-/// only the agent-mode envelope, and the `redirect` sub-object only a
-/// hosted-mode run's. `None` (key omitted, additive contract) when the
-/// ledger is absent or its `records` are empty — an edits-only ledger
-/// (post-takeover / degraded) asserts no patches, mirroring the warning's
-/// records gate. This emptiness check is the block's ONE presence
-/// decision; the caller precomputes `wiring_live` (see below) whose own
-/// probe guards its inputs independently for its other callers.
+/// `None` (key omitted, additive contract) when the ledger is absent or its
+/// `records` are empty — an edits-only ledger asserts no patches.
 ///
 /// Shape: `{ mode, ledger, records: [{purl, ledgerKey, uuid}], wiringLive:
-/// [purl] }`. `mode` is the constant [`crate::commands::HOSTED_MODE_LABEL`]
-/// — never the ledger's own opaque `mode` string (pre-rename ledgers carry
-/// `"redirect"`; consumers dispatching on this key must not need that
-/// history). Each record's `purl` is CANONICALIZED (qualifiers stripped,
-/// percent-decoded) to the same spelling `wiringLive` carries, so the
-/// records↔proof join is a plain string compare; `ledgerKey` is the
-/// ledger's verbatim key (percent-encoded scoped names, `?platform=`
-/// qualifiers) for consumers that need to address the ledger itself.
-/// `wiring_live` is the caller's [`hosted_wiring_retained_purls`] result —
-/// computed ONCE per run (it parses the project's lockfiles) and shared
-/// with the agent-flow warning. Records are the ledger's word, wiringLive
-/// the live lock's proof: a record with no proof means the wiring was
-/// unwound, the lock is unreadable, or the purl was not crawled/queried
-/// this run — never "still live".
+/// [purl] }`. `mode` is the constant [`crate::commands::HOSTED_MODE_LABEL`],
+/// never the ledger's own `mode` string (older ledgers carry `"redirect"`).
+/// Each record's `purl` is canonicalized (qualifiers stripped,
+/// percent-decoded) to the spelling `wiringLive` carries; `ledgerKey` is the
+/// ledger's verbatim key. `wiring_live` is the caller's
+/// [`hosted_wiring_retained_purls`] result, computed once per run. A record
+/// with no proof means the wiring was unwound, the lock is unreadable, or
+/// the purl was not crawled this run — never "still live".
 pub(super) fn redirect_state_json(
     redirect_state: Option<&socket_patch_core::patch::redirect::RedirectState>,
     wiring_live: &[String],
@@ -1630,8 +1512,8 @@ fn print_zero_error_envelope(err: &str, paths: &[String]) {
 pub async fn run(args: ScanArgs) -> i32 {
     // Scan's telemetry sends run off the critical path: each is spawned
     // where its event fires and flushed before the first stdout write that
-    // follows it (so a closed pipe's SIGPIPE, or a Ctrl-C at a prompt, still
-    // finds it delivered, as with an inline send). The flush here is the
+    // follows it (so a closed pipe's SIGPIPE or a Ctrl-C still finds it
+    // delivered, as with an inline send). The flush here is the
     // backstop that keeps every event ahead of the process exit.
     let mut telemetry = PendingTelemetry::new();
     let code = Box::pin(run_scan(args, &mut telemetry)).await;
@@ -1700,15 +1582,10 @@ async fn run_project_dirs(args: ScanArgs, telemetry: &mut PendingTelemetry) -> i
 async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
     apply_env_toggles(&args.common);
 
-    // Fold the legacy mode booleans into `args.mode` before anything reads
-    // it, so every branch below keeps a single source of truth (the enum;
-    // the booleans are never consulted past this point). Cross-mode
-    // combinations get a usage-style error (exit 2, matching clap's
-    // conflict exit code) — see `resolve_mode_flags` for why clap itself
-    // can't express them.
-    // Usage errors (exit 2) print no JSON envelope, even under --json:
-    // they behave like clap's own usage errors, which cannot print one
-    // either (pinned by scan_paths_e2e::paths_with_hosted_or_vendored_mode_exit_2).
+    // Fold the legacy mode booleans into `args.mode` (see
+    // `resolve_mode_flags`). Cross-mode combinations are usage errors
+    // (exit 2), which print no JSON envelope even under --json, like
+    // clap's own.
     if let Err(message) = resolve_mode_flags(&mut args) {
         eprintln!("Error: {message}");
         return 2;
@@ -1732,13 +1609,9 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         }
     };
 
-    // Strict airgap (CLI_CONTRACT.md `--offline`: never contact the
-    // network; operations that need remote data fail loudly). Scan's
-    // patch discovery IS remote data — proceeding would POST the crawled
-    // package inventory to the batch endpoint — so refuse up front,
-    // before the crawl and before the API client is built (org
-    // auto-resolve is itself a network call). No telemetry fires here:
-    // offline gates `is_telemetry_disabled` too.
+    // Strict airgap (CLI_CONTRACT.md `--offline`): scan's patch discovery
+    // is remote data, so refuse before the crawl and before the API client
+    // is built (org auto-resolve is itself a network call).
     if args.common.offline {
         let err = "scan requires network access to query the patch API and cannot run with \
                    --offline/SOCKET_OFFLINE (strict airgap)";
@@ -1752,20 +1625,14 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         return 1;
     }
 
-    // `--sync` is sugar for `--mode agent --prune`. Derive locals once and
-    // use them everywhere downstream so the flag interactions are
-    // expressed in one place. `--apply --prune --sync` is redundant
-    // but legal.
+    // `--sync` is sugar for `--mode agent --prune`.
     let apply = args.mode == Some(ScanMode::Agent);
     let vendor = args.mode == Some(ScanMode::Vendored);
     let hosted = args.mode == Some(ScanMode::Hosted);
     let prune = args.prune || args.sync;
 
-    // Hosted mode runs no GC (both hosted terminals return before the GC
-    // blocks): say so ONCE up front on the human path instead of silently
-    // dropping the flag. The `--json` path carries the same warning in the
-    // `redirect.warnings[]` array (see `run_redirect` and the zero-discovery
-    // envelope below).
+    // Hosted mode runs no GC: say so once up front on the human path. The
+    // `--json` path carries it in `redirect.warnings[]`.
     if hosted && prune && !args.common.json && !args.common.silent {
         eprintln!("Warning ({REDIRECT_PRUNE_IGNORED}): {REDIRECT_PRUNE_IGNORED_DETAIL}");
     }
@@ -1779,18 +1646,14 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
     let overrides = args.common.api_client_overrides();
     let (mut api_client, mut use_public_proxy) =
         get_api_client_with_overrides(overrides.clone()).await;
-    // Sized for the endpoint the run starts on (see `effective_batch_size`;
-    // a zero `--batch-size` is floored to 1 there rather than crash the
-    // chunking below). A mid-run downgrade to the proxy keeps these chunk
-    // boundaries: the failed chunk is retried as-is, and every chunk is
-    // within the proxy's body cap by construction (`BATCH_BODY_BYTE_CAP`).
+    // Sized for the endpoint the run starts on. A mid-run downgrade to the
+    // proxy keeps these chunk boundaries: every chunk is within the proxy's
+    // body cap by construction (`BATCH_BODY_BYTE_CAP`).
     let batch_size = effective_batch_size(args.batch_size, use_public_proxy);
     let telemetry_token = api_client.api_token().cloned();
     let telemetry_org = api_client.org_slug().cloned();
-    // Tracks whether scan was downgraded from the authenticated
-    // endpoint to the public proxy mid-run after a 401/403. Surfaces
-    // in the final `patch_scanned` telemetry event so we can measure
-    // how often stale-token fallbacks fire in the wild.
+    // Whether scan downgraded to the public proxy mid-run after a 401/403
+    // (reported in the `patch_scanned` telemetry event).
     let mut fallback_to_proxy = false;
 
     let crawler_options = args.common.crawler_options();
@@ -1801,11 +1664,9 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         "packages"
     };
 
-    // `--silent` is "errors only" (CLI_CONTRACT.md): progress, the crawl
-    // summary, the results table, and the per-patch listing are all
-    // suppressed below, mirroring `list`/`get`/`repair`/`remove`. Errors
-    // and the JSON envelope are unaffected.
-    // Live only on a terminal; its result lines print whenever `human`.
+    // `--silent` is "errors only" (CLI_CONTRACT.md): progress, summary,
+    // table and per-patch listing are suppressed; errors and the JSON
+    // envelope are unaffected.
     let human = !args.common.json && !args.common.silent;
     let mut status = StatusLine::stderr(args.common.json, args.common.silent);
     status.set(format!("Scanning {scan_target}..."));
@@ -1813,12 +1674,9 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
     // Which ecosystems to crawl (see `crawl_scope`).
     let crawl_scope = crawl_scope(prune, args.common.ecosystems.as_deref());
 
-    // Crawl packages. Vendored mode keeps the npm half: its engine
-    // resolves the same untouched tree and reuses this crawl instead of
-    // walking `node_modules` again (no snapshot when npm was not crawled).
-    // Hosted mode keeps it only for an embedded `--vex` (skipped under
-    // `--dry-run`), whose installed-copy lookup reuses the npm roots. No
-    // other run reads the snapshot, so no other run pays for copying it.
+    // Crawl packages. Vendored mode keeps the npm half for its engine to
+    // reuse; hosted mode keeps it only for an embedded `--vex` (skipped
+    // under `--dry-run`). No other run pays for copying the snapshot.
     let keep_npm = vendor || (hosted && args.vex.vex.is_some() && !args.common.dry_run);
     let (mut all_crawled, mut eco_counts, skipped_bundle_config_path, npm_crawl) = if keep_npm {
         crawl_ecosystems_with_npm(&crawler_options, crawl_scope).await
@@ -1829,26 +1687,15 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
 
     // Lockfile supplement: dependencies the project's lockfile resolves
     // that have NO installed copy (fresh clone, partial install). They join
-    // discovery — counts, API lookup, table, the prune "scanned" set — and
-    // are flagged "not yet installed" everywhere a user could act on them.
-    // Scoped to the crawled ecosystems: a skipped ecosystem's lockfile
-    // entries have no crawl to be measured against, and `--ecosystems`
-    // filters them out of this run anyway.
+    // discovery and are flagged "not yet installed". Scoped to the crawled
+    // ecosystems.
     let lockfile_only = lockfile_supplement(&args.common, &all_crawled, crawl_scope).await;
-    // Discovery diagnoses unsupported installation layouts and malformed
-    // binary Bun locks. Preserve these on empty scans too: an unreadable
-    // graph is not evidence that a fresh checkout has no dependencies.
-    // Surface them as run-level JSON warnings and human stderr messages.
+    // Unsupported layouts and malformed binary Bun locks, kept on empty
+    // scans too: an unreadable graph is not evidence of no dependencies.
     let mut layout_refusals = unsupported_layout_warnings(&lockfile_only.unsupported);
-    // Config-sourced gem bundle root refused by the crawler's containment
-    // guard (a committed `.bundle/config` whose BUNDLE_PATH resolves
-    // outside the project — untrusted input that would otherwise become a
-    // scan/apply WRITE-target root). The crawl above consulted and
-    // silently skipped it, handing the skip back (local mode only); surface
-    // it on the SAME run-level channel as the layout refusals (JSON
-    // `warnings[]` on both the zero-package and ≥1-package envelopes; a
-    // gated stderr line on the human path) unless `--ecosystems` filtered
-    // gem out of this run.
+    // A committed `.bundle/config` whose BUNDLE_PATH resolves outside the
+    // project, refused by the crawler's containment guard: surface it on
+    // the same run-level channel as the layout refusals.
     if let Some(value) = skipped_bundle_config_path {
         if args.common.ecosystem_selected(Ecosystem::Gem) {
             let (code, detail) = config_path_ignored_warning(&value);
@@ -1869,12 +1716,10 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         }
         all_crawled.extend(lockfile_only.packages.iter().cloned());
     }
-    // The vendor ledger, loaded ONCE and shared by the supplement here, the
-    // prune-exemption / vendored-skip key set below, and update detection —
-    // three read-only consumers of the same bytes. Their failure policies
-    // stay distinct on purpose: the supplement falls back to the committed
-    // artifacts (fail-closed for the prune), the key set degrades to empty
-    // (fail-open, its documented contract).
+    // The vendor ledger, loaded ONCE for the supplement, the key set below,
+    // and update detection. Failure policies differ on purpose: the
+    // supplement falls back to the committed artifacts (fail-closed for the
+    // prune), the key set degrades to empty (fail-open).
     let vendor_state = socket_patch_core::vendor::load_state(&args.common.cwd).await;
     let ledger_supplement =
         vendored_ledger_supplement(&args.common, &all_crawled, &vendor_state).await;
@@ -1886,26 +1731,16 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
     }
     all_crawled.extend(ledger_supplement);
 
-    // Every PURL the crawl found, captured BEFORE the `--ecosystems`
-    // display/query filter is applied. Prunable detection (manifest
-    // entries whose PURL is not installed) must reference the full
-    // installed set: `--ecosystems npm` narrows what we *query and
-    // show*, but packages of other ecosystems are still installed. If
-    // prune used the filtered set instead, `scan --ecosystems npm --prune`
-    // would treat every cargo/go/pypi/gem manifest entry as "uninstalled"
-    // and delete it (plus its blobs) — silent cross-ecosystem data loss.
-    // Lockfile-only purls are deliberately included: a dependency the
-    // lockfile still resolves must not be pruned just because node_modules
-    // is wiped or partially installed. (This is why a GC run never scopes
-    // the crawl — see `crawl_scope`; a scoped run reads this set nowhere.)
+    // Every PURL the crawl found, captured BEFORE the `--ecosystems` /
+    // `--package` / PATH filters: prune must judge manifest entries against
+    // the full installed set, or `scan --ecosystems npm --prune` would
+    // delete every other ecosystem's entries. Lockfile-only purls are
+    // included so a wiped node_modules does not prune them.
     let scanned_purls: HashSet<String> = all_crawled.iter().map(|p| p.purl.clone()).collect();
 
-    // Vendor-ledger purl keys (from the single load above), shared by the
-    // prune exemption (a vendored package is consumed from the committed
-    // artifact, so "absent from the crawl" is its normal state, not
-    // grounds for pruning) and the vendored-skip in the apply path. A
-    // corrupt ledger degrades to the EMPTY set — fail-open by the key set's
-    // documented contract (the supplement above is the fail-closed half).
+    // Vendor-ledger purl keys, shared by the prune exemption (a vendored
+    // package's normal state is absent from the crawl) and the
+    // vendored-skip in the apply path. A corrupt ledger yields the empty set.
     let vendored_purls: HashSet<String> = vendor_state
         .as_ref()
         .map(VendorState::purl_keys)
@@ -1930,11 +1765,9 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
             .collect()
     };
 
-    // PATH scoping — applied strictly AFTER the `scanned_purls` capture
-    // above (the prune universe stays full-crawl: `scan PATHS --prune`
-    // must never treat out-of-scope packages as uninstalled) and after the
-    // `--ecosystems` filter. A purl is in scope when ANY genuinely-crawled
-    // copy of it sits under a matching path.
+    // PATH scoping, strictly AFTER the `scanned_purls` capture. A purl is
+    // in scope when ANY genuinely-crawled copy of it sits under a matching
+    // path.
     let filtered_crawled: Vec<_> = if path_scope.is_empty() {
         filtered_crawled
     } else {
@@ -1982,9 +1815,7 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
             for (code, detail) in &layout_refusals {
                 eprintln!("Warning ({code}): {detail}");
             }
-            // The JSON path skips the GC here too (see below); the human
-            // path says so instead of silently dropping `--prune`. Hosted
-            // mode already printed its own prune-ignored warning.
+            // Hosted mode already printed its own prune-ignored warning.
             if prune && !hosted {
                 eprintln!("{}", render::PRUNE_SKIPPED_EMPTY);
             }
@@ -2008,11 +1839,9 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         // The result prints right away: nothing to overlap the send with.
         telemetry.flush().await;
         if args.common.json {
-            // When the crawler finds nothing, GC is intentionally skipped
-            // — pruning every manifest entry on the assumption that the
-            // user "uninstalled everything" is too destructive. Bots
-            // that need full cleanup can call `repair` explicitly. No
-            // `gc` field emitted because the user didn't request one.
+            // GC is intentionally skipped when the crawl finds nothing:
+            // pruning every manifest entry is too destructive (`repair`
+            // does full cleanup explicitly).
             let mut result = serde_json::json!({
                 "status": "success",
                 "scannedPackages": 0,
@@ -2026,19 +1855,14 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
                 "updates": [],
                 "paths": path_scope.raw(),
             });
-            // PnP layout refusals: additive top-level `warnings` (omitted
-            // when empty — run-level warnings precedent) so a JSON consumer
-            // can tell "structurally unscannable project" apart from a
-            // genuinely-empty one. This is the loud half of the fix for the
-            // yarn-PnP silent success-0 no-op.
+            // Layout refusals: additive top-level `warnings` (omitted when
+            // empty) so a consumer can tell an unscannable project from an
+            // empty one.
             if !layout_refusals.is_empty() {
                 result["warnings"] = layout_refusal_json(&layout_refusals);
             }
-            // Hosted mode: keep the `--json` envelope schema-consistent with
-            // the ≥1-package path by including a (no-op) nested `redirect`
-            // block — nothing was discovered, so nothing is redirected. The
-            // prune-ignored warning still rides along: hosted runs no GC even
-            // when the crawl is empty.
+            // Hosted mode: a no-op `redirect` block keeps the envelope
+            // schema-consistent with the ≥1-package path.
             if hosted {
                 let mut warnings: Vec<serde_json::Value> = Vec::new();
                 if prune {
@@ -2052,19 +1876,9 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
                     args.common.dry_run,
                 );
             } else if !vendor {
-                // The `redirectState` block rides the empty-discovery
-                // envelope too (same rule as the ≥1-package path below:
-                // every non-hosted-mode, non-vendored-mode `--json` envelope
-                // carries it when the ledger holds records) — an
-                // `--ecosystems` filter or a wiped tree must not blind a
-                // state-probing consumer. The vendored gate mirrors the
-                // main path's: vendored runs may reconcile ledger records
-                // mid-run, so they never carry a pre-run snapshot. The
-                // ledger is loaded here (leniently, --silent-gated) because
-                // the main-path load sits after this early return.
-                // `wiringLive` is empty by construction: this run counted
-                // zero packages, and the block's contract scopes the proof
-                // to packages the run actually covered.
+                // `redirectState` rides the empty-discovery envelope too
+                // (same rule as the ≥1-package path). `wiringLive` is empty
+                // by construction: this run covered zero packages.
                 let redirect_state = crate::commands::load_redirect_state_lenient(
                     &args.common.cwd,
                     args.common.silent,
@@ -2079,8 +1893,6 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
             print_json(&result);
             return code;
         } else if !args.common.silent {
-            // Errors only under --silent: the empty-scan hint is
-            // informational.
             println!(
                 "{}",
                 render::no_packages_message(
@@ -2093,9 +1905,6 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         return embed_vex_human(&args.common, &args.vex, &manifest_path, 0).await;
     }
 
-    // Keep discovery format errors on non-empty scans in every mode as
-    // well: installed packages do not make an unreadable lockfile safe.
-
     // Build ecosystem summary
     let mut eco_parts = Vec::new();
     for eco in Ecosystem::all() {
@@ -2126,9 +1935,6 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         if !lockfile_only.purls.is_empty() {
             eprintln!("{}", render::lockfile_only_note(lockfile_only.purls.len()));
         }
-        // Polyglot PnP repos (e.g. a PnP frontend + a python venv) reach
-        // this non-empty path: the refusal still prints so the invisible
-        // npm half is never silently blessed by the other ecosystems' scan.
         for (code, detail) in &layout_refusals {
             eprintln!("Warning ({code}): {detail}");
         }
@@ -2146,10 +1952,8 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
     // succeeded (all failing is the error envelope below).
     let mut failed_batches: Vec<(usize, String)> = Vec::new();
 
-    // Fold one batch outcome, in chunk order. Every caller below consumes
-    // outcomes strictly by chunk index, so the per-batch warnings,
-    // `batch_error_count` and `last_batch_error` come out exactly as the
-    // serial loop produced them.
+    // Fold one batch outcome; callers consume outcomes strictly in chunk
+    // order.
     let mut fold = |batch_idx: usize,
                     result: Result<BatchSearchResponse, ApiError>,
                     status: &mut StatusLine<_>| match result {
@@ -2184,23 +1988,13 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
     //
     // - On the authenticated client the first chunk goes alone, so a stale
     //   token costs the authenticated API one request before the
-    //   downgrade, as it always did. Already on the proxy there is no
-    //   downgrade left to cap (the fallback arm below is authenticated-
-    //   only), so a token-less run opens the full window at chunk 0.
-    // - Fallback: a 401/403 against the authenticated endpoint can mean a
-    //   stale/revoked token. At the first consumed chunk `k` whose error is
-    //   a fallback candidate (any index, not just the first), the window is
-    //   dropped — in-flight requests for chunks past `k` are cancelled and
-    //   any responses already received for them are discarded, never
-    //   folded — then chunk `k` is retried against the public proxy (free
-    //   patches only) and the rest continues on the downgraded client.
-    //   That is exactly the serial loop's sequence; on the proxy no further
-    //   fallback applies. A token revoked mid-run does cost the auth
-    //   endpoint the requests the window had already dispatched past `k`
-    //   (up to the in-flight cap, instead of one). Their answers are
-    //   discarded, and so are their `--debug` lines: each chunk's are held
-    //   back until it is folded, so a chunk the window drops announces
-    //   nothing the serial loop would not have announced.
+    //   downgrade. Already on the proxy, the full window opens at chunk 0.
+    // - Fallback: at the first consumed chunk `k` whose error is a 401/403
+    //   fallback candidate, the window is dropped (in-flight requests past
+    //   `k` cancelled, received responses and their held-back `--debug`
+    //   lines discarded), chunk `k` is retried against the public proxy
+    //   (free patches only), and the rest continues on the downgraded
+    //   client. No further fallback applies on the proxy.
     let mut next = 0usize;
     'windows: while next < total_batches {
         let end = if next == 0 && !use_public_proxy {
@@ -2221,11 +2015,9 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
                     "Querying API for patches... (batch {}/{total_batches})",
                     next + 1
                 ));
-                // `ordered_concurrent` yields exactly one item per chunk,
-                // so the window never runs dry early. Should a future
-                // variant make it, stop the scan here: re-entering the
-                // outer loop with `next` unchanged would rebuild the very
-                // same window and re-POST every chunk in it, forever.
+                // `ordered_concurrent` yields one item per chunk. Should it
+                // ever run dry early, stop: re-entering the outer loop with
+                // `next` unchanged would re-POST the same window forever.
                 let Some(result) = results.next().await else {
                     debug_assert!(false, "batch window yields one result per chunk");
                     break 'windows;
@@ -2258,16 +2050,13 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         }
     }
 
-    // The client returns each batch's packages PURL-sorted, but the batches
-    // themselves are concatenated in chunk order, so the assembled list is
-    // only sorted *within* each chunk. Sort globally: this list drives the
-    // human table, the `--json` `packages` array, and the apply order, all
-    // of which operators diff across runs.
+    // Batches are only sorted within each chunk. Sort globally: this list
+    // drives the table, the `--json` `packages` array and the apply order,
+    // which operators diff across runs.
     all_packages_with_patches.sort_by(|a, b| a.purl.cmp(&b.purl));
 
-    // If every batch errored, surface this as a full scan failure rather
-    // than silently reporting zero patches (which historically looked
-    // identical to "no patches for these packages").
+    // If every batch errored, surface a full scan failure rather than
+    // silently reporting zero patches.
     if total_batches > 0 && batch_error_count == total_batches {
         status.finish();
         let err = last_batch_error.unwrap_or_else(|| "all batches failed".to_string());
@@ -2280,12 +2069,6 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         );
         // The failure prints right away: nothing to overlap the send with.
         telemetry.flush().await;
-
-        // A scan in which *every* batch failed produced no trustworthy
-        // patch data. Surfacing `status: "success"` / exit 0 here would be
-        // indistinguishable from a genuine "no patches" result and would
-        // mask a total API outage. Report the failure explicitly and bail
-        // before writing any manifest or attempting apply/prune.
         if args.common.json {
             let result = serde_json::json!({
                 "status": "error",
@@ -2339,10 +2122,7 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
     }
     let total_patches = free_patches + paid_patches;
 
-    // Telemetry: record the scan outcome once we have the canonical
-    // per-tier counts. `fallback_to_proxy` is `true` iff the batch
-    // loop downgraded from the authenticated endpoint to the public
-    // proxy after a 401/403.
+    // Telemetry: record the scan outcome with the per-tier counts.
     spawn_patch_scanned(
         telemetry,
         package_count,
@@ -2359,39 +2139,24 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         telemetry_org.as_deref(),
     );
 
-    // Read existing manifest once for update detection. Used by both the
-    // JSON-mode emission (always includes an `updates` array) and the
-    // non-JSON table-print path (counts `updates_available`).
-    // (`manifest_path`/`socket_dir` are resolved at the top of `run`.)
+    // Read existing manifest once for update detection.
     let existing_manifest = read_manifest(&manifest_path).await.ok().flatten();
-    // Hosted and vendored modes record their patches ONLY in their ledgers
-    // (neither writes the manifest), so fold both ledgers' purl→uuid records
-    // into the view update detection sees — otherwise a pure hosted or
-    // vendored project's `updates[]` (the documented CI signal) stays
-    // structurally empty and a superseding patch is never reported. The
-    // envelope schema is unchanged. A malformed redirect ledger is only
-    // warned about here (and muted by --silent — the warning is advisory)
-    // — this is a read-only consult; a malformed vendor ledger contributes
-    // nothing (the supplement above already recovered its purls from the
-    // committed artifacts). A HOSTED run does not warn here: its engine
-    // loads the same ledger strictly, under the apply lock when it holds
-    // one, and reports the corruption ONCE as the hard error it is, so the
-    // advisory here would only duplicate that message. But the human hosted
-    // arm has returns BEFORE the engine (empty discovery, nothing
-    // downloadable, a detail-fetch failure, a declined confirm) where nobody
-    // would report it — so the corruption text is kept and printed at those
-    // returns (`warn_unreported_corrupt_ledger`), never quarantined (a
-    // read-only consult; quarantine is the engine's under-lock job).
+    // Hosted and vendored modes record their patches ONLY in their ledgers,
+    // so both ledgers' purl→uuid records are folded into update detection
+    // (otherwise their `updates[]` would stay empty). A malformed redirect
+    // ledger is only warned about here (--silent mutes it). A HOSTED run
+    // does not warn: its engine loads the ledger strictly and reports the
+    // corruption once as a hard error; the human hosted arm's returns
+    // BEFORE the engine (empty discovery, nothing downloadable, a
+    // detail-fetch failure) print it via `warn_unreported_corrupt_ledger`.
     let (redirect_state, hosted_corrupt_ledger) = if hosted {
         match socket_patch_core::patch::redirect::load_redirect_state(&args.common.cwd).await {
             Ok(state) => (state, None),
             Err(corrupt) => (None, Some(corrupt.to_string())),
         }
     } else {
-        // `load_redirect_state_lenient`, with the scan event's send flushed
-        // before its warning: that line can be this run's first write since
-        // the event fired, and a closed stderr's SIGPIPE must find the event
-        // delivered, as the inline send it replaced was.
+        // `load_redirect_state_lenient`, with the scan event flushed before
+        // its warning (possibly this run's first write since the event).
         match socket_patch_core::patch::redirect::load_redirect_state(&args.common.cwd).await {
             Ok(state) => (state, None),
             Err(corrupt) => {
@@ -2425,13 +2190,9 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
     );
     let updates = detect_updates(update_manifest.as_deref(), &all_packages_with_patches);
 
-    // The hosted-wiring probes below (`wiringLive`, the agent-flow
-    // `hosted_wiring_retained` warning) take `all_purls` — the POST-filter
-    // scanned set: they only ever name packages this run actually
-    // counted/queried (an `--ecosystems` filter narrows both — a
-    // filtered-out purl reads as "not covered this run", never as "wiring
-    // unwound"). Distinct from `scanned_purls` above, which deliberately
-    // stays PRE-filter for the GC prune (see its comment).
+    // The hosted-wiring probes below take `all_purls` (POST-filter: only
+    // packages this run covered), unlike the PRE-filter `scanned_purls`
+    // the GC prune uses.
 
     if args.common.json {
         let mut result = serde_json::json!({
@@ -2451,26 +2212,20 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
                 "newUuid": u.new_uuid,
             })).collect::<Vec<_>>(),
         });
-        // PnP layout refusals ride the non-empty envelope too (polyglot
-        // repos: the OTHER ecosystems' discovery being non-empty must not
-        // silently bless the structurally-invisible npm half). Additive,
-        // omitted when empty.
+        // Layout refusals ride the non-empty envelope too (additive,
+        // omitted when empty).
         if !layout_refusals.is_empty() {
             result["warnings"] = layout_refusal_json(&layout_refusals);
         }
-        // A batch that failed while others succeeded left its packages
-        // unchecked; the human run warns on stderr, the envelope carries
-        // the same line per batch (additive, status and exit unchanged).
+        // One warning per failed batch (status and exit unchanged).
         for (batch, err) in &failed_batches {
             let line = render::batch_failed_warning(*batch, total_batches, err);
             let detail = line.strip_prefix("Warning: ").unwrap_or(&line);
             push_scan_json_warning(&mut result, API_BATCH_FAILED, detail);
         }
-        // Flag lockfile-only packages so JSON consumers can tell "patch
-        // available but not installed" from the installed case. Additive
-        // field; absent means installed. Matching bridges the API's
-        // percent-encoded purl spelling to the supplement's literal form
-        // via `normalize_purl`, like the apply-path skip partitions.
+        // Flag lockfile-only packages (additive; absent means installed).
+        // `normalize_purl` bridges the API's percent-encoded spelling to the
+        // supplement's literal form.
         if let Some(packages) = result["packages"].as_array_mut() {
             for pkg in packages {
                 let is_lockfile_only = pkg["purl"].as_str().is_some_and(|p| {
@@ -2484,12 +2239,8 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
             }
         }
 
-        // Hosted mode: NEST the redirect result under `redirect` in the classic
-        // scan object just built above (mirrors vendored mode's nested `vendor`
-        // block), so the hosted `--json` envelope carries the same top-level
-        // scan keys and `packages` enumeration as every other scan plus the
-        // redirect summary. Returns before the apply/vendor/prune branches,
-        // which are mutually exclusive with hosted mode.
+        // Hosted mode: NEST the redirect result under `redirect` in the scan
+        // object above (like vendored mode's `vendor` block).
         if hosted {
             return run_redirect(
                 &args,
@@ -2503,19 +2254,11 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
             .await;
         }
 
-        // Cross-mode visibility, read-only half (companion to the run-level
-        // warnings below): the hosted redirect ledger's records ride every
-        // report-only and agent `--json` envelope as the additive
-        // `redirectState` block. Hosted mode is excluded above (its nested
-        // `redirect` block reports this run's own result, and `run_redirect`
-        // re-persists the ledger mid-run, so a pre-run snapshot would go
-        // stale); the vendored path below is excluded for the same staleness
-        // reason (its takeover reconciliation may retire ledger records
-        // mid-run — the `vendor_supersedes_redirect` warning covers it).
-        //
-        // The live-wiring probe (lockfile discovery, behind its cheap
-        // no-I/O gate) runs ONCE here and is shared with the agent-flow
-        // warning in the apply branch below.
+        // The additive `redirectState` block rides every report-only and
+        // agent `--json` envelope. Hosted and vendored runs are excluded:
+        // both may rewrite the ledger mid-run, so a pre-run snapshot would
+        // go stale. The live-wiring probe runs ONCE here and is shared with
+        // the agent-flow warning below.
         let hosted_retained = if vendor {
             Vec::new()
         } else {
@@ -2527,10 +2270,6 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
             }
         }
 
-        // `apply` and `prune` are computed once at the top of run()
-        // (factoring in --sync, which implies both). They're independent
-        // here: a bot can `--apply` without `--prune`, or `--prune`
-        // without `--apply` (just GC-sweep), or both (full sync).
         let dry = args.common.dry_run;
         let mut apply_code = 0i32;
 
@@ -2556,9 +2295,7 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
             };
 
             // Vendor-owned and lockfile-only purls leave the selection as
-            // calm skip records BEFORE download (see `partition_agent_
-            // selection`); the vendored purls alone feed the run-level
-            // `vendored_ownership_retained` warning emitted after apply.
+            // skip records BEFORE download (see `partition_agent_selection`).
             let AgentSelection {
                 kept: selected,
                 skip_records: vendored_records,
@@ -2568,8 +2305,6 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
 
             if dry {
                 // Synthesize the per-patch outcome without touching disk.
-                // `decide_patch_action` consults the existing manifest,
-                // so it accurately reports what `--apply` *would* do.
                 let empty_manifest = PatchManifest::new();
                 let manifest_for_preview = existing_manifest.as_ref().unwrap_or(&empty_manifest);
                 let mut patches: Vec<serde_json::Value> = selected
@@ -2609,10 +2344,8 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
                     "dryRun": true,
                 });
             } else if selected.is_empty() {
-                // No patches left to download (e.g. all paid for a free
-                // user, no packages had patches, or everything selected is
-                // vendor-owned). Emit a stable-shape `apply` carrying any
-                // vendored skips, then fall through to GC if requested.
+                // Nothing left to download: a stable-shape `apply` carrying
+                // any skips, then fall through to GC if requested.
                 result["apply"] = serde_json::json!({
                     "found": vendored_records.len(),
                     "downloaded": 0,
@@ -2639,15 +2372,8 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
                 }
             }
 
-            // Cross-mode visibility (additive run-level warnings; never a
-            // status or exit-code change — see the constants' docs):
-            //
-            // * vendor-owned purls were partitioned out above — surface
-            //   them at the envelope level instead of only deep inside
-            //   `apply.patches[]`;
-            // * hosted redirect wiring the live lock still proves — the
-            //   agent run cannot unwind it, so silence here reads as a
-            //   completed conversion that never happened.
+            // Cross-mode visibility: additive run-level warnings, never a
+            // status or exit-code change.
             if !vendored_skip_purls.is_empty() {
                 let detail = vendored_ownership_retained_detail(&vendored_skip_purls);
                 if !args.common.silent {
@@ -2655,9 +2381,6 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
                 }
                 push_scan_json_warning(&mut result, VENDORED_OWNERSHIP_RETAINED, &detail);
             }
-            // `hosted_retained` was computed once above (shared with the
-            // `redirectState` block) — same probe, same post-filter scanned
-            // set, no second lockfile-inventory parse.
             if !hosted_retained.is_empty() {
                 let detail = hosted_wiring_retained_detail(&hosted_retained);
                 if !args.common.silent {
@@ -2667,12 +2390,9 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
             }
         // --- Vendor path (if requested; conflicts with --apply/--sync) ---
         } else if vendor {
-            // Extracted into its own boxed fn — and it must STAY extracted:
-            // this branch's temporaries (json! trees, DownloadParams, the
-            // engine dispatch) live in the enclosing poll frame in debug
-            // builds even when the branch is never taken, and that frame
-            // has to fit Windows' 1 MiB main-thread stack (regression-
-            // pinned by `scan_run_fits_windows_main_thread_stack`).
+            // Must STAY a boxed fn: this branch's temporaries would otherwise
+            // live in the enclosing poll frame in debug builds, which has to
+            // fit Windows' 1 MiB main-thread stack.
             return boxed_vendor_json_path(
                 &args,
                 &api_client,
@@ -2731,10 +2451,8 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
     let silent = args.common.silent;
 
     // Every human-path exit that did not fail: the `--prune` GC first
-    // (agent mode only: the vendored step runs its own GC and hosted mode
-    // runs none), then the embedded VEX. The JSON path runs the GC whether
-    // or not anything was applied, and so does this one: an early "nothing
-    // to apply" exit must not silently drop `--prune`.
+    // (not vendored, which runs its own, nor hosted, which runs none), then
+    // the embedded VEX. An early "nothing to apply" exit still runs the GC.
     let (args_ref, manifest_ref, socket_ref) = (&args, &manifest_path, &socket_dir);
     let (scanned_ref, vendored_ref) = (&scanned_purls, &vendored_purls);
     let finish_human = move |code: i32| async move {
@@ -2751,11 +2469,8 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         embed_vex_human(&args_ref.common, &args_ref.vex, manifest_ref, code).await
     };
 
-    // Every mode stops on an empty discovery — vendored mode included: scan
-    // vendors what THIS discovery selects (a fresh clone or wiped
-    // `.socket/vendor/` is `repair`'s job, from the committed ledger), so
-    // there is nothing for its vendor step to do and reaching it would only
-    // take the apply lock for a no-op.
+    // Every mode stops on an empty discovery, vendored included (restoring
+    // a wiped `.socket/vendor/` is `repair`'s job).
     if all_packages_with_patches.is_empty() {
         if !silent {
             println!("\nNo patches available for installed packages.");
@@ -2764,19 +2479,12 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         return finish_human(0).await;
     }
 
-    // The whole table + summary section is presentational only (nothing
-    // computed inside is consumed downstream), so `--silent` skips it
-    // wholesale.
+    // Presentational only, so `--silent` skips it wholesale.
     if !silent {
         let mut updates_available = 0usize;
 
-        // Canonical set of PURLs with a newer patch available, computed once via
-        // `detect_updates` (the same source the JSON `updates` array uses). The
-        // table path MUST agree with the JSON path, so reuse that result rather
-        // than re-deriving it: comparing against *any* batch patch (instead of the
-        // first/candidate one `select_patches` would resolve to) over-reports
-        // updates whenever the manifest already holds the newest patch but older
-        // patches also appear in the batch.
+        // PURLs with a newer patch, from the same `detect_updates` result the
+        // JSON `updates` array uses, so the table and JSON never disagree.
         let update_purls: HashSet<&str> = updates.iter().map(|u| u.purl.as_str()).collect();
 
         // Human display only: the decoded PURL (`%40scope` → `@scope`), like
@@ -2817,13 +2525,9 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
                 .min_by_key(|s| severity_order(s))
                 .unwrap_or("unknown");
 
-            // Collect vuln IDs (deterministic: deduped, CVEs then GHSAs,
-            // each group sorted, aliases not counted — see collect_vuln_ids).
+            // Collect vuln IDs (deterministic; see collect_vuln_ids).
             let vuln_str = render::vuln_cell(&collect_vuln_ids(pkg), verbose);
 
-            // Check for updates — consult the canonical `detect_updates` result
-            // (mirrored into `update_purls`) so the human table and JSON `updates`
-            // array never disagree.
             let has_update = update_purls.contains(pkg.purl.as_str());
             if has_update {
                 updates_available += 1;
@@ -2834,11 +2538,8 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
             } else {
                 String::new()
             };
-            // Lockfile-only packages can be patched by `scan --mode vendored`
-            // (which fetches them pristine) but not applied in place.
-            // `normalize_purl` bridges the API's percent-encoded spelling
-            // to the supplement's literal form, like the JSON flag and the
-            // apply-path skip partitions.
+            // Lockfile-only packages can be vendored (fetched pristine) but
+            // not applied in place.
             let not_installed_marker = if lockfile_only_contains(&lockfile_only.purls, &pkg.purl) {
                 ui::paint(" [NOT INSTALLED]", "33", use_color)
             } else {
@@ -2901,19 +2602,9 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         }
     }
 
-    // Registry-redirect (hosted) mode is a distinct, self-contained flow
-    // (rewrite lockfiles → hosted vendored patches). It reuses the
-    // discovery, table and update detection above, confirms, then hands
-    // the selection to the redirect engine — it must NOT fall through to
-    // the apply/vendor branches. Same discovery/selection as `run_redirect`
-    // (the `--json` arm, which returned above with the redirect result
-    // NESTED in its envelope) and the same engine entry as `get --mode
-    // hosted`.
-    // Count downloadable patches. Shared by the hosted arm below and the
-    // agent/vendored arms: a free-tier org whose every offer is paid-tier has
-    // nothing any mode could select, so every human arm stops here with the
-    // same paid-subscription line instead of entering its engine for a
-    // no-op (hosted would otherwise print `Redirected 0 packages`).
+    // Count downloadable patches: a free-tier org whose every offer is
+    // paid-tier has nothing any mode could select, so every human arm stops
+    // here with the same paid-subscription line.
     let downloadable_count = if can_access_paid_patches {
         all_packages_with_patches.len()
     } else {
@@ -2931,6 +2622,10 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         return finish_human(0).await;
     }
 
+    // Hosted mode is a self-contained flow: it reuses the discovery, table
+    // and update detection above, then hands the selection to the redirect
+    // engine (the same entry as `get --mode hosted`) — it must NOT fall
+    // through to the apply/vendor branches.
     if hosted {
         let selected = match discover_selected(
             &api_client,
@@ -2978,17 +2673,14 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         return 1;
     }
 
-    // Scan never prompts. A scan left without a mode (path-scoped,
-    // `--prune` or global; see `resolve_mode_flags`) only reports, plus the
-    // `--prune` GC.
+    // A scan left without a mode (`--prune` or global; see
+    // `resolve_mode_flags`) only reports, plus the `--prune` GC.
     let report_only = args.mode.is_none();
 
-    // Smart selection. A report-only run picks without the non-interactive
-    // note: it never downloads, so there is no pick to announce.
+    // Scan always takes the top-ranked patch (see `selection_args`).
     let mut select_common = selection_args(&args.common);
     select_common.silent |= report_only;
-    // A menu or the non-interactive note opens its own paragraph under the
-    // table's Summary (stderr, like the prompt).
+    // Never true for scan: `selection_args` sets `yes`.
     if !select_common.silent
         && super::get::selection_has_choice(
             &all_search_results,
@@ -3009,10 +2701,7 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
     let mut skip_paragraph = false;
 
     // Agent flow (mirrors the JSON arm): vendor-owned and lockfile-only
-    // purls leave the selection as calm skips. In vendored mode nothing is
-    // partitioned — re-vendoring a stale uuid is exactly what the mode is
-    // for, and the vendor engine fetches lockfile-resolved packages
-    // pristine.
+    // purls leave the selection as skips. Vendored mode partitions nothing.
     let selected = if vendor {
         selected
     } else {
@@ -3030,9 +2719,8 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         split.kept
     };
 
-    // A selection the manifest already records at the same uuid would be
-    // downloaded only to be skipped ("already in manifest") — don't offer
-    // it. Agent mode only: vendored mode never reads the manifest.
+    // Drop selections the manifest already records at the same uuid.
+    // Agent mode only: vendored mode never reads the manifest.
     let recorded = |p: &PatchSearchResult| {
         existing_manifest
             .as_ref()
@@ -3066,8 +2754,7 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         return finish_human(0).await;
     }
 
-    // Display detailed summary of selected patches before confirming
-    // (presentational only — skipped wholesale under --silent).
+    // Display detailed summary of selected patches (skipped under --silent).
     if !silent {
         if vendor {
             println!("\nPatches to vendor:\n");
@@ -3111,27 +2798,21 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         }
     }
 
-    // What the prompt / dry-run line offers.
+    // What the dry-run line offers.
     let plan = if vendor {
         render::Plan::Vendor(selected.len())
     } else {
         render::Plan::Apply(selected.len())
     };
 
-    // `--dry-run` is a non-mutating preview (see the global flag's doc and
-    // the JSON path's `dryRun` envelope). The interactive path must honor it
-    // too: stop here, having printed the table and the per-patch plan above,
-    // before the confirm prompt, the download/apply, and the prune GC — all
-    // of which mutate the manifest and `.socket/` on disk (the GC runs as a
-    // read-only preview instead).
+    // `--dry-run` is a non-mutating preview: stop here, having printed the
+    // table and the per-patch plan above, before the download/apply and the
+    // prune GC (which runs as a read-only preview instead).
     if args.common.dry_run {
         if !silent {
-            // Vendored preview: the same ledger classification the JSON arm
-            // nests under `vendor`, rendered as `[would-refuse]` lines so a
-            // human preview never advertises vendoring the wet run's Bun
-            // preflight is known to refuse (the `get --mode vendored
-            // --dry-run` arms print the identical lines). The headline
-            // counts them too.
+            // Vendored preview: the JSON arm's ledger classification,
+            // rendered as `[would-refuse]` lines so a preview never
+            // advertises vendoring the wet run would refuse.
             let preview = if vendor {
                 Some(preview_vendor_json(&args.common.cwd, &selected).await)
             } else {
@@ -3172,10 +2853,9 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
     }
 
     // Vendor mode: pre-verify baselines so a content mismatch is reported
-    // before vendoring starts (vendoring still proceeds for these — the
-    // stage force-applies the verified patched content). Runs after the
-    // dry-run return above so a preview fetches no views; the views it
-    // does fetch seed the download phase, which never fetches them again.
+    // before vendoring starts (vendoring still proceeds — the stage
+    // force-applies the verified patched content). The fetched views seed
+    // the download phase.
     let prefetched = if vendor && !silent {
         let (mismatched, views) = preverify_vendor_baselines(
             &api_client,
@@ -3209,8 +2889,7 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
     );
 
     let code = if vendor {
-        // Extracted + boxed for the same Windows-1-MiB-frame reason as the
-        // JSON path (see `run_vendor_json_path`).
+        // Boxed for the same Windows 1 MiB frame reason as the JSON path.
         boxed_vendor_interactive_path(
             &args,
             &api_client,
@@ -3235,12 +2914,9 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         code
     };
 
-    // Cross-mode visibility, mirroring the JSON apply path: after an
-    // in-place apply, warn when the hosted redirect wiring is still live
-    // for scanned package(s) — the apply cannot unwind it, and silence
-    // reads as a completed hosted→agent conversion that never happened.
-    // (The vendored-ownership counterpart is already printed per package
-    // by the `[skip] … (vendored …)` lines above.)
+    // Cross-mode visibility, mirroring the JSON apply path: warn when the
+    // hosted redirect wiring is still live for scanned package(s). (The
+    // vendored-ownership counterpart is the `[skip]` lines above.)
     if !vendor && !silent {
         let hosted_retained =
             hosted_wiring_retained_purls(&args.common, redirect_state.as_ref(), &all_purls).await;
@@ -3252,11 +2928,9 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         }
     }
 
-    // Post-apply GC: only runs when the user opted in via `--prune` or
-    // `--sync`. Default `scan --yes` no longer touches the manifest
-    // beyond what `--apply` added — users wanting to clean up should
-    // run `socket-patch gc` (or `repair`) explicitly. (Vendor mode runs
-    // its own GC after the vendor step, inside `vendor_flow`.)
+    // Post-apply GC: only with `--prune` or `--sync`; otherwise an agent
+    // apply leaves every other manifest entry alone (`socket-patch repair`
+    // cleans up explicitly). Vendor mode runs its own GC in `vendor_flow`.
     if prune && !vendor {
         gc::run_human_gc(
             &args.common,
@@ -3492,10 +3166,6 @@ mod tests {
     }
 
     // ---- cross-mode ledger takeover (hosted ⇄ vendored) --------------------
-    // Switching a project's patch mode rewires the lockfile to the new mode
-    // but leaves the OLD mode's ledger on disk asserting stale wiring. These
-    // pin the detection + warning that flags it (the sweep's
-    // stale-ledger-on-mode-takeover finding).
 
     const TAKEOVER_UUID: &str = "9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f";
 
@@ -3619,9 +3289,7 @@ mod tests {
         let purls = vec!["pkg:npm/minimist@1.2.2".to_string()];
 
         // Vendored displaced a hosted redirect: name the stale ledger, but
-        // NEVER advise deleting it by hand — it may hold the only revert data
-        // and VEX records for OTHER still-live redirects. The safe sequence
-        // is re-running the vendored flow, which reconciles per package.
+        // NEVER advise deleting it by hand.
         let vendored = mode_takeover_detail(&purls, /*current_is_hosted=*/ false);
         assert!(vendored.contains("pkg:npm/minimist@1.2.2"));
         assert!(vendored.contains("redirect-state.json"));
@@ -3634,10 +3302,11 @@ mod tests {
             "must warn against hand-deleting the ledger: {vendored}"
         );
 
-        // Hosted displaced a vendored ledger: `vendor --revert` is the ONLY
-        // offered remediation. Deleting the `.socket/vendor/<eco>/` tree by
-        // hand hard-breaks cargo resolution while `[patch.crates-io]` still
-        // references it.
+        // Hosted displaced a vendored ledger: per-package `remove <purl>` is
+        // the offered remediation; `vendor --revert` is named only as
+        // something NOT to run (it mass-reverts). Deleting the
+        // `.socket/vendor/<eco>/` tree by hand hard-breaks cargo resolution
+        // while `[patch.crates-io]` still references it.
         let hosted = mode_takeover_detail(&purls, /*current_is_hosted=*/ true);
         assert!(hosted.contains("pkg:npm/minimist@1.2.2"));
         assert!(hosted.contains("state.json"));
@@ -3654,12 +3323,6 @@ mod tests {
     }
 
     // ---- agent-flow hosted-wiring retention (hosted → agent conversion) ----
-    // The overlap classifier keys on purls present in BOTH ledgers, so
-    // hosted-ONLY wiring (the exact hosted→agent conversion state: redirect
-    // ledger live, no vendor state.json) can structurally never trigger it.
-    // The agent flow probes the redirect ledger + live lock directly and
-    // emits `hosted_wiring_retained`. These pin the trigger, every
-    // non-trigger, and the remediation wording.
 
     /// Redirect ledger with one record per PURL AND a recorded `yarn.lock`
     /// edit — the shape a real hosted run leaves behind (the edit is what
@@ -3748,11 +3411,9 @@ mod tests {
         let purl = "pkg:npm/minimist@1.2.2";
         let scanned: HashSet<String> = [purl.to_string()].into_iter().collect();
 
-        // (a) Records retired — the lane-B (hosted→vendored pre-revert)
-        // world: the pre-revert drops the ledger RECORDS while the
-        // append-only `edits` (revert originals) legitimately remain. The
-        // warning keys on records still live at scan time, so it must stay
-        // silent even with the uuid still present in the lock text.
+        // (a) Records retired (a hosted→vendored pre-revert drops RECORDS
+        // while the `edits` remain): silent even with the uuid still in the
+        // lock text.
         let tmp = tempfile::tempdir().unwrap();
         write_redirect_ledger_with_edit(tmp.path(), &[]).await;
         write_hosted_yarn_lock(tmp.path(), TAKEOVER_UUID).await;
@@ -3858,10 +3519,8 @@ mod tests {
     fn agent_retention_details_name_packages_and_safe_remediation() {
         let purls = vec!["pkg:npm/minimist@1.2.2".to_string()];
 
-        // hosted_wiring_retained: names the purl and both real options
-        // (stay hosted / migrate via vendored), never a hosted→agent
-        // unwind (none exists) and never hand-deleting the ledger (the
-        // only store of the pre-redirect revert originals).
+        // hosted_wiring_retained: names the purl and the real options,
+        // never hand-deleting the ledger.
         let hosted = hosted_wiring_retained_detail(&purls);
         assert!(hosted.contains("pkg:npm/minimist@1.2.2"));
         assert!(hosted.contains("scan --mode hosted"));
@@ -3946,12 +3605,8 @@ mod tests {
 
     /// The records↔wiringLive join is a plain string compare: each record's
     /// `purl` is canonicalized to exactly the spelling the probe emits, with
-    /// the ledger's raw key preserved as `ledgerKey`. Pinned on the two key
-    /// shapes real ledgers carry — a percent-encoded scoped npm name (the
-    /// API spelling, the `drop_superseded_purl` fixture shape) and a
-    /// `?platform=`-qualified gem purl. Pre-fix, `records[].purl` kept the
-    /// verbatim key while `wiringLive` was canonical, so a LIVE redirect
-    /// read as "wiring unwound" to any consumer doing the documented join.
+    /// the ledger's raw key preserved as `ledgerKey`. Pinned on a
+    /// percent-encoded scoped npm name and a `?platform=`-qualified gem purl.
     #[tokio::test]
     async fn redirect_state_records_canonicalize_to_the_wiring_live_spelling() {
         use socket_patch_core::patch::redirect::{FileEdit, RedirectState};
@@ -4040,8 +3695,8 @@ mod tests {
     }
 
     /// The block's `mode` is the constant label, not the ledger's opaque
-    /// `mode` string: a pre-rename ledger carrying `"redirect"` still labels
-    /// as `"hosted"`, so consumers dispatching on the key need no history.
+    /// `mode` string: a ledger carrying `"redirect"` still labels as
+    /// `"hosted"`.
     #[tokio::test]
     async fn redirect_state_mode_is_the_constant_label_for_legacy_ledgers() {
         let tmp = tempfile::tempdir().unwrap();
@@ -4055,11 +3710,8 @@ mod tests {
 
     // ---- cargo takeover direction (lock-shape probe) ------------------------
     // The scan inventory records `resolved: None` for every cargo entry, so
-    // the generic patch.socket.dev check can never prove hosted for cargo —
-    // pre-fix, a genuine vendored→hosted cargo takeover classified as
-    // (hosted=false, vendored=true) and the warning INVERTED: the vendored
-    // flow told the user to delete the LIVE redirect ledger. These pin the
-    // cargo-specific lock-shape classifier.
+    // the generic patch.socket.dev check can never prove hosted for cargo;
+    // these pin the cargo-specific lock-shape classifier.
 
     const CARGO_PURL: &str = "pkg:cargo/cfg-if@1.0.4";
     /// A self-hosted patch server's sparse index (the probe must not depend
@@ -4116,7 +3768,7 @@ mod tests {
         .unwrap();
     }
 
-    /// The mixed state a pre-fix vendored→hosted cargo takeover left behind:
+    /// The mixed state a vendored→hosted cargo takeover can leave behind:
     /// the lock rewired to the hosted sparse index (declared as a
     /// socket-patch registry in the config), while the vendored
     /// `[patch.crates-io]` entry ALSO survives in the config.
@@ -4150,7 +3802,7 @@ mod tests {
         // (a localhost URL — the probe must not depend on the
         // patch.socket.dev host). Hosted won; the vendored ledger is stale —
         // even though the leftover [patch.crates-io] marker would satisfy the
-        // generic wiring scan (the pre-fix inversion).
+        // generic wiring scan.
         let tmp = tempfile::tempdir().unwrap();
         let root = tmp.path();
         write_redirect_ledger(root, &[CARGO_PURL]).await;
@@ -4231,10 +3883,6 @@ mod tests {
     }
 
     // ---- takeover DIRECTION follows the live lock, not the command ---------
-    // The overlap alone only proves both ledgers name the same package; it does
-    // NOT prove which mode won. `classify_overlap_takeover` decides direction
-    // from the ACTUAL current lockfile wiring, so a dry-run/no-op can never emit
-    // the wrong `*_supersedes_*` warning and point cleanup at the LIVE ledger.
 
     /// Like [`write_vendor_ledger`] but each entry records wiring the
     /// `package-lock.json` — the file the direction check reads to see whether
@@ -4336,7 +3984,7 @@ mod tests {
         // Both ledgers claim minimist, but the LIVE lockfile still resolves it
         // to the committed `.socket/vendor/` artifact — vendored is live. A
         // hosted dry-run/no-op must NOT emit `redirect_supersedes_vendored`,
-        // which would point cleanup at the LIVE vendored ledger (the bug).
+        // which would point cleanup at the LIVE vendored ledger.
         let tmp = tempfile::tempdir().unwrap();
         let root = tmp.path();
         write_redirect_ledger(root, &["pkg:npm/minimist@1.2.2"]).await;
@@ -4355,8 +4003,7 @@ mod tests {
             takeover.vendored,
             vec!["pkg:npm/minimist@1.2.2".to_string()]
         );
-        // Pre-fix the hosted flow keyed off the raw overlap, which is non-empty
-        // — it WOULD have wrongly told the user to delete the live ledger.
+        // The raw overlap is non-empty: only the direction gate keeps it quiet.
         assert!(!overlapping_ledger_purls(root).await.is_empty());
     }
 
@@ -4409,12 +4056,9 @@ mod tests {
 
     #[test]
     fn takeover_detail_remediation_is_per_package_and_non_destructive() {
-        // Regression: the remediation used to instruct whole-ledger /
-        // whole-tree deletion, destroying live data for packages the takeover
-        // did not touch — the redirect ledger holds OTHER packages' records
-        // (VEX reads them) plus the only recorded pre-redirect originals, and
-        // the `.socket/vendor/<eco>/` tree holds EVERY vendored uuid dir.
-        // Cleanup must be scoped per named package.
+        // Cleanup must be scoped per named package: whole-ledger / whole-tree
+        // deletion would destroy live data for packages the takeover did not
+        // touch.
         let purls = vec!["pkg:npm/minimist@1.2.2".to_string()];
 
         let hosted = mode_takeover_detail(&purls, /*current_is_hosted=*/ true);
@@ -4456,11 +4100,8 @@ mod tests {
 
     #[test]
     fn hosted_remediation_states_removes_full_blast_radius() {
-        // Regression: the hosted text said `socket-patch remove <purl>` "drops
-        // only that entry and its own `.socket/vendor/<eco>/<uuid>/` artifact
-        // directory". It also deletes the package's `.socket/manifest.json`
-        // entry, so a reader budgeting for a ledger-scoped edit — a bot passing
-        // `--yes`, especially — was mis-told what the command does.
+        // `socket-patch remove <purl>` also deletes the package's
+        // `.socket/manifest.json` entry; the hosted text must say so.
         let purls = vec!["pkg:npm/minimist@1.2.2".to_string()];
         let hosted = mode_takeover_detail(&purls, /*current_is_hosted=*/ true);
 
@@ -4522,8 +4163,7 @@ mod tests {
         // A hosted run where every per-uuid record fetch failed persists a
         // ledger with edits but an EMPTY records map (`record_fetch_failed`).
         // That ledger still asserts stale lock wiring, so a vendored takeover
-        // of the same package must still be flagged — deriving the overlap
-        // from record keys alone was blind to exactly this ledger.
+        // of the same package must still be flagged.
         let tmp = tempfile::tempdir().unwrap();
         let root = tmp.path();
         write_redirect_ledger_with_edits(
@@ -4576,14 +4216,10 @@ mod tests {
 
     #[tokio::test]
     async fn following_the_vendored_remediation_clears_the_warning() {
-        // Regression (sticky warning): the vendored remediation used to name
-        // only the `records` entries. When the takeover cleared the LAST
-        // record, the leftover `edits` still matched the package through the
-        // degraded-ledger fallback above, so the identical warning fired on
-        // every later run — and repeated advice that could no longer be
-        // followed, since `records` was already empty. The remediation now
-        // names the matching `edits` entries too; carrying it out in full has
-        // to leave nothing to warn about.
+        // The vendored remediation names the matching `edits` entries as
+        // well as `records` (leftover edits keep matching through the
+        // degraded-ledger fallback); carrying it out in full must leave
+        // nothing to warn about.
         let tmp = tempfile::tempdir().unwrap();
         let root = tmp.path();
         write_redirect_ledger_with_edits(
@@ -4822,9 +4458,8 @@ mod tests {
     // ---- hostile-ledger tamper guards (path traversal) ----------------------
     // The ledgers are committed files an attacker can edit: a recorded
     // lockfile name must never make the wiring probes READ outside the
-    // project root. The probes are core discovery's ledger-liveness rules
-    // (the ones `vex` gates on); with nothing discovered they fall back to
-    // the ledger's recorded files, which is the path under test.
+    // project root. With nothing discovered the probes fall back to the
+    // ledger's recorded files, which is the path under test.
 
     #[tokio::test]
     async fn hosted_wiring_text_proof_never_reads_outside_the_project() {
@@ -4933,9 +4568,6 @@ mod tests {
     }
 
     // ---- note_vendor_supersedes_redirect: warning + npm auto-reconcile ------
-    // The vendored flows' takeover advisory. Detection is pinned above;
-    // these pin the post-detection body: the reconciled/manual/dry-run
-    // partitions, the ledger mutation, and the fires-once contract.
 
     const NPM_TAKEOVER_PURL: &str = "pkg:npm/minimist@1.2.2";
 
@@ -5010,12 +4642,9 @@ mod tests {
         );
     }
 
-    /// Finding: the reconcile unwound the hosted `.npmrc` auto-config but
-    /// threw away the unwind's warnings (a user-edited redirect-created
-    /// `.npmrc` was rewritten with no `redirect_npmrc_allow_remote_modified`)
-    /// and its detail never mentioned `.npmrc` while still promising
-    /// `vendor --revert` restores the hosted wiring (npm 12 then refuses it
-    /// without the line). Both are now surfaced.
+    /// The reconcile's `.npmrc` unwind surfaces its own warnings
+    /// (`redirect_npmrc_allow_remote_modified`), and the detail mentions
+    /// `.npmrc` with the npm 12 EALLOWREMOTE caveat.
     #[tokio::test]
     async fn vendored_takeover_reconcile_surfaces_the_npmrc_unwind() {
         let tmp = tempfile::tempdir().unwrap();
diff --git a/crates/socket-patch-cli/src/commands/scan/render.rs b/crates/socket-patch-cli/src/commands/scan/render.rs
index f9c28fc8..34adcadc 100644
--- a/crates/socket-patch-cli/src/commands/scan/render.rs
+++ b/crates/socket-patch-cli/src/commands/scan/render.rs
@@ -1,7 +1,7 @@
 //! Pure text builders for `scan`'s human output: the results table, the
-//! summary and prompt lines, the per-patch preview, and the hints. No I/O
-//! and no terminal state (color is decided by the caller and passed in),
-//! so every string is unit-testable byte for byte.
+//! summary lines, the dry-run line, the per-patch preview, and the hints.
+//! No I/O and no terminal state (color is decided by the caller and passed
+//! in), so every string is unit-testable byte for byte.
 
 use std::collections::HashMap;
 
@@ -202,8 +202,6 @@ fn quoted_list(items: &[String], one: &str, many: &str) -> String {
     format!("{label}: {}", items.join(", "))
 }
 
-/// Warning printed when `--prune` cannot run because nothing was crawled
-/// (pruning every manifest entry is too destructive to do implicitly).
 /// The warning for one failed API batch of several (the scan goes on
 /// with the others). A one-batch scan prints only [`all_batches_failed`].
 pub(super) fn batch_failed_warning(batch: usize, total: usize, err: &str) -> String {
@@ -219,6 +217,8 @@ pub(super) fn all_batches_failed(total: usize, err: &str) -> String {
     }
 }
 
+/// Warning printed when `--prune` cannot run because nothing was crawled
+/// (pruning every manifest entry is too destructive to do implicitly).
 pub(super) const PRUNE_SKIPPED_EMPTY: &str = "Warning: --prune skipped: no installed packages \
      were found, and pruning every manifest entry is too destructive to do implicitly; run \
      `socket-patch repair` to clean up .socket/ explicitly.";
@@ -248,8 +248,8 @@ pub(super) fn dry_run_line(plan: Plan, refused: usize) -> String {
     format!("[dry-run] Would {what}. No changes made.")
 }
 
-/// Lines printed after a report-only scan (path-scoped, `--prune` or
-/// global, so no lockfile to rewire): how to apply what it found.
+/// Lines printed after a report-only scan (`--prune` or global with no
+/// mode, so no lockfile to rewire): how to apply what it found.
 pub(super) fn report_only_hint() -> [String; 3] {
     [
         "To apply these patches in place, run:".to_string(),
diff --git a/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs b/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs
index c51b2ea4..f365ab24 100644
--- a/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs
+++ b/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs
@@ -77,22 +77,16 @@ type VendorStepResult = Result<(bool, Envelope), VendorStepError>;
 /// ([`crate::commands::bun_preflight::BunVendorRefusal`],
 /// [`crate::commands::vlt_preflight`]) would refuse before any download.
 /// The preview stays a ledger classification otherwise (engine refusals
-/// outside the preflights are not predicted), and it never flips the run's
-/// status or exit code: `would_refuse` is best-effort advice so a preview
-/// never advertises vendoring the wet run is known to refuse. The
-/// preflights read `bun.lock`/`bun.lockb` (plus, on a refused workspace
-/// lock, the lock once more per npm purl for the exemption) or
-/// `vlt-lock.json` with its importer package.json files — the only disk
-/// access here — and run only when the selection holds an npm purl.
+/// outside the preflights are not predicted), and `would_refuse` never
+/// flips the run's status or exit code. The preflights (the only disk
+/// access besides the ledger) run only when the selection holds an npm purl.
 pub(crate) async fn preview_vendor_json(
     cwd: &Path,
     selected: &[PatchSearchResult],
 ) -> serde_json::Value {
     // The ledger load outcome reaches the preflight AS a result, so an
-    // unreadable ledger previews as `vendor_state_unreadable` (nothing
-    // exempt) instead of being flattened into an empty ledger that then
-    // predicts a Bun lock refusal; the classification below degrades it to
-    // empty (every npm record then reads `would_refuse` with that code).
+    // unreadable ledger previews as `vendor_state_unreadable` rather than
+    // as an empty ledger.
     let state = load_state(cwd).await;
     let refusal =
         bun_vendor_preflight_with_ledger(cwd, selected, state.as_ref().map(|s| &s.entries)).await;
@@ -137,11 +131,9 @@ pub(crate) async fn preview_vendor_json(
 /// Human rendering of the vendored dry-run preview's `would_refuse` records
 /// (see [`preview_vendor_json`]): the count line above it still says
 /// "would download and vendor", so name what the wet run would refuse and
-/// why. Shared by `scan --mode vendored --dry-run`'s interactive arm and
-/// both `get … --mode vendored --dry-run` arms so the two commands' human
-/// previews cannot drift (the contract promises the line for both).
-/// Informational (the preview exits 0), hence behind the caller's
-/// `--silent` gate.
+/// why. Shared by `scan --mode vendored --dry-run` and
+/// `get … --mode vendored --dry-run` so the two cannot drift. Callers gate
+/// it on `--silent`.
 pub(crate) fn print_dry_run_refusals(preview: &serde_json::Value) {
     let Some(patches) = preview["patches"].as_array() else {
         return;
@@ -160,28 +152,19 @@ pub(crate) fn print_dry_run_refusals(preview: &serde_json::Value) {
 /// (and, through [`boxed_scan_vendor_step`], `get --mode vendored`):
 /// acquire the apply lock, stage the in-memory `records` (from
 /// [`download_patch_records_reusing`], whose blob `seed` spares the stager a
-/// second view fetch), drive [`vendor_records`] detached — every ledger
-/// entry embeds its record; `.socket/manifest.json` is never a record
-/// source — over the run's `client`, then migrate any legacy manifest
-/// records the ledger now owns and run the run-level advisories, all under
-/// the lock.
+/// second view fetch), drive [`vendor_records_reusing`] detached (every
+/// ledger entry embeds its record) over the run's `client`, then migrate any
+/// legacy manifest records the ledger now owns and run the run-level
+/// advisories, all under the lock.
 ///
-/// An empty `records` map (nothing selected, or everything refused/failed
-/// in the download phase) is a no-op BEFORE the lock: nothing is staged,
-/// the engine does not run, and no `.socket/` is created for a run with
-/// nothing to vendor.
+/// An empty `records` map is a no-op BEFORE the lock: nothing is staged and
+/// no `.socket/` is created.
 ///
-/// `Ok((has_errors, envelope))` on a run that reached the engine;
-/// `Err((code, message, envelope))` for the lock/stage failures the caller
-/// folds into its own output shape (scan's ad-hoc JSON can't use
-/// `acquire_or_emit`, which prints an Envelope). A lock failure precedes
-/// the step, so it carries no envelope (`None`); a staging failure
-/// (`no_local_source`) hands back the step's envelope demoted to
-/// `partialFailure` — the contract's `vendor` sub-object is present
-/// whenever the step ran, and a consumer reading `.vendor.status` inside a
-/// `"status":"error"` result must never see the fresh-envelope default of
-/// `success`. Nothing mutates the project before staging, so that
-/// envelope carries no events.
+/// `Err((code, message, envelope))` is a lock/stage failure the caller folds
+/// into its own output shape. A lock failure carries no envelope; a staging
+/// failure (`no_local_source`) hands back the step's envelope demoted to
+/// `partialFailure`, so `.vendor.status` inside a `"status":"error"` result
+/// never reads `success`.
 async fn run_scan_vendor_step(
     common: &GlobalArgs,
     records: HashMap<String, PatchRecord>,
@@ -208,10 +191,9 @@ async fn run_scan_vendor_step(
     let manifest_path = common.resolved_manifest_path();
     let socket_dir = common.socket_dir();
     let timeout = Duration::from_secs(common.lock_timeout.unwrap_or(0));
-    // `acquire` creates `.socket/` itself and reports a file squatting on
-    // it as `LockError::Io` (→ `lock_io`). The guard lives to the end of
-    // the step so the ledger migration and the redirect-ledger reconcile
-    // inside `note_vendor_supersedes_redirect` run under the lock too.
+    // The guard lives to the end of the step so the ledger migration and
+    // the redirect-ledger reconcile in `note_vendor_supersedes_redirect`
+    // run under the lock too.
     let _guard =
         crate::commands::lock_cli::acquire_with_status(&socket_dir, timeout).map_err(|e| {
             let (code, message) = lock_failure(&e, timeout);
@@ -239,8 +221,7 @@ async fn run_scan_vendor_step(
         Ok(has_errors) => has_errors,
         Err((code, message)) => {
             // The step ran and is aborting: hand its envelope (demoted) to
-            // the caller's fold instead of letting the `vendor` sub-object
-            // vanish from a run that entered the step.
+            // the caller's fold.
             env.mark_partial_failure();
             return Err((code, message, Some(Box::new(env))));
         }
@@ -295,17 +276,12 @@ async fn stage_and_vendor(
         }
     };
     let sources = staged.as_patch_sources();
-    // A record whose content this run could not obtain is an unsatisfiable
-    // PACKAGE, reported per-package and left out of the engine run — the
-    // rest of the selection still vendors (the stager reserves its
-    // whole-run `no_local_source` bail for "nothing is stageable").
+    // A record whose content this run could not obtain is reported
+    // per-package and left out of the engine run; the rest still vendors.
     let (records, staging_errors) = drop_unstageable(env, &manifest.patches, staged.unavailable());
-    // Honor `--vendor-source` (and `--vendor-url` / `--patch-server-url`)
-    // exactly as the `vendor` command does: the SAME service-config
-    // assembler, over the run's one client, so `scan --mode vendored` and a
-    // plain `vendor` commit byte-identical artifacts by default (both
-    // service-download under `auto`) instead of scan silently building
-    // locally.
+    // The SAME service-config assembler the `vendor` command uses
+    // (`--vendor-source` / `--vendor-url` / `--patch-server-url`), so
+    // `scan --mode vendored` and `vendor` commit byte-identical artifacts.
     let service = common.vendor_service_config(Some(client), use_public_proxy);
     let engine_errors = boxed_vendor_records(
         common,
@@ -326,27 +302,19 @@ fn ledger_key_for(state: &VendorState, purl: &str) -> Option<String> {
     socket_patch_core::vendor::state::lookup_entry_kv(&state.entries, purl).map(|(k, _)| k.clone())
 }
 
-/// Migrate a project vendored by an older, manifest-mode CLI: the ledger
-/// is now the single owner of vendored state, so for the purls THIS run
-/// vendored (`records` — the selection, in-sync `already_vendored` skips
-/// included): (1) a legacy entry the engine just found in sync at a
-/// record's uuid (an `already_vendored` skip persists nothing) is upgraded
-/// in place — `detached: true` plus the embedded record, the verification
-/// source every manifest-free reader needs — and (2) every
+/// Migrate a project vendored by an older, manifest-mode CLI. For the purls
+/// THIS run vendored (`records`, in-sync `already_vendored` skips included):
+/// (1) a legacy entry in sync at a record's uuid is upgraded in place
+/// (`detached: true` plus the embedded record), and (2) every
 /// `.socket/manifest.json` record keyed by (or sharing a qualifier-stripped
-/// base with) the purl's ledger entry is dropped, provided the ledger now
-/// owns it: the entry is detached with an embedded record AT the record's
-/// uuid. An emptied manifest is left as `{"patches":{}}` (never deleted:
-/// `list`/`apply`/`repair` distinguish empty from missing). Scoped to the
-/// selection on purpose (D2: "when a vendored run vendors a purl that ALSO
-/// has a manifest record, drop that manifest record"): an agent-mode `get X`
-/// may legitimately record X at a NEWER uuid than the ledger's while the
-/// user is told to run `vendor` to refresh the artifact — a vendored run for
-/// some other purl must not destroy that pending signal. Idempotent for the
-/// selected purls, so it also heals their records stranded by earlier
-/// detached runs; a project with no manifest is untouched (no file is
-/// created). Best-effort: failures are reported as run-level warnings,
-/// never as run errors — the vendoring itself already committed.
+/// base with) the purl's ledger entry is dropped, provided the entry is
+/// detached with an embedded record AT the record's uuid. An emptied
+/// manifest is left as `{"patches":{}}` (`list`/`apply`/`repair` distinguish
+/// empty from missing). Scoped to the selection on purpose: an agent-mode
+/// `get X` may record X at a NEWER uuid than the ledger's, a pending signal
+/// a vendored run for another purl must not destroy. Idempotent; a project
+/// with no manifest is untouched. Best-effort: failures are run-level
+/// warnings, never run errors.
 ///
 /// Caller holds the apply lock (both files are rewritten).
 async fn migrate_legacy_manifest_records(
@@ -464,11 +432,9 @@ async fn migrate_legacy_manifest_records(
 /// The dry-run arm skips the VEX embed (emitting a `vex.skipped` marker
 /// instead): a dry run vendors nothing, so there is no state to attest.
 ///
-/// Extracted from `run` (and called through `Box::pin`) so its sizeable
-/// temporaries get their own poll frame, entered only when `--vendor` is
-/// actually requested — in debug builds the enclosing frame retains stack
-/// slots for never-taken branches, and `run`'s frame must fit Windows'
-/// 1 MiB main-thread stack.
+/// Extracted from `run` (and called through `Box::pin`) so its temporaries
+/// get their own poll frame: `run`'s frame must fit Windows' 1 MiB
+/// main-thread stack, and debug builds reserve slots for never-taken branches.
 #[allow(clippy::too_many_arguments)]
 async fn run_vendor_json_path(
     args: &ScanArgs,
@@ -527,12 +493,8 @@ async fn run_vendor_json_path(
             )
             .await;
         }
-        // Embedded VEX is skipped on a dry run (apply.rs's precedent):
-        // nothing was vendored, so there is no just-vendored state to
-        // attest — generating here would verify the deliberately untouched
-        // tree (failing outright on a not-yet-vendored project) and write
-        // an attestation file during --dry-run. The marker keeps the
-        // request visible to JSON consumers instead of silently dropping it.
+        // Embedded VEX is skipped on a dry run (nothing was vendored to
+        // attest); the marker keeps the request visible to JSON consumers.
         if args.vex.vex.is_some() {
             result["vex"] = serde_json::json!({ "skipped": true, "reason": "dry_run" });
         }
@@ -631,7 +593,7 @@ async fn run_vendor_json_path(
 }
 
 /// The `scan --vendor` interactive arm: download → vendor engine → GC,
-/// with human-readable output. `prefetched` holds the views the pre-prompt
+/// with human-readable output. `prefetched` holds the views the pre-download
 /// baseline check already fetched (uuid-keyed), so the download phase
 /// serves those records from memory. Extracted + boxed for the same
 /// Windows-1-MiB-poll-frame reason as [`run_vendor_json_path`].
@@ -650,15 +612,15 @@ async fn run_vendor_interactive_path(
     prune: bool,
     telemetry_token: Option<&str>,
     telemetry_org: Option<&str>,
-    // The npm half of scan's crawl, for the vendor engine to reuse —
-    // `None` when the tree may have changed since (an answered prompt).
+    // The npm half of scan's crawl, for the vendor engine to reuse.
     prior: Option<&NpmCrawlSnapshot>,
 ) -> i32 {
     // The download phase is quiet about its own header in vendored mode
     // (only the manifest-mode download prints it), so this arm does.
     if !args.common.silent && !selected.is_empty() {
-        // A blank line after an answered prompt; otherwise the listing's
-        // trailing blank line already separates the sections.
+        // Extra separator on a terminal run without `--yes` (a vestige of
+        // the removed confirm prompt); otherwise the listing's trailing
+        // blank line already separates the sections.
         if !args.common.yes && std::io::stdin().is_terminal() {
             eprintln!();
         }
@@ -782,14 +744,11 @@ pub(crate) fn format_vendor_step_error(code: &str, message: &str) -> String {
 ///   verification (`vendor_uuid_mismatch`) until a vendor run.
 /// * `"package_not_installed"` — the package is not on disk to patch in
 ///   place, and downloading its patch into the manifest would create a
-///   not-yet-appliable entry (and flip the apply path's exit code).
-///   `scan --vendor` is the route that handles these (the vendor engine
-///   auto-fetches lockfile-resolved packages); matching bridges API purl
-///   encoding via `normalize_purl`.
+///   not-yet-appliable entry. `scan --mode vendored` handles these (the
+///   vendor engine auto-fetches lockfile-resolved packages).
 ///
 /// A plain fn (not inlined into `run`) so the json! temporaries don't ride
-/// `run`'s async poll frame — see [`run_vendor_json_path`]'s Windows-stack
-/// note.
+/// `run`'s async poll frame — see [`run_vendor_json_path`].
 pub(super) fn partition_skipped_selected(
     selected: Vec<PatchSearchResult>,
     skip: impl Fn(&str) -> bool,
@@ -836,12 +795,10 @@ pub(super) fn fold_vendored_skips_into_apply(
 }
 
 /// Construct the (large) vendor-JSON-path future on THIS transient frame
-/// and hand `run` only the heap pointer. Writing
-/// `Box::pin(run_vendor_json_path(..))` inline in `run` materializes the
-/// future — which embeds the whole vendor engine — as a stack temporary in
-/// `run`'s poll frame: debug builds allocate slots even for never-taken
-/// branches, and that frame has to fit Windows' 1 MiB main-thread stack
-/// (every plain `scan` was overflowing there).
+/// and hand `run` only the heap pointer. `Box::pin(run_vendor_json_path(..))`
+/// inline in `run` would materialize the future (which embeds the whole
+/// vendor engine) as a stack temporary in `run`'s poll frame, which has to
+/// fit Windows' 1 MiB main-thread stack.
 #[allow(clippy::too_many_arguments)]
 pub(super) fn boxed_vendor_json_path<'a>(
     args: &'a ScanArgs,
@@ -917,12 +874,8 @@ pub(super) fn boxed_vendor_interactive_path<'a>(
 }
 
 /// Transient-frame boxed constructor for [`run_scan_vendor_step`] — the
-/// one entry for scan's two arms and for `get --mode vendored`. The future
-/// embeds the entire vendor engine, and the vendor-path frames it would
-/// otherwise ride must themselves fit Windows' 1 MiB main-thread stack
-/// (same rationale as [`boxed_vendor_json_path`], one level down). Moving
-/// the records and seed maps and the client into the future is
-/// stack-neutral (a few words each).
+/// one entry for scan's two arms and for `get --mode vendored`. Same
+/// Windows-stack rationale as [`boxed_vendor_json_path`], one level down.
 pub(crate) fn boxed_scan_vendor_step<'a>(
     common: &'a GlobalArgs,
     records: HashMap<String, PatchRecord>,
@@ -999,7 +952,7 @@ fn boxed_download_patch_records<'a>(
 }
 
 /// Transient-frame boxed constructor for the vendor engine itself
-/// ([`vendor_records`]) — the deepest, largest future on the scan-vendor
+/// ([`vendor_records_reusing`]) — the deepest, largest future on the scan-vendor
 /// chain. See [`boxed_vendor_json_path`] for the Windows-stack rationale.
 fn boxed_vendor_records<'a>(
     common: &'a GlobalArgs,
@@ -1010,11 +963,8 @@ fn boxed_vendor_records<'a>(
     env: &'a mut Envelope,
     prior: Option<&'a NpmCrawlSnapshot>,
 ) -> std::pin::Pin<Box<dyn std::future::Future<Output = bool> + 'a>> {
-    // `scan --vendor` threads the SAME service config the `vendor` command
-    // builds (honoring `--vendor-source`), so both entry points vendor the
-    // same bytes by default. See `run_scan_vendor_step`. Always detached:
-    // vendored mode is manifest-free. The ledger is the one the harvest
-    // just read, handed over so the engine does not reload it.
+    // Always detached: vendored mode is manifest-free. The ledger is the
+    // one the harvest just read, so the engine does not reload it.
     Box::pin(vendor_records_reusing(
         common, records, sources, /*detached=*/ true, false, env, service, ledger, prior,
     ))
@@ -1346,8 +1296,8 @@ mod preview_tests {
             .unwrap_or_else(|| panic!("no preview record for {purl}: {preview}"))
     }
 
-    /// Without a Bun lock the preview is the pre-existing ledger
-    /// classification, byte for byte: `would_vendor` and nothing else.
+    /// Without a Bun lock the preview is the plain ledger classification:
+    /// `would_vendor` and nothing else.
     #[tokio::test]
     async fn preview_without_bun_lock_is_plain_would_vendor() {
         let tmp = tempfile::tempdir().unwrap();
diff --git a/crates/socket-patch-cli/src/commands/setup.rs b/crates/socket-patch-cli/src/commands/setup.rs
index 722262f7..7b1d8070 100644
--- a/crates/socket-patch-cli/src/commands/setup.rs
+++ b/crates/socket-patch-cli/src/commands/setup.rs
@@ -467,8 +467,7 @@ fn is_member_excluded(manifest_path: &Path, cwd: &Path, excludes: &[String]) ->
 
 /// This run's ONE read of `.socket/manifest.json`, shared by the exclude
 /// resolution, the `--exclude` persistence's already-persisted check and
-/// `--check`'s patch-consistency pass (each used to parse the same bytes
-/// again).
+/// `--check`'s patch-consistency pass.
 async fn read_setup_manifest(common: &GlobalArgs) -> io::Result<Option<PatchManifest>> {
     read_manifest(&common.resolved_manifest_path()).await
 }
@@ -1110,7 +1109,7 @@ async fn finalize_gem(common: &GlobalArgs) -> Vec<String> {
 /// Append gem check entries (the Gemfile `plugin` directive + the generated
 /// plugin dir) to the shared `run_check` entries list. Returns whether a
 /// Bundler project was found. Checks the SETUP wiring only — patch consistency
-/// is `apply --check`.
+/// is the shared `append_patch_consistency_entries` pass.
 async fn append_gem_check_entries(
     common: &GlobalArgs,
     entries: &mut Vec<(&'static str, String, CheckState, Option<String>)>,
@@ -1327,13 +1326,14 @@ fn format_check_footer(hooks: usize, drifted: usize, errors: usize) -> String {
     format!("{}. {}", problems.join(", "), advice.join(" "))
 }
 
-/// Read-only verification that every discovered manifest (npm package.json and
-/// the Python dependency manifest) is configured for socket-patch. Never writes
-/// (so `--dry-run` is a harmless no-op here). Exits 0 only when all are
-/// configured and none failed to parse.
 /// The status line while `setup --check` / `--remove` discover manifests.
 const SEARCHING: &str = "Searching for package.json / Python / Bundler / Composer manifests...";
 
+/// Read-only verification that every discovered install hook (npm
+/// package.json, the Python dependency manifest, the Bundler plugin, the
+/// Composer script) is configured for socket-patch, plus the shared
+/// patch-consistency pass. Never writes (so `--dry-run` is a harmless no-op
+/// here). Exits 0 only when all are configured and none failed to parse.
 async fn run_check(args: &SetupArgs) -> i32 {
     // `--silent` is "errors only" (CLI_CONTRACT.md): suppress the entire
     // human-readable report, mirroring `list`/`repair`/`get`/`remove`/`scan`.
@@ -1527,7 +1527,7 @@ fn render_removed(new: &Option<String>) -> String {
 }
 
 /// Revert the install hooks `setup` added (npm package.json scripts, the
-/// Python `socket-patch-hook` dependency, the gem Bundler plugin wiring and
+/// Python `socket-patch[hook]` dependency, the gem Bundler plugin wiring and
 /// the Composer script). Honors `--dry-run`, `--yes`, `--json`.
 async fn run_remove(args: &SetupArgs) -> i32 {
     let common = &args.common;
diff --git a/crates/socket-patch-cli/src/commands/update.rs b/crates/socket-patch-cli/src/commands/update.rs
index fa6c384b..dc8fe2be 100644
--- a/crates/socket-patch-cli/src/commands/update.rs
+++ b/crates/socket-patch-cli/src/commands/update.rs
@@ -24,13 +24,11 @@ use crate::json_envelope::{Command, Envelope, PatchAction, PatchEvent, RunWarnin
 pub const UPDATE_TARGET: &str = env!("SOCKET_PATCH_TARGET");
 
 // `socket-patch --update --help` must describe the public `--update`
-// flag, not the hidden `self-update` subcommand it is rewritten to. The
-// variant's doc comment in lib.rs (developer notes) becomes the
-// subcommand's `about` and is applied after these attributes, so the help
-// text is fixed through a template that never renders `{about}`.
-// (The usage line still reads `socket-patch self-update ...`: lib.rs's
-// `update_help_shows_self_update_help` pins that; overriding it to
-// `socket-patch --update [VERSION] [OPTIONS]` belongs with that test.)
+// flag, not the hidden `self-update` subcommand it is rewritten to. lib.rs
+// sets an explicit `about`/`override_usage` on the hidden variant, and this
+// template keeps `--update --help` on the public wording; both are pinned by
+// lib.rs `update_help_shows_self_update_help` and help_text_hygiene
+// `self_update_help_shows_the_public_spelling`.
 #[derive(Args)]
 #[command(
     help_template = "Update socket-patch itself to the latest release (or to VERSION).\n\n\
diff --git a/crates/socket-patch-cli/src/commands/vendor.rs b/crates/socket-patch-cli/src/commands/vendor.rs
index 4618fcdd..5da61dd9 100644
--- a/crates/socket-patch-cli/src/commands/vendor.rs
+++ b/crates/socket-patch-cli/src/commands/vendor.rs
@@ -8,9 +8,10 @@
 //! socket-patch and no Socket API access. `--revert` restores the recorded
 //! original lockfile fragments and removes the artifacts.
 //!
-//! The rest of the CLI is vendor-aware: `apply`/`rollback` yield ownership of
-//! ledger-recorded purls, `remove` reverts vendoring as part of removing a
-//! patch, `scan --prune` exempts vendored entries, and `scan`/`get --mode
+//! The rest of the CLI is vendor-aware: `apply` yields ownership of
+//! ledger-recorded purls, `rollback` skips them in its in-place leg and then
+//! reverts them through its vendored leg, `remove` reverts vendoring as part
+//! of removing a patch, `scan --prune` exempts vendored entries, and `scan`/`get --mode
 //! vendored` drive this module's [`vendor_records`] engine directly in
 //! DETACHED mode: every entry they write carries its patch record embedded
 //! in the ledger and no `.socket/manifest.json` is ever written — this
@@ -118,25 +119,19 @@ pub(crate) async fn dispatch_vendor_one(
     vendored_at: &str,
     dry_run: bool,
     force: bool,
-    // The patch.socket.dev vendoring-service config. `None` = build-only (the
-    // pre-service behavior). `vendor` and `scan`/`get --mode vendored` pass
-    // `Some(_)` (honoring `--vendor-source`); repair passes `None` — it
-    // rebuilds locally from the recorded patch.
+    // The patch.socket.dev vendoring-service config. `None` = build-only;
+    // `vendor` and `scan`/`get --mode vendored` pass `Some(_)` (honoring
+    // `--vendor-source`); repair passes `None` — it rebuilds locally from
+    // the recorded patch.
     service: Option<&VendorServiceConfig>,
     pipenv_version: &tokio::sync::OnceCell<Option<u32>>,
     installed_sites: &vendor::pypi::InstalledSiteListings,
 ) -> Option<VendorOutcome> {
     let eco = ecosystem_dir_for_purl(purl)?;
 
-    // Prebuilt service downloads now cover every vendorable ecosystem: npm,
-    // pypi, cargo, golang, composer, gem, nuget, and maven. Gem's `.gem`
-    // archive doesn't carry the eval-able stub gemspec a bundler path source
-    // wants, so the converter generates it and serves it as a
-    // `gem-stub-gemspec` second artifact alongside the `.gem` (the gem backend
-    // downloads + verifies both).
-    // Under fail-closed `service` mode, refuse any not-covered ecosystem with a
-    // clear message rather than silently building (which would violate the
-    // contract). Under `auto`/`build` they fall through to the local build.
+    // Ecosystems with prebuilt service downloads. Under fail-closed `service`
+    // mode any other ecosystem is refused rather than silently built; under
+    // `auto`/`build` it falls through to the local build.
     const SERVICE_ECOSYSTEMS: &[&str] = &[
         "npm", "pypi", "cargo", "golang", "composer", "gem", "nuget", "maven",
     ];
@@ -153,8 +148,7 @@ pub(crate) async fn dispatch_vendor_one(
             });
         }
     }
-    // Every backend takes the identical 9-argument tuple; the macro keeps
-    // the per-arm #[cfg] while collapsing the eight-way repetition.
+    // Every backend takes the identical 9-argument tuple.
     macro_rules! vend {
         ($backend:path) => {
             $backend(
@@ -258,17 +252,14 @@ pub(crate) async fn dispatch_revert_one_opts(
 
 /// Is this vendored entry still consumed by its project's lockfile
 /// dependency graph? `None` = cannot determine — callers must keep the
-/// entry (fail-safe): non-npm ecosystems have no in-use probe yet, and a
-/// missing/unreadable lockfile proves nothing.
+/// entry (fail-safe): ecosystems other than npm and cargo have no in-use
+/// probe yet, and a missing/unreadable lockfile proves nothing.
 async fn dispatch_in_use_one(entry: &VendorEntry, project_root: &Path) -> Option<bool> {
     match entry.ecosystem.as_str() {
         "npm" => vendor::npm_flavor::vendored_entry_in_use(entry, project_root).await,
         // Cargo probes the lock entry's shape: detached + `[patch]` pointing
         // at this entry's copy = in use; a registry source (crates.io
-        // re-resolve or a hosted takeover) or a missing entry = reclaimable
-        // (the revert restores / keeps the registry resolution and drops the
-        // dead wiring). Without this, a vendored entry displaced by a hosted
-        // takeover survives every `scan --prune` forever.
+        // re-resolve or a hosted takeover) or a missing entry = reclaimable.
         "cargo" => vendor::cargo::vendored_entry_in_use(entry, project_root).await,
         _ => None,
     }
@@ -366,12 +357,8 @@ pub(crate) fn ecosystem_in_scope(common: &GlobalArgs, eco: &str) -> bool {
 ///
 /// The event is therefore pushed DIRECTLY onto `events` rather than through
 /// [`Envelope::record`], so it stays visible to JSON consumers but does NOT
-/// bump `summary.skipped`. That counter must report packages that were
-/// genuinely skipped, not the number of advisory events — routing every
-/// warning through `record` made a single SUCCESSFUL service vendor report
-/// `applied:1 skipped:1`, let a 1-package project print "2 skipped", and
-/// counted "1 skipped" on a refresh that skipped nothing. `Skipped` never
-/// flips the run status, so pushing it directly loses no status signal.
+/// bump `summary.skipped`, which counts genuinely skipped packages.
+/// `Skipped` never flips the run status, so no status signal is lost.
 pub(crate) fn record_warning(
     env: &mut Envelope,
     purl: &str,
@@ -437,9 +424,6 @@ fn format_vendor_failure(purl: &str, detail: &str) -> String {
     format!("Error: Cannot vendor {}: {detail}", normalize_purl(purl))
 }
 
-/// Report one package that failed to vendor. An error, so it prints even
-/// under `--silent` ("errors only", never nothing); `--json` carries it
-/// in the envelope instead.
 /// The status line while one package's vendor engine call runs.
 fn format_vendor_progress(dry_run: bool, purl: &str, n: usize, total: usize) -> String {
     let verb = if dry_run { "Checking" } else { "Vendoring" };
@@ -450,6 +434,9 @@ fn format_vendor_progress(dry_run: bool, purl: &str, n: usize, total: usize) ->
     }
 }
 
+/// Report one package that failed to vendor. An error, so it prints even
+/// under `--silent` ("errors only", never nothing); `--json` carries it
+/// in the envelope instead.
 fn report_vendor_failure(common: &GlobalArgs, purl: &str, detail: &str) {
     if !common.json {
         eprintln!("{}", format_vendor_failure(purl, detail));
@@ -665,20 +652,14 @@ pub async fn run(args: VendorArgs) -> i32 {
     // `--revert` derives everything from state.json + the vendor tree; it
     // must work after the manifest was deleted. Plain vendor needs the
     // manifest and exits clean without one (same contract as apply). This
-    // is a MANIFEST check, not a `.socket/` check: it also fires on
-    // hosted-only projects and on every `scan`/`get --mode vendored`
-    // project (those never write a manifest — the vendor ledger owns their
-    // entries and `repair` is what verifies them), where `.socket/` exists.
-    // Nothing is locked or written on this path.
+    // is a MANIFEST check, not a `.socket/` check: `scan`/`get --mode
+    // vendored` projects have `.socket/` but never a manifest. Nothing is
+    // locked or written on this path.
     if !args.revert && tokio::fs::metadata(&manifest_path).await.is_err() {
-        // Nothing to vendor, but a requested `--vex` still attests what the
-        // `.socket/vendor` ledgers and lockfiles already wire (e.g. a
-        // `scan`/`get --mode vendored` checkout, which has no manifest by
-        // design). Same contract as `apply --vex` with no manifest: nothing
-        // referenced anywhere keeps the calm exit 0; any other VEX failure
-        // flips the exit; a dry run skips generation. The host line prints
-        // first: the VEX run's own stderr warnings follow what the command
-        // did.
+        // A requested `--vex` still attests what the `.socket/vendor`
+        // ledgers and lockfiles already wire. Same contract as `apply --vex`
+        // with no manifest: nothing referenced anywhere keeps exit 0; any
+        // other VEX failure flips the exit; a dry run skips generation.
         if !args.common.json && !args.common.silent {
             // An unreadable ledger is not "no entries": say so (stderr)
             // instead of the calm nothing-to-vendor line.
@@ -752,16 +733,10 @@ pub async fn run(args: VendorArgs) -> i32 {
         return i32::from(matches!(vex_result, Some(ManifestlessVex::Failed(_))));
     }
 
-    // The API client and the vendoring-service config exist for the
-    // vendoring arm alone — `--revert` never talks to the API (no service
-    // downloads, no telemetry) — so they are built after the no-manifest
-    // no-op and only when this run vendors. Built BEFORE the lock, like
-    // apply/rollback: the client's org-resolve round-trip must not run
-    // while other commands wait on `apply.lock`. `vendor_source` was
-    // validated by clap, so the parse cannot fail; fall back to the `auto`
-    // default defensively. The client moves into the config and is reused
-    // for the package-reference request (no second auth round-trip); the
-    // telemetry ids ride alongside for the post-run report.
+    // The API client and vendoring-service config exist for the vendoring
+    // arm alone (`--revert` never talks to the API). Built BEFORE the lock,
+    // like apply/rollback: the client's org-resolve round-trip must not run
+    // while other commands wait on `apply.lock`.
     let vendor_service = if args.revert {
         None
     } else {
@@ -778,14 +753,9 @@ pub async fn run(args: VendorArgs) -> i32 {
     // Same lock as apply/rollback: vendor mutates the same lockfiles and
     // `.socket/` tree, so a separate lock would allow an apply↔vendor race.
     //
-    // `--revert` skipped the manifest check above, so it is the one path
-    // that can reach here with no `.socket/` dir at all — the documented
-    // clean no-op ("a missing ledger is an empty ledger"). `acquire` would
-    // create `.socket/` for its lock file and the guard's drop would prune
-    // it again, but a no-op revert must never be the thing that creates a
-    // `.socket/` dir, even transiently: with no `.socket/` there is no
-    // ledger to read and nothing to write, hence nothing to serialize
-    // against. Skip the lock.
+    // `--revert` with no `.socket/` dir is a clean no-op ("a missing ledger
+    // is an empty ledger") and must never create `.socket/`, even
+    // transiently for the lock file — so skip the lock.
     let lock = if args.revert && tokio::fs::metadata(&socket_dir).await.is_err() {
         None
     } else {
@@ -811,10 +781,7 @@ pub async fn run(args: VendorArgs) -> i32 {
 
     // Embedded VEX: same contract as `apply --vex` — only on success, and a
     // requested-but-failed VEX flips the exit code. A dry run vendors
-    // nothing, so there is no vendored state to attest: generating here
-    // would verify the deliberately untouched tree, spuriously fail the
-    // whole command with `no_applicable_patches`, and write an attestation
-    // file during --dry-run. Skip instead.
+    // nothing, so there is nothing to attest: skip.
     if exit == 0 && !args.revert {
         if let Some(vex_path) = args.vex.vex.as_ref() {
             if args.common.dry_run {
@@ -857,18 +824,12 @@ pub async fn run(args: VendorArgs) -> i32 {
 
     note_classic_migration_risk(&mut env, &args.common.cwd, &args.common);
     // Same cross-mode takeover advisory the scan-driven vendored flow emits:
-    // the standalone `vendor` command is the PRIMARY hosted→vendored
-    // migration entry point, so it must surface a redirect ledger that this
-    // run (or an earlier one) superseded — silence here left the stale
-    // ledger feeding VEX indefinitely.
+    // surface a redirect ledger that this run (or an earlier one) superseded.
     super::scan::note_vendor_supersedes_redirect(&mut env, &args.common.cwd, &args.common).await;
 
     // That advisory may persist the redirect ledger, so it ran under the
-    // lock; everything below is output and telemetry — nothing touches
-    // `.socket/` or the lockfiles — so release the lock first (the drop also
-    // unlinks `apply.lock` and prunes an emptied `.socket/`) rather than
-    // holding it across a network round-trip while competitors see
-    // `lock_held`.
+    // lock; everything below is output and telemetry, so release the lock
+    // before the telemetry round-trip.
     drop(lock);
 
     if args.common.json {
@@ -889,11 +850,6 @@ pub async fn run(args: VendorArgs) -> i32 {
     exit
 }
 
-/// The human no-op line for a plain `vendor` with no manifest. Names the
-/// MANIFEST (the thing actually missing), and — when the vendor ledger
-/// tracks entries, i.e. a `scan`/`get --mode vendored` project — says so
-/// instead of implying nothing is vendored: their refresh path is `scan
-/// --mode vendored`, and `repair` is what re-verifies the ledger.
 /// The no-manifest warning when the vendor ledger cannot be read either.
 fn no_manifest_ledger_unreadable(err: &str) -> String {
     format!(
@@ -902,6 +858,11 @@ fn no_manifest_ledger_unreadable(err: &str) -> String {
     )
 }
 
+/// The human no-op line for a plain `vendor` with no manifest. Names the
+/// MANIFEST (the thing actually missing), and — when the vendor ledger
+/// tracks entries, i.e. a `scan`/`get --mode vendored` project — says so
+/// instead of implying nothing is vendored: their refresh path is `scan
+/// --mode vendored`, and `repair` is what re-verifies the ledger.
 fn no_manifest_message(tracked_entries: usize) -> String {
     match tracked_entries {
         0 => "No manifest found, nothing to vendor.".to_string(),
@@ -916,7 +877,7 @@ fn no_manifest_message(tracked_entries: usize) -> String {
 }
 
 /// Telemetry for a vendor run's success/failure split, shared by
-/// [`run`] and the scan-driven vendor step (`scan --vendor`).
+/// [`run`] and the scan-driven vendor step (`scan --mode vendored`).
 pub(crate) async fn track_outcomes_for_vendor(
     has_errors: bool,
     env: &Envelope,
@@ -953,8 +914,7 @@ async fn run_vendor(
     // Reconcile first (mirrors apply's placement): entries vendored by a
     // previous run whose patches were dropped from the manifest are reverted
     // even when zero in-scope patches remain. Its post-reconcile ledger
-    // feeds the staging harvest below and then the engine (one load, not
-    // three).
+    // feeds the staging harvest below and then the engine.
     let (mut has_errors, ledger) = reconcile_dropped(&manifest, common, env).await;
 
     let socket_dir = crate::args::socket_dir_of(manifest_path, &common.cwd);
@@ -1007,12 +967,9 @@ async fn run_vendor(
 
     if has_errors {
         // A run where EVERY event failed still reads as "partialFailure":
-        // the envelope has no "completed with zero successes" status, and
-        // status=error is reserved for pre-event failures (it implies a
-        // top-level error payload and empty events[] — see json_envelope.rs).
-        // Escalating here without an envelope-level API broke that contract,
-        // and scan --vendor / vendor --revert report the same outcome as
-        // partialFailure, so this stays aligned with them.
+        // status=error is reserved for pre-event failures (a top-level error
+        // payload and empty events[] — see json_envelope.rs), matching
+        // `scan --mode vendored` and `vendor --revert`.
         env.mark_partial_failure();
         1
     } else {
@@ -1039,7 +996,7 @@ pub(crate) async fn persist_vendor_entry(
     let (has_errors, stale) =
         record_vendor_entry(common, env, &mut shared, candidate, entry, detached, record).await;
     // A group commit keeps its own reference to the ledger it captured, so
-    // this copies — once per save, as the by-value save always did.
+    // this may copy once per save.
     *state = std::sync::Arc::try_unwrap(shared).unwrap_or_else(|held| (*held).clone());
     if let Some(stale) = stale {
         sweep_stale_artifact(common, env, state, stale).await;
@@ -1071,25 +1028,17 @@ async fn record_vendor_entry(
 ) -> (bool, Option<StaleArtifact>) {
     let candidate = candidate.to_string();
     entry.detached = detached;
-    // EVERY entry embeds its patch record, not only detached (vendored-mode)
-    // ones: the ledger is committed next to the artifacts, so a checkout of
-    // a project the manifest-driven standalone `vendor` wired, whose
-    // manifest is gone or was never committed, can still verify and attest
-    // the vendored patch offline — manifest-less `vex` reads it. `detached`
-    // stays the "no manifest owner" flag: for a non-detached entry the
-    // manifest record remains authoritative wherever both exist (repair,
-    // vex), and the embedded copy is the fallback.
+    // EVERY entry embeds its patch record, not only detached ones, so a
+    // checkout whose manifest is gone or was never committed can still
+    // verify and attest the vendored patch offline. For a non-detached
+    // entry the manifest record stays authoritative wherever both exist;
+    // the embedded copy is the fallback.
     entry.record = Some(record.clone());
-    // A re-vendor run re-derives the entry from current disk state, where
-    // the takeover / earlier wiring already happened. Reconcile the fresh
-    // entry with the one it replaces so `--revert` still knows how to undo
-    // every surface any earlier vendoring touched: carry forward the true
-    // pre-vendor originals (a re-vendor records `original: None` for its own
-    // stale `.socket/vendor/` pointer), the wiring records for surfaces this
-    // run left in sync (e.g. package.json + pnpm-lock.yaml when only the new
-    // pnpm-workspace.yaml override was added on a pnpm >= 11 upgrade), the
-    // pnpm created-surface bookkeeping, the cargo lock originals, and the
-    // takeover flag. See [`vendor::carry_forward_wiring`].
+    // A re-vendor re-derives the entry from disk state where the earlier
+    // wiring already happened, so carry forward the true pre-vendor
+    // originals and wiring records from the entry it replaces — `--revert`
+    // must still undo every surface any earlier vendoring touched. See
+    // [`vendor::carry_forward_wiring`].
     let prev = state.entries.get(&candidate).cloned();
     if let Some(prev) = &prev {
         vendor::carry_forward_wiring(prev, &mut entry);
@@ -1097,9 +1046,7 @@ async fn record_vendor_entry(
     let new_uuid = entry.uuid.clone();
     // Persist per-package so a crash mid-run leaves a ledger that matches
     // what's already wired (under a group commit this lands in the run's
-    // captured state, committed with the wiring it describes — the group
-    // holds this very ledger, so the insert is made in place rather than
-    // on a per-package copy of the whole ledger).
+    // captured state, committed with the wiring it describes).
     let key = candidate.clone();
     if let Err(e) = save_state_shared(&common.cwd, state, move |s| {
         s.entries.insert(key, entry);
@@ -1223,12 +1170,8 @@ pub(crate) async fn fetch_pristine_package(
 /// download: the lock's own entry when it carries an integrity, else the
 /// pre-vendor resolution the ledger recovers. A cargo crate from a git,
 /// path or custom-registry source has neither, so its fetch refuses
-/// `vendor_fetch_unverifiable` and the purl is not vendored; deferring that
-/// fetch behind the patch service would instead vendor the crates.io patch
-/// over it. A purl with neither is also one the ladder has no source for
-/// at all (`package_not_installed` when nothing is installed), which is
-/// why the early lock-text refusals ([`lock_refusals_reaching_backend`])
-/// stay off it.
+/// `vendor_fetch_unverifiable`; deferring that fetch behind the patch
+/// service would instead vendor the crates.io patch over it.
 pub(crate) async fn pristine_fetch_is_verifiable(
     project_root: &Path,
     inventory: &[lock_inventory::LockfileEntry],
@@ -1387,10 +1330,10 @@ impl MissingRung {
 /// the ledger (a vlt directory artifact against its file inventory) —
 /// offline-safe, no registry traffic — and `--offline` stops before the
 /// registry. Only at the record's own uuid: an older patch's artifact holds
-/// that patch's bytes, never a pristine source for a superseding one. Also returns the committed artifact's path when it
-/// is missing (the caller's `vendor_artifact_missing` warning; the purl
-/// then falls through to the registry ladder, which recovers the
-/// pre-vendor resolution from the ledger and rebuilds).
+/// that patch's bytes, never a pristine source for a superseding one. Also
+/// returns the committed artifact's path when it is missing (the caller's
+/// `vendor_artifact_missing` warning; the purl then falls through to the
+/// registry ladder).
 async fn missing_local_rung(
     common: &GlobalArgs,
     ledger_entry: Option<&VendorEntry>,
@@ -1443,10 +1386,7 @@ async fn missing_local_rung(
 /// which is what lets its download be deferred. Some in-sync checks look
 /// only for the artifact's presence (pypi's), so a file artifact that no
 /// longer hashes to its ledger pin is not covered: it keeps the eager
-/// ladder, and a run that cannot reach the registry says so as it always
-/// did. A copy DIR's integrity stays the backend's own question — a
-/// drifted one is rebuilt, and a rebuild that needs the pristine tree
-/// fetches it then.
+/// ladder. A copy DIR's integrity stays the backend's own question.
 async fn ledger_covers(cwd: &Path, entry: Option<&VendorEntry>, record: &PatchRecord) -> bool {
     match entry {
         Some(entry) if entry.uuid == record.uuid => entry.committed_artifact_intact(cwd).await,
@@ -1734,7 +1674,8 @@ pub(crate) async fn vendor_records(
     force: bool,
     env: &mut Envelope,
     // Vendoring-service config (`None` = build-only). Both the `vendor`
-    // command and `scan --vendor` pass `Some(_)`, honoring `--vendor-source`.
+    // command and `scan --mode vendored` pass `Some(_)`, honoring
+    // `--vendor-source`.
     service: Option<&VendorServiceConfig>,
     ledger: std::io::Result<VendorState>,
 ) -> bool {
@@ -1749,7 +1690,7 @@ pub(crate) async fn vendor_records(
 /// nothing has touched since (`scan`'s own crawl) — instead of walking
 /// `node_modules` again: its roots feed the targeted lookup and its
 /// packages the alias identity fallback. `None` (or a snapshot taken with
-/// other options) crawls as before.
+/// other options) crawls afresh.
 #[allow(clippy::too_many_arguments)]
 pub(crate) async fn vendor_records_reusing(
     common: &GlobalArgs,
@@ -1809,14 +1750,10 @@ pub(crate) async fn vendor_records_reusing(
         })
         .collect();
 
-    // The vendor ledger, loaded ONCE per run by the caller (under its lock,
-    // for its staging harvest) and handed over here: the artifact-staging
-    // path below, the Bun preflight and every per-package persist read or
-    // mutate this copy. An unreadable ledger is the hard error it is —
-    // failing here, before the crawler walk and any registry traffic, is
-    // what keeps a corrupt state.json from running the whole fetch ladder
-    // first (and pushing its warnings into the envelope) only to fail the
-    // run afterwards.
+    // The vendor ledger, loaded ONCE per run by the caller (under its lock)
+    // and handed over here; every read and per-package persist below uses
+    // this copy. An unreadable ledger fails here, before the crawler walk
+    // and any registry traffic.
     let mut state = match ledger {
         Ok(s) => std::sync::Arc::new(s),
         Err(e) => {
@@ -1837,14 +1774,10 @@ pub(crate) async fn vendor_records_reusing(
     // Resolve installed packages with the qualified-purl-aware resolver, never
     // a base-keyed one: the manifest keys release-variant ecosystems (gem
     // `?platform=`, pypi `?artifact_id=`, maven `?classifier=&ext=`) by
-    // *qualified* purls, but the crawler only knows the *base* purl. A
-    // base-keyed result map would make the `missing`/`contains_key` check
-    // below miss every installed
-    // qualified-purl package and falsely classify it "not installed" —
-    // triggering a spurious `vendor_fetched_missing`, a redundant per-run
-    // registry download, and (for gem) a HashMap-order platform coin-flip.
-    // The rollback variant fans each base path back out to every qualified
-    // manifest purl (same invariant as `find_manifest_package_paths`).
+    // *qualified* purls, but the crawler only knows the *base* purl, so a
+    // base-keyed map would misclassify every installed qualified purl as
+    // "not installed". The rollback variant fans each base path back out to
+    // every qualified manifest purl.
     let mut all_packages: HashMap<String, StagedSource> = find_packages_for_rollback_reusing(
         &vendorable_partition,
         &crawler_options,
@@ -1913,13 +1846,11 @@ pub(crate) async fn vendor_records_reusing(
             let client = registry_fetch::build_registry_client();
             // Two passes over `missing`, so the registry fetches can run
             // concurrently while every event, warning and stderr line still
-            // lands in `missing` order, exactly as the one-purl-at-a-time
-            // loop emitted them. Pass 1 decides each purl's local rungs (the
-            // committed-artifact staging and the offline stop: local and
-            // read-only, so deciding them early changes nothing) without
-            // emitting anything; the purls left for the registry are then
-            // fetched at most `registry_concurrency` at a time, in order, and
-            // pass 2 emits every purl's outcome in turn.
+            // lands in `missing` order. Pass 1 decides each purl's local
+            // rungs (local and read-only) without emitting anything; the
+            // purls left for the registry are then fetched at most
+            // `registry_concurrency` at a time, in order, and pass 2 emits
+            // every purl's outcome in turn.
             let mut rungs: Vec<(Option<String>, MissingRung)> = {
                 let mut rungs = Vec::with_capacity(missing.len());
                 for purl in &missing {
@@ -1937,20 +1868,17 @@ pub(crate) async fn vendor_records_reusing(
             // Downloads nothing may need, deferred to the backend branch
             // that reads the pristine tree (see `DeferredPackage`):
             //
-            //  * a purl the ledger already covers — its entry records this
-            //    record's patch uuid and the committed artifact is on disk —
-            //    is what the backend's in-sync hot path answers from those
-            //    committed bytes alone, so a re-run makes no registry request
-            //    (and succeeds with no network at all). `--force` may
+            //  * a purl the ledger already covers (see `ledger_covers`): the
+            //    backend's in-sync hot path answers it from the committed
+            //    bytes alone, so a re-run needs no network. `--force` may
             //    rebuild anyway, so it keeps the eager fetch.
             //  * a cargo crate the patch service can serve: the backend reads
-            //    the pristine tree only once `cargo_service_copy` falls back
-            //    to the local build. Only a crate the registry ladder COULD
-            //    fetch (see `pristine_fetch_is_verifiable`) — a git, path or
+            //    the pristine tree only if it falls back to the local build.
+            //    Only a crate the registry ladder COULD fetch (see
+            //    `pristine_fetch_is_verifiable`) — a git, path or
             //    custom-registry crate keeps the eager rung, whose
-            //    `vendor_fetch_unverifiable` refusal is what keeps a
-            //    crates.io patch off a crate that does not come from
-            //    crates.io.
+            //    `vendor_fetch_unverifiable` refusal keeps a crates.io patch
+            //    off it.
             //
             // A backend that does reach its pristine tree fetches it then,
             // through the same ladder, and the loop reports the fetch as the
@@ -2045,32 +1973,19 @@ pub(crate) async fn vendor_records_reusing(
                 }
             }
             // A NOT-INSTALLED gem can only be vendored through the patch
-            // service. The bundler path source the gem backend wires needs
-            // the eval-able stub gemspec rubygems writes into
-            // `<gem home>/specifications/` at INSTALL time; a fetched `.gem`
-            // carries its gemspec only as YAML in `metadata.gz`, which is
-            // exactly why the service serves a converted `gem-stub-gemspec`
-            // second artifact. With the service off (`--vendor-source build`,
-            // or no config at all) the fetched copy is unusable, so the
-            // backend refused `gem_spec_missing` — AFTER paying for the
-            // download, on every run. Refuse before the download instead,
-            // with the same code and a detail that names the real remedy.
-            // The backend keeps its own refusal as the backstop for every
-            // other route into it.
+            // service: the bundler path source needs the eval-able stub
+            // gemspec rubygems writes at INSTALL time, which a fetched `.gem`
+            // lacks (the service serves a converted `gem-stub-gemspec`).
+            // With the service off, refuse `gem_spec_missing` before the
+            // download rather than after it; the backend keeps its own
+            // refusal as the backstop.
             //
             // Scoped to the purls a DOWNLOAD would actually happen for,
-            // mirroring `fetch_pristine_package`'s own `fetchable` filter: a
-            // gem the lock cannot VERIFY (no `CHECKSUMS` section) is never
-            // fetched and keeps its `vendor_fetch_unverifiable` warning plus
-            // the calm `package_not_installed` skip; a gem the ledger already
-            // holds is the already-vendored fresh-clone case the backend's
-            // hot path confirms without a stub gemspec; a gem that resolves
-            // from nowhere keeps the calm skip. Refusing first also means a
-            // refusal the backend would have reached earlier on the fetched
-            // copy (an uneditable Gemfile declaration, say) now reports as
-            // `gem_spec_missing` instead; either way the package fails.
-            // A dry run never refused: the backend's verify-only preview
-            // runs on the fetched copy, so it keeps the eager fetch.
+            // mirroring `fetch_pristine_package`'s `fetchable` filter: a gem
+            // the lock cannot VERIFY, one the ledger already holds, or one
+            // that resolves from nowhere keeps its existing outcome. A dry
+            // run keeps the eager fetch: its verify-only preview runs on the
+            // fetched copy.
             if !service_enabled
                 && !common.dry_run
                 && missing
@@ -2092,8 +2007,7 @@ pub(crate) async fn vendor_records_reusing(
                     }
                 }
             }
-            // Parsed only when some purl reaches the registry rung (the
-            // serial loop's lazy first use).
+            // Parsed only when some purl reaches the registry rung.
             let inv: &[lock_inventory::LockfileEntry] =
                 if rungs.iter().any(|(_, r)| r.needs_registry()) {
                     inventory
@@ -2247,24 +2161,12 @@ pub(crate) async fn vendor_records_reusing(
     let vendored_at = now_rfc3339();
 
     // Bun vendored preflight (see `crate::commands::bun_preflight`), run
-    // ONCE per run over the in-scope npm records and consulted per
-    // candidate in the dispatch loop BEFORE the hosted→vendored takeover.
-    // The bun engine refuses a pre-v2 text `workspace:` lock (and a malformed /
-    // unreadable / unsupported-version project) before its own writes —
-    // but the takeover below reverts a hosted purl's lockfile edits and
-    // persists the redirect-ledger drop FIRST, so without this gate a
-    // `vendor` over a hosted-wired v1 workspace lock stripped the live
-    // hosted redirect, then failed `vendor_bun_workspace_unsupported`:
-    // unpatched in both modes, with the refusal telling the user to use
-    // the hosted mode it had just destroyed. `scan`/`get --mode vendored`
-    // already run this preflight at download time; here it is the ONLY
-    // gate the plain `vendor` command has, and its dry-run arm previews the
-    // same refusal instead of the takeover advisory. A purl the vendor
-    // ledger wires at the record's uuid, or whose lock instances are all
-    // already ours, is exempt (the engine handles in-sync re-runs and
-    // superseding-uuid re-vendors itself) — the ledger loaded above is the
-    // one it consults. Pairs are the in-scope vendorable records, so an
-    // `--ecosystems` filter that excludes npm never reads the lock.
+    // ONCE per run over the in-scope records and consulted per candidate
+    // BEFORE the hosted→vendored takeover: the takeover reverts a hosted
+    // purl's lockfile edits first, so a bun refusal the engine would raise
+    // afterwards (pre-v2 text `workspace:` lock, unsupported project) must
+    // be raised before it, or the purl ends up unpatched in both modes.
+    // A purl the ledger wires at the record's uuid is exempt.
     let bun_pairs: Vec<(&str, &str)> = vendorable
         .iter()
         .filter_map(|p| records.get(p).map(|r| (p.as_str(), r.uuid.as_str())))
@@ -2294,14 +2196,11 @@ pub(crate) async fn vendor_records_reusing(
     let mut handled_bases: HashSet<String> = HashSet::new();
 
     // The hosted redirect ledger, for cross-mode takeovers: vendoring a purl
-    // it still claims must revert the hosted edits FIRST (see the hook in the
-    // dispatch loop below). Loaded once; mutated + persisted per reverted
-    // purl. A MALFORMED ledger is held as the hard error it is: this loop
-    // WRITES the ledger for takeovers, and with its records unreadable a
-    // claimed purl is indistinguishable from an unclaimed one — so every
-    // purl of a takeover-capable ecosystem (cargo, npm) fails closed with
-    // the corruption surfaced (other purls never touch the redirect ledger
-    // here and proceed).
+    // it still claims must revert the hosted edits FIRST (see the dispatch
+    // loop below). Loaded once; mutated + persisted per reverted purl. With
+    // a MALFORMED ledger a claimed purl is indistinguishable from an
+    // unclaimed one, so every takeover-capable purl fails closed; other
+    // purls proceed.
     let (mut redirect_ledger, redirect_ledger_corrupt) =
         match socket_patch_core::patch::redirect::load_redirect_state(&common.cwd).await {
             Ok(state) => (state, None),
@@ -2313,14 +2212,13 @@ pub(crate) async fn vendor_records_reusing(
     // backend's project-level refusals (mixed line endings in yarn.lock or
     // package.json, cacheKey, `.yarnrc.yml` compressionLevel), computed at
     // most once per run and only when a hosted-claimed npm purl reaches the
-    // takeover below — which must refuse such a purl BEFORE reverting its
-    // hosted edits: a hosted revert keeps a mixed lock mixed, so the backend
-    // then refused it with the redirect already gone.
+    // takeover below, which must refuse such a purl BEFORE reverting its
+    // hosted edits.
     let berry_takeover_refusal: tokio::sync::OnceCell<Option<(&'static str, String)>> =
         tokio::sync::OnceCell::new();
     let pipenv_version = tokio::sync::OnceCell::new();
     // The vlt store entries each hosted→vendored takeover unpinned, healed
-    // once the purl is vendored (DESIGN §4.10).
+    // once the purl is vendored.
     let mut vlt_takeover_targets: HashMap<
         String,
         Vec<socket_patch_core::patch::redirect::vlt_heal::LedgerTarget>,
@@ -2328,8 +2226,6 @@ pub(crate) async fn vendor_records_reusing(
     let installed_sites = vendor::pypi::InstalledSiteListings::default();
     let mut dry_in_sync: u32 = 0;
     // Sorted, so per-package lines print in the same order every run.
-    // Purls are unique keys, so ordering on the purl alone is the order the
-    // `(purl, path)` sort produced.
     let mut all_packages: Vec<(String, StagedSource)> = all_packages.into_iter().collect();
     all_packages.sort_by(|a, b| a.0.cmp(&b.0));
     // Progress over the per-package engine calls (download, pack, lockfile
@@ -2338,20 +2234,12 @@ pub(crate) async fn vendor_records_reusing(
     let mut status = StatusLine::stderr(common.json, common.silent);
     let total = all_packages.len();
     // Service downloads, fetched ahead of this serial loop (the wiring and
-    // every write stay here, in order). The plan is EXACT — the records the
-    // loop will ask the service for, in loop order, across every ecosystem:
-    // past the variant probe, the Bun refusal and the takeover gate below,
-    // and past every refusal the backend raises before its first service
-    // call (evaluated here with the backend's own gates — npm's
-    // `preflight_packages`, the others' `service_preflight`), and not
-    // answered by a backend's in-sync hot path or a committed-artifact
-    // reuse (those never ask the service). A download grant can start a
-    // server-side build and counts against quota, so a package the loop
-    // refuses is never granted on its behalf. The plan stays advisory —
-    // the breaker and every outcome are still decided at the loop's own
-    // call (see `VendorPrefetch`). Asking `wants_prefetch` first keeps the
-    // walk off the runs that would drop the plan anyway (`--vendor-source
-    // build`, `--offline`, one request at a time).
+    // every write stay here, in order). The plan is EXACT — only the
+    // records the loop will ask the service for (see
+    // `plan_service_downloads`): a download grant can start a server-side
+    // build and counts against quota, so a package the loop refuses is
+    // never granted on its behalf. The plan stays advisory — every outcome
+    // is still decided at the loop's own call (see `VendorPrefetch`).
     let service_prefetch = match service.filter(|cfg| !common.dry_run && cfg.wants_prefetch()) {
         Some(cfg) => {
             let takeover_blocked = |purl: &str| {
@@ -2434,13 +2322,9 @@ pub(crate) async fn vendor_records_reusing(
             // Variant probe: only the installed distribution's variant is
             // vendored (mirrors apply / select_installed_variants). It hashes a
             // representative patch-target file against the installed package
-            // dir, so it only works when those files are EXTRACTED on disk
-            // (pypi wheels / gem gems). Maven is a release-variant ecosystem
-            // too, but its patch targets live INSIDE the un-extracted
-            // `<a>-<v>.jar` — the version dir holds only the jar/pom, so the
-            // probe would always read NotFound and drop the package. Maven
-            // vendor takes the single main jar regardless (no on-disk variant
-            // to select), so the probe is inapplicable and is skipped for it.
+            // dir, so it only works when those files are EXTRACTED on disk.
+            // Maven's patch targets live INSIDE the un-extracted jar and its
+            // vendor takes the single main jar regardless, so it is skipped.
             let probe_applicable = is_variant_eco
                 && !matches!(Ecosystem::from_purl(candidate), Some(Ecosystem::Maven));
             // A deferred source was deferred because the ledger covers the
@@ -2474,15 +2358,9 @@ pub(crate) async fn vendor_records_reusing(
                             break;
                         }
                         // Not a variant verdict: the tree could not be
-                        // WRITTEN at all — a full or unwritable `$TMPDIR`,
-                        // no file descriptors. The eager fetch hit that
-                        // while fetching and reported it; reading it as a
-                        // variant that does not match would file the purl
-                        // under `package_not_installed` ("no installed
-                        // package found on disk") and lose the cause.
-                        // One failure for the SOURCE, keyed on the purl the
-                        // fetch was issued for — the eager fetch raised it
-                        // once, before the variants were ever fanned out.
+                        // WRITTEN at all (full `$TMPDIR`, no fds). Report one
+                        // failure for the SOURCE purl rather than filing it
+                        // under `package_not_installed` and losing the cause.
                         Err(detail) => {
                             env.record(
                                 PatchEvent::new(PatchAction::Failed, purl.clone())
@@ -2502,13 +2380,9 @@ pub(crate) async fn vendor_records_reusing(
             }
             matched.insert(candidate.clone());
 
-            // The Bun preflight verdict (computed once above): the engine
-            // would refuse this project for this purl, so refuse HERE — the
-            // same `failed` event, code and detail the engine would have
-            // produced, in the dry run and the wet run alike — before the
-            // takeover block below can revert a live hosted redirect on its
-            // behalf. Hosted wiring, redirect ledger and lockfile stay
-            // byte-untouched for a refused purl.
+            // The Bun/vlt preflight verdicts (computed once above): refuse
+            // HERE, with the engine's own code and detail, before the
+            // takeover block below can revert a live hosted redirect.
             if let Some(refusal) = bun_refusal.as_ref().filter(|r| r.applies_to(candidate)) {
                 has_errors = true;
                 env.record(
@@ -2531,23 +2405,14 @@ pub(crate) async fn vendor_records_reusing(
             // Cross-mode takeover: vendoring over a LIVE hosted redirect
             // must first revert the hosted edits from the redirect ledger.
             // Cargo: `[patch.crates-io]` only patches crates-io-sourced
-            // deps, so vendoring on top of the `registry = "socket-patch-…"`
-            // pin leaves the project unbuildable in BOTH modes while this
-            // run reports success. npm family: the vendor rewire happens to
-            // succeed either way, but without the pre-revert the vendor
-            // ledger records the grant-tokenized HOSTED lock fragment as its
-            // unrecoverable pre-vendor original (so `vendor --revert` lands
-            // back on an expiring hosted URL with no CLI path to registry
-            // state) and the superseded redirect records/edits survive
-            // forever as a stale-ledger replay hazard. In every ecosystem
-            // the pre-revert hands the vendor detach the PRISTINE registry
-            // lock fragment to record as the ledger's originals. A purl
-            // whose hosted edits cannot be cleanly reverted is REFUSED; the
-            // cargo backend's own fail-closed guard (`hosted_redirect_live`)
-            // backstops states with no usable ledger at all. A purl whose
-            // bun project the vendor engine would refuse outright never
-            // reaches this block (the Bun preflight `continue`d above), so
-            // a refusal can no longer land AFTER the revert was persisted.
+            // deps, so vendoring on top of the hosted registry pin leaves the
+            // project unbuildable. npm family: without the pre-revert the
+            // vendor ledger records the grant-tokenized HOSTED lock fragment
+            // as its pre-vendor original. In every ecosystem the pre-revert
+            // hands the vendor detach the PRISTINE registry fragment to
+            // record. A purl whose hosted edits cannot be cleanly reverted is
+            // REFUSED; the cargo backend's `hosted_redirect_live` guard
+            // backstops states with no usable ledger.
             if socket_patch_core::patch::redirect::redirect_revert_supported(candidate) {
                 if let Some(corrupt) = &redirect_ledger_corrupt {
                     has_errors = true;
@@ -2589,13 +2454,9 @@ pub(crate) async fn vendor_records_reusing(
                     }
                 }
                 if claimed && common.dry_run {
-                    // Probe the takeover exactly as the wet run would — the
-                    // per-purl revert's dry run resolves every inverse and
-                    // drift check, flushes nothing, and mutates only this
-                    // throwaway clone — so the preview never promises a
-                    // takeover the wet run then refuses (a drifted lock, a
-                    // corrupt edit): those surface here with the SAME
-                    // `redirect_revert_failed` code and detail.
+                    // Probe the takeover exactly as the wet run would (a dry
+                    // revert on a throwaway clone), so the preview never
+                    // promises a takeover the wet run then refuses.
                     let mut probe = redirect_ledger.clone().expect("claimed implies Some");
                     match socket_patch_core::patch::redirect::revert_redirect_purl(
                         &common.cwd,
@@ -2621,22 +2482,12 @@ pub(crate) async fn vendor_records_reusing(
                                 common,
                             );
                             // The backend preview below reads the lock from
-                            // disk, where the hosted wiring is still live. A
-                            // flavor whose hosted rewrite keeps the entry's
-                            // `name@version` identity (yarn, pnpm, package-lock)
-                            // previews fine over it; bun's hosted rewrite
-                            // REPLACES that spec, so the backend would refuse a
-                            // `vendor_lock_entry_not_found` the wet run never
-                            // sees. When the revert would rewrite a lock this
-                            // backend reads, the advisory already states the
-                            // whole plan (revert, then vendor) and the preview
-                            // stops here — the hosted dry run makes the same
-                            // choice after `redirect_would_revert_vendored`.
-                            // The project-level refusals the engine WOULD
-                            // raise after the revert (workspace gate, lock
-                            // version) were already previewed by the Bun
-                            // preflight above, so stopping here promises
-                            // nothing the wet run then refuses.
+                            // disk, where the hosted wiring is still live.
+                            // Bun's hosted rewrite REPLACES the entry's
+                            // `name@version` spec, so the backend would refuse
+                            // a `vendor_lock_entry_not_found` the wet run never
+                            // sees: the advisory already states the plan, so
+                            // the preview stops here.
                             if revert
                                 .reverted_files
                                 .iter()
@@ -2961,7 +2812,7 @@ pub(crate) async fn vendor_records_reusing(
             }
             // The reverted hosted pin is gone either way: a vendored purl
             // is healed against its new wiring, a failed one against the
-            // restored registry pin (DESIGN §4.10 step 4).
+            // restored registry pin.
             if let Some(targets) = vlt_takeover_targets.remove(candidate) {
                 let detail = if vendored {
                     crate::commands::scan::vlt_takeover_heal(common, &targets).await
@@ -3184,7 +3035,7 @@ pub(crate) async fn vendor_records_reusing(
     has_errors
 }
 
-/// The committable-files hint of a vlt-wired run (DESIGN §4.9).
+/// The committable-files hint of a vlt-wired run.
 const VLT_COMMIT_HINT: &str = "Commit package.json (and workspace package.json files), \
      vlt-lock.json and .socket/vendor/ (the .gitignore there re-includes the payload and keeps \
      vlt's node_modules links out of git); CI: `vlt ci`.";
@@ -3192,9 +3043,9 @@ const VLT_COMMIT_HINT: &str = "Commit package.json (and workspace package.json f
 /// The install command that re-materializes the project tree from the wired
 /// lockfile, per npm-family flavor. Vendoring edits ONLY the lockfile/config
 /// wiring — the already-installed node_modules keeps its pre-vendor bytes
-/// until the package manager reinstalls from the rewired lock (verified
-/// against real pnpm installs) — so a successful vendor must say how to
-/// update it. `None` for flavors whose consuming step is not an install.
+/// until the package manager reinstalls from the rewired lock — so a
+/// successful vendor must say how to update it. `None` for flavors whose
+/// consuming step is not an install.
 fn flavor_install_command(flavor: &str) -> Option<&'static str> {
     match flavor {
         "package-lock" => Some("npm install"),
@@ -3263,8 +3114,8 @@ fn drop_vendored_installs_by<V>(
 /// deleting its artifact) as a cross-ecosystem side effect. Detached
 /// entries — every `scan`/`get --mode vendored` entry — are never
 /// manifest-tracked, so "absent from the manifest" is their normal state,
-/// not a drop — only `vendor --revert`, `remove`, or the lockfile-driven
-/// half of [`run_vendor_gc`] may undo them.
+/// not a drop — only `vendor --revert`, `remove`, `rollback` (its vendored
+/// leg), or the lockfile-driven half of [`run_vendor_gc`] may undo them.
 fn manifest_dropped_purls(
     state: &VendorState,
     manifest: &PatchManifest,
@@ -3306,10 +3157,10 @@ pub(crate) async fn reconcile_dropped(
         }
         if outcome.success {
             if outcome.kept_artifact {
-                // Drift-skip keep (residual #131): the backend left the
-                // drifted lock alone and kept the artifacts, so the ledger
-                // entry must survive too — and the genuine outcome is a
-                // COUNTED skip, not a removal.
+                // Drift-skip keep: the backend left the drifted lock alone
+                // and kept the artifacts, so the ledger entry must survive
+                // too — and the genuine outcome is a COUNTED skip, not a
+                // removal.
                 env.record(
                     PatchEvent::new(PatchAction::Skipped, purl.clone()).with_reason(
                         "vendor_revert_kept",
@@ -3329,10 +3180,8 @@ pub(crate) async fn reconcile_dropped(
             if !common.dry_run {
                 state.entries.remove(&purl);
                 // Per-purl save, exactly like `--revert`: crash-consistent
-                // with the wiring just restored, no write at all on the
-                // (normal) run that reverted nothing, and a failed write is
-                // the failure it is — the reverted purl would otherwise
-                // linger in the ledger with exit 0 and no event.
+                // with the wiring just restored, and a failed write fails
+                // the purl rather than leaving it in the ledger silently.
                 if let Err(e) = save_state(&common.cwd, &state).await {
                     had_error = true;
                     env.record(
@@ -3400,12 +3249,11 @@ async fn run_revert(args: &VendorArgs, env: &mut Envelope) -> i32 {
                         .with_error("revert_failed", why),
                 );
             }
-            // Drift-skip keep (residual #131): the backend left the
-            // drifted lock alone and kept the artifacts, so the ledger
-            // entry must survive too — and the genuine outcome is a
-            // COUNTED skip, not a removal. (`record_warning` above
-            // already surfaced the per-record details as uncounted
-            // advisory events.)
+            // Drift-skip keep: the backend left the drifted lock alone and
+            // kept the artifacts, so the ledger entry must survive too — and
+            // the genuine outcome is a COUNTED skip, not a removal.
+            // (`record_warning` above already surfaced the per-record
+            // details as uncounted advisory events.)
             VendorRevertStep::Kept => env.record(
                 PatchEvent::new(PatchAction::Skipped, purl.clone()).with_reason(
                     "vendor_revert_kept",
@@ -3546,11 +3394,9 @@ pub(crate) struct VendorGcSummary {
 /// A drift-skipped revert ([`RevertOutcome::kept_artifact`]) keeps the
 /// ledger entry — and, in (b), the purl's manifest records — exactly like
 /// every other `dispatch_revert_one` caller; the kept purl is reported in
-/// [`VendorGcSummary::kept`] so `scan --prune` can explain the entry it
-/// did not reclaim instead of silently no-oping on what its own preview
-/// listed as revertable. Wet-only: a dry [`dispatch_revert_one`] returns
-/// before the wiring replay that detects drift, so the dry lists still
-/// carry such an entry as revertable.
+/// [`VendorGcSummary::kept`] so `scan --prune` can explain it. Wet-only: a
+/// dry [`dispatch_revert_one`] returns before the wiring replay that
+/// detects drift.
 ///
 /// Detached entries — every `scan`/`get --mode vendored` entry — are exempt
 /// from (a) alone: they are never manifest-tracked, so "absent from the
@@ -3561,15 +3407,12 @@ pub(crate) struct VendorGcSummary {
 /// manifest skips (a) only (a prune must not mass-revert on a deleted
 /// manifest — that is `vendor --revert`'s explicit contract).
 ///
-/// Lock-free: the caller holds the apply lock for a wet pass (`scan
-/// --prune`'s `run_apply_gc` takes ONE lock for the vendored half and the
-/// manifest prune — flock is per open file description, so a nested acquire
-/// here would read as a live holder and silently skip every revert); a dry
-/// run needs none (read-only, list-only). Re-reads the ledger itself — under
-/// the caller's lock it is the authoritative copy. The ledger and manifest
-/// are rewritten only when a pass removed something; a failed rewrite is
-/// recorded in [`VendorGcSummary::write_failures`] (the reverts themselves
-/// already happened on disk).
+/// Lock-free: the caller holds the apply lock for a wet pass (flock is per
+/// open file description, so a nested acquire here would read as a live
+/// holder and skip every revert); a dry run needs none. Re-reads the ledger
+/// itself — under the caller's lock it is the authoritative copy. The
+/// ledger and manifest are rewritten only when a pass removed something; a
+/// failed rewrite is recorded in [`VendorGcSummary::write_failures`].
 pub(crate) async fn run_vendor_gc(
     common: &GlobalArgs,
     manifest_path: &Path,
@@ -3584,10 +3427,8 @@ pub(crate) async fn run_vendor_gc(
     };
 
     // (a) manifest-dropped entries. Everything (a) touches is excluded from
-    // (b): in a dry run the ledger keeps the entry, and after a wet revert
-    // failure it does too — either way (b) would list/fail the same purl a
-    // second time, which the wet success path (entry removed before (b)'s
-    // candidate scan) never does.
+    // (b), which would otherwise list/fail the same purl a second time on a
+    // dry run or after a wet revert failure.
     let mut handled_by_a: HashSet<String> = HashSet::new();
     // Set at the two `state.entries.remove` sites: the ledger is rewritten
     // only when a pass reclaimed something (the common `scan --prune` with
@@ -3606,12 +3447,9 @@ pub(crate) async fn run_vendor_gc(
             if !outcome.success {
                 out.failed.push(purl);
             } else if outcome.kept_artifact {
-                // Drift-skip keep (residual #131): the backend left the
-                // drifted lock alone and kept the artifacts, so the ledger
-                // entry must survive too (the RevertOutcome contract every
-                // other caller honors) — which also shields the uuid dir
-                // from the (c) orphan sweep. Nothing was reclaimed, so the
-                // purl is reported as kept, never as reverted.
+                // Drift-skip keep: the ledger entry must survive too (which
+                // also shields the uuid dir from the (c) orphan sweep), and
+                // the purl is reported as kept, never as reverted.
                 out.kept.push(purl);
             } else {
                 state.entries.remove(&purl);
@@ -3647,10 +3485,10 @@ pub(crate) async fn run_vendor_gc(
             continue;
         }
         if outcome.kept_artifact {
-            // Drift-skip keep (residual #131), same gate as (a) — and the
-            // purl's manifest records must survive too: pruning them would
-            // make the next `vendor` reconcile re-revert an entry whose
-            // backing record is gone (the `remove` caller's rationale).
+            // Drift-skip keep, same gate as (a) — and the purl's manifest
+            // records must survive too: pruning them would make the next
+            // `vendor` reconcile re-revert an entry whose backing record is
+            // gone.
             out.kept.push(purl);
             continue;
         }
@@ -3675,8 +3513,7 @@ pub(crate) async fn run_vendor_gc(
     if !dry_run {
         // The reverts above already restored the wiring and removed the
         // artifacts; a failed ledger/manifest rewrite leaves records for
-        // state that is gone, which must not pass silently (the sibling
-        // callers all report `vendor_state_write_failed`).
+        // state that is gone, which must not pass silently.
         if ledger_dirty {
             if let Err(e) = save_state(&common.cwd, &state).await {
                 let detail = format!(
@@ -3728,9 +3565,7 @@ mod dispatch_tests {
     /// Fail-closed `--vendor-source=service` must not refuse maven at the
     /// dispatch gate: the maven backend has a full service path (prebuilt
     /// jar download + registry pom), and its own errors advise exactly
-    /// that flag. Regression: PR #117 shipped the backend and added nuget
-    /// to `SERVICE_ECOSYSTEMS` but left maven off the list, so the gate
-    /// dead-ended the flag the backend recommends.
+    /// that flag.
     #[tokio::test]
     async fn service_mode_gate_admits_maven() {
         let tmp = tempfile::tempdir().unwrap();
@@ -3892,10 +3727,7 @@ mod warning_counting_tests {
     /// A vendor advisory (e.g. a SUCCESSFUL `vendor_prebuilt_downloaded`
     /// service fetch) must NOT inflate `summary.skipped`: that counter counts
     /// packages that were genuinely skipped, not the number of advisory
-    /// events. Regression: every warning was routed through
-    /// `Envelope::record` as a `Skipped` event, so a single service vendor
-    /// reported `applied:1 skipped:1` and a 1-package project could print
-    /// "2 skipped". The advisory must still remain visible in `events[]`.
+    /// events. The advisory must still remain visible in `events[]`.
     #[test]
     fn advisory_warning_does_not_bump_skipped_summary() {
         let common = quiet_common();
@@ -3933,8 +3765,7 @@ mod warning_counting_tests {
     }
 
     /// Two advisories on a single 1-package vendor must still leave
-    /// `summary.skipped` at zero — directly reproduces the "2 skipped" report
-    /// the sweep observed for a one-package project.
+    /// `summary.skipped` at zero.
     #[test]
     fn multiple_advisories_do_not_accumulate_skips() {
         let common = quiet_common();
@@ -3962,8 +3793,7 @@ mod warning_counting_tests {
 
     /// A genuinely-skipped PACKAGE (recorded via `Envelope::record`, e.g.
     /// `already_vendored` or `package_not_installed`) must still bump
-    /// `summary.skipped` — the fix narrows the counter to real skips, it does
-    /// not zero it out.
+    /// `summary.skipped`.
     #[test]
     fn genuine_package_skip_still_counts() {
         let mut env = Envelope::new(Command::Vendor);
@@ -4022,12 +3852,10 @@ mod variant_probe_tests {
     /// Fixture: an installed wheel of `foo@1.0.0` (its `foo/__init__.py`
     /// matches the wheel variant's `beforeHash`) plus a manifest sdist
     /// variant that is NOT installed — it patches `setup.py` (absent from
-    /// the wheel install → `NotFound`) and adds one new file. With the
-    /// representative taken from `HashMap::iter().next()` the sdist's new
-    /// file comes up first roughly half the time, `Ready` admits the
-    /// not-installed variant, and `vendor` attempts to vendor it — the
-    /// same nondeterminism that was fixed in core's
-    /// `select_installed_variants` and in `apply`'s variant loop.
+    /// the wheel install → `NotFound`) and adds one new file. A
+    /// representative taken from `HashMap::iter().next()` would pick the
+    /// sdist's new file roughly half the time and admit the not-installed
+    /// variant.
     #[tokio::test]
     async fn variant_probe_never_picks_a_new_file_as_representative() {
         let tmp = tempfile::tempdir().unwrap();
@@ -4436,9 +4264,7 @@ mod gc_tests {
     /// writes — is exempt from (a) alone (never manifest-tracked, so its
     /// absence from the manifest is not a drop) but NOT from (b): it is
     /// wired into the lock like any other entry, so once the dependency
-    /// leaves the lock graph the GC reclaims it. Pre-fix (b) skipped
-    /// detached entries as "lockfile-invisible", which made the unused GC
-    /// dead for every vendored-mode project.
+    /// leaves the lock graph the GC reclaims it.
     #[tokio::test]
     async fn vendor_gc_keeps_undeterminable_entries_and_reclaims_unused_detached() {
         // Lock removed entirely: probe says None → keep.
@@ -4528,10 +4354,9 @@ mod gc_tests {
     }
 
     /// A vendored CARGO entry displaced by a hosted takeover (its lock entry
-    /// re-sourced to a socket-patch sparse index) is reclaimable by the GC:
-    /// pre-fix, `dispatch_in_use_one` had no cargo probe (`None` = keep), so
-    /// the stale ledger entry, the committed tree, and the build-breaking
-    /// `[patch.crates-io]` entry survived every `scan --prune` forever.
+    /// re-sourced to a socket-patch sparse index) is reclaimable by the GC
+    /// through `dispatch_in_use_one`'s cargo probe, which drops the
+    /// build-breaking `[patch.crates-io]` entry.
     #[tokio::test]
     async fn vendor_gc_reclaims_cargo_entry_displaced_by_hosted_takeover() {
         const CARGO_PURL: &str = "pkg:cargo/cfg-if@1.0.4";
@@ -4687,14 +4512,12 @@ mod gc_tests {
         })
     }
 
-    /// (a) + drift-keep (residual #131): the patch left the manifest, but
+    /// (a) + drift-keep: the patch left the manifest, but
     /// the lock entry drifted since vendoring, so the revert leaves the
     /// lock alone and returns success with `kept_artifact`. Per the
     /// [`RevertOutcome::kept_artifact`] contract the GC must keep the
     /// ledger entry — which also shields the uuid dir from the (c) orphan
-    /// sweep — and must NOT report the purl as cleanly reverted. Pre-fix
-    /// it pruned the entry, counted it `dropped_reverted`, and the sweep
-    /// then destroyed the kept artifacts.
+    /// sweep — and must NOT report the purl as cleanly reverted.
     #[tokio::test]
     async fn vendor_gc_keeps_drift_skipped_manifest_dropped_entry() {
         let (tmp, common, manifest_path) = wired_gc_fixture(fork_fragment()).await;
@@ -4746,8 +4569,7 @@ mod gc_tests {
     /// artifact — because the lock entry drifted to a third-party fork.
     /// Same keep contract as (a), plus the purl's manifest records must
     /// survive (pruning them would make the next `vendor` reconcile
-    /// re-revert an entry whose backing record is gone — the `remove`
-    /// caller's rationale).
+    /// re-revert an entry whose backing record is gone).
     #[tokio::test]
     async fn vendor_gc_keeps_drift_skipped_unused_entry_and_manifest_record() {
         let (tmp, common, manifest_path) = wired_gc_fixture(fork_fragment()).await;
@@ -4837,10 +4659,10 @@ mod gc_tests {
 
     /// The orphan sweep keeps every un-ledgered dir a project file still
     /// points at. A vendored requirements pin may live ONLY in a `-r`
-    /// include (the planner writes it where the original pin was), and
-    /// the sweep used to consult the root requirements.txt alone — so
-    /// after a state.json loss it deleted the include-referenced wheel as
-    /// `vendor_orphan_removed` and bricked the next `pip install`.
+    /// include (the planner writes it where the original pin was), so the
+    /// sweep must follow includes, not just the root requirements.txt —
+    /// deleting the include-referenced wheel would brick the next
+    /// `pip install`.
     #[tokio::test]
     async fn orphan_sweep_keeps_include_referenced_dir() {
         let tmp = tempfile::tempdir().unwrap();
@@ -5108,11 +4930,6 @@ mod scope_and_hint_tests {
         assert_eq!(flavor_install_command(""), None);
     }
 
-    /// The no-manifest no-op names the MANIFEST (the thing missing) and,
-    /// on a ledger-tracked project (`scan`/`get --mode vendored` never
-    /// write a manifest), says what IS vendored instead of "nothing" —
-    /// the old "No .socket folder found" text was false on every such
-    /// project (`.socket/vendor/` exists).
     #[test]
     fn no_manifest_with_unreadable_ledger_warns() {
         assert_eq!(
@@ -5123,6 +4940,9 @@ mod scope_and_hint_tests {
         );
     }
 
+    /// The no-manifest no-op names the MANIFEST (the thing missing) and,
+    /// on a ledger-tracked project (`scan`/`get --mode vendored` never
+    /// write a manifest), says what IS vendored instead of "nothing".
     #[test]
     fn no_manifest_message_names_the_manifest_and_tracked_entries() {
         assert_eq!(
diff --git a/crates/socket-patch-cli/src/commands/vex.rs b/crates/socket-patch-cli/src/commands/vex.rs
index 32bc6478..4ece01fb 100644
--- a/crates/socket-patch-cli/src/commands/vex.rs
+++ b/crates/socket-patch-cli/src/commands/vex.rs
@@ -45,7 +45,7 @@ use crate::ui::plural;
 /// no install hook set up and is not declared `manual`. Distinct from the
 /// verification tags (`hash_mismatch`, `package_not_found`, …) so a JSON
 /// consumer can tell "not patched" from "patched but not persisted by any
-/// hook" — before this tag existed the drop was machine-invisible.
+/// hook".
 const ECOSYSTEM_NOT_SETUP: &str = "ecosystem_not_setup";
 
 #[derive(Args)]
@@ -85,12 +85,9 @@ pub struct VexArgs {
     /// longer wires, or a lockfile reference whose record is unavailable or
     /// names another package, is omitted either way.
     //
-    // `value_parser = parse_bool_flag` matches the `GlobalArgs` bool flags:
-    // clap's default bool parser accepts only the literal strings
-    // `true`/`false` from the env binding, so `SOCKET_VEX_NO_VERIFY=1` (or
-    // an exported-but-empty `SOCKET_VEX_NO_VERIFY=`) aborted the parse.
-    // This var is also outside `GLOBAL_ARG_ENV_VARS`, so `main`'s empty-var
-    // scrub never rescues it.
+    // `value_parser = parse_bool_flag`: clap's default bool parser accepts
+    // only `true`/`false` from the env binding, so `SOCKET_VEX_NO_VERIFY=1`
+    // would abort the parse.
     #[arg(
         long = "no-verify",
         env = "SOCKET_VEX_NO_VERIFY",
@@ -115,7 +112,7 @@ pub struct VexArgs {
     pub compact: bool,
 }
 
-/// VEX-generation knobs embedded into `apply` and `scan` via `--vex`.
+/// VEX-generation knobs embedded into `apply`, `vendor` and `scan` via `--vex`.
 ///
 /// `--vex <path>` is the trigger: when set, the host command generates an
 /// OpenVEX document at that path after a successful run. The remaining
@@ -140,10 +137,9 @@ pub struct VexEmbedArgs {
     /// trust the patch records (the lockfile wiring checks still apply). See
     /// `socket-patch vex --no-verify`.
     //
-    // `value_parser = parse_bool_flag`: these embedded flags share their
-    // env vars with the standalone `vex` flags, so without it an ambient
-    // `SOCKET_VEX_NO_VERIFY=1` (or `=`) aborted every host command parse —
-    // including `apply` running from a postinstall hook.
+    // `value_parser = parse_bool_flag`: these share env vars with the
+    // standalone `vex` flags, so an ambient `SOCKET_VEX_NO_VERIFY=1` (or `=`)
+    // must not abort every host command parse (e.g. a postinstall `apply`).
     #[arg(
         long = "vex-no-verify",
         env = "SOCKET_VEX_NO_VERIFY",
@@ -188,7 +184,7 @@ impl VexEmbedArgs {
 }
 
 /// Plain (non-clap) inputs to [`generate_vex`] so the standalone `vex`
-/// command and the embedded `apply`/`scan` paths feed one code path.
+/// command and the embedded `apply`/`vendor`/`scan` paths feed one code path.
 pub(crate) struct VexBuildParams {
     /// Where to write the document. `None` => stdout (standalone `vex`
     /// only); embedded callers always pass `Some(path)`.
@@ -197,7 +193,7 @@ pub(crate) struct VexBuildParams {
     pub no_verify: bool,
     pub doc_id: Option<String>,
     pub compact: bool,
-    /// In-run `scan --redirect --vex` only: the PURLs whose lockfile rewrite
+    /// In-run `scan --mode hosted --vex` only: the PURLs whose lockfile rewrite
     /// THIS RUN confirmed (their hosted-patch URL landed in a project file).
     /// These are exempt from on-disk verification — their bytes are remote
     /// until the next install; the lockfile integrity pins are the evidence —
@@ -219,10 +215,9 @@ pub(crate) struct VexBuildParams {
     /// Embedded hosted `scan --vex` only: scan's npm crawl of the same
     /// tree earlier in this process. The installed-copy lookups take the
     /// npm `node_modules` roots (and, for the identity fallback, the
-    /// crawled packages) from it instead of walking the tree again; each
-    /// root is still searched as before, so copy choice and order are
-    /// unchanged. Ignored when taken with other crawler options. The
-    /// standalone `vex` passes `None` and walks the tree.
+    /// crawled packages) from it instead of walking the tree again; copy
+    /// choice and order are unchanged. Ignored when taken with other crawler
+    /// options. The standalone `vex` passes `None` and walks the tree.
     pub npm_prior: Option<crate::ecosystem_dispatch::NpmCrawlSnapshot>,
 }
 
@@ -304,8 +299,7 @@ pub async fn run(args: VexArgs) -> i32 {
     let output = args.output.clone().filter(|p| p.as_os_str() != "-");
 
     // --json without --output would race the envelope and the VEX doc
-    // on the same stdout stream. Bail out with a clear error before
-    // doing any work.
+    // on the same stdout stream.
     if args.common.json && output.is_none() {
         // A usage error, not a generation failure: no telemetry POST and no
         // config read (argument errors never report), just the envelope.
@@ -468,10 +462,11 @@ fn org_looks_like_path(org: Option<&str>) -> Option<String> {
     })
 }
 
-/// Map a `setup.manual` entry to an `Ecosystem`. Accepts the canonical
-/// `cli_name` plus the friendly aliases `setup --exclude`/`--ecosystems` accept
-/// (`go`/`golang`, `python`/`pypi`, `ruby`/`gem`, `php`/`composer`).
-/// Unrecognized names yield `None` and are ignored.
+/// Map a `setup.manual` entry to an `Ecosystem`, case-insensitively.
+/// Accepts the canonical `cli_name`, the aliases `go`, `python`, `ruby`,
+/// `rust`, `php`, `java`, `dotnet` and `jsr`, and the npm-family package
+/// manager names (`yarn`/`pnpm`/`bun`/`vlt`). Unrecognized names yield
+/// `None` and are ignored.
 fn ecosystem_from_manual_name(name: &str) -> Option<Ecosystem> {
     match name.to_ascii_lowercase().as_str() {
         "npm" | "yarn" | "pnpm" | "bun" | "vlt" => Some(Ecosystem::Npm),
@@ -490,7 +485,7 @@ fn ecosystem_from_manual_name(name: &str) -> Option<Ecosystem> {
 }
 
 /// Core VEX pipeline shared by the standalone `vex` command and the
-/// embedded `apply`/`scan` `--vex` paths: resolve the product, verify the
+/// embedded `apply`/`vendor`/`scan` `--vex` paths: resolve the product, verify the
 /// plan's record view against disk (unless `no_verify`), build the OpenVEX
 /// document, serialize, write (or print to stdout when `output` is `None`),
 /// and fire telemetry. Returns a [`VexWriteSummary`] on success or a
@@ -506,7 +501,6 @@ async fn generate_vex(
 ) -> Result<VexWriteSummary, VexGenError> {
     let manifest = &plan.view;
     let redirected: &[String] = &plan.redirected;
-    // Resolve product.
     let product_id = match resolve_product_id(common, params.product.as_deref(), warnings).await {
         Ok(id) => id,
         Err(reason) => return Err(fail(common, "product_undetected", reason).await),
@@ -645,7 +639,7 @@ async fn generate_vex(
         outcome
     };
 
-    // In-run `scan --redirect --vex`: the bytes of deps THAT RUN confirmed
+    // In-run `scan --mode hosted --vex`: the bytes of deps THAT RUN confirmed
     // redirected live on the patch server until the next install, so their
     // verification against the local tree would spuriously fail
     // (package_not_found / not_applied). Exempt exactly those PURLs —
@@ -657,9 +651,7 @@ async fn generate_vex(
         // The confirmed purls come from the grant reference (unqualified —
         // `pkg:pypi/urllib3@1.26.18`) while the ledger records the API's
         // artifact-qualified purl (`…?artifact_id=py2-py3-none-any-whl`), so
-        // match on the qualifier-stripped form: a lock-only pypi redirect used
-        // to attest nothing and fail the same-run `--vex` with
-        // `no_applicable_patches`.
+        // match on the qualifier-stripped form.
         let exempt: std::collections::HashSet<&str> = params
             .assume_applied
             .iter()
@@ -732,10 +724,8 @@ async fn generate_vex(
     // mechanism, so no install hook exists (or is needed) by construction.
     let vendored_set: std::collections::HashSet<String> =
         outcome.vendored.iter().cloned().collect();
-    // Redirected patches (from `scan --redirect`) bypass the property-7
-    // ecosystem filter for the same reason vendored ones do: the committed
-    // lockfile rewrite IS the persistence mechanism, so no install hook exists
-    // (or is needed) by construction.
+    // Redirected (hosted) patches bypass the filter for the same reason: the
+    // committed lockfile rewrite IS the persistence mechanism.
     let redirected_set: std::collections::HashSet<&str> =
         redirected.iter().map(|s| s.as_str()).collect();
     let mut allowed = crate::commands::setup::configured_ecosystems(common).await;
@@ -761,9 +751,7 @@ async fn generate_vex(
     let any_setup_filtered = !setup_filtered.is_empty();
     // The filter drops join the omission channel (`failed`) with their own
     // routing tag so they surface as per-purl `skipped` events in the
-    // envelope — success and error paths alike. Before this they existed
-    // only as the human-mode note above, leaving `--json` consumers unable
-    // to distinguish "patched but no persistence hook" from "not patched".
+    // envelope — success and error paths alike.
     outcome
         .failed
         .extend(setup_filtered.into_iter().map(|purl| FailedPatch {
@@ -798,12 +786,10 @@ async fn generate_vex(
         }
     }
 
-    // Build the document.
     let opts = BuildOptions {
         product_id,
-        // Same "empty means unset" rule as the product override above: the
-        // document `@id` is a required field with no `skip_serializing_if`,
-        // so `--doc-id "$UNSET_VAR"` emitted a literal `"@id": ""`.
+        // Empty means unset: the document `@id` is a required field, so
+        // `--doc-id "$UNSET_VAR"` must not emit a literal `"@id": ""`.
         doc_id: params
             .doc_id
             .clone()
@@ -845,7 +831,6 @@ async fn generate_vex(
         }
     };
 
-    // Serialize.
     let serialized = match if params.compact {
         serde_json::to_string(&doc)
     } else {
@@ -861,9 +846,7 @@ async fn generate_vex(
         Some(_) if params.dry_run => false,
         Some(path) => {
             if let Err(e) = tokio::fs::write(path, format!("{serialized}\n")).await {
-                // The raw io::Error ("No such file or directory (os error
-                // 2)") names neither the file nor the operation — useless
-                // in a CI log. Say what was being written and where.
+                // The raw io::Error names neither the file nor the operation.
                 return Err(fail(
                     common,
                     "write_failed",
@@ -932,9 +915,9 @@ fn has_iri_scheme(s: &str) -> bool {
 }
 
 /// Read the manifest at `manifest_path`, then [`generate_vex`]. Manifest
-/// read failures are wrapped as [`VexGenError`] so embedded callers
-/// (`apply`/`scan`) get a single error channel. Used by the embedded
-/// `--vex` paths, which always write to a file.
+/// read failures are wrapped as [`VexGenError`] so every caller gets a single
+/// error channel. Used by the standalone `vex` command (file or stdout) and
+/// the embedded `--vex` paths of `apply`/`vendor`/`scan` (always a file).
 ///
 /// Failure contract: a run that ends in error leaves NO OpenVEX document at
 /// the output path — including a stale one from a previous run. Attestation
@@ -1090,7 +1073,7 @@ async fn generate_vex_from_manifest_path_inner(
         Ok(state) => state,
         Err(corrupt) => {
             // Not core's Display: that text ("... so it will not be
-            // overwritten") is written for the `scan --redirect` writer, and
+            // overwritten") is written for the hosted `scan` writer, and
             // `vex` only reads the ledger.
             let message = format!(
                 "The redirect ledger {} is malformed ({}); cannot attest redirected patches. \
@@ -1112,12 +1095,10 @@ async fn generate_vex_from_manifest_path_inner(
             return Err(fail(common, "vendor_ledger_corrupt", message).await);
         }
     };
-    // Rooted where the ledgers are (`--cwd`). It runs under `--global` /
-    // `--global-prefix` too: the redirect and vendor ledgers are still read
-    // from `--cwd`, and discovery is what gates them (core discover rule
-    // 11). Skipping it handed every ledger claim to the raw-text fallbacks,
-    // which must never decide a uuid a lockfile mentions — so a
-    // commented-out or rejected pin attested again under `--global`.
+    // Rooted where the ledgers are (`--cwd`), and run under `--global` /
+    // `--global-prefix` too: discovery is what gates the ledgers (core
+    // discover rule 11); without it the raw-text fallbacks would decide a
+    // uuid a lockfile mentions, attesting a commented-out or rejected pin.
     let discovery = crate::commands::discover_wiring(common, &common.cwd).await;
     for diag in &discovery.diagnostics {
         note_warning(warnings, common, diag.code, diag.detail.clone());
@@ -1185,13 +1166,9 @@ async fn resolve_product_id(
     product: Option<&str>,
     warnings: &mut Vec<RunWarning>,
 ) -> Result<String, String> {
-    // An empty (or whitespace-only) override means "unset" — the semantics
-    // `scrub_empty_env_vars` already gives the `SOCKET_VEX_PRODUCT=` twin and
-    // `api_client_overrides` gives `--api-url ""`. Without the filter,
-    // `--product "$UNSET_VAR"` sailed through to `BuildOptions::product_id`,
-    // and `Product::id` is `skip_serializing_if = "String::is_empty"` — so the
-    // run wrote a spec-invalid document whose statements claim `not_affected`
-    // about a product carrying NO identifier at all, and exited 0.
+    // An empty (or whitespace-only) override means "unset". `Product::id` is
+    // `skip_serializing_if = "String::is_empty"`, so passing it through would
+    // write a spec-invalid document about a product with no identifier.
     if let Some(p) = product.filter(|p| !p.trim().is_empty()) {
         return Ok(p.to_string());
     }
@@ -1274,12 +1251,9 @@ pub(crate) fn warn_unreadable_vendor_state(common: &GlobalArgs, e: &std::io::Err
 /// instead, so a ledger entry no lockfile wires never routes its
 /// verification.)
 ///
-/// The go-patches synthesis fixes a latent bug: an apply-redirected Go
-/// patch leaves the module cache pristine (the `replace` directive routes
-/// the build at the copy dir), so verifying against the crawler-resolved
-/// cache path reported `not_applied`/`package_not_found` and the patch was
-/// silently omitted from the VEX document. The redirect copy dir holds the
-/// bytes the build actually consumes, so it is what verification must hash.
+/// Go-patches synthesis: an apply-redirected Go patch leaves the module
+/// cache pristine (the `replace` directive routes the build at the copy
+/// dir), so the copy dir is what verification must hash.
 ///
 /// An unreadable/corrupt vendor ledger degrades to "no vendor entries":
 /// vendored PURLs then fall through to the installed tree, fail
@@ -1538,8 +1512,7 @@ mod tests {
     use clap::Parser;
 
     // Property 7: every ecosystem a PURL can classify to must also be
-    // declarable `manual`. Apply-only maven/nuget/deno are the *primary* use of
-    // `manual`; they were missing originally, silently dropping their patches.
+    // declarable `manual` (apply-only maven/nuget/deno are its primary use).
     #[test]
     fn ecosystem_from_manual_name_maps_every_ecosystem() {
         assert_eq!(ecosystem_from_manual_name("npm"), Some(Ecosystem::Npm));
@@ -1559,14 +1532,9 @@ mod tests {
         assert_eq!(ecosystem_from_manual_name("deno"), Some(Ecosystem::Deno));
     }
 
-    // Property 7 completeness, the reverse direction of the test above and
-    // future-proof: every ecosystem the build can classify a PURL for (i.e.
-    // every `Ecosystem::all()` variant) MUST round-trip through its canonical
-    // `cli_name` back to itself via `ecosystem_from_manual_name`. Otherwise a
-    // `manual`-declared patch for that ecosystem would be silently dropped from
-    // the VEX doc by the `retain` in `generate_vex`. Iterating `all()` (rather
-    // than hard-coding names) means adding a new ecosystem without wiring up its
-    // `manual` alias fails this test instead of shipping a silent drop.
+    // Every `Ecosystem::all()` variant must round-trip through its `cli_name`
+    // via `ecosystem_from_manual_name`, or its `manual`-declared patches are
+    // silently dropped by the `retain` in `generate_vex`.
     #[test]
     fn every_compiled_ecosystem_is_declarable_manual_via_cli_name() {
         for &e in Ecosystem::all() {
@@ -1615,10 +1583,8 @@ mod tests {
     }
 
     /// The `--product` advisory keys off [`has_iri_scheme`]: PURLs and
-    /// anything scheme-shaped sail through silently; bare names (what the
-    /// probe fed in) warn. Pin the accept/reject sets so the check can't
-    /// drift into rejecting legal identifiers (a hard reject is explicitly
-    /// out of contract — help text says "PURL/identifier").
+    /// anything scheme-shaped pass silently; bare names warn (never a hard
+    /// reject — help text says "PURL/identifier").
     #[test]
     fn iri_scheme_check_accepts_purls_and_iris_rejects_bare_names() {
         // Accepted (no warning): PURLs, URLs, URNs, exotic-but-legal schemes.
@@ -1845,7 +1811,7 @@ mod tests {
     }
 }
 
-/// H3: embedded hosted `scan --vex` takes the npm roots and crawled
+/// Embedded hosted `scan --vex` takes the npm roots and crawled
 /// packages from scan's crawl instead of walking the tree again; the VEX
 /// document is byte-identical (modulo its per-run timestamps) to the one
 /// the tree walk produces.
diff --git a/crates/socket-patch-cli/src/commands/vex_consumed.rs b/crates/socket-patch-cli/src/commands/vex_consumed.rs
index 5500e53e..d0bc39fe 100644
--- a/crates/socket-patch-cli/src/commands/vex_consumed.rs
+++ b/crates/socket-patch-cli/src/commands/vex_consumed.rs
@@ -153,9 +153,9 @@ const ALIAS_WALK_MAX_DIRS: usize = 200_000;
 /// `node_modules/mm`, a dir the crawler's name-keyed lookup never probes
 /// (it matches `node_modules/<name>` by design, so apply cannot patch the
 /// wrong package). For a hosted ref that copy is what the aliased import
-/// loads, so it is consumed evidence like any other: without it an alias
-/// that is the ONLY copy read as "not installed" and a tampered or stale
-/// (pre-reinstall) tree attested from the lock pin alone.
+/// loads, so it is consumed evidence like any other (otherwise an alias
+/// that is the ONLY copy reads as "not installed" and attests from the lock
+/// pin alone).
 ///
 /// Walks EVERY importer `node_modules` tree the crawler resolves the
 /// installed copies from ([`NpmCrawler::get_node_modules_paths`]: the
@@ -163,10 +163,8 @@ const ALIAS_WALK_MAX_DIRS: usize = 200_000;
 /// `--global-prefix`) once, matching each package dir's `package.json`
 /// `(name, version)`; only dirs whose on-disk key DIFFERS from the
 /// package's name are aliases (the crawler already returns the rest).
-/// Walking the root tree alone left a workspace member's alias
-/// (`packages/a/node_modules/lp`) unhashed whenever the root or a hoisted
-/// copy existed — the identity fallback only fills purls with NO copy —
-/// so a stale or tampered member alias attested from the good root copy.
+/// Member trees matter because the identity fallback only fills purls with
+/// NO copy, so a member alias beside a root copy is found only here.
 /// Hidden entries (`.bin`, pnpm's `.pnpm` and vlt's `.vlt` stores — the
 /// crawler probes them) and symlinks (pnpm's and vlt's importer links,
 /// `npm link` targets) are not traversed. Under vlt EVERY importer entry,
@@ -279,12 +277,11 @@ async fn real_subdirs(dir: &Path) -> Vec<(PathBuf, String)> {
 /// (`node_modules/lp`), not its package name, so the targeted resolver —
 /// which probes `node_modules/<name>` — reports it not installed, and the
 /// walk skips symlinked importer entries (yarn's pnpm linker, a global
-/// `--global-prefix` tree). For a hosted purl that is not a harmless miss: "not
-/// installed" is exactly what the lockfile basis excuses, so a stale or
-/// tampered alias install was attested from the lock pin instead of being
-/// hash-verified ("installed evidence wins"). Resolve every npm purl the
-/// targeted lookup missed by the installed `package.json` identity instead
-/// — the same fallback `vendor` uses before declaring a package missing.
+/// `--global-prefix` tree). For a hosted purl "not installed" is exactly what
+/// the lockfile basis excuses, so such a copy must still be hash-verified
+/// ("installed evidence wins"). Resolve every npm purl the targeted lookup
+/// missed by the installed `package.json` identity instead — the same
+/// fallback `vendor` uses before declaring a package missing.
 #[cfg(test)]
 async fn npm_identity_fallback(
     npm: Option<&Vec<String>>,
@@ -622,11 +619,9 @@ mod tests {
         }
     }
 
-    /// REGRESSION: an npm alias install (`node_modules/lp` holding
-    /// left-pad@1.3.0) is a consumed copy of the hosted purl. The targeted
-    /// lookup probes `node_modules/left-pad` only, so it used to come back
-    /// "not installed" — which the lockfile basis excuses — and a tampered or
-    /// stale alias install was attested from the lock pin unverified.
+    /// An npm alias install (`node_modules/lp` holding left-pad@1.3.0) is a
+    /// consumed copy of the hosted purl, though the targeted lookup probes
+    /// only `node_modules/left-pad`.
     #[tokio::test]
     async fn npm_identity_fallback_fills_only_misses() {
         let tmp = tempfile::tempdir().unwrap();
@@ -663,7 +658,7 @@ mod tests {
         assert!(!all.contains_key(&purls[0]), "{all:?}");
     }
 
-    /// H3: the identity fallback answered from the crawl snapshot finds the
+    /// The identity fallback answered from the crawl snapshot finds the
     /// same copies as crawling again — here an alias installed through a
     /// symlink (yarn's pnpm linker, `npm link`), which neither the targeted
     /// lookup nor the alias walk (it skips symlinks) finds, among other
@@ -766,14 +761,10 @@ mod tests {
         assert_eq!(found["pkg:npm/%40scope/pkg@1.0.0"], vec![nm.join("sc")]);
     }
 
-    /// REGRESSION: a workspace member's alias install is a consumed copy
-    /// even when the root holds the package under its own name. The walk
-    /// used to start at the root `node_modules` only, and the identity
-    /// fallback only fills purls with NO copy — so beside a root (or
-    /// hoisted) install the member alias went unhashed and a tampered one
-    /// attested from the good root copy. Every importer tree the crawler
-    /// enumerates is walked; `--global-prefix` walks the prefix; a plain
-    /// `--global` run walks nothing (the fallback covers it).
+    /// A workspace member's alias install is a consumed copy even when the
+    /// root holds the package under its own name. Every importer tree the
+    /// crawler enumerates is walked; `--global-prefix` walks the prefix; a
+    /// plain `--global` run walks nothing (the fallback covers it).
     #[tokio::test]
     async fn npm_alias_copies_walks_every_workspace_members_tree() {
         let tmp = tempfile::tempdir().unwrap();
diff --git a/crates/socket-patch-cli/src/commands/vex_sources.rs b/crates/socket-patch-cli/src/commands/vex_sources.rs
index 92883ed0..0d6c08d5 100644
--- a/crates/socket-patch-cli/src/commands/vex_sources.rs
+++ b/crates/socket-patch-cli/src/commands/vex_sources.rs
@@ -65,7 +65,7 @@
 //! when any exist ("installed evidence wins") and otherwise, for a
 //! DISCOVERED Socket-host reference with a lockfile pin, attests from the
 //! pinned wiring (the in-run `scan --mode hosted --vex` evidence);
-//! `Installed` is the pre-existing agent-mode path.
+//! `Installed` is the agent-mode path.
 
 use std::collections::{BTreeMap, BTreeSet, HashMap, HashSet};
 
@@ -111,14 +111,9 @@ pub(crate) const WIRING_CONFLICT: &str = "wiring_conflict";
 /// carries blob content, so it is heavy).
 const FETCH_CONCURRENCY: usize = 10;
 
-/// The in-flight cap for the record fetch.
-///
-/// These are patch-API requests — `scan --vex` makes them too — so the
-/// documented escape hatch has to reach them like it reaches every other
-/// window: an operator behind something that caps in-flight requests per
-/// client sets `SOCKET_API_CONCURRENCY=1` and gets one view at a time.
-/// [`FETCH_CONCURRENCY`] is this window's own ceiling on top of that, for
-/// the size of a view.
+/// The in-flight cap for the record fetch: `SOCKET_API_CONCURRENCY` applies
+/// here like every other patch-API window, with [`FETCH_CONCURRENCY`] as
+/// this window's own ceiling on top (a view is heavy).
 fn fetch_concurrency(use_public_proxy: bool) -> usize {
     api_concurrency(use_public_proxy).min(FETCH_CONCURRENCY)
 }
@@ -212,7 +207,7 @@ pub(crate) struct HostedWiring {
 
 /// How one view purl is verified.
 enum Basis {
-    /// The pre-existing agent-mode path: installed tree / go-patches copy.
+    /// The agent-mode path: installed tree / go-patches copy.
     Installed,
     /// The committed `.socket/vendor` artifact named by this entry.
     Vendored(Box<VendorEntry>),
@@ -556,7 +551,7 @@ fn expected_package(cand: &Cand) -> String {
 }
 
 /// One candidate per manifest key, then per unclaimed vendor-ledger key,
-/// then per unclaimed redirect-ledger key — the pre-existing collision rule
+/// then per unclaimed redirect-ledger key — the collision rule
 /// (the manifest owns a key it records; ledgers fill the rest), in sorted
 /// order so the output is deterministic.
 fn build_candidates(
@@ -924,16 +919,9 @@ async fn fetch_records(
     loop {
         let mut auth_refused: Vec<String> = Vec::new();
         let mut auth_error: Option<String> = None;
-        // A sliding window of at most FETCH_CONCURRENCY views in flight
-        // (it used to wait for each whole chunk of that size to drain
-        // before starting the next), consumed in `pending` order.
-        //
-        // That IS an observable change, the one in this area: the chunked
-        // JoinSet folded each chunk in COMPLETION order, so which refusal
-        // was reported as `auth_error` (printed in the fallback note) and
-        // the order of the retried `pending` list were a race. They now
-        // follow `pending` order — deterministic, and the same order the
-        // notes above already came out in.
+        // A sliding window of views in flight, consumed in `pending` order,
+        // so the reported `auth_error` and the retried `pending` list are
+        // deterministic.
         {
             let client = &client;
             let mut views = std::pin::pin!(ordered_concurrent(
@@ -1058,9 +1046,8 @@ mod tests {
         }
     }
 
-    /// `scan --vex` reaches this window, so the documented escape hatch
-    /// has to reach it too: `SOCKET_API_CONCURRENCY=1` means one view at a
-    /// time here as well. Serial: `SOCKET_*` is process-global.
+    /// `SOCKET_API_CONCURRENCY=1` means one view at a time here as well.
+    /// Serial: `SOCKET_*` is process-global.
     #[test]
     #[serial_test::serial]
     fn socket_api_concurrency_paces_the_record_fetch() {
@@ -1090,8 +1077,6 @@ mod tests {
     /// server happens to answer: the FIRST refusal in `pending` is the one
     /// reported in the fallback note, even when it answers last, and the
     /// refused uuids are retried against the proxy in that same order.
-    /// (The chunked JoinSet this replaced folded by completion, so which
-    /// refusal was reported was a race.)
     #[tokio::test]
     #[serial_test::serial]
     async fn refused_records_fold_in_pending_order_not_completion_order() {
@@ -1380,8 +1365,7 @@ mod tests {
     /// `redirect_unwired`, with a note naming the file and the extractor's
     /// reason — although the raw-text fallbacks would call both live (the
     /// files hold each uuid in pin position; the unrecognized control run
-    /// proves it). Before, exactly this re-derivation from raw text attested
-    /// an orphaned berry entry and a reverted cargo pin.
+    /// proves it).
     #[tokio::test]
     async fn recognized_but_rejected_uuids_are_dead_whatever_the_raw_text_says() {
         use socket_patch_core::vendor::state::{WiringAction, WiringRecord};
@@ -1590,14 +1574,12 @@ mod tests {
         );
     }
 
-    /// REGRESSION: the bundler < 2.6 hosted rewrite leaves the pair MIXED —
-    /// the Gemfile's `source "<patch registry>" do` block pins the patch, the
+    /// The bundler < 2.6 hosted rewrite leaves the pair MIXED — the
+    /// Gemfile's `source "<patch registry>" do` block pins the patch, the
     /// CHECKSUMS-less lock still resolves the gem from rubygems.org until
-    /// the next unfrozen `bundle install` converges it. The lock inventory
-    /// reads `Gemfile.lock`'s registry url and used to call the redirect
-    /// record dead (while the identical `gems.rb` / `gems.locked` pair was
-    /// live, the inventory not reading `gems.locked`). Reverting the
-    /// Gemfile too kills it under both spellings.
+    /// the next unfrozen `bundle install` converges it. That keeps the
+    /// redirect record live under both spellings (`Gemfile`/`gems.rb`);
+    /// reverting the Gemfile too kills it.
     #[tokio::test]
     async fn gemfile_source_block_keeps_a_mixed_gem_pair_live() {
         let purl = "pkg:gem/vexprobe@1.2.3";
diff --git a/crates/socket-patch-cli/src/commands/vlt_preflight.rs b/crates/socket-patch-cli/src/commands/vlt_preflight.rs
index 0945773f..57f1f533 100644
--- a/crates/socket-patch-cli/src/commands/vlt_preflight.rs
+++ b/crates/socket-patch-cli/src/commands/vlt_preflight.rs
@@ -1,4 +1,4 @@
-//! The vlt vendored-mode preflight (DESIGN §4.6), the per-purl twin of
+//! The vlt vendored-mode preflight, the per-purl twin of
 //! [`crate::commands::bun_preflight`]: every refusal the vlt backend can
 //! decide from `vlt-lock.json`, the importer package.json files, the vendor
 //! ledger and the installed store copy, evaluated read-only before any
diff --git a/crates/socket-patch-cli/src/ecosystem_dispatch.rs b/crates/socket-patch-cli/src/ecosystem_dispatch.rs
index 9be0519b..f5e3221c 100644
--- a/crates/socket-patch-cli/src/ecosystem_dispatch.rs
+++ b/crates/socket-patch-cli/src/ecosystem_dispatch.rs
@@ -53,7 +53,7 @@ pub fn partition_purls(
 /// scans; pass `""` to suppress that line. The banner is progress chrome
 /// and goes to STDERR like the macro's two warnings: stdout belongs to
 /// `--json` envelopes and the VEX document, so a caller that forgets to
-/// fold `json` into `$silent` can no longer corrupt them.
+/// fold `json` into `$silent` cannot corrupt them.
 macro_rules! scan_ecosystem {
     (
         out = $out:ident,
@@ -165,12 +165,10 @@ fn merge_first_wins(
 /// discovery (precedence) order. The gem crawler legitimately discovers
 /// several coexisting stores holding REAL physical copies of one
 /// `gem@version` (bundler's scoped `<engine>/<abi>/gems` beside the flat
-/// `gems/` layout, or an env `BUNDLE_PATH` store) — first-wins here
-/// dropped the second copy, so apply patched one store and reported
-/// success while the other bundler loaded pristine bytes (the gem sibling
-/// of the npm multi-copy P0). Collapsing consumers still take the first
-/// (highest-precedence) path, so this changes nothing for
-/// vendor/vex/setup/get/repair-vendor; apply fans out per-copy for gem
+/// `gems/` layout, or an env `BUNDLE_PATH` store) — first-wins would drop
+/// the second copy, so apply would patch one store while the other bundler
+/// loads pristine bytes. Collapsing consumers still take the first
+/// (highest-precedence) path; apply fans out per-copy for gem
 /// only (PyPI/Maven keep their one-install-dir contract — see the apply
 /// variant loop).
 fn merge_variant_copies(
@@ -185,9 +183,8 @@ fn merge_variant_copies(
 
 /// npm merge: the npm crawler returns EVERY physical copy of each PURL
 /// (nested duplicates, diamonds, `file:` dups), so fold every path in.
-/// This is the type shape that carries the second copy the old
-/// `HashMap<String, PathBuf>` could not — the fix for the multi-copy silent
-/// partial P0.
+/// A one-path `HashMap<String, PathBuf>` would silently drop every copy
+/// after the first.
 fn merge_npm_copies(
     out: &mut HashMap<String, Vec<PathBuf>>,
     _purls: &[String],
@@ -398,8 +395,8 @@ async fn dispatch_find(
 /// Collapse a multi-copy map to one representative path per PURL (the
 /// first-discovered — root-copy-first for npm). Consumers that only need
 /// "is it installed / where is a representative copy" (`vendor`, `vex`,
-/// `setup`, `get`, `repair vendor`) use the collapsing wrappers below and
-/// keep the old `HashMap<String, PathBuf>` contract unchanged. `apply` and
+/// `setup`, `get`, `repair vendor`) use the collapsing wrappers below
+/// (`HashMap<String, PathBuf>`). `apply` and
 /// `rollback` — which must touch EVERY copy — use the `_all` variants.
 pub(crate) fn collapse_to_first(multi: HashMap<String, Vec<PathBuf>>) -> HashMap<String, PathBuf> {
     multi
@@ -1425,11 +1422,10 @@ mod tests {
         assert_eq!(out.get("pkg:npm/ms@2.1.3"), Some(&transitive));
     }
 
-    /// Multi-copy P0 at the dispatch layer: `find_all_packages_for_purls`
+    /// Multi-copy at the dispatch layer: `find_all_packages_for_purls`
     /// must carry EVERY physical copy of a duplicated npm PURL (a root copy
-    /// plus a nested duplicate), root-copy-first — the second path the old
-    /// `HashMap<String, PathBuf>` return type could not hold. `apply`
-    /// iterates this to patch both copies.
+    /// plus a nested duplicate), root-copy-first. `apply` iterates this to
+    /// patch both copies.
     #[tokio::test]
     async fn find_all_packages_for_purls_carries_every_duplicate_copy() {
         let tmp = tempfile::tempdir().unwrap();
@@ -1462,15 +1458,15 @@ mod tests {
         assert_eq!(copies[0], root_copy, "root copy first");
         assert!(copies.contains(&nested_copy), "nested copy must be present");
 
-        // The collapsing wrapper (used by vendor/vex/setup/get) keeps the
-        // old one-path contract: exactly the root-preferred representative.
+        // The collapsing wrapper (test-only; pins the one-representative
+        // contract) keeps exactly the root-preferred copy.
         let single =
             find_packages_for_purls(&partitioned, &local_options(tmp.path().to_path_buf()), true)
                 .await;
         assert_eq!(single.get("pkg:npm/dup@1.0.0"), Some(&root_copy));
     }
 
-    /// Multi-copy P0 for gem (mirrors the npm test above): bundler's scoped
+    /// Multi-copy for gem (mirrors the npm test above): bundler's scoped
     /// (`<engine>/<abi>/gems`) and flat (`gems/`) store layouts coexist under
     /// one `vendor/bundle` root — a bundler-2 `--path` install beside a
     /// bundler-1 env install — each holding a REAL physical copy of the same
@@ -1510,8 +1506,8 @@ mod tests {
         assert_eq!(copies[0], scoped_copy, "scoped store copy first");
         assert!(copies.contains(&flat_copy), "flat store copy present");
 
-        // The collapsing wrapper (vendor/vex/setup/get/repair-vendor) keeps
-        // the one-representative contract: the first store's copy.
+        // The collapsing wrapper (test-only; pins the one-representative
+        // contract) keeps the first store's copy.
         let single = find_packages_for_purls(&partitioned, &opts, true).await;
         assert_eq!(single.get(&purl), Some(&scoped_copy));
     }
@@ -1533,8 +1529,8 @@ mod tests {
 
     #[tokio::test]
     async fn find_packages_for_rollback_keeps_full_npm_key() {
-        // Non-variant ecosystems use `merge_first_wins` even on the rollback
-        // path, so a qualified npm PURL must round-trip under its exact key
+        // Non-variant ecosystems keep their own crawler-keyed merge (npm:
+        // `merge_npm_copies`) even on the rollback path, so a qualified npm PURL must round-trip under its exact key
         // (a regression that routed npm through `merge_qualified` would drop
         // it, since the crawler echoes the verbatim PURL back).
         let tmp = tempfile::tempdir().unwrap();
@@ -1560,8 +1556,8 @@ mod tests {
         // rollback resolver so its `all_packages.contains_key(qualified)`
         // check recognizes the installed gem. Using `find_packages_for_purls`
         // (base-keyed) misses the qualified key, falsely classifying the
-        // installed gem "not installed" — the bug that produced spurious
-        // `vendor_fetched_missing` events and the gem platform coin-flip.
+        // installed gem "not installed" (spurious `vendor_fetched_missing`
+        // events and a gem platform coin-flip).
         let tmp = tempfile::tempdir().unwrap();
         // A platform gem installs into a `<name>-<version>` dir (with an
         // optional `-<platform>` suffix); lay down the plain-platform case.
@@ -1614,9 +1610,7 @@ mod tests {
 
     // ---- Maven/NuGet are first-class ecosystems ---------------------------
     //
-    // Maven and NuGet used to sit behind `SOCKET_EXPERIMENTAL_MAVEN` /
-    // `SOCKET_EXPERIMENTAL_NUGET` runtime gates. The gates are gone: every
-    // ecosystem is crawled unconditionally in every flow. The observable
+    // Every ecosystem is crawled unconditionally in every flow. The observable
     // pin is the per-ecosystem `counts` map — a crawled-but-empty ecosystem
     // gets a `0` entry, so presence proves the crawler ran without needing
     // a real Maven repo / NuGet cache fixture.
@@ -1896,7 +1890,7 @@ mod tests {
     /// concatenation, so its POSITION in the consumption array is
     /// unobservable and a reordering would ship silently. That order is
     /// shipped behavior: `scan` chunks the crawl-ordered purls into
-    /// batches, so it decides batch composition, the `batch N/M failed`
+    /// batches, so it decides batch composition, the `API batch N of M failed`
     /// warning text and order, and `last_batch_error`.
     #[tokio::test(flavor = "multi_thread")]
     async fn crawl_all_ecosystems_matches_serial_order() {
@@ -2011,9 +2005,8 @@ mod tests {
     }
 
     /// The `!silent` banner branch — "Using <label> at: <prefix>", printed
-    /// on global/global-prefix runs (`apply --global` shows it) — has never
-    /// executed for ANY labeled ecosystem: every existing dispatch test
-    /// passes `silent = true`. Drive it for all eight labeled ecosystems
+    /// on global/global-prefix runs (`apply --global` shows it). Drive it
+    /// for all eight labeled ecosystems
     /// (pypi's label is "" — deliberately suppressed) and pin the real
     /// output contract: an empty prefix resolves NOTHING, so the banner
     /// path must not fabricate phantom mappings. Every crawler's
diff --git a/crates/socket-patch-cli/src/json_envelope.rs b/crates/socket-patch-cli/src/json_envelope.rs
index 8b22bc52..42b0d950 100644
--- a/crates/socket-patch-cli/src/json_envelope.rs
+++ b/crates/socket-patch-cli/src/json_envelope.rs
@@ -1,8 +1,10 @@
 //! Unified JSON output envelope shared across every subcommand.
 //!
-//! Every `--json` invocation of socket-patch (whether `scan`, `apply`,
-//! `get`, `list`, `gc`/`repair`, `remove`, or `rollback`) emits the same
-//! top-level shape:
+//! The `--json` output of `apply`, `list`, `remove`, `repair`/`gc`,
+//! `vendor`, `self-update` and `vex --json --output` (and every command's
+//! lock-contention error) uses this top-level shape; `scan`, `get`,
+//! `rollback` and `setup` still emit their legacy shapes (see
+//! CLI_CONTRACT.md's migration status):
 //!
 //! ```json
 //! {
@@ -19,7 +21,7 @@
 //! one observable thing that happened during the run (a patch was
 //! downloaded, applied, skipped, etc.). A downstream consumer (PR-comment
 //! bot, dashboard, log shipper) only needs to learn this single vocabulary
-//! to interpret output from every subcommand.
+//! to interpret output from every envelope-emitting subcommand.
 //!
 //! See `CLI_CONTRACT.md` for the per-subcommand action matrix and example
 //! `jq` recipes.
@@ -28,7 +30,7 @@ use serde::Serialize;
 
 pub use socket_patch_core::patch::sidecars::{SidecarFile, SidecarFileAction, SidecarRecord};
 
-/// Top-level JSON envelope emitted by every `--json` invocation.
+/// Top-level JSON envelope (see the module doc for which commands emit it).
 #[derive(Debug, Clone, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct Envelope {
@@ -216,9 +218,8 @@ pub struct PatchEvent {
     pub error: Option<String>,
     /// Command-specific additional fields. Consumers MUST NOT depend on
     /// the shape of this object — different subcommands attach different
-    /// keys here. Used today for `list` (vulnerabilities, license, tier,
-    /// description) and `scan` (discovered metadata not covered by the
-    /// other event fields).
+    /// keys here, e.g. `list` (vulnerabilities, license, tier,
+    /// description).
     #[serde(skip_serializing_if = "Option::is_none")]
     pub details: Option<serde_json::Value>,
 }
@@ -313,20 +314,18 @@ pub struct PatchEventFile {
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub enum PatchAction {
-    /// `scan`: a patch exists upstream for this package, but no action
-    /// taken yet (no `--apply` / `--sync`).
+    /// `list`: a patch recorded for this package (hosted/vendored lockfile
+    /// reference or manifest entry).
     Discovered,
-    /// `get` / `scan --apply` / `apply` (online): patch bytes were
-    /// fetched from the registry.
+    /// Patch bytes were fetched from the registry.
     Downloaded,
-    /// `apply` / `scan --sync`: patch was applied to disk. `files`
-    /// enumerates which files changed.
+    /// `apply`: patch was applied to disk. `files` enumerates which files
+    /// changed.
     Applied,
-    /// `apply` / `scan --sync`: patch replaced an older patch (the
-    /// manifest already had a different UUID for this PURL). `oldUuid`
-    /// carries the previous UUID.
+    /// Patch replaced an older patch (the manifest already had a different
+    /// UUID for this PURL). `oldUuid` carries the previous UUID.
     Updated,
-    /// `apply` / `scan` / `get`: the patch was a no-op — already
+    /// The patch was a no-op — already
     /// applied, not in scope, or filtered out. `errorCode` carries the
     /// reason tag.
     Skipped,
@@ -336,7 +335,7 @@ pub enum PatchAction {
     /// `gc` / `repair` / `remove` / `rollback`: data was removed from
     /// `.socket/` (or from disk in the rollback case).
     Removed,
-    /// `apply --dry-run` / `scan --dry-run`: patch *would* apply
+    /// `apply --dry-run`: patch *would* apply
     /// cleanly. `files` lists what would change.
     Verified,
     /// `repair`: a missing/corrupt vendored artifact was rebuilt in place
@@ -396,9 +395,11 @@ pub enum Status {
     /// there's nothing to apply. Distinct from `Success` because some
     /// consumers want to early-exit on this state.
     NoManifest,
-    /// `get` / `scan`: the requested patch requires a paid plan but the
-    /// caller's API token isn't entitled. Distinct from `Error` so PR
-    /// bots can post a "upgrade your plan" comment instead of failing.
+    /// Reserved: the requested patch requires a paid plan but the caller's
+    /// API token isn't entitled. Nothing emits it yet (`get` reports this
+    /// via its legacy `status: "paid_required"` shape; scan never does).
+    /// Distinct from `Error` so PR bots can post a "upgrade your plan"
+    /// comment instead of failing.
     PaidRequired,
     /// `remove` / `rollback`: the patch identifier didn't resolve to
     /// anything in the local manifest.
diff --git a/crates/socket-patch-cli/src/path_scope.rs b/crates/socket-patch-cli/src/path_scope.rs
index dfa27a77..c67f4a86 100644
--- a/crates/socket-patch-cli/src/path_scope.rs
+++ b/crates/socket-patch-cli/src/path_scope.rs
@@ -1,4 +1,6 @@
-//! Path-glob scoping shared by `scan` and `rollback`.
+//! Path-glob scoping shared by agent-mode (and report-only) `scan` and
+//! `rollback`. (Hosted/vendored scan PATHS are project directories instead;
+//! see `run_project_dirs`.)
 //!
 //! A [`PathScope`] holds the user's positional PATH patterns and answers
 //! "is this installed-package directory in scope?". Matching rules
@@ -11,7 +13,7 @@
 //!   absolute patterns match the absolute path (the only way to scope
 //!   packages outside the project tree, e.g. `--global` stores).
 //! * A pattern that matches any ANCESTOR directory of the package path
-//!   also matches, so `scan packages/foo` scopes the whole subtree
+//!   also matches, so `scan --mode agent packages/foo` scopes the whole subtree
 //!   without needing an explicit `packages/foo/**`.
 //! * Matching is purely textual on `/`-normalized paths — no filesystem
 //!   access, no symlink resolution.
@@ -70,9 +72,6 @@ impl PathScope {
     pub fn parse(raw_patterns: &[String]) -> Result<Self, String> {
         let mut patterns = Vec::with_capacity(raw_patterns.len());
         let mut raw = Vec::with_capacity(raw_patterns.len());
-        // Lowercase on purpose: scan and rollback print this after a clap-style
-        // `error: ` usage-error prefix. Capitalize it together with those
-        // call sites if they move to `Error: `.
         for r in raw_patterns {
             let normalized = normalize_pattern(r);
             if normalized.is_empty() {
diff --git a/crates/socket-patch-cli/src/ui/prompt.rs b/crates/socket-patch-cli/src/ui/prompt.rs
index e9eabc8f..1895f0e1 100644
--- a/crates/socket-patch-cli/src/ui/prompt.rs
+++ b/crates/socket-patch-cli/src/ui/prompt.rs
@@ -185,9 +185,7 @@ pub enum SelectError {
 ///   `Ok(0)` would hand callers an out-of-bounds index.
 /// - stdin not a terminal: the first option, with
 ///   [`NON_INTERACTIVE_SELECT_FIRST`] unless `--silent` or the process is
-///   quiet ([`super::quiet`]; a caller that must never get
-///   `JsonModeNeedsExplicit`, like `scan`, passes its flags with `json`
-///   off, but a `--json` run still keeps the note off stderr).
+///   quiet ([`super::quiet`]).
 /// - Interactive: Esc/q/Ctrl-C cancel; the cursor is always restored.
 pub fn select_one(
     prompt: &str,
@@ -418,7 +416,7 @@ mod tests {
 
     #[test]
     fn eof_declines_even_when_default_is_yes() {
-        // Ctrl-D at "[Y/n]" used to mean yes and mutate the project.
+        // Ctrl-D at "[Y/n]" must not mean yes and mutate the project.
         let (answer, out) = run(b"", at_tty(true));
         assert!(!answer);
         assert_eq!(
diff --git a/crates/socket-patch-cli/tests/api_client_errors_e2e.rs b/crates/socket-patch-cli/tests/api_client_errors_e2e.rs
index d58abe80..ef9d2f75 100644
--- a/crates/socket-patch-cli/tests/api_client_errors_e2e.rs
+++ b/crates/socket-patch-cli/tests/api_client_errors_e2e.rs
@@ -1,14 +1,9 @@
 //! End-to-end tests for API client error paths — exercises 4xx/5xx/
 //! malformed responses + connection failure paths via wiremock.
 //!
-//! Hardening note (audit/test-review): every test in this file previously
-//! asserted only `code == 0 || code == 1`, which is satisfied by *both* a
-//! correct error-handling impl AND a broken one that silently swallows the
-//! failure and reports success. That is a disjoint-outcome loophole: it can
-//! never distinguish "handled the 401 gracefully" from "ignored the 401".
-//! Each test below now pins the *exact* exit code and inspects the JSON
-//! envelope (`status`/`error`) emitted on stdout, so a regression that turns
-//! a real API failure into a fake success fails the test loudly.
+//! Each test pins the *exact* exit code and inspects the JSON envelope
+//! (`status`/`error`) on stdout, so a regression that turns a real API
+//! failure into a fake success fails loudly.
 
 use std::path::{Path, PathBuf};
 use std::process::Command;
@@ -271,8 +266,8 @@ async fn get_uuid_with_malformed_json_reports_parse_error() {
 /// A scan whose only API batch is rejected (400) must NOT report success.
 /// A clean `status:"success"`/exit-0 here would tell a CI gate the project
 /// is fully scanned and patch-free when in fact the scan never reached the
-/// API — exactly the silent-zero failure the production comment at
-/// scan.rs:598-611 claims to prevent.
+/// API — exactly the silent-zero failure the "If every batch errored" block
+/// in `commands/scan/mod.rs` prevents.
 #[tokio::test]
 async fn scan_with_400_bad_request_reports_failure() {
     let mock = MockServer::start().await;
@@ -306,10 +301,8 @@ async fn scan_with_400_bad_request_reports_failure() {
     // calls the API) could also avoid "success" for the wrong reason.
     assert_path_hit(&mock, &format!("/v0/orgs/{ORG_SLUG}/patches/batch")).await;
     let v = json_stdout(&out);
-    // KNOWN PRODUCTION BUG (left red intentionally — see file summary):
-    // `scan` currently emits `status:"success"`/exit 0 even when every
-    // batch failed. The intended contract is that a fully-failed scan is
-    // surfaced, so a CI gate does not mistake it for "no vulnerabilities".
+    // A fully-failed scan must be surfaced so a CI gate does not mistake it
+    // for "no vulnerabilities".
     assert_ne!(
         v["status"], "success",
         "a scan where the only batch returned 400 must not report success; got: {v}"
@@ -377,7 +370,6 @@ async fn scan_with_unreachable_api_url_reports_failure() {
         .expect("run");
     let code = out.status.code().unwrap_or(-1);
     let v = json_stdout(&out);
-    // KNOWN PRODUCTION BUG (left red intentionally — see file summary).
     assert_ne!(
         v["status"], "success",
         "a scan where the only batch was unreachable must not report success; got: {v}"
diff --git a/crates/socket-patch-cli/tests/apply_invariants.rs b/crates/socket-patch-cli/tests/apply_invariants.rs
index 8e70e46a..6c41a148 100644
--- a/crates/socket-patch-cli/tests/apply_invariants.rs
+++ b/crates/socket-patch-cli/tests/apply_invariants.rs
@@ -230,11 +230,8 @@ fn write_mixed_scope_project(root: &Path) {
 /// THIS run. A patch filtered out by `--ecosystems` — or belonging to an
 /// ecosystem this build can't apply at all — will never be applied, so
 /// its missing `.socket/` sources must not fail a run whose in-scope
-/// patches are all locally applicable.
-///
-/// Before the fix, the guard scanned the WHOLE manifest: here the
-/// out-of-scope pypi patch (no blob on disk) tripped the offline bail and
-/// the fully-applicable npm patch was never applied (exit 1, no events).
+/// patches are all locally applicable: here the out-of-scope pypi patch
+/// (no blob on disk) must not trip the offline bail for the npm patch.
 #[test]
 fn offline_ecosystems_filter_ignores_out_of_scope_missing_source() {
     let tmp = tempfile::tempdir().expect("tempdir");
@@ -274,7 +271,7 @@ fn offline_ecosystems_filter_ignores_out_of_scope_missing_source() {
 
     // CONTROL: the same fixture WITHOUT the `--ecosystems` filter puts the
     // sourceless pypi patch in scope, so the documented offline bail must
-    // still fire — the fix scopes the guard, it does not disable it.
+    // still fire — the guard is scoped, not disabled.
     let tmp2 = tempfile::tempdir().expect("tempdir");
     write_mixed_scope_project(tmp2.path());
     let (code2, stdout2) = run_apply(tmp2.path(), &["--offline", "--silent"]);
@@ -509,9 +506,9 @@ fn apply_with_no_socket_dir_silent_emits_nothing() {
 /// Regression: only a genuine NotFound means "no `.socket/` set up". Any
 /// other stat error — an unreadable `.socket/` (root-owned directory,
 /// restrictive ACL), a plain file where `.socket/` should be, a symlink
-/// loop — used to take the very same `status: noManifest` / exit-0 path.
-/// A project whose patches were never even read then reported "nothing to
-/// apply", which the install hook and CI both read as success. Fail closed.
+/// loop — must NOT take the `status: noManifest` / exit-0 path: a project
+/// whose patches were never even read would report "nothing to apply",
+/// which the install hook and CI both read as success. Fail closed.
 #[cfg(unix)]
 #[test]
 #[ignore = "RED: apply's manifest probe is `tokio::fs::metadata(..).is_err()`, so \
diff --git a/crates/socket-patch-cli/tests/apply_network.rs b/crates/socket-patch-cli/tests/apply_network.rs
index 562feae4..2c01ebb8 100644
--- a/crates/socket-patch-cli/tests/apply_network.rs
+++ b/crates/socket-patch-cli/tests/apply_network.rs
@@ -87,8 +87,8 @@ fn write_manifest_with_patch(
 }
 
 fn run_apply(cwd: &Path, api_url: &str, extra: &[&str]) -> (i32, String, String) {
-    // CLI rejects --api-token / --api-url / --org on apply (those are
-    // rollback-only flags) — apply respects them via env vars instead.
+    // Pass the API URL/token/org via env vars (equivalent to the global
+    // --api-url/--api-token/--org flags).
     let mut argv: Vec<&str> = vec!["apply", "--json"];
     argv.extend_from_slice(extra);
     let out = Command::new(binary())
@@ -246,12 +246,10 @@ async fn apply_with_ecosystem_filter_excluding_npm_skips_all_npm_patches() {
     // Filtering out npm leaves nothing in scope: there is genuinely no
     // work this run can do, so apply is a clean no-op SUCCESS (exit 0) —
     // the same documented contract as an empty manifest (npm `postinstall`
-    // runs `apply` on every install). This test previously pinned exit
-    // 1/partialFailure, but that outcome was an artifact of a scoping bug:
-    // the excluded npm patch's missing artifacts were fetched (and failed,
-    // against this route-less mock) BEFORE the `--ecosystems` filter was
-    // applied, so the run never reached the no-in-scope success path. The
-    // filter now scopes the source probes and download planner up front.
+    // runs `apply` on every install). The `--ecosystems` filter scopes the
+    // source probes and download planner up front, so the excluded npm
+    // patch's missing artifacts are never fetched against this route-less
+    // mock.
     assert_eq!(
         code, 0,
         "ecosystem filter with nothing in scope is a clean no-op success; stdout={stdout}; stderr={stderr}"
@@ -524,8 +522,7 @@ async fn apply_hash_mismatch_default_warns_and_applies_strict_fails() {
         "stderr warning present: {stderr}"
     );
 
-    // --strict: the old fail-closed contract — exit 1, failed event, file
-    // untouched.
+    // --strict: fail closed — exit 1, failed event, file untouched.
     let tmp = fixture();
     let out = Command::new(binary())
         .args(["apply", "--json", "--offline", "--strict"])
@@ -906,12 +903,10 @@ fn write_package_archive(packages: &Path, uuid: &str, entries: &[(&str, &[u8])])
 
 /// A cached `.socket/packages/<uuid>.tar.gz` is a complete source for the
 /// patch: the same tree applies fine under `--offline`. Going online must
-/// not make it FAIL — but the stage step used to bail whenever the
-/// (default) diff fetch and the blob fallback both reported failures,
-/// without checking whether any patch was actually left without a source.
-/// A server that serves no archives and no longer has the blob (GC'd,
-/// entitlement change, dead network) therefore turned a fully satisfiable
-/// apply into a whole-run abort.
+/// not make it FAIL: when the (default) diff fetch and the blob fallback
+/// both fail (no archives served, blob GC'd, entitlement change, dead
+/// network), the stage step must only bail if some patch is actually left
+/// without a source.
 #[tokio::test]
 async fn apply_online_uses_cached_package_archive_when_downloads_fail() {
     let before = b"pkgcache before\n";
@@ -996,9 +991,8 @@ async fn apply_online_uses_cached_package_archive_when_downloads_fail() {
 /// stage step download nothing, so the on-demand mismatch top-up is the
 /// ONLY chance to fetch the full afterHash blob the nested copy needs under
 /// the default warn-and-overwrite policy — and copies drift independently,
-/// so the top-up must probe EVERY copy. Before the fix it probed only the
-/// first (root) copy, found it clean, queued nothing, and the nested copy
-/// failed to apply (exit 1) — the very failure the top-up exists to prevent.
+/// so the top-up must probe EVERY copy, not just the first (clean, root)
+/// one.
 #[tokio::test]
 async fn mismatch_blob_topup_probes_every_copy_of_a_duplicated_package() {
     let before = b"before\n";
diff --git a/crates/socket-patch-cli/tests/cli_apply_silent.rs b/crates/socket-patch-cli/tests/cli_apply_silent.rs
index 49a8fb9a..3f3c5c02 100644
--- a/crates/socket-patch-cli/tests/cli_apply_silent.rs
+++ b/crates/socket-patch-cli/tests/cli_apply_silent.rs
@@ -15,9 +15,6 @@
 //! 4. `apply --check --silent` with real redirect drift exited 1 with zero
 //!    output (the OUT OF SYNC report was muted).
 //!
-//! Same bug class previously fixed in `scan` (`embed_vex_human`), `setup`
-//! (all three modes), and apply's own yarn-PnP refusal.
-//!
 //! Stderr assertions ignore the "No SOCKET_API_TOKEN set" client warning:
 //! it's printed by `get_api_client_with_overrides` in core for every ONLINE
 //! command (offline runs suppress it — see
diff --git a/crates/socket-patch-cli/tests/cli_config_fallback.rs b/crates/socket-patch-cli/tests/cli_config_fallback.rs
index dc09b57a..a919ab99 100644
--- a/crates/socket-patch-cli/tests/cli_config_fallback.rs
+++ b/crates/socket-patch-cli/tests/cli_config_fallback.rs
@@ -50,7 +50,7 @@ fn write_config(data_dir: &Path, json: &serde_json::Value) {
     std::fs::write(dir.join("config.json"), encoded).unwrap();
 }
 
-/// Build a hermetic `socket-patch scan --json -e npm` command: every
+/// Build a hermetic human-mode `socket-patch scan -e npm --cwd <project>` command: every
 /// ambient `SOCKET_*` var is scrubbed (including the inherited
 /// `SOCKET_NO_CONFIG=1` guard — tests re-add exactly what they need), the
 /// data dir points at `data_dir`, and the project dir is an empty npm
diff --git a/crates/socket-patch-cli/tests/cli_gem_variant_mismatch_policy.rs b/crates/socket-patch-cli/tests/cli_gem_variant_mismatch_policy.rs
index 25adf4f0..94a4919d 100644
--- a/crates/socket-patch-cli/tests/cli_gem_variant_mismatch_policy.rs
+++ b/crates/socket-patch-cli/tests/cli_gem_variant_mismatch_policy.rs
@@ -5,12 +5,10 @@
 //! `--strict` refuses, `--force` also skips missing files (see
 //! `apply_network.rs::apply_hash_mismatch_default_warns_and_applies_strict_fails`).
 //! Release-variant ecosystems (gem/pypi/maven) route through the variant
-//! loop instead, whose installed-distribution gate used to skip ANY
-//! variant whose representative file mismatched — making the default
-//! policy unreachable for them: an UNQUALIFIED SINGLETON base (one bare
-//! manifest record for the `package@version`, the common case) with a
-//! locally-modified file failed with "no matching variant found" instead
-//! of warn-overwriting.
+//! loop instead, whose installed-distribution gate must still let the
+//! default policy reach an UNQUALIFIED SINGLETON base (one bare manifest
+//! record for the `package@version`, the common case) with a
+//! locally-modified file: warn-overwrite, not "no matching variant found".
 //!
 //! Behaviors pinned (all offline, real binary, synthetic gem trees):
 //!   * unqualified singleton + locally-modified file: default apply warns
@@ -168,8 +166,7 @@ fn singleton_fixture(cwd: &Path) -> (PathBuf, Vec<u8>) {
 
 /// Default policy: the singleton's local modification is overwritten with
 /// the full verified patched content and surfaced as a warning — the same
-/// npm contract, previously unreachable for gem (the run failed with
-/// "no matching variant found" and left the file untouched).
+/// npm contract, not "no matching variant found" with the file untouched.
 #[test]
 fn singleton_mismatch_default_warns_and_applies() {
     let tmp = tempfile::tempdir().expect("tempdir");
diff --git a/crates/socket-patch-cli/tests/cli_global_args.rs b/crates/socket-patch-cli/tests/cli_global_args.rs
index 65cebdd0..e3741e59 100644
--- a/crates/socket-patch-cli/tests/cli_global_args.rs
+++ b/crates/socket-patch-cli/tests/cli_global_args.rs
@@ -531,12 +531,9 @@ fn env_vars_populate_global_args() {
     }
 }
 
-/// Regression: bool env vars accept "1"/"yes" (the conventional truthy
-/// strings), not just clap's strict "true"/"false". Before
-/// BoolishValueParser was wired onto every bool with env, setting
-/// SOCKET_OFFLINE=1 (or SOCKET_DEBUG=1) crashed clap with
-/// `error: invalid value '1' for '--offline'`, taking down every
-/// downstream CLI run that follows the conventional shell idiom.
+/// Bool env vars accept "1"/"yes" (the conventional truthy strings), not
+/// just clap's strict "true"/"false": `SOCKET_OFFLINE=1` (or
+/// `SOCKET_DEBUG=1`) must not fail with `invalid value '1' for '--offline'`.
 ///
 /// `#[serial]` because env-var state is process-global; without it
 /// these tests race each other (and the existing
@@ -654,14 +651,11 @@ fn bool_env_vars_reject_zero_and_falsey() {
 
 /// An **empty** boolean env var resolves to `false` — it must NOT crash.
 ///
-/// FIXED (2026-06-05): `SOCKET_OFFLINE=` (the conventional shell idiom for
-/// blanking a variable without unsetting it) previously made clap fail with a
-/// `ValueValidation` error via the stock `BoolishValueParser`, which rejects
-/// `""`. That took down *every* CLI invocation, on *every* subcommand, for
-/// *every* boolean global — an operator who blanked the var to disable airgap
-/// mode got a hard crash instead. `args::parse_bool_flag` now maps an empty
-/// (or whitespace-only) value to `false`. This test pins the fixed behavior:
-/// every boolean global parses cleanly to `false` when its env var is empty.
+/// `SOCKET_OFFLINE=` (the conventional shell idiom for blanking a variable
+/// without unsetting it) must not fail validation the way the stock
+/// `BoolishValueParser` does on `""`: `args::parse_bool_flag` maps an empty
+/// (or whitespace-only) value to `false`, so every boolean global parses
+/// cleanly to `false` when its env var is empty.
 #[test]
 #[serial_test::serial]
 fn empty_bool_env_var_resolves_to_false_not_crash() {
@@ -708,10 +702,8 @@ fn empty_bool_env_var_resolves_to_false_not_crash() {
 
 /// Every `SOCKET_*` env var that `GlobalArgs` binds, so tests that need a
 /// clean slate can save/clear/restore them in one place. This is the
-/// production list itself — a private copy already went stale once
-/// (`SOCKET_STRICT` + the vendor knobs were missing, so ambient values
-/// survived the "clean slate" and could taint every parse in this file);
-/// `save_and_clear_covers_every_bound_global_env_var` above pins the fix.
+/// production list itself, so it cannot drift from the bound flags;
+/// `save_and_clear_covers_every_bound_global_env_var` below pins that.
 use socket_patch_cli::args::GLOBAL_ARG_ENV_VARS as GLOBAL_ENV_VARS;
 
 /// An exported-but-**empty** non-bool env var must mean "unset", not crash.
diff --git a/crates/socket-patch-cli/tests/cli_parse_apply.rs b/crates/socket-patch-cli/tests/cli_parse_apply.rs
index 691e8575..f68ae72d 100644
--- a/crates/socket-patch-cli/tests/cli_parse_apply.rs
+++ b/crates/socket-patch-cli/tests/cli_parse_apply.rs
@@ -84,9 +84,9 @@ fn defaults_match_contract() {
     assert!(!a.common.verbose);
     assert_eq!(a.common.download_mode, "diff");
 
-    // The remaining global defaults from the contract table. These were
-    // previously unpinned, which let a dangerous default-value drift slip
-    // through silently — e.g. `--yes` defaulting to `true` would make
+    // The remaining global defaults from the contract table, pinned so a
+    // dangerous default-value drift cannot slip through silently — e.g.
+    // `--yes` defaulting to `true` would make
     // `apply` auto-approve every prompt. The API/proxy URLs parse to `None`
     // (no clap default) — the documented production URLs are applied by
     // `get_api_client_with_overrides` after env + socket-cli config fallback.
@@ -116,8 +116,9 @@ fn defaults_match_contract() {
     assert_only_true(&a, &[]);
 }
 
-/// `--check` (cargo redirect audit mode) must parse and flip the flag true.
-/// It uses a `BoolishValueParser`, so the bare flag form is the canonical use.
+/// `--check` (read-only Go replace-redirect audit mode) must parse and flip
+/// the flag true. It uses `parse_bool_flag`, so the bare flag form is the
+/// canonical use.
 #[test]
 fn check_long() {
     let a = parse_apply(&["--check"]);
@@ -492,7 +493,7 @@ fn ecosystems_single_value() {
 }
 
 // ---------------------------------------------------------------------------
-// --download-mode — accepted token values are documented contract.
+// --download-mode — the parse layer passes tokens through verbatim.
 // ---------------------------------------------------------------------------
 
 #[test]
@@ -537,7 +538,8 @@ fn download_mode_values_are_not_normalized() {
             .download_mode,
         "DIFF"
     );
-    // The three valid tokens are distinct and round-trip exactly.
+    // diff/file are the valid runtime tokens; `package` (removed) is still
+    // passed through verbatim by the parse layer.
     for token in ["diff", "package", "file"] {
         let got = parse_apply(&["--download-mode", token])
             .common
@@ -550,10 +552,11 @@ fn download_mode_values_are_not_normalized() {
 }
 
 /// CONTRACT GAP (documented, not a hardening of a passing behavior): the
-/// contract types `--download-mode` as `enum: diff | package | file`, but the
-/// arg is a plain `String` with no `value_parser`, so clap accepts ANY value
-/// at parse time. Invalid values are only rejected later by
-/// `DownloadMode::parse` at runtime (see `commands/apply.rs`). This test pins
+/// accepted runtime values are `diff | file` (`blob` is an alias; `package`
+/// is rejected as removed), but the arg is a plain `String` with no
+/// `value_parser`, so clap accepts ANY value at parse time. Invalid values are
+/// only rejected later by `DownloadMode::parse` (socket-patch-core
+/// `api/blob_fetcher.rs`, called from `commands/fetch_stage.rs`). This test pins
 /// the *current* parse-layer behavior so a future move to a real
 /// `value_parser`/enum (which WOULD reject here) is a deliberate, visible
 /// change rather than a silent one. If the enum is enforced at parse, flip the
diff --git a/crates/socket-patch-cli/tests/cli_parse_get.rs b/crates/socket-patch-cli/tests/cli_parse_get.rs
index 43709677..9d50c0e2 100644
--- a/crates/socket-patch-cli/tests/cli_parse_get.rs
+++ b/crates/socket-patch-cli/tests/cli_parse_get.rs
@@ -247,7 +247,7 @@ fn expected_defaults(identifier: &str) -> Snap {
 fn defaults_with_only_required_identifier() {
     let a = parse_get(&["some-id"]);
     // Pin the *entire* default surface in one shot against the independent
-    // oracle. This covers fields the old test silently skipped (manifest_path,
+    // oracle. This covers every field (manifest_path,
     // proxy_url, offline, verbose, silent, dry_run, lock_timeout,
     // debug, no_telemetry, ecosystems) — any of which could regress to a
     // non-default and go unnoticed under a field-cherry-picked assertion.
@@ -491,7 +491,7 @@ fn download_mode_file() {
     assert_eq!(snapshot(&a), want);
 }
 
-// --- `--mode` selector (v3.6) --------------------------------------------
+// --- `--mode` selector (v4.0) --------------------------------------------
 //
 // `get --mode <hosted|vendored|agent>` reuses scan's `ScanMode` value-enum
 // (see cli_parse_scan.rs) so the two commands can never drift on mode
diff --git a/crates/socket-patch-cli/tests/cli_parse_list.rs b/crates/socket-patch-cli/tests/cli_parse_list.rs
index ad6b3939..5e5dd991 100644
--- a/crates/socket-patch-cli/tests/cli_parse_list.rs
+++ b/crates/socket-patch-cli/tests/cli_parse_list.rs
@@ -368,9 +368,8 @@ fn empty_file_manifest_reports_manifest_invalid_via_binary() {
 fn missing_manifest_under_valid_cwd_reports_manifest_not_found_via_binary() {
     // The common missing-manifest case: cwd exists, but `.socket/manifest.json`
     // does not. `read_manifest` returns `Ok(None)` here, which must surface as
-    // `manifest_not_found` — NOT `manifest_invalid`. (Regression: the `Ok(None)`
-    // arm previously hard-coded `manifest_invalid`, telling consumers a missing
-    // file was corrupt. It was masked by a now-removed metadata pre-check.)
+    // `manifest_not_found` — NOT `manifest_invalid`, which would tell
+    // consumers a missing file was corrupt.
     let tmp = tempfile::tempdir().unwrap();
     let out = run_list_binary(tmp.path(), &["--json"]);
     let v: serde_json::Value = serde_json::from_str(String::from_utf8_lossy(&out.stdout).trim())
@@ -398,11 +397,8 @@ fn manifest_path_is_existing_directory_reports_unreadable_via_binary() {
     // path because the latter is `ENOTDIR` on Unix but a NotFound-class error
     // on Windows, where traversing through a file is legitimately "path not
     // found"; a directory yields a non-NotFound error on every platform.)
-    //
-    // Regression: `run()` used to stat the path with `tokio::fs::metadata`
-    // first and treat ANY stat failure as `manifest_not_found`, masking real
-    // I/O errors. Removing that pre-check lets `read_manifest`'s I/O error
-    // classify it correctly.
+    // A stat failure must not be folded into `manifest_not_found`:
+    // `read_manifest`'s I/O error classifies it.
     let tmp = tempfile::tempdir().unwrap();
     let manifest_path = tmp.path().join("manifest-is-a-dir");
     std::fs::create_dir(&manifest_path).unwrap();
@@ -866,10 +862,8 @@ fn absolute_manifest_path_content_wins_over_cwd_via_binary() {
 
 // ---------------------------------------------------------------------------
 // `--silent` contract — CLI_CONTRACT.md defines `--silent` as "Errors only".
-// Regression guard: `run()` gated the human-readable listing on `!json`
-// alone, so `list --silent` still printed the full patch table (and the
-// "No patches found in manifest." line for an empty manifest). Mirrors the
-// `get --silent` / `repair --silent` regressions fixed earlier.
+// `list --silent` must print neither the patch table nor the "No patches
+// found in manifest." line for an empty manifest.
 // ---------------------------------------------------------------------------
 
 /// Like [`run_list_binary`] but with every `GlobalArgs` env var scrubbed,
@@ -1288,10 +1282,10 @@ fn silent_gates_the_malformed_ledger_warning_via_binary() {
 
 // ---------------------------------------------------------------------------
 // `--manifest-path` store scoping — both stores must come from the SAME
-// project. The redirect ledger used to be resolved against cwd
-// unconditionally, so pointing `--manifest-path` at another project's
-// manifest interleaved two projects' patch state (and a LOCAL ledger could
-// suppress the flagged project's manifest_not_found).
+// project. Resolving the redirect ledger against cwd instead would
+// interleave two projects' patch state when `--manifest-path` points at
+// another project's manifest (and a LOCAL ledger could suppress the flagged
+// project's manifest_not_found).
 // ---------------------------------------------------------------------------
 
 #[test]
diff --git a/crates/socket-patch-cli/tests/cli_parse_repair.rs b/crates/socket-patch-cli/tests/cli_parse_repair.rs
index 474b6fcb..c83b6f80 100644
--- a/crates/socket-patch-cli/tests/cli_parse_repair.rs
+++ b/crates/socket-patch-cli/tests/cli_parse_repair.rs
@@ -494,8 +494,9 @@ fn repair_unknown_flag_is_unknown_argument_error() {
 
 // --- `gc` is a first-class visible alias for `repair` ---------------------
 //
-// `scan --sync` is the recommended combined workflow, but `gc`/`repair`
-// remain documented commands for users who want to clean up without an
+// `scan --mode agent --prune` (or `--sync`) combines apply and GC in one
+// pass, but `gc`/`repair` remain documented commands for users who want to
+// clean up without an
 // apply pass. These tests guard the `visible_alias = "gc"` attribute on
 // `Commands::Repair` — if a future refactor demotes the alias (to
 // `alias = "gc"` or removes it entirely), the help output check below
diff --git a/crates/socket-patch-cli/tests/cli_parse_rollback.rs b/crates/socket-patch-cli/tests/cli_parse_rollback.rs
index d46f04b8..79787517 100644
--- a/crates/socket-patch-cli/tests/cli_parse_rollback.rs
+++ b/crates/socket-patch-cli/tests/cli_parse_rollback.rs
@@ -362,7 +362,7 @@ fn all_short_flags_map_to_distinct_fields() {
 /// Bare boolean flags are `SetTrue` (num_args = 0): they must NOT swallow the
 /// following token as a value. If `--one-off` silently became value-taking, a
 /// wrapper invoking `rollback --one-off <purl>` would change meaning (the purl
-/// would be consumed as the flag's value, not the `identifier` positional).
+/// would be consumed as the flag's value, not the `targets` positional).
 #[test]
 fn bare_bool_does_not_consume_next_token() {
     let args = parse_rollback(&["--one-off", "pkg:npm/foo@1"]);
diff --git a/crates/socket-patch-cli/tests/cli_parse_scan.rs b/crates/socket-patch-cli/tests/cli_parse_scan.rs
index 06863f78..c172901b 100644
--- a/crates/socket-patch-cli/tests/cli_parse_scan.rs
+++ b/crates/socket-patch-cli/tests/cli_parse_scan.rs
@@ -28,7 +28,7 @@ use socket_patch_cli::{Cli, Commands};
 /// so the process-global mutation can't race a concurrent test.
 ///
 /// Keep this list in sync with `env = "SOCKET_*"` attrs in
-/// `src/args.rs`, `src/commands/scan.rs`, and `src/commands/vex.rs`.
+/// `src/args.rs`, `src/commands/scan/mod.rs`, and `src/commands/vex.rs`.
 const SCAN_ENV_VARS: &[&str] = &[
     "SOCKET_ALL_RELEASES",
     "SOCKET_API_TOKEN",
@@ -384,10 +384,11 @@ fn unknown_flag_fails() {
 
 // --- `--apply` flag and JSON shape ----------------------------------------
 //
-// `--apply` opts JSON callers into the full discover → select → apply
-// pipeline (read-only stays the default for backwards compatibility). The
-// subprocess test below also locks in the new `updates` key that bots rely
-// on to summarize what would change.
+// `--apply` (== `--mode agent`) opts callers into the discover → select →
+// apply pipeline; a bare scan defaults to hosted mode, and only
+// `--prune`/global scans without a mode are report-only. The subprocess test
+// below also locks in the `updates` key that bots rely on to summarize what
+// would change.
 
 #[test]
 #[serial_test::serial]
@@ -464,13 +465,11 @@ fn scan_json_empty_cwd_emits_updates_key() {
     // `scan::run`, where the whole result object — including `updates` — is
     // a hardcoded literal. It does NOT cover `detect_updates`, the real
     // function that populates `updates` once packages with patches are
-    // discovered (that path needs live API results and cannot run
-    // hermetically here, and `detect_updates` is `pub(crate)` so it can't
-    // be unit-tested from this integration crate). What this test CAN do is
-    // lock the empty-scan JSON contract *exactly*, so a regression that
-    // drops/renames a key, flips a default count, or leaks an unexpected
-    // `gc`/`apply`/`vex` sub-object onto the read-only default path fails
-    // loudly. See the summary for the uncovered `detect_updates` gap.
+    // discovered; `detect_updates` (pub(super)) is covered by the unit tests
+    // in `src/commands/scan/discovery.rs`). What this test CAN do is lock the
+    // empty-scan JSON contract *exactly*, so a regression that drops/renames
+    // a key, flips a default count, or leaks an unexpected `gc`/`apply`/`vex`
+    // sub-object onto the hosted default path fails loudly.
     let bin = env!("CARGO_BIN_EXE_socket-patch");
     let tmp = tempfile::tempdir().expect("tempdir");
     let mut cmd = std::process::Command::new(bin);
@@ -836,10 +835,8 @@ fn mode_alias_host_folds_to_redirect() {
 #[test]
 #[serial_test::serial]
 fn mode_alias_redirect_folds_to_hosted() {
-    // `redirect` is the legacy FLAG spelling (`--redirect`); pre-fix the
-    // value aliases were asymmetric — `--mode vendor`/`--mode host` parsed
-    // while `--mode redirect` was rejected, even though `--redirect` itself
-    // still folds to hosted.
+    // `redirect` is the legacy FLAG spelling (`--redirect`); the value
+    // aliases stay symmetric with `--mode vendor`/`--mode host`.
     assert_eq!(
         parse_scan(&["--mode", "redirect"]).mode,
         Some(ScanMode::Hosted)
diff --git a/crates/socket-patch-cli/tests/cli_parse_setup.rs b/crates/socket-patch-cli/tests/cli_parse_setup.rs
index a17bfe31..085df8ce 100644
--- a/crates/socket-patch-cli/tests/cli_parse_setup.rs
+++ b/crates/socket-patch-cli/tests/cli_parse_setup.rs
@@ -92,9 +92,9 @@ fn remove_long_form() {
 fn ecosystems_flag_parses_on_setup() {
     // Setup command contract, property 2 ("ecosystem-scoped"): `setup` accepts
     // the global `--ecosystems` filter (long form + the `-e` short form, CSV
-    // split). This pins the *parse* surface only; whether `setup` actually
-    // restricts its work to the named ecosystems at runtime is a separate
-    // (currently unimplemented) guarantee, RED-guarded in setup_contract_gaps.rs.
+    // split). This pins the *parse* surface only; whether `setup` restricts
+    // its work to the named ecosystems at runtime is covered by
+    // setup_contract_gaps::setup_ecosystems_filter_scopes_work_to_named_ecosystem.
     let long = parse_setup(&["--ecosystems", "npm,cargo"]);
     assert_eq!(
         long.common.ecosystems.as_deref(),
diff --git a/crates/socket-patch-cli/tests/cli_parse_vex.rs b/crates/socket-patch-cli/tests/cli_parse_vex.rs
index d7d65fd2..444d167d 100644
--- a/crates/socket-patch-cli/tests/cli_parse_vex.rs
+++ b/crates/socket-patch-cli/tests/cli_parse_vex.rs
@@ -158,7 +158,7 @@ fn truthy_vex_compact_env_sets_flag_on_vex() {
 /// `VexEmbedArgs` shares the env var names with the standalone flags, so an
 /// ambient `SOCKET_VEX_NO_VERIFY=1` must also parse (and set
 /// `--vex-no-verify`) on `apply` — this is the postinstall-hook blast
-/// radius: before the fix the env var aborted every `apply` run.
+/// radius: a parse failure here would abort every `apply` run.
 #[test]
 #[serial_test::serial]
 fn truthy_vex_no_verify_env_sets_embedded_flag_on_apply() {
diff --git a/crates/socket-patch-cli/tests/cli_remove_silent.rs b/crates/socket-patch-cli/tests/cli_remove_silent.rs
index 46d2721c..fb8acebe 100644
--- a/crates/socket-patch-cli/tests/cli_remove_silent.rs
+++ b/crates/socket-patch-cli/tests/cli_remove_silent.rs
@@ -1,11 +1,8 @@
 //! `remove --silent` contract tests.
 //!
-//! CLI_CONTRACT.md defines `--silent` as "Errors only". Regression
-//! guard: `remove` gated all of its human-readable chatter on `!json`
-//! alone, and passed only `json` as `rollback_patches`' silent param —
-//! so `remove --silent` printed everything. Same bug class previously
-//! fixed in `list`, `repair`, and `get`. Runs fully offline: the patch
-//! record has no
+//! CLI_CONTRACT.md defines `--silent` as "Errors only": `remove`'s
+//! human-readable chatter (and the nested rollback's) must be muted, not
+//! just gated on `!json`. Runs fully offline: the patch record has no
 //! files (so rollback fetches no blobs) and the project dir has no
 //! installed packages, so the internal rollback takes the
 //! "not installed" path and the manifest mutation needs no network.
diff --git a/crates/socket-patch-cli/tests/cli_rollback_silent.rs b/crates/socket-patch-cli/tests/cli_rollback_silent.rs
index f98fbaa3..3603b56c 100644
--- a/crates/socket-patch-cli/tests/cli_rollback_silent.rs
+++ b/crates/socket-patch-cli/tests/cli_rollback_silent.rs
@@ -14,9 +14,6 @@
 //! 5. `rollback --silent` with a per-package failure (installed file
 //!    modified after patching — hash mismatch) exited 1 with zero output.
 //!
-//! Same bug class previously fixed in `scan` (`embed_vex_human`), `setup`
-//! (all three modes), `apply` (`--silent`/`--check` mutes), and `remove`.
-//!
 //! Stderr assertions ignore the "No SOCKET_API_TOKEN set" client warning:
 //! it's printed by `get_api_client_with_overrides` in core for every ONLINE
 //! command (offline runs suppress it) and is out of scope for `rollback`'s
diff --git a/crates/socket-patch-cli/tests/cli_scan_silent.rs b/crates/socket-patch-cli/tests/cli_scan_silent.rs
index 31cb2710..fe3b4456 100644
--- a/crates/socket-patch-cli/tests/cli_scan_silent.rs
+++ b/crates/socket-patch-cli/tests/cli_scan_silent.rs
@@ -1,14 +1,10 @@
 //! `scan --silent` contract tests.
 //!
-//! CLI_CONTRACT.md defines `--silent` as "Errors only". Regression
-//! guard: `scan` gated all of its human-readable output on `!json`
-//! alone — the "No packages found" hint, the "Found N packages" /
-//! "Found N patches" stderr chatter, the results table, the summary,
-//! the "Patches to apply" listing, and the post-apply GC line all
-//! printed under `--silent` — and the human download path hardcoded
-//! `silent: false` into `DownloadParams`, so the nested apply step's
-//! progress printed too. Same bug class previously fixed in `list`,
-//! `repair`, `get`, and `remove`.
+//! CLI_CONTRACT.md defines `--silent` as "Errors only": the "No packages
+//! found" hint, the "Found N packages" / "Found N patches" stderr chatter,
+//! the results table, the summary, the "Patches to apply" listing, the
+//! post-apply GC line, and the nested apply step's progress must all be
+//! muted under `--silent` (not just gated on `!json`).
 //!
 //! The apply-flow test runs against a wiremock API (same fixture shape
 //! as `scan_sync_e2e.rs`) so the full human-mode scan→select→download→
@@ -365,9 +361,8 @@ fn seed_manifest_with_gone_entry(root: &Path) {
 
 /// The vendored-mode GC line must honor `--silent` like the apply-mode one
 /// does: `scan --vendor --prune --silent --yes` prints nothing when it
-/// succeeds. Regression guard: `run_vendor_interactive_path` printed
-/// "GC: pruned N manifest entries and removed …" (and the vendored-revert GC line)
-/// unconditionally.
+/// succeeds: `run_vendor_interactive_path` must not print "GC: pruned N
+/// manifest entries and removed …" (or the vendored-revert GC line).
 #[tokio::test]
 async fn scan_vendor_silent_gc_prints_nothing() {
     let purl = "pkg:npm/silent-target@1.0.0";
@@ -522,10 +517,8 @@ fn scan_silent_vex_failure_keeps_error_output() {
 /// under `--silent` too ("errors only", not "nothing"): `scan --redirect
 /// --vex out.json --silent` with nothing to attest (the reference is
 /// forbidden, no manifest exists) exits 1, and the failure message must
-/// still reach stderr. Regression guard: `run_redirect` printed its
-/// `vex_error` inside the `!silent` human branch, so the run failed with
-/// exit 1 and no output at all — the same bug `embed_vex_human` already
-/// fixed on the non-redirect path (see
+/// still reach stderr: `run_redirect`'s `vex_error` must not sit inside the
+/// `!silent` human branch (the non-redirect twin is
 /// `scan_silent_vex_failure_keeps_error_output` above).
 #[tokio::test]
 async fn scan_redirect_silent_vex_failure_keeps_error_output() {
diff --git a/crates/socket-patch-cli/tests/cli_setup_silent.rs b/crates/socket-patch-cli/tests/cli_setup_silent.rs
index 89ee92b4..e5d37ee7 100644
--- a/crates/socket-patch-cli/tests/cli_setup_silent.rs
+++ b/crates/socket-patch-cli/tests/cli_setup_silent.rs
@@ -1,12 +1,10 @@
 //! `setup --silent` contract tests.
 //!
-//! CLI_CONTRACT.md defines `--silent` as "Errors only". Regression
-//! guard: `setup` (and its `--check` / `--remove` modes) gated all of
-//! its human-readable output on `!json` alone — the "Configuring..." /
+//! CLI_CONTRACT.md defines `--silent` as "Errors only": `setup` (and its
+//! `--check` / `--remove` modes) must mute the "Configuring..." /
 //! "Searching..." headers, the previews, the summaries, the
-//! configuration-status report, and the commit hints all printed under
-//! `--silent`. Same bug class previously fixed in `list`, `repair`,
-//! `get`, `remove`, and `scan`.
+//! configuration-status report, and the commit hints (not just gate them
+//! on `!json`).
 //!
 //! `--silent` suppresses informational output only: the mutation still
 //! happens, exit codes still distinguish states, and (matching the
diff --git a/crates/socket-patch-cli/tests/common/update_fixture.rs b/crates/socket-patch-cli/tests/common/update_fixture.rs
index 8c433344..4c567c12 100644
--- a/crates/socket-patch-cli/tests/common/update_fixture.rs
+++ b/crates/socket-patch-cli/tests/common/update_fixture.rs
@@ -541,8 +541,7 @@ mod fixture_selftests {
     /// `open` and its `exec` inherits the still-open write fd, and our
     /// `exec` in that window fails with "Text file busy" (os error 26).
     /// The window is a fork/exec race, not a property of the binary, so
-    /// retry briefly rather than failing the run. Observed on
-    /// `ubuntu-latest` here and on PR #139's `coverage` job.
+    /// retry briefly rather than failing the run.
     fn exec_freshly_written(path: &std::path::Path) -> std::process::Output {
         let deadline = std::time::Instant::now() + std::time::Duration::from_secs(10);
         loop {
diff --git a/crates/socket-patch-cli/tests/coverage_fix_apply_silent_mute_exit.rs b/crates/socket-patch-cli/tests/coverage_fix_apply_silent_mute_exit.rs
index a56820e7..444dd2a3 100644
--- a/crates/socket-patch-cli/tests/coverage_fix_apply_silent_mute_exit.rs
+++ b/crates/socket-patch-cli/tests/coverage_fix_apply_silent_mute_exit.rs
@@ -12,9 +12,8 @@
 //!    exited 1 with zero output (the "Some artifacts could not be
 //!    downloaded" line was gated on `!quiet`, i.e. muted by `--silent`).
 //!
-//! Same class previously fixed in four other apply paths (see
-//! `cli_apply_silent.rs`), in scan, and in setup; `rollback --silent
-//! --offline` (`cli_rollback_silent.rs`) pins the same rule for rollback.
+//! Sibling suites: `cli_apply_silent.rs` (other apply paths) and
+//! `cli_rollback_silent.rs` (the same rule for rollback).
 //!
 //! Under `--json` both diagnostics stay off stderr — the envelope is the
 //! machine channel, and `apply_invariants.rs` pins its exact shape for
diff --git a/crates/socket-patch-cli/tests/coverage_fix_get_double_json.rs b/crates/socket-patch-cli/tests/coverage_fix_get_double_json.rs
index cdd6a728..2c84264b 100644
--- a/crates/socket-patch-cli/tests/coverage_fix_get_double_json.rs
+++ b/crates/socket-patch-cli/tests/coverage_fix_get_double_json.rs
@@ -1,15 +1,13 @@
 //! Subprocess regression test: agent-mode `get <search-id> --json` must
 //! print exactly ONE JSON document when the download engine hits a HARD
 //! error (here: an unreadable manifest). The engine's fail-closed paths
-//! in `download_and_apply_patches` print the `{status: "error"}`
+//! in `download_and_apply_patches_with` print the `{status: "error"}`
 //! envelope themselves via `report_error` and return it; `run()`'s agent
-//! path then pretty-printed the SAME envelope again, putting two JSON
-//! documents on stdout — violating get's one-document `--json` contract
-//! (the vendored search path already guards this with its
-//! `result["status"] == "error"` early return).
+//! path must not pretty-print the SAME envelope again (get's `--json`
+//! contract is one document on stdout).
 //!
-//! Subprocess (not in-process) because the defect is precisely what the
-//! spawned binary PRINTS. Same harness recipe as `get_modes_e2e.rs`.
+//! Subprocess (not in-process) because the contract is what the spawned
+//! binary PRINTS. Same harness recipe as `get_modes_e2e.rs`.
 
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
diff --git a/crates/socket-patch-cli/tests/coverage_fix_rollback_ecosystem_scoped_replay.rs b/crates/socket-patch-cli/tests/coverage_fix_rollback_ecosystem_scoped_replay.rs
index c8781a6b..0f568394 100644
--- a/crates/socket-patch-cli/tests/coverage_fix_rollback_ecosystem_scoped_replay.rs
+++ b/crates/socket-patch-cli/tests/coverage_fix_rollback_ecosystem_scoped_replay.rs
@@ -115,7 +115,7 @@ async fn ecosystems_scoped_rollback_leaves_other_ecosystems_leftover_edits() {
     );
 }
 
-/// Control (the behavior the fix must not break): an UNSCOPED rollback
+/// Control: an UNSCOPED rollback
 /// still replays the records-empty ledger's leftover edits and deletes
 /// the emptied ledger.
 #[tokio::test]
diff --git a/crates/socket-patch-cli/tests/coverage_fix_scan_discovery_corrupt_ledger.rs b/crates/socket-patch-cli/tests/coverage_fix_scan_discovery_corrupt_ledger.rs
index ae5fdba7..59e30ec4 100644
--- a/crates/socket-patch-cli/tests/coverage_fix_scan_discovery_corrupt_ledger.rs
+++ b/crates/socket-patch-cli/tests/coverage_fix_scan_discovery_corrupt_ledger.rs
@@ -1,12 +1,8 @@
-//! Regression: a corrupt `.socket/vendor/state.json` must not defeat the
-//! vendored prune safeguards. With the ledger unreadable, BOTH protection
-//! legs used to degrade to empty — `vendored_ledger_supplement` (discovery)
-//! silently returned no packages, so the vendored purls never entered
-//! `scanned_purls`, and core's `vendored_purl_keys` prune exemption is
-//! fail-open by contract — so `scan --prune` deleted a still-vendored
-//! package's manifest entry and swept its blobs while the committed
-//! artifacts remained. The fix recovers the vendored set from the committed
-//! ground truth: manifest entries whose patch uuid owns a live
+//! A corrupt `.socket/vendor/state.json` must not defeat the vendored prune
+//! safeguards. With the ledger unreadable, `vendored_ledger_supplement`
+//! (discovery) and core's `vendored_purl_keys` prune exemption (fail-open
+//! by contract) both see nothing, so the vendored set is recovered from the
+//! committed ground truth: manifest entries whose patch uuid owns a live
 //! `.socket/vendor/<eco>/<uuid>` artifact dir.
 //!
 //! Modeled on `scan_vendor_e2e.rs` (mock API + real fixture through the
@@ -130,10 +126,8 @@ async fn mount_empty_discovery(mock: &MockServer) {
 }
 
 /// `scan --prune` on a fresh clone whose vendor ledger is corrupt: the
-/// vendored package's manifest entry and blob must survive the GC. Before
-/// the fix, discovery's ledger supplement silently returned empty, the
-/// prune exemption was also empty, and the entry + blob were deleted while
-/// the committed artifacts remained.
+/// vendored package's manifest entry and blob must survive the GC while the
+/// committed artifacts remain.
 #[tokio::test]
 async fn corrupt_ledger_scan_prune_keeps_vendored_manifest_entry() {
     let mock = MockServer::start().await;
diff --git a/crates/socket-patch-cli/tests/coverage_fix_scan_hosted_dryrun_vendored.rs b/crates/socket-patch-cli/tests/coverage_fix_scan_hosted_dryrun_vendored.rs
index 7fcd503e..928010ff 100644
--- a/crates/socket-patch-cli/tests/coverage_fix_scan_hosted_dryrun_vendored.rs
+++ b/crates/socket-patch-cli/tests/coverage_fix_scan_hosted_dryrun_vendored.rs
@@ -1,16 +1,10 @@
-//! Coverage-audit regression: `scan --mode hosted --dry-run` over a VENDORED
-//! project must preview the WET run's takeover outcome.
-//!
-//! Pre-fix, the takeover pre-revert loop's dry-run branch pushed the
-//! `redirect_would_revert_vendored` warning ("will revert … then redirect")
-//! and `continue`d — skipping the revert but LEAVING the purl in the
-//! candidates/overrides handed to the rewriters. The pnpm/berry rewriters
-//! then previewed against the still-vendored lock, fail-closed refused its
-//! `file:.socket/vendor/…` resolution (`redirect_pnpm_entry_vendored`,
-//! "run `vendor --revert` first"), and the envelope reported `redirected: 0`
-//! with BOTH contradictory prescriptions — while the same command WITHOUT
-//! `--dry-run` reverted first and reported `redirected: 1`. A CI gate keying
-//! on the dry-run count concluded the migration would fail when it succeeds.
+//! `scan --mode hosted --dry-run` over a VENDORED project must preview the
+//! WET run's takeover outcome: the rewriters must not preview against the
+//! still-vendored lock (and fail-closed refuse its `file:.socket/vendor/…`
+//! resolution with `redirect_pnpm_entry_vendored`), or the envelope would
+//! report `redirected: 0` with contradictory prescriptions while the wet
+//! run reports `redirected: 1` — and a CI gate keying on the dry-run count
+//! would conclude the migration fails when it succeeds.
 //!
 //! Fixture: a real offline `vendor` run (the `in_process_vendor.rs` harness
 //! shapes) produces the vendored lock + `.socket/vendor/state.json` entry;
@@ -336,15 +330,15 @@ async fn dry_run_over_vendored_project_previews_the_wet_takeover() {
         codes.contains(&"redirect_would_revert_vendored"),
         "the takeover plan must be announced: {doc:#}"
     );
-    // THE BUG: the rewriters previewed against the still-vendored lock and
-    // refused it, contradicting the takeover warning above.
+    // Previewing against the still-vendored lock would refuse it,
+    // contradicting the takeover warning above.
     assert!(
         !codes.contains(&"redirect_pnpm_entry_vendored"),
         "the dry-run must not also tell the user to run `vendor --revert` \
          for a purl this run just promised to revert itself: {doc:#}"
     );
-    // THE BUG: the preview reported `redirected: 0` for a migration the wet
-    // run lands (below) — the CI-gate signal this envelope exists for.
+    // The preview must count the migration the wet run lands (below) — the
+    // CI-gate signal this envelope exists for.
     assert_eq!(
         doc["redirect"]["redirected"], 1,
         "the dry-run must preview the wet outcome: {doc:#}"
@@ -490,7 +484,6 @@ fn scan_hosted_human(cwd: &Path, api_url: &str, dry_run: bool) -> (i32, String,
     run_cli(cwd, &args)
 }
 
-/// The first line of `stdout` (the summary).
 /// The engine's one-line summary. Human hosted `scan` prints the results
 /// table and discovery summary above it, so find it by its lead words.
 fn summary_line(stdout: &str) -> &str {
@@ -504,8 +497,7 @@ fn summary_line(stdout: &str) -> &str {
 /// the wet run the landed one, each as its own line on stderr, and both
 /// summaries count the same 3 files — the lock and workspace the hosted
 /// rewriter touches plus the package.json `pnpm.overrides` wiring only the
-/// vendored revert touches (the wet count used to omit it: "rewrote 2
-/// files"). The wet run's next steps name `.socket/vendor/` and
+/// vendored revert touches. The wet run's next steps name `.socket/vendor/` and
 /// package.json, so the deleted vendored ledger entry and artifact and the
 /// reverted wiring are committed too.
 #[tokio::test]
diff --git a/crates/socket-patch-cli/tests/covgap_api_client.rs b/crates/socket-patch-cli/tests/covgap_api_client.rs
index 07b2dfee..99ccb75f 100644
--- a/crates/socket-patch-cli/tests/covgap_api_client.rs
+++ b/crates/socket-patch-cli/tests/covgap_api_client.rs
@@ -1,5 +1,5 @@
 //! Coverage-gap e2e for `api::client` env/org-resolution UX paths that need
-//! process-level stderr assertions (2026-09 coverage audit).
+//! process-level stderr assertions.
 //!
 //! The core inline tests (`org_auto_resolution_401_with_hash_shaped_token_hint_arm`)
 //! pin the resulting client *state*; this suite pins the operator-facing
diff --git a/crates/socket-patch-cli/tests/covgap_commands_apply.rs b/crates/socket-patch-cli/tests/covgap_commands_apply.rs
index 4f57dacf..edeb8f0a 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_apply.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_apply.rs
@@ -1,4 +1,4 @@
-//! Coverage-gap tests for `commands/apply.rs` (2026-09 audit).
+//! Coverage-gap tests for `commands/apply.rs`.
 //!
 //! The uncovered surface of apply.rs is dominated by HUMAN-mode output —
 //! nearly every existing apply test passes `--json` and/or `--silent` — plus
@@ -13,7 +13,8 @@
 //!   3. `reconcile_local_go`'s human report (`Removed` / `Would remove`
 //!      N stale go patch redirect(s));
 //!   4. mismatch-blob prefetch messages: the `--offline` warning, the
-//!      "Downloading N full patched blob(s)" line, and the broken-TMPDIR
+//!      transient "Downloading ..." status resolving to the "Downloaded N
+//!      full patched blob(s)" result line, and the broken-TMPDIR
 //!      transient-stage failure warning;
 //!   5. human-mode output block: "No patches to apply.", the no-matching-
 //!      packages warning, the npm per-package failure line, the dry-run
@@ -24,7 +25,9 @@
 //!   7. apply-loop wiring: a vendored release-variant base with its
 //!      installed tree PRESENT is skipped (not re-patched), and a qualified
 //!      singleton whose record holds only NEW files (no representative)
-//!      is treated as installed and applied.
+//!      is treated as installed and applied; a ledger-only vendored
+//!      project with no manifest is the `noManifest` no-op;
+//!   8. the `apply --dry-run --vex` skip message.
 //!
 //! Binary-driven throughout (`common::run_with_env`, `SOCKET_*`-scrubbed
 //! children), hand-written camelCase manifests, git-sha256 oracle,
@@ -178,8 +181,7 @@ fn write_drifted_go_manifest(root: &Path) {
 
 /// `apply --check --json` WITH drift: the machine-readable envelope carries
 /// one Failed event per drift with `errorCode: go_redirect_drift`, status
-/// `partialFailure`, exit 1. (Every prior drift run was human/silent —
-/// the envelope had never been serialized.)
+/// `partialFailure`, exit 1.
 #[test]
 fn check_json_with_drift_emits_failed_events_envelope() {
     let tmp = tempfile::tempdir().unwrap();
@@ -442,8 +444,8 @@ fn offline_mismatch_blob_gap_warns_and_fails_in_human_mode() {
     );
 }
 
-/// Online, human mode: the "Downloading N full patched blob(s)..."
-/// progress line prints before the prefetch, the blob is fetched from the
+/// Online, human mode: the transient "Downloading ..." status resolves to
+/// the "Downloaded 1 full patched blob for mismatched files" result line, the blob is fetched from the
 /// API into a transient overlay (never `.socket/blobs/`), and the mismatch
 /// is warn-overwritten with the verified patched bytes.
 #[tokio::test]
@@ -537,8 +539,7 @@ fn broken_tmpdir_surfaces_transient_blob_stage_warning() {
 // ═══════════ 5. human-mode apply output block ═══════════
 
 /// The empty-scope clean success prints "No patches to apply." — the
-/// postinstall-hook UX for fresh projects (previously covered only in
-/// json/silent modes, where the line is suppressed).
+/// postinstall-hook UX for fresh projects (json/silent suppress the line).
 #[test]
 fn empty_manifest_prints_no_patches_to_apply_in_human_mode() {
     let tmp = tempfile::tempdir().unwrap();
@@ -729,7 +730,7 @@ fn verbose_dry_run_prints_per_file_labels_and_hashes() {
 }
 
 /// A pnpm store layout gets the informational stderr note in human mode
-/// (previously detected only under json/silent, where the note is muted).
+/// (json/silent mute it).
 #[test]
 fn pnpm_layout_prints_informational_note_in_human_mode() {
     let tmp = tempfile::tempdir().unwrap();
diff --git a/crates/socket-patch-cli/tests/covgap_commands_fetch_stage.rs b/crates/socket-patch-cli/tests/covgap_commands_fetch_stage.rs
index 125245d3..1058e8ac 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_fetch_stage.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_fetch_stage.rs
@@ -3,9 +3,9 @@
 //!
 //!   - the non-quiet offline "no local source" report: the count header,
 //!     the 5-PURL cap, the "... and N more" continuation, and the
-//!     re-run-online hint (`report_offline_missing`);
-//!   - the non-quiet online staging progress: the download announcement
-//!     and the diff→per-file-blob fallback messages;
+//!     the `repair` remedy hint (`report_offline_missing`);
+//!   - the online staging result lines (progress is transient) and the
+//!     diff→per-file-blob fallback;
 //!   - the vendor mem-stager's per-file failure arms for malformed patch
 //!     view responses (missing `blobContent`, invalid `afterHash`,
 //!     undecodable base64) and the non-quiet "could not fetch patch
@@ -160,11 +160,11 @@ fn apply_offline_nonquiet_lists_capped_missing_purls_and_repair_hint() {
 
 /// A human-mode (no `--json`/`--silent`) online apply in the default
 /// `diff` download mode, where the server has no diff archive but serves
-/// the per-file blob: the run announces the primary download (with the
-/// mode tag), announces the per-file blob fallback in place of the
-/// unavailable diff archive (whose 404 is not reported: the blobs cover
-/// it), reports its success — and applies. `.socket/` stays
-/// untouched (downloads land in the overlay tempdir).
+/// the per-file blob: the download and fallback progress are transient
+/// status lines (nothing permanent on a non-terminal stderr), the diff
+/// archive's 404 is not reported (the blobs cover it), and only the
+/// "Downloaded 1 blob" result line persists before the apply. `.socket/`
+/// stays untouched (downloads land in the overlay tempdir).
 #[tokio::test]
 async fn apply_online_nonquiet_prints_download_progress_and_diff_fallback() {
     let before_hash = git_sha256(BEFORE);
@@ -223,7 +223,8 @@ async fn apply_online_nonquiet_prints_download_progress_and_diff_fallback() {
     )
     .unwrap();
 
-    // apply rejects --api-url/--api-token/--org flags — env is its channel.
+    // Point apply at the mock via env (SOCKET_API_URL/TOKEN/ORG_SLUG); the
+    // equivalent --api-url/--api-token/--org flags work too.
     let mock_uri = mock.uri();
     let (code, stdout, stderr) = run_cli_env(
         tmp.path(),
diff --git a/crates/socket-patch-cli/tests/covgap_commands_list.rs b/crates/socket-patch-cli/tests/covgap_commands_list.rs
index 02176eee..a41fceea 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_list.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_list.rs
@@ -1,7 +1,8 @@
-//! Coverage-gap tests for `commands/list.rs` (audit of 2026-09, commit
-//! d5e1815): the `--debug` provenance echoes for config-sourced telemetry
-//! credentials (`telemetry_credentials`'s two `inspect` closures ran under
-//! the config-fallback tests, but never with `--debug`), and the
+//! Coverage-gap tests for `commands/list.rs`: the `--debug` provenance
+//! echoes for config-sourced telemetry credentials (the two `inspect`
+//! closures in core api/client.rs's credential resolution, reached via
+//! `GlobalArgs::telemetry_credentials` -> `resolve_ambient_credentials`),
+//! and the
 //! human-readable listing's sparse-record branches — a vulnerability with
 //! no CVE ids (GHSA-only advisories are a real production shape), and a
 //! record with zero vulnerabilities / zero files, whose section headers
@@ -27,7 +28,7 @@ mod vlt_hosted_common;
 mod vlt_vendored;
 
 // ---------------------------------------------------------------------------
-// `--debug` provenance echoes (list.rs telemetry_credentials, config layer)
+// `--debug` provenance echoes (GlobalArgs::telemetry_credentials, config layer)
 // ---------------------------------------------------------------------------
 
 const BINARY: &str = env!("CARGO_BIN_EXE_socket-patch");
diff --git a/crates/socket-patch-cli/tests/covgap_commands_remove.rs b/crates/socket-patch-cli/tests/covgap_commands_remove.rs
index 0d4641a2..fa000a59 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_remove.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_remove.rs
@@ -1,5 +1,5 @@
-//! Coverage-gap tests for `commands/remove.rs` (audit of 2026-09, commit
-//! d5e1815): the lock-contention return, the vendor-ledger hard-failure
+//! Coverage-gap tests for `commands/remove.rs`: the lock-contention
+//! return, the vendor-ledger hard-failure
 //! aborts, the hosted-redirect leg's dry-run / preserve-state / refusal /
 //! failure branches, the drift-keep exclusion arms, the mixed drift-keep
 //! partial failure, and the human-mode output surfaces that were only ever
@@ -10,7 +10,7 @@
 //! offline: every fixture is hand-written camelCase JSON, and every wet run
 //! passes `--offline`. Fixture shapes are copied from
 //! remove_invariants.rs / remove_duality_invariants.rs /
-//! interactive_prompts_e2e.rs (do not edit those files).
+//! interactive_prompts_e2e.rs.
 
 #[path = "common/pty_io.rs"]
 mod pty_io;
@@ -121,7 +121,7 @@ fn write_two_entry_manifest(
 /// Vendor ledger with one npm entry keyed `key` (extra: raw JSON fields
 /// appended to the entry — e.g. `"flavor": "...",` or `"detached": true,`),
 /// plus the artifact dir it names. Fixture shape copied from
-/// remove_invariants.rs::write_vendored_ledger (do not edit that file).
+/// remove_invariants.rs::write_vendored_ledger.
 fn write_vendor_ledger_entry(
     root: &Path,
     key: &str,
@@ -154,12 +154,11 @@ fn write_vendor_ledger_entry(
 
 /// A wiring record naming a file the npm revert backend does not edit: the
 /// revert drift-keeps (`kept_artifact`) — fixture copied from
-/// remove_duality_invariants.rs (do not edit that file).
+/// remove_duality_invariants.rs.
 const DRIFTED_WIRING: &str = r#"[{ "file": "weird.txt", "kind": "npm_lock_entry", "action": "added", "key": "node_modules/x" }]"#;
 
 // ---------------------------------------------------------------------------
-// Hosted-redirect fixtures (copied from remove_duality_invariants.rs —
-// do not edit that file).
+// Hosted-redirect fixtures (copied from remove_duality_invariants.rs).
 // ---------------------------------------------------------------------------
 
 const NPM_PURL: &str = "pkg:npm/left-pad@1.3.0";
@@ -247,13 +246,13 @@ fn expected_reverted_lock_text() -> String {
 }
 
 // ---------------------------------------------------------------------------
-// 1. Lock contention (remove.rs:207)
+// 1. Lock contention
 // ---------------------------------------------------------------------------
 
 /// `remove` against an externally-held `.socket/apply.lock` must refuse
 /// with the same `lock_held` envelope contract apply pins in
-/// e2e_safety_lock.rs — remove had never been run against a held lock.
-/// After the lock is released the same removal must proceed.
+/// e2e_safety_lock.rs. After the lock is released the same removal must
+/// proceed.
 #[test]
 fn remove_lock_held_returned_then_proceeds_after_release() {
     use fs2::FileExt;
@@ -324,8 +323,8 @@ fn remove_lock_held_returned_then_proceeds_after_release() {
 }
 
 // ---------------------------------------------------------------------------
-// 2. Corrupt vendor ledger fails the remove closed (remove.rs:457-464; the
-//    human branch also covers emit_error_envelope's stderr arm at 87-88)
+// 2. Corrupt vendor ledger fails the remove closed (the human branch also
+//    covers emit_error_envelope's stderr arm)
 // ---------------------------------------------------------------------------
 
 /// Garbage `.socket/vendor/state.json` must abort the remove BEFORE any
@@ -399,7 +398,7 @@ fn remove_corrupt_vendor_ledger_fails_closed_human() {
 
 // ---------------------------------------------------------------------------
 // 3. Vendor revert hard failure aborts before the manifest mutation
-//    (remove.rs:517-533 main flow; 1240-1255 detached twin)
+//    (main flow + ledger-only twin)
 // ---------------------------------------------------------------------------
 
 /// An unknown wiring flavor fails the revert closed (the VendorEntry
@@ -458,7 +457,7 @@ fn remove_unknown_vendor_flavor_fails_closed_before_manifest_mutation() {
 }
 
 /// Detached twin (no manifest at all): the failure surfaces through
-/// `remove_detached_only`'s own `vendor_revert_failed` branch, and the
+/// `remove_ledger_only`'s own `vendor_revert_failed` branch, and the
 /// ledger entry survives.
 #[test]
 fn remove_detached_unknown_vendor_flavor_fails_closed() {
@@ -499,8 +498,8 @@ fn remove_detached_unknown_vendor_flavor_fails_closed() {
 }
 
 // ---------------------------------------------------------------------------
-// 4. save_state failure after a successful revert (remove.rs:592-598 main
-//    flow; 1273-1279 detached twin). Unix-only chmod choreography:
+// 4. save_state failure after a successful revert (main flow + ledger-only
+//    twin). Unix-only chmod choreography:
 //    `.socket/vendor` goes read-only while `.socket/vendor/npm/` stays
 //    writable, so the artifact delete succeeds but the ledger write fails.
 // ---------------------------------------------------------------------------
@@ -583,7 +582,7 @@ fn remove_vendor_state_write_failure_aborts_before_manifest_mutation() {
     );
 }
 
-/// Detached twin: same choreography through `remove_detached_only`.
+/// Detached twin: same choreography through `remove_ledger_only`.
 #[cfg(unix)]
 #[test]
 fn remove_detached_vendor_state_write_failure_fails_with_code() {
@@ -623,8 +622,7 @@ fn remove_detached_vendor_state_write_failure_fails_with_code() {
 }
 
 // ---------------------------------------------------------------------------
-// 5. Hosted leg: dry-run previews (remove.rs:716 main flow; 1164
-//    hosted-only)
+// 5. Hosted leg: dry-run previews (main flow + hosted-only)
 // ---------------------------------------------------------------------------
 
 /// A dry-run remove touching hosted records had NEVER run. The preview
@@ -725,7 +723,6 @@ fn remove_hosted_only_dry_run_previews_without_mutation() {
 
 // ---------------------------------------------------------------------------
 // 6. Hosted leg: --preserve-state note + preserve-state human summary
-//    (remove.rs:706-713, 809-813)
 // ---------------------------------------------------------------------------
 
 /// `--preserve-state` still unwinds hosted redirects (hosted has no
@@ -775,7 +772,7 @@ fn remove_hosted_preserve_state_notes_no_preservable_state() {
 }
 
 // ---------------------------------------------------------------------------
-// 7. Corrupt hosted-redirect ledger: warn-and-continue (remove.rs:623-629)
+// 7. Corrupt hosted-redirect ledger: warn-and-continue
 // ---------------------------------------------------------------------------
 
 /// A corrupt redirect ledger must not block a manifest removal: the main
@@ -844,7 +841,7 @@ fn remove_corrupt_hosted_ledger_json_still_removes() {
 }
 
 // ---------------------------------------------------------------------------
-// 8. Hosted-only refusal + human listing (remove.rs:1066-1076, 1080-1084)
+// 8. Hosted-only refusal + human listing
 // ---------------------------------------------------------------------------
 
 /// With no manifest entry to delete, removing a hosted patch can only mean
@@ -910,8 +907,8 @@ fn remove_hosted_only_human_lists_redirects_and_unwinds() {
 }
 
 // ---------------------------------------------------------------------------
-// 9. Hosted per-purl revert failure fails closed (remove.rs:694-703 main
-//    flow; 1152-1159 hosted-only twin)
+// 9. Hosted per-purl revert failure fails closed (main flow + hosted-only
+//    twin)
 // ---------------------------------------------------------------------------
 
 /// A package-lock.json that is no longer valid JSON makes the recorded
@@ -984,7 +981,7 @@ fn remove_hosted_only_revert_failure_fails_closed() {
 
 // ---------------------------------------------------------------------------
 // 10. Hosted ledger persist failure after successful lockfile reverts
-//     (remove.rs:669-675 main flow; 1122-1128 hosted-only). Unix-only.
+//     (main flow + hosted-only). Unix-only.
 // ---------------------------------------------------------------------------
 
 /// The per-purl reverts flush lockfile writes as they go; when the ledger
@@ -1080,8 +1077,7 @@ fn remove_hosted_only_ledger_persist_failure_fails_closed() {
 }
 
 // ---------------------------------------------------------------------------
-// 11. Drift-keep exclusion arms (remove.rs:741-745) + mixed partial
-//     failure (remove.rs:1009, 1022-1031)
+// 11. Drift-keep exclusion arms + mixed partial failure
 // ---------------------------------------------------------------------------
 
 const MIXED_UUID: &str = "88888888-8888-4888-8888-888888888888";
@@ -1177,7 +1173,7 @@ fn remove_mixed_drift_keep_is_partial_failure_json() {
 }
 
 /// Human twin: exit 1 plus the singular drift-keep error line on stderr
-/// (the count + pluralization surface at remove.rs:1022-1030).
+/// (the count + pluralization surface).
 #[test]
 fn remove_mixed_drift_keep_is_partial_failure_human() {
     let tmp = tempfile::tempdir().expect("tempdir");
@@ -1199,7 +1195,7 @@ fn remove_mixed_drift_keep_is_partial_failure_human() {
     );
 }
 
-/// Qualifier-stripped exclusion arm (remove.rs:741): a drift-kept ledger
+/// Qualifier-stripped exclusion arm: a drift-kept ledger
 /// key for ONE release variant keeps the manifest entries of ALL sibling
 /// variants of that package@version (vendored state is per-package, so
 /// dropping a sibling's record would strand the surviving vendored state).
@@ -1256,8 +1252,8 @@ fn remove_drift_keep_excludes_sibling_variants_by_stripped_key() {
     );
 }
 
-/// Base-purl exclusion arm (remove.rs:742-745, and the base_purl match arm
-/// of vendor_entries_matching at remove.rs:44): a drift-kept ledger entry
+/// Base-purl exclusion arm (and the base_purl match arm of
+/// vendor_entries_matching): a drift-kept ledger entry
 /// whose KEY differs from the manifest purl but whose `basePurl` resolves
 /// to it still keeps the manifest entry.
 #[test]
@@ -1303,7 +1299,7 @@ fn remove_drift_keep_excludes_manifest_entry_by_base_purl() {
 }
 
 // ---------------------------------------------------------------------------
-// 12. Detached entry matched by base_purl only (remove.rs:44): the golang
+// 12. Detached entry matched by base_purl only: the golang
 //     case-encoded ledger key, whose decoded basePurl is what users type.
 // ---------------------------------------------------------------------------
 
@@ -1378,7 +1374,7 @@ fn remove_matches_detached_entry_by_base_purl() {
 }
 
 // ---------------------------------------------------------------------------
-// 13. Detached-only --skip-rollback refusal (remove.rs:1194-1204)
+// 13. Detached-only --skip-rollback refusal
 // ---------------------------------------------------------------------------
 
 /// With no manifest entry to delete, removing a detached vendored patch
@@ -1422,8 +1418,7 @@ fn remove_detached_skip_rollback_refused() {
 }
 
 // ---------------------------------------------------------------------------
-// 14. Human-mode output surfaces (remove.rs:319-324, 421, 559, 579,
-//     809-813)
+// 14. Human-mode output surfaces
 // ---------------------------------------------------------------------------
 
 /// A base PURL expanding to multiple manifest entries must make the blast
@@ -1463,10 +1458,10 @@ fn remove_multi_variant_blast_radius_prints_expansion() {
     );
 }
 
-/// The "already in original state" count line (remove.rs:421): an entry
+/// The "already in original state" count line: an entry
 /// whose installed file is already at its original bytes rolls back as
 /// already-original, and the human run must say so. (JSON twin lives in
-/// remove_invariants.rs; the human surface was never exercised.)
+/// remove_invariants.rs.)
 #[test]
 fn remove_already_original_human_prints_count_line() {
     let original = b"covgap original bytes\n";
@@ -1532,8 +1527,8 @@ fn remove_already_original_human_prints_count_line() {
 }
 
 /// Wet `--preserve-state` on a vendored entry, human mode: the per-key
-/// "Unwired vendoring … (artifact preserved)" line (remove.rs:579) plus
-/// the final preserve summary (809-813), with all state kept.
+/// "Unwired vendoring … (artifact preserved)" line plus
+/// the final preserve summary, with all state kept.
 #[test]
 fn remove_preserve_state_vendored_human_wet_surfaces() {
     let tmp = tempfile::tempdir().expect("tempdir");
@@ -1568,7 +1563,7 @@ fn remove_preserve_state_vendored_human_wet_surfaces() {
 }
 
 /// Dry-run `--preserve-state` twin: the "Would unwire vendoring …
-/// (artifact preserved)" preview line (remove.rs:559), nothing mutated.
+/// (artifact preserved)" preview line, nothing mutated.
 #[test]
 fn remove_preserve_state_vendored_human_dry_run_previews() {
     let tmp = tempfile::tempdir().expect("tempdir");
@@ -1598,8 +1593,7 @@ fn remove_preserve_state_vendored_human_dry_run_previews() {
 }
 
 // ---------------------------------------------------------------------------
-// 15. Blob/archive cleanup failures warn, never fatal (remove.rs:887-891,
-//     905-908)
+// 15. Blob/archive cleanup failures warn, never fatal
 // ---------------------------------------------------------------------------
 
 /// Plant `.socket/blobs`, `.socket/diffs`, `.socket/packages` as regular
@@ -1647,7 +1641,7 @@ fn remove_cleanup_failures_warn_not_fatal() {
 }
 
 // ---------------------------------------------------------------------------
-// 16. rollback_patches Err(String) plumbing (remove.rs:429-437) — distinct
+// 16. rollback_patches_inner Err(String) plumbing (remove.rs's rollback match) — distinct
 //     from the covered Ok(success=false) gate abort.
 // ---------------------------------------------------------------------------
 
@@ -1730,10 +1724,9 @@ fn remove_rollback_infrastructure_error_surfaces_rollback_failed() {
 }
 
 // ---------------------------------------------------------------------------
-// 17. Hosted-only interactive decline (remove.rs:1092-1095) — PTY-driven
+// 17. Hosted-only interactive decline — PTY-driven
 //     (the non-TTY confirm auto-proceeds, so only a real terminal reaches
-//     the cancel branch). Runner copied from interactive_prompts_e2e.rs
-//     (do not edit that file).
+//     the cancel branch). Runner copied from interactive_prompts_e2e.rs.
 // ---------------------------------------------------------------------------
 
 #[cfg(unix)]
@@ -1852,8 +1845,7 @@ mod pty {
 
 /// `remove --preserve-state` on a ledger-only entry unwires the lockfile
 /// but KEEPS the artifact and the ledger entry — the documented
-/// `--preserve-state` promise, which the ledger-only path used to ignore
-/// (deleting the very state it promised to preserve). The empty wiring
+/// `--preserve-state` promise. The empty wiring
 /// makes the unwire an offline no-op, so the keep-everything half is what
 /// shows: exit 0, a `skipped`/`vendor_state_preserved` event, no `removed`
 /// event, ledger byte-identical, artifact on disk. Dry-run twin previews
@@ -1948,10 +1940,9 @@ fn remove_detached_preserve_state_keeps_artifact_and_ledger_entry() {
 /// (`kept_artifact`), and the ledger-only path must honor it exactly like
 /// the manifest path — keep the ledger entry and the artifact, report
 /// `skipped`/`vendor_revert_kept`, and fail the run (`partialFailure`,
-/// top-level `vendor_revert_kept` since every match kept, exit 1). Before
-/// the fix the entry was dropped from the ledger while its wiring and
-/// artifact stayed behind — the "wired but ledgerless" recovery state
-/// `repair` exists for — and the run reported a clean removal.
+/// top-level `vendor_revert_kept` since every match kept, exit 1) — never
+/// drop the entry while its wiring and artifact stay behind (the "wired but
+/// ledgerless" recovery state `repair` exists for).
 #[test]
 fn remove_detached_drift_keep_holds_ledger_entry_and_exits_one() {
     let tmp = tempfile::tempdir().expect("tempdir");
diff --git a/crates/socket-patch-cli/tests/covgap_commands_repair.rs b/crates/socket-patch-cli/tests/covgap_commands_repair.rs
index 829dee0c..4282dd9b 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_repair.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_repair.rs
@@ -2,7 +2,7 @@
 //! output arms that every existing suite drove through `--json`, plus the
 //! warn-and-continue housekeeping contracts.
 //!
-//! Ranges pinned (audited at d5e1815, file unchanged since):
+//! Ranges pinned:
 //!   * the loud `manifest_not_found` / `repair_failed` stderr prints,
 //!   * the loud "All {artifacts} are present locally." summary,
 //!   * the `... and N more` truncation of the offline warning (>5 missing)
@@ -18,7 +18,7 @@
 //!
 //! Everything runs offline or against a wiremock server — no real hosts.
 //! Fixtures mirror `repair_invariants.rs` / `repair_vendor_e2e.rs` (this
-//! suite owns its own copies; those files are owned by other agents).
+//! suite owns its own copies).
 
 use std::path::{Path, PathBuf};
 use std::process::Command;
diff --git a/crates/socket-patch-cli/tests/covgap_commands_repair_vendor.rs b/crates/socket-patch-cli/tests/covgap_commands_repair_vendor.rs
index b4dc42f2..357c8e75 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_repair_vendor.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_repair_vendor.rs
@@ -8,7 +8,7 @@
 //! scoping, and the human (non-`--json`) output lines.
 //!
 //! Fixtures and helpers mirror `repair_vendor_e2e.rs` (this suite owns its
-//! own copies; that file is owned by another agent).
+//! own copies).
 //!
 //! A vendored run (`scan --vendor`) is manifest-free: every ledger entry is
 //! `detached` with its record embedded and `.socket/manifest.json` is never
@@ -510,9 +510,10 @@ fn to_standalone_vendor_mode(root: &Path) -> PathBuf {
 
 /// Corrupt `.socket/vendor/state.json` (unparseable JSON) → the vendored
 /// phase surfaces `vendor_state_unreadable` as a partial failure instead of
-/// silently treating the ledger as empty (repair.rs's own earlier load uses
-/// `unwrap_or_default`, so this is the only place the corruption reaches
-/// the user). The artifact is untouched.
+/// silently treating the ledger as empty (repair.rs loads the ledger once
+/// and only its manifest-scoping step degrades a corrupt ledger to "nothing
+/// vendored"; the vendored phase gets the raw result, so this is the only
+/// place the corruption reaches the user). The artifact is untouched.
 #[tokio::test]
 async fn repair_fails_loudly_on_corrupt_vendor_state() {
     let mock = MockServer::start().await;
@@ -1563,12 +1564,10 @@ async fn repair_offline_soft_restore_without_installed_copy() {
 /// the QUALIFIED purl production publishes (`pkg:gem/…?platform=ruby`) —
 /// while the crawler knows only base purls. Repair must resolve the
 /// installed copy through the qualified-aware resolver (the one
-/// `vendor_records` uses): pre-fix the base-keyed lookup never matched a
-/// qualified ledger key, so an INSTALLED package read as absent and an
-/// offline rebuild of a missing artifact failed `vendor_artifact_missing`
-/// instead of rebuilding from the copy on disk (online, it fell through to
-/// the registry-fetch rung — a needless network round-trip that, with no
-/// rubygems route mounted here, fails the repair outright).
+/// `vendor_records` uses): a base-keyed lookup never matches a qualified
+/// ledger key, so an INSTALLED package would read as absent and the rebuild
+/// would fall through to `vendor_artifact_missing` (offline) or the
+/// registry-fetch rung (online; no rubygems route is mounted here).
 #[tokio::test]
 async fn repair_rebuilds_qualified_ledger_key_from_installed_copy() {
     let mock = MockServer::start().await;
diff --git a/crates/socket-patch-cli/tests/covgap_commands_rollback.rs b/crates/socket-patch-cli/tests/covgap_commands_rollback.rs
index 185edeef..bfa15851 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_rollback.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_rollback.rs
@@ -1,21 +1,21 @@
-//! Coverage-gap tests for `commands/rollback.rs` (2026-09 audit).
+//! Coverage-gap tests for `commands/rollback.rs`. Sections:
 //!
-//! Five themes the existing rollback suites never exercised:
-//!
-//!   1. HUMAN-mode output — nearly every prior rollback test runs `--json`
-//!      or `--silent`, so the dry-run summary, wet-run messages, verbose
-//!      per-file details, preserve-state closing message, and the
-//!      error-class stderr notices had never rendered;
-//!   2. failure legs of the vendored and hosted rollback (unknown-backend
-//!      revert failure, ledger save/persist failure, replay refusal,
-//!      per-purl revert I/O failure, corrupt ledgers);
-//!   3. scope plumbing gaps (path globs selecting vendored/hosted entries,
-//!      `--ecosystems` narrowing both non-manifest legs, the multi-copy
-//!      out-of-scope warning);
-//!   4. the interactive confirm DECLINE (PTY-driven, like
-//!      `interactive_prompts_e2e.rs`);
-//!   5. boundary error envelopes (corrupt manifest, blobs-path-is-a-file
-//!      legacy error shape, lock contention).
+//! 1. HUMAN-mode output — the dry-run summary, wet-run messages, verbose
+//!    per-file details, preserve-state closing message, and the
+//!    error-class stderr notices (other suites run `--json`/`--silent`);
+//! 2. failure legs of the vendored and hosted rollback (unknown-backend
+//!    revert failure, ledger save/persist failure, replay refusal,
+//!    per-purl revert I/O failure, corrupt ledgers);
+//! 3. GC-failure warnings (unix permissions);
+//! 4. manifest-write failure (macOS immutable flag);
+//! 5. the interactive confirm DECLINE (PTY-driven, like
+//!    `interactive_prompts_e2e.rs`);
+//! 6. mop-up arms: boundary error envelopes (corrupt manifest,
+//!    blobs-path-is-a-file legacy error shape, lock contention), scope
+//!    isolation (path globs, `--ecosystems` narrowing both non-manifest
+//!    legs, the multi-copy out-of-scope warning), variant + redirect
+//!    routing;
+//! 7. the hosted vlt heal.
 //!
 //! Binary-driven throughout (the `rollback_duality_invariants.rs` shape):
 //! `SOCKET_*`-scrubbed child processes via `common::run`, hand-written
@@ -372,7 +372,7 @@ fn human_wet_reports_already_original_and_not_installed() {
 
 /// `--verbose` per-file details on a hash-mismatch failure: the humanized
 /// `[hash mismatch]` label plus the `message:` and `expected:` lines
-/// (populated exactly on this status) — and the wet "Failed to rollback:"
+/// (populated exactly on this status) — and the wet "Failed to roll back:"
 /// section with exit 1.
 #[test]
 fn human_verbose_hash_mismatch_details() {
diff --git a/crates/socket-patch-cli/tests/covgap_commands_scan_hosted.rs b/crates/socket-patch-cli/tests/covgap_commands_scan_hosted.rs
index b99cb22a..41433f64 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_scan_hosted.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_scan_hosted.rs
@@ -1,6 +1,6 @@
-//! Coverage-gap tests for `commands/scan/hosted.rs` (coverage audit 2026-09).
+//! Coverage-gap tests for `commands/scan/hosted.rs`.
 //!
-//! Targets the audited never-executed branches of `run_redirect_selected`:
+//! Targets otherwise-untested branches of `run_redirect_selected`:
 //! the `bad_purl` / `no_url` reference skips, the WET takeover refusal
 //! (vendored revert fails closed) and its refused-purl cleanup, the cargo
 //! socket-owned-wiring-without-ledger refusal, the bun.lockb dry-run /
@@ -388,7 +388,7 @@ fn warning_detail<'a>(doc: &'a Value, code: &str) -> &'a str {
         .unwrap_or_else(|| panic!("expected a `{code}` warning: {doc:#}"))
 }
 
-// ───────────────────── reference-skip reasons (835-844) ─────────────────────
+// ───────────────────── reference-skip reasons ─────────────────────
 
 /// A granted reference whose purl fails `parse_purl_simple` is skipped with
 /// reason `bad_purl` — never redirected, never recorded — and the project is
@@ -883,7 +883,8 @@ async fn zero_grant_wet_run_reports_a_malformed_ledger_without_moving_it() {
     assert_eq!(std::fs::read(&ledger).unwrap(), TORN);
 }
 
-/// The hosted `lock_io` envelope (contract §123/§138): a regular file
+/// The hosted `lock_io` envelope (CLI_CONTRACT.md "Lock lifecycle (v5.0)" and
+/// the hosted-mode "Lock (v5.0)" clause): a regular file
 /// squatting on `.socket/` makes the wet run's lock acquire fail with an I/O
 /// fault, not contention — top-level `errorCode: "lock_io"`, a string
 /// `error` naming the squatting path, `redirect: {mode: "hosted"}` retained,
@@ -946,8 +947,8 @@ async fn hosted_lock_io_when_a_file_squats_on_socket_dir() {
 /// `scan --mode hosted --yes` (human) and `scan --mode hosted --json`, each
 /// on a fresh project, `.socket/` holds exactly `vendor/` (the redirect
 /// ledger's home) — no `apply.lock` outlives the run, nothing else is
-/// created. The `--yes` human run also never prints the `Non-interactive
-/// mode detected` auto-accept line: the prompt is skipped, not answered.
+/// created. The human run also never prints the `Non-interactive mode
+/// detected` auto-accept line: scan never prompts.
 #[tokio::test]
 async fn successful_wet_hosted_run_leaves_only_vendor_under_socket() {
     let server = MockServer::start().await;
@@ -964,7 +965,7 @@ async fn successful_wet_hosted_run_leaves_only_vendor_under_socket() {
         names
     };
 
-    // Human `--yes` arm.
+    // Human arm.
     let tmp = tempfile::tempdir().unwrap();
     let root = tmp.path();
     write_npm_project(root, NAME);
@@ -1125,7 +1126,7 @@ async fn hosted_human_paid_only_discovery_stops_with_the_paid_hint() {
     server.verify().await;
 }
 
-// ───────────── cargo wiring-without-ledger refusal (1104-1114) ─────────────
+// ───────────── cargo wiring-without-ledger refusal ─────────────
 
 /// A cargo purl with SOCKET-OWNED `[patch.crates-io]` wiring — pre-v5 in
 /// .cargo/config.toml, or v5 in the root Cargo.toml — but NO vendored ledger
@@ -1769,7 +1770,7 @@ async fn malformed_bun_lockb_beside_pnpm_lock_is_not_confirmed() {
     );
 }
 
-// ───────────── live unreadable pnpm-workspace.yaml fallback (1450) ─────────────
+// ───────────── live unreadable pnpm-workspace.yaml fallback ─────────────
 
 /// Production wiring of the present-but-unreadable pnpm-workspace.yaml arm
 /// (the exact seam where a Create once overwrote the user's workspace file):
@@ -1833,7 +1834,7 @@ async fn unreadable_pnpm_workspace_gets_warning_only_guidance_in_a_live_run() {
     );
 }
 
-// ──────────── redirect_supersedes_vendored (1723-1726 + human) ────────────
+// ──────────── redirect_supersedes_vendored (+ human) ────────────
 
 /// The hosted-direction takeover warning: a LIVE lock routing package X to
 /// its hosted artifact while BOTH ledgers still claim X (redirect records +
@@ -2164,7 +2165,7 @@ async fn human_rush_run_prints_the_repo_state_stale_warning_line() {
     );
 }
 
-// ───────── ledger save failure after a successful revert (1065-1079) ─────────
+// ───────── ledger save failure after a successful revert ─────────
 
 /// save_state failure AFTER a successful takeover revert: the wiring is gone
 /// but the vendored ledger still claims it, so the purl must fail CLOSED —
@@ -2287,7 +2288,7 @@ async fn human_reference_failure_prints_an_error_line_and_exits_1() {
 }
 
 /// A malformed redirect ledger aborts with an `Error: The redirect ledger
-/// ...` line (it used to print a bare lowercase sentence).
+/// ...` line.
 #[tokio::test]
 async fn human_malformed_ledger_prints_an_error_prefix() {
     let server = MockServer::start().await;
@@ -2386,8 +2387,8 @@ async fn human_rerun_says_already_redirected_and_first_run_prints_next_steps() {
 }
 
 /// A granted patch whose package has no lock entry is listed by purl on
-/// stderr (it used to vanish: only a raw rewriter warning hinted at it),
-/// under a `No patches could be redirected:` headline when nothing was.
+/// stderr (not just hinted at by a raw rewriter warning), under a
+/// `No patches could be redirected:` headline when nothing was.
 #[tokio::test]
 async fn human_unconfirmed_purl_is_listed_with_a_headline() {
     let server = MockServer::start().await;
diff --git a/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs b/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs
index dde9044b..e34a34b1 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs
@@ -1,6 +1,6 @@
-//! Coverage-gap tests for `commands/scan/mod.rs` (2026-09 audit).
+//! Coverage-gap tests for `commands/scan/mod.rs`.
 //!
-//! Pins the audited-but-untested surfaces of `scan`:
+//! Pins the otherwise-untested surfaces of `scan`:
 //!
 //! * the remaining `resolve_mode_flags` cross-mode conflict arms (and
 //!   `ScanMode::Agent.cli_name()` reaching an error message);
@@ -19,12 +19,14 @@
 //! * per-patch vulnerability rendering in the "Patches to apply" preview;
 //! * the human post-apply GC line (both pluralization arms) and the
 //!   `hosted_wiring_retained` stderr warning after an in-place apply;
-//! * non-TTY human runs: a mode-less scan is report-only (no download, no
-//!   `.socket/`), while `--mode agent` / `--apply` / `--prune` auto-proceed;
-//! * the hosted human arm's results table, `[UPDATE]` detection and
-//!   confirm prompt (parity with the agent/vendored arms);
-//! * the declined download / redirect confirm via a PTY (exit 0, hint, no
-//!   mutation).
+//! * human runs: a bare scan runs hosted mode; a mode-less `--prune`/global
+//!   scan is report-only (no download, no `.socket/`, prints the
+//!   `scan --mode agent` hint), while `--mode agent` / `--apply` apply
+//!   without prompting;
+//! * the hosted human arm's results table and `[UPDATE]` detection (parity
+//!   with the agent/vendored arms);
+//! * scan on a PTY: never prompts, never opens the select menu under
+//!   --json, and renders the live status line cleanly.
 //!
 //! Subprocess runs scrub the `SOCKET_*` flag environment (the
 //! `cli_scan_silent.rs` pattern) so ambient developer/CI configuration
@@ -657,7 +659,7 @@ async fn scan_human_table_renders_update_marker_and_vuln_overflow() {
     write_npm_package(tmp.path(), "minimist", "1.2.2", b"x\n");
     seed_manifest(tmp.path(), &[(purl, OLD_UUID)]);
 
-    // --dry-run keeps the run read-only past the table (the confirm and
+    // --dry-run keeps the run read-only past the table (the download and
     // apply never run), so no view/blob mocks are needed.
     let (code, stdout, stderr) = run_scan_agent(tmp.path(), &mock.uri(), &["--dry-run", "--yes"]);
     assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
@@ -1271,10 +1273,10 @@ async fn scan_human_empty_batch_reports_no_patches_once() {
 }
 
 // ---------------------------------------------------------------------------
-// Non-TTY human scans: the mode-less scan is report-only, explicit intent
-// auto-proceeds
+// Human scans never prompt: a mode-less --prune/global scan is report-only,
+// agent mode applies
 // ---------------------------------------------------------------------------
-// v5: scan never prompts. A bare scan runs hosted mode; a `--prune` or
+// A bare scan runs hosted mode; a `--prune` or
 // global scan with no mode only reports (it has no lockfile to rewire),
 // and `--mode agent` applies in place without asking.
 
@@ -1383,9 +1385,9 @@ async fn scan_human_agent_prune_applies_and_collects() {
 }
 
 /// An empty discovery stops every human mode at "No patches available"
-/// with exit 0 and no `.socket/`: vendored mode no longer falls through to
+/// with exit 0 and no `.socket/`: vendored mode does not fall through to
 /// its vendor step to re-vendor a committed manifest (scan vendors what
-/// discovery selects), and hosted mode no longer enters its engine for a
+/// discovery selects), and hosted mode does not enter its engine for a
 /// zero-package redirect.
 #[tokio::test]
 async fn scan_human_empty_discovery_stops_in_every_mode() {
@@ -1421,15 +1423,13 @@ async fn scan_human_empty_discovery_stops_in_every_mode() {
 }
 
 // ---------------------------------------------------------------------------
-// Human `--mode hosted`: table + update detection parity and the confirm
+// Human hosted scan: table + update detection parity
 // ---------------------------------------------------------------------------
-// The hosted human arm used to return straight into the redirect engine —
-// no results table, no `[UPDATE]` marker, and no prompt (while `get --mode
-// hosted` and scan's agent/vendored arms all confirm). It now shares the
-// table/update block and confirms before the engine runs.
+// The hosted human arm shares the table/update block with the agent/vendored
+// arms, then runs the engine without prompting (scan never prompts).
 
 /// Reference endpoint denying the grant: the engine runs (proving the
-/// prompt was accepted) but rewrites nothing, so no lockfile fixture is
+/// hosted arm reached it) but rewrites nothing, so no lockfile fixture is
 /// needed.
 async fn mount_forbidden_reference(mock: &MockServer, purl: &str) {
     Mock::given(method("POST"))
@@ -1607,8 +1607,8 @@ mod pty {
             cmd.arg(a);
         }
         cmd.cwd(cwd);
-        // Scrub the flag-bound SOCKET_* surface (SOCKET_YES=true would skip
-        // the very prompt under test); keep telemetry disabled and the
+        // Scrub the flag-bound SOCKET_* surface so ambient configuration
+        // cannot reroute the run; keep telemetry disabled and the
         // update notifier off — this child gets a REAL terminal, so the
         // stderr-TTY guard does not protect it.
         for (key, _) in std::env::vars_os() {
@@ -2169,7 +2169,7 @@ async fn mount_empty_batch(mock: &MockServer) {
 }
 
 /// `scan --prune` with nothing to apply still garbage-collects, like the
-/// JSON path (it used to return early and silently skip the GC), and a
+/// JSON path, and a
 /// `--dry-run` previews it without touching the manifest.
 #[tokio::test]
 async fn scan_human_prune_runs_gc_even_when_no_patches_are_available() {
@@ -2338,8 +2338,8 @@ async fn scan_human_does_not_offer_an_already_recorded_patch() {
     );
 }
 
-/// The human table's PACKAGE column grows to fit the PURL (the old fixed
-/// 40-column cut dropped the version), and the rule matches the table.
+/// The human table's PACKAGE column grows to fit the PURL (a fixed-width
+/// cut would drop the version), and the rule matches the table.
 #[tokio::test]
 async fn scan_human_table_shows_full_purl_with_version() {
     let mock = MockServer::start().await;
diff --git a/crates/socket-patch-cli/tests/covgap_commands_scan_vendor_flow.rs b/crates/socket-patch-cli/tests/covgap_commands_scan_vendor_flow.rs
index e0e6d697..090c5f38 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_scan_vendor_flow.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_scan_vendor_flow.rs
@@ -1,6 +1,6 @@
-//! Coverage-gap tests for `commands/scan/vendor_flow.rs` (2026-09 audit).
+//! Coverage-gap tests for `commands/scan/vendor_flow.rs`.
 //!
-//! Pins the audited-but-untested surfaces of `scan --vendor`:
+//! Pins the otherwise-untested surfaces of `scan --vendor`:
 //!
 //! * the `already_vendored` dry-run preview arm (the sibling
 //!   `would_vendor` / `would_revendor` arms are pinned by
diff --git a/crates/socket-patch-cli/tests/covgap_commands_setup.rs b/crates/socket-patch-cli/tests/covgap_commands_setup.rs
index 35afa135..9d8024b0 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_setup.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_setup.rs
@@ -1,5 +1,6 @@
-//! Coverage-gap tests for `commands/setup.rs` (audit at d5e1815; the file is
-//! unchanged since). Each section names the uncovered line ranges it drives.
+//! Coverage-gap tests for `commands/setup.rs`. Each section's "Covers NNN"
+//! refs are setup.rs line numbers at the d5e1815 audit and have drifted
+//! since; use the named functions/messages to locate the code.
 //!
 //! Everything here runs on the host with no Docker and no ecosystem
 //! toolchain: `setup` edits package.json / requirements.txt / pyproject.toml /
@@ -815,8 +816,8 @@ fn exclude_already_persisted_skips_manifest_rewrite() {
 // ---------------------------------------------------------------------------
 
 /// `setup --exclude` in a directory with no project files reports `no_files`
-/// and must NOT leave a `.socket/manifest.json` behind (the exclude list
-/// used to be persisted before discovery).
+/// and must NOT leave a `.socket/manifest.json` behind (the exclude list is
+/// persisted only after discovery).
 #[test]
 fn setup_exclude_in_empty_dir_writes_no_socket_dir() {
     let tmp = tempfile::tempdir().expect("tempdir");
@@ -1774,8 +1775,8 @@ fn setup_does_not_persist_an_unmatched_exclude() {
 /// `Warning: Unreadable vendor state (…)` line plus a `vendor_ledger` error
 /// entry — verdict `error`, exit 1 — never as a `configured` verdict. The
 /// manifest-free vendored project (the only `scan`/`get --mode vendored`
-/// posture) is exactly where the corrupt ledger used to be swallowed: hooks
-/// wired, no manifest, garbage `state.json` → `configured`, exit 0, silence.
+/// posture) is exactly where a swallowed corrupt ledger would read as
+/// hooks wired, no manifest, garbage `state.json` → `configured`, exit 0.
 #[test]
 fn check_reports_an_unreadable_vendor_ledger_instead_of_configured() {
     let tmp = tempfile::tempdir().unwrap();
diff --git a/crates/socket-patch-cli/tests/covgap_commands_update.rs b/crates/socket-patch-cli/tests/covgap_commands_update.rs
index d0b7b7ea..82aa57f2 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_update.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_update.rs
@@ -1,5 +1,5 @@
-//! Coverage-gap tests for `commands/update.rs` (audit of 2026-09, commit
-//! d5e1815): the pinned already-there message (a zero-network path), the
+//! Coverage-gap tests for `commands/update.rs`: the pinned already-there
+//! message (a zero-network path), the
 //! already-latest `--json` envelope shape, the human-mode dry-run prints
 //! (both the `--force` "Would reinstall" wording and the plain
 //! "Update available" wording), and the PTY-driven interactive decline.
@@ -7,8 +7,7 @@
 //! Every wet run drives a COPY of the built binary staged into a tempdir
 //! (`update_fixture::staged_install`) — `CARGO_BIN_EXE_socket-patch`
 //! itself must never be a swap target. Fixture shapes are copied from
-//! self_update_e2e.rs / interactive_prompts_e2e.rs (do not edit those
-//! files).
+//! self_update_e2e.rs / interactive_prompts_e2e.rs.
 
 #[path = "common/pty_io.rs"]
 mod pty_io;
@@ -28,11 +27,11 @@ const DEAD_ENDPOINT: &str = "http://127.0.0.1:9";
 
 /// `--update <CURRENT>`: an explicit pin equal to the compiled version is
 /// an informational no-op that never creates a network client — no
-/// latest-resolution, no sums, no download (update.rs:225). It must use
+/// latest-resolution, no sums, no download. It must use
 /// the PINNED wording ("already version X", not "already the latest": the
 /// pin path cannot know what the latest is), and it must NOT refresh the
-/// passive notifier cache (update.rs:170 gates the state write on
-/// `!pinned` — a pin says nothing about the latest release, so caching it
+/// passive notifier cache (the `if !pinned` state-write gate in `run()` —
+/// a pin says nothing about the latest release, so caching it
 /// as `latestSeen` would poison the nag).
 #[test]
 fn update_pin_to_current_is_noop_zero_network() {
@@ -70,9 +69,8 @@ fn update_pin_to_current_is_noop_zero_network() {
     update_fixture::StagedInstall::assert_build_artifact_untouched(&real_hash);
 }
 
-/// The already-latest `--json` envelope (update.rs:229-241) is a machine
-/// contract scripts branch on, and it has only ever been exercised in
-/// human mode: exit 0, `status: success`, `dryRun: false`, exactly one
+/// The already-latest `--json` envelope is a machine contract scripts
+/// branch on: exit 0, `status: success`, `dryRun: false`, exactly one
 /// skipped/already_latest event carrying `details.current`/`details.latest`,
 /// summary agreeing, and the empty `warnings` omitted (additive-only
 /// envelope contract). One resolve, zero sums, zero downloads.
@@ -135,9 +133,8 @@ async fn update_already_latest_json_envelope_shape() {
 /// `--dry-run --force` when already up to date: the probe still reports
 /// first (one resolve, zero downloads, zero mutation), and the human
 /// message is the documented "Would reinstall … (dry run; --force)"
-/// wording (update.rs:193) via the human-mode dry-run print
-/// (update.rs:215) — both existing dry-run tests pass `--json`, so this
-/// interactive-facing surface never executed.
+/// wording via the human-mode dry-run print (the other dry-run tests pass
+/// `--json`).
 #[tokio::test]
 async fn update_dry_run_force_up_to_date_human_says_would_reinstall() {
     let real_hash = update_fixture::real_binary_hash();
@@ -172,9 +169,9 @@ async fn update_dry_run_force_up_to_date_human_says_would_reinstall() {
     update_fixture::StagedInstall::assert_build_artifact_untouched(&real_hash);
 }
 
-/// The plain human dry-run with an update available (update.rs:190-191 via
-/// the 215 print): "Update available: socket-patch X → Y (dry run; not
-/// installed)", exit 0, nothing downloaded, nothing swapped.
+/// The plain human dry-run with an update available: "Update available:
+/// socket-patch X → Y (dry run; not installed)", exit 0, nothing
+/// downloaded, nothing swapped.
 #[tokio::test]
 async fn update_dry_run_human_reports_update_available() {
     let install = staged_install();
@@ -207,10 +204,10 @@ async fn update_dry_run_human_reports_update_available() {
 }
 
 // ---------------------------------------------------------------------------
-// Interactive decline (update.rs:251-255) — PTY-driven: ui::confirm
+// Interactive decline — PTY-driven: ui::confirm
 // auto-proceeds with default-yes on non-TTY stdin (and under --yes/--json),
 // so only a real terminal reaches the cancel branch. Runner copied from
-// interactive_prompts_e2e.rs (do not edit that file), adapted to spawn the
+// interactive_prompts_e2e.rs, adapted to spawn the
 // STAGED binary with injected env — so even a decline-regression that
 // proceeds to a swap can only ever touch the tempdir copy, and the dead
 // SOCKET_UPDATE_BASE_URL kills such a run at download.
@@ -298,9 +295,9 @@ mod pty {
         )
     }
 
-    /// Declining the update confirm must cancel with exit 1 and "Update
-    /// cancelled.", leaving the installed binary byte-identical. The
-    /// pin-to-current + `--force` combination reaches the confirm with
+    /// Declining the reinstall confirm must cancel with exit 1 and
+    /// "Reinstall cancelled.", leaving the installed binary byte-identical.
+    /// The pin-to-current + `--force` combination reaches the confirm with
     /// ZERO network before the prompt (pinned skips latest-resolution,
     /// --force skips the already-there return), and the dead endpoint
     /// guarantees that even a decline-regression dies at download instead
diff --git a/crates/socket-patch-cli/tests/covgap_commands_vendor.rs b/crates/socket-patch-cli/tests/covgap_commands_vendor.rs
index a7483c22..0c6399bd 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_vendor.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_vendor.rs
@@ -1,4 +1,4 @@
-//! Coverage-gap tests for `commands/vendor.rs` (2026-09 coverage audit):
+//! Coverage-gap tests for `commands/vendor.rs`:
 //! the fail-closed ledger/manifest exit contracts, the fresh-clone
 //! committed-artifact staging error ladder, the redirect-ledger takeover
 //! guard, the human-mode (no `--json`) output surface, and the unix
@@ -741,9 +741,8 @@ fn human_revert_empty_ledger_prints_nothing_to_revert() {
 
 /// Human plain vendor with no manifest at all: the clean no-op message,
 /// exit 0 (same contract as apply). The line names the MANIFEST — the
-/// fixture's `.socket/` (blobs) very much exists, so the old "No .socket
-/// folder found" text was false here and on every hosted-only or
-/// vendored-mode project.
+/// fixture's `.socket/` (blobs) very much exists, as it does on every
+/// hosted-only or vendored-mode project.
 #[test]
 fn human_missing_manifest_prints_nothing_to_vendor() {
     let fx = npm_fixture();
@@ -926,9 +925,9 @@ async fn revert_state_write_failure_reports_failed_after_removal() {
 /// whose ledger save fails AFTER the entry's revert succeeded
 /// (`.socket/vendor` read-only, the artifact dir under `npm/` still
 /// deletable). The purl carries BOTH its `vendor_reconciled` removal and a
-/// `vendor_state_write_failed` failure, and the run exits 1 — pre-fix
-/// `reconcile_dropped` swallowed the error (`let _ = save_state`) and
-/// exited 0 with a ledger still listing the reverted purl.
+/// `vendor_state_write_failed` failure, and the run exits 1 —
+/// `reconcile_dropped` must not swallow the save error and exit 0 with a
+/// ledger still listing the reverted purl.
 #[cfg(unix)]
 #[tokio::test]
 async fn reconcile_state_write_failure_reports_failed_after_removal() {
diff --git a/crates/socket-patch-cli/tests/covgap_commands_vex.rs b/crates/socket-patch-cli/tests/covgap_commands_vex.rs
index d9a31ae0..a1bed29c 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_vex.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_vex.rs
@@ -1,4 +1,4 @@
-//! Coverage-gap tests for `commands/vex.rs` (2026-09 coverage audit): the
+//! Coverage-gap tests for `commands/vex.rs`: the
 //! corrupt-ledger/corrupt-manifest hard-error family, the multi-manifest
 //! product auto-detect warning echo, and the four skip guards in the
 //! go-patches `replace` synthesis (including the SECURITY fail-closed
@@ -132,7 +132,7 @@ fn write_ghost_npm_manifest(cwd: &Path, purl: &str) {
 }
 
 // ──────────────────────────────────────────────────────────────────────
-// corrupt manifest → `manifest_unreadable`, exit 2 (line 682)
+// corrupt manifest → `manifest_unreadable`, exit 2 (read_manifest Err arm)
 //
 // A PRESENT-but-corrupt `.socket/manifest.json` is the hard exit-2 error
 // (`read_manifest` → Err), distinct from the missing-manifest exit-2
@@ -233,7 +233,7 @@ fn corrupt_manifest_json_envelope_carries_code_and_removes_stale_doc() {
 }
 
 // ──────────────────────────────────────────────────────────────────────
-// corrupt redirect ledger → `redirect_ledger_corrupt`, exit 2 (692-693)
+// corrupt redirect ledger → `redirect_ledger_corrupt`, exit 2 (redirect ledger load)
 //
 // The module doc promises a HARD error for a present-but-malformed
 // `.socket/vendor/redirect-state.json`: attesting with its records
@@ -341,10 +341,8 @@ fn corrupt_redirect_ledger_json_envelope_carries_code_and_preserves_ledger() {
 // ──────────────────────────────────────────────────────────────────────
 // corrupt vendor ledger → `vendor_ledger_corrupt`, exit 2
 //
-// DELIBERATE CHANGE (manifest-less VEX): a present-but-corrupt
-// `.socket/vendor/state.json` used to DEGRADE (stderr warning, vendored
-// purls fell through to the installed tree and were omitted). It is now a
-// hard error mirroring `redirect_ledger_corrupt`: the vendor ledger is an
+// A present-but-corrupt `.socket/vendor/state.json` is a hard error
+// mirroring `redirect_ledger_corrupt`: the vendor ledger is an
 // attestation input in its own right — it carries embedded records and
 // the entries whose wiring liveness gates them — so a run that cannot read
 // it cannot tell which vendored patches it is dropping, and attesting from
@@ -450,7 +448,7 @@ fn corrupt_vendor_ledger_json_envelope_carries_code_and_preserves_ledger() {
 }
 
 // ──────────────────────────────────────────────────────────────────────
-// multi-manifest auto-detect warning echo (792-794)
+// multi-manifest auto-detect warning echo (resolve_product_id)
 //
 // `detect_product` warns when multiple project manifests coexist (e.g.
 // package.json + Cargo.toml, no .git) and `resolve_product_id` must echo
@@ -604,15 +602,15 @@ fn auto_detect_multi_manifest_warning_suppressed_by_silent() {
 }
 
 // ──────────────────────────────────────────────────────────────────────
-// go-patches synthesis skip guards (875, 879, 884, 891)
+// go-patches synthesis skip guards
 //
 // `synthesize_go_patches` walks the tamper-able `go.mod` replace set;
 // owner classification is by target-path prefix (`.socket/go-patches/`),
 // so hand-written lines reach every guard:
-//   (a) version-less directory replace          → skipped (875)
-//   (b) go-patches replace with no manifest purl → skipped (879)
-//   (c) explicit (LIVE) vendor entry takes precedence → skipped (884)
-//   (d) SECURITY: unsafe module coordinates      → skipped (891) — the
+//   (a) version-less directory replace          → skipped
+//   (b) go-patches replace with no manifest purl → skipped
+//   (c) explicit (LIVE) vendor entry takes precedence → skipped
+//   (d) SECURITY: unsafe module coordinates      → skipped — the
 //       only end-to-end proof that a tampered go.mod cannot key an
 //       out-of-tree path into VEX verification (the inline unit test only
 //       pins the predicate, not that the synthesis consults it).
diff --git a/crates/socket-patch-cli/tests/covgap_ecosystem_dispatch.rs b/crates/socket-patch-cli/tests/covgap_ecosystem_dispatch.rs
index c3655302..5fee90f8 100644
--- a/crates/socket-patch-cli/tests/covgap_ecosystem_dispatch.rs
+++ b/crates/socket-patch-cli/tests/covgap_ecosystem_dispatch.rs
@@ -4,8 +4,7 @@
 //! ecosystem dispatch branch", but deno is absent from both its apply and
 //! rollback halves — lcov shows the deno `scan_ecosystem!` invocation has
 //! never executed with a `pkg:jsr/` PURL in any test. These two tests close
-//! that charter gap using the sibling suite's own oracles (adapted copies —
-//! that file is owned by another suite and must not be edited):
+//! that charter gap using the sibling suite's own oracles (adapted copies):
 //!
 //! * **Apply branch** — a manifest holding one `pkg:jsr/` PURL, run under
 //!   `apply --offline --json --ecosystems deno` with nothing installed. The
diff --git a/crates/socket-patch-cli/tests/covgap_output.rs b/crates/socket-patch-cli/tests/covgap_output.rs
index 21121cac..eb964cc2 100644
--- a/crates/socket-patch-cli/tests/covgap_output.rs
+++ b/crates/socket-patch-cli/tests/covgap_output.rs
@@ -1,5 +1,4 @@
-//! Coverage-gap tests for the interactive TTY branches of `src/ui/prompt.rs`
-//! (2026-09 coverage audit):
+//! Coverage-gap tests for the interactive TTY branches of `src/ui/prompt.rs`:
 //!
 //! * `confirm()`'s bare-Enter -> `default_yes` return. Every production
 //!   caller passes `default_yes = true`, so this IS the "Enter proceeds
@@ -26,7 +25,7 @@ use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
 // Pulled in for `git_sha256` (the patch-view blob fixture below must clear
-// PR #158's "patch has no applicable files" guardrail with a real blob
+// the "patch has no applicable files" guardrail with a real blob
 // hash). Read-only reuse of the shared helper module.
 #[path = "common/mod.rs"]
 mod common;
@@ -318,7 +317,7 @@ async fn received_paths(mock: &MockServer) -> Vec<String> {
         .collect()
 }
 
-/// A single-file patch-view `files` map that survives PR #158's "patch has
+/// A single-file patch-view `files` map that survives the "patch has
 /// no applicable files" guardrail: one net-new file with an all-zero
 /// `beforeHash`, a real git-blob `afterHash`, and matching base64
 /// `blobContent`. These tests pass `--save-only`, which records without
@@ -342,7 +341,7 @@ fn single_file_view() -> serde_json::Value {
 /// be caught by the request log rather than dying on a confusing 404.
 ///
 /// Both patches carry the same `publishedAt` and no vulnerabilities, so
-/// `cmp_search_results` falls through severity/coverage/recency to its
+/// `cmp_search_results` falls through merge coverage/severity/recency/tier to its
 /// uuid-ascending backstop: UUID_A ranks first, deterministically, without
 /// depending on how the date string parses.
 async fn mount_two_free_patches(mock: &MockServer, purl: &str, encoded: &str) {
@@ -531,7 +530,7 @@ fn get_interactive_dialoguer_quit_cancels_with_exit_zero() {
     // Cancelling the dialoguer menu → `interact_opt()` returns `Ok(None)` →
     // `select_one` maps it to `SelectError::Cancelled` (ui/prompt.rs) →
     // get prints "Selection cancelled." and exits 0 without downloading
-    // anything (get.rs:660-663).
+    // anything (get.rs, the SelectError::Cancelled arm after select_one).
     //
     // The keystroke is `q`, not ESC: dialoguer 0.11's Select treats
     // `Key::Escape | Key::Char('q')` identically (both return `None` from
diff --git a/crates/socket-patch-cli/tests/covgap_setup_gem_mod.rs b/crates/socket-patch-cli/tests/covgap_setup_gem_mod.rs
index 989cc381..44eefd78 100644
--- a/crates/socket-patch-cli/tests/covgap_setup_gem_mod.rs
+++ b/crates/socket-patch-cli/tests/covgap_setup_gem_mod.rs
@@ -1,4 +1,4 @@
-//! Coverage-gap integration test for `setup/gem/mod.rs` (audit at d5e1815):
+//! Coverage-gap integration test for `setup/gem/mod.rs`:
 //! the binary-level gem `setup` → `setup --remove` round trip that clears
 //! bundler's machine-local plugin registration under `BUNDLE_APP_CONFIG`.
 //!
diff --git a/crates/socket-patch-cli/tests/covgap_setup_gem_version.rs b/crates/socket-patch-cli/tests/covgap_setup_gem_version.rs
index 846ec3f0..d4000795 100644
--- a/crates/socket-patch-cli/tests/covgap_setup_gem_version.rs
+++ b/crates/socket-patch-cli/tests/covgap_setup_gem_version.rs
@@ -11,8 +11,7 @@
 //!   * exit 0 but unparseable stdout → the probe fails OPEN, setup wires;
 //!   * nonzero exit → the probe fails OPEN, setup wires.
 //!
-//! Sibling host-run gem tests live in setup_invariants.rs; this file is
-//! additive (coverage-audit file-ownership rules). Shims are sh scripts, so
+//! Sibling host-run gem tests live in setup_invariants.rs. Shims are sh scripts, so
 //! the whole file is unix-only — matching every other PATH-shim suite.
 #![cfg(unix)]
 
diff --git a/crates/socket-patch-cli/tests/covgap_update_download.rs b/crates/socket-patch-cli/tests/covgap_update_download.rs
index 4d2cfa34..6bf578ed 100644
--- a/crates/socket-patch-cli/tests/covgap_update_download.rs
+++ b/crates/socket-patch-cli/tests/covgap_update_download.rs
@@ -1,5 +1,5 @@
 //! Coverage-gap e2e for `update::download::fetch_archive`'s non-404 HTTP
-//! failure branch (2026-09 coverage audit): a server error on the asset
+//! failure branch: a server error on the asset
 //! download must surface as `download_failed` — not `asset_not_found`,
 //! which is reserved for 404 ("no prebuilt binary for your target").
 //!
diff --git a/crates/socket-patch-cli/tests/covgap_update_swap.rs b/crates/socket-patch-cli/tests/covgap_update_swap.rs
index d047d2ad..2730744a 100644
--- a/crates/socket-patch-cli/tests/covgap_update_swap.rs
+++ b/crates/socket-patch-cli/tests/covgap_update_swap.rs
@@ -1,5 +1,5 @@
 //! Coverage-gap e2e for `update::swap::acquire_update_lock`'s unlocked
-//! degrade (2026-09 coverage audit): when no per-user state dir resolves
+//! degrade: when no per-user state dir resolves
 //! at all — the `SOCKET_UPDATE_STATE_DIR` override, `XDG_CACHE_HOME`, and
 //! `HOME` all unset/empty — the updater proceeds WITHOUT the single-flight
 //! lock rather than refusing on exotic environments. A documented
diff --git a/crates/socket-patch-cli/tests/docker_e2e_gem.rs b/crates/socket-patch-cli/tests/docker_e2e_gem.rs
index e906f10d..830a4996 100644
--- a/crates/socket-patch-cli/tests/docker_e2e_gem.rs
+++ b/crates/socket-patch-cli/tests/docker_e2e_gem.rs
@@ -16,8 +16,6 @@
 //! both apply paths run gated, without `--force`: `scan --sync`'s own
 //! nested apply must patch the file in the same run, and the explicit
 //! `apply` (against restored pristine bytes) must pass the variant gate.
-//! With the old all-zeros placeholder the nested apply failed invisibly
-//! and only the `--force` escape hatch was ever exercised.
 
 #![cfg(feature = "docker-e2e")]
 
diff --git a/crates/socket-patch-cli/tests/docker_e2e_npm.rs b/crates/socket-patch-cli/tests/docker_e2e_npm.rs
index d1578d47..ee3455a7 100644
--- a/crates/socket-patch-cli/tests/docker_e2e_npm.rs
+++ b/crates/socket-patch-cli/tests/docker_e2e_npm.rs
@@ -9,16 +9,16 @@
 //! when it fails). NOTE: because the fixture uses a placeholder all-zero
 //! beforeHash and serves no before-blob, an --offline rollback cannot
 //! actually restore the original bytes here — that path is the offline
-//! guard, not a genuine restore. See the summary in the audit notes.
+//! guard, not a genuine restore.
 //!
 //! Run modes:
 //!   - Default (Docker): requires Docker daemon. Pulls `socket-patch-test-
 //!     npm:latest` (built from `tests/docker/Dockerfile.npm` — base built
 //!     from `tests/docker/Dockerfile.base`). If the image isn't present
-//!     the test fails with a clear build-instruction error.
+//!     the test prints a skip notice and passes vacuously.
 //!   - Host mode: set `SOCKET_PATCH_TEST_HOST=1`. Skips Docker; runs npm
-//!     and socket-patch on the host. Requires host-installed npm + a
-//!     debug socket-patch binary at `target/debug/socket-patch`.
+//!     and socket-patch on the host. Requires npm and `socket-patch` on
+//!     PATH.
 //!
 //! Run command:
 //!   `cargo test -p socket-patch-cli --features docker-e2e --test docker_e2e_npm`
@@ -166,9 +166,10 @@ async fn make_mock_server(after_hash: &str) -> MockServer {
                     // bytes, so apply's hash-verify reports HashMismatch.
                     // We pass --force to the apply step to override and
                     // exercise the blob-write path against real on-disk
-                    // content. (`get.rs::download_and_apply_patches`
-                    // requires both hashes to be Some, so we can't send
-                    // null here.)
+                    // content. (A null beforeHash would mark the file as a
+                    // new-file insert — see get.rs `files_for_manifest` —
+                    // so a placeholder hash is needed to exercise the
+                    // overwrite path.)
                     "beforeHash": "0000000000000000000000000000000000000000000000000000000000000000",
                     "afterHash":  after_hash,
                     "blobContent": blob_b64,
@@ -674,8 +675,8 @@ async fn npm_install_scan_apply_rollback_cycle() {
     );
     assert_vex_agent_attested(&stdout, PURL);
 
-    // Keep the workspace_root reference alive — used by host mode to
-    // resolve the in-tree binary. Without this clippy warns unused.
+    // Keep the workspace_root reference alive; without this clippy warns
+    // unused.
     let _ = workspace_root();
 
     // The mock must have served BOTH the metadata discovery (batch) and
diff --git a/crates/socket-patch-cli/tests/docker_e2e_vendor_maven.rs b/crates/socket-patch-cli/tests/docker_e2e_vendor_maven.rs
index 47cba505..cd36ce57 100644
--- a/crates/socket-patch-cli/tests/docker_e2e_vendor_maven.rs
+++ b/crates/socket-patch-cli/tests/docker_e2e_vendor_maven.rs
@@ -267,7 +267,8 @@ echo "===FRESH INSTALL VERIFIED==="
 
 # TAMPER PROBE: mutate the vendored jar (leaving its .sha1 stale), purge the
 # target from $M2, and force a cold re-resolve → checksumPolicy=fail must reject
-# it. Restore the pristine jar + re-warm $M2 afterward so stage 3 is clean.
+# it. Restore the pristine jar afterward (stage 3 re-warms $M2 from the clean
+# vendored repo).
 cp "$VJAR" /tmp/vjar.pristine
 printf 'TAMPER' >> "$VJAR"
 rm -rf "$M2/org/apache/commons/commons-text"
diff --git a/crates/socket-patch-cli/tests/docker_e2e_vendor_pypi_pm.rs b/crates/socket-patch-cli/tests/docker_e2e_vendor_pypi_pm.rs
index ee962b77..3b022de5 100644
--- a/crates/socket-patch-cli/tests/docker_e2e_vendor_pypi_pm.rs
+++ b/crates/socket-patch-cli/tests/docker_e2e_vendor_pypi_pm.rs
@@ -20,13 +20,16 @@
 //!     (lock + pyproject/Pipfile + .socket/) are copied to a fresh dir; the
 //!     tool's STRICTEST install runs cold+offline and a Python import probe
 //!     proves `six.py` is the PATCHED bytes.
-//!   stage 2b (poetry, `--network none`, then the host): manifest-less VEX
-//!     over copies of the installed fresh checkout — manifest deleted →
-//!     attested offline from the ledger (standalone + `apply --vex`);
-//!     ledgers deleted → attested from the poetry.lock wiring + a wiremock
-//!     patch API (host side), `record_unavailable` under `--offline`; lock
-//!     reverted with ledger + artifact kept → `vendor_unwired`, `--no-verify`
-//!     too.
+//!   manifest-less VEX, per flavor: poetry stage 2b (`--network none`, then
+//!     the host) over copies of the installed fresh checkout — manifest
+//!     deleted → attested offline from the ledger (standalone + `apply
+//!     --vex`); ledgers deleted → attested from the poetry.lock wiring + a
+//!     wiremock patch API (host side), `record_unavailable` under
+//!     `--offline`; lock reverted with ledger + artifact kept →
+//!     `vendor_unwired`, `--no-verify` too. pdm runs the same matrix at the
+//!     end of stage 2 (offline only); pipenv has its own stage 2b (offline
+//!     only; the online ledger-less step is covered by
+//!     e2e_vex_build/e2e_vex_lockfile).
 //!   stage 3 (`--network none`): re-vendor is idempotent (already_vendored,
 //!     lock byte-stable) → `vendor --revert` restores the lock byte-identical
 //!     to the pre-vendor snapshot and removes `.socket/vendor` → re-vendor
diff --git a/crates/socket-patch-cli/tests/docker_vendor_common/mod.rs b/crates/socket-patch-cli/tests/docker_vendor_common/mod.rs
index 6e5637da..91023a27 100644
--- a/crates/socket-patch-cli/tests/docker_vendor_common/mod.rs
+++ b/crates/socket-patch-cli/tests/docker_vendor_common/mod.rs
@@ -153,7 +153,7 @@ git_blob_sha() {
 /// zero network. The optional trailing `<ghsa> <cve>` pair records one
 /// high-severity vulnerability so a generated VEX document has a statement
 /// to emit; omitted, `vulnerabilities` stays empty. Shape mirrors
-/// `e2e_vendor_npm_build.rs::stage_patch` / `stage_patch_with_vuln`.
+/// `e2e_vendor_npm_build.rs::stage_patch_with_vuln`.
 /// Requires [`bash_prelude`] (uses `git_blob_sha`).
 pub fn stage_patch_fn() -> &'static str {
     r#"stage_patch() {
diff --git a/crates/socket-patch-cli/tests/e2e_cargo.rs b/crates/socket-patch-cli/tests/e2e_cargo.rs
index b8770d4c..65581526 100644
--- a/crates/socket-patch-cli/tests/e2e_cargo.rs
+++ b/crates/socket-patch-cli/tests/e2e_cargo.rs
@@ -4,8 +4,7 @@
 //! Cargo registry layout.  They do **not** require network access or a real
 //! Cargo installation: the scan's patch lookup is pinned to an in-test
 //! [`wiremock`] public-proxy stand-in via `--proxy-url`. That pinning is
-//! load-bearing, not cosmetic — since the all-batches-failed fix, an
-//! unreachable API is a hard scan failure (exit 1, `status: "error"`), so an
+//! load-bearing, not cosmetic — an unreachable API is a hard scan failure (exit 1, `status: "error"`), so an
 //! unpinned scan would phone home to the live proxy on every test run and go
 //! red whenever the network (or an ambient `SOCKET_*` variable) misbehaved.
 //!
@@ -110,11 +109,10 @@ async fn scan_json(cwd: &Path, proxy_url: &str) -> serde_json::Value {
     value
 }
 
-/// Regression guard for the hermeticity fix: every scan in a test must have
-/// routed its patch lookup through the in-test proxy. Fewer recorded requests
-/// than scans means at least one binary invocation talked to the live API (or
-/// skipped the lookup outright) despite the pinning — exactly the bug this
-/// file used to have.
+/// Hermeticity guard: every scan in a test must have routed its patch lookup
+/// through the in-test proxy. Fewer recorded requests than scans means at
+/// least one binary invocation talked to the live API (or skipped the lookup
+/// outright) despite the pinning.
 async fn assert_proxy_served_scans(server: &MockServer, scans: usize) {
     let requests = server.received_requests().await.unwrap_or_default();
     assert!(
@@ -140,10 +138,9 @@ async fn scan_discovers_fake_registry_crates() {
     // The crawler only falls back to scanning the global `$CARGO_HOME`
     // registry when the cwd actually looks like a Rust project (has a
     // `Cargo.toml` / `Cargo.lock`). Without this manifest the registry path
-    // is never exercised and discovery silently returns zero — which the old
-    // `contains("packages")` assertion happily accepted via the
-    // "No packages found" message. Provide the manifest so the registry
-    // branch is genuinely taken.
+    // is never exercised and discovery silently returns zero (whose
+    // "No packages found" message a loose `contains("packages")` check would
+    // accept). Provide the manifest so the registry branch is genuinely taken.
     std::fs::write(
         dir.path().join("Cargo.toml"),
         "[package]\nname = \"myapp\"\nversion = \"0.1.0\"\n",
@@ -185,9 +182,8 @@ async fn scan_discovers_fake_registry_crates() {
 
     // --- Human path: the count must be attributed to the *cargo* ecosystem,
     // proving the registry crawler (not some accidental npm/pypi pickup) is
-    // what found them. This also guards against the old loophole where the
-    // failure message "No packages found" satisfied a `contains("packages")`
-    // check.
+    // what found them (a bare `contains("packages")` would also match the
+    // "No packages found" failure message).
     let output = run(
         &["scan", "--cwd", dir.path().to_str().unwrap()],
         dir.path(),
@@ -249,7 +245,7 @@ async fn scan_discovers_vendor_crates() {
     );
 
     // --- Human path: the discovery must be attributed to the cargo ecosystem,
-    // and must NOT report "No packages found" (the old loophole).
+    // and must NOT report "No packages found".
     let output = run(
         &["scan", "--cwd", dir.path().to_str().unwrap()],
         dir.path(),
diff --git a/crates/socket-patch-cli/tests/e2e_composer.rs b/crates/socket-patch-cli/tests/e2e_composer.rs
index 9c4ef401..92810ff8 100644
--- a/crates/socket-patch-cli/tests/e2e_composer.rs
+++ b/crates/socket-patch-cli/tests/e2e_composer.rs
@@ -4,10 +4,8 @@
 //! Composer vendor layout.  They do **not** require network access or a real
 //! PHP/Composer installation: every scan's patch lookup is pinned to an
 //! in-test wiremock proxy (empty no-patch result), so a live-API outage can
-//! never fail them and the discovery counts stay the only thing under test.
-//! (They used to call the real public proxy implicitly — green only while
-//! production was healthy — and turned red when the all-batches-failed
-//! exit-code fix made total API failure exit non-zero.)
+//! never fail them (total API failure exits non-zero) and the discovery
+//! counts stay the only thing under test.
 //!
 //! # Running
 //! ```sh
@@ -72,10 +70,10 @@ async fn run(args: &[&str], cwd: &std::path::Path, proxy_url: &str) -> Output {
     .expect("socket-patch subprocess task panicked")
 }
 
-/// Regression guard: every scan in a test must have routed its patch lookup
+/// Hermeticity guard: every scan in a test must have routed its patch lookup
 /// through the in-test proxy. Fewer recorded requests than scans means a
 /// binary invocation talked to the live API (or skipped the lookup) despite
-/// the pinning — exactly the flake this file used to have.
+/// the pinning.
 async fn assert_proxy_served_scans(server: &MockServer, scans: usize) {
     let requests = server.received_requests().await.unwrap_or_default();
     assert!(
@@ -91,8 +89,9 @@ async fn assert_proxy_served_scans(server: &MockServer, scans: usize) {
 ///
 /// Parsing (rather than substring matching) means a malformed or missing
 /// envelope fails the test loudly instead of slipping past a `.contains()`
-/// check. Doing this offline is safe: the package *count* is derived from the
-/// local crawl and is emitted regardless of whether the API query succeeds.
+/// check. The package *count* is derived from the local crawl; the patch
+/// lookup is served by the in-test proxy, so the exit-0 / status=success
+/// assertions hold without live network access.
 async fn scan_json(cwd: &std::path::Path, proxy_url: &str) -> serde_json::Value {
     let output = run(
         &["scan", "--json", "--cwd", cwd.to_str().unwrap()],
diff --git a/crates/socket-patch-cli/tests/e2e_embedded_vex.rs b/crates/socket-patch-cli/tests/e2e_embedded_vex.rs
index 7ea4f1f0..4d619aa1 100644
--- a/crates/socket-patch-cli/tests/e2e_embedded_vex.rs
+++ b/crates/socket-patch-cli/tests/e2e_embedded_vex.rs
@@ -36,7 +36,7 @@ fn binary() -> &'static str {
 /// `--vex-product`/`SOCKET_VEX_PRODUCT`, `--vex-no-verify`/
 /// `SOCKET_VEX_NO_VERIFY`, `--vex-doc-id`, `--vex-compact`), as do the
 /// `GlobalArgs` (`SOCKET_OFFLINE`, `SOCKET_FORCE`, `SOCKET_API_TOKEN`,
-/// `SOCKET_ORG`, …). If the ambient environment leaks any of these into
+/// `SOCKET_ORG_SLUG`, …). If the ambient environment leaks any of these into
 /// the child, a test silently stops exercising the path it names —
 /// `apply_vex_failure_flips_exit_code` would no longer hit
 /// product-detection failure if `SOCKET_VEX_PRODUCT` were exported, and the
@@ -419,11 +419,9 @@ fn apply_json_envelope_carries_vex_summary() {
 }
 
 /// `--dry-run` applies nothing, so embedded VEX generation must be
-/// skipped entirely. Before the fix, VEX ran anyway and verified the
-/// deliberately-unapplied tree: every patch classified `not_applied`,
-/// `build_document` produced nothing, and the whole command exited 1
-/// with `no_applicable_patches` even though the dry-run verification
-/// itself succeeded. A dry run must exit 0, report no `vex` summary,
+/// skipped entirely (verifying the deliberately-unapplied tree would
+/// classify every patch `not_applied` and exit 1 with
+/// `no_applicable_patches`). A dry run must exit 0, report no `vex` summary,
 /// and never write an attestation file.
 #[test]
 fn apply_dry_run_skips_embedded_vex() {
@@ -512,10 +510,8 @@ fn apply_vex_failure_flips_exit_code() {
 
 /// `--silent` means "errors only", never "nothing" (CLI_CONTRACT): a
 /// requested-but-failed VEX still exits 1, and the failure message must
-/// reach stderr. Regression guard: the human-readable VEX status block
-/// gated ALL of its arms — the error arm included — on `!silent`, so
-/// `apply --silent --vex out.json` on a VEX failure exited 1 with zero
-/// diagnostic output. Same fixture as `apply_vex_failure_flips_exit_code`:
+/// reach stderr: the human-readable VEX status block must not gate its
+/// error arm on `!silent`. Same fixture as `apply_vex_failure_flips_exit_code`:
 /// apply succeeds offline, then product detection fails (no root
 /// package.json / git remote, no `--vex-product`).
 #[test]
@@ -726,10 +722,9 @@ fn apply_vex_product_non_iri_warns_in_human_mode() {
 
 /// Under `--json` the run-level VEX advisories are silenced on stderr
 /// (`note_warning` skips the print), so the envelope's `vex.warnings` is
-/// the ONLY channel they reach a consumer on. Regression guard: the
-/// embedded hosts built their `vex` summary from `statements` alone, so a
-/// non-IRI product produced a warning that was invisible on exactly the
-/// machine channel — absent from the envelope AND absent from stderr.
+/// the ONLY channel they reach a consumer on: the embedded hosts' `vex`
+/// summary must carry them (not just `statements`), or a non-IRI product's
+/// warning would be absent from the envelope AND from stderr.
 #[test]
 fn apply_json_vex_warnings_ride_in_envelope() {
     let tmp = tempfile::tempdir().expect("create tempdir");
diff --git a/crates/socket-patch-cli/tests/e2e_gem.rs b/crates/socket-patch-cli/tests/e2e_gem.rs
index 002a94dd..da04518f 100644
--- a/crates/socket-patch-cli/tests/e2e_gem.rs
+++ b/crates/socket-patch-cli/tests/e2e_gem.rs
@@ -289,8 +289,10 @@ fn percent_decode(s: &str) -> String {
 /// with an empty (no-patch) result. Returns the running server.
 ///
 /// In proxy mode (no API token — `run()` strips `SOCKET_API_TOKEN`) the scan
-/// issues one `GET /patch/by-package/<percent-encoded-purl>` per discovered
-/// package. Capturing those requests lets us assert the *exact* PURLs the
+/// first POSTs `/patch/batch`, which this mock leaves unrouted (404), so the
+/// client falls back to one `GET /patch/by-package/<percent-encoded-purl>`
+/// per discovered package. Capturing those fallback requests lets us assert
+/// the *exact* PURLs the
 /// gem crawler synthesized — name, version, and `pkg:gem/` ecosystem — rather
 /// than trusting a self-reported count.
 async fn start_proxy() -> MockServer {
diff --git a/crates/socket-patch-cli/tests/e2e_hosted_production.rs b/crates/socket-patch-cli/tests/e2e_hosted_production.rs
index eacda8a8..5c17b75a 100644
--- a/crates/socket-patch-cli/tests/e2e_hosted_production.rs
+++ b/crates/socket-patch-cli/tests/e2e_hosted_production.rs
@@ -143,10 +143,11 @@ const GEM_PURL: &str = "pkg:gem/activestorage@6.0.3";
 const GEM_NAME: &str = "activestorage";
 const GEM_VERSION: &str = "6.0.3";
 /// Acceptable patch UUIDs for [`GEM_PURL`] — an any-of set, mirroring
-/// [`PYPI_UUIDS`]: patch selection is server-ranked and the non-TTY scan
-/// auto-selects the top candidate, so pinning a single UUID would red the
-/// required check on a server-side reorder or a second published 6.0.3
-/// patch. The gem leg parses the UUID actually WIRED into the rewritten
+/// [`PYPI_UUIDS`]: patch selection is ranked by `api::ranking` (merged
+/// patches first, newest first) and scan always auto-selects the top
+/// candidate, so pinning a single UUID would red the required check whenever
+/// production publishes a newer or merged 6.0.3 patch. The gem leg parses
+/// the UUID actually WIRED into the rewritten
 /// Gemfile, asserts it is one of these, and content-verifies against that
 /// exact patch's `/patch/view` manifest. When production publishes another
 /// acceptable 6.0.3 patch, verify it and append its UUID here.
@@ -155,40 +156,27 @@ const GEM_UUIDS: &[&str] = &[
     // 2026-08-18 catalog republish.
     "15e960b5-f432-4b6c-b8aa-534a2b419323",
     // GHSA-w749-p3v6-hccq / CVE-2022-21831 (image_processing_transformer.rb),
-    // published 2026-08-19T21:19Z when production re-extended 6.0.3 with the
-    // second advisory; the server-ranked selection now wires this one.
-    // Content live-verified 2026-08-20: served .gem matches the /info
-    // checksum, carries the Socket patch header in the transformer, and every
-    // other file is byte-identical to stock rubygems 6.0.3.
+    // published 2026-08-19T21:19Z — the second advisory.
     "6c4141c5-1535-4fd2-9db1-b5f8e4834bdb",
     // GHSA-9xrj-h377-fr87 / CVE-2026-33195 (disk_service.rb +
     // disk_controller.rb + errors.rb), published 2026-08-20T16:14Z when
-    // production extended 6.0.3 with a third advisory. /patch/view blobs
-    // live-verified 2026-08-20: every touched file carries the Socket
-    // Community Patch header.
+    // production extended 6.0.3 with a third advisory.
     "eeb6bf9f-96c0-4963-a0f1-2e88f91f8b1a",
     // GHSA-r4mg-4433-c7g3 / CVE-2025-24293 (image_processing_transformer.rb),
-    // published 2026-08-20T20:31Z — the fourth advisory. /patch/view blobs
-    // live-verified 2026-08-20: carries the Socket Community Patch header.
+    // published 2026-08-20T20:31Z — the fourth advisory.
     "c1a1cd3c-b670-4e44-b4fa-1a63ecd42db6",
     // GHSA-xr9x-r78c-5hrm / CVE-2026-66066 (image_processing_transformer.rb +
     // NEW lib/active_storage/vips.rb backporting the libvips
     // unfuzzed-operations hardening), published 2026-08-21T19:07Z — the fifth
-    // advisory, and the one the server-ranked selection now wires.
-    // /patch/view blobs live-verified 2026-08-24: both files carry the Socket
-    // Community Patch header and git-blob-sha256-match their manifest
-    // afterHash entries.
+    // advisory; selected until the 2026-09-04 merged patch below.
     "9c2b4925-b413-4a3a-bb3a-9990440fb446",
     // MERGED patch — the first one production has published for any pinned
     // purl: GHSA-w749-p3v6-hccq / CVE-2022-21831 + GHSA-r4mg-4433-c7g3 /
     // CVE-2025-24293 + GHSA-xr9x-r78c-5hrm / CVE-2026-66066 in one artifact
     // (image_processing_transformer.rb allowlist + unsupported-method guard,
     // engine.rb + active_storage.rb config plumbing, NEW vips.rb libvips
-    // backport). Published 2026-09-04T21:23Z; the server-ranked selection
-    // (merge rung) now wires this one. Served .gem live-verified 2026-09-08:
-    // sha256 matches the registry /info checksum, all four touched files
-    // carry the Socket Community Patch header naming this UUID, metadata and
-    // every other file are byte-identical to stock rubygems 6.0.3.
+    // backport). Published 2026-09-04T21:23Z; the client-side merge rung in
+    // `api::ranking` now selects this one.
     "01019627-b481-4bae-bc09-e93b5a5e4481",
 ];
 
@@ -306,7 +294,7 @@ fn has_command(cmd: &str) -> bool {
 }
 
 /// The three legacy `SOCKET_PATCH_*` names still honored at runtime via
-/// `socket_patch_core::env_compat` — not in the clap-bound lists, so they need
+/// `socket_patch_core::utils::env_compat` — not in the clap-bound lists, so they need
 /// scrubbing separately.
 const LEGACY_ENV_VARS: &[&str] = &[
     "SOCKET_PATCH_PROXY_URL",
@@ -1166,13 +1154,13 @@ fn pnpm_hosted_install_proof() {
     //   (https://patch.socket.dev/...) that does not match the registry's
     //   published metadata (https://registry.npmjs.org/minimist/-/...)
     //
-    // `--trust-lockfile` is pnpm's documented opt-out. This is a real
-    // compatibility gap in socket-patch's pnpm hosted mode, not a test bug:
-    // the CLI should emit a `redirect_pnpm_*` warning naming the flag, the way
-    // it already does for the gem CHECKSUMS and Rush repo-state cases. Until
-    // it does, this leg proves the artifact IS correctly served and installs
-    // cleanly once the policy is relaxed — and it fails loudly if the failure
-    // is anything OTHER than that known policy rejection.
+    // `--trust-lockfile` is pnpm's documented opt-out. The CLI warns with
+    // `redirect_pnpm_trust_lockfile` and, by default, auto-configures
+    // `trustLockfile: true` in pnpm-workspace.yaml; the `--trust-lockfile`
+    // retry below is the fallback for layouts that auto-config does not
+    // cover. It proves the artifact IS correctly served and installs cleanly
+    // once the policy is relaxed — and fails loudly if the failure is
+    // anything OTHER than that known policy rejection.
     let detail = dump(&reinstall);
     assert!(
         detail.contains("ERR_PNPM_TARBALL_URL_MISMATCH"),
@@ -2072,16 +2060,10 @@ fn pypi_uv_lock_hosted_install_proof() {
 /// the patch rewrites is verified on disk against the `/patch/view`
 /// afterHash.
 ///
-/// # History
-///
-/// Hosted gem mode was long blocked by a **server-side** compact-index
-/// defect: the patch-registry's `/info/<gem>` line declared no runtime
-/// dependencies while the `.gem` it served declared several, so bundler's
-/// `ensure_same_dependencies` check failed closed with
-/// `Bundler::APIResponseMismatchError`. The 2026-08-18 gem catalog republish
-/// fixed the index (deps now served, `/versions` 200), and the probe-based
-/// tolerance this leg used to carry — pass on a non-2xx `/versions`, enforce
-/// on 2xx — retired itself exactly as designed and was deleted.
+/// The patch-registry's `/info/<gem>` line must declare the served `.gem`'s
+/// runtime dependencies, or bundler's `ensure_same_dependencies` check fails
+/// closed with `Bundler::APIResponseMismatchError` (production's defect until
+/// the 2026-08-18 gem catalog republish).
 ///
 /// NOTE (latent, server-side): the registry's `/api/v1/dependencies` route
 /// still answers 200 with an empty body. That bug is unreachable today —
@@ -2147,9 +2129,10 @@ async fn gem_bundler_hosted_install_proof() {
 
     // Hard assertions: the redirect itself must be correct. The wired patch
     // UUID is parsed back out of the rewritten Gemfile rather than assumed:
-    // selection is server-ranked (the non-TTY scan auto-selects the top
-    // candidate), so the leg accepts any UUID in the pinned any-of set and
-    // then content-verifies against the one bundler was actually given.
+    // selection is ranked client-side by `api::ranking` and scan always
+    // auto-selects the top candidate, so the leg accepts any UUID in the
+    // pinned any-of set and then content-verifies against the one bundler
+    // was actually given.
     let gemfile = read(&proj.join("Gemfile"));
     let wired_uuid = wired_gem_registry_uuid(&gemfile).unwrap_or_else(|| {
         panic!(
@@ -2169,7 +2152,7 @@ async fn gem_bundler_hosted_install_proof() {
         lock.contains("CHECKSUMS"),
         "{LEG}: Gemfile.lock lost its CHECKSUMS section:\n{lock}"
     );
-    // Converged-lock proof (the #212 shape): a rewrite that only moved the
+    // Converged-lock proof: a rewrite that only moved the
     // CHECKSUMS pin would leave the lock's GEM section on rubygems.org — a
     // mixed state an unfrozen install can silently paper over. The GEM
     // section must carry a patch-registry remote and DEPENDENCIES must
diff --git a/crates/socket-patch-cli/tests/e2e_maven.rs b/crates/socket-patch-cli/tests/e2e_maven.rs
index 40676a01..63f53e27 100644
--- a/crates/socket-patch-cli/tests/e2e_maven.rs
+++ b/crates/socket-patch-cli/tests/e2e_maven.rs
@@ -4,8 +4,7 @@
 //! Maven local repository layout.  They do **not** require network access or a
 //! real Maven/Java installation: the scan's patch lookup is pinned to an
 //! in-test [`wiremock`] public-proxy stand-in via `--proxy-url`. That pinning
-//! is load-bearing, not cosmetic — since the all-batches-failed fix, an
-//! unreachable API is a hard scan failure (exit 1, `status: "error"`), so an
+//! is load-bearing, not cosmetic — an unreachable API is a hard scan failure (exit 1, `status: "error"`), so an
 //! unpinned scan would phone home to the live proxy on every test run and go
 //! red whenever the network (or an ambient `SOCKET_*` variable) misbehaved.
 //!
@@ -80,11 +79,10 @@ async fn run(args: &[&str], cwd: &Path, m2_repo: &Path, proxy_url: &str) -> Outp
     .expect("socket-patch subprocess task panicked")
 }
 
-/// Regression guard for the hermeticity fix: every scan in a test must have
-/// routed its patch lookup through the in-test proxy. Fewer recorded requests
-/// than scans means at least one binary invocation talked to the live API (or
-/// skipped the lookup outright) despite the pinning — exactly the bug this
-/// file used to have.
+/// Hermeticity guard: every scan in a test must have routed its patch lookup
+/// through the in-test proxy. Fewer recorded requests than scans means at
+/// least one binary invocation talked to the live API (or skipped the lookup
+/// outright) despite the pinning.
 async fn assert_proxy_served_scans(server: &MockServer, scans: usize) {
     let requests = server.received_requests().await.unwrap_or_default();
     assert!(
@@ -101,7 +99,7 @@ async fn assert_proxy_served_scans(server: &MockServer, scans: usize) {
 
 /// Verify that `socket-patch scan` discovers artifacts in a fake Maven local repo.
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[ignore = "experimental ecosystem (maven): not gating CI until the maven backend is implemented; run with --ignored"]
+#[ignore = "opt-in maven crawl e2e; run with --ignored"]
 async fn scan_discovers_maven_artifacts() {
     let server = start_proxy().await;
     let proxy_url = server.uri();
@@ -179,8 +177,7 @@ async fn scan_discovers_maven_artifacts() {
         output.status.code()
     );
     // Must NOT have hit the empty-crawl path — that line *also* contains
-    // the word "packages", which is exactly what let the old assertion
-    // pass when discovery was disabled.
+    // the word "packages".
     assert!(
         !combined.contains("No packages found")
             && !combined.contains("No packages found"),
@@ -229,7 +226,7 @@ async fn scan_discovers_maven_artifacts() {
 
 /// Verify that `socket-patch scan` discovers Gradle project artifacts.
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[ignore = "experimental ecosystem (maven): not gating CI until the maven backend is implemented; run with --ignored"]
+#[ignore = "opt-in maven crawl e2e; run with --ignored"]
 async fn scan_discovers_gradle_project_artifacts() {
     let server = start_proxy().await;
     let proxy_url = server.uri();
@@ -264,9 +261,8 @@ async fn scan_discovers_gradle_project_artifacts() {
 
     // --- JSON run: the `scannedPackages` count is the contract field -----
     // A single artifact lives in the repo. We assert the *value* (1), not
-    // merely the presence of the key — the old `contains("scannedPackages")`
-    // check passed even when the count was 0 (i.e. nothing discovered),
-    // since the field is always emitted.
+    // merely the presence of the key — the field is always emitted, even
+    // when nothing was discovered.
     let output = run(
         &["scan", "--json", "--cwd", project_dir.to_str().unwrap()],
         &project_dir,
diff --git a/crates/socket-patch-cli/tests/e2e_nuget.rs b/crates/socket-patch-cli/tests/e2e_nuget.rs
index e00e2e8b..93fc84b7 100644
--- a/crates/socket-patch-cli/tests/e2e_nuget.rs
+++ b/crates/socket-patch-cli/tests/e2e_nuget.rs
@@ -4,8 +4,7 @@
 //! NuGet package layouts.  They do **not** require network access or a real
 //! .NET installation: the scan's patch lookup is pinned to an in-test
 //! [`wiremock`] public-proxy stand-in via `--proxy-url`. That pinning is
-//! load-bearing, not cosmetic — since the all-batches-failed fix, an
-//! unreachable API is a hard scan failure (exit 1, `status: "error"`), so an
+//! load-bearing, not cosmetic — an unreachable API is a hard scan failure (exit 1, `status: "error"`), so an
 //! unpinned scan would phone home to the live proxy on every test run and go
 //! red whenever the network (or an ambient `SOCKET_*` variable) misbehaved.
 //!
@@ -160,11 +159,10 @@ async fn assert_json_scanned(
     );
 }
 
-/// Regression guard for the hermeticity fix: every scan in a test must have
-/// routed its patch lookup through the in-test proxy. Fewer recorded requests
-/// than scans means at least one binary invocation talked to the live API (or
-/// skipped the lookup outright) despite the pinning — exactly the bug this
-/// file used to have.
+/// Hermeticity guard: every scan in a test must have routed its patch lookup
+/// through the in-test proxy. Fewer recorded requests than scans means at
+/// least one binary invocation talked to the live API (or skipped the lookup
+/// outright) despite the pinning.
 async fn assert_proxy_served_scans(server: &MockServer, scans: usize) {
     let requests = server.received_requests().await.unwrap_or_default();
     assert!(
@@ -181,7 +179,7 @@ async fn assert_proxy_served_scans(server: &MockServer, scans: usize) {
 
 /// Verify that `socket-patch scan` discovers packages in a fake global cache layout.
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[ignore = "experimental ecosystem (nuget): not gating CI until the nuget backend is implemented; run with --ignored"]
+#[ignore = "opt-in nuget crawl e2e; run with --ignored"]
 async fn scan_discovers_global_cache_packages() {
     let server = start_proxy().await;
     let proxy_url = server.uri();
@@ -227,9 +225,8 @@ async fn scan_discovers_global_cache_packages() {
         "scan should exit 0 on a clean discovery, got {:?}:\n{combined}",
         output.status.code()
     );
-    // The crawler must NOT fall through to the empty-result message — that is
-    // the bug the old substring check ("packages" ⊂ "No packages found.")
-    // masked.
+    // The crawler must NOT fall through to the empty-result message (which a
+    // "packages" substring check would also match).
     assert!(
         !combined.contains("No packages found")
             && !combined.contains("No packages found") && !combined.contains("No global packages found"),
@@ -250,7 +247,7 @@ async fn scan_discovers_global_cache_packages() {
 
 /// Verify that `socket-patch scan` discovers packages in a fake legacy packages/ layout.
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[ignore = "experimental ecosystem (nuget): not gating CI until the nuget backend is implemented; run with --ignored"]
+#[ignore = "opt-in nuget crawl e2e; run with --ignored"]
 async fn scan_discovers_legacy_packages() {
     let server = start_proxy().await;
     let proxy_url = server.uri();
diff --git a/crates/socket-patch-cli/tests/e2e_pypi.rs b/crates/socket-patch-cli/tests/e2e_pypi.rs
index 9b2b4a99..1d1dda17 100644
--- a/crates/socket-patch-cli/tests/e2e_pypi.rs
+++ b/crates/socket-patch-cli/tests/e2e_pypi.rs
@@ -62,7 +62,7 @@ fn git_sha256_file(path: &Path) -> String {
 }
 
 /// The three legacy `SOCKET_PATCH_*` names still honored at runtime via
-/// `socket_patch_core::env_compat` — not in the clap-bound lists, so they
+/// `socket_patch_core::utils::env_compat` — not in the clap-bound lists, so they
 /// need scrubbing separately.
 const LEGACY_ENV_VARS: &[&str] = &[
     "SOCKET_PATCH_PROXY_URL",
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_bun_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_bun_build.rs
index cb8d6521..7915abe6 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_bun_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_bun_build.rs
@@ -48,7 +48,7 @@
 //! is pinned from both sides as [`TARBALL_INTEGRITY_ENFORCED_FROM`]. The
 //! vendored twin lives in `e2e_vendor_bun_build.rs`.
 //!
-//! The get-driven twin (v3.6) runs step 3 as `get <uuid> --mode hosted`
+//! The get-driven twin (v4.0) runs step 3 as `get <uuid> --mode hosted`
 //! instead of `scan --mode hosted` — same hosted engine by construction
 //! (get routes through scan's `run_redirect_selected`), so the lock/ledger
 //! assertions and the fresh-checkout proof are shared via [`HostedDriver`].
@@ -549,7 +549,7 @@ enum HostedDriver {
     /// `scan --mode hosted --vex …` — the original capstone path, in-run
     /// VEX assertions included.
     ScanVex,
-    /// `get <uuid> --mode hosted` — the v3.6 per-advisory selector. The
+    /// `get <uuid> --mode hosted` — the v4.0 per-advisory selector. The
     /// UUID identifier path is exempt from installed narrowing, so the
     /// fixture's view + reference mocks are all it needs. No manifest, no
     /// blobs, no vex flags (get has none).
@@ -1203,7 +1203,7 @@ async fn bun_redirect_fresh_checkout_installs_patched_bytes() {
     assert_patched_fresh_install(&fx);
 }
 
-/// get-driven twin (v3.6): `get <uuid> --mode hosted` must land the SAME
+/// get-driven twin (v4.0): `get <uuid> --mode hosted` must land the SAME
 /// hosted rewrite as the scan capstone — same engine by construction — and a
 /// fresh checkout carrying only package.json + bun.lock + .socket/ must
 /// install the patched bytes from the hosted tarball. The fixture's GetUuid
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_cargo_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_cargo_build.rs
index 20949088..e3229b03 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_cargo_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_cargo_build.rs
@@ -38,7 +38,7 @@
 //! decoration.
 //!
 //! A get-driven twin (`cargo_get_uuid_hosted_fresh_checkout_fetch`) drives
-//! the SAME fixture through `get <uuid> --mode hosted` (v3.6) — parity by
+//! the SAME fixture through `get <uuid> --mode hosted` (v4.0) — parity by
 //! construction, since get hands the (purl, uuid) pair to scan's extracted
 //! run_redirect_selected engine — and re-proves the fresh-checkout fetch.
 //! Hosted get writes NO manifest and NO blobs (the redirect ledger is the
@@ -999,7 +999,7 @@ async fn cargo_hosted_fresh_checkout_fetch_pulls_patched_crate_and_vex_verifies(
         .await;
 }
 
-/// get-driven twin (v3.6): `get <uuid> --mode hosted --json --yes` must land
+/// get-driven twin (v4.0): `get <uuid> --mode hosted --json --yes` must land
 /// the SAME three-file rewrite + ledger as the scan capstone (asserted
 /// inside the shared fixture — parity by construction through
 /// run_redirect_selected, redirected count via the transactional
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_gem_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_gem_build.rs
index 05409ed0..95283d24 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_gem_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_gem_build.rs
@@ -44,7 +44,7 @@
 //! `gems.rb`/`gems.locked` spelling (which bundler prefers over `Gemfile`
 //! when both exist — this pins the candidate-list + rewriter support).
 //!
-//! The `get <uuid> --mode hosted` twin (v3.6) drives the SAME fixture
+//! The `get <uuid> --mode hosted` twin (v4.0) drives the SAME fixture
 //! through get's per-advisory selector instead of scan — same hosted engine
 //! by construction (CLI_CONTRACT.md "get --mode and installed narrowing"):
 //! identical Gemfile/lock rewrite + ledger, get's envelope (nested
@@ -392,7 +392,7 @@ enum Driver {
     /// recipe with the in-run (unverified) attestation.
     ScanVex,
     /// `get <uuid> --mode hosted --json --yes` — get's per-advisory
-    /// selector (v3.6). No `--vex` (get has none); the uuid path needs only
+    /// selector (v4.0). No `--vex` (get has none); the uuid path needs only
     /// the view + reference mocks and is exempt from installed narrowing.
     GetUuid,
 }
@@ -484,8 +484,9 @@ fn run_hosted_scan(proj: &Path, api: &str) -> (i32, String, String) {
 /// and assert the redirect envelope + Gemfile rewrite. `checksums_lock` opts
 /// the fixture lock into a CHECKSUMS section (`bundle lock --add-checksums`);
 /// `registry_declares_deps` toggles the patch registry's `/info` between the
-/// CORRECT contract (runtime deps declared) and today's production-like
-/// deps-less answer. `rotated_token` = Some(token B) arms a grant-rotation
+/// CORRECT contract (runtime deps declared) and production's HISTORICAL
+/// deps-less answer (fixed by the 2026-08-18 republish). `rotated_token` =
+/// Some(token B) arms a grant-rotation
 /// plan: the `TOKEN` grant answers the first two reference calls, token B
 /// (same uuid) every later one, and the patch registry serves both token
 /// paths (production keeps a grant alive until it expires). `None` = skip
@@ -977,8 +978,9 @@ fn assert_patched_install(fx: &RedirectFixture, fresh: &Path) {
     );
     // The deps contract: `tiny-dep` reaches the install ONLY through the
     // patch registry's `/info` declaring it (the fresh resolution re-derives
-    // vuln-gem's dependencies from that answer — production's deps-less
-    // answer drops it, see the red-arm twin).
+    // vuln-gem's dependencies from that answer — a deps-less answer
+    // (production's historical defect, reproduced by the red-arm twin) drops
+    // it).
     assert!(
         fresh_installed_lib(fresh, &format!("{TRANSITIVE}-1.0.0"), "tiny_dep.rb").is_file(),
         "the runtime dependency must install alongside the patched gem"
@@ -1154,7 +1156,8 @@ async fn manifestless_vex_matrix(fx: &RedirectFixture, fresh: &Path) {
 /// `git checkout`): the Gemfile still carries the patch-registry source
 /// block, the lock resolves the gem from upstream. Bundler re-resolves from
 /// the Gemfile — proven here with the REAL bundler — so the ledger keeps the
-/// patch live (vex_sources `redirect_record_live` step 0), while a
+/// patch live (`Discovery::redirect_record_live` step 0 in socket-patch-core
+/// vex/discover), while a
 /// ledger-less checkout has nothing discovery reads until that install
 /// re-converges the lock, after which it attests from the lock alone.
 async fn lock_only_revert_reconverges(fx: &RedirectFixture) {
@@ -1287,7 +1290,7 @@ async fn gem_hosted_fresh_checkout_bundle_install_installs_patched_bytes_and_vex
     lock_only_revert_reconverges(&fx).await;
 }
 
-/// GET-DRIVEN TWIN of the main capstone: `get <uuid> --mode hosted` (v3.6,
+/// GET-DRIVEN TWIN of the main capstone: `get <uuid> --mode hosted` (v4.0,
 /// the per-advisory selector) must leave the same committable redirect
 /// state as `scan --mode hosted` — same Gemfile source block, same ledger,
 /// NO manifest, NO blobs — proven the same way against the REAL bundler: a
@@ -1547,8 +1550,8 @@ async fn gem_hosted_checksums_lock_converges_and_installs_frozen_and_unfrozen()
     // rewrite): discovery reads it AND its CHECKSUMS pin.
     manifestless_vex_matrix(&fx, &frozen).await;
 
-    // UNFROZEN fresh checkout: the previously-pinned exit 37 "mismatched
-    // checksums" refusal is gone too.
+    // UNFROZEN fresh checkout: no exit 37 "mismatched checksums" refusal
+    // either.
     let (fresh, install) = fresh_checkout_bundle_install(&fx);
     assert!(
         install.status.success(),
@@ -1567,10 +1570,9 @@ async fn gem_hosted_checksums_lock_converges_and_installs_frozen_and_unfrozen()
 /// grant, (2) refresh the source block's URL IN PLACE under a rotated grant —
 /// exactly one Socket source block, a `redirect_gemfile_source_url` ledger
 /// edit, no stale token anywhere — and (3) leave a pair a fresh checkout
-/// installs the patched bytes from. Before the fix, the rotated re-scan
-/// wrapped the old block's indented gem line in a new NESTED source block
-/// (+1 nesting per re-scan), kept the stale token URL live, and still
-/// reported success.
+/// installs the patched bytes from — never wrap the old block's indented
+/// gem line in a new NESTED source block (+1 nesting per re-scan) with the
+/// stale token URL still live.
 #[tokio::test(flavor = "multi_thread")]
 #[ignore = "host capstone: shells out to a real ruby/gem/bundler (>= 1.17; CHECKSUMS arm >= 2.6); \
             the unpinned `test` job skips it, an e2e job with a pinned toolchain runs it via --ignored"]
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_npm_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_npm_build.rs
index e20d86ec..d578076d 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_npm_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_npm_build.rs
@@ -27,7 +27,7 @@
 //! the real sha512: the fresh `npm ci` must FAIL with an integrity error —
 //! the lockfile pin is enforcement, not decoration.
 //!
-//! v3.6 adds get-driven twins through the SAME fixture: `get <uuid> --mode
+//! v4.0 adds get-driven twins through the SAME fixture: `get <uuid> --mode
 //! hosted` must land the identical redirect (no manifest, no blobs — the
 //! ledger is the persistence), and `get <GHSA> --mode hosted` must narrow a
 //! two-version fan-out to the installed version BEFORE the grant request.
@@ -860,7 +860,7 @@ async fn npm_redirect_tampered_hosted_tarball_fails_fresh_npm_ci() {
     );
 }
 
-// ── get --mode hosted twins (v3.6) ────────────────────────────────────
+// ── get --mode hosted twins (v4.0) ────────────────────────────────────
 
 /// `get <uuid> --mode hosted` twin of the capstone: the same fixture (real
 /// npm install, patched hosted tarball, API mocks) driven by get's UUID path
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_pnpm_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_pnpm_build.rs
index c4949b98..b627eebc 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_pnpm_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_pnpm_build.rs
@@ -229,7 +229,7 @@ fn run_socket(cwd: &Path, args: &[&str]) -> (i32, String, String) {
 }
 
 /// Which CLI front door drives the hosted engine. Both consume the SAME
-/// engine by construction (v3.6): `scan --mode hosted` discovers the dep,
+/// engine by construction (v4.0): `scan --mode hosted` discovers the dep,
 /// while `get <uuid> --mode hosted` names the patch explicitly (the uuid
 /// identifier path is exempt from installed narrowing and needs no
 /// discovery mocks beyond view + reference, which the fixture mounts
@@ -1140,7 +1140,7 @@ async fn pnpm10_redirect_tampered_hosted_tarball_fails_fresh_frozen_install() {
     }
 }
 
-/// get-driven hosted twin (v3.6): `get <uuid> --mode hosted --json --yes`
+/// get-driven hosted twin (v4.0): `get <uuid> --mode hosted --json --yes`
 /// routes through the SAME hosted engine as `scan --mode hosted`, so the
 /// full pnpm@10 chain must hold unchanged — the fixture's lock splice,
 /// trustLockfile auto-config (pnpm-workspace.yaml gains `trustLockfile:
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_rush_sim.rs b/crates/socket-patch-cli/tests/e2e_redirect_rush_sim.rs
index 19aedb8d..dd589c50 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_rush_sim.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_rush_sim.rs
@@ -6,7 +6,8 @@
 //! `common/temp/pnpm-lock.yaml` from `common/config/rush/pnpm-lock.yaml`, then
 //! `rush install` runs `pnpm install --frozen-lockfile` inside `common/temp`.
 //!
-//! Tier 1 (default-runnable, gated on corepack pnpm): run the REAL CLI
+//! Tier 1 (`#[ignore]`d, runs as an e2e CI matrix leg on all 3 OSes;
+//! self-skips without corepack pnpm@9): run the REAL CLI
 //! `scan --mode hosted` against wiremock over a committed Rush-shaped fixture
 //! (rush.json + common/config/rush/pnpm-lock.yaml), then REPLICATE rush's
 //! install step in-test — clearly labeled a simulation: copy the rewritten
@@ -401,7 +402,7 @@ fn assert_rush_manifestless_vex(root: &Path, patch_server: &str, patched: &[u8],
     });
 }
 
-// ── Tier 1: default-runnable pnpm simulation ───────────────────────────
+// ── Tier 1: pnpm simulation (CI matrix leg) ───────────────────────────
 
 #[tokio::test(flavor = "multi_thread")]
 #[serial_test::serial]
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_yarn_berry_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_yarn_berry_build.rs
index b73bf72e..440774db 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_yarn_berry_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_yarn_berry_build.rs
@@ -245,7 +245,7 @@ fn bootstrap_berry_checksum(tmp: &Path, patched_tgz: &Path) -> Option<String> {
     let lock = std::fs::read_to_string(boot.join("yarn.lock")).ok()?;
     // yarn 4.0.x writes the bare hex, 4.1+ `10c0/<hex>`: the API form is the
     // prefixed one. A lock with neither is a harness failure, never a
-    // silent pass (the old `?` here returned before any assertion ran).
+    // silent pass.
     let checksum = yarn_berry_common::yarn_written_checksum(&lock);
     if checksum.is_none() {
         skip!(
@@ -270,7 +270,7 @@ struct BerryRedirectFixture {
 }
 
 /// Which CLI front door drives the hosted engine. Both consume the SAME
-/// engine by construction (v3.6): `scan --mode hosted` discovers the dep,
+/// engine by construction (v4.0): `scan --mode hosted` discovers the dep,
 /// while `get <uuid> --mode hosted` names the patch explicitly (the uuid
 /// identifier path is exempt from installed narrowing and needs only the
 /// view + reference mocks, which the fixture mounts anyway). get has no
@@ -698,7 +698,7 @@ async fn berry_redirect_fresh_checkout_installs_patched_bytes() {
     hosted_manifestless_vex_matrix(&fx, HostedDriver::Scan);
 }
 
-/// get-driven hosted twin (v3.6): `get <uuid> --mode hosted --json --yes`
+/// get-driven hosted twin (v4.0): `get <uuid> --mode hosted --json --yes`
 /// routes through the SAME hosted engine as `scan --mode hosted`, so the
 /// berry chain must hold unchanged — including the `10c0` cacheKey bootstrap
 /// (the fixture still resolves the patched tarball with a real yarn to pin
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_yarn_classic_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_yarn_classic_build.rs
index 2f92944a..97b2b1f0 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_yarn_classic_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_yarn_classic_build.rs
@@ -107,7 +107,7 @@ fn scrub_socket_env(cmd: &mut Command) {
 fn corepack(cwd: &Path, pm: &str, args: &[&str], extra_env: &[(&str, &str)]) -> Output {
     let mut cmd = Command::new("corepack");
     cmd.arg(pm).args(args).current_dir(cwd);
-    // Scrub FIRST (it removes YARN_* / SOCKET_* from the inherited env), then
+    // Scrub FIRST (it removes SOCKET_* and YARN_CACHE_FOLDER), then
     // set the hermetic flags so they survive.
     scrub_socket_env(&mut cmd);
     cache_env::isolate(&mut cmd);
@@ -218,7 +218,7 @@ struct ClassicRedirectFixture {
 }
 
 /// Which CLI front door drives the hosted engine. Both consume the SAME
-/// engine by construction (v3.6): `scan --mode hosted` discovers the dep,
+/// engine by construction (v4.0): `scan --mode hosted` discovers the dep,
 /// while `get <uuid> --mode hosted` names the patch explicitly (the uuid
 /// identifier path is exempt from installed narrowing and needs only the
 /// view + reference mocks, which the fixture mounts anyway). get has no
@@ -686,7 +686,7 @@ async fn classic_redirect_fresh_checkout_installs_patched_bytes() {
     tokio::task::block_in_place(|| hosted_dev_resave_vex(&fx));
 }
 
-/// get-driven hosted twin (v3.6): `get <uuid> --mode hosted --json --yes`
+/// get-driven hosted twin (v4.0): `get <uuid> --mode hosted --json --yes`
 /// routes through the SAME hosted engine as `scan --mode hosted`, so the
 /// classic chain must hold unchanged — the fixture's lock pin (hosted URL +
 /// `#sha1` + recomputed integrity) and ledger assertions run against the get
diff --git a/crates/socket-patch-cli/tests/e2e_safety_advisories.rs b/crates/socket-patch-cli/tests/e2e_safety_advisories.rs
index f01bf6f4..359ffae4 100644
--- a/crates/socket-patch-cli/tests/e2e_safety_advisories.rs
+++ b/crates/socket-patch-cli/tests/e2e_safety_advisories.rs
@@ -484,17 +484,14 @@ fn nuget_apply_deletes_metadata_and_records_files() {
     );
 }
 
-/// NuGet `has_signed_marker` non-UTF8 filename skip: dropping a
-/// file with a non-UTF8 name into the package directory exercises
-/// the `entry.file_name().to_str()` None arm of
-/// `has_signed_marker`'s iteration (line 93). The fixup then
-/// continues — the sha512 marker isn't present, no advisory; the
-/// `.nupkg.metadata` deletion still fires because we stage it too.
+/// NuGet `has_signed_marker` non-UTF8 filename: a file with a non-UTF8
+/// name in the package directory is byte-matched (it is not a
+/// `.nupkg.sha512` marker) and left untouched. The fixup continues — no
+/// advisory; the `.nupkg.metadata` deletion still fires because we stage
+/// it too.
 ///
-/// Linux-only (`OsStr::from_bytes` is Unix-gated; macOS HFS+/APFS
-/// also accept arbitrary byte sequences in filenames). Falls back
-/// to a portable shape on other Unices where the filesystem
-/// rejects non-UTF8 names.
+/// Unix-only (`OsStr::from_bytes` is Unix-gated). Skips where the
+/// filesystem rejects non-UTF8 names.
 #[cfg(unix)]
 #[test]
 fn nuget_apply_with_non_utf8_filename_in_pkg_dir() {
@@ -511,26 +508,18 @@ fn nuget_apply_with_non_utf8_filename_in_pkg_dir() {
         r#"{"contentHash":"deadbeef"}"#,
     )
     .unwrap();
-    // Drop a file with a non-UTF8 name into the package dir. The
-    // sidecar's `has_signed_marker` iteration calls
-    // `entry.file_name().to_str()` on each entry; this one returns
-    // None and the iteration skips past it (covering line 93 of
-    // nuget.rs).
-    //
-    // APFS/HFS+/ext4 all accept arbitrary byte sequences in
-    // filenames; some networked filesystems may reject. If the
-    // filesystem rejects, skip — the iteration arm is exercised on
-    // the runners where it can run.
+    // Drop a file with a non-UTF8 name into the package dir;
+    // `has_signed_marker` matches entries on their raw bytes, so this one
+    // is simply not a marker. Some networked filesystems reject non-UTF8
+    // names; skip there.
     let bad_name = OsStr::from_bytes(&[0xff, 0xfe, b'-', b'b', b'a', b'd']);
     let bad_path = pkg_dir.join(bad_name);
     if std::fs::write(&bad_path, b"binary").is_err() {
         eprintln!("SKIP: filesystem rejects non-UTF8 filenames");
         return;
     }
-    // Precondition must be genuinely established — otherwise the rest of
-    // this test would pass as a plain `.nupkg.metadata` deletion without
-    // ever exercising the non-UTF8 `to_str() == None` skip arm it exists
-    // to lock. A silent no-op here would mean the test guards nothing.
+    // Without the fixture this would pass as a plain `.nupkg.metadata`
+    // deletion and guard nothing.
     assert!(
         bad_path.exists(),
         "non-UTF8 fixture file must exist so has_signed_marker's None arm is reached"
@@ -597,7 +586,7 @@ fn nuget_apply_with_non_utf8_filename_in_pkg_dir() {
 /// converts that into a `sidecar_fixup_failed` advisory.
 ///
 /// Covers the non-NotFound arm of the remove_file match in
-/// `sidecars/nuget.rs` (lines 50-54) — the path the existing
+/// `patch/sidecars/nuget.rs::fixup` — the path the existing
 /// success and signed-package tests can't reach. As with the
 /// cargo equivalent, the directory-as-file ruse beats chmod
 /// because it fails uniformly across uids and platforms.
diff --git a/crates/socket-patch-cli/tests/e2e_safety_cargo_build.rs b/crates/socket-patch-cli/tests/e2e_safety_cargo_build.rs
index 510b4b25..328441d8 100644
--- a/crates/socket-patch-cli/tests/e2e_safety_cargo_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_safety_cargo_build.rs
@@ -605,7 +605,7 @@ fn apply_with_malformed_checksum_reports_sidecar_fixup_failed() {
     stage_socket_manifest(&consumer);
 
     // Corrupt the checksum file so cargo::fixup hits the
-    // `serde_json::from_str` Malformed error path. The fixup runs
+    // `serde_json::from_slice` Malformed error path. The fixup runs
     // AFTER the patch is committed atomically, so the patch itself
     // succeeds; only the sidecar emits an Error-severity advisory.
     let checksum = consumer.join("vendor/safety-fixture/.cargo-checksum.json");
@@ -843,10 +843,9 @@ fn apply_with_readonly_checksum_still_rewrites_it() {
 }
 
 /// Third Malformed branch: when `.cargo-checksum.json` exists but
-/// is a *directory* rather than a file. `tokio::fs::read_to_string`
-/// returns an I/O error with kind `IsADirectory` (Linux) /
-/// `InvalidInput` (macOS) — NOT `NotFound` — so the fixup hits the
-/// generic `Err(source)` arm in cargo.rs (lines 61-65) and returns
+/// is a *directory* rather than a file. `read_regular_to_bytes`'s
+/// regular-file check rejects it with a non-`NotFound` I/O error, so the
+/// fixup hits the generic `Err(source)` arm and returns
 /// `SidecarError::Io`. The boundary converts that to a
 /// `sidecar_fixup_failed` advisory.
 ///
@@ -861,8 +860,7 @@ fn apply_with_checksum_directory_reports_sidecar_fixup_failed() {
     stage_socket_manifest(&consumer);
 
     // Replace the regular `.cargo-checksum.json` file with a
-    // directory of the same name. `read_to_string` will refuse to
-    // treat it as a string.
+    // directory of the same name, which `read_regular_to_bytes` refuses.
     let checksum = consumer.join("vendor/safety-fixture/.cargo-checksum.json");
     std::fs::remove_file(&checksum).unwrap();
     std::fs::create_dir(&checksum).unwrap();
@@ -910,7 +908,7 @@ fn apply_with_checksum_directory_reports_sidecar_fixup_failed() {
 }
 
 /// Cargo sidecar no-op: no `.cargo-checksum.json` present at all.
-/// The fixup returns `Ok(None)` (lines 56-60 of cargo.rs) and the
+/// The fixup returns `Ok(None)` and the
 /// envelope carries no cargo record at all — apply still succeeds
 /// because the sidecar contract treats "no checksum file" as
 /// "nothing to do, package isn't from a directory source".
diff --git a/crates/socket-patch-cli/tests/e2e_safety_cow.rs b/crates/socket-patch-cli/tests/e2e_safety_cow.rs
index b3957ce2..96334fb4 100644
--- a/crates/socket-patch-cli/tests/e2e_safety_cow.rs
+++ b/crates/socket-patch-cli/tests/e2e_safety_cow.rs
@@ -14,7 +14,7 @@
 //!     with a private regular file; the target stays put.
 //!   * a multi-file patch where every patched file is hardlinked.
 //!   * regular files (no hardlink, no symlink) — CoW must be a
-//!     no-op, no `.socket-cow-*` litter in the parent directory.
+//!     no-op, no stage litter in the parent directory.
 //!
 //! These tests use the npm crawler against a synthetic
 //! `node_modules/<pkg>/` layout (no real npm install needed). The
@@ -272,10 +272,9 @@ fn apply_breaks_hardlink_before_patching() {
         1,
         "after CoW, the outside file should be a single-link inode"
     );
-    // CoW broke the link via a `.socket-cow-*` stage + rename; that
-    // stage file (and the atomic-writer's `.socket-stage-*`) must be
-    // gone. This is the only scenario class that exercises the CoW
-    // stager, so this is where a stage-cleanup regression would show.
+    // The atomic writer's `.socket-stage-*` rename-over broke the link;
+    // the stage must be gone (`.socket-cow-*` is checked only as a
+    // regression tripwire).
     assert_no_patch_litter(&fx.root().join("node_modules/cow-fixture"));
 }
 
@@ -318,8 +317,8 @@ fn apply_replaces_symlink_with_private_file() {
         git_sha256(ORIGINAL_BYTES),
         "the symlink target must NOT have been mutated; CoW must replace the link with a private file"
     );
-    // The symlink branch of CoW also stages a `.socket-cow-*` private
-    // copy and renames it over the link; no litter may remain.
+    // The `.socket-stage-*` rename-over replaced the link; no litter may
+    // remain.
     assert_no_patch_litter(&fx.root().join("node_modules/cow-fixture"));
 }
 
@@ -469,8 +468,8 @@ fn run_scrubs_ambient_socket_env() {
 /// Regular files (no hardlink, no symlink) are the common case.
 /// CoW must be a no-op fast path: no stage litter in the parent
 /// directory, no extra inodes created, the file is rewritten in
-/// place via the atomic-write path. This pins the
-/// `CowAction::AlreadyPrivate` route.
+/// place via the atomic-write path. This pins the plain regular-file
+/// path through `atomic_write_bytes`.
 #[test]
 #[serial_test::serial]
 fn apply_against_regular_file_leaves_no_cow_litter() {
@@ -484,16 +483,13 @@ fn apply_against_regular_file_leaves_no_cow_litter() {
     // File patched.
     assert_eq!(git_sha256_file(&fx.index_js()), git_sha256(PATCHED_BYTES));
 
-    // No `.socket-cow-*` or `.socket-stage-*` litter in the package
-    // directory after a successful apply. (For a regular file the
-    // `AlreadyPrivate` path never stages a `.socket-cow-*` copy, so this
-    // mainly guards the atomic writer's `.socket-stage-*` cleanup here;
-    // the hardlink/symlink tests are what cover the CoW stager.)
+    // No `.socket-stage-*` (or tripwire `.socket-cow-*`) litter in the
+    // package directory after a successful apply.
     assert_no_patch_litter(&fx.root().join("node_modules/cow-fixture"));
 }
 
-/// CoW happens before the atomic write — so on a hash-mismatch
-/// failure (where apply errors out without writing), the hardlink
+/// The pre-write hash gate fires before any stage/rename — so on a
+/// hash-mismatch failure (where apply errors out without writing), the hardlink
 /// pair must NOT have been broken either. The original outside
 /// file's inode and content must be byte-identical AND still
 /// share the same inode as the package file.
diff --git a/crates/socket-patch-cli/tests/e2e_safety_internals.rs b/crates/socket-patch-cli/tests/e2e_safety_internals.rs
index 3bd22782..6938ebca 100644
--- a/crates/socket-patch-cli/tests/e2e_safety_internals.rs
+++ b/crates/socket-patch-cli/tests/e2e_safety_internals.rs
@@ -23,7 +23,7 @@ use socket_patch_core::patch::sidecars::dispatch_fixup;
 /// Empty `patched` list short-circuits with `Ok(None)` — guards
 /// against callers that forget to check `files_patched.is_empty()`
 /// (apply.rs does, but the guard belongs on the engine side too).
-/// Covers `sidecars/mod.rs:110`.
+/// Covers the `patched.is_empty()` early return in `dispatch_fixup`.
 ///
 /// The PURL MUST name an ecosystem whose non-short-circuited path
 /// returns `Some` — otherwise the test is vacuous. A `pkg:cargo/...`
@@ -51,7 +51,8 @@ async fn dispatch_fixup_empty_patched_returns_none() {
 }
 
 /// Unknown PURL ecosystem (no recognized scheme prefix) also
-/// short-circuits with `Ok(None)`. Covers `sidecars/mod.rs:115`.
+/// short-circuits with `Ok(None)`. Covers the `Ecosystem::from_purl`
+/// early return in `dispatch_fixup`.
 #[tokio::test]
 async fn dispatch_fixup_unknown_ecosystem_returns_none() {
     let tmp = tempfile::tempdir().unwrap();
@@ -70,8 +71,8 @@ async fn dispatch_fixup_unknown_ecosystem_returns_none() {
 
 /// `dispatch_fixup` cargo path with a `patched` entry that points
 /// at a file that doesn't exist on disk exercises the
-/// `sha256_file` error arm inside `update_entries`
-/// (cargo.rs:131-133). In the apply-CLI flow this is race-only
+/// `read_regular_to_bytes(on_disk)` error arm inside `update_entries`.
+/// In the apply-CLI flow this is race-only
 /// (apply atomically wrote the file before dispatch_fixup is
 /// called), so direct invocation is the only way to drive it
 /// from outside the engine.
@@ -79,7 +80,7 @@ async fn dispatch_fixup_unknown_ecosystem_returns_none() {
 /// The setup: a valid `.cargo-checksum.json` on disk + a `patched`
 /// entry naming a file that doesn't exist. cargo::fixup parses the
 /// checksum, then `update_entries` walks `patched`, calls
-/// `sha256_file(on_disk)`, and the open fails with NotFound. The
+/// `read_regular_to_bytes(on_disk)`, and the open fails with NotFound. The
 /// `.map_err(|source| SidecarError::Io { ... })?` wraps it; the
 /// dispatcher returns `Err(SidecarError::Io)`.
 #[tokio::test]
@@ -95,7 +96,7 @@ async fn dispatch_fixup_cargo_sha256_file_failure_arm() {
     )
     .unwrap();
     // Note: we DO NOT create "missing-on-disk.txt" — that's
-    // exactly the condition that fires the sha256_file Err arm.
+    // exactly the condition that fires the read Err arm.
 
     let result = dispatch_fixup(
         "pkg:cargo/anything@1.0.0",
@@ -111,12 +112,8 @@ async fn dispatch_fixup_cargo_sha256_file_failure_arm() {
                 path.contains("missing-on-disk.txt"),
                 "Io error path must reference the missing file; got {path:?}"
             );
-            // The premise of this test is that the file is *absent* and
-            // the `read()` in `sha256_file` fails with NotFound. Assert
-            // that exact errno so a regression that surfaced some other
-            // Io failure (EACCES, EISDIR, a wrapped/mislabeled error)
-            // here — i.e. NOT the missing-file arm we claim to cover —
-            // cannot masquerade as this test passing.
+            // Pin NotFound so some other Io failure (EACCES, EISDIR, a
+            // mislabeled error) can't masquerade as the missing-file arm.
             assert_eq!(
                 source.kind(),
                 std::io::ErrorKind::NotFound,
@@ -130,9 +127,9 @@ async fn dispatch_fixup_cargo_sha256_file_failure_arm() {
 /// `dispatch_fixup` against a non-existent `pkg_path` exercises
 /// the nuget side: `remove_file(.nupkg.metadata)` returns NotFound
 /// (already covered by the success-path tests), then
-/// `has_signed_marker` runs and its `read_dir(pkg_path)` ALSO
-/// fails — non-existent dir hits the `Err(_) => return false`
-/// fallback at nuget.rs:86. The fixup then returns `Ok(None)`.
+/// `has_signed_marker` runs, and the missing dir makes
+/// `list_dir_entries` (utils/fs.rs) yield no entries, so it returns
+/// false. The fixup then returns `Ok(None)`.
 ///
 /// Together with the no-metadata + signed-marker tests this nails
 /// down every branch in `has_signed_marker`'s setup.
@@ -149,7 +146,7 @@ async fn dispatch_fixup_nuget_with_nonexistent_pkg_path() {
     .await
     .unwrap();
     // No metadata removed (NotFound), no signed marker found
-    // (read_dir failed → false), advisory absent → Ok(None).
+    // (no dir entries → false), advisory absent → Ok(None).
     assert!(
         out.is_none(),
         "non-existent pkg_path must yield no sidecar record"
diff --git a/crates/socket-patch-cli/tests/e2e_safety_lock.rs b/crates/socket-patch-cli/tests/e2e_safety_lock.rs
index e1bdf897..653a5e40 100644
--- a/crates/socket-patch-cli/tests/e2e_safety_lock.rs
+++ b/crates/socket-patch-cli/tests/e2e_safety_lock.rs
@@ -228,9 +228,9 @@ fn lock_released_after_external_drop() {
     // The synthetic manifest targets a package that isn't on disk, so
     // apply runs the pipeline to a partialFailure (exit 1). The point
     // of THIS test is that the released lock is re-acquired: assert the
-    // envelope proves we got past the lock (not the old vacuous
-    // `!stdout.contains("lock_held")`, which a crash to empty stdout or
-    // an unrelated error would also satisfy).
+    // envelope proves we got past the lock (a bare
+    // `!stdout.contains("lock_held")` would also pass on a crash to empty
+    // stdout or an unrelated error).
     let env = parse_json_envelope(&stdout);
     assert_lock_acquired(&env);
     assert_eq!(
diff --git a/crates/socket-patch-cli/tests/e2e_safety_yarn_pnp.rs b/crates/socket-patch-cli/tests/e2e_safety_yarn_pnp.rs
index 149da66b..d97ebfe8 100644
--- a/crates/socket-patch-cli/tests/e2e_safety_yarn_pnp.rs
+++ b/crates/socket-patch-cli/tests/e2e_safety_yarn_pnp.rs
@@ -779,17 +779,13 @@ fn pnp_project_with_no_npm_patches_still_applies_its_other_patches() {
 // ── the silent no-op (P0) ────────────────────────────────────────────────────
 //
 // Under PnP, `node_modules/` is absent, so the crawler leg of scan discovery
-// is empty; the lockfile-supplement leg used to swallow the flavor probe's
-// PnP diagnosis and return nothing. Scan then hit its `package_count == 0`
-// early-return and printed `status: success` / `scannedPackages: 0` with NO
-// warning — in ALL THREE modes — and, because scan wrote no manifest,
-// apply's documented loud refusal above was unreachable (apply exited 0 with
-// the calm `noManifest` status). The user believed they were protected;
-// nothing was checked. Reproduced on yarn 2.4.3 / 3.8.7 / 4.6.0, plain PnP
-// and zero-install. The tests below pin the fix: an explicit
-// `yarn_pnp_unsupported` refusal warning in scan's JSON envelope (exit
-// semantics deliberately unchanged: still exit 0 / status success), a stderr
-// line in human mode, and a loud apply refusal even without a manifest.
+// is empty and a scan that swallowed the flavor probe's PnP diagnosis would
+// report `status: success` / `scannedPackages: 0` with NO warning while
+// checking nothing (yarn 2.4.3 / 3.8.7 / 4.6.0, plain PnP and zero-install).
+// The tests below pin: an explicit `yarn_pnp_unsupported` refusal warning in
+// scan's JSON envelope in every mode (exit semantics deliberately unchanged:
+// still exit 0 / status success), a stderr line in human mode, and a loud
+// apply refusal even without a manifest.
 
 /// Recursively snapshot every file under `root` as relative path → git
 /// sha256, for whole-tree no-mutation assertions.
@@ -1005,12 +1001,11 @@ fn scan_on_pnpm_pnp_project_surfaces_pnpm_refusal_warning() {
     );
 }
 
-/// The apply half of the P0: on a PnP checkout WITHOUT a manifest, apply
-/// used to exit 0 with the calm `noManifest` status — the documented loud
-/// `yarn_pnp_unsupported` refusal (pinned by the tests at the top of this
-/// file) sat BELOW the noManifest early-return and was unreachable, because
-/// scan never writes a manifest on PnP projects. The refusal must fire
-/// first, matching the with-manifest envelope shape exactly.
+/// The apply half: on a PnP checkout WITHOUT a manifest (scan never writes
+/// one on PnP projects), the loud `yarn_pnp_unsupported` refusal (pinned by
+/// the tests at the top of this file) must fire before the calm
+/// `noManifest` early-return, matching the with-manifest envelope shape
+/// exactly.
 #[test]
 fn apply_without_manifest_on_pnp_project_refuses_loudly() {
     let dir = tempfile::tempdir().unwrap();
@@ -1070,7 +1065,9 @@ fn apply_without_manifest_on_pnp_project_refuses_in_human_mode() {
     );
 }
 
-/// Control for the two tests above: an in-scope npm patch in the SAME
+/// Control for the refusal-scope tests
+/// (`non_npm_ecosystem_apply_is_not_refused_in_a_pnp_project`,
+/// `pnp_project_with_no_npm_patches_still_applies_its_other_patches`): an in-scope npm patch in the SAME
 /// polyglot manifest still refuses. Without this, scoping the detector down
 /// to nothing at all would leave every positive test in this file passing
 /// only because they happen to use npm-only manifests.
diff --git a/crates/socket-patch-cli/tests/e2e_scan.rs b/crates/socket-patch-cli/tests/e2e_scan.rs
index a0f6f4f9..7543490f 100644
--- a/crates/socket-patch-cli/tests/e2e_scan.rs
+++ b/crates/socket-patch-cli/tests/e2e_scan.rs
@@ -5,8 +5,9 @@
 //! * `scan --json --apply --yes` adds, updates, and skips patches based on
 //!   the existing manifest, emitting the `apply.patches[]` action vocabulary
 //!   (`"added"`, `"updated"`, `"skipped"`).
-//! * Read-only `scan --json` emits the `updates` array (PURLs whose UUID
-//!   would change) and does NOT emit a `gc` field by default.
+//! * A bare `scan --json` (hosted mode by default) emits the `updates`
+//!   array (PURLs whose UUID would change) and does NOT emit a `gc` field
+//!   by default; it never writes `.socket/manifest.json` or node_modules.
 //! * `--prune` opts into garbage collection (manifest pruning + orphan
 //!   file cleanup). Without it, scan leaves the manifest alone.
 //! * `--sync` is sugar for `--apply --prune` — the canonical bot mode.
@@ -365,9 +366,9 @@ fn test_scan_apply_json_updates_existing() {
     assert_ne!(new_uuid, FAKE_OLD_UUID, "manifest must reflect the update");
 }
 
-/// `scan --json` (without `--apply`) is read-only: it lists available
-/// patches and an `updates` array reflecting manifest-vs-API drift, but
-/// does not mutate `.socket/manifest.json` or the file on disk.
+/// Bare `scan --json` (hosted by default) lists available patches and an
+/// `updates` array reflecting manifest-vs-API drift, but never writes
+/// `.socket/manifest.json` or touches node_modules.
 #[test]
 #[ignore]
 fn test_scan_json_read_only_emits_updates_array() {
@@ -400,8 +401,8 @@ fn test_scan_json_read_only_emits_updates_array() {
     assert_eq!(git_sha256_file(&index_js), BEFORE_HASH);
 }
 
-/// `scan --json` against a project with no existing manifest does NOT
-/// create one — read-only is read-only.
+/// Bare `scan --json` against a project with no existing manifest does NOT
+/// create one.
 #[test]
 #[ignore]
 fn test_scan_json_read_only_no_mutation() {
@@ -420,11 +421,11 @@ fn test_scan_json_read_only_no_mutation() {
     let (stdout, _) = assert_run_ok(cwd, &["scan", "--json"], "scan --json (no manifest)");
     let v = parse_scan_json(&stdout);
 
-    // Positive proof the read-only scan actually *did the read* — without
-    // this, a scan that crawled 0 packages or whose API batches all failed
-    // would still trivially satisfy the "no mutation" assertions below and
-    // falsely pass. A real read-only scan of an installed minimist must
-    // report it as scanned with a free patch available.
+    // Positive proof the scan actually *did the read* — without this, a
+    // scan that crawled 0 packages or whose API batches all failed would
+    // still trivially satisfy the "no mutation" assertions below. A real
+    // scan of an installed minimist must report it as scanned with a free
+    // patch available.
     assert_eq!(v["status"], "success");
     assert!(
         v["scannedPackages"].as_u64().unwrap_or(0) >= 1,
@@ -731,7 +732,7 @@ fn test_scan_json_no_gc_field_without_prune() {
     let (stdout, _) = assert_run_ok(cwd, &["scan", "--json"], "scan --json (no prune)");
     let v = parse_scan_json(&stdout);
 
-    // Positive proof the read-only scan actually ran a discovery pass — a
+    // Positive proof the scan actually ran a discovery pass — a
     // scan that crawled nothing would emit no gc field and pass the negative
     // assertion below for the wrong reason. left-pad is the installed package
     // here (minimist was uninstalled), so at minimum one package is scanned.
diff --git a/crates/socket-patch-cli/tests/e2e_vendor_bun_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_bun_build.rs
index ce734f00..b6007211 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_bun_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_bun_build.rs
@@ -40,8 +40,8 @@
 //! The get-driven twin (v3.6) replaces steps 2–3 with a wiremock
 //! `view/{uuid}` (same hashes, base64 `blobContent` of the after bytes) and
 //! `get <uuid> --mode vendored --vendor-source build` — scan's vendored
-//! posture end to end: manifest + committed artifact + ledger + wired lock,
-//! NO `.socket/blobs` — then re-runs the same fresh-checkout install proof.
+//! posture end to end: committed artifact + ledger (detached record) + wired
+//! lock, NO manifest, NO `.socket/blobs` — then re-runs the same fresh-checkout install proof.
 //! The revert half is not repeated there: `vendor --revert` on the
 //! capstone already covers it (same ledger, same engine).
 //!
@@ -260,9 +260,9 @@ fn bun_toolchain(tag: &str) -> Option<(String, BunVersion)> {
 
 /// Run `bun <args>` in `cwd` with the given private cache dir, the shared
 /// cache sandbox for everything bun keeps outside that dir (`~/.bun`, the
-/// npmrc it reads), and the ambient env scrubbed by the scrub the three bun
+/// npmrc it reads), and the ambient env scrubbed by the scrub the bun
 /// suites share (`cache_env::scrub_ambient_bun_env`: `SOCKET_*`, every
-/// `BUN_*`, case-insensitive `npm_config_*` — an ambient registry mirror
+/// `BUN_*`, case-insensitive `npm_config_*`, `VIRTUAL_ENV` — an ambient registry mirror
 /// would put the mirror tarball URL in the 4-tuple's registry slot and fail
 /// the pre-vendor assertions).
 fn bun(cwd: &Path, args: &[&str], cache_dir: &Path) -> Output {
@@ -1327,8 +1327,8 @@ async fn mock_view(server: &MockServer, purl: &str, before: &[u8], after: &[u8])
 }
 
 /// get-driven twin: `get <uuid> --mode vendored` must land scan's vendored
-/// result — manifest record + committed artifact + ledger + wired lock, NO
-/// blobs — and the fresh-checkout install proof must materialize the
+/// result — committed artifact + ledger (detached record) + wired lock, NO
+/// manifest, NO blobs — and the fresh-checkout install proof must materialize the
 /// patched bytes. The revert half is deliberately not repeated here:
 /// `vendor --revert` on the capstone above already proves it (same ledger,
 /// same engine).
diff --git a/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
index 16e324e0..5825b4d3 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_cargo_build.rs
@@ -51,8 +51,9 @@
 //! A get-driven twin (`cargo_get_uuid_vendored_fresh_checkout_locked_build`,
 //! v3.6) reaches the same committed state through `get <uuid> --mode
 //! vendored` with the patch record + blob content served from a wiremock
-//! view endpoint instead of a pre-staged `.socket/` — proving the manifest
-//! write, the NO-blobs posture (content stays in memory), and the same
+//! view endpoint instead of a pre-staged `.socket/` — proving the
+//! manifest-free posture (the ledger's detached entry is the record), the
+//! NO-blobs posture (content stays in memory), and the same
 //! fresh-checkout `--locked --offline` build (the revert half is covered by
 //! the capstone: get rides the identical vendor engine).
 //!
@@ -638,10 +639,8 @@ fn cargo_vendor_fresh_checkout_locked_offline_build_and_revert() {
     let env = parse_envelope(&stdout);
     assert_eq!(env["status"], "success", "envelope: {env}");
     assert_eq!(env["summary"]["failed"], 0, "no failures: {env}");
-    // NOTE: summary.applied / the event action are asserted in the
-    // `cargo_vendor_reports_applied_event` below — a successful
-    // cargo vendor is currently misreported as skipped/`vendored` (see the
-    // BUG note there). The on-disk + build assertions here are unaffected.
+    // summary.applied / the event action are pinned by
+    // `cargo_vendor_reports_applied_event` below.
 
     // The patched copy, without a `.cargo-checksum.json` (path deps must
     // never carry one).
@@ -896,15 +895,10 @@ fn cargo_vendor_fresh_checkout_locked_offline_build_and_revert() {
 /// cargo vendor must surface as an `applied` event with `summary.applied == 1`
 /// (CLI_CONTRACT.md: vendor events are `Applied` (= vendored)).
 ///
-/// Currently it is misreported as `skipped` with errorCode `vendored` and
-/// `summary.applied == 0`: the shared `result_to_event` (apply.rs) routes any
-/// result whose `package_path` contains `.socket/vendor/` to the
-/// Skipped/`vendored` event — that check exists for APPLY's yield-to-vendor
-/// path, but the cargo/golang/composer/gem vendor backends set their
-/// `ApplyResult.package_path` to the vendor copy dir itself, so vendor's own
-/// successes trip it (npm/pypi report `applied` correctly because their
-/// package_path is a stage tempdir / site-packages). Human output says
-/// "Vendored 0 package(s); 1 skipped" and `track_patch_vendored` reports 0.
+/// The cargo/golang/composer/gem vendor backends set
+/// `ApplyResult.package_path` to the `.socket/vendor/` copy dir itself;
+/// `result_to_event` must classify only the exact `VENDOR_OWNED_MARKER`
+/// sentinel as Skipped/`vendored`, never a path under `.socket/vendor/`.
 #[test]
 fn cargo_vendor_reports_applied_event() {
     if !cargo_e2e_matrix::cargo_available("e2e_vendor_cargo_build (applied-event)") {
@@ -954,7 +948,7 @@ fn cargo_vendor_reports_applied_event() {
 
 /// get-driven twin (v3.6): `get <uuid> --mode vendored --vendor-source build`
 /// must reach the capstone's committed state through scan's vendored engine —
-/// the manifest record, the patched copy under `.socket/vendor/cargo/<uuid>/`,
+/// no manifest (the ledger records the patch), the patched copy under `.socket/vendor/cargo/<uuid>/`,
 /// the `[patch.crates-io]` wiring + surgical lock detach — with NO
 /// `.socket/blobs` (the download phase holds content in memory; the vendor
 /// step re-fetches `blobContent` from the same view mock). Then the
@@ -980,7 +974,7 @@ async fn cargo_get_uuid_vendored_fresh_checkout_locked_build() {
 
     // The view endpoint serves the record with REAL hashes computed from the
     // ACTUAL extracted registry bytes + inline blobContent — no `.socket/`
-    // pre-staging: `get` writes the manifest itself and the vendor step
+    // pre-staging: `get` writes no manifest (the ledger records the patch) and the vendor step
     // fetches the after-blob into memory from this same mock.
     let orig = std::fs::read(crate_dir.join("src/lib.rs")).unwrap();
     assert!(
@@ -1173,8 +1167,8 @@ async fn cargo_get_uuid_vendored_fresh_checkout_locked_build() {
         "the detach must keep the lock format:\n{lock_text}"
     );
 
-    // Manifest-less VEX on the fresh checkout (get wrote a manifest; the
-    // steps delete it).
+    // Manifest-less VEX on the fresh checkout (get wrote no manifest; the
+    // steps' strip is a no-op for it).
     ManifestlessVendored {
         fresh,
         fresh_home,
diff --git a/crates/socket-patch-cli/tests/e2e_vendor_composer_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_composer_build.rs
index 49f9ae20..8809b85f 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_composer_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_composer_build.rs
@@ -25,7 +25,7 @@
 //!      patch uuid survives into `vendor/composer/installed.json`
 //!      (`dist.reference`).
 //!      Then the **manifest-less VEX legs** run on that fresh checkout (the shape a
-//!      depscan PR / a `vendor --detached` checkout has): with
+//!      depscan PR / a `scan --mode vendored` checkout has): with
 //!      `.socket/manifest.json` deleted, standalone `vex` (and embedded
 //!      `vendor --vex` / `apply --vex`) still attests `(vendored)` from the
 //!      ledger; with both ledgers deleted too it attests from the
@@ -200,7 +200,8 @@ fn lock_entry(lock_path: &Path, name: &str) -> serde_json::Value {
 /// `.socket/` manifest + blob fully offline, while `get <uuid> --mode
 /// vendored` fetches the record from the mocked API (the uuid path is
 /// exempt from installed narrowing, so only the `view/{uuid}` route is
-/// needed), writes the manifest itself, and stages patch content in memory
+/// needed), writes NO manifest (the vendor ledger's detached entry is the
+/// record), and stages patch content in memory
 /// — `.socket/blobs` must stay absent. `--vendor-source build` keeps the
 /// get flow off the vendoring service (no grant/tarball mocks needed).
 enum VendorDriver<'a> {
@@ -574,7 +575,7 @@ fn assert_manifestless_vendored_vex(
 // ── the capstone ──────────────────────────────────────────────────────
 
 #[test]
-#[ignore = "host capstone: shells out to a real composer 2; the unpinned `test` job \
+#[ignore = "host capstone: shells out to a real composer; the unpinned `test` job \
             skips it, the e2e job runs it with a pinned toolchain via --ignored"]
 fn composer_vendor_fresh_checkout_install_and_revert() {
     let Some(major) = composer_e2e_common::composer_major("e2e_vendor_composer_build") else {
@@ -773,14 +774,15 @@ fn composer_vendor_fresh_checkout_install_and_revert() {
 /// get's uuid path — exempt from installed narrowing, so only the mocked
 /// `view/{uuid}` route is needed. Unlike the capstone, NOTHING is staged
 /// locally: the record and the patched content come from the API mock, get
-/// writes `.socket/manifest.json` itself, and `.socket/blobs` must stay
+/// writes NO manifest (the ledger's detached entry in
+/// `.socket/vendor/state.json` is the record), and `.socket/blobs` must stay
 /// absent (vendored downloads live in memory). Ends with the same
 /// fresh-checkout `composer install` proof; the revert half stays with the
 /// vendor capstone (same engine, same ledger).
 // multi_thread: the CLI/composer subprocesses block a worker thread while
 // wiremock keeps serving the view route on the others.
 #[tokio::test(flavor = "multi_thread")]
-#[ignore = "host capstone: shells out to a real composer 2; the unpinned `test` job \
+#[ignore = "host capstone: shells out to a real composer; the unpinned `test` job \
             skips it, the e2e job runs it with a pinned toolchain via --ignored"]
 async fn composer_get_uuid_vendored_fresh_checkout_install() {
     let Some(major) = composer_e2e_common::composer_major("e2e_vendor_composer_build(get)") else {
@@ -925,8 +927,9 @@ async fn composer_get_uuid_vendored_fresh_checkout_install() {
     // capstone — cold home + cache, path dist the only source.
     let fresh = assert_fresh_checkout_installs_patched(tmp.path(), &proj, &patched);
 
-    // Manifest-less VEX legs on the get-produced checkout: `get` wrote the
-    // manifest, so deleting it is exactly the depscan / detached shape.
+    // Manifest-less VEX legs on the get-produced checkout: `get --mode
+    // vendored` writes no manifest, so this checkout already is the
+    // depscan / detached shape.
     tokio::task::block_in_place(|| {
         assert_manifestless_vendored_vex(tmp.path(), &fresh, &purl, &patched, &lock_before, "get")
     });
diff --git a/crates/socket-patch-cli/tests/e2e_vendor_gem_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_gem_build.rs
index acd2695e..74b86664 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_gem_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_gem_build.rs
@@ -32,8 +32,9 @@
 //! the patch record comes from a wiremock `view/{uuid}` (real hashes of the
 //! ACTUAL installed bytes + inline `blobContent`), `--vendor-source build`
 //! keeps the artifact build local, and the result must match a plain
-//! `vendor` run by construction — manifest + `.socket/vendor/` artifact +
-//! ledger + the mandatory Gemfile/lock pair edit, but NO `.socket/blobs`
+//! `vendor` run by construction — `.socket/vendor/` artifact + ledger (a
+//! detached entry) + the mandatory Gemfile/lock pair edit, with NO manifest
+//! and NO `.socket/blobs`
 //! (get's vendored download phase holds content in memory).
 //!
 //! MANIFEST-LESS VEX (every capstone, `vendored_manifestless_vex_matrix`,
@@ -1059,7 +1060,7 @@ fn gem_vendor_transitive_dep_fresh_checkout_and_revert() {
 
 /// GET-DRIVEN TWIN of the direct-dep capstone: `get <uuid> --mode vendored`
 /// (v3.6, the per-advisory selector) must leave the same committable state
-/// as a plain `vendor` run — manifest record, `.socket/vendor/` artifact +
+/// as a plain `vendor` run — the ledger's detached entry (no manifest), `.socket/vendor/` artifact +
 /// ledger, the mandatory Gemfile/lock pair edit — with NO `.socket/blobs`
 /// (get's vendored download phase holds content in memory) and get's
 /// envelope nesting the vendor Envelope (and dropping `applied`). The patch
diff --git a/crates/socket-patch-cli/tests/e2e_vendor_golang_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_golang_build.rs
index fff71d58..df8d9f00 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_golang_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_golang_build.rs
@@ -397,10 +397,8 @@ fn go_vendor_fresh_checkout_offline_build_and_revert() {
     let env = parse_envelope(&stdout);
     assert_eq!(env["status"], "success", "envelope: {env}");
     assert_eq!(env["summary"]["failed"], 0, "no failures: {env}");
-    // NOTE: summary.applied / the event action are pinned in the
-    // `go_vendor_reports_applied_event` below — successful golang vendors
-    // are currently misreported as skipped/`vendored` (shared
-    // result_to_event bug). The wiring/build proofs here are unaffected.
+    // summary.applied / the event action are pinned by
+    // `go_vendor_reports_applied_event` below.
 
     // The replace directive points at the uuid copy, with the mandatory
     // `./` prefix (a bare path fails go.mod parsing — spike claim 6).
@@ -584,8 +582,9 @@ fn go_vendor_fresh_checkout_offline_build_and_revert() {
 /// advisory-selector path must land the SAME committed vendor shape — but
 /// with the patch record served over the wire (wiremock `view/{uuid}` with
 /// the suite's real hashes + inline blobContent) instead of `write_patch`'s
-/// local manifest+blobs seed. The download phase writes ONLY the manifest
-/// (NO `.socket/blobs` — content stays in memory, scan parity), the vendor
+/// local manifest+blobs seed. The download phase writes nothing under
+/// `.socket/` (NO manifest, NO blobs — content stays in memory, scan
+/// parity; the ledger's detached entry is the record), the vendor
 /// step builds the artifact locally (`--vendor-source build`) from the
 /// installed module, and the fresh-checkout proof builds the PATCHED module
 /// fully offline. The revert half stays the vendor capstone's job.
@@ -1003,9 +1002,9 @@ fn go_apply_vendor_interplay_takeover_and_yield() {
 /// Correct-behavior pin for the vendor envelope: a successful first-time
 /// golang vendor must surface as an `applied` event with
 /// `summary.applied == 1` (CLI_CONTRACT.md: vendor events are `Applied`
-/// (= vendored)). See `cargo_vendor_reports_applied_event` in
-/// `e2e_vendor_cargo_build.rs` for the root cause (shared `result_to_event`
-/// misroutes results whose package_path is the `.socket/vendor/` copy dir).
+/// (= vendored)). Regression guard: `result_to_event` must match only the
+/// exact `VENDOR_OWNED_MARKER` sentinel, not a `.socket/vendor/` copy-dir
+/// package_path (see `cargo_vendor_reports_applied_event`).
 #[test]
 fn go_vendor_reports_applied_event() {
     if !golang_e2e_matrix::toolchain_ready("e2e_vendor_golang_build") {
diff --git a/crates/socket-patch-cli/tests/e2e_vendor_npm_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_npm_build.rs
index e9f6a0c6..f4f367e4 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_npm_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_npm_build.rs
@@ -598,7 +598,7 @@ fn npm_vendor_vex_attests_against_vendored_tarball() {
 /// `view/{uuid}` endpoint — the before/after git-blob hashes `stage_patch`
 /// would compute from the actually-installed bytes, plus the after bytes
 /// inline as base64 `blobContent` — and must land the identical committed
-/// state: manifest record, deterministic artifact, vendor ledger, `file:`
+/// state: a detached vendor-ledger entry (NO manifest), deterministic artifact, vendor ledger, `file:`
 /// lock wiring with a recomputed sha512, and NO `.socket/blobs` (scan
 /// parity: the download phase holds patch content in memory). The
 /// fresh-checkout `npm ci` proof is the capstone's, verbatim.
diff --git a/crates/socket-patch-cli/tests/e2e_vendor_pnpm_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_pnpm_build.rs
index 46ae6eaa..9e92ab9e 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_pnpm_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_pnpm_build.rs
@@ -31,7 +31,8 @@
 //! twin (v3.6): the SAME capstone with the record arriving over a mocked API
 //! `view/{uuid}` (real hashes + inline blobContent) via `get <uuid> --mode
 //! vendored --vendor-source build` instead of a hand-staged `.socket/` +
-//! `vendor` — manifest + vendor artifacts, NO blobs — ending at the
+//! `vendor` — the vendor ledger (detached entry) + vendor artifacts, NO
+//! manifest and NO blobs — ending at the
 //! fresh-checkout install proof (idempotency/revert stay the `vendor` front
 //! door's own contract).
 //!
@@ -312,8 +313,9 @@ async fn mock_view(server: &MockServer, purl: &str, before: &[u8], after: &[u8])
 /// engine by construction (v3.6): `vendor` reads a hand-staged `.socket/`
 /// manifest + blob offline, while `get <uuid> --mode vendored` fetches the
 /// record from the (mocked) API — the uuid identifier path is exempt from
-/// installed narrowing, so only the view mock is needed — and persists the
-/// manifest + vendor artifacts with NO blobs.
+/// installed narrowing, so only the view mock is needed — and persists only
+/// the vendor ledger (a detached entry embedding the record) + vendor
+/// artifacts, with NO manifest and NO blobs.
 #[derive(Clone, Copy, PartialEq, Debug)]
 enum VendorDriver {
     VendorCli,
@@ -1173,7 +1175,7 @@ fn run_unsupported_lock_refusal(pm: &str) {
 // ── pre-9.0 LEGACY lock legs (hermetic splice-shape + gated real-pnpm) ────
 //
 // pnpm 7 (lockfileVersion 5.4) and pnpm 8 ('6.0') are wired by the
-// pnpm-legacy vendor backend since 2026-08-18 (they used to refuse). The
+// pnpm-legacy vendor backend. The
 // hermetic legs below prove the splice reproduces the captured pnpm-emitted
 // shape byte-for-byte with no corepack/network; the `pnpm7_real_*` /
 // `pnpm8_real_*` legs run the full lifecycle against the REAL pinned pnpm
diff --git a/crates/socket-patch-cli/tests/e2e_vendor_pypi_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_pypi_build.rs
index 43a3af7e..8615fcba 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_pypi_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_pypi_build.rs
@@ -323,7 +323,8 @@ fn assert_vendored_applied(env: &serde_json::Value) {
 /// `.socket/` manifest + blob fully offline, while `get <uuid> --mode
 /// vendored` fetches the record from the mocked API (the uuid path is
 /// exempt from installed narrowing, so only the `view/{uuid}` route is
-/// needed), writes the manifest itself, and stages patch content in memory
+/// needed), records it in the vendor ledger (detached entry, no manifest),
+/// and stages patch content in memory
 /// — `.socket/blobs` must stay absent. `--vendor-source build` keeps the
 /// get flow off the vendoring service (no grant/tarball mocks needed).
 enum VendorDriver<'a> {
@@ -370,7 +371,7 @@ fn run_vendored(driver: &VendorDriver<'_>, proj: &Path) -> (i32, String, String)
 
 /// Mount `view/{UUID}` on the mock API: the patch record with REAL git-blob
 /// hashes over the ACTUAL installed bytes plus inline base64 `blobContent`,
-/// so `get --mode vendored` both saves the manifest record and stages the
+/// so `get --mode vendored` both records the patch in the vendor ledger and stages the
 /// after-bytes in memory (nothing is staged locally). The purl is the
 /// suite's bare (unqualified) spelling and the file key is
 /// site-packages-relative — exactly what [`stage_patch`]'s manifest carries.
@@ -773,7 +774,7 @@ fn uv_vendor_fresh_checkout_frozen_offline_and_revert() {
     // `uv sync --frozen --offline` (spike claim 3).
     assert_fresh_checkout_frozen_offline(&uv, tmp.path(), &proj, &lock_wired, python.as_deref());
 
-    // Manifest-less VEX over that fresh checkout (a `vendor --detached` /
+    // Manifest-less VEX over that fresh checkout (a `scan --mode vendored` /
     // depscan checkout's shape once the manifest is gone).
     manifestless_vex_tail(
         &uv,
@@ -825,8 +826,9 @@ fn uv_vendor_fresh_checkout_frozen_offline_and_revert() {
 /// SAME vendor engine and wiring, driven through get's uuid path — exempt
 /// from installed narrowing, so only the mocked `view/{uuid}` route is
 /// needed. Unlike the capstone, NOTHING is staged locally: the record and
-/// the patched content come from the API mock, get writes
-/// `.socket/manifest.json` itself, and `.socket/blobs` must stay absent
+/// the patched content come from the API mock, get writes NO
+/// `.socket/manifest.json` (the ledger's detached entry is the record), and
+/// `.socket/blobs` must stay absent
 /// (vendored downloads live in memory). Ends with the same fresh-checkout
 /// `uv sync --frozen --offline` committability proof; the revert half stays
 /// with the vendor capstone (same engine, same ledger).
@@ -948,8 +950,8 @@ async fn uv_get_uuid_vendored_fresh_checkout_frozen_offline() {
     let lock_wired = std::fs::read(proj.join("uv.lock")).unwrap();
     assert_fresh_checkout_frozen_offline(&uv, tmp.path(), &proj, &lock_wired, python.as_deref());
 
-    // Manifest-less VEX over the fresh checkout: get wrote the manifest, the
-    // checkout deletes it; the vendor ledger (+ wheel) and the pair remain.
+    // Manifest-less VEX over the fresh checkout: get never wrote a manifest;
+    // the vendor ledger (+ wheel) and the pair remain.
     // Off the async runtime: the matrix's patch API owns its own runtime.
     std::thread::scope(|scope| {
         scope
diff --git a/crates/socket-patch-cli/tests/e2e_vendor_yarn_berry_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_yarn_berry_build.rs
index f847a1e4..772bd6e7 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_yarn_berry_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_yarn_berry_build.rs
@@ -30,7 +30,8 @@
 //! (v3.6): the SAME capstone with the record arriving over a mocked API
 //! `view/{uuid}` (real hashes + inline blobContent) via `get <uuid> --mode
 //! vendored --vendor-source build` instead of a hand-staged `.socket/` +
-//! `vendor` — manifest + vendor artifacts, NO blobs — ending at the
+//! `vendor` — the vendor ledger (detached entry) + vendor artifacts, NO
+//! manifest and NO blobs — ending at the
 //! `--immutable --check-cache` install proof (idempotency/revert stay the
 //! `vendor` front door's own contract).
 //!
@@ -227,8 +228,9 @@ async fn mock_view(server: &MockServer, purl: &str, before: &[u8], after: &[u8])
 /// engine by construction (v3.6): `vendor` reads a hand-staged `.socket/`
 /// manifest + blob offline, while `get <uuid> --mode vendored` fetches the
 /// record from the (mocked) API — the uuid identifier path is exempt from
-/// installed narrowing, so only the view mock is needed — and persists the
-/// manifest + vendor artifacts with NO blobs.
+/// installed narrowing, so only the view mock is needed — and persists only
+/// the vendor ledger (a detached entry embedding the record) + vendor
+/// artifacts, with NO manifest and NO blobs.
 #[derive(Clone, Copy, PartialEq, Debug)]
 enum VendorDriver {
     VendorCli,
diff --git a/crates/socket-patch-cli/tests/e2e_vendor_yarn_classic_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_yarn_classic_build.rs
index 4e1a06ea..157a8df2 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_yarn_classic_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_yarn_classic_build.rs
@@ -31,8 +31,9 @@
 //!      `vendor --vex`.
 //!
 //! The detached twin (`yarn_classic_detached_scan_vendored_…`) produces the
-//! state with `scan --mode vendored --detached` against a wiremock Socket
-//! API instead — the vendored shape that never has a manifest — and runs the
+//! state with `scan --mode vendored` (plus the kept-for-compat no-op
+//! `--detached`) against a wiremock Socket API instead — the manifest-free
+//! shape every vendored run has — and runs the
 //! same fresh-checkout install + manifest-less VEX matrix (plus the embedded
 //! re-scan).
 //!
@@ -621,8 +622,8 @@ fn sha512_sri_b64(bytes: &[u8]) -> String {
 
 // ── detached vendoring from the patch API (the manifest-less shape) ────
 
-/// `scan --mode vendored --detached` against a wiremock Socket API: the
-/// vendored posture that NEVER has a `.socket/manifest.json` (the vendor
+/// `scan --mode vendored` (with the legacy no-op `--detached`) against a
+/// wiremock Socket API: vendored mode NEVER writes `.socket/manifest.json` (the vendor
 /// ledger embeds the record) — the shape a depscan-opened PR commits. The
 /// scan discovers the dep (batch search), the record (with `blobContent`)
 /// comes from the mocked `view/<uuid>` and the tarball is built locally
diff --git a/crates/socket-patch-cli/tests/e2e_vendor_yarn_classic_dev_flow.rs b/crates/socket-patch-cli/tests/e2e_vendor_yarn_classic_dev_flow.rs
index 423a132c..701395fa 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_yarn_classic_dev_flow.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_yarn_classic_dev_flow.rs
@@ -547,14 +547,14 @@ fn yarn_classic_vendored_lock_survives_dev_install_resave() {
     eprintln!("MANIFEST-LESS VEX OK");
 }
 
-// ── drift-skipped revert keeps artifacts (residual #131, E1 flow) ─────
+// ── drift-skipped revert keeps artifacts (E1 flow) ─────────────────────
 
 /// The strapi E1 flow, end-to-end with real yarn classic: vendored wiring,
 /// then a hosted overlay re-resolves the lock block to a
 /// `patch.socket.dev` URL (any resolution outside our uuid dir fails the
 /// revert's ownership gate the same way), then `vendor --revert`.
 ///
-/// Contract (residual #131 fixed): the revert drift-skips the lock restore
+/// Contract: the revert drift-skips the lock restore
 /// — and must then ALSO keep the vendored artifacts and the ledger entry,
 /// reporting a counted `Skipped` (`vendor_revert_kept`) instead of a
 /// `Removed`. Previously it deleted `.socket/vendor/npm/<uuid>/` and pruned
diff --git a/crates/socket-patch-cli/tests/e2e_vendored_production.rs b/crates/socket-patch-cli/tests/e2e_vendored_production.rs
index 4a9bf1c0..8aa793cd 100644
--- a/crates/socket-patch-cli/tests/e2e_vendored_production.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendored_production.rs
@@ -55,11 +55,8 @@
 //!
 //! # Ecosystem coverage notes (gaps, and one resolved gap)
 //!
-//! * **gem** — RESOLVED: full coverage. The old `platform_gem_unsupported`
-//!   refusal for `?platform=ruby` purls was fixed in the CLI (#172 — only
-//!   non-`ruby` platform qualifiers are refused), and the 2026-08-18 catalog
-//!   republish restored the pinned patch, so
-//!   [`gem_bundler_vendored_install_proof`] now runs the complete vendored
+//! * **gem** — full coverage (only non-`ruby` platform qualifiers are
+//!   refused): [`gem_bundler_vendored_install_proof`] runs the complete vendored
 //!   loop including the fresh-dir `bundle install` delivery proof. While
 //!   production's served `gem-stub-gemspec` remains invalid (D4: missing the
 //!   rubygems-required `summary`/`authors`), the leg passes via the CLI's
@@ -146,8 +143,9 @@ const PYPI_PURL: &str = "pkg:pypi/urllib3@1.26.18";
 const PYPI_NAME: &str = "urllib3";
 const PYPI_VERSION: &str = "1.26.18";
 /// urllib3 1.26.18 carries **three** distinct free patches (one per advisory).
-/// Which one the resolver selects is a server-side ordering detail, so the
-/// tests assert "one of these" rather than pinning a single UUID.
+/// The CLI's own ranking (`socket_patch_core::api::ranking`) picks one, and
+/// the pick changes whenever production publishes a new or merged patch, so
+/// the tests assert "one of these" rather than pinning a single UUID.
 const PYPI_UUIDS: &[&str] = &[
     "de58c8b8-796c-4b6d-8a48-539b5563db76",
     "26242e35-f867-4da8-8789-f0d2ea49e0f1",
@@ -164,9 +162,10 @@ const GEM_NAME: &str = "activestorage";
 const GEM_VERSION: &str = "6.0.3";
 /// Any-of pin set for the gem leg: `(patch uuid, the file its diff marks)`.
 /// Production has published several distinct free 6.0.3 patches (one per
-/// advisory), the manifest holds one patch per PURL, and which one the
-/// server-ranked resolver returns is a server-side ordering detail — so the
-/// leg accepts any pinned patch and probes the marker file that PATCH
+/// advisory), the manifest holds one patch per PURL, and the CLI's own
+/// ranking (`socket_patch_core::api::ranking`: newest merged patch first,
+/// otherwise severity, then newest) picks one — the pick changes whenever
+/// production publishes a new or merged patch, so the leg accepts any pinned patch and probes the marker file that PATCH
 /// actually touches. When production publishes another acceptable 6.0.3
 /// patch, verify its `/patch/view` blobs carry the marker and append it here
 /// (and to the hosted suite's `GEM_UUIDS`).
@@ -189,8 +188,7 @@ const GEM_PATCHES: &[(&str, &str)] = &[
         "eeb6bf9f-96c0-4963-a0f1-2e88f91f8b1a",
         "lib/active_storage/service/disk_service.rb",
     ),
-    // GHSA-r4mg-4433-c7g3 / CVE-2025-24293, published 2026-08-20T20:31Z —
-    // the one the server-ranked selection wires as of 2026-08-20.
+    // GHSA-r4mg-4433-c7g3 / CVE-2025-24293, published 2026-08-20T20:31Z.
     (
         "c1a1cd3c-b670-4e44-b4fa-1a63ecd42db6",
         "lib/active_storage/transformers/image_processing_transformer.rb",
@@ -209,10 +207,8 @@ const YARN_BERRY: &str = "yarn@4.6.0";
 /// patches to exercise it with. [`canary_unpublished_vendored_ecosystems`]
 /// watches these so coverage can be extended the moment one lights up.
 const UNPUBLISHED_ECOSYSTEMS: &[(&str, &[&str])] = &[
-    // cargo joined this list on 2026-09-01: production deleted its last free
-    // cargo patches on 2026-08-28, retiring the pinned `[patch.crates-io]`
-    // delivery proof this suite used to carry. Re-promotion procedure:
-    // docs/testing/vendored-production-e2e.md.
+    // Production has no free cargo patches (since 2026-08-28). Re-promotion
+    // procedure: docs/testing/vendored-production-e2e.md.
     (
         "cargo",
         &["pkg:cargo/openssl", "pkg:cargo/tokio", "pkg:cargo/smallvec"],
@@ -2153,15 +2149,6 @@ fn pypi_uv_lock_vendored_install_proof() {
 /// the fallback needs the install's `specifications/` stub. Once the
 /// server-side stub fix (depscan) deploys and the artifacts rebuild, the same
 /// leg exercises the service artifact directly — no test change needed.
-///
-/// # History
-///
-/// This leg used to tolerate a `platform_gem_unsupported` vendor refusal:
-/// production publishes the gem purl platform-qualified (`?platform=ruby`)
-/// and the old vendor gate refused every platform qualifier. #172 fixed the
-/// gate to refuse only non-empty, non-`ruby` platforms, and the 2026-08-18
-/// catalog republish restored the pinned patch, so the leg was upgraded to
-/// this full install proof per its own auto-retire NOTE.
 #[test]
 #[ignore = "live production API + real rubygems.org. Run with --ignored."]
 fn gem_bundler_vendored_install_proof() {
@@ -2213,7 +2200,7 @@ fn gem_bundler_vendored_install_proof() {
     );
     let installed_dir = PathBuf::from(String::from_utf8_lossy(&info.stdout).trim());
     // Anti-vacuity over EVERY pinned patch's marker file: whichever patch the
-    // server-ranked resolver wires below, its target must start pristine.
+    // CLI's ranking wires below, its target must start pristine.
     // Capture the pristine bytes now, keyed by file, for the post-install
     // byte-inequality probe.
     let mut pristine_by_file = std::collections::HashMap::new();
@@ -2619,9 +2606,7 @@ fn deno_vendored_is_unsupported() {
 }
 
 /// cargo, maven, nuget and composer all implement vendored mode, but
-/// production publishes no free-tier patches for them. (cargo used to have a
-/// full delivery proof — retired 2026-09-01 when production's free cargo tier
-/// emptied.) This probes production every run and reports the moment that
+/// production publishes no free-tier patches for them. This probes production every run and reports the moment that
 /// changes, so coverage can be extended deliberately rather than by accident.
 /// It does not fail when patches appear;
 /// `SOCKET_PATCH_VENDORED_E2E_CANARY_STRICT=1` makes it fail, for a scheduled
diff --git a/crates/socket-patch-cli/tests/e2e_vex.rs b/crates/socket-patch-cli/tests/e2e_vex.rs
index d37a4e2d..be7c2583 100644
--- a/crates/socket-patch-cli/tests/e2e_vex.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex.rs
@@ -2,7 +2,8 @@
 //!
 //! Validates the OpenVEX document shape produced by a real invocation
 //! of the compiled binary. When `vexctl` is on `PATH` the test also
-//! pipes the output through `vexctl validate` to confirm spec
+//! pipes the output through `vexctl merge` (a single-file parse gate,
+//! since vexctl has no `validate` subcommand) to confirm spec
 //! conformance — the CI workflow installs vexctl before the test
 //! step, so this branch is exercised in CI.
 //!
@@ -23,16 +24,17 @@ use socket_patch_core::manifest::schema::{
     PatchFileInfo, PatchManifest, PatchRecord, SetupConfig, VulnerabilityInfo,
 };
 
-/// Setup-supported ecosystems, declared `manual` in test fixtures so the
+/// Ecosystems opted in via `setup.manual` in test fixtures so the
 /// property-7 setup-state filter (`commands/setup::configured_ecosystems`)
-/// does not drop these patches — these tests exercise VEX document
-/// GENERATION, not setup state, so they opt every patch in via the `manual`
-/// escape hatch. The apply-only ecosystems (maven/nuget) are appended by
-/// [`all_manual`].
+/// keeps these patches — these tests exercise VEX document GENERATION, not
+/// setup state. Only npm/pypi/gem/composer are setup-capable; cargo, golang,
+/// maven and nuget have no setup hook and get in only through `manual`
+/// (maven/nuget are appended by [`all_manual`]).
 const ALL_MANUAL: &[&str] = &["npm", "pypi", "cargo", "golang", "gem", "composer"];
 
 /// [`ALL_MANUAL`] plus the apply-only ecosystems (maven/nuget), so the
-/// all-ecosystem agent matrix below can declare every one of the 8.
+/// all-ecosystem agent matrix below can declare every non-Deno ecosystem
+/// (8 of the 9).
 fn all_manual() -> Vec<String> {
     let mut names: Vec<String> = ALL_MANUAL.iter().map(|s| (*s).to_string()).collect();
     names.push("maven".to_string());
@@ -271,7 +273,7 @@ fn two_patches_sharing_ghsa_merge_subcomponents() {
 // ──────────────────────────────────────────────────────────────────────
 // Cross-ecosystem AGENT matrix — the agent-mode twin of
 // `e2e_vex_redirect::no_verify_attests_redirected_patches_across_ecosystems`.
-// One manifest patch per official ecosystem (qualified PURLs for the
+// One manifest patch per non-Deno ecosystem (qualified PURLs for the
 // release-variant ones: pypi `?artifact_id=`, gem `?platform=`, maven
 // `?classifier=&ext=`), `setup.manual` declaring every ecosystem (via
 // `all_manual`) so property 7 keeps them all, and `--no-verify` attests
@@ -348,7 +350,7 @@ fn no_verify_attests_agent_patches_across_ecosystems() {
         );
     }
     // write_manifest stamps setup.manual = all_manual(), which declares
-    // every one of the 8 ecosystems.
+    // every non-Deno ecosystem (8 of the 9).
     write_manifest(cwd, &manifest);
 
     let out = cli()
@@ -989,7 +991,7 @@ fn verify_mode_resolves_qualified_pypi_purl() {
     let after_hash = compute_git_sha256_from_bytes(patched);
     std::fs::write(site_packages.join("mod.py"), patched).unwrap();
 
-    // Manifest keyed by a *qualified* PyPI PURL, as `get --sync` writes
+    // Manifest keyed by a *qualified* PyPI PURL, as `get` / `scan --mode agent` write
     // for release-variant ecosystems.
     let qualified_purl = "pkg:pypi/examplepkg@1.2.3?artifact_id=sdist";
     let mut manifest = PatchManifest::new();
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/bun.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/bun.rs
index 34fbf057..2bee5e29 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/bun.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/bun.rs
@@ -1417,11 +1417,10 @@ fn truncated_binary_lock_attests_nothing() {
 /// An aliased install (`"mm": "npm:minimist@1.2.2"`): the map key is the
 /// alias, the spec names the real package, so the purl is minimist's.
 ///
-/// REGRESSION (hosted): bun installs the aliased hosted tarball at
-/// `node_modules/mm`, which the npm crawler's name-keyed lookup never
-/// probes — so the only installed copy read as "not installed" and a
-/// tampered or pristine (not yet reinstalled) alias attested from the lock
-/// pin. The alias copy is consumed evidence and must verify.
+/// Hosted: bun installs the aliased hosted tarball at `node_modules/mm`,
+/// which the npm crawler's name-keyed lookup never probes. The alias copy is
+/// consumed evidence and must verify — a tampered or pristine (not yet
+/// reinstalled) alias must not attest from the lock pin.
 #[test]
 fn aliased_text_entries_attest_the_real_package() {
     for version in [0, 1, 2] {
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs
index a0bc1cd2..b47c5cf8 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs
@@ -1731,7 +1731,7 @@ fn cargo_hosted_and_vendored_in_one_project_attest_together() {
     );
 }
 
-/// Embedded `scan --vex` (read-only scan) on the manifest-less, ledger-less
+/// Embedded `scan --vex` (a bare scan, which runs hosted mode) on the manifest-less, ledger-less
 /// mixed project: the scan attests the same patches standalone `vex` does
 /// and folds the summary into its envelope; an API that serves no view
 /// fails the requested VEX (and removes a stale document).
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/deno.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/deno.rs
index f8c89d06..a8681db1 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/deno.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/deno.rs
@@ -244,10 +244,10 @@ fn deno_files_naming_socket_urls_never_attest() {
 /// `--no-verify`:
 /// * a redirect ledger recording the lockfile a hosted rewriter WOULD have
 ///   edited (package-lock.json, absent here) — `redirect_unwired`;
-/// * REGRESSION: a (forged / foreign) redirect ledger naming `deno.lock` /
-///   `deno.json` ITSELF — no writer records those, and the Socket url in
-///   them is the user's own import; the liveness fallback used to read any
-///   unknown file as a pin, so `--no-verify` attested it;
+/// * a (forged / foreign) redirect ledger naming `deno.lock` / `deno.json`
+///   ITSELF — no writer records those, and the Socket url in them is the
+///   user's own import; the liveness fallback must not read an unknown file
+///   as a pin, even under `--no-verify`;
 /// * a vendor ledger entry for a jsr package: there is no jsr backend, so
 ///   no committed artifact can be wired — `vendor_unwired`.
 #[test]
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/golang.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/golang.rs
index 79d8b858..e709813f 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/golang.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/golang.rs
@@ -1136,7 +1136,7 @@ fn golang_hosted_and_vendored_modules_attest_together() {
     );
 }
 
-/// Embedded `scan --vex` (read-only scan) on a manifest-less, ledger-less
+/// Embedded `scan --vex` (a bare scan, which runs hosted mode) on a manifest-less, ledger-less
 /// go project: the scan attests the same patches standalone `vex` does,
 /// and folds the summary into its envelope.
 #[test]
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/npm.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/npm.rs
index 7d6a9226..3fdfe8b1 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/npm.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/npm.rs
@@ -325,7 +325,7 @@ fn vendored_artifact_is_the_evidence_and_a_tampered_member_is_omitted() {
     }
 }
 
-/// REGRESSION (npm 12 dual-lock): npm <= 11 installs from the shrinkwrap,
+/// npm 12 dual-lock: npm <= 11 installs from the shrinkwrap,
 /// npm 12 from the package-lock.json beside it. One lock wired to a Socket
 /// patch while the other still resolves the package from the registry is
 /// patched under some majors only — nothing attests (hosted or vendored, in
@@ -469,9 +469,8 @@ fn warnings_of(envelope: &Value) -> Vec<(String, String)> {
         .collect()
 }
 
-/// `--json` keeps WHY a patch was gated (it used to reach only human
-/// stderr as `Note:` lines, leaving the envelope with a bare
-/// `record_unavailable` / `wiring_conflict`): the record-fetch error and
+/// `--json` keeps WHY a patch was gated (not only human stderr `Note:`
+/// lines beside a bare `record_unavailable` / `wiring_conflict`): the record-fetch error and
 /// the wiring conflict's files ride `warnings[]`, standalone and embedded,
 /// and a failed embedded `--vex` lists each omitted patch as `vex_omitted`
 /// (`--silent`: `omitted:` lines under the error).
@@ -700,12 +699,11 @@ fn write_workspace_with_member_alias(project: &Path) {
     .unwrap();
 }
 
-/// REGRESSION (Bugbot): every consumed copy of a hosted npm purl is hashed,
-/// including a workspace member's ALIAS install beside a good root copy.
-/// The alias walk used to start at the root `node_modules` only, and the
-/// identity fallback runs only when no copy was found at all — so with the
-/// root (hoisted) copy patched, a tampered or stale member alias went
-/// unhashed and the document attested from the good root copy.
+/// Every consumed copy of a hosted npm purl is hashed, including a
+/// workspace member's ALIAS install beside a good root copy. The identity
+/// fallback runs only when no copy was found at all, so an alias walk that
+/// started at the root `node_modules` only would leave a tampered or stale
+/// member alias unhashed and attest from the good root copy.
 #[test]
 fn workspace_member_alias_beside_a_patched_root_copy_is_evidence() {
     let api = api_for(UUID, PURL);
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/nuget.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/nuget.rs
index a546287c..007fcd40 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/nuget.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/nuget.rs
@@ -712,8 +712,8 @@ fn nuget_hosted_spoofed_sources_never_attest() {
 /// output for a project without RestorePackagesWithLockFile: the exclusive
 /// exact-id mapping routes every restore of the id to the Socket source,
 /// which serves only the patched version, so the redirect ledger's record
-/// (which supplies the exact version) is live and attests `(redirected)`.
-/// REGRESSION: it used to be `redirect_unwired`.
+/// (which supplies the exact version) is live and attests `(redirected)`,
+/// not `redirect_unwired`.
 #[test]
 fn nuget_hosted_source_without_a_lock_attests_through_its_ledger() {
     let fx = Fx::new();
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/uv.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/uv.rs
index 5a3a8b97..e8777484 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/uv.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/uv.rs
@@ -1837,10 +1837,10 @@ fn embedded_vex(p: &Proj, command: &str, extra: &[&str]) -> (Option<i32>, Value,
     (out.status.code(), env, doc)
 }
 
-/// REGRESSION (fixed on the feature branch, `generate_vex_without_manifest`):
-/// `apply --vex` / `vendor --vex` in a manifest-less uv checkout used to
-/// return `noManifest` / exit 0 BEFORE the embedded VEX ran, so the
-/// requested document was silently never written. Every flavor × mode, with
+/// `apply --vex` / `vendor --vex` in a manifest-less uv checkout must run
+/// the embedded VEX (`generate_vex_without_manifest`) rather than return
+/// `noManifest` / exit 0 with the requested document silently never
+/// written. Every flavor × mode, with
 /// the writer's ledger and fully offline: the document is written (exit 0,
 /// envelope `vex` summary) with the right marker; `--dry-run` writes none;
 /// the lock reverted with the ledger left behind fails the command (exit 1,
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/yarn.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/yarn.rs
index 7a4cb9ec..f504682f 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/yarn.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/yarn.rs
@@ -1249,7 +1249,8 @@ fn assert_embedded_attested(doc: Option<Value>, env: &Value, marker: &str, cell:
     );
 }
 
-/// The in-run VEX of `scan` (agent mode, `--redirect`, `--vendor`) on an
+/// The in-run VEX of `scan` (a bare scan, which runs hosted mode; the legacy
+/// `--redirect`; `--vendor`) on an
 /// already-wired, manifest-less checkout attests the lock's patch like the
 /// standalone command, never rewrites the wiring, never writes a manifest,
 /// and still refuses a tampered installed tree.
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/yarn_berry.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/yarn_berry.rs
index 918335ba..44e2c393 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/yarn_berry.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/yarn_berry.rs
@@ -21,7 +21,7 @@
 //! | vendored CRLF + BOM | lock AND root `package.json` CRLF + BOM (yarn's Windows output) | the committed artifact attests; offline `record_unavailable`; `resolutions` reverted: nothing discovered |
 //! | two uuids for one package | two live blocks wiring one purl to different patches | never attested (`wiring_conflict`) |
 //! | user `yarn patch` on top | `patch:` entry wrapping the hosted locator | the hosted base entry still attests when the user patch leaves the Socket file intact; a user patch rewriting it is `hash_mismatch` |
-//! | foreign / look-alike hosts, uuid-shaped token only | `__archiveUrl` not on the patch host, or whose LAST uuid is the grant token of another patch | nothing discovered (exit 2), zero requests |
+//! | foreign / look-alike hosts | `__archiveUrl` not on the patch host, or with the uuid only in a query string or fragment | nothing discovered (exit 2), zero requests |
 //! | record for another package | API record names `@scope/other` for the wired uuid | `record_mismatch` |
 
 use std::path::Path;
@@ -833,9 +833,9 @@ fn user_yarn_patch_on_top_of_hosted() {
 // ── spoofing ─────────────────────────────────────────────────────────────
 
 /// An `__archiveUrl` that is not on the Socket patch host — including
-/// look-alikes — or whose uuid-shaped segments are only a GRANT TOKEN of
-/// the patch host's path grammar, is never a patch reference: nothing is
-/// discovered and nothing is fetched.
+/// look-alikes — or that carries its uuid only in a query string or
+/// fragment, is never a patch reference: nothing is discovered and nothing
+/// is fetched.
 #[test]
 fn foreign_hosts_and_token_only_urls_are_not_references() {
     let api = api_for(LP);
diff --git a/crates/socket-patch-cli/tests/e2e_vex_redirect.rs b/crates/socket-patch-cli/tests/e2e_vex_redirect.rs
index 37d41e16..785015c1 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_redirect.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_redirect.rs
@@ -384,8 +384,7 @@ fn redirected_no_verify_attests_without_installed_tree() {
     let purl = "pkg:npm/left-pad@1.3.0";
 
     // No node_modules, no manifest — the redirect ledger is the only record
-    // source. DELIBERATE CHANGE: the ledger alone no longer attests; the
-    // lockfile must still wire the hosted patch (see the gated twin below),
+    // source. The ledger alone does not attest; the lockfile must still wire the hosted patch (see the gated twin below),
     // so the fixture carries the rewrite `scan --redirect` recorded.
     write_redirect_state(
         cwd,
@@ -636,8 +635,7 @@ fn no_verify_attests_redirected_patches_across_ecosystems() {
 
     // The ledger records both halves `scan --redirect` persists: the
     // records AND the file edits (whose files still carry each patch's
-    // hosted wiring — the liveness proof for formats lockfile discovery
-    // does not read yet).
+    // hosted wiring — the liveness proof the ledger record needs).
     let mut state = RedirectState::new();
     for (purl, ghsa, eco, uuid) in cases {
         state.records.insert(
@@ -706,11 +704,10 @@ fn no_verify_attests_redirected_patches_across_ecosystems() {
 }
 
 // ──────────────────────────────────────────────────────────────────────
-// 4b. DELIBERATE CHANGE — the redirect ledger alone no longer attests.
+// 4b. The redirect ledger alone does not attest.
 // A record whose hosted wiring the lockfile no longer carries (no lockfile,
 // or one reverted to the registry) is `redirect_unwired`, INCLUDING under
 // `--no-verify`: the gate is about what the build consumes, not hashing.
-// Before, both shapes attested `(redirected)` — a false `not_affected`.
 // ──────────────────────────────────────────────────────────────────────
 
 /// `vex --json --output` in `cwd` (hermetic: no ambient token or socket-cli
@@ -1277,10 +1274,10 @@ fn hosted_takeover_of_a_vendored_package_attests_the_hosted_patch() {
 }
 
 // ──────────────────────────────────────────────────────────────────────
-// 8. REGRESSION (core discover rule 11): a redirect ledger record whose
-// patch the lockfiles still MENTION, but only in a shape the package
-// manager does not consume, is dead — the ledger fallback no longer
-// re-derives "live" from the raw text the extractor already rejected.
+// 8. Core discover rule 11: a redirect ledger record whose patch the
+// lockfiles still MENTION, but only in a shape the package manager does not
+// consume, is dead — the ledger fallback never re-derives "live" from the
+// raw text the extractor already rejected.
 // ──────────────────────────────────────────────────────────────────────
 
 /// A committed hosted-rewriter golden (`crates/socket-patch-core/tests/
@@ -1495,15 +1492,15 @@ fn rejected_hosted_wiring_never_keeps_a_redirect_ledger_alive() {
     }
 }
 
-/// REGRESSION (false attestation): the ledger's hosted wiring lives in one
+/// No false attestation: the ledger's hosted wiring lives in one
 /// lock while a SIBLING lock resolves the same version from the registry —
 /// a stale `yarn.lock` beside the hosted `package-lock.json`, a registry
 /// `uv.lock` (what `uv sync --frozen` installs) beside a hosted
 /// `requirements.txt`, a registry `vlt-lock.json` beside a hosted
 /// `package-lock.json`. Which one the build installs from depends on the
 /// package manager that runs, so the record is not attested
-/// (`redirect_unwired`, with a note naming the contesting lock) where it
-/// used to be `not_affected (redirected)`. Without the stale lock it attests.
+/// (`redirect_unwired`, with a note naming the contesting lock). Without the
+/// stale lock it attests.
 #[test]
 fn a_sibling_lock_resolving_the_registry_contests_a_ledger_record() {
     const U: &str = "5e1f0a3c-2b4d-4c6e-8f10-123456789abc";
diff --git a/crates/socket-patch-cli/tests/e2e_vex_vendor.rs b/crates/socket-patch-cli/tests/e2e_vex_vendor.rs
index da40701c..5cbd7118 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_vendor.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_vendor.rs
@@ -219,8 +219,8 @@ fn vendored_purl_attested_with_no_installed_tree() {
     let rel = write_vendored_dir(cwd, patched);
     write_vendor_state(cwd, purl, &rel);
 
-    // No Cargo.toml, no target/, no registry copy — the vendored artifact
-    // is the ONLY evidence on disk.
+    // No installed tree (no target/, no registry copy) — only the wiring
+    // Cargo.toml and the vendored artifact are on disk.
     let mut manifest = PatchManifest::new();
     manifest.patches.insert(
         purl.to_string(),
@@ -792,7 +792,7 @@ fn write_member_tgz(dest: &Path, member: &str, bytes: &[u8]) -> Vec<u8> {
 
 /// Minimal STORED-entry (no compression) zip writer — local headers +
 /// central directory + EOCD — and returns the bytes for the ledger sha256.
-/// The production reader (`verify_wheel_members`' bounded `zip::ZipArchive`,
+/// The production reader (`vendor::verify`'s bounded `read_zip_to_map` over `zip::ZipArchive`,
 /// which handles `.whl`/`.nupkg`/`.jar` alike) is the code under test;
 /// hand-rolling the writer keeps this test crate off a zip-writer dependency
 /// while still producing honest zip-family artifacts.
@@ -1990,11 +1990,10 @@ fn lockfile_vendored_ref_whose_record_names_another_package_is_a_mismatch() {
     );
 }
 
-/// REGRESSION: `repair`'s ledger reconstruction writes entries with
+/// `repair`'s ledger reconstruction writes entries with
 /// `wiring: []` (every ecosystem but gem) and says VEX attests them. With
 /// no recorded wiring file, liveness must probe the ecosystem's root locks
-/// — here a pnpm lock (a format lockfile discovery does not read yet) that
-/// still wires the committed tarball — instead of calling the entry
+/// — here a pnpm lock that still wires the committed tarball — instead of calling the entry
 /// `vendor_unwired`. Once that lock is reverted, the entry is unwired.
 #[test]
 fn reconstructed_ledger_entry_without_wiring_attests_from_the_root_lock() {
@@ -2086,10 +2085,10 @@ fn reconstructed_ledger_entry_without_wiring_attests_from_the_root_lock() {
 }
 
 // ──────────────────────────────────────────────────────────────────────
-// 9. REGRESSION (core discover rule 11): a vendor ledger entry whose
-// artifact the lockfiles still MENTION, but only in a shape the package
-// manager does not consume, is dead — the ledger fallback no longer
-// re-derives "live" from the raw text the extractor already rejected.
+// 9. Core discover rule 11: a vendor ledger entry whose artifact the
+// lockfiles still MENTION, but only in a shape the package manager does not
+// consume, is dead — the ledger fallback never re-derives "live" from the
+// raw text the extractor already rejected.
 // ──────────────────────────────────────────────────────────────────────
 
 /// A detached ledger entry (embedded record) for `purl` → `rel`, recording
diff --git a/crates/socket-patch-cli/tests/e2e_yarn4_pnpm_linker_build.rs b/crates/socket-patch-cli/tests/e2e_yarn4_pnpm_linker_build.rs
index fa165f10..59aa1bec 100644
--- a/crates/socket-patch-cli/tests/e2e_yarn4_pnpm_linker_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_yarn4_pnpm_linker_build.rs
@@ -316,7 +316,7 @@ fn bootstrap_berry_checksum(tmp: &Path, patched_tgz: &Path) -> Option<String> {
     let lock = std::fs::read_to_string(boot.join("yarn.lock")).ok()?;
     // yarn 4.0.x writes the bare hex, 4.1+ `10c0/<hex>`: the API form is the
     // prefixed one. A lock with neither is a harness failure, never a
-    // silent pass (the old `?` here returned before any assertion ran).
+    // silent pass.
     let checksum = yarn_berry_common::yarn_written_checksum(&lock);
     if checksum.is_none() {
         skip!(
diff --git a/crates/socket-patch-cli/tests/e2e_yarn4_workspaces_build.rs b/crates/socket-patch-cli/tests/e2e_yarn4_workspaces_build.rs
index f87be21e..b0b1883b 100644
--- a/crates/socket-patch-cli/tests/e2e_yarn4_workspaces_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_yarn4_workspaces_build.rs
@@ -314,7 +314,7 @@ fn bootstrap_berry_checksum(tmp: &Path, patched_tgz: &Path) -> Option<String> {
     let lock = std::fs::read_to_string(boot.join("yarn.lock")).ok()?;
     // yarn 4.0.x writes the bare hex, 4.1+ `10c0/<hex>`: the API form is the
     // prefixed one. A lock with neither is a harness failure, never a
-    // silent pass (the old `?` here returned before any assertion ran).
+    // silent pass.
     let checksum = yarn_berry_common::yarn_written_checksum(&lock);
     if checksum.is_none() {
         skip!(
diff --git a/crates/socket-patch-cli/tests/e2e_yarn_legacy_cachekey_refusal_build.rs b/crates/socket-patch-cli/tests/e2e_yarn_legacy_cachekey_refusal_build.rs
index 00c81f02..df8525dd 100644
--- a/crates/socket-patch-cli/tests/e2e_yarn_legacy_cachekey_refusal_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_yarn_legacy_cachekey_refusal_build.rs
@@ -26,9 +26,9 @@
 //!     code `redirect_yarn_berry_cache_unsupported` (the CODE, not human
 //!     text), and `yarn.lock` + `package.json` byte-identical.
 //!   * `scan --mode vendored`: exit 1, envelope `status: partial_failure`,
-//!     a per-package failed event with errorCode
-//!     `vendor_yarn_berry_cache_unsupported` (download succeeded — the
-//!     refusal is at the wiring step, not discovery), zero mutations to
+//!     a failed DOWNLOAD record (errorCode
+//!     `vendor_yarn_berry_cache_unsupported`) produced before any view
+//!     fetch, with no vendor-step event for the package, zero mutations to
 //!     `yarn.lock` / `package.json`, and no `.socket/vendor` artifacts.
 //!
 //! If a future corepack pin emits a different cacheKey, the pin assertion
diff --git a/crates/socket-patch-cli/tests/ecosystem_dispatch_e2e.rs b/crates/socket-patch-cli/tests/ecosystem_dispatch_e2e.rs
index b3324566..35bf0a01 100644
--- a/crates/socket-patch-cli/tests/ecosystem_dispatch_e2e.rs
+++ b/crates/socket-patch-cli/tests/ecosystem_dispatch_e2e.rs
@@ -199,10 +199,8 @@ fn assert_apply_dispatched(code: i32, env: &Value, ecosystem: &str, expected_pur
 /// `skipped == 0`. This is the load-bearing proof that the filter actually
 /// filters — without it, a `partition_purls` that ignored `allowed_ecosystems`
 /// (a catch-all) would keep every positive test below green while silently
-/// dispatching out-of-scope PURLs. We deliberately do NOT assert the exit
-/// code / status here: an all-out-of-scope (effectively empty) manifest
-/// currently exits 1 / `partialFailure` (a known, separate no-op-success bug);
-/// the dispatch property under test is independent of that.
+/// dispatching out-of-scope PURLs. The exit code / status is not asserted
+/// here; the dispatch property under test is independent of it.
 fn assert_apply_not_dispatched(env: &Value, ecosystem: &str, out_of_scope_purls: &[&str]) {
     assert_eq!(
         env["command"], "apply",
@@ -443,7 +441,8 @@ struct RollbackFixture {
     purl: String,
     /// The on-disk file the rollback must restore to ORIGINAL.
     verify_file: PathBuf,
-    /// Extra env vars the crawler needs (cache locations, experimental gates).
+    /// Extra env vars the crawler needs (cache locations such as GOMODCACHE /
+    /// MAVEN_REPO_LOCAL).
     envs: Vec<(String, String)>,
     /// Run the rollback in `--global` mode. Required for ecosystems whose
     /// project-local backend is a *redirect* (golang): in local mode the
@@ -825,13 +824,11 @@ fn rollback_dispatch_branch_composer() {
 // ---------------------------------------------------------------------------
 // Machine-output purity at dispatch call sites.
 //
-// The scan macro in `ecosystem_dispatch` prints "Using <X> at: <path>" to
-// STDOUT whenever the crawl is global (`--global` / `--global-prefix`) and
-// the caller did not pass `silent = true`. `apply` and `rollback` pass
-// `silent || json`, but the `vex` and `setup --check` call sites passed only
-// `silent`, so in `--json` mode (envelope on stdout) — and in vex's
-// doc-to-stdout mode — the chrome line corrupted the machine stream.
-// `--global-prefix` makes the leak deterministic: the npm crawler returns
+// The scan macro in `ecosystem_dispatch` prints "Using <X> at: <path>" on
+// global crawls (`--global` / `--global-prefix`); it goes to stderr so it
+// can never reach a `--json` envelope or a VEX document on stdout. These
+// tests pin that stdout stays pure at the `vex` and `setup --check` call
+// sites. `--global-prefix` makes the check deterministic: the npm crawler returns
 // the prefix verbatim as a node_modules root, so `paths` is never empty.
 // ---------------------------------------------------------------------------
 
diff --git a/crates/socket-patch-cli/tests/get_batch_paths_e2e.rs b/crates/socket-patch-cli/tests/get_batch_paths_e2e.rs
index 4e81225c..65a3afe9 100644
--- a/crates/socket-patch-cli/tests/get_batch_paths_e2e.rs
+++ b/crates/socket-patch-cli/tests/get_batch_paths_e2e.rs
@@ -84,10 +84,10 @@ fn run_get_auth(
 /// Multiple FREE patches for one package + JSON mode + no explicit
 /// selection: emits `status: selection_required` with the full
 /// candidate list. Covers the `JsonModeNeedsExplicit` arm of
-/// `select_patches` (commands/get.rs ~481-517).
+/// `select_patches` (commands/get.rs).
 ///
 /// NOTE: `canAccessPaidPatches` MUST be false here. With paid access the
-/// command auto-picks the newest patch and never reaches the
+/// command auto-picks the top-ranked patch (see api::ranking) and never reaches the
 /// selection-required branch — so a `true` here would silently exercise
 /// a completely different (download) path while still "passing" a loose
 /// assertion.
@@ -177,8 +177,8 @@ async fn get_by_purl_with_multiple_patches_emits_selection_required() {
     // instruction must be one the CLI actually accepts. `--id` is a boolean
     // type-tag (see get_id_flag_does_not_accept_a_value below), so selection
     // happens by re-running with the chosen UUID as the positional
-    // identifier; the old "Specify --id <UUID>" wording sent users straight
-    // into a clap usage error.
+    // identifier; a "Specify --id <UUID>" instruction would send users
+    // straight into a clap usage error.
     let err = v["error"].as_str().unwrap_or("");
     assert!(
         !err.contains("--id <"),
@@ -198,10 +198,8 @@ async fn get_by_purl_with_multiple_patches_emits_selection_required() {
 /// This contract is why the `selection_required` wording matters:
 /// selection happens by re-running with the chosen UUID as the positional
 /// identifier (`get <uuid> --id`), never by passing a value to `--id`.
-/// The envelope's error text used to instruct the impossible
-/// "Specify --id <UUID>" form; the selection test above pins the
-/// corrected instruction, and this test locks the boolean CLI contract
-/// it depends on.
+/// The selection test above pins the instruction, and this test locks the
+/// boolean CLI contract it depends on.
 #[tokio::test]
 async fn get_id_flag_does_not_accept_a_value() {
     let mock = MockServer::start().await; // must never be reached
diff --git a/crates/socket-patch-cli/tests/get_edge_cases_e2e.rs b/crates/socket-patch-cli/tests/get_edge_cases_e2e.rs
index e419d8c6..86b754a2 100644
--- a/crates/socket-patch-cli/tests/get_edge_cases_e2e.rs
+++ b/crates/socket-patch-cli/tests/get_edge_cases_e2e.rs
@@ -32,12 +32,11 @@ async fn received_paths(mock: &MockServer) -> Vec<String> {
         .collect()
 }
 
-/// A single-file patch-view `files` map that survives PR #158's
-/// "patch has no applicable files" guardrail (5d7eb6f): a fetched view
-/// whose `files_for_manifest` map is empty is now an exit-1 failure, not a
-/// silent `applied:1`. The tests below assert SELECTION / paid-token /
-/// drift-warning / manifest-replacement behavior — the empty `"files": {}`
-/// they used to carry was only ever a lazy stand-in, never the point.
+/// A single-file patch-view `files` map that survives the "patch has no
+/// applicable files" guardrail (a fetched view whose `files_for_manifest`
+/// map is empty is an exit-1 failure, not a silent `applied:1`). The tests
+/// below assert SELECTION / paid-token / drift-warning /
+/// manifest-replacement behavior, not file content.
 ///
 /// Modeled on the passing `get_invariants::patch_response_json` fixture: a
 /// net-new file with an all-zero `beforeHash`, a real git-blob `afterHash`
@@ -90,7 +89,7 @@ fn get_one_off_and_save_only_together_errors() {
 
 #[tokio::test]
 async fn get_with_id_flag_selects_specific_patch() {
-    // Multiple patches available for a PURL, `--id <UUID>` picks one.
+    // Multiple patches available for a PURL; `get <UUID> --id` fetches exactly that one.
     let mock = MockServer::start().await;
     let purl = "pkg:npm/multi@1.0.0";
     let encoded = "pkg%3Anpm%2Fmulti%401.0.0";
@@ -603,7 +602,7 @@ async fn get_uuid_replacing_existing_manifest_entry_reports_updated() {
     // `apply`, `scan --sync`, `get` — means "a different UUID replaced an
     // older one for this PURL. `oldUuid` set." The fetch-by-UUID save path
     // (`save_and_apply_patch`) must classify against the pre-insert manifest
-    // exactly like `download_and_apply_patches` does; reporting the
+    // exactly like `download_and_apply_patches_with` does; reporting the
     // replacement as `added` (without `oldUuid`) hides the overwrite from
     // consumers that diff on `action == "updated"` — including the jq
     // recipe the contract itself documents.
diff --git a/crates/socket-patch-cli/tests/get_modes_e2e.rs b/crates/socket-patch-cli/tests/get_modes_e2e.rs
index 0a3a2a42..a50a6bc0 100644
--- a/crates/socket-patch-cli/tests/get_modes_e2e.rs
+++ b/crates/socket-patch-cli/tests/get_modes_e2e.rs
@@ -1213,8 +1213,8 @@ async fn get_save_only_agent_ignores_vlt_preflight() {
 
 /// Manifest-less VEX over what `get <uuid> --mode hosted` and `get <uuid>
 /// --mode vendored` commit for an npm project: a checkout of package.json,
-/// the lock and `.socket/` (no manifest — hosted never writes one, vendored's
-/// is deleted like an uncommitted one) attests with the ledger, then from
+/// the lock and `.socket/` (no manifest — neither hosted nor vendored get
+/// writes one) attests with the ledger, then from
 /// lockfile discovery + the patch API with the ledgers gone, never
 /// `--offline` (`record_unavailable`, zero requests), and not once the lock
 /// is reverted (`redirect_unwired` / `vendor_unwired`, `--no-verify` too).
diff --git a/crates/socket-patch-cli/tests/get_update_summary_e2e.rs b/crates/socket-patch-cli/tests/get_update_summary_e2e.rs
index 9887db41..973839fd 100644
--- a/crates/socket-patch-cli/tests/get_update_summary_e2e.rs
+++ b/crates/socket-patch-cli/tests/get_update_summary_e2e.rs
@@ -1,6 +1,6 @@
 //! The human-readable `get` summary must not report one patch twice.
 //!
-//! `download_and_apply_patches` prints an `Added: / Skipped: / Failed: /
+//! `download_and_apply_patches_with` prints an `Added: / Skipped: / Failed: /
 //! Updated:` block after writing the manifest. Regression guard: the "added"
 //! tally was bumped for EVERY record it wrote — including the ones classified
 //! `Updated` — so replacing an existing manifest entry printed both
diff --git a/crates/socket-patch-cli/tests/global_packages_e2e.rs b/crates/socket-patch-cli/tests/global_packages_e2e.rs
index 087a9fd2..61d0f7d3 100644
--- a/crates/socket-patch-cli/tests/global_packages_e2e.rs
+++ b/crates/socket-patch-cli/tests/global_packages_e2e.rs
@@ -1,4 +1,5 @@
-//! End-to-end tests for `global_packages.rs` paths, exercised via the
+//! End-to-end tests for the npm crawler's global-prefix resolution
+//! (`crawlers/npm_crawler.rs`), exercised via the
 //! `apply --global` / `rollback --global` flags. Two strategies:
 //!
 //! 1. Real-tool path: when `npm` / `yarn` / `pnpm` are on PATH, the
diff --git a/crates/socket-patch-cli/tests/hosted_symlinked_files.rs b/crates/socket-patch-cli/tests/hosted_symlinked_files.rs
index c58107ca..a3d2ca5a 100644
--- a/crates/socket-patch-cli/tests/hosted_symlinked_files.rs
+++ b/crates/socket-patch-cli/tests/hosted_symlinked_files.rs
@@ -1,7 +1,7 @@
 //! `scan --mode hosted` against project files that are NOT plain regular
 //! files: symbolic links and FIFOs.
 //!
-//! Policy (PR #239 review): symlinked project files are DISCOVERED (the
+//! Policy: symlinked project files are DISCOVERED (the
 //! Python lock discovery follows links) but never REWRITTEN in place — every
 //! writer stages a replacement next to the path and renames over it, which
 //! replaces the link with a detached regular copy, leaves the link target
diff --git a/crates/socket-patch-cli/tests/in_process_gem_apply.rs b/crates/socket-patch-cli/tests/in_process_gem_apply.rs
index 33d64d1e..ae9f45c4 100644
--- a/crates/socket-patch-cli/tests/in_process_gem_apply.rs
+++ b/crates/socket-patch-cli/tests/in_process_gem_apply.rs
@@ -289,8 +289,8 @@ async fn gem_crawler_finds_real_installed_gem() {
     }
     let tmp = tempfile::tempdir().expect("tempdir");
     let lib_file = install_colorize(tmp.path());
-    // A scan WITHOUT --sync is read-only; capture the installed file so we can
-    // prove it is left byte-for-byte untouched after discovery.
+    // A bare scan (hosted mode) rewires lockfiles only; capture the installed
+    // file so we can prove it is left byte-for-byte untouched.
     let before_scan = std::fs::read(&lib_file).expect("read colorize.rb before scan");
 
     let server = MockServer::start().await;
@@ -358,9 +358,7 @@ async fn gem_crawler_finds_real_installed_gem() {
         "crawler did not discover the installed gem: no batch request carried {purl}"
     );
 
-    // A discovery-only scan (no --sync, no --apply) must not mutate any
-    // installed file. This catches a regression where scan silently writes
-    // patches behind the user's back during a read-only pass.
+    // A bare scan (hosted mode) must never write the installed gem copy.
     let after_scan = std::fs::read(&lib_file).expect("read colorize.rb after scan");
     assert_eq!(
         after_scan,
diff --git a/crates/socket-patch-cli/tests/in_process_gem_fallback_home.rs b/crates/socket-patch-cli/tests/in_process_gem_fallback_home.rs
index fbce6b5a..bb61ebd5 100644
--- a/crates/socket-patch-cli/tests/in_process_gem_fallback_home.rs
+++ b/crates/socket-patch-cli/tests/in_process_gem_fallback_home.rs
@@ -231,8 +231,8 @@ fn mismatched_fallback_home_copy_is_nonfatal_when_store_patched() {
 }
 
 /// (b) Parity pin: with NO bundle-store copy, the fallback-home copy IS
-/// the primary install — a mismatch there keeps the historic loud
-/// failure (exit 1), exactly as plain apply behaved before #218.
+/// the primary install — a mismatch there is a loud failure (exit 1), as
+/// in plain apply.
 #[test]
 fn fallback_only_mismatch_keeps_loud_failure_parity() {
     let fx = build_fixture(false, b"totally different bytes\n", QUALIFIED_PURL);
diff --git a/crates/socket-patch-cli/tests/in_process_gem_multicopy.rs b/crates/socket-patch-cli/tests/in_process_gem_multicopy.rs
index 9b71ac29..0b309702 100644
--- a/crates/socket-patch-cli/tests/in_process_gem_multicopy.rs
+++ b/crates/socket-patch-cli/tests/in_process_gem_multicopy.rs
@@ -6,10 +6,10 @@
 //! local-config installs) and the flat `vendor/bundle/gems/` store
 //! (bundler 1 with an env `BUNDLE_PATH`). Both can coexist — a bundler-2
 //! install beside a bundler-1 install of the SAME project — each holding a
-//! REAL physical copy of the same `gem@version`. `apply` used to resolve
-//! the purl to ONE store's copy (first-wins merge), patch it, and report
-//! `success` while whichever bundler loaded the OTHER store ran pristine
-//! (vulnerable) bytes.
+//! REAL physical copy of the same `gem@version`. `apply` must patch every
+//! store's copy: resolving the purl to ONE copy (first-wins merge) would
+//! report `success` while whichever bundler loaded the OTHER store ran
+//! pristine (vulnerable) bytes.
 //!
 //! These tests build the coexisting layout by hand (hermetic, offline, no
 //! ruby toolchain), hand-stage a `.socket/` manifest + blobs, run the REAL
diff --git a/crates/socket-patch-cli/tests/in_process_get_update_count.rs b/crates/socket-patch-cli/tests/in_process_get_update_count.rs
index b5d0c41f..cce2616f 100644
--- a/crates/socket-patch-cli/tests/in_process_get_update_count.rs
+++ b/crates/socket-patch-cli/tests/in_process_get_update_count.rs
@@ -2,12 +2,11 @@
 //! `get::download_and_apply_patches_with` (driven through this file's
 //! `download_and_apply_patches` shim, which supplies the run's client).
 //!
-//! Regression guard: the manifest-update count used to be tallied from a
-//! pre-fetch scan of the manifest (`existing.uuid != search_result.uuid`),
-//! so a patch whose detail fetch subsequently FAILED was still reported as
-//! `updated`, and the misleading `[update] … (replacing …)` line printed
-//! for a replacement that never happened. The count must now reflect only
-//! patches whose record was actually replaced in the manifest.
+//! The manifest-update count must reflect only patches whose record was
+//! actually replaced in the manifest — not a pre-fetch scan of the manifest
+//! (`existing.uuid != search_result.uuid`), which would report a patch whose
+//! detail fetch FAILED as `updated` and print a misleading `[update] …
+//! (replacing …)` line for a replacement that never happened.
 
 use std::path::Path;
 
diff --git a/crates/socket-patch-cli/tests/in_process_npm_multicopy.rs b/crates/socket-patch-cli/tests/in_process_npm_multicopy.rs
index 4e52774f..fd0ce239 100644
--- a/crates/socket-patch-cli/tests/in_process_npm_multicopy.rs
+++ b/crates/socket-patch-cli/tests/in_process_npm_multicopy.rs
@@ -2,9 +2,9 @@
 //!
 //! When two REAL on-disk copies of the SAME `name@version` exist in a
 //! `node_modules` tree (an npm nested duplicate, a diamond dependency, a
-//! `file:` dup), agent-mode `apply` used to patch only ONE copy and report
-//! `success` with no signal the other copy was left with pristine
-//! (vulnerable) bytes — a false success for a security tool.
+//! `file:` dup), agent-mode `apply` must patch every copy — patching only
+//! ONE and reporting `success` would leave the other with pristine
+//! (vulnerable) bytes, a false success for a security tool.
 //!
 //! These tests build such a tree by hand (no package manager needed, so
 //! they are hermetic and offline), hand-stage a `.socket/` manifest + blob,
diff --git a/crates/socket-patch-cli/tests/in_process_pypi_apply.rs b/crates/socket-patch-cli/tests/in_process_pypi_apply.rs
index 8e9de4c3..c5bafe10 100644
--- a/crates/socket-patch-cli/tests/in_process_pypi_apply.rs
+++ b/crates/socket-patch-cli/tests/in_process_pypi_apply.rs
@@ -506,15 +506,12 @@ async fn pypi_apply_dry_run_does_not_modify_file() {
          the unchanged file does not prove dry-run suppressed a real patch; \
          bodies: {batch_bodies:?}"
     );
-    // Discovery alone still doesn't pin the APPLY path: a scan that
-    // degraded to plain listing (e.g. a broken `--apply` → agent-mode
-    // fold in `resolve_mode_flags`) also queries batch with the purl,
-    // exits 0, and leaves the file untouched — vacuously green. In JSON
-    // mode only the agent-mode apply branch fetches per-package patch
-    // details (`discover_selected`, which runs before the dry-run gate),
-    // so requiring that fetch proves dry-run reached the apply path with
-    // a real patch selected and then declined to write. Mutation-verified:
-    // dropping the `--apply` fold passes every assert above but fails here.
+    // Discovery alone doesn't prove a patch was selected. Requiring the
+    // per-package fetch (`discover_selected`, which runs before the dry-run
+    // gate) proves a real patch was selected before dry-run declined to
+    // write. Hosted mode's `run_redirect` also calls `discover_selected`, so
+    // this does NOT tell a broken `--apply` → agent fold (which would fall
+    // into the hosted default) apart from a working one.
     assert!(
         requests.iter().any(|r| r
             .url
diff --git a/crates/socket-patch-cli/tests/in_process_redirect.rs b/crates/socket-patch-cli/tests/in_process_redirect.rs
index 7299c758..9b6ff057 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect.rs
@@ -1789,9 +1789,9 @@ async fn partial_lockfile_write_failure_persists_ledger_originals() {
 // ── Rush monorepo ────────────────────────────────────────────────────────
 
 /// A Rush pnpm lock (v9) resolving the patched package under `packages:`, so
-/// the pnpm redirect rewriter has a `NAME@VERSION` block to repoint. `extra`
-/// lets a subspace lock resolve a DIFFERENT package name so the two locks are
-/// distinguishable in assertions.
+/// the pnpm redirect rewriter has a `NAME@VERSION` block to repoint.
+/// `pkg_name` is the package the lock resolves (both the common and the
+/// subspace lock pass `NAME`).
 fn rush_pnpm_lock(pkg_name: &str) -> String {
     format!(
         "lockfileVersion: '9.0'
@@ -3454,11 +3454,10 @@ async fn corrupt_ledger_dry_run_errors_without_moving_the_file() {
     );
 }
 
-/// D2 regression: hosted mode records patches ONLY in the redirect ledger —
-/// it never writes `.socket/manifest.json` — so `updates[]` (the documented
-/// read-only CI signal) must consult the ledger too. A pure hosted project
-/// whose redirected patch has been superseded used to report `updates: []`
-/// forever.
+/// Hosted mode records patches ONLY in the redirect ledger — it never
+/// writes `.socket/manifest.json` — so `updates[]` (the documented CI
+/// signal) must consult the ledger too, or a pure hosted project whose
+/// redirected patch has been superseded reports `updates: []` forever.
 #[tokio::test]
 #[serial]
 async fn scan_updates_reports_superseding_patch_for_ledger_only_project() {
@@ -3492,7 +3491,7 @@ async fn scan_updates_reports_superseding_patch_for_ledger_only_project() {
     )
     .unwrap();
 
-    // Plain read-only `scan --json` — the nightly CI shape from the finding.
+    // Bare `scan --json` (hosted by default) — the nightly CI shape.
     let out = scrubbed_cli()
         .args([
             "scan",
diff --git a/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs b/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs
index 1ebec913..43d789de 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs
@@ -10,8 +10,8 @@
 //!   same-run `--vex`, re-scanned idempotently and rolled back byte for byte;
 //! * `SOCKET_PIPENV_MAJOR=11` selects the legacy `path` reference shape the
 //!   installer probe would otherwise need a real Pipenv 7–11 on PATH for;
-//! * a stale `Pipfile.lock` that does not pin the package no longer vetoes
-//!   the sibling `requirements.txt` redirect (Bugbot HIGH on #242);
+//! * a stale `Pipfile.lock` that does not pin the package does not veto
+//!   the sibling `requirements.txt` redirect;
 //! * a venv still holding the UPSTREAM release is reported stale and kept
 //!   out of the same-run attestation.
 //!
diff --git a/crates/socket-patch-cli/tests/in_process_redirect_pnpm.rs b/crates/socket-patch-cli/tests/in_process_redirect_pnpm.rs
index a3a2eb35..9ceacd24 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect_pnpm.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect_pnpm.rs
@@ -30,7 +30,8 @@ const PATCHED_SHA512: &str = "sha512-PATCHEDpatchedPATCHEDpatched0123456789==";
 const UPSTREAM_SHA512: &str = "sha512-UPSTREAMupstream==";
 const GHSA: &str = "GHSA-rdir-pnpm-bbbb";
 
-/// `--mode hosted` (the released spelling that folds to `redirect: true`).
+/// `--mode hosted` (the documented spelling; the hidden `--redirect` boolean
+/// folds into it).
 fn hosted_args(cwd: &Path, api_url: String) -> ScanArgs {
     ScanArgs {
         paths: Vec::new(),
@@ -875,7 +876,7 @@ specifiers:
     assert!(!doc.to_string().contains("redirect_pnpm_legacy_lockfile"));
 
     // The lockfile-only supplement reads shrinkwrap.yaml: the uninstalled
-    // `/legacy-only-dep/2.0.0` entry surfaces (it was 0 before the fix).
+    // `/legacy-only-dep/2.0.0` entry surfaces.
     assert_eq!(
         doc["lockfileOnlyPackages"], 1,
         "shrinkwrap.yaml must feed the lockfile-only supplement: {doc}"
diff --git a/crates/socket-patch-cli/tests/in_process_remote_ecosystems_apply.rs b/crates/socket-patch-cli/tests/in_process_remote_ecosystems_apply.rs
index 6ef4aaa6..094454bc 100644
--- a/crates/socket-patch-cli/tests/in_process_remote_ecosystems_apply.rs
+++ b/crates/socket-patch-cli/tests/in_process_remote_ecosystems_apply.rs
@@ -33,10 +33,9 @@ fn git_sha256(content: &[u8]) -> String {
 }
 
 // --- Request introspection helpers -----------------------------------------
-// The discovery-only tests below previously asserted *only* `scan_run == 0`.
 // Exit 0 is also what a crawler that discovered nothing (or short-circuited
-// the API entirely) returns, so the old assertion was vacuous. These helpers
-// let us assert on the real code path: that the batch endpoint was actually
+// the API entirely) returns, so these helpers let the discovery-only tests
+// assert on the real code path: that the batch endpoint was actually
 // hit and that it carried the PURL the crawler was supposed to discover.
 async fn recorded(server: &MockServer) -> Vec<wiremock::Request> {
     server.received_requests().await.unwrap_or_default()
@@ -231,7 +230,7 @@ async fn golang_handcrafted_install_apply_patches_file() {
     let args = default_scan_args(tmp.path(), "golang", server.uri());
     let code = scan_run(args).await;
     // A single free patch that downloads + applies cleanly must exit 0.
-    // `download_and_apply_patches` only returns 1 when a patch fails to
+    // `download_and_apply_patches_with` only returns 1 when a patch fails to
     // download or apply, so 1 here means the apply path silently broke.
     assert_eq!(
         code, 0,
@@ -528,9 +527,6 @@ async fn nuget_handcrafted_install_apply_patches_file() {
     let after_hash = git_sha256(&patched);
 
     std::env::set_var("NUGET_PACKAGES", &packages);
-    // NuGet crawler is runtime-gated behind this env var (see
-    // `ecosystem_dispatch::nuget_runtime_enabled`). The test
-    // deliberately exercises the NuGet apply path, so opt in.
 
     let server = MockServer::start().await;
     setup_apply_mock(
diff --git a/crates/socket-patch-cli/tests/in_process_remove_repair_lifecycle.rs b/crates/socket-patch-cli/tests/in_process_remove_repair_lifecycle.rs
index 2f286618..575d6339 100644
--- a/crates/socket-patch-cli/tests/in_process_remove_repair_lifecycle.rs
+++ b/crates/socket-patch-cli/tests/in_process_remove_repair_lifecycle.rs
@@ -1,8 +1,8 @@
 //! Full-lifecycle tests for `remove` and `repair`.
 //!
 //! `remove` exercises the rollback → manifest delete → blob cleanup
-//! chain. `repair` exercises blob fetching + GC across all three
-//! download modes (file/diff/package). Both are run in-process so
+//! chain. `repair` exercises blob fetching + GC in both download modes
+//! (file/diff) and checks that the removed `package` mode fails hard. Both are run in-process so
 //! coverage is captured.
 
 use std::path::Path;
@@ -314,7 +314,7 @@ async fn remove_no_manifest_emits_not_found() {
 }
 
 // ---------------------------------------------------------------------------
-// repair: download in all three modes (file/diff/package)
+// repair: download in both modes (file/diff); `package` fails hard
 // ---------------------------------------------------------------------------
 
 fn make_repair_args(cwd: &Path, mode: &str) -> RepairArgs {
diff --git a/crates/socket-patch-cli/tests/in_process_rollback_all_ecosystems.rs b/crates/socket-patch-cli/tests/in_process_rollback_all_ecosystems.rs
index 4d8e8fbc..cdaf734d 100644
--- a/crates/socket-patch-cli/tests/in_process_rollback_all_ecosystems.rs
+++ b/crates/socket-patch-cli/tests/in_process_rollback_all_ecosystems.rs
@@ -5,17 +5,17 @@
 //! `.socket/blobs/`, writes a manifest, then runs in-process
 //! `rollback`. Verifies the file is restored to the original content.
 //!
-//! Exercises `find_packages_for_rollback` for every ecosystem — a
+//! Exercises `find_all_packages_for_rollback` for every ecosystem — a
 //! distinct code path from apply's `find_all_packages_for_purls`.
 //!
 //! That distinction is only *observable* for the release-variant
 //! ecosystems (PyPI / RubyGems / Maven): there the rollback resolver
-//! uses `merge_qualified` while the apply/get resolver uses
-//! `merge_first_wins`, and the two diverge ONLY when the manifest key is
+//! uses `merge_qualified` while apply's resolver is base-keyed
+//! (`merge_variant_copies`), and the two diverge ONLY when the manifest key is
 //! a *qualified* PURL (`?artifact_id=` / `?platform=` / `?classifier=`).
 //! The crawler is queried with the deduped base PURL and returns a
 //! base-keyed result; `merge_qualified` fans that path back out to every
-//! qualified manifest key, whereas `merge_first_wins` would leave only
+//! qualified manifest key, whereas a base-keyed merge would leave only
 //! the base key — so the subsequent `manifest.patches.get(<qualified>)`
 //! returns `None`, the package is skipped, and nothing is restored.
 //!
@@ -23,11 +23,10 @@
 //! manifest PURL: a regression that swapped the rollback resolver back to
 //! a base-keyed `find_all_packages_for_purls` would silently leave the file patched and
 //! the byte-restore assertion below would fail. With a bare PURL both
-//! merge functions behave identically, so the test would prove nothing —
-//! that is the loophole this file used to have.
+//! merge functions behave identically, so the test would prove nothing.
 //!
 //! npm / cargo / golang / composer / nuget are NOT release-variant
-//! ecosystems (they use `merge_first_wins` in both resolvers), so a
+//! ecosystems (their crawlers wire `merge_first_wins` in both resolvers), so a
 //! qualified PURL there is genuinely unsupported and those fixtures keep
 //! bare PURLs.
 
@@ -190,9 +189,8 @@ async fn rollback_pypi_restores_original_content() {
     // create site-packages with a dist-info dir. The layout differs
     // per platform (PEP-405): Unix puts site-packages under
     // `lib/python<MAJOR>.<MINOR>/`, Windows puts it under `Lib/`
-    // with no version subdirectory. The crawler at
-    // crates/socket-patch-core/src/crawlers/python_crawler.rs:182
-    // already branches on cfg!(windows); mirror that here so the
+    // with no version subdirectory. The python crawler
+    // (crates/socket-patch-core/src/crawlers/python_crawler.rs) already branches on cfg!(windows); mirror that here so the
     // crawler actually finds the synthetic package on every runner.
     let site = if cfg!(windows) {
         tmp.path().join(".venv").join("Lib").join("site-packages")
@@ -222,9 +220,9 @@ async fn rollback_pypi_restores_original_content() {
     let socket = tmp.path().join(".socket");
     // QUALIFIED PURL on purpose — see module header. The crawler emits the
     // base `pkg:pypi/rbpypi@1.0.0`; only `merge_qualified` (used by
-    // `find_packages_for_rollback`) fans it back out to this `?artifact_id=`
+    // `find_all_packages_for_rollback`) fans it back out to this `?artifact_id=`
     // key so the manifest lookup hits. A base-keyed `find_all_packages_for_purls`
-    // (`merge_first_wins`) would key it under the bare base, the patch
+    // (`merge_variant_copies`) would key it under the bare base, the patch
     // lookup would miss, and the file below would stay patched.
     write_manifest_with_patch(
         &socket,
@@ -293,9 +291,9 @@ async fn rollback_gem_restores_original_content() {
 
     let socket = tmp.path().join(".socket");
     // QUALIFIED PURL on purpose — RubyGems is a release-variant ecosystem
-    // (`?platform=`). Only `find_packages_for_rollback`'s `merge_qualified`
-    // remaps the crawler's base PURL onto this qualified manifest key; the
-    // `merge_first_wins` resolver would skip the package and leave the file
+    // (`?platform=`). Only `find_all_packages_for_rollback`'s `merge_qualified`
+    // remaps the crawler's base PURL onto this qualified manifest key; a
+    // base-keyed resolver would skip the package and leave the file
     // patched. See module header.
     write_manifest_with_patch(
         &socket,
@@ -453,9 +451,9 @@ async fn rollback_maven_restores_original_content() {
 
     let socket = tmp.path().join(".socket");
     // QUALIFIED PURL on purpose — Maven is a release-variant ecosystem
-    // (`?classifier=&type=`). Only `find_packages_for_rollback`'s
+    // (`?classifier=&type=`). Only `find_all_packages_for_rollback`'s
     // `merge_qualified` remaps the crawler's base PURL onto this qualified
-    // manifest key; `merge_first_wins` would skip the package and leave the
+    // manifest key; a base-keyed resolver would skip the package and leave the
     // file patched. See module header.
     write_manifest_with_patch(
         &socket,
diff --git a/crates/socket-patch-cli/tests/in_process_rollback_hosted.rs b/crates/socket-patch-cli/tests/in_process_rollback_hosted.rs
index 36d3b3a0..3fcd5a24 100644
--- a/crates/socket-patch-cli/tests/in_process_rollback_hosted.rs
+++ b/crates/socket-patch-cli/tests/in_process_rollback_hosted.rs
@@ -1058,8 +1058,7 @@ async fn unscoped_replays_unsupported_ecosystems() {
 // ---------------------------------------------------------------------------
 
 /// A hosted-only project (redirect ledger + wired lock, NO manifest) rolls
-/// back fine — a missing manifest is no longer fatal when a ledger holds
-/// work. A TRULY empty directory keeps the legacy "Manifest not found"
+/// back fine — a missing manifest is not fatal when a ledger holds work. A TRULY empty directory keeps the legacy "Manifest not found"
 /// exit-1 error.
 #[tokio::test]
 #[serial]
diff --git a/crates/socket-patch-cli/tests/in_process_scan.rs b/crates/socket-patch-cli/tests/in_process_scan.rs
index a63d8efe..859bb611 100644
--- a/crates/socket-patch-cli/tests/in_process_scan.rs
+++ b/crates/socket-patch-cli/tests/in_process_scan.rs
@@ -4,7 +4,7 @@
 //! is fully instrumented. Mocks the API via wiremock. Hits every flag
 //! combination that the subprocess-based tests don't explicitly
 //! exercise (non-JSON paths, --apply without --prune, --prune without
-//! --apply, --batch-size variations, --download-mode variations).
+//! --apply, --batch-size variations).
 
 use std::path::Path;
 
@@ -196,7 +196,7 @@ async fn run_scrubbed(args: ScanArgs) -> i32 {
 }
 
 // ---------------------------------------------------------------------------
-// Discovery — read-only --json mode
+// Discovery — default (hosted) --json mode
 // ---------------------------------------------------------------------------
 
 #[tokio::test]
@@ -237,7 +237,7 @@ async fn scan_installed_package_discovers_patch() {
     assert_eq!(run_scrubbed(args).await, 0);
     // The installed package must actually be discovered by the crawler and
     // sent to the batch endpoint. Without this, a regression that crawled
-    // nothing would still exit 0 and pass the old test.
+    // nothing would still exit 0.
     let reqs = recorded(&server).await;
     let posts = batch_posts(&reqs);
     assert_eq!(posts.len(), 1, "exactly one batch query expected");
@@ -357,10 +357,10 @@ const UUID_LOW: &str = "22222222-2222-4222-8222-222222222222";
 
 /// A package with two available patches: a freshly-published `low` and an
 /// older `critical`. `paid` toggles `canAccessPaidPatches`, which selects
-/// between `select_patches`' auto-select branch and its interactive one.
+/// between `select_patches`' paid auto-select branch and its free-tier
+/// `--yes` auto-select (scan never prompts).
 ///
-/// This is the exact shape of the reported bug — the old selector took the
-/// most recent patch and left the critical unfixed.
+/// Neither is merged, so severity must beat recency.
 async fn mock_two_patches(server: &MockServer, paid: bool) {
     let low = serde_json::json!({
         "uuid": UUID_LOW, "purl": PURL, "tier": "free",
@@ -377,8 +377,8 @@ async fn mock_two_patches(server: &MockServer, paid: bool) {
     Mock::given(method("POST"))
         .and(path(format!("/v0/orgs/{ORG}/patches/batch")))
         .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
-            // Listed newest-first, i.e. the order the old `.first()` /
-            // date-sort logic would have taken the WRONG patch from.
+            // Listed newest-first, so a `.first()` / date-sort pick would
+            // take the WRONG patch.
             "packages": [{ "purl": PURL, "patches": [low, critical] }],
             "canAccessPaidPatches": paid,
         })))
@@ -458,10 +458,9 @@ async fn scan_apply_picks_critical_over_more_recent_low_for_paid_user() {
     );
 }
 
-/// Same package, but the user has no paid access, so `select_patches`
-/// takes the interactive branch. Tests run headless, so `select_one`
-/// auto-selects option 0 — which means the *presented order* is what
-/// decides, and it must be the ranked order.
+/// Same package, but the user has no paid access. Scan never prompts:
+/// `selection_args` forces `--yes`, so `select_patches` auto-selects the
+/// top-ranked accessible patch, and the ranking alone decides.
 #[tokio::test]
 #[serial]
 async fn scan_apply_picks_critical_for_free_user_via_ranked_prompt_order() {
@@ -927,19 +926,10 @@ async fn scan_non_json_empty_project_friendly_message() {
 // ---------------------------------------------------------------------------
 // API error handling
 //
-// The original `assert!(code == 0 || code == 1)` here was the headline
-// loophole of this file: a disjoint-outcome assertion that passes whether
-// the scan correctly surfaces the failure OR silently swallows it. The
-// implementation used to only emit a telemetry event when every batch
-// errored — returning 0 and printing status="success" with an empty package
-// list — so the assertions below were first committed RED to encode the
-// documented intent ("surface this as a full scan failure rather than
-// silently reporting zero patches").
-//
-// That bug is now FIXED (scan/mod.rs bails with exit 1 when
+// Documented intent: "surface this as a full scan failure rather than
+// silently reporting zero patches" — scan/mod.rs bails with exit 1 when
 // batch_error_count == total_batches, and discover_selected likewise errors
-// when every detail query fails); these tests pass and stay as regression
-// guards for both levels.
+// when every detail query fails. These pin both levels.
 // ---------------------------------------------------------------------------
 
 #[tokio::test]
@@ -1179,8 +1169,7 @@ async fn scan_prune_with_ecosystem_filter_keeps_other_ecosystem() {
 async fn scan_prune_keeps_entry_of_uncrawled_ecosystem() {
     // `.socket/manifest.json` is a COMMITTED, shared file. A teammate on a
     // newer CLI can add a patch for an ecosystem this binary has no crawler
-    // for (here `pkg:hex/…`; the runtime-gated maven/nuget crawlers behave
-    // the same way with their gate off). That purl is never looked for, so
+    // for (here `pkg:hex/…`). That purl is never looked for, so
     // its absence from the crawl says nothing about whether it is installed
     // — yet prune treated "not in scanned_purls" as "uninstalled" and
     // deleted both the entry and its blob: silent, cross-machine patch loss.
@@ -1375,9 +1364,7 @@ async fn scan_non_json_dry_run_does_not_mutate() {
 // Maven/NuGet are first-class: every scan mode discovers them.
 // ---------------------------------------------------------------------------
 
-/// Maven and NuGet used to sit behind `SOCKET_EXPERIMENTAL_MAVEN` /
-/// `SOCKET_EXPERIMENTAL_NUGET` runtime gates that silently dropped them
-/// from discovery. The gates are retired: every scan mode (default,
+/// Maven and NuGet have no runtime gate: every scan mode (default,
 /// `--mode hosted`, `--mode vendored`) must crawl both with no opt-in of
 /// any kind. The oracle is the batch POST body — it carries exactly the
 /// purls the crawl discovered, so a resurrected gate shows up as the
@@ -1500,8 +1487,8 @@ async fn scan_vendor_dry_run_with_vex_does_not_write_attestation_file() {
     // A manifest whose sole record WOULD attest successfully: vulnerability
     // metadata for the statement, `setup.manual: ["npm"]` to pass the
     // property-7 ecosystem filter, and `--vex-no-verify` below to skip the
-    // on-disk hash check. Under the old behavior the dry run generated the
-    // document for real and wrote it to disk.
+    // on-disk hash check, so only the dry-run gate keeps the document off
+    // disk.
     let socket = tmp.path().join(".socket");
     std::fs::create_dir_all(&socket).unwrap();
     std::fs::write(
diff --git a/crates/socket-patch-cli/tests/in_process_vendor.rs b/crates/socket-patch-cli/tests/in_process_vendor.rs
index f9e66e87..e0767718 100644
--- a/crates/socket-patch-cli/tests/in_process_vendor.rs
+++ b/crates/socket-patch-cli/tests/in_process_vendor.rs
@@ -393,9 +393,9 @@ async fn rerun_is_idempotent() {
     );
     assert_eq!(env["summary"]["failed"], 0);
     assert_eq!(env["summary"]["skipped"], 1);
-    // The in-sync re-run synthesizes its result against the vendored
-    // artifact path, which routes to the `vendored` skip reason (the same
-    // tag `apply` uses for vendor-owned packages) — pin the actual contract.
+    // The in-sync re-run is a counted skip with reason `already_vendored`
+    // (distinct from the `vendored` tag `apply` uses for vendor-owned
+    // packages) — pin the actual contract.
     let skipped = find_event(&env, "skipped", Some("already_vendored"));
     assert_eq!(skipped["purl"], PURL);
 
@@ -1547,23 +1547,17 @@ async fn vendored_npm_purl_skipped_even_without_installed_tree() {
 }
 
 // ─────────────────────────────────────────────────────────────────────
-// 10a′. rollback after vendor — vendored purls are excluded
+// 10a′. rollback after vendor — vendoring is reverted
 // ─────────────────────────────────────────────────────────────────────
 
-/// `rollback` excludes vendor-owned purls from in-place restoration: the
-/// patch lives in the committed artifact + lock wiring, so before-blob
-/// restoration has nothing to restore (and would only hash-mismatch).
-/// The skip is benign (exit 0) and surfaced in the JSON `vendored` array;
-/// an identifier that targets ONLY a vendored purl is still exit 0, not
-/// `not_found`.
+/// `rollback` reverts vendor-owned purls (lock restored byte-for-byte,
+/// artifact + ledger entry gone, manifest entry removed), surfaced in
+/// `vendoredReverted`; both the unscoped and identifier-scoped spellings
+/// act.
 #[tokio::test]
 async fn vendored_purl_excluded_from_rollback() {
-    // v4 duality rework: `rollback` REVERTS vendored state by default —
-    // lock restored byte-for-byte, artifact + ledger entry gone, manifest
-    // entry removed. (The pre-v4 benign skip is what `--preserve-state`'s
-    // artifact/entry retention replaced.) Both the unscoped and the
-    // identifier-scoped spellings act; the fixture is re-vendored between
-    // them.
+    // The fixture is re-vendored between the unscoped and the
+    // identifier-scoped runs.
     let fx = npm_fixture();
     // The default rollback now removes the manifest entry AND sweeps the
     // now-unused blobs, and re-vendoring needs both back — snapshot the
@@ -2656,9 +2650,8 @@ async fn scan_vendor_gem_end_to_end_and_reverts() {
 /// the served patch records carry the QUALIFIED gem purl (`?platform=ruby`)
 /// — the spelling production has published since the 2026-08-18 gem catalog
 /// republish. `platform=ruby` is the portable default: the vendor gate
-/// refuses only non-empty, non-`ruby` platform qualifiers (#172), so this
-/// must vendor exactly like the bare purl. This is the CLI-level pin that
-/// keeps the old `platform_gem_unsupported` gap from silently reopening;
+/// refuses only non-empty, non-`ruby` platform qualifiers, so this must
+/// vendor exactly like the bare purl (never `platform_gem_unsupported`);
 /// the core-level twin is
 /// `vendor::gem::tests::test_platform_ruby_gem_from_autofetch_staging_dir_vendors`.
 #[tokio::test]
@@ -2990,8 +2983,8 @@ async fn scan_vendor_gem_artifact_rebuild_over_other_uuid_entry_keeps_ledger() {
 //     not the grant-tokenized hosted splice — and a re-vendor
 //     (`already_vendored`) is silent,
 //   * `vendor --revert` therefore restores the REGISTRY lock byte-exactly
-//     (pre-#206 it restored an expiring hosted URL with no CLI path back to
-//     registry state).
+//     (never an expiring hosted URL with no CLI path back to registry
+//     state).
 mod hosted_to_vendor_conversion {
     use super::*;
     use serial_test::serial;
@@ -3240,7 +3233,7 @@ snapshots:
 
         // The pre-revert leaves nothing to supersede, so the
         // vendor_supersedes_redirect warning must not fire — not on this run
-        // (pre-#206 it fired here) and not on any later one.
+        // and not on any later one.
         assert!(
             takeover_warnings(&env1).is_empty(),
             "the pre-revert must preempt vendor_supersedes_redirect: {env1:#}"
@@ -3427,13 +3420,10 @@ snapshots:
 /// orchestrator must ALSO keep the artifact dir and the state.json entry,
 /// and account for it honestly — a COUNTED `Skipped` (`vendor_revert_kept`),
 /// never a `Removed`. Undoing the drift and re-running `--revert` then
-/// completes the revert fully.
-///
-/// Previously (residual #131) this path deleted the artifact dir and pruned
-/// the ledger entry while the lock stayed pointed elsewhere — destroying the
-/// only pre-vendor originals a later restore (or the redirect ledger's
-/// recorded `original` fragments) could use — and reported plain success
-/// with `summary.skipped == 0`.
+/// completes the revert fully. Deleting the artifact dir or pruning the
+/// ledger entry here would destroy the only pre-vendor originals a later
+/// restore (or the redirect ledger's recorded `original` fragments) could
+/// use.
 #[tokio::test]
 async fn revert_after_drift_keeps_artifact_and_ledger_then_completes() {
     let fx = npm_fixture();
diff --git a/crates/socket-patch-cli/tests/in_process_vendor_bun.rs b/crates/socket-patch-cli/tests/in_process_vendor_bun.rs
index ba874fa2..33cf99de 100644
--- a/crates/socket-patch-cli/tests/in_process_vendor_bun.rs
+++ b/crates/socket-patch-cli/tests/in_process_vendor_bun.rs
@@ -4,7 +4,7 @@
 //! vendored`, their `--dry-run` previews, `--silent`, and the agent
 //! `--save-only` exemption — driven through the built binary against a
 //! wiremock patch API, on lockfiles written in the grammar REAL bun
-//! releases emit (captured in the PR #245 compatibility matrix and from a
+//! releases emit (captured in the bun compatibility matrix and from a
 //! bun 1.1.45 `--save-text-lockfile` run):
 //!
 //! * lockfileVersion 1 (bun 1.2.x–1.3.x) / 2 (bun 1.4.x) workspace locks:
@@ -572,12 +572,10 @@ async fn scan_vendored_refusal_preserves_seeded_manifest_record() {
 // scan --mode vendored --detached: the same refusal, BEFORE any fetch
 // ---------------------------------------------------------------------------
 
-/// The detached download phase used to skip the preflight: the patch view
-/// was fetched (`download.downloaded: 1`) and the refusal only surfaced
-/// from the vendor engine afterwards (degrading to `package_not_installed`
-/// for alias installs). Now it refuses exactly like the manifest-tracked
-/// phase — pre-fetch, with the vendor code — and, being detached, writes
-/// no manifest at all.
+/// Every vendored download phase (with or without the no-op `--detached`)
+/// refuses pre-fetch with the vendor code — never fetching the view and
+/// deferring the refusal to the vendor engine (which degrades to
+/// `package_not_installed` for alias installs) — and writes no manifest.
 #[tokio::test]
 async fn scan_vendored_detached_refuses_v1_workspace_before_fetch() {
     let mock = MockServer::start().await;
@@ -1161,9 +1159,8 @@ async fn preserved_ledger_does_not_bypass_bun_refusal_after_rollback() {
 /// The download phase must NOT refuse a purl the ledger already wires at
 /// the selected uuid: the re-run classifies it `skipped` (the ledger's
 /// embedded record is reused) exactly as on a non-Bun project, instead of
-/// `failed`. Pinned
-/// independently of the vendor step below so the CLI half of the
-/// exemption is guarded even while the engine half lands separately.
+/// `failed`. Pinned independently of the vendor step (see the next test) so
+/// a regression in the CLI half fails on its own.
 #[tokio::test]
 async fn already_vendored_v1_workspace_rerun_download_phase_is_skipped_not_refused() {
     let mock = MockServer::start().await;
diff --git a/crates/socket-patch-cli/tests/in_process_vendor_bun_takeover.rs b/crates/socket-patch-cli/tests/in_process_vendor_bun_takeover.rs
index 994460f4..4662a33a 100644
--- a/crates/socket-patch-cli/tests/in_process_vendor_bun_takeover.rs
+++ b/crates/socket-patch-cli/tests/in_process_vendor_bun_takeover.rs
@@ -3,9 +3,7 @@
 //!
 //! Twin of the yarn legs in `mode_migration_npm.rs` and the pnpm
 //! `hosted_to_vendor_conversion` module in `in_process_vendor.rs`, for the
-//! one npm-family lock flavor whose hosted→vendored takeover used to be a
-//! hard refusal (`redirect_revert_failed`, "cannot replay yet"): the bun
-//! hosted rewrite REPLACES the registry 4-tuple's `name@version` spec with
+//! bun lock flavor: the bun hosted rewrite REPLACES the registry 4-tuple's `name@version` spec with
 //! a URL 3-tuple, so without the per-purl pre-revert the bun vendor backend
 //! cannot even find the entry. The API is wiremock; no `bun` binary is
 //! needed (the lock grammar is the real bun 1.4.2 lockfileVersion-2 shape
@@ -613,9 +611,9 @@ async fn bun_digestless_hosted_line_is_taken_over_by_scan_vendored_and_reverts_t
     let digestless = drop_digest_in_lock(root, NAME);
     assert!(digestless.contains(HOSTED_URL), "{digestless}");
 
-    // The takeover over the digest-less hosted line: used to refuse
+    // The takeover over the digest-less hosted line must not refuse
     // `redirect_revert_failed` ("has drifted from the recorded hosted
-    // redirect") and vendor nothing.
+    // redirect").
     let (code, env) = scan_mode(root, &server.uri(), "vendored", &[]);
     assert_eq!(code, 0, "takeover over a digest-less hosted line: {env:#}");
     assert_eq!(env["status"], "success", "{env:#}");
@@ -825,8 +823,7 @@ async fn bun_vendor_dry_run_previews_the_takeover_then_wet_vendor_completes_it()
 /// A hosted-live bun project with TWO redirect records, written exactly as
 /// the hosted flow leaves them (ledger edits = verbatim lines, lock = the
 /// URL 3-tuples). Two records make a scoped unwind of one purl ineligible
-/// for the whole-ledger replay, so it takes the per-purl revert — the path
-/// that used to refuse for bun.
+/// for the whole-ledger replay, so it takes the per-purl revert.
 fn write_two_record_hosted_project(root: &Path) -> String {
     let pristine = pristine_lock_two();
     write_bun_project(root, &pristine, &[(NAME, VERSION), (OTHER_NAME, "1.0.0")]);
@@ -953,8 +950,7 @@ fn bun_scoped_remove_of_one_of_two_hosted_records_unwinds_only_that_purl() {
     let root = tmp.path();
     let pristine = write_two_record_hosted_project(root);
 
-    // `remove <purl>` takes the same per-purl hosted leg; used to exit 1
-    // with `hosted_revert_failed`.
+    // `remove <purl>` takes the same per-purl hosted leg.
     let (code, env) = run_json(
         root,
         &[
@@ -979,13 +975,10 @@ fn bun_scoped_remove_of_one_of_two_hosted_records_unwinds_only_that_purl() {
 // ─────────────────────────────────────────────────────────────────────
 // Hosted mode accepts a lockfileVersion-1 workspace lock (a URL tuple has
 // no path to resolve); the vendored backend refuses every pre-v2 workspace
-// lock (`vendor_bun_workspace_unsupported`). The plain `vendor` command
-// used to run the takeover FIRST — revert the hosted line, persist the
-// redirect-ledger drop — and only then hear the engine's refusal, leaving
-// the project unpatched in BOTH modes while the refusal's remedy pointed
-// at the hosted mode it had just destroyed; its dry run promised the
-// takeover (`vendor_would_revert_redirect`, status success) outright. The
-// Bun preflight now runs inside the engine loop before the takeover block.
+// lock (`vendor_bun_workspace_unsupported`). The Bun preflight runs inside
+// the engine loop before the takeover block, so a refused `vendor` (and its
+// dry run) never reverts the hosted line or drops the redirect-ledger
+// record first — which would leave the project unpatched in BOTH modes.
 
 const WS_CODE: &str = "vendor_bun_workspace_unsupported";
 
diff --git a/crates/socket-patch-cli/tests/interactive_prompts_e2e.rs b/crates/socket-patch-cli/tests/interactive_prompts_e2e.rs
index 83c26d67..ce1fae11 100644
--- a/crates/socket-patch-cli/tests/interactive_prompts_e2e.rs
+++ b/crates/socket-patch-cli/tests/interactive_prompts_e2e.rs
@@ -1,7 +1,8 @@
 //! End-to-end tests that drive interactive prompts (`ui::confirm`,
 //! `ui::confirm_or_proceed`) via a pseudo-terminal. These exercise the
-//! stdin-is-a-terminal-gated confirmation paths in `setup`, `remove`, and
-//! `get` that subprocess-with-piped-stdin tests can't reach.
+//! stdin-is-a-terminal-gated confirmation paths in `setup` and `remove`
+//! (plus `apply`'s no-manifest message) that subprocess-with-piped-stdin
+//! tests can't reach.
 //!
 //! PTY support: macOS + Linux. Skipped on Windows.
 
@@ -582,8 +583,8 @@ fn remove_detached_interactive_n_cancel_message_respects_silent() {
 }
 
 // ---------------------------------------------------------------------------
-// Apply non-JSON without --yes also exercises confirm() flow,
-// even though apply auto-proceeds in non-interactive contexts.
+// `apply` has no prompt; in a real TTY the no-manifest path must still
+// print its friendly message.
 // ---------------------------------------------------------------------------
 
 #[test]
@@ -591,10 +592,9 @@ fn apply_in_pty_with_no_manifest_prints_friendly_message() {
     let tmp = tempfile::tempdir().unwrap();
     let (code, output) = run_in_pty(&["apply"], tmp.path(), "", Duration::from_secs(15));
     assert_eq!(code, 0);
-    // Assert the full message, not either half of it. The `||` previously
-    // let a truncated/garbled message ("...nothing to apply...") pass.
-    // v5.0 wording names the missing manifest, not the `.socket/` folder
-    // (hosted/vendored projects have one with nothing for `apply` to do).
+    // Assert the full message, not either half of it. The wording names the
+    // missing manifest, not the `.socket/` folder (hosted/vendored projects
+    // have one with nothing for `apply` to do).
     assert!(
         output.contains("No patch manifest found; nothing to apply."),
         "PTY apply no-manifest must print the friendly message; got: {output}"
diff --git a/crates/socket-patch-cli/tests/mode_migration_bun.rs b/crates/socket-patch-cli/tests/mode_migration_bun.rs
index 0794f3eb..49452d22 100644
--- a/crates/socket-patch-cli/tests/mode_migration_bun.rs
+++ b/crates/socket-patch-cli/tests/mode_migration_bun.rs
@@ -316,7 +316,7 @@ fn bun_toolchain(tag: &str) -> Option<(String, BunVersion)> {
 /// every `BUN_*` var (the harness passes bun's install/cache dirs
 /// explicitly per project), `npm_config_*` (bun reads npm's registry
 /// config; an ambient mirror or auth token would change what the fixture
-/// install resolves against) and `VIRTUAL_ENV` — the scrub the three bun
+/// install resolves against) and `VIRTUAL_ENV` — the scrub the bun
 /// suites share, so none can drift back to a `SOCKET_*`-only scrub.
 fn scrub_env(cmd: &mut Command) {
     cache_env::scrub_ambient_bun_env(cmd);
@@ -1845,8 +1845,7 @@ async fn bun_scoped_rollback_and_remove_unwind_one_of_two_hosted_records() {
     // replay ⇒ pristine.
     assert_unscoped_rollback_restores_pristine(&fx, &by_rollback, "after-scoped-rollback");
 
-    // `remove <purl>` takes the same per-purl hosted leg; used to exit 1
-    // with `hosted_revert_failed`.
+    // `remove <purl>` takes the same per-purl hosted leg.
     let by_remove = fx.dir("two-hosted-copy-remove");
     copy_project(&proj, &by_remove);
     let (code, stdout, stderr) = run_socket(
diff --git a/crates/socket-patch-cli/tests/mode_migration_cargo.rs b/crates/socket-patch-cli/tests/mode_migration_cargo.rs
index de3d8197..8b1d3b60 100644
--- a/crates/socket-patch-cli/tests/mode_migration_cargo.rs
+++ b/crates/socket-patch-cli/tests/mode_migration_cargo.rs
@@ -5,14 +5,13 @@
 //! `.cargo/config.toml` registry block — so both directions edit Cargo.toml
 //! and each must leave none of the other mode's lines behind.
 //!
-//! Adapted from the audit probes that empirically proved findings C1–C7 (the
-//! cargo mode-takeover bug class): both directions used to exit 0 while
-//! leaving the project unbuildable under `--locked` (leftover
+//! Pins the cargo mode-takeover failure class: neither direction may exit 0
+//! while leaving the project unbuildable under `--locked` (a leftover
 //! `[patch.crates-io]` after a hosted takeover; a surviving
 //! `registry = "socket-patch-…"` Cargo.toml pin after a vendored takeover), a
-//! double takeover destroyed the unrecoverable crates.io lock originals in
-//! the vendored ledger, and the takeover classifier then emitted an INVERTED
-//! warning telling the user to delete the live ledger.
+//! double takeover must keep the unrecoverable crates.io lock originals in
+//! the vendored ledger, and the takeover classifier must never tell the user
+//! to delete the live ledger.
 //!
 //! Each scenario drives the REAL binary against real cargo (network used for
 //! the crates.io fixture build only; the hosted registry is wiremock) and
diff --git a/crates/socket-patch-cli/tests/mode_migration_npm.rs b/crates/socket-patch-cli/tests/mode_migration_npm.rs
index ecb3e6bc..a2398ae3 100644
--- a/crates/socket-patch-cli/tests/mode_migration_npm.rs
+++ b/crates/socket-patch-cli/tests/mode_migration_npm.rs
@@ -1,18 +1,16 @@
 //! Real-yarn mode-migration e2e: hosted ⇄ vendored takeovers on the npm
 //! family must leave the project FULLY in the new mode — or refuse.
 //!
-//! Twin of `mode_migration_cargo.rs` (the file that pins the C1–C7 cargo
-//! takeover bug class from #196) for the yarn classic + berry lock flavors.
-//! Pre-fix, the vendor dispatch loop's cross-mode pre-revert was hard-gated
-//! `candidate.starts_with("pkg:cargo/")`, so vendoring an npm purl over a
-//! LIVE hosted redirect:
-//!   (a) recorded the HOSTED patch.socket.dev lock fragment as the vendor
+//! Twin of `mode_migration_cargo.rs` for the yarn classic + berry lock
+//! flavors. Vendoring an npm purl over a LIVE hosted redirect must run the
+//! cross-mode pre-revert, or it would:
+//!   (a) record the HOSTED patch.socket.dev lock fragment as the vendor
 //!       ledger's unrecoverable pre-vendor "original" (not the pristine
 //!       registry fragment),
-//!   (b) left the redirect ledger's records + edits in place forever, so the
+//!   (b) leave the redirect ledger's records + edits in place forever, so the
 //!       `vendor_supersedes_redirect` warning's promised auto-reconcile never
-//!       converged, and
-//!   (c) made `vendor --revert` land back on the (grant-tokenized, expiring)
+//!       converges, and
+//!   (c) make `vendor --revert` land back on the (grant-tokenized, expiring)
 //!       hosted wiring with no CLI path back to registry state.
 //!
 //! Each scenario drives the REAL binary against a real `corepack yarn`
diff --git a/crates/socket-patch-cli/tests/output_helpers_e2e.rs b/crates/socket-patch-cli/tests/output_helpers_e2e.rs
index 263d156e..2b22d6af 100644
--- a/crates/socket-patch-cli/tests/output_helpers_e2e.rs
+++ b/crates/socket-patch-cli/tests/output_helpers_e2e.rs
@@ -1,6 +1,6 @@
 //! Integration coverage for the `socket_patch_cli::ui` color helpers.
 //! The pub `severity` and `paint` functions are widely used
-//! by `commands/scan.rs` + `commands/list.rs` for human-mode display,
+//! by `commands/scan/` (render.rs + mod.rs) + `commands/list.rs` for human-mode display,
 //! but the integration test suite runs all its scan/list tests in
 //! `--json` mode (which suppresses the colour wrappers entirely), so
 //! every ANSI branch was uncovered. These tests drive each branch
diff --git a/crates/socket-patch-cli/tests/remove_duality_invariants.rs b/crates/socket-patch-cli/tests/remove_duality_invariants.rs
index 41baadd2..ef7ecdf2 100644
--- a/crates/socket-patch-cli/tests/remove_duality_invariants.rs
+++ b/crates/socket-patch-cli/tests/remove_duality_invariants.rs
@@ -9,16 +9,9 @@
 //! offline: every fixture is hand-written camelCase JSON plus blobs staged
 //! under `.socket/blobs`, and every wet run passes `--offline`.
 //!
-//! DISCREPANCY PINS (implementation is the source of truth):
-//! CLI_CONTRACT.md ("remove unwinds hosted redirects (v5.0)") promises "a
-//! hosted-only match works with no manifest at all (mirroring the
-//! detached-vendored escape)". The implementation does NOT deliver that:
-//! `remove.rs`'s manifest-missing gate recognizes the hosted-only match and
-//! proceeds, but the `matching.is_empty()` branch afterwards knows only the
-//! detached-vendored escape and falls through to `not_found` (exit 1)
-//! without ever reaching the hosted leg. The two `*_pins_not_found` tests
-//! below pin that ACTUAL behavior; the hosted leg itself is reachable (and
-//! covered here) only when the identifier also matches a manifest entry.
+//! The hosted leg is covered on both paths: through a manifest entry, and
+//! manifest-less via `remove_hosted_only` (CLI_CONTRACT.md: "a hosted-only
+//! match works with no manifest at all").
 
 use std::path::{Path, PathBuf};
 
@@ -616,7 +609,7 @@ fn hosted_only_remove_without_manifest_unwinds_redirect() {
     );
 }
 
-/// The hosted leg where it IS reachable: the identifier matches a manifest
+/// The hosted leg on the manifest path: the identifier matches a manifest
 /// entry AND the redirect ledger's record for the same purl. The remove
 /// unwinds the redirect (per-purl npm revert): the lock entry gets its
 /// original resolved/integrity back byte-exactly, the emptied ledger is
@@ -725,8 +718,8 @@ fn gem_plus_npm_ledger_text() -> String {
     )
 }
 
-/// With a manifest entry for the gem purl (the only way the hosted leg is
-/// reachable — see the module docs), the unsupported-ecosystem hosted
+/// With a manifest entry for the gem purl (the manifest path; the
+/// manifest-less twin is below), the unsupported-ecosystem hosted
 /// target fails closed BEFORE the manifest mutation: exit 1, top-level
 /// `hosted_revert_unsupported`, and BOTH stores byte-identical.
 #[test]
diff --git a/crates/socket-patch-cli/tests/remove_invariants.rs b/crates/socket-patch-cli/tests/remove_invariants.rs
index 47e3700e..33ff8559 100644
--- a/crates/socket-patch-cli/tests/remove_invariants.rs
+++ b/crates/socket-patch-cli/tests/remove_invariants.rs
@@ -1,9 +1,9 @@
 //! Integration tests for `remove` against pre-populated manifests.
 //!
 //! `remove` runs rollback internally before deleting from the manifest.
-//! These tests pass `--skip-rollback` so they don't try to walk
-//! node_modules — every code path here is testable without network or
-//! installed packages.
+//! Most tests use the `run_remove` helper, which passes `--skip-rollback`;
+//! the rest drive the real rollback path offline against installed
+//! fixtures.
 
 use std::path::{Path, PathBuf};
 
@@ -163,9 +163,8 @@ fn remove_with_invalid_manifest_emits_error() {
     // A manifest that EXISTS but cannot be parsed is `manifest_invalid` per
     // the CLI_CONTRACT.md error-code table — distinct from both
     // `manifest_not_found` (missing file) and `manifest_unreadable` (genuine
-    // I/O error). Regression: remove labeled every read error
-    // `manifest_unreadable`, telling consumers a corrupt file was a
-    // transient I/O failure (list shares the split and was fixed first).
+    // I/O error) — a corrupt file must not read as a transient I/O failure
+    // (list shares the split).
     assert_eq!(
         v["error"]["code"], "manifest_invalid",
         "unparseable manifest must be manifest_invalid; envelope: {v}"
@@ -321,7 +320,7 @@ fn remove_event_has_required_envelope_fields() {
 // Real rollback path (no --skip-rollback)
 // ---------------------------------------------------------------------------
 
-/// Every other test passes `--skip-rollback`, which bypasses the
+/// The `run_remove` helper passes `--skip-rollback`, which bypasses the
 /// rollback-before-remove step that `remove` runs by default. That makes the
 /// suite blind to the actual contract: if the internal rollback fails, the
 /// manifest entry must NOT be deleted (fail-closed — never drop a patch from
@@ -402,7 +401,7 @@ fn remove_without_skip_rollback_fails_closed_and_keeps_manifest() {
 /// `details.rolledBack`. That carrier is metadata — NOT a removed manifest
 /// entry — so it must never bump `summary.removed`.
 ///
-/// Every other test passes `--skip-rollback` against a manifest whose afterHash
+/// The `run_remove` helper passes `--skip-rollback` against a manifest whose afterHash
 /// blobs aren't present on disk, so the cleanup phase sweeps nothing and the
 /// carrier never fires — leaving this path completely uncovered. Here we stage
 /// both patches' afterHash blobs in `.socket/blobs`, remove A, and force a
@@ -985,9 +984,8 @@ fn remove_skip_rollback_sweep_semantics_unchanged() {
 }
 
 /// The full-path preview (no --skip-rollback) must not create `.socket/blobs`
-/// either: rollback's preview previously `create_dir_all`'d it (and, online,
-/// downloaded before-blobs into it) — leaving new files a wet remove's sweep
-/// would have deleted. Offline keeps this hermetic: the preview reports the
+/// either (nor, online, download before-blobs into it) — that would leave
+/// new files a wet remove's sweep would have deleted. Offline keeps this hermetic: the preview reports the
 /// missing-blob failure (accurate — a wet offline run fails the same way)
 /// without inventing directories.
 ///
diff --git a/crates/socket-patch-cli/tests/remove_network.rs b/crates/socket-patch-cli/tests/remove_network.rs
index 5c22d684..d069cf72 100644
--- a/crates/socket-patch-cli/tests/remove_network.rs
+++ b/crates/socket-patch-cli/tests/remove_network.rs
@@ -4,18 +4,17 @@
 //! rollback fetches any missing `beforeHash` blobs from the API. Two
 //! contractual behaviours are exercised here against a wiremock server:
 //!
-//!   1. **online (default):** a missing `beforeHash` blob is downloaded,
-//!      rollback succeeds (no package installed → nothing to restore),
-//!      and the manifest entry is dropped.
+//!   1. **online (default):** with the package installed at its patched
+//!      bytes, the missing `beforeHash` blob is downloaded, rollback
+//!      restores the original file, and the manifest entry is dropped.
 //!   2. **`--offline`:** the strict-airgap contract ("never contact the
 //!      network on *any* command") must hold. With a missing blob,
 //!      `remove --offline` must refuse to roll back rather than reach out,
 //!      and therefore must leave the manifest entry intact.
 //!
-//! Regression guard: `remove` previously hard-coded `offline = false`
-//! when delegating to `rollback_patches`, so `--offline` was silently
-//! ignored — the binary would contact the mock, succeed, and delete the
-//! entry. Test (2) fails loudly if that bug returns.
+//! Test (2) fails loudly if `remove` stops forwarding `--offline` to
+//! `rollback_patches` (the binary would contact the mock, succeed, and
+//! delete the entry).
 
 use std::path::{Path, PathBuf};
 use std::process::Command;
diff --git a/crates/socket-patch-cli/tests/repair_invariants.rs b/crates/socket-patch-cli/tests/repair_invariants.rs
index 86af601a..3588eadd 100644
--- a/crates/socket-patch-cli/tests/repair_invariants.rs
+++ b/crates/socket-patch-cli/tests/repair_invariants.rs
@@ -1,11 +1,8 @@
 //! Integration tests for `repair` / `gc` against pre-populated `.socket/`
-//! fixtures. These run fully offline (`--offline` flag), so they exercise
-//! the cleanup paths — manifest read, orphan-blob detection, archive
-//! cleanup, dry-run preview, JSON envelope output — without needing the
-//! Socket API.
-//!
-//! Network-dependent paths (the fetch arm of `repair` when run without
-//! `--offline`) stay in the `#[ignore]`'d e2e suite.
+//! fixtures. Most tests run fully offline (`--offline`), exercising the
+//! cleanup paths — manifest read, orphan-blob detection, archive cleanup,
+//! dry-run preview, JSON envelope output; the online fetch arm is covered
+//! against a wiremock API (see "Online fetch path" below).
 
 use std::path::{Path, PathBuf};
 use std::process::Command;
@@ -567,8 +564,7 @@ fn repair_cleanup_failure_is_reported_in_json_and_silent_modes() {
 //
 // Every mutating command's lock guard reclaims a leftover `apply.lock` in
 // place and removes it (plus an otherwise-empty `.socket/`) when it drops;
-// repair — the historical home of the old `unlock --release` fold-in — is
-// where that contract is pinned.
+// that contract is pinned here.
 // ---------------------------------------------------------------------------
 
 /// Take an exclusive flock on the binary's lock file path (the same
diff --git a/crates/socket-patch-cli/tests/repair_vendor_e2e.rs b/crates/socket-patch-cli/tests/repair_vendor_e2e.rs
index 9b5e77dd..e942d2c3 100644
--- a/crates/socket-patch-cli/tests/repair_vendor_e2e.rs
+++ b/crates/socket-patch-cli/tests/repair_vendor_e2e.rs
@@ -1675,8 +1675,8 @@ async fn revert_of_empty_wiring_gem_entry_fails_loudly() {
 ///     LEDGERED gem entry whose wiring is empty (pre-reconstruction repairs
 ///     persisted exactly these) gets full revert-capable wiring backfilled
 ///     from the live pair while the artifact is healthy — byte-identical to
-///     the original ledger for the exact-pin fixture — and the revert that
-///     used to refuse (G2) byte-restores both files. RED without the pass-1
+///     the original ledger for the exact-pin fixture — and the revert
+///     byte-restores both files. RED without the pass-1
 ///     backfill: repair exits 0 leaving `"wiring": []`, no wiringRestored
 ///     event, and the revert fails.
 #[tokio::test]
diff --git a/crates/socket-patch-cli/tests/repair_vendor_flavors_e2e.rs b/crates/socket-patch-cli/tests/repair_vendor_flavors_e2e.rs
index 080dab93..e5ad4ddf 100644
--- a/crates/socket-patch-cli/tests/repair_vendor_flavors_e2e.rs
+++ b/crates/socket-patch-cli/tests/repair_vendor_flavors_e2e.rs
@@ -69,8 +69,7 @@ enum Flavor {
 /// gate refuses a FRESH vendor into a pre-v2 workspace lock, while `repair`
 /// (and in-sync re-runs) on a lock that ALREADY carries the vendored tuple
 /// must keep working — a project vendored before it grew a workspace member
-/// used to be refused every maintenance verb, with `repair` leaving the lock
-/// pointing at a tarball it declined to rebuild.
+/// must not be refused every maintenance verb.
 #[derive(Clone, Copy)]
 struct BunLock {
     version: u64,
@@ -849,11 +848,9 @@ async fn repair_reconstructs_pnpm_ledger_from_lockfile() {
 // Empirically confirmed brick (real pnpm@10.34.5 project, 2026-08-18): after
 // `repair` reconstructs a ledger-gone vendored entry from the lockfile, the
 // entry carries EMPTY wiring (npm-family pre-vendor lock fragments are not
-// offline-recoverable). A subsequent `vendor --revert` used to exit 0 with a
-// bare {"action":"removed"} event — zero warnings — while DELETING the
-// vendored tarball pnpm-lock.yaml still resolves through in several places;
-// every later `pnpm install` then fails ENOENT on the missing file: tarball.
-// The npm-family backends now fail closed
+// offline-recoverable). Deleting the vendored tarball pnpm-lock.yaml still
+// resolves through would make every later `pnpm install` fail ENOENT, so a
+// subsequent `vendor --revert` on the npm-family backends fails closed
 // (`vendor_wiring_unknown_revert_blocked`) when there is nothing to replay
 // and the lock still references the artifact, and still remove genuinely
 // orphaned artifacts once the lock no longer does. `repair`'s reconstruction
diff --git a/crates/socket-patch-cli/tests/rollback_invariants.rs b/crates/socket-patch-cli/tests/rollback_invariants.rs
index 676b8509..1cba3538 100644
--- a/crates/socket-patch-cli/tests/rollback_invariants.rs
+++ b/crates/socket-patch-cli/tests/rollback_invariants.rs
@@ -1,9 +1,8 @@
-//! Integration tests for `rollback` paths that don't require network or
-//! installed packages — same shape as `apply_invariants.rs` for apply.
-//!
-//! The network-dependent paths (downloading missing `beforeHash` blobs)
-//! and the actual disk-mutation paths (rolling back a real installed
-//! package) stay in the `#[ignore]`'d e2e suite.
+//! Integration tests for `rollback` driven through the built binary against
+//! hand-written manifests: error paths, the offline/online before-blob gate,
+//! not-installed entries, the JSON shape, and real restores of fake
+//! installed packages. Nothing reaches a real registry; network cases hit an
+//! unroutable localhost port.
 
 use std::path::{Path, PathBuf};
 use std::process::Command;
@@ -203,11 +202,11 @@ fn truthy_one_off_env_var_sets_flag() {
     );
 }
 
-/// Regression: an exported-but-empty `SOCKET_ONE_OFF=` — the shell/CI idiom
-/// for blanking a variable without unsetting it — must mean "unset, fall back
-/// to false", not abort the run. (This flag is outside `GLOBAL_ARG_ENV_VARS`,
-/// so `main`'s empty-var scrub never rescues it; the parser itself must
-/// tolerate the empty string.) With one-off correctly off, a manifest-less
+/// An exported-but-empty `SOCKET_ONE_OFF=` — the shell/CI idiom for
+/// blanking a variable without unsetting it — must mean "unset, fall back to
+/// false", not abort the run. (`SOCKET_ONE_OFF` is in `LOCAL_ARG_ENV_VARS`,
+/// so `main`'s empty-var scrub removes it before clap parses;
+/// `parse_bool_flag` also treats an empty string as false.) With one-off correctly off, a manifest-less
 /// rollback reaches the normal "Manifest not found" error.
 #[test]
 fn empty_one_off_env_var_parses_as_false_not_crash() {
@@ -287,11 +286,10 @@ fn rollback_offline_with_missing_before_blob_partial_failure() {
     // means we won't fetch. Rollback must fail out before touching
     // anything — and the JSON envelope must SAY so. The bail fires before
     // the rollback loop produces any per-package results, so the failures
-    // are synthesized: before the fix the envelope claimed `failed: 0`
-    // with empty `results[]` on an exit-1 run, and `--json` mutes the
-    // stderr explanation, leaving machine consumers zero diagnostic.
-    // (Installing the package matters since the gate reorder: an entry
-    // with no installed package never enters the blob plan — see
+    // are synthesized — `--json` mutes the stderr explanation, so an
+    // envelope claiming `failed: 0` with empty `results[]` would leave
+    // machine consumers zero diagnostic. (The package is installed because
+    // an entry with no installed package never enters the blob plan — see
     // `rollback_only_not_installed_entry_is_never_blob_gated`.)
     let tmp = tempfile::tempdir().expect("tempdir");
     make_socket_dir(tmp.path());
@@ -775,7 +773,7 @@ fn rollback_json_shape_has_documented_keys() {
     // These keys are documented in CLI_CONTRACT.md as the rollback shape
     // (not yet migrated to the unified envelope). Pin them so a future
     // migration trips this test instead of breaking wrappers silently.
-    // The v4 duality rework added the always-present additive keys from
+    // The v5.0 duality rework added the always-present additive keys from
     // `vendored` onward (vendoredReverted/vendoredPreserved/vendoredKept,
     // hosted, manifest, gc, paths).
     for key in [
@@ -819,10 +817,6 @@ fn rollback_json_shape_has_documented_keys() {
     );
 }
 
-// ---------------------------------------------------------------------------
-// Manifest-path override
-// ---------------------------------------------------------------------------
-
 // ---------------------------------------------------------------------------
 // Real rollback against an installed package
 // ---------------------------------------------------------------------------
@@ -1143,6 +1137,10 @@ fn rollback_dry_run_does_not_modify_file() {
     assert_eq!(content, after, "dry-run must not modify the installed file");
 }
 
+// ---------------------------------------------------------------------------
+// Manifest-path override
+// ---------------------------------------------------------------------------
+
 #[test]
 fn rollback_honors_manifest_path_override() {
     let tmp = tempfile::tempdir().expect("tempdir");
diff --git a/crates/socket-patch-cli/tests/rollback_multicopy_blob_gate.rs b/crates/socket-patch-cli/tests/rollback_multicopy_blob_gate.rs
index 248ec933..1ac5dbca 100644
--- a/crates/socket-patch-cli/tests/rollback_multicopy_blob_gate.rs
+++ b/crates/socket-patch-cli/tests/rollback_multicopy_blob_gate.rs
@@ -191,11 +191,10 @@ fn rollback_cmd(cwd: &Path) -> Command {
     cmd
 }
 
-/// THE regression: an online rollback must download a before-blob that only
-/// a NESTED duplicate copy needs. The gate used to verify the root copy
-/// alone — already original, so "no blob needed" — skip the download, and
-/// the loop then failed the nested copy with `MissingBlob` while it stayed
-/// patched. Retrying could never succeed.
+/// An online rollback must download a before-blob that only a NESTED
+/// duplicate copy needs. A gate that verified the root copy alone (already
+/// original, so "no blob needed") would skip the download and fail the
+/// nested copy with `MissingBlob` while it stayed patched, forever.
 #[test]
 fn rollback_downloads_blob_needed_only_by_nested_duplicate_copy() {
     let tmp = tempfile::tempdir().unwrap();
diff --git a/crates/socket-patch-cli/tests/scan_ecosystems_scope_e2e.rs b/crates/socket-patch-cli/tests/scan_ecosystems_scope_e2e.rs
index cca601d4..72501207 100644
--- a/crates/socket-patch-cli/tests/scan_ecosystems_scope_e2e.rs
+++ b/crates/socket-patch-cli/tests/scan_ecosystems_scope_e2e.rs
@@ -7,13 +7,11 @@
 //! the skip itself: `crawl_scope`'s unit test pins the decision and
 //! `ecosystem_dispatch`'s `scoped_crawl_is_the_full_crawl_filtered_to_its_ecosystems`
 //! pins that a scoped crawl never runs the other crawlers. What these pin
-//! is the one output that used to see past the filter, the lockfile-only
-//! count: a selected-ecosystem scan counted the OTHER ecosystems'
-//! uninstalled lockfile entries too. A scoped run cannot tell whether a
-//! skipped ecosystem's entry is installed, so `lockfileOnlyPackages` now
-//! counts the selected ecosystems only. A GC run still crawls everything —
-//! the prune judges every manifest entry against the full installed set —
-//! and keeps the old count (and keeps an installed crate of an unselected
+//! is the lockfile-only count: a scoped run cannot tell whether a skipped
+//! ecosystem's entry is installed, so `lockfileOnlyPackages` counts the
+//! selected ecosystems only. A GC run still crawls everything — the prune
+//! judges every manifest entry against the full installed set — and keeps
+//! the all-ecosystem count (and keeps an installed crate of an unselected
 //! ecosystem out of the prune).
 //!
 //! The fixture: an npm project (one installed package, one lockfile-only)
diff --git a/crates/socket-patch-cli/tests/scan_invariants.rs b/crates/socket-patch-cli/tests/scan_invariants.rs
index 22fd29e2..d0b61f89 100644
--- a/crates/socket-patch-cli/tests/scan_invariants.rs
+++ b/crates/socket-patch-cli/tests/scan_invariants.rs
@@ -985,10 +985,9 @@ async fn scan_handles_api_500_error_gracefully() {
         panic!("scan must emit valid JSON even on API failure; err={e}; stdout={stdout}; stderr={stderr}")
     });
 
-    // CONTRACT (scan.rs:598-600): "If every batch errored, surface this as
-    // a full scan failure rather than silently reporting zero patches
-    // (which historically looked identical to 'no patches for these
-    // packages')." Here there is exactly one package → exactly one batch,
+    // CONTRACT (commands/scan/mod.rs, all-batches-failed bail): "If every
+    // batch errored, surface this as a full scan failure rather than
+    // silently reporting zero patches." Here there is exactly one package → exactly one batch,
     // and it returns 500, so EVERY batch failed. scan must therefore NOT
     // present this as a clean success. A scan that emits status="success"
     // / exit 0 with scannedPackages=1, totalPatches=0 is reporting the
@@ -1258,8 +1257,8 @@ async fn scan_prune_removes_withdrawn_patch_entry() {
 /// same PURL that's in the manifest, `scan` surfaces that in the
 /// `updates` array even without `--apply`. Sibling to
 /// `scan_emits_updates_entry_when_newer_uuid_available` but exercised
-/// with a stub blob on disk so we pin the read-only behavior: scan
-/// alone never mutates files.
+/// with a stub blob on disk so we pin that scan without `--apply` never
+/// rewrites the manifest or existing blobs.
 #[tokio::test]
 async fn scan_detects_update_without_touching_existing_blobs() {
     const OLD_UUID: &str = "44444444-4444-4444-8444-444444444444";
@@ -1325,7 +1324,7 @@ async fn scan_detects_update_without_touching_existing_blobs() {
     assert_eq!(updates[0]["oldUuid"], OLD_UUID);
     assert_eq!(updates[0]["newUuid"], NEW_UUID);
 
-    // Critical: scan is read-only. The manifest still records the OLD
+    // Scan without --apply never rewrites the manifest or blobs. The manifest still records the OLD
     // UUID and the marker blob is byte-for-byte unchanged.
     let manifest: serde_json::Value =
         serde_json::from_str(&std::fs::read_to_string(socket.join("manifest.json")).unwrap())
@@ -1359,7 +1358,8 @@ async fn scan_detects_update_without_touching_existing_blobs() {
 // * `hosted_wiring_retained`: agent-mode scan over a live hosted redirect
 //   (lockfile still pinned to the patch server + redirect ledger records
 //   live) applies in place and reports success with zero hint that the
-//   hosted wiring was NOT unwound (no hosted revert exists for npm/yarn).
+//   hosted wiring was NOT unwound (an agent run does not unwind hosted
+//   wiring; `rollback` or `scan --mode vendored` does).
 
 const AGENT_WARN_UUID: &str = "33333333-3333-4333-8333-333333333333";
 
@@ -1671,15 +1671,12 @@ async fn scan_agent_hosted_warning_silent_when_lock_is_registry_clean() {
 }
 
 // ---------------------------------------------------------------------------
-// Read-only cross-mode visibility — the `redirectState` envelope block
+// Report-only cross-mode visibility — the `redirectState` envelope block
 // ---------------------------------------------------------------------------
 //
 // The `hosted_wiring_retained` warning above only rides the AGENT-mode
-// envelope, and report-only `scan --json` (the documented read-only state
-// probe) said nothing at all about a live hosted redirect: a hosted-wired
-// project's `scan --json` was byte-identical to a never-touched project's
-// (verified against production on bundler 1.17/2.7/4.0 — the gem live-matrix
-// D3 defect). These pin the additive top-level `redirectState` block: the
+// envelope; a report-only scan (`scan --prune` or a global scan with no
+// mode) must still say something about a live hosted redirect. These pin the additive top-level `redirectState` block: the
 // redirect ledger's records (project STATE, not an anomaly — so a block, not
 // a warning) plus the scanned purls whose hosted lockfile wiring the live
 // lock still proves.
@@ -1954,9 +1951,9 @@ async fn hosted_mode_envelopes_omit_redirect_state() {
 /// Vendored-mode envelopes never carry `redirectState` either: the vendored
 /// takeover reconciliation may retire ledger records mid-run (the
 /// `vendor_supersedes_redirect` warning covers that state), so a pre-run
-/// snapshot would go stale. The zero-discovery leg is the regression pin —
-/// the early-return used to gate the block on `!hosted` alone, leaking it
-/// into `scan --mode vendored --json` over an empty crawl.
+/// snapshot would go stale. The zero-discovery leg pins that the
+/// early-return does not leak the block into `scan --mode vendored --json`
+/// over an empty crawl.
 #[tokio::test]
 async fn vendored_mode_envelopes_omit_redirect_state() {
     let mock = MockServer::start().await;
diff --git a/crates/socket-patch-cli/tests/scan_paths_e2e.rs b/crates/socket-patch-cli/tests/scan_paths_e2e.rs
index d338ccf8..159b7394 100644
--- a/crates/socket-patch-cli/tests/scan_paths_e2e.rs
+++ b/crates/socket-patch-cli/tests/scan_paths_e2e.rs
@@ -3,7 +3,8 @@
 //!
 //! Spawns the real `socket-patch` binary (same recipe as
 //! `scan_invariants.rs`, with `rollback_invariants.rs`'s SOCKET_* env
-//! scrub) and pins the CONTRACT of path-scoped scans:
+//! scrub) and pins the CONTRACT of path-scoped scans (the scoping bullets
+//! describe agent mode, where PATHS are installed-path globs):
 //!
 //! * scoping narrows the API QUERY (batch-POST body oracle) and the
 //!   envelope counters, echoing the patterns in an always-present `paths`
@@ -14,8 +15,9 @@
 //! * an empty match is a normal empty scan (exit 0, no GC, no API calls);
 //! * lockfile-only supplements are excluded from a scoped scan with the
 //!   `path_scope_excluded_supplements` run-level warning;
-//! * PATHS with `--mode hosted`/`--mode vendored`, and unparseable globs,
-//!   are usage errors (exit 2).
+//! * in hosted/vendored mode (including a bare scan) PATHS are project
+//!   directories: a PATH that is not a directory, more than one directory
+//!   under `--json`, or an unparseable glob is a usage error (exit 2).
 
 use std::path::{Path, PathBuf};
 use std::process::Command;
@@ -536,7 +538,8 @@ async fn supplements_excluded_with_warning() {
 }
 
 // ---------------------------------------------------------------------------
-// 5. Usage errors: PATHS with hosted/vendored modes, and invalid globs.
+// 5. Usage errors: non-directory PATHs in hosted/vendored mode, >1 directory
+//    under --json, and invalid globs.
 // ---------------------------------------------------------------------------
 
 #[tokio::test]
diff --git a/crates/socket-patch-cli/tests/scan_sync_e2e.rs b/crates/socket-patch-cli/tests/scan_sync_e2e.rs
index 8aba1a8f..8dccae2c 100644
--- a/crates/socket-patch-cli/tests/scan_sync_e2e.rs
+++ b/crates/socket-patch-cli/tests/scan_sync_e2e.rs
@@ -152,7 +152,7 @@ async fn scan_sync_against_clean_project_adds_and_applies_patch() {
     let status = v["status"].as_str().expect("status string");
     // A clean apply against a pristine fixture MUST fully succeed. Accepting
     // "partial_failure" here would mask the apply step silently failing
-    // (`scan.rs` flips status to partial_failure exactly when apply_code != 0).
+    // (`commands/scan/mod.rs` flips status to partial_failure exactly when apply_code != 0).
     assert_eq!(
         status, "success",
         "scan --sync against a clean project must fully succeed; envelope={v}"
diff --git a/crates/socket-patch-cli/tests/scan_vendor_e2e.rs b/crates/socket-patch-cli/tests/scan_vendor_e2e.rs
index cba19720..2926892d 100644
--- a/crates/socket-patch-cli/tests/scan_vendor_e2e.rs
+++ b/crates/socket-patch-cli/tests/scan_vendor_e2e.rs
@@ -1030,11 +1030,10 @@ async fn scan_vendor_resolves_percent_encoded_scoped_purl() {
 /// 1. The wired lock entry VANISHED (an uninstall is one drift flavor —
 ///    the live lock no longer matches anything the wiring recorded), so
 ///    the backend revert keeps the artifacts (`RevertOutcome::
-///    kept_artifact`, residual #131) and the GC must keep the ledger entry
-///    too — pre-fix it pruned the ledger, reported the purl in
-///    `revertedVendoredEntries`, and the orphan sweep then destroyed the
-///    kept artifacts (with the recorded pre-vendor originals, the state a
-///    later `git checkout` of the vendored lock still points at).
+///    kept_artifact`) and the GC must keep the ledger entry too — pruning
+///    it would let the orphan sweep destroy the kept artifacts (with the
+///    recorded pre-vendor originals, the state a later `git checkout` of
+///    the vendored lock still points at).
 /// 2. Undoing the drift (restoring the pre-vendor registry lock — the
 ///    keep warning's documented remediation) converges every recorded
 ///    fragment, and the same prune then reverts fully: ledger entry
@@ -1176,8 +1175,8 @@ async fn scan_prune_reverts_unused_vendored_entry() {
 }
 
 /// Interactive (non-JSON) `scan --vendor` pre-verifies patch baselines:
-/// installed content matching NEITHER hash is annotated BEFORE the
-/// confirm prompt, and the run still vendors (auto-force) with the
+/// installed content matching NEITHER hash is annotated before vendoring
+/// starts, and the run still vendors (auto-force) with the
 /// `vendor_content_mismatch_overwritten` warning on stderr.
 #[tokio::test]
 async fn scan_vendor_annotates_mismatched_baseline_and_vendors_anyway() {
@@ -1558,8 +1557,8 @@ async fn scan_vendor_works_on_a_completely_fresh_clone() {
     assert_socket_dir_lean(tmp.path());
 }
 
-/// Read-only discovery flags lockfile-only packages in JSON and the human
-/// table.
+/// A bare (hosted-mode) scan flags lockfile-only packages in JSON and the
+/// human table.
 #[tokio::test]
 async fn scan_discovers_lockfile_only_packages_with_warning() {
     let mock = MockServer::start().await;
@@ -1888,9 +1887,8 @@ async fn scan_vendored_bun_v1_workspace_refuses_in_download_phase() {
     );
 }
 
-/// The `--detached` twin refuses BEFORE any fetch too (it used to fetch the
-/// view and only fail in the vendor step): same record, zero downloads,
-/// and — detached — no manifest at all.
+/// The `--detached` (no-op) twin refuses BEFORE any fetch too: same record,
+/// zero downloads, and no manifest at all.
 #[tokio::test]
 async fn scan_vendored_bun_detached_refuses_before_fetch() {
     let mock = MockServer::start().await;
@@ -2287,8 +2285,7 @@ mod exact_download_plan {
     /// A pnpm 9 project with three installed, patched packages. `pkg-b`'s
     /// snapshot key carries a peer suffix (`1.0.0(peer-x@1.0.0)`), which
     /// the pnpm backend refuses as `vendor_lock_entry_unsupported` before
-    /// staging anything — the shape behind two of the three speculative
-    /// grants the plan used to issue on depscan.
+    /// staging anything, so the plan must not issue it a speculative grant.
     fn write_pnpm_fixture(root: &Path) {
         std::fs::write(
             root.join("package.json"),
diff --git a/crates/socket-patch-cli/tests/self_update_e2e.rs b/crates/socket-patch-cli/tests/self_update_e2e.rs
index 0b34305d..61d40e8a 100644
--- a/crates/socket-patch-cli/tests/self_update_e2e.rs
+++ b/crates/socket-patch-cli/tests/self_update_e2e.rs
@@ -236,9 +236,9 @@ async fn update_dry_run_checks_without_downloading() {
 }
 
 /// `--dry-run` on an ALREADY-CURRENT install still reports through the
-/// verified/update_check probe shape (`updateAvailable: false`) — review
-/// regression: it used to fall into the skipped/already_latest path,
-/// breaking scripts that branch on the documented probe fields.
+/// verified/update_check probe shape (`updateAvailable: false`), not the
+/// skipped/already_latest path, so scripts can branch on the documented
+/// probe fields.
 #[tokio::test]
 async fn update_dry_run_up_to_date_still_reports_probe_shape() {
     let install = staged_install();
diff --git a/crates/socket-patch-cli/tests/setup_contract_gaps.rs b/crates/socket-patch-cli/tests/setup_contract_gaps.rs
index 00a3fa25..c314af77 100644
--- a/crates/socket-patch-cli/tests/setup_contract_gaps.rs
+++ b/crates/socket-patch-cli/tests/setup_contract_gaps.rs
@@ -179,7 +179,7 @@ fn setup_check_detects_unapplied_manifest_patch() {
 // re-materializes it from the artifact; go redirects leave the module cache
 // pristine forever), and a patched-looking installed tree must not launder a
 // tampered artifact. `vex` builds that vendor context
-// (commands/vex.rs::load_vendor_context); `setup --check` must too — without
+// (commands/vex.rs::vendor_context_from); `setup --check` must too — without
 // it a healthy vendored repo false-fails `--check` with `not_applied`, and a
 // tampered artifact passes.
 // ===========================================================================
diff --git a/crates/socket-patch-cli/tests/setup_invariants.rs b/crates/socket-patch-cli/tests/setup_invariants.rs
index c0a6ba20..a69f945a 100644
--- a/crates/socket-patch-cli/tests/setup_invariants.rs
+++ b/crates/socket-patch-cli/tests/setup_invariants.rs
@@ -367,9 +367,9 @@ fn setup_yes_json_files_entry_has_expected_keys() {
 // ---------------------------------------------------------------------------
 // Error handling — a malformed package.json must NOT be reported as success.
 //
-// Regression: when nothing was updatable but a file errored (e.g. invalid
-// JSON), `setup` used to emit `status: "already_configured"` with exit 0,
-// masking the failure. A parse error must surface as a non-zero exit.
+// When nothing was updatable but a file errored (e.g. invalid JSON), `setup`
+// must not emit `status: "already_configured"` with exit 0; a parse error
+// must surface as a non-zero exit.
 // ---------------------------------------------------------------------------
 
 #[test]
@@ -718,14 +718,11 @@ fn setup_remove_nothing_to_remove_exits_zero() {
     assert_eq!(v["removed"], 0);
 }
 
-// Regression: in human (non-JSON) mode `setup --remove` ends with
+// In human (non-JSON) mode `setup --remove` ends with
 // "Nothing removed; N item(s) could not be processed (see errors above)."
-// when a manifest fails to parse, but `print_remove_preview` printed NO error
-// section at all — so "(see errors above)" pointed at nothing and the user
-// never saw *why* the file could not be processed. The preview must surface the
-// per-file error so the message is truthful. (The companion setup-path check is
-// `setup_malformed_does_not_claim_already_configured_in_human_mode`; this guards
-// the remove path, whose preview previously had no error branch whatsoever.)
+// when a manifest fails to parse, so `print_remove_preview` must surface the
+// per-file error for that message to be truthful. (The companion setup-path
+// check is `setup_malformed_does_not_claim_already_configured_in_human_mode`.)
 #[test]
 fn remove_human_mode_surfaces_unprocessable_file_error() {
     let tmp = tempfile::tempdir().expect("tempdir");
diff --git a/crates/socket-patch-cli/tests/setup_matrix_common/mod.rs b/crates/socket-patch-cli/tests/setup_matrix_common/mod.rs
index c04c4c98..d12f572d 100644
--- a/crates/socket-patch-cli/tests/setup_matrix_common/mod.rs
+++ b/crates/socket-patch-cli/tests/setup_matrix_common/mod.rs
@@ -139,17 +139,18 @@ pub struct Case {
 }
 
 impl Case {
-    /// Baseline (currently-known) outcome under today's code:
-    /// `setup` only wires npm-family hooks, so applied is expected only
-    /// when the target advertises `baseline_supported` AND the scenario
+    /// Baseline outcome: applied is expected only when the target
+    /// advertises `baseline_supported` (the PMs whose install hook `setup`
+    /// wires: npm family, pip/uv/hatch, bundler, composer) AND the scenario
     /// aspires to apply.
     fn baseline_applied(&self) -> bool {
         self.expect_applied && self.baseline_supported
     }
 
     /// npm-family package managers (plus the polyglot monorepo's npm slice)
-    /// are the surface `setup` actually configures today — the only cases
-    /// where the check/remove round-trip is expected to do real work.
+    /// are the cases where the driver runs the check/remove round-trip;
+    /// other supported ecosystems (pypi, gem, composer) are round-tripped by
+    /// their host_guard tests instead.
     fn is_npm_family(&self) -> bool {
         matches!(self.pm.as_str(), "npm" | "yarn" | "pnpm" | "bun" | "vlt")
             || self.layout == "monorepo"
@@ -503,9 +504,8 @@ fn run_cases(label: &str, cases: Vec<Case>) {
         }
 
         // check/remove round-trip — only asserted for npm-family cases that
-        // ran setup (the surface setup configures today). For other
-        // ecosystems setup writes nothing, so the round-trip is a no-op and
-        // we leave it untagged, consistent with the BASELINE GAP convention.
+        // ran setup. Other ecosystems either have no setup hook (no-op) or
+        // are round-tripped by their own host_guard tests.
         if case.run_setup && case.is_npm_family() && !case.known_regression {
             if let Some(msg) = round_trip_failure(case, &res) {
                 failures.push(msg);
diff --git a/crates/socket-patch-cli/tests/setup_matrix_composer.rs b/crates/socket-patch-cli/tests/setup_matrix_composer.rs
index 1ef19367..74c0dd81 100644
--- a/crates/socket-patch-cli/tests/setup_matrix_composer.rs
+++ b/crates/socket-patch-cli/tests/setup_matrix_composer.rs
@@ -94,8 +94,8 @@ mod host_guard {
 
     /// Assert composer.json is byte-for-byte what we wrote, AND that the
     /// project directory still contains *only* composer.json. The directory
-    /// check is the real teeth: a clean no-op for an unsupported ecosystem
-    /// must create NOTHING — not an npm `package.json` hook, not a `.socket/`
+    /// check is the real teeth: after `--remove` the project must hold
+    /// NOTHING else — not an npm `package.json` hook, not a `.socket/`
     /// dir, not a lockfile, not a `.pth`, nothing. Probing for one specific
     /// filename (`package.json`) would let any other foreign artifact through.
     fn assert_manifest_pristine(root: &Path, who: &str) {
@@ -120,8 +120,7 @@ mod host_guard {
     /// ecosystem: `setup` wires `socket-patch apply` into `composer.json`'s
     /// post-install/post-update script events, `--check` reflects it, and
     /// `--remove` restores the manifest byte-for-byte. Non-skippable (no Docker,
-    /// no PHP toolchain) — it edits composer.json directly. This is the positive
-    /// twin of `composer_setup_is_a_clean_noop_host` (the two never co-exist).
+    /// no PHP toolchain) — it edits composer.json directly.
     #[test]
     fn composer_setup_round_trips_host() {
         let tmp = tempfile::tempdir().unwrap();
@@ -223,8 +222,8 @@ mod host_guard {
     }
 
     /// The hook `setup` wires into a MANIFEST-LESS hosted / vendored
-    /// checkout (a depscan-opened PR, a `vendor --detached` or `scan
-    /// --redirect` project: the patches live in composer.lock, no
+    /// checkout (a depscan-opened PR, a `scan --mode vendored` or `scan
+    /// --mode hosted` project: the patches live in composer.lock, no
     /// `.socket/manifest.json`, no ledger). composer runs the hook after
     /// every install, so it must be a silent, write-free exit 0 there — and
     /// the same `apply` with `--vex` must attest the lockfile-wired patch
diff --git a/crates/socket-patch-cli/tests/setup_matrix_deno.rs b/crates/socket-patch-cli/tests/setup_matrix_deno.rs
index 60cf4bbb..7c70beb7 100644
--- a/crates/socket-patch-cli/tests/setup_matrix_deno.rs
+++ b/crates/socket-patch-cli/tests/setup_matrix_deno.rs
@@ -50,10 +50,11 @@ mod vex_e2e_common;
 #[test]
 #[serial_test::serial]
 // Experimental ecosystem (deno): the setup-matrix aspirational cases are a
-// BASELINE GAP (setup does not wire deno's install hook yet). This passes on CI
+// BASELINE GAP (setup wires the package.json postinstall, but `deno install`
+// is not known to run it). This passes on CI
 // only because the runners lack the `deno` toolchain (the cases soft-skip); on
 // any host that HAS deno it fails. Ignore it so deno can never block the
-// blocking --all-features jobs. The non-skippable no-op contract is still
+// blocking --all-features jobs. The non-skippable setup round-trip is still
 // guarded by `host_guard` below. Run with `--features setup-e2e -- --ignored`.
 #[ignore = "experimental ecosystem (deno): not gating CI until the deno backend is implemented; run with --ignored"]
 fn deno() {
diff --git a/crates/socket-patch-cli/tests/setup_matrix_gem.rs b/crates/socket-patch-cli/tests/setup_matrix_gem.rs
index 9773fb81..efef1fc6 100644
--- a/crates/socket-patch-cli/tests/setup_matrix_gem.rs
+++ b/crates/socket-patch-cli/tests/setup_matrix_gem.rs
@@ -5,22 +5,18 @@
 //! `bundle install` (digest-gated load-time + per-gem `after-install`
 //! triggers, forced `after-install-all` re-apply).
 //!
-//! The two structural reasons the with-setup Docker cases
-//! (`baseline_with_setup`, `alt_content_patchset`) used to be a
-//! [BASELINE GAP] are both fixed (2026-08-13): (a) the bootstrap deadlock —
-//! installing the plugin evaluates `plugins.rb` BEFORE any project gems land,
-//! and the old load-time `SocketPatch.apply!` treated apply's exit 1 ("No
-//! packages found") as fatal (`Bundler::BundlerError`), killing the FIRST
-//! `bundle install` of every fresh checkout — is gone: the generated plugin
-//! now warns-and-continues on apply failures (`SOCKET_PATCH_STRICT=1`
-//! restores the raise), pinned by [`plugin_runtime`] below; (b) the fixture's
-//! synthetic all-zeros beforeHash — which hash-gated gem apply (no npm-style
-//! mismatch-warn-and-apply path) always rejected — is replaced by the real
+//! The with-setup Docker cases (`baseline_with_setup`, `alt_content_patchset`)
+//! depend on two things: (a) installing the plugin evaluates `plugins.rb`
+//! BEFORE any project gems land, so the generated plugin warns-and-continues
+//! on apply failures (`SOCKET_PATCH_STRICT=1` restores the raise) instead of
+//! killing the FIRST `bundle install` of every fresh checkout — pinned by
+//! [`plugin_runtime`] below; (b) hash-gated gem apply has no npm-style
+//! mismatch-warn-and-apply path, so the fixture's beforeHash is the real
 //! git-blob hash probed from the published .gem (`resolve_before_hash` in
 //! `run-case.sh`, mirroring docker_e2e_gem). NOTE: in Docker mode the matrix
-//! runs the binary BAKED INTO the local image; an image built before this fix
-//! generates the old raising plugin and still red-flags these cases — rebuild
-//! the image (or run with `SOCKET_PATCH_TEST_HOST=1`) to see them pass.
+//! runs the binary BAKED INTO the local image; a stale image generates a
+//! raising plugin and red-flags these cases — rebuild the image (or run with
+//! `SOCKET_PATCH_TEST_HOST=1`).
 //!
 //! IMPORTANT — why this file carries a real assertion of its own:
 //! `smc::run_pm("gem", "bundler")` routes gem through the shared Docker
@@ -1019,8 +1015,7 @@ mod plugin_runtime {
             "the warning must mention the strict escape hatch:\n{err}"
         );
 
-        // A retry is not poisoned either (the old failure mode repeated
-        // identically forever because plugin registration never completed).
+        // A retry is not poisoned either (plugin registration completed).
         let (code, out, err) = bundle_install(root, &fake, &[]);
         assert_eq!(
             code, 0,
@@ -1545,7 +1540,7 @@ mod plugin_runtime {
         out
     }
 
-    /// MANIFEST-LESS vendored checkout (the depscan / `vendor --detached`
+    /// MANIFEST-LESS vendored checkout (the depscan / `scan --mode vendored`
     /// shape: a committed `.socket/vendor/gem/<uuid>/` artifact wired by a
     /// Gemfile `path:`, NO `.socket/manifest.json`) with the setup plugin
     /// wired, driven with the REAL binary as the plugin's apply under
diff --git a/crates/socket-patch-cli/tests/setup_matrix_maven.rs b/crates/socket-patch-cli/tests/setup_matrix_maven.rs
index fbbf1032..55105441 100644
--- a/crates/socket-patch-cli/tests/setup_matrix_maven.rs
+++ b/crates/socket-patch-cli/tests/setup_matrix_maven.rs
@@ -46,12 +46,12 @@ mod vex_e2e_common;
 /// real teeth live in [`host_guard`] below.
 #[test]
 #[serial_test::serial]
-// Experimental ecosystem (maven): aspirational setup-matrix cases are a
-// BASELINE GAP today; this passes on CI only because the runners lack `mvn`
-// (cases soft-skip) and fails on any host that has it. Ignore so maven can
-// never block the blocking --all-features jobs; `host_guard` below still pins
-// the real no-op contract. Run with `--features setup-e2e,maven -- --ignored`.
-#[ignore = "experimental ecosystem (maven): not gating CI until the maven backend is implemented; run with --ignored"]
+// maven's aspirational setup-matrix cases are a BASELINE GAP (no install
+// hook for setup to wire); this passes on CI only because the runners lack
+// `mvn` (cases soft-skip) and fails on any host that has it. Ignore so maven
+// can never block the blocking --all-features jobs; `host_guard` below still
+// pins the real no-op contract. Run with `--features setup-e2e -- --ignored`.
+#[ignore = "BASELINE GAP (maven): no install hook for setup to wire; not gating CI; run with --ignored"]
 fn mvn() {
     smc::run_pm("maven", "mvn");
 }
@@ -101,9 +101,9 @@ mod host_guard {
     /// runs; a (perfectly valid!) ambient `SOCKET_SETUP_EXCLUDE` stands in for
     /// `setup --exclude`, which a real `setup` run PERSISTS — creating
     /// `.socket/manifest.json` inside the maven fixture and failing
-    /// `assert_pristine`. (Safe to set process-wide: the only other test in
-    /// this binary is the `#[ignore]`d matrix pass, which routes through
-    /// `smc::host_driver_command`'s own `SOCKET_*` prefix scrub.)
+    /// `assert_pristine`. (Safe to set process-wide: every other test in this
+    /// binary is `#[serial]` and spawns through this module's
+    /// prefix-scrubbing `run` / `run_vex` or `smc::host_driver_command`.)
     const HOSTILE_DECOYS: &[(&str, &str)] = &[
         ("SOCKET_STRICT", "banana"),
         ("SOCKET_VENDOR_SOURCE", "bogus-decoy"),
diff --git a/crates/socket-patch-cli/tests/setup_matrix_npm.rs b/crates/socket-patch-cli/tests/setup_matrix_npm.rs
index 10109bb9..66d72679 100644
--- a/crates/socket-patch-cli/tests/setup_matrix_npm.rs
+++ b/crates/socket-patch-cli/tests/setup_matrix_npm.rs
@@ -1,7 +1,7 @@
 //! setup-matrix: npm ecosystem (npm / yarn / pnpm / bun / vlt).
 //!
-//! These are the ecosystems `socket-patch setup` actually supports
-//! today (it writes a package.json postinstall hook), so the
+//! `socket-patch setup` supports these package managers (it writes a
+//! package.json postinstall hook), so the
 //! `baseline_with_setup` / `alt_content_patchset` cases are expected to
 //! PASS here. See `setup_matrix_common/mod.rs` for the harness and
 //! `tests/setup_matrix/matrix.json` for the case list.
@@ -80,7 +80,7 @@ fn vlt_workspace() {
 // every `smc::run_pm` / `smc::run_workspace_pm` call above routes through the
 // shared Docker matrix harness, which *soft-skips and silently passes* whenever
 // Docker or the `npm` image is absent (the common case locally and in this
-// eval). So for the one ecosystem `setup` genuinely supports today, the matrix
+// eval). So for npm, the ecosystem family whose `setup` hook the matrix round-trips, the matrix
 // calls can be entirely green having exercised NOTHING — a broken
 // package.json-hook writer would never turn this file red.
 //
diff --git a/crates/socket-patch-cli/tests/setup_matrix_nuget.rs b/crates/socket-patch-cli/tests/setup_matrix_nuget.rs
index 89fa1a25..a7fc11dc 100644
--- a/crates/socket-patch-cli/tests/setup_matrix_nuget.rs
+++ b/crates/socket-patch-cli/tests/setup_matrix_nuget.rs
@@ -50,12 +50,12 @@ mod vex_e2e_common;
 /// real teeth live in [`host_guard`] below.
 #[test]
 #[serial_test::serial]
-// Experimental ecosystem (nuget): aspirational setup-matrix cases are a
-// BASELINE GAP today; this passes on CI only because the runners lack `dotnet`
-// (cases soft-skip) and fails on any host that has it. Ignore so nuget can
-// never block the blocking --all-features jobs; `host_guard` below still pins
-// the real no-op contract. Run with `--features setup-e2e,nuget -- --ignored`.
-#[ignore = "experimental ecosystem (nuget): not gating CI until the nuget backend is implemented; run with --ignored"]
+// nuget's aspirational setup-matrix cases are a BASELINE GAP (no install
+// hook for setup to wire); this passes on CI only because the runners lack
+// `dotnet` (cases soft-skip) and fails on any host that has it. Ignore so
+// nuget can never block the blocking --all-features jobs; `host_guard` below
+// still pins the real no-op contract. Run with `--features setup-e2e -- --ignored`.
+#[ignore = "BASELINE GAP (nuget): no install hook for setup to wire; not gating CI; run with --ignored"]
 fn dotnet() {
     smc::run_pm("nuget", "dotnet");
 }
@@ -156,7 +156,7 @@ mod host_guard {
     }
 
     /// The `.csproj` must be byte-for-byte what we wrote — `setup` (in any
-    /// mode) operates on package.json / Python / Cargo manifests and must
+    /// mode) operates on package.json / Python / Gemfile / composer.json manifests and must
     /// NEVER touch a dotnet project file.
     fn assert_csproj_pristine(root: &Path, who: &str) {
         assert_eq!(
diff --git a/crates/socket-patch-cli/tests/setup_matrix_pypi.rs b/crates/socket-patch-cli/tests/setup_matrix_pypi.rs
index d74b64b3..4bc19021 100644
--- a/crates/socket-patch-cli/tests/setup_matrix_pypi.rs
+++ b/crates/socket-patch-cli/tests/setup_matrix_pypi.rs
@@ -83,10 +83,11 @@ fn hatch() {
 //
 // A pip project carries a `requirements.txt`, which `setup` DOES support:
 // it commits the `socket-patch[hook]` dependency (the `.pth` post-install
-// carrier). Unlike gem/go/deno (no-op `no_files` ecosystems), pypi has a
+// carrier). Unlike the no-op `no_files` ecosystems (go, maven, nuget,
+// cargo), pypi has a
 // positive contract, so this guard asserts the full configure round-trip
 // rather than a no-op. It runs with no Docker, no network, and (for pip,
-// whose `lock_command` is `None`) no external toolchain.
+// whose `lock_commands()` is `None`) no external toolchain.
 // ─────────────────────────────────────────────────────────────────────────
 mod host_guard {
     use std::path::Path;
diff --git a/crates/socket-patch-cli/tests/telemetry_e2e.rs b/crates/socket-patch-cli/tests/telemetry_e2e.rs
index 9103a3bc..859dd758 100644
--- a/crates/socket-patch-cli/tests/telemetry_e2e.rs
+++ b/crates/socket-patch-cli/tests/telemetry_e2e.rs
@@ -339,7 +339,7 @@ async fn get_emits_patch_fetched_telemetry_on_uuid_lookup_success() {
         "license": "MIT",
         "description": "test patch",
         // A recordable new-file patch (afterHash is the git-blob sha256 of
-        // the decoded blobContent "patched\n"). Post-#158, a patch whose
+        // the decoded blobContent "patched\n"). A patch whose
         // applicable-files map is empty is a hard failure ("no applicable
         // files"), so the success path this test asserts needs a real file.
         "files": {
@@ -506,9 +506,7 @@ async fn apply_skips_telemetry_in_airgap_mode() {
 
     // Anti-vacuous guard: apply must have run its command body and emitted
     // its JSON result envelope (with a summary), proving the suppression
-    // wasn't a side effect of an early crash. (Apply on an empty manifest
-    // currently reports partialFailure — a separately tracked design gap —
-    // so we assert on the envelope shape, not the status string.)
+    // wasn't a side effect of an early crash.
     let v: serde_json::Value = serde_json::from_str(&stdout)
         .unwrap_or_else(|e| panic!("apply stdout not JSON: {e}\n{stdout}"));
     assert_eq!(
@@ -864,14 +862,14 @@ async fn scan_flushes_background_telemetry_before_exit() {
 /// A consumer that exits early (`scan | head`, `scan | true`) closes
 /// stdout, and the CLI dies of SIGPIPE on its first result write (main
 /// restores SIG_DFL). The background send must already be delivered by
-/// then — flushed before that write, as the inline send it replaced was —
-/// not lost with the process. Covers each JSON flush point: the empty-crawl
-/// and all-batches-failed terminals, the plain envelope, and the hosted and
-/// vendored arms (flushed at `discover_selected`). The first three print
-/// right after the event fires, so they fail deterministically without the
-/// flush; the hosted/vendored arms do enough work before printing that an
-/// unflushed send usually wins the race anyway, so for them this is a
-/// delivery check rather than a pin on the flush point.
+/// then — flushed before that write —
+/// not lost with the process. Covers the empty-crawl and all-batches-failed
+/// terminals, which print right after the event fires (so they fail
+/// deterministically without the flush), and the hosted and vendored arms
+/// (flushed at `discover_selected`; the "plain envelope" case is a bare
+/// scan, i.e. hosted too). The hosted/vendored arms do enough work before
+/// printing that an unflushed send usually wins the race anyway, so for
+/// them this is a delivery check rather than a pin on the flush point.
 #[tokio::test]
 async fn scan_delivers_telemetry_before_writing_to_a_closed_stdout() {
     const TELEMETRY_DELAY: std::time::Duration = std::time::Duration::from_millis(800);
@@ -974,10 +972,11 @@ async fn scan_delivers_telemetry_before_writing_to_a_closed_stdout() {
 /// read-only consult) right after the scan event fires, BEFORE any stdout
 /// write — so with stderr closed that warning is the run's first
 /// SIGPIPE-raising write, and the background send must be flushed ahead of
-/// it, as the inline send it replaced always was. The plain envelope does
-/// no network work between the event and the warning, so without the flush
-/// the delayed send deterministically loses the race; the vendored arm is
-/// covered too (its warning also precedes `discover_selected`'s flush).
+/// it. The agent preview (`--mode agent --dry-run`) does no network work
+/// between the event and the warning, so without the flush the delayed send
+/// deterministically loses the race (a bare scan is hosted and reads the
+/// ledger strictly, so it is not a case here); the vendored arm is covered
+/// too (its warning also precedes `discover_selected`'s flush).
 #[tokio::test]
 async fn scan_delivers_telemetry_before_writing_to_a_closed_stderr() {
     const TELEMETRY_DELAY: std::time::Duration = std::time::Duration::from_millis(800);
diff --git a/crates/socket-patch-cli/tests/vendor_gem_lockfile_only_e2e.rs b/crates/socket-patch-cli/tests/vendor_gem_lockfile_only_e2e.rs
index 3307e01f..81578de3 100644
--- a/crates/socket-patch-cli/tests/vendor_gem_lockfile_only_e2e.rs
+++ b/crates/socket-patch-cli/tests/vendor_gem_lockfile_only_e2e.rs
@@ -8,9 +8,8 @@
 //! converter is what turns that into the Ruby form, and serves it as the
 //! `gem-stub-gemspec` second artifact). So build mode cannot vendor a
 //! fetched gem, ever — and the vendor loop refuses it `gem_spec_missing`
-//! BEFORE downloading it (the X1b deferred-fetch gate), where the
-//! auto-fetch rung used to download the `.gem` first and only then hit the
-//! backend's refusal. `vendor_rerun_no_network_e2e` pins the gate itself;
+//! BEFORE downloading it (the X1b deferred-fetch gate).
+//! `vendor_rerun_no_network_e2e` pins the gate itself;
 //! this suite pins its SCOPE: `auto` still fetches, and the three runs a
 //! fetch would never have happened for (nothing resolves the gem, the lock
 //! cannot verify it, the ledger already vendors it) keep their own
diff --git a/crates/socket-patch-cli/tests/vendor_partial_staging_e2e.rs b/crates/socket-patch-cli/tests/vendor_partial_staging_e2e.rs
index 3555b592..b6a1b5a7 100644
--- a/crates/socket-patch-cli/tests/vendor_partial_staging_e2e.rs
+++ b/crates/socket-patch-cli/tests/vendor_partial_staging_e2e.rs
@@ -11,10 +11,9 @@
 //!    (`a_view_whose_only_contentless_files_are_zero_delta_vendors`).
 //! 2. A file the patch CHANGES that is served without content is genuinely
 //!    unsatisfiable. That is a broken PACKAGE, not a broken run: it gets
-//!    its own `failed` event and the rest of the run carries on. A single
-//!    such patch used to make the WHOLE run bail `no_local_source` — exit
-//!    1, `status: error`, zero events, and every OTHER package in the
-//!    manifest left unvendored without a word.
+//!    its own `failed` event and the rest of the run carries on — it must
+//!    not make the WHOLE run bail `no_local_source` with every OTHER
+//!    package left unvendored without a word.
 //!
 //! A package whose patch content cannot be obtained is an unsatisfiable
 //! package like any other (`vendor_fetch_failed`, `redirect_revert_failed`,
@@ -553,8 +552,9 @@ async fn a_dropped_package_is_never_granted_a_service_download() {
 
 // ── the other caller of the per-package drop ────────────────────────────
 //
-// `drop_unstageable` is wired into `vendor` (above), `scan --mode vendored`
-// / `get --mode vendored` (`scan::vendor_flow`) and `repair`. The vendored
+// `drop_unstageable` is wired into `vendor` (above) and `scan --mode
+// vendored` / `get --mode vendored` (`scan::vendor_flow`); `repair` drops
+// unstageable candidates with its own partition in `repair_vendor`. The vendored
 // SCAN fold — `Ok(staging_errors || engine_errors)` — has its own error
 // path, and every existing suite that touches it mounts a single-patch
 // manifest, so it only ever exercised the preserved whole-run bail.
diff --git a/crates/socket-patch-cli/tests/vendor_rerun_no_network_e2e.rs b/crates/socket-patch-cli/tests/vendor_rerun_no_network_e2e.rs
index 10efe03b..4c581e70 100644
--- a/crates/socket-patch-cli/tests/vendor_rerun_no_network_e2e.rs
+++ b/crates/socket-patch-cli/tests/vendor_rerun_no_network_e2e.rs
@@ -2,19 +2,17 @@
 //!
 //! The fresh-clone case: `.socket/vendor/` and the wired lockfile are
 //! committed, the package itself is not installed (no `bundle install`, no
-//! venv, an empty module/registry cache). The missing purl used to go
-//! through the pristine-source ladder BEFORE the backend's in-sync check —
-//! recovering the pre-vendor registry resolution from the ledger and
-//! downloading the pristine artifact just to hand the backend a tree it
-//! never reads on that path. With no network the download failed and so
-//! did the run, for every already-vendored pypi, cargo, go and
-//! lockfile-only gem package.
+//! venv, an empty module/registry cache). The pristine-source ladder must
+//! not download the pristine artifact before the backend's in-sync check —
+//! the backend never reads that tree on this path, and with no network the
+//! download (and so the run) would fail for every already-vendored pypi,
+//! cargo, go and lockfile-only gem package.
 //!
-//! The ladder now defers that download to the backend branch that reads
+//! The ladder defers that download to the backend branch that reads
 //! the tree, for a purl whose ledger entry records the record's patch uuid
 //! and whose committed artifact is on disk. The backend's hot path answers
 //! from the committed bytes, so the re-run is green (`already_vendored`),
-//! makes no registry request, and no longer reports a
+//! makes no registry request, and reports no
 //! `vendor_fetched_missing` fetch it did not need — both with the registry
 //! unreachable and under `--offline`.
 //!
@@ -235,7 +233,7 @@ fn write_six_project(root: &Path, uuid: &str) {
     const ORIG: &[u8] = b"# six\nVERSION = '1.16.0'\n";
     const PATCHED: &[u8] = b"# six\nVERSION = '1.16.0'\nSAFE = True\n";
     // A hash-pinned requirement: the ledger-recovered pre-vendor line is
-    // then fetchable, so the old ladder really went to the registry.
+    // then fetchable, so an eager ladder would really go to the registry.
     std::fs::write(
         root.join("requirements.txt"),
         format!("six==1.16.0 --hash=sha256:{}\n", "a".repeat(64)),
@@ -420,7 +418,7 @@ fn golang_rerun_without_network_is_in_sync() {
         format!("module example.com/app\n\ngo 1.21\n\nrequire {MODULE} {VERSION}\n"),
     )
     .unwrap();
-    // A verifiable go.sum pin: the old ladder fetched it from GOPROXY.
+    // A verifiable go.sum pin: an eager ladder would fetch it from GOPROXY.
     std::fs::write(
         root.join("go.sum"),
         format!(
@@ -1056,8 +1054,8 @@ async fn cargo_rerun_over_a_drifted_copy_reports_the_deferred_fetch_first() {
 /// (a peer-suffixed snapshot key it cannot rewire) is never fetched: the
 /// pristine download is deferred to the backend, which refuses before it
 /// reads anything, so the run makes no registry request and reports the
-/// real reason. With the registry unreachable, the old eager fetch failed
-/// first (`vendor_fetch_failed`) and hid it.
+/// real reason (an eager fetch would fail first with `vendor_fetch_failed`
+/// and hide it).
 #[test]
 fn a_lockfile_only_package_refused_on_lock_text_is_never_fetched() {
     const UUID: &str = "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb";
diff --git a/crates/socket-patch-cli/tests/vex_e2e_common/mod.rs b/crates/socket-patch-cli/tests/vex_e2e_common/mod.rs
index a7fd30cb..dfb2aea7 100644
--- a/crates/socket-patch-cli/tests/vex_e2e_common/mod.rs
+++ b/crates/socket-patch-cli/tests/vex_e2e_common/mod.rs
@@ -1,8 +1,8 @@
 //! Shared steps for manifest-less VEX end-to-end tests (hosted + vendored
 //! patches, one suite per package manager).
 //!
-//! A hosted (`scan --mode hosted`) or vendored (`scan --vendor`,
-//! `vendor --detached`, a depscan-opened PR) checkout has NO
+//! A hosted (`scan --mode hosted`) or vendored (`scan --mode vendored`,
+//! `get --mode vendored`, a depscan-opened PR) checkout has NO
 //! `.socket/manifest.json`: the patches live in the lockfiles/configs, the
 //! committed `.socket/vendor/` artifacts and (optionally) the two ledgers.
 //! These helpers take a project a real package manager produced, strip it
diff --git a/crates/socket-patch-cli/tests/vex_e2e_common/uv.rs b/crates/socket-patch-cli/tests/vex_e2e_common/uv.rs
index d2cf0b59..a21d8a20 100644
--- a/crates/socket-patch-cli/tests/vex_e2e_common/uv.rs
+++ b/crates/socket-patch-cli/tests/vex_e2e_common/uv.rs
@@ -1071,9 +1071,9 @@ pub fn manifestless_matrix(m: &Matrix<'_>, row: &dyn Fn(&str, &str)) {
         assert_attested(out.doc(), m.purl, m.uuid, marker, m.vulns);
         row(label, "attested");
         if run.via == VexVia::Scan && m.mode == Mode::Vendored {
-            // `scan --mode vendored` is a WRITER: it records the vendored
-            // patch in the manifest it (re)creates — the checkout goes back
-            // to the manifest-less shape for the next steps.
+            // `scan --mode vendored` is manifest-free (records go into the
+            // vendor ledger), so no manifest should appear; strip
+            // defensively.
             strip_manifest(fresh);
         }
         assert!(
diff --git a/crates/socket-patch-cli/tests/vex_pdm_hatch_common/mod.rs b/crates/socket-patch-cli/tests/vex_pdm_hatch_common/mod.rs
index 1116c357..608b37a2 100644
--- a/crates/socket-patch-cli/tests/vex_pdm_hatch_common/mod.rs
+++ b/crates/socket-patch-cli/tests/vex_pdm_hatch_common/mod.rs
@@ -495,8 +495,8 @@ pub struct Wired {
     pub flavor: Flavor,
     pub mode: Mode,
     /// Every file after the wiring run (the venv and VEX output excluded):
-    /// wired project files, `.socket/manifest.json` (vendored non-detached),
-    /// the mode's ledger, the committed wheel (vendored).
+    /// wired project files, the mode's ledger, the committed wheel
+    /// (vendored).
     pub files: BTreeMap<String, Vec<u8>>,
 }
 
@@ -769,8 +769,8 @@ pub fn c_ledger_without_manifest_attests_offline(flavors: &[Flavor]) {
 }
 
 /// d) wiring reverted to the registry while ledger + artifact remain →
-/// `redirect_unwired` / `vendor_unwired`, `--no-verify` included; the
-/// manifest back as well still attests nothing; with the ledger gone too
+/// `redirect_unwired` / `vendor_unwired`, `--no-verify` included; a legacy
+/// (pre-5.0) manifest put back as well still attests nothing; with the ledger gone too
 /// nothing is discovered at all (the orphaned wheel is never evidence).
 pub fn d_reverted_wiring_is_unwired_even_with_no_verify(flavors: &[Flavor]) {
     for (flavor, mode) in cells(flavors) {
diff --git a/crates/socket-patch-cli/tests/vex_pipenv_pip_common/mod.rs b/crates/socket-patch-cli/tests/vex_pipenv_pip_common/mod.rs
index 82ed4892..0c8d06e5 100644
--- a/crates/socket-patch-cli/tests/vex_pipenv_pip_common/mod.rs
+++ b/crates/socket-patch-cli/tests/vex_pipenv_pip_common/mod.rs
@@ -518,8 +518,8 @@ pub struct Wired {
     pub flavor: Flavor,
     pub mode: Mode,
     /// Every file after the wiring run (the venv and VEX output excluded):
-    /// wired project files, `.socket/manifest.json` (vendored non-detached),
-    /// the mode's ledger, the committed wheel (vendored).
+    /// wired project files, the mode's ledger, the committed wheel
+    /// (vendored); neither mode writes `.socket/manifest.json`.
     pub files: BTreeMap<String, Vec<u8>>,
 }
 
@@ -715,7 +715,7 @@ pub fn assert_no_statement(out: &VexOutcome, what: &str) {
 
 /// a) no manifest, no ledgers, online → attested from the wiring alone;
 /// vex never writes the manifest or a ledger. Also the committed `.socket/`
-/// (manifest + ledger) baseline, offline.
+/// (ledger, plus the wheel when vendored) baseline, offline.
 pub fn a_wiring_only_checkout_attests_online(flavors: &[Flavor]) {
     for (flavor, mode) in cells(flavors) {
         let wired = wired(&flavor, mode);
diff --git a/crates/socket-patch-cli/tests/vlt_e2e_common/fixture.rs b/crates/socket-patch-cli/tests/vlt_e2e_common/fixture.rs
index 01fe282a..c1303105 100644
--- a/crates/socket-patch-cli/tests/vlt_e2e_common/fixture.rs
+++ b/crates/socket-patch-cli/tests/vlt_e2e_common/fixture.rs
@@ -278,7 +278,8 @@ impl Fixture {
         co
     }
 
-    /// The lock-level warnings DESIGN §3.8 predicts for the lock vlt wrote.
+    /// The lock-level warnings the boundary table (docs/testing/vlt-compatibility.md) predicts for the
+    /// lock vlt wrote.
     pub fn lock_warnings(&self) -> Vec<&'static str> {
         expected_lock_warnings(&self.lock_before, &self.proj)
     }
@@ -389,7 +390,8 @@ pub fn slash(u: &str) -> String {
     }
 }
 
-/// DESIGN §3.8 over the lock vlt wrote and the project's vlt.json.
+/// The boundary table (docs/testing/vlt-compatibility.md) applied to the lock vlt wrote and the
+/// project's vlt.json.
 pub fn expected_lock_warnings(lock_bytes: &[u8], proj: &Path) -> Vec<&'static str> {
     let lock: Value = serde_json::from_slice(lock_bytes).unwrap();
     let mut out = Vec::new();
diff --git a/crates/socket-patch-cli/tests/vlt_e2e_common/mod.rs b/crates/socket-patch-cli/tests/vlt_e2e_common/mod.rs
index 0303ca82..3a41ce66 100644
--- a/crates/socket-patch-cli/tests/vlt_e2e_common/mod.rs
+++ b/crates/socket-patch-cli/tests/vlt_e2e_common/mod.rs
@@ -1,4 +1,4 @@
-//! The real-vlt capstone harness (DESIGN §8.3), shared by
+//! The real-vlt capstone harness (docs/testing/vlt-compatibility.md, "The capstone registry harness"), shared by
 //! `e2e_redirect_vlt_build`, `e2e_vendor_vlt_build`, `mode_migration_vlt`,
 //! `e2e_safety_vlt`, `e2e_vlt` and the production suites.
 //!
@@ -300,7 +300,7 @@ pub fn legacy_workspaces_file(v: VltVersion) -> bool {
     v <= VltVersion::zero(12)
 }
 
-/// The lockfile grammar a release writes (DESIGN §1.1).
+/// The lockfile grammar a release writes (docs/testing/vlt-compatibility.md, "Formats").
 #[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]
 pub enum VltEra {
     A0,
@@ -837,7 +837,7 @@ pub struct VltJson {
     pub no_registry: bool,
 }
 
-/// The vlt.json the §8.3 era table prescribes for registry `r`
+/// The per-era vlt.json (docs/testing/vlt-compatibility.md, "The capstone registry harness") for registry `r`
 /// (`http://127.0.0.1:<port>/`).
 pub fn vlt_json(v: VltVersion, r: &str, opts: &VltJson) -> Value {
     let mut config = serde_json::Map::new();
@@ -1869,7 +1869,7 @@ pub fn lock_bytes(proj: &Path) -> Vec<u8> {
     std::fs::read(proj.join(VLT_LOCK)).expect("vlt-lock.json")
 }
 
-/// vlt's tilde segment decode (DESIGN §1.6).
+/// vlt's tilde segment decode (docs/testing/vlt-compatibility.md, "Formats").
 pub fn tilde_decode(seg: &str) -> String {
     let chars: Vec<char> = seg.chars().collect();
     let mut out = String::new();
diff --git a/crates/socket-patch-core/Cargo.toml b/crates/socket-patch-core/Cargo.toml
index 98757345..3add95f0 100644
--- a/crates/socket-patch-core/Cargo.toml
+++ b/crates/socket-patch-core/Cargo.toml
@@ -66,8 +66,7 @@ sha2 = { workspace = true, features = ["asm"] }
 
 # All ecosystems (npm, PyPI, Ruby gems, Go, Cargo, NuGet, Maven, Composer,
 # Deno) are unconditionally compiled in AND enabled at runtime — there are
-# no ecosystem feature gates and no runtime env gates (the old
-# SOCKET_EXPERIMENTAL_MAVEN/NUGET opt-ins are retired).
+# no ecosystem feature gates and no runtime env gates.
 
 [dev-dependencies]
 tempfile = { workspace = true }
diff --git a/crates/socket-patch-core/src/api/blob_fetcher.rs b/crates/socket-patch-core/src/api/blob_fetcher.rs
index 03eea3e2..5125ab3f 100644
--- a/crates/socket-patch-core/src/api/blob_fetcher.rs
+++ b/crates/socket-patch-core/src/api/blob_fetcher.rs
@@ -180,7 +180,8 @@ pub async fn fetch_blobs_by_hash(
 
 /// Return the set of patch UUIDs whose archive at
 /// `<archives_dir>/<uuid>.tar.gz` is missing from disk. Used as the
-/// "what do I need to download" query for diff and package modes.
+/// "what do I need to download" query for diff mode, and as a presence
+/// check for locally staged package archives (`.socket/packages/`).
 pub async fn get_missing_archives(
     manifest: &PatchManifest,
     archives_dir: &Path,
diff --git a/crates/socket-patch-core/src/api/client.rs b/crates/socket-patch-core/src/api/client.rs
index faed8f02..5f716c02 100644
--- a/crates/socket-patch-core/src/api/client.rs
+++ b/crates/socket-patch-core/src/api/client.rs
@@ -738,7 +738,7 @@ impl ApiClient {
     }
 
     /// Resolve hosted-patch references for a set of published-patch UUIDs
-    /// (`scan --redirect`). Uses the authenticated
+    /// (hosted-mode `scan`, the default for a bare `scan`). Uses the authenticated
     /// `POST /v0/orgs/{org}/patches/package` when a token+org are set, else the
     /// public proxy `POST /patch/package` (free patches only). Returns a
     /// UUID → reference map (missing/404 → empty).
@@ -2468,8 +2468,10 @@ fn convert_search_result_to_batch_info(patch: PatchSearchResult) -> BatchPatchIn
         severity: highest_severity,
         title,
         // Carry the timestamp through. The batch shape does not require it,
-        // but dropping it here would cost this path the recency tiebreak in
-        // `ranking` — and it is the one path where we definitely have it.
+        // but dropping it here would cost this path its recency ordering in
+        // `ranking` (the sole key among merged patches, the tiebreak after
+        // severity otherwise) — and it is the one path where we definitely
+        // have it.
         published_at: Some(patch.published_at),
     }
 }
@@ -3348,9 +3350,8 @@ mod tests {
 
     #[test]
     fn test_convert_moderate_outranks_low() {
-        // Regression: `moderate` (GHSA medium tier) used to rank below
-        // `low`, so a moderate+low patch reported `low` as its highest
-        // severity.
+        // `moderate` (GHSA medium tier) must outrank `low`, so a
+        // moderate+low patch reports `moderate` as its highest severity.
         let mut vulns = HashMap::new();
         vulns.insert(
             "GHSA-1111".into(),
@@ -3698,9 +3699,8 @@ mod tests {
     #[test]
     fn validate_token_shape_redacts_by_chars_not_bytes() {
         // Regression: the preview tail and the "(N chars)" count must be
-        // measured in *characters*, not bytes. A multi-byte token used to be
-        // sized with `token.len()` (bytes), which over-reported the length
-        // and mis-sliced the "last 4 chars" tail.
+        // measured in *characters*, not bytes: `token.len()` (bytes) would
+        // over-report the length and mis-slice the "last 4 chars" tail.
         //
         // 1 multi-byte char ('é', 2 bytes) + 16 ASCII + "WXYZ" = 21 chars /
         // 22 bytes. Correct redaction keeps the last 4 chars ("WXYZ") and
@@ -3727,11 +3727,10 @@ mod tests {
 
     // ── classify_auth_error: shared 401/403/429 classification ──────────
     //
-    // Regression: `fetch_binary` used to fold *every* non-OK/404 status into
-    // `ApiError::Other`, so an authenticated blob/diff/package fetch that
-    // 401'd/403'd was never recognized by `is_fallback_candidate` and the
-    // auth→proxy fallback silently never fired. Both transport paths now route
-    // through this shared classifier; these pin its contract directly.
+    // Both transport paths (including `fetch_binary`) route through this
+    // shared classifier, so an authenticated blob/diff/package fetch that
+    // 401s/403s is recognized by `is_fallback_candidate` and the auth→proxy
+    // fallback fires. These pin its contract directly.
 
     #[test]
     fn classify_auth_error_maps_401_to_unauthorized() {
@@ -3876,10 +3875,10 @@ mod tests {
 
     // ── binary_url: proxy override must reach blob/diff/package fetches ──
     //
-    // Regression: `fetch_binary` used to re-derive the proxy base from
-    // `SOCKET_PROXY_URL`/default instead of the client's configured
-    // `api_url`, so a `--proxy-url` override (which sets `api_url` but no env
-    // var) was honored for searches yet silently ignored for downloads.
+    // `fetch_binary` must use the client's configured `api_url`, not
+    // re-derive the proxy base from `SOCKET_PROXY_URL`/default, so a
+    // `--proxy-url` override (which sets `api_url` but no env var) reaches
+    // downloads as well as searches.
 
     fn proxy_client(api_url: &str) -> ApiClient {
         ApiClient::new(ApiClientOptions {
@@ -4530,7 +4529,7 @@ mod vendor_package_tests {
         ));
     }
 
-    // ── fetch_registry_references (scan --redirect resolution) ────────
+    // ── fetch_registry_references (hosted-mode scan resolution) ────────
 
     /// `fetch_registry_references` with no UUIDs must return an empty map
     /// with zero I/O — the client points at a closed port, so a regression
@@ -4558,7 +4557,7 @@ mod vendor_package_tests {
         }
     }
 
-    /// The anonymous `scan --redirect` route: `fetch_registry_references`
+    /// The anonymous hosted-mode `scan` route: `fetch_registry_references`
     /// on a public-proxy client POSTs `/patch/package` with no bearer and
     /// no `freeOnly` key, and returns the UUID → reference map.
     #[tokio::test]
diff --git a/crates/socket-patch-core/src/api/date.rs b/crates/socket-patch-core/src/api/date.rs
index 08822a19..46de16c0 100644
--- a/crates/socket-patch-core/src/api/date.rs
+++ b/crates/socket-patch-core/src/api/date.rs
@@ -1,8 +1,7 @@
 //! Minimal timestamp parser for the `publishedAt` field on patch records.
 //!
 //! The Socket patch API serves `publishedAt` as an **RFC 2822 / HTTP-date**
-//! string — `Fri, 27 Mar 2026 19:12:42 GMT` — verified live across npm,
-//! PyPI, cargo and gem. Test fixtures throughout this repo use RFC 3339
+//! string — `Fri, 27 Mar 2026 19:12:42 GMT`. Test fixtures throughout this repo use RFC 3339
 //! (`2026-03-27T19:12:42Z`) instead, so both spellings must parse.
 //!
 //! This matters because these strings are *ordered*: patch selection ranks
diff --git a/crates/socket-patch-core/src/api/types.rs b/crates/socket-patch-core/src/api/types.rs
index ceca4dd0..09b7914f 100644
--- a/crates/socket-patch-core/src/api/types.rs
+++ b/crates/socket-patch-core/src/api/types.rs
@@ -102,11 +102,12 @@ pub struct BatchPatchInfo {
     pub title: String,
     /// When **this patch** was published (see
     /// [`PatchResponse::published_at`]), if the server supplies it. The
-    /// batch shape historically omits it, which is why it is optional — a
-    /// `None` here only weakens the recency tiebreak in
-    /// [`crate::api::ranking`], it never changes the severity or
-    /// merge-state ordering. The public-proxy fallback path fills it in from the
-    /// per-package search results.
+    /// batch shape may omit it, which is why it is optional — a `None`
+    /// ranks as oldest in [`crate::api::ranking`], which weakens recency
+    /// ordering (the sole key among merged patches, the tiebreak after
+    /// severity otherwise) but never changes merge state or severity. The
+    /// public-proxy fallback path fills it in from the per-package search
+    /// results.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub published_at: Option<String>,
 }
@@ -159,7 +160,7 @@ pub struct PackageVendorResult {
     pub purl: Option<String>,
     #[serde(default)]
     pub artifacts: Option<Vec<PackageVendorArtifact>>,
-    /// Per-ecosystem registry override that `scan --redirect` turns into a
+    /// Per-ecosystem registry override that hosted-mode `scan` turns into a
     /// `DepOverride`.
     #[serde(default)]
     pub registry_override: Option<RegistryOverride>,
@@ -179,7 +180,7 @@ pub struct PackageVendorArtifact {
     /// `sha512-<b64>`) + `sha1` + `md5`; golang additionally `dirhash_h1`
     /// (`h1:<b64>`); the npm yarn-berry zip carries only `yarn_berry10c0`
     /// (`10c0/<sha512-hex>`). A plain `sha256` IS served and is load-bearing
-    /// for `scan --redirect`: the pypi (`requirements.txt` / `uv.lock`) and
+    /// for hosted-mode `scan`: the pypi (`requirements.txt` / `uv.lock`) and
     /// maven rewriters pin it directly, and cargo / gem fall back to it when
     /// the `registry_override` identifiers carry no checksum.
     #[serde(default)]
diff --git a/crates/socket-patch-core/src/constants.rs b/crates/socket-patch-core/src/constants.rs
index 3f872bbb..5a6fefeb 100644
--- a/crates/socket-patch-core/src/constants.rs
+++ b/crates/socket-patch-core/src/constants.rs
@@ -26,9 +26,8 @@ mod tests {
 
     #[test]
     fn user_agent_reports_real_crate_version() {
-        // Regression: USER_AGENT was pinned to "SocketPatchCLI/1.0" while the
-        // crate shipped 3.x, so every API request / telemetry beacon misreported
-        // the version. It must carry the actual compiled crate version.
+        // USER_AGENT must carry the actual compiled crate version, never a
+        // hardcoded one.
         let expected = format!("SocketPatchCLI/{}", env!("CARGO_PKG_VERSION"));
         assert_eq!(USER_AGENT, expected);
         assert!(USER_AGENT.starts_with("SocketPatchCLI/"));
diff --git a/crates/socket-patch-core/src/crawlers/cargo_crawler.rs b/crates/socket-patch-core/src/crawlers/cargo_crawler.rs
index 8c36205f..808876b7 100644
--- a/crates/socket-patch-core/src/crawlers/cargo_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/cargo_crawler.rs
@@ -950,7 +950,7 @@ version = "fake"
     // --- regression: dir-name version splitting ------------------------
 
     /// A numeric pre-release segment (legal SemVer) must stay part of the
-    /// version. Previously the "last hyphen-before-digit" heuristic split
+    /// version; a "last hyphen-before-digit" heuristic would split
     /// `mycrate-1.0.0-2` into (`mycrate-1.0.0`, `2`).
     #[test]
     fn test_parse_dir_name_version_numeric_prerelease() {
diff --git a/crates/socket-patch-core/src/crawlers/composer_crawler.rs b/crates/socket-patch-core/src/crawlers/composer_crawler.rs
index a2a029d0..38d06018 100644
--- a/crates/socket-patch-core/src/crawlers/composer_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/composer_crawler.rs
@@ -278,14 +278,14 @@ pub fn parse_composer_home_output(stdout: &str) -> Option<PathBuf> {
 /// whole environment (every variable, and the working directory) is exactly
 /// what it was when the answer was produced — the subprocess's only inputs
 /// the CLI controls. A different environment re-runs it and replaces the
-/// entry; concurrent first callers may each run it, as before.
+/// entry; concurrent first callers may each run it.
 ///
 /// Only an answer is kept. A FAILED probe (spawn error under fd pressure,
-/// a non-zero exit, empty stdout) is asked again by the next caller, as
-/// every caller used to ask — global discovery runs at least twice per
-/// command (the crawl, then the package-lookup pass), and before the memo
-/// a transient first failure cost nothing. So is an answer the environment
-/// changed under, which the key would misfile. Same rule as the `gem env`
+/// a non-zero exit, empty stdout) is asked again by the next caller —
+/// global discovery runs at least twice per command (the crawl, then the
+/// package-lookup pass), so a transient first failure must not stick. So
+/// is an answer the environment changed under, which the key would
+/// misfile. Same rule as the `gem env`
 /// memo in `ruby_crawler`.
 struct EnvKeyedMemo {
     slot: std::sync::Mutex<Option<(EnvKey, String)>>,
@@ -494,9 +494,8 @@ async fn resolve_local_vendor_dir(cwd: &Path) -> Option<PathBuf> {
 
 /// Reduce a `config.vendor-dir` value to plain `a/b` segments before the
 /// safety gate. Composer accepts `./`-prefixed and `.`-interleaved values
-/// (`./vendor`, `lib/./deps`) and either separator; refusing those shapes
-/// outright regressed projects that previously resolved fine at the
-/// hardcoded `vendor/`. `..` is resolved lexically the way Composer's own
+/// (`./vendor`, `lib/./deps`) and either separator, so those shapes must
+/// resolve rather than be refused. `..` is resolved lexically the way Composer's own
 /// path resolution does; a value that climbs above the project root (or
 /// reduces to it) fails closed as `None`.
 fn normalize_config_vendor_dir(raw: &str) -> Option<String> {
diff --git a/crates/socket-patch-core/src/crawlers/maven_crawler.rs b/crates/socket-patch-core/src/crawlers/maven_crawler.rs
index a72d346a..da2a1584 100644
--- a/crates/socket-patch-core/src/crawlers/maven_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/maven_crawler.rs
@@ -1585,7 +1585,7 @@ mod tests {
     #[test]
     fn test_parse_pom_skip_section_close_tag_with_whitespace() {
         // XML permits whitespace before `>` in a closing tag (`</build >`).
-        // The exact `</build>` match used to miss it, leaving `build` open and
+        // An exact `</build>` match would miss it, leaving `build` open and
         // leaking the plugin's coordinates. The boundary-aware close handles it.
         let content = r#"<project>
   <groupId>com.example</groupId>
diff --git a/crates/socket-patch-core/src/crawlers/npm_crawler.rs b/crates/socket-patch-core/src/crawlers/npm_crawler.rs
index e9094e9f..348c6377 100644
--- a/crates/socket-patch-core/src/crawlers/npm_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/npm_crawler.rs
@@ -659,7 +659,7 @@ pub struct NpmCrawler;
 ///
 /// `purl` is the *verbatim* caller-supplied PURL, including any
 /// `?qualifiers`. The result map is keyed by this exact string: the
-/// dispatcher drives npm with `passthrough_purls` + `merge_first_wins`,
+/// dispatcher drives npm with `passthrough_purls` + `merge_npm_copies`,
 /// so it looks results back up under the PURL it handed in. Keying by a
 /// reconstructed/stripped PURL silently loses every qualified PURL
 /// (e.g. `pkg:npm/foo@1.0.0?vcs_url=...`).
@@ -761,7 +761,7 @@ impl NpmCrawler {
     /// vulnerable copy while reporting success (a silent partial). The
     /// per-PURL `Vec` is ordered root-copy-first (breadth-first), so callers
     /// that only need one representative (`vendor`, `vex`, `setup`) can take
-    /// the first and preserve the old root-preference.
+    /// the first and get the root copy.
     ///
     /// pnpm's and vlt's store peer-variant copies are deliberately NOT
     /// enumerated here for a copy already found in an importer tree (a
@@ -1521,8 +1521,9 @@ impl NpmCrawler {
     }
 
     /// Gather each virtual-store entry's `node_modules` (entries come from
-    /// [`Self::list_pnpm_store_entries_sync`] or
-    /// [`Self::collect_nested_store_entries_sync`]) under the store-entry
+    /// [`Self::list_pnpm_store_entries_sync`],
+    /// [`Self::collect_nested_store_entries_sync`] or
+    /// [`Self::vlt_store_entry_dirs`]) under the store-entry
     /// policy, in parallel, preserving entry order.
     fn gather_store_entries(entries: Vec<StoreEntryDir>) -> Vec<ScanEvent> {
         par_map(entries, |entry| ScanEvent::StoreEntry {
@@ -2338,9 +2339,9 @@ mod tests {
 
     /// Regression: a wildcard segment that matches a *symlinked*
     /// directory must be followed. `DirEntry::metadata()` stats the link
-    /// itself (reports `is_dir == false`), so the resolver previously
-    /// skipped symlinked version dirs — exactly the layout fnm produces
-    /// and the `current`/`default` aliases nvm creates. The fix stats the
+    /// itself (reports `is_dir == false`), which would skip symlinked
+    /// version dirs — exactly the layout fnm produces and the
+    /// `current`/`default` aliases nvm creates. The resolver stats the
     /// joined path with `std::fs::metadata`, which resolves the target.
     #[cfg(unix)]
     #[test]
@@ -2514,12 +2515,12 @@ mod tests {
         );
     }
 
-    /// Regression: a qualified PURL (carrying `?qualifiers`) must resolve and
-    /// be keyed by the *verbatim* input PURL — not a reconstructed, stripped
-    /// form. The dispatcher drives npm with `passthrough_purls` +
-    /// `merge_first_wins`, so it looks the result back up under the exact PURL
-    /// it passed in. Keying by the stripped PURL silently dropped every
-    /// qualified npm PURL from apply/rollback.
+    /// A qualified PURL (carrying `?qualifiers`) must resolve and be keyed by
+    /// the *verbatim* input PURL — not a reconstructed, stripped form. The
+    /// dispatcher drives npm with `passthrough_purls` + `merge_npm_copies`,
+    /// so it looks the result back up under the exact PURL it passed in.
+    /// Keying by the stripped PURL drops every qualified npm PURL from
+    /// apply/rollback.
     #[tokio::test]
     async fn test_find_by_purls_resolves_qualified_purl_keyed_by_input() {
         let dir = tempfile::tempdir().unwrap();
@@ -2887,7 +2888,7 @@ mod tests {
             "both physical copies must be returned; got {copies:?}"
         );
         // Root-copy-first ordering (breadth-first): callers needing one
-        // representative take [0] and keep the old root-preference.
+        // representative take [0] and get the root copy.
         assert_eq!(copies[0].path, root_copy, "root copy must be first");
         let paths: HashSet<&Path> = copies.iter().map(|c| c.path.as_path()).collect();
         assert!(paths.contains(root_copy.as_path()));
diff --git a/crates/socket-patch-core/src/crawlers/nuget_crawler.rs b/crates/socket-patch-core/src/crawlers/nuget_crawler.rs
index 76674bc0..58227730 100644
--- a/crates/socket-patch-core/src/crawlers/nuget_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/nuget_crawler.rs
@@ -770,7 +770,7 @@ mod tests {
         assert_eq!(packages[0].purl, "pkg:nuget/newtonsoft.json@13.0.3");
     }
 
-    /// Direct guard on the `seen`-dedup arm of `scan_global_cache_package`:
+    /// Direct guard on the `seen`-dedup arm of `scan_package_dir`:
     /// the same package reached through TWO scanned paths (e.g. a local
     /// `packages/` folder and the global cache both holding it) must be
     /// emitted only once. `test_deduplication` above creates a single
@@ -793,7 +793,7 @@ mod tests {
         assert_eq!(first[0].path, pkg_dir);
 
         // Second scan of the same tree: the version dir verifies again
-        // (so `scan_global_cache_package` reports `found_any` for it), but
+        // (so `scan_global_cache_package` returns it as a candidate), but
         // the purl is already in `seen`, so no duplicate package is
         // emitted.
         let second = crawler.scan_package_dir(dir.path(), &mut seen).await;
@@ -931,8 +931,8 @@ mod tests {
         let pkg = dir.path().join("Foo.1.0.0");
         // Top-level marker — this is a valid legacy package.
         tokio::fs::create_dir_all(pkg.join("lib")).await.unwrap();
-        // A content folder that itself contains a lib/ dir. This is what
-        // tripped the old global-cache heuristic.
+        // A content folder that itself contains a lib/ dir, which a naive
+        // global-cache heuristic would mistake for a version dir.
         tokio::fs::create_dir_all(pkg.join("tools").join("lib"))
             .await
             .unwrap();
@@ -1119,10 +1119,9 @@ mod tests {
     /// `1`), `i+1 < dir_name.len()` is true, split_idx = Some(0).
     /// The name slice ends up empty; the defensive guard at the
     /// bottom of parse_legacy_dir_name rejects rather than producing
-    /// a `("", "1.0.0")` ghost package. (Hidden dirs are skipped
-    /// upstream in scan_package_dir, but the parser is also called
-    /// from find_by_purls without the hidden-dir filter, so the
-    /// guard is real defense-in-depth.)
+    /// a `("", "1.0.0")` ghost package. (Hidden dirs are already
+    /// skipped upstream in classify_package_entry, so this guard is
+    /// pure defense-in-depth for the parser.)
     #[test]
     fn test_parse_legacy_dir_name_empty_name_guard() {
         assert_eq!(parse_legacy_dir_name(".1.0.0"), None);
diff --git a/crates/socket-patch-core/src/crawlers/python_crawler.rs b/crates/socket-patch-core/src/crawlers/python_crawler.rs
index 001ed5c1..03814ab2 100644
--- a/crates/socket-patch-core/src/crawlers/python_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/python_crawler.rs
@@ -266,10 +266,11 @@ async fn find_site_packages_under(
 ///
 /// Checks (in order):
 /// 1. `VIRTUAL_ENV` environment variable
-/// 2. `.venv` directory in `cwd`
-/// 3. `venv` directory in `cwd`
-/// 4. Poetry's out-of-tree virtualenv(s) for a Poetry project (see
+/// 2. `.venv` and `venv` directories in `cwd`
+/// 3. Poetry's out-of-tree virtualenv(s) for a Poetry project (see
 ///    [`find_poetry_virtualenv_site_packages`])
+/// 4. Pipenv's out-of-tree virtualenv for a Pipenv project (see
+///    [`find_pipenv_virtualenv_site_packages`])
 pub async fn find_local_venv_site_packages(cwd: &Path) -> Vec<PathBuf> {
     let mut results = Vec::new();
 
@@ -291,19 +292,14 @@ pub async fn find_local_venv_site_packages(cwd: &Path) -> Vec<PathBuf> {
     }
 
     // 3. Poetry keeps its virtualenv OUTSIDE the project by default, so a plain
-    // `poetry install` leaves nothing above to find and the crawl used to fall
-    // through to the global interpreter (patching the wrong site-packages, or
-    // nothing, and reporting success).
+    // `poetry install` leaves nothing above to find; without this probe the
+    // crawl would fall through to the global interpreter.
     if results.is_empty() {
         results.extend(find_poetry_virtualenv_site_packages(cwd).await);
     }
 
     // 4. Pipenv keeps its virtualenv OUTSIDE the project by default
-    // (`$WORKON_HOME/<dir>-<hash>`), so a plain `pipenv install` leaves
-    // nothing above to find and the crawl used to fall through to the global
-    // interpreter's site-packages — patching the wrong Python (or nothing)
-    // and reporting success. Measured on real Pipenv 11.10.4, 2018.11.26 and
-    // 2026.8.0.
+    // (`$WORKON_HOME/<dir>-<hash>`); same reasoning as Poetry above.
     if results.is_empty() {
         results.extend(find_pipenv_virtualenv_site_packages(cwd).await);
     }
@@ -1336,8 +1332,9 @@ pub async fn get_global_python_site_packages() -> Vec<PathBuf> {
 ///
 /// Used by `PythonCrawler::get_site_packages_paths` to decide
 /// whether to fall back to the global-discovery path when no venv
-/// was found. Mirrors `is_dotnet_project` in nuget_crawler and the
-/// `has_gemfile || has_gemfile_lock` check in ruby_crawler.
+/// was found. Mirrors `is_dotnet_project` in nuget_crawler and
+/// `RubyCrawler::has_bundler_manifest` (Gemfile / Gemfile.lock / gems.rb /
+/// gems.locked) in ruby_crawler.
 ///
 /// The list intentionally covers all major Python toolchains:
 ///   * `pyproject.toml` — PEP 518 / 621 (poetry, hatch, uv, flit,
@@ -1384,11 +1381,10 @@ impl PythonCrawler {
     ///
     /// Local-mode discovery has two stages:
     ///   1. `find_local_venv_site_packages` — handles `VIRTUAL_ENV`,
-    ///      `.venv`, and `venv` directories (covers the common case
-    ///      of an activated or project-local venv).
+    ///      `.venv`, and `venv` directories, then Poetry's and Pipenv's
+    ///      out-of-tree virtualenvs.
     ///   2. If no venv was found AND the cwd looks like a Python
-    ///      project (`pyproject.toml`, `setup.py`, `setup.cfg`,
-    ///      `requirements.txt`, or `uv.lock` present), fall through
+    ///      project (see `is_python_project`), fall through
     ///      to `get_global_python_site_packages`. This mirrors the
     ///      cargo / ruby / go pattern where a project marker
     ///      indicates "scan this ecosystem globally for this project".
@@ -1572,8 +1568,7 @@ impl PythonCrawler {
 /// Scan a `site-packages` directory for `.dist-info` entries, returning
 /// `(canonicalized name, version)` for each package that yields metadata,
 /// in listing order. One blocking-pool task for the listing and every
-/// METADATA read (one runtime hop per open, read and stat used to set the
-/// scan's pace).
+/// METADATA read, rather than a runtime hop per open, read and stat.
 pub(crate) async fn list_dist_info_packages(site_packages_path: &Path) -> Vec<(String, String)> {
     let site_packages_path = site_packages_path.to_path_buf();
     run_blocking(move || list_dist_info_packages_sync(&site_packages_path)).await
@@ -1800,10 +1795,6 @@ mod tests {
             .is_empty());
     }
 
-    /// The crawler's public entry point wires step 3 in: with no VIRTUAL_ENV
-    /// and no in-project venv, `find_local_venv_site_packages` returns the
-    /// out-of-tree Pipenv venv instead of nothing (which used to trigger the
-    /// global fallback).
     /// Pipenv 2018–2021 with an absolute PIPENV_PYTHON append the whole
     /// interpreter path to the venv name, so the virtualenv sits at the
     /// bottom of `<workon>/<name>-<hash>-/<abs>/<python>/`; the crawler must
@@ -2412,8 +2403,7 @@ mod tests {
 
     /// Regression for the macOS Python.framework layout: the `Versions/`
     /// directory holds bare version dirs (`3.11`), so the version segment
-    /// must be matched with `*`. A `python3.*` pattern matches nothing —
-    /// which is exactly the bug that was fixed.
+    /// must be matched with `*`. A `python3.*` pattern matches nothing.
     #[tokio::test]
     async fn test_find_python_dirs_framework_versions_layout() {
         let dir = tempfile::tempdir().unwrap();
diff --git a/crates/socket-patch-core/src/crawlers/ruby_crawler.rs b/crates/socket-patch-core/src/crawlers/ruby_crawler.rs
index bdb5cb02..383018e3 100644
--- a/crates/socket-patch-core/src/crawlers/ruby_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/ruby_crawler.rs
@@ -531,8 +531,8 @@ impl RubyCrawler {
     /// caller that swaps `PATH` or `GEM_HOME` still asks afresh. Only a
     /// complete answer is kept: a failed ask (spawn error under fd pressure,
     /// a non-zero exit from a racing shim, empty output) is asked again by
-    /// the next caller, as every caller used to ask — and so is an answer
-    /// the environment changed under, which the key would misfile.
+    /// the next caller — and so is an answer the environment changed under,
+    /// which the key would misfile.
     async fn gem_env_homes() -> GemEnvHomes {
         static MEMO: once_cell::sync::Lazy<GemEnvMemo> =
             once_cell::sync::Lazy::new(Default::default);
@@ -1232,16 +1232,15 @@ mod tests {
         assert_eq!(found, HashSet::from([ruby_gems, jruby_gems, truffle_gems]));
     }
 
-    // ── bundler-1 flat BUNDLE_PATH layout (gem live-matrix D1) ─────
+    // ── bundler-1 flat BUNDLE_PATH layout ─────
 
     /// Bundler 1 with `BUNDLE_PATH` set via the ENVIRONMENT installs
     /// GEM_HOME-style into the flat `<BUNDLE_PATH>/gems/` — no
     /// `<engine>/<abi>` scope segment, sibling `specifications/` dir
-    /// present (bundler >= 2 appends the scope even for env installs).
-    /// The crawler only enumerated the scoped layout, so such projects
-    /// scanned as `notInstalled` and `get` downloaded 1 / applied 0
-    /// (live-verified 2026-08-19: activestorage@6.0.3 under bundler
-    /// 1.17.3 at `vendor/bundle/gems/activestorage-6.0.3`).
+    /// present (bundler >= 2 appends the scope even for env installs),
+    /// e.g. activestorage@6.0.3 under bundler 1.17.3 at
+    /// `vendor/bundle/gems/activestorage-6.0.3`. Enumerating only the
+    /// scoped layout would scan such projects as `notInstalled`.
     #[tokio::test]
     async fn get_vendor_bundle_paths_flat_bundler1_layout() {
         let dir = tempfile::tempdir().unwrap();
@@ -1582,8 +1581,7 @@ mod tests {
     /// `.bundle/config` `BUNDLE_PATH:` first, then the `BUNDLE_PATH`
     /// environment variable, then the implicit `vendor/bundle` default —
     /// so the stores come back highest-precedence first and first-wins
-    /// consumers pick the copy bundler actually loads. The pre-fix order
-    /// (default → env → config) was bundler's precedence inverted.
+    /// consumers pick the copy bundler actually loads.
     #[tokio::test]
     async fn bundle_roots_probe_in_bundler_precedence_order() {
         let dir = tempfile::tempdir().unwrap();
@@ -1889,8 +1887,8 @@ mod tests {
     // ── env BUNDLE_PATH `~` expansion + normalization ──────────────
 
     /// A leading `~/` in the env `BUNDLE_PATH` expands against HOME
-    /// (bundler `File.expand_path`s the value); it used to resolve as a
-    /// literal `<cwd>/~/...` relative path and discover nothing.
+    /// (bundler `File.expand_path`s the value), not as a literal
+    /// `<cwd>/~/...` relative path.
     #[tokio::test]
     async fn bundle_path_env_tilde_expands_against_home() {
         let dir = tempfile::tempdir().unwrap();
diff --git a/crates/socket-patch-core/src/crawlers/walk_pool.rs b/crates/socket-patch-core/src/crawlers/walk_pool.rs
index 03743ea3..1c395559 100644
--- a/crates/socket-patch-core/src/crawlers/walk_pool.rs
+++ b/crates/socket-patch-core/src/crawlers/walk_pool.rs
@@ -1,32 +1,28 @@
 //! The dedicated thread pool the npm crawler's parallel walks run on, and
 //! the file-descriptor budget that sizes it.
 //!
-//! Two properties of the old one-`spawn_blocking`-per-call async walk must
-//! survive the move to parallel sync walks:
+//! Two properties the parallel sync walks must provide:
 //!
-//! - **Stack depth.** The async walk recursed through `Box::pin` futures
-//!   polled on the `#[tokio::main]` thread (8 MiB on Unix, and on Windows
-//!   via the `/STACK` link flag in `.cargo/config.toml`). Rayon's and
-//!   tokio's worker threads default to 2 MiB, so the recursive gather runs
-//!   on pool threads built with the same 8 MiB ([`WALK_STACK_SIZE`]).
+//! - **Stack depth.** The recursive gather needs the same 8 MiB the
+//!   `#[tokio::main]` thread has (8 MiB on Unix, and on Windows via the
+//!   `/STACK` link flag in `.cargo/config.toml`). Rayon's and tokio's
+//!   worker threads default to 2 MiB, so it runs on pool threads built
+//!   with 8 MiB ([`WALK_STACK_SIZE`]).
 //!   When not even one walk thread could be spawned the walk falls back to
 //!   the blocking-pool thread and its 2 MiB: only `node_modules` nesting
 //!   depth is exposed there, since the workspace-roots walk (the one that
 //!   sees arbitrary project trees) is iterative.
-//! - **Descriptor headroom.** The sequential walk held at most one
-//!   directory stream (or package.json) open at a time, and the nine
-//!   ecosystem crawlers ran one after another. Every walker treats a failed
-//!   `read_dir`/open — `EMFILE` included — as "absent", so a process that
-//!   needs more descriptors than the old one would silently drop packages
-//!   under a tight `RLIMIT_NOFILE` the old one handled. Under such a limit
-//!   ([`fd_limit_is_tight`]) the pool gets ONE thread and the crawlers run
-//!   serially (the old descriptor profile); otherwise the thread count is
-//!   capped so the extra descriptors stay well inside the limit.
+//! - **Descriptor headroom.** Every walker treats a failed `read_dir`/open
+//!   — `EMFILE` included — as "absent", so running out of descriptors
+//!   silently drops packages. A single sequential walk holds at most one
+//!   directory stream (or package.json) open at a time; under a tight
+//!   `RLIMIT_NOFILE` ([`fd_limit_is_tight`]) the pool gets ONE thread and
+//!   the crawlers run serially to keep that profile; otherwise the thread
+//!   count is capped so the extra descriptors stay well inside the limit.
 //!
-//! Peak MEMORY has no such budget, and does not survive the move: the walk
-//! holds up to one package.json per walk thread at once (each read sizes
-//! its buffer from the file, with no cap), where the sequential walk held
-//! one. Real trees barely notice — package.json files are kilobytes — but
+//! Peak MEMORY has no such budget: the walk holds up to one package.json
+//! per walk thread at once (each read sizes its buffer from the file, with
+//! no cap), where a sequential walk would hold one. Real trees barely notice — package.json files are kilobytes — but
 //! one outsized file in an untrusted tree now costs [`walk_threads`]
 //! copies instead of one. Capping the read would change what the crawler
 //! inventories, so the trade is deliberate, not an oversight. What the
diff --git a/crates/socket-patch-core/src/lib.rs b/crates/socket-patch-core/src/lib.rs
index 5337ab26..04a2a6f9 100644
--- a/crates/socket-patch-core/src/lib.rs
+++ b/crates/socket-patch-core/src/lib.rs
@@ -15,7 +15,7 @@ pub mod vex;
 // Moved modules — these aliases keep the old top-level paths compiling for
 // external consumers of the published crate. Internal code must import the
 // canonical `setup::*` paths; CI greps reject new uses of the old ones.
-// Drop these aliases at 4.0.
+// Drop these aliases at 5.0.
 pub use setup::composer as composer_setup;
 pub use setup::gem as gem_setup;
 pub use setup::pypi as pth_hook;
diff --git a/crates/socket-patch-core/src/manifest/cleanup_blobs.rs b/crates/socket-patch-core/src/manifest/cleanup_blobs.rs
index bd572ab8..de3a3e74 100644
--- a/crates/socket-patch-core/src/manifest/cleanup_blobs.rs
+++ b/crates/socket-patch-core/src/manifest/cleanup_blobs.rs
@@ -429,7 +429,7 @@ mod tests {
 
         assert_eq!(result.blobs_removed, 2);
         // A wet sweep that orphaned everything leaves no empty `blobs/` husk
-        // behind (the residue a full agent-mode rollback used to leave).
+        // behind.
         assert!(
             !blobs_dir.exists(),
             "an emptied store directory is removed with its last orphan"
@@ -786,8 +786,8 @@ mod tests {
     #[tokio::test]
     async fn test_cleanup_dangling_symlink_does_not_abort() {
         // Regression: a single dangling symlink must not abort cleanup of every
-        // other orphan. Previously `tokio::fs::metadata(..)?` followed the link,
-        // hit a NotFound error, and propagated it out of the whole operation.
+        // other orphan (following the link would hit NotFound and propagate it
+        // out of the whole operation).
         use std::os::unix::fs::symlink;
 
         let dir = tempfile::tempdir().unwrap();
diff --git a/crates/socket-patch-core/src/manifest/operations.rs b/crates/socket-patch-core/src/manifest/operations.rs
index 641a2609..3590adeb 100644
--- a/crates/socket-patch-core/src/manifest/operations.rs
+++ b/crates/socket-patch-core/src/manifest/operations.rs
@@ -288,7 +288,7 @@ mod tests {
     }
 
     /// Deserializing straight into the struct rejects a REPEATED struct field
-    /// (the old `Value` round-trip silently kept the last value). A
+    /// (a `Value` round-trip would silently keep the last value). A
     /// hand-edited manifest with two `uuid` keys in one record is malformed
     /// and classified as a data error. The fixture is a raw string on purpose:
     /// `json!` would collapse the duplicate before the parser ever saw it.
diff --git a/crates/socket-patch-core/src/manifest/schema.rs b/crates/socket-patch-core/src/manifest/schema.rs
index d7d54b81..9dd8f04e 100644
--- a/crates/socket-patch-core/src/manifest/schema.rs
+++ b/crates/socket-patch-core/src/manifest/schema.rs
@@ -477,11 +477,10 @@ mod tests {
     // state ──
     //
     // The field doc promises `setup` is "omitted from the serialized form when
-    // empty so existing manifests are byte-stable." Before the fix, the skip
-    // predicate was `Option::is_none`, so a `Some` of an empty `SetupConfig`
-    // (which a load of `"setup": {}` produces, and which the also-then-dead
-    // `SetupConfig::is_empty` was written to detect) leaked a spurious
-    // `"setup":{}` key, breaking that contract.
+    // empty so existing manifests are byte-stable." A `Some` of an empty
+    // `SetupConfig` (which a load of `"setup": {}` produces) must not leak a
+    // spurious `"setup":{}` key, so the skip predicate (`setup_is_absent`)
+    // checks emptiness, not just `Option::is_none`.
 
     // A `Some` of an empty config must serialize byte-identically to `None`:
     // no `setup` key at all.
diff --git a/crates/socket-patch-core/src/package_json/detect.rs b/crates/socket-patch-core/src/package_json/detect.rs
index c0e4d811..782d01e6 100644
--- a/crates/socket-patch-core/src/package_json/detect.rs
+++ b/crates/socket-patch-core/src/package_json/detect.rs
@@ -765,8 +765,8 @@ mod tests {
 
     #[test]
     fn test_update_object_scripts_is_string_does_not_panic() {
-        // Regression: a present-but-non-object `scripts` previously panicked
-        // when indexed (`cannot access key "postinstall" in JSON string`).
+        // A present-but-non-object `scripts` must not panic when indexed
+        // (`cannot access key "postinstall" in JSON string`).
         let mut pkg: serde_json::Value = serde_json::json!({
             "name": "test",
             "scripts": "build"
@@ -804,7 +804,7 @@ mod tests {
 
     #[test]
     fn test_update_object_non_object_root_is_noop() {
-        // Regression: a non-object root previously panicked on `["scripts"] = ...`.
+        // A non-object root must not panic on `["scripts"] = ...`.
         let mut arr: serde_json::Value = serde_json::json!([1, 2, 3]);
         let (modified, _, _) = update_package_json_object(&mut arr, PackageManager::Npm);
         assert!(!modified);
@@ -891,10 +891,9 @@ mod tests {
     #[test]
     fn test_remove_script_empty_segment_no_patch_is_unchanged() {
         // Regression: a patch-free script with a stray empty segment (double
-        // `" && "`) must report `changed == false`. Keying `changed` off
-        // `kept.len() != segments.len()` previously returned `(true, ..)` here,
-        // violating the documented contract — `(true, ..)` means a socket-patch
-        // segment was removed, which did not happen.
+        // `" && "`) must report `changed == false` — `(true, ..)` means a
+        // socket-patch segment was removed, which did not happen, so
+        // `changed` must not be keyed off `kept.len() != segments.len()`.
         let (changed, new) = remove_socket_patch_from_script("echo a &&  && echo b");
         assert!(
             !changed,
@@ -944,8 +943,8 @@ mod tests {
     }
 
     /// A `&&` inside a QUOTED argument of a surviving user command also
-    /// splits at the operator scan, and the old canonical `" && "` rejoin
-    /// rewrote the user's bytes — `grep "a&&b"` became `grep "a && b"`,
+    /// splits at the operator scan, and a canonical `" && "` rejoin would
+    /// rewrite the user's bytes — `grep "a&&b"` becoming `grep "a && b"`,
     /// which greps a different pattern. Survivors must come back verbatim.
     #[test]
     fn test_remove_script_preserves_quoted_ampersands_in_survivors() {
diff --git a/crates/socket-patch-core/src/package_json/find.rs b/crates/socket-patch-core/src/package_json/find.rs
index 46d1112e..7912e153 100644
--- a/crates/socket-patch-core/src/package_json/find.rs
+++ b/crates/socket-patch-core/src/package_json/find.rs
@@ -157,11 +157,12 @@ async fn detect_workspaces(package_json_path: &Path) -> WorkspaceConfig {
         patterns: Vec::new(),
     };
 
-    // Check for pnpm workspaces first — pnpm projects may also have
-    // "workspaces" in package.json for compatibility, but pnpm-workspace.yaml
-    // is the definitive signal. It lives next to package.json and does not
-    // depend on package.json being present or even valid JSON, so it must be
-    // checked *before* parsing package.json — otherwise a malformed (e.g.
+    // Check vlt's workspace config (vlt.json / vlt-workspaces.json) and then
+    // pnpm-workspace.yaml first — pnpm projects may also have "workspaces" in
+    // package.json for compatibility, but these files are the definitive
+    // signal. They live next to package.json and do not depend on it being
+    // present or even valid JSON, so they must be checked *before* parsing
+    // package.json — otherwise a malformed (e.g.
     // JSONC, or simply broken) root manifest would wrongly demote a real pnpm
     // workspace to "no workspace".
     let dir = package_json_path.parent().unwrap_or(Path::new("."));
@@ -535,7 +536,7 @@ async fn search_one_level(dir: &Path, results: &mut Vec<PathBuf>) {
     for entry in list_dir_entries(dir).await {
         let path = entry.path();
         // A single-level `dir/*` glob follows a symlinked direct member, the
-        // way npm/pnpm (and our cargo `glob_dir`) resolve a workspace member
+        // way npm/pnpm resolve a workspace member
         // that is itself a symlink. `entry.file_type()` reports the *link's*
         // own type — `is_dir() == false` — so it would silently drop such a
         // member; stat the path instead so the link is followed. (The
@@ -646,7 +647,7 @@ mod tests {
 
     #[test]
     fn test_parse_pnpm_indented_key() {
-        // The parser uses `trimmed == "packages:"` so leading spaces should match
+        // The header is matched on the trimmed line, so leading spaces still match
         let yaml = "  packages:\n  - packages/*";
         assert_eq!(parse_pnpm_workspace_patterns(yaml), vec!["packages/*"]);
     }
@@ -731,7 +732,7 @@ mod tests {
     #[test]
     fn test_parse_pnpm_flow_sequence_on_line_after_header() {
         // The flow sequence may equally sit indented on its own line below the
-        // header (`packages:` then `  ['a']`). The next-section check used to
+        // header (`packages:` then `  ['a']`); the next-section check must not
         // break on the `[` line and drop every pattern.
         assert_eq!(
             parse_pnpm_workspace_patterns("packages:\n  ['packages/*', apps/*]"),
@@ -852,8 +853,7 @@ mod tests {
     #[tokio::test]
     async fn test_detect_workspaces_pnpm_with_malformed_package_json() {
         // Regression: pnpm-workspace.yaml is the definitive signal and must be
-        // honored even when the root package.json is not valid JSON. Previously
-        // the JSON parse error short-circuited before the pnpm check.
+        // honored even when the root package.json is not valid JSON.
         let dir = tempfile::tempdir().unwrap();
         let pkg = dir.path().join("package.json");
         // JSONC-style comment — valid for some tooling, invalid for serde_json.
@@ -1339,8 +1339,8 @@ mod tests {
     #[test]
     fn test_parse_pnpm_comment_only_list_item_skipped() {
         // A `- # comment` item is a YAML null (the value is just a comment) and
-        // must NOT become a literal `"# comment"` workspace pattern. Previously
-        // the inline-comment scan started at index 1, so a leading `#` survived.
+        // must NOT become a literal `"# comment"` workspace pattern (the
+        // inline-comment scan must consider index 0).
         let yaml = "packages:\n  - # only a comment\n  - real/*";
         assert_eq!(parse_pnpm_workspace_patterns(yaml), vec!["real/*"]);
     }
@@ -1494,11 +1494,10 @@ mod tests {
     #[cfg(unix)]
     #[tokio::test]
     async fn test_find_star_glob_follows_symlinked_member() {
-        // Regression: a single-level `packages/*` glob must follow a workspace
-        // member that is itself a symlink (npm/pnpm and our cargo `glob_dir`
-        // both resolve such members). `entry.file_type()` reports the link as a
-        // non-directory, so the old gate silently dropped it and `setup` never
-        // patched the package.
+        // A single-level `packages/*` glob must follow a workspace member that
+        // is itself a symlink (npm/pnpm resolve such members).
+        // `entry.file_type()` reports the link as a non-directory, so gating on
+        // it would drop the member and `setup` would never patch the package.
         let dir = tempfile::tempdir().unwrap();
         fs::write(
             dir.path().join("package.json"),
@@ -1671,10 +1670,9 @@ mod tests {
     async fn test_find_workspace_negation_excludes_member() {
         // npm (`@npmcli/map-workspaces`), yarn, and pnpm all support
         // `!`-prefixed exclusion patterns: a member matched by an earlier
-        // pattern and then negated is NOT a workspace member. Previously the
-        // `!pattern` was treated as a literal directory named `!packages`, so
-        // the exclusion was silently ignored and `setup` edited a package.json
-        // the user had explicitly excluded.
+        // pattern and then negated is NOT a workspace member. `!pattern` must
+        // not be treated as a literal directory named `!packages`, or `setup`
+        // edits a package.json the user explicitly excluded.
         let dir = tempfile::tempdir().unwrap();
         fs::write(
             dir.path().join("package.json"),
@@ -1738,8 +1736,7 @@ mod tests {
         // Globstar matches zero segments: npm/pnpm resolve members by globbing
         // `apps/**/package.json`, which matches `apps/package.json` itself. A
         // package living at the pattern's prefix directory is a workspace
-        // member too, not just its descendants — previously it was silently
-        // skipped and never configured.
+        // member too, not just its descendants.
         let dir = tempfile::tempdir().unwrap();
         fs::write(
             dir.path().join("package.json"),
diff --git a/crates/socket-patch-core/src/package_json/update.rs b/crates/socket-patch-core/src/package_json/update.rs
index 2c184d04..4eea2515 100644
--- a/crates/socket-patch-core/src/package_json/update.rs
+++ b/crates/socket-patch-core/src/package_json/update.rs
@@ -709,7 +709,7 @@ mod tests {
     /// `os.EOL`, so CRLF; an editor may add a BOM; some tools drop the final
     /// newline) must keep its layout through `setup`, and `setup --remove`
     /// must land byte-identical on the pre-setup file. serde's serializer
-    /// emits bare `\n` and no BOM, which used to flip every line to LF — a
+    /// emits bare `\n` and no BOM, which would flip every line to LF — a
     /// whole-file diff yarn then keeps (it follows the majority ending).
     #[tokio::test]
     async fn test_setup_then_remove_round_trips_crlf_bom_and_final_newline_shape() {
diff --git a/crates/socket-patch-core/src/patch/apply.rs b/crates/socket-patch-core/src/patch/apply.rs
index de890e33..14788d3e 100644
--- a/crates/socket-patch-core/src/patch/apply.rs
+++ b/crates/socket-patch-core/src/patch/apply.rs
@@ -87,8 +87,7 @@ impl AppliedVia {
 /// Patch sources the apply pipeline may use to obtain patched bytes.
 ///
 /// `blobs_path` is always required and serves as the universal fallback.
-/// `packages_path` and `diffs_path` are optional opt-ins to the new
-/// pathways introduced in socket-patch 2.2.
+/// `packages_path` and `diffs_path` are optional opt-ins.
 #[derive(Debug, Clone, Copy)]
 pub struct PatchSources<'a> {
     pub blobs_path: &'a Path,
@@ -143,9 +142,6 @@ pub struct ApplyResult {
     pub sidecar: Option<crate::patch::sidecars::SidecarRecord>,
 }
 
-/// Normalize file path by removing the "package/" prefix if present.
-/// Patch files come from the API with paths like "package/lib/file.js"
-/// but we need relative paths like "lib/file.js" for the actual package directory.
 /// A patch's files in file-name order: the verify and write loops walk
 /// this, not the `HashMap`, so the file named in a "Cannot apply patch"
 /// error (the first one that fails) and every per-file list are the same
@@ -158,6 +154,9 @@ pub(crate) fn files_in_order(
     ordered
 }
 
+/// Normalize file path by removing the "package/" prefix if present.
+/// Patch files come from the API with paths like "package/lib/file.js"
+/// but we need relative paths like "lib/file.js" for the actual package directory.
 pub(crate) fn normalize_file_path(file_name: &str) -> &str {
     const PACKAGE_PREFIX: &str = "package/";
     if let Some(stripped) = file_name.strip_prefix(PACKAGE_PREFIX) {
@@ -393,11 +392,10 @@ pub async fn select_installed_variants(
 /// files must look identical to pre-patch perms-wise):
 ///
 /// 1. **Existing file**. Snapshot mode + owner + group before writing.
-///    If the file is read-only, temporarily grant owner-write so the
-///    overwrite succeeds (e.g. Go's module cache marks sources read-only).
-///    After the write, restore the **exact** original mode and chown
-///    back to the pre-patch uid/gid. Owners stay put even when
-///    `tokio::fs::write` truncates and rewrites.
+///    The patched bytes land on a fresh inode (stage + rename), so a
+///    read-only target needs no write grant; only a read-only parent
+///    directory is relaxed for the write. After the rename, chown back
+///    to the pre-patch uid/gid, then restore the **exact** original mode.
 ///
 /// 2. **New file** (created by the patch). Inherit owner + group from
 ///    the parent directory and force mode `0o444` (read-only for all).
@@ -442,10 +440,8 @@ pub(crate) async fn apply_file_patch_at(
     }
     let filepath = pkg_path.join(normalized);
 
-    // Hash-check the in-memory content BEFORE touching disk. Removes
-    // the prior "wrote bytes, then post-write verify failed, can't
-    // restore" failure mode — if the upstream blob is corrupt we
-    // error out before any disk write.
+    // Hash-check the in-memory content BEFORE touching disk: a corrupt
+    // upstream blob errors out before any disk write.
     let content_hash = compute_git_sha256_from_bytes(patched_content);
     if content_hash != expected_hash {
         return Err(std::io::Error::new(
@@ -679,8 +675,8 @@ async fn restore_file_permissions(
     {
         match pre_patch {
             Some(meta) => {
-                // Re-apply the pre-patch readonly state; tokio::fs::write
-                // does not preserve it across the truncate+rewrite.
+                // Re-apply the pre-patch readonly state: the rename
+                // installed a fresh file that does not carry it.
                 let perms = meta.permissions();
                 tokio::fs::set_permissions(filepath, perms).await?;
             }
@@ -729,7 +725,7 @@ async fn chown_blocking(
 /// `uuid` is the patch UUID. Pass `Some` to enable package- and
 /// diff-archive lookup (the corresponding `sources.packages_path` /
 /// `sources.diffs_path` must also be set). Pass `None` to restrict the
-/// pipeline to per-file blobs only — equivalent to pre-2.2 behavior.
+/// pipeline to per-file blobs only.
 ///
 /// For npm packages, one on-disk `pkg_path` is not necessarily the only
 /// physical home of `package@version`: pnpm and vlt materialize a separate
@@ -1229,7 +1225,7 @@ mod tests {
         for bad in ["\\\\server\\share\\x", "C:\\Windows\\x"] {
             assert!(!is_safe_relative_subpath(bad), "should reject {bad:?}");
         }
-        // The `package/`-prefixed escape that previously slipped through:
+        // The `package/`-prefixed escape:
         // `package//etc/passwd` normalizes to `/etc/passwd`.
         assert!(!is_safe_relative_subpath(normalize_file_path(
             "package//etc/passwd"
@@ -1440,9 +1436,9 @@ mod tests {
         assert_eq!(tokio::fs::read(&store).await.unwrap(), b"original");
     }
 
-    /// Existing read-only file: temporarily made writable for the
-    /// overwrite, restored to read-only afterward, content updated.
-    /// Mirrors the Go module cache scenario.
+    /// Existing read-only file: the patched bytes replace it via stage +
+    /// rename and its 0o444 mode is restored bit-for-bit. Mirrors the Go
+    /// module cache scenario.
     #[cfg(unix)]
     #[tokio::test]
     async fn test_apply_file_patch_preserves_readonly_mode() {
@@ -1579,8 +1575,6 @@ mod tests {
     /// 0o444 AND directories 0o555). The stage+rename write path needs
     /// owner-write on the directory; `apply_file_patch_at` must grant it for
     /// the write and then restore the directory to its exact prior mode.
-    /// Regression: before the `DirWriteGuard` fix the stage-file creation
-    /// failed with EACCES and the patch could not be applied at all.
     #[cfg(unix)]
     #[tokio::test]
     async fn test_apply_file_patch_in_readonly_dir() {
@@ -1690,8 +1684,7 @@ mod tests {
 
     /// setuid/setgid bits survive the patch round-trip. `chown(2)` strips
     /// these bits even when the uid/gid are unchanged, so the restore
-    /// must chown BEFORE it chmods. Regression: the prior chmod-then-chown
-    /// order silently dropped the setuid bit on every patched file.
+    /// must chown BEFORE it chmods.
     #[cfg(unix)]
     #[tokio::test]
     async fn test_apply_file_patch_preserves_setuid_bit() {
@@ -1958,7 +1951,7 @@ mod tests {
     /// beforeHash mismatch across the three policies: the DEFAULT (Warn)
     /// overwrites with the verified patched content and keeps the
     /// promoted warning signature (`Ready` + `expected_hash: Some` +
-    /// differing `current_hash`); `Strict` is the old hard error; `Force`
+    /// differing `current_hash`); `Strict` is a hard error; `Force`
     /// behaves like Warn (its extra tolerance is missing files).
     #[tokio::test]
     async fn test_apply_package_patch_hash_mismatch_policies() {
@@ -2012,7 +2005,7 @@ mod tests {
             assert_eq!(written, patched, "{policy:?}");
         }
 
-        // Strict: the old fail-closed behavior, file untouched.
+        // Strict: fail-closed, file untouched.
         tokio::fs::write(pkg_dir.path().join("index.js"), divergent)
             .await
             .unwrap();
@@ -2141,7 +2134,7 @@ mod tests {
 
     // ── Fallback-chain tests ─────────────────────────────────────────
     //
-    // Tests below exercise the new strategies introduced in 2.2:
+    // Tests below exercise the archive strategies:
     // package archive (.socket/packages/<uuid>.tar.gz) and per-file diff
     // archive (.socket/diffs/<uuid>.tar.gz), plus the priority order
     // package → diff → blob.
@@ -2345,7 +2338,7 @@ mod tests {
     #[tokio::test]
     async fn test_apply_uuid_none_disables_alt_sources() {
         // Even if archives exist, passing `uuid = None` must restrict the
-        // pipeline to the blob path — preserving pre-2.2 behavior.
+        // pipeline to the blob path.
         let (_root, pkg_dir, blobs_dir, packages_dir, diffs_dir, files, _orig, _patched) =
             make_fixture().await;
 
@@ -2484,10 +2477,8 @@ mod tests {
 
     /// New file in a NEW subdirectory inside a read-only package
     /// directory. Go's module cache marks directories 0o555; a patch that
-    /// adds a file under a not-yet-existing subdir must still apply.
-    /// Regression: `create_dir_all` ran before any directory-permission
-    /// relaxation, so the mkdir failed with EACCES and the patch could not
-    /// be applied at all. The directory's mode must be restored afterward.
+    /// adds a file under a not-yet-existing subdir must still apply, and
+    /// the directory's mode must be restored afterward.
     #[cfg(unix)]
     #[tokio::test]
     async fn test_apply_file_patch_new_file_in_new_subdir_of_readonly_dir() {
@@ -2590,13 +2581,9 @@ mod tests {
     /// against a file that can actually discriminate between
     /// distributions. A NEW file (empty `beforeHash`) verifies Ready
     /// against ANY environment, so it must never be the basis for
-    /// selecting a variant. Regression: the representative file was taken
-    /// via `HashMap::iter().next()`, whose order is randomized per map
-    /// instance — whenever the new file came up first, a variant
-    /// describing a different, NOT-installed distribution matched, and
-    /// the result flipped between runs (wrong-variant rollback attempts,
-    /// wrong variants kept by `get`). The loop re-builds the maps each
-    /// round so the randomized iteration order is exercised.
+    /// selecting a variant, whatever the `HashMap` iteration order. The
+    /// loop re-builds the maps each round so the randomized iteration
+    /// order is exercised.
     #[tokio::test]
     async fn test_select_installed_variants_new_file_never_drives_selection() {
         let dir = tempfile::tempdir().unwrap();
@@ -2692,7 +2679,7 @@ mod tests {
         assert!(sources.diffs_path.is_none());
     }
 
-    /// Regression (retried partial apply wedges cargo): a previous apply
+    /// Retried partial apply must not wedge cargo: a previous apply
     /// that failed partway (e.g. a missing blob for the second file) left
     /// the first file PATCHED on disk but returned before the sidecar
     /// boundary, so `.cargo-checksum.json` still carries that file's
@@ -3291,9 +3278,8 @@ mod tests {
     // ── hygiene / hardening pins ─────────────────────────────────────
 
     /// A manifest key whose parent component is a regular FILE: the open
-    /// fails ENOTDIR (Windows: path-not-found), which must read exactly like
-    /// the old `metadata` probe did — "File not found" for a pre-existing
-    /// entry, `Ready` for a new-file entry (the write then fails in mkdir).
+    /// fails ENOTDIR (Windows: path-not-found), which must read as a
+    /// missing file — "File not found" for a pre-existing entry, `Ready` for a new-file entry (the write then fails in mkdir).
     #[tokio::test]
     async fn test_verify_file_patch_parent_is_regular_file_reports_not_found() {
         let dir = tempfile::tempdir().unwrap();
@@ -3318,10 +3304,10 @@ mod tests {
     }
 
     /// SECURITY: `afterHash` is joined onto the blobs directory. A committed
-    /// manifest carrying `afterHash: "../outside"` used to make apply read
+    /// manifest carrying `afterHash: "../outside"` must not make apply read
     /// the out-of-tree file and echo its content hash back in the mismatch
-    /// error (an oracle). The disk-blob read now refuses anything that is
-    /// not a 64-hex blob hash before any path is built.
+    /// error (an oracle): the disk-blob read refuses anything that is not a
+    /// 64-hex blob hash before any path is built.
     #[tokio::test]
     async fn test_apply_package_patch_refuses_invalid_blob_hash() {
         let root = tempfile::tempdir().unwrap();
@@ -3474,10 +3460,9 @@ mod tests {
         assert_eq!(written, patched);
     }
 
-    /// A write failure under the archive strategy used to be swallowed as
-    /// "not applicable" and the pipeline fell through to the blob, so the
-    /// user saw `Failed to read blob …: No such file` while the real
-    /// failure was the write. The write error must surface as itself.
+    /// A write failure under the archive strategy must surface as itself,
+    /// not be swallowed as "not applicable" and reported as the blob
+    /// fallback's `Failed to read blob …: No such file`.
     /// `chflags uchg` on the package dir is the unprivileged deterministic
     /// route to a stage-creation failure (the guard defeats 0o555).
     #[cfg(target_os = "macos")]
diff --git a/crates/socket-patch-core/src/patch/apply_lock.rs b/crates/socket-patch-core/src/patch/apply_lock.rs
index d1b155cd..48cefbb7 100644
--- a/crates/socket-patch-core/src/patch/apply_lock.rs
+++ b/crates/socket-patch-core/src/patch/apply_lock.rs
@@ -698,12 +698,10 @@ mod tests {
         assert!(is_lock_contended(&fs2::lock_contended_error()));
     }
 
-    /// Regression: genuine I/O failures of `try_lock_exclusive` must
-    /// NOT masquerade as contention. Previously every error funnelled
-    /// into the retry/`Held` path, so a real fault (e.g. ENOLCK on a
-    /// full kernel lock table, or a filesystem without advisory locks)
-    /// was reported as "another process is operating here" — and, with
-    /// a positive timeout, only after busy-sleeping the entire budget.
+    /// Genuine I/O failures of `try_lock_exclusive` must NOT masquerade
+    /// as contention: a real fault (e.g. ENOLCK on a full kernel lock
+    /// table, or a filesystem without advisory locks) must never be
+    /// reported as "another process is operating here".
     #[test]
     fn genuine_io_errors_are_not_contention() {
         use std::io::{Error, ErrorKind};
@@ -772,8 +770,6 @@ mod tests {
     fn overflowing_timeout_does_not_panic_when_free() {
         let dir = tempfile::tempdir().unwrap();
         let socket = socket_dir(&dir);
-        // Would panic ("overflow when adding duration to instant") under
-        // the old `Instant::now() + timeout`.
         let guard = acquire(&socket, Duration::from_secs(u64::MAX)).unwrap();
         assert!(socket.join("apply.lock").is_file());
         drop(guard);
@@ -783,7 +779,7 @@ mod tests {
     /// Regression companion: with an overflowing (effectively infinite)
     /// timeout AND a contended lock, `acquire` must *wait* — not panic
     /// and not give up — and then succeed once the holder releases.
-    /// Proves both the no-overflow-panic fix and that a `None` deadline
+    /// Proves both that nothing overflows and that a `None` deadline
     /// never spuriously elapses into `Held`. The holder's release also
     /// unlinks the file and prunes `.socket/`, so the parked waiter has
     /// to recreate both — the mkdir-inside-the-loop path.
@@ -805,9 +801,8 @@ mod tests {
             drop(dir2);
         });
 
-        // u64::MAX seconds == astronomically large; under the bug this
-        // panics before ever sleeping. With the fix it waits indefinitely
-        // and acquires once `held` drops above.
+        // u64::MAX seconds: waits indefinitely and acquires once `held`
+        // drops above.
         let start = Instant::now();
         let guard = acquire(&socket, Duration::from_secs(u64::MAX)).unwrap();
         let waited = start.elapsed();
@@ -833,9 +828,8 @@ mod tests {
     /// now, or nothing) and send it back around the loop, where it either
     /// wins the free window itself or sees the fresh holder and reports
     /// `Held`. Both are correct; two live guards at once is the bug this
-    /// pins, and — unlike the pre-identity-check protocol, which merely
-    /// called that window "vanishingly rare" — it is now impossible, so
-    /// every iteration asserts it outright.
+    /// pins, and the identity check makes it impossible, so every
+    /// iteration asserts it outright.
     #[test]
     fn waiter_does_not_lock_orphaned_inode_after_holder_release() {
         use std::sync::mpsc;
@@ -1096,8 +1090,7 @@ mod tests {
             }
         }
         // The fault arm returns without ever entering the retry/backoff
-        // path: nowhere near the 5 s budget (the old funnel-everything-
-        // into-retry behaviour slept the full budget before erroring).
+        // path: nowhere near the 5 s budget.
         assert!(
             elapsed < Duration::from_secs(1),
             "Io fault must not burn the retry budget, took {:?}",
@@ -1135,7 +1128,7 @@ mod tests {
     }
 
     /// The retry loop must not overshoot the deadline by a full sleep
-    /// quantum. A 150 ms budget should resolve well under the old
+    /// quantum. A 150 ms budget should resolve well under an unclamped
     /// fixed-100 ms-sleep worst case (~200 ms) — the final sleep is
     /// clamped to the remaining slice.
     #[test]
@@ -1154,7 +1147,7 @@ mod tests {
         );
         // Loose upper bound: clamped sleeps mean we don't blow well past
         // the budget. Generous slack keeps slow CI hosts non-flaky while
-        // still failing the old uncapped behaviour's pathological cases.
+        // still failing an unclamped sleep's pathological cases.
         assert!(
             elapsed < Duration::from_millis(450),
             "clamped sleep should keep us near the budget, got {:?}",
diff --git a/crates/socket-patch-core/src/patch/copy_tree.rs b/crates/socket-patch-core/src/patch/copy_tree.rs
index 1081b357..5d2fb5b4 100644
--- a/crates/socket-patch-core/src/patch/copy_tree.rs
+++ b/crates/socket-patch-core/src/patch/copy_tree.rs
@@ -19,7 +19,8 @@ fn to_io<E: std::fmt::Display>(e: E) -> std::io::Error {
 /// mirroring the cache's read-only modes, so the copy can be patched and later
 /// removed without a chmod dance. File *contents* are copied via
 /// `std::fs::copy`, which also carries the source's mode bits (often `0o444` in
-/// the cache); the downstream apply pipeline grants write as needed, and
+/// the cache); the downstream apply pipeline replaces files via stage +
+/// rename (no write grant needed), and
 /// [`remove_tree`] relaxes perms on cleanup. Symlinks / specials are skipped —
 /// crates.io registry and Go module-cache sources contain none, and copying a
 /// dangling link would be unsafe.
diff --git a/crates/socket-patch-core/src/patch/diff.rs b/crates/socket-patch-core/src/patch/diff.rs
index b6cae266..783857d4 100644
--- a/crates/socket-patch-core/src/patch/diff.rs
+++ b/crates/socket-patch-core/src/patch/diff.rs
@@ -167,15 +167,8 @@ mod tests {
 
     #[test]
     fn test_apply_diff_forged_oversize_header_is_safe() {
-        // Regression: `apply_diff` used to feed `hint_target_size()` straight
-        // into `Vec::with_capacity`. That field is the bsdiff header's target
-        // size (little-endian bytes 24..32) and is NOT validated by qbsdiff
-        // against the real payload, so a corrupt/hostile delta can claim an
-        // enormous size. A multi-exabyte `with_capacity` aborts the process
-        // (allocator failure) or panics with "capacity overflow" — neither is
-        // recoverable, which would let a single bad patch take the tool down.
-        //
-        // We build a genuine, small delta and then overwrite only the target
+        // The header's target size (bytes 24..32) is unvalidated; see
+        // `MAX_PREALLOC_BYTES`. We build a genuine, small delta and then overwrite only the target
         // size field with ~1.15 EiB. Because `apply` is driven by the control
         // stream and ignores the hint, the clamp lets the patch still produce
         // the correct bytes instead of dying on the allocation.
@@ -197,15 +190,9 @@ mod tests {
 
     #[test]
     fn test_apply_diff_forged_negative_block_length_does_not_panic() {
-        // Regression: qbsdiff's `parse` reads the control/diff block lengths
-        // (header bytes 8..16 and 16..24) via a sign-magnitude decoder, casts
-        // them to `u64`, and checks `32 + csize + dsize > patch.len()` with
-        // *wrapping* arithmetic before doing `split_at(csize)`. A header whose
-        // csize field has the high bit set decodes to a "negative" length whose
-        // `as u64` is enormous; the sum wraps back under `patch.len()`, slips
-        // past the guard, and then `split_at(huge)` panics (or the add itself
-        // panics in debug builds). `apply_diff` must reject such a header as a
-        // normal `io::Error`, upholding its never-panic-on-bad-input contract.
+        // A csize field with the sign bit set would panic qbsdiff's parser
+        // (see `validate_bsdiff_header`); `apply_diff` must reject it as a
+        // normal `io::Error`.
         let before = b"the quick brown fox jumps over the lazy dog";
         let after = b"the quick brown cat jumps over the lazy dog";
         let mut forged = make_delta(before, after);
diff --git a/crates/socket-patch-core/src/patch/mod.rs b/crates/socket-patch-core/src/patch/mod.rs
index 39474f55..9d73089a 100644
--- a/crates/socket-patch-core/src/patch/mod.rs
+++ b/crates/socket-patch-core/src/patch/mod.rs
@@ -1,7 +1,6 @@
 pub mod apply;
 pub mod apply_lock;
-// Ungated: the vendor backends (npm/pypi/gem are unconditional) stage their
-// patched copies with `fresh_copy`/`remove_tree`, not just the golang redirect.
+// `fresh_copy`/`remove_tree` are shared by the Go redirect and the vendor backends.
 pub mod copy_tree;
 pub mod diff;
 pub(crate) mod file_hash;
@@ -14,7 +13,7 @@ pub mod sidecars;
 // Moved modules — these re-exports keep the old `patch::*` paths compiling
 // for external consumers of the published crate. Internal code must import
 // the new canonical paths (`crate::vendor::*`, `redirect::golang_local`);
-// CI greps reject new uses of the old ones. Drop these aliases at 4.0.
+// CI greps reject new uses of the old ones. Drop these aliases in the next major.
 pub use crate::vendor;
 pub use crate::vendor::go_mod_edit;
 pub use redirect::golang_local as go_redirect;
diff --git a/crates/socket-patch-core/src/patch/package.rs b/crates/socket-patch-core/src/patch/package.rs
index 54ed7a7f..fe41c446 100644
--- a/crates/socket-patch-core/src/patch/package.rs
+++ b/crates/socket-patch-core/src/patch/package.rs
@@ -446,12 +446,8 @@ mod tests {
 
     #[test]
     fn test_read_archive_rejects_double_slash_package_escape() {
-        // Regression: validation must run on the POST-strip path. The raw
-        // entry `package//etc/passwd` passes every pre-strip check (not
-        // absolute, no leading separator, the `//` collapses so no `..`),
-        // but `strip_prefix("package/")` yields the absolute path
-        // `/etc/passwd`. `pkg_path.join("/etc/passwd")` discards the base
-        // and writes to `/etc/passwd` — an out-of-tree arbitrary write.
+        // Validation must run on the POST-strip path: `package//etc/passwd`
+        // strips to the absolute `/etc/passwd` (see `read_archive_from_reader`).
         let dir = tempfile::tempdir().unwrap();
         let archive = dir.path().join("arc.tar.gz");
         write_raw_archive(&archive, b"package//etc/passwd", b"evil");
@@ -817,8 +813,9 @@ mod tests {
         let dir = tempfile::tempdir().unwrap();
         let archive = dir.path().join("bomb.tar.gz");
 
-        // Two entries of (max - 1) MiB each = 30 MiB declared, but
-        // gzip compresses zeroes ~1000x so the on-disk archive is small.
+        // Five entries of (MAX_ENTRY_BYTES - 1) bytes each (~16 MiB,
+        // ~80 MiB declared in total), but gzip compresses zeroes ~1000x
+        // so the on-disk archive is small.
         // We don't need to *exceed* 64 MiB — the cap is enforced
         // strictly, so an entry that crosses it will be truncated.
         let chunk = vec![0u8; (MAX_ENTRY_BYTES - 1) as usize];
@@ -826,8 +823,8 @@ mod tests {
         let entry2 = raw_entry(b"b.bin", chunk.len() as u64, &chunk);
         let entry3 = raw_entry(b"c.bin", chunk.len() as u64, &chunk);
         let entry4 = raw_entry(b"d.bin", chunk.len() as u64, &chunk);
-        // 4 * 15 MiB = 60 MiB declared, just under the 64 MiB cap.
-        // Add a fifth to push us over.
+        // Four payloads come to 4 bytes under the 64 MiB cap; a fifth
+        // pushes past it.
         let entry5 = raw_entry(b"e.bin", chunk.len() as u64, &chunk);
         write_raw_tar_gz(&archive, &[entry1, entry2, entry3, entry4, entry5]);
 
@@ -835,7 +832,7 @@ mod tests {
         // Either we get an Io error from truncation or the read
         // succeeds with the first ~4 entries — both prove the cap
         // prevented unbounded growth. Failure mode we want to RULE
-        // OUT: reading all 5 entries (~75 MiB) without error.
+        // OUT: reading all 5 entries (~80 MiB) without error.
         match result {
             Err(_) => { /* defused via Io / truncation */ }
             Ok(map) => {
diff --git a/crates/socket-patch-core/src/patch/redirect/cargo_lock_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/cargo_lock_equivalence_tests.rs
index b0311422..ad4e20a0 100644
--- a/crates/socket-patch-core/src/patch/redirect/cargo_lock_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/cargo_lock_equivalence_tests.rs
@@ -165,7 +165,7 @@ fn bound_matches_unbounded_on_hand_written_edges() {
     }
 }
 
-/// The CG1 guard shape: ≥1k blocks, where the unbounded search was
+/// The large-lock shape: ≥1k blocks, where the unbounded search was
 /// quadratic. Checked at every block body (what `plan_cargo_lock` asks for)
 /// and along the `next_lock_block` walk its dependents loop takes.
 #[test]
diff --git a/crates/socket-patch-core/src/patch/redirect/composer_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/composer_equivalence_tests.rs
index 32b14c22..488c5f74 100644
--- a/crates/socket-patch-core/src/patch/redirect/composer_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/composer_equivalence_tests.rs
@@ -498,7 +498,7 @@ fn byte_walk_matches_the_char_walk() {
     }
 }
 
-/// Runs the oracle over the Phase 3 benchmark composer.lock (too large to
+/// Runs the oracle over a large benchmark composer.lock (too large to
 /// commit) when `SOCKET_PATCH_COMPOSER_FIXTURE` names it, redirecting every
 /// package; a no-op otherwise.
 #[test]
diff --git a/crates/socket-patch-core/src/patch/redirect/golang_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/golang_equivalence_tests.rs
index 43a16f74..7ac73360 100644
--- a/crates/socket-patch-core/src/patch/redirect/golang_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/golang_equivalence_tests.rs
@@ -614,7 +614,7 @@ fn single_walk_golang_rewrite_matches_oracle() {
     }
 }
 
-/// Runs the oracle over the Phase 3 benchmark go.mod / go.sum pairs (too
+/// Runs the oracle over the benchmark go.mod / go.sum pairs (too
 /// large to commit) when `SOCKET_PATCH_GO_FIXTURES` names their directory,
 /// redirecting every required module; a no-op otherwise.
 #[test]
diff --git a/crates/socket-patch-core/src/patch/redirect/golang_local.rs b/crates/socket-patch-core/src/patch/redirect/golang_local.rs
index 04e8db89..feb2ea22 100644
--- a/crates/socket-patch-core/src/patch/redirect/golang_local.rs
+++ b/crates/socket-patch-core/src/patch/redirect/golang_local.rs
@@ -15,8 +15,7 @@
 //! `go mod verify` keeps passing and other projects are unaffected), and removal
 //! is clean (drop the directive → the build falls back to the cache). A
 //! local-path `replace` target is **not** `go.sum` content-verified, so the
-//! patched bytes build cleanly under the default `-mod=readonly` (validated
-//! empirically — see project memory).
+//! patched bytes build cleanly under the default `-mod=readonly`.
 //!
 //! The copy is produced by **delegating to the hardened
 //! [`apply_package_patch`] pipeline** pointed at the fresh copy, reusing all the
diff --git a/crates/socket-patch-core/src/patch/redirect/group_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/group_equivalence_tests.rs
index ce3a2879..d6fb3831 100644
--- a/crates/socket-patch-core/src/patch/redirect/group_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/group_equivalence_tests.rs
@@ -1,4 +1,4 @@
-//! H4 equivalence: the rewriter groups run concurrently and merged in order
+//! Group equivalence: the rewriter groups run concurrently and merged in order
 //! produce the same [`RewriteResult`] — every channel, edits and warnings in
 //! order — as the serial chain they replaced.
 
diff --git a/crates/socket-patch-core/src/patch/redirect/mod.rs b/crates/socket-patch-core/src/patch/redirect/mod.rs
index ef1b56cb..9f03dbaa 100644
--- a/crates/socket-patch-core/src/patch/redirect/mod.rs
+++ b/crates/socket-patch-core/src/patch/redirect/mod.rs
@@ -1,4 +1,4 @@
-//! Registry-redirect rewriters (the `scan --redirect` engine).
+//! Registry-redirect rewriters (the hosted-mode `scan` engine).
 //!
 //! Rewrites lockfiles / registry configs so ONLY the patched dependency points
 //! at Socket's HOSTED vendored patches — the Rust counterpart of the depscan
@@ -7,7 +7,8 @@
 //! `tests/fixtures/redirect/` (see `tests/redirect_golden.rs`): a fixture's
 //! `expected/` bytes are produced identically by the TS backend (the GitHub-app
 //! PR flow) and by this CLI, so a customer gets the same result whether Socket
-//! opens the PR or they run `socket-patch scan --redirect` locally.
+//! opens the PR or they run `socket-patch scan --mode hosted` (or a bare
+//! `socket-patch scan`) locally.
 //!
 //! Python lockfiles use TOML-aware edits to keep source identities consistent.
 //! Other non-JSON formats use targeted text edits; JSON uses `serde_json` with
@@ -753,7 +754,7 @@ fn rewrite_npm_lock(
     // `package-lock.json` beside any committed `npm-shrinkwrap.json` on first
     // install and reifies the install FROM `package-lock.json`. So the
     // dual-lock state is the DEFAULT for a shrinkwrap repo under npm 12.
-    // Rewriting only the first present lock patched the file npm doesn't
+    // Rewriting only the first present lock would patch the file npm doesn't
     // install from — a silent FALSE SUCCESS. Rewrite EVERY present npm lock so
     // a fresh `npm install`/`npm ci` from EITHER is redirected (shrinkwrap-only
     // repos on npm <= 6 keep working: only that one file is present).
@@ -2714,8 +2715,7 @@ fn plan_cargo_toml(
             }
             // Plain version: `crate = "1.0"` (+ optional trailing comment).
             // The rewrite is line-scoped, so the trailing newline / blank
-            // line after the entry is untouched (the old `\s*$` regex
-            // swallowed it).
+            // line after the entry is untouched.
             let c = regex::escape(crate_name);
             let line_re = Regex::new(&format!(
                 r#"^(\s*(?:{c}|"{c}")\s*=\s*)"([^"]+)"([ \t]*(?:#.*)?)$"#
@@ -3010,8 +3010,8 @@ fn plan_cargo_lock(
     // `redirect_cargo_lock_reference` edit holding just the quoted id —
     // never a dependent's whole block: a block referencing two patched
     // packages (the root of a v1 lock) would hold two overlapping block
-    // edits, and reverting the first-applied one alone found neither of its
-    // fragments. The id names this name + version + source exactly, so its
+    // edits, and reverting the first-applied one alone would find neither of
+    // its fragments. The id names this name + version + source exactly, so its
     // inverse puts back EVERY occurrence, independently of any other
     // package's edits and in any removal order.
     if let Some(old) = old_source.filter(|old| old != index_url) {
@@ -3157,9 +3157,9 @@ struct CargoConfigPlan {
 /// HEALTHY block is already wired in — an uncommented header with an
 /// uncommented `index = "<index_url>"` line. Comments never satisfy the
 /// check: a user who commented the managed block out gets it restored on the
-/// next run (the old substring test matched the commented text, reported
-/// success, and left `registry = "socket-patch-…"` in Cargo.toml naming an
-/// undefined registry). A degraded block (missing/stale index line) is
+/// next run (a substring test would match the commented text and leave
+/// `registry = "socket-patch-…"` in Cargo.toml naming an undefined
+/// registry). A degraded block (missing/stale index line) is
 /// regenerated in place — it is ours, the header grammar proves it.
 fn plan_cargo_config(
     config: &str,
@@ -3564,8 +3564,7 @@ fn rewrite_pnpm_lock(
             }
         }
         // ANY residual anywhere refuses the dep across the WHOLE lock set —
-        // nothing rewritten, nothing recorded, nothing confirmed (the same
-        // fail-closed contract the pre-splice v5/v6 refusal had): a rewrite
+        // nothing rewritten, nothing recorded, nothing confirmed: a rewrite
         // committed in one lock while another still resolves the dep
         // upstream would confirm the dep set-wide.
         if !residuals.is_empty() {
@@ -3921,8 +3920,8 @@ fn berry_cache_key(content: &str) -> Option<String> {
 /// Exposed so the vendored→hosted mode takeover (`scan`/`get --mode hosted`
 /// over a vendored berry purl) can refuse BEFORE it reverts the vendored
 /// wiring: the vendored revert never refuses on line endings (it keeps a
-/// mixed lock mixed), so without this preflight the takeover stripped the
-/// live vendored patch and then this rewriter refused the lock, leaving the
+/// mixed lock mixed), so without this preflight the takeover would strip the
+/// live vendored patch and then this rewriter would refuse the lock, leaving the
 /// package unpatched in both modes — the bun twin is
 /// [`preflight_bun_hosted`].
 ///
@@ -4043,7 +4042,7 @@ fn rewrite_yarn_berry(
             });
             continue;
         };
-        // Berry versions are UNQUOTED (`  version: 1.3.0`, spike B3 ground truth).
+        // Berry versions are UNQUOTED (`  version: 1.3.0`).
         let version_re =
             Regex::new(&(String::from(r"\n {2}version: ") + &regex::escape(&dep.version) + "\n"))
                 .expect("version regex from the escaped version is valid");
@@ -4118,8 +4117,8 @@ fn rewrite_yarn_berry(
             }
             // Descriptor ranges carry a protocol; only an `npm:` range names
             // a registry tarball this rewriter can own. A `patch:` range
-            // (yarn's OWN builtin compat patches — the 2026-07 strapi
-            // incident family), `workspace:`, `portal:`, or `link:` block
+            // (including yarn's OWN builtin compat patches), `workspace:`,
+            // `portal:`, or `link:` block
             // must survive byte-identically: splicing an npm resolution
             // under such a key corrupts the key/resolution protocol pairing.
             // Mirrors the vendor backend's fail-closed gate
@@ -4144,9 +4143,10 @@ fn rewrite_yarn_berry(
                 // the real way out. `remove <purl>` is the per-package
                 // retirement; `vendor --revert` works too but unwinds EVERY
                 // vendored package, so it is scoped, not recommended. The
-                // remedy holds whether or not a vendored→hosted pre-revert
-                // ever lands for npm-family — today no berry counterpart of
-                // the cargo takeover exists.
+                // CLI's vendored→hosted takeover (scan/hosted.rs) reverts
+                // ledger-recorded vendored npm purls, berry included, before
+                // this rewriter runs; this refusal is only reached when that
+                // wiring was not taken over (e.g. no vendor ledger entry).
                 if ranges
                     .iter()
                     .any(|r| r.starts_with("file:") && r.contains(".socket/vendor/"))
@@ -4808,10 +4808,9 @@ fn rewrite_uv_lock(
 /// `\/`-escaped slashes an older composer wrote, which redirect the install just
 /// as well. Shared by the composer rewriter's already-redirected check and the
 /// CLI's post-rewrite confirmation probe so the writer's spelling and the
-/// probe's cannot drift: the probe searched only raw and percent-encoded urls
-/// while the composer rewriter emitted `\/`, so a fully successful composer
-/// redirect reported nothing redirected — no patch record reached the ledger and
-/// `vex` had nothing to attest.
+/// probe's cannot drift: a probe blind to `\/` would report a fully
+/// successful composer redirect as nothing redirected, leaving `vex` nothing
+/// to attest.
 pub fn artifact_url_present(text: &str, artifact_url: &str) -> bool {
     text.contains(artifact_url) || text.contains(&artifact_url.replace('/', "\\/"))
 }
@@ -4885,8 +4884,8 @@ enum ComposerEntry {
 /// hand-written mixed-case locks install fine and would otherwise silently miss
 /// the redirect. The locked version must match the patched one through
 /// composer's leading-`v` normalization (locks carry the pretty `v6.4.1`, PURLs
-/// the bare `6.4.1`); matching on name alone repointed whatever version the
-/// lock happened to hold at a patch built for a different one.
+/// the bare `6.4.1`); matching on name alone would repoint whatever version
+/// the lock happened to hold at a patch built for a different one.
 fn find_composer_entry(content: &str, pkg: &str, version: &str) -> ComposerEntry {
     let mut mismatched: Option<String> = None;
     for (name_idx, _) in content.match_indices("\"name\": \"") {
@@ -4921,8 +4920,8 @@ fn find_composer_entry(content: &str, pkg: &str, version: &str) -> ComposerEntry
 
 /// Append `"shasum": "<sha1>"` as the last key of a `"dist": { … }` block,
 /// indented like the keys already in it. VCS/zipball dists omit `shasum`
-/// entirely; redirecting such a block without inserting the pin left the hosted
-/// artifact unverified, so composer would install whatever the URL returned.
+/// entirely; redirecting such a block without inserting the pin would leave the
+/// hosted artifact unverified, so composer would install whatever the URL returned.
 /// `block` is the whole dist object and already holds at least a `url`.
 fn append_composer_shasum(block: &str, sha1: &str) -> String {
     let Some(close) = block.rfind('}') else {
@@ -5027,7 +5026,7 @@ fn rewrite_composer_lock(
                 }
             };
         // The dist block MUST belong to the located entry. Scanning forward
-        // from the name for the next `"dist": {` walked into the FOLLOWING
+        // from the name for the next `"dist": {` would walk into the FOLLOWING
         // package whenever the target was installed from source, repointing a
         // bystander's url + shasum — a checksum-clean install of the wrong
         // code. A target with no dist of its own pins nothing: fail closed.
@@ -5105,8 +5104,8 @@ fn rewrite_composer_lock(
                 }
             };
         if rewritten != original {
-            // In place: a fresh whole-lock copy per edit left the allocator
-            // holding one lock-sized buffer per redirected dep.
+            // In place: a fresh whole-lock copy per edit would hold one
+            // lock-sized buffer per redirected dep.
             content.replace_range(edit_start..=dist_end, &rewritten);
             changed = true;
             result.edits.push(FileEdit {
@@ -5492,7 +5491,7 @@ fn rewrite_nuget(
 /// version-constraint args (`"7.0.0"`, `'~> 7.0'`, `">= 1", "< 2"`) — i.e. the
 /// options (`require: false`, `group: :test`, …) that must survive the move
 /// into the source block. Empty when the line carries none; bails to empty on
-/// an unparseable tail (unbalanced quote), matching the previous behavior.
+/// an unparseable tail (unbalanced quote).
 /// Shared with the vendor backend's Gemfile rewrite (`vendor::gem`),
 /// which has the same drop-the-options failure mode.
 pub(crate) fn gem_line_trailing_options(tail: &str) -> String {
@@ -5675,8 +5674,8 @@ pub fn hosted_patch_url_uuids(url: &str, extra_origins: &[String]) -> Option<Vec
 /// A dep's Socket index URL as a regex source with the per-request rotating
 /// segments (grant token, patch uuid) wildcarded — an exact-URL pattern
 /// misses the URL a previous run wrote under an older grant. The grant token
-/// is wildcarded even when the caller left `dep.token` empty (the CLI
-/// historically never populated it): the token path level is derived from
+/// is wildcarded even when the caller left `dep.token` empty: the token path
+/// level is derived from
 /// the index URL itself as the segment immediately preceding the patch-uuid
 /// level, so the idempotency guard never silently degrades into the
 /// nesting-corruption failure mode when a caller forgets the token.
@@ -5780,7 +5779,7 @@ struct GemLockSection {
 /// into `result`); false when the dep cannot be attributed safely — spec
 /// entry absent or duplicated, a legacy multi-remote `GEM` section, or no
 /// DEPENDENCIES section — in which case nothing is touched and the caller
-/// surfaces the frozen-install caveat exactly as before.
+/// surfaces the frozen-install caveat.
 fn converge_gem_lock_source(
     lk: &mut String,
     dep: &DepOverride,
@@ -5935,7 +5934,7 @@ fn converge_gem_lock_source(
         // frozen mode can't update the lockfile") any difference is fatal:
         // "Your lockfile needs to be updated, but it can't be because frozen
         // mode is set". Appending after `https://rubygems.org/` when the
-        // patch registry (`https://patch.socket.dev/…`) sorts first broke
+        // patch registry (`https://patch.socket.dev/…`) sorts first would break
         // every converged hosted pair under `BUNDLE_FROZEN` / deployment
         // mode (verified: 4.0.15 installs it, 4.0.21 refuses it).
         let mut last = spec_idx;
@@ -6050,8 +6049,8 @@ fn rewrite_gem(
     // Static regex — compile once, not per-dependency (clippy: regex-in-loop).
     // `\r?` throughout the lock handling: a CRLF Gemfile.lock is legal to
     // bundler (verified: `bundle check`/frozen install both accept one on
-    // 4.0.15), and without the tolerance the CHECKSUMS header never matched,
-    // misdiagnosing the lock as bundler <2.6.
+    // 4.0.15), and without the tolerance the CHECKSUMS header would never
+    // match, misdiagnosing the lock as bundler <2.6.
     let checksums_re =
         Regex::new(r"(?m)^CHECKSUMS(\r?)$").expect("static CHECKSUMS header regex is valid");
     // True once any redirected dep leaves the pair MIXED: the lock still
@@ -6372,7 +6371,7 @@ fn rewrite_gem(
                 // no-op
             } else if let Some(m) = sum_line_re.captures(lk) {
                 // The pre-edit line goes into the ledger as `original` so a
-                // future `--revert` can restore the upstream sha.
+                // revert can restore the upstream sha.
                 let old_val = format!(
                     "{} ({}) sha256={}",
                     dep.name,
@@ -6427,7 +6426,7 @@ fn rewrite_gem(
             // sha pinned, bundler still attributes the gem to the upstream
             // remote and refuses the pair outright (unfrozen: exit 37
             // "mismatched checksums"; frozen: exit 16). A pre-CHECKSUMS lock
-            // has no sha to converge around, so it keeps today's
+            // has no sha to converge around, so it keeps the
             // mixed-but-installable state + the frozen-install caveat.
             if !checksums_era
                 || !converge_gem_lock_source(
@@ -6688,8 +6687,7 @@ fn rewrite_maven_pom(
 
         // LEGACY same-GAV fallback: no suffixed version means the patched jar is
         // served under its original GAV. Add the repository (transport checksum
-        // policy `fail`) exactly as before and warn that this is NOT
-        // fail-closed.
+        // policy `fail`) and warn that this is NOT fail-closed.
         let Some(suffixed_version) = suffixed_version else {
             // Verify-only inspection: warn when the redirect can't take effect.
             // Only the FIRST match matters here (legacy behavior).
@@ -7150,7 +7148,7 @@ fn go_token_safe(s: &str) -> bool {
 // grant-free/content-addressed (one build-once artifact per patch, public on
 // the free tier), and with the pinned replace in force go never fetches or
 // verifies the original module at all. A dep whose reference carries no
-// `goproxy` override falls back to the historical `redirect_golang_unsupported`
+// `goproxy` override falls back to the `redirect_golang_unsupported`
 // warning (the paid tier's tokened URLs remain a genuine no-go — see the
 // design doc's paid-tier analysis).
 fn rewrite_golang(
@@ -7480,7 +7478,7 @@ mod tests {
     /// Re-running a rewriter over its own output must be a no-op: zero new
     /// edits, byte-identical files. Recorded edits whose `original` is the
     /// already-redirected value would grow the committed ledger on every
-    /// `scan --redirect` run and poison a future revert.
+    /// hosted `scan` run and poison a future revert.
     #[test]
     fn second_pass_over_rewritten_output_is_a_noop() {
         let mut files = BTreeMap::new();
@@ -7543,7 +7541,7 @@ mod tests {
 
     /// The requirements marker is taken from the requirement portion only —
     /// a previously appended `--hash=…` must never be swallowed into the
-    /// marker (that duplicated the hash on every re-run).
+    /// marker (that would duplicate the hash on every re-run).
     #[test]
     fn requirements_marker_line_is_rerun_stable() {
         let mut files = BTreeMap::new();
@@ -8103,7 +8101,7 @@ mod tests {
         }
     }
 
-    /// An `<add>` keyed nuget.org that the strict scan used to miss (XML
+    /// An `<add>` keyed nuget.org that a strict scan would miss (XML
     /// allows whitespace around `=` and any attribute order) is a REAL
     /// source: it must be harvested as the catch-all target — not
     /// double-added by the seed, and not left out of the `*` fan-out.
@@ -8132,11 +8130,10 @@ mod tests {
     /// A `<packageSources >`-style open tag, or single-quoted `<add>`
     /// attributes — both valid XML NuGet parses — is a REAL source list: its
     /// keys must be harvested and the socket source inserted into the
-    /// EXISTING element. The literal probes used to read it as zero sources:
-    /// a SECOND `<packageSources>` element appeared carrying a duplicate
-    /// nuget.org seed, and the catch-all fanned `*` only to nuget.org —
-    /// every corp-feed-only package then NU1100s. Mirrors the tolerant
-    /// vendor/nuget_feed twin.
+    /// EXISTING element. Read as zero sources, a SECOND `<packageSources>`
+    /// element would appear carrying a duplicate nuget.org seed, and the
+    /// catch-all would fan `*` only to nuget.org — every corp-feed-only
+    /// package would NU1100. Mirrors the tolerant vendor/nuget_feed twin.
     #[test]
     fn nuget_open_tag_whitespace_and_single_quotes_harvested_not_reseeded() {
         for config in [
@@ -8175,7 +8172,7 @@ mod tests {
 
     /// A root open tag that isn't the literal `<configuration>` — trailing
     /// whitespace or attributes, both valid XML NuGet parses fine — must
-    /// still receive the source insert. The literal `replacen` used to no-op
+    /// still receive the source insert. A literal `replacen` would no-op
     /// silently while the mapping (anchored on the close tag) still landed,
     /// routing the patched id to a source that was never defined.
     #[test]
@@ -8294,9 +8291,9 @@ mod tests {
         )
     }
 
-    /// REGRESSION (yarn 4.0.x): a lock that spells its `10c0` checksums
-    /// bare (yarn 4.0.0–4.0.2) gets the hosted entry's checksum spelled bare
-    /// — the API's prefixed `yarnBerry10c0` made `yarn install --immutable`
+    /// yarn 4.0.x: a lock that spells its `10c0` checksums bare (yarn
+    /// 4.0.0–4.0.2) gets the hosted entry's checksum spelled bare — the
+    /// API's prefixed `yarnBerry10c0` would make `yarn install --immutable`
     /// reject the rewritten lock (YN0028). A 4.1+ (prefixed) lock keeps it.
     #[test]
     fn yarn_berry_checksum_follows_the_lock_spelling() {
@@ -8414,17 +8411,14 @@ mod tests {
 
     /// A `file:` lock entry carrying the `.socket/vendor/` signature is
     /// socket-patch's OWN vendored wiring (a `scan --mode vendored` project
-    /// being converted to hosted). Refusing it under the generic
-    /// `redirect_yarn_berry_unsupported_protocol` code misdiagnosed it —
-    /// the detail hardcoded "(workspace:/patch:/portal:/link:)" (`file:`
-    /// was not even listed) and named no way out. The refusal itself is
-    /// correct (fail-closed, byte-identical), but it must carry a DISTINCT
-    /// code and the real per-package remediation: retire the vendored
-    /// wiring first (`socket-patch remove <purl>`; `vendor --revert`
-    /// unwinds EVERY vendored package), then re-run `scan --mode hosted`.
-    /// That remedy holds whether or not a vendored→hosted pre-revert ever
-    /// lands for npm-family — today no berry counterpart of the cargo
-    /// takeover exists, so manual retirement is the only path.
+    /// being converted to hosted). The refusal is fail-closed and
+    /// byte-identical, but it must carry a DISTINCT code (not the generic
+    /// `redirect_yarn_berry_unsupported_protocol`) and the real per-package
+    /// remediation: retire the vendored wiring first (`socket-patch remove
+    /// <purl>`; `vendor --revert` unwinds EVERY vendored package), then
+    /// re-run `scan --mode hosted`. This refusal covers vendored wiring the
+    /// CLI takeover did not revert (e.g. no vendor ledger entry), where
+    /// manual retirement is the way out.
     #[test]
     fn yarn_berry_vendored_file_entry_refused_with_distinct_code_and_remediation() {
         let checksum = format!("10c0/{}", "7".repeat(128));
@@ -8483,8 +8477,8 @@ mod tests {
             "must name the re-run step: {}",
             w.detail
         );
-        // The old misdiagnosis must be gone: no four-protocol list that
-        // does not even include `file:`.
+        // Not the generic four-protocol list that does not even include
+        // `file:`.
         assert!(
             !w.detail.contains("(workspace:/patch:/portal:/link:)"),
             "must not misdiagnose the vendored entry with the generic \
@@ -8496,8 +8490,7 @@ mod tests {
     /// The generic unsupported-protocol refusal must name the entry's
     /// ACTUAL protocol (backticked), not a hardcoded four-item list that
     /// omits, e.g., `file:` — an operator debugging the refusal needs the
-    /// real cause, and the old list actively misdirected for any protocol
-    /// outside it.
+    /// real cause, and a fixed list misdirects for any protocol outside it.
     #[test]
     fn yarn_berry_unsupported_protocol_detail_names_actual_protocol() {
         let checksum = format!("10c0/{}", "7".repeat(128));
@@ -8567,7 +8560,7 @@ mod tests {
     }
 
     /// Two-entry classic lock: a decoy entry FIRST, the target second — the
-    /// shape that exposed the CRLF wrong-entry rewrite.
+    /// shape that catches a CRLF wrong-entry rewrite.
     fn classic_lock_two_entries() -> String {
         "# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.\n\
          # yarn lockfile v1\n\n\n\
@@ -8582,10 +8575,8 @@ mod tests {
 
     /// A CRLF classic lock (Windows `core.autocrlf` checkout) must rewrite
     /// the TARGET entry, not whichever entry happens to come first, and every
-    /// untouched line must keep its CRLF ending byte-exactly. Regression:
-    /// `split("\n\n")` never matched in a CRLF file, so the whole lock was
-    /// one block and the leftmost `resolved`/`integrity` — the decoy's —
-    /// were rewritten (then confirmed and attested downstream).
+    /// untouched line must keep its CRLF ending byte-exactly (see the CRLF
+    /// note in `rewrite_yarn_classic`).
     #[test]
     fn yarn_classic_crlf_lock_rewrites_only_the_target_entry() {
         let ovr = npm_override(
@@ -8983,7 +8974,7 @@ mod tests {
     /// the registry `name@version` spec is gone — so when the artifact URL
     /// changes (patch republish rotates the uuid segment, token rotation
     /// changes the token) the entry MUST still be re-pinned to the new URL;
-    /// exact-URL matching alone stranded the stale pin forever. Ownership is
+    /// exact-URL matching alone would strand the stale pin forever. Ownership is
     /// origin + `<name>-<version>.tgz` leaf, so user URL deps and
     /// other-version artifacts stay untouched.
     #[test]
@@ -9558,7 +9549,7 @@ mod tests {
     /// `[patch.crates-io]` on top of a live hosted redirect) reads back
     /// EVERY declaration shape this rewriter pins — driven through the
     /// rewriter itself so the two can never drift apart. A single-line
-    /// `<name> = { … }` regex saw only the first of these.
+    /// `<name> = { … }` regex would see only the first of these.
     #[test]
     fn cargo_socket_registry_pin_reads_back_every_written_shape() {
         let head = "[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n";
@@ -9764,12 +9755,12 @@ mod tests {
         files
     }
 
-    /// AUDIT A1+A7: a crate declared in BOTH [dev-dependencies] and
+    /// A crate declared in BOTH [dev-dependencies] and
     /// [dependencies] must gain the registry pin in BOTH sections — a
     /// first-match-only rewrite gives the two sections different sources for
     /// the same dep, which cargo rejects at manifest-parse time, bricking
     /// every cargo command. The blank separator line after each entry must
-    /// survive (the old `\s*$` regex swallowed it).
+    /// survive.
     #[test]
     fn cargo_two_sections_rewrites_all_occurrences_and_preserves_blank_lines() {
         let files = cargo_files(
@@ -9804,11 +9795,11 @@ mod tests {
         );
     }
 
-    /// AUDIT A2: the multi-line `[dependencies.<name>]` table form is a
-    /// completely standard manifest shape — it gains a `registry = "…"` line
-    /// instead of being reported not-found (which used to leave the lock
-    /// repointed while the manifest still said crates.io: `--locked` builds
-    /// broke, unlocked builds silently dropped the patch).
+    /// The multi-line `[dependencies.<name>]` table form is a completely
+    /// standard manifest shape — it gains a `registry = "…"` line instead of
+    /// being reported not-found (which would leave the lock repointed while
+    /// the manifest still said crates.io: `--locked` builds break, unlocked
+    /// builds silently drop the patch).
     #[test]
     fn cargo_table_form_dep_gains_registry_line() {
         let files = cargo_files(
@@ -9843,7 +9834,7 @@ mod tests {
         assert!(second.confirmed_cargo_uuids.contains(CARGO_UUID));
     }
 
-    /// AUDIT A5: rename-aware matching. An entry whose KEY matches the
+    /// Rename-aware matching. An entry whose KEY matches the
     /// patched crate but whose `package = "<other>"` names a different crate
     /// is NOT the patched crate (pinning it would point a foreign package at
     /// the single-crate socket registry — resolution hard-fails); the patched
@@ -10030,7 +10021,7 @@ mod tests {
         }
     }
 
-    /// AUDIT A5(a) alone: when the ONLY key match renames a different crate,
+    /// Rename case alone: when the ONLY key match renames a different crate,
     /// the dep is genuinely not declared → not-found, and NOTHING is written
     /// (no config block, no lock repoint).
     #[test]
@@ -10056,12 +10047,12 @@ mod tests {
         assert!(r.confirmed_cargo_uuids.is_empty());
     }
 
-    /// AUDIT A4: a re-scan that selects a NEWER patch uuid over an existing
-    /// redirect must supersede the old `registry = "socket-patch-<old>"` pin
-    /// in place — the old code classified it as a foreign registry and left
-    /// the manifest on the OLD uuid while moving the lock to the NEW one
-    /// (broken `--locked` builds, unlocked builds resolving the superseded
-    /// patch, VEX attesting the new one).
+    /// A re-scan that selects a NEWER patch uuid over an existing redirect
+    /// must supersede the old `registry = "socket-patch-<old>"` pin in place
+    /// — classifying it as a foreign registry would leave the manifest on
+    /// the OLD uuid while moving the lock to the NEW one (broken `--locked`
+    /// builds, unlocked builds resolving the superseded patch, VEX attesting
+    /// the new one).
     #[test]
     fn cargo_supersede_replaces_previous_socket_registry_pin() {
         const OLD_UUID: &str = "0a1b2c3d-4e5f-4a7b-8c9d-0e1f2a3b4c5d";
@@ -10161,7 +10152,7 @@ mod tests {
         assert!(r.confirmed_cargo_uuids.is_empty());
     }
 
-    /// AUDIT A2/A3 (transactionality): when ONE occurrence is rewritable but
+    /// Transactionality: when ONE occurrence is rewritable but
     /// ANOTHER is not, the dep is skipped ENTIRELY — a partial pin (one
     /// section redirected, one not) gives the dep two different sources and
     /// cargo refuses the manifest.
@@ -10185,12 +10176,11 @@ mod tests {
         assert!(r.confirmed_cargo_uuids.is_empty());
     }
 
-    /// AUDIT A3 (the cargo analogue of npm's
-    /// `no_lockfile_redirect_is_not_attested`): a granted dep the project
-    /// does not declare at all (e.g. surfaced by the machine-wide
-    /// $CARGO_HOME crawl) must produce NO writes — the old code still wrote
-    /// the inert `[registries.…]` block, whose index URL then satisfied the
-    /// hosted confirmed check and produced a false VEX attestation.
+    /// The cargo analogue of npm's `no_lockfile_redirect_is_not_attested`:
+    /// a granted dep the project does not declare at all (e.g. surfaced by
+    /// the machine-wide $CARGO_HOME crawl) must produce NO writes — an inert
+    /// `[registries.…]` block's index URL would satisfy the hosted confirmed
+    /// check and produce a false VEX attestation.
     #[test]
     fn cargo_undeclared_dep_writes_nothing_not_even_the_config_block() {
         let mut files = BTreeMap::new();
@@ -10235,11 +10225,11 @@ mod tests {
         assert!(r.confirmed_cargo_uuids.is_empty());
     }
 
-    /// AUDIT A6: a user who commented the managed [registries] block out (to
-    /// debug an install) and re-runs the scan gets the block RESTORED. The
-    /// old substring idempotence check matched the commented text, wrote
-    /// nothing, and the run still reported the dep redirected while every
-    /// cargo command failed on the undefined registry.
+    /// A user who commented the managed [registries] block out (to debug an
+    /// install) and re-runs the scan gets the block RESTORED. A substring
+    /// idempotence check would match the commented text, write nothing, and
+    /// report the dep redirected while every cargo command failed on the
+    /// undefined registry.
     #[test]
     fn cargo_commented_config_block_is_restored() {
         // First run to produce the redirected state.
@@ -10370,7 +10360,7 @@ mod tests {
         assert!(r.confirmed_cargo_uuids.contains(CARGO_UUID));
     }
 
-    /// AUDIT A9: an empty-string `cargoCksumSha256` is MISSING (the TS twin's
+    /// An empty-string `cargoCksumSha256` is MISSING (the TS twin's
     /// falsy check), never written as `checksum = ""` into Cargo.lock — that
     /// hard-fails the next `cargo fetch --locked`.
     #[test]
@@ -10399,7 +10389,7 @@ mod tests {
         assert!(r.confirmed_cargo_uuids.is_empty());
     }
 
-    /// AUDIT A8: service-supplied strings are validated against their exact
+    /// Service-supplied strings are validated against their exact
     /// grammars before interpolation into raw TOML — a hostile patch uuid,
     /// index URL, or cksum must be refused, never written (TOML injection:
     /// a `]`+newline uuid can define `[source.crates-io] replace-with = …`
@@ -10579,11 +10569,11 @@ mod tests {
     const CFG_IF_MULTI_DEPS: &str = "[dependencies]\ncfg-if = \"1.0.4\"\n\
          cfg-if-legacy = { package = \"cfg-if\", version = \"0.1.10\" }\n";
 
-    /// Bug B: the manifest pin matched the crate NAME only, so every
-    /// same-named declaration — `cfg-if-legacy = { package = "cfg-if",
-    /// version = "0.1.10" }` too — was pinned to the one patched version's
-    /// registry, where `^0.1.10` cannot resolve. Each declaration is pinned
-    /// only by the patch its version requirement selects.
+    /// A manifest pin matched by crate NAME only would pin every same-named
+    /// declaration — `cfg-if-legacy = { package = "cfg-if", version =
+    /// "0.1.10" }` too — to the one patched version's registry, where
+    /// `^0.1.10` cannot resolve. Each declaration is pinned only by the
+    /// patch its version requirement selects.
     #[test]
     fn cargo_multi_version_pins_only_the_declaration_the_version_selects() {
         let files = cfg_if_multi_files(CFG_IF_MULTI_DEPS);
@@ -10748,10 +10738,10 @@ mod tests {
         files
     }
 
-    /// Bug F: only the root's `[workspace.dependencies]` was pinned; member
-    /// `b`'s own `serde = "1.0.190"` stayed on crates.io, so `--locked`
-    /// failed against the repointed lock while the dep was reported
-    /// redirected. Every member manifest the caller supplies is planned in
+    /// Pinning only the root's `[workspace.dependencies]` would leave member
+    /// `b`'s own `serde = "1.0.190"` on crates.io, so `--locked` fails
+    /// against the repointed lock while the dep is reported redirected.
+    /// Every member manifest the caller supplies is planned in
     /// the same transaction; inheritors are satisfied by the root's pin.
     #[test]
     fn cargo_workspace_member_direct_declaration_is_pinned() {
@@ -10941,9 +10931,8 @@ mod tests {
         }
     }
 
-    /// Bug K: CRLF manifests and locks (Windows checkouts) were refused —
-    /// every planner matched LF text only. A CRLF-only file is now planned
-    /// as LF and written back CRLF, recorded fragments included, and a
+    /// CRLF manifests and locks (Windows checkouts): every planner matches
+    /// LF text, so a CRLF-only file is planned as LF and written back CRLF, recorded fragments included, and a
     /// re-run over the output is a silent no-op.
     #[test]
     fn cargo_crlf_files_are_rewritten_with_crlf_kept() {
@@ -11012,7 +11001,7 @@ mod tests {
         );
     }
 
-    /// Bug J (kept a refusal): a crate only reached transitively cannot be
+    /// A crate only reached transitively cannot be
     /// pinned by a manifest `registry` key. Nothing is written or
     /// confirmed, and the warning says it is transitive-only, unpatched, and
     /// which mode can patch it.
@@ -11355,11 +11344,9 @@ mod tests {
         );
     }
 
-    /// The CLI's ONLY production `DepOverride` construction site
-    /// (`scan/hosted.rs`) builds every override with an EMPTY `token` — the
-    /// reference endpoint hands the grant token back only inside the URLs it
-    /// returns. The rotated-grant idempotency guard must therefore never
-    /// depend on the caller populating `token`: a re-scan under a rotated
+    /// The CLI derives `token` from the reference URLs (`scan/hosted.rs`,
+    /// `hosted_memory/redirect.rs`), but the rotated-grant idempotency guard
+    /// must not depend on any caller populating it: a re-scan under a rotated
     /// grant must still recognize the source block a previous run wrote and
     /// refresh its URL in place. With a token-dependent guard the recognizer
     /// misses the old block, `gem_line_re` matches the INDENTED gem line
@@ -11371,7 +11358,7 @@ mod tests {
         const PATCH_UUID: &str = "7c8d9e0f-1a2b-4a1b-8c2d-3e4f5a6b7c8d";
         fn ov(token: &str) -> DepOverride {
             let mut o = gem_override("rails", "7.0.0");
-            // Exactly as the CLI builds it: the grant token never populated.
+            // A caller that leaves the grant token empty.
             o.token = String::new();
             o.patch_uuid = PATCH_UUID.into();
             if let Some(r) = o.registry_override.as_mut() {
@@ -11436,7 +11423,7 @@ mod tests {
     /// The gems.rb/Gemfile divergence guard erases the redirect's own
     /// footprint with the same token-wildcard pattern, so it too must not
     /// depend on `DepOverride.token` being populated: identical twins
-    /// re-scanned under a rotated grant with the CLI's empty token must reach
+    /// re-scanned under a rotated grant with an empty token must reach
     /// the in-place refresh, not be trapped behind
     /// `redirect_gem_gemfile_spellings_diverge` by run 1's own edit.
     #[test]
@@ -11893,7 +11880,7 @@ mod tests {
 
     /// The rewritten CHECKSUMS edit must carry the pre-edit line as
     /// `original` — with `None` the ledger cannot restore the upstream sha on
-    /// a future revert.
+    /// revert.
     #[test]
     fn gem_lock_rewrite_records_original_checksum_line() {
         let mut files = BTreeMap::new();
@@ -11925,8 +11912,8 @@ mod tests {
     /// come out FULLY CONVERGED, not mixed-state: the dep's spec entry moves
     /// out of the upstream GEM section into a patch-registry GEM section
     /// (`remote: <index-url>`), DEPENDENCIES pins `<name> (= <ver>)!`, and
-    /// CHECKSUMS carries the patched sha. The old mixed rewrite (CHECKSUMS
-    /// pinned, GEM section left upstream) made bundler refuse the prescribed
+    /// CHECKSUMS carries the patched sha. A mixed rewrite (CHECKSUMS
+    /// pinned, GEM section left upstream) makes bundler refuse the prescribed
     /// unfrozen install with exit 37 "mismatched checksums" — and the
     /// converged pair needs no frozen-install caveat at all.
     #[test]
@@ -11987,11 +11974,11 @@ mod tests {
         );
     }
 
-    /// REGRESSION (bundler 4.0.19+): the patch-registry `GEM` section must
+    /// Bundler 4.0.19+: the patch-registry `GEM` section must
     /// land where bundler itself renders it — rubygems sections sorted by
     /// remote (`SourceList#lock_rubygems_sources`) — because a frozen install
     /// re-renders the lock and, since rubygems#9750, FAILS on any difference.
-    /// Appending after the upstream section produced a lock bundler 4.0.21
+    /// Appending after the upstream section would produce a lock bundler 4.0.21
     /// refuses under `BUNDLE_FROZEN=true` whenever the patch registry sorts
     /// first (`https://patch.socket.dev/` < `https://rubygems.org/`), i.e. on
     /// every production pair. Pinned both ways, with a third section present.
@@ -12269,8 +12256,7 @@ mod tests {
     }
 
     /// Bundler's modern `gems.rb`/`gems.locked` spelling must be redirected
-    /// exactly like the classic pair — before this, a gems.rb project was a
-    /// silent no-op (the rewriter keyed on the literal "Gemfile" names).
+    /// exactly like the classic pair.
     #[test]
     fn gems_rb_pair_is_rewritten_with_modern_paths() {
         let mut files = BTreeMap::new();
@@ -12444,8 +12430,9 @@ mod tests {
 
     /// The identical-twins re-run with a ROTATED grant (the token/uuid URL
     /// segments rotate per request) must still reach the in-place URL
-    /// refresh — with a raw-byte divergence guard, run 1's edit tripped the
-    /// trap and the redirect went permanently stale under the old grant.
+    /// refresh — with a raw-byte divergence guard, run 1's edit would trip
+    /// the trap and the redirect would go permanently stale under the old
+    /// grant.
     #[test]
     fn gems_rb_identical_twins_rerun_refreshes_rotated_grant_url() {
         fn ov(token: &str) -> DepOverride {
@@ -12616,9 +12603,9 @@ mod tests {
 
     /// A CRLF Gemfile.lock is legal to bundler (`bundle check` and a frozen
     /// install both accept one — verified on 4.0.15). The CHECKSUMS pin must
-    /// land in place, byte-preserving the `\r\n` endings — before this, the
-    /// `(?m)^…$` matchers never saw the `\r`-terminated lines and the lock
-    /// was misdiagnosed as bundler <2.6 (`redirect_gem_no_checksums_section`).
+    /// land in place, byte-preserving the `\r\n` endings — `(?m)^…$`
+    /// matchers blind to the `\r`-terminated lines would misdiagnose the lock
+    /// as bundler <2.6 (`redirect_gem_no_checksums_section`).
     #[test]
     fn gem_crlf_lock_checksum_pinned_preserving_crlf() {
         let mut files = BTreeMap::new();
@@ -12707,7 +12694,7 @@ mod tests {
         );
     }
 
-    /// REGRESSION (npm 6): a lockfileVersion 1 lock is only ever written by
+    /// npm 6: a lockfileVersion 1 lock is only ever written by
     /// npm <= 6, which ignores `resolved` for registry deps (verified against
     /// real npm 6.14.18) — so its installs of the redirected lock fail
     /// EINTEGRITY. The rewrite still happens (npm >= 7 installs it), but the
@@ -12769,10 +12756,10 @@ mod tests {
     /// `package-lock.json` beside any committed `npm-shrinkwrap.json` on first
     /// install — and reifies the install from `package-lock.json`. So a
     /// shrinkwrap repo's DEFAULT state under npm 12 is BOTH locks present,
-    /// byte-divergent but pinning the same versions. The old rewriter rewrote
-    /// only the FIRST present lock (`npm-shrinkwrap.json`) and left
-    /// `package-lock.json` — the file npm actually installs from — pristine,
-    /// with no warning: a silent FALSE SUCCESS. EVERY present npm lock must be
+    /// byte-divergent but pinning the same versions. Rewriting only the FIRST
+    /// present lock (`npm-shrinkwrap.json`) would leave `package-lock.json` —
+    /// the file npm actually installs from — pristine, with no warning: a
+    /// silent FALSE SUCCESS. EVERY present npm lock must be
     /// rewritten so a fresh install/ci from EITHER is redirected.
     #[test]
     fn npm_dual_lock_shrinkwrap_and_package_lock_both_rewritten() {
@@ -12863,8 +12850,8 @@ mod tests {
 
     /// A shrinkwrap-ONLY project (the npm <= 6 world, where `npm shrinkwrap`
     /// wrote the sole lock and no `package-lock.json` was auto-created) must
-    /// still be rewritten with zero warnings — the dual-lock fix must not
-    /// perturb the single-lock path.
+    /// still be rewritten with zero warnings — the dual-lock handling must
+    /// not perturb the single-lock path.
     #[test]
     fn npm_shrinkwrap_only_still_rewritten_no_warnings() {
         let ovr = npm_override(
@@ -12916,7 +12903,7 @@ mod tests {
 
     /// An unparseable package-lock.json must surface a warning, not silently
     /// skip the npm redirect entirely (missing-lockfile already warns; a
-    /// corrupt lockfile is strictly worse and was silent).
+    /// corrupt lockfile is strictly worse).
     #[test]
     fn npm_unparseable_lockfile_warns() {
         let mut files = BTreeMap::new();
@@ -13211,7 +13198,7 @@ mod tests {
     /// A granted npm override matching no lock entry (not installed, or the
     /// lock drifted to another version) must warn — parity with
     /// `redirect_pnpm_entry_not_found` / `redirect_yarn_berry_entry_not_found`.
-    /// Silence here made every npm redirect miss unreadable in CI.
+    /// Silence here would make every npm redirect miss unreadable in CI.
     #[test]
     fn npm_entry_not_found_warns() {
         let mut files = BTreeMap::new();
@@ -13383,10 +13370,10 @@ snapshots:
     }
 
     /// A source-only target (composer.lock records `source`, no `dist` — a VCS
-    /// install) must fail closed. The rewriter used to find the package by name
-    /// and then scan FORWARD for the next `"dist": {` with no package boundary,
-    /// so it repointed the FOLLOWING package's url AND shasum at the target's
-    /// patch: a checksum-clean install of the wrong code.
+    /// install) must fail closed. Scanning FORWARD from the name for the next
+    /// `"dist": {` with no package boundary would repoint the FOLLOWING
+    /// package's url AND shasum at the target's patch: a checksum-clean
+    /// install of the wrong code.
     #[test]
     fn composer_source_only_target_never_touches_the_next_package() {
         let lock = composer_lock_with(
@@ -13454,8 +13441,8 @@ snapshots:
     }
 
     /// The locked version must match the patched one. Matching on name alone
-    /// repointed whichever version the lock happened to hold at a patch built
-    /// for a different one.
+    /// would repoint whichever version the lock happened to hold at a patch
+    /// built for a different one.
     #[test]
     fn composer_version_mismatch_fails_closed() {
         let lock = composer_lock_with(
@@ -13998,7 +13985,7 @@ snapshots:",
 
     /// A v6 dep resolved ONLY through a peer-suffixed key (pnpm 8 dedupes a
     /// workspace onto the peered instantiation — captured live from corepack
-    /// pnpm@8.15.9, 2026-08-18) is spliced in place like any other instance,
+    /// pnpm@8.15.9) is spliced in place like any other instance,
     /// scoped names included, with the peered key preserved verbatim in the
     /// ledger edit.
     #[test]
@@ -14199,7 +14186,7 @@ packages:
     /// Byte-accurate pnpm 7 (lockfileVersion 5.4) grammar, captured live from
     /// `corepack pnpm@7.33.5 install` of a workspace where pkg-a consumes
     /// use-sync-external-store@1.2.0 bare and pkg-b consumes it beside
-    /// react@18.2.0 (2026-08-18): the plain and `_react@18.2.0`-suffixed
+    /// react@18.2.0: the plain and `_react@18.2.0`-suffixed
     /// instances each carry their own resolution and BOTH get spliced, with
     /// every sibling line (`peerDependencies:`, `dependencies:`, `dev:`)
     /// byte-preserved. The spliced shape is exactly what pnpm@7.33.5 then
@@ -14299,7 +14286,7 @@ packages:
     }
 
     /// Byte-accurate pnpm 8 (lockfileVersion '6.0') grammar from the same
-    /// live capture (`corepack pnpm@8.15.9`, 2026-08-18): pnpm 8 deduped both
+    /// live capture (`corepack pnpm@8.15.9`): pnpm 8 deduped both
     /// importers onto the single peer-suffixed instance
     /// `/use-sync-external-store@1.2.0(react@18.2.0):` — the real-world v6
     /// peered shape — and the spliced lock frozen-installed from an empty
@@ -14434,10 +14421,10 @@ snapshots:
     }
 
     /// A clean, fully-successful redirect must emit EXACTLY zero rewrite
-    /// warnings — for the npm lock AND for a pnpm-only project. The pnpm leg
-    /// regressed silently for a long time: `rewrite_npm_lock` pushed a
-    /// spurious `redirect_npm_no_lockfile` onto every pnpm/yarn/bun/Rush run
-    /// because those projects (correctly) have no package-lock.json.
+    /// warnings — for the npm lock AND for a pnpm-only project:
+    /// `rewrite_npm_lock` must not push a spurious `redirect_npm_no_lockfile`
+    /// onto pnpm/yarn/bun/Rush runs, which (correctly) have no
+    /// package-lock.json.
     #[test]
     fn clean_success_run_emits_no_warnings_for_npm_and_pnpm() {
         let ovr = npm_override(
@@ -14615,7 +14602,7 @@ snapshots:
     /// key is `<name>@file:.socket/vendor/…` (v9) and the generic
     /// entry-not-found wording invites a wild-goose `pnpm install`. The
     /// warning must name the vendored state and the `vendor --revert` path
-    /// instead, while a genuinely unlocked dep keeps the old code, and a
+    /// instead, while a genuinely unlocked dep keeps the generic code, and a
     /// same-name USER `file:` dep (not under .socket/vendor/) is never
     /// misreported as vendored. Fail-closed in all three: zero rewrites.
     #[test]
@@ -14627,8 +14614,8 @@ snapshots:
             "sha512-PATCHED==",
         );
 
-        // Byte-real v9 vendored lock shape (2026-08-18 mode-conversion
-        // matrix, projB snap): overrides + file:-keyed packages/snapshots.
+        // Byte-real v9 vendored lock shape (captured from a real
+        // mode-conversion run): overrides + file:-keyed packages/snapshots.
         let vendored_lock = "lockfileVersion: '9.0'
 
 settings:
@@ -14927,8 +14914,7 @@ packages:
 
     /// The whole-file gates read the NORMALIZED lock: a CRLF lock at an
     /// unsupported cacheKey is refused naming THAT key — never
-    /// "`(missing)`", which is what the `\n\n` grammar made of a CRLF
-    /// `__metadata` block before line endings were handled.
+    /// "`(missing)`".
     #[test]
     fn berry_crlf_lock_cache_key_gate_names_the_real_key() {
         let checksum = format!("10c0/{}", "7".repeat(128));
@@ -15467,15 +15453,15 @@ packages:
                     .contains("v1.4.2-socketpatch.1"))));
     }
 
-    // ── coverage-audit 2026-09 additions ─────────────────────────────────────
-    // Warning/refusal legs and rare-lock-shape branches the golden fixtures
+    // ── warning/refusal legs ─────────────────────────────────────────────────
+    // These and the rare-lock-shape branches the golden fixtures
     // deliberately do not pin (they are byte-shared with the TS backend).
 
     /// A crafted lock entry that carries BOTH `link: true` and a version gets
     /// the specific link diagnosis; the REAL npm-emitted link shape (no
     /// `version` key at all) falls through to the generic not-found today —
     /// pinned here so a future link-aware diagnosis flips this test
-    /// deliberately (audit bug anchor #2).
+    /// deliberately.
     #[test]
     fn npm_link_entry_versioned_skips_loudly_versionless_is_generic_not_found() {
         let ovr = npm_override(
@@ -16098,13 +16084,12 @@ packages:
     /// Cargo.lock v1 (cargo < 1.41; every cargo still reads it and, under
     /// `--locked`, never rewrites it): the checksum lives in `[metadata]`
     /// keyed by the source, and dependents reference the crate by its full
-    /// `"name version (source)"` id. REGRESSION: only the entry's `source`
-    /// was repointed — the dependent's reference then named a package no
-    /// longer in the lock (real cargo discards the lock and re-resolves;
-    /// `cargo fetch --locked` fails) and nothing pinned the patched
-    /// `.crate` (the v1 entry has no inline checksum, and the insert after a
-    /// block-final `source` line never matched). Every fragment now follows
-    /// the source, each as its own revertible edit.
+    /// `"name version (source)"` id. Repointing only the entry's `source`
+    /// would leave the dependent's reference naming a package no longer in
+    /// the lock (real cargo discards the lock and re-resolves; `cargo fetch
+    /// --locked` fails) with nothing pinning the patched `.crate` (the v1
+    /// entry has no inline checksum). Every fragment follows the source,
+    /// each as its own revertible edit.
     #[test]
     fn cargo_lock_v1_repoints_metadata_checksum_and_full_id_references() {
         const CRATES_IO: &str = "registry+https://github.com/rust-lang/crates.io-index";
@@ -16183,12 +16168,12 @@ packages:
     /// The OLDEST v1 locks (cargo before the `[root]` removal) record the
     /// root package in a standalone `[root]` table — not in the
     /// `[[package]]` array — and its `dependencies` spell full package ids
-    /// the same way. REGRESSION: the reference walk searched `[[package]]`
-    /// blocks only, so `[root]` kept naming the crates.io id of a package
-    /// the repointed lock no longer contained: `cargo build --locked` fails
-    /// and an unlocked build silently discards the lock, while the scan
-    /// reports the crate redirected. The vendored twin has handled this
-    /// table since `dependency_tables_mut`.
+    /// the same way. A reference walk over `[[package]]` blocks only would
+    /// leave `[root]` naming the crates.io id of a package the repointed
+    /// lock no longer contains: `cargo build --locked` fails and an unlocked
+    /// build silently discards the lock, while the scan reports the crate
+    /// redirected. The vendored twin handles this table too
+    /// (`dependency_tables_mut`).
     #[test]
     fn cargo_lock_v1_root_table_references_are_repointed() {
         const CRATES_IO: &str = "registry+https://github.com/rust-lang/crates.io-index";
@@ -16312,8 +16297,7 @@ packages:
     /// crate (cfg-if, libc, serde…) cannot be hosted-redirected: the pin
     /// reaches only the root's declaration, the other crate keeps resolving
     /// it from crates.io, so the repointed lock fails `--locked` and the
-    /// unpatched copy is compiled. REGRESSION: it was pinned, repointed and
-    /// confirmed (reported redirected, attested by VEX).
+    /// unpatched copy is compiled.
     #[test]
     fn cargo_crate_another_lock_package_depends_on_is_refused() {
         const CRATES_IO: &str = "registry+https://github.com/rust-lang/crates.io-index";
@@ -17563,9 +17547,8 @@ packages:
         assert!(checksums.contains(&format!("{}  ", "d".repeat(64))));
     }
 
-    // ── coverage mop-up 2026-09 (final wave) ─────────────────────────────────
-    // Residual branches the earlier audit passes did not pin: malformed-input
-    // tolerance legs, workspace-inheritance satisfaction, and the remaining
+    // ── residual branches ────────────────────────────────────────────────────
+    // Malformed-input tolerance legs, workspace-inheritance satisfaction, and the remaining
     // diagnosis spellings.
 
     #[test]
@@ -17965,7 +17948,8 @@ packages:
 
     /// A dep whose registry override is of a FOREIGN kind writes nothing —
     /// the nuget and golang arms skip it rather than misinterpreting the
-    /// override's fields (silently, matching the TS twin).
+    /// override's fields, and each warns its missing-override code, as for
+    /// an absent override.
     #[test]
     fn foreign_override_kind_warns_missing_override_for_nuget_and_golang() {
         let mut nuget = nuget_override();
diff --git a/crates/socket-patch-core/src/patch/redirect/npmrc.rs b/crates/socket-patch-core/src/patch/redirect/npmrc.rs
index 8c9e8034..e8497d85 100644
--- a/crates/socket-patch-core/src/patch/redirect/npmrc.rs
+++ b/crates/socket-patch-core/src/patch/redirect/npmrc.rs
@@ -994,8 +994,8 @@ mod tests {
 
     /// Differential corpus: every expectation is what npm's bundled `ini`
     /// (`ini.parse(text)['allow-remote']`) returned for the same text —
-    /// identically under npm 11.19 (ini 6.0.0) and npm 12.1.0 (ini 7.0.0). Pins the review findings: a bare
-    /// `\r` ends a line (`/[\r\n]+/`), and a section header is matched on
+    /// identically under npm 11.19 (ini 6.0.0) and npm 12.1.0 (ini 7.0.0).
+    /// Pins that a bare `\r` ends a line (`/[\r\n]+/`), and a section header is matched on
     /// the UNTRIMMED line (an indented or BOM-prefixed `[sec]` is a plain
     /// top-level key, so the scope does not end there).
     #[test]
@@ -1034,10 +1034,10 @@ mod tests {
         }
     }
 
-    /// Finding: a CR-only `.npmrc` with an explicit `allow-remote=none` was
-    /// read as one `registry` line, planned an Append, and the appended
-    /// `allow-remote=all` silently flipped the user's `none`. Now it is
-    /// respected; a CR-only file WITHOUT the key is never spliced.
+    /// A CR-only `.npmrc` with an explicit `allow-remote=none` must not be
+    /// read as one `registry` line and have an appended `allow-remote=all`
+    /// silently flip the user's `none`: it is respected, and a CR-only file
+    /// WITHOUT the key is never spliced.
     #[test]
     fn plan_never_flips_or_splices_a_cr_only_npmrc() {
         assert_eq!(
@@ -1055,10 +1055,10 @@ mod tests {
         ));
     }
 
-    /// Finding: an indented / BOM-prefixed `[sec]` was treated as a header,
-    /// so the plan wrote `allow-remote=all` above it while npm kept reading
-    /// the user's `none` below it (EALLOWREMOTE, yet the warning claimed
-    /// the write fixed it). npm reads those lines as top-level keys.
+    /// An indented / BOM-prefixed `[sec]` is not a header: npm reads those
+    /// lines as top-level keys, so treating one as a header would write
+    /// `allow-remote=all` above it while npm kept reading the user's `none`
+    /// below it.
     #[test]
     fn plan_respects_values_under_non_headers() {
         for text in [
@@ -1081,11 +1081,11 @@ mod tests {
         assert_eq!(text, "\u{feff}[x]\nallow-remote=all\n[sec]\ny=1\n");
     }
 
-    /// Finding: `[sec]\nallow-remote=all\n` (inert under a section) planned
-    /// a top-level append, and the unwind then counted BOTH copies and
-    /// refused as ambiguous — blocking rollback, remove, the vendored
-    /// takeover and the reconcile over a state our own writer created. The
-    /// unwind now only counts top-level lines, like the plan.
+    /// `[sec]\nallow-remote=all\n` (inert under a section) plans a
+    /// top-level append, so the unwind must count only top-level lines,
+    /// like the plan — counting BOTH copies would refuse as ambiguous and
+    /// block rollback, remove, the vendored takeover and the reconcile over
+    /// a state our own writer created.
     #[test]
     fn unwind_ignores_section_scoped_copies() {
         let before = "[sec]\nallow-remote=all\n";
@@ -1131,11 +1131,11 @@ mod tests {
         }
     }
 
-    /// Finding: only the project `.npmrc` was consulted, so a machine / org
-    /// `allow-remote=none` in `~/.npmrc` or `$PREFIX/etc/npmrc` was
+    /// Outer npm config layers are consulted: a machine / org
+    /// `allow-remote=none` in `~/.npmrc` or `$PREFIX/etc/npmrc` must not be
     /// silently overridden by a committed project `allow-remote=all`, and
     /// an env `npm_config_allow_remote=none` (which beats the project file)
-    /// was ignored while the warning promised `npm ci` needs no flags.
+    /// must not be ignored.
     #[test]
     fn outer_layers_are_located_like_npm_and_respected() {
         use std::collections::HashMap;
@@ -1456,9 +1456,9 @@ mod tests {
         assert!(!npmrc_unwind_due(&edits[..1], &HashSet::new()));
     }
 
-    /// Finding: the per-purl revert learned a symlinked `.npmrc` was
-    /// unwritable only at flush time, after the reverted lock had landed.
-    /// The read used while PLANNING now refuses it.
+    /// The read used while PLANNING refuses a symlinked `.npmrc`, so the
+    /// per-purl revert never learns it is unwritable only at flush time,
+    /// after the reverted lock had landed.
     #[cfg(unix)]
     #[test]
     fn read_project_npmrc_refuses_a_symlink_at_plan_time() {
diff --git a/crates/socket-patch-core/src/patch/redirect/pipenv.rs b/crates/socket-patch-core/src/patch/redirect/pipenv.rs
index ef62dce7..7725c9e6 100644
--- a/crates/socket-patch-core/src/patch/redirect/pipenv.rs
+++ b/crates/socket-patch-core/src/patch/redirect/pipenv.rs
@@ -576,7 +576,7 @@ mod tests {
         }
     }
 
-    /// Only conflicts veto the sibling rewriters (Bugbot HIGH on #242): a
+    /// Only conflicts veto the sibling rewriters: a
     /// Pipfile.lock without the package, an old pipfile-spec, an unparseable
     /// lock or a digest-less patch is SKIPPED with `redirect_pipenv_skipped`
     /// and the requirements.txt / uv.lock rewrite still lands.
diff --git a/crates/socket-patch-core/src/patch/redirect/python_lock_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/python_lock_equivalence_tests.rs
index d1249102..f783a6a8 100644
--- a/crates/socket-patch-core/src/patch/redirect/python_lock_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/python_lock_equivalence_tests.rs
@@ -672,7 +672,7 @@ fn refusal_in_the_middle_leaves_the_prior_rewrite_intact() {
     }
 }
 
-/// Runs the oracle over the Phase 3 benchmark fixtures (real ~1.9 MB uv,
+/// Runs the oracle over the benchmark fixtures (real ~1.9 MB uv,
 /// pylock and PEP 723 locks, too large to commit) when
 /// `SOCKET_PATCH_PY_LOCK_FIXTURES` names their directory; a no-op otherwise.
 #[test]
diff --git a/crates/socket-patch-core/src/patch/redirect/replay.rs b/crates/socket-patch-core/src/patch/redirect/replay.rs
index 4a0549e8..8b643115 100644
--- a/crates/socket-patch-core/src/patch/redirect/replay.rs
+++ b/crates/socket-patch-core/src/patch/redirect/replay.rs
@@ -3,10 +3,11 @@
 //! The per-purl reverts in [`super::takeover`] cover cargo, the
 //! npm-family lock flavors, and golang (which reuses the golang inverses
 //! here). Everything else the hosted rewriters touch —
-//! gem, pypi, composer, bun, and the non-package rideshare edits
+//! gem, pypi, composer, and the non-package rideshare edits
 //! (such as the pnpm `trustLockfile` auto-config) —
-//! has no per-purl revert: their unwind rides the ledger's designed
-//! whole-list contract ("edits appended in write order, a revert walks
+//! has no per-purl revert (bun edits the per-purl revert does not claim
+//! also fall through to this replay): their unwind rides the ledger's
+//! designed whole-list contract ("edits appended in write order, a revert walks
 //! them in reverse", see [`super::state`]).
 //!
 //! [`revert_remaining_redirect_edits`] performs that walk over whatever
@@ -2468,10 +2469,10 @@ mod tests {
         assert_eq!(read(dir.path(), ".npmrc").await, "allow-remote=all\n");
     }
 
-    /// The replay twin of the per-purl finding: a symlinked `.npmrc`
+    /// The replay twin of the per-purl planning guard: a symlinked `.npmrc`
     /// refuses the npm group while planning (the link and its target are
-    /// never written), and a section-scoped copy of the line no longer
-    /// makes the unwind ambiguous.
+    /// never written), and a section-scoped copy of the line does not make
+    /// the unwind ambiguous.
     #[cfg(unix)]
     #[tokio::test]
     async fn npmrc_symlink_refuses_at_plan_time_and_section_copies_are_inert() {
@@ -2926,8 +2927,8 @@ mod tests {
     async fn directory_squatting_a_lockfile_refuses_each_arm_fail_fast() {
         // A directory planted at the lockfile path makes open_regular_file
         // return InvalidInput (open + fstat) — the fail-fast posture the
-        // module doc claims. Every per-arm read must refuse the group with
-        // the read error and keep the ledger.
+        // `staged` module documents for its guarded reads. Every per-arm
+        // read must refuse the group with the read error and keep the ledger.
         #[allow(clippy::type_complexity)]
         let cases: [(&str, &str, &str, Option<&str>, Option<&str>); 4] = [
             (
diff --git a/crates/socket-patch-core/src/patch/redirect/state.rs b/crates/socket-patch-core/src/patch/redirect/state.rs
index 0bad12b7..d5a2da88 100644
--- a/crates/socket-patch-core/src/patch/redirect/state.rs
+++ b/crates/socket-patch-core/src/patch/redirect/state.rs
@@ -1,9 +1,11 @@
 //! The hosted-mode ledger (`.socket/vendor/redirect-state.json`), written by
-//! `scan --mode hosted` (a.k.a. `scan --redirect`).
+//! hosted-mode `scan` (the default mode; also `--mode hosted` / the legacy
+//! `--redirect`).
 //!
 //! Mirrors the vendor `state.json` shape but records a REMOTE per-dependency
 //! redirect (no local artifact bytes). It carries the recorded [`FileEdit`]s
-//! (for a future `--revert`) plus, per redirected PURL, the manifest
+//! (which `rollback` and the hosted→vendored takeover replay in reverse to
+//! restore the pre-redirect files) plus, per redirected PURL, the manifest
 //! [`PatchRecord`] (file hashes + vulnerability metadata) so a post-install
 //! `socket-patch vex` can attest the redirected patches against the installed
 //! tree exactly as it does for `apply` / `vendor`. VEX folds `records`
@@ -315,11 +317,10 @@ pub async fn save_redirect_state(
 ///   `"name@version"`, pnpm v6 peer-suffixed `"name@version(peer…)"`, or the
 ///   pnpm-v5 respelling `"name@version_peer…"`.
 ///
-/// The old matcher claimed by NAME alone (`key == name`, key ends with
-/// `"/name"`): with two versions of one package hosted, vendoring one
-/// deleted BOTH versions' path-keyed edits, destroying the other version's
-/// revert originals. Name-only matching is gone; version-blind keys with no
-/// artifact anchor are KEPT (fail-closed — they may be the other version's
+/// Never claim by NAME alone (`key == name`, key ends with `"/name"`): with
+/// two versions of one package hosted, vendoring one would delete BOTH
+/// versions' path-keyed edits, destroying the other version's revert
+/// originals. Version-blind keys with no artifact anchor are KEPT (fail-closed — they may be the other version's
 /// only revert data). Consequence for the CLI's takeover-overlap fallback
 /// matcher (which still matches edit keys by bare name, but ONLY when
 /// `records` is empty — the degraded record-fetch-failed ledger): a normal
@@ -695,11 +696,11 @@ mod tests {
     /// TWO versions of one package hosted at once: dropping the vendored one
     /// must not touch the other version's halves. The npm path keys
     /// (`node_modules/…/left-pad`) and legacy `dependencies` bare-name keys
-    /// carry NO version, so the old name-anchored matcher claimed BOTH
+    /// carry NO version, so a name-anchored matcher would claim BOTH
     /// versions' edits here — destroying left-pad@2.0.0's pre-redirect
     /// originals (its only revert data) when left-pad@1.3.0 was vendored.
-    /// The matcher is artifact-anchored now: only edits whose rewritten
-    /// content references the dropped purl's own hosted artifact go.
+    /// Only edits whose rewritten content references the dropped purl's own
+    /// hosted artifact go.
     #[test]
     fn drop_superseded_purl_never_claims_the_other_hosted_versions_edits() {
         const UUID_V2: &str = "1a2b3c4d-5e6f-4a1b-8c2d-0f9e8d7c6b5a";
@@ -1041,7 +1042,7 @@ mod tests {
     /// is at index 0) — is refused outright: nothing is dropped and `false`
     /// is reported. Fail closed — without a `(name, version)` pair the
     /// matcher could only claim by name, the exact over-deletion the
-    /// artifact-anchored rewrite removed.
+    /// artifact anchor exists to prevent.
     #[test]
     fn drop_superseded_purl_unversioned_purl_drops_nothing() {
         for bogus in ["pkg:npm/left-pad", "pkg:npm/@1.0.0"] {
@@ -1164,9 +1165,9 @@ mod tests {
 
     #[tokio::test]
     async fn load_malformed_ledger_is_a_hard_error_naming_the_file() {
-        // A torn/hand-mangled ledger must NOT load as "no ledger": the old
-        // tolerant `None` let the next hosted run start a fresh ledger and
-        // silently overwrite the only copy of the pre-redirect revert data.
+        // A torn/hand-mangled ledger must NOT load as "no ledger": a
+        // tolerant `None` would let the next hosted run start a fresh ledger
+        // and silently overwrite the only copy of the pre-redirect revert data.
         let tmp = tempfile::tempdir().unwrap();
         let dir = tmp.path().join(".socket/vendor");
         tokio::fs::create_dir_all(&dir).await.unwrap();
@@ -1492,8 +1493,8 @@ mod tests {
     }
 
     /// Emptying the ledger deletes it AND prunes the now-empty
-    /// `.socket/vendor/` it lived in — the residue a hosted rollback used to
-    /// leave — but never `.socket/` itself (the lock guard owns that level).
+    /// `.socket/vendor/` it lived in — but never `.socket/` itself (the lock
+    /// guard owns that level).
     #[tokio::test]
     async fn persist_empty_state_prunes_the_emptied_vendor_dir() {
         let tmp = tempfile::tempdir().unwrap();
diff --git a/crates/socket-patch-core/src/patch/redirect/takeover.rs b/crates/socket-patch-core/src/patch/redirect/takeover.rs
index fc471ba2..268bec13 100644
--- a/crates/socket-patch-core/src/patch/redirect/takeover.rs
+++ b/crates/socket-patch-core/src/patch/redirect/takeover.rs
@@ -1443,12 +1443,13 @@ mod tests {
         (tmp, state)
     }
 
-    /// Bug I: two redirected versions of one crate share the manifest edit
-    /// key (the crate name). Removing one version must revert ONLY its own
+    /// Two redirected versions of one crate share the manifest edit key
+    /// (the crate name). Removing one version must revert ONLY its own
     /// declaration + lock entry + registry block — claiming the sibling's
-    /// manifest edit reverted the other pin while its lock entry stayed
-    /// hosted (a broken build), and dropped the sibling's registry edit, so
-    /// the second removal left the created `.cargo/config.toml` behind.
+    /// manifest edit would revert the other pin while its lock entry stayed
+    /// hosted (a broken build), and dropping the sibling's registry edit
+    /// would leave the created `.cargo/config.toml` behind on the second
+    /// removal.
     #[tokio::test]
     async fn multi_version_removes_each_version_independently() {
         const UUID_OLD: &str = "3c5d7e9f-2a4b-4c6d-8e0f-1a3b5c7d9e1f";
@@ -1667,11 +1668,8 @@ mod tests {
     }
 
     /// A v1 lock names every dependency by its full id, so the root block
-    /// references BOTH patched cfg-if versions. REGRESSION: each dependent
-    /// block was one whole-block edit, the second version's edit recorded
-    /// the first one's output as its `original`, and removing the
-    /// first-applied version alone found neither fragment — `remove`
-    /// refused as drifted unless purls went in exact reverse apply order.
+    /// references BOTH patched cfg-if versions. Removing the versions in any
+    /// order must succeed — not only in exact reverse apply order.
     #[tokio::test]
     async fn v1_lock_multi_version_removes_in_any_order() {
         const UUID_OLD: &str = "3c5d7e9f-2a4b-4c6d-8e0f-1a3b5c7d9e1f";
@@ -1751,10 +1749,9 @@ mod tests {
     /// both cfg-if versions: each run pinned BOTH declarations to its own
     /// registry, so the file ends with both on the 0.1.10 registry and the
     /// ledger holds plain→1.0.4 then 1.0.4→0.1.10 edits for both lines.
-    /// REGRESSION: removing 1.0.4 first claimed the plain→1.0.4 edit of the
-    /// 0.1.10 declaration but not its 1.0.4→0.1.10 successor, found neither
-    /// fragment and refused as drifted; removing 0.1.10 first dropped the
-    /// still-referenced 0.1.10 registry edit and left the config behind.
+    /// Removing either version first must neither refuse as drifted (by
+    /// claiming only half of a declaration's chain) nor drop a
+    /// still-referenced registry edit and leave the config behind.
     #[tokio::test]
     async fn legacy_name_only_multi_version_ledger_removes_in_any_order() {
         let (toml, lock) = multi_version_project();
@@ -1875,9 +1872,9 @@ mod tests {
     /// An older CLI redirected only 1.0.4 and its name-only matcher also
     /// pinned the 0.1.10 declaration to 1.0.4's registry; the current
     /// planner then repaired it (superseding that pin with 0.1.10's own
-    /// registry) while redirecting 0.1.10. REGRESSION: removing 1.0.4
-    /// claimed the old mis-pin edit, whose fragments were both gone, and
-    /// refused as drifted.
+    /// registry) while redirecting 0.1.10. Removing 1.0.4 must not claim the
+    /// superseded mis-pin edit (whose fragments are both gone) and refuse as
+    /// drifted.
     #[tokio::test]
     async fn repaired_legacy_mispin_removes_in_any_order() {
         let (toml, lock) = multi_version_project();
@@ -2206,7 +2203,8 @@ mod tests {
             .await
             .expect("dry-run revert succeeds");
 
-        // Nothing reached disk and the ledger still claims everything.
+        // Nothing reached disk (the in-memory claim is checked below; the
+        // persisted ledger is the caller's and is never written on a dry run).
         assert_eq!(
             tokio::fs::read_to_string(root.join("Cargo.toml"))
                 .await
@@ -3077,11 +3075,10 @@ mod tests {
         assert!(state.edits.is_empty(), "{state:?}");
     }
 
-    /// Finding: a symlinked `.npmrc` passed planning (the read followed
-    /// the link), `flush_staged` wrote the reverted lock, and only then did
-    /// `flush_npmrc` refuse the link — leaving the lock un-hosted while the
-    /// ledger still recorded the redirect. The refusal now happens while
-    /// planning: lock byte-identical, ledger untouched. While another
+    /// A symlinked `.npmrc` refuses while planning — never at
+    /// `flush_npmrc` time, after `flush_staged` had written the reverted
+    /// lock while the ledger still recorded the redirect: lock
+    /// byte-identical, ledger untouched. While another
     /// package-lock entry still needs the setting, the odd `.npmrc` shape
     /// does not block the revert at all (the file is never read).
     #[cfg(unix)]
@@ -4094,8 +4091,7 @@ mod tests {
             .unwrap()
     }
 
-    /// The bun revert used to be a hard refusal ("cannot replay yet");
-    /// now the takeover claims the purl's `redirect_bun_lock_package` edit
+    /// The takeover claims the purl's `redirect_bun_lock_package` edit
     /// by the recorded line's spec and replays the registry line back,
     /// leaving the sibling-version and foreign entries untouched.
     #[tokio::test]
@@ -4181,8 +4177,8 @@ mod tests {
     /// (`bun add`, `bun install` after a manifest change): the recorded
     /// `new` is no longer on disk byte-for-byte, but the 2-tuple with the
     /// same key/spec/meta IS our wiring — the claim must not refuse as
-    /// drift (that blocked hosted→vendored takeover, scoped `rollback` and
-    /// `remove` for every user on those releases). The registry line comes
+    /// drift (that would block hosted→vendored takeover, scoped `rollback`
+    /// and `remove` for every user on those releases). The registry line comes
     /// back and the ledger is cleared.
     fn drop_digest(line: &str) -> String {
         let cut = line
@@ -4907,10 +4903,10 @@ mod tests {
         assert!(state.edits.is_empty(), "edits dropped");
     }
 
-    /// Bug H: removing the block the redirect APPENDED to an existing
-    /// config (the legacy `.cargo/config` here) restores the user's bytes —
-    /// it left a trailing blank line (`[net]\nretry = 2\n\n`) — and never
-    /// touches blank runs of the user's own elsewhere in the file.
+    /// Removing the block the redirect APPENDED to an existing config (the
+    /// legacy `.cargo/config` here) restores the user's bytes — no trailing
+    /// blank line (`[net]\nretry = 2\n\n`) left behind — and never touches
+    /// blank runs of the user's own elsewhere in the file.
     #[tokio::test]
     async fn appended_registry_block_revert_restores_the_config_bytes() {
         let cases = [
@@ -4993,7 +4989,7 @@ mod tests {
         }
     }
 
-    /// Bug K: a CRLF project (manifest, lock and legacy config) is
+    /// A CRLF project (manifest, lock and legacy config) is
     /// redirected with CRLF kept and `remove` restores every byte.
     #[tokio::test]
     async fn crlf_project_reverts_byte_for_byte() {
@@ -5048,8 +5044,8 @@ mod tests {
     /// files checked out on the other: a Windows scan (CRLF fragments,
     /// JSON-escaped, so git never converts them) removed on an LF checkout,
     /// and an LF scan removed on a CRLF (`core.autocrlf`) checkout — through
-    /// `remove` and through the whole-ledger replay. REGRESSION: both
-    /// refused as "drifted" (neither fragment found byte-for-byte).
+    /// `remove` and through the whole-ledger replay — neither may refuse as
+    /// "drifted" because no fragment matches byte-for-byte.
     #[tokio::test]
     async fn revert_survives_a_checkout_line_ending_conversion() {
         let crlf = |s: &str| s.replace('\n', "\r\n");
@@ -5156,9 +5152,9 @@ mod tests {
         assert!(state.edits.is_empty(), "edits dropped");
     }
 
-    /// The whole-ledger replay keeps a hand-pinned block too (it removed
-    /// it unconditionally, leaving the hand pin naming an undefined
-    /// registry), while still unwinding the wiring it owns.
+    /// The whole-ledger replay keeps a hand-pinned block too (removing it
+    /// would leave the hand pin naming an undefined registry), while still
+    /// unwinding the wiring it owns.
     #[tokio::test]
     async fn replay_keeps_a_registry_block_still_referenced() {
         let (tmp, mut state) = redirected_fixture().await;
diff --git a/crates/socket-patch-core/src/patch/redirect/vlt.rs b/crates/socket-patch-core/src/patch/redirect/vlt.rs
index f40b5f11..bf256b82 100644
--- a/crates/socket-patch-core/src/patch/redirect/vlt.rs
+++ b/crates/socket-patch-core/src/patch/redirect/vlt.rs
@@ -155,7 +155,7 @@ pub(super) fn default_instances<'a>(lock: &'a HostedLock, dep: &DepOverride) ->
     partition_instances(nodes, &full_name(dep), &dep.version, lock.parsed.options()).0
 }
 
-/// Does `dep` have a node of socket-patch's vendored vlt shape (§3.4) in a
+/// Does `dep` have a node of socket-patch's vendored vlt shape in a
 /// lock that passed the lock-level parse?
 pub(super) fn has_vendored_instance(lock: &HostedLock, dep: &DepOverride) -> bool {
     lock.parsed
@@ -163,9 +163,9 @@ pub(super) fn has_vendored_instance(lock: &HostedLock, dep: &DepOverride) -> boo
         .is_some_and(|nodes| has_vendored_node(nodes, &full_name(dep), &dep.version))
 }
 
-/// The lock-level warnings that say vlt may discard the lock's pins
-/// (§3.9 (c)): neither in-run nor standalone VEX attests a hosted pin of such
-/// a lock from the lock alone.
+/// The lock-level warnings that say vlt may discard the lock's pins:
+/// neither in-run nor standalone VEX attests a hosted pin of such a lock
+/// from the lock alone.
 pub const DISCARDING_LOCK_CODES: [&str; 3] = [
     VERSION_MISSING,
     OLD_LOCKFILE_IGNORED,
@@ -529,8 +529,8 @@ fn rewrite_dep(
     changed
 }
 
-/// The hosted vlt rewrite (DESIGN §3.2–§3.8): lock-level refusal and
-/// advisories, then each npm override's default-registry instances.
+/// The hosted vlt rewrite: lock-level refusal and advisories, then each
+/// npm override's default-registry instances.
 pub(super) fn rewrite_vlt_lock(
     files: &BTreeMap<String, String>,
     overrides: &[DepOverride],
diff --git a/crates/socket-patch-core/src/patch/redirect/vlt_heal.rs b/crates/socket-patch-core/src/patch/redirect/vlt_heal.rs
index 53547140..5bbeb1ac 100644
--- a/crates/socket-patch-core/src/patch/redirect/vlt_heal.rs
+++ b/crates/socket-patch-core/src/patch/redirect/vlt_heal.rs
@@ -1,4 +1,4 @@
-//! Warm-tree heal for hosted vlt redirects (DESIGN D7).
+//! Warm-tree heal for hosted vlt redirects.
 //!
 //! vlt never refreshes a store entry it already holds: after the lock is
 //! repointed, `vlt install` keeps `node_modules/.vlt/<DepID>` and the
@@ -370,7 +370,7 @@ async fn bytes_check(dir: &Path, target: &Target<'_>, expected: Expected) -> Byt
 }
 
 /// Is `target`'s store entry stale against `expected`, healthy, or
-/// impossible to judge? See DESIGN §3.9 "Heal" for the rules.
+/// impossible to judge? The module doc states the rules.
 pub async fn classify_target(
     state: &InstallState,
     root: &Path,
diff --git a/crates/socket-patch-core/src/patch/rollback.rs b/crates/socket-patch-core/src/patch/rollback.rs
index d2eb720e..571a4098 100644
--- a/crates/socket-patch-core/src/patch/rollback.rs
+++ b/crates/socket-patch-core/src/patch/rollback.rs
@@ -95,9 +95,8 @@ pub async fn verify_file_rollback(
     if is_new_file {
         // Probe the directory ENTRY (`symlink_metadata`), not the symlink
         // target: a dangling symlink left where the patch-added file was
-        // makes `metadata` report ENOENT, which mis-classified the entry
-        // as already rolled back — the package rollback claimed success
-        // while silently leaving the stray entry behind. Only a true
+        // makes `metadata` report ENOENT, which would mis-classify the
+        // entry as already rolled back. Only a true
         // NotFound means already-gone; any other stat error (ELOOP,
         // EACCES) is an unverifiable state and must fail closed.
         match tokio::fs::symlink_metadata(&filepath).await {
@@ -822,9 +821,7 @@ mod tests {
     /// Validate-before-write: a corrupt/mismatched rollback blob must be
     /// refused *before* any disk write, leaving the on-disk file
     /// byte-identical to its pre-call (patched) state and dropping no
-    /// `.socket-stage-*` litter. Regression: the old in-place
-    /// `tokio::fs::write` committed the bad bytes over the file and only
-    /// then hashed, leaving the file corrupted on the error path.
+    /// `.socket-stage-*` litter.
     #[tokio::test]
     async fn test_rollback_file_patch_hash_mismatch_leaves_file_intact() {
         let dir = tempfile::tempdir().unwrap();
@@ -857,8 +854,7 @@ mod tests {
     /// Copy-on-write safety: rolling back a file that shares an inode
     /// with a sibling (the pnpm / Go-cache hardlink case) must only
     /// restore *our* copy. The sibling — another project's view or the
-    /// shared store entry — must keep its bytes. Regression: the old
-    /// in-place write mutated the shared inode and corrupted the sibling.
+    /// shared store entry — must keep its bytes.
     #[cfg(unix)]
     #[tokio::test]
     async fn test_rollback_file_patch_does_not_propagate_to_hardlinked_sibling() {
@@ -892,9 +888,7 @@ mod tests {
 
     /// Permission fidelity: rolling back a read-only file (Go module
     /// cache marks sources `0o444`) must restore the original content
-    /// AND leave the file read-only afterward. Regression: the old code
-    /// relaxed the mode to `0o644` to write and never restored it,
-    /// silently leaving rolled-back cache files writable.
+    /// AND leave the file read-only afterward.
     #[cfg(unix)]
     #[tokio::test]
     async fn test_rollback_file_patch_preserves_readonly_mode() {
@@ -931,8 +925,7 @@ mod tests {
     /// End-to-end rollback against a fully read-only package directory
     /// (Go cache: `0o444` files inside a `0o555` directory). The atomic
     /// stage+rename path must temporarily grant directory write, restore
-    /// content, and put the directory mode back. Regression: the old
-    /// in-place write could not stage inside a read-only directory.
+    /// content, and put the directory mode back.
     #[cfg(unix)]
     #[tokio::test]
     async fn test_rollback_package_patch_in_readonly_dir() {
@@ -1170,13 +1163,11 @@ mod tests {
         assert!(result.error.is_some());
     }
 
-    /// Regression (blob-vs-already-original ordering): a file already at
+    /// Blob-vs-already-original ordering: a file already at
     /// its original (`beforeHash`) state must verify as `AlreadyOriginal`
     /// even when the before-blob is gone. A finished rollback needs no
     /// blob to restore, so a GC'd blob must NOT downgrade it to
-    /// `MissingBlob`. Before the fix the blob check ran first and a
-    /// re-run rollback (or one after blob cleanup) reported a spurious
-    /// missing-blob failure.
+    /// `MissingBlob`.
     #[tokio::test]
     async fn test_verify_file_rollback_already_original_without_blob() {
         let pkg_dir = tempfile::tempdir().unwrap();
@@ -1200,11 +1191,10 @@ mod tests {
         assert_eq!(result.status, VerifyRollbackStatus::AlreadyOriginal);
     }
 
-    /// Package-level consequence of the ordering fix: an already-original
+    /// Package-level consequence of that ordering: an already-original
     /// file whose blob was GC'd must not block its sibling's real
     /// rollback. The whole package should succeed and the ready file
-    /// should be restored. Before the fix the missing blob on the
-    /// no-op file aborted the entire package rollback.
+    /// should be restored.
     #[tokio::test]
     async fn test_rollback_package_patch_already_original_missing_blob_does_not_block() {
         let pkg_dir = tempfile::tempdir().unwrap();
@@ -1271,8 +1261,6 @@ mod tests {
     /// the package directory must be refused at verification — never
     /// hashed or stat'd through `pkg_path.join`. Returns a blocking
     /// status (not Ready/AlreadyOriginal) so the package rollback aborts.
-    /// Regression: verify joined the raw key with no safety check, the
-    /// same hole the apply path closes with `is_safe_relative_subpath`.
     #[tokio::test]
     async fn test_verify_file_rollback_rejects_path_escape() {
         let pkg_dir = tempfile::tempdir().unwrap();
@@ -1300,8 +1288,7 @@ mod tests {
     /// branch builds the path itself and calls `remove_file` directly,
     /// bypassing `apply_file_patch_at`'s guard. A poisoned manifest with an
     /// empty `beforeHash` and an escaping key must NOT unlink a file
-    /// outside the package dir. Regression: the bare `remove_file` would
-    /// delete an arbitrary host file.
+    /// outside the package dir.
     #[tokio::test]
     async fn test_rollback_package_patch_new_file_path_escape_blocked() {
         let root = tempfile::tempdir().unwrap();
@@ -1406,11 +1393,10 @@ mod tests {
         assert_eq!(result.files_rolled_back.len(), 0);
     }
 
-    /// Regression (read-only-dir delete): deleting a patch-added file
+    /// Read-only-dir delete: deleting a patch-added file
     /// requires write permission on the *parent directory*. A Go-cache
     /// style read-only directory (0o555) must be temporarily relaxed for
-    /// the unlink and restored to its exact prior mode afterward. Before
-    /// the fix the bare `remove_file` failed with EACCES.
+    /// the unlink and restored to its exact prior mode afterward.
     #[cfg(unix)]
     #[tokio::test]
     async fn test_rollback_package_patch_new_file_delete_in_readonly_dir() {
@@ -1474,10 +1460,9 @@ mod tests {
     /// joined onto the blobs directory as a path component. A traversal
     /// (`../x`) or absolute "hash" must be refused at verification —
     /// `Path::join` discards the base on an absolute string and `..`
-    /// walks out, so an escaping hash that resolved to any existing file
-    /// verified `Ready` and the rollback loop then read an arbitrary
-    /// out-of-tree path (existence oracle, unbounded read of `/dev/zero`,
-    /// FIFO hang).
+    /// walks out, so an escaping hash must never verify `Ready` and let the
+    /// rollback loop read an arbitrary out-of-tree path (existence oracle,
+    /// unbounded read of `/dev/zero`, FIFO hang).
     #[tokio::test]
     async fn test_verify_file_rollback_rejects_blob_hash_escape() {
         let root = tempfile::tempdir().unwrap();
@@ -1521,10 +1506,9 @@ mod tests {
 
     /// SECURITY (before-blob escape at the read site): a poisoned manifest
     /// whose `beforeHash` escapes the blobs directory must fail the
-    /// package rollback with the path-safety error. Regression: the
-    /// unguarded code read the out-of-tree file and leaked its git-sha256
-    /// into the error message ("Got: <hash>") — an existence +
-    /// content-hash oracle over any host file readable by the user.
+    /// package rollback with the path-safety error, never leaking the
+    /// out-of-tree file's git-sha256 into the error message ("Got: <hash>")
+    /// — an existence + content-hash oracle over any host file.
     #[tokio::test]
     async fn test_rollback_package_patch_blob_hash_escape_blocked() {
         let root = tempfile::tempdir().unwrap();
@@ -1574,11 +1558,10 @@ mod tests {
         );
     }
 
-    /// Regression (new-file dangling symlink): `metadata()` follows
-    /// symlinks, so a dangling symlink left where the patch-added file
-    /// was reported ENOENT → `AlreadyOriginal`, and the package rollback
-    /// claimed success while silently leaving the stray entry behind.
-    /// The entry probe must be `symlink_metadata`: a path occupied by
+    /// New-file dangling symlink: `metadata()` follows symlinks, so a
+    /// dangling symlink left where the patch-added file was would read
+    /// ENOENT → `AlreadyOriginal`. The entry probe must be
+    /// `symlink_metadata`: a path occupied by
     /// something that is neither the added file nor absent is a modified
     /// state and must fail closed, like every other modified state.
     #[cfg(unix)]
@@ -1617,14 +1600,12 @@ mod tests {
         assert!(tokio::fs::symlink_metadata(&path).await.is_ok());
     }
 
-    /// Regression (cargo sidecar resync): apply rewrites
-    /// `.cargo-checksum.json` to the *patched* SHA256s (and inserts
-    /// entries for patch-added files). Rolling the package back restores
-    /// the original bytes but used to leave the checksum file untouched —
-    /// original sources verified against patched hashes, so the very next
-    /// `cargo build` of the vendored crate refused with "checksum ...
-    /// has changed" (proven by `cargo_check_fails_without_sidecar_fixup`
-    /// in the cargo-build e2e). Rollback must resync the sidecar:
+    /// Cargo sidecar resync: apply rewrites `.cargo-checksum.json` to the
+    /// *patched* SHA256s (and inserts entries for patch-added files). With
+    /// the original bytes restored, a stale checksum file makes the next
+    /// `cargo build` of the vendored crate refuse with "checksum ... has
+    /// changed" (see `cargo_check_fails_without_sidecar_fixup` in the
+    /// cargo-build e2e). Rollback must resync the sidecar:
     /// restored files get their original hash back, and the entry for a
     /// patch-added (now deleted) file is removed entirely.
     #[tokio::test]
@@ -1793,7 +1774,7 @@ mod tests {
         assert_eq!(advisory.severity, SidecarSeverity::Error);
     }
 
-    /// Regression (retried partial rollback wedges cargo): a previous
+    /// Retried partial rollback must not wedge cargo: a previous
     /// rollback that failed partway restored a.rs to its ORIGINAL bytes
     /// but returned before the resync boundary, leaving a.rs's
     /// `.cargo-checksum.json` entry at the PATCHED hash apply's fixup
@@ -1897,10 +1878,8 @@ mod tests {
     /// directory only ever contains regular files the CLI wrote, but a
     /// symlink planted at `blobs/<hash>` — committable to a poisoned repo
     /// alongside the manifest, unlike the already-guarded escaping hash
-    /// STRING — re-opens the same out-of-tree read the string guard
-    /// blocks. Regression: `metadata` followed the link, verify reported
-    /// `Ready`, and the restore loop then read an arbitrary out-of-tree
-    /// file through it.
+    /// STRING — would re-open the same out-of-tree read the string guard
+    /// blocks.
     #[cfg(unix)]
     #[tokio::test]
     async fn test_verify_file_rollback_rejects_symlinked_blob_entry() {
@@ -2052,13 +2031,11 @@ mod tests {
 
     /// SECURITY (symlinked blob entry at the read site): a poisoned repo
     /// that commits `blobs/<hex>` as a symlink to an out-of-tree file must
-    /// fail the package rollback WITHOUT reading through the link.
-    /// Regression: the bare `tokio::fs::read` followed it and the
-    /// hash-verify mismatch error leaked the target's git-sha256
-    /// ("Got: <hash>") — the same existence + content-hash oracle the
-    /// escaping-hash-string fix closed (see
-    /// `test_rollback_package_patch_blob_hash_escape_blocked`); a FIFO or
-    /// device target instead meant an unbounded read or a permanent hang.
+    /// fail the package rollback WITHOUT reading through the link: the
+    /// hash-verify mismatch error would leak the target's git-sha256
+    /// ("Got: <hash>") — the same oracle
+    /// `test_rollback_package_patch_blob_hash_escape_blocked` pins — and a
+    /// FIFO or device target would mean an unbounded read or a hang.
     #[cfg(unix)]
     #[tokio::test]
     async fn test_rollback_package_patch_symlinked_blob_entry_blocked() {
@@ -2113,12 +2090,9 @@ mod tests {
     }
 
     /// SECURITY/robustness (FIFO blob entry): a FIFO planted at
-    /// `blobs/<hash>` must be refused at verification. Regression: the
-    /// `metadata` probe reported it present, verify said `Ready`, and the
-    /// restore loop's blob read then blocked forever waiting for a writer
-    /// — the rollback wedged with zero diagnostics (same class as the
-    /// crawler/state-file FIFO wedges). The verify-time probe is
-    /// stat-only, so this test cannot hang even on the broken code.
+    /// `blobs/<hash>` must be refused at verification, or the restore
+    /// loop's blob read blocks forever waiting for a writer. The
+    /// verify-time probe is stat-only, so this test cannot hang.
     #[cfg(unix)]
     #[tokio::test]
     async fn test_verify_file_rollback_rejects_fifo_blob_entry() {
@@ -2200,11 +2174,11 @@ mod tests {
     }
 
     /// Fail-closed (existing-entry hash error): when the manifest-keyed path
-    /// exists but cannot be hashed — a DIRECTORY planted at the path passes
-    /// the `metadata` existence probe, then `open_regular_file` rejects it —
-    /// verify must block with the real error, not fabricate a hash. The
-    /// new-file twin of this branch is covered by the dangling-symlink test;
-    /// this pins the non-empty-`beforeHash` route.
+    /// exists but cannot be hashed — a DIRECTORY planted at the path is
+    /// rejected by `open_regular_file` when verify hashes it (there is no
+    /// separate existence probe) — verify must block with the real error,
+    /// not fabricate a hash. The new-file twin of this branch is covered by
+    /// the dangling-symlink test; this pins the non-empty-`beforeHash` route.
     #[tokio::test]
     async fn test_verify_file_rollback_hash_error_on_existing_entry_fails_closed() {
         let pkg_dir = tempfile::tempdir().unwrap();
diff --git a/crates/socket-patch-core/src/patch/sidecars/cargo.rs b/crates/socket-patch-core/src/patch/sidecars/cargo.rs
index b54d276f..1e4b5e59 100644
--- a/crates/socket-patch-core/src/patch/sidecars/cargo.rs
+++ b/crates/socket-patch-core/src/patch/sidecars/cargo.rs
@@ -139,27 +139,16 @@ async fn sync_checksum(
     // `tokio::fs::write`. The checksum file lives inside a Cargo
     // registry/vendor `<crate>-<version>/` tree, which Cargo marks
     // read-only (files `0o444` inside `0o555` dirs) for tamper
-    // detection. A plain in-place truncating write has three defects
-    // there, all of which the rest of the patch engine was hardened
-    // against (see `apply::apply_file_patch_at` and `rollback`):
-    //
-    //   1. **Read-only-hostile.** Opening the existing `0o444` file
-    //      `O_TRUNC` fails `EACCES`, so the fixup errored out exactly
-    //      in the real-registry case it exists to handle — leaving the
-    //      checksum stale-patched and every future `cargo build` of the
-    //      crate refusing the (correctly) patched sources.
-    //   2. **Non-atomic.** A crash / `ENOSPC` mid-write leaves a
-    //      truncated, unparseable `.cargo-checksum.json` — strictly
-    //      worse than a stale hash, because cargo can no longer even
-    //      parse it to report a mismatch; the crate is wedged.
-    //   3. **Copy-on-write-unsafe.** A vendored tree hardlinked into a
-    //      shared store would have its sibling mutated in place.
+    // detection. A plain in-place truncating write would fail `EACCES`
+    // on the `0o444` file, could leave a truncated, unparseable checksum
+    // on a crash / `ENOSPC` (wedging the crate), and would mutate a
+    // hardlinked shared-store sibling in place.
     //
     // `apply_file_patch_at` stages a sibling, fsyncs, and `rename(2)`s
     // atomically (the rename-over is the copy-on-write isolation for a
     // hardlinked sibling — see `utils::fs::atomic_write_bytes`); relaxes
-    // then restores BOTH the file's and the directory's read-only modes;
-    // and verifies the bytes that landed. The `expected_hash` is just the
+    // then restores a read-only parent directory; restores the file's
+    // mode; and verifies the bytes it writes. The `expected_hash` is just the
     // digest of the bytes we hand it (a self-check) — the file already
     // exists, so its original mode is snapshotted and restored
     // bit-for-bit. The post-write ownership warning it may return is
@@ -425,13 +414,11 @@ mod tests {
         assert!(matches!(err, SidecarError::Malformed { .. }));
     }
 
-    /// Regression (read-only checksum file): a real Cargo registry/vendor
-    /// tree marks `.cargo-checksum.json` read-only (`0o444`) for tamper
-    /// detection. The rewrite must still succeed — the hardened
-    /// stage+rename path relaxes the file's mode, swaps a fresh inode in
-    /// atomically, and restores the original `0o444` mode afterward.
-    /// Before the fix the bare in-place `tokio::fs::write` failed `EACCES`
-    /// here, leaving the checksum stale-patched and the crate unbuildable.
+    /// Read-only checksum file: a real Cargo registry/vendor tree marks
+    /// `.cargo-checksum.json` read-only (`0o444`) for tamper detection.
+    /// The rewrite must still succeed — the stage+rename path swaps a
+    /// fresh inode in atomically and restores the original `0o444` mode
+    /// afterward.
     #[cfg(unix)]
     #[tokio::test]
     async fn rewrites_readonly_checksum_file_and_restores_mode() {
@@ -480,12 +467,11 @@ mod tests {
         );
     }
 
-    /// Regression (read-only package directory): Cargo also marks the
+    /// Read-only package directory: Cargo also marks the
     /// crate directory `0o555`. The atomic stage+rename needs write
     /// permission on the *parent dir* to create its sibling stage file,
     /// so the write path must temporarily grant directory write and
-    /// restore the exact `0o555` mode afterward. The bare write could
-    /// not stage inside a read-only directory at all.
+    /// restore the exact `0o555` mode afterward.
     #[cfg(unix)]
     #[tokio::test]
     async fn rewrites_inside_readonly_package_dir() {
@@ -531,12 +517,10 @@ mod tests {
         );
     }
 
-    /// Security regression (path escape via `..`): a poisoned patch
-    /// entry whose key walks out of the package dir must be refused —
-    /// NOT hashed and embedded under an escaping key in the committed
-    /// checksum. Before the guard, `sha256_file` read the out-of-tree
-    /// target and `update_entries` inserted `../secret.txt` into the
-    /// `files` map (info leak + checksum corruption).
+    /// Security (path escape via `..`): a poisoned patch entry whose key
+    /// walks out of the package dir must be refused — NOT hashed and
+    /// embedded under an escaping key in the committed checksum (info
+    /// leak + checksum corruption).
     #[tokio::test]
     async fn refuses_dotdot_escape_path() {
         let d = tempfile::tempdir().unwrap();
@@ -578,7 +562,7 @@ mod tests {
         );
     }
 
-    /// Security regression (absolute-path escape): `Path::join` discards
+    /// Security (absolute-path escape): `Path::join` discards
     /// the base when the key is absolute, so an absolute key would hash
     /// an arbitrary system file. Must be refused exactly like `..`.
     #[tokio::test]
@@ -748,13 +732,11 @@ mod tests {
         );
     }
 
-    /// DoS regression (FIFO checksum file): the checksum file is read
-    /// straight out of the (untrusted) package tree on every cargo
-    /// apply. A FIFO planted at `.cargo-checksum.json` made the plain
-    /// `open(2)` wait for a writer that never comes — wedging apply
-    /// forever *after* the patch bytes were committed. Same DoS class
-    /// already fixed in `file_hash.rs` and `package.rs`: the open must
-    /// be non-blocking and non-regular files must be rejected.
+    /// DoS (FIFO checksum file): the checksum file is read straight out
+    /// of the (untrusted) package tree on every cargo apply. A FIFO
+    /// planted at `.cargo-checksum.json` must not wedge apply on a
+    /// blocking `open(2)`: the open must be non-blocking and non-regular
+    /// files must be rejected (as in `file_hash.rs` and `package.rs`).
     #[cfg(unix)]
     #[tokio::test]
     async fn fifo_checksum_file_errors_promptly() {
@@ -782,9 +764,9 @@ mod tests {
         assert!(matches!(result, Err(SidecarError::Io { .. })));
     }
 
-    /// DoS regression (FIFO patched-file target): `update_entries`
-    /// hashes each patched path from disk; a FIFO at that path hung the
-    /// rehash the same way. Must error promptly instead.
+    /// DoS (FIFO patched-file target): `update_entries` hashes each
+    /// patched path from disk; a FIFO at that path must error promptly
+    /// instead of hanging the rehash.
     #[cfg(unix)]
     #[tokio::test]
     async fn fifo_patched_file_errors_promptly() {
@@ -825,8 +807,7 @@ mod tests {
     /// Copy-on-write safety: when `.cargo-checksum.json` is hardlinked
     /// into a shared store (a vendored tree shared between projects),
     /// the rewrite must give us a private inode and leave the sibling
-    /// untouched. The atomic rename-over-target achieves this; the old
-    /// in-place write would have mutated the shared inode.
+    /// untouched. The atomic rename-over-target achieves this.
     #[cfg(unix)]
     #[tokio::test]
     async fn rewrite_does_not_mutate_hardlinked_sibling() {
diff --git a/crates/socket-patch-core/src/patch/sidecars/mod.rs b/crates/socket-patch-core/src/patch/sidecars/mod.rs
index fe34e573..b814bfce 100644
--- a/crates/socket-patch-core/src/patch/sidecars/mod.rs
+++ b/crates/socket-patch-core/src/patch/sidecars/mod.rs
@@ -8,7 +8,7 @@
 //! module owns the post-apply rewrites that keep those sidecars
 //! consistent with what we just wrote to disk.
 //!
-//! Coverage in this revision:
+//! Coverage:
 //!
 //! - **Cargo** ([`cargo::fixup`]): rewrite `.cargo-checksum.json` so
 //!   `cargo build` accepts the patched sources.
@@ -19,7 +19,6 @@
 //!   surfaces an advisory ALONGSIDE the metadata deletion.
 //! - **PyPI / gem / Go**: advisory only — emit a structured
 //!   advisory so downstream tooling consequences are programmatic.
-//!   Full sidecar rewrites land in follow-ups.
 //!
 //! All ecosystems return a [`SidecarRecord`] via [`dispatch_fixup`].
 //! The record is the canonical JSON-envelope shape — see
@@ -277,7 +276,7 @@ mod tests {
         assert!(out.is_none());
     }
 
-    /// Regression: an empty `patched` list short-circuits to `None`
+    /// An empty `patched` list short-circuits to `None`
     /// *before* the PURL is classified, even for an ecosystem that
     /// would otherwise always emit an advisory (pypi). Guards the
     /// `patched.is_empty()` early return at the top of `dispatch_fixup`
diff --git a/crates/socket-patch-core/src/patch/sidecars/nuget.rs b/crates/socket-patch-core/src/patch/sidecars/nuget.rs
index fcfdd651..3bbf4230 100644
--- a/crates/socket-patch-core/src/patch/sidecars/nuget.rs
+++ b/crates/socket-patch-core/src/patch/sidecars/nuget.rs
@@ -14,9 +14,8 @@
 //! metadata as "unknown state, accept the install" rather than
 //! "checksum mismatch, refuse". A signed-package detail tag
 //! (`<name>.<ver>.nupkg.sha512`) — if present — still flags
-//! tampering at the package-archive level; the new typed surface
-//! carries that as an advisory ALONGSIDE the metadata-deleted file
-//! entry (no longer collapsed).
+//! tampering at the package-archive level; that is carried as an
+//! advisory ALONGSIDE the metadata-deleted file entry.
 
 use std::path::Path;
 
@@ -79,8 +78,7 @@ pub(crate) async fn fixup(pkg_path: &Path) -> Result<Option<SidecarPayload>, Sid
 
     // If a `*.nupkg.sha512` sibling exists, the package is signed at
     // the archive level. We can't fix that. Surface a structured
-    // advisory regardless of whether we also deleted metadata — the
-    // old design's lossy collapse hid this when both fired.
+    // advisory regardless of whether we also deleted metadata.
     let advisory = if has_signed_marker(pkg_path).await {
         Some(SidecarAdvisory {
             code: SidecarAdvisoryCode::NugetSignedPackageTampered,
@@ -119,8 +117,7 @@ pub(crate) async fn fixup(pkg_path: &Path) -> Result<Option<SidecarPayload>, Sid
 /// file. The check follows symlinks (`fs::metadata`, not the
 /// non-following `DirEntry::file_type`) so a marker that ships as a
 /// symlink to a real `.sha512` still counts — fail-closed against the
-/// directory false-positive, not fail-open against a symlinked marker
-/// (the symlink-drop trap the npm/cargo crawlers were bitten by).
+/// directory false-positive, not fail-open against a symlinked marker.
 async fn has_signed_marker(pkg_path: &Path) -> bool {
     for entry in list_dir_entries(pkg_path).await {
         if entry
@@ -182,7 +179,7 @@ mod tests {
         assert_eq!(adv.severity, SidecarSeverity::Warning);
     }
 
-    /// Regression (read-only package directory): NuGet caches — like
+    /// Read-only package directory: NuGet caches — like
     /// Cargo's registry and Go's module cache — can live inside a
     /// directory the host marks read-only (`0o555`) for tamper
     /// detection. Removing `.nupkg.metadata` requires *write permission
@@ -233,13 +230,10 @@ mod tests {
         );
     }
 
-    /// Regression (directory false-positive): a *directory* whose name
-    /// ends in `.nupkg.sha512` is NOT a content-signing marker. Before
-    /// the `is_file` guard, `has_signed_marker` matched on name alone
-    /// and emitted a spurious "package may be flagged as tampered"
-    /// advisory for it — misleading an operator into thinking an
-    /// unsigned package was signed. There's no metadata here either, so
-    /// the correct outcome is a clean `None`.
+    /// Directory false-positive: a *directory* whose name ends in
+    /// `.nupkg.sha512` is NOT a content-signing marker and must not emit
+    /// a spurious "package may be flagged as tampered" advisory. There's
+    /// no metadata here either, so the correct outcome is a clean `None`.
     #[tokio::test]
     async fn directory_named_like_marker_is_not_a_signature() {
         let d = tempfile::tempdir().unwrap();
@@ -280,7 +274,7 @@ mod tests {
     /// A marker shipped as a *symlink to a real `.sha512` file* must
     /// still count — the `is_file` guard follows symlinks, so it does
     /// not fail open the way the non-following `DirEntry::file_type`
-    /// would have (the symlink-drop trap the crawlers were bitten by).
+    /// would.
     #[cfg(unix)]
     #[tokio::test]
     async fn symlinked_marker_still_counts_as_signed() {
@@ -330,9 +324,8 @@ mod tests {
         );
     }
 
-    /// Signed package WITH metadata: the typed payload now carries
-    /// BOTH the file entry and the advisory — the lossy collapse
-    /// from the old design is fixed.
+    /// Signed package WITH metadata: the typed payload carries
+    /// BOTH the file entry and the advisory.
     #[tokio::test]
     async fn signed_with_metadata_carries_files_and_advisory() {
         let d = tempfile::tempdir().unwrap();
diff --git a/crates/socket-patch-core/src/patch/sidecars/types.rs b/crates/socket-patch-core/src/patch/sidecars/types.rs
index ca97304c..4fbb0fcf 100644
--- a/crates/socket-patch-core/src/patch/sidecars/types.rs
+++ b/crates/socket-patch-core/src/patch/sidecars/types.rs
@@ -69,8 +69,7 @@ pub enum SidecarFileAction {
     Deleted,
 }
 
-/// Structured operator advisory. Replaces the previous free-form
-/// `Option<String>` field so consumers can switch on `code` and
+/// Structured operator advisory: consumers switch on `code` and
 /// route on `severity` without regex-matching `message`.
 #[derive(Debug, Clone, Serialize, PartialEq, Eq)]
 #[serde(rename_all = "camelCase")]
@@ -280,8 +279,8 @@ mod tests {
     }
 
     /// Multi-file record + advisory together — the NuGet
-    /// signed-package case that the old design lost. Verify both
-    /// surface in the JSON simultaneously.
+    /// signed-package case. Verify both surface in the JSON
+    /// simultaneously.
     #[test]
     fn nuget_signed_case_carries_files_and_advisory() {
         let r = SidecarRecord {
diff --git a/crates/socket-patch-core/src/setup/composer/mod.rs b/crates/socket-patch-core/src/setup/composer/mod.rs
index e92e79e1..1783f8dd 100644
--- a/crates/socket-patch-core/src/setup/composer/mod.rs
+++ b/crates/socket-patch-core/src/setup/composer/mod.rs
@@ -6,8 +6,8 @@
 //! `composer update` finish populating `vendor/`. `setup` appends
 //! `socket-patch apply --offline --silent --ecosystems composer` to both so the
 //! committed `.socket/` patches are re-applied on every install/update (the
-//! socket-patch CLI must be on `PATH`, the same requirement as the cargo build
-//! guard / gem Bundler plugin / Go guard).
+//! socket-patch CLI must be on `PATH`, the same requirement as the gem Bundler
+//! plugin).
 //!
 //! `composer.json` is JSON, so — like the npm `package_json` backend — edits go
 //! through `serde_json` (with the workspace's `preserve_order` feature, so the
@@ -56,8 +56,8 @@ pub struct ComposerEditResult {
 }
 
 /// Find the composer project rooted at `cwd`: the path to a `composer.json`
-/// directly in `cwd`. cwd-only, matching the other single-project backends
-/// (gem/pypi/go).
+/// directly in `cwd`. cwd-only, like the pypi backend (gem discovery walks up
+/// to the nearest Gemfile/gems.rb).
 pub async fn discover_composer_project(cwd: &Path) -> Option<PathBuf> {
     let composer_json = cwd.join("composer.json");
     fs::metadata(&composer_json)
diff --git a/crates/socket-patch-core/src/setup/gem/mod.rs b/crates/socket-patch-core/src/setup/gem/mod.rs
index 4246925f..e592dc7b 100644
--- a/crates/socket-patch-core/src/setup/gem/mod.rs
+++ b/crates/socket-patch-core/src/setup/gem/mod.rs
@@ -67,7 +67,7 @@ const STAMP_REL: &str = ".socket/gem-plugin-stamp";
 /// every clone.
 const STAMP_IGNORE_LINE: &str = "/gem-plugin-stamp";
 
-/// The generated `plugins.rb` body (the two-trigger idempotent applier).
+/// The generated `plugins.rb` body (the three-trigger idempotent applier).
 const PLUGINS_RB: &str = include_str!("templates/plugins.rb.tmpl");
 /// The generated plugin gemspec.
 const GEMSPEC: &str = include_str!("templates/gemspec.tmpl");
diff --git a/crates/socket-patch-core/src/setup/mod.rs b/crates/socket-patch-core/src/setup/mod.rs
index c7ed6f1c..96f9787a 100644
--- a/crates/socket-patch-core/src/setup/mod.rs
+++ b/crates/socket-patch-core/src/setup/mod.rs
@@ -2,9 +2,7 @@
 //! ecosystem's auto-re-apply hook into a user's project, consumed by the
 //! CLI's `setup` command.
 //!
-//! One concept, one home — these previously lived as four top-level modules
-//! under four naming schemes (`gem_setup`, `composer_setup`, `pth_hook`,
-//! plus `package_json`'s setup surface):
+//! The backends:
 //!
 //! * [`gem`] — Bundler plugin directive in the Gemfile + generated plugin
 //!   gem, re-applying gem patches on `bundle install`.
diff --git a/crates/socket-patch-core/src/setup/pypi/detect.rs b/crates/socket-patch-core/src/setup/pypi/detect.rs
index 65b3d357..f756b898 100644
--- a/crates/socket-patch-core/src/setup/pypi/detect.rs
+++ b/crates/socket-patch-core/src/setup/pypi/detect.rs
@@ -249,7 +249,7 @@ mod tests {
     #[test]
     fn test_has_table_trailing_comment_and_padding() {
         // A trailing inline comment after the header is valid TOML and must
-        // not defeat detection (previously `trim_end_matches(']')` left the
+        // not defeat detection (`trim_end_matches(']')` alone would leave the
         // comment glued to the header).
         assert!(has_table("[tool.uv] # the uv table\n", "tool.uv"));
         assert!(has_table("[tool.uv.sources]  # comment\n", "tool.uv"));
diff --git a/crates/socket-patch-core/src/telemetry.rs b/crates/socket-patch-core/src/telemetry.rs
index b57e0e57..3a1dd4bb 100644
--- a/crates/socket-patch-core/src/telemetry.rs
+++ b/crates/socket-patch-core/src/telemetry.rs
@@ -1282,8 +1282,8 @@ mod tests {
             build_telemetry_context("apply").version,
             env!("CARGO_PKG_VERSION")
         );
-        // The previously-hardcoded literal must never reappear unless the crate
-        // is genuinely at that version.
+        // A hardcoded "1.0.0" literal must never appear unless the crate is
+        // genuinely at that version.
         assert!(
             PACKAGE_VERSION != "1.0.0" || env!("CARGO_PKG_VERSION") == "1.0.0",
             "telemetry version is still hardcoded to the stale 1.0.0 literal"
diff --git a/crates/socket-patch-core/src/utils/concurrent.rs b/crates/socket-patch-core/src/utils/concurrent.rs
index 09656faf..a3617ad4 100644
--- a/crates/socket-patch-core/src/utils/concurrent.rs
+++ b/crates/socket-patch-core/src/utils/concurrent.rs
@@ -1,9 +1,9 @@
 //! Ordered, bounded concurrency for independent network requests.
 //!
 //! The CLI's patch-API loops (batch discovery, per-package detail GETs,
-//! hosted record views) used to await one request at a time, so a run
-//! paid one round trip per request. Every consumer here must keep its
-//! output byte-identical to the serial loop, so the only primitive on
+//! hosted record views) run their requests concurrently rather than paying
+//! one round trip per request. Every consumer here must keep its output
+//! byte-identical to a serial loop, so the only primitive on
 //! offer is the ORDERED one: at most `limit` futures run at once, and
 //! results come back in input order no matter which request finishes
 //! first. Callers fold them exactly as the serial loop did (warnings,
@@ -54,8 +54,8 @@ pub const PROXY_API_CONCURRENCY: usize = 4;
 
 /// Operator override for the caps above: the escape hatch for an endpoint
 /// that caps in-flight requests per client (a self-hosted `--api-url`, a
-/// corporate reverse proxy, a WAF or CDN). `1` restores the old strictly
-/// serial loops exactly.
+/// corporate reverse proxy, a WAF or CDN). `1` makes the loops strictly
+/// serial.
 pub const API_CONCURRENCY_ENV: &str = "SOCKET_API_CONCURRENCY";
 
 /// Largest value [`API_CONCURRENCY_ENV`] can ask for — the most in-flight
diff --git a/crates/socket-patch-core/src/utils/durability.rs b/crates/socket-patch-core/src/utils/durability.rs
index e49627c6..967d56dc 100644
--- a/crates/socket-patch-core/src/utils/durability.rs
+++ b/crates/socket-patch-core/src/utils/durability.rs
@@ -30,9 +30,9 @@
 //! `fsync(2)` stops at the drive's cache — issues ONE `F_FULLFSYNC` per
 //! device to flush that cache for everything before it. Every durable
 //! commit-point write runs the barrier first, so a lockfile or ledger that
-//! names an artifact is never made durable ahead of the artifact itself: the
-//! per-file `F_FULLFSYNC` pair each artifact used to pay collapses into one
-//! plain `fsync` per file plus one cache flush per commit point. (Unix
+//! names an artifact is never made durable ahead of the artifact itself,
+//! at the cost of one plain `fsync` per file plus one cache flush per commit
+//! point rather than a per-file `F_FULLFSYNC` pair. (Unix
 //! only: off Unix the writer fsyncs each file itself and the barrier has
 //! nothing to sync — see [`DEFERS_FILE_SYNC`].)
 //!
diff --git a/crates/socket-patch-core/src/utils/env_compat.rs b/crates/socket-patch-core/src/utils/env_compat.rs
index aa4fb09f..3acaae86 100644
--- a/crates/socket-patch-core/src/utils/env_compat.rs
+++ b/crates/socket-patch-core/src/utils/env_compat.rs
@@ -13,7 +13,7 @@
 //! legacy name and prints a one-shot deprecation warning to stderr. The
 //! warning fires **unconditionally** — even under `--silent` / `--json` — so
 //! users see the transition signal in scripts and CI logs. The legacy names
-//! will be removed in the next major release.
+//! will be removed in a future major release.
 
 use std::collections::HashSet;
 use std::sync::Mutex;
diff --git a/crates/socket-patch-core/src/utils/fs.rs b/crates/socket-patch-core/src/utils/fs.rs
index f651755f..b03dc302 100644
--- a/crates/socket-patch-core/src/utils/fs.rs
+++ b/crates/socket-patch-core/src/utils/fs.rs
@@ -3,7 +3,7 @@
 //!
 //! Each crawler walks one or more package directories and decides
 //! whether each entry is a candidate package. The operations that
-//! all eight crawlers repeat are:
+//! the ecosystem crawlers repeat are:
 //!
 //! - listing entries in a directory while tolerating permission /
 //!   I/O errors (we treat an unreadable directory as "no entries");
@@ -81,8 +81,7 @@ pub(crate) async fn entry_is_dir(entry: &DirEntry) -> bool {
 /// Returns `false` if the stat fails (missing path, broken symlink,
 /// permission error, etc.) — the crawlers probe candidate package
 /// roots and treat "can't stat" the same as "not there". The
-/// `Path`-taking counterpart of [`entry_is_dir`]; previously
-/// copy-pasted into every crawler.
+/// `Path`-taking counterpart of [`entry_is_dir`].
 pub(crate) async fn is_dir(path: &Path) -> bool {
     tokio::fs::metadata(path)
         .await
@@ -383,7 +382,7 @@ pub(crate) async fn entry_file_type(entry: &DirEntry) -> Option<FileType> {
 /// crawlers at directories inside the user's project. The shared
 /// fallback chain for every crawler that scans well-known per-user
 /// package roots (`~/.cargo`, `~/.m2`, `~/.nuget`, …) and for
-/// telemetry's home-dir redaction; previously copy-pasted into each.
+/// telemetry's home-dir redaction.
 /// The go/composer crawlers deliberately use a stricter
 /// no-home-means-no-path chain instead.
 pub(crate) fn home_dir() -> PathBuf {
@@ -924,8 +923,8 @@ mod tests {
     /// The stage of a mode-preserving write is CREATED with the preserved
     /// bits, never the 0666 & ~umask default: the full new content (a
     /// `.npmrc` auth token) is written and fsynced into it before the final
-    /// chmod, and a killed process leaves it behind. Red before the fix:
-    /// the 0600 destination's stage came out 0644 (umask 022).
+    /// chmod, and a killed process leaves it behind (a 0600 destination's
+    /// stage must not come out 0644 under umask 022).
     #[cfg(unix)]
     #[tokio::test]
     async fn preserving_stage_is_created_with_the_destination_mode() {
diff --git a/crates/socket-patch-core/src/utils/group_commit.rs b/crates/socket-patch-core/src/utils/group_commit.rs
index 72cc1fad..d00a2da3 100644
--- a/crates/socket-patch-core/src/utils/group_commit.rs
+++ b/crates/socket-patch-core/src/utils/group_commit.rs
@@ -1,11 +1,10 @@
 //! Group commit of a vendored run's commit points.
 //!
-//! A vendored run used to commit after every package: each backend wrote
-//! its lockfile / `package.json` / `pnpm-workspace.yaml` / config edits
-//! durably, and the engine rewrote the whole ledger durably behind it. A
-//! run over N packages paid N rounds of durable writes of the same few
-//! files, each round rewriting whole lockfiles and a ledger that grows with
-//! every package.
+//! Committing after every package — each backend writing its lockfile /
+//! `package.json` / `pnpm-workspace.yaml` / config edits durably, then the
+//! engine rewriting the whole ledger durably behind it — would cost a run
+//! over N packages N rounds of durable writes of the same few files, each
+//! rewriting whole lockfiles and a ledger that grows with every package.
 //!
 //! While a [`GroupCommit`] is open for a project root, the durable writers
 //! in [`super::fs`] ([`super::fs::atomic_write_bytes`],
diff --git a/crates/socket-patch-core/src/utils/mod.rs b/crates/socket-patch-core/src/utils/mod.rs
index da4f97d6..80a6dda9 100644
--- a/crates/socket-patch-core/src/utils/mod.rs
+++ b/crates/socket-patch-core/src/utils/mod.rs
@@ -26,7 +26,7 @@ pub mod uri;
 // Moved modules — these re-exports keep the old `utils::*` paths compiling
 // for external consumers of the published crate. Internal code must import
 // the new canonical paths; CI greps reject new uses of the old ones. Drop
-// these aliases at 4.0.
+// these aliases at 5.0.
 pub use crate::api::date;
 pub use crate::crawlers::fuzzy_match;
 pub use crate::manifest::cleanup_blobs;
diff --git a/crates/socket-patch-core/src/utils/pdm_lock.rs b/crates/socket-patch-core/src/utils/pdm_lock.rs
index 20eee27c..4dbd1816 100644
--- a/crates/socket-patch-core/src/utils/pdm_lock.rs
+++ b/crates/socket-patch-core/src/utils/pdm_lock.rs
@@ -262,7 +262,7 @@ pub fn rewrite_pdm_lock_in<'a>(
         }
     };
     // The original's fragments come from the same parse; an error surfaces
-    // where the fresh parse used to raise it, after the rewrite.
+    // where a fresh parse would raise it, after the rewrite.
     let before = pdm_lock_fragments_in(&doc, text, name);
     let mut lock = doc.into_mut();
     for (index, inline_files, files_key) in edits {
@@ -422,7 +422,7 @@ fn plan_pdm_rewrite(
 /// End (exclusive, before its line break) of the first top-level TOML header
 /// line at or after `from`, skipping blank/comment lines; `text.len()` at EOF;
 /// `from` itself when the next non-blank line is not a header (a shape PDM never
-/// writes — the fragment then ends where it used to). Kept local, like this
+/// writes — the fragment is then not extended). Kept local, like this
 /// module's own `extend_span`.
 fn next_header_end(text: &str, from: usize) -> usize {
     let mut pos = from;
diff --git a/crates/socket-patch-core/src/utils/pipenv.rs b/crates/socket-patch-core/src/utils/pipenv.rs
index 462ae593..8ef12a46 100644
--- a/crates/socket-patch-core/src/utils/pipenv.rs
+++ b/crates/socket-patch-core/src/utils/pipenv.rs
@@ -40,13 +40,12 @@ fn parse_major(output: &str) -> Option<u32> {
 }
 
 /// The `pipenv` executable, searched on ABSOLUTE `PATH` entries only: the
-/// probe runs with the project as its working directory, so a relative entry
-/// (`.`, an empty component) would execute a `pipenv` planted in the
-/// repository being scanned. On Windows every `PATHEXT` extension is tried,
+/// CLI runs inside the project being scanned, so a relative entry (`.`, an
+/// empty component) would execute a `pipenv` planted in that repository. On Windows every `PATHEXT` extension is tried,
 /// so `pipenv.exe` and the `pipenv.bat` / `pipenv.cmd` shims (pyenv-win,
 /// hand-written wrappers) are both found. The rule lives in
 /// [`crate::utils::process::resolve_tool_with`], shared with every other
-/// tool the CLI spawns inside a project (`bun`).
+/// tool the CLI spawns inside a project (`git`, `vlt`, `node`).
 fn resolve_on_path(var: &impl Fn(&str) -> Option<OsString>) -> Option<PathBuf> {
     crate::utils::process::resolve_tool_with("pipenv", var)
 }
diff --git a/crates/socket-patch-core/src/utils/poetry_lock.rs b/crates/socket-patch-core/src/utils/poetry_lock.rs
index ceb7726c..48b40b8a 100644
--- a/crates/socket-patch-core/src/utils/poetry_lock.rs
+++ b/crates/socket-patch-core/src/utils/poetry_lock.rs
@@ -269,7 +269,7 @@ pub fn rewrite_poetry_lock_in<'a>(
         package_name,
     } = plan;
     // The original's fragments come from the same parse; an error surfaces
-    // where the fresh parse used to raise it, after the rewrite.
+    // where a fresh parse would raise it, after the rewrite.
     let before = poetry_lock_fragments_in(&doc, text, name);
     let mut lock = doc.into_mut();
     let package = lock
@@ -429,7 +429,7 @@ fn plan_poetry_rewrite(
 /// End (exclusive, before its line break) of the first top-level TOML header
 /// line at or after `from`, skipping blank lines; `text.len()` at EOF; `from`
 /// itself when the next non-blank line is not a header (a shape Poetry never
-/// writes — the fragment then ends where it used to).
+/// writes — the fragment is then not extended).
 fn next_header_end(text: &str, from: usize) -> usize {
     let mut pos = from;
     for line in text[from..].split_inclusive('\n') {
@@ -605,7 +605,7 @@ mod tests {
     }
 
     /// A user-editable lock with a malformed integrity table must be refused,
-    /// never panic (it used to `IndexMut` straight into `metadata.files`).
+    /// never panic (no `IndexMut` straight into `metadata.files`).
     #[test]
     fn malformed_integrity_tables_are_refused_without_panicking() {
         let lock = fixture("1.2.2");
@@ -639,8 +639,8 @@ mod tests {
 
     /// Poetry bumps the 2.x minor additively; the vendored loader accepts a
     /// newer minor with an advisory, so the shared rewriter must too — the
-    /// same lock used to be applied (LF vendored), hard-failed (CRLF vendored)
-    /// and silently skipped (hosted) depending only on the path taken.
+    /// same lock must get the same treatment on every path (LF vendored, CRLF
+    /// vendored, hosted).
     #[test]
     fn newer_2x_minor_is_rewritten_like_2_1() {
         let lock = fixture("2.4.3").replace("lock-version = \"2.1\"", "lock-version = \"2.2\"");
diff --git a/crates/socket-patch-core/src/utils/process.rs b/crates/socket-patch-core/src/utils/process.rs
index 8f6b7068..81bb2a22 100644
--- a/crates/socket-patch-core/src/utils/process.rs
+++ b/crates/socket-patch-core/src/utils/process.rs
@@ -23,10 +23,10 @@ use std::process::Command;
 /// The executable `name` on ABSOLUTE `PATH` entries only, or `None` when
 /// no entry holds one.
 ///
-/// Shared by every tool the CLI spawns with the scanned project as its
-/// working directory (`bun`, `pipenv`): a relative `PATH` component (`.`,
-/// an empty string) resolves against the child's cwd, so a bare
-/// `Command::new("bun")` would execute a `bun` planted in the repository
+/// Shared by every tool the CLI spawns from inside a scanned project
+/// (`git`, `vlt`, `node`, `pipenv`): a relative `PATH`
+/// component (`.`, an empty string) resolves against the child's cwd, so a
+/// bare `Command::new("git")` would execute a `git` planted in the repository
 /// being scanned — and on macOS `posix_spawnp` can run BOTH the planted
 /// file and the next absolute entry's binary for one spawn. Skipping
 /// non-absolute entries closes that; callers must then spawn the RESOLVED
@@ -34,7 +34,7 @@ use std::process::Command;
 ///
 /// On Windows every `PATHEXT` extension is tried (falling back to
 /// `.exe`/`.bat`/`.cmd` when the variable is unset or empty), so an npm-global
-/// `bun.cmd` / pyenv-win `pipenv.bat` shim is found where Rust's own
+/// `vlt.cmd` / pyenv-win `pipenv.bat` shim is found where Rust's own
 /// `Command` resolution — which appends only `.exe` — would report NotFound.
 /// A plain file without execute permission is skipped like execvp does.
 pub fn resolve_tool(name: &str) -> Option<PathBuf> {
@@ -189,7 +189,7 @@ mod tests {
     }
 
     /// Exit 0 but stdout is empty → None. This is the fourth arm of
-    /// the contract and was previously untested. A successful command
+    /// the contract. A successful command
     /// that prints nothing carries no information for the crawlers.
     #[cfg(unix)]
     #[test]
diff --git a/crates/socket-patch-core/src/utils/purl.rs b/crates/socket-patch-core/src/utils/purl.rs
index 9a84498e..5982160c 100644
--- a/crates/socket-patch-core/src/utils/purl.rs
+++ b/crates/socket-patch-core/src/utils/purl.rs
@@ -296,6 +296,13 @@ pub(crate) fn build_composer_purl(namespace: &str, name: &str, version: &str) ->
     format!("pkg:composer/{namespace}/{name}@{version}")
 }
 
+/// `((namespace, name), version)` from a namespaced purl, percent-decoded
+/// (jsr `@scope/name`, composer `vendor/name`).
+pub(crate) type NamespacedPurlParts<'a> = ((Cow<'a, str>, Cow<'a, str>), Cow<'a, str>);
+
+/// [`NamespacedPurlParts`] under the JSR crawler's own name.
+pub(crate) type JsrPurlParts<'a> = NamespacedPurlParts<'a>;
+
 /// Parse a JSR PURL to extract scope, name, and version.
 ///
 /// JSR (https://jsr.io) is Deno's package registry. Packages are
@@ -308,13 +315,6 @@ pub(crate) fn build_composer_purl(namespace: &str, name: &str, version: &str) ->
 /// We follow the same shape as `parse_composer_purl` since both
 /// have a `<scope>/<name>` namespace structure. The leading `@` on
 /// the scope is preserved (matching npm's `@scope/name` convention).
-/// `((namespace, name), version)` from a namespaced purl, percent-decoded
-/// (jsr `@scope/name`, composer `vendor/name`).
-pub(crate) type NamespacedPurlParts<'a> = ((Cow<'a, str>, Cow<'a, str>), Cow<'a, str>);
-
-/// [`NamespacedPurlParts`] under the JSR crawler's own name.
-pub(crate) type JsrPurlParts<'a> = NamespacedPurlParts<'a>;
-
 pub(crate) fn parse_jsr_purl(purl: &str) -> Option<JsrPurlParts<'_>> {
     // `parse_namespaced` decodes AFTER splitting on `/`/`@` and BEFORE the
     // shape check below (and the caller's `is_safe_jsr_component` gate) —
@@ -371,8 +371,9 @@ pub fn is_purl(s: &str) -> bool {
 
 /// Does a manifest PURL key match a user-supplied PURL identifier?
 ///
-/// PyPI patches are keyed in the manifest by their fully-qualified PURL
-/// (`pkg:pypi/foo@1.0?artifact_id=...`), one entry per release variant.
+/// Release-variant ecosystems key patches in the manifest by their
+/// fully-qualified PURL — PyPI `?artifact_id=`, RubyGems `?platform=`,
+/// Maven `?classifier=`/`?ext=` — one entry per release variant.
 /// A user removing or rolling back a package usually types the *base*
 /// PURL without a qualifier and expects it to cover every variant. So:
 ///
@@ -381,8 +382,7 @@ pub fn is_purl(s: &str) -> bool {
 /// * a **qualified** identifier (`?artifact_id=...`) matches only the
 ///   exact key, so a single variant can still be targeted precisely.
 ///
-/// Non-PyPI keys never carry a `?`, so for them this reduces to plain
-/// equality.
+/// For keys without a qualifier this reduces to plain equality.
 ///
 /// Comparison is encoding-tolerant (`purl_eq`): manifest keys come from
 /// the API in percent-encoded form (`pkg:npm/%40scope/x@1`) while users
diff --git a/crates/socket-patch-core/src/utils/requirements.rs b/crates/socket-patch-core/src/utils/requirements.rs
index 421cb6ef..f811032a 100644
--- a/crates/socket-patch-core/src/utils/requirements.rs
+++ b/crates/socket-patch-core/src/utils/requirements.rs
@@ -218,7 +218,7 @@ mod tests {
 
     /// The ONE exact-pin rule the lock inventory and lockfile discovery
     /// share: wildcards (`==1.*`) and arbitrary equality (`===`) are not
-    /// exact pins (the inventory used to emit `pkg:pypi/six@1.*`).
+    /// exact pins (the inventory must never emit `pkg:pypi/six@1.*`).
     #[test]
     fn exact_pin_is_the_shared_registry_pin_rule() {
         assert_eq!(exact_pin("six==1.16.0"), Some(("six", "1.16.0")));
diff --git a/crates/socket-patch-core/src/utils/socket_dir.rs b/crates/socket-patch-core/src/utils/socket_dir.rs
index 8c009643..3cd8d4a8 100644
--- a/crates/socket-patch-core/src/utils/socket_dir.rs
+++ b/crates/socket-patch-core/src/utils/socket_dir.rs
@@ -1,10 +1,10 @@
 //! Residue-free removal of socket-patch-owned state under `.socket/`.
 //!
 //! Every reversal path (an emptied ledger, a swept blob store, a reverted
-//! vendored unit) used to hand-roll "delete the file, then `remove_dir` the
-//! parents I created" — or forgot to, leaving empty `.socket/vendor/`,
-//! `.socket/vendor/<eco>/` or `.socket/blobs/` husks behind. The helpers here
-//! are the one implementation: delete, then climb the now-empty parents up
+//! vendored unit) must "delete the file, then `remove_dir` the parents I
+//! created", or it leaves empty `.socket/vendor/`, `.socket/vendor/<eco>/`
+//! or `.socket/blobs/` husks behind. The helpers here are the one
+//! implementation: delete, then climb the now-empty parents up
 //! to but EXCLUDING `stop_dir` (normally the project's `.socket/`, which the
 //! lock guard owns).
 //!
diff --git a/crates/socket-patch-core/src/vendor/berry_zip.rs b/crates/socket-patch-core/src/vendor/berry_zip.rs
index 0802dbf7..17cab520 100644
--- a/crates/socket-patch-core/src/vendor/berry_zip.rs
+++ b/crates/socket-patch-core/src/vendor/berry_zip.rs
@@ -3,12 +3,11 @@
 //! yarn berry verifies every install against the sha512 of the *converted
 //! cache zip*, not of the tarball — so a committed vendored lock entry needs
 //! that checksum computed offline, with no yarn on the machine. This module
-//! is a byte-exact Rust port of `spikes/yarn-berry-nm/rebuild_zip.py`, the
-//! spike-proven recipe that reproduces yarn 4.x cache zips bit-for-bit
-//! (verified against yarn 4.12.0 and 4.6.0 output, TZ-insensitive, mode-probe
-//! tarball included — see spike B2 in `spikes/PHASE0-V2-FINDINGS.txt`).
+//! is a byte-exact port of an empirically proven recipe that reproduces
+//! yarn 4.x cache zips bit-for-bit (verified against yarn 4.12.0 and 4.6.0
+//! output, TZ-insensitive, mode-probe tarball included).
 //!
-//! Every constant below is pinned by that spike; the zip writer is
+//! Every constant below is pinned by that verification; the zip writer is
 //! hand-rolled because the recipe's exact field bytes (no extra fields, no
 //! data descriptors, libzip's version-made-by, DOS timestamps rendered as
 //! UTC) are the whole point and must never float with a zip-crate default.
@@ -337,9 +336,9 @@ mod tests {
     use super::*;
     use base64::Engine as _;
 
-    /// `spikes/yarn-berry-nm/fixtures/b2-zip-reproducibility/left-pad-1.3.0-patched.tgz`
-    /// (base64) — the spike's patched left-pad tarball, the input yarn 4.12.0
-    /// converted into cache zip `left-pad-file-8dfd6a0c16-10c0.zip`.
+    /// `left-pad-1.3.0-patched.tgz` (base64) — a patched left-pad tarball,
+    /// the input yarn 4.12.0 converted into cache zip
+    /// `left-pad-file-8dfd6a0c16-10c0.zip`.
     const LEFT_PAD_PATCHED_TGZ_B64: &str = concat!(
         "H4sIAJtlKWoAA+1b/XLbNhLv35rpOyDqTSk5EkXqM3HqtIk/rr42tid2Lpd6fDFEQhJjilRJ0Iray/Pcg9yL3W8BkqIcJ7Jd",
         "271rhUxMEthd7C6Axe4CmnDnjA9F44s7LJZl9Todpp5d/UTJnvrD7jTtZrOLf21m2e12r/kF69wlU1lJYskjsDL2zkKf+7NY",
@@ -395,9 +394,8 @@ mod tests {
         "8QVG79b+L+z/+cq7XSdgqf/fsi7s/71ue+X/30v5f/X/swuwI1MfnOlrk9nVxj9ipnZVVmVVVuV2y38BIDHF2gBKAAA=",
     );
 
-    /// `spikes/yarn-berry-nm/fixtures/b2-zip-reproducibility/modeprobe.tgz`
-    /// (base64) — the spike's odd-modes probe tarball (files 0755/0664/0600/
-    /// 0444, dir 0700), pinning yarn's mode normalization.
+    /// `modeprobe.tgz` (base64) — an odd-modes probe tarball (files
+    /// 0755/0664/0600/0444, dir 0700), pinning yarn's mode normalization.
     const MODEPROBE_TGZ_B64: &str = concat!(
         "H4sIAF9mKWoAA+2W3U6EMBCFud6nwHprSltom5j4MICjID8lFBRjfHeLC2aXGPRii4n0u5lACHPg5My0idMifoTAswghRHLu",
         "f1ZxrIa5Hi8oZ5QxEdJQ+oRGkWSez22Kmul1F7dGSpUXqozLVw11ob557iUDKFfec/5RviW1F6eZ/G/7GuvMTo8f/WfsxH9h",
@@ -406,8 +404,8 @@ mod tests {
         "l/R9cXr+e8Dd0FnoMW74aG3/E7bc/yyULv9bMLjAOxwOxy75AJ0RpNkAGAAA",
     );
 
-    /// `spikes/yarn-berry-nm/fixtures/b2-zip-reproducibility/yarn-cache-modeprobe-file-10c0.zip`
-    /// (base64) — yarn 4.12.0's OWN cache zip for modeprobe.tgz, byte-exact.
+    /// `yarn-cache-modeprobe-file-10c0.zip` (base64) — yarn 4.12.0's OWN
+    /// cache zip for modeprobe.tgz, byte-exact.
     const MODEPROBE_YARN_ZIP_B64: &str = concat!(
         "UEsDBBQAAAAAAECu1ggAAAAAAAAAAAAAAAANAAAAbm9kZV9tb2R1bGVzL1BLAwQUAAAAAABArtYIAAAAAAAAAAAAAAAAFwAA",
         "AG5vZGVfbW9kdWxlcy9tb2RlcHJvYmUvUEsDBAoAAAAAAECu1ggvOtrpEgAAABIAAAAdAAAAbm9kZV9tb2R1bGVzL21vZGVw",
@@ -427,8 +425,7 @@ mod tests {
     );
 
     /// Spike-captured lock checksum for the patched left-pad tarball: the
-    /// verbatim `checksum:` value yarn 4.12.0 wrote in
-    /// `spikes/yarn-berry-nm/fixtures/b3-vendored-resolutions/after/yarn.lock`
+    /// verbatim `checksum:` value yarn 4.12.0 wrote in its `yarn.lock`
     /// (== sha512 of `yarn-cache-left-pad-file-8dfd6a0c16-10c0.zip`).
     const LEFT_PAD_SPIKE_CHECKSUM: &str = "10c0/7785879d9a7dc9bee6730ec55926a0ab9ed6bfe0eaee0cbcbcf00841d42488fddda51265c73eeddd54c5deca87d131e846ff66d27d890ef73f12720b458d7ca3";
 
diff --git a/crates/socket-patch-core/src/vendor/bun_binary.rs b/crates/socket-patch-core/src/vendor/bun_binary.rs
index 3071992a..3178e8ce 100644
--- a/crates/socket-patch-core/src/vendor/bun_binary.rs
+++ b/crates/socket-patch-core/src/vendor/bun_binary.rs
@@ -911,7 +911,7 @@ mod rebuild_tests {
     /// A service outage (here a 403) after a prebuilt vendor: the committed
     /// prebuilt archive is anchored by the ledger, so the re-run reuses it —
     /// entry `None`, bun.lockb and every workspace mirror byte-unchanged, no
-    /// request (the flip no longer re-pins).
+    /// request.
     #[tokio::test]
     async fn same_uuid_prebuilt_then_outage_reuses_the_committed_archive() {
         let archive = prebuilt_archive();
diff --git a/crates/socket-patch-core/src/vendor/bun_lock.rs b/crates/socket-patch-core/src/vendor/bun_lock.rs
index aa652147..71643202 100644
--- a/crates/socket-patch-core/src/vendor/bun_lock.rs
+++ b/crates/socket-patch-core/src/vendor/bun_lock.rs
@@ -1,7 +1,6 @@
 //! bun vendor backend: LOCK-ONLY `bun.lock` surgery.
 //!
-//! Spike BN3 (`spikes/PHASE0-V2-FINDINGS.txt`, fixtures in `spikes/bun/`)
-//! proved the lock-only edit is sound on bun 1.3.x: rewriting just the
+//! Spike BN3 proved the lock-only edit is sound on bun 1.3.x: rewriting just the
 //! `packages` entry passes `bun install --frozen-lockfile` / `bun ci`, the
 //! lock stays byte-stable under plain `bun install`, the entry's integrity
 //! (sha512 of the raw tarball bytes) is enforced fail-closed even on plain
@@ -239,8 +238,8 @@ pub async fn preflight_vendor(project_root: &Path) -> Result<(), (&'static str,
 /// before it grew a workspace member re-vendors in place, and a `repair`
 /// rebuild proceeds. The CLI consults this so its pre-download refusal
 /// exempts exactly what the engine would let through, ledger or no ledger
-/// (a wiped `state.json` used to turn every such update into a false
-/// `vendor_bun_workspace_unsupported`).
+/// (otherwise a wiped `state.json` would turn every such update into a
+/// false `vendor_bun_workspace_unsupported`).
 ///
 /// `Err` mirrors [`preflight_vendor`]'s codes (unreadable lock, unsupported
 /// version, out-of-grammar packages section); a purl that is not an npm
@@ -507,7 +506,7 @@ pub(crate) async fn vendor_bun<'a>(
                         }
                         // Same path, different digest — or a digest-less line
                         // whose artifact was missing or differed before staging.
-                        // A source flip no longer reaches here when the ledger
+                        // A source flip does not reach here when the ledger
                         // verifies the committed tarball (it is reused, so the
                         // digests agree); only a missing, corrupt or unanchored
                         // artifact (a `repair` rebuild, a lost state.json) is
@@ -881,7 +880,7 @@ pub(crate) async fn revert_bun_opts(
         }
     }
 
-    // LOSSINESS GUARD (residual #131): when any wiring record was left
+    // LOSSINESS GUARD: when any wiring record was left
     // alone ("drifted; left alone"), the uuid dir may hold the only copy of
     // what the lock — or the redirect ledger's recorded originals — still
     // points at. Keep it (and let the CLI keep the ledger entry) instead of
@@ -1067,7 +1066,7 @@ mod tests {
         "sha512-BeCz4t+xVlVhKgnBa2K5pAR1MKUgHxv3w9G4T/ADxBhxHNY1ByfS0zcyKi6WQYEM+W2MbTE5kpwwVpgkS//6lQ==";
 
     // ── tool-generated byte-exact oracles ─────────────────────────────────
-    // Provenance: spikes/bun/bn3-lock-only/{before,after}/bun.lock — the
+    // Provenance: spike fixture bn3-lock-only/{before,after}/bun.lock — the
     // decisive lock-only pair, bun 1.3.14 (frozen install passes, plain
     // install + `bun ci` keep the after-lock byte-identical).
     const BN3_BEFORE_LOCK: &str = r#"{
@@ -1111,7 +1110,7 @@ mod tests {
 }
 "#;
 
-    // Provenance: spikes/bun/bn4c-targeted-nested/{before,after}/bun.lock —
+    // Provenance: spike fixture bn4c-targeted-nested/{before,after}/bun.lock —
     // per-instance targeting: ONLY the nested "haspad/left-pad" (1.3.0)
     // moves; the root "left-pad" (1.2.0) stays the registry tuple.
     const BN4C_BEFORE_LOCK: &str = r#"{
@@ -2048,8 +2047,8 @@ mod tests {
 
     // ── lockfileVersion 0 + workspace locks: real per-version grammar ─────
     //
-    // Provenance (real `bun install --save-text-lockfile` output, verified
-    // 2026-09-18 on a root + `packages/consumer` workspace project):
+    // Provenance (real `bun install --save-text-lockfile` output on a root +
+    // `packages/consumer` workspace project):
     //   bun 1.1.45 (v0): no `configVersion` line; the root's workspace dep
     //     is spelled as a bare path (`"consumer": "packages/consumer"`);
     //     the member's packages entry is a 2-TUPLE carrying its deps object
@@ -2752,7 +2751,7 @@ mod tests {
             fx.read_lock().await.contains(drifted_line),
             "drifted entry left alone"
         );
-        // Residual #131: a drift-skip keeps the artifact dir (the drifted
+        // A drift-skip keeps the artifact dir (the drifted
         // entry's recorded original may still be needed later) and says so.
         assert!(
             fx.root()
diff --git a/crates/socket-patch-core/src/vendor/bun_lock_text.rs b/crates/socket-patch-core/src/vendor/bun_lock_text.rs
index 6783a70b..539f5a2c 100644
--- a/crates/socket-patch-core/src/vendor/bun_lock_text.rs
+++ b/crates/socket-patch-core/src/vendor/bun_lock_text.rs
@@ -391,7 +391,8 @@ mod tests {
         );
         assert!(!e.trailing_comma);
 
-        // split at the LAST @ (scoped names).
+        // split at the FIRST @ past index 0 (a scoped name's @ is at index 0;
+        // the spec may contain more @s).
         assert_eq!(
             split_name_spec("@scope/pkg@1.0.0"),
             Some(("@scope/pkg", "1.0.0"))
@@ -515,7 +516,7 @@ mod tests {
 
     /// A `"packages"` header spelled any way other than bun's byte-exact
     /// emitted shape must parse as an ERROR (fail closed), never as an empty
-    /// lock — "empty" made the rewriters silently skip locks bun itself
+    /// lock — "empty" would make the rewriters silently skip locks bun itself
     /// parses fine.
     #[test]
     fn noncanonical_packages_header_is_an_error_not_empty() {
diff --git a/crates/socket-patch-core/src/vendor/cargo.rs b/crates/socket-patch-core/src/vendor/cargo.rs
index 860bc481..54ea86a6 100644
--- a/crates/socket-patch-core/src/vendor/cargo.rs
+++ b/crates/socket-patch-core/src/vendor/cargo.rs
@@ -7,7 +7,7 @@
 //! `Cargo.lock` entry from the registry ([`super::cargo_lock`]) — without the
 //! lock edit, `cargo build --locked` fails closed on the un-relocked `[patch]`
 //! (spike-verified; the whole wiring is proven offline-from-Socket on a fresh
-//! checkout with an empty `CARGO_HOME` — `spikes/PHASE0-FINDINGS.txt`).
+//! checkout with an empty `CARGO_HOME`).
 //!
 //! The copy's own `Cargo.toml` version is TAGGED `<version>+socket.<uuid>`
 //! ([`super::cargo_tag`]) and the detached lock entry carries the same
@@ -233,13 +233,6 @@ pub async fn vendored_entry_in_use(entry: &VendorEntry, project_root: &Path) ->
     }
 }
 
-/// A LIVE hosted-redirect wiring for `name`+`version`: the lock resolves it
-/// from a Socket hosted patch registry, or a manifest — the root or any
-/// workspace member — pins it to a `socket-patch-<uuid>` registry in any
-/// declaration shape (the shapes `scan --mode hosted` writes).
-/// Registry indexes are matched against the config-declared
-/// `[registries.socket-patch-*]` URLs, not a hardcoded host, so test
-/// registries are recognised too. `Some(description)` when residue is found.
 /// The run's parse of the workspace-root `Cargo.toml` for the per-crate
 /// pre-flight, which only reads it: a cargo vendor run asks it about every
 /// patched crate, and on an in-sync re-run the manifest never changes. See
@@ -259,6 +252,13 @@ static MANIFEST_MEMO: ParseMemo<toml_edit::DocumentMut> = ParseMemo::new();
 /// and costs the extraction plus the slot scan and bytes copy.
 static PIN_MEMO: ParseMemo<crate::patch::redirect::CargoRegistryPins, 512> = ParseMemo::new();
 
+/// A LIVE hosted-redirect wiring for `name`+`version`: the lock resolves it
+/// from a Socket hosted patch registry, or a manifest — the root or any
+/// workspace member — pins it to a `socket-patch-<uuid>` registry in any
+/// declaration shape (the shapes `scan --mode hosted` writes).
+/// Registry indexes are matched against the config-declared
+/// `[registries.socket-patch-*]` URLs, not a hardcoded host, so test
+/// registries are recognised too. `Some(description)` when residue is found.
 async fn hosted_redirect_residue(project_root: &Path, name: &str, version: &str) -> Option<String> {
     let socket_indexes = cargo_config::socket_registry_indexes(project_root).await;
     if let cargo_lock::LockEntryProbe::Source(src) =
@@ -622,7 +622,7 @@ async fn cargo_prelude(
         ));
     }
     // (b) The lock must resolve this exact version, or the `[patch]` would be
-    // unused and an unlocked build would silently re-lock (spike claim 6).
+    // unused and an unlocked build would silently re-lock.
     if let Some(locked) = cargo_lock::read_locked_versions(project_root).await {
         match locked.get(name) {
             Some(versions) if versions.contains(version) => {}
@@ -2355,14 +2355,9 @@ mod tests {
         out
     }
 
-    /// REGRESSION: cargo before 1.45 resolves every source-less lock entry
-    /// of a crate through ONE `[patch.crates-io]` path (the entry whose key
-    /// sorts last), so a second vendored version of the same crate cannot
-    /// build there — verified on the `rust:1.41-slim` image and cargo
-    /// 1.42/1.43/1.44, where the adversarial key order fails ``patch for
-    /// `cfg-if` … did not resolve to any crates`` even with a populated
-    /// index, while 1.45 and later build either order. The vendor says so
-    /// when the project does not promise a cargo that can take it.
+    /// A second vendored version of one crate cannot build on cargo before
+    /// 1.45 (see [`MULTI_VERSION_CARGO_MINOR`]): the vendor says so when the
+    /// project does not promise a cargo that can take it.
     #[tokio::test]
     async fn a_second_vendored_version_warns_unless_the_project_pins_cargo_1_45() {
         // One version: nothing to warn about.
@@ -2777,7 +2772,7 @@ mod tests {
         let entry = entry.unwrap();
         assert_eq!(entry.lock, None, "nothing was detached");
         assert_eq!(entry.wiring.len(), 1, "only the config wire is recorded");
-        // The copy + config still landed.
+        // The copy + manifest [patch] entry still landed.
         assert!(root.join(copy_rel()).join("src/lib.rs").exists());
         assert!(manifest_path(root).await.is_some());
     }
@@ -2801,7 +2796,7 @@ mod tests {
                 .exists(),
             "half-built copy must be rolled back"
         );
-        // No config entry, lock untouched.
+        // No manifest [patch] entry, lock untouched.
         assert!(manifest_path(root).await.is_none());
         assert_eq!(
             tokio::fs::read_to_string(root.join("Cargo.lock"))
@@ -2917,7 +2912,7 @@ mod tests {
             "error names the lock: {:?}",
             result.error
         );
-        // Unwound: config entry gone (file pruned), copy gone, lock unchanged.
+        // Unwound: manifest [patch] entry gone, copy gone, lock unchanged.
         assert!(manifest_path(root).await.is_none());
         assert!(!root.join(copy_rel()).exists());
         assert_eq!(
@@ -2933,9 +2928,8 @@ mod tests {
     /// formatter), then re-run with the patch content unavailable (empty
     /// blobs dir — the offline shape: a drifted file harvests no blob): the
     /// rebuild fails, but the previous — drifted yet buildable — copy, the
-    /// marker, the config entry, and the detached lock must all be left
-    /// exactly as they were. (Adapted from the audit probe
-    /// `audit_failed_rebuild_deletes_wired_artifact`.)
+    /// marker, the manifest [patch] entry, and the detached lock must all be left
+    /// exactly as they were.
     #[tokio::test]
     async fn test_failed_rebuild_preserves_live_wired_copy() {
         let (dir, blobs, pristine, record) = fixture().await;
@@ -3067,7 +3061,7 @@ mod tests {
     }
 
     /// AUDIT B1 (same destroy class, fresh path): when the pre-existing
-    /// config entry already points at THIS copy (wiring out of sync only
+    /// manifest [patch] entry already points at THIS copy (wiring out of sync only
     /// because the lock went corrupt post-vendor), a detach failure's unwind
     /// restores that entry — so the uuid dir it points at must survive, or
     /// the restored entry dangles and every build breaks.
@@ -3134,7 +3128,7 @@ mod tests {
         );
     }
 
-    /// AUDIT B4 (security_scratch_audit.rs REPRO 3): a user-authored entry
+    /// AUDIT B4: a user-authored entry
     /// whose path merely TRAVERSES a foreign checkout's
     /// `.socket/vendor/cargo/` is user-authored — vendor must refuse up
     /// front, never silently rewrite (or later delete) it.
@@ -3476,7 +3470,7 @@ mod tests {
     /// uuid dir swept afterwards — there is no revert-first). The lock is
     /// already in the detached shape from the first run, so the re-vendor
     /// must accept it as the desired state and succeed — never fail and
-    /// unwind the live config entry (which bricks every build: no `[patch]`
+    /// unwind the live manifest [patch] entry (which bricks every build: no `[patch]`
     /// entry left, source-less lock entry).
     #[tokio::test]
     async fn test_revendor_new_uuid_over_live_wiring_succeeds() {
@@ -3491,7 +3485,7 @@ mod tests {
             expect_done(run_vendor(PURL, root, &blobs, &pristine, &record2, false).await);
         assert!(result.success, "re-vendor must succeed: {:?}", result.error);
 
-        // The config entry is repointed at the new uuid's copy.
+        // The manifest [patch] entry is repointed at the new uuid's copy.
         let new_rel = format!(".socket/vendor/cargo/{UUID2}/cfg-if-1.0.4");
         assert_eq!(manifest_path(root).await.as_deref(), Some(new_rel.as_str()));
         // The new copy carries the patched bytes; the old uuid dir is left
@@ -3522,7 +3516,7 @@ mod tests {
 
     /// When the lock-detach step fails mid-re-vendor (here: the lock went
     /// corrupt, which the pre-flight cross-check deliberately skips), the
-    /// unwind must put the PRIOR socket-owned config entry back — dropping
+    /// unwind must put the PRIOR socket-owned manifest [patch] entry back — dropping
     /// it would destroy the first vendor's live wiring.
     #[tokio::test]
     async fn test_detach_failure_unwind_restores_prior_socket_entry() {
@@ -4911,13 +4905,13 @@ mod tests {
             .find(|w| w.code == "lock_restore_skipped")
             .unwrap_or_else(|| panic!("missing skip warning: {:?}", out.warnings));
         assert!(w.detail.contains("no longer exists"), "{}", w.detail);
-        // The rest still reverted: config entry gone, uuid dir gone.
+        // The rest still reverted: manifest [patch] entry gone, uuid dir gone.
         assert!(manifest_path(root).await.is_none());
         assert!(!root.join(format!(".socket/vendor/cargo/{UUID}")).exists());
     }
 
-    /// Revert fails CLOSED on a corrupt lock BEFORE touching the config
-    /// entry — a half-revert (entry dropped, lock still path-form) would
+    /// Revert fails CLOSED on a corrupt lock BEFORE touching the manifest
+    /// [patch] entry — a half-revert (entry dropped, lock still path-form) would
     /// break every `--locked` build with no breadcrumb.
     #[tokio::test]
     async fn test_revert_corrupt_lock_fails_closed() {
@@ -4940,7 +4934,7 @@ mod tests {
             "{:?}",
             out.error
         );
-        // Fail-closed: the config entry and the artifact both survive.
+        // Fail-closed: the manifest [patch] entry and the artifact both survive.
         assert_eq!(
             manifest_path(root).await.as_deref(),
             Some(copy_rel().as_str()),
@@ -6862,7 +6856,7 @@ mod tests {
                 ours(11)
             ),
             format!("[dependencies]\nlibc = {{ registry = \"{}\"\n", ours(12)),
-            // Literal strings and quoted keys (#256 reads these as TOML).
+            // Literal strings and quoted keys (the pin scan reads these as TOML).
             format!("[dependencies]\nserde = {{ version = '1', registry = '{}' }}\n", ours(13)),
             format!(
                 "[dependencies.alias]\npackage = 'libc'\nregistry = '{}' # c\n",
diff --git a/crates/socket-patch-core/src/vendor/cargo_config.rs b/crates/socket-patch-core/src/vendor/cargo_config.rs
index 0f4a0602..6740038f 100644
--- a/crates/socket-patch-core/src/vendor/cargo_config.rs
+++ b/crates/socket-patch-core/src/vendor/cargo_config.rs
@@ -25,7 +25,7 @@
 //! relative to the **parent of the `.cargo/` directory** (i.e. the project
 //! root), so the committed `<root>/.socket/vendor/cargo/<uuid>/<name>-<ver>`
 //! copy is found on any clone (spike-verified, including builds invoked from a
-//! subdirectory — see `spikes/PHASE0-FINDINGS.txt` cargo claim 7).
+//! subdirectory).
 
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
@@ -712,7 +712,7 @@ mod tests {
         );
     }
 
-    /// COVERAGE 2026-09: `crates-io` written as an INLINE table —
+    /// `crates-io` written as an INLINE table —
     /// `[patch]` + `crates-io = { cfg-if = { path = "…" } }` — is valid TOML
     /// that cargo honors identically to `[patch.crates-io]` (a hand edit or
     /// another tool re-serializing this user-owned file produces it). The
@@ -735,7 +735,7 @@ mod tests {
         assert!(upsert_patch_entry(&out, "cfg-if", &want).unwrap().is_none());
     }
 
-    /// COVERAGE 2026-09: …and a USER-authored entry in the inline form is
+    /// A USER-authored entry in the inline form is
     /// still refused, never silently overwritten.
     #[test]
     fn test_upsert_refuses_user_authored_inline_form() {
@@ -807,7 +807,7 @@ mod tests {
             .is_none());
     }
 
-    /// COVERAGE 2026-09: removal twin of the inline-form blindness. A
+    /// Removal twin of the inline-form blindness. A
     /// socket-owned entry inside `crates-io = { … }` must be removed on
     /// rollback — a silent no-op here means revert_cargo_vendor_opts still
     /// deletes the `.socket/vendor/cargo/<uuid>/` copy, leaving a dangling
@@ -836,7 +836,7 @@ mod tests {
         assert!(!out.contains("patch"), "emptied inline patch pruned: {out}");
     }
 
-    /// COVERAGE 2026-09: sibling user entries sharing the inline table
+    /// Sibling user entries sharing the inline table
     /// survive the removal.
     #[test]
     fn test_remove_inline_crates_io_form_keeps_user_entry() {
@@ -852,7 +852,7 @@ mod tests {
         assert!(doc["patch"]["crates-io"].get("other").is_some());
     }
 
-    /// COVERAGE 2026-09: the ownership guard holds through the inline form —
+    /// The ownership guard holds through the inline form —
     /// a user-authored same-name entry stays a no-op.
     #[test]
     fn test_remove_inline_form_user_entry_is_noop() {
@@ -892,7 +892,7 @@ mod tests {
         );
     }
 
-    /// COVERAGE 2026-09: `[patch]` exists but `crates-io` is absent or not a
+    /// `[patch]` exists but `crates-io` is absent or not a
     /// table. Only `[patch.crates-io]` is managed — an entry under some other
     /// registry's patch table is never ours, even when its `path` value looks
     /// socket-owned; and a scalar `crates-io` (adversarial hand edit) must be
@@ -949,7 +949,7 @@ mod tests {
         assert!(entries["mine"].socket_owned);
     }
 
-    /// COVERAGE 2026-09: read twin of the inline-form blindness — an unread
+    /// Read twin of the inline-form blindness — an unread
     /// entry makes verify / pre-flight report the vendor copy unwired (so
     /// GC-reclaimable) while cargo still resolves through it.
     #[test]
@@ -1229,7 +1229,7 @@ mod tests {
         assert!(out.is_empty(), "FIFO configs contribute no registries");
     }
 
-    /// COVERAGE 2026-09: the skip branches of `socket_registry_indexes` — a
+    /// The skip branches of `socket_registry_indexes` — a
     /// malformed legacy `.cargo/config` alongside a good `config.toml` (a
     /// real mixed/legacy state) contributes nothing, per the doc's
     /// "malformed files contribute nothing" promise; a user-authored
@@ -1355,7 +1355,7 @@ mod tests {
         );
     }
 
-    /// COVERAGE 2026-09: a real `remove_file` failure in the delete branch
+    /// A real `remove_file` failure in the delete branch
     /// must propagate as `Err("remove {path}: …")` — a swallowed unlink error
     /// would make `drop_legacy_patch_entries` report a successful revert while the
     /// stale `[patch]` wiring still sits on disk.
diff --git a/crates/socket-patch-core/src/vendor/cargo_lock.rs b/crates/socket-patch-core/src/vendor/cargo_lock.rs
index 42b930bf..2a800d93 100644
--- a/crates/socket-patch-core/src/vendor/cargo_lock.rs
+++ b/crates/socket-patch-core/src/vendor/cargo_lock.rs
@@ -3,22 +3,22 @@
 //! A `[patch.crates-io]` path entry alone does NOT survive `cargo build
 //! --locked`: the lock still records the crate's registry `source` +
 //! `checksum`, so cargo wants to re-lock and `--locked` fails closed with a
-//! generic error (spike-verified — `spikes/PHASE0-FINDINGS.txt` cargo claim
-//! 1). Deleting exactly the `source` and `checksum` keys from the crate's
-//! `[[package]]` entry makes cargo accept the path patch as the lock's sole
-//! provider; the edited lock is **byte-stable across builds** (locked and
-//! unlocked, claims 2/4) and the `dependencies` arrays reference the crate by
-//! plain name, so nothing else needs rewriting (claim 8).
+//! generic error (spike-verified with real cargo). Deleting exactly the
+//! `source` and `checksum` keys from the crate's `[[package]]` entry makes
+//! cargo accept the path patch as the lock's sole provider; the edited lock
+//! is **byte-stable across builds** (locked and unlocked) and the
+//! `dependencies` arrays reference the crate by plain name, so nothing else
+//! needs rewriting.
 //!
-//! Claim 8 holds only while `name`+`version` is unique in the lock. When the
-//! same name+version resolves from MULTIPLE sources (a registry entry plus a
-//! same-version git fork — a legal, cargo-generated shape), consumers'
-//! `dependencies` arrays disambiguate with FULL package-id strings
-//! (`"cfg-if 1.0.0 (registry+…)"`); detaching `source`/`checksum` from one
-//! entry dangles those references and breaks `--locked` builds. Vendor
-//! refuses that shape upstream via [`count_lock_entries`]. Once a copy is
-//! vendored, a user's same-version PATH crate may still be locked beside it
-//! (an untagged sourceless `"<name> <version>"` next to the tagged copy):
+//! Plain-name references hold only while `name`+`version` is unique in the
+//! lock. When the same name+version resolves from MULTIPLE sources (a
+//! registry entry plus a same-version git fork — a legal, cargo-generated
+//! shape), consumers' `dependencies` arrays disambiguate with FULL package-id
+//! strings (`"cfg-if 1.0.0 (registry+…)"`); detaching `source`/`checksum`
+//! from one entry dangles those references and breaks `--locked` builds.
+//! Vendor refuses that shape upstream via [`count_lock_entries`]. Once a copy
+//! is vendored, a user's same-version PATH crate may still be locked beside
+//! it (an untagged sourceless `"<name> <version>"` next to the tagged copy):
 //! every helper here selects entries by [`entry_rank`], so the fork is never
 //! mistaken for the copy, and the restore spells the registry entry by its
 //! full id while the fork shares its name+version.
@@ -110,8 +110,8 @@ static LOCK_MEMO: ParseMemo<DocumentMut> = ParseMemo::new();
 
 /// The run's [`locked_packages`] of `Cargo.lock`, keyed on the lock bytes
 /// like [`LOCK_MEMO`]: the per-crate probes ([`probe_lock_entry_for`],
-/// [`count_lock_entries`]) each re-derived the whole package list — a few
-/// thousand entries on a workspace lock — several times per patched crate.
+/// [`count_lock_entries`]) would each re-derive the whole package list — a
+/// few thousand entries on a workspace lock — several times per patched crate.
 static PACKAGES_MEMO: ParseMemo<Vec<LockedPackage>> = ParseMemo::new();
 
 /// [`read_lock`]'s parse as its [`locked_packages`], memoized per lock bytes
@@ -547,8 +547,7 @@ pub async fn detach_lock_entry(
     dry_run: bool,
 ) -> Result<CargoLockOriginal, LockEditError> {
     let (path, doc, lock_text) = read_lock(project_root).await?;
-    // The shared parse is read-only; this editor takes its own copy — the
-    // allocation the per-crate parse it replaced would have made anyway.
+    // The shared parse is read-only; this editor takes its own copy.
     let mut doc = (*doc).clone();
     // The registry entry is what gets detached (an entry already at the
     // tagged version beside it then refuses in `ensure_consistent`).
@@ -957,7 +956,7 @@ mod tests {
     const UUID2: &str = "0a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d";
 
     /// A realistic cargo-1.93-shaped v4 lock (header comment, version line,
-    /// plain-name dependencies array — spike claim 8).
+    /// plain-name dependencies array).
     fn lock_body() -> String {
         format!(
             "# This file is automatically @generated by Cargo.\n\
@@ -1020,13 +1019,10 @@ mod tests {
             .collect()
     }
 
-    /// REGRESSION: `toml_edit` renders LF only, so writing the edited lock
-    /// back rewrote a CRLF `Cargo.lock` as all-LF — and `vendor --revert`
-    /// then "restored" a file that differed from the original in every line
-    /// ending, so the rollback was not byte-identical (the copy's
-    /// `Cargo.toml` already reconciled endings; the lock did not). Covers
-    /// CRLF, LF and a missing trailing newline, in lock formats v1–v4,
-    /// across detach → retag → restore.
+    /// `toml_edit` renders LF only, so the edited lock must be mapped back
+    /// onto its original line endings for `vendor --revert` to restore it
+    /// byte-for-byte. Covers CRLF, LF and a missing trailing newline, in
+    /// lock formats v1–v4, across detach → retag → restore.
     #[tokio::test]
     async fn lock_edits_keep_line_endings_and_revert_byte_identically() {
         for v in 1u8..=4 {
@@ -1088,7 +1084,7 @@ mod tests {
     /// file's dominant ending — its original one is not recoverable from
     /// text alone — so a mixed lock is NOT promised a byte-identical
     /// revert, only an unchanged remainder (the same contract
-    /// `Cargo.toml` has had).
+    /// `Cargo.toml` has).
     #[tokio::test]
     async fn a_mixed_ending_lock_keeps_every_untouched_line() {
         for v in 1u8..=4 {
@@ -1150,10 +1146,10 @@ mod tests {
     }
 
     /// Cargo.lock v1: checksum in `[metadata]`, dependents referencing the
-    /// crate by full id. REGRESSION: detach removed only the entry's
-    /// `source`, leaving `"cfg-if 1.0.4 (registry+…)"` references (and the
-    /// `[metadata]` checksum) naming a package the lock no longer has —
-    /// real cargo then refuses the vendored lock under `--locked`.
+    /// crate by full id. Detach must also rewrite the
+    /// `"cfg-if 1.0.4 (registry+…)"` references and drop the `[metadata]`
+    /// checksum: left alone they name a package the lock no longer has, and
+    /// real cargo refuses the vendored lock under `--locked`.
     #[tokio::test]
     async fn detach_and_restore_a_v1_lock_follow_metadata_and_full_id_refs() {
         let other = "a".repeat(64);
@@ -1251,7 +1247,7 @@ mod tests {
 
     /// Detach both crates, then restore both — the shape of a two-crate
     /// vendor run and its revert. `cold` drops the memo before every call,
-    /// which is the pre-change path (parse the bytes on disk, every time).
+    /// the uncached path (parse the bytes on disk, every time).
     async fn detach_then_restore_both(body: &str, cold: bool) -> (String, String) {
         let dir = tempfile::tempdir().unwrap();
         let lock = dir.path().join("Cargo.lock");
@@ -1703,7 +1699,7 @@ mod tests {
         );
     }
 
-    /// AUDIT B2 helper: the same name+version under multiple sources must be
+    /// The same name+version under multiple sources must be
     /// counted, so vendor can refuse the lock shape whose `dependencies`
     /// arrays reference entries by full package-id string.
     #[tokio::test]
@@ -2256,8 +2252,8 @@ mod tests {
         );
     }
 
-    /// V-7: the memoized package list answers every probe exactly as the
-    /// per-call [`locked_packages`] did — over a lock carrying registry,
+    /// The memoized package list answers every probe exactly as the
+    /// per-call [`locked_packages`] does — over a lock carrying registry,
     /// tagged, other-tagged, untagged-sourceless and duplicate entries, a
     /// v1 `[metadata]` lock, a missing lock and a corrupt one, and after
     /// the lock is rewritten between two probes (the memo must miss).
diff --git a/crates/socket-patch-core/src/vendor/common.rs b/crates/socket-patch-core/src/vendor/common.rs
index 6eb3663c..8ba51f2b 100644
--- a/crates/socket-patch-core/src/vendor/common.rs
+++ b/crates/socket-patch-core/src/vendor/common.rs
@@ -1,7 +1,6 @@
 //! Leaf helpers shared by the vendor backends (and [`crate::patch::redirect::golang_local`]).
 //!
-//! Each backend used to carry a private, byte-identical copy of these; they
-//! are hoisted here so the shapes stay in lockstep.
+//! Kept in one place so every backend's shapes stay in lockstep.
 
 use std::collections::{HashMap, HashSet};
 use std::path::Path;
@@ -798,7 +797,7 @@ impl MemoryRepack {
 /// A private stage directory whose (recursive) deletion can be handed to the
 /// blocking pool: [`tempfile::TempDir`]'s own `Drop` unlinks the whole tree
 /// synchronously, which on the build paths ran on the runtime thread. Dropping
-/// a `Stage` without [`Stage::dispose`] still deletes it the old way, so every
+/// a `Stage` without [`Stage::dispose`] still deletes it synchronously, so every
 /// early return stays correct.
 pub(crate) struct Stage(Option<tempfile::TempDir>);
 
@@ -1859,8 +1858,7 @@ mod tests {
     }
 
     /// The lock file is user-owned: reverting the splice must not reset its
-    /// permission bits (the `package_json/update.rs` mode-reset bug, same
-    /// class — see `atomic_write_bytes_preserving_mode`).
+    /// permission bits (see `atomic_write_bytes_preserving_mode`).
     #[cfg(unix)]
     #[tokio::test]
     async fn revert_lock_fragment_splice_preserves_lock_mode() {
@@ -1974,8 +1972,9 @@ mod tests {
     /// When the final atomic write fails (read-only parent dir — the
     /// documented 'atomic write needs writable parent' class), the revert
     /// must fail with `cannot write <lock>`, keep `kept_artifact == false`
-    /// (the mod.rs contract), and — the reason lines 462-467 hand-build the
-    /// outcome instead of calling `RevertOutcome::failed` — carry the drift
+    /// (the mod.rs contract), and — the reason `revert_lock_fragment_splice_inner`
+    /// hand-builds the write-failure outcome instead of calling
+    /// `RevertOutcome::failed` — carry the drift
     /// warnings accumulated before the write into the failed outcome.
     #[cfg(unix)]
     #[tokio::test]
@@ -2071,7 +2070,7 @@ mod tests {
         );
     }
 
-    // ── in-memory repack equivalence (X10) ──────────────────────────────────
+    // ── in-memory repack equivalence ────────────────────────────────────────
 
     /// A zip built entry by entry, so the oracle fixtures can carry the
     /// spellings `write_zip_entries` never emits: repeated names, STORED
@@ -2118,7 +2117,7 @@ mod tests {
             .collect()
     }
 
-    /// The pre-X10 repack, kept verbatim as the oracle: extract every member
+    /// The extract-to-disk repack, kept as the oracle: extract every member
     /// to a stage, let the caller stand in for the apply pipeline, then walk
     /// the stage back into a deterministic zip.
     async fn on_disk_repack(
@@ -2132,7 +2131,7 @@ mod tests {
         rebuild_zip(stage.path(), skip_entry)
     }
 
-    /// The X10 repack: members stay in memory, only the patch targets (plus
+    /// The in-memory repack: members stay in memory, only the patch targets (plus
     /// `extra`) are materialised, and the same stand-in apply runs over them.
     /// `None` means the name gate sent the rebuild back to the on-disk path.
     async fn in_memory_repack(
@@ -2289,7 +2288,7 @@ mod tests {
 
     /// A patch key that names a DIRECTORY of the archive must find one in the
     /// stage, exactly as a full extraction leaves one there — otherwise the
-    /// verify reports "File not found" where it used to report a hash
+    /// verify reports "File not found" where a full extraction reports a hash
     /// failure, and `--force` would silently skip the key.
     #[tokio::test]
     // The fixture must take the in-memory path, and `FORCE_ON_DISK_REPACK` is
diff --git a/crates/socket-patch-core/src/vendor/composer_lock.rs b/crates/socket-patch-core/src/vendor/composer_lock.rs
index ef04d83f..c2119f6d 100644
--- a/crates/socket-patch-core/src/vendor/composer_lock.rs
+++ b/crates/socket-patch-core/src/vendor/composer_lock.rs
@@ -1,13 +1,15 @@
 //! Composer vendor backend: lock-only `dist` surgery pointing at a committed
 //! patched copy.
 //!
-//! Spike-verified mechanism (composer 2.10 — `spikes/PHASE0-FINDINGS.txt`):
+//! Spike-verified mechanism (composer 2.10):
 //! edit ONLY `composer.lock`. `composer.json` is never touched, and the lock's
 //! `content-hash` covers composer.json alone, so the surgery triggers no
 //! "lock file out of date" warning. The package's lock entry is rewritten to:
 //!
-//! * `dist` → `{"type": "path", "url": "<rel copy dir>", "reference": null}`
-//!   (replaced IN ITS ORIGINAL SLOT so the entry's key order is stable);
+//! * `dist` → `{"type": "path", "url": "<rel copy dir>", "reference": "<patch uuid>"}`
+//!   (replaced IN ITS ORIGINAL SLOT so the entry's key order is stable;
+//!   composer carries the reference into `vendor/composer/installed.json`,
+//!   so the patch stays traceable);
 //! * `source` REMOVED entirely — left in place, `--prefer-source` could
 //!   git-clone the unpatched upstream; with it removed the spike confirmed
 //!   `--prefer-source` falls back to the path dist cleanly;
@@ -414,8 +416,7 @@ pub async fn vendor_composer<'a>(
 
     // ── lock rewrite ─────────────────────────────────────────────────────
     // The memo hands the parse out shared; this is the one branch that
-    // mutates it, so it takes its own copy — exactly the allocation the
-    // parse it replaced would have made.
+    // mutates it, so it takes its own copy.
     let mut lock = (*lock).clone();
     let original_entry = lock[section][idx].clone();
     let Some(original_obj) = original_entry.as_object() else {
@@ -796,7 +797,7 @@ async fn composer_service_copy(
             let stage = stage_dir_for(copy_dir);
             // A tree the download plan already extracted from these bytes
             // (see `prestage`) is moved into the stage instead; otherwise —
-            // or should the move fail — extract here, as always.
+            // or should the move fail — extract here.
             if !claim_prestaged(&mut archive, &stage, copy_dir).await {
                 let _ = remove_tree(&stage).await;
                 if let Err(e) = tokio::fs::create_dir_all(&stage).await {
@@ -824,11 +825,10 @@ async fn composer_service_copy(
             // record names: a zip with an unexpected wrapper dir (the
             // single-level `strip_first` leaves an extra `pkg-<sha>/`
             // segment) or a root-level `src/…` (over-stripped) extracts
-            // "successfully" with every file at the WRONG path. Without
-            // this check the caller synthesized success purely from
-            // `record.files` and shipped a copy missing its patched files
-            // (exit 0, empty copy_dir on disk). Fail closed here and let
-            // the `auto` source fall back to the local build.
+            // "successfully" with every file at the WRONG path, and the
+            // caller would ship a copy missing its patched files. Fail
+            // closed here and let the `auto` source fall back to the local
+            // build.
             if !copy_matches_after_hashes(&stage, &record.files).await {
                 cleanup_failed_stage(&stage, uuid_dir, false).await;
                 return miss(
@@ -2313,7 +2313,7 @@ mod tests {
     /// misplaces the patched file) must NOT be reported as success from
     /// `record.files` alone. Under `service` mode it hard-fails
     /// `vendor_prebuilt_layout_mismatch`; the file is not at the expected
-    /// path. Regression for the exit-0-empty-copy incident (run 29040958337).
+    /// path.
     #[tokio::test]
     async fn service_wrong_layout_service_mode_hard_fails() {
         let lock = lock_value("psr/log", "3.0.2", false);
@@ -2339,8 +2339,8 @@ mod tests {
         .await;
         // Service mode has no fallback, so `miss()` surfaces the uniform
         // `vendor_prebuilt_required` code (same as an integrity mismatch);
-        // the layout diagnosis rides in the detail. The point of the
-        // regression is that it REFUSES rather than synthesizing success —
+        // the layout diagnosis rides in the detail. The point is that it
+        // REFUSES rather than synthesizing success —
         // and the copy dir does not hold the file at its recorded path.
         match outcome {
             VendorOutcome::Refused { code, detail } => {
diff --git a/crates/socket-patch-core/src/vendor/gem.rs b/crates/socket-patch-core/src/vendor/gem.rs
index b6f177aa..adbff138 100644
--- a/crates/socket-patch-core/src/vendor/gem.rs
+++ b/crates/socket-patch-core/src/vendor/gem.rs
@@ -1,6 +1,6 @@
 //! Gem (Bundler) vendor backend: the Gemfile + Gemfile.lock pair edit.
 //!
-//! Spike-verified mechanism (bundler 2.5 — `spikes/PHASE0-FINDINGS.txt`):
+//! Empirically verified mechanism (bundler 2.5):
 //! BOTH files must be edited. A lock-only edit is a silent unpatch on the next
 //! plain `bundle install` (bundler re-resolves from the Gemfile and rewrites
 //! the lock back to a registry GEM source; frozen/CI mode errors with exit 16
@@ -26,9 +26,9 @@
 //!   byte-preserved;
 //! * bundler ≥ 2.6 with `lockfile_checksums` adds a CHECKSUMS section whose
 //!   registry entries read `  <name> (<version>) sha256=<hex>`; a path-sourced
-//!   gem keeps a BARE `  <name> (<version>)` entry (bundler 2.7.2 spike —
-//!   `spikes/PHASE0-V2-FINDINGS.txt` gemChecksums G2/G3). The registry token
-//!   MUST be stripped on vendor — bundler never repairs it itself (G4: a stale
+//!   gem keeps a BARE `  <name> (<version>)` entry (verified on bundler
+//!   2.7.2). The registry token
+//!   MUST be stripped on vendor — bundler never repairs it itself (a stale
 //!   token is silently preserved, i.e. permanent lock-vs-regen churn) — and
 //!   restored verbatim on revert: a bare entry on a registry-sourced gem
 //!   hard-fails `BUNDLE_FROZEN=true bundle install` (exit 16).
@@ -204,13 +204,9 @@ async fn gem_prelude(
     //      suffix to the base purl, so a `?platform=ruby` lookup can still land
     //      on a native install dir).
     //
-    // The old gate tested only `dir_name != leaf`, which spuriously refused
-    // EVERY pure-ruby gem fetched via the registry auto-fetch ladder: that
-    // path stages the pristine `.gem` into a private tempdir named literally
-    // `gem` (see registry_fetch::fetch_gem), so `dir_name` was `gem`, never
-    // `<name>-<version>`. Gating on the platform (not the staging dir name)
-    // lets `?platform=ruby` and bare purls vendor while still refusing true
-    // native builds by either signal.
+    // Gating on the platform (not only the staging dir name) lets
+    // `?platform=ruby` and bare purls vendor whatever the staging dir is
+    // called, while still refusing true native builds by either signal.
     if let Some(platform) = purl_qualifier(purl, "platform") {
         if !platform.is_empty() && !platform.eq_ignore_ascii_case("ruby") {
             return Err(refused(
@@ -225,9 +221,10 @@ async fn gem_prelude(
         .file_name()
         .map(|n| n.to_string_lossy().into_owned())
         .unwrap_or_default();
-    // Fail closed: only two dir names are legitimate here — the installed
-    // gem's own `<name>-<version>` leaf, and the literal `gem` staging dir
-    // created by the registry auto-fetch ladder (registry_fetch::fetch_gem).
+    // Fail closed: only two dir names are legitimate here — the gem's own
+    // `<name>-<version>` leaf (installed, or staged by
+    // registry_fetch::fetch_gem), and a literal `gem` staging dir, still
+    // admitted for compatibility though fetch_gem no longer produces it.
     // Everything else is refused, including a `<name>-<version>-<platform>`
     // precompiled build; an allowlist (not a suffix match) means an unexpected
     // install dir name can never slip through into a vendored copy.
@@ -333,9 +330,9 @@ async fn gem_prelude(
     if lock_wired {
         if lock_checksum_in_sync(&lock_text, name, version) {
             // Probe the copy only once the lock is known to be wired (the
-            // common fresh vendor has no copy to hash). D4 heal: a project
-            // vendored before the invalid-stub hardening carries the
-            // defective SERVED stub on disk, so EXISTS is not enough — an
+            // common fresh vendor has no copy to hash). Invalid-stub heal: a
+            // project vendored before the stub check carries a defective
+            // SERVED stub on disk, so EXISTS is not enough — an
             // on-disk stub that fails the required-attribute bar routes into
             // the artifact rebuild (which re-materialises a valid stub)
             // instead of the silent `already_vendored` no-op. The stub read
@@ -399,8 +396,7 @@ fn gem_edits(
     };
     // ── Gemfile.lock edit (pure text surgery, computed before any write) ──
     // A lock-shape failure therefore costs no download / copy / patch and no
-    // Gemfile write — the same failed `Done` outcome the unwind path used to
-    // produce, minus the unwind.
+    // Gemfile write.
     let lock_edit = match edit_lock(&prelude.lock_text, name, version, &prelude.copy_rel) {
         Ok(edit) => edit,
         Err(e) => {
@@ -908,8 +904,8 @@ enum GemServiceCopy {
     /// Bubble this terminal outcome (boxed — `VendorOutcome` is large).
     HardFail(Box<VendorOutcome>),
     /// Fall back to copying the installed gem + local stub and patching it.
-    /// When the service DID serve a stub but it failed validation (the D4
-    /// defect), the payload carries the defect reason so a stub-less local
+    /// When the service DID serve a stub but it failed validation, the
+    /// payload carries the defect reason so a stub-less local
     /// fallback can refuse truthfully — naming the served defect and the
     /// install-the-gem remedy — instead of `gem_spec_missing`'s circular
     /// "use --vendor-source=service" advice (a `Refused` outcome carries no
@@ -930,7 +926,7 @@ enum GemServiceCopy {
 /// patch built before the stub rollout (the invalidation migration rebuilds
 /// those). The downloaded stub is re-checked for native extensions as defense
 /// in depth, and an INVALID stub — one missing the rubygems-required
-/// `summary`/`authors` assignments, the D4 served-artifact defect — follows
+/// `summary`/`authors` assignments — follows
 /// the same miss policy under its own `vendor_prebuilt_stub_invalid` code
 /// (always loud, even under `auto`).
 async fn gem_service_copy(
@@ -1071,9 +1067,9 @@ async fn gem_service_copy(
         );
     }
 
-    // Defense in depth (D4, gem live matrix 2026-08-19): production's stub
-    // generator omitted the rubygems-required `summary`/`authors`, and every
-    // bundler major validates path-source gemspecs — writing such a stub
+    // Defense in depth: a served stub may omit the rubygems-required
+    // `summary`/`authors`, and every bundler major validates path-source
+    // gemspecs — writing such a stub
     // verbatim makes every later `bundle install` exit 1 (`missing value for
     // attribute summary`). An INVALID stub follows the MISSING-stub policy
     // (fall back under `auto`, refuse under `service`) but under its own
@@ -1231,7 +1227,7 @@ async fn materialise_patched_copy(
             // gem, whose only route is the service path.
             let Some((spec_path, spec_text)) = local_stub else {
                 return Err(Box::new(match served_stub_defect {
-                    // The service DID serve a stub — a defective one (D4). Say
+                    // The service DID serve a stub — a defective one. Say
                     // so: the generic advice below would send the user in a
                     // circle (`--vendor-source=service` refuses on the same
                     // defect), and a `Refused` outcome carries no warnings, so
@@ -1385,7 +1381,7 @@ pub async fn revert_gem_opts(
     // the removed dir and the next `bundle install` hard-fails. Refuse
     // loudly with the manual cleanup steps instead. (Every entry
     // `vendor_gem` records carries at least the Gemfile + lock records.)
-    // NOT skipped under `keep_artifact` (PR #231 review hardening): a
+    // NOT skipped under `keep_artifact`: a
     // preserve-state revert that cannot restore the wiring must not report
     // the system restored while the pair edit still wires the vendored dir
     // in — the patch would silently stay applied.
@@ -2862,8 +2858,7 @@ fn authors_rhs_collapses_empty(rhs: &str) -> bool {
 /// The rubygems-REQUIRED attributes a stub gemspec must assign for bundler to
 /// accept it as a path source, returned as the list it is missing (empty =
 /// valid). Every bundler major validates path-source gemspecs, so a stub
-/// missing these bricks every later `bundle install` — the D4 defect the
-/// 2026-08-19 gem live matrix found in ALL served stubs.
+/// missing these bricks every later `bundle install`.
 ///
 /// The bar is EMPIRICAL, verified against rubygems 3.3 / 3.5 / 3.6
 /// (`Gem::Specification#validate`, both packaging modes, in the bundler
@@ -3302,7 +3297,7 @@ mod tests {
     /// tolerates must always pass, whatever its spelling.
     #[test]
     fn required_attrs_heuristic() {
-        // The D4 production shape: no summary, no authors.
+        // The defective served shape: no summary, no authors.
         assert_eq!(
             gemspec_missing_required_attrs(
                 "Gem::Specification.new do |s|\n  s.name = \"rack\".freeze\n  s.version = \"3.2.6\".freeze\n  s.require_paths = [\"lib\".freeze]\nend\n"
@@ -3426,16 +3421,15 @@ mod tests {
         assert!(!root.join(".socket").exists());
     }
 
-    /// Fail-closed allowlist regression: an install dir whose name is neither
-    /// the `<name>-<version>` leaf nor the `gem` auto-fetch staging dir is
-    /// refused — even though it is NOT a `<leaf>-<platform>` suffix, so the old
-    /// suffix-only check (`dir_name.starts_with("{leaf}-")`) would have ADMITTED
-    /// it. Only the two legitimate dir names may pass.
+    /// Fail-closed allowlist: an install dir whose name is neither the
+    /// `<name>-<version>` leaf nor the legacy `gem` staging dir is refused —
+    /// even though it is NOT a `<leaf>-<platform>` suffix, so a suffix-only
+    /// check would admit it. Only the two legitimate dir names may pass.
     #[tokio::test]
     async fn test_refuses_unexpected_install_dir_name() {
         let (_tmp, root, installed, blobs, record) = fixture(GEMFILE_DIRECT, LOCK_DIRECT).await;
         // A wholly-unexpected dir name: not `rack-3.2.6`, not `gem`, and not a
-        // `rack-3.2.6-<suffix>` platform build (which the old suffix check caught).
+        // `rack-3.2.6-<suffix>` platform build.
         let odd_dir = installed.parent().unwrap().join("random-unrelated");
         tokio::fs::rename(&installed, &odd_dir).await.unwrap();
 
@@ -3463,18 +3457,16 @@ mod tests {
         assert!(!root.join(".socket").exists(), "refusal must write nothing");
     }
 
-    /// Regression: a pure-ruby gem fetched via the registry auto-fetch ladder
-    /// is staged into a private tempdir named literally `gem` (NOT
-    /// `<name>-<version>`). The old gate refused every such gem with
-    /// `platform_gem_unsupported` because `dir_name != leaf`. With the purl's
-    /// `?platform=ruby` (the portable default) the vendor must now SUCCEED —
-    /// the staging dir name is not a platform signal.
+    /// A pure-ruby gem in the legacy `gem` staging dir (still admitted, though
+    /// registry_fetch::fetch_gem now stages at `<name>-<version>`) vendors
+    /// with the purl's `?platform=ruby` (the portable default) — the staging
+    /// dir name is not a platform signal.
     #[tokio::test]
     async fn test_platform_ruby_gem_from_autofetch_staging_dir_vendors() {
         let (_tmp, root, installed, blobs, record) = fixture(GEMFILE_DIRECT, LOCK_DIRECT).await;
-        // Rename the install dir to `gem`, mirroring registry_fetch::fetch_gem's
-        // staging leaf. The sibling `specifications/rack-3.2.6.gemspec` (needed
-        // by the local build) is derived from installed_dir.parent().parent(),
+        // Rename the install dir to the legacy `gem` staging leaf. The
+        // sibling `specifications/rack-3.2.6.gemspec` (needed by the local
+        // build) is derived from installed_dir.parent().parent(),
         // so keeping the dir under the same gem_home preserves it.
         let staged = installed.parent().unwrap().join("gem");
         tokio::fs::rename(&installed, &staged).await.unwrap();
@@ -3847,10 +3839,9 @@ mod tests {
         b"module Rack\n  SOCKET_PATCHED = true\n  VERSION = \"3.1.8\"\nend\n";
     const GEMSPEC_318: &str = "Gem::Specification.new do |s|\n  s.name = \"rack\"\n  s.version = \"3.1.8\"\n  s.summary = \"a modular Ruby web server interface\"\n  s.authors = [\"Rack maintainers\"]\n  s.require_paths = [\"lib\"]\nend\n";
 
-    // Embedded VERBATIM from the spike pair
-    // `spikes/gem-checksums/path-with-checksums/{before,after}/` (bundler
+    // Embedded VERBATIM from a captured before/after pair (bundler
     // 2.7.2, ruby 3.3.11, aarch64-linux; the `after` lock was written by
-    // bundler itself via `bundle lock`, never by hand). G3 pinned exactly this
+    // bundler itself via `bundle lock`, never by hand), verified exactly this
     // pair byte-stable under `bundle install`, `BUNDLE_FROZEN=true bundle
     // install` and a from-scratch `bundle lock`.
     const SPIKE_GEMFILE_CHECKSUMS: &str =
@@ -4267,7 +4258,7 @@ mod tests {
 
     #[test]
     fn test_no_checksums_lock_records_no_checksum_wiring() {
-        // Regression: a lock WITHOUT a CHECKSUMS section must keep producing
+        // A lock WITHOUT a CHECKSUMS section must keep producing
         // the exact pre-CHECKSUMS output and no checksum record.
         let edit = edit_lock(LOCK_DIRECT, "rack", "3.2.6", &copy_rel()).unwrap();
         assert!(edit.checksum_rewrite.is_none());
@@ -4733,8 +4724,7 @@ mod tests {
 
     /// Trailing options on the declaration (`require: false`, `group: :test`,
     /// …) must survive the rewrite: dropping `require: false` auto-requires
-    /// the gem at boot, changing app behavior while vendored (the redirect
-    /// backend's `gem_line_trailing_options` twin, FIXED there 2026-07-06).
+    /// the gem at boot, changing app behavior while vendored.
     #[tokio::test]
     async fn test_rewrite_preserves_trailing_options() {
         let gemfile =
@@ -4874,8 +4864,7 @@ mod tests {
     const SERVICE_STUB: &[u8] = b"# -*- encoding: utf-8 -*-\n# stub: rack 3.2.6 ruby lib\n\nGem::Specification.new do |s|\n  s.name = \"rack\".freeze\n  s.version = \"3.2.6\".freeze\n  s.summary = \"a modular Ruby web server interface\".freeze\n  s.authors = [\"Rack maintainers\".freeze]\n  s.licenses = [\"MIT\".freeze]\n  s.require_paths = [\"lib\".freeze]\nend\n";
     /// A stub that declares native extensions (must be refused).
     const SERVICE_STUB_NATIVE: &[u8] = b"Gem::Specification.new do |s|\n  s.name = \"rack\".freeze\n  s.version = \"3.2.6\".freeze\n  s.extensions = [\"ext/rack/extconf.rb\"]\nend\n";
-    /// The DEFECTIVE stub shape production served as of 2026-08-19 (gem
-    /// live-matrix defect D4): it never assigns the rubygems-required
+    /// A DEFECTIVE stub shape: it never assigns the rubygems-required
     /// `summary` / `authors` (nor `licenses`), so bundler's path-source
     /// validation rejects it and every post-vendor `bundle install` exits 1.
     const SERVICE_STUB_INVALID: &[u8] = b"# -*- encoding: utf-8 -*-\n# stub: rack 3.2.6 ruby lib\n\nGem::Specification.new do |s|\n  s.name = \"rack\".freeze\n  s.version = \"3.2.6\".freeze\n  s.require_paths = [\"lib\".freeze]\nend\n";
@@ -5211,7 +5200,7 @@ mod tests {
         );
     }
 
-    /// D4 (gem live-matrix 2026-08-19): explicit `service` mode + a served stub
+    /// Explicit `service` mode + a served stub
     /// that never assigns the rubygems-required `summary`/`authors` refuses
     /// with its own `vendor_prebuilt_stub_invalid` code, naming the missing
     /// attributes — writing it verbatim would make every later `bundle install`
@@ -5259,7 +5248,7 @@ mod tests {
         );
     }
 
-    /// D4 under the default `auto`: an INVALID served stub is treated exactly
+    /// Under the default `auto`: an INVALID served stub is treated exactly
     /// like a MISSING one — fall back to the LOCAL build (installed gem +
     /// locally derived stub) — but with a LOUD `vendor_prebuilt_stub_invalid`
     /// warning naming the served-stub defect. The vendored copy must carry the
@@ -5308,7 +5297,7 @@ mod tests {
         );
     }
 
-    /// D4 + `auto` + the gem NOT installed (a `missing_install` staging-style
+    /// Invalid served stub + `auto` + the gem NOT installed (a `missing_install` staging-style
     /// dir): the local-build fallback has no stub to derive, and the refusal
     /// must be TRUTHFUL — it carries the served-stub defect (a `Refused`
     /// outcome has no warnings channel, so the detail is the diagnostic's
@@ -5354,7 +5343,7 @@ mod tests {
         assert!(!root.join(".socket").exists());
     }
 
-    /// D4 + explicit `service` + the gem NOT installed: the hard refusal is
+    /// Invalid served stub + explicit `service` + the gem NOT installed: the hard refusal is
     /// the same as the installed case — installation is irrelevant to
     /// `service` mode, which never falls back.
     #[tokio::test]
@@ -5473,8 +5462,8 @@ mod tests {
         );
     }
 
-    /// D4 heal: a project vendored PRE-hardening carries the invalid served
-    /// stub on disk. The idempotent hot path must not re-bless it as
+    /// Invalid-stub heal: a project vendored before the stub check carries
+    /// the invalid served stub on disk. The idempotent hot path must not re-bless it as
     /// `already_vendored`: the on-disk stub fails the required-attribute bar,
     /// routing into the artifact-only rebuild, which rewrites a valid stub
     /// with the pair edit and the ledger entry untouched.
@@ -5527,7 +5516,7 @@ mod tests {
         );
     }
 
-    /// AUDIT B1 (cargo twin, PR #194): a failed hot-path artifact rebuild must
+    /// A failed hot-path artifact rebuild must
     /// never destroy the live-wired vendored copy. Drift the committed copy
     /// (bad merge / hand edit — still buildable: the path source exists and
     /// the stub is valid), then re-run with the patch content unavailable
@@ -6014,8 +6003,7 @@ mod tests {
     }
 
     /// The empty-wiring refusal applies under `keep_artifact`
-    /// (`--preserve-state`) TOO — PR #231's review hardening (5ceba4a3)
-    /// deliberately removed the `&& !keep_artifact` gate: a preserve-state
+    /// (`--preserve-state`) TOO: a preserve-state
     /// rollback that cannot restore the wiring must not report the system
     /// restored while the pair edit still wires the vendored dir in (the
     /// patch would silently stay applied). Pins that decision.
@@ -6250,10 +6238,10 @@ mod tests {
         );
     }
 
-    // ── coverage-gap additions (2026-09 audit): refusal / failure legs ────
+    // ── refusal / failure legs ────
 
     /// [`run_vendor`] with an explicit service config (the service tests
-    /// above inline this shape; the coverage additions share it).
+    /// above inline this shape; the tests below share it).
     async fn run_vendor_service(
         root: &Path,
         blobs: &Path,
@@ -7027,8 +7015,8 @@ mod tests {
     }
 
     /// An invalid served stub that DOES assign `licenses` must not carry the
-    /// "also omits `licenses`" advisory — the empty-note branch of the D4
-    /// refusal detail.
+    /// "also omits `licenses`" advisory — the empty-note branch of the
+    /// invalid-stub refusal detail.
     #[tokio::test]
     async fn invalid_stub_with_licenses_omits_licenses_advisory() {
         const STUB_INVALID_WITH_LICENSE: &[u8] = b"# -*- encoding: utf-8 -*-\n# stub: rack 3.2.6 ruby lib\n\nGem::Specification.new do |s|\n  s.name = \"rack\".freeze\n  s.version = \"3.2.6\".freeze\n  s.licenses = [\"MIT\".freeze]\n  s.require_paths = [\"lib\".freeze]\nend\n";
@@ -7057,7 +7045,7 @@ mod tests {
         assert!(!root.join(".socket").exists());
     }
 
-    /// D4 + `auto` + a CORRUPTED local stub: the local-build write choke
+    /// Invalid served stub + `auto` + a CORRUPTED local stub: the local-build write choke
     /// point refuses `gem_spec_invalid`, and the detail honestly notes the
     /// service cannot supply a stub either (its served stub is defective) —
     /// never circular "use --vendor-source=service" advice.
@@ -7996,7 +7984,7 @@ mod tests {
         );
     }
 
-    // ── coverage mop-up 2026-09: swap / prune / grammar / unwind edges ───────
+    // ── swap / prune / grammar / unwind edges ───────
 
     /// A parentless `copy_dir` (e.g. the filesystem root) has no directory to
     /// place a same-dir sibling in; the fallback nests the suffix under the
@@ -8118,7 +8106,9 @@ mod tests {
     }
 
     /// An unreadable (present but non-regular) Gemfile fails a `gemfile_line`
-    /// revert loudly — unlike a MISSING one, which is drift and left alone.
+    /// revert loudly — unlike a MISSING one, which is reported as
+    /// `vendor_lockfile_missing` (`FileMissing`, not drift) and does not
+    /// block artifact removal.
     #[tokio::test]
     async fn revert_gemfile_record_unreadable_gemfile_is_an_error() {
         // The tempdir itself squats the Gemfile path: a directory is
@@ -8143,7 +8133,7 @@ mod tests {
     }
 
     /// A `gemfile_lock_spec` record whose `new` is not a string array is
-    /// drift (`Ok(false)`), decided BEFORE the lock is read — proven with a
+    /// drift (`Ok(RecordRevert::Drifted)`), decided BEFORE the lock is read — proven with a
     /// lock path that would error loudly (a directory) if it were read.
     #[tokio::test]
     async fn revert_lock_record_non_array_new_is_drift_before_reading() {
@@ -8361,7 +8351,7 @@ mod tests {
         );
     }
 
-    // ── source-flip regression: the hot path decides "in sync" from the
+    // ── source flip: the hot path decides "in sync" from the
     //    COMMITTED copy before any service call, so a service ↔ local flip
     //    between runs is a byte-identical no-op with no request. ──
 
diff --git a/crates/socket-patch-core/src/vendor/gemfile_lock.rs b/crates/socket-patch-core/src/vendor/gemfile_lock.rs
index f825f26c..4ec9c095 100644
--- a/crates/socket-patch-core/src/vendor/gemfile_lock.rs
+++ b/crates/socket-patch-core/src/vendor/gemfile_lock.rs
@@ -243,8 +243,9 @@ pub(crate) fn parse(text: &str) -> GemfileLock<'_> {
 
 /// The plain gem-token charset (letters, digits, `.`, `_`, `-`). The vendor
 /// backend applies it before embedding coordinates into Ruby source and lock
-/// line grammar (see the SECURITY note on [`crate::vendor::gem::vendor_gem`]),
-/// so it is deliberately stricter than the path-level segment guard.
+/// line grammar (see the SECURITY note in `crate::vendor::gem`'s
+/// `gem_prelude`, which [`crate::vendor::gem::vendor_gem`] runs first), so it
+/// is deliberately stricter than the path-level segment guard.
 pub(crate) fn is_plain_gem_token(s: &str) -> bool {
     !s.is_empty()
         && s.chars()
diff --git a/crates/socket-patch-core/src/vendor/go_mod_edit.rs b/crates/socket-patch-core/src/vendor/go_mod_edit.rs
index dffa847a..8f7ecc71 100644
--- a/crates/socket-patch-core/src/vendor/go_mod_edit.rs
+++ b/crates/socket-patch-core/src/vendor/go_mod_edit.rs
@@ -27,7 +27,7 @@
 //! `apply`'s reconcile can never prune a vendored module and vice versa).
 //! Policy about *when* an owner may take over lives in the callers.
 //!
-//! ## Why `replace` (validated empirically — see project memory)
+//! ## Why `replace` (validated empirically)
 //! A local-path `replace` target is **not** `go.sum` content-verified, so
 //! patched bytes build cleanly under the default `-mod=readonly`. The directive
 //! is keyed by *module + version*: a stale pin (the graph resolved a different
@@ -687,7 +687,7 @@ pub(crate) fn scan_hosted_replace(
 }
 
 /// [`upsert_hosted_replace_entry`] from a [`scan_hosted_replace`] of the
-/// same `content`, editing it in place (an append no longer copies the
+/// same `content`, editing it in place (an append does not copy the
 /// file). `Ok(true)` when it changed.
 pub(crate) fn apply_hosted_replace(
     content: &mut String,
@@ -1679,8 +1679,7 @@ replace (
     }
 
     /// `go.mod` is user-owned: editing it must not reset its permission bits
-    /// (a 0600 private go.mod silently becoming umask-default 0644 is the
-    /// `package_json/update.rs` mode-reset bug, same class).
+    /// (a 0600 private go.mod must not silently become umask-default 0644).
     #[cfg(unix)]
     #[tokio::test]
     async fn test_ensure_preserves_go_mod_mode() {
diff --git a/crates/socket-patch-core/src/vendor/go_sum_edit.rs b/crates/socket-patch-core/src/vendor/go_sum_edit.rs
index 0102f192..e216b147 100644
--- a/crates/socket-patch-core/src/vendor/go_sum_edit.rs
+++ b/crates/socket-patch-core/src/vendor/go_sum_edit.rs
@@ -20,11 +20,13 @@
 //!
 //! Everything here is a pure `&str` transform (the hosted rewriters operate on
 //! in-memory file content, mirrored byte-identically by depscan's TS twins).
-//! Unrelated lines are preserved verbatim; insertions keep go's lexicographic
-//! line order so a later `go mod tidy` is a no-op, not a reshuffle. (Whole-line
-//! byte order equals go's `(module, version)` sort because `' '` compares
-//! below every module-path/version character, and the zip line sorts before
-//! its `/go.mod` sibling because `' '` < `'/'`.)
+//! Unrelated lines are preserved verbatim. [`upsert_module_lines`] inserts at
+//! the whole-line byte-order position, which matches go's `(module, semver)`
+//! sort (so a later `go mod tidy` is a no-op) because `' '` compares below
+//! every module-path/version character and `' '` < `'/'` puts the zip line
+//! before its `/go.mod` sibling — except where versions differ in a
+//! multi-digit component (`v1.10.0` vs `v1.9.0`); [`reinsert_lines`] uses the
+//! semver-aware [`go_sum_line_cmp`] instead.
 
 /// The two `go.sum` lines for one module version.
 fn module_lines(module: &str, version: &str, zip_h1: &str, gomod_h1: &str) -> [String; 2] {
diff --git a/crates/socket-patch-core/src/vendor/golang.rs b/crates/socket-patch-core/src/vendor/golang.rs
index 993b8648..541b12fb 100644
--- a/crates/socket-patch-core/src/vendor/golang.rs
+++ b/crates/socket-patch-core/src/vendor/golang.rs
@@ -6,7 +6,7 @@
 //! and the `go.mod` `replace` points at it ([`ReplaceOwner::Vendor`]). A
 //! directory `replace` target bypasses the module cache, sumdb, and `go.sum`
 //! entirely, so a fresh checkout builds the patched module fully offline and
-//! survives `go mod tidy` (spike-verified — `spikes/PHASE0-FINDINGS.txt`).
+//! survives `go mod tidy` (spike-verified).
 //!
 //! ## Takeover of an `apply` redirect
 //! `ensure_replace_entry`'s cross-owner upsert rewrites an existing
@@ -2788,9 +2788,9 @@ mod tests {
 
     /// A FIRST-run service failure (corrupt zip, never previously wired)
     /// must remove the uuid dir but leave go.mod completely untouched — the
-    /// teardown has no directive to drop (`wired=false`), unlike the stale-
-    /// copy rebuild covered by
-    /// `failed_service_rebuild_of_stale_copy_drops_dangling_directive`.
+    /// teardown has no directive to drop (`wired=false`), unlike the wired
+    /// rebuild of a MISSING copy covered by
+    /// `failed_service_rebuild_of_missing_copy_drops_dangling_directive`.
     #[tokio::test]
     async fn first_run_service_extract_failure_leaves_gomod_untouched() {
         let (dir, blobs, pristine, record) = fixture().await;
diff --git a/crates/socket-patch-core/src/vendor/ledger_snapshots.rs b/crates/socket-patch-core/src/vendor/ledger_snapshots.rs
index d8021f6d..215db6b1 100644
--- a/crates/socket-patch-core/src/vendor/ledger_snapshots.rs
+++ b/crates/socket-patch-core/src/vendor/ledger_snapshots.rs
@@ -6,8 +6,8 @@
 //! restores the verbatim original when the live file is still exactly what
 //! vendoring wrote, and otherwise does a structural or fragment-level
 //! restore that needs both texts. A record's `new` is its `original` plus
-//! the package's own few-hundred-byte edit, yet was stored in full beside
-//! it, so every package of a project held two near-identical copies of the
+//! the package's own few-hundred-byte edit; stored in full beside it, every
+//! package of a project would hold two near-identical copies of the
 //! (growing) file — tens of megabytes on a hundred-package maven or pylock
 //! project, re-serialized after every package and re-parsed by every later
 //! command.
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/gem.rs b/crates/socket-patch-core/src/vendor/lock_inventory/gem.rs
index ee6fb95c..61643eba 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/gem.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/gem.rs
@@ -56,7 +56,6 @@ pub(super) async fn inventory_gemfile_lock_raw_in(
     for section in &gem_sections {
         let remotes: Vec<&str> = section.remote_bases().collect();
         for spec in section.specs.iter().filter_map(|line| line.parsed) {
-            // Platform-suffixed specs are unsupported for vendoring anyway.
             if spec.platform.is_some() {
                 continue;
             }
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/npm_family.rs b/crates/socket-patch-core/src/vendor/lock_inventory/npm_family.rs
index f6e217c0..7255825d 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/npm_family.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/npm_family.rs
@@ -65,8 +65,8 @@ pub(super) async fn inventory_npm_lock_raw_in(
             // The PnP loaders are a refusal, not an absence: propagate the
             // diagnosis instead of discarding it. Under PnP the
             // installed-tree crawl is ALSO structurally empty, so
-            // swallowing this here made `scan` a silent success-0 no-op in
-            // every mode. Every other probe error keeps the fallbacks below
+            // swallowing this here would make `scan` a silent success-0
+            // no-op in every mode. Every other probe error keeps the fallbacks below
             // and the calm `Ok(None)`.
             if matches!(
                 code,
@@ -144,9 +144,9 @@ pub(super) async fn inventory_npm_lock_raw_in(
     };
     let raw = match flavor {
         NpmLockFlavor::PackageLock => inventory_package_lock_in(view).await,
-        // The pnpm reader is grammar-agnostic (it already served legacy
-        // 5.4/6.0 locks through the refusal fallback below before those
-        // grammars had a wiring backend), so both pnpm flavors share it.
+        // The pnpm reader is grammar-agnostic (it also serves legacy
+        // 5.4/6.0 locks through the version-refusal fallback above), so
+        // both pnpm flavors share it.
         NpmLockFlavor::Pnpm | NpmLockFlavor::PnpmLegacy => inventory_pnpm_lock_in(view).await,
         NpmLockFlavor::YarnClassic => inventory_yarn_classic_in(view).await,
         NpmLockFlavor::YarnBerry => inventory_yarn_berry_in(view).await,
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/pypi.rs b/crates/socket-patch-core/src/vendor/lock_inventory/pypi.rs
index fda4bd03..597cd880 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/pypi.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/pypi.rs
@@ -166,12 +166,12 @@ pub(crate) fn hosted_artifact_url(url: &str) -> Result<HostedArtifactUrl, String
 // ── registry view ──
 
 /// Inventory the pypi lock the project carries. Fetchable resolution
-/// (URL + sha256 of a pure `py3-none-any` wheel) comes from `uv.lock`;
-/// `poetry.lock` and `--hash`-pinned `requirements.txt` contribute
-/// DISCOVERY-only entries (no recorded URL; platform-independent wheel
-/// choice is not derivable offline). `pdm.lock` contributes discovery-only
-/// entries. Pipfile.lock contributes entries whose integrity is its digest SET
-/// (see `inventory_pipfile_lock`).
+/// (URL + sha256 of a pure `-none-any` wheel) comes from `uv.lock` and
+/// PEP 751 / PEP 723 script locks; `poetry.lock` entries carry the pure
+/// wheel's sha256 when the lock lists one (resolved through PyPI's JSON API
+/// at fetch time), else stay discovery-only; exact `==` `requirements.txt`
+/// pins and `pdm.lock` are discovery-only; Pipfile.lock entries carry its
+/// digest SET (see `inventory_pipfile_lock`).
 #[cfg(test)]
 pub(super) async fn inventory_pypi_locks(project_root: &Path) -> Option<Vec<LockfileEntry>> {
     inventory_pypi_locks_in(&ProjectView::Disk(project_root)).await
@@ -220,10 +220,9 @@ pub(super) async fn inventory_pypi_locks_raw_in(
             }
         }
     }
-    // A PARSEABLE uv.lock stays the EXCLUSIVE project inventory (its
-    // precedence over poetry.lock / requirements.txt predates standalone-lock
-    // support). Exclusivity is keyed on parse SUCCESS, not on the file's
-    // presence: an unparseable uv.lock contributed nothing above, so it falls
+    // A PARSEABLE uv.lock is the EXCLUSIVE project inventory, taking
+    // precedence over poetry.lock / requirements.txt. Exclusivity is keyed
+    // on parse SUCCESS, not on the file's presence: an unparseable uv.lock contributed nothing above, so it falls
     // through to poetry.lock / requirements.txt exactly like a package-less
     // poetry.lock does (`depless_poetry_lock_falls_through_to_requirements`).
     // Keying on presence would hide every requirements pin behind a corrupt
@@ -581,7 +580,7 @@ async fn inventory_pdm_lock(view: &ProjectView<'_>) -> Option<Vec<LockfileEntry>
 ///   `vex::discover::pypi_other` already uses).
 ///
 /// A user's OWN file/url/path reference is not ours to resolve and stays
-/// out, exactly as before.
+/// out.
 async fn inventory_requirements_txt(view: &ProjectView<'_>) -> Option<Vec<LockfileEntry>> {
     let text = view.read_text("requirements.txt").await.ok()?;
     let mut out = Vec::new();
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/python_lock_union_tests.rs b/crates/socket-patch-core/src/vendor/lock_inventory/python_lock_union_tests.rs
index 1c2fab93..5092a48b 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/python_lock_union_tests.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/python_lock_union_tests.rs
@@ -18,8 +18,7 @@ fn names(entries: &[LockfileEntry]) -> Vec<(String, String)> {
 }
 
 /// A script lock is scoped to its script: it must ADD to the project's
-/// requirements.txt / poetry.lock pins, not replace them (the base only
-/// ever let uv.lock short-circuit the fallbacks).
+/// requirements.txt / poetry.lock pins, not replace them.
 #[tokio::test]
 async fn script_lock_supplements_project_pins() {
     let tmp = tempfile::tempdir().unwrap();
@@ -60,9 +59,9 @@ async fn uv_lock_still_hides_requirements_pins() {
 }
 
 /// Without a uv.lock, poetry.lock is the project's tool lock: it hides
-/// requirements.txt (the base's poetry → requirements ordering) while a
-/// script lock still UNIONS with it — the standalone lock supplements
-/// whichever tool lock the project has, never just uv.lock.
+/// requirements.txt while a script lock still UNIONS with it — the
+/// standalone lock supplements whichever tool lock the project has, never
+/// just uv.lock.
 #[tokio::test]
 async fn poetry_lock_unions_with_script_lock_and_hides_requirements() {
     let tmp = tempfile::tempdir().unwrap();
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/recover_tests.rs b/crates/socket-patch-core/src/vendor/lock_inventory/recover_tests.rs
index 9c392a69..1ddb4171 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/recover_tests.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/recover_tests.rs
@@ -338,8 +338,7 @@ async fn composer_gem_uv_fragments_recover() {
 
 // A pdm.lock produced with the `static_urls` strategy inlines the wheel
 // URL exactly like uv.lock, but records it under the `pdm_lock_package`
-// wiring kind. Recovery used to look only at `uv_lock_package`, so it was
-// blind to pdm/poetry/pipenv projects; it now accepts every pypi kind.
+// wiring kind; recovery accepts every pypi kind, not just `uv_lock_package`.
 #[tokio::test]
 async fn recover_pypi_pdm_static_urls_recovers_pure_wheel() {
     let tmp = tempfile::tempdir().unwrap();
@@ -362,10 +361,8 @@ async fn recover_pypi_pdm_static_urls_recovers_pure_wheel() {
 
 // Default pdm/poetry (`file = …`), pipenv (`hashes` only) and pip
 // (`--hash=`) locks record the wheel hash but no fetchable URL. Recovery
-// now RECOGNIZES those fragments (previously they fell through to the
-// uv-specific "no uv.lock fragment recorded" error) and returns an
-// accurate, actionable message instead of the false "not installed / no
-// recoverable fragment".
+// recognizes those fragments and returns an accurate, actionable message
+// rather than a "no recoverable fragment" error.
 #[tokio::test]
 async fn recover_pypi_urlless_locks_report_no_fetchable_url() {
     let tmp = tempfile::tempdir().unwrap();
@@ -622,8 +619,7 @@ async fn recover_composer_empty_shasum_and_gem_hexless_checksum_fail_closed() {
 /// Fragments PRESENT but invalid (non-SRI pnpm integrity, a yarn block
 /// with neither SRI nor 40-hex fragment, a malformed berry checksum, a
 /// bun tuple without an SRI token) must all fall through to the final
-/// fail-closed error — only the no-fragment-at-all path was tested. An
-/// empty-name base purl is unparseable outright.
+/// fail-closed error. An empty-name base purl is unparseable outright.
 #[tokio::test]
 async fn recover_present_but_invalid_npm_fragments_fail_closed() {
     let tmp = tempfile::tempdir().unwrap();
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/tests.rs b/crates/socket-patch-core/src/vendor/lock_inventory/tests.rs
index 0e009b07..e6f31357 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/tests.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/tests.rs
@@ -194,7 +194,7 @@ async fn pnpm_v9_keys_parse_with_peer_suffix_and_scoped_quoting() {
 
 /// A CRLF checkout of the same lock inventories identically: the
 /// hosted rewriter's pnpm grammar (the one reader) is CRLF-blind, where
-/// an exact `packages:` line match used to see no section at all.
+/// an exact `packages:` line match would see no section at all.
 #[tokio::test]
 async fn pnpm_crlf_lock_inventories_like_its_lf_twin() {
     let tmp = tempfile::tempdir().unwrap();
@@ -280,9 +280,7 @@ async fn pnpm_v5_slash_keys_inventory_with_peer_and_hash_suffixes() {
     write(tmp.path(), "pnpm-lock.yaml", PNPM_LOCK_V5).await;
 
     let (flavor, entries) = inventory_npm_lock(tmp.path()).await.unwrap().unwrap();
-    // The legacy grammars route to the PnpmLegacy wiring flavor now
-    // (they used to reach here through the version-refusal fallback);
-    // the inventory content is identical either way.
+    // The legacy grammars route to the PnpmLegacy wiring flavor.
     assert_eq!(flavor, NpmLockFlavor::PnpmLegacy);
     assert_eq!(
         sorted_pairs(&entries),
@@ -346,9 +344,7 @@ async fn pnpm_v6_leading_slash_keys_inventory_with_peer_parens() {
     write(tmp.path(), "pnpm-lock.yaml", PNPM_LOCK_V6).await;
 
     let (flavor, entries) = inventory_npm_lock(tmp.path()).await.unwrap().unwrap();
-    // The legacy grammars route to the PnpmLegacy wiring flavor now
-    // (they used to reach here through the version-refusal fallback);
-    // the inventory content is identical either way.
+    // The legacy grammars route to the PnpmLegacy wiring flavor.
     assert_eq!(flavor, NpmLockFlavor::PnpmLegacy);
     assert_eq!(
         sorted_pairs(&entries),
@@ -630,9 +626,8 @@ async fn stale_pnpm_lock_beside_empty_live_lock_yields_none() {
 
 // ── shrinkwrap.yaml (pnpm 1/2) ──────────────────────────────────────────
 
-/// The exact grammar the 2026-08-18 legacy matrix captured from a real
-/// pnpm 2 install (shrinkwrapVersion 3): v5-style `/name/version` keys,
-/// BLOCK-mapped `resolution:` (integrity nested on its own line — every
+/// The exact grammar a real pnpm 2 install writes (shrinkwrapVersion 3):
+/// v5-style `/name/version` keys, BLOCK-mapped `resolution:` (integrity nested on its own line — every
 /// pnpm-lock.yaml generation writes the inline `{…}` flow map instead),
 /// quoted top-level `registry:`, and a transitive dep (`minimist`)
 /// listed only under `packages:`.
@@ -1611,8 +1606,7 @@ async fn pipfile_lock_inventory_reads_every_category_with_its_digest_set() {
 /// One hosted pypi url grammar (`hosted_artifact_url`, the one lockfile
 /// discovery reads): a hosted SDIST, an `http://` configured origin and a
 /// path-prefixed origin are Socket references too, so the package stays
-/// discoverable instead of vanishing from the inventory (the old
-/// `https://` + exactly-7-segments + `.whl` rule dropped them).
+/// discoverable instead of vanishing from the inventory.
 #[tokio::test]
 async fn pipfile_lock_inventory_reads_hosted_refs_with_the_shared_url_grammar() {
     let uuid = "7c8d9e0f-1a2b-4a1b-8c2d-3e4f5a6b7c8d";
@@ -1775,8 +1769,8 @@ async fn pnp_layouts_propagate_the_diagnosis_instead_of_yielding_none() {
     // PnP marker wins over any lockfile — and the diagnosis must
     // PROPAGATE, not collapse into the calm no-lockfile `None`. Under
     // yarn PnP the installed-tree crawl is also structurally empty, so
-    // swallowing this here made `scan` a silent success-0 no-op in
-    // every mode (the P0 this pins).
+    // swallowing this here would make `scan` a silent success-0 no-op in
+    // every mode.
     let tmp = tempfile::tempdir().unwrap();
     write(tmp.path(), ".pnp.cjs", "/* pnp */").await;
     write(tmp.path(), "package-lock.json", PACKAGE_LOCK).await;
@@ -2341,7 +2335,7 @@ async fn depless_poetry_lock_falls_through_to_requirements() {
 /// requirements.txt pins read with the shared exact-pin rule
 /// (`utils::requirements::exact_pin`, the one lockfile discovery uses): a
 /// wildcard or arbitrary-equality pin is no exact version, so it is not
-/// inventoried as one (it used to emit `pkg:pypi/six@1.*`).
+/// inventoried as one (never `pkg:pypi/six@1.*`).
 #[tokio::test]
 async fn requirements_wildcard_pins_are_not_exact_versions() {
     let tmp = tempfile::tempdir().unwrap();
@@ -2584,9 +2578,9 @@ async fn vlt_lock_wins_the_sibling_order_behind_a_refused_pnpm_lock() {
 ///
 /// The rewriter turns `name==X` into the PEP 508 direct reference
 /// `name @ <patch-server url> --hash=sha256:…`, which the exact-pin rule
-/// does not match — so every redirected line dropped out of the inventory
-/// and a second hosted run over a wet requirements.txt reported ONE package
-/// with patches instead of twelve. uv.lock keeps its `[[package]]`
+/// does not match — without the direct-reference reader every redirected
+/// line would drop out of the inventory and a second hosted run over a wet
+/// requirements.txt would undercount its patched packages. uv.lock keeps its `[[package]]`
 /// name/version through the same rewrite; requirements.txt must too, the
 /// way Pipfile.lock's own reader already keeps a Socket-written reference
 /// (`socket_reference_coords`).
@@ -2698,7 +2692,7 @@ async fn the_hosted_rewriters_own_output_reinventories() {
 /// `./<rel wheel>[ ; marker] --hash=sha256:<hex>  # socket-patch vendor:
 /// <name>==<ver>` (`vendor::pypi_requirements::vendor_line`) — with no
 /// `name @` at all, so the direct-reference reader never sees it and the
-/// package drops out of the inventory exactly the way the hosted lines did.
+/// package would drop out of the inventory just like unread hosted lines.
 /// The `socket-patch vendor:` comment tag is the name/version the writer
 /// left for its readers; cross-check it against the path's own coordinates.
 #[tokio::test]
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/view.rs b/crates/socket-patch-core/src/vendor/lock_inventory/view.rs
index e41120b2..4f603f1d 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/view.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/view.rs
@@ -2,7 +2,7 @@
 //! ([`ProjectView::Disk`]) or an in-memory file map
 //! ([`ProjectView::Memory`]) handed in by a host that never materializes
 //! the repository (the hosted in-memory engine). The disk variant calls the
-//! exact readers the views always used, so on-disk behavior is unchanged.
+//! plain FIFO-safe filesystem readers.
 
 use std::collections::{BTreeMap, BTreeSet};
 use std::io;
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/vlt.rs b/crates/socket-patch-core/src/vendor/lock_inventory/vlt.rs
index 7034acb8..f84eed67 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/vlt.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/vlt.rs
@@ -1,5 +1,5 @@
 //! `vlt-lock.json`: the entry model lockfile discovery shares
-//! ([`vlt_lock_nodes`]) and the registry view (DESIGN §4.8).
+//! ([`vlt_lock_nodes`]) and the registry view.
 
 #[cfg(test)]
 use std::path::Path;
diff --git a/crates/socket-patch-core/src/vendor/maven_repo.rs b/crates/socket-patch-core/src/vendor/maven_repo.rs
index 1c9b88b9..2c98c664 100644
--- a/crates/socket-patch-core/src/vendor/maven_repo.rs
+++ b/crates/socket-patch-core/src/vendor/maven_repo.rs
@@ -833,7 +833,7 @@ async fn local_rebuild_jar(
 /// dependency resolve reads the central directory, so lexicographic entry
 /// order + fixed timestamps yield stable bytes across re-runs). The in-memory
 /// repack assembles the same entry list from the members it never wrote out;
-/// an archive that had to be extracted is walked as before.
+/// an archive that had to be extracted is walked on disk.
 async fn rebuild_jar_bytes(repack: Option<MemoryRepack>, stage: &Path) -> Result<Vec<u8>, String> {
     let rezip = match repack {
         Some(repack) => {
@@ -1705,7 +1705,7 @@ mod tests {
         Some(out)
     }
 
-    /// X10 equivalence: keeping the jar's members in memory must rebuild the
+    /// In-memory repack equivalence: keeping the jar's members in memory must rebuild the
     /// EXACT bytes the extract-to-disk rebuild produced — the artifact's sha1
     /// sidecar and every downstream pin ride on them. Driven twice over one
     /// fixture, once with the in-memory repack forced off.
@@ -2172,7 +2172,7 @@ mod tests {
         // sibling vendor run inserts ANOTHER <repository> into that same
         // section (simulated by inserting before </repositories>). Reverting
         // us must excise ONLY our block and keep the sibling's wiring intact —
-        // the old whole-file restore would have wiped it.
+        // a whole-file restore would wipe it.
         let (dir, blobs, installed, record) = fixture(Some(project_pom()), true, true).await;
         let root = dir.path();
 
@@ -2609,8 +2609,8 @@ mod tests {
     /// must read as out-of-sync — triggering the artifact rebuild that
     /// atomically replaces it — instead of wedging the in-sync hot path
     /// forever in an `open(2)` waiting for a writer. The jar half of this
-    /// probe (`zip_matches_after_hashes`) is already guarded in common.rs;
-    /// this pins the `sidecar_matches` half.
+    /// probe (`read_zip_artifact` + `zip_bytes_match_after_hashes`) is
+    /// already guarded in common.rs; this pins the `sidecar_matches` half.
     #[cfg(unix)]
     #[tokio::test]
     async fn fifo_vendored_pom_fails_fast_and_rebuilds_on_hot_path() {
@@ -2802,7 +2802,7 @@ mod tests {
         );
     }
 
-    // ── coverage-gap additions (2026-09 audit) ───────────────────────────────
+    // ── coverage: refusal and edge arms ──────────────────────────────────────
 
     /// Save/restore guard for env-var tests (same shape as the maven crawler's
     /// tests); every user must also be `#[serial_test::serial]`.
diff --git a/crates/socket-patch-core/src/vendor/mod.rs b/crates/socket-patch-core/src/vendor/mod.rs
index 02cc4d81..9dae4b77 100644
--- a/crates/socket-patch-core/src/vendor/mod.rs
+++ b/crates/socket-patch-core/src/vendor/mod.rs
@@ -7,7 +7,7 @@
 //! committing `.socket/vendor/` + the lockfile edits, a fresh checkout builds
 //! with the patched dependency on machines with no socket-patch installed and
 //! no Socket API access (spike-proven per ecosystem against real package
-//! managers — see `spikes/PHASE0-FINDINGS.txt`).
+//! managers).
 //!
 //! ## Per-ecosystem wiring
 //!
@@ -24,7 +24,8 @@
 //!
 //! npm requests route through [`npm_flavor`], which content-sniffs the
 //! project's lockfile (not just file presence) and dispatches to the
-//! matching backend — all five flavors have real backends; a lockfile the
+//! matching backend — every flavor (package-lock, yarn classic/berry, pnpm
+//! v9 and legacy, bun, vlt) has a real backend; a lockfile the
 //! probe can't classify (or a berry PnP layout) refuses with a stable
 //! reason code.
 //!
@@ -116,12 +117,12 @@ pub use state::{
     carry_forward_wiring, load_state, lookup_entry, save_state, save_state_shared, VendorEntry,
     VendorState, VENDOR_STATE_REL,
 };
-// The hosted→vendored takeover refuses a berry project the backend would
-// refuse BEFORE it reverts the hosted redirect.
 pub use verify::{
     artifact_is_file_shaped, check_vendored_artifact, compute_dir_inventory,
     compute_package_dir_inventory, file_sha256_hex, ArtifactHealth,
 };
+// The hosted→vendored takeover refuses a berry project the backend would
+// refuse BEFORE it reverts the hosted redirect.
 pub use yarn_berry_lock::yarn_berry_vendor_preflight;
 
 use std::collections::{HashMap, HashSet};
@@ -158,8 +159,8 @@ impl VendorWarning {
 /// Yarn 2+ (berry) migrates a classic (v1) `yarn.lock` to its own format on
 /// install and re-resolves every entry from the registry — the vendored
 /// `file:./.socket/vendor/…` resolutions are dropped with no warning and the
-/// packages install unpatched (observed end-to-end on a real monorepo,
-/// 2026-07). Returns the warning when ALL of:
+/// packages install unpatched (observed end-to-end on a real monorepo).
+/// Returns the warning when ALL of:
 ///
 /// * `yarn.lock` exists and is classic (`# yarn lockfile v1` marker), AND
 /// * it carries vendored wiring (`.socket/vendor/` resolutions), AND
@@ -172,7 +173,7 @@ impl VendorWarning {
 pub fn yarn_classic_berry_migration_risk(project_root: &Path) -> Option<VendorWarning> {
     // The guarded sync reader (`O_NONBLOCK` open + fstat regular-file check):
     // this probe runs at envelope-finalize time on every vendor / scan
-    // --vendor run, and a plain `open(2)` of a FIFO planted at `yarn.lock` or
+    // --mode vendored run, and a plain `open(2)` of a FIFO planted at `yarn.lock` or
     // `package.json` would wedge the whole run after the real work is done.
     let lock = read_regular_to_string_sync(&project_root.join("yarn.lock")).ok()?;
     if !lock.contains("# yarn lockfile v1") || !lock.contains(".socket/vendor/") {
@@ -212,8 +213,8 @@ pub fn yarn_classic_berry_migration_risk(project_root: &Path) -> Option<VendorWa
 ///   integrity-verified before use.
 /// * `Service` — require the vendoring service; fail closed on a miss. Useful
 ///   for CI / exercising the service path exclusively.
-/// * `Build` — always build the artifact locally (the pre-service behavior;
-///   never contacts the vendoring service).
+/// * `Build` — always build the artifact locally (never contacts the
+///   vendoring service).
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
 pub enum VendorSource {
     #[default]
@@ -262,8 +263,7 @@ impl VendorSource {
 ///
 /// Built once per `vendor` run in the CLI and threaded as
 /// `Option<&VendorServiceConfig>` through the dispatch chain — `None` means
-/// "build-only" (the pre-service behavior), which keeps every caller that
-/// doesn't opt in (and every existing test) unchanged.
+/// "build-only".
 #[derive(Debug, Clone)]
 pub struct VendorServiceConfig {
     /// The `auto` / `service` / `build` policy.
@@ -615,9 +615,8 @@ fn fallback_scans_of<T>(f: impl FnOnce() -> T) -> (T, usize) {
 /// common case costs one seek and one inflate per needed hash instead of
 /// inflating the whole archive. Everything the name lookup does not settle —
 /// a member renamed since the patch was exported, a duplicate name, an
-/// entry the caps reject — falls back to the exhaustive index scan the
-/// harvest always did, which is what keeps the result identical to reading
-/// every entry: the name path only ever admits an entry whose hash IS one of
+/// entry the caps reject — falls back to an exhaustive index scan, which is
+/// what keeps the result identical to reading every entry: the name path only ever admits an entry whose hash IS one of
 /// the wanted ones, and the scan then supplies every hash still outstanding.
 fn harvest_zip_blobs(path: &Path, wanted: &[(String, String)]) -> HashMap<String, Vec<u8>> {
     use crate::hash::git_sha256::compute_git_sha256_from_bytes;
@@ -691,7 +690,7 @@ fn harvest_zip_blobs(path: &Path, wanted: &[(String, String)]) -> HashMap<String
     }
 
     // Fallback: the member names disagree with the record's keys (or an
-    // entry was rejected above). Scan every entry, exactly as before.
+    // entry was rejected above). Scan every entry.
     #[cfg(test)]
     FALLBACK_SCANS.with(|n| n.set(n.get() + 1));
     for i in 0..archive.len() {
@@ -810,8 +809,8 @@ pub struct RevertOpts {
 }
 
 impl RevertOpts {
-    /// The classic revert shape every `dry_run: bool` caller used: the
-    /// artifact directory is deleted on a successful wet revert.
+    /// The default revert: the artifact directory is deleted on a
+    /// successful wet revert.
     pub fn new(dry_run: bool) -> Self {
         Self {
             dry_run,
@@ -828,7 +827,7 @@ pub struct RevertOutcome {
     pub error: Option<String>,
     /// True when the backend deliberately KEPT the artifact uuid dir
     /// because at least one wiring record was left alone during the
-    /// restore (a `vendor_lock_entry_drifted` skip — residual #131). The
+    /// restore (a `vendor_lock_entry_drifted` skip). The
     /// entry's recorded pre-vendor originals and vendored blob may be the
     /// only surviving inputs a later restore needs (the lockfile — or the
     /// hosted redirect ledger's recorded `original` fragments — can still
@@ -1366,7 +1365,7 @@ mod harvest_tests {
         assert!(harvest_artifact_blobs(&project, &patches).await.is_empty());
     }
 
-    /// Release a reader wedged in `open(2)` on `fifo` (pre-fix behavior) so
+    /// Release a reader wedged in `open(2)` on `fifo` (an unguarded open) so
     /// the tokio blocking pool can shut down; the write side closing
     /// immediately EOFs the read.
     #[cfg(unix)]
@@ -1516,15 +1515,15 @@ mod harvest_tests {
         );
     }
 
-    // ── The name-seeking harvest against the scan it replaced ───────────
+    // ── The name-seeking harvest against an exhaustive-scan oracle ──────
     // `harvest_zip_blobs` returns the same blobs whichever path produced
     // them, which is what makes it safe and also what makes a scenario test
     // blind to the path: every test below still passes with the name lookup
-    // deleted. The oracle pins the RESULT against the pre-change scan, and
+    // deleted. The oracle pins the RESULT against an exhaustive scan, and
     // `fallback_scans_of` pins the PATH.
 
-    /// The whole-archive scan `harvest_zip_blobs` replaced, verbatim, over
-    /// the hashes a record needs.
+    /// Reference oracle: a whole-archive scan over the hashes a record
+    /// needs, reading every entry.
     fn exhaustive_scan(path: &Path, needed: &HashSet<&str>) -> HashMap<String, Vec<u8>> {
         use std::io::Read as _;
 
@@ -2286,9 +2285,9 @@ mod berry_migration_risk_tests {
     }
 
     /// Run the sync probe on another thread with a timeout: a FIFO planted
-    /// at either probed path wedged the pre-fix `read_to_string` in
+    /// at either probed path would wedge an unguarded `read_to_string` in
     /// `open(2)` forever — and the probe runs unconditionally at
-    /// envelope-finalize time on EVERY vendor / scan --vendor run.
+    /// envelope-finalize time on EVERY vendor / scan --mode vendored run.
     #[cfg(unix)]
     fn probe_with_timeout(root: &Path, fifo: &Path) -> Option<VendorWarning> {
         let root = root.to_path_buf();
diff --git a/crates/socket-patch-core/src/vendor/npm_common.rs b/crates/socket-patch-core/src/vendor/npm_common.rs
index 41c7c766..88cf6331 100644
--- a/crates/socket-patch-core/src/vendor/npm_common.rs
+++ b/crates/socket-patch-core/src/vendor/npm_common.rs
@@ -1,8 +1,8 @@
 //! Flavor-agnostic npm vendoring pipeline: coordinate guards plus the shared
 //! stage→patch→pack steps.
 //!
-//! Every npm lockfile flavor (package-lock, yarn-classic/berry, pnpm, bun)
-//! vendors the same way up to the wiring: validate the
+//! Every tarball-artifact npm flavor (package-lock, yarn classic/berry, pnpm
+//! incl. legacy, bun) vendors the same way up to the wiring: validate the
 //! coordinates fail-closed, stage a private copy of the installed package in
 //! a tempdir OUTSIDE the project, prune nested `node_modules`, refuse
 //! bundled-deps packages, run the hardened apply pipeline against the stage,
@@ -10,7 +10,8 @@
 //! `.socket/vendor/npm/<uuid>/`. Only the lockfile wiring differs per flavor,
 //! and it always runs LAST — so a refusal or failure in this pipeline leaves
 //! the project byte-untouched (a dry run stops after verification and
-//! creates nothing on disk).
+//! creates nothing on disk). vlt shares the coordinate guards but vendors a
+//! directory artifact instead (see [`super::npm_dir`]).
 
 use std::path::{Path, PathBuf};
 
@@ -213,10 +214,10 @@ pub(super) async fn stage_patch_pack(
     // same members but different bytes), so a service outage or its
     // recovery would re-vendor every package. `--vendor-source` governs
     // acquisition, not reuse; checked before `service_offline_conflict` so
-    // an in-sync `service` + `--offline` re-run succeeds (as cargo and
-    // composer already do). The probe is read-only and offline, so a dry
-    // run runs it too: on a hit it skips the offline refusal (the real run
-    // would not raise it) and keeps previewing the local build.
+    // an in-sync `service` + `--offline` re-run succeeds. The probe is
+    // read-only and offline, so a dry run runs it too: on a hit it skips the
+    // offline refusal (the real run would not raise it) and keeps previewing
+    // the local build.
     let mut reusable = false;
     if let Some(pair) = reuse_committed_pack(purl, project_root, &coords, record).await {
         if !dry_run {
@@ -1029,8 +1030,8 @@ mod tests {
     /// created inside the project — the module contract ("a refusal or
     /// failure in this pipeline leaves the project byte-untouched", and the
     /// `Err` arm's "Nothing inside the project was written") — instead of
-    /// stranding an unledgered, committable husk no `--revert` entry tracks
-    /// (the vendor/cargo.rs failed-vendor-husk class). Reachable shape: the
+    /// stranding an unledgered, committable husk no `--revert` entry tracks.
+    /// Reachable shape: the
     /// patch rewrites package/package.json to content that is not valid
     /// JSON (apply is afterHash-gated only, never a JSON parse), so
     /// `read_staged_package_json` errs after the tarball fully packed.
diff --git a/crates/socket-patch-core/src/vendor/npm_dir.rs b/crates/socket-patch-core/src/vendor/npm_dir.rs
index 3e5c2768..82cfd580 100644
--- a/crates/socket-patch-core/src/vendor/npm_dir.rs
+++ b/crates/socket-patch-core/src/vendor/npm_dir.rs
@@ -1,4 +1,4 @@
-//! Directory artifacts for the vlt backend (DESIGN §4.2–§4.4).
+//! Directory artifacts for the vlt backend.
 //!
 //! vlt installs a `file:` directory dependency by linking it, so the vendored
 //! artifact is the patched package directory itself, laid out as
@@ -15,7 +15,7 @@
 //! packages publish) while keeping vlt's links out, and `<uuid>/.gitattributes`
 //! stops EOL conversion from rewriting the payload on a Windows checkout.
 //!
-//! Two deterministic transforms run on every tree, service-built or local:
+//! One deterministic transform runs on every tree, service-built or local:
 //! the top-level `devDependencies` member is cut out of `package.json` (vlt
 //! installs a `file` node's devDependencies), and nothing else changes. The
 //! verifiers then apply the vlt manifest exemption ([`super::verify`]).
@@ -206,7 +206,7 @@ pub(crate) enum SpanError {
     NotString,
 }
 
-/// DESIGN §4.4: `package.json` with its top-level `devDependencies` member
+/// `package.json` with its top-level `devDependencies` member
 /// cut out as a byte span (key, colon, value and the whitespace between
 /// them, plus the following comma and the run up to the next token, else
 /// the preceding comma). `Ok(None)` when the member is absent.
@@ -270,8 +270,8 @@ pub(crate) fn replace_dependency_token(
     Ok(format!("{}{raw}{}", &text[..start], &text[end..]))
 }
 
-/// The §4.4 transform on a staged tree's `package.json`. A refusal is the
-/// ready outcome.
+/// The `devDependencies` strip on a staged tree's `package.json`. A
+/// refusal is the ready outcome.
 async fn apply_transforms(
     stage: &Path,
     name: &str,
@@ -302,7 +302,7 @@ async fn apply_transforms(
 
 // ── tree checks ──────────────────────────────────────────────────────────
 
-/// DESIGN §4.2 structure rule: `<uuid>/<leaf>/node_modules/` holds exactly
+/// The structure rule: `<uuid>/<leaf>/node_modules/` holds exactly
 /// the package dir (for a scoped name, exactly `@scope/` holding exactly
 /// `<bare>`). `rel_abs` is the package dir.
 pub(crate) async fn structure_rule_holds(rel_abs: &Path, name: &str) -> bool {
@@ -430,7 +430,7 @@ async fn git_output(
     ))
 }
 
-/// DESIGN §4.2 probe: `git check-ignore -v --no-index` over `paths`
+/// `git check-ignore -v --no-index` over `paths`
 /// (project-relative). `Some(rules)` names what ignores them; `None` when
 /// nothing is ignored, git is absent or the root is not a work tree, and
 /// also when git could not answer (see [`gitignore_probe`] for the
@@ -528,7 +528,7 @@ pub(crate) fn gitignored_detail(rel: &str, rules: &str) -> String {
 
 // ── pipeline ─────────────────────────────────────────────────────────────
 
-/// DESIGN §4.3: reuse the committed dir, else build it from the patch
+/// Reuse the committed dir, else build it from the patch
 /// service or the installed copy, then write it into place. Same result
 /// shape as [`super::npm_common::stage_patch_pack`]: `Err` is a refusal or
 /// a failure with the project untouched, `Ok((None, _))` a failed patch or
@@ -726,7 +726,7 @@ pub(super) async fn stage_patch_dir(
     ))
 }
 
-/// DESIGN §4.3 step 5 on any staged tree: prune its `node_modules/` and
+/// On any staged tree: prune its `node_modules/` and
 /// refuse a package that bundles dependencies.
 async fn prune_staged_node_modules(
     purl: &str,
diff --git a/crates/socket-patch-core/src/vendor/npm_flavor.rs b/crates/socket-patch-core/src/vendor/npm_flavor.rs
index 33c72d14..25a976a0 100644
--- a/crates/socket-patch-core/src/vendor/npm_flavor.rs
+++ b/crates/socket-patch-core/src/vendor/npm_flavor.rs
@@ -14,7 +14,7 @@
 //! The router fans `vendor`/`revert` out per detected flavor. Every flavor
 //! has a real backend: package-lock ([`super::npm_lock`]), yarn classic
 //! ([`super::yarn_classic_lock`]), yarn berry ([`super::yarn_berry_lock`]),
-//! pnpm ([`super::pnpm_lock`]), bun ([`super::bun_lock`]) and vlt
+//! pnpm ([`super::pnpm_lock`], legacy [`super::pnpm_lock_legacy`]), bun ([`super::bun_lock`]) and vlt
 //! ([`super::vlt_lock`]); a lockfile the probe can't classify refuses with
 //! a stable code. Reverts fail CLOSED on a flavor this build has no
 //! backend for — never guess at another flavor's wiring records.
@@ -138,8 +138,9 @@ pub(super) fn project_root_location(project_root: &Path) -> String {
 /// 4. `pnpm-lock.yaml` → head-sniff `lockfileVersion`: `'9.0'` → Pnpm;
 ///    `5.4`/`'6.0'` (pnpm 7/8) → PnpmLegacy; anything else → Err
 ///    `vendor_lockfile_version_unsupported` (version-aware remedy);
-/// 5. `yarn.lock` → head-sniff: column-0 `__metadata:` → Err
-///    `vendor_yarn_berry_unsupported`; `# yarn lockfile v1` → YarnClassic;
+/// 5. `yarn.lock` → head-sniff: column-0 `__metadata:` → YarnBerry
+///    (node-modules linker; PnP was already refused in step 1);
+///    `# yarn lockfile v1` → YarnClassic;
 ///    neither → Err `vendor_lockfile_version_unsupported`;
 /// 6. `npm-shrinkwrap.json` | `package-lock.json` → PackageLock;
 /// 7. nothing recognized, but `rush.json` present → Err
@@ -349,8 +350,8 @@ async fn sniff_yarn_lock(project_root: &Path) -> Result<NpmLockFlavor, (&'static
 
 /// Vendor one npm package through whichever lockfile-flavor backend serves
 /// this project (package-lock / yarn classic / yarn berry node-modules /
-/// pnpm / bun). Probe refusals (PnP, unsupported lock versions)
-/// surface verbatim; the detected flavor is stamped onto the ledger entry so
+/// pnpm / pnpm legacy / bun / vlt). Probe refusals (PnP, unsupported lock
+/// versions) surface verbatim; the detected flavor is stamped onto the ledger entry so
 /// `revert_npm_any` routes back to the same backend.
 #[allow(clippy::too_many_arguments)]
 pub async fn vendor_npm_any<'a>(
@@ -376,7 +377,7 @@ pub async fn vendor_npm_any<'a>(
         };
     }
     // Every backend takes the identical 9-argument tuple; the macro collapses
-    // the five-way repetition (same shape as the CLI dispatcher's `vend!`).
+    // the seven-way repetition (same shape as the CLI dispatcher's `vend!`).
     macro_rules! vend {
         ($backend:path) => {
             $backend(
@@ -669,8 +670,8 @@ pub async fn vendored_entry_in_use(entry: &VendorEntry, project_root: &Path) ->
 /// the textual backends' unwired-revert guard
 /// ([`super::npm_lock::guard_unwired_textual_revert`]).
 ///
-/// It used to stop at the FIRST readable name (npm <= 11's shrinkwrap-wins
-/// rule), but npm 12 installs from package-lock.json beside a committed
+/// It never stops at the first readable name (npm <= 11's shrinkwrap-wins
+/// rule): npm 12 installs from package-lock.json beside a committed
 /// npm-shrinkwrap.json, so a mention in either lock can be the one an
 /// install resolves through.
 pub(super) async fn lock_text_mentions_uuid(
@@ -1078,7 +1079,7 @@ mod tests {
         let (flavor, _) = detect_npm_lock_flavor(tmp.path()).await.unwrap();
         assert_eq!(flavor, NpmLockFlavor::YarnClassic);
 
-        // A berry (node-modules) lock now routes to the YarnBerry backend
+        // A berry (node-modules) lock routes to the YarnBerry backend
         // (cache-zip checksum is reproducible from our tarball — berry_zip).
         // Only PnP (`.pnp.*` markers, caught earlier) stays refused.
         let tmp = tempfile::tempdir().unwrap();
@@ -1464,9 +1465,8 @@ mod tests {
 
     /// The PackageLock arm: the router runs the npm_lock backend and stamps
     /// the ledger entry's flavor. (Every OTHER known lockfile outranks
-    /// package-lock in the decision table, so the PackageLock arm can never
-    /// carry probe warnings today — the merge matters once the yarn/pnpm/bun
-    /// arms become real backends.)
+    /// package-lock in the decision table, so the PackageLock arm never
+    /// carries probe warnings; the merge matters for the other arms.)
     #[tokio::test]
     async fn package_lock_arm_stamps_flavor_on_the_ledger_entry() {
         let (tmp, record) = npm_project().await;
@@ -1493,9 +1493,8 @@ mod tests {
         )));
     }
 
-    /// A yarn.lock now ROUTES to the yarn-classic backend (no longer the old
-    /// `vendor_pkg_manager_unsupported` gate). With a header-only lock that
-    /// has no matching block, the backend's own `vendor_lock_entry_not_found`
+    /// A yarn.lock ROUTES to the yarn-classic backend. With a header-only
+    /// lock that has no matching block, the backend's own `vendor_lock_entry_not_found`
     /// proves the dispatch reached it — and nothing is written.
     #[tokio::test]
     async fn yarn_lock_routes_to_the_backend_not_the_old_gate() {
@@ -1523,9 +1522,9 @@ mod tests {
     /// The router's documented contract: backend format errors and probe
     /// refusals (unsupported versions, missing locks) surface VERBATIM through
     /// `vendor_npm_any` — same code, same detail, nothing remapped — and a
-    /// refusal writes nothing. (The one other Refused-outcome test gets its
-    /// refusal from a backend AFTER a successful probe; this one exercises
-    /// the probe-refusal arm itself.)
+    /// refusal writes nothing. (The bare `bun.lockb` case is a backend
+    /// format error from the native parser after a successful probe; the
+    /// missing-lock case exercises the probe-refusal arm itself.)
     #[tokio::test]
     async fn router_surfaces_probe_refusals_verbatim() {
         let (tmp, record) = npm_project().await;
@@ -1649,7 +1648,8 @@ mod tests {
         touch(tmp.path(), "package-lock.json", "{\"packages\":{}}").await;
         assert_eq!(vendored_entry_in_use(&entry, tmp.path()).await, Some(false));
 
-        // shrinkwrap wins over package-lock (same precedence as vendoring).
+        // A mention in either npm lock counts (npm <= 11 installs from the
+        // shrinkwrap, npm 12 from package-lock.json).
         touch(
             tmp.path(),
             "npm-shrinkwrap.json",
@@ -1846,7 +1846,7 @@ mod tests {
     /// in-use probe behind scan's GC and the textual backends' unwired-revert
     /// guard, forever in an `open(2)` waiting for a writer that never comes.
     /// Same `open_regular_file` guard class as the vendor siblings
-    /// (lock_inventory.rs, cargo_lock.rs, gem.rs). The probe stays
+    /// (lock_inventory/, cargo_lock.rs, gem.rs). The probe stays
     /// fail-closed (`vendor_lockfile_missing` names the unreadable file); the
     /// in-use probe stays fail-safe (`None` = keep the entry).
     #[cfg(unix)]
diff --git a/crates/socket-patch-core/src/vendor/npm_lock.rs b/crates/socket-patch-core/src/vendor/npm_lock.rs
index fc66c3b8..c518e9c1 100644
--- a/crates/socket-patch-core/src/vendor/npm_lock.rs
+++ b/crates/socket-patch-core/src/vendor/npm_lock.rs
@@ -4,7 +4,7 @@
 //! tarball under `.socket/vendor/npm/<uuid>/` (`super::npm_pack`) and
 //! rewrite every matching lockfile entry's `resolved` to a relative `file:`
 //! spec + `integrity` to the tarball's recomputed sha512. That lock-only
-//! rewrite passes `npm ci` (spike-proven; see `spikes/PHASE0-FINDINGS.txt`):
+//! rewrite passes `npm ci` (spike-proven):
 //! a relative `file:` resolves against the project dir and npm never
 //! rewrites/normalizes the entry.
 //!
@@ -42,9 +42,9 @@ use super::{RevertOpts, RevertOutcome, VendorOutcome, VendorWarning};
 use super::npm_common::{is_safe_npm_name, parse_npm_purl, tgz_rel_leaf};
 use crate::constants::npm_family::NPM_LOCKS;
 
-/// `npm-shrinkwrap.json` wins over `package-lock.json` when both exist —
-/// npm itself ignores the package-lock in that case, so editing it would be
-/// a silent no-op.
+/// `npm-shrinkwrap.json` is the primary lock when both exist (npm <= 11
+/// installs from it); npm 12 installs from the `package-lock.json` beside
+/// it, so that sibling is rewired identically (step 3b of [`vendor_npm`]).
 const SHRINKWRAP: &str = NPM_LOCKS[0];
 const PACKAGE_LOCK: &str = NPM_LOCKS[1];
 
@@ -65,7 +65,7 @@ const KIND_LOCK_LEGACY_ENTRY: &str = "npm_lock_legacy_entry";
 /// Lock-entry fields that mirror the package's own `package.json`. When the
 /// patch rewrites that manifest, these go stale in the lock and `npm ci`
 /// would resolve the OLD dependency graph — so they are recomputed from the
-/// patched manifest (step 7 of [`vendor_npm`]).
+/// patched manifest (step 8 of [`vendor_npm`]).
 const DEP_MANIFEST_FIELDS: [&str; 4] = [
     "dependencies",
     "peerDependencies",
@@ -550,11 +550,12 @@ pub(crate) async fn preflight_packages(
 /// restored entry carries empty wiring). Revert has nothing to replay for
 /// them — it cannot un-wire the lock — so removing the artifact while the
 /// lockfile still resolves through it bricks every subsequent install
-/// (ENOENT on the missing `file:` tarball), and used to do so silently.
+/// (ENOENT on the missing `file:` tarball).
 /// The in-use probe is textual and EXACT for these flavors (the uuid dir
 /// path appears iff some resolution still points at the artifact — see
-/// [`super::npm_flavor::vendored_entry_in_use`]), over `lock_names` in the
-/// caller's own precedence order (npm: shrinkwrap wins). Mentioned ⇒
+/// [`super::npm_flavor::vendored_entry_in_use`]), over every lock in
+/// `lock_names` (a mention in any of them counts — npm 12 installs from the
+/// package-lock.json beside a shrinkwrap). Mentioned ⇒
 /// refuse; readable and provably absent ⇒ `None`, the caller's removal
 /// proceeds unchanged; no readable lock ⇒ refuse, fail-closed (it may still
 /// resolve through the artifact) UNLESS no lock file exists at all — a
@@ -735,7 +736,7 @@ pub async fn revert_npm_opts(
         }
     }
 
-    // LOSSINESS GUARD (residual #131): when any wiring record was left
+    // LOSSINESS GUARD: when any wiring record was left
     // alone ("drifted; left alone"), the uuid dir may hold the only copy of
     // what the lock — or the redirect ledger's recorded originals — still
     // points at. Keep it (and let the CLI keep the ledger entry) instead of
@@ -760,8 +761,9 @@ pub async fn revert_npm_opts(
     // npm-shrinkwrap.json (carrying the file: entries with it), and a
     // re-install can hoist the entry to a key the wiring never recorded.
     // Deleting the uuid dir then fails every subsequent install with
-    // ENOENT on the missing tarball, silently. Probe the winning lock
-    // (shrinkwrap-first, like installs): mentioned ⇒ refuse; absent or
+    // ENOENT on the missing tarball, silently. Probe every npm lock (a
+    // mention in either counts — npm <= 11 installs from the shrinkwrap,
+    // npm 12 from the package-lock beside it): mentioned ⇒ refuse; absent or
     // unprovable keeps the wired revert's existing missing-lock tolerance.
     if super::npm_flavor::lock_text_mentions_uuid(
         project_root,
@@ -2355,10 +2357,10 @@ mod tests {
         );
     }
 
-    /// REGRESSION (npm 12): npm 12 auto-creates package-lock.json beside a
-    /// committed npm-shrinkwrap.json and installs FROM package-lock.json
-    /// (verified against real npm 12.0.0 / 12.1.0), so wiring only the
-    /// shrinkwrap was a silent false success there. BOTH locks are rewired
+    /// npm 12 auto-creates package-lock.json beside a committed
+    /// npm-shrinkwrap.json and installs FROM package-lock.json (npm 12.0.0 /
+    /// 12.1.0), so wiring only the shrinkwrap would be a silent false
+    /// success there. BOTH locks are rewired
     /// identically, each wiring record names its own file, a re-run is a
     /// byte-stable no-op, and revert restores both byte-for-byte.
     #[tokio::test]
@@ -2972,7 +2974,7 @@ mod tests {
             default_lock()["packages"]["node_modules/foo/node_modules/left-pad"],
             "non-drifted instance restored"
         );
-        // Residual #131: a drift-skip keeps the artifact dir (the drifted
+        // A drift-skip keeps the artifact dir (the drifted
         // entry's recorded original may still be needed later) and says so.
         assert!(
             fx.root()
@@ -3381,11 +3383,10 @@ mod tests {
     }
 
     // ── empty-wiring (reconstructed) revert guard ──────────────────────────
-    // Same brick as the pnpm backends' (empirically confirmed 2026-08-18):
-    // a `repair`-reconstructed entry carries no wiring records; revert used
-    // to remove the artifact dir unconditionally, leaving the lock resolving
-    // through a deleted tarball — every later `npm ci` failed ENOENT, and
-    // nothing said so.
+    // Same brick as the pnpm backends': a `repair`-reconstructed entry
+    // carries no wiring records; removing the artifact dir unconditionally
+    // would leave the lock resolving through a deleted tarball — every later
+    // `npm ci` fails ENOENT, and nothing says so.
 
     /// Reshape a vendored entry into what `repair`'s no-ledger
     /// reconstruction persists: same uuid/artifact, EMPTY wiring.
@@ -3455,11 +3456,11 @@ mod tests {
         );
     }
 
-    /// REGRESSION (npm 12): a clean shrinkwrap no longer "wins" the probe.
-    /// npm 12 installs from package-lock.json beside a committed
-    /// npm-shrinkwrap.json, so a package-lock.json still resolving through
-    /// the artifact must block its deletion — it used to be removed, and
-    /// every later npm 12 install failed ENOENT on the missing tarball.
+    /// A clean shrinkwrap does not "win" the probe: npm 12 installs from
+    /// package-lock.json beside a committed npm-shrinkwrap.json, so a
+    /// package-lock.json still resolving through the artifact must block its
+    /// deletion — otherwise every later npm 12 install fails ENOENT on the
+    /// missing tarball.
     #[tokio::test]
     async fn empty_wiring_revert_refuses_while_the_sibling_package_lock_is_wired() {
         let (fx, entry) = reconstructed_fixture().await;
diff --git a/crates/socket-patch-core/src/vendor/npm_pack.rs b/crates/socket-patch-core/src/vendor/npm_pack.rs
index a9ffff4d..25fd63ea 100644
--- a/crates/socket-patch-core/src/vendor/npm_pack.rs
+++ b/crates/socket-patch-core/src/vendor/npm_pack.rs
@@ -414,7 +414,7 @@ mod tests {
                 .contains("non-UTF-8 file name in staged package"),
             "unexpected error: {err}"
         );
-        // The error fires while packing in memory, before atomic_write_bytes:
+        // The error fires while packing in memory, before atomic_write_artifact:
         // a failed pack must leave no torn artifact behind.
         assert!(
             !dest.exists(),
diff --git a/crates/socket-patch-core/src/vendor/nuget_feed.rs b/crates/socket-patch-core/src/vendor/nuget_feed.rs
index 61ed8c6d..29f4323a 100644
--- a/crates/socket-patch-core/src/vendor/nuget_feed.rs
+++ b/crates/socket-patch-core/src/vendor/nuget_feed.rs
@@ -1059,7 +1059,7 @@ async fn local_rebuild(
     };
 
     if let Err(e) = write_nupkg(uuid_dir, nupkg_path, &nupkg_bytes).await {
-        // atomic_write_bytes cleans up its own stage file, so an existing
+        // atomic_write_artifact cleans up its own stage file, so an existing
         // committed nupkg in the dir is intact; on the wired hot path it (and
         // the marker) must stay — the config still routes restores here.
         if !config_wired {
@@ -1075,7 +1075,7 @@ async fn local_rebuild(
 /// OPC zip; NuGet reads the central directory, so entry order is free to be
 /// lexicographic for stable bytes across re-runs). The in-memory repack
 /// assembles the same entry list from the parts it never wrote out; a package
-/// that had to be extracted is walked as before.
+/// that had to be extracted is walked from the stage on disk.
 async fn rebuild_nupkg_bytes(
     repack: Option<MemoryRepack>,
     stage: &Path,
@@ -2312,7 +2312,7 @@ mod tests {
         .await
     }
 
-    /// X10 equivalence: keeping the package's parts in memory must rebuild
+    /// Equivalence: keeping the package's parts in memory must rebuild
     /// the EXACT bytes the extract-to-disk rebuild produced — the lock's
     /// `contentHash` pin rides on them. Driven twice over one fixture, once
     /// with the in-memory repack forced off. The fixture also exercises the
@@ -2540,8 +2540,7 @@ mod tests {
         // A pre-existing config. Vendor wires OUR source + mapping. Then a
         // sibling vendor run adds ITS OWN source + mapping (simulated by the
         // same insertion shape). Reverting us must excise ONLY our source
-        // `<add>` and our `<packageSource>` mapping, keeping the sibling's —
-        // the old whole-file restore would have wiped the sibling entirely.
+        // `<add>` and our `<packageSource>` mapping, keeping the sibling's.
         let orig_cfg = "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n\
                         <configuration>\n\
                         \x20 <packageSources>\n\
@@ -2749,7 +2748,7 @@ mod tests {
         assert!(!root.join("nuget.config").exists());
     }
 
-    // ── comment-blind wiring regressions ───────────────────────────────────
+    // ── comment-blind wiring ───────────────────────────────────────────────
 
     /// `t` with every `<!-- … -->` span dropped — what NuGet actually reads.
     fn visible_text(t: &str) -> String {
@@ -2911,7 +2910,7 @@ mod tests {
         );
     }
 
-    // ── wired hot-path rebuild regressions ─────────────────────────────────
+    // ── wired hot-path rebuild ─────────────────────────────────────────────
 
     #[tokio::test]
     async fn wired_rebuild_reports_vendored_nupkg_path() {
@@ -3100,7 +3099,7 @@ mod tests {
         );
     }
 
-    // ── tamper-able wiring `file` regression ───────────────────────────────
+    // ── tamper-able wiring `file` ──────────────────────────────────────────
 
     #[tokio::test]
     async fn revert_refuses_wiring_file_outside_project_root() {
@@ -3439,8 +3438,9 @@ mod tests {
     /// A FIFO planted as the committed vendored nupkg (the tamper-able tree)
     /// must read as out-of-sync — triggering the artifact rebuild that
     /// atomically replaces it — instead of wedging the in-sync hot path
-    /// forever. The zip probe (`zip_matches_after_hashes`) is already guarded
-    /// in common.rs; this pins the lock-hash read beside it.
+    /// forever. The one guarded read of the nupkg (`read_zip_artifact` in
+    /// common.rs) feeds both the member-hash check and the lock content-hash
+    /// pin; this pins that the read fails fast on a FIFO.
     #[cfg(unix)]
     #[tokio::test]
     async fn fifo_vendored_nupkg_fails_fast_and_rebuilds_on_hot_path() {
@@ -3596,7 +3596,7 @@ mod tests {
         );
     }
 
-    // ── covgap 2026-09: refusal + no-op edges ───────────────────────────────
+    // ── refusal + no-op edges ──────────────────────────────────────────────
 
     /// A purl from another ecosystem is refused before any disk access.
     #[tokio::test]
@@ -3645,7 +3645,7 @@ mod tests {
         );
     }
 
-    // ── covgap 2026-09: wired hot path without a lockfile ───────────────────
+    // ── wired hot path without a lockfile ──────────────────────────────────
 
     /// The in-sync rerun of a project with NO packages.lock.json short-circuits
     /// to AlreadyPatched (an absent lock is trivially in sync).
@@ -3697,7 +3697,7 @@ mod tests {
         );
     }
 
-    // ── covgap 2026-09: wired hot-path rebuild failure legs ─────────────────
+    // ── wired hot-path rebuild failure legs ────────────────────────────────
 
     /// Wired + stale with the cached pristine nupkg ALSO gone: the rebuild leg
     /// bubbles the terminal refusal, and the wired config stays untouched.
@@ -3833,7 +3833,7 @@ mod tests {
         );
     }
 
-    // ── covgap 2026-09: config-edit failure shapes ──────────────────────────
+    // ── config-edit failure shapes ─────────────────────────────────────────
 
     /// A pre-existing config with no `</configuration>` fails the FRESH vendor
     /// after the artifact was built — the partial uuid dir is removed and no
@@ -3939,7 +3939,7 @@ mod tests {
         assert!(err.contains("no </configuration> to edit"), "{err}");
     }
 
-    // ── covgap 2026-09: marker write failure is a warning, not a failure ────
+    // ── marker write failure is a warning, not a failure ───────────────────
 
     #[tokio::test]
     async fn marker_write_failure_warns_but_vendor_succeeds() {
@@ -3979,7 +3979,7 @@ mod tests {
         assert!(lock.contains(&content_hash(&nupkg)));
     }
 
-    // ── covgap 2026-09: revert entry validation edges ───────────────────────
+    // ── revert entry validation edges ──────────────────────────────────────
 
     fn entry_with_wiring(uuid: &str, wiring: Vec<WiringRecord>) -> VendorEntry {
         VendorEntry {
@@ -4194,7 +4194,7 @@ mod tests {
         assert!(!root.join("nuget.config").exists(), "no config resurrected");
     }
 
-    // ── covgap 2026-09: dry-run revert previews without writes ──────────────
+    // ── dry-run revert previews without writes ─────────────────────────────
 
     #[tokio::test]
     async fn dry_run_revert_in_sync_touches_nothing() {
@@ -4267,7 +4267,7 @@ mod tests {
         assert!(root.join(format!(".socket/vendor/nuget/{UUID}")).exists());
     }
 
-    // ── covgap 2026-09: local-rebuild failure shapes ────────────────────────
+    // ── local-rebuild failure shapes ───────────────────────────────────────
 
     /// A cached .nupkg that is not a zip cannot be staged: failed result, and
     /// no project file (or artifact dir) is written after the failure.
@@ -4366,7 +4366,7 @@ mod tests {
         );
     }
 
-    // ── covgap 2026-09: service prebuilt (Tier A) arms ──────────────────────
+    // ── service prebuilt (Tier A) arms ─────────────────────────────────────
 
     #[tokio::test]
     async fn service_prebuilt_used_writes_served_bytes_verbatim() {
@@ -4522,7 +4522,7 @@ mod tests {
         assert!(!root.join("nuget.config").exists());
     }
 
-    // ── covgap 2026-09: edit_lock / lock_pinned pure edges ──────────────────
+    // ── edit_lock / lock_pinned pure edges ─────────────────────────────────
 
     #[test]
     fn edit_lock_absent_shapes_are_nothing_to_pin() {
@@ -4588,7 +4588,7 @@ mod tests {
         assert!(!lock_pinned(&lock, "Newtonsoft.Json", "12.0.0", "H=="));
     }
 
-    // ── covgap 2026-09: revert_lock_record pure edges ───────────────────────
+    // ── revert_lock_record pure edges ──────────────────────────────────────
 
     fn lock_wiring(original: Option<&str>, new: Option<&str>) -> WiringRecord {
         WiringRecord {
@@ -4655,7 +4655,7 @@ mod tests {
         assert!(!revert_lock_record(&lock_path, &w, false).await.unwrap());
     }
 
-    // ── covgap 2026-09: unwind of a CREATED config ──────────────────────────
+    // ── unwind of a CREATED config ─────────────────────────────────────────
 
     /// When vendor CREATED nuget.config and the lock edit then fails, the
     /// unwind must DELETE the created config (the None arm), not restore it.
@@ -4690,7 +4690,7 @@ mod tests {
         );
     }
 
-    // ── covgap 2026-09: comment blanking + key scan edges ───────────────────
+    // ── comment blanking + key scan edges ──────────────────────────────────
 
     #[test]
     fn blank_comments_unterminated_blanks_through_eof() {
@@ -4718,7 +4718,7 @@ mod tests {
         assert_eq!(parse_config_source_keys(text), vec!["a"]);
     }
 
-    // ── covgap 2026-09: permission-failure unwinds (unix) ───────────────────
+    // ── permission-failure unwinds (unix) ──────────────────────────────────
 
     /// Fresh-path nuget.config write failure: the artifact already staged into
     /// the (pre-created, writable) uuid dir must be cleaned up so a failed
@@ -4902,7 +4902,7 @@ mod tests {
         );
     }
 
-    // ── covgap 2026-09 mop-up: remaining prod arms ───────────────────────────
+    // ── remaining prod arms ────────────────────────────────────────────────
 
     /// `attr_value` scanning edges: a substring hit on the attribute NAME
     /// (`keyring`) and a malformed unquoted value both advance the scan to the
@@ -5080,7 +5080,7 @@ mod tests {
         );
     }
 
-    // ── source-flip regression: the hot path decides "in sync" from the
+    // ── source flip: the hot path decides "in sync" from the
     //    COMMITTED copy before any service call, so a service ↔ local flip
     //    between runs is a byte-identical no-op with no request. ──
 
diff --git a/crates/socket-patch-core/src/vendor/parse_memo.rs b/crates/socket-patch-core/src/vendor/parse_memo.rs
index 41810ff1..b4eb2baf 100644
--- a/crates/socket-patch-core/src/vendor/parse_memo.rs
+++ b/crates/socket-patch-core/src/vendor/parse_memo.rs
@@ -39,8 +39,8 @@
 //! **Cost:** a filled slot holds a parsed document AND a copy of the bytes
 //! it came from, in a `static`, until a write drops it or the process
 //! exits — and a parsed document is itself several times its own source
-//! text. Measured against the pre-memo build on a 2.5 MB `composer.lock`,
-//! peak RSS moved by +3 MB on an idempotent re-run and +15-21 MB on the
+//! text. Measured on a 2.5 MB `composer.lock`, the memo adds
+//! +3 MB of peak RSS on an idempotent re-run and +15-21 MB on the
 //! fresh and revert paths, so the sites whose file runs to megabytes
 //! (uv.lock, a package-lock.json, the vendor ledger) are the ones that
 //! decide a run's peak. Keying a slot on an `Arc<[u8]>` the reader already
diff --git a/crates/socket-patch-core/src/vendor/pnpm_lock.rs b/crates/socket-patch-core/src/vendor/pnpm_lock.rs
index 7c00ad74..f62b4ae6 100644
--- a/crates/socket-patch-core/src/vendor/pnpm_lock.rs
+++ b/crates/socket-patch-core/src/vendor/pnpm_lock.rs
@@ -5,7 +5,7 @@
 //! lockfile's own `overrides:` section, so a lock-only edit is unsound:
 //! `--frozen-lockfile` fails with `ERR_PNPM_LOCKFILE_CONFIG_MISMATCH` and a
 //! plain `pnpm install` silently strips the section and reinstalls the
-//! unpatched registry bytes (spike P3, `spikes/PHASE0-V2-FINDINGS.txt`).
+//! unpatched registry bytes (spike P3).
 //!
 //! WHERE pnpm reads overrides moved between majors: pnpm <= 10 reads
 //! package.json `pnpm.overrides`; pnpm >= 11 no longer reads the package.json
@@ -18,11 +18,10 @@
 //! has no `pnpm-workspace.yaml`, one is created carrying a root-only
 //! `packages:` list (pnpm 9 refuses a workspace file with no `packages`
 //! field) plus the `overrides:` block; `vendor --revert` deletes it again.
-//! The lock still gets the four fragments pnpm itself would emit. The surgery
-//! is a faithful port of
-//! `spikes/pnpm/edit_lock.py`, whose output was verified byte-identical to
-//! pnpm's own lock on BOTH supported majors (9.15.9 / 10.34.1 — they emit
-//! byte-identical `lockfileVersion: '9.0'` locks; fixtures in `spikes/pnpm/`):
+//! The lock still gets the four fragments pnpm itself would emit; the
+//! surgery's output was verified byte-identical to pnpm's own lock on BOTH
+//! supported majors (9.15.9 / 10.34.1 — they emit byte-identical
+//! `lockfileVersion: '9.0'` locks):
 //!
 //! 1. `overrides:` section — inserted before `importers:` or extended;
 //! 2. every importer's dep entry — `specifier:` AND `version:` rewritten to
@@ -612,9 +611,9 @@ fn pnpm_entry_in_use_scan(uuid: &str, lines: &[String]) -> bool {
 /// restored entry carries empty wiring). Revert has nothing to replay for
 /// them — it cannot un-wire the lock — so removing the artifact while
 /// `pnpm-lock.yaml` still resolves through it bricks every subsequent
-/// install (ENOENT on the missing `file:` tarball), and used to do so
-/// silently. `in_use` is the calling backend's own lock probe result
-/// ([`pnpm_entry_in_use`] / its legacy twin): `Some(true)` refuses;
+/// install (ENOENT on the missing `file:` tarball). `in_use` is the calling
+/// backend's own lock probe result ([`pnpm_entry_in_use`] / its legacy
+/// twin): `Some(true)` refuses;
 /// `Some(false)` (provably orphaned) returns `None` and the caller's
 /// removal proceeds unchanged; undeterminable (`None`) refuses too UNLESS
 /// the lock is absent altogether — a missing lock cannot reference the
@@ -877,11 +876,11 @@ pub async fn revert_pnpm_opts(
         }
     }
 
-    // LOSSINESS GUARD (residual #131): when any wiring record was left
-    // alone ("drifted; left alone"), the uuid dir may hold the only copy of
-    // what the lock — or the redirect ledger's recorded originals — still
-    // points at. Keep it (and let the CLI keep the ledger entry) instead of
-    // deleting evidence out from under a lock we just refused to touch.
+    // LOSSINESS GUARD: when any wiring record was left alone ("drifted;
+    // left alone"), the uuid dir may hold the only copy of what the lock —
+    // or the redirect ledger's recorded originals — still points at. Keep
+    // it (and let the CLI keep the ledger entry) instead of deleting evidence
+    // out from under a lock we just refused to touch.
     if outcome.drift_skipped() {
         outcome.keep_artifact(&uuid_dir_rel);
         return outcome;
@@ -2293,7 +2292,7 @@ fn matching_blocks<L: EditLines>(
 /// The run's `pnpm-lock.yaml` split. A vendored run reads the lock once per
 /// patched npm package — and a monorepo lock runs to megabytes, so the
 /// split into lines and the whole-section scans the pre-flight and the
-/// edits make were paid per package. See [`ParseMemo`]: the read still
+/// edits make would be paid per package. See [`ParseMemo`]: the read still
 /// happens every time, and a lock whose bytes changed between two packages
 /// is split afresh. The backend re-seeds the slot with the lock it wrote.
 static LOCK_MEMO: ParseMemo<LockDoc> = ParseMemo::new();
@@ -3329,10 +3328,9 @@ pub(super) fn indent_of(line: &str) -> usize {
 /// (keys themselves contain `:` in `file:` specs).
 ///
 /// All three are slices of `line`. Every scan below runs this over whole
-/// `packages:` / `snapshots:` sections once per vendored package, so on a
-/// multi-megabyte lock the owning copies it used to hand back dominated
-/// the surgery's CPU. A caller that keeps a piece past the next edit to
-/// `lines` copies it itself.
+/// `packages:` / `snapshots:` sections once per vendored package, so owning
+/// copies would dominate the surgery's CPU on a multi-megabyte lock. A
+/// caller that keeps a piece past the next edit to `lines` copies it itself.
 pub(super) fn parse_key_line(line: &str, indent: usize) -> Option<(&str, &str, &str)> {
     if line.len() <= indent || !line.as_bytes()[..indent].iter().all(|&b| b == b' ') {
         return None;
@@ -3433,7 +3431,7 @@ mod tests {
         "sha512-VR8nCbFxvOcFX5Rxku2psjaj0+xzKdzFkcuqZJSHf597bMVomG100t6+cJkMBFRLhyVdSVwufbCwVzlCzZkUwg==";
 
     // ── tool-generated byte-exact oracles ─────────────────────────────────
-    // Provenance: spikes/pnpm/p1-multi-dep/{before,after}/ — generated by
+    // Provenance: spike P1 (multi-dep) before/after — generated by
     // pnpm 9.15.9 AND 10.34.1 (byte-identical on both majors), spike P1/P2.
     const P1_BEFORE_PKG: &str = r#"{
   "name": "vendor-spike",
@@ -3552,7 +3550,7 @@ snapshots:
   left-pad@file:.socket/vendor/npm/9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f/left-pad-1.3.0.tgz: {}
 ";
 
-    // Provenance: spikes/pnpm/p7-workspace/{before,after}/ (spike P7) — the
+    // Provenance: spike P7 (workspace) before/after — the
     // per-importer re-relativized specifier vs root-relative version.
     const P7_BEFORE_PKG: &str = r#"{
   "name": "ws-root",
@@ -4031,11 +4029,9 @@ snapshots:
         (fx, entry)
     }
 
-    /// P1 regression (empirically confirmed vs a real pnpm@10.34.5 project,
-    /// 2026-08-18): a `repair`-reconstructed entry carries no wiring
-    /// records; revert used to remove the artifact dir unconditionally,
-    /// leaving the lock resolving through a deleted tarball — every later
-    /// install failed ENOENT, and nothing said so. With nothing to replay,
+    /// A `repair`-reconstructed entry carries no wiring records; removing
+    /// the artifact dir would leave the lock resolving through a deleted
+    /// tarball (every later install fails ENOENT). With nothing to replay,
     /// revert must refuse (fail-closed) while the lock still resolves
     /// through the artifact.
     #[tokio::test]
@@ -4442,12 +4438,11 @@ snapshots:
     /// Two VERSIONS of the same package vendored in sequence: each edit
     /// must bind to its own version's entries — a name-only "ours" match
     /// would let the second vendor clobber/rekey the first one's blocks
-    /// (live-debugged on Flowise: identical duplicated mapping keys).
-    /// 1.2.0 is reachable through a transitive dependent's snapshot ref
-    /// (the Flowise shape) — the P1 `npm:` ALIAS shape now refuses
-    /// fail-closed instead (see
+    /// (identical duplicated mapping keys). 1.2.0 is reachable through a
+    /// transitive dependent's snapshot ref — the P1 `npm:` ALIAS shape
+    /// refuses fail-closed instead (see
     /// `aliased_same_version_reference_refuses_fail_closed`; the surgery
-    /// cannot rewrite alias dep paths and used to strand them dangling).
+    /// cannot rewrite alias dep paths).
     #[tokio::test]
     async fn multi_version_vendor_does_not_clobber_sibling_entries() {
         // P1 with the `left-pad-old` alias swapped for a `dep-two`
@@ -5184,8 +5179,8 @@ snapshots:
         );
         // Non-drifted fragments still restored.
         assert!(after.contains("  left-pad@1.3.0:\n    resolution: {integrity: sha512-XI5MPzVN"));
-        // Residual #131: a drift-skip keeps the artifact dir (the drifted
-        // fragment's recorded original may still be needed later) and says so.
+        // A drift-skip keeps the artifact dir (the drifted fragment's
+        // recorded original may still be needed later) and says so.
         assert!(
             fx.root()
                 .join(format!(".socket/vendor/npm/{UUID}"))
@@ -5947,7 +5942,8 @@ snapshots:
     /// pnpm-workspace.yaml are the FIRST opens in the vendor flow (flavor
     /// detection reads only the lock), and revert's lock/package.json reads
     /// are the first opens of theirs. Same `open_regular_file` guard class
-    /// as the vendor siblings (npm_lock.rs, npm_flavor.rs, lock_inventory.rs).
+    /// as the vendor siblings (npm_lock.rs, npm_flavor.rs, the
+    /// lock_inventory/ readers).
     #[cfg(unix)]
     #[tokio::test]
     async fn fifo_pair_files_fail_fast_instead_of_wedging_vendor_and_revert() {
diff --git a/crates/socket-patch-core/src/vendor/pnpm_lock_legacy.rs b/crates/socket-patch-core/src/vendor/pnpm_lock_legacy.rs
index 986cf095..f82b4567 100644
--- a/crates/socket-patch-core/src/vendor/pnpm_lock_legacy.rs
+++ b/crates/socket-patch-core/src/vendor/pnpm_lock_legacy.rs
@@ -4,8 +4,7 @@
 //! backend ([`super::pnpm_lock`]), with the legacy serialization shapes.
 //!
 //! Every splice below is a faithful port of REAL captured pnpm output
-//! (spike `matrix/vendor-legacy-spike/{p7,p8,t7,t8}`, pnpm 7.33.5 /
-//! 8.15.9, 2026-08-18): a `file:` tarball override was added to
+//! (pnpm 7.33.5 / 8.15.9): a `file:` tarball override was added to
 //! `package.json` and THAT pnpm's own `install` re-serialized the lock; the
 //! unit-test fixtures quote those locks verbatim. Both majors were also
 //! proven byte-stable across an install re-run of the captured shape.
@@ -25,9 +24,9 @@
 //!    bundled `createVersionsOverrider`: `path.join(rootDir, pkgPath)`), so
 //!    the captured locks carry `file:/abs/project/.socket/...`. This makes
 //!    the frozen check path-bound: `pnpm install --frozen-lockfile` only
-//!    passes in a checkout at that exact absolute path (spike probes A/B),
+//!    passes in a checkout at that exact absolute path,
 //!    while a `pnpm install --offline --no-frozen-lockfile` at any path installs the
-//!    patched tarball and re-resolves only that specifier line (probe C).
+//!    patched tarball and re-resolves only that specifier line.
 //!    Vendoring writes the absolute spelling pnpm itself emits and surfaces
 //!    the portability limit as `vendor_pnpm_legacy_absolute_specifier`.
 //! 4. `packages:` — the registry entry (`/name/version` in v5.4,
@@ -43,8 +42,8 @@
 //!    exact version become `name: file:<rel-tgz>`.
 //!
 //! No `pnpm-workspace.yaml` is written for legacy locks: pnpm <= 8 reads
-//! overrides ONLY from package.json `pnpm.overrides` (proven by the spike —
-//! the override applied with no workspace file present), and creating one
+//! overrides ONLY from package.json `pnpm.overrides` (the override applies
+//! with no workspace file present), and creating one
 //! would flip the project into workspace mode. Legacy WORKSPACE locks
 //! (an `importers:` section) are refused fail-closed: the flat-map surgery
 //! has no captured fixtures for them.
@@ -140,7 +139,7 @@ const OVERRIDES_PRECEDING: [&str; 4] = [
 ///
 /// `pub` because the e2e capstone's byte-exact lock oracle must build its
 /// expected absolute specifier with THIS transformation — a hand-copied
-/// oracle drifted on Windows the moment the real spelling differed.
+/// oracle drifts on Windows wherever the real spelling differs.
 pub fn normalize_canonical_root(path: &str) -> String {
     /// Drive-letter (`C:\...` / `C:/...`) or UNC (`\\server\...`) shape.
     fn is_windows_shaped(path: &str) -> bool {
@@ -943,7 +942,7 @@ fn dep_field_lines(
 /// Edit 1: the `overrides:` section — splice our entry into an existing one,
 /// or insert the section at pnpm's ROOT_KEYS_ORDER slot (after
 /// `lockfileVersion:`/`settings:`, before everything else — byte-identical
-/// to the p7/p8 captures).
+/// to the pnpm 7/8 captures).
 fn edit_overrides(
     lines: &mut Vec<String>,
     ctx: &Ctx<'_>,
@@ -1568,7 +1567,7 @@ pub async fn revert_pnpm_legacy_opts(
         }
     }
 
-    // LOSSINESS GUARD (residual #131): when any wiring record was left
+    // LOSSINESS GUARD: when any wiring record was left
     // alone ("drifted; left alone"), the uuid dir may hold the only copy of
     // what the lock still points at. Keep it (and let the CLI keep the
     // ledger entry) instead of deleting evidence out from under a lock we
@@ -1943,7 +1942,7 @@ mod tests {
     // ── normalize_canonical_root (pure string level; no Windows host) ─────
     // The synthetic inputs mirror what `std::fs::canonicalize` returns on
     // Windows (verbatim paths); a real Windows CI leg should confirm pnpm
-    // 7/8's own emission spelling (tracked residual).
+    // 7/8's own emission spelling.
 
     #[test]
     fn normalize_strips_windows_verbatim_drive_prefix_and_forward_slashes() {
@@ -1994,13 +1993,13 @@ mod tests {
         );
     }
 
-    /// The uuid the 2026-08-18 legacy spike vendored under (the captured
-    /// locks quote it verbatim).
+    /// The uuid the captured locks were vendored under (they quote it
+    /// verbatim).
     const UUID: &str = "1a2b3c4d-5e6f-4a1b-8c2d-0123456789ab";
     const ORIG_INDEX: &[u8] = b"module.exports = () => 'orig';\n";
     const PATCHED_INDEX: &[u8] = b"module.exports = () => 'patched';\n";
 
-    /// The spike tarball's integrity as the captured after-locks record it.
+    /// The captured tarball's integrity as the after-locks record it.
     /// Our pack pipeline produces a DIFFERENT (deterministic) tarball, so
     /// fixture comparisons substitute the actual integrity for this token —
     /// everything else must be byte-identical.
@@ -2013,11 +2012,11 @@ mod tests {
     const ROOT_TOKEN: &str = "__PROJECT_ROOT__";
 
     // ── tool-generated byte-exact oracles ─────────────────────────────────
-    // Provenance: matrix/vendor-legacy-spike/{t7,t8} — a `file:` tarball
-    // pnpm.overrides entry added to the fixture below, then serialized by
-    // REAL `corepack pnpm@7.33.5` / `pnpm@8.15.9` installs (2026-08-18) and
-    // proven byte-stable across an install re-run. Only the machine path
-    // and the tarball integrity are tokenized.
+    // Provenance: a `file:` tarball pnpm.overrides entry added to the
+    // fixture below, then serialized by REAL `corepack pnpm@7.33.5` /
+    // `pnpm@8.15.9` installs and proven byte-stable across an install
+    // re-run. Only the machine path and the tarball integrity are
+    // tokenized.
     const T_BEFORE_PKG: &str = r#"{
   "name": "legacy-spike2",
   "version": "0.0.0",
@@ -2190,7 +2189,7 @@ packages:
     dev: false
 ";
 
-    // Provenance: matrix/vendor-legacy-spike/x7 — the transitive-ONLY shape
+    // Provenance: a real pnpm 7.33.5 capture of the transitive-ONLY shape
     // (root depends on `consumer` only): pnpm rekeys the packages entry and
     // the consumer's dep ref but touches NO root section — no absolute path
     // appears anywhere.
@@ -2304,7 +2303,7 @@ packages:
             )
         }
 
-        /// Instantiate a captured after-lock for THIS tempdir: the spike's
+        /// Instantiate a captured after-lock for THIS tempdir: the captured
         /// integrity and absolute-root tokens swapped for the live values.
         async fn expected_lock(&self, fixture: &str) -> String {
             fixture
@@ -2686,7 +2685,7 @@ packages:
 
     // ── empty-wiring (reconstructed) revert guard ─────────────────────────
 
-    /// Same P1 regression guard as the v9 backend: a `repair`-reconstructed
+    /// Same guard as the v9 backend: a `repair`-reconstructed
     /// entry (empty wiring — the legacy fragments are just as
     /// offline-unrecoverable) must not have its artifact deleted while the
     /// legacy lock still resolves through it; a provably orphaned artifact
@@ -3115,8 +3114,8 @@ packages:
     /// Wiring records left alone during a WIRED revert (here: a
     /// CRLF-converted lock whose LF-exact probes all miss) must KEEP the
     /// artifact dir — the lock still resolves through the tarball, and
-    /// deleting it bricks every subsequent install (residual #131's
-    /// lossiness guard, present in the v9/npm/bun backends).
+    /// deleting it bricks every subsequent install (the lossiness guard,
+    /// present in the v9/npm/bun backends).
     #[tokio::test]
     async fn drifted_lock_revert_keeps_the_artifact() {
         let fx = fixture_with(T_BEFORE_PKG, T7_BEFORE_LOCK).await;
@@ -3385,7 +3384,7 @@ packages:
         );
     }
 
-    // ── coverage-audit 2026-09: revert drift/degradation matrices, dry run,
+    // ── revert drift/degradation matrices, dry run,
     //    pre-flight refusal variants, and write-failure paths ──────────────
 
     /// A foreign checkout root every drift fixture below pretends the lock
@@ -4615,7 +4614,7 @@ packages:
         );
     }
 
-    // ── coverage mop-up 2026-09: grammar naming, coordinate guard routing,
+    // ── grammar naming, coordinate guard routing,
     //    marker degradation, malformed/hand-edited lock tolerance, and the
     //    remaining revert left-alone shapes ─────────────────────────────────
 
diff --git a/crates/socket-patch-core/src/vendor/prestage.rs b/crates/socket-patch-core/src/vendor/prestage.rs
index 47a6a75b..b3149cca 100644
--- a/crates/socket-patch-core/src/vendor/prestage.rs
+++ b/crates/socket-patch-core/src/vendor/prestage.rs
@@ -22,7 +22,7 @@
 //!   runs without it (its call skipped by the breaker, its plan position
 //!   passed over) builds in its own stage undisturbed.
 //! * Any failure — the extraction's own refusal included — just drops the
-//!   pre-staged tree: the backend then extracts live, exactly as before,
+//!   pre-staged tree: the backend then extracts live, exactly as without it,
 //!   and reports whatever that extraction reports, word for word.
 //! * The swap, the wiring, the marker and the ledger stay in the loop, in
 //!   record order; the backend claims the tree right where it would have
diff --git a/crates/socket-patch-core/src/vendor/pypi.rs b/crates/socket-patch-core/src/vendor/pypi.rs
index 2c2f6c3a..b3d9c0b6 100644
--- a/crates/socket-patch-core/src/vendor/pypi.rs
+++ b/crates/socket-patch-core/src/vendor/pypi.rs
@@ -233,16 +233,20 @@ const SETUP_ALTERNATIVE: &str =
 /// uv > poetry > pdm > pipenv), and a lock-less tool MARKER refuses with a
 /// "run `<tool> lock`" pointer — falling through to `requirements.txt` when
 /// one exists (a marker alone must not block the requirements wiring):
-/// 1. `uv.lock` → uv;  2. `poetry.lock` → poetry;  3. `pdm.lock` → pdm;
-/// 4. `Pipfile.lock` → pipenv;
-/// 5. lock-less `[tool.uv]`/`[tool.poetry]`/`[tool.pdm]`/`Pipfile` →
+/// 1. `uv.lock` → uv;
+/// 2. standalone `pylock*.toml` / `*.py.lock` locks containing this package
+///    → python-lock;
+/// 3. `poetry.lock` → poetry;  4. `pdm.lock` → pdm;  5. `Pipfile.lock` → pipenv;
+/// 6. lock-less `[tool.uv]`/`[tool.poetry]`/`[tool.pdm]`/`Pipfile` →
 ///    `<tool>_no_lockfile` refusal unless requirements.txt exists;
-/// 6. `requirements.txt` → requirements;
-/// 7. a lone pyproject → refuse;  8. nothing → refuse.
+/// 7. `requirements.txt` → requirements;
+/// 8. `hatch.toml` / `[tool.hatch]` / hatchling build backend → hatch;
+/// 9. a lone pyproject → refuse;  10. nothing → refuse.
 ///
 /// When more than one tool lockfile coexists, the winner is wired and a LOUD
 /// `pypi_multiple_lockfiles` warning names the ignored locks — they go
-/// stale-but-valid, which is otherwise invisible.
+/// stale-but-valid, which is otherwise invisible. Standalone locks that don't
+/// contain the package get a `pypi_unmatched_lockfiles` warning instead.
 async fn detect_pypi_flavor(
     project_root: &Path,
     target: Option<(&str, &str)>,
@@ -554,14 +558,14 @@ pub async fn vendor_pypi<'a>(
 /// site.
 ///
 /// [`pipenv_stale_install_warning`] judges every patched package against the
-/// same venvs, and each judgement re-listed the whole directory (a
-/// `.dist-info` scan plus a METADATA read per installed package) to answer
-/// one question about one purl. A vendor run never writes into a venv, so
+/// same venvs; re-listing the whole directory (a `.dist-info` scan plus a
+/// METADATA read per installed package) per judgement would answer one
+/// question about one purl. A vendor run never writes into a venv, so
 /// one listing per site answers for every package that asks.
 ///
-/// The ONE thing this gives up, deliberately (plan §2.1 row 11): an
+/// The ONE thing this gives up, deliberately: an
 /// EXTERNAL installer landing mid-run — `pip install -U`, `pipenv sync` in
-/// another terminal — is no longer seen by the packages judged after the
+/// another terminal — is not seen by the packages judged after the
 /// first ask for that site, where re-listing per package would have seen
 /// it. Only the `(canonicalized name, version)` SET is frozen: which files
 /// are stale is still read live, per package, through `verify_file_patch`.
@@ -1375,8 +1379,6 @@ pub async fn revert_pypi(entry: &VendorEntry, project_root: &Path, dry_run: bool
     revert_pypi_opts(entry, project_root, RevertOpts::new(dry_run)).await
 }
 
-/// [`revert_pypi`] with full [`RevertOpts`]: `keep_artifact` skips the
-/// artifact deletion while the per-flavor wiring restore runs unchanged.
 /// Fail-closed twin of [`super::npm_lock::guard_unwired_textual_revert`]
 /// for the Python backends. A ledger entry with NO wiring records cannot
 /// restore any project file — that is the shape `socket-patch repair`
@@ -1453,8 +1455,8 @@ async fn unwired_pypi_reference_clause(project_root: &Path, uuid: &str) -> Optio
     }
     // Enumerate the locks ourselves instead of through
     // `python_lock_paths`, which follows symlinks and DROPS every entry
-    // whose target cannot be stat'ed — and whose `Err` the previous shape
-    // read as "no Python locks here". Neither may fail open here.
+    // whose target cannot be stat'ed; a listing `Err` must not read as "no
+    // Python locks here" either. Neither may fail open here.
     let listing = match std::fs::read_dir(project_root) {
         Ok(listing) => listing,
         Err(_) => {
@@ -1529,6 +1531,8 @@ const KNOWN_PYPI_FLAVORS: [&str; 7] = [
     "pipenv",
 ];
 
+/// [`revert_pypi`] with full [`RevertOpts`]: `keep_artifact` skips the
+/// artifact deletion while the per-flavor wiring restore runs unchanged.
 pub async fn revert_pypi_opts(
     entry: &VendorEntry,
     project_root: &Path,
@@ -1598,8 +1602,8 @@ pub async fn revert_pypi_opts(
     if !outcome.success || dry_run {
         return outcome;
     }
-    // LOSSINESS GUARD (residual #131 — the RevertOutcome contract every
-    // npm-family backend honors): when any wiring record was left alone
+    // LOSSINESS GUARD (the RevertOutcome contract every npm-family backend
+    // honors): when any wiring record was left alone
     // ("drifted; left untouched"), the lockfile may still resolve through
     // the uuid dir, and the ledger entry holds the only recorded pre-vendor
     // originals. Keep both (the caller keeps the entry when `kept_artifact`
@@ -1663,15 +1667,13 @@ pub async fn revert_pypi_opts(
     outcome
 }
 
-/// The patched wheel plus the facts the wiring + ledger need, however it was
-/// acquired (service download or local build).
 /// The committed wheel for a Fresh-plan re-run, when the ledger anchors it
 /// and it verifies (see [`reuse`]): directly under `uuid_dir_rel`, a
 /// well-formed wheel filename for THIS distribution and version (the leaf
 /// comes from the committed ledger, and the wirings splice it verbatim into
 /// requirements.txt / uv.lock / poetry.lock — see [`reusable_wheel_leaf`]),
 /// and not platform-locked by either the ledger flag or the filename's own
-/// tags (a platform-specific wheel committed on another OS keeps today's
+/// tags (a platform-specific wheel committed on another OS keeps the usual
 /// acquire-and-pin behavior). `None` acquires as usual.
 async fn fresh_reuse_wheel(
     base: &str,
@@ -1765,6 +1767,8 @@ fn reuse_preview_result(base: &str, abs: &Path, record: &PatchRecord) -> ApplyRe
     super::common::synthesized_result(base, abs, files_verified, true, None)
 }
 
+/// The patched wheel plus the facts the wiring + ledger need, however it was
+/// acquired (service download, local build, or reuse of the committed wheel).
 struct AcquiredWheel {
     wheel_name: String,
     rel_wheel: String,
@@ -2083,8 +2087,9 @@ mod tests {
         tokio::fs::write(root.join(name), content).await.unwrap();
     }
 
-    /// One assert per row of the v2 routing table (locks > lock-less markers
-    /// with requirements fallthrough > requirements > pyproject > nothing).
+    /// One assert per row of the routing table (locks > lock-less markers
+    /// with requirements fallthrough > requirements > pyproject > nothing;
+    /// the python-lock and hatch rows are covered elsewhere).
     #[tokio::test]
     async fn flavor_routing_table_v2_precedence() {
         let flavor = |tmp: &Path| {
@@ -2105,7 +2110,7 @@ mod tests {
             .any(|warning| warning.code == "pypi_multiple_lockfiles"
                 && warning.detail.contains("pylock.toml")));
 
-        // 2-4. Tool locks route to their flavors.
+        // 3-5. Tool locks route to their flavors.
         let tmp = tempfile::tempdir().unwrap();
         touch(tmp.path(), "poetry.lock", "").await;
         assert_eq!(flavor(tmp.path()).await.unwrap(), PypiFlavor::Poetry);
@@ -2132,7 +2137,7 @@ mod tests {
             warnings[0].detail
         );
 
-        // 5. Lock-less tool markers refuse with the per-tool pointer...
+        // 6. Lock-less tool markers refuse with the per-tool pointer...
         let tmp = tempfile::tempdir().unwrap();
         touch(
             tmp.path(),
@@ -2171,8 +2176,7 @@ mod tests {
         );
 
         // ...but every lock-less marker falls through to requirements.txt when
-        // one exists (the marker alone must not block the pip wiring) — this
-        // expands v1, where a bare Pipfile + requirements.txt refused.
+        // one exists (the marker alone must not block the pip wiring).
         for marker in [
             ("pyproject.toml", "[tool.uv]\n"),
             ("pyproject.toml", "[tool.poetry]\n"),
@@ -2189,12 +2193,12 @@ mod tests {
             );
         }
 
-        // 6. requirements.txt at the root.
+        // 7. requirements.txt at the root.
         let tmp = tempfile::tempdir().unwrap();
         touch(tmp.path(), "requirements.txt", "six==1.16.0\n").await;
         assert_eq!(flavor(tmp.path()).await.unwrap(), PypiFlavor::Requirements);
 
-        // 7. a lone pyproject.
+        // 9. a lone pyproject.
         let tmp = tempfile::tempdir().unwrap();
         touch(tmp.path(), "pyproject.toml", "[project]\nname = \"x\"\n").await;
         assert_eq!(
@@ -2202,7 +2206,7 @@ mod tests {
             "pypi_pyproject_only"
         );
 
-        // 8. nothing at all.
+        // 10. nothing at all.
         let tmp = tempfile::tempdir().unwrap();
         let err = detect_pypi_flavor(tmp.path(), None).await.unwrap_err();
         assert_eq!(err.0, "pypi_no_requirements");
@@ -3309,7 +3313,7 @@ wheels = [
         save_state(root, &state).await.unwrap();
     }
 
-    /// BUG GUARD (in-sync rebuild × service): the in-sync probes key only on
+    /// In-sync rebuild × service: the in-sync probes key only on
     /// the patch uuid, so the lockfile still pins the FIRST vendor's exact
     /// wheel sha256. A service-built wheel with different bytes must not
     /// silently replace the missing artifact — under `auto` the rebuild must
@@ -3802,10 +3806,10 @@ wheels = [
 
     /// A ledger entry with NO wiring (the shape `socket-patch repair`
     /// re-synthesizes when state.json is lost) cannot restore any file.
-    /// Routing it into a flavor revert that iterates zero records used to
-    /// "succeed", after which the caller deleted the uuid dir and dropped
-    /// the entry while the lock still resolved through the vendored wheel.
-    /// Both Python-lock backends must refuse while anything references it.
+    /// A flavor revert that iterates zero records would "succeed", and the
+    /// caller would then delete the uuid dir and drop the entry while the
+    /// lock still resolves through the vendored wheel. Both Python-lock
+    /// backends must refuse while anything references it.
     #[tokio::test]
     async fn unwired_python_entry_revert_refuses_while_lock_references_artifact() {
         let rel_wheel = format!(".socket/vendor/pypi/{UUID}/six-1.16.0-py2.py3-none-any.whl");
@@ -3941,10 +3945,10 @@ wheels = [
 
     /// `rollback/remove --preserve-state` (`keep_artifact`) never deletes the
     /// artifact, and an unwired entry has nothing to restore — so there is
-    /// nothing for the in-use guard to protect. It used to refuse with
-    /// `vendor_wiring_unknown_revert_blocked` although the revert would
-    /// have touched nothing (npm skips the guard under `keep_artifact` for
-    /// exactly this reason: the refusal exists only to protect the deletion).
+    /// nothing for the in-use guard to protect: no
+    /// `vendor_wiring_unknown_revert_blocked` refusal (npm skips the guard
+    /// under `keep_artifact` for the same reason: the refusal exists only to
+    /// protect the deletion).
     #[tokio::test]
     async fn unwired_entry_preserve_state_skips_guard() {
         let tmp = tempfile::tempdir().unwrap();
@@ -3989,12 +3993,10 @@ wheels = [
         }
     }
 
-    /// The guard used to treat a `read_dir` failure on the project root as
-    /// "no Python locks here" (and its static list lacked uv.lock and
-    /// pylock.toml), so on an execute-only root nothing was probed and the
-    /// referenced wheel was deleted while uv.lock / pylock.toml still
-    /// resolved through it. An unlistable root cannot prove the absence of
-    /// a reference: refuse, fail-closed.
+    /// A `read_dir` failure on the project root (an execute-only root) is
+    /// not "no Python locks here": an unlistable root cannot prove the
+    /// absence of a reference in uv.lock / pylock.toml, so refuse,
+    /// fail-closed.
     #[cfg(unix)]
     #[tokio::test]
     async fn unwired_python_entry_revert_refuses_when_root_unlistable() {
@@ -4077,10 +4079,9 @@ wheels = [
         }
     }
 
-    /// A lock that is a SYMLINK whose target cannot be stat'ed used to be
-    /// dropped from the probe list (the lister follows the link and drops
-    /// any entry whose metadata fails), so the guard never saw it and the
-    /// wheel it may reference was deleted. Listing must keep symlinks on
+    /// A lock that is a SYMLINK whose target cannot be stat'ed must stay on
+    /// the probe list (a lister that follows the link would drop it and let
+    /// the wheel it may reference be deleted). Listing keeps symlinks on
     /// lstat alone; the unreadable target then hits the fail-closed read.
     /// Both a static-list name and a listing-only name are covered.
     #[cfg(unix)]
@@ -4148,8 +4149,9 @@ wheels = [
     }
 
     /// Once the guard finds no reference, an unwired entry is a plain
-    /// orphan and must be reclaimable. Dispatching it by flavor used to
-    /// fail forever: flavor `uv` with uv.lock gone → "cannot read uv.lock".
+    /// orphan and must be reclaimable — never dispatched by flavor, which
+    /// would fail forever (flavor `uv` with uv.lock gone → "cannot read
+    /// uv.lock").
     #[tokio::test]
     async fn unwired_uv_entry_without_uv_lock_reclaims_orphan() {
         let tmp = tempfile::tempdir().unwrap();
@@ -4180,8 +4182,8 @@ wheels = [
     }
 
     /// Same reclaim contract for flavor `None` — the shape `repair` stamps
-    /// for requirements/poetry/pdm/pipenv reconstructions, which the
-    /// dispatch used to reject with "unknown pypi vendor flavor None".
+    /// for requirements/poetry/pdm/pipenv reconstructions (never rejected as
+    /// "unknown pypi vendor flavor None").
     #[tokio::test]
     async fn unwired_entry_flavor_none_reclaims_orphan() {
         let tmp = tempfile::tempdir().unwrap();
@@ -4240,8 +4242,8 @@ wheels = [
     }
 
     /// The requirements planner writes vendored pins into `-r` includes, so
-    /// a reference may live ONLY in an include. The guard used to probe the
-    /// root requirements.txt alone and let the include-referenced wheel go.
+    /// a reference may live ONLY in an include; the guard must probe the
+    /// includes, not just the root requirements.txt.
     #[tokio::test]
     async fn unwired_requirements_entry_refuses_on_include_reference() {
         let tmp = tempfile::tempdir().unwrap();
@@ -4316,7 +4318,7 @@ wheels = [
 
     /// A relock regenerated the wired entry to a registry reference whose
     /// hash list differs from the recorded original (Pipenv 2022.12.19 does
-    /// exactly this; 2026 reproduces the original and converges silently):
+    /// exactly this; 2026.x reproduces the original and converges silently):
     /// the vendored reference is gone, so the revert must RETIRE the record
     /// — success, no drift-keep, artifact removed — instead of keeping the
     /// uuid dir and ledger entry forever for a reference nothing points at.
@@ -4455,8 +4457,8 @@ wheels = [
         assert!(wheel.is_file());
     }
 
-    /// BUG GUARD (missing drift-keep gate — the npm-family RevertOutcome
-    /// contract, residual #131): a drift-skipped pipenv revert leaves the
+    /// Drift-keep gate (the npm-family RevertOutcome contract): a
+    /// drift-skipped pipenv revert leaves the
     /// vendor-pointing entry in Pipfile.lock, so deleting the uuid dir
     /// bricks every subsequent `pipenv install`/`sync` and pruning the
     /// ledger entry destroys the only recorded pre-vendor original. The
@@ -4523,7 +4525,7 @@ wheels = [
         );
     }
 
-    /// The splice flavors (poetry/pdm) share the same missing gate: a
+    /// The splice flavors (poetry/pdm) share the same drift-keep gate: a
     /// hand-edited-but-still-vendor-pointing `[[package]]` unit is left
     /// alone with a drift warning, so the uuid dir it references must
     /// survive the revert (and the ledger entry with it).
@@ -4944,11 +4946,10 @@ wheels = [
 
     // ───────── full lock-flavor orchestration (poetry / pdm / pipenv) ─────────
     //
-    // Byte-exact copies of the sibling modules' spike-derived six==1.16.0
-    // registry lock fixtures (pypi_poetry.rs tests::LOCK21_DIRECT_REGISTRY,
+    // Byte-exact copies of the sibling modules' six==1.16.0 registry lock
+    // fixtures (pypi_poetry.rs tests::LOCK21_DIRECT_REGISTRY,
     // pypi_pdm.rs / pypi_pipenv.rs tests::LOCK_DIRECT_REGISTRY — private to
-    // their mods, duplicated verbatim; the spike dirs are the source of
-    // truth). They pair exactly with e2e_fixture()'s installed six 1.16.0,
+    // their mods, duplicated verbatim). They pair exactly with e2e_fixture()'s installed six 1.16.0,
     // so one vendor_pypi → revert_pypi cycle runs the flavor's plan arm,
     // wire arm, flavor tag, and MetaSlot arm end to end.
 
@@ -5453,7 +5454,7 @@ wheels = [
     /// every other backend) — a failed write is a `vendor_marker_write_failed`
     /// warning riding an otherwise successful run: the wheel stays, the
     /// wiring lands (the marker is written BEFORE the wiring, and its failure
-    /// no longer short-circuits that), and the ledger entry is emitted.
+    /// does not short-circuit that), and the ledger entry is emitted.
     #[tokio::test]
     async fn fresh_marker_write_failure_warns_but_vendor_succeeds() {
         let fx = e2e_fixture().await;
@@ -5999,7 +6000,7 @@ wheels = [
         mount_pypi_granted(&server, WHEEL_NAME, &sri, bytes).await;
 
         // A non-empty directory squatting at the destination wheel filename
-        // makes atomic_write_bytes' rename fail deterministically.
+        // makes atomic_write_artifact's rename fail deterministically.
         let blocker = fx
             .root
             .join(format!(".socket/vendor/pypi/{UUID}/{WHEEL_NAME}"));
@@ -6717,8 +6718,8 @@ wheels = [{url = "https://files.pythonhosted.org/six.whl", hash = "sha256:upstre
             ]
         }
 
-        /// Regression (the analysts' repro): an in-sync re-run after a flip,
-        /// in both directions, is a no-op with no request, for every flavor.
+        /// An in-sync re-run after a flip, in both directions, is a no-op
+        /// with no request, for every flavor.
         #[tokio::test]
         async fn all_flavors_rerun_flip_is_in_sync() {
             let alt = rezip(&local_wheel().await);
@@ -6898,7 +6899,7 @@ wheels = [{url = "https://files.pythonhosted.org/six.whl", hash = "sha256:upstre
         }
 
         /// P6: a platform-locked ledger entry is never reused on the Fresh
-        /// path (a platform wheel committed on another OS keeps today's
+        /// path (a platform wheel committed on another OS keeps the usual
         /// acquire-and-pin behavior).
         #[tokio::test]
         async fn platform_locked_entry_is_not_reused() {
@@ -6921,8 +6922,8 @@ wheels = [{url = "https://files.pythonhosted.org/six.whl", hash = "sha256:upstre
         /// Dry run of the relock re-scan: the preview agrees with the real
         /// run (which re-wires offline, see above) — success, a verified
         /// preview, the reuse note, nothing written, no request — instead
-        /// of the `service` + `--offline` refusal the acquisition preview
-        /// raised.
+        /// of the `service` + `--offline` refusal an acquisition preview
+        /// would raise.
         #[tokio::test]
         async fn relock_rescan_dry_run_previews_the_reuse_under_service_offline() {
             let alt = rezip(&local_wheel().await);
diff --git a/crates/socket-patch-core/src/vendor/pypi_lock.rs b/crates/socket-patch-core/src/vendor/pypi_lock.rs
index 86053e16..cb522160 100644
--- a/crates/socket-patch-core/src/vendor/pypi_lock.rs
+++ b/crates/socket-patch-core/src/vendor/pypi_lock.rs
@@ -37,10 +37,9 @@ pub(super) struct PythonLocks {
 /// FIFO-safe read that FOLLOWS a symlink to a regular file. Discovery
 /// (`python_lock_paths`) follows links too, so a shared `pylock.dev.toml`
 /// link beside a regular `pylock.toml` reads like the file it points at —
-/// an lstat-based "is this a regular file" pre-check here rejected the
-/// link, and because `contains_target`/`load_python_locks` bubble the FIRST
-/// unreadable sibling, one stray link blocked vendoring of the whole
-/// project. Whether a linked file may be WRITTEN is a separate question,
+/// `contains_target`/`load_python_locks` bubble the FIRST unreadable
+/// sibling, so rejecting links here would let one stray link block
+/// vendoring of the whole project. Whether a linked file may be WRITTEN is a separate question,
 /// answered by [`refuse_symlinked`] right before the writers run.
 async fn read_file(path: &Path) -> Result<String, Failure> {
     read_regular_to_string(path).await.map_err(|error| {
@@ -75,9 +74,9 @@ async fn refuse_symlinked(root: &Path, files: impl Iterator<Item = &String>) ->
         .map(symlink_refusal)
 }
 
-/// The run's PEP 751 / script-lock parses. Both readers below re-read AND
-/// re-parsed every one of the project's locks for every patched package;
-/// the lock set is small but the documents are not. Four slots so a project
+/// The run's PEP 751 / script-lock parses. Both readers below would
+/// otherwise re-read and re-parse every one of the project's locks for every
+/// patched package; the lock set is small but the documents are not. Four slots so a project
 /// with a handful of locks does not evict its own parses between packages;
 /// see [`ParseMemo`].
 ///
@@ -889,14 +888,11 @@ mod tests {
     }
 
     /// A stray `pylock.dev.toml` SYMLINK (pointing at a lock that does not
-    /// contain the target) beside a REGULAR `pylock.toml` that does. On main
-    /// the symlink was invisible (`python_lock_paths` skipped links); since
-    /// discovery started following links, `read_file`'s
-    /// `symlink_metadata().is_file()` pre-check rejected it with
-    /// `pypi_lock_read_failed`, and because `contains_target` /
-    /// `load_python_locks` bubble the FIRST unreadable sibling, the stray link
-    /// blocked vendoring of the whole project. A link to a regular file must
-    /// read like the file (`open_regular_file`'s fstat already accepts it).
+    /// contain the target) beside a REGULAR `pylock.toml` that does.
+    /// Discovery follows links, and `contains_target` / `load_python_locks`
+    /// bubble the FIRST unreadable sibling, so a link to a regular file must
+    /// read like the file (`open_regular_file`'s fstat accepts it) or the
+    /// stray link would block vendoring of the whole project.
     #[cfg(unix)]
     #[tokio::test]
     async fn stray_sibling_symlink_does_not_block_regular_pylock() {
@@ -1232,7 +1228,7 @@ mod tests {
         assert_eq!(restored, original);
     }
 
-    /// KNOWN LIMITATION (documented, not fixed here): two TRANSITIVE deps
+    /// KNOWN LIMITATION: two TRANSITIVE deps
     /// vendored into one PEP 723 script share the `[tool.uv]
     /// override-dependencies` ARRAY. Reverting the OLDER one first (`one`,
     /// while `two`'s override is still live) cannot be expressed by
diff --git a/crates/socket-patch-core/src/vendor/pypi_pdm.rs b/crates/socket-patch-core/src/vendor/pypi_pdm.rs
index 3668c6df..bdb6ce4c 100644
--- a/crates/socket-patch-core/src/vendor/pypi_pdm.rs
+++ b/crates/socket-patch-core/src/vendor/pypi_pdm.rs
@@ -407,15 +407,10 @@ pub async fn wire_pdm(
         PdmTarget::Fresh => {}
     }
 
-    // A `pdm add <other>` / partial relock drops our vendored `path` but reuses
-    // the stale `files` entry that still carries the patched wheel sha256 (PDM
-    // 2.8–2.15, lock_version 4.3/4.4/4.4.1). Sourceless + hashed, that unit
-    // reads as `Fresh`; rewriting it here would ALSO record it as the pre-vendor
-    // `original`, baking our patched hash into the ledger as the "registry"
-    // state — a later rollback would then restore an uninstallable lock and the
-    // true registry original would be lost. Refuse with the repair path (a full
-    // `pdm lock` re-resolves the registry hashes) so the ledger's real original
-    // survives untouched.
+    // A partial relock left our patched hash on a sourceless unit (see
+    // [`target_carries_patched_wheel_hash`]): refuse with the repair path (a
+    // full `pdm lock` re-resolves the registry hashes) so the ledger's real
+    // original survives untouched.
     if target_carries_patched_wheel_hash(&p.lock, canon_name, known_patched_sha256) {
         return Err((
             "pypi_pdm_source_already_exists",
@@ -499,8 +494,6 @@ pub async fn revert_pdm(entry: &VendorEntry, root: &Path, dry_run: bool) -> Reve
     revert_lock_fragment_splice(entry, root, dry_run, LOCK_FILE, KIND_LOCK_PACKAGE, "pdm").await
 }
 
-// ── helpers ──────────────────────────────────────────────────────────────
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -510,20 +503,19 @@ mod tests {
     const REL_WHEEL: &str =
         ".socket/vendor/pypi/9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f/six-1.16.0-py2.py3-none-any.whl";
     const WHEEL_NAME: &str = "six-1.16.0-py2.py3-none-any.whl";
-    /// sha256 of the spike's patched wheel (spikes/pdm fixtures, D1).
+    /// sha256 of the spike's patched wheel (D1).
     const WHEEL_SHA: &str = "7015f5a42a0f83fd1b7d3ca0ba10d8777a207c19b6ffebb39e2e1c03af6a281b";
 
     // ── fixture constants ──────────────────────────────────────────────
-    // Byte-exact copies of the spikes/pdm/ fixtures (pdm 2.27.0, lock_version
-    // 4.5.0; spike date 2026-06-10). The registry locks are tool-generated
+    // Captured byte-exact from an out-of-tree pdm spike (pdm 2.27.0,
+    // lock_version 4.5.0; 2026-06-10). The registry locks are tool-generated
     // (`pdm lock`); the vendored expectations carry the D1 path-unit verbatim
-    // from the tool-generated `after/` locks with the BEFORE lock's
+    // from the tool-generated after-locks with the BEFORE lock's
     // content_hash — the lock-only splice leaves content_hash untouched
-    // (spike D2). If these drift from the committed fixtures, the spike dirs
-    // are the source of truth.
+    // (spike D2). These inline copies are the pinned source of truth.
 
-    /// spikes/pdm/direct-path-wheel/before/pdm.lock (verbatim — identical to
-    /// direct-registry/after/pdm.lock).
+    /// The spike's direct-path-wheel before-lock (verbatim — identical to the
+    /// direct-registry after-lock).
     const LOCK_DIRECT_REGISTRY: &str = r#"# This file is @generated by PDM.
 # It is not intended for manual editing.
 
@@ -549,7 +541,7 @@ files = [
 "#;
 
     /// Expected splice output: the six [[package]] unit verbatim from
-    /// spikes/pdm/direct-path-wheel/after/pdm.lock (the D1 shape), with the
+    /// the spike's direct-path-wheel after-lock (the D1 shape), with the
     /// before lock's [metadata]/content_hash (untouched by the splice, D2).
     const LOCK_DIRECT_VENDORED: &str = r#"# This file is @generated by PDM.
 # It is not intended for manual editing.
@@ -574,7 +566,7 @@ path = "./.socket/vendor/pypi/9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f/six-1.16.0-py
 "#;
 
     /// The transitive "before": [metadata] + python-dateutil unit verbatim
-    /// from spikes/pdm/transitive-path/before/pdm.lock, with the six unit
+    /// from the spike's transitive-path before-lock, with the six unit
     /// verbatim from direct-registry — the registry resolution pdm produced
     /// when 1.16.0 was current (the production case: the lock resolves the
     /// version being patched; today's resolver picks 1.17.0, spike D3).
@@ -617,7 +609,7 @@ files = [
 "#;
 
     /// Expected transitive splice output: the six unit verbatim from
-    /// spikes/pdm/transitive-path/after/pdm.lock (identical D1 shape), with
+    /// the spike's transitive-path after-lock (identical D1 shape), with
     /// the before lock's content_hash.
     const LOCK_TRANSITIVE_VENDORED: &str = r#"# This file is @generated by PDM.
 # It is not intended for manual editing.
@@ -995,7 +987,7 @@ distribution = false
     /// Partial relock after a service ↔ local source flip: the stale unit
     /// carries the PRIOR (ledger) sha, not this run's. The guard matches any
     /// known patched sha, so it still refuses — and without the prior sha
-    /// it would have wired over it (the pre-fix, source-dependent hole).
+    /// it would wire over it.
     #[tokio::test]
     async fn partial_relock_guard_matches_any_known_patched_sha() {
         let prior_sha = "c".repeat(64);
@@ -1228,9 +1220,8 @@ distribution = false
     }
 
     /// The lock file is user-owned: wiring the splice must not reset its
-    /// permission bits (the `package_json/update.rs` mode-reset bug, same
-    /// class — see `atomic_write_bytes_preserving_mode`; the revert leg is
-    /// covered in common.rs).
+    /// permission bits (see `atomic_write_bytes_preserving_mode`; the revert
+    /// leg is covered in common.rs).
     #[cfg(unix)]
     #[tokio::test]
     async fn wire_preserves_lock_file_mode() {
diff --git a/crates/socket-patch-core/src/vendor/pypi_pipenv.rs b/crates/socket-patch-core/src/vendor/pypi_pipenv.rs
index 85a00255..ff55fb6a 100644
--- a/crates/socket-patch-core/src/vendor/pypi_pipenv.rs
+++ b/crates/socket-patch-core/src/vendor/pypi_pipenv.rs
@@ -50,17 +50,18 @@ pub(super) struct PipenvProject {
     /// wired lock and the reverted lock stay byte-comparable to the original.
     pub crlf: bool,
     /// Non-fatal advisories raised during load. ALWAYS contains the
-    /// `vendor_integrity_unverified` warning (spike V4: pipenv never enforces
-    /// hashes on file-ref entries) — the orchestrator must surface these.
+    /// `vendor_integrity_unverified` warning (Pipenv does not consistently
+    /// enforce file-ref hashes: 2018–2022 verify the `hashes` list, 2023+ do
+    /// not) — the orchestrator must surface these.
     pub warnings: Vec<VendorWarning>,
 }
 
 /// The run's Pipfile.lock parse. `load_pipenv_project` runs once per patched
-/// package and re-parsed the whole lock each time; an idempotent re-run
+/// package and would re-parse the whole lock each time; an idempotent re-run
 /// parses bytes nothing has changed. Not re-seeded after a write: the wire
 /// step re-serializes with the lock's own line endings restored, so the
 /// document in hand is not the one those bytes parse to — the next package
-/// pays one parse, as before. See [`ParseMemo`].
+/// pays one parse. See [`ParseMemo`].
 static LOCK_MEMO: ParseMemo<Value> = ParseMemo::new();
 
 /// What the target entries already look like.
@@ -136,8 +137,9 @@ pub(super) async fn load_pipenv_project(
         }
     }
 
-    // ALWAYS pushed (spike V4 refuted hash enforcement): the recorded hash is
-    // self-documentation, not a pipenv-enforced check.
+    // ALWAYS pushed (Pipenv does not consistently enforce file-ref hashes:
+    // 2018–2022 verify the `hashes` list, 2023+ do not): the recorded hash is
+    // self-documentation, not a guaranteed check.
     let warnings = vec![VendorWarning::new(
         "vendor_integrity_unverified",
         "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries \
@@ -154,8 +156,8 @@ pub(super) async fn load_pipenv_project(
 }
 
 /// Target-specific guards (also re-run by [`wire_pipenv`] right before
-/// writing). Entries match by PEP 503 canonical NAME in `default` and
-/// custom categories. Registry pins and existing vendored wheel identities
+/// writing). Entries match by PEP 503 canonical NAME in every package
+/// category. Registry pins and existing vendored wheel identities
 /// must both match the selected patch version.
 pub(super) fn check_target_guards(
     p: &PipenvProject,
@@ -273,12 +275,13 @@ pub(super) fn check_target_guards(
     })
 }
 
-/// Wire Pipfile.lock for the vendored wheel: replace every matching
-/// `default`/`develop` entry with the V1/V2-captured file-ref shape (the new
-/// document is fully computed, then committed atomically with the pinned
-/// pipenv serialization). `rel_wheel` is the project-relative wheel path
-/// (`.socket/vendor/pypi/<uuid>/<wheel>`, no `./` prefix — the fixture's
-/// `./` spelling is applied here).
+/// Wire Pipfile.lock for the vendored wheel: replace every matching entry
+/// in every package category (all keys but `_meta`) with the spike-captured
+/// file-ref shape (`path` instead of `file` when the entry carries extras;
+/// the new document is fully computed, then committed atomically with the
+/// pinned pipenv serialization). `rel_wheel` is the project-relative wheel
+/// path (`.socket/vendor/pypi/<uuid>/<wheel>`, no `./` prefix — the
+/// fixture's `./` spelling is applied here).
 pub(super) async fn wire_pipenv(
     p: &PipenvProject,
     root: &Path,
@@ -320,9 +323,9 @@ pub(super) async fn wire_pipenv(
             .collect();
         for key in keys {
             let old = map.get(&key).cloned().unwrap_or(Value::Null);
-            // The V1/V2 entry shape: file + OUR hash; markers preserved
+            // The file-ref entry shape: file + OUR hash; markers preserved
             // verbatim; index/version dropped (transitive entries never had
-            // an index key — V3).
+            // an index key).
             let mut new_entry = Map::new();
             // Pipenv 2022 misparses local file URLs carrying extras.
             let source_key = if old
@@ -469,8 +472,9 @@ pub(super) async fn revert_pipenv(
             ));
             continue;
         }
-        // SECURITY: the section component is also untrusted — only the two
-        // known section names are ever dereferenced.
+        // SECURITY: the section component is also untrusted — `_meta` and
+        // empty names are refused, and only an existing object-valued
+        // category of the live lock is ever dereferenced.
         let Some((section, name)) = rec.key.as_deref().and_then(|k| k.split_once(':')) else {
             warnings.push(drifted());
             continue;
@@ -605,10 +609,6 @@ fn find_entries<'a>(lock: &'a Value, canon_name: &str) -> Vec<(&'a str, String,
     out
 }
 
-/// pipenv's exact serialization (spike V7): 4-space indent, ALL keys sorted
-/// at every nesting level, default separators, one trailing newline —
-/// byte-identical to `json.dumps(obj, indent=4, sort_keys=True) + "\n"` for
-/// the ASCII content pipenv locks carry.
 /// A hosted Socket patch reference as `scan --mode hosted` writes it:
 /// `https://<host>/patch/pypi/<name>/<version>/<grant>/<uuid>/<wheel>[#sha256=…]`.
 fn is_socket_hosted_reference(value: &str) -> bool {
@@ -630,6 +630,10 @@ fn with_line_ending(text: String, crlf: bool) -> String {
     }
 }
 
+/// pipenv's exact serialization (spike-verified): 4-space indent, ALL keys
+/// sorted at every nesting level, default separators, one trailing newline —
+/// byte-identical to `json.dumps(obj, indent=4, sort_keys=True) + "\n"` for
+/// the ASCII content pipenv locks carry.
 fn to_canonical_json(value: &Value) -> String {
     fn sorted(value: &Value) -> Value {
         match value {
@@ -659,18 +663,17 @@ mod tests {
     const UUID: &str = "9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f";
     const REL_WHEEL: &str =
         ".socket/vendor/pypi/9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f/six-1.16.0-py2.py3-none-any.whl";
-    /// sha256 of the spike's patched wheel (spikes/pipenv/artifacts/SHA256SUMS).
+    /// sha256 of the spike's patched wheel.
     const WHEEL_SHA: &str = "573ecfcc2c1f54aeb4e3d6198d58069a3a3258a5a2b18906aae2761a4b2568a0";
 
     // ── fixture constants ──────────────────────────────────────────────
-    // Byte-exact copies of the spikes/pipenv/ fixtures (pipenv 2026.6.2,
-    // pipfile-spec 6; spike date 2026-06-10). The registry locks are
-    // tool-generated (`pipenv lock`); the vendored locks are the
-    // `.lock-only-edit` splices that pass sync / --deploy / verify
-    // byte-stably (V2/V3). If these drift from the committed fixtures, the
-    // spike dirs are the source of truth.
-
-    /// spikes/pipenv/direct-registry/Pipfile.lock (verbatim).
+    // Byte-exact copies of pipenv-generated output (pipenv 2026.6.2,
+    // pipfile-spec 6; captured 2026-06-10 during the phase-0 spike, not
+    // committed). The registry locks are tool-generated (`pipenv lock`); the
+    // vendored locks are the `.lock-only-edit` splices that pass sync /
+    // --deploy / verify byte-stably. These constants are the source of truth.
+
+    /// The spike's direct-registry Pipfile.lock (verbatim).
     const LOCK_DIRECT_REGISTRY: &str = r#"{
     "_meta": {
         "hash": {
@@ -703,8 +706,8 @@ mod tests {
 }
 "#;
 
-    /// spikes/pipenv/direct-file/Pipfile.lock.lock-only-edit (verbatim —
-    /// the V2 splice: file + patched hash, index/version dropped, markers
+    /// The spike's direct-file Pipfile.lock.lock-only-edit (verbatim —
+    /// the splice: file + patched hash, index/version dropped, markers
     /// kept, _meta untouched).
     const LOCK_DIRECT_VENDORED: &str = r#"{
     "_meta": {
@@ -736,7 +739,7 @@ mod tests {
 }
 "#;
 
-    /// spikes/pipenv/transitive-registry/Pipfile.lock (verbatim — six is
+    /// The spike's transitive-registry Pipfile.lock (verbatim — six is
     /// FLAT in default at the resolver's 1.17.0, no index key).
     const LOCK_TRANSITIVE_REGISTRY: &str = r#"{
     "_meta": {
@@ -778,8 +781,8 @@ mod tests {
 }
 "#;
 
-    /// spikes/pipenv/transitive-file/Pipfile.lock.lock-only-edit (verbatim —
-    /// the V3 splice; note the silent 1.17.0 → 1.16.0 pin-down, which pipenv
+    /// The spike's transitive-file Pipfile.lock.lock-only-edit (verbatim —
+    /// note the silent 1.17.0 → 1.16.0 pin-down, which pipenv
     /// accepts: install is per-entry with no cross-check).
     const LOCK_TRANSITIVE_VENDORED: &str = r#"{
     "_meta": {
@@ -867,7 +870,7 @@ mod tests {
     }
 
     /// The load-bearing oracle: wiring the registry lock must produce the
-    /// `.lock-only-edit` fixture BYTE-IDENTICALLY (direct V2 + transitive V3,
+    /// `.lock-only-edit` fixture BYTE-IDENTICALLY (direct + transitive,
     /// which includes the version pin-down replacement), `_meta` untouched.
     #[tokio::test]
     async fn wiring_matches_fixtures_byte_identically() {
@@ -946,8 +949,9 @@ mod tests {
         assert_eq!(read_lock(tmp.path()).await, before_text);
     }
 
-    /// Spike V4 (REFUTED): pipenv never enforces file-ref hashes, so EVERY
-    /// load carries the integrity warning for the orchestrator to surface.
+    /// Pipenv does not consistently enforce file-ref hashes (2018–2022
+    /// verify the `hashes` list, 2023+ do not), so EVERY load carries the
+    /// integrity warning for the orchestrator to surface.
     #[tokio::test]
     async fn integrity_unverified_warning_always_present() {
         let tmp = write_lock(LOCK_DIRECT_REGISTRY).await;
@@ -967,7 +971,7 @@ mod tests {
         assert_eq!(p.warnings[0].code, "vendor_integrity_unverified");
     }
 
-    /// Spike V7: our serializer reproduces pipenv's own
+    /// Our serializer reproduces pipenv's own
     /// `json.dumps(indent=4, sort_keys=True) + "\n"` byte-for-byte, so a
     /// parse → serialize round trip of a pipenv-written lock is the identity.
     #[test]
@@ -1317,7 +1321,7 @@ mod tests {
     }
 
     /// A third-party edit to the entry we wrote (e.g. `pipenv lock`
-    /// regenerated it — spike V6) is left alone with a drift warning;
+    /// regenerated it) is left alone with a drift warning;
     /// unknown wiring kinds from a newer ledger degrade the same way.
     #[tokio::test]
     async fn revert_warns_and_skips_on_drifted_entry_and_unknown_kind() {
diff --git a/crates/socket-patch-core/src/vendor/pypi_poetry.rs b/crates/socket-patch-core/src/vendor/pypi_poetry.rs
index ff0e09bc..ede0f1a2 100644
--- a/crates/socket-patch-core/src/vendor/pypi_poetry.rs
+++ b/crates/socket-patch-core/src/vendor/pypi_poetry.rs
@@ -445,10 +445,11 @@ fn rewrite_target_package_unit(
         })?;
     let unit = package_unit_lines(&lock_text[span]);
     let old_unit = unit.join("\n");
-    // The unit's lines were re-derived via `str::lines()`, which strips `\r`
-    // — on a CRLF lock (git autocrlf checkout) the joined fragment can never
-    // byte-match the file and the caller's replacen splice would silently
-    // no-op while still recording a rewrite. Fail closed instead.
+    // Defensive backstop: CRLF locks are routed to the line-ending-preserving
+    // `poetry_lock` rewriter before this point, so a fragment that cannot
+    // byte-match the file here is an unexpected shape. The caller's replacen
+    // splice would silently no-op while still recording a rewrite, so fail
+    // closed instead.
     if !lock_text.contains(&old_unit) {
         return Err((
             "pypi_poetry_lock_parse_failed",
@@ -483,18 +484,17 @@ mod tests {
     const REL_WHEEL: &str =
         ".socket/vendor/pypi/9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f/six-1.16.0-py2.py3-none-any.whl";
     const WHEEL_NAME: &str = "six-1.16.0-py2.py3-none-any.whl";
-    /// sha256 of the spike's patched wheel (spikes/poetry/wheels/patched/).
+    /// sha256 of the spike's patched wheel (wheels/patched/).
     const WHEEL_SHA: &str = "0bf540048d557577b88d92443652cc4c4cbfd291c8c53f00c7bcac3a213f14d1";
 
     // ── fixture constants ──────────────────────────────────────────────
-    // Byte-exact copies of the spikes/poetry/ fixtures (Poetry 2.4.1 for
-    // lock 2.1, Poetry 1.8.5 for lock 2.0; spike date 2026-06-10). The
-    // registry locks are tool-generated (`poetry lock`); the vendored locks
-    // are the evidence-lockonly/ splices both majors install byte-stably.
-    // If these drift from the committed fixtures, the spike dirs are the
-    // source of truth.
-
-    /// spikes/poetry/lock-2.1/direct-registry/pyproject.toml (verbatim).
+    // Byte-exact copies of the Poetry spike fixtures (Poetry 2.4.1 for
+    // lock 2.1, Poetry 1.8.5 for lock 2.0; the spike tree is not checked in
+    // — the paths below are relative to it). The registry locks are
+    // tool-generated (`poetry lock`); the vendored locks are the
+    // evidence-lockonly/ splices both majors install byte-stably.
+
+    /// lock-2.1/direct-registry/pyproject.toml (verbatim).
     const PYPROJECT_DIRECT: &str = r#"[tool.poetry]
 name = "scratch"
 version = "0.1.0"
@@ -507,7 +507,7 @@ python = ">=3.9"
 six = "1.16.0"
 "#;
 
-    /// spikes/poetry/lock-2.1/transitive-registry/pyproject.toml (verbatim).
+    /// lock-2.1/transitive-registry/pyproject.toml (verbatim).
     const PYPROJECT_TRANSITIVE: &str = r#"[tool.poetry]
 name = "scratch"
 version = "0.1.0"
@@ -520,7 +520,7 @@ python = ">=3.9"
 python-dateutil = "2.8.2"
 "#;
 
-    /// spikes/poetry/lock-2.1/direct-registry/poetry.lock (verbatim).
+    /// lock-2.1/direct-registry/poetry.lock (verbatim).
     const LOCK21_DIRECT_REGISTRY: &str = r#"# This file is automatically @generated by Poetry 2.4.1 and should not be changed by hand.
 
 [[package]]
@@ -541,7 +541,7 @@ python-versions = ">=3.9"
 content-hash = "4b42a89b7ff7b26511b06acdc458dbd85312e5083db8f212b017482bc68cdd01"
 "#;
 
-    /// spikes/poetry/evidence-lockonly/lock-2.1-direct/poetry.lock (verbatim
+    /// evidence-lockonly/lock-2.1-direct/poetry.lock (verbatim
     /// — the spliced state both majors install byte-stably, spike P2).
     const LOCK21_DIRECT_VENDORED: &str = r#"# This file is automatically @generated by Poetry 2.4.1 and should not be changed by hand.
 
@@ -567,7 +567,7 @@ content-hash = "4b42a89b7ff7b26511b06acdc458dbd85312e5083db8f212b017482bc68cdd01
 "#;
 
     /// The transitive "before": dateutil unit + [metadata] verbatim from
-    /// spikes/poetry/lock-2.1/transitive-registry/poetry.lock, with the six
+    /// lock-2.1/transitive-registry/poetry.lock, with the six
     /// unit verbatim from lock-2.1/direct-registry — the registry resolution
     /// poetry produced when 1.16.0 was current (the production case: the lock
     /// resolves the version being patched; today's resolver picks 1.17.0,
@@ -607,7 +607,7 @@ python-versions = ">=3.9"
 content-hash = "09f98227642bff952b3df8f8fcc74f1538c091a3ac3ed0031500188347ecb3ca"
 "#;
 
-    /// spikes/poetry/evidence-lockonly/lock-2.1-transitive/poetry.lock
+    /// evidence-lockonly/lock-2.1-transitive/poetry.lock
     /// (verbatim — the transitive splice, spike P3).
     const LOCK21_TRANSITIVE_VENDORED: &str = r#"# This file is automatically @generated by Poetry 2.4.1 and should not be changed by hand.
 
@@ -647,7 +647,7 @@ python-versions = ">=3.9"
 content-hash = "09f98227642bff952b3df8f8fcc74f1538c091a3ac3ed0031500188347ecb3ca"
 "#;
 
-    /// spikes/poetry/lock-2.0/direct-registry/poetry.lock (verbatim — Poetry
+    /// lock-2.0/direct-registry/poetry.lock (verbatim — Poetry
     /// 1.8.5; lock 2.0 has NO groups key).
     const LOCK20_DIRECT_REGISTRY: &str = r#"# This file is automatically @generated by Poetry 1.8.5 and should not be changed by hand.
 
@@ -668,7 +668,7 @@ python-versions = ">=3.9"
 content-hash = "4b42a89b7ff7b26511b06acdc458dbd85312e5083db8f212b017482bc68cdd01"
 "#;
 
-    /// spikes/poetry/evidence-lockonly/lock-2.0-direct/poetry.lock (verbatim).
+    /// evidence-lockonly/lock-2.0-direct/poetry.lock (verbatim).
     const LOCK20_DIRECT_VENDORED: &str = r#"# This file is automatically @generated by Poetry 1.8.5 and should not be changed by hand.
 
 [[package]]
@@ -727,7 +727,7 @@ python-versions = ">=3.9"
 content-hash = "09f98227642bff952b3df8f8fcc74f1538c091a3ac3ed0031500188347ecb3ca"
 "#;
 
-    /// spikes/poetry/evidence-lockonly/lock-2.0-transitive/poetry.lock
+    /// evidence-lockonly/lock-2.0-transitive/poetry.lock
     /// (verbatim).
     const LOCK20_TRANSITIVE_VENDORED: &str = r#"# This file is automatically @generated by Poetry 1.8.5 and should not be changed by hand.
 
diff --git a/crates/socket-patch-core/src/vendor/pypi_requirements.rs b/crates/socket-patch-core/src/vendor/pypi_requirements.rs
index bd920202..942e6c67 100644
--- a/crates/socket-patch-core/src/vendor/pypi_requirements.rs
+++ b/crates/socket-patch-core/src/vendor/pypi_requirements.rs
@@ -535,8 +535,8 @@ async fn plan_requirements(
 
     if !rewrote_any {
         // Transitive: append a managed line at the ROOT file's EOF. pip
-        // treats it as one more requirement; the resolver folds it into the
-        // graph exactly like the spike's mixed-requirements run.
+        // treats it as one more requirement and the resolver folds it into
+        // the graph.
         let root_file = files
             .first()
             .expect("collect_requirements_files always yields the root file first");
@@ -1321,12 +1321,11 @@ mod tests {
 
     // ── revert edge cases ────────────────────────────────────────────────
 
-    /// SECURITY regression: a poisoned state.json wiring record naming a
+    /// SECURITY: a poisoned state.json wiring record naming a
     /// `..`/absolute `file` must never make `--revert` read or rewrite a file
     /// outside the project root — the record is skipped with a warning and
-    /// the out-of-tree target stays byte-identical. (Found by adversarial
-    /// review: revert previously joined `rec.file` unvalidated, an arbitrary
-    /// content-injection write.)
+    /// the out-of-tree target stays byte-identical (joining `rec.file`
+    /// unvalidated would be an arbitrary content-injection write).
     #[tokio::test]
     async fn revert_refuses_unsafe_wiring_file_paths() {
         let outer = tempfile::tempdir().unwrap();
diff --git a/crates/socket-patch-core/src/vendor/pypi_uv.rs b/crates/socket-patch-core/src/vendor/pypi_uv.rs
index fdc1ddf3..b60b927c 100644
--- a/crates/socket-patch-core/src/vendor/pypi_uv.rs
+++ b/crates/socket-patch-core/src/vendor/pypi_uv.rs
@@ -1,20 +1,21 @@
 //! uv-project wiring: paired `pyproject.toml` + `uv.lock` surgery.
 //!
-//! The pairing is load-bearing (spike claims 7/9): a `[tool.uv.sources]`
+//! The pairing is load-bearing (spike-verified): a `[tool.uv.sources]`
 //! entry for a package uv doesn't consider declared is SILENTLY ignored, and
 //! a path-source lock without the pyproject entry is silently rewritten back
 //! to the registry by a plain `uv sync`. So vendor always writes BOTH — the
 //! pyproject sources entry (plus, for transitive deps, a
-//! `[tool.uv] override-dependencies` pin, which sources DO apply to — claim
-//! 8 — but only on uv >= 0.5.6: 0.2.35–0.5.3 ignore sources for overrides
+//! `[tool.uv] override-dependencies` pin, which sources DO apply to — but
+//! only on uv >= 0.5.6: 0.2.35–0.5.3 ignore sources for overrides
 //! and a plain `uv sync` there reinstalls the registry wheel, hence the
 //! `pypi_uv_override_requires_uv_0_5_6` advisory on that branch) and the
 //! lock's `[[package]]` / `requires-dist` / `[manifest]` fragments.
 //!
 //! All lock edits are targeted text surgery rather than a TOML re-serialize:
 //! the spike proved a surgical edit reproduces uv's own serializer output
-//! byte-identically (claim 2), which keeps `uv lock --check` green and the
-//! committed diff minimal. The `spikes/uv/` fixtures pin the exact shapes.
+//! byte-identically, which keeps `uv lock --check` green and the committed
+//! diff minimal. The inline fixture constants in this module's tests
+//! (captured from real uv output) pin the exact shapes.
 
 use std::ops::Range;
 use std::path::Path;
@@ -43,7 +44,7 @@ use super::toml_surgery::{
 };
 use super::{RevertOutcome, VendorWarning};
 
-/// Highest uv.lock `revision` the spike fixtures were generated with. A newer
+/// Highest uv.lock `revision` the test fixtures were generated with. A newer
 /// revision is a warning, not a refusal: the shapes we rewrite have been
 /// stable across revisions and `uv lock --check` will catch a real mismatch.
 const HIGHEST_TESTED_LOCK_REVISION: u64 = 3;
@@ -70,7 +71,7 @@ enum UvDepClass {
 /// the lock rewrite is text surgery, so there is no mutated document to
 /// hand back, and the pyproject's emitted text may have had its CRLF line
 /// endings restored — the document those bytes parse to is not the one in
-/// hand. A write simply costs the next package one parse, as before, and
+/// hand. A write simply costs the next package one parse, and
 /// every write path here drops the slot it just made unreachable rather
 /// than leaving a megabyte of document for the next read to evict.
 static PYPROJECT_MEMO: ParseMemo<DocumentMut> = ParseMemo::new();
@@ -451,7 +452,7 @@ pub(super) fn wired_pin(
 /// Wire the pair for the vendored wheel. Writes `pyproject.toml` FIRST, then
 /// `uv.lock`; a failed lock write unwinds the pyproject from the recorded
 /// original so the pair is never left half-wired (either half alone is a
-/// silent no-op or a silent revert — spike claims 7/9). The third element
+/// silent no-op or a silent revert). The third element
 /// carries wiring-time advisories (non-fatal, surfaced with the outcome).
 #[allow(clippy::too_many_arguments)]
 pub(super) async fn wire_uv(
@@ -1704,8 +1705,8 @@ fn render_requires_dist_entry(dep: &MetaDep) -> String {
 /// wheel core METADATA text. Returns the block (no leading/trailing newline)
 /// or `None` when there is nothing to record (no requires-dist AND no
 /// provides-extras) or a `Requires-Dist` line fails to parse — in which case
-/// we emit no block rather than risk malformed TOML (`uv sync` then heals it,
-/// the pre-fix behavior, instead of failing to parse the lock).
+/// we emit no block rather than risk malformed TOML (`uv sync` then heals it
+/// instead of failing to parse the lock).
 pub(super) fn render_package_metadata_block(metadata_text: &str) -> Option<String> {
     let (requires_raw, provides_raw) = parse_core_metadata_fields(metadata_text);
     if requires_raw.is_empty() && provides_raw.is_empty() {
@@ -1762,9 +1763,9 @@ mod tests {
     const WHEEL_SHA: &str = "8abb2f1d86890a2dfb989f9a77cfcfd3e47c2a354b01111771326f8aa26e0254";
 
     // ── fixture constants ──────────────────────────────────────────────
-    // Byte-exact copies of the uv-generated spikes/uv/ fixtures (uv 0.11.19,
-    // 2026-06-09). If these drift from the committed fixtures, the spike
-    // dirs are the source of truth.
+    // Byte-exact copies of uv-generated output (uv 0.11.19, 2026-06-09;
+    // captured during the phase-0 spike, not committed). These constants are
+    // the source of truth.
 
     const DIRECT_REGISTRY_PYPROJECT: &str = r#"[project]
 name = "proj"
@@ -1979,8 +1980,8 @@ wheels = [
     /// The wired-pair pin reader the in-sync rebuild guard falls back to
     /// when the state.json ledger has no entry: the lock's rewritten
     /// `[[package]]` unit yields (wheel path, sha256); a registry-shaped
-    /// lock, or a foreign uuid, yields None (the guard then stays off, as
-    /// before, rather than guessing).
+    /// lock, or a foreign uuid, yields None (the guard then stays off rather
+    /// than guessing).
     #[tokio::test]
     async fn wired_pin_reads_the_wired_pair() {
         let tmp = write_pair(DIRECT_PATH_PYPROJECT, DIRECT_PATH_LOCK).await;
@@ -2050,7 +2051,7 @@ wheels = [
         );
     }
 
-    /// Transitive deps wire via override-dependencies (spike claim 8), never
+    /// Transitive deps wire via override-dependencies, never
     /// promotion — the result must byte-match the override-transitive pair,
     /// including the lock's 1.17.0 → 1.16.0 version pin-down.
     #[tokio::test]
@@ -2275,8 +2276,8 @@ wheels = [
     }
 
     /// A failed lock write must unwind the already-written pyproject — a
-    /// sources entry without the lock pair is exactly the silent-failure
-    /// combo the spike warned about.
+    /// sources entry without the lock pair is a silent failure (uv ignores
+    /// the entry).
     #[tokio::test]
     async fn lock_write_failure_unwinds_pyproject() {
         let tmp = write_pair(DIRECT_REGISTRY_PYPROJECT, DIRECT_REGISTRY_LOCK).await;
@@ -2856,10 +2857,9 @@ wheels = [
         tokio::fs::write(&path, &bytes).await.unwrap();
     }
 
-    /// The core defect: after wiring, the path-sourced package must carry the
-    /// reconstructed `[package.metadata]` block (it was dropped before the
-    /// fix, leaving `uv lock --check` red), and `vendor --revert` must
-    /// byte-restore the original registry lock.
+    /// After wiring, the path-sourced package must carry the reconstructed
+    /// `[package.metadata]` block (without it `uv lock --check` is red), and
+    /// `vendor --revert` must byte-restore the original registry lock.
     #[tokio::test]
     async fn direct_wiring_reconstructs_package_metadata_block_and_reverts() {
         let rel_wheel = format!(".socket/vendor/pypi/{UUID}/{WIDGET_WHEEL_NAME}");
@@ -2929,9 +2929,9 @@ wheels = [
     }
 
     /// A hand-edited `overrides = []` (uv itself omits the key when empty)
-    /// must extend to a well-formed single-element array — the single-line
-    /// branch used to emit `[, { … }]`, a leading comma that stops the whole
-    /// lock from parsing (every later `uv sync` AND our own next load fail).
+    /// must extend to a well-formed single-element array — never `[, { … }]`,
+    /// a leading comma that stops the whole lock from parsing (every later
+    /// `uv sync` AND our own next load fail).
     #[tokio::test]
     async fn override_wiring_extends_an_empty_manifest_overrides_array() {
         let empty_overrides_lock = TRANSITIVE_REGISTRY_LOCK.replace(
@@ -3291,8 +3291,7 @@ wheels = [
     // ── load/wire refusal edges ──────────────────────────────────────────
 
     /// Load-side error tuples for malformed pyproject shapes: an unparseable
-    /// pyproject.toml and a `[project]` with no `name` (only their uv.lock
-    /// twins were covered).
+    /// pyproject.toml and a `[project]` with no `name`.
     #[tokio::test]
     async fn load_refuses_unparseable_or_nameless_pyproject() {
         let tmp = write_pair("not = [broken\n", DIRECT_REGISTRY_LOCK).await;
@@ -3649,7 +3648,7 @@ wheels = [
 
     /// A third-party edit to the REWRITTEN `[manifest] overrides` array must
     /// be left alone with a drift warning — the never-clobber contract for
-    /// this record kind (only the uv_lock_package drift arm was covered).
+    /// this record kind.
     #[tokio::test]
     async fn revert_warns_and_skips_on_drifted_manifest_overrides_array() {
         let one_el = "overrides = [{ name = \"other\", path = \"o.whl\" }]";
@@ -3826,9 +3825,9 @@ wheels = [
 
     /// The pypi drift-keep gate × the convergence carve-out, end to end: a
     /// hand-restored uv pair converges silently, so `revert_pypi` must still
-    /// DELETE the artifact dir (no `kept_artifact`) — before the carve-out
-    /// the gate misread the convergence as drift and kept the uuid dir and
-    /// ledger entry forever with an unsatisfiable remediation.
+    /// DELETE the artifact dir (no `kept_artifact`) — without the carve-out
+    /// the gate would misread the convergence as drift and keep the uuid dir
+    /// and ledger entry forever with an unsatisfiable remediation.
     #[tokio::test]
     async fn revert_pypi_converged_uv_cleans_up_the_artifact() {
         let tmp = write_pair(DIRECT_REGISTRY_PYPROJECT, DIRECT_REGISTRY_LOCK).await;
@@ -4299,8 +4298,8 @@ wheels = [
         assert_eq!(wheel_metadata_text(&bytes).as_deref(), Some(real));
     }
 
-    /// METADATA over the size cap drops the WHOLE extraction (degrade to the
-    /// pre-fix no-block behavior), never a truncated block.
+    /// METADATA over the size cap drops the WHOLE extraction (degrade to no
+    /// block), never a truncated block.
     #[test]
     fn wheel_metadata_text_drops_an_oversized_metadata_file() {
         let entries = vec![(
@@ -4346,7 +4345,7 @@ wheels = [
         );
     }
 
-    // ── coverage mop-up 2026-09: guard/error/skip arms ────────────────────
+    // ── guard/error/skip arms ────────────────────────────────────────────
 
     /// In-memory pair (no tempdir) for the pure-read helpers.
     fn project_from(pyproject: &str, lock: &str) -> UvProject {
@@ -4982,10 +4981,11 @@ six = { path = ".socket/vendor/pypi/9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f/six-1.1
     /// A target declared ONLY in the legacy `[tool.uv] dev-dependencies`
     /// array is a Direct dependency: `[tool.uv.sources]` applies to it and
     /// the lock keeps it in `[package.metadata.requires-dev]`. Classifying
-    /// it Transitive took the override branch and left the requires-dev
-    /// `specifier` in place, so every uv >= 0.2.37 `uv sync --locked` /
-    /// `uv lock --check` failed after a "successful" vendored scan (and a
-    /// plain `uv sync` on 0.2.37/0.4.30 reinstalled the pristine wheel).
+    /// it Transitive would take the override branch and leave the
+    /// requires-dev `specifier` in place, so every uv >= 0.2.37 `uv sync
+    /// --locked` / `uv lock --check` would fail after a "successful" vendored
+    /// scan (and a plain `uv sync` on 0.2.37/0.4.30 would reinstall the
+    /// pristine wheel).
     #[tokio::test]
     async fn tool_uv_dev_dependencies_classify_direct_and_repoint_requires_dev() {
         let tmp = write_pair(TOOL_UV_DEV_REGISTRY_PYPROJECT, DEV_GROUP_REGISTRY_LOCK).await;
@@ -5124,9 +5124,9 @@ wheels = [
 "#;
 
     /// Both requires-dist entries for one package (bare + extra-marker) are
-    /// repointed — one wiring record each — and revert restores both. The
-    /// first-match `break` left the marker entry with its `specifier`, so
-    /// `uv lock --check` / `uv sync --locked` failed after vendoring.
+    /// repointed — one wiring record each — and revert restores both. A
+    /// marker entry left with its `specifier` fails `uv lock --check` /
+    /// `uv sync --locked` after vendoring.
     #[tokio::test]
     async fn duplicate_requires_dist_entries_all_repointed() {
         let tmp = write_pair(EXTRAS_DUP_REGISTRY_PYPROJECT, EXTRAS_DUP_REGISTRY_LOCK).await;
@@ -5352,10 +5352,9 @@ six = { path = ".socket/vendor/pypi/9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f/six-1.1
     }
 
     /// A pure-CRLF pair (git autocrlf on Windows) must wire to a pure-CRLF
-    /// pair and revert byte-exactly. `doc.to_string()` re-emits every
-    /// pyproject newline as LF, the lock surgery joined rebuilt units and
-    /// created `[manifest]` fragments with LF (mixed endings), and revert's
-    /// hardcoded `"{new}\n"` removals then missed. Covers the Direct,
+    /// pair and revert byte-exactly: `doc.to_string()` re-emits every
+    /// pyproject newline as LF, and every lock fragment spliced, created or
+    /// removed must use the file's own terminator. Covers the Direct,
     /// Transitive (created override + created `[manifest]`), Rewritten
     /// override (multi-line arrays in both files) and requires-dev shapes.
     #[tokio::test]
@@ -5461,8 +5460,7 @@ six = { path = ".socket/vendor/pypi/9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f/six-1.1
     /// The `[[distribution]]` refusal names the REAL limitation measured
     /// against the 0.1.45–0.2.34 binaries (relative path sources are
     /// rejected by `--locked` and absolutized by `uv lock` / `uv sync`),
-    /// not the old "records absolute file paths" folklore, and points at
-    /// both exits (uv >= 0.2.35, or a requirements.txt install).
+    /// and points at both exits (uv >= 0.2.35, or a requirements.txt install).
     #[tokio::test]
     async fn legacy_distribution_lock_refusal_names_the_real_limitation() {
         let legacy_lock = "version = 1\nrequires-python = \">=3.9\"\n\n[[distribution]]\nname = \"proj\"\nversion = \"0.1.0\"\nsource = { editable = \".\" }\n";
diff --git a/crates/socket-patch-core/src/vendor/pypi_wheel.rs b/crates/socket-patch-core/src/vendor/pypi_wheel.rs
index f823feb9..927ee006 100644
--- a/crates/socket-patch-core/src/vendor/pypi_wheel.rs
+++ b/crates/socket-patch-core/src/vendor/pypi_wheel.rs
@@ -3,8 +3,8 @@
 //! pypi vendoring cannot reuse a registry artifact: the patch applies to the
 //! *installed* site-packages tree, so the committable `.socket/vendor/pypi/`
 //! artifact must be reconstructed from that tree. The installed
-//! `*.dist-info/RECORD` is the authoritative member list (spike-verified: pip
-//! 26 / uv 0.11 only require RECORD to exist and parse at install time — per
+//! `*.dist-info/RECORD` is the authoritative member list (pip 26 / uv 0.11
+//! only require RECORD to exist and parse at install time — per
 //! file hashes are unchecked — but we regenerate it correctly anyway, because
 //! the RECORD drives uninstall bookkeeping and post-hoc audits). The rebuild
 //! is byte-for-byte deterministic so the emitted `--hash` / uv lock hash pin
@@ -341,7 +341,7 @@ pub async fn build_patched_wheel(
         // row that escapes site-packages (`../../../bin/x`, absolute paths)
         // must never be staged or zipped — only the installer-regenerated
         // console/gui scripts (matched by entry_points.txt NAME, never by
-        // extension heuristics: the spike's splitext shortcut wrongly dropped
+        // extension heuristics, which would wrongly drop
         // `../../../share/man/man6/pycowsay.6`) are silently excluded; any
         // OTHER out-of-tree entry is data the rebuilt wheel cannot carry, so
         // the whole vendor is refused fail-closed.
@@ -385,7 +385,7 @@ pub async fn build_patched_wheel(
     // once and carried straight into the wheel. That holds only while no two
     // names can fold into one another on the staging filesystem (a
     // case-insensitive or Unicode-normalising volume) — for anything else the
-    // whole member set is staged and read back from there, as before.
+    // whole member set is staged and read back from there.
     // `patch_target_paths` is sorted, so the directory pass below — which
     // returns on its first failure — names the same target on every run.
     let target_paths = patch_target_paths(&record.files);
@@ -963,7 +963,7 @@ mod tests {
         assert_eq!(zip_file(&bytes, "six.py"), PATCHED);
     }
 
-    /// X10 equivalence: keeping the installed tree's members in memory must
+    /// Equivalence: keeping the installed tree's members in memory must
     /// rebuild the EXACT wheel bytes the stage-everything build produced —
     /// the emitted `--hash` / uv lock pin rides on them. Driven twice over
     /// one fixture (an exec-bit member, a zero-length member, a nested tree,
@@ -1163,7 +1163,7 @@ mod tests {
     #[tokio::test]
     async fn out_of_tree_data_file_is_refused() {
         // `share/man/...` is a wheel .data payload, NOT a console script —
-        // the spike showed name-stem heuristics must not swallow it.
+        // name-stem heuristics must not swallow it.
         let fx = make_fixture(
             "../../../share/man/man6/six.6,sha256=ee,10\n",
             Some("[console_scripts]\nsix-cmd = six:main\n"),
@@ -1452,7 +1452,8 @@ mod tests {
         assert!(is_console_script_artifact("pycowsay", &names));
         assert!(is_console_script_artifact("pycowsay.exe", &names));
         assert!(is_console_script_artifact("pycowsay-script.py", &names));
-        // The spike's splitext bug: `pycowsay.6` (a man page) must NOT match.
+        // A splitext-style stem heuristic's trap: `pycowsay.6` (a man page)
+        // must NOT match.
         assert!(!is_console_script_artifact("pycowsay.6", &names));
         assert!(!is_console_script_artifact("other", &names));
     }
diff --git a/crates/socket-patch-core/src/vendor/registry_fetch.rs b/crates/socket-patch-core/src/vendor/registry_fetch.rs
index 22b73dde..533ad810 100644
--- a/crates/socket-patch-core/src/vendor/registry_fetch.rs
+++ b/crates/socket-patch-core/src/vendor/registry_fetch.rs
@@ -57,12 +57,11 @@ pub(crate) const MAX_ENTRIES: usize = 60_000;
 /// entry and with the same message. What is deferred is the WRITING — the
 /// committed-artifact reuse, the in-sync hot path and the vendoring service
 /// never read the tree, so an idempotent re-run on a lockfile-only checkout
-/// no longer creates and deletes one.
+/// never creates and deletes one.
 ///
-/// Better still, most of the tree never reaches the tempdir at all: a local
-/// build asks for the vendor stage directly ([`FetchedPackage::stage_into`]),
-/// which the verified bytes write in one pass instead of an extraction and a
-/// whole-tree copy out of it.
+/// A local build asks for the vendor stage directly
+/// ([`FetchedPackage::stage_into`]), which the verified bytes write in one
+/// pass without going through the tempdir.
 ///
 /// The tempdir lives exactly as long as this value — callers must hold it
 /// until the vendor pipeline has finished staging from [`FetchedPackage::dir`].
@@ -77,11 +76,10 @@ pub struct FetchedPackage {
     /// ([`FetchedPackage::stage_into`]).
     ///
     /// Dropped as soon as the tempdir holds the tree: from there on every
-    /// caller copies out of it, so the archive is dead weight and a run
-    /// that materialises its sources holds no more of them than the eager
-    /// fetch did. A source NOTHING reads — the case this deferral exists
-    /// for — keeps its bytes until the holder is dropped, which is the
-    /// trade: the eager fetch spent a whole extracted tree on disk instead.
+    /// caller copies out of it, so the archive is dead weight. A source
+    /// NOTHING reads — the case this deferral exists for — keeps its bytes
+    /// until the holder is dropped instead of a whole extracted tree on
+    /// disk.
     extract: std::sync::Mutex<Option<std::sync::Arc<Extractor>>>,
     /// The tempdir materialisation's outcome, shared by every later caller
     /// so a failure reads the same each time.
@@ -185,16 +183,14 @@ impl FetchedPackage {
     }
 
     /// Write the tree at `dst` instead of the tempdir: the vendor stage the
-    /// local build patches, which a fetched source used to reach by
-    /// extracting into the tempdir and copying the whole tree out of it
-    /// again. `dst` is removed and recreated first, exactly as `fresh_copy`
-    /// does, and `skip_file_name` drops the same entries it dropped.
+    /// local build patches. `dst` is removed and recreated first, exactly as
+    /// `fresh_copy` does, and `skip_file_name` drops the same entries it
+    /// drops.
     pub async fn stage_into(&self, dst: &Path, skip_file_name: Option<&str>) -> Result<(), String> {
         // An earlier branch already wrote the tempdir out (a dry-run
         // preview, or the release-variant probe the vendor loop runs for
         // pypi and gem). Copying it is cheaper than inflating the archive a
-        // second time, and it is what this path did before the fetch went
-        // lazy.
+        // second time.
         if self.extracted.get().is_some_and(Result::is_ok) {
             return crate::patch::copy_tree::fresh_copy(&self.dir, dst, skip_file_name)
                 .await
@@ -457,20 +453,20 @@ struct DestShape {
     /// Two planned entries may land on ONE file, or a name is used as both
     /// a file and a directory. Either way the entries are not independent:
     /// the pool must not spread them and each parent must be created right
-    /// before its own file, which is what the one-pass walk did.
+    /// before its own file, as a sequential in-order extraction does.
     ///
     /// Besides the exact repeats the plan already resolves, two spellings
     /// meet on a case-insensitive volume (`LICENSE` / `license`) or a
     /// normalization-insensitive one (`café` in NFC / NFD). ASCII case is
     /// checked; for anything non-ASCII the walk gives up on deciding and
-    /// takes the one-at-a-time path, which is what it did before.
+    /// takes the one-at-a-time path.
     in_order: bool,
     /// A name is used as both a file and a directory — a refusal the write
     /// walk raises for every such archive, decided by its entries alone.
     file_dir_conflict: bool,
 }
 
-/// What a one-pass walk has put under the destination so far, by the key a
+/// What a sequential walk has put under the destination so far, by the key a
 /// case-insensitive filesystem compares on — enough to answer the one
 /// refusal a write-free pass cannot: a name used as both a file and a
 /// directory ([`DestShape::file_dir_conflict`]), which a sequential archive
@@ -605,12 +601,10 @@ pub(crate) fn validate_zip(
 /// The zip walk, in two passes.
 ///
 /// Pass one reads the central directory alone — no entry is inflated — and
-/// answers everything the one-entry-at-a-time walk decided from headers, in
-/// the same order over the same running total: the traversal guard, the
-/// per-entry and total DECLARED caps, and each entry's destination (with
-/// every parent directory created once, where the old walk re-created them
-/// per entry). It stops at the first refusal, exactly where the single walk
-/// stopped accumulating.
+/// decides everything that comes from headers, in entry order over one
+/// running total: the traversal guard, the per-entry and total DECLARED
+/// caps, and each entry's destination (every parent directory created
+/// once). It stops at the first refusal.
 ///
 /// Pass two inflates the planned entries on a bounded pool of threads, each
 /// with its own reader over the shared bytes. Inflating is the whole cost of
@@ -618,7 +612,7 @@ pub(crate) fn validate_zip(
 /// pass has to serialise is the ANSWER: a repeated name is written by its
 /// last spelling, as an in-order extraction left it, and the refusal
 /// reported is the one at the lowest entry index — which, against pass one's
-/// own index, reproduces the single walk's verdict entry for entry.
+/// own index, reproduces a sequential walk's verdict entry for entry.
 fn walk_zip(
     bytes: &[u8],
     dest: &Path,
@@ -710,8 +704,8 @@ fn plan_zip(
     for i in 0..archive.len() {
         // `by_index`, not the raw reader: an entry the decompressor refuses
         // (an unsupported method, an encrypted member) must be refused HERE,
-        // at the index and with the words the one-pass walk used, rather
-        // than falling through to a later check.
+        // at its index and with the sequential walk's words, rather than
+        // falling through to a later check.
         let file = match archive.by_index(i) {
             Ok(file) => file,
             Err(e) => {
@@ -777,14 +771,13 @@ fn plan_zip(
         return Ok(plan);
     }
 
-    // The destination pass, in entry order — where the one-pass walk did
-    // this work per entry, between its header checks and its inflate.
+    // The destination pass, in entry order.
     let mut out = EntrySink::new(dest, sink).skipping(skip_file_name);
     if plan.in_order {
         // Aliasing destinations: leave the directories to the inflate pass,
         // which creates each one right before its own file, so a name used
-        // as both a file and a directory fails from the syscall it failed
-        // from before, at the entry it failed at.
+        // as both a file and a directory fails from the same syscall at the
+        // same entry as a sequential extraction.
         for entry in &mut plan.entries {
             entry.parent = entry
                 .target
@@ -798,8 +791,8 @@ fn plan_zip(
                 continue;
             };
             if let Err(detail) = out.ensure_parent(&target) {
-                // The one-pass walk stopped here, having written every
-                // entry before this one and nothing after it.
+                // Refuse at this entry: everything before it is written,
+                // nothing after it.
                 let index = plan.entries[at].index;
                 plan.entries.truncate(at);
                 plan.header_refusal = Some((index, detail));
@@ -884,8 +877,8 @@ fn inflate_planned_entries(
             }
         };
         loop {
-            // The verdict is decided; the walk this stands in for had
-            // stopped writing by now, so stop taking work.
+            // The verdict is decided; a sequential walk would have stopped
+            // writing by now, so stop taking work.
             if refused.load(std::sync::atomic::Ordering::Relaxed) {
                 return;
             }
@@ -908,7 +901,7 @@ fn inflate_planned_entries(
         // RLIMIT_NPROC, ENOMEM), and this runs inline on a runtime worker
         // for the fetchers that validate in their async body. Take what the
         // OS gives and let the caller's own thread drain the rest — one
-        // thread is the pre-change walk.
+        // thread is a plain sequential walk.
         for _ in 1..threads {
             if std::thread::Builder::new()
                 .spawn_scoped(scope, worker)
@@ -990,8 +983,8 @@ fn inflate_one<R: std::io::Read + std::io::Seek>(
 
 /// Whether extracting `rel` puts `name` at the root of the destination —
 /// either as the entry itself or as a directory the walk creates for it.
-/// This is exactly what a `metadata(dest.join(name))` probe answered once
-/// the eager extraction had run.
+/// This is exactly what a `metadata(dest.join(name))` probe would answer
+/// after a full extraction.
 fn lands_at_root(rel: &Path, name: &str) -> bool {
     // A leading `./` survives `Path::components` but not `dest.join(rel)`,
     // which is what the probe this replaces ran against.
@@ -1072,13 +1065,10 @@ async fn fetch_gem(
     }))
 }
 
-/// Pure-python wheels recorded by uv.lock (URL + sha256): the unzipped
-/// wheel IS a site-packages layout (package dirs + `.dist-info/RECORD` at
-/// the root), which is exactly the shape the pypi vendor backend stages
-/// from.
 /// PyPI's JSON API base; override with `SOCKET_PYPI_JSON_API` (tests point it
 /// at a mock). Used only to turn a lock's file hash into a download URL for
-/// locks that record hashes without URLs (poetry.lock).
+/// locks that record hashes without URLs (poetry.lock, which records one wheel
+/// hash, and Pipfile.lock, which records every release file's hash).
 pub const DEFAULT_PYPI_JSON_API: &str = "https://pypi.org/pypi";
 
 fn pypi_json_api_base() -> String {
@@ -1179,6 +1169,10 @@ async fn resolve_pypi_url_by_hash(
         })
 }
 
+/// Pure-python wheels recorded by uv.lock (URL + sha256): the unzipped
+/// wheel IS a site-packages layout (package dirs + `.dist-info/RECORD` at
+/// the root), which is exactly the shape the pypi vendor backend stages
+/// from.
 async fn fetch_pypi(
     entry: &LockfileEntry,
     client: &reqwest::Client,
@@ -1367,18 +1361,14 @@ struct ModuleZipWalk {
 /// The dirhash walk, optionally also answering what the extraction walk
 /// would have said about the same entries.
 ///
-/// The golang registry fetch used to inflate every entry twice: once for
-/// the dirhash, once to write the tree. Both walks read the same deflate
-/// streams and both derive everything they check from the entry's name,
-/// its declared size and how many bytes it actually decompresses to — all
-/// of which this walk already has — so the second inflate bought nothing.
+/// One inflate serves both the dirhash and the extraction checks: both
+/// derive everything from the entry's name, its declared size and how many
+/// bytes it actually decompresses to.
 ///
-/// The ORDER the two walks produced is preserved exactly. The dirhash pass
-/// ran to completion first, so its refusal still wins outright and returns
-/// here; the extraction refusal is recorded at the lowest entry index,
-/// where the second walk would have stopped, and handed back for the caller
-/// to raise only after the dirhash has been compared — which is where the
-/// second walk used to start.
+/// Refusal ORDER matches a dirhash-then-extract sequence: a dirhash refusal
+/// wins outright and returns here; the extraction refusal is recorded at
+/// the lowest entry index and handed back for the caller to raise only
+/// after the dirhash has been compared.
 fn walk_module_zip(bytes: &[u8], validate_prefix: Option<&str>) -> Result<ModuleZipWalk, String> {
     use std::io::Read as _;
     let mut archive = zip::ZipArchive::new(std::io::Cursor::new(bytes))
@@ -1441,8 +1431,8 @@ fn walk_module_zip(bytes: &[u8], validate_prefix: Option<&str>) -> Result<Module
             ));
         }
         // What `extract_zip_with_prefix` would have made of this entry, in
-        // its own order. Only up to the first refusal: past that the walk it
-        // stands in for had already stopped, totals included.
+        // its own order. Only up to the first refusal: past that the
+        // extraction would already have stopped, totals included.
         if let (Some(prefix), None) = (validate_prefix, extract_refusal.as_ref()) {
             extract_refusal =
                 module_entry_refusal(&name, prefix, declared, entry_bytes, &mut declared_total);
@@ -1667,9 +1657,8 @@ async fn fetch_golang(
             walk.h1
         )));
     }
-    // The tempdir is created BEFORE the extraction refusal is raised, where
-    // the second walk created it: a run that cannot make one reports that,
-    // as it did, rather than the refusal.
+    // The tempdir is created BEFORE the extraction refusal is raised: a run
+    // that cannot make one reports that rather than the refusal.
     let tmp = tempfile::tempdir()
         .map_err(|e| FetchError::Failed(format!("cannot create fetch tempdir: {e}")))?;
     let dir = tmp.path().join("module");
@@ -1910,9 +1899,6 @@ async fn download(client: &reqwest::Client, url: &str) -> Result<Vec<u8>, String
     Ok(bytes)
 }
 
-/// Verify downloaded bytes against the lock-recorded verifier. Runs BEFORE
-/// any disk write. Berry cache-zip checksums and go.sum dirhashes have
-/// dedicated verifiers in their ecosystems' fetchers.
 /// Fetch + stage an npm package from its conventional registry URL WITHOUT
 /// content verification. The download/extract caps still apply.
 ///
@@ -1970,6 +1956,9 @@ pub fn artifact_matches_integrity(
     }
 }
 
+/// Verify downloaded bytes against the lock-recorded verifier. Runs BEFORE
+/// any disk write. Berry cache-zip checksums and go.sum dirhashes have
+/// dedicated verifiers in their ecosystems' fetchers.
 fn verify_integrity(bytes: &[u8], integrity: &LockIntegrity) -> Result<(), FetchError> {
     match integrity {
         LockIntegrity::Sri(sri) => verify_sri(bytes, sri).map_err(FetchError::Failed),
@@ -2020,8 +2009,8 @@ fn verify_integrity(bytes: &[u8], integrity: &LockIntegrity) -> Result<(), Fetch
 /// the only integrity npm-era lockfile entries carry (yarn classic writes
 /// `integrity sha1-…` for them), and it is the exact guarantee the package
 /// manager itself enforces for those entries — refusing it would make every
-/// legacy package unvendorable whenever the prebuilt-artifact service misses
-/// (the 2026-07 strapi clean-run regression). The bare-hex twin of this trust
+/// legacy package unvendorable whenever the prebuilt-artifact service misses.
+/// The bare-hex twin of this trust
 /// decision already lives in the `LockIntegrity::Sha1Hex` arm above.
 fn verify_sri(bytes: &[u8], sri: &str) -> Result<(), String> {
     let mut best: Option<(u8, &str, &str)> = None;
@@ -2401,8 +2390,7 @@ mod tests {
         use base64::Engine as _;
         let bytes = b"hello";
         let sha1_b64 = base64::engine::general_purpose::STANDARD.encode(Sha1::digest(bytes));
-        // npm-era lockfile entries carry ONLY `sha1-…` (the strapi clean-run
-        // regression: `no usable hash in SRI`); it must verify…
+        // npm-era lockfile entries carry ONLY `sha1-…`; it must verify…
         assert!(
             verify_sri(bytes, &format!("sha1-{sha1_b64}")).is_ok(),
             "sha1-only SRI must be usable"
@@ -2990,8 +2978,7 @@ mod tests {
         assert!(fetched.dir().await.unwrap().join("README.md").is_file());
         // The staged leaf must be the canonical `{name}-{version}`:
         // vendor_gem's platform-suffix guard refuses any other leaf
-        // (`platform_gem_unsupported`), which killed lockfile auto-fetch
-        // when this dir was named `gem`.
+        // (`platform_gem_unsupported`).
         assert_eq!(
             fetched
                 .dir()
@@ -3286,7 +3273,7 @@ mod tests {
     /// instead of wedging the fresh-clone re-vendor forever in an `open(2)`
     /// waiting for a writer — the caller's metadata probe passes for a FIFO,
     /// so this read is the first open. Same `open_regular_file` guard class
-    /// as the vendor lockfile reads (lock_inventory.rs, npm_lock.rs).
+    /// as the vendor lockfile reads (lock_inventory/, npm_lock.rs).
     #[cfg(unix)]
     #[test]
     fn stage_local_artifact_fifo_fails_fast_instead_of_wedging() {
@@ -4305,8 +4292,7 @@ mod tests {
             // And the golang fetch's fused walk, which answers the same
             // question off the dirhash pass's single inflate.
             match walk_module_zip(&bytes, Some(prefix)) {
-                // The dirhash pass guards the caps too and refuses first —
-                // exactly where the pair of walks did.
+                // The dirhash pass guards the caps too and refuses first.
                 Err(dirhash_refusal) => assert!(
                     dirhash_refusal.contains("cap"),
                     "{label}: {dirhash_refusal}"
@@ -4433,8 +4419,7 @@ mod tests {
     }
 
     /// And on a healthy archive: the pass accepts it, writes nothing, and
-    /// answers the root-file probe the fetchers used to run against the
-    /// extracted tree.
+    /// answers the root-file probe without an extracted tree.
     #[test]
     fn validation_pass_accepts_and_answers_the_root_probe() {
         let tgz = make_tgz(&[
diff --git a/crates/socket-patch-core/src/vendor/reuse.rs b/crates/socket-patch-core/src/vendor/reuse.rs
index 5ba92eaa..539d0bc4 100644
--- a/crates/socket-patch-core/src/vendor/reuse.rs
+++ b/crates/socket-patch-core/src/vendor/reuse.rs
@@ -3,18 +3,18 @@
 //!
 //! The directory-shaped backends (cargo, golang, composer, gem, maven,
 //! nuget) decide "in sync" from the COMMITTED artifact before they ever
-//! consult the patch service. The archive-shaped backends used to acquire
-//! first (service download, else a local deterministic pack) and compare the
-//! lock's digests with those NEW bytes — so a prebuilt ↔ local source flip
-//! between two runs (a service outage, or its recovery) rewrote the lock and
-//! the tarball even though nothing needed vendoring. This module gives them
-//! the same rule: when the ledger vouches for the committed artifact and the
-//! bytes verify, reuse them.
+//! consult the patch service. The archive-shaped backends acquire (service
+//! download, else a local deterministic pack) and compare the lock's digests
+//! with those NEW bytes, so without this a prebuilt ↔ local source flip
+//! between two runs (a service outage, or its recovery) would rewrite the
+//! lock and the tarball even though nothing needed vendoring. This module
+//! gives them the same rule: when the ledger vouches for the committed
+//! artifact and the bytes verify, reuse them.
 //!
 //! Anchor: the vendor ledger entry (`.socket/vendor/state.json`) recorded
 //! the artifact's path + sha256 when it was wired. Reuse requires, fail
 //! closed at every step (any miss falls through to the caller's normal
-//! acquisition, exactly today's behavior):
+//! acquisition):
 //!
 //! 1. a non-empty patch record (nothing to verify ⇒ never reused);
 //! 2. a canonical, uuid-bound artifact path (`checked_artifact_path`) — an
@@ -93,7 +93,7 @@ pub(crate) enum ReuseMiss {
     PlatformLocked,
 }
 
-/// Debug-log a reuse miss (`SOCKET_PATCH_DEBUG`); the caller then acquires.
+/// Debug-log a reuse miss (`SOCKET_DEBUG`); the caller then acquires.
 pub(crate) fn log_miss(purl: &str, miss: &ReuseMiss) {
     if is_debug_enabled() {
         eprintln!("[socket-patch debug] vendor reuse skipped for {purl}: {miss:?}");
@@ -114,7 +114,7 @@ fn norm(path: &str) -> String {
 /// The ledger comes from [`load_state_shared`]: the run asks it once per
 /// npm/pypi package, and on a big monorepo the ledger runs to megabytes,
 /// so re-parsing (or, inside a group commit, deep-cloning) it per package
-/// was the vendored re-run's dominant cost. The shared read still reads
+/// would dominate the vendored re-run. The shared read still reads
 /// the bytes every time and re-parses whenever they changed, answers from
 /// the group commit's captured ledger when there is one, and fails exactly
 /// where [`super::state::load_state`] fails. Only the one matching entry is
@@ -166,7 +166,7 @@ fn select_prior_entry<'a>(
     Ok(first)
 }
 
-/// The pre-SC1 [`prior_entry`], kept as the equivalence oracle: a full
+/// The reloading form of [`prior_entry`], kept as the equivalence oracle: a full
 /// [`super::state::load_state`] per call, entries taken by value.
 #[cfg(test)]
 pub(crate) async fn prior_entry_reloading(
@@ -327,7 +327,7 @@ pub(crate) async fn reusable_committed_artifact(
     verify_committed_artifact(project_root, &entry, record).await
 }
 
-/// DESIGN §4.3 step 2: the committed vlt package dir at `rel_dir`, when
+/// The committed vlt package dir at `rel_dir`, when
 /// the ledger records it for `record.uuid` with an inventory and the tree
 /// still verifies (no link on the path, the structure rule, only links and
 /// `.bin/` scripts under its `node_modules/`, every member and the whole
@@ -664,8 +664,8 @@ mod tests {
     }
 
     /// An UNPATCHED member edited and re-gzipped, with the ledger still
-    /// recording the original sha: the anchor rejects it (today's rebuild
-    /// then heals it).
+    /// recording the original sha: the anchor rejects it (the rebuild then
+    /// heals it).
     #[tokio::test]
     async fn edited_unpatched_member_with_stale_ledger_sha_misses() {
         let (tmp, _) = project(&good_tgz()).await;
@@ -1015,7 +1015,7 @@ mod tests {
         assert!(wheel_reuse(&zip_of(&[("index.js", PATCHED)])).await.is_ok());
     }
 
-    /// SC1: the shared-ledger [`prior_entry`] answers exactly what the
+    /// The shared-ledger [`prior_entry`] answers exactly what the
     /// reloading oracle answers — hits, path filters, twins that agree or
     /// disagree, a missing or corrupt ledger — including after the ledger
     /// changes between two calls (the memo must miss) and inside a group
diff --git a/crates/socket-patch-core/src/vendor/service_fetch.rs b/crates/socket-patch-core/src/vendor/service_fetch.rs
index a5b4d92a..1639aee0 100644
--- a/crates/socket-patch-core/src/vendor/service_fetch.rs
+++ b/crates/socket-patch-core/src/vendor/service_fetch.rs
@@ -453,7 +453,7 @@ mod tests {
         ));
     }
 
-    /// AUDIT B3: IntegrityMismatch is a hard error in EVERY mode — under the
+    /// IntegrityMismatch is a hard error in EVERY mode — under the
     /// default `auto` the Tier-A copy must refuse, never fall back to a local
     /// rebuild on tampered bytes (the enum's own contract: "never fall back").
     #[tokio::test]
@@ -536,8 +536,7 @@ mod tests {
     }
 
     /// The h1-dirhash verify's SUCCESS continuation: a service archive whose
-    /// golang `h1:` dirhash matches its zip contents passes through to Ready
-    /// (only the mismatch side of this gate had ever executed).
+    /// golang `h1:` dirhash matches its zip contents passes through to Ready.
     #[tokio::test]
     async fn ready_when_golang_h1_dirhash_matches() {
         let server = MockServer::start().await;
diff --git a/crates/socket-patch-core/src/vendor/source.rs b/crates/socket-patch-core/src/vendor/source.rs
index 69f6e81e..0821367d 100644
--- a/crates/socket-patch-core/src/vendor/source.rs
+++ b/crates/socket-patch-core/src/vendor/source.rs
@@ -1,16 +1,12 @@
 //! What a vendor backend stages the pristine package from.
 //!
-//! A backend used to be handed a directory that always existed: the
-//! crawler's installed location, or the tree the pristine-source ladder had
-//! already extracted into a private tempdir. Most runs never read it — the
-//! committed-artifact reuse, the in-sync hot path and the vendoring service
-//! all answer from bytes the project already has — so on a lockfile-only
-//! checkout the ladder wrote a whole package tree per purl and deleted it
-//! again at the end of the run.
+//! Most runs never read the pristine tree — the committed-artifact reuse,
+//! the in-sync hot path and the vendoring service all answer from bytes the
+//! project already has — so extracting a whole package tree per purl on a
+//! lockfile-only checkout would be wasted work.
 //!
-//! [`PackageSource`] keeps the fetch, the size caps and the integrity
-//! verification exactly where they were and defers only the writing: the
-//! fetched artifact is validated against the extractor's own rules up front
+//! [`PackageSource`] does the fetch, the size caps and the integrity
+//! verification eagerly and defers only the writing: the fetched artifact is validated against the extractor's own rules up front
 //! (see [`super::registry_fetch::FetchedPackage`]) and materialises on the
 //! first branch that actually reads a file.
 //!
@@ -82,12 +78,11 @@ impl<'a> PackageSource<'a> {
     /// Stage the source freshly at `dst` — the vendor stage the local build
     /// patches and then swaps into the copy dir.
     ///
-    /// An installed tree is copied out of the registry/module cache, as it
-    /// always was. A pending artifact is written STRAIGHT here instead of
-    /// into its tempdir and copied out of it again: the extraction is the
-    /// same walk, so the stage gets the same files with the same bytes and
-    /// the same modes, and `skip_file_name` drops the same entries the copy
-    /// dropped. `dst` is removed and recreated either way.
+    /// An installed tree is copied out of the registry/module cache. A
+    /// pending artifact is written STRAIGHT here instead of into its tempdir
+    /// and copied out of it again: the extraction is the same walk, so the
+    /// stage gets the same files with the same bytes and the same modes, and
+    /// `skip_file_name` drops the same entries the copy drops. `dst` is removed and recreated either way.
     pub async fn stage_into(
         &self,
         dst: &Path,
diff --git a/crates/socket-patch-core/src/vendor/state.rs b/crates/socket-patch-core/src/vendor/state.rs
index b5484055..765ee260 100644
--- a/crates/socket-patch-core/src/vendor/state.rs
+++ b/crates/socket-patch-core/src/vendor/state.rs
@@ -211,7 +211,7 @@ pub struct PipenvMeta {
 #[serde(rename_all = "camelCase")]
 pub struct VendorEntry {
     /// Vendor ecosystem dir name (`npm`, `cargo`, `golang`, `composer`,
-    /// `gem`, `pypi`).
+    /// `gem`, `pypi`, `nuget`, `maven`).
     pub ecosystem: String,
     /// Qualifier-free base PURL (`pkg:npm/lodash@4.17.21`). The map key is
     /// the manifest PURL (possibly qualified); this is the resolved base.
@@ -233,9 +233,10 @@ pub struct VendorEntry {
     /// npm: `package-lock` | `yarn-classic` | `yarn-berry` | `pnpm` |
     /// `pnpm-legacy` | `bun` | `vlt` (absent on pre-flavor entries ⇒
     /// `package-lock`; a `vlt` artifact is a package directory, whose
-    /// `fileInventory` excludes its `node_modules/`); pypi: `uv` | `requirements` |
-    /// `poetry` | `pdm` | `pipenv`. Reverts route on this and fail closed
-    /// on flavors this build has no backend for.
+    /// `fileInventory` excludes its `node_modules/`); pypi: `uv` |
+    /// `python-lock` | `requirements` | `hatch` | `poetry` | `pdm` |
+    /// `pipenv`. Reverts route on this and fail closed on flavors this build
+    /// has no backend for.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub flavor: Option<String>,
     /// pypi/uv extras.
@@ -612,8 +613,8 @@ fn parse_snapshot_state(bytes: &[u8], path: &Path) -> std::io::Result<VendorStat
 /// questions for every patched package — which entry carries this uuid, and
 /// which wiring record already allows direct references — and a ledger
 /// holding a whole-file snapshot per wired file runs to megabytes, so an
-/// idempotent re-run (which writes no ledger at all) parsed the same bytes
-/// once per package. See [`ParseMemo`]: the read still happens every time,
+/// idempotent re-run (which writes no ledger at all) would otherwise parse
+/// the same bytes once per package. See [`ParseMemo`]: the read still happens every time,
 /// and a ledger something else rewrote between two packages differs in its
 /// bytes and is re-parsed.
 static STATE_MEMO: ParseMemo<VendorState> = ParseMemo::new();
diff --git a/crates/socket-patch-core/src/vendor/toml_surgery.rs b/crates/socket-patch-core/src/vendor/toml_surgery.rs
index 4837a61b..23c26154 100644
--- a/crates/socket-patch-core/src/vendor/toml_surgery.rs
+++ b/crates/socket-patch-core/src/vendor/toml_surgery.rs
@@ -1,6 +1,6 @@
 //! Pure text-surgery helpers for lockfile-shaped TOML.
 //!
-//! The pypi/uv, poetry, and pdm backends edit locks by TARGETED text
+//! The pypi/uv and poetry backends edit locks by TARGETED text
 //! surgery rather than a TOML re-serialize: the spike
 //! proved a surgical edit reproduces the lock generator's own serializer
 //! output byte-identically, which keeps `--check`-style validations green
@@ -77,9 +77,8 @@ pub(super) fn package_unit_lines(unit_text: &str) -> Vec<&str> {
 
 /// Rewrite the unit's `files = [...]` array (single- or multi-line) to the
 /// single patched-wheel `{file, hash}` element, preserving every other line
-/// verbatim — the splice shape shared by the poetry and pdm locks. `None`
-/// when the unit has no files array (the callers fail closed rather than
-/// guess a placement).
+/// verbatim — the splice shape of the poetry lock. `None` when the unit has
+/// no files array (the caller fails closed rather than guess a placement).
 pub(super) fn replace_files_array(
     unit: &[&str],
     wheel_file_name: &str,
@@ -485,8 +484,8 @@ mod tests {
         assert_eq!(remove_table_if_empty(keep_blanks, "[tool.uv]"), keep_blanks);
         // A section holding ONLY blank lines is empty too — the headline
         // documented case. The splice consumes the section's trailing blanks
-        // up to the next header, so the blank separator that used to sit
-        // before [next] does not survive (pinning current behavior).
+        // up to the next header, so the blank separator before [next] does
+        // not survive (pinning current behavior).
         assert_eq!(
             remove_table_if_empty("x = 1\n\n[tool.uv]\n\n\n[next]\na = 1\n", "[tool.uv]"),
             "x = 1\n[next]\na = 1\n"
@@ -504,11 +503,9 @@ mod tests {
     #[test]
     fn removal_helpers_preserve_foreign_line_endings() {
         // pyproject.toml is user-authored: git autocrlf on Windows makes it
-        // CRLF. The uv wire now renders its inserts in the file's own
-        // convention, but an older wire (or a hand edit) can still leave a
-        // mixed-ending file, so the removal helpers must never normalize:
-        // every byte outside the removed segment survives verbatim (the
-        // go_mod/go_sum CRLF-churn class).
+        // CRLF, and a hand edit can leave a mixed-ending file, so the
+        // removal helpers must never normalize: every byte outside the
+        // removed segment survives verbatim.
         let wired = "[project]\r\nname = \"x\"\r\n\n[tool.uv.sources]\nfoo = { path = \"w.whl\" }\n";
         let after = remove_exact_line(wired, "foo = { path = \"w.whl\" }").unwrap();
         assert_eq!(after, "[project]\r\nname = \"x\"\r\n\n[tool.uv.sources]\n");
diff --git a/crates/socket-patch-core/src/vendor/verify.rs b/crates/socket-patch-core/src/vendor/verify.rs
index b9860431..f9080b61 100644
--- a/crates/socket-patch-core/src/vendor/verify.rs
+++ b/crates/socket-patch-core/src/vendor/verify.rs
@@ -5,9 +5,9 @@
 //! manifest claims the patch modified must hash (git-blob sha256) to its
 //! `afterHash` inside that artifact — the same standard `vex::verify` applies
 //! to installed trees. Dir-shaped ecosystems are hashed in place; npm
-//! tarballs and pypi wheels are decoded in memory (bounded — the artifacts
-//! are committed and tamper-able, so a crafted archive must not OOM an
-//! audit).
+//! tarballs and zip artifacts (`.whl`/`.nupkg`/`.jar`) are decoded in memory
+//! (bounded — the artifacts are committed and tamper-able, so a crafted
+//! archive must not OOM an audit).
 //!
 //! Fail-closed order (each failure is a stable snake_case routing tag):
 //! `no_files` → `vendor_path_unsafe` → `vendor_uuid_mismatch` →
@@ -167,7 +167,7 @@ async fn verify_dir_members(
     Ok(())
 }
 
-/// A vlt package-dir entry (DESIGN §4.2): npm, flavor `vlt`, not a tarball.
+/// A vlt package-dir entry: npm, flavor `vlt`, not a tarball.
 pub(crate) fn is_vlt_dir_entry(entry: &VendorEntry) -> bool {
     entry.ecosystem == "npm"
         && entry.flavor.as_deref() == Some(super::vlt_lock::FLAVOR)
@@ -281,7 +281,7 @@ pub(crate) async fn vlt_installed_copy_matches(
     true
 }
 
-/// The vlt manifest exemption (DESIGN §4.4): the committed `package.json`
+/// The vlt manifest exemption: the committed `package.json`
 /// is post-transform, so it verifies iff it hashes to the inventory pin and,
 /// when the afterHash blob is in the local blob store, the blob with its
 /// devDependencies stripped hashes to that pin too.
@@ -645,7 +645,8 @@ pub enum ArtifactHealth {
     /// Present but failing verification: rebuildable. `reason` is the
     /// stable routing tag (`vendor_hash_mismatch`, `file_not_found`,
     /// `vendor_artifact_unreadable`, `vendor_sha256_mismatch`,
-    /// `vendor_inventory_mismatch`).
+    /// `vendor_inventory_mismatch`, `vendor_workspace_artifact_missing`,
+    /// `vendor_workspace_artifact_corrupt`).
     Corrupt { reason: String },
     /// The ledger/artifact uuid doesn't match the record: a re-vendor is
     /// pending — not repair's job.
@@ -661,7 +662,8 @@ pub enum ArtifactHealth {
 /// Health-check one vendored artifact against its patch record: the
 /// per-file afterHash verification of [`verify_vendored_patch_record`]
 /// (which for dir-shaped artifacts includes the whole-tree fileInventory
-/// cross-check) plus, for file-shaped artifacts (`.tgz`/`.tar.gz`/`.whl`)
+/// cross-check) plus, for file-shaped artifacts
+/// (`.tgz`/`.tar.gz`/`.whl`/`.nupkg`/`.jar`, see [`artifact_is_file_shaped`])
 /// with a recorded ledger sha256, a whole-file hash cross-check — the
 /// rewired lockfile integrity references those exact bytes, so silent
 /// drift breaks the package manager even when the patched members still
@@ -744,7 +746,7 @@ pub async fn file_sha256_hex(path: &Path) -> Option<String> {
 
     // Open, read and hash in ONE blocking hop. The loop below is pure CPU
     // between `read`s, and a wheel or a `.nupkg` is megabytes of it — run on
-    // the async thread it blocked the runtime for the whole digest.
+    // the async thread it would block the runtime for the whole digest.
     let path = path.to_path_buf();
     tokio::task::spawn_blocking(move || {
         let (mut file, meta) = crate::utils::fs::open_regular_file_sync(&path).ok()?;
@@ -1099,7 +1101,7 @@ mod tests {
 
     /// The whole-tree inventory closes the dir-shaped blindspot: with only
     /// afterHashes, a tampered UNPATCHED file (or stub gemspec), a deleted
-    /// file, or a planted extra file were all blessed Healthy. Each arm of
+    /// file, or a planted extra file would all be blessed Healthy. Each arm of
     /// the tamper matrix is hand-pinned; the legacy no-inventory entry keeps
     /// member-only behavior (backward tolerance).
     #[tokio::test]
@@ -1210,7 +1212,7 @@ mod tests {
             .unwrap();
 
         // 5. LEGACY entry (no inventory recorded): the same unpatched-file
-        //    tamper keeps today's member-only Healthy verdict.
+        //    tamper keeps the member-only Healthy verdict.
         tokio::fs::write(dir.join("rack.gemspec"), b"tampered gemspec\n")
             .await
             .unwrap();
diff --git a/crates/socket-patch-core/src/vendor/vlt_lock.rs b/crates/socket-patch-core/src/vendor/vlt_lock.rs
index 2397c5e6..fe434149 100644
--- a/crates/socket-patch-core/src/vendor/vlt_lock.rs
+++ b/crates/socket-patch-core/src/vendor/vlt_lock.rs
@@ -1,5 +1,5 @@
 //! vlt vendor backend: `vlt-lock.json` + importer `package.json` surgery
-//! for a direct dependency (DESIGN §4.5).
+//! for a direct dependency.
 //!
 //! The target's default-registry node becomes a `file` node naming the
 //! directory artifact ([`super::npm_dir`]), without the peer-context extra
@@ -8,7 +8,7 @@
 //! importers' package.json specs move to `file:<path relative to the
 //! importer>`, and its own outgoing edges are re-keyed to the new DepID.
 //! Every other line of the lock stays byte-identical, and the moved entries
-//! are placed where vlt's own serializer puts them (§4.5.4), so `vlt ci`
+//! are placed where vlt's own serializer puts them, so `vlt ci`
 //! keeps the lock byte-stable.
 //!
 //! Transitive targets are refused: vlt re-resolves a non-importer edge to a
@@ -65,7 +65,7 @@ const NOT_CANONICAL: &str =
 /// A refusal: a stable code and its detail.
 pub type Refusal = (&'static str, String);
 
-/// DESIGN §4.1 lock sniff: a BOM-less JSON object with `lockfileVersion` 0
+/// Lock sniff: a BOM-less JSON object with `lockfileVersion` 0
 /// or 1. The `Err` detail goes with `vendor_lockfile_version_unsupported`.
 pub(crate) fn sniff_vendor_lock(text: &str) -> Result<ParsedLock, String> {
     match sniff_lock(text) {
@@ -297,7 +297,7 @@ impl LockDoc {
     }
 }
 
-// ── placement (§4.5.4) ───────────────────────────────────────────────────
+// ── placement ────────────────────────────────────────────────────────────
 
 fn node_cmp(a: &Entry, b: &Entry) -> Option<Ordering> {
     vlt_collate(&a.key, &b.key)
@@ -350,7 +350,7 @@ fn place(
     list
 }
 
-// ── target analysis (§4.5.1) ─────────────────────────────────────────────
+// ── target analysis ──────────────────────────────────────────────────────
 
 /// An importer edge into the target.
 #[derive(Debug, Clone)]
@@ -585,7 +585,7 @@ fn json_string(s: &str) -> String {
     serde_json::to_string(s).expect("a str serializes to JSON infallibly")
 }
 
-/// DESIGN §4.5.1 declaration checks on the importers' package.json files.
+/// Declaration checks on the importers' package.json files.
 fn check_declarations(
     target: &Target,
     pkgs: &BTreeMap<String, String>,
@@ -705,8 +705,8 @@ async fn analyze(
 /// The read-only vendored-mode refusals vlt can decide before any write:
 /// the lock sniff and layout, the target analysis with its declaration
 /// checks, the installed store copy's `bundleDependencies` and duplicate
-/// `devDependencies`, and a git rule ignoring the would-be uuid dir
-/// (DESIGN §4.6, core part). The dir form matches only directory
+/// `devDependencies`, and a git rule ignoring the would-be uuid dir. The
+/// dir form matches only directory
 /// exclusions: every other rule is overridden by the `!*` the engine
 /// writes into that dir.
 pub async fn vlt_vendor_preflight(
@@ -836,7 +836,7 @@ fn carried(
     }
 }
 
-/// DESIGN §4.5.2–§4.5.4: the records and the new surfaces, or `None` when
+/// The wiring records and the new surfaces, or `None` when
 /// every surface already names `rel`.
 fn plan_wiring(
     analysis: &Analysis,
@@ -1421,7 +1421,7 @@ async fn preflight_package(
 }
 
 /// Rewrite a vlt entry's `<uuid>/.gitignore` and `<uuid>/.gitattributes`
-/// when absent or changed (DESIGN §4.8 health: neither is part of the
+/// when absent or changed (health: neither is part of the
 /// artifact, so repairing them is no rebuild).
 pub async fn restore_vlt_uuid_metadata(
     entry: &VendorEntry,
@@ -1436,7 +1436,7 @@ pub async fn restore_vlt_uuid_metadata(
     super::npm_dir::restore_uuid_metadata(&project_root.join(uuid_dir)).await
 }
 
-/// Whether `text` passes the §4.1 router sniff (a BOM-less JSON object
+/// Whether `text` passes the router sniff (a BOM-less JSON object
 /// with `lockfileVersion` 0 or 1).
 pub fn vlt_lock_sniff_ok(text: &str) -> bool {
     sniff_vendor_lock(text).is_ok()
@@ -1493,7 +1493,7 @@ pub async fn vlt_entry_in_use(entry: &VendorEntry, project_root: &Path) -> Optio
     lock_has_file_node_under(&text, &entry.uuid)
 }
 
-// ── revert (§4.7) ────────────────────────────────────────────────────────
+// ── revert ───────────────────────────────────────────────────────────────
 
 fn drifted(detail: impl Into<String>) -> VendorWarning {
     VendorWarning::new("vendor_lock_entry_drifted", detail.into())
@@ -1730,7 +1730,7 @@ fn revert_pkg(pkgs: &mut BTreeMap<String, String>, rec: &WiringRecord) -> Step {
     }
 }
 
-/// The DESIGN §4.7 cross-grammar drift detail: the user re-created the lock
+/// The cross-grammar drift detail: the user re-created the lock
 /// under the other DepID grammar while package.json still names our dir.
 fn cross_grammar_detail(entry: &VendorEntry, doc: &LockDoc) -> Option<String> {
     let node = entry.wiring.iter().find(|r| r.kind == KIND_LOCK_NODE)?;
@@ -1824,7 +1824,7 @@ async fn revert_reinstall_advisory(
     ))
 }
 
-/// Undo one vlt-vendored package: every record through its §4.5.3 inverse,
+/// Undo one vlt-vendored package: every record through its inverse,
 /// all or nothing, then remove the artifact.
 pub async fn revert_vlt_opts(
     entry: &VendorEntry,
@@ -2035,7 +2035,7 @@ fn drop_unrecorded_file_edges(staged: &mut Staged, entry: &VendorEntry) {
 }
 
 /// A block without its merged entries, the restored ones re-placed
-/// (§4.5.4) in the forward record order.
+/// in the forward record order.
 fn restored_block(
     entries: &[Entry],
     touched: &[usize],
diff --git a/crates/socket-patch-core/src/vendor/vlt_lock_text.rs b/crates/socket-patch-core/src/vendor/vlt_lock_text.rs
index e10e7c5f..c7c54822 100644
--- a/crates/socket-patch-core/src/vendor/vlt_lock_text.rs
+++ b/crates/socket-patch-core/src/vendor/vlt_lock_text.rs
@@ -2204,9 +2204,8 @@ mod tests {
         }
     }
 
-    // Captured with vlt 1.2.0 and rc.14 (design probes peerprobe/t2 and
-    // e1c/base): every entry line is inside the grammar and both sections
-    // are in the order the comparators compute.
+    // Captured with vlt 1.2.0 and rc.14: every entry line is inside the
+    // grammar and both sections are in the order the comparators compute.
     const CAPTURED_1_2_0: &str = r#"{
   "lockfileVersion": 1,
   "options": {
diff --git a/crates/socket-patch-core/src/vendor/yarn_berry_lock.rs b/crates/socket-patch-core/src/vendor/yarn_berry_lock.rs
index 6a8768e6..3af1c826 100644
--- a/crates/socket-patch-core/src/vendor/yarn_berry_lock.rs
+++ b/crates/socket-patch-core/src/vendor/yarn_berry_lock.rs
@@ -3,8 +3,7 @@
 //!
 //! Berry verifies every install against the sha512 of the *converted cache
 //! zip* (`checksum: 10c0/<hex>`), so a lock-only rewrite à la classic is not
-//! enough — but spike B2/B3 (`spikes/PHASE0-V2-FINDINGS.txt` +
-//! `spikes/yarn-berry-nm/`) proved the full recipe is reproducible offline:
+//! enough — but the full recipe is reproducible offline:
 //!
 //! 1. `package.json` gains `"resolutions": {"<name>": "file:./<rel-tgz>"}`
 //!    (the dependency ranges stay untouched);
@@ -17,10 +16,10 @@
 //!
 //! A fresh checkout of exactly {package.json, yarn.lock, .yarnrc.yml,
 //! .socket/} then passes `yarn install --immutable --check-cache` fully
-//! offline (spike B5).
+//! offline.
 //!
 //! Fail-closed gates, all BEFORE any write: the checksum recipe only holds
-//! for cacheKey `10c0` (compressionLevel 0, the yarn 4 default — B4 showed
+//! for cacheKey `10c0` (compressionLevel 0, the yarn 4 default —
 //! `compressionLevel: mixed` changes both the cacheKey and the checksum), and
 //! a user-authored resolutions entry for the same package is never
 //! overwritten. The pair is committed package.json-first, lock-second, and
@@ -76,9 +75,8 @@ const YARN_LOCK: &str = "yarn.lock";
 const PACKAGE_JSON: &str = "package.json";
 const YARNRC: &str = ".yarnrc.yml";
 
-/// The run's project-`package.json` parse: berry re-read AND re-parsed the
-/// manifest for every patched package to check the `resolutions` gate. See
-/// [`ParseMemo`].
+/// The run's project-`package.json` parse: the `resolutions` gate reads the
+/// manifest once per patched package. See [`ParseMemo`].
 static PKG_JSON_MEMO: ParseMemo<Value> = ParseMemo::new();
 
 /// Wiring kinds this backend owns.
@@ -134,7 +132,7 @@ pub async fn vendor_yarn_berry<'a>(
         return outcome;
     }
 
-    // ── 3. .yarnrc.yml knobs that change the checksum (spike B4) ─────────
+    // ── 3. .yarnrc.yml knobs that change the checksum ───────────────────
     if let Some(outcome) = refuse_unsupported_compression(project_root).await {
         return outcome;
     }
@@ -273,7 +271,7 @@ pub async fn vendor_yarn_berry<'a>(
     }
     let tgz_sha512 = hex::encode(Sha512::digest(&tgz_bytes));
     // `hash=` — the first 6 hex chars of sha512(tgz): the lock-committed
-    // tamper guard on the tarball itself (spike B3, flips on any byte edit).
+    // tamper guard on the tarball itself (flips on any byte edit).
     let hash6 = &tgz_sha512[..6];
     let checksum = match berry_cache_checksum_10c0(&tgz_bytes, name) {
         Ok(c) => checksum_in_lock_spelling(&lock_text, &c),
@@ -307,7 +305,7 @@ pub async fn vendor_yarn_berry<'a>(
         ));
     }
     // The exact entry yarn 4 emits for a resolutions-driven `file:` tarball
-    // (spike B3, verbatim), carried sections in yarn's position between
+    // (the B3 fixture, verbatim), carried sections in yarn's position between
     // `resolution` and `checksum`.
     let mut new_lines = vec![
         format!("{lock_key}:"),
@@ -795,7 +793,7 @@ pub async fn revert_yarn_berry_opts(
         }
     }
 
-    // LOSSINESS GUARD (residual #131): when any wiring record was left
+    // LOSSINESS GUARD: when any wiring record was left
     // alone ("drifted; left alone"), the uuid dir may hold the only copy of
     // what the lock — or the redirect ledger's recorded originals — still
     // points at. Keep it (and let the CLI keep the ledger entry) instead of
@@ -927,7 +925,7 @@ fn revert_resolution_record(
         return;
     }
     // A takeover recorded the user's pinned value: restore it in place
-    // (the key and table stay). Otherwise remove our entry as before.
+    // (the key and table stay). Otherwise remove our entry.
     if let Some(orig) = rec.original.as_ref().and_then(Value::as_str) {
         res_obj.insert(key.to_string(), Value::String(orig.to_string()));
         *changed = true;
@@ -992,7 +990,7 @@ fn refuse_unsupported_cache(blocks: &[LockBlock]) -> Option<VendorOutcome> {
     })
 }
 
-/// The `.yarnrc.yml` `compressionLevel` gate (spike B4): any level but 0
+/// The `.yarnrc.yml` `compressionLevel` gate: any level but 0
 /// changes berry's cache checksums.
 async fn refuse_unsupported_compression(project_root: &Path) -> Option<VendorOutcome> {
     match read_regular_to_string(&project_root.join(YARNRC)).await {
@@ -1026,8 +1024,8 @@ async fn refuse_unsupported_compression(project_root: &Path) -> Option<VendorOut
 /// vendored` over a hosted-redirected purl): the takeover reverts the
 /// hosted lock edits and drops the redirect-ledger record BEFORE this
 /// backend runs, and a hosted revert keeps a mixed lock mixed — so without
-/// this preflight a refusal here landed after the hosted redirect was gone,
-/// leaving the package unpatched in both modes. Returns `(code, detail)`,
+/// this preflight a refusal here would land after the hosted redirect was
+/// gone, leaving the package unpatched in both modes. Returns `(code, detail)`,
 /// exactly the refusal the backend would raise.
 pub async fn yarn_berry_vendor_preflight(project_root: &Path) -> Option<(&'static str, String)> {
     use super::npm_flavor::{detect_npm_lock_flavor, NpmLockFlavor};
@@ -1297,7 +1295,7 @@ fn root_workspace_name(blocks: &[LockBlock]) -> Option<String> {
 }
 
 /// The `.yarnrc.yml` `compressionLevel` value, when set. A flat line scan is
-/// enough: yarn writes the knob as a top-level scalar (spike B4), and any
+/// enough: yarn writes the knob as a top-level scalar, and any
 /// value we cannot positively read as `0` makes the caller refuse. Shared
 /// with the hosted-redirect rewriter, whose cache-checksum gate is identical.
 /// CRLF lines split like LF ones (`str::lines`), and a leading BOM is
@@ -1385,7 +1383,8 @@ mod tests {
     const ORIG_INDEX: &[u8] = b"module.exports = () => 'orig';\n";
     const PATCHED_INDEX: &[u8] = b"module.exports = () => 'patched';\n";
 
-    /// Verbatim `spikes/yarn-berry-nm/fixtures/b3-vendored-resolutions/before/package.json`.
+    /// Verbatim `package.json` of the B3 fixture (a real yarn 4.12.0
+    /// project with a vendored resolution), before vendoring.
     const B3_BEFORE_PKG: &str = r#"{
   "name": "vendor-spike",
   "version": "1.0.0",
@@ -1396,7 +1395,7 @@ mod tests {
 }
 "#;
 
-    /// Verbatim `…/b3-vendored-resolutions/after/package.json`.
+    /// Verbatim B3 `package.json` after vendoring.
     const B3_AFTER_PKG: &str = r#"{
   "name": "vendor-spike",
   "version": "1.0.0",
@@ -1410,7 +1409,7 @@ mod tests {
 }
 "#;
 
-    /// Verbatim `…/b3-vendored-resolutions/before/yarn.lock` (yarn 4.12.0).
+    /// Verbatim B3 `yarn.lock` before vendoring (yarn 4.12.0).
     const B3_BEFORE_LOCK: &str = r#"# This file is generated by running "yarn install" inside your project.
 # Manual changes might be lost - proceed with caution!
 
@@ -1434,7 +1433,7 @@ __metadata:
   linkType: soft
 "#;
 
-    /// Verbatim `…/b3-vendored-resolutions/after/yarn.lock` (yarn-emitted).
+    /// Verbatim B3 `yarn.lock` after vendoring (yarn-emitted).
     const B3_AFTER_LOCK: &str = r#"# This file is generated by running "yarn install" inside your project.
 # Manual changes might be lost - proceed with caution!
 
@@ -1458,7 +1457,7 @@ __metadata:
   linkType: soft
 "#;
 
-    /// The spike tarball's hash constants inside the after-lock fixture; the
+    /// The captured tarball's hash constants inside the after-lock fixture; the
     /// tests substitute the recomputed hashes of the tarball this build
     /// packs (everything else must match byte-for-byte).
     const SPIKE_HASH6: &str = "39ea9b";
@@ -1693,14 +1692,14 @@ __metadata:
         assert!(warnings.is_empty(), "{warnings:?}");
         let entry = entry.expect("success carries a ledger entry");
 
-        // package.json: byte-for-byte the spike's after fixture.
+        // package.json: byte-for-byte the B3 after fixture.
         assert_eq!(
             tokio::fs::read_to_string(fx.pkg_path()).await.unwrap(),
             B3_AFTER_PKG
         );
         // yarn.lock: byte-for-byte modulo the recomputed hash= + checksum of
         // the tarball THIS build packed (checksum equality with the
-        // spike-captured value is berry_zip's own oracle test).
+        // captured value is berry_zip's own oracle test).
         let (hash6, checksum) = fx.packed_berry_facts().await;
         assert_eq!(
             tokio::fs::read_to_string(fx.lock_path()).await.unwrap(),
@@ -2215,7 +2214,7 @@ __metadata:
             outcome.warnings
         );
         // The drifted lock entry stays; the (still-ours) resolutions entry
-        // was removed; the artifact is KEPT (residual #131: the drifted
+        // was removed; the artifact is KEPT (the drifted
         // entry's recorded original may still be needed later) and the keep
         // is surfaced.
         let after = tokio::fs::read_to_string(fx.lock_path()).await.unwrap();
@@ -2308,7 +2307,7 @@ __metadata:
             tokio::fs::read(fx.lock_path()).await.unwrap(),
             fx.lock_bytes
         );
-        // The manifest drift-skip keeps the artifact too (residual #131).
+        // The manifest drift-skip keeps the artifact too.
         assert!(fx.tgz_path().exists(), "drift-skip must keep the artifact");
     }
 
@@ -2584,7 +2583,7 @@ __metadata:
     /// fail fast instead of wedging vendor or revert forever in an
     /// `open(2)` waiting for a writer that never comes. Same
     /// `open_regular_file` guard class as the vendor siblings (npm_lock.rs,
-    /// pnpm_lock.rs, lock_inventory.rs).
+    /// pnpm_lock.rs, lock_inventory/).
     #[cfg(unix)]
     #[tokio::test]
     async fn fifo_files_fail_fast_instead_of_wedging_vendor_and_revert() {
@@ -3406,13 +3405,13 @@ __metadata:
         );
     }
 
-    /// REGRESSION: the vendored backend splits berry keys with the ONE
-    /// berry splitter (`split_berry_key_patterns`, which the redirect and
-    /// the lock inventory's `berry_entries` use). The classic splitter read
-    /// berry's single outer quote pair as one pattern, so a multi-descriptor
-    /// key looked like a single `left-pad` / `a` descriptor: the mixed-name
-    /// refusal never fired, and an alias sharing the real package's block
-    /// was not seen.
+    /// The vendored backend splits berry keys with the ONE berry splitter
+    /// (`split_berry_key_patterns`, which the redirect and the lock
+    /// inventory's `berry_entries` use). The classic splitter reads berry's
+    /// single outer quote pair as one pattern, so a multi-descriptor key
+    /// would look like a single `left-pad` / `a` descriptor: the mixed-name
+    /// refusal would never fire, and an alias sharing the real package's
+    /// block would go unseen.
     #[test]
     fn multi_descriptor_berry_keys_split_like_every_other_reader() {
         let block = |key: &str, version: &str| {
@@ -3532,10 +3531,10 @@ __metadata:
         }
     }
 
-    /// REGRESSION (yarn 4.0.x): a lock whose checksums are spelled bare
-    /// (yarn 4.0.0–4.0.2 at cacheKey `10c0`) gets the vendored entry's
-    /// checksum spelled bare too — byte-exact against the spike after-lock
-    /// with every checksum de-prefixed. The prefixed spelling made the
+    /// yarn 4.0.x: a lock whose checksums are spelled bare (yarn
+    /// 4.0.0–4.0.2 at cacheKey `10c0`) gets the vendored entry's checksum
+    /// spelled bare too — byte-exact against the B3 after-lock with
+    /// every checksum de-prefixed. The prefixed spelling makes the
     /// fresh-checkout `yarn install --immutable` fail with YN0028.
     #[tokio::test]
     async fn yarn40_bare_checksum_lock_gets_a_bare_vendored_checksum() {
@@ -3567,7 +3566,7 @@ __metadata:
     /// The Windows shape — yarn writes a new `yarn.lock` and the
     /// `package.json` it first pretty-prints with `os.EOL` (CRLF) — plus a
     /// BOM and a missing trailing newline: vendoring keeps each file's
-    /// layout (the spike's LF oracle bytes in that layout), the ledger
+    /// layout (the B3 LF oracle bytes in that layout), the ledger
     /// records terminator-free lines, the re-run is in sync, and revert
     /// lands byte-exactly on the pre-vendor files.
     #[tokio::test]
diff --git a/crates/socket-patch-core/src/vendor/yarn_classic_lock.rs b/crates/socket-patch-core/src/vendor/yarn_classic_lock.rs
index a0387714..cd65d524 100644
--- a/crates/socket-patch-core/src/vendor/yarn_classic_lock.rs
+++ b/crates/socket-patch-core/src/vendor/yarn_classic_lock.rs
@@ -5,9 +5,9 @@
 //! pipeline) and rewrite every matching `yarn.lock` block's
 //! `resolved "file:./<rel-tgz>#<sha1>"` + `integrity <sha512 SRI>`.
 //! `package.json` is untouched — the block's range keys still match.
-//! Spike-proven (Y2/Y5/Y6 in `spikes/PHASE0-V2-FINDINGS.txt`): the rewrite
-//! passes `--frozen-lockfile`, installs offline from a fresh checkout, and
-//! round-trips yarn's own serializer byte-for-byte.
+//! Spike-proven (Y2/Y5/Y6): the rewrite passes `--frozen-lockfile`,
+//! installs offline from a fresh checkout, and round-trips yarn's own
+//! serializer byte-for-byte.
 //!
 //! Two spellings are LOAD-BEARING:
 //! * `resolved` must keep a `file:./` (or `./`) prefix — a bare path is
@@ -495,11 +495,11 @@ pub async fn revert_yarn_classic_opts(
         }
     }
 
-    // LOSSINESS GUARD (residual #131): when any wiring record was left
-    // alone ("drifted; left alone"), the uuid dir may hold the only copy of
-    // what the lock — or the redirect ledger's recorded originals — still
-    // points at. Keep it (and let the CLI keep the ledger entry) instead of
-    // deleting evidence out from under a lock we just refused to touch.
+    // LOSSINESS GUARD: when any wiring record was left alone ("drifted;
+    // left alone"), the uuid dir may hold the only copy of what the lock —
+    // or the redirect ledger's recorded originals — still points at. Keep
+    // it (and let the CLI keep the ledger entry) instead of deleting evidence
+    // out from under a lock we just refused to touch.
     if outcome.drift_skipped() {
         outcome.keep_artifact(&uuid_dir_rel);
         return outcome;
@@ -824,7 +824,7 @@ pub(crate) struct LockBlock {
 
 /// The run's yarn-lock block scans. `scan_blocks` walks every line of the
 /// lock and copies each one into the block it belongs to, and BOTH yarn
-/// backends re-scanned the whole lock for every patched package — plus once
+/// backends re-scan the whole lock for every patched package — plus once
 /// per candidate key while splicing. One slot: a project has one yarn.lock,
 /// and the splice loop leaves the memo alone once it has rewritten the text
 /// (nothing can ask for a half-spliced lock again). An idempotent re-run
@@ -1119,8 +1119,7 @@ mod tests {
     const SPIKE_SRI: &str =
         "sha512-AhUdVqx1bsqgzQOo7owaHwAHqwHbpwHo4Y1U27ucyBdZn2KxEEzoT9kYGApl8gO3eu5oY2TceRVcmbgLXXRmPw==";
 
-    /// Verbatim `spikes/yarn-classic/y2-lock-rewrite/before/yarn.lock`
-    /// (yarn 1.22.22-generated).
+    /// Verbatim spike Y2 before-lock (yarn 1.22.22-generated).
     const Y2_BEFORE: &str = r#"# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
 # yarn lockfile v1
 
@@ -1131,9 +1130,9 @@ left-pad@^1.3.0:
   integrity sha512-XI5MPzVNApjAyhQzphX8BkmKsKUxD4LdyK24iZeQGinBN9yTQT3bFlCBy/aVx2HrNcqQGsdot8ghrjyrvMCoEA==
 "#;
 
-    /// Verbatim `spikes/yarn-classic/y2-lock-rewrite/after/yarn.lock` — yarn
-    /// itself round-tripped this byte-for-byte (spike Y2's re-serialization
-    /// oracle), so it IS yarn's own output shape.
+    /// Verbatim spike Y2 after-lock — yarn itself round-tripped this
+    /// byte-for-byte (spike Y2's re-serialization oracle), so it IS yarn's
+    /// own output shape.
     const Y2_AFTER: &str = r#"# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
 # yarn lockfile v1
 
@@ -1144,8 +1143,8 @@ left-pad@^1.3.0:
   integrity sha512-AhUdVqx1bsqgzQOo7owaHwAHqwHbpwHo4Y1U27ucyBdZn2KxEEzoT9kYGApl8gO3eu5oY2TceRVcmbgLXXRmPw==
 "#;
 
-    /// Verbatim `spikes/yarn-classic/y5-merged-alias/before/yarn.lock`:
-    /// a merged two-pattern block, a separate alias block, and a folder dep.
+    /// Verbatim spike Y5 before-lock: a merged two-pattern block, a
+    /// separate alias block, and a folder dep.
     const Y5_BEFORE: &str = r#"# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
 # yarn lockfile v1
 
@@ -1166,7 +1165,7 @@ left-pad@^1.3.0, left-pad@~1.3.0:
   integrity sha512-XI5MPzVNApjAyhQzphX8BkmKsKUxD4LdyK24iZeQGinBN9yTQT3bFlCBy/aVx2HrNcqQGsdot8ghrjyrvMCoEA==
 "#;
 
-    /// Verbatim `spikes/yarn-classic/y5-merged-alias/after/yarn.lock`.
+    /// Verbatim spike Y5 after-lock.
     const Y5_AFTER: &str = r#"# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
 # yarn lockfile v1
 
@@ -1544,9 +1543,10 @@ left-pad@^1.3.0:
         );
     }
 
-    /// F10 + F12 twin: a relock back to the registry block, re-pinned
-    /// from the REUSED tarball (no request under the outage), recomputes
-    /// the dependency sub-maps from the reused bytes' patched package.json.
+    /// Twin of npm_lock's relock re-pin test: a relock back to the registry
+    /// block, re-pinned from the REUSED tarball (no request under the
+    /// outage), recomputes the dependency sub-maps from the reused bytes'
+    /// patched package.json.
     #[tokio::test]
     async fn relock_with_pkg_json_patch_recomputes_submaps_from_reused_bytes() {
         use crate::vendor::test_support as ts;
@@ -1896,8 +1896,8 @@ left-pad@^1.3.0:
             after.contains("left-pad@^1.3.0, left-pad@~1.3.0:\n  version \"1.3.0\"\n  resolved \"https://registry.yarnpkg.com/"),
             "non-drifted block restored: {after}"
         );
-        // Residual #131: a drift-skip keeps the artifact dir (the drifted
-        // block's recorded original may still be needed later) and says so.
+        // A drift-skip keeps the artifact dir (the drifted block's recorded
+        // original may still be needed later) and says so.
         assert!(
             fx.root()
                 .join(format!(".socket/vendor/npm/{UUID}"))
diff --git a/crates/socket-patch-core/src/vendor/yarn_layering_tests.rs b/crates/socket-patch-core/src/vendor/yarn_layering_tests.rs
index 34ef822e..f720bfd8 100644
--- a/crates/socket-patch-core/src/vendor/yarn_layering_tests.rs
+++ b/crates/socket-patch-core/src/vendor/yarn_layering_tests.rs
@@ -11,12 +11,12 @@
 //!    resolve) stay byte-identical, no `patch:` protocol string is ever
 //!    introduced, and the crate's own lockfile parser still reads the file;
 //! 2. the rewritten block's `#<sha1>` fragment and `integrity` SRI match the
-//!    actual vendored blob bytes (the chain the forensics verified 48/48);
+//!    actual vendored blob bytes;
 //! 3. hosted-over-vendored layering records the vendored blocks as its
 //!    `original`s (data-level reversibility) — and `vendor --revert` after
 //!    that overlay is drift-skipped AND keeps the blob dir + surfaces the
-//!    keep (residual #131 fixed: deleting the blob while the lock stayed
-//!    hosted stranded the redirect ledger's recorded `original`s);
+//!    keep (deleting the blob while the lock stays hosted would strand the
+//!    redirect ledger's recorded `original`s);
 //! 4. yarn berry locks containing builtin `patch:` resolution entries pass
 //!    through both the vendor backend and the hosted redirect rewriter with
 //!    those entries byte-identical — even when the redirected package IS the
@@ -364,9 +364,8 @@ async fn classic_vendor_rewrites_only_target_block_and_stays_parseable() {
     );
 }
 
-/// Incident guard 2 (the chain the forensics verified 48/48 on the strapi
-/// tree): the rewritten block's `resolved` keeps the `<url>#<sha1>` shape
-/// where the sha1 fragment and the `integrity` sha512 SRI are recomputed
+/// Incident guard 2: the rewritten block's `resolved` keeps the
+/// `<url>#<sha1>` shape where the sha1 fragment and the `integrity` sha512 SRI are recomputed
 /// from the ACTUAL vendored blob bytes, and the ledger's artifact.sha256
 /// matches the same bytes.
 ///
@@ -406,7 +405,7 @@ async fn classic_rewritten_block_hashes_match_vendored_blob_bytes() {
 /// Incident guard 3, forward direction (exactly what the strapi user did):
 /// a hosted redirect layered over vendored wiring records the VENDORED
 /// block as its `original` (redirect edit.original == vendor wiring.new —
-/// the cross-ledger invariant the forensics checked 48/48), produces hosted
+/// the cross-ledger invariant), produces hosted
 /// URLs, leaves every other block byte-identical, introduces no `patch:`
 /// string, is idempotent, and its recorded originals are sufficient data to
 /// restore the vendored lock byte-exactly.
@@ -488,19 +487,16 @@ async fn classic_hosted_redirect_layers_over_vendored_wiring() {
     assert!(again.edits.is_empty(), "{:?}", again.edits);
 }
 
-/// Incident guard 3, reverse direction — the drift-skip KEEP contract
-/// (residual #131, fixed): `vendor --revert` after a hosted overlay finds
+/// Incident guard 3, reverse direction — the drift-skip KEEP contract:
+/// `vendor --revert` after a hosted overlay finds
 /// every block re-resolved (the hosted URL fails the
 /// `.socket/vendor/npm/<uuid>` ownership gate), warns
 /// `vendor_lock_entry_drifted`, leaves the lock byte-identical at the
 /// hosted URLs — and KEEPS the blob dir, surfacing the keep honestly
 /// (`vendor_artifact_kept`). The blob is the only surviving copy of what
 /// the redirect ledger's recorded `original` (`file:` fragment) points at:
-/// deleting it while claiming success planted a dangling replay hazard and
-/// destroyed the pre-vendor originals a later restore needs.
-///
-/// This test previously PINNED the lossy behavior (blob deleted); it was
-/// flipped when the drift-skip keep shipped.
+/// deleting it while claiming success would plant a dangling replay hazard
+/// and destroy the pre-vendor originals a later restore needs.
 #[tokio::test]
 async fn classic_vendor_revert_after_hosted_overlay_is_drift_skipped_and_keeps_blob() {
     let fx = classic_fx(CLASSIC_BEFORE);
@@ -538,7 +534,7 @@ async fn classic_vendor_revert_after_hosted_overlay_is_drift_skipped_and_keeps_b
         hosted_text,
         "drift-skip must leave the hosted lock untouched"
     );
-    // 4. the blob dir SURVIVES — "left alone" now holds end-to-end.
+    // 4. the blob dir SURVIVES — "left alone" holds end-to-end.
     assert!(
         fx.tgz_path().exists(),
         "drift-skip must keep the blob: it is the only copy the redirect \
@@ -583,7 +579,7 @@ async fn classic_vendor_revert_after_hosted_overlay_is_drift_skipped_and_keeps_b
 /// the block back to `file:` but records the HOSTED block as the wiring
 /// `original` (`block_points_into_vendor` is false for https URLs), so a
 /// subsequent revert restores the hosted block exactly — never a fabricated
-/// registry URL. Pins the provenance-supersession the forensics traced.
+/// registry URL.
 ///
 /// RED-verified: asserting original == the registry block fails; asserting
 /// revert lands on registry URLs fails.
@@ -992,7 +988,7 @@ async fn berry_hosted_redirect_leaves_builtin_patch_entries_untouched() {
 /// and the builtin `resolve@patch:...#builtin<compat/resolve>` entry at the
 /// same version) rewrites ONLY the npm: entry and leaves the builtin
 /// `patch:` block byte-identical, warning about the block it refused to
-/// touch. Without the protocol gate the rewriter spliced an
+/// touch. Without the protocol gate the rewriter would splice an
 /// `npm:...::__archiveUrl=` resolution under the still-`patch:` key — a
 /// corrupted key/resolution protocol mismatch in the incident's exact error
 /// family, emitted as a silent second edit.
diff --git a/crates/socket-patch-core/src/vex/build.rs b/crates/socket-patch-core/src/vex/build.rs
index 22919652..a021dd29 100644
--- a/crates/socket-patch-core/src/vex/build.rs
+++ b/crates/socket-patch-core/src/vex/build.rs
@@ -46,11 +46,11 @@ pub struct BuildOptions {
 /// `VerifyOutcome::vendored`) carry the impact-statement phrasing
 /// "Patched via Socket patch `<uuid>` (vendored)" so the attestation
 /// records that the evidence is the committed `.socket/vendor/`
-/// artifact, not the installed tree. PURLs in `redirected` (pointed at
-/// Socket's hosted vendored patches by `scan --redirect`) carry
-/// "(redirected)" instead. The two sets are disjoint in practice
-/// (`--redirect` conflicts with `--vendor`); if a PURL somehow appears
-/// in both, `vendored` wins. Status and justification are identical
+/// artifact, not the installed tree. PURLs in `redirected` (wired to
+/// Socket's hosted patches by hosted-mode `scan`) carry "(redirected)"
+/// instead. The two sets are disjoint in practice (each PURL is attested
+/// on exactly one basis); if a PURL somehow appears in both, `vendored`
+/// wins. Status and justification are identical
 /// across all three phrasings.
 ///
 /// Returns `None` when no statements can be emitted (no applied
@@ -490,8 +490,7 @@ mod tests {
     }
 
     /// `BuildOptions.tooling = None` → `Document.tooling` is None and
-    /// the JSON output omits the key. Previously only `Some` was
-    /// asserted.
+    /// the JSON output omits the key.
     #[test]
     fn tooling_none_omits_key_in_document() {
         let mut manifest = PatchManifest::new();
@@ -762,7 +761,7 @@ mod tests {
 
     /// If a PURL is defensively present in BOTH the vendored and redirected
     /// sets, the vendored phrasing wins (they are disjoint in practice —
-    /// `--redirect` conflicts with `--vendor`).
+    /// each PURL is attested on one basis).
     #[test]
     fn vendored_takes_precedence_over_redirected() {
         let mut manifest = PatchManifest::new();
diff --git a/crates/socket-patch-core/src/vex/discover/cargo.rs b/crates/socket-patch-core/src/vex/discover/cargo.rs
index b454e502..8c537427 100644
--- a/crates/socket-patch-core/src/vex/discover/cargo.rs
+++ b/crates/socket-patch-core/src/vex/discover/cargo.rs
@@ -1473,8 +1473,9 @@ mod tests {
 
     // ── vendored ─────────────────────────────────────────────────────
 
-    /// The exact shape `vendor`'s cargo backend writes: the config entry
-    /// plus a detached (sourceless) lock entry.
+    /// The pre-v5 shape `vendor`'s cargo backend wrote (still honored): a
+    /// project-config `[patch]` entry plus an untagged detached (sourceless)
+    /// lock entry.
     #[tokio::test]
     async fn vendored_patch_entry_with_detached_lock_entry() {
         let rel = vendor_path(UUID_A, "cfg-if-1.0.4");
diff --git a/crates/socket-patch-core/src/vex/discover/deno.rs b/crates/socket-patch-core/src/vex/discover/deno.rs
index d0861239..9b680aaf 100644
--- a/crates/socket-patch-core/src/vex/discover/deno.rs
+++ b/crates/socket-patch-core/src/vex/discover/deno.rs
@@ -1,7 +1,8 @@
 //! Deno — deliberately always empty.
 //!
-//! Neither mode exists for Deno: there is no hosted rewriter
-//! (`commands/scan/hosted.rs:78-80` refuses the ecosystem) and no vendored
+//! Neither mode exists for Deno: there is no hosted rewriter (no rewriter
+//! edits `deno.lock`; `commands/scan/hosted.rs` leaves it out of the
+//! rewriter's input files on purpose) and no vendored
 //! backend (`vendor::path::ecosystem_dir_for_purl` maps `pkg:jsr/…` to
 //! `None` — there is no `.socket/vendor/jsr/`). A `deno.lock` can therefore
 //! never carry a Socket patch reference, and a Socket-looking url in one is
diff --git a/crates/socket-patch-core/src/vex/discover/gem.rs b/crates/socket-patch-core/src/vex/discover/gem.rs
index 1bfa468c..da1ef1e9 100644
--- a/crates/socket-patch-core/src/vex/discover/gem.rs
+++ b/crates/socket-patch-core/src/vex/discover/gem.rs
@@ -940,11 +940,10 @@ mod tests {
         )
     }
 
-    /// REGRESSION: a merged section (bundler <= 2.1) used to be flatly
-    /// unattributable — and, being RECOGNIZED, it killed the redirect
-    /// ledger's claim too, so a correctly patched bundler 1.17-2.1 project
-    /// could not attest its hosted patch at all, ledger or not. The source
-    /// pin (DEPENDENCIES `!` + the Gemfile block on that remote) attributes
+    /// A merged section (bundler <= 2.1) must stay attributable — being
+    /// RECOGNIZED, an unattributable one would also kill the redirect
+    /// ledger's claim, so a correctly patched bundler 1.17-2.1 project could
+    /// not attest its hosted patch at all. The source pin (DEPENDENCIES `!` + the Gemfile block on that remote) attributes
     /// the gem; the upstream spec in the same section stays silent.
     #[tokio::test]
     async fn merged_section_source_pinned_gem_is_hosted() {
diff --git a/crates/socket-patch-core/src/vex/discover/maven.rs b/crates/socket-patch-core/src/vex/discover/maven.rs
index 970fa4cb..9908e52c 100644
--- a/crates/socket-patch-core/src/vex/discover/maven.rs
+++ b/crates/socket-patch-core/src/vex/discover/maven.rs
@@ -1299,7 +1299,7 @@ mod tests {
     /// jar's `.sha1` sidecar is part of the wiring. With it stale or gone,
     /// real Maven (3.6.3 → 4.0.0-rc-6, `e2e_vendor_maven_build`) rejects the
     /// file:// copy and silently resolves Central's pristine jar — while the
-    /// committed members still hash-verify, so this ref used to attest a
+    /// committed members still hash-verify, so the ref must not attest a
     /// build that no longer consumes the patch.
     #[tokio::test]
     async fn vendored_jar_sidecar_must_match_the_jar() {
diff --git a/crates/socket-patch-core/src/vex/discover/mod.rs b/crates/socket-patch-core/src/vex/discover/mod.rs
index 4289cc3b..bc4e6727 100644
--- a/crates/socket-patch-core/src/vex/discover/mod.rs
+++ b/crates/socket-patch-core/src/vex/discover/mod.rs
@@ -1722,10 +1722,11 @@ pub async fn vendored_wiring_live(root: &Path, recorded: &[&str], eco: &str, uui
     vendored_wiring_in_files(root, &probe, eco, uuid).await
 }
 
-/// The root files a vendored `eco` artifact can be wired from — every
-/// vendor backend's lockfile / wiring config for that ecosystem (npm: every
+/// The root files a vendored `eco` artifact can be wired from — the vendor
+/// backends' lockfile / wiring config for that ecosystem (npm: every
 /// npm-family lock the `vendor_probe` table flags, `vlt-lock.json`
-/// included; cargo: the `[patch.crates-io]` config; maven /
+/// included; cargo: only the pre-v5 `.cargo/config.toml` / `.cargo/config`
+/// `[patch.crates-io]` spellings, not the v5 root `Cargo.toml`; maven /
 /// nuget: the repository / source that serves the vendored dir). Manifests
 /// such as package.json are deliberately absent: the lock is what the
 /// install consumes.
@@ -2580,7 +2581,8 @@ mod tests {
     /// the patch host is outside the allowlist (no `hosted_claim`); only a
     /// LIVE `source "<patch registry>" do` block declaring rails keeps the
     /// record alive — the uuid in a `#` comment, inside `=begin` … `=end`,
-    /// or in a block for another gem used to (a raw substring scan).
+    /// or in a block for another gem must not (as a raw substring scan
+    /// would).
     #[tokio::test]
     async fn gemfile_liveness_reads_live_source_blocks_only() {
         let index = format!("https://patches.example.com/patch-registry/gem/{TOKEN}/{UUID_A}/");
@@ -2880,8 +2882,8 @@ mod tests {
 
     /// REGRESSION: a redirect ledger naming `deno.lock` (which no hosted
     /// writer edits — Deno has no rewriter) must not stay alive on the
-    /// user's own Socket-url import text there: the fallback used to treat
-    /// every unknown file as a pin, so `vex --no-verify` attested the
+    /// user's own Socket-url import text there: a fallback that treated
+    /// every unknown file as a pin would let `vex --no-verify` attest the
     /// forged record. `deno.json(c)` likewise.
     #[tokio::test]
     async fn hosted_ledger_proof_never_trusts_deno_files() {
@@ -3012,7 +3014,7 @@ mod tests {
             !vendored_wiring_live(root, &["package-lock.json"], "npm", UUID_A).await,
             "an existing recorded wiring file that was reverted is authoritative"
         );
-        // cargo's wiring lives in the config, not Cargo.lock.
+        // Pre-v5 cargo wiring lives in the cargo config, not Cargo.lock.
         let c = Project::new();
         c.write(
             ".cargo/config.toml",
diff --git a/crates/socket-patch-core/src/vex/discover/testing/golden.rs b/crates/socket-patch-core/src/vex/discover/testing/golden.rs
index 8af57ab9..9ddae973 100644
--- a/crates/socket-patch-core/src/vex/discover/testing/golden.rs
+++ b/crates/socket-patch-core/src/vex/discover/testing/golden.rs
@@ -23,7 +23,8 @@
 //! ```
 //!
 //! Unix only: Windows checkouts convert some fixtures' line endings (only
-//! `redirect/**`, `pdm-native/*.lock` and `pnpm-hosted/**` are `-text`),
+//! `redirect/**`, `pdm-native/*.lock`, `pnpm-hosted/**` and `vlt-locks/**`
+//! among the corpus trees are `-text`),
 //! and I/O error texts differ, so the snapshot would describe different
 //! inputs. The Unix legs (Linux + macOS) pin the behavior.
 //!
diff --git a/crates/socket-patch-core/src/vex/discover/vlt.rs b/crates/socket-patch-core/src/vex/discover/vlt.rs
index e62e94ef..2f9b38ce 100644
--- a/crates/socket-patch-core/src/vex/discover/vlt.rs
+++ b/crates/socket-patch-core/src/vex/discover/vlt.rs
@@ -71,7 +71,7 @@
 //! and whatever it mentions is recognized as unwired (rule 11). The canonical
 //! one-entry-per-line layout is not required here (the writers check it).
 //!
-//! Non-goals: nested `*/vlt-lock.json` (a separate project, DESIGN D3), the
+//! Non-goals: nested `*/vlt-lock.json` (a separate project with its own root), the
 //! hidden `node_modules/.vlt-lock.json` (install state, not wiring) and
 //! `vlt.json` as wiring (it is read only for its `modifiers`, above).
 
diff --git a/crates/socket-patch-core/src/vex/product.rs b/crates/socket-patch-core/src/vex/product.rs
index 552bd056..618a1ebf 100644
--- a/crates/socket-patch-core/src/vex/product.rs
+++ b/crates/socket-patch-core/src/vex/product.rs
@@ -873,8 +873,7 @@ mod tests {
 
     /// Regression: a malformed `url ...` line WITHOUT an `=` must be
     /// skipped, allowing a later well-formed `url = ...` line in the
-    /// same section to still be picked up. (Previously the `?` on the
-    /// `=` strip aborted the whole function, returning None.)
+    /// same section to still be picked up.
     #[test]
     fn scan_origin_url_skips_malformed_url_line_then_finds_valid_one() {
         let cfg = "[remote \"origin\"]\n\turl no-equals-here\n\turl = git@github.com:foo/bar.git\n";
@@ -1129,7 +1128,7 @@ mod tests {
     }
 
     /// `package.json` with only `version` (no `name`) → None.
-    /// Currently the early `is_empty()` branch in `read_package_json`.
+    /// Exercises the `v.get("name")?` early return in `parse_package_json`.
     #[tokio::test]
     async fn package_json_missing_name_returns_none() {
         let dir = tempfile::tempdir().unwrap();
@@ -1326,16 +1325,12 @@ mod tests {
     }
 
     /// `[remote "origin"]` block has a line that starts with `url`
-    /// but has no `=` (e.g. `url ` then EOL). The `strip_prefix('=')?`
-    /// inside `scan_remote_origin_url` returns None and the scanner
-    /// continues — eventually exhausting the section with no url.
+    /// but has no `=` (e.g. `url ` then EOL). The scanner skips it
+    /// (`split_once('=')` → `continue`) and exhausts the section with no
+    /// url.
     #[test]
     fn scan_origin_url_skips_url_line_without_equals_sign() {
         let cfg = "[remote \"origin\"]\n\turl no-equals-here\n";
-        // The `url` line has no `=`, so the scanner returns None
-        // from the inner `strip_prefix('=')?` — but per the code
-        // shape (line 224 with `?` on an Option), that propagates
-        // out of `scan_remote_origin_url` as None.
         assert!(scan_remote_origin_url(cfg).is_none());
     }
 
@@ -1356,9 +1351,8 @@ mod tests {
 
     /// Regression: a remote URL carrying BOTH a `.git` suffix AND a
     /// trailing slash (`https://github.com/owner/repo.git/`) must still
-    /// normalize to `pkg:github/owner/repo`. Previously `.git` was
-    /// stripped before the slash was trimmed, so the strip no-opped and
-    /// the PURL kept `repo.git`.
+    /// normalize to `pkg:github/owner/repo` — the slash must be trimmed
+    /// before `.git` is stripped.
     #[test]
     fn remote_url_dotgit_with_trailing_slash_is_normalized() {
         assert_eq!(
@@ -1407,8 +1401,7 @@ mod tests {
     /// Regression: when the highest-priority manifest is present but
     /// fails to parse (invalid JSON), detection falls through to the
     /// next manifest — and the warning must name the manifest ACTUALLY
-    /// used, not the one that failed. Previously the warning hard-coded
-    /// `found[0]` ("package.json") even though Cargo.toml was used.
+    /// used, not the one that failed (not `found[0]`).
     #[tokio::test]
     async fn multi_manifest_warning_names_actually_used_manifest() {
         let dir = tempfile::tempdir().unwrap();
@@ -1442,11 +1435,9 @@ mod tests {
     // (it would name a manifest that wasn't actually used).
     // ── Regression: TOML single-quoted (literal) string values ────────
     // TOML permits `key = 'value'` (literal strings) as well as
-    // `key = "value"`. The scanner previously only accepted the
-    // double-quoted form, so a manifest written with single quotes
-    // (common with cargo-edit / hand-edited files) yielded None and
-    // product detection silently failed. Mirrors the cargo-crawler
-    // single-quote fix.
+    // `key = "value"`, so a manifest written with single quotes (common
+    // with cargo-edit / hand-edited files) must still yield a product.
+    // Mirrors the cargo crawler's single-quote handling.
 
     /// `parse_toml_string_kv`: single-quoted literal value is accepted.
     #[test]
@@ -1503,7 +1494,7 @@ mod tests {
     }
 
     /// End-to-end: a `Cargo.toml` with single-quoted name/version still
-    /// produces a cargo PURL (previously returned None).
+    /// produces a cargo PURL.
     #[tokio::test]
     async fn detect_cargo_toml_single_quoted() {
         let dir = tempfile::tempdir().unwrap();
diff --git a/crates/socket-patch-core/src/vex/schema.rs b/crates/socket-patch-core/src/vex/schema.rs
index b9172d79..0a6c8818 100644
--- a/crates/socket-patch-core/src/vex/schema.rs
+++ b/crates/socket-patch-core/src/vex/schema.rs
@@ -632,8 +632,7 @@ mod tests {
     /// OpenVEX 0.2.0 — it cascades from the document when omitted. A
     /// spec-valid statement that leaves it out (the canonical spec
     /// example does exactly this for a `fixed` statement) MUST parse,
-    /// not error with "missing field `timestamp`". Previously the
-    /// field was a required `String`, so this document was rejected.
+    /// not error with "missing field `timestamp`".
     #[test]
     fn statement_without_timestamp_parses_and_leaves_it_none() {
         let doc_json = r#"{
diff --git a/crates/socket-patch-core/src/vex/verify.rs b/crates/socket-patch-core/src/vex/verify.rs
index bcae0141..3227b7e2 100644
--- a/crates/socket-patch-core/src/vex/verify.rs
+++ b/crates/socket-patch-core/src/vex/verify.rs
@@ -215,10 +215,11 @@ pub async fn applied_patches_with_vendor(
 /// "omit when unconfirmed" contract — it is reported as `no_files` and
 /// dropped from the VEX document rather than vacuously attested.
 ///
-/// `pub`: this is the ONE "is this installed tree patched?" oracle — the
-/// CLI's gem stale-install probe (`scan --mode hosted`) reuses it rather
-/// than growing a second copy of the all-files-AlreadyPatched + zero-file
-/// semantics that would inevitably drift.
+/// `pub`: this is the reference "is this installed tree patched?" oracle
+/// (all-files-AlreadyPatched + zero-file semantics); `vendor::pypi` calls it
+/// directly. The CLI's gem/python stale-install probes use its one-pass
+/// equivalent [`judge_installed_record`], which
+/// `judge_installed_record_matches_verify_and_evidence_scan` pins to it.
 pub async fn verify_patch_record(pkg_path: &Path, record: &PatchRecord) -> Result<(), String> {
     if record.files.is_empty() {
         return Err("no_files".to_string());
@@ -252,8 +253,7 @@ pub struct InstalledRecordJudgment {
 }
 
 /// [`verify_patch_record`] and the stale-evidence scan in ONE blocking-pool
-/// task, hashing each record file at most once (the pair used to hash the
-/// same files twice, each 8 KiB read its own runtime hop). Stops at the
+/// task, hashing each record file at most once. Stops at the
 /// first file that proves staleness — which also settles `patched` —
 /// exactly where both scans agree.
 pub async fn judge_installed_record(
diff --git a/crates/socket-patch-core/tests/api_retry_e2e.rs b/crates/socket-patch-core/tests/api_retry_e2e.rs
index 42d05eac..26325f28 100644
--- a/crates/socket-patch-core/tests/api_retry_e2e.rs
+++ b/crates/socket-patch-core/tests/api_retry_e2e.rs
@@ -344,7 +344,7 @@ async fn batch_post_503_retries_then_succeeds_or_reports() {
     assert_eq!(waits(&log).len(), 3);
 }
 
-/// 401, 403, 404, 400 and 500 are answered once: never retried, and 401 /
+/// 401, 403, 404, 400, 500 and 502 are answered once: never retried, and 401 /
 /// 403 still classify as the proxy-fallback candidates they were.
 #[tokio::test]
 async fn other_statuses_are_not_retried() {
diff --git a/crates/socket-patch-core/tests/binary_fetch_error_classification_e2e.rs b/crates/socket-patch-core/tests/binary_fetch_error_classification_e2e.rs
index 0ea1bd45..2e9dd3c7 100644
--- a/crates/socket-patch-core/tests/binary_fetch_error_classification_e2e.rs
+++ b/crates/socket-patch-core/tests/binary_fetch_error_classification_e2e.rs
@@ -1,12 +1,11 @@
-//! Regression: the binary transport path (`fetch_blob` / `fetch_diff`,
-//! both sharing `fetch_binary`) must classify authenticated
-//! 401 / 403 / 429 responses the same way the JSON path does.
+//! The binary transport path (`fetch_blob` / `fetch_diff`, both sharing
+//! `fetch_binary`) must classify authenticated 401 / 403 / 429 responses the
+//! same way the JSON path does.
 //!
-//! Before the fix, `fetch_binary` collapsed every non-OK/404 status into
-//! `ApiError::Other`. That defeated `is_fallback_candidate` (which keys on
-//! `Unauthorized` / `Forbidden`) so a stale/revoked token blocked binary
-//! downloads instead of rerouting to the public proxy, and the tailored
-//! 401/403/429 operator messages were lost.
+//! Collapsing them into `ApiError::Other` would defeat `is_fallback_candidate`
+//! (which keys on `Unauthorized` / `Forbidden`), so a stale/revoked token would
+//! block binary downloads instead of rerouting to the public proxy, and the
+//! tailored 401/403/429 operator messages would be lost.
 //!
 //! These tests drive the *authenticated* `fetch_binary` branch (token + org
 //! slug, not public-proxy) against a mock server, so they exercise exactly the
@@ -112,7 +111,7 @@ async fn fetch_blob_429_classifies_as_rate_limited_and_not_fallback() {
 #[tokio::test]
 async fn fetch_blob_500_still_classifies_as_other() {
     // Genuine server errors must keep flowing through to `Other` with the
-    // status code embedded — the fix must not over-classify.
+    // status code embedded — the classification must not over-reach.
     let server = MockServer::start().await;
     Mock::given(method("GET"))
         .and(path(format!("/v0/orgs/my-org/patches/blob/{VALID_HASH}")))
diff --git a/crates/socket-patch-core/tests/blob_fetcher_edges_e2e.rs b/crates/socket-patch-core/tests/blob_fetcher_edges_e2e.rs
index f4d4a239..a4591bd5 100644
--- a/crates/socket-patch-core/tests/blob_fetcher_edges_e2e.rs
+++ b/crates/socket-patch-core/tests/blob_fetcher_edges_e2e.rs
@@ -262,7 +262,7 @@ fn download_mode_as_tag_round_trips_with_parse() {
 /// `fetch_blobs_by_hash` with a hash whose blob is already on disk
 /// short-circuits the network call and reports `skipped: 1`, leaving the
 /// existing file byte-for-byte untouched. Covers the `skip if already on
-/// disk` branch (~L184-206).
+/// disk` branch.
 #[tokio::test]
 async fn fetch_blobs_by_hash_skips_existing_blobs() {
     let tmp = tempfile::tempdir().unwrap();
diff --git a/crates/socket-patch-core/tests/covgap_api_blob_fetcher.rs b/crates/socket-patch-core/tests/covgap_api_blob_fetcher.rs
index 8d495238..460bb2e6 100644
--- a/crates/socket-patch-core/tests/covgap_api_blob_fetcher.rs
+++ b/crates/socket-patch-core/tests/covgap_api_blob_fetcher.rs
@@ -1,5 +1,5 @@
 //! Coverage-gap tests for `api::blob_fetcher`'s never-executed error
-//! branches (audit of commit d5e1815):
+//! branches:
 //!
 //! * an uncreatable cache directory — the dir is created by the first
 //!   verified download inside `write_cache_entry_atomic`, never up front,
@@ -7,11 +7,10 @@
 //!   fetch that lands nothing leaves no `.socket/blobs/` husk — driven
 //!   cross-platform via ENOTDIR (the target directory is routed *through
 //!   a regular file*, which fails even as root, unlike permission tricks);
-//! * the blob-download loop's progress callback (~471) — the diff-loop
+//! * the blob-download loop's progress callback — the diff-loop
 //!   twin is tested in `blob_fetcher_edges_e2e.rs`, this one never ran;
-//! * the "Failed to write blob/archive to disk" arms (~501-508,
-//!   ~306-313) where the download succeeded but the atomic cache write
-//!   failed (unix-only, read-only directory);
+//! * the "Failed to write blob/archive to disk" arms where the download
+//!   succeeded but the atomic cache write failed (unix-only, read-only directory);
 //! * mixed-outcome aggregation across `download_hashes` arms — each arm
 //!   is individually covered by the sibling suite, but a single run
 //!   combining success + 404 + hash-mismatch never was.
diff --git a/crates/socket-patch-core/tests/covgap_crawlers_npm_crawler.rs b/crates/socket-patch-core/tests/covgap_crawlers_npm_crawler.rs
index c67b077f..298999e5 100644
--- a/crates/socket-patch-core/tests/covgap_crawlers_npm_crawler.rs
+++ b/crates/socket-patch-core/tests/covgap_crawlers_npm_crawler.rs
@@ -1,7 +1,7 @@
-//! Coverage-gap integration tests for `crawlers::npm_crawler`: the audited
+//! Coverage-gap integration tests for `crawlers::npm_crawler`: the
 //! never-executed skip/fallback regions of the store walkers
 //! (`collect_nested_node_modules`, `collect_nested_store_entries`,
-//! `scan_scoped_packages`) and every reject/fallback gate of
+//! `gather_scoped_packages`) and every reject/fallback gate of
 //! `find_store_peer_variant_copies` (pnpm and vlt stores). Each test stages the real on-disk shape
 //! that reaches its region and asserts resolver/scan OUTPUT, not just
 //! survival. Companion to `crawler_npm_e2e.rs` (helpers mirrored from
diff --git a/crates/socket-patch-core/tests/crawler_cargo_e2e.rs b/crates/socket-patch-core/tests/crawler_cargo_e2e.rs
index 37825dad..50fafc9f 100644
--- a/crates/socket-patch-core/tests/crawler_cargo_e2e.rs
+++ b/crates/socket-patch-core/tests/crawler_cargo_e2e.rs
@@ -76,8 +76,7 @@ fn parse_cargo_toml_malformed_returns_none() {
 
 /// Parser must stop scanning when it leaves the `[package]` table.
 /// A `name =` or `version =` line under a later table must NOT be
-/// picked up. Covers the "left package section" early-break arm
-/// (cargo_crawler.rs:34-36).
+/// picked up. Covers the "left package section" early-break arm.
 #[test]
 #[serial_test::parallel]
 fn parse_cargo_toml_stops_at_next_section() {
@@ -427,7 +426,7 @@ async fn get_crate_source_paths_no_cargo_project_returns_empty() {
 /// Crate directory whose Cargo.toml has `version.workspace = true`
 /// (no concrete `version =` field) — the crawler must fall back to
 /// parsing `<name>-<version>` from the directory name. Exercises
-/// `parse_dir_name_version` (cargo_crawler.rs:357-372).
+/// `parse_dir_name_version`.
 #[tokio::test]
 #[serial_test::parallel]
 async fn crawl_all_falls_back_to_dir_name_when_workspace_version() {
@@ -474,7 +473,7 @@ async fn crawl_all_skips_dir_without_cargo_toml() {
 
 /// `verify_crate_at_path`'s fallback path: Cargo.toml has workspace
 /// version, find_by_purls compares dir name. Exercises the
-/// fallback arm in `verify_crate_at_path` (L335-L348).
+/// fallback arm in `verify_crate_at_path`.
 #[tokio::test]
 #[serial_test::parallel]
 async fn find_by_purls_verify_fallback_via_dir_name() {
@@ -504,7 +503,7 @@ async fn find_by_purls_verify_fallback_via_dir_name() {
 }
 
 /// `version.workspace = true` in a top-level `[package]` block must
-/// bail (line 49-52): the crawler can't infer the actual version from
+/// bail: the crawler can't infer the actual version from
 /// just this file. `find_by_purls` then has to fall back to dir-name
 /// parsing — but `parse_cargo_toml_name_version` itself must return
 /// None up front.
@@ -521,8 +520,7 @@ fn parse_cargo_toml_version_workspace_returns_none() {
 /// staged `sha-1/` dir itself: its manifest bails (workspace version)
 /// and its dir name parses as ("sha", "1") ≠ ("sha-1", "0.10.6"), so
 /// the version cannot be confirmed and the crate must be rejected.
-/// Exercises the `n == name && v == version` false arm
-/// (cargo_crawler.rs:349).
+/// Exercises the `n == name && v == version` false arm.
 #[tokio::test]
 #[serial_test::parallel]
 async fn find_by_purls_verify_fallback_dir_name_mismatch_returns_empty() {
@@ -547,7 +545,7 @@ async fn find_by_purls_verify_fallback_dir_name_mismatch_returns_empty() {
 }
 
 /// Hidden directory entries inside the crate source root must be
-/// skipped by `scan_crate_source` (line 274).
+/// skipped by `scan_crate_source`.
 #[tokio::test]
 #[serial_test::parallel]
 async fn crawl_all_skips_hidden_dirs() {
@@ -579,8 +577,8 @@ async fn crawl_all_skips_hidden_dirs() {
     );
 }
 
-/// `read_crate_cargo_toml` early-returns when the purl has already
-/// been recorded in `seen` (line 310-311). Drive this by staging two
+/// `scan_crate_source` skips a crate whose purl is already in `seen`
+/// (the `seen.insert` continue arm). Drive this by staging two
 /// registry dirs for the same crate — the second one is deduped.
 #[tokio::test]
 #[serial_test::parallel]
@@ -617,7 +615,7 @@ async fn crawl_all_dedups_same_purl() {
 /// `get_crate_source_paths` in local mode without a vendor dir but
 /// with a Cargo.toml falls through to `get_registry_src_paths`. With
 /// CARGO_HOME pointed at an empty tempdir, the registry/src subdir
-/// doesn't exist → returns empty. Covers line 130.
+/// doesn't exist → returns empty.
 #[tokio::test]
 #[serial_test::serial]
 async fn get_crate_source_paths_local_cargo_toml_falls_back_to_registry() {
@@ -649,7 +647,7 @@ async fn get_crate_source_paths_local_cargo_toml_falls_back_to_registry() {
 }
 
 /// `scan_crate_source` must skip plain-file entries inside the source
-/// path — covers `!ft.is_dir()` continue arm (cargo_crawler.rs:266).
+/// path — covers its `!entry.is_dir` continue arm.
 #[tokio::test]
 #[serial_test::parallel]
 async fn crawl_all_skips_top_level_files() {
@@ -673,7 +671,7 @@ async fn crawl_all_skips_top_level_files() {
 /// A crate directory with a broken `Cargo.toml` AND a non-conforming
 /// directory name → `parse_cargo_toml_name_version` returns None
 /// (broken toml) AND `parse_dir_name_version` returns None (no `-`
-/// followed by digit), so the chain short-circuits at line 304 and
+/// followed by digit), so the chain short-circuits and
 /// the package is silently skipped.
 #[tokio::test]
 #[serial_test::parallel]
@@ -737,8 +735,7 @@ async fn crawl_all_handles_unreadable_src_path() {
 /// `pkg:cargo/foo@1.0.0` is the staged `foo/` dir itself: its
 /// Cargo.toml is unparseable and `foo` has no `-<digit>` boundary, so
 /// both parsers fail and the crate must be rejected — exercises the
-/// dir-name-fallback `is_some_and` short-circuit on `None`
-/// (cargo_crawler.rs:346-349).
+/// dir-name-fallback `is_some_and` short-circuit on `None`.
 #[tokio::test]
 #[serial_test::parallel]
 async fn find_by_purls_verify_fails_when_both_parsers_fail() {
@@ -761,7 +758,7 @@ async fn find_by_purls_verify_fails_when_both_parsers_fail() {
 }
 
 /// Same as above but with a registry/src tree staged — the discovered
-/// index dirs must surface. Covers lines 228-235 (entry walk).
+/// index dirs must surface (entry walk).
 #[tokio::test]
 #[serial_test::serial]
 async fn get_crate_source_paths_local_cargo_toml_with_registry_src() {
diff --git a/crates/socket-patch-core/tests/crawler_composer_e2e.rs b/crates/socket-patch-core/tests/crawler_composer_e2e.rs
index 4122b5eb..bb78f6ae 100644
--- a/crates/socket-patch-core/tests/crawler_composer_e2e.rs
+++ b/crates/socket-patch-core/tests/crawler_composer_e2e.rs
@@ -360,7 +360,7 @@ async fn get_vendor_paths_local_full_setup_returns_vendor() {
 // ── global mode discovery ──────────────────────────────────────
 
 /// `get_vendor_paths(global=true, global_prefix=None)` falls through to
-/// `get_global_vendor_paths` which checks `COMPOSER_HOME` env var.
+/// `get_composer_home`, which checks `COMPOSER_HOME` first.
 /// Stubbing it to a fixture root with `<root>/vendor/` populated must
 /// surface that path.
 #[tokio::test]
@@ -498,9 +498,9 @@ async fn get_vendor_paths_global_via_home_xdg_config_composer_fallback() {
 
 /// `get_composer_home` returns `None` when COMPOSER_HOME is unset,
 /// `composer` is not on PATH, and HOME points at a tempdir without
-/// either `.composer/` or `.config/composer/`. Covers the L194-207
-/// shell-out failure path (via PATH stubbing) plus the final L226
-/// `None` arm.
+/// either `.composer/` or `.config/composer/`. Covers the `composer
+/// global config home` shell-out failure path (via PATH stubbing) plus
+/// the final `None` arm.
 #[tokio::test]
 #[serial_test::serial]
 async fn get_vendor_paths_global_no_composer_no_home_layout_returns_empty() {
@@ -549,7 +549,7 @@ async fn get_vendor_paths_global_no_composer_no_home_layout_returns_empty() {
 /// `.composer` / `.config/composer` platform-default probes into
 /// CWD-relative paths, so a `.composer/vendor/` directory inside the
 /// user's project gets scanned as if it were the global composer home.
-/// Twin of the `utils::fs::home_dir` empty-HOME fix.
+/// Twin of the `utils::fs::home_dir` empty-HOME handling.
 #[tokio::test]
 #[serial_test::serial]
 async fn get_vendor_paths_global_empty_home_not_cwd_relative() {
@@ -665,7 +665,7 @@ async fn find_by_purls_handles_unreadable_installed_json() {
 
 /// `crawl_all` should dedup packages discovered across multiple
 /// vendor paths sharing the same installed package — exercises the
-/// `seen.contains` early-continue arm.
+/// `seen.insert` dedup early-continue arm.
 #[tokio::test]
 #[serial_test::parallel]
 async fn crawl_all_dedups_across_vendor_paths() {
@@ -792,9 +792,8 @@ async fn config_vendor_dir_relocates_discovery() {
 }
 
 /// Composer accepts `./`-prefixed vendor-dir values (`./lib/deps`); refusing
-/// the `.` segment outright regressed such projects to zero discovery, worse
-/// than the old hardcoded `vendor/`. The normalizer reduces the value before
-/// the safety gate.
+/// the `.` segment outright would drop such projects to zero discovery. The
+/// normalizer reduces the value before the safety gate.
 #[tokio::test]
 #[serial_test::parallel]
 async fn config_vendor_dir_dot_prefix_is_normalized() {
@@ -1156,10 +1155,10 @@ async fn rejected_install_path_does_not_fall_back_to_conventional_dir() {
 /// The CLI defaults to `--cwd .`, so production discovery hands the crawler
 /// a RELATIVE vendor path (`./vendor`). `resolve_project_root` then
 /// normalizes the containment boundary to the EMPTY path — and every path,
-/// absolute ones included, `starts_with` the empty path — so the escape gate
-/// was vacuous in exactly the default invocation: a tampered installed.json
-/// entry with an ABSOLUTE `install-path` resolved out of tree and became a
-/// patch write target. `install_path_escaping_project_root_is_rejected`
+/// absolute ones included, `starts_with` the empty path — so a naive escape
+/// gate is vacuous in exactly the default invocation: a tampered
+/// installed.json entry with an ABSOLUTE `install-path` would resolve out of
+/// tree and become a patch write target. `install_path_escaping_project_root_is_rejected`
 /// above never sees this because its staged project root is absolute.
 #[tokio::test]
 #[serial_test::serial]
diff --git a/crates/socket-patch-core/tests/crawler_go_e2e.rs b/crates/socket-patch-core/tests/crawler_go_e2e.rs
index cca1a08f..157ca1f0 100644
--- a/crates/socket-patch-core/tests/crawler_go_e2e.rs
+++ b/crates/socket-patch-core/tests/crawler_go_e2e.rs
@@ -206,7 +206,7 @@ async fn get_module_cache_paths_with_go_mod_returns_cache() {
 #[path = "common/mod.rs"]
 mod common;
 
-/// `scan_dir_recursive` short-circuits when read_dir returns Err.
+/// `scan_cache_sync` short-circuits when read_dir returns Err.
 #[cfg(unix)]
 #[tokio::test]
 #[serial_test::parallel]
@@ -267,7 +267,8 @@ async fn go_crawler_default_and_new_construct_cleanly() {
 }
 
 /// A `module` directive with no path (`module`) must not match — the
-/// guard at line 61 (`!rest.is_empty()`) keeps it from being returned.
+/// `!rest.is_empty()` guard in `parse_go_mod_module` keeps it from being
+/// returned.
 #[test]
 #[serial_test::parallel]
 fn parse_go_mod_module_directive_with_empty_path_returns_none() {
@@ -357,7 +358,7 @@ async fn crawl_all_finds_nested_versioned_module() {
 }
 
 /// `cache` directory inside the module cache is metadata, must be
-/// skipped (line 249 second arm).
+/// skipped (the root-level `cache` arm in `scan_cache_sync`).
 #[tokio::test]
 #[serial]
 async fn crawl_all_skips_cache_metadata_dir() {
@@ -395,7 +396,7 @@ async fn crawl_all_skips_cache_metadata_dir() {
 }
 
 /// With GOMODCACHE and GOPATH both unset, `get_gomodcache` falls
-/// through to `$HOME/go/pkg/mod` (lines 194-197).
+/// through to `$HOME/go/pkg/mod`.
 #[tokio::test]
 #[serial]
 async fn get_module_cache_paths_home_go_pkg_mod_fallback() {
diff --git a/crates/socket-patch-core/tests/crawler_maven_e2e.rs b/crates/socket-patch-core/tests/crawler_maven_e2e.rs
index 5649b704..0b4ee097 100644
--- a/crates/socket-patch-core/tests/crawler_maven_e2e.rs
+++ b/crates/socket-patch-core/tests/crawler_maven_e2e.rs
@@ -103,7 +103,7 @@ fn parse_pom_empty_string_returns_none() {
 
 /// Parent block supplies groupId when the project block doesn't —
 /// exercise the `in_parent` arm that records `parent_group_id` and the
-/// final `group_id.or(parent_group_id)` fallback (maven_crawler.rs:124).
+/// final `group_id.or(parent_group_id)` fallback.
 #[test]
 #[serial_test::parallel]
 fn parse_pom_parent_groupid_fallback() {
@@ -130,7 +130,7 @@ fn parse_pom_parent_groupid_fallback() {
 
 /// Top-level `<groupId>${env.GROUP_ID}</groupId>` is a property
 /// reference — the parser must bail out instead of treating the
-/// literal placeholder as a value (line 100).
+/// literal placeholder as a value.
 #[test]
 #[serial_test::parallel]
 fn parse_pom_property_reference_groupid_returns_none() {
@@ -167,9 +167,7 @@ fn parse_pom_property_reference_version_returns_none() {
     assert_eq!(parse_pom_group_artifact_version(pom), None);
 }
 
-/// `<parent><groupId>${prop}</groupId></parent>` is a parent property
-/// reference — must NOT be accepted as a fallback groupId (line 86-87
-/// skip arm).
+/// A pom with no `<artifactId>` yields no coordinate.
 #[test]
 #[serial_test::parallel]
 fn parse_pom_missing_artifact_id_returns_none() {
@@ -182,9 +180,9 @@ fn parse_pom_missing_artifact_id_returns_none() {
 }
 
 /// An XML element rendered across two lines (open on one, close on
-/// another) — `extract_xml_value` returns None for both, the parser
-/// can't extract a value, and the function returns None. Drives
-/// `extract_xml_value` line 16 (close-tag not found on same line).
+/// another) — the per-line matcher (`xml_value_needles`) finds no
+/// closing tag on the same line, the parser can't extract a value, and
+/// the function returns None.
 #[test]
 #[serial_test::parallel]
 fn parse_pom_split_tag_returns_none() {
@@ -211,7 +209,7 @@ fn maven_crawler_default_and_new_construct_cleanly() {
 /// `m2_repo_path` falls through to `$HOME/.m2/repository` when neither
 /// MAVEN_REPO_LOCAL nor M2_HOME is set. We can't exercise this directly
 /// (private fn) but can drive it via `get_maven_repo_paths` with a
-/// build.gradle marker and both env vars cleared. The crawler should
+/// pom.xml marker and both env vars cleared. The crawler should
 /// then point at the staged `<HOME>/.m2/repository`.
 #[tokio::test]
 #[serial]
@@ -258,7 +256,7 @@ async fn get_maven_repo_paths_home_dot_m2_fallback() {
 }
 
 /// `get_maven_repo_paths(global=true)` with a real m2 layout under
-/// MAVEN_REPO_LOCAL returns just that repo (lines 205-208).
+/// MAVEN_REPO_LOCAL returns just that repo.
 #[tokio::test]
 #[serial]
 async fn get_maven_repo_paths_global_mode_with_maven_repo_local() {
@@ -288,7 +286,7 @@ async fn get_maven_repo_paths_global_mode_with_maven_repo_local() {
 
 /// `get_maven_repo_paths(global=true)` with no env vars set and no
 /// HOME/.m2 either — `is_dir` check fails and the crawler returns
-/// empty (line 209).
+/// empty.
 #[tokio::test]
 #[serial]
 async fn get_maven_repo_paths_global_mode_no_m2_returns_empty() {
@@ -355,6 +353,8 @@ async fn find_by_purls_version_dir_without_pom_returns_empty() {
     assert!(result.is_empty(), "missing .pom must skip the package");
 }
 
+/// `<parent><groupId>${prop}</groupId></parent>` is a parent property
+/// reference — must NOT be accepted as a fallback groupId.
 #[test]
 #[serial_test::parallel]
 fn parse_pom_parent_property_reference_groupid_skipped() {
diff --git a/crates/socket-patch-core/tests/crawler_monorepo_gaps.rs b/crates/socket-patch-core/tests/crawler_monorepo_gaps.rs
index c0fe5d8e..e7fe1eb2 100644
--- a/crates/socket-patch-core/tests/crawler_monorepo_gaps.rs
+++ b/crates/socket-patch-core/tests/crawler_monorepo_gaps.rs
@@ -7,7 +7,7 @@
 //! with its own lockfile / installed packages in a subdir — crawling from the
 //! repo root therefore finds none of them.
 //!
-//! Gem is the representative here (the case the request named); python
+//! Gem is the representative here; python
 //! (multiple `.venv`), go (multiple `go.mod`), and composer (multiple
 //! `composer.json`) share the identical cwd-only limitation.
 //!
diff --git a/crates/socket-patch-core/tests/crawler_npm_e2e.rs b/crates/socket-patch-core/tests/crawler_npm_e2e.rs
index cd73f644..6aa419da 100644
--- a/crates/socket-patch-core/tests/crawler_npm_e2e.rs
+++ b/crates/socket-patch-core/tests/crawler_npm_e2e.rs
@@ -542,16 +542,15 @@ async fn find_by_purls_resolves_qualified_purl_keyed_by_input() {
     assert_eq!(pkg.purl, qualified);
 }
 
-/// Regression: a qualifier value that itself contains an `@`
+/// A qualifier value that itself contains an `@`
 /// (`?vcs_url=git@github.com:...`) must NOT corrupt version parsing.
 /// `parse_purl_components` strips the `?qualifier` *before* it calls
 /// `rfind('@')` to split name from version. If those two steps were
 /// reordered, `rfind('@')` would latch onto the `@` inside `git@github`
 /// and parse a bogus version (`github.com:...`), so the package would
 /// fail to match its on-disk `1.0.0` and silently drop out of
-/// apply/rollback. The existing qualified-PURL tests only use
-/// qualifiers WITHOUT an `@`, so they cannot catch a strip-order
-/// regression — this pins it.
+/// apply/rollback. The other qualified-PURL tests only use qualifiers
+/// WITHOUT an `@`, so this is the one that pins the strip order.
 #[tokio::test]
 #[serial_test::parallel]
 async fn find_by_purls_qualifier_containing_at_does_not_corrupt_version() {
@@ -586,7 +585,7 @@ async fn find_by_purls_qualifier_containing_at_does_not_corrupt_version() {
 }
 
 /// PURL with no `@` (no version separator) must be rejected via the
-/// `rfind('@')?` arm (line 707).
+/// `rfind('@')?` arm.
 #[tokio::test]
 #[serial_test::parallel]
 async fn find_by_purls_purl_without_at_skipped() {
@@ -601,7 +600,7 @@ async fn find_by_purls_purl_without_at_skipped() {
 }
 
 /// PURL with `@` but an empty version (`pkg:npm/lodash@`) — covers the
-/// `version.is_empty()` arm at line 711-712.
+/// `version.is_empty()` arm.
 #[tokio::test]
 #[serial_test::parallel]
 async fn find_by_purls_purl_with_empty_version_skipped() {
@@ -616,7 +615,7 @@ async fn find_by_purls_purl_with_empty_version_skipped() {
 }
 
 /// PURL with scope marker but no slash (`pkg:npm/@foo@1.0`) — covers
-/// the `find('/')?` arm at line 716.
+/// the scoped-namespace `find('/')` split.
 #[tokio::test]
 #[serial_test::parallel]
 async fn find_by_purls_scoped_purl_without_slash_skipped() {
@@ -631,7 +630,7 @@ async fn find_by_purls_scoped_purl_without_slash_skipped() {
 }
 
 /// Scoped PURL with empty name after slash (`pkg:npm/@scope/@1.0`) —
-/// covers the `if name.is_empty()` arm at line 719-720.
+/// covers the `name.is_empty()` arm.
 #[tokio::test]
 #[serial_test::parallel]
 async fn find_by_purls_scoped_purl_with_empty_name_skipped() {
@@ -794,7 +793,7 @@ async fn crawl_all_skips_hidden_and_skip_dirs() {
 #[path = "common/mod.rs"]
 mod common;
 
-/// `scan_node_modules` short-circuits when read_dir returns Err.
+/// `gather_node_modules` short-circuits when read_dir returns Err.
 #[cfg(unix)]
 #[tokio::test]
 #[serial_test::parallel]
@@ -820,8 +819,8 @@ async fn crawl_all_handles_unreadable_node_modules() {
 }
 
 /// `find_workspace_node_modules` short-circuits cleanly when it
-/// encounters an unreadable workspace subdir — drives the read_dir
-/// Err arm at npm_crawler.rs:440-441 by chmod 000-ing one workspace
+/// encounters an unreadable workspace subdir — drives its
+/// unreadable-dir arm by chmod 000-ing one workspace
 /// while leaving a readable one alongside.
 #[cfg(unix)]
 #[tokio::test]
@@ -859,8 +858,7 @@ async fn crawl_all_handles_unreadable_workspace_dir() {
 }
 
 /// Drives scoped-package scanning + nested node_modules recursion +
-/// the hidden-and-file-entries skip arms inside `scan_scoped_packages`
-/// and `scan_nested_node_modules`. Covers L552, 581-604, 619-665.
+/// the hidden-and-file-entries skip arms of both walks.
 #[tokio::test]
 #[serial_test::parallel]
 async fn crawl_all_handles_nested_and_messy_scope_dir() {
@@ -868,15 +866,15 @@ async fn crawl_all_handles_nested_and_messy_scope_dir() {
     let nm = tmp.path().join("node_modules");
 
     // Regular package with its own nested node_modules containing another
-    // package — exercises the unscoped → scan_nested_node_modules path.
+    // package — exercises the unscoped → nested node_modules path.
     stage_npm_pkg(&nm, "outer", "1.0.0").await;
     stage_npm_pkg(&nm.join("outer").join("node_modules"), "inner", "2.0.0").await;
 
-    // Scoped package — exercises scan_scoped_packages happy path.
+    // Scoped package — exercises the scoped-walk happy path.
     stage_npm_pkg(&nm, "@scope/scoped-pkg", "3.0.0").await;
 
-    // Scoped package WITH a nested node_modules → scan_nested_node_modules
-    // is reached from inside scan_scoped_packages (L599-604).
+    // Scoped package WITH a nested node_modules → the nested walk is
+    // reached from inside the scoped walk.
     stage_npm_pkg(
         &nm.join("@scope").join("scoped-pkg").join("node_modules"),
         "scoped-dep",
@@ -884,23 +882,23 @@ async fn crawl_all_handles_nested_and_messy_scope_dir() {
     )
     .await;
 
-    // Hidden subdir inside @scope — must be skipped (L581-583).
+    // Hidden subdir inside @scope — must be skipped.
     tokio::fs::create_dir_all(nm.join("@scope").join(".hidden"))
         .await
         .unwrap();
     // A plain file inside @scope — must be skipped via the !is_dir &&
-    // !is_symlink arm (L590-591).
+    // !is_symlink arm.
     tokio::fs::write(nm.join("@scope").join("README.md"), b"x")
         .await
         .unwrap();
     // A plain file at top of node_modules too — exercises the same arm
-    // in scan_node_modules.
+    // in the top-level walk.
     tokio::fs::write(nm.join("top-level-file.txt"), b"y")
         .await
         .unwrap();
 
-    // Nested node_modules with a scoped subentry — drives the L650-653 arm
-    // (nested → scan_scoped_packages).
+    // Nested node_modules with a scoped subentry — drives the
+    // nested → scoped arm.
     stage_npm_pkg(
         &nm.join("outer").join("node_modules"),
         "@nest/leaf",
@@ -1009,15 +1007,14 @@ async fn crawl_all_skips_dirs_with_corrupt_package_json() {
     assert!(result.is_empty());
 }
 
-/// Regression: a symlinked package inside a nested `node_modules` (the
+/// A symlinked package inside a nested `node_modules` (the
 /// shape pnpm and `npm link` produce — top-level entries are symlinks
 /// into a content-addressed store) must itself be recorded, but the
 /// crawler must NOT recurse *through* the symlink into the store. Doing
 /// so would surface store-internal packages that aren't part of the
 /// project's dependency tree and could escape the project root
-/// entirely. `scan_nested_node_modules` guards its deeper recursion with
-/// `if file_type.is_dir()`, matching its sibling scanners; this pins
-/// that behavior.
+/// entirely. The nested node_modules walk only descends into real
+/// directories (never through a symlink); this pins that behavior.
 #[cfg(unix)]
 #[tokio::test]
 #[serial_test::parallel]
@@ -1060,12 +1057,12 @@ async fn crawl_all_does_not_recurse_through_symlinked_nested_package() {
 
 // ── regression pins: metadata identity + nested lookup ─────────
 
-/// Regression: npm (and Node's own loader) strip a leading UTF-8 BOM from
+/// npm (and Node's own loader) strip a leading UTF-8 BOM from
 /// `package.json`, so a published package may legitimately ship one
 /// (Windows-authored packages do). `serde_json::from_str` rejects the BOM,
-/// which made the crawler silently skip the package — a vulnerable install
-/// invisible to `scan` and unpatchable by `apply`. Same class as the
-/// `strip_bom` fixes in `package_json/detect.rs`.
+/// so without stripping it the crawler would silently skip the package — a
+/// vulnerable install invisible to `scan` and unpatchable by `apply`. Same
+/// class as the `strip_bom` handling in `package_json/detect.rs`.
 #[tokio::test]
 #[serial_test::parallel]
 async fn read_package_json_tolerates_utf8_bom() {
@@ -1107,13 +1104,12 @@ async fn read_package_json_tolerates_utf8_bom() {
     );
 }
 
-/// Regression: `find_by_purls` verified only the *version* of the
-/// `package.json` it probed, never the *name*. An npm alias install
-/// (`npm i foo@npm:bar@1.0.0`) puts package `bar` in `node_modules/foo`;
-/// a patch for `foo@1.0.0` would then be "resolved" to bar's directory and
-/// applied to a completely different package's files (with the default
-/// mismatch policy applying the full patched blob of `foo` over `bar`).
-/// The probe must require the on-disk name to match the PURL identity.
+/// `find_by_purls` must verify the *name* of the probed `package.json`, not
+/// just its version. An npm alias install (`npm i foo@npm:bar@1.0.0`) puts
+/// package `bar` in `node_modules/foo`; a version-only probe would
+/// "resolve" a patch for `foo@1.0.0` to bar's directory and apply it to a
+/// completely different package's files (with the default mismatch policy
+/// applying the full patched blob of `foo` over `bar`).
 #[tokio::test]
 #[serial_test::parallel]
 async fn find_by_purls_rejects_alias_dir_with_matching_version() {
@@ -1160,13 +1156,12 @@ async fn find_by_purls_rejects_alias_dir_with_matching_version() {
     );
 }
 
-/// Regression: CLI_CONTRACT promises "deeply nested transitive dependencies
-/// are fully supported … `apply` is path-agnostic … patched identically to a
-/// direct one", and `crawl_all` (scan) discovers them at unbounded depth —
-/// but `find_by_purls` (apply's resolver) probed only the tree root, so a
-/// version that exists *only* nested (root holds a different major, the
-/// classic hoisting-conflict layout) was scannable yet unpatchable: apply
-/// reported "No packages found that match available patches".
+/// CLI_CONTRACT promises "deeply nested transitive dependencies are fully
+/// supported … `apply` is path-agnostic … patched identically to a direct
+/// one", and `crawl_all` (scan) discovers them at unbounded depth — so
+/// `find_by_purls` (apply's resolver) must too. A version that exists
+/// *only* nested (root holds a different major, the classic
+/// hoisting-conflict layout) must not be scannable yet unpatchable.
 #[tokio::test]
 #[serial_test::parallel]
 async fn find_by_purls_resolves_nested_only_install() {
@@ -1209,13 +1204,12 @@ async fn find_by_purls_resolves_nested_only_install() {
     assert_eq!(d[0].path, a_nm.join("@s").join("d"));
 }
 
-/// Regression: a FIFO planted at a `package.json` path must be skipped
-/// promptly, never opened blockingly. `tokio::fs::read_to_string` performs a
-/// plain `open(2)`, which on a FIFO waits for a writer that never comes — so
-/// one special file inside `node_modules` (a malicious package's postinstall
-/// can create one; npm itself never extracts FIFOs) wedged `scan`
-/// (crawl_all) and `apply` (find_by_purls) indefinitely, with no error and
-/// no timeout. Same class as the `open_regular_file` guards in
+/// A FIFO planted at a `package.json` path must be skipped promptly, never
+/// opened blockingly. A plain `open(2)` on a FIFO waits for a writer that
+/// never comes — so one special file inside `node_modules` (a malicious
+/// package's postinstall can create one; npm itself never extracts FIFOs)
+/// would wedge `scan` (crawl_all) and `apply` (find_by_purls) indefinitely,
+/// with no error and no timeout. Same class as the `open_regular_file` guards in
 /// `patch/file_hash.rs`, the cargo sidecar, and the vendor harvest/verify
 /// readers.
 #[cfg(unix)]
@@ -1384,10 +1378,10 @@ async fn stage_pnpm_isolated_tree(root: &Path) -> std::path::PathBuf {
     nm
 }
 
-/// Regression (pnpm 7–12, empirically confirmed): a transitive-only
-/// dependency living solely at `.pnpm/<x>/node_modules/<name>` was invisible
-/// to `find_by_purls` — apply reported `package_not_installed` for a package
-/// that is installed and runtime-loaded. The virtual store must be probed;
+/// pnpm 7–12: a transitive-only dependency living solely at
+/// `.pnpm/<x>/node_modules/<name>` must be visible to `find_by_purls`, or
+/// apply reports `package_not_installed` for a package that is installed
+/// and runtime-loaded. The virtual store must be probed;
 /// the name@version match keeps two store versions of one package distinct;
 /// the root-linked direct dep must still resolve at its importer-root path
 /// (BFS root-first); and the hoist-dir/hidden decoys must stay unreachable.
@@ -1468,8 +1462,8 @@ async fn find_by_purls_resolves_pnpm_virtual_store_transitives() {
     assert_eq!(result.len(), 4, "exactly the four real packages resolve");
 }
 
-/// Scan twin of the resolver regression: `crawl_all` skipped `.pnpm` as
-/// just-another-hidden-dir, so a transitive-only install never reached the
+/// Scan twin of the resolver test: `crawl_all` must not skip `.pnpm` as
+/// just-another-hidden-dir, or a transitive-only install never reaches the
 /// batch API request. Each package must be inventoried exactly once (the
 /// root pass wins the `seen` dedup for the root-linked direct dep; store
 /// entries are accepted only as real dirs so a sibling symlink cannot
@@ -1525,9 +1519,9 @@ async fn crawl_all_inventories_pnpm_virtual_store_exactly_once() {
 /// name decodes to a non-pending package (perf: a manifest routinely
 /// lists packages that simply aren't installed), but a target physically
 /// present ONLY inside such an entry must still resolve — the unfiltered
-/// fallback pass probes every entry for the leftovers. Pre-fix the filter
-/// was final, leaving these installed, scan-visible packages invisible to
-/// apply (fail-open).
+/// fallback pass probes every entry for the leftovers. A final filter
+/// would leave these installed, scan-visible packages invisible to apply
+/// (fail-open).
 #[tokio::test]
 #[serial_test::parallel]
 async fn find_by_purls_fallback_pass_probes_store_entries_decoding_to_other_names() {
@@ -1684,11 +1678,11 @@ async fn crawl_all_inventories_bundled_dep_under_seen_store_entry() {
     assert_eq!(result.len(), 2, "exactly host + bundled; got {names:?}");
 }
 
-/// Multi-copy P0: when the same `name@version` exists at the root *and*
+/// Multi-copy: when the same `name@version` exists at the root *and*
 /// nested, BOTH physical copies must be returned (patching only one leaves
 /// a live vulnerable copy — the silent partial). Root preference survives
-/// as ORDERING ONLY — the root copy leads the list so a caller needing one
-/// representative keeps the old behavior — never as a stop condition that
+/// as ORDERING ONLY — the root copy leads the list for a caller needing one
+/// representative — never as a stop condition that
 /// drops the nested duplicate.
 #[tokio::test]
 #[serial_test::parallel]
@@ -1819,13 +1813,12 @@ async fn stage_pnpm4_nested_tree(root: &Path) -> std::path::PathBuf {
     nm
 }
 
-/// Regression (empirically confirmed on a real pnpm 4.14.4 tree, same on
-/// synthetic pnpm-5): the `.pnpm` walk handled FLAT `name@version` entries
-/// only. The nested `registry.npmjs.org` child has no `node_modules`, the
-/// conservative fallback enqueued exactly `.pnpm/<entry>/node_modules`
-/// (one level), so a transitive-only dep was silently skipped — apply
-/// exited 0 claiming success while the file was never written. The nested
-/// descent must find it; a target hidden behind another entry's advertised
+/// pnpm 4/5 (layout captured from a real pnpm 4.14.4 tree): the `.pnpm`
+/// store nests entries under a `registry.npmjs.org` child that has no
+/// `node_modules`, so a walk of FLAT `name@version` entries only (one
+/// level of `.pnpm/<entry>/node_modules`) would silently skip a
+/// transitive-only dep and apply would exit 0 with nothing written. The
+/// nested descent must find it; a target hidden behind another entry's advertised
 /// name resolves via the unfiltered fallback pass; the cycle symlink must
 /// not hang the walk.
 #[cfg(unix)]
@@ -2013,11 +2006,11 @@ async fn stage_pnpm3_legacy_tree(root: &Path) -> std::path::PathBuf {
     nm
 }
 
-/// Regression (empirically confirmed on a real pnpm 3.8.1 tree; pnpm 1/2
-/// captures show the identical layout): pre-`.pnpm` pnpm hides the virtual
-/// store at `node_modules/.registry.npmjs.org`, which the walk skipped as
-/// just-another-hidden-dir — a transitive-only dep was unresolvable, apply
-/// exited 0 claiming success with nothing written.
+/// pnpm 1–3 (layout captured from a real pnpm 3.8.1 tree): pre-`.pnpm`
+/// pnpm hides the virtual store at `node_modules/.registry.npmjs.org`,
+/// which must not be skipped as just-another-hidden-dir — otherwise a
+/// transitive-only dep is unresolvable and apply exits 0 with nothing
+/// written.
 #[cfg(unix)]
 #[tokio::test]
 #[serial_test::parallel]
@@ -2096,12 +2089,11 @@ async fn crawl_all_inventories_pnpm3_legacy_registry_store_exactly_once() {
 
 // ── pnpm peer-variant duplicates & bundled-only targets ────────
 
-/// Regression (adversarial review, CONFIRMED): pnpm materializes one
-/// physical store copy PER PEER COMBINATION — `.pnpm/foo@1.0.0(react@17…)/`
-/// and `.pnpm/foo@1.0.0(react@18…)/` are both real dirs holding the same
-/// `foo@1.0.0`. The resolver hands apply ONE primary path (root-linked
-/// install wins), and apply used to patch only that copy — exiting 0
-/// claiming the CVE fixed while the twin stayed vulnerable and
+/// pnpm materializes one physical store copy PER PEER COMBINATION —
+/// `.pnpm/foo@1.0.0(react@17…)/` and `.pnpm/foo@1.0.0(react@18…)/` are both
+/// real dirs holding the same `foo@1.0.0`. The resolver hands apply ONE
+/// primary path (root-linked install wins); patching only that copy would
+/// exit 0 claiming the CVE fixed while the twin stays vulnerable and
 /// runtime-loaded. Apply must patch EVERY physical copy, rollback must
 /// restore every copy, and the copy-on-write break must protect the shared
 /// content-store inode per copy.
@@ -2235,8 +2227,8 @@ async fn apply_and_rollback_reach_every_pnpm_peer_variant_copy() {
     );
 }
 
-/// Healing half of the peer-variant regression: a pre-fix apply left the
-/// primary copy patched and the twin vulnerable. Re-running apply reports
+/// Healing half of the peer-variant test: a tree whose primary copy is
+/// patched and whose twin is still vulnerable. Re-running apply reports
 /// the primary AlreadyPatched — and must STILL patch the lagging twin
 /// instead of early-returning success.
 #[cfg(unix)]
@@ -2314,11 +2306,10 @@ async fn apply_heals_unpatched_pnpm_twin_when_primary_already_patched() {
     );
 }
 
-/// Regression (adversarial review, CONFIRMED): a target that exists ONLY
-/// as a bundled dependency inside another package's store entry
-/// (`.pnpm/host@1.0.0/node_modules/host/node_modules/leaf`) was invisible
-/// to the resolver — the pending-name filter skipped the `host@1.0.0`
-/// entry — while `crawl_all` (scan) listed it. After the filtered pass
+/// A target that exists ONLY as a bundled dependency inside another
+/// package's store entry (`.pnpm/host@1.0.0/node_modules/host/node_modules/leaf`)
+/// is skipped by the resolver's pending-name filter (it drops the
+/// `host@1.0.0` entry) while `crawl_all` (scan) lists it. After the filtered pass
 /// leaves targets unresolved, an unfiltered fallback pass must find them.
 #[tokio::test]
 #[serial_test::parallel]
diff --git a/crates/socket-patch-core/tests/crawler_nuget_e2e.rs b/crates/socket-patch-core/tests/crawler_nuget_e2e.rs
index 97ba15d5..2228e9a8 100644
--- a/crates/socket-patch-core/tests/crawler_nuget_e2e.rs
+++ b/crates/socket-patch-core/tests/crawler_nuget_e2e.rs
@@ -504,8 +504,8 @@ async fn crawl_all_handles_unreadable_pkg_path() {
 }
 
 /// `scan_global_cache_package` returns None when the per-name version
-/// directory is unreadable — drives the inner read_dir Err arm at
-/// nuget_crawler.rs:236.
+/// directory is unreadable — drives its empty-listing path
+/// (`list_dir_sync` on an unreadable dir).
 #[cfg(unix)]
 #[tokio::test]
 #[serial_test::parallel]
@@ -552,7 +552,7 @@ async fn crawl_all_handles_unreadable_version_dir() {
 }
 
 /// `scan_package_dir` skips entries that are not directories — covers
-/// the `if !ft.is_dir()` continue arm at L183. Drive this by staging
+/// `classify_package_entry`'s non-directory skip. Drive this by staging
 /// a plain file alongside a valid global-cache package.
 #[tokio::test]
 #[serial_test::parallel]
@@ -580,7 +580,7 @@ async fn crawl_all_skips_files_at_top_level() {
 }
 
 /// `scan_package_dir` short-circuits when the package dir doesn't
-/// exist — covers `read_dir(...).await` Err arm at L169.
+/// exist — covers its empty-listing path for a missing dir.
 #[tokio::test]
 #[serial_test::parallel]
 async fn crawl_all_missing_pkg_path_returns_empty() {
@@ -609,7 +609,7 @@ fn nuget_crawler_default_and_new_construct_cleanly() {
 
 /// `global=true` with no `global_prefix` falls through to `nuget_home`
 /// which honors NUGET_PACKAGES. When the resulting home exists, the
-/// crawler returns it as the only path (line 38-39).
+/// crawler returns it as the only path.
 #[tokio::test]
 #[serial]
 async fn get_nuget_package_paths_global_mode_returns_nuget_home() {
@@ -635,8 +635,7 @@ async fn get_nuget_package_paths_global_mode_returns_nuget_home() {
 }
 
 /// `global=true` but NUGET_PACKAGES points at a non-existent dir →
-/// `is_dir` check fails and the crawler returns an empty list
-/// (line 41).
+/// `is_dir` check fails and the crawler returns an empty list.
 #[tokio::test]
 #[serial]
 async fn get_nuget_package_paths_global_mode_missing_home_returns_empty() {
@@ -674,8 +673,8 @@ async fn get_nuget_package_paths_global_mode_missing_home_returns_empty() {
 }
 
 /// `is_dotnet_project` accepts a NuGet.Config marker without any
-/// project file extensions — covers the L355 `if name == "NuGet.Config"`
-/// branch.
+/// project file extensions — covers the case-insensitive `nuget.config`
+/// marker branch.
 #[tokio::test]
 #[serial]
 async fn get_nuget_package_paths_with_nuget_config_falls_back_to_global() {
@@ -852,7 +851,8 @@ async fn get_nuget_package_paths_assets_json_empty_packagefolders_yields_no_path
 }
 
 /// Malformed JSON in project.assets.json must not crash — discovery
-/// just skips it (line 442 `from_str.ok()?` arm).
+/// just skips it (the `from_str(...).ok()?` arm in
+/// `parse_project_assets_package_folders`).
 #[tokio::test]
 #[serial]
 async fn get_nuget_package_paths_assets_json_malformed_skipped() {
diff --git a/crates/socket-patch-core/tests/crawler_python_e2e.rs b/crates/socket-patch-core/tests/crawler_python_e2e.rs
index 78530504..9e1addf9 100644
--- a/crates/socket-patch-core/tests/crawler_python_e2e.rs
+++ b/crates/socket-patch-core/tests/crawler_python_e2e.rs
@@ -130,7 +130,7 @@ async fn find_python_dirs_python3_wildcard_matches_versions() {
 }
 
 /// `*` generic wildcard matches every directory entry. Covers the
-/// generic wildcard branch (L142-L160 of python_crawler.rs).
+/// generic `*` wildcard branch of `find_python_dirs`.
 #[tokio::test]
 #[serial_test::parallel]
 async fn find_python_dirs_star_wildcard_matches_all() {
@@ -159,7 +159,7 @@ async fn find_python_dirs_star_wildcard_matches_all() {
 }
 
 /// `*` wildcard skips non-directory entries (regular files). Covers
-/// the `if !ft.is_dir() { continue; }` arm.
+/// the `entry_is_dir` skip arm.
 #[tokio::test]
 #[serial_test::parallel]
 async fn find_python_dirs_star_wildcard_skips_files() {
@@ -341,12 +341,11 @@ async fn get_global_python_site_packages_discovers_anaconda() {
 /// Both Apple's `/usr/bin/python3` and Homebrew's `python3` are framework
 /// builds and use it, so a stock Mac has several of these trees.
 ///
-/// The well-known scan covers pip --user on Linux (`~/.local`) and Windows
-/// (`%APPDATA%\Python`) but had no macOS entry, so the only thing that ever
-/// surfaced such a package was the `site.getusersitepackages()` query — which
-/// reports at most the ONE interpreter first on PATH. Everything
-/// `pip3 install --user`ed under any other interpreter was invisible to
-/// global discovery.
+/// The well-known scan needs a macOS entry alongside pip --user on Linux
+/// (`~/.local`) and Windows (`%APPDATA%\Python`): the
+/// `site.getusersitepackages()` query reports at most the ONE interpreter
+/// first on PATH, so everything `pip3 install --user`ed under any other
+/// interpreter would be invisible to global discovery.
 ///
 /// Two versions are staged deliberately: the runtime-query arm can only ever
 /// contribute the host interpreter's own version, so requiring BOTH to surface
@@ -593,12 +592,9 @@ async fn get_site_packages_paths_falls_back_via_pyproject_marker() {
 /// `uv.lock` alone is also a valid Python-project marker — a fresh
 /// clone of a uv-managed repo shouldn't need a venv to be scannable.
 ///
-/// Previously this test only asserted the call returned `Ok` without
-/// staging anything discoverable, so a regression that dropped
-/// `uv.lock` from the marker list (returning an empty Vec via the
-/// no-marker early-out) stayed green. We now stage a real global
-/// layout under the stubbed HOME and assert it surfaces — which can
-/// ONLY happen if the `uv.lock` marker triggered the global fallback.
+/// Stages a real global layout under the stubbed HOME and asserts it
+/// surfaces — which can ONLY happen if the `uv.lock` marker triggered
+/// the global fallback (no marker returns an empty Vec).
 #[tokio::test]
 #[serial]
 async fn get_site_packages_paths_falls_back_via_uv_lock_marker() {
@@ -868,7 +864,8 @@ async fn read_python_metadata_rejects_fifo_metadata_without_hanging() {
 mod common;
 
 /// `find_by_purls` short-circuits when the site-packages dir is
-/// unreadable. Drives the python_crawler.rs:530 read_dir Err arm.
+/// unreadable. Drives the unreadable-listing arm of
+/// `list_dist_info_packages`.
 #[cfg(unix)]
 #[tokio::test]
 #[serial_test::parallel]
@@ -892,8 +889,8 @@ async fn find_by_purls_handles_unreadable_site_packages() {
     assert!(result.is_empty());
 }
 
-/// `scan_site_packages` short-circuits when site-packages is
-/// unreadable — drives python_crawler.rs:584 read_dir Err arm.
+/// `list_dist_info_packages` yields nothing when site-packages is
+/// unreadable (`list_dir_sync` degrades to an empty listing).
 #[cfg(unix)]
 #[tokio::test]
 #[serial_test::parallel]
@@ -998,8 +995,8 @@ async fn find_by_purls_strips_qualifiers() {
 /// A bare `#subpath` (no `?qualifier`) is valid PURL grammar and must be
 /// stripped the same way qualifiers are — cutting only at `?` leaks the
 /// subpath into the version (`2.28.0#src/requests`), so the installed
-/// package silently fails to match. Twin of the strip_purl_qualifiers
-/// subpath fix in utils::purl.
+/// package silently fails to match. Twin of `strip_purl_qualifiers`'
+/// subpath handling in utils::purl.
 #[tokio::test]
 #[serial_test::parallel]
 async fn find_by_purls_strips_subpath() {
@@ -1179,7 +1176,7 @@ async fn crawl_all_with_unparseable_dist_info_skips() {
 }
 
 /// `get_site_packages_paths` with `global_prefix` set returns just that
-/// prefix — exercises the early-return arm at python_crawler.rs:473-474.
+/// prefix — exercises its `global_prefix` early-return arm.
 #[tokio::test]
 #[serial_test::parallel]
 async fn get_site_packages_paths_with_global_prefix_passthrough() {
diff --git a/crates/socket-patch-core/tests/crawler_ruby_e2e.rs b/crates/socket-patch-core/tests/crawler_ruby_e2e.rs
index 9a2bf068..dd91d398 100644
--- a/crates/socket-patch-core/tests/crawler_ruby_e2e.rs
+++ b/crates/socket-patch-core/tests/crawler_ruby_e2e.rs
@@ -347,7 +347,7 @@ async fn get_gem_paths_no_gemfile_returns_empty() {
 /// With a Gemfile present and no vendor/bundle, local mode falls back
 /// to `gem env gemdir` and returns `<gemdir>/gems`. Driven
 /// deterministically with a fake `gem` on PATH so the success arm is
-/// actually asserted (the old test swallowed the result with `let _`).
+/// actually asserted.
 #[cfg(unix)]
 #[tokio::test]
 #[serial]
@@ -699,8 +699,8 @@ async fn global_gem_discovery_via_home_dotgem_layout() {
 #[path = "common/mod.rs"]
 mod common;
 
-/// `scan_gem_dir` short-circuits when the gem path is unreadable —
-/// drives ruby_crawler.rs:270 read_dir Err arm.
+/// `scan_gem_dir` yields nothing when the gem path is unreadable
+/// (`list_dir_entries` degrades to empty).
 #[cfg(unix)]
 #[tokio::test]
 #[serial_test::parallel]
@@ -736,8 +736,8 @@ fn ruby_crawler_default_and_new_construct_cleanly() {
 }
 
 /// With a Gemfile present and `gem` not on PATH, the local-mode
-/// `gem env gemdir` fallback at L56-64 must short-circuit cleanly
-/// (run_gem_env returns None via the `.output().ok()?` arm). The
+/// `gem env gemdir` fallback must short-circuit cleanly
+/// (run_gem_env returns None when the command runner yields no output). The
 /// crawler then exits the if-block and returns an empty Vec.
 #[tokio::test]
 #[serial]
diff --git a/crates/socket-patch-core/tests/diff_e2e.rs b/crates/socket-patch-core/tests/diff_e2e.rs
index cf8b5700..438d1d0d 100644
--- a/crates/socket-patch-core/tests/diff_e2e.rs
+++ b/crates/socket-patch-core/tests/diff_e2e.rs
@@ -109,7 +109,7 @@ fn wrong_source_does_not_panic() {
     }
 }
 
-/// Security regression (mirrors the lib's
+/// Security (mirrors the lib's
 /// `test_apply_diff_forged_oversize_header_is_safe`): a hostile delta can
 /// claim an arbitrary target size in header bytes 24..32. qbsdiff does NOT
 /// validate that field against the real payload, so feeding it straight into
@@ -118,8 +118,7 @@ fn wrong_source_does_not_panic() {
 /// `apply_diff` must clamp the hint and still produce correct output.
 ///
 /// Without the clamp this test panics/aborts on the allocation, so it fails
-/// loudly if the bound is ever removed. This is the protection the rest of
-/// this "mirror" file was missing.
+/// loudly if the bound is ever removed.
 #[test]
 fn forged_oversize_header_is_safe() {
     let before = b"the quick brown fox jumps over the lazy dog";
@@ -163,7 +162,7 @@ fn forged_max_u64_header_is_safe() {
     );
 }
 
-/// Security regression (mirrors the lib's
+/// Security (mirrors the lib's
 /// `test_apply_diff_forged_negative_block_length_does_not_panic`): the
 /// compressed control/diff block lengths in header bytes 8..24 are decoded
 /// with a sign-magnitude scheme. A field with the sign bit set decodes to a
diff --git a/crates/socket-patch-core/tests/package_e2e.rs b/crates/socket-patch-core/tests/package_e2e.rs
index 7b98a0d8..2bfd8f7f 100644
--- a/crates/socket-patch-core/tests/package_e2e.rs
+++ b/crates/socket-patch-core/tests/package_e2e.rs
@@ -187,16 +187,14 @@ fn read_archive_to_map_rejects_parent_traversal() {
 
 #[test]
 fn read_archive_to_map_rejects_double_slash_package_escape() {
-    // Regression for the validate-AFTER-normalize fix. The raw entry
-    // `package//etc/passwd` passes every PRE-strip check (not absolute,
+    // Validate AFTER normalize. The raw entry `package//etc/passwd` passes every PRE-strip check (not absolute,
     // no leading separator, the `//` collapses so there is no `..`), but
     // `strip_prefix("package/")` yields the absolute path `/etc/passwd`,
     // and `pkg_path.join("/etc/passwd")` discards the base — an arbitrary
     // out-of-tree write. The guard MUST run on the post-strip path.
     //
-    // Unlike the bare-`/etc/passwd` test above, this case stays green
-    // under the OLD (pre-strip) validation, so it is the one that
-    // actually polices the fix.
+    // Unlike the bare-`/etc/passwd` test above, this case would pass a
+    // pre-strip-only validation, so it is the one that polices the order.
     let tmp = tempfile::tempdir().unwrap();
     let archive = tmp.path().join("arc.tar.gz");
     write_raw_archive(&archive, b"package//etc/passwd", b"evil");
@@ -221,7 +219,7 @@ fn read_archive_to_map_rejects_package_prefixed_backslash_escape() {
 #[test]
 fn read_archive_to_map_rejects_package_prefixed_parent_traversal() {
     // A `..` that survives the `package/` strip must still be rejected
-    // now that validation happens after normalization.
+    // when validation happens after normalization.
     let tmp = tempfile::tempdir().unwrap();
     let archive = tmp.path().join("arc.tar.gz");
     write_raw_archive(&archive, b"package/../../etc/passwd", b"evil");
diff --git a/crates/socket-patch-core/tests/poetry_hosted.rs b/crates/socket-patch-core/tests/poetry_hosted.rs
index 17173e65..74ad3cd6 100644
--- a/crates/socket-patch-core/tests/poetry_hosted.rs
+++ b/crates/socket-patch-core/tests/poetry_hosted.rs
@@ -416,10 +416,9 @@ fn rotated_grant_token_supersedes_the_prior_hosted_url() {
 
 /// A relock (or hand edit) that drops the inserted `files` line but keeps
 /// `[package.source]` must be REFUSED by rollback, never mistaken for an
-/// already-reverted lock: before the fragment carried its boundary header the
-/// pristine unit matched as a prefix, replay reported success, deleted the
-/// ledger, and left the lock redirecting with upstream hashes in
-/// `[metadata.files]`.
+/// already-reverted lock (the fragment's boundary header keeps the pristine
+/// unit from matching as a prefix, which would delete the ledger and leave the
+/// lock redirecting with upstream hashes in `[metadata.files]`).
 #[tokio::test]
 async fn dropped_files_line_with_source_kept_is_refused_not_converged() {
     for version in ["1.2.2", "2.4.3"] {
diff --git a/crates/socket-patch-core/tests/proxy_batch_e2e.rs b/crates/socket-patch-core/tests/proxy_batch_e2e.rs
index a302de15..a0ac9f63 100644
--- a/crates/socket-patch-core/tests/proxy_batch_e2e.rs
+++ b/crates/socket-patch-core/tests/proxy_batch_e2e.rs
@@ -274,13 +274,12 @@ async fn proxy_batch_429_surfaces_as_rate_limited_without_fallback() {
 
 #[tokio::test]
 async fn proxy_batch_fallback_preserves_requested_purl_order() {
-    // Regression: the per-package fallback runs each chunk's GETs
-    // concurrently and used to collect them in *completion* order, so the
-    // assembled `packages` list was ordered by whichever response came back
-    // first. That order is user-visible — `scan --json` emits `packages`
-    // verbatim and the human table / interactive picker index it — so two
-    // identical scans of an unchanged project could disagree. The order must
-    // follow the requested PURLs, matching what the batch endpoint returns.
+    // The per-package fallback runs each chunk's GETs concurrently; the
+    // assembled `packages` list must not follow *completion* order. That
+    // order is user-visible — `scan --json` emits `packages` verbatim and the
+    // human table indexes it — so two identical scans of an unchanged project
+    // could disagree. The order must follow the requested PURLs, matching
+    // what the batch endpoint returns.
     //
     // The mock makes the race deterministic: the FIRST requested PURL is
     // served with a delay, so completion order is the exact reverse of
diff --git a/crates/socket-patch-core/tests/redirect_golden.rs b/crates/socket-patch-core/tests/redirect_golden.rs
index 7a6266f1..097f5748 100644
--- a/crates/socket-patch-core/tests/redirect_golden.rs
+++ b/crates/socket-patch-core/tests/redirect_golden.rs
@@ -5,7 +5,7 @@
 //! byte-identical `expected/` files + `expected-edits.json`. A fixture's
 //! `expected/` bytes were authored by the TS backend, so a match here proves a
 //! customer gets the same lockfile whether Socket opens the PR (backend) or
-//! they run `socket-patch scan --redirect` locally (this CLI).
+//! they run `socket-patch scan` (hosted mode) locally (this CLI).
 //!
 //! `RUST_IMPLEMENTED` lists the eco/flavor pairs this CLI rewrites today —
 //! covering JSON round-trip (npm, nuget), text-line (requirements, yarn), the
diff --git a/gem/socket-patch/lib/socket_patch/launcher.rb b/gem/socket-patch/lib/socket_patch/launcher.rb
index cf4e166f..531f4351 100644
--- a/gem/socket-patch/lib/socket_patch/launcher.rb
+++ b/gem/socket-patch/lib/socket_patch/launcher.rb
@@ -86,8 +86,8 @@ def version
       Gem::Specification.find_by_name("socket-patch").version.to_s
     rescue StandardError, Gem::LoadError
       # Gem::MissingSpecError (the gem isn't installed at all — running from
-      # a checkout) is a Gem::LoadError, which is NOT a StandardError; without
-      # naming it the documented fallback never engaged.
+      # a checkout) is a Gem::LoadError, which is NOT a StandardError, so it
+      # must be rescued by name for the fallback to engage.
       VERSION
     end
 
diff --git a/npm/socket-patch/src/schema/manifest-schema.ts b/npm/socket-patch/src/schema/manifest-schema.ts
index 96f201bc..e11f2936 100644
--- a/npm/socket-patch/src/schema/manifest-schema.ts
+++ b/npm/socket-patch/src/schema/manifest-schema.ts
@@ -30,7 +30,7 @@ export type PatchRecord = z.infer<typeof PatchRecordSchema>
 
 export const PatchManifestSchema = z.object({
   patches: z.record(
-    z.string(), // Package identifier like "npm:simplehttpserver@0.0.6"
+    z.string(), // Package PURL like "pkg:npm/simplehttpserver@0.0.6"
     PatchRecordSchema,
   ),
 })
diff --git a/pypi/socket-patch-hook/pyproject.toml b/pypi/socket-patch-hook/pyproject.toml
index 01bbe19b..469c2301 100644
--- a/pypi/socket-patch-hook/pyproject.toml
+++ b/pypi/socket-patch-hook/pyproject.toml
@@ -20,11 +20,10 @@ classifiers = [
     "Topic :: Security",
     "Topic :: Software Development :: Build Tools",
 ]
-# Intentionally NO dependency on socket-patch: the hook is version-agnostic and
-# invokes whatever `socket-patch` CLI is on PATH (or pip-installed in the env),
-# no-opping if none is present. This keeps the committed `socket-patch-hook`
-# dependency a single stable token that never needs a version bump, and lets the
-# CLI be provisioned independently (pip, pipx, a GitHub Action, system install).
+# Intentionally NO dependency on socket-patch: the hook is version-agnostic. It
+# runs the binary bundled in an installed `socket_patch` package, falls back to
+# `socket-patch` on PATH, and no-ops if neither exists. Projects commit
+# `socket-patch[hook]`, which pulls in both the CLI and this wheel.
 # (The canonical build is scripts/build-pypi-wheels.py, which also lays down the
 # startup .pth; this block keeps the directory a valid project for `pip install .`.)
 dependencies = []
diff --git a/pypi/socket-patch/pyproject.toml b/pypi/socket-patch/pyproject.toml
index 6c0a8dd0..0f505912 100644
--- a/pypi/socket-patch/pyproject.toml
+++ b/pypi/socket-patch/pyproject.toml
@@ -25,8 +25,9 @@ classifiers = [
 # `pip install socket-patch[hook]` additionally installs the
 # package-manager-agnostic .pth startup hook that re-applies patches after
 # install. Unpinned so the hook updates independently of the CLI. `setup`
-# itself commits a bare `socket-patch-hook` dependency (the hook needs no
-# specific CLI version — it runs whatever `socket-patch` is on PATH).
+# commits `socket-patch[hook]` (this extra), which pulls in both the CLI and the
+# hook wheel. The hook runs the binary bundled in the installed `socket_patch`
+# package and falls back to PATH only when that package is absent.
 hook = ["socket-patch-hook"]
 
 [project.urls]
diff --git a/scripts/backtest-pipenv.py b/scripts/backtest-pipenv.py
index 75953a3b..610a67fe 100755
--- a/scripts/backtest-pipenv.py
+++ b/scripts/backtest-pipenv.py
@@ -699,9 +699,6 @@ def cli_run(penv_, *rest, log):
         python = venv / "bin/python"
         penv = pipenv_env(version, tool)
 
-        # Pipenv 0.x installs plain string pins only: inline-table entries with
-        # markers / extras are not understood, so nothing gets installed for
-        # agent mode to patch — nothing to measure there.
         if mode in ("agent", "agent-oot") and major < 7 and shape in ("marker", "marker-excluded", "extras"):
             # Pipenv 0.x–6.x install plain string pins only: inline-table
             # entries are mis-handled (markers ignored, extras fail to
diff --git a/scripts/fix-vuln.config.ts b/scripts/fix-vuln.config.ts
index 79983215..d63dbd8e 100644
--- a/scripts/fix-vuln.config.ts
+++ b/scripts/fix-vuln.config.ts
@@ -1,8 +1,9 @@
 /**
- * Example prompt module for scripts/study-crates.ts.
+ * Bug-fixing prompt module for scripts/study-crates.ts, with extra emphasis on
+ * the patch engine and crawlers.
  *
  * Pass it with:
- *   npx tsx scripts/study-crates.ts --prompt-file scripts/study-crates.config.example.ts
+ *   npx tsx scripts/study-crates.ts --prompt-file scripts/fix-vuln.config.ts
  *
  * The module's default export is a function `(ctx: FileCtx) => string` that
  * returns the prompt for one file. This gives you full programmatic control:
diff --git a/scripts/optimize-test-perf.config.ts b/scripts/optimize-test-perf.config.ts
index 257fe29d..548ec6fb 100644
--- a/scripts/optimize-test-perf.config.ts
+++ b/scripts/optimize-test-perf.config.ts
@@ -45,11 +45,11 @@ import type { FileCtx } from "./study-crates.ts";
 
 export const model = "claude-opus-5";
 
-// Every ecosystem is compiled in unconditionally — the old per-ecosystem
-// feature gates (`cargo`, `golang`, `maven`, …) no longer exist, and naming
-// them makes cargo abort with "none of the selected packages contains these
-// features". The default feature set is already exactly what we want here:
-// all nine ecosystems, minus the cfg-gated `docker-e2e`/`setup-e2e` suites
+// Every ecosystem is compiled in unconditionally — there are no per-ecosystem
+// feature gates, and naming one (`cargo`, `golang`, `maven`, …) makes cargo
+// abort with "none of the selected packages contains these features". The
+// default feature set is already exactly what we want here: all nine
+// ecosystems, minus the cfg-gated `docker-e2e`/`setup-e2e` suites
 // that `--all-features` would drag in.
 const FEATURES = "";
 
diff --git a/scripts/study-crates.ts b/scripts/study-crates.ts
index 226a25ab..438c09de 100644
--- a/scripts/study-crates.ts
+++ b/scripts/study-crates.ts
@@ -30,7 +30,7 @@
  *     -p 'Inspect {file} for panics and unwraps. Summarize risks.'
  *
  *   # Fully programmatic prompt via a TS module:
- *   npx tsx scripts/study-crates.ts --prompt-file scripts/study-crates.config.example.ts
+ *   npx tsx scripts/study-crates.ts --prompt-file scripts/fix-bugs.config.example.ts
  *
  *   # Audit every test file/harness one at a time for reward-hacked tests:
  *   npx tsx scripts/study-crates.ts --tests \
diff --git a/tests/setup_matrix/run-case.sh b/tests/setup_matrix/run-case.sh
index 85c9105c..11618d88 100755
--- a/tests/setup_matrix/run-case.sh
+++ b/tests/setup_matrix/run-case.sh
@@ -25,7 +25,8 @@
 #   SM_PM                npm|yarn|pnpm|bun|vlt|pip|uv|poetry|pdm|hatch|cargo|
 #                        bundler|go|mvn|composer|dotnet|deno
 #   SM_SCENARIO          scenario id (echoed back)
-#   SM_PATCHSET          primary|alt|empty|wrong
+#   SM_PATCHSET          primary|alt|empty|wrong|none
+#   SM_LAYOUT            single|workspace|monorepo
 #   SM_RUN_SETUP         1|0  — run `socket-patch setup` before install
 #   SM_EXPECT_APPLIED    1|0  — the aspirational expectation
 #   SM_PACKAGE           dependency name (e.g. minimist, six, cfg-if)
@@ -424,7 +425,8 @@ run_install() {
       uv pip install --python venv/bin/python --quiet "$SM_PACKAGE==$SM_VERSION"
       pth_trigger venv ;;
     # poetry / pdm are resolver-based: `add` re-resolves the whole manifest
-    # (which setup edited to add `socket-patch-hook`) against a package index.
+    # (which setup edited to add `socket-patch[hook]`, whose `hook` extra pulls
+    # the unpublished socket-patch-hook wheel) against a package index.
     # In this hermetic test the hook wheel isn't published, so resolution
     # fails — these PMs can't be exercised without a local index, so they stay
     # documented gaps (baseline_supported:false). The .pth mechanism itself is
@@ -651,9 +653,9 @@ run_file() { # $1 = absolute path to the resolved package file
     pypi)
       # Run the patched module with the in-project venv interpreter directly.
       # Going through `<pm> run` re-resolves the project, which (after setup)
-      # includes the committed `socket-patch-hook` dependency — unpublished in
-      # this hermetic test, so the resolve would fail for a reason unrelated to
-      # whether six.py is patched. Direct execution faithfully runs the on-disk
+      # includes the committed `socket-patch[hook]` dependency, whose hook wheel
+      # is unpublished in this hermetic test, so the resolve would fail for a
+      # reason unrelated to whether six.py is patched. Direct execution faithfully runs the on-disk
       # patched file and observes its marker. (hatch manages its env outside
       # an in-project .venv, and its skip-install env doesn't re-resolve, so it
       # keeps using `hatch run`.)
@@ -691,8 +693,8 @@ verify_applied() {
   log "verify(run): marker '$check_marker' in runtime output=$APPLIED (candidates=$n_found, target=${TARGET:-<none>})"
 }
 
-# npm-family is the surface `setup` actually configures today — the only place
-# the behavioral check/remove round-trip is expected to do real work.
+# The full check/remove round trip runs only for npm-family cases; the other
+# supported hooks use the simple single-install flow.
 is_npm_family() {
   [[ "$SM_PM" =~ ^(npm|yarn|pnpm|bun|vlt)$ ]] || [ "$SM_LAYOUT" = monorepo ]
 }
@@ -726,9 +728,6 @@ if [[ "$SM_PM" =~ ^(npm|yarn|pnpm|bun|vlt|deno)$ ]] || [ "$SM_LAYOUT" = monorepo
 fi
 
 # Hermetic apply env inherited by the install hook's `socket-patch apply`.
-# NOTE: SOCKET_OFFLINE/SOCKET_FORCE must be "true"/"false" — the apply
-# `--force` flag (unlike its siblings) has no boolish value parser, so
-# SOCKET_FORCE=1 is rejected with "invalid value '1' for '--force'".
 export SOCKET_OFFLINE=true SOCKET_FORCE=true SOCKET_API_TOKEN=fake SOCKET_ORG_SLUG=test-org
 export SOCKET_TELEMETRY_DISABLED=1 VLT_TELEMETRY=0
 # Isolate the pypi `.pth` hook's change-detection stamp per case so runs
diff --git a/tests/setup_matrix/shims/npx b/tests/setup_matrix/shims/npx
index fb158c29..d64dd9e1 100755
--- a/tests/setup_matrix/shims/npx
+++ b/tests/setup_matrix/shims/npx
@@ -10,9 +10,9 @@
 # delegated to the real `npx`.
 #
 # This is a TEST FIXTURE, not a change to socket-patch behavior. It is the
-# standalone/reference copy; tests/setup_matrix/run-case.sh embeds an
-# identical copy inline so the driver is self-contained when piped into a
-# container. Keep the two in sync.
+# standalone/reference copy; tests/setup_matrix/run-case.sh embeds a
+# functionally equivalent, condensed copy inline so the driver is
+# self-contained when piped into a container. Keep the two in sync.
 set -uo pipefail
 
 sp_bin="${SOCKET_PATCH_BIN:-socket-patch}"
diff --git a/tests/setup_matrix/shims/pnpm b/tests/setup_matrix/shims/pnpm
index 7f342f71..e497e398 100755
--- a/tests/setup_matrix/shims/pnpm
+++ b/tests/setup_matrix/shims/pnpm
@@ -10,7 +10,7 @@
 # real `pnpm install` / `pnpm add` — is delegated unchanged to the real
 # pnpm.
 #
-# TEST FIXTURE only. Reference copy; run-case.sh embeds an identical copy.
+# TEST FIXTURE only. Reference copy; run-case.sh embeds an equivalent copy.
 set -uo pipefail
 
 sp_bin="${SOCKET_PATCH_BIN:-socket-patch}"

From 962acc43bf988c9691c74de49bf74fc3c1689816 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Sun, 27 Sep 2026 16:54:55 -0400
Subject: [PATCH 11/32] Fix follow-ups from the stale-doc sweep

- An exported-but-empty SOCKET_SCAN_PACKAGES= filtered every package out
  of a scan. It is now scrubbed like the other local env vars, and blank
  --package specs are ignored.
- Manifest-less VEX liveness for a rebuilt cargo vendor entry (no
  recorded wiring) now also probes the root Cargo.toml, where v5 writes
  the [patch.crates-io] table, not only the pre-v5 .cargo/config files.
- setup names the dependency it writes, socket-patch[hook]. The
  repair_vendor hint and the hosted --prune warning name the current
  flags.
- Drop scan's unreachable patch-menu spacing and the vendored arm's
  leftover blank line from the removed confirm prompt.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 crates/socket-patch-cli/src/args.rs            |  2 ++
 .../src/commands/repair_vendor.rs              |  2 +-
 .../socket-patch-cli/src/commands/scan/mod.rs  | 18 +++++-------------
 .../src/commands/scan/vendor_flow.rs           |  7 -------
 crates/socket-patch-cli/src/commands/setup.rs  |  6 +++---
 .../socket-patch-cli/tests/cli_parse_scan.rs   |  1 +
 crates/socket-patch-cli/tests/cli_parse_vex.rs |  1 +
 .../tests/covgap_commands_setup.rs             |  4 ++--
 .../socket-patch-core/src/vex/discover/mod.rs  | 17 +++++++++++++----
 9 files changed, 28 insertions(+), 30 deletions(-)

diff --git a/crates/socket-patch-cli/src/args.rs b/crates/socket-patch-cli/src/args.rs
index 8ada7e0c..29a09df7 100644
--- a/crates/socket-patch-cli/src/args.rs
+++ b/crates/socket-patch-cli/src/args.rs
@@ -622,6 +622,7 @@ pub const LOCAL_ARG_ENV_VARS: &[&str] = &[
     "SOCKET_SETUP_EXCLUDE",
     "SOCKET_VENDOR_REVERT",
     "SOCKET_BATCH_SIZE",
+    "SOCKET_SCAN_PACKAGES",
     "SOCKET_VEX",
     "SOCKET_VEX_OUTPUT",
     "SOCKET_VEX_PRODUCT",
@@ -1642,6 +1643,7 @@ mod tests {
 
         const VALUE_BINDINGS: &[(&str, &[&str])] = &[
             ("SOCKET_BATCH_SIZE", &["socket-patch", "scan"]),
+            ("SOCKET_SCAN_PACKAGES", &["socket-patch", "scan"]),
             ("SOCKET_PATCH_VERSION", &["socket-patch", "self-update"]),
             ("SOCKET_SETUP_EXCLUDE", &["socket-patch", "setup"]),
             ("SOCKET_VEX", &["socket-patch", "apply"]),
diff --git a/crates/socket-patch-cli/src/commands/repair_vendor.rs b/crates/socket-patch-cli/src/commands/repair_vendor.rs
index 77df1be2..662f5cd1 100644
--- a/crates/socket-patch-cli/src/commands/repair_vendor.rs
+++ b/crates/socket-patch-cli/src/commands/repair_vendor.rs
@@ -755,7 +755,7 @@ pub(crate) async fn repair_vendored_artifacts_with_references(
                 PatchEvent::new(PatchAction::Skipped, purl.clone()).with_reason(
                     "vendor_uuid_mismatch",
                     "the manifest's patch uuid moved on; run `socket-patch vendor` (or \
-                     `scan --vendor`) to re-vendor",
+                     `scan --mode vendored`) to re-vendor",
                 ),
             );
             continue;
diff --git a/crates/socket-patch-cli/src/commands/scan/mod.rs b/crates/socket-patch-cli/src/commands/scan/mod.rs
index e471d659..20ab9896 100644
--- a/crates/socket-patch-cli/src/commands/scan/mod.rs
+++ b/crates/socket-patch-cli/src/commands/scan/mod.rs
@@ -851,7 +851,7 @@ pub(super) const VENDOR_SUPERSEDES_REDIRECT: &str = "vendor_supersedes_redirect"
 pub(super) const REDIRECT_PRUNE_IGNORED: &str = "redirect_prune_ignored";
 pub(super) const REDIRECT_PRUNE_IGNORED_DETAIL: &str =
     "--prune has no effect with --mode hosted: the hosted flow rewrites lockfiles only and \
-     runs no GC sweep of `.socket/` state; run `scan --prune` (agent mode) or \
+     runs no GC sweep of `.socket/` state; run `scan --mode agent --prune` or \
      `scan --mode vendored --prune` to garbage-collect";
 
 /// The PURLs claimed by BOTH the hosted redirect ledger
@@ -1752,13 +1752,15 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         .filter(|pkg| args.common.purl_ecosystem_selected(&pkg.purl))
         .collect();
 
-    let filtered_crawled: Vec<_> = if args.packages.is_empty() {
+    let package_specs: Vec<&String> =
+        args.packages.iter().filter(|s| !s.trim().is_empty()).collect();
+    let filtered_crawled: Vec<_> = if package_specs.is_empty() {
         filtered_crawled
     } else {
         filtered_crawled
             .into_iter()
             .filter(|pkg| {
-                args.packages
+                package_specs
                     .iter()
                     .any(|spec| package_spec_matches(spec, &pkg.purl))
             })
@@ -2680,16 +2682,6 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
     // Scan always takes the top-ranked patch (see `selection_args`).
     let mut select_common = selection_args(&args.common);
     select_common.silent |= report_only;
-    // Never true for scan: `selection_args` sets `yes`.
-    if !select_common.silent
-        && super::get::selection_has_choice(
-            &all_search_results,
-            can_access_paid_patches,
-            &select_common,
-        )
-    {
-        eprintln!();
-    }
     let selected: Vec<PatchSearchResult> =
         match select_patches(&all_search_results, can_access_paid_patches, &select_common) {
             Ok(s) => s,
diff --git a/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs b/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs
index f365ab24..5457311c 100644
--- a/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs
+++ b/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs
@@ -25,7 +25,6 @@ use socket_patch_core::telemetry::{track_patch_vendor_failed, PendingTelemetry};
 use socket_patch_core::utils::purl::strip_purl_qualifiers;
 use socket_patch_core::vendor::{load_state, lookup_entry, save_state, VendorState};
 use std::collections::{HashMap, HashSet};
-use std::io::IsTerminal;
 use std::path::Path;
 use std::time::Duration;
 
@@ -618,12 +617,6 @@ async fn run_vendor_interactive_path(
     // The download phase is quiet about its own header in vendored mode
     // (only the manifest-mode download prints it), so this arm does.
     if !args.common.silent && !selected.is_empty() {
-        // Extra separator on a terminal run without `--yes` (a vestige of
-        // the removed confirm prompt); otherwise the listing's trailing
-        // blank line already separates the sections.
-        if !args.common.yes && std::io::stdin().is_terminal() {
-            eprintln!();
-        }
         eprintln!(
             "Downloading {}...",
             plural(selected.len(), "patch", "patches")
diff --git a/crates/socket-patch-cli/src/commands/setup.rs b/crates/socket-patch-cli/src/commands/setup.rs
index 7b1d8070..63106bdc 100644
--- a/crates/socket-patch-cli/src/commands/setup.rs
+++ b/crates/socket-patch-cli/src/commands/setup.rs
@@ -1935,7 +1935,7 @@ fn format_remove_preview(
         .filter(|r| r.status == PthStatus::Updated)
         .collect();
     if !py_remove.is_empty() {
-        out.push_str("\nWill remove the socket-patch-hook dependency from:\n");
+        out.push_str("\nWill remove the socket-patch[hook] dependency from:\n");
         for r in &py_remove {
             out.push_str(&format!("  - {}\n", pathdiff(&r.path, cwd)));
         }
@@ -2457,7 +2457,7 @@ fn format_setup_preview(
         .filter(|r| r.status == PthStatus::Updated)
         .collect();
     if !py_changes.is_empty() {
-        out.push_str("\nPython manifests to update (socket-patch-hook):\n");
+        out.push_str("\nPython manifests to update (socket-patch[hook]):\n");
         for r in &py_changes {
             out.push_str(&format!("  + {}\n", pathdiff(&r.path, cwd)));
         }
@@ -2892,7 +2892,7 @@ mod tests {
             "\nProposed changes:\n\nWill remove socket-patch from:\n  - package.json\n    \
              postinstall:    \"socket-patch apply && echo hi\"\n    -> postinstall: \"echo \
              hi\"\n    dependencies:    \"socket-patch apply\"\n    -> dependencies: \
-             (removed)\n\nWill remove the socket-patch-hook dependency from:\n  - \
+             (removed)\n\nWill remove the socket-patch[hook] dependency from:\n  - \
              requirements.txt\n\nGem: remove the socket-patch Bundler plugin wiring from:\n  \
              - Gemfile\n"
         );
diff --git a/crates/socket-patch-cli/tests/cli_parse_scan.rs b/crates/socket-patch-cli/tests/cli_parse_scan.rs
index c172901b..1ed6a66d 100644
--- a/crates/socket-patch-cli/tests/cli_parse_scan.rs
+++ b/crates/socket-patch-cli/tests/cli_parse_scan.rs
@@ -35,6 +35,7 @@ const SCAN_ENV_VARS: &[&str] = &[
     "SOCKET_API_URL",
     "SOCKET_BATCH_SIZE",
     "SOCKET_CWD",
+    "SOCKET_SCAN_PACKAGES",
     "SOCKET_DEBUG",
     "SOCKET_DOWNLOAD_MODE",
     "SOCKET_DRY_RUN",
diff --git a/crates/socket-patch-cli/tests/cli_parse_vex.rs b/crates/socket-patch-cli/tests/cli_parse_vex.rs
index 444d167d..5d5c4934 100644
--- a/crates/socket-patch-cli/tests/cli_parse_vex.rs
+++ b/crates/socket-patch-cli/tests/cli_parse_vex.rs
@@ -71,6 +71,7 @@ const SOCKET_ENV_VARS: &[&str] = &[
     "SOCKET_FORCE",
     // ScanArgs-specific
     "SOCKET_BATCH_SIZE",
+    "SOCKET_SCAN_PACKAGES",
     "SOCKET_ALL_RELEASES",
 ];
 
diff --git a/crates/socket-patch-cli/tests/covgap_commands_setup.rs b/crates/socket-patch-cli/tests/covgap_commands_setup.rs
index 9d8024b0..db0ce3f9 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_setup.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_setup.rs
@@ -1320,7 +1320,7 @@ fn remove_human_real_run_prints_python_gem_composer_sections() {
     let (code, stdout, stderr) = run(cwd, &["setup", "--remove", "--yes"]);
     assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
     assert!(
-        stdout.contains("Will remove the socket-patch-hook dependency from:"),
+        stdout.contains("Will remove the socket-patch[hook] dependency from:"),
         "the python remove preview section must print; stdout=\n{stdout}"
     );
     assert!(
@@ -1511,7 +1511,7 @@ fn setup_human_preview_and_commit_notes_for_python_and_gem() {
     let (code, stdout, stderr) = run(cwd, &["setup", "--yes"]);
     assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
     assert!(
-        stdout.contains("Python manifests to update (socket-patch-hook):"),
+        stdout.contains("Python manifests to update (socket-patch[hook]):"),
         "the python preview section must print; stdout=\n{stdout}"
     );
     assert!(
diff --git a/crates/socket-patch-core/src/vex/discover/mod.rs b/crates/socket-patch-core/src/vex/discover/mod.rs
index bc4e6727..34b3c3ef 100644
--- a/crates/socket-patch-core/src/vex/discover/mod.rs
+++ b/crates/socket-patch-core/src/vex/discover/mod.rs
@@ -1725,8 +1725,8 @@ pub async fn vendored_wiring_live(root: &Path, recorded: &[&str], eco: &str, uui
 /// The root files a vendored `eco` artifact can be wired from — the vendor
 /// backends' lockfile / wiring config for that ecosystem (npm: every
 /// npm-family lock the `vendor_probe` table flags, `vlt-lock.json`
-/// included; cargo: only the pre-v5 `.cargo/config.toml` / `.cargo/config`
-/// `[patch.crates-io]` spellings, not the v5 root `Cargo.toml`; maven /
+/// included; cargo: the root `Cargo.toml` `[patch.crates-io]` table and the
+/// pre-v5 `.cargo/config.toml` / `.cargo/config` spellings; maven /
 /// nuget: the repository / source that serves the vendored dir). Manifests
 /// such as package.json are deliberately absent: the lock is what the
 /// install consumes.
@@ -1742,7 +1742,7 @@ pub fn vendored_wiring_probe_files(root: &Path, eco: &str) -> Vec<String> {
             "pyproject.toml",
             "hatch.toml",
         ],
-        "cargo" => vec![".cargo/config.toml", ".cargo/config"],
+        "cargo" => vec!["Cargo.toml", ".cargo/config.toml", ".cargo/config"],
         "golang" => vec!["go.mod"],
         "gem" => vec!["Gemfile.lock"],
         "composer" => vec!["composer.lock"],
@@ -2951,7 +2951,7 @@ mod tests {
                     "uv.lock",
                 ],
             ),
-            ("cargo", &[".cargo/config", ".cargo/config.toml"]),
+            ("cargo", &[".cargo/config", ".cargo/config.toml", "Cargo.toml"]),
             ("golang", &["go.mod"]),
             ("gem", &["Gemfile.lock"]),
             ("composer", &["composer.lock"]),
@@ -3021,6 +3021,15 @@ mod tests {
             format!("[patch.crates-io]\nsmallvec = {{ path = \".socket/vendor/cargo/{UUID_A}/smallvec-1.6.0\" }}\n"),
         );
         assert!(vendored_wiring_live(c.root(), &[], "cargo", UUID_A).await);
+        // v5 cargo wiring lives in the root Cargo.toml (repair rebuilds such
+        // entries with no recorded wiring).
+        let m = Project::new();
+        m.write(
+            "Cargo.toml",
+            format!("[package]\nname = \"app\"\n\n[patch.crates-io]\nsmallvec = {{ path = \".socket/vendor/cargo/{UUID_A}/smallvec-1.6.0\" }}\n"),
+        );
+        assert!(vendored_wiring_live(m.root(), &[], "cargo", UUID_A).await);
+        assert!(!vendored_wiring_live(m.root(), &[], "cargo", UUID_B).await);
     }
 
     /// Cross-package-manager union: one root carrying the committed hosted

From 8ae7dc37eca91fb2cc5c931e132a1563c4392183 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Sun, 27 Sep 2026 17:37:53 -0400
Subject: [PATCH 12/32] Add the v5 plan: decisions and workstreams

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 docs/design/v5-plan.md | 141 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 141 insertions(+)
 create mode 100644 docs/design/v5-plan.md

diff --git a/docs/design/v5-plan.md b/docs/design/v5-plan.md
new file mode 100644
index 00000000..5d131f99
--- /dev/null
+++ b/docs/design/v5-plan.md
@@ -0,0 +1,141 @@
+# v5 plan (branch `release/v5-prerelease`, PR #277)
+
+Decided 2026-09-27 by the project owner. Each workstream is its own branch
+cut from `release/v5-prerelease` and its own PR back into it. Signed commits,
+explicit push refspecs (`git push origin HEAD:refs/heads/<branch>`), never
+push to `main`.
+
+Supporting analysis (session reports, summarized here): stale-doc audit
+(567 findings, fixed), complexity-vs-value inventory, duplicated-code map,
+patch-UI review.
+
+## Product decisions
+
+- **Workflow:** `scan` (hosted, default, no prompts) → `vex` → `vendor`
+  (eject to `.socket/vendor/` for offline) + `list`. `get` defaults to hosted
+  too (done).
+- **vlt stays** in every mode (hosted, vendored, agent). Not a cut candidate.
+- **Every package-manager version we support stays** (pnpm 1–10 incl. 7/8
+  vendored, bun.lockb, yarn classic + berry, pipenv/pdm/poetry/hatch/uv,
+  bundler eras, …). Version support is not negotiable.
+- **Agent mode** is deprecated over time but stays in v5. **`setup` is
+  removed in v5** (install hooks: npm postinstall, the pypi `.pth` hook
+  wheel, the Bundler plugin gem, Composer). `apply` stays (users wire it
+  into CI themselves).
+- **Hosted ledger (`.socket/vendor/redirect-state.json`) is removed.**
+  `scan`/`get` hosted write only lockfile edits. Rollback of hosted wiring
+  no longer replays recorded fragments.
+- **In-place vendored ledger re-synthesis in `repair` is cut**; repair
+  re-downloads artifacts from the remote instead (see WS5 caveat).
+- **Future work (not v5):** a better vendored story for Maven and NuGet
+  (vendored Maven refuses multi-module/Gradle; NuGet feed is fragile).
+  Keep the current behavior; do not invest further now.
+
+## Workstreams (ordered; WS1–WS3 unblock the rest)
+
+### WS1 — Ledger-free hosted mode + new rollback  *(branch `v5/ledger-free-hosted`)*
+- Start from local WIP `wip/v5-ledger-free-hosted` (6426bd68: scan stops
+  writing the ledger; broke ~230 hosted round-trip tests).
+- Hosted rollback/remove: for each hosted pin discovered from lockfiles
+  (`vex::discover` refs), restore the **default upstream** entry: re-resolve
+  the registry artifact for `name@version` (npm registry tarball + integrity,
+  PyPI JSON, crates index, rubygems, packagist, proxy.golang.org, maven
+  central, nuget v3) and rewrite the lock entry with the same per-format
+  writer used for hosted (WS3 LockModel). Where that is impossible
+  (formats with non-derivable fields, offline), refuse with a clear
+  `git checkout -- <lockfile>` remedy. No fragment replay.
+- Keep *reading* a legacy `redirect-state.json` only for migration (list/vex
+  may show its records; rollback may delete it). Never write it.
+- vex/list/vendor/scan-updates derive hosted state from lockfiles only.
+- Rewrite the ~230 affected tests to the new contract; update
+  CLI_CONTRACT/README/CHANGELOG.
+
+### WS2 — `vendor` ejects hosted projects  *(branch `v5/vendor-eject`)*
+- Standalone `vendor` today no-ops without `.socket/manifest.json`
+  (vendor.rs ~672). New behavior: with no manifest, take the patch set from
+  the hosted pins in the lockfiles (uuid in the hosted URL), fetch records
+  from the API, vendor each into `.socket/vendor/`, and rewire the lock
+  from hosted → vendored (reuse `scan --mode vendored` takeover path, or
+  WS1's upstream-restore + vendored rewrite).
+- `vendor --revert` → back to upstream (WS1 mechanism), not hosted.
+- `lib.rs` after_help line "socket-patch vendor  Eject…" becomes true;
+  README tutorial/“Work offline” switch back to `socket-patch vendor`.
+
+### WS3 — One lockfile model per ecosystem  *(branch `v5/lock-models`)*
+- Today pnpm-lock.yaml has 7 readers (redirect/mod.rs pnpm, vendor/pnpm_lock,
+  pnpm_lock_legacy, lock_inventory/pnpm, lock_inventory/wired+recover,
+  get.rs:1511 heuristic, repair_vendor scan_vendor_references); cargo 3
+  grammars (redirect/mod.rs:1059–3261, vendor/cargo_lock+cargo_manifest,
+  takeover.rs); gem 2; composer 3; yarn/bun partially shared.
+- Target: `core/formats/<fmt>` per lock format, parse once, exposing
+  `entries()` (inventory), `wired_refs()` (vex discover + repair),
+  `plan_hosted()`, `plan_vendored()`, `restore_upstream()` (WS1), `in_use()`.
+  Follow the `utils/python_lock.rs` pattern (already shared by disk + memory).
+- One PR per family: pnpm (incl. legacy — support must stay) → cargo → gem →
+  composer → yarn/bun/npm/vlt → go/maven/nuget.
+- Gate: redirect golden fixtures (shared with depscan TS), the
+  `*_equivalence_tests`, vex discover goldens, lock_inventory tests,
+  byte-exact CRLF output.
+- Also unify the 4 "which files carry wiring" lists into `formats::registry()`.
+
+### WS4 — One hosted engine, disk + memory  *(branch `v5/one-hosted-engine`)*
+- Both functions stay: disk `scan/get --mode hosted` and the in-memory
+  engine (`hosted_memory/`, used by `socket-patch-node` and `hosted-bundle`).
+- Extract plan → rewrite → edits from `run_redirect_selected`
+  (scan/hosted.rs:1205–3358, 2.1k LOC) into a pure core function over
+  `ProjectView`; `hosted_memory` calls it (delete its redirect.rs/ledger.rs
+  copies, ~2.5k LOC); disk keeps only lock, probes, symlink guard, commit.
+  Move the engine to core so `socket-patch-node` stops depending on the CLI
+  crate. Keep `hosted_memory_parity` green until the final commit.
+- Depends on WS1 (no ledger delta to merge) and benefits from WS3.
+
+### WS5 — Consolidate vendored apply/revert wrappers + cut ledger rebuild  *(branch `v5/vendor-backend`)*
+- Apply wrappers (4): `vendor.rs run/run_vendor`, `scan/vendor_flow.rs`
+  (json/interactive/preview/legacy + 7 `boxed_*` shims), `get.rs
+  run_get_vendored`, `repair_vendor.rs` (1.2k-LOC fn). Revert wrappers (3):
+  `vendor.rs run_revert`, `rollback.rs run_vendored_leg`, `remove.rs
+  revert_vendored_matches`. → one `VendoredBackend { apply, revert, repair }`.
+- Cut `repair`'s vendored-ledger re-synthesis from lockfiles; repair
+  re-downloads missing/corrupt artifacts from the vendoring service/remote.
+- **Caveat to verify first:** the local rebuild path (`vendor/npm_pack.rs`,
+  `pypi_wheel.rs`, `berry_zip.rs`, `registry_fetch.rs`, `prestage.rs`) may be
+  what depscan's server-side vendoring uses via the CLI for packing. Check
+  `../depscan` (grep for `socket-patch`, `vendor-source`, `npm_pack`,
+  `hosted-bundle`, napi usage) before deleting anything; if used, keep it as
+  a library path.
+
+### WS6 — Unified ledgers/context  *(branch `v5/project-context`)*
+- After WS1 only two stores remain (manifest for agent mode, vendor
+  `state.json`). One `Ledgers` view with one owner-precedence rule replaces
+  the 7 merge implementations (list combined_entries, fold_vendor_records,
+  scan merge_ledger_records_for_updates, vex_sources plan/build_candidates,
+  classify_overlap_takeover, rollback, remove) and the 61 load sites.
+- `ProjectContext` (crawl snapshot, lock set, ledgers; lazy) shared by
+  scan/vendor/vex/list/get; `get` reuses scan's discovery instead of
+  get.rs:1583.
+
+### WS7 — Remove `setup`  *(branch `v5/remove-setup`)*
+- Delete the `setup` subcommand, core/setup/**, package_json/** helpers only
+  setup uses, the setup-matrix CI job, and the Bundler plugin gem +
+  `socket-patch-hook` wheel publishing (or mark them deprecated/unpublished;
+  confirm with owner before deleting release workflows). Keep `apply`.
+  Docs: agent mode = `scan --mode agent` + `socket-patch apply` in CI.
+
+### WS8 — Patch UI streamlining  *(branch `v5/ui`)*
+- `-h` shows ~8 options (hide_short_help for the rest); hide deprecated
+  `--apply/--vendor`; one-line npm allow-remote note; no `(code)` tags in
+  human warnings; "hosted" not "redirect" in human text; one shared
+  Next-steps renderer; hosted/vendored `get` without prompts; `list` without
+  manifest says "No patches in this project"; unify cancel/upsell strings;
+  exit 2 for all usage errors; scan/get JSON onto `json_envelope`.
+- Full item list: 22 findings from the UI review (sizes S/M/L, contract flags).
+
+## Remaining small follow-ups
+- ci.yml `e2e_cargo`/`e2e_golang` rows select `--ignored` but have no ignored
+  tests (vacuous legs) → give them `--include-ignored` or drop the rows.
+- `e2e_vendored_production` GEM_PATCHES lacks merged `01019627` (v5 ranking
+  picks it) and `9c2b4925`.
+- `utils::process::tool_command` has no prod callers.
+- Deprecated re-export aliases in core (`patch/mod.rs`, `lib.rs`,
+  `utils/mod.rs`) — drop in v5.
+- `scripts/backtest-poetry.py:541` "known crawler gap" label.

From 686e5fb497cb50bd62162dcd3b15718149fa3927 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Mon, 28 Sep 2026 06:53:14 -0400
Subject: [PATCH 13/32] v5 WS1+WS2: ledger-free hosted mode, upstream-restore
 rollback, vendor ejects hosted projects (#280)

* Stop writing the hosted redirect ledger from scan

Hosted scan keeps its edits and records in memory only; the lockfiles
are the record of a redirect. Replays the parked WIP (which was
snapshotted on an older tree) as just its hosted.rs delta.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Restore hosted pins to their upstream registry entries instead of replaying the ledger

Imports the stopped local WS1 agent's work-in-progress (backup/local-v5-
ledger-free-hosted): core patch::redirect::upstream re-resolves npm-family,
cargo and golang registry entries for every hosted pin vex::discover finds
in the lockfiles, and rollback/remove/vendor route their hosted legs
through it instead of the redirect ledger.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Update rollback prompt unit test for the upstream-restore wording

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Derive list, scan updates and takeover state from lockfile hosted pins

v5 keeps no hosted ledger, so every reader that consulted
.socket/vendor/redirect-state.json now reads the hosted pins lockfile
discovery finds:

- list shows each hosted pin with the lockfiles wiring it (details.lockfiles);
  a pre-v5 ledger only supplies the details of pins it still describes.
- scan's updates[] fold, redirectState block and the agent-flow
  hosted_wiring_retained probe read the pins.
- The hosted-over-vendored takeover classifier reads the pins; the
  vendored-over-hosted ledger reconcile (vendor_supersedes_redirect) is
  gone: once the lock routes a package to .socket/vendor/ no hosted state
  is left to go stale.
- vex treats a malformed pre-v5 redirect ledger as an advisory.

scan/mod.rs unit tests still need rewriting (WIP).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Drop the hosted ledger from get, repair, the in-memory engine and the scan fold

- get's vendored lock-text gates read the lockfiles' hosted pins instead of
  the redirect ledger (DownloadParams carries --patch-server-url for it).
- repair's hosted-only no-op fires for hosted lockfile pins (or a pre-v5
  ledger).
- The in-memory hosted engine neither reads nor emits
  .socket/vendor/redirect-state.json.
- Disk hosted scan no longer folds edits into a throwaway ledger; its
  records feed only the stale-install probes and in-run VEX.
- The cargo vendor backend's hosted_redirect_live refusal names rollback /
  git checkout instead of a ledger.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* vendor ejects a hosted project; vendoring over any hosted pin restores upstream first

WS2: standalone `vendor` with no manifest now takes its patch set from the
lockfiles' hosted pins (purl + the uuid in each hosted URL), fetches each
record from the API, vendors it into .socket/vendor/ through the same step
`scan --mode vendored` and `get --mode vendored` use, and rewires the lock
from hosted to vendored. Without hosted pins it keeps the no-manifest
no-op.

The vendor takeover now restores the upstream registry entry before
vendoring for every ecosystem, not only cargo/npm/golang, so the vendor
ledger always records the upstream entry as its original and
`vendor --revert` returns to upstream rather than to hosted. A pin whose
upstream entry cannot be restored is refused with the checkout remedy.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Rewrite scan/mod.rs takeover unit tests for lockfile-derived hosted state

v5 hosted mode keeps no ledger, so the scan/mod.rs unit tests now make a
purl "hosted" by writing a lockfile that pins the hosted URL instead of
planting .socket/vendor/redirect-state.json:

- overlap / classify_overlap_takeover tests use hosted package-lock,
  yarn (classic + berry), bun and cargo sparse-index pins; the
  non-default-host test configures --patch-server-url and pins that an
  unconfigured host is no pin.
- New behavior pinned: a pre-v5 ledger on disk is never hosted state;
  a lock routed to vendored (npm or cargo) yields no pin and no overlap;
  an edits-only state names no package; a half-migrated project whose
  locks name both sides stays silent; the redirectState block has no
  ledger/ledgerKey fields.
- hosted_wiring_retained_purls / redirect_state_json tests read the
  lockfile-derived state, keeping the probe's own liveness gate covered.
- Removed tests of retired behavior: note_vendor_supersedes_redirect
  reconcile (wet/npmrc/dry-run/no-op/persist-failure), the edits-only
  fallback (degraded ledger, vlt tilde keys) and following the vendored
  remediation.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Restore hosted gem and composer pins to their upstream entries

Add the RubyGems and Composer restorers to the v5 ledger-free hosted
unwind (`redirect::upstream`).

Gem (Gemfile.lock / gems.locked + Gemfile / gems.rb): a converged Socket
GEM section is removed and its spec moved back, in name order, into the
upstream section (the single remaining one, else the manifest's global
source or rubygems.org, else refused as ambiguous); a bundler <= 2.1
merged section loses only the Socket remote; the DEPENDENCIES `!` pin is
dropped; CHECKSUMS is re-pinned from the rubygems.org compact index. The
Gemfile source block becomes `gem "n", "v"[, opts]` again (the original
constraint is not derivable), or is removed with its DEPENDENCIES entry
only when provably a transitive append. The pre-2.6 mixed state is undone
when a pin is supplied, keeping the untouched lock's own constraint.

Composer: dist {type,url,reference,shasum} and the dropped source block
are rebuilt from packagist p2 metadata (composer/2.0 minified, expanded),
cross-checked against the lock's dist.reference, in the lock's indent,
slash style and line endings. Non-packagist entries are refused.

UpstreamClient gains cached rubygems and packagist lookups
(SOCKET_RUBYGEMS_URL, SOCKET_PACKAGIST_URL).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Fix clippy findings in the eject and takeover paths

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Restore hosted PyPI pins to their upstream registry entries

Add the Python family to the v5 hosted -> upstream restore: Pipfile.lock,
requirements.txt, Hatch direct references (pyproject.toml / hatch.toml),
poetry.lock, pdm.lock, and uv.lock / PEP 723 script locks / PEP 751 pylock
files with their paired pyproject / script metadata.

Each restorer rewrites only entries whose reference is a hosted URL for an
in-scope patch uuid and re-derives what the hosted rewrite overwrote from
PyPI's JSON API (UpstreamClient::pypi_files, base overridable with
SOCKET_PYPI_JSON_API, cached like the other lookups). Where a field is not
derivable the pin is refused instead of guessed: requirements hash-checking
mode that no other line settles, a Pipfile.lock index that is not PyPI,
PDM locks without cross_platform (or uv locks) when the release ships
platform- or interpreter-specific wheels, uv locks with no sibling
registry package to show the artifact shape, several or non-PyPI
registries, exclude-newer / no-binary / no-build filtering, multi-clause
uv specifiers with no spelling evidence, uv 0.2 [[distribution]] locks,
offline runs and registry failures.

The golden harness round-trips the native Poetry (1.0-2.4), PDM (every
supported lock_version) and Pipenv fixtures plus synthetic
requirements/Hatch/uv/pylock projects through the real hosted rewriter;
the shared requirements golden restores modulo the grant's name casing and
the uv golden (no registry sibling) is refused.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Restore vlt, Maven and NuGet hosted pins to their upstream entries

vlt-lock.json: slot [2] from npm dist.integrity, slot [3] per the lock's
own convention (same-era default-registry siblings, else DepID era and
options.registries), every hosted instance of name@version together.
Maven (no network): base versions back, added dependencyManagement
entries, socket-patch repositories and emptied wrappers removed,
trusted-checksum lines dropped and .mvn files deleted only when nothing
but hosted content is left; module poms and stray suffix uses refuse.
NuGet: socket-patch source and mapping removed, a mapping that only fans
* out to every source dropped; packages.lock.json contentHash re-derived
from nuget.org's catalog packageHash (SOCKET_NUGET_URL), refusing when
the restored config does not resolve the id from nuget.org alone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Drop dead fixture fields clippy flags in covgap_commands_rollback

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Retire a pre-v5 hosted ledger when rollback finds nothing else; update the cargo guard test

rollback in a project whose only state is a stale pre-v5
redirect-state.json (no manifest, no vendor ledger, no hosted pin in the
lockfiles) removes that file and exits 0 instead of failing on the missing
manifest.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Feed the hosted scan's in-run VEX this run's records

The in-run `scan --mode hosted --vex` attestation read its hosted records
from the ledger the run had just written. With no ledger, the run's
fetched records reach the VEX builder in memory (VexBuildParams
hosted_records), merged over any pre-v5 ledger's.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Refresh doc comments that still described the hosted ledger

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* vendor --revert restores hosted pins a pre-v5 vendor ledger re-creates

A package vendored over hosted wiring before v5 recorded the hosted
fragment as its pre-vendor original, so reverting it wired the lock back to
the patch server. After a wet revert, any hosted pin on a reverted purl is
restored to its upstream registry entry (warning
vendor_revert_restored_upstream; a refused restore is a failed event,
hosted_restore_failed, exit 1).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Refuse around contested hosted wiring; refuse offline eject before any request

Review follow-ups:

- core HostedInventory keeps raw hosted wiring apart from attributable
  pins: a hosted identity discovery recognizes but cannot attribute (locks
  that disagree, a malformed reference, a lockless registry pin) is
  contested wiring. rollback (unscoped), remove, list and vendor refuse
  around it with hosted_wiring_contested, naming the files and the
  git checkout remedy, instead of reporting a bare project.
- vendor's eject refuses offline (flag or env, wet or dry) with
  offline_eject_unavailable before it builds any request.
- Drop the stray upstream/client.rs.orig merge backup.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Make eject one transaction: plan, restore upstream, vendor, or roll back

Review follow-ups on the hosted -> vendored eject:

- Every patch record is fetched first; one the API cannot serve refuses
  the whole eject (eject_refused) before anything is touched.
- The upstream restore is planned first (a dry resolve of every pin); a pin
  that cannot be restored refuses the whole eject with its remedy.
- A dry run stops at the verified plan (eject_planned events) and writes
  nothing, not even .socket/.
- The wet run takes the apply lock once, snapshots every file the eject
  can touch (root files, pin and restore files, cargo/maven config, the
  vendor ledger, vendored uuid dirs), restores the pins upstream BEFORE the
  vendor engine inventories sources (so a fresh checkout with nothing
  installed resolves the pristine registry package), vendors, and on any
  failure puts the snapshot back (eject_rolled_back): a failed eject
  leaves the project hosted, byte for byte.

Adds failure-injection and dry-run coverage.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Rewrite hosted rollback/remove coverage-gap tests to the v5 upstream restore

Hosted state is the lockfile pin: rollback/remove restore the default
upstream registry entry (mock npm registry via SOCKET_NPM_REGISTRY), a
refused pin (offline, registry 404, missing integrity) fails closed with
the git-checkout remedy, and a pre-v5 ledger is never replayed but
retired once no pin remains. Ledger-persist failure tests become
restored-lockfile write failure tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Rewrite hosted rollback/remove/vex-step tests to the ledger-free v5 contract

- in_process_rollback_hosted (+ vlt): hosted pins come from the lockfiles
  and are restored from a mock npm registry; per-pin refusal, scoped
  restores, legacy-ledger retirement (never replayed), preserve-state,
  and the vlt heal following restored pins. A vlt project re-locked onto
  the registry has no hosted state left to roll back.
- coverage_fix_rollback_ecosystem_scoped_replay -> ..._scoped_hosted:
  --ecosystems never restores another ecosystem's pin nor retires the
  pre-v5 ledger while a pin remains.
- e2e_golang_hosted_state: rollback and vendor takeover restore go.sum
  from a mock checksum database; offline refuses.
- redirect_npm_allow_remote: no ledger records the .npmrc edit; restore
  deletes only a pristine scaffold .npmrc and reports a kept
  allow-remote=all line (npm_allow_remote_left).
- hosted_symlinked_files, repair_invariants: no ledger is written; a
  lockfile-pin-only project takes the redirect_only_project skip.
- vex_pipenv_pip_steps: a reverted checkout with no ledger is the plain
  manifest_not_found error; apply --vex fetches the record online when
  no ledger supplies it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Rewrite hosted scan/get integration tests for the ledger-free v5 contract

Hosted scan/get write no .socket/vendor/redirect-state.json: assertions on
the ledger become "no ledger" plus lockfile facts; pre-v5 (incl. corrupt)
ledgers are pinned as ignored and left byte-identical; ledger-write failure
tests become "a read-only .socket/vendor or a squatting dir no longer
blocks the run"; re-runs are pinned idempotent on the lock bytes.

Rollback round trips now name the mock host with --patch-server-url and
mock the upstream registry (SOCKET_NPM_REGISTRY / SOCKET_PYPI_JSON_API);
berry CRLF/BOM, bun digestless, pnpm, poetry, pdm and pipenv restores are
checked against the pristine locks. bun.lockb rollback pins the refusal.
Manifest-less VEX legs attest from lock + API, and use a synthesized
pre-v5 ledger as the extra local record source for the offline and
redirect_unwired legs. scan redirectState/hosted_wiring_retained/updates
are pinned to lockfile pins; vendor_supersedes_redirect is gone.

vlt_hosted_common gains assert_no_ledger, legacy_record_from_view and
write_legacy_ledger (additive).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Tidy hosted remove/rollback messages and legacy-ledger residue

- remove's hosted_revert_failed message is the restore's own refusal (it
  already names the pin and the remedy) instead of wrapping it twice.
- Retiring a pre-v5 ledger prunes the emptied .socket/vendor/.
- The in-run hosted VEX summary says patches are attested from their patch
  records, not from a ledger.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Rewrite list and vex ledger tests for lockfile-derived hosted state

list: hosted entries are lockfile pins (details.mode hosted,
details.lockfiles, no details.ledger); a pre-v5 ledger only details a
matching pin and never lists a record by itself. vex: a malformed pre-v5
redirect ledger is the redirect_ledger_corrupt warning, the run proceeds
and the file is left byte-identical.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Rewrite manifest-less VEX suites for the ledger-free hosted mode

v5 hosted mode writes no .socket/vendor/redirect-state.json, so the shared
harnesses (vex_pdm_hatch_common, vex_pipenv_pip_common, vex_e2e_common/bun
and vlt, npm_e2e_common/manifestless) now assert the hosted wiring run left
NO ledger, while vendored keeps its .socket/vendor/state.json cells.
Hosted cells that relied on the ledger now pin the new contract: offline
with no local record is record_unavailable, online attests from the API,
and a reverted hosted lock leaves nothing to discover. vendor over hosted
pins is the eject flow, so the manifest-less embedded cells drive apply
for hosted checkouts and a new cell pins the eject path. One focused cell
shows a committed pre-v5 ledger still lets a hosted pin attest offline
(new additive helpers: write_legacy_redirect_ledger,
assert_no_hosted_ledger, LEGACY_REDIRECT_LEDGER).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Teach the real-uv VEX matrix the ledger-free hosted mode

A hosted uv flow writes no ledger: assert that, run the embedded steps
online (no local record), expect nothing discovered once the wiring is
reverted, and take a hosted production leg's record from the public
patch API instead of the removed ledger.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Run the real-uv hosted revert against the v5 rollback contract

A hosted uv flow commits no .socket/, so copy_tree tolerates a missing
source; rollback needs --patch-server-url for a pin on the mock origin,
and restores each pin to its upstream registry entry or refuses it with
the version-control hint (asserting nothing was written) instead of
replaying ledger bytes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Delete the hosted ledger replay engine; keep a read-only legacy loader

v5 derives hosted state from lockfile pins and restores upstream entries
by re-resolving them from the registry, so nothing reverts recorded ledger
fragments any more. Remove the replay machinery and the writers behind it:

- patch/redirect/replay.rs and takeover.rs (fragment replay, per-purl
  npm/cargo/golang revert, redirect_revert_supported)
- state.rs persist_redirect_state, drop_superseded_purl, quarantine and the
  unclassified-edit guards; load_redirect_state stays for migration reads
  and save_redirect_state stays doc(hidden) for laying down pre-v5 fixtures
- npmrc unwind planners, bun.lockb snapshot restore, pipenv/vlt/bun text
  inverses and the EOL fragment respelling that only replay used
- tests that only exercised replay; rewrite round-trips in the poetry/uv
  suites keep their forward and idempotency assertions (the upstream
  restore of those formats is covered by upstream_restore_golden)

hosted_url_names/hosted_url_version move to a small hosted_url module
shared by the bun rewriter and VEX discovery.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Document the ledger-free hosted contract and hosted eject

Update CLI_CONTRACT.md, README.md, CHANGELOG.md [Unreleased] and the
testing/ecosystem docs to v5's WS1/WS2 behaviour: hosted mode writes no
redirect ledger; rollback/remove restore hosted pins to their upstream
registry entries (per-format coverage, refusals incl. --offline and
bun.lockb, the git checkout remedy); list/vex/scan/repair derive hosted
state from the lockfiles (details.lockfiles, the new redirectState shape,
redirect_ledger_corrupt as a warning); vendor ejects a hosted project and
vendor --revert returns to upstream; vendor_supersedes_redirect and
hosted_revert_unsupported are gone; the pre-v5 ledger is read for
migration only and retired by rollback; new registry env overrides.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Rewrite vendor takeover covgap tests to lockfile hosted pins; add WS2 eject tests

covgap_commands_vendor: a pre-v5 redirect ledger (even malformed) is now
ignored; the takeover guard is driven by hosted pins in package-lock.json
on a --patch-server-url origin (dry-run advisory against a mock registry,
wet takeover + revert back to the upstream registry entry, offline refusal
redirect_revert_failed, unconfigured origin is not hosted). The
redirect-ledger write-failure test has no subject anymore and is removed.

vendor_eject (new): standalone vendor in a hosted npm project ejects the
pins into .socket/vendor/ (no ledger, no manifest), vendor --revert returns
to upstream, a failed view fetch is patch_fetch_failed/exit 1, and no pins
keeps the no-manifest no-op.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Rewrite in_process_vendor hosted takeovers to the v5 upstream restore

The berry CRLF takeover and the pnpm/package-lock hosted->vendored
conversions no longer see a redirect ledger: vendor runs online against a
mock npm registry (SOCKET_NPM_REGISTRY) with the patch-server origin
configured, restores the upstream entry, and vendor --revert / rollback
land on the upstream registry entry. Adds an offline-refusal test
(redirect_revert_failed with the checkout remedy).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* mode_migration_npm: hosted takeovers restore the upstream registry entry

Hosted mode writes no ledger; vendor over a hosted yarn pin now runs
online with --patch-server-url and restores the upstream entry first
(classic legs read a registry document mirrored from the pristine lock via
SOCKET_NPM_REGISTRY, so the unwind is hermetic). The reverse classic leg
replaces the ledger-originals check with a rollback back to the pristine
registry lock.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* mode_migration_cargo: hosted takeovers restore the crates.io entry

Vendor over a hosted cargo pin runs online with --patch-server-url and a
sparse-index mirror (SOCKET_CRATES_INDEX) of the pristine checksum; the
ledger-deletion fail-closed test becomes an offline-refusal test
(redirect_revert_failed + checkout remedy) keeping the half-reverted
hosted_redirect_live backstop, which now names rollback / git checkout.
The hosted leg of the manifest-less VEX matrix fetches its record from the
API (no hosted ledger).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* mode_migration_bun: no hosted ledger; unwinds restore the upstream 4-tuple

Every run carries SOCKET_PATCH_SERVER_URL (the mock patch origin) and
SOCKET_NPM_REGISTRY (a mirror of the pristine lock's integrities), so
vendor takeovers, rollback and remove restore the registry 4-tuple; the
ledger record/edit assertions become no-ledger assertions. VEX over a
stale manifest may name the superseded uuid only in vex_record_superseded.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* in_process_vendor_bun_takeover: hosted pins without a ledger

bun: every run names http://patch.test the patch server and points
SOCKET_NPM_REGISTRY at one shared registry mirror of the pristine
integrities; hand-written hosted fixtures are the lock's URL 3-tuples
only, and the ledger record/edit assertions become no-ledger assertions
(the unwinds restore the registry 4-tuple byte-exactly).

vlt: scan/vendor/get/rollback over a hosted pin run online against the
mock origin and a registry mirror; the fixture lock records
options.registries so the upstream restore re-derives slot [3] exactly.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* e2e_bun_lockb: binary hosted pins are refused by rollback and vendor takeover

v5 restores a hosted pin's upstream entry instead of replaying a ledger,
which a binary bun.lockb cannot get: vendor over the hosted pin (dry and
wet) and rollback of it now refuse with the git-checkout remedy and write
nothing; the tests apply that remedy and continue the round trip.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* e2e_redirect_bun_build: no hosted ledger; rollback restores the upstream 4-tuple

The hosted run writes only bun.lock (asserted: no ledger). Rollback and
its dry run carry the mock origin as the patch server and a registry
mirror of the pristine integrity, so the upstream restore lands on the
pre-redirect lock byte for byte; the repeat-run heal is checked in the
lock alone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* e2e_redirect_yarn_classic_build: hosted run writes only yarn.lock

Assert no redirect ledger is written, and carry .socket/ into the fresh
checkout only when it exists (v5 hosted mode writes nothing there).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* e2e_redirect_gem_stale_install: no ledger fallback in hosted mode

The re-fire-from-ledger test becomes a re-scan with a failing record fetch:
record_fetch_failed with the v5 VEX-omission detail, exit 0, wiring
byte-identical, no ledger. Manifest-less VEX drops the ledger-kept cells:
a stale unconverged pair and a reverted pair attest nothing.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* e2e_redirect_pnpm_build: no hosted ledger; rollback restores the resolution

The hosted run and its idempotent re-run write no ledger (the trust
setting and lock splice are checked on disk). The v5/v6 synthetic legs
replace the ledger-original checks with a rollback that re-resolves the
upstream integrity from a registry mirror and lands on the pristine lock
byte for byte; the pinned matrix rollback runs online the same way, and
its vex checks fetch the record from the API (no ledger to read offline).
.socket/ is copied into fresh checkouts only when present.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* e2e_redirect_cargo_shapes: remove restores crates.io entries without a ledger

The post-install vex fetches records from the API (no hosted ledger), and
remove runs with a sparse-index mirror of the pristine checksums and the
mock origin named the patch server, restoring every shape byte for byte.
One inherent v5 difference is pinned: a .cargo config that lacked a final
newline gets it back, since without a ledger fragment the rewriter's
separator is indistinguishable from a terminated file's.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* e2e_redirect_cargo_build: the three-file rewrite is the whole hosted state

Assert no ledger after scan/get --mode hosted; the post-install vex and
the manifest-less matrix fetch the record from the API (the ledger-kept
cells go), and reverted locks attest nothing. .socket/ travels into the
fresh checkout only when present.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* golang hosted e2e: go.mod/go.sum is the whole hosted state

get --mode hosted in a module and in a go.work root now asserts no
redirect ledger is written; the manifest-less VEX tail already covers the
ledger-less shape.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Format the rewritten vendor/hosted test files

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Pin that a transactional eject emits no per-purl takeover warning

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Document the transactional eject, offline refusal and contested wiring

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Drop a stale comment on the hosted unwind error

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Prove eject from a fresh hosted checkout; verify hash-pinned requirements

The eject restores every hosted pin's upstream registry entry before the
vendor engine takes its source inventory, so a fresh checkout (no
node_modules, empty CARGO_HOME, no virtualenv) fetches the pristine
source from the registry and verifies it against the restored checksum.
New subprocess tests pin that for npm, cargo and pypi.

The pypi case exposed that requirements.txt `==` pins never carried their
`--hash=sha256:` digests into the lock inventory, so a hash-pinned pin
with no installed copy was unverifiable. Carry them as the entry's
integrity (any-of, like Pipfile.lock) while the file resolves from the
public index; an index option keeps every pin unverifiable.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Give the stale-Pipfile rollback test a derivable hash mode

A requirements.txt whose every line is a hosted pin is refused by the
upstream restore (hash-checking mode is not derivable). Add an unhashed,
unpatched sibling so the test still pins a successful restore.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* node addon smoke: a wet hosted session writes no ledger

The in-memory hosted engine emits only lockfile/config edits in v5, so
assert no .socket/ output instead of requiring the redirect ledger.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* covgap scan_hosted: unreadable-workspace case asserts no ledger

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Rewrite the CI-only e2e suites and backtests to the ledger-free hosted contract

v5 hosted mode writes no .socket/vendor/redirect-state.json: every
#[ignore]d real-toolchain capstone and every compatibility backtest that
read the redirect ledger now asserts it is absent and reads the facts
from the lockfile (or the public API record) instead.

- npm / yarn berry / composer / gem / maven / nuget / rush / poetry /
  pdm / hatch / pypi-real / yarn-classic matrices: no-ledger assertions;
  vex offline with no local record is record_unavailable; a reverted
  hosted lock names the patch nowhere (manifest_not_found, exit 2);
  a manifest-less `vendor --vex` is no longer run over hosted pins
  (it ejects them now).
- Mock-origin hosted pins pass --patch-server-url to vex / rollback /
  remove / vendor / scan --mode vendored; the vlt harness gains
  rollback_upstream / Fixture::rollback with SOCKET_NPM_REGISTRY pointed
  at the harness registry.
- Rollback legs expect the upstream registry entry back: npm (real
  registry, JSON-equal lock, .npmrc removed), composer 2 (byte-identical
  from packagist; composer 1's inline repository refuses with the
  git checkout remedy), maven (--offline, byte-identical pom), poetry
  (real PyPI), vlt (byte-exact per era); the production npm leg gains a
  real-registry rollback on a copy.
- vlt: URL-less / update-dropped pins now find no state ("Manifest not
  found"); the TS-written lock restores to its input and the pre-v5
  ledger is retired; mode migrations restore upstream before vendoring.
- Backtests (bun, pdm, pipenv, poetry, vlt, uv docs): hosted records come
  from the public /patch/view/<uuid>; noLedger checks are unconditional
  for hosted; rollback checks expect the upstream entry (bun custom
  registry slot comes back as "", bun.lockb refuses with the remedy);
  the vlt downgrade leg asserts the pin with no ledger.

Core fix: the vlt upstream restore added a slot [3] tarball URL to a
single-node lock whose options record `registry` (vlt rc.33 .. 1.0.4
with config.registry), which vlt itself never writes (save.ts omits the
resolved URL when it starts with the configured registry); rollback was
not byte-exact on those eras. The no-siblings fallback now honours that
rule (unit-tested).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Hold the vlt configured-registry slot [3] rule pending real-vlt evidence

The rule in 44240a2 drops slot [3] when a lock records options.registry,
matching vlt rc.33..1.0.4, but it breaks the vlt-lock-v1-both-registry-keys
golden, and newer vlt releases have not been checked yet. Restore the
previous behaviour until real captures decide it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Backtests: send a User-Agent on public patch-view fetches

The hosted backtest legs now read the patch record from the public proxy's
/patch/view/<uuid>, and CI got HTTP 403 for Python's default urllib
User-Agent (the poetry 1.4-2.x native legs). Send an explicit agent, as the
vlt backtest's api_get already does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Re-land the vlt configured-registry slot [3] rule on real-vlt evidence

vlt's lockfile save (identical in 1.0.0-rc.33, 1.0.4, 1.0.10 and 1.2.0)
writes a default-registry node's resolved URL (slot [3]) only when no
`registry` is configured or the URL does not start with it, and records
that `registry` in `options.registry`. Real installs of left-pad@1.3.0
with `config.registry` + `registries.npm` set to the default registry
produce a byte-identical 3-tuple lock on all four releases.

- upstream::vlt: the no-siblings fallback of `records_url` no longer
  adds slot [3] under a recorded `options.registry` the node resolves
  under (unit test covers both sides).
- fixtures: `lock-v1-both-registry-keys` was hand-written with slot [3];
  its input (and expected-edits original) now match the real lock byte
  for byte, and the real capture is added as
  `capture-1.2.0-config-registry` (vex-discover golden extended).
- docs/testing/vlt-compatibility.md records the rule and the evidence.

Without the rule the real-vlt legs that restore a single-node lock of a
`config.registry` project (the harness configures it for rc.33 .. 1.0.4)
are not byte-exact: hosted idempotence / crlf_lock and the migration
scoped_unwind / rollback_from_mixed / agent_rollback_after_takeovers
legs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* hosted-e2e uv leg: serve the record of the uuid the lock pins

pypi_uv_lock_hosted_install_proof handed all three PYPI_UUIDS to
uv_vex::production_manifestless. With no local record (v5 hosted keeps
no ledger) production_record takes the FIRST of those the public proxy
answers for, so the VEX stand-in served de58c8b8 while the resolver had
granted (and uv.lock pinned) e828efa5: every manifest-less cell then
asked the stand-in for e828efa5 and got `vex_record_not_found` /
`record_unavailable`. Pass exactly the wired uuid instead; if production
ever grants a uuid its public view will not serve, production_record now
fails naming it rather than masking it behind another patch's record.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* PDM static_urls restore writes files in URL order; bun backtest User-Agent on artifact fetches

PDM orders a static_urls entry's files by URL (the sdist under 0c/39
precedes the wheel under b0/53 for urllib3 1.26.18); the upstream restore
wrote them in filename order, so hosted rollback wasn't byte-exact. The
golden now uses real bucketed URLs so the order differs from filename order.

The bun backtest's lockb digest and asset downloads now send the same
User-Agent as the patch-view fetch (patch.socket.dev 403s urllib's default).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* covgap rollback: macOS-only blob-pin check derives hashes from the fixture bytes

The fixture no longer carries before_hash/after_hash; the macos-gated
manifest-write-failure test still read them and broke the macOS build.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Round-trip hosted rollback of unpopulated Poetry 1.0/1.1 locks

Poetry 1.0/1.1 record `[metadata.files] <name> = []` against today's PyPI
JSON API, while locks written earlier list every release file. The hosted
rewrite replaced either with the one-entry patched array, so rollback could
not tell them apart and always re-derived the full release list: the
backtest's `direct` and `crlf` shapes (literal `urllib3 = []`) failed
rollbackRestoresLockBytes on Poetry 1.0.10 and 1.1.15.

The rewriter now keeps that bit in the patched entry's layout: one file per
line (Poetry's own rendering) when the original listed files, inline when
it was `[]`; a re-run keeps the layout it finds. The restore reads it back
and writes the full release list or `[]`.

Adds a golden round-trip over every native fixture generation (1.0.10 to
2.4.3), LF and CRLF, alongside the existing populated-shape one.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* yarn berry e2e: manifest-less VEX matrix expects no hosted ledger

The berry matrix still asserted the pre-v5 .socket/vendor redirect ledger
after a hosted flow. v5 hosted mode writes none: the offline cell now
expects record_unavailable, a reverted hosted checkout discovers nothing
(exit 2 manifest_not_found), and manifest-less apply --vex is a calm
no-op. The yarn4 pnpm-linker and workspaces fresh checkouts copy .socket/
only when it exists, as the node-modules berry test already does.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* e2e vex poetry: accept the one-file-per-line metadata.files pin

A populated lock-1.0/1.1 [metadata.files] entry now keeps Poetry's
multi-line layout after the hosted rewrite (so rollback can tell it from
an originally empty one); the pin-spelling matrix strips that form too.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Keep Pipenv's index on hosted entries so rollback restores it exactly

The hosted Pipfile.lock rewrite dropped each entry's `index`, and the
ledger-free upstream restore then guessed it from sibling registry
entries (none -> the PyPI source name; all siblings index-less -> none).
Pipenv's own choice cannot be re-derived from the lock or the Pipfile:
for the same Pipfile it depends on the release and the locking
environment (measured with real `pipenv lock`):

  shape            2018.11.26  2020-2022  2023.12.1-2026.8.0
  direct           pypi        pypi       pypi
  extras table     pypi        pypi       (none)
  marker-excluded  pypi        (none)     (none)
  transitive       (none)      (none)     (none)

So the backtest's rollbackRestoresLockBytes failed on 2022.12.19
extras (transitive pysocks sibling has no index -> index dropped) and
on 2022.12.19 / 2026.8.0 marker-excluded (no siblings -> "pypi"
added), and rollbackAfterRelockRetires failed on 2026.8.0
marker-excluded: the relock hybrid (our `file` kept, `version` and
registry `hashes` restored, no `index`) was restored with an `index`
Pipenv never wrote.

The hosted rewrite now keeps `index` exactly as Pipenv wrote it
(present or absent) and only drops `version`; the restore carries the
entry's `index` back unchanged instead of choosing one, refusing when
it (or the Pipfile's explicit index) does not name a PyPI source in
`_meta.sources`. A `file` entry carrying `index` installs the
referenced wheel itself (direct_url.json present) on Pipenv
2018.11.26, 2020.11.15, 2021.11.23, 2022.12.19, 2023.12.1, 2024.4.1,
2025.1.3 and 2026.8.0 (`install --deploy`, `sync`, `verify`), and a
marker-excluded one stays uninstalled; Pipenv 7-11 ignore `index` on a
`path` entry (convert_deps_to_pip skips it for file/path deps).

Tests: real Pipenv 2018.11.26 / 2022.12.19 / 2026.8.0 locks for the
extras and marker-excluded shapes (tests/fixtures/pipenv-shapes) round
trip byte for byte in LF and CRLF, and the 2026.8.0 marker-excluded
relock hybrid restores the pristine bytes. The backtest's
allCategoriesRewritten now expects hosted entries to keep the pristine
`index` (vendored still drops it).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Restore hosted bun.lockb pins natively for the vendor takeover

With the hosted ledger gone, `vendor` over a live hosted pin in a binary
bun.lockb (Bun 0.8.1-1.1.x's default lock, Bun 1.2's legacy lock) was
refused `redirect_revert_failed`: format_of() mapped bun.lockb to
Unsupported, so the backtest matrix's hosted-then-vendored cell exited
partial_failure.

The upstream restore gains a bun.lockb restorer
(patch/redirect/upstream/bun_lockb.rs). It rebuilds each hosted
remote-tarball record as Bun's npm registry record for name@version,
from the registry's dist.tarball / dist.integrity (SOCKET_NPM_REGISTRY
aware), via the new BunLockb::set_registry_package. That function
re-interns the URL (re-using the original pool offset), drops the
hosted URL string from the pool tail and re-derives the metadata hash.
The staged restore view now carries binary files.

To make the rebuild byte-exact, set_package keeps the registry record's
inactive bytes (padding, semver) when it writes a remote tarball
record. Early writers leave uninitialized padding there (Bun 0.8.1), so
this matters. A re-pin to a later grant's URL now drops the superseded
URL from the pool. A record without the retained bytes is rebuilt the
way Bun writes one; prerelease versions are refused in that case.

The rebuild is exact for every fixture writer except a format-1 lock
(kept promoted) and workspace locks (behaviors kept normalized). So
only the vendor takeover and eject opt in (RestoreOptions::bun_lockb):
their vendor ledger records the rebuilt record, and `vendor --revert`
returns the pre-hosted bytes. `rollback` / `remove` keep refusing a
hosted bun.lockb pin with the `git checkout -- bun.lockb` remedy, as
the harness's rollbackLockbRefused expects. An offline vendor still
refuses.

Tests: core restorer tests over every real fixture, codec tests for the
rebuild (retained and zeroed records, re-pin), a hermetic CLI test
(vendor_eject_bun_lockb.rs: takeover, eject, rollback and offline
refusals on Bun 0.8.1 / 1.1.38 / 1.2.0 locks), and the real-Bun
e2e_bun_lockb takeover now vendors online and reverts byte-exact.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* bun backtest: inject the custom-registry slot with byte I/O

On Windows, Path.write_text turned the injected bun.lock's LF into CRLF, so
the LF pre-injection bytes could never match the (EOL-preserving) upstream
restore: custom-registry hosted rollbackOriginalFiles failed on Windows only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Demote hosted format-1 bun.lockb locks exactly on the vendor takeover

The bun backtest's binary job failed only for the format-1 writers (Bun
0.1.1 / 0.1.6, readers 0.5.9 and 1.4.2) after 65aa074: the hosted rewrite
promotes a format-1 lock to format 2 (format 1 has no URL column), and
the new native upstream restorer rebuilt the registry record inside that
promoted lock. The vendor ledger then recorded the promoted bytes as its
pre-vendor original, so `vendor --revert` returned a format-2 lock and
e2e_bun_lockb's "the revert restores the pre-hosted bytes exactly"
assertion failed. A promoted lock is byte-for-byte indistinguishable from
one Bun 0.1.7+ wrote (same pool order, same metadata hash), and hosted
mode keeps no ledger, so the restorer could not tell.

The codec now marks a lock whenever an edit had to normalize it: seven
magic bytes and a flag byte in the last eight bytes of the root package's
resolution (the root resolution's value union, which no Bun reader reads;
early writers leave uninitialized bytes there, and 1.4.2 / 0.5.9 read such
locks). For a promoted lock those bytes are new, so the mark overwrites
nothing. promote_legacy_format sets NORMALIZED_FORMAT_1;
normalize_workspace_behaviors sets NORMALIZED_WORKSPACE when it changes a
dependency behavior or workspace literal. The vendor ledger's
layout_original path normalizes the original the same way, so its exact
revert is unchanged.

The bun.lockb upstream restorer then:
- demotes a NORMALIZED_FORMAT_1 lock back to format 1 once every hosted
  record is rebuilt (BunLockb::demote_legacy_format, which drops the URL
  column and the URLs the promotion appended to the pool, and succeeds
  only if promoting the result again reproduces the lock byte for byte).
  Otherwise the pins are refused with the `git checkout -- bun.lockb`
  remedy.
- refuses a NORMALIZED_WORKSPACE lock outright with that remedy, since
  clearing the workspace behavior bit cannot be undone. It no longer
  takes the lock over non-exactly.

Tests: the upstream restorer's byte-exact test now covers 0.1.1 / 0.1.6.
Workspace-normalized extension locks refuse, and so does a lock whose mark
carries an unknown flag. The codec rebuild test checks the exact
demotion. vendor_eject_bun_lockb adds the 0.1.1 / 0.1.6 takeover with an
exact revert and a workspace-lock refusal. Locally with real Bun, the
1.4.2 reader x 0.1.1 / 0.1.6 writer cells now pass the takeover and the
exact revert. They then stop at the 0.5.9 legacy reader, which segfaults
on any networked install in this sandbox. The 1.1.45 / 1.2.0 / 1.4.2
cells pass everything except the `extensions` shape, which needs
api.github.com (403 here).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* ci: give the Windows test leg a 50-minute budget

The Windows leg runs the same suite ~1.6x slower than macOS. On the base
branch it already took 34m40s of the flat 35-minute budget, and with this
PR's added tests it was cancelled at the limit mid-run (no failures).
Linux and macOS keep 35 minutes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

* Check out the Poetry and Pipenv lock fixtures byte-exact on Windows

The Windows test leg's CRLF checkout (core.autocrlf) turned the LF-committed
tests/fixtures/poetry, pipenv and pipenv-shapes locks into CRLF, so the
byte-exact upstream-restore round trips (and their derived CRLF variants,
which became \r\r\n) and the Poetry VEX pin-spelling test failed on
Windows only. Mark them -text like the other captured-lock fixtures.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018tncU7u7FK48tubFNA12UQ

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .gitattributes                                |    7 +
 .github/workflows/ci.yml                      |    4 +-
 CHANGELOG.md                                  |  246 +-
 README.md                                     |  218 +-
 crates/socket-patch-cli/CLI_CONTRACT.md       |  273 +-
 crates/socket-patch-cli/src/args.rs           |    2 +-
 crates/socket-patch-cli/src/commands/get.rs   |   41 +-
 crates/socket-patch-cli/src/commands/list.rs  |  254 +-
 crates/socket-patch-cli/src/commands/mod.rs   |   87 +-
 .../socket-patch-cli/src/commands/remove.rs   |  309 +-
 .../socket-patch-cli/src/commands/repair.rs   |   31 +-
 .../socket-patch-cli/src/commands/rollback.rs |  456 +-
 .../src/commands/scan/discovery.rs            |  152 +-
 .../src/commands/scan/hosted.rs               |  538 +-
 .../socket-patch-cli/src/commands/scan/mod.rs | 1580 ++---
 .../src/commands/scan/vendor_flow.rs          |   10 +-
 .../socket-patch-cli/src/commands/vendor.rs   |  936 ++-
 crates/socket-patch-cli/src/commands/vex.rs   |   53 +-
 .../src/hosted_memory/ledger.rs               |  187 -
 .../socket-patch-cli/src/hosted_memory/mod.rs |   59 +-
 .../src/hosted_memory/select.rs               |   17 +-
 .../socket-patch-cli/tests/cli_parse_list.rs  |  361 +-
 .../tests/common/yarn_classic_vex.rs          |    8 +-
 ...ge_fix_rollback_ecosystem_scoped_hosted.rs |  146 +
 ...ge_fix_rollback_ecosystem_scoped_replay.rs |  143 -
 ...overage_fix_scan_hosted_dryrun_vendored.rs |    9 +-
 .../tests/covgap_commands_get.rs              |    1 +
 .../tests/covgap_commands_remove.rs           |  346 +-
 .../tests/covgap_commands_rollback.rs         | 1051 ++-
 .../tests/covgap_commands_scan_hosted.rs      |  250 +-
 .../tests/covgap_commands_scan_mod.rs         |  131 +-
 .../tests/covgap_commands_vendor.rs           |  385 +-
 .../tests/covgap_commands_vex.rs              |  149 +-
 .../socket-patch-cli/tests/e2e_bun_lockb.rs   |  187 +-
 .../tests/e2e_golang_hosted_build.rs          |   30 +-
 .../tests/e2e_golang_hosted_state.rs          |  105 +-
 .../tests/e2e_golang_workspace_build.rs       |    7 +-
 .../tests/e2e_hosted_production.rs            |  282 +-
 .../tests/e2e_nuget_dotnet_build.rs           |   76 +-
 .../tests/e2e_redirect_bun_build.rs           |  127 +-
 .../tests/e2e_redirect_cargo_build.rs         |  119 +-
 .../tests/e2e_redirect_cargo_shapes.rs        |  106 +-
 .../tests/e2e_redirect_composer_build.rs      |  144 +-
 .../tests/e2e_redirect_gem_build.rs           |  242 +-
 .../tests/e2e_redirect_gem_stale_install.rs   |  112 +-
 .../tests/e2e_redirect_maven_build.rs         |  118 +-
 .../tests/e2e_redirect_npm_build.rs           |  137 +-
 .../tests/e2e_redirect_pnpm_build.rs          |  258 +-
 .../tests/e2e_redirect_rush_sim.rs            |   29 +-
 .../tests/e2e_redirect_vlt_build.rs           |  139 +-
 .../tests/e2e_redirect_yarn_berry_build.rs    |   22 +-
 .../tests/e2e_redirect_yarn_classic_build.rs  |   17 +-
 .../tests/e2e_vex_build/hatch.rs              |   13 +-
 .../tests/e2e_vex_build/pdm.rs                |   15 +-
 .../tests/e2e_vex_build/poetry.rs             |   99 +-
 .../tests/e2e_vex_lockfile/bun.rs             |   91 +-
 .../tests/e2e_vex_lockfile/cargo.rs           |   16 +-
 .../tests/e2e_vex_lockfile/common_selftest.rs |   48 +-
 .../tests/e2e_vex_lockfile/gem.rs             |   11 +-
 .../e2e_vex_lockfile/manifestless_embedded.rs |   64 +-
 .../tests/e2e_vex_lockfile/maven.rs           |   51 +-
 .../tests/e2e_vex_lockfile/npm.rs             |    5 +-
 .../tests/e2e_vex_lockfile/nuget.rs           |   54 +-
 .../tests/e2e_vex_lockfile/pdm.rs             |    6 +-
 .../tests/e2e_vex_lockfile/pip.rs             |    7 +-
 .../tests/e2e_vex_lockfile/pipenv.rs          |   55 +-
 .../tests/e2e_vex_lockfile/poetry.rs          |   76 +-
 .../tests/e2e_vex_lockfile/uv.rs              |   75 +-
 .../tests/e2e_vex_lockfile/vlt.rs             |   14 +-
 .../tests/e2e_yarn4_pnpm_linker_build.rs      |    5 +-
 .../tests/e2e_yarn4_workspaces_build.rs       |    5 +-
 .../socket-patch-cli/tests/get_modes_e2e.rs   |   23 +-
 .../tests/hosted_management_refusals.rs       |  318 +
 .../tests/hosted_memory_engine.rs             |   41 +-
 .../tests/hosted_symlinked_files.rs           |    9 +-
 .../tests/in_process_get_hosted_ecosystems.rs |  151 +-
 .../tests/in_process_get_modes.rs             |   40 +-
 .../tests/in_process_get_update_count.rs      |    1 +
 .../tests/in_process_redirect.rs              |  677 +-
 .../tests/in_process_redirect/vlt.rs          |   49 +-
 .../tests/in_process_redirect_pdm.rs          |  322 +-
 .../tests/in_process_redirect_pipenv.rs       |  169 +-
 .../tests/in_process_redirect_pnpm.rs         |  246 +-
 .../tests/in_process_redirect_poetry.rs       |  225 +-
 .../tests/in_process_rollback_hosted.rs       |  748 ++-
 .../tests/in_process_rollback_hosted/vlt.rs   |  328 +-
 .../tests/in_process_vendor.rs                |  328 +-
 .../tests/in_process_vendor_bun_takeover.rs   |  302 +-
 .../in_process_vendor_bun_takeover/vlt.rs     |  123 +-
 .../tests/mode_migration_bun.rs               |  267 +-
 .../tests/mode_migration_cargo.rs             |  182 +-
 .../tests/mode_migration_npm.rs               |  135 +-
 .../tests/mode_migration_vlt.rs               |  216 +-
 .../tests/npm_e2e_common/manifestless.rs      |   64 +-
 .../tests/redirect_npm_allow_remote.rs        |  197 +-
 .../tests/remove_duality_invariants.rs        |  310 +-
 .../tests/repair_invariants.rs                |   58 +-
 .../socket-patch-cli/tests/scan_invariants.rs |  182 +-
 .../tests/scan_ordered_concurrency_e2e.rs     |   56 +-
 .../socket-patch-cli/tests/telemetry_e2e.rs   |   28 +-
 crates/socket-patch-cli/tests/vendor_eject.rs |  360 +
 .../tests/vendor_eject_bun_lockb.rs           |  391 ++
 .../tests/vendor_eject_fresh_checkout.rs      |  358 +
 .../tests/vex_e2e_common/bun.rs               |   55 +-
 .../tests/vex_e2e_common/mod.rs               |   61 +-
 .../tests/vex_e2e_common/uv.rs                |  166 +-
 .../tests/vex_e2e_common/vlt.rs               |   57 +-
 .../tests/vex_pdm_hatch_common/mod.rs         |  129 +-
 .../tests/vex_pipenv_pip_common/mod.rs        |  142 +-
 .../tests/vex_pipenv_pip_steps/mod.rs         |   66 +-
 .../tests/vex_pypi_real_common/mod.rs         |   54 +-
 .../tests/vlt_e2e_common/fixture.rs           |   10 +
 .../tests/vlt_e2e_common/mod.rs               |   24 +-
 .../tests/vlt_hosted_common/mod.rs            |   43 +
 .../tests/yarn_berry_common/mod.rs            |   64 +-
 .../src/patch/redirect/bun_binary.rs          |  328 +-
 .../src/patch/redirect/hosted_url.rs          |   46 +
 .../src/patch/redirect/mod.rs                 |   25 +-
 .../src/patch/redirect/npmrc.rs               |  525 +-
 .../src/patch/redirect/pipenv.rs              |  289 +-
 .../src/patch/redirect/pnpm.rs                |   33 +
 .../src/patch/redirect/replay.rs              | 3545 ----------
 .../src/patch/redirect/requirements.rs        |   16 +-
 .../src/patch/redirect/staged.rs              |   16 -
 .../src/patch/redirect/state.rs               | 1151 +---
 .../src/patch/redirect/takeover.rs            | 5896 -----------------
 .../src/patch/redirect/upstream/bun_lockb.rs  |  382 ++
 .../src/patch/redirect/upstream/cargo.rs      |  409 ++
 .../src/patch/redirect/upstream/client.rs     |  681 ++
 .../src/patch/redirect/upstream/composer.rs   |  484 ++
 .../src/patch/redirect/upstream/gem.rs        |  960 +++
 .../src/patch/redirect/upstream/golang.rs     |  113 +
 .../src/patch/redirect/upstream/maven.rs      |  596 ++
 .../src/patch/redirect/upstream/mod.rs        |  665 ++
 .../src/patch/redirect/upstream/npm.rs        |  742 +++
 .../src/patch/redirect/upstream/nuget.rs      |  568 ++
 .../src/patch/redirect/upstream/pypi.rs       | 1014 +++
 .../src/patch/redirect/upstream/pypi_locks.rs |  403 ++
 .../src/patch/redirect/upstream/uv.rs         | 1197 ++++
 .../src/patch/redirect/upstream/vlt.rs        |  596 ++
 .../src/patch/redirect/vlt.rs                 |  291 -
 .../src/patch/redirect/vlt_heal.rs            |   23 +
 .../src/utils/line_endings.rs                 |   57 -
 .../src/utils/poetry_lock.rs                  |   74 +-
 .../socket-patch-core/src/vendor/berry_zip.rs |    2 +-
 .../src/vendor/bun_lock_text.rs               |  222 -
 .../socket-patch-core/src/vendor/bun_lockb.rs |  362 +-
 crates/socket-patch-core/src/vendor/cargo.rs  |   33 +-
 .../src/vendor/lock_inventory/pypi.rs         |   28 +-
 crates/socket-patch-core/src/vendor/mod.rs    |    3 +-
 .../src/vendor/registry_fetch.rs              |   16 +-
 .../socket-patch-core/src/vex/discover/mod.rs |   15 +
 .../pipenv-shapes/2018.11.26/extras/Pipfile   |    9 +
 .../2018.11.26/extras/Pipfile.lock            |   38 +
 .../2018.11.26/marker-excluded/Pipfile        |    9 +
 .../2018.11.26/marker-excluded/Pipfile.lock   |   28 +
 .../pipenv-shapes/2022.12.19/extras/Pipfile   |    9 +
 .../2022.12.19/extras/Pipfile.lock            |   38 +
 .../2022.12.19/marker-excluded/Pipfile        |    9 +
 .../2022.12.19/marker-excluded/Pipfile.lock   |   27 +
 .../pipenv-shapes/2026.8.0/extras/Pipfile     |    9 +
 .../2026.8.0/extras/Pipfile.lock              |   39 +
 .../2026.8.0/marker-excluded/Pipfile          |    9 +
 .../2026.8.0/marker-excluded/Pipfile.lock     |   27 +
 .../expected-confirmation.json                |    7 +
 .../expected-edits.json                       |   10 +
 .../expected-warnings.json                    |    1 +
 .../expected/vlt-lock.json                    |   15 +
 .../input/vlt-lock.json                       |   15 +
 .../overrides.json                            |   13 +
 .../expected-edits.json                       |    2 +-
 .../input/vlt-lock.json                       |    2 +-
 .../vex-discover-golden/pipenv-shapes.json    |   92 +
 .../vex-discover-golden/redirect-npm.json     |   50 +
 .../tests/hosted_inventory.rs                 |   75 +
 .../socket-patch-core/tests/poetry_hosted.rs  |  250 +-
 .../tests/redirect_golden_reverse_replay.rs   |  252 -
 .../tests/upstream_restore_golden.rs          | 1909 ++++++
 crates/socket-patch-core/tests/uv_hosted.rs   |   87 +-
 crates/socket-patch-node/npm/test/smoke.mjs   |    6 +-
 docs/ecosystems.md                            |   21 +-
 docs/testing/bun-compatibility.md             |   47 +-
 docs/testing/hosted-production-e2e.md         |    2 +-
 docs/testing/pipenv-compatibility.md          |    2 +-
 docs/testing/vlt-compatibility.md             |    8 +
 scripts/backtest-bun.py                       |  174 +-
 scripts/backtest-pdm.py                       |   81 +-
 scripts/backtest-pipenv.py                    |   85 +-
 scripts/backtest-poetry.py                    |   57 +-
 scripts/backtest-uv.py                        |   13 +-
 scripts/backtest-vlt.py                       |   51 +-
 191 files changed, 23293 insertions(+), 21273 deletions(-)
 delete mode 100644 crates/socket-patch-cli/src/hosted_memory/ledger.rs
 create mode 100644 crates/socket-patch-cli/tests/coverage_fix_rollback_ecosystem_scoped_hosted.rs
 delete mode 100644 crates/socket-patch-cli/tests/coverage_fix_rollback_ecosystem_scoped_replay.rs
 create mode 100644 crates/socket-patch-cli/tests/hosted_management_refusals.rs
 create mode 100644 crates/socket-patch-cli/tests/vendor_eject.rs
 create mode 100644 crates/socket-patch-cli/tests/vendor_eject_bun_lockb.rs
 create mode 100644 crates/socket-patch-cli/tests/vendor_eject_fresh_checkout.rs
 create mode 100644 crates/socket-patch-core/src/patch/redirect/hosted_url.rs
 delete mode 100644 crates/socket-patch-core/src/patch/redirect/replay.rs
 delete mode 100644 crates/socket-patch-core/src/patch/redirect/takeover.rs
 create mode 100644 crates/socket-patch-core/src/patch/redirect/upstream/bun_lockb.rs
 create mode 100644 crates/socket-patch-core/src/patch/redirect/upstream/cargo.rs
 create mode 100644 crates/socket-patch-core/src/patch/redirect/upstream/client.rs
 create mode 100644 crates/socket-patch-core/src/patch/redirect/upstream/composer.rs
 create mode 100644 crates/socket-patch-core/src/patch/redirect/upstream/gem.rs
 create mode 100644 crates/socket-patch-core/src/patch/redirect/upstream/golang.rs
 create mode 100644 crates/socket-patch-core/src/patch/redirect/upstream/maven.rs
 create mode 100644 crates/socket-patch-core/src/patch/redirect/upstream/mod.rs
 create mode 100644 crates/socket-patch-core/src/patch/redirect/upstream/npm.rs
 create mode 100644 crates/socket-patch-core/src/patch/redirect/upstream/nuget.rs
 create mode 100644 crates/socket-patch-core/src/patch/redirect/upstream/pypi.rs
 create mode 100644 crates/socket-patch-core/src/patch/redirect/upstream/pypi_locks.rs
 create mode 100644 crates/socket-patch-core/src/patch/redirect/upstream/uv.rs
 create mode 100644 crates/socket-patch-core/src/patch/redirect/upstream/vlt.rs
 create mode 100644 crates/socket-patch-core/tests/fixtures/pipenv-shapes/2018.11.26/extras/Pipfile
 create mode 100644 crates/socket-patch-core/tests/fixtures/pipenv-shapes/2018.11.26/extras/Pipfile.lock
 create mode 100644 crates/socket-patch-core/tests/fixtures/pipenv-shapes/2018.11.26/marker-excluded/Pipfile
 create mode 100644 crates/socket-patch-core/tests/fixtures/pipenv-shapes/2018.11.26/marker-excluded/Pipfile.lock
 create mode 100644 crates/socket-patch-core/tests/fixtures/pipenv-shapes/2022.12.19/extras/Pipfile
 create mode 100644 crates/socket-patch-core/tests/fixtures/pipenv-shapes/2022.12.19/extras/Pipfile.lock
 create mode 100644 crates/socket-patch-core/tests/fixtures/pipenv-shapes/2022.12.19/marker-excluded/Pipfile
 create mode 100644 crates/socket-patch-core/tests/fixtures/pipenv-shapes/2022.12.19/marker-excluded/Pipfile.lock
 create mode 100644 crates/socket-patch-core/tests/fixtures/pipenv-shapes/2026.8.0/extras/Pipfile
 create mode 100644 crates/socket-patch-core/tests/fixtures/pipenv-shapes/2026.8.0/extras/Pipfile.lock
 create mode 100644 crates/socket-patch-core/tests/fixtures/pipenv-shapes/2026.8.0/marker-excluded/Pipfile
 create mode 100644 crates/socket-patch-core/tests/fixtures/pipenv-shapes/2026.8.0/marker-excluded/Pipfile.lock
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/capture-1.2.0-config-registry/expected-confirmation.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/capture-1.2.0-config-registry/expected-edits.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/capture-1.2.0-config-registry/expected-warnings.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/capture-1.2.0-config-registry/expected/vlt-lock.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/capture-1.2.0-config-registry/input/vlt-lock.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/capture-1.2.0-config-registry/overrides.json
 create mode 100644 crates/socket-patch-core/tests/fixtures/vex-discover-golden/pipenv-shapes.json
 create mode 100644 crates/socket-patch-core/tests/hosted_inventory.rs
 delete mode 100644 crates/socket-patch-core/tests/redirect_golden_reverse_replay.rs
 create mode 100644 crates/socket-patch-core/tests/upstream_restore_golden.rs

diff --git a/.gitattributes b/.gitattributes
index 4b3f63f0..85808065 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -6,6 +6,13 @@ crates/socket-patch-core/tests/fixtures/redirect/** -text
 
 crates/socket-patch-core/tests/fixtures/pdm-native/*.lock -text
 
+# Poetry and Pipenv locks are real `poetry lock` / `pipenv lock` output: the
+# upstream restore and VEX tests round-trip them byte for byte and derive
+# their CRLF variants from the LF bytes themselves.
+crates/socket-patch-core/tests/fixtures/poetry/** -text
+crates/socket-patch-core/tests/fixtures/pipenv/** -text
+crates/socket-patch-core/tests/fixtures/pipenv-shapes/** -text
+
 # The captured pnpm 1-12 locks are byte-real: the hosted/vendored rewriters
 # refuse CRLF by design (vendor_lockfile_crlf_unsupported), and the tests
 # derive their CRLF variants from the LF bytes themselves.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4a260c8f..eb2d4722 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -237,7 +237,9 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
-    timeout-minutes: 35
+    # Windows runs the same suite ~1.6x slower than macOS: on the base
+    # branch it already took 34m40s of a flat 35m budget.
+    timeout-minutes: ${{ matrix.os == 'windows-latest' && 50 || 35 }}
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 33a44ba3..2689764a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -22,7 +22,10 @@ into the new version's section — see docs/releasing.md.
 > packages resolve to Socket-hosted, integrity-pinned copies (hosted mode is
 > the default, and scan never prompts); `socket-patch vex` emits OpenVEX for
 > vulnerability scanners; `socket-patch vendor` ejects the patches into
-> `.socket/vendor/` for offline installs; `socket-patch list` shows them.
+> `.socket/vendor/` for offline installs (it ejects a hosted project: no
+> manifest needed); `socket-patch list` shows them. Hosted mode keeps no
+> ledger — the lockfile edits are the whole change, and `rollback` restores
+> each hosted package to its upstream registry entry.
 > `get`, `apply`, `setup`, `rollback`, `remove` and `repair` (the agent-mode
 > commands) keep working and are listed after these.
 
@@ -33,7 +36,12 @@ into the new version's section — see docs/releasing.md.
 > (visible to the patched crate as `CARGO_PKG_VERSION`), makes a bare `scan`
 > run hosted mode without prompting, changes which patch scan picks when a
 > package has several, makes `vex`
-> refuse to attest stale ledger records and corrupt vendor ledgers, and
+> refuse to attest stale ledger records and corrupt vendor ledgers, drops the
+> hosted redirect ledger (`rollback` / `remove` now restore upstream registry
+> entries and refuse where they cannot; `list`'s hosted `details.ledger`
+> becomes `details.lockfiles`; scan's `redirectState` loses `ledger` /
+> `ledgerKey`; `vendor_supersedes_redirect` and `hosted_revert_unsupported`
+> are gone), and
 > retries a throttled patch API (new error text, added waiting, a throttled
 > package failing its legacy-proxy batch) — all
 > MAJOR per CLI_CONTRACT.md's semver policy — so it ships as the next major
@@ -41,6 +49,183 @@ into the new version's section — see docs/releasing.md.
 
 ### Changed (BREAKING)
 
+> **Ledger-free hosted mode.** The first entries below supersede every
+> earlier entry in this section (and under Added / Fixed) that describes
+> the hosted redirect ledger (`.socket/vendor/redirect-state.json`): its
+> writes, quarantine, per-purl reverts, whole-ledger replay, ledger
+> records in `list` / `vex` / `scan`, and `vendor_supersedes_redirect`.
+> Those describe intermediate v5 development states; the ledger-free
+> contract here is what ships.
+
+- **Hosted mode keeps no ledger.** `scan --mode hosted` / `get --mode
+  hosted` (and the in-memory hosted engine behind the hosted bundle) write
+  ONLY their lockfile / registry-config edits:
+  `.socket/vendor/redirect-state.json` is never written — not on success,
+  not on failure — so a hosted project commits just its lockfile and config
+  changes (`Commit package-lock.json to keep the redirect.`). A pre-v5
+  ledger on disk is ignored by scan (never read for planning, never
+  quarantined, left byte-identical); a re-run plans from the current lock
+  text and is idempotent. The in-run `scan --mode hosted --vex` attests from
+  the patch records this run fetched, and the gem / Python stale-install
+  probes judge only those (a purl whose record fetch failed is not judged
+  this run: `record_fetch_failed` now says the in-run VEX omits it and
+  `socket-patch vex` fetches it again once the API answers).
+- **`rollback` and `remove` restore hosted pins to their upstream registry
+  entries.** With no ledger to replay, each hosted pin the lockfiles wire
+  (discovered like `vex` does: a hosted URL counts only on
+  `https://patch.socket.dev` or the `--patch-server-url` origin) is
+  rewritten back to the DEFAULT UPSTREAM registry entry for `name@version`,
+  re-resolving what the entry pins from the public registry (core
+  `patch::redirect::upstream`). Restored formats: `package-lock.json` /
+  `npm-shrinkwrap.json`, `yarn.lock` (classic and berry), `pnpm-lock.yaml` /
+  `shrinkwrap.yaml`, `bun.lock` and `vlt-lock.json` (npm registry version
+  document), `Cargo.lock` + `Cargo.toml` + the project cargo config
+  (crates.io sparse index), `go.mod` / `go.sum` (module proxy + checksum
+  database; a user's pre-hosted `replace` is not recoverable, so the
+  restore lands on the plain upstream module), `Pipfile.lock`,
+  `requirements.txt`, Hatch direct references, `poetry.lock`, `pdm.lock`,
+  `uv.lock`, PEP 723 script locks and `pylock*.toml` (PyPI JSON API),
+  `Gemfile.lock` / `gems.locked` + the Gemfile source block (rubygems.org
+  compact index; the declaration comes back as the exact pin), `composer.lock`
+  (packagist v2 metadata), `pom.xml` + the `.mvn` trusted-checksums lines
+  (no network — restores offline), and `nuget.config` + `packages.lock.json`
+  (nuget.org `contentHash`). A pin is all-or-nothing and nothing is written
+  until every pin resolved; `--dry-run` resolves exactly like a wet run.
+  **Refused**, with nothing written for the pin and the message `cannot
+  restore <purl> to its upstream registry entry: <why>; restore it from
+  version control instead (`git checkout -- <files>`)`: every pin under
+  `--offline` except Maven, a registry that does not answer or no longer
+  describes the entry, a binary `bun.lockb` (for `rollback` / `remove`; see
+  the vendor takeover below), a composer entry that
+  is not packagist-sourced or whose `dist.reference` packagist no longer
+  serves, a gem whose upstream section is ambiguous or not rubygems.org, a
+  nuget id the restored config would not resolve from nuget.org alone, a
+  `pdm.lock` without `cross_platform` or a uv / pylock lock whose release has
+  a non-pure-Python-3 wheel, a uv lock whose options filter files or whose
+  registry is not PyPI's, uv 0.2 `[[distribution]]` locks, and any file
+  format the restore does not know. Rollback reports a refusal in
+  `hosted.failed[{purl, error}]` (exit 1, `partial_failure`; human `Error:
+  Cannot restore …`), `remove` as `hosted_revert_failed` before touching the
+  manifest. Human lines are `Restored <purl> to its upstream registry entry`
+  / `Would restore …`, and the prompt clause is `restore N hosted packages
+  to the upstream registry`. Scoped runs restore only the named pins (no
+  whole-ledger replay; `hosted.unsupported` is always empty and
+  `hosted_revert_unsupported` is gone), `--preserve-state` still restores
+  (`hosted_state_not_preservable`), and the vlt install heal still runs.
+  Side settings: a project `.npmrc` that is exactly `allow-remote=all` and a
+  `pnpm-workspace.yaml` that is exactly hosted mode's scaffold are deleted
+  once no lock entry needs them; otherwise the line stays with
+  `npm_allow_remote_left` / `pnpm_trust_lockfile_left` (v5 records no
+  provenance). New advisories: `maven_trusted_checksums_left`,
+  `nuget_default_config_left`, `upstream_uv_override_removed`. A pin
+  discovery cannot see (a lockless cargo pin, a nuget mapping with no
+  `packages.lock.json`, a Gemfile-only gem) is out of reach: restore those
+  files from version control. v4's `redirect_state_unreadable`,
+  `redirect_pnpm_trust_scaffold_modified` and
+  `redirect_npmrc_allow_remote_modified` are no longer emitted.
+- **The Pipenv hosted redirect keeps the entry's `index`.** A hosted
+  `Pipfile.lock` entry is now `{"file" | "path", "hashes"}` plus every key
+  but `version` exactly as Pipenv wrote it — `index` included, present or
+  absent — so `rollback` / `remove` carry it back instead of guessing it
+  from sibling entries. Pipenv records `index` by release, Pipfile spelling
+  and locking environment (2018.11.26 writes it for a marker-excluded
+  package, 2022.12.19 does not; 2022.12.19 writes it for an `extras` table,
+  2023.12.1 and later do not; no release writes it for a transitive
+  package), so no rule over the lock could re-derive it, and the guess left
+  those rollbacks off by one key. Measured on Pipenv 2018.11.26, 2020.11.15,
+  2021.11.23, 2022.12.19, 2023.12.1, 2024.4.1, 2025.1.3 and 2026.8.0: a
+  `file` entry carrying `index` still installs the referenced wheel itself
+  (`install --deploy`, `sync`, `verify`); Pipenv 7–11 ignore `index` on a
+  `path` entry. The restore refuses when the entry's `index` (or the
+  Pipfile's explicit one) does not name a PyPI source in `_meta.sources`.
+- **`list`, `vex`, `scan` and `repair` derive hosted state from the
+  lockfiles.** `list` shows one entry per hosted pin: JSON
+  `details.mode: "hosted"` plus `details.lockfiles: [<files wiring it>]`
+  (no `details.ledger`), human `Mode: hosted (wired in package-lock.json)`;
+  a pin carries only its uuid unless a pre-v5 ledger records the same purl
+  and uuid, and a ledger record whose pin is in no lockfile is no longer
+  listed. `scan --json`'s `redirectState` is now `{mode, records: [{purl,
+  uuid}], wiringLive}` built from the pins (no `ledger`, no
+  `records[].ledgerKey`) and is omitted when no lockfile pins a hosted
+  patch; `updates[]` folds the pins in (manifest > hosted pins > vendor
+  ledger), and `hosted_wiring_retained` keys on them. `vex` takes hosted
+  references from the lockfiles and their records from the API (online);
+  offline without a local record the pin is `record_unavailable`. A
+  malformed pre-v5 redirect ledger is now the WARNING
+  `redirect_ledger_corrupt` in `vex` (every form) and `list` — the run
+  continues — instead of `vex`'s exit-2 hard error. `repair` treats a
+  project with hosted pins (or a pre-v5 ledger) and nothing vendored as the
+  `redirect_only_project` skip, exit 0. A hosted URL on a staging host is
+  seen only with `--patch-server-url` (no ledger vouches for it any more).
+- **`vendor` ejects a hosted project, and vendoring over a hosted pin
+  restores upstream first.** Standalone `vendor` with no manifest and hosted
+  pins in the lockfiles takes its patch set from those pins, fetches each
+  record from the patch API, vendors into `.socket/vendor/` and rewires
+  hosted → vendored (`Ejecting N hosted packages into .socket/vendor/...`,
+  `Would eject …` on a dry run). The eject is one planned, all-or-nothing
+  transition: every record is fetched and every upstream restore resolved
+  before anything is written (a failure is `eject_refused`, nothing
+  touched); a dry run writes nothing (`eject_planned`); the wet run
+  snapshots the files it touches and, if vendoring then fails, puts them
+  back so the project stays hosted (`eject_rolled_back`). It works from a
+  fresh checkout (no installed tree needed). `--offline` refuses it with
+  `offline_eject_unavailable` and makes no requests. A lock whose hosted
+  wiring discovery cannot attribute is refused with
+  `hosted_wiring_contested` by eject, `rollback` and `remove` (a warning in
+  `list`). Without hosted pins the no-manifest no-op is unchanged. Every vendored flow (`vendor`, `scan` / `get --mode
+  vendored`) that meets a hosted pin — any ecosystem, no longer just cargo,
+  golang and the npm family — first restores its upstream registry entry
+  with the same restore as `rollback`, so the vendor ledger records the
+  upstream entry and **`vendor --revert` returns to upstream, never to
+  hosted**. `vendor_takeover_reverted_redirect` (`… was hosted; restored its
+  upstream registry entry (<files>) before vendoring (mode takeover)`) and
+  the dry-run `vendor_would_revert_redirect` keep their codes; a refused
+  restore fails the purl `redirect_revert_failed` (`cannot vendor over the
+  live hosted pin: …`) and leaves it hosted. The cargo backend's
+  `hosted_redirect_live` refusal now names `socket-patch rollback` and
+  `git checkout -- Cargo.toml Cargo.lock` instead of the ledger.
+- **Vendoring over a hosted binary `bun.lockb` works again** (Bun 0.8–1.1's
+  default lock and Bun 1.2's legacy lock; it was refused
+  `redirect_revert_failed` once the hosted ledger was gone). The takeover
+  and the eject rebuild each hosted remote-tarball record as Bun's npm
+  registry record for `name@version` from the registry's `dist.tarball` /
+  `dist.integrity`, re-derive the package metadata hash, drop the hosted
+  URL from the string pool, then vendor; `vendor --revert` returns the
+  pre-hosted lock. The hosted rewrite now keeps the registry record's
+  inactive bytes (padding, semver) in the tarball record it writes, and a
+  re-pin to a later grant's URL drops the superseded URL from the string
+  pool, so the rebuild is byte-exact — early writers' uninitialized padding included.
+  Where the hosted rewrite had to normalize the lock it marks it (in the
+  root package's resolution bytes, which no Bun reader reads): a binary
+  format 1 lock (Bun 0.1.1-0.1.6), promoted to format 2, is demoted back to
+  its exact format-1 bytes, and a lock whose workspace dependency behaviors
+  were normalized is refused with the `git checkout -- bun.lockb` remedy
+  instead of taken over non-exactly. `rollback` / `remove` keep refusing a
+  hosted `bun.lockb` pin with that remedy; an `--offline` vendor still refuses.
+- **`vendor_supersedes_redirect` is removed.** The vendored flows no longer
+  warn about (or auto-reconcile, or unwind the `.npmrc` for) a stale hosted
+  ledger record: once the lock routes a package to `.socket/vendor/`, no
+  hosted state is left to go stale. `redirect_supersedes_vendored` (hosted
+  over a vendored package) stays, classified from the lockfile pins.
+- **A pre-v5 hosted ledger is read for migration only, and `rollback`
+  retires it.** No command writes `redirect-state.json` any more; `list`
+  and `vex` read it only as an extra record source for a pin with the same
+  purl and uuid, and its edits are never replayed. `rollback` and `remove`
+  delete it once no lockfile pins a hosted patch (`legacy_redirect_ledger_kept`
+  warns when the delete fails), and a `rollback` in a project whose only
+  state is that file removes it and exits 0 (JSON
+  `legacyRedirectLedgerRemoved: true`) instead of failing on the missing
+  manifest.
+- **Registry base overrides for the upstream restore.** Besides the existing
+  `SOCKET_NPM_REGISTRY`, `SOCKET_GOPROXY` and `SOCKET_PYPI_JSON_API`, the
+  restore honors new env-only knobs for mirrors and tests:
+  `SOCKET_CRATES_INDEX` (default `https://index.crates.io`),
+  `SOCKET_GOSUMDB_URL` (`https://sum.golang.org`; else `GOSUMDB` /
+  `GONOSUMDB` / `GOPRIVATE` as go reads them), `SOCKET_RUBYGEMS_URL`
+  (`https://rubygems.org`), `SOCKET_PACKAGIST_URL`
+  (`https://repo.packagist.org`) and `SOCKET_NUGET_URL`
+  (`https://api.nuget.org`).
+
 - **Vendored runs refuse lock-text failures before downloading them.**
   `scan --mode vendored` and `get --mode vendored` evaluate the vendor
   backends' pure lock-text gates — pnpm, yarn classic and yarn berry
@@ -66,8 +251,8 @@ into the new version's section — see docs/releasing.md.
   package is refused this way, the human arm prints `Nothing was
   vendored: N patches failed (see above).`).
   (The human `scan --mode vendored` arm still fetches the views its
-  baseline pre-check verifies.) Purls the hosted redirect ledger
-  claims keep the vendor loop's refusal. Because no view is fetched, the
+  baseline pre-check verifies.) Purls the lockfiles pin hosted keep the
+  vendor loop's refusal. Because no view is fetched, the
   lock-text refusal now takes precedence over every outcome that came
   from the view: a package that would also have hit a paid-access 403, a
   failed view fetch or the no-applicable-files guardrail reports the lock
@@ -259,10 +444,7 @@ into the new version's section — see docs/releasing.md.
   empty hosted discovery prints `No patches available for installed
   packages.` and exits 0 without entering the redirect engine; a discovery
   whose every offer is paid-tier for an org without paid access stops the
-  same way with `No downloadable patches (paid subscription required).`. A
-  malformed redirect ledger on a human hosted run that stops before the
-  engine is reported as the read-only `Warning: the redirect ledger … is
-  malformed` advisory instead of nowhere.
+  same way with `No downloadable patches (paid subscription required).`.
 - **`get` defaults to hosted mode too.** `socket-patch get <id>` (and the
   bare-UUID shortcut `socket-patch <uuid>`) now redirects the package's
   lockfile entry to its Socket-hosted patched copy, like `scan`. Agent mode
@@ -285,12 +467,9 @@ into the new version's section — see docs/releasing.md.
   be written, so previews create no `.socket/` — and report `lock_held` /
   `lock_io` like the other lock holders (top-level `errorCode` on the hosted
   JSON shape; a read-only project root or a file squatting on `.socket/` is
-  refused at the lock, before the redirect ledger is touched, and a
+  refused at the lock, before any file is touched, and a
   vendored→hosted takeover over a symlinked wiring file is refused with
-  `redirect_symlinked_file_unsupported` before any revert). A zero-grant wet
-  run — which holds no lock — no longer moves a malformed
-  `redirect-state.json` aside: like a dry run it reports the hard error and
-  leaves the file in place; only the lock holder quarantines. The lock guard
+  `redirect_symlinked_file_unsupported` before any revert). The lock guard
   unlinks only the file it holds (a replacement planted by a non-cooperating
   `rm` + `touch` is left for the next acquire), and a long `--lock-timeout`
   wait behind a hot loop of short commands can no longer accumulate its
@@ -318,7 +497,8 @@ into the new version's section — see docs/releasing.md.
   those flags now skip only the hashing, never the wiring, record-match and
   conflict gates. A malformed or unreadable `.socket/vendor/state.json` is
   now the hard error `vendor_ledger_corrupt` (exit 2 standalone, the host
-  command fails under `--vex`), mirroring `redirect_ledger_corrupt`, instead
+  command fails under `--vex`) — a malformed pre-v5 redirect ledger is only
+  the `redirect_ledger_corrupt` warning (see the ledger-free entries) — instead
   of a warning after which vendored patches silently lost their
   committed-artifact verification and detached records.
   Lockfiles that wire one package to different patches attest none of them
@@ -365,8 +545,8 @@ into the new version's section — see docs/releasing.md.
   case-insensitively.
 - **Hosted projects report patch updates from their lockfiles.** scan's
   `updates[]` and `[UPDATE]` marker also see the hosted pins the lockfiles
-  wire, so a hosted project that never committed its redirect ledger still
-  reports a superseding patch.
+  wire (hosted mode keeps no ledger), so a hosted project still reports a
+  superseding patch.
 
 - **`apply` and `rollback` patch vlt installs in place.** A project
   installed by vlt (`node_modules/.vlt/` or `node_modules/.vlt-lock.json`)
@@ -661,8 +841,8 @@ into the new version's section — see docs/releasing.md.
   `Cargo.lock` model, the Python lock and requirements-file readers the
   rewriters use, with one exact-pin rule and one hosted pypi url
   grammar).
-  `scan`'s cross-mode takeover warnings (`redirect_supersedes_vendored`,
-  `vendor_supersedes_redirect`), `hosted_wiring_retained` and
+  `scan`'s cross-mode takeover warning `redirect_supersedes_vendored`,
+  `hosted_wiring_retained` and
   `redirectState.wiringLive` now prove the live lock with the same
   discovery and liveness rules `vex` gates attestations on, instead of a
   looser text scan: a ledger record counts as live only while a lockfile
@@ -890,29 +1070,21 @@ into the new version's section — see docs/releasing.md.
   `SOCKET_PRESERVE_STATE`): fully unpatch the system but keep the local
   state for a later re-apply — manifest entries, vendored artifacts +
   ledger entries (kept byte-identical; re-vendor re-wires from the live
-  lock) — and skip all GC. Hosted redirects have no preservable state:
-  they are unwound and their records dropped either way
-  (`hosted_state_not_preservable` warning). On `remove`, combining it with
+  lock) — and skip all GC. Hosted pins have no preservable state: they are
+  restored to upstream either way (`hosted_state_not_preservable`
+  warning). On `remove`, combining it with
   `--skip-rollback` is a usage error (exit 2, flag- or env-sourced): the
   combination would be a no-op — one flag keeps the tree and drops the
   state, the other restores the tree and keeps the state.
-- **Hosted redirect unwind.** Per-purl reverts for cargo + the npm family,
-  plus a whole-ledger reverse replay (core `patch/redirect/replay.rs`) that
-  runs whenever the scope covers every redirect record: a per-kind inverse
-  table, staged all-or-nothing per ecosystem group, covering gem, golang,
-  pypi, composer, bun, and the non-package rideshare edits (pnpm
-  `trustLockfile` auto-config — pristine scaffold deleted, modified
-  scaffold keeps the file and loses only the owned line). Native `bun.lockb`
-  package snapshots restore binary resolutions directly;
-  maven and nuget fail closed with `hosted_revert_unsupported` guidance
-  (their structured-metadata edits keep their ledger records; re-run
-  `scan --mode hosted` or restore from VCS). Refused groups keep their
-  edits AND records — the coherent ledger a retry needs.
+- **Hosted unwind.** `rollback` restores every in-scope hosted pin to its
+  upstream registry entry, in every ecosystem — see "`rollback` and `remove`
+  restore hosted pins to their upstream registry entries" under Changed
+  (BREAKING); a pin that cannot be restored is refused with the `git checkout
+  -- <files>` remedy.
 - **`remove` gains the hosted leg and full archive GC**: an identifier
-  matching hosted redirect-ledger records unwinds those redirects (per-purl
-  or via the replay when it covers the full record set; works manifest-less
-  on hosted-only projects; unsupported ecosystems fail closed with
-  `hosted_revert_unsupported` before the manifest mutation), and remove's
+  matching hosted lockfile pins restores their upstream registry entries
+  (works manifest-less on hosted-only projects; a refused restore fails
+  `hosted_revert_failed` before the manifest mutation), and remove's
   default GC extends from blobs-only to blobs + diff + package archives
   (parity with rollback/repair/`scan --prune`).
 - **`SOCKET_API_CONCURRENCY` paces `scan`'s patch-API requests.** `scan`
diff --git a/README.md b/README.md
index af7fc5af..82e6ef3a 100644
--- a/README.md
+++ b/README.md
@@ -136,8 +136,8 @@ socket-patch scan
 versions have a patch, prints each one with its severity and CVE/GHSA identifiers, and
 patches them in **hosted mode**: it rewrites the lockfile so only the patched
 dependencies resolve to Socket-hosted, integrity-pinned packages on `patch.socket.dev`.
-It never prompts. The patch records go in `.socket/vendor/redirect-state.json`, and the
-run ends by listing the files it changed. (Add `--dry-run` to preview without writing.)
+It never prompts, keeps no ledger — the lockfile edits are the whole change — and ends by
+listing the files it changed. (Add `--dry-run` to preview without writing.)
 
 > If it prints `No patches available for installed packages.`, none of your dependency
 > versions currently has a Socket patch — the good outcome, with nothing to do. To walk
@@ -151,11 +151,12 @@ run ends by listing the files it changed. (Add `--dry-run` to preview without wr
 > (The patch catalog changes over time; if that finds nothing, pick another patched
 > version.)
 
-**2. Commit.** The lockfile edit *is* the patch, so commit it with the redirect ledger
-(`rollback` and `vex` read it):
+**2. Commit.** The lockfile edit *is* the patch, so commit just the files `scan`
+changed — there is no other state to commit (`rollback`, `list` and `vex` read the
+lockfile itself):
 
 ```bash
-git add package-lock.json .socket/vendor/redirect-state.json .npmrc   # npm example
+git add package-lock.json .npmrc   # npm example
 git commit -m "apply Socket security patches"
 ```
 
@@ -183,19 +184,9 @@ socket-patch vex --output socket.vex.json
 grype . --vex socket.vex.json
 ```
 
-**5. Go offline, if you need to.** Hosted installs must reach `patch.socket.dev`. For
-airgapped builds, switch to vendored mode: it copies the patched packages into
-`.socket/vendor/`, points the lockfile at them, and reverts the hosted edits:
-
-```bash
-socket-patch scan --mode vendored
-git add .socket/vendor package-lock.json .npmrc && git commit -m "vendor Socket patches"
-```
-
-(Vendored npm installs don't need the `.npmrc` line, so the switch removes it again.)
-
-**6. See what you have.** `list` shows each patch and the mode that holds it
-(`Mode: vendored` after step 5):
+**5. See what you have.** `list` shows each patch and the mode that holds it. A hosted
+patch is read straight from the lockfile, so it shows its UUID and the files that wire
+it (`vex` fetches its full record from the API):
 
 ```bash
 socket-patch list
@@ -206,17 +197,34 @@ Found 1 patch:
 
 Package: pkg:npm/flatted@3.3.1
   UUID: 5cac955f-eab1-4d29-8f4f-c408a6cc9647
-  Mode: hosted (recorded in .socket/vendor/redirect-state.json)
-  ...
-  Vulnerabilities (1):
-    - GHSA-25h7-pfq9-p65f (CVE-2026-32141)
-      Severity: HIGH
+  Mode: hosted (wired in package-lock.json)
 ```
 
-To undo everything, run `socket-patch rollback`: it restores the original lockfile
-entries and drops the records.
+**6. Go offline, if you need to.** Hosted installs must reach `patch.socket.dev`. For
+airgapped builds, eject to vendored mode with `socket-patch vendor`: it fetches the patch
+behind each hosted pin, copies the patched packages into `.socket/vendor/`, and points the
+lockfile at them — no manifest needed:
 
-That's the whole loop: **scan → commit → reinstall → vex**, with `scan --mode vendored`
+```bash
+socket-patch vendor
+git add .socket/vendor package-lock.json .npmrc && git commit -m "vendor Socket patches"
+```
+
+(Vendored npm installs don't need the `.npmrc` line: the switch deletes the `.npmrc` hosted
+mode created, or leaves it with an `npm_allow_remote_left` warning if you added settings to
+it.) Each
+package is first restored to its upstream registry entry and then vendored, so a later
+`socket-patch vendor --revert` returns the project to the plain upstream packages, not to
+hosted. After the switch, `list` reads `Mode: vendored (recorded in
+.socket/vendor/state.json)` with the patch's full record.
+
+To undo everything, run `socket-patch rollback`: it restores each hosted lockfile entry to
+its upstream registry entry (re-resolved from the registry), reverts vendored wiring, and
+drops the records. Where it cannot restore an entry — offline, or a binary `bun.lockb` —
+it changes nothing for that package and tells you to restore the file from version control
+(`git checkout -- <lockfile>`).
+
+That's the whole loop: **scan → commit → reinstall → vex**, with `socket-patch vendor`
 when installs must be offline. The older *agent* mode, which patches installed files in
 place and re-applies them from an install hook, is still supported; the next section
 compares the three.
@@ -257,12 +265,14 @@ Local state lives in `.socket/` at your project root, and is designed to be comm
 
 | Path | Contents |
 |------|----------|
-| `.socket/vendor/redirect-state.json` | Hosted mode: the patch records plus the original lockfile / registry-config fragments each redirect replaced (what [`rollback`](#rollback) replays) |
 | `.socket/vendor/state.json` + `.socket/vendor/<ecosystem>/…` | Vendored mode: the ledger (with embedded patch records) and the patched package artifacts |
 | `.socket/manifest.json` | Agent mode only: the record of downloaded patches — PURLs, file hashes, vulnerability metadata ([format](#manifest-format)) |
 | `.socket/blobs/` | Agent mode only: patched file contents, named by git-sha256 hash |
 
-Hosted and vendored mode never write `manifest.json`.
+Hosted mode writes nothing here: its patches live only in your lockfiles (and the
+registry configs it edits). Hosted and vendored mode never write `manifest.json`. A
+`.socket/vendor/redirect-state.json` from a pre-v5 release is no longer used — `list`
+and `vex` read it only for details, and `rollback` deletes it.
 
 > While a command runs it holds a transient advisory lock, `.socket/apply.lock`, and
 > removes it when it finishes — the file never outlives the command, so there is nothing
@@ -280,8 +290,8 @@ run; a bare `scan` is hosted.
 
 | Mode | Where the patch lives | Install-time requirement | Trade-off |
 |------|----------------------|--------------------------|-----------|
-| **hosted** (default) — `scan` | Nowhere in your repo: the lockfile is rewritten so **only** the patched dependencies resolve to Socket-hosted, integrity-pinned packages on `patch.socket.dev`; the edits and patch records are ledgered in `.socket/vendor/redirect-state.json` | Installs must be able to reach `patch.socket.dev` (no CLI, no install hook) | Smallest possible diff (lockfile + ledger); not for airgapped installs |
-| **vendored** — `scan --mode vendored` (or [`vendor`](#vendor)) | Patched packages committed under `.socket/vendor/`, with the lockfile rewired to consume them | **None** — the package manager installs the committed bytes | Fully airgapped and hermetic, at the cost of repo size |
+| **hosted** (default) — `scan` | Nowhere in your repo: the lockfile is rewritten so **only** the patched dependencies resolve to Socket-hosted, integrity-pinned packages on `patch.socket.dev`; nothing else is written | Installs must be able to reach `patch.socket.dev` (no CLI, no install hook) | Smallest possible diff (just the lockfile / registry-config edits); not for airgapped installs |
+| **vendored** — `scan --mode vendored` or [`vendor`](#vendor) (which ejects a hosted project) | Patched packages committed under `.socket/vendor/`, with the lockfile rewired to consume them | **None** — the package manager installs the committed bytes | Fully airgapped and hermetic, at the cost of repo size |
 | **agent** (older) — `scan --mode agent`, [`get`](#get), [`apply`](#apply) | `.socket/manifest.json` + blobs, committed; the CLI patches installed files in place | The `socket-patch` CLI must run after every install (an install hook via [`setup`](#setup), or an `apply` step in CI) | No lockfile edits and a small repo footprint, but the only mode that needs CI / install-hook changes |
 
 Every mode pins the patched bytes: vendored and hosted modes lean on your package
@@ -319,8 +329,11 @@ never changed or overridden — whether it sits in the project `.npmrc`, in your
 environment variable (the warning names where it found it and how to install anyway),
 `--no-npm-allow-remote-config`
 (`SOCKET_NO_NPM_ALLOW_REMOTE_CONFIG`) turns the write off (install with
-`npm ci --allow-remote=all` instead), and `rollback` / `remove` / switching to vendored
-mode remove exactly the line or file the run added. Vendored mode needs none of this:
+`npm ci --allow-remote=all` instead). Once `rollback` / `remove` / switching to vendored
+mode has restored the last hosted `package-lock.json` entry, an `.npmrc` that holds only
+`allow-remote=all` is deleted; if you have other settings in it, the line is left alone
+with an `npm_allow_remote_left` warning (hosted mode keeps no record of whether it added
+the line). Vendored mode needs none of this:
 npm treats its `file:` tarballs under `allow-file`, which defaults to `all`. See
 [npm compatibility](docs/testing/npm-compatibility.md) for the tested majors.
 
@@ -337,7 +350,10 @@ clean tree and an empty store, then check with `socket-patch vex`. See
 #### Bun
 
 Both text `bun.lock` and binary `bun.lockb` support hosted and vendored
-patches, mode switching, repair, and rollback. Binary locks are read and
+patches, mode switching, repair, and rollback — with one exception: a hosted
+`bun.lockb` entry is not rolled back to its upstream registry entry, so
+`rollback` and `remove` refuse it and point you at `git checkout -- bun.lockb`
+(switching it to vendored mode rebuilds the registry entry and works). Binary locks are read and
 patched natively: Socket Patch does not need Bun installed to discover or
 rewrite them, and does not convert them to text. If both filenames exist,
 `bun.lock` takes precedence. See [Bun compatibility](docs/testing/bun-compatibility.md)
@@ -421,7 +437,7 @@ socket-patch scan --json
 
 A hosted scan takes new patches and newer versions of the ones already applied. Your PR
 tooling (e.g. `peter-evans/create-pull-request`) commits the changed lockfiles and
-`.socket/vendor/`; use the JSON result for the PR title/body. See
+registry configs (hosted mode writes nothing else); use the JSON result for the PR title/body. See
 [Scripting & CI/CD](#scripting--cicd), including how to supply `SOCKET_API_TOKEN` for
 org-tier patches.
 
@@ -439,11 +455,14 @@ inline with `scan --vex <path>`. Details in [OpenVEX attestations](#openvex-atte
 ### Work offline / airgapped
 
 ```bash
-socket-patch scan --mode vendored
+socket-patch vendor              # ejects a hosted project; or: socket-patch scan --mode vendored
 git add .socket/vendor <your lockfile>
 ```
 
-Vendored mode needs no Socket infrastructure and no `socket-patch` binary at install
+`socket-patch vendor` in a hosted project (no manifest) fetches the patch behind each
+hosted lockfile pin and vendors it; `scan --mode vendored` discovers and vendors from
+scratch. Either way a hosted package is restored to its upstream registry entry before it
+is vendored, so `socket-patch vendor --revert` later returns to upstream. Vendored mode needs no Socket infrastructure and no `socket-patch` binary at install
 time — the patched packages install from the committed bytes (other, unvendored
 dependencies still resolve from your registry or mirror as usual). Agent mode also works
 offline once its blobs are committed (`socket-patch apply --offline`). `scan` and `get`
@@ -453,18 +472,16 @@ need the network and refuse to run with `--offline`.
 
 | Command | What it does |
 |---------|--------------|
-| [`rollback`](#rollback) | **Fully unpatches, in every mode**: unwinds hosted redirects (replaying the originals recorded in `redirect-state.json`) and vendored lockfile wiring, restores in-place files, and drops the records — everything, or just the given targets; `--preserve-state` keeps the local patch state for a later re-apply |
-| [`remove`](#remove) | The single-patch form of `rollback`: restore, unwind, drop the record and GC for one PURL/UUID |
-| [`vendor --revert`](#vendor) | **Un-vendors wholesale**: restores the recorded original lockfile fragments byte-for-byte and removes the `.socket/vendor/` artifacts |
+| [`rollback`](#rollback) | **Fully unpatches, in every mode**: restores each hosted lockfile entry to its upstream registry entry (re-resolved from the registry; refused with a `git checkout -- <lockfile>` hint where that is impossible, e.g. offline or `bun.lockb`), unwinds vendored lockfile wiring, restores in-place files, and drops the records — everything, or just the given targets; `--preserve-state` keeps the local patch state for a later re-apply |
+| [`remove`](#remove) | The single-patch form of `rollback`: restore, unwind, drop the record and GC for one PURL/UUID (a hosted patch is restored to upstream) |
+| [`vendor --revert`](#vendor) | **Un-vendors wholesale**: restores the recorded original lockfile fragments byte-for-byte and removes the `.socket/vendor/` artifacts (a package vendored over a hosted pin returns to upstream, not to hosted) |
 | [`scan --prune`](#scan) | Agent mode: **reconciles, doesn't reverse** — drops manifest entries for packages that have left the project and garbage-collects orphan blob/diff/archive files |
 | [`repair`](#repair) (alias `gc`) | **Restores health, not originals**: re-downloads missing blobs, rebuilds missing/corrupt vendored artifacts, and cleans up unused ones |
 
 And `setup --remove` reverts the install hooks that `setup` added.
 
-> If you revert a hosted edit by hand instead (e.g. `git checkout -- <lockfile>`), also
-> delete `.socket/vendor/redirect-state.json` — its recorded originals are then stale. A
-> leftover ledger does not make [`vex`](#vex) attest the removed redirects: a record
-> attests only while a lockfile still wires its hosted patch.
+> Reverting a hosted edit by hand (e.g. `git checkout -- <lockfile>`) is always safe:
+> hosted mode keeps no other state, so there is nothing else to clean up.
 
 ## Command reference
 
@@ -478,7 +495,7 @@ And `setup --remove` reverts the install hooks that `setup` added.
 | [`get`](#get) | Fetch and apply one patch by UUID / CVE / GHSA / PURL / name (alias: `download`) |
 | [`apply`](#apply) | Apply the patches in `.socket/manifest.json` in place |
 | [`setup`](#setup) | Wire install hooks (npm, Python, Bundler, Composer) that re-apply patches after install |
-| [`rollback`](#rollback) | Undo patches in every mode: restore original files and unwind hosted or vendored lockfile wiring |
+| [`rollback`](#rollback) | Undo patches in every mode: restore original files, unwind vendored lockfile wiring, and restore hosted lockfile entries to upstream |
 | [`remove`](#remove) | Remove one patch by PURL or UUID (rolls back first) |
 | [`repair`](#repair) | Download missing patch artifacts, rebuild vendored artifacts, clean up unused ones (alias: `gc`) |
 
@@ -589,8 +606,8 @@ Find patches for your dependencies and apply them. `scan` is the entry point for
 three [patch modes](#three-patch-modes):
 
 - **hosted** (the default — a bare `scan`, `scan --json` included) rewrites lockfiles /
-  registry configs so only the patched dependencies resolve to Socket-hosted packages,
-  and records the edits in `.socket/vendor/redirect-state.json`;
+  registry configs so only the patched dependencies resolve to Socket-hosted packages
+  (the lockfile edits are the only record — no ledger);
 - `--mode vendored` discovers, downloads, and builds + wires the committable
   `.socket/vendor/` artifacts in one pass (re-vendoring automatically when a newer patch
   is selected), writing no `.socket/manifest.json`. It works on a fresh clone:
@@ -608,7 +625,7 @@ garbage collection) and prints `To apply these patches in place, run: socket-pat
 When a package has several patches, `scan` applies the one described in
 [Which patch is picked](#which-patch-is-picked). The JSON `updates[]` array lists
 packages whose recorded patch has been superseded — agent manifest entries, vendored
-entries, and hosted pins read from the redirect ledger and the lockfiles — and the next
+entries, and hosted pins read from the lockfiles — and the next
 `scan` in that mode takes the newer patch.
 
 **Usage:**
@@ -696,7 +713,7 @@ socket-patch vex [options]
 |------|---------|-------------|
 | `-O, --output <path>` | `SOCKET_VEX_OUTPUT` | Write the VEX document to this path instead of stdout. Required when combined with `--json`. |
 | `--product <id>` | `SOCKET_VEX_PRODUCT` | Override the auto-detected top-level product PURL/identifier. |
-| `--no-verify` | `SOCKET_VEX_NO_VERIFY` | Skip the on-disk file-hash check and trust the patch records — useful on a build machine that doesn't have the patched files laid out. The wiring checks still apply: a hosted/vendored ledger record the lockfile no longer wires, or a lockfile reference whose record is unavailable or names another package, is omitted either way. |
+| `--no-verify` | `SOCKET_VEX_NO_VERIFY` | Skip the on-disk file-hash check and trust the patch records — useful on a build machine that doesn't have the patched files laid out. The wiring checks still apply: a vendored ledger record the lockfile no longer wires, or a lockfile reference whose record is unavailable or names another package, is omitted either way. |
 | `--doc-id <id>` | `SOCKET_VEX_DOC_ID` | Override the document `@id`. Default is a random `urn:uuid:<v4>` regenerated each run; pin this for a reproducible identifier. |
 | `--compact` | `SOCKET_VEX_COMPACT` | Emit compact JSON instead of pretty-printed. |
 
@@ -728,13 +745,22 @@ consuming machine.
 
 There are two ways in:
 
-- **`socket-patch scan --mode vendored`** discovers, downloads and vendors in one pass,
-  writes no `.socket/manifest.json`, and takes over packages a hosted scan redirected
-  (their hosted lockfile edits are reverted first). This is the way to move a hosted
-  project offline.
 - **`socket-patch vendor`** vendors the agent-mode patches listed in
-  `.socket/manifest.json`. With no manifest (a hosted or `scan --mode vendored` project)
-  it has nothing to vendor and says so; `vendor --revert` works either way.
+  `.socket/manifest.json`. With no manifest in a **hosted** project it **ejects**: it
+  takes the patch set from the lockfiles' hosted pins, fetches each patch from the API,
+  and vendors it (`Ejecting N hosted packages into .socket/vendor/...`). This is the way
+  to move a hosted project offline (run it while online; it works from a fresh checkout).
+  The eject is all-or-nothing: if any patch can't be fetched or vendored, the project is
+  left hosted exactly as it was. With neither a manifest nor hosted pins (a
+  `scan --mode vendored` project) it has nothing to vendor and says so; `vendor --revert`
+  works either way.
+- **`socket-patch scan --mode vendored`** discovers, downloads and vendors in one pass,
+  writes no `.socket/manifest.json`, and takes over packages a hosted scan redirected.
+
+Taking over a hosted package (either way) first restores its upstream registry entry —
+the same restore `rollback` does — so `vendor --revert` later returns it to upstream,
+never back to hosted. A package whose entry cannot be restored (offline, `bun.lockb`)
+fails with `redirect_revert_failed` and stays hosted.
 
 Vendoring is per-patch: only dependencies with a Socket patch are vendored. For the
 lockfile flavors each ecosystem supports, see the
@@ -750,7 +776,7 @@ socket-patch scan --mode vendored [PATHS]... [options]
 | Flag | Env var | Description |
 |------|---------|-------------|
 | `-f, --force` | `SOCKET_FORCE` | Tolerate *missing* patch-target files in the staged copy (skipped instead of failing the vendor) and bypass the variant probe for multi-release ecosystems. A plain before-hash mismatch doesn't need this: vendor staging always overwrites mismatched content with the verified patched bytes (surfaced as a `vendor_content_mismatch_overwritten` warning). |
-| `--revert` | `SOCKET_VENDOR_REVERT` | Undo vendoring: restore the recorded original lockfile fragments byte-for-byte and remove the `.socket/vendor/` artifacts. Works without a manifest. |
+| `--revert` | `SOCKET_VENDOR_REVERT` | Undo vendoring: restore the recorded original lockfile fragments byte-for-byte and remove the `.socket/vendor/` artifacts. Works without a manifest. A package vendored over a hosted pin returns to its upstream registry entry. |
 | `--vex <path>` | `SOCKET_VEX` | On a successful vendor, also write an OpenVEX 0.2.0 document to this path. |
 | `--vex-product`, `--vex-no-verify`, `--vex-doc-id`, `--vex-compact` | `SOCKET_VEX_*` | Passthrough to the embedded VEX builder. Inert unless `--vex` is set. |
 
@@ -780,7 +806,8 @@ socket-patch scan --mode vendored
 # Preview it (would_vendor / would_revendor / already_vendored)
 socket-patch scan --json --mode vendored --dry-run
 
-# Vendor the agent-mode patches listed in .socket/manifest.json
+# Vendor the agent-mode patches listed in .socket/manifest.json,
+# or, in a hosted project with no manifest, eject its hosted pins
 socket-patch vendor
 
 # Preview without writing anything
@@ -789,7 +816,8 @@ socket-patch vendor --dry-run
 # Then make it stick: commit .socket/ (vendor artifacts + ledger) and the lockfile
 git add .socket package-lock.json && git commit -m "vendor Socket patches"
 
-# Undo everything (restores the original lockfile byte-for-byte)
+# Undo everything (restores the original lockfile byte-for-byte; ejected hosted
+# packages come back as their upstream registry entries)
 socket-patch vendor --revert
 
 # JSON output for scripting
@@ -798,9 +826,12 @@ socket-patch vendor --json
 
 ### `list`
 
-List the patches in this project: the hosted redirect ledger's records (labeled
-`Mode: hosted`), the vendor ledger's (`Mode: vendored`), and any agent-mode entries in
-`.socket/manifest.json`.
+List the patches in this project: the hosted pins your lockfiles wire (labeled
+`Mode: hosted (wired in <lockfiles>)` — JSON `details.mode: "hosted"` and
+`details.lockfiles`), the vendor ledger's records (`Mode: vendored`), and any agent-mode
+entries in `.socket/manifest.json`. A hosted pin shows its UUID only (hosted mode keeps no
+local record; `vex` fetches it from the API), unless a pre-v5
+`.socket/vendor/redirect-state.json` still records it.
 
 **Usage:**
 ```bash
@@ -825,7 +856,7 @@ Found 1 patch:
 
 Package: pkg:npm/flatted@3.3.1
   UUID: 5cac955f-eab1-4d29-8f4f-c408a6cc9647
-  Mode: hosted (recorded in .socket/vendor/redirect-state.json)
+  Mode: vendored (recorded in .socket/vendor/state.json)
   Tier: free
   License: MIT
   Exported: Wed, 18 Mar 2026 22:53:26 GMT
@@ -1082,13 +1113,28 @@ socket-patch setup --json -y
 
 Roll back patches to restore the system to unpatched. If no target is given, everything
 is rolled back, across all three modes: in-place file restores (agent), vendored unwire +
-artifact deletion + ledger-entry drop, and hosted lockfile-redirect unwind + record drop.
+artifact deletion + ledger-entry drop, and hosted lockfile entries restored to their
+upstream registry entries.
 The rolled-back entries are then removed from `.socket/manifest.json` (a zero-patch
 `{"patches": {}}` husk stays) and their blobs are garbage-collected — a later `apply` has
 nothing to re-apply. Pass `--preserve-state` to keep the local patch state (manifest
 entries, vendored artifacts + ledger entries) for a later re-apply; use
 [`remove`](#remove) for a single patch.
 
+**Hosted patches** are read from the lockfiles (hosted mode keeps no ledger). Each one is
+rewritten back to the default upstream registry entry, with the tarball URL, integrity or
+checksum re-resolved from the public registry — npm, crates.io, the Go module proxy, PyPI,
+rubygems.org, packagist, nuget.org (Maven needs no network). Where that is impossible the
+package is refused, nothing is written for it, and the run exits 1 with a hint to restore
+the file from version control (`git checkout -- <lockfile>`): under `--offline`, when the
+registry does not answer, for a binary `bun.lockb`, and for a few lock shapes whose
+entries only the package manager can compute (see
+[CLI_CONTRACT.md](crates/socket-patch-cli/CLI_CONTRACT.md), "Hosted unwind coverage").
+The registry bases honor the `SOCKET_NPM_REGISTRY`, `SOCKET_CRATES_INDEX`,
+`SOCKET_GOPROXY`, `SOCKET_GOSUMDB_URL`, `SOCKET_PYPI_JSON_API`, `SOCKET_RUBYGEMS_URL`,
+`SOCKET_PACKAGIST_URL` and `SOCKET_NUGET_URL` overrides for mirrors. A leftover pre-v5
+`.socket/vendor/redirect-state.json` is deleted once no lockfile pins a hosted patch.
+
 A wet run confirms once (auto-accepted under `--yes`/`--json`/non-TTY). Vendor-owned purls
 the run did NOT act on (a corrupt vendor ledger) are listed in the JSON output's
 `vendored` array; acted-on entries ride `vendoredReverted` / `vendoredPreserved` /
@@ -1106,7 +1152,7 @@ socket-patch rollback [targets]... [options]
 **Command-specific options** (plus all [Global options](#global-options)):
 | Flag | Env var | Description |
 |------|---------|-------------|
-| `--preserve-state` | `SOCKET_PRESERVE_STATE` | Unpatch the system but keep the local patch state — manifest entries, vendored artifacts + ledger entries — for a later re-apply, and skip GC. Hosted redirects have no preservable state and are unwound either way. |
+| `--preserve-state` | `SOCKET_PRESERVE_STATE` | Unpatch the system but keep the local patch state — manifest entries, vendored artifacts + ledger entries — for a later re-apply, and skip GC. Hosted patches have no preservable state (the lockfile is their only record) and are restored to upstream either way. |
 | `--one-off` | `SOCKET_ONE_OFF` | Reserved: rollback by fetching original (`beforeHash`) files from the API, no manifest required. **Not yet implemented** — the command currently errors up front. |
 
 **Examples:**
@@ -1134,7 +1180,9 @@ Remove a patch from the manifest (rolls back files first by default). If the pac
 byte-for-byte and the `.socket/vendor/` artifact is deleted — so the patch is fully gone
 in one command. Patches vendored by `scan --mode vendored` have no manifest entry and are
 removable by PURL or UUID all the same (reverting the vendoring *is* the removal, so
-`--skip-rollback` is refused for them).
+`--skip-rollback` is refused for them). A hosted patch is removed the same way: its
+lockfile entries are restored to their upstream registry entry, exactly as `rollback`
+does it (refused, with the manifest untouched, where that is impossible).
 
 **Usage:**
 ```bash
@@ -1218,15 +1266,15 @@ place — without bumping the package version.
 
 1. Gathers every patch the project can prove: agent-mode patches from
    `.socket/manifest.json`, and [vendored](#vendor) / [hosted](#three-patch-modes) patches
-   from the wiring in your **lockfiles** (plus the `.socket/vendor` ledgers when they are
-   committed). See [No manifest needed for hosted and vendored
+   from the wiring in your **lockfiles** (plus the vendor ledger when it is committed;
+   hosted records are fetched from the API). See [No manifest needed for hosted and vendored
    patches](#no-manifest-needed-for-hosted-and-vendored-patches).
 2. Unless `--no-verify` is passed, re-checks each patch's bytes so the attestation only
    covers patches that are actually applied: agent patches against the installed tree,
    vendored patches against the **committed artifact** (marker `(vendored)`), and hosted
    patches against the installed copy the build consumes — or, before any install, against
    the lockfile's integrity pin (marker `(redirected)`). Vendored and hosted patches need
-   no `setup` install hook to be attested. Whatever `--no-verify` says, a ledger record the
+   no `setup` install hook to be attested. Whatever `--no-verify` says, a record the
    lockfile no longer wires is never attested.
 3. Auto-detects the top-level **product** identifier (override with `--product`), probing
    in order:
@@ -1284,7 +1332,7 @@ trivy image --vex socket.vex.json <image>
 ```
 
 Patch first (in any mode). When nothing names a patch anywhere — no manifest
-entry, no `.socket/vendor` ledger entry, no hosted or vendored lockfile reference — `vex`
+entry, no vendor ledger entry, no hosted or vendored lockfile reference — `vex`
 errors with `no_patches` (exit 1) when the manifest file exists but is empty, or with
 `manifest_not_found` (exit 2) when there is no manifest either. When there are patches but
 none can be attested, it exits 1 with `no_applicable_patches`, and each omission is listed
@@ -1292,12 +1340,13 @@ with its reason: `hash_mismatch`, `record_unavailable`, `redirect_unwired`, and
 
 ### No manifest needed for hosted and vendored patches
 
-A hosted or vendored checkout needs no `.socket/manifest.json`, and no `.socket/vendor`
-ledgers either. This covers a depscan-opened PR, a clone of a repo that never committed its
-ledgers, and a fresh hosted `scan`. `vex` reads the patch reference out of each root
-lockfile or config: a `patch.socket.dev` URL or a `.socket/vendor/<eco>/<uuid>/…` path
-carries the patch uuid. It then finds that patch's record in the manifest or ledgers, or
-fetches it from the patch API. The references it accepts are what socket-patch's own
+A hosted or vendored checkout needs no `.socket/manifest.json`, and no vendor ledger
+either. This covers a depscan-opened PR, a clone of a repo that never committed its
+vendor ledger, and every hosted project (hosted mode keeps no ledger at all). `vex` reads
+the patch reference out of each root lockfile or config: a `patch.socket.dev` URL (or one
+on your `--patch-server-url`) or a `.socket/vendor/<eco>/<uuid>/…` path carries the patch
+uuid. It then finds that patch's record in the manifest or vendor ledger, or fetches it
+from the patch API — the normal path for hosted patches. The references it accepts are what socket-patch's own
 rewriters write: a URL on any other host, or an entry the package manager would not
 install from, is ignored.
 
@@ -1310,10 +1359,11 @@ Behavior worth knowing:
 
 - **Network.** Without a local record, `vex` fetches the patch by uuid from the patch API.
   With `--offline`, or when the fetch fails or the patch is paid and not entitled, the patch
-  is omitted as `record_unavailable`. Commit the ledgers, or keep the manifest, to attest
-  offline.
-- **Liveness.** A ledger entry attests only while a lockfile still wires it. Otherwise it is
-  omitted as `vendor_unwired` or `redirect_unwired`, even under `--no-verify`. Lockfiles
+  is omitted as `record_unavailable`. Hosted patches therefore need the network to be
+  attested; commit the vendor ledger, or keep the manifest, to attest offline.
+- **Liveness.** A vendor ledger entry (or a leftover pre-v5 hosted record) attests only
+  while a lockfile still wires it. Otherwise it is omitted as `vendor_unwired` or
+  `redirect_unwired`, even under `--no-verify`. Lockfiles
   that wire one package to different patches (`wiring_conflict`) attest none of them. A
   package that one lock wires to a patch while another lock resolves it from the registry
   is not attested either.
@@ -1330,13 +1380,13 @@ Behavior worth knowing:
 | yarn | `yarn.lock` (classic + berry) | Berry vendored entries also need the root `package.json` `resolutions` mapping; member locks are not read |
 | bun | `bun.lock`, else `bun.lockb` | A hosted entry that Bun < 1.3.10 re-saved without its sha512 attests only after install |
 | vlt | `vlt-lock.json` (`lockfileVersion` absent, 0 or 1) | A BOM-prefixed or other-version lock wires nothing; a same-version instance on another registry keeps a hosted pin from attesting before install; a vendored directory whose `package.json` patch lost its devDependencies needs the patched blob in `.socket/blobs` without the vendor ledger |
-| cargo | `Cargo.lock`, `Cargo.toml`, `.cargo/config[.toml]` | Root manifest + project config only (no `$CARGO_HOME` / parent configs); vendored `[patch.crates-io]` entries are read from `Cargo.toml` first (v5), the project config for pre-v5 projects, and must agree with the detached lock entry's tagged version `<version>+socket.<uuid>` (a tag for another uuid — in the lock or in the copy's own `Cargo.toml` — is dead wiring; an untagged detached entry counts only beside an untagged, pre-tag copy); a manifest entry cargo ignores (a same-key project-config item, or a URL-spelled crates.io `[patch]` table) is not attested; a lockless hosted pin needs the redirect ledger's record |
+| cargo | `Cargo.lock`, `Cargo.toml`, `.cargo/config[.toml]` | Root manifest + project config only (no `$CARGO_HOME` / parent configs); vendored `[patch.crates-io]` entries are read from `Cargo.toml` first (v5), the project config for pre-v5 projects, and must agree with the detached lock entry's tagged version `<version>+socket.<uuid>` (a tag for another uuid — in the lock or in the copy's own `Cargo.toml` — is dead wiring; an untagged detached entry counts only beside an untagged, pre-tag copy); a manifest entry cargo ignores (a same-key project-config item, or a URL-spelled crates.io `[patch]` table) is not attested; a lockless hosted pin (no `Cargo.lock`) names no version and is not attested — nor seen by `list` / `rollback` (only a pre-v5 redirect ledger record keeps it live) |
 | golang | `go.mod`, `go.work`, `go.sum`, `go.work.sum` | A replace that `require` no longer selects is inert; `vendor/modules.txt` is not read |
 | pypi | `uv.lock`, `*.py.lock`, `pylock*.toml`, `poetry.lock`, `pdm.lock`, `Pipfile.lock`, `requirements.txt` (+ `-r` includes), `pyproject.toml` / `hatch.toml` | A `uv.lock` beside a `pyproject.toml` must agree with its `[tool.uv.sources]`; PDM 3.1 / 4.0–4.2 locks are refused; a Pipenv project needs `--product` (or a git remote) |
-| gem | `Gemfile.lock`, `gems.locked` | Platform gems unsupported; a Gemfile-only (pre-bundler-2.6, not yet locked) wiring needs the redirect ledger |
+| gem | `Gemfile.lock`, `gems.locked` | Platform gems unsupported; a Gemfile-only (pre-bundler-2.6, not yet locked) wiring is not attested — nor seen by `list` / `rollback` (only a pre-v5 redirect ledger record keeps it live) |
 | composer | `composer.lock` | `installed.json` and `COMPOSER=`-renamed locks are not read |
 | maven | `pom.xml` (+ `.mvn/` checksums) | Root pom only (no parents / submodules, no Gradle); legacy same-GAV hosted repositories cannot be attributed |
-| nuget | `nuget.config`, `packages.lock.json` | Hosted needs a `packages.lock.json` entry for the id (with no lock at all, an exclusive exact-id mapping still keeps the redirect ledger's record live); root config only |
+| nuget | `nuget.config`, `packages.lock.json` | Hosted needs a `packages.lock.json` entry for the id: with no lock, the mapping names no version and is not attested — nor seen by `list` / `rollback` (only a pre-v5 redirect ledger record keeps it live); root config only |
 | deno | none | No hosted or vendored mode exists; Deno patches attest only through the manifest (agent mode + `setup.manual`) |
 
 The full recognition rules are in
@@ -1368,15 +1418,15 @@ Contract:
   with the command's own `--json` output. JSON mode adds a top-level `vex` summary —
   `{ path, statements, format }` — to the envelope (`apply`) / result (`scan`).
 - It's built from the project **as it stands after the run** — the manifest (including
-  any `--mode agent` writes), the `.socket/vendor` ledgers, and the lockfile wiring — and
+  any `--mode agent` writes), the vendor ledger, and the lockfile wiring — and
   verified against on-disk state unless `--vex-no-verify` is set. Generated for real runs
   and report-only scans alike; `--dry-run` skips it (nothing was changed, so nothing is
   attested).
 - `apply --vex` and `vendor --vex` with **no manifest** still attest what the lockfiles and
-  ledgers wire. A project with nothing wired anywhere keeps the calm exit 0 and writes no
+  the vendor ledger wire. A project with nothing wired anywhere keeps the calm exit 0 and writes no
   document. `apply --check` never generates one.
 - **Fail-the-command:** if `--vex` was requested but generation fails (no detectable
-  product, nothing attestable, a corrupt ledger, unwritable path), the command exits
+  product, nothing attestable, a corrupt vendor ledger, unwritable path), the command exits
   non-zero **even when the apply/scan itself succeeded**, with a stable error code in the
   JSON output.
 
diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index 55a3983a..978a22d4 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -9,13 +9,13 @@ This document defines the **public surface** of the `socket-patch` binary. Anyth
 | Name | Visible alias(es) | Notes |
 |---|---|---|
 | `scan` | — | Find patches for installed packages and apply them. **v5.0 (MAJOR)**: a bare `scan` runs hosted mode (rewrites lockfiles so only the patched dependencies resolve to Socket-hosted, integrity-pinned packages); `--mode vendored` / `--mode agent` pick the other modes. Never prompts. See [scan modes](#scan-modes-v50) |
-| `vex` | — | Emit an OpenVEX 0.2.0 attestation derived from the local manifest, the `.socket/vendor` ledgers, and the hosted / vendored patch references the project's lockfiles wire (no manifest required) |
+| `vex` | — | Emit an OpenVEX 0.2.0 attestation derived from the local manifest, the vendor ledger, and the hosted / vendored patch references the project's lockfiles wire (no manifest required; hosted records come from the API) |
 | `vendor` | — | Eject patched dependencies into committable `.socket/vendor/` and rewire lockfiles |
-| `list` | — | Print patches in the local manifest, plus the vendor ledger's (v5.0) and the hosted redirect ledger's records (labeled; see the `manifest_not_found` row and the action matrix) |
+| `list` | — | Print patches in the local manifest, plus the vendor ledger's records (v5.0) and the hosted pins the lockfiles wire (labeled; see the `manifest_not_found` row and the action matrix) |
 | `get` | `download` | Agent mode by default (`--mode` selects hosted/vendored): fetch + apply a patch; requires positional `identifier` |
 | `apply` | — | Agent mode: apply patches from the local manifest |
 | `setup` | — | Agent mode: wire automatic-patching install hooks (npm/pypi/gem/composer) |
-| `rollback` | — | **Full-state rollback (v5.0, MAJOR)**: restore original files AND unwind vendored/hosted lockfile wiring, remove the rolled-back entries from the manifest, and GC their blobs/archives; takes optional variadic positional `targets` (PURL \| UUID \| path glob). See [Rollback command contract](#rollback-command-contract-v50) |
+| `rollback` | — | **Full-state rollback (v5.0, MAJOR)**: restore original files AND unwind vendored lockfile wiring / restore hosted pins to their upstream registry entries, remove the rolled-back entries from the manifest, and GC their blobs/archives; takes optional variadic positional `targets` (PURL \| UUID \| path glob). See [Rollback command contract](#rollback-command-contract-v50) |
 | `remove` | — | Agent mode: remove a patch from manifest (rolls back first); requires positional `identifier` |
 | `repair` | `gc` | Agent mode: download missing blobs, rebuild missing/corrupt vendored artifacts, and clean up unused ones (refuses with `lock_held` when a live process holds the lock; see "Lock lifecycle" below) |
 
@@ -77,7 +77,7 @@ Beyond the globals above, each subcommand defines a small set of local arguments
 | `apply` | `--force` / `-f` | `SOCKET_FORCE` | Bypass beforeHash check |
 | `apply` | `--check` | — | Read-only audit that the committed **Go** `replace`-redirects match the manifest (CI / GitHub-App auditing) — Go ONLY (cargo patches in place, so there is no redirect to audit). Lock-free, crawl-free, offline-safe; exits 0 in sync, 1 on drift. Vendored modules are excluded from the audit |
 | `vendor` | `--force` / `-f` | `SOCKET_FORCE` | Tolerate missing patch-target files in the stage + bypass the variant probe. A beforeHash mismatch no longer needs it: vendor staging auto-overwrites with the verified patched content (`vendor_content_mismatch_overwritten` warning) |
-| `vendor` | `--revert` | `SOCKET_VENDOR_REVERT` | Undo vendoring: restore recorded original lockfile fragments + remove `.socket/vendor/` artifacts. Works without a manifest |
+| `vendor` | `--revert` | `SOCKET_VENDOR_REVERT` | Undo vendoring: restore recorded original lockfile fragments + remove `.socket/vendor/` artifacts. Works without a manifest. A package vendored over a hosted pin returns to its upstream registry entry, never to hosted (see "Takeover reconciliation") |
 | `apply`, `scan`, `vendor` | `--vex` | `SOCKET_VEX` | Generate an OpenVEX 0.2.0 document at this path on a successful run; see "embedded VEX" below |
 | `apply`, `scan`, `vendor` | `--vex-product`, `--vex-no-verify`, `--vex-doc-id`, `--vex-compact` | `SOCKET_VEX_PRODUCT`, `SOCKET_VEX_NO_VERIFY`, `SOCKET_VEX_DOC_ID`, `SOCKET_VEX_COMPACT` | Passthrough to the embedded VEX builder; mirror the standalone `vex` knobs. Inert unless `--vex` is set |
 | `scan` | positional `[PATHS]...` | — | (v5.0) Meaning depends on the mode. **Hosted / vendored** (bare `scan` included): each PATH, or directory glob (`apps/*`), is a project directory scanned on its own as if it were `--cwd`. **Agent** (and a mode-less `--prune`/`--global` report): path globs scoping DISCOVERY to packages installed under matching paths (`packages/foo`, `apps/**`). See "Path-scoped scans" below |
@@ -97,17 +97,17 @@ Beyond the globals above, each subcommand defines a small set of local arguments
 
 **pnpm hosted-mode contract**: `scan --mode hosted` handles block and flow resolutions in legacy `shrinkwrap.yaml` and lockfileVersion 5.x, 6.0, and 9.0. The [pinned compatibility matrix](../../docs/testing/pnpm-compatibility.md) samples pnpm majors 1–12. Early shrinkwrapVersion 3 without a positive minor version is refused with `redirect_pnpm_legacy_lockfile_unsupported`: pnpm 1.0.0 discards hosted URLs even on frozen installs. Upgrade to a tested release (1.43.1 or newer) and regenerate the lock, or use agent mode.
 
-Each matching package instance is spliced, including scoped, quoted and nested-peer keys, with one `redirect_pnpm_resolution` revert-ledger edit per changed instance. LF/CRLF and unrelated lock bytes are preserved. Unsupported matching instances refuse that dependency across the lockfile set; an already-hosted URL elsewhere cannot confirm a partial rewrite.
+Each matching package instance is spliced, including scoped, quoted and nested-peer keys, one `redirect_pnpm_resolution` edit per changed instance (`rollback` / `remove` restore each from the npm registry — see "Hosted unwind coverage"). LF/CRLF and unrelated lock bytes are preserved. Unsupported matching instances refuse that dependency across the lockfile set; an already-hosted URL elsewhere cannot confirm a partial rewrite.
 
-For a **9.0 root lock**, the CLI ensures `pnpm-workspace.yaml` carries `trustLockfile: true` (created with a root-only `packages:` scaffold, or appended while preserving user bytes). pnpm >=11 requires this to accept hosted URLs; it disables registry re-verification for the whole lock, while sha512 tarball integrity remains enforced. The write is ledger-recorded as `redirect_pnpm_workspace_trust`, respects `--dry-run`, skips legacy locks and Rush repos, preserves explicit user settings, and is disabled by `--no-trust-lockfile-config`. The `redirect_pnpm_trust_lockfile` warning explains manual configuration when required and clean reinstall guidance for all pnpm versions. Existing installs and warm stores can retain upstream files; use a clean install tree and empty store, then verify installed files with `socket-patch vex`. Neither a successful install nor a local VEX export guarantees hosted SBOM recognition or changes dashboard alert actions/counts.
+For a **9.0 root lock**, the CLI ensures `pnpm-workspace.yaml` carries `trustLockfile: true` (created with a root-only `packages:` scaffold, or appended while preserving user bytes). pnpm >=11 requires this to accept hosted URLs; it disables registry re-verification for the whole lock, while sha512 tarball integrity remains enforced. The write (edit kind `redirect_pnpm_workspace_trust`) respects `--dry-run`, skips legacy locks and Rush repos, preserves explicit user settings, and is disabled by `--no-trust-lockfile-config`. The `redirect_pnpm_trust_lockfile` warning explains manual configuration when required and clean reinstall guidance for all pnpm versions. Existing installs and warm stores can retain upstream files; use a clean install tree and empty store, then verify installed files with `socket-patch vex`. Neither a successful install nor a local VEX export guarantees hosted SBOM recognition or changes dashboard alert actions/counts.
 
-**npm hosted-mode `allow-remote` contract**: npm >=12 defaults `allow-remote=none` and refuses (EALLOWREMOTE) every lockfile entry whose `resolved` tarball is not served by the configured registry — exactly what a hosted redirect writes into `package-lock.json` / `npm-shrinkwrap.json`. Whenever a run leaves a ROOT npm lock carrying a granted hosted artifact URL (spliced this run, or already redirected by an earlier one — a missed config heals on re-run), the CLI ensures `allow-remote=all` in the project-root `.npmrc`: the file is created holding exactly `allow-remote=all\n` when absent, otherwise one `allow-remote=all` line is spliced in after the last non-empty top-level line (before any ini `[section]` header), in the file's own line ending, with the BOM, CRLF and trailing-newline shape preserved. The write lands in `redirect.rewrittenFiles` and is ledger-recorded as `redirect_npmrc_allow_remote` (`path: ".npmrc"`, `key: "allow-remote"`, `new: "all"`; `action: "created"` for a new file, `"added"` for a spliced line), respects `--dry-run` (nothing written; the warning says what would be — including for a vendored → hosted takeover the dry run only previews), and is disabled by `--no-npm-allow-remote-config` / `SOCKET_NO_NPM_ALLOW_REMOTE_CONFIG`. The `.npmrc` grammar is npm's own `ini` parser's (cross-checked against it): lines split on any run of `\r` / `\n` (a bare `\r` ends a line), only the exact key `allow-remote` counts after ini unquoting (npm ignores `allow_remote` / `ALLOW-REMOTE` in a `.npmrc`; such a line is left alone and the real key appended), comment lines are ignored, a `[section]` header is recognized only as npm does — on the UNTRIMMED line (an indented or BOM-prefixed `[sec]` is a plain top-level key) — and ends the top-level scope, quotes and inline comments are stripped, the LAST top-level assignment wins, and the value is case-sensitive. An explicit other value (`allow-remote=none` / `root` / anything but `all`) is RESPECTED and never rewritten — the pnpm `trustLockfile: false` precedent — in the project `.npmrc` AND in every other npm config layer npm would consult: an `npm_config_allow_remote` environment variable (any spelling npm normalizes; it beats every `.npmrc`, so a project write could not take effect), and — when the project file sets nothing — the user (`npm_config_userconfig` / `~/.npmrc`), global (`npm_config_globalconfig` / `<prefix>/etc/npmrc`, prefix from `npm_config_prefix`, the user/builtin config, `PREFIX` or the `node` binary's install root) and builtin (npm's own `npmrc` beside the `node` binary: `<dir>/lib/node_modules/npm/npmrc`, `<dir>\node_modules\npm\npmrc` on Windows) config files — path values `${VAR}`-expanded and `~`-expanded like npm, env names case-insensitive on Windows, where a committed project line would silently override a machine / org policy. A symlinked, non-regular or unreadable `.npmrc`, or one with bare-`\r` line endings (npm splits on them, the line splice does not), is left untouched. Every variant emits the `redirect_npm_allow_remote` warning (written / would write / already set / explicit value respected — naming the project file, the env var, or the user/global/builtin config path — / opted out / unreadable or unsupported), always with the tradeoff: `allow-remote=all` lets npm install ANY url-resolved dependency, not just Socket's patched ones, while the per-entry sha512 integrity pins stay enforced; the remedy for the non-writing variants is `allow-remote=all` in `.npmrc` or `npm ci --allow-remote=all`. npm <=11 is unaffected (11 defaults to `all`, <=10 has no such setting). **Unwind**: the edit is removed exactly once no `redirect_npm_lock_entry` / `redirect_npm_lock_dep` edit remains in the ledger — by the per-purl npm revert of the LAST package-lock entry (scoped `rollback <purl>` / `remove <purl>`, the hosted → vendored takeover), by the whole-ledger replay (`rollback` / `remove`, `npm` group — a refused package-lock edit keeps the setting it needs), and by the vendored-supersedes-hosted reconcile. A `created` file still holding exactly `allow-remote=all\n` is deleted; otherwise only the one top-level `allow-remote=all` line is removed, user edits kept (a modified created file warns `redirect_npmrc_allow_remote_modified`, surfaced in the `warnings[]` of `rollback`, `remove`, `vendor` and the vendored reconcile, and as a `Warning (<code>): …` stderr line in human mode); copies under an ini `[section]` are inert to npm and never counted, and a duplicated TOP-LEVEL line refuses fail-closed (ambiguous). A symlinked or non-regular `.npmrc` refuses the unwind while it is still being PLANNED, so the revert writes nothing (never a reverted lock behind a ledger that still records the redirect). The rewrite's stage file is created with the `.npmrc`'s own permission bits (a 0600 token-bearing file is never staged world-readable). **Vendored mode is unaffected**: its `file:.socket/vendor/…` resolutions are npm `file` specs, which npm gates by `allow-file` (default `all`), never `allow-remote` — verified by the real npm 12 vendored matrix.
+**npm hosted-mode `allow-remote` contract**: npm >=12 defaults `allow-remote=none` and refuses (EALLOWREMOTE) every lockfile entry whose `resolved` tarball is not served by the configured registry — exactly what a hosted redirect writes into `package-lock.json` / `npm-shrinkwrap.json`. Whenever a run leaves a ROOT npm lock carrying a granted hosted artifact URL (spliced this run, or already redirected by an earlier one — a missed config heals on re-run), the CLI ensures `allow-remote=all` in the project-root `.npmrc`: the file is created holding exactly `allow-remote=all\n` when absent, otherwise one `allow-remote=all` line is spliced in after the last non-empty top-level line (before any ini `[section]` header), in the file's own line ending, with the BOM, CRLF and trailing-newline shape preserved. The write lands in `redirect.rewrittenFiles` (edit kind `redirect_npmrc_allow_remote`), respects `--dry-run` (nothing written; the warning says what would be — including for a vendored → hosted takeover the dry run only previews), and is disabled by `--no-npm-allow-remote-config` / `SOCKET_NO_NPM_ALLOW_REMOTE_CONFIG`. The `.npmrc` grammar is npm's own `ini` parser's (cross-checked against it): lines split on any run of `\r` / `\n` (a bare `\r` ends a line), only the exact key `allow-remote` counts after ini unquoting (npm ignores `allow_remote` / `ALLOW-REMOTE` in a `.npmrc`; such a line is left alone and the real key appended), comment lines are ignored, a `[section]` header is recognized only as npm does — on the UNTRIMMED line (an indented or BOM-prefixed `[sec]` is a plain top-level key) — and ends the top-level scope, quotes and inline comments are stripped, the LAST top-level assignment wins, and the value is case-sensitive. An explicit other value (`allow-remote=none` / `root` / anything but `all`) is RESPECTED and never rewritten — the pnpm `trustLockfile: false` precedent — in the project `.npmrc` AND in every other npm config layer npm would consult: an `npm_config_allow_remote` environment variable (any spelling npm normalizes; it beats every `.npmrc`, so a project write could not take effect), and — when the project file sets nothing — the user (`npm_config_userconfig` / `~/.npmrc`), global (`npm_config_globalconfig` / `<prefix>/etc/npmrc`, prefix from `npm_config_prefix`, the user/builtin config, `PREFIX` or the `node` binary's install root) and builtin (npm's own `npmrc` beside the `node` binary: `<dir>/lib/node_modules/npm/npmrc`, `<dir>\node_modules\npm\npmrc` on Windows) config files — path values `${VAR}`-expanded and `~`-expanded like npm, env names case-insensitive on Windows, where a committed project line would silently override a machine / org policy. A symlinked, non-regular or unreadable `.npmrc`, or one with bare-`\r` line endings (npm splits on them, the line splice does not), is left untouched. Every variant emits the `redirect_npm_allow_remote` warning (written / would write / already set / explicit value respected — naming the project file, the env var, or the user/global/builtin config path — / opted out / unreadable or unsupported), always with the tradeoff: `allow-remote=all` lets npm install ANY url-resolved dependency, not just Socket's patched ones, while the per-entry sha512 integrity pins stay enforced; the remedy for the non-writing variants is `allow-remote=all` in `.npmrc` or `npm ci --allow-remote=all`. npm <=11 is unaffected (11 defaults to `all`, <=10 has no such setting). **Unwind (v5.0: no ledger)**: once `rollback`, `remove` or a hosted → vendored takeover has restored the last hosted entry of the root `package-lock.json` / `npm-shrinkwrap.json` to its upstream registry entry (see "Hosted unwind coverage"), a project `.npmrc` holding exactly `allow-remote=all\n` (the file hosted mode creates) is deleted; any other `.npmrc` that still has a top-level `allow-remote=all` line is left untouched and the `npm_allow_remote_left` warning says the line may be removed if nothing else needs it (v5 keeps no record of whether hosted mode added it, so it is never removed behind the user's back). The rewrite's stage file is created with the `.npmrc`'s own permission bits (a 0600 token-bearing file is never staged world-readable). **Vendored mode is unaffected**: its `file:.socket/vendor/…` resolutions are npm `file` specs, which npm gates by `allow-file` (default `all`), never `allow-remote` — verified by the real npm 12 vendored matrix.
 
 `redirect_pnpm_no_lockfile` names pnpm when installer markers exist without a lock; `redirect_pnpm_entry_vendored` identifies a vendored entry instead of reporting it missing. Supported `shrinkwrap.yaml` files are writable lockfiles, not read-only markers.
 
-**vlt hosted-mode contract**: `scan` / `get --mode hosted` rewrite, in `vlt-lock.json`, every default-registry node of a granted `name@version` (the `''` / `npm` segment or a URL segment equal to the lock's scalar `registry`, both DepID grammars, every peer and modifier variant): slot [2] becomes the granted sha512 and slot [3] the hosted URL (appended to a 3-tuple); the DepID, flags and trailing slots, the line ending and every other byte stay. One `redirect_vlt_lock_node` ledger edit per changed node records the entry text (`"<DepID>": <tuple>`, no indent, comma or `\r`). `options` is never edited and `vlt.json` is only read. A lock with another `lockfileVersion` (decided on the raw JSON token), a BOM, a non-object body or a `nodes` section outside vlt's one-node-per-line layout refuses the whole lock (`redirect_vlt_lock_unsupported`). **Confirmation**: vlt drives when its install state (`node_modules/.vlt-lock.json` or `node_modules/.vlt/`) is present or no other npm-family lock is; then only `vlt-lock.json` confirms a uuid. Otherwise every lock is rewritten, `redirect_vlt_sibling_lockfiles` warns, and the other locks' rules confirm, including a dep `vlt-lock.json` merely does not wire (`redirect_vlt_entry_not_found`, `redirect_vlt_entry_vendored`). Whichever lock drives, a dep the vlt rewriter refuses (`redirect_vlt_missing_sha512`, `redirect_vlt_unsupported_lock_key`) is never confirmed by any lock, although a sibling lock may already carry its rewritten URL. **Artifact preflight**: before any takeover or write (dry runs included), each granted artifact with a default-registry instance is fetched once as vlt fetches it and must verify, else the dep is withheld (`redirect_vlt_artifact_unverifiable`, see the tag table). **Heal**: stale installed copies of Socket-owned nodes are removed so the next `vlt install` extracts the patched bytes, and `rollback` / `remove` do the same for the registry bytes (`--no-vlt-install-cleanup` keeps them; optional dependencies' copies are always kept); `redirect_vlt_reinstall_required` says what happened and what to run. The same-run `--vex` never attests a vlt package whose installed copy is stale or unchecked, whose lock a vlt release may ignore (`redirect_vlt_lockfile_version_missing`, `redirect_vlt_old_lockfile_ignored`, `redirect_vlt_scalar_registry_ignored`), or which also resolves from a non-default registry (`redirect_vlt_custom_registry_skipped`). `vlt.json` or vlt install state without `vlt-lock.json` warns `redirect_vlt_no_lockfile` instead of `redirect_npm_no_lockfile`. vlt ledgers require the socket-patch release that adds vlt support. Tested releases: `docs/testing/vlt-compatibility.md`.
+**vlt hosted-mode contract**: `scan` / `get --mode hosted` rewrite, in `vlt-lock.json`, every default-registry node of a granted `name@version` (the `''` / `npm` segment or a URL segment equal to the lock's scalar `registry`, both DepID grammars, every peer and modifier variant): slot [2] becomes the granted sha512 and slot [3] the hosted URL (appended to a 3-tuple); the DepID, flags and trailing slots, the line ending and every other byte stay. `options` is never edited and `vlt.json` is only read. A lock with another `lockfileVersion` (decided on the raw JSON token), a BOM, a non-object body or a `nodes` section outside vlt's one-node-per-line layout refuses the whole lock (`redirect_vlt_lock_unsupported`). **Confirmation**: vlt drives when its install state (`node_modules/.vlt-lock.json` or `node_modules/.vlt/`) is present or no other npm-family lock is; then only `vlt-lock.json` confirms a uuid. Otherwise every lock is rewritten, `redirect_vlt_sibling_lockfiles` warns, and the other locks' rules confirm, including a dep `vlt-lock.json` merely does not wire (`redirect_vlt_entry_not_found`, `redirect_vlt_entry_vendored`). Whichever lock drives, a dep the vlt rewriter refuses (`redirect_vlt_missing_sha512`, `redirect_vlt_unsupported_lock_key`) is never confirmed by any lock, although a sibling lock may already carry its rewritten URL. **Artifact preflight**: before any takeover or write (dry runs included), each granted artifact with a default-registry instance is fetched once as vlt fetches it and must verify, else the dep is withheld (`redirect_vlt_artifact_unverifiable`, see the tag table). **Heal**: stale installed copies of Socket-owned nodes are removed so the next `vlt install` extracts the patched bytes, and `rollback` / `remove` do the same for the registry bytes (`--no-vlt-install-cleanup` keeps them; optional dependencies' copies are always kept); `redirect_vlt_reinstall_required` says what happened and what to run. The same-run `--vex` never attests a vlt package whose installed copy is stale or unchecked, whose lock a vlt release may ignore (`redirect_vlt_lockfile_version_missing`, `redirect_vlt_old_lockfile_ignored`, `redirect_vlt_scalar_registry_ignored`), or which also resolves from a non-default registry (`redirect_vlt_custom_registry_skipped`). `vlt.json` or vlt install state without `vlt-lock.json` warns `redirect_vlt_no_lockfile` instead of `redirect_npm_no_lockfile`. `rollback` / `remove` restore each hosted node's slots [2] and [3] from the npm registry, following the lock's own slot-[3] convention (see "Hosted unwind coverage"). Tested releases: `docs/testing/vlt-compatibility.md`.
 
-**Takeover reconciliation (npm family, bun and vlt included)**: vendoring over a hosted-redirected purl (`vendor`, `scan --mode vendored`, `get --mode vendored`) first REVERTS that purl's hosted lockfile edits to their pre-redirect registry values through the per-purl redirect revert, drops the purl's record + package edits from `redirect-state.json`, and then vendors — so the vendor ledger records the PRISTINE registry fragment as its wiring `original` and `vendor --revert` lands back on registry state, never on an expiring hosted URL. The run that takes over records a `vendor_takeover_reverted_redirect` advisory event (`skipped` action beside the purl's genuine outcome; the human path prints `Warning (vendor_takeover_reverted_redirect): …`). `--dry-run` PROBES the same revert against an in-memory ledger clone instead of promising it: a clean probe reports `vendor_would_revert_redirect`, and a drifted lock or an undecidable ledger edit surfaces in the preview with the wet run's `redirect_revert_failed` code and detail (for bun, whose hosted rewrite replaces the entry's `name@version` spec, the preview first runs the Bun vendored preflight described below and then stops at the advisory instead of reading the still-hosted lock — a lock the vendored backend would refuse is previewed as the wet run's `failed <code>`, never as `vendor_would_revert_redirect`). A purl whose hosted edits cannot be cleanly reverted fails `redirect_revert_failed` (exit 1 / `partial_failure`, nothing vendored for it, the hosted wiring left in place, the remedy in the detail). **bun** participates like every other npm-family flavor: binary `redirect_bun_lockb_package` snapshots are claimed by their recorded package identity and restore individual binary resolutions; its text `redirect_bun_lock_package` edits are claimed by the recorded line's spec — the registry spec `<name>@<version>`, or a hosted URL whose tarball leaf is `<name>-<version>.tgz` — so a sibling version's or an aliased sibling's edit is neither claimed nor a refusal, and only an edit that mentions the package without being a bun packages-entry line refuses (remedy: an unscoped `socket-patch rollback`, whose whole-ledger replay unwinds bun.lock hosted edits; never hand-edit the ledger). The same claim rule serves scoped `rollback <purl>` / `remove <purl>` of one of several hosted bun records (see "Hosted unwind coverage"). Hosted → vendored and vendored → hosted (`redirect_takeover_reverted_vendored` in `redirect.warnings[]`) both work in place on bun locks the target mode accepts. **Bun vendored preflight before the takeover**: `vendor` — like `scan` / `get --mode vendored`, whose pre-download preflight runs earlier — checks `bun.lock` / `bun.lockb` with the shared Bun vendored preflight BEFORE the per-purl hosted revert, so a hosted-redirected purl on a lock the vendored backend refuses (a pre-version-2 `workspace:` lock → `vendor_bun_workspace_unsupported`; a malformed or unsupported binary lock → `vendor_bun_lockb_invalid`; an unsupported text-lock version → its code) is reported `failed <code>` with the hosted wiring, the redirect ledger and active Bun lock byte-untouched (exit 1 / `partial_failure`): the package stays hosted-patched instead of being un-hosted and then refused. `vendor --dry-run` previews that same `failed` code (exit-code parity with the wet run, nothing written) instead of promising `vendor_would_revert_redirect`. Pinned by `tests/in_process_vendor_bun_takeover.rs` and, against real Bun, `tests/mode_migration_bun.rs`. **golang** takes over the same way: the per-purl revert drops the module's hosted `replace`, removes the socket module's go.sum lines, puts the pruned upstream go.sum lines back in go's sort order, and drops the ledger record, so the vendored `replace` is recorded over pristine go.mod/go.sum (a go.mod whose replace for the module is no longer the recorded one refuses `redirect_revert_failed`). The separate run-level `vendor_supersedes_redirect` warning covers the reconcile-only case — a live lock that already proves vendored won over a stale hosted ledger record (the vendor wiring then holds the hosted-spliced fragment as `original`) — and fires exactly once, on the run that drops the stale records. Which way the live lock points is decided by the same lockfile discovery and ledger-liveness rules `vex` gates attestations on (see "Manifest-less VEX (lockfile discovery)"), for this warning, its `redirect_supersedes_vendored` twin and `hosted_wiring_retained` alike.
+**Takeover reconciliation (every hosted ecosystem, v5.0)**: vendoring over a hosted pin (`vendor`, `scan --mode vendored`, `get --mode vendored`) first RESTORES that purl's lock entries to their default upstream registry entry — the same restore `rollback` runs (core `patch::redirect::upstream::restore_upstream`; see "Hosted unwind coverage"), over the hosted pins lockfile discovery finds (v5 keeps no hosted ledger) — and then vendors, so the vendor ledger records the PRISTINE registry entry as its wiring `original` and `vendor --revert` lands back on upstream registry state, never on hosted. The run that takes over records a `vendor_takeover_reverted_redirect` advisory event (`skipped` action beside the purl's genuine outcome; detail `<purl> was hosted; restored its upstream registry entry (<files>) before vendoring (mode takeover)`; the human path prints `Warning (vendor_takeover_reverted_redirect): …`), plus any advisory the restore raised (`npm_allow_remote_left`, …). `--dry-run` resolves the same restore without writing (registry lookups included): a pin that would restore reports `vendor_would_revert_redirect`, and one that would be refused surfaces in the preview with the wet run's `redirect_revert_failed` code and detail (for bun, whose hosted rewrite replaces the entry's `name@version` spec, the preview first runs the Bun vendored preflight described below and then stops at the advisory instead of reading the still-hosted lock — a lock the vendored backend would refuse is previewed as the wet run's `failed <code>`, never as `vendor_would_revert_redirect`). A purl whose upstream entry cannot be restored — `--offline`, a registry that does not answer, a lock the restore refuses (see "Hosted unwind coverage"; a hosted binary `bun.lockb` pin IS restored for the takeover — its npm registry record is rebuilt natively — while `rollback` / `remove` refuse it) — fails `redirect_revert_failed` with the detail `cannot vendor over the live hosted pin: cannot restore <purl> to its upstream registry entry: <why>; restore it from version control instead (`git checkout -- <files>`)` (exit 1 / `partial_failure`, nothing vendored for it, the hosted wiring left in place). The cargo backend's `hosted_redirect_live` refusal backstops a crate whose hosted residue is still in place when it is reached; its detail names `socket-patch rollback` and `git checkout -- Cargo.toml Cargo.lock`. **Bun vendored preflight before the takeover**: `vendor` — like `scan` / `get --mode vendored`, whose pre-download preflight runs earlier — checks `bun.lock` / `bun.lockb` with the shared Bun vendored preflight BEFORE the upstream restore, so a hosted purl on a lock the vendored backend refuses (a pre-version-2 `workspace:` lock → `vendor_bun_workspace_unsupported`; a malformed or unsupported binary lock → `vendor_bun_lockb_invalid`; an unsupported text-lock version → its code) is reported `failed <code>` with the hosted wiring and active Bun lock byte-untouched (exit 1 / `partial_failure`): the package stays hosted-patched instead of being un-hosted and then refused. `vendor --dry-run` previews that same `failed` code (exit-code parity with the wet run, nothing written) instead of promising `vendor_would_revert_redirect`. Pinned by `tests/in_process_vendor_bun_takeover.rs` and, against real Bun, `tests/mode_migration_bun.rs`. Hosted → vendored and vendored → hosted (`redirect_takeover_reverted_vendored` in `redirect.warnings[]`) both work in place on the locks the target mode accepts. **Removed in v5.0**: the run-level `vendor_supersedes_redirect` warning and its reconcile of the redirect ledger (a live lock that already proved vendored won over a stale hosted ledger record) — once the lock routes a package to `.socket/vendor/`, no hosted state is left to go stale. Which way the live lock points is decided by the same lockfile discovery rules `vex` gates attestations on (see "Manifest-less VEX (lockfile discovery)"), for `redirect_supersedes_vendored` and `hosted_wiring_retained` alike.
 
 ### Scan modes (v5.0)
 
@@ -115,9 +115,9 @@ For a **9.0 root lock**, the CLI ensures `pnpm-workspace.yaml` carries `trustLoc
 
 **scan never prompts, in any mode** (v5.0): no confirm, no free-tier patch menu (it always takes the top-ranked downloadable patch; see "Which patch gets selected"), and no `Non-interactive mode detected` note. `--yes` does not change a scan. `get`, `rollback`, `remove`, `setup` and `--update` keep their prompts.
 
-**Hosted-state visibility (`redirectState`, additive/MINOR).** Every non-hosted-mode, non-vendored-mode `scan --json` SUCCESS envelope (report-only, `--mode agent`/`--apply`/`--sync`, and the zero-discovery envelope) carries an additive top-level `redirectState` object whenever the hosted redirect ledger (`.socket/vendor/redirect-state.json`) holds ≥ 1 `records` entry: `{ mode, ledger, records: [{purl, ledgerKey, uuid}], wiringLive: [purl] }`. It is a descriptive STATE block, not a warning. `mode` is the constant `"hosted"` (the mode's documented name, whatever opaque `mode` string the ledger itself carries — pre-rename ledgers say `"redirect"`) and `ledger` the ledger's repo-relative path. `records` lists every ledger record (sorted by ledger key): each entry's `purl` is CANONICALIZED (qualifiers stripped, percent-decoded — e.g. `pkg:npm/@scope/pkg@1.0.0`, `pkg:gem/nokogiri@1.13.3`) to the same spelling `wiringLive` carries, so the records↔proof join is a plain string compare, and `ledgerKey` preserves the ledger's verbatim key (percent-encoded scoped names, `?platform=` qualifiers) for consumers addressing the ledger itself. `wiringLive` is the subset of this run's *counted* purls (post-`--ecosystems`-filter) whose hosted lockfile wiring the LIVE lock still proves — the same proof, computed once per run, that feeds `hosted_wiring_retained`, and the same liveness rule `vex` applies to a redirect-ledger record (see "Manifest-less VEX (lockfile discovery)"). Consumers must treat the split as exactly that: records are the ledger's word, `wiringLive` the live lock's proof — a record with no proof means the wiring was unwound, the lock is unreadable, or the purl was not crawled/queried this run (an `--ecosystems` filter, a zero discovery), never "still live". The key is omitted when the ledger is absent or its `records` are empty (an edits-only ledger asserts no patches), and error envelopes (the `--offline` refusal, all-batches-failed) are deliberately minimal and never carry it. A malformed ledger degrades to "nothing to consult" (no block) with a stderr warning, muted by `--silent`. Hosted-mode runs carry the `redirect` sub-object instead (the run's own result; the ledger is re-persisted mid-run), and vendored-mode runs carry the takeover warnings (their reconciliation may retire records mid-run) — neither duplicates a pre-run snapshot that could go stale.
+**Hosted-state visibility (`redirectState`, additive/MINOR).** Every non-hosted-mode, non-vendored-mode `scan --json` SUCCESS envelope (report-only, `--mode agent`/`--apply`/`--sync`, and the zero-discovery envelope) carries an additive top-level `redirectState` object whenever the project's lockfiles pin ≥ 1 hosted patch: `{ mode, records: [{purl, uuid}], wiringLive: [purl] }`. It is a descriptive STATE block, not a warning. `mode` is the constant `"hosted"`. **v5.0 (MAJOR shape change)**: hosted mode keeps no ledger, so `records` lists the hosted pins lockfile discovery finds (one per `(purl, uuid)`, the same discovery `vex` uses: a hosted URL counts only on `https://patch.socket.dev` or the `--patch-server-url` origin), and the v4 `ledger` and `records[].ledgerKey` keys are gone. Each record's `purl` is CANONICALIZED (qualifiers stripped, percent-decoded — e.g. `pkg:npm/@scope/pkg@1.0.0`, `pkg:gem/nokogiri@1.13.3`) to the same spelling `wiringLive` carries, so the join is a plain string compare. `wiringLive` is the subset of those pins among this run's *counted* purls (post-`--ecosystems`-filter) — computed once per run, the same set that feeds `hosted_wiring_retained`. A record missing from `wiringLive` is still wired; it just was not crawled/queried this run (an `--ecosystems` filter, a zero discovery). The key is omitted when no lockfile pins a hosted patch (and under `--global`), and error envelopes (the `--offline` refusal, all-batches-failed) are deliberately minimal and never carry it. A pre-v5 `.socket/vendor/redirect-state.json` is not read. Hosted-mode runs carry the `redirect` sub-object instead (the run's own result), and vendored-mode runs carry the takeover warnings (their takeovers may restore pins mid-run) — neither duplicates a pre-run snapshot that could go stale.
 
-**Agent-flow run-level warnings (additive).** An agent-mode apply (`--mode agent` / `--apply` / `--sync`, `--json`) may add a top-level `warnings[]` array of `{code, detail}` entries to the scan envelope (absent when none fired; each is also mirrored to stderr unless `--silent`). They surface cross-mode state the apply cannot change — never a status or exit-code change (hosted refusals set the precedent: exit 0 + warning). Codes (stable; new codes are additive/MINOR): `vendored_ownership_retained` — vendor-owned package(s) were skipped before download (the per-patch `skipped`/`vendored` records in `apply.patches[]` are unchanged); the detail names the purls and the migration path (`remove <purl>`, or `vendor --revert` which unwinds every vendored package, then re-run). `hosted_wiring_retained` — the hosted redirect ledger records scanned package(s) whose hosted lockfile wiring the live lock still proves (the agent run does not unwind hosted wiring — as of v5.0 that is `socket-patch rollback`'s job, or `remove <purl>` per package); the detail names the purls and the options (stay `--mode hosted`, or migrate via `scan --mode vendored`) and never advises hand-deleting the ledger. The warning keys on ledger *records* still live at scan time — a flow that pre-reverted the redirect (retiring the records) retires the warning with them, even while the append-only `edits` (revert originals) remain. The human path prints the same `hosted_wiring_retained` text to stderr after an apply; the vendored counterpart is already covered by its per-package `[skip] … (vendored …)` lines. `ownership_not_restored` (v5.0; `apply` and `rollback` `warnings[]` alike) — a file WAS patched (or restored) but its ownership could not be put back to the original uid/gid (the mode is still restored last); the detail is `<purl>: <path>: patched, but ownership could not be restored to uid N gid M: <error>` and the human line `Warning (ownership_not_restored): <detail>` (stderr, muted by `--silent`); never a status or exit change.
+**Agent-flow run-level warnings (additive).** An agent-mode apply (`--mode agent` / `--apply` / `--sync`, `--json`) may add a top-level `warnings[]` array of `{code, detail}` entries to the scan envelope (absent when none fired; each is also mirrored to stderr unless `--silent`). They surface cross-mode state the apply cannot change — never a status or exit-code change (hosted refusals set the precedent: exit 0 + warning). Codes (stable; new codes are additive/MINOR): `vendored_ownership_retained` — vendor-owned package(s) were skipped before download (the per-patch `skipped`/`vendored` records in `apply.patches[]` are unchanged); the detail names the purls and the migration path (`remove <purl>`, or `vendor --revert` which unwinds every vendored package, then re-run). `hosted_wiring_retained` — the lockfiles still pin scanned package(s) to a hosted patch (the agent run does not unwind hosted wiring — as of v5.0 that is `socket-patch rollback`'s job, which restores the upstream registry entries, or `remove <purl>` per package); the detail names the purls and the options (stay `--mode hosted`, migrate via `scan --mode vendored`, or `socket-patch rollback`). The warning keys on the hosted pins lockfile discovery finds at scan time, so a flow that restored the upstream entries retires it. The human path prints the same `hosted_wiring_retained` text to stderr after an apply; the vendored counterpart is already covered by its per-package `[skip] … (vendored …)` lines. `ownership_not_restored` (v5.0; `apply` and `rollback` `warnings[]` alike) — a file WAS patched (or restored) but its ownership could not be put back to the original uid/gid (the mode is still restored last); the detail is `<purl>: <path>: patched, but ownership could not be restored to uid N gid M: <error>` and the human line `Warning (ownership_not_restored): <detail>` (stderr, muted by `--silent`); never a status or exit change.
 
 `scan --prune` opts into garbage collection. When set, `scan` removes manifest entries for packages no longer present in the crawl, then deletes orphan blob, diff, and package-archive files from `.socket/`. Off by default (v3.0) so a temporary uninstall doesn't silently destroy manifest state. Only entries whose ecosystem this run actually crawled are eligible: a `pkg:<type>/` with no crawler in this build (a newer CLI's ecosystem in the committed manifest) is exempt — the crawl never looked for them, so their absence is not evidence of removal (same fail-safe as the `--ecosystems` filter, which narrows the query but never the prune's installed set). The pass also reconciles vendored state (runs FIRST, under ONE apply-lock acquisition shared with the manifest prune — lock contention skips the whole pass without failing the scan; `--lock-timeout` is honored and a lock I/O error is reported rather than swallowed; the existence gate — a manifest file OR a vendor ledger file, both cheap stats; an emptied ledger is deleted on save, so its presence is its content proxy — runs BEFORE the lock, so a bare project never gets a `.socket/`; in the vendored scan arms the pass runs AFTER the vendor step): (a) ledger entries still tracked by a manifest record (manifest-mode entries written by standalone `vendor`) whose patch is gone from the manifest are reverted — `detached` entries (every `scan`/`get --mode vendored` entry, v5.0) have no manifest record to lose and are exempt from this leg; (b) EVERY ledger entry whose dependency is no longer in the lockfile graph is reverted and any manifest entry it still had dropped (v5.0: the check is about the lockfile, not the manifest, so embedded-record entries are no longer exempt; a missing or undeterminable lockfile keeps the entry, fail-safe); and (c) orphan `.socket/vendor/<eco>/<uuid>` dirs with no ledger entry are swept. The prune never deletes a zero-patch `.socket/manifest.json` (its `{"patches": {}}` + `setup` block stay). The JSON `gc` sub-object gains `revertedVendoredEntries` + `keptVendoredEntries` + `failedVendoredEntries` + `removedVendorOrphanDirs` (wet) / `revertableVendoredEntries` + `vendorOrphanDirs` (preview), plus two ADDITIVE wet-only keys: `skipped: {code, message}` — present exactly when the pass was skipped at the lock (`lock_held` | `lock_io`; every count is then zero) — and `warnings: [{code, detail}]` — `vendor_state_write_failed` / `manifest_write_failed` (entries were reverted but the ledger or manifest rewrite failed) and `cleanup_failed` (an orphan sweep failed mid-way). Human mode prints `GC: skipped (<code>): <message>.`, one `GC: <detail>.` line per warning, and `GC: failed to revert N vendored entries: …` (singular for one) for `failedVendoredEntries`. `keptVendoredEntries` lists drift-kept entries the revert deliberately preserved (`vendor_artifact_kept` — undo the drift and re-run `vendor --revert` to finish); the preview cannot see drift (backends return before the wiring replay on dry runs), so `revertableVendoredEntries` may over-promise what a wet run will actually reclaim.
 
@@ -146,29 +146,29 @@ For a **9.0 root lock**, the CLI ensures `pnpm-workspace.yaml` carries `trustLoc
 
 **Vendored entries and the rest of the CLI.** Because nothing is in the manifest, vendored patches are invisible to `apply` (nothing to apply in place) but fully visible to `list` (listed from the ledger, labeled `Mode: vendored (recorded in .socket/vendor/state.json)` in human mode, exit 0 on a vendored-only project), `vex` (attested from the embedded records while a lockfile still wires the artifact — see "Manifest-less VEX"), `repair` (health-checked and rebuilt from the ledger), `scan --prune` (lockfile-driven reconcile) and `setup --check`'s patch-consistency property (consulted from the embedded records). They are exempt from standalone `vendor`'s manifest reconcile (`reconcile_dropped` never touches `detached` entries) and exit via `remove <purl>` (which reverts them), `vendor --revert`, or `rollback`, whose vendored leg reverts every in-scope ledger entry (unscoped and identifier-scoped runs; path-scoped runs reach them only when an installed copy matches). The hidden `--detached` flag (`scan --vendor --detached`) names exactly this — the only — vendored posture and is accepted as a no-op for compatibility.
 
-`scan --mode hosted` (== `--redirect`) swaps the in-place apply for the registry-redirect pipeline: discover → resolve hosted-patch references (grant token + integrity + per-dep registry override) → rewrite ONLY the patched dependencies' lockfile / registry-config entries to point at the hosted packages. A dep counts as **redirected** only when its hosted-artifact URL (or per-dep registry index URL) actually landed in a project file — a granted reference whose rewriter found nothing to edit is neither recorded nor attested. Cargo and golang are confirmed only by their rewriter's own report (`confirmed_cargo_uuids` / `confirmed_golang_uuids`): a golang dep counts only when its go.mod `replace M V => patch.socket.dev/gopatch/<uuid> <sver>` and both go.sum lines are in place, never because the patch-server origin or leftover go.sum lines appear somewhere. A golang module that go.mod does not require and go.sum does not list at the patched version is outside the build graph and is refused with `redirect_golang_not_in_module_graph` (nothing written). Only the exact module `patch.socket.dev/gopatch/<canonical uuid>` is socket-owned; any other module path is refused with `redirect_golang_untrusted_module_path`. A vendored golang module is taken over like cargo and the npm family: its vendor wiring, committed copy and ledger entry are reverted first (`redirect_takeover_reverted_vendored`). Re-runs over already-rewritten output record zero new edits. **Lock (v5.0)**: the hosted engine acquires `<.socket>/apply.lock` around its first wet write (the takeover pre-reverts) — not on `--dry-run`, and not when the run would write nothing (zero redirects, all skipped) — so previews and no-op runs never create `.socket/` (and never quarantine: a `--dry-run` or a zero-grant wet run that finds a malformed `redirect-state.json` reports it as the hard error it is — exit 1, the repair-or-move-aside remedy — but moves nothing; only a run holding the lock moves it aside to `redirect-state.json.corrupt`); contention is `lock_held` and a lock-file I/O fault (a read-only project root, a file squatting on `.socket/`) is `lock_io` — both exit 1, refused BEFORE the redirect ledger is read or written, and rendered like every other lock holder: human `Error (<code>): <message>` on stderr (+ the `--lock-timeout` hint for a live holder); JSON keeps the hosted shape — top-level `status: "error"`, `errorCode: "lock_held" | "lock_io"`, a string `error`, and `redirect: {mode: "hosted"}` retained (NOT the vendored `error: {code, message}` object). **Takeover symlink pre-check (v5.0)**: a vendored→hosted takeover whose recorded wiring file is a symlink is refused up front with `redirect_symlinked_file_unsupported` — wet and `--dry-run` alike, before any revert — so "nothing was written" holds. **Human mode (v5.0)**: hosted `scan` prints the results table and update detection like the other modes, then rewrites without a prompt (scan never prompts); `--dry-run` previews through the engine, and a detail fetch that leaves nothing to redirect enters the engine as a no-op (`Redirected 0 packages; rewrote 0 files.`, no lock, no `.socket/`). The detail fetch prints the same progress counter and per-package `Warning: could not fetch details for …` lines as the agent arm. An EMPTY hosted discovery prints `No patches available for installed packages.` and exits 0 without entering the engine; a discovery whose every offer is paid-tier for an org without paid access prints the table's paid nudge, then `No downloadable patches (paid subscription required).`, and exits 0 without entering the engine (parity with the agent/vendored arms). A malformed redirect ledger on a human hosted run that returns before the engine (empty discovery, nothing downloadable, a detail-fetch failure) is surfaced there as the read-only `Warning: the redirect ledger … is malformed …` advisory (muted by `--silent`), never moved; the `--json` arm always enters the engine and hard-errors instead. JSON output gains a `redirect` sub-object: `{ mode: "hosted", redirected, rewrittenFiles, skipped, warnings, dryRun }` (`mode` is additive so consumers can dispatch without inferring it). Rewriter warnings carry stable `redirect_*` codes (e.g. `redirect_npm_no_lockfile`, `redirect_gradle_manual_snippet`, `redirect_golang_unsupported`); new codes are additive (MINOR). v5.0 additive codes: `redirect_composer_no_lockfile` / `redirect_gem_no_gemfile` (composer / gem: neither manifest nor lock present — once per run, after the intake gates), `redirect_maven_no_pom` (no `pom.xml` and no Gradle build), `redirect_nuget_lock_unparseable` (a present-but-corrupt `packages.lock.json` — warned once, nothing mutated; an absent lock still proceeds), `redirect_cargo_lock_pkg_ambiguous` (several same-name+version `[[package]]` blocks and none carries the index `source` — transactional skip). Also v5.0: a registry override of the wrong kind (or none at all) warns the arm's missing-override code for nuget/gem/golang, and the ledger's `redirect_nuget_source` edit records `action: "added"` when `nuget.config` was authored from scratch (`rewritten` otherwise). Refusals stay fail-closed with a diagnosis that names the actual cause: a yarn-berry lock entry resolving through a non-`npm:` protocol keeps `redirect_yarn_berry_unsupported_protocol` with the entry's ACTUAL protocol in the detail — except socket-patch's OWN vendored wiring (a `file:` range into `.socket/vendor/`), which gets the distinct `redirect_yarn_berry_vendored_entry` code whose detail names the retirement path (`remove <purl>` per package, or `vendor --revert` which unwinds every vendored package, then re-run `scan --mode hosted`). Both leave the entry byte-identical; neither changes exit code or status. **yarn berry line endings (v5.0)**: yarn writes a NEW `yarn.lock` with the OS line ending (`os.EOL` — CRLF on Windows) and keeps an existing lock's majority ending on every later write, and a `core.autocrlf` checkout turns an LF lock CRLF on any OS — so a uniformly CRLF lock is rewritten in its own ending: every untouched byte (a leading BOM included) round-trips, and the `redirect_yarn_berry_entry` ledger edits record the lock's ON-DISK (CRLF) fragments, which the reverts match byte-exactly. A lock that MIXES CRLF and LF (or holds a bare CR) has no single ending to keep — yarn's own `--immutable` check rejects it too (YN0028) — so it is refused untouched with `redirect_yarn_berry_mixed_line_endings` (the detail names `yarn install`, which normalizes it). This replaces v4's `redirect_yarn_berry_crlf_unsupported`, which refused every CRLF lock and is no longer emitted. A vendored→hosted takeover runs these berry gates (mixed line endings, unsupported `cacheKey`, a non-zero `.yarnrc.yml` `compressionLevel`) BEFORE reverting a vendored berry purl — wet and `--dry-run` alike — so a refused purl keeps its vendored wiring, ledger entry and artifact byte-identical and is skipped with the gate's code (never announced as `redirect_takeover_reverted_vendored` and then left unpatched in both modes).
+`scan --mode hosted` (== `--redirect`) swaps the in-place apply for the registry-redirect pipeline: discover → resolve hosted-patch references (grant token + integrity + per-dep registry override) → rewrite ONLY the patched dependencies' lockfile / registry-config entries to point at the hosted packages. A dep counts as **redirected** only when its hosted-artifact URL (or per-dep registry index URL) actually landed in a project file — a granted reference whose rewriter found nothing to edit is neither counted nor attested. **No ledger (v5.0)**: hosted mode writes ONLY the lockfile / registry-config edits — `.socket/vendor/redirect-state.json` is never written (on success or failure), and a pre-v5 one on disk is ignored (never read for planning, never quarantined, left byte-identical). The lockfiles are the only record of a hosted patch: `list`, `vex`, `rollback`, `remove`, `vendor` and `repair` all discover the hosted pins from them (a hosted URL counts only on `https://patch.socket.dev` or the `--patch-server-url` / `SOCKET_PATCH_SERVER_URL` origin), and commit-ready output is just the lockfile / config changes. Cargo and golang are confirmed only by their rewriter's own report (`confirmed_cargo_uuids` / `confirmed_golang_uuids`): a golang dep counts only when its go.mod `replace M V => patch.socket.dev/gopatch/<uuid> <sver>` and both go.sum lines are in place, never because the patch-server origin or leftover go.sum lines appear somewhere. A golang module that go.mod does not require and go.sum does not list at the patched version is outside the build graph and is refused with `redirect_golang_not_in_module_graph` (nothing written). Only the exact module `patch.socket.dev/gopatch/<canonical uuid>` is socket-owned; any other module path is refused with `redirect_golang_untrusted_module_path`. A vendored golang module is taken over like cargo and the npm family: its vendor wiring, committed copy and ledger entry are reverted first (`redirect_takeover_reverted_vendored`). Re-runs over already-rewritten output plan from the current lock text and are idempotent (exit 0, lock unchanged). **Lock (v5.0)**: the hosted engine acquires `<.socket>/apply.lock` around its first wet write (the takeover pre-reverts) — not on `--dry-run`, and not when the run would write nothing (zero redirects, all skipped) — so previews and no-op runs never create `.socket/`; contention is `lock_held` and a lock-file I/O fault (a read-only project root, a file squatting on `.socket/`) is `lock_io` — both exit 1, refused BEFORE any project file is written, and rendered like every other lock holder: human `Error (<code>): <message>` on stderr (+ the `--lock-timeout` hint for a live holder); JSON keeps the hosted shape — top-level `status: "error"`, `errorCode: "lock_held" | "lock_io"`, a string `error`, and `redirect: {mode: "hosted"}` retained (NOT the vendored `error: {code, message}` object). **Takeover symlink pre-check (v5.0)**: a vendored→hosted takeover whose recorded wiring file is a symlink is refused up front with `redirect_symlinked_file_unsupported` — wet and `--dry-run` alike, before any revert — so "nothing was written" holds. **Human mode (v5.0)**: hosted `scan` prints the results table and update detection like the other modes, then rewrites without a prompt (scan never prompts); `--dry-run` previews through the engine, and a detail fetch that leaves nothing to redirect enters the engine as a no-op (`Redirected 0 packages; rewrote 0 files.`, no lock, no `.socket/`). The detail fetch prints the same progress counter and per-package `Warning: could not fetch details for …` lines as the agent arm. An EMPTY hosted discovery prints `No patches available for installed packages.` and exits 0 without entering the engine; a discovery whose every offer is paid-tier for an org without paid access prints the table's paid nudge, then `No downloadable patches (paid subscription required).`, and exits 0 without entering the engine (parity with the agent/vendored arms). JSON output gains a `redirect` sub-object: `{ mode: "hosted", redirected, rewrittenFiles, skipped, warnings, dryRun }` (`mode` is additive so consumers can dispatch without inferring it). Rewriter warnings carry stable `redirect_*` codes (e.g. `redirect_npm_no_lockfile`, `redirect_gradle_manual_snippet`, `redirect_golang_unsupported`); new codes are additive (MINOR). v5.0 additive codes: `redirect_composer_no_lockfile` / `redirect_gem_no_gemfile` (composer / gem: neither manifest nor lock present — once per run, after the intake gates), `redirect_maven_no_pom` (no `pom.xml` and no Gradle build), `redirect_nuget_lock_unparseable` (a present-but-corrupt `packages.lock.json` — warned once, nothing mutated; an absent lock still proceeds), `redirect_cargo_lock_pkg_ambiguous` (several same-name+version `[[package]]` blocks and none carries the index `source` — transactional skip). Also v5.0: a registry override of the wrong kind (or none at all) warns the arm's missing-override code for nuget/gem/golang. Refusals stay fail-closed with a diagnosis that names the actual cause: a yarn-berry lock entry resolving through a non-`npm:` protocol keeps `redirect_yarn_berry_unsupported_protocol` with the entry's ACTUAL protocol in the detail — except socket-patch's OWN vendored wiring (a `file:` range into `.socket/vendor/`), which gets the distinct `redirect_yarn_berry_vendored_entry` code whose detail names the retirement path (`remove <purl>` per package, or `vendor --revert` which unwinds every vendored package, then re-run `scan --mode hosted`). Both leave the entry byte-identical; neither changes exit code or status. **yarn berry line endings (v5.0)**: yarn writes a NEW `yarn.lock` with the OS line ending (`os.EOL` — CRLF on Windows) and keeps an existing lock's majority ending on every later write, and a `core.autocrlf` checkout turns an LF lock CRLF on any OS — so a uniformly CRLF lock is rewritten in its own ending: every untouched byte (a leading BOM included) round-trips (and `rollback`'s upstream restore keeps the lock's own ending). A lock that MIXES CRLF and LF (or holds a bare CR) has no single ending to keep — yarn's own `--immutable` check rejects it too (YN0028) — so it is refused untouched with `redirect_yarn_berry_mixed_line_endings` (the detail names `yarn install`, which normalizes it). This replaces v4's `redirect_yarn_berry_crlf_unsupported`, which refused every CRLF lock and is no longer emitted. A vendored→hosted takeover runs these berry gates (mixed line endings, unsupported `cacheKey`, a non-zero `.yarnrc.yml` `compressionLevel`) BEFORE reverting a vendored berry purl — wet and `--dry-run` alike — so a refused purl keeps its vendored wiring, ledger entry and artifact byte-identical and is skipped with the gate's code (never announced as `redirect_takeover_reverted_vendored` and then left unpatched in both modes).
 
 The rewriter reads a fixed set of candidate files from the project root: the npm-family locks (`package-lock.json`, `npm-shrinkwrap.json`, `pnpm-lock.yaml`, `shrinkwrap.yaml`, `yarn.lock`, plus `.yarnrc.yml` for the berry cache-config gate, `bun.lock` / `bun.lockb`, and `vlt-lock.json` with `vlt.json` and `node_modules/.vlt-lock.json` read only), `requirements.txt` / `uv.lock` / `Pipfile.lock` (pipfile-spec 6; see the Pipenv section below) / `poetry.lock` (every Poetry lock generation from 1.0 on — the 0.12 `[metadata.hashes]` layout is refused because that installer ignores URL sources; a Poetry < 1.4 writer additionally gets `redirect_poetry_stale_install_risk`, see `docs/testing/poetry-compatibility.md`) / `pdm.lock` (PDM lock formats `2` and `4.3`–`4.5.1`; the identity-losing `3.1` / `4.0`–`4.2` formats and unknown future formats are refused with `redirect_pdm_refused`, and a lock-format-`2` writer additionally gets `redirect_pdm_legacy_sync_required`, see `docs/testing/pdm-compatibility.md`; when `uv.lock` or `poetry.lock` sits beside it they drive and `pdm.lock` is left alone), `Cargo.toml` / `Cargo.lock` / `.cargo/config.toml` (plus the legacy extensionless `.cargo/config` — cargo reads that spelling in preference when both exist, so the managed `[registries.…]` block is written into whichever one is present; **cargo also reads every workspace-member manifest** — the `[workspace] members` globs minus `exclude` — and every in-root path-dependency manifest, recursively, reached without crossing a symbolic link and never under `.socket/`, and pins the crate in each one that declares it, so those `<dir>/Cargo.toml` files can appear in `rewrittenFiles`. A crate is redirected only when every declaration pins and every other `Cargo.lock` package depending on it is a planned member: one a registry or git crate — or a path package outside the root or behind a link — also depends on is refused `redirect_cargo_transitive_dependents` (a pin reaches only the declarations it sits on), a crate no manifest declares keeps `redirect_cargo_toml_dep_not_found` with a transitive-only detail naming `--mode vendored`, a crate every declaration of which requires another version (no requirement accepts the patched version) is refused `redirect_cargo_toml_dep_unrewritable`, and so is a requirement that also matches another locked version of the crate — each a transactional skip, never recorded or attested. With NO `Cargo.lock` there is no resolved graph to ask, so the dependents question is answered from the manifests instead: a crate declared beside any other dependency — anything but a path dependency on a manifest this run also pins, or a `workspace = true` inheritor of a table it scans — or beside a workspace member this run did not read (a `members` glob, or a member outside the project or behind a symbolic link, which member discovery drops) is refused `redirect_cargo_lockless_dependents`, whose detail names the remedies (commit a lockfile, or `--mode vendored`); a project whose only dependency is the patched crate has nothing that could pull it in and still redirects. All-CRLF manifests, locks and configs are rewritten with CRLF kept (mixed endings keep refusing where the grammar does not match), and `remove` / rollback match the recorded fragments across a later CRLF↔LF checkout conversion), `composer.lock`, `nuget.config` / `packages.lock.json`, `Gemfile` / `Gemfile.lock`, `pom.xml` (+ `.mvn/maven.config` / `.mvn/checksums/checksums.sha256` for maven Trusted Checksums merge, and the Gradle build scripts read only to trigger the manual-snippet warning). **npm-family flavor coverage**: package-lock / npm-shrinkwrap, pnpm (root OR any nested `*/pnpm-lock.yaml`), yarn classic, **yarn berry** (`yarn.lock` entry only — `resolution: ::__archiveUrl=` + `yarnBerry10c0` checksum; cacheKey `10c0` and `.yarnrc.yml compressionLevel 0` gated by `redirect_yarn_berry_cache_unsupported`), and **bun** (text `bun.lock` lockfileVersion 0, 1 or 2 — 0 is the `--save-text-lockfile` opt-in lock of Bun 1.1.39–1.1.45, 1 the 1.2–1.3 default, 2 the 1.4+ default; all three emit one `packages` grammar, so the registry 4-tuple → URL 3-tuple rewrite is version-independent and the lock's own version line is kept. Any other or missing version, or a `packages` section outside bun's single-line grammar, is refused `redirect_bun_lock_unsupported` — the detail is the shared version gate's text (a newer version: update socket-patch, re-locking would reproduce it; no integer: re-lock with Bun ≥ 1.2), identical to the vendored refusal. A version-0 lock holding `workspace:` packages is refused `redirect_bun_workspace_unsupported` (its 2-tuple workspace grammar cannot keep the hosted tuple through a frozen install); the remedy is to delete `bun.lock` and re-run `bun install` with Bun ≥ 1.2, which writes lockfileVersion 1 (accepted). A plain in-place `bun install` bumps the version only when a workspace depends on another workspace (e.g. root → member — the shape the matrix measured); otherwise Bun 1.2.0 keeps version 0 and Bun 1.2.23+ fail to resolve, so the in-place bump is not the documented remedy. Bun lock version, grammar and workspace compatibility are checked before a vendored takeover, including during dry-run: these refusals preserve the existing lock, artifact and vendor ledger. Version-1 and version-2 workspace locks are rewritten, nested versions included. A granted dep with no rewritable entry warns `redirect_bun_entry_not_found`, a grant without a sha512 `redirect_bun_missing_sha512`; a CRLF lock keeps `\r\n` on the rewritten line, and a hosted URL left by an earlier grant of the same `name@version` is re-pinned in place. **Digest-less re-saves (Bun 1.1.39–1.3.9)**: every text-lock Bun below 1.3.10 re-saves a URL tuple WITHOUT its `sha512` whenever the lock is re-saved for another reason (`bun add`, `bun install` after a package.json or workspace change), leaving the 2-tuple `["name@<url>", {meta}]` — the spec Bun installs from is intact. The CLI treats that spelling as its own wiring: a repeat hosted run counts the dep as redirected (no `redirect_bun_entry_not_found`) and HEALS the line back to the 3-tuple with the current `sha512`, recording the heal as a further `redirect_bun_lock_package` edit whose `original` is the 2-tuple (a stale URL is re-pinned from either spelling); `rollback`, scoped `rollback <purl>` / `remove <purl>` and the vendored takeover accept the digest-less spelling of a recorded `new` line (same key, spec and meta, only the trailing `"sha512-…"` missing) and restore the recorded original over it, so the chain always unwinds to the pristine registry line. Anything else — another uuid/token, another version, a re-laid meta object — is still drift. **Native `bun.lockb`**: when no text `bun.lock` exists, binary format versions 1, 2 and 3 are read and rewritten directly. Socket Patch does not invoke Bun or convert the project to a text lockfile. Exact matching package records are rewritten to hosted tarballs with the granted integrity, preserving dependency resolution IDs, workspace/dependency topology and unrelated package metadata; binary pointers and the package metadata hash are updated. Per-package `redirect_bun_lockb_package` snapshots support scoped rollback, repeat runs, superseding grants and hosted ↔ vendored takeover. A regular binary lock is discoverable even with no Bun runtime or `node_modules`; a dry run previews the same binary edits without writing them. A malformed, unreadable, unsupported or unverified binary structure is `redirect_bun_lockb_invalid` (exit 0, `redirected: 0`), and it refuses the npm rewrite before any takeover or sibling npm-family lock mutation. A symlinked binary write target is `redirect_symlinked_file_unsupported` (exit 1, including dry-run). `bun.lock` wins when both spellings exist. Binary-only projects do not receive `redirect_npm_no_lockfile`. Measured boundaries and the real-Bun matrix: `docs/testing/bun-compatibility.md`), and **vlt** (`vlt-lock.json` without `lockfileVersion`, `0` or `1`; see the vlt hosted-mode contract below). **Rush monorepos**: when `rush.json` is present the rewriter also reads `common/config/rush/pnpm-lock.yaml` and each `common/config/subspaces/<name>/pnpm-lock.yaml` (sorted for determinism) under their repo-relative keys and repoints them in place; editing them emits `redirect_rush_repo_state_stale` when `common/config/rush/repo-state.json` exists (the `pnpmShrinkwrapHash` desync is refreshed by `rush update`, which the redirect survives). **maven** is fail-closed via version suffixing: a `mavenSuffixedVersion` + `mavenPomSha256` override pins the Socket-only `<version>-socket.<hex8>` by rewriting the literal `<version>` (`redirect_maven_dep_version`) or adding a `<dependencyManagement>` entry (`redirect_maven_dep_management_added`), plus optional Trusted Checksums (`redirect_maven_trusted_checksums`, conflicts as `redirect_maven_trusted_checksums_conflict`); a `${property}` version is refused (`redirect_maven_dep_unpinned`), a non-matching literal skipped (`redirect_maven_dep_version_mismatch`), and an override without a suffixed version falls back to same-GAV repository injection (`redirect_maven_same_gav_fallback`, NOT fail-closed).
 
-**Gem stale-install guard (additive warning — the canonical narrative; other mentions point here)**: the gem hosted rewrite is pure Gemfile/lock text, so a gem ALREADY materialized under the project's bundle paths keeps its upstream bytes — the next `bundle install` prints `Using <gem>` and never refetches, on **every** bundler major (live-verified 2026-08-19 on 1.17.3 / 2.7.2 / 4.0.18: bundler 4's CHECKSUMS verify at download time only, and nothing is downloaded; `bundle install --force`/`--redownload` re-install from the stale cached `.gem` instead of re-fetching — bundler 1 silently, bundler 4 with an exit-37 checksum refusal that still leaves the upstream bytes installed; the **verified** remedy is removing the installed dir + cache `.gem` + `specifications` entry, then `bundle install`). After the rewrite, a hosted run therefore probes the installed-gem discovery paths (the same ruby-crawler discovery `apply` uses, honoring `--global`/`--global-prefix` like scan's own discovery) for each confirmed gem redirect and judges the materialization against the patch record's `afterHash` file map. Judgment rules: records are found **by uuid** — this run's fetched records first, then the redirect ledger's persisted ones, so a transiently failed `/patches/view` fetch cannot retire the warning (it re-fires on every re-scan until the stale materialization is gone); a materialization with every file at `afterHash` is already patched and never warns (an agent→hosted migration stays quiet by construction), and when several confirmed variant purls resolve to one installed dir, ANY of them judging it patched keeps it quiet; staleness needs **positive evidence** — at least one record file whose bytes were actually read and hash to neither state's expectation — so missing or unreadable files never produce a warning. Warnings emit `redirect_gem_stale_install` (JSON `redirect.warnings[]` + a code-tagged stderr line) in three flavors: a PROJECT-LOCAL dir gets the verified delete-list remedy (installed dir, cache `.gem`, `specifications` entry — plus the project's committed `vendor/cache/<leaf>.gem` when present and not proven to be the patched artifact, since bundler installs from `vendor/cache` in preference to fetching); a SHARED gem-env home gets a caveat that the home is shared machine-wide and prefers migrating the project to a local bundle path over deleting shared files; and a committed `vendor/cache` archive whose sha256 differs from the patched artifact's warns standalone even with no installed dir at all (a fresh checkout with a committed stale cache re-materializes the upstream bytes forever). A stale-flagged purl is additionally **excluded from the same run's `--vex` `assume_applied` set** — the envelope must never attest a CVE its own warning says is live; the purl falls back to normal installed-tree verification (a patched install still attests, a stale one is omitted). The probe is read-only (nothing is deleted) and skipped on `--dry-run` — deliberately explicit, since nothing was rewritten but the ledger fallback could otherwise judge an already-redirected project. Exit code and `status` are unchanged (warning-only, the hosted-refusal posture); a same-run `--vex` may still fail on "nothing to attest" per the embedded-VEX contract.
+**Gem stale-install guard (additive warning — the canonical narrative; other mentions point here)**: the gem hosted rewrite is pure Gemfile/lock text, so a gem ALREADY materialized under the project's bundle paths keeps its upstream bytes — the next `bundle install` prints `Using <gem>` and never refetches, on **every** bundler major (live-verified 2026-08-19 on 1.17.3 / 2.7.2 / 4.0.18: bundler 4's CHECKSUMS verify at download time only, and nothing is downloaded; `bundle install --force`/`--redownload` re-install from the stale cached `.gem` instead of re-fetching — bundler 1 silently, bundler 4 with an exit-37 checksum refusal that still leaves the upstream bytes installed; the **verified** remedy is removing the installed dir + cache `.gem` + `specifications` entry, then `bundle install`). After the rewrite, a hosted run therefore probes the installed-gem discovery paths (the same ruby-crawler discovery `apply` uses, honoring `--global`/`--global-prefix` like scan's own discovery) for each confirmed gem redirect and judges the materialization against the patch record's `afterHash` file map. Judgment rules: records are found **by uuid** among this run's fetched records (v5.0: hosted mode persists no records, so a purl whose `/patches/view` fetch failed this run is not judged; the warning re-fires on every re-scan whose fetch succeeds, until the stale materialization is gone); a materialization with every file at `afterHash` is already patched and never warns (an agent→hosted migration stays quiet by construction), and when several confirmed variant purls resolve to one installed dir, ANY of them judging it patched keeps it quiet; staleness needs **positive evidence** — at least one record file whose bytes were actually read and hash to neither state's expectation — so missing or unreadable files never produce a warning. Warnings emit `redirect_gem_stale_install` (JSON `redirect.warnings[]` + a code-tagged stderr line) in three flavors: a PROJECT-LOCAL dir gets the verified delete-list remedy (installed dir, cache `.gem`, `specifications` entry — plus the project's committed `vendor/cache/<leaf>.gem` when present and not proven to be the patched artifact, since bundler installs from `vendor/cache` in preference to fetching); a SHARED gem-env home gets a caveat that the home is shared machine-wide and prefers migrating the project to a local bundle path over deleting shared files; and a committed `vendor/cache` archive whose sha256 differs from the patched artifact's warns standalone even with no installed dir at all (a fresh checkout with a committed stale cache re-materializes the upstream bytes forever). A stale-flagged purl is additionally **excluded from the same run's `--vex` `assume_applied` set** — the envelope must never attest a CVE its own warning says is live; the purl falls back to normal installed-tree verification (a patched install still attests, a stale one is omitted). The probe is read-only (nothing is deleted) and skipped on `--dry-run` — deliberately explicit, since nothing was rewritten. Exit code and `status` are unchanged (warning-only, the hosted-refusal posture); a same-run `--vex` may still fail on "nothing to attest" per the embedded-VEX contract.
 
-**Pipenv hosted redirect (`Pipfile.lock`, pipfile-spec 6)**: every category other than `_meta` (`default`, `develop`, and Pipenv 2022+ named categories) that pins the package at the patched version is rewritten to the hosted reference — `{"file" | "path": "<artifact url>#sha256=<hex>", "hashes": ["sha256:<hex>"]}` with `markers`/`extras` preserved and `version`/`index` dropped; `_meta` (the Pipfile content hash) and the Pipfile itself are never touched, so `pipenv install --deploy`/`sync`/`verify` keep passing. The reference KEY depends on the installing Pipenv: releases 7–11 only install `path` references, 2018 and later `file` ones (0–6 write pipfile-spec < 6 and are refused). The release is probed once per command with `pipenv --version`, resolved on ABSOLUTE `PATH` entries only (a relative entry would run a `pipenv` planted in the scanned repository; `.bat`/`.cmd` shims are found through `PATHEXT` on Windows), only when a pypi patch actually targets an entry of the lock, and `SOCKET_PIPENV_MAJOR=<major>` pins the answer without spawning anything. An unknown installer selects `file` and warns `redirect_pipenv_installer_unknown` only when the lock was rewritten. **Refusal scope**: a pin/source CONFLICT (another version pinned, a foreign `file`/`path` source, a VCS/editable dependency) refuses the whole dependency atomically across categories as `redirect_pipenv_refused` AND vetoes the sibling Python rewriters (requirements.txt / uv.lock / pyproject) for that patch — the project's Pipenv install could not pick the patch up, so a half-redirected checkout is refused; anything else (no entry for the package, an old pipfile-spec, an unparseable lock, a digest-less patch) is `redirect_pipenv_skipped` and leaves the siblings alone (a stale Pipfile.lock in a uv/Poetry/requirements project must not block them). The veto applies to a LIVE lock only: a `Pipfile.lock` with no `Pipfile` beside it is abandoned, so its conflict refuses that file but never the siblings. Hash enforcement at install time is split by era — the `#sha256=` URL fragment is what Pipenv 2023+ verifies, the `hashes` list what 2018–2022 verify, Pipenv 11 either — so both are load-bearing. **Pipenv stale-install guard**: Pipenv never reinstalls a release that is already present (`pipenv install`, `install --deploy` and `sync` all exit 0 and keep the installed bytes — measured on 11.10.4, 2018.11.26 and 2026.8.0, hosted and vendored), so after the rewrite the run probes the Python crawler's site-packages (VIRTUAL_ENV, `./.venv`, `./venv`, Pipenv's out-of-tree `WORKON_HOME` venv; `--global`/`--global-prefix` honoured) for each confirmed Pipfile.lock redirect with the same rules as the gem guard (records by uuid with the ledger fallback, PATCHED = `verify_patch_record` Ok, STALE needs positive evidence, read-only, skipped on `--dry-run`, stale purls excluded from the same-run `--vex` `assume_applied` set) and the Python stale-install guard (`redirect_pypi_stale_install`, see above) names the site-packages dir and the Pipenv-specific verified remedy: `pipenv run pip uninstall -y <pkg> && pipenv sync` (or `pipenv --rm && pipenv sync`) — NOT `pipenv uninstall`, which rewrites the Pipfile and re-locks the patch away. The vendored backend emits the twin `pypi_pipenv_stale_install` (`skipped` warning event). **Rollback**: `redirect_pipenv_entry` edits replay per entry, compared as parsed JSON (a whole-file CRLF/LF conversion or a Pipenv re-serialization that kept our reference and hashes is not drift; the original is spliced back in the live file's line ending); an entry a relock removed retires the edit; a relock (`pipenv lock`, `update`, `install <other>` before 2024) regenerates the entry to registry shape on every Pipenv major and is NOT drift — the edit retires and the user's fresh resolution stands (vendored twin: `vendor_lock_entry_relocked`); a foreign `file`/`path` reference still refuses the pypi group. A Pipfile names no project, so a same-run `--vex` on a Pipenv project needs `--vex-product` (or a git remote) to detect a product purl. **Discovery**: `Pipfile.lock` is part of the lockfile inventory (every category's `==` pins, with the lock's digest set as `Sha256AnyOf` integrity so a lock-only checkout can be vendored by fetching the pure wheel through PyPI's JSON API — only when `_meta.sources` name the public index; a private-index lock stays discovery-only and never reaches pypi.org), and Socket's own hosted / vendored references stay discoverable as the package they replace, so a re-scan of an already-redirected or already-vendored lock-only checkout re-confirms it (`--vex` attests, vendored reports `already_vendored`) instead of finding nothing.
+**Pipenv hosted redirect (`Pipfile.lock`, pipfile-spec 6)**: every category other than `_meta` (`default`, `develop`, and Pipenv 2022+ named categories) that pins the package at the patched version is rewritten to the hosted reference — `{"file" | "path": "<artifact url>#sha256=<hex>", "hashes": ["sha256:<hex>"]}` with `markers`/`extras`/`index` kept exactly as Pipenv wrote them (present or absent: whether Pipenv records `index` depends on its release, the Pipfile spelling and the locking environment, so only the entry itself knows) and `version` dropped; `_meta` (the Pipfile content hash) and the Pipfile itself are never touched, so `pipenv install --deploy`/`sync`/`verify` keep passing. The reference KEY depends on the installing Pipenv: releases 7–11 only install `path` references, 2018 and later `file` ones (0–6 write pipfile-spec < 6 and are refused). The release is probed once per command with `pipenv --version`, resolved on ABSOLUTE `PATH` entries only (a relative entry would run a `pipenv` planted in the scanned repository; `.bat`/`.cmd` shims are found through `PATHEXT` on Windows), only when a pypi patch actually targets an entry of the lock, and `SOCKET_PIPENV_MAJOR=<major>` pins the answer without spawning anything. An unknown installer selects `file` and warns `redirect_pipenv_installer_unknown` only when the lock was rewritten. **Refusal scope**: a pin/source CONFLICT (another version pinned, a foreign `file`/`path` source, a VCS/editable dependency) refuses the whole dependency atomically across categories as `redirect_pipenv_refused` AND vetoes the sibling Python rewriters (requirements.txt / uv.lock / pyproject) for that patch — the project's Pipenv install could not pick the patch up, so a half-redirected checkout is refused; anything else (no entry for the package, an old pipfile-spec, an unparseable lock, a digest-less patch) is `redirect_pipenv_skipped` and leaves the siblings alone (a stale Pipfile.lock in a uv/Poetry/requirements project must not block them). The veto applies to a LIVE lock only: a `Pipfile.lock` with no `Pipfile` beside it is abandoned, so its conflict refuses that file but never the siblings. Hash enforcement at install time is split by era — the `#sha256=` URL fragment is what Pipenv 2023+ verifies, the `hashes` list what 2018–2022 verify, Pipenv 11 either — so both are load-bearing. **Pipenv stale-install guard**: Pipenv never reinstalls a release that is already present (`pipenv install`, `install --deploy` and `sync` all exit 0 and keep the installed bytes — measured on 11.10.4, 2018.11.26 and 2026.8.0, hosted and vendored), so after the rewrite the run probes the Python crawler's site-packages (VIRTUAL_ENV, `./.venv`, `./venv`, Pipenv's out-of-tree `WORKON_HOME` venv; `--global`/`--global-prefix` honoured) for each confirmed Pipfile.lock redirect with the same rules as the gem guard (records by uuid from this run's fetch, PATCHED = `verify_patch_record` Ok, STALE needs positive evidence, read-only, skipped on `--dry-run`, stale purls excluded from the same-run `--vex` `assume_applied` set) and the Python stale-install guard (`redirect_pypi_stale_install`, see above) names the site-packages dir and the Pipenv-specific verified remedy: `pipenv run pip uninstall -y <pkg> && pipenv sync` (or `pipenv --rm && pipenv sync`) — NOT `pipenv uninstall`, which rewrites the Pipfile and re-locks the patch away. The vendored backend emits the twin `pypi_pipenv_stale_install` (`skipped` warning event). **Rollback** (v5.0, upstream restore): each hosted entry gets its registry shape back — `"version": "==<v>"`, the entry's own `index` carried back unchanged (refused unless it — and the Pipfile's explicit `index`, if any — names a PyPI source in `_meta.sources`), and every release file's sha256 from PyPI's JSON API (`SOCKET_PYPI_JSON_API`), sorted by filename as Pipenv records them; an entry that pins another version beside the hosted reference is refused with the `git checkout` remedy (see "Hosted unwind coverage"). A Pipfile names no project, so a same-run `--vex` on a Pipenv project needs `--vex-product` (or a git remote) to detect a product purl. **Discovery**: `Pipfile.lock` is part of the lockfile inventory (every category's `==` pins, with the lock's digest set as `Sha256AnyOf` integrity so a lock-only checkout can be vendored by fetching the pure wheel through PyPI's JSON API — only when `_meta.sources` name the public index; a private-index lock stays discovery-only and never reaches pypi.org), and Socket's own hosted / vendored references stay discoverable as the package they replace, so a re-scan of an already-redirected or already-vendored lock-only checkout re-confirms it (`--vex` attests, vendored reports `already_vendored`) instead of finding nothing.
 
-**Mode ledgers (contract surfaces).** Each committable mode persists its state at a stable repo-relative path; external tools (and the depscan backend's GitHub-app PR flows) read and write these files, so path + schema are part of the contract:
+**Mode ledgers (contract surfaces).** Vendored mode persists its state at a stable repo-relative path; external tools (and the depscan backend's GitHub-app PR flows) read and write it, so path + schema are part of the contract. Hosted mode (v5.0) persists nothing but its lockfile / config edits:
 
 * `.socket/vendor/state.json` — the **vendored**-mode ledger (see "Ownership, state, and reversal" below): wiring edits with verbatim pre-vendor originals, artifact fingerprints, and the embedded patch `record` — for every entry written by `scan`/`get --mode vendored` beside `detached: true` (the record is that entry's only source), and for standalone `vendor` fed by an agent-mode manifest as a fallback copy without `detached` (the manifest record stays authoritative while the manifest covers the entry, by ledger key or base purl; `vex`, `list` and `setup --check` fall back to the embedded copy when it does not, `repair` only with no manifest at all). Entries written before 5.0 by standalone `vendor` carry no `record`; readers tolerate its absence. **Schema version 2 (v5.0)**: the `new` of a whole-file wiring record (kinds `maven_pom_repository`, `nuget_config_source`, `python_lock_document`, `python_script_metadata`, `hatch_document`) of 1 KiB or more, when its `original` is a string, is stored as an edit of that same record's `original`: `{"snapshot": "<sha256 of the text>", "ops": [[start, len] | "inserted text", …]}` (the text is the ops concatenated in order: a `[start, len]` byte range copied from the `original`, a string inserted as is), and the ledger's `version` is `2`; the `original` stays a plain string, no other record kind is touched, and a ledger without such a record keeps the version-1 bytes. Both versions are read; a version-2 edit is rebuilt and checked against its hash (a mismatch, a missing `original`, an out-of-range copy, or any other `{"snapshot": …}` value is `vendor_state_unreadable`), so every consumer sees the same full texts as with an inline version-1 ledger. Records are self-contained, so an older socket-patch re-saving a version-2 ledger (it keeps `original` / `new` verbatim and drops unknown fields) loses nothing.
-* `.socket/vendor/redirect-state.json` — the **hosted**-mode ledger (`RedirectState` in `socket-patch-core/src/patch/redirect/state.rs`): `{ version, mode: "hosted", edits[], records{} }`. `edits` are recorded `FileEdit`s (append-only across re-runs — merge, never clobber: the pre-redirect originals a future revert needs live here; v5.0: a byte-identical re-save is skipped, which still satisfies the rule); `records` maps PURL → the full manifest `PatchRecord`, one of `vex`'s record sources for redirected patches with no manifest entry (a record attests only while a lockfile still wires its hosted patch — see "Manifest-less VEX" below). The `mode` string is opaque to the loader (pre-rename ledgers carrying `"redirect"` still load; a hosted re-run normalizes them to `"hosted"`). Written identically by this CLI and by the depscan backend's hosted PR flow (`github-patch-pr-hosted.ts`).
+* `.socket/vendor/redirect-state.json` — the **pre-v5 hosted**-mode ledger (`RedirectState` in `socket-patch-core/src/patch/redirect/state.rs`: `{ version, mode, edits[], records{} }`). **Retired in v5.0**: no command writes it, and `scan` / `get --mode hosted` ignore it. It is read for migration only — `list` and `vex` take a record from it for a hosted pin with the same purl and uuid (the lockfiles still decide what is hosted; its `edits` are never replayed), and a malformed one is only the `redirect_ledger_corrupt` warning there — and `rollback` / `remove` delete it once no lockfile pins a hosted patch any more (a `rollback` in a project whose ONLY state is this file removes it and exits 0, JSON `legacyRedirectLedgerRemoved: true`). A project scanned in hosted mode by v5 commits only its lockfile / config edits.
 
 **get --mode and installed narrowing (v3.6).** `get <identifier> --mode hosted|vendored` consumes the resolved patch(es) through the SAME engines as `scan --mode hosted|vendored`, so for the same selected (purl, uuid) set the on-disk result is identical by construction — the per-advisory selector for hosted/vendored (`get <id> --save-only` then `vendor` still works). **Agent mode (v5.0 lock + residue rules)**: the download phase runs under `<.socket>/apply.lock` and hands the guard to the nested apply, so download → manifest write → apply is one lock window (the nested apply never re-acquires and inherits every caller flag — `--lock-timeout` and `--verbose` included); a failed acquire is `{status: "error", errorCode: "lock_held" | "lock_io", error}` on get's legacy envelope, exit 1, before any fetch (a read-only `.socket/` fails here, naming the lock path). `.socket/` and `.socket/blobs/` are created only when a record is actually persisted — an all-skipped or all-failed run leaves no `.socket/` on a fresh project — and a same-uuid `get <uuid>` re-run rewrites neither the manifest nor the blobs. Semantics:
 
-* **Hosted** (`get GHSA-… --mode hosted`): resolves the advisory, then hands the selected (purl, uuid) pairs to scan's hosted engine — reference grants, cross-mode takeover pre-revert, lockfile rewrite, `redirect-state.json` ledger (merge-never-clobber), gem stale-install probe, warnings, confirmation rules (cargo via `confirmed_cargo_uuids`, golang via `confirmed_golang_uuids` only) all identical to `scan --mode hosted`, and (v5.0) under the same `apply.lock` acquisition — taken around the first wet write, never on `--dry-run` or when nothing would be written; a failed acquire folds as top-level `errorCode: "lock_held" | "lock_io"` + string `error` (exit 1), and `--dry-run` under a held lock still exits 0. **No manifest write, no blobs** — the ledger is the persistence. JSON: get's legacy envelope gains the same nested `redirect` sub-object as scan's (`{mode:"hosted", redirected, rewrittenFiles, skipped, warnings, dryRun}`); the top-level shape is `{status, found, patches:[<narrowing skips>], warnings?}` — `downloaded`/`applied` are absent (nothing is downloaded into `.socket/`). Exit codes follow scan's hosted semantics: skipped grants and rewriter warnings never flip the exit; infra errors (reference fetch, corrupt/unwritable ledger, file writes) exit 1. Human prompt: `Redirect N packages to the hosted patch server?` (singular for one; `--yes`/`--json`/non-TTY auto-accept as usual). This confirm is get's alone: `scan` never prompts.
+* **Hosted** (`get GHSA-… --mode hosted`): resolves the advisory, then hands the selected (purl, uuid) pairs to scan's hosted engine — reference grants, cross-mode takeover pre-revert, lockfile rewrite (no ledger, v5.0), gem stale-install probe, warnings, confirmation rules (cargo via `confirmed_cargo_uuids`, golang via `confirmed_golang_uuids` only) all identical to `scan --mode hosted`, and (v5.0) under the same `apply.lock` acquisition — taken around the first wet write, never on `--dry-run` or when nothing would be written; a failed acquire folds as top-level `errorCode: "lock_held" | "lock_io"` + string `error` (exit 1), and `--dry-run` under a held lock still exits 0. **No manifest write, no blobs, no ledger** — the lockfile edits are the persistence. JSON: get's legacy envelope gains the same nested `redirect` sub-object as scan's (`{mode:"hosted", redirected, rewrittenFiles, skipped, warnings, dryRun}`); the top-level shape is `{status, found, patches:[<narrowing skips>], warnings?}` — `downloaded`/`applied` are absent (nothing is downloaded into `.socket/`). Exit codes follow scan's hosted semantics: skipped grants and rewriter warnings never flip the exit; infra errors (reference fetch, file writes) exit 1. Human prompt: `Redirect N packages to the hosted patch server?` (singular for one; `--yes`/`--json`/non-TTY auto-accept as usual). This confirm is get's alone: `scan` never prompts.
 * **Vendored** (`get GHSA-… --mode vendored`): the download phase is scan's vendored posture — **manifest-free (v5.0)**: the selected records are fetched into memory (`download_patch_records`; blobs held in memory; nothing under `.socket/` is written; the nested apply never runs), then scan's vendor step runs under the apply lock over exactly the selected records, like `scan --mode vendored` (no whole-manifest scope and no `[note]` about other records — that blast radius is retired with the manifest; a legacy manifest record for a vendored purl is migrated out of `.socket/manifest.json` the same way scan does it). JSON: get's envelope takes the detached download envelope's shape — `{status, found, downloaded, skipped, failed, detached: true, patches: [{purl, uuid, action: "downloaded" | "skipped" | "failed", …}], warnings?}` (`applied` is absent; `detached: true` is pinned; a `downloaded` record for a purl the vendor ledger holds at another uuid carries the additive `oldUuid`, derived from the ledger — the human `[fetch]` line reads `<purl> (replacing <short uuid>)`) — and gains the nested `vendor` Envelope exactly like scan's `result["vendor"]`; a vendor-step error folds the partial envelope + `{status:"error", error:{code,message}}` in (a pre-failure takeover reconcile may have already mutated the ledger — its events must reach the consumer). Exit: download failures or vendor `has_errors` → `partial_failure`/1. Human prompt: `Download and vendor N patches?`; `--dry-run` prints `[dry-run] Would download and vendor N patches. No changes made.` on both identifier paths (uuid and search). Telemetry mirrors scan's vendored arms (`track_outcomes_for_vendor` / `track_patch_vendor_failed`). **Bun vendored preflight (additive)** — shared by `get --mode vendored` on both its paths and `scan --mode vendored`: before ANY patch download, and only when the selection holds a `pkg:npm/` purl, the download phase reads `bun.lock`/`bun.lockb` once (`preflight_vendor`) and, when the vendor backend would refuse the project — a malformed, unreadable or unsupported `bun.lockb` → `vendor_bun_lockb_invalid`; an unreadable `bun.lock` → `vendor_lockfile_missing`; a `lockfileVersion` other than 0/1/2 or a non-canonical `packages` grammar → `vendor_lockfile_version_unsupported`; `workspace:` packages in a lock below version 2 → `vendor_bun_workspace_unsupported` — every `pkg:npm/` result becomes `{action:"failed", errorCode:<code>, error:<detail>}` with NO fetch (the patch view is never requested) and no patch record; other ecosystems' results are untouched. **Search path** (`get <purl|advisory> --mode vendored`) and `scan --mode vendored`: the records ride `patches[]` / `download.patches[]` with `downloaded: 0`, the download phase writes nothing under `.socket/` (v5.0 — a pre-existing `.socket/manifest.json`, including a record seeded for another purl, is left byte-untouched), the vendor step still runs over the remaining records (no event for the refused purl), exit `partial_failure`/1. **uuid path** (`get <uuid> --mode vendored`): the uuid lookup is the only fetch; the run exits 1 BEFORE the vendor step with exactly `{status:"error", found:1, downloaded:0, skipped:0, failed:1, error:{code, message}, patches:[{purl, uuid, action:"failed", errorCode, error}]}` (the `error` OBJECT is the vendored-mode error shape of the vendor-step fold-in above) and writes nothing — no `.socket/` on a fresh project; human mode prints `Error (<code>): <detail>` on stderr. **Already-vendored exemption**: a purl is exempt from the workspace refusal only when every instance of its `name@version` in `bun.lock` is already a `.socket/vendor/npm/…` local tuple (any uuid; the digest-less 2-tuple counts) — the engine's own criterion — so in-sync re-runs, `repair`, and a superseding patch uuid on a project vendored before it grew a workspace member all flow to the engine (re-pinning an already-local tuple adds no workspace-relative exposure); a wiped ledger alone is not a refusal (the engine path decides). UUID equality in the ledger alone never exempts a purl: `rollback --preserve-state` retains its record after unwiring. Dry-run refusal takes priority over `already_vendored`. **Unreadable vendor ledger**: a `.socket/vendor/state.json` the preflight cannot read or parse is itself the refusal — `vendor_state_unreadable` with the io/parse detail, fail-closed (nothing is exempt) — on the uuid path, the search / `scan` path and the `--dry-run` preview alike; never a Bun lock code. **`--silent`** is "errors only" and never mutes the refusal: the code-tagged `[error] <purl> (<code>): <detail>` (per-patch paths) / `Error (<code>): …` (uuid path) line stays on stderr with an empty stdout. **`--dry-run`** previews the refusal as the additive `would_refuse` action (see `--dry-run` below). Agent-mode `get --save-only` is NOT preflighted (record-only intent has no consumption precondition). Pinned by `tests/in_process_vendor_bun.rs` (exact uuid-path envelope, seeded-manifest survival, `--silent`, `--dry-run`) and `tests/scan_vendor_e2e.rs`.
 
-**Lock-text refusals before the download (v5.0)** — shared by `get --mode vendored` on both its paths and `scan --mode vendored`, after the Bun preflight above and the ledger's `already vendored` skip: a `pkg:npm/` result in a **pnpm, yarn classic or yarn berry** project, or a `pkg:cargo/` result, that its vendor backend refuses on the project's lock and manifest text alone is refused BEFORE its patch view is fetched — the pnpm / classic / berry gates the backend runs before it reads the package (coordinates, the lock and manifest reads and their line-ending / version / `cacheKey` / `.yarnrc.yml` gates, override and `resolutions` conflicts, the lock entry present and rewritable) and cargo's `locked_version_mismatch` (only when it is the crate's FIRST refusal; an in-tree `cargo vendor` copy still refuses in the loop as `already_vendored_in_tree`). **Scope:** only a package the vendor loop would hand to its backend is refused early — one installed on disk (the loop's own qualified-aware resolver plus the npm identity lookup), or one the lockfile inventory resolves to a verifiable registry source (a lock entry with an integrity, or the ledger-recovered pre-vendor resolution — exactly the entry the pristine fetch would use). A package absent from the lock and not installed never reached its backend and is untouched: its view is fetched, it downloads, and the vendor loop skips it `skipped` / `package_not_installed` as in v4.x (so cargo's `locked_version_mismatch` is refused early only for a crate installed at the unlocked version). The result becomes `{action:"failed", errorCode:<code>, error:<detail>}` in `download.patches[]` / `patches[]` with the backend's exact code and detail, no view and no pristine fetch, no patch record, and therefore no vendor event: compared with v4.x, `download.downloaded` drops and `download.failed` rises by the number of such packages, `vendor.summary.failed` and `vendor.events` lose their `failed` events, and a lockfile-only package among them loses its `vendor_fetched_missing` event (it is never fetched). Exit code and top-level `status` are unchanged (`partial_failure`/1); the nested `vendor.status` becomes `success` when those refusals were the vendor step's only failures (observed on the depscan fixture: 3 refusals, `partialFailure` → `success`), and when every selected package is refused this way the human `scan --vendor` arm prints `Nothing was vendored: N patches failed (see above).`. **Precedence:** the lock-text refusal is decided before the view, so it wins over every view-derived outcome — a package that would also have been a paid-access 403 (`[PAID]`/no access), a failed view fetch, or a no-applicable-files skip reports the lock refusal instead (the Bun refusal and the ledger's `already vendored` skip still come first). The human `[error] <purl> (<code>): <detail>` line is printed during the download instead of the vendor step's failure line (the human (non-`--silent`) `scan --vendor` arm's baseline pre-check still fetches the views it verifies; only the download, the pristine fetch and the vendor step skip the package there). A purl the hosted redirect ledger claims keeps the loop's refusal (its takeover revert rewrites the lock the gates read), as does every purl when that ledger is malformed; other flavors (package-lock, pnpm-legacy, bun) and ecosystems are untouched, and `--dry-run` is unchanged. `vendor` (manifest-driven, no view fetch) keeps its per-package `failed` events but no longer fetches the pristine source of a lockfile-only package it refuses this way — the source is deferred to the backend, which refuses before reading it (no `vendor_fetched_missing` event and no registry request; a refused package whose registry is unreachable reports the gate's code instead of `vendor_fetch_failed`); only a package the lock resolves to a verifiable source is deferred, and one it does not resolve keeps its `package_not_installed` skip. Pinned by `tests/scan_vendor_e2e.rs` (`exact_download_plan`: scan and exact-purl get, pnpm and cargo scope), `tests/e2e_yarn_legacy_cachekey_refusal_build.rs` and `tests/vendor_rerun_no_network_e2e.rs`.
+**Lock-text refusals before the download (v5.0)** — shared by `get --mode vendored` on both its paths and `scan --mode vendored`, after the Bun preflight above and the ledger's `already vendored` skip: a `pkg:npm/` result in a **pnpm, yarn classic or yarn berry** project, or a `pkg:cargo/` result, that its vendor backend refuses on the project's lock and manifest text alone is refused BEFORE its patch view is fetched — the pnpm / classic / berry gates the backend runs before it reads the package (coordinates, the lock and manifest reads and their line-ending / version / `cacheKey` / `.yarnrc.yml` gates, override and `resolutions` conflicts, the lock entry present and rewritable) and cargo's `locked_version_mismatch` (only when it is the crate's FIRST refusal; an in-tree `cargo vendor` copy still refuses in the loop as `already_vendored_in_tree`). **Scope:** only a package the vendor loop would hand to its backend is refused early — one installed on disk (the loop's own qualified-aware resolver plus the npm identity lookup), or one the lockfile inventory resolves to a verifiable registry source (a lock entry with an integrity, or the ledger-recovered pre-vendor resolution — exactly the entry the pristine fetch would use). A package absent from the lock and not installed never reached its backend and is untouched: its view is fetched, it downloads, and the vendor loop skips it `skipped` / `package_not_installed` as in v4.x (so cargo's `locked_version_mismatch` is refused early only for a crate installed at the unlocked version). The result becomes `{action:"failed", errorCode:<code>, error:<detail>}` in `download.patches[]` / `patches[]` with the backend's exact code and detail, no view and no pristine fetch, no patch record, and therefore no vendor event: compared with v4.x, `download.downloaded` drops and `download.failed` rises by the number of such packages, `vendor.summary.failed` and `vendor.events` lose their `failed` events, and a lockfile-only package among them loses its `vendor_fetched_missing` event (it is never fetched). Exit code and top-level `status` are unchanged (`partial_failure`/1); the nested `vendor.status` becomes `success` when those refusals were the vendor step's only failures (observed on the depscan fixture: 3 refusals, `partialFailure` → `success`), and when every selected package is refused this way the human `scan --vendor` arm prints `Nothing was vendored: N patches failed (see above).`. **Precedence:** the lock-text refusal is decided before the view, so it wins over every view-derived outcome — a package that would also have been a paid-access 403 (`[PAID]`/no access), a failed view fetch, or a no-applicable-files skip reports the lock refusal instead (the Bun refusal and the ledger's `already vendored` skip still come first). The human `[error] <purl> (<code>): <detail>` line is printed during the download instead of the vendor step's failure line (the human (non-`--silent`) `scan --vendor` arm's baseline pre-check still fetches the views it verifies; only the download, the pristine fetch and the vendor step skip the package there). A purl the lockfiles pin hosted keeps the loop's refusal (its takeover restore rewrites the lock the gates read); other flavors (package-lock, pnpm-legacy, bun) and ecosystems are untouched, and `--dry-run` is unchanged. `vendor` (manifest-driven, no view fetch) keeps its per-package `failed` events but no longer fetches the pristine source of a lockfile-only package it refuses this way — the source is deferred to the backend, which refuses before reading it (no `vendor_fetched_missing` event and no registry request; a refused package whose registry is unreachable reports the gate's code instead of `vendor_fetch_failed`); only a package the lock resolves to a verifiable source is deferred, and one it does not resolve keeps its `package_not_installed` skip. Pinned by `tests/scan_vendor_e2e.rs` (`exact_download_plan`: scan and exact-purl get, pnpm and cargo scope), `tests/e2e_yarn_legacy_cachekey_refusal_build.rs` and `tests/vendor_rerun_no_network_e2e.rs`.
 * **Installed-version narrowing** (all modes, `get`'s search path): a CVE/GHSA fan-out returns one patch record per patched VERSION; get keeps only versions present here and emits calm `skipped` records (`errorCode: "package_not_installed"`) for the rest — never an error exit. Presence = installed on disk (qualified-aware resolver) ∪ already tracked in the manifest (record maintenance keeps working on hosts without an installed copy); hosted/vendored modes additionally count lockfile-resolved deps and vendor-ledger purls (mirroring scan's discovery supplements, including their `--global` gate). **Exempt** (no narrowing): UUID identifiers, exact-versioned PURL identifiers (explicit intent), `--save-only` runs (record-only has no installation precondition — the fresh-clone record→vendor flow keeps working), `--all-releases`, and the package-name path (already installed-derived). When EVERY found patch is filtered out, get exits 0 with the additive status **`not_installed`** (`{status:"not_installed", found:N, downloaded:0, applied:0, patches:[<skip records>], warnings?}`) — never `no_match`, which remains pinned to the fuzzy package-name path. PnP layouts are surfaced, not misreported: yarn-PnP npm results skip with `errorCode: "yarn_pnp_unsupported"` in every mode; pnpm-PnP skips carry `pnpm_pnp_unsupported` in agent/vendored modes; hosted mode — the refusal's own remedy — keeps ONLY the versions the raw `pnpm-lock.yaml` text actually resolves (boundary-anchored probe over the v5/v6/v9 key spellings, so a large fan-out never requests grants for every version ever patched), labels a JUDGED miss `package_not_installed` exactly like a non-PnP project (the layout blocked nothing — the lock was read and the version isn't resolved), and reserves the layout code for an unreadable lock (no judgment possible). When EVERY narrowed-out result is a PnP refusal, the human terminal names the layout instead of claiming "not installed" and never advises `--all-releases` (which cannot make PnP patchable); the JSON status stays `not_installed` — consumers dispatch on the per-record `errorCode`. Hosted mode also runs the per-release VARIANT filter (`filter_to_installed_releases`) on its search path before requesting grants — agent/vendored runs get it inside the download engines — with the same keep-all-plus-warning fallbacks (surfaced as `(release_narrowing)`-prefixed strings in `warnings[]`). An ecosystem this binary has no crawler for is likewise never judged: its results are KEPT (absence from a crawl that never looked carries no information — the same fail-safe as scan's prune GC). The human `Found N patches:` listing shows only the patches whose package version survived the narrowing (the narrowing is judged over every result, so an installed package's paid fix a free user cannot download still lists as `[PAID] (no access)`, while skip records and counts cover only accessible patches), sorted by PURL in natural version order (`4.17.2` before `4.17.10`); the narrowed-out ones are summarized on stderr in one line per reason (`Skipped N patches for M package versions not installed here (use --all-releases to include them).`), and `--verbose` adds one `[skip] <purl> (<reason>)` line per skipped version after that summary, in natural version order. When the candidates hold more patches than were selected and the pick was made without a menu (a paid user's auto-pick, `--yes`, a non-TTY run), a `Selected:` block names the patch (purl, tier, short uuid, advisories) that will be installed before the prompt. Machine output (the prompt count, the JSON envelope) uses the kept set, unchanged. The finer per-release variant narrowing (`filter_to_installed_releases`) is unchanged and still runs inside the download engines (and before an agent-mode `--dry-run` preview, so the preview names only the variants a wet run would fetch).
 * **Deliberate divergences from scan** (documented, not drift): get keeps its `selection_required` JSON posture for free multi-patch PURLs (scan auto-picks); get has no `--vex` (an ambient `SOCKET_VEX` is ignored by get's modes), no `--detached` (moot — `get --mode vendored` is manifest-free by construction), no `--prune`; get does not run scan's pre-vendor baseline annotation; and an all-narrowed-out run exits `not_installed` without entering the vendor step (heal-after-wipe re-vendoring stays `scan --mode vendored`'s job). Agent-mode `get` honors `--dry-run` too (v5.0): the search and uuid paths classify each selected patch against the manifest (read-only; an unreadable manifest fails closed like the wet run) and stop before the prompt, the download, any `.socket/` write and the apply — human `[would-add]` / `[would-update] … (replacing <short uuid>)` / `[skip] … (already in manifest)` lines then `[dry-run] Would download and apply N patches. No changes made.`; JSON `{status:"success", dryRun:true, found, downloaded:0, skipped, applied:0, patches:[{purl, uuid, action:"would_add"|"would_update"(+oldUuid)|"skipped"}, <narrowing skip records>], warnings?}`, exit 0.
 
-`--dry-run` previews what `apply` / `rollback` / `scan --apply` / `repair` / `remove` — and `get` in every mode (hosted/vendored since v3.6, agent since v5.0) — would do without mutating disk. `get --mode hosted --dry-run` flows through the hosted engine's dry-run contract (no lock, no `.socket/`, no ledger write, no lockfile writes, `redirect.dryRun: true`); `get --mode vendored --dry-run` emits the same ledger-classification preview as scan's (`would_vendor` / `already_vendored` / `would_revendor`+`oldUuid` under the nested `vendor` key — plus, additive, `would_refuse` + `errorCode` + `error` for npm purls the wet run's Bun preflight would refuse: an in-sync `already_vendored` entry is exempt, as is a `would_revendor` entry whose `bun.lock` instances are all already local tuples; a purl the lock still resolves from the registry is refused like a fresh one, and the preview stays exit 0 / `status: "success"` with nothing written) before any download, and both skip the confirm prompt (nothing to confirm). In JSON mode, the envelope is populated with would-be actions and counts (`remove --dry-run` skips the confirmation prompt — there is nothing to confirm — and flips its would-be `Removed` events to `Verified` previews, so `summary.removed` stays "entries actually deleted"). `rollback --dry-run` (v5.0) previews every leg — the in-place restore verification, the vendored unwire (`Would revert/unwire vendoring for …`), the hosted unwind (the redirect engines resolve every inverse and drift check exactly like a wet run, flush nothing to disk, and claim the IN-MEMORY ledger clone exactly like a wet run — so the composed preview, per-purl reverts then whole-ledger replay, sees the same intermediate state a wet run would; the ON-DISK ledger is untouched), the manifest removals (simulated in memory), and the blob/archive GC — with no writes and no prompt.
+`--dry-run` previews what `apply` / `rollback` / `scan --apply` / `repair` / `remove` — and `get` in every mode (hosted/vendored since v3.6, agent since v5.0) — would do without mutating disk. `get --mode hosted --dry-run` flows through the hosted engine's dry-run contract (no lock, no `.socket/`, no lockfile writes, `redirect.dryRun: true`); `get --mode vendored --dry-run` emits the same ledger-classification preview as scan's (`would_vendor` / `already_vendored` / `would_revendor`+`oldUuid` under the nested `vendor` key — plus, additive, `would_refuse` + `errorCode` + `error` for npm purls the wet run's Bun preflight would refuse: an in-sync `already_vendored` entry is exempt, as is a `would_revendor` entry whose `bun.lock` instances are all already local tuples; a purl the lock still resolves from the registry is refused like a fresh one, and the preview stays exit 0 / `status: "success"` with nothing written) before any download, and both skip the confirm prompt (nothing to confirm). In JSON mode, the envelope is populated with would-be actions and counts (`remove --dry-run` skips the confirmation prompt — there is nothing to confirm — and flips its would-be `Removed` events to `Verified` previews, so `summary.removed` stays "entries actually deleted"). `rollback --dry-run` (v5.0) previews every leg — the in-place restore verification, the vendored unwire (`Would revert/unwire vendoring for …`), the hosted upstream restore (every pin is resolved exactly like a wet run — registry lookups included, so a pin the wet run would refuse is previewed as that refusal — and nothing is flushed to disk), the manifest removals (simulated in memory), and the blob/archive GC — with no writes and no prompt.
 
 The hidden alias `--no-apply` on `get --save-only` is **part of the contract** — it does not appear in `--help` but is widely used in existing scripts.
 
@@ -183,12 +183,12 @@ The hidden alias `--no-apply` on `get --save-only` is **part of the contract** 
 Contract details:
 
 * **Always written to the file** — never stdout — so the document never races the command's own `--json` output.
-* **Fail-the-command**: if `--vex` was requested but generation fails (product PURL undetectable, nothing to attest in the manifest / ledgers / lockfiles, all patches omitted, a corrupt ledger, unwritable path), the command exits non-zero **even when the apply/scan itself succeeded**. In `--json` mode the failure surfaces in the envelope's `error` (`apply`) / top-level `error` (`scan`), with a stable code (`product_undetected`, `no_applicable_patches`, `write_failed`, …).
-* **Built from the post-run state** — the manifest, both `.socket/vendor` ledgers and the project's lockfile references (see "Manifest-less VEX" below) — and verified against on-disk state (unless `--vex-no-verify`; the wiring gates apply either way). Generated for real applies and read-only `scan` alike; `--dry-run` skips generation on every host command (nothing was changed, and a preview must not write an attestation — `scan --json` marks it `vex: {skipped: true, reason: "dry_run"}`).
+* **Fail-the-command**: if `--vex` was requested but generation fails (product PURL undetectable, nothing to attest in the manifest / vendor ledger / lockfiles, all patches omitted, a corrupt vendor ledger, unwritable path), the command exits non-zero **even when the apply/scan itself succeeded**. In `--json` mode the failure surfaces in the envelope's `error` (`apply`) / top-level `error` (`scan`), with a stable code (`product_undetected`, `no_applicable_patches`, `write_failed`, …).
+* **Built from the post-run state** — the manifest, the `.socket/vendor/state.json` ledger and the project's lockfile references, with hosted records fetched from the API (see "Manifest-less VEX" below) — and verified against on-disk state (unless `--vex-no-verify`; the wiring gates apply either way). Generated for real applies and read-only `scan` alike; `--dry-run` skips generation on every host command (nothing was changed, and a preview must not write an attestation — `scan --json` marks it `vex: {skipped: true, reason: "dry_run"}`).
 * **JSON success surface**: `apply` adds a top-level `vex` object to its envelope; `scan` adds a top-level `vex` key to its result. Both carry `{ path, statements, format: "openvex-0.2.0" }`.
-* `apply`'s no-manifest early exit (the `noManifest` success no-op; v5.0: its human line is `No patch manifest found; nothing to apply.` — it names the missing `.socket/manifest.json`, not the folder, since `.socket/` may legitimately hold setup files or vendored state) and `vendor`'s (`No manifest found, nothing to vendor.`) still generate the document from the lockfiles and `.socket/vendor` ledgers (manifest-less VEX: hosted / vendored checkouts carry no manifest). Nothing referenced anywhere keeps the calm exit 0 (a stale document at the path is removed; `--json` carries any discovery diagnostics in `warnings[]`); any other VEX failure fails the command with exit 1 — including a run whose only candidates are omitted `record_unavailable` (an `--offline` run over a lockfile-wired checkout with no local records), so an ambient `SOCKET_VEX` there fails the install. `--dry-run` skips generation on both, and so does `apply --check` — it stays read-only and offline-safe, leaving the output path untouched. `scan` has no such early exit: with no manifest and nothing wired anywhere its `--vex` fails with `manifest_not_found`.
+* `apply`'s no-manifest early exit (the `noManifest` success no-op; v5.0: its human line is `No patch manifest found; nothing to apply.` — it names the missing `.socket/manifest.json`, not the folder, since `.socket/` may legitimately hold setup files or vendored state) and `vendor`'s (`No manifest found, nothing to vendor.` — a project with hosted pins ejects instead, v5.0) still generate the document from the lockfiles and the vendor ledger (manifest-less VEX: hosted / vendored checkouts carry no manifest). Nothing referenced anywhere keeps the calm exit 0 (a stale document at the path is removed; `--json` carries any discovery diagnostics in `warnings[]`); any other VEX failure fails the command with exit 1 — including a run whose only candidates are omitted `record_unavailable` (an `--offline` run over a lockfile-wired checkout with no local records), so an ambient `SOCKET_VEX` there fails the install. `--dry-run` skips generation on both, and so does `apply --check` — it stays read-only and offline-safe, leaving the output path untouched. `scan` has no such early exit: with no manifest and nothing wired anywhere its `--vex` fails with `manifest_not_found`.
 * **Stale-doc removal (v3.5)**: a run that ends in a VEX error removes a recognizably-OpenVEX file (JSON whose `@context` names openvex.dev) already sitting at the output path — a pipeline reusing one path can never ship yesterday's attestation for a now-unpatched tree. Unrelated files at the path are never touched; a mid-write partial that no longer parses as JSON is left for downstream parsers to reject loudly.
-* **Additive warnings (v3.5)**: `product_not_iri` (the `--product`/`--vex-product` override is neither a `pkg:` purl nor an absolute IRI; honored verbatim, warned) and `vendored_tree_out_of_sync` (a healthy vendored attestation stands on the committed artifact + lock wiring while the PRESENT installed tree hash-mismatches the patched bytes — run the package manager's install; the attestation itself is unchanged). Both ride stderr in human mode and `warnings[]` in the standalone `vex --json` envelope. Same channel for `product_multiple_manifests` (auto-detect found several project manifests and names the one it used), `vex_stale_doc_removed` (the stale-doc removal above happened), the manifest-less plan's advisories — `vex_wiring_conflict` (the lockfiles wire a package to different patches: which files, which uuids, how to fix it), `vex_record_superseded` (a recorded patch replaced by the lockfile-wired one), `vex_claim_unwired` (a ledger claim whose patch the lockfiles still mention, but not as wiring), `vex_record_offline` / `vex_record_not_found` / `vex_record_fetch_failed` (why a lockfile-wired patch has no record — the detail behind a `record_unavailable` skip) and `api_auth_fallback` (the authenticated API refused the credentials and the public proxy served free patches only; `get` / `scan`'s warning text) — and, standalone only, `org_looks_like_path` (`-o`/`--org` given a file-shaped value — `-O` is `--output`). The standalone error envelope carries `warnings[]` too. An embedded `--vex` that fails also folds each omitted patch into the host command's `warnings[]` as `vex_omitted` (`<purl>: <why> (<errorCode>)` — standalone `vex` lists them as `skipped` events), and `--silent` lists them as `omitted: <purl> (<errorCode>)` lines under the error. A corrupt `.socket/vendor/state.json` or `redirect-state.json` is no longer degraded with a warning: every form of vex fails with `vendor_ledger_corrupt` / `redirect_ledger_corrupt` (see the error-code table).
+* **Additive warnings (v3.5)**: `product_not_iri` (the `--product`/`--vex-product` override is neither a `pkg:` purl nor an absolute IRI; honored verbatim, warned) and `vendored_tree_out_of_sync` (a healthy vendored attestation stands on the committed artifact + lock wiring while the PRESENT installed tree hash-mismatches the patched bytes — run the package manager's install; the attestation itself is unchanged). Both ride stderr in human mode and `warnings[]` in the standalone `vex --json` envelope. Same channel for `product_multiple_manifests` (auto-detect found several project manifests and names the one it used), `vex_stale_doc_removed` (the stale-doc removal above happened), the manifest-less plan's advisories — `vex_wiring_conflict` (the lockfiles wire a package to different patches: which files, which uuids, how to fix it), `vex_record_superseded` (a recorded patch replaced by the lockfile-wired one), `vex_claim_unwired` (a ledger claim whose patch the lockfiles still mention, but not as wiring), `vex_record_offline` / `vex_record_not_found` / `vex_record_fetch_failed` (why a lockfile-wired patch has no record — the detail behind a `record_unavailable` skip) and `api_auth_fallback` (the authenticated API refused the credentials and the public proxy served free patches only; `get` / `scan`'s warning text) — and, standalone only, `org_looks_like_path` (`-o`/`--org` given a file-shaped value — `-O` is `--output`). The standalone error envelope carries `warnings[]` too. An embedded `--vex` that fails also folds each omitted patch into the host command's `warnings[]` as `vex_omitted` (`<purl>: <why> (<errorCode>)` — standalone `vex` lists them as `skipped` events), and `--silent` lists them as `omitted: <purl> (<errorCode>)` lines under the error. A corrupt `.socket/vendor/state.json` is no longer degraded with a warning: every form of vex fails with `vendor_ledger_corrupt` (see the error-code table). A malformed pre-v5 `redirect-state.json` is, as of v5.0, only the `redirect_ledger_corrupt` warning (hosted mode keeps no ledger; the file is an optional migration record source).
 
 ### VEX provenance markers (contract)
 
@@ -198,24 +198,24 @@ Every VEX statement's impact string records which patch-application mode persist
 |---|---|---|
 | `Patched via Socket patch <uuid>` | agent | installed-tree file hashes vs the manifest's `afterHash` |
 | `Patched via Socket patch <uuid> (vendored)` | vendored | the committed `.socket/vendor/` artifact (no install hook needed) |
-| `Patched via Socket patch <uuid> (redirected)` | hosted | the lockfile's hosted integrity pin; in-run `scan --mode hosted --vex` attests from the redirect ledger WITHOUT hash verification (the JSON `vex` summary carries `verified: false`), while a post-install `socket-patch vex` re-proves the lockfile wiring and hash-verifies the installed copy the build consumes — or, with nothing installed, attests a discovered lockfile reference from its integrity pin (see "Manifest-less VEX") |
+| `Patched via Socket patch <uuid> (redirected)` | hosted | the lockfile's hosted integrity pin; in-run `scan --mode hosted --vex` attests from the patch records THIS RUN fetched (v5.0: held in memory; hosted mode persists none) WITHOUT hash verification (the JSON `vex` summary carries `verified: false`), while a post-install `socket-patch vex` re-proves the lockfile wiring and hash-verifies the installed copy the build consumes — or, with nothing installed, attests a discovered lockfile reference from its integrity pin (see "Manifest-less VEX") |
 
 `vendored` and `redirected` are disjoint in practice (the modes conflict); if a PURL somehow appears in both sets, `vendored` wins.
 
-**Patch hosts (manifest-less VEX).** A hosted lockfile reference counts only when it points at Socket's patch server or the operator's `--patch-server-url` / `SOCKET_PATCH_SERVER_URL` origin. A redirect-ledger record whose recorded wiring names its patch on any OTHER host — a staging patch server used without `--patch-server-url`, or a look-alike host — is judged by the ledger's own recorded wiring: with verification on it attests only an installed tree that hashes to the record (nothing installed is `package_not_found`, pristine bytes `not_applied`), but `--no-verify` / `--vex-no-verify` trusts the records by definition and attests it `(redirected)`, because the wiring gate cannot tell a staging host from a hostile one. Pass `--patch-server-url` for a non-production patch server, and do not combine `--no-verify` with lockfiles you do not trust.
+**Patch hosts (manifest-less VEX).** A hosted lockfile reference counts only when it points at Socket's patch server or the operator's `--patch-server-url` / `SOCKET_PATCH_SERVER_URL` origin. A hosted URL on any OTHER host — a staging patch server used without `--patch-server-url`, or a look-alike host — is not a hosted pin at all (v5.0: there is no redirect ledger to vouch for it), so `vex` does not attest it, and `list`, `rollback`, `remove`, `vendor` and `repair` do not see it either. Pass `--patch-server-url` for a non-production patch server. (A pre-v5 redirect ledger still on disk can keep such a record in play under the pre-v5 rule: judged by the ledger's own recorded wiring, attesting only an installed tree that hashes to the record unless `--no-verify` / `--vex-no-verify` trusts it; do not combine `--no-verify` with lockfiles you do not trust.)
 
 ### Manifest-less VEX (lockfile discovery)
 
-`vex` and every embedded `--vex` attest hosted and vendored patches without `.socket/manifest.json`, and without the `.socket/vendor` ledgers too, by reading the wiring out of the project's lockfiles and package-manager configs. This covers a depscan-opened PR, a clone of a repo that never committed its ledgers, and a `scan --mode hosted` checkout. The merge lives in `commands/vex_sources.rs`; discovery lives in `socket-patch-core/src/vex/discover/`.
+`vex` and every embedded `--vex` attest hosted and vendored patches without `.socket/manifest.json`, and without the vendor ledger too, by reading the wiring out of the project's lockfiles and package-manager configs. This covers a depscan-opened PR, a clone of a repo that never committed its vendor ledger, and every `scan --mode hosted` checkout (v5.0 hosted mode keeps no ledger at all: its records come from the API). The merge lives in `commands/vex_sources.rs`; discovery lives in `socket-patch-core/src/vex/discover/`.
 
 **Inputs.** Four sources feed one record view:
 
 1. `.socket/manifest.json`. A missing file counts as empty.
-2. The redirect ledger's `records`.
-3. The vendor ledger entries' embedded `record`s.
-4. Lockfile discovery.
+2. The vendor ledger entries' embedded `record`s.
+3. Lockfile discovery — the only source of hosted references (v5.0).
+4. Hosted records: the ones an in-run `scan --mode hosted --vex` fetched this run, and — for migration only — a pre-v5 `.socket/vendor/redirect-state.json`'s `records` (a malformed one is the `redirect_ledger_corrupt` WARNING, v5.0, and is simply not consulted). Anything else is fetched from the API (see **Record resolution**).
 
-Discovery is read-only, never touches the network, and never fails the run: a malformed file becomes a diagnostic. It reads files at `--cwd`, the root where the ledgers are read, and it does so under `--global` / `--global-prefix` as well, because discovery is what gates the ledgers (below). It reads only root files (no nested workspace-member locks) except where noted, and it reads **every** supported file that is present. There is no precedence chain: the hosted rewriter edits every candidate it finds, so a lock that another lock "shadows" can still carry wiring. Every value is committed, tamperable data, so each one is validated fail-closed: canonical uuid grammar, path-safe coordinates, root-anchored `.socket/vendor/` paths, and the patch-host allowlist.
+Discovery is read-only, never touches the network, and never fails the run: a malformed file becomes a diagnostic. It reads files at `--cwd`, the root where the vendor ledger is read, and it does so under `--global` / `--global-prefix` as well, because discovery is what gates the ledger entries (below). It reads only root files (no nested workspace-member locks) except where noted, and it reads **every** supported file that is present. There is no precedence chain: the hosted rewriter edits every candidate it finds, so a lock that another lock "shadows" can still carry wiring. Every value is committed, tamperable data, so each one is validated fail-closed: canonical uuid grammar, path-safe coordinates, root-anchored `.socket/vendor/` paths, and the patch-host allowlist.
 
 | Ecosystem | Files read | Hosted reference | Vendored reference | Hosted pin (`integrity_required`) |
 |---|---|---|---|---|
@@ -235,26 +235,26 @@ Discovery is read-only, never touches the network, and never fails the run: a ma
 
 Recognition rules that hold for every ecosystem:
 
-* **Patch hosts.** A hosted reference counts only on `https://patch.socket.dev` or the `--patch-server-url` / `SOCKET_PATCH_SERVER_URL` origin, with no userinfo. The uuid is the URL's LAST canonical-uuid path segment, because grant tokens may themselves be uuid-shaped. The Go module prefix is fixed. `socket-patch-<uuid>` registry / repository / source names count only through a pin. For a redirect-ledger record on any other host, see **Patch hosts** above.
+* **Patch hosts.** A hosted reference counts only on `https://patch.socket.dev` or the `--patch-server-url` / `SOCKET_PATCH_SERVER_URL` origin, with no userinfo. The uuid is the URL's LAST canonical-uuid path segment, because grant tokens may themselves be uuid-shaped. The Go module prefix is fixed. `socket-patch-<uuid>` registry / repository / source names count only through a pin. For a URL on any other host, see **Patch hosts** above.
 * **Pins, not definitions.** A registry, index or source *definition* alone (cargo `[registries]`, nuget `<add>`, pom `<repository>`, uv index tables, `.npmrc`) never makes a reference, because it survives a reverted pin. Sections the package manager ignores are not read: npm's v2 `dependencies` mirror, a `.cargo/config.toml` shadowed by `.cargo/config`. A Socket pin inside a maven `<profile>` is diagnosed, never a reference.
 * **Contested locks.** When one lock wires a package to a patch and another lock resolves the same `name@version` from a non-Socket source, the build's bytes depend on which package manager runs. The reference is then dropped with a `patched_ref_unattributable` diagnostic naming both files. This applies across npm / pnpm / yarn / bun and across uv / pylock / poetry / pdm / Pipfile.lock / requirements. PEP 723 script locks neither contest nor are contested.
-* **Lockless pins.** With no lock to name a version, a `Cargo.toml` pin (every declaration on `socket-patch-<uuid>`, that registry defined on the patch host for the same uuid) or an exclusive nuget exact-id mapping is never a reference on its own. It still keeps a redirect-ledger record live for a version the pin admits.
+* **Lockless pins.** With no lock to name a version, a `Cargo.toml` pin (every declaration on `socket-patch-<uuid>`, that registry defined on the patch host for the same uuid) or an exclusive nuget exact-id mapping is never a reference on its own, so v5.0 does not attest it (nor does `list` show it, or `rollback` / `remove` restore it — restore those files from version control). Only a pre-v5 redirect-ledger record naming a version the pin admits keeps it live. The same holds for a gem wired only in the `Gemfile` (the pre-bundler-2.6 mixed state, lock not converged).
 
-**Record resolution.** A candidate's record must carry the patch uuid the lockfile actually **wires**. It is taken from the first source that has one: the manifest (matched qualifier-insensitively), the redirect ledger's `records`, then the vendor ledger's embedded records. If none has it and the run is online, `vex` fetches the patch view by uuid from the patch API. The fetch uses `get`'s API client: the public proxy when no token is configured, and a one-shot 401/403 fallback to the proxy (free patches only). At most 10 fetches run concurrently. Fetched records stay in memory: `vex` never writes the manifest. A candidate still has no record under `--offline`, after a transport error or a 404, or when the patch is refused (paid without an entitled token); it is then omitted as `record_unavailable`, and the run is not aborted. A record whose uuid or package disagrees with the wiring is omitted as `record_mismatch`. The informational `socket-patch.vendor.json` marker is never a record source. When the lockfile wires a package to patch U, a manifest or ledger record for that package under another uuid is superseded, and a human-mode `Note:` says so.
+**Record resolution.** A candidate's record must carry the patch uuid the lockfile actually **wires**. It is taken from the first source that has one: the manifest (matched qualifier-insensitively), the hosted records above (this run's, then a pre-v5 ledger's), then the vendor ledger's embedded records. If none has it and the run is online, `vex` fetches the patch view by uuid from the patch API — for a v5 hosted checkout this is the normal path. The fetch uses `get`'s API client: the public proxy when no token is configured, and a one-shot 401/403 fallback to the proxy (free patches only). At most 10 fetches run concurrently. Fetched records stay in memory: `vex` never writes the manifest. A candidate still has no record under `--offline`, after a transport error or a 404, or when the patch is refused (paid without an entitled token); it is then omitted as `record_unavailable`, and the run is not aborted. A record whose uuid or package disagrees with the wiring is omitted as `record_mismatch`. The informational `socket-patch.vendor.json` marker is never a record source. When the lockfile wires a package to patch U, a manifest or ledger record for that package under another uuid is superseded, and a human-mode `Note:` says so.
 
 **Verification basis.** `(vendored)` and `(redirected)` patches bypass the Property 7 ecosystem filter, because their wiring is the persistence. With no manifest there is no `setup.manual`, and none is needed.
 
 | Wiring | Evidence (verify mode) | Marker |
 |---|---|---|
 | Vendored: a lockfile/config wires a `.socket/vendor` artifact, or a live vendor ledger entry | The **committed artifact** is hashed against the record's `afterHash`. The ledger entry is used when it names the wired artifact (it carries the dir-artifact inventory); otherwise an entry is synthesized from the reference. A present installed tree with different bytes only warns `vendored_tree_out_of_sync`. | `(vendored)` |
-| Hosted: a discovered patch-host reference, or a live redirect-ledger record | The installed copies the build **consumes** through the hosted wiring are hash-verified when any exist: the Go replacement module, never the pristine `M@v` in the module cache; the Socket-registry cargo source dir; maven's suffixed version. Installed evidence wins: `hash_mismatch` / `not_applied` are omitted. With **nothing installed**, a discovered reference whose lock pins the artifact (or whose format's rewriter never writes a pin) attests from that pin, which is the same evidence as in-run `scan --mode hosted --vex`. A ledger-only record, or a reference whose required pin is missing, stays `package_not_found`. So do purls that `--ecosystems` kept out of the crawl, because "not installed" has to mean the crawler looked. | `(redirected)` |
+| Hosted: a discovered patch-host reference (or a live pre-v5 redirect-ledger record) | The installed copies the build **consumes** through the hosted wiring are hash-verified when any exist: the Go replacement module, never the pristine `M@v` in the module cache; the Socket-registry cargo source dir; maven's suffixed version. Installed evidence wins: `hash_mismatch` / `not_applied` are omitted. With **nothing installed**, a discovered reference whose lock pins the artifact (or whose format's rewriter never writes a pin) attests from that pin, which is the same evidence as in-run `scan --mode hosted --vex`. A pre-v5 ledger-only record, or a reference whose required pin is missing, stays `package_not_found`. So do purls that `--ecosystems` kept out of the crawl, because "not installed" has to mean the crawler looked. | `(redirected)` |
 | Agent: a manifest record with no live hosted/vendored wiring | The installed tree, unchanged | none |
 
 **Liveness gates.** These gates run before hashing, and `--no-verify` / `--vex-no-verify` skips only the hashing, never the gates:
 
 * A **vendor ledger entry** attests only while some lockfile or config still wires its artifact. Otherwise it is omitted as `vendor_unwired`. The exception is a hosted takeover: the same package with a live redirect record falls through to that hosted claim.
-* A **redirect ledger record** attests only while a lockfile still wires its hosted patch. Otherwise it is omitted as `redirect_unwired`. The exception is a manifest-owned purl, which falls back to agent-mode verification. The purls that an in-run `scan --mode hosted --vex` itself confirmed count as live.
-* **Discovery is authoritative** for every patch uuid that a file it read *mentions*: the accepted references alone decide. A mention an extractor rejected keeps nothing alive, whatever raw text survives. That covers an orphaned berry entry, an inert Go replace, a reverted cargo pin, a uv lock its `pyproject.toml` does not confirm, a shadowed maven pin, a contested lock, a commented-out line and an unparseable lock. Only for a uuid that no read file mentions (formats no extractor reads, patch hosts outside the allowlist) does the ledger's own recorded wiring decide. Even then, only files that PIN the resolution count, never a leftover registry definition.
+* A **hosted record** (this run's, or a pre-v5 ledger's) attests only while a lockfile still wires its hosted patch. Otherwise it is omitted as `redirect_unwired`. The exception is a manifest-owned purl, which falls back to agent-mode verification. The purls that an in-run `scan --mode hosted --vex` itself confirmed count as live.
+* **Discovery is authoritative** for every patch uuid that a file it read *mentions*: the accepted references alone decide. A mention an extractor rejected keeps nothing alive, whatever raw text survives. That covers an orphaned berry entry, an inert Go replace, a reverted cargo pin, a uv lock its `pyproject.toml` does not confirm, a shadowed maven pin, a contested lock, a commented-out line and an unparseable lock. Only for a uuid that no read file mentions (formats no extractor reads, patch hosts outside the allowlist) does a ledger's own recorded wiring decide. Even then, only files that PIN the resolution count, never a leftover registry definition.
 * **Wiring conflict.** When the lockfiles wire one package to two or more different patches, every candidate for that package is omitted as `wiring_conflict`, with a note naming the patches.
 
 A reverted lockfile plus a leftover ledger or artifact therefore stops attesting, even under `--no-verify`.
@@ -561,6 +561,37 @@ machines with **no socket-patch installed and no Socket API access** (registry a
 unvendored dependencies may still be needed). Every mechanism below was validated against the real
 package managers (`spikes/PHASE0-FINDINGS.txt`).
 
+**Eject a hosted project (v5.0)**: standalone `vendor` with NO manifest in a project whose lockfiles
+pin hosted patches (not under `--global`; `--ecosystems` narrows the pins) takes its patch set from
+those pins — each pin's purl plus the patch uuid in its hosted URL — fetches each record from the
+patch API (`GET …/patches/view/<uuid>`, the same client and public-proxy fallback as `get`), vendors
+into `.socket/vendor/` exactly like `scan --mode vendored`, and rewires each package from hosted to
+vendored (the upstream registry entry is restored first, so a later `vendor --revert` returns the
+project to upstream, never to hosted). The human output opens with
+`Ejecting N hosted package(s) into .socket/vendor/...` (`Would eject …` under `--dry-run`); the
+JSON is the vendor envelope. It needs no installed `node_modules` / site-packages: the sources are
+fetched from the upstream registry, so a fresh hosted checkout ejects.
+
+The eject is ONE planned transition, all-or-nothing: (1) every record is fetched first — a failed
+(or 404) view fetch is a `failed` event with `errorCode: "patch_fetch_failed"` and the run stops
+with `status: "error"`, `errorCode: "eject_refused"`, exit 1, nothing touched; (2) the upstream
+restore of every pin is resolved against staged copies — a refused pin (offline registry, a
+non-derivable field; a binary `bun.lockb` record is rebuilt like the takeover's) is `eject_refused` with the `git checkout -- <lockfile>`
+remedy, nothing touched; (3) `--dry-run` stops here and reports each pin as an `applied` event with
+reason `eject_planned` — no file is written and no `.socket/` is created; (4) the wet run snapshots
+every file the eject may touch under one `apply.lock`, restores upstream, then vendors. If any
+package then fails, the snapshot is put back — the project stays hosted exactly as before, with the
+`eject_rolled_back` warning and `partial_failure`, exit 1; if putting the snapshot back itself fails,
+the error is `eject_rollback_failed` naming the files to `git checkout`. The eject does not emit the
+per-purl `vendor_takeover_reverted_redirect` warning (the restore is its own planned step).
+`--offline` (or `SOCKET_OFFLINE`) refuses the eject up front with `offline_eject_unavailable` —
+records and registry entries cannot be fetched offline — making zero network requests (dry run
+included). A hosted wiring that discovery cannot attribute (a lock mentioning a recognized hosted
+uuid it rejected, or a pin with no lockfile) is refused with `hosted_wiring_contested` (exit 1,
+nothing touched) rather than ejecting a partial set; `rollback`, `remove` and `list` refuse the same
+way (`list` degrades to a warning when it can still list). `--vex` works as on the manifest-driven
+path. Without hosted pins the no-manifest no-op below is unchanged.
+
 **Prebuilt vendor artifacts (`--vendor-source`)**: by default (`auto`) `vendor` first tries to
 DOWNLOAD the already-built patched artifact + integrity from the patch.socket.dev vendoring service,
 and silently falls back to building it locally on any non-fatal miss. `service` requires the service
@@ -676,9 +707,10 @@ kept). Reconstructed entries carry no pre-vendor wiring originals, so a later `-
 to the documented `vendor_lock_entry_drifted` guidance (re-resolve with the package manager). Because of this
 phase, `repair` no longer errors with `manifest_not_found` when the project has a vendor ledger
 or vendor-path lockfile references — it runs the vendored phase alone. A **hosted-only** project
-(no manifest, no vendor ledger, no vendored references — only `.socket/vendor/redirect-state.json`)
-is a no-op: `repair` exits 0 with a `redirect_only_project` skip pointing at `scan --mode hosted`
-(hosted redirects have no local artifacts to repair), rather than the `manifest_not_found` error a
+(no manifest, no vendor ledger, no vendored references — only hosted pins in its lockfiles, v5.0,
+or a pre-v5 `.socket/vendor/redirect-state.json`) is a no-op: `repair` exits 0 with a
+`redirect_only_project` skip pointing at `scan --mode hosted` (hosted pins have no local artifacts
+to repair), rather than the `manifest_not_found` error a
 bare directory still gets. Step 1's source download
 likewise skips vendored-in-sync manifest entries (their content lives in the committed artifact),
 so repairing a vendored project never re-litters `.socket/blobs`. `--dry-run` previews
@@ -806,7 +838,8 @@ worse, lets a warm cache silently serve unpatched bytes):
   `already_vendored` skips). Manifest-tracked entries whose patches were dropped from the manifest
   are auto-reverted at the start of the next `vendor` run (`vendor_reconciled` events); `detached`
   entries have no manifest record and are exempt. Standalone `vendor` (no flags) is fed
-  by `.socket/manifest.json` only: with no manifest it is a clean exit-0 no-op whose human line names
+  by `.socket/manifest.json` — or, with no manifest, by the lockfiles' hosted pins (the eject
+  above); with neither it is a clean exit-0 no-op whose human line names
   the missing manifest — `No manifest found, nothing to vendor.`, or, when the vendor ledger holds
   entries, `No manifest to vendor from; N vendored entr(y is|ies are) tracked in the ledger —
   `socket-patch repair` verifies (it|them).` — and it never re-vendors from the ledger. This no-op
@@ -832,52 +865,20 @@ worse, lets a warm cache silently serve unpatched bytes):
   0) — NOT `not_found`, which stays reserved for identifier-matches-nothing. `remove`'s default
   GC also extends (v5.0, additive) from blobs-only to blobs + diff archives + package archives
   (parity with rollback/repair/`scan --prune`; GC errors warn and continue, repair's posture).
-* **remove unwinds hosted redirects (v5.0)**: an identifier matching hosted records in the
-  redirect ledger unwinds those redirects too — per-purl for the supported ecosystems (cargo +
-  npm-family), via the whole-ledger reverse replay when the identifier covers EVERY record (the
-  same eligibility rule as `rollback`). A hosted-only match works with no manifest at all
-  (mirroring the manifest-less vendored escape). Unsupported-ecosystem hosted targets fail closed
-  BEFORE the manifest mutation with top-level `hosted_revert_unsupported` (exit 1; remedy:
-  unscoped `socket-patch rollback`, or re-run `scan --mode hosted`); a failed unwind or ledger
-  persist is `hosted_revert_failed` (exit 1, manifest not modified). Successful unwinds ride the
-  envelope as `removed`/`hosted_reverted` events (bypassing `summary.removed`, like
-  `vendor_reverted`). `--skip-rollback` leaves hosted wiring untouched; `--preserve-state` still
-  unwinds — hosted has no preservable local state (a stderr note says the records were dropped).
-* **rollback reverts vendored and hosted state by default (v5.0, MAJOR — was: excluded)**: the
-  agent leg still excludes vendor-owned purls from IN-PLACE restore (their patch lives in the
-  committed artifact, not the installed tree, so before-blob restoration is meaningless), but a
-  v5.0 `rollback` then unwires those purls through its vendored leg and unwinds hosted redirects
-  through its hosted leg — `remove <purl>` and `vendor --revert` are no longer the only exits
-  from vendored/hosted state. The JSON `vendored: []` array's meaning NARROWS accordingly (MAJOR):
-  it now lists only vendor-owned purls the run did NOT act on (today: the corrupt-vendor-ledger
-  skip — reserved-empty in v5.0, since naming skipped purls needs the very ledger that failed
-  to load); acted-on entries land in the new `vendoredReverted`/`vendoredPreserved`/`vendoredKept`
-  arrays. An identifier matching only vendored purls is still a success, not `not_found`. See
-  [Rollback command contract](#rollback-command-contract-v50).
-* **apply yields to vendor — every ecosystem**: a purl recorded in the ledger is skipped by
-  `apply` with reason `vendored`, even when the installed tree is absent entirely (never
-  `package_not_installed`; a vendored variant also accounts for its qualified release-variant
-  siblings). Golang especially — apply never repoints a vendor-owned `replace` back at
-  `.socket/go-patches/` — and `apply --check` excludes vendored modules from its drift audit.
-* **scan skips vendored purls before download** (plain `--apply`/`--sync`): the manifest is never
-  moved past the vendored uuid (that would break VEX verification with `vendor_uuid_mismatch`
-  until a vendor run). The skip rides `apply.patches[]` as `skipped`/`vendored`; a newer available
-  patch still surfaces in `updates[]` — the signal to run `scan --vendor`. In `--json` mode the
-  run additionally carries one top-level `vendored_ownership_retained` warning naming the skipped
-  purls and the migration path (see "Agent-flow run-level warnings"), so consumers need not dig
-  into `apply.patches[]` to learn the mode did not change; exit code and status are unaffected. `scan --prune` exempts
-  vendored purls from the crawl-based manifest prune (an absent installed copy is their NORMAL
-  state) but reconciles vendored state via the lockfile instead — see the `--prune` section. An
-  explicit `get` is allowed to move the manifest past the vendored uuid and warns
-  (`warnings[]` + stderr) that a `vendor` run must refresh the artifact — while
-  `get … --mode vendored` (v3.6) re-vendors at the new uuid in the same run instead
-  of warning (the vendor step immediately resolves the drift the warning describes).
-* **Old-binary skew caveat**: EVERY `scan`/`get --mode vendored` entry is now detached-shaped, so a
-  `socket-patch` binary that predates the `detached` flag (pre-4.0) running `vendor` against such a
-  checkout cannot see the flag and will reconcile-revert every vendored entry; a 4.x binary honors
-  the flag but drives its own re-vendor from the manifest and finds nothing to do. Pin the CLI
-  version in CI when mixing generations. The ledger schema itself stays parseable both ways
-  (additive optional fields).
+* **remove restores hosted pins (v5.0)**: an identifier matching hosted pins in the lockfiles
+  (purl or patch uuid; v5 keeps no hosted ledger) restores each matched pin to its default
+  upstream registry entry — the same restore as `rollback` (see "Hosted unwind coverage"), for every
+  ecosystem. A hosted-only match works with no manifest at all (mirroring the manifest-less
+  vendored escape). A pin the restore refuses (`--offline`, a registry that does not answer,
+  `bun.lockb`, …) or a failed write is the top-level `hosted_revert_failed` error BEFORE the
+  manifest mutation (exit 1, manifest not modified; message `could not restore <purl> to its
+  upstream registry entry: … (`git checkout -- <files>`)`). v4's `hosted_revert_unsupported` is no
+  longer emitted. Successful restores ride the envelope as `removed`/`hosted_reverted` events
+  (beside a manifest entry they bypass `summary.removed`, like `vendor_reverted`; for a hosted-only
+  match the restore IS the removal and they count); once no hosted pin is left, a pre-v5
+  `redirect-state.json` is deleted. `--skip-rollback` leaves hosted wiring untouched (and is refused
+  for a hosted-only match); `--preserve-state` still restores — hosted has no preservable local
+  state (a stderr note says the lockfile pins now resolve upstream).
 
 ### Caveats (documented behavior, not bugs)
 
@@ -917,13 +918,13 @@ worse, lets a warm cache silently serve unpatched bytes):
 
 ## Rollback command contract (v5.0)
 
-> **Semver note.** v5.0 changes `rollback`'s DEFAULT behavior (a default-value/behavior change → **MAJOR** per the [semver policy](#semver-policy)) and narrows the meaning of the existing `vendored: []` JSON key (**MAJOR**). Every new envelope key, flag, and warning code below is additive on top of that.
+> **Semver note.** v5.0 changes `rollback`'s DEFAULT behavior (a default-value/behavior change → **MAJOR** per the [semver policy](#semver-policy)) and narrows the meaning of the existing `vendored: []` JSON key (**MAJOR**). Every new envelope key, flag, and warning code below is additive on top of that. **Hosted leg (v5.0)**: hosted mode keeps no ledger, so the hosted leg restores each hosted pin to its default upstream registry entry (re-resolved from the registry) instead of replaying recorded fragments; a pin that cannot be restored is refused with the `git checkout -- <files>` remedy.
 
-`rollback` and `scan` are now the batch-level duals — `scan` moves the project toward "fully patched", `rollback` toward "fully unpatched" — the way `get` and `remove` are the single-patch duals. `rollback` needs no `--mode`: it infers what to undo from the three state stores (`.socket/manifest.json` = agent/in-place, `.socket/vendor/state.json` = vendored, `.socket/vendor/redirect-state.json` = hosted).
+`rollback` and `scan` are now the batch-level duals — `scan` moves the project toward "fully patched", `rollback` toward "fully unpatched" — the way `get` and `remove` are the single-patch duals. `rollback` needs no `--mode`: it infers what to undo from three sources (`.socket/manifest.json` = agent/in-place, `.socket/vendor/state.json` = vendored, and the hosted pins lockfile discovery finds in the project's lockfiles = hosted — v5.0 hosted mode keeps no ledger).
 
 ### Targets
 
-`rollback [TARGET]...` — zero or more targets, unioned. `pkg:` tokens are PURLs (base purl matches every release variant; qualified purl exact), other identifier-shaped tokens are UUIDs, and only **path-shaped** tokens (separator, glob metachar `*?[`, `./` prefix, or absolute) are path globs — see the per-subcommand args table for the safety rationale. Identifier matching runs across ALL THREE stores; an identifier matching nothing anywhere is the familiar exit-1 error. Path globs use the same matcher as `scan [PATHS]` (ancestor rule, `require_literal_separator`, absolute-only outside `--cwd`, Windows case-insensitive): installed copies of every candidate purl are discovered and purls with ≥ 1 matching copy are selected. Scoping sentences (shared with scan):
+`rollback [TARGET]...` — zero or more targets, unioned. `pkg:` tokens are PURLs (base purl matches every release variant; qualified purl exact), other identifier-shaped tokens are UUIDs, and only **path-shaped** tokens (separator, glob metachar `*?[`, `./` prefix, or absolute) are path globs — see the per-subcommand args table for the safety rationale. Identifier matching runs across ALL THREE sources (a hosted pin matches by purl or by the patch uuid in its hosted URL); an identifier matching nothing anywhere is the familiar exit-1 error. Path globs use the same matcher as `scan [PATHS]` (ancestor rule, `require_literal_separator`, absolute-only outside `--cwd`, Windows case-insensitive): installed copies of every candidate purl are discovered and purls with ≥ 1 matching copy are selected. Scoping sentences (shared with scan):
 
 * **A target that selects nothing is an error on `rollback` (exit 1) and an empty scan on `scan` (exit 0).** Each rollback path pattern must select at least one patched package; the error names the pattern and the reachability rule.
 * **Path targets select installed copies; entries with no installed copy are reachable only by identifier or unscoped runs.**
@@ -935,29 +936,39 @@ worse, lets a warm cache silently serve unpatched bytes):
 
 A bare `rollback` (or a scoped one, for its scope) restores the SYSTEM to unpatched and cleans up the local state, in phases under one `apply.lock` acquisition:
 
-1. **State discovery.** A missing manifest is no longer fatal when the vendor or redirect ledger holds work (`rollback` runs manifest-less on hosted-only / vendored projects — every `scan`/`get --mode vendored` project is manifest-less). The **truly-empty** project — all three stores absent — keeps the legacy "Manifest not found" exit 1 (JSON: the legacy `{status: "error", error: "Manifest not found", path}` shape). A project whose lockfiles still reference `.socket/vendor/` artifacts but whose vendor ledger is missing errors naming `socket-patch repair` (reconstruct the ledger, then roll back). **Corrupt-ledger containment**: an unreadable vendor ledger fails ONLY the legs that need it — the vendored leg, manifest cleanup, and GC are skipped fail-closed (`vendor_state_unreadable` warning) while the agent leg still restores files; an unreadable redirect ledger skips only the hosted leg (`redirect_state_unreadable` warning; v5.0 distinguishes a ledger that cannot be READ — EACCES, a directory or FIFO squatting on the path — which is reported as such and left in place with a fix-the-permissions remedy, from MALFORMED JSON, which is quarantined to `redirect-state.json.corrupt` with the restore remedy). Either drives `partial_failure` exit 1; an emergency restore is never blocked by an unrelated corrupt ledger. When the ONLY state on disk is an unreadable ledger, the run fails closed naming the store.
+1. **State discovery.** A missing manifest is no longer fatal when the vendor ledger or the lockfiles' hosted pins hold work (`rollback` runs manifest-less on hosted-only / vendored projects — every `scan`/`get --mode vendored` and v5 `scan --mode hosted` project is manifest-less). The **truly-empty** project — no manifest, no vendor ledger, no hosted pin — keeps the legacy "Manifest not found" exit 1 (JSON: the legacy `{status: "error", error: "Manifest not found", path}` shape), with one v5.0 exception: when a pre-v5 `.socket/vendor/redirect-state.json` is the only thing left, nothing pins it any more, so a wet run deletes it and exits 0 (human `Removed the pre-v5 hosted ledger .socket/vendor/redirect-state.json: no lockfile pins a hosted patch.`, `Would remove …` on `--dry-run`, which deletes nothing; JSON `{status: "success", rolledBack: 0, alreadyOriginal: 0, failed: 0, dryRun, warnings, legacyRedirectLedgerRemoved}` — a minimal envelope without the keys below; a failed delete is the `legacy_redirect_ledger_kept` warning, still exit 0). A project whose lockfiles still reference `.socket/vendor/` artifacts but whose vendor ledger is missing errors naming `socket-patch repair` (reconstruct the ledger, then roll back). **Corrupt-ledger containment**: an unreadable vendor ledger fails ONLY the legs that need it — the vendored leg, manifest cleanup, and GC are skipped fail-closed (`vendor_state_unreadable` warning) while the agent and hosted legs still run; it drives `partial_failure` exit 1, and an emergency restore is never blocked by it. When the ONLY state on disk is an unreadable vendor ledger, the run fails closed naming the store. A pre-v5 redirect ledger is never read by rollback (v4's `redirect_state_unreadable` is no longer emitted).
 2. **Agent leg** — the existing in-place restore machinery, unchanged (v5.0 presentation: the human `No patches found in manifest` line prints only for an unscoped run with no work in ANY leg — a run whose work is all vendored/hosted stays quiet about the manifest): multi-copy restore, release-variant narrowing, the before-blob gate (+ on-demand download; a gate abort still exits 1 with per-package `missing_blob` failure results **and** skips manifest cleanup + GC entirely — nothing was restored, and the retry's revert data must survive), local-go redirect drop, and the `not_installed` exit-0 asymmetry verbatim. Vendor-owned purls are still excluded here (see the vendored-mode section) — they are handled by the next leg instead of being punted to other commands.
 3. **Vendored leg** — each in-scope ledger entry (embedded-record entries included) is reverted through the vendor backends: lockfile wiring restored, artifact dir deleted (and its emptied `.socket/vendor/<eco>/` husk pruned, v5.0), ledger entry dropped + persisted per purl (crash-consistent, like `vendor --revert`). A **drift-keep** (the backend refused a drifted lock) keeps the entry, the artifact, AND the manifest record (`vendoredKept`, exit 1 — the system is still patched); a failure is recorded and other entries proceed.
-4. **Hosted leg** — see "Hosted unwind coverage" below.
+4. **Hosted leg** — each in-scope hosted pin is restored to its default upstream registry entry; see "Hosted unwind coverage" below. After a hosted leg with no failure, a wet run deletes a pre-v5 `redirect-state.json` once no lockfile pins a hosted patch any more (a failed delete is the `legacy_redirect_ledger_kept` warning).
 5. **Manifest cleanup** — entries are removed ONLY for in-scope purls whose legs fully succeeded, were not-installed, or were release-variant siblings narrowed away by an attempted variant that succeeded (half a variant group never lingers — `remove` parity); drift-kept and failed purls keep their records, and a failed variant holds its whole group. No-op removals never rewrite the file. A failed write surfaces as `manifest_write_failed` (warning + `partial_failure` exit 1; GC still runs against the unchanged manifest).
 6. **GC** — `cleanup_unused_blobs` + diff/package-archive sweeps against the post-removal manifest, with beforeHash blobs pinned (synthetic afterHash-slot records) for (a) removed-but-not-installed entries (a crawler miss must not destroy the only local revert data — `remove` parity) and (b) EVERY entry remaining in the post-removal manifest — still-active patches (failed, drift-kept, eco-/path-excluded) keep their revert data, so a scoped or failed run never destroys the blobs a later rollback needs; only blobs referenced solely by genuinely-removed entries are swept. GC errors warn (`cleanup_failed`) and continue — they never affect the exit (repair's posture).
 
-**Confirmation prompt.** A wet, non-preserve run with work prompts once, remove-style, composing only the clauses that apply into one English list (`a and b`, `a, b, and c`) with counted nouns: `Roll back N patches`, `remove them from the local manifest`, `delete M vendored artifacts and their ledger records`, `unwind H hosted redirects` (a hosted ledger with leftover edits but no records gets `replay K leftover hosted redirect edits` instead of the unwind clause; e.g. `Roll back 1 patch, remove it from the local manifest, and unwind 1 hosted redirect?`) — default yes, auto-accepted under `--yes`/`--json`/non-TTY (the shared `confirm` semantics; CI unaffected). Decline prints `Rollback cancelled.` and exits 0. `--dry-run` and `--preserve-state` runs are prompt-free (they delete no local state).
+**Confirmation prompt.** A wet, non-preserve run with work prompts once, remove-style, composing only the clauses that apply into one English list (`a and b`, `a, b, and c`) with counted nouns: `Roll back N patches`, `remove them from the local manifest`, `delete M vendored artifacts and their ledger records`, `restore H hosted packages to the upstream registry` (e.g. `Roll back 1 patch, remove it from the local manifest, and restore 1 hosted package to the upstream registry?`) — default yes, auto-accepted under `--yes`/`--json`/non-TTY (the shared `confirm` semantics; CI unaffected). Decline prints `Rollback cancelled.` and exits 0. `--dry-run` and `--preserve-state` runs are prompt-free (they delete no local state).
 
 ### `--preserve-state` (opt-out, both `rollback` and `remove`)
 
-Restore the system but keep the local patch state for a later re-apply: manifest entries kept, vendored artifacts + ledger entries kept byte-identical (only the lockfile wiring is reverted; the already-reverted wiring records replay as silent no-ops on a later revert, and a re-vendor re-wires from the live lock), and all blob/archive GC skipped. **Hosted redirects have no preservable local state**: their ledger records describe live wiring only, so a preserve run still unwinds them and drops the records either way — surfaced as the `hosted_state_not_preservable` warning (re-run `scan --mode hosted` to re-wire). Caveat (documented): preserved vendored entries may be reclaimed by an explicit later `scan --prune` (user-invoked GC); `vendor` re-runs re-wire them.
+Restore the system but keep the local patch state for a later re-apply: manifest entries kept, vendored artifacts + ledger entries kept byte-identical (only the lockfile wiring is reverted; the already-reverted wiring records replay as silent no-ops on a later revert, and a re-vendor re-wires from the live lock), and all blob/archive GC skipped. **Hosted pins have no preservable local state**: the lockfile pins are the only record, so a preserve run still restores them to upstream — surfaced as the `hosted_state_not_preservable` warning (re-run `scan --mode hosted` to re-wire). Caveat (documented): preserved vendored entries may be reclaimed by an explicit later `scan --prune` (user-invoked GC); `vendor` re-runs re-wire them.
 
-**Replay fail-closed carve-outs (v5.0)**: the gem SECTION-MOVE record (`redirect_gemfile_lock_gem_source`) refuses in the replay — the writer records only the bare remote URLs, not the moved spec block, so a URL swap cannot invert the move (remedy: `scan --mode hosted` normalize). A socket-owned go.mod `replace` folded into a `replace ( … )` BLOCK and later refreshed also refuses (the ledger records the single-line spelling). Both keep their records + edits for a retry. **Ledger persistence rule**: rollback and remove persist the mutated redirect ledger whenever it changed — INCLUDING on partial-failure exits — so lockfile writes that already flushed are never stranded against a stale on-disk ledger. **Lock discipline**: all three state stores are LOADED under the apply lock (only cheap existence probes run before it), so a concurrent run's writes are never clobbered by a stale pre-lock snapshot. **Residue rule (v5.0)**: a reversal that empties a ledger deletes the file — `redirect-state.json` and/or `vendor/state.json` — and prunes the emptied `.socket/vendor/<eco>/` and `.socket/vendor/` directories (non-recursive, so a `redirect-state.json.corrupt` quarantine or any other stray file keeps its directory alive — the one sanctioned `.socket/vendor/` residue); emptied `blobs/`, `diffs/` and `packages/` stores are removed by the GC sweep; `.socket/` itself is removed by the lock guard when the run leaves it empty, so a fully unwound hosted or vendored project has no `.socket/` at all. What legitimately survives a full reversal: `.socket/manifest.json` at `{"patches": {}}` (+ its `setup` block — never deleted, see the exit-code section), the setup-owned `.socket/.gitignore`, `gem-plugin-stamp` and `bundler-plugin/`, and `.corrupt` quarantine files.
+**Lock discipline**: the manifest and vendor ledger are LOADED under the apply lock (only cheap existence probes and the read-only hosted-pin discovery run before it; the upstream restore re-reads every file it rewrites under the lock), so a concurrent run's writes are never clobbered by a stale pre-lock snapshot. **Residue rule (v5.0)**: a reversal that empties the vendor ledger deletes `vendor/state.json` (and a pre-v5 `redirect-state.json` is retired as above) and prunes the emptied `.socket/vendor/<eco>/` and `.socket/vendor/` directories (non-recursive, so a pre-v5 `redirect-state.json.corrupt` quarantine or any other stray file keeps its directory alive — the one sanctioned `.socket/vendor/` residue); emptied `blobs/`, `diffs/` and `packages/` stores are removed by the GC sweep; `.socket/` itself is removed by the lock guard when the run leaves it empty, so a fully unwound hosted or vendored project has no `.socket/` at all. What legitimately survives a full reversal: `.socket/manifest.json` at `{"patches": {}}` (+ its `setup` block — never deleted, see the exit-code section), the setup-owned `.socket/.gitignore`, `gem-plugin-stamp` and `bundler-plugin/`, and `.corrupt` quarantine files.
 
 ### Hosted unwind coverage
 
-* **Per-purl reverts** exist for **cargo, golang and the npm family** (`redirect_revert_supported`): staged, fail-closed on drift, and honoring `dry_run` (every inverse and drift check resolves like a wet run; nothing flushes and the ledger is untouched). npm purls on projects with bun-lock edits DEFER to the whole-ledger replay (below) whenever it will run — the scope covers every record, and the replay stages the bun group all-or-nothing. A SCOPED unwind (`rollback <purl>`, or `remove <purl>` while other hosted records remain) takes the per-purl revert instead: it claims that purl's `redirect_bun_lock_package` edits by the recorded line's spec (`<name>@<version>` registry spec, or a hosted URL whose tarball leaf is `<name>-<version>.tgz`) and replays them like the yarn/pnpm text kinds (whole-line fragments, CRLF-exact); a sibling version's edit is neither claimed nor a refusal; an edit that mentions the package but is not a bun packages-entry line refuses with the unscoped-`rollback` remedy. Pinned by `tests/in_process_vendor_bun_takeover.rs` (`bun_scoped_rollback_of_one_of_two_hosted_records_unwinds_only_that_purl` and the `remove` twin). Native binary `redirect_bun_lockb_package` snapshots follow the same scoped ownership rule and restore only the claimed package records; unrelated binary resolutions stay intact. yarn lock blocks (`redirect_yarn_berry_entry` / `redirect_yarn_classic_entry`) are recorded in the lock's on-disk line endings and replayed byte-exactly; when a `core.autocrlf` checkout has since flipped the lock's UNIFORM ending (LF ↔ CRLF — the committed ledger keeps its fragments verbatim), this per-purl revert and the whole-ledger replay below match the recorded blocks respelled in the live ending and restore in that ending (v5.0). A lock with mixed endings proves nothing and still refuses as drift. vlt `redirect_vlt_lock_node` edits record entry text (`"<DepID>": <tuple>`, no indent, comma or `\r`) and revert slot by slot, in the per-purl revert and the whole-ledger replay alike: the line keyed by the recorded DepID gets the recorded slots [2] and [3] back while it keeps the flags, trailing slots, comma and line ending vlt has written since; a line already at the recorded original, or a DepID vlt has re-locked away with no line still carrying the hosted URL, is already reverted; anything else refuses as drift (remedy: restore the registry pin for the DepID by hand, or re-run `socket-patch scan --mode hosted` and roll back). Per-purl claims are by key: `<name>@<version>` or `<name>@<version>~<extra>` (peer and modifier variants).
-* **Whole-ledger reverse replay** (`revert_remaining_redirect_edits`, core `patch/redirect/replay.rs`) runs whenever the in-scope hosted record set equals the FULL ledger record set — however the scope was spelled (bare `rollback`, `rollback '**'`, an identifier set covering every record; `remove` reuses the same eligibility rule). It walks every remaining ledger edit in reverse write order through a **per-kind inverse table**, staged and committed **per ecosystem group, all-or-nothing**: one drifted, ambiguous (a fragment appearing more than once), or unhandled edit refuses the whole group byte-untouched while other groups proceed. This covers **gem, golang, pypi, composer, bun**, the yarn/pnpm text kinds (normally claimed by the per-purl npm revert first), and the **non-package rideshare edits** — the pnpm `trustLockfile` auto-config (a pristine created scaffold is deleted; a user-modified one keeps the file and loses only the `trustLockfile: true` line, warned as `redirect_pnpm_trust_scaffold_modified`) — plus a "last one out turns off the lights" pass: when the record map empties but non-package edits remain, they are replayed in the same persist, so the trust edit never strands. The npm `.npmrc` `allow-remote=all` auto-config (`redirect_npmrc_allow_remote`) replays in the `npm` group (a pristine created file is deleted; otherwise only the line is removed, warned as `redirect_npmrc_allow_remote_modified` for a modified created file) and is ALSO claimed by the per-purl npm revert of the last package-lock entry, so a scoped unwind never strands it.
-* **maven and nuget fail closed**: their structured-metadata kinds (`redirect_maven_repository` / `redirect_maven_dep_management` / `redirect_maven_config` / `redirect_maven_trusted_checksums`, `redirect_nuget_source` / `redirect_nuget_lock`) have no revert implementation, so any such edit refuses its whole group (the maven `<version>` suffix rewrite alone IS invertible, but it rides the same all-or-nothing group). The refusal keeps their records + edits in the ledger and names the remedy: re-run `scan --mode hosted` to normalize, or restore the lockfiles from version control.
-* **Unknown edit kinds fail closed (forward compatibility).** A ledger edit kind this release has no inverse for (written by a newer socket-patch) refuses in the replay's reserved `unknown` group with "the redirect ledger holds a {kind} edit this socket-patch release does not understand; upgrade socket-patch", and every record of every ecosystem is held while that group refuses, so no record is dropped beside an edit it may own. The other groups still unwind on disk and drop their edits; only their records wait until the unknown group clears. A per-purl revert (`rollback <purl>`, `remove`, the hosted→vendored takeover) refuses with the same text, and with nothing written, when any unknown `redirect_*` edit's `key`, `original` or `new` names the purl's `<name>@<version>` (at a package-name boundary: `left-pad@1.3.0` does not name `pad@1.3.0`, nor does `@scope/a@1.0.0` name `a@1.0.0`). When that scope covers every record, the whole-ledger replay above still runs after the refusal. The vendored flows' takeover reconcile (`vendor_supersedes_redirect`) drops nothing for such a purl and falls back to the manual advisory. vlt ledgers (`redirect_vlt_lock_node` edits, vendored entries with `flavor: "vlt"`) require the socket-patch release that adds vlt support. The ledger `version` stays 1: compatibility is decided per kind.
-* **Scoped runs** (paths / identifiers / `--ecosystems`) that do NOT cover the full record set get per-purl reverts only; in-scope hosted purls of ecosystems without one fail closed — `rollback` reports them in `hosted.unsupported` (exit 1), `remove` as the top-level `hosted_revert_unsupported` error — with the remedy "run an unscoped `socket-patch rollback` to unwind ALL hosted redirects, or re-run `scan --mode hosted`".
-* **Ledger accounting**: exactly the replayed (or already-at-original) edits are dropped; a record is dropped only when every group its ecosystem writes ended clean, so refused groups keep both edits and records — the intermediate-but-coherent ledger a retry needs. The mutated ledger is persisted (delete-when-empty); a failed persist rides `hosted.failed` / `hosted_revert_failed`.
+v5.0 replaces v4's per-purl reverts and whole-ledger reverse replay (`revert_remaining_redirect_edits`) with ONE mechanism, the **upstream restore** (core `patch/redirect/upstream/`), shared by `rollback`, `remove` and the hosted → vendored takeover:
+
+* **Scope.** The hosted pins are what lockfile discovery finds — `(purl, patch uuid, files wiring it)`, recognized only on `https://patch.socket.dev` or the `--patch-server-url` / `SOCKET_PATCH_SERVER_URL` origin. A scoped rollback (paths / identifiers / `--ecosystems`) restores exactly the pins in scope; each pin restores or refuses on its own (there is no whole-ledger replay, and a pre-v5 ledger's edits are never replayed). A pin discovery cannot see is out of reach: a lockless cargo `registry = "socket-patch-<uuid>"` pin, a nuget exact-id mapping with no `packages.lock.json`, a gem wired only in the `Gemfile` (pre-bundler-2.6 mixed state) — restore those files from version control.
+* **What a restore does.** Every file wiring the pin is rewritten back to the DEFAULT UPSTREAM registry entry for `name@version`, re-resolving whatever the entry pins (tarball URL, integrity, checksum, hashes) from the public registry; only the hosted entries change and every other byte stays the file's own. A pin is **all-or-nothing**: refused in one of its files, it is restored in none of them, so no pin is left half hosted. Nothing reaches disk until every pin has resolved, and `--dry-run` resolves exactly like a wet run — registry lookups included — and skips only the write. Per format:
+  * **npm family** — `package-lock.json` / `npm-shrinkwrap.json`, `yarn.lock` (classic and berry), `pnpm-lock.yaml` / `shrinkwrap.yaml`, `bun.lock`: resolution + integrity (+ shasum where recorded) from the npm registry's version document (`SOCKET_NPM_REGISTRY`). Side settings: a project `.npmrc` that is exactly `allow-remote=all\n` is deleted once no root npm lock entry is hosted, otherwise a remaining top-level `allow-remote=all` warns `npm_allow_remote_left`; a `pnpm-workspace.yaml` that is exactly the scaffold hosted mode creates is deleted once `pnpm-lock.yaml` is no longer hosted, otherwise a remaining `trustLockfile: true` warns `pnpm_trust_lockfile_left`. **`bun.lockb` (binary)**: `rollback` and `remove` refuse it (the checkout remedy). The hosted → vendored takeover and the eject DO restore it, since the vendor ledger then records the rebuilt record as its pre-vendor original: the native codec turns each hosted remote-tarball record back into Bun's npm registry record for `name@version` (the registry's `dist.tarball` + `dist.integrity`, the package metadata hash re-derived, the hosted URL string dropped from the string pool). The hosted rewrite keeps the registry record's inactive bytes (padding, semver) in the tarball record, so a lock it wrote comes back byte for byte — early writers' uninitialized padding included; a record without them (an older socket-patch or a Bun re-save) is rebuilt the way Bun writes one, and refused for a prerelease/build version. A lock the hosted rewrite had to normalize is marked in the root package's resolution value bytes (which no Bun reader reads): a binary format 1 lock it promoted to format 2 is demoted back to its exact format-1 bytes (verified by promoting it again, otherwise refused), and a lock whose workspace dependency behaviors it normalized is refused with the `git checkout -- bun.lockb` remedy.
+  * **vlt** — `vlt-lock.json`: slot [2] from the registry's `dist.integrity`, slot [3] per the lock's own convention (see the vlt hosted-mode contract); every hosted instance of the pin together.
+  * **cargo** — `Cargo.lock` back on crates.io (source + the sparse index's checksum, `SOCKET_CRATES_INDEX`); every `Cargo.toml` declaration loses its `registry = "socket-patch-<uuid>"` pin (the shorthand the rewriter produced collapses back); the unreferenced `[registries.socket-patch-<uuid>]` block leaves the project cargo config. A declaration it cannot unpin refuses.
+  * **golang** — the hosted `replace` and the socket module's go.sum lines go; the upstream module's two go.sum lines come back, hashed from the module proxy (`SOCKET_GOPROXY`, else `GOPROXY` / `GONOPROXY` / `GOPRIVATE` as go reads them) and cross-checked against the checksum database (`SOCKET_GOSUMDB_URL`, else `sum.golang.org` unless `GOSUMDB=off` / `GONOSUMDB` / `GOPRIVATE` say go would not ask it). A `replace` the user had before the hosted run is not recorded anywhere, so the restore lands on the plain upstream module.
+  * **pypi** — `Pipfile.lock`, `requirements.txt` (+ in-root `-r` includes), Hatch PEP 508 direct references (`pyproject.toml` / `hatch.toml`), `poetry.lock`, `pdm.lock`, `uv.lock`, PEP 723 script locks and PEP 751 `pylock*.toml` (+ the paired `pyproject.toml` / script metadata): hashes re-derived from PyPI's JSON API (`SOCKET_PYPI_JSON_API`). Refused: a `pdm.lock` without `cross_platform`, or a uv / script / pylock lock, whose release has a wheel that is not pure Python 3 (which files the lock keeps is not re-derivable); a uv lock whose options filter files (`exclude-newer`, `no-binary`, `no-build`), or whose other registry packages name no registry, several, or one other than PyPI's simple index; uv 0.2 `[[distribution]]` locks. A transitive `override-dependencies` entry hosted mode added is removed (`upstream_uv_override_removed`).
+  * **gem** — `Gemfile.lock` / `gems.locked` + `Gemfile` / `gems.rb`: the spec moves back into the upstream `GEM` section (or the Socket remote leaves a merged section), the `source "<patch registry>" do … end` block is undone, the `CHECKSUMS` entry is re-pinned from the rubygems.org compact index (`SOCKET_RUBYGEMS_URL`) and the `DEPENDENCIES` pin loses its `!`. The declaration's original constraint is not recorded, so it comes back as the exact pin `gem "<name>", "<version>"`. Refused: an ambiguous upstream section, an upstream remote other than rubygems.org.
+  * **composer** — `composer.lock`: `dist` and the deleted `source` block from packagist's composer v2 metadata (`SOCKET_PACKAGIST_URL`). Refused unless the entry is packagist-sourced and packagist still serves the lock's `dist.reference` for the version.
+  * **maven** — `pom.xml` (the `-socket.<hex8>` version suffix, the added `<repository>` / `<dependencyManagement>` entry) and the `.mvn/maven.config` / `.mvn/checksums/checksums.sha256` lines hosted mode writes: **no network**, so it restores under `--offline` too. `.mvn` files holding anything else keep the resolver lines (`maven_trusted_checksums_left`).
+  * **nuget** — `nuget.config` loses the `socket-patch-<uuid>` source and its exact-id mapping; every `packages.lock.json` entry of the id gets nuget.org's `contentHash` back (`SOCKET_NUGET_URL`). Refused when the restored config would not resolve the id from nuget.org alone. A config hosted mode created from scratch is kept (`nuget_default_config_left`).
+  * Any other file wiring a pin refuses it (`socket-patch cannot re-derive the upstream entry in <files>`).
+* **Refusals.** `--offline` refuses every pin whose restore needs a registry lookup (all but maven), as does a registry that does not answer or no longer describes the entry. A refused pin writes nothing; its message is `cannot restore <purl> to its upstream registry entry: <why>; restore it from version control instead (`git checkout -- <files>`)` — human `Error: Cannot restore …` on stderr (even under `--silent`), JSON `hosted.failed[{purl, error}]`, and `partial_failure` exit 1 (`remove`: the `hosted_revert_failed` error). A write failure after every pin resolved is one `hosted.failed` entry with the pseudo-purl `files`.
+* **Output.** Human `Restored <purl> to its upstream registry entry` / `Would restore <purl> to its upstream registry entry` (`--dry-run`). vlt: the stale installed copies of restored nodes are removed afterwards, as before (`--no-vlt-install-cleanup` keeps them).
 
 ### JSON envelope (legacy shape + additive always-present keys)
 
@@ -965,18 +976,18 @@ Restore the system but keep the local patch state for a later re-apply: manifest
 
 | Key | Shape | Meaning |
 |---|---|---|
-| `warnings` | `[{code, detail}]` | Run-level warnings, now populated (previously always empty): `reinstall_required`, `hosted_state_not_preservable`, `out_of_scope_copies_restored`, `vendor_state_unreadable`, `redirect_state_unreadable`, `cleanup_failed`, `manifest_write_failed`, `redirect_pnpm_trust_scaffold_modified`, `redirect_npmrc_allow_remote_modified`, `ownership_not_restored` (a restored file whose ownership could not be put back — see the apply warnings), plus vendored/hosted leg advisories. New codes are additive (MINOR) |
+| `warnings` | `[{code, detail}]` | Run-level warnings, now populated (previously always empty): `reinstall_required`, `hosted_state_not_preservable`, `out_of_scope_copies_restored`, `vendor_state_unreadable`, `cleanup_failed`, `manifest_write_failed`, `legacy_redirect_ledger_kept`, the upstream-restore advisories (`npm_allow_remote_left`, `pnpm_trust_lockfile_left`, `maven_trusted_checksums_left`, `nuget_default_config_left`, `upstream_uv_override_removed`), `ownership_not_restored` (a restored file whose ownership could not be put back — see the apply warnings), plus vendored/hosted leg advisories. New codes are additive (MINOR) |
 | `vendored` | `[purl]` | **Meaning narrowed (MAJOR)**: vendor-owned purls the run did NOT act on — today exactly the corrupt-vendor-ledger skip. |
 | `vendoredReverted` | `[purl]` | Ledger entries cleanly reverted this run (unwired + artifact deleted + entry dropped; previewed on dry-run) |
 | `vendoredPreserved` | `[purl]` | `--preserve-state`: unwired with artifact + ledger entry kept |
 | `vendoredKept` | `[{purl, reason}]` | Drift-keeps — wiring drifted, vendored state (and the manifest entry) left untouched; drives exit 1 |
 | `vendoredFailed` | `[{purl, error}]` | Vendored reverts that errored — entry, artifact, and manifest record all survive for a retry; drives exit 1 |
-| `hosted` | `{reverted: [purl], failed: [{purl, error}], unsupported: [purl], editedFiles: N}` | The hosted leg. `failed` entries may carry a `group:<name>` pseudo-purl for whole-group replay refusals; `unsupported` lists scoped purls with no per-purl revert; `editedFiles` counts distinct files rewritten |
+| `hosted` | `{reverted: [purl], failed: [{purl, error}], unsupported: [purl], editedFiles: N}` | The hosted leg (v5.0: the upstream restore). `reverted` lists the pins restored (would-be on dry-run); `failed` the refused pins with the version-control remedy in `error` (the pseudo-purl `files` for a write failure); `unsupported` is kept for shape and is always empty (every ecosystem has a restore); `editedFiles` counts distinct files rewritten |
 | `manifest` | `{removedEntries: [purl], preserved: bool}` | Entries removed from the manifest (would-be removals on dry-run); `preserved` mirrors `--preserve-state` |
 | `gc` | `{skipped: true}` \| `{removedBlobs, removedDiffArchives, removedPackageArchives, bytesFreed}` | Skipped under `--preserve-state`, after a blob-gate abort, and under a corrupt vendor ledger |
 | `paths` | `[string]` | The path-glob targets verbatim (empty when none) |
 
-**Exit rules**: not-installed entries never flip the exit (the documented apply/rollback asymmetry — even an all-not-installed run exits 0 `success`). Everything that leaves the system still patched DOES flip it to `partial_failure` exit 1: agent-leg failures, vendored drift-keeps and revert failures, hosted refusals and scoped-unsupported targets, corrupt ledgers, and a failed manifest write. GC failures never affect the exit.
+**Exit rules**: not-installed entries never flip the exit (the documented apply/rollback asymmetry — even an all-not-installed run exits 0 `success`). Everything that leaves the system still patched DOES flip it to `partial_failure` exit 1: agent-leg failures, vendored drift-keeps and revert failures, hosted refusals, a corrupt vendor ledger, and a failed manifest write. GC failures never affect the exit.
 
 ## Self-update contract (`socket-patch --update`)
 
@@ -1119,14 +1130,20 @@ Contract properties:
 
 ### Registry override env vars
 
-Env-only knobs (no CLI flag) read by the vendor auto-fetch / artifact-rebuild paths in `socket-patch-core` (`src/vendor/registry_fetch.rs`, `src/vendor/maven_repo.rs`). Each is the enterprise-mirror / test escape hatch for one registry base; trailing slashes are trimmed and an exported-but-empty value falls back to the default. Lock-recorded URLs (npm/yarn/composer/gem/uv `resolved`/dist URLs) are used verbatim and bypass these.
+Env-only knobs (no CLI flag) read by the vendor auto-fetch / artifact-rebuild paths in `socket-patch-core` (`src/vendor/registry_fetch.rs`, `src/vendor/maven_repo.rs`) and (v5.0) by the hosted upstream restore of `rollback` / `remove` / the vendored takeover (`src/patch/redirect/upstream/client.rs`, which honors the same bases). Each is the enterprise-mirror / test escape hatch for one registry base; trailing slashes are trimmed and an exported-but-empty value falls back to the default. Lock-recorded URLs (npm/yarn/composer/gem/uv `resolved`/dist URLs) are used verbatim and bypass these.
 
 | Env var | Default | Notes |
 |---|---|---|
-| `SOCKET_NPM_REGISTRY` | `https://registry.npmjs.org` | Base for conventional npm tarball URLs (vendor auto-fetch + the npm-family lockfile-integrity reconstruction rung in `repair`). |
+| `SOCKET_NPM_REGISTRY` | `https://registry.npmjs.org` | Base for conventional npm tarball URLs (vendor auto-fetch + the npm-family lockfile-integrity reconstruction rung in `repair`) and, v5.0, the version documents (`<base>/<name>/<version>`, a scoped name's `/` as `%2f`; `dist.tarball` / `integrity` / `shasum`) the npm-family and vlt upstream restore reads. |
 | `SOCKET_CRATES_REGISTRY` | `https://static.crates.io/crates` | crates.io static `.crate` download host. |
 | `SOCKET_GOPROXY` | `https://proxy.golang.org` | Go module proxy. Wins over the standard `GOPROXY` env var, whose first element is used otherwise. When that element is `off` or `direct`, or the module matches `GONOPROXY` (default `GOPRIVATE`), go would not ask a proxy, so the pristine fetch is refused (`vendor_fetch_unverifiable` + the calm `package_not_installed` skip) instead of falling back to `proxy.golang.org`. |
 | `SOCKET_MAVEN_REGISTRY` | `https://repo1.maven.org/maven2` | maven2 base for the fallback upstream-pom download. |
+| `SOCKET_CRATES_INDEX` | `https://index.crates.io` | v5.0 upstream restore: the crates.io sparse index whose `checksum` a restored `Cargo.lock` entry gets back. |
+| `SOCKET_GOSUMDB_URL` | `https://sum.golang.org` | v5.0 upstream restore: the checksum database the restored go.sum lines are checked against. Without it, `GOSUMDB=off` or a module matching `GONOSUMDB` (default `GOPRIVATE`) skips the database and the hashes come from the module proxy's bytes alone (`SOCKET_GOPROXY` above). |
+| `SOCKET_PYPI_JSON_API` | `https://pypi.org/pypi` | PyPI's JSON API (`<base>/<name>/<version>/json`): the vendored fetch's hash → URL lookup, and (v5.0) the release files whose sha256 the upstream restore writes back into every Python lock format. |
+| `SOCKET_RUBYGEMS_URL` | `https://rubygems.org` | v5.0 upstream restore: the compact index (`/info/<name>`) a restored `CHECKSUMS` entry is re-pinned from. |
+| `SOCKET_PACKAGIST_URL` | `https://repo.packagist.org` | v5.0 upstream restore: packagist's composer v2 metadata (`/p2/<vendor>/<package>.json`) a restored `composer.lock` `dist` / `source` comes from. |
+| `SOCKET_NUGET_URL` | `https://api.nuget.org` | v5.0 upstream restore: the nuget.org API host whose catalog `packageHash` a restored `packages.lock.json` `contentHash` comes from. |
 
 ### Internal env vars (no stability guarantee)
 
@@ -1239,21 +1256,21 @@ Every `--json` invocation emits a single JSON object that follows the **unified
 | `vendor_reverted`         | `removed`        | remove: vendoring reverted (lock fragments restored, artifact + ledger entry gone) as part of removing the patch. |
 | `vendor_revert_failed`    | top-level error  | remove: the vendor revert failed; the manifest was NOT modified. |
 | `vendor_state_retained`   | `skipped`        | remove `--skip-rollback`: vendor wiring + artifact deliberately left in place (the next `vendor` run reconciles the dropped entry). Also the top-level error code when `--skip-rollback` targets a vendored patch with no manifest record (every `scan`/`get --mode vendored` entry — and, v5.0, the ledger-only leftover of an earlier `remove --skip-rollback` of a manifest-tracked vendored patch). |
-| `hosted_state_retained`   | (top-level error) | remove `--skip-rollback` targeting a hosted-only patch (no manifest entry): unwinding the redirect is the only possible removal, so the combination is refused (exit 1), mirroring the manifest-less vendored refusal above. |
+| `hosted_state_retained`   | (top-level error) | remove `--skip-rollback` targeting a hosted-only patch (no manifest entry): restoring the pin's upstream registry entry is the only possible removal, so the combination is refused (exit 1), mirroring the manifest-less vendored refusal above. |
 | `vendor_state_preserved`  | `skipped`        | remove `--preserve-state` (v5.0): lockfile unwired; artifact, ledger entry, and manifest entry all kept for a later re-apply. Rollback's counterpart is the `vendoredPreserved: []` envelope array. |
 | `vendor_revert_kept`      | `skipped` + top-level error | remove (v5.0): the vendored revert drift-kept (`kept_artifact`), so the ledger entry AND the manifest entry were both kept. ANY drift-keep makes the run a `partialFailure` (exit 1) — part of the requested removal did not happen; when EVERY matching entry drift-kept, the top-level error carries this code (`summary.removed` stays 0; the identifier DID match, so never `not_found`). Remedy: re-run `scan --mode vendored` to normalize, then remove. Rollback's counterpart is the `vendoredKept: []` envelope array (also exit 1). |
-| `hosted_reverted`         | `removed`        | remove (v5.0): a hosted lockfile redirect was unwound as part of removing the patch (`verified` on dry-run). Bypasses `summary.removed` like `vendor_reverted`. |
-| `hosted_revert_unsupported` | top-level error | remove (v5.0): the identifier matches hosted records of an ecosystem with no per-purl revert (and the identifier does not cover the full record set, so the whole-ledger replay cannot serve it — maven/nuget always land here scoped, as do npm purls a refused replay left behind). The manifest was not modified; exit 1. Remedy: unscoped `socket-patch rollback`, or re-run `scan --mode hosted`. Rollback reports the same condition in its `hosted.unsupported` array (exit 1). |
-| `hosted_revert_failed`    | top-level error  | remove (v5.0): a per-purl hosted unwind, group replay, or redirect-ledger persist failed; the manifest was not modified, exit 1. Rollback's counterpart is a `hosted.failed[]` entry (also `partial_failure` exit 1). |
+| `hosted_reverted`         | `removed`        | remove (v5.0): a hosted lockfile pin was restored to its upstream registry entry as part of removing the patch (`verified` on dry-run). Beside a manifest entry it bypasses `summary.removed` like `vendor_reverted`. |
+| `hosted_revert_failed`    | top-level error  | remove (v5.0): a matched hosted pin could not be restored to its upstream registry entry (`--offline`, a registry that does not answer, `bun.lockb`, a lock shape the restore refuses — see "Hosted unwind coverage"), or writing the restored files failed; the message names the `git checkout -- <files>` remedy. The manifest was not modified, exit 1. Rollback's counterpart is a `hosted.failed[]` entry (also `partial_failure` exit 1). v4's `hosted_revert_unsupported` is no longer emitted (every ecosystem has a restore). |
 | `reinstall_required`      | rollback `warnings[]` | rollback (v5.0): vendored/hosted wiring was unwound, but installed trees keep their patched bytes until the next package-manager install — the stale-install advisory. |
-| `hosted_state_not_preservable` | rollback `warnings[]` | rollback `--preserve-state` (v5.0): hosted redirects were unwound and their ledger records dropped anyway — hosted has no preservable local state; re-run `scan --mode hosted` to re-wire. (`remove --preserve-state` prints the same note on stderr.) |
+| `hosted_state_not_preservable` | rollback `warnings[]` | rollback `--preserve-state` (v5.0): hosted pins were restored to upstream anyway — the lockfile pins are hosted mode's only record, so there is no local state to preserve; re-run `scan --mode hosted` to re-wire. (`remove --preserve-state` prints the same note on stderr.) |
 | `out_of_scope_copies_restored` | rollback `warnings[]` | path-scoped rollback (v5.0): a selected patch had installed copies outside the given patterns; ALL copies were restored (patches are per-package). Informational — never flips the exit. |
 | `path_scope_excluded_supplements` | scan `warnings[]` | path-scoped scan (v5.0): lockfile-only / vendor-ledger supplement packages have no installed path and were excluded from the scoped scan; the detail carries the count. |
 | `vendor_commit_failed` | top-level error (`vendor`, and the nested vendor envelope of `scan` / `get --mode vendored`) | v5.0 group commit: the run's lockfile / manifest / ledger edits could not be written (the detail names the I/O error). Exit 1; the project's lockfiles and `.socket/vendor/state.json` are left as they were before the run (a partially-applied commit is put back), and the per-package events describe the uncommitted outcome. When putting a partially-applied commit back fails too, the journal is kept instead and the detail says the next socket-patch command in the project finishes the commit. |
-| `vendor_state_unreadable` / `redirect_state_unreadable` | rollback `warnings[]`; remove top-level error | corrupt-ledger containment (v5.0). Rollback: an unreadable vendor ledger skips the vendored leg + manifest cleanup + GC; an unreadable redirect ledger skips the hosted leg (quarantine/restore remedy in the detail); either drives `partial_failure` exit 1 while the agent leg still restores files. Remove: `vendor_state_unreadable` is a hard top-level error before any mutation (an unreadable redirect ledger only warns — the identifier may match other stores). Also the Bun vendored preflight's refusal code: `get` / `scan --mode vendored`, `vendor`'s pre-takeover check and the `--dry-run` `would_refuse` preview report an unreadable `.socket/vendor/state.json` as itself (`errorCode` in `patches[]` / `download.patches[]`, or `get <uuid>`'s top-level `error.code`), fail-closed — nothing is exempt — instead of a Bun lock code. |
+| `vendor_state_unreadable` | rollback `warnings[]`; remove top-level error | corrupt-ledger containment (v5.0). Rollback: an unreadable vendor ledger skips the vendored leg + manifest cleanup + GC and drives `partial_failure` exit 1 while the agent and hosted legs still run. Remove: a hard top-level error before any mutation. Also the Bun vendored preflight's refusal code: `get` / `scan --mode vendored`, `vendor`'s pre-takeover check and the `--dry-run` `would_refuse` preview report an unreadable `.socket/vendor/state.json` as itself (`errorCode` in `patches[]` / `download.patches[]`, or `get <uuid>`'s top-level `error.code`), fail-closed — nothing is exempt — instead of a Bun lock code. (v4's `redirect_state_unreadable` is no longer emitted: v5 never reads the redirect ledger on these paths.) |
 | `manifest_write_failed`   | rollback `warnings[]` | rollback (v5.0): the post-rollback manifest update could not be written; no entries were removed (`manifest.removedEntries: []`) and the run exits `partial_failure` 1. |
-| `redirect_pnpm_trust_scaffold_modified` | rollback/remove `warnings[]` | hosted replay (v5.0): the redirect-created `pnpm-workspace.yaml` scaffold was modified since; the file was kept and only the `trustLockfile: true` line removed. |
-| `redirect_npmrc_allow_remote_modified` | rollback/remove `warnings[]` (+ human stderr); vendored-supersedes-hosted reconcile `warnings[]` (`vendor`, `scan --mode vendored`); vendor advisory event | hosted unwind (v5.0): the redirect-created project `.npmrc` was modified since; the file was kept and only the `allow-remote=all` line removed. |
+| `npm_allow_remote_left` / `pnpm_trust_lockfile_left` | rollback/remove `warnings[]`; vendor advisory event (takeover) | upstream restore (v5.0): no npm-family lock entry is hosted any more, but the project `.npmrc` keeps a top-level `allow-remote=all` (resp. `pnpm-workspace.yaml` keeps `trustLockfile: true`) in a file that is not exactly what hosted mode creates; the file is left untouched (v5 records no provenance), remove the line if nothing else needs it. A file that is exactly hosted mode's own is deleted silently. |
+| `maven_trusted_checksums_left` / `nuget_default_config_left` / `upstream_uv_override_removed` | rollback/remove `warnings[]`; vendor advisory event (takeover) | upstream restore (v5.0): `.mvn` config keeps the trusted-checksums resolver lines because it holds more than hosted mode writes; `nuget.config` now holds only the nuget.org source (delete it if hosted mode created it); a transitive `override-dependencies` entry hosted mode added to `pyproject.toml` was removed. |
+| `legacy_redirect_ledger_kept` | rollback `warnings[]` (+ remove stderr) | v5.0: a pre-v5 `.socket/vendor/redirect-state.json` could not be deleted once no hosted pin was left; the file is inert (never read for planning). Never flips the exit. |
 | `vendor_stale_artifact_removed` | `removed`  | vendor / scan `--vendor`: re-vendor under a newer patch uuid removed the previous uuid's orphaned artifact dir. |
 | `vendor_unsupported_ecosystem` | `skipped`   | vendor: no vendor backend for this purl's ecosystem (jsr). |
 | `already_vendored`        | `skipped`        | vendor: artifact + wiring already in sync for this patch uuid. |
@@ -1262,10 +1279,10 @@ Every `--json` invocation emits a single JSON object that follows the **unified
 | `vendor_wiring_unknown_revert_blocked` | `skipped` (beside the `failed`/`revert_failed` event) | vendor --revert: the ledger entry was reconstructed by `repair` without wiring records and the live lockfile still resolves through the artifact — the revert refuses (fail-closed) instead of deleting a tarball the lock points at. Recovery: `socket-patch repair`, then restore the pre-vendor lock (or re-lock without the override) and re-run the revert. repair: an npm ledger entry whose `flavor` this release does not know (written by a newer socket-patch) is skipped, never health-checked or rebuilt, and the artifact, wiring and ledger stay as found (a lone `skipped` event; the run's exit is unaffected). Recovery: upgrade socket-patch. |
 | `ecosystem_not_setup`     | `skipped`        | vex: the patch is applied and byte-verified but its ecosystem has no install hook configured and is not declared in the manifest's `setup.manual`, so it is omitted from the document (Property 7). |
 | `stale_install`           | `skipped`        | vex (in-run `scan --mode hosted --vex`): a hosted stale-install probe found positively unpatched installed bytes, so the purl is omitted even under `--vex-no-verify` (see the gem / Python stale-install guards). |
-| `record_unavailable`      | `skipped`        | vex (manifest-less): a lockfile-wired patch has no local record (manifest, redirect ledger, vendor ledger) and none could be fetched — `--offline`, transport error, 404, or a refused (paid) patch. Omitted, never attested from the `socket-patch.vendor.json` marker. |
+| `record_unavailable`      | `skipped`        | vex (manifest-less): a lockfile-wired patch has no local record (manifest, this run's hosted records or a pre-v5 redirect ledger, vendor ledger) and none could be fetched — `--offline`, transport error, 404, or a refused (paid) patch. Omitted, never attested from the `socket-patch.vendor.json` marker. |
 | `record_mismatch`         | `skipped`        | vex (manifest-less): the record found for a wired patch names another package or another patch uuid than the wiring. |
 | `vendor_unwired`          | `skipped`        | vex: a vendor-ledger entry whose committed artifact no lockfile/config wires any more (reverted lock, leftover ledger or artifact). Applies under `--no-verify` too. |
-| `redirect_unwired`        | `skipped`        | vex: a redirect-ledger record whose hosted patch no lockfile wires any more (and no manifest entry owns the purl). Applies under `--no-verify` too. |
+| `redirect_unwired`        | `skipped`        | vex: a hosted record (this run's, or a pre-v5 redirect ledger's) whose hosted patch no lockfile wires any more (and no manifest entry owns the purl). Applies under `--no-verify` too. |
 | `wiring_conflict`         | `skipped`        | vex (manifest-less): the lockfiles wire one package to two or more different patches (e.g. a stale sibling lock); which one the build installs is undecidable, so none is attested. |
 | `hash_mismatch` / `not_applied` / `file_not_found` / `package_not_found` / `no_files` / `vendor_*` | `skipped` | vex: verification omissions — the installed copy (agent / hosted) or the committed artifact (`vendor_hash_mismatch`, `vendor_artifact_missing`, `vendor_artifact_unreadable`, `vendor_inventory_mismatch`, `vendor_uuid_mismatch`, `vendor_path_unsafe`) does not carry the patched bytes, or nothing is installed. `vendor_manifest_unverifiable`: a vendored vlt directory verified without its vendor ledger (from `vlt-lock.json` alone) holds a `package.json` with its devDependencies stripped, and the patched `package.json` blob is not in `.socket/blobs`, so it cannot be checked. A lockfile-pinned hosted reference with nothing installed attests instead of `package_not_found` (see "Manifest-less VEX"). |
 | `lockfile_unreadable` / `lockfile_unparseable` / `patched_ref_invalid` / `patched_ref_unattributable` | run-level `warnings[]` | vex (every form): lockfile-discovery diagnostics — see "Manifest-less VEX (lockfile discovery)". Never flip the exit on their own. |
@@ -1284,10 +1301,17 @@ Every `--json` invocation emits a single JSON object that follows the **unified
 | `cargo_copy_untaggable` | `failed` (error prefix) | vendor / scan / get `--mode vendored` (cargo, v5.0): the copy's `Cargo.toml` has no literal `[package] version` string that can be rewritten byte-exactly (or it names another version); nothing is swapped in. A dry run over an already-vendored copy reports the same failure; a patch-service crate that cannot be tagged is a miss (`vendor_prebuilt_layout_mismatch`: `auto` builds locally, `service` fails `vendor_prebuilt_required`). |
 | `cargo_wiring_restored` | `skipped` (advisory note) | repair (v5.0): a vendored crate's Cargo.lock entry was detached with no Socket-owned `[patch]` pointing at its committed copy (a pre-v5 release overwrote its crate-named config key when a second version was vendored); the manifest entry is written back and the ledger updated (dry run: "would restore"). A `vendor` re-run heals the same state as a plain re-vendor. |
 | `cargo_manifest_unreadable` / `cargo_manifest_unparseable` / `cargo_manifest_symlink_unsupported` / `cargo_manifest_not_workspace_root` / `cargo_manifest_patch_source_alias` | `failed` | vendor / scan / get `--mode vendored` (cargo, v5.0): the workspace-root `Cargo.toml` cannot carry the vendored `[patch.crates-io]` entry (or cargo would ignore it there) — see the cargo caveat under "Vendored mode". Refused before any write. |
-| `vendor_would_revert_redirect` / `vendor_takeover_reverted_redirect` | `skipped` (advisory event) | vendor / scan / get `--mode vendored` over a hosted-redirected purl (cargo and the npm family, bun included): dry run — the per-purl hosted revert was PROBED and would succeed (for bun, only after the Bun vendored preflight accepted the lock; a refused lock is previewed as the wet run's `failed <code>` instead) / wet run — the hosted lockfile edits were reverted to their pre-redirect registry values and the redirect-ledger record dropped before vendoring (mode takeover). Fires on the run that takes over, not on re-runs. |
-| `redirect_revert_failed` | `failed` | vendor / scan / get `--mode vendored` (dry and wet): the per-purl hosted revert refused (drifted lock, missing original fragment, an undecidable ledger edit) — nothing vendored for the purl, hosted wiring left in place, exit 1 `partial_failure`; the detail names the remedy (for bun: an unscoped `socket-patch rollback`). |
+| `vendor_would_revert_redirect` / `vendor_takeover_reverted_redirect` | `skipped` (advisory event) | vendor / scan / get `--mode vendored` over a hosted pin (every ecosystem, v5.0): dry run — the upstream restore was resolved (registry lookups included) and would succeed (for bun, only after the Bun vendored preflight accepted the lock; a refused lock is previewed as the wet run's `failed <code>` instead) / wet run — the pin's lock entries were restored to their upstream registry entry before vendoring (mode takeover; detail `<purl> was hosted; restored its upstream registry entry (<files>) before vendoring (mode takeover)`), so `vendor --revert` later returns to upstream. Fires on the run that takes over, not on re-runs. |
+| `redirect_revert_failed` | `failed` | vendor / scan / get `--mode vendored` (dry and wet): the upstream restore of a hosted pin was refused (`--offline`, a registry that does not answer, a lock shape the restore refuses — for `bun.lockb`, a record the codec cannot rebuild) — detail `cannot vendor over the live hosted pin: cannot restore <purl> to its upstream registry entry: <why>; restore it from version control instead (`git checkout -- <files>`)`; nothing vendored for the purl, hosted wiring left in place, exit 1 `partial_failure`. |
+| `patch_fetch_failed` (eject) | `failed` | vendor eject (v5.0): a hosted pin's patch record could not be fetched from `…/patches/view/<uuid>`; the whole eject is refused (`eject_refused`), nothing touched, exit 1. |
+| `eject_refused` | top-level `errorCode` (`status: "error"`) | vendor eject (v5.0): a record fetch failed or a pin's upstream restore was refused while planning; nothing was changed, exit 1. |
+| `eject_planned` | `applied` (reason) | vendor eject `--dry-run` (v5.0): the pin would be restored upstream and vendored; nothing written. |
+| `eject_rolled_back` | warning | vendor eject (v5.0): a package failed after the restore began; every touched file was put back from the pre-eject snapshot, so the project is still hosted; `partial_failure`, exit 1. |
+| `eject_rollback_failed` | top-level `errorCode` | vendor eject (v5.0): putting the pre-eject snapshot back failed; the detail names the files to `git checkout --`; exit 1. |
+| `offline_eject_unavailable` | top-level `errorCode` | vendor eject under `--offline` / `SOCKET_OFFLINE` (v5.0): records and registry entries cannot be fetched offline; zero network requests, nothing touched, exit 1. |
+| `hosted_wiring_contested` | top-level `errorCode` (list: warning when it can still list) | rollback / remove / vendor eject / list (v5.0): a lockfile mentions a recognized hosted patch uuid that discovery rejected (or a pin with no lockfile), so the hosted set is not known exactly; refused with nothing touched, exit 1. Remedy: fix or `git checkout` the named lockfile. |
 | `vendor_yarn_berry_cache_unsupported` | `failed` | vendor (yarn berry): lock `cacheKey ≠ 10c0` or non-default `.yarnrc.yml` `compressionLevel` — the cache-zip checksum is not reproducible. |
-| `vendor_yarn_berry_mixed_line_endings` | `failed` | vendor (yarn berry): `yarn.lock` or the root `package.json` mixes CRLF and LF line endings (or holds a bare CR) — no single ending can be kept, and yarn rewrites such a file wholesale on its next install (a mixed lock also fails `--immutable`, YN0028). Refused before any write; `yarn install` normalizes the files. A uniformly CRLF pair is vendored in CRLF. A hosted→vendored takeover (`vendor`, `scan`/`get --mode vendored`) raises this — and the berry `vendor_yarn_berry_cache_unsupported` gates — BEFORE reverting the hosted redirect (dry run too), so a refused purl stays hosted. |
+| `vendor_yarn_berry_mixed_line_endings` | `failed` | vendor (yarn berry): `yarn.lock` or the root `package.json` mixes CRLF and LF line endings (or holds a bare CR) — no single ending can be kept, and yarn rewrites such a file wholesale on its next install (a mixed lock also fails `--immutable`, YN0028). Refused before any write; `yarn install` normalizes the files. A uniformly CRLF pair is vendored in CRLF. A hosted→vendored takeover (`vendor`, `scan`/`get --mode vendored`) raises this — and the berry `vendor_yarn_berry_cache_unsupported` gates — BEFORE restoring the hosted pin's upstream entry (dry run too), so a refused purl stays hosted. |
 | `vendor_override_conflict` | `failed`        | vendor (pnpm/yarn-berry): a user-authored override/resolution for the package already exists. |
 | `vendor_integrity_unverified` | `skipped` (warning) | vendor (pipenv): the lockfile format does not hash-check file entries; the committed wheel bytes are the protection. |
 | `vendor_content_mismatch_overwritten` | `skipped` (warning) | vendor: a staged file matched NEITHER beforeHash nor afterHash (patch built against different bytes, or local edits); the stage was overwritten with the verified patched content and the vendor succeeded. |
@@ -1351,11 +1375,12 @@ Every `--json` invocation emits a single JSON object that follows the **unified
 
 | Code                  | Subcommands                      | Meaning |
 |-----------------------|----------------------------------|---------|
-| `manifest_not_found`  | list, remove, repair, rollback, vex | `.socket/manifest.json` doesn't exist. For `vex` (and `scan --vex`) it fires only when, in addition, NOTHING else names a patch — no redirect-ledger record, no vendor-ledger entry, no lockfile reference — and the message says so (exit 2 standalone; `apply`/`vendor --vex` treat it as their calm no-op). v3.5: `repair` proceeds anyway (vendored phase only) when a vendor ledger or vendor-path lockfile references exist, and exits 0 with a `redirect_only_project` skip (not this error) when the only `.socket/` trace is a hosted-mode `redirect-state.json`. `list` likewise no longer fires this on a hosted-only project: when the hosted redirect ledger holds ≥ 1 `records` entry, the records are listed (exit 0, labeled `details.mode: "hosted"` + `details.ledger`; when the manifest exists too, both stores are shown, purl-sorted with the manifest entry first on a tie). v5.0: `list` reads the vendor ledger the same way — a vendored-only project (every `scan`/`get --mode vendored` project) lists its ledger entries' embedded records labeled `Mode: vendored (recorded in .socket/vendor/state.json)` in human mode — the twin of the hosted `Mode: hosted (recorded in .socket/vendor/redirect-state.json)` line — (`details.mode: "vendored"` + `details.ledger: ".socket/vendor/state.json"` in JSON), exit 0. A standalone-`vendor` entry's fallback `record` lists the same way once no manifest entry covers it (by ledger key or base purl) — the copy manifest-less `vex` attests from, so `list` never reports `manifest_not_found` for a tree whose VEX document attests a patch; while the manifest covers it, only the manifest entry is listed. All stores always come from the SAME project: the ledger is resolved against the root the RESOLVED manifest path implies (its `.socket` parent's parent in the standard layout, else the manifest file's directory — exactly `--cwd` for the default path), so `--manifest-path` into another project reads that project's ledger, never the local one. The error still fires when NONE of the three stores has a record — an edits-only ledger asserts no patches — and a present-but-broken manifest still reports `manifest_invalid`/`manifest_unreadable` regardless of ledger records (corruption is never masked). A malformed ledger degrades to "nothing to consult" with a stderr warning, muted by `--silent` (read-only consumer posture; the hosted write path hard-errors instead); `list --json` carries it in the run-level `warnings[]` as `redirect_ledger_corrupt` instead of on stderr. v5.0: `rollback` likewise proceeds manifest-less when the vendor ledger or the redirect ledger holds work (its error is the legacy `{status: "error", error: "Manifest not found", path}` shape, not this envelope code); only the truly-empty project — all three stores absent — keeps the exit-1 error, and a project whose lockfiles still reference `.socket/vendor/` artifacts with NO vendor ledger gets a distinct error naming `socket-patch repair`. `remove` (v5.0) proceeds manifest-less whenever a vendor OR redirect ledger file exists (two existence probes before the lock; the stores themselves load under it): ANY vendor-ledger entry matching the identifier — detached or not — is removed through the ledger path (`--preserve-state` and drift-keeps behave exactly as on the manifest path), a hosted-only match unwinds its redirect, and when the ledgers exist but hold nothing for the identifier the error is `not_found` (exit 1), not this code — `manifest_not_found` fires from `remove` only when all three stores are absent. Manifest entries are removed in sorted purl order. |
+| `manifest_not_found`  | list, remove, repair, rollback, vex | `.socket/manifest.json` doesn't exist. For `vex` (and `scan --vex`) it fires only when, in addition, NOTHING else names a patch — no vendor-ledger entry, no lockfile reference (hosted or vendored) — and the message says so (exit 2 standalone; `apply`/`vendor --vex` treat it as their calm no-op). v3.5: `repair` proceeds anyway (vendored phase only) when a vendor ledger or vendor-path lockfile references exist, and exits 0 with a `redirect_only_project` skip (not this error) when the project's only patch state is hosted pins in its lockfiles (v5.0; or a pre-v5 `redirect-state.json`). `list` likewise no longer fires this on a hosted-only project: v5.0 lists every hosted pin the lockfiles wire (exit 0, labeled `details.mode: "hosted"` + `details.lockfiles: [<files wiring it>]` — no `details.ledger`, since hosted mode keeps none; when the manifest exists too, both are shown, purl-sorted with the manifest entry first on a tie). A pin carries its uuid and empty details unless a pre-v5 redirect ledger records the same purl and uuid (read for migration only: its record supplies the vulnerabilities / tier / description); a pre-v5 ledger record whose pin is in no lockfile is not listed. v5.0: `list` reads the vendor ledger the same way — a vendored-only project (every `scan`/`get --mode vendored` project) lists its ledger entries' embedded records labeled `Mode: vendored (recorded in .socket/vendor/state.json)` in human mode — the twin of the hosted `Mode: hosted (wired in <lockfiles>)` line — (`details.mode: "vendored"` + `details.ledger: ".socket/vendor/state.json"` in JSON), exit 0. A standalone-`vendor` entry's fallback `record` lists the same way once no manifest entry covers it (by ledger key or base purl) — the copy manifest-less `vex` attests from, so `list` never reports `manifest_not_found` for a tree whose VEX document attests a patch; while the manifest covers it, only the manifest entry is listed. All sources always come from the SAME project: the vendor ledger and the lockfiles are resolved against the root the RESOLVED manifest path implies (its `.socket` parent's parent in the standard layout, else the manifest file's directory — exactly `--cwd` for the default path), so `--manifest-path` into another project reads that project's state, never the local one. The error still fires when NONE of the three sources has a patch, and a present-but-broken manifest still reports `manifest_invalid`/`manifest_unreadable` regardless (corruption is never masked). A malformed pre-v5 redirect ledger degrades to "nothing to consult" with a stderr warning, muted by `--silent` (the pins still list); `list --json` carries it in the run-level `warnings[]` as `redirect_ledger_corrupt` instead of on stderr. v5.0: `rollback` likewise proceeds manifest-less when the vendor ledger or the lockfiles' hosted pins hold work (its error is the legacy `{status: "error", error: "Manifest not found", path}` shape, not this envelope code); only the truly-empty project — no manifest, no vendor ledger, no hosted pin (a lone pre-v5 redirect ledger is deleted, exit 0) — keeps the exit-1 error, and a project whose lockfiles still reference `.socket/vendor/` artifacts with NO vendor ledger gets a distinct error naming `socket-patch repair`. `remove` (v5.0) proceeds manifest-less whenever a vendor ledger file exists or the lockfiles pin a hosted patch (an existence probe and the read-only hosted-pin discovery before the lock; the vendor ledger loads under it): ANY vendor-ledger entry matching the identifier — detached or not — is removed through the ledger path (`--preserve-state` and drift-keeps behave exactly as on the manifest path), a hosted-only match restores its upstream registry entry, and when that state exists but holds nothing for the identifier the error is `not_found` (exit 1), not this code — `manifest_not_found` fires from `remove` only when all three sources are empty. Manifest entries are removed in sorted purl order. |
 | `manifest_invalid`    | list, remove                     | Manifest exists but is unparseable. |
 | `manifest_unreadable` | list, remove, vex                | I/O error reading manifest (vex: also an unparseable manifest; exit 2). |
-| `no_patches`          | vex                              | The manifest file exists but is empty AND no ledger record or lockfile reference names a patch (exit 1). |
-| `redirect_ledger_corrupt` / `vendor_ledger_corrupt` | vex (every form) | `.socket/vendor/redirect-state.json` / `.socket/vendor/state.json` exists but is malformed or unreadable. Both ledgers are attestation inputs (records and liveness), so attesting from a partial view is refused (exit 2 standalone; the host command fails). A missing ledger is simply empty. |
+| `no_patches`          | vex                              | The manifest file exists but is empty AND no vendor-ledger record or lockfile reference names a patch (exit 1). |
+| `vendor_ledger_corrupt` | vex (every form) | `.socket/vendor/state.json` exists but is malformed or unreadable. The vendor ledger is an attestation input (records and liveness), so attesting from a partial view is refused (exit 2 standalone; the host command fails). A missing ledger is simply empty. |
+| `redirect_ledger_corrupt` | vex, list (`warnings[]`) | v5.0: a WARNING, no longer an error — a pre-v5 `.socket/vendor/redirect-state.json` exists but is malformed or unreadable. v5 hosted mode keeps no ledger (hosted references come from the lockfiles, their records from the API), so the file is only an optional migration record source: its records are not consulted and the run continues. Delete the file or restore it from version control. |
 | `serialize_failed`    | vex                              | The built document could not be serialized (exit 2). |
 | `apply_failed`        | apply                            | apply pipeline error before any patch ran. |
 | `repair_failed`       | repair                           | repair pipeline error. |
@@ -1367,7 +1392,7 @@ Every `--json` invocation emits a single JSON object that follows the **unified
 |--------------|---|
 | `apply`      | `Applied` · `Updated` · `Skipped` (already_patched / package_not_installed / vendored) · `Failed` · `Verified` (dry-run) |
 | `vendor`     | `Applied` (= vendored; `command` routes) · `Skipped` (refusals, warnings, unsupported ecosystems) · `Failed` · `Removed` (reconcile + `--revert`) · `Verified` (dry-run) |
-| `list`       | `Discovered` (with `details.vulnerabilities`, `details.tier`, `details.license`, `details.description`, `details.exportedAt`; hosted redirect-ledger records additionally carry `details.mode: "hosted"` — the constant mode name, whatever opaque mode string the ledger itself carries — and `details.ledger: ".socket/vendor/redirect-state.json"`, both additive and absent on manifest entries; v5.0: vendor-ledger records carry `details.mode: "vendored"` + `details.ledger: ".socket/vendor/state.json"` the same way, and the human listing labels them `Mode: vendored (recorded in .socket/vendor/state.json)`; a `state.json` that cannot be read or parsed degrades to nothing-to-consult with the stderr line `Warning: unreadable vendor ledger (<error>); its vendored patches are not listed` — muted by `--silent`, exit unchanged) |
+| `list`       | `Discovered` (with `details.vulnerabilities`, `details.tier`, `details.license`, `details.description`, `details.exportedAt`; hosted pins (v5.0: one per `(purl, uuid)` the lockfiles wire) additionally carry `details.mode: "hosted"` and `details.lockfiles: [<root-relative files wiring it>]` (no `details.ledger` — hosted mode keeps no ledger; the human listing labels them `Mode: hosted (wired in <files>)`), both additive and absent on manifest entries; v5.0: vendor-ledger records carry `details.mode: "vendored"` + `details.ledger: ".socket/vendor/state.json"` the same way, and the human listing labels them `Mode: vendored (recorded in .socket/vendor/state.json)`; a `state.json` that cannot be read or parsed degrades to nothing-to-consult with the stderr line `Warning: unreadable vendor ledger (<error>); its vendored patches are not listed` — muted by `--silent`, exit unchanged) |
 | `repair`/`gc`| `Downloaded` (or `Verified` on dry-run) · `Rebuilt` (vendored artifacts; `Verified` previews on dry-run) · `Skipped` (vendor_uuid_mismatch) · `Removed` (or `Verified`) · `Failed` events |
 | `remove`     | `Removed` (per purl; `Verified` on dry-run) · artifact-level `Removed`/`Verified` event (with `details.blobsRemoved`, `details.rolledBack`) |
 | `--update`   | `Downloaded` → `Updated` (success) · `Skipped` (already_latest) · `Verified` (dry-run check, reason update_check) — see the Self-update contract section for details fields and top-level error codes |
@@ -1606,7 +1631,7 @@ Exit `1` when `status` is `partialFailure` (any `events[*].action == "failed"`)
 | `1` | Error (missing/invalid manifest, fetch failed, apply failed, selection cancelled in non-JSON mode, etc.) |
 | `2` | Usage error: clap parse failures (unknown flag/value, missing required arg — including the clap-enforced `setup --check --remove` conflict) and the conflicts the commands enforce themselves — `scan`'s cross-mode conflicts (`--mode` combined with a DIFFERENT mode's boolean spelling, rejected in `resolve_mode_flags`), `--detached` without vendored mode and `--mode hosted` with `--global`/`--global-prefix` (same enforcement point); in hosted/vendored `scan` (bare `scan` included), a PATH that is not a directory, a PATH glob matching no directory, and `--json` with more than one project directory (`run_project_dirs`); `remove --preserve-state --skip-rollback` (the no-op quadrant; flag- or env-sourced alike), an unparseable path glob on `scan`/`rollback`, `repair --offline --download-only`. `vex` also exits `2` on hard errors before document generation (see its tri-state table below). **Carve-out**: `get`'s self-enforced conflicts have always exited `1` via its error envelope (`--id`/`--cve`/`--ghsa`/`--package` multi-select, `--one-off --save-only`) and the v3.6 `--mode hosted\|vendored --save-only` conflict deliberately follows that get-internal precedent — changing the existing ones to `2` would be a MAJOR exit-code change |
 
-`list` returns **`0`** for an empty manifest and **`1`** for a missing manifest — these are distinct and load-bearing (a manifest-less project whose vendor or redirect ledger holds records is NOT "missing": `list` reads all three stores and exits 0 — see the `manifest_not_found` row). Every lock-taking subcommand — including `scan`/`get --mode hosted` as of v5.0 — returns **`1`** with `errorCode: lock_held` when another live socket-patch process holds `<.socket>/apply.lock`.
+`list` returns **`0`** for an empty manifest and **`1`** for a missing manifest — these are distinct and load-bearing (a manifest-less project whose vendor ledger holds records or whose lockfiles pin hosted patches is NOT "missing": `list` reads all three sources and exits 0 — see the `manifest_not_found` row). Every lock-taking subcommand — including `scan`/`get --mode hosted` as of v5.0 — returns **`1`** with `errorCode: lock_held` when another live socket-patch process holds `<.socket>/apply.lock`.
 
 `vex` exit codes are tri-state:
 
@@ -1614,7 +1639,7 @@ Exit `1` when `status` is `partialFailure` (any `events[*].action == "failed"`)
 |---|---|
 | `0` | A non-empty OpenVEX document was produced |
 | `1` | Nothing attested: `no_applicable_patches` (every candidate was omitted — by verification, a wiring gate, a missing record, or Property 7; the omissions ride `skipped` events) or `no_patches` (an empty manifest file and nothing wired anywhere) |
-| `2` | Hard error: `manifest_not_found` (no manifest AND no ledger record / lockfile reference anywhere), `manifest_unreadable`, `redirect_ledger_corrupt`, `vendor_ledger_corrupt`, `json_requires_output`, `product_undetected`, `serialize_failed`, `write_failed` |
+| `2` | Hard error: `manifest_not_found` (no manifest AND no vendor-ledger record / lockfile reference anywhere), `manifest_unreadable`, `vendor_ledger_corrupt` (v5.0: `redirect_ledger_corrupt` is a warning), `json_requires_output`, `product_undetected`, `serialize_failed`, `write_failed` |
 
 A missing manifest alone is not an error: a hosted or vendored checkout attests from its lockfiles (see "Manifest-less VEX"). Embedded `--vex` maps every failure to the host command's exit `1`.
 
diff --git a/crates/socket-patch-cli/src/args.rs b/crates/socket-patch-cli/src/args.rs
index 29a09df7..14ea18e8 100644
--- a/crates/socket-patch-cli/src/args.rs
+++ b/crates/socket-patch-cli/src/args.rs
@@ -427,7 +427,7 @@ impl GlobalArgs {
     }
 
     /// The project root whose `.socket/` state stores — manifest, vendor
-    /// ledger, redirect ledger — belong together: the RESOLVED manifest's
+    /// ledger — belong together: the RESOLVED manifest's
     /// directory, stepping out of a standard `.socket/` layout when the
     /// manifest lives in one. For the default `<cwd>/.socket/manifest.json`
     /// this is exactly `cwd`; for a `--manifest-path` into another project
diff --git a/crates/socket-patch-cli/src/commands/get.rs b/crates/socket-patch-cli/src/commands/get.rs
index 76fe2a8b..16b7063c 100644
--- a/crates/socket-patch-cli/src/commands/get.rs
+++ b/crates/socket-patch-cli/src/commands/get.rs
@@ -541,8 +541,8 @@ pub struct GetArgs {
     /// [default: hosted; agent with `--save-only` or `--global`]
     // agent = record in .socket/manifest.json + blobs and apply in place;
     // hosted = rewrite lockfiles so the patched deps resolve to Socket's
-    // hosted patch server (no manifest, no blobs; state lives in the
-    // redirect ledger); vendored = commit patched artifacts under
+    // hosted patch server (no manifest, no blobs, no ledger: the lockfile
+    // is the record); vendored = commit patched artifacts under
     // .socket/vendor/ and rewire the lockfile (no manifest, no blobs; the
     // vendor ledger carries the records). Hosted/vendored runs produce the
     // same on-disk result as `scan --mode hosted|vendored` selecting the
@@ -1222,6 +1222,9 @@ pub struct DownloadParams {
     /// `false`: their patch content is staged in memory and the committed
     /// artifact is the patch — nothing should land in `.socket/blobs`.
     pub persist_blobs: bool,
+    /// `--patch-server-url`: the extra origin whose URLs count as hosted
+    /// when lockfile discovery reads the project's hosted pins.
+    pub patch_server_url: Option<String>,
 }
 
 impl DownloadParams {
@@ -1851,10 +1854,9 @@ type LockRefusals = HashMap<String, (&'static str, String)>;
 /// classic / yarn berry gates and cargo's locked-version gate), over the
 /// patches the phase would otherwise fetch a view for — past the Bun
 /// refusal and the ledger's idempotency skip, which take precedence in the
-/// fetch loop. A purl the hosted redirect ledger claims is left to the
-/// vendor loop: its takeover reverts the hosted lock edits first, and the
-/// revert rewrites the very text the gates read. A redirect ledger that
-/// cannot be read leaves every purl to the loop.
+/// fetch loop. A purl the lockfiles pin hosted is left to the vendor loop:
+/// its takeover restores the upstream lock entry first, and the restore
+/// rewrites the very text the gates read.
 ///
 /// Only a package the vendor loop would hand to its backend is refused
 /// here (see [`crate::commands::vendor::lock_refusals_reaching_backend`]):
@@ -1872,11 +1874,23 @@ async fn lock_text_refusals_for(
 ) -> LockRefusals {
     let cwd = params.cwd.as_path();
     let claimed: Vec<String> =
-        match socket_patch_core::patch::redirect::load_redirect_state(cwd).await {
-            Ok(Some(state)) => state.records.keys().map(|k| canonical_purl(k)).collect(),
-            Ok(None) => Vec::new(),
-            Err(_) => return HashMap::new(),
-        };
+        socket_patch_core::patch::redirect::upstream::HostedPin::all(
+            &socket_patch_core::vex::discover_patched_refs_with(
+                cwd,
+                &socket_patch_core::vex::DiscoverOptions {
+                    patch_server_origins: params
+                        .patch_server_url
+                        .iter()
+                        .filter(|url| !url.trim().is_empty())
+                        .cloned()
+                        .collect(),
+                },
+            )
+            .await,
+        )
+        .into_iter()
+        .map(|pin| canonical_purl(&pin.purl))
+        .collect();
     let candidates: Vec<(&str, &str)> = selected
         .iter()
         .filter(|sr| bun_refusal.filter(|r| r.applies_to(&sr.purl)).is_none())
@@ -3663,12 +3677,13 @@ fn get_download_params(args: &GetArgs, save_only: bool, persist_blobs: bool) ->
         strict: args.common.strict,
         ecosystems: args.common.ecosystems.clone(),
         persist_blobs,
+        patch_server_url: args.common.patch_server_url.clone(),
     }
 }
 
 /// `get … --mode hosted`: hand the selected (purl, uuid) pairs to scan's
 /// hosted engine ([`super::scan::boxed_run_redirect_selected`]) — lockfile
-/// rewrite + redirect ledger, no manifest, no blobs — so the on-disk result
+/// rewrite only, no manifest, no blobs, no ledger — so the on-disk result
 /// matches `scan --mode hosted` selecting the same patches. The engine owns
 /// all output (and honors `--dry-run` internally); in JSON mode it nests its
 /// `redirect` block into the get base envelope passed as `scan_result`.
@@ -5223,6 +5238,7 @@ mod tests {
             strict: false,
             ecosystems: None,
             persist_blobs: false,
+            patch_server_url: None,
         }
     }
 
@@ -5891,6 +5907,7 @@ mod tests {
             ecosystems: None,
             // The vendor-detached posture this fn exists for.
             persist_blobs: false,
+            patch_server_url: None,
         }
     }
 
diff --git a/crates/socket-patch-cli/src/commands/list.rs b/crates/socket-patch-cli/src/commands/list.rs
index 6bbc5e76..18956a83 100644
--- a/crates/socket-patch-cli/src/commands/list.rs
+++ b/crates/socket-patch-cli/src/commands/list.rs
@@ -3,7 +3,8 @@ use std::path::Path;
 use clap::Args;
 use socket_patch_core::manifest::operations::read_manifest;
 use socket_patch_core::manifest::schema::{PatchManifest, PatchRecord};
-use socket_patch_core::patch::redirect::{RedirectState, REDIRECT_STATE_REL};
+use socket_patch_core::patch::redirect::upstream::HostedPin;
+use socket_patch_core::patch::redirect::RedirectState;
 use socket_patch_core::telemetry::track_patch_listed;
 use socket_patch_core::vendor::state::{VendorEntry, VENDOR_STATE_REL};
 
@@ -26,9 +27,9 @@ pub struct ListArgs {
 enum Source {
     /// A `.socket/manifest.json` entry (agent mode).
     Manifest,
-    /// A hosted redirect-ledger record: `scan --mode hosted` records its
-    /// patches ONLY in `.socket/vendor/redirect-state.json` and never
-    /// writes the manifest.
+    /// A hosted pin the lockfiles wire: `scan --mode hosted` keeps no
+    /// ledger and never writes the manifest, so the lockfiles are the only
+    /// record of a hosted patch.
     Hosted,
     /// A vendor-ledger record: vendored mode is manifest-free, so every
     /// `scan`/`get --mode vendored` patch lives ONLY in
@@ -39,14 +40,14 @@ enum Source {
     Vendored,
 }
 
-/// The `(mode, ledger)` label pair for a ledger-sourced record — the shared
-/// constant labels, never a ledger's own opaque `mode` string (see
-/// `HOSTED_MODE_LABEL`'s docs) — or `None` for a manifest entry. Shared by
-/// the JSON `details` and the human `Mode:` line.
+/// The `(mode, ledger)` label pair for a vendor-ledger record — the shared
+/// constant label, never a ledger's own opaque `mode` string (see
+/// `HOSTED_MODE_LABEL`'s docs) — or `None` for a manifest entry or a hosted
+/// pin (which has no ledger; see [`ListEntry::lockfiles`]). Shared by the
+/// JSON `details` and the human `Mode:` line.
 fn ledger_label(source: Source) -> Option<(&'static str, &'static str)> {
     match source {
-        Source::Manifest => None,
-        Source::Hosted => Some((crate::commands::HOSTED_MODE_LABEL, REDIRECT_STATE_REL)),
+        Source::Manifest | Source::Hosted => None,
         Source::Vendored => Some((crate::commands::VENDORED_MODE_LABEL, VENDOR_STATE_REL)),
     }
 }
@@ -56,12 +57,62 @@ struct ListEntry<'a> {
     purl: &'a str,
     record: &'a PatchRecord,
     source: Source,
+    /// The lockfiles wiring a hosted pin (empty for the other sources).
+    lockfiles: &'a [String],
+}
+
+/// A hosted pin as `list` shows it: the lockfiles wiring it, and its
+/// record — from a pre-v5 redirect ledger when one still describes this
+/// exact pin (read for migration only), else just the uuid (the details
+/// live on the API; `vex` fetches them).
+pub(crate) struct HostedListing {
+    pub purl: String,
+    pub record: PatchRecord,
+    pub lockfiles: Vec<String>,
+}
+
+impl HostedListing {
+    /// One listing per hosted pin in `pins`, detailed from `legacy` where
+    /// it records the same purl and uuid.
+    pub(crate) fn from_pins(pins: &[HostedPin], legacy: Option<&RedirectState>) -> Vec<Self> {
+        let canon = |p: &str| {
+            socket_patch_core::utils::purl::normalize_purl(
+                socket_patch_core::utils::purl::strip_purl_qualifiers(p),
+            )
+            .into_owned()
+        };
+        pins.iter()
+            .map(|pin| {
+                let record = legacy
+                    .and_then(|l| {
+                        l.records
+                            .iter()
+                            .find(|(k, r)| canon(k) == canon(&pin.purl) && r.uuid == pin.uuid)
+                            .map(|(_, r)| r.clone())
+                    })
+                    .unwrap_or_else(|| PatchRecord {
+                        uuid: pin.uuid.clone(),
+                        exported_at: String::new(),
+                        files: Default::default(),
+                        vulnerabilities: Default::default(),
+                        description: String::new(),
+                        license: String::new(),
+                        tier: String::new(),
+                    });
+                HostedListing {
+                    purl: pin.purl.clone(),
+                    record,
+                    lockfiles: pin.files.clone(),
+                }
+            })
+            .collect()
+    }
 }
 
 /// Every listable record from all three stores, in a stable order: by
 /// PURL, then manifest < hosted < vendored when one purl appears in more
 /// than one. The record maps (`HashMap` manifest and vendor ledger /
-/// `BTreeMap` redirect ledger) never impose an order shared consumers could
+/// hosted pins) never impose an order shared consumers could
 /// diff, so the sort here is the contract. Only vendor entries whose
 /// embedded record stands on its own fold in
 /// ([`crate::commands::vendor_record_is_unowned`], the rule `vex` attests
@@ -72,7 +123,7 @@ struct ListEntry<'a> {
 /// purl. A legacy entry with no embedded record never folds in.
 fn combined_entries<'a>(
     manifest: Option<&'a PatchManifest>,
-    redirect: Option<&'a RedirectState>,
+    hosted: &'a [HostedListing],
     vendor: Option<&'a std::collections::HashMap<String, VendorEntry>>,
 ) -> Vec<ListEntry<'a>> {
     let mut entries: Vec<ListEntry<'a>> = Vec::new();
@@ -81,15 +132,15 @@ fn combined_entries<'a>(
             purl,
             record,
             source: Source::Manifest,
+            lockfiles: &[],
         }));
     }
-    if let Some(redirect) = redirect {
-        entries.extend(redirect.records.iter().map(|(purl, record)| ListEntry {
-            purl,
-            record,
-            source: Source::Hosted,
-        }));
-    }
+    entries.extend(hosted.iter().map(|h| ListEntry {
+        purl: &h.purl,
+        record: &h.record,
+        source: Source::Hosted,
+        lockfiles: &h.lockfiles,
+    }));
     if let Some(vendor) = vendor {
         entries.extend(vendor.iter().filter_map(|(purl, entry)| {
             let record = entry
@@ -100,6 +151,7 @@ fn combined_entries<'a>(
                 purl,
                 record,
                 source: Source::Vendored,
+                lockfiles: &[],
             })
         }));
     }
@@ -162,6 +214,10 @@ fn build_list_envelope(entries: &[ListEntry<'_>]) -> Envelope {
             details["mode"] = serde_json::json!(mode);
             details["ledger"] = serde_json::json!(ledger);
         }
+        if entry.source == Source::Hosted {
+            details["mode"] = serde_json::json!(crate::commands::HOSTED_MODE_LABEL);
+            details["lockfiles"] = serde_json::json!(entry.lockfiles);
+        }
 
         env.record(
             PatchEvent::new(PatchAction::Discovered, entry.purl.to_string())
@@ -248,6 +304,13 @@ fn format_entry(entry: &ListEntry<'_>, color: bool) -> String {
         // Same labeling rule as the JSON details.
         lines.push(format!("  Mode: {mode} (recorded in {ledger})"));
     }
+    if entry.source == Source::Hosted {
+        lines.push(format!(
+            "  Mode: {} (wired in {})",
+            crate::commands::HOSTED_MODE_LABEL,
+            sanitize(&entry.lockfiles.join(", "))
+        ));
+    }
     lines.extend(field("  ", "Tier", &patch.tier));
     lines.extend(field("  ", "License", &patch.license));
     lines.extend(field("  ", "Exported", &patch.exported_at));
@@ -334,22 +397,20 @@ pub async fn run(args: ListArgs) -> i32 {
         }
     };
 
-    // Hosted-mode patches live ONLY in the redirect ledger and vendored-mode
-    // patches ONLY in the vendor ledger, so `list` consults both alongside
-    // the manifest — leniently (a malformed ledger degrades to "nothing to
-    // consult", surfaced on stderr unless --silent; the write paths
-    // hard-error on it instead), and always from the SAME project as the
-    // manifest (`project_root` steps out of the manifest's `.socket/`):
-    // with `--manifest-path` pointing at another project, reading the LOCAL
-    // cwd's ledgers would interleave two projects' patch state (and a local
-    // ledger could suppress the flagged project's manifest_not_found).
+    // Hosted-mode patches live ONLY in the lockfiles (v5 keeps no hosted
+    // ledger) and vendored-mode patches ONLY in the vendor ledger, so
+    // `list` consults both alongside the manifest — always from the SAME
+    // project as the manifest (`project_root` steps out of the manifest's
+    // `.socket/`): with `--manifest-path` pointing at another project,
+    // reading the LOCAL cwd's state would interleave two projects' patches.
     //
-    // Under --json a corrupt redirect ledger rides the envelope's
-    // `warnings[]` (stdout is the machine channel; a stderr-only warning
-    // would vanish for JSON consumers), the same split `update` uses.
+    // A pre-v5 redirect ledger is read (never written) only to detail the
+    // hosted pins it still describes; a malformed one degrades to "nothing
+    // to consult", surfaced on stderr unless --silent, or in the envelope's
+    // `warnings[]` under --json.
     let project_root = args.common.project_root();
     let mut warnings: Vec<RunWarning> = Vec::new();
-    let redirect_state =
+    let legacy_redirect =
         match socket_patch_core::patch::redirect::load_redirect_state(&project_root).await {
             Ok(state) => state,
             Err(corrupt) => {
@@ -364,19 +425,37 @@ pub async fn run(args: ListArgs) -> i32 {
                 None
             }
         };
+    let inventory = crate::commands::hosted_inventory(&args.common, &project_root).await;
+    let hosted = HostedListing::from_pins(&inventory.pins, legacy_redirect.as_ref());
+    // Contested hosted wiring cannot be listed as patches, but it is hosted
+    // state: surface it (stderr / `warnings[]`), never hide it.
+    let contested = inventory.contested_refusal();
+    if let Some(detail) = &contested {
+        if args.common.json {
+            warnings.push(RunWarning {
+                code: "hosted_wiring_contested".to_string(),
+                detail: detail.clone(),
+            });
+        } else if !args.common.silent {
+            eprintln!("Warning (hosted_wiring_contested): {detail}");
+        }
+    }
     let vendor_state =
         crate::commands::load_vendor_state_lenient(&project_root, args.common.silent).await;
 
-    // `combined_entries` folds only ledger RECORDS in (an edits-only
-    // redirect ledger — post-takeover residue / a degraded record-fetch-
-    // failed run — and a record-less legacy vendor entry assert no
-    // patches), so entry emptiness is the whole exit predicate.
+    // `combined_entries` folds only real records in (a record-less legacy
+    // vendor entry asserts no patch), so entry emptiness is the whole exit
+    // predicate.
     let entries = combined_entries(
         manifest.as_ref(),
-        redirect_state.as_ref(),
+        &hosted,
         vendor_state.as_ref().map(|s| &s.entries),
     );
     if manifest.is_none() && entries.is_empty() {
+        if let Some(detail) = contested {
+            emit_error(&args, "hosted_wiring_contested", detail, warnings);
+            return 1;
+        }
         // No manifest AND no ledger records: nothing is listable anywhere.
         emit_error(
             &args,
@@ -422,11 +501,10 @@ mod tests {
     use socket_patch_core::manifest::schema::{PatchFileInfo, PatchRecord, VulnerabilityInfo};
     use std::collections::HashMap;
 
-    /// Envelope for a manifest-only listing (no redirect ledger) — the shape
-    /// most tests below need; the hosted tests call `combined_entries`
-    /// directly with a `RedirectState`.
+    /// Envelope for a manifest-only listing (no hosted pins, no vendor
+    /// ledger) — the shape most tests below need.
     fn manifest_envelope(manifest: &PatchManifest) -> Envelope {
-        build_list_envelope(&combined_entries(Some(manifest), None, None))
+        build_list_envelope(&combined_entries(Some(manifest), &[], None))
     }
 
     fn sample_manifest() -> PatchManifest {
@@ -632,25 +710,30 @@ mod tests {
         assert_eq!(paths, vec!["z/a.js", "z/b.js"]);
     }
 
-    /// Hosted redirect-ledger records fold into the envelope labeled apart
-    /// from manifest entries: `details.mode` / `details.ledger` ride the
-    /// hosted events ONLY (additive keys), and the global purl sort holds
-    /// with the manifest entry first when one purl appears in both stores.
+    fn hosted(purl: &str, record: PatchRecord) -> HostedListing {
+        HostedListing {
+            purl: purl.to_string(),
+            record,
+            lockfiles: vec!["package-lock.json".to_string()],
+        }
+    }
+
+    /// Hosted pins fold into the envelope labeled apart from manifest
+    /// entries: `details.mode` / `details.lockfiles` ride the hosted events
+    /// ONLY (additive keys), and the global purl sort holds with the
+    /// manifest entry first when one purl appears in both stores.
     #[test]
-    fn hosted_ledger_records_are_labeled_and_interleaved() {
+    fn hosted_pins_are_labeled_and_interleaved() {
         let manifest = sample_manifest();
-        let mut redirect = RedirectState::new();
         let mut hosted_record = manifest.patches["pkg:npm/minimist@1.2.2"].clone();
         hosted_record.uuid = "22222222-2222-4222-8222-222222222222".to_string();
         // Same purl as the manifest entry (coexistence) + a distinct one.
-        redirect
-            .records
-            .insert("pkg:npm/minimist@1.2.2".to_string(), hosted_record.clone());
-        redirect
-            .records
-            .insert("pkg:npm/aaa-hosted@1.0.0".to_string(), hosted_record);
+        let pins = vec![
+            hosted("pkg:npm/minimist@1.2.2", hosted_record.clone()),
+            hosted("pkg:npm/aaa-hosted@1.0.0", hosted_record),
+        ];
 
-        let env = build_list_envelope(&combined_entries(Some(&manifest), Some(&redirect), None));
+        let env = build_list_envelope(&combined_entries(Some(&manifest), &pins, None));
         let v: serde_json::Value = serde_json::from_str(&env.to_pretty_json()).unwrap();
         assert_eq!(v["summary"]["discovered"], 3);
         let events = v["events"].as_array().unwrap();
@@ -678,22 +761,53 @@ mod tests {
             "manifest entries must NOT carry the hosted labels: {v}"
         );
         assert_eq!(
-            events[0]["details"]["ledger"],
-            ".socket/vendor/redirect-state.json"
+            events[0]["details"]["lockfiles"],
+            serde_json::json!(["package-lock.json"])
+        );
+        assert!(
+            events[0]["details"].get("ledger").is_none(),
+            "a hosted pin names no ledger: {v}"
         );
     }
 
+    /// A pre-v5 redirect ledger details only the pins it records with the
+    /// same uuid; any other pin lists with its uuid alone.
+    #[test]
+    fn legacy_ledger_details_only_matching_pins() {
+        let manifest = sample_manifest();
+        let record = manifest.patches["pkg:npm/minimist@1.2.2"].clone();
+        let mut legacy = RedirectState::new();
+        legacy
+            .records
+            .insert("pkg:npm/minimist@1.2.2".to_string(), record.clone());
+        let pin = |purl: &str, uuid: &str| HostedPin {
+            purl: purl.to_string(),
+            uuid: uuid.to_string(),
+            files: vec!["yarn.lock".to_string()],
+        };
+        let listings = HostedListing::from_pins(
+            &[
+                pin("pkg:npm/minimist@1.2.2", &record.uuid),
+                pin("pkg:npm/other@1.0.0", "33333333-3333-4333-8333-333333333333"),
+            ],
+            Some(&legacy),
+        );
+        assert_eq!(listings[0].record, record);
+        assert_eq!(listings[1].record.uuid, "33333333-3333-4333-8333-333333333333");
+        assert!(listings[1].record.vulnerabilities.is_empty());
+        assert_eq!(listings[1].lockfiles, vec!["yarn.lock".to_string()]);
+    }
+
     /// A hosted-only listing (no manifest at all) — the shape a purely
     /// hosted-wired project produces.
     #[test]
     fn hosted_only_entries_build_a_success_envelope() {
         let manifest = sample_manifest();
-        let mut redirect = RedirectState::new();
-        redirect.records.insert(
-            "pkg:npm/minimist@1.2.2".to_string(),
+        let pins = vec![hosted(
+            "pkg:npm/minimist@1.2.2",
             manifest.patches["pkg:npm/minimist@1.2.2"].clone(),
-        );
-        let env = build_list_envelope(&combined_entries(None, Some(&redirect), None));
+        )];
+        let env = build_list_envelope(&combined_entries(None, &pins, None));
         let v: serde_json::Value = serde_json::from_str(&env.to_pretty_json()).unwrap();
         assert_eq!(v["status"], "success");
         assert_eq!(v["summary"]["discovered"], 1);
@@ -728,10 +842,7 @@ mod tests {
     fn vendored_ledger_records_are_labeled_and_sorted_last() {
         let manifest = sample_manifest();
         let record = manifest.patches["pkg:npm/minimist@1.2.2"].clone();
-        let mut redirect = RedirectState::new();
-        redirect
-            .records
-            .insert("pkg:npm/minimist@1.2.2".to_string(), record.clone());
+        let pins = vec![hosted("pkg:npm/minimist@1.2.2", record.clone())];
         let mut detached = record.clone();
         detached.uuid = "44444444-4444-4444-8444-444444444444".to_string();
         let mut vendor = HashMap::new();
@@ -751,7 +862,7 @@ mod tests {
 
         let env = build_list_envelope(&combined_entries(
             Some(&manifest),
-            Some(&redirect),
+            &pins,
             Some(&vendor),
         ));
         let v: serde_json::Value = serde_json::from_str(&env.to_pretty_json()).unwrap();
@@ -786,7 +897,7 @@ mod tests {
             "the ledger's embedded record is the one listed: {v}"
         );
 
-        let only = build_list_envelope(&combined_entries(None, None, Some(&vendor)));
+        let only = build_list_envelope(&combined_entries(None, &[], Some(&vendor)));
         let v: serde_json::Value = serde_json::from_str(&only.to_pretty_json()).unwrap();
         assert_eq!(v["status"], "success", "{v}");
         assert_eq!(v["summary"]["discovered"], 2, "{v}");
@@ -850,7 +961,7 @@ mod tests {
         };
 
         assert_eq!(
-            listed(&combined_entries(Some(&manifest), None, Some(&vendor))),
+            listed(&combined_entries(Some(&manifest), &[], Some(&vendor))),
             vec![
                 (
                     "pkg:npm/left-pad@1.3.0".to_string(),
@@ -867,7 +978,7 @@ mod tests {
         );
 
         // No manifest at all: every fallback copy stands on its own.
-        let only = listed(&combined_entries(None, None, Some(&vendor)));
+        let only = listed(&combined_entries(None, &[], Some(&vendor)));
         assert_eq!(only.len(), 3, "{only:?}");
         assert!(
             only.iter().all(|(_, mode, _)| mode == "vendored"),
@@ -899,6 +1010,7 @@ mod tests {
             purl,
             record,
             source: Source::Manifest,
+            lockfiles: &[],
         }
     }
 
@@ -975,13 +1087,13 @@ mod tests {
     fn format_listing_counts_and_separates_entries() {
         assert_eq!(format_listing(&[], false), "No patches found in manifest.");
         let manifest = sample_manifest();
-        let one = combined_entries(Some(&manifest), None, None);
+        let one = combined_entries(Some(&manifest), &[], None);
         let out = format_listing(&one, false);
         assert!(out.starts_with("Found 1 patch:\n\nPackage: "), "{out}");
         assert!(!out.ends_with('\n'), "no trailing blank line: {out:?}");
 
         let multi = multi_entry_manifest();
-        let many = combined_entries(Some(&multi), None, None);
+        let many = combined_entries(Some(&multi), &[], None);
         let out = format_listing(&many, false);
         assert!(
             out.starts_with(&format!("Found {} patches:\n\n", many.len())),
diff --git a/crates/socket-patch-cli/src/commands/mod.rs b/crates/socket-patch-cli/src/commands/mod.rs
index ddda23e2..f30ee99e 100644
--- a/crates/socket-patch-cli/src/commands/mod.rs
+++ b/crates/socket-patch-cli/src/commands/mod.rs
@@ -20,13 +20,10 @@ pub(crate) mod vlt_preflight;
 
 use std::path::Path;
 
-/// The documented name of the mode whose ledger is
-/// `.socket/vendor/redirect-state.json`. Shared by scan's `redirectState`
-/// envelope block and list's hosted event labels so the two surfaces can
-/// never drift, and deliberately a CONSTANT rather than an echo of the
-/// ledger's own `mode` string: that string is opaque to the loader
-/// (pre-rename ledgers carry `"redirect"`), and a consumer dispatching on
-/// these keys must not have to know that history.
+/// The documented name of hosted mode (lockfile pins to Socket-hosted
+/// patched packages; no ledger). Shared by scan's `redirectState` envelope
+/// block and list's hosted event labels so the two surfaces can never
+/// drift.
 pub(crate) const HOSTED_MODE_LABEL: &str = "hosted";
 
 /// The documented name of the mode whose ledger is
@@ -62,35 +59,63 @@ pub(crate) async fn discover_wiring(
     socket_patch_core::vex::discover_patched_refs_with(root, &opts).await
 }
 
-/// Read-only lenient load of the hosted redirect ledger: missing → `None`
-/// (a fresh start); malformed → `None` with the corruption surfaced on
-/// stderr unless `silent`. This is the "read-only consumers may degrade a
-/// malformed ledger to nothing-to-consult, but must surface it" posture
-/// from `load_redirect_state`'s contract — the warning is advisory
-/// (muted by `--silent`, "errors only"), because every path that would
-/// WRITE or ATTEST from the ledger hard-errors on the same corruption
-/// instead. Used by scan's empty-discovery `redirectState` consult; the
-/// main-path consult inlines the same posture so it can flush telemetry
-/// before the warning.
-pub(crate) async fn load_redirect_state_lenient(
-    cwd: &Path,
-    silent: bool,
-) -> Option<socket_patch_core::patch::redirect::RedirectState> {
-    match socket_patch_core::patch::redirect::load_redirect_state(cwd).await {
-        Ok(state) => state,
-        Err(corrupt) => {
-            if !silent {
-                eprintln!("Warning: {corrupt}");
-            }
-            None
-        }
+/// The project's hosted wiring as raw inventory (core
+/// [`HostedInventory`]): the attributable pins management commands act on,
+/// and the contested wiring they must refuse around. VEX eligibility is a
+/// separate judgment over the same discovery.
+///
+/// [`HostedInventory`]: socket_patch_core::patch::redirect::upstream::HostedInventory
+pub(crate) async fn hosted_inventory(
+    common: &crate::args::GlobalArgs,
+    root: &Path,
+) -> socket_patch_core::patch::redirect::upstream::HostedInventory {
+    socket_patch_core::patch::redirect::upstream::HostedInventory::of(
+        &discover_wiring(common, root).await,
+    )
+}
+
+/// The project's hosted state, v5-style: v5 hosted mode keeps no ledger,
+/// so the hosted pins [`discover_wiring`] finds in the lockfiles are the
+/// whole record. Shaped as a [`RedirectState`] for the readers that classify
+/// hosted against vendored state (one uuid-only record per pinned purl, no
+/// edits) — it is never persisted.
+///
+/// [`RedirectState`]: socket_patch_core::patch::redirect::RedirectState
+pub(crate) async fn hosted_state_from_lockfiles(
+    common: &crate::args::GlobalArgs,
+    root: &Path,
+) -> socket_patch_core::patch::redirect::RedirectState {
+    hosted_state_from_pins(&socket_patch_core::patch::redirect::upstream::HostedPin::all(
+        &discover_wiring(common, root).await,
+    ))
+}
+
+/// [`hosted_state_from_lockfiles`] over already-discovered pins. A purl
+/// pinned to several uuids (different lockfiles) keeps the first.
+pub(crate) fn hosted_state_from_pins(
+    pins: &[socket_patch_core::patch::redirect::upstream::HostedPin],
+) -> socket_patch_core::patch::redirect::RedirectState {
+    let mut state = socket_patch_core::patch::redirect::RedirectState::new();
+    for pin in pins {
+        state
+            .records
+            .entry(pin.purl.clone())
+            .or_insert_with(|| socket_patch_core::manifest::schema::PatchRecord {
+                uuid: pin.uuid.clone(),
+                exported_at: String::new(),
+                files: Default::default(),
+                vulnerabilities: Default::default(),
+                description: String::new(),
+                license: String::new(),
+                tier: String::new(),
+            });
     }
+    state
 }
 
 /// Read-only lenient load of the vendor ledger (`.socket/vendor/state.json`):
 /// missing → an empty ledger; malformed/unreadable → `None` with the
-/// problem surfaced on stderr unless `silent`. The vendor twin of
-/// [`load_redirect_state_lenient`], with the same posture: a read-only
+/// problem surfaced on stderr unless `silent`. A read-only
 /// consumer (`list`) degrades a broken ledger to nothing-to-consult but
 /// must say so, while every path that writes or attests from it fails
 /// closed instead.
diff --git a/crates/socket-patch-cli/src/commands/remove.rs b/crates/socket-patch-cli/src/commands/remove.rs
index 9ce95401..c21fbfd7 100644
--- a/crates/socket-patch-cli/src/commands/remove.rs
+++ b/crates/socket-patch-cli/src/commands/remove.rs
@@ -3,9 +3,7 @@ use socket_patch_core::api::client::get_api_client_with_overrides;
 use socket_patch_core::manifest::cleanup_blobs::format_bytes;
 use socket_patch_core::manifest::operations::{read_manifest, write_manifest};
 use socket_patch_core::manifest::schema::PatchManifest;
-use socket_patch_core::patch::redirect::{
-    load_redirect_state, persist_redirect_state, RedirectState, REDIRECT_STATE_REL,
-};
+use socket_patch_core::patch::redirect::upstream::HostedPin;
 use socket_patch_core::telemetry::{track_patch_remove_failed, track_patch_removed};
 use socket_patch_core::utils::purl::patch_matches;
 use socket_patch_core::vendor::{
@@ -38,15 +36,15 @@ fn vendor_entries_matching(state: &VendorState, identifier: &str) -> Vec<(String
     matches
 }
 
-/// Hosted redirect records matching a remove identifier, sorted.
-fn hosted_records_matching(state: &RedirectState, identifier: &str) -> Vec<String> {
-    let mut matches: Vec<String> = state
-        .records
+/// The lockfiles' hosted pins matching a remove identifier (by purl or
+/// patch uuid), sorted by purl.
+fn hosted_pins_matching(pins: &[HostedPin], identifier: &str) -> Vec<HostedPin> {
+    let mut matches: Vec<HostedPin> = pins
         .iter()
-        .filter(|(purl, rec)| patch_matches(purl, &rec.uuid, identifier))
-        .map(|(purl, _)| purl.clone())
+        .filter(|pin| patch_matches(&pin.purl, &pin.uuid, identifier))
+        .cloned()
         .collect();
-    matches.sort();
+    matches.sort_by(|a, b| a.purl.cmp(&b.purl));
     matches
 }
 
@@ -340,22 +338,33 @@ pub async fn run(args: RemoveArgs) -> i32 {
     let cwd = &args.common.cwd;
 
     // ── state discovery ─────────────────────────────────────────────────
-    // A ledger-only project (vendored mode keeps its records in the vendor
-    // ledger, hosted mode in the redirect ledger — neither writes a
-    // manifest) proceeds manifest-less: `remove` is the per-purl exit path
-    // for those entries. Only cheap EXISTENCE probes run before the lock —
-    // they decide the truly-empty error path, which never locks (a bare
-    // project must not see `.socket/` created and pruned again). The
-    // stores themselves are loaded under the lock below.
+    // A manifest-less project (vendored mode keeps its records in the
+    // vendor ledger; hosted mode keeps none — its lockfile pins are the
+    // record) proceeds manifest-less: `remove` is the per-purl exit path
+    // for those entries. Only cheap probes run before the lock — they
+    // decide the truly-empty error path, which never locks (a bare project
+    // must not see `.socket/` created and pruned again). The vendor ledger
+    // is loaded under the lock below; the hosted pins come from read-only
+    // lockfile discovery (the restore re-reads every file under the lock).
     let manifest_missing = tokio::fs::metadata(&manifest_path).await.is_err();
+    let hosted_inventory = crate::commands::hosted_inventory(&args.common, cwd).await;
+    let hosted_pins: Vec<HostedPin> = hosted_inventory.pins.clone();
     if manifest_missing {
         let vendor_ledger_exists = tokio::fs::metadata(cwd.join(VENDOR_STATE_REL))
             .await
             .is_ok();
-        let redirect_ledger_exists = tokio::fs::metadata(cwd.join(REDIRECT_STATE_REL))
-            .await
-            .is_ok();
-        if !vendor_ledger_exists && !redirect_ledger_exists {
+        if !vendor_ledger_exists && hosted_pins.is_empty() {
+            // Contested hosted wiring is still hosted state: name it
+            // instead of reporting a bare project.
+            if let Some(refusal) = hosted_inventory.contested_refusal() {
+                emit_error_envelope(
+                    args.common.json,
+                    args.common.dry_run,
+                    "hosted_wiring_contested",
+                    refusal,
+                );
+                return 1;
+            }
             emit_error_envelope(
                 args.common.json,
                 args.common.dry_run,
@@ -453,23 +462,18 @@ pub async fn run(args: RemoveArgs) -> i32 {
             }
         }
 
-        // Hosted-only patches likewise have no manifest entry — the
-        // redirect ledger is their only persistence, and `remove` is
-        // their per-purl exit path (the unwind IS the removal). An
-        // unreadable ledger falls through to `not_found`: nothing is
-        // mutated on that path.
-        if let Ok(Some(redirect_state)) = load_redirect_state(cwd).await {
-            let hosted_matches = hosted_records_matching(&redirect_state, &args.identifier);
-            if !hosted_matches.is_empty() {
-                return remove_hosted_only(
-                    &args,
-                    hosted_matches,
-                    redirect_state,
-                    api_token.as_deref(),
-                    org_slug.as_deref(),
-                )
-                .await;
-            }
+        // Hosted-only patches likewise have no manifest entry — their
+        // lockfile pins are their only persistence, and `remove` is their
+        // per-purl exit path (restoring the upstream entry IS the removal).
+        let hosted_matches = hosted_pins_matching(&hosted_pins, &args.identifier);
+        if !hosted_matches.is_empty() {
+            return remove_hosted_only(
+                &args,
+                hosted_matches,
+                api_token.as_deref(),
+                org_slug.as_deref(),
+            )
+            .await;
         }
 
         emit_not_found(
@@ -516,8 +520,8 @@ pub async fn run(args: RemoveArgs) -> i32 {
     // `--dry-run` previews without mutating, so there is nothing to
     // confirm — skip the prompt (matching the global contract row:
     // "Preview, no mutations"). The prompt names every leg the removal
-    // will touch: the redirect ledger is probed read-only here (the legs
-    // below re-load it and decide for real).
+    // will touch: the hosted pins come from the read-only discovery above
+    // (the legs below decide for real).
     if !args.common.dry_run {
         let (vendored, hosted) = if args.skip_rollback {
             (0, 0)
@@ -526,12 +530,7 @@ pub async fn run(args: RemoveArgs) -> i32 {
                 .as_ref()
                 .map(|st| vendor_entries_matching(st, &args.identifier).len())
                 .unwrap_or(0);
-            let hosted = load_redirect_state(cwd)
-                .await
-                .ok()
-                .flatten()
-                .map(|st| hosted_records_matching(&st, &args.identifier).len())
-                .unwrap_or(0);
+            let hosted = hosted_pins_matching(&hosted_pins, &args.identifier).len();
             (vendored, hosted)
         };
         let prompt = remove_prompt(
@@ -745,75 +744,50 @@ pub async fn run(args: RemoveArgs) -> i32 {
     }
 
     // ── hosted leg ──────────────────────────────────────────────────────
-    // An identifier can also (or only) match hosted records in the
-    // redirect ledger. Supported ecosystems (cargo, npm-family, golang) unwind
-    // per-purl; when the identifier covers EVERY record the whole-ledger
-    // replay serves the rest; otherwise unsupported targets fail closed
-    // BEFORE the manifest mutation. A corrupt ledger skips the leg with a
-    // warning (the identifier may still match other stores).
+    // An identifier can also (or only) match hosted pins in the lockfiles.
+    // Each is restored to its default upstream registry entry; a pin that
+    // cannot be fails closed BEFORE the manifest mutation.
     // `--skip-rollback` leaves hosted wiring untouched, like the vendor
-    // wiring above; `--preserve-state` still unwinds — hosted has no
+    // wiring above; `--preserve-state` still restores — hosted has no
     // preservable local state.
     let mut hosted_reverted_events: Vec<PatchEvent> = Vec::new();
-    // The hosted leg's run-level advisories (e.g.
-    // `redirect_npmrc_allow_remote_modified`): printed as they arrive,
+    // The hosted leg's run-level advisories: printed as they arrive,
     // carried into the success envelope's `warnings[]`.
     let mut hosted_leg_warnings: Vec<(String, String)> = Vec::new();
     if !args.skip_rollback {
-        match load_redirect_state(cwd).await {
-            Err(e) => {
-                if loud {
-                    eprintln!(
-                        "Warning: cannot read the hosted redirect ledger ({e}); hosted \
-                         redirects were not examined"
-                    );
+        let hosted_matches = hosted_pins_matching(&hosted_pins, &args.identifier);
+        if !hosted_matches.is_empty() {
+            let leg = match unwind_hosted(&args.common, &hosted_matches).await {
+                Ok(leg) => {
+                    hosted_leg_warnings.extend(leg.warnings.iter().cloned());
+                    leg
                 }
-            }
-            Ok(None) => {}
-            Ok(Some(mut redirect_state)) => {
-                let hosted_matches = hosted_records_matching(&redirect_state, &args.identifier);
-                if !hosted_matches.is_empty() {
-                    let leg =
-                        match unwind_hosted(&args.common, &hosted_matches, &mut redirect_state)
-                            .await
-                        {
-                            Ok(leg) => {
-                                hosted_leg_warnings.extend(leg.warnings.iter().cloned());
-                                leg
-                            }
-                            Err(err) => {
-                                let (code, msg) = hosted_unwind_error(err, true);
-                                emit_error_envelope(
-                                    args.common.json,
-                                    args.common.dry_run,
-                                    code,
-                                    msg,
-                                );
-                                return 1;
-                            }
-                        };
-                    if args.preserve_state && !leg.reverted.is_empty() && loud {
-                        eprintln!(
-                            "Note: hosted redirects have no preservable local state; \
-                             their ledger records were dropped with the unwound wiring."
-                        );
-                    }
-                    // `run_hosted_leg` printed one line per unwound purl.
-                    printed_progress |= loud && !leg.reverted.is_empty();
-                    let hosted_action = if args.common.dry_run {
-                        PatchAction::Verified
-                    } else {
-                        PatchAction::Removed
-                    };
-                    for purl in &leg.reverted {
-                        hosted_reverted_events.push(
-                            PatchEvent::new(hosted_action, purl.clone()).with_reason(
-                                "hosted_reverted",
-                                "hosted lockfile redirect unwound on remove",
-                            ),
-                        );
-                    }
+                Err(err) => {
+                    let (code, msg) = hosted_unwind_error(err, true);
+                    emit_error_envelope(args.common.json, args.common.dry_run, code, msg);
+                    return 1;
                 }
+            };
+            if args.preserve_state && !leg.reverted.is_empty() && loud {
+                eprintln!(
+                    "Note: hosted wiring has no preservable local state; its lockfile pins \
+                     now resolve upstream."
+                );
+            }
+            // `run_hosted_leg` printed one line per restored purl.
+            printed_progress |= loud && !leg.reverted.is_empty();
+            let hosted_action = if args.common.dry_run {
+                PatchAction::Verified
+            } else {
+                PatchAction::Removed
+            };
+            for purl in &leg.reverted {
+                hosted_reverted_events.push(
+                    PatchEvent::new(hosted_action, purl.clone()).with_reason(
+                        "hosted_reverted",
+                        "hosted lockfile pin restored to the upstream registry on remove",
+                    ),
+                );
             }
         }
     }
@@ -1299,86 +1273,52 @@ async fn revert_vendored_matches(
     Ok(leg)
 }
 
-/// Why a hosted unwind stopped. Each caller renders its own message (the
+/// Why a hosted unwind stopped: a pin the upstream restore refused (or a
+/// write failure). Each caller renders its own message (the
 /// manifest-backed path adds that the manifest was not touched).
-enum HostedUnwindError {
-    /// The ledger could not be persisted after the reverts flushed.
-    Persist(String),
-    /// Scoped targets whose ecosystem has no per-purl hosted revert.
-    Unsupported(Vec<String>),
-    /// A per-purl revert (or the whole-ledger replay) refused.
-    Failed { what: String, why: String },
+struct HostedUnwindError {
+    why: String,
 }
 
-/// Unwind the hosted redirect records in `hosted_matches` and persist the
-/// ledger — FIRST, failure or not: the per-purl reverts flush lockfile
-/// writes as they go, so an early error return without persisting would
-/// strand already-reverted purls' records in the on-disk ledger (lockfiles
-/// and ledger desynced; `list`/VEX attest dead wiring). When the matches
-/// cover EVERY record the whole-ledger replay serves the ecosystems without
-/// a per-purl revert. Shared by the manifest-backed and hosted-only remove
-/// paths.
+/// Restore the hosted pins in `hosted_matches` to their upstream registry
+/// entries. Nothing is written unless every pin resolved (the restore is
+/// all-or-nothing per pin, and a refused pin fails the remove). Shared by
+/// the manifest-backed and hosted-only remove paths.
 async fn unwind_hosted(
     common: &GlobalArgs,
-    hosted_matches: &[String],
-    state: &mut RedirectState,
+    hosted_matches: &[HostedPin],
 ) -> Result<HostedLegOutcome, HostedUnwindError> {
-    let replay_eligible = state.records.keys().all(|p| hosted_matches.contains(p));
-    let before = (state.edits.len(), state.records.len());
-    let leg = run_hosted_leg(common, hosted_matches, state, replay_eligible).await;
+    let leg = run_hosted_leg(common, hosted_matches).await;
     // Printed as soon as the leg returns, so a human run that then fails
     // still says what it did to the files.
     print_hosted_leg_warnings(common, &leg.warnings);
-    if !common.dry_run && (state.edits.len(), state.records.len()) != before {
-        if let Err(e) = persist_redirect_state(&common.cwd, state).await {
-            return Err(HostedUnwindError::Persist(e.to_string()));
-        }
-    }
-    if !leg.unsupported.is_empty() {
-        return Err(HostedUnwindError::Unsupported(leg.unsupported));
+    if let Some((_, why)) = leg.failed.first().cloned() {
+        return Err(HostedUnwindError { why });
     }
-    if let Some((what, why)) = leg.failed.first().cloned() {
-        return Err(HostedUnwindError::Failed { what, why });
+    if let Some(warning) = super::rollback::retire_legacy_redirect_ledger(common).await {
+        print_hosted_leg_warnings(common, std::slice::from_ref(&warning));
     }
     Ok(leg)
 }
 
 /// Error code + message for a stopped hosted unwind.
 fn hosted_unwind_error(err: HostedUnwindError, manifest_backed: bool) -> (&'static str, String) {
-    let note = if manifest_backed {
-        " The manifest was not modified."
-    } else {
-        ""
-    };
-    match err {
-        HostedUnwindError::Persist(e) => (
-            "hosted_revert_failed",
-            format!("failed to persist the hosted redirect ledger: {e}"),
-        ),
-        HostedUnwindError::Unsupported(purls) => (
-            "hosted_revert_unsupported",
-            format!(
-                "no per-purl hosted-redirect revert exists for: {}. Run an unscoped \
-                 `socket-patch rollback` to unwind ALL hosted redirects, or re-run \
-                 `scan --mode hosted` to normalize.{note}",
-                purls.join(", ")
-            ),
-        ),
-        HostedUnwindError::Failed { what, why } => (
-            "hosted_revert_failed",
-            if manifest_backed {
-                format!("could not unwind hosted redirect for {what}: {why}.{note}")
-            } else {
-                format!("could not unwind hosted redirect for {what}: {why}")
-            },
-        ),
-    }
+    // `why` already names the pin (the restore's refusal) or the write
+    // that failed, with its remedy.
+    let HostedUnwindError { why } = err;
+    (
+        "hosted_revert_failed",
+        if manifest_backed {
+            format!("{why}. The manifest was not modified.")
+        } else {
+            why
+        },
+    )
 }
 
-/// Remove path for identifiers that match ONLY hosted redirect records
-/// (no manifest entry, no vendor-ledger entry): confirm, unwind each
-/// record's lockfile wiring, drop it from the redirect ledger, and report
-/// `Removed`/`hosted_reverted` events. Like the ledger-only vendored path,
+/// Remove path for identifiers that match ONLY hosted lockfile pins (no
+/// manifest entry, no vendor-ledger entry): confirm, restore each pin's
+/// upstream registry entry, and report `Removed`/`hosted_reverted` events. Like the ledger-only vendored path,
 /// the unwind IS the removal, so events go through `env.record` and bump
 /// `summary.removed`. `--skip-rollback` is refused (with no manifest
 /// entry to delete, removing a hosted patch can only mean unwinding its
@@ -1386,8 +1326,7 @@ fn hosted_unwind_error(err: HostedUnwindError, manifest_backed: bool) -> (&'stat
 /// preservable local state.
 async fn remove_hosted_only(
     args: &RemoveArgs,
-    hosted_matches: Vec<String>,
-    mut redirect_state: RedirectState,
+    hosted_matches: Vec<HostedPin>,
     api_token: Option<&str>,
     org_slug: Option<&str>,
 ) -> i32 {
@@ -1398,8 +1337,8 @@ async fn remove_hosted_only(
             args.common.dry_run,
             "hosted_state_retained",
             format!(
-                "{} matches only hosted redirect records; removing one means unwinding \
-                 its lockfile redirect, which --skip-rollback prevents",
+                "{} matches only hosted lockfile pins; removing one means restoring its \
+                 upstream registry entry, which --skip-rollback prevents",
                 args.identifier
             ),
         );
@@ -1420,8 +1359,8 @@ async fn remove_hosted_only(
                 "will be"
             }
         );
-        for purl in &hosted_matches {
-            eprintln!("  - {purl}");
+        for pin in &hosted_matches {
+            eprintln!("  - {}", pin.purl);
         }
         eprintln!();
     }
@@ -1442,24 +1381,10 @@ async fn remove_hosted_only(
         return 0;
     }
 
-    let leg = match unwind_hosted(&args.common, &hosted_matches, &mut redirect_state).await {
+    let leg = match unwind_hosted(&args.common, &hosted_matches).await {
         Ok(leg) => leg,
         Err(err) => {
-            match &err {
-                HostedUnwindError::Unsupported(_) => {
-                    track_patch_remove_failed(
-                        "hosted redirect revert unsupported",
-                        api_token,
-                        org_slug,
-                    )
-                    .await;
-                }
-                HostedUnwindError::Failed { .. } => {
-                    track_patch_remove_failed("hosted redirect revert failed", api_token, org_slug)
-                        .await;
-                }
-                HostedUnwindError::Persist(_) => {}
-            }
+            track_patch_remove_failed("hosted redirect revert failed", api_token, org_slug).await;
             let (code, msg) = hosted_unwind_error(err, false);
             emit_error_envelope(args.common.json, args.common.dry_run, code, msg);
             return 1;
@@ -1482,7 +1407,7 @@ async fn remove_hosted_only(
     for purl in &leg.reverted {
         env.record(PatchEvent::new(action, purl.clone()).with_reason(
             "hosted_reverted",
-            "hosted lockfile redirect unwound on remove",
+            "hosted lockfile pin restored to the upstream registry on remove",
         ));
     }
     if args.common.json {
diff --git a/crates/socket-patch-cli/src/commands/repair.rs b/crates/socket-patch-cli/src/commands/repair.rs
index 4fb8ed4d..f4aa08ec 100644
--- a/crates/socket-patch-cli/src/commands/repair.rs
+++ b/crates/socket-patch-cli/src/commands/repair.rs
@@ -64,18 +64,15 @@ pub async fn run(args: RepairArgs) -> i32 {
     let mut vendor_references: Option<Vec<(String, String, String)>> = None;
 
     if tokio::fs::metadata(&manifest_path).await.is_err() {
-        // Hosted (redirect) mode leaves no local artifacts to repair: the
-        // lockfiles point at patch.socket.dev URLs, not `.socket/vendor/...`,
-        // and there is no manifest or vendor ledger. A project whose only
-        // trace is `redirect-state.json` is therefore a no-op for repair —
-        // exit success with an informational skip rather than the
-        // `manifest_not_found` error a bare directory would get. Only cheap
-        // existence probes (and the read-only lockfile scan) run before the
-        // lock, so a project with nothing to repair never grows `.socket/`.
-        let redirect_state = args
-            .common
-            .cwd
-            .join(socket_patch_core::patch::redirect::REDIRECT_STATE_REL);
+        // Hosted mode leaves no local artifacts to repair: the lockfiles
+        // point at patch.socket.dev URLs, not `.socket/vendor/...`, and
+        // there is no manifest or vendor ledger. A project whose only trace
+        // is its hosted lockfile pins (or a pre-v5 `redirect-state.json`)
+        // is therefore a no-op for repair — exit success with an
+        // informational skip rather than the `manifest_not_found` error a
+        // bare directory would get. Only cheap existence probes (and the
+        // read-only lockfile scans) run before the lock, so a project with
+        // nothing to repair never grows `.socket/`.
         let state_file = args
             .common
             .cwd
@@ -88,7 +85,15 @@ pub async fn run(args: RepairArgs) -> i32 {
             vendor_references = Some(refs);
         }
         if !has_vendor_traces {
-            if tokio::fs::metadata(&redirect_state).await.is_ok() {
+            let legacy_ledger = args
+                .common
+                .cwd
+                .join(socket_patch_core::patch::redirect::REDIRECT_STATE_REL);
+            let hosted = tokio::fs::metadata(&legacy_ledger).await.is_ok()
+                || !crate::commands::hosted_inventory(&args.common, &args.common.cwd)
+                    .await
+                    .is_empty();
+            if hosted {
                 let msg = HOSTED_ONLY_REASON;
                 if args.common.json {
                     let mut env = Envelope::new(Command::Repair);
diff --git a/crates/socket-patch-cli/src/commands/rollback.rs b/crates/socket-patch-cli/src/commands/rollback.rs
index 14806e79..12ccdb31 100644
--- a/crates/socket-patch-cli/src/commands/rollback.rs
+++ b/crates/socket-patch-cli/src/commands/rollback.rs
@@ -16,6 +16,7 @@ use socket_patch_core::patch::rollback::{
 };
 use socket_patch_core::telemetry::{track_patch_rollback_failed, track_patch_rolled_back};
 use socket_patch_core::utils::purl::{patch_matches, strip_purl_qualifiers};
+use socket_patch_core::patch::redirect::upstream::HostedPin;
 use socket_patch_core::vendor::{save_state, RevertOpts, VendorState, VendorWarning};
 use std::collections::{HashMap, HashSet};
 use std::path::{Path, PathBuf};
@@ -176,12 +177,7 @@ pub(crate) fn as_question(text: &str) -> String {
 
 /// The default (destructive) rollback's confirmation prompt, naming only
 /// the legs that have work.
-fn rollback_prompt(
-    manifest: usize,
-    vendored: usize,
-    hosted: usize,
-    leftover_edits: usize,
-) -> String {
+fn rollback_prompt(manifest: usize, vendored: usize, hosted: usize) -> String {
     let mut clauses: Vec<String> = Vec::new();
     if manifest > 0 {
         clauses.push(format!(
@@ -206,17 +202,8 @@ fn rollback_prompt(
     }
     if hosted > 0 {
         clauses.push(format!(
-            "unwind {}",
-            plural(hosted, "hosted redirect", "hosted redirects")
-        ));
-    } else if leftover_edits > 0 {
-        clauses.push(format!(
-            "replay {}",
-            plural(
-                leftover_edits,
-                "leftover hosted redirect edit",
-                "leftover hosted redirect edits"
-            )
+            "restore {} to the upstream registry",
+            plural(hosted, "hosted package", "hosted packages")
         ));
     }
     as_question(&join_clauses(&clauses))
@@ -1023,35 +1010,34 @@ async fn run_vendored_leg(
     out
 }
 
-/// Unwind the in-scope hosted redirects: per-purl reverts where they
-/// exist (cargo, npm-family, golang), and — when the scope covers the ENTIRE
-/// record set — the whole-ledger reverse replay for everything else.
-/// Mutates `state`; the caller persists on wet runs.
-pub(crate) async fn run_hosted_leg(
-    common: &GlobalArgs,
-    purls: &[String],
-    state: &mut socket_patch_core::patch::redirect::RedirectState,
-    replay_eligible: bool,
-) -> HostedLegOutcome {
-    use socket_patch_core::patch::redirect::{
-        redirect_revert_supported, revert_redirect_purl, revert_remaining_redirect_edits,
+/// The patch-server origins that count as hosted, besides Socket's own:
+/// the operator's `--patch-server-url` (discovery's allowlist).
+pub(crate) fn patch_server_origins(common: &GlobalArgs) -> Vec<String> {
+    common
+        .patch_server_url
+        .iter()
+        .filter(|url| !url.trim().is_empty())
+        .cloned()
+        .collect()
+}
+
+/// Restore the in-scope hosted pins to their default upstream registry
+/// entries (core `patch::redirect::upstream`): v5 hosted mode keeps no
+/// ledger, so each pin's lock entry is re-resolved from the registry, and a
+/// pin that cannot be is refused with the `git checkout` remedy. Shared
+/// with remove's hosted leg.
+pub(crate) async fn run_hosted_leg(common: &GlobalArgs, pins: &[HostedPin]) -> HostedLegOutcome {
+    use socket_patch_core::patch::redirect::upstream::{
+        restore_upstream, PinStatus, RestoreOptions,
     };
 
     let mut out = HostedLegOutcome::default();
-    // The vlt nodes the unwound purls pin, read before the revert drops
-    // their edits: the heal below invalidates the patched installed copies
-    // once the registry pins are back.
-    let vlt_scope: Vec<String> = if replay_eligible {
-        purls
-            .iter()
-            .cloned()
-            .chain(state.records.keys().cloned())
-            .collect()
-    } else {
-        purls.to_vec()
-    };
-    // FIFO-safe: a FIFO or device planted at the lock path must fail this
-    // read at once, not block the rollback in open(2).
+    if pins.is_empty() {
+        return out;
+    }
+    // The vlt nodes the restored pins pin, read before the restore rewrites
+    // them: the heal below invalidates the patched installed copies once the
+    // registry pins are back.
     let vlt_lock = socket_patch_core::utils::fs::read_regular_to_string(
         &common
             .cwd
@@ -1059,126 +1045,97 @@ pub(crate) async fn run_hosted_leg(
     )
     .await
     .ok();
-    let vlt_targets = socket_patch_core::patch::redirect::vlt_heal::ledger_targets(
-        state,
-        &vlt_scope,
-        vlt_lock.as_deref(),
-    );
-    // When the whole-ledger replay will run anyway (the scope covers every
-    // record), npm purls on Bun projects defer to it so all lockfile edits
-    // are staged together atomically. A scoped unwind of one of several
-    // Bun records uses the per-purl revert to restore only its package.
-    let has_bun_edits = state.edits.iter().any(|e| {
-        matches!(
-            e.kind.as_str(),
-            "redirect_bun_lock_package" | "redirect_bun_lockb_package"
-        )
-    });
-    let mut deferred_to_replay: Vec<String> = Vec::new();
-    for purl in purls {
-        let defer_bun = has_bun_edits && purl.starts_with("pkg:npm/") && replay_eligible;
-        if !defer_bun && redirect_revert_supported(purl) {
-            match revert_redirect_purl(&common.cwd, state, purl, common.dry_run).await {
-                Ok(revert) => {
-                    for (code, detail) in &revert.warnings {
-                        out.warnings.push((code.clone(), detail.clone()));
-                    }
-                    if !common.json && !common.silent {
-                        if common.dry_run {
-                            println!("Would unwind hosted redirect for {purl}");
-                        } else {
-                            println!("Unwound hosted redirect for {purl}");
-                        }
-                    }
-                    out.edited_files
-                        .extend(revert.reverted_files.iter().cloned());
-                    out.reverted.push(purl.clone());
-                }
-                Err(e) => {
-                    if !common.json {
-                        eprintln!("Error: Failed to unwind hosted redirect for {purl}: {e}");
-                    }
-                    out.failed.push((purl.clone(), e));
-                }
-            }
-        } else if replay_eligible {
-            deferred_to_replay.push(purl.clone());
-        } else {
-            if !common.json {
-                eprintln!(
-                    "Error: Cannot unwind hosted redirect for {purl}: no per-purl revert exists for \
-                     this ecosystem. Run an unscoped `socket-patch rollback` to unwind ALL \
-                     hosted redirects, or re-run `scan --mode hosted` to normalize."
-                );
-            }
-            out.unsupported.push(purl.clone());
-        }
-    }
-    // The whole-ledger replay runs when the scope covers every record
-    // (however it was spelled), and also as the "last one out turns off
-    // the lights" pass — per-purl reverts never claim the non-package
-    // shared settings edits (such as pnpm trustLockfile), so an emptied
-    // record map with leftover edits replays them here too. (The npm
-    // `.npmrc` `allow-remote=all` edit is the one exception: the per-purl
-    // npm revert of the LAST package-lock entry unwinds it itself, so a
-    // scoped rollback leaves no loosened policy behind while other
-    // ecosystems' records remain.)
-    if replay_eligible || (state.records.is_empty() && !state.edits.is_empty()) {
-        let replay = revert_remaining_redirect_edits(&common.cwd, state, common.dry_run).await;
-        for refusal in &replay.refusals {
-            let files: Vec<&str> = refusal.files.iter().map(String::as_str).collect();
-            let why = format!("{} ({})", refusal.reason, files.join(", "));
-            if !common.json {
-                eprintln!(
-                    "Error: Cannot unwind hosted redirect edits ({}): {why}",
-                    refusal.group
-                );
-            }
-            out.failed.push((format!("group:{}", refusal.group), why));
-        }
-        out.warnings.extend(replay.warnings.iter().cloned());
-        out.edited_files
-            .extend(replay.reverted_files.iter().cloned());
-        // Deferred purls succeeded iff the replay dropped their records.
-        for purl in deferred_to_replay {
-            if replay.dropped_records.iter().any(|p| p == &purl) {
+    let origins = patch_server_origins(common);
+    let purls: Vec<String> = pins.iter().map(|p| p.purl.clone()).collect();
+    let vlt_targets = vlt_lock
+        .as_deref()
+        .map(|lock| {
+            socket_patch_core::patch::redirect::vlt_heal::lock_targets(lock, &origins, &purls)
+        })
+        .unwrap_or_default();
+    let opts = RestoreOptions {
+        dry_run: common.dry_run,
+        offline: common.offline,
+        patch_server_origins: origins,
+        // A binary bun.lockb pin refuses with the checkout remedy: its
+        // rebuilt registry record is not byte-exact for every lock.
+        bun_lockb: false,
+    };
+    let outcome = restore_upstream(&common.cwd, pins, &opts).await;
+    for pin in &outcome.pins {
+        match &pin.status {
+            PinStatus::Restored => {
                 if !common.json && !common.silent {
                     if common.dry_run {
-                        println!("Would unwind hosted redirect for {purl}");
+                        println!("Would restore {} to its upstream registry entry", pin.purl);
                     } else {
-                        println!("Unwound hosted redirect for {purl}");
+                        println!("Restored {} to its upstream registry entry", pin.purl);
                     }
                 }
-                out.reverted.push(purl);
-            } else if !out.failed.iter().any(|(p, _)| p.starts_with("group:")) {
-                let why = "hosted redirect edits could not be replayed";
+                out.reverted.push(pin.purl.clone());
+            }
+            PinStatus::Refused(why) => {
                 // Errors print even under --silent: this drives exit 1.
                 if !common.json {
-                    eprintln!("Error: Failed to unwind hosted redirect for {purl}: {why}");
+                    eprintln!("Error: {}", capitalize_first(why));
                 }
-                out.failed.push((purl, why.into()));
+                out.failed.push((pin.purl.clone(), why.clone()));
             }
         }
     }
-    // A target's registry pins are back when its purl reverted, or when the
-    // whole-ledger replay committed the vlt group: groups commit on their
-    // own, so another lock's refusal (a drifted package-lock.json) leaves
-    // the restored vlt-lock.json pins restored.
-    let vlt_group_refused = out.failed.iter().any(|(p, _)| p == "group:vlt");
+    if let Some(e) = &outcome.flush_error {
+        let why = format!("writing the restored lockfiles failed: {e}");
+        if !common.json {
+            eprintln!("Error: {}", capitalize_first(&why));
+        }
+        out.failed.push(("files".to_string(), why));
+    }
+    out.warnings.extend(
+        outcome
+            .warnings
+            .iter()
+            .map(|(code, detail)| (code.to_string(), detail.clone())),
+    );
+    out.edited_files.extend(outcome.reverted_files.iter().cloned());
     let unwound: Vec<_> = vlt_targets
         .into_iter()
-        .filter(|t| {
-            out.reverted.iter().any(|p| {
-                socket_patch_core::utils::purl::canonical_purl(p)
-                    == socket_patch_core::utils::purl::canonical_purl(&t.purl)
-            }) || (replay_eligible && !vlt_group_refused)
-        })
+        .filter(|t| out.reverted.iter().any(|p| p == &t.purl))
         .collect();
     out.warnings
         .extend(crate::commands::scan::vlt_rollback_heal(common, &unwound).await);
     out
 }
 
+/// Delete a pre-v5 hosted ledger once no hosted pin is left for it to
+/// describe (v5 never writes it; it is read only for migration). A wet run
+/// only; a failure is a warning (the file is inert).
+pub(crate) async fn retire_legacy_redirect_ledger(common: &GlobalArgs) -> Option<(String, String)> {
+    let path = common
+        .cwd
+        .join(socket_patch_core::patch::redirect::REDIRECT_STATE_REL);
+    if common.dry_run || tokio::fs::symlink_metadata(&path).await.is_err() {
+        return None;
+    }
+    let remaining = crate::commands::discover_wiring(common, &common.cwd).await;
+    if !HostedPin::all(&remaining).is_empty() {
+        return None;
+    }
+    // The emptied `.socket/vendor/` goes with it; the apply lock's drop
+    // prunes an emptied `.socket/` itself.
+    let stop = common.cwd.join(socket_patch_core::constants::SOCKET_DIR);
+    match socket_patch_core::utils::socket_dir::remove_file_and_prune(&path, &stop).await {
+        Ok(()) => None,
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => None,
+        Err(e) => Some((
+            "legacy_redirect_ledger_kept".to_string(),
+            format!(
+                "could not delete the pre-v5 hosted ledger {}: {e}",
+                socket_patch_core::patch::redirect::REDIRECT_STATE_REL
+            ),
+        )),
+    }
+}
+
 pub async fn run(args: RollbackArgs) -> i32 {
     apply_env_toggles(&args.common);
 
@@ -1237,10 +1194,10 @@ pub async fn run(args: RollbackArgs) -> i32 {
     let cwd = args.common.cwd.clone();
 
     // ── state discovery ─────────────────────────────────────────────────
-    // Rollback infers what to undo from the three state stores: the
-    // manifest (in-place/agent patches), the vendor ledger (vendored
-    // patches), and the redirect ledger (hosted lockfile redirects). A
-    // missing manifest is not fatal when a ledger holds work.
+    // Rollback infers what to undo from three sources: the manifest
+    // (in-place/agent patches), the vendor ledger (vendored patches), and
+    // the lockfiles themselves (hosted pins — v5 hosted mode keeps no
+    // ledger). A missing manifest is not fatal when either holds work.
     //
     // Only cheap EXISTENCE probes happen before the lock (they decide the
     // truly-empty error path, which never locks: acquiring would create
@@ -1253,12 +1210,54 @@ pub async fn run(args: RollbackArgs) -> i32 {
     let vendor_ledger_exists = tokio::fs::metadata(cwd.join(".socket/vendor/state.json"))
         .await
         .is_ok();
-    let redirect_ledger_exists =
-        tokio::fs::metadata(cwd.join(socket_patch_core::patch::redirect::REDIRECT_STATE_REL))
-            .await
-            .is_ok();
-
-    if manifest_missing && !vendor_ledger_exists && !redirect_ledger_exists {
+    // The hosted pins the lockfiles wire (read-only discovery; the restore
+    // re-reads every file under the lock before it writes).
+    let hosted_inventory = crate::commands::hosted_inventory(&args.common, &cwd).await;
+    let hosted_pins: Vec<HostedPin> = hosted_inventory.pins.clone();
+
+    if manifest_missing && !vendor_ledger_exists && hosted_pins.is_empty() {
+        // Hosted wiring the lockfiles name but cannot attribute is still
+        // hosted state: refuse, naming it, instead of "Manifest not found".
+        if let Some(refusal) = hosted_inventory.contested_refusal() {
+            emit_rollback_error(args.common.json, &refusal);
+            return 1;
+        }
+        // Only a pre-v5 hosted ledger left: no lockfile pins it any more,
+        // so there is nothing to restore — retire the stale file (a wet run
+        // only) instead of failing on the missing manifest.
+        let legacy = cwd.join(socket_patch_core::patch::redirect::REDIRECT_STATE_REL);
+        if tokio::fs::symlink_metadata(&legacy).await.is_ok() {
+            let warning = retire_legacy_redirect_ledger(&args.common).await;
+            if args.common.json {
+                println!(
+                    "{}",
+                    serde_json::to_string_pretty(&serde_json::json!({
+                        "status": "success",
+                        "rolledBack": 0,
+                        "alreadyOriginal": 0,
+                        "failed": 0,
+                        "dryRun": args.common.dry_run,
+                        "warnings": warning
+                            .iter()
+                            .map(|(code, detail)| serde_json::json!({
+                                "code": code, "detail": detail,
+                            }))
+                            .collect::<Vec<_>>(),
+                        "legacyRedirectLedgerRemoved": warning.is_none() && !args.common.dry_run,
+                    }))
+                    .expect("serializing an in-memory JSON value cannot fail")
+                );
+            } else if let Some((code, detail)) = &warning {
+                eprintln!("Warning ({code}): {}", capitalize_first(detail));
+            } else if !args.common.silent {
+                println!(
+                    "{} the pre-v5 hosted ledger {}: no lockfile pins a hosted patch.",
+                    if args.common.dry_run { "Would remove" } else { "Removed" },
+                    socket_patch_core::patch::redirect::REDIRECT_STATE_REL
+                );
+            }
+            return 0;
+        }
         // Ledger-less but still wired? (a deleted/uncommitted state.json
         // with lockfiles still consuming `.socket/vendor/` artifacts is a
         // supported recovery state — `repair` reconstructs the ledger.)
@@ -1308,9 +1307,7 @@ pub async fn run(args: RollbackArgs) -> i32 {
     // each exactly once: the agent leg below receives the manifest and the
     // vendor-ownership key set instead of re-reading them.
     let vendor_state_result = socket_patch_core::vendor::load_state(&cwd).await;
-    let redirect_state_result = socket_patch_core::patch::redirect::load_redirect_state(&cwd).await;
     let vendor_corrupt = vendor_state_result.is_err();
-    let redirect_corrupt = redirect_state_result.is_err();
     // An unreadable ledger degrades to "nothing vendored" for the in-place
     // leg (its own containment is the `vendor_state_unreadable` exit below).
     let vendored_keys: HashSet<String> = vendor_state_result
@@ -1355,14 +1352,10 @@ pub async fn run(args: RollbackArgs) -> i32 {
             }
             Err(_) => Vec::new(),
         };
-    let redirect_records: Vec<(String, String)> = match &redirect_state_result {
-        Ok(Some(s)) => s
-            .records
-            .iter()
-            .map(|(purl, rec)| (purl.clone(), rec.uuid.clone()))
-            .collect(),
-        _ => Vec::new(),
-    };
+    let redirect_records: Vec<(String, String)> = hosted_pins
+        .iter()
+        .map(|pin| (pin.purl.clone(), pin.uuid.clone()))
+        .collect();
 
     let scoped = !identifiers.is_empty() || !path_scope.is_empty();
 
@@ -1528,25 +1521,6 @@ pub async fn run(args: RollbackArgs) -> i32 {
         });
     }
 
-    // The whole-ledger hosted replay (which covers the ecosystems without
-    // a per-purl revert) runs only when the scope covers EVERY record —
-    // however the scope was spelled.
-    let replay_eligible = match &redirect_state_result {
-        // A records-EMPTY ledger (degraded record-fetch-failed runs leave
-        // edits without records) is vacuously "covered" by any scope; only
-        // an UNSCOPED run may replay those leftover edits — a scoped
-        // rollback of an unrelated purl must not unwind live redirects it
-        // was never asked about. `--ecosystems` counts as a scope here:
-        // recordless edits carry no purl to narrow by, so an eco-narrowed
-        // run leaves them to an unscoped rollback rather than replaying
-        // other ecosystems' edits behind the filter's back.
-        Ok(Some(s)) => {
-            (!s.records.is_empty() || (!scoped && args.common.ecosystems.is_none()))
-                && s.records.keys().all(|p| hosted_scope.contains(p))
-        }
-        _ => false,
-    };
-
     // Corrupt-ledger containment: a corrupt store fails ONLY the legs that
     // need it; the agent leg still restores files (emergency restores are
     // never blocked by an unrelated corrupt ledger). Cleanup/GC also skip
@@ -1564,40 +1538,14 @@ pub async fn run(args: RollbackArgs) -> i32 {
             ),
         ));
     }
-    if redirect_corrupt {
-        run_warnings.push((
-            "redirect_state_unreadable".into(),
-            // The core error already carries the recovery steps; only say
-            // what this run skipped.
-            format!(
-                "the hosted leg was skipped: cannot read the hosted redirect ledger: {}",
-                redirect_state_result
-                    .as_ref()
-                    .expect_err("checked corrupt above")
-            ),
-        ));
-    }
 
     // ── confirmation ────────────────────────────────────────────────────
     // The default run deletes manifest entries, vendored artifacts, ledger
     // records, and unused blobs — prompt once, remove-style. Auto-accepted
     // under --yes/--json/non-TTY; skipped for previews and for
     // --preserve-state runs (which delete no local state).
-    // Leftover hosted edits an eligible replay would unwind even with no
-    // in-scope records (degraded record-fetch-failed ledgers): they are
-    // work — and prompt-worthy mutation — too.
-    let hosted_leftover_edits = if replay_eligible {
-        match &redirect_state_result {
-            Ok(Some(st)) => st.edits.len(),
-            _ => 0,
-        }
-    } else {
-        0
-    };
-    let has_work = !manifest_scope.is_empty()
-        || !vendor_scope.is_empty()
-        || !hosted_scope.is_empty()
-        || hosted_leftover_edits > 0;
+    let has_work =
+        !manifest_scope.is_empty() || !vendor_scope.is_empty() || !hosted_scope.is_empty();
     // Everything in scope was filtered out by `--ecosystems`: say so,
     // instead of the misleading "No patches found in manifest".
     let eco_filtered_everything = !has_work && scope_before_eco_filter > 0;
@@ -1614,12 +1562,7 @@ pub async fn run(args: RollbackArgs) -> i32 {
     if has_work && !args.common.dry_run && !args.preserve_state {
         // Compose only the clauses that apply, so a hosted-only run never
         // claims manifest entries it does not have.
-        let prompt = rollback_prompt(
-            manifest_scope.len(),
-            vendor_scope.len(),
-            hosted_scope.len(),
-            hosted_leftover_edits,
-        );
+        let prompt = rollback_prompt(manifest_scope.len(), vendor_scope.len(), hosted_scope.len());
         if !crate::ui::confirm(&prompt, true, &args.common) {
             if !args.common.json && !args.common.silent {
                 println!("Rollback cancelled.");
@@ -1675,33 +1618,28 @@ pub async fn run(args: RollbackArgs) -> i32 {
             }
 
             // ── hosted leg ───────────────────────────────────────────────
-            let mut hosted_leg = HostedLegOutcome::default();
-            if !redirect_corrupt {
-                if let Ok(Some(existing)) = &redirect_state_result {
-                    let mut st = existing.clone();
-                    let before = (st.edits.len(), st.records.len());
-                    let mut purls: Vec<String> = hosted_scope.iter().cloned().collect();
-                    purls.sort();
-                    if !purls.is_empty() || (replay_eligible && !st.edits.is_empty()) {
-                        hosted_leg =
-                            run_hosted_leg(&args.common, &purls, &mut st, replay_eligible).await;
-                        let changed = (st.edits.len(), st.records.len()) != before;
-                        if !args.common.dry_run && changed {
-                            if let Err(e) =
-                                socket_patch_core::patch::redirect::persist_redirect_state(
-                                    &cwd, &st,
-                                )
-                                .await
-                            {
-                                let msg =
-                                    format!("failed to persist the hosted redirect ledger: {e}");
-                                if !args.common.json {
-                                    eprintln!("Error: {}", capitalize_first(&msg));
-                                }
-                                hosted_leg.failed.push(("ledger".to_string(), msg));
-                            }
-                        }
+            let in_scope: Vec<HostedPin> = hosted_pins
+                .iter()
+                .filter(|pin| hosted_scope.contains(&pin.purl))
+                .cloned()
+                .collect();
+            let mut hosted_leg = run_hosted_leg(&args.common, &in_scope).await;
+            // An unscoped rollback promises to unwind EVERY hosted patch:
+            // contested wiring it cannot restore fails the leg (a scoped run
+            // names its own targets and leaves unrelated wiring alone).
+            if !scoped {
+                if let Some(refusal) = hosted_inventory.contested_refusal() {
+                    if !args.common.json {
+                        eprintln!("Error: {}", capitalize_first(&refusal));
                     }
+                    hosted_leg
+                        .failed
+                        .push(("hosted_wiring_contested".to_string(), refusal));
+                }
+            }
+            if hosted_leg.failed.is_empty() {
+                if let Some(warning) = retire_legacy_redirect_ledger(&args.common).await {
+                    run_warnings.push(warning);
                 }
             }
 
@@ -1846,8 +1784,8 @@ pub async fn run(args: RollbackArgs) -> i32 {
             if args.preserve_state && !hosted_leg.reverted.is_empty() {
                 run_warnings.push((
                     "hosted_state_not_preservable".into(),
-                    "hosted redirects have no preservable local state: their ledger \
-                     records were dropped with the unwound wiring; re-run \
+                    "hosted wiring has no preservable local state: the lockfile pins are \
+                     the only record, and they now resolve upstream; re-run \
                      `scan --mode hosted` to re-wire"
                         .into(),
                 ));
@@ -1889,9 +1827,7 @@ pub async fn run(args: RollbackArgs) -> i32 {
                 .filter(|(code, _)| {
                     !matches!(
                         code.as_str(),
-                        "vendor_state_unreadable"
-                            | "redirect_state_unreadable"
-                            | "reinstall_required"
+                        "vendor_state_unreadable" | "reinstall_required"
                     )
                 })
                 .chain(hosted_leg.warnings.iter())
@@ -1928,7 +1864,6 @@ pub async fn run(args: RollbackArgs) -> i32 {
                 && hosted_leg.failed.is_empty()
                 && hosted_leg.unsupported.is_empty()
                 && !vendor_corrupt
-                && !redirect_corrupt
                 && manifest_write_failed.is_none();
             let rolled_back_count = results
                 .iter()
@@ -2157,7 +2092,7 @@ pub async fn run(args: RollbackArgs) -> i32 {
                     eprintln!("Error: Kept vendored state for {key}: {reason}");
                 }
                 for (code, detail) in &run_warnings {
-                    if code == "vendor_state_unreadable" || code == "redirect_state_unreadable" {
+                    if code == "vendor_state_unreadable" {
                         eprintln!("Error ({code}): {}", capitalize_first(detail));
                     }
                 }
@@ -4671,30 +4606,29 @@ mod tests {
     #[test]
     fn rollback_prompt_singular_plural_and_clauses() {
         assert_eq!(
-            rollback_prompt(1, 0, 0, 0),
+            rollback_prompt(1, 0, 0),
             "Roll back 1 patch and remove it from the local manifest?"
         );
         assert_eq!(
-            rollback_prompt(2, 0, 0, 0),
+            rollback_prompt(2, 0, 0),
             "Roll back 2 patches and remove them from the local manifest?"
         );
-        // Never "..., and unwind" after an inner "and".
+        // Never "..., and restore" after an inner "and".
         assert_eq!(
-            rollback_prompt(1, 0, 1, 0),
-            "Roll back 1 patch, remove it from the local manifest, and unwind 1 hosted \
-             redirect?"
+            rollback_prompt(1, 0, 1),
+            "Roll back 1 patch, remove it from the local manifest, and restore 1 hosted \
+             package to the upstream registry?"
         );
-        assert_eq!(rollback_prompt(0, 0, 3, 0), "Unwind 3 hosted redirects?");
         assert_eq!(
-            rollback_prompt(0, 0, 0, 1),
-            "Replay 1 leftover hosted redirect edit?"
+            rollback_prompt(0, 0, 3),
+            "Restore 3 hosted packages to the upstream registry?"
         );
         assert_eq!(
-            rollback_prompt(0, 1, 0, 0),
+            rollback_prompt(0, 1, 0),
             "Delete 1 vendored artifact and its ledger record?"
         );
         assert_eq!(
-            rollback_prompt(0, 2, 0, 0),
+            rollback_prompt(0, 2, 0),
             "Delete 2 vendored artifacts and their ledger records?"
         );
     }
diff --git a/crates/socket-patch-cli/src/commands/scan/discovery.rs b/crates/socket-patch-cli/src/commands/scan/discovery.rs
index d9d51ea7..642547aa 100644
--- a/crates/socket-patch-cli/src/commands/scan/discovery.rs
+++ b/crates/socket-patch-cli/src/commands/scan/discovery.rs
@@ -398,62 +398,50 @@ pub(super) async fn preverify_vendor_baselines<W: std::io::Write>(
     (mismatched, views)
 }
 
-/// Fold both ledgers' patch records into the manifest view update detection
-/// consults. Hosted mode records purl→uuid ONLY in
-/// `.socket/vendor/redirect-state.json` and vendored mode ONLY in
-/// `.socket/vendor/state.json`, so without this fold a pure hosted or
-/// vendored project's `updates[]` would always be empty. Precedence on a
-/// collision: manifest > redirect ledger > vendor ledger (matching VEX's
-/// candidate merge in `commands::vex_sources`), then the lockfile's hosted
-/// pins (`hosted_pins`, uuid only). Vendor entries are keyed by their
-/// manifest-form ledger key (`detect_updates` bridges the spellings); a
-/// legacy entry without an embedded record contributes its uuid alone.
-/// Borrows the manifest untouched when nothing else contributes.
+/// Fold the hosted pins and the vendor ledger's patch records into the
+/// manifest view update detection consults. Hosted mode records purl→uuid
+/// ONLY in the lockfiles (`hosted_pins`, uuid only; v5 keeps no hosted
+/// ledger) and vendored mode ONLY in `.socket/vendor/state.json`, so without
+/// this fold a pure hosted or vendored project's `updates[]` would always
+/// be empty. Precedence on a collision: manifest > hosted pins > vendor
+/// ledger (the live lock over a possibly superseded vendored entry). Vendor
+/// entries are keyed by their manifest-form ledger key (`detect_updates`
+/// bridges the spellings); a legacy entry without an embedded record
+/// contributes its uuid alone. Borrows the manifest untouched when nothing
+/// else contributes.
 pub(super) fn merge_ledger_records_for_updates<'a>(
     manifest: Option<&'a PatchManifest>,
-    redirect: Option<&socket_patch_core::patch::redirect::RedirectState>,
     vendor: Option<&VendorState>,
     hosted_pins: &[(String, String)],
 ) -> Option<Cow<'a, PatchManifest>> {
-    let redirect_records = redirect.map(|s| &s.records).filter(|r| !r.is_empty());
     let vendor_entries = vendor.map(|s| &s.entries).filter(|e| !e.is_empty());
-    if redirect_records.is_none() && vendor_entries.is_none() && hosted_pins.is_empty() {
+    if vendor_entries.is_none() && hosted_pins.is_empty() {
         return manifest.map(Cow::Borrowed);
     }
+    let uuid_only = |uuid: &str| PatchRecord {
+        uuid: uuid.to_string(),
+        exported_at: String::new(),
+        files: HashMap::new(),
+        vulnerabilities: HashMap::new(),
+        description: String::new(),
+        license: String::new(),
+        tier: String::new(),
+    };
     let mut merged = manifest.cloned().unwrap_or_default();
-    for (purl, record) in redirect_records.into_iter().flatten() {
+    for (purl, uuid) in hosted_pins {
         merged
             .patches
             .entry(purl.clone())
-            .or_insert_with(|| record.clone());
+            .or_insert_with(|| uuid_only(uuid));
     }
     for (purl, entry) in vendor_entries.into_iter().flatten() {
         merged.patches.entry(purl.clone()).or_insert_with(|| {
-            entry.record.clone().unwrap_or_else(|| PatchRecord {
-                uuid: entry.uuid.clone(),
-                exported_at: String::new(),
-                files: HashMap::new(),
-                vulnerabilities: HashMap::new(),
-                description: String::new(),
-                license: String::new(),
-                tier: String::new(),
-            })
+            entry
+                .record
+                .clone()
+                .unwrap_or_else(|| uuid_only(&entry.uuid))
         });
     }
-    for (purl, uuid) in hosted_pins {
-        merged
-            .patches
-            .entry(purl.clone())
-            .or_insert_with(|| PatchRecord {
-                uuid: uuid.clone(),
-                exported_at: String::new(),
-                files: HashMap::new(),
-                vulnerabilities: HashMap::new(),
-                description: String::new(),
-                license: String::new(),
-                tier: String::new(),
-            });
-    }
     Some(Cow::Owned(merged))
 }
 
@@ -905,16 +893,16 @@ mod tests {
     }
 
     // ---- merge_ledger_records_for_updates -----------------------------------
-    // Hosted mode records patches ONLY in the redirect ledger and vendored
-    // mode ONLY in the vendor ledger — these pin that ledger-only projects
-    // still surface `updates[]` (the documented CI signal) through the
-    // merged manifest view.
+    // Hosted mode records patches ONLY in the lockfiles (the hosted pins) and
+    // vendored mode ONLY in the vendor ledger — these pin that manifest-less
+    // projects still surface `updates[]` (the documented CI signal) through
+    // the merged manifest view.
 
-    fn ledger_with(entries: &[(&str, &str)]) -> socket_patch_core::patch::redirect::RedirectState {
-        let mut state = socket_patch_core::patch::redirect::RedirectState::new();
-        let manifest = crate::commands::scan::tests::manifest_with(entries);
-        state.records.extend(manifest.patches);
-        state
+    fn pins(entries: &[(&str, &str)]) -> Vec<(String, String)> {
+        entries
+            .iter()
+            .map(|(purl, uuid)| (purl.to_string(), uuid.to_string()))
+            .collect()
     }
 
     /// A vendor ledger with one entry per `(key, uuid, detached)`: detached
@@ -946,12 +934,12 @@ mod tests {
     }
 
     #[test]
-    fn ledger_only_project_reports_superseding_patch_in_updates() {
-        // Pure hosted project: NO .socket/manifest.json, one redirected patch
-        // recorded in the ledger; discovery now offers a different (newer)
-        // uuid. The merged view must make detect_updates flag it.
-        let ledger = ledger_with(&[("pkg:npm/foo@1.0", "uuid-old")]);
-        let merged = merge_ledger_records_for_updates(None, Some(&ledger), None, &[]);
+    fn hosted_only_project_reports_superseding_patch_in_updates() {
+        // Pure hosted project: NO .socket/manifest.json, one hosted pin in
+        // the lockfile; discovery now offers a different (newer) uuid. The
+        // merged view must make detect_updates flag it.
+        let hosted = pins(&[("pkg:npm/foo@1.0", "uuid-old")]);
+        let merged = merge_ledger_records_for_updates(None, None, &hosted);
         let pkgs = vec![batch_with("pkg:npm/foo@1.0", &["uuid-new"])];
         let updates = detect_updates(merged.as_deref(), &pkgs);
         assert_eq!(updates.len(), 1);
@@ -967,7 +955,7 @@ mod tests {
         // record still contributes its uuid — all detection reads.
         for detached in [true, false] {
             let vendor = vendor_ledger_with(&[("pkg:npm/foo@1.0", "uuid-old", detached)]);
-            let merged = merge_ledger_records_for_updates(None, None, Some(&vendor), &[]);
+            let merged = merge_ledger_records_for_updates(None, Some(&vendor), &[]);
             let pkgs = vec![batch_with("pkg:npm/foo@1.0", &["uuid-new"])];
             let updates = detect_updates(merged.as_deref(), &pkgs);
             assert_eq!(updates.len(), 1, "detached={detached}");
@@ -976,16 +964,16 @@ mod tests {
         }
         // Still the top offer — no nag.
         let vendor = vendor_ledger_with(&[("pkg:npm/foo@1.0", "uuid-a", true)]);
-        let merged = merge_ledger_records_for_updates(None, None, Some(&vendor), &[]);
+        let merged = merge_ledger_records_for_updates(None, Some(&vendor), &[]);
         let pkgs = vec![batch_with("pkg:npm/foo@1.0", &["uuid-a"])];
         assert!(detect_updates(merged.as_deref(), &pkgs).is_empty());
     }
 
     #[test]
-    fn ledger_record_matching_the_candidate_is_not_an_update() {
-        // The redirected patch is still the top offer — no nag.
-        let ledger = ledger_with(&[("pkg:npm/foo@1.0", "uuid-a")]);
-        let merged = merge_ledger_records_for_updates(None, Some(&ledger), None, &[]);
+    fn hosted_pin_matching_the_candidate_is_not_an_update() {
+        // The hosted patch is still the top offer — no nag.
+        let hosted = pins(&[("pkg:npm/foo@1.0", "uuid-a")]);
+        let merged = merge_ledger_records_for_updates(None, None, &hosted);
         let pkgs = vec![batch_with("pkg:npm/foo@1.0", &["uuid-a"])];
         assert!(detect_updates(merged.as_deref(), &pkgs).is_empty());
     }
@@ -994,33 +982,32 @@ mod tests {
     fn manifest_entry_wins_a_collision_with_a_ledger_record() {
         // A PURL present in every store is manifest-owned (same precedence as
         // VEX's candidate merge): the manifest's uuid is the "old" side;
-        // between the ledgers, the redirect record wins.
+        // between the other two, the live hosted pin wins over the vendor
+        // ledger's (possibly superseded) entry.
         let manifest =
             crate::commands::scan::tests::manifest_with(&[("pkg:npm/foo@1.0", "uuid-manifest")]);
-        let ledger = ledger_with(&[("pkg:npm/foo@1.0", "uuid-ledger")]);
+        let hosted = pins(&[("pkg:npm/foo@1.0", "uuid-pin")]);
         let vendor = vendor_ledger_with(&[("pkg:npm/foo@1.0", "uuid-vendor", true)]);
-        let merged =
-            merge_ledger_records_for_updates(Some(&manifest), Some(&ledger), Some(&vendor), &[]);
+        let merged = merge_ledger_records_for_updates(Some(&manifest), Some(&vendor), &hosted);
         let pkgs = vec![batch_with("pkg:npm/foo@1.0", &["uuid-new"])];
         let updates = detect_updates(merged.as_deref(), &pkgs);
         assert_eq!(updates.len(), 1);
         assert_eq!(updates[0].old_uuid, "uuid-manifest");
-        let merged = merge_ledger_records_for_updates(None, Some(&ledger), Some(&vendor), &[]);
+        let merged = merge_ledger_records_for_updates(None, Some(&vendor), &hosted);
         let updates = detect_updates(merged.as_deref(), &pkgs);
-        assert_eq!(updates[0].old_uuid, "uuid-ledger");
+        assert_eq!(updates[0].old_uuid, "uuid-pin");
     }
 
     #[test]
-    fn ledger_and_manifest_cover_disjoint_purls() {
-        // A mixed project (some deps applied via manifest, some hosted via
-        // the redirect ledger, some vendored) gets update detection across
-        // every store.
+    fn hosted_pins_and_manifest_cover_disjoint_purls() {
+        // A mixed project (some deps applied via manifest, some hosted in
+        // the lockfile, some vendored) gets update detection across every
+        // store.
         let manifest =
             crate::commands::scan::tests::manifest_with(&[("pkg:npm/foo@1.0", "uuid-f1")]);
-        let ledger = ledger_with(&[("pkg:npm/bar@2.0", "uuid-b1")]);
+        let hosted = pins(&[("pkg:npm/bar@2.0", "uuid-b1")]);
         let vendor = vendor_ledger_with(&[("pkg:npm/baz@3.0", "uuid-z1", true)]);
-        let merged =
-            merge_ledger_records_for_updates(Some(&manifest), Some(&ledger), Some(&vendor), &[]);
+        let merged = merge_ledger_records_for_updates(Some(&manifest), Some(&vendor), &hosted);
         let pkgs = vec![
             batch_with("pkg:npm/foo@1.0", &["uuid-f2"]),
             batch_with("pkg:npm/bar@2.0", &["uuid-b2"]),
@@ -1035,28 +1022,25 @@ mod tests {
     }
 
     #[test]
-    fn absent_or_empty_ledgers_leave_the_manifest_view_untouched() {
-        assert!(merge_ledger_records_for_updates(None, None, None, &[]).is_none());
-        let pins = vec![("pkg:npm/foo@1.0.0".to_string(), "uuid-pin".to_string())];
-        let merged = merge_ledger_records_for_updates(None, None, None, &pins).expect("pinned");
+    fn absent_or_empty_stores_leave_the_manifest_view_untouched() {
+        assert!(merge_ledger_records_for_updates(None, None, &[]).is_none());
+        let hosted = pins(&[("pkg:npm/foo@1.0.0", "uuid-pin")]);
+        let merged = merge_ledger_records_for_updates(None, None, &hosted).expect("pinned");
         assert_eq!(merged.patches["pkg:npm/foo@1.0.0"].uuid, "uuid-pin");
-        let empty = socket_patch_core::patch::redirect::RedirectState::new();
         let empty_vendor = VendorState::new();
-        assert!(
-            merge_ledger_records_for_updates(None, Some(&empty), Some(&empty_vendor), &[]).is_none()
-        );
+        assert!(merge_ledger_records_for_updates(None, Some(&empty_vendor), &[]).is_none());
         let manifest =
             crate::commands::scan::tests::manifest_with(&[("pkg:npm/foo@1.0", "uuid-a")]);
-        let merged = merge_ledger_records_for_updates(Some(&manifest), Some(&empty), None, &[])
+        let merged = merge_ledger_records_for_updates(Some(&manifest), Some(&empty_vendor), &[])
             .expect("manifest present");
         assert!(
             matches!(merged, Cow::Borrowed(_)),
-            "empty ledgers must not clone the manifest"
+            "empty stores must not clone the manifest"
         );
         assert_eq!(
             merged.patches.len(),
             manifest.patches.len(),
-            "an empty ledger adds nothing"
+            "an empty vendor ledger adds nothing"
         );
     }
 
diff --git a/crates/socket-patch-cli/src/commands/scan/hosted.rs b/crates/socket-patch-cli/src/commands/scan/hosted.rs
index 156f8bf4..6231254a 100644
--- a/crates/socket-patch-cli/src/commands/scan/hosted.rs
+++ b/crates/socket-patch-cli/src/commands/scan/hosted.rs
@@ -26,15 +26,6 @@ pub(crate) mod vlt;
 pub(crate) use vlt::rollback_heal as vlt_rollback_heal;
 pub(crate) use vlt::takeover_heal as vlt_takeover_heal;
 
-/// Fragment-edit kinds whose lockfile the package manager re-lays in place
-/// (keeping the Socket source) — a re-scan REBASES their ledger edits instead
-/// of appending; see the ledger merge below.
-pub(crate) const REBASE_KINDS: &[&str] = &[
-    "redirect_poetry_lock_package",
-    "redirect_pdm_lock_package",
-    socket_patch_core::patch::redirect::vlt::KIND,
-];
-
 /// Candidate lockfiles / registry configs the redirect rewriters may touch —
 /// read from the project when present and handed to `rewrite_registry_redirect`.
 pub(crate) const REDIRECT_CANDIDATE_FILES: &[&str] = &[
@@ -1213,7 +1204,7 @@ pub(crate) async fn run_redirect_selected(
 ) -> i32 {
     use socket_patch_core::manifest::schema::PatchRecord;
     use socket_patch_core::patch::redirect::{
-        rewrite_registry_redirect_withholding_vlt, RedirectState,
+        rewrite_registry_redirect_withholding_vlt,
     };
 
     let mut skipped: Vec<serde_json::Value> = Vec::new();
@@ -1409,15 +1400,12 @@ pub(crate) async fn run_redirect_selected(
     // The apply lock (see `acquire_hosted_lock`), taken only by a WET run
     // that holds at least one granted reference — the only runs that can
     // write anything: the takeover pre-reverts (lockfiles + the vendored
-    // ledger), the redirect-ledger merge and the lockfile writes. Dry runs
+    // ledger) and the lockfile writes. Dry runs
     // and zero-grant runs never touch `.socket/`, so they never lock (a
     // preview must not create `.socket/`, flip to `lock_held` under a
-    // concurrent wet run, or fail on a read-only checkout). Acquired BEFORE
-    // the ledger load so load → merge → persist is one critical section
-    // (rollback's rule: a ledger a run will persist is loaded under the
-    // lock) and held to the end of the function. Read below: it also gates
-    // the corrupt-ledger quarantine, the one write the load itself can make.
-    let lock: Option<LockGuard> = if !common.dry_run && !candidates.is_empty() {
+    // concurrent wet run, or fail on a read-only checkout). Held to the end
+    // of the function.
+    let _lock: Option<LockGuard> = if !common.dry_run && !candidates.is_empty() {
         match acquire_hosted_lock(common, &mut scan_result) {
             Ok(guard) => Some(guard),
             Err(code) => return code,
@@ -1426,36 +1414,11 @@ pub(crate) async fn run_redirect_selected(
         None
     };
 
-    // Load the existing redirect ledger before any file changes, including
-    // Cargo takeover reverts. It stores the originals a future revert needs, so
-    // a malformed (torn/hand-mangled) ledger must abort the run while the
-    // project is still untouched, or the merge below would silently
-    // overwrite that revert data. The malformed file is moved aside to
-    // redirect-state.json.corrupt (never clobbered) — but only by a run
-    // holding the apply lock; a dry run or zero-grant run reports the same
-    // error and moves nothing, so `.socket/vendor/` is never mutated
-    // lock-free.
-    //
-    // Held as the ONE in-memory ledger for the whole run: the write below
-    // merges into it in place, the stale-install probes read its records
-    // (persisted ones are the fallback when this run's /patches/view fetch
-    // fails transiently), and the takeover classification at the end reads
-    // the merged state.
-    let mut ledger =
-        match socket_patch_core::patch::redirect::load_redirect_state(&common.cwd).await {
-            Ok(state) => state.unwrap_or_else(RedirectState::new),
-            Err(mut corrupt) => {
-                if lock.is_some() {
-                    corrupt.quarantine().await;
-                }
-                let message = corrupt.to_string();
-                eprintln!("{}", format_error_line(&message));
-                if common.json {
-                    emit_json_error(scan_result.take(), &message);
-                }
-                return 1;
-            }
-        };
+    // v5 hosted mode keeps no ledger: the lockfiles are the only record of
+    // a redirect (vex, list, vendor and rollback read the hosted pins from
+    // them). This run's patch records (fetched below) feed only the
+    // stale-install probes and the in-run VEX attestation. A pre-v5 ledger
+    // on disk is left untouched: it is read only for migration.
     // The vendored ledger, loaded ONCE per run (under the same lock, so no
     // other writer can move the on-disk file under it): the takeover below
     // mutates it in place per reverted purl (saving after each), and the
@@ -2807,8 +2770,8 @@ pub(crate) async fn run_redirect_selected(
                         "code": "record_fetch_failed",
                         "detail": format!(
                             "{purl} redirected, but its patch record could not be fetched; \
-                             it will be missing from VEX until `socket-patch scan --mode \
-                             hosted` is re-run"
+                             this run's VEX attestation omits it (`socket-patch vex` \
+                             fetches it again once the API answers)"
                         ),
                     }));
                 }
@@ -2817,137 +2780,7 @@ pub(crate) async fn run_redirect_selected(
         status.finish();
     }
 
-    // Whether this run persisted the redirect ledger (human next steps).
-    let mut ledger_written = false;
     if !common.dry_run {
-        // Ledger (mirrors the vendor state.json shape): recorded edits for a
-        // future revert + the patch records (file hashes + vulnerabilities) so
-        // a post-install `socket-patch vex` can attest the redirected patches.
-        // MERGE with any existing ledger rather than overwriting: an idempotent
-        // re-run produces no new edits (the lockfile already points at the
-        // hosted patch), and clobbering the file would lose the original
-        // pre-redirect values a future revert needs. New edits APPEND (revert
-        // walks them in reverse), skipping byte-identical re-plans from a
-        // retried partial failure; records are keyed by PURL, newest wins.
-        //
-        // Persisted BEFORE the project files, and atomically (stage + fsync +
-        // rename): a crash between the two leaves a complete ledger whose
-        // originals match files never rewritten, never rewritten files whose
-        // originals reached no ledger.
-        if !rewrite.edits.is_empty() || !records.is_empty() {
-            // Older ledgers carry `"mode": "redirect"`; normalize on rewrite
-            // (the loader accepts either).
-            ledger.mode = "hosted".to_string();
-            // REBASE instead of append for fragment kinds whose file the
-            // package manager itself rewrites in place: when the ledger already
-            // holds edits for the same (path, kind, key) and the file no longer
-            // carried their `new` fragments before this run (Poetry 1.1/1.2
-            // `poetry lock --no-update` keeps the Socket source but re-lays the
-            // unit and drops the inserted `files` line), appending this run's
-            // edits — recorded against the RELOCKED text — would build a chain
-            // whose older links match nothing, so rollback and remove refuse
-            // forever. Keeping the oldest `original` (the pristine
-            // fragment) and adopting the fresh `new` keeps the chain a single
-            // invertible link: replay swaps the fragment this run wrote back to
-            // the fragment the very first run found.
-            let vlt_merged = rebase_vlt_edits(
-                &mut ledger.edits,
-                &rewrite.edits,
-                files
-                    .get(socket_patch_core::constants::npm_family::VLT_LOCK)
-                    .map(String::as_str),
-            );
-            let mut rebased: Vec<usize> = Vec::new();
-            for edit in rewrite.edits.iter().filter(|e| {
-                REBASE_KINDS.contains(&e.kind.as_str())
-                    && e.kind != socket_patch_core::patch::redirect::vlt::KIND
-            }) {
-                let siblings: Vec<usize> = ledger
-                    .edits
-                    .iter()
-                    .enumerate()
-                    .filter(|(_, old)| {
-                        old.path == edit.path && old.kind == edit.kind && old.key == edit.key
-                    })
-                    .map(|(i, _)| i)
-                    .collect();
-                let before = files.get(&edit.path).map(String::as_str).unwrap_or("");
-                let drifted = !siblings.is_empty()
-                    && siblings.iter().all(|&i| {
-                        ledger.edits[i]
-                            .new
-                            .as_ref()
-                            .and_then(serde_json::Value::as_str)
-                            .is_none_or(|new| !before.contains(new))
-                    });
-                if !drifted {
-                    continue;
-                }
-                // Positional pairing: the rewriter emits a key's fragments in a
-                // fixed order (package unit, then the legacy integrity entry).
-                let nth = rewrite
-                    .edits
-                    .iter()
-                    .filter(|e| e.path == edit.path && e.kind == edit.kind && e.key == edit.key)
-                    .position(|e| std::ptr::eq(e, edit))
-                    .unwrap_or(0);
-                if let Some(&target) = siblings.get(nth) {
-                    if !rebased.contains(&target) {
-                        // `pdm lock` fully un-patches the lock (registry source
-                        // restored) and may reflow line endings (CRLF → LF), so
-                        // the fresh run's `original` IS the correct
-                        // relocked-registry rollback target and the stale
-                        // recorded one would restore a mismatched fragment.
-                        // Poetry's relock instead KEEPS the Socket source (it
-                        // only drops the inserted `files` line), so its oldest
-                        // `original` — the true pre-patch fragment — must
-                        // survive; only its `new` is refreshed.
-                        if edit.kind == "redirect_pdm_lock_package" {
-                            ledger.edits[target].original = edit.original.clone();
-                        }
-                        ledger.edits[target].new = edit.new.clone();
-                        ledger.edits[target].action = edit.action.clone();
-                        rebased.push(target);
-                    }
-                }
-            }
-            // Dedup against the ledger as this run found it, never within
-            // this run: one run legitimately records identical edits (a
-            // Cargo.toml declaring the crate with the same line in two
-            // sections), and each one reverts one occurrence.
-            let recorded = ledger.edits.len();
-            for (i, edit) in rewrite.edits.iter().enumerate() {
-                if vlt_merged[i] {
-                    continue;
-                }
-                let is_rebased = REBASE_KINDS.contains(&edit.kind.as_str())
-                    && rebased.iter().any(|&t| {
-                        let old = &ledger.edits[t];
-                        old.path == edit.path
-                            && old.kind == edit.kind
-                            && old.key == edit.key
-                            && old.new == edit.new
-                    });
-                if !is_rebased && !ledger.edits[..recorded].contains(edit) {
-                    ledger.edits.push(edit.clone());
-                }
-            }
-            ledger.records.extend(records);
-            // The ledger is the only revert path and the VEX record store —
-            // a swallowed write failure would let the lockfile writes below
-            // proceed with no revert data persisted while reporting success.
-            let saved =
-                socket_patch_core::patch::redirect::save_redirect_state(&common.cwd, &ledger).await;
-            ledger_written = saved.is_ok();
-            if let Err(e) = saved {
-                let message = format!("failed to write .socket/vendor/redirect-state.json: {e}");
-                eprintln!("{}", format_error_line(&message));
-                if common.json {
-                    emit_json_error(scan_result.take(), &message);
-                }
-                return 1;
-            }
-        }
         for (rel, content) in rewrite
             .files
             .iter()
@@ -3004,7 +2837,7 @@ pub(crate) async fn run_redirect_selected(
             common.global,
             common.global_prefix.clone(),
             &confirmed,
-            &ledger.records,
+            &records,
             &gem_artifact_shas,
         )
         .await
@@ -3016,7 +2849,7 @@ pub(crate) async fn run_redirect_selected(
             common,
             &confirmed,
             &rewrite.confirmed_pipenv_uuids,
-            &ledger.records,
+            &records,
         )
         .await
     };
@@ -3038,7 +2871,7 @@ pub(crate) async fn run_redirect_selected(
                     .or_else(|| files.get(lock_key))
                     .map(String::as_str),
                 preflight: &vlt_preflight,
-                records: &ledger.records,
+                records: &records,
                 confirmed: &confirmed,
                 confirmed_vlt: &rewrite.confirmed_vlt_uuids,
                 foreign: &rewrite.vlt_foreign_uuids,
@@ -3049,23 +2882,23 @@ pub(crate) async fn run_redirect_selected(
     };
 
     // Cross-mode takeover: a committed vendored ledger (`.socket/vendor/state.json`)
-    // may still claim package(s) this project also has a hosted redirect ledger
-    // for — their tarballs would then be orphaned and that ledger stale. But the
-    // overlap alone does NOT prove hosted won: only warn for the package(s) the
-    // LIVE lockfile actually routes to the hosted patch server (see
-    // `classify_overlap_takeover`), so a dry-run / no-op over a lock that still
-    // points at the vendored files stays silent instead of pointing cleanup at
-    // the live vendored ledger. The takeover pre-revert above already
-    // reconciled what it could; this only warns (JSON `warnings[]` and
-    // stderr) about any overlap left, WITHOUT deleting the other ledger.
-    // Classified over this run's in-memory ledgers — the redirect ledger as
-    // merged and persisted above, the vendored ledger as the takeover left
-    // it — so a non-dry-run reflects this run without re-reading either file.
+    // may still claim package(s) the lockfiles now pin hosted — their
+    // tarballs would then be orphaned and that ledger stale. But the overlap
+    // alone does NOT prove hosted won: only warn for the package(s) the LIVE
+    // lockfile actually routes to the hosted patch server (see
+    // `classify_overlap_takeover`), so a dry-run / no-op over a lock that
+    // still points at the vendored files stays silent instead of pointing
+    // cleanup at the live vendored ledger. The takeover pre-revert above
+    // already reconciled what it could; this only warns (JSON `warnings[]`
+    // and stderr) about any overlap left, WITHOUT deleting the other ledger.
+    // Classified over the lockfiles as this run left them and the vendored
+    // ledger as the takeover left it.
     let mut takeover_warnings: Vec<serde_json::Value> = Vec::new();
+    let hosted_now = crate::commands::hosted_state_from_lockfiles(common, &common.cwd).await;
     let superseded = super::classify_overlap_takeover_with(
         common,
         &common.cwd,
-        Some(&ledger),
+        Some(&hosted_now),
         vendor_state.as_ref().ok(),
     )
     .await
@@ -3073,7 +2906,7 @@ pub(crate) async fn run_redirect_selected(
     if !superseded.is_empty() {
         takeover_warnings.push(serde_json::json!({
             "code": super::REDIRECT_SUPERSEDES_VENDORED,
-            "detail": super::mode_takeover_detail(&superseded, /*current_is_hosted=*/ true),
+            "detail": super::mode_takeover_detail(&superseded),
         }));
     }
 
@@ -3088,7 +2921,7 @@ pub(crate) async fn run_redirect_selected(
 
     // Emit an OpenVEX attestation when `--vex` was requested. The redirected
     // bytes are fetched from the hosted patch server at install time, so the
-    // PURLs CONFIRMED REDIRECTED BY THIS RUN are attested from the ledger
+    // PURLs CONFIRMED REDIRECTED BY THIS RUN are attested from this run's
     // records WITHOUT hash verification (`assume_applied` — the integrity
     // pins written into the lockfile are the evidence), while any OTHER
     // manifest patches (previously applied / vendored — and any stale ledger
@@ -3110,6 +2943,9 @@ pub(crate) async fn run_redirect_selected(
         // it was taken with these crawler options). `get --mode hosted`
         // passes none.
         params.npm_prior = npm_prior.cloned();
+        // v5 keeps no hosted ledger: this run's fetched records are the
+        // hosted record source of the in-run attestation.
+        params.hosted_records = records.clone();
         // Stale-flagged purls are EXCLUDED from assume_applied: the same-run
         // envelope carries a redirect_gem_stale_install warning proving the
         // installed materialization unpatched, so attesting that purl from
@@ -3295,7 +3131,7 @@ pub(crate) async fn run_redirect_selected(
             if let Some(statements) = vex_statements {
                 eprintln!(
                     "Wrote OpenVEX document with {} to {} (redirected patches are attested \
-                     from the ledger, not hash-verified — their bytes are fetched at install \
+                     from their patch records, not hash-verified — their bytes are fetched at install \
                      time; run `socket-patch vex` after installing to verify against the \
                      installed tree).",
                     crate::ui::plural(statements, "statement", "statements"),
@@ -3312,7 +3148,7 @@ pub(crate) async fn run_redirect_selected(
             }
             if !common.dry_run {
                 for line in
-                    format_next_steps(&human_files, ledger_written, !takeover_migrated.is_empty())
+                    format_next_steps(&human_files, !takeover_migrated.is_empty())
                 {
                     println!("{line}");
                 }
@@ -3614,30 +3450,17 @@ fn join_names(names: &[String], max: usize) -> String {
 
 /// Next steps after a wet run that rewrote files (stdout, after the
 /// summary — the same place vendored mode prints its own): commit the
-/// ledger and the rewritten files, reinstall so the installed tree picks
-/// up the patched artifacts, then verify with `vex`. After a
-/// vendored→hosted takeover (`vendored_removed`) the commit also has to
-/// carry the deleted vendored ledger entries and artifacts, so the whole
-/// `.socket/vendor/` directory is named instead of the redirect ledger.
-fn format_next_steps(
-    files: &[String],
-    ledger_written: bool,
-    vendored_removed: bool,
-) -> Vec<String> {
+/// rewritten files, reinstall so the installed tree picks up the patched
+/// artifacts, then verify with `vex`. After a vendored→hosted takeover
+/// (`vendored_removed`) the commit also has to carry the deleted vendored
+/// ledger entries and artifacts.
+fn format_next_steps(files: &[String], vendored_removed: bool) -> Vec<String> {
     if files.is_empty() && !vendored_removed {
         return Vec::new();
     }
     let mut commit: Vec<String> = Vec::new();
     if vendored_removed {
-        commit.push(if ledger_written {
-            ".socket/vendor/ (the redirect ledger, plus the removed vendored ledger entries and \
-             artifacts)"
-                .to_string()
-        } else {
-            ".socket/vendor/ (the removed vendored ledger entries and artifacts)".to_string()
-        });
-    } else if ledger_written {
-        commit.push(".socket/vendor/redirect-state.json".to_string());
+        commit.push(".socket/vendor/ (the removed vendored ledger entries and artifacts)".to_string());
     }
     commit.extend(files.iter().cloned());
     let npm = files
@@ -3660,91 +3483,6 @@ fn format_next_steps(
     steps
 }
 
-/// Merge this run's vlt node edits into the recorded ones. A fresh edit
-/// for the same `key` and DepID keeps the oldest recorded `original` (the
-/// pristine registry entry), takes the fresh `new` and drops the chain's
-/// later links (a server-written ledger appends one per hosted PR). One
-/// whose recorded same-key edits all name DepIDs the pre-run lock no longer
-/// holds (a re-lock, or a new id grammar after a vlt upgrade) replaces
-/// them. So does one for another key of the same `name@version` whose
-/// vanished recorded edit's pin vlt carried to the fresh DepID (a new peer
-/// context). A replacing edit keeps the recorded pristine slots when vlt
-/// carried the pin ([`carried_pin_original`]). Returns, per fresh edit,
-/// whether it was merged (anything else is appended as usual).
-pub(crate) fn rebase_vlt_edits(
-    ledger: &mut Vec<socket_patch_core::patch::redirect::FileEdit>,
-    fresh: &[socket_patch_core::patch::redirect::FileEdit],
-    before_lock: Option<&str>,
-) -> Vec<bool> {
-    use socket_patch_core::patch::redirect::vlt::{
-        carried_pin_original, edit_dep_id, lock_node_ids, KIND,
-    };
-    use socket_patch_core::patch::redirect::FileEdit;
-    fn superseding(edit: &FileEdit, old: &FileEdit) -> FileEdit {
-        let mut next = edit.clone();
-        if let Some(original) = carried_pin_original(edit, old) {
-            next.original = Some(original);
-        }
-        next
-    }
-    fn key_base(key: &Option<String>) -> Option<&str> {
-        key.as_deref()
-            .map(|k| k.split_once('~').map_or(k, |(base, _)| base))
-    }
-    let live = before_lock.and_then(lock_node_ids).unwrap_or_default();
-    let mut merged = vec![false; fresh.len()];
-    for (i, edit) in fresh.iter().enumerate() {
-        if edit.kind != KIND {
-            continue;
-        }
-        let id = edit_dep_id(edit);
-        let same_key: Vec<usize> = ledger
-            .iter()
-            .enumerate()
-            .filter(|(_, old)| old.kind == KIND && old.path == edit.path && old.key == edit.key)
-            .map(|(j, _)| j)
-            .collect();
-        let same_dep: Vec<usize> = same_key
-            .iter()
-            .copied()
-            .filter(|&j| id.is_some() && edit_dep_id(&ledger[j]) == id)
-            .collect();
-        if let Some((&first, rest)) = same_dep.split_first() {
-            ledger[first].new = edit.new.clone();
-            ledger[first].action = edit.action.clone();
-            for &j in rest.iter().rev() {
-                ledger.remove(j);
-            }
-            merged[i] = true;
-            continue;
-        }
-        let vanished = |j: &usize| edit_dep_id(&ledger[*j]).is_none_or(|old| !live.contains(&old));
-        let gone: Vec<usize> = same_key.into_iter().filter(vanished).collect();
-        if let Some((&first, rest)) = gone.split_first() {
-            ledger[first] = superseding(edit, &ledger[first]);
-            for &j in rest.iter().rev() {
-                ledger.remove(j);
-            }
-            merged[i] = true;
-            continue;
-        }
-        let rekeyed = (0..ledger.len()).find(|j| {
-            let old = &ledger[*j];
-            old.kind == KIND
-                && old.path == edit.path
-                && old.key != edit.key
-                && key_base(&old.key) == key_base(&edit.key)
-                && vanished(j)
-                && carried_pin_original(edit, old).is_some()
-        });
-        if let Some(j) = rekeyed {
-            ledger[j] = superseding(edit, &ledger[j]);
-            merged[i] = true;
-        }
-    }
-    merged
-}
-
 /// Transient-frame boxed constructor for [`run_redirect_selected`] — the
 /// future embeds the whole hosted engine, and callers outside scan (`get
 /// --mode hosted`) must not materialize it in their own poll frame (Windows
@@ -3789,10 +3527,9 @@ mod tests {
         pnpm_lock_may_need_store_flag, pnpm_trust_rerun_reminder, sentence_case, split_sentences,
         wrap_tokens, wrap_words, TAKEOVER_INFO_CODES,
     };
-    use super::{rebase_vlt_edits, REBASE_KINDS};
     use super::{wheel_metadata_concurrency, WHEEL_METADATA_CONCURRENCY};
     use socket_patch_core::constants::npm_family;
-    use socket_patch_core::patch::redirect::{DepOverride, FileEdit};
+    use socket_patch_core::patch::redirect::DepOverride;
     use socket_patch_core::utils::concurrent::API_CONCURRENCY_ENV;
 
     /// The wheel window is a patch-API window, so the documented escape
@@ -5379,14 +5116,12 @@ mod tests {
     }
 
     #[test]
-    fn next_steps_name_the_ledger_files_and_reinstall() {
-        assert!(format_next_steps(&[], true, false).is_empty());
+    fn next_steps_name_the_rewritten_files_and_reinstall() {
+        assert!(format_next_steps(&[], false).is_empty());
         assert_eq!(
-            format_next_steps(&["package-lock.json".to_string()], true, false),
+            format_next_steps(&["package-lock.json".to_string()], false),
             vec![
-                "Commit .socket/vendor/redirect-state.json and package-lock.json to keep the \
-                 redirect."
-                    .to_string(),
+                "Commit package-lock.json to keep the redirect.".to_string(),
                 "Reinstall from the updated lockfile (e.g. `npm ci`) so the installed packages \
                  pick up the patched artifacts, then run `socket-patch vex` to verify them."
                     .to_string(),
@@ -5398,7 +5133,6 @@ mod tests {
                 "pnpm-workspace.yaml".to_string(),
             ],
             false,
-            false,
         );
         assert_eq!(
             steps[0],
@@ -5409,196 +5143,22 @@ mod tests {
 
     #[test]
     fn next_steps_add_the_vlt_ci_line_only_for_a_rewritten_vlt_lock() {
-        let steps = format_next_steps(&["vlt-lock.json".to_string()], true, false);
+        let steps = format_next_steps(&["vlt-lock.json".to_string()], false);
         assert_eq!(
             steps.last().map(String::as_str),
             Some("vlt: commit vlt-lock.json; CI should run `vlt ci`")
         );
         assert!(
-            !format_next_steps(&["package-lock.json".to_string()], true, false)
+            !format_next_steps(&["package-lock.json".to_string()], false)
                 .iter()
                 .any(|s| s.starts_with("vlt:"))
         );
     }
 
-    fn vlt_edit(key: &str, id: &str, slot2: &str, slot3: &str) -> FileEdit {
-        FileEdit {
-            path: "vlt-lock.json".into(),
-            kind: socket_patch_core::patch::redirect::vlt::KIND.into(),
-            action: "rewritten".into(),
-            key: Some(key.into()),
-            original: Some(serde_json::Value::String(format!(
-                "\"{id}\": [0,\"x\",\"sha512-reg\",null]"
-            ))),
-            new: Some(serde_json::Value::String(format!(
-                "\"{id}\": [0,\"x\",\"{slot2}\",\"{slot3}\"]"
-            ))),
-        }
-    }
-
-    fn vlt_lock_with(ids: &[&str]) -> String {
-        let nodes: Vec<String> = ids
-            .iter()
-            .map(|id| format!("    \"{id}\": [0,\"x\"]"))
-            .collect();
-        format!(
-            "{{\n  \"lockfileVersion\": 1,\n  \"nodes\": {{\n{}\n  }},\n  \"edges\": {{}}\n}}\n",
-            nodes.join(",\n")
-        )
-    }
-
-    #[test]
-    fn vlt_rerun_keeps_the_pristine_original_for_the_same_dep_id() {
-        assert!(REBASE_KINDS.contains(&socket_patch_core::patch::redirect::vlt::KIND));
-        let mut ledger = vec![vlt_edit("x@1.0.0", "~npm~x@1.0.0", "sha512-p1", "u1")];
-        let mut fresh = vlt_edit("x@1.0.0", "~npm~x@1.0.0", "sha512-p2", "u2");
-        fresh.original = ledger[0].new.clone();
-        let merged = rebase_vlt_edits(
-            &mut ledger,
-            std::slice::from_ref(&fresh),
-            Some(&vlt_lock_with(&["~npm~x@1.0.0"])),
-        );
-        assert_eq!(merged, [true]);
-        assert_eq!(ledger.len(), 1);
-        assert_eq!(
-            ledger[0].original,
-            vlt_edit("x@1.0.0", "~npm~x@1.0.0", "", "").original
-        );
-        assert_eq!(ledger[0].new, fresh.new);
-    }
-
-    #[test]
-    fn vlt_relocked_dep_id_supersedes_the_recorded_edits() {
-        let mut ledger = vec![
-            vlt_edit("x@1.0.0", "··x@1.0.0", "sha512-p", "u"),
-            vlt_edit("x@1.0.0", "·npm·x@1.0.0", "sha512-p", "u"),
-            vlt_edit("y@1.0.0", "·npm·y@1.0.0", "sha512-p", "u"),
-        ];
-        let fresh = vlt_edit("x@1.0.0", "~npm~x@1.0.0", "sha512-p", "u");
-        let merged = rebase_vlt_edits(
-            &mut ledger,
-            std::slice::from_ref(&fresh),
-            Some(&vlt_lock_with(&["~npm~x@1.0.0", "·npm·y@1.0.0"])),
-        );
-        assert_eq!(merged, [true]);
-        assert_eq!(
-            ledger,
-            [fresh, vlt_edit("y@1.0.0", "·npm·y@1.0.0", "sha512-p", "u")]
-        );
-    }
-
-    fn vlt_pinned_at(edit: &FileEdit, id: &str) -> Option<serde_json::Value> {
-        let new = edit.new.as_ref()?.as_str()?;
-        let (_, tuple) = new.split_once(": ")?;
-        Some(serde_json::Value::String(format!("\"{id}\": {tuple}")))
-    }
-
-    #[test]
-    fn vlt_rerun_collapses_a_server_appended_chain_into_one_link() {
-        let first = vlt_edit("x@1.0.0", "~npm~x@1.0.0", "sha512-pa", "ua");
-        let mut second = vlt_edit("x@1.0.0", "~npm~x@1.0.0", "sha512-pb", "ub");
-        second.original = first.new.clone();
-        let mut ledger = vec![first, second.clone()];
-        let mut fresh = vlt_edit("x@1.0.0", "~npm~x@1.0.0", "sha512-pc", "uc");
-        fresh.original = second.new.clone();
-        let merged = rebase_vlt_edits(
-            &mut ledger,
-            std::slice::from_ref(&fresh),
-            Some(&vlt_lock_with(&["~npm~x@1.0.0"])),
-        );
-        assert_eq!(merged, [true]);
-        assert_eq!(
-            ledger,
-            [FileEdit {
-                original: vlt_edit("x@1.0.0", "~npm~x@1.0.0", "", "").original,
-                ..fresh
-            }]
-        );
-    }
-
-    #[test]
-    fn vlt_rerun_after_a_peer_context_rekey_keeps_the_pristine_slots() {
-        let old_id = "~npm~x@1.0.0~peer.0df72515a50372ba";
-        let new_id = "~npm~x@1.0.0~peer.32643a3290c32d5d";
-        let recorded = vlt_edit("x@1.0.0~peer.0df72515a50372ba", old_id, "sha512-p1", "u1");
-        let mut ledger = vec![
-            vlt_edit("y@1.0.0", "~npm~y@1.0.0", "sha512-p", "u"),
-            recorded.clone(),
-        ];
-        let mut fresh = vlt_edit("x@1.0.0~peer.32643a3290c32d5d", new_id, "sha512-p2", "u2");
-        fresh.original = vlt_pinned_at(&recorded, new_id);
-        let merged = rebase_vlt_edits(
-            &mut ledger,
-            std::slice::from_ref(&fresh),
-            Some(&vlt_lock_with(&[new_id, "~npm~y@1.0.0"])),
-        );
-        assert_eq!(merged, [true]);
-        assert_eq!(ledger.len(), 2);
-        assert_eq!(ledger[1].key, fresh.key);
-        assert_eq!(ledger[1].new, fresh.new);
-        assert_eq!(
-            ledger[1].original,
-            Some(serde_json::Value::String(format!(
-                "\"{new_id}\": [0,\"x\",\"sha512-reg\"]"
-            )))
-        );
-
-        let mut pristine = vec![recorded.clone()];
-        let relocked = vlt_edit("x@1.0.0~peer.32643a3290c32d5d", new_id, "sha512-p2", "u2");
-        let merged = rebase_vlt_edits(
-            &mut pristine,
-            std::slice::from_ref(&relocked),
-            Some(&vlt_lock_with(&[new_id])),
-        );
-        assert_eq!(merged, [false], "a re-lock that dropped the pin appends");
-        assert_eq!(pristine, [recorded]);
-    }
-
-    #[test]
-    fn vlt_relocked_dep_id_that_kept_the_pin_keeps_the_pristine_slots() {
-        let recorded = vlt_edit("x@1.0.0", "·npm·x@1.0.0", "sha512-p1", "u1");
-        let mut ledger = vec![recorded.clone()];
-        let mut fresh = vlt_edit("x@1.0.0", "~npm~x@1.0.0", "sha512-p2", "u2");
-        fresh.original = vlt_pinned_at(&recorded, "~npm~x@1.0.0");
-        let merged = rebase_vlt_edits(
-            &mut ledger,
-            std::slice::from_ref(&fresh),
-            Some(&vlt_lock_with(&["~npm~x@1.0.0"])),
-        );
-        assert_eq!(merged, [true]);
-        assert_eq!(
-            ledger,
-            [FileEdit {
-                original: Some(serde_json::Value::String(
-                    "\"~npm~x@1.0.0\": [0,\"x\",\"sha512-reg\"]".into()
-                )),
-                ..fresh
-            }]
-        );
-    }
-
-    #[test]
-    fn vlt_edit_of_a_live_sibling_dep_id_is_appended() {
-        let mut ledger = vec![vlt_edit("x@1.0.0", "··x@1.0.0", "sha512-p", "u")];
-        let fresh = vlt_edit("x@1.0.0", "·npm·x@1.0.0", "sha512-p", "u");
-        let merged = rebase_vlt_edits(
-            &mut ledger,
-            std::slice::from_ref(&fresh),
-            Some(&vlt_lock_with(&["··x@1.0.0", "·npm·x@1.0.0"])),
-        );
-        assert_eq!(merged, [false]);
-        assert_eq!(ledger.len(), 1);
-    }
-
     #[test]
     fn next_steps_after_a_takeover_name_the_removed_vendored_state() {
         assert_eq!(
-            format_next_steps(&["package-lock.json".to_string()], true, true)[0],
-            "Commit .socket/vendor/ (the redirect ledger, plus the removed vendored ledger \
-             entries and artifacts) and package-lock.json to keep the redirect."
-        );
-        assert_eq!(
-            format_next_steps(&["pnpm-lock.yaml".to_string()], false, true)[0],
+            format_next_steps(&["pnpm-lock.yaml".to_string()], true)[0],
             "Commit .socket/vendor/ (the removed vendored ledger entries and artifacts) and \
              pnpm-lock.yaml to keep the redirect."
         );
diff --git a/crates/socket-patch-cli/src/commands/scan/mod.rs b/crates/socket-patch-cli/src/commands/scan/mod.rs
index 20ab9896..0b9ff3c3 100644
--- a/crates/socket-patch-cli/src/commands/scan/mod.rs
+++ b/crates/socket-patch-cli/src/commands/scan/mod.rs
@@ -21,7 +21,7 @@ use socket_patch_core::telemetry::{
     spawn_patch_scan_failed, spawn_patch_scanned, PendingTelemetry,
 };
 use socket_patch_core::utils::concurrent::{api_concurrency_for, ordered_concurrent};
-use socket_patch_core::utils::purl::{normalize_purl, purl_name_version, strip_purl_qualifiers};
+use socket_patch_core::utils::purl::{normalize_purl, strip_purl_qualifiers};
 use socket_patch_core::vendor::VendorState;
 use socket_patch_core::vex::discover::{LedgerLiveness, WiringMode};
 use std::collections::{HashMap, HashSet};
@@ -687,19 +687,6 @@ async fn fetch_patch_details(
     (results, failures)
 }
 
-/// The human hosted arm's stand-in for the lenient loader's advisory: a
-/// malformed redirect ledger the engine would report as a hard error, on a
-/// run that returned BEFORE the engine (empty discovery, nothing
-/// downloadable, a detail-fetch failure). Read-only —
-/// the file is never moved; `--silent` mutes it like every advisory.
-fn warn_unreported_corrupt_ledger(common: &crate::args::GlobalArgs, corrupt: Option<&str>) {
-    if let Some(corrupt) = corrupt {
-        if !common.silent {
-            eprintln!("Warning: {corrupt}");
-        }
-    }
-}
-
 /// Fold a [`discover_selected`] failure into a JSON caller's `result` and
 /// print it. The discovery counts already in `result` stay — they were
 /// computed from the (successful) batch phase — while `status`/`error`
@@ -800,6 +787,7 @@ fn download_params(args: &ScanArgs, save_only: bool, json: bool, silent: bool) -
         strict: args.common.strict,
         ecosystems: args.common.ecosystems.clone(),
         persist_blobs: args.mode != Some(ScanMode::Vendored),
+        patch_server_url: args.common.patch_server_url.clone(),
     }
 }
 
@@ -816,33 +804,29 @@ fn download_run<'a>(args: &ScanArgs, api_client: &'a ApiClient) -> DownloadRun<'
 }
 
 // ---------------------------------------------------------------------------
-// Cross-mode ledger takeover detection (hosted ⇄ vendored)
+// Cross-mode takeover detection (hosted over vendored)
 // ---------------------------------------------------------------------------
 //
-// Hosted mode writes `.socket/vendor/redirect-state.json`; vendored mode
-// writes `.socket/vendor/state.json` (+ committed tarballs). Switching a
-// project's mode rewires the lockfile but leaves the OLD mode's ledger on
-// disk asserting wiring that is no longer live, which misleads anything
-// auditing a ledger (including `vex`). Detect the overlap so each flow can
-// warn. The VENDORED flows clean the superseded redirect-ledger halves
-// themselves (always announced); the HOSTED direction stays warn-only
-// (removing a vendored entry deletes committed artifacts — `remove
-// <purl>`'s job).
+// Vendored mode writes `.socket/vendor/state.json` (+ committed tarballs);
+// hosted mode keeps no ledger — its lockfile pins are the only record.
+// Redirecting a vendored package to the hosted patch server rewires the
+// lockfile but leaves the vendored ledger entry on disk asserting wiring that
+// is no longer live, which misleads anything auditing the ledger (including
+// `vex`). Detect the overlap so the hosted flow can warn (removing a vendored
+// entry deletes committed artifacts — `remove <purl>`'s job). The reverse
+// direction needs no advisory: once the lock routes a package to
+// `.socket/vendor/`, no hosted state is left to go stale.
 //
-// The overlap only proves BOTH ledgers name the package, not which won. The
-// takeover DIRECTION comes from the current lockfile wiring per package
-// (`classify_overlap_takeover`), never from which command is running;
-// remediation points at the ledger that does NOT match the live lock, and a
-// package the lock proves neither way stays silent.
+// The overlap only proves the vendored ledger and a hosted pin both name the
+// package, not which won. The takeover DIRECTION comes from the current
+// lockfile wiring per package (`classify_overlap_takeover`), never from
+// which command is running, and a package the lock proves neither way stays
+// silent.
 
 /// Warning code emitted by the HOSTED flow when it just redirected package(s)
 /// a committed vendored ledger still claims (its tarballs are now orphaned).
 pub(super) const REDIRECT_SUPERSEDES_VENDORED: &str = "redirect_supersedes_vendored";
 
-/// Warning code emitted by the VENDORED flow when it just vendored package(s)
-/// a committed hosted redirect ledger still claims.
-pub(super) const VENDOR_SUPERSEDES_REDIRECT: &str = "vendor_supersedes_redirect";
-
 /// Warning code + detail emitted when `--prune` is combined with
 /// `--mode hosted`: the hosted flow runs no GC, so the flag would otherwise
 /// be silently dropped. `--prune` stays accepted (CLI_CONTRACT.md: an
@@ -854,12 +838,12 @@ pub(super) const REDIRECT_PRUNE_IGNORED_DETAIL: &str =
      runs no GC sweep of `.socket/` state; run `scan --mode agent --prune` or \
      `scan --mode vendored --prune` to garbage-collect";
 
-/// The PURLs claimed by BOTH the hosted redirect ledger
-/// (`.socket/vendor/redirect-state.json`) and the vendored state ledger
-/// (`.socket/vendor/state.json`), sorted, over already-loaded ledgers. A
-/// non-empty result means exactly one of the two ledgers is stale for each
-/// PURL (a lockfile entry can point only one way). `None`, an empty vendor
-/// ledger, or disjoint ledgers (a legitimate split) yield no overlap.
+/// The PURLs claimed by BOTH a hosted pin (`redirect`, the lockfiles'
+/// hosted state — see [`crate::commands::hosted_state_from_lockfiles`]) and
+/// the vendored state ledger (`.socket/vendor/state.json`), sorted. A
+/// non-empty result means one of the two is stale for each PURL (a
+/// lockfile entry can point only one way). `None`, an empty vendor ledger,
+/// or disjoint states (a legitimate split) yield no overlap.
 fn overlap_from_states(
     redirect: Option<&socket_patch_core::patch::redirect::RedirectState>,
     vendor: &VendorState,
@@ -867,54 +851,23 @@ fn overlap_from_states(
     let Some(redirect) = redirect else {
         return Vec::new();
     };
-    if vendor.entries.is_empty() {
+    if vendor.entries.is_empty() || redirect.records.is_empty() {
         return Vec::new();
     }
-    // Canonicalize both sides (drop qualifiers, percent-decode) so the API
-    // purl form the redirect records carry matches the vendor entry's base
-    // purl — mirrors `vendored_ledger_supplement`.
+    // Canonicalize both sides (drop qualifiers, percent-decode) so the
+    // hosted pin's purl matches the vendor entry's base purl — mirrors
+    // `vendored_ledger_supplement`.
     let canon = |p: &str| normalize_purl(strip_purl_qualifiers(p)).into_owned();
     let mut vendor_purls: std::collections::BTreeSet<String> = std::collections::BTreeSet::new();
     for (key, entry) in &vendor.entries {
         vendor_purls.insert(canon(key));
         vendor_purls.insert(canon(&entry.base_purl));
     }
-    if !redirect.records.is_empty() {
-        let redirect_purls: std::collections::BTreeSet<String> =
-            redirect.records.keys().map(|p| canon(p)).collect();
-        return redirect_purls
-            .intersection(&vendor_purls)
-            .cloned()
-            .collect();
-    }
-    // The records map can be EMPTY while the ledger still asserts stale lock
-    // wiring (every per-uuid record fetch failed: `record_fetch_failed`), so
-    // fall back to matching the vendored purls against the recorded edit
-    // keys — npm `node_modules/<name>` (possibly nested), pnpm/yarn/cargo/uv
-    // `<name>@<version>` (vlt `<name>@<version>~<extra>`), bun
-    // `<prefix>/<name>`, gem/composer/pypi bare `<name>`. Name-level matching
-    // can over-claim across versions, but `classify_overlap_takeover` still
-    // requires the live lock to prove one side before anything is reported.
-    if redirect.edits.is_empty() {
-        return Vec::new();
-    }
-    vendor_purls
-        .into_iter()
-        .filter(|purl| {
-            let Some((name, version)) = purl_name_version(strip_purl_qualifiers(purl)) else {
-                return false;
-            };
-            redirect
-                .edits
-                .iter()
-                .filter_map(|e| e.key.as_deref())
-                .any(|key| {
-                    key == name
-                        || key == format!("{name}@{version}")
-                        || key.starts_with(&format!("{name}@{version}~"))
-                        || key.ends_with(&format!("/{name}"))
-                })
-        })
+    let redirect_purls: std::collections::BTreeSet<String> =
+        redirect.records.keys().map(|p| canon(p)).collect();
+    redirect_purls
+        .intersection(&vendor_purls)
+        .cloned()
         .collect()
 }
 
@@ -926,7 +879,7 @@ fn overlap_from_states(
 /// / `Discovery::vendor_entry_live`). `redirect` holds the overlap PURLs the
 /// lock routes to the hosted patch server (the vendored ledger entry is
 /// stale); `vendored` holds those it routes to a committed
-/// `.socket/vendor/<eco>/<uuid>` artifact (the redirect record is stale).
+/// `.socket/vendor/<eco>/<uuid>` artifact.
 ///
 /// A PURL the lock proves NEITHER way — a dry-run/no-op that did not rewire it,
 /// a half-migrated lock naming both, or an ecosystem whose live spec we cannot
@@ -936,27 +889,25 @@ fn overlap_from_states(
 pub(super) struct OverlapTakeover {
     /// Overlap PURLs whose vendored ledger is stale (lock points hosted).
     pub redirect: Vec<String>,
-    /// Overlap PURLs whose redirect ledger is stale (lock points vendored).
+    /// Overlap PURLs the lock routes to the vendored artifact.
     pub vendored: Vec<String>,
 }
 
+/// [`classify_overlap_takeover_with`] over the on-disk state: the
+/// lockfiles' hosted pins and the committed vendored ledger.
+#[cfg(test)]
 pub(super) async fn classify_overlap_takeover(common: &GlobalArgs, cwd: &Path) -> OverlapTakeover {
-    // Both ledgers loaded ONCE here. A malformed ledger classifies like a
-    // missing one, matching `overlap_from_states` (this path only
-    // feeds takeover warnings; corruption is a hard error on the
+    // A malformed vendor ledger classifies like a missing one (this path
+    // only feeds takeover warnings; corruption is a hard error on the
     // write/attest paths).
-    let redirect = socket_patch_core::patch::redirect::load_redirect_state(cwd)
-        .await
-        .ok()
-        .flatten();
+    let redirect = crate::commands::hosted_state_from_lockfiles(common, cwd).await;
     let vendor = socket_patch_core::vendor::load_state(cwd).await.ok();
-    classify_overlap_takeover_with(common, cwd, redirect.as_ref(), vendor.as_ref()).await
+    classify_overlap_takeover_with(common, cwd, Some(&redirect), vendor.as_ref()).await
 }
 
-/// [`classify_overlap_takeover`] over already-loaded ledgers (the hosted
-/// engine must classify against its in-memory post-merge / post-takeover
-/// copies, never a pre-takeover snapshot); still reads the LIVE lockfiles
-/// in `cwd`. `None` for either ledger yields no overlap.
+/// [`classify_overlap_takeover`] over already-loaded state (the hosted
+/// engine classifies against its post-takeover vendor ledger); still reads
+/// the LIVE lockfiles in `cwd`. `None` for either yields no overlap.
 pub(super) async fn classify_overlap_takeover_with(
     common: &GlobalArgs,
     cwd: &Path,
@@ -984,10 +935,8 @@ pub(super) async fn classify_overlap_takeover_with(
             .entry(canon(&entry.base_purl))
             .or_insert(entry);
     }
-    // The hosted proof needs the redirect ledger too: each record's patch
-    // uuid (embedded in every hosted artifact URL, whatever the host) and
-    // the lockfiles the redirect actually edited. A non-empty overlap
-    // proves the ledger is `Some`.
+    // Each hosted pin's patch uuid (embedded in every hosted artifact URL,
+    // whatever the host). A non-empty overlap proves `redirect` is `Some`.
     let mut redirect_uuid_by_purl: std::collections::HashMap<String, &str> =
         std::collections::HashMap::new();
     for (key, record) in redirect.iter().flat_map(|r| &r.records) {
@@ -996,12 +945,10 @@ pub(super) async fn classify_overlap_takeover_with(
             .or_insert(record.uuid.as_str());
     }
     let discovery = crate::commands::discover_wiring(common, cwd).await;
-    let mut liveness = LedgerLiveness::new(cwd, &discovery, redirect);
+    let mut liveness = LedgerLiveness::new(cwd, &discovery, None);
     for purl in overlap {
         let hosted_live = match redirect_uuid_by_purl.get(&purl) {
             Some(uuid) => liveness.redirect_record(&purl, uuid).await,
-            // An edits-only ledger (every record fetch failed) names no
-            // uuid: the lock's own hosted wiring of the package decides.
             None => discovery.wires_package(&purl, WiringMode::Hosted),
         };
         let vendored_live = match vendor_by_purl.get(&purl) {
@@ -1021,159 +968,42 @@ pub(super) async fn classify_overlap_takeover_with(
     out
 }
 
-/// Human-readable detail for a mode-takeover warning naming the displaced
-/// package(s). `current_is_hosted` selects the direction: `true` when a
-/// hosted redirect displaced a vendored ledger, `false` when a vendored run
-/// displaced a hosted redirect ledger.
+/// Human-readable detail for the hosted-over-vendored takeover warning
+/// ([`REDIRECT_SUPERSEDES_VENDORED`]) naming the displaced package(s).
 ///
 /// The warning fires PER PACKAGE, so the remediation is per-package and
-/// non-destructive: never delete a whole ledger file or a whole
-/// `.socket/vendor/<eco>/` tree, which may still carry LIVE data for
-/// packages this takeover did not touch (other records VEX reads, the
-/// pre-redirect originals that are the only revert data, other vendored
-/// uuid dirs).
-///
-/// It must also be COMPLETE per package, or it does not converge:
-///
-/// * The vendored direction names the package's `edits` entry alongside its
-///   `records` entry: `overlap_from_states` falls back to edit KEYS once
-///   `records` is empty, so a records-only cleanup keeps this warning firing.
-/// * The hosted direction states `socket-patch remove`'s full blast radius,
-///   including the package's `.socket/manifest.json` entry.
-pub(super) fn mode_takeover_detail(superseded: &[String], current_is_hosted: bool) -> String {
+/// non-destructive: never delete a whole `.socket/vendor/<eco>/` tree, which
+/// may still carry LIVE data for packages this takeover did not touch. It
+/// states `socket-patch remove`'s full blast radius, including the
+/// package's `.socket/manifest.json` entry.
+pub(super) fn mode_takeover_detail(superseded: &[String]) -> String {
     let list = superseded.join(", ");
-    if current_is_hosted {
-        // NEVER offer deleting the `.socket/vendor/<eco>/` tree here: for
-        // cargo the leftover `[patch.crates-io]` entry still points at that
-        // tree, and deleting it hard-fails every cargo invocation ("failed to
-        // load source for dependency"). Nor `vendor --revert`, which unwinds
-        // EVERY vendored package including the ones still live in the
-        // lockfile — `remove <purl>` is the per-package equivalent.
-        format!(
-            "hosted redirect superseded the vendored ledger for: {list}. \
-             `.socket/vendor/state.json` still claims these package(s) and their \
-             committed artifacts under `.socket/vendor/` are now orphaned — the \
-             lockfile points at the hosted patch server, not the vendored files. \
-             Clean up per package: run `socket-patch remove <purl>` for each \
-             package listed above, so audits and VEX do not read superseded \
-             wiring. It drops that package's vendored ledger entry and its own \
-             `.socket/vendor/<eco>/<uuid>/` artifact directory, AND deletes that \
-             package's now-superseded `.socket/manifest.json` entry — that entry \
-             describes the vendored delivery, while the live hosted patch is \
-             recorded in `.socket/vendor/redirect-state.json`, which `remove` \
-             never touches. In-place file rollback is skipped for vendor-owned \
-             package(s), so the installed tree is left as the lockfile wires it; \
-             preview with `--dry-run` first. Do not delete the whole \
-             `.socket/vendor/<eco>/` tree and do not run `vendor --revert`: \
-             other vendored package(s) may still be live in the lockfile and \
-             would break or be mass-reverted."
-        )
-    } else {
-        // NEVER advise deleting the redirect ledger by hand: it may hold the
-        // only revert data (FileEdit originals) and VEX records for OTHER
-        // packages that are still hosted-redirected.
-        format!(
-            "vendored artifacts superseded the hosted redirect ledger for: {list}. \
-             `.socket/vendor/redirect-state.json` still records a hosted redirect for \
-             these package(s), but the lockfile now points at the committed \
-             `.socket/vendor/` files. The vendored flows (`socket-patch vendor`, \
-             `scan --mode vendored`) reconcile npm-family and cargo package(s) \
-             automatically on their next non-dry run, dropping both halves of \
-             each superseded entry — the `records` entry AND its matching \
-             `edits` (cargo additionally reverts the stale hosted edits on disk \
-             first). For other package(s), or if the automatic reconciliation \
-             could not run, clean up by hand: delete only these package(s)' \
-             entries under `records` AND their matching entries under `edits`, \
-             so audits and VEX do not read superseded wiring. \
-             Both halves matter: the leftover `edits` are that package's stale \
-             pre-redirect originals, which a later redirect revert would replay \
-             over the live vendored wiring — and an `edits` entry left behind \
-             still names the package, so a ledger whose last record you just \
-             deleted keeps reading as superseded and this warning keeps firing. \
-             Do not delete the ledger file itself: it may still hold live \
-             redirect records for other package(s), plus the recorded \
-             pre-redirect lockfile originals (`edits`) a future revert needs \
-             for them."
-        )
-    }
-}
-
-/// Detail for the vendored-direction takeover warning on the run that
-/// RECONCILED the ledger in place (non-dry-run, npm-family): past tense,
-/// stating what was dropped and where the revert data now lives. The code
-/// stays `vendor_supersedes_redirect` (codes are stable; only the detail
-/// differs), and it fires once — the reconciled ledger no longer overlaps.
-pub(super) fn mode_takeover_reconciled_detail(
-    reconciled: &[String],
-    npmrc_unwound: bool,
-) -> String {
-    let list = reconciled.join(", ");
-    // Only a run that actually unwound the hosted npm allow-remote
-    // auto-config says so (with its npm >= 12 caveat).
-    let npmrc = if npmrc_unwound {
-        " The hosted redirect's `.npmrc` `allow-remote=all` auto-config was \
-         unwound too (a redirect-created file deleted, an appended line \
-         removed): the vendored `file:` specs do not need it. If you later \
-         restore the hosted lock wiring with `vendor --revert`, npm >=12 \
-         refuses it (EALLOWREMOTE) until `allow-remote=all` is back — re-run \
-         `scan --mode hosted` afterwards to re-establish it and its ledger \
-         record."
-    } else {
-        ""
-    };
+    // NEVER offer deleting the `.socket/vendor/<eco>/` tree here: for cargo
+    // the leftover `[patch.crates-io]` entry still points at that tree, and
+    // deleting it hard-fails every cargo invocation ("failed to load source
+    // for dependency"). Nor `vendor --revert`, which unwinds EVERY vendored
+    // package including the ones still live in the lockfile — `remove
+    // <purl>` is the per-package equivalent.
     format!(
-        "vendored artifacts superseded the hosted redirect ledger for: {list}; \
-         reconciled automatically. Both halves of each superseded entry — the \
-         package's `records` entry AND its matching `edits` — were dropped \
-         from `.socket/vendor/redirect-state.json` (an emptied ledger is \
-         deleted). The lockfile points at the committed `.socket/vendor/` \
-         files, and the pre-vendor lock values (including the hosted-spliced \
-         fragment) are preserved as the vendor ledger's wiring originals, so \
-         `vendor --revert` still restores the hosted lock wiring \
-         byte-for-byte.{npmrc} Ledger data for other, still-redirected \
-         package(s) was left untouched. No action needed."
+        "hosted redirect superseded the vendored ledger for: {list}. \
+         `.socket/vendor/state.json` still claims these package(s) and their \
+         committed artifacts under `.socket/vendor/` are now orphaned — the \
+         lockfile points at the hosted patch server, not the vendored files. \
+         Clean up per package: run `socket-patch remove <purl>` for each \
+         package listed above, so audits and VEX do not read superseded \
+         wiring. It drops that package's vendored ledger entry and its own \
+         `.socket/vendor/<eco>/<uuid>/` artifact directory, AND deletes that \
+         package's now-superseded `.socket/manifest.json` entry — that entry \
+         describes the vendored delivery, while the live hosted patch is \
+         recorded in the lockfile itself. In-place file rollback is skipped \
+         for vendor-owned package(s), so the installed tree is left as the \
+         lockfile wires it; preview with `--dry-run` first. Do not delete the \
+         whole `.socket/vendor/<eco>/` tree and do not run `vendor --revert`: \
+         other vendored package(s) may still be live in the lockfile and \
+         would break or be mass-reverted."
     )
 }
 
-/// Drop the superseded purls' `records` + `edits` from the redirect ledger
-/// and persist it (atomic write; an emptied ledger is deleted). Called ONLY
-/// with purls [`classify_overlap_takeover`] proved vendored-live AND
-/// hosted-dead: that gate makes the drop lossless (the vendor ledger's
-/// wiring `original` embeds the hosted-spliced fragment, so `vendor
-/// --revert` needs nothing from these records). `Ok(Some(npmrc))`:
-/// reconciled, with the `.npmrc` allow-remote unwind outcome; `Ok(None)`:
-/// nothing matched (caller falls back to the manual advisory); `Err`: the
-/// ledger could not be read or persisted (fail closed: on-disk ledger
-/// untouched or fully pre-drop).
-async fn reconcile_superseded_redirect(
-    cwd: &Path,
-    purls: &[String],
-) -> Result<Option<socket_patch_core::patch::redirect::npmrc::NpmrcStandaloneUnwind>, String> {
-    let mut state = match socket_patch_core::patch::redirect::load_redirect_state(cwd).await {
-        Ok(Some(state)) => state,
-        Ok(None) => return Ok(None),
-        Err(corrupt) => return Err(corrupt.to_string()),
-    };
-    let mut dropped = false;
-    for purl in purls {
-        dropped |= socket_patch_core::patch::redirect::drop_superseded_purl(&mut state, purl);
-    }
-    if !dropped {
-        return Ok(None);
-    }
-    // The dropped npm purls may have been the last entries the hosted
-    // `.npmrc` `allow-remote=all` auto-config served: unwind it before
-    // persisting, so a hosted→vendored migration leaves no loosened install
-    // policy behind (vendored `file:` specs are gated by `allow-file`).
-    let npmrc =
-        socket_patch_core::patch::redirect::npmrc::unwind_unneeded_npmrc(cwd, &mut state, false)
-            .await?;
-    socket_patch_core::patch::redirect::persist_redirect_state(cwd, &state)
-        .await
-        .map_err(|e| e.to_string())?;
-    Ok(Some(npmrc))
-}
-
 /// Record a run-level advisory: stderr `Warning (code): detail` in human
 /// mode (informational, so muted by `--silent`) and `warnings[]` on the
 /// envelope for JSON consumers. Shared by the vendored flows here and in
@@ -1193,82 +1023,6 @@ pub(super) fn push_run_warning(
     });
 }
 
-/// Cross-mode takeover advisory shared by every VENDORED flow (`vendor`,
-/// `scan --mode vendored`): when this ledger and a committed hosted redirect
-/// ledger both claim package(s) AND the live lockfile proves vendored won,
-/// the redirect ledger records for those package(s) are stale. Warn once at
-/// the envelope level (JSON `warnings[]` and stderr) — and, for npm-family
-/// package(s) on a non-dry run, reconcile the ledger in place (cargo
-/// reverts + drops BEFORE vendoring in `vendor.rs`; npm-family needs no
-/// on-disk revert, since vendoring already overwrote the hosted splice and
-/// recorded it as the wiring `original`). The reverse direction
-/// (`redirect_supersedes_vendored`) is deliberately untouched.
-pub(super) async fn note_vendor_supersedes_redirect(
-    env: &mut crate::json_envelope::Envelope,
-    cwd: &Path,
-    common: &GlobalArgs,
-) {
-    // Only the package(s) the LIVE lockfile routes to `.socket/vendor/`.
-    let superseded = classify_overlap_takeover(common, cwd).await.vendored;
-    if superseded.is_empty() {
-        return;
-    }
-    // Reconciliation is gated, each fail-closed to the manual advisory:
-    // never under --dry-run; only npm-family purls (cargo reverts in
-    // vendor.rs, and other ecosystems' vendor wiring is not verified to
-    // embed the hosted originals); only purls classified above.
-    let (reconcilable, manual): (Vec<String>, Vec<String>) = if common.dry_run {
-        (Vec::new(), superseded)
-    } else {
-        superseded
-            .into_iter()
-            .partition(|purl| purl.starts_with("pkg:npm/"))
-    };
-    if !manual.is_empty() {
-        push_run_warning(
-            env,
-            common,
-            VENDOR_SUPERSEDES_REDIRECT,
-            mode_takeover_detail(&manual, /*current_is_hosted=*/ false),
-        );
-    }
-    if reconcilable.is_empty() {
-        return;
-    }
-    match reconcile_superseded_redirect(cwd, &reconcilable).await {
-        Ok(Some(npmrc)) => {
-            push_run_warning(
-                env,
-                common,
-                VENDOR_SUPERSEDES_REDIRECT,
-                mode_takeover_reconciled_detail(&reconcilable, npmrc.file_changed),
-            );
-            for (code, detail) in npmrc.warnings {
-                push_run_warning(env, common, &code, detail);
-            }
-        }
-        // Nothing matched to drop — do not claim a reconciliation that did
-        // not happen; hand out the manual remediation instead.
-        Ok(None) => push_run_warning(
-            env,
-            common,
-            VENDOR_SUPERSEDES_REDIRECT,
-            mode_takeover_detail(&reconcilable, /*current_is_hosted=*/ false),
-        ),
-        Err(e) => push_run_warning(
-            env,
-            common,
-            VENDOR_SUPERSEDES_REDIRECT,
-            format!(
-                "{} Automatic reconciliation failed ({e}); the ledger was left \
-                 as it was, so this warning will fire again until the cleanup \
-                 above succeeds.",
-                mode_takeover_detail(&reconcilable, /*current_is_hosted=*/ false)
-            ),
-        ),
-    }
-}
-
 /// Top-level `warnings[]` JSON for scan's envelope from `(code, detail)`
 /// pairs (see [`unsupported_layout_warnings`]). Same `{code, detail}` object
 /// shape as the run-level `warnings[]` on the unified envelope.
@@ -1322,21 +1076,21 @@ pub(super) const API_BATCH_FAILED: &str = "api_batch_failed";
 /// prefix. (Every query failing is the discovery error envelope instead.)
 pub(super) const PATCH_DETAILS_FAILED: &str = "patch_details_failed";
 
-/// The scanned purls whose HOSTED redirect wiring is still live: the
-/// redirect ledger records the purl AND lockfile discovery proves the
-/// current lockfile still routes it to that hosted patch — core
+/// The scanned purls whose HOSTED redirect wiring is still live: a hosted
+/// pin names the purl (`redirect_state`, the lockfiles' hosted state — see
+/// [`crate::commands::hosted_state_from_lockfiles`]) AND lockfile discovery
+/// proves the current lockfile still routes it to that hosted patch — core
 /// `Discovery::redirect_record_live`, the same liveness rule `vex` gates
-/// redirect-ledger attestations on.
+/// hosted attestations on.
 ///
 /// Deliberately NOT routed through [`classify_overlap_takeover`]: that
 /// classifier keys on purls present in BOTH ledgers, so hosted-only wiring
 /// can never trigger it (pinned by
 /// `hosted_only_wiring_fires_agent_probe_not_the_overlap_classifier`).
 ///
-/// Silent cases (each pinned by a test): ledger absent/malformed or
-/// `records` empty (even while `edits` remain); purl not scanned this run;
-/// the live lock does not prove hosted wiring — never guess from ledger
-/// presence alone.
+/// Silent cases (each pinned by a test): no hosted pin (a pre-v5 ledger is
+/// not hosted state); purl not scanned this run; the live lock does not
+/// prove hosted wiring.
 pub(super) async fn hosted_wiring_retained_purls(
     common: &GlobalArgs,
     redirect_state: Option<&socket_patch_core::patch::redirect::RedirectState>,
@@ -1366,7 +1120,7 @@ pub(super) async fn hosted_wiring_retained_purls(
     }
     let cwd = &common.cwd;
     let discovery = crate::commands::discover_wiring(common, cwd).await;
-    let mut liveness = LedgerLiveness::new(cwd, &discovery, Some(redirect));
+    let mut liveness = LedgerLiveness::new(cwd, &discovery, None);
     let mut out = Vec::new();
     for (purl, uuid) in candidates {
         if liveness.redirect_record(&purl, uuid).await {
@@ -1379,28 +1133,20 @@ pub(super) async fn hosted_wiring_retained_purls(
 }
 
 /// Detail for [`HOSTED_WIRING_RETAINED`]. Names the package(s) and the
-/// real options — stay hosted, migrate via the vendored flow (which
-/// reconciles the superseded ledger entries per package), or unwind via
-/// `rollback`. It must never advise hand-deleting the redirect ledger
-/// (the only store of the pre-redirect originals plus the records VEX
-/// reads).
+/// real options — stay hosted, migrate via the vendored flow, or restore
+/// the upstream registry entries via `rollback`.
 pub(super) fn hosted_wiring_retained_detail(retained: &[String]) -> String {
     let list = retained.join(", ");
     format!(
         "agent-mode scan left the hosted redirect wiring live for: {list}. \
          The lockfile still resolves these package(s) to the hosted patch \
-         server and `.socket/vendor/redirect-state.json` still records the \
-         redirect — an agent run patches installed files in place but does \
+         server — an agent run patches installed files in place but does \
          NOT unwind hosted lockfile wiring, so installs keep fetching \
          these package(s) from the patch server. Either keep the project \
          in hosted mode (`scan --mode hosted`), migrate to committed \
          artifacts with `scan --mode vendored` (which takes these \
-         package(s) over in the lockfile and reconciles the superseded \
-         redirect ledger entries), or unwind the redirects with \
-         `socket-patch rollback`. Do not delete \
-         `.socket/vendor/redirect-state.json` by hand: it holds the \
-         recorded pre-redirect lockfile originals (the only revert data) \
-         and the redirect records VEX reads."
+         package(s) over in the lockfile), or restore their upstream \
+         registry entries with `socket-patch rollback`."
     )
 }
 
@@ -1429,22 +1175,19 @@ pub(super) fn vendored_ownership_retained_detail(purls: &[String]) -> String {
 }
 
 /// Additive top-level `redirectState` block for the scan `--json` envelope:
-/// the hosted redirect ledger's records — project STATE, so a descriptive
-/// block rather than a warning — plus the scanned purls whose hosted
-/// lockfile wiring the live lock still proves.
+/// the hosted pins the lockfiles wire — project STATE, so a descriptive
+/// block rather than a warning — plus the scanned purls among them.
 ///
-/// `None` (key omitted, additive contract) when the ledger is absent or its
-/// `records` are empty — an edits-only ledger asserts no patches.
+/// `None` (key omitted, additive contract) when no lockfile pins a hosted
+/// patch.
 ///
-/// Shape: `{ mode, ledger, records: [{purl, ledgerKey, uuid}], wiringLive:
-/// [purl] }`. `mode` is the constant [`crate::commands::HOSTED_MODE_LABEL`],
-/// never the ledger's own `mode` string (older ledgers carry `"redirect"`).
-/// Each record's `purl` is canonicalized (qualifiers stripped,
-/// percent-decoded) to the spelling `wiringLive` carries; `ledgerKey` is the
-/// ledger's verbatim key. `wiring_live` is the caller's
-/// [`hosted_wiring_retained_purls`] result, computed once per run. A record
-/// with no proof means the wiring was unwound, the lock is unreadable, or
-/// the purl was not crawled this run — never "still live".
+/// Shape: `{ mode, records: [{purl, uuid}], wiringLive: [purl] }`. `mode`
+/// is the constant [`crate::commands::HOSTED_MODE_LABEL`]. Each record's
+/// `purl` is canonicalized (qualifiers stripped, percent-decoded) to the
+/// spelling `wiringLive` carries. `wiring_live` is the caller's
+/// [`hosted_wiring_retained_purls`] result, computed once per run: the pins
+/// this run crawled (a pin whose package was not crawled is still wired,
+/// just not covered by this run).
 pub(super) fn redirect_state_json(
     redirect_state: Option<&socket_patch_core::patch::redirect::RedirectState>,
     wiring_live: &[String],
@@ -1460,14 +1203,12 @@ pub(super) fn redirect_state_json(
         .map(|(key, record)| {
             serde_json::json!({
                 "purl": canon(key),
-                "ledgerKey": key,
                 "uuid": record.uuid,
             })
         })
         .collect();
     Some(serde_json::json!({
         "mode": crate::commands::HOSTED_MODE_LABEL,
-        "ledger": socket_patch_core::patch::redirect::REDIRECT_STATE_REL,
         "records": records,
         "wiringLive": wiring_live,
     }))
@@ -1881,11 +1622,13 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
                 // `redirectState` rides the empty-discovery envelope too
                 // (same rule as the ≥1-package path). `wiringLive` is empty
                 // by construction: this run covered zero packages.
-                let redirect_state = crate::commands::load_redirect_state_lenient(
-                    &args.common.cwd,
-                    args.common.silent,
-                )
-                .await;
+                let redirect_state = (!args.common.is_global()).then_some(
+                    crate::commands::hosted_state_from_lockfiles(
+                        &args.common,
+                        &args.common.cwd,
+                    )
+                    .await,
+                );
                 if let Some(state) = redirect_state_json(redirect_state.as_ref(), &[]) {
                     result["redirectState"] = state;
                 }
@@ -2143,50 +1886,26 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
 
     // Read existing manifest once for update detection.
     let existing_manifest = read_manifest(&manifest_path).await.ok().flatten();
-    // Hosted and vendored modes record their patches ONLY in their ledgers,
-    // so both ledgers' purl→uuid records are folded into update detection
-    // (otherwise their `updates[]` would stay empty). A malformed redirect
-    // ledger is only warned about here (--silent mutes it). A HOSTED run
-    // does not warn: its engine loads the ledger strictly and reports the
-    // corruption once as a hard error; the human hosted arm's returns
-    // BEFORE the engine (empty discovery, nothing downloadable, a
-    // detail-fetch failure) print it via `warn_unreported_corrupt_ledger`.
-    let (redirect_state, hosted_corrupt_ledger) = if hosted {
-        match socket_patch_core::patch::redirect::load_redirect_state(&args.common.cwd).await {
-            Ok(state) => (state, None),
-            Err(corrupt) => (None, Some(corrupt.to_string())),
-        }
-    } else {
-        // `load_redirect_state_lenient`, with the scan event flushed before
-        // its warning (possibly this run's first write since the event).
-        match socket_patch_core::patch::redirect::load_redirect_state(&args.common.cwd).await {
-            Ok(state) => (state, None),
-            Err(corrupt) => {
-                if !args.common.silent {
-                    telemetry.flush().await;
-                    eprintln!("Warning: {corrupt}");
-                }
-                (None, None)
-            }
-        }
-    };
-    // The hosted pins the lockfiles wire count too: the lockfile is the
-    // record of a hosted redirect even where no ledger was committed.
-    let hosted_pins: Vec<(String, String)> =
+    // Hosted mode records its patches ONLY in the lockfiles (v5 keeps no
+    // hosted ledger) and vendored mode ONLY in its ledger, so the hosted
+    // pins and the vendor ledger's purl→uuid records are folded into update
+    // detection (otherwise their `updates[]` would stay empty).
+    let hosted_pin_list: Vec<socket_patch_core::patch::redirect::upstream::HostedPin> =
         if args.common.is_global() {
             Vec::new()
         } else {
-            crate::commands::discover_wiring(&args.common, &args.common.cwd)
-                .await
-                .refs
-                .into_iter()
-                .filter(|r| r.mode == socket_patch_core::vex::discover::WiringMode::Hosted)
-                .map(|r| (r.purl, r.uuid))
-                .collect()
+            socket_patch_core::patch::redirect::upstream::HostedPin::all(
+                &crate::commands::discover_wiring(&args.common, &args.common.cwd).await,
+            )
         };
+    let redirect_state = (!args.common.is_global())
+        .then(|| crate::commands::hosted_state_from_pins(&hosted_pin_list));
+    let hosted_pins: Vec<(String, String)> = hosted_pin_list
+        .iter()
+        .map(|pin| (pin.purl.clone(), pin.uuid.clone()))
+        .collect();
     let update_manifest = merge_ledger_records_for_updates(
         existing_manifest.as_ref(),
-        redirect_state.as_ref(),
         vendor_state.as_ref().ok(),
         &hosted_pins,
     );
@@ -2477,7 +2196,6 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         if !silent {
             println!("\nNo patches available for installed packages.");
         }
-        warn_unreported_corrupt_ledger(&args.common, hosted_corrupt_ledger.as_deref());
         return finish_human(0).await;
     }
 
@@ -2620,7 +2338,6 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         if !silent {
             println!("\nNo downloadable patches (paid subscription required).");
         }
-        warn_unreported_corrupt_ledger(&args.common, hosted_corrupt_ledger.as_deref());
         return finish_human(0).await;
     }
 
@@ -2644,7 +2361,6 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
             Ok(s) => s,
             // `discover_selected` already printed the failure to stderr.
             Err((code, _)) => {
-                warn_unreported_corrupt_ledger(&args.common, hosted_corrupt_ledger.as_deref());
                 return code;
             }
         };
@@ -2990,20 +2706,18 @@ mod tests {
     }
 
     /// The load-then-derive form of [`overlap_from_states`]: the unit
-    /// tests' entry point (production classifies over ledgers it already
-    /// holds via `classify_overlap_takeover_with`). A malformed redirect
-    /// ledger classifies like a missing one — this path only feeds takeover
-    /// WARNINGS; the corruption itself is a hard error on every path that
-    /// would write or attest from the ledger.
-    async fn overlapping_ledger_purls(cwd: &Path) -> Vec<String> {
-        let redirect = socket_patch_core::patch::redirect::load_redirect_state(cwd)
-            .await
-            .ok()
-            .flatten();
+    /// tests' entry point (production classifies over state it already
+    /// holds via `classify_overlap_takeover_with`). The hosted side is the
+    /// lockfiles' hosted pins — never a pre-v5 redirect ledger on disk — and
+    /// a malformed vendor ledger classifies like a missing one: this path
+    /// only feeds takeover WARNINGS; the corruption itself is a hard error on
+    /// every path that would write or attest from the ledger.
+    async fn overlapping_purls(common: &GlobalArgs, cwd: &Path) -> Vec<String> {
+        let redirect = crate::commands::hosted_state_from_lockfiles(common, cwd).await;
         let Ok(vendor) = socket_patch_core::vendor::load_state(cwd).await else {
             return Vec::new();
         };
-        overlap_from_states(redirect.as_ref(), &vendor)
+        overlap_from_states(Some(&redirect), &vendor)
     }
     use socket_patch_core::manifest::schema::{PatchManifest, PatchRecord};
     use std::collections::HashMap;
@@ -3157,7 +2871,7 @@ mod tests {
         assert_eq!(crawl_scope(true, None), None);
     }
 
-    // ---- cross-mode ledger takeover (hosted ⇄ vendored) --------------------
+    // ---- cross-mode takeover (hosted over vendored) ------------------------
 
     const TAKEOVER_UUID: &str = "9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f";
 
@@ -3173,8 +2887,10 @@ mod tests {
         }
     }
 
-    /// Write a hosted redirect ledger (`.socket/vendor/redirect-state.json`)
-    /// recording a redirect for each PURL.
+    /// Write a PRE-V5 hosted redirect ledger
+    /// (`.socket/vendor/redirect-state.json`) recording a redirect for each
+    /// PURL. v5 never writes one and never reads it for hosted state: the
+    /// tests plant it only to prove it is ignored.
     async fn write_redirect_ledger(root: &Path, purls: &[&str]) {
         use socket_patch_core::patch::redirect::RedirectState;
         let mut state = RedirectState::new();
@@ -3191,6 +2907,18 @@ mod tests {
         .unwrap();
     }
 
+    /// An in-memory hosted state holding one [`takeover_record`] per PURL
+    /// under the given (possibly non-canonical) keys — the shape
+    /// [`crate::commands::hosted_state_from_pins`] builds, for the block
+    /// builder and the probe's own liveness gate.
+    fn pinned_state(purls: &[&str]) -> socket_patch_core::patch::redirect::RedirectState {
+        let mut state = socket_patch_core::patch::redirect::RedirectState::new();
+        for purl in purls {
+            state.records.insert((*purl).to_string(), takeover_record());
+        }
+        state
+    }
+
     /// Write a vendored state ledger (`.socket/vendor/state.json`) with one
     /// entry per PURL, in the committed camelCase wire shape.
     async fn write_vendor_ledger(root: &Path, purls: &[&str]) {
@@ -3223,43 +2951,93 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn overlapping_ledgers_flag_the_taken_over_package() {
-        // Both ledgers claim minimist ⇒ one mode took the lockfile over from
-        // the other and the displaced ledger is stale. The detection names
-        // exactly the overlapping PURL.
+    async fn hosted_pin_over_a_vendored_entry_flags_the_taken_over_package() {
+        // The lock pins minimist to the hosted patch server while the vendored
+        // ledger still claims it ⇒ one mode took the lockfile over from the
+        // other. The detection names exactly the overlapping PURL.
         let tmp = tempfile::tempdir().unwrap();
         let root = tmp.path();
-        write_redirect_ledger(root, &["pkg:npm/minimist@1.2.2"]).await;
+        write_lock_pointing_at_hosted(root, "minimist", "1.2.2").await;
         write_vendor_ledger(root, &["pkg:npm/minimist@1.2.2"]).await;
 
-        let superseded = overlapping_ledger_purls(root).await;
+        let superseded = overlapping_purls(&common_at(root), root).await;
         assert_eq!(superseded, vec!["pkg:npm/minimist@1.2.2".to_string()]);
     }
 
     #[tokio::test]
-    async fn single_ledger_present_flags_nothing() {
-        // A first-time redirect (only the redirect ledger, no vendored ledger)
-        // displaces nothing — no warning. Guards against warning on the FIRST
-        // scan of a fresh project.
+    async fn single_side_present_flags_nothing() {
+        // A first-time redirect (a hosted pin, no vendored ledger) displaces
+        // nothing — no warning. Guards against warning on the FIRST scan of a
+        // fresh project.
         let tmp = tempfile::tempdir().unwrap();
         let root = tmp.path();
-        write_redirect_ledger(root, &["pkg:npm/minimist@1.2.2"]).await;
-        assert!(overlapping_ledger_purls(root).await.is_empty());
+        write_lock_pointing_at_hosted(root, "minimist", "1.2.2").await;
+        assert!(overlapping_purls(&common_at(root), root).await.is_empty());
 
-        // And a project with no ledgers at all.
+        // And a project with no lockfile and no ledgers at all.
         let tmp2 = tempfile::tempdir().unwrap();
-        assert!(overlapping_ledger_purls(tmp2.path()).await.is_empty());
+        assert!(overlapping_purls(&common_at(tmp2.path()), tmp2.path())
+            .await
+            .is_empty());
     }
 
     #[tokio::test]
-    async fn disjoint_ledgers_are_not_a_takeover() {
-        // A legitimate split — one package redirected, a DIFFERENT one
-        // vendored — is not a takeover: neither ledger's wiring is stale.
+    async fn disjoint_states_are_not_a_takeover() {
+        // A legitimate split — one package pinned hosted, a DIFFERENT one
+        // vendored — is not a takeover: neither side's wiring is stale.
         let tmp = tempfile::tempdir().unwrap();
         let root = tmp.path();
-        write_redirect_ledger(root, &["pkg:npm/minimist@1.2.2"]).await;
+        write_lock_pointing_at_hosted(root, "minimist", "1.2.2").await;
         write_vendor_ledger(root, &["pkg:npm/lodash@4.17.21"]).await;
-        assert!(overlapping_ledger_purls(root).await.is_empty());
+        assert!(overlapping_purls(&common_at(root), root).await.is_empty());
+    }
+
+    #[tokio::test]
+    async fn legacy_redirect_ledger_is_not_hosted_state() {
+        // v5 derives hosted state from the lockfiles only: a pre-v5 ledger
+        // still claiming minimist, with no lockfile pinning it hosted, makes
+        // no overlap with the vendored ledger — and no directional warning.
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        write_redirect_ledger(root, &["pkg:npm/minimist@1.2.2"]).await;
+        write_vendor_ledger_wired(root, &["pkg:npm/minimist@1.2.2"]).await;
+
+        assert!(overlapping_purls(&common_at(root), root).await.is_empty());
+        assert_eq!(
+            classify_overlap_takeover(&common_at(root), root).await,
+            OverlapTakeover::default(),
+            "a legacy ledger must never be read as hosted state"
+        );
+    }
+
+    /// The overlap keys on hosted RECORDS only: a state carrying edits but no
+    /// records (the shape a pre-v5 run with failed record fetches persisted)
+    /// names no package, so nothing overlaps.
+    #[tokio::test]
+    async fn edits_only_hosted_state_names_no_package() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        write_vendor_ledger_wired(root, &["pkg:npm/minimist@1.2.2"]).await;
+        let vendor = socket_patch_core::vendor::load_state(root).await.unwrap();
+
+        let mut edits_only = socket_patch_core::patch::redirect::RedirectState::new();
+        edits_only
+            .edits
+            .push(socket_patch_core::patch::redirect::FileEdit {
+                path: "package-lock.json".to_string(),
+                kind: "redirect_npm_lock_entry".to_string(),
+                action: "modified".to_string(),
+                key: Some("node_modules/minimist".to_string()),
+                original: None,
+                new: None,
+            });
+        assert!(overlap_from_states(Some(&edits_only), &vendor).is_empty());
+        assert!(overlap_from_states(None, &vendor).is_empty());
+        assert_eq!(
+            overlap_from_states(Some(&pinned_state(&["pkg:npm/minimist@1.2.2"])), &vendor),
+            vec!["pkg:npm/minimist@1.2.2".to_string()],
+            "positive control: a record names the package"
+        );
     }
 
     #[test]
@@ -3277,29 +3055,15 @@ mod tests {
     }
 
     #[test]
-    fn takeover_detail_names_direction_package_and_remediation() {
+    fn takeover_detail_names_package_and_remediation() {
         let purls = vec!["pkg:npm/minimist@1.2.2".to_string()];
 
-        // Vendored displaced a hosted redirect: name the stale ledger, but
-        // NEVER advise deleting it by hand.
-        let vendored = mode_takeover_detail(&purls, /*current_is_hosted=*/ false);
-        assert!(vendored.contains("pkg:npm/minimist@1.2.2"));
-        assert!(vendored.contains("redirect-state.json"));
-        assert!(
-            !vendored.contains("Remove the stale redirect ledger"),
-            "must not advise deleting the redirect ledger: {vendored}"
-        );
-        assert!(
-            vendored.contains("Do not delete"),
-            "must warn against hand-deleting the ledger: {vendored}"
-        );
-
         // Hosted displaced a vendored ledger: per-package `remove <purl>` is
         // the offered remediation; `vendor --revert` is named only as
         // something NOT to run (it mass-reverts). Deleting the
         // `.socket/vendor/<eco>/` tree by hand hard-breaks cargo resolution
         // while `[patch.crates-io]` still references it.
-        let hosted = mode_takeover_detail(&purls, /*current_is_hosted=*/ true);
+        let hosted = mode_takeover_detail(&purls);
         assert!(hosted.contains("pkg:npm/minimist@1.2.2"));
         assert!(hosted.contains("state.json"));
         assert!(hosted.contains("orphaned"));
@@ -3309,42 +3073,17 @@ mod tests {
             "deleting the vendor tree must not be offered as an equal \
              alternative: {hosted}"
         );
-
-        // The two warning codes are distinct routing tags.
-        assert_ne!(VENDOR_SUPERSEDES_REDIRECT, REDIRECT_SUPERSEDES_VENDORED);
+        // v5 keeps no hosted ledger, so the detail must not point at one.
+        assert!(
+            !hosted.contains("redirect-state.json"),
+            "the detail must not name the retired hosted ledger: {hosted}"
+        );
     }
 
     // ---- agent-flow hosted-wiring retention (hosted → agent conversion) ----
 
-    /// Redirect ledger with one record per PURL AND a recorded `yarn.lock`
-    /// edit — the shape a real hosted run leaves behind (the edit is what
-    /// lets the ledger-file fallback scan the lock).
-    async fn write_redirect_ledger_with_edit(root: &Path, purls: &[&str]) {
-        use socket_patch_core::patch::redirect::{FileEdit, RedirectState};
-        let mut state = RedirectState::new();
-        for purl in purls {
-            state.records.insert((*purl).to_string(), takeover_record());
-        }
-        state.edits.push(FileEdit {
-            path: "yarn.lock".to_string(),
-            kind: "redirect_yarn_entry".to_string(),
-            action: "rewritten".to_string(),
-            key: Some("minimist@1.2.2".to_string()),
-            original: Some(serde_json::Value::String("registry original".to_string())),
-            new: None,
-        });
-        let dir = root.join(".socket/vendor");
-        tokio::fs::create_dir_all(&dir).await.unwrap();
-        tokio::fs::write(
-            dir.join("redirect-state.json"),
-            serde_json::to_string_pretty(&state).unwrap(),
-        )
-        .await
-        .unwrap();
-    }
-
     /// yarn classic lock whose resolved URL is the hosted artifact (carries
-    /// the record uuid) — the live-hosted-wiring proof.
+    /// the patch uuid) — the live-hosted-wiring proof.
     async fn write_hosted_yarn_lock(root: &Path, uuid: &str) {
         tokio::fs::write(
             root.join("yarn.lock"),
@@ -3358,10 +3097,25 @@ mod tests {
         .unwrap();
     }
 
-    async fn load_ledger(root: &Path) -> Option<socket_patch_core::patch::redirect::RedirectState> {
-        socket_patch_core::patch::redirect::load_redirect_state(root)
-            .await
-            .unwrap()
+    /// yarn classic lock resolving minimist from the public registry — no
+    /// hosted pin.
+    async fn write_registry_yarn_lock(root: &Path) {
+        tokio::fs::write(
+            root.join("yarn.lock"),
+            "# yarn lockfile v1\n\n\nminimist@^1.2.2:\n  version \"1.2.2\"\n  \
+             resolved \"https://registry.yarnpkg.com/minimist/-/minimist-1.2.2.tgz#bbbb\"\n  \
+             integrity sha512-orig==\n",
+        )
+        .await
+        .unwrap();
+    }
+
+    /// The project's hosted state as production derives it: the lockfiles'
+    /// hosted pins (`Some`, as a non-global scan passes it).
+    async fn hosted_state(
+        common: &GlobalArgs,
+    ) -> Option<socket_patch_core::patch::redirect::RedirectState> {
+        Some(crate::commands::hosted_state_from_lockfiles(common, &common.cwd).await)
     }
 
     /// `GlobalArgs` rooted at `root` (the classifiers read the live
@@ -3379,12 +3133,11 @@ mod tests {
         let tmp = tempfile::tempdir().unwrap();
         let root = tmp.path();
         let purl = "pkg:npm/minimist@1.2.2";
-        write_redirect_ledger_with_edit(root, &[purl]).await;
         write_hosted_yarn_lock(root, TAKEOVER_UUID).await;
 
         // Hosted-only wiring (no vendor state.json) is structurally
         // invisible to the hosted⇄vendored overlap classifier…
-        assert!(overlapping_ledger_purls(root).await.is_empty());
+        assert!(overlapping_purls(&common_at(root), root).await.is_empty());
         assert_eq!(
             classify_overlap_takeover(&common_at(root), root).await,
             OverlapTakeover::default()
@@ -3392,46 +3145,39 @@ mod tests {
 
         // …but the agent flow's direct probe sees it for scanned purls.
         let scanned: HashSet<String> = [purl.to_string()].into_iter().collect();
-        let ledger = load_ledger(root).await;
+        let state = hosted_state(&common_at(root)).await;
         let retained =
-            hosted_wiring_retained_purls(&common_at(root), ledger.as_ref(), &scanned).await;
+            hosted_wiring_retained_purls(&common_at(root), state.as_ref(), &scanned).await;
         assert_eq!(retained, vec![purl.to_string()]);
     }
 
     #[tokio::test]
-    async fn hosted_retained_probe_is_silent_without_live_records_or_wiring() {
+    async fn hosted_retained_probe_is_silent_without_live_pins_or_wiring() {
         let purl = "pkg:npm/minimist@1.2.2";
         let scanned: HashSet<String> = [purl.to_string()].into_iter().collect();
 
-        // (a) Records retired (a hosted→vendored pre-revert drops RECORDS
-        // while the `edits` remain): silent even with the uuid still in the
-        // lock text.
+        // (a) Registry-clean lock beside a pre-v5 ledger still recording the
+        // redirect: the lockfiles hold no pin, and the legacy ledger is
+        // never consulted.
         let tmp = tempfile::tempdir().unwrap();
-        write_redirect_ledger_with_edit(tmp.path(), &[]).await;
-        write_hosted_yarn_lock(tmp.path(), TAKEOVER_UUID).await;
-        let ledger = load_ledger(tmp.path()).await;
+        write_redirect_ledger(tmp.path(), &[purl]).await;
+        write_registry_yarn_lock(tmp.path()).await;
+        let common = common_at(tmp.path());
+        let state = hosted_state(&common).await;
+        assert!(state.as_ref().is_some_and(|s| s.records.is_empty()));
         assert!(
-            hosted_wiring_retained_purls(&common_at(tmp.path()), ledger.as_ref(), &scanned)
+            hosted_wiring_retained_purls(&common, state.as_ref(), &scanned)
                 .await
                 .is_empty(),
-            "records gone ⇒ silent (pre-reverted wiring must not re-warn)"
+            "no pin ⇒ silent (a legacy ledger must not re-warn)"
         );
 
-        // (b) Registry-clean lock with a live record: the live lock is the
-        // truth source — never guess from ledger presence alone.
-        let tmp = tempfile::tempdir().unwrap();
-        write_redirect_ledger_with_edit(tmp.path(), &[purl]).await;
-        tokio::fs::write(
-            tmp.path().join("yarn.lock"),
-            "# yarn lockfile v1\n\n\nminimist@^1.2.2:\n  version \"1.2.2\"\n  \
-             resolved \"https://registry.yarnpkg.com/minimist/-/minimist-1.2.2.tgz#bbbb\"\n  \
-             integrity sha512-orig==\n",
-        )
-        .await
-        .unwrap();
-        let ledger = load_ledger(tmp.path()).await;
+        // (b) A state record the live lock does not back (the lock was
+        // re-resolved after the state was taken): the live lock is the truth
+        // source — never guess from state presence alone.
+        let stale = pinned_state(&[purl]);
         assert!(
-            hosted_wiring_retained_purls(&common_at(tmp.path()), ledger.as_ref(), &scanned)
+            hosted_wiring_retained_purls(&common, Some(&stale), &scanned)
                 .await
                 .is_empty(),
             "registry-clean lock ⇒ silent"
@@ -3439,25 +3185,23 @@ mod tests {
 
         // (c) The purl was not scanned this run.
         let tmp = tempfile::tempdir().unwrap();
-        write_redirect_ledger_with_edit(tmp.path(), &[purl]).await;
         write_hosted_yarn_lock(tmp.path(), TAKEOVER_UUID).await;
+        let common = common_at(tmp.path());
         let other: HashSet<String> = ["pkg:npm/lodash@4.17.21".to_string()].into_iter().collect();
-        let ledger = load_ledger(tmp.path()).await;
+        let state = hosted_state(&common).await;
         assert!(
-            hosted_wiring_retained_purls(&common_at(tmp.path()), ledger.as_ref(), &other)
+            hosted_wiring_retained_purls(&common, state.as_ref(), &other)
                 .await
                 .is_empty(),
             "unscanned purl ⇒ silent"
         );
 
-        // (d) No ledger at all.
-        let tmp = tempfile::tempdir().unwrap();
-        write_hosted_yarn_lock(tmp.path(), TAKEOVER_UUID).await;
+        // (d) No hosted state at all (a global scan passes `None`).
         assert!(
-            hosted_wiring_retained_purls(&common_at(tmp.path()), None, &scanned)
+            hosted_wiring_retained_purls(&common, None, &scanned)
                 .await
                 .is_empty(),
-            "no ledger ⇒ silent"
+            "no state ⇒ silent"
         );
     }
 
@@ -3490,20 +3234,29 @@ mod tests {
             ),
         ] {
             let tmp = tempfile::tempdir().unwrap();
-            write_redirect_ledger_with_edit(tmp.path(), &[purl]).await;
             tokio::fs::write(tmp.path().join("vlt-lock.json"), text)
                 .await
                 .unwrap();
-            let ledger = load_ledger(tmp.path()).await;
-            let retained =
-                hosted_wiring_retained_purls(&common_at(tmp.path()), ledger.as_ref(), &scanned)
-                    .await;
+            let common = common_at(tmp.path());
             let want = if live {
                 vec![purl.to_string()]
             } else {
                 Vec::new()
             };
+            // The lockfiles' own pins, as production derives them…
+            let state = hosted_state(&common).await;
+            let pinned: Vec<String> = state
+                .iter()
+                .flat_map(|s| s.records.keys().cloned())
+                .collect();
+            assert_eq!(pinned, want, "pins: {what}");
+            let retained = hosted_wiring_retained_purls(&common, state.as_ref(), &scanned).await;
             assert_eq!(retained, want, "{what}");
+            // …and the probe's own liveness gate over a record the lock may
+            // not back.
+            let retained =
+                hosted_wiring_retained_purls(&common, Some(&pinned_state(&[purl])), &scanned).await;
+            assert_eq!(retained, want, "liveness: {what}");
         }
     }
 
@@ -3511,15 +3264,17 @@ mod tests {
     fn agent_retention_details_name_packages_and_safe_remediation() {
         let purls = vec!["pkg:npm/minimist@1.2.2".to_string()];
 
-        // hosted_wiring_retained: names the purl and the real options,
-        // never hand-deleting the ledger.
+        // hosted_wiring_retained: names the purl and the real options
+        // (stay hosted, migrate to vendored, or restore upstream via
+        // rollback), and no longer points at a hosted ledger.
         let hosted = hosted_wiring_retained_detail(&purls);
         assert!(hosted.contains("pkg:npm/minimist@1.2.2"));
         assert!(hosted.contains("scan --mode hosted"));
         assert!(hosted.contains("scan --mode vendored"));
+        assert!(hosted.contains("socket-patch rollback"));
         assert!(
-            hosted.contains("Do not delete"),
-            "must warn against hand-deleting the ledger: {hosted}"
+            !hosted.contains("redirect-state.json"),
+            "v5 keeps no hosted ledger to name: {hosted}"
         );
 
         // vendored_ownership_retained: names the purl and the per-package
@@ -3534,10 +3289,10 @@ mod tests {
         );
         assert!(vendored.contains("scan --mode agent"));
 
-        // Distinct routing tags, also distinct from the takeover family.
+        // Distinct routing tags, also distinct from the takeover code.
         assert_ne!(HOSTED_WIRING_RETAINED, VENDORED_OWNERSHIP_RETAINED);
         assert_ne!(HOSTED_WIRING_RETAINED, REDIRECT_SUPERSEDES_VENDORED);
-        assert_ne!(VENDORED_OWNERSHIP_RETAINED, VENDOR_SUPERSEDES_REDIRECT);
+        assert_ne!(VENDORED_OWNERSHIP_RETAINED, REDIRECT_SUPERSEDES_VENDORED);
     }
 
     // ---- redirectState envelope block (read-only cross-mode visibility) ----
@@ -3545,94 +3300,81 @@ mod tests {
     // hosted/vendored runs don't) is pinned by `tests/scan_invariants.rs`;
     // these pin the block builder's own gates and shape.
 
-    /// Records present ⇒ the block exists with each record's canonicalized
-    /// purl + verbatim ledger key, the constant mode label, and the
-    /// caller-supplied wiringLive. Records absent (edits-only ledger, no
-    /// ledger) ⇒ `None`, so the envelope key stays additive.
+    /// Pins present ⇒ the block exists with each pin's canonical purl +
+    /// uuid, the constant mode label, and the caller-supplied wiringLive —
+    /// and no pre-v5 `ledger` / `ledgerKey` fields. No pin (a
+    /// registry-clean lock, even beside a legacy ledger; no state) ⇒ `None`,
+    /// so the envelope key stays additive.
     #[tokio::test]
-    async fn redirect_state_block_gates_on_records_and_splits_live_proof() {
+    async fn redirect_state_block_gates_on_pins_and_splits_live_proof() {
         let purl = "pkg:npm/minimist@1.2.2";
         let scanned: HashSet<String> = [purl.to_string()].into_iter().collect();
 
-        // Records, but no lockfile on disk: listed, with the EMPTY wiringLive
-        // the probe computes (the ledger's word is never promoted to a
-        // live-lock proof).
+        // A hosted pin the run did not crawl: listed, with an EMPTY
+        // wiringLive (the pin is wired, just not covered by this run).
         let tmp = tempfile::tempdir().unwrap();
-        write_redirect_ledger_with_edit(tmp.path(), &[purl]).await;
-        let ledger = load_ledger(tmp.path()).await;
-        let wiring =
-            hosted_wiring_retained_purls(&common_at(tmp.path()), ledger.as_ref(), &scanned).await;
+        write_hosted_yarn_lock(tmp.path(), TAKEOVER_UUID).await;
+        let common = common_at(tmp.path());
+        let state = hosted_state(&common).await;
+        let unscanned: HashSet<String> = HashSet::new();
+        let wiring = hosted_wiring_retained_purls(&common, state.as_ref(), &unscanned).await;
         assert_eq!(wiring, Vec::<String>::new());
         let block =
-            redirect_state_json(ledger.as_ref(), &wiring).expect("records present ⇒ block present");
+            redirect_state_json(state.as_ref(), &wiring).expect("pins present ⇒ block present");
         assert_eq!(block["mode"], "hosted");
-        assert_eq!(block["ledger"], ".socket/vendor/redirect-state.json");
         assert_eq!(
             block["records"],
-            serde_json::json!([{ "purl": purl, "ledgerKey": purl, "uuid": TAKEOVER_UUID }])
+            serde_json::json!([{ "purl": purl, "uuid": TAKEOVER_UUID }])
         );
         assert_eq!(block["wiringLive"], serde_json::json!([]));
+        let keys: Vec<&str> = block
+            .as_object()
+            .unwrap()
+            .keys()
+            .map(String::as_str)
+            .collect();
+        assert_eq!(
+            keys,
+            ["mode", "records", "wiringLive"],
+            "v5 block carries no `ledger` key: {block}"
+        );
 
-        // Live lock present too: the same purl graduates into wiringLive
-        // (a fresh run re-parses the inventory, so re-take it here).
-        write_hosted_yarn_lock(tmp.path(), TAKEOVER_UUID).await;
-        let wiring =
-            hosted_wiring_retained_purls(&common_at(tmp.path()), ledger.as_ref(), &scanned).await;
+        // Crawled this run: the same purl graduates into wiringLive.
+        let wiring = hosted_wiring_retained_purls(&common, state.as_ref(), &scanned).await;
         let block =
-            redirect_state_json(ledger.as_ref(), &wiring).expect("records present ⇒ block present");
+            redirect_state_json(state.as_ref(), &wiring).expect("pins present ⇒ block present");
         assert_eq!(block["wiringLive"], serde_json::json!([purl]));
 
-        // Edits-only ledger (records retired) ⇒ no block.
+        // Registry-clean lock beside a legacy ledger that still records the
+        // redirect ⇒ no pin ⇒ no block.
         let tmp = tempfile::tempdir().unwrap();
-        write_redirect_ledger_with_edit(tmp.path(), &[]).await;
-        let ledger = load_ledger(tmp.path()).await;
+        write_redirect_ledger(tmp.path(), &[purl]).await;
+        write_registry_yarn_lock(tmp.path()).await;
+        let state = hosted_state(&common_at(tmp.path())).await;
         assert!(
-            redirect_state_json(ledger.as_ref(), &[]).is_none(),
-            "an edits-only ledger asserts no records"
+            redirect_state_json(state.as_ref(), &[]).is_none(),
+            "a legacy ledger alone asserts no hosted pin"
         );
 
-        // No ledger ⇒ no block.
+        // No state ⇒ no block.
         assert!(redirect_state_json(None, &[]).is_none());
     }
 
     /// The records↔wiringLive join is a plain string compare: each record's
-    /// `purl` is canonicalized to exactly the spelling the probe emits, with
-    /// the ledger's raw key preserved as `ledgerKey`. Pinned on a
-    /// percent-encoded scoped npm name and a `?platform=`-qualified gem purl.
+    /// `purl` is canonicalized to exactly the spelling the probe emits.
+    /// Pinned on a percent-encoded scoped npm name and a
+    /// `?platform=`-qualified gem purl.
     #[tokio::test]
     async fn redirect_state_records_canonicalize_to_the_wiring_live_spelling() {
-        use socket_patch_core::patch::redirect::{FileEdit, RedirectState};
-
         let scoped_key = "pkg:npm/%40scope%2Fpkg@1.0.0";
         let scoped_canon = "pkg:npm/@scope/pkg@1.0.0";
         let gem_key = "pkg:gem/nokogiri@1.13.3?platform=ruby";
         let gem_canon = "pkg:gem/nokogiri@1.13.3";
 
         let tmp = tempfile::tempdir().unwrap();
-        let mut state = RedirectState::new();
-        state
-            .records
-            .insert(scoped_key.to_string(), takeover_record());
-        state.records.insert(gem_key.to_string(), takeover_record());
-        // A recorded yarn.lock edit + a lock entry resolving the scoped
-        // package from its hosted artifact — live hosted wiring for the
-        // scoped purl.
-        state.edits.push(FileEdit {
-            path: "yarn.lock".to_string(),
-            kind: "redirect_yarn_entry".to_string(),
-            action: "rewritten".to_string(),
-            key: Some("@scope/pkg@1.0.0".to_string()),
-            original: Some(serde_json::Value::String("orig".to_string())),
-            new: None,
-        });
-        let dir = tmp.path().join(".socket/vendor");
-        tokio::fs::create_dir_all(&dir).await.unwrap();
-        tokio::fs::write(
-            dir.join("redirect-state.json"),
-            serde_json::to_string_pretty(&state).unwrap(),
-        )
-        .await
-        .unwrap();
+        let state = pinned_state(&[scoped_key, gem_key]);
+        // A lock entry resolving the scoped package from its hosted
+        // artifact — live hosted wiring for the scoped purl.
         tokio::fs::write(
             tmp.path().join("yarn.lock"),
             format!(
@@ -3645,25 +3387,23 @@ mod tests {
         .unwrap();
 
         let scanned: HashSet<String> = [scoped_canon.to_string()].into_iter().collect();
-        let ledger = load_ledger(tmp.path()).await;
         let wiring =
-            hosted_wiring_retained_purls(&common_at(tmp.path()), ledger.as_ref(), &scanned).await;
+            hosted_wiring_retained_purls(&common_at(tmp.path()), Some(&state), &scanned).await;
         assert_eq!(
             wiring,
             vec![scoped_canon.to_string()],
-            "the text proof (uuid in the recorded lock) claims the scoped purl"
+            "the hosted pin in the lock claims the scoped purl"
         );
 
         let block =
-            redirect_state_json(ledger.as_ref(), &wiring).expect("records present ⇒ block present");
+            redirect_state_json(Some(&state), &wiring).expect("records present ⇒ block present");
         assert_eq!(
             block["records"],
             serde_json::json!([
-                { "purl": gem_canon, "ledgerKey": gem_key, "uuid": TAKEOVER_UUID },
-                { "purl": scoped_canon, "ledgerKey": scoped_key, "uuid": TAKEOVER_UUID },
+                { "purl": gem_canon, "uuid": TAKEOVER_UUID },
+                { "purl": scoped_canon, "uuid": TAKEOVER_UUID },
             ]),
-            "records carry the canonical purl (wiringLive's spelling) plus \
-             the verbatim ledger key; block={block}"
+            "records carry the canonical purl (wiringLive's spelling); block={block}"
         );
         let live: Vec<&str> = block["wiringLive"]
             .as_array()
@@ -3686,17 +3426,15 @@ mod tests {
         }
     }
 
-    /// The block's `mode` is the constant label, not the ledger's opaque
-    /// `mode` string: a ledger carrying `"redirect"` still labels as
-    /// `"hosted"`.
-    #[tokio::test]
-    async fn redirect_state_mode_is_the_constant_label_for_legacy_ledgers() {
-        let tmp = tempfile::tempdir().unwrap();
-        write_redirect_ledger_with_edit(tmp.path(), &["pkg:npm/minimist@1.2.2"]).await;
-        let mut ledger = load_ledger(tmp.path()).await.unwrap();
-        ledger.mode = "redirect".to_string();
+    /// The block's `mode` is the constant label, not the state's opaque
+    /// `mode` string: a state carrying the legacy `"redirect"` still labels
+    /// as `"hosted"`.
+    #[test]
+    fn redirect_state_mode_is_the_constant_label_for_legacy_states() {
+        let mut state = pinned_state(&["pkg:npm/minimist@1.2.2"]);
+        state.mode = "redirect".to_string();
         let block =
-            redirect_state_json(Some(&ledger), &[]).expect("records present ⇒ block present");
+            redirect_state_json(Some(&state), &[]).expect("records present ⇒ block present");
         assert_eq!(block["mode"], "hosted");
     }
 
@@ -3797,7 +3535,6 @@ mod tests {
         // generic wiring scan.
         let tmp = tempfile::tempdir().unwrap();
         let root = tmp.path();
-        write_redirect_ledger(root, &[CARGO_PURL]).await;
         write_cargo_vendor_ledger(root).await;
         write_cargo_hosted_takeover_files(root).await;
 
@@ -3809,15 +3546,16 @@ mod tests {
         );
         assert!(
             takeover.vendored.is_empty(),
-            "the INVERSE warning must not fire (pre-fix bug): {takeover:?}"
+            "the INVERSE direction must not be reported: {takeover:?}"
         );
     }
 
     #[tokio::test]
-    async fn cargo_takeover_classifies_vendored_when_the_lock_is_detached() {
+    async fn cargo_lock_routed_to_vendored_yields_no_hosted_pin() {
         // The genuine vendored-live shape: detached lock entry (no source) +
-        // [patch.crates-io] pointing at the entry's committed copy. The
-        // redirect ledger is the stale one.
+        // [patch.crates-io] pointing at the entry's committed copy. The lock
+        // pins nothing hosted, so there is no hosted state to overlap — even
+        // with a pre-v5 ledger still claiming the crate.
         let tmp = tempfile::tempdir().unwrap();
         let root = tmp.path();
         write_redirect_ledger(root, &[CARGO_PURL]).await;
@@ -3840,19 +3578,19 @@ mod tests {
         .await
         .unwrap();
 
-        let takeover = classify_overlap_takeover(&cargo_common_at(root), root).await;
+        let common = cargo_common_at(root);
+        assert!(overlapping_purls(&common, root).await.is_empty());
         assert_eq!(
-            takeover.vendored,
-            vec![CARGO_PURL.to_string()],
-            "{takeover:?}"
+            classify_overlap_takeover(&common, root).await,
+            OverlapTakeover::default()
         );
-        assert!(takeover.redirect.is_empty(), "{takeover:?}");
     }
 
     #[tokio::test]
     async fn cargo_takeover_stays_silent_when_the_lock_points_at_crates_io() {
-        // Both ledgers claim the purl but a third party re-resolved the lock
-        // back to crates.io: neither mode is live — no directional warning.
+        // A third party re-resolved the lock back to crates.io: no hosted pin
+        // is left (a legacy ledger claiming the crate does not count), so
+        // no directional warning.
         let tmp = tempfile::tempdir().unwrap();
         let root = tmp.path();
         write_redirect_ledger(root, &[CARGO_PURL]).await;
@@ -3883,6 +3621,7 @@ mod tests {
     /// (`<name>-<version>.tgz`, what [`write_lock_pointing_at_vendored`]
     /// wires).
     async fn write_vendor_ledger_wired(root: &Path, purls: &[&str]) {
+        use socket_patch_core::utils::purl::purl_name_version;
         let entries: serde_json::Map<String, serde_json::Value> = purls
             .iter()
             .map(|purl| {
@@ -3973,87 +3712,76 @@ mod tests {
 
     #[tokio::test]
     async fn hosted_flow_stays_silent_when_the_lock_still_points_at_vendored() {
-        // Both ledgers claim minimist, but the LIVE lockfile still resolves it
-        // to the committed `.socket/vendor/` artifact — vendored is live. A
-        // hosted dry-run/no-op must NOT emit `redirect_supersedes_vendored`,
-        // which would point cleanup at the LIVE vendored ledger.
+        // The vendored ledger (and a pre-v5 redirect ledger) claim minimist,
+        // but the LIVE lockfile resolves it to the committed
+        // `.socket/vendor/` artifact — vendored is live and no hosted pin
+        // exists. A hosted dry-run/no-op must NOT emit
+        // `redirect_supersedes_vendored`, which would point cleanup at the
+        // LIVE vendored ledger; nor is there any hosted state to call stale.
         let tmp = tempfile::tempdir().unwrap();
         let root = tmp.path();
         write_redirect_ledger(root, &["pkg:npm/minimist@1.2.2"]).await;
         write_vendor_ledger_wired(root, &["pkg:npm/minimist@1.2.2"]).await;
         write_lock_pointing_at_vendored(root, "minimist", "1.2.2").await;
 
-        let takeover = classify_overlap_takeover(&common_at(root), root).await;
-        // The hosted flow keys its warning off `.redirect` — empty here, so it
-        // stays silent instead of accusing the live vendored ledger.
-        assert!(
-            takeover.redirect.is_empty(),
-            "hosted flow must not warn when the lock is vendored: {takeover:?}"
-        );
-        // Truthful direction: vendored won ⇒ the redirect ledger is the stale one.
+        assert!(overlapping_purls(&common_at(root), root).await.is_empty());
         assert_eq!(
-            takeover.vendored,
-            vec!["pkg:npm/minimist@1.2.2".to_string()]
+            classify_overlap_takeover(&common_at(root), root).await,
+            OverlapTakeover::default(),
+            "a vendored lock leaves no hosted pin to overlap"
         );
-        // The raw overlap is non-empty: only the direction gate keeps it quiet.
-        assert!(!overlapping_ledger_purls(root).await.is_empty());
     }
 
     #[tokio::test]
-    async fn vendored_flow_stays_silent_when_the_lock_still_points_at_hosted() {
-        // Mirror: both ledgers claim minimist, but the LIVE lockfile resolves it
-        // to the hosted patch server — hosted is live. A vendored dry-run/no-op
-        // must NOT emit `vendor_supersedes_redirect` and point cleanup at the
-        // live redirect ledger.
+    async fn hosted_lock_classifies_the_vendored_ledger_as_superseded() {
+        // The vendored ledger claims minimist, but the LIVE lockfile resolves
+        // it to the hosted patch server — hosted is live, so the vendored
+        // ledger is the stale one.
         let tmp = tempfile::tempdir().unwrap();
         let root = tmp.path();
-        write_redirect_ledger(root, &["pkg:npm/minimist@1.2.2"]).await;
         write_vendor_ledger_wired(root, &["pkg:npm/minimist@1.2.2"]).await;
         write_lock_pointing_at_hosted(root, "minimist", "1.2.2").await;
 
         let takeover = classify_overlap_takeover(&common_at(root), root).await;
-        assert!(
-            takeover.vendored.is_empty(),
-            "vendored flow must not warn when the lock is hosted: {takeover:?}"
-        );
-        // Truthful direction: hosted won ⇒ the vendored ledger is the stale one.
         assert_eq!(
             takeover.redirect,
             vec!["pkg:npm/minimist@1.2.2".to_string()]
         );
+        assert!(takeover.vendored.is_empty(), "{takeover:?}");
     }
 
     #[tokio::test]
-    async fn overlap_without_a_lock_to_prove_direction_stays_silent_both_ways() {
-        // Both ledgers overlap, but no lockfile proves which mode is live. Rather
-        // than guess the direction from which command is running, both flows stay
-        // silent — the raw overlap still fires, only the direction is gated.
+    async fn half_migrated_locks_naming_both_stay_silent() {
+        // One lockfile pins minimist hosted while another still routes it to
+        // the committed vendored artifact: the raw overlap fires, but neither
+        // direction is proven, so the classifier stays silent rather than
+        // guess from which command is running.
         let tmp = tempfile::tempdir().unwrap();
         let root = tmp.path();
-        write_redirect_ledger(root, &["pkg:npm/minimist@1.2.2"]).await;
         write_vendor_ledger_wired(root, &["pkg:npm/minimist@1.2.2"]).await;
+        write_lock_pointing_at_vendored(root, "minimist", "1.2.2").await;
+        write_hosted_yarn_lock(root, TAKEOVER_UUID).await;
 
-        let takeover = classify_overlap_takeover(&common_at(root), root).await;
-        assert!(
-            takeover.redirect.is_empty() && takeover.vendored.is_empty(),
-            "no lock proof ⇒ no directional warning: {takeover:?}"
-        );
         assert_eq!(
-            overlapping_ledger_purls(root).await,
+            overlapping_purls(&common_at(root), root).await,
             vec!["pkg:npm/minimist@1.2.2".to_string()]
         );
+        assert_eq!(
+            classify_overlap_takeover(&common_at(root), root).await,
+            OverlapTakeover::default(),
+            "both sides live ⇒ no directional warning"
+        );
     }
 
     // ---- remediation is per-package and non-destructive ---------------------
 
     #[test]
     fn takeover_detail_remediation_is_per_package_and_non_destructive() {
-        // Cleanup must be scoped per named package: whole-ledger / whole-tree
-        // deletion would destroy live data for packages the takeover did not
-        // touch.
+        // Cleanup must be scoped per named package: whole-tree deletion would
+        // destroy live data for packages the takeover did not touch.
         let purls = vec!["pkg:npm/minimist@1.2.2".to_string()];
 
-        let hosted = mode_takeover_detail(&purls, /*current_is_hosted=*/ true);
+        let hosted = mode_takeover_detail(&purls);
         // The sanctioned per-purl cleanup command…
         assert!(
             hosted.contains("socket-patch remove <purl>"),
@@ -4073,21 +3801,6 @@ mod tests {
             !hosted.contains("vendor --revert` before redirecting"),
             "hosted remediation must not advise a blanket revert: {hosted}"
         );
-
-        let vendored = mode_takeover_detail(&purls, /*current_is_hosted=*/ false);
-        // Only the named packages' records — never the whole ledger file.
-        assert!(
-            vendored.contains("only these package(s)"),
-            "vendored remediation must be per-package: {vendored}"
-        );
-        assert!(
-            !vendored.contains("Remove the stale redirect ledger"),
-            "vendored remediation must not advise deleting the ledger: {vendored}"
-        );
-        assert!(
-            vendored.contains("Do not delete the ledger file"),
-            "vendored remediation must warn against file deletion: {vendored}"
-        );
     }
 
     #[test]
@@ -4095,7 +3808,7 @@ mod tests {
         // `socket-patch remove <purl>` also deletes the package's
         // `.socket/manifest.json` entry; the hosted text must say so.
         let purls = vec!["pkg:npm/minimist@1.2.2".to_string()];
-        let hosted = mode_takeover_detail(&purls, /*current_is_hosted=*/ true);
+        let hosted = mode_takeover_detail(&purls);
 
         assert!(
             !hosted.contains("drops only that entry"),
@@ -4105,152 +3818,16 @@ mod tests {
             hosted.contains("`.socket/manifest.json`"),
             "hosted remediation must name the manifest entry `remove` deletes: {hosted}"
         );
-        // …and must place the LIVE hosted patch, so "manifest entry deleted"
-        // does not read as "the hosted patch was dropped too".
+        // …and must place the LIVE hosted patch (the lockfile pin itself —
+        // v5 keeps no hosted ledger), so "manifest entry deleted" does not
+        // read as "the hosted patch was dropped too".
         assert!(
-            hosted.contains("redirect-state.json"),
+            hosted.contains("recorded in the lockfile itself"),
             "hosted remediation must say where the live hosted patch lives: {hosted}"
         );
     }
 
-    // ---- takeover blind spots: degraded ledgers and hosted-proof gaps ------
-
-    fn redirect_edit(path: &str, key: &str) -> socket_patch_core::patch::redirect::FileEdit {
-        socket_patch_core::patch::redirect::FileEdit {
-            path: path.to_string(),
-            kind: "redirect_npm_lock_entry".to_string(),
-            action: "modified".to_string(),
-            key: Some(key.to_string()),
-            original: None,
-            new: None,
-        }
-    }
-
-    /// Like [`write_redirect_ledger`] but with explicit `edits` (and possibly
-    /// NO records — the degraded shape a run with failed record fetches
-    /// persists).
-    async fn write_redirect_ledger_with_edits(
-        root: &Path,
-        purls: &[&str],
-        edits: Vec<socket_patch_core::patch::redirect::FileEdit>,
-    ) {
-        use socket_patch_core::patch::redirect::RedirectState;
-        let mut state = RedirectState::new();
-        for purl in purls {
-            state.records.insert((*purl).to_string(), takeover_record());
-        }
-        state.edits = edits;
-        let dir = root.join(".socket/vendor");
-        tokio::fs::create_dir_all(&dir).await.unwrap();
-        tokio::fs::write(
-            dir.join("redirect-state.json"),
-            serde_json::to_string_pretty(&state).unwrap(),
-        )
-        .await
-        .unwrap();
-    }
-
-    #[tokio::test]
-    async fn overlap_detected_when_redirect_ledger_has_edits_but_no_records() {
-        // A hosted run where every per-uuid record fetch failed persists a
-        // ledger with edits but an EMPTY records map (`record_fetch_failed`).
-        // That ledger still asserts stale lock wiring, so a vendored takeover
-        // of the same package must still be flagged.
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        write_redirect_ledger_with_edits(
-            root,
-            &[],
-            vec![redirect_edit("package-lock.json", "node_modules/minimist")],
-        )
-        .await;
-        write_vendor_ledger_wired(root, &["pkg:npm/minimist@1.2.2"]).await;
-        write_lock_pointing_at_vendored(root, "minimist", "1.2.2").await;
-
-        assert_eq!(
-            overlapping_ledger_purls(root).await,
-            vec!["pkg:npm/minimist@1.2.2".to_string()],
-            "an edits-only redirect ledger must still count as overlapping"
-        );
-        let takeover = classify_overlap_takeover(&common_at(root), root).await;
-        assert_eq!(
-            takeover.vendored,
-            vec!["pkg:npm/minimist@1.2.2".to_string()],
-            "the vendored takeover of a degraded redirect ledger must be flagged"
-        );
-        assert!(takeover.redirect.is_empty(), "{takeover:?}");
-    }
-
-    #[tokio::test]
-    async fn degraded_ledger_matches_a_vlt_variant_key_at_the_tilde_boundary() {
-        for (key, overlaps) in [
-            ("minimist@1.2.2~peer.2", true),
-            ("minimist@1.2.2~_croot_s_g_s#a", true),
-            ("minimist@1.2.20~peer.2", false),
-        ] {
-            let tmp = tempfile::tempdir().unwrap();
-            let root = tmp.path();
-            let mut edit = redirect_edit("vlt-lock.json", key);
-            edit.kind = socket_patch_core::patch::redirect::vlt::KIND.to_string();
-            write_redirect_ledger_with_edits(root, &[], vec![edit]).await;
-            write_vendor_ledger_wired(root, &["pkg:npm/minimist@1.2.2"]).await;
-            assert_eq!(
-                overlapping_ledger_purls(root).await,
-                if overlaps {
-                    vec!["pkg:npm/minimist@1.2.2".to_string()]
-                } else {
-                    Vec::new()
-                },
-                "{key}"
-            );
-        }
-    }
-
-    #[tokio::test]
-    async fn following_the_vendored_remediation_clears_the_warning() {
-        // The vendored remediation names the matching `edits` entries as
-        // well as `records` (leftover edits keep matching through the
-        // degraded-ledger fallback); carrying it out in full must leave
-        // nothing to warn about.
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        write_redirect_ledger_with_edits(
-            root,
-            &["pkg:npm/minimist@1.2.2"],
-            vec![redirect_edit("package-lock.json", "node_modules/minimist")],
-        )
-        .await;
-        write_vendor_ledger_wired(root, &["pkg:npm/minimist@1.2.2"]).await;
-        write_lock_pointing_at_vendored(root, "minimist", "1.2.2").await;
-
-        let before = classify_overlap_takeover(&common_at(root), root).await;
-        assert_eq!(
-            before.vendored,
-            vec!["pkg:npm/minimist@1.2.2".to_string()],
-            "the vendored takeover must be flagged first: {before:?}"
-        );
-        let detail = mode_takeover_detail(&before.vendored, /*current_is_hosted=*/ false);
-        assert!(
-            detail.contains("`edits`"),
-            "the remediation must name the edits entries: {detail}"
-        );
-
-        // Exactly what the remediation prescribes for this ledger: the
-        // package's `records` entry AND its matching `edits` entry gone, the
-        // ledger file itself left in place.
-        write_redirect_ledger_with_edits(root, &[], Vec::new()).await;
-
-        let after = classify_overlap_takeover(&common_at(root), root).await;
-        assert_eq!(
-            after,
-            OverlapTakeover::default(),
-            "following the remediation must clear the warning: {after:?}"
-        );
-        assert!(
-            overlapping_ledger_purls(root).await.is_empty(),
-            "no residue may keep the ledgers reading as overlapping"
-        );
-    }
+    // ---- hosted-proof gaps: other hosts and lock formats -------------------
 
     /// A grant token as it appears between the host and the patch uuid in
     /// hosted artifact URLs.
@@ -4258,13 +3835,13 @@ mod tests {
 
     #[tokio::test]
     async fn hosted_direction_provable_on_non_default_patch_host() {
-        // Hosted artifact URLs embed the record's patch uuid on ANY host
-        // (staging / self-hosted `--patch-server-url` deployments), so the
-        // liveness proof must not be pinned to the `patch.socket.dev`
-        // hostname.
+        // Hosted artifact URLs embed the pin's patch uuid on ANY host the
+        // operator configured (staging / self-hosted `--patch-server-url`
+        // deployments), so the proof must not be pinned to the
+        // `patch.socket.dev` hostname — but an unconfigured host is a user's
+        // own dependency source, never a pin.
         let tmp = tempfile::tempdir().unwrap();
         let root = tmp.path();
-        write_redirect_ledger(root, &["pkg:npm/minimist@1.2.2"]).await;
         write_vendor_ledger_wired(root, &["pkg:npm/minimist@1.2.2"]).await;
         let lock = serde_json::json!({
             "name": "app",
@@ -4288,28 +3865,31 @@ mod tests {
         .await
         .unwrap();
 
-        let takeover = classify_overlap_takeover(&common_at(root), root).await;
+        let configured = GlobalArgs {
+            patch_server_url: Some("https://patches.example.com".to_string()),
+            ..common_at(root)
+        };
+        let takeover = classify_overlap_takeover(&configured, root).await;
         assert_eq!(
             takeover.redirect,
             vec!["pkg:npm/minimist@1.2.2".to_string()],
-            "a non-default patch host must still prove hosted is live"
+            "a configured non-default patch host must still prove hosted is live"
         );
         assert!(takeover.vendored.is_empty(), "{takeover:?}");
+
+        assert_eq!(
+            classify_overlap_takeover(&common_at(root), root).await,
+            OverlapTakeover::default(),
+            "an unconfigured host is not a hosted pin"
+        );
     }
 
     #[tokio::test]
     async fn hosted_direction_provable_for_bun_url_tuple() {
-        // The bun inventory skips the URL 3-tuples hosted mode writes, so
-        // hosted liveness must be provable from the redirect-edited lockfile
-        // text (the record's uuid outside any vendored path).
+        // bun records the hosted artifact as a URL 3-tuple; the pin must be
+        // found there.
         let tmp = tempfile::tempdir().unwrap();
         let root = tmp.path();
-        write_redirect_ledger_with_edits(
-            root,
-            &["pkg:npm/minimist@1.2.2"],
-            vec![redirect_edit("bun.lock", "minimist")],
-        )
-        .await;
         write_vendor_ledger_wired(root, &["pkg:npm/minimist@1.2.2"]).await;
         tokio::fs::write(
             root.join("bun.lock"),
@@ -4333,17 +3913,11 @@ mod tests {
 
     #[tokio::test]
     async fn hosted_direction_provable_for_berry_archive_url() {
-        // The berry inventory always emits `resolved: None`; the hosted URL
-        // lives percent-encoded in the `::__archiveUrl=` binding. The uuid
-        // survives encoding verbatim, so the text proof must see it.
+        // The hosted URL lives percent-encoded in berry's `::__archiveUrl=`
+        // binding. The uuid survives encoding verbatim, so the pin must be
+        // found there.
         let tmp = tempfile::tempdir().unwrap();
         let root = tmp.path();
-        write_redirect_ledger_with_edits(
-            root,
-            &["pkg:npm/minimist@1.2.2"],
-            vec![redirect_edit("yarn.lock", "minimist@1.2.2")],
-        )
-        .await;
         write_vendor_ledger_wired(root, &["pkg:npm/minimist@1.2.2"]).await;
         tokio::fs::write(
             root.join("yarn.lock"),
@@ -4366,45 +3940,33 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn vendored_path_uuid_does_not_prove_hosted() {
+    async fn vendored_path_uuid_is_not_a_hosted_pin() {
         // The vendored wiring embeds the SAME patch uuid in its
-        // `.socket/vendor/<eco>/<uuid>/` path. When the redirect ledger
-        // names the same lockfile, those occurrences must NOT read as
-        // hosted proof — the lock points at the vendored files.
+        // `.socket/vendor/<eco>/<uuid>/` path. That occurrence must NOT read
+        // as a hosted pin — the lock points at the vendored files.
         let tmp = tempfile::tempdir().unwrap();
         let root = tmp.path();
-        write_redirect_ledger_with_edits(
-            root,
-            &["pkg:npm/minimist@1.2.2"],
-            vec![redirect_edit("package-lock.json", "node_modules/minimist")],
-        )
-        .await;
-        write_vendor_ledger_wired(root, &["pkg:npm/minimist@1.2.2"]).await;
         write_lock_pointing_at_vendored(root, "minimist", "1.2.2").await;
 
-        let takeover = classify_overlap_takeover(&common_at(root), root).await;
+        let state = crate::commands::hosted_state_from_lockfiles(&common_at(root), root).await;
         assert!(
-            takeover.redirect.is_empty(),
-            "a vendored-path uuid must not prove hosted: {takeover:?}"
-        );
-        assert_eq!(
-            takeover.vendored,
-            vec!["pkg:npm/minimist@1.2.2".to_string()]
+            state.records.is_empty(),
+            "a vendored-path uuid must not be a hosted pin: {:?}",
+            state.records.keys().collect::<Vec<_>>()
         );
     }
 
-    // ---- takeover detection degradation: corrupt / probe-less ledgers ------
+    // ---- takeover detection degradation: corrupt / probe-less state --------
 
     #[tokio::test]
     async fn corrupt_vendor_state_json_degrades_to_no_overlap() {
         // A hand-corrupted (or torn mid-write) `.socket/vendor/state.json`
         // must classify like a missing one: this path only feeds takeover
         // WARNINGS, and the vendored write paths hard-error on corruption
-        // themselves. A valid redirect ledger alone must not produce a
-        // spurious overlap.
+        // themselves. A hosted pin alone must not produce a spurious overlap.
         let tmp = tempfile::tempdir().unwrap();
         let root = tmp.path();
-        write_redirect_ledger(root, &["pkg:npm/minimist@1.2.2"]).await;
+        write_lock_pointing_at_hosted(root, "minimist", "1.2.2").await;
         let dir = root.join(".socket/vendor");
         tokio::fs::create_dir_all(&dir).await.unwrap();
         tokio::fs::write(dir.join("state.json"), "not-json {{{")
@@ -4412,7 +3974,7 @@ mod tests {
             .unwrap();
 
         assert!(
-            overlapping_ledger_purls(root).await.is_empty(),
+            overlapping_purls(&common_at(root), root).await.is_empty(),
             "a corrupt vendor ledger must degrade to no-overlap"
         );
         assert_eq!(
@@ -4424,24 +3986,22 @@ mod tests {
 
     #[tokio::test]
     async fn cargo_overlap_with_no_lock_to_probe_stays_silent() {
-        // Both ledgers claim the cargo purl but there is NO Cargo.lock (a
-        // fresh checkout / deleted lock): discovery finds no cargo wiring
-        // either way, which proves neither direction — the classifier must
-        // stay silent rather than guess.
+        // The vendored ledger (and a pre-v5 redirect ledger) claim the cargo
+        // purl but there is NO Cargo.lock (a fresh checkout / deleted lock):
+        // discovery finds no hosted pin, so nothing overlaps and the
+        // classifier stays silent rather than guess.
         let tmp = tempfile::tempdir().unwrap();
         let root = tmp.path();
         write_redirect_ledger(root, &[CARGO_PURL]).await;
         write_cargo_vendor_ledger(root).await;
 
-        // The raw overlap fires (both ledgers name the purl)…
-        assert_eq!(
-            overlapping_ledger_purls(root).await,
-            vec![CARGO_PURL.to_string()],
-            "the overlap itself must be detected"
+        let common = cargo_common_at(root);
+        assert!(
+            overlapping_purls(&common, root).await.is_empty(),
+            "no lock ⇒ no hosted pin ⇒ no overlap"
         );
-        // …but with no lock to prove a direction, both buckets stay empty.
         assert_eq!(
-            classify_overlap_takeover(&common_at(root), root).await,
+            classify_overlap_takeover(&common, root).await,
             OverlapTakeover::default(),
             "no Cargo.lock ⇒ neither direction proven ⇒ silent"
         );
@@ -4559,266 +4119,6 @@ mod tests {
         );
     }
 
-    // ---- note_vendor_supersedes_redirect: warning + npm auto-reconcile ------
-
-    const NPM_TAKEOVER_PURL: &str = "pkg:npm/minimist@1.2.2";
-
-    fn vendor_env() -> crate::json_envelope::Envelope {
-        crate::json_envelope::Envelope::new(crate::json_envelope::Command::Vendor)
-    }
-
-    /// `GlobalArgs` for the advisory: `json` keeps the stderr print quiet
-    /// (the envelope `warnings[]` is what the tests read).
-    fn takeover_common() -> GlobalArgs {
-        GlobalArgs {
-            json: true,
-            ..GlobalArgs::default()
-        }
-    }
-
-    /// The WET npm takeover: redirect ledger records the purl (with a
-    /// version-exact keyed edit `drop_superseded_purl` can claim), the
-    /// vendored ledger is wired, and the LIVE lock points at the committed
-    /// vendored artifact.
-    async fn write_wet_npm_takeover(root: &Path) {
-        write_redirect_ledger_with_edits(
-            root,
-            &[NPM_TAKEOVER_PURL],
-            vec![redirect_edit("package-lock.json", "minimist@1.2.2")],
-        )
-        .await;
-        write_vendor_ledger_wired(root, &[NPM_TAKEOVER_PURL]).await;
-        write_lock_pointing_at_vendored(root, "minimist", "1.2.2").await;
-    }
-
-    #[tokio::test]
-    async fn vendored_takeover_wet_npm_run_reconciles_the_ledger_once() {
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        write_wet_npm_takeover(root).await;
-
-        let mut env = vendor_env();
-        note_vendor_supersedes_redirect(&mut env, root, &takeover_common()).await;
-
-        assert_eq!(
-            env.warnings.len(),
-            1,
-            "exactly one warning: {:?}",
-            env.warnings
-        );
-        assert_eq!(env.warnings[0].code, VENDOR_SUPERSEDES_REDIRECT);
-        assert!(
-            env.warnings[0].detail.contains("reconciled automatically"),
-            "a wet npm run must report the past-tense reconciled detail: {}",
-            env.warnings[0].detail
-        );
-        assert!(
-            env.warnings[0].detail.contains(NPM_TAKEOVER_PURL),
-            "the warning must name the package: {}",
-            env.warnings[0].detail
-        );
-
-        // Both halves dropped; the emptied ledger is deleted outright.
-        assert!(
-            load_ledger(root).await.is_none(),
-            "an emptied redirect ledger must be deleted"
-        );
-
-        // Fires once: the reconciled project no longer overlaps.
-        let mut env2 = vendor_env();
-        note_vendor_supersedes_redirect(&mut env2, root, &takeover_common()).await;
-        assert!(
-            env2.warnings.is_empty(),
-            "a reconciled takeover must not re-warn: {:?}",
-            env2.warnings
-        );
-    }
-
-    /// The reconcile's `.npmrc` unwind surfaces its own warnings
-    /// (`redirect_npmrc_allow_remote_modified`), and the detail mentions
-    /// `.npmrc` with the npm 12 EALLOWREMOTE caveat.
-    #[tokio::test]
-    async fn vendored_takeover_reconcile_surfaces_the_npmrc_unwind() {
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        write_redirect_ledger_with_edits(
-            root,
-            &[NPM_TAKEOVER_PURL],
-            vec![
-                redirect_edit("package-lock.json", "minimist@1.2.2"),
-                socket_patch_core::patch::redirect::FileEdit {
-                    path: ".npmrc".into(),
-                    kind: "redirect_npmrc_allow_remote".into(),
-                    action: "created".into(),
-                    key: Some("allow-remote".into()),
-                    original: None,
-                    new: Some(serde_json::json!("all")),
-                },
-            ],
-        )
-        .await;
-        write_vendor_ledger_wired(root, &[NPM_TAKEOVER_PURL]).await;
-        write_lock_pointing_at_vendored(root, "minimist", "1.2.2").await;
-        // The user added their own setting to the redirect-created file.
-        tokio::fs::write(root.join(".npmrc"), "allow-remote=all\nfund=false\n")
-            .await
-            .unwrap();
-
-        let mut env = vendor_env();
-        note_vendor_supersedes_redirect(&mut env, root, &takeover_common()).await;
-
-        let codes: Vec<&str> = env.warnings.iter().map(|w| w.code.as_str()).collect();
-        assert_eq!(
-            codes,
-            [
-                VENDOR_SUPERSEDES_REDIRECT,
-                "redirect_npmrc_allow_remote_modified"
-            ],
-            "{:?}",
-            env.warnings
-        );
-        let detail = &env.warnings[0].detail;
-        assert!(detail.contains("reconciled automatically"), "{detail}");
-        assert!(detail.contains("`.npmrc` `allow-remote=all`"), "{detail}");
-        assert!(detail.contains("EALLOWREMOTE"), "{detail}");
-        assert_eq!(
-            tokio::fs::read_to_string(root.join(".npmrc"))
-                .await
-                .unwrap(),
-            "fund=false\n",
-            "only our line removed"
-        );
-        assert!(load_ledger(root).await.is_none(), "emptied ledger deleted");
-
-        // Without a recorded `.npmrc` edit the detail stays silent on it.
-        assert!(!mode_takeover_reconciled_detail(&["p".into()], false).contains(".npmrc"));
-    }
-
-    #[tokio::test]
-    async fn vendored_takeover_dry_run_warns_manual_and_leaves_the_ledger() {
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        write_wet_npm_takeover(root).await;
-        let ledger_path = root.join(".socket/vendor/redirect-state.json");
-        let before = tokio::fs::read(&ledger_path).await.unwrap();
-
-        let mut env = vendor_env();
-        let common = GlobalArgs {
-            dry_run: true,
-            ..takeover_common()
-        };
-        note_vendor_supersedes_redirect(&mut env, root, &common).await;
-
-        assert_eq!(env.warnings.len(), 1, "{:?}", env.warnings);
-        assert_eq!(env.warnings[0].code, VENDOR_SUPERSEDES_REDIRECT);
-        // A dry run hands out the MANUAL remediation (never the past-tense
-        // reconciled text — nothing was mutated).
-        assert!(
-            env.warnings[0].detail.contains("clean up by hand"),
-            "dry-run must carry the manual advisory: {}",
-            env.warnings[0].detail
-        );
-        assert!(
-            !env.warnings[0].detail.contains("reconciled automatically"),
-            "dry-run must not claim a reconciliation: {}",
-            env.warnings[0].detail
-        );
-        let after = tokio::fs::read(&ledger_path).await.unwrap();
-        assert_eq!(
-            before, after,
-            "a dry run must leave the ledger byte-identical"
-        );
-    }
-
-    #[tokio::test]
-    async fn degraded_ledger_reconcile_matches_nothing_and_falls_back_to_manual() {
-        // The degraded record-fetch-failed ledger: records EMPTY, one
-        // version-blind path-keyed edit. The overlap fallback flags it, but
-        // `drop_superseded_purl` (fail-closed: no record uuid to anchor on,
-        // key not version-exact) drops nothing — the warning must hand out
-        // the manual remediation, never claim a reconciliation.
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        write_redirect_ledger_with_edits(
-            root,
-            &[],
-            vec![redirect_edit("package-lock.json", "node_modules/minimist")],
-        )
-        .await;
-        write_vendor_ledger_wired(root, &[NPM_TAKEOVER_PURL]).await;
-        write_lock_pointing_at_vendored(root, "minimist", "1.2.2").await;
-        let ledger_path = root.join(".socket/vendor/redirect-state.json");
-        let before = tokio::fs::read(&ledger_path).await.unwrap();
-
-        let mut env = vendor_env();
-        note_vendor_supersedes_redirect(&mut env, root, &takeover_common()).await;
-
-        assert_eq!(env.warnings.len(), 1, "{:?}", env.warnings);
-        assert_eq!(env.warnings[0].code, VENDOR_SUPERSEDES_REDIRECT);
-        assert_eq!(
-            env.warnings[0].detail,
-            mode_takeover_detail(&[NPM_TAKEOVER_PURL.to_string()], false),
-            "an Ok(None) reconcile must fall back to the manual detail verbatim"
-        );
-        let after = tokio::fs::read(&ledger_path).await.unwrap();
-        assert_eq!(
-            before, after,
-            "a no-op reconcile must leave the degraded ledger byte-identical"
-        );
-    }
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn reconcile_persist_failure_fails_closed_with_manual_advice() {
-        use std::os::unix::fs::PermissionsExt;
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        write_wet_npm_takeover(root).await;
-        let vendor_dir = root.join(".socket/vendor");
-        let ledger_path = vendor_dir.join("redirect-state.json");
-        let before = tokio::fs::read(&ledger_path).await.unwrap();
-
-        std::fs::set_permissions(&vendor_dir, std::fs::Permissions::from_mode(0o555)).unwrap();
-        // Root ignores mode bits; skip there (CI containers sometimes run as root).
-        if std::fs::File::create(vendor_dir.join("probe")).is_ok() {
-            let _ = std::fs::remove_file(vendor_dir.join("probe"));
-            let _ = std::fs::set_permissions(&vendor_dir, std::fs::Permissions::from_mode(0o755));
-            eprintln!("skipping: running as root, 0555 does not block writes");
-            return;
-        }
-
-        let mut env = vendor_env();
-        note_vendor_supersedes_redirect(&mut env, root, &takeover_common()).await;
-
-        // Restore BEFORE asserting so a failure never leaks an undeletable
-        // tempdir.
-        std::fs::set_permissions(&vendor_dir, std::fs::Permissions::from_mode(0o755)).unwrap();
-
-        assert_eq!(env.warnings.len(), 1, "{:?}", env.warnings);
-        assert_eq!(env.warnings[0].code, VENDOR_SUPERSEDES_REDIRECT);
-        assert!(
-            env.warnings[0]
-                .detail
-                .contains("Automatic reconciliation failed"),
-            "the persist failure must be surfaced inside the warning: {}",
-            env.warnings[0].detail
-        );
-        assert!(
-            env.warnings[0].detail.starts_with(&mode_takeover_detail(
-                &[NPM_TAKEOVER_PURL.to_string()],
-                false
-            )),
-            "the failure text must ride on the full manual remediation: {}",
-            env.warnings[0].detail
-        );
-        // Fail closed: the atomic writer left the ledger fully pre-drop.
-        let after = tokio::fs::read(&ledger_path).await.unwrap();
-        assert_eq!(
-            before, after,
-            "a failed persist must leave the ledger untouched"
-        );
-    }
-
     /// A failed embedded VEX's discovery diagnostics reach the scan JSON:
     /// appended after existing `warnings[]` (layout refusals), or creating
     /// the array; an empty list leaves the object untouched.
diff --git a/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs b/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs
index 5457311c..7930eb43 100644
--- a/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs
+++ b/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs
@@ -46,7 +46,7 @@ use crate::ui::{plural, print_json};
 use super::gc::{gc_json, print_gc_vendored_line, run_apply_gc};
 use super::{
     discover_selected, download_params, embed_vex_into_json, emit_discovery_error_json,
-    note_vendor_supersedes_redirect, push_run_warning, ScanArgs,
+    push_run_warning, ScanArgs,
 };
 
 /// Run-level warning: a `.socket/manifest.json` record for a purl the
@@ -190,9 +190,8 @@ async fn run_scan_vendor_step(
     let manifest_path = common.resolved_manifest_path();
     let socket_dir = common.socket_dir();
     let timeout = Duration::from_secs(common.lock_timeout.unwrap_or(0));
-    // The guard lives to the end of the step so the ledger migration and
-    // the redirect-ledger reconcile in `note_vendor_supersedes_redirect`
-    // run under the lock too.
+    // The guard lives to the end of the step so the ledger migration runs
+    // under the lock too.
     let _guard =
         crate::commands::lock_cli::acquire_with_status(&socket_dir, timeout).map_err(|e| {
             let (code, message) = lock_failure(&e, timeout);
@@ -230,7 +229,6 @@ async fn run_scan_vendor_step(
         env.mark_partial_failure();
     }
     note_classic_migration_risk(&mut env, &common.cwd, common);
-    note_vendor_supersedes_redirect(&mut env, &common.cwd, common).await;
     Ok((has_errors, env))
 }
 
@@ -241,7 +239,7 @@ async fn run_scan_vendor_step(
 /// `no_local_source` fold (staging could not obtain the patch content —
 /// offline, or the view fetch failed).
 #[allow(clippy::too_many_arguments)]
-async fn stage_and_vendor(
+pub(crate) async fn stage_and_vendor(
     common: &GlobalArgs,
     socket_dir: &Path,
     manifest: &PatchManifest,
diff --git a/crates/socket-patch-cli/src/commands/vendor.rs b/crates/socket-patch-cli/src/commands/vendor.rs
index 5da61dd9..275cf503 100644
--- a/crates/socket-patch-cli/src/commands/vendor.rs
+++ b/crates/socket-patch-cli/src/commands/vendor.rs
@@ -26,6 +26,7 @@ use socket_patch_core::crawlers::{CrawlerOptions, Ecosystem};
 use socket_patch_core::manifest::operations::{read_manifest, write_manifest};
 use socket_patch_core::manifest::schema::{PatchManifest, PatchRecord};
 use socket_patch_core::patch::apply::{verify_file_patch, PatchSources};
+use socket_patch_core::patch::redirect::upstream::HostedPin;
 use socket_patch_core::telemetry::{track_patch_vendor_failed, track_patch_vendored};
 use socket_patch_core::utils::concurrent::{ordered_concurrent, registry_concurrency};
 use socket_patch_core::utils::group_commit::GroupCommit;
@@ -656,6 +657,34 @@ pub async fn run(args: VendorArgs) -> i32 {
     // vendored` projects have `.socket/` but never a manifest. Nothing is
     // locked or written on this path.
     if !args.revert && tokio::fs::metadata(&manifest_path).await.is_err() {
+        // A hosted project (no manifest, hosted pins in its lockfiles)
+        // ejects: its patch set is the lockfiles' hosted pins.
+        if !args.common.is_global() {
+            let inventory = crate::commands::hosted_inventory(&args.common, &args.common.cwd).await;
+            // Contested hosted wiring: the patch set cannot be read off the
+            // lockfiles, and a "nothing to vendor" answer would hide it.
+            if let Some(refusal) = inventory.contested_refusal() {
+                return emit_eject_refusal(&args.common, "hosted_wiring_contested", &refusal);
+            }
+            let pins = hosted_pins_in_scope(&args.common, inventory.pins);
+            if !pins.is_empty() {
+                // Eject needs every patch record from the API: an offline
+                // run (or dry run) refuses before any request.
+                if args.common.offline {
+                    return emit_eject_refusal(
+                        &args.common,
+                        "offline_eject_unavailable",
+                        &format!(
+                            "ejecting {} needs {} patch record(s) from the Socket API, and this \
+                             run is offline; re-run without --offline",
+                            plural(pins.len(), "hosted package", "hosted packages"),
+                            pins.len()
+                        ),
+                    );
+                }
+                return run_eject(&args, pins).await;
+            }
+        }
         // A requested `--vex` still attests what the `.socket/vendor`
         // ledgers and lockfiles already wire. Same contract as `apply --vex`
         // with no manifest: nothing referenced anywhere keeps exit 0; any
@@ -823,13 +852,9 @@ pub async fn run(args: VendorArgs) -> i32 {
     }
 
     note_classic_migration_risk(&mut env, &args.common.cwd, &args.common);
-    // Same cross-mode takeover advisory the scan-driven vendored flow emits:
-    // surface a redirect ledger that this run (or an earlier one) superseded.
-    super::scan::note_vendor_supersedes_redirect(&mut env, &args.common.cwd, &args.common).await;
 
-    // That advisory may persist the redirect ledger, so it ran under the
-    // lock; everything below is output and telemetry, so release the lock
-    // before the telemetry round-trip.
+    // Everything below is output and telemetry, so release the lock before
+    // the telemetry round-trip.
     drop(lock);
 
     if args.common.json {
@@ -850,6 +875,487 @@ pub async fn run(args: VendorArgs) -> i32 {
     exit
 }
 
+/// A refused eject: the JSON error envelope (`status: error`) or an
+/// `Error:` line (printed even under `--silent`). Exit 1; nothing touched.
+fn emit_eject_refusal(common: &GlobalArgs, code: &'static str, message: &str) -> i32 {
+    if common.json {
+        let mut env = Envelope::new(Command::Vendor);
+        env.dry_run = common.dry_run;
+        env.mark_error(EnvelopeError::new(code, message.to_string()));
+        println!("{}", env.to_pretty_json());
+    } else {
+        eprintln!("Error ({code}): {message}");
+    }
+    1
+}
+
+/// The hosted pins whose ecosystem `--ecosystems` selects.
+fn hosted_pins_in_scope(common: &GlobalArgs, pins: Vec<HostedPin>) -> Vec<HostedPin> {
+    pins.into_iter()
+        .filter(|pin| {
+            socket_patch_core::utils::purl::purl_parts(&pin.purl)
+                .is_some_and(|(eco, _, _)| ecosystem_in_scope(common, &eco))
+        })
+        .collect()
+}
+
+/// What a wet eject can touch, captured before it touches anything: every
+/// regular file directly in the project root, the hosted pins' files and
+/// the restore's files (nested locks included), the project's cargo and
+/// maven config files, the vendor ledger, and the set of vendored uuid
+/// directories. [`EjectSnapshot::restore`] puts all of it back and removes
+/// what the eject created.
+struct EjectSnapshot {
+    root: std::path::PathBuf,
+    files: Vec<(String, Option<Vec<u8>>)>,
+    root_files: std::collections::BTreeSet<String>,
+    vendor_dirs: std::collections::BTreeSet<std::path::PathBuf>,
+}
+
+impl EjectSnapshot {
+    const EXTRA: [&'static str; 5] = [
+        ".cargo/config",
+        ".cargo/config.toml",
+        ".mvn/maven.config",
+        ".mvn/checksums/checksums.sha256",
+        socket_patch_core::vendor::VENDOR_STATE_REL,
+    ];
+
+    async fn root_file_names(root: &Path) -> std::io::Result<std::collections::BTreeSet<String>> {
+        let mut out = std::collections::BTreeSet::new();
+        let mut dir = tokio::fs::read_dir(root).await?;
+        while let Some(entry) = dir.next_entry().await? {
+            if entry.file_type().await?.is_file() {
+                out.insert(entry.file_name().to_string_lossy().into_owned());
+            }
+        }
+        Ok(out)
+    }
+
+    fn vendor_dir_set(root: &Path) -> std::collections::BTreeSet<std::path::PathBuf> {
+        let base = root.join(".socket/vendor");
+        let mut out = std::collections::BTreeSet::new();
+        for eco in std::fs::read_dir(&base).into_iter().flatten().flatten() {
+            if eco.file_type().is_ok_and(|t| t.is_dir()) {
+                for unit in std::fs::read_dir(eco.path()).into_iter().flatten().flatten() {
+                    out.insert(unit.path());
+                }
+            }
+        }
+        out
+    }
+
+    async fn take(root: &Path, touched: &[String]) -> std::io::Result<Self> {
+        let root_files = Self::root_file_names(root).await?;
+        let mut rels: std::collections::BTreeSet<String> = root_files.clone();
+        rels.extend(touched.iter().cloned());
+        rels.extend(Self::EXTRA.iter().map(|s| s.to_string()));
+        let mut files = Vec::with_capacity(rels.len());
+        for rel in rels {
+            let bytes = match tokio::fs::read(root.join(&rel)).await {
+                Ok(bytes) => Some(bytes),
+                Err(e) if e.kind() == std::io::ErrorKind::NotFound => None,
+                Err(e) => return Err(e),
+            };
+            files.push((rel, bytes));
+        }
+        Ok(EjectSnapshot {
+            root: root.to_path_buf(),
+            files,
+            root_files,
+            vendor_dirs: Self::vendor_dir_set(root),
+        })
+    }
+
+    async fn restore(&self) -> Result<(), String> {
+        let mut errors: Vec<String> = Vec::new();
+        for (rel, bytes) in &self.files {
+            let path = self.root.join(rel);
+            let result = match bytes {
+                Some(bytes) => {
+                    socket_patch_core::utils::fs::atomic_write_bytes_preserving_mode(&path, bytes).await
+                }
+                None => match tokio::fs::remove_file(&path).await {
+                    Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(()),
+                    other => other,
+                },
+            };
+            if let Err(e) = result {
+                errors.push(format!("{rel}: {e}"));
+            }
+        }
+        // Root files the eject created.
+        if let Ok(now) = Self::root_file_names(&self.root).await {
+            for name in now.difference(&self.root_files) {
+                if self.files.iter().any(|(rel, _)| rel == name) {
+                    continue;
+                }
+                if let Err(e) = tokio::fs::remove_file(self.root.join(name)).await {
+                    errors.push(format!("{name}: {e}"));
+                }
+            }
+        }
+        // Vendored uuid dirs the eject created.
+        for dir in Self::vendor_dir_set(&self.root).difference(&self.vendor_dirs) {
+            if let Err(e) = remove_tree_and_prune(dir, &self.root.join(SOCKET_DIR)).await {
+                errors.push(format!("{}: {e}", dir.display()));
+            }
+        }
+        if errors.is_empty() {
+            Ok(())
+        } else {
+            Err(errors.join("; "))
+        }
+    }
+
+    /// The project files for the manual remedy.
+    fn files_hint(&self) -> String {
+        self.files
+            .iter()
+            .filter(|(_, bytes)| bytes.is_some())
+            .map(|(rel, _)| rel.as_str())
+            .collect::<Vec<_>>()
+            .join(" ")
+    }
+}
+
+/// Standalone `vendor` in a hosted project — no manifest, hosted pins in the
+/// lockfiles: EJECT. The patch set is the pins themselves (purl + the uuid
+/// in each hosted URL); each record is fetched from the API, vendored into
+/// `.socket/vendor/` exactly like `scan --mode vendored`, and the lock is
+/// rewired from hosted to vendored (the engine's takeover restores each
+/// pin's upstream registry entry first, so `vendor --revert` later returns
+/// the project to upstream, not to hosted).
+async fn run_eject(args: &VendorArgs, pins: Vec<HostedPin>) -> i32 {
+    let common = &args.common;
+    let (client, use_public_proxy) =
+        get_api_client_with_overrides(common.api_client_overrides()).await;
+    let (api_token, org_slug) = (client.api_token().cloned(), client.org_slug().cloned());
+    if !common.json && !common.silent {
+        println!(
+            "{} {} into .socket/vendor/...",
+            if common.dry_run { "Would eject" } else { "Ejecting" },
+            plural(pins.len(), "hosted package", "hosted packages")
+        );
+    }
+
+    // One view per distinct uuid, fetched concurrently and consumed in pin
+    // order; the views' blobs seed the in-memory staging.
+    let mut records: HashMap<String, PatchRecord> = HashMap::new();
+    let mut blobs: HashMap<String, Vec<u8>> = HashMap::new();
+    let mut fetch_failures: Vec<(String, String)> = Vec::new();
+    let mut views = std::pin::pin!(ordered_concurrent(
+        pins.iter(),
+        socket_patch_core::utils::concurrent::api_concurrency_for(
+            client.uses_public_proxy(),
+            pins.len(),
+        ),
+        |pin| {
+            let client = &client;
+            async move { client.fetch_patch(&pin.uuid).await }
+        },
+    ));
+    for pin in &pins {
+        let Some(view) = views.next().await else {
+            break;
+        };
+        match view {
+            Ok(Some(patch)) => {
+                for info in patch.files.values() {
+                    let (Some(b64), Some(hash)) = (&info.blob_content, &info.after_hash) else {
+                        continue;
+                    };
+                    if !socket_patch_core::patch::apply::is_valid_blob_hash(hash)
+                        || blobs.contains_key(hash)
+                    {
+                        continue;
+                    }
+                    if let Ok(bytes) = crate::commands::get::base64_decode(b64) {
+                        blobs.insert(hash.clone(), bytes);
+                    }
+                }
+                let (_, record) = crate::commands::get::record_from_patch_response(&patch);
+                records.insert(pin.purl.clone(), record);
+            }
+            Ok(None) => fetch_failures.push((
+                pin.purl.clone(),
+                format!("patch {} was not found on the API", pin.uuid),
+            )),
+            Err(e) => fetch_failures.push((
+                pin.purl.clone(),
+                format!("could not fetch patch {}: {e}", pin.uuid),
+            )),
+        }
+    }
+
+    // All or nothing: a record the API cannot serve refuses the whole eject
+    // before anything is touched, so every package stays hosted.
+    if !fetch_failures.is_empty() {
+        let mut env = Envelope::new(Command::Vendor);
+        env.dry_run = common.dry_run;
+        for (purl, detail) in &fetch_failures {
+            report_vendor_failure(common, purl, detail);
+            env.record(
+                PatchEvent::new(PatchAction::Failed, purl.clone())
+                    .with_error("patch_fetch_failed", detail.clone()),
+            );
+        }
+        env.mark_error(EnvelopeError::new(
+            "eject_refused",
+            "not every hosted patch record could be fetched; nothing was changed",
+        ));
+        if common.json {
+            println!("{}", env.to_pretty_json());
+        }
+        track_outcomes_for_vendor(true, &env, common.dry_run, api_token.as_deref(), org_slug.as_deref())
+            .await;
+        return 1;
+    }
+
+    // Plan the upstream restore before touching anything: every pin must
+    // re-resolve to its registry entry (a dry resolve), or the eject is
+    // refused whole with each pin's remedy.
+    let origins = crate::commands::rollback::patch_server_origins(common);
+    let plan = socket_patch_core::patch::redirect::upstream::restore_upstream(
+        &common.cwd,
+        &pins,
+        &socket_patch_core::patch::redirect::upstream::RestoreOptions {
+            dry_run: true,
+            offline: common.offline,
+            patch_server_origins: origins.clone(),
+            bun_lockb: true,
+        },
+    )
+    .await;
+    let refused: Vec<(String, String)> = plan
+        .refused()
+        .map(|(pin, why)| (pin.purl.clone(), why.to_string()))
+        .collect();
+    if !refused.is_empty() {
+        let mut env = Envelope::new(Command::Vendor);
+        env.dry_run = common.dry_run;
+        for (purl, why) in &refused {
+            report_vendor_failure(common, purl, why);
+            env.record(
+                PatchEvent::new(PatchAction::Failed, purl.clone())
+                    .with_error("redirect_revert_failed", why.clone()),
+            );
+        }
+        env.mark_error(EnvelopeError::new(
+            "eject_refused",
+            "not every hosted pin can be restored to its upstream registry entry; nothing was \
+             changed",
+        ));
+        if common.json {
+            println!("{}", env.to_pretty_json());
+        }
+        track_outcomes_for_vendor(true, &env, common.dry_run, api_token.as_deref(), org_slug.as_deref())
+            .await;
+        return 1;
+    }
+
+    // A dry run stops at the verified plan: restoring the live lock to
+    // preview the vendor step would be a write.
+    if common.dry_run {
+        let mut env = Envelope::new(Command::Vendor);
+        env.dry_run = true;
+        for pin in &pins {
+            env.record(PatchEvent::new(PatchAction::Applied, pin.purl.clone()).with_reason(
+                "eject_planned",
+                format!(
+                    "would restore the upstream registry entry ({}) and vendor the patch",
+                    pin.files.join(", ")
+                ),
+            ));
+            if !common.json && !common.silent {
+                println!(
+                    "Would eject {} (restore {}, then vendor into .socket/vendor/)",
+                    pin.purl,
+                    pin.files.join(", ")
+                );
+            }
+        }
+        if args.vex.vex.is_some() && !common.json && !common.silent {
+            println!("{}", crate::commands::vex::format_vex_dry_run_skip("vendored"));
+        }
+        if common.json {
+            println!("{}", env.to_pretty_json());
+        }
+        track_outcomes_for_vendor(false, &env, true, api_token.as_deref(), org_slug.as_deref()).await;
+        return 0;
+    }
+
+    // One transaction under one apply lock: snapshot what the eject can
+    // touch, restore every pin upstream (so the vendor engine resolves the
+    // pristine registry package even in a fresh checkout with nothing
+    // installed), vendor, and on ANY failure put the snapshot back — a
+    // failed eject leaves the project hosted, exactly as it was.
+    let socket_dir = common.socket_dir();
+    let timeout = Duration::from_secs(common.lock_timeout.unwrap_or(0));
+    let guard = match crate::commands::lock_cli::acquire_with_status(&socket_dir, timeout) {
+        Ok(guard) => guard,
+        Err(e) => {
+            let (code, message) = crate::commands::lock_cli::lock_failure(&e, timeout);
+            return emit_eject_refusal(common, code, &message);
+        }
+    };
+    let touched: Vec<String> = pins
+        .iter()
+        .flat_map(|p| p.files.iter().cloned())
+        .chain(plan.reverted_files.iter().cloned())
+        .collect();
+    let snapshot = match EjectSnapshot::take(&common.cwd, &touched).await {
+        Ok(snapshot) => snapshot,
+        Err(e) => {
+            drop(guard);
+            return emit_eject_refusal(
+                common,
+                "eject_refused",
+                &format!("could not snapshot the project before ejecting: {e}"),
+            );
+        }
+    };
+    let mut env = Envelope::new(Command::Vendor);
+    let restore = socket_patch_core::patch::redirect::upstream::restore_upstream(
+        &common.cwd,
+        &pins,
+        &socket_patch_core::patch::redirect::upstream::RestoreOptions {
+            dry_run: false,
+            offline: common.offline,
+            patch_server_origins: origins,
+            bun_lockb: true,
+        },
+    )
+    .await;
+    let restore_failure = restore
+        .refused()
+        .map(|(_, why)| why.to_string())
+        .next()
+        .or_else(|| restore.flush_error.clone());
+    let mut exit: i32;
+    if let Some(why) = restore_failure {
+        env.mark_error(EnvelopeError::new("redirect_revert_failed", why.clone()));
+        if !common.json {
+            eprintln!("Error: {}", crate::commands::rollback::capitalize_first(&why));
+        }
+        exit = 1;
+    } else {
+        for (code, detail) in &restore.warnings {
+            env.warnings.push(RunWarning {
+                code: code.to_string(),
+                detail: detail.clone(),
+            });
+        }
+        let manifest = PatchManifest {
+            patches: records,
+            setup: None,
+        };
+        match crate::commands::scan::vendor_flow::stage_and_vendor(
+            common,
+            &socket_dir,
+            &manifest,
+            blobs,
+            client.clone(),
+            use_public_proxy,
+            &mut env,
+            None,
+        )
+        .await
+        {
+            Ok(has_errors) => exit = i32::from(has_errors),
+            Err((code, message)) => {
+                env.mark_error(EnvelopeError::new(code, message.clone()));
+                if !common.json {
+                    eprintln!(
+                        "{}",
+                        crate::commands::scan::vendor_flow::format_vendor_step_error(code, &message)
+                    );
+                }
+                exit = 1;
+            }
+        }
+    }
+    if exit != 0 {
+        match snapshot.restore().await {
+            Ok(()) => env.warnings.push(RunWarning {
+                code: "eject_rolled_back".to_string(),
+                detail: "the eject did not complete, so every file it touched was restored: the \
+                         project is still hosted, exactly as before"
+                    .to_string(),
+            }),
+            Err(e) => {
+                let detail = format!(
+                    "the eject did not complete and restoring the pre-eject files failed ({e}); \
+                     restore them from version control (`git checkout -- {}`)",
+                    snapshot.files_hint()
+                );
+                if !common.json {
+                    eprintln!("Error: {detail}");
+                }
+                env.mark_error(EnvelopeError::new("eject_rollback_failed", detail));
+            }
+        }
+        if env.error.is_none() {
+            env.mark_partial_failure();
+        }
+    }
+    note_classic_migration_risk(&mut env, &common.cwd, common);
+    drop(guard);
+
+    // Embedded VEX: same contract as the manifest-driven arm — only on
+    // success, never on a dry run, and a requested-but-failed VEX flips the
+    // exit code. The ejected project has no manifest.
+    if exit == 0 {
+        if let Some(vex_path) = args.vex.vex.as_ref() {
+            if common.dry_run {
+                if !common.json && !common.silent {
+                    println!("{}", crate::commands::vex::format_vex_dry_run_skip("vendored"));
+                }
+            } else {
+                let params = args.vex.to_build_params();
+                let manifest_path = common.resolved_manifest_path();
+                match generate_vex_without_manifest(common, &params, &manifest_path).await {
+                    ManifestlessVex::Written(summary) => {
+                        env.vex = Some(VexSummary {
+                            path: vex_path.display().to_string(),
+                            statements: summary.statements,
+                            format: "openvex-0.2.0".to_string(),
+                            warnings: summary.warnings,
+                        });
+                    }
+                    ManifestlessVex::NothingToAttest(warnings) => {
+                        env.warnings.extend(warnings);
+                        if !common.json && !common.silent {
+                            println!("{}", crate::commands::vex::format_vex_nothing_to_attest());
+                        }
+                    }
+                    ManifestlessVex::Failed(e) => {
+                        env.warnings.extend(e.embedded_warnings());
+                        env.mark_error(EnvelopeError::new(e.code, e.message.clone()));
+                        if !common.json {
+                            e.print_embedded(common);
+                        }
+                        exit = 1;
+                    }
+                }
+            }
+        }
+    }
+
+    if common.json {
+        println!("{}", env.to_pretty_json());
+    }
+    track_outcomes_for_vendor(
+        exit != 0,
+        &env,
+        common.dry_run,
+        api_token.as_deref(),
+        org_slug.as_deref(),
+    )
+    .await;
+    exit
+}
+
 /// The no-manifest warning when the vendor ledger cannot be read either.
 fn no_manifest_ledger_unreadable(err: &str) -> String {
     format!(
@@ -1582,9 +2088,7 @@ async fn plan_service_downloads(
             if bun_refusal.is_some_and(|r| r.applies_to(candidate)) {
                 continue;
             }
-            if socket_patch_core::patch::redirect::redirect_revert_supported(candidate)
-                && takeover_blocked(candidate)
-            {
+            if takeover_blocked(candidate) {
                 continue;
             }
             // The npm backends re-wire a committed artifact the ledger
@@ -1918,10 +2422,9 @@ pub(crate) async fn vendor_records_reusing(
             // version) is deferred rather than fetched: the backend refuses
             // it — at its turn, in its own words — before anything reads
             // the source, so the refusal costs no registry request. A purl
-            // the hosted redirect ledger claims keeps the eager fetch: its
-            // takeover reverts the hosted lock edits first, which rewrites
-            // the text the gates read (and a malformed redirect ledger
-            // defers nothing).
+            // the lockfiles pin hosted keeps the eager fetch: its takeover
+            // restores the upstream lock entry first, which rewrites the
+            // text the gates read.
             let lock_candidates: Vec<(&str, &str)> = missing
                 .iter()
                 .zip(&rungs)
@@ -1939,15 +2442,14 @@ pub(crate) async fn vendor_records_reusing(
                 })
                 .collect();
             if !lock_candidates.is_empty() {
-                let claimed: Option<Vec<String>> =
-                    match socket_patch_core::patch::redirect::load_redirect_state(&common.cwd).await
-                    {
-                        Ok(Some(state)) => {
-                            Some(state.records.keys().map(|k| canonical_purl(k)).collect())
-                        }
-                        Ok(None) => Some(Vec::new()),
-                        Err(_) => None,
-                    };
+                let claimed: Option<Vec<String>> = Some(
+                    socket_patch_core::patch::redirect::upstream::HostedPin::all(
+                        &crate::commands::discover_wiring(common, &common.cwd).await,
+                    )
+                    .into_iter()
+                    .map(|pin| canonical_purl(&pin.purl))
+                    .collect(),
+                );
                 if let Some(claimed) = claimed {
                     let unclaimed: Vec<(&str, &str)> = lock_candidates
                         .into_iter()
@@ -2195,17 +2697,19 @@ pub(crate) async fn vendor_records_reusing(
     let mut matched: HashSet<String> = HashSet::new();
     let mut handled_bases: HashSet<String> = HashSet::new();
 
-    // The hosted redirect ledger, for cross-mode takeovers: vendoring a purl
-    // it still claims must revert the hosted edits FIRST (see the dispatch
-    // loop below). Loaded once; mutated + persisted per reverted purl. With
-    // a MALFORMED ledger a claimed purl is indistinguishable from an
-    // unclaimed one, so every takeover-capable purl fails closed; other
-    // purls proceed.
-    let (mut redirect_ledger, redirect_ledger_corrupt) =
-        match socket_patch_core::patch::redirect::load_redirect_state(&common.cwd).await {
-            Ok(state) => (state, None),
-            Err(corrupt) => (None, Some(corrupt)),
-        };
+    // The lockfiles' hosted pins, for cross-mode takeovers: vendoring a purl
+    // the lockfiles still pin hosted must restore its upstream registry
+    // entry FIRST (see the dispatch loop below). Discovered once, before any
+    // write of this run.
+    let hosted_pins: Vec<socket_patch_core::patch::redirect::upstream::HostedPin> =
+        socket_patch_core::patch::redirect::upstream::HostedPin::all(
+            &crate::commands::discover_wiring(common, &common.cwd).await,
+        );
+    let hosted_pin_of = |purl: &str| {
+        hosted_pins
+            .iter()
+            .find(|pin| canonical_purl(&pin.purl) == canonical_purl(purl))
+    };
 
     // Yarn berry takeover preflight (see
     // `socket_patch_core::vendor::yarn_berry_vendor_preflight`): the berry
@@ -2242,14 +2746,7 @@ pub(crate) async fn vendor_records_reusing(
     // is still decided at the loop's own call (see `VendorPrefetch`).
     let service_prefetch = match service.filter(|cfg| !common.dry_run && cfg.wants_prefetch()) {
         Some(cfg) => {
-            let takeover_blocked = |purl: &str| {
-                redirect_ledger_corrupt.is_some()
-                    || redirect_ledger.as_ref().is_some_and(|l| {
-                        l.records
-                            .keys()
-                            .any(|k| canonical_purl(k) == canonical_purl(purl))
-                    })
-            };
+            let takeover_blocked = |purl: &str| hosted_pin_of(purl).is_some();
             let planned = plan_service_downloads(
                 &common.cwd,
                 force,
@@ -2402,42 +2899,23 @@ pub(crate) async fn vendor_records_reusing(
                 continue;
             }
 
-            // Cross-mode takeover: vendoring over a LIVE hosted redirect
-            // must first revert the hosted edits from the redirect ledger.
-            // Cargo: `[patch.crates-io]` only patches crates-io-sourced
-            // deps, so vendoring on top of the hosted registry pin leaves the
-            // project unbuildable. npm family: without the pre-revert the
-            // vendor ledger records the grant-tokenized HOSTED lock fragment
-            // as its pre-vendor original. In every ecosystem the pre-revert
-            // hands the vendor detach the PRISTINE registry fragment to
-            // record. A purl whose hosted edits cannot be cleanly reverted is
-            // REFUSED; the cargo backend's `hosted_redirect_live` guard
-            // backstops states with no usable ledger.
-            if socket_patch_core::patch::redirect::redirect_revert_supported(candidate) {
-                if let Some(corrupt) = &redirect_ledger_corrupt {
-                    has_errors = true;
-                    env.record(
-                        PatchEvent::new(PatchAction::Failed, candidate.clone()).with_error(
-                            "redirect_ledger_corrupt",
-                            format!(
-                                "cannot vendor over a possibly-live hosted redirect: \
-                                 {corrupt}"
-                            ),
-                        ),
-                    );
-                    report_vendor_failure(common, candidate, &corrupt.to_string());
-                    continue;
-                }
-                let claimed = redirect_ledger.as_ref().is_some_and(|l| {
-                    l.records
-                        .keys()
-                        .any(|k| canonical_purl(k) == canonical_purl(candidate))
-                });
+            // Cross-mode takeover: vendoring over a LIVE hosted pin must
+            // first restore the upstream registry entry (v5 keeps no hosted
+            // ledger: the entry is re-resolved from the registry). Cargo:
+            // `[patch.crates-io]` only patches crates-io-sourced deps, so
+            // vendoring on top of the hosted registry pin leaves the project
+            // unbuildable. npm family: without the restore the vendor ledger
+            // records the grant-tokenized HOSTED lock fragment as its
+            // pre-vendor original. In every ecosystem the restore hands the
+            // vendor detach the PRISTINE registry entry to record. A purl
+            // whose upstream entry cannot be restored is REFUSED; the cargo
+            // backend's `hosted_redirect_live` guard backstops the rest.
+            if let Some(pin) = hosted_pin_of(candidate) {
                 // The refusal the berry backend would raise after the
-                // revert, raised HERE instead — the same `failed` event,
+                // restore, raised HERE instead — the same `failed` event,
                 // code and detail, in the dry run and the wet run alike —
-                // so the hosted wiring and redirect ledger stay untouched.
-                if claimed && candidate.starts_with("pkg:npm/") {
+                // so the hosted wiring stays untouched.
+                if candidate.starts_with("pkg:npm/") {
                     let refusal = berry_takeover_refusal
                         .get_or_init(|| {
                             socket_patch_core::vendor::yarn_berry_vendor_preflight(&common.cwd)
@@ -2453,177 +2931,103 @@ pub(crate) async fn vendor_records_reusing(
                         continue;
                     }
                 }
-                if claimed && common.dry_run {
-                    // Probe the takeover exactly as the wet run would (a dry
-                    // revert on a throwaway clone), so the preview never
-                    // promises a takeover the wet run then refuses.
-                    let mut probe = redirect_ledger.clone().expect("claimed implies Some");
-                    match socket_patch_core::patch::redirect::revert_redirect_purl(
-                        &common.cwd,
-                        &mut probe,
+                let origins = crate::commands::rollback::patch_server_origins(common);
+                let vlt_lock = socket_patch_core::utils::fs::read_regular_to_string(
+                    &common
+                        .cwd
+                        .join(socket_patch_core::constants::npm_family::VLT_LOCK),
+                )
+                .await
+                .ok();
+                let targets = vlt_lock
+                    .as_deref()
+                    .map(|lock| {
+                        socket_patch_core::patch::redirect::vlt_heal::lock_targets(
+                            lock,
+                            &origins,
+                            std::slice::from_ref(candidate),
+                        )
+                    })
+                    .unwrap_or_default();
+                let restore = socket_patch_core::patch::redirect::upstream::restore_upstream(
+                    &common.cwd,
+                    std::slice::from_ref(pin),
+                    &socket_patch_core::patch::redirect::upstream::RestoreOptions {
+                        dry_run: common.dry_run,
+                        offline: common.offline,
+                        patch_server_origins: origins,
+                        bun_lockb: true,
+                    },
+                )
+                .await;
+                let refusal = restore
+                    .refused()
+                    .map(|(_, why)| why.to_string())
+                    .next()
+                    .or_else(|| restore.flush_error.clone());
+                if let Some(detail) = refusal {
+                    has_errors = true;
+                    env.record(
+                        PatchEvent::new(PatchAction::Failed, candidate.clone()).with_error(
+                            "redirect_revert_failed",
+                            format!("cannot vendor over the live hosted pin: {detail}"),
+                        ),
+                    );
+                    report_vendor_failure(
+                        common,
                         candidate,
-                        true,
-                    )
-                    .await
-                    {
-                        Ok(revert) => {
-                            record_warning(
-                                env,
-                                candidate,
-                                &VendorWarning::new(
-                                    "vendor_would_revert_redirect",
-                                    format!(
-                                        "{} is hosted-redirected; a non-dry-run vendor will \
-                                         revert the hosted redirect edits first, then vendor \
-                                         (mode takeover)",
-                                        normalize_purl(candidate)
-                                    ),
-                                ),
-                                common,
-                            );
-                            // The backend preview below reads the lock from
-                            // disk, where the hosted wiring is still live.
-                            // Bun's hosted rewrite REPLACES the entry's
-                            // `name@version` spec, so the backend would refuse
-                            // a `vendor_lock_entry_not_found` the wet run never
-                            // sees: the advisory already states the plan, so
-                            // the preview stops here.
-                            if revert
-                                .reverted_files
-                                .iter()
-                                .any(|f| f == "bun.lock" || f == "bun.lockb")
-                            {
-                                continue;
-                            }
-                        }
-                        Err(detail) => {
-                            has_errors = true;
-                            env.record(
-                                PatchEvent::new(PatchAction::Failed, candidate.clone()).with_error(
-                                    "redirect_revert_failed",
-                                    format!(
-                                        "cannot vendor over the live hosted redirect: \
-                                         {detail}"
-                                    ),
-                                ),
-                            );
-                            report_vendor_failure(
-                                common,
-                                candidate,
-                                &format!("cannot revert the hosted redirect: {detail}"),
-                            );
-                            continue;
-                        }
-                    }
-                } else if claimed {
-                    let ledger = redirect_ledger.as_mut().expect("claimed implies Some");
-                    let vlt_lock = socket_patch_core::utils::fs::read_regular_to_string(
-                        &common
-                            .cwd
-                            .join(socket_patch_core::constants::npm_family::VLT_LOCK),
-                    )
-                    .await
-                    .ok();
-                    let targets = socket_patch_core::patch::redirect::vlt_heal::ledger_targets(
-                        ledger,
-                        std::slice::from_ref(candidate),
-                        vlt_lock.as_deref(),
+                        &format!("cannot restore the upstream entry: {detail}"),
                     );
-                    match socket_patch_core::patch::redirect::revert_redirect_purl(
-                        &common.cwd,
-                        ledger,
+                    continue;
+                }
+                for (code, detail) in &restore.warnings {
+                    record_warning(env, candidate, &VendorWarning::new(code, detail.clone()), common);
+                }
+                if common.dry_run {
+                    record_warning(
+                        env,
                         candidate,
-                        false,
-                    )
-                    .await
+                        &VendorWarning::new(
+                            "vendor_would_revert_redirect",
+                            format!(
+                                "{} is hosted; a non-dry-run vendor will restore its upstream \
+                                 registry entry first, then vendor (mode takeover)",
+                                normalize_purl(candidate)
+                            ),
+                        ),
+                        common,
+                    );
+                    // The backend preview below reads the lock from disk,
+                    // where the hosted wiring is still live. Bun's hosted
+                    // rewrite REPLACES the entry's `name@version` spec, so the
+                    // backend would refuse a `vendor_lock_entry_not_found`
+                    // the wet run never sees: the advisory already states the
+                    // plan, so the preview stops here.
+                    if restore
+                        .reverted_files
+                        .iter()
+                        .any(|f| f == "bun.lock" || f == "bun.lockb")
                     {
-                        Ok(revert) => {
-                            // Advisories from the same transaction (a
-                            // redirect-created `.npmrc` modified since —
-                            // kept, only the `allow-remote=all` line removed).
-                            for (code, detail) in &revert.warnings {
-                                if code == "redirect_npmrc_allow_remote_modified" {
-                                    record_warning(
-                                        env,
-                                        candidate,
-                                        &VendorWarning::new(
-                                            "redirect_npmrc_allow_remote_modified",
-                                            detail.clone(),
-                                        ),
-                                        common,
-                                    );
-                                }
-                            }
-                            if let Err(e) =
-                                socket_patch_core::patch::redirect::persist_redirect_state(
-                                    &common.cwd,
-                                    ledger,
-                                )
-                                .await
-                            {
-                                // The hosted edits are reverted but the ledger
-                                // still claims them; vendoring now would leave
-                                // a ledger asserting wiring that is gone. Fail
-                                // closed for this purl.
-                                has_errors = true;
-                                let detail = format!(
-                                    "reverted the hosted redirect but could not update \
-                                     .socket/vendor/redirect-state.json: {e}"
-                                );
-                                report_vendor_failure(common, candidate, &detail);
-                                env.record(
-                                    PatchEvent::new(PatchAction::Failed, candidate.clone())
-                                        .with_error("redirect_ledger_write_failed", detail),
-                                );
-                                continue;
-                            }
-                            let reverted_what = if candidate.starts_with("pkg:cargo/") {
-                                "the hosted edits (Cargo.toml registry pin, Cargo.lock \
-                                 source/checksum, registries block)"
-                            } else if candidate.starts_with("pkg:golang/") {
-                                "the hosted edits (go.mod replace, the socket module's go.sum \
-                                 lines, the pruned upstream go.sum lines)"
-                            } else {
-                                "the hosted lockfile edits back to their pre-redirect \
-                                 registry values"
-                            };
-                            if !targets.is_empty() {
-                                vlt_takeover_targets.insert(candidate.clone(), targets);
-                            }
-                            record_warning(
-                                env,
-                                candidate,
-                                &VendorWarning::new(
-                                    "vendor_takeover_reverted_redirect",
-                                    format!(
-                                        "{} was hosted-redirected; reverted {reverted_what} \
-                                         and dropped the redirect-ledger record before \
-                                         vendoring (mode takeover)",
-                                        normalize_purl(candidate)
-                                    ),
-                                ),
-                                common,
-                            );
-                        }
-                        Err(detail) => {
-                            has_errors = true;
-                            env.record(
-                                PatchEvent::new(PatchAction::Failed, candidate.clone()).with_error(
-                                    "redirect_revert_failed",
-                                    format!(
-                                        "cannot vendor over the live hosted redirect: \
-                                             {detail}"
-                                    ),
-                                ),
-                            );
-                            report_vendor_failure(
-                                common,
-                                candidate,
-                                &format!("cannot revert the hosted redirect: {detail}"),
-                            );
-                            continue;
-                        }
+                        continue;
+                    }
+                } else {
+                    if !targets.is_empty() {
+                        vlt_takeover_targets.insert(candidate.clone(), targets);
                     }
+                    record_warning(
+                        env,
+                        candidate,
+                        &VendorWarning::new(
+                            "vendor_takeover_reverted_redirect",
+                            format!(
+                                "{} was hosted; restored its upstream registry entry ({}) \
+                                 before vendoring (mode takeover)",
+                                normalize_purl(candidate),
+                                restore.reverted_files.join(", ")
+                            ),
+                        ),
+                        common,
+                    );
                 }
             }
 
@@ -3278,6 +3682,56 @@ async fn run_revert(args: &VendorArgs, env: &mut Envelope) -> i32 {
         }
     }
 
+    // `--revert` returns to UPSTREAM: a package vendored over hosted wiring
+    // before v5 recorded the hosted fragment as its pre-vendor original, so
+    // its revert just wired it back to the patch server. Restore those pins
+    // to their upstream registry entries too (a wet run only — a dry revert
+    // wrote nothing to inspect).
+    if !common.dry_run {
+        let reverted: HashSet<String> = env
+            .events
+            .iter()
+            .filter(|e| e.action == PatchAction::Removed)
+            .filter_map(|e| e.purl.as_deref().map(canonical_purl))
+            .collect();
+        let rehosted: Vec<HostedPin> =
+            HostedPin::all(&crate::commands::discover_wiring(common, &common.cwd).await)
+                .into_iter()
+                .filter(|pin| reverted.contains(&canonical_purl(&pin.purl)))
+                .collect();
+        if !rehosted.is_empty() {
+            let leg = crate::commands::rollback::run_hosted_leg(common, &rehosted).await;
+            for purl in &leg.reverted {
+                record_warning(
+                    env,
+                    purl,
+                    &VendorWarning::new(
+                        "vendor_revert_restored_upstream",
+                        format!(
+                            "{purl} was vendored over a hosted pin before v5, so its revert \
+                             re-wired it to the hosted patch server; restored its upstream \
+                             registry entry"
+                        ),
+                    ),
+                    common,
+                );
+            }
+            for (purl, why) in &leg.failed {
+                has_errors = true;
+                env.record(
+                    PatchEvent::new(PatchAction::Failed, purl.clone())
+                        .with_error("hosted_restore_failed", why.clone()),
+                );
+            }
+            for (code, detail) in &leg.warnings {
+                env.warnings.push(RunWarning {
+                    code: code.clone(),
+                    detail: detail.clone(),
+                });
+            }
+        }
+    }
+
     // Orphan sweep: uuid dirs on disk with no ledger entry (a hand-edited
     // state file, or artifacts left by an interrupted run). Unparseable dirs
     // are reported, never deleted — and neither are dirs a lockfile still
diff --git a/crates/socket-patch-cli/src/commands/vex.rs b/crates/socket-patch-cli/src/commands/vex.rs
index 4ece01fb..cae0946d 100644
--- a/crates/socket-patch-cli/src/commands/vex.rs
+++ b/crates/socket-patch-cli/src/commands/vex.rs
@@ -22,7 +22,7 @@ use std::path::{Path, PathBuf};
 use clap::Args;
 use socket_patch_core::crawlers::Ecosystem;
 use socket_patch_core::manifest::operations::read_manifest;
-use socket_patch_core::manifest::schema::PatchManifest;
+use socket_patch_core::manifest::schema::{PatchManifest, PatchRecord};
 use socket_patch_core::telemetry::{track_vex_failed, track_vex_generated};
 use socket_patch_core::vendor::state::VendorState;
 use socket_patch_core::vex::{
@@ -179,6 +179,7 @@ impl VexEmbedArgs {
             dry_run: false,
             product_flag: "--vex-product",
             npm_prior: None,
+            hosted_records: Default::default(),
         }
     }
 }
@@ -219,6 +220,12 @@ pub(crate) struct VexBuildParams {
     /// choice and order are unchanged. Ignored when taken with other crawler
     /// options. The standalone `vex` passes `None` and walks the tree.
     pub npm_prior: Option<crate::ecosystem_dispatch::NpmCrawlSnapshot>,
+    /// Embedded hosted `scan --vex` only: the patch records THIS RUN
+    /// fetched for the pins it confirmed, keyed by purl. v5 hosted mode
+    /// keeps no ledger, so these are the in-run attestation's hosted
+    /// records (the post-install standalone `vex` fetches them from the
+    /// API instead). Empty everywhere else.
+    pub hosted_records: std::collections::BTreeMap<String, PatchRecord>,
 }
 
 /// Successful result of [`generate_vex`].
@@ -337,6 +344,7 @@ pub async fn run(args: VexArgs) -> i32 {
         dry_run: args.common.dry_run,
         product_flag: "--product",
         npm_prior: None,
+        hosted_records: Default::default(),
     };
 
     let manifest_path = args.common.resolved_manifest_path();
@@ -1064,24 +1072,30 @@ async fn generate_vex_from_manifest_path_inner(
         }
     };
     let had_manifest_file = manifest_file.is_some();
-    // Both ledgers are attestation inputs (records, and the entries whose
-    // wiring liveness gates them), so a MALFORMED one is a hard error:
-    // attesting with its contents silently dropped would produce a false —
-    // or silently partial — document. A missing ledger is simply empty.
+    // The vendor ledger is an attestation input (records, and the entries
+    // whose wiring liveness gates them), so a MALFORMED one is a hard error
+    // (below). v5 hosted mode keeps no ledger: hosted references come from
+    // the lockfiles, their records from the API. A pre-v5 redirect ledger
+    // is read (never written) only as an extra local record source for the
+    // pins it still describes, so a malformed one is an advisory: its
+    // records are simply not consulted.
     let redirect = match socket_patch_core::patch::redirect::load_redirect_state(&common.cwd).await
     {
         Ok(state) => state,
         Err(corrupt) => {
-            // Not core's Display: that text ("... so it will not be
-            // overwritten") is written for the hosted `scan` writer, and
-            // `vex` only reads the ledger.
-            let message = format!(
-                "The redirect ledger {} is malformed ({}); cannot attest redirected patches. \
-                 Repair its JSON or restore it from version control, then re-run.",
-                corrupt.path.display(),
-                corrupt.detail
+            note_warning(
+                warnings,
+                common,
+                "redirect_ledger_corrupt",
+                format!(
+                    "the pre-v5 redirect ledger {} is malformed ({}); its records were not \
+                     consulted. socket-patch v5 no longer uses it: delete it, or restore it \
+                     from version control.",
+                    corrupt.path.display(),
+                    corrupt.detail
+                ),
             );
-            return Err(fail(common, "redirect_ledger_corrupt", message).await);
+            None
         }
     };
     let vendor = match socket_patch_core::vendor::load_state(&common.cwd).await {
@@ -1103,6 +1117,16 @@ async fn generate_vex_from_manifest_path_inner(
     for diag in &discovery.diagnostics {
         note_warning(warnings, common, diag.code, diag.detail.clone());
     }
+    // This run's hosted records (embedded hosted `scan --vex`) join a
+    // pre-v5 ledger's as the hosted record source, newest wins.
+    let redirect = if params.hosted_records.is_empty() {
+        redirect
+    } else {
+        let mut state =
+            redirect.unwrap_or_else(socket_patch_core::patch::redirect::RedirectState::new);
+        state.records.extend(params.hosted_records.clone());
+        Some(state)
+    };
     let sources = Sources {
         manifest: manifest_file.unwrap_or_else(PatchManifest::new),
         vendor,
@@ -1956,6 +1980,7 @@ mod npm_prior_tests {
             dry_run: false,
             product_flag: "--vex-product",
             npm_prior: prior,
+            hosted_records: Default::default(),
         };
         let manifest_path = common.resolved_manifest_path();
         match generate_vex_from_manifest_path(common, &params, &manifest_path).await {
diff --git a/crates/socket-patch-cli/src/hosted_memory/ledger.rs b/crates/socket-patch-cli/src/hosted_memory/ledger.rs
deleted file mode 100644
index 2961d107..00000000
--- a/crates/socket-patch-cli/src/hosted_memory/ledger.rs
+++ /dev/null
@@ -1,187 +0,0 @@
-//! The redirect ledger (`.socket/vendor/redirect-state.json`) in memory:
-//! loaded strictly (a malformed ledger is a project error, never a fresh
-//! start), merged exactly like the disk flow (edits appended unless already
-//! recorded, `REBASE_KINDS` rebased, records extended newest-wins), and
-//! serialized with the disk writer's bytes (`to_vec_pretty` + `\n`).
-
-use std::collections::BTreeMap;
-
-use socket_patch_core::manifest::schema::PatchRecord;
-use socket_patch_core::patch::redirect::{
-    CorruptRedirectState, FileEdit, RedirectState, REDIRECT_STATE_REL,
-};
-use socket_patch_core::vendor::lock_inventory::{MemoryEntry, MemoryProject};
-
-use crate::commands::scan::hosted::{rebase_vlt_edits, REBASE_KINDS};
-
-/// Load the project's ledger: `Ok(None)` when absent, `Err` (the disk
-/// message) when present but unreadable or malformed.
-pub(crate) fn load(project: &MemoryProject, root: &str) -> Result<Option<RedirectState>, String> {
-    let path = super::roots::join_root(root, REDIRECT_STATE_REL);
-    let corrupt = |detail: String, unreadable: bool| {
-        CorruptRedirectState {
-            path: path.clone().into(),
-            detail,
-            quarantined_to: None,
-            unreadable,
-        }
-        .to_string()
-    };
-    let bytes: &[u8] = match project.get(REDIRECT_STATE_REL) {
-        None => return Ok(None),
-        Some(MemoryEntry::Text(text)) => text.as_bytes(),
-        Some(MemoryEntry::Binary(bytes)) => bytes,
-        Some(MemoryEntry::Present) => {
-            return Err(corrupt("file content was not provided".into(), true))
-        }
-        Some(MemoryEntry::Symlink) => return Err(corrupt("is a symbolic link".into(), true)),
-    };
-    serde_json::from_slice(bytes)
-        .map(Some)
-        .map_err(|e| corrupt(format!("invalid JSON: {e}"), false))
-}
-
-/// Merge this run's `edits` and `records` into `ledger` (the disk flow's
-/// merge, verbatim). `files` are the pre-rewrite candidate contents the
-/// rebase drift check reads.
-pub(crate) fn merge(
-    ledger: &mut RedirectState,
-    edits: &[FileEdit],
-    records: BTreeMap<String, PatchRecord>,
-    files: &BTreeMap<String, String>,
-) {
-    ledger.mode = "hosted".to_string();
-    let vlt_merged = rebase_vlt_edits(
-        &mut ledger.edits,
-        edits,
-        files
-            .get(socket_patch_core::constants::npm_family::VLT_LOCK)
-            .map(String::as_str),
-    );
-    let mut rebased: Vec<usize> = Vec::new();
-    for edit in edits.iter().filter(|e| {
-        REBASE_KINDS.contains(&e.kind.as_str())
-            && e.kind != socket_patch_core::patch::redirect::vlt::KIND
-    }) {
-        let siblings: Vec<usize> = ledger
-            .edits
-            .iter()
-            .enumerate()
-            .filter(|(_, old)| {
-                old.path == edit.path && old.kind == edit.kind && old.key == edit.key
-            })
-            .map(|(i, _)| i)
-            .collect();
-        let before = files.get(&edit.path).map(String::as_str).unwrap_or("");
-        let drifted = !siblings.is_empty()
-            && siblings.iter().all(|&i| {
-                ledger.edits[i]
-                    .new
-                    .as_ref()
-                    .and_then(serde_json::Value::as_str)
-                    .is_none_or(|new| !before.contains(new))
-            });
-        if !drifted {
-            continue;
-        }
-        let nth = edits
-            .iter()
-            .filter(|e| e.path == edit.path && e.kind == edit.kind && e.key == edit.key)
-            .position(|e| std::ptr::eq(e, edit))
-            .unwrap_or(0);
-        if let Some(&target) = siblings.get(nth) {
-            if !rebased.contains(&target) {
-                if edit.kind == "redirect_pdm_lock_package" {
-                    ledger.edits[target].original = edit.original.clone();
-                }
-                ledger.edits[target].new = edit.new.clone();
-                ledger.edits[target].action = edit.action.clone();
-                rebased.push(target);
-            }
-        }
-    }
-    let recorded = ledger.edits.len();
-    for (i, edit) in edits.iter().enumerate() {
-        if vlt_merged[i] {
-            continue;
-        }
-        let is_rebased = REBASE_KINDS.contains(&edit.kind.as_str())
-            && rebased.iter().any(|&t| {
-                let old = &ledger.edits[t];
-                old.path == edit.path
-                    && old.kind == edit.kind
-                    && old.key == edit.key
-                    && old.new == edit.new
-            });
-        if !is_rebased && !ledger.edits[..recorded].contains(edit) {
-            ledger.edits.push(edit.clone());
-        }
-    }
-    ledger.records.extend(records);
-}
-
-/// The ledger's on-disk bytes.
-pub(crate) fn serialize(ledger: &RedirectState) -> Result<String, String> {
-    let mut bytes = serde_json::to_vec_pretty(ledger).map_err(|e| e.to_string())?;
-    bytes.push(b'\n');
-    String::from_utf8(bytes).map_err(|e| e.to_string())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn edit(kind: &str, new: &str) -> FileEdit {
-        FileEdit {
-            path: "poetry.lock".into(),
-            kind: kind.into(),
-            action: "replaced".into(),
-            key: Some("k".into()),
-            original: Some(serde_json::json!("orig")),
-            new: Some(serde_json::json!(new)),
-        }
-    }
-
-    #[test]
-    fn corrupt_and_absent_ledgers() {
-        let mut p = MemoryProject::new();
-        assert!(load(&p, "").unwrap().is_none());
-        p.insert_text(REDIRECT_STATE_REL, "{not json");
-        let err = load(&p, "sub").unwrap_err();
-        assert!(
-            err.contains("sub/.socket/vendor/redirect-state.json"),
-            "{err}"
-        );
-        assert!(err.contains("malformed"), "{err}");
-        p.insert_symlink(REDIRECT_STATE_REL);
-        assert!(load(&p, "").unwrap_err().contains("cannot be read"));
-    }
-
-    #[test]
-    fn merge_appends_new_edits_and_rebases_drifted_fragments() {
-        let mut ledger = RedirectState::new();
-        ledger.edits.push(edit("redirect_npm_lock_entry", "a"));
-        ledger
-            .edits
-            .push(edit("redirect_poetry_lock_package", "old-new"));
-        let files = BTreeMap::from([("poetry.lock".to_string(), "relocked".to_string())]);
-        merge(
-            &mut ledger,
-            &[
-                edit("redirect_npm_lock_entry", "a"),
-                edit("redirect_npm_lock_entry", "b"),
-                edit("redirect_poetry_lock_package", "fresh"),
-            ],
-            BTreeMap::new(),
-            &files,
-        );
-        let news: Vec<&str> = ledger
-            .edits
-            .iter()
-            .map(|e| e.new.as_ref().and_then(|v| v.as_str()).unwrap())
-            .collect();
-        assert_eq!(news, vec!["a", "fresh", "b"]);
-        let text = serialize(&ledger).unwrap();
-        assert!(text.ends_with("}\n"));
-    }
-}
diff --git a/crates/socket-patch-cli/src/hosted_memory/mod.rs b/crates/socket-patch-cli/src/hosted_memory/mod.rs
index b5f8b0f3..7d2e9e2c 100644
--- a/crates/socket-patch-cli/src/hosted_memory/mod.rs
+++ b/crates/socket-patch-cli/src/hosted_memory/mod.rs
@@ -2,7 +2,8 @@
 //! filesystem, no subprocesses, no environment reads, no telemetry. Every
 //! patch lookup goes through the caller's [`PatchApi`]; the caller hands
 //! in the repository's candidate files (chosen by [`select_paths`]) and
-//! gets back the changed files, ledger included.
+//! gets back the changed files (v5 hosted mode keeps no ledger: the
+//! rewritten lockfiles are the whole record).
 //!
 //! Per project root the result matches `scan --mode hosted --json` over a
 //! checkout holding the same files (the parity tests hold the two paths to
@@ -40,8 +41,6 @@ use std::time::Instant;
 use socket_patch_core::api::client::PatchApi;
 use socket_patch_core::api::types::{PatchResponse, PatchSearchResult};
 use socket_patch_core::crawlers::Ecosystem;
-use socket_patch_core::manifest::schema::PatchRecord;
-use socket_patch_core::patch::redirect::{RedirectState, REDIRECT_STATE_REL};
 use socket_patch_core::utils::cargo_workspace::member_manifests_in;
 use socket_patch_core::vendor::lock_inventory::{
     inventory_project_diagnosed_in, MemoryEntry, MemoryProject, ProjectView,
@@ -49,7 +48,6 @@ use socket_patch_core::vendor::lock_inventory::{
 use tokio_util::sync::CancellationToken;
 
 pub(crate) mod discover;
-pub(crate) mod ledger;
 pub mod limits;
 pub(crate) mod redirect;
 pub(crate) mod roots;
@@ -110,7 +108,6 @@ struct RootState {
     /// (oversize, LFS pointers, presence-only): the disk flow would read
     /// them, so a rewrite that depends on one is refused.
     unreadable: BTreeSet<String>,
-    ledger: Option<RedirectState>,
     purls: Vec<String>,
     summary: ProjectSummary,
     packages: Vec<socket_patch_core::api::types::BatchPackagePatches>,
@@ -405,7 +402,6 @@ async fn engine(
             root: root.clone(),
             project: Some(project),
             unreadable,
-            ledger: None,
             purls: Vec::new(),
             summary: ProjectSummary::default(),
             packages: Vec::new(),
@@ -423,13 +419,6 @@ async fn engine(
         let Some(project) = state.project.as_ref() else {
             continue;
         };
-        match ledger::load(project, &state.root) {
-            Ok(loaded) => state.ledger = loaded,
-            Err(message) => {
-                state.fail("corrupt_ledger", message);
-                continue;
-            }
-        }
         let (entries, unsupported) =
             inventory_project_diagnosed_in(&ProjectView::Memory(project)).await;
         for (code, detail) in crate::commands::scan::unsupported_layout_warnings(&unsupported) {
@@ -711,7 +700,7 @@ async fn engine(
     })
 }
 
-/// Records → ledger merge → the project's result and changed files.
+/// Records → the project's result and changed files.
 fn finish_root(
     state: &mut RootState,
     done: Rewritten,
@@ -731,22 +720,19 @@ fn finish_root(
         npm_warnings,
     } = done;
     let root = state.root.clone();
-    let mut record_map: BTreeMap<String, PatchRecord> = BTreeMap::new();
+    // No ledger keeps the records; the fetch mirrors the disk flow's, so a
+    // record the API cannot serve warns the same way.
     let mut record_warnings: Vec<serde_json::Value> = Vec::new();
     if !dry_run {
         for (purl, uuid) in &confirmed {
             match records.get(uuid) {
-                Some(Some(response)) => {
-                    let (rec_purl, record) =
-                        crate::commands::get::record_from_patch_response(response);
-                    record_map.insert(rec_purl, record);
-                }
+                Some(Some(_)) => {}
                 _ => record_warnings.push(serde_json::json!({
                     "code": "record_fetch_failed",
                     "detail": format!(
                         "{purl} redirected, but its patch record could not be fetched; \
-                         it will be missing from VEX until `socket-patch scan --mode \
-                         hosted` is re-run"
+                         this run's VEX attestation omits it (`socket-patch vex` \
+                         fetches it again once the API answers)"
                     ),
                 })),
             }
@@ -754,34 +740,6 @@ fn finish_root(
     }
 
     let mut project_changes: Vec<(String, String)> = Vec::new();
-    let mut ledger_error: Option<ProjectError> = None;
-    if !dry_run && (!rewrite.edits.is_empty() || !record_map.is_empty()) {
-        let mut ledger = state.ledger.take().unwrap_or_default();
-        ledger::merge(&mut ledger, &rewrite.edits, record_map, &planned.files);
-        match ledger::serialize(&ledger) {
-            Ok(text) => {
-                if planned.project.text(REDIRECT_STATE_REL) != Some(text.as_str()) {
-                    project_changes.push((REDIRECT_STATE_REL.to_string(), text));
-                }
-            }
-            Err(message) => {
-                ledger_error = Some(ProjectError {
-                    code: "ledger_serialize_failed".into(),
-                    message,
-                })
-            }
-        }
-    }
-    if let Some(error) = ledger_error {
-        return ProjectResult {
-            root,
-            redirect: serde_json::json!({ "mode": "hosted" }),
-            summary: state.summary.clone(),
-            redirected: Vec::new(),
-            skipped: planned.skipped,
-            error: Some(error),
-        };
-    }
     for (rel, content) in &rewrite.files {
         if planned.project.text(rel) != Some(content.as_str()) {
             project_changes.push((rel.clone(), content.clone()));
@@ -894,7 +852,6 @@ mod tests {
             root: root.to_string(),
             project: Some(project),
             unreadable: BTreeSet::new(),
-            ledger: None,
             purls: Vec::new(),
             summary: ProjectSummary::default(),
             packages: Vec::new(),
diff --git a/crates/socket-patch-cli/src/hosted_memory/select.rs b/crates/socket-patch-cli/src/hosted_memory/select.rs
index 67a4b4b7..b7d939af 100644
--- a/crates/socket-patch-cli/src/hosted_memory/select.rs
+++ b/crates/socket-patch-cli/src/hosted_memory/select.rs
@@ -2,7 +2,7 @@
 //! per root, the same root-relative candidate set the disk hosted flow
 //! reads (`REDIRECT_CANDIDATE_FILES`, Python lock / script pairs, Cargo
 //! member manifests, Rush locks, the install-policy configs, the
-//! Plug'n'Play markers and the two `.socket/vendor/` ledgers), plus one
+//! Plug'n'Play markers and the vendored ledger), plus one
 //! presence-only Maven / NuGet marker per ecosystem so a repo holding only
 //! those still gets its `ecosystem_unsupported_in_memory` warning.
 
@@ -12,7 +12,6 @@ use socket_patch_core::constants::npm_family::{
     BUN_LOCKB, PNP_MARKERS, RUSH_COMMON_LOCK_REL, RUSH_SUBSPACES_DIR,
 };
 use socket_patch_core::patch::redirect::npmrc::NPMRC_REL;
-use socket_patch_core::patch::redirect::REDIRECT_STATE_REL;
 use socket_patch_core::utils::python_lock::is_python_lock_name;
 
 use super::roots::{
@@ -37,12 +36,7 @@ pub(crate) const VENDOR_STATE_REL: &str = ".socket/vendor/state.json";
 pub(crate) const RUSH_REPO_STATE_REL: &str = "common/config/rush/repo-state.json";
 
 /// Root-relative text files read beyond `REDIRECT_CANDIDATE_FILES`.
-const EXTRA_TEXT_FILES: [&str; 4] = [
-    PNPM_WORKSPACE_REL,
-    NPMRC_REL,
-    VENDOR_STATE_REL,
-    REDIRECT_STATE_REL,
-];
+const EXTRA_TEXT_FILES: [&str; 3] = [PNPM_WORKSPACE_REL, NPMRC_REL, VENDOR_STATE_REL];
 
 /// The one directory name the disk Cargo member walk never enters (it
 /// follows `members`, `exclude`, path dependencies and `[patch]` paths
@@ -363,7 +357,6 @@ mod tests {
             s.fetch_text,
             vec![
                 ".npmrc",
-                ".socket/vendor/redirect-state.json",
                 "package-lock.json",
                 "tool.py",
                 "tool.py.lock",
@@ -465,12 +458,14 @@ mod tests {
     }
 
     #[test]
-    fn candidate_listing_is_sorted_and_names_the_ledgers() {
+    fn candidate_listing_is_sorted_and_names_the_vendored_ledger_only() {
         let listed = candidate_files();
         let mut sorted = listed.clone();
         sorted.sort();
         assert_eq!(listed, sorted);
-        assert!(listed
+        assert!(listed.iter().any(|f| f == ".socket/vendor/state.json"));
+        // v5 hosted mode keeps no ledger, so the pre-v5 one is never read.
+        assert!(!listed
             .iter()
             .any(|f| f == ".socket/vendor/redirect-state.json"));
         assert!(listed.iter().any(|f| f == "package-lock.json"));
diff --git a/crates/socket-patch-cli/tests/cli_parse_list.rs b/crates/socket-patch-cli/tests/cli_parse_list.rs
index 5e5dd991..a15c8724 100644
--- a/crates/socket-patch-cli/tests/cli_parse_list.rs
+++ b/crates/socket-patch-cli/tests/cli_parse_list.rs
@@ -954,19 +954,20 @@ fn silent_keeps_missing_manifest_error_on_stderr_via_binary() {
 }
 
 // ---------------------------------------------------------------------------
-// Hosted redirect-ledger records — `scan --mode hosted` records its patches
-// ONLY in `.socket/vendor/redirect-state.json` (it never writes
-// `.socket/manifest.json`), so `list` on a purely hosted-wired project used
-// to hard-fail `manifest_not_found` while patches were demonstrably live
-// (verified against production on bundler 1.17/2.7/4.0 — the gem live-matrix
-// D3 defect). `list` now folds the ledger's records in, labeled as hosted;
-// when both stores exist, both are shown.
+// Hosted lockfile pins — `scan --mode hosted` writes ONLY lockfile edits (v5
+// keeps no hosted ledger and never writes `.socket/manifest.json`), so the
+// lockfiles are the sole record of a hosted patch. `list` on a purely
+// hosted-wired project lists those pins (labeled hosted, naming the
+// lockfiles that wire them) and exits 0 instead of `manifest_not_found`;
+// when a manifest exists too, both are shown. A pre-v5
+// `.socket/vendor/redirect-state.json` is read only to DETAIL a pin with the
+// same purl + uuid — it never lists anything by itself.
 // ---------------------------------------------------------------------------
 
 const HOSTED_PURL: &str = "pkg:npm/hosted-pkg@2.0.0";
 const HOSTED_UUID: &str = "22222222-2222-4222-8222-222222222222";
 
-/// A patch record for the redirect ledger, distinguishable from the
+/// A patch record for the pre-v5 redirect ledger, distinguishable from the
 /// manifest fixture's record.
 fn hosted_record(uuid: &str) -> PatchRecord {
     let mut files = HashMap::new();
@@ -998,27 +999,75 @@ fn hosted_record(uuid: &str) -> PatchRecord {
     }
 }
 
-// The redirect-ledger writer lives in `tests/common/mod.rs`
+/// Write `<root>/package-lock.json` resolving every `(purl, uuid)` from its
+/// hosted Socket patch URL on `https://patch.socket.dev` — the shape `scan
+/// --mode hosted` leaves (the lock is the hosted state).
+fn write_hosted_lock(root: &Path, pins: &[(&str, &str)]) {
+    let mut packages = serde_json::Map::new();
+    packages.insert(
+        String::new(),
+        serde_json::json!({ "name": "app", "version": "1.0.0" }),
+    );
+    for (purl, uuid) in pins {
+        let (name, version) = purl
+            .strip_prefix("pkg:npm/")
+            .and_then(|nv| nv.rsplit_once('@'))
+            .expect("an unscoped npm purl");
+        packages.insert(
+            format!("node_modules/{name}"),
+            serde_json::json!({
+                "version": version,
+                "resolved": format!(
+                    "https://patch.socket.dev/patch/npm/{name}/{version}/\
+                     11111111-2222-4333-8444-555555555555/{uuid}/{name}-{version}.tgz"
+                ),
+                "integrity": "sha512-UEFUQ0hFRHBhdGNoZWRQQVRDSEVEcGF0Y2hlZA==",
+            }),
+        );
+    }
+    std::fs::write(
+        root.join("package-lock.json"),
+        serde_json::to_string_pretty(&serde_json::json!({
+            "name": "app",
+            "version": "1.0.0",
+            "lockfileVersion": 3,
+            "requires": true,
+            "packages": packages,
+        }))
+        .unwrap(),
+    )
+    .unwrap();
+}
+
+fn list_json(out: &std::process::Output) -> serde_json::Value {
+    serde_json::from_str(String::from_utf8_lossy(&out.stdout).trim()).unwrap_or_else(|e| {
+        panic!(
+            "stdout must be valid JSON ({e}); stdout={} stderr={}",
+            String::from_utf8_lossy(&out.stdout),
+            String::from_utf8_lossy(&out.stderr)
+        )
+    })
+}
+
+// The pre-v5 redirect-ledger writer lives in `tests/common/mod.rs`
 // (`common::write_redirect_ledger`) — shared with the other suites that
-// seed hosted state, so the fixture can never drift from the on-disk schema.
+// seed legacy hosted state, so the fixture can never drift from the schema.
 
 #[test]
-fn hosted_only_project_list_json_lists_ledger_records_via_binary() {
-    // No manifest at all — only the hosted redirect ledger. `list --json`
-    // must exit 0 with the hosted records as labeled discovered events, not
-    // `manifest_not_found`.
+fn hosted_only_project_list_json_lists_lockfile_pins_via_binary() {
+    // No manifest, no ledger — only a lockfile wiring a hosted patch.
+    // `list --json` must exit 0 with the pin as a labeled discovered event.
     let tmp = tempfile::tempdir().unwrap();
-    common::write_redirect_ledger(tmp.path(), &[(HOSTED_PURL, hosted_record(HOSTED_UUID))]);
+    write_hosted_lock(tmp.path(), &[(HOSTED_PURL, HOSTED_UUID)]);
 
     let out = run_list_binary(tmp.path(), &["--json"]);
     assert_eq!(
         out.status.code(),
         Some(0),
-        "hosted-only list --json must exit 0 (records found), stderr={}",
+        "hosted-only list --json must exit 0 (a pin was found), stderr={}",
         String::from_utf8_lossy(&out.stderr)
     );
-    let v: serde_json::Value = serde_json::from_str(String::from_utf8_lossy(&out.stdout).trim())
-        .expect("stdout must be valid JSON");
+    let v = list_json(&out);
     assert_eq!(v["command"], "list");
     assert_eq!(v["status"], "success", "envelope={v}");
     assert_eq!(v["summary"]["discovered"], 1, "envelope={v}");
@@ -1029,27 +1078,85 @@ fn hosted_only_project_list_json_lists_ledger_records_via_binary() {
     assert_eq!(event["action"], "discovered");
     assert_eq!(event["purl"], HOSTED_PURL);
     assert_eq!(event["uuid"], HOSTED_UUID);
-    // The hosted label: a consumer must be able to tell a redirect-ledger
-    // record from a manifest entry.
+    // The hosted label: a consumer must be able to tell a lockfile pin from
+    // a manifest entry, and see which files wire it.
     assert_eq!(event["details"]["mode"], "hosted", "envelope={v}");
     assert_eq!(
-        event["details"]["ledger"], ".socket/vendor/redirect-state.json",
+        event["details"]["lockfiles"],
+        serde_json::json!(["package-lock.json"]),
         "envelope={v}"
     );
-    // The rich metadata rides along exactly like a manifest entry's.
-    assert_eq!(event["details"]["tier"], "free");
+    assert!(
+        event["details"].get("ledger").is_none(),
+        "a hosted pin names no ledger: {v}"
+    );
+    // Without a pre-v5 record the details live on the API: uuid only.
+    assert_eq!(event["details"]["tier"], "", "envelope={v}");
+    assert_eq!(
+        event["details"]["vulnerabilities"],
+        serde_json::json!([]),
+        "envelope={v}"
+    );
+    assert!(
+        !tmp.path().join(".socket").exists(),
+        "list never writes hosted state"
+    );
+}
+
+#[test]
+fn legacy_ledger_details_the_matching_hosted_pin_via_binary() {
+    // A committed pre-v5 ledger recording the SAME purl + uuid as the pin
+    // supplies its details (tier, vulns, …); the entry is still labeled by
+    // its lockfiles, never by the ledger.
+    let tmp = tempfile::tempdir().unwrap();
+    write_hosted_lock(tmp.path(), &[(HOSTED_PURL, HOSTED_UUID)]);
+    common::write_redirect_ledger(tmp.path(), &[(HOSTED_PURL, hosted_record(HOSTED_UUID))]);
+    let ledger = tmp.path().join(".socket/vendor/redirect-state.json");
+    let ledger_before = std::fs::read(&ledger).unwrap();
+
+    let v = list_json(&run_list_binary(tmp.path(), &["--json"]));
+    assert_eq!(v["summary"]["discovered"], 1, "envelope={v}");
+    let event = &v["events"][0];
+    assert_eq!(event["uuid"], HOSTED_UUID, "envelope={v}");
+    assert_eq!(event["details"]["mode"], "hosted", "envelope={v}");
+    assert_eq!(
+        event["details"]["lockfiles"],
+        serde_json::json!(["package-lock.json"]),
+        "envelope={v}"
+    );
+    assert!(event["details"].get("ledger").is_none(), "envelope={v}");
+    assert_eq!(event["details"]["tier"], "free", "envelope={v}");
     assert_eq!(event["details"]["exportedAt"], "2024-02-02T00:00:00Z");
     let vulns = event["details"]["vulnerabilities"]
         .as_array()
         .expect("vulnerabilities array");
-    assert_eq!(vulns[0]["id"], "GHSA-host-host-host");
-    assert_eq!(vulns[0]["severity"], "critical");
+    assert_eq!(vulns[0]["id"], "GHSA-host-host-host", "envelope={v}");
+    assert_eq!(vulns[0]["severity"], "critical", "envelope={v}");
+    assert_eq!(
+        std::fs::read(&ledger).unwrap(),
+        ledger_before,
+        "list never rewrites the pre-v5 ledger"
+    );
+
+    // A ledger record for the same purl under ANOTHER uuid describes some
+    // other patch: the pin lists with its uuid only.
+    common::write_redirect_ledger(
+        tmp.path(),
+        &[(
+            HOSTED_PURL,
+            hosted_record("33333333-3333-4333-8333-333333333333"),
+        )],
+    );
+    let v = list_json(&run_list_binary(tmp.path(), &["--json"]));
+    assert_eq!(v["summary"]["discovered"], 1, "envelope={v}");
+    assert_eq!(v["events"][0]["uuid"], HOSTED_UUID, "envelope={v}");
+    assert_eq!(v["events"][0]["details"]["tier"], "", "envelope={v}");
 }
 
 #[test]
 fn hosted_only_project_list_plain_labels_hosted_via_binary() {
     let tmp = tempfile::tempdir().unwrap();
-    common::write_redirect_ledger(tmp.path(), &[(HOSTED_PURL, hosted_record(HOSTED_UUID))]);
+    write_hosted_lock(tmp.path(), &[(HOSTED_PURL, HOSTED_UUID)]);
 
     let out = run_list_binary(tmp.path(), &[]);
     let stdout = String::from_utf8_lossy(&out.stdout);
@@ -1061,7 +1168,7 @@ fn hosted_only_project_list_plain_labels_hosted_via_binary() {
     );
     assert!(
         stdout.contains("Found 1 patch:"),
-        "count header must include the hosted record: {stdout}"
+        "count header must include the hosted pin: {stdout}"
     );
     assert!(
         stdout.contains(&format!("Package: {HOSTED_PURL}")),
@@ -1071,32 +1178,32 @@ fn hosted_only_project_list_plain_labels_hosted_via_binary() {
         stdout.contains(&format!("UUID: {HOSTED_UUID}")),
         "missing hosted uuid: {stdout}"
     );
-    // The human line must label the record as hosted and name the ledger.
+    // The human line labels the pin as hosted and names the lockfile.
     assert!(
-        stdout.contains("Mode: hosted"),
-        "hosted record must be labeled: {stdout}"
+        stdout.contains("Mode: hosted (wired in package-lock.json)"),
+        "hosted pin must be labeled with its lockfile: {stdout}"
     );
     assert!(
-        stdout.contains(".socket/vendor/redirect-state.json"),
-        "the label must name the ledger the record came from: {stdout}"
+        !stdout.contains("redirect-state.json"),
+        "v5 hosted state is never attributed to a ledger: {stdout}"
     );
 }
 
 #[test]
-fn manifest_and_hosted_ledger_coexist_via_binary() {
-    // Manifest entry + hosted records, including one purl present in BOTH
+fn manifest_and_hosted_pins_coexist_via_binary() {
+    // Manifest entry + hosted pins, including one purl present in BOTH
     // stores: both are shown (labeled apart), globally purl-sorted with the
     // manifest entry first on a tie.
     let tmp = tempfile::tempdir().unwrap();
     write_manifest_in(tmp.path(), &populated_manifest());
-    common::write_redirect_ledger(
+    write_hosted_lock(
         tmp.path(),
         &[
-            (HOSTED_PURL, hosted_record(HOSTED_UUID)),
+            (HOSTED_PURL, HOSTED_UUID),
             // Same purl as the manifest fixture, different uuid.
             (
                 "pkg:npm/test-pkg@1.0.0",
-                hosted_record("33333333-3333-4333-8333-333333333333"),
+                "33333333-3333-4333-8333-333333333333",
             ),
         ],
     );
@@ -1108,8 +1215,7 @@ fn manifest_and_hosted_ledger_coexist_via_binary() {
         "list over both stores must exit 0, stderr={}",
         String::from_utf8_lossy(&out.stderr)
     );
-    let v: serde_json::Value = serde_json::from_str(String::from_utf8_lossy(&out.stdout).trim())
-        .expect("stdout must be valid JSON");
+    let v = list_json(&out);
     assert_eq!(v["summary"]["discovered"], 3, "envelope={v}");
     let events = v["events"].as_array().expect("events array");
     let listed: Vec<(&str, &str, bool)> = events
@@ -1137,16 +1243,43 @@ fn manifest_and_hosted_ledger_coexist_via_binary() {
                 true
             ),
         ],
-        "both stores' records must be listed, purl-sorted, manifest entry \
-         before the hosted record on a purl tie; envelope={v}"
+        "both stores' entries must be listed, purl-sorted, manifest entry \
+         before the hosted pin on a purl tie; envelope={v}"
     );
 }
 
+#[test]
+fn legacy_ledger_record_without_a_pin_is_not_listed_via_binary() {
+    // A pre-v5 ledger whose record no lockfile wires any more (the lock was
+    // re-resolved to the registry) asserts no live patch: with no manifest
+    // and no pin, `list` stays on the manifest_not_found path, and a
+    // manifest-backed listing does not pick the stale record up either.
+    let tmp = tempfile::tempdir().unwrap();
+    common::write_redirect_ledger(tmp.path(), &[(HOSTED_PURL, hosted_record(HOSTED_UUID))]);
+
+    let out = run_list_binary(tmp.path(), &["--json"]);
+    let v = list_json(&out);
+    assert_eq!(out.status.code(), Some(1), "no pin anywhere: {v}");
+    assert_eq!(v["error"]["code"], "manifest_not_found", "envelope={v}");
+
+    write_manifest_in(tmp.path(), &populated_manifest());
+    let out = run_list_binary(tmp.path(), &["--json"]);
+    let v = list_json(&out);
+    assert_eq!(out.status.code(), Some(0), "envelope={v}");
+    let purls: Vec<&str> = v["events"]
+        .as_array()
+        .expect("events array")
+        .iter()
+        .map(|e| e["purl"].as_str().expect("purl"))
+        .collect();
+    assert_eq!(purls, vec!["pkg:npm/test-pkg@1.0.0"], "envelope={v}");
+}
+
 #[test]
 fn edits_only_ledger_without_manifest_still_manifest_not_found_via_binary() {
-    // A ledger with recorded edits but NO records (the post-takeover /
-    // degraded shape) asserts no patches, so a manifest-less project stays
-    // on the manifest_not_found path.
+    // A pre-v5 ledger with recorded edits but NO records asserts no
+    // patches, so a manifest-less project stays on the manifest_not_found
+    // path.
     let tmp = tempfile::tempdir().unwrap();
     let vendor_dir = tmp.path().join(".socket/vendor");
     std::fs::create_dir_all(&vendor_dir).unwrap();
@@ -1168,8 +1301,7 @@ fn edits_only_ledger_without_manifest_still_manifest_not_found_via_binary() {
     .unwrap();
 
     let out = run_list_binary(tmp.path(), &["--json"]);
-    let v: serde_json::Value = serde_json::from_str(String::from_utf8_lossy(&out.stdout).trim())
-        .expect("stdout must be valid JSON");
+    let v = list_json(&out);
     assert_eq!(
         out.status.code(),
         Some(1),
@@ -1180,7 +1312,7 @@ fn edits_only_ledger_without_manifest_still_manifest_not_found_via_binary() {
 
 #[test]
 fn missing_manifest_with_corrupt_ledger_keeps_warning_in_error_envelope_via_binary() {
-    // No manifest and a corrupt ledger: the run takes the
+    // No manifest and a corrupt pre-v5 ledger: the run takes the
     // manifest_not_found exit, but the ledger corruption must still reach
     // a JSON consumer via the error envelope's `warnings[]` (stderr is not
     // the machine channel), and nothing may leak onto stderr.
@@ -1190,8 +1322,7 @@ fn missing_manifest_with_corrupt_ledger_keeps_warning_in_error_envelope_via_bina
     std::fs::write(vendor_dir.join("redirect-state.json"), "{ not json").unwrap();
 
     let out = run_list_binary(tmp.path(), &["--json"]);
-    let v: serde_json::Value = serde_json::from_str(String::from_utf8_lossy(&out.stdout).trim())
-        .expect("stdout must be valid JSON");
+    let v = list_json(&out);
     assert_eq!(out.status.code(), Some(1));
     assert_eq!(v["error"]["code"], "manifest_not_found", "envelope={v}");
     let warnings = v["warnings"].as_array().expect("warnings[] present");
@@ -1212,18 +1343,46 @@ fn missing_manifest_with_corrupt_ledger_keeps_warning_in_error_envelope_via_bina
 }
 
 #[test]
-fn corrupt_manifest_with_hosted_ledger_still_manifest_invalid_via_binary() {
-    // A corrupt manifest is an error state; hosted records must never mask
-    // it as a healthy hosted-only listing.
+fn corrupt_ledger_is_a_warning_and_hosted_pins_still_list_via_binary() {
+    // A malformed pre-v5 ledger only loses its details: the lockfile pin
+    // still lists (uuid only), the warning rides `warnings[]`, the ledger is
+    // left byte-identical.
+    let tmp = tempfile::tempdir().unwrap();
+    write_hosted_lock(tmp.path(), &[(HOSTED_PURL, HOSTED_UUID)]);
+    let vendor_dir = tmp.path().join(".socket/vendor");
+    std::fs::create_dir_all(&vendor_dir).unwrap();
+    std::fs::write(vendor_dir.join("redirect-state.json"), "{ not json").unwrap();
+
+    let out = run_list_binary(tmp.path(), &["--json"]);
+    let v = list_json(&out);
+    assert_eq!(out.status.code(), Some(0), "envelope={v}");
+    assert_eq!(v["summary"]["discovered"], 1, "envelope={v}");
+    assert_eq!(v["events"][0]["uuid"], HOSTED_UUID, "envelope={v}");
+    assert_eq!(v["events"][0]["details"]["mode"], "hosted", "envelope={v}");
+    assert!(
+        v["warnings"]
+            .as_array()
+            .is_some_and(|w| w.iter().any(|w| w["code"] == "redirect_ledger_corrupt")),
+        "envelope={v}"
+    );
+    assert_eq!(
+        std::fs::read_to_string(vendor_dir.join("redirect-state.json")).unwrap(),
+        "{ not json"
+    );
+}
+
+#[test]
+fn corrupt_manifest_with_hosted_pin_still_manifest_invalid_via_binary() {
+    // A corrupt manifest is an error state; hosted pins must never mask it
+    // as a healthy hosted-only listing.
     let tmp = tempfile::tempdir().unwrap();
     let socket_dir = tmp.path().join(".socket");
     std::fs::create_dir_all(&socket_dir).unwrap();
     std::fs::write(socket_dir.join("manifest.json"), "{not json").unwrap();
-    common::write_redirect_ledger(tmp.path(), &[(HOSTED_PURL, hosted_record(HOSTED_UUID))]);
+    write_hosted_lock(tmp.path(), &[(HOSTED_PURL, HOSTED_UUID)]);
 
     let out = run_list_binary(tmp.path(), &["--json"]);
-    let v: serde_json::Value = serde_json::from_str(String::from_utf8_lossy(&out.stdout).trim())
-        .expect("stdout must be valid JSON");
+    let v = list_json(&out);
     assert_eq!(out.status.code(), Some(1), "corrupt manifest must exit 1");
     assert_eq!(v["error"]["code"], "manifest_invalid", "envelope={v}");
 }
@@ -1231,29 +1390,36 @@ fn corrupt_manifest_with_hosted_ledger_still_manifest_invalid_via_binary() {
 #[test]
 fn silent_suppresses_hosted_listing_via_binary() {
     // `--silent` is "errors only": the hosted listing is muted like the
-    // manifest one, while the exit code still says records were found.
+    // manifest one, while the exit code still says entries were found.
     let tmp = tempfile::tempdir().unwrap();
-    common::write_redirect_ledger(tmp.path(), &[(HOSTED_PURL, hosted_record(HOSTED_UUID))]);
+    write_hosted_lock(tmp.path(), &[(HOSTED_PURL, HOSTED_UUID)]);
 
     let out = run_list_binary_scrubbed(tmp.path(), &["--silent"]);
     assert_eq!(
         out.status.code(),
         Some(0),
-        "hosted-only --silent must exit 0"
+        "hosted-only --silent must exit 0, stderr={}",
+        String::from_utf8_lossy(&out.stderr)
     );
     let stdout = String::from_utf8_lossy(&out.stdout);
     assert!(
         stdout.trim().is_empty(),
         "--silent must suppress the hosted listing; got {stdout:?}"
     );
+    // Control: the same project without --silent prints the pin.
+    let loud = run_list_binary_scrubbed(tmp.path(), &[]);
+    assert!(
+        String::from_utf8_lossy(&loud.stdout).contains(&format!("Package: {HOSTED_PURL}")),
+        "non-silent run must print the listing"
+    );
 }
 
 #[test]
 fn silent_gates_the_malformed_ledger_warning_via_binary() {
-    // A malformed ledger degrades to "nothing to consult" with a stderr
-    // warning — and that warning is advisory, so `--silent` ("errors only")
-    // must mute it like every sibling warning. The listing itself proceeds
-    // from the manifest either way.
+    // A malformed pre-v5 ledger degrades to "nothing to consult" with a
+    // stderr warning — and that warning is advisory, so `--silent` ("errors
+    // only") must mute it like every sibling warning. The listing itself
+    // proceeds from the manifest either way.
     let tmp = tempfile::tempdir().unwrap();
     write_manifest_in(tmp.path(), &populated_manifest());
     let vendor_dir = tmp.path().join(".socket/vendor");
@@ -1281,27 +1447,24 @@ fn silent_gates_the_malformed_ledger_warning_via_binary() {
 }
 
 // ---------------------------------------------------------------------------
-// `--manifest-path` store scoping — both stores must come from the SAME
-// project. Resolving the redirect ledger against cwd instead would
-// interleave two projects' patch state when `--manifest-path` points at
-// another project's manifest (and a LOCAL ledger could suppress the flagged
-// project's manifest_not_found).
+// `--manifest-path` store scoping — every store must come from the SAME
+// project. Discovering hosted pins against cwd instead would interleave two
+// projects' patch state when `--manifest-path` points at another project's
+// manifest (and a LOCAL lockfile could suppress the flagged project's
+// manifest_not_found).
 // ---------------------------------------------------------------------------
 
 #[test]
-fn manifest_path_scopes_ledger_to_target_project_via_binary() {
-    // cwd has its own (decoy) ledger; --manifest-path points at another
-    // project that has BOTH a manifest and its own ledger. Only the target
-    // project's stores may be listed.
+fn manifest_path_scopes_hosted_pins_to_target_project_via_binary() {
+    // cwd has its own (decoy) hosted lockfile; --manifest-path points at
+    // another project that has BOTH a manifest and its own hosted lockfile.
+    // Only the target project's stores may be listed.
     let cwd = tempfile::tempdir().unwrap();
-    common::write_redirect_ledger(
-        cwd.path(),
-        &[("pkg:npm/local-decoy@0.0.1", hosted_record(HOSTED_UUID))],
-    );
+    write_hosted_lock(cwd.path(), &[("pkg:npm/local-decoy@0.0.1", HOSTED_UUID)]);
 
     let target = tempfile::tempdir().unwrap();
     write_manifest_in(target.path(), &populated_manifest());
-    common::write_redirect_ledger(target.path(), &[(HOSTED_PURL, hosted_record(HOSTED_UUID))]);
+    write_hosted_lock(target.path(), &[(HOSTED_PURL, HOSTED_UUID)]);
 
     let manifest_path = target.path().join(".socket/manifest.json");
     let out = run_list_binary(
@@ -1314,8 +1477,7 @@ fn manifest_path_scopes_ledger_to_target_project_via_binary() {
         "stderr={}",
         String::from_utf8_lossy(&out.stderr)
     );
-    let v: serde_json::Value = serde_json::from_str(String::from_utf8_lossy(&out.stdout).trim())
-        .expect("stdout must be valid JSON");
+    let v = list_json(&out);
     let purls: Vec<&str> = v["events"]
         .as_array()
         .expect("events array")
@@ -1325,17 +1487,17 @@ fn manifest_path_scopes_ledger_to_target_project_via_binary() {
     assert_eq!(
         purls,
         vec![HOSTED_PURL, "pkg:npm/test-pkg@1.0.0"],
-        "only the target project's manifest + ledger may be listed — never \
-         the cwd's local ledger; envelope={v}"
+        "only the target project's manifest + hosted pins may be listed — \
+         never the cwd's local lockfile; envelope={v}"
     );
 }
 
 #[test]
-fn local_ledger_never_suppresses_flagged_manifest_not_found_via_binary() {
-    // --manifest-path points at a project with NO manifest and NO ledger;
-    // the cwd's local ledger records must not turn that into a success.
+fn local_hosted_pins_never_suppress_flagged_manifest_not_found_via_binary() {
+    // --manifest-path points at a project with NO manifest and NO pins;
+    // the cwd's local hosted lockfile must not turn that into a success.
     let cwd = tempfile::tempdir().unwrap();
-    common::write_redirect_ledger(cwd.path(), &[(HOSTED_PURL, hosted_record(HOSTED_UUID))]);
+    write_hosted_lock(cwd.path(), &[(HOSTED_PURL, HOSTED_UUID)]);
     let target = tempfile::tempdir().unwrap();
 
     let manifest_path = target.path().join(".socket/manifest.json");
@@ -1343,8 +1505,7 @@ fn local_ledger_never_suppresses_flagged_manifest_not_found_via_binary() {
         cwd.path(),
         &["--json", "--manifest-path", manifest_path.to_str().unwrap()],
     );
-    let v: serde_json::Value = serde_json::from_str(String::from_utf8_lossy(&out.stdout).trim())
-        .expect("stdout must be valid JSON");
+    let v = list_json(&out);
     assert_eq!(
         out.status.code(),
         Some(1),
@@ -1460,15 +1621,13 @@ fn vendored_only_project_list_plain_labels_vendored_via_binary() {
 }
 
 #[test]
-fn manifest_hosted_and_vendored_ledgers_coexist_via_binary() {
-    // One purl in all three stores: every copy listed, purl-sorted, manifest
-    // then hosted then vendored on the tie.
+fn manifest_hosted_pins_and_vendored_ledger_coexist_via_binary() {
+    // One purl in all three stores (manifest, a hosted lockfile pin, the
+    // vendor ledger): every copy listed, purl-sorted, manifest then hosted
+    // then vendored on the tie.
     let tmp = tempfile::tempdir().unwrap();
     write_manifest_in(tmp.path(), &populated_manifest());
-    common::write_redirect_ledger(
-        tmp.path(),
-        &[("pkg:npm/test-pkg@1.0.0", hosted_record(HOSTED_UUID))],
-    );
+    write_hosted_lock(tmp.path(), &[("pkg:npm/test-pkg@1.0.0", HOSTED_UUID)]);
     write_vendor_ledger(
         tmp.path(),
         &[
@@ -1515,7 +1674,7 @@ fn manifest_hosted_and_vendored_ledgers_coexist_via_binary() {
 fn record_less_vendor_entry_without_manifest_still_manifest_not_found_via_binary() {
     // A legacy manifest-tracked entry asserts no patch of its own: with no
     // manifest and no other store, `list` stays on the manifest_not_found
-    // path (mirrors the edits-only redirect ledger).
+    // path (mirrors the edits-only pre-v5 redirect ledger).
     let tmp = tempfile::tempdir().unwrap();
     write_vendor_ledger(tmp.path(), &[(VENDORED_PURL, None)]);
 
@@ -1532,7 +1691,7 @@ fn record_less_vendor_entry_without_manifest_still_manifest_not_found_via_binary
 
 #[test]
 fn silent_gates_the_malformed_vendor_ledger_warning_via_binary() {
-    // Same posture as the redirect ledger: a corrupt vendor ledger degrades
+    // Same posture as the pre-v5 redirect ledger: a corrupt vendor ledger degrades
     // to "nothing to consult" with an advisory stderr warning that --silent
     // ("errors only") mutes; the manifest still lists, exit 0.
     let tmp = tempfile::tempdir().unwrap();
@@ -1562,7 +1721,7 @@ fn silent_gates_the_malformed_vendor_ledger_warning_via_binary() {
 #[test]
 fn manifest_path_scopes_vendor_ledger_to_target_project_via_binary() {
     // The vendor ledger resolves at the SAME project root as the manifest
-    // and the redirect ledger — never the cwd's.
+    // and the hosted pins — never the cwd's.
     let cwd = tempfile::tempdir().unwrap();
     write_vendor_ledger(
         cwd.path(),
@@ -1601,7 +1760,7 @@ fn manifest_path_scopes_vendor_ledger_to_target_project_via_binary() {
 
 // ---------------------------------------------------------------------------
 // Telemetry — `patch_listed`'s `patches_count` predates the hosted folding
-// and dashboards consume it as "manifest patches". Folding hosted records
+// and dashboards consume it as "manifest patches". Folding hosted pins
 // into the SAME field would silently redefine the metric (and double-count
 // purls present in both stores), so the count stays manifest-only.
 // ---------------------------------------------------------------------------
@@ -1618,17 +1777,17 @@ async fn list_telemetry_counts_manifest_patches_only_via_binary() {
         .mount(&server)
         .await;
 
-    // 1 manifest patch + 2 hosted records (one sharing the manifest purl):
+    // 1 manifest patch + 2 hosted pins (one sharing the manifest purl):
     // the listing shows 3 entries, the metric must still say 1.
     let tmp = tempfile::tempdir().unwrap();
     write_manifest_in(tmp.path(), &populated_manifest());
-    common::write_redirect_ledger(
+    write_hosted_lock(
         tmp.path(),
         &[
-            (HOSTED_PURL, hosted_record(HOSTED_UUID)),
+            (HOSTED_PURL, HOSTED_UUID),
             (
                 "pkg:npm/test-pkg@1.0.0",
-                hosted_record("33333333-3333-4333-8333-333333333333"),
+                "33333333-3333-4333-8333-333333333333",
             ),
         ],
     );
diff --git a/crates/socket-patch-cli/tests/common/yarn_classic_vex.rs b/crates/socket-patch-cli/tests/common/yarn_classic_vex.rs
index fd2313eb..dd1f6e32 100644
--- a/crates/socket-patch-cli/tests/common/yarn_classic_vex.rs
+++ b/crates/socket-patch-cli/tests/common/yarn_classic_vex.rs
@@ -161,7 +161,9 @@ impl Wiring {
         }
     }
 
-    /// The omission code once the ledger outlives a reverted lock.
+    /// The omission code once the (vendor) ledger outlives a reverted lock.
+    /// Hosted never reaches it: v5 writes no redirect ledger, so a reverted
+    /// hosted lock names the patch nowhere.
     fn unwired(self) -> &'static str {
         match self {
             Wiring::Hosted => "redirect_unwired",
@@ -345,6 +347,10 @@ impl<'a> ManifestlessVex<'a> {
             socket_patch_core::patch::redirect::REDIRECT_STATE_REL,
         ]
         .map(|rel| (rel, std::fs::read(project.join(rel)).ok()));
+        assert!(
+            ledgers[1].1.is_none(),
+            "{leg}: v5 hosted mode writes no redirect ledger"
+        );
         strip_ledgers(project);
         let before = self.api.view_requests(self.uuid);
         let out = run_vex(&binary(), project, &self.online());
diff --git a/crates/socket-patch-cli/tests/coverage_fix_rollback_ecosystem_scoped_hosted.rs b/crates/socket-patch-cli/tests/coverage_fix_rollback_ecosystem_scoped_hosted.rs
new file mode 100644
index 00000000..e0b8d253
--- /dev/null
+++ b/crates/socket-patch-cli/tests/coverage_fix_rollback_ecosystem_scoped_hosted.rs
@@ -0,0 +1,146 @@
+//! Regression suite for `--ecosystems`-scoped rollback over hosted state.
+//!
+//! Formerly this pinned a replay leak: against a records-EMPTY degraded
+//! redirect ledger, `rollback --ecosystems npm` replayed (and dropped)
+//! leftover hosted edits of OTHER ecosystems. v5 keeps no hosted ledger:
+//! the hosted pins are discovered from the lockfiles and each in-scope pin
+//! is restored to its upstream registry entry on its own, so the invariant
+//! becomes: an `--ecosystems`-narrowed run never restores a pin of another
+//! ecosystem, and never retires a pre-v5 ledger while any hosted pin (in
+//! scope or not) is still wired. The ledger's recorded edits are never
+//! replayed at all.
+//!
+//! The fixture is a requirements.txt hosted-wired to the mock patch host
+//! (recognized through `patch_server_url`) beside a pre-v5 ledger written
+//! through the exported `socket_patch_core::patch::redirect` types. The
+//! file is unhashed apart from the hosted line, so the pypi restore needs
+//! no registry lookup and the runs stay offline.
+//!
+//! `#[serial]`: every command's `run` mirrors env toggles into
+//! process-global env vars (`apply_env_toggles`).
+
+use std::path::Path;
+
+use serde_json::Value;
+use serial_test::serial;
+use socket_patch_cli::commands::rollback::{run as rollback_run, RollbackArgs};
+use socket_patch_core::patch::redirect::{save_redirect_state, FileEdit, RedirectState};
+
+const PRISTINE_LINE: &str = "requests==2.31.0";
+const WIRED_LINE: &str = "requests @ http://patch.test/patch/pypi/requests/2.31.0/22222222-2222-4222-8222-222222222222/a1a1a1a1-a1a1-4a1a-8a1a-a1a1a1a1a1a1/requests-2.31.0-py3-none-any.whl --hash=sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
+
+fn requirements_content(line: &str) -> String {
+    format!("flask==2.0.1\n{line}\n")
+}
+
+/// The requirements-line edit a pre-v5 hosted run recorded. Its recorded
+/// original is deliberately NOT what the restore derives (`==2.30.0`): a
+/// replay would write it, the restore must not.
+fn legacy_requirements_edit() -> FileEdit {
+    FileEdit {
+        path: "requirements.txt".to_string(),
+        kind: "redirect_requirements_line".to_string(),
+        action: "rewritten".to_string(),
+        key: Some("requests".to_string()),
+        original: Some(Value::String("requests==2.30.0".to_string())),
+        new: Some(Value::String(WIRED_LINE.to_string())),
+    }
+}
+
+fn ledger_path(root: &Path) -> std::path::PathBuf {
+    root.join(".socket/vendor/redirect-state.json")
+}
+
+/// requirements.txt still hosted-wired + a pre-v5 records-empty ledger
+/// holding the recorded edit. No manifest, no vendor ledger — the hosted
+/// pin alone keeps the run off the truly-empty error path.
+async fn write_hosted_pypi_fixture(root: &Path) {
+    std::fs::write(
+        root.join("requirements.txt"),
+        requirements_content(WIRED_LINE),
+    )
+    .unwrap();
+    let mut state = RedirectState::new();
+    state.edits = vec![legacy_requirements_edit()];
+    save_redirect_state(root, &state)
+        .await
+        .expect("write redirect ledger");
+}
+
+/// In-process wet rollback (`--json --yes --offline --silent`, the mock
+/// patch host recognized as hosted), optionally `--ecosystems`-narrowed.
+async fn rollback_in_process(cwd: &Path, ecosystems: Option<Vec<String>>) -> i32 {
+    let args = RollbackArgs {
+        targets: Vec::new(),
+        common: socket_patch_cli::args::GlobalArgs {
+            cwd: cwd.to_path_buf(),
+            manifest_path: ".socket/manifest.json".to_string(),
+            ecosystems,
+            offline: true,
+            json: true,
+            yes: true,
+            silent: true,
+            patch_server_url: Some("http://patch.test".to_string()),
+            ..socket_patch_cli::args::GlobalArgs::default()
+        },
+        one_off: false,
+        preserve_state: false,
+    };
+    let code = rollback_run(args).await;
+    // `apply_env_toggles` mirrored `--offline` into the PROCESS env and
+    // nothing unsets it; scrub so the next in-process run in this
+    // `#[serial]` process isn't silently forced offline.
+    std::env::remove_var("SOCKET_OFFLINE");
+    code
+}
+
+/// `rollback --ecosystems npm` over a project whose only hosted pin is a
+/// PYPI one must restore nothing: the pypi pin stays wired and the pre-v5
+/// ledger stays (a pin is still wired), byte-identical.
+#[tokio::test]
+#[serial]
+async fn ecosystems_scoped_rollback_leaves_other_ecosystems_pins() {
+    let tmp = tempfile::tempdir().unwrap();
+    write_hosted_pypi_fixture(tmp.path()).await;
+    let ledger_before = std::fs::read(ledger_path(tmp.path())).unwrap();
+
+    let code = rollback_in_process(tmp.path(), Some(vec!["npm".to_string()])).await;
+    assert_eq!(code, 0, "an npm-scoped run with no npm state is a no-op");
+
+    assert_eq!(
+        std::fs::read_to_string(tmp.path().join("requirements.txt")).unwrap(),
+        requirements_content(WIRED_LINE),
+        "an --ecosystems npm rollback must not restore the pypi pin"
+    );
+    assert_eq!(
+        std::fs::read(ledger_path(tmp.path())).unwrap(),
+        ledger_before,
+        "the pre-v5 ledger is kept while a hosted pin is still wired"
+    );
+}
+
+/// Control: a pypi-scoped (and an unscoped) rollback restores the pin to
+/// the upstream `name==version` line — derived, not replayed from the
+/// ledger's recorded original — and then retires the pre-v5 ledger,
+/// leaving no `.socket/` files behind.
+#[tokio::test]
+#[serial]
+async fn in_scope_rollback_restores_the_pin_and_retires_the_ledger() {
+    for ecosystems in [Some(vec!["pypi".to_string()]), None] {
+        let tmp = tempfile::tempdir().unwrap();
+        write_hosted_pypi_fixture(tmp.path()).await;
+
+        let code = rollback_in_process(tmp.path(), ecosystems.clone()).await;
+        assert_eq!(code, 0, "{ecosystems:?}: the pypi restore must succeed");
+
+        assert_eq!(
+            std::fs::read_to_string(tmp.path().join("requirements.txt")).unwrap(),
+            requirements_content(PRISTINE_LINE),
+            "{ecosystems:?}: the pin must come back as the upstream requirement"
+        );
+        assert!(
+            !ledger_path(tmp.path()).exists(),
+            "{ecosystems:?}: with no hosted pin left the pre-v5 ledger is retired"
+        );
+    }
+}
diff --git a/crates/socket-patch-cli/tests/coverage_fix_rollback_ecosystem_scoped_replay.rs b/crates/socket-patch-cli/tests/coverage_fix_rollback_ecosystem_scoped_replay.rs
deleted file mode 100644
index 0f568394..00000000
--- a/crates/socket-patch-cli/tests/coverage_fix_rollback_ecosystem_scoped_replay.rs
+++ /dev/null
@@ -1,143 +0,0 @@
-//! Regression suite for the `--ecosystems`-scoped rollback replay leak:
-//! against a records-EMPTY degraded redirect ledger (a record-fetch-failed
-//! hosted run persists its edits with no records), `replay_eligible` was
-//! vacuously true for a scope spelled ONLY with `--ecosystems` — the flag
-//! never fed the `scoped` flip — so `rollback --ecosystems npm` replayed,
-//! and dropped from the ledger, leftover hosted edits of OTHER ecosystems
-//! it was never asked about.
-//!
-//! The fixture hand-writes the ledger through the exported
-//! `socket_patch_core::patch::redirect` types (real schema, real edit
-//! kind) with the matching redirected fragment on disk — the
-//! `in_process_rollback_hosted.rs` pattern.
-//!
-//! `#[serial]`: every command's `run` mirrors env toggles into
-//! process-global env vars (`apply_env_toggles`).
-
-use std::path::Path;
-
-use serde_json::Value;
-use serial_test::serial;
-use socket_patch_cli::commands::rollback::{run as rollback_run, RollbackArgs};
-use socket_patch_core::patch::redirect::{save_redirect_state, FileEdit, RedirectState};
-
-const PRISTINE_LINE: &str = "requests==2.31.0";
-const WIRED_LINE: &str = "requests @ http://patch.test/patch/pypi/requests/2.31.0/22222222-2222-4222-8222-222222222222/a1a1a1a1-a1a1-4a1a-8a1a-a1a1a1a1a1a1/requests-2.31.0-py3-none-any.whl --hash=sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef";
-
-fn requirements_content(line: &str) -> String {
-    format!("flask==2.0.1\n{line}\n")
-}
-
-/// The leftover requirements-source edit a degraded (record-fetch-failed)
-/// hosted run leaves behind: `redirect_requirements_line` has no per-purl
-/// revert — only the whole-ledger replay can unwind it.
-fn requirements_edit() -> FileEdit {
-    FileEdit {
-        path: "requirements.txt".to_string(),
-        kind: "redirect_requirements_line".to_string(),
-        action: "rewritten".to_string(),
-        key: Some("requests".to_string()),
-        original: Some(Value::String(PRISTINE_LINE.to_string())),
-        new: Some(Value::String(WIRED_LINE.to_string())),
-    }
-}
-
-fn ledger_path(root: &Path) -> std::path::PathBuf {
-    root.join(".socket/vendor/redirect-state.json")
-}
-
-/// requirements.txt still wired + a ledger holding the leftover pypi edit
-/// and NO records (the record-fetch-failed shape). No manifest, no vendor
-/// ledger — the redirect ledger alone keeps the run off the truly-empty
-/// error path.
-async fn write_degraded_pypi_fixture(root: &Path) {
-    std::fs::write(
-        root.join("requirements.txt"),
-        requirements_content(WIRED_LINE),
-    )
-    .unwrap();
-    let mut state = RedirectState::new();
-    state.edits = vec![requirements_edit()];
-    save_redirect_state(root, &state)
-        .await
-        .expect("write redirect ledger");
-}
-
-/// In-process wet rollback (`--json --yes --offline --silent`), optionally
-/// `--ecosystems`-narrowed.
-async fn rollback_in_process(cwd: &Path, ecosystems: Option<Vec<String>>) -> i32 {
-    let args = RollbackArgs {
-        targets: Vec::new(),
-        common: socket_patch_cli::args::GlobalArgs {
-            cwd: cwd.to_path_buf(),
-            manifest_path: ".socket/manifest.json".to_string(),
-            ecosystems,
-            offline: true,
-            json: true,
-            yes: true,
-            silent: true,
-            ..socket_patch_cli::args::GlobalArgs::default()
-        },
-        one_off: false,
-        preserve_state: false,
-    };
-    let code = rollback_run(args).await;
-    // `apply_env_toggles` mirrored `--offline` into the PROCESS env and
-    // nothing unsets it; scrub so the next in-process run in this
-    // `#[serial]` process isn't silently forced offline.
-    std::env::remove_var("SOCKET_OFFLINE");
-    code
-}
-
-/// Regression: `rollback --ecosystems npm` over the records-empty degraded
-/// ledger must NOT replay (and drop) the leftover PYPI edit. An
-/// eco-narrowed run is a scoped run — only an unscoped rollback may claim
-/// the whole-ledger replay of leftover edits.
-#[tokio::test]
-#[serial]
-async fn ecosystems_scoped_rollback_leaves_other_ecosystems_leftover_edits() {
-    let tmp = tempfile::tempdir().unwrap();
-    write_degraded_pypi_fixture(tmp.path()).await;
-    let ledger_before = std::fs::read(ledger_path(tmp.path())).unwrap();
-
-    let code = rollback_in_process(tmp.path(), Some(vec!["npm".to_string()])).await;
-    assert_eq!(code, 0, "an npm-scoped run with no npm state is a no-op");
-
-    assert_eq!(
-        std::fs::read_to_string(tmp.path().join("requirements.txt")).unwrap(),
-        requirements_content(WIRED_LINE),
-        "an --ecosystems npm rollback must not unwind the pypi redirect edit"
-    );
-    assert_eq!(
-        std::fs::read(ledger_path(tmp.path())).unwrap(),
-        ledger_before,
-        "the out-of-scope leftover edit must stay in the ledger"
-    );
-}
-
-/// Control: an UNSCOPED rollback
-/// still replays the records-empty ledger's leftover edits and deletes
-/// the emptied ledger.
-#[tokio::test]
-#[serial]
-async fn unscoped_rollback_still_replays_leftover_edits() {
-    let tmp = tempfile::tempdir().unwrap();
-    write_degraded_pypi_fixture(tmp.path()).await;
-
-    let code = rollback_in_process(tmp.path(), None).await;
-    assert_eq!(code, 0, "unscoped replay of the leftover edit must succeed");
-
-    assert_eq!(
-        std::fs::read_to_string(tmp.path().join("requirements.txt")).unwrap(),
-        requirements_content(PRISTINE_LINE),
-        "the unscoped run must unwind the leftover pypi edit"
-    );
-    assert!(
-        !ledger_path(tmp.path()).exists(),
-        "the emptied ledger must be deleted"
-    );
-    assert!(
-        !tmp.path().join(".socket").exists(),
-        "the replayed-out project keeps no .socket/ residue"
-    );
-}
diff --git a/crates/socket-patch-cli/tests/coverage_fix_scan_hosted_dryrun_vendored.rs b/crates/socket-patch-cli/tests/coverage_fix_scan_hosted_dryrun_vendored.rs
index 928010ff..eb35348e 100644
--- a/crates/socket-patch-cli/tests/coverage_fix_scan_hosted_dryrun_vendored.rs
+++ b/crates/socket-patch-cli/tests/coverage_fix_scan_hosted_dryrun_vendored.rs
@@ -82,8 +82,8 @@ async fn mock_hosted_api(server: &MockServer) {
         })))
         .mount(server)
         .await;
-    // `view/{uuid}` — the record the wet run persists into the redirect
-    // ledger after a confirmed redirect.
+    // `view/{uuid}` — the record the wet run fetches (in memory: stale-install
+    // probes, in-run VEX) after a confirmed redirect.
     let before_hash = compute_git_sha256_from_bytes(ORIG_INDEX);
     let after_hash = compute_git_sha256_from_bytes(PATCHED_INDEX);
     Mock::given(method("GET"))
@@ -547,9 +547,8 @@ async fn human_takeover_prints_migration_lines_and_matching_file_counts() {
     );
     assert!(
         wet_out.contains(
-            "Commit .socket/vendor/ (the redirect ledger, plus the removed vendored ledger \
-             entries and artifacts), package.json, pnpm-lock.yaml, and pnpm-workspace.yaml \
-             to keep the redirect."
+            "Commit .socket/vendor/ (the removed vendored ledger entries and artifacts), \
+             package.json, pnpm-lock.yaml, and pnpm-workspace.yaml to keep the redirect."
         ),
         "stdout=\n{wet_out}"
     );
diff --git a/crates/socket-patch-cli/tests/covgap_commands_get.rs b/crates/socket-patch-cli/tests/covgap_commands_get.rs
index ba006e94..da232d43 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_get.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_get.rs
@@ -294,6 +294,7 @@ fn engine_params(root: &Path) -> DownloadParams {
         strict: false,
         ecosystems: None,
         persist_blobs: true,
+        patch_server_url: None,
         all_releases: true,
     }
 }
diff --git a/crates/socket-patch-cli/tests/covgap_commands_remove.rs b/crates/socket-patch-cli/tests/covgap_commands_remove.rs
index fa000a59..49b300de 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_remove.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_remove.rs
@@ -6,9 +6,10 @@
 //! exercised in JSON mode.
 //!
 //! Binary-driven (spawns `CARGO_BIN_EXE_socket-patch` through
-//! `common::run_with_env`, which scrubs the ambient `SOCKET_*` env), fully
-//! offline: every fixture is hand-written camelCase JSON, and every wet run
-//! passes `--offline`. Fixture shapes are copied from
+//! `common::run_with_env`, which scrubs the ambient `SOCKET_*` env): every
+//! fixture is hand-written camelCase JSON, and every wet run passes
+//! `--offline` — except the hosted leg's, whose upstream restore re-resolves
+//! the registry entry from a mock npm registry (`SOCKET_NPM_REGISTRY`). Fixture shapes are copied from
 //! remove_invariants.rs / remove_duality_invariants.rs /
 //! interactive_prompts_e2e.rs.
 
@@ -158,7 +159,8 @@ fn write_vendor_ledger_entry(
 const DRIFTED_WIRING: &str = r#"[{ "file": "weird.txt", "kind": "npm_lock_entry", "action": "added", "key": "node_modules/x" }]"#;
 
 // ---------------------------------------------------------------------------
-// Hosted-redirect fixtures (copied from remove_duality_invariants.rs).
+// Hosted-redirect fixtures (copied from remove_duality_invariants.rs). The
+// lockfile pin IS the hosted state; the ledger text is a pre-v5 leftover.
 // ---------------------------------------------------------------------------
 
 const NPM_PURL: &str = "pkg:npm/left-pad@1.3.0";
@@ -190,7 +192,7 @@ fn redirected_lock_text() -> String {
     )
 }
 
-/// Redirect ledger (real `RedirectState` schema) with ONE npm record and
+/// A PRE-V5 redirect ledger (v5 never writes one) with ONE npm record and
 /// its recorded `redirect_npm_lock_entry` edit matching
 /// [`redirected_lock_text`].
 fn npm_redirect_ledger_text() -> String {
@@ -231,9 +233,10 @@ fn write_redirect_ledger_text(root: &Path, text: &str) -> PathBuf {
     path
 }
 
-/// The exact bytes the npm redirect revert writes when it restores
-/// [`redirected_lock_text`] to the pre-redirect entry (same whole-file
-/// derivation the remove_duality_invariants.rs twins use).
+/// The exact bytes the upstream restore writes when it puts
+/// [`redirected_lock_text`] back on the registry entry the mock registry
+/// serves (`ORIG_RESOLVED` / `ORIG_INTEGRITY`; same whole-file derivation
+/// the remove_duality_invariants.rs twins use).
 fn expected_reverted_lock_text() -> String {
     let mut expected: serde_json::Value =
         serde_json::from_str(&redirected_lock_text()).expect("parse fixture lock");
@@ -623,27 +626,75 @@ fn remove_detached_vendor_state_write_failure_fails_with_code() {
 
 // ---------------------------------------------------------------------------
 // 5. Hosted leg: dry-run previews (main flow + hosted-only)
+//
+// v5 hosted state is the lockfile pin itself (no ledger): removing a hosted
+// patch restores the pin's DEFAULT UPSTREAM registry entry, re-resolved
+// from the mock npm registry below (`SOCKET_NPM_REGISTRY`).
 // ---------------------------------------------------------------------------
 
-/// A dry-run remove touching hosted records had NEVER run. The preview
-/// must leave BOTH the lockfile and the redirect ledger byte-identical
-/// while reporting the would-be unwind as a Verified/hosted_reverted
-/// event.
+/// A mock npm registry serving left-pad@1.3.0's version document with the
+/// fixture's upstream tarball + integrity (or nothing: every lookup 404s).
+/// wiremock serves from its own thread; the runtime only owns the server.
+struct NpmRegistry {
+    server: wiremock::MockServer,
+    _rt: tokio::runtime::Runtime,
+}
+
+impl NpmRegistry {
+    fn start(serve_left_pad: bool) -> Self {
+        use wiremock::matchers::{method, path};
+        use wiremock::{Mock, MockServer, ResponseTemplate};
+        let rt = tokio::runtime::Runtime::new().expect("tokio runtime");
+        let server = rt.block_on(async {
+            let server = MockServer::start().await;
+            if serve_left_pad {
+                Mock::given(method("GET"))
+                    .and(path("/npm/left-pad/1.3.0"))
+                    .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+                        "name": "left-pad",
+                        "version": "1.3.0",
+                        "dist": { "tarball": ORIG_RESOLVED, "integrity": ORIG_INTEGRITY }
+                    })))
+                    .mount(&server)
+                    .await;
+            }
+            server
+        });
+        Self { server, _rt: rt }
+    }
+
+    fn base(&self) -> String {
+        format!("{}/npm", self.server.uri())
+    }
+}
+
+/// `run_remove` with the npm registry pointed at `registry`.
+fn run_remove_online(cwd: &Path, args: &[&str], registry: &NpmRegistry) -> (i32, String, String) {
+    let base = registry.base();
+    run_remove(cwd, args, &[("SOCKET_NPM_REGISTRY", base.as_str())])
+}
+
+fn legacy_ledger_path(root: &Path) -> PathBuf {
+    root.join(".socket/vendor/redirect-state.json")
+}
+
+/// A dry-run remove touching a hosted pin must leave the lockfile
+/// byte-identical (and write no ledger) while reporting the would-be
+/// restore as a Verified/hosted_reverted event.
 #[test]
-fn remove_hosted_dry_run_leaves_lock_and_ledger_untouched() {
+fn remove_hosted_dry_run_leaves_lock_untouched() {
     let tmp = tempfile::tempdir().expect("tempdir");
     let lock_path = tmp.path().join("package-lock.json");
     std::fs::write(&lock_path, redirected_lock_text()).unwrap();
-    let ledger_path = write_redirect_ledger_text(tmp.path(), &npm_redirect_ledger_text());
-    let ledger_before = read_bytes(&ledger_path);
     let lock_before = read_bytes(&lock_path);
     let socket = write_manifest_files_empty(tmp.path(), NPM_PURL, NPM_UUID);
     let manifest_before = read_bytes(&socket.join("manifest.json"));
+    let registry = NpmRegistry::start(true);
 
-    let (code, stdout, stderr) = run_remove(
+    let (code, stdout, stderr) = run_remove_online(
         tmp.path(),
-        &[NPM_PURL, "--json", "--yes", "--offline", "--dry-run"],
-        &[],
+        &[NPM_PURL, "--json", "--yes", "--dry-run"],
+        &registry,
     );
     assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
     let v = parse_envelope(&stdout);
@@ -657,7 +708,7 @@ fn remove_hosted_dry_run_leaves_lock_and_ledger_untouched() {
         events.iter().any(|e| e["action"] == "verified"
             && e["purl"] == NPM_PURL
             && e["errorCode"] == "hosted_reverted"),
-        "the hosted unwind preview must be a verified/hosted_reverted event: {events:?}"
+        "the hosted restore preview must be a verified/hosted_reverted event: {events:?}"
     );
     assert!(
         events.iter().all(|e| e["action"] != "removed"),
@@ -666,10 +717,9 @@ fn remove_hosted_dry_run_leaves_lock_and_ledger_untouched() {
 
     // Nothing on disk moved.
     assert_eq!(read_bytes(&lock_path), lock_before, "lock byte-identical");
-    assert_eq!(
-        read_bytes(&ledger_path),
-        ledger_before,
-        "ledger byte-identical"
+    assert!(
+        !legacy_ledger_path(tmp.path()).exists(),
+        "no hosted ledger is ever written"
     );
     assert_eq!(
         read_bytes(&socket.join("manifest.json")),
@@ -685,21 +735,17 @@ fn remove_hosted_only_dry_run_previews_without_mutation() {
     let tmp = tempfile::tempdir().expect("tempdir");
     let lock_path = tmp.path().join("package-lock.json");
     std::fs::write(&lock_path, redirected_lock_text()).unwrap();
-    let ledger_path = write_redirect_ledger_text(tmp.path(), &npm_redirect_ledger_text());
-    let ledger_before = read_bytes(&ledger_path);
     let lock_before = read_bytes(&lock_path);
+    let registry = NpmRegistry::start(true);
 
-    let (code, stdout, stderr) = run_remove(
-        tmp.path(),
-        &[NPM_PURL, "--json", "--offline", "--dry-run"],
-        &[],
-    );
+    let (code, stdout, stderr) =
+        run_remove_online(tmp.path(), &[NPM_PURL, "--json", "--dry-run"], &registry);
     assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
     let v = parse_envelope(&stdout);
     assert_eq!(v["dryRun"], true);
     assert_eq!(
         v["summary"]["verified"], 1,
-        "the preview must count the would-be unwind; envelope={v}"
+        "the preview must count the would-be restore; envelope={v}"
     );
     assert_eq!(v["summary"]["removed"], 0);
     let events = v["events"].as_array().expect("events array");
@@ -710,14 +756,9 @@ fn remove_hosted_only_dry_run_previews_without_mutation() {
         "expected a verified/hosted_reverted preview event: {events:?}"
     );
     assert_eq!(read_bytes(&lock_path), lock_before, "lock byte-identical");
-    assert_eq!(
-        read_bytes(&ledger_path),
-        ledger_before,
-        "ledger byte-identical"
-    );
     assert!(
-        !tmp.path().join(".socket/manifest.json").exists(),
-        "no manifest may be materialized as a side effect"
+        !tmp.path().join(".socket").exists(),
+        "no manifest (or any .socket/ state) may be materialized as a side effect"
     );
 }
 
@@ -725,7 +766,7 @@ fn remove_hosted_only_dry_run_previews_without_mutation() {
 // 6. Hosted leg: --preserve-state note + preserve-state human summary
 // ---------------------------------------------------------------------------
 
-/// `--preserve-state` still unwinds hosted redirects (hosted has no
+/// `--preserve-state` still restores hosted pins (hosted has no
 /// preservable local state) and the human run must say so on stderr —
 /// while the manifest entry survives and the final preserve summary
 /// prints.
@@ -734,18 +775,18 @@ fn remove_hosted_preserve_state_notes_no_preservable_state() {
     let tmp = tempfile::tempdir().expect("tempdir");
     let lock_path = tmp.path().join("package-lock.json");
     std::fs::write(&lock_path, redirected_lock_text()).unwrap();
-    let ledger_path = write_redirect_ledger_text(tmp.path(), &npm_redirect_ledger_text());
     let socket = write_manifest_files_empty(tmp.path(), NPM_PURL, NPM_UUID);
     let manifest_before = read_bytes(&socket.join("manifest.json"));
+    let registry = NpmRegistry::start(true);
 
-    let (code, stdout, stderr) = run_remove(
+    let (code, stdout, stderr) = run_remove_online(
         tmp.path(),
-        &[NPM_PURL, "--yes", "--offline", "--preserve-state"],
-        &[],
+        &[NPM_PURL, "--yes", "--preserve-state"],
+        &registry,
     );
     assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
     assert!(
-        stderr.contains("hosted redirects have no preservable local state"),
+        stderr.contains("hosted wiring has no preservable local state"),
         "the preserve-state hosted note must reach stderr; got:\n{stderr}"
     );
     assert!(
@@ -753,15 +794,11 @@ fn remove_hosted_preserve_state_notes_no_preservable_state() {
         "the preserve-state summary must print; got:\n{stdout}"
     );
 
-    // The unwind really happened: lock restored, emptied ledger deleted.
+    // The restore really happened: the lock holds the upstream entry.
     assert_eq!(
         std::fs::read_to_string(&lock_path).unwrap(),
         expected_reverted_lock_text(),
-        "the lock must hold exactly the pre-redirect entry"
-    );
-    assert!(
-        !ledger_path.exists(),
-        "the emptied redirect ledger must be deleted"
+        "the lock must hold exactly the upstream registry entry"
     );
     // The state half was preserved: manifest byte-identical.
     assert_eq!(
@@ -772,15 +809,14 @@ fn remove_hosted_preserve_state_notes_no_preservable_state() {
 }
 
 // ---------------------------------------------------------------------------
-// 7. Corrupt hosted-redirect ledger: warn-and-continue
+// 7. Corrupt pre-v5 hosted ledger: ignored
 // ---------------------------------------------------------------------------
 
-/// A corrupt redirect ledger must not block a manifest removal: the main
-/// flow warns on stderr ("hosted redirects were not examined") and the
-/// removal still succeeds. The corrupt ledger is left alone (it may hold
-/// revert data a human can repair).
+/// A corrupt pre-v5 redirect ledger is inert: hosted state comes from the
+/// lockfiles, so a manifest removal neither reads nor warns about it, the
+/// removal succeeds, and the file is left alone.
 #[test]
-fn remove_corrupt_hosted_ledger_warns_and_continues_human() {
+fn remove_corrupt_legacy_hosted_ledger_is_ignored_human() {
     let tmp = tempfile::tempdir().expect("tempdir");
     let purl = "pkg:npm/__covgap_hcorrupt__@1.0.0";
     let socket =
@@ -791,11 +827,11 @@ fn remove_corrupt_hosted_ledger_warns_and_continues_human() {
     let (code, stdout, stderr) = run_remove(tmp.path(), &[purl, "--yes", "--offline"], &[]);
     assert_eq!(
         code, 0,
-        "a corrupt hosted ledger must not block the removal; stdout=\n{stdout}\nstderr=\n{stderr}"
+        "a corrupt pre-v5 ledger must not block the removal; stdout=\n{stdout}\nstderr=\n{stderr}"
     );
     assert!(
-        stderr.contains("hosted redirects were not examined"),
-        "the warning must reach stderr; got:\n{stderr}"
+        !stderr.contains("redirect") && !stderr.contains("ledger"),
+        "the pre-v5 ledger is never read, so nothing warns about it; got:\n{stderr}"
     );
     assert!(
         stdout.contains("Removed 1 patch from manifest:"),
@@ -811,15 +847,14 @@ fn remove_corrupt_hosted_ledger_warns_and_continues_human() {
     assert_eq!(
         read_bytes(&ledger_path),
         ledger_before,
-        "the corrupt ledger must be left alone (it may hold repairable revert data)"
+        "the corrupt ledger must be left alone"
     );
 }
 
-/// JSON twin: the removal still succeeds and the corrupt ledger is left
-/// alone. (Known gap, deliberately NOT pinned here: JSON mode currently
-/// carries no machine-visible signal for the skipped hosted leg.)
+/// JSON twin: the removal still succeeds with no warning, and the corrupt
+/// ledger is left alone.
 #[test]
-fn remove_corrupt_hosted_ledger_json_still_removes() {
+fn remove_corrupt_legacy_hosted_ledger_is_ignored_json() {
     let tmp = tempfile::tempdir().expect("tempdir");
     let purl = "pkg:npm/__covgap_hcorrupt__@1.0.0";
     write_manifest_files_empty(tmp.path(), purl, "77777777-7777-4777-8777-777777777777");
@@ -833,6 +868,10 @@ fn remove_corrupt_hosted_ledger_json_still_removes() {
     assert_eq!(v["status"], "success");
     assert_eq!(v["summary"]["removed"], 1, "envelope={v}");
     assert_eq!(event_purls(&v, "removed"), vec![purl]);
+    assert!(
+        v["warnings"].as_array().is_none_or(Vec::is_empty),
+        "the pre-v5 ledger is never read: no warning; envelope={v}"
+    );
     assert_eq!(
         read_bytes(&ledger_path),
         ledger_before,
@@ -845,15 +884,13 @@ fn remove_corrupt_hosted_ledger_json_still_removes() {
 // ---------------------------------------------------------------------------
 
 /// With no manifest entry to delete, removing a hosted patch can only mean
-/// unwinding its redirect — `--skip-rollback` is refused with
+/// restoring its upstream entry — `--skip-rollback` is refused with
 /// `hosted_state_retained` and nothing moves.
 #[test]
 fn remove_hosted_only_skip_rollback_refused() {
     let tmp = tempfile::tempdir().expect("tempdir");
     let lock_path = tmp.path().join("package-lock.json");
     std::fs::write(&lock_path, redirected_lock_text()).unwrap();
-    let ledger_path = write_redirect_ledger_text(tmp.path(), &npm_redirect_ledger_text());
-    let ledger_before = read_bytes(&ledger_path);
     let lock_before = read_bytes(&lock_path);
 
     let (code, stdout, stderr) = run_remove(
@@ -870,21 +907,27 @@ fn remove_hosted_only_skip_rollback_refused() {
         msg.contains(NPM_PURL) && msg.contains("--skip-rollback"),
         "the refusal must name the purl and the flag; got: {msg}"
     );
-    assert_eq!(read_bytes(&ledger_path), ledger_before, "ledger untouched");
     assert_eq!(read_bytes(&lock_path), lock_before, "lock untouched");
+    assert!(!tmp.path().join(".socket").exists(), "nothing written");
 }
 
 /// Hosted-only human mode: the pre-confirm listing ("The following hosted
-/// redirect(s) will be unwound and removed:") must print to stderr, and
-/// the wet run must complete the unwind.
+/// redirect(s) will be unwound and removed:") must print to stderr, the
+/// wet run must restore the upstream entry, and a pre-v5 ledger left
+/// beside the pin is retired once no hosted pin remains (it is never the
+/// revert source: its recorded original disagrees with the registry).
 #[test]
 fn remove_hosted_only_human_lists_redirects_and_unwinds() {
     let tmp = tempfile::tempdir().expect("tempdir");
     let lock_path = tmp.path().join("package-lock.json");
     std::fs::write(&lock_path, redirected_lock_text()).unwrap();
-    let ledger_path = write_redirect_ledger_text(tmp.path(), &npm_redirect_ledger_text());
+    let ledger_path = write_redirect_ledger_text(
+        tmp.path(),
+        &npm_redirect_ledger_text().replace(ORIG_INTEGRITY, "sha512-LEDGERledger=="),
+    );
+    let registry = NpmRegistry::start(true);
 
-    let (code, stdout, stderr) = run_remove(tmp.path(), &[NPM_PURL, "--yes", "--offline"], &[]);
+    let (code, stdout, stderr) = run_remove_online(tmp.path(), &[NPM_PURL, "--yes"], &registry);
     assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
     assert!(
         stderr.contains("The following hosted redirect will be unwound and removed:"),
@@ -894,71 +937,76 @@ fn remove_hosted_only_human_lists_redirects_and_unwinds() {
         stderr.contains(&format!("  - {NPM_PURL}")),
         "the listing must name the purl; got:\n{stderr}"
     );
-    // The unwind really ran: lock restored byte-exactly, ledger deleted.
+    assert!(
+        stdout.contains(&format!(
+            "Restored {NPM_PURL} to its upstream registry entry"
+        )),
+        "the restore line must print; got:\n{stdout}"
+    );
+    // The restore really ran: lock holds the registry's entry byte-exactly.
     assert_eq!(
         std::fs::read_to_string(&lock_path).unwrap(),
         expected_reverted_lock_text(),
-        "the lock must hold exactly the pre-redirect entry"
+        "the lock must hold exactly the upstream registry entry"
     );
     assert!(
         !ledger_path.exists(),
-        "the emptied redirect ledger must be deleted"
+        "the pre-v5 ledger is retired once no hosted pin remains"
     );
 }
 
 // ---------------------------------------------------------------------------
-// 9. Hosted per-purl revert failure fails closed (main flow + hosted-only
+// 9. Hosted upstream-restore refusal fails closed (main flow + hosted-only
 //    twin)
 // ---------------------------------------------------------------------------
 
-/// A package-lock.json that is no longer valid JSON makes the recorded
-/// `redirect_npm_lock_entry` revert fail — the remove must abort with
-/// `hosted_revert_failed` BEFORE the manifest mutation, leaving every
-/// store byte-identical.
+/// The registry cannot re-resolve the upstream entry (404): the pin is
+/// refused, and the remove must abort with `hosted_revert_failed` BEFORE
+/// the manifest mutation, leaving every store byte-identical.
 #[test]
 fn remove_hosted_revert_failure_fails_closed() {
     let tmp = tempfile::tempdir().expect("tempdir");
     let lock_path = tmp.path().join("package-lock.json");
-    std::fs::write(&lock_path, "{corrupt lock").unwrap();
+    std::fs::write(&lock_path, redirected_lock_text()).unwrap();
     let lock_before = read_bytes(&lock_path);
-    let ledger_path = write_redirect_ledger_text(tmp.path(), &npm_redirect_ledger_text());
-    let ledger_before = read_bytes(&ledger_path);
     let socket = write_manifest_files_empty(tmp.path(), NPM_PURL, NPM_UUID);
     let manifest_before = read_bytes(&socket.join("manifest.json"));
+    let registry = NpmRegistry::start(false);
 
     let (code, stdout, stderr) =
-        run_remove(tmp.path(), &[NPM_PURL, "--json", "--yes", "--offline"], &[]);
+        run_remove_online(tmp.path(), &[NPM_PURL, "--json", "--yes"], &registry);
     assert_eq!(
         code, 1,
-        "a failed hosted revert must abort the remove; stdout=\n{stdout}\nstderr=\n{stderr}"
+        "a refused hosted restore must abort the remove; stdout=\n{stdout}\nstderr=\n{stderr}"
     );
     let v = parse_envelope(&stdout);
     assert_eq!(v["status"], "error");
     assert_eq!(v["error"]["code"], "hosted_revert_failed", "envelope={v}");
     let msg = v["error"]["message"].as_str().expect("message string");
     assert!(
-        msg.contains("could not unwind hosted redirect for pkg:npm/left-pad@1.3.0")
+        msg.contains("cannot restore pkg:npm/left-pad@1.3.0 to its upstream registry entry")
+            && msg.contains("404")
+            && msg.contains("git checkout -- package-lock.json")
             && msg.contains("The manifest was not modified."),
-        "the error must name the purl and promise the manifest is intact; got: {msg}"
+        "the error must name the purl, the cause, the remedy and promise the manifest is \
+         intact; got: {msg}"
     );
     assert_eq!(v["summary"]["removed"], 0);
 
-    // Fail-closed: manifest, ledger, and (corrupt) lock all byte-identical.
+    // Fail-closed: manifest and lock byte-identical.
     assert_eq!(read_bytes(&socket.join("manifest.json")), manifest_before);
-    assert_eq!(read_bytes(&ledger_path), ledger_before);
     assert_eq!(read_bytes(&lock_path), lock_before);
 }
 
-/// Hosted-only twin: the same corrupt-lock failure surfaces through
-/// `remove_hosted_only`'s failed-revert branch.
+/// Hosted-only twin: an `--offline` run cannot re-resolve the upstream
+/// entry, so the pin is refused through `remove_hosted_only`'s
+/// failed-restore branch.
 #[test]
 fn remove_hosted_only_revert_failure_fails_closed() {
     let tmp = tempfile::tempdir().expect("tempdir");
     let lock_path = tmp.path().join("package-lock.json");
-    std::fs::write(&lock_path, "{corrupt lock").unwrap();
+    std::fs::write(&lock_path, redirected_lock_text()).unwrap();
     let lock_before = read_bytes(&lock_path);
-    let ledger_path = write_redirect_ledger_text(tmp.path(), &npm_redirect_ledger_text());
-    let ledger_before = read_bytes(&ledger_path);
 
     let (code, stdout, stderr) =
         run_remove(tmp.path(), &[NPM_PURL, "--json", "--yes", "--offline"], &[]);
@@ -968,45 +1016,42 @@ fn remove_hosted_only_revert_failure_fails_closed() {
     assert_eq!(v["error"]["code"], "hosted_revert_failed", "envelope={v}");
     let msg = v["error"]["message"].as_str().expect("message string");
     assert!(
-        msg.contains("could not unwind hosted redirect for pkg:npm/left-pad@1.3.0"),
-        "the error must name the purl; got: {msg}"
-    );
-    assert_eq!(read_bytes(&ledger_path), ledger_before, "ledger untouched");
-    assert_eq!(
-        read_bytes(&lock_path),
-        lock_before,
-        "corrupt lock untouched"
+        msg.contains("cannot restore pkg:npm/left-pad@1.3.0 to its upstream registry entry")
+            && msg.contains("this run is offline"),
+        "the error must name the purl and the offline cause; got: {msg}"
     );
+    assert_eq!(read_bytes(&lock_path), lock_before, "lock untouched");
 }
 
 // ---------------------------------------------------------------------------
-// 10. Hosted ledger persist failure after successful lockfile reverts
-//     (main flow + hosted-only). Unix-only.
+// 10. Restored-lockfile write failure (main flow + hosted-only). Unix-only;
+//     skipped where directory modes are not enforced (root).
 // ---------------------------------------------------------------------------
 
-/// The per-purl reverts flush lockfile writes as they go; when the ledger
-/// persist then fails, the remove must abort with `hosted_revert_failed`
-/// naming the persist — the manifest untouched, the (stale) ledger still
-/// on disk, and the lock already restored (the documented desync posture).
+/// Every pin resolved, but the restored lockfile cannot be written (a
+/// read-only project root; the write is a temp-file + rename beside it):
+/// the remove aborts with `hosted_revert_failed` naming the write — the
+/// manifest untouched and the lock byte-identical.
 #[cfg(unix)]
 #[test]
-fn remove_hosted_ledger_persist_failure_fails_closed() {
+fn remove_hosted_lockfile_write_failure_fails_closed() {
     let tmp = tempfile::tempdir().expect("tempdir");
-    let lock_path = tmp.path().join("package-lock.json");
+    let root = tmp.path().join("project");
+    std::fs::create_dir(&root).unwrap();
+    let lock_path = root.join("package-lock.json");
     std::fs::write(&lock_path, redirected_lock_text()).unwrap();
-    let ledger_path = write_redirect_ledger_text(tmp.path(), &npm_redirect_ledger_text());
-    let ledger_before = read_bytes(&ledger_path);
-    let socket = write_manifest_files_empty(tmp.path(), NPM_PURL, NPM_UUID);
+    let lock_before = read_bytes(&lock_path);
+    let socket = write_manifest_files_empty(&root, NPM_PURL, NPM_UUID);
     let manifest_before = read_bytes(&socket.join("manifest.json"));
-    let vendor = tmp.path().join(".socket/vendor");
+    let registry = NpmRegistry::start(true);
 
-    chmod(&vendor, 0o555);
-    let _mode = ModeGuard(vendor.clone());
-    if !readonly_dir_enforced(&vendor) {
+    chmod(&root, 0o555);
+    let _mode = ModeGuard(root.clone());
+    if !readonly_dir_enforced(&root) {
         return;
     }
     let (code, stdout, stderr) =
-        run_remove(tmp.path(), &[NPM_PURL, "--json", "--yes", "--offline"], &[]);
+        run_remove_online(&root, &[NPM_PURL, "--json", "--yes"], &registry);
 
     assert_eq!(code, 1, "stdout=\n{stdout}\nstderr=\n{stderr}");
     let v = parse_envelope(&stdout);
@@ -1014,8 +1059,8 @@ fn remove_hosted_ledger_persist_failure_fails_closed() {
     assert_eq!(v["error"]["code"], "hosted_revert_failed", "envelope={v}");
     let msg = v["error"]["message"].as_str().expect("message string");
     assert!(
-        msg.contains("failed to persist the hosted redirect ledger"),
-        "the error must name the persist failure; got: {msg}"
+        msg.contains("writing the restored lockfiles failed"),
+        "the error must name the write failure; got: {msg}"
     );
     assert_eq!(
         read_bytes(&socket.join("manifest.json")),
@@ -1023,37 +1068,33 @@ fn remove_hosted_ledger_persist_failure_fails_closed() {
         "the manifest mutation must not have happened"
     );
     assert_eq!(
-        read_bytes(&ledger_path),
-        ledger_before,
-        "the unwritable ledger keeps its old bytes"
-    );
-    // The lockfile edits flushed BEFORE the persist (the documented
-    // desync-avoidance ordering): the lock is already restored.
-    assert_eq!(
-        std::fs::read_to_string(&lock_path).unwrap(),
-        expected_reverted_lock_text(),
-        "the per-purl revert flushed the lock before the persist failed"
+        read_bytes(&lock_path),
+        lock_before,
+        "the lock was never written"
     );
 }
 
-/// Hosted-only twin of the persist failure.
+/// Hosted-only twin of the write failure.
 #[cfg(unix)]
 #[test]
-fn remove_hosted_only_ledger_persist_failure_fails_closed() {
+fn remove_hosted_only_lockfile_write_failure_fails_closed() {
     let tmp = tempfile::tempdir().expect("tempdir");
-    let lock_path = tmp.path().join("package-lock.json");
+    let root = tmp.path().join("project");
+    std::fs::create_dir(&root).unwrap();
+    let lock_path = root.join("package-lock.json");
     std::fs::write(&lock_path, redirected_lock_text()).unwrap();
-    let ledger_path = write_redirect_ledger_text(tmp.path(), &npm_redirect_ledger_text());
-    let ledger_before = read_bytes(&ledger_path);
-    let vendor = tmp.path().join(".socket/vendor");
+    let lock_before = read_bytes(&lock_path);
+    // `.socket/` exists and stays writable so the apply lock is taken.
+    std::fs::create_dir(root.join(".socket")).unwrap();
+    let registry = NpmRegistry::start(true);
 
-    chmod(&vendor, 0o555);
-    let _mode = ModeGuard(vendor.clone());
-    if !readonly_dir_enforced(&vendor) {
+    chmod(&root, 0o555);
+    let _mode = ModeGuard(root.clone());
+    if !readonly_dir_enforced(&root) {
         return;
     }
     let (code, stdout, stderr) =
-        run_remove(tmp.path(), &[NPM_PURL, "--json", "--yes", "--offline"], &[]);
+        run_remove_online(&root, &[NPM_PURL, "--json", "--yes"], &registry);
 
     assert_eq!(code, 1, "stdout=\n{stdout}\nstderr=\n{stderr}");
     let v = parse_envelope(&stdout);
@@ -1061,18 +1102,13 @@ fn remove_hosted_only_ledger_persist_failure_fails_closed() {
     assert_eq!(v["error"]["code"], "hosted_revert_failed", "envelope={v}");
     let msg = v["error"]["message"].as_str().expect("message string");
     assert!(
-        msg.contains("failed to persist the hosted redirect ledger"),
-        "the error must name the persist failure; got: {msg}"
-    );
-    assert_eq!(
-        read_bytes(&ledger_path),
-        ledger_before,
-        "ledger keeps its old bytes"
+        msg.contains("writing the restored lockfiles failed"),
+        "the error must name the write failure; got: {msg}"
     );
     assert_eq!(
-        std::fs::read_to_string(&lock_path).unwrap(),
-        expected_reverted_lock_text(),
-        "the per-purl revert flushed the lock before the persist failed"
+        read_bytes(&lock_path),
+        lock_before,
+        "the lock was never written"
     );
 }
 
@@ -1799,14 +1835,13 @@ mod pty {
     }
 
     /// Declining the hosted-only confirm prompt must cancel cleanly (exit
-    /// 0, "Removal cancelled.") with the lock and ledger byte-identical.
+    /// 0, "Removal cancelled.") with the lock byte-identical and no
+    /// `.socket/` state written.
     #[test]
     fn remove_hosted_only_interactive_n_cancels() {
         let tmp = tempfile::tempdir().expect("tempdir");
         let lock_path = tmp.path().join("package-lock.json");
         std::fs::write(&lock_path, redirected_lock_text()).unwrap();
-        let ledger_path = write_redirect_ledger_text(tmp.path(), &npm_redirect_ledger_text());
-        let ledger_before = read_bytes(&ledger_path);
         let lock_before = read_bytes(&lock_path);
 
         let (code, output) = run_in_pty(
@@ -1833,8 +1868,11 @@ mod pty {
             "'n' must report cancellation; got: {output}"
         );
         // Declined: nothing moved.
-        assert_eq!(read_bytes(&ledger_path), ledger_before, "ledger untouched");
         assert_eq!(read_bytes(&lock_path), lock_before, "lock untouched");
+        assert!(
+            !tmp.path().join(".socket").exists(),
+            "a declined remove leaves no .socket/ state"
+        );
     }
 }
 
diff --git a/crates/socket-patch-cli/tests/covgap_commands_rollback.rs b/crates/socket-patch-cli/tests/covgap_commands_rollback.rs
index bfa15851..ded85f9b 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_rollback.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_rollback.rs
@@ -4,8 +4,8 @@
 //!    per-file details, preserve-state closing message, and the
 //!    error-class stderr notices (other suites run `--json`/`--silent`);
 //! 2. failure legs of the vendored and hosted rollback (unknown-backend
-//!    revert failure, ledger save/persist failure, replay refusal,
-//!    per-purl revert I/O failure, corrupt ledgers);
+//!    revert failure, ledger save failure, per-pin upstream-restore
+//!    refusals, lockfile write failure, pre-v5 hosted ledger retirement);
 //! 3. GC-failure warnings (unix permissions);
 //! 4. manifest-write failure (macOS immutable flag);
 //! 5. the interactive confirm DECLINE (PTY-driven, like
@@ -19,18 +19,16 @@
 //!
 //! Binary-driven throughout (the `rollback_duality_invariants.rs` shape):
 //! `SOCKET_*`-scrubbed child processes via `common::run`, hand-written
-//! camelCase manifests, git-sha256 oracle, `--offline` everywhere. Hosted
-//! ledgers are serialized through the real `RedirectState`/`FileEdit`
-//! types so fixtures can never drift from the on-disk schema (the
-//! `in_process_rollback_hosted.rs` convention).
+//! camelCase manifests, git-sha256 oracle, `--offline` everywhere except the
+//! hosted leg: v5 hosted state is the lockfile pins themselves, and their
+//! rollback restores the upstream registry entry from a mock npm registry
+//! (`SOCKET_NPM_REGISTRY`, see `NpmRegistry`).
 
 #[path = "common/pty_io.rs"]
 mod pty_io;
 use std::path::{Path, PathBuf};
 
 use serde_json::{json, Value};
-use socket_patch_core::manifest::schema::{PatchFileInfo, PatchRecord};
-use socket_patch_core::patch::redirect::{FileEdit, RedirectState};
 
 #[path = "common/mod.rs"]
 mod common;
@@ -149,8 +147,6 @@ struct PatchedFixture {
     purl: &'static str,
     before: &'static [u8],
     after: &'static [u8],
-    before_hash: String,
-    after_hash: String,
 }
 
 fn patched_fixture() -> PatchedFixture {
@@ -179,8 +175,6 @@ fn patched_fixture() -> PatchedFixture {
         purl,
         before,
         after,
-        before_hash,
-        after_hash,
     }
 }
 
@@ -1350,73 +1344,134 @@ fn qualified_manifest_purl_removed_after_vendored_revert() {
 }
 
 // ═════════════════════════ 3. hosted-leg gaps ══════════════════════════════
+//
+// v5 hosted mode keeps no ledger: the hosted pins are discovered from the
+// lockfiles (on `--patch-server-url`'s origin for these mock-host URLs) and
+// rollback restores each pin's DEFAULT UPSTREAM registry entry, re-resolved
+// from the (mocked) npm registry. A pre-v5 ledger is never replayed; it is
+// retired once no hosted pin remains.
 
 const LP_PURL: &str = "pkg:npm/left-pad@1.2.3";
-const LP_UUID: &str = "55555555-5555-4555-8555-555555555555";
 const LP_HOSTED_URL: &str = "http://patch.test/patch/npm/left-pad/1.2.3/66666666-6666-4666-8666-666666666666/55555555-5555-4555-8555-555555555555/left-pad-1.2.3.tgz";
-const GEM_PURL: &str = "pkg:gem/rex@1.0.0";
-const GEM_UUID: &str = "77777777-7777-4777-8777-777777777777";
-const GEM_UPSTREAM_REMOTE: &str = "https://rubygems.org/";
-const GEM_PATCH_REMOTE: &str = "http://patch.test/gems/t0k3nt0k3n/";
-
-/// A full camelCase patch record for hand-written ledgers.
-fn hosted_record(uuid: &str) -> PatchRecord {
-    let mut files = std::collections::HashMap::new();
-    files.insert(
-        "package/index.js".to_string(),
-        PatchFileInfo {
-            before_hash: "a".repeat(64),
-            after_hash: "b".repeat(64),
-        },
-    );
-    PatchRecord {
-        uuid: uuid.to_string(),
-        exported_at: "2024-01-01T00:00:00Z".to_string(),
-        files,
-        vulnerabilities: std::collections::HashMap::new(),
-        description: "x".to_string(),
-        license: "MIT".to_string(),
-        tier: "free".to_string(),
+const IO_PURL: &str = "pkg:npm/is-odd@3.0.1";
+const IO_HOSTED_URL: &str = "http://patch.test/patch/npm/is-odd/3.0.1/66666666-6666-4666-8666-666666666666/99999999-9999-4999-8999-999999999999/is-odd-3.0.1.tgz";
+const PATCH_SERVER: &str = "http://patch.test";
+const UPSTREAM_INTEGRITY: &str = "sha512-UPSTREAMupstream==";
+
+/// A mock npm registry (the `SOCKET_NPM_REGISTRY` override the upstream
+/// restore reads) serving the version document of each `(name, version)`
+/// it was started with; everything else is a 404. The server runs on
+/// wiremock's own thread; the runtime is kept only to own it.
+struct NpmRegistry {
+    server: wiremock::MockServer,
+    _rt: tokio::runtime::Runtime,
+}
+
+impl NpmRegistry {
+    fn start(served: &[(&str, &str)]) -> Self {
+        use wiremock::matchers::{method, path};
+        use wiremock::{Mock, MockServer, ResponseTemplate};
+        let rt = tokio::runtime::Runtime::new().expect("tokio runtime");
+        let server = rt.block_on(async {
+            let server = MockServer::start().await;
+            for (name, version) in served {
+                Mock::given(method("GET"))
+                    .and(path(format!("/npm/{name}/{version}")))
+                    .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+                        "name": name,
+                        "version": version,
+                        "dist": {
+                            "tarball": format!(
+                                "https://registry.yarnpkg.com/{name}/-/{name}-{version}.tgz"
+                            ),
+                            "shasum": "aaaa",
+                            "integrity": UPSTREAM_INTEGRITY,
+                        }
+                    })))
+                    .mount(&server)
+                    .await;
+            }
+            server
+        });
+        Self { server, _rt: rt }
+    }
+
+    fn base(&self) -> String {
+        format!("{}/npm", self.server.uri())
+    }
+
+    fn request_count(&self) -> usize {
+        self._rt
+            .block_on(self.server.received_requests())
+            .map(|r| r.len())
+            .unwrap_or(0)
     }
 }
 
-/// Serialize a hand-written ledger through the real core types (real
-/// schema: version, mode "hosted", edits[FileEdit], records{purl:record}).
-fn write_hosted_ledger(root: &Path, records: Vec<(&str, PatchRecord)>, edits: Vec<FileEdit>) {
-    let mut state = RedirectState::new();
-    state.edits = edits;
-    for (purl, record) in records {
-        state.records.insert(purl.to_string(), record);
+/// `common::run` with the mock patch host recognized as hosted
+/// (`--patch-server-url`) and, when given, the npm registry pointed at the
+/// mock.
+fn run_hosted(cwd: &Path, args: &[&str], registry: Option<&NpmRegistry>) -> (i32, String, String) {
+    let mut full: Vec<&str> = args.to_vec();
+    full.extend(["--patch-server-url", PATCH_SERVER]);
+    match registry {
+        Some(r) => {
+            let base = r.base();
+            common::run_with_env(cwd, &full, &[("SOCKET_NPM_REGISTRY", base.as_str())])
+        }
+        None => run(cwd, &full),
     }
-    let vendor_dir = root.join(".socket/vendor");
-    std::fs::create_dir_all(&vendor_dir).expect("create .socket/vendor");
-    let mut bytes = serde_json::to_vec_pretty(&state).expect("serialize ledger");
-    bytes.push(b'\n');
-    std::fs::write(vendor_dir.join("redirect-state.json"), bytes).expect("write ledger");
 }
 
 fn ledger_path(root: &Path) -> PathBuf {
     root.join(".socket/vendor/redirect-state.json")
 }
 
-// yarn-classic fragments — `redirect_yarn_classic_entry` is a text kind the
-// per-purl npm revert claims by `<name>@<version>` key.
+/// Write a pre-v5 hosted ledger (v5 never writes one) with the given raw
+/// `edits`, exactly as an old release serialized it.
+fn write_legacy_ledger(root: &Path, edits: Value) {
+    let vendor_dir = root.join(".socket/vendor");
+    std::fs::create_dir_all(&vendor_dir).expect("create .socket/vendor");
+    let ledger = json!({
+        "version": 1,
+        "mode": "hosted",
+        "edits": edits,
+        "records": {},
+    });
+    let mut bytes = serde_json::to_vec_pretty(&ledger).expect("serialize ledger");
+    bytes.push(b'\n');
+    std::fs::write(vendor_dir.join("redirect-state.json"), bytes).expect("write ledger");
+}
+
+// yarn-classic fragments: the upstream block is exactly what the restore
+// re-derives from the mock registry's version document.
 
-fn yarn_block(resolved: &str, integrity: &str) -> String {
+fn yarn_block_for(name: &str, version: &str, resolved: &str, integrity: &str) -> String {
     format!(
-        "left-pad@1.2.3:\n  version \"1.2.3\"\n  resolved \"{resolved}\"\n  integrity {integrity}"
+        "{name}@{version}:\n  version \"{version}\"\n  resolved \"{resolved}\"\n  integrity {integrity}"
     )
 }
 
-fn yarn_original_block() -> String {
-    yarn_block(
-        "https://registry.yarnpkg.com/left-pad/-/left-pad-1.2.3.tgz#aaaa",
-        "sha512-UPSTREAMupstream==",
+fn yarn_upstream_block_for(name: &str, version: &str) -> String {
+    yarn_block_for(
+        name,
+        version,
+        &format!("https://registry.yarnpkg.com/{name}/-/{name}-{version}.tgz#aaaa"),
+        UPSTREAM_INTEGRITY,
     )
 }
 
+fn yarn_original_block() -> String {
+    yarn_upstream_block_for("left-pad", "1.2.3")
+}
+
 fn yarn_redirected_block() -> String {
-    yarn_block(LP_HOSTED_URL, "sha512-PATCHEDpatched==")
+    yarn_block_for(
+        "left-pad",
+        "1.2.3",
+        LP_HOSTED_URL,
+        "sha512-PATCHEDpatched==",
+    )
 }
 
 fn yarn_lock_content(block: &str) -> String {
@@ -1426,99 +1481,42 @@ fn yarn_lock_content(block: &str) -> String {
     )
 }
 
-fn yarn_classic_edit() -> FileEdit {
-    FileEdit {
-        path: "yarn.lock".to_string(),
-        kind: "redirect_yarn_classic_entry".to_string(),
-        action: "rewritten".to_string(),
-        key: Some("left-pad@1.2.3".to_string()),
-        original: Some(Value::String(yarn_original_block())),
-        new: Some(Value::String(yarn_redirected_block())),
-    }
-}
-
-// gem fragments — `redirect_gemfile_lock_source_url` has NO per-purl revert.
-
-fn gemfile_lock_content(remote: &str) -> String {
-    format!(
-        "GEM\n  remote: {remote}\n  specs:\n    rex (1.0.0)\n\n\
-         PLATFORMS\n  ruby\n\nDEPENDENCIES\n  rex\n\nBUNDLED WITH\n   2.5.9\n"
-    )
-}
-
-fn gem_source_edit() -> FileEdit {
-    FileEdit {
-        path: "Gemfile.lock".to_string(),
-        kind: "redirect_gemfile_lock_source_url".to_string(),
-        action: "rewritten".to_string(),
-        key: Some("rex".to_string()),
-        original: Some(Value::String(GEM_UPSTREAM_REMOTE.to_string())),
-        new: Some(Value::String(GEM_PATCH_REMOTE.to_string())),
-    }
-}
-
-/// Single-record npm fixture (yarn-classic wiring, redirected on disk).
+/// Single-pin npm fixture: a yarn.lock hosted-wired to the mock patch host.
 fn write_single_npm_fixture(root: &Path) {
     std::fs::write(
         root.join("yarn.lock"),
         yarn_lock_content(&yarn_redirected_block()),
     )
     .unwrap();
-    write_hosted_ledger(
-        root,
-        vec![(LP_PURL, hosted_record(LP_UUID))],
-        vec![yarn_classic_edit()],
-    );
 }
 
-/// Two-record fixture: npm (per-purl revertable) + gem (replay-only).
-fn write_two_record_fixture(root: &Path) {
-    std::fs::write(
-        root.join("yarn.lock"),
-        yarn_lock_content(&yarn_redirected_block()),
-    )
-    .unwrap();
-    std::fs::write(
-        root.join("Gemfile.lock"),
-        gemfile_lock_content(GEM_PATCH_REMOTE),
-    )
-    .unwrap();
-    write_hosted_ledger(
-        root,
-        vec![
-            (LP_PURL, hosted_record(LP_UUID)),
-            (GEM_PURL, hosted_record(GEM_UUID)),
-        ],
-        vec![yarn_classic_edit(), gem_source_edit()],
-    );
-}
-
-/// Human wet run over a hosted-only (manifest-less) project: the wet
-/// "Unwound hosted redirect for {purl}" line and the reinstall note — with
-/// the wiring actually unwound, the emptied ledger deleted and no
+/// Human wet run over a hosted-only (manifest-less, ledger-less) project:
+/// the "Restored {purl} to its upstream registry entry" line and the
+/// reinstall note — with the lock entry actually restored and no
 /// `.socket/` residue. The unscoped "No patches found in manifest" line is
 /// reserved for a run with no work in ANY leg: a project whose patches are
-/// all hosted has work, so the line must NOT print alongside the unwind.
+/// all hosted has work, so the line must NOT print alongside the restore.
 #[test]
 fn hosted_human_wet_announces_and_unwinds() {
     let tmp = tempfile::tempdir().expect("tempdir");
     write_single_npm_fixture(tmp.path());
+    let registry = NpmRegistry::start(&[("left-pad", "1.2.3")]);
 
-    let (code, stdout, stderr) = run(tmp.path(), &["rollback", "--offline", "--yes"]);
+    let (code, stdout, stderr) = run_hosted(tmp.path(), &["rollback", "--yes"], Some(&registry));
     assert_eq!(
         code, 0,
         "the hosted-only rollback succeeds; stdout=\n{stdout}\nstderr=\n{stderr}"
     );
-    // No manifest at all: "No patches found in manifest" would be a
-    // misleading line right above the hosted unwind.
     assert!(
         !stdout.contains("No patches found in manifest"),
         "the empty-manifest announce must not print when the hosted leg has work; \
          stdout=\n{stdout}"
     );
     assert!(
-        stdout.contains(&format!("Unwound hosted redirect for {LP_PURL}")),
-        "the wet unwind line must print; stdout=\n{stdout}"
+        stdout.contains(&format!(
+            "Restored {LP_PURL} to its upstream registry entry"
+        )),
+        "the wet restore line must print; stdout=\n{stdout}"
     );
     assert!(
         stdout.contains("1 unwired package keeps its patched bytes"),
@@ -1527,238 +1525,312 @@ fn hosted_human_wet_announces_and_unwinds() {
     assert_eq!(
         std::fs::read_to_string(tmp.path().join("yarn.lock")).unwrap(),
         yarn_lock_content(&yarn_original_block()),
-        "the wiring must be unwound on disk"
+        "the lock entry must be restored to the upstream registry entry"
     );
     assert!(
         !ledger_path(tmp.path()).exists(),
-        "the emptied ledger must be deleted"
+        "no ledger is ever written"
     );
     assert!(
         !tmp.path().join(".socket").exists(),
-        "a fully unwound hosted project keeps no .socket/ residue (vendor/ pruned \
-         with the ledger, apply.lock removed by the lock guard)"
+        "a fully restored hosted project keeps no .socket/ residue (apply.lock \
+         removed by the lock guard)"
     );
 }
 
-/// Human dry-run twin: "Would unwind hosted redirect for {purl}", nothing
-/// mutated.
+/// Human dry-run twin: "Would restore {purl} …", nothing mutated. A dry
+/// run resolves exactly like a wet run (the registry IS asked) and skips
+/// only the write.
 #[test]
 fn hosted_human_dry_run_previews() {
     let tmp = tempfile::tempdir().expect("tempdir");
     write_single_npm_fixture(tmp.path());
-    let ledger_before = std::fs::read(ledger_path(tmp.path())).unwrap();
+    let registry = NpmRegistry::start(&[("left-pad", "1.2.3")]);
 
-    let (code, stdout, stderr) = run(tmp.path(), &["rollback", "--offline", "--dry-run"]);
+    let (code, stdout, stderr) =
+        run_hosted(tmp.path(), &["rollback", "--dry-run"], Some(&registry));
     assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
     assert!(
-        stdout.contains(&format!("Would unwind hosted redirect for {LP_PURL}")),
-        "the dry-run unwind preview must print; stdout=\n{stdout}"
+        stdout.contains(&format!(
+            "Would restore {LP_PURL} to its upstream registry entry"
+        )),
+        "the dry-run restore preview must print; stdout=\n{stdout}"
+    );
+    assert!(
+        registry.request_count() >= 1,
+        "a dry run resolves the upstream entry like a wet run"
     );
     assert_eq!(
         std::fs::read_to_string(tmp.path().join("yarn.lock")).unwrap(),
         yarn_lock_content(&yarn_redirected_block()),
         "dry run must not touch the wired lock"
     );
-    assert_eq!(
-        std::fs::read(ledger_path(tmp.path())).unwrap(),
-        ledger_before,
-        "dry run must not touch the ledger"
-    );
+    assert!(!tmp.path().join(".socket").exists(), "no .socket/ residue");
 }
 
-/// Human notice for a SCOPED hosted target with no per-purl revert (gem,
-/// with an out-of-scope npm record blocking the replay): the "Cannot
-/// unwind hosted redirect for …" stderr guidance, exit 1, nothing touched.
+/// `--offline` cannot re-resolve the upstream entry: the pin is REFUSED
+/// with the `git checkout` remedy on stderr (human), exit 1, nothing
+/// written — the registry is never asked.
 #[test]
-fn scoped_unsupported_ecosystem_prints_human_notice() {
+fn offline_refusal_prints_human_notice() {
     let tmp = tempfile::tempdir().expect("tempdir");
-    write_two_record_fixture(tmp.path());
-    let ledger_before = std::fs::read(ledger_path(tmp.path())).unwrap();
+    write_single_npm_fixture(tmp.path());
+    let registry = NpmRegistry::start(&[("left-pad", "1.2.3")]);
 
-    let (code, stdout, stderr) = run(tmp.path(), &["rollback", "--offline", "--yes", GEM_PURL]);
+    let (code, stdout, stderr) = run_hosted(
+        tmp.path(),
+        &["rollback", "--offline", "--yes", LP_PURL],
+        Some(&registry),
+    );
     assert_eq!(
         code, 1,
-        "a scoped unsupported hosted purl fails closed; stdout=\n{stdout}\nstderr=\n{stderr}"
+        "an offline hosted restore is refused; stdout=\n{stdout}\nstderr=\n{stderr}"
     );
     assert!(
-        stderr.contains(&format!("Cannot unwind hosted redirect for {GEM_PURL}"))
-            && stderr.contains("no per-purl revert exists"),
-        "the human guidance must print on stderr; stderr=\n{stderr}"
-    );
-    assert_eq!(
-        std::fs::read(ledger_path(tmp.path())).unwrap(),
-        ledger_before,
-        "the ledger must be untouched"
+        stderr.contains(&format!(
+            "Error: Cannot restore {LP_PURL} to its upstream registry entry"
+        )) && stderr.contains("this run is offline")
+            && stderr.contains("`git checkout -- yarn.lock`"),
+        "the human refusal must print on stderr with the remedy; stderr=\n{stderr}"
     );
+    assert_eq!(registry.request_count(), 0, "offline asks no registry");
     assert_eq!(
-        std::fs::read_to_string(tmp.path().join("Gemfile.lock")).unwrap(),
-        gemfile_lock_content(GEM_PATCH_REMOTE),
-        "the refused gem wiring must be untouched"
+        std::fs::read_to_string(tmp.path().join("yarn.lock")).unwrap(),
+        yarn_lock_content(&yarn_redirected_block()),
+        "the refused pin's wiring must be untouched"
     );
 }
 
-/// Per-purl hosted revert FAILURE: the wired lockfile is unreadable
-/// (yarn.lock is a directory), so the scoped npm revert errors — the purl
-/// + error land in `hosted.failed`, exit 1, everything else untouched.
+/// Two pins in one yarn.lock, one of which the registry does not answer
+/// for: each pin restores or refuses on its own. The refused purl + error
+/// land in `hosted.failed` (exit 1, `partial_failure`), the other pin is
+/// restored, and the refused block stays hosted byte-for-byte.
 #[test]
 fn per_purl_revert_failure_lands_in_hosted_failed() {
     let tmp = tempfile::tempdir().expect("tempdir");
-    // Two records so the scoped npm run is NOT replay-eligible: the
-    // failure under test is the per-purl revert alone.
-    std::fs::create_dir(tmp.path().join("yarn.lock")).unwrap(); // a DIRECTORY
+    let io_redirected = yarn_block_for("is-odd", "3.0.1", IO_HOSTED_URL, "sha512-PATCHEDio==");
     std::fs::write(
-        tmp.path().join("Gemfile.lock"),
-        gemfile_lock_content(GEM_PATCH_REMOTE),
+        tmp.path().join("yarn.lock"),
+        yarn_lock_content(&format!("{io_redirected}\n\n{}", yarn_redirected_block())),
     )
     .unwrap();
-    write_hosted_ledger(
-        tmp.path(),
-        vec![
-            (LP_PURL, hosted_record(LP_UUID)),
-            (GEM_PURL, hosted_record(GEM_UUID)),
-        ],
-        vec![yarn_classic_edit(), gem_source_edit()],
-    );
-    let ledger_before = std::fs::read(ledger_path(tmp.path())).unwrap();
+    // left-pad is NOT served: its lookup 404s.
+    let registry = NpmRegistry::start(&[("is-odd", "3.0.1")]);
 
-    let (code, stdout, stderr) = run(
+    let (code, stdout, stderr) = run_hosted(
         tmp.path(),
-        &["rollback", "--json", "--offline", "--yes", LP_PURL],
+        &["rollback", "--json", "--yes"],
+        Some(&registry),
     );
     assert_eq!(
         code, 1,
-        "a failed per-purl revert must exit 1; stdout=\n{stdout}\nstderr=\n{stderr}"
+        "a refused pin must exit 1; stdout=\n{stdout}\nstderr=\n{stderr}"
     );
     let v = parse_envelope(&stdout, &stderr);
     assert_eq!(v["status"], "partial_failure", "stdout=\n{stdout}");
     let failed = v["hosted"]["failed"].as_array().expect("failed array");
     assert_eq!(failed.len(), 1, "stdout=\n{stdout}");
     assert_eq!(failed[0]["purl"], LP_PURL, "stdout=\n{stdout}");
+    let error = failed[0]["error"].as_str().unwrap_or_default();
     assert!(
-        failed[0]["error"]
-            .as_str()
-            .is_some_and(|e| e.contains("read yarn.lock")),
-        "the error must name the unreadable lockfile; stdout=\n{stdout}"
+        error.contains(&format!(
+            "cannot restore {LP_PURL} to its upstream registry entry"
+        )) && error.contains("404")
+            && error.contains("git checkout -- yarn.lock"),
+        "the error must name the purl, the registry failure and the remedy; \
+         stdout=\n{stdout}"
     );
     assert_eq!(
         v["hosted"]["reverted"],
-        json!([]),
-        "nothing may be reported reverted; stdout=\n{stdout}"
+        json!([IO_PURL]),
+        "the other pin restores on its own; stdout=\n{stdout}"
     );
     assert_eq!(
-        std::fs::read(ledger_path(tmp.path())).unwrap(),
-        ledger_before,
-        "a failed revert must leave the ledger byte-identical"
+        std::fs::read_to_string(tmp.path().join("yarn.lock")).unwrap(),
+        yarn_lock_content(&format!(
+            "{}\n\n{}",
+            yarn_upstream_block_for("is-odd", "3.0.1"),
+            yarn_redirected_block()
+        )),
+        "only the resolvable pin is restored; the refused one stays hosted"
     );
+}
+
+/// Human twin of `per_purl_revert_failure_lands_in_hosted_failed`: the
+/// refused pin prints the "Error: Cannot restore {purl} …" stderr line
+/// (errors print even without `--json`), exit 1, the lock untouched.
+#[test]
+fn per_purl_revert_failure_prints_human_stderr_line() {
+    let tmp = tempfile::tempdir().expect("tempdir");
+    write_single_npm_fixture(tmp.path());
+    let registry = NpmRegistry::start(&[]);
+
+    let (code, stdout, stderr) =
+        run_hosted(tmp.path(), &["rollback", "--yes", LP_PURL], Some(&registry));
     assert_eq!(
-        std::fs::read_to_string(tmp.path().join("Gemfile.lock")).unwrap(),
-        gemfile_lock_content(GEM_PATCH_REMOTE),
-        "the out-of-scope gem wiring must be untouched"
+        code, 1,
+        "a refused pin must exit 1; stdout=\n{stdout}\nstderr=\n{stderr}"
+    );
+    assert!(
+        stderr.contains(&format!(
+            "Error: Cannot restore {LP_PURL} to its upstream registry entry:"
+        )),
+        "the human failure line must print on stderr; stderr=\n{stderr}"
+    );
+    assert_eq!(
+        std::fs::read_to_string(tmp.path().join("yarn.lock")).unwrap(),
+        yarn_lock_content(&yarn_redirected_block()),
+        "a refused pin leaves the lock byte-identical"
     );
 }
 
-/// The whole-ledger replay REFUSAL loop: a leftover edit with an unsafe
-/// path refuses its group — `group:<name>` failure entries in the JSON,
-/// the "Cannot unwind hosted redirect edits" stderr line in human mode,
-/// exit 1, ledger intact.
+/// A pre-v5 ledger's edits are NEVER replayed: a ledger whose only content
+/// is an edit naming an unsafe path (the old replay refused such a group)
+/// is simply retired — no lockfile pins a hosted patch, so rollback removes
+/// the stale file and exits 0 (`legacyRedirectLedgerRemoved`), and the
+/// edit's target is never touched. Human mode says so on stdout.
 #[test]
-fn replay_refusal_reports_group_failures_in_both_modes() {
-    let evil_edit = || FileEdit {
-        path: "../evil.lock".to_string(),
-        kind: "redirect_yarn_classic_entry".to_string(),
-        action: "rewritten".to_string(),
-        key: Some("left-pad@1.2.3".to_string()),
-        original: Some(Value::String(yarn_original_block())),
-        new: Some(Value::String(yarn_redirected_block())),
+fn legacy_ledger_edits_are_never_replayed_in_both_modes() {
+    let edits = || {
+        json!([{
+            "path": "../evil.lock",
+            "kind": "redirect_yarn_classic_entry",
+            "action": "rewritten",
+            "key": "left-pad@1.2.3",
+            "original": yarn_original_block(),
+            "new": yarn_redirected_block(),
+        }])
     };
 
     // ── --json ──
     let tmp = tempfile::tempdir().expect("tempdir");
-    write_hosted_ledger(tmp.path(), vec![], vec![evil_edit()]);
-    let ledger_before = std::fs::read(ledger_path(tmp.path())).unwrap();
+    let project = tmp.path().join("project");
+    std::fs::create_dir(&project).unwrap();
+    let evil = tmp.path().join("evil.lock");
+    std::fs::write(&evil, yarn_lock_content(&yarn_redirected_block())).unwrap();
+    write_legacy_ledger(&project, edits());
 
-    let (code, stdout, stderr) = run(tmp.path(), &["rollback", "--json", "--offline", "--yes"]);
+    let (code, stdout, stderr) = run_hosted(&project, &["rollback", "--json", "--yes"], None);
     assert_eq!(
-        code, 1,
-        "a replay refusal must exit 1; stdout=\n{stdout}\nstderr=\n{stderr}"
+        code, 0,
+        "a stale pre-v5 ledger is retired, not replayed; stdout=\n{stdout}\nstderr=\n{stderr}"
     );
     let v = parse_envelope(&stdout, &stderr);
-    assert_eq!(v["status"], "partial_failure", "stdout=\n{stdout}");
-    let failed = v["hosted"]["failed"].as_array().expect("failed array");
-    assert_eq!(failed.len(), 1, "stdout=\n{stdout}");
-    assert_eq!(
-        failed[0]["purl"], "group:yarn",
-        "the refusal is reported per group; stdout=\n{stdout}"
-    );
+    assert_eq!(v["status"], "success", "stdout=\n{stdout}");
+    assert_eq!(v["legacyRedirectLedgerRemoved"], true, "stdout=\n{stdout}");
     assert!(
-        failed[0]["error"]
-            .as_str()
-            .is_some_and(|e| e.contains("unsafe path") && e.contains("../evil.lock")),
-        "the refusal must name the reason and the file; stdout=\n{stdout}"
+        !ledger_path(&project).exists(),
+        "the stale ledger is deleted"
     );
     assert_eq!(
-        std::fs::read(ledger_path(tmp.path())).unwrap(),
-        ledger_before,
-        "a refused replay must leave the ledger byte-identical"
+        std::fs::read_to_string(&evil).unwrap(),
+        yarn_lock_content(&yarn_redirected_block()),
+        "a legacy ledger's edit is never replayed"
     );
 
     // ── human ──
     let tmp = tempfile::tempdir().expect("tempdir");
-    write_hosted_ledger(tmp.path(), vec![], vec![evil_edit()]);
-    let (code, stdout, stderr) = run(tmp.path(), &["rollback", "--offline", "--yes"]);
-    assert_eq!(code, 1, "stdout=\n{stdout}\nstderr=\n{stderr}");
+    write_legacy_ledger(tmp.path(), edits());
+    let (code, stdout, stderr) = run_hosted(tmp.path(), &["rollback", "--yes"], None);
+    assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
     assert!(
-        stderr.contains("Cannot unwind hosted redirect edits (yarn)"),
-        "the human refusal line must print on stderr; stderr=\n{stderr}"
+        stdout.contains(
+            "Removed the pre-v5 hosted ledger .socket/vendor/redirect-state.json: no \
+             lockfile pins a hosted patch."
+        ),
+        "the human retire line must print; stdout=\n{stdout}"
     );
+    assert!(!ledger_path(tmp.path()).exists());
 }
 
-/// A records-EMPTY ledger with leftover edits (the degraded
-/// record-fetch-failed shape): an unscoped wet run replays the edits —
-/// the confirm clause for leftover edits composes on the way — restoring
-/// the wired file and deleting the emptied ledger.
+/// A pre-v5 ledger beside a live hosted pin: the pin is restored from the
+/// registry (never from the ledger's recorded original), and the ledger is
+/// retired once no pin remains. Offline, the ledger's recorded original is
+/// NOT a fallback: the pin is refused, and the ledger stays while the pin
+/// is still wired.
 #[test]
-fn leftover_edits_only_ledger_replays_unscoped() {
+fn legacy_ledger_beside_a_live_pin_is_never_the_revert_source() {
+    let legacy_edits = || {
+        json!([{
+            "path": "yarn.lock",
+            "kind": "redirect_yarn_classic_entry",
+            "action": "rewritten",
+            "key": "left-pad@1.2.3",
+            // A recorded "original" the registry disagrees with: a replay
+            // would write it; the restore must not.
+            "original": yarn_block_for(
+                "left-pad", "1.2.3",
+                "https://registry.yarnpkg.com/left-pad/-/left-pad-1.2.3.tgz#bbbb",
+                "sha512-LEDGERledger==",
+            ),
+            "new": yarn_redirected_block(),
+        }])
+    };
+
+    // Offline: refused, nothing written, ledger kept.
     let tmp = tempfile::tempdir().expect("tempdir");
-    std::fs::write(
-        tmp.path().join("yarn.lock"),
+    write_single_npm_fixture(tmp.path());
+    write_legacy_ledger(tmp.path(), legacy_edits());
+    let ledger_before = std::fs::read(ledger_path(tmp.path())).unwrap();
+    let (code, stdout, stderr) = run_hosted(
+        tmp.path(),
+        &["rollback", "--json", "--offline", "--yes"],
+        None,
+    );
+    assert_eq!(code, 1, "stdout=\n{stdout}\nstderr=\n{stderr}");
+    let v = parse_envelope(&stdout, &stderr);
+    assert_eq!(v["status"], "partial_failure", "stdout=\n{stdout}");
+    assert_eq!(
+        v["hosted"]["failed"][0]["purl"], LP_PURL,
+        "stdout=\n{stdout}"
+    );
+    assert_eq!(v["hosted"]["reverted"], json!([]), "stdout=\n{stdout}");
+    assert_eq!(
+        std::fs::read_to_string(tmp.path().join("yarn.lock")).unwrap(),
         yarn_lock_content(&yarn_redirected_block()),
-    )
-    .unwrap();
-    write_hosted_ledger(tmp.path(), vec![], vec![yarn_classic_edit()]);
-
-    let (code, stdout, stderr) = run(tmp.path(), &["rollback", "--json", "--offline", "--yes"]);
+        "the ledger's recorded original is never replayed"
+    );
     assert_eq!(
-        code, 0,
-        "the leftover-edits replay succeeds; stdout=\n{stdout}\nstderr=\n{stderr}"
+        std::fs::read(ledger_path(tmp.path())).unwrap(),
+        ledger_before,
+        "the ledger stays while a pin is still wired"
     );
+
+    // Online: restored from the registry, ledger retired.
+    let registry = NpmRegistry::start(&[("left-pad", "1.2.3")]);
+    let (code, stdout, stderr) = run_hosted(
+        tmp.path(),
+        &["rollback", "--json", "--yes"],
+        Some(&registry),
+    );
+    assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
     let v = parse_envelope(&stdout, &stderr);
     assert_eq!(v["status"], "success", "stdout=\n{stdout}");
+    assert_eq!(
+        v["hosted"]["reverted"],
+        json!([LP_PURL]),
+        "stdout=\n{stdout}"
+    );
     assert!(
         v["hosted"]["editedFiles"].as_u64().unwrap_or(0) >= 1,
-        "the replay rewrote the lock; stdout=\n{stdout}"
+        "the restore rewrote the lock; stdout=\n{stdout}"
     );
     assert_eq!(
         std::fs::read_to_string(tmp.path().join("yarn.lock")).unwrap(),
         yarn_lock_content(&yarn_original_block()),
-        "the leftover edit must be replayed"
+        "the entry comes back from the registry, not the ledger"
     );
     assert!(
         !ledger_path(tmp.path()).exists(),
-        "the emptied ledger must be deleted"
-    );
-    assert!(
-        !tmp.path().join(".socket").exists(),
-        "the replayed-out project keeps no .socket/ residue"
+        "with no hosted pin left the pre-v5 ledger is retired"
     );
 }
 
-/// A corrupt redirect ledger skips ONLY the hosted leg: exit 1 with the
-/// `redirect_state_unreadable` warning (JSON) / `Error
-/// (redirect_state_unreadable):` notice (human), and the garbage file is
-/// left in place for quarantine.
+/// A corrupt pre-v5 ledger is inert: a project whose only state is that
+/// garbage file retires it and exits 0 in both modes (it is never parsed,
+/// so it can never fail the run).
 #[test]
-fn corrupt_redirect_ledger_warns_and_fails_in_both_modes() {
+fn corrupt_legacy_ledger_is_retired_in_both_modes() {
     let corrupt = || {
         let tmp = tempfile::tempdir().expect("tempdir");
         let vendor_dir = tmp.path().join(".socket/vendor");
@@ -1771,103 +1843,77 @@ fn corrupt_redirect_ledger_warns_and_fails_in_both_modes() {
     let tmp = corrupt();
     let (code, stdout, stderr) = run(tmp.path(), &["rollback", "--json", "--offline", "--yes"]);
     assert_eq!(
-        code, 1,
-        "a corrupt redirect ledger must exit 1; stdout=\n{stdout}\nstderr=\n{stderr}"
+        code, 0,
+        "a corrupt pre-v5 ledger never fails the run; stdout=\n{stdout}\nstderr=\n{stderr}"
     );
     let v = parse_envelope(&stdout, &stderr);
-    assert_eq!(v["status"], "partial_failure", "stdout=\n{stdout}");
+    assert_eq!(v["status"], "success", "stdout=\n{stdout}");
+    assert_eq!(v["legacyRedirectLedgerRemoved"], true, "stdout=\n{stdout}");
+    assert!(!ledger_path(tmp.path()).exists());
+
+    // ── human dry run: previewed, kept ──
+    let tmp = corrupt();
+    let (code, stdout, stderr) = run(tmp.path(), &["rollback", "--offline", "--dry-run"]);
+    assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
     assert!(
-        warning_codes(&v).contains(&"redirect_state_unreadable".to_string()),
-        "the warning must be surfaced; stdout=\n{stdout}"
-    );
-    assert_eq!(
-        v["hosted"]["reverted"],
-        json!([]),
-        "the hosted leg must be skipped; stdout=\n{stdout}"
+        stdout.contains("Would remove the pre-v5 hosted ledger"),
+        "stdout=\n{stdout}"
     );
     assert_eq!(
         std::fs::read(ledger_path(tmp.path())).unwrap(),
         b"garbage not json",
-        "the corrupt ledger must be left in place for quarantine"
-    );
-
-    // ── human ──
-    let tmp = corrupt();
-    let (code, stdout, stderr) = run(tmp.path(), &["rollback", "--offline", "--yes"]);
-    assert_eq!(code, 1, "stdout=\n{stdout}\nstderr=\n{stderr}");
-    assert!(
-        stderr.contains("Error (redirect_state_unreadable):"),
-        "the error-class notice must print on stderr; stderr=\n{stderr}"
+        "a dry run deletes nothing"
     );
 }
 
 /// `--ecosystems` narrows the hosted leg: a pypi-scoped run leaves the npm
-/// record (and, being a scope, blocks the whole-ledger replay); an
-/// npm-scoped run unwinds it.
+/// pin; an npm-scoped run restores it.
 #[test]
 fn ecosystems_filter_narrows_hosted_scope() {
     let tmp = tempfile::tempdir().expect("tempdir");
     write_single_npm_fixture(tmp.path());
-    let ledger_before = std::fs::read(ledger_path(tmp.path())).unwrap();
+    let registry = NpmRegistry::start(&[("left-pad", "1.2.3")]);
 
-    let (code, stdout, stderr) = run(
+    let (code, stdout, stderr) = run_hosted(
         tmp.path(),
-        &[
-            "rollback",
-            "--json",
-            "--offline",
-            "--yes",
-            "--ecosystems",
-            "pypi",
-        ],
+        &["rollback", "--json", "--yes", "--ecosystems", "pypi"],
+        Some(&registry),
     );
     assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
     let v = parse_envelope(&stdout, &stderr);
     assert_eq!(
         v["hosted"]["reverted"],
         json!([]),
-        "a pypi-scoped run must not unwind the npm record; stdout=\n{stdout}"
-    );
-    assert_eq!(
-        std::fs::read(ledger_path(tmp.path())).unwrap(),
-        ledger_before,
-        "the record must survive the eco-narrowed run"
+        "a pypi-scoped run must not restore the npm pin; stdout=\n{stdout}"
     );
     assert_eq!(
         std::fs::read_to_string(tmp.path().join("yarn.lock")).unwrap(),
         yarn_lock_content(&yarn_redirected_block()),
-        "the wiring must survive too"
+        "the wiring must survive the eco-narrowed run"
     );
 
-    let (code, stdout, stderr) = run(
+    let (code, stdout, stderr) = run_hosted(
         tmp.path(),
-        &[
-            "rollback",
-            "--json",
-            "--offline",
-            "--yes",
-            "--ecosystems",
-            "npm",
-        ],
+        &["rollback", "--json", "--yes", "--ecosystems", "npm"],
+        Some(&registry),
     );
     assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
     let v = parse_envelope(&stdout, &stderr);
     assert_eq!(
         v["hosted"]["reverted"],
         json!([LP_PURL]),
-        "the npm-scoped run must unwind it; stdout=\n{stdout}"
+        "the npm-scoped run must restore it; stdout=\n{stdout}"
     );
     assert_eq!(
         std::fs::read_to_string(tmp.path().join("yarn.lock")).unwrap(),
         yarn_lock_content(&yarn_original_block()),
-        "the wiring must be unwound"
+        "the entry must be restored"
     );
-    assert!(!ledger_path(tmp.path()).exists(), "ledger deleted");
     assert!(!tmp.path().join(".socket").exists(), "no .socket/ residue");
 }
 
-/// A path-shaped target selects a HOSTED record through its installed
-/// copy: `rollback node_modules/left-pad` unwinds the redirect.
+/// A path-shaped target selects a HOSTED pin through its installed copy:
+/// `rollback node_modules/left-pad` restores the upstream entry.
 #[test]
 fn path_glob_selects_hosted_record() {
     let tmp = tempfile::tempdir().expect("tempdir");
@@ -1881,16 +1927,12 @@ fn path_glob_selects_hosted_record() {
         "1.2.3",
         b"installed bytes\n",
     );
+    let registry = NpmRegistry::start(&[("left-pad", "1.2.3")]);
 
-    let (code, stdout, stderr) = run(
+    let (code, stdout, stderr) = run_hosted(
         tmp.path(),
-        &[
-            "rollback",
-            "--json",
-            "--offline",
-            "--yes",
-            "node_modules/left-pad",
-        ],
+        &["rollback", "--json", "--yes", "node_modules/left-pad"],
+        Some(&registry),
     );
     assert_eq!(
         code, 0,
@@ -1900,117 +1942,165 @@ fn path_glob_selects_hosted_record() {
     assert_eq!(
         v["hosted"]["reverted"],
         json!([LP_PURL]),
-        "the path target must select the hosted record; stdout=\n{stdout}"
+        "the path target must select the hosted pin; stdout=\n{stdout}"
     );
     assert_eq!(
         std::fs::read_to_string(tmp.path().join("yarn.lock")).unwrap(),
         yarn_lock_content(&yarn_original_block()),
-        "the wiring must be unwound"
+        "the entry must be restored"
     );
-    assert!(!ledger_path(tmp.path()).exists(), "ledger deleted");
     assert!(!tmp.path().join(".socket").exists(), "no .socket/ residue");
 }
 
-/// `persist_redirect_state` FAILURE after the hosted leg mutated the
-/// ledger in memory: the replay rewrote the wired file, but the emptied
-/// ledger cannot be removed (read-only `.socket/vendor`) — the failure
-/// lands in `hosted.failed` as the `ledger` entry and the run exits 1.
+/// The restored lockfile cannot be written (a read-only project root; the
+/// write is an atomic temp-file + rename beside it): the failure lands in
+/// `hosted.failed` under the `files` key and the run exits 1, the lock
+/// untouched. (Skipped where the sandbox ignores directory modes, e.g. as
+/// root.)
 #[cfg(unix)]
 #[test]
-fn hosted_persist_failure_lands_in_hosted_failed() {
+fn hosted_restore_write_failure_lands_in_hosted_failed() {
     let tmp = tempfile::tempdir().expect("tempdir");
-    std::fs::write(
-        tmp.path().join("yarn.lock"),
-        yarn_lock_content(&yarn_redirected_block()),
-    )
-    .unwrap();
-    write_hosted_ledger(tmp.path(), vec![], vec![yarn_classic_edit()]);
-
-    let vendor_dir = tmp.path().join(".socket/vendor");
-    let guard = DirModeGuard::chmod(&vendor_dir, 0o555, 0o755);
-    if !readonly_dir_enforced(&vendor_dir) {
+    let project = tmp.path().join("project");
+    std::fs::create_dir(&project).unwrap();
+    write_single_npm_fixture(&project);
+    // `.socket/` exists and stays writable so the apply lock is taken.
+    std::fs::create_dir(project.join(".socket")).unwrap();
+    let registry = NpmRegistry::start(&[("left-pad", "1.2.3")]);
+
+    let guard = DirModeGuard::chmod(&project, 0o555, 0o755);
+    if !readonly_dir_enforced(&project) {
         return;
     }
-
-    let (code, stdout, stderr) = run(tmp.path(), &["rollback", "--json", "--offline", "--yes"]);
+    let (code, stdout, stderr) =
+        run_hosted(&project, &["rollback", "--json", "--yes"], Some(&registry));
     guard.restore();
 
     assert_eq!(
         code, 1,
-        "a ledger persist failure must exit 1; stdout=\n{stdout}\nstderr=\n{stderr}"
+        "a lockfile write failure must exit 1; stdout=\n{stdout}\nstderr=\n{stderr}"
     );
     let v = parse_envelope(&stdout, &stderr);
     assert_eq!(v["status"], "partial_failure", "stdout=\n{stdout}");
     let failed = v["hosted"]["failed"].as_array().expect("failed array");
     assert!(
-        failed.iter().any(|f| f["purl"] == "ledger"
+        failed.iter().any(|f| f["purl"] == "files"
             && f["error"]
                 .as_str()
-                .is_some_and(|e| e.contains("failed to persist the hosted redirect ledger"))),
-        "the persist failure must be reported under the 'ledger' key; stdout=\n{stdout}"
+                .is_some_and(|e| e.contains("writing the restored lockfiles failed"))),
+        "the write failure must be reported under the 'files' key; stdout=\n{stdout}"
     );
-    // The replay itself ran before the persist: the wired file is restored.
     assert_eq!(
-        std::fs::read_to_string(tmp.path().join("yarn.lock")).unwrap(),
-        yarn_lock_content(&yarn_original_block()),
-        "the replay's file writes land before the persist failure"
+        std::fs::read_to_string(project.join("yarn.lock")).unwrap(),
+        yarn_lock_content(&yarn_redirected_block()),
+        "the lock was never written"
+    );
+}
+
+/// Human twin of `hosted_restore_write_failure_lands_in_hosted_failed`:
+/// the "Error: Writing the restored lockfiles failed" stderr line, exit 1.
+#[cfg(unix)]
+#[test]
+fn hosted_restore_write_failure_prints_human_error_line() {
+    let tmp = tempfile::tempdir().expect("tempdir");
+    let project = tmp.path().join("project");
+    std::fs::create_dir(&project).unwrap();
+    write_single_npm_fixture(&project);
+    std::fs::create_dir(project.join(".socket")).unwrap();
+    let registry = NpmRegistry::start(&[("left-pad", "1.2.3")]);
+
+    let guard = DirModeGuard::chmod(&project, 0o555, 0o755);
+    if !readonly_dir_enforced(&project) {
+        return;
+    }
+    let (code, stdout, stderr) = run_hosted(&project, &["rollback", "--yes"], Some(&registry));
+    guard.restore();
+
+    assert_eq!(
+        code, 1,
+        "a lockfile write failure must exit 1; stdout=\n{stdout}\nstderr=\n{stderr}"
     );
     assert!(
-        ledger_path(tmp.path()).exists(),
-        "the un-removable ledger file must still be on disk"
+        stderr.contains("Error: Writing the restored lockfiles failed"),
+        "the human write-failure line must print on stderr; stderr=\n{stderr}"
     );
 }
 
-/// An unscoped Bun rollback stages its package edits together through
-/// whole-ledger replay. Its human confirmation prints from that deferred
-/// path after the original lockfile is restored.
-#[test]
-fn bun_deferred_purl_unwinds_via_replay() {
-    let bun_original =
-        r#"    "left-pad": ["left-pad@1.2.3", "", {}, "sha512-UPSTREAMupstream=="],"#;
-    // The engine's real redirected shape: registry 4-tuple → URL 3-tuple
-    // `["name@<url>", {deps}, "sha512-…"]` (the registry slot is dropped).
-    let bun_redirected = format!(
-        r#"    "left-pad": ["left-pad@{LP_HOSTED_URL}", {{}}, "sha512-PATCHEDpatched=="],"#
-    );
-    let bun_lock = |block: &str| {
-        format!("{{\n  \"lockfileVersion\": 1,\n  \"packages\": {{\n{block}\n  }}\n}}\n")
-    };
+fn bun_original_line() -> String {
+    format!(r#"    "left-pad": ["left-pad@1.2.3", "", {{}}, "{UPSTREAM_INTEGRITY}"],"#)
+}
 
+/// The engine's real redirected shape: registry 4-tuple → URL 3-tuple
+/// `["name@<url>", {deps}, "sha512-…"]` (the registry slot is dropped).
+fn bun_redirected_line() -> String {
+    format!(r#"    "left-pad": ["left-pad@{LP_HOSTED_URL}", {{}}, "sha512-PATCHEDpatched=="],"#)
+}
+
+fn bun_lock(line: &str) -> String {
+    format!("{{\n  \"lockfileVersion\": 1,\n  \"packages\": {{\n{line}\n  }}\n}}\n")
+}
+
+/// A hosted bun.lock pin restores to the registry 4-tuple
+/// `["name@version", "", {deps}, "<registry integrity>"]`, with the human
+/// restore line.
+#[test]
+fn bun_lock_pin_restores_to_the_registry_tuple() {
     let tmp = tempfile::tempdir().expect("tempdir");
-    std::fs::write(tmp.path().join("bun.lock"), bun_lock(&bun_redirected)).unwrap();
-    write_hosted_ledger(
-        tmp.path(),
-        vec![(LP_PURL, hosted_record(LP_UUID))],
-        vec![FileEdit {
-            path: "bun.lock".to_string(),
-            kind: "redirect_bun_lock_package".to_string(),
-            action: "rewritten".to_string(),
-            key: Some("left-pad".to_string()),
-            original: Some(Value::String(bun_original.to_string())),
-            new: Some(Value::String(bun_redirected.clone())),
-        }],
-    );
+    std::fs::write(
+        tmp.path().join("bun.lock"),
+        bun_lock(&bun_redirected_line()),
+    )
+    .unwrap();
+    let registry = NpmRegistry::start(&[("left-pad", "1.2.3")]);
 
-    let (code, stdout, stderr) = run(tmp.path(), &["rollback", "--offline", "--yes"]);
+    let (code, stdout, stderr) = run_hosted(tmp.path(), &["rollback", "--yes"], Some(&registry));
     assert_eq!(
         code, 0,
-        "the bun-deferred unwind succeeds; stdout=\n{stdout}\nstderr=\n{stderr}"
+        "the bun.lock restore succeeds; stdout=\n{stdout}\nstderr=\n{stderr}"
     );
     assert!(
-        stdout.contains(&format!("Unwound hosted redirect for {LP_PURL}")),
-        "the deferred purl's wet unwind line must print; stdout=\n{stdout}"
+        stdout.contains(&format!(
+            "Restored {LP_PURL} to its upstream registry entry"
+        )),
+        "the wet restore line must print; stdout=\n{stdout}"
     );
     assert_eq!(
         std::fs::read_to_string(tmp.path().join("bun.lock")).unwrap(),
-        bun_lock(bun_original),
-        "the bun.lock fragment must be replayed back to the original"
+        bun_lock(&bun_original_line()),
+        "the bun.lock entry must be the registry tuple again"
+    );
+    assert!(!tmp.path().join(".socket").exists(), "no .socket/ residue");
+}
+
+/// Dry-run twin of `bun_lock_pin_restores_to_the_registry_tuple`: "Would
+/// restore …", bun.lock byte-identical afterwards.
+#[test]
+fn bun_lock_pin_dry_run_previews() {
+    let tmp = tempfile::tempdir().expect("tempdir");
+    std::fs::write(
+        tmp.path().join("bun.lock"),
+        bun_lock(&bun_redirected_line()),
+    )
+    .unwrap();
+    let registry = NpmRegistry::start(&[("left-pad", "1.2.3")]);
+
+    let (code, stdout, stderr) =
+        run_hosted(tmp.path(), &["rollback", "--dry-run"], Some(&registry));
+    assert_eq!(
+        code, 0,
+        "the bun.lock dry run succeeds; stdout=\n{stdout}\nstderr=\n{stderr}"
     );
     assert!(
-        !ledger_path(tmp.path()).exists(),
-        "record and edit both unwound: the ledger must be deleted"
+        stdout.contains(&format!(
+            "Would restore {LP_PURL} to its upstream registry entry"
+        )),
+        "the dry-run preview line must print; stdout=\n{stdout}"
+    );
+    assert_eq!(
+        std::fs::read_to_string(tmp.path().join("bun.lock")).unwrap(),
+        bun_lock(&bun_redirected_line()),
+        "dry run must not touch the wired bun.lock"
     );
-    assert!(!tmp.path().join(".socket").exists(), "no .socket/ residue");
 }
 
 // ═══════════════ 4. GC-failure warnings (unix permissions) ═════════════════
@@ -2158,8 +2248,8 @@ fn manifest_write_failure_warns_and_exits_one() {
     // And the entry's blobs must survive for a retry (the failed-write
     // fallback restores the in-memory reference before the GC).
     assert!(
-        fx.socket.join("blobs").join(&fx.before_hash).exists()
-            && fx.socket.join("blobs").join(&fx.after_hash).exists(),
+        fx.socket.join("blobs").join(git_sha256(fx.before)).exists()
+            && fx.socket.join("blobs").join(git_sha256(fx.after)).exists(),
         "the failed-cleanup entry's blobs must be pinned"
     );
 }
@@ -2330,101 +2420,6 @@ fn vendored_dry_run_json_previews_without_human_print() {
     assert!(fx.tgz_path().is_file(), "dry run must keep the artifact");
 }
 
-/// Human twin of `per_purl_revert_failure_lands_in_hosted_failed`: the
-/// failed per-purl npm revert prints the "Failed to unwind hosted
-/// redirect for {purl}: {e}" stderr line (errors print even without
-/// `--json`), exit 1, ledger untouched.
-#[test]
-fn per_purl_revert_failure_prints_human_stderr_line() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    // yarn.lock is a DIRECTORY so the scoped npm revert fails on read;
-    // the second (gem) record keeps the scoped run replay-ineligible.
-    std::fs::create_dir(tmp.path().join("yarn.lock")).unwrap();
-    std::fs::write(
-        tmp.path().join("Gemfile.lock"),
-        gemfile_lock_content(GEM_PATCH_REMOTE),
-    )
-    .unwrap();
-    write_hosted_ledger(
-        tmp.path(),
-        vec![
-            (LP_PURL, hosted_record(LP_UUID)),
-            (GEM_PURL, hosted_record(GEM_UUID)),
-        ],
-        vec![yarn_classic_edit(), gem_source_edit()],
-    );
-    let ledger_before = std::fs::read(ledger_path(tmp.path())).unwrap();
-
-    let (code, stdout, stderr) = run(tmp.path(), &["rollback", "--offline", "--yes", LP_PURL]);
-    assert_eq!(
-        code, 1,
-        "a failed per-purl revert must exit 1; stdout=\n{stdout}\nstderr=\n{stderr}"
-    );
-    assert!(
-        stderr.contains(&format!("Failed to unwind hosted redirect for {LP_PURL}:")),
-        "the human failure line must print on stderr; stderr=\n{stderr}"
-    );
-    assert_eq!(
-        std::fs::read(ledger_path(tmp.path())).unwrap(),
-        ledger_before,
-        "a failed revert must leave the ledger byte-identical"
-    );
-}
-
-/// Dry-run twin of `bun_deferred_purl_unwinds_via_replay`: the deferred
-/// preview routes through the replay's dropped-records probe and prints
-/// "Would unwind hosted redirect for {purl}" — with bun.lock and the
-/// ledger byte-identical afterwards.
-#[test]
-fn bun_deferred_purl_dry_run_previews_via_replay() {
-    let bun_original =
-        r#"    "left-pad": ["left-pad@1.2.3", "", {}, "sha512-UPSTREAMupstream=="],"#;
-    // The engine's real redirected shape: registry 4-tuple → URL 3-tuple
-    // `["name@<url>", {deps}, "sha512-…"]` (the registry slot is dropped).
-    let bun_redirected = format!(
-        r#"    "left-pad": ["left-pad@{LP_HOSTED_URL}", {{}}, "sha512-PATCHEDpatched=="],"#
-    );
-    let bun_lock = |block: &str| {
-        format!("{{\n  \"lockfileVersion\": 1,\n  \"packages\": {{\n{block}\n  }}\n}}\n")
-    };
-
-    let tmp = tempfile::tempdir().expect("tempdir");
-    std::fs::write(tmp.path().join("bun.lock"), bun_lock(&bun_redirected)).unwrap();
-    write_hosted_ledger(
-        tmp.path(),
-        vec![(LP_PURL, hosted_record(LP_UUID))],
-        vec![FileEdit {
-            path: "bun.lock".to_string(),
-            kind: "redirect_bun_lock_package".to_string(),
-            action: "rewritten".to_string(),
-            key: Some("left-pad".to_string()),
-            original: Some(Value::String(bun_original.to_string())),
-            new: Some(Value::String(bun_redirected.clone())),
-        }],
-    );
-    let ledger_before = std::fs::read(ledger_path(tmp.path())).unwrap();
-
-    let (code, stdout, stderr) = run(tmp.path(), &["rollback", "--offline", "--dry-run"]);
-    assert_eq!(
-        code, 0,
-        "the bun-deferred dry run succeeds; stdout=\n{stdout}\nstderr=\n{stderr}"
-    );
-    assert!(
-        stdout.contains(&format!("Would unwind hosted redirect for {LP_PURL}")),
-        "the deferred purl's dry-run preview line must print; stdout=\n{stdout}"
-    );
-    assert_eq!(
-        std::fs::read_to_string(tmp.path().join("bun.lock")).unwrap(),
-        bun_lock(&bun_redirected),
-        "dry run must not touch the wired bun.lock"
-    );
-    assert_eq!(
-        std::fs::read(ledger_path(tmp.path())).unwrap(),
-        ledger_before,
-        "dry run must not touch the ledger"
-    );
-}
-
 /// The manifest vanishing while another process holds the apply lock: the
 /// pre-lock existence probe saw the file, but the under-lock read finds
 /// it gone — rollback fails closed with the "Invalid manifest" error
@@ -2499,45 +2494,6 @@ fn manifest_deleted_under_held_lock_fails_with_invalid_manifest() {
     panic!("the probe-then-delete interleaving never landed in 8 attempts");
 }
 
-/// Human twin of `hosted_persist_failure_lands_in_hosted_failed`: the
-/// wet-run ledger persist failure prints the "Error: Failed to persist
-/// the hosted redirect ledger" stderr line, exit 1 — after the replay
-/// already restored the wired file.
-#[cfg(unix)]
-#[test]
-fn hosted_persist_failure_prints_human_error_line() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    std::fs::write(
-        tmp.path().join("yarn.lock"),
-        yarn_lock_content(&yarn_redirected_block()),
-    )
-    .unwrap();
-    write_hosted_ledger(tmp.path(), vec![], vec![yarn_classic_edit()]);
-
-    let vendor_dir = tmp.path().join(".socket/vendor");
-    let guard = DirModeGuard::chmod(&vendor_dir, 0o555, 0o755);
-    if !readonly_dir_enforced(&vendor_dir) {
-        return;
-    }
-
-    let (code, stdout, stderr) = run(tmp.path(), &["rollback", "--offline", "--yes"]);
-    guard.restore();
-
-    assert_eq!(
-        code, 1,
-        "a ledger persist failure must exit 1; stdout=\n{stdout}\nstderr=\n{stderr}"
-    );
-    assert!(
-        stderr.contains("Error: Failed to persist the hosted redirect ledger"),
-        "the human persist-failure line must print on stderr; stderr=\n{stderr}"
-    );
-    assert_eq!(
-        std::fs::read_to_string(tmp.path().join("yarn.lock")).unwrap(),
-        yarn_lock_content(&yarn_original_block()),
-        "the replay's file writes land before the persist failure"
-    );
-}
-
 /// Human twin of `manifest_write_failure_warns_and_exits_one`: the failed
 /// manifest update prints the "Error: Failed to update the manifest:"
 /// stderr line, exit 1, manifest byte-identical — after the file restore
@@ -3347,7 +3303,6 @@ fn empty_manifest_announces_no_patches() {
 
 const VLT_UUID: &str = "88888888-8888-4888-8888-888888888888";
 const VLT_ID: &str = "~npm~left-pad@1.3.0";
-const VLT_REGISTRY_SHA: &str = "sha512-REGISTRY==";
 const VLT_PATCHED_SHA: &str = "sha512-PATCHED==";
 
 fn vlt_entry(sha: &str, url: &str) -> String {
@@ -3361,12 +3316,10 @@ fn vlt_lock_text(entry: &str) -> String {
 }
 
 /// A redirected vlt project whose store holds the patched copy `vlt
-/// install` extracted, with the hidden lock recording the hosted pin.
-fn write_vlt_hosted_fixture(root: &Path) -> (String, PathBuf) {
-    let registry = vlt_entry(
-        VLT_REGISTRY_SHA,
-        "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
-    );
+/// install` extracted, with the hidden lock recording the hosted pin (on
+/// Socket's own patch host, so discovery needs no `--patch-server-url`).
+/// Returns the store path.
+fn write_vlt_hosted_fixture(root: &Path) -> PathBuf {
     let hosted = vlt_entry(
         VLT_PATCHED_SHA,
         &format!("https://patch.socket.dev/patch/npm/t/{VLT_UUID}/left-pad-1.3.0.tgz"),
@@ -3383,42 +3336,29 @@ fn write_vlt_hosted_fixture(root: &Path) -> (String, PathBuf) {
         vlt_lock_text(&hosted),
     )
     .unwrap();
-    let mut record = hosted_record(VLT_UUID);
-    record.files.insert(
-        "package/index.js".to_string(),
-        PatchFileInfo {
-            before_hash: git_sha256(b"pristine"),
-            after_hash: git_sha256(b"patched"),
-        },
-    );
-    write_hosted_ledger(
-        root,
-        vec![("pkg:npm/left-pad@1.3.0", record)],
-        vec![FileEdit {
-            path: "vlt-lock.json".to_string(),
-            kind: "redirect_vlt_lock_node".to_string(),
-            action: "rewritten".to_string(),
-            key: Some("left-pad@1.3.0".to_string()),
-            original: Some(json!(registry)),
-            new: Some(json!(hosted)),
-        }],
-    );
-    (vlt_lock_text(&registry), store)
+    store
 }
 
-/// A dry-run rollback previews the vlt unwind but deletes nothing and
+/// A dry-run rollback previews the vlt restore but deletes nothing and
 /// says nothing about installed copies; the wet human run restores the
-/// registry pin, invalidates the patched store entry and prints the
-/// advisory as a warning line.
+/// registry pin (integrity from the registry's version document),
+/// invalidates the patched store entry and prints the advisory as a
+/// warning line.
 #[test]
 fn vlt_hosted_rollback_dry_run_keeps_the_store_and_wet_human_run_heals() {
     let tmp = tempfile::tempdir().unwrap();
     let root = tmp.path();
-    let (registry_lock, store) = write_vlt_hosted_fixture(root);
+    let store = write_vlt_hosted_fixture(root);
     let hosted_lock = std::fs::read_to_string(root.join("vlt-lock.json")).unwrap();
+    let registry = NpmRegistry::start(&[("left-pad", "1.3.0")]);
 
-    let (code, stdout, stderr) = run(root, &["rollback", "--dry-run", "--yes", "--offline"]);
+    let (code, stdout, stderr) =
+        run_hosted(root, &["rollback", "--dry-run", "--yes"], Some(&registry));
     assert_eq!(code, 0, "{stdout}\n{stderr}");
+    assert!(
+        stdout.contains("Would restore pkg:npm/left-pad@1.3.0 to its upstream registry entry"),
+        "{stdout}"
+    );
     assert!(
         !stderr.contains("redirect_vlt_reinstall_required"),
         "{stderr}"
@@ -3429,11 +3369,14 @@ fn vlt_hosted_rollback_dry_run_keeps_the_store_and_wet_human_run_heals() {
     );
     assert!(store.join("index.js").exists());
 
-    let (code, stdout, stderr) = run(root, &["rollback", "--yes", "--offline"]);
+    let (code, stdout, stderr) = run_hosted(root, &["rollback", "--yes"], Some(&registry));
     assert_eq!(code, 0, "{stdout}\n{stderr}");
-    assert_eq!(
-        std::fs::read_to_string(root.join("vlt-lock.json")).unwrap(),
-        registry_lock
+    let restored = std::fs::read_to_string(root.join("vlt-lock.json")).unwrap();
+    assert!(
+        restored.contains(&format!(
+            "\"{VLT_ID}\": [0,\"left-pad\",\"{UPSTREAM_INTEGRITY}\""
+        )) && !restored.contains("patch.socket.dev"),
+        "the node must carry the registry integrity again, no hosted URL:\n{restored}"
     );
     assert!(
         stderr.contains(
diff --git a/crates/socket-patch-cli/tests/covgap_commands_scan_hosted.rs b/crates/socket-patch-cli/tests/covgap_commands_scan_hosted.rs
index 41433f64..cea44d55 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_scan_hosted.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_scan_hosted.rs
@@ -791,16 +791,13 @@ async fn hosted_lock_held_refuses_before_any_write() {
     );
 }
 
-/// A WET zero-grant run (every reference skipped) holds no apply lock, so
-/// it must not perform the one write the strict ledger load can make: the
-/// `redirect-state.json` → `redirect-state.json.corrupt` quarantine. Under a
-/// held lock AND with no holder, a malformed ledger is reported as the hard
-/// error it is (exit 1, the repair-or-move-aside remedy) and left exactly
-/// where it was — no `.corrupt` file, no `.socket/vendor/` mutation
-/// lock-free. A granted wet run (the lock holder) still quarantines
-/// (pinned in in_process_redirect.rs).
+/// A zero-grant wet run over a project holding a MALFORMED pre-v5 redirect
+/// ledger: v5 scan never reads that ledger, so it is neither an error nor
+/// quarantined — the run succeeds (nothing granted, nothing written) under a
+/// lock held by another process and with no holder alike, and the torn file
+/// stays byte-identical in place. The human arm never mentions it either.
 #[tokio::test]
-async fn zero_grant_wet_run_reports_a_malformed_ledger_without_moving_it() {
+async fn zero_grant_wet_run_ignores_a_malformed_pre_v5_ledger() {
     use std::time::Duration;
 
     let no_grant = MockServer::start().await;
@@ -816,21 +813,12 @@ async fn zero_grant_wet_run_reports_a_malformed_ledger_without_moving_it() {
     std::fs::write(&ledger, TORN).unwrap();
     let lock_before = std::fs::read(root.join("package-lock.json")).unwrap();
 
-    let assert_left_in_place = |code: i32, doc: &Value, label: &str| {
-        assert_eq!(
-            code, 1,
-            "{label}: a malformed ledger is a hard error: {doc:#}"
-        );
-        assert_eq!(doc["status"], "error", "{label}: {doc:#}");
-        let error = doc["error"].as_str().unwrap_or_default();
+    let assert_ignored = |code: i32, doc: &Value, label: &str| {
+        assert_eq!(code, 0, "{label}: a pre-v5 ledger is never an error: {doc:#}");
+        assert_eq!(doc["status"], "success", "{label}: {doc:#}");
         assert!(
-            error.contains("redirect-state.json") && error.contains("is malformed"),
-            "{label}: the error names the ledger: {error}"
-        );
-        assert!(
-            !error.contains(".corrupt") && error.contains("move it aside"),
-            "{label}: no lock, so nothing was moved — the remedy is the repair-or-move-aside \
-             variant: {error}"
+            !doc.to_string().contains("redirect-state.json"),
+            "{label}: the envelope never mentions the legacy ledger: {doc:#}"
         );
         assert_eq!(
             std::fs::read(&ledger).unwrap(),
@@ -841,7 +829,7 @@ async fn zero_grant_wet_run_reports_a_malformed_ledger_without_moving_it() {
             !root
                 .join(".socket/vendor/redirect-state.json.corrupt")
                 .exists(),
-            "{label}: a zero-grant run never quarantines"
+            "{label}: never quarantined"
         );
         assert_eq!(
             std::fs::read(root.join("package-lock.json")).unwrap(),
@@ -850,8 +838,8 @@ async fn zero_grant_wet_run_reports_a_malformed_ledger_without_moving_it() {
         );
     };
 
-    // Under a lock held by another process: the run does not contend (it
-    // would write nothing) and must not rename under the holder either.
+    // Under a lock held by another process: a zero-grant run writes nothing,
+    // so it never contends.
     let holder =
         socket_patch_core::patch::apply_lock::acquire(&root.join(".socket"), Duration::ZERO)
             .unwrap();
@@ -860,25 +848,21 @@ async fn zero_grant_wet_run_reports_a_malformed_ledger_without_moving_it() {
         doc["errorCode"], "lock_held",
         "a zero-grant run never contends: {doc:#}"
     );
-    assert_left_in_place(code, &doc, "held lock");
+    assert_ignored(code, &doc, "held lock");
     drop(holder);
 
-    // No holder: same outcome — the gate is "this run holds the lock", not
-    // "nobody else does".
     let (code, doc) = scan_hosted_json(root, &no_grant.uri(), &[], &[]);
-    assert_left_in_place(code, &doc, "no holder");
+    assert_ignored(code, &doc, "no holder");
     assert!(
         !root.join(".socket/apply.lock").exists(),
         "no lock was taken, none is left behind"
     );
 
-    // Human arm: the same hard error on stderr, once.
     let (code, _stdout, stderr) = scan_hosted(root, &no_grant.uri(), &[], &[]);
-    assert_eq!(code, 1, "stderr=\n{stderr}");
-    assert_eq!(
-        stderr.matches("is malformed").count(),
-        1,
-        "reported exactly once; stderr=\n{stderr}"
+    assert_eq!(code, 0, "stderr=\n{stderr}");
+    assert!(
+        !stderr.contains("malformed") && !stderr.contains("redirect ledger"),
+        "stderr=\n{stderr}"
     );
     assert_eq!(std::fs::read(&ledger).unwrap(), TORN);
 }
@@ -945,20 +929,22 @@ async fn hosted_lock_io_when_a_file_squats_on_socket_dir() {
 
 /// The footprint of a SUCCESSFUL wet hosted run (G6 / lock lifecycle): after
 /// `scan --mode hosted --yes` (human) and `scan --mode hosted --json`, each
-/// on a fresh project, `.socket/` holds exactly `vendor/` (the redirect
-/// ledger's home) — no `apply.lock` outlives the run, nothing else is
-/// created. The human run also never prints the `Non-interactive mode
+/// on a fresh project, `.socket/` holds NOTHING (v5 hosted mode writes no
+/// ledger; the lockfile is the whole record) — no `apply.lock` outlives the
+/// run, and nothing else is created. The human run also never prints the `Non-interactive mode
 /// detected` auto-accept line: scan never prompts.
 #[tokio::test]
-async fn successful_wet_hosted_run_leaves_only_vendor_under_socket() {
+async fn successful_wet_hosted_run_leaves_nothing_under_socket() {
     let server = MockServer::start().await;
     mock_discovery(&server, PURL, UUID).await;
     mock_granted_reference(&server, UUID, PURL, HOSTED_URL).await;
     mock_view(&server, UUID, PURL).await;
 
     let socket_listing = |root: &Path| -> Vec<String> {
-        let mut names: Vec<String> = std::fs::read_dir(root.join(".socket"))
-            .unwrap()
+        let Ok(dir) = std::fs::read_dir(root.join(".socket")) else {
+            return Vec::new();
+        };
+        let mut names: Vec<String> = dir
             .map(|e| e.unwrap().file_name().to_string_lossy().into_owned())
             .collect();
         names.sort();
@@ -979,15 +965,15 @@ async fn successful_wet_hosted_run_leaves_only_vendor_under_socket() {
         !stderr.contains("Non-interactive mode detected"),
         "--yes skips the prompt outright; stderr=\n{stderr}"
     );
-    assert!(root.join(".socket/vendor/redirect-state.json").is_file());
+    assert!(!root.join(".socket/vendor/redirect-state.json").exists());
     assert!(
         !root.join(".socket/apply.lock").exists(),
         "apply.lock never outlives the run"
     );
     assert_eq!(
         socket_listing(root),
-        vec!["vendor".to_string()],
-        "a hosted run writes ONLY .socket/vendor/**"
+        Vec::<String>::new(),
+        "a v5 hosted run writes nothing under .socket/"
     );
 
     // `--json` arm on a fresh project (a second run over the redirected
@@ -1002,17 +988,15 @@ async fn successful_wet_hosted_run_leaves_only_vendor_under_socket() {
         !root.join(".socket/apply.lock").exists(),
         "apply.lock never outlives the run"
     );
-    assert_eq!(socket_listing(root), vec!["vendor".to_string()]);
+    assert_eq!(socket_listing(root), Vec::<String>::new());
 }
 
 /// Human `scan --mode hosted` on a project whose discovery is EMPTY returns
-/// before the engine (exit 0, `No patches available…`) — the only place a
-/// malformed redirect ledger would have been reported. It is reported there
-/// as an advisory instead, exactly once, and the file is never moved (a
-/// read-only consult; quarantine is the engine's job under the lock).
-/// `--silent` mutes it like every advisory.
+/// before the engine (exit 0, `No patches available…`). A malformed pre-v5
+/// redirect ledger is ignored there like everywhere else in v5 scan: no
+/// advisory (with or without `--silent`), never moved, no lock taken.
 #[tokio::test]
-async fn hosted_human_empty_discovery_still_reports_a_malformed_ledger() {
+async fn hosted_human_empty_discovery_ignores_a_malformed_pre_v5_ledger() {
     let server = MockServer::start().await;
     Mock::given(method("POST"))
         .and(path(format!("/v0/orgs/{ORG}/patches/batch")))
@@ -1031,33 +1015,25 @@ async fn hosted_human_empty_discovery_still_reports_a_malformed_ledger() {
     const TORN: &[u8] = b"{ torn";
     std::fs::write(&ledger, TORN).unwrap();
 
-    let (code, stdout, stderr) = scan_hosted(root, &server.uri(), &[], &[]);
-    assert_eq!(code, 0, "an empty discovery exits 0; stderr=\n{stderr}");
-    assert!(
-        stdout.contains("No patches available for installed packages."),
-        "{stdout}"
-    );
-    assert_eq!(
-        stderr.matches("is malformed").count(),
-        1,
-        "the corruption is reported exactly once; stderr=\n{stderr}"
-    );
-    assert!(
-        stderr.contains("Warning: the redirect ledger"),
-        "advisory form; stderr=\n{stderr}"
-    );
-    assert_eq!(std::fs::read(&ledger).unwrap(), TORN, "left in place");
-    assert!(!root
-        .join(".socket/vendor/redirect-state.json.corrupt")
-        .exists());
-    assert!(!root.join(".socket/apply.lock").exists());
-
-    let (code, _stdout, stderr) = scan_hosted(root, &server.uri(), &["--silent"], &[]);
-    assert_eq!(code, 0, "stderr=\n{stderr}");
-    assert!(
-        !stderr.contains("is malformed"),
-        "--silent mutes the advisory; stderr=\n{stderr}"
-    );
+    for extra in [&[][..], &["--silent"][..]] {
+        let (code, stdout, stderr) = scan_hosted(root, &server.uri(), extra, &[]);
+        assert_eq!(code, 0, "{extra:?}: an empty discovery exits 0; stderr=\n{stderr}");
+        if extra.is_empty() {
+            assert!(
+                stdout.contains("No patches available for installed packages."),
+                "{stdout}"
+            );
+        }
+        assert!(
+            !stderr.contains("malformed") && !stderr.contains("redirect ledger"),
+            "{extra:?}: a pre-v5 ledger is never read; stderr=\n{stderr}"
+        );
+        assert_eq!(std::fs::read(&ledger).unwrap(), TORN, "left in place");
+        assert!(!root
+            .join(".socket/vendor/redirect-state.json.corrupt")
+            .exists());
+        assert!(!root.join(".socket/apply.lock").exists());
+    }
 }
 
 /// A free-tier org whose every discovered hosted offer is paid-tier: the
@@ -1341,10 +1317,18 @@ async fn ledgerless_cargo_wiring_refuses(manifest_wiring: bool) {
 
 /// Dry-run and apply use the same native binary rewrite, with no Bun
 /// executable or installed dependencies. A fresh clone works immediately.
+/// No run writes a redirect ledger (v5), and `rollback` cannot restore a
+/// binary `bun.lockb` pin to its upstream entry: it refuses the pin
+/// (`partial_failure`, exit 1) naming the `git checkout` remedy and leaves
+/// the lock byte-identical.
 #[tokio::test]
 async fn native_bun_lockb_hosting_dry_run_rerun_and_rollback_without_bun() {
     let purl = "pkg:npm/minimist@1.2.2";
-    let url = "https://patch.test/minimist-1.2.2.tgz";
+    // A standard hosted URL shape (grant token, then the patch uuid), so
+    // lockfile discovery recognizes the pin under `--patch-server-url`.
+    let url = &format!(
+        "https://patch.test/patch/npm/minimist/1.2.2/22222222-2222-4222-8222-222222222222/{UUID}/minimist-1.2.2.tgz"
+    );
     let sri = format!("sha512-{}", "A".repeat(86) + "==");
     let server = MockServer::start().await;
     mock_discovery(&server, purl, UUID).await;
@@ -1395,15 +1379,10 @@ async fn native_bun_lockb_hosting_dry_run_rerun_and_rollback_without_bun() {
         .any(|bytes| bytes == url.as_bytes()));
     assert!(!tmp.path().join("bun.lock").exists());
     assert!(!tmp.path().join("node_modules").exists());
-    let ledger: Value = serde_json::from_slice(
-        &std::fs::read(tmp.path().join(".socket/vendor/redirect-state.json")).unwrap(),
-    )
-    .unwrap();
-    assert!(ledger["edits"]
-        .as_array()
-        .unwrap()
-        .iter()
-        .any(|edit| edit["kind"] == "redirect_bun_lockb_package"));
+    assert!(!tmp
+        .path()
+        .join(".socket/vendor/redirect-state.json")
+        .exists());
 
     let (code, rerun) = scan_hosted_json(tmp.path(), &server.uri(), &[], &env);
     assert_eq!(code, 0, "{rerun:#}");
@@ -1418,17 +1397,30 @@ async fn native_bun_lockb_hosting_dry_run_rerun_and_rollback_without_bun() {
             "rollback",
             "--json",
             "--yes",
-            "--offline",
+            "--patch-server-url",
+            "https://patch.test",
             "--cwd",
             tmp.path().to_str().unwrap(),
         ],
         &env,
     );
-    assert_eq!(code, 0, "{stdout}\n{stderr}");
-    let entries = socket_patch_core::vendor::lock_inventory::inventory_project(tmp.path()).await;
+    assert_eq!(code, 1, "a binary bun.lockb pin is refused: {stdout}\n{stderr}");
+    let doc: Value = serde_json::from_str(&stdout).unwrap_or_else(|e| panic!("{e}: {stdout}"));
+    assert_eq!(doc["status"], "partial_failure", "{doc:#}");
+    let failed = doc["hosted"]["failed"].as_array().unwrap_or_else(|| panic!("{doc:#}"));
+    assert_eq!(failed.len(), 1, "{doc:#}");
+    assert_eq!(failed[0]["purl"], purl, "{doc:#}");
+    let error = failed[0]["error"].as_str().unwrap_or_default();
     assert!(
-        entries.iter().any(|entry| entry.purl == purl),
-        "{entries:?}"
+        error.starts_with(&format!("cannot restore {purl} to its upstream registry entry: "))
+            && error.contains("bun.lockb")
+            && error.contains("git checkout"),
+        "{error}"
+    );
+    assert_eq!(
+        std::fs::read(tmp.path().join("bun.lockb")).unwrap(),
+        patched,
+        "nothing is written for a refused pin"
     );
     assert!(!tmp.path().join("bun.lock").exists());
     assert!(!tmp
@@ -1826,19 +1818,17 @@ async fn unreadable_pnpm_workspace_gets_warning_only_guidance_in_a_live_run() {
         user_bytes,
         "the unreadable workspace file must be left byte-identical"
     );
-    let ledger =
-        std::fs::read_to_string(tmp.path().join(".socket/vendor/redirect-state.json")).unwrap();
     assert!(
-        !ledger.contains("redirect_pnpm_workspace_trust"),
-        "no workspace-trust edit may be recorded when the file was unreadable: {ledger}"
+        !tmp.path().join(".socket/vendor/redirect-state.json").exists(),
+        "v5 hosted mode writes no redirect ledger"
     );
 }
 
 // ──────────── redirect_supersedes_vendored (+ human) ────────────
 
 /// The hosted-direction takeover warning: a LIVE lock routing package X to
-/// its hosted artifact while BOTH ledgers still claim X (redirect records +
-/// vendored state) must fire `redirect_supersedes_vendored` naming X — the
+/// its hosted artifact (a lockfile hosted pin — v5 hosted state) while the
+/// vendored ledger still claims X must fire `redirect_supersedes_vendored` naming X — the
 /// only signal that X's vendored ledger entry and committed tarball are now
 /// orphaned. A DIFFERENT package Y is granted this run so the takeover
 /// pre-revert never consumes X's vendored entry. The human re-run prints
@@ -1900,31 +1890,9 @@ async fn live_hosted_overlap_fires_redirect_supersedes_vendored() {
         ),
     )
     .unwrap();
-    // Redirect ledger: records X (the record uuid the live-lock proof keys on).
-    let socket_vendor = root.join(".socket/vendor");
-    std::fs::create_dir_all(&socket_vendor).unwrap();
-    let redirect_ledger = json!({
-        "version": 1,
-        "mode": "hosted",
-        "records": {
-            XPURL: {
-                "uuid": XUUID,
-                "exportedAt": "2026-01-01T00:00:00Z",
-                "files": {
-                    "package/index.js": { "beforeHash": "a".repeat(64), "afterHash": "b".repeat(64) }
-                },
-                "vulnerabilities": {},
-                "description": "x",
-                "license": "MIT",
-                "tier": "free"
-            }
-        }
-    });
-    std::fs::write(
-        socket_vendor.join("redirect-state.json"),
-        serde_json::to_vec_pretty(&redirect_ledger).unwrap(),
-    )
-    .unwrap();
+    // No redirect ledger (v5): X's hosted pin in the lock is the whole
+    // hosted state. The mock host is recognized as a patch server only via
+    // `--patch-server-url` below.
     // Vendored ledger ALSO claims X (stale — the lock routes X hosted).
     write_vendor_state(
         root,
@@ -1933,7 +1901,8 @@ async fn live_hosted_overlap_fires_redirect_supersedes_vendored() {
         "package-lock",
     );
 
-    let (code, doc) = scan_hosted_json(root, &server.uri(), &[], &[]);
+    let psu = ["--patch-server-url", "http://patch.test"];
+    let (code, doc) = scan_hosted_json(root, &server.uri(), &psu, &[]);
     assert_eq!(
         code, 0,
         "the overlap warning never flips the exit code: {doc:#}"
@@ -1959,7 +1928,7 @@ async fn live_hosted_overlap_fires_redirect_supersedes_vendored() {
     );
 
     // Human re-run (idempotent): the takeover-warning loop prints the detail.
-    let (code, _stdout, stderr) = scan_hosted(root, &server.uri(), &[], &[]);
+    let (code, _stdout, stderr) = scan_hosted(root, &server.uri(), &psu, &[]);
     assert_eq!(code, 0, "human overlap run exits 0; stderr=\n{stderr}");
     assert!(
         stderr.contains(
@@ -2067,7 +2036,7 @@ async fn human_vex_success_summary_names_statements_path_and_ledger_caveat() {
         "the VEX summary must name the count and the path; stderr=\n{stderr}"
     );
     assert!(
-        stderr.contains("attested from the ledger"),
+        stderr.contains("attested from their patch records"),
         "the no-verify caveat is load-bearing; stderr=\n{stderr}"
     );
     let doc: Value =
@@ -2287,10 +2256,10 @@ async fn human_reference_failure_prints_an_error_line_and_exits_1() {
     );
 }
 
-/// A malformed redirect ledger aborts with an `Error: The redirect ledger
-/// ...` line.
+/// A malformed pre-v5 redirect ledger no longer aborts anything: the human
+/// dry run proceeds (exit 0, the preview summary) with no `Error:` line.
 #[tokio::test]
-async fn human_malformed_ledger_prints_an_error_prefix() {
+async fn human_malformed_pre_v5_ledger_does_not_abort_the_run() {
     let server = MockServer::start().await;
     mock_discovery(&server, PURL, UUID).await;
     mock_granted_reference(&server, UUID, PURL, HOSTED_URL).await;
@@ -2304,14 +2273,20 @@ async fn human_malformed_ledger_prints_an_error_prefix() {
     )
     .unwrap();
 
-    let (code, _stdout, stderr) = scan_hosted(tmp.path(), &server.uri(), &["--dry-run"], &[]);
-    assert_eq!(code, 1, "stderr=\n{stderr}");
+    let (code, stdout, stderr) = scan_hosted(tmp.path(), &server.uri(), &["--dry-run"], &[]);
+    assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
     assert!(
-        stderr
-            .lines()
-            .any(|l| l.starts_with("Error: The redirect ledger ") && l.contains("malformed")),
+        stdout.contains("Would redirect 1 package"),
+        "stdout=\n{stdout}"
+    );
+    assert!(
+        !stderr.lines().any(|l| l.starts_with("Error:")) && !stderr.contains("malformed"),
         "stderr=\n{stderr}"
     );
+    assert_eq!(
+        std::fs::read(tmp.path().join(".socket/vendor/redirect-state.json")).unwrap(),
+        b"{bad"
+    );
 }
 
 /// Stdout below the discovery report: human hosted `scan` prints the
@@ -2364,8 +2339,7 @@ async fn human_rerun_says_already_redirected_and_first_run_prints_next_steps() {
     assert_eq!(
         engine_stdout(&stdout),
         "Redirected 1 package; rewrote 2 files.\n\
-         Commit .socket/vendor/redirect-state.json, .npmrc, and package-lock.json to keep \
-         the redirect.\n\
+         Commit .npmrc and package-lock.json to keep the redirect.\n\
          Reinstall from the updated lockfile (e.g. `npm ci`) so the installed packages pick \
          up the patched artifacts, then run `socket-patch vex` to verify them.\n",
         "stderr=\n{stderr}"
diff --git a/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs b/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs
index e34a34b1..72219731 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs
@@ -1062,29 +1062,7 @@ async fn scan_human_apply_over_live_hosted_wiring_warns_retained() {
     )
     .unwrap();
 
-    // The redirect ledger recording that hosted redirect.
-    use socket_patch_core::manifest::schema::PatchRecord;
-    use socket_patch_core::patch::redirect::RedirectState;
-    let mut state = RedirectState::new();
-    state.records.insert(
-        purl.to_string(),
-        PatchRecord {
-            uuid: UUID.to_string(),
-            exported_at: "2024-01-01T00:00:00Z".to_string(),
-            files: std::collections::HashMap::new(),
-            vulnerabilities: std::collections::HashMap::new(),
-            description: String::new(),
-            license: "MIT".to_string(),
-            tier: "free".to_string(),
-        },
-    );
-    let vendor_dir = tmp.path().join(".socket/vendor");
-    std::fs::create_dir_all(&vendor_dir).unwrap();
-    std::fs::write(
-        vendor_dir.join("redirect-state.json"),
-        serde_json::to_string_pretty(&state).unwrap(),
-    )
-    .unwrap();
+    // v5: the lock pin above is the whole hosted state (no ledger).
 
     let (code, stdout, stderr) = run_scan_agent(tmp.path(), &mock.uri(), &["--yes"]);
     assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
@@ -1450,31 +1428,38 @@ fn reference_posts(reqs: &[wiremock::Request]) -> usize {
         .count()
 }
 
-/// Seed a redirect ledger recording `uuid` for `purl` (hosted mode's only
-/// patch store), so update detection has an "old" side to compare. Written
-/// through the real ledger type so the hosted engine's strict loader
-/// accepts it.
-fn seed_redirect_ledger(root: &Path, purl: &str, uuid: &str) {
-    use socket_patch_core::manifest::schema::PatchRecord;
-    use socket_patch_core::patch::redirect::RedirectState;
-    let mut state = RedirectState::new();
-    state.records.insert(
-        purl.to_string(),
-        PatchRecord {
-            uuid: uuid.to_string(),
-            exported_at: "2024-01-01T00:00:00Z".to_string(),
-            files: std::collections::HashMap::new(),
-            vulnerabilities: std::collections::HashMap::new(),
-            description: "seed".to_string(),
-            license: "MIT".to_string(),
-            tier: "free".to_string(),
-        },
-    );
-    let vendor_dir = root.join(".socket/vendor");
-    std::fs::create_dir_all(&vendor_dir).unwrap();
+/// Seed a hosted pin for the npm `purl` in `package-lock.json` — the
+/// lockfile resolving it to the Socket patch server under `uuid`. v5 hosted
+/// mode keeps its state only in lockfile pins, so this is update
+/// detection's "old" side.
+fn seed_hosted_pin(root: &Path, purl: &str, uuid: &str) {
+    let (name, version) = purl
+        .strip_prefix("pkg:npm/")
+        .and_then(|rest| rest.rsplit_once('@'))
+        .expect("an npm purl");
+    let lock = serde_json::json!({
+        "name": "covgap-scan-root",
+        "version": "0.0.0",
+        "lockfileVersion": 3,
+        "requires": true,
+        "packages": {
+            "": {
+                "name": "covgap-scan-root",
+                "version": "0.0.0",
+                "dependencies": { name: version }
+            },
+            format!("node_modules/{name}"): {
+                "version": version,
+                "resolved": format!(
+                    "https://patch.socket.dev/patch/npm/{name}/{version}/tok/{uuid}/{name}-{version}.tgz"
+                ),
+                "integrity": "sha512-orig==",
+            }
+        }
+    });
     std::fs::write(
-        vendor_dir.join("redirect-state.json"),
-        serde_json::to_string_pretty(&state).unwrap(),
+        root.join("package-lock.json"),
+        serde_json::to_string_pretty(&lock).unwrap(),
     )
     .unwrap();
 }
@@ -1519,9 +1504,9 @@ async fn scan_hosted_human_prints_table_updates_and_redirects() {
     let tmp = tempfile::tempdir().unwrap();
     write_root_package_json(tmp.path());
     write_npm_package(tmp.path(), "minimist", "1.2.2", b"x\n");
-    // The ledger records an OLDER patch: the shared update detection must
+    // The lock pins an OLDER hosted patch: the shared update detection must
     // flag the newer offer in hosted mode too.
-    seed_redirect_ledger(tmp.path(), purl, OLD_UUID);
+    seed_hosted_pin(tmp.path(), purl, OLD_UUID);
 
     // v5: a bare scan is hosted.
     let (code, stdout, stderr) = run_scan_human(tmp.path(), &mock.uri(), &[]);
@@ -2449,18 +2434,17 @@ async fn scan_prune_keeps_a_wired_vlt_uuid_and_sweeps_an_unwired_one() {
     );
 }
 
-/// The degraded-ledger overlap through the CLI: a redirect ledger holding
-/// only a vlt node edit (no records) keyed at a peer variant of the
-/// vendored package's DepID is superseded by the vendored wiring (warned
-/// and reconciled), at the `~` boundary only.
+/// A pre-v5 redirect ledger holding only a vlt node edit keyed at a peer
+/// variant of the vendored package's DepID is IGNORED by a vendored scan:
+/// v5 has no `vendor_supersedes_redirect` reconciliation (once the lock
+/// routes a package to `.socket/vendor/`, no hosted state is left), so no
+/// warning fires at either side of the `~` boundary and the legacy file is
+/// left byte-identical.
 #[tokio::test]
-async fn scan_vendored_warns_on_a_degraded_vlt_edit_at_the_tilde_boundary() {
+async fn scan_vendored_ignores_a_degraded_pre_v5_vlt_ledger_edit() {
     use socket_patch_core::patch::redirect::{FileEdit, RedirectState};
     use vlt_hosted_common as hosted;
-    for (key, overlaps) in [
-        ("left-pad@1.3.0~peer.2", true),
-        ("left-pad@1.3.00~peer.2", false),
-    ] {
+    for key in ["left-pad@1.3.0~peer.2", "left-pad@1.3.00~peer.2"] {
         let server = MockServer::start().await;
         hosted::mock_all(&server).await;
         let tmp = tempfile::tempdir().unwrap();
@@ -2475,14 +2459,11 @@ async fn scan_vendored_warns_on_a_degraded_vlt_edit_at_the_tilde_boundary() {
             original: None,
             new: None,
         }];
-        std::fs::write(
-            hosted::ledger_path(root),
-            serde_json::to_string_pretty(&ledger).unwrap(),
-        )
-        .unwrap();
+        let bytes = serde_json::to_string_pretty(&ledger).unwrap();
+        std::fs::write(hosted::ledger_path(root), &bytes).unwrap();
         let cwd = root.to_str().unwrap().to_string();
         let uri = server.uri();
-        let (_, env, stderr) = hosted::run_json(
+        let (code, env, stderr) = hosted::run_json(
             root,
             &[
                 "scan",
@@ -2500,22 +2481,16 @@ async fn scan_vendored_warns_on_a_degraded_vlt_edit_at_the_tilde_boundary() {
             ],
             &[],
         );
+        assert_eq!(code, 0, "{key}: {env:#}\n{stderr}");
         let text = env.to_string();
-        let warned = text.contains("vendor_supersedes_redirect");
-        assert_eq!(warned, overlaps, "{key}: {env:#}\n{stderr}");
-        let edits = std::fs::read(hosted::ledger_path(root))
-            .ok()
-            .map(|b| {
-                serde_json::from_slice::<RedirectState>(&b)
-                    .unwrap()
-                    .edits
-                    .len()
-            })
-            .unwrap_or(0);
+        assert!(
+            !text.contains("vendor_supersedes_redirect"),
+            "{key}: the v5 vendored scan never reconciles a hosted ledger: {env:#}"
+        );
         assert_eq!(
-            edits,
-            usize::from(!overlaps),
-            "{key}: the reconciliation drops exactly the claimed edit: {env:#}"
+            std::fs::read_to_string(hosted::ledger_path(root)).unwrap(),
+            bytes,
+            "{key}: the pre-v5 ledger is left byte-identical: {env:#}"
         );
     }
 }
diff --git a/crates/socket-patch-cli/tests/covgap_commands_vendor.rs b/crates/socket-patch-cli/tests/covgap_commands_vendor.rs
index 0c6399bd..ca875494 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_vendor.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_vendor.rs
@@ -1,8 +1,9 @@
 //! Coverage-gap tests for `commands/vendor.rs`:
 //! the fail-closed ledger/manifest exit contracts, the fresh-clone
-//! committed-artifact staging error ladder, the redirect-ledger takeover
-//! guard, the human-mode (no `--json`) output surface, and the unix
-//! fault-injection paths for the two state-write failure events.
+//! committed-artifact staging error ladder, the hosted-pin takeover guard
+//! (v5: hosted state is the lockfile pins), the human-mode (no `--json`)
+//! output surface, and the unix fault-injection paths for the state-write
+//! failure events.
 //!
 //! Fixture + runner shapes mirror `in_process_vendor.rs` (which this suite
 //! deliberately does not touch): an offline, self-contained npm project with
@@ -427,58 +428,122 @@ fn missing_package_with_no_lock_and_no_ledger_is_calm_skip() {
 }
 
 // ─────────────────────────────────────────────────────────────────────
-// 3. redirect-ledger takeover guard
+// 3. hosted-pin takeover guard (v5: lockfile pins, no redirect ledger)
 // ─────────────────────────────────────────────────────────────────────
 
-/// A malformed redirect ledger makes a claimed purl indistinguishable from
-/// an unclaimed one, so every purl of a takeover-capable ecosystem (npm,
-/// cargo) fails CLOSED with the corruption surfaced — and nothing is
-/// vendored over the possibly-live hosted redirect.
+/// The mock patch-server origin the hosted pins below live on. Only
+/// `https://patch.socket.dev` and the `--patch-server-url` origin count as
+/// hosted, so every run over these pins passes that flag.
+const HOSTED_ORIGIN: &str = "http://patch.test";
+const HOSTED_INTEGRITY: &str = "sha512-HOSTEDpatchedHOSTEDpatched==";
+/// What the mock npm registry's version document hands back for the
+/// upstream restore.
+const UPSTREAM_INTEGRITY: &str = "sha512-UPSTREAMupstreamUPSTREAM==";
+
+fn hosted_url() -> String {
+    format!(
+        "{HOSTED_ORIGIN}/patch/npm/left-pad/1.3.0/55555555-5555-4555-8555-555555555555/{UUID}/left-pad-1.3.0.tgz"
+    )
+}
+
+/// Pin the fixture's left-pad entry to the hosted tarball (what `scan
+/// --mode hosted` leaves in package-lock.json) and return the lock bytes.
+fn pin_hosted(fx: &NpmFixture) -> Vec<u8> {
+    let mut lock: Value = serde_json::from_slice(&fx.lock_bytes()).unwrap();
+    lock["packages"]["node_modules/left-pad"]["resolved"] = Value::String(hosted_url());
+    lock["packages"]["node_modules/left-pad"]["integrity"] =
+        Value::String(HOSTED_INTEGRITY.to_string());
+    let mut bytes = serde_json::to_vec_pretty(&lock).unwrap();
+    bytes.push(b'\n');
+    std::fs::write(fx.lock_path(), &bytes).unwrap();
+    bytes
+}
+
+/// A wiremock npm registry answering left-pad@1.3.0's version document.
+async fn mock_npm_registry() -> MockServer {
+    let server = MockServer::start().await;
+    Mock::given(method("GET"))
+        .and(path("/left-pad/1.3.0"))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+            "name": "left-pad",
+            "version": "1.3.0",
+            "dist": {
+                "tarball": format!("{}/left-pad/-/left-pad-1.3.0.tgz", server.uri()),
+                "integrity": UPSTREAM_INTEGRITY,
+                "shasum": "0000000000000000000000000000000000000000"
+            }
+        })))
+        .mount(&server)
+        .await;
+    server
+}
+
+/// `vendor --json --patch-server-url <mock origin>` through the binary,
+/// ONLINE against the mock registry (the upstream restore needs it) but
+/// anonymous, so no other network path opens.
+fn vendor_online(fx: &NpmFixture, registry: &str, extra: &[&str]) -> (i32, Value) {
+    let root = fx.root().to_str().unwrap();
+    let mut args = vec![
+        "vendor",
+        "--json",
+        "--patch-server-url",
+        HOSTED_ORIGIN,
+        "--cwd",
+        root,
+    ];
+    args.extend_from_slice(extra);
+    let (code, stdout, stderr) = run_cli(
+        fx.root(),
+        &args,
+        &[
+            ("SOCKET_NO_API_TOKEN", "1"),
+            ("SOCKET_NPM_REGISTRY", registry),
+        ],
+    );
+    let env: Value = serde_json::from_str(&stdout)
+        .unwrap_or_else(|e| panic!("envelope: {e}\nstdout:\n{stdout}\nstderr:\n{stderr}"));
+    (code, env)
+}
+
+/// A pre-v5 redirect ledger on disk (even a malformed one) is IGNORED:
+/// the vendor run neither reads nor rewrites it, vendors the purl as
+/// usual, and leaves the stale file byte-identical.
 #[test]
-fn corrupt_redirect_ledger_fails_takeover_capable_purl_closed() {
+fn corrupt_pre_v5_redirect_ledger_is_ignored_by_vendor() {
     let fx = npm_fixture();
     std::fs::create_dir_all(fx.vendor_dir()).unwrap();
     std::fs::write(fx.redirect_state_path(), b"garbage").unwrap();
 
     let (code, env) = vendor_cli(fx.root(), &[]);
-    assert_eq!(code, 1, "{env:#}");
-    let failed = find_event(&env, "failed", Some("redirect_ledger_corrupt"));
-    assert_eq!(failed["purl"], PURL);
+    assert_eq!(code, 0, "a stale ledger must not block vendoring: {env:#}");
+    let applied = find_event(&env, "applied", None);
+    assert_eq!(applied["purl"], PURL);
     assert!(
-        failed["error"]
-            .as_str()
-            .is_some_and(|d| d.contains("cannot vendor over a possibly-live hosted redirect")),
-        "{env:#}"
+        events(&env)
+            .iter()
+            .all(|e| e["errorCode"] != "redirect_ledger_corrupt"),
+        "the pre-v5 ledger is never read: {env:#}"
     );
+    assert!(fx.tgz_path().is_file(), "the purl is vendored");
+    assert_ne!(fx.lock_bytes(), fx.original_lock, "the lock is rewired");
     assert_eq!(
-        fx.lock_bytes(),
-        fx.original_lock,
-        "the lock must not be rewired while the redirect ledger is unreadable"
-    );
-    assert!(
-        !fx.tgz_path().exists(),
-        "no artifact may be produced for the refused purl"
+        std::fs::read(fx.redirect_state_path()).unwrap(),
+        b"garbage",
+        "the pre-v5 ledger is left untouched"
     );
 }
 
-/// Dry-run over a purl the redirect ledger still claims: the run must warn
+/// Dry run over a purl the lockfile pins hosted: the run warns
 /// `vendor_would_revert_redirect` (an UNCOUNTED advisory — dry/wet takeover
-/// parity) and leave both the redirect ledger and the lockfile untouched.
-#[test]
-fn dry_run_over_claimed_redirect_warns_and_writes_nothing() {
+/// parity) after resolving the upstream entry exactly like a wet run
+/// would, and writes nothing — no lock edit, no artifact, no ledger.
+#[tokio::test]
+async fn dry_run_over_hosted_pin_warns_and_writes_nothing() {
     let fx = npm_fixture();
-    std::fs::create_dir_all(fx.vendor_dir()).unwrap();
-    let before_hash = compute_git_sha256_from_bytes(ORIG_INDEX);
-    let after_hash = compute_git_sha256_from_bytes(PATCHED_INDEX);
-    let ledger = json!({
-        "version": 1,
-        "mode": "hosted",
-        "records": { PURL: patch_record(&before_hash, &after_hash) }
-    });
-    let ledger_bytes = serde_json::to_vec_pretty(&ledger).unwrap();
-    std::fs::write(fx.redirect_state_path(), &ledger_bytes).unwrap();
+    let hosted_lock = pin_hosted(&fx);
+    let registry = mock_npm_registry().await;
 
-    let (code, env) = vendor_cli(fx.root(), &["--dry-run"]);
+    let (code, env) = vendor_online(&fx, &registry.uri(), &["--dry-run"]);
     assert_eq!(code, 0, "the dry run itself succeeds: {env:#}");
     let warned = find_event(&env, "skipped", Some("vendor_would_revert_redirect"));
     assert_eq!(warned["purl"], PURL);
@@ -486,63 +551,115 @@ fn dry_run_over_claimed_redirect_warns_and_writes_nothing() {
         env["summary"]["skipped"], 0,
         "the takeover advisory is uncounted: {env:#}"
     );
-    assert_eq!(
-        std::fs::read(fx.redirect_state_path()).unwrap(),
-        ledger_bytes,
-        "a dry run must not touch the redirect ledger"
-    );
     assert_eq!(
         fx.lock_bytes(),
-        fx.original_lock,
+        hosted_lock,
         "a dry run must not touch the lock"
     );
+    assert!(!fx.tgz_path().exists(), "a dry run vendors nothing");
+    assert!(
+        !fx.state_path().exists(),
+        "a dry run writes no vendor ledger"
+    );
+    assert!(
+        !fx.redirect_state_path().exists(),
+        "no hosted ledger is ever written"
+    );
+}
+
+/// The wet twin: vendoring over the hosted pin first restores the upstream
+/// registry entry (`vendor_takeover_reverted_redirect`), then vendors; the
+/// vendor ledger records the UPSTREAM entry as the original, so `vendor
+/// --revert` lands on the registry entry — never back on the hosted URL.
+#[tokio::test]
+async fn vendor_over_hosted_pin_restores_upstream_then_revert_returns_to_registry() {
+    let fx = npm_fixture();
+    pin_hosted(&fx);
+    let registry = mock_npm_registry().await;
+
+    let (code, env) = vendor_online(&fx, &registry.uri(), &[]);
+    assert_eq!(code, 0, "{env:#}");
+    find_event(&env, "applied", None);
+    let warned = find_event(&env, "skipped", Some("vendor_takeover_reverted_redirect"));
+    assert!(
+        warned
+            .to_string()
+            .contains("restored its upstream registry entry (package-lock.json)"),
+        "the advisory names the restored lockfile: {warned:#}"
+    );
+    let lock: Value = serde_json::from_slice(&fx.lock_bytes()).unwrap();
+    let entry = &lock["packages"]["node_modules/left-pad"];
+    assert!(
+        entry["resolved"]
+            .as_str()
+            .unwrap_or_default()
+            .contains(".socket/vendor/"),
+        "the lock is vendored: {lock:#}"
+    );
+    assert!(!fx
+        .lock_bytes()
+        .windows(HOSTED_ORIGIN.len())
+        .any(|w| w == HOSTED_ORIGIN.as_bytes()));
+    assert!(!fx.redirect_state_path().exists(), "no hosted ledger");
+
+    let (code, env) = vendor_cli(fx.root(), &["--revert"]);
+    assert_eq!(code, 0, "{env:#}");
+    let lock: Value = serde_json::from_slice(&fx.lock_bytes()).unwrap();
+    let entry = &lock["packages"]["node_modules/left-pad"];
+    assert_eq!(
+        entry["resolved"],
+        format!("{}/left-pad/-/left-pad-1.3.0.tgz", registry.uri()),
+        "revert lands on the upstream registry tarball: {lock:#}"
+    );
+    assert_eq!(entry["integrity"], UPSTREAM_INTEGRITY, "{lock:#}");
 }
 
-/// A claimed redirect whose recorded edit cannot be reverted (no recorded
-/// original fragment) fails the purl CLOSED with `redirect_revert_failed`
-/// — vendoring over an unrevertable live redirect would strand the hosted
-/// edits forever.
+/// A hosted pin whose upstream entry cannot be restored (here: `--offline`,
+/// so the registry lookup is impossible) fails the purl CLOSED with
+/// `redirect_revert_failed` naming the checkout remedy — vendoring over a
+/// live hosted pin would record the hosted fragment as the "original".
 #[test]
-fn unrevertable_redirect_claim_fails_closed() {
+fn unrestorable_hosted_pin_fails_closed() {
     let fx = npm_fixture();
-    std::fs::create_dir_all(fx.vendor_dir()).unwrap();
-    let before_hash = compute_git_sha256_from_bytes(ORIG_INDEX);
-    let after_hash = compute_git_sha256_from_bytes(PATCHED_INDEX);
-    // A yarn-classic hosted edit claiming this purl, with NO original
-    // fragment recorded: the revert must refuse rather than guess.
-    let ledger = json!({
-        "version": 1,
-        "mode": "hosted",
-        "edits": [{
-            "path": "yarn.lock",
-            "kind": "redirect_yarn_classic_entry",
-            "action": "rewritten",
-            "key": "left-pad@1.3.0"
-        }],
-        "records": { PURL: patch_record(&before_hash, &after_hash) }
-    });
-    let ledger_bytes = serde_json::to_vec_pretty(&ledger).unwrap();
-    std::fs::write(fx.redirect_state_path(), &ledger_bytes).unwrap();
+    let hosted_lock = pin_hosted(&fx);
 
-    let (code, env) = vendor_cli(fx.root(), &[]);
+    let (code, env) = vendor_cli(fx.root(), &["--patch-server-url", HOSTED_ORIGIN]);
     assert_eq!(code, 1, "{env:#}");
     let failed = find_event(&env, "failed", Some("redirect_revert_failed"));
     assert_eq!(failed["purl"], PURL);
+    let detail = failed["error"].as_str().unwrap_or_default();
     assert!(
-        failed["error"]
-            .as_str()
-            .is_some_and(|d| d.contains("cannot vendor over the live hosted redirect")),
+        detail.contains("cannot vendor over the live hosted pin")
+            && detail.contains("git checkout -- package-lock.json"),
         "{env:#}"
     );
     assert_eq!(
-        std::fs::read(fx.redirect_state_path()).unwrap(),
-        ledger_bytes,
-        "a refused takeover must leave the redirect ledger as it was"
+        fx.lock_bytes(),
+        hosted_lock,
+        "the hosted pin stays as found"
     );
-    assert_eq!(fx.lock_bytes(), fx.original_lock, "lock untouched");
     assert!(!fx.tgz_path().exists(), "no artifact for the refused purl");
+    assert!(!fx.state_path().exists(), "no vendor ledger entry");
+    assert!(!fx.redirect_state_path().exists());
 }
 
+/// Without `--patch-server-url` a URL on a non-Socket origin is NOT a
+/// hosted pin, so no takeover is attempted and no `redirect_revert_failed`
+/// can fire.
+#[test]
+fn hosted_url_on_unconfigured_origin_is_not_a_takeover() {
+    let fx = npm_fixture();
+    pin_hosted(&fx);
+
+    let (_code, env) = vendor_cli(fx.root(), &[]);
+    assert!(
+        events(&env).iter().all(|e| {
+            e["errorCode"] != "redirect_revert_failed"
+                && e["errorCode"] != "vendor_takeover_reverted_redirect"
+        }),
+        "an unrecognized origin is not hosted state: {env:#}"
+    );
+}
 // ─────────────────────────────────────────────────────────────────────
 // 4. revert-failure accounting on tampered ledger entries
 // ─────────────────────────────────────────────────────────────────────
@@ -993,61 +1110,6 @@ async fn vendor_state_write_failure_reports_failed_event() {
     );
 }
 
-/// A hosted redirect record whose revert succeeds but whose ledger update
-/// cannot be persisted (`.socket/vendor` read-only). The takeover's revert,
-/// its redirect-ledger drop, the vendor rewire and the vendor ledger are
-/// committed together, so the failed commit leaves ALL of them as found:
-/// the lock untouched, the redirect ledger byte-identical (still claiming
-/// only wiring that is still there), no vendor ledger — never a redirect
-/// ledger claiming reverted wiring. The run exits 1 with
-/// `vendor_commit_failed`. (Before the group commit the takeover persisted
-/// the redirect ledger on its own and failed the purl closed with
-/// `redirect_ledger_write_failed` before vendoring it.)
-#[cfg(unix)]
-#[test]
-fn redirect_ledger_write_failure_commits_nothing() {
-    let fx = npm_fixture();
-    std::fs::create_dir_all(fx.vendor_dir()).unwrap();
-    let before_hash = compute_git_sha256_from_bytes(ORIG_INDEX);
-    let after_hash = compute_git_sha256_from_bytes(PATCHED_INDEX);
-    // A record claiming the purl with no edits left to unwind: the revert
-    // trivially succeeds, so the ledger persist is the step that fails.
-    let ledger = json!({
-        "version": 1,
-        "mode": "hosted",
-        "records": { PURL: patch_record(&before_hash, &after_hash) }
-    });
-    let ledger_bytes = serde_json::to_vec_pretty(&ledger).unwrap();
-    std::fs::write(fx.redirect_state_path(), &ledger_bytes).unwrap();
-    chmod(&fx.vendor_dir(), 0o555);
-    let _restore = RestorePerms(fx.vendor_dir());
-
-    let (code, env) = vendor_cli(fx.root(), &[]);
-    assert_eq!(code, 1, "{env:#}");
-    assert_eq!(env["error"]["code"], "vendor_commit_failed", "{env:#}");
-    assert!(
-        env["error"]["message"]
-            .as_str()
-            .is_some_and(|d| d.contains("could not commit")),
-        "{env:#}"
-    );
-    assert_eq!(
-        fx.lock_bytes(),
-        fx.original_lock,
-        "no vendor rewire is committed"
-    );
-    assert!(!fx.state_path().exists(), "no vendor ledger is committed");
-    assert_eq!(
-        std::fs::read(fx.redirect_state_path()).unwrap(),
-        ledger_bytes,
-        "the unpersistable ledger is left exactly as found"
-    );
-    assert!(
-        !fx.vendor_dir().join(".commit-journal.json").exists(),
-        "the failed commit leaves no journal behind"
-    );
-}
-
 // ─────────────────────────────────────────────────────────────────────
 // 8. human-mode error/refusal stderr surfaces (no --json, no --silent)
 //
@@ -1157,65 +1219,52 @@ async fn human_fetch_failure_prints_fetch_failed() {
         "nothing may be vendored from a failed fetch"
     );
 }
-
-/// Human corrupt-redirect-ledger surface: the takeover-capable purl's
-/// fail-closed refusal prints `Cannot vendor …` with the corruption.
+/// Human stale-ledger surface: a malformed pre-v5 redirect ledger is
+/// ignored — the run vendors normally and prints no refusal.
 #[test]
-fn human_corrupt_redirect_ledger_prints_cannot_vendor() {
+fn human_corrupt_pre_v5_redirect_ledger_vendors_normally() {
     let fx = npm_fixture();
     std::fs::create_dir_all(fx.vendor_dir()).unwrap();
     std::fs::write(fx.redirect_state_path(), b"garbage").unwrap();
 
     let (code, stdout, stderr) = human_vendor(&fx, &[]);
-    assert_eq!(code, 1, "stdout:\n{stdout}\nstderr:\n{stderr}");
+    assert_eq!(code, 0, "stdout:\n{stdout}\nstderr:\n{stderr}");
     assert!(
-        stderr.contains("Cannot vendor pkg:npm/left-pad@1.3.0:"),
-        "stderr names the refused purl: {stderr}"
+        stdout.contains("Vendored 1 package."),
+        "the stale ledger does not block the run: {stdout}"
     );
     assert!(
-        stdout.contains("Vendored 0 packages; 1 failed."),
-        "the fail-closed refusal is counted: {stdout}"
+        !stderr.contains("Cannot vendor"),
+        "no refusal is printed: {stderr}"
+    );
+    assert_eq!(
+        std::fs::read(fx.redirect_state_path()).unwrap(),
+        b"garbage",
+        "the pre-v5 ledger is left untouched"
     );
-    assert_eq!(fx.lock_bytes(), fx.original_lock, "lock untouched");
 }
 
-/// Human unrevertable-redirect surface: a claimed purl whose hosted edits
-/// cannot be reverted prints the `cannot revert the hosted redirect` line.
+/// Human unrestorable-hosted-pin surface: an offline run over a hosted pin
+/// prints the `Cannot vendor …: cannot restore the upstream entry` line and
+/// counts the refusal.
 #[test]
-fn human_unrevertable_redirect_prints_cannot_revert() {
+fn human_unrestorable_hosted_pin_prints_cannot_restore() {
     let fx = npm_fixture();
-    std::fs::create_dir_all(fx.vendor_dir()).unwrap();
-    let before_hash = compute_git_sha256_from_bytes(ORIG_INDEX);
-    let after_hash = compute_git_sha256_from_bytes(PATCHED_INDEX);
-    // Same unrevertable shape as section 3: a rewritten hosted edit with
-    // NO recorded original fragment.
-    let ledger = json!({
-        "version": 1,
-        "mode": "hosted",
-        "edits": [{
-            "path": "yarn.lock",
-            "kind": "redirect_yarn_classic_entry",
-            "action": "rewritten",
-            "key": "left-pad@1.3.0"
-        }],
-        "records": { PURL: patch_record(&before_hash, &after_hash) }
-    });
-    std::fs::write(
-        fx.redirect_state_path(),
-        serde_json::to_vec_pretty(&ledger).unwrap(),
-    )
-    .unwrap();
+    let hosted_lock = pin_hosted(&fx);
 
-    let (code, stdout, stderr) = human_vendor(&fx, &[]);
+    let (code, stdout, stderr) = human_vendor(&fx, &["--patch-server-url", HOSTED_ORIGIN]);
     assert_eq!(code, 1, "stdout:\n{stdout}\nstderr:\n{stderr}");
     assert!(
         stderr.contains("Cannot vendor pkg:npm/left-pad@1.3.0:")
-            && stderr.contains("cannot revert the hosted redirect"),
+            && stderr.contains("cannot restore the upstream entry"),
         "the human takeover-refusal line: {stderr}"
     );
-    assert_eq!(fx.lock_bytes(), fx.original_lock, "lock untouched");
+    assert!(
+        stdout.contains("Vendored 0 packages; 1 failed."),
+        "the fail-closed refusal is counted: {stdout}"
+    );
+    assert_eq!(fx.lock_bytes(), hosted_lock, "lock untouched");
 }
-
 /// Human backend-refusal surface: an installed package with NO lockfile of
 /// any flavor is a non-benign `vendor_lockfile_missing` refusal — the
 /// `Cannot vendor …` stderr line carries the backend's remedy.
diff --git a/crates/socket-patch-cli/tests/covgap_commands_vex.rs b/crates/socket-patch-cli/tests/covgap_commands_vex.rs
index a1bed29c..6de4d960 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_vex.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_vex.rs
@@ -1,5 +1,6 @@
 //! Coverage-gap tests for `commands/vex.rs`: the
-//! corrupt-ledger/corrupt-manifest hard-error family, the multi-manifest
+//! corrupt-ledger/corrupt-manifest family (hard errors, plus the advisory
+//! malformed pre-v5 redirect ledger), the multi-manifest
 //! product auto-detect warning echo, and the four skip guards in the
 //! go-patches `replace` synthesis (including the SECURITY fail-closed
 //! coordinate guard on tamper-able `go.mod` lines).
@@ -233,26 +234,46 @@ fn corrupt_manifest_json_envelope_carries_code_and_removes_stale_doc() {
 }
 
 // ──────────────────────────────────────────────────────────────────────
-// corrupt redirect ledger → `redirect_ledger_corrupt`, exit 2 (redirect ledger load)
+// corrupt pre-v5 redirect ledger → `redirect_ledger_corrupt` WARNING
 //
-// The module doc promises a HARD error for a present-but-malformed
-// `.socket/vendor/redirect-state.json`: attesting with its records
-// silently dropped would produce a false document. No manifest is laid
-// down — the ledger load must error BEFORE the empty-manifest /
-// manifest_not_found check, which is itself an ordering assertion.
+// v5 hosted mode keeps no ledger: hosted references come from the
+// lockfiles and their records from the API. A pre-v5
+// `.socket/vendor/redirect-state.json` is only an extra local record
+// source, so a malformed one is an advisory — its records are simply not
+// consulted, the run proceeds to its normal outcome, and (vex being a
+// read-only consumer) the file is left byte-identical, never quarantined.
 // ──────────────────────────────────────────────────────────────────────
 
-/// Plant a malformed redirect ledger at its canonical path.
+const CORRUPT_REDIRECT_LEDGER: &str = "{{{";
+
+/// Plant a malformed pre-v5 redirect ledger at its canonical path.
 fn write_corrupt_redirect_ledger(cwd: &Path) {
     let dir = cwd.join(".socket/vendor");
     std::fs::create_dir_all(&dir).unwrap();
-    std::fs::write(dir.join("redirect-state.json"), "{{{").unwrap();
+    std::fs::write(dir.join("redirect-state.json"), CORRUPT_REDIRECT_LEDGER).unwrap();
+}
+
+fn assert_redirect_ledger_untouched(cwd: &Path) {
+    assert_eq!(
+        std::fs::read_to_string(cwd.join(".socket/vendor/redirect-state.json")).unwrap(),
+        CORRUPT_REDIRECT_LEDGER,
+        "vex must leave the malformed pre-v5 ledger byte-identical"
+    );
+    assert!(
+        !cwd.join(".socket/vendor/redirect-state.json.corrupt")
+            .exists(),
+        "vex must not quarantine the pre-v5 ledger"
+    );
 }
 
 #[test]
-fn corrupt_redirect_ledger_hard_errors_in_human_mode() {
+fn corrupt_redirect_ledger_is_a_warning_in_human_mode_and_the_run_proceeds() {
     let tmp = tempfile::tempdir().unwrap();
     let cwd = tmp.path();
+    // A manifest patch whose package is nowhere on disk: the run's own
+    // outcome is `no_applicable_patches` (exit 1) — reaching it proves the
+    // malformed ledger did not abort the run.
+    write_ghost_npm_manifest(cwd, "pkg:npm/leftpad@1.0.0");
     write_corrupt_redirect_ledger(cwd);
 
     let out = cli()
@@ -265,32 +286,33 @@ fn corrupt_redirect_ledger_hard_errors_in_human_mode() {
         ])
         .output()
         .expect("invoke vex");
+    let stderr = String::from_utf8_lossy(&out.stderr);
     assert_eq!(
         out.status.code(),
-        Some(2),
-        "a malformed redirect ledger is a hard error, never a degrade. stderr:\n{}",
-        String::from_utf8_lossy(&out.stderr)
+        Some(1),
+        "a malformed pre-v5 redirect ledger is advisory: the run reaches its own \
+         no_applicable_patches outcome. stderr:\n{stderr}"
     );
-    assert!(out.stdout.is_empty(), "no document on a hard error");
-    let stderr = String::from_utf8_lossy(&out.stderr);
     assert!(
-        stderr.contains("redirect ledger") && stderr.contains("malformed"),
-        "the CorruptRedirectState message must reach stderr. got: {stderr}"
+        stderr.contains("Warning:")
+            && stderr.contains("pre-v5 redirect ledger")
+            && stderr.contains("malformed")
+            && stderr.contains("not consulted"),
+        "the redirect_ledger_corrupt warning must reach stderr. got: {stderr}"
     );
-    // Ordering: the ledger error fires before the missing-manifest check —
-    // the (absent) manifest must not be what gets reported.
     assert!(
         !stderr.contains("Manifest not found"),
-        "the redirect-ledger error must win over manifest_not_found. got: {stderr}"
+        "the manifest was read and planned from. got: {stderr}"
     );
+    assert_redirect_ledger_untouched(cwd);
 }
 
 #[test]
-fn corrupt_redirect_ledger_json_envelope_carries_code_and_preserves_ledger() {
+fn corrupt_redirect_ledger_json_envelope_carries_the_warning_and_preserves_ledger() {
     let tmp = tempfile::tempdir().unwrap();
     let cwd = tmp.path();
+    write_ghost_npm_manifest(cwd, "pkg:npm/leftpad@1.0.0");
     write_corrupt_redirect_ledger(cwd);
-    let ledger_path = cwd.join(".socket/vendor/redirect-state.json");
 
     let vex_path = cwd.join("out.vex.json");
     let out = cli()
@@ -306,43 +328,78 @@ fn corrupt_redirect_ledger_json_envelope_carries_code_and_preserves_ledger() {
         ])
         .output()
         .expect("invoke vex");
-    assert_eq!(
-        out.status.code(),
-        Some(2),
-        "redirect_ledger_corrupt is a hard error in --json mode too. stdout:\n{}",
-        String::from_utf8_lossy(&out.stdout)
-    );
     let env: Value = serde_json::from_slice(&out.stdout).expect("envelope JSON on stdout");
-    assert_eq!(env["status"], "error", "{env}");
-    assert_eq!(env["error"]["code"], "redirect_ledger_corrupt", "{env}");
+    assert_eq!(out.status.code(), Some(1), "{env}");
+    // The run's own outcome, not a ledger error.
+    assert_eq!(env["error"]["code"], "no_applicable_patches", "{env}");
+    let skipped = env["events"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .find(|e| e["action"] == "skipped" && e["purl"] == "pkg:npm/leftpad@1.0.0")
+        .unwrap_or_else(|| panic!("the manifest patch was evaluated: {env}"));
+    assert_eq!(skipped["errorCode"], "package_not_found", "{env}");
+    let warning = env["warnings"]
+        .as_array()
+        .unwrap_or_else(|| panic!("warnings[] expected: {env}"))
+        .iter()
+        .find(|w| w["code"] == "redirect_ledger_corrupt")
+        .unwrap_or_else(|| panic!("redirect_ledger_corrupt must be in warnings[]: {env}"));
     assert!(
-        env["error"]["message"]
+        warning["detail"]
             .as_str()
-            .unwrap()
-            .contains("malformed"),
-        "the envelope must carry the CorruptRedirectState detail: {env}"
+            .is_some_and(|m| m.contains("malformed") && m.contains("redirect-state.json")),
+        "{env}"
     );
-    // vex is a READ-ONLY ledger consumer: the malformed file may still hold
-    // the only pre-redirect revert data, so it must be left exactly where it
-    // was — neither deleted nor quarantined by this run.
-    assert_eq!(
-        std::fs::read_to_string(&ledger_path).unwrap(),
-        "{{{",
-        "vex must not touch the malformed redirect ledger"
+    // Under --json the warning travels in the envelope only.
+    let stderr = String::from_utf8_lossy(&out.stderr);
+    assert!(
+        !stderr.contains("pre-v5 redirect ledger"),
+        "--json must not echo the warning on stderr: {stderr}"
     );
+    assert_redirect_ledger_untouched(cwd);
+    assert!(!vex_path.exists(), "no document when nothing was attested");
+}
+
+#[test]
+fn corrupt_redirect_ledger_alone_warns_and_is_still_manifest_not_found() {
+    let tmp = tempfile::tempdir().unwrap();
+    let cwd = tmp.path();
+    write_corrupt_redirect_ledger(cwd);
+
+    let vex_path = cwd.join("out.vex.json");
+    let out = cli()
+        .args([
+            "vex",
+            "--cwd",
+            cwd.to_str().unwrap(),
+            "--json",
+            "--output",
+            vex_path.to_str().unwrap(),
+            "--product",
+            "pkg:npm/app@1.0.0",
+        ])
+        .output()
+        .expect("invoke vex");
+    let env: Value = serde_json::from_slice(&out.stdout).expect("envelope JSON on stdout");
+    // A malformed ledger is no patch source: with nothing else on disk the
+    // run is the ordinary nothing-to-attest error.
+    assert_eq!(out.status.code(), Some(2), "{env}");
+    assert_eq!(env["error"]["code"], "manifest_not_found", "{env}");
     assert!(
-        !cwd.join(".socket/vendor/redirect-state.json.corrupt")
-            .exists(),
-        "vex must not quarantine the ledger (that is the writer's recovery flow)"
+        env["warnings"]
+            .as_array()
+            .is_some_and(|w| w.iter().any(|w| w["code"] == "redirect_ledger_corrupt")),
+        "{env}"
     );
-    assert!(!vex_path.exists(), "no document on a hard error");
+    assert_redirect_ledger_untouched(cwd);
 }
 
 // ──────────────────────────────────────────────────────────────────────
 // corrupt vendor ledger → `vendor_ledger_corrupt`, exit 2
 //
 // A present-but-corrupt `.socket/vendor/state.json` is a hard error
-// mirroring `redirect_ledger_corrupt`: the vendor ledger is an
+// (unlike the advisory pre-v5 redirect ledger above): the vendor ledger is an
 // attestation input in its own right — it carries embedded records and
 // the entries whose wiring liveness gates them — so a run that cannot read
 // it cannot tell which vendored patches it is dropping, and attesting from
diff --git a/crates/socket-patch-cli/tests/e2e_bun_lockb.rs b/crates/socket-patch-cli/tests/e2e_bun_lockb.rs
index 959f506f..d51b6c77 100644
--- a/crates/socket-patch-cli/tests/e2e_bun_lockb.rs
+++ b/crates/socket-patch-cli/tests/e2e_bun_lockb.rs
@@ -1,6 +1,9 @@
 //! Real Bun binary-lock acceptance tests. The CLI must never invoke a Bun
 //! conversion or replace bun.lockb with text. Every terminal mode is checked
-//! with an empty-cache frozen install, and rollback restores the exact input.
+//! with an empty-cache frozen install, and rollback restores the exact input
+//! (v5: a hosted pin in a binary lock is refused by rollback — restored from
+//! version control instead — while a vendor takeover rebuilds its registry
+//! record from the npm registry, refusing only offline).
 //!
 //! Run scripts/backtest-bun-lockb.py for the writer/reader release matrix.
 //! SOCKET_PATCH_BUN_LOCKB_REQUIRED=1 makes missing tools a hard error;
@@ -62,8 +65,14 @@ fn require_success(output: Output, label: &str) -> Output {
 }
 
 fn cli(project: &Path, args: &[&str]) -> Value {
+    cli_env(project, args, &[])
+}
+
+/// [`cli`] with extra environment variables.
+fn cli_env(project: &Path, args: &[&str], envs: &[(&str, &str)]) -> Value {
     let output = require_success(
         command(env!("CARGO_BIN_EXE_socket-patch"), project)
+            .envs(envs.iter().copied())
             .args(args)
             .args([
                 "--cwd",
@@ -84,6 +93,69 @@ fn cli(project: &Path, args: &[&str]) -> Value {
     })
 }
 
+/// [`cli`] for a run expected to fail: `(exit code, envelope)`.
+fn cli_code(project: &Path, args: &[&str]) -> (i32, Value) {
+    let output = command(env!("CARGO_BIN_EXE_socket-patch"), project)
+        .args(args)
+        .args([
+            "--cwd",
+            project.to_str().unwrap(),
+            "--json",
+            "--no-telemetry",
+        ])
+        .output()
+        .unwrap();
+    let envelope = serde_json::from_slice(&output.stdout).unwrap_or_else(|error| {
+        panic!(
+            "{error}: {}\n{}",
+            String::from_utf8_lossy(&output.stdout),
+            String::from_utf8_lossy(&output.stderr)
+        )
+    });
+    (output.status.code().unwrap_or(-1), envelope)
+}
+
+/// v5 keeps no hosted ledger, so undoing a hosted pin means restoring the
+/// entry's upstream registry form. For a binary `bun.lockb` only a vendor
+/// takeover rebuilds that record (it refuses a workspace-normalized lock), so
+/// `rollback` REFUSES the pin, naming the checkout remedy, and leaves the
+/// lock exactly as found; the test then applies that remedy (`git checkout --
+/// bun.lockb`, here: the original bytes written back).
+fn rollback_refuses_binary_hosted_pin_then_checkout(fixture: &Fixture, server: &MockServer) {
+    let hosted_lock = fixture.lock();
+    let uri = server.uri();
+    let (code, env) = cli_code(
+        &fixture.project,
+        &["rollback", "--yes", "--patch-server-url", &uri],
+    );
+    assert_eq!(code, 1, "a binary hosted pin cannot be restored: {env}");
+    assert_eq!(env["status"], "partial_failure", "{env}");
+    let failed = env["hosted"]["failed"]
+        .as_array()
+        .cloned()
+        .unwrap_or_default();
+    assert!(
+        failed.iter().any(|f| f["purl"] == PURL
+            && f["error"]
+                .as_str()
+                .is_some_and(|e| e.contains("git checkout -- bun.lockb"))),
+        "the refusal names the checkout remedy: {env}"
+    );
+    assert_eq!(
+        fixture.lock(),
+        hosted_lock,
+        "a refused restore writes nothing"
+    );
+    assert!(
+        !fixture
+            .project
+            .join(".socket/vendor/redirect-state.json")
+            .exists(),
+        "no hosted ledger exists"
+    );
+    std::fs::write(fixture.project.join("bun.lockb"), &fixture.original_lock).unwrap();
+}
+
 fn scan(project: &Path, server: &MockServer, mode: &str, extra: &[&str]) -> Value {
     let uri = server.uri();
     let mut args = vec![
@@ -670,10 +742,116 @@ async fn native_binary_hosted_vendored_takeover_roundtrip() {
         "hosted rerun: {repeat}"
     );
     assert_eq!(fixture.lock(), hosted_lock);
+    assert!(
+        !project.join(".socket/vendor/redirect-state.json").exists(),
+        "hosted mode writes no ledger"
+    );
     std::fs::rename(&modules, project.join("node_modules")).unwrap();
 
-    // Hosted -> vendored, including truthful dry run and exact rerun state.
+    // Hosted -> vendored: v5 restores a hosted pin's upstream entry before
+    // vendoring over it, re-resolving the registry record from the npm
+    // registry — which an OFFLINE takeover cannot do, so it is REFUSED (dry
+    // and wet alike, nothing written) with the checkout remedy. Online, the
+    // takeover rebuilds the binary registry record exactly and vendors over
+    // it; `vendor --revert` then gives back the original bytes. After that
+    // (equivalently, after `git checkout -- bun.lockb`) the offline vendor
+    // proceeds, with a truthful dry run and exact rerun state.
     fixture.stage();
+    let uri = server.uri();
+    let before = snapshot(project);
+    for extra in [&["--dry-run"][..], &[][..]] {
+        let mut args = vec!["vendor", "--offline", "--patch-server-url", &uri];
+        args.extend_from_slice(extra);
+        let (code, refused) = cli_code(project, &args);
+        assert_eq!(
+            code, 1,
+            "vendor {extra:?} over a binary hosted pin: {refused}"
+        );
+        let failed = refused["events"]
+            .as_array()
+            .and_then(|events| {
+                events
+                    .iter()
+                    .find(|e| e["errorCode"] == "redirect_revert_failed")
+            })
+            .unwrap_or_else(|| panic!("expected redirect_revert_failed: {refused}"));
+        assert_eq!(failed["purl"], PURL, "{refused}");
+        assert!(
+            failed["error"].as_str().is_some_and(|e| {
+                e.contains("cannot vendor over the live hosted pin")
+                    && e.contains("git checkout -- bun.lockb")
+            }),
+            "{refused}"
+        );
+        assert_eq!(
+            snapshot(project),
+            before,
+            "refused vendor {extra:?} wrote nothing"
+        );
+    }
+    // The npm registry's version document for minimist@1.2.2 (the public
+    // registry's values, which the original lock pins), served locally.
+    let integrity = "sha512-rIqbOrKb8GJmx/5bc2M0QchhUouMXSpd1RTclXsB41JdL+VtnojfaJR+h7F9k18/4kHUsBFgk80Uk+q569vjPA==";
+    let digest = base64::engine::general_purpose::STANDARD
+        .decode(integrity.trim_start_matches("sha512-"))
+        .unwrap();
+    assert!(
+        fixture.original_lock.windows(64).any(|w| w == digest.as_slice()),
+        "the original lock pins the registry digest"
+    );
+    Mock::given(method("GET"))
+        .and(path("/minimist/1.2.2"))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({"dist": {
+            "tarball": "https://registry.npmjs.org/minimist/-/minimist-1.2.2.tgz",
+            "integrity": integrity}})))
+        .mount(&server)
+        .await;
+    let taken_over = cli_env(
+        project,
+        &["vendor", "--patch-server-url", &uri, "--vendor-source", "build"],
+        &[("SOCKET_NPM_REGISTRY", &uri)],
+    );
+    assert_eq!(
+        taken_over["summary"]["applied"], 1,
+        "online vendor over the binary hosted pin: {taken_over}"
+    );
+    assert!(
+        taken_over["events"].as_array().is_some_and(|events| events
+            .iter()
+            .any(|e| e["errorCode"] == "vendor_takeover_reverted_redirect")),
+        "the takeover is reported: {taken_over}"
+    );
+    let vendor_lock = fixture.lock();
+    assert!(
+        !vendor_lock
+            .windows(uri.len())
+            .any(|w| w == uri.as_bytes()),
+        "no hosted URL is left in bun.lockb"
+    );
+    let state: Value = serde_json::from_slice(
+        &std::fs::read(project.join(".socket/vendor/state.json")).unwrap(),
+    )
+    .unwrap();
+    let original = state["entries"][PURL]["wiring"]
+        .as_array()
+        .and_then(|w| w.iter().find(|r| r["kind"] == "bun_lockb_package"))
+        .map(|r| r["original"].clone())
+        .unwrap_or_else(|| panic!("bun_lockb_package wiring: {state}"));
+    assert_eq!(original["name"], "minimist", "{original}");
+    assert_eq!(original["version"], "1.2.2", "{original}");
+    assert_eq!(
+        original["resolution"],
+        "https://registry.npmjs.org/minimist/-/minimist-1.2.2.tgz",
+        "the vendor ledger records the registry record: {original}"
+    );
+    fixture.frozen("taken-over", &fixture.patched, "minimist");
+    let reverted = cli(project, &["vendor", "--revert", "--offline"]);
+    assert_eq!(
+        fixture.lock(),
+        fixture.original_lock,
+        "the revert restores the pre-hosted bytes exactly: {reverted}"
+    );
+    assert!(!project.join(".socket/vendor").exists(), "{reverted}");
     let before = snapshot(project);
     let preview = cli(project, &["vendor", "--offline", "--dry-run"]);
     assert_eq!(snapshot(project), before, "vendor dry run: {preview}");
@@ -767,8 +945,7 @@ async fn native_binary_hosted_vendored_takeover_roundtrip() {
     );
     fixture.frozen("hosted-again", &fixture.patched, "minimist");
     fixture.manifestless_vex("hosted-again", bun_vex::BunMode::Hosted, &server.uri());
-    let reverted = cli(project, &["rollback", "--yes"]);
-    assert_eq!(reverted["status"], "success", "rollback: {reverted}");
+    rollback_refuses_binary_hosted_pin_then_checkout(&fixture, &server);
     fixture.pristine();
     fixture.frozen("rolled-back", &fixture.original, "minimist");
 }
@@ -847,7 +1024,7 @@ async fn native_binary_alias_and_transitive() {
             bun_vex::BunMode::Hosted,
             &server.uri(),
         );
-        cli(&fixture.project, &["rollback", "--yes"]);
+        rollback_refuses_binary_hosted_pin_then_checkout(&fixture, &server);
         fixture.pristine();
         fixture.stage();
         let result = cli(&fixture.project, &["vendor", "--offline"]);
diff --git a/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs b/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
index e046c046..225bba3c 100644
--- a/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
@@ -34,8 +34,8 @@
 //! Both end in the manifest-less VEX tail
 //! ([`golang_e2e_matrix::manifestless_vex`]): a fresh checkout on a fresh
 //! machine (real `go run`, patched module in its cache) attests the patch
-//! `(redirected)` from go.mod/go.sum + the patch API alone — with and
-//! without the redirect ledger, never offline without a record, never once
+//! `(redirected)` from go.mod/go.sum + the patch API alone (v5 hosted mode
+//! writes no redirect ledger), never offline without a record, never once
 //! the replace is reverted. The Go release is whatever `go` is on `PATH`
 //! (see `golang_e2e_matrix` for the version matrix knobs).
 
@@ -547,8 +547,8 @@ fn day2_machine_builds_patched_module_from_committed_files_alone() {
 /// onto the gopatch module path, plus BOTH go.sum `h1:` lines (the goproxy
 /// integrity pair is all-or-nothing; the grant carries it on the override's
 /// identifiers) — and a fresh day-2 machine must build the PATCHED module
-/// from the committed files alone. Hosted persistence is the redirect ledger
-/// ONLY: no manifest, no blobs.
+/// from the committed files alone. Hosted persistence is the go.mod/go.sum
+/// rewrite ONLY: no manifest, no blobs, no ledger (v5).
 // multi_thread: the CLI subprocess blocks a worker thread while wiremock
 // keeps serving the view + reference routes on the others.
 // #[serial]: see the sibling test's note — env mutation vs env iteration.
@@ -564,7 +564,7 @@ async fn golang_get_uuid_hosted_day2_machine_builds() {
     let purl = format!("pkg:golang/{UMOD}@{UVER}");
     let artifact_url = format!("{}/{}/@v/{SVER}.zip", fx.proxy_url, fx.smod);
 
-    // API mocks: `view/{uuid}` (the record the redirect ledger embeds for
+    // API mocks: `view/{uuid}` (the record the hosted run fetches for its
     // VEX) + the reference grant whose goproxy override carries the module
     // path/version and the gopatch-flavor hash pair the rewriter pins.
     let server = MockServer::start().await;
@@ -694,17 +694,13 @@ async fn golang_get_uuid_hosted_day2_machine_builds() {
         "go.sum must pin the served-.mod hash.\nwant: {want_mod}\ngot:\n{gosum}"
     );
 
-    // Hosted persistence contract: the ledger IS the persistence.
-    let ledger: serde_json::Value = serde_json::from_str(
-        &std::fs::read_to_string(fx.consumer.join(".socket/vendor/redirect-state.json"))
-            .expect("redirect ledger must be written"),
-    )
-    .unwrap();
-    assert_eq!(ledger["mode"], "hosted", "ledger: {ledger}");
-    assert_eq!(
-        ledger["records"][purl.as_str()]["uuid"],
-        UUID,
-        "the ledger must embed the patch record for VEX: {ledger}"
+    // Hosted persistence contract (v5): the go.mod/go.sum rewrite IS the
+    // persistence — no ledger.
+    assert!(
+        !fx.consumer
+            .join(".socket/vendor/redirect-state.json")
+            .exists(),
+        "hosted mode must NOT write a redirect ledger ({purl})"
     );
     assert!(
         !fx.consumer.join(".socket/manifest.json").exists(),
@@ -753,7 +749,7 @@ async fn golang_get_uuid_hosted_day2_machine_builds() {
         String::from_utf8_lossy(&patched.stdout)
     );
 
-    // ── manifest-less VEX over the committed state (ledger included) ─────
+    // ── manifest-less VEX over the committed state (no ledger) ───────────
     // The API stand-in owns its own runtime, so the tail runs off this
     // test's async runtime.
     std::thread::scope(|scope| {
diff --git a/crates/socket-patch-cli/tests/e2e_golang_hosted_state.rs b/crates/socket-patch-cli/tests/e2e_golang_hosted_state.rs
index 81157c77..865bd6bc 100644
--- a/crates/socket-patch-cli/tests/e2e_golang_hosted_state.rs
+++ b/crates/socket-patch-cli/tests/e2e_golang_hosted_state.rs
@@ -83,6 +83,20 @@ async fn mount_hosted_grant(server: &MockServer) {
         .await;
 }
 
+/// Serve Go's checksum database lookup for the upstream module (the
+/// `SOCKET_GOSUMDB_URL` override the hosted -> upstream restore reads): the
+/// two go.sum lines of `UPSTREAM_SUM`, so the restore re-derives exactly
+/// the pair the hosted rewrite pruned.
+async fn mount_sumdb(server: &MockServer) {
+    Mock::given(method("GET"))
+        .and(path(format!("/lookup/{UMOD}@{UVER}")))
+        .respond_with(ResponseTemplate::new(200).set_body_string(format!(
+            "12345\n{UPSTREAM_SUM}\ngo.sum database tree\n12345\nAAAA\n"
+        )))
+        .mount(server)
+        .await;
+}
+
 fn get_hosted(consumer: &Path, server: &MockServer, modcache: &Path) -> serde_json::Value {
     let (code, stdout, stderr) = common::run_with_env(
         consumer,
@@ -311,8 +325,10 @@ fn pristine_module(modcache: &Path) {
     std::fs::write(module_dir.join("lib.go"), PRISTINE_LIB).unwrap();
 }
 
-/// Hosted `rollback` puts the pruned upstream go.sum pair back where go
-/// sorts it, so go.mod and go.sum return byte for byte.
+/// Hosted `rollback` drops the hosted `replace` and puts the pruned upstream
+/// go.sum pair back where go sorts it -- re-derived from the (mocked)
+/// checksum database, no ledger involved -- so go.mod and go.sum return
+/// byte for byte. Offline, the pin is refused and nothing is written.
 #[tokio::test(flavor = "multi_thread")]
 async fn hosted_rollback_restores_go_sum_byte_for_byte() {
     let tmp = tempfile::tempdir().unwrap();
@@ -325,23 +341,63 @@ async fn hosted_rollback_restores_go_sum_byte_for_byte() {
     mount_hosted_grant(&server).await;
     let env = get_hosted(&consumer, &server, &modcache);
     assert_eq!(env["redirect"]["redirected"], 1, "envelope: {env}");
+    assert!(
+        !consumer.join(".socket/vendor/redirect-state.json").exists(),
+        "hosted mode keeps no ledger: go.mod/go.sum are the record"
+    );
+    let wired_mod = std::fs::read_to_string(consumer.join("go.mod")).unwrap();
+    let wired_sum = std::fs::read_to_string(consumer.join("go.sum")).unwrap();
+    assert_ne!(wired_mod, go_mod, "precondition: go.mod is hosted-wired");
 
-    let (code, stdout, stderr) = common::run_with_env(
-        &consumer,
-        &[
+    let rollback = |extra: &[&str], env: &[(&str, &str)]| {
+        let mut args = vec![
             "rollback",
             "--json",
             "--yes",
-            "--offline",
             "--cwd",
             consumer.to_str().unwrap(),
-        ],
-        &[("GOMODCACHE", modcache.to_str().unwrap())],
+        ];
+        args.extend_from_slice(extra);
+        let mut env_full = vec![("GOMODCACHE", modcache.to_str().unwrap())];
+        env_full.extend_from_slice(env);
+        common::run_with_env(&consumer, &args, &env_full)
+    };
+
+    let (code, stdout, stderr) = rollback(&["--offline"], &[]);
+    assert_eq!(
+        code, 1,
+        "offline must refuse\nstdout:\n{stdout}\nstderr:\n{stderr}"
+    );
+    let doc: serde_json::Value = serde_json::from_str(&stdout).unwrap();
+    assert_eq!(doc["hosted"]["failed"][0]["purl"], UPURL, "{doc}");
+    assert!(
+        doc["hosted"]["failed"][0]["error"]
+            .as_str()
+            .is_some_and(|e| e.contains("this run is offline") && e.contains("go.mod")),
+        "{doc}"
+    );
+    assert_eq!(
+        std::fs::read_to_string(consumer.join("go.mod")).unwrap(),
+        wired_mod
     );
+    assert_eq!(
+        std::fs::read_to_string(consumer.join("go.sum")).unwrap(),
+        wired_sum
+    );
+
+    mount_sumdb(&server).await;
+    let sumdb = server.uri();
+    let (code, stdout, stderr) = rollback(&[], &[("SOCKET_GOSUMDB_URL", sumdb.as_str())]);
     assert_eq!(
         code, 0,
         "rollback failed\nstdout:\n{stdout}\nstderr:\n{stderr}"
     );
+    let doc: serde_json::Value = serde_json::from_str(&stdout).unwrap();
+    assert_eq!(
+        doc["hosted"]["reverted"],
+        serde_json::json!([UPURL]),
+        "{doc}"
+    );
     assert_eq!(
         std::fs::read_to_string(consumer.join("go.mod")).unwrap(),
         go_mod
@@ -352,10 +408,11 @@ async fn hosted_rollback_restores_go_sum_byte_for_byte() {
     );
 }
 
-/// hosted → vendored takeover: vendoring must first unwind the hosted
-/// redirect (replace, socket go.sum lines, pruned upstream pair, ledger
-/// record), so the project is fully vendored — never a vendored go.mod
-/// beside a redirect ledger that still claims the module.
+/// hosted → vendored takeover: vendoring must first restore the hosted pin
+/// to its upstream entry (drop the hosted replace and the socket go.sum
+/// lines, re-derive the pruned upstream pair from the checksum database),
+/// so the project is fully vendored — never a vendored go.mod beside a
+/// hosted pin. No ledger is involved at any point.
 #[tokio::test(flavor = "multi_thread")]
 async fn vendored_takeover_of_hosted_module_unwinds_the_redirect() {
     let tmp = tempfile::tempdir().unwrap();
@@ -370,11 +427,14 @@ async fn vendored_takeover_of_hosted_module_unwinds_the_redirect() {
     assert_eq!(env["redirect"]["redirected"], 1, "envelope: {env}");
     let ledger_path = consumer.join(".socket/vendor/redirect-state.json");
     assert!(
-        std::fs::read_to_string(&ledger_path)
+        std::fs::read_to_string(consumer.join("go.mod"))
             .unwrap()
-            .contains(UPURL),
+            .contains("gopatch"),
         "precondition: the module is hosted-redirected"
     );
+    assert!(!ledger_path.exists(), "hosted mode keeps no ledger");
+    mount_sumdb(&server).await;
+    let sumdb = server.uri();
 
     let socket = consumer.join(".socket");
     std::fs::create_dir_all(socket.join("blobs")).unwrap();
@@ -400,16 +460,15 @@ async fn vendored_takeover_of_hosted_module_unwinds_the_redirect() {
     .unwrap();
     std::fs::write(socket.join("blobs").join(&after), PATCHED_LIB).unwrap();
 
+    // Online: the takeover's upstream restore consults the (mocked)
+    // checksum database; the patch itself comes from the local manifest.
     let (code, stdout, stderr) = common::run_with_env(
         &consumer,
+        &["vendor", "--json", "--cwd", consumer.to_str().unwrap()],
         &[
-            "vendor",
-            "--json",
-            "--offline",
-            "--cwd",
-            consumer.to_str().unwrap(),
+            ("GOMODCACHE", modcache.to_str().unwrap()),
+            ("SOCKET_GOSUMDB_URL", sumdb.as_str()),
         ],
-        &[("GOMODCACHE", modcache.to_str().unwrap())],
     );
     assert_eq!(
         code, 0,
@@ -432,9 +491,5 @@ async fn vendored_takeover_of_hosted_module_unwinds_the_redirect() {
         go_sum,
         "go.sum is back to its pre-redirect bytes"
     );
-    let ledger = std::fs::read_to_string(&ledger_path).unwrap_or_default();
-    assert!(
-        !ledger.contains(UPURL),
-        "the redirect ledger no longer claims the module: {ledger}"
-    );
+    assert!(!ledger_path.exists(), "no hosted ledger is ever written");
 }
diff --git a/crates/socket-patch-cli/tests/e2e_golang_workspace_build.rs b/crates/socket-patch-cli/tests/e2e_golang_workspace_build.rs
index 02201cdc..6fd68191 100644
--- a/crates/socket-patch-cli/tests/e2e_golang_workspace_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_golang_workspace_build.rs
@@ -18,7 +18,8 @@
 //!
 //! Each state then runs the manifest-less VEX tail
 //! ([`golang_e2e_matrix::manifestless_vex`]): fresh checkout, real install
-//! on a fresh cache, attested with and without ledgers, `record_unavailable`
+//! on a fresh cache, attested with and without ledgers (hosted mode writes
+//! none since v5), `record_unavailable`
 //! offline, omitted when tampered or reverted. Hermetic + offline (file
 //! GOPROXY, per-"machine" caches, wiremock API). Needs Go 1.18+ (`go.work`);
 //! the release is whatever `go` is on `PATH` (see `golang_e2e_matrix`).
@@ -604,8 +605,8 @@ fn go_work_hosted_members_build_patched_and_attest_without_manifest() {
         "only the ROOT module's files: {env}"
     );
     assert!(
-        root.join(".socket/vendor/redirect-state.json").is_file(),
-        "hosted persistence is the redirect ledger"
+        !root.join(".socket/vendor/redirect-state.json").exists(),
+        "v5 hosted persistence is the go.mod/go.sum rewrite alone — no ledger"
     );
     run_members(
         root,
diff --git a/crates/socket-patch-cli/tests/e2e_hosted_production.rs b/crates/socket-patch-cli/tests/e2e_hosted_production.rs
index 5c17b75a..ddab397e 100644
--- a/crates/socket-patch-cli/tests/e2e_hosted_production.rs
+++ b/crates/socket-patch-cli/tests/e2e_hosted_production.rs
@@ -358,9 +358,37 @@ fn scan_hosted(cwd: &Path, extra: &[&str]) -> serde_json::Value {
         // Exit 0 alone is not enough: the envelope carries the real verdict.
         "scan --mode hosted did not report success.\nenvelope:\n{env:#}\nstderr:\n{stderr}"
     );
+    // v5 hosted mode keeps no ledger: the lockfile pins are the whole state.
+    assert!(
+        !cwd.join(".socket/vendor/redirect-state.json").exists(),
+        "scan --mode hosted wrote the pre-v5 redirect ledger"
+    );
     env
 }
 
+/// The production record `GET /patch/view/<uuid>` serves (the public
+/// proxy), fetched on a private runtime so the sync legs can call it.
+fn published_view_record_blocking(uuid: &str) -> serde_json::Value {
+    let url = format!("{PROXY}/patch/view/{uuid}");
+    tokio::runtime::Runtime::new()
+        .expect("tokio runtime")
+        .block_on(async {
+            let resp = reqwest::Client::new()
+                .get(&url)
+                .header("Accept", "application/json")
+                .send()
+                .await
+                .unwrap_or_else(|e| panic!("GET {url}: {e}"));
+            let status = resp.status();
+            let body = resp
+                .text()
+                .await
+                .unwrap_or_else(|e| panic!("GET {url}: reading body: {e}"));
+            assert!(status.is_success(), "GET {url}: HTTP {status}\n{body}");
+            serde_json::from_str(&body).unwrap_or_else(|e| panic!("GET {url}: bad JSON ({e})"))
+        })
+}
+
 /// Assert the hosted redirect actually rewrote something, and return the list
 /// of rewritten files.
 ///
@@ -1034,10 +1062,39 @@ fn npm_package_lock_hosted_install_proof() {
     );
     assert_patched(&minimist_entry(&fx.proj), PATCH_MARKER, LEG);
 
+    // ROLLBACK on a copy of the committed state: v5 restores the upstream
+    // registry entry re-resolved from the REAL npm registry — the lock
+    // comes back equal to what npm wrote — and removes the `.npmrc` the
+    // hosted run created.
+    let copy = fx.proj.parent().unwrap().join("rollback-copy");
+    std::fs::create_dir_all(&copy).unwrap();
+    for f in ["package.json", "package-lock.json", ".npmrc"] {
+        std::fs::copy(fx.proj.join(f), copy.join(f)).unwrap();
+    }
+    let (code, stdout, stderr) = run(&copy, &["rollback", "--json", "--yes"]);
+    assert_eq!(code, 0, "{LEG}: rollback failed:\n{stdout}\n{stderr}");
+    let rb: serde_json::Value = serde_json::from_str(&stdout)
+        .unwrap_or_else(|e| panic!("{LEG}: rollback --json is not JSON ({e}):\n{stdout}"));
+    assert_eq!(
+        rb["hosted"]["reverted"],
+        serde_json::json!([NPM_PURL]),
+        "{LEG}: rollback restores the hosted pin: {rb:#}"
+    );
+    let json = |b: &[u8]| serde_json::from_slice::<serde_json::Value>(b).unwrap();
+    assert_eq!(
+        json(&std::fs::read(copy.join("package-lock.json")).unwrap()),
+        json(&lock_before),
+        "{LEG}: rollback restores the registry lock"
+    );
+    assert!(
+        !copy.join(".npmrc").exists(),
+        "{LEG}: rollback removes the .npmrc the hosted run created"
+    );
+
     // MANIFEST-LESS VEX against production: the installed patched tree is
-    // hash-verified against the real patch record — with the ledger, from
-    // lockfile discovery + the public proxy without it, never offline, and
-    // not once the lock is reverted.
+    // hash-verified against the real patch record — from lockfile discovery
+    // + the public proxy (hosted keeps no ledger), never offline, and not
+    // once the lock is reverted.
     npm_e2e_common::production_manifestless_vex(
         LEG,
         &fx.proj,
@@ -1199,15 +1256,14 @@ fn pnpm_hosted_install_proof() {
 }
 
 /// Manifest-less VEX over the reinstalled pnpm project, against the REAL
-/// public patch proxy: the ledger record attests `(redirected)`; with both
-/// ledgers deleted the production `view/<uuid>` record does; `--offline`
-/// has no record; and with the lock back on the registry (ledger kept)
-/// nothing attests, `--no-verify` included. Only the pinned advisory is
-/// asserted — production may add more to the patch later.
+/// public patch proxy: hosted keeps no ledger, so the production
+/// `view/<uuid>` record attests `(redirected)` from the lock alone;
+/// `--offline` has no record; and with the lock back on the registry
+/// nothing names the patch, `--no-verify` included. Only the pinned
+/// advisory is asserted — production may add more to the patch later.
 fn pnpm_hosted_manifestless_vex(proj: &Path, lock_pristine: &[u8], leg: &str) {
     use vex_e2e_common::{
-        assert_absent, assert_not_attested, run_vex, statements_for, strip_ledgers, strip_manifest,
-        VexRun,
+        assert_absent, assert_not_attested, run_vex, statements_for, strip_manifest, VexRun,
     };
     let bin = binary();
     let attested = |run: &VexRun, cell: &str| {
@@ -1226,15 +1282,14 @@ fn pnpm_hosted_manifestless_vex(proj: &Path, lock_pristine: &[u8], leg: &str) {
         );
     };
     strip_manifest(proj);
-    let ledger = proj.join(".socket/vendor/redirect-state.json");
-    let ledger_bytes = std::fs::read(&ledger).expect("redirect ledger");
-    attested(&VexRun::default(), "manifest deleted");
-    strip_ledgers(proj);
-    attested(&VexRun::default(), "ledgers deleted");
+    assert!(
+        !proj.join(".socket/vendor/redirect-state.json").exists(),
+        "{leg}: v5 hosted mode writes no ledger"
+    );
+    attested(&VexRun::default(), "lock + public proxy");
     let out = run_vex(&bin, proj, &VexRun::offline());
     assert_eq!(out.code, Some(1), "{leg} [offline]: {out}");
     assert_not_attested(&out.envelope, NPM_PURL, "record_unavailable");
-    std::fs::write(&ledger, &ledger_bytes).unwrap();
     std::fs::write(proj.join("pnpm-lock.yaml"), lock_pristine).unwrap();
     for no_verify in [false, true] {
         let out = run_vex(
@@ -1245,13 +1300,16 @@ fn pnpm_hosted_manifestless_vex(proj: &Path, lock_pristine: &[u8], leg: &str) {
                 ..VexRun::default()
             },
         );
-        assert_ne!(
+        assert_eq!(
             out.code,
-            Some(0),
-            "{leg} [reverted, no_verify={no_verify}]: {out}"
+            Some(2),
+            "{leg} [reverted, no_verify={no_verify}]: nothing names the patch: {out}"
+        );
+        assert_eq!(
+            out.envelope["error"]["code"], "manifest_not_found",
+            "{leg}: {out}"
         );
         assert_absent(out.doc.as_ref(), NPM_PURL);
-        assert_not_attested(&out.envelope, NPM_PURL, "redirect_unwired");
     }
 }
 
@@ -1328,9 +1386,9 @@ fn yarn_classic_hosted_install_proof() {
     assert_patched(&minimist_entry(&fx.proj), PATCH_MARKER, LEG);
 
     // Manifest-less VEX against the REAL public proxy: the record for the
-    // production patch comes from `patches-api.socket.dev` once the redirect
-    // ledger is gone; `--offline` is pointed at an empty local stand-in so
-    // its zero-request claim is observable.
+    // production patch comes from `patches-api.socket.dev` (hosted keeps no
+    // ledger); `--offline` is pointed at an empty local stand-in so its
+    // zero-request claim is observable.
     let empty = vex_e2e_common::PatchApi::empty();
     let reinstall_env = env;
     yarn_classic_vex::ManifestlessVex {
@@ -1533,11 +1591,11 @@ fn berry_skip_code(env: &serde_json::Value) -> String {
 /// Manifest-less VEX against PRODUCTION for the berry hosted leg (a hosted
 /// checkout carries no `.socket/manifest.json` by design): after the
 /// `--immutable` reinstall served the patched bytes, standalone `vex`
-/// attests the production patch — with the redirect ledger (online and
-/// `--offline`), with the lockfile alone (the record fetched from the
-/// public proxy), not at all `--offline` without a ledger
-/// (`record_unavailable`), and not once the lock is reverted to the
-/// registry and reinstalled (`redirect_unwired`, even with `--no-verify`).
+/// attests the production patch from the lockfile alone (the record fetched
+/// from the public proxy — v5 hosted keeps no ledger), not at all
+/// `--offline` (`record_unavailable`), and not once the lock is reverted to
+/// the registry and reinstalled (nothing names the patch, even with
+/// `--no-verify`).
 fn yarn_berry_hosted_manifestless_vex(fx: &NpmFixture, registry_lock: &[u8], env: &[(&str, &str)]) {
     const LEG: &str = "yarn_berry_hosted_install_proof (manifest-less vex)";
     let proj = &fx.proj;
@@ -1545,15 +1603,10 @@ fn yarn_berry_hosted_manifestless_vex(fx: &NpmFixture, registry_lock: &[u8], env
         !proj.join(".socket/manifest.json").exists(),
         "{LEG}: hosted mode writes no manifest"
     );
-    let ledger_path = proj.join(".socket/vendor/redirect-state.json");
-    let ledger = std::fs::read(&ledger_path).expect("redirect ledger");
-
-    let (code, env_json, doc) = yarn_berry_vex(proj, &[]);
-    assert_berry_redirected_attestation(code, &env_json, doc, &format!("{LEG}: ledger, online"));
-    let (code, env_json, doc) = yarn_berry_vex(proj, &["--offline"]);
-    assert_berry_redirected_attestation(code, &env_json, doc, &format!("{LEG}: ledger, offline"));
-
-    std::fs::remove_file(&ledger_path).unwrap();
+    assert!(
+        !proj.join(".socket/vendor/redirect-state.json").exists(),
+        "{LEG}: v5 hosted mode writes no ledger"
+    );
     let (code, env_json, doc) = yarn_berry_vex(proj, &[]);
     assert_berry_redirected_attestation(code, &env_json, doc, &format!("{LEG}: lockfile only"));
     let (code, env_json, doc) = yarn_berry_vex(proj, &["--offline"]);
@@ -1561,8 +1614,7 @@ fn yarn_berry_hosted_manifestless_vex(fx: &NpmFixture, registry_lock: &[u8], env
     assert_eq!(berry_skip_code(&env_json), "record_unavailable", "{LEG}");
     assert!(doc.is_none(), "{LEG}: no document");
 
-    // Revert the lock to the registry (ledger kept) and reinstall.
-    std::fs::write(&ledger_path, &ledger).unwrap();
+    // Revert the lock to the registry and reinstall.
     std::fs::write(proj.join("yarn.lock"), registry_lock).unwrap();
     std::fs::remove_dir_all(proj.join("node_modules")).ok();
     let reinstall = tool(proj, "yarn", &["install", "--immutable"], env);
@@ -1578,15 +1630,19 @@ fn yarn_berry_hosted_manifestless_vex(fx: &NpmFixture, registry_lock: &[u8], env
         &[][..],
     ] {
         let (code, env_json, doc) = yarn_berry_vex(proj, extra);
-        assert_eq!(code, 1, "{LEG}: reverted {extra:?}: {env_json:#}");
         assert_eq!(
-            berry_skip_code(&env_json),
-            "redirect_unwired",
-            "{LEG}: reverted {extra:?}"
+            code, 2,
+            "{LEG}: reverted {extra:?}: nothing names the patch: {env_json:#}"
+        );
+        assert_eq!(
+            env_json["error"]["code"], "manifest_not_found",
+            "{LEG}: reverted {extra:?}: {env_json:#}"
         );
         assert!(doc.is_none(), "{LEG}: reverted {extra:?}: no document");
     }
-    println!("VEX-MATRIX|yarn@4.6.0|production|hosted|manifest-less+ledgers-deleted+offline+reverted|PASS");
+    println!(
+        "VEX-MATRIX|yarn@4.6.0|production|hosted|manifest-less+lockfile-only+offline+reverted|PASS"
+    );
 }
 
 #[test]
@@ -1639,22 +1695,22 @@ fn bun_hosted_install_proof() {
         dump(&reinstall)
     );
     assert_patched(&minimist_entry(&fx.proj), PATCH_MARKER, LEG);
-    let ledger: serde_json::Value =
-        serde_json::from_str(&read(&fx.proj.join(".socket/vendor/redirect-state.json"))).unwrap();
-    let record = ledger["records"][NPM_PURL].clone();
+    // v5 hosted keeps no ledger: the record the attestation must match is
+    // production's own (`/patch/view/<uuid>` on the public proxy).
+    let record = published_view_record_blocking(NPM_UUID);
     bun_manifestless_vex_production(&fx.proj, &record, "redirected", &lock_before, LEG);
 }
 
 /// Manifest-less VEX over a PRODUCTION bun checkout (`checkout` holds the
 /// committed state plus a real frozen install of the patched bytes):
 /// with `.socket/manifest.json` deleted, standalone `vex` against the public
-/// patch API attests minimist under the ledger record's uuid with `marker`
-/// (`redirected` / `vendored`) and exactly the record's vulnerability ids;
-/// with both ledgers deleted as well it still attests (lockfile discovery +
-/// the API); `--offline` then omits it as `record_unavailable`; and with
-/// the ledgers back but `bun.lock` reverted to `registry_lock` it is NOT
-/// attested, verified or not. The hermetic twins (mock API, zero-request
-/// oracle) run in `e2e_redirect_bun_build` / `e2e_vendor_bun_build`.
+/// patch API attests minimist under the production record's uuid with
+/// `marker` and exactly the record's vulnerability ids (lockfile discovery
+/// plus the API: v5 hosted keeps no ledger); `--offline` omits it as
+/// `record_unavailable`; and with `bun.lock` reverted to `registry_lock`
+/// nothing names the patch any more, verified or not. The hermetic twins
+/// (mock API, zero-request oracle) run in `e2e_redirect_bun_build` /
+/// `e2e_vendor_bun_build`.
 fn bun_manifestless_vex_production(
     checkout: &Path,
     record: &serde_json::Value,
@@ -1730,24 +1786,13 @@ fn bun_manifestless_vex_production(
         })
     };
     let _ = std::fs::remove_file(checkout.join(".socket/manifest.json"));
+    assert!(
+        !checkout.join(".socket/vendor/redirect-state.json").exists(),
+        "{leg}: v5 hosted mode writes no ledger"
+    );
     let (code, env, doc) = vex(&[]);
     assert_eq!(code, Some(0), "{leg}: manifest-less vex: {env:#}");
     assert_eq!(attested(&doc), want, "{leg}: manifest-less vex: {env:#}");
-    let ledgers: Vec<(PathBuf, Vec<u8>)> = [
-        ".socket/vendor/state.json",
-        ".socket/vendor/redirect-state.json",
-    ]
-    .iter()
-    .map(|rel| checkout.join(rel))
-    .filter_map(|p| std::fs::read(&p).ok().map(|b| (p, b)))
-    .collect();
-    assert!(!ledgers.is_empty(), "{leg}: the flow left no ledger");
-    for (p, _) in &ledgers {
-        std::fs::remove_file(p).unwrap();
-    }
-    let (code, env, doc) = vex(&[]);
-    assert_eq!(code, Some(0), "{leg}: ledger-less vex: {env:#}");
-    assert_eq!(attested(&doc), want, "{leg}: ledger-less vex: {env:#}");
     let (code, env, doc) = vex(&["--offline"]);
     assert_eq!(code, Some(1), "{leg}: offline vex: {env:#}");
     assert_eq!(
@@ -1756,21 +1801,16 @@ fn bun_manifestless_vex_production(
         "{leg}: {env:#}"
     );
     assert!(attested(&doc).is_empty(), "{leg}: offline vex: {env:#}");
-    for (p, b) in &ledgers {
-        std::fs::write(p, b).unwrap();
-    }
     std::fs::write(checkout.join("bun.lock"), registry_lock).unwrap();
-    let unwired = if marker == "redirected" {
-        "redirect_unwired"
-    } else {
-        "vendor_unwired"
-    };
     for extra in [&[][..], &["--no-verify"][..]] {
         let (code, env, doc) = vex(extra);
-        assert_eq!(code, Some(1), "{leg}: reverted vex {extra:?}: {env:#}");
         assert_eq!(
-            skip(&env).as_deref(),
-            Some(unwired),
+            code,
+            Some(2),
+            "{leg}: reverted vex {extra:?}: nothing names the patch: {env:#}"
+        );
+        assert_eq!(
+            env["error"]["code"], "manifest_not_found",
             "{leg}: reverted {extra:?}: {env:#}"
         );
         assert!(
@@ -1778,7 +1818,7 @@ fn bun_manifestless_vex_production(
             "{leg}: reverted vex {extra:?}: {env:#}"
         );
     }
-    eprintln!("BUN-VEX production {marker} manifest-deleted/ledgers-deleted/offline/reverted ok");
+    eprintln!("BUN-VEX production {marker} manifest-deleted/offline/reverted ok");
 }
 
 // ===========================================================================
@@ -1935,7 +1975,7 @@ fn pypi_requirements_txt_hosted_install_proof() {
     );
 
     // Manifest-less VEX over the installed, redirected checkout (hosted
-    // writes no manifest; the steps also drop the redirect ledger).
+    // writes no manifest, and v5 no redirect ledger either).
     let original = format!("{PYPI_NAME}=={PYPI_VERSION}\n");
     pypi_manifestless_vex(
         &proj,
@@ -2004,6 +2044,17 @@ fn pypi_uv_lock_hosted_install_proof() {
     assert_redirected(&env_json, "uv.lock");
     let lock = read(&proj.join("uv.lock"));
     assert_hosted_pin(&lock, PYPI_UUIDS, LEG);
+    // The ONE uuid the resolver granted (and the lock now pins). The VEX
+    // stand-in below serves exactly that record: v5 hosted keeps no local
+    // record, so `production_record` resolves it from the public proxy, and
+    // handing it all of PYPI_UUIDS would let it serve the first one the
+    // proxy answers for — a different patch than the lock wires, which the
+    // manifest-less `vex` then (rightly) reports `record_unavailable` for.
+    let wired_uuid: &str = PYPI_UUIDS
+        .iter()
+        .copied()
+        .find(|u| lock.contains(u))
+        .unwrap_or_else(|| panic!("{LEG}: the uv.lock pins none of PYPI_UUIDS"));
 
     std::fs::remove_dir_all(&venv).expect("rm venv");
     let resync = tool(&proj, &uv, &["sync", "--frozen", "--quiet"], &env);
@@ -2020,19 +2071,19 @@ fn pypi_uv_lock_hosted_install_proof() {
     );
 
     // Manifest-less VEX over a fresh checkout (pyproject + uv.lock + .socket,
-    // reinstalled by uv from an empty cache through patch.socket.dev): the
-    // record comes from the redirect ledger, then — ledger deleted — from a
-    // local stand-in serving the SAME production record (hermetic, so a
-    // proxy 503 cannot flake the matrix); `--offline` makes zero requests;
-    // `apply --vex` and the leg's own `scan --mode hosted --vex` (live) attest;
-    // the reverted pair, ledger kept, reinstalled pristine, does not.
+    // reinstalled by uv from an empty cache through patch.socket.dev): v5
+    // hosted keeps no ledger, so the record comes from a local stand-in
+    // serving the SAME production record (hermetic, so a proxy 503 cannot
+    // flake the matrix); `--offline` makes zero requests; `apply --vex` and
+    // the leg's own `scan --mode hosted --vex` (live) attest; the reverted
+    // pair, reinstalled pristine, does not.
     uv_vex::production_manifestless(&uv_vex::Production {
         leg: LEG,
         proj: &proj,
         tmp: tmp.path(),
         mode: uv_vex::Mode::Hosted,
         purl: PYPI_PURL,
-        uuids: PYPI_UUIDS,
+        uuids: &[wired_uuid],
         registry: &registry,
         uv: &uv,
         patched: &|dir: &Path| {
@@ -2293,7 +2344,6 @@ async fn gem_bundler_hosted_install_proof() {
         &proj,
         &wired_uuid,
         "redirected",
-        "redirect_unwired",
         (&pristine_gemfile, pristine_lock.as_bytes()),
         &[
             ("BUNDLE_PATH", bundle_path.as_str()),
@@ -2305,10 +2355,9 @@ async fn gem_bundler_hosted_install_proof() {
 /// Manifest-less VEX over a gem production leg's installed checkout `dir`
 /// (the real public patch proxy supplies records; `envs` point the crawler
 /// at the leg's BUNDLE_PATH so the installed tree is hash-verified):
-/// attested with the ledger kept → attested from the lockfile wiring alone
-/// once both ledgers are deleted → `record_unavailable` offline (no
-/// ledger) → `unwired` once the Gemfile + lock are reverted to `pristine`
-/// (ledger restored), with and without `--no-verify`. Production's
+/// attested from the lockfile wiring alone (v5 hosted keeps no ledger) →
+/// `record_unavailable` offline → nothing names the patch once the Gemfile
+/// and lock are reverted to `pristine`, with and without `--no-verify`. Production's
 /// vulnerability set is not pinned here: every statement for the purl must
 /// be `not_affected` via `uuid` with `marker`.
 fn gem_manifestless_vex(
@@ -2316,13 +2365,10 @@ fn gem_manifestless_vex(
     dir: &Path,
     uuid: &str,
     marker: &str,
-    unwired: &str,
     pristine: (&[u8], &[u8]),
     envs: &[(&str, &str)],
 ) {
-    use vex_e2e_common::{
-        assert_not_attested, run_vex, statements_for, strip_ledgers, strip_manifest, VexRun,
-    };
+    use vex_e2e_common::{assert_not_attested, run_vex, statements_for, strip_manifest, VexRun};
     let purl = format!("pkg:gem/{GEM_NAME}@{GEM_VERSION}");
     let mut base = VexRun {
         product: Some("pkg:gem/app@1.0.0".into()),
@@ -2351,27 +2397,17 @@ fn gem_manifestless_vex(
             );
         }
     };
-    let ledgers = dir.join(".socket/vendor");
-    let saved: Vec<(std::ffi::OsString, Vec<u8>)> = std::fs::read_dir(&ledgers)
-        .map(|rd| {
-            rd.flatten()
-                .filter(|e| e.path().is_file())
-                .map(|e| (e.file_name(), std::fs::read(e.path()).unwrap()))
-                .collect()
-        })
-        .unwrap_or_default();
     strip_manifest(dir);
-    attested(&base, "ledger kept");
-    strip_ledgers(dir);
-    attested(&base, "ledgers deleted");
+    assert!(
+        !dir.join(".socket/vendor/redirect-state.json").exists(),
+        "{leg}: v5 hosted mode writes no ledger"
+    );
+    attested(&base, "lockfile wiring + public proxy");
     let mut offline = base.clone();
     offline.offline = true;
     let out = run_vex(&vex_e2e_common::binary(), dir, &offline);
-    assert_eq!(out.code, Some(1), "{leg} offline, no ledger: {out}");
+    assert_eq!(out.code, Some(1), "{leg} offline: {out}");
     assert_not_attested(&out.envelope, &purl, "record_unavailable");
-    for (name, bytes) in &saved {
-        std::fs::write(ledgers.join(name), bytes).unwrap();
-    }
     std::fs::write(dir.join("Gemfile"), pristine.0).unwrap();
     std::fs::write(dir.join("Gemfile.lock"), pristine.1).unwrap();
     for no_verify in [false, true] {
@@ -2380,13 +2416,25 @@ fn gem_manifestless_vex(
         let out = run_vex(&vex_e2e_common::binary(), dir, &run);
         assert_eq!(
             out.code,
-            Some(1),
-            "{leg} reverted no_verify={no_verify}: {out}"
+            Some(2),
+            "{leg} reverted no_verify={no_verify}: nothing names the patch: {out}"
+        );
+        assert_eq!(
+            out.envelope["error"]["code"], "manifest_not_found",
+            "{leg}: {out}"
+        );
+        assert!(
+            statements_for_opt(out.doc.as_ref(), &purl) == 0,
+            "{leg} reverted: {out}"
         );
-        assert_not_attested(&out.envelope, &purl, unwired);
     }
 }
 
+/// How many statements `doc` (if any) carries for `purl`.
+fn statements_for_opt(doc: Option<&serde_json::Value>, purl: &str) -> usize {
+    doc.map_or(0, |d| vex_e2e_common::statements_for(d, purl).len())
+}
+
 // ===========================================================================
 // Documented negative cases
 // ===========================================================================
diff --git a/crates/socket-patch-cli/tests/e2e_nuget_dotnet_build.rs b/crates/socket-patch-cli/tests/e2e_nuget_dotnet_build.rs
index a86b4ddd..9b4ccd72 100644
--- a/crates/socket-patch-cli/tests/e2e_nuget_dotnet_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_nuget_dotnet_build.rs
@@ -26,10 +26,10 @@
 //!
 //! | step | shape | expectation |
 //! |---|---|---|
-//! | 1 | no manifest, ledger present | attested `(redirected)` / `(vendored)` online and `--offline` (ledger record) |
+//! | 1 | no manifest, vendor ledger present (vendored only — v5 hosted writes no ledger) | attested `(vendored)` online and `--offline` (ledger record) |
 //! | 2 | no manifest, no ledgers | attested from the lockfile wiring + the patch API record; embedded `apply --vex` (+ `vendor --vex`) too |
 //! | 3 | `--offline`, no ledgers | omitted `record_unavailable`, ZERO requests to the API |
-//! | 4 | lock + config reverted to the registry, ledger + artifacts kept | omitted `redirect_unwired` / `vendor_unwired`, with and without `--no-verify`; a real `dotnet restore --locked-mode` of the reverted files installs the PRISTINE bytes |
+//! | 4 | lock + config reverted to the registry (vendor ledger + artifacts kept) | vendored: omitted `vendor_unwired`; hosted: nothing names the patch any more (`manifest_not_found`) — with and without `--no-verify`; a real `dotnet restore --locked-mode` of the reverted files installs the PRISTINE bytes |
 //!
 //! Gates (the `e2e` CI matrix runs this suite once per SDK major with
 //! `--ignored`): `#[ignore]` keeps it out of the unpinned `test` job (it
@@ -593,7 +593,10 @@ fn allow_http_source(config_path: &Path, uuid: &str) {
 // ── the shared manifest-less VEX matrix ───────────────────────────────
 
 /// Steps 1–4 on a fresh, really-restored checkout. `ledger` is the one the
-/// flow persisted; `store` holds the checkout's (patched) restore.
+/// flow persisted and `dead_reason` the skip a reverted checkout reports
+/// while it is kept — `None` for hosted (v5 writes no redirect ledger, so a
+/// reverted checkout names the patch nowhere); `store` holds the
+/// checkout's (patched) restore.
 #[allow(clippy::too_many_arguments)]
 fn manifestless_vex_matrix(
     dn: &Dotnet,
@@ -602,8 +605,7 @@ fn manifestless_vex_matrix(
     store: &Path,
     uuid: &str,
     marker: Marker,
-    ledger: &str,
-    dead_reason: &str,
+    ledger: Option<(&str, &str)>,
     pristine: &[u8],
     patched: &[u8],
     registry: &(String, String),
@@ -618,22 +620,29 @@ fn manifestless_vex_matrix(
     };
     assert!(!checkout.join(".socket/manifest.json").exists());
     assert!(
-        checkout.join(ledger).is_file(),
-        "the flow committed {ledger}"
+        !checkout
+            .join(socket_patch_core::patch::redirect::REDIRECT_STATE_REL)
+            .exists(),
+        "v5 hosted mode writes no redirect ledger"
     );
+    let saved_ledger = ledger.map(|(rel, _)| {
+        assert!(checkout.join(rel).is_file(), "the flow committed {rel}");
+        std::fs::read(checkout.join(rel)).unwrap()
+    });
 
     // (1) manifest gone, ledger present: online and offline (ledger record).
-    for (label, run) in [
-        ("online+ledger", VexRun::online(&api)),
-        ("offline+ledger", VexRun::offline()),
-    ] {
-        let out = vex_in(checkout, store, hosted_origin(run));
-        assert_eq!(out.code, Some(0), "SDK {sdk} {label}: {out}");
-        assert_attested(out.doc(), PURL, uuid, marker, &vulns());
+    if saved_ledger.is_some() {
+        for (label, run) in [
+            ("online+ledger", VexRun::online(&api)),
+            ("offline+ledger", VexRun::offline()),
+        ] {
+            let out = vex_in(checkout, store, hosted_origin(run));
+            assert_eq!(out.code, Some(0), "SDK {sdk} {label}: {out}");
+            assert_attested(out.doc(), PURL, uuid, marker, &vulns());
+        }
     }
 
-    // (2) ledgers gone too: the lockfile/config wiring + the API record.
-    let saved_ledger = std::fs::read(checkout.join(ledger)).unwrap();
+    // (2) no ledgers: the lockfile/config wiring + the API record.
     strip_ledgers(checkout);
     let before = api.view_requests(uuid);
     let out = vex_in(checkout, store, hosted_origin(VexRun::online(&api)));
@@ -685,10 +694,12 @@ fn manifestless_vex_matrix(
     );
     quiet.assert_no_requests();
 
-    // (4) the lock + config reverted to the registry, ledger + artifacts
-    // kept: the claim is dead even though the patched bytes are still in
-    // the checkout's store, with and without --no-verify.
-    std::fs::write(checkout.join(ledger), &saved_ledger).unwrap();
+    // (4) the lock + config reverted to the registry (a vendor ledger +
+    // artifacts kept): the claim is dead even though the patched bytes are
+    // still in the checkout's store, with and without --no-verify.
+    if let (Some((rel, _)), Some(bytes)) = (ledger, &saved_ledger) {
+        std::fs::write(checkout.join(rel), bytes).unwrap();
+    }
     std::fs::write(checkout.join("nuget.config"), &registry.0).unwrap();
     std::fs::write(checkout.join("packages.lock.json"), &registry.1).unwrap();
     let reverted_store = sb.dir(&format!("store-reverted-{uuid}"));
@@ -709,11 +720,17 @@ fn manifestless_vex_matrix(
             let mut run = hosted_origin(VexRun::offline());
             run.no_verify = no_verify;
             let out = vex_in(checkout, s, run);
-            assert_omitted(
-                &out,
-                dead_reason,
-                &format!("SDK {sdk} reverted nv={no_verify}"),
-            );
+            let cell = format!("SDK {sdk} reverted nv={no_verify}");
+            match ledger {
+                Some((_, dead_reason)) => assert_omitted(&out, dead_reason, &cell),
+                None => {
+                    assert_eq!(out.code, Some(2), "{cell}: nothing names the patch: {out}");
+                    assert_eq!(
+                        out.envelope["error"]["code"], "manifest_not_found",
+                        "{cell}: {out}"
+                    );
+                }
+            }
         }
     }
 }
@@ -818,8 +835,7 @@ fn nuget_hosted_dotnet_restore_then_manifestless_vex() {
         &store_co,
         HOSTED_UUID,
         Marker::Redirected,
-        socket_patch_core::patch::redirect::REDIRECT_STATE_REL,
-        "redirect_unwired",
+        None,
         &pristine,
         &patched,
         &registry,
@@ -919,8 +935,10 @@ fn nuget_vendored_dotnet_restore_then_manifestless_vex() {
         &store_co,
         VENDORED_UUID,
         Marker::Vendored,
-        socket_patch_core::vendor::VENDOR_STATE_REL,
-        "vendor_unwired",
+        Some((
+            socket_patch_core::vendor::VENDOR_STATE_REL,
+            "vendor_unwired",
+        )),
         &pristine,
         &patched,
         &registry,
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_bun_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_bun_build.rs
index 7915abe6..62758751 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_bun_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_bun_build.rs
@@ -3,9 +3,9 @@
 //!
 //! `scan --mode hosted` rewrites `bun.lock` so the patched dependency's
 //! `packages` entry moves from the registry 4-tuple to the URL 3-tuple
-//! `["<name>@<hosted-url>", {deps}, "sha512-<patched>"]`, and records the
-//! patch in the redirect ledger. This test proves every link against REAL
-//! `bun`:
+//! `["<name>@<hosted-url>", {deps}, "sha512-<patched>"]` — and writes
+//! nothing else (v5: no redirect ledger; the lock IS the hosted state).
+//! This test proves every link against REAL `bun`:
 //!
 //!   1. `bun install` of left-pad@1.3.0 (network for fixture setup only,
 //!      private `BUN_INSTALL_CACHE_DIR`). The text `bun.lock` is the default
@@ -24,8 +24,8 @@
 //!      bootstrap is needed).
 //!   3. `scan --mode hosted --json --vex` (the real binary): bun.lock now
 //!      pins the hosted URL + the patched sha512 and keeps its own
-//!      lockfileVersion line, the ledger embeds the record, the in-run VEX
-//!      is the `(redirected)` attestation.
+//!      lockfileVersion line, no ledger is written, the in-run VEX is the
+//!      `(redirected)` attestation (from this run's fetched record).
 //!   4. FRESH-CHECKOUT PROOF: only package.json + bun.lock + .socket/ travel;
 //!      `bun install --frozen-lockfile` with a fresh `BUN_INSTALL_CACHE_DIR`
 //!      MUST install the patched bytes from the hosted tarball. Then the
@@ -36,8 +36,10 @@
 //!      is the matrix twin) — and land the marker bytes again.
 //!
 //! The rollback leg continues from step 4: `rollback --yes` must restore
-//! bun.lock byte-for-byte to the pre-redirect snapshot, delete the redirect
-//! ledger, and a fresh frozen install of the restored lock must produce the
+//! bun.lock byte-for-byte to the pre-redirect snapshot — v5 re-resolves the
+//! upstream registry 4-tuple (a wiremock mirror of the pristine integrity,
+//! `SOCKET_NPM_REGISTRY`, with the mock origin named the patch server) —
+//! and a fresh frozen install of the restored lock must produce the
 //! ORIGINAL registry bytes (marker gone).
 //!
 //! The negative twin serves TAMPERED tarball bytes (a different, valid
@@ -293,9 +295,17 @@ fn bun(cwd: &Path, args: &[&str], cache_dir: &Path) -> Output {
 /// The real binary with `--no-telemetry` appended: nothing in this suite
 /// should ever post a telemetry event, mocked API or not.
 fn run_socket(cwd: &Path, args: &[&str]) -> (i32, String, String) {
+    run_socket_env(cwd, args, &[])
+}
+
+/// [`run_socket`] with extra env applied after the scrub.
+fn run_socket_env(cwd: &Path, args: &[&str], env: &[(String, String)]) -> (i32, String, String) {
     let mut cmd = Command::new(binary());
     cmd.args(args).arg("--no-telemetry").current_dir(cwd);
     cache_env::scrub_ambient_bun_env(&mut cmd);
+    for (k, v) in env {
+        cmd.env(k, v);
+    }
     let out = cmd.output().expect("failed to run socket-patch binary");
     (
         out.status.code().unwrap_or(-1),
@@ -900,7 +910,7 @@ async fn bun_hosted_project(
             assert_eq!(env["vex"]["format"], "openvex-0.2.0", "vex block: {env}");
             assert_eq!(
                 env["vex"]["verified"], false,
-                "in-run redirect VEX is attested from the ledger, not hash-verified: {env}"
+                "in-run redirect VEX is attested from the fetched record, not hash-verified: {env}"
             );
             let vex_doc: serde_json::Value =
                 serde_json::from_slice(&std::fs::read(proj.join("out.vex.json")).unwrap()).unwrap();
@@ -927,7 +937,7 @@ async fn bun_hosted_project(
         }
         HostedDriver::GetUuid => {
             // get's envelope nests the same redirect block into its own base
-            // shape; nothing is downloaded into `.socket/` (the ledger IS the
+            // shape; nothing is downloaded into `.socket/` (the lock IS the
             // persistence — parity with `scan --mode hosted`).
             assert_eq!(env["redirect"]["mode"], "hosted", "envelope: {env}");
             assert_eq!(env["found"], 1, "get keeps its found count: {env}");
@@ -990,10 +1000,9 @@ async fn bun_hosted_project(
         );
     }
 
-    let ledger = std::fs::read_to_string(redirect_ledger(&proj)).unwrap();
     assert!(
-        ledger.contains("\"records\"") && ledger.contains(GHSA),
-        "redirect ledger must embed the patch record + vulnerability: {ledger}"
+        !redirect_ledger(&proj).exists(),
+        "v5 hosted mode writes no redirect ledger — the lock is the hosted state"
     );
 
     Some(BunRedirectFixture {
@@ -1017,6 +1026,42 @@ fn redirect_ledger(proj: &Path) -> PathBuf {
         .join("redirect-state.json")
 }
 
+/// The env an unwind of the fixture's hosted pin runs with: the mock origin
+/// named the patch server (so its URL counts as a hosted pin) and an npm
+/// registry mirror serving `left-pad@1.3.0`'s version document with the
+/// integrity the PRISTINE lock recorded — all the v5 upstream restore of a
+/// bun.lock entry reads.
+async fn unwind_env(fx: &BunRedirectFixture) -> Vec<(String, String)> {
+    let server = &fx._server;
+    let lock_before = String::from_utf8(fx.lock_before.clone()).unwrap();
+    let line = packages_line(&lock_before, DEP);
+    let integrity = line
+        .rsplit('"')
+        .nth(1)
+        .filter(|s| s.starts_with("sha512-"))
+        .unwrap_or_else(|| panic!("no integrity in the pristine line {line}"))
+        .to_string();
+    Mock::given(method("GET"))
+        .and(path(format!("/registry/{DEP}/{DEP_VERSION}")))
+        .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+            "name": DEP,
+            "version": DEP_VERSION,
+            "dist": {
+                "tarball": format!("https://registry.npmjs.org/{DEP}/-/{DEP}-{DEP_VERSION}.tgz"),
+                "integrity": integrity
+            }
+        })))
+        .mount(server)
+        .await;
+    vec![
+        ("SOCKET_PATCH_SERVER_URL".to_string(), server.uri()),
+        (
+            "SOCKET_NPM_REGISTRY".to_string(),
+            format!("{}/registry", server.uri()),
+        ),
+    ]
+}
+
 /// Fresh dir `<tmp>/<name>` with only the committable files (package.json,
 /// bun.lock, bunfig.toml when the project has one, and `.socket/` when it
 /// exists — rollback removes it).
@@ -1380,10 +1425,10 @@ async fn bun_redirect_tampered_hosted_tarball_digest_boundary() {
 }
 
 /// Rollback leg: after the hosted rewrite and the fresh-checkout proof,
-/// `rollback --yes` (unscoped — the whole-ledger reverse replay) must
-/// restore bun.lock byte-for-byte to the pre-redirect snapshot and delete
-/// the redirect ledger, and a fresh frozen install of the restored lock
-/// must land the ORIGINAL registry bytes — the marker gone.
+/// `rollback --yes` (the v5 upstream restore of the hosted pin) must
+/// restore bun.lock byte-for-byte to the pre-redirect snapshot, and a
+/// fresh frozen install of the restored lock must land the ORIGINAL
+/// registry bytes — the marker gone.
 #[tokio::test(flavor = "multi_thread")]
 #[serial_test::serial]
 async fn bun_redirect_rollback_restores_lock_and_original_install() {
@@ -1401,7 +1446,8 @@ async fn bun_redirect_rollback_restores_lock_and_original_install() {
     assert_patched_fresh_install(&fx);
 
     let proj = &fx.proj;
-    let (code, stdout, stderr) = run_socket(
+    let env = unwind_env(&fx).await;
+    let (code, stdout, stderr) = run_socket_env(
         proj,
         &[
             "rollback",
@@ -1410,6 +1456,7 @@ async fn bun_redirect_rollback_restores_lock_and_original_install() {
             "--cwd",
             proj.to_str().unwrap(),
         ],
+        &env,
     );
     assert_eq!(
         code, 0,
@@ -1425,7 +1472,7 @@ async fn bun_redirect_rollback_restores_lock_and_original_install() {
     );
     assert!(
         !redirect_ledger(proj).exists(),
-        "rollback must delete the redirect ledger"
+        "no hosted ledger exists at any point"
     );
     let restored = std::fs::read_to_string(proj.join("bun.lock")).unwrap();
     assert!(
@@ -1527,11 +1574,11 @@ fn fresh_frozen_install_with_local_dep(
 /// still our wiring — the spec bun installs from is intact — so after a
 /// real re-save: `rollback --dry-run` must resolve, the repeat hosted run
 /// must report `redirected: 1` with no `redirect_bun_entry_not_found` and
-/// heal the line back to the 3-tuple (a second ledger edit), a fresh
-/// frozen install must land the patched bytes, and `rollback` must put the
-/// registry line back inside the GROWN lock and install the original bytes.
-/// On ≥ 1.3.10 the same steps prove the no-regression twin: digest kept,
-/// repeat run a no-op, one ledger edit.
+/// heal the line back to the 3-tuple, a fresh frozen install must land the
+/// patched bytes, and `rollback` must put the registry line back inside the
+/// GROWN lock and install the original bytes. On ≥ 1.3.10 the same steps
+/// prove the no-regression twin: digest kept, repeat run a no-op. No run
+/// writes a ledger.
 #[tokio::test(flavor = "multi_thread")]
 #[serial_test::serial]
 async fn bun_redirect_survives_a_digest_dropping_lock_resave() {
@@ -1588,7 +1635,8 @@ async fn bun_redirect_survives_a_digest_dropping_lock_resave() {
     manifestless_vex(&fx, "resaved", grown_registry.as_bytes());
 
     // 2. The unwind must already resolve over the re-saved lock (dry run).
-    let (code, stdout, stderr) = run_socket(
+    let unwind = unwind_env(&fx).await;
+    let (code, stdout, stderr) = run_socket_env(
         proj,
         &[
             "rollback",
@@ -1598,6 +1646,7 @@ async fn bun_redirect_survives_a_digest_dropping_lock_resave() {
             "--cwd",
             proj.to_str().unwrap(),
         ],
+        &unwind,
     );
     assert_eq!(
         code, 0,
@@ -1657,22 +1706,10 @@ async fn bun_redirect_survives_a_digest_dropping_lock_resave() {
         healed.contains("\"local-dep\": ["),
         "the grown entry survives"
     );
-    let ledger: serde_json::Value =
-        serde_json::from_slice(&std::fs::read(redirect_ledger(proj)).unwrap()).unwrap();
-    let edits = ledger["edits"].as_array().unwrap();
-    assert_eq!(
-        edits.len(),
-        if expect_drop { 2 } else { 1 },
-        "the heal is recorded as a second edit exactly when the digest was dropped: {ledger:#}"
+    assert!(
+        !redirect_ledger(proj).exists(),
+        "the repeat run (heal or no-op) writes no ledger"
     );
-    if expect_drop {
-        assert_eq!(
-            edits[1]["original"],
-            serde_json::json!(digestless_spelling),
-            "{ledger:#}"
-        );
-        assert_eq!(edits[1]["new"], serde_json::json!(wired_line), "{ledger:#}");
-    }
     eprintln!("REPEAT HOSTED RUN OK");
 
     // 4. The healed lock installs the patched bytes from an empty cache.
@@ -1682,9 +1719,9 @@ async fn bun_redirect_survives_a_digest_dropping_lock_resave() {
         "the healed lock must install the patched bytes"
     );
 
-    // 5. Rollback: registry line back inside the grown lock, ledger gone,
-    //    original bytes on a fresh install.
-    let (code, stdout, stderr) = run_socket(
+    // 5. Rollback: registry line back inside the grown lock (the upstream
+    //    restore), original bytes on a fresh install.
+    let (code, stdout, stderr) = run_socket_env(
         proj,
         &[
             "rollback",
@@ -1693,6 +1730,7 @@ async fn bun_redirect_survives_a_digest_dropping_lock_resave() {
             "--cwd",
             proj.to_str().unwrap(),
         ],
+        &unwind,
     );
     assert_eq!(
         code, 0,
@@ -1711,10 +1749,7 @@ async fn bun_redirect_survives_a_digest_dropping_lock_resave() {
         restored.contains("\"local-dep\": ["),
         "rollback must not disturb the grown entry:\n{restored}"
     );
-    assert!(
-        !redirect_ledger(proj).exists(),
-        "the emptied ledger is deleted"
-    );
+    assert!(!redirect_ledger(proj).exists(), "no hosted ledger");
     let installed = fresh_frozen_install_with_local_dep(&fx, "fresh-rolled-back", &tgz_name);
     assert_eq!(
         installed, fx.orig,
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_cargo_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_cargo_build.rs
index e3229b03..3df2d5bb 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_cargo_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_cargo_build.rs
@@ -20,17 +20,18 @@
 //!      reference / view API mocks AND a real sparse index
 //!      (`config.json` + per-crate index file + download route).
 //!   3. `scan --mode hosted --json --vex …` (the real binary): the three-file
-//!      rewrite lands, the ledger embeds the patch record, and the in-run
-//!      VEX is the unverified `(redirected)` attestation.
+//!      rewrite lands, no ledger is written (v5: the three files ARE the
+//!      hosted state), and the in-run VEX is the unverified `(redirected)`
+//!      attestation from this run's fetched record.
 //!   4. FRESH-CHECKOUT PROOF: only Cargo.toml + Cargo.lock + `.cargo/` +
-//!      `src/` + `.socket/` travel; `cargo fetch --locked` with an EMPTY
+//!      `src/` (+ `.socket/` when present) travel; `cargo fetch --locked` with an EMPTY
 //!      CARGO_HOME pulls the patched `.crate` from wiremock (byte-asserted
 //!      against the cache), and an offline compile oracle
 //!      (`cfg_if::socket_patched()`) proves the patched bytes are what cargo
 //!      extracts and links.
 //!   5. POST-INSTALL VERIFIED VEX: `socket-patch vex` hash-verifies the
-//!      extracted registry sources against the ledger record and emits the
-//!      `(redirected)` statement.
+//!      extracted registry sources against the patch record (fetched from
+//!      the API — no hosted ledger) and emits the `(redirected)` statement.
 //!
 //! The negative twin serves TAMPERED `.crate` bytes while the index cksum
 //! and the lockfile checksum keep the real sha256: the fresh `cargo fetch
@@ -41,22 +42,20 @@
 //! the SAME fixture through `get <uuid> --mode hosted` (v4.0) — parity by
 //! construction, since get hands the (purl, uuid) pair to scan's extracted
 //! run_redirect_selected engine — and re-proves the fresh-checkout fetch.
-//! Hosted get writes NO manifest and NO blobs (the redirect ledger is the
-//! persistence) and has no `--vex`.
+//! Hosted get writes NO manifest, NO blobs and NO ledger (the lockfile
+//! rewrite is the persistence) and has no `--vex`.
 //!
 //! MANIFEST-LESS VEX (both drivers): the fresh checkout above is then
 //! driven through the lockfile-discovery steps with the shared
 //! `vex_e2e_common` helpers against a separate patch-API stand-in —
-//! (1) no manifest, ledger kept → `(redirected)` from the ledger record,
-//! zero API calls; embedded `apply --vex` attests too; (2) ledger deleted →
-//! the lockfile's hosted `source` + the API's record still attest — with
-//! the patched copy extracted, and with nothing installed (the lock's
-//! checksum pin) — and embedded `apply --vex` / `scan --vex` too; (3) `--offline` with no ledger →
-//! `record_unavailable`, zero API requests; (4) the lockfile reverted to
-//! crates.io with the ledger restored — the stale lock alone (the patched
-//! copy still extracted), and the full three-file revert re-fetched from
-//! crates.io by the real cargo — → NOT attested (`redirect_unwired`), also
-//! under `--no-verify`.
+//! (1) no manifest (and no ledger — v5 writes none) → the lockfile's hosted
+//! `source` + the API's record attest `(redirected)`; embedded
+//! `apply --vex` attests too; (2) with the patched copy extracted, and with
+//! nothing installed (the lock's checksum pin) — and embedded `scan --vex`
+//! too; (3) `--offline` → `record_unavailable`, zero API requests; (4) the
+//! lockfile reverted to crates.io — the stale lock alone (the patched copy
+//! still extracted), and the full three-file revert re-fetched from
+//! crates.io by the real cargo — → NOT attested, also under `--no-verify`.
 //!
 //! Toolchain / lock format: `cargo_e2e_matrix` (`SOCKET_PATCH_CARGO_E2E_*`)
 //! runs every step under a pinned cargo release and re-encodes the
@@ -577,7 +576,7 @@ async fn redirect_scanned_project(
             assert_eq!(env["vex"]["statements"], 1, "vex block: {env}");
             assert_eq!(
                 env["vex"]["verified"], false,
-                "in-run hosted VEX is attested from the ledger, not hash-verified: {env}"
+                "in-run hosted VEX is attested from the fetched record, not hash-verified: {env}"
             );
         }
         Driver::GetUuid => {
@@ -589,7 +588,7 @@ async fn redirect_scanned_project(
             assert!(
                 env["downloaded"].is_null() && env["applied"].is_null(),
                 "hosted get must not report downloaded/applied — nothing \
-                 is persisted under .socket/ but the ledger: {env}"
+                 is persisted under .socket/: {env}"
             );
         }
     }
@@ -631,15 +630,16 @@ async fn redirect_scanned_project(
         "lock checksum must be the PATCHED .crate's sha256:\n{lock_text}"
     );
 
-    // Ledger embeds the patch record so a post-install `vex` can verify.
-    let ledger = std::fs::read_to_string(proj.join(".socket/vendor/redirect-state.json")).unwrap();
+    // v5 hosted mode keeps no ledger: the three-file rewrite is the whole
+    // hosted state (a post-install `vex` fetches the record from the API).
     assert!(
-        ledger.contains("\"records\"") && ledger.contains(GHSA),
-        "redirect ledger must embed the patch record + vulnerability: {ledger}"
+        !proj.join(".socket/vendor/redirect-state.json").exists(),
+        "hosted mode writes no redirect ledger"
     );
 
     if driver == Driver::GetUuid {
-        // Parity with scan --mode hosted: the ledger IS the persistence.
+        // Parity with scan --mode hosted: the lockfile rewrite IS the
+        // persistence.
         assert!(
             !proj.join(".socket/manifest.json").exists(),
             "get --mode hosted must NOT write the manifest"
@@ -675,7 +675,10 @@ fn fresh_checkout_cargo_fetch(fx: &RedirectFixture) -> (PathBuf, PathBuf, Output
     std::fs::copy(fx.proj.join("Cargo.lock"), fresh.join("Cargo.lock")).unwrap();
     copy_dir_recursive(&fx.proj.join(".cargo"), &fresh.join(".cargo"));
     copy_dir_recursive(&fx.proj.join("src"), &fresh.join("src"));
-    copy_dir_recursive(&fx.proj.join(".socket"), &fresh.join(".socket"));
+    // v5 hosted mode writes nothing under `.socket/`; carry it when present.
+    if fx.proj.join(".socket").is_dir() {
+        copy_dir_recursive(&fx.proj.join(".socket"), &fresh.join(".socket"));
+    }
 
     let fresh_home = fx.tmp.path().join("fresh-cargo-home");
     std::fs::create_dir_all(&fresh_home).unwrap();
@@ -750,30 +753,15 @@ impl ManifestlessHosted {
         let ledger_path = fresh.join(socket_patch_core::patch::redirect::REDIRECT_STATE_REL);
         let run = self.vex_run(&api, &self.fresh_home);
 
-        // (1) No manifest (hosted never writes one), ledger kept: the
-        //     ledger's record attests, verified against the extracted
-        //     hosted copy — no API call.
+        // (1) No manifest (hosted never writes one) and no ledger (v5
+        //     writes none): the lock's hosted `source` names the patch, the
+        //     record comes from the API, verified against the extracted
+        //     hosted copy.
         strip_manifest(fresh);
-        assert!(ledger_path.is_file(), "the redirect ledger travels");
-        let out = run_vex(&bin, fresh, &run);
-        assert_eq!(out.code, Some(0), "(1) ledger-backed:\n{out}");
-        assert_attested(out.doc(), &self.purl, UUID, Marker::Redirected, vulns);
-        assert_eq!(
-            api.view_requests(UUID),
-            0,
-            "(1) the ledger record needs no API"
-        );
-        let out = run_vex(&bin, fresh, &run.clone().via(VexVia::Apply));
-        assert_eq!(out.code, Some(0), "(1) apply --vex:\n{out}");
-        assert_eq!(
-            out.envelope["status"], "noManifest",
-            "(1) apply --vex:\n{out}"
+        assert!(
+            !ledger_path.exists(),
+            "hosted mode writes no redirect ledger"
         );
-        assert_attested(out.doc(), &self.purl, UUID, Marker::Redirected, vulns);
-
-        // (2) Ledgers deleted: the lock's hosted `source` names the patch;
-        //     the record comes from the API.
-        let ledger = std::fs::read(&ledger_path).unwrap();
         strip_ledgers(fresh);
         let out = run_vex(&bin, fresh, &run);
         assert_eq!(out.code, Some(0), "(2) lockfile-only:\n{out}");
@@ -831,10 +819,10 @@ impl ManifestlessHosted {
         assert_absent(out.doc.as_ref(), &self.purl);
         assert_eq!(api.request_count(), before, "(3) --offline made a request");
 
-        // (4a) The lock reverted to crates.io (ledger restored, the patched
-        //      hosted copy still extracted, the Cargo.toml pin + registry
-        //      definition left over): the stale ledger never attests.
-        std::fs::write(&ledger_path, &ledger).unwrap();
+        // (4a) The lock reverted to crates.io (the patched hosted copy still
+        //      extracted, the Cargo.toml pin + registry definition left
+        //      over): nothing in the lock wires the patch, so nothing
+        //      attests it.
         std::fs::write(fresh.join("Cargo.lock"), &self.baseline_lock).unwrap();
         for no_verify in [false, true] {
             let out = run_vex(
@@ -845,25 +833,19 @@ impl ManifestlessHosted {
                     ..run.clone()
                 },
             );
-            assert_eq!(out.code, Some(1), "(4a) no_verify={no_verify}:\n{out}");
-            assert_not_attested(&out.envelope, &self.purl, "redirect_unwired");
+            assert_ne!(out.code, Some(0), "(4a) no_verify={no_verify}:\n{out}");
             assert_absent(out.doc.as_ref(), &self.purl);
         }
 
         // (4b) The full three-file revert, installed for real from
-        //      crates.io, with the ledger kept.
+        //      crates.io.
         let revert = self.scratch.join("reverted");
         let revert_home = self.scratch.join("reverted-cargo-home");
-        std::fs::create_dir_all(revert.join(".socket/vendor")).unwrap();
+        std::fs::create_dir_all(&revert).unwrap();
         std::fs::create_dir_all(&revert_home).unwrap();
         std::fs::write(revert.join("Cargo.toml"), &self.baseline_toml).unwrap();
         std::fs::write(revert.join("Cargo.lock"), &self.baseline_lock).unwrap();
         copy_dir_recursive(&fresh.join("src"), &revert.join("src"));
-        std::fs::write(
-            revert.join(socket_patch_core::patch::redirect::REDIRECT_STATE_REL),
-            &ledger,
-        )
-        .unwrap();
         let fetch = cargo(&revert, &["fetch", "--locked"], &revert_home);
         assert!(
             fetch.status.success(),
@@ -889,8 +871,7 @@ impl ManifestlessHosted {
                     ..run.clone()
                 },
             );
-            assert_eq!(out.code, Some(1), "(4b) no_verify={no_verify}:\n{out}");
-            assert_not_attested(&out.envelope, &self.purl, "redirect_unwired");
+            assert_ne!(out.code, Some(0), "(4b) no_verify={no_verify}:\n{out}");
             assert_absent(out.doc.as_ref(), &self.purl);
         }
     }
@@ -954,7 +935,9 @@ async fn cargo_hosted_fresh_checkout_fetch_pulls_patched_crate_and_vex_verifies(
     );
 
     // 5. POST-INSTALL VERIFIED VEX: default verify mode hash-verifies the
-    //    extracted registry sources against the ledger's patch record.
+    //    extracted registry sources against the patch record — fetched
+    //    from the API (v5: no hosted ledger), the mock origin named the
+    //    patch server so the lock's hosted source is recognized.
     let doc_path = fresh.join("doc.json");
     let (code, stdout, stderr) = run_socket(
         &fresh,
@@ -964,6 +947,14 @@ async fn cargo_hosted_fresh_checkout_fetch_pulls_patched_crate_and_vex_verifies(
             doc_path.to_str().unwrap(),
             "--product",
             PRODUCT,
+            "--patch-server-url",
+            &fx.server_uri,
+            "--api-url",
+            &fx.server_uri,
+            "--org",
+            ORG,
+            "--api-token",
+            "fake",
             "--cwd",
             fresh.to_str().unwrap(),
         ],
@@ -1000,7 +991,7 @@ async fn cargo_hosted_fresh_checkout_fetch_pulls_patched_crate_and_vex_verifies(
 }
 
 /// get-driven twin (v4.0): `get <uuid> --mode hosted --json --yes` must land
-/// the SAME three-file rewrite + ledger as the scan capstone (asserted
+/// the SAME three-file rewrite (and no ledger) as the scan capstone (asserted
 /// inside the shared fixture — parity by construction through
 /// run_redirect_selected, redirected count via the transactional
 /// confirmed_cargo_uuids), with NO manifest and NO blobs. Then the
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_cargo_shapes.rs b/crates/socket-patch-cli/tests/e2e_redirect_cargo_shapes.rs
index b5abf52e..73da2c89 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_cargo_shapes.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_cargo_shapes.rs
@@ -7,7 +7,8 @@
 //!   own version's registry, and removing both purls restores every byte.
 //! * `legacy_config` — an existing legacy `.cargo/config`: the registry
 //!   block lands there, and `remove` restores the file byte-for-byte —
-//!   also when it lacks a final newline or ends in a blank line.
+//!   also when it ends in a blank line (one lacking a final newline gets
+//!   that newline back: v5 keeps no ledger fragment to tell them apart).
 //! * `crlf` — CRLF `Cargo.toml` + `Cargo.lock`: rewritten with CRLF kept,
 //!   and restored byte-for-byte.
 //! * `workspace_direct_member` — a virtual workspace whose root pins
@@ -27,10 +28,14 @@
 //! wiremock sparse registry per patch, `scan --mode hosted`, then a FRESH
 //! checkout (only the committed files travel) where `cargo fetch --locked`
 //! and an offline `cargo build --locked` must link each patched-only symbol
-//! and a post-install `vex` must attest exactly the patches, and finally
+//! and a post-install `vex` must attest exactly the patches (v5: no hosted
+//! ledger, so each record comes from the patch API), and finally
 //! `remove <purl>` for every patch — in apply order and, from the same
 //! post-scan state, in reverse — which must leave the project
-//! byte-identical to its pre-scan state.
+//! byte-identical to its pre-scan state. v5 `remove` restores each hosted
+//! pin's crates.io entry, re-resolving the checksum from the sparse index:
+//! a wiremock mirror of the pristine checksums (`SOCKET_CRATES_INDEX`), with
+//! the mock origin named the patch server.
 //!
 //! `SOCKET_PATCH_CARGO_E2E_LOCK_VERSION` / `_TOOLCHAIN` (see
 //! `cargo_e2e_matrix`) re-encode the baseline lock, so a v1 lock's full-id
@@ -107,6 +112,16 @@ fn binary() -> PathBuf {
 }
 
 fn run_socket(cwd: &Path, args: &[&str], cargo_home: &Path) -> (i32, String, String) {
+    run_socket_env(cwd, args, cargo_home, &[])
+}
+
+/// [`run_socket`] with extra env applied after the scrub.
+fn run_socket_env(
+    cwd: &Path,
+    args: &[&str],
+    cargo_home: &Path,
+    env: &[(&str, &str)],
+) -> (i32, String, String) {
     let mut cmd = Command::new(binary());
     cmd.args(args).current_dir(cwd);
     for (k, _) in std::env::vars_os() {
@@ -116,6 +131,9 @@ fn run_socket(cwd: &Path, args: &[&str], cargo_home: &Path) -> (i32, String, Str
     }
     cmd.env("SOCKET_NO_CONFIG", "1");
     cmd.env("CARGO_HOME", cargo_home);
+    for (k, v) in env {
+        cmd.env(k, v);
+    }
     let out = cmd.output().expect("failed to run socket-patch binary");
     (
         out.status.code().unwrap_or(-1),
@@ -153,6 +171,40 @@ fn sparse_index_rel(name: &str) -> String {
     }
 }
 
+/// A crates.io sparse-index mirror of the PRISTINE lock's checksums for
+/// every patched crate — what the v5 upstream restore reads to put a hosted
+/// `Cargo.lock` entry back on crates.io.
+async fn mount_crates_index_mirror(pristine_lock: &str, patches: &[Patch]) -> MockServer {
+    let server = MockServer::start().await;
+    let lock = pristine_lock.replace("\r\n", "\n");
+    let mut rows: BTreeMap<String, Vec<String>> = BTreeMap::new();
+    for pkg in cargo_e2e_matrix::parse_lock(&lock) {
+        if !patches.iter().any(|p| p.name == pkg.name) {
+            continue;
+        }
+        let cksum = pkg
+            .checksum
+            .unwrap_or_else(|| panic!("{} {} has no checksum", pkg.name, pkg.version));
+        rows.entry(pkg.name.clone()).or_default().push(
+            serde_json::json!({
+                "name": pkg.name, "vers": pkg.version, "deps": [], "cksum": cksum,
+                "features": {}, "yanked": false,
+            })
+            .to_string(),
+        );
+    }
+    for (name, lines) in rows {
+        Mock::given(wiremock::matchers::path(format!(
+            "/{}",
+            sparse_index_rel(&name)
+        )))
+        .respond_with(ResponseTemplate::new(200).set_body_string(lines.join("\n")))
+        .mount(&server)
+        .await;
+    }
+    server
+}
+
 fn build_crate(stage: &Path, crate_dir: &Path, leaf: &str, patched: &[u8]) -> Vec<u8> {
     let pkg = stage.join(leaf);
     copy_tree(crate_dir, &pkg);
@@ -579,6 +631,13 @@ async fn run_shape(shape: Shape) -> Option<()> {
             "pkg:cargo/consumer@0.1.0",
             "--patch-server-url",
             &uri,
+            // No hosted ledger (v5): the records come from the patch API.
+            "--api-url",
+            &uri,
+            "--org",
+            ORG,
+            "--api-token",
+            "fake",
             "--cwd",
             &fresh_s,
         ],
@@ -605,9 +664,25 @@ async fn run_shape(shape: Shape) -> Option<()> {
     expected.sort();
     assert_eq!(attested, expected, "{}: attested purls: {doc}", shape.tag);
 
+    assert!(
+        !proj.join(".socket/vendor/redirect-state.json").exists(),
+        "{}: hosted mode writes no redirect ledger",
+        shape.tag
+    );
+
     // Rollback: removing every purl restores the pre-scan project exactly —
     // in apply order AND in reverse (a v1 lock's shared dependent blocks
     // once made the first-applied purl unremovable before its sibling).
+    // v5: each removal restores the pin's crates.io entry from the index
+    // mirror; the mock origin is named the patch server so the pins are
+    // found without a ledger.
+    let pristine_lock = String::from_utf8(before["Cargo.lock"].clone()).unwrap();
+    let index = mount_crates_index_mirror(&pristine_lock, &shape.patches).await;
+    let index_uri = index.uri();
+    let unwind_env = [
+        ("SOCKET_CRATES_INDEX", index_uri.as_str()),
+        ("SOCKET_PATCH_SERVER_URL", uri.as_str()),
+    ];
     let post_scan = tmp.path().join("post-scan");
     copy_tree(&proj, &post_scan);
     let mut orders = vec![shape.patches.clone()];
@@ -621,7 +696,7 @@ async fn run_shape(shape: Shape) -> Option<()> {
         }
         for patch in order {
             let purl = patch.purl();
-            let (code, stdout, err) = run_socket(
+            let (code, stdout, err) = run_socket_env(
                 &proj,
                 &[
                     "remove",
@@ -633,6 +708,7 @@ async fn run_shape(shape: Shape) -> Option<()> {
                     "--no-telemetry",
                 ],
                 &home,
+                &unwind_env,
             );
             assert_eq!(
                 code, 0,
@@ -642,11 +718,23 @@ async fn run_shape(shape: Shape) -> Option<()> {
         }
         let after = snapshot(&proj);
         for (rel, bytes) in &before {
+            // v5 keeps no ledger fragment, and the rewriter separates its
+            // appended registry block with the same bytes whether or not the
+            // original file ended in a newline — so an UNTERMINATED file can
+            // only come back with its final newline (every other byte exact).
+            let want = match after.get(rel) {
+                Some(got)
+                    if !bytes.ends_with(b"\n") && *got == [bytes.as_slice(), b"\n"].concat() =>
+                {
+                    got.clone()
+                }
+                _ => bytes.clone(),
+            };
             assert_eq!(
                 after
                     .get(rel)
                     .map(|b| String::from_utf8_lossy(b).into_owned()),
-                Some(String::from_utf8_lossy(bytes).into_owned()),
+                Some(String::from_utf8_lossy(&want).into_owned()),
                 "{} (removal order {n}): {rel} not restored byte-for-byte by remove",
                 shape.tag
             );
@@ -753,9 +841,11 @@ async fn cargo_hosted_legacy_config_is_restored_byte_for_byte() {
     let _ = run_shape(shape).await;
 }
 
-/// Bug H, exactly: a config without a final newline, and one ending in a
-/// blank line, both come back byte-for-byte (the appended block's removal
-/// once normalized the trailing newline run).
+/// Bug H: a config ending in a blank line comes back byte-for-byte (the
+/// appended block's removal once normalized the trailing newline run). A
+/// config without a final newline comes back with every byte but that
+/// missing newline: v5 keeps no ledger fragment to tell it apart from a
+/// terminated file, since the rewriter's separator is the same for both.
 #[tokio::test(flavor = "multi_thread")]
 async fn cargo_hosted_config_trailing_bytes_are_restored() {
     for (tag, rel, config) in [
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_composer_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_composer_build.rs
index 563315fc..c96762a2 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_composer_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_composer_build.rs
@@ -17,8 +17,9 @@
 //!      the discovery / reference / view API mocks.
 //!   3. `scan --redirect --json --vex …` (or its `get <uuid> --mode hosted`
 //!      twin): composer.lock's psr/log `dist` now points at the wiremock
-//!      archive with its sha1, the redirect ledger embeds the record, no
-//!      manifest is written, and the in-run VEX is `(redirected)`.
+//!      archive with its sha1, NO redirect ledger and no manifest is written
+//!      (v5: the lock is the hosted state), and the in-run VEX is
+//!      `(redirected)`.
 //!   4. FRESH-CHECKOUT PROOF: only composer.json + composer.lock + `.socket/`
 //!      travel; a cold-home/cache `composer install` downloads the archive
 //!      from the hosted patch server — the installed file is byte-identical
@@ -29,17 +30,22 @@
 //!      silently install the pristine upstream commit instead.)
 //!   5. MANIFEST-LESS VEX on the fresh checkout (the hosted flow never wrote
 //!      a manifest; asserted), against a mock patch API:
-//!      * ledger kept → standalone `vex` attests `(redirected)` with the
-//!        installed tree hash-verified, as does embedded `apply --vex`; a
-//!        tampered installed file is `hash_mismatch`;
-//!      * ledger deleted → attests from the composer.lock dist (the hosted
-//!        origin named by `--patch-server-url`) + the API record; without
-//!        that flag a loopback origin is not Socket's and nothing is
-//!        discovered;
-//!      * `--offline`, no ledger → `record_unavailable`, zero requests;
-//!      * composer.lock reverted to the registry dist with the ledger left
-//!        behind + a REAL re-install (pristine bytes) → `redirect_unwired`,
+//!      * standalone `vex` attests `(redirected)` from the composer.lock
+//!        dist (the hosted origin named by `--patch-server-url`) + the API
+//!        record, with the installed tree hash-verified, as does embedded
+//!        `apply --vex`; a tampered installed file is `hash_mismatch`;
+//!        without `--patch-server-url` a loopback origin is not Socket's and
+//!        nothing is discovered;
+//!      * `--offline` → `record_unavailable` (hosted mode keeps no local
+//!        record), zero requests;
+//!      * composer.lock reverted to the registry dist + a REAL re-install
+//!        (pristine bytes) → nothing names the patch any more,
 //!        `--no-verify` and `--offline` included.
+//!   6. ROLLBACK of the original project restores the upstream dist +
+//!      source from the REAL packagist metadata: byte-identical to the
+//!      registry lock on composer 2 (packagist-resolved); composer 1's
+//!      inline package repository is not packagist, so the pin is refused
+//!      with the `git checkout -- composer.lock` remedy and nothing moves.
 //!
 //! Skips (println) when composer is missing or the fixture install cannot
 //! reach its registry — unless `SOCKET_PATCH_COMPOSER_E2E_REQUIRED` is set,
@@ -65,7 +71,7 @@ mod vex_e2e_common;
 use composer_e2e_common::{composer, composer_major, fresh_checkout, setup_psr_log_project};
 use vex_e2e_common::{
     assert_absent, assert_attested, assert_not_attested, binary, git_sha256, patch_view, run_vex,
-    strip_ledgers, strip_manifest, Marker, PatchApi, VexOutcome, VexRun, VexVia,
+    strip_manifest, Marker, PatchApi, VexOutcome, VexRun, VexVia,
 };
 
 const SUITE: &str = "e2e_redirect_composer_build";
@@ -91,6 +97,8 @@ enum RedirectCli {
 
 struct Fixture {
     tmp: tempfile::TempDir,
+    /// Composer major on PATH (1 resolves from an inline repository).
+    major: u32,
     proj: PathBuf,
     purl: String,
     orig: Vec<u8>,
@@ -379,11 +387,9 @@ async fn redirected_project(
         entry.get("source").is_none(),
         "the redirected entry must not keep a source fallback: {entry}"
     );
-    let ledger =
-        std::fs::read_to_string(proj.join(".socket/vendor/redirect-state.json")).expect("ledger");
     assert!(
-        ledger.contains(&purl) && ledger.contains(GHSA),
-        "the ledger embeds the record: {ledger}"
+        !proj.join(".socket/vendor/redirect-state.json").exists(),
+        "v5 hosted mode must not write the redirect ledger"
     );
     assert!(
         !proj.join(".socket/manifest.json").exists(),
@@ -398,6 +404,7 @@ async fn redirected_project(
 
     Some(Fixture {
         tmp,
+        major,
         proj,
         purl,
         orig,
@@ -441,35 +448,48 @@ fn assert_manifestless_hosted_vex(fx: &Fixture, fresh: &Path, tag: &str) {
     let vex_in = |dir: &Path, run: VexRun| -> VexOutcome { run_vex(&binary(), dir, &run) };
     let installed = fresh.join("vendor/psr/log").join(FILE_KEY);
 
-    // (1) the hosted flow never wrote a manifest; ledger kept.
+    // (1) the hosted flow never wrote a manifest nor a ledger: the lock's
+    // hosted dist + the API record.
     assert!(
         !fresh.join(".socket/manifest.json").exists(),
         "[{tag}] hosted checkout has no manifest"
     );
+    assert!(
+        !fresh.join(".socket/vendor/redirect-state.json").exists(),
+        "[{tag}] hosted checkout has no redirect ledger"
+    );
     strip_manifest(fresh);
+    let fetched = api.view_requests(UUID);
     let out = vex_in(fresh, hosted(VexRun::online(&api)));
-    assert_eq!(out.code, Some(0), "[{tag}] ledger kept:\n{out}");
+    assert_eq!(out.code, Some(0), "[{tag}] lock + API:\n{out}");
     assert_attested(out.doc(), purl, UUID, Marker::Redirected, vulns);
+    assert!(
+        api.view_requests(UUID) > fetched,
+        "[{tag}] the record came from the API: {:?}",
+        api.requests()
+    );
     let out = vex_in(fresh, hosted(VexRun::online(&api)).via(VexVia::Apply));
     assert_eq!(out.code, Some(0), "[{tag}] apply --vex:\n{out}");
     assert_eq!(out.envelope["status"], "noManifest", "[{tag}]:\n{out}");
     assert_eq!(out.envelope["vex"]["statements"], 1, "[{tag}]:\n{out}");
     assert_attested(out.doc(), purl, UUID, Marker::Redirected, vulns);
     // The installed tree is hash-verified, not just the lock: a tampered
-    // installed file un-attests even with the ledger and wiring intact.
+    // installed file un-attests even with the wiring intact.
     std::fs::write(&installed, b"<?php // tampered after install\n").unwrap();
     let out = vex_in(fresh, hosted(VexRun::online(&api)));
     assert_eq!(out.code, Some(1), "[{tag}] tampered install:\n{out}");
     assert_not_attested(&out.envelope, purl, "hash_mismatch");
     std::fs::write(&installed, &fx.patched).unwrap();
 
-    // (4) (prepared before the ledger goes) composer.lock reverted to the
-    // registry dist, ledger left behind, REAL re-install → pristine bytes.
+    // (4) composer.lock reverted to the registry dist, REAL re-install →
+    // pristine bytes.
     let reverted = fx.tmp.path().join(format!("reverted-{tag}"));
     std::fs::create_dir_all(&reverted).unwrap();
     std::fs::copy(fresh.join("composer.json"), reverted.join("composer.json")).unwrap();
     std::fs::write(reverted.join("composer.lock"), &fx.registry_lock).unwrap();
-    composer_e2e_common::copy_dir_recursive(&fresh.join(".socket"), &reverted.join(".socket"));
+    if fresh.join(".socket").is_dir() {
+        composer_e2e_common::copy_dir_recursive(&fresh.join(".socket"), &reverted.join(".socket"));
+    }
     let install = composer(
         &reverted,
         &["install"],
@@ -487,9 +507,6 @@ fn assert_manifestless_hosted_vex(fx: &Fixture, fresh: &Path, tag: &str) {
         fx.orig,
         "[{tag}] the reverted install holds the pristine registry bytes"
     );
-    assert!(reverted
-        .join(".socket/vendor/redirect-state.json")
-        .is_file());
     for (label, run) in [
         ("online", VexRun::online(&api)),
         (
@@ -515,26 +532,13 @@ fn assert_manifestless_hosted_vex(fx: &Fixture, fresh: &Path, tag: &str) {
             },
         ),
     ] {
+        // No lock names the patch and hosted mode keeps no ledger: nothing
+        // to attest at all.
         let out = vex_in(&reverted, hosted(run));
-        assert_eq!(out.code, Some(1), "[{tag}] reverted {label}:\n{out}");
-        assert_not_attested(&out.envelope, purl, "redirect_unwired");
+        assert_eq!(out.code, Some(2), "[{tag}] reverted {label}:\n{out}");
+        assert_eq!(out.envelope["error"]["code"], "manifest_not_found", "{out}");
         assert_absent(out.doc.as_ref(), purl);
     }
-
-    // (2) ledger deleted: the lock's hosted dist + the API record.
-    strip_ledgers(fresh);
-    let fetched = api.view_requests(UUID);
-    let out = vex_in(fresh, hosted(VexRun::online(&api)));
-    assert_eq!(out.code, Some(0), "[{tag}] ledger deleted:\n{out}");
-    assert_attested(out.doc(), purl, UUID, Marker::Redirected, vulns);
-    assert!(
-        api.view_requests(UUID) > fetched,
-        "[{tag}] the record came from the API: {:?}",
-        api.requests()
-    );
-    let out = vex_in(fresh, hosted(VexRun::online(&api)).via(VexVia::Apply));
-    assert_eq!(out.code, Some(0), "[{tag}] ledger-less apply --vex:\n{out}");
-    assert_attested(out.doc(), purl, UUID, Marker::Redirected, vulns);
     // Without `--patch-server-url` the loopback origin is not Socket's: no
     // reference, no fetch (`manifest_not_found`, exit 2).
     let seen = api.request_count();
@@ -549,7 +553,7 @@ fn assert_manifestless_hosted_vex(fx: &Fixture, fresh: &Path, tag: &str) {
     assert_eq!(out.envelope["error"]["code"], "manifest_not_found", "{out}");
     assert_eq!(api.request_count(), seen, "[{tag}] nothing fetched");
 
-    // (3) --offline, no ledger: record_unavailable, zero requests.
+    // (3) --offline: no local record → record_unavailable, zero requests.
     for no_verify in [false, true] {
         let out = vex_in(
             fresh,
@@ -598,6 +602,58 @@ async fn full_chain(tag: &str, cli: RedirectCli) {
         "installed.json names {DEP}"
     );
     tokio::task::block_in_place(|| assert_manifestless_hosted_vex(&fx, &fresh, tag));
+    tokio::task::block_in_place(|| assert_rollback_restores_upstream(&fx, tag));
+}
+
+/// Step 6: `rollback` of the original (still hosted) project. The pin is
+/// discovered from composer.lock on the `--patch-server-url` origin and
+/// restored from the REAL packagist metadata (reachable wherever the
+/// fixture install was).
+fn assert_rollback_restores_upstream(fx: &Fixture, tag: &str) {
+    let origin = fx.server.uri();
+    let before = std::fs::read(fx.proj.join("composer.lock")).unwrap();
+    let (code, stdout, stderr) = run_socket(
+        &fx.proj,
+        &[
+            "rollback",
+            "--json",
+            "--cwd",
+            fx.proj.to_str().unwrap(),
+            "--patch-server-url",
+            &origin,
+        ],
+    );
+    let env: serde_json::Value = serde_json::from_str(&stdout).unwrap_or_else(|e| {
+        panic!("[{tag}] rollback --json is not JSON ({e}):\n{stdout}\n{stderr}")
+    });
+    let after = std::fs::read(fx.proj.join("composer.lock")).unwrap();
+    if fx.major >= 2 {
+        assert_eq!(code, 0, "[{tag}] rollback: {env}\n{stderr}");
+        assert_eq!(
+            env["hosted"]["reverted"],
+            serde_json::json!([fx.purl]),
+            "[{tag}] {env}"
+        );
+        assert_eq!(
+            String::from_utf8_lossy(&after),
+            String::from_utf8_lossy(&fx.registry_lock),
+            "[{tag}] rollback restores composer.lock byte-for-byte from packagist"
+        );
+    } else {
+        // Composer 1 resolved from an inline `package` repository: not
+        // packagist, so the restore refuses rather than guess.
+        assert_eq!(code, 1, "[{tag}] rollback: {env}\n{stderr}");
+        assert_eq!(env["hosted"]["failed"][0]["purl"], fx.purl, "[{tag}] {env}");
+        let why = env["hosted"]["failed"][0]["error"]
+            .as_str()
+            .unwrap_or_default();
+        assert!(
+            why.contains("git checkout -- composer.lock"),
+            "[{tag}] the refusal names the remedy: {env}"
+        );
+        assert_eq!(after, before, "[{tag}] a refused pin changes nothing");
+    }
+    assert!(!fx.proj.join(".socket/vendor/redirect-state.json").exists());
 }
 
 // multi_thread: the CLI/composer subprocesses block a worker thread while
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_gem_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_gem_build.rs
index 95283d24..5ba18f3e 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_gem_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_gem_build.rs
@@ -28,17 +28,18 @@
 //!      project-local `vendor/bundle` (no rubygems.org, no network beyond
 //!      loopback).
 //!   2. `scan --mode hosted --json --vex …` (the real binary): the Gemfile
-//!      gains the `source "<index-url>" do … end` block, the ledger embeds
-//!      the patch record, the in-run VEX is the unverified `(redirected)`
-//!      attestation.
+//!      gains the `source "<index-url>" do … end` block, NO redirect ledger
+//!      is written (v5: the manifest pair is the hosted state), the in-run
+//!      VEX is the unverified `(redirected)` attestation.
 //!   3. FRESH-CHECKOUT PROOF: only the committable files travel; an UNFROZEN
 //!      `bundle install` (the flow the rewriter's `redirect_gem_frozen_install`
 //!      warning prescribes) resolves the patched gem from the mock patch
 //!      registry: installed bytes byte-match the patch blob, the runtime dep
 //!      installs BECAUSE the registry `/info` declares it, and a require
 //!      probe loads the patched code.
-//!   4. POST-INSTALL VERIFIED VEX: `socket-patch vex` hash-verifies the
-//!      installed tree against the ledger record.
+//!   4. POST-INSTALL VERIFIED VEX: `socket-patch vex` discovers the pin from
+//!      the lock (`--patch-server-url` names the mock origin), fetches the
+//!      record from the patch API and hash-verifies the installed tree.
 //!
 //! The `gems.rb` twin drives the same chain through bundler's modern
 //! `gems.rb`/`gems.locked` spelling (which bundler prefers over `Gemfile`
@@ -47,7 +48,7 @@
 //! The `get <uuid> --mode hosted` twin (v4.0) drives the SAME fixture
 //! through get's per-advisory selector instead of scan — same hosted engine
 //! by construction (CLI_CONTRACT.md "get --mode and installed narrowing"):
-//! identical Gemfile/lock rewrite + ledger, get's envelope (nested
+//! identical Gemfile/lock rewrite (no ledger), get's envelope (nested
 //! `redirect`, no `downloaded`/`applied`), NO manifest, NO blobs, no --vex.
 //!
 //! The deps red-arm serves an `/info` shaped like production's HISTORICAL
@@ -72,11 +73,10 @@
 //!
 //! MANIFEST-LESS VEX (every installing arm, `manifestless_vex_matrix`): on
 //! the fresh checkout the real bundler installed — hosted never writes a
-//! `.socket/manifest.json` — `vex` attests `(redirected)` from the lock +
-//! ledger; with both ledgers deleted it still attests from the lockfile
-//! wiring + the patch API (and so does the embedded `apply --vex`);
-//! `--offline` without ledgers is `record_unavailable` with zero requests;
-//! the pair reverted to its registry version is `redirect_unwired` even
+//! `.socket/manifest.json` nor a ledger — `vex` attests `(redirected)` from
+//! the lockfile wiring + the patch API (and so does the embedded
+//! `apply --vex`); `--offline` is `record_unavailable` with zero requests;
+//! the pair reverted to its registry version names the patch nowhere, even
 //! under `--no-verify`. The main arm also proves the lock-only revert
 //! (Gemfile block kept) re-converges on the next unfrozen install.
 //!
@@ -233,7 +233,12 @@ fn md5_hex(bytes: &[u8]) -> String {
     hexstr
 }
 
+/// Copy `src` into `dst`; a missing `src` copies nothing (v5 hosted mode may
+/// leave no `.socket/` at all).
 fn copy_dir_recursive(src: &Path, dst: &Path) {
+    if !src.exists() {
+        return;
+    }
     std::fs::create_dir_all(dst).unwrap();
     for entry in std::fs::read_dir(src).unwrap() {
         let entry = entry.unwrap();
@@ -857,14 +862,14 @@ async fn redirect_scanned_project(
             assert_eq!(env["vex"]["statements"], 1, "vex block: {env}");
             assert_eq!(
                 env["vex"]["verified"], false,
-                "in-run hosted VEX is attested from the ledger, not hash-verified: {env}"
+                "in-run hosted VEX is attested from this run's fetched record, not hash-verified: {env}"
             );
         }
         Driver::GetUuid => {
             // get's hosted envelope (CLI_CONTRACT.md "get --mode and
             // installed narrowing"): `found` counts the resolved patch;
             // `downloaded`/`applied` are ABSENT — nothing lands in
-            // `.socket/`, the redirect ledger IS the persistence — and no
+            // `.socket/`, the lockfile IS the persistence — and no
             // `vex` key (get has no --vex).
             assert_eq!(env["found"], 1, "envelope: {env}");
             assert!(
@@ -896,12 +901,8 @@ async fn redirect_scanned_project(
         );
     }
 
-    // Ledger embeds the patch record so a post-install `vex` can verify.
-    let ledger = std::fs::read_to_string(proj.join(".socket/vendor/redirect-state.json")).unwrap();
-    assert!(
-        ledger.contains("\"records\"") && ledger.contains(GHSA),
-        "redirect ledger must embed the patch record + vulnerability: {ledger}"
-    );
+    // v5: hosted mode writes no ledger — the manifest pair is the state.
+    assert_no_redirect_ledger(&proj);
 
     Some(RedirectFixture {
         tmp,
@@ -917,6 +918,14 @@ async fn redirect_scanned_project(
     })
 }
 
+/// v5 hosted mode never writes `.socket/vendor/redirect-state.json`.
+fn assert_no_redirect_ledger(proj: &Path) {
+    assert!(
+        !proj.join(".socket/vendor/redirect-state.json").exists(),
+        "v5 hosted mode must not write the redirect ledger"
+    );
+}
+
 /// New dir named `name` holding ONLY what a git checkout would carry — the
 /// manifest pair, `.socket/`, `.bundle/` — with a cold per-dir bundler home.
 fn stage_fresh_checkout(fx: &RedirectFixture, name: &str) -> PathBuf {
@@ -1057,22 +1066,22 @@ async fn view_requests(fx: &RedirectFixture) -> usize {
 }
 
 /// Manifest-less VEX over a fresh checkout the REAL bundler just installed
-/// the patched gem into (`fresh`, whose ledger came along with the commit):
+/// the patched gem into (`fresh`):
 ///
-///   1. no `.socket/manifest.json` (hosted never writes one): `vex` attests
-///      `(redirected)` from the lockfile wiring + the ledger record, hash-
-///      verified against the installed tree;
-///   2. both ledgers deleted too: still attested — discovery reads the
-///      converged lock's patch-registry `GEM` remote and the record comes
-///      from the patch API; the embedded `apply --vex` agrees;
-///   3. `--offline` with no ledgers: `record_unavailable`, ZERO requests;
-///   4. the manifest pair reverted to its registry version (ledgers and the
-///      installed patched tree kept): `redirect_unwired`, with and without
-///      `--no-verify`, online and offline.
+///   1. no `.socket/manifest.json` and no ledger (hosted writes neither):
+///      `vex` attests `(redirected)` — discovery reads the converged lock's
+///      patch-registry `GEM` remote and the record comes from the patch
+///      API, hash-verified against the installed tree; the embedded
+///      `apply --vex` agrees;
+///   2. `--offline`: no local record → `record_unavailable`, ZERO requests;
+///   3. the manifest pair reverted to its registry version (the installed
+///      patched tree kept): nothing names the patch any more
+///      (`manifest_not_found`), with and without `--no-verify`, online and
+///      offline.
 async fn manifestless_vex_matrix(fx: &RedirectFixture, fresh: &Path) {
     use vex_e2e_common::{
-        assert_absent, assert_attested, assert_not_attested, run_vex, strip_ledgers,
-        strip_manifest, Marker, VexVia,
+        assert_absent, assert_attested, assert_not_attested, run_vex, strip_manifest, Marker,
+        VexVia,
     };
     let bin = binary();
     let lock = std::fs::read_to_string(fresh.join(fx.lock_name)).unwrap();
@@ -1082,15 +1091,11 @@ async fn manifestless_vex_matrix(fx: &RedirectFixture, fresh: &Path) {
         fx.lock_name,
         fx.bundler.version
     );
-    let ledgers = fresh.join(".socket/vendor");
-    let saved = fx.tmp.path().join(format!(
-        "ledgers-{}",
-        fresh.file_name().unwrap().to_string_lossy()
-    ));
-    copy_dir_recursive(&ledgers, &saved);
+    assert_no_redirect_ledger(fresh);
 
-    // 1. manifest-less (the ledger rides along).
+    // 1. manifest-less, ledger-less: lockfile discovery + the patch API.
     strip_manifest(fresh);
+    let views = view_requests(fx).await;
     let out = run_vex(&bin, fresh, &vex_run(fx));
     assert_eq!(
         out.code,
@@ -1100,24 +1105,12 @@ async fn manifestless_vex_matrix(fx: &RedirectFixture, fresh: &Path) {
     );
     assert_attested(out.doc(), PURL, UUID, Marker::Redirected, VULNS);
     assert_eq!(out.envelope["summary"]["verified"], 1, "{out}");
-
-    // 2. no ledgers: lockfile discovery + the patch API.
-    strip_ledgers(fresh);
-    let views = view_requests(fx).await;
-    let out = run_vex(&bin, fresh, &vex_run(fx));
-    assert_eq!(
-        out.code,
-        Some(0),
-        "ledger-less vex: {out}\n--- {}\n{lock}",
-        fx.lock_name
-    );
-    assert_attested(out.doc(), PURL, UUID, Marker::Redirected, VULNS);
     assert!(
         view_requests(fx).await > views,
         "the record must come from the patch API"
     );
     let out = run_vex(&bin, fresh, &vex_run(fx).via(VexVia::Apply));
-    assert_eq!(out.code, Some(0), "ledger-less apply --vex: {out}");
+    assert_eq!(out.code, Some(0), "manifest-less apply --vex: {out}");
     assert_eq!(out.envelope["status"], "noManifest", "{out}");
     assert_eq!(out.envelope["vex"]["statements"], 1, "{out}");
     assert_attested(out.doc(), PURL, UUID, Marker::Redirected, VULNS);
@@ -1126,18 +1119,17 @@ async fn manifestless_vex_matrix(fx: &RedirectFixture, fresh: &Path) {
         "vex / apply --vex must never write the manifest"
     );
 
-    // 3. offline, no ledgers: nothing to build a statement from, no network.
+    // 2. offline: no local record to build a statement from, no network.
     let before = request_count(fx).await;
     let mut offline = vex_run(fx);
     offline.offline = true;
     let out = run_vex(&bin, fresh, &offline);
-    assert_eq!(out.code, Some(1), "offline ledger-less vex: {out}");
+    assert_eq!(out.code, Some(1), "offline vex: {out}");
     assert_not_attested(&out.envelope, PURL, "record_unavailable");
     assert_eq!(request_count(fx).await, before, "--offline made requests");
 
-    // 4. reverted to the registry pair; ledgers (and the patched install)
-    //    kept.
-    copy_dir_recursive(&saved, &ledgers);
+    // 3. reverted to the registry pair (the patched install kept): no lock
+    //    names the patch, and hosted mode keeps no ledger to remember it.
     std::fs::write(fresh.join(fx.gemfile_name), &fx.pristine_gemfile).unwrap();
     std::fs::write(fresh.join(fx.lock_name), &fx.pristine_lock).unwrap();
     for (offline, no_verify) in [(false, false), (false, true), (true, false), (true, true)] {
@@ -1146,8 +1138,11 @@ async fn manifestless_vex_matrix(fx: &RedirectFixture, fresh: &Path) {
         run.no_verify = no_verify;
         let out = run_vex(&bin, fresh, &run);
         let cell = format!("reverted offline={offline} no_verify={no_verify}");
-        assert_eq!(out.code, Some(1), "{cell}: {out}");
-        assert_not_attested(&out.envelope, PURL, "redirect_unwired");
+        assert_eq!(out.code, Some(2), "{cell}: {out}");
+        assert_eq!(
+            out.envelope["error"]["code"], "manifest_not_found",
+            "{cell}: {out}"
+        );
         assert_absent(out.doc.as_ref(), PURL);
     }
 }
@@ -1155,13 +1150,12 @@ async fn manifestless_vex_matrix(fx: &RedirectFixture, fresh: &Path) {
 /// The mixed pair the bundler < 2.6 rewriter leaves (and a lock-only
 /// `git checkout`): the Gemfile still carries the patch-registry source
 /// block, the lock resolves the gem from upstream. Bundler re-resolves from
-/// the Gemfile — proven here with the REAL bundler — so the ledger keeps the
-/// patch live (`Discovery::redirect_record_live` step 0 in socket-patch-core
-/// vex/discover), while a
-/// ledger-less checkout has nothing discovery reads until that install
-/// re-converges the lock, after which it attests from the lock alone.
+/// the Gemfile — proven here with the REAL bundler. v5 keeps no ledger, so
+/// the mixed checkout has nothing discovery reads (lockfile pins only) until
+/// that install re-converges the lock, after which it attests from the lock
+/// alone.
 async fn lock_only_revert_reconverges(fx: &RedirectFixture) {
-    use vex_e2e_common::{assert_attested, run_vex, strip_ledgers, Marker};
+    use vex_e2e_common::{assert_attested, run_vex, Marker};
     let bin = binary();
     let dir = stage_fresh_checkout(fx, "fresh-lock-only-revert");
     let install = bundle(&dir, &["install"]);
@@ -1171,20 +1165,12 @@ async fn lock_only_revert_reconverges(fx: &RedirectFixture) {
         String::from_utf8_lossy(&install.stderr)
     );
     std::fs::write(dir.join(fx.lock_name), &fx.pristine_lock).unwrap();
-    let out = run_vex(&bin, &dir, &vex_run(fx));
-    assert_eq!(
-        out.code,
-        Some(0),
-        "Gemfile-wired, lock reverted, ledger kept: {out}"
-    );
-    assert_attested(out.doc(), PURL, UUID, Marker::Redirected, VULNS);
-
-    strip_ledgers(&dir);
+    assert_no_redirect_ledger(&dir);
     let out = run_vex(&bin, &dir, &vex_run(fx));
     assert_eq!(
         out.code,
         Some(2),
-        "no ledger and no lockfile reference: nothing to attest: {out}"
+        "Gemfile-wired, lock reverted: no lockfile reference, nothing to attest: {out}"
     );
     assert_eq!(out.envelope["error"]["code"], "manifest_not_found", "{out}");
 
@@ -1202,7 +1188,7 @@ async fn lock_only_revert_reconverges(fx: &RedirectFixture) {
     );
     assert_patched_install(fx, &dir);
     let out = run_vex(&bin, &dir, &vex_run(fx));
-    assert_eq!(out.code, Some(0), "re-converged, ledger-less: {out}");
+    assert_eq!(out.code, Some(0), "re-converged: {out}");
     assert_attested(out.doc(), PURL, UUID, Marker::Redirected, VULNS);
 }
 
@@ -1251,8 +1237,10 @@ async fn gem_hosted_fresh_checkout_bundle_install_installs_patched_bytes_and_vex
     );
 
     // POST-INSTALL VERIFIED VEX: default verify mode hash-verifies the
-    // installed tree against the ledger's patch record.
+    // installed tree against the patch API's record (v5: no ledger — the pin
+    // comes from the lock on the `--patch-server-url` origin).
     let doc_path = fresh.join("doc.json");
+    let server = fx._server.uri();
     let (code, stdout, stderr) = run_socket(
         &fresh,
         &[
@@ -1263,6 +1251,14 @@ async fn gem_hosted_fresh_checkout_bundle_install_installs_patched_bytes_and_vex
             PRODUCT,
             "--cwd",
             fresh.to_str().unwrap(),
+            "--patch-server-url",
+            &server,
+            "--api-url",
+            &server,
+            "--org",
+            ORG,
+            "--api-token",
+            "fake",
         ],
     );
     assert_eq!(
@@ -1292,7 +1288,7 @@ async fn gem_hosted_fresh_checkout_bundle_install_installs_patched_bytes_and_vex
 
 /// GET-DRIVEN TWIN of the main capstone: `get <uuid> --mode hosted` (v4.0,
 /// the per-advisory selector) must leave the same committable redirect
-/// state as `scan --mode hosted` — same Gemfile source block, same ledger,
+/// state as `scan --mode hosted` — same Gemfile source block, NO ledger,
 /// NO manifest, NO blobs — proven the same way against the REAL bundler: a
 /// fresh checkout of only the committable files resolves the PATCHED gem
 /// (bytes + runtime dep + require probe) from the mock patch registry.
@@ -1313,9 +1309,9 @@ async fn gem_get_uuid_hosted_fresh_checkout_bundle_install() {
         return;
     };
 
-    // Persistence parity with `scan --mode hosted`: the redirect ledger is
-    // the ONLY .socket/ artifact — no manifest, no blobs (the fixture
-    // already asserted the ledger + the Gemfile source block).
+    // Persistence parity with `scan --mode hosted`: nothing lands in
+    // .socket/ — no ledger, no manifest, no blobs (the fixture already
+    // asserted the missing ledger + the Gemfile source block).
     assert!(
         !fx.proj.join(".socket/manifest.json").exists(),
         "get --mode hosted must NOT write the manifest (parity with scan --mode hosted)"
@@ -1458,8 +1454,8 @@ async fn gem_hosted_registry_info_without_deps_breaks_install_like_production()
 
 /// FLIPPED CANARY — CHECKSUMS locks (bundler >= 4 default) must come out
 /// FULLY CONVERGED: patch-registry GEM section holding the dep's spec,
-/// `<name> (= <ver>)!` DEPENDENCIES pin, patched CHECKSUMS sha (upstream sha
-/// recorded in the ledger for revert). The old mixed-state rewrite (pin only,
+/// `<name> (= <ver>)!` DEPENDENCIES pin, patched CHECKSUMS sha (v5 keeps no
+/// ledger: a rollback re-resolves the upstream sha from the registry). The old mixed-state rewrite (pin only,
 /// GEM section left upstream) made the prescribed unfrozen install fail with
 /// "Bundler found mismatched checksums" (exit 37 — the bundler-4 DEFAULT
 /// lock, i.e. the mainstream hosted-gem path) and forced a frozen-install
@@ -1484,31 +1480,24 @@ async fn gem_hosted_checksums_lock_converges_and_installs_frozen_and_unfrozen()
         return;
     };
 
-    // The rewrite half: the ledger's CHECKSUMS edit must carry the UPSTREAM
-    // sha as `original` (the only revert path back to the registry line).
-    let ledger: serde_json::Value = serde_json::from_str(
-        &std::fs::read_to_string(fx.proj.join(".socket/vendor/redirect-state.json")).unwrap(),
-    )
-    .unwrap();
-    let edits = ledger["edits"].as_array().expect("ledger edits");
-    let edit = edits
-        .iter()
-        .find(|e| e["kind"] == "redirect_gemfile_lock_checksum")
-        .expect("CHECKSUMS pin edit recorded in the ledger");
-    assert_eq!(edit["path"], "Gemfile.lock", "edit path: {edit}");
-    let original = edit["original"].as_str().expect("original recorded");
-    assert!(
-        original.starts_with(&format!("{DEP} ({DEP_VERSION}) sha256=")),
-        "original must be the pre-edit registry line: {original}"
-    );
+    // The rewrite half: the registry lock's upstream CHECKSUMS line must
+    // actually have been replaced (else the pin is vacuous). No ledger
+    // records it (v5).
+    let pristine_lock = String::from_utf8_lossy(&fx.pristine_lock).into_owned();
+    let original = pristine_lock
+        .lines()
+        .map(str::trim)
+        .find(|l| l.starts_with(&format!("{DEP} ({DEP_VERSION}) sha256=")))
+        .unwrap_or_else(|| panic!("the registry lock pins an upstream sha:\n{pristine_lock}"))
+        .to_string();
     let lock = std::fs::read_to_string(fx.proj.join("Gemfile.lock")).unwrap();
     assert!(
-        !lock.contains(original),
+        !lock.contains(&original),
         "the upstream sha line must actually have been replaced (else the pin is vacuous)"
     );
+    assert_no_redirect_ledger(&fx.proj);
 
-    // The converged half: GEM section attribution + bundler's own `!` pin,
-    // with the move and the pin recorded in the ledger.
+    // The converged half: GEM section attribution + bundler's own `!` pin.
     assert!(
         lock.contains(&format!(
             "GEM\n  remote: {}\n  specs:\n    {DEP} ({DEP_VERSION})",
@@ -1520,12 +1509,6 @@ async fn gem_hosted_checksums_lock_converges_and_installs_frozen_and_unfrozen()
         lock.contains(&format!("  {DEP} (= {DEP_VERSION})!")),
         "DEPENDENCIES must carry the source-pinned entry:\n{lock}"
     );
-    assert!(
-        edits
-            .iter()
-            .any(|e| e["kind"] == "redirect_gemfile_lock_gem_source"),
-        "the GEM-section move must be a ledger edit: {edits:?}"
-    );
 
     // FROZEN fresh checkout: the converged pair needs no unfrozen two-step —
     // bundler's deployment contract accepts it as-is and the lock stays
@@ -1568,8 +1551,7 @@ async fn gem_hosted_checksums_lock_converges_and_installs_frozen_and_unfrozen()
 /// index URL per request, so a periodic/CI re-scan sees a NEW index URL for
 /// the SAME redirect. The re-scan must (1) be byte-idempotent under the same
 /// grant, (2) refresh the source block's URL IN PLACE under a rotated grant —
-/// exactly one Socket source block, a `redirect_gemfile_source_url` ledger
-/// edit, no stale token anywhere — and (3) leave a pair a fresh checkout
+/// exactly one Socket source block, no stale token anywhere, no ledger — and (3) leave a pair a fresh checkout
 /// installs the patched bytes from — never wrap the old block's indented
 /// gem line in a new NESTED source block (+1 nesting per re-scan) with the
 /// stale token URL still live.
@@ -1594,19 +1576,9 @@ async fn gem_hosted_rotated_grant_rescan_refreshes_source_block_and_installs() {
     let index_url_b = format!("{api}/patch-registry/gem/{TOKEN_B}/{UUID}/");
     let gemfile_after_run1 = std::fs::read_to_string(fx.proj.join("Gemfile"))
         .expect("read Gemfile after initial hosted scan");
-    let ledger_edits = |proj: &Path| -> Vec<serde_json::Value> {
-        serde_json::from_str::<serde_json::Value>(
-            &std::fs::read_to_string(proj.join(".socket/vendor/redirect-state.json"))
-                .expect("read redirect ledger"),
-        )
-        .expect("ledger is JSON")["edits"]
-            .as_array()
-            .expect("ledger edits array")
-            .clone()
-    };
-    let edits_after_run1 = ledger_edits(&fx.proj).len();
+    let lock_after_run1 = std::fs::read_to_string(fx.proj.join(fx.lock_name)).unwrap();
 
-    // Re-scan 2, SAME grant: byte-idempotent, no ledger growth.
+    // Re-scan 2, SAME grant: byte-idempotent (Gemfile AND lock), no ledger.
     let (code, stdout, stderr) = run_hosted_scan(&fx.proj, &api);
     assert_eq!(
         code, 0,
@@ -1621,10 +1593,11 @@ async fn gem_hosted_rotated_grant_rescan_refreshes_source_block_and_installs() {
         "same-grant re-scan must leave the Gemfile byte-identical"
     );
     assert_eq!(
-        ledger_edits(&fx.proj).len(),
-        edits_after_run1,
-        "same-grant re-scan must not grow the ledger"
+        std::fs::read_to_string(fx.proj.join(fx.lock_name)).unwrap(),
+        lock_after_run1,
+        "same-grant re-scan must leave the lock byte-identical"
     );
+    assert_no_redirect_ledger(&fx.proj);
 
     // Re-scan 3, ROTATED grant (token B, same uuid): refresh in place.
     let (code, stdout, stderr) = run_hosted_scan(&fx.proj, &api);
@@ -1651,20 +1624,11 @@ async fn gem_hosted_rotated_grant_rescan_refreshes_source_block_and_installs() {
         !gemfile.contains(TOKEN),
         "the stale grant token must be gone from the Gemfile:\n{gemfile}"
     );
-    let refresh = ledger_edits(&fx.proj)
-        .into_iter()
-        .find(|e| e["kind"] == "redirect_gemfile_source_url")
-        .expect("rotation must be recorded as a redirect_gemfile_source_url ledger edit");
-    assert_eq!(
-        refresh["original"],
-        serde_json::Value::String(fx.index_url.clone()),
-        "refresh edit original: {refresh}"
-    );
-    assert_eq!(
-        refresh["new"],
-        serde_json::Value::String(index_url_b),
-        "refresh edit new: {refresh}"
+    assert!(
+        !gemfile.contains(&fx.index_url),
+        "the grant-A index URL must be refreshed away:\n{gemfile}"
     );
+    assert_no_redirect_ledger(&fx.proj);
 
     // Fresh checkout of the rotated pair: the prescribed unfrozen install
     // resolves the patched gem from the rotated registry path.
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_gem_stale_install.rs b/crates/socket-patch-cli/tests/e2e_redirect_gem_stale_install.rs
index b3bbb586..34e641ec 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_gem_stale_install.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_gem_stale_install.rs
@@ -15,19 +15,20 @@
 //!   3. FRESH checkout (no materialization) → quiet.
 //!   4. TWO gem homes both stale → one warning per home, each naming its
 //!      own paths.
-//!   5. RE-FIRE: a re-scan whose /patches/view fetch fails transiently
-//!      still warns, judged from the redirect ledger's persisted record.
-//!   6. Same-run `--vex`: the stale purl is excluded from the ledger-based
-//!      attestation — the envelope must never attest a CVE its own warning
-//!      says is live.
+//!   5. RE-SCAN with a failing record fetch: v5 hosted mode keeps no ledger,
+//!      so a re-scan whose /patches/view fetch fails has no persisted record
+//!      to judge from — it surfaces `record_fetch_failed` (the VEX-omission
+//!      detail) and leaves the committed wiring untouched.
+//!   6. Same-run `--vex`: the stale purl is excluded from the attestation
+//!      (built from this run's fetched records) — the envelope must never
+//!      attest a CVE its own warning says is live.
 //!   7. Manifest-less standalone `vex` over the same committed state follows
-//!      the installed tree: stale → `not_applied` (ledger kept) / nothing
-//!      discoverable (ledgers deleted, lock not yet converged); after the
-//!      prescribed re-install (the lock bundler then writes — separate
-//!      patch-registry `GEM` section on bundler >= 2.2, the merged
-//!      multi-remote section on <= 2.1) it attests from the lock + patch API
-//!      with no ledger; offline → `record_unavailable`; tampered →
-//!      `hash_mismatch`; reverted pair → `redirect_unwired`.
+//!      the installed tree: stale → nothing discoverable (no ledger, lock not
+//!      yet converged); after the prescribed re-install (the lock bundler
+//!      then writes — separate patch-registry `GEM` section on bundler >=
+//!      2.2, the merged multi-remote section on <= 2.1) it attests from the
+//!      lock + patch API; offline → `record_unavailable`; tampered →
+//!      `hash_mismatch`; reverted pair → not attested (nothing wires it).
 
 use std::path::{Path, PathBuf};
 
@@ -417,12 +418,13 @@ async fn gem_hosted_redirect_warns_once_per_stale_gem_home() {
     assert!(b.contains(&cache_b.display().to_string()), "{b}");
 }
 
-/// RE-FIRE guarantee: scan 1 warns and persists the patch record in the
-/// redirect ledger; scan 2's /patches/view fetch fails transiently (500) —
-/// the warning must STILL fire, judged from the ledger's persisted record,
-/// alongside the record_fetch_failed warning for the fetch itself.
+/// v5 hosted mode keeps no ledger: scan 1 warns (from its fetched record)
+/// and persists nothing but the Gemfile/lock edits; scan 2's /patches/view
+/// fetch fails transiently (500), so it surfaces `record_fetch_failed` with
+/// the VEX-omission detail, exits 0, and leaves the committed wiring
+/// byte-identical (the re-run is idempotent) — still with no ledger.
 #[tokio::test(flavor = "multi_thread")]
-async fn gem_hosted_stale_warning_refires_when_record_fetch_fails() {
+async fn gem_hosted_rescan_with_failing_record_fetch_reports_it_and_keeps_the_wiring() {
     let server = MockServer::start().await;
     mount_api(&server, Some(1)).await; // view answers 200 exactly once
     let tmp = tempfile::tempdir().unwrap();
@@ -431,43 +433,51 @@ async fn gem_hosted_stale_warning_refires_when_record_fetch_fails() {
     write_manifest_pair(&proj);
     let (gem_dir, ..) = materialize_installed_gem(&proj, "3.3.0", UPSTREAM_LIB);
 
-    // Scan 1: fresh record, warning fires, ledger persists the record.
+    // Scan 1: fresh record, warning fires, no ledger persists anything.
     let (code, stdout, _) = hosted_scan_json(&proj, &server.uri());
     assert_eq!(code, 0);
     let env = common::parse_json_envelope(&stdout);
-    assert_eq!(stale_warnings(&env).len(), 1, "scan 1 must warn: {env}");
-    let ledger = std::fs::read_to_string(proj.join(".socket/vendor/redirect-state.json")).unwrap();
-    assert!(
-        ledger.contains(UUID),
-        "the ledger must persist the record scan 2 falls back to: {ledger}"
-    );
+    let details = stale_warnings(&env);
+    assert_eq!(details.len(), 1, "scan 1 must warn: {env}");
+    assert!(details[0].contains(&gem_dir.display().to_string()), "{env}");
+    let ledger = proj.join(".socket/vendor/redirect-state.json");
+    assert!(!ledger.exists(), "hosted mode writes no redirect ledger");
+    let gemfile = std::fs::read(proj.join("Gemfile")).unwrap();
+    let lock = std::fs::read(proj.join("Gemfile.lock")).unwrap();
 
-    // Scan 2: view 500s → record_fetch_failed, but the stale warning
-    // re-fires from the ledger record.
+    // Scan 2: view 500s → record_fetch_failed with the VEX-omission detail.
     let (code, stdout, _) = hosted_scan_json(&proj, &server.uri());
-    assert_eq!(code, 0);
+    assert_eq!(code, 0, "{stdout}");
     let env = common::parse_json_envelope(&stdout);
-    let codes: Vec<&str> = env["redirect"]["warnings"]
+    let failed = env["redirect"]["warnings"]
         .as_array()
         .expect("warnings")
         .iter()
-        .filter_map(|w| w["code"].as_str())
-        .collect();
-    assert!(
-        codes.contains(&"record_fetch_failed"),
-        "the transient fetch failure itself is surfaced: {env}"
+        .find(|w| w["code"] == "record_fetch_failed")
+        .unwrap_or_else(|| panic!("the transient fetch failure is surfaced: {env}"));
+    assert_eq!(
+        failed["detail"],
+        format!(
+            "{PURL} redirected, but its patch record could not be fetched; this run's VEX \
+             attestation omits it (`socket-patch vex` fetches it again once the API answers)"
+        ),
+        "{env}"
     );
-    let details = stale_warnings(&env);
     assert_eq!(
-        details.len(),
-        1,
-        "a flaky record fetch must not retire the stale warning: {env}"
+        std::fs::read(proj.join("Gemfile")).unwrap(),
+        gemfile,
+        "the re-run leaves the Gemfile as the first run wrote it"
     );
-    assert!(details[0].contains(&gem_dir.display().to_string()), "{env}");
+    assert_eq!(
+        std::fs::read(proj.join("Gemfile.lock")).unwrap(),
+        lock,
+        "the re-run leaves the lock as the first run wrote it"
+    );
+    assert!(!ledger.exists(), "still no ledger");
 }
 
 /// Same-run `--vex` consistency: a stale-flagged purl is EXCLUDED from the
-/// ledger-based `assume_applied` attestation — the envelope must never
+/// run's `assume_applied` attestation — the envelope must never
 /// attest a CVE its own warning says is live. With the only patch stale,
 /// verification finds nothing attestable, so the run fails the VEX step
 /// (the embedded-VEX fail-the-command contract) and no document attests
@@ -576,16 +586,14 @@ async fn gem_hosted_manifest_less_vex_follows_the_installed_tree() {
         1
     );
     strip_manifest(&proj);
-    let ledger = std::fs::read(proj.join(".socket/vendor/redirect-state.json")).unwrap();
-
-    // Stale, ledger kept: the Gemfile block keeps the claim live, the
-    // pristine installed tree decides.
-    let out = run_vex(&bin, &proj, &base);
-    assert_eq!(out.code, Some(1), "stale install: {out}");
-    assert_not_attested(&out.envelope, PURL, "not_applied");
+    assert!(
+        !proj.join(".socket/vendor/redirect-state.json").exists(),
+        "hosted mode writes no redirect ledger"
+    );
 
-    // Stale, no ledgers: the lock is not converged yet (bundler < 2.6 mixed
-    // pair) and the Gemfile is not a discovery input — nothing to attest.
+    // Stale: the lock is not converged yet (bundler < 2.6 mixed pair), the
+    // Gemfile is not a discovery input, and v5 keeps no ledger claim —
+    // nothing to attest.
     strip_ledgers(&proj);
     let out = run_vex(&bin, &proj, &base);
     assert_eq!(out.code, Some(2), "nothing discoverable: {out}");
@@ -631,15 +639,15 @@ async fn gem_hosted_manifest_less_vex_follows_the_installed_tree() {
     assert_not_attested(&out.envelope, PURL, "hash_mismatch");
     std::fs::write(gem_dir.join("lib").join("stale_probe_gem.rb"), PATCHED_LIB).unwrap();
 
-    // Reverted pair, ledger (and the patched install) kept.
-    std::fs::write(proj.join(".socket/vendor/redirect-state.json"), &ledger).unwrap();
+    // Reverted pair (the patched install kept): nothing wires the patch any
+    // more, so nothing attests it — verified or not.
     std::fs::write(proj.join("Gemfile"), &pristine_gemfile).unwrap();
     std::fs::write(proj.join("Gemfile.lock"), &pristine_lock).unwrap();
     for no_verify in [false, true] {
         let mut run = base.clone();
         run.no_verify = no_verify;
         let out = run_vex(&bin, &proj, &run);
-        assert_eq!(out.code, Some(1), "reverted no_verify={no_verify}: {out}");
-        assert_not_attested(&out.envelope, PURL, "redirect_unwired");
+        assert_ne!(out.code, Some(0), "reverted no_verify={no_verify}: {out}");
+        assert_absent(out.doc.as_ref(), PURL);
     }
 }
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_maven_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_maven_build.rs
index 69c235e4..27013ad6 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_maven_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_maven_build.rs
@@ -19,7 +19,8 @@
 //!      production-shaped `…/patch-registry/maven/<token>/<uuid>/maven2`
 //!      path, next to the discovery / reference / view API mocks.
 //!   3. `scan --mode hosted --json --vex …` (the real binary) rewires the
-//!      three files, writes the ledger, and attests in-run `(redirected)`.
+//!      three files (v5: NO redirect ledger — the pom is the hosted state)
+//!      and attests in-run `(redirected)`.
 //!   4. FRESH CHECKOUT: only `pom.xml` + `.mvn/` + `.socket/` travel, the
 //!      fixture is purged from the local repository, and Maven resolves
 //!      with a user `settings.xml` mirroring ONLY `socket-patch-<uuid>`
@@ -33,17 +34,18 @@
 //!      lines ignore the `aether.*` properties — asserted, so a change in
 //!      either direction is noticed).
 //!   6. MANIFEST-LESS VEX over the fresh checkout (`vex_e2e_common`):
-//!      * the ledger present, online → the installed suffixed copy
-//!        hash-verifies, attested `(redirected)`; `--offline` → attested
-//!        from the ledger's record;
-//!      * the ledgers deleted, online → attested from the pom wiring +
-//!        the API record; `--offline` → `record_unavailable`, ZERO
-//!        requests;
+//!      * online → attested from the pom wiring + the API record (the
+//!        installed suffixed copy hash-verifies, `(redirected)`);
+//!        `--offline` → `record_unavailable`, ZERO requests (hosted mode
+//!        keeps no local record);
 //!      * embedded `apply --vex` with no manifest attests the same;
 //!      * a tampered installed jar → `hash_mismatch`;
-//!      * the pom reverted to the registry version (ledgers, `.mvn/` and
-//!        the installed suffixed copy left behind) → `redirect_unwired`,
+//!      * the pom reverted to the registry version (`.mvn/` and the
+//!        installed suffixed copy left behind) → nothing names the patch,
 //!        with and without `--no-verify`.
+//!   7. ROLLBACK (`--offline`: Maven restores with no network) returns the
+//!      original project's pom byte-for-byte to its registry version and
+//!      drops the `.mvn/` provenance hosted mode wrote.
 //!
 //! Gated like the other real-toolchain capstones: `#[ignore]` (network to
 //! Maven Central for the fixture), toolchain selection and the
@@ -323,7 +325,7 @@ fn maven_scan_hosted_fresh_checkout_install_and_manifestless_vex() {
     mount_api(&server, &patched_jar, &sfx_pom, &view);
     server.serve_repo(&patched_jar, &sfx_pom, None);
 
-    // 3. The real writer: three-file rewrite + ledger + in-run VEX.
+    // 3. The real writer: three-file rewrite + in-run VEX, no ledger.
     let (code, env, stderr) = socket(
         &proj,
         &m2,
@@ -367,7 +369,10 @@ fn maven_scan_hosted_fresh_checkout_install_and_manifestless_vex() {
         checksums.contains(&sha256_hex(&patched_jar)) && checksums.contains(&sha256_hex(&sfx_pom)),
         "trusted checksums pin the jar and the served pom:\n{checksums}"
     );
-    assert!(proj.join(".socket/vendor/redirect-state.json").is_file());
+    assert!(
+        !proj.join(".socket/vendor/redirect-state.json").exists(),
+        "v5 hosted mode must not write the redirect ledger"
+    );
     assert!(
         !proj.join(".socket/manifest.json").exists(),
         "hosted mode never writes the manifest"
@@ -473,35 +478,8 @@ fn maven_scan_hosted_fresh_checkout_install_and_manifestless_vex() {
     let api = PatchApi::start(vec![(UUID.to_string(), view.clone())]);
     let run = vex_run(&m2);
 
-    // Ledger present, online: the installed suffixed copy hash-verifies.
-    let out = run_vex(
-        &binary(),
-        &fresh,
-        &VexRun {
-            proxy_url: Some(api.uri()),
-            ..run.clone()
-        },
-    );
-    assert_eq!(out.code, Some(0), "{out}");
-    assert_attested(out.doc(), &purl(), UUID, Marker::Redirected, &vulns());
-    // ...and offline from the ledger's embedded record.
-    let quiet = PatchApi::empty();
-    let out = run_vex(
-        &binary(),
-        &fresh,
-        &VexRun {
-            offline: true,
-            proxy_url: Some(quiet.uri()),
-            ..run.clone()
-        },
-    );
-    assert_eq!(out.code, Some(0), "{out}");
-    assert_attested(out.doc(), &purl(), UUID, Marker::Redirected, &vulns());
-    quiet.assert_no_requests();
-
-    // Ledgers gone: the pom wiring + the API record.
-    let ledger = std::fs::read(fresh.join(".socket/vendor/redirect-state.json")).unwrap();
-    strip_ledgers(&fresh);
+    // Online: the pom wiring + the API record; the installed suffixed copy
+    // hash-verifies.
     let before = api.view_requests(UUID);
     let out = run_vex(
         &binary(),
@@ -530,7 +508,8 @@ fn maven_scan_hosted_fresh_checkout_install_and_manifestless_vex() {
     assert_eq!(out.code, Some(0), "{out}");
     assert_attested(out.doc(), &purl(), UUID, Marker::Redirected, &vulns());
 
-    // Offline, no ledgers: record_unavailable with zero network.
+    // Offline: no local record (hosted mode keeps none) → record_unavailable
+    // with zero network.
     let quiet = PatchApi::empty();
     let out = run_vex(
         &binary(),
@@ -574,36 +553,55 @@ fn maven_scan_hosted_fresh_checkout_install_and_manifestless_vex() {
     assert_not_attested(&out.envelope, &purl(), "hash_mismatch");
     std::fs::write(&installed, &patched_jar).unwrap();
 
-    // Reverted to the registry version, ledger + `.mvn/` + the installed
-    // suffixed copy left behind: dead, with and without --no-verify.
+    // Reverted to the registry version, `.mvn/` + the installed suffixed
+    // copy left behind: nothing names the patch any more, with and without
+    // --no-verify.
     std::fs::write(fresh.join("pom.xml"), &pristine_pom).unwrap();
-    std::fs::write(fresh.join(".socket/vendor/redirect-state.json"), &ledger).unwrap();
     for no_verify in [false, true] {
-        let quiet = PatchApi::empty();
         let out = run_vex(
             &binary(),
             &fresh,
             &VexRun {
-                offline: true,
+                proxy_url: Some(api.uri()),
                 no_verify,
-                proxy_url: Some(quiet.uri()),
                 ..run.clone()
             },
         );
-        assert_eq!(out.code, Some(1), "reverted no_verify={no_verify}: {out}");
-        assert_not_attested(&out.envelope, &purl(), "redirect_unwired");
+        assert_eq!(out.code, Some(2), "reverted no_verify={no_verify}: {out}");
+        assert_eq!(out.envelope["error"]["code"], "manifest_not_found", "{out}");
         assert_absent(out.doc.as_ref(), &purl());
     }
-    // ...and with the ledger gone too there is nothing to attest at all.
-    strip_ledgers(&fresh);
-    let out = run_vex(
-        &binary(),
-        &fresh,
-        &VexRun {
-            proxy_url: Some(api.uri()),
-            ..run.clone()
-        },
+
+    // 7. ROLLBACK of the original project: Maven's restore needs no
+    // network, so `--offline` returns the pom byte-for-byte to its registry
+    // version and drops the `.mvn/` provenance.
+    let (code, env, stderr) = socket(
+        &proj,
+        &m2,
+        &[
+            "rollback",
+            "--json",
+            "--offline",
+            "--cwd",
+            proj.to_str().unwrap(),
+        ],
     );
-    assert_eq!(out.code, Some(2), "{out}");
-    assert_eq!(out.envelope["error"]["code"], "manifest_not_found", "{out}");
+    assert_eq!(code, Some(0), "rollback --offline: {env}\n{stderr}");
+    assert_eq!(
+        env["hosted"]["reverted"],
+        serde_json::json!([purl()]),
+        "rollback restores the hosted pin: {env}"
+    );
+    assert_eq!(
+        std::fs::read_to_string(proj.join("pom.xml")).unwrap(),
+        pristine_pom,
+        "rollback restores the pom byte-for-byte"
+    );
+    for rel in [".mvn/checksums/checksums.sha256", ".mvn/maven.config"] {
+        assert!(
+            !proj.join(rel).exists(),
+            "rollback removes the {rel} hosted mode wrote"
+        );
+    }
+    assert!(!proj.join(".socket/vendor/redirect-state.json").exists());
 }
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_npm_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_npm_build.rs
index d578076d..dce12a6c 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_npm_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_npm_build.rs
@@ -2,9 +2,9 @@
 //!
 //! `scan --redirect` never lands patched bytes in the repo: it rewrites the
 //! lockfile so the patched dependency RESOLVES from Socket's hosted vendored
-//! patch (here: a wiremock standing in for patch.socket.dev) and records the
-//! patch (file hashes + vulnerabilities) in the redirect ledger. This test
-//! proves every link of that chain against the REAL npm:
+//! patch (here: a wiremock standing in for patch.socket.dev). v5 keeps no
+//! redirect ledger: the lockfile pin IS the hosted state. This test proves
+//! every link of that chain against the REAL npm:
 //!
 //!   1. `npm install left-pad@1.3.0` into a tempdir project (network used for
 //!      fixture setup only, private cache).
@@ -12,29 +12,31 @@
 //!      comment prepended to `index.js`) and serve it from wiremock, alongside
 //!      the discovery / reference / view API mocks.
 //!   3. `scan --redirect --json --vex …` (the real binary): the lockfile now
-//!      pins the wiremock tarball URL + the patched tarball's sha512, the
-//!      ledger embeds the patch record, and the in-run VEX is the unverified
-//!      `(redirected)` attestation (`verified: false`).
+//!      pins the wiremock tarball URL + the patched tarball's sha512, NO
+//!      `.socket/vendor/redirect-state.json` is written, and the in-run VEX
+//!      is the unverified `(redirected)` attestation (`verified: false`).
 //!   4. FRESH-CHECKOUT PROOF: only package.json + package-lock.json +
 //!      `.socket/` travel; `npm ci --cache <empty>` MUST install the patched
 //!      bytes — npm pulls them from the hosted patch server because the
 //!      lockfile says so.
 //!   5. POST-INSTALL VERIFIED VEX: `socket-patch vex` (default verify mode)
-//!      hash-verifies the installed tree against the ledger records and emits
-//!      the `(redirected)` statement.
+//!      discovers the hosted pin from the lockfile (`--patch-server-url`
+//!      names the wiremock origin), fetches the record from the patch API,
+//!      hash-verifies the installed tree and emits the `(redirected)`
+//!      statement.
 //!
 //! The negative twin serves TAMPERED tarball bytes while the lockfile keeps
 //! the real sha512: the fresh `npm ci` must FAIL with an integrity error —
 //! the lockfile pin is enforcement, not decoration.
 //!
 //! v4.0 adds get-driven twins through the SAME fixture: `get <uuid> --mode
-//! hosted` must land the identical redirect (no manifest, no blobs — the
-//! ledger is the persistence), and `get <GHSA> --mode hosted` must narrow a
+//! hosted` must land the identical redirect (no manifest, no blobs, no
+//! ledger — the lockfile is the persistence), and `get <GHSA> --mode hosted` must narrow a
 //! two-version fan-out to the installed version BEFORE the grant request.
 //!
 //! v5 adds the MANIFEST-LESS VEX tail to every flow that installs
-//! (`npm_e2e_common::manifestless_vex_matrix`): with the fresh checkout's
-//! ledger present, then deleted (lockfile discovery + a mock patch API),
+//! (`npm_e2e_common::manifestless_vex_matrix`): lockfile discovery + a mock
+//! patch API,
 //! then `--offline` (`record_unavailable`, zero requests), then with the
 //! lock reverted to its registry bytes (`redirect_unwired`, `--no-verify`
 //! too) — plus the embedded `apply --vex` twin. And it runs against EVERY
@@ -45,11 +47,12 @@
 //! the redirected lock (EALLOWREMOTE) unless `.npmrc` sets
 //! `allow-remote=all`, so the hosted run AUTO-CONFIGURES it: every flow
 //! asserts the run wrote `allow-remote=all` to a new project `.npmrc`
-//! (ledger-recorded, `redirect_npm_allow_remote` warned), the fresh checkout
+//! (`redirect_npm_allow_remote` warned), the fresh checkout
 //! carries that committed `.npmrc` and installs with a PLAIN `npm ci` on
 //! every major — npm >= 12 additionally proves the setting is load-bearing
 //! (a checkout WITHOUT it is refused EALLOWREMOTE) — and the main capstone
-//! ends with `rollback` removing exactly the `.npmrc` it created.
+//! ends with `rollback` restoring the upstream registry entry (re-resolved
+//! from the REAL npm registry) and removing exactly the `.npmrc` it created.
 //!
 //! Skips (with a println) when `npm` is missing or the fixture install
 //! cannot reach the registry — unless `SOCKET_PATCH_NPM_E2E_REQUIRED` is set;
@@ -168,7 +171,7 @@ enum RedirectCli {
 
 /// Steps 1–3 of the module doc: real install, patched tarball + API mocks
 /// (same contract as `tests/in_process_redirect.rs`), the `cli`-selected
-/// redirect invocation, and the envelope/lockfile/ledger assertions. When
+/// redirect invocation, and the envelope/lockfile/no-ledger assertions. When
 /// `tamper_served_tarball` is set, the tarball route serves DIFFERENT bytes
 /// than the sha512 pinned into the lockfile — the negative twin's premise.
 /// `None` = skip (message already printed).
@@ -448,7 +451,7 @@ async fn redirect_scanned_project(
             assert_eq!(env["vex"]["format"], "openvex-0.2.0", "vex block: {env}");
             assert_eq!(
                 env["vex"]["verified"], false,
-                "in-run redirect VEX is attested from the ledger, not hash-verified: {env}"
+                "in-run redirect VEX is attested from this run's fetched record, not hash-verified: {env}"
             );
         }
         RedirectCli::GetUuidHosted => {
@@ -530,8 +533,8 @@ async fn redirect_scanned_project(
     );
 
     // ...and the run AUTO-CONFIGURED it: a new project `.npmrc` holding
-    // exactly `allow-remote=all`, said so in the warning, ledger-recorded
-    // (so `rollback` can remove exactly what it added).
+    // exactly `allow-remote=all`, said so in the warning (`rollback` removes
+    // the file while it is still byte-identical to what the run created).
     let allow_remote = env["redirect"]["warnings"]
         .as_array()
         .and_then(|w| w.iter().find(|w| w["code"] == "redirect_npm_allow_remote"))
@@ -548,15 +551,10 @@ async fn redirect_scanned_project(
         "the hosted run must write allow-remote=all to the project .npmrc"
     );
 
-    // Ledger embeds the patch record so a post-install `vex` can verify.
-    let ledger = std::fs::read_to_string(proj.join(".socket/vendor/redirect-state.json")).unwrap();
+    // v5: hosted mode writes no ledger — the lockfile pin is the state.
     assert!(
-        ledger.contains("\"records\"") && ledger.contains(GHSA),
-        "redirect ledger must embed the patch record + vulnerability: {ledger}"
-    );
-    assert!(
-        ledger.contains("\"redirect_npmrc_allow_remote\""),
-        "the .npmrc auto-config must be ledger-recorded: {ledger}"
+        !proj.join(".socket/vendor/redirect-state.json").exists(),
+        "hosted mode must not write the redirect ledger"
     );
 
     Some(RedirectFixture {
@@ -609,17 +607,37 @@ fn fresh_checkout_npm_ci(fx: &RedirectFixture) -> (PathBuf, Output) {
     (fresh, ci)
 }
 
-/// The capstone's last step: `rollback` in the redirected project unwinds
-/// the lock redirect AND removes exactly the `.npmrc` the hosted run created
-/// (the ledger's `redirect_npmrc_allow_remote` `created` edit), leaving the
-/// committed lock(s) at their registry resolution and no ledger behind.
+/// The capstone's last step: `rollback` in the redirected project restores
+/// the upstream registry entry (re-resolved from the REAL npm registry — the
+/// pin is discovered from the lock on the `--patch-server-url` origin) AND
+/// removes exactly the `.npmrc` the hosted run created (still byte-identical
+/// to the scaffold), leaving the committed lock(s) at their registry
+/// resolution and no ledger behind.
 fn rollback_removes_npmrc(fx: &RedirectFixture) {
     let proj = fx.proj.to_str().unwrap();
-    let (code, stdout, stderr) = run_socket(&fx.proj, &["rollback", "--json", "--cwd", proj]);
+    let uri = fx.server.uri();
+    let (code, stdout, stderr) = run_socket(
+        &fx.proj,
+        &[
+            "rollback",
+            "--json",
+            "--cwd",
+            proj,
+            "--patch-server-url",
+            &uri,
+        ],
+    );
     assert_eq!(
         code, 0,
         "rollback failed.\nstdout:\n{stdout}\nstderr:\n{stderr}"
     );
+    let env: serde_json::Value = serde_json::from_str(&stdout)
+        .unwrap_or_else(|e| panic!("rollback --json is not JSON: {e}\n{stdout}"));
+    assert_eq!(
+        env["hosted"]["reverted"],
+        serde_json::json!([PURL]),
+        "rollback restores the hosted pin to its upstream entry: {env}"
+    );
     assert!(
         !fx.proj.join(".npmrc").exists(),
         "rollback must remove the .npmrc the hosted run created:\n{stdout}"
@@ -635,7 +653,7 @@ fn rollback_removes_npmrc(fx: &RedirectFixture) {
     }
     assert!(
         !fx.proj.join(".socket/vendor/redirect-state.json").exists(),
-        "the emptied redirect ledger is deleted"
+        "rollback never creates a redirect ledger"
     );
 }
 
@@ -680,8 +698,8 @@ fn fresh_install_patched(fx: &RedirectFixture) -> (PathBuf, bool) {
 }
 
 /// A patch API (public-proxy view route) serving the capstone's record
-/// with the REAL patched hash — what manifest-less VEX fetches once the
-/// ledger is gone. Built on its own runtime thread (the test's own runtime
+/// with the REAL patched hash — what manifest-less VEX fetches (hosted mode
+/// keeps no local record). Built on its own runtime thread (the test's own runtime
 /// cannot host a nested one).
 fn manifestless_tail(fx: &RedirectFixture, fresh: &Path, installed: bool, embedded: &[VexVia]) {
     std::thread::scope(|scope| {
@@ -748,23 +766,26 @@ async fn npm_redirect_fresh_checkout_npm_ci_installs_patched_bytes_and_vex_verif
     let (fresh, installed) = fresh_install_patched(&fx);
 
     // 5. POST-INSTALL VERIFIED VEX: default verify mode hash-verifies the
-    //    installed tree against the ledger's patch record (npm <= 6 installed
+    //    installed tree against the API's patch record (npm <= 6 installed
     //    nothing — the manifest-less tail below covers its lockfile basis).
     if installed {
-        post_install_ledger_vex(&fresh);
+        post_install_vex(&fresh, &fx.server.uri());
     }
 
-    // 6. MANIFEST-LESS VEX over the fresh checkout: ledger present, ledger
-    //    deleted (lockfile + API), offline, reverted — standalone and via
-    //    the embedded `apply --vex`.
-    manifestless_tail(&fx, &fresh, installed, &[VexVia::Apply]);
-
-    // 7. ROLLBACK: the lock redirect AND the auto-configured .npmrc go.
+    // 6. ROLLBACK of the redirected project (the fresh checkout is its own
+    //    tree): the lock goes back to the upstream registry entry and the
+    //    auto-configured .npmrc goes.
     rollback_removes_npmrc(&fx);
+
+    // 7. MANIFEST-LESS VEX over the fresh checkout: lockfile + API,
+    //    offline, reverted — standalone and via the embedded `apply --vex`.
+    manifestless_tail(&fx, &fresh, installed, &[VexVia::Apply]);
 }
 
-/// Step 5 of the capstone: the ledger-backed, hash-verified `vex`.
-fn post_install_ledger_vex(fresh: &Path) {
+/// Step 5 of the capstone: the hash-verified `vex`. v5 hosted mode keeps no
+/// ledger, so the pin comes from the committed lock (its host named by
+/// `--patch-server-url`) and the record from the org-scoped patch API.
+fn post_install_vex(fresh: &Path, server: &str) {
     let doc_path = fresh.join("doc.json");
     let (code, stdout, stderr) = run_socket(
         fresh,
@@ -776,6 +797,14 @@ fn post_install_ledger_vex(fresh: &Path) {
             PRODUCT,
             "--cwd",
             fresh.to_str().unwrap(),
+            "--patch-server-url",
+            server,
+            "--api-url",
+            server,
+            "--org",
+            ORG,
+            "--api-token",
+            "fake",
         ],
     );
     assert_eq!(
@@ -865,7 +894,7 @@ async fn npm_redirect_tampered_hosted_tarball_fails_fresh_npm_ci() {
 /// `get <uuid> --mode hosted` twin of the capstone: the same fixture (real
 /// npm install, patched hosted tarball, API mocks) driven by get's UUID path
 /// must land the identical redirect — lockfile pinned to the hosted tarball,
-/// ledger written, NO manifest/blobs (all asserted inside the fixture) — and
+/// NO ledger, NO manifest/blobs (all asserted inside the fixture) — and
 /// a fresh checkout's `npm ci` must install the patched bytes.
 #[tokio::test(flavor = "multi_thread")]
 #[ignore = "wall-bound real-npm install (~150s); runs on all 3 OSes as an e2e CI matrix leg"]
@@ -890,7 +919,7 @@ async fn npm_get_uuid_hosted_fresh_checkout_npm_ci_installs_patched_bytes() {
 /// uninstalled 9.9.9. The coarse installed-version narrowing must drop the
 /// latter BEFORE the grant request (the reference body is the oracle — the
 /// lockfile rewriter could never catch a granted-but-unmatchable version),
-/// only the installed purl may land in the ledger, and the fresh-checkout
+/// only the installed purl may land in the lockfile, and the fresh-checkout
 /// install must still land the patched bytes.
 #[tokio::test(flavor = "multi_thread")]
 #[ignore = "wall-bound real-npm install (~150s); runs on all 3 OSes as an e2e CI matrix leg"]
@@ -940,18 +969,16 @@ async fn npm_get_ghsa_hosted_narrows_and_installs() {
         "the uninstalled version's view must never be fetched"
     );
 
-    // Ledger: only the installed purl's record.
-    let ledger: serde_json::Value = serde_json::from_str(
-        &std::fs::read_to_string(fx.proj.join(".socket/vendor/redirect-state.json")).unwrap(),
-    )
-    .unwrap();
+    // The lockfile (v5's only hosted state): only the installed purl's
+    // patch uuid is pinned.
+    let lock = std::fs::read_to_string(fx.proj.join("package-lock.json")).unwrap();
     assert!(
-        ledger["records"][PURL].is_object(),
-        "the installed purl must be recorded in the ledger: {ledger}"
+        lock.contains(&format!("/{UUID}/")),
+        "the installed purl must be pinned in the lockfile: {lock}"
     );
     assert!(
-        ledger["records"][PURL_UNINSTALLED].is_null(),
-        "no ledger record for the uninstalled version: {ledger}"
+        !lock.contains(UUID_UNINSTALLED) && !lock.contains("9.9.9"),
+        "nothing may pin the uninstalled version: {lock}"
     );
 
     // Fresh-checkout proof: the narrowed redirect still installs the
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_pnpm_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_pnpm_build.rs
index b627eebc..ecd2686f 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_pnpm_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_pnpm_build.rs
@@ -4,8 +4,9 @@
 //! `scan --mode hosted` never lands patched bytes in the repo: it splices the
 //! patched package's `resolution:` in pnpm-lock.yaml to `{integrity:
 //! <patched sha512>, tarball: <hosted url>}` (a wiremock standing in for
-//! patch.socket.dev) and records the patch in the redirect ledger. The
-//! corepack legs prove every link of that chain against the REAL pnpm:
+//! patch.socket.dev) and writes nothing else but the pnpm >=11 trust setting
+//! (v5: no redirect ledger; the lock IS the hosted state). The corepack legs
+//! prove every link of that chain against the REAL pnpm:
 //!
 //!   1. `corepack pnpm@<major> install left-pad@1.3.0` into a tempdir project
 //!      (network used for fixture setup only, private `--store-dir`).
@@ -14,11 +15,10 @@
 //!      the discovery / reference / view API mocks.
 //!   3. `scan --mode hosted --json --yes` (the real binary): the lock's
 //!      `resolution:` now pins the wiremock tarball URL + the patched
-//!      tarball's sha512, the ledger holds the `redirect_pnpm_resolution`
-//!      edit + the patch record, and a second scan is idempotent (lock
-//!      byte-stable, no duplicate ledger edits).
-//!   4. FRESH-CHECKOUT PROOF: only package.json + pnpm-lock.yaml + `.socket/`
-//!      travel, the `.npmrc` registry points at a DEAD port, the store is
+//!      tarball's sha512, no ledger is written, and a second scan is
+//!      idempotent (lock and workspace file byte-stable).
+//!   4. FRESH-CHECKOUT PROOF: only package.json + pnpm-lock.yaml (+ `.socket/`
+//!      when present) travel, the `.npmrc` registry points at a DEAD port, the store is
 //!      empty — `pnpm install --frozen-lockfile` MUST land the marker bytes,
 //!      because the only reachable artifact URL is the hosted tarball.
 //!
@@ -43,8 +43,7 @@
 //! `e2e_vex_lockfile/pnpm.rs`.
 //!
 //! TRUST AUTO-CONFIG: a scan that rewrites a ROOT v9 lock also ensures
-//! `trustLockfile: true` in pnpm-workspace.yaml (ledger edit kind
-//! `redirect_pnpm_workspace_trust`; the workspace file joins
+//! `trustLockfile: true` in pnpm-workspace.yaml (the workspace file joins
 //! `rewrittenFiles`), because pnpm >=11's lockfile supply-chain policy
 //! rejects the rewritten lock otherwise. Legacy locks need no trust setting
 //! or flag. The auto-config gate is lock-major >=9. Two
@@ -217,9 +216,17 @@ fn corepack(cwd: &Path, pm: &str, args: &[&str]) -> Output {
 }
 
 fn run_socket(cwd: &Path, args: &[&str]) -> (i32, String, String) {
+    run_socket_env(cwd, args, &[])
+}
+
+/// [`run_socket`] with extra env applied after the scrub.
+fn run_socket_env(cwd: &Path, args: &[&str], env: &[(String, String)]) -> (i32, String, String) {
     let mut cmd = Command::new(binary());
     cmd.args(args).current_dir(cwd);
     scrub_socket_env(&mut cmd);
+    for (k, v) in env {
+        cmd.env(k, v);
+    }
     let out = cmd.output().expect("failed to run socket-patch binary");
     (
         out.status.code().unwrap_or(-1),
@@ -737,56 +744,17 @@ async fn redirect_scanned_pnpm_project(
         "hosted mode must not edit package.json"
     );
 
-    // Ledger: the lock edit (with the original resolution preserved for
-    // revert) + the embedded patch record a post-install `vex` verifies.
+    // v5 hosted mode keeps no ledger: the lock (+ the trust setting) is the
+    // whole hosted state.
     let ledger_path = proj.join(".socket/vendor/redirect-state.json");
-    let ledger: serde_json::Value =
-        serde_json::from_str(&std::fs::read_to_string(&ledger_path).unwrap()).unwrap();
-    let edits = ledger["edits"].as_array().unwrap().clone();
-    assert!(
-        edits.iter().any(|e| e["kind"] == "redirect_pnpm_resolution"
-            && e["key"] == format!("{DEP}@{DEP_VERSION}")
-            && e["path"] == lock_name),
-        "the ledger must record the redirect_pnpm_resolution edit: {ledger}"
-    );
-    let trust_edits: Vec<&serde_json::Value> = edits
-        .iter()
-        .filter(|e| e["kind"] == "redirect_pnpm_workspace_trust")
-        .collect();
-    if auto_trust {
-        // Exactly one trust edit, so `--revert` unwinds exactly one write.
-        assert_eq!(
-            trust_edits.len(),
-            1,
-            "a v9 rewrite must record exactly one workspace trust edit: {ledger}"
-        );
-        let edit = trust_edits[0];
-        assert_eq!(edit["path"], "pnpm-workspace.yaml", "trust edit: {edit}");
-        assert_eq!(edit["key"], "trustLockfile", "trust edit: {edit}");
-        // "created" = new file (revert deletes it); "added" = line appended
-        // to a pre-existing file (revert removes only that line).
-        let expected_action = if ws_existed_before {
-            "added"
-        } else {
-            "created"
-        };
-        assert_eq!(edit["action"], expected_action, "trust edit: {edit}");
-    } else {
-        assert!(
-            trust_edits.is_empty(),
-            "legacy-lock / --no-trust-lockfile-config runs must record no workspace \
-             trust edit: {ledger}"
-        );
-    }
     assert!(
-        ledger["records"][PURL]["vulnerabilities"][GHSA].is_object(),
-        "the ledger must embed the patch record + vulnerability: {ledger}"
+        !ledger_path.exists(),
+        "hosted mode writes no redirect ledger ({tag})"
     );
 
     // Idempotency: the second scan still counts the dep as redirected (the
     // hosted URL is already in the lock) but rewrites nothing — lock AND
-    // workspace file byte-stable — and appends no duplicate edits (which
-    // would poison a revert).
+    // workspace file byte-stable — and still writes no ledger.
     let (code, stdout, stderr) = run_hosted(driver, &proj, &server.uri(), scan_extra);
     assert_eq!(
         code, 0,
@@ -814,13 +782,7 @@ async fn redirect_scanned_pnpm_project(
             "the re-run must leave pnpm-workspace.yaml byte-stable"
         );
     }
-    let ledger2: serde_json::Value =
-        serde_json::from_str(&std::fs::read_to_string(&ledger_path).unwrap()).unwrap();
-    assert_eq!(
-        edits.len(),
-        ledger2["edits"].as_array().unwrap().len(),
-        "a re-run must not append duplicate ledger edits: {ledger2}"
-    );
+    assert!(!ledger_path.exists(), "the re-run writes no ledger ({tag})");
 
     Some(PnpmRedirectFixture {
         tmp,
@@ -858,7 +820,10 @@ fn fresh_checkout_install(
         )
         .expect("the v9 scan must have written pnpm-workspace.yaml");
     }
-    copy_dir_recursive(&fx.proj.join(".socket"), &fresh.join(".socket"));
+    // v5 hosted mode writes nothing under `.socket/`; carry it when present.
+    if fx.proj.join(".socket").is_dir() {
+        copy_dir_recursive(&fx.proj.join(".socket"), &fresh.join(".socket"));
+    }
     // Dead registry: the only reachable artifact URL is the wiremock hosted
     // tarball, so a successful install can only have come from it. The retry
     // clamps keep the negative legs from pnpm's default 10s + 60s retry
@@ -1342,10 +1307,7 @@ async fn pnpm_pinned_matrix_install_verify_revert_and_tamper() {
     );
     assert!(warm.status.success(), "warm install failed: {warm:?}");
     let installed = std::fs::read(fx.proj.join("node_modules").join(DEP).join("index.js")).unwrap();
-    let (vex_code, _, _) = run_socket(
-        &fx.proj,
-        &["vex", "--offline", "--product", "pkg:npm/consumer@0.0.0"],
-    );
+    let (vex_code, _, _) = vex_online(&fx.proj, &fx._server.uri());
     assert_eq!(
         vex_code == 0,
         installed == fx.patched,
@@ -1376,10 +1338,7 @@ async fn pnpm_pinned_matrix_install_verify_revert_and_tamper() {
 
     // Local evidence of remediation: the default VEX path verifies installed
     // hashes. This deliberately makes no assertion about dashboard alerts.
-    let (code, stdout, stderr) = run_socket(
-        &fresh,
-        &["vex", "--offline", "--product", "pkg:npm/consumer@0.0.0"],
-    );
+    let (code, stdout, stderr) = vex_online(&fresh, &fx._server.uri());
     assert_eq!(code, 0, "verified VEX failed: {stdout}\n{stderr}");
     let vex: serde_json::Value = serde_json::from_str(&stdout).unwrap();
     assert_eq!(vex["statements"][0]["status"], "not_affected", "{vex}");
@@ -1400,9 +1359,12 @@ async fn pnpm_pinned_matrix_install_verify_revert_and_tamper() {
 
     // Revert committed wiring without an installed tree: no in-place patch
     // reversal or blob fetching can hide a lock/trust-setting rollback bug.
+    // v5: the upstream restore re-resolves the registry integrity (a mirror
+    // of the pristine lock's), with the mock origin named the patch server.
     std::fs::remove_dir_all(fx.proj.join("node_modules")).unwrap();
+    let unwind = unwind_env(&fx._server, &fx.lock_before).await;
     let (code, stdout, stderr) =
-        run_socket(&fx.proj, &["rollback", "--offline", "--yes", "--json"]);
+        run_socket_env(&fx.proj, &["rollback", "--yes", "--json"], &unwind);
     assert_eq!(code, 0, "rollback failed: {stdout}\n{stderr}");
     assert_eq!(
         std::fs::read_to_string(fx.proj.join(&fx.lock_name)).unwrap(),
@@ -1446,6 +1408,106 @@ async fn pnpm_pinned_matrix_install_verify_revert_and_tamper() {
     );
 }
 
+/// The env an unwind of a hosted pnpm pin runs with: `server` named the
+/// patch server (so its tarball URL counts as a hosted pin — v5 keeps no
+/// ledger) and an npm registry mirror under `<server>/registry` serving
+/// `left-pad@1.3.0`'s version document with the integrity `lock_before`
+/// (the pristine lock) recorded — all the v5 upstream restore reads.
+async fn unwind_env(server: &MockServer, lock_before: &str) -> Vec<(String, String)> {
+    unwind_env_for(server, &server.uri(), lock_before).await
+}
+
+/// [`unwind_env`] with the hosted origin given explicitly (the synthetic
+/// legs pin `http://patch.test`, not the mock server's own origin).
+async fn unwind_env_for(
+    server: &MockServer,
+    patch_origin: &str,
+    lock_before: &str,
+) -> Vec<(String, String)> {
+    let integrity = regex::Regex::new(r"integrity: (sha512-[A-Za-z0-9+/=]+)")
+        .unwrap()
+        .captures(lock_before)
+        .map(|c| c[1].to_string())
+        .unwrap_or_else(|| panic!("no integrity in the pristine lock:\n{lock_before}"));
+    Mock::given(method("GET"))
+        .and(path(format!("/registry/{DEP}/{DEP_VERSION}")))
+        .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+            "name": DEP,
+            "version": DEP_VERSION,
+            "dist": {
+                "tarball": format!("https://registry.npmjs.org/{DEP}/-/{DEP}-{DEP_VERSION}.tgz"),
+                "integrity": integrity
+            }
+        })))
+        .mount(server)
+        .await;
+    vec![
+        (
+            "SOCKET_PATCH_SERVER_URL".to_string(),
+            patch_origin.to_string(),
+        ),
+        (
+            "SOCKET_NPM_REGISTRY".to_string(),
+            format!("{}/registry", server.uri()),
+        ),
+    ]
+}
+
+/// v5 unwind of a synthetic-leg hosted pin: `rollback` restores the
+/// upstream resolution from the registry mirror — the lock lands back on
+/// `pristine` byte for byte — and no ledger appears at any point.
+async fn assert_rollback_restores_pristine(server: &MockServer, root: &Path, pristine: &str) {
+    assert!(
+        !root.join(".socket/vendor/redirect-state.json").exists(),
+        "hosted mode writes no redirect ledger"
+    );
+    let unwind = unwind_env_for(server, "http://patch.test", pristine).await;
+    let (code, stdout, stderr) = run_socket_env(
+        root,
+        &[
+            "rollback",
+            "--yes",
+            "--json",
+            "--cwd",
+            root.to_str().unwrap(),
+        ],
+        &unwind,
+    );
+    assert_eq!(
+        code, 0,
+        "rollback failed.\nstdout:\n{stdout}\nstderr:\n{stderr}"
+    );
+    assert_eq!(
+        std::fs::read_to_string(root.join("pnpm-lock.yaml")).unwrap(),
+        pristine,
+        "rollback restores the upstream resolution byte for byte"
+    );
+    assert!(!root.join(".socket/vendor/redirect-state.json").exists());
+}
+
+/// `vex` over `cwd`, ONLINE: v5 keeps no hosted ledger, so the patch record
+/// comes from the patch API (`server_uri`, which is also the patch-server
+/// origin the lock's hosted URL lives on). The installed tree is still
+/// hash-verified.
+fn vex_online(cwd: &Path, server_uri: &str) -> (i32, String, String) {
+    run_socket(
+        cwd,
+        &[
+            "vex",
+            "--product",
+            "pkg:npm/consumer@0.0.0",
+            "--api-url",
+            server_uri,
+            "--org",
+            ORG,
+            "--api-token",
+            "fake",
+            "--patch-server-url",
+            server_uri,
+        ],
+    )
+}
+
 /// A project whose only lockfile is the synthesized `lock`, with an installed
 /// node_modules stub so the crawler discovers the dep (a real pnpm project
 /// always has one).
@@ -1574,25 +1636,9 @@ async fn pnpm_v5_lock_key_rewrite_splices_in_place() {
         "the upstream integrity must be replaced; got:\n{lock_after}"
     );
 
-    let ledger: serde_json::Value = serde_json::from_str(
-        &std::fs::read_to_string(tmp.path().join(".socket/vendor/redirect-state.json")).unwrap(),
-    )
-    .unwrap();
-    let edit = ledger["edits"]
-        .as_array()
-        .unwrap()
-        .iter()
-        .find(|e| {
-            e["kind"] == "redirect_pnpm_resolution" && e["key"] == format!("{DEP}@{DEP_VERSION}")
-        })
-        .unwrap_or_else(|| panic!("the ledger must record the v5 redirect edit: {ledger}"));
-    assert!(
-        edit["original"]
-            .as_str()
-            .unwrap_or_default()
-            .contains(UPSTREAM_SHA512),
-        "the ledger must preserve the original upstream integrity for revert: {edit}"
-    );
+    // The unwind: no ledger preserves the original — rollback re-resolves
+    // the upstream integrity and splices it back in place.
+    assert_rollback_restores_pristine(&server, tmp.path(), &v5_lock()).await;
 }
 
 /// pnpm v6 PLAIN lock keys (`/name@version:` with no peer suffix) stay inside
@@ -1680,33 +1726,9 @@ async fn pnpm_v6_plain_lock_key_rewrite_stays_supported() {
         "the upstream integrity must be replaced; got:\n{lock_after}"
     );
 
-    let ledger: serde_json::Value = serde_json::from_str(
-        &std::fs::read_to_string(tmp.path().join(".socket/vendor/redirect-state.json")).unwrap(),
-    )
-    .unwrap();
-    let edit = ledger["edits"]
-        .as_array()
-        .unwrap()
-        .iter()
-        .find(|e| {
-            e["kind"] == "redirect_pnpm_resolution" && e["key"] == format!("{DEP}@{DEP_VERSION}")
-        })
-        .unwrap_or_else(|| panic!("the ledger must record the v6 redirect edit: {ledger}"));
-    assert!(
-        edit["original"]
-            .as_str()
-            .unwrap_or_default()
-            .contains(UPSTREAM_SHA512),
-        "the ledger must preserve the original upstream integrity for revert: {edit}"
-    );
-    assert!(
-        !ledger["edits"]
-            .as_array()
-            .unwrap()
-            .iter()
-            .any(|e| e["kind"] == "redirect_pnpm_workspace_trust"),
-        "a v6-lock scan must record no workspace trust edit: {ledger}"
-    );
+    // The unwind: no ledger preserves the original — rollback re-resolves
+    // the upstream integrity and splices it back in place.
+    assert_rollback_restores_pristine(&server, tmp.path(), &v6_lock()).await;
 }
 
 /// Real pnpm workspace graph with a scoped target, an npm alias, two peer
@@ -1887,7 +1909,9 @@ async fn pnpm_pinned_matrix_workspace_peer_instances() {
     }
     // Manifest-less VEX over the fresh workspace: both peer instances are
     // hash-verified, from the ledger and then from the lockfile alone.
-    copy_dir_recursive(&proj.join(".socket"), &fresh.join(".socket"));
+    if proj.join(".socket").is_dir() {
+        copy_dir_recursive(&proj.join(".socket"), &fresh.join(".socket"));
+    }
     assert_manifestless_hosted_vex(
         &fresh,
         &server.uri(),
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_rush_sim.rs b/crates/socket-patch-cli/tests/e2e_redirect_rush_sim.rs
index dd589c50..9a0c2a02 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_rush_sim.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_rush_sim.rs
@@ -37,7 +37,7 @@ mod cache_env;
 mod vex_e2e_common;
 use vex_e2e_common::{
     assert_absent, assert_attested, assert_not_attested, git_sha256, patch_view, run_vex,
-    strip_ledgers, strip_manifest, Marker, PatchApi, VexRun,
+    strip_manifest, Marker, PatchApi, VexRun,
 };
 
 const ORG: &str = "test-org";
@@ -253,7 +253,7 @@ async fn mount_hosted(
         })))
         .mount(server)
         .await;
-    // The record the ledger embeds: the patched bytes' real hash, so a
+    // The record the hosted run fetches: the patched bytes' real hash, so a
     // post-install VEX verifies what the install landed.
     Mock::given(method("GET"))
         .and(path(format!("/v0/orgs/{ORG}/patches/view/{UUID}")))
@@ -336,11 +336,11 @@ fn simulate_rush_install(root: &Path, store: &Path) -> Output {
 /// Manifest-less VEX over the Rush repo root after an install landed the
 /// patched bytes. Discovery reads `common/config/rush/pnpm-lock.yaml` (the
 /// rewritten source of truth); the hosted URLs sit on `patch_server` (the
-/// wiremock), named via `--patch-server-url`. Cells: ledger kept (the
-/// ledger record); ledgers deleted (the lock + the patch API record);
-/// `--offline` with no ledgers (`record_unavailable`, zero requests); the
-/// common lock reverted with the ledger restored (`redirect_unwired`,
-/// `--no-verify` too).
+/// wiremock), named via `--patch-server-url`. v5 hosted mode writes no
+/// ledger, so the cells are: online (the lock + the patch API record);
+/// `--offline` (`record_unavailable`, zero requests); the common lock
+/// reverted (nothing names the patch any more — never attested, with or
+/// without `--no-verify`).
 fn assert_rush_manifestless_vex(root: &Path, patch_server: &str, patched: &[u8], pristine: &[u8]) {
     std::thread::scope(|s| {
         s.spawn(|| {
@@ -362,15 +362,12 @@ fn assert_rush_manifestless_vex(root: &Path, patch_server: &str, patched: &[u8],
             let lock = root.join("common/config/rush/pnpm-lock.yaml");
             let wired = std::fs::read(&lock).unwrap();
             strip_manifest(root);
+            assert!(
+                !root.join(".socket/vendor/redirect-state.json").exists(),
+                "v5 hosted mode must not write the redirect ledger"
+            );
             let out = run_vex(&bin, root, &online(false));
-            assert_eq!(out.code, Some(0), "rush, ledger kept: {out}");
-            assert_attested(out.doc(), PURL, UUID, Marker::Redirected, VULNS);
-
-            let ledger = root.join(".socket/vendor/redirect-state.json");
-            let ledger_bytes = std::fs::read(&ledger).unwrap();
-            strip_ledgers(root);
-            let out = run_vex(&bin, root, &online(false));
-            assert_eq!(out.code, Some(0), "rush, ledgers deleted: {out}");
+            assert_eq!(out.code, Some(0), "rush, lock + API: {out}");
             assert_attested(out.doc(), PURL, UUID, Marker::Redirected, VULNS);
             assert!(api.view_requests(UUID) >= 1, "{:?}", api.requests());
 
@@ -387,12 +384,10 @@ fn assert_rush_manifestless_vex(root: &Path, patch_server: &str, patched: &[u8],
             assert_not_attested(&out.envelope, PURL, "record_unavailable");
             assert_eq!(api.request_count(), seen, "--offline hit the API");
 
-            std::fs::write(&ledger, &ledger_bytes).unwrap();
             std::fs::write(&lock, pristine).unwrap();
             for no_verify in [false, true] {
                 let out = run_vex(&bin, root, &online(no_verify));
                 assert_ne!(out.code, Some(0), "rush, reverted: {out}");
-                assert_not_attested(&out.envelope, PURL, "redirect_unwired");
                 assert_absent(out.doc.as_ref(), PURL);
             }
             std::fs::write(&lock, &wired).unwrap();
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_vlt_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_vlt_build.rs
index f3b6e5b0..55a4708a 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_vlt_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_vlt_build.rs
@@ -181,7 +181,7 @@ async fn vlt_pinned_matrix_hosted_rollback_byte_exact() {
     assert_eq!(state(&fx.proj, fx.t()), State::Patched);
     let ids = fx.store_ids(fx.t());
     let snap = fx.snapshot(&fx.proj, &ids);
-    let out = rollback(&fx.proj, &[]);
+    let out = fx.rollback(&[]);
     assert_eq!(out.code, 0, "{out}");
     let doc = out.json();
     assert_eq!(
@@ -189,7 +189,10 @@ async fn vlt_pinned_matrix_hosted_rollback_byte_exact() {
         String::from_utf8_lossy(&fx.lock_before),
         "rollback restores vlt-lock.json byte-for-byte"
     );
-    assert!(fx.ledger().is_none(), "the ledger is gone");
+    assert!(
+        fx.ledger().is_none(),
+        "no hosted ledger is ever written (v5)"
+    );
     fx.assert_advisory(&doc, &advisory_rolled_back(1));
     for id in &ids {
         assert!(!store_entry(&fx.proj, id).exists(), "{id} healed");
@@ -201,7 +204,8 @@ async fn vlt_pinned_matrix_hosted_rollback_byte_exact() {
 }
 
 /// A second scan of an already-patched, installed project changes
-/// nothing: the lock and ledger stay byte-identical and nothing is healed.
+/// nothing: the lock stays byte-identical, no ledger appears and nothing is
+/// healed.
 #[tokio::test(flavor = "multi_thread")]
 #[ignore = "real vlt: SOCKET_PATCH_VLT_E2E_JS"]
 async fn vlt_pinned_matrix_hosted_rerun_noop() {
@@ -213,11 +217,11 @@ async fn vlt_pinned_matrix_hosted_rerun_noop() {
     fx.vlt_ok(&fx.proj, &fx.leg.locked_install_args());
     assert_eq!(state(&fx.proj, fx.t()), State::Patched);
     let lock = lock_bytes(&fx.proj);
-    let ledger = fx.ledger();
+    assert!(fx.ledger().is_none(), "v5 hosted mode writes no ledger");
     let snap = fx.snapshot(&fx.proj, &[]);
     let doc = fx.scan(&[]);
     assert_eq!(lock_bytes(&fx.proj), lock, "rerun keeps the lock");
-    assert_eq!(fx.ledger(), ledger, "rerun keeps the ledger");
+    assert!(fx.ledger().is_none(), "the rerun writes no ledger either");
     fx.assert_advisory(&doc, &advisory_nothing_stale());
     snap.assert_same(&fx.snapshot(&fx.proj, &[]), "a healthy rerun");
     assert_eq!(state(&fx.proj, fx.t()), State::Patched);
@@ -461,7 +465,8 @@ async fn vlt_pinned_matrix_hosted_peer_workspace_instances() {
 /// From 1.0.8 vlt keys a root dependency with resolved peers by its peer
 /// context (`~peer.<16 hex>`), so `vlt install <peer>@<new>` re-keys the
 /// pinned node and carries the pin to the new DepID: a rescan leaves the
-/// ledger alone, and rollback restores the registry pin on the new DepID.
+/// lock alone (no ledger), and rollback restores the registry pin on the new
+/// DepID.
 #[tokio::test(flavor = "multi_thread")]
 #[ignore = "real vlt: SOCKET_PATCH_VLT_E2E_JS"]
 async fn vlt_pinned_matrix_hosted_peer_rekey_rollback() {
@@ -497,11 +502,10 @@ async fn vlt_pinned_matrix_hosted_peer_rekey_rollback() {
     assert_pinned(&fx.proj, &fx.svc, &t);
     assert_eq!(state(&fx.proj, &t), State::Patched);
     let lock = lock_bytes(&fx.proj);
-    let ledger = fx.ledger();
     fx.scan(&[]);
     assert_eq!(lock_bytes(&fx.proj), lock, "the rescan keeps the lock");
-    assert_eq!(fx.ledger(), ledger, "the rescan keeps the ledger");
-    let out = rollback(&fx.proj, &[]);
+    assert!(fx.ledger().is_none(), "v5 hosted mode writes no ledger");
+    let out = fx.rollback(&[]);
     assert_eq!(out.code, 0, "{out}");
     assert_not_pinned(&fx.proj, &t);
     fx.assert_advisory(&out.json(), &advisory_rolled_back(1));
@@ -633,23 +637,22 @@ async fn resave_install_rollback(name: &'static str, crlf: bool) {
     }
     if resave_drops_hosted_url(fx.leg.version()) {
         assert_url_dropped(&fx);
+        // The re-save kept the patched integrity but dropped the hosted
+        // URL: no lockfile pin is left for v5 rollback to discover (it keeps
+        // no ledger), so it finds no state and writes nothing; a re-scan
+        // re-pins the node and the rollback below restores it.
         let dropped = lock_bytes(&fx.proj);
-        let out = rollback(&fx.proj, &[]);
-        assert_eq!(out.code, 1, "{out}");
-        let failed = out.json()["hosted"]["failed"][0]["error"]
-            .as_str()
-            .unwrap_or_default()
-            .to_string();
-        assert!(
-            failed.contains("drifted from the recorded redirect")
-                && failed.contains("re-run `socket-patch scan --mode hosted` and then roll back"),
-            "{out}"
+        let out = fx.rollback(&[]);
+        assert_eq!(
+            (out.code, out.json()["error"].as_str()),
+            (1, Some("Manifest not found")),
+            "a URL-less node is no hosted pin: {out}"
         );
         assert_eq!(lock_bytes(&fx.proj), dropped, "drift: no write");
         fx.scan(&[]);
     }
     assert_pinned(&fx.proj, &fx.svc, fx.t());
-    let out = rollback(&fx.proj, &[]);
+    let out = fx.rollback(&[]);
     assert_eq!(out.code, 0, "{out}");
     assert_not_pinned(&fx.proj, fx.t());
     let lock = read_lock(&fx.proj);
@@ -678,8 +681,10 @@ async fn vlt_pinned_matrix_hosted_resave_crlf_rollback() {
     resave_install_rollback("resave_crlf_rollback", true).await;
 }
 
-/// scan → `vlt update` → rollback: already reverted, and the patched store
-/// copy the update left behind is invalidated (r-vlt L3).
+/// scan → `vlt update` → rollback. Through 1.0.7 the update keeps the pin:
+/// rollback restores it and invalidates the patched store copy (r-vlt L3).
+/// From 1.0.8 the update re-resolves from the registry: no pin is left, so
+/// the ledger-free v5 rollback finds nothing to do and writes nothing.
 #[tokio::test(flavor = "multi_thread")]
 #[ignore = "real vlt: SOCKET_PATCH_VLT_E2E_JS"]
 async fn vlt_pinned_matrix_hosted_resave_update_rollback() {
@@ -705,17 +710,25 @@ async fn vlt_pinned_matrix_hosted_resave_update_rollback() {
     let lock = lock_bytes(&fx.proj);
     let ids = fx.store_ids(fx.t());
     let snap = fx.snapshot(&fx.proj, &ids);
-    let out = rollback(&fx.proj, &[]);
-    assert_eq!(out.code, 0, "{out}");
+    let out = fx.rollback(&[]);
     if drops {
+        // The update already put the lock back on the registry: v5 keeps no
+        // ledger, so no hosted pin (and no heal target) is left to find.
+        assert_eq!(
+            (out.code, out.json()["error"].as_str()),
+            (1, Some("Manifest not found")),
+            "already reverted: nothing to roll back: {out}"
+        );
         assert_eq!(
             lock_bytes(&fx.proj),
             lock,
             "already reverted: no lock write"
         );
-    } else {
-        assert_not_pinned(&fx.proj, fx.t());
+        fx.leg.ran();
+        return;
     }
+    assert_eq!(out.code, 0, "{out}");
+    assert_not_pinned(&fx.proj, fx.t());
     fx.assert_advisory(&out.json(), &advisory_rolled_back(1));
     for id in &ids {
         assert!(!store_entry(&fx.proj, id).exists(), "{id} invalidated");
@@ -747,7 +760,7 @@ async fn vlt_pinned_matrix_hosted_crlf_lock() {
     let co = fx.checkout("fresh-crlf");
     fx.vlt_ok_profile(&co, &fx.leg.locked_install_args(), "fresh-crlf");
     assert_eq!(state(&co, fx.t()), State::Patched);
-    let out = rollback(&fx.proj, &[]);
+    let out = fx.rollback(&[]);
     assert_eq!(out.code, 0, "{out}");
     assert_eq!(
         lock_bytes(&fx.proj),
@@ -1166,16 +1179,20 @@ async fn vlt_pinned_matrix_hosted_idempotence() {
     let fx = Fixture::build(leg, Shape::left_pad()).await;
     get_hosted(&fx.proj, &fx.svc, UUID, &[]);
     let lock = lock_bytes(&fx.proj);
-    let ledger = fx.ledger();
+    assert!(fx.ledger().is_none(), "v5 hosted mode writes no ledger");
     get_hosted(&fx.proj, &fx.svc, UUID, &[]);
     assert_eq!(lock_bytes(&fx.proj), lock);
-    assert_eq!(fx.ledger(), ledger);
-    let out = rollback(&fx.proj, &[]);
+    assert!(fx.ledger().is_none());
+    let out = fx.rollback(&[]);
     assert_eq!(out.code, 0, "{out}");
-    assert_eq!(lock_bytes(&fx.proj), fx.lock_before);
+    assert_eq!(
+        String::from_utf8_lossy(&lock_bytes(&fx.proj)),
+        String::from_utf8_lossy(&fx.lock_before),
+        "rollback restores the registry lock byte-for-byte: {out}"
+    );
     assert!(fx.ledger().is_none());
     let files = package_files(&fx.proj);
-    let out = rollback(&fx.proj, &[]);
+    let out = fx.rollback(&[]);
     assert_eq!(
         (out.code, out.json()["error"].as_str()),
         (1, Some("Manifest not found")),
@@ -1222,9 +1239,11 @@ async fn vlt_pinned_matrix_hosted_manifestless_vex() {
     fx.leg.ran();
 }
 
-/// The TS twin's golden output for `basic` (the server's PR-flow lock and
-/// ledger) is reverted by SP `rollback`, and `vlt ci` then installs the
-/// registry bytes.
+/// The TS twin's golden output for `basic` (the server's PR-flow lock, its
+/// pin on `patch.socket.dev`) is restored by SP `rollback` to its upstream
+/// registry entry — byte-identical to the input — and `vlt ci` then
+/// installs the registry bytes. The pre-v5 ledger the server wrote beside it
+/// is never replayed, only retired.
 #[tokio::test(flavor = "multi_thread")]
 #[ignore = "real vlt: SOCKET_PATCH_VLT_E2E_JS"]
 async fn vlt_pinned_matrix_hosted_ts_written_lock() {
@@ -1273,12 +1292,21 @@ async fn vlt_pinned_matrix_hosted_ts_written_lock() {
         &proj.join(".socket/vendor/redirect-state.json"),
         serde_json::to_vec_pretty(&ledger).unwrap(),
     );
-    let out = rollback(&proj, &[]);
+    let out = rollback_upstream(&proj, &reg.url(), None, &[]);
     assert_eq!(out.code, 0, "{out}");
+    assert_eq!(
+        out.json()["hosted"]["reverted"],
+        json!(["pkg:npm/left-pad@1.3.0"]),
+        "{out}"
+    );
     assert_eq!(
         String::from_utf8_lossy(&lock_bytes(&proj)),
         input,
-        "SP reverts the TS-written lock to its input"
+        "SP restores the TS-written lock to its input"
+    );
+    assert!(
+        !proj.join(".socket/vendor/redirect-state.json").exists(),
+        "the pre-v5 ledger is retired once no hosted pin remains"
     );
     leg.vlt_ok(&proj, &["ci"]);
     let lp = reg.pkg(LP.0, LP.1);
@@ -1379,7 +1407,7 @@ async fn vlt_pinned_matrix_hosted_optional_dependency_heal() {
     }
     assert_eq!(lock_bytes(&fx.proj), before_ci, "ci keeps the lock");
     let snap = fx.snapshot(&fx.proj, &lp_ids);
-    let out = rollback(&fx.proj, &[]);
+    let out = fx.rollback(&[]);
     assert_eq!(out.code, 0, "{out}");
     snap.assert_same(
         &fx.snapshot(&fx.proj, &lp_ids),
@@ -1513,7 +1541,10 @@ async fn vlt_pinned_matrix_hosted_then_vendored_optional_takeover() {
             hidden_lock_exists(&proj),
             "{kind}: the warm tree has a hidden lock"
         );
-        let out = socket_api(&proj, &svc, &["scan", "--mode", "vendored"], &[]);
+        // The hosted pin sits on the mock patch service: name its origin so
+        // the takeover classifies it (v5 discovers hosted pins from the lock
+        // alone), and restore its upstream entry from the harness registry.
+        let out = vendored_over_hosted(&proj, &svc, &reg);
         assert_eq!(out.code, 0, "{kind}: {out}");
         let doc = out.json();
         let detail = event_reason(&doc, ADVISORY);
@@ -1568,6 +1599,36 @@ async fn vlt_pinned_matrix_hosted_then_vendored_optional_takeover() {
     leg.ran();
 }
 
+/// `scan --mode vendored` over a hosted pin on the mock patch service:
+/// `--patch-server-url` names its origin (v5 recognizes no other hosted
+/// host) and `SOCKET_NPM_REGISTRY` points the takeover's upstream restore
+/// at the harness registry.
+fn vendored_over_hosted(proj: &Path, svc: &PatchService, reg: &Registry) -> SocketOut {
+    let cwd = proj.to_str().unwrap().to_string();
+    let uri = svc.uri();
+    socket(
+        proj,
+        &[
+            "scan",
+            "--mode",
+            "vendored",
+            "--json",
+            "--yes",
+            "--cwd",
+            &cwd,
+            "--api-url",
+            &uri,
+            "--org",
+            ORG,
+            "--api-token",
+            "sktsec_placeholder_value_for_tests_api",
+            "--patch-server-url",
+            &uri,
+        ],
+        &[("SOCKET_NPM_REGISTRY", &reg.url())],
+    )
+}
+
 fn optional_only_kind(leg: &Leg) -> OptionalOnly {
     optional_only(leg.version())
 }
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_yarn_berry_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_yarn_berry_build.rs
index 440774db..0ffb717d 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_yarn_berry_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_yarn_berry_build.rs
@@ -5,8 +5,9 @@
 //! `scan --mode hosted` never lands patched bytes in the repo: it rewrites
 //! `yarn.lock` so the patched dependency resolves via
 //! `npm:<v>::__archiveUrl=<hosted-tgz>` with `checksum: 10c0/<hex>` (yarn's
-//! cache-zip sha512), and records the patch in the redirect ledger. This test
-//! proves every link against the REAL `corepack yarn@4.12.0`:
+//! cache-zip sha512); v5 keeps no redirect ledger — the lock pin is the
+//! whole hosted state. This test proves every link against the REAL
+//! `corepack yarn@4.12.0`:
 //!
 //!   1. `yarn install` of left-pad@1.3.0 (network for fixture setup only,
 //!      private global cache, node-modules linker).
@@ -17,8 +18,8 @@
 //!      (yarn recomputes the same zip checksum whether the locator is `file:`
 //!      or `::__archiveUrl=`, so `--check-cache` will accept it).
 //!   3. `scan --mode hosted --json --vex` (the real binary): yarn.lock now
-//!      pins the hosted `__archiveUrl` + the `10c0` checksum, the ledger
-//!      embeds the record, the in-run VEX is the `(redirected)` attestation.
+//!      pins the hosted `__archiveUrl` + the `10c0` checksum, NO ledger is
+//!      written, the in-run VEX is the `(redirected)` attestation.
 //!   4. FRESH-CHECKOUT PROOF: only package.json + yarn.lock + .yarnrc.yml +
 //!      .socket/ travel; `yarn install --immutable --check-cache` (offline
 //!      from the registry, `unsafeHttpWhitelist` for the wiremock host) MUST
@@ -522,7 +523,7 @@ async fn berry_hosted_project(
         assert_eq!(env["vex"]["format"], "openvex-0.2.0", "vex block: {env}");
         assert_eq!(
             env["vex"]["verified"], false,
-            "in-run redirect VEX is attested from the ledger, not hash-verified: {env}"
+            "in-run redirect VEX is attested from this run's fetched record, not hash-verified: {env}"
         );
         let vex_doc: serde_json::Value =
             serde_json::from_slice(&std::fs::read(proj.join("out.vex.json")).unwrap()).unwrap();
@@ -565,10 +566,10 @@ async fn berry_hosted_project(
          ({checksum_line:?}); got:\n{lock}"
     );
 
-    let ledger = std::fs::read_to_string(proj.join(".socket/vendor/redirect-state.json")).unwrap();
+    // v5: hosted mode writes no ledger — the yarn.lock pin is the state.
     assert!(
-        ledger.contains("\"records\"") && ledger.contains(GHSA),
-        "redirect ledger must embed the patch record + vulnerability: {ledger}"
+        !proj.join(".socket/vendor/redirect-state.json").exists(),
+        "hosted mode must not write the redirect ledger"
     );
 
     Some(BerryRedirectFixture {
@@ -606,7 +607,10 @@ fn fresh_checkout_yarn_install(fx: &BerryRedirectFixture) -> (PathBuf, Output) {
     // A fresh .yarnrc.yml: node-modules linker, no global cache, and the
     // wiremock host whitelisted for plain http (yarn refuses http otherwise).
     std::fs::write(fresh.join(".yarnrc.yml"), fresh_yarnrc(fx)).unwrap();
-    copy_dir_recursive(&fx.proj.join(".socket"), &fresh.join(".socket"));
+    // v5 hosted mode may leave no `.socket/` at all (no ledger, no manifest).
+    if fx.proj.join(".socket").is_dir() {
+        copy_dir_recursive(&fx.proj.join(".socket"), &fresh.join(".socket"));
+    }
     let fresh_global = fx.tmp.path().join("fresh-yarn-global");
     let ci = corepack(
         &fresh,
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_yarn_classic_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_yarn_classic_build.rs
index 97b2b1f0..511788da 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_yarn_classic_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_yarn_classic_build.rs
@@ -5,7 +5,8 @@
 //! `scan --mode hosted` never lands patched bytes in the repo: it rewrites the
 //! classic `yarn.lock` block to
 //! `resolved "<hosted-tgz-url>#<sha1>"` + a recomputed `integrity sha512-…`
-//! line, and records the patch in the redirect ledger. This test proves every
+//! line — and writes nothing else (v5: no redirect ledger; the lock IS the
+//! hosted state). This test proves every
 //! link against the REAL `corepack yarn@1.22.22` — the gap the 2026-07 strapi
 //! incident exposed: hosted wiring for a classic lock had never been
 //! install-proven with the installer that actually honors the v1 format
@@ -21,7 +22,7 @@
 //!      cache-zip `10c0` checksum).
 //!   3. `scan --mode hosted --json --vex` (the real binary) against a wiremock
 //!      Socket API: yarn.lock now pins the hosted URL + `#sha1` + recomputed
-//!      integrity, the ledger embeds the record, the in-run VEX is the
+//!      integrity, no ledger is written, the in-run VEX is the
 //!      `(redirected)` attestation.
 //!   4. FRESH-CHECKOUT PROOF: only package.json + yarn.lock + .socket/ travel;
 //!      `yarn install --frozen-lockfile` (empty private cache; the only dep
@@ -34,7 +35,7 @@
 //!
 //! Manifest-less VEX (the depscan / never-committed-manifest shape): once the
 //! fresh checkout has installed the hosted bytes, `ManifestlessVex` deletes
-//! `.socket/manifest.json`, then the redirect ledger, and proves the patch is
+//! `.socket/manifest.json` (and any ledger), and proves the patch is
 //! still attested `(redirected)` from the `yarn.lock` wiring alone (record
 //! from the patch API), is `record_unavailable` `--offline` with zero API
 //! requests, and is NOT attested once the lock is reverted to the registry
@@ -455,10 +456,9 @@ async fn classic_hosted_project(
         "the registry resolution must be gone from the rewired block:\n{lock}"
     );
 
-    let ledger = std::fs::read_to_string(proj.join(".socket/vendor/redirect-state.json")).unwrap();
     assert!(
-        ledger.contains("\"records\"") && ledger.contains(GHSA),
-        "redirect ledger must embed the patch record + vulnerability: {ledger}"
+        !proj.join(".socket/vendor/redirect-state.json").exists(),
+        "v5 hosted mode writes no redirect ledger — the lock is the hosted state"
     );
 
     Some(ClassicRedirectFixture {
@@ -479,7 +479,10 @@ fn fresh_checkout_yarn_install(fx: &ClassicRedirectFixture) -> (PathBuf, Output)
     std::fs::create_dir_all(&fresh).unwrap();
     std::fs::copy(fx.proj.join("package.json"), fresh.join("package.json")).unwrap();
     std::fs::copy(fx.proj.join("yarn.lock"), fresh.join("yarn.lock")).unwrap();
-    copy_dir_recursive(&fx.proj.join(".socket"), &fresh.join(".socket"));
+    // v5 hosted mode writes nothing under `.socket/`; carry it when present.
+    if fx.proj.join(".socket").is_dir() {
+        copy_dir_recursive(&fx.proj.join(".socket"), &fresh.join(".socket"));
+    }
     let fresh_cache = fx.tmp.path().join("fresh-yarn-cache");
     let ci = corepack(
         &fresh,
diff --git a/crates/socket-patch-cli/tests/e2e_vex_build/hatch.rs b/crates/socket-patch-cli/tests/e2e_vex_build/hatch.rs
index 095e3bc1..278cae19 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_build/hatch.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_build/hatch.rs
@@ -25,9 +25,10 @@
 //! 5. manifest-less VEX there (`vex_pypi_real_common::VexMatrix`, with
 //!    `VIRTUAL_ENV` naming Hatch's out-of-tree environment so the crawler
 //!    hashes the real install): manifest deleted, tampered install (hosted),
-//!    ledgers deleted, embedded `apply --vex` / `vendor --vex`, offline with
-//!    no ledger → `record_unavailable`, declaration reverted →
-//!    `redirect_unwired` / `vendor_unwired` (`--no-verify` too); plus the
+//!    ledgers deleted (v5 hosted writes none), embedded `apply --vex` /
+//!    `vendor --vex`, offline with no ledger → `record_unavailable`,
+//!    declaration reverted → `vendor_unwired` / hosted: nothing names the
+//!    patch (`--no-verify` too); plus the
 //!    manifest-less `scan --vex` re-run and, hosted, the not-installed
 //!    (pin) basis.
 //!
@@ -290,6 +291,12 @@ fn flow(flavor: Flavor, mode: Mode) {
         Flavor::HatchTomlEnv => "hatch.toml",
     };
     let wired = std::fs::read_to_string(project.join(wired_file)).unwrap();
+    assert!(
+        !project
+            .join(socket_patch_core::patch::redirect::REDIRECT_STATE_REL)
+            .exists(),
+        "{what}: v5 writes no redirect ledger"
+    );
     match mode {
         Mode::Hosted => assert!(
             wired.contains(&format!(
diff --git a/crates/socket-patch-cli/tests/e2e_vex_build/pdm.rs b/crates/socket-patch-cli/tests/e2e_vex_build/pdm.rs
index 28bcc959..4e79d00c 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_build/pdm.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_build/pdm.rs
@@ -18,13 +18,14 @@
 //!    from the mock patch server (hosted) or the committed wheel (vendored)
 //!    — and `import six` must see the patched bytes;
 //! 5. manifest-less VEX there (`vex_pypi_real_common::VexMatrix`): manifest
-//!    deleted (ledger offline + online), tampered install → `hash_mismatch`
+//!    deleted (vendored: vendor ledger offline + online; hosted: online —
+//!    v5 hosted writes no ledger), tampered install → `hash_mismatch`
 //!    (hosted), ledgers deleted (lockfile discovery + API), embedded
 //!    `apply --vex` / `vendor --vex`, `--offline` with no ledger →
 //!    `record_unavailable` with zero requests, and the lock reverted to the
-//!    registry (ledgers + artifacts kept) → `redirect_unwired` /
-//!    `vendor_unwired`, `--no-verify` included; plus a manifest-less
-//!    `scan --redirect|--vendor --vex` re-run.
+//!    registry (vendor ledger + artifacts kept) → `vendor_unwired` /
+//!    hosted: nothing names the patch, `--no-verify` included; plus a
+//!    manifest-less `scan --redirect|--vendor --vex` re-run.
 //!
 //! Releases whose lock format loses url/path identity (PDM 1.8 – 1.15 =
 //! 3.1, 2.0 – 2.7 = 4.0 – 4.2) must REFUSE both scans with the lock
@@ -417,6 +418,12 @@ fn flow(mode: Mode) {
     assert_attested(&doc, PURL, mode.uuid(), mode.marker(), VULNS);
     std::fs::remove_file(&vex_out).unwrap();
     let wired_lock = std::fs::read_to_string(project.join("pdm.lock")).unwrap();
+    assert!(
+        !project
+            .join(socket_patch_core::patch::redirect::REDIRECT_STATE_REL)
+            .exists(),
+        "{what}: v5 writes no redirect ledger"
+    );
     match mode {
         Mode::Hosted => assert!(
             wired_lock.contains(&api.artifact_url()),
diff --git a/crates/socket-patch-cli/tests/e2e_vex_build/poetry.rs b/crates/socket-patch-cli/tests/e2e_vex_build/poetry.rs
index 7549b0fe..bd6d2b4a 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_build/poetry.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_build/poetry.rs
@@ -5,8 +5,8 @@
 //!    (PyPI is used for fixture setup only);
 //! 2. OUR CLI produces the committed state against a wiremock patch service:
 //!    hosted = `scan --redirect --vex` on the lock-only checkout (the lock is
-//!    repointed at a patched wheel the mock serves, the redirect ledger is
-//!    written, the same-run VEX attests from the lock's sha256 pin); vendored
+//!    repointed at a patched wheel the mock serves — v5 writes NO redirect
+//!    ledger — the same-run VEX attests from the lock's sha256 pin); vendored
 //!    = `scan --vendor --vendor-source build --vex` over the pristine
 //!    install (the patched wheel is committed under
 //!    `.socket/vendor/pypi/<uuid>/`, the lock is rewired to it, and only the
@@ -19,19 +19,21 @@
 //! 4. manifest-less VEX over that installed checkout, with standalone
 //!    `socket-patch vex --json --output` against a separate records API:
 //!    - (1) `.socket/manifest.json` deleted → attested with the right
-//!      `(redirected)` / `(vendored)` marker and vulnerability ids, and also
-//!      offline from the committed ledger;
-//!    - (2) the ledgers deleted too → still attested, via lockfile discovery
-//!      and the API record (installed tree / committed wheel hash-verified);
-//!      embedded `apply --vex` (and vendored `vendor --vex`) agree;
+//!      `(redirected)` / `(vendored)` marker and vulnerability ids (vendored
+//!      also offline from the committed vendor ledger);
+//!    - (2) no ledgers → still attested, via lockfile discovery and the API
+//!      record (installed tree / committed wheel hash-verified); embedded
+//!      `apply --vex` (and vendored `vendor --vex`) agree;
 //!    - (3) `--offline` with no ledgers → `record_unavailable`, zero API
 //!      requests;
-//!    - (4) the lock reverted to the registry version with the ledgers and
-//!      artifacts kept → NOT attested (`redirect_unwired` /
-//!      `vendor_unwired`), under `--no-verify` too;
+//!    - (4) the lock reverted to the registry version (vendor ledger and
+//!      artifacts kept) → NOT attested: `vendor_unwired` for vendored,
+//!      nothing names the patch at all for hosted — under `--no-verify` too;
 //!
-//!    then the real `rollback` / `vendor --revert` in the original project
-//!    restores the pristine lock byte for byte.
+//!    then the real `rollback` (hosted: the upstream PyPI entry re-resolved
+//!    from the registry, pins discovered on the `--patch-server-url` origin)
+//!    / `vendor --revert` in the original project restores the pristine lock
+//!    byte for byte.
 //!
 //! Poetry selection: `SOCKET_PATCH_POETRY_BIN` (a Poetry executable, e.g.
 //! `<venv>/bin/poetry` of a pinned release) or `poetry` on `PATH`. With
@@ -632,16 +634,16 @@ fn manifestless_vex_matrix(
 ) {
     let label = format!("poetry {} {marker:?}", ctx.poetry.version);
     let api = PatchApi::start(vec![(uuid.into(), record_view(uuid, pristine, patched))]);
-    let unwired = match marker {
-        Marker::Redirected => "redirect_unwired",
-        _ => "vendor_unwired",
-    };
+    let hosted = marker == Marker::Redirected;
 
-    // (1) manifest deleted, ledger kept: offline from the ledger, online.
+    // (1) manifest deleted, ledger kept: offline from the vendor ledger,
+    // online. v5 hosted keeps no ledger: no local record to go offline from.
     strip_manifest(ctx.project);
-    let out = ctx.standalone(&api, true, &[]);
-    attested(&format!("{label} (1) ledger offline"), &out, uuid, marker);
-    api.assert_no_requests();
+    if !hosted {
+        let out = ctx.standalone(&api, true, &[]);
+        attested(&format!("{label} (1) ledger offline"), &out, uuid, marker);
+        api.assert_no_requests();
+    }
     let out = ctx.standalone(&api, false, &[]);
     attested(&format!("{label} (1) online"), &out, uuid, marker);
 
@@ -656,7 +658,11 @@ fn manifestless_vex_matrix(
             (p, bytes)
         })
         .collect();
-    assert!(!ledgers.is_empty(), "{label}: the writer left a ledger");
+    assert_eq!(
+        ledgers.is_empty(),
+        hosted,
+        "{label}: vendored leaves its vendor ledger, hosted (v5) none: {ledgers:?}"
+    );
     strip_ledgers(ctx.project);
     let before = api.view_requests(uuid);
     let out = ctx.standalone(&api, false, &[]);
@@ -700,20 +706,29 @@ fn manifestless_vex_matrix(
     for extra in [&[][..], &["--no-verify"][..]] {
         for offline in [true, false] {
             let out = ctx.standalone(&api, offline, extra);
-            omitted(
-                &format!("{label} (4) reverted offline={offline} {extra:?}"),
-                &out,
-                unwired,
-            );
+            let what = format!("{label} (4) reverted offline={offline} {extra:?}");
+            if hosted {
+                // No ledger and no wiring: nothing names the patch any more.
+                assert_eq!(out.code, Some(2), "{what}: {out}");
+                assert_eq!(
+                    out.envelope["error"]["code"], "manifest_not_found",
+                    "{what}: {out}"
+                );
+                assert_absent(out.doc.as_ref(), PURL);
+            } else {
+                omitted(&what, &out, "vendor_unwired");
+            }
         }
     }
-    let out = ctx.run(&api, VexVia::Apply, false, &["--vex-no-verify"]);
-    assert_eq!(out.code, Some(1), "{label} (4) apply --vex: {out}");
-    assert_eq!(
-        out.envelope["error"]["code"], "no_applicable_patches",
-        "{label} (4) apply --vex: {out}"
-    );
-    assert!(out.doc.is_none(), "{label} (4) apply --vex: {out}");
+    if !hosted {
+        let out = ctx.run(&api, VexVia::Apply, false, &["--vex-no-verify"]);
+        assert_eq!(out.code, Some(1), "{label} (4) apply --vex: {out}");
+        assert_eq!(
+            out.envelope["error"]["code"], "no_applicable_patches",
+            "{label} (4) apply --vex: {out}"
+        );
+        assert!(out.doc.is_none(), "{label} (4) apply --vex: {out}");
+    }
 }
 
 // ════════════════════════════════════════════════════════════════════════
@@ -859,14 +874,28 @@ fn poetry_hosted_fresh_install_then_manifestless_vex() {
     let out = ctx.standalone(&api, false, &[]);
     omitted("hosted pristine install", &out, "not_applied");
 
-    // The real rollback in the writer's project restores every byte.
-    let (code, env) = socket_patch(&project, &poetry, &service, &["rollback"]);
+    // The real rollback in the writer's project restores every byte: the
+    // pin is discovered from the lock on the mock's origin
+    // (`--patch-server-url`) and its upstream entry re-resolved from PyPI.
+    let uri = service.uri();
+    let (code, env) = socket_patch(
+        &project,
+        &poetry,
+        &service,
+        &["rollback", "--patch-server-url", &uri],
+    );
     assert_eq!(code, Some(0), "rollback: {env}");
+    assert_eq!(
+        env["hosted"]["reverted"],
+        json!([PURL]),
+        "rollback restores the hosted pin: {env}"
+    );
     assert_eq!(
         std::fs::read_to_string(project.join("poetry.lock")).unwrap(),
         pristine_lock,
         "rollback restores the pristine lock"
     );
+    assert!(!project.join(".socket/vendor/redirect-state.json").exists());
 }
 
 // ════════════════════════════════════════════════════════════════════════
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/bun.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/bun.rs
index 2bee5e29..67ffce61 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/bun.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/bun.rs
@@ -21,11 +21,15 @@
 //!   `(redirected)` / `(vendored)` marker; exit 0; `verified` events.
 //! * b) `--offline` with no local record → `record_unavailable`, exit 1,
 //!   and the mock records ZERO requests.
-//! * c) ledger present, manifest absent → attests offline from the ledger's
-//!   embedded record (ledgers written by the REAL CLI: `scan --mode hosted`
-//!   / `scan --mode vendored`, whose embedded `--vex` is asserted too).
-//! * d) lock reverted to the registry while ledger + artifact remain →
-//!   `redirect_unwired` / `vendor_unwired`, including under `--no-verify`.
+//! * c) vendored: ledger present, manifest absent → attests offline from
+//!   the ledger's embedded record (written by the REAL CLI: `scan --mode
+//!   vendored`, whose embedded `--vex` is asserted too). Hosted: the REAL
+//!   `scan --mode hosted` writes no ledger (v5), so offline the wired lock
+//!   is `record_unavailable` and online it attests from the API.
+//! * d) lock reverted to the registry: vendored, while ledger + artifact
+//!   remain → `vendor_unwired`, including under `--no-verify`; hosted →
+//!   nothing is discovered (the lock was the only hosted state); a PRE-v5
+//!   redirect ledger left behind → `redirect_unwired`.
 //! * e) tampered installed tree (hosted) / tampered artifact member
 //!   (vendored) → `hash_mismatch` / `vendor_hash_mismatch`.
 //! * f) spoofs: a uuid on a non-Socket host (and look-alike hosts), a
@@ -723,12 +727,13 @@ fn b_api_without_the_record_is_record_unavailable() {
 }
 
 // ──────────────────────────────────────────────────────────────────────
-// c) + d) + embedded: the ledgers written by the REAL CLI.
+// c) + d) + embedded: the state written by the REAL CLI.
 // ──────────────────────────────────────────────────────────────────────
 
 /// `scan --mode hosted --vex` on a lock-only checkout (nothing installed):
-/// the real engine rewires the lock to the mock server's hosted url, and
-/// the in-run VEX attests `(redirected)`. Returns the pre-scan lock bytes.
+/// the real engine rewires the lock to the mock server's hosted url, the
+/// in-run VEX attests `(redirected)` from this run's fetched records, and
+/// no ledger is written (v5). Returns the pre-scan lock bytes.
 fn scan_hosted(cwd: &Path, flavor: Flavor, api: &Api) -> Vec<u8> {
     write_lock(cwd, flavor, &Wiring::Registry);
     let registry_lock = std::fs::read(cwd.join(flavor.lock_file())).unwrap();
@@ -764,8 +769,8 @@ fn scan_hosted(cwd: &Path, flavor: Flavor, api: &Api) -> Vec<u8> {
         "{what}: the lock must be rewired"
     );
     assert!(
-        cwd.join(".socket/vendor/redirect-state.json").is_file(),
-        "{what}"
+        !cwd.join(".socket/vendor/redirect-state.json").exists(),
+        "{what}: v5 hosted mode writes no ledger"
     );
     assert!(!cwd.join(".socket/manifest.json").exists(), "{what}");
     registry_lock
@@ -830,7 +835,7 @@ fn drop_ledgers(cwd: &Path) {
 }
 
 #[test]
-fn c_d_hosted_ledger_from_real_scan_attests_offline_and_dies_with_the_lock() {
+fn c_d_hosted_real_scan_attests_online_only_and_dies_with_the_lock() {
     for flavor in FLAVORS {
         let what = format!("{flavor:?} hosted");
         let tmp = project();
@@ -841,49 +846,18 @@ fn c_d_hosted_ledger_from_real_scan_attests_offline_and_dies_with_the_lock() {
         let origin = api.uri();
         let psu = ["--patch-server-url", origin.as_str()];
 
-        // c) ledger present, manifest absent: offline, from the ledger.
+        // c) the scan left no local record (v5 keeps no hosted ledger):
+        // offline, the wired lock is `record_unavailable`.
         let (code, env) = vex(cwd, &[&["--offline"][..], &psu].concat());
-        assert_attested(cwd, code, &env, UUID, "hosted", &format!("{what} ledger"));
-
-        // The hosted url is on the operator's patch server, so without
-        // `--patch-server-url` it is not a discovered Socket reference.
-        // DELIBERATE (vex_sources' raw-text fallback, kept so staging
-        // servers keep working): an off-allowlist origin still proves the
-        // LEDGER claim live — but only a discovered pinned ref may attest
-        // from the lock, so with nothing installed the claim is
-        // `package_not_found`, never attested.
-        let (code, env) = vex(cwd, &["--offline"]);
-        assert_omitted(
-            cwd,
-            code,
-            &env,
-            "package_not_found",
-            &format!("{what} no psu"),
-        );
-        install(cwd, PATCHED);
-        let (code, env) = vex(cwd, &["--offline"]);
-        assert_attested(
-            cwd,
-            code,
-            &env,
-            UUID,
-            "hosted",
-            &format!("{what} no psu, installed"),
-        );
-        install(cwd, PRISTINE);
-        let (code, env) = vex(cwd, &["--offline"]);
         assert_omitted(
             cwd,
             code,
             &env,
-            "not_applied",
-            &format!("{what} no psu, pristine"),
+            "record_unavailable",
+            &format!("{what} offline"),
         );
-        std::fs::remove_dir_all(cwd.join("node_modules")).unwrap();
 
-        // a) no ledger either: the record comes from the API.
-        let saved = std::fs::read(cwd.join(".socket/vendor/redirect-state.json")).unwrap();
-        drop_ledgers(cwd);
+        // a) online: the record comes from the API.
         let (code, env) = vex_online(cwd, &api, &psu);
         assert_attested(
             cwd,
@@ -893,10 +867,19 @@ fn c_d_hosted_ledger_from_real_scan_attests_offline_and_dies_with_the_lock() {
             "hosted",
             &format!("{what} lock only"),
         );
-        std::fs::write(cwd.join(".socket/vendor/redirect-state.json"), &saved).unwrap();
 
-        // d) lock reverted to the registry, ledger left behind: never
-        // attested, not even under --no-verify, offline or online.
+        // The hosted url is on the operator's patch server, so without
+        // `--patch-server-url` it is not a Socket reference at all — and
+        // no ledger is left to vouch for it — installed or not.
+        let (code, env) = vex_online(cwd, &api, &[]);
+        assert_nothing_found(code, &env, &format!("{what} no psu"));
+        install(cwd, PATCHED);
+        let (code, env) = vex_online(cwd, &api, &[]);
+        assert_nothing_found(code, &env, &format!("{what} no psu, installed"));
+        std::fs::remove_dir_all(cwd.join("node_modules")).unwrap();
+
+        // d) lock reverted to the registry: no hosted state is left, so
+        // nothing is discovered — offline or online, --no-verify included.
         std::fs::write(cwd.join(flavor.lock_file()), &registry_lock).unwrap();
         for extra in [
             &["--offline"][..],
@@ -904,13 +887,7 @@ fn c_d_hosted_ledger_from_real_scan_attests_offline_and_dies_with_the_lock() {
             &[][..],
         ] {
             let (code, env) = vex_online(cwd, &api, &[extra, &psu].concat());
-            assert_omitted(
-                cwd,
-                code,
-                &env,
-                "redirect_unwired",
-                &format!("{what} reverted {extra:?}"),
-            );
+            assert_nothing_found(code, &env, &format!("{what} reverted {extra:?}"));
         }
     }
 }
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs
index b47c5cf8..67368f84 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/cargo.rs
@@ -1782,11 +1782,12 @@ fn embedded_scan_vex_attests_lockfile_wired_patches() {
     assert!(!out_path.exists(), "the stale document is removed");
 }
 
-/// Embedded `apply --vex` / `vendor --vex` on the manifest-less mixed
-/// project: neither command has anything of its own to do, but the
-/// requested document must still be produced (`status: noManifest` + a
-/// `vex` summary) — and offline, with no record anywhere, the requested VEX
-/// fails the command rather than exiting 0 without it.
+/// Embedded `apply --vex` on the manifest-less mixed project: the command
+/// has nothing of its own to do, but the requested document must still be
+/// produced (`status: noManifest` + a `vex` summary) — and offline, with no
+/// record anywhere, the requested VEX fails the command rather than exiting
+/// 0 without it. (`vendor` is not driven here: over the project's HOSTED
+/// pins it is the v5 eject flow, not a manifest-less no-op.)
 #[test]
 fn embedded_apply_and_vendor_vex_attest_lockfile_wired_patches_without_manifest() {
     let api = mixed_api();
@@ -1797,7 +1798,8 @@ fn embedded_apply_and_vendor_vex_attest_lockfile_wired_patches_without_manifest(
         .map(|f| fx.read(f))
         .collect();
     let out_path = fx.cwd.join("embedded.vex.json");
-    for command in ["apply", "vendor"] {
+    {
+        let command = "apply";
         let run = |extra: &[&str]| {
             let _ = std::fs::remove_file(&out_path);
             let mut args = vec![
@@ -1838,7 +1840,7 @@ fn embedded_apply_and_vendor_vex_attest_lockfile_wired_patches_without_manifest(
         );
         assert!(!out_path.exists(), "{command}");
     }
-    // Neither command touched the committed wiring.
+    // The command never touched the committed wiring.
     let after: Vec<String> = ["Cargo.toml", "Cargo.lock", ".cargo/config.toml"]
         .iter()
         .map(|f| fx.read(f))
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/common_selftest.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/common_selftest.rs
index cfdfa598..83a8de74 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/common_selftest.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/common_selftest.rs
@@ -102,7 +102,10 @@ fn run_vex_hosted_lockfile_only_offline_then_online() {
     assert_absent(out.doc.as_ref(), "pkg:npm/other@1.0.0");
     assert!(api.view_requests(UUID) >= 1, "{:?}", api.requests());
 
-    for via in [VexVia::Apply, VexVia::Vendor] {
+    // `apply --vex` treats the hosted checkout as manifest-less; `vendor`
+    // would EJECT it (v5), which `manifestless_embedded` covers.
+    {
+        let via = VexVia::Apply;
         std::fs::remove_file(p.join(DEFAULT_OUTPUT)).unwrap();
         let out = run_vex(&binary(), p, &VexRun::online(&api).via(via));
         assert_eq!(out.code, Some(0), "{via:?}: {out}");
@@ -117,6 +120,49 @@ fn run_vex_hosted_lockfile_only_offline_then_online() {
     }
 }
 
+/// A checkout wired by a PRE-v5 socket-patch still commits
+/// `.socket/vendor/redirect-state.json`. v5 never writes it, but reads it as
+/// an extra local record source: a hosted pin it describes (same purl and
+/// uuid) attests OFFLINE, with zero network, and the ledger is left
+/// byte-identical. A ledger record for another uuid is no record for this
+/// pin.
+#[test]
+fn committed_pre_v5_ledger_lets_a_hosted_pin_attest_offline() {
+    let tmp = tempfile::tempdir().unwrap();
+    let p = tmp.path();
+    let purl = write_hosted_npm_lock(p, "left-pad", "1.3.0", UUID);
+    write_legacy_redirect_ledger(p, &purl, &left_pad_view());
+    let ledger = p.join(LEGACY_REDIRECT_LEDGER);
+    let before = std::fs::read(&ledger).unwrap();
+    let api = PatchApi::empty();
+    for no_verify in [false, true] {
+        let run = VexRun {
+            offline: true,
+            no_verify,
+            ..VexRun::online(&api)
+        };
+        let out = run_vex(&binary(), p, &run);
+        assert_eq!(out.code, Some(0), "nv={no_verify}: {out}");
+        assert_attested(
+            out.doc(),
+            &purl,
+            UUID,
+            Marker::Redirected,
+            &[(GHSA, &[CVE])],
+        );
+    }
+    api.assert_no_requests();
+    assert_eq!(std::fs::read(&ledger).unwrap(), before, "vex never rewrites it");
+
+    let other = "0b0b0b0b-0b0b-4b0b-8b0b-0b0b0b0b0b0b";
+    let mut stale = left_pad_view();
+    stale["uuid"] = other.into();
+    write_legacy_redirect_ledger(p, &purl, &stale);
+    let out = run_vex(&binary(), p, &VexRun::offline());
+    assert_eq!(out.code, Some(1), "{out}");
+    assert_not_attested(&out.envelope, &purl, "record_unavailable");
+}
+
 /// With a token the CLI uses the org-scoped route, which the stand-in
 /// serves too.
 #[test]
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/gem.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/gem.rs
index b79513d0..f023f6e0 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/gem.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/gem.rs
@@ -445,7 +445,9 @@ fn vendored_spoofed_paths_are_not_references() {
 // ── embedded ──────────────────────────────────────────────────────────
 
 /// The embedded `apply --vex` / `vendor --vex` of a manifest-less checkout
-/// attest exactly what standalone `vex` does, in every era.
+/// attest exactly what standalone `vex` does, in every era. (`vendor` over a
+/// HOSTED checkout is the v5 eject flow, not a manifest-less no-op, so the
+/// hosted cells drive `apply` only.)
 #[test]
 fn embedded_vex_agrees_in_every_era() {
     for era in ERAS {
@@ -453,7 +455,12 @@ fn embedded_vex_agrees_in_every_era() {
             ("hosted", Marker::Redirected),
             ("vendored", Marker::Vendored),
         ] {
-            for via in [VexVia::Apply, VexVia::Vendor] {
+            let vias: &[VexVia] = if mode == "hosted" {
+                &[VexVia::Apply]
+            } else {
+                &[VexVia::Apply, VexVia::Vendor]
+            };
+            for &via in vias {
                 let api = api();
                 let tmp = tempfile::tempdir().unwrap();
                 let dir = tmp.path();
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/manifestless_embedded.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/manifestless_embedded.rs
index 7d46cd42..49ace8ce 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/manifestless_embedded.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/manifestless_embedded.rs
@@ -18,6 +18,11 @@
 //! - `--dry-run` => no generation, no document, no network;
 //! - `apply --check` => no generation, the output path untouched, no
 //!   network (read-only, like the with-manifest `--check`).
+//!
+//! `vendor` on a checkout whose lockfiles carry HOSTED pins is not a
+//! no-manifest no-op any more: it EJECTS the pins into `.socket/vendor/`
+//! (v5 WS2), so the hosted-wiring cells below drive `apply` only, and
+//! [`vendor_on_a_hosted_checkout_takes_the_eject_path`] pins the switch.
 
 use crate::vex_e2e_common;
 
@@ -28,6 +33,9 @@ const GHSA: &str = "GHSA-mfls-embd-0001";
 const CVE: &str = "CVE-2026-5151";
 
 const EMBEDDED: [VexVia; 2] = [VexVia::Apply, VexVia::Vendor];
+/// The embedded commands that treat a HOSTED-wired checkout as manifest-less
+/// (`vendor` ejects it instead).
+const EMBEDDED_OVER_HOSTED: [VexVia; 1] = [VexVia::Apply];
 
 fn api() -> PatchApi {
     PatchApi::start(vec![(
@@ -56,7 +64,7 @@ fn write_stale_doc(project: &std::path::Path) {
 
 #[test]
 fn manifest_less_embedded_vex_attests_hosted_wiring() {
-    for via in EMBEDDED {
+    for via in EMBEDDED_OVER_HOSTED {
         let tmp = tempfile::tempdir().unwrap();
         let p = tmp.path();
         let purl = write_hosted_npm_lock(p, "left-pad", "1.3.0", UUID);
@@ -156,7 +164,7 @@ fn nothing_discovered_still_reports_discovery_diagnostics() {
 
 #[test]
 fn vex_failure_without_manifest_fails_the_command() {
-    for via in EMBEDDED {
+    for via in EMBEDDED_OVER_HOSTED {
         let tmp = tempfile::tempdir().unwrap();
         let p = tmp.path();
         write_hosted_npm_lock(p, "left-pad", "1.3.0", UUID);
@@ -235,7 +243,11 @@ fn dry_run_skips_manifest_less_vex() {
     for via in EMBEDDED {
         let tmp = tempfile::tempdir().unwrap();
         let p = tmp.path();
-        write_hosted_npm_lock(p, "left-pad", "1.3.0", UUID);
+        // `vendor` over hosted pins is the eject flow; its no-manifest
+        // dry-run skip is pinned on a checkout without them.
+        if via == VexVia::Apply {
+            write_hosted_npm_lock(p, "left-pad", "1.3.0", UUID);
+        }
         let api = api();
         let run = VexRun {
             dry_run: true,
@@ -268,3 +280,49 @@ fn dry_run_skips_manifest_less_vex() {
         api.assert_no_requests();
     }
 }
+
+/// v5 WS2: `vendor` with no manifest and HOSTED pins in the lockfiles is the
+/// eject flow, not the calm no-manifest no-op — it fetches each pin's patch
+/// record from the API. With the API not serving the patch the purl fails
+/// `patch_fetch_failed`, the command exits 1, no document is written, and
+/// the hosted lock is left as it was.
+#[test]
+fn vendor_on_a_hosted_checkout_takes_the_eject_path() {
+    let tmp = tempfile::tempdir().unwrap();
+    let p = tmp.path();
+    let purl = write_hosted_npm_lock(p, "left-pad", "1.3.0", UUID);
+    let lock_before = std::fs::read(p.join("package-lock.json")).unwrap();
+    let api = PatchApi::empty();
+    let out = run_vex(&binary(), p, &VexRun::online(&api).via(VexVia::Vendor));
+    assert_eq!(out.code, Some(1), "{out}");
+    assert_ne!(out.envelope["status"], "noManifest", "{out}");
+    let failed = out.envelope["events"]
+        .as_array()
+        .into_iter()
+        .flatten()
+        .find(|e| e["action"] == "failed" && e["purl"] == purl.as_str())
+        .unwrap_or_else(|| panic!("the hosted pin must be an eject candidate: {out}"));
+    assert_eq!(failed["errorCode"], "patch_fetch_failed", "{out}");
+    assert!(api.view_requests(UUID) >= 1, "{:?}", api.requests());
+    assert!(out.envelope.get("vex").is_none(), "{out}");
+    assert!(out.doc.is_none(), "{out}");
+    assert_eq!(
+        std::fs::read(p.join("package-lock.json")).unwrap(),
+        lock_before,
+        "a failed eject leaves the hosted lock alone"
+    );
+    assert_no_hosted_ledger(p, "vendor eject");
+
+    // Human mode names the eject.
+    let human = VexRun {
+        human: true,
+        ..VexRun::online(&api).via(VexVia::Vendor)
+    };
+    let out = run_vex(&binary(), p, &human);
+    assert_eq!(out.code, Some(1), "{out}");
+    assert!(
+        out.stdout
+            .contains("Ejecting 1 hosted package into .socket/vendor/..."),
+        "{out}"
+    );
+}
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/maven.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/maven.rs
index 4683f019..96947ce6 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/maven.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/maven.rs
@@ -1190,8 +1190,8 @@ fn vendored_spoofed_locations_never_attest() {
 // ══════════════════════════════════════════════════════════════════════════
 // EMBEDDED — the REAL writers lay the wiring down (`vendor --vex`,
 // `scan --mode hosted --vex`, `apply --vex`); then the manifest and the
-// ledgers are deleted and the standalone `vex` must re-attest from the
-// project files alone.
+// vendor ledger are deleted (v5 hosted mode writes no ledger at all) and
+// the standalone `vex` must re-attest from the project files alone.
 // ══════════════════════════════════════════════════════════════════════════
 
 const ORG: &str = "test-org";
@@ -1310,6 +1310,43 @@ fn standalone_after_writer(
     }
 }
 
+/// After the real HOSTED writer ran: v5 hosted mode left NO ledger, so
+/// the lock pin is the only hosted state — offline there is no local
+/// record (`record_unavailable`, zero requests), online the API's record
+/// attests, and with the wiring reverted nothing is discovered at all.
+fn standalone_after_hosted_writer(
+    fx: &Fx,
+    uuid: &str,
+    record_purl: &str,
+    api_view: Value,
+    revert: &dyn Fn(&Fx),
+) {
+    fx.rm(".socket/manifest.json");
+    fx.rm(".socket/blobs");
+    assert!(
+        !fx.cwd.join(".socket/vendor/redirect-state.json").exists(),
+        "v5 hosted mode writes no ledger"
+    );
+    let api = Api::serve(vec![(uuid, api_view)]);
+    let (code, env) = fx.vex(&["--offline", "--proxy-url", &api.uri()]);
+    assert_omitted(
+        code,
+        &env,
+        record_purl,
+        "record_unavailable",
+        "hosted writer, offline",
+    );
+    assert_eq!(api.requests(), 0, "--offline never asks the API");
+    let (code, env) = fx.vex(&["--proxy-url", &api.uri()]);
+    assert_attested(fx, code, &env, uuid, record_purl, "redirected");
+
+    revert(fx);
+    for extra in [&["--offline"][..], &["--offline", "--no-verify"][..]] {
+        let (code, env) = fx.vex(extra);
+        assert_nothing_to_attest(code, &env, "hosted writer, reverted");
+    }
+}
+
 /// A plausible upstream pom for the cached artifact (the maven vendor
 /// backend copies it verbatim next to the rebuilt jar).
 const COMMONS_TEXT_POM: &str = "<project xmlns=\"http://maven.apache.org/POM/4.0.0\">\n  \
@@ -1475,8 +1512,9 @@ fn scan_hosted_vex(fx: &Fx, api: &Api) -> (Option<i32>, Value, String) {
 
 /// `scan --mode hosted --vex` against a project whose pristine base
 /// version is cached: the real rewriter pins `-socket.<hex8>`, the in-run
-/// VEX attests; the pristine base is never the consumed copy, so the
-/// standalone vex keeps attesting from the pin with no manifest/ledger.
+/// VEX attests and no ledger is written; the pristine base is never the
+/// consumed copy, so the standalone vex keeps attesting from the pin (with
+/// the API's record) with no manifest/ledger.
 #[test]
 fn maven_scan_hosted_wiring_reattests_without_manifest_or_ledger() {
     let golden = "maven/pom/basic";
@@ -1496,15 +1534,12 @@ fn maven_scan_hosted_wiring_reattests_without_manifest_or_ledger() {
     );
     let reverted =
         std::fs::read_to_string(fixture_dir(&format!("{golden}/input/pom.xml"))).unwrap();
-    standalone_after_writer(
+    standalone_after_hosted_writer(
         &fx,
-        ".socket/vendor/redirect-state.json",
         MVN_HOSTED_UUID,
         MVN_PURL,
-        "redirected",
         mvn_hosted_view(),
         &|fx| fx.put("pom.xml", &reverted),
-        "redirect_unwired",
     );
 }
 
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/npm.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/npm.rs
index 3fdfe8b1..f6334087 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/npm.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/npm.rs
@@ -494,7 +494,10 @@ fn json_envelopes_carry_why_a_patch_was_gated() {
         "{out}"
     );
 
-    for via in [VexVia::Apply, VexVia::Vendor] {
+    // Embedded: `apply --vex` (on this HOSTED checkout `vendor` is the v5
+    // eject flow, not a manifest-less VEX run).
+    {
+        let via = VexVia::Apply;
         let out = run_vex(&binary(), p, &unreachable.clone().via(via));
         assert_eq!(out.code, Some(1), "{via:?}:\n{out}");
         let warnings = warnings_of(&out.envelope);
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/nuget.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/nuget.rs
index 007fcd40..3973a9e7 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/nuget.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/nuget.rs
@@ -1153,6 +1153,44 @@ fn standalone_after_writer(
     }
 }
 
+/// After the real HOSTED writer ran: v5 hosted mode left NO ledger, so
+/// the pin (lock + nuget.config) is the only hosted state — offline there
+/// is no local record (`record_unavailable`, zero requests), online the
+/// API's record attests, and with the wiring reverted nothing is
+/// discovered at all.
+fn standalone_after_hosted_writer(
+    fx: &Fx,
+    uuid: &str,
+    record_purl: &str,
+    api_view: Value,
+    revert: &dyn Fn(&Fx),
+) {
+    fx.rm(".socket/manifest.json");
+    fx.rm(".socket/blobs");
+    assert!(
+        !fx.cwd.join(".socket/vendor/redirect-state.json").exists(),
+        "v5 hosted mode writes no ledger"
+    );
+    let api = Api::serve(vec![(uuid, api_view)]);
+    let (code, env) = fx.vex(&["--offline", "--proxy-url", &api.uri()]);
+    assert_omitted(
+        code,
+        &env,
+        record_purl,
+        "record_unavailable",
+        "hosted writer, offline",
+    );
+    assert_eq!(api.requests(), 0, "--offline never asks the API");
+    let (code, env) = fx.vex(&["--proxy-url", &api.uri()]);
+    assert_attested(fx, code, &env, uuid, record_purl, "redirected");
+
+    revert(fx);
+    for extra in [&["--offline"][..], &["--offline", "--no-verify"][..]] {
+        let (code, env) = fx.vex(extra);
+        assert_nothing_to_attest(code, &env, "hosted writer, reverted");
+    }
+}
+
 #[test]
 fn nuget_vendor_command_wiring_reattests_without_manifest_or_ledger() {
     let fx = Fx::new();
@@ -1359,9 +1397,16 @@ fn nuget_scan_hosted_wiring_reattests_without_manifest_or_ledger() {
         "{config}"
     );
 
-    // The pristine shared-folder copy is installed evidence: omitted.
+    assert!(
+        !fx.cwd.join(".socket/vendor/redirect-state.json").exists(),
+        "v5 hosted mode writes no ledger"
+    );
+
+    // The pristine shared-folder copy is installed evidence: omitted (the
+    // record comes from the API — the scan left no local one).
     fx.rm(".socket/manifest.json");
-    let (code, env) = fx.vex(&["--offline"]);
+    let view_api = Api::serve(vec![(NUGET_HOSTED_UUID, nuget_hosted_view())]);
+    let (code, env) = fx.vex(&["--proxy-url", &view_api.uri()]);
     assert_omitted(
         code,
         &env,
@@ -1372,19 +1417,16 @@ fn nuget_scan_hosted_wiring_reattests_without_manifest_or_ledger() {
     // Cleared (a fresh CI restore would fetch the patched nupkg): the pin.
     std::fs::remove_dir_all(fx.nuget().join("newtonsoft.json")).unwrap();
     let inputs = copy_golden_to_vec(&format!("{golden}/input"));
-    standalone_after_writer(
+    standalone_after_hosted_writer(
         &fx,
-        ".socket/vendor/redirect-state.json",
         NUGET_HOSTED_UUID,
         NUGET_PURL,
-        "redirected",
         nuget_hosted_view(),
         &|fx| {
             for (file, bytes) in &inputs {
                 fx.put(file, bytes);
             }
         },
-        "redirect_unwired",
     );
 }
 
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/pdm.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/pdm.rs
index c2b1300e..f2678626 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/pdm.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/pdm.rs
@@ -19,8 +19,10 @@
 //!
 //! The cells (see `vex_pdm_hatch_common`) run for every (release, mode):
 //! a) wiring-only checkout attests online; b) `record_unavailable` offline /
-//! unreachable / 404 with zero requests offline; c) ledger without manifest
-//! attests offline; d) reverted lock is unwired even with `--no-verify`;
+//! unreachable / 404 with zero requests offline; c) the vendor ledger
+//! without manifest attests offline (v5 hosted keeps no ledger: offline it
+//! is `record_unavailable`, online it attests); d) reverted lock is unwired
+//! even with `--no-verify` (hosted: nothing is discovered);
 //! e) tampered installed tree / wheel member omitted; f) foreign host,
 //! root-escaping path and mismatched records never attest; g) hosted
 //! installed-tree states (not installed → pin, patched → hashed, pristine →
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/pip.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/pip.rs
index f730b5ce..efef9f43 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/pip.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/pip.rs
@@ -267,9 +267,8 @@ fn sibling_requirements_file_the_root_never_includes_is_not_read() {
 }
 
 /// A wired line commented out (`# vexdemo @ …` / `# ./.socket/vendor/…`)
-/// is not something pip installs: not wiring, and with the ledger kept the
-/// ledger claim is dead (`redirect_unwired` / `vendor_unwired`), even
-/// under `--no-verify`.
+/// is not something pip installs: not wiring, and with the vendor ledger
+/// kept its claim is dead (`vendor_unwired`), even under `--no-verify`.
 #[test]
 fn commented_out_wiring_is_not_a_reference() {
     let root = &flavors()[0];
@@ -280,7 +279,7 @@ fn commented_out_wiring_is_not_a_reference() {
             .map(|l| format!("# {l}\n"))
             .collect::<String>()
             + "vexdemo==1.2.3\n";
-        for keep in [NOTHING, LEDGERS_ONLY] {
+        for &keep in mode.ledger_keeps() {
             let what = format!("{} commented ledgers={}", wired.what(), keep.ledgers);
             let (_tmp, cwd) = fresh();
             wired.restore(&cwd, keep);
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/pipenv.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/pipenv.rs
index e6325110..f076a160 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/pipenv.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/pipenv.rs
@@ -13,9 +13,10 @@
 //!
 //! Every cell of `vex_pipenv_pip_common` runs per (flavor, mode): wiring
 //! alone attests online; `--offline` / unreachable / 404 / 403 with no
-//! local record is `record_unavailable` (zero requests offline); ledger-only
-//! attests offline; a reverted lock is `redirect_unwired` /
-//! `vendor_unwired` under `--no-verify` too; tampered installed tree /
+//! local record is `record_unavailable` (zero requests offline); the vendor
+//! ledger alone attests offline (v5 hosted keeps no ledger: offline it is
+//! `record_unavailable`); a reverted lock is `vendor_unwired` under
+//! `--no-verify` too (hosted: nothing is discovered); tampered installed tree /
 //! wheel member is omitted; foreign-host, root-escaping and
 //! record-mismatched references never attest; hosted not-installed attests
 //! from the pin, a pristine install is `not_applied`, pinless needs an
@@ -25,9 +26,8 @@
 //!
 //! Pipenv-specific cells below: a relock that re-serializes AROUND our
 //! reference (Pipenv 2023+ restores `version` / `index` / registry
-//! `hashes`) still attests unless the restored version disagrees, in which
-//! case even the ledger claim is dead; an entry carrying both `file` and
-//! `path` is ambiguous; and the vendored backend refusing a legacy installer
+//! `hashes`) still attests unless the restored version disagrees; an entry
+//! carrying both `file` and `path` is ambiguous; and the vendored backend refusing a legacy installer
 //! leaves nothing to attest.
 //!
 //! The real-Pipenv counterpart (every calendar major 2022..2026, real
@@ -213,9 +213,8 @@ fn edit_entry(lock: &str, edit: impl Fn(&mut serde_json::Map<String, Value>)) ->
 /// but restores the registry `version` / `index` / `hashes` around it
 /// (`reserialized_around_reference`). Pipenv still installs the reference,
 /// so it is still wired: attested with no ledger. When the restored
-/// `version` names ANOTHER release the entry is diagnosed, and the stale
-/// ledger claim dies with it (discover rule 11: a recognized-but-rejected
-/// mention is authoritative), `--no-verify` included.
+/// `version` names ANOTHER release the entry is diagnosed and never
+/// attested, `--no-verify` included.
 #[test]
 fn relock_reserialized_around_the_reference_attests_unless_the_version_disagrees() {
     for flavor in flavors().into_iter().filter(|f| f.pipenv_major == "2026") {
@@ -246,34 +245,26 @@ fn relock_reserialized_around_the_reference_attests_unless_the_version_disagrees
             &format!("{what} hybrid"),
         );
 
-        for keep in [NOTHING, LEDGERS_ONLY] {
-            let (_tmp, cwd) = fresh();
-            wired.restore(&cwd, keep);
-            put(&cwd, "Pipfile.lock", hybrid("9.9.9").as_bytes());
-            for no_verify in [false, true] {
-                let run = VexRun {
-                    no_verify,
-                    offline: keep.ledgers,
-                    ..vex_run(Some(&api))
-                };
-                let out = vex(&cwd, &run);
-                let what = format!(
-                    "{what} hybrid@9.9.9 ledgers={} no_verify={no_verify}",
-                    keep.ledgers
-                );
-                assert_ne!(out.code, Some(0), "{what}: {out}");
-                assert_no_statement(&out, &what);
-                if keep.ledgers {
-                    assert_omitted(&out, "redirect_unwired", &what);
-                }
-            }
+        let (_tmp, cwd) = fresh();
+        wired.restore(&cwd, NOTHING);
+        put(&cwd, "Pipfile.lock", hybrid("9.9.9").as_bytes());
+        for no_verify in [false, true] {
+            let run = VexRun {
+                no_verify,
+                ..vex_run(Some(&api))
+            };
+            let out = vex(&cwd, &run);
+            let what = format!("{what} hybrid@9.9.9 no_verify={no_verify}");
+            assert_ne!(out.code, Some(0), "{what}: {out}");
+            assert_no_statement(&out, &what);
         }
     }
 }
 
 /// An entry carrying BOTH `file` and `path` (neither writer produces one)
 /// is ambiguous — which one Pipenv reads depends on its release — so it is
-/// diagnosed, never attested, and it kills the stale ledger claim.
+/// diagnosed, never attested, and (vendored) it kills the stale ledger
+/// claim.
 #[test]
 fn entry_with_both_file_and_path_is_ambiguous() {
     let flavor = &flavors()[0];
@@ -289,7 +280,7 @@ fn entry_with_both_file_and_path_is_ambiguous() {
             let value = entry[have].clone();
             entry.insert(add.into(), value);
         });
-        for keep in [NOTHING, LEDGERS_ONLY] {
+        for &keep in mode.ledger_keeps() {
             let what = format!("{} both keys ledgers={}", wired.what(), keep.ledgers);
             let (_tmp, cwd) = fresh();
             wired.restore(&cwd, keep);
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/poetry.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/poetry.rs
index 30cefb67..8601113e 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/poetry.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/poetry.rs
@@ -1014,10 +1014,17 @@ fn every_hosted_pin_spelling_attests_and_a_pinless_entry_needs_an_install() {
         let api = api_for(Mode::Hosted);
         let files_line = format!("files = [{{ file = \"{WHEEL}\", hash = \"sha256:{sha}\" }}]");
         let metadata_entry = format!("{PKG} = [{{ file = \"{WHEEL}\", hash = \"sha256:{sha}\" }}]");
+        // A `[metadata.files]` entry that listed files before the rewrite
+        // keeps Poetry's one-file-per-line layout (rollback restores the full
+        // list from it; an inline entry means the original was `[]`).
+        let metadata_block = format!(
+            "{PKG} = [\n    {{file = \"{WHEEL}\", hash = \"sha256:{sha}\"}},\n]"
+        );
         let fragment = format!("#sha256={sha}&");
         let spellings: Vec<(&str, &str)> = [
             ("package files", files_line.as_str()),
             ("metadata.files", metadata_entry.as_str()),
+            ("metadata.files block", metadata_block.as_str()),
             ("url fragment", fragment.as_str()),
         ]
         .into_iter()
@@ -1422,12 +1429,13 @@ fn embedded(p: &Proj, api: &PatchApi, via: VexVia, offline: bool, extra: &[&str]
 }
 
 /// `scan --redirect --vex` on a lock-only checkout (nothing installed)
-/// writes the hosted wiring + the redirect ledger and attests in-run; then,
-/// with no manifest:
-///   c. the ledger alone attests offline (standalone and `apply --vex`);
-///   b. without the ledger, offline is `record_unavailable` with no request;
-///   a. without the ledger, online attests (standalone and `apply --vex`);
-///   d. `rollback` unwinds the wiring; with the ledger put back it is dead.
+/// writes the hosted wiring — and NO ledger (v5) — and attests in-run from
+/// this run's records; then, with no manifest:
+///   b. offline is `record_unavailable` with no request (standalone and
+///      `apply --vex`): the lock is the only hosted state, it carries no
+///      record;
+///   a. online attests (standalone and `apply --vex`);
+///   d. the wiring reverted to the native files: nothing is discovered.
 ///
 /// Both a production `patch.socket.dev` artifact url (nothing is fetched
 /// from it) and a self-hosted patch server (the mock's own origin, which
@@ -1472,7 +1480,10 @@ fn scan_redirect_wiring_attests_without_manifest_or_ledger() {
                 "{what}: lock not wired:\n{lock}"
             );
             assert!(lock.contains("type = \"url\""), "{what}:\n{lock}");
-            assert!(p.exists(".socket/vendor/redirect-state.json"), "{what}");
+            assert!(
+                !p.exists(".socket/vendor/redirect-state.json"),
+                "{what}: v5 hosted mode writes no ledger"
+            );
             assert!(
                 !p.exists(".socket/manifest.json"),
                 "{what}: hosted writes no manifest"
@@ -1487,19 +1498,7 @@ fn scan_redirect_wiring_attests_without_manifest_or_ledger() {
             let origin: Vec<&str> = origin_flag.iter().map(String::as_str).collect();
             let api = api_for(Mode::Hosted);
 
-            // c. the writer's ledger attests offline.
-            let out = vex(&p, &api, true, &origin);
-            assert_attested(&format!("{what} ledger"), &out, Mode::Hosted, HOSTED_UUID);
-            let out = embedded(&p, &api, VexVia::Apply, true, &origin);
-            assert_eq!(out.code, Some(0), "{what} apply --vex ledger: {out}");
-            assert_eq!(out.envelope["status"], "noManifest", "{what}: {out}");
-            assert_eq!(out.envelope["vex"]["statements"], 1, "{what}: {out}");
-            api.assert_no_requests();
-
-            // b / a. no ledger.
-            let ledger_path = p.root.join(".socket/vendor/redirect-state.json");
-            let ledger = std::fs::read(&ledger_path).unwrap();
-            strip_ledgers(&p);
+            // b / a. the wiring alone (the writer left no ledger).
             let out = vex(&p, &api, true, &origin);
             assert_omitted(
                 &format!("{what} no ledger offline"),
@@ -1519,6 +1518,8 @@ fn scan_redirect_wiring_attests_without_manifest_or_ledger() {
             );
             let out = embedded(&p, &api, VexVia::Apply, false, &origin);
             assert_eq!(out.code, Some(0), "{what} apply --vex online: {out}");
+            assert_eq!(out.envelope["status"], "noManifest", "{what}: {out}");
+            assert_eq!(out.envelope["vex"]["statements"], 1, "{what}: {out}");
             vex_e2e_common::assert_attested(
                 out.doc(),
                 &purl(),
@@ -1528,32 +1529,21 @@ fn scan_redirect_wiring_attests_without_manifest_or_ledger() {
             );
             assert_no_manifest_written(&p, &what);
 
-            // d. the real revert, then the ledger restored behind its back.
-            std::fs::write(&ledger_path, &ledger).unwrap();
-            let (code, env) = run_authed(&p, &scan, &["rollback"]);
-            assert_eq!(code, Some(0), "{what} rollback: {env}");
-            for (name, text) in native_files(release) {
-                assert_eq!(p.read(name), text, "{what}: rollback restores {name}");
-            }
-            // A fully reverted project keeps no `.socket/` at all: recreate
-            // the directory the stale ledger is planted back into.
-            std::fs::create_dir_all(ledger_path.parent().unwrap()).unwrap();
-            std::fs::write(&ledger_path, &ledger).unwrap();
+            // d. the wiring reverted to the native files: no hosted state
+            // is left anywhere, so nothing is discovered, offline or online.
+            p.write_files(&native_files(release));
             for extra in [&[][..], &["--no-verify"][..]] {
                 let mut args = origin.clone();
                 args.extend_from_slice(extra);
-                let out = vex(&p, &api, true, &args);
-                assert_omitted(
-                    &format!("{what} reverted {extra:?}"),
-                    &out,
-                    "redirect_unwired",
-                );
-                let out = vex(&p, &api, false, &args);
-                assert_omitted(
-                    &format!("{what} reverted online {extra:?}"),
-                    &out,
-                    "redirect_unwired",
-                );
+                for offline in [true, false] {
+                    let out = vex(&p, &api, offline, &args);
+                    let cell = format!("{what} reverted offline={offline} {extra:?}");
+                    assert_eq!(out.code, Some(2), "{cell}: {out}");
+                    assert_eq!(
+                        out.envelope["error"]["code"], "manifest_not_found",
+                        "{cell}: {out}"
+                    );
+                }
             }
             let _ = scan.requests();
         }
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/uv.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/uv.rs
index e8777484..5a9f7960 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/uv.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/uv.rs
@@ -1517,12 +1517,12 @@ fn writer_flavors() -> Vec<Flavor> {
 
 /// `scan --redirect --vex` on a lock-only checkout (nothing installed; an
 /// empty in-project venv keeps the crawl off the host interpreters) writes
-/// the hosted wiring + the redirect ledger and attests in-run; afterwards,
-/// with no manifest:
-///   c. the ledger alone attests offline;
-///   b. without the ledger, offline is `record_unavailable` with no request;
-///   a. without the ledger, online (public-proxy view) attests;
-///   d. `rollback` unwinds the wiring; with the ledger put back, it is dead.
+/// the hosted wiring — and NO ledger (v5) — and attests in-run from this
+/// run's records; afterwards, with no manifest:
+///   b. offline is `record_unavailable` with no request (the lock carries
+///      no record, and nothing else local does);
+///   a. online (public-proxy view) attests;
+///   d. the wiring reverted to the native files: nothing is discovered.
 ///
 /// uv locks are wired to the mock's origin (the writer fetches the hosted
 /// wheel's METADATA for them), so `vex` is told that origin is the patch
@@ -1568,7 +1568,10 @@ fn scan_redirect_wiring_attests_without_manifest_or_ledger() {
             lock.contains(&artifact_url),
             "{what}: lock not wired:\n{lock}"
         );
-        assert!(p.exists(".socket/vendor/redirect-state.json"), "{what}");
+        assert!(
+            !p.exists(".socket/vendor/redirect-state.json"),
+            "{what}: v5 hosted mode writes no ledger"
+        );
         assert!(
             !p.exists(".socket/manifest.json"),
             "{what}: hosted writes no manifest"
@@ -1582,25 +1585,9 @@ fn scan_redirect_wiring_attests_without_manifest_or_ledger() {
             Vec::new()
         };
 
-        // c. the writer's ledger attests offline.
+        // b / a. the wiring alone (the writer left no ledger).
         let before = api.requests();
         let (code, env, doc) = vex_offline(&p, &api, &origin);
-        assert_attested(
-            &format!("{what} ledger"),
-            code,
-            &env,
-            &doc,
-            &flavor.api_purl(),
-            HOSTED_UUID,
-            Mode::Hosted,
-        );
-        assert_eq!(api.requests(), before, "{what}: offline made a request");
-
-        // b / a. no ledger.
-        let ledger_path = p.root.join(".socket/vendor/redirect-state.json");
-        let ledger = std::fs::read(&ledger_path).unwrap();
-        std::fs::remove_file(&ledger_path).unwrap();
-        let (code, env, doc) = vex_offline(&p, &api, &origin);
         assert_omitted(
             &format!("{what} no ledger offline"),
             code,
@@ -1622,29 +1609,17 @@ fn scan_redirect_wiring_attests_without_manifest_or_ledger() {
         );
         assert_no_manifest_written(&p, &what);
 
-        // d. the real revert, then the ledger restored behind its back.
-        std::fs::write(&ledger_path, &ledger).unwrap();
-        let (code, env) = run_authed(&p, &api, &["rollback"]);
-        assert_eq!(code, Some(0), "{what} rollback: {env}");
-        for (name, text) in flavor.native_files() {
-            assert_eq!(p.read(name), text, "{what}: rollback restores {name}");
-        }
-        // A fully reverted project keeps no `.socket/` at all: recreate the
-        // directory the stale ledger is planted back into.
-        std::fs::create_dir_all(ledger_path.parent().unwrap()).unwrap();
-        std::fs::write(&ledger_path, &ledger).unwrap();
+        // d. the wiring reverted to the native files: no hosted state is
+        // left anywhere, so nothing is discovered.
+        p.write_files(&flavor.native_files());
         for extra in [&[][..], &["--no-verify"][..]] {
             let mut args = origin.clone();
             args.extend_from_slice(extra);
             let (code, env, doc) = vex_offline(&p, &api, &args);
-            assert_omitted(
-                &format!("{what} reverted {extra:?}"),
-                code,
-                &env,
-                &doc,
-                &flavor.purl(),
-                "redirect_unwired",
-            );
+            let cell = format!("{what} reverted {extra:?}");
+            assert_eq!(code, Some(2), "{cell}: {env}");
+            assert_eq!(env["error"]["code"], "manifest_not_found", "{cell}: {env}");
+            assert!(doc.is_none(), "{cell}: {doc:?}");
         }
     }
 }
@@ -1841,11 +1816,14 @@ fn embedded_vex(p: &Proj, command: &str, extra: &[&str]) -> (Option<i32>, Value,
 /// the embedded VEX (`generate_vex_without_manifest`) rather than return
 /// `noManifest` / exit 0 with the requested document silently never
 /// written. Every flavor × mode, with
-/// the writer's ledger and fully offline: the document is written (exit 0,
-/// envelope `vex` summary) with the right marker; `--dry-run` writes none;
-/// the lock reverted with the ledger left behind fails the command (exit 1,
+/// a committed ledger (vendored: the vendor ledger; hosted: a PRE-v5
+/// redirect ledger, which v5 still reads as a local record source) and
+/// fully offline: the document is written (exit 0, envelope `vex` summary)
+/// with the right marker; `--dry-run` writes none; the lock reverted with
+/// the ledger left behind fails the command (exit 1,
 /// `no_applicable_patches`) and leaves no stale document; and a project with
-/// NOTHING wired keeps the calm no-op.
+/// NOTHING wired keeps the calm no-op. `vendor` skips the hosted cells: over
+/// hosted pins it is the v5 eject flow, not a manifest-less VEX run.
 #[test]
 fn embedded_apply_and_vendor_vex_attest_manifest_less_checkouts() {
     for command in ["apply", "vendor"] {
@@ -1859,6 +1837,9 @@ fn embedded_apply_and_vendor_vex_attest_manifest_less_checkouts() {
         assert!(doc.is_none(), "{command}: nothing to attest, no document");
 
         for mode in [Mode::Hosted, Mode::Vendored] {
+            if command == "vendor" && mode == Mode::Hosted {
+                continue;
+            }
             for flavor in flavors(mode) {
                 let what = format!("{command} --vex {} {mode:?}", flavor.label());
                 let p = Proj::new();
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/vlt.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/vlt.rs
index 5ee6dce1..14ea135d 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/vlt.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/vlt.rs
@@ -14,9 +14,10 @@
 //!   lock over an importer copy; then vlt's installed state is staged (the
 //!   importer copy and `node_modules/.vlt/<DepID>/node_modules/left-pad`)
 //!   and, with the manifest deleted:
-//!   - the redirect ledger's embedded record attests offline;
-//!   - with the ledgers deleted too, installed + patched attests
-//!     `(redirected)` from the patch API's record;
+//!   - the scan wrote no ledger (v5), so offline there is no local record
+//!     (`record_unavailable`, zero requests);
+//!   - installed + patched attests `(redirected)` from the patch API's
+//!     record;
 //!   - a tampered or pristine store copy is omitted (`hash_mismatch` /
 //!     `not_applied`) even though the importer copy is patched;
 //!   - not installed attests from the lock's sha512 pin, except in the
@@ -120,7 +121,7 @@ fn hosted_project(tmp: &Path, era: Era, tag: &str) -> HostedProject {
         "[{tag}] the lock must pin the hosted tarball:\n{lock}"
     );
     assert!(!root.join(".socket/manifest.json").exists());
-    assert!(hosted::ledger_path(&root).is_file(), "[{tag}]");
+    vlt_vex::assert_no_hosted_ledger(&root, &format!("[{tag}]"));
     HostedProject {
         root,
         origin: server.uri(),
@@ -153,10 +154,9 @@ fn hosted_every_vlt_era_manifestless_evidence_cells() {
                 ..VexRun::offline()
             },
         );
-        assert_eq!(out.code, Some(0), "[{tag}] ledger, offline: {out}");
-        assert_attested(out.doc(), PURL, UUID, Marker::Redirected, VULNS);
+        assert_eq!(out.code, Some(1), "[{tag}] no local record, offline: {out}");
+        assert_not_attested(&out.envelope, PURL, "record_unavailable");
         silent.assert_no_requests();
-        strip_ledgers(root);
 
         let api = api_with(UUID, PURL);
         let out = run_vex(&bin, root, &online(&api));
diff --git a/crates/socket-patch-cli/tests/e2e_yarn4_pnpm_linker_build.rs b/crates/socket-patch-cli/tests/e2e_yarn4_pnpm_linker_build.rs
index 59aa1bec..ff575b68 100644
--- a/crates/socket-patch-cli/tests/e2e_yarn4_pnpm_linker_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_yarn4_pnpm_linker_build.rs
@@ -378,7 +378,10 @@ fn fresh_checkout_install(tmp: &Path, proj: &Path, yarnrc: &str) -> (PathBuf, Ou
     std::fs::copy(proj.join("package.json"), fresh.join("package.json")).unwrap();
     std::fs::copy(proj.join("yarn.lock"), fresh.join("yarn.lock")).unwrap();
     std::fs::write(fresh.join(".yarnrc.yml"), yarnrc).unwrap();
-    copy_dir_recursive(&proj.join(".socket"), &fresh.join(".socket"));
+    // v5 hosted mode may leave no `.socket/` at all (no ledger, no manifest).
+    if proj.join(".socket").is_dir() {
+        copy_dir_recursive(&proj.join(".socket"), &fresh.join(".socket"));
+    }
     let fresh_global = tmp.join("fresh-yarn-global");
     let ci = corepack(
         &fresh,
diff --git a/crates/socket-patch-cli/tests/e2e_yarn4_workspaces_build.rs b/crates/socket-patch-cli/tests/e2e_yarn4_workspaces_build.rs
index b0b1883b..bbffec46 100644
--- a/crates/socket-patch-cli/tests/e2e_yarn4_workspaces_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_yarn4_workspaces_build.rs
@@ -375,7 +375,10 @@ fn fresh_checkout_install(tmp: &Path, proj: &Path, yarnrc: &str) -> (PathBuf, Ou
     .unwrap();
     std::fs::copy(proj.join("yarn.lock"), fresh.join("yarn.lock")).unwrap();
     std::fs::write(fresh.join(".yarnrc.yml"), yarnrc).unwrap();
-    copy_dir_recursive(&proj.join(".socket"), &fresh.join(".socket"));
+    // v5 hosted mode may leave no `.socket/` at all (no ledger, no manifest).
+    if proj.join(".socket").is_dir() {
+        copy_dir_recursive(&proj.join(".socket"), &fresh.join(".socket"));
+    }
     let fresh_global = tmp.join("fresh-yarn-global");
     let ci = corepack(
         &fresh,
diff --git a/crates/socket-patch-cli/tests/get_modes_e2e.rs b/crates/socket-patch-cli/tests/get_modes_e2e.rs
index a50a6bc0..c815575a 100644
--- a/crates/socket-patch-cli/tests/get_modes_e2e.rs
+++ b/crates/socket-patch-cli/tests/get_modes_e2e.rs
@@ -553,10 +553,12 @@ async fn get_hosted_silent_prints_nothing_to_stdout() {
         lock.contains(HOSTED_URL1),
         "silent run must still redirect; lock:\n{lock}"
     );
-    assert!(tmp
-        .path()
-        .join(".socket/vendor/redirect-state.json")
-        .is_file());
+    assert!(
+        !tmp.path()
+            .join(".socket/vendor/redirect-state.json")
+            .exists(),
+        "v5 hosted mode writes no redirect ledger"
+    );
 
     // Loud control: without --silent the human path prints the redirect
     // summary — otherwise the empty-stdout assertion above proves nothing.
@@ -781,12 +783,13 @@ async fn get_vendored_then_hosted_takes_over_cleanly() {
             "the vendored ledger must no longer claim the purl; got:\n{state}"
         );
     }
-    // Hosted ledger present with the record.
-    let ledger: serde_json::Value = serde_json::from_str(
-        &std::fs::read_to_string(tmp.path().join(".socket/vendor/redirect-state.json")).unwrap(),
-    )
-    .unwrap();
-    assert_eq!(ledger["records"][PURL1]["uuid"], UUID1);
+    // v5: the lock pin is the whole hosted state — no redirect ledger.
+    assert!(
+        !tmp.path()
+            .join(".socket/vendor/redirect-state.json")
+            .exists(),
+        "v5 hosted mode writes no redirect ledger"
+    );
     // The takeover is announced, not silent.
     assert!(
         stdout.contains("redirect_takeover_reverted_vendored"),
diff --git a/crates/socket-patch-cli/tests/hosted_management_refusals.rs b/crates/socket-patch-cli/tests/hosted_management_refusals.rs
new file mode 100644
index 00000000..2d84dd98
--- /dev/null
+++ b/crates/socket-patch-cli/tests/hosted_management_refusals.rs
@@ -0,0 +1,318 @@
+//! Management commands over hosted state they cannot act on safely:
+//!
+//! * contested hosted wiring (a hosted `npm-shrinkwrap.json` beside an
+//!   upstream `package-lock.json`) is hosted state, so `rollback`, `list`
+//!   and `vendor` refuse and name it instead of reporting a bare project;
+//! * `vendor` ejecting a hosted project needs every patch record from the
+//!   API, so an offline run (flag or env, wet or dry) refuses before it
+//!   sends a single request.
+
+use std::path::Path;
+use std::process::Command;
+
+use serde_json::Value;
+use wiremock::MockServer;
+
+const PATCH: &str = "11111111-1111-4111-8111-111111111111";
+const GRANT: &str = "22222222-2222-4222-8222-222222222222";
+
+fn cli() -> Command {
+    let mut cmd = Command::new(env!("CARGO_BIN_EXE_socket-patch"));
+    for (key, _) in std::env::vars() {
+        if key.starts_with("SOCKET_") && key != "SOCKET_NO_CONFIG" {
+            cmd.env_remove(key);
+        }
+    }
+    cmd.env("SOCKET_TELEMETRY_DISABLED", "1");
+    cmd
+}
+
+fn lock(resolved: &str, integrity: &str) -> String {
+    format!(
+        r#"{{"name":"app","version":"1.0.0","lockfileVersion":3,"requires":true,"packages":{{"":{{"name":"app","version":"1.0.0","dependencies":{{"left-pad":"1.3.0"}}}},"node_modules/left-pad":{{"version":"1.3.0","resolved":"{resolved}","integrity":"{integrity}"}}}}}}"#
+    )
+}
+
+fn hosted_lock() -> String {
+    lock(
+        &format!(
+            "https://patch.socket.dev/patch/npm/left-pad/1.3.0/{GRANT}/{PATCH}/left-pad-1.3.0.tgz"
+        ),
+        "sha512-patched==",
+    )
+}
+
+fn write_package_json(root: &Path) {
+    std::fs::write(
+        root.join("package.json"),
+        r#"{"name":"app","version":"1.0.0","dependencies":{"left-pad":"1.3.0"}}"#,
+    )
+    .unwrap();
+}
+
+/// Hosted shrinkwrap, upstream package-lock: the locks disagree.
+fn write_contested(root: &Path) {
+    write_package_json(root);
+    std::fs::write(
+        root.join("package-lock.json"),
+        lock(
+            "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
+            "sha512-upstream==",
+        ),
+    )
+    .unwrap();
+    std::fs::write(root.join("npm-shrinkwrap.json"), hosted_lock()).unwrap();
+}
+
+fn run_json(args: &[&str], cwd: &Path) -> (Option<i32>, Value) {
+    let out = cli()
+        .args(args)
+        .arg("--cwd")
+        .arg(cwd)
+        .output()
+        .expect("run socket-patch");
+    let stdout = String::from_utf8_lossy(&out.stdout);
+    let v: Value = serde_json::from_str(&stdout).unwrap_or_else(|e| {
+        panic!(
+            "{args:?}: stdout is not JSON ({e}): {stdout}\nstderr: {}",
+            String::from_utf8_lossy(&out.stderr)
+        )
+    });
+    (out.status.code(), v)
+}
+
+fn snapshot(root: &Path) -> Vec<(String, String)> {
+    ["package-lock.json", "npm-shrinkwrap.json"]
+        .iter()
+        .map(|f| {
+            (
+                f.to_string(),
+                std::fs::read_to_string(root.join(f)).unwrap_or_default(),
+            )
+        })
+        .collect()
+}
+
+#[test]
+fn rollback_refuses_contested_hosted_wiring_and_names_it() {
+    let tmp = tempfile::tempdir().unwrap();
+    write_contested(tmp.path());
+    let before = snapshot(tmp.path());
+    let (code, v) = run_json(&["rollback", "--json", "--yes"], tmp.path());
+    assert_eq!(code, Some(1), "{v}");
+    let err = v["error"].as_str().unwrap_or_default();
+    assert!(
+        err.contains("npm-shrinkwrap.json") && err.contains("git checkout --"),
+        "the refusal names the contested file and the remedy: {v}"
+    );
+    assert!(!err.contains("Manifest not found"), "{v}");
+    assert_eq!(snapshot(tmp.path()), before, "nothing was rewritten");
+}
+
+#[test]
+fn list_reports_contested_hosted_wiring_instead_of_no_manifest() {
+    let tmp = tempfile::tempdir().unwrap();
+    write_contested(tmp.path());
+    let (code, v) = run_json(&["list", "--json"], tmp.path());
+    assert_eq!(code, Some(1), "{v}");
+    assert_eq!(v["error"]["code"], "hosted_wiring_contested", "{v}");
+}
+
+#[test]
+fn vendor_refuses_to_eject_contested_hosted_wiring() {
+    let tmp = tempfile::tempdir().unwrap();
+    write_contested(tmp.path());
+    let before = snapshot(tmp.path());
+    let (code, v) = run_json(&["vendor", "--offline", "--dry-run", "--json"], tmp.path());
+    assert_eq!(code, Some(1), "{v}");
+    assert_eq!(v["error"]["code"], "hosted_wiring_contested", "{v}");
+    assert_eq!(snapshot(tmp.path()), before);
+    assert!(!tmp.path().join(".socket").exists());
+}
+
+/// An offline eject refuses with ZERO requests to the API, whether offline
+/// comes from the flag or the env, and on a dry run too.
+#[tokio::test]
+async fn offline_eject_refuses_before_any_request() {
+    let server = MockServer::start().await;
+    for (flag, env, dry) in [
+        (true, false, false),
+        (true, false, true),
+        (false, true, false),
+        (false, true, true),
+    ] {
+        let tmp = tempfile::tempdir().unwrap();
+        write_package_json(tmp.path());
+        std::fs::write(tmp.path().join("package-lock.json"), hosted_lock()).unwrap();
+        let before = snapshot(tmp.path());
+        let mut cmd = cli();
+        cmd.args(["vendor", "--json", "--org", "test-org", "--api-token", "fake"])
+            .arg("--api-url")
+            .arg(server.uri())
+            .arg("--cwd")
+            .arg(tmp.path());
+        if flag {
+            cmd.arg("--offline");
+        }
+        if env {
+            cmd.env("SOCKET_OFFLINE", "1");
+        }
+        if dry {
+            cmd.arg("--dry-run");
+        }
+        let out = cmd.output().unwrap();
+        let v: Value = serde_json::from_slice(&out.stdout).unwrap_or_else(|e| {
+            panic!(
+                "flag={flag} env={env} dry={dry}: {e}: {}",
+                String::from_utf8_lossy(&out.stdout)
+            )
+        });
+        assert_eq!(out.status.code(), Some(1), "flag={flag} env={env} dry={dry}: {v}");
+        assert_eq!(v["error"]["code"], "offline_eject_unavailable", "{v}");
+        assert_eq!(snapshot(tmp.path()), before);
+    }
+    let received = server.received_requests().await.unwrap_or_default();
+    assert!(
+        received.is_empty(),
+        "an offline eject must not touch the network: {:?}",
+        received.iter().map(|r| r.url.to_string()).collect::<Vec<_>>()
+    );
+}
+
+// ── eject is one transaction ────────────────────────────────────────────────
+
+const ORG: &str = "test-org";
+const MOCK_PATCH: &str = "33333333-3333-4333-8333-333333333333";
+
+/// A fresh hosted checkout: package.json + a package-lock.json pinning
+/// left-pad to the mock patch server, and NOTHING installed.
+fn write_fresh_hosted_checkout(root: &Path, patch_origin: &str) -> String {
+    write_package_json(root);
+    let lock = lock(
+        &format!(
+            "{patch_origin}/patch/npm/left-pad/1.3.0/{GRANT}/{MOCK_PATCH}/left-pad-1.3.0.tgz"
+        ),
+        "sha512-patched==",
+    );
+    std::fs::write(root.join("package-lock.json"), &lock).unwrap();
+    lock
+}
+
+async fn mount_view_and_registry(server: &MockServer, tarball_status: u16) {
+    use wiremock::matchers::{method, path};
+    use wiremock::{Mock, ResponseTemplate};
+    Mock::given(method("GET"))
+        .and(path(format!("/v0/orgs/{ORG}/patches/view/{MOCK_PATCH}")))
+        .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+            "uuid": MOCK_PATCH,
+            "purl": "pkg:npm/left-pad@1.3.0",
+            "publishedAt": "2024-01-01T00:00:00Z",
+            "files": { "package/index.js": { "beforeHash": "a".repeat(64), "afterHash": "b".repeat(64) } },
+            "vulnerabilities": {},
+            "description": "x", "license": "MIT", "tier": "free"
+        })))
+        .mount(server)
+        .await;
+    Mock::given(method("GET"))
+        .and(path("/npm-registry/left-pad/1.3.0"))
+        .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+            "name": "left-pad",
+            "version": "1.3.0",
+            "dist": {
+                "tarball": format!("{}/npm-registry/left-pad/-/left-pad-1.3.0.tgz", server.uri()),
+                "integrity": "sha512-upstream==",
+            }
+        })))
+        .mount(server)
+        .await;
+    Mock::given(method("GET"))
+        .and(path("/npm-registry/left-pad/-/left-pad-1.3.0.tgz"))
+        .respond_with(ResponseTemplate::new(tarball_status))
+        .mount(server)
+        .await;
+}
+
+fn eject_cmd(server: &MockServer, cwd: &Path, dry: bool) -> Command {
+    let mut cmd = cli();
+    cmd.args(["vendor", "--json", "--org", ORG, "--api-token", "fake"])
+        .args(["--vendor-source", "build"])
+        .arg("--api-url")
+        .arg(server.uri())
+        .arg("--patch-server-url")
+        .arg(server.uri())
+        .arg("--cwd")
+        .arg(cwd)
+        .env("SOCKET_NPM_REGISTRY", format!("{}/npm-registry", server.uri()));
+    if dry {
+        cmd.arg("--dry-run");
+    }
+    cmd
+}
+
+/// Failure injection: the pristine tarball cannot be fetched, so vendoring
+/// fails AFTER the upstream restore landed — the eject rolls everything
+/// back and the project stays hosted, byte for byte.
+#[tokio::test]
+async fn failed_eject_rolls_back_and_keeps_the_project_hosted() {
+    let server = MockServer::start().await;
+    mount_view_and_registry(&server, 404).await;
+    let tmp = tempfile::tempdir().unwrap();
+    let hosted = write_fresh_hosted_checkout(tmp.path(), &server.uri());
+    let out = eject_cmd(&server, tmp.path(), false).output().unwrap();
+    let v: Value = serde_json::from_slice(&out.stdout).unwrap_or_else(|e| {
+        panic!(
+            "{e}: {}\n{}",
+            String::from_utf8_lossy(&out.stdout),
+            String::from_utf8_lossy(&out.stderr)
+        )
+    });
+    assert_eq!(out.status.code(), Some(1), "{v}");
+    assert!(
+        v["warnings"]
+            .as_array()
+            .is_some_and(|w| w.iter().any(|w| w["code"] == "eject_rolled_back")),
+        "the rollback is announced: {v}"
+    );
+    assert_eq!(
+        std::fs::read_to_string(tmp.path().join("package-lock.json")).unwrap(),
+        hosted,
+        "the hosted pin survives a failed eject"
+    );
+    assert!(
+        !tmp.path().join(".socket/vendor").exists()
+            || std::fs::read_dir(tmp.path().join(".socket/vendor"))
+                .unwrap()
+                .next()
+                .is_none(),
+        "no vendored residue"
+    );
+    assert!(
+        !tmp.path().join(".npmrc").exists(),
+        "the restore's side-config cleanup is rolled back with the rest"
+    );
+}
+
+/// A dry-run eject verifies the plan (records, upstream restore) and writes
+/// nothing.
+#[tokio::test]
+async fn dry_run_eject_verifies_the_plan_and_writes_nothing() {
+    let server = MockServer::start().await;
+    mount_view_and_registry(&server, 200).await;
+    let tmp = tempfile::tempdir().unwrap();
+    let hosted = write_fresh_hosted_checkout(tmp.path(), &server.uri());
+    let out = eject_cmd(&server, tmp.path(), true).output().unwrap();
+    let v: Value = serde_json::from_slice(&out.stdout).unwrap();
+    assert_eq!(out.status.code(), Some(0), "{v}");
+    assert_eq!(v["dryRun"], true, "{v}");
+    assert!(
+        v["events"]
+            .as_array()
+            .is_some_and(|e| e.iter().any(|e| e["purl"] == "pkg:npm/left-pad@1.3.0")),
+        "{v}"
+    );
+    assert_eq!(
+        std::fs::read_to_string(tmp.path().join("package-lock.json")).unwrap(),
+        hosted
+    );
+    assert!(!tmp.path().join(".socket").exists(), "a dry run creates no .socket/");
+}
diff --git a/crates/socket-patch-cli/tests/hosted_memory_engine.rs b/crates/socket-patch-cli/tests/hosted_memory_engine.rs
index 8b57dfc1..761d34ea 100644
--- a/crates/socket-patch-cli/tests/hosted_memory_engine.rs
+++ b/crates/socket-patch-cli/tests/hosted_memory_engine.rs
@@ -89,10 +89,8 @@ async fn roots_sharing_a_purl_share_every_lookup() {
         paths,
         vec![
             "a/.npmrc",
-            "a/.socket/vendor/redirect-state.json",
             "a/package-lock.json",
             "b/.npmrc",
-            "b/.socket/vendor/redirect-state.json",
             "b/package-lock.json"
         ]
     );
@@ -276,7 +274,16 @@ async fn malformed_and_deeply_nested_inputs_never_panic() {
         .iter()
         .find(|p| p.root == "deepjson")
         .unwrap();
-    assert_eq!(deepjson.error.as_ref().unwrap().code, "corrupt_ledger");
+    // The deep pre-v5 ledger is never parsed: whatever the project reports,
+    // it is not a ledger fault.
+    assert!(
+        deepjson
+            .error
+            .as_ref()
+            .is_none_or(|e| e.code != "corrupt_ledger"),
+        "{:?}",
+        deepjson.error
+    );
 }
 
 #[test]
@@ -484,7 +491,7 @@ async fn unauthorized_is_a_project_error_without_proxy_fallback() {
 }
 
 #[tokio::test]
-async fn dry_run_previews_without_records_or_ledger() {
+async fn dry_run_previews_without_records() {
     let server = npm_server().await;
     let output = run_engine(&server, build_input(&npm_files(), &[], options(true))).await;
     let paths: Vec<&str> = output
@@ -584,8 +591,11 @@ async fn vendored_takeover_is_refused() {
     assert!(output.changed_files.is_empty());
 }
 
+/// A pre-v5 redirect ledger (`.socket/vendor/redirect-state.json`) is
+/// never read by the v5 engine: a torn one neither fails its project nor
+/// changes its plan, and the engine never emits (or rewrites) the file.
 #[tokio::test]
-async fn corrupt_ledger_fails_only_its_project() {
+async fn corrupt_pre_v5_ledger_is_ignored() {
     let server = npm_server().await;
     let mut repo = prefixed("good", &npm_files());
     repo.extend(prefixed("bad", &npm_files()));
@@ -596,14 +606,25 @@ async fn corrupt_ledger_fails_only_its_project() {
     let output = run_engine(&server, build_input(&repo, &[], options(false))).await;
     let bad = output.projects.iter().find(|p| p.root == "bad").unwrap();
     let good = output.projects.iter().find(|p| p.root == "good").unwrap();
-    assert_eq!(bad.error.as_ref().unwrap().code, "corrupt_ledger");
-    assert_eq!(bad.redirect, serde_json::json!({ "mode": "hosted" }));
-    assert!(good.error.is_none());
+    assert!(bad.error.is_none(), "{:?}", bad.error);
+    assert!(good.error.is_none(), "{:?}", good.error);
+    assert_eq!(bad.redirected.len(), 1);
     assert_eq!(good.redirected.len(), 1);
-    assert!(output
+    let paths: Vec<&str> = output
         .changed_files
         .iter()
-        .all(|f| !f.path.starts_with("bad/")));
+        .map(|f| f.path.as_str())
+        .collect();
+    assert_eq!(
+        paths,
+        vec![
+            "bad/.npmrc",
+            "bad/package-lock.json",
+            "good/.npmrc",
+            "good/package-lock.json"
+        ],
+        "the ledger is neither consumed nor emitted"
+    );
 }
 
 #[tokio::test]
diff --git a/crates/socket-patch-cli/tests/hosted_symlinked_files.rs b/crates/socket-patch-cli/tests/hosted_symlinked_files.rs
index a3d2ca5a..4ab06e22 100644
--- a/crates/socket-patch-cli/tests/hosted_symlinked_files.rs
+++ b/crates/socket-patch-cli/tests/hosted_symlinked_files.rs
@@ -9,8 +9,8 @@
 //! restore bytes but never the link (git: a 120000→100644 typechange). The
 //! hosted REVERT side already refuses symlinked files fail-closed; these
 //! tests pin the WRITE side to the same policy: the whole (transactional)
-//! rewrite is refused with a stable code, before the ledger and before any
-//! file write.
+//! rewrite is refused with a stable code before any file write (v5 hosted
+//! mode keeps no ledger at all; the tests still pin that none appears).
 //!
 //! A FIFO planted under a candidate name (`pyproject.toml`) must be skipped
 //! like an unreadable file, never opened with a blocking `open(2)` that waits
@@ -472,7 +472,10 @@ async fn hosted_rewrites_the_same_lock_once_it_is_a_regular_file() {
     assert!(std::fs::read_to_string(root.join("package-lock.json"))
         .unwrap()
         .contains(NPM_HOSTED_URL));
-    assert!(root.join(LEDGER_REL).exists());
+    assert!(
+        !root.join(LEDGER_REL).exists(),
+        "v5 hosted mode keeps no ledger: the lockfile is the record"
+    );
 }
 
 /// A FIFO planted as `pyproject.toml` beside a real uv.lock: the candidate
diff --git a/crates/socket-patch-cli/tests/in_process_get_hosted_ecosystems.rs b/crates/socket-patch-cli/tests/in_process_get_hosted_ecosystems.rs
index 1a8c2a21..f6ab3f7a 100644
--- a/crates/socket-patch-cli/tests/in_process_get_hosted_ecosystems.rs
+++ b/crates/socket-patch-cli/tests/in_process_get_hosted_ecosystems.rs
@@ -155,20 +155,11 @@ async fn reference_bodies(server: &MockServer) -> Vec<String> {
         .collect()
 }
 
-fn read_ledger(cwd: &Path) -> serde_json::Value {
-    let ledger_path = cwd.join(".socket/vendor/redirect-state.json");
-    assert!(
-        ledger_path.is_file(),
-        "redirect ledger must be written at {}",
-        ledger_path.display()
-    );
-    serde_json::from_str(&std::fs::read_to_string(&ledger_path).unwrap())
-        .expect("redirect-state.json parses")
-}
-
-/// Hosted mode's persistence contract: the ledger IS the store — never the
-/// manifest, never blobs (parity with `scan --mode hosted`).
+/// Hosted mode's persistence contract: the lockfile edits ARE the store —
+/// never the manifest, never blobs, and (v5) never the redirect ledger
+/// (parity with `scan --mode hosted`).
 fn assert_no_manifest_no_blobs(cwd: &Path) {
+    vlt_hosted_common::assert_no_ledger(cwd);
     assert!(
         !cwd.join(".socket/manifest.json").exists(),
         "hosted mode must NOT write the manifest"
@@ -186,7 +177,7 @@ fn assert_no_manifest_no_blobs(cwd: &Path) {
 /// A pip project pinning `requests==2.31.0`: the hosted grant must rewrite
 /// that one line to `requests @ <hosted-url> --hash=sha256:<hex>` (the
 /// integrity pin fails closed on tampered bytes), leave the bystander line
-/// byte-identical, record the ledger — and write no manifest.
+/// byte-identical — and write no manifest and no ledger.
 #[tokio::test]
 #[serial]
 async fn pypi_requirements_hosted_rewrites_pinned_line() {
@@ -235,20 +226,6 @@ async fn pypi_requirements_hosted_rewrites_pinned_line() {
         "the bystander line must survive byte-identical; got:\n{reqs}"
     );
 
-    let ledger = read_ledger(tmp.path());
-    assert_eq!(ledger["mode"], "hosted");
-    assert_eq!(
-        ledger["records"][PURL]["uuid"], UUID,
-        "the ledger must record the redirected patch for VEX; got:\n{ledger}"
-    );
-    assert!(
-        ledger["edits"]
-            .as_array()
-            .unwrap()
-            .iter()
-            .any(|e| e["path"] == "requirements.txt" && e["kind"] == "redirect_requirements_line"),
-        "the ledger must carry the requirements.txt edit (revert data); got:\n{ledger}"
-    );
     assert_no_manifest_no_blobs(tmp.path());
 
     let bodies = reference_bodies(&server).await;
@@ -405,8 +382,6 @@ async fn maven_pom_hosted_pins_suffixed_version_fail_closed() {
         "maven.config must enable the trusted-checksums post-processor; got:\n{mvn_config}"
     );
 
-    let ledger = read_ledger(tmp.path());
-    assert_eq!(ledger["records"][PURL]["uuid"], UUID);
     assert_no_manifest_no_blobs(tmp.path());
 
     let bodies = reference_bodies(&server).await;
@@ -427,11 +402,14 @@ async fn maven_pom_hosted_pins_suffixed_version_fail_closed() {
 
 /// Manifest-less VEX over what `get <uuid> --mode hosted` committed for a
 /// maven pom (nothing installed: the fail-closed suffixed pin is the
-/// evidence): the ledger present, the ledgers deleted (pom wiring + API
-/// record), `--offline` without a local record (`record_unavailable`, zero
-/// requests), and the pom reverted with the ledger kept (`redirect_unwired`,
-/// with and without `--no-verify`). Without `--patch-server-url` the
-/// `patch.test` repository is not a Socket reference at all.
+/// evidence). v5 `get` writes no ledger, so: attested from the pom wiring +
+/// the API record; `--offline` without a local record →
+/// `record_unavailable` (zero requests); a pre-v5 ledger carrying the
+/// record is an extra local record source, so the same offline run then
+/// attests; (before that ledger exists) without `--patch-server-url` the
+/// `patch.test` repository is not a Socket reference at all, so there is
+/// nothing to attest (exit 2); and the pom reverted with the legacy ledger
+/// kept → `redirect_unwired`, with and without `--no-verify`.
 fn maven_hosted_get_state_attests_without_manifest(
     project: &Path,
     uuid: &str,
@@ -440,15 +418,13 @@ fn maven_hosted_get_state_attests_without_manifest(
 ) {
     use vex_e2e_common::*;
     let vulns: [(&str, &[&str]); 1] = [("GHSA-hhhh-eeee-xxxx", &["CVE-2024-4321"])];
-    let api = PatchApi::start(vec![(
-        uuid.to_string(),
-        patch_view(
-            uuid,
-            purl,
-            &[("commons-lang3-3.12.0.jar", &git_sha256(AFTER_BYTES))],
-            &vulns,
-        ),
-    )]);
+    let view = patch_view(
+        uuid,
+        purl,
+        &[("commons-lang3-3.12.0.jar", &git_sha256(AFTER_BYTES))],
+        &vulns,
+    );
+    let api = PatchApi::start(vec![(uuid.to_string(), view.clone())]);
     let m2 = tempfile::tempdir().unwrap();
     let run = VexRun {
         product: Some("pkg:maven/dev.socket.test/consumer@1.0.0".to_string()),
@@ -457,31 +433,19 @@ fn maven_hosted_get_state_attests_without_manifest(
     }
     .env("MAVEN_REPO_LOCAL", m2.path().as_os_str());
 
+    vlt_hosted_common::assert_no_ledger(project);
     let out = run_vex(&binary(), project, &run);
     assert_eq!(out.code, Some(0), "{out}");
     assert_attested(out.doc(), purl, uuid, Marker::Redirected, &vulns);
-
-    let ledger = std::fs::read(project.join(".socket/vendor/redirect-state.json")).unwrap();
-    strip_ledgers(project);
-    let before = api.view_requests(uuid);
-    let out = run_vex(&binary(), project, &run);
-    assert_eq!(out.code, Some(0), "{out}");
-    assert_attested(out.doc(), purl, uuid, Marker::Redirected, &vulns);
-    assert!(
-        api.view_requests(uuid) > before,
-        "record fetched from the API"
-    );
+    assert!(api.view_requests(uuid) >= 1, "record fetched from the API");
 
     let quiet = PatchApi::empty();
-    let out = run_vex(
-        &binary(),
-        project,
-        &VexRun {
-            offline: true,
-            proxy_url: Some(quiet.uri()),
-            ..run.clone()
-        },
-    );
+    let offline = VexRun {
+        offline: true,
+        proxy_url: Some(quiet.uri()),
+        ..run.clone()
+    };
+    let out = run_vex(&binary(), project, &offline);
     assert_eq!(out.code, Some(1), "{out}");
     assert_not_attested(&out.envelope, purl, "record_unavailable");
     quiet.assert_no_requests();
@@ -500,8 +464,16 @@ fn maven_hosted_get_state_attests_without_manifest(
         "not a Socket host without the override: {out}"
     );
 
+    vlt_hosted_common::write_legacy_ledger(
+        project,
+        &[(purl, vlt_hosted_common::legacy_record_from_view(&view))],
+    );
+    let out = run_vex(&binary(), project, &offline);
+    assert_eq!(out.code, Some(0), "a pre-v5 ledger record serves offline: {out}");
+    assert_attested(out.doc(), purl, uuid, Marker::Redirected, &vulns);
+    quiet.assert_no_requests();
+
     std::fs::write(project.join("pom.xml"), pristine_pom).unwrap();
-    std::fs::write(project.join(".socket/vendor/redirect-state.json"), &ledger).unwrap();
     for no_verify in [false, true] {
         let out = run_vex(
             &binary(),
@@ -634,8 +606,6 @@ async fn nuget_hosted_wires_source_mapping_and_lock_hash() {
         "the resolved version stays the normalized 13.0.3; got:\n{lock}"
     );
 
-    let ledger = read_ledger(tmp.path());
-    assert_eq!(ledger["records"][PURL]["uuid"], UUID);
     assert_no_manifest_no_blobs(tmp.path());
 
     let bodies = reference_bodies(&server).await;
@@ -653,25 +623,23 @@ async fn nuget_hosted_wires_source_mapping_and_lock_hash() {
 
 /// The manifest-less VEX steps for a nuget hosted checkout `get` wired
 /// (`http://patch.test` is the configured patch-server origin; nothing is
-/// installed, so the lock's re-pinned `contentHash` is the evidence):
-/// ledger present → attested online and offline; ledger deleted → attested
-/// from nuget.config + packages.lock.json + the API record; `--offline`
-/// with no ledger → `record_unavailable` with zero requests; wiring
-/// reverted with the ledger restored → `redirect_unwired`, with and
-/// without `--no-verify`.
+/// installed, so the lock's re-pinned `contentHash` is the evidence). v5
+/// `get` writes no ledger: attested from nuget.config, packages.lock.json
+/// and the API record; `--offline` with no local record →
+/// `record_unavailable` with zero requests; a pre-v5 ledger carrying the
+/// record serves the offline run; wiring reverted with that ledger kept →
+/// `redirect_unwired`, with and without `--no-verify`.
 fn nuget_hosted_manifestless_vex(root: &Path, uuid: &str, purl: &str) {
     use vex_e2e_common::*;
     let store = tempfile::tempdir().unwrap();
     let vulns: &[(&str, &[&str])] = &[("GHSA-hhhh-eeee-xxxx", &["CVE-2024-4321"])];
-    let api = PatchApi::start(vec![(
-        uuid.to_string(),
-        patch_view(
-            uuid,
-            purl,
-            &[("package/payload.txt", &git_sha256(AFTER_BYTES))],
-            vulns,
-        ),
-    )]);
+    let view = patch_view(
+        uuid,
+        purl,
+        &[("package/payload.txt", &git_sha256(AFTER_BYTES))],
+        vulns,
+    );
+    let api = PatchApi::start(vec![(uuid.to_string(), view.clone())]);
     let run = |r: VexRun| {
         let r = VexRun {
             patch_server_url: Some("http://patch.test".to_string()),
@@ -696,13 +664,7 @@ fn nuget_hosted_manifestless_vex(root: &Path, uuid: &str, purl: &str) {
         assert!(hit, "{purl} skipped with {reason}: {out}");
         assert_absent(out.doc.as_ref(), purl);
     };
-    for r in [VexRun::online(&api), VexRun::offline()] {
-        let out = run(r);
-        assert_eq!(out.code, Some(0), "with the ledger: {out}");
-        assert_attested(out.doc(), purl, uuid, Marker::Redirected, vulns);
-    }
-    let ledger = std::fs::read(root.join(".socket/vendor/redirect-state.json")).unwrap();
-    strip_ledgers(root);
+    vlt_hosted_common::assert_no_ledger(root);
     let out = run(VexRun::online(&api));
     assert_eq!(out.code, Some(0), "lockfile wiring alone: {out}");
     assert_attested(out.doc(), purl, uuid, Marker::Redirected, vulns);
@@ -717,7 +679,14 @@ fn nuget_hosted_manifestless_vex(root: &Path, uuid: &str, purl: &str) {
     );
     quiet.assert_no_requests();
 
-    std::fs::write(root.join(".socket/vendor/redirect-state.json"), ledger).unwrap();
+    vlt_hosted_common::write_legacy_ledger(
+        root,
+        &[(purl, vlt_hosted_common::legacy_record_from_view(&view))],
+    );
+    let out = run(VexRun::offline());
+    assert_eq!(out.code, Some(0), "a pre-v5 ledger record serves offline: {out}");
+    assert_attested(out.doc(), purl, uuid, Marker::Redirected, vulns);
+
     std::fs::write(
         root.join("nuget.config"),
         "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<configuration>\n  <packageSources>\n    \
@@ -845,8 +814,6 @@ async fn composer_lock_hosted_repoints_dist_minding_escaped_slashes() {
         "the bystander package's escaped dist must stay byte-identical; got:\n{lock}"
     );
 
-    let ledger = read_ledger(tmp.path());
-    assert_eq!(ledger["records"][PURL]["uuid"], UUID);
     assert_no_manifest_no_blobs(tmp.path());
 
     let bodies = reference_bodies(&server).await;
diff --git a/crates/socket-patch-cli/tests/in_process_get_modes.rs b/crates/socket-patch-cli/tests/in_process_get_modes.rs
index f2317fb0..b5d70fef 100644
--- a/crates/socket-patch-cli/tests/in_process_get_modes.rs
+++ b/crates/socket-patch-cli/tests/in_process_get_modes.rs
@@ -227,12 +227,12 @@ async fn requests_containing(server: &MockServer, fragment: &str) -> usize {
 // ---------------------------------------------------------------------------
 
 /// `get <uuid> --mode hosted` must produce scan's hosted result: lockfile
-/// repointed at the hosted artifact with the patched integrity, a redirect
-/// ledger with the patch record — and NO manifest, NO blobs (the ledger IS
-/// the persistence; parity with `scan --mode hosted`).
+/// repointed at the hosted artifact with the patched integrity — and NO
+/// manifest, NO blobs, NO redirect ledger (v5: the lockfile pin IS the
+/// persistence; parity with `scan --mode hosted`).
 #[tokio::test]
 #[serial]
-async fn get_uuid_hosted_rewrites_lockfile_and_writes_ledger_not_manifest() {
+async fn get_uuid_hosted_rewrites_lockfile_and_writes_no_ledger_or_manifest() {
     let server = MockServer::start().await;
     mock_view(&server, UUID1, PURL1).await;
     mock_reference(&server).await;
@@ -259,14 +259,11 @@ async fn get_uuid_hosted_rewrites_lockfile_and_writes_ledger_not_manifest() {
         "upstream resolved/integrity must be replaced; got:\n{lock}"
     );
 
-    let ledger_path = tmp.path().join(".socket/vendor/redirect-state.json");
-    assert!(ledger_path.is_file(), "redirect ledger must be written");
-    let ledger: serde_json::Value =
-        serde_json::from_str(&std::fs::read_to_string(&ledger_path).unwrap()).unwrap();
-    assert_eq!(ledger["mode"], "hosted");
-    assert_eq!(
-        ledger["records"][PURL1]["uuid"], UUID1,
-        "the ledger must record the redirected patch for VEX; got:\n{ledger}"
+    assert!(
+        !tmp.path()
+            .join(".socket/vendor/redirect-state.json")
+            .exists(),
+        "v5 hosted mode must NOT write the redirect ledger"
     );
 
     assert!(
@@ -281,8 +278,8 @@ async fn get_uuid_hosted_rewrites_lockfile_and_writes_ledger_not_manifest() {
 
 /// A GHSA fan-out across two versions must be narrowed to the INSTALLED
 /// version before the hosted engine runs: only its uuid is sent to the
-/// reference endpoint, only its lock entry is rewritten, and only its purl
-/// lands in the ledger.
+/// reference endpoint, only its lock entry is rewritten, and no ledger is
+/// written.
 #[tokio::test]
 #[serial]
 async fn get_ghsa_hosted_narrows_to_installed_version() {
@@ -321,14 +318,15 @@ async fn get_ghsa_hosted_narrows_to_installed_version() {
         reference_bodies[0]
     );
 
-    let ledger: serde_json::Value = serde_json::from_str(
-        &std::fs::read_to_string(tmp.path().join(".socket/vendor/redirect-state.json")).unwrap(),
-    )
-    .unwrap();
-    assert!(ledger["records"][PURL1].is_object());
     assert!(
-        ledger["records"][PURL2].is_null(),
-        "no record for the uninstalled version"
+        !lock.contains(UUID2) && !lock.contains(&format!("{NAME}-2.0.0")),
+        "the uninstalled version must not be pinned; got:\n{lock}"
+    );
+    assert!(
+        !tmp.path()
+            .join(".socket/vendor/redirect-state.json")
+            .exists(),
+        "v5 hosted mode must NOT write the redirect ledger"
     );
     assert!(!tmp.path().join(".socket/manifest.json").exists());
 }
diff --git a/crates/socket-patch-cli/tests/in_process_get_update_count.rs b/crates/socket-patch-cli/tests/in_process_get_update_count.rs
index cce2616f..9ac8bed4 100644
--- a/crates/socket-patch-cli/tests/in_process_get_update_count.rs
+++ b/crates/socket-patch-cli/tests/in_process_get_update_count.rs
@@ -93,6 +93,7 @@ fn params(root: &Path) -> DownloadParams {
         strict: false,
         ecosystems: None,
         persist_blobs: true,
+        patch_server_url: None,
         // Skip release-narrowing; npm has no variants anyway.
         all_releases: true,
     }
diff --git a/crates/socket-patch-cli/tests/in_process_redirect.rs b/crates/socket-patch-cli/tests/in_process_redirect.rs
index 9b6ff057..ef2c0309 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect.rs
@@ -2,7 +2,9 @@
 //! (discovery + the `patches/package` reference endpoint) via wiremock, lays
 //! down an npm project with a lockfile, runs `scan --redirect`, and asserts the
 //! lockfile's patched-dependency entry was repointed at the hosted vendored
-//! patch (resolved URL + sha512 integrity) and a revert ledger was written.
+//! patch (resolved URL + sha512 integrity) — and (v5) that NO redirect
+//! ledger was written: the lockfile pin is the whole hosted state, and
+//! `rollback` restores the default upstream registry entry.
 //! This is the CLI counterpart of the depscan-side install-verify e2e; the
 //! rewriter bytes themselves are pinned by the shared golden fixtures.
 
@@ -125,7 +127,7 @@ async fn mock_reference(server: &MockServer) {
 }
 
 /// The `view/{uuid}` endpoint `run_redirect` calls to build the patch record
-/// (file hashes + vulnerabilities) it persists into the redirect ledger for VEX.
+/// (file hashes + vulnerabilities) the in-run VEX attests from.
 async fn mock_view(server: &MockServer) {
     Mock::given(method("GET"))
         .and(path(format!("/v0/orgs/{ORG}/patches/view/{UUID}")))
@@ -219,19 +221,15 @@ async fn scan_redirect_rewrites_lockfile_to_hosted_patch() {
         !lock.contains("UPSTREAMupstream"),
         "the upstream resolved/integrity must be replaced; got:\n{lock}"
     );
-    // Revert ledger written.
-    assert!(
-        tmp.path()
-            .join(".socket/vendor/redirect-state.json")
-            .is_file(),
-        "a redirect ledger should be written for revert"
-    );
+    // v5: no revert ledger — the lock pin is the whole record.
+    vlt_hosted_common::assert_no_ledger(tmp.path());
 }
 
 /// `scan --redirect --vex` must emit a valid OpenVEX doc for the redirected
 /// patch. The redirected bytes aren't installed in-run, so this is a NO-VERIFY
-/// attestation built from the patch records the redirect run persists into the
-/// ledger; the statement carries the `(redirected)` provenance marker.
+/// attestation built from the patch records this run fetched (held in memory
+/// — v5 writes no ledger); the statement carries the `(redirected)`
+/// provenance marker.
 #[tokio::test]
 #[serial]
 async fn scan_redirect_vex_emits_redirected_attestation() {
@@ -254,13 +252,8 @@ async fn scan_redirect_vex_emits_redirected_attestation() {
     let code = run(args).await;
     assert_eq!(code, 0, "scan --redirect --vex should succeed");
 
-    // The ledger embeds the patch record (so a post-install `vex` can verify).
-    let ledger =
-        std::fs::read_to_string(tmp.path().join(".socket/vendor/redirect-state.json")).unwrap();
-    assert!(
-        ledger.contains("\"records\"") && ledger.contains(GHSA) && ledger.contains(PURL),
-        "ledger must embed the patch record + vulnerability: {ledger}"
-    );
+    // The record reached the attestation in memory: nothing persisted.
+    vlt_hosted_common::assert_no_ledger(tmp.path());
 
     // The VEX document attests the redirected patch with the (redirected) marker.
     let doc: serde_json::Value =
@@ -325,13 +318,12 @@ fn write_installed(root: &Path, name: &str, version: &str, bytes: &[u8]) {
     std::fs::write(pkg.join("index.js"), bytes).unwrap();
 }
 
-/// Idempotency guard for the revert ledger: a second `scan --redirect` run
-/// (whose rewrite matches the already-redirected entries) must MERGE into
-/// `redirect-state.json`, preserving the first run's edits — the entries whose
-/// `original` values a future revert needs — rather than clobbering the file.
+/// Idempotency: a second `scan --redirect` run over the already-redirected
+/// lock plans from the current lock text (v5 keeps no ledger chain), so it
+/// succeeds, leaves the lock byte-identical and still writes no ledger.
 #[tokio::test]
 #[serial]
-async fn second_redirect_run_preserves_revert_edits() {
+async fn second_redirect_run_is_idempotent() {
     let server = MockServer::start().await;
     mock_discovery(&server).await;
     mock_reference(&server).await;
@@ -342,35 +334,17 @@ async fn second_redirect_run_preserves_revert_edits() {
 
     let code = run(redirect_args(tmp.path(), server.uri())).await;
     assert_eq!(code, 0, "first scan --redirect should succeed");
-    let ledger_path = tmp.path().join(".socket/vendor/redirect-state.json");
-    let first = std::fs::read_to_string(&ledger_path).unwrap();
-    assert!(
-        first.contains("registry.npmjs.org"),
-        "first run's edits must record the ORIGINAL upstream URL: {first}"
-    );
+    let first = std::fs::read_to_string(tmp.path().join("package-lock.json")).unwrap();
+    assert!(first.contains(HOSTED_URL), "{first}");
 
     let code = run(redirect_args(tmp.path(), server.uri())).await;
     assert_eq!(code, 0, "second scan --redirect should succeed");
-    let second = std::fs::read_to_string(&ledger_path).unwrap();
-    assert!(
-        second.contains("registry.npmjs.org"),
-        "the second run must PRESERVE the original-upstream edit needed for \
-         revert (merge, not overwrite): {second}"
-    );
-    assert!(
-        second.contains(GHSA),
-        "records must survive the merge: {second}"
-    );
-    // Idempotency: the rewriters see an already-redirected lockfile, record
-    // no new edits, and the edit list stays the same length — unbounded edit
-    // growth across CI re-runs would poison a future revert.
-    let first_json: serde_json::Value = serde_json::from_str(&first).unwrap();
-    let second_json: serde_json::Value = serde_json::from_str(&second).unwrap();
     assert_eq!(
-        first_json["edits"].as_array().unwrap().len(),
-        second_json["edits"].as_array().unwrap().len(),
-        "a re-run must not append duplicate edits: {second}"
+        std::fs::read_to_string(tmp.path().join("package-lock.json")).unwrap(),
+        first,
+        "a re-run must leave the redirected lock byte-identical"
     );
+    vlt_hosted_common::assert_no_ledger(tmp.path());
 }
 
 /// A granted patch whose rewriter finds NOTHING to edit (no lockfile at all)
@@ -726,7 +700,7 @@ fn write_berry_project_spelled(root: &Path, spell: impl Fn(&str) -> String) {
 
 /// The berry leg: the yarn.lock entry is repointed via `::__archiveUrl=` (the
 /// URL percent-encoded) and its `checksum:` becomes the yarnBerry10c0. The
-/// descriptor KEY is preserved (so `--immutable` still passes), a ledger is
+/// descriptor KEY is preserved (so `--immutable` still passes), no ledger is
 /// written, and a second run is a no-op.
 #[tokio::test]
 #[serial]
@@ -757,35 +731,28 @@ async fn scan_redirect_rewrites_yarn_berry_lock() {
         lock.contains(&format!("\"{NAME}@npm:^{VERSION}\":")),
         "the descriptor key must be preserved verbatim; got:\n{lock}"
     );
-    assert!(
-        tmp.path()
-            .join(".socket/vendor/redirect-state.json")
-            .is_file(),
-        "a redirect ledger should be written"
-    );
+    vlt_hosted_common::assert_no_ledger(tmp.path());
 
-    // Idempotent: a second run rewrites nothing new (no ledger edit growth).
-    let ledger_path = tmp.path().join(".socket/vendor/redirect-state.json");
-    let first: serde_json::Value =
-        serde_json::from_str(&std::fs::read_to_string(&ledger_path).unwrap()).unwrap();
+    // Idempotent: a second run rewrites nothing (the lock is byte-stable).
     let code = run(redirect_args(tmp.path(), server.uri())).await;
     assert_eq!(code, 0, "second berry run should succeed");
-    let second: serde_json::Value =
-        serde_json::from_str(&std::fs::read_to_string(&ledger_path).unwrap()).unwrap();
     assert_eq!(
-        first["edits"].as_array().unwrap().len(),
-        second["edits"].as_array().unwrap().len(),
-        "a berry re-run must not append duplicate edits"
+        std::fs::read_to_string(tmp.path().join("yarn.lock")).unwrap(),
+        lock,
+        "a berry re-run must leave the lock byte-identical"
     );
+    vlt_hosted_common::assert_no_ledger(tmp.path());
 }
 
 /// The berry leg on the Windows lock shapes: yarn berry writes a NEW
 /// `yarn.lock` with `os.EOL` (CRLF on Windows), a `core.autocrlf` checkout
 /// produces the same on any OS, and editors add a BOM. The hosted chain
 /// must redirect the dep (never `redirected: 0` with a line-ending
-/// refusal), keep every line CRLF and the BOM, record the lock's on-disk
-/// CRLF fragments in the ledger, stay a no-op on re-run, and `rollback`
-/// must restore the pristine lock byte-for-byte.
+/// refusal), keep every line CRLF and the BOM, write no ledger, stay a
+/// no-op on re-run, and `rollback` must restore the upstream registry entry
+/// (re-resolved from the mocked npm registry: the berry checksum is
+/// recomputed from the upstream tarball) — the pristine lock byte-for-byte
+/// but for that checksum value, CRLF and BOM kept.
 #[tokio::test]
 #[serial]
 async fn scan_redirect_rewrites_crlf_and_bom_yarn_berry_locks_and_rollback_restores_them() {
@@ -793,6 +760,13 @@ async fn scan_redirect_rewrites_crlf_and_bom_yarn_berry_locks_and_rollback_resto
     mock_discovery(&server).await;
     mock_reference_with_berry(&server).await;
     mock_view(&server).await;
+    let tarball = upstream_tarball();
+    mock_npm_registry(
+        &server,
+        &vlt_hosted_common::sha512_sri(&tarball),
+        Some(tarball),
+    )
+    .await;
     let encoded = socket_patch_core::utils::uri::encode_uri_component(HOSTED_URL);
 
     for (label, bom) in [("crlf", ""), ("bom+crlf", "\u{feff}")] {
@@ -820,31 +794,9 @@ async fn scan_redirect_rewrites_crlf_and_bom_yarn_berry_locks_and_rollback_resto
         );
         assert_eq!(lock.starts_with('\u{feff}'), !bom.is_empty(), "{label}");
 
-        let ledger = read_ledger(tmp.path());
-        let edit = ledger["edits"]
-            .as_array()
-            .unwrap()
-            .iter()
-            .find(|e| e["kind"] == "redirect_yarn_berry_entry")
-            .unwrap_or_else(|| panic!("{label}: a berry ledger edit: {ledger:#}"));
-        for side in ["original", "new"] {
-            let fragment = edit[side].as_str().unwrap();
-            assert!(
-                fragment.contains("\r\n") && !fragment.replace("\r\n", "").contains('\n'),
-                "{label}: the ledger's {side} is the on-disk CRLF fragment: {fragment:?}"
-            );
-            assert!(
-                String::from_utf8_lossy(if side == "original" {
-                    &pristine
-                } else {
-                    lock.as_bytes()
-                })
-                .contains(fragment),
-                "{label}: {side} is a verbatim slice of the file"
-            );
-        }
+        vlt_hosted_common::assert_no_ledger(tmp.path());
 
-        // Re-run: in sync, byte-stable, no new ledger edit.
+        // Re-run: in sync, byte-stable.
         let env = run_redirect_subprocess(tmp.path(), &server.uri());
         assert_eq!(env["redirect"]["redirected"], 1, "{label}: {env:#}");
         assert_eq!(
@@ -852,25 +804,23 @@ async fn scan_redirect_rewrites_crlf_and_bom_yarn_berry_locks_and_rollback_resto
             lock,
             "{label}"
         );
-        assert_eq!(
-            read_ledger(tmp.path())["edits"].as_array().unwrap().len(),
-            ledger["edits"].as_array().unwrap().len(),
-            "{label}: a re-run appends nothing"
-        );
+        vlt_hosted_common::assert_no_ledger(tmp.path());
 
-        let (code, env) = rollback_json(tmp.path());
+        let (code, env) = rollback_json(tmp.path(), &server);
         assert_eq!(code, Some(0), "{label}: rollback: {env:#}");
+        assert_eq!(env["hosted"]["reverted"], serde_json::json!([PURL]), "{label}: {env:#}");
+        let restored = std::fs::read_to_string(&lock_path).unwrap();
+        let checksum = berry_checksum_of(&restored);
+        assert_ne!(checksum, BERRY_CHECKSUM, "{label}: the patched checksum is gone");
         assert_eq!(
-            std::fs::read(&lock_path).unwrap(),
-            pristine,
-            "{label}: rollback restores the pristine CRLF lock byte-for-byte"
-        );
-        assert!(
-            !tmp.path()
-                .join(".socket/vendor/redirect-state.json")
-                .exists(),
-            "{label}: the emptied ledger is removed"
+            restored,
+            String::from_utf8(pristine.clone())
+                .unwrap()
+                .replace(&format!("10c0/{}", "3".repeat(128)), &format!("10c0/{checksum}")),
+            "{label}: rollback restores the pristine CRLF lock (upstream checksum \
+             re-derived from the registry tarball)"
         );
+        vlt_hosted_common::assert_no_ledger(tmp.path());
     }
 }
 
@@ -878,7 +828,7 @@ async fn scan_redirect_rewrites_crlf_and_bom_yarn_berry_locks_and_rollback_resto
 /// cannot be kept in one style — and yarn itself rejects it under
 /// `--immutable` — so the hosted run refuses it untouched with a code that
 /// names the line endings and the `yarn install` remedy, redirecting
-/// nothing and writing no ledger.
+/// nothing and writing nothing.
 #[tokio::test]
 #[serial]
 async fn scan_redirect_refuses_a_mixed_line_ending_yarn_berry_lock() {
@@ -975,12 +925,7 @@ async fn scan_redirect_rewrites_correct_entry_in_crlf_classic_lock() {
         lock.matches("\r\n").count(),
         "every line must keep its CRLF ending: {lock}"
     );
-    assert!(
-        tmp.path()
-            .join(".socket/vendor/redirect-state.json")
-            .is_file(),
-        "a redirect ledger should be written"
-    );
+    vlt_hosted_common::assert_no_ledger(tmp.path());
 }
 
 /// Write a project whose only lockfile is a text `bun.lock` (registry
@@ -1063,12 +1008,7 @@ async fn scan_redirect_rewrites_bun_lock() {
         !lock.contains("UPSTREAMupstream"),
         "upstream integrity must be replaced; got:\n{lock}"
     );
-    assert!(
-        tmp.path()
-            .join(".socket/vendor/redirect-state.json")
-            .is_file(),
-        "a redirect ledger should be written"
-    );
+    vlt_hosted_common::assert_no_ledger(tmp.path());
     bun_manifestless_vex(tmp.path(), &lock_before, "bun-v1");
 }
 
@@ -1104,12 +1044,7 @@ async fn scan_redirect_rewrites_bun_lock_v2() {
         lock.contains(PATCHED_SHA512),
         "integrity must be the patched sha512"
     );
-    assert!(
-        tmp.path()
-            .join(".socket/vendor/redirect-state.json")
-            .is_file(),
-        "a redirect ledger should be written"
-    );
+    vlt_hosted_common::assert_no_ledger(tmp.path());
     bun_manifestless_vex(tmp.path(), &lock_before, "bun-v2");
 }
 
@@ -1176,14 +1111,11 @@ fn drop_bun_digest(line: &str) -> String {
 /// lock is re-saved for another reason. The digest-less 2-tuple is still
 /// our wiring (the spec bun installs from is intact): a repeat `scan
 /// --mode hosted` must report a CONSISTENT envelope — `redirected: 1` with
-/// no `redirect_bun_entry_not_found` — heal the line back to the 3-tuple
-/// and record the heal as a second ledger edit for the key (`original` =
-/// the 2-tuple); a third run appends nothing; and `rollback` must unwind
-/// the chain to the pristine registry line whether the lock is the healed
-/// 3-tuple or Bun has since dropped the digest again. Before the fix the
-/// repeat scan warned `entry_not_found` beside `redirected: 1` and
-/// rollback refused `partial_failure` ("matches neither the redirected nor
-/// the original fragment"), stranding every user on those releases.
+/// no `redirect_bun_entry_not_found` — and heal the line back to the
+/// 3-tuple; a third run is a no-op; no run writes a ledger; and `rollback`
+/// must restore the pristine registry line (re-resolved from the mocked npm
+/// registry) whether the lock is the healed 3-tuple or Bun has since
+/// dropped the digest again.
 #[tokio::test]
 #[serial]
 async fn scan_redirect_heals_digestless_bun_tuple_and_rollback_restores_the_registry_line() {
@@ -1198,7 +1130,7 @@ async fn scan_redirect_heals_digestless_bun_tuple_and_rollback_restores_the_regi
     write_bun_project(tmp.path(), 1);
     let lock_path = tmp.path().join("bun.lock");
     let pristine = std::fs::read_to_string(&lock_path).unwrap();
-    let ledger_path = tmp.path().join(".socket/vendor/redirect-state.json");
+    mock_npm_registry(&server, "sha512-UPSTREAMupstream==", None).await;
 
     for drop_again_before_rollback in [false, true] {
         let env = run_redirect_subprocess(tmp.path(), &server.uri());
@@ -1233,37 +1165,19 @@ async fn scan_redirect_heals_digestless_bun_tuple_and_rollback_restores_the_regi
             wired,
             "the digest is healed back — lock byte-identical to the first run's"
         );
-        let ledger = read_ledger(tmp.path());
-        let edits = ledger["edits"].as_array().unwrap();
-        assert_eq!(edits.len(), 2, "first edit + the heal: {ledger:#}");
-        assert_eq!(
-            edits[0]["original"],
-            serde_json::json!(bun_packages_line(&pristine, NAME)),
-            "{ledger:#}"
-        );
-        assert_eq!(edits[1]["key"], NAME, "{ledger:#}");
-        assert_eq!(
-            edits[1]["original"],
-            serde_json::json!(digestless),
-            "{ledger:#}"
-        );
-        assert_eq!(edits[1]["new"], serde_json::json!(wired_line), "{ledger:#}");
+        vlt_hosted_common::assert_no_ledger(tmp.path());
 
-        // A third run over the healed lock is a no-op for the ledger.
+        // A third run over the healed lock is a no-op.
         let env = run_redirect_subprocess(tmp.path(), &server.uri());
         assert_eq!(env["redirect"]["redirected"], 1, "{env:#}");
         assert!(warning_codes(&env).is_empty(), "{env:#}");
-        assert_eq!(
-            read_ledger(tmp.path())["edits"].as_array().unwrap().len(),
-            2,
-            "a re-run over the healed lock must not append edits"
-        );
+        assert_eq!(std::fs::read_to_string(&lock_path).unwrap(), wired);
 
         if drop_again_before_rollback {
             // Another `bun add` on Bun < 1.3.10: the digest is gone again.
             std::fs::write(&lock_path, wired.replace(&wired_line, &digestless)).unwrap();
         }
-        let (code, env) = rollback_json(tmp.path());
+        let (code, env) = rollback_json(tmp.path(), &server);
         assert_eq!(
             code,
             Some(0),
@@ -1276,28 +1190,33 @@ async fn scan_redirect_heals_digestless_bun_tuple_and_rollback_restores_the_regi
             "rollback lands on the pristine registry line (digest dropped again: \
              {drop_again_before_rollback})"
         );
-        assert!(
-            !ledger_path.exists(),
-            "the emptied ledger is deleted after a full unwind"
-        );
+        vlt_hosted_common::assert_no_ledger(tmp.path());
     }
 }
 
 // Native binary lockfiles are parsed and patched without invoking Bun.
 const INVALID_LOCKB_BYTES: &[u8] = b"\x00BUN-BINARY\xff\xfe\x00LOCK";
 
-/// `rollback --json --yes --offline` as a subprocess; returns (exit code,
-/// parsed envelope).
-fn rollback_json(cwd: &Path) -> (Option<i32>, serde_json::Value) {
+/// `rollback --json --yes` as a subprocess, with the mock patch host
+/// recognized (`--patch-server-url http://patch.test`, so lockfile
+/// discovery finds the hosted pins) and the upstream restore's npm registry
+/// pointed at `registry` (`SOCKET_NPM_REGISTRY`, see [`mock_npm_registry`]);
+/// returns (exit code, parsed envelope).
+fn rollback_json(cwd: &Path, registry: &MockServer) -> (Option<i32>, serde_json::Value) {
     let out = scrubbed_cli()
         .args([
             "rollback",
             "--json",
             "--yes",
-            "--offline",
+            "--patch-server-url",
+            "http://patch.test",
             "--cwd",
             cwd.to_str().unwrap(),
         ])
+        .env(
+            "SOCKET_NPM_REGISTRY",
+            format!("{}/npm-registry", registry.uri()),
+        )
         .output()
         .expect("run socket-patch rollback");
     let env_json: serde_json::Value = serde_json::from_slice(&out.stdout).unwrap_or_else(|e| {
@@ -1310,9 +1229,64 @@ fn rollback_json(cwd: &Path) -> (Option<i32>, serde_json::Value) {
     (out.status.code(), env_json)
 }
 
-fn read_ledger(root: &Path) -> serde_json::Value {
-    let text = std::fs::read_to_string(root.join(".socket/vendor/redirect-state.json")).unwrap();
-    serde_json::from_str(&text).expect("the ledger is JSON")
+/// The npm registry's version document for `NAME@VERSION` under
+/// `<server>/npm-registry` — what rollback's upstream restore re-resolves a
+/// hosted pin from — carrying `integrity`, plus (when given) the upstream
+/// `tarball` served at the document's `dist.tarball` (a yarn berry restore
+/// downloads it to recompute the zip checksum).
+async fn mock_npm_registry(server: &MockServer, integrity: &str, tarball: Option<Vec<u8>>) {
+    let tarball_path = format!("/npm-registry/{NAME}/-/{NAME}-{VERSION}.tgz");
+    Mock::given(method("GET"))
+        .and(path(format!("/npm-registry/{NAME}/{VERSION}")))
+        .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+            "name": NAME,
+            "version": VERSION,
+            "dist": {
+                "tarball": format!("{}{tarball_path}", server.uri()),
+                "integrity": integrity,
+                "shasum": "0".repeat(40),
+            }
+        })))
+        .mount(server)
+        .await;
+    if let Some(bytes) = tarball {
+        Mock::given(method("GET"))
+            .and(path(tarball_path))
+            .respond_with(ResponseTemplate::new(200).set_body_bytes(bytes))
+            .mount(server)
+            .await;
+    }
+}
+
+/// A small upstream npm tarball for `NAME@VERSION`.
+fn upstream_tarball() -> Vec<u8> {
+    let gz = flate2::write::GzEncoder::new(Vec::new(), flate2::Compression::default());
+    let mut builder = tar::Builder::new(gz);
+    let package_json = format!(r#"{{ "name": "{NAME}", "version": "{VERSION}" }}"#);
+    for (name, data) in [
+        ("package/package.json", package_json.as_bytes()),
+        ("package/index.js", b"module.exports = 'upstream'\n".as_slice()),
+    ] {
+        let mut header = tar::Header::new_gnu();
+        header.set_size(data.len() as u64);
+        header.set_mode(0o644);
+        header.set_cksum();
+        builder.append_data(&mut header, name, data).unwrap();
+    }
+    builder.into_inner().unwrap().finish().unwrap()
+}
+
+/// The `checksum: 10c0/<hex>` value of the target entry in a berry lock.
+fn berry_checksum_of(lock: &str) -> String {
+    let at = lock
+        .find(&format!("\"{NAME}@npm:^{VERSION}\":"))
+        .unwrap_or_else(|| panic!("no target entry in {lock:?}"));
+    let rest = &lock[at..];
+    let line = rest
+        .split('\n')
+        .find_map(|l| l.trim_end_matches('\r').trim().strip_prefix("checksum: 10c0/"))
+        .unwrap_or_else(|| panic!("no checksum in {rest:?}"));
+    line.to_string()
 }
 
 /// A child-only PATH with `bin_dir` first, joined with the OS separator.
@@ -1620,12 +1594,15 @@ async fn no_redirectable_patch_leaves_bun_lockb_alone() {
     );
 }
 
-/// A corrupt redirect ledger refuses before any binary-lockfile edits.
-/// The existing binary remains byte-identical and no Bun process starts.
+/// A corrupt pre-v5 redirect ledger is IGNORED (v5 never reads it): the
+/// binary-lockfile path runs exactly as without it — here a placeholder
+/// `bun.lockb` the native codec rejects (exit 0, nothing redirected) — no
+/// Bun process starts, no text lock appears, and the torn ledger is left
+/// byte-identical in place (never quarantined).
 #[cfg(unix)]
 #[tokio::test]
 #[serial]
-async fn corrupt_ledger_refuses_before_the_bun_lockb_edit() {
+async fn corrupt_pre_v5_ledger_is_ignored_beside_a_bun_lockb() {
     let server = MockServer::start().await;
     mock_discovery(&server).await;
     mock_reference(&server).await;
@@ -1648,7 +1625,6 @@ async fn corrupt_ledger_refuses_before_the_bun_lockb_edit() {
     .unwrap();
     std::fs::write(tmp.path().join("bun.lockb"), b"BUN-BINARY-PLACEHOLDER").unwrap();
 
-    // A torn ledger: parseable as neither the vendor nor the redirect shape.
     let ledger_path = tmp.path().join(".socket/vendor/redirect-state.json");
     std::fs::create_dir_all(ledger_path.parent().unwrap()).unwrap();
     let corrupt_bytes = b"{\"mode\":\"hosted\",\"edits\":[{\"path\":\"bun.lo";
@@ -1669,38 +1645,32 @@ async fn corrupt_ledger_refuses_before_the_bun_lockb_edit() {
     unsafe {
         std::env::set_var("PATH", orig_path);
     }
-    assert_eq!(code, 1, "a corrupt ledger must flip the exit code");
+    assert_eq!(code, 0, "a pre-v5 ledger never fails a hosted run");
     assert!(!bin_dir.join("bun-was-spawned").exists());
     assert_eq!(
         std::fs::read(tmp.path().join("bun.lockb")).ok().as_deref(),
         Some(b"BUN-BINARY-PLACEHOLDER".as_slice()),
-        "the binary lock must be byte-untouched: the refusal precedes the rewrite"
-    );
-    assert!(
-        !tmp.path().join("bun.lock").exists(),
-        "no text lock may be created by a run that refused before redirecting"
+        "the unparseable binary lock stays byte-untouched"
     );
-    // The malformed ledger is quarantined (never deleted), so recovery of the
-    // pre-redirect originals it may still hold stays possible.
-    let quarantined = tmp
-        .path()
-        .join(".socket/vendor/redirect-state.json.corrupt");
+    assert!(!tmp.path().join("bun.lock").exists());
     assert_eq!(
-        std::fs::read(&quarantined).unwrap(),
+        std::fs::read(&ledger_path).unwrap(),
         corrupt_bytes,
-        "the malformed ledger is moved aside verbatim"
+        "the pre-v5 ledger is left byte-identical in place"
     );
+    assert!(!tmp
+        .path()
+        .join(".socket/vendor/redirect-state.json.corrupt")
+        .exists());
 }
 
-/// An unusable ledger is an ERROR, not a silent success:
-/// `.socket/vendor/redirect-state.json` is the only revert path (and the VEX
-/// record store). A DIRECTORY squatting on the ledger path makes it
-/// unloadable, so the run must fail closed BEFORE rewriting anything — the
-/// old flow rewrote the lockfile first and only then discovered the ledger
-/// could not be persisted, leaving the repo redirected with no way back.
+/// A DIRECTORY squatting on the pre-v5 ledger path used to make the run
+/// fail closed (the ledger was the revert path). v5 hosted mode never reads
+/// or writes that path, so the run succeeds, the lock is redirected, and
+/// the squatting directory is left alone.
 #[tokio::test]
 #[serial]
-async fn unwritable_ledger_fails_the_run() {
+async fn directory_at_the_legacy_ledger_path_does_not_block_the_run() {
     let server = MockServer::start().await;
     mock_discovery(&server).await;
     mock_reference(&server).await;
@@ -1708,33 +1678,27 @@ async fn unwritable_ledger_fails_the_run() {
 
     let tmp = tempfile::tempdir().unwrap();
     write_project(tmp.path());
-    // Occupy the ledger path with a DIRECTORY so the ledger cannot be loaded
-    // (or written).
-    std::fs::create_dir_all(tmp.path().join(".socket/vendor/redirect-state.json")).unwrap();
+    let squatter = tmp.path().join(".socket/vendor/redirect-state.json");
+    std::fs::create_dir_all(&squatter).unwrap();
 
     let code = run(redirect_args(tmp.path(), server.uri())).await;
-    assert_eq!(code, 1, "an unusable ledger must flip the exit code");
-    // Fail-closed ordering: the ledger problem surfaces before any project
-    // file is touched, so the lockfile still points at the upstream registry.
+    assert_eq!(code, 0, "the legacy ledger path is not consulted");
     let lock = std::fs::read_to_string(tmp.path().join("package-lock.json")).unwrap();
-    assert!(
-        !lock.contains(HOSTED_URL),
-        "an unusable ledger must abort before the lockfile rewrite; got:\n{lock}"
-    );
+    assert!(lock.contains(HOSTED_URL), "the lock is redirected; got:\n{lock}");
+    assert!(squatter.is_dir(), "the squatting directory is untouched");
 }
 
-/// Findings hosted-atomicity 1+2: a MID-RUN lockfile write failure (second of
-/// two locks unwritable) must never leave the successfully-written first lock
-/// redirected with no ledger record of its pre-redirect originals. The ledger
-/// is persisted BEFORE the lockfile loop, so every planned edit's original is
-/// durable even when a later write fails; the failed lock itself stays
-/// byte-untouched (atomic stage+rename, no truncation).
+/// A MID-RUN lockfile write failure (second of two locks unwritable) exits
+/// 1; the first lock landed, the failed lock stays byte-untouched (atomic
+/// stage+rename, no truncation), and no ledger is written (v5: a landed
+/// hosted pin is undone by `rollback`'s upstream restore, which needs no
+/// recorded originals).
 ///
 /// unix-only: a read-only directory does not block file creation on Windows.
 #[cfg(unix)]
 #[tokio::test]
 #[serial]
-async fn partial_lockfile_write_failure_persists_ledger_originals() {
+async fn partial_lockfile_write_failure_exits_1_and_writes_no_ledger() {
     use std::os::unix::fs::PermissionsExt;
 
     let server = MockServer::start().await;
@@ -1764,19 +1728,7 @@ async fn partial_lockfile_write_failure_persists_ledger_originals() {
         common.contains(HOSTED_URL),
         "the common lock was written before the subspace failure; got:\n{common}"
     );
-    // …so its pre-redirect originals MUST already be in the ledger: without
-    // them a revert is impossible, and a re-run cannot recapture them (the
-    // entry is already redirected and produces no new edit).
-    let ledger = std::fs::read_to_string(tmp.path().join(".socket/vendor/redirect-state.json"))
-        .expect("the ledger must be persisted before any lockfile is mutated");
-    assert!(
-        ledger.contains("UPSTREAMupstream"),
-        "the ledger must record the pre-redirect original integrity: {ledger}"
-    );
-    assert!(
-        ledger.contains("common/config/rush/pnpm-lock.yaml"),
-        "the ledger must record the edit for the lock that WAS written: {ledger}"
-    );
+    vlt_hosted_common::assert_no_ledger(tmp.path());
 
     // The failed lock is byte-untouched — no partial/truncated write.
     assert_eq!(
@@ -1887,13 +1839,7 @@ async fn scan_redirect_rewrites_rush_common_and_subspace_locks() {
         "rush nested-lock redirects must not create a root pnpm-workspace.yaml"
     );
 
-    // repo-state.json present → the stale-hash warning fires.
-    let out = std::fs::read_to_string(tmp.path().join(".socket/vendor/redirect-state.json"))
-        .expect("a redirect ledger should be written");
-    assert!(
-        out.contains(HOSTED_URL),
-        "the ledger records the redirect for revert: {out}"
-    );
+    vlt_hosted_common::assert_no_ledger(tmp.path());
 }
 
 /// Run the built `socket-patch` binary as a subprocess against `api_url`
@@ -2104,23 +2050,8 @@ packages:
         !after.contains(HOSTED_URL),
         "the hosted URL must never appear (it would confirm + attest): {after}"
     );
-    // No ledger half-claims the purl either: an unconfirmed dep must fetch
-    // no record and record no edits.
-    let ledger_path = tmp.path().join(".socket/vendor/redirect-state.json");
-    if let Ok(text) = std::fs::read_to_string(&ledger_path) {
-        let ledger: serde_json::Value =
-            serde_json::from_str(&text).expect("the redirect ledger must be valid JSON");
-        assert!(
-            ledger["records"].get(PURL).is_none(),
-            "an unconfirmed dep must not be recorded: {ledger}"
-        );
-        let claimed = ledger["edits"]
-            .as_array()
-            .into_iter()
-            .flatten()
-            .any(|e| e["key"].as_str().is_some_and(|k| k.contains(NAME)));
-        assert!(!claimed, "no edit may claim the refused dep: {ledger}");
-    }
+    // And nothing else half-claims the purl (v5 writes no ledger at all).
+    vlt_hosted_common::assert_no_ledger(tmp.path());
 }
 
 /// The rewriters' own warnings must reach HUMAN mode too, not just the
@@ -2515,20 +2446,8 @@ async fn pnpm_lock_redirect_autoconfigures_trust_lockfile_and_says_so() {
          got: {detail}"
     );
 
-    // The ledger records the workspace-trust edit (created ⇒ revert deletes).
-    let ledger: serde_json::Value = serde_json::from_str(
-        &std::fs::read_to_string(pnpm.path().join(".socket/vendor/redirect-state.json")).unwrap(),
-    )
-    .unwrap();
-    assert!(
-        ledger["edits"].as_array().unwrap().iter().any(|e| {
-            e["kind"] == "redirect_pnpm_workspace_trust"
-                && e["action"] == "created"
-                && e["path"] == "pnpm-workspace.yaml"
-                && e["key"] == "trustLockfile"
-        }),
-        "the ledger must record the created workspace-trust edit: {ledger}"
-    );
+    // v5: the created workspace file is the record (no ledger edit).
+    vlt_hosted_common::assert_no_ledger(pnpm.path());
 
     // npm twin: only a package-lock.json is rewritten → no pnpm warning and
     // no workspace file materializes.
@@ -2578,14 +2497,7 @@ async fn pnpm_trust_opt_out_writes_nothing_and_keeps_manual_guidance() {
         serde_json::json!(["pnpm-lock.yaml"]),
         "only the lock may be rewritten under the opt-out: {env}"
     );
-    let ledger: serde_json::Value = serde_json::from_str(
-        &std::fs::read_to_string(tmp.path().join(".socket/vendor/redirect-state.json")).unwrap(),
-    )
-    .unwrap();
-    assert!(
-        !ledger.to_string().contains("redirect_pnpm_workspace_trust"),
-        "the opt-out must record no workspace-trust edit: {ledger}"
-    );
+    vlt_hosted_common::assert_no_ledger(tmp.path());
     let detail = env["redirect"]["warnings"]
         .as_array()
         .unwrap()
@@ -2652,14 +2564,7 @@ async fn pnpm_trust_respects_an_explicit_user_false() {
         detail.contains("--trust-lockfile"),
         "the warning must fall back to the per-run flag recovery; got: {detail}"
     );
-    let ledger: serde_json::Value = serde_json::from_str(
-        &std::fs::read_to_string(tmp.path().join(".socket/vendor/redirect-state.json")).unwrap(),
-    )
-    .unwrap();
-    assert!(
-        !ledger.to_string().contains("redirect_pnpm_workspace_trust"),
-        "no workspace-trust edit may be recorded for a respected user setting: {ledger}"
-    );
+    vlt_hosted_common::assert_no_ledger(tmp.path());
 }
 
 /// Two hardening pins on the trust-lockfile warning's host list, which lands
@@ -3250,9 +3155,9 @@ async fn run_hosted_json_scan(tmp: &std::path::Path, server: &MockServer) -> std
 /// read-only lock FILE no longer fails this leg: the atomic stage+rename
 /// replaces it mode-preserved, like the vendored backend's writer. (Legs 1-2
 /// — the discovery-detail and reference-resolve failures — are pinned by
-/// `redirect_json_mode_failures_emit_error_envelope` above; leg 4 — the
-/// ledger write — is pinned by the unix-only
-/// `redirect_ledger_write_failure_leaves_project_files_untouched` below.)
+/// `redirect_json_mode_failures_emit_error_envelope` above. The former leg 4
+/// — the ledger write — has no subject in v5: hosted mode writes no ledger,
+/// see `readonly_socket_vendor_does_not_block_a_hosted_run` below.)
 ///
 /// unix-only: a read-only directory does not block file creation on Windows.
 #[cfg(unix)]
@@ -3266,8 +3171,7 @@ async fn redirect_json_mode_write_failures_emit_error_envelope() {
     mock_reference(&server).await;
     mock_view(&server).await;
     let tmp = tempfile::tempdir().unwrap();
-    // Rush project: the lock lives in a subdirectory, so obstructing it does
-    // not also block the (earlier) `.socket/vendor` ledger write at the root.
+    // Rush project: the lock lives in a subdirectory.
     write_rush_project(tmp.path(), false);
     let lock_dir = tmp.path().join("common/config/rush");
     std::fs::set_permissions(&lock_dir, std::fs::Permissions::from_mode(0o555)).unwrap();
@@ -3276,26 +3180,22 @@ async fn redirect_json_mode_write_failures_emit_error_envelope() {
     assert_write_failure_envelope(&out, "lockfile-write failure");
 }
 
-/// Leg 4 of the four `--json` failure exits: the revert ledger cannot be
-/// persisted — `.socket/vendor` is read-only, so the atomic writer's stage
-/// file cannot be created. The ledger is written BEFORE the project files
-/// (its recorded originals are the only revert path), so the failure must
-/// also leave the lockfile untouched — not rewritten-but-unrevertable.
+/// v5 hosted mode writes nothing under `.socket/`, so a read-only
+/// `.socket/vendor` (which used to fail the run at the ledger write) no
+/// longer matters: the run succeeds and the lockfile is redirected.
 ///
-/// unix-only: the obstruction is a read-only DIRECTORY, and Windows ignores
-/// FILE_ATTRIBUTE_READONLY on directories for file creation, so the stage
-/// file would be created fine there.
+/// unix-only: the obstruction is a read-only DIRECTORY (Windows ignores
+/// FILE_ATTRIBUTE_READONLY on directories for file creation).
 #[cfg(unix)]
 #[tokio::test]
 #[serial]
-async fn redirect_ledger_write_failure_leaves_project_files_untouched() {
+async fn readonly_socket_vendor_does_not_block_a_hosted_run() {
     let server = MockServer::start().await;
     mock_discovery(&server).await;
     mock_reference(&server).await;
     mock_view(&server).await;
     let tmp = tempfile::tempdir().unwrap();
     write_project(tmp.path());
-    let lock_before = std::fs::read_to_string(tmp.path().join("package-lock.json")).unwrap();
     let vendor_dir = tmp.path().join(".socket/vendor");
     std::fs::create_dir_all(&vendor_dir).unwrap();
     let mut perms = std::fs::metadata(&vendor_dir).unwrap().permissions();
@@ -3308,23 +3208,27 @@ async fn redirect_ledger_write_failure_leaves_project_files_untouched() {
     #[allow(clippy::permissions_set_readonly_false)]
     perms.set_readonly(false);
     std::fs::set_permissions(&vendor_dir, perms).unwrap();
-    assert_write_failure_envelope(&out, "ledger-write failure");
+    let stdout = String::from_utf8_lossy(&out.stdout);
     assert_eq!(
-        std::fs::read_to_string(tmp.path().join("package-lock.json")).unwrap(),
-        lock_before,
-        "a failed ledger write must leave the project files untouched \
-         (ledger-before-files ordering)"
+        out.status.code(),
+        Some(0),
+        "stdout=\n{stdout}\nstderr=\n{}",
+        String::from_utf8_lossy(&out.stderr)
     );
+    let v: serde_json::Value = serde_json::from_str(&stdout).expect("parseable envelope");
+    assert_eq!(v["redirect"]["redirected"], 1, "{v:#}");
+    let lock = std::fs::read_to_string(tmp.path().join("package-lock.json")).unwrap();
+    assert!(lock.contains(HOSTED_URL), "{lock}");
+    vlt_hosted_common::assert_no_ledger(tmp.path());
 }
 
-/// A MALFORMED redirect ledger (torn write, truncation, bad hand-edit) must
-/// abort a hosted run before anything is written. The old tolerant load
-/// returned `None` for it, so `run_redirect` started a FRESH ledger and
-/// overwrote the corrupt file — permanently destroying every previously
-/// recorded pre-redirect original (the only revert path) with exit 0.
+/// A MALFORMED pre-v5 redirect ledger (torn write, truncation, bad
+/// hand-edit) is IGNORED by v5 hosted scan: never read for planning, never
+/// quarantined, never an error. The run succeeds and redirects, the torn
+/// bytes are left in place verbatim, and nothing about them is printed.
 #[tokio::test]
 #[serial]
-async fn corrupt_ledger_fails_closed_and_preserves_the_bytes() {
+async fn corrupt_pre_v5_ledger_is_ignored_and_left_untouched() {
     const TORN: &[u8] = b"{ \"version\": 1, \"mode\": \"hosted\", \"edits\": [ { \"path\": \"packa";
 
     let server = MockServer::start().await;
@@ -3333,80 +3237,36 @@ async fn corrupt_ledger_fails_closed_and_preserves_the_bytes() {
     mock_view(&server).await;
     let tmp = tempfile::tempdir().unwrap();
     write_project(tmp.path());
-    let lock_before = std::fs::read_to_string(tmp.path().join("package-lock.json")).unwrap();
     let vendor_dir = tmp.path().join(".socket/vendor");
     std::fs::create_dir_all(&vendor_dir).unwrap();
     std::fs::write(vendor_dir.join("redirect-state.json"), TORN).unwrap();
 
-    let out = scrubbed_cli()
-        .args([
-            "scan",
-            "--redirect",
-            "--yes",
-            "--json",
-            "--cwd",
-            tmp.path().to_str().unwrap(),
-            "--api-url",
-            &server.uri(),
-            "--org",
-            ORG,
-            "--api-token",
-            "fake",
-        ])
-        .output()
-        .expect("run socket-patch");
+    let out = run_hosted_json_scan(tmp.path(), &server).await;
     let stdout = String::from_utf8_lossy(&out.stdout);
-    assert_eq!(
-        out.status.code(),
-        Some(1),
-        "a corrupt ledger must be a hard error, not a silent fresh start; \
-         stdout=\n{stdout}"
-    );
-    let v: serde_json::Value =
-        serde_json::from_str(&stdout).expect("--json stdout must stay parseable on failure");
-    assert_eq!(v["status"], "error");
-    let message = v["error"].as_str().unwrap_or_default();
-    assert!(
-        message.contains("redirect-state.json"),
-        "error must name the ledger file: {message}"
-    );
-    assert!(
-        message.contains("redirect-state.json.corrupt"),
-        "error must point at the moved-aside file: {message}"
-    );
-    // The corruption is reported ONCE, as the engine's hard error: the
-    // read-only `updates[]` consult of the same file must not also print
-    // its advisory warning for a hosted run.
     let stderr = String::from_utf8_lossy(&out.stderr);
-    assert_eq!(
-        stderr.matches("is malformed").count(),
-        1,
-        "the corrupt-ledger message must print exactly once; stderr=\n{stderr}"
-    );
-
-    // Nothing was rewritten, and the corrupt bytes survived verbatim in the
-    // quarantine file — never overwritten by a fresh ledger.
-    assert_eq!(
-        std::fs::read_to_string(tmp.path().join("package-lock.json")).unwrap(),
-        lock_before,
-        "the project must be untouched"
+    assert_eq!(out.status.code(), Some(0), "stdout=\n{stdout}\nstderr=\n{stderr}");
+    let v: serde_json::Value = serde_json::from_str(&stdout).expect("parseable envelope");
+    assert_eq!(v["status"], "success", "{v:#}");
+    assert_eq!(v["redirect"]["redirected"], 1, "{v:#}");
+    assert!(
+        !stdout.contains("redirect-state.json") && !stderr.contains("malformed"),
+        "the legacy ledger is never mentioned; stdout=\n{stdout}\nstderr=\n{stderr}"
     );
+    let lock = std::fs::read_to_string(tmp.path().join("package-lock.json")).unwrap();
+    assert!(lock.contains(HOSTED_URL), "{lock}");
     assert_eq!(
-        std::fs::read(vendor_dir.join("redirect-state.json.corrupt")).unwrap(),
+        std::fs::read(vendor_dir.join("redirect-state.json")).unwrap(),
         TORN,
-        "the corrupt ledger bytes must be preserved for recovery"
-    );
-    assert!(
-        !vendor_dir.join("redirect-state.json").exists(),
-        "no fresh ledger may be written over the failure"
+        "the pre-v5 ledger bytes are left in place verbatim"
     );
+    assert!(!vendor_dir.join("redirect-state.json.corrupt").exists());
 }
 
-/// `--dry-run` over a corrupt ledger reports the same hard error but moves
-/// nothing: a dry run must not mutate the project, quarantine included.
+/// `--dry-run` over a corrupt pre-v5 ledger: the preview succeeds, and
+/// neither the ledger nor the lock is touched.
 #[tokio::test]
 #[serial]
-async fn corrupt_ledger_dry_run_errors_without_moving_the_file() {
+async fn corrupt_pre_v5_ledger_dry_run_succeeds_without_touching_it() {
     const TORN: &[u8] = b"{ not json";
 
     let server = MockServer::start().await;
@@ -3414,6 +3274,7 @@ async fn corrupt_ledger_dry_run_errors_without_moving_the_file() {
     mock_reference(&server).await;
     let tmp = tempfile::tempdir().unwrap();
     write_project(tmp.path());
+    let lock_before = std::fs::read(tmp.path().join("package-lock.json")).unwrap();
     let vendor_dir = tmp.path().join(".socket/vendor");
     std::fs::create_dir_all(&vendor_dir).unwrap();
     std::fs::write(vendor_dir.join("redirect-state.json"), TORN).unwrap();
@@ -3437,65 +3298,57 @@ async fn corrupt_ledger_dry_run_errors_without_moving_the_file() {
         .output()
         .expect("run socket-patch");
     let stdout = String::from_utf8_lossy(&out.stdout);
-    assert_eq!(
-        out.status.code(),
-        Some(1),
-        "dry-run must report the corruption a real run would refuse on; \
-         stdout=\n{stdout}"
-    );
+    assert_eq!(out.status.code(), Some(0), "stdout=\n{stdout}");
     assert_eq!(
         std::fs::read(vendor_dir.join("redirect-state.json")).unwrap(),
         TORN,
-        "dry-run must not move or rewrite the malformed ledger"
+        "dry-run must not move or rewrite the pre-v5 ledger"
     );
-    assert!(
-        !vendor_dir.join("redirect-state.json.corrupt").exists(),
-        "dry-run must not quarantine"
+    assert!(!vendor_dir.join("redirect-state.json.corrupt").exists());
+    assert_eq!(
+        std::fs::read(tmp.path().join("package-lock.json")).unwrap(),
+        lock_before,
+        "dry-run leaves the lock untouched"
     );
 }
 
-/// Hosted mode records patches ONLY in the redirect ledger — it never
-/// writes `.socket/manifest.json` — so `updates[]` (the documented CI
-/// signal) must consult the ledger too, or a pure hosted project whose
-/// redirected patch has been superseded reports `updates: []` forever.
+/// Hosted mode records patches ONLY in the lockfile pins — it never writes
+/// `.socket/manifest.json` (nor, in v5, a ledger) — so `updates[]` (the
+/// documented CI signal) must consult the hosted pins, or a pure hosted
+/// project whose redirected patch has been superseded reports
+/// `updates: []` forever.
 #[tokio::test]
 #[serial]
-async fn scan_updates_reports_superseding_patch_for_ledger_only_project() {
+async fn scan_updates_reports_superseding_patch_for_a_lock_pinned_project() {
     const OLD_UUID: &str = "99999999-9999-4999-8999-999999999999";
 
     let server = MockServer::start().await;
-    // Discovery offers ONLY the new uuid; the ledger records the old one.
+    // Discovery offers ONLY the new uuid; the lock pins the old one.
     mock_discovery(&server).await;
 
     let tmp = tempfile::tempdir().unwrap();
     write_project(tmp.path());
-    // Ledger-only persistence, exactly as a previous hosted run left it.
-    let mut ledger = socket_patch_core::patch::redirect::RedirectState::new();
-    ledger.records.insert(
-        PURL.to_string(),
-        PatchRecord {
-            uuid: OLD_UUID.to_string(),
-            exported_at: "2024-01-01T00:00:00Z".to_string(),
-            files: HashMap::new(),
-            vulnerabilities: HashMap::new(),
-            description: String::new(),
-            license: "MIT".to_string(),
-            tier: "free".to_string(),
-        },
-    );
-    let vendor_dir = tmp.path().join(".socket/vendor");
-    std::fs::create_dir_all(&vendor_dir).unwrap();
+    // The lock as a previous hosted run left it: pinned to OLD_UUID's
+    // hosted artifact (the only v5 hosted persistence).
+    let old_url = HOSTED_URL.replace(UUID, OLD_UUID);
+    let lock = std::fs::read_to_string(tmp.path().join("package-lock.json")).unwrap();
     std::fs::write(
-        vendor_dir.join("redirect-state.json"),
-        format!("{}\n", serde_json::to_string_pretty(&ledger).unwrap()),
+        tmp.path().join("package-lock.json"),
+        lock.replace(
+            &format!("https://registry.npmjs.org/{NAME}/-/{NAME}-{VERSION}.tgz"),
+            &old_url,
+        ),
     )
     .unwrap();
 
-    // Bare `scan --json` (hosted by default) — the nightly CI shape.
+    // Bare `scan --json` (hosted by default) — the nightly CI shape; the
+    // mock host counts as the patch server via `--patch-server-url`.
     let out = scrubbed_cli()
         .args([
             "scan",
             "--json",
+            "--patch-server-url",
+            "http://patch.test",
             "--cwd",
             tmp.path().to_str().unwrap(),
             "--api-url",
@@ -3514,7 +3367,7 @@ async fn scan_updates_reports_superseding_patch_for_ledger_only_project() {
     assert_eq!(
         updates.len(),
         1,
-        "the ledger-recorded patch was superseded — updates[] must say so; \
+        "the lock-pinned patch was superseded — updates[] must say so; \
          stdout=\n{stdout}"
     );
     assert_eq!(updates[0]["purl"], PURL);
@@ -3716,7 +3569,7 @@ async fn mock_composer_api(server: &MockServer) {
 /// having done nothing: the rewriter wrote the hosted url with `\/`-escaped
 /// slashes while the post-rewrite confirmation probe searched only the raw and
 /// percent-encoded spellings, so a fully successful rewrite yielded
-/// `redirected: 0`, no patch record in the ledger, and nothing for `vex` to
+/// `redirected: 0`, no patch record fetched, and nothing for `vex` to
 /// attest. The rewriter now emits composer-native raw slashes and the probe
 /// asks the rewriter's own predicate, so the lock edit and the confirmation
 /// cannot disagree. Subprocess so the `--json` envelope can be read back.
@@ -3760,18 +3613,17 @@ async fn composer_redirect_is_confirmed_and_recorded() {
         "dist.shasum must pin the patched artifact's sha1; got:\n{lock}"
     );
 
-    // The confirmation is what drives the record fetch: no confirmation, no
-    // record, and `socket-patch vex` can never attest the patch.
-    let ledger =
-        std::fs::read_to_string(tmp.path().join(".socket/vendor/redirect-state.json")).unwrap();
-    assert!(
-        ledger.contains(COMPOSER_PURL) && ledger.contains(GHSA),
-        "the ledger must carry the fetched patch record for the redirected purl: {ledger}"
-    );
-    assert!(
-        ledger.contains("redirect_composer_dist"),
-        "the ledger must carry the revert edit for the lock rewrite: {ledger}"
-    );
+    // The confirmation is what drives the record fetch (held in memory for
+    // the in-run VEX — v5 persists no ledger): no confirmation, no record.
+    let views = server
+        .received_requests()
+        .await
+        .unwrap_or_default()
+        .iter()
+        .filter(|r| r.url.path().contains("/patches/view/"))
+        .count();
+    assert_eq!(views, 1, "the confirmed redirect fetched its patch record");
+    vlt_hosted_common::assert_no_ledger(tmp.path());
 }
 
 /// Mount the full cargo hosted-mock set (discovery + reference + view) for
@@ -4217,12 +4069,7 @@ async fn cargo_table_form_without_lock_is_pinned_and_attested() {
         !tmp.path().join("Cargo.lock").exists(),
         "no lockfile may be invented"
     );
-    let ledger =
-        std::fs::read_to_string(tmp.path().join(".socket/vendor/redirect-state.json")).unwrap();
-    assert!(
-        ledger.contains(CARGO_UUID) && ledger.contains("GHSA-carg-cccc-dddd"),
-        "the ledger must record the landed redirect: {ledger}"
-    );
+    vlt_hosted_common::assert_no_ledger(tmp.path());
     let doc: serde_json::Value =
         serde_json::from_str(&std::fs::read_to_string(&vex_path).unwrap()).unwrap();
     let stmts = doc["statements"].as_array().unwrap();
diff --git a/crates/socket-patch-cli/tests/in_process_redirect/vlt.rs b/crates/socket-patch-cli/tests/in_process_redirect/vlt.rs
index 373455be..f90893f3 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect/vlt.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect/vlt.rs
@@ -11,20 +11,6 @@ use wiremock::{Mock, MockServer, ResponseTemplate};
 
 use crate::vlt_hosted_common::*;
 
-fn ledger(root: &Path) -> Value {
-    serde_json::from_str(&read(root, ".socket/vendor/redirect-state.json")).unwrap()
-}
-
-fn vlt_edit_keys(root: &Path) -> Vec<String> {
-    ledger(root)["edits"]
-        .as_array()
-        .into_iter()
-        .flatten()
-        .filter(|e| e["kind"] == "redirect_vlt_lock_node")
-        .map(|e| e["key"].as_str().unwrap().to_string())
-        .collect()
-}
-
 fn skipped_reasons(doc: &Value) -> Vec<String> {
     doc["redirect"]["skipped"]
         .as_array()
@@ -57,8 +43,8 @@ async fn assert_rewrites(era: Era, expected_warnings: &[&str]) {
     );
     assert_eq!(warning_codes(&doc), expected_warnings, "{doc:#}");
     assert_eq!(warning_detail(&doc, ADVISORY), ADVISORY_NOTHING_STALE);
-    assert_eq!(vlt_edit_keys(tmp.path()), ["left-pad@1.3.0"]);
-    assert!(ledger(tmp.path())["records"][PURL].is_object());
+    // v5: the lock pin is the whole record — no redirect ledger.
+    assert_no_ledger(tmp.path());
     assert_eq!(artifact_requests(&server).await, 1);
 }
 
@@ -104,15 +90,16 @@ async fn scan_redirect_refuses_vlt_lock_v2() {
     assert!(!ledger_path(tmp.path()).exists());
 }
 
+/// A re-run over the pinned lock is idempotent: still confirmed, the lock
+/// byte-identical, and (v5) still no ledger.
 #[tokio::test]
-async fn scan_redirect_vlt_rerun_noop_keeps_ledger() {
+async fn scan_redirect_vlt_rerun_is_a_noop() {
     let server = MockServer::start().await;
     mock_all(&server).await;
     let tmp = tempfile::tempdir().unwrap();
     write_vlt_project(tmp.path(), Era::V1);
     scan_hosted(tmp.path(), &server, &[], &[]);
     let lock = read(tmp.path(), "vlt-lock.json");
-    let ledger_bytes = read(tmp.path(), ".socket/vendor/redirect-state.json");
 
     let (_, doc) = scan_hosted(tmp.path(), &server, &[], &[]);
 
@@ -122,11 +109,7 @@ async fn scan_redirect_vlt_rerun_noop_keeps_ledger() {
         "a pinned lock stays confirmed: {doc:#}"
     );
     assert_eq!(read(tmp.path(), "vlt-lock.json"), lock);
-    assert_eq!(
-        read(tmp.path(), ".socket/vendor/redirect-state.json"),
-        ledger_bytes
-    );
-    assert_eq!(vlt_edit_keys(tmp.path()), ["left-pad@1.3.0"]);
+    assert_no_ledger(tmp.path());
 }
 
 #[tokio::test]
@@ -146,14 +129,7 @@ async fn scan_redirect_vlt_crlf() {
         read(tmp.path(), "vlt-lock.json"),
         lock_with(Era::V1, &[pinned_node(TILDE_ID, &server), other]).replace('\n', "\r\n")
     );
-    let original = ledger(tmp.path())["edits"][0]["original"]
-        .as_str()
-        .unwrap()
-        .to_string();
-    assert!(
-        !original.contains('\r') && !original.ends_with(','),
-        "{original:?}"
-    );
+    assert_no_ledger(tmp.path());
 }
 
 #[tokio::test]
@@ -179,10 +155,7 @@ async fn scan_redirect_vlt_peer_instances() {
             &[pinned_node(TILDE_ID, &server), pinned_node(peer, &server)]
         )
     );
-    assert_eq!(
-        vlt_edit_keys(tmp.path()),
-        ["left-pad@1.3.0", "left-pad@1.3.0~peer.2"]
-    );
+    assert_no_ledger(tmp.path());
     assert_eq!(
         artifact_requests(&server).await,
         1,
@@ -234,7 +207,7 @@ async fn scan_redirect_vlt_sibling_package_lock_vlt_installed_does_not_confirm_r
     );
     assert!(warning_codes(&doc).contains(&"redirect_vlt_unsupported_lock_key".to_string()));
     assert_eq!(read(tmp.path(), "vlt-lock.json"), lock);
-    assert!(!ledger_path(tmp.path()).exists() || ledger(tmp.path())["records"][PURL].is_null());
+    assert_no_ledger(tmp.path());
 }
 
 // ── artifact preflight ───────────────────────────────────────────────────
@@ -625,7 +598,7 @@ async fn scan_redirect_vlt_not_driving_entry_not_found_sibling_confirms() {
     );
     assert!(read(tmp.path(), "package-lock.json").contains(&artifact_url(&server)));
     assert_eq!(redirected(&doc), 1, "{doc:#}");
-    assert!(ledger(tmp.path())["records"][PURL].is_object());
+    assert_no_ledger(tmp.path());
 }
 
 /// A dep the vlt rewriter refuses is confirmed by no lock, even when vlt
@@ -656,7 +629,7 @@ async fn scan_redirect_vlt_not_driving_refused_dep_is_not_confirmed_by_the_sibli
     assert_eq!(read(tmp.path(), "vlt-lock.json"), lock);
     assert!(read(tmp.path(), "package-lock.json").contains(&artifact_url(&server)));
     assert_eq!(redirected(&doc), 0, "{doc:#}");
-    assert!(!ledger_path(tmp.path()).exists() || ledger(tmp.path())["records"][PURL].is_null());
+    assert_no_ledger(tmp.path());
 }
 
 const VENDORED_UUID: &str = "11111111-2222-4333-8444-555555555555";
diff --git a/crates/socket-patch-cli/tests/in_process_redirect_pdm.rs b/crates/socket-patch-cli/tests/in_process_redirect_pdm.rs
index da069fcb..7eb92abf 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect_pdm.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect_pdm.rs
@@ -2,20 +2,21 @@
 //! (discovery + reference + view) via wiremock, lays down a native `pdm.lock`
 //! (the committed backtest fixtures) with NO installed package — the lock-only
 //! fresh-checkout / CI shape — and asserts the lock is repointed at the hosted
-//! wheel, the redirect ledger is written, the same-run `--vex` attests the
-//! redirect, a re-scan is idempotent, and `rollback` restores every byte. It
-//! also covers the PDM-specific relock convergence: `pdm lock` un-patches the
-//! lock AND can reflow its line endings (CRLF → LF), so a re-scan must rebase
-//! the ledger onto the relocked bytes — adopting the fresh `original` — for
-//! `rollback` to still land on the relocked lock. The rewriter bytes themselves
-//! are pinned by the core `utils::pdm_lock` tests; this covers the CLI wiring.
+//! wheel, NO redirect ledger is written (v5), the same-run `--vex` attests the
+//! redirect, a re-scan is idempotent, and `rollback` restores every byte by
+//! re-resolving the upstream entry from a mocked PyPI JSON API
+//! (`SOCKET_PYPI_JSON_API`). It also covers the PDM-specific relock
+//! convergence: `pdm lock` un-patches the lock AND can reflow its line
+//! endings (CRLF → LF); a re-scan plans from the relocked bytes and
+//! `rollback` lands on the relocked lock. The rewriter bytes themselves are
+//! pinned by the core `utils::pdm_lock` tests; this covers the CLI wiring.
 //!
 //! Every flow ends with the MANIFEST-LESS VEX step ([`assert_manifestless_vex`],
 //! the shared `vex_e2e_common` helper): a fresh copy of the committed state
-//! (pyproject + lock + `.socket/`, never a manifest in hosted mode) attests the
-//! redirect from the ledger offline, from the lock + patch API with the ledger
-//! gone (`--patch-server-url` admits the fixture's non-Socket host), omits it
-//! `record_unavailable` offline with no ledger (zero requests), and omits it
+//! (pyproject + lock, never a manifest or ledger in v5 hosted mode) attests
+//! the redirect from the lock + patch API (`--patch-server-url` admits the
+//! fixture's non-Socket host), omits it `record_unavailable` offline (zero
+//! requests), attests offline from a pre-v5 ledger's record, and omits it
 //! `redirect_unwired` once the lock is reverted — `--no-verify` included.
 
 use std::path::Path;
@@ -32,15 +33,15 @@ use wiremock::{Mock, MockServer, ResponseTemplate};
 #[path = "vex_e2e_common/mod.rs"]
 mod vex_e2e_common;
 use vex_e2e_common::{
-    assert_attested, assert_not_attested, binary, git_sha256, patch_view, run_vex, strip_ledgers,
-    strip_manifest, Marker, PatchApi, VexRun,
+    assert_attested, assert_not_attested, binary, git_sha256, patch_view, run_vex, strip_manifest,
+    Marker, PatchApi, VexRun,
 };
 
 const ORG: &str = "test-org";
 /// Discovery names the base purl (the lock inventory's spelling)…
 const PURL: &str = "pkg:pypi/urllib3@1.26.18";
-/// …while the patch record carries the API's artifact-qualified purl, which is
-/// what the redirect ledger is keyed by.
+/// …while the patch record carries the API's artifact-qualified purl (what a
+/// pre-v5 redirect ledger was keyed by).
 const RECORD_PURL: &str = "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl";
 const UUID: &str = "e828efa5-5c6d-43f3-9909-03f5ac232b98";
 const HOSTED_URL: &str = "http://patch.test/patch/pypi/urllib3/1.26.18/22222222-2222-4222-8222-222222222222/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl";
@@ -72,6 +73,83 @@ fn global(cwd: &Path, api_url: String) -> GlobalArgs {
     }
 }
 
+/// The urllib3 1.26.18 release files the PDM fixtures pin, as the PyPI JSON
+/// API serves them (`GET /pypi/urllib3/1.26.18/json`).
+async fn mock_pypi(server: &MockServer) {
+    let file = |filename: &str, sha: &str, size: u64, uploaded: &str| {
+        serde_json::json!({
+            "filename": filename,
+            "url": format!("https://files.pythonhosted.org/packages/ab/cd/{filename}"),
+            "digests": { "sha256": sha },
+            "size": size,
+            "upload_time_iso_8601": uploaded,
+        })
+    };
+    Mock::given(method("GET"))
+        .and(path("/pypi/urllib3/1.26.18/json"))
+        .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+            "urls": [
+                file(
+                    "urllib3-1.26.18-py2.py3-none-any.whl",
+                    "34b97092d7e0a3a8cf7cd10e386f401b3737364026c45e622aa02903dffe0f07",
+                    143835,
+                    "2023-10-17T17:46:21.184066Z",
+                ),
+                file(
+                    "urllib3-1.26.18.tar.gz",
+                    "f8ecc1bba5667413457c529ab955bf8c67b45db799d159066261719e328580a0",
+                    305687,
+                    "2023-10-17T17:46:24.000000Z",
+                ),
+            ]
+        })))
+        .mount(server)
+        .await;
+}
+
+/// In-process `rollback` of the hosted pin: the mock patch host is named by
+/// `--patch-server-url` (so discovery finds the pin) and the upstream restore
+/// re-resolves the release from the mocked PyPI JSON API.
+async fn rollback_hosted(cwd: &Path, server: &MockServer) -> i32 {
+    mock_pypi(server).await;
+    std::env::set_var("SOCKET_PYPI_JSON_API", format!("{}/pypi", server.uri()));
+    let code = rollback::run(RollbackArgs {
+        targets: Vec::new(),
+        common: GlobalArgs {
+            patch_server_url: Some(PATCH_SERVER.to_string()),
+            ..global(cwd, server.uri())
+        },
+        one_off: false,
+        preserve_state: false,
+    })
+    .await;
+    std::env::remove_var("SOCKET_PYPI_JSON_API");
+    code
+}
+
+/// A pre-v5 redirect ledger holding `record` under `purl` (no edits).
+fn write_legacy_ledger(root: &Path, purl: &str, record: serde_json::Value) {
+    let dir = root.join(".socket/vendor");
+    std::fs::create_dir_all(&dir).unwrap();
+    std::fs::write(
+        dir.join("redirect-state.json"),
+        serde_json::to_vec_pretty(&serde_json::json!({
+            "version": 1,
+            "mode": "hosted",
+            "records": { purl: record },
+        }))
+        .unwrap(),
+    )
+    .unwrap();
+}
+
+fn assert_no_ledger(root: &Path) {
+    assert!(
+        !root.join(".socket/vendor/redirect-state.json").exists(),
+        "v5 hosted mode writes no redirect ledger"
+    );
+}
+
 fn hosted_args(cwd: &Path, api_url: String, vex: Option<&Path>) -> ScanArgs {
     ScanArgs {
         paths: Vec::new(),
@@ -207,15 +285,13 @@ fn assert_manifestless_vex(root: &Path, pristine_lock: &str) {
 
 fn manifestless_vex_steps(root: &Path, pristine_lock: &str) {
     let vulns: &[(&str, &[&str])] = &[(GHSA, &["CVE-2025-66418"])];
-    let api = PatchApi::start(vec![(
-        UUID.to_string(),
-        patch_view(
-            UUID,
-            RECORD_PURL,
-            &[("urllib3/response.py", &git_sha256(PATCHED))],
-            vulns,
-        ),
-    )]);
+    let view = patch_view(
+        UUID,
+        RECORD_PURL,
+        &[("urllib3/response.py", &git_sha256(PATCHED))],
+        vulns,
+    );
+    let api = PatchApi::start(vec![(UUID.to_string(), view.clone())]);
     let online = || VexRun {
         patch_server_url: Some(PATCH_SERVER.to_string()),
         ..VexRun::online(&api)
@@ -228,27 +304,12 @@ fn manifestless_vex_steps(root: &Path, pristine_lock: &str) {
     std::fs::copy(root.join("pyproject.toml"), copy.join("pyproject.toml")).unwrap();
     copy_dir(&root.join(".socket"), &copy.join(".socket"));
     strip_manifest(copy);
+    assert_no_ledger(copy);
 
-    // (1) ledger kept: attested offline from the ledger record (zero
-    // network), and online. Nothing is installed, so the basis is the
-    // lock's sha256 pin — which counts only once `--patch-server-url` makes
-    // the lock's url a discovered hosted reference.
-    let offline_ledger = VexRun {
-        offline: true,
-        patch_server_url: Some(PATCH_SERVER.to_string()),
-        ..VexRun::default()
-    };
-    for (i, run) in [offline_ledger, online()].into_iter().enumerate() {
-        let out = run_vex(&binary(), copy, &run);
-        assert_eq!(out.code, Some(0), "{out}");
-        assert_attested(out.doc(), PURL, UUID, Marker::Redirected, vulns);
-        if i == 0 {
-            api.assert_no_requests();
-        }
-    }
-
-    // (2) ledgers gone: the lock alone, the record from the patch API.
-    strip_ledgers(copy);
+    // (1) The lock alone, the record from the patch API. Nothing is
+    // installed, so the basis is the lock's sha256 pin — which counts only
+    // once `--patch-server-url` makes the lock's url a discovered hosted
+    // reference.
     let out = run_vex(&binary(), copy, &online());
     assert_eq!(out.code, Some(0), "{out}");
     assert_attested(out.doc(), PURL, UUID, Marker::Redirected, vulns);
@@ -258,7 +319,7 @@ fn manifestless_vex_steps(root: &Path, pristine_lock: &str) {
     assert_eq!(out.code, Some(2), "{out}");
     assert_eq!(out.envelope["error"]["code"], "manifest_not_found", "{out}");
 
-    // (3) offline with no ledger: nothing local to attest from, no network.
+    // (2) offline with no local record: nothing to attest from, no network.
     let quiet = PatchApi::empty();
     let offline = VexRun {
         offline: true,
@@ -270,12 +331,20 @@ fn manifestless_vex_steps(root: &Path, pristine_lock: &str) {
     assert_not_attested(&out.envelope, PURL, "record_unavailable");
     quiet.assert_no_requests();
 
-    // (4) lock reverted to the registry, ledger kept: dead claim.
+    // (3) a pre-v5 ledger's record is an extra local record source: the
+    // same offline run now attests, still with zero requests.
+    write_legacy_ledger(copy, RECORD_PURL, legacy_record(&view));
+    let out = run_vex(&binary(), copy, &offline);
+    assert_eq!(out.code, Some(0), "{out}");
+    assert_attested(out.doc(), PURL, UUID, Marker::Redirected, vulns);
+    quiet.assert_no_requests();
+
+    // (4) lock reverted to the registry, that ledger kept: dead claim.
     let tmp2 = tempfile::tempdir().unwrap();
     let reverted = tmp2.path();
     write_project(reverted, pristine_lock);
     std::fs::copy(root.join("pyproject.toml"), reverted.join("pyproject.toml")).unwrap();
-    copy_dir(&root.join(".socket"), &reverted.join(".socket"));
+    copy_dir(&copy.join(".socket"), &reverted.join(".socket"));
     strip_manifest(reverted);
     for no_verify in [false, true] {
         let out = run_vex(
@@ -291,7 +360,25 @@ fn manifestless_vex_steps(root: &Path, pristine_lock: &str) {
     }
 }
 
+/// A pre-v5 ledger record (the `PatchRecord` shape) from a view body.
+fn legacy_record(view: &serde_json::Value) -> serde_json::Value {
+    let mut record = view.clone();
+    let obj = record.as_object_mut().unwrap();
+    obj.remove("purl");
+    let exported = obj
+        .remove("publishedAt")
+        .unwrap_or_else(|| serde_json::json!("2024-01-01T00:00:00Z"));
+    obj.insert("exportedAt".to_string(), exported);
+    obj.entry("description").or_insert_with(|| serde_json::json!("x"));
+    obj.entry("license").or_insert_with(|| serde_json::json!("MIT"));
+    obj.entry("tier").or_insert_with(|| serde_json::json!("free"));
+    record
+}
+
 fn copy_dir(from: &Path, to: &Path) {
+    if !from.is_dir() {
+        return;
+    }
     std::fs::create_dir_all(to).unwrap();
     for entry in std::fs::read_dir(from).unwrap().flatten() {
         let target = to.join(entry.file_name());
@@ -338,20 +425,11 @@ async fn lock_only_pdm_project_redirects_attests_rescans_and_rolls_back() {
         PYPROJECT,
         "pyproject untouched"
     );
-    let ledger: serde_json::Value =
-        serde_json::from_str(&read(&tmp.path().join(".socket/vendor/redirect-state.json"))).unwrap();
-    assert!(
-        ledger["records"][RECORD_PURL].is_object(),
-        "ledger keyed by the artifact-qualified purl: {ledger}"
-    );
-    assert_eq!(
-        ledger["edits"][0]["kind"].as_str(),
-        Some("redirect_pdm_lock_package"),
-        "{ledger}"
-    );
-    // The redirect is attested from the ledger even though the base purl the
-    // run confirmed differs from the record's qualified purl only by its
-    // `?artifact_id=` qualifier (the shared qualifier-strip in vex).
+    assert_no_ledger(tmp.path());
+    // The redirect is attested from this run's fetched record even though
+    // the base purl the run confirmed differs from the record's qualified
+    // purl only by its `?artifact_id=` qualifier (the shared qualifier-strip
+    // in vex).
     let vex: serde_json::Value = serde_json::from_str(&read(&vex_path)).unwrap();
     let statements = vex["statements"].as_array().expect("statements");
     assert_eq!(statements.len(), 1, "{vex}");
@@ -369,30 +447,15 @@ async fn lock_only_pdm_project_redirects_attests_rescans_and_rolls_back() {
     // 3. The committed state, manifest-less, attests (and only while wired).
     assert_manifestless_vex(tmp.path(), LOCK);
 
-    // 4. rollback unwinds the redirect and drops the record.
-    let code = rollback::run(RollbackArgs {
-        targets: Vec::new(),
-        common: global(tmp.path(), server.uri()),
-        one_off: false,
-        preserve_state: false,
-    })
-    .await;
+    // 4. rollback restores the upstream registry entry.
+    let code = rollback_hosted(tmp.path(), &server).await;
     assert_eq!(code, 0, "rollback must succeed");
     assert_eq!(
         read(&lock_path),
         LOCK,
         "rollback must restore the pristine lock byte for byte"
     );
-    let ledger_path = tmp.path().join(".socket/vendor/redirect-state.json");
-    if ledger_path.exists() {
-        let ledger: serde_json::Value = serde_json::from_str(&read(&ledger_path)).unwrap();
-        assert!(
-            ledger["records"]
-                .as_object()
-                .is_none_or(|records| records.is_empty()),
-            "no redirect record may survive rollback: {ledger}"
-        );
-    }
+    assert_no_ledger(tmp.path());
 }
 
 /// A PDM project whose `pyproject.toml` names `hatchling` as its build
@@ -400,7 +463,7 @@ async fn lock_only_pdm_project_redirects_attests_rescans_and_rolls_back() {
 /// for such a project and then yields to the lock without confirming any, so
 /// hosted confirmation must key off the pdm rewriter's own report BEFORE the
 /// hatch gate can veto it — otherwise the lock is rewritten but nothing is
-/// recorded or attested.
+/// confirmed or attested.
 #[tokio::test]
 #[serial]
 async fn hatchling_build_backend_does_not_veto_the_pdm_lock_redirect() {
@@ -423,26 +486,19 @@ async fn hatchling_build_backend_does_not_veto_the_pdm_lock_redirect() {
         pyproject,
         "pyproject untouched"
     );
-    let ledger: serde_json::Value =
-        serde_json::from_str(&read(&tmp.path().join(".socket/vendor/redirect-state.json"))).unwrap();
-    assert!(
-        ledger["records"][RECORD_PURL].is_object(),
-        "the pdm redirect must be confirmed and recorded despite the hatch backend: {ledger}"
-    );
-    assert_eq!(
-        ledger["edits"][0]["kind"].as_str(),
-        Some("redirect_pdm_lock_package"),
-        "{ledger}"
-    );
+    assert_no_ledger(tmp.path());
+    // Confirmed despite the hatch backend: the record was fetched.
+    let views = server
+        .received_requests()
+        .await
+        .unwrap_or_default()
+        .iter()
+        .filter(|r| r.url.path().ends_with(&format!("/patches/view/{UUID}")))
+        .count();
+    assert_eq!(views, 1, "the pdm redirect must be confirmed despite the hatch backend");
     assert_manifestless_vex(tmp.path(), LOCK);
 
-    let code = rollback::run(RollbackArgs {
-        targets: Vec::new(),
-        common: global(tmp.path(), server.uri()),
-        one_off: false,
-        preserve_state: false,
-    })
-    .await;
+    let code = rollback_hosted(tmp.path(), &server).await;
     assert_eq!(code, 0, "rollback must succeed");
     assert_eq!(read(&lock_path), LOCK, "rollback must restore the pristine lock");
 }
@@ -462,33 +518,32 @@ async fn legacy_metadata_files_lock_redirects_both_fragments_and_warns() {
     assert_eq!(code, 0);
     let redirected = read(&lock_path);
     assert!(redirected.contains(HOSTED_URL), "{redirected}");
-    let ledger: serde_json::Value =
-        serde_json::from_str(&read(&tmp.path().join(".socket/vendor/redirect-state.json"))).unwrap();
-    assert_eq!(
-        ledger["edits"].as_array().unwrap().len(),
-        2,
-        "package unit + [metadata.files] entry: {ledger}"
+    assert!(
+        redirected.contains(&format!("url = \"{HOSTED_URL}\"")),
+        "the package unit gains the hosted url: {redirected}"
+    );
+    assert!(
+        redirected.contains(&format!(
+            "\"urllib3 1.26.18\" = [{{ file = \"urllib3-1.26.18-py2.py3-none-any.whl\", \
+             hash = \"sha256:{}\" }}]",
+            sha256()
+        )),
+        "the [metadata.files] entry pins the patched wheel: {redirected}"
     );
+    assert_no_ledger(tmp.path());
     assert_manifestless_vex(tmp.path(), LOCK_LEGACY);
 
     // rollback restores both fragments byte for byte.
-    let code = rollback::run(RollbackArgs {
-        targets: Vec::new(),
-        common: global(tmp.path(), server.uri()),
-        one_off: false,
-        preserve_state: false,
-    })
-    .await;
+    let code = rollback_hosted(tmp.path(), &server).await;
     assert_eq!(code, 0);
     assert_eq!(read(&lock_path), LOCK_LEGACY, "byte-identical revert");
 }
 
 /// `pdm lock` un-patches the lock (registry source restored) and — this is the
 /// PDM-specific hazard — can reflow its line endings (CRLF → LF). The re-scan
-/// must rebase the ledger onto the relocked bytes, adopting the fresh
-/// `original`, so `rollback` lands on the RELOCKED lock rather than restoring a
-/// stale CRLF fragment into an LF file. Appending instead would leave a chain
-/// whose older link matches nothing and make rollback refuse.
+/// plans from the relocked bytes (v5 keeps no ledger to rebase), and
+/// `rollback` lands on the RELOCKED lock: the upstream entry re-resolved in
+/// the file's current (LF) line endings, never a stale CRLF fragment.
 #[tokio::test]
 #[serial]
 async fn relock_reflow_then_rescan_keeps_rollback_invertible() {
@@ -511,45 +566,28 @@ async fn assert_relock_roundtrip(lock: &str, relocked: &str) {
     assert_eq!(run(hosted_args(tmp.path(), server.uri(), None)).await, 0);
     let redirected = read(&lock_path);
     assert!(redirected.contains(HOSTED_URL));
-    let ledger_path = tmp.path().join(".socket/vendor/redirect-state.json");
-    let before: serde_json::Value = serde_json::from_str(&read(&ledger_path)).unwrap();
-    let n_edits = before["edits"].as_array().unwrap().len();
+    assert_no_ledger(tmp.path());
 
     // The user runs `pdm lock`: the patch is gone and the file is LF now.
     assert!(!relocked.contains(HOSTED_URL), "relock un-patches the lock");
     std::fs::write(&lock_path, relocked).unwrap();
 
-    // Re-scan re-applies and rebases the ledger (no appended chain).
+    // Re-scan re-applies from the relocked bytes.
     assert_eq!(run(hosted_args(tmp.path(), server.uri(), None)).await, 0);
     let rescanned = read(&lock_path);
     assert!(rescanned.contains(HOSTED_URL), "the re-scan re-redirects");
-    let after: serde_json::Value = serde_json::from_str(&read(&ledger_path)).unwrap();
-    let edits = after["edits"].as_array().unwrap();
-    assert_eq!(edits.len(), n_edits, "rebased, not appended: {after}");
-    for edit in edits {
-        let original = edit["original"].as_str().unwrap();
-        assert!(
-            !original.contains(HOSTED_URL),
-            "originals describe the relocked registry lock: {original}"
-        );
-        assert!(
-            rescanned.contains(edit["new"].as_str().unwrap()),
-            "new fragments describe the current lock: {after}"
-        );
-    }
-    // The rebased ledger + re-redirected (relocked) lock attest; reverting
-    // to the relocked registry lock unwires it.
+    assert!(
+        !rescanned.contains('\r'),
+        "the re-scan keeps the relocked LF line endings"
+    );
+    assert_no_ledger(tmp.path());
+    // The re-redirected (relocked) lock attests; reverting to the relocked
+    // registry lock unwires it.
     assert_manifestless_vex(tmp.path(), relocked);
 
     // rollback lands on the relocked (LF, registry) lock — the user's `pdm
     // lock` is preserved, only the Socket patch is unwound.
-    let code = rollback::run(RollbackArgs {
-        targets: Vec::new(),
-        common: global(tmp.path(), server.uri()),
-        one_off: false,
-        preserve_state: false,
-    })
-    .await;
+    let code = rollback_hosted(tmp.path(), &server).await;
     assert_eq!(code, 0, "rollback after relock + re-scan must succeed");
     assert_eq!(
         read(&lock_path),
diff --git a/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs b/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs
index 43d789de..b176e9a6 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs
@@ -7,7 +7,9 @@
 //! * the lock-only fresh-checkout shape (nothing installed) is discovered
 //!   from `Pipfile.lock` alone, repointed with a `file` reference carrying
 //!   the `#sha256=` fragment and a matching `hashes` entry, attested by the
-//!   same-run `--vex`, re-scanned idempotently and rolled back byte for byte;
+//!   same-run `--vex`, re-scanned idempotently and rolled back byte for byte
+//!   (v5: no redirect ledger is written; `rollback` re-resolves the upstream
+//!   entry from a mocked PyPI JSON API, `SOCKET_PYPI_JSON_API`);
 //! * `SOCKET_PIPENV_MAJOR=11` selects the legacy `path` reference shape the
 //!   installer probe would otherwise need a real Pipenv 7–11 on PATH for;
 //! * a stale `Pipfile.lock` that does not pin the package does not veto
@@ -16,8 +18,8 @@
 //!   out of the same-run attestation.
 //!
 //! Every flow ends with the manifest-less VEX steps (`vex_pipenv_pip_steps`)
-//! over a copy of the committed state it produced: manifest deleted,
-//! ledgers deleted too, `--offline` (`record_unavailable`, zero requests),
+//! over a copy of the committed state it produced: no manifest and no ledger,
+//! `--offline` (`record_unavailable`, zero requests),
 //! the lock reverted to the registry (`redirect_unwired`, `--no-verify`
 //! too) and `apply --vex` — and, for the warm venv, `not_applied` whatever
 //! the lock says.
@@ -44,8 +46,7 @@ use vex_pipenv_pip_steps::{run_manifestless_steps, Records, Steps};
 const ORG: &str = "test-org";
 /// Discovery names the base purl (the lockfile supplement's spelling)…
 const PURL: &str = "pkg:pypi/urllib3@1.26.18";
-/// …while the patch record carries the API's artifact-qualified purl, which
-/// is what the redirect ledger is keyed by.
+/// …while the patch record carries the API's artifact-qualified purl.
 const RECORD_PURL: &str = "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl";
 const UUID: &str = "e828efa5-5c6d-43f3-9909-03f5ac232b98";
 const HOSTED_URL: &str = "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/22222222-2222-4222-8222-222222222222/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl";
@@ -272,15 +273,62 @@ fn urllib3_entry(lock: &str) -> serde_json::Value {
     value["default"]["urllib3"].clone()
 }
 
-async fn roll_back(cwd: &Path, api_url: String) {
+/// The urllib3 1.26.18 release files the Pipenv fixture pins, as the PyPI
+/// JSON API serves them (`GET /pypi/urllib3/1.26.18/json`).
+async fn mock_pypi(server: &MockServer) {
+    let file = |filename: &str, sha: &str, size: u64, uploaded: &str| {
+        serde_json::json!({
+            "filename": filename,
+            "url": format!("https://files.pythonhosted.org/packages/ab/cd/{filename}"),
+            "digests": { "sha256": sha },
+            "size": size,
+            "upload_time_iso_8601": uploaded,
+        })
+    };
+    Mock::given(method("GET"))
+        .and(path("/pypi/urllib3/1.26.18/json"))
+        .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+            "urls": [
+                file(
+                    "urllib3-1.26.18-py2.py3-none-any.whl",
+                    "34b97092d7e0a3a8cf7cd10e386f401b3737364026c45e622aa02903dffe0f07",
+                    143835,
+                    "2023-10-17T17:46:21.184066Z",
+                ),
+                file(
+                    "urllib3-1.26.18.tar.gz",
+                    "f8ecc1bba5667413457c529ab955bf8c67b45db799d159066261719e328580a0",
+                    305687,
+                    "2023-10-17T17:46:24.000000Z",
+                ),
+            ]
+        })))
+        .mount(server)
+        .await;
+}
+
+/// In-process `rollback`: the hosted pin (on patch.socket.dev) is restored
+/// to its upstream entry, re-resolved from the mocked PyPI JSON API.
+async fn roll_back(cwd: &Path, server: &MockServer) {
+    mock_pypi(server).await;
+    std::env::set_var("SOCKET_PYPI_JSON_API", format!("{}/pypi", server.uri()));
     let code = rollback::run(RollbackArgs {
         targets: Vec::new(),
-        common: global(cwd, api_url),
+        common: global(cwd, server.uri()),
         one_off: false,
         preserve_state: false,
     })
     .await;
+    std::env::remove_var("SOCKET_PYPI_JSON_API");
     assert_eq!(code, 0, "rollback must succeed");
+    assert_no_ledger(cwd);
+}
+
+fn assert_no_ledger(root: &Path) {
+    assert!(
+        !root.join(".socket/vendor/redirect-state.json").exists(),
+        "v5 hosted mode writes no redirect ledger"
+    );
 }
 
 #[tokio::test]
@@ -309,7 +357,12 @@ async fn lock_only_pipenv_project_redirects_attests_rescans_and_rolls_back() {
         serde_json::json!([format!("sha256:{}", sha256())]),
         "{redirected}"
     );
-    assert!(entry.get("version").is_none() && entry.get("index").is_none(), "{entry}");
+    assert!(entry.get("version").is_none(), "{entry}");
+    assert_eq!(
+        entry.get("index"),
+        urllib3_entry(LOCK).get("index"),
+        "Pipenv's own index is kept for rollback"
+    );
     assert_eq!(
         entry["markers"],
         urllib3_entry(LOCK)["markers"],
@@ -319,25 +372,10 @@ async fn lock_only_pipenv_project_redirects_attests_rescans_and_rolls_back() {
     let after: serde_json::Value = serde_json::from_str(&redirected).unwrap();
     assert_eq!(after["_meta"], before["_meta"], "the Pipfile content hash stays");
     assert_eq!(read(&tmp.path().join("Pipfile")), PIPFILE, "Pipfile untouched");
-    let ledger: serde_json::Value =
-        serde_json::from_str(&read(&tmp.path().join(".socket/vendor/redirect-state.json")))
-            .unwrap();
-    assert!(
-        ledger["records"][RECORD_PURL].is_object(),
-        "ledger keyed by the artifact-qualified purl: {ledger}"
-    );
-    assert_eq!(
-        ledger["edits"][0]["kind"].as_str(),
-        Some("redirect_pipenv_entry"),
-        "{ledger}"
-    );
-    assert_eq!(
-        ledger["edits"][0]["key"].as_str(),
-        Some(r#"["default","urllib3"]"#),
-        "{ledger}"
-    );
-    // Attested from the ledger (assume_applied) although the base purl the
-    // run confirmed differs from the record's qualified purl.
+    assert_no_ledger(tmp.path());
+    // Attested from this run's fetched record (keyed by RECORD_PURL, assume
+    // applied) although the base purl the run confirmed differs from the
+    // record's qualified purl.
     let vex: serde_json::Value = serde_json::from_str(&read(&vex_path)).unwrap();
     let statements = vex["statements"].as_array().expect("statements");
     assert_eq!(statements.len(), 1, "{vex}");
@@ -348,29 +386,16 @@ async fn lock_only_pipenv_project_redirects_attests_rescans_and_rolls_back() {
     let code = run(hosted_args(tmp.path(), server.uri(), None)).await;
     assert_eq!(code, 0);
     assert_eq!(read(&lock_path), redirected, "re-scan must not touch the lock");
-    let ledger: serde_json::Value =
-        serde_json::from_str(&read(&tmp.path().join(".socket/vendor/redirect-state.json")))
-            .unwrap();
-    assert_eq!(ledger["edits"].as_array().map(Vec::len), Some(1), "one edit, not two");
+    assert_no_ledger(tmp.path());
 
     // Manifest-less VEX over the committed state (the depscan / CI shape).
     manifestless_vex(tmp.path(), "pipenv lock-only", &|p: &Path| {
         std::fs::write(p.join("Pipfile.lock"), LOCK).unwrap();
     });
 
-    // 3. rollback unwinds the redirect and drops the record.
-    roll_back(tmp.path(), server.uri()).await;
+    // 3. rollback restores the upstream registry entry.
+    roll_back(tmp.path(), &server).await;
     assert_eq!(read(&lock_path), LOCK, "rollback must restore the pristine lock byte for byte");
-    let ledger_path = tmp.path().join(".socket/vendor/redirect-state.json");
-    if ledger_path.exists() {
-        let ledger: serde_json::Value = serde_json::from_str(&read(&ledger_path)).unwrap();
-        assert!(
-            ledger["records"]
-                .as_object()
-                .is_none_or(|records| records.is_empty()),
-            "no redirect record may survive rollback: {ledger}"
-        );
-    }
 }
 
 #[tokio::test]
@@ -400,7 +425,7 @@ async fn legacy_installer_major_selects_path_references() {
         std::fs::write(p.join("Pipfile.lock"), LOCK).unwrap();
     });
 
-    roll_back(tmp.path(), server.uri()).await;
+    roll_back(tmp.path(), &server).await;
     assert_eq!(read(&lock_path), LOCK);
 }
 
@@ -416,7 +441,11 @@ async fn stale_pipfile_lock_does_not_veto_the_requirements_redirect() {
     // installs from requirements.txt.
     let stale = LOCK.replace("\"urllib3\"", "\"six\"").replace("==1.26.18", "==1.16.0");
     std::fs::write(tmp.path().join("Pipfile.lock"), &stale).unwrap();
-    std::fs::write(tmp.path().join("requirements.txt"), "urllib3==1.26.18\n").unwrap();
+    // An unpatched, unhashed sibling makes the file's hash mode derivable,
+    // so rollback can restore the hosted line (a file whose every line is a
+    // hosted pin is refused with the `git checkout` remedy instead).
+    const REQS: &str = "urllib3==1.26.18\nrequests==2.31.0\n";
+    std::fs::write(tmp.path().join("requirements.txt"), REQS).unwrap();
 
     let code = run(hosted_args(tmp.path(), server.uri(), None)).await;
     assert_eq!(code, 0);
@@ -434,13 +463,13 @@ async fn stale_pipfile_lock_does_not_veto_the_requirements_redirect() {
     // The requirements wiring attests manifest-less; the stale lock beside
     // it neither vetoes nor contributes.
     manifestless_vex(tmp.path(), "requirements past a stale lock", &|p: &Path| {
-        std::fs::write(p.join("requirements.txt"), "urllib3==1.26.18\n").unwrap();
+        std::fs::write(p.join("requirements.txt"), REQS).unwrap();
     });
 
-    roll_back(tmp.path(), server.uri()).await;
+    roll_back(tmp.path(), &server).await;
     assert_eq!(
         read(&tmp.path().join("requirements.txt")),
-        "urllib3==1.26.18\n"
+        REQS
     );
     assert_eq!(read(&tmp.path().join("Pipfile.lock")), stale);
 }
@@ -468,7 +497,7 @@ async fn warm_venv_with_the_upstream_release_is_not_attested() {
         .then(|| serde_json::from_str::<serde_json::Value>(&read(&vex_path)).unwrap())
         .and_then(|v| v["statements"].as_array().map(Vec::len))
         .unwrap_or(0);
-    assert_eq!(attested, 0, "a stale install must not be attested from the ledger");
+    assert_eq!(attested, 0, "a stale install must not be attested from the fetched record");
     assert_ne!(code, 0, "nothing to attest fails the embedded-VEX run");
     assert_eq!(
         std::fs::read(site_packages(tmp.path()).join("urllib3").join("response.py")).unwrap(),
@@ -476,38 +505,34 @@ async fn warm_venv_with_the_upstream_release_is_not_attested() {
         "the probe is read-only"
     );
 
+    assert_no_ledger(tmp.path());
+
     // Manifest-less: the installed UPSTREAM copy is the evidence, whatever
-    // the lock and the ledger say — `not_applied`, with or without the
-    // ledger, online.
+    // the lock says — `not_applied`, online (the record from the API).
     std::thread::scope(|scope| {
         scope
             .spawn(|| {
                 let api = vex_e2e_common::PatchApi::start(vec![(UUID.to_string(), view_body())]);
-                for strip_ledgers in [false, true] {
-                    let scratch = tempfile::tempdir().unwrap();
-                    let p = scratch.path().join("proj");
-                    vex_pipenv_pip_steps::copy_tree(tmp.path(), &p);
-                    vex_e2e_common::strip_manifest(&p);
-                    if strip_ledgers {
-                        vex_e2e_common::strip_ledgers(&p);
-                    }
-                    let out = vex_e2e_common::run_vex(
-                        &vex_e2e_common::binary(),
-                        &p,
-                        &vex_e2e_common::VexRun {
-                            product: Some(VEX_PRODUCT.into()),
-                            ..vex_e2e_common::VexRun::online(&api)
-                        },
-                    );
-                    assert_eq!(out.code, Some(1), "ledgers stripped={strip_ledgers}: {out}");
-                    vex_e2e_common::assert_absent(out.doc.as_ref(), PURL);
-                    vex_e2e_common::assert_not_attested(&out.envelope, PURL, "not_applied");
-                }
+                let scratch = tempfile::tempdir().unwrap();
+                let p = scratch.path().join("proj");
+                vex_pipenv_pip_steps::copy_tree(tmp.path(), &p);
+                vex_e2e_common::strip_manifest(&p);
+                let out = vex_e2e_common::run_vex(
+                    &vex_e2e_common::binary(),
+                    &p,
+                    &vex_e2e_common::VexRun {
+                        product: Some(VEX_PRODUCT.into()),
+                        ..vex_e2e_common::VexRun::online(&api)
+                    },
+                );
+                assert_eq!(out.code, Some(1), "{out}");
+                vex_e2e_common::assert_absent(out.doc.as_ref(), PURL);
+                vex_e2e_common::assert_not_attested(&out.envelope, PURL, "not_applied");
             })
             .join()
             .unwrap_or_else(|e| std::panic::resume_unwind(e));
     });
 
-    roll_back(tmp.path(), server.uri()).await;
+    roll_back(tmp.path(), &server).await;
     assert_eq!(read(&lock_path), LOCK);
 }
diff --git a/crates/socket-patch-cli/tests/in_process_redirect_pnpm.rs b/crates/socket-patch-cli/tests/in_process_redirect_pnpm.rs
index 9ceacd24..03da8fcd 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect_pnpm.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect_pnpm.rs
@@ -4,14 +4,16 @@
 //! view) via wiremock, lays down a pnpm project whose only lockfile is a root
 //! `pnpm-lock.yaml`, runs the redirect, and asserts the patched package's
 //! `resolution:` was spliced to `{integrity: sha512-<patched>, tarball:
-//! <hosted url>}` (the shape the shared golden `npm/pnpm` fixture pins) with a
-//! `redirect_pnpm_resolution` edit recorded in the revert ledger.
+//! <hosted url>}` (the shape the shared golden `npm/pnpm` fixture pins) — and,
+//! v5, that no redirect ledger is written: `rollback` restores the upstream
+//! entry from the (mocked) npm registry instead.
 //!
 //! `in_process_redirect.rs` covers pnpm ONLY through the Rush nested-lock
 //! path; these tests pin the plain single-project pnpm root-lock rewrite plus
 //! its idempotency and the `--vex` `(redirected)` attestation.
 
 use serial_test::serial;
+use socket_patch_cli::commands::rollback::{self, RollbackArgs};
 use socket_patch_cli::commands::scan::{run, ScanArgs, ScanMode};
 use std::path::Path;
 
@@ -30,6 +32,49 @@ const PATCHED_SHA512: &str = "sha512-PATCHEDpatchedPATCHEDpatched0123456789==";
 const UPSTREAM_SHA512: &str = "sha512-UPSTREAMupstream==";
 const GHSA: &str = "GHSA-rdir-pnpm-bbbb";
 
+fn assert_no_ledger(root: &Path) {
+    assert!(
+        !root.join(".socket/vendor/redirect-state.json").exists(),
+        "v5 hosted mode writes no redirect ledger"
+    );
+}
+
+/// In-process `rollback` of the hosted pin: the mock patch host is named by
+/// `--patch-server-url` (so discovery finds the pin) and the upstream restore
+/// re-resolves `NAME@VERSION` from a mocked npm registry serving
+/// `UPSTREAM_SHA512`.
+async fn rollback_hosted(cwd: &Path, server: &MockServer) -> i32 {
+    Mock::given(method("GET"))
+        .and(path(format!("/npm-registry/{NAME}/{VERSION}")))
+        .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+            "name": NAME,
+            "version": VERSION,
+            "dist": {
+                "tarball": format!("{}/npm-registry/{NAME}/-/{NAME}-{VERSION}.tgz", server.uri()),
+                "integrity": UPSTREAM_SHA512,
+            }
+        })))
+        .mount(server)
+        .await;
+    std::env::set_var("SOCKET_NPM_REGISTRY", format!("{}/npm-registry", server.uri()));
+    let code = rollback::run(RollbackArgs {
+        targets: Vec::new(),
+        common: socket_patch_cli::args::GlobalArgs {
+            cwd: cwd.to_path_buf(),
+            json: true,
+            yes: true,
+            silent: true,
+            patch_server_url: Some("http://patch.test".to_string()),
+            ..socket_patch_cli::args::GlobalArgs::default()
+        },
+        one_off: false,
+        preserve_state: false,
+    })
+    .await;
+    std::env::remove_var("SOCKET_NPM_REGISTRY");
+    code
+}
+
 /// `--mode hosted` (the documented spelling; the hidden `--redirect` boolean
 /// folds into it).
 fn hosted_args(cwd: &Path, api_url: String) -> ScanArgs {
@@ -113,7 +158,7 @@ async fn mock_reference(server: &MockServer) {
         .await;
 }
 
-/// `view/{uuid}` — the patch record persisted into the redirect ledger for VEX.
+/// `view/{uuid}` — the patch record the in-run VEX attests from (in memory).
 async fn mock_view(server: &MockServer) {
     Mock::given(method("GET"))
         .and(path(format!("/v0/orgs/{ORG}/patches/view/{UUID}")))
@@ -187,9 +232,9 @@ snapshots:
 
 /// (a) The pnpm root-lock rewrite: the `resolution:` for the patched package
 /// gains the `tarball:` key pointing at the hosted patch and its integrity
-/// becomes the patched sha512, the upstream integrity is gone, a
-/// `redirect_pnpm_resolution` edit lands in the ledger, and a second run adds
-/// zero edits (idempotent).
+/// becomes the patched sha512, the upstream integrity is gone, no ledger is
+/// written, a second run is a byte-stable no-op, and `rollback` restores the
+/// pristine lock AND removes the auto-created pnpm-workspace.yaml.
 #[tokio::test]
 #[serial]
 async fn hosted_rewrites_pnpm_root_lock_resolution() {
@@ -199,6 +244,7 @@ async fn hosted_rewrites_pnpm_root_lock_resolution() {
 
     let tmp = tempfile::tempdir().unwrap();
     write_pnpm_project(tmp.path());
+    let pristine_lock = std::fs::read_to_string(tmp.path().join("pnpm-lock.yaml")).unwrap();
 
     let code = run(hosted_args(tmp.path(), server.uri())).await;
     assert_eq!(code, 0, "scan --mode hosted should succeed for pnpm");
@@ -227,27 +273,12 @@ async fn hosted_rewrites_pnpm_root_lock_resolution() {
         "the importer/snapshot keys must be preserved; got:\n{lock}"
     );
 
-    let ledger_path = tmp.path().join(".socket/vendor/redirect-state.json");
-    let first: serde_json::Value =
-        serde_json::from_str(&std::fs::read_to_string(&ledger_path).unwrap()).unwrap();
-    let edits = first["edits"].as_array().unwrap();
-    assert!(
-        edits
-            .iter()
-            .any(|e| e["kind"] == "redirect_pnpm_resolution"
-                && e["key"] == format!("{NAME}@{VERSION}")),
-        "the ledger must record a redirect_pnpm_resolution edit: {first}"
-    );
-    // The ORIGINAL upstream integrity is preserved for revert.
-    assert!(
-        first.to_string().contains("UPSTREAMupstream"),
-        "the ledger must preserve the original upstream integrity for revert: {first}"
-    );
+    assert_no_ledger(tmp.path());
 
     // Zero-touch trust config: a rewritten root v9 lock auto-creates
     // pnpm-workspace.yaml with the root-only scaffold + `trustLockfile: true`
     // (pnpm >=11 rejects the redirected lock without it; 9/10 ignore the
-    // key), and the ledger records the created-file edit for revert.
+    // key).
     let ws_path = tmp.path().join("pnpm-workspace.yaml");
     let ws = std::fs::read_to_string(&ws_path)
         .expect("the redirect must auto-create pnpm-workspace.yaml");
@@ -255,28 +286,12 @@ async fn hosted_rewrites_pnpm_root_lock_resolution() {
         ws, "packages:\n  - '.'\ntrustLockfile: true\n",
         "created workspace file must be the scaffold + trust key"
     );
-    assert!(
-        edits.iter().any(|e| {
-            e["kind"] == "redirect_pnpm_workspace_trust"
-                && e["action"] == "created"
-                && e["path"] == "pnpm-workspace.yaml"
-                && e["key"] == "trustLockfile"
-        }),
-        "the ledger must record the workspace-trust creation: {first}"
-    );
 
-    // Idempotency: a second run rewrites nothing new — an already-redirected
-    // resolution must not append duplicate edits (which would poison a revert),
-    // and the auto-created workspace file must stay byte-stable.
+    // Idempotency: a second run rewrites nothing — the lock and the
+    // auto-created workspace file stay byte-stable.
+    let pristine = pristine_lock;
     let code = run(hosted_args(tmp.path(), server.uri())).await;
     assert_eq!(code, 0, "second scan --mode hosted should succeed");
-    let second: serde_json::Value =
-        serde_json::from_str(&std::fs::read_to_string(&ledger_path).unwrap()).unwrap();
-    assert_eq!(
-        edits.len(),
-        second["edits"].as_array().unwrap().len(),
-        "a pnpm re-run must not append duplicate edits: {second}"
-    );
     let lock_after_rerun = std::fs::read_to_string(tmp.path().join("pnpm-lock.yaml")).unwrap();
     assert_eq!(
         lock, lock_after_rerun,
@@ -287,13 +302,31 @@ async fn hosted_rewrites_pnpm_root_lock_resolution() {
         ws,
         "the re-run must leave pnpm-workspace.yaml byte-stable"
     );
+    assert_no_ledger(tmp.path());
+
+    // rollback: the upstream entry comes back from the registry, and the
+    // trust key the run added (here: the whole scaffold file) goes with it.
+    let code = rollback_hosted(tmp.path(), &server).await;
+    assert_eq!(code, 0, "rollback must restore the pnpm pin");
+    assert_eq!(
+        std::fs::read_to_string(tmp.path().join("pnpm-lock.yaml")).unwrap(),
+        pristine,
+        "rollback restores the pristine lock byte for byte"
+    );
+    assert!(
+        !ws_path.exists(),
+        "the auto-created pnpm-workspace.yaml is removed with the pin"
+    );
+    assert_no_ledger(tmp.path());
 }
 
 /// MERGE case: a pre-existing pnpm-workspace.yaml (comments, multi-glob
 /// packages, catalog — none of it ours) gains EXACTLY one appended
 /// `trustLockfile: true` line after its last non-empty line; every other
-/// byte survives verbatim, and the ledger records the `added` (not
-/// `created`) action so a revert removes just that line.
+/// byte survives verbatim. v5 keeps no ledger record of that edit, so
+/// `rollback` cannot prove the line is ours: it restores the lock entry and
+/// leaves the user's file (trust line included) alone, warning
+/// `pnpm_trust_lockfile_left` instead of guessing.
 #[tokio::test]
 #[serial]
 async fn hosted_merges_trust_key_into_existing_workspace_yaml_byte_exactly() {
@@ -316,17 +349,20 @@ async fn hosted_merges_trust_key_into_existing_workspace_yaml_byte_exactly() {
         "# team workspace\npackages:\n  - '.'\n  - 'tools/*'\n\ncatalog:\n  react: ^18.0.0\ntrustLockfile: true\n",
         "the merge must preserve every user byte and append exactly one line"
     );
-    let ledger: serde_json::Value = serde_json::from_str(
-        &std::fs::read_to_string(tmp.path().join(".socket/vendor/redirect-state.json")).unwrap(),
-    )
-    .unwrap();
+    assert_no_ledger(tmp.path());
+
+    let code = rollback_hosted(tmp.path(), &server).await;
+    assert_eq!(code, 0, "rollback must restore the pnpm pin");
     assert!(
-        ledger["edits"].as_array().unwrap().iter().any(|e| {
-            e["kind"] == "redirect_pnpm_workspace_trust"
-                && e["action"] == "added"
-                && e["path"] == "pnpm-workspace.yaml"
-        }),
-        "the ledger must record the merged (added) trust edit: {ledger}"
+        !std::fs::read_to_string(tmp.path().join("pnpm-lock.yaml"))
+            .unwrap()
+            .contains(HOSTED_URL),
+        "the pin is restored upstream"
+    );
+    assert_eq!(
+        std::fs::read_to_string(tmp.path().join("pnpm-workspace.yaml")).unwrap(),
+        ws,
+        "a user-authored workspace file is never edited by the restore"
     );
 }
 
@@ -370,7 +406,7 @@ async fn hosted_dry_run_writes_neither_lock_nor_workspace_trust() {
 /// plain `/name@version:` key stays redirectable, but the trustLockfile
 /// auto-config must NOT fire — pnpm 7/8 have neither the >=11 policy nor the
 /// flag, so writing trust config for them would be pure noise. No
-/// pnpm-workspace.yaml appears and the ledger carries no workspace-trust
+/// pnpm-workspace.yaml appears (and no ledger is written) — no workspace-trust
 /// edit.
 #[tokio::test]
 #[serial]
@@ -433,11 +469,7 @@ packages:
         !root.join("pnpm-workspace.yaml").exists(),
         "a legacy v6 lock must not trigger the trustLockfile auto-config"
     );
-    let ledger = std::fs::read_to_string(root.join(".socket/vendor/redirect-state.json")).unwrap();
-    assert!(
-        !ledger.contains("redirect_pnpm_workspace_trust"),
-        "no workspace-trust edit may be recorded for a legacy lock: {ledger}"
-    );
+    assert_no_ledger(root);
 }
 
 /// (a2) SCOPED package: pnpm lockfileVersion 9 single-quotes `packages:` keys
@@ -563,24 +595,12 @@ snapshots:
         "the upstream integrity must be replaced; got:\n{lock}"
     );
 
-    let ledger: serde_json::Value = serde_json::from_str(
-        &std::fs::read_to_string(root.join(".socket/vendor/redirect-state.json")).unwrap(),
-    )
-    .unwrap();
-    assert!(
-        ledger["edits"]
-            .as_array()
-            .unwrap()
-            .iter()
-            .any(|e| e["kind"] == "redirect_pnpm_resolution"
-                && e["key"] == format!("{SCOPED_NAME}@{VERSION}")),
-        "the ledger must record the scoped redirect edit: {ledger}"
-    );
+    assert_no_ledger(root);
 }
 
 /// (b) `scan --mode hosted --vex`: the redirected pnpm patch is attested with
 /// the `(redirected)` provenance marker (bytes are remote until install, so
-/// this is the NO-VERIFY attestation built from the ledger record — the same
+/// this is the NO-VERIFY attestation built from this run's fetched record — the same
 /// contract `scan_redirect_vex_emits_redirected_attestation` pins for npm).
 #[tokio::test]
 #[serial]
@@ -604,13 +624,8 @@ async fn hosted_pnpm_vex_emits_redirected_attestation() {
     let code = run(args).await;
     assert_eq!(code, 0, "scan --mode hosted --vex should succeed for pnpm");
 
-    // The ledger embeds the patch record (so a post-install `vex` can verify).
-    let ledger =
-        std::fs::read_to_string(tmp.path().join(".socket/vendor/redirect-state.json")).unwrap();
-    assert!(
-        ledger.contains("\"records\"") && ledger.contains(GHSA) && ledger.contains(PURL),
-        "ledger must embed the patch record + vulnerability: {ledger}"
-    );
+    // The record reached the attestation in memory: nothing persisted.
+    assert_no_ledger(tmp.path());
 
     let doc: serde_json::Value =
         serde_json::from_str(&std::fs::read_to_string(&vex_path).unwrap()).unwrap();
@@ -635,18 +650,18 @@ async fn hosted_pnpm_vex_emits_redirected_attestation() {
 /// manifest (hosted mode never writes one), the hosted URL sits on the
 /// operator's patch server (`--patch-server-url http://patch.test`).
 ///
-/// * not installed, ledger kept: the ledger record + the lock's
-///   integrity-pinned wiring attest `(redirected)`;
-/// * ledgers deleted: the lockfile reference + the patch API record attest,
-///   first from the pin, then hash-verified against an installed copy;
-/// * `--offline`, no ledgers: `record_unavailable`, zero requests;
-/// * lock reverted, ledger restored: `redirect_unwired`, `--no-verify` too.
+/// * not installed, no ledger (v5): the lockfile reference + the patch API
+///   record attest `(redirected)` from the integrity pin, then
+///   hash-verified against an installed copy;
+/// * `--offline`, no local record: `record_unavailable`, zero requests;
+/// * a pre-v5 ledger carrying the record serves the offline run;
+/// * lock reverted, that ledger kept: `redirect_unwired`, `--no-verify` too.
 #[tokio::test]
 #[serial]
-async fn hosted_pnpm_manifestless_vex_from_lockfile_ledger_and_api() {
+async fn hosted_pnpm_manifestless_vex_from_lockfile_legacy_ledger_and_api() {
     use vex_e2e_common::{
         assert_absent, assert_attested, assert_not_attested, git_sha256, patch_view, run_vex,
-        strip_ledgers, strip_manifest, Marker, PatchApi, VexRun,
+        strip_manifest, Marker, PatchApi, VexRun,
     };
     const PATCHED: &[u8] = b"/* patched */\nmodule.exports = 1;\n";
     let vulns: &[(&str, &[&str])] = &[(GHSA, &["CVE-2024-9"])];
@@ -683,30 +698,22 @@ async fn hosted_pnpm_manifestless_vex_from_lockfile_ledger_and_api() {
         std::thread::scope(|s| {
             s.spawn(|| {
                 let bin = vex_e2e_common::binary();
-                let api = PatchApi::start(vec![(
-                    UUID.to_string(),
-                    patch_view(
-                        UUID,
-                        PURL,
-                        &[("package/index.js", &git_sha256(PATCHED))],
-                        vulns,
-                    ),
-                )]);
+                let view = patch_view(
+                    UUID,
+                    PURL,
+                    &[("package/index.js", &git_sha256(PATCHED))],
+                    vulns,
+                );
+                let api = PatchApi::start(vec![(UUID.to_string(), view.clone())]);
                 let online = |no_verify| VexRun {
                     patch_server_url: Some("http://patch.test".to_string()),
                     no_verify,
                     ..VexRun::online(&api)
                 };
                 strip_manifest(root);
+                assert_no_ledger(root);
                 std::fs::remove_dir_all(root.join("node_modules")).unwrap();
                 let out = run_vex(&bin, root, &online(false));
-                assert_eq!(out.code, Some(0), "[{lock_name}] ledger kept: {out}");
-                assert_attested(out.doc(), PURL, UUID, Marker::Redirected, vulns);
-
-                let ledger = root.join(".socket/vendor/redirect-state.json");
-                let ledger_bytes = std::fs::read(&ledger).unwrap();
-                strip_ledgers(root);
-                let out = run_vex(&bin, root, &online(false));
                 assert_eq!(out.code, Some(0), "[{lock_name}] ledger-less: {out}");
                 assert_attested(out.doc(), PURL, UUID, Marker::Redirected, vulns);
                 assert!(api.view_requests(UUID) >= 1);
@@ -735,7 +742,34 @@ async fn hosted_pnpm_manifestless_vex_from_lockfile_ledger_and_api() {
                 assert_not_attested(&out.envelope, PURL, "record_unavailable");
                 assert_eq!(api.request_count(), seen);
 
-                std::fs::write(&ledger, &ledger_bytes).unwrap();
+                // A pre-v5 ledger's record is an extra local record source.
+                let mut record = view.clone();
+                let obj = record.as_object_mut().unwrap();
+                obj.remove("purl");
+                let exported = obj.remove("publishedAt").unwrap();
+                obj.insert("exportedAt".to_string(), exported);
+                let ledger = root.join(".socket/vendor/redirect-state.json");
+                std::fs::create_dir_all(ledger.parent().unwrap()).unwrap();
+                std::fs::write(
+                    &ledger,
+                    serde_json::to_vec_pretty(&serde_json::json!({
+                        "version": 1, "mode": "hosted", "records": { PURL: record },
+                    }))
+                    .unwrap(),
+                )
+                .unwrap();
+                let out = run_vex(
+                    &bin,
+                    root,
+                    &VexRun {
+                        patch_server_url: Some("http://patch.test".to_string()),
+                        ..VexRun::offline()
+                    },
+                );
+                assert_eq!(out.code, Some(0), "[{lock_name}] legacy ledger, offline: {out}");
+                assert_attested(out.doc(), PURL, UUID, Marker::Redirected, vulns);
+                assert_eq!(api.request_count(), seen);
+
                 std::fs::write(root.join(lock_name), &pristine).unwrap();
                 for no_verify in [false, true] {
                     let out = run_vex(&bin, root, &online(no_verify));
diff --git a/crates/socket-patch-cli/tests/in_process_redirect_poetry.rs b/crates/socket-patch-cli/tests/in_process_redirect_poetry.rs
index b26c7af3..9ba3c5a9 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect_poetry.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect_poetry.rs
@@ -2,10 +2,12 @@
 //! API (discovery + reference + view) via wiremock, lays down a native
 //! `poetry.lock` (the committed Poetry 2.4.3 fixture) with NO installed
 //! package — the lock-only fresh-checkout / CI shape — and asserts the lock is
-//! repointed at the hosted wheel, the redirect ledger is written, the same-run
-//! `--vex` attests the redirect, a re-scan is idempotent, and `rollback`
-//! restores every byte. The rewriter bytes themselves are pinned by the core
-//! `poetry_hosted` tests; this covers the CLI wiring around them.
+//! repointed at the hosted wheel, NO redirect ledger is written (v5), the
+//! same-run `--vex` attests the redirect, a re-scan is idempotent, and
+//! `rollback` restores every byte by re-resolving the upstream entry from a
+//! mocked PyPI JSON API (`SOCKET_PYPI_JSON_API`). The rewriter bytes
+//! themselves are pinned by the core `poetry_hosted` tests; this covers the
+//! CLI wiring around them.
 
 use std::path::Path;
 
@@ -24,8 +26,8 @@ use wiremock::{Mock, MockServer, ResponseTemplate};
 const ORG: &str = "test-org";
 /// Discovery names the base purl (the lockfile supplement's spelling)…
 const PURL: &str = "pkg:pypi/urllib3@1.26.18";
-/// …while the patch record carries the API's artifact-qualified purl, which
-/// is what the redirect ledger is keyed by.
+/// …while the patch record carries the API's artifact-qualified purl (what a
+/// pre-v5 redirect ledger was keyed by).
 const RECORD_PURL: &str = "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl";
 const UUID: &str = "e828efa5-5c6d-43f3-9909-03f5ac232b98";
 const HOSTED_URL: &str = "http://patch.test/patch/pypi/urllib3/1.26.18/22222222-2222-4222-8222-222222222222/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl";
@@ -56,6 +58,67 @@ fn global(cwd: &Path, api_url: String) -> GlobalArgs {
     }
 }
 
+/// The urllib3 1.26.18 release files the Poetry fixtures pin, as the PyPI
+/// JSON API serves them (`GET /pypi/urllib3/1.26.18/json`).
+async fn mock_pypi(server: &MockServer) {
+    let file = |filename: &str, sha: &str, size: u64, uploaded: &str| {
+        serde_json::json!({
+            "filename": filename,
+            "url": format!("https://files.pythonhosted.org/packages/ab/cd/{filename}"),
+            "digests": { "sha256": sha },
+            "size": size,
+            "upload_time_iso_8601": uploaded,
+        })
+    };
+    Mock::given(method("GET"))
+        .and(path("/pypi/urllib3/1.26.18/json"))
+        .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+            "urls": [
+                file(
+                    "urllib3-1.26.18-py2.py3-none-any.whl",
+                    "34b97092d7e0a3a8cf7cd10e386f401b3737364026c45e622aa02903dffe0f07",
+                    143835,
+                    "2023-10-17T17:46:21.184066Z",
+                ),
+                file(
+                    "urllib3-1.26.18.tar.gz",
+                    "f8ecc1bba5667413457c529ab955bf8c67b45db799d159066261719e328580a0",
+                    305687,
+                    "2023-10-17T17:46:24.000000Z",
+                ),
+            ]
+        })))
+        .mount(server)
+        .await;
+}
+
+/// In-process `rollback` of the hosted pin: the mock patch host is named by
+/// `--patch-server-url` (so discovery finds the pin) and the upstream restore
+/// re-resolves the release from the mocked PyPI JSON API.
+async fn rollback_hosted(cwd: &Path, server: &MockServer) -> i32 {
+    mock_pypi(server).await;
+    std::env::set_var("SOCKET_PYPI_JSON_API", format!("{}/pypi", server.uri()));
+    let code = rollback::run(RollbackArgs {
+        targets: Vec::new(),
+        common: GlobalArgs {
+            patch_server_url: Some("http://patch.test".to_string()),
+            ..global(cwd, server.uri())
+        },
+        one_off: false,
+        preserve_state: false,
+    })
+    .await;
+    std::env::remove_var("SOCKET_PYPI_JSON_API");
+    code
+}
+
+fn assert_no_ledger(root: &Path) {
+    assert!(
+        !root.join(".socket/vendor/redirect-state.json").exists(),
+        "v5 hosted mode writes no redirect ledger"
+    );
+}
+
 fn hosted_args(cwd: &Path, api_url: String, vex: Option<&Path>) -> ScanArgs {
     ScanArgs {
         paths: Vec::new(),
@@ -200,22 +263,10 @@ async fn lock_only_poetry_project_redirects_attests_rescans_and_rolls_back() {
         PYPROJECT,
         "pyproject untouched"
     );
-    let ledger: serde_json::Value = serde_json::from_str(&read(
-        &tmp.path().join(".socket/vendor/redirect-state.json"),
-    ))
-    .unwrap();
-    assert!(
-        ledger["records"][RECORD_PURL].is_object(),
-        "ledger keyed by the artifact-qualified purl: {ledger}"
-    );
-    assert_eq!(
-        ledger["edits"][0]["kind"].as_str(),
-        Some("redirect_poetry_lock_package"),
-        "{ledger}"
-    );
-    // The redirect is attested from the ledger (assume_applied) even though
-    // the base purl the run confirmed differs from the record's qualified
-    // purl only by its `?artifact_id=` qualifier.
+    assert_no_ledger(tmp.path());
+    // The redirect is attested from this run's fetched record (assume
+    // applied) even though the base purl the run confirmed differs from the
+    // record's qualified purl only by its `?artifact_id=` qualifier.
     let vex: serde_json::Value = serde_json::from_str(&read(&vex_path)).unwrap();
     let statements = vex["statements"].as_array().expect("statements");
     assert_eq!(statements.len(), 1, "{vex}");
@@ -234,30 +285,15 @@ async fn lock_only_poetry_project_redirects_attests_rescans_and_rolls_back() {
         "re-scan must not touch the lock"
     );
 
-    // 3. rollback unwinds the redirect and drops the record.
-    let code = rollback::run(RollbackArgs {
-        targets: Vec::new(),
-        common: global(tmp.path(), server.uri()),
-        one_off: false,
-        preserve_state: false,
-    })
-    .await;
+    // 3. rollback restores the upstream registry entry.
+    let code = rollback_hosted(tmp.path(), &server).await;
     assert_eq!(code, 0, "rollback must succeed");
     assert_eq!(
         read(&lock_path),
         LOCK,
         "rollback must restore the pristine lock byte for byte"
     );
-    let ledger_path = tmp.path().join(".socket/vendor/redirect-state.json");
-    if ledger_path.exists() {
-        let ledger: serde_json::Value = serde_json::from_str(&read(&ledger_path)).unwrap();
-        assert!(
-            ledger["records"]
-                .as_object()
-                .is_none_or(|records| records.is_empty()),
-            "no redirect record may survive rollback: {ledger}"
-        );
-    }
+    assert_no_ledger(tmp.path());
 }
 
 /// What `poetry lock --no-update` on Poetry 1.1 / 1.2 does to a redirected
@@ -285,9 +321,9 @@ fn simulate_poetry_1x_relock(lock: &str) -> String {
 }
 
 /// Relock → re-scan → rollback must still land on the pristine lock. The
-/// re-scan REBASES the ledger's edits (pristine → freshly written) instead of
-/// appending edits recorded against the relocked text, whose older links
-/// would match nothing and make rollback (and remove) refuse forever.
+/// re-scan plans from the relocked text (v5 keeps no ledger chain to rebase)
+/// and rollback re-resolves the upstream entry from the registry, so the
+/// relock never strands the unwind.
 #[tokio::test]
 #[serial]
 async fn relock_then_rescan_keeps_rollback_invertible() {
@@ -308,13 +344,8 @@ async fn assert_relock_roundtrip(lock: &str) {
 
     assert_eq!(run(hosted_args(tmp.path(), server.uri(), None)).await, 0);
     let redirected = read(&lock_path);
-    let ledger_path = tmp.path().join(".socket/vendor/redirect-state.json");
-    let ledger: serde_json::Value = serde_json::from_str(&read(&ledger_path)).unwrap();
-    assert_eq!(
-        ledger["edits"].as_array().unwrap().len(),
-        2,
-        "package + metadata fragments"
-    );
+    assert!(redirected.contains(HOSTED_URL), "{redirected}");
+    assert_no_ledger(tmp.path());
 
     let relocked = simulate_poetry_1x_relock(&redirected);
     assert_ne!(relocked, redirected);
@@ -328,29 +359,9 @@ async fn assert_relock_roundtrip(lock: &str) {
         rescanned, relocked,
         "the re-scan must restore the package files entry"
     );
-    let ledger: serde_json::Value = serde_json::from_str(&read(&ledger_path)).unwrap();
-    let edits = ledger["edits"].as_array().unwrap();
-    assert_eq!(edits.len(), 2, "rebased, not appended: {ledger}");
-    for edit in edits {
-        let original = edit["original"].as_str().unwrap();
-        assert!(
-            !original.contains(HOSTED_URL),
-            "originals stay pristine: {original}"
-        );
-        let new = edit["new"].as_str().unwrap();
-        assert!(
-            rescanned.contains(new),
-            "new fragments describe the current lock"
-        );
-    }
+    assert_no_ledger(tmp.path());
 
-    let code = rollback::run(RollbackArgs {
-        targets: Vec::new(),
-        common: global(tmp.path(), server.uri()),
-        one_off: false,
-        preserve_state: false,
-    })
-    .await;
+    let code = rollback_hosted(tmp.path(), &server).await;
     assert_eq!(code, 0, "rollback after relock + re-scan must succeed");
     assert_eq!(
         read(&lock_path),
@@ -456,7 +467,9 @@ async fn stale_python_install_warns_and_cannot_attest_even_on_rescan() {
             assert_eq!(json["error"]["code"], "no_applicable_patches", "{json}");
             assert!(!vex.exists(), "stale bytes cannot produce a VEX file");
         }
-        // A failed fresh record fetch must not bypass the persisted evidence.
+        // A failed fresh record fetch leaves the probe no evidence (v5 keeps
+        // no persisted record): the run still succeeds, says the record
+        // could not be fetched, and never attests.
         Mock::given(method("GET"))
             .and(path(format!("/v0/orgs/{ORG}/patches/view/{UUID}")))
             .respond_with(ResponseTemplate::new(404))
@@ -464,12 +477,9 @@ async fn stale_python_install_warns_and_cannot_attest_even_on_rescan() {
             .mount(&server)
             .await;
         let out = scan_output(tmp.path(), &server, &[]).await;
-        assert!(
-            out.status.success(),
-            "{}",
-            String::from_utf8_lossy(&out.stderr)
-        );
-        assert!(String::from_utf8_lossy(&out.stderr).contains("redirect_pypi_stale_install"));
+        let stderr = String::from_utf8_lossy(&out.stderr);
+        assert!(out.status.success(), "{stderr}");
+        assert!(stderr.contains("record_fetch_failed"), "{stderr}");
         assert_eq!(
             std::fs::read(installed).unwrap(),
             bytes,
@@ -575,15 +585,14 @@ fn manifestless_vex(
 }
 
 /// After `scan --mode hosted` wired the lock-only checkout, VEX needs no
-/// manifest (hosted never writes one) and — with the patch API reachable —
-/// no ledger either:
-///   1. manifest absent, ledger kept → attests offline from the ledger;
-///   2. ledger deleted → attests from the lock's sha256 pin + the API
-///      record, and after an install only when the installed tree hashes to
-///      the patch (`not_applied` for the upstream bytes); `apply --vex`
-///      agrees;
-///   3. `--offline` without the ledger → `record_unavailable`, no request;
-///   4. the lock reverted with the ledger kept → `redirect_unwired`, also
+/// manifest and no ledger (v5 hosted writes neither):
+///   1. attests from the lock's sha256 pin + the API record, and after an
+///      install only when the installed tree hashes to the patch
+///      (`not_applied` for the upstream bytes); `apply --vex` agrees;
+///   2. `--offline` with no local record → `record_unavailable`, no request;
+///   3. a pre-v5 ledger carrying the record is an extra local record
+///      source: the same offline run attests with no request;
+///   4. the lock reverted with that ledger kept → `redirect_unwired`, also
 ///      under `--no-verify`; and the self-hosted origin only counts when
 ///      `--patch-server-url` names it.
 #[test]
@@ -598,8 +607,8 @@ fn manifestless_vex_after_hosted_redirect() {
     let root = tmp.path();
     assert_eq!(rt.block_on(run(hosted_args(root, server.uri(), None))), 0);
     assert!(!root.join(".socket/manifest.json").exists());
+    assert_no_ledger(root);
     let ledger_path = root.join(".socket/vendor/redirect-state.json");
-    let ledger = std::fs::read(&ledger_path).unwrap();
     let redirected = read(&root.join("poetry.lock"));
 
     let mut view = vex_e2e_common::patch_view(
@@ -613,17 +622,10 @@ fn manifestless_vex_after_hosted_redirect() {
     );
     view["files"]["urllib3/response.py"]["beforeHash"] =
         compute_git_sha256_from_bytes(UPSTREAM).into();
-    let api = PatchApi::start(vec![(UUID.into(), view)]);
+    let api = PatchApi::start(vec![(UUID.into(), view.clone())]);
     let vulns: &[(&str, &[&str])] = &[(GHSA, &["CVE-2025-66418"])];
 
-    // 1. the ledger alone, offline.
-    let out = manifestless_vex(root, &api, true, &[]);
-    assert_eq!(out.code, Some(0), "{out}");
-    assert_attested(out.doc(), PURL, UUID, Marker::Redirected, vulns);
-    api.assert_no_requests();
-
-    // 2. no ledger: lock pin + API record.
-    vex_e2e_common::strip_ledgers(root);
+    // 1. lock pin + API record.
     let out = manifestless_vex(root, &api, false, &[]);
     assert_eq!(out.code, Some(0), "{out}");
     assert_attested(out.doc(), PURL, UUID, Marker::Redirected, vulns);
@@ -658,7 +660,7 @@ fn manifestless_vex_after_hosted_redirect() {
     assert_not_attested(&out.envelope, PURL, "not_applied");
     std::fs::write(&installed, PATCHED).unwrap();
 
-    // 3. offline without the ledger.
+    // 2. offline with no local record.
     let seen = api.request_count();
     let out = manifestless_vex(root, &api, true, &[]);
     assert_eq!(out.code, Some(1), "{out}");
@@ -666,8 +668,29 @@ fn manifestless_vex_after_hosted_redirect() {
     assert!(out.doc.is_none());
     assert_eq!(api.request_count(), seen, "--offline made a request");
 
-    // 4. reverted lock, ledger kept.
-    std::fs::write(&ledger_path, &ledger).unwrap();
+    // 3. a pre-v5 ledger's record serves the offline run.
+    let mut record = view;
+    let obj = record.as_object_mut().unwrap();
+    obj.remove("purl");
+    let exported = obj.remove("publishedAt").unwrap();
+    obj.insert("exportedAt".to_string(), exported);
+    std::fs::create_dir_all(ledger_path.parent().unwrap()).unwrap();
+    std::fs::write(
+        &ledger_path,
+        serde_json::to_vec_pretty(&serde_json::json!({
+            "version": 1,
+            "mode": "hosted",
+            "records": { RECORD_PURL: record },
+        }))
+        .unwrap(),
+    )
+    .unwrap();
+    let out = manifestless_vex(root, &api, true, &[]);
+    assert_eq!(out.code, Some(0), "{out}");
+    assert_attested(out.doc(), PURL, UUID, Marker::Redirected, vulns);
+    assert_eq!(api.request_count(), seen, "--offline made a request");
+
+    // 4. reverted lock, that ledger kept.
     std::fs::write(root.join("poetry.lock"), LOCK).unwrap();
     for extra in [&[][..], &["--no-verify"][..]] {
         for offline in [true, false] {
diff --git a/crates/socket-patch-cli/tests/in_process_rollback_hosted.rs b/crates/socket-patch-cli/tests/in_process_rollback_hosted.rs
index 3fcd5a24..5f6072e0 100644
--- a/crates/socket-patch-cli/tests/in_process_rollback_hosted.rs
+++ b/crates/socket-patch-cli/tests/in_process_rollback_hosted.rs
@@ -1,14 +1,22 @@
-//! In-process rollback tests for HOSTED-mode state (the redirect ledger).
+//! In-process rollback tests for HOSTED-mode state.
+//!
+//! v5 hosted mode keeps no ledger: the hosted pins ARE the lockfile entries
+//! (discovered on `--patch-server-url`'s origin for these mock-host URLs),
+//! and rollback restores each in-scope pin to its DEFAULT UPSTREAM registry
+//! entry, re-resolved from the (wiremocked) registry through the
+//! `SOCKET_NPM_REGISTRY` base override. A refused pin (offline, registry
+//! failure) is left untouched and reported. A pre-v5 ledger is never
+//! replayed; it is retired once no hosted pin remains.
 //!
 //! The genuine-wiring fixtures run the REAL hosted flow first — in-process
 //! `scan --mode hosted` over an npm package-lock project (the
 //! `in_process_redirect.rs` fixture, wiremock API) and in-process
 //! `get <uuid> --mode hosted` over a pip requirements.txt project (the
 //! `in_process_get_hosted_ecosystems.rs` fixture) — then roll back and
-//! byte-compare the lockfiles against their pristine snapshots. The
-//! fail-closed / replay fixtures hand-write the redirect ledger through the
-//! exported `socket_patch_core::patch::redirect` types (real schema, real
-//! edit kinds) with matching file fragments on disk.
+//! byte-compare the lockfiles against their pristine snapshots. The other
+//! fixtures hand-write hosted yarn.lock entries (and, for the migration
+//! tests, a pre-v5 ledger through the exported
+//! `socket_patch_core::patch::redirect` types).
 //!
 //! Convention split (the same one `in_process_redirect.rs` documents):
 //! in-process `rollback::run(RollbackArgs)` for exit codes + on-disk
@@ -51,12 +59,12 @@ const HOSTED_URL: &str = "http://patch.test/patch/npm/in-proc-redirect/1.0.0/222
 const PATCHED_SHA512: &str = "sha512-PATCHEDpatchedPATCHEDpatched0123456789==";
 const GHSA: &str = "GHSA-rbhr-aaaa-bbbb";
 
-// ── the hand-written two-record ledger fixture ──────────────────────────────
+// ── the hand-written hosted yarn.lock pins ──────────────────────────────────
 const LP_PURL: &str = "pkg:npm/left-pad@1.2.3";
 const LP_UUID: &str = "55555555-5555-4555-8555-555555555555";
 const LP_HOSTED_URL: &str = "http://patch.test/patch/npm/left-pad/1.2.3/66666666-6666-4666-8666-666666666666/55555555-5555-4555-8555-555555555555/left-pad-1.2.3.tgz";
-const GEM_PURL: &str = "pkg:gem/rex@1.0.0";
-const GEM_UUID: &str = "77777777-7777-4777-8777-777777777777";
+const IO_PURL: &str = "pkg:npm/is-odd@3.0.1";
+const IO_HOSTED_URL: &str = "http://patch.test/patch/npm/is-odd/3.0.1/66666666-6666-4666-8666-666666666666/99999999-9999-4999-8999-999999999999/is-odd-3.0.1.tgz";
 const GEM_UPSTREAM_REMOTE: &str = "https://rubygems.org/";
 const GEM_PATCH_REMOTE: &str = "http://patch.test/gems/t0k3nt0k3n/";
 
@@ -98,6 +106,7 @@ async fn rollback_in_process(cwd: &Path, targets: Vec<String>, preserve_state: b
             json: true,
             yes: true,
             silent: true,
+            patch_server_url: Some("http://patch.test".to_string()),
             ..socket_patch_cli::args::GlobalArgs::default()
         },
         one_off: false,
@@ -111,6 +120,49 @@ async fn rollback_in_process(cwd: &Path, targets: Vec<String>, preserve_state: b
     code
 }
 
+/// Serve the npm registry's version document for the real-flow fixture's
+/// package, so the upstream restore can re-resolve its pristine entry.
+async fn mock_npm_registry(server: &MockServer) {
+    Mock::given(method("GET"))
+        .and(path(format!("/npm-registry/{NAME}/{VERSION}")))
+        .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+            "name": NAME,
+            "version": VERSION,
+            "dist": {
+                "tarball": format!("https://registry.npmjs.org/{NAME}/-/{NAME}-{VERSION}.tgz"),
+                "integrity": "sha512-UPSTREAMupstream==",
+            }
+        })))
+        .mount(server)
+        .await;
+}
+
+/// Bare in-process rollback that may reach the (mocked) npm registry: the
+/// upstream restore re-resolves each hosted pin's registry entry.
+async fn rollback_online(cwd: &Path, server: &MockServer) -> i32 {
+    std::env::set_var(
+        "SOCKET_NPM_REGISTRY",
+        format!("{}/npm-registry", server.uri()),
+    );
+    let args = RollbackArgs {
+        targets: Vec::new(),
+        common: socket_patch_cli::args::GlobalArgs {
+            cwd: cwd.to_path_buf(),
+            manifest_path: ".socket/manifest.json".to_string(),
+            json: true,
+            yes: true,
+            silent: true,
+            patch_server_url: Some("http://patch.test".to_string()),
+            ..socket_patch_cli::args::GlobalArgs::default()
+        },
+        one_off: false,
+        preserve_state: false,
+    };
+    let code = rollback_run(args).await;
+    std::env::remove_var("SOCKET_NPM_REGISTRY");
+    code
+}
+
 /// A `socket-patch` Command with the ambient `SOCKET_*` env surface scrubbed
 /// (the `in_process_redirect.rs` seed-then-scrub pattern): hostile seeds
 /// never reach the child because `env_remove` clears them too, but if a
@@ -151,7 +203,8 @@ fn scrubbed_cli() -> std::process::Command {
     cmd
 }
 
-/// Run `rollback --json --yes --offline [extra]` as a scrubbed subprocess
+/// Run `rollback --json --yes --offline [extra]` (the mock patch host
+/// recognized as hosted) as a scrubbed subprocess
 /// and parse the envelope back (in-process runs print to the real stdout,
 /// which a hosting test can't read). Returns (exit code, envelope).
 fn run_rollback_subprocess(cwd: &Path, extra: &[&str]) -> (i32, Value) {
@@ -161,6 +214,39 @@ fn run_rollback_subprocess(cwd: &Path, extra: &[&str]) -> (i32, Value) {
             "--json",
             "--yes",
             "--offline",
+            "--patch-server-url",
+            "http://patch.test",
+            "--cwd",
+            cwd.to_str().unwrap(),
+        ])
+        .args(extra)
+        .output()
+        .expect("run socket-patch");
+    let envelope: Value = serde_json::from_slice(&out.stdout).unwrap_or_else(|e| {
+        panic!(
+            "rollback --json stdout must be a pure JSON envelope: {e}\nstdout:\n{}\nstderr:\n{}",
+            String::from_utf8_lossy(&out.stdout),
+            String::from_utf8_lossy(&out.stderr)
+        )
+    });
+    (out.status.code().unwrap_or(-1), envelope)
+}
+
+/// [`run_rollback_subprocess`] ONLINE: no `--offline`, the npm registry
+/// pointed at `server`'s `/npm-registry` (see [`mock_yarn_registry`] /
+/// [`mock_npm_registry`]), and the mock patch host recognized as hosted.
+fn run_rollback_subprocess_online(cwd: &Path, server: &MockServer, extra: &[&str]) -> (i32, Value) {
+    let out = scrubbed_cli()
+        .env(
+            "SOCKET_NPM_REGISTRY",
+            format!("{}/npm-registry", server.uri()),
+        )
+        .args([
+            "rollback",
+            "--json",
+            "--yes",
+            "--patch-server-url",
+            "http://patch.test",
             "--cwd",
             cwd.to_str().unwrap(),
         ])
@@ -323,8 +409,7 @@ fn ledger_path(root: &Path) -> std::path::PathBuf {
     root.join(".socket/vendor/redirect-state.json")
 }
 
-/// A full camelCase patch record for hand-written ledgers (the same shape
-/// the hosted flow persists from `view/{uuid}`).
+/// A full camelCase patch record for the hand-written pre-v5 ledgers.
 fn patch_record(uuid: &str, ghsa: &str) -> PatchRecord {
     let mut files = HashMap::new();
     files.insert(
@@ -355,41 +440,76 @@ fn patch_record(uuid: &str, ghsa: &str) -> PatchRecord {
     }
 }
 
-/// Serialize a hand-written ledger through the real core writer (real
-/// schema: version, mode "hosted", edits[FileEdit], records{purl: record}).
-async fn write_hosted_ledger(root: &Path, records: Vec<(&str, PatchRecord)>, edits: Vec<FileEdit>) {
+/// Serialize a PRE-V5 hosted ledger (v5 never writes one) through the real
+/// core writer (real schema: version, mode "hosted", edits[FileEdit],
+/// records{purl: record}) — what an older release left on disk.
+async fn write_legacy_ledger(root: &Path, edits: Vec<FileEdit>) {
     let mut state = RedirectState::new();
     state.edits = edits;
-    for (purl, record) in records {
-        state.records.insert(purl.to_string(), record);
-    }
+    state.records.insert(
+        LP_PURL.to_string(),
+        patch_record(LP_UUID, "GHSA-lpad-aaaa-bbbb"),
+    );
     save_redirect_state(root, &state)
         .await
         .expect("write redirect ledger");
 }
 
-// ── yarn-classic fragments for the hand-written npm record ─────────────────
-// `redirect_yarn_classic_entry` is one of the text kinds the per-purl npm
-// revert claims by `<name>@<version>` key; original/new record whole blocks,
-// exactly as the real writer does.
+/// Serve the npm registry's version document for `name@version` under
+/// `/npm-registry` (the `SOCKET_NPM_REGISTRY` base `rollback_online` and
+/// `run_rollback_subprocess_online` set) in the shape a yarn-classic
+/// restore turns back into [`yarn_upstream_block`].
+async fn mock_yarn_registry(server: &MockServer, name: &str, version: &str) {
+    Mock::given(method("GET"))
+        .and(path(format!("/npm-registry/{name}/{version}")))
+        .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+            "name": name,
+            "version": version,
+            "dist": {
+                "tarball": format!("https://registry.yarnpkg.com/{name}/-/{name}-{version}.tgz"),
+                "shasum": "aaaa",
+                "integrity": "sha512-UPSTREAMupstream==",
+            }
+        })))
+        .mount(server)
+        .await;
+}
+
+// ── yarn-classic fragments ──────────────────────────────────────────────────
+// The hosted wiring is the lock entry itself; the upstream block is exactly
+// what the restore re-derives from `mock_yarn_registry`'s document.
 
-fn yarn_block(resolved: &str, integrity: &str) -> String {
+fn yarn_block_for(name: &str, version: &str, resolved: &str, integrity: &str) -> String {
     format!(
-        "left-pad@1.2.3:\n  version \"1.2.3\"\n  resolved \"{resolved}\"\n  integrity {integrity}"
+        "{name}@{version}:\n  version \"{version}\"\n  resolved \"{resolved}\"\n  integrity {integrity}"
     )
 }
 
-fn yarn_original_block() -> String {
-    yarn_block(
-        "https://registry.yarnpkg.com/left-pad/-/left-pad-1.2.3.tgz#aaaa",
+fn yarn_block(resolved: &str, integrity: &str) -> String {
+    yarn_block_for("left-pad", "1.2.3", resolved, integrity)
+}
+
+fn yarn_upstream_block(name: &str, version: &str) -> String {
+    yarn_block_for(
+        name,
+        version,
+        &format!("https://registry.yarnpkg.com/{name}/-/{name}-{version}.tgz#aaaa"),
         "sha512-UPSTREAMupstream==",
     )
 }
 
+fn yarn_original_block() -> String {
+    yarn_upstream_block("left-pad", "1.2.3")
+}
+
 fn yarn_redirected_block() -> String {
     yarn_block(LP_HOSTED_URL, "sha512-PATCHEDpatched==")
 }
 
+fn io_redirected_block() -> String {
+    yarn_block_for("is-odd", "3.0.1", IO_HOSTED_URL, "sha512-PATCHEDio==")
+}
+
 fn yarn_lock_content(block: &str) -> String {
     format!(
         "# THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.\n\
@@ -397,6 +517,7 @@ fn yarn_lock_content(block: &str) -> String {
     )
 }
 
+/// The yarn-classic edit a pre-v5 ledger recorded for the left-pad pin.
 fn yarn_classic_edit() -> FileEdit {
     FileEdit {
         path: "yarn.lock".to_string(),
@@ -408,10 +529,7 @@ fn yarn_classic_edit() -> FileEdit {
     }
 }
 
-// ── gem fragments for the hand-written gem record ───────────────────────────
-// `redirect_gemfile_lock_source_url` has NO per-purl revert (gem is not in
-// `redirect_revert_supported`); its unwind is the whole-ledger replay's
-// ReplaceFragment arm.
+// ── other pre-v5 ledger edits (never replayed) ──────────────────────────────
 
 fn gemfile_lock_content(remote: &str) -> String {
     format!(
@@ -431,45 +549,40 @@ fn gem_source_edit() -> FileEdit {
     }
 }
 
-/// The two-record fixture: an npm purl with a yarn-classic text edit (owned
-/// by the per-purl npm revert) and a gem purl with a Gemfile.lock edit
-/// (replay-only), both with REAL redirected fragments on disk.
-async fn write_two_record_fixture(root: &Path) {
+/// An edit kind no release understands (a ledger from a newer build).
+fn future_lock_edit() -> FileEdit {
+    FileEdit {
+        path: "future.lock".to_string(),
+        kind: "redirect_future_lock_entry".to_string(),
+        action: "rewritten".to_string(),
+        key: Some("left-pad@1.2.3".to_string()),
+        original: Some(Value::String(
+            "left-pad@1.2.3 sha512-UPSTREAMupstream==".to_string(),
+        )),
+        new: Some(Value::String(format!("left-pad@1.2.3 {LP_HOSTED_URL}"))),
+    }
+}
+
+/// Single-pin npm fixture: a yarn.lock hosted-wired to the mock patch host.
+fn write_single_npm_fixture(root: &Path) {
     std::fs::write(
         root.join("yarn.lock"),
         yarn_lock_content(&yarn_redirected_block()),
     )
     .unwrap();
-    std::fs::write(
-        root.join("Gemfile.lock"),
-        gemfile_lock_content(GEM_PATCH_REMOTE),
-    )
-    .unwrap();
-    write_hosted_ledger(
-        root,
-        vec![
-            (LP_PURL, patch_record(LP_UUID, "GHSA-lpad-aaaa-bbbb")),
-            (GEM_PURL, patch_record(GEM_UUID, "GHSA-gems-cccc-dddd")),
-        ],
-        vec![yarn_classic_edit(), gem_source_edit()],
-    )
-    .await;
 }
 
-/// Single-record npm fixture (yarn-classic wiring) for the manifest-less and
-/// preserve-state tests.
-async fn write_single_npm_fixture(root: &Path) {
+/// Two-pin fixture: left-pad then is-odd, both hosted in one yarn.lock.
+fn write_two_pin_fixture(root: &Path) {
     std::fs::write(
         root.join("yarn.lock"),
-        yarn_lock_content(&yarn_redirected_block()),
+        yarn_lock_content(&format!(
+            "{}\n\n{}",
+            yarn_redirected_block(),
+            io_redirected_block()
+        )),
     )
     .unwrap();
-    write_hosted_ledger(
-        root,
-        vec![(LP_PURL, patch_record(LP_UUID, "GHSA-lpad-aaaa-bbbb"))],
-        vec![yarn_classic_edit()],
-    )
-    .await;
 }
 
 // ---------------------------------------------------------------------------
@@ -477,9 +590,9 @@ async fn write_single_npm_fixture(root: &Path) {
 // ---------------------------------------------------------------------------
 
 /// Snapshot the pristine lock → `scan --mode hosted` wires it (resolved URL
-/// rewritten + ledger written) → bare in-process rollback → exit 0, lock
-/// byte-identical to pristine, redirect-state.json DELETED, and no manifest
-/// materialized as a side effect.
+/// rewritten, NO ledger written) → bare in-process rollback restoring the
+/// upstream entry from the mocked registry → exit 0, lock byte-identical to
+/// pristine, and nothing materialized under `.socket/` as a side effect.
 #[tokio::test]
 #[serial]
 async fn npm_hosted_round_trip() {
@@ -501,11 +614,12 @@ async fn npm_hosted_round_trip() {
     );
     assert_ne!(wired, pristine, "wiring must actually change the lock");
     assert!(
-        ledger_path(tmp.path()).is_file(),
-        "scan --mode hosted must write the redirect ledger"
+        !ledger_path(tmp.path()).exists(),
+        "scan --mode hosted keeps no redirect ledger: the lockfile is the record"
     );
 
-    let code = rollback_in_process(tmp.path(), Vec::new(), false).await;
+    mock_npm_registry(&server).await;
+    let code = rollback_online(tmp.path(), &server).await;
     assert_eq!(code, 0, "bare rollback over hosted wiring should exit 0");
 
     let restored = std::fs::read_to_string(tmp.path().join("package-lock.json")).unwrap();
@@ -513,27 +627,17 @@ async fn npm_hosted_round_trip() {
         restored, pristine,
         "rollback must restore the lock byte-identical to the pristine snapshot"
     );
-    assert!(
-        !ledger_path(tmp.path()).exists(),
-        "an emptied redirect ledger must be DELETED, not left as an empty file"
-    );
-    assert!(
-        !tmp.path().join(".socket/manifest.json").exists(),
-        "a hosted-only rollback must not materialize a manifest"
-    );
     assert!(
         !tmp.path().join(".socket").exists(),
-        "a fully unwound hosted project keeps no .socket/ residue: the ledger's \
-         vendor/ dir is pruned with it and the lock guard removes apply.lock and \
+        "a fully restored hosted project keeps no .socket/ residue: no manifest \
+         or ledger is materialized, and the lock guard removes apply.lock and \
          the emptied directory"
     );
 }
 
-/// Dry-run twin of the round trip — the review-caught regression: the
-/// per-purl dry revert must claim its npm JSON edits IN MEMORY so the
-/// whole-ledger replay does not refuse them as unclaimed (`group:npm`)
-/// and flip a would-succeed run to partial_failure. A hosted npm dry run
-/// exits 0, reports the purl as would-be-reverted, and mutates NOTHING.
+/// Dry-run twin of the round trip: a hosted npm dry run resolves the
+/// upstream entry exactly like a wet run (the registry IS asked), exits 0,
+/// and mutates NOTHING (no ledger is ever written either).
 #[tokio::test]
 #[serial]
 async fn npm_hosted_dry_run_previews_cleanly() {
@@ -547,40 +651,50 @@ async fn npm_hosted_dry_run_previews_cleanly() {
     let code = scan_run(hosted_scan_args(tmp.path(), server.uri())).await;
     assert_eq!(code, 0, "scan --mode hosted should succeed");
     let wired = std::fs::read_to_string(tmp.path().join("package-lock.json")).unwrap();
-    let ledger_before = std::fs::read(ledger_path(tmp.path())).unwrap();
+    mock_npm_registry(&server).await;
 
+    std::env::set_var(
+        "SOCKET_NPM_REGISTRY",
+        format!("{}/npm-registry", server.uri()),
+    );
     let args = RollbackArgs {
         targets: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
             cwd: tmp.path().to_path_buf(),
             manifest_path: ".socket/manifest.json".to_string(),
-            offline: true,
             json: true,
             yes: true,
             silent: true,
             dry_run: true,
+            patch_server_url: Some("http://patch.test".to_string()),
             ..socket_patch_cli::args::GlobalArgs::default()
         },
         one_off: false,
         preserve_state: false,
     };
     let code = rollback_run(args).await;
-    std::env::remove_var("SOCKET_OFFLINE");
+    std::env::remove_var("SOCKET_NPM_REGISTRY");
     std::env::remove_var("SOCKET_DRY_RUN");
-    assert_eq!(
-        code, 0,
-        "a hosted npm dry run must preview cleanly, never refuse its own \
-         per-purl-claimed edits"
+    assert_eq!(code, 0, "a hosted npm dry run must preview cleanly");
+    let registry_hits = server
+        .received_requests()
+        .await
+        .unwrap_or_default()
+        .iter()
+        .filter(|r| r.url.path().starts_with("/npm-registry/"))
+        .count();
+    assert!(
+        registry_hits >= 1,
+        "a dry run resolves the upstream entry like a wet run"
     );
     assert_eq!(
         std::fs::read_to_string(tmp.path().join("package-lock.json")).unwrap(),
         wired,
         "dry run must not touch the lock"
     );
-    assert_eq!(
-        std::fs::read(ledger_path(tmp.path())).unwrap(),
-        ledger_before,
-        "dry run must not touch the on-disk ledger"
+    assert!(
+        !tmp.path().join(".socket").exists(),
+        "dry run must write no ledger (or any .socket/ state)"
     );
 }
 
@@ -600,7 +714,8 @@ async fn npm_hosted_round_trip_envelope() {
     let code = scan_run(hosted_scan_args(tmp.path(), server.uri())).await;
     assert_eq!(code, 0, "scan --mode hosted should succeed");
 
-    let (code, envelope) = run_rollback_subprocess(tmp.path(), &[]);
+    mock_npm_registry(&server).await;
+    let (code, envelope) = run_rollback_subprocess_online(tmp.path(), &server, &[]);
     assert_eq!(code, 0, "bare rollback should exit 0: {envelope}");
     assert_eq!(envelope["status"], "success", "{envelope}");
     assert_eq!(
@@ -617,7 +732,7 @@ async fn npm_hosted_round_trip_envelope() {
     assert_eq!(
         envelope["manifest"]["removedEntries"],
         serde_json::json!([]),
-        "hosted state lives in the ledger, not the manifest: {envelope}"
+        "hosted state lives in the lockfile, not the manifest: {envelope}"
     );
     assert!(
         warning_codes(&envelope).contains(&"reinstall_required".to_string()),
@@ -626,7 +741,10 @@ async fn npm_hosted_round_trip_envelope() {
 
     let restored = std::fs::read_to_string(tmp.path().join("package-lock.json")).unwrap();
     assert_eq!(restored, pristine, "lock must be byte-restored");
-    assert!(!ledger_path(tmp.path()).exists(), "ledger must be deleted");
+    assert!(
+        !ledger_path(tmp.path()).exists(),
+        "no ledger is ever written"
+    );
 }
 
 // ---------------------------------------------------------------------------
@@ -636,8 +754,9 @@ async fn npm_hosted_round_trip_envelope() {
 /// A pip project wired by the REAL hosted flow (`get <uuid> --mode hosted`,
 /// the `in_process_get_hosted_ecosystems.rs` fixture — the UUID path needs
 /// no installed tree), then a bare rollback: requirements.txt restored
-/// byte-for-byte via the whole-ledger replay (pypi has no per-purl revert),
-/// ledger deleted, exit 0.
+/// byte-for-byte to the upstream `name==version` line (the file is
+/// unhashed, so no registry lookup is needed and the run may stay offline),
+/// no ledger ever written, exit 0.
 #[tokio::test]
 #[serial]
 async fn pypi_requirements_hosted_round_trip() {
@@ -726,10 +845,9 @@ async fn pypi_requirements_hosted_round_trip() {
         wired.contains(&url),
         "requirements.txt must be wired to the hosted wheel; got:\n{wired}"
     );
-    let ledger = std::fs::read_to_string(ledger_path(tmp.path())).unwrap();
     assert!(
-        ledger.contains(PY_PURL) && ledger.contains("redirect_requirements_line"),
-        "the ledger must record the pypi redirect; got:\n{ledger}"
+        !ledger_path(tmp.path()).exists(),
+        "get --mode hosted keeps no ledger: requirements.txt is the record"
     );
 
     // Manifest-less VEX over the committed hosted state (an EMPTY in-project
@@ -767,10 +885,6 @@ async fn pypi_requirements_hosted_round_trip() {
         restored, pristine,
         "requirements.txt must be restored byte-for-byte"
     );
-    assert!(
-        !ledger_path(tmp.path()).exists(),
-        "the emptied ledger must be deleted"
-    );
     assert!(
         !tmp.path().join(".socket/manifest.json").exists(),
         "hosted mode never touches the manifest"
@@ -807,249 +921,193 @@ async fn pypi_requirements_hosted_round_trip() {
 }
 
 // ---------------------------------------------------------------------------
-// 3. scoped rollback of an unsupported ecosystem fails closed
+// 3. scoped rollback restores only the named pins
 // ---------------------------------------------------------------------------
 
-/// A two-record ledger (npm + gem) scoped to ONLY the gem purl: gem has no
-/// per-purl revert and the scope does not cover the full record set, so the
-/// replay may not run — the run fails closed with the purl in
-/// `hosted.unsupported`, exit 1, and both the ledger and every wired file
-/// stay byte-identical on disk.
+/// Two hosted pins in one yarn.lock, scoped to ONE: only the named pin is
+/// restored to its upstream registry entry (each pin restores on its own;
+/// there is no whole-state replay), the other stays hosted byte-for-byte,
+/// and a pre-v5 ledger beside them is kept while a pin remains. The
+/// unscoped follow-up restores the other pin and then retires the ledger.
 #[tokio::test]
 #[serial]
-async fn scoped_unsupported_ecosystem_fails_closed() {
+async fn scoped_rollback_restores_only_the_named_pin() {
+    let server = MockServer::start().await;
+    mock_yarn_registry(&server, "left-pad", "1.2.3").await;
+    mock_yarn_registry(&server, "is-odd", "3.0.1").await;
     let tmp = tempfile::tempdir().unwrap();
-    write_two_record_fixture(tmp.path()).await;
+    write_two_pin_fixture(tmp.path());
+    write_legacy_ledger(tmp.path(), vec![yarn_classic_edit()]).await;
     let ledger_before = std::fs::read(ledger_path(tmp.path())).unwrap();
-    let yarn_before = std::fs::read_to_string(tmp.path().join("yarn.lock")).unwrap();
-    let gem_before = std::fs::read_to_string(tmp.path().join("Gemfile.lock")).unwrap();
 
-    let (code, envelope) = run_rollback_subprocess(tmp.path(), &[GEM_PURL]);
-    assert_eq!(
-        code, 1,
-        "a scoped hosted purl with no per-purl revert must fail closed: {envelope}"
-    );
-    assert_eq!(envelope["status"], "partial_failure", "{envelope}");
-    assert_eq!(
-        envelope["hosted"]["unsupported"],
-        serde_json::json!([GEM_PURL]),
-        "the refused purl must be reported unsupported: {envelope}"
-    );
+    let (code, envelope) = run_rollback_subprocess_online(tmp.path(), &server, &[LP_PURL]);
+    assert_eq!(code, 0, "{envelope}");
+    assert_eq!(envelope["status"], "success", "{envelope}");
     assert_eq!(
         envelope["hosted"]["reverted"],
-        serde_json::json!([]),
-        "nothing may be unwound on a refused scoped run: {envelope}"
-    );
-
-    assert_eq!(
-        std::fs::read(ledger_path(tmp.path())).unwrap(),
-        ledger_before,
-        "the ledger must stay byte-identical on a fail-closed run"
+        serde_json::json!([LP_PURL]),
+        "only the named pin is restored: {envelope}"
     );
+    assert_eq!(envelope["hosted"]["failed"], serde_json::json!([]));
     assert_eq!(
         std::fs::read_to_string(tmp.path().join("yarn.lock")).unwrap(),
-        yarn_before,
-        "the out-of-scope npm wiring must be untouched"
-    );
-    assert_eq!(
-        std::fs::read_to_string(tmp.path().join("Gemfile.lock")).unwrap(),
-        gem_before,
-        "the refused gem wiring must be untouched"
-    );
-}
-
-/// A ledger written by a newer socket-patch carries a hosted edit kind this
-/// release has no revert for (`redirect_future_lock_entry`). A scoped
-/// rollback of the purl it names must refuse with nothing written, and an
-/// unscoped one must keep the record while that edit survives.
-async fn write_unknown_kind_ledger_fixture(root: &Path, with_gem: bool) -> String {
-    let future_new = format!("left-pad@1.2.3 {LP_HOSTED_URL}");
-    let future_lock = format!("{future_new}\n");
-    std::fs::write(root.join("future.lock"), &future_lock).unwrap();
-    std::fs::write(
-        root.join("yarn.lock"),
-        yarn_lock_content(&yarn_redirected_block()),
-    )
-    .unwrap();
-    let mut records = vec![(LP_PURL, patch_record(LP_UUID, "GHSA-lpad-aaaa-bbbb"))];
-    let mut edits = vec![yarn_classic_edit()];
-    if with_gem {
-        std::fs::write(
-            root.join("Gemfile.lock"),
-            gemfile_lock_content(GEM_PATCH_REMOTE),
-        )
-        .unwrap();
-        records.push((GEM_PURL, patch_record(GEM_UUID, "GHSA-gems-cccc-dddd")));
-        edits.push(gem_source_edit());
-    }
-    edits.push(FileEdit {
-        path: "future.lock".to_string(),
-        kind: "redirect_future_lock_entry".to_string(),
-        action: "rewritten".to_string(),
-        key: Some("left-pad@1.2.3".to_string()),
-        original: Some(Value::String(
-            "left-pad@1.2.3 sha512-UPSTREAMupstream==".to_string(),
+        yarn_lock_content(&format!(
+            "{}\n\n{}",
+            yarn_original_block(),
+            io_redirected_block()
         )),
-        new: Some(Value::String(future_new)),
-    });
-    write_hosted_ledger(root, records, edits).await;
-    future_lock
-}
-
-fn ledger_edit_kinds(root: &Path) -> Vec<String> {
-    let ledger: Value = serde_json::from_slice(&std::fs::read(ledger_path(root)).unwrap()).unwrap();
-    ledger["edits"]
-        .as_array()
-        .unwrap()
-        .iter()
-        .map(|e| e["kind"].as_str().unwrap().to_string())
-        .collect()
-}
-
-#[tokio::test]
-#[serial]
-async fn scoped_rollback_refuses_a_purl_named_by_an_unknown_edit_kind() {
-    let tmp = tempfile::tempdir().unwrap();
-    let future_lock = write_unknown_kind_ledger_fixture(tmp.path(), true).await;
-    let ledger_before = std::fs::read(ledger_path(tmp.path())).unwrap();
-    let yarn_before = std::fs::read_to_string(tmp.path().join("yarn.lock")).unwrap();
-
-    let (code, envelope) = run_rollback_subprocess(tmp.path(), &[LP_PURL]);
-    assert_eq!(code, 1, "{envelope}");
-    assert_eq!(envelope["status"], "partial_failure", "{envelope}");
-    assert_eq!(
-        envelope["hosted"]["reverted"],
-        serde_json::json!([]),
-        "{envelope}"
-    );
-    let failed = envelope["hosted"]["failed"].as_array().unwrap();
-    assert_eq!(failed.len(), 1, "{envelope}");
-    assert_eq!(failed[0]["purl"], LP_PURL);
-    assert!(
-        failed[0]["error"].as_str().unwrap().contains(
-            "redirect_future_lock_entry edit this socket-patch release does not understand"
-        ),
-        "{envelope}"
+        "the out-of-scope pin must stay hosted"
     );
     assert_eq!(
         std::fs::read(ledger_path(tmp.path())).unwrap(),
-        ledger_before
+        ledger_before,
+        "a pre-v5 ledger is kept while a hosted pin remains"
     );
+
+    let code = rollback_online(tmp.path(), &server).await;
+    assert_eq!(code, 0, "the unscoped follow-up restores the rest");
     assert_eq!(
         std::fs::read_to_string(tmp.path().join("yarn.lock")).unwrap(),
-        yarn_before
+        yarn_lock_content(&format!(
+            "{}\n\n{}",
+            yarn_original_block(),
+            yarn_upstream_block("is-odd", "3.0.1")
+        ))
     );
-    assert_eq!(
-        std::fs::read_to_string(tmp.path().join("future.lock")).unwrap(),
-        future_lock
+    assert!(
+        !ledger_path(tmp.path()).exists(),
+        "with no hosted pin left the pre-v5 ledger is retired"
     );
 }
 
+/// A ledger written by an OLDER (or newer) socket-patch may carry edits of
+/// kinds this release never replays — an unknown kind, a gem source edit.
+/// v5 never replays a ledger at all: the yarn pin is restored from the
+/// registry (not from the ledger's recorded original), the files the
+/// ledger's other edits name are left byte-identical, and the ledger is
+/// retired once no hosted pin remains. Scoped and unscoped alike.
 #[tokio::test]
 #[serial]
-async fn unscoped_rollback_holds_the_record_beside_an_unknown_edit_kind() {
-    let tmp = tempfile::tempdir().unwrap();
-    let future_lock = write_unknown_kind_ledger_fixture(tmp.path(), true).await;
+async fn legacy_ledger_edits_of_any_kind_are_never_replayed() {
+    for scoped in [true, false] {
+        let server = MockServer::start().await;
+        mock_yarn_registry(&server, "left-pad", "1.2.3").await;
+        let tmp = tempfile::tempdir().unwrap();
+        write_single_npm_fixture(tmp.path());
+        let future_lock = format!("left-pad@1.2.3 {LP_HOSTED_URL}\n");
+        std::fs::write(tmp.path().join("future.lock"), &future_lock).unwrap();
+        let gem_lock = gemfile_lock_content(GEM_PATCH_REMOTE);
+        std::fs::write(tmp.path().join("Gemfile.lock"), &gem_lock).unwrap();
+        write_legacy_ledger(
+            tmp.path(),
+            vec![
+                // Its recorded original disagrees with the registry: a
+                // replay would write it, the restore must not.
+                FileEdit {
+                    original: Some(Value::String(yarn_block(
+                        "https://registry.yarnpkg.com/left-pad/-/left-pad-1.2.3.tgz#bbbb",
+                        "sha512-LEDGERledger==",
+                    ))),
+                    ..yarn_classic_edit()
+                },
+                gem_source_edit(),
+                future_lock_edit(),
+            ],
+        )
+        .await;
 
-    let code = rollback_in_process(tmp.path(), Vec::new(), false).await;
-    assert_eq!(
-        code, 1,
-        "an unknown edit kind must fail the rollback closed"
-    );
-    assert_eq!(
-        std::fs::read_to_string(tmp.path().join("future.lock")).unwrap(),
-        future_lock
-    );
-    let ledger: Value =
-        serde_json::from_slice(&std::fs::read(ledger_path(tmp.path())).unwrap()).unwrap();
-    assert!(ledger["records"].get(LP_PURL).is_some(), "{ledger}");
-    assert!(ledger["records"].get(GEM_PURL).is_some(), "{ledger}");
-    // The groups this release understands still unwind on disk; their
-    // records wait for the unknown group to clear.
-    assert_eq!(
-        ledger_edit_kinds(tmp.path()),
-        ["redirect_future_lock_entry"]
-    );
-    assert_eq!(
-        std::fs::read_to_string(tmp.path().join("yarn.lock")).unwrap(),
-        yarn_lock_content(&yarn_original_block())
-    );
-    assert_eq!(
-        std::fs::read_to_string(tmp.path().join("Gemfile.lock")).unwrap(),
-        gemfile_lock_content(GEM_UPSTREAM_REMOTE)
-    );
+        let targets: &[&str] = if scoped { &[LP_PURL] } else { &[] };
+        let (code, envelope) = run_rollback_subprocess_online(tmp.path(), &server, targets);
+        assert_eq!(code, 0, "scoped={scoped}: {envelope}");
+        assert_eq!(
+            envelope["hosted"]["reverted"],
+            serde_json::json!([LP_PURL]),
+            "scoped={scoped}: {envelope}"
+        );
+        assert_eq!(
+            std::fs::read_to_string(tmp.path().join("yarn.lock")).unwrap(),
+            yarn_lock_content(&yarn_original_block()),
+            "scoped={scoped}: the entry comes back from the registry, not the ledger"
+        );
+        assert_eq!(
+            std::fs::read_to_string(tmp.path().join("future.lock")).unwrap(),
+            future_lock,
+            "scoped={scoped}: an unknown-kind ledger edit is never replayed"
+        );
+        assert_eq!(
+            std::fs::read_to_string(tmp.path().join("Gemfile.lock")).unwrap(),
+            gem_lock,
+            "scoped={scoped}: a ledger-only gem edit is never replayed"
+        );
+        assert!(
+            !ledger_path(tmp.path()).exists(),
+            "scoped={scoped}: the pre-v5 ledger is retired once no hosted pin remains"
+        );
+    }
 }
 
-/// With the purl as the only hosted record the scope covers the whole
-/// ledger: the per-purl claim refuses, then the replay still unwinds
-/// yarn.lock but holds the record and the unknown edit.
+// ---------------------------------------------------------------------------
+// 4. a refused pin fails closed on its own
+// ---------------------------------------------------------------------------
+
+/// The registry answers for one pin and not the other: the answered pin is
+/// restored, the other is REFUSED with the `git checkout` remedy
+/// (`hosted.failed`, `partial_failure`, exit 1) and its block stays hosted
+/// byte-for-byte. An `--offline` run refuses every pin and writes nothing.
 #[tokio::test]
 #[serial]
-async fn scoped_rollback_of_the_only_record_holds_it_beside_an_unknown_edit_kind() {
-    let tmp = tempfile::tempdir().unwrap();
-    let future_lock = write_unknown_kind_ledger_fixture(tmp.path(), false).await;
+async fn a_refused_pin_fails_closed_beside_a_restored_one() {
+    let server = MockServer::start().await;
+    mock_yarn_registry(&server, "is-odd", "3.0.1").await;
 
-    let (code, envelope) = run_rollback_subprocess(tmp.path(), &[LP_PURL]);
+    // Offline: both refused, nothing written.
+    let tmp = tempfile::tempdir().unwrap();
+    write_two_pin_fixture(tmp.path());
+    let wired = std::fs::read_to_string(tmp.path().join("yarn.lock")).unwrap();
+    let (code, envelope) = run_rollback_subprocess(tmp.path(), &[]);
     assert_eq!(code, 1, "{envelope}");
-    assert_eq!(
-        envelope["hosted"]["reverted"],
-        serde_json::json!([]),
-        "{envelope}"
-    );
+    assert_eq!(envelope["status"], "partial_failure", "{envelope}");
+    assert_eq!(envelope["hosted"]["reverted"], serde_json::json!([]));
     let failed: Vec<&str> = envelope["hosted"]["failed"]
         .as_array()
         .unwrap()
         .iter()
         .map(|f| f["purl"].as_str().unwrap())
         .collect();
-    assert_eq!(failed, [LP_PURL, "group:unknown"], "{envelope}");
-    assert_eq!(
-        std::fs::read_to_string(tmp.path().join("future.lock")).unwrap(),
-        future_lock
+    assert_eq!(failed, [IO_PURL, LP_PURL], "{envelope}");
+    assert!(
+        envelope["hosted"]["failed"][0]["error"]
+            .as_str()
+            .is_some_and(|e| e.contains("this run is offline")
+                && e.contains(
+                    "restore it from version control instead (`git checkout -- yarn.lock`)"
+                )),
+        "{envelope}"
     );
     assert_eq!(
         std::fs::read_to_string(tmp.path().join("yarn.lock")).unwrap(),
-        yarn_lock_content(&yarn_original_block())
-    );
-    let ledger: Value =
-        serde_json::from_slice(&std::fs::read(ledger_path(tmp.path())).unwrap()).unwrap();
-    assert!(ledger["records"].get(LP_PURL).is_some(), "{ledger}");
-    assert_eq!(
-        ledger_edit_kinds(tmp.path()),
-        ["redirect_future_lock_entry"]
+        wired,
+        "an offline run writes nothing"
     );
-}
-
-// ---------------------------------------------------------------------------
-// 4. unscoped rollback replays the unsupported ecosystems
-// ---------------------------------------------------------------------------
-
-/// The same two-record ledger, unscoped: the npm purl unwinds through the
-/// per-purl revert and the gem purl through the whole-ledger reverse replay
-/// (its scope covers every record). Both files are byte-restored, the
-/// ledger is deleted, exit 0.
-#[tokio::test]
-#[serial]
-async fn unscoped_replays_unsupported_ecosystems() {
-    let tmp = tempfile::tempdir().unwrap();
-    write_two_record_fixture(tmp.path()).await;
-
-    let code = rollback_in_process(tmp.path(), Vec::new(), false).await;
-    assert_eq!(code, 0, "unscoped rollback must unwind BOTH records");
 
+    // Online, left-pad unanswered (404): is-odd restores on its own.
+    let (code, envelope) = run_rollback_subprocess_online(tmp.path(), &server, &[]);
+    assert_eq!(code, 1, "{envelope}");
+    assert_eq!(envelope["status"], "partial_failure", "{envelope}");
+    assert_eq!(envelope["hosted"]["reverted"], serde_json::json!([IO_PURL]));
     assert_eq!(
-        std::fs::read_to_string(tmp.path().join("yarn.lock")).unwrap(),
-        yarn_lock_content(&yarn_original_block()),
-        "the npm wiring must be unwound (per-purl revert)"
+        envelope["hosted"]["failed"][0]["purl"], LP_PURL,
+        "{envelope}"
     );
+    assert_eq!(envelope["hosted"]["unsupported"], serde_json::json!([]));
     assert_eq!(
-        std::fs::read_to_string(tmp.path().join("Gemfile.lock")).unwrap(),
-        gemfile_lock_content(GEM_UPSTREAM_REMOTE),
-        "the gem wiring must be unwound (whole-ledger replay)"
-    );
-    assert!(
-        !ledger_path(tmp.path()).exists(),
-        "all records and edits unwound: the ledger must be deleted"
+        std::fs::read_to_string(tmp.path().join("yarn.lock")).unwrap(),
+        yarn_lock_content(&format!(
+            "{}\n\n{}",
+            yarn_redirected_block(),
+            yarn_upstream_block("is-odd", "3.0.1")
+        )),
+        "the refused pin stays hosted, the other is restored"
     );
 }
 
@@ -1057,18 +1115,22 @@ async fn unscoped_replays_unsupported_ecosystems() {
 // 5. manifest-less hosted-only project vs. the truly-empty project
 // ---------------------------------------------------------------------------
 
-/// A hosted-only project (redirect ledger + wired lock, NO manifest) rolls
-/// back fine — a missing manifest is not fatal when a ledger holds work. A TRULY empty directory keeps the legacy "Manifest not found"
-/// exit-1 error.
+/// A hosted-only project (a wired lock, NO manifest, NO ledger) rolls back
+/// fine — a missing manifest is not fatal when the lockfiles pin hosted
+/// patches. A project whose only state is a stale pre-v5 ledger retires it
+/// and exits 0. A TRULY empty directory keeps the legacy "Manifest not
+/// found" exit-1 error.
 #[tokio::test]
 #[serial]
 async fn hosted_only_project_without_manifest() {
-    // Hosted-only: unwinds and exits 0.
+    // Hosted-only: restores and exits 0.
+    let server = MockServer::start().await;
+    mock_yarn_registry(&server, "left-pad", "1.2.3").await;
     let tmp = tempfile::tempdir().unwrap();
-    write_single_npm_fixture(tmp.path()).await;
-    assert!(!tmp.path().join(".socket/manifest.json").exists());
+    write_single_npm_fixture(tmp.path());
+    assert!(!tmp.path().join(".socket").exists());
 
-    let code = rollback_in_process(tmp.path(), Vec::new(), false).await;
+    let code = rollback_online(tmp.path(), &server).await;
     assert_eq!(
         code, 0,
         "a manifest-less hosted-only project must roll back fine"
@@ -1076,15 +1138,22 @@ async fn hosted_only_project_without_manifest() {
     assert_eq!(
         std::fs::read_to_string(tmp.path().join("yarn.lock")).unwrap(),
         yarn_lock_content(&yarn_original_block()),
-        "the hosted wiring must be unwound"
+        "the hosted pin must be restored to its upstream entry"
     );
-    assert!(!ledger_path(tmp.path()).exists(), "ledger must be deleted");
     assert!(
         !tmp.path().join(".socket").exists(),
-        "no manifest may be materialized, and the emptied .socket/ (ledger and \
-         vendor/ pruned, apply.lock removed) must be gone"
+        "no manifest or ledger may be materialized, and apply.lock is removed"
     );
 
+    // Only a stale pre-v5 ledger: retired, exit 0.
+    let stale = tempfile::tempdir().unwrap();
+    write_legacy_ledger(stale.path(), vec![yarn_classic_edit()]).await;
+    let (code, envelope) = run_rollback_subprocess(stale.path(), &[]);
+    assert_eq!(code, 0, "{envelope}");
+    assert_eq!(envelope["status"], "success", "{envelope}");
+    assert_eq!(envelope["legacyRedirectLedgerRemoved"], true, "{envelope}");
+    assert!(!ledger_path(stale.path()).exists());
+
     // Truly empty: all three stores absent keeps the legacy error.
     let empty = tempfile::tempdir().unwrap();
     let (code, envelope) = run_rollback_subprocess(empty.path(), &[]);
@@ -1103,20 +1172,23 @@ async fn hosted_only_project_without_manifest() {
 }
 
 // ---------------------------------------------------------------------------
-// 6. --preserve-state still unwinds hosted state
+// 6. --preserve-state still restores hosted pins
 // ---------------------------------------------------------------------------
 
-/// Hosted redirects have no preservable local state: a `--preserve-state`
-/// run still unwinds the wiring and drops the ledger records, surfacing the
+/// Hosted pins have no preservable local state: a `--preserve-state` run
+/// still restores the upstream entry, surfacing the
 /// `hosted_state_not_preservable` warning; manifest cleanup and GC stay
 /// skipped (`manifest.preserved`, `gc.skipped`).
 #[tokio::test]
 #[serial]
 async fn preserve_state_still_unwinds_hosted() {
+    let server = MockServer::start().await;
+    mock_yarn_registry(&server, "left-pad", "1.2.3").await;
     let tmp = tempfile::tempdir().unwrap();
-    write_single_npm_fixture(tmp.path()).await;
+    write_single_npm_fixture(tmp.path());
 
-    let (code, envelope) = run_rollback_subprocess(tmp.path(), &["--preserve-state"]);
+    let (code, envelope) =
+        run_rollback_subprocess_online(tmp.path(), &server, &["--preserve-state"]);
     assert_eq!(
         code, 0,
         "preserve-state hosted rollback exits 0: {envelope}"
@@ -1125,11 +1197,11 @@ async fn preserve_state_still_unwinds_hosted() {
     assert_eq!(
         envelope["hosted"]["reverted"],
         serde_json::json!([LP_PURL]),
-        "the wiring must still be unwound under --preserve-state: {envelope}"
+        "the pin must still be restored under --preserve-state: {envelope}"
     );
     assert!(
         warning_codes(&envelope).contains(&"hosted_state_not_preservable".to_string()),
-        "dropping hosted records under --preserve-state must be surfaced: {envelope}"
+        "restoring hosted pins under --preserve-state must be surfaced: {envelope}"
     );
     assert_eq!(
         envelope["manifest"]["preserved"], true,
@@ -1143,31 +1215,26 @@ async fn preserve_state_still_unwinds_hosted() {
     assert_eq!(
         std::fs::read_to_string(tmp.path().join("yarn.lock")).unwrap(),
         yarn_lock_content(&yarn_original_block()),
-        "the hosted wiring must be unwound on disk"
-    );
-    assert!(
-        !ledger_path(tmp.path()).exists(),
-        "hosted ledger records are dropped with the wiring — no preservable state"
+        "the hosted pin must be restored on disk"
     );
     assert!(
         !tmp.path().join(".socket").exists(),
-        "with nothing preservable, the emptied .socket/ is gone too"
+        "with nothing preservable, no .socket/ is left behind"
     );
 }
 
 /// Manifest-less VEX across the hosted npm round trip. Before the rollback
-/// a checkout of the committed state (package.json, the redirected lock,
-/// `.socket/`; nothing installable — the host is fictional — so the lock pin
-/// is the basis) attests `(redirected)` with the ledger, and without it from
-/// lockfile discovery + the patch API. After the bare rollback the restored
-/// lock names no patch and the ledger is gone: nothing attests, online or
-/// `--no-verify`, and the patch API is never asked.
+/// a checkout of the committed state (package.json, the redirected lock;
+/// nothing installable — the host is fictional — so the lock pin is the
+/// basis; no ledger exists) attests `(redirected)` from lockfile discovery +
+/// the patch API. After the bare rollback the restored lock names no patch:
+/// nothing attests, online or `--no-verify`, and the patch API is never
+/// asked.
 #[tokio::test]
 #[serial]
 async fn npm_hosted_round_trip_manifest_less_vex() {
     use vex_e2e_common::{
-        assert_absent, assert_attested, patch_view, run_vex, strip_ledgers, Marker, PatchApi,
-        VexRun,
+        assert_absent, assert_attested, patch_view, run_vex, Marker, PatchApi, VexRun,
     };
     let server = MockServer::start().await;
     mock_discovery(&server).await;
@@ -1203,8 +1270,13 @@ async fn npm_hosted_round_trip_manifest_less_vex() {
         dir
     };
     let wired = checkout("wired");
+    assert!(
+        !wired.join(".socket").exists(),
+        "hosted mode commits no .socket/ state"
+    );
 
-    let code = rollback_in_process(tmp.path(), Vec::new(), false).await;
+    mock_npm_registry(&server).await;
+    let code = rollback_online(tmp.path(), &server).await;
     assert_eq!(code, 0, "bare rollback");
     let reverted = checkout("reverted");
 
@@ -1225,17 +1297,7 @@ async fn npm_hosted_round_trip_manifest_less_vex() {
                     ..VexRun::online(&api)
                 };
                 let out = run_vex(&vex_e2e_common::binary(), &wired, &online());
-                assert_eq!(out.code, Some(0), "wired, ledger:\n{out}");
-                assert_attested(
-                    out.doc(),
-                    PURL,
-                    UUID,
-                    Marker::Redirected,
-                    &[(GHSA, &["CVE-2024-9"])],
-                );
-                strip_ledgers(&wired);
-                let out = run_vex(&vex_e2e_common::binary(), &wired, &online());
-                assert_eq!(out.code, Some(0), "wired, no ledger:\n{out}");
+                assert_eq!(out.code, Some(0), "wired:\n{out}");
                 assert_attested(
                     out.doc(),
                     PURL,
diff --git a/crates/socket-patch-cli/tests/in_process_rollback_hosted/vlt.rs b/crates/socket-patch-cli/tests/in_process_rollback_hosted/vlt.rs
index 7075ba26..0695f6fd 100644
--- a/crates/socket-patch-cli/tests/in_process_rollback_hosted/vlt.rs
+++ b/crates/socket-patch-cli/tests/in_process_rollback_hosted/vlt.rs
@@ -2,20 +2,51 @@
 //! then `rollback` / `remove` restoring the registry pins slot by slot
 //! (after vlt re-laid the line) and invalidating the patched installed
 //! copies so the next install extracts the registry bytes.
+//!
+//! v5 hosted mode keeps no ledger: the pins are read from `vlt-lock.json`
+//! (on the mock server's origin, recognized through `--patch-server-url`)
+//! and each is restored to the upstream registry entry re-resolved from the
+//! mock npm registry (`SOCKET_NPM_REGISTRY`).
 
 use std::path::Path;
 
 use serde_json::Value;
-use wiremock::MockServer;
+use wiremock::matchers::{method, path};
+use wiremock::{Mock, MockServer, ResponseTemplate};
 
 use crate::vlt_hosted_common::*;
 
 const RESTORED: &str = "restored registry pins for 1 packages; removed the patched installed \
      copies, so node_modules is incomplete until you run `vlt install` (or `vlt ci`)";
 
+/// Serve the npm registry's version document for left-pad@1.3.0 (the
+/// registry entry `registry_node` pins) under `/npm-registry`.
+async fn mock_registry(server: &MockServer) {
+    Mock::given(method("GET"))
+        .and(path(format!("/npm-registry/{NAME}/{VERSION}")))
+        .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+            "name": NAME,
+            "version": VERSION,
+            "dist": { "tarball": REGISTRY_URL, "integrity": UPSTREAM_SHA512 }
+        })))
+        .mount(server)
+        .await;
+}
+
+/// The node line the upstream restore writes back for `id`: slot [2] is the
+/// registry's `dist.integrity`, and — this lock recording no
+/// `options.registries` and no other default-registry node to read the
+/// convention from — a tilde-era node gets no resolved URL (slot [3]), per
+/// the restore's documented convention. (The URL `registry_node` carries is
+/// what the rewrite discarded; it is not derivable from the lock.)
+fn restored_node(id: &str) -> String {
+    format!("\"{id}\": [0,\"{NAME}\",\"{UPSTREAM_SHA512}\"]")
+}
+
 async fn hosted_vlt_project(root: &Path) -> MockServer {
     let server = MockServer::start().await;
     mock_all(&server).await;
+    mock_registry(&server).await;
     write_vlt_project(root, Era::V1);
     let (_, doc) = scan_hosted(root, &server, &[], &[]);
     assert_eq!(redirected(&doc), 1, "{doc:#}");
@@ -23,6 +54,7 @@ async fn hosted_vlt_project(root: &Path) -> MockServer {
         read(root, "vlt-lock.json"),
         vlt_lock(Era::V1, &[pinned_node(TILDE_ID, &server)])
     );
+    assert!(!ledger_path(root).exists(), "hosted mode keeps no ledger");
     server
 }
 
@@ -33,12 +65,25 @@ fn vlt_install_patched(root: &Path, server: &MockServer) {
     write_hidden_lock(root, &[pinned_node(TILDE_ID, server)]);
 }
 
-fn run_verb(root: &Path, verb: &str, extra: &[&str]) -> (i32, Value) {
+/// `<verb> [extra] --yes --json` online against `server` (registry +
+/// patch host); `(exit code, envelope, stderr)`.
+fn run_verb_raw(
+    root: &Path,
+    server: &MockServer,
+    verb: &str,
+    extra: &[&str],
+) -> (i32, Value, String) {
     let cwd = root.to_str().unwrap().to_string();
+    let uri = server.uri();
+    let registry = format!("{uri}/npm-registry");
     let mut args = vec![verb];
     args.extend_from_slice(extra);
-    args.extend_from_slice(&["--yes", "--offline", "--cwd", &cwd]);
-    let (code, doc, stderr) = run_json(root, &args, &[]);
+    args.extend_from_slice(&["--yes", "--patch-server-url", &uri, "--cwd", &cwd]);
+    run_json(root, &args, &[("SOCKET_NPM_REGISTRY", registry.as_str())])
+}
+
+fn run_verb(root: &Path, server: &MockServer, verb: &str, extra: &[&str]) -> (i32, Value) {
+    let (code, doc, stderr) = run_verb_raw(root, server, verb, extra);
     assert_eq!(code, 0, "{verb} must succeed: {doc:#}\n{stderr}");
     (code, doc)
 }
@@ -58,22 +103,23 @@ async fn vlt_hosted_round_trip() {
     for scoped in [true, false] {
         let tmp = tempfile::tempdir().unwrap();
         let root = tmp.path();
-        let pristine = vlt_lock(Era::V1, &[registry_node(TILDE_ID)]);
+        let pristine = vlt_lock(Era::V1, &[restored_node(TILDE_ID)]);
         let server = hosted_vlt_project(root).await;
         vlt_install_patched(root, &server);
 
         let targets: &[&str] = if scoped { &[PURL] } else { &[] };
-        let (_, doc) = run_verb(root, "rollback", targets);
+        let (_, doc) = run_verb(root, &server, "rollback", targets);
 
         assert_eq!(read(root, "vlt-lock.json"), pristine, "scoped={scoped}");
+        assert_eq!(
+            doc["hosted"]["reverted"],
+            serde_json::json!([PURL]),
+            "{doc:#}"
+        );
         assert_eq!(advisory_details(&doc), [RESTORED], "{doc:#}");
         assert!(!store_dir(root, TILDE_ID).exists());
         assert!(!root.join("node_modules/.vlt-lock.json").exists());
-        assert!(
-            !ledger_path(root).exists()
-                || !read(root, ".socket/vendor/redirect-state.json")
-                    .contains("redirect_vlt_lock_node")
-        );
+        assert!(!ledger_path(root).exists());
     }
 }
 
@@ -84,31 +130,49 @@ async fn vlt_hosted_remove_restores_and_emits_the_advisory() {
     let server = hosted_vlt_project(root).await;
     vlt_install_patched(root, &server);
 
-    let (_, doc) = run_verb(root, "remove", &[PURL]);
+    let (_, doc) = run_verb(root, &server, "remove", &[PURL]);
 
     assert_eq!(
         read(root, "vlt-lock.json"),
-        vlt_lock(Era::V1, &[registry_node(TILDE_ID)])
+        vlt_lock(Era::V1, &[restored_node(TILDE_ID)])
     );
     assert!(doc.to_string().contains(ADVISORY), "{doc:#}");
     assert!(!store_dir(root, TILDE_ID).exists());
 }
 
+/// Once vlt itself re-locked the package back onto the registry (a `vlt
+/// update`, or a relock to another version, optional or not), no lockfile
+/// pins a hosted patch any more — and v5 hosted mode keeps no ledger that
+/// could remember the patched store copy. Rollback therefore has no hosted
+/// state to act on: the plain "Manifest not found" exit 1, the lock and the
+/// installed copies untouched (`vlt install` / `vlt ci` owns the store).
 #[tokio::test]
-async fn vlt_rollback_after_vlt_update_invalidates_patched_store() {
-    let tmp = tempfile::tempdir().unwrap();
-    let root = tmp.path();
-    let _server = hosted_vlt_project(root).await;
-    let registry = vlt_lock(Era::V1, &[registry_node(TILDE_ID)]);
-    std::fs::write(root.join("vlt-lock.json"), &registry).unwrap();
-    install_store(root, TILDE_ID, PATCHED);
-    write_hidden_lock(root, &[registry_node(TILDE_ID)]);
+async fn vlt_rollback_after_a_relock_has_no_hosted_state_left() {
+    for (flags, version) in [(0, "1.3.0"), (0, "1.3.1"), (1, "1.3.1")] {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        let server = hosted_vlt_project(root).await;
+        let relocked = vlt_lock(
+            Era::V1,
+            &[with_flags(&registry_node(TILDE_ID), flags).replace("1.3.0", version)],
+        );
+        std::fs::write(root.join("vlt-lock.json"), &relocked).unwrap();
+        install_store(root, TILDE_ID, PATCHED);
+        write_hidden_lock(root, &[registry_node(TILDE_ID)]);
 
-    let (_, doc) = run_verb(root, "rollback", &[]);
+        let (code, doc, stderr) = run_verb_raw(root, &server, "rollback", &[]);
 
-    assert_eq!(read(root, "vlt-lock.json"), registry);
-    assert_eq!(advisory_details(&doc), [RESTORED], "{doc:#}");
-    assert!(!store_dir(root, TILDE_ID).exists());
+        let what = format!("flags={flags} version={version}");
+        assert_eq!(code, 1, "{what}: {doc:#}\n{stderr}");
+        assert_eq!(doc["error"], "Manifest not found", "{what}: {doc:#}");
+        assert_eq!(read(root, "vlt-lock.json"), relocked, "{what}");
+        assert!(
+            store_dir(root, TILDE_ID).join("index.js").exists(),
+            "{what}"
+        );
+        assert!(root.join("node_modules/.vlt-lock.json").exists(), "{what}");
+        assert!(!root.join(".socket").exists(), "{what}");
+    }
 }
 
 #[tokio::test]
@@ -123,11 +187,11 @@ async fn vlt_rollback_after_comma_move() {
     )
     .unwrap();
 
-    let (_, doc) = run_verb(root, "rollback", &[PURL]);
+    let (_, doc) = run_verb(root, &server, "rollback", &[PURL]);
 
     assert_eq!(
         read(root, "vlt-lock.json"),
-        vlt_lock(Era::V1, &[registry_node(TILDE_ID), sibling])
+        vlt_lock(Era::V1, &[restored_node(TILDE_ID), sibling])
     );
     assert!(
         advisory_details(&doc).is_empty(),
@@ -143,13 +207,13 @@ async fn vlt_rollback_after_e0_flag_change() {
     let relaid = pinned_node(TILDE_ID, &server).replacen("[0,", "[1,", 1);
     std::fs::write(root.join("vlt-lock.json"), vlt_lock(Era::V1, &[relaid])).unwrap();
 
-    run_verb(root, "rollback", &[]);
+    run_verb(root, &server, "rollback", &[]);
 
     assert_eq!(
         read(root, "vlt-lock.json"),
         vlt_lock(
             Era::V1,
-            &[registry_node(TILDE_ID).replacen("[0,", "[1,", 1)]
+            &[restored_node(TILDE_ID).replacen("[0,", "[1,", 1)]
         )
     );
 }
@@ -161,7 +225,7 @@ async fn vlt_rollback_honors_no_vlt_install_cleanup() {
     let server = hosted_vlt_project(root).await;
     vlt_install_patched(root, &server);
 
-    let (_, doc) = run_verb(root, "rollback", &["--no-vlt-install-cleanup"]);
+    let (_, doc) = run_verb(root, &server, "rollback", &["--no-vlt-install-cleanup"]);
 
     assert_eq!(
         advisory_details(&doc),
@@ -179,11 +243,11 @@ async fn vlt_rollback_honors_no_vlt_install_cleanup() {
 async fn vlt_rollback_of_a_pristine_tree_keeps_it() {
     let tmp = tempfile::tempdir().unwrap();
     let root = tmp.path();
-    let _server = hosted_vlt_project(root).await;
+    let server = hosted_vlt_project(root).await;
     install_store(root, TILDE_ID, PRISTINE);
     write_hidden_lock(root, &[registry_node(TILDE_ID)]);
 
-    let (_, doc) = run_verb(root, "rollback", &[]);
+    let (_, doc) = run_verb(root, &server, "rollback", &[]);
 
     assert!(advisory_details(&doc).is_empty(), "{doc:#}");
     assert!(store_dir(root, TILDE_ID).join("index.js").exists());
@@ -201,6 +265,7 @@ async fn hosted_optional_project(root: &Path, flags: u8) -> MockServer {
 async fn hosted_flagged_project(root: &Path, nodes: &[(&str, u8)]) -> MockServer {
     let server = MockServer::start().await;
     mock_all(&server).await;
+    mock_registry(&server).await;
     write_vlt_project(root, Era::V1);
     let registry: Vec<String> = nodes
         .iter()
@@ -233,14 +298,14 @@ async fn vlt_rollback_keeps_a_patched_optional_copy() {
     for (verb, flags) in [("rollback", 1), ("rollback", 3), ("remove", 1)] {
         let tmp = tempfile::tempdir().unwrap();
         let root = tmp.path();
-        let _server = hosted_optional_project(root, flags).await;
+        let server = hosted_optional_project(root, flags).await;
         let targets: &[&str] = if verb == "remove" { &[PURL] } else { &[] };
 
-        let (_, doc) = run_verb(root, verb, targets);
+        let (_, doc) = run_verb(root, &server, verb, targets);
 
         assert_eq!(
             read(root, "vlt-lock.json"),
-            vlt_lock(Era::V1, &[with_flags(&registry_node(TILDE_ID), flags)]),
+            vlt_lock(Era::V1, &[with_flags(&restored_node(TILDE_ID), flags)]),
             "{verb} flags={flags}"
         );
         assert_eq!(
@@ -279,18 +344,18 @@ async fn vlt_rollback_removes_the_prod_copy_keeps_the_optional_one() {
     ] {
         let tmp = tempfile::tempdir().unwrap();
         let root = tmp.path();
-        let _server = hosted_flagged_project(root, &nodes).await;
+        let server = hosted_flagged_project(root, &nodes).await;
         let expected = if cleaned { &removed } else { &skipped };
 
-        let (_, doc) = run_verb(root, verb, extra);
+        let (_, doc) = run_verb(root, &server, verb, extra);
 
         assert_eq!(
             read(root, "vlt-lock.json"),
             vlt_lock(
                 Era::V1,
                 &[
-                    registry_node(TILDE_ID),
-                    with_flags(&registry_node(optional), 1)
+                    restored_node(TILDE_ID),
+                    with_flags(&restored_node(optional), 1)
                 ]
             ),
             "{verb} {extra:?}"
@@ -318,64 +383,18 @@ async fn vlt_rollback_removes_the_prod_copy_keeps_the_optional_one() {
     }
 }
 
-/// Once vlt re-locked the package, the healed DepID is gone from the lock,
-/// so the heal goes by the flags the ledger recorded for it.
-#[tokio::test]
-async fn vlt_rollback_after_relock_goes_by_the_recorded_flags() {
-    for flags in [0, 1] {
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        let _server = hosted_optional_project(root, flags).await;
-        let relocked = vlt_lock(
-            Era::V1,
-            &[with_flags(&registry_node(TILDE_ID), flags).replace("1.3.0", "1.3.1")],
-        );
-        std::fs::write(root.join("vlt-lock.json"), &relocked).unwrap();
-        write_hidden_lock(root, &[]);
-
-        let (_, doc) = run_verb(root, "rollback", &[]);
-
-        assert_eq!(read(root, "vlt-lock.json"), relocked);
-        let (advisory, kept) = if flags == 0 {
-            (RESTORED.to_string(), false)
-        } else {
-            (optional_kept(1, 1), true)
-        };
-        assert_eq!(advisory_details(&doc), [advisory], "flags={flags}: {doc:#}");
-        assert_eq!(
-            store_dir(root, TILDE_ID).join("index.js").exists(),
-            kept,
-            "flags={flags}"
-        );
-    }
-}
-
 const OTHER: &str = "right-pad";
 const OTHER_UUID: &str = "cccccccc-cccc-4ccc-8ccc-cccccccccccc";
+const OTHER_PURL: &str = "pkg:npm/right-pad@1.3.0";
 
 fn as_other(text: &str) -> String {
     text.replace(NAME, OTHER).replace(UUID, OTHER_UUID)
 }
 
-/// Add a second hosted vlt package to the ledger and the lock by renaming
-/// left-pad's recorded edit, record and pinned node.
+/// Add a second hosted vlt package (right-pad, its own patch uuid) to the
+/// lock by renaming left-pad's pinned node. The lock pin is the whole
+/// hosted state; the mock registry does NOT serve right-pad.
 fn add_second_hosted_package(root: &Path, server: &MockServer) -> String {
-    let path = ledger_path(root);
-    let mut ledger: Value = serde_json::from_str(&read(root, ".socket/vendor/redirect-state.json"))
-        .expect("the hosted run wrote a ledger");
-    let edits: Vec<Value> = ledger["edits"]
-        .as_array()
-        .unwrap()
-        .iter()
-        .filter(|e| e["kind"] == "redirect_vlt_lock_node")
-        .map(|e| serde_json::from_str(&as_other(&e.to_string())).unwrap())
-        .collect();
-    assert_eq!(edits.len(), 1);
-    ledger["edits"].as_array_mut().unwrap().extend(edits);
-    let record: Value =
-        serde_json::from_str(&as_other(&ledger["records"][PURL].to_string())).unwrap();
-    ledger["records"][as_other(PURL)] = record;
-    std::fs::write(&path, serde_json::to_vec_pretty(&ledger).unwrap()).unwrap();
     let other_pinned = as_other(&pinned_node(TILDE_ID, server));
     std::fs::write(
         root.join("vlt-lock.json"),
@@ -395,15 +414,13 @@ fn other_store_dir(root: &Path) -> std::path::PathBuf {
         .join(OTHER)
 }
 
-/// A scoped rollback of one of two hosted vlt packages takes the per-purl
-/// path (not a whole-ledger replay): only that package's pin is restored
-/// and only its patched store entry (plus the hidden lock) is removed.
-#[tokio::test]
-async fn vlt_scoped_rollback_of_one_of_two_heals_only_that_package() {
-    let tmp = tempfile::tempdir().unwrap();
-    let root = tmp.path();
-    let server = hosted_vlt_project(root).await;
-    let other_pinned = add_second_hosted_package(root, &server);
+/// Both packages installed patched, with the hidden lock recording both
+/// pins.
+fn install_both_patched(
+    root: &Path,
+    server: &MockServer,
+    other_pinned: &str,
+) -> std::path::PathBuf {
     install_store(root, TILDE_ID, PATCHED);
     let other = other_store_dir(root);
     std::fs::create_dir_all(&other).unwrap();
@@ -415,14 +432,32 @@ async fn vlt_scoped_rollback_of_one_of_two_heals_only_that_package() {
     std::fs::write(other.join("index.js"), PATCHED).unwrap();
     write_hidden_lock(
         root,
-        &[pinned_node(TILDE_ID, &server), other_pinned.clone()],
+        &[pinned_node(TILDE_ID, server), other_pinned.to_string()],
     );
+    other
+}
 
-    let (_, doc) = run_verb(root, "rollback", &[PURL]);
+/// A scoped rollback of one of two hosted vlt packages restores only that
+/// package's pin and removes only its patched store entry (plus the hidden
+/// lock); the other package stays pinned and installed.
+#[tokio::test]
+async fn vlt_scoped_rollback_of_one_of_two_heals_only_that_package() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    let server = hosted_vlt_project(root).await;
+    let other_pinned = add_second_hosted_package(root, &server);
+    let other = install_both_patched(root, &server, &other_pinned);
+
+    let (_, doc) = run_verb(root, &server, "rollback", &[PURL]);
 
     assert_eq!(
         read(root, "vlt-lock.json"),
-        vlt_lock(Era::V1, &[registry_node(TILDE_ID), other_pinned])
+        vlt_lock(Era::V1, &[restored_node(TILDE_ID), other_pinned])
+    );
+    assert_eq!(
+        doc["hosted"]["reverted"],
+        serde_json::json!([PURL]),
+        "{doc:#}"
     );
     assert_eq!(advisory_details(&doc), [RESTORED], "{doc:#}");
     assert!(!store_dir(root, TILDE_ID).exists());
@@ -431,22 +466,20 @@ async fn vlt_scoped_rollback_of_one_of_two_heals_only_that_package() {
         other.join("index.js").exists(),
         "the other package's copy stays"
     );
-    let ledger = read(root, ".socket/vendor/redirect-state.json");
-    assert!(ledger.contains(OTHER_UUID), "{ledger}");
 }
 
-/// Hosted rollback reads `vlt-lock.json` before any revert (to find the
-/// store copies to heal). A FIFO planted at that path must fail the read at
-/// once through the FIFO-safe opener, never block the process in open(2)
-/// waiting for a writer, and the rollback then fails closed: the ledger
-/// keeps the record and the FIFO is left as it was.
+/// Hosted rollback reads `vlt-lock.json` (to find the pins and the store
+/// copies to heal). A FIFO planted at that path must fail the read at once
+/// through the FIFO-safe opener, never block the process in open(2)
+/// waiting for a writer; the run then fails closed and the FIFO is left as
+/// it was.
 #[cfg(unix)]
 #[tokio::test]
 async fn vlt_hosted_rollback_fails_fast_on_a_fifo_lock() {
     use std::os::unix::fs::FileTypeExt as _;
     let tmp = tempfile::tempdir().unwrap();
     let root = tmp.path();
-    let _server = hosted_vlt_project(root).await;
+    let server = hosted_vlt_project(root).await;
     let lock = root.join("vlt-lock.json");
     std::fs::remove_file(&lock).unwrap();
     let status = std::process::Command::new("mkfifo")
@@ -454,11 +487,20 @@ async fn vlt_hosted_rollback_fails_fast_on_a_fifo_lock() {
         .status()
         .unwrap();
     assert!(status.success());
-    let ledger_before = read(root, ".socket/vendor/redirect-state.json");
 
     let cwd = root.to_str().unwrap().to_string();
+    let uri = server.uri();
     let mut child = scrubbed_cli()
-        .args(["rollback", "--json", "--yes", "--offline", "--cwd", &cwd])
+        .env("SOCKET_NPM_REGISTRY", format!("{uri}/npm-registry"))
+        .args([
+            "rollback",
+            "--json",
+            "--yes",
+            "--patch-server-url",
+            &uri,
+            "--cwd",
+            &cwd,
+        ])
         .stdout(std::process::Stdio::null())
         .stderr(std::process::Stdio::null())
         .spawn()
@@ -486,50 +528,48 @@ async fn vlt_hosted_rollback_fails_fast_on_a_fifo_lock() {
         .unwrap()
         .file_type()
         .is_fifo());
-    assert_eq!(
-        read(root, ".socket/vendor/redirect-state.json"),
-        ledger_before,
-        "nothing is half-reverted"
-    );
+    assert!(!ledger_path(root).exists(), "nothing is written");
 }
 
-/// Replay groups commit on their own: when an unscoped rollback's
-/// package-lock.json group refuses (drifted since the redirect) while the
-/// vlt group restores the registry pins, the patched store copy the
-/// restored vlt-lock.json no longer names is still removed. The heal keys
-/// off the vlt group's own outcome, not off any group's refusal.
+/// Each pin restores or refuses on its own: when an unscoped rollback's
+/// right-pad pin is refused (the registry does not answer for it) while
+/// the left-pad pin is restored, left-pad's patched store copy — which the
+/// restored vlt-lock.json no longer names — is still removed. The heal
+/// follows the restored pins, not the run's overall outcome.
 #[tokio::test]
-async fn vlt_heal_follows_the_vlt_group_when_another_group_refuses() {
+async fn vlt_heal_follows_the_restored_pin_when_another_pin_refuses() {
     let tmp = tempfile::tempdir().unwrap();
     let root = tmp.path();
-    let server = MockServer::start().await;
-    mock_all(&server).await;
-    write_vlt_project(root, Era::V1);
-    std::fs::write(root.join("package-lock.json"), package_lock()).unwrap();
-    let (_, doc) = scan_hosted(root, &server, &["--no-npm-allow-remote-config"], &[]);
-    assert_eq!(redirected(&doc), 1, "the scan redirects both locks");
-    vlt_install_patched(root, &server);
-    let drifted = read(root, "package-lock.json")
-        .replace(&artifact_url(&server), "https://example.invalid/left-pad-1.3.0.tgz");
-    std::fs::write(root.join("package-lock.json"), &drifted).unwrap();
+    let server = hosted_vlt_project(root).await;
+    let other_pinned = add_second_hosted_package(root, &server);
+    let other = install_both_patched(root, &server, &other_pinned);
 
-    let cwd = root.to_str().unwrap().to_string();
-    let (code, doc, _) = run_json(
-        root,
-        &["rollback", "--yes", "--offline", "--cwd", &cwd],
-        &[],
-    );
+    let (code, doc, _) = run_verb_raw(root, &server, "rollback", &[]);
 
-    assert_ne!(code, 0, "the refused package-lock.json group fails the run");
+    assert_ne!(code, 0, "the refused right-pad pin fails the run");
+    assert_eq!(doc["status"], "partial_failure", "{doc:#}");
+    assert_eq!(
+        doc["hosted"]["reverted"],
+        serde_json::json!([PURL]),
+        "{doc:#}"
+    );
+    assert_eq!(doc["hosted"]["failed"][0]["purl"], OTHER_PURL, "{doc:#}");
     assert_eq!(
         read(root, "vlt-lock.json"),
-        vlt_lock(Era::V1, &[registry_node(TILDE_ID)]),
-        "the vlt group restored the registry pins"
+        vlt_lock(Era::V1, &[restored_node(TILDE_ID), other_pinned]),
+        "left-pad restored, the refused right-pad pin untouched"
     );
-    assert_eq!(read(root, "package-lock.json"), drifted, "the refused group wrote nothing");
     assert!(
         !store_dir(root, TILDE_ID).exists(),
-        "the patched store copy is removed for the restored pins"
+        "the patched store copy is removed for the restored pin"
+    );
+    assert!(
+        other.join("index.js").exists(),
+        "the refused package's copy stays"
+    );
+    assert_eq!(
+        advisory_details(&doc),
+        [RESTORED],
+        "the heal advisory is reported"
     );
-    assert_eq!(advisory_details(&doc), [RESTORED], "the heal advisory is reported");
 }
diff --git a/crates/socket-patch-cli/tests/in_process_vendor.rs b/crates/socket-patch-cli/tests/in_process_vendor.rs
index e0767718..15c8aaf8 100644
--- a/crates/socket-patch-cli/tests/in_process_vendor.rs
+++ b/crates/socket-patch-cli/tests/in_process_vendor.rs
@@ -1111,17 +1111,130 @@ fn hosted_scan_cli(root: &Path, api_url: &str) -> (i32, Value) {
     (code, env)
 }
 
+/// A single-package npm tarball (`package/package.json` + `package/index.js`)
+/// — the pristine bytes a mock registry serves for the upstream restore.
+fn npm_tgz(name: &str, version: &str, index: &[u8]) -> Vec<u8> {
+    let enc = flate2::write::GzEncoder::new(Vec::new(), flate2::Compression::default());
+    let mut builder = tar::Builder::new(enc);
+    let manifest = format!(r#"{{"name":"{name}","version":"{version}"}}"#);
+    for (path, bytes) in [
+        ("package/package.json", manifest.as_bytes()),
+        ("package/index.js", index),
+    ] {
+        let mut header = tar::Header::new_gnu();
+        header.set_size(bytes.len() as u64);
+        header.set_mode(0o644);
+        header.set_mtime(0);
+        header.set_cksum();
+        builder.append_data(&mut header, path, bytes).unwrap();
+    }
+    builder.into_inner().unwrap().finish().unwrap()
+}
+
+/// `sha512-<base64>` SRI of `bytes`.
+fn sri_sha512(bytes: &[u8]) -> String {
+    use base64::Engine as _;
+    use sha2::Sha512;
+    format!(
+        "sha512-{}",
+        base64::engine::general_purpose::STANDARD.encode(Sha512::digest(bytes))
+    )
+}
+
+/// Mount the npm registry surface the v5 upstream restore reads
+/// (`SOCKET_NPM_REGISTRY`): `GET /<name>/<version>` (the version document)
+/// and the tarball it names. Returns the dist `(tarball, integrity)`.
+async fn mount_npm_registry(
+    server: &wiremock::MockServer,
+    name: &str,
+    version: &str,
+    tgz: Vec<u8>,
+) -> (String, String) {
+    use wiremock::matchers::{method, path};
+    use wiremock::{Mock, ResponseTemplate};
+    let tarball_path = format!("/{name}/-/{name}-{version}.tgz");
+    let tarball = format!("{}{tarball_path}", server.uri());
+    let integrity = sri_sha512(&tgz);
+    Mock::given(method("GET"))
+        .and(path(format!("/{name}/{version}")))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+            "name": name,
+            "version": version,
+            "dist": { "tarball": tarball, "integrity": integrity }
+        })))
+        .mount(server)
+        .await;
+    Mock::given(method("GET"))
+        .and(path(tarball_path))
+        .respond_with(ResponseTemplate::new(200).set_body_bytes(tgz))
+        .mount(server)
+        .await;
+    (tarball, integrity)
+}
+
+/// The env that points a run's hosted recognition (`SOCKET_PATCH_SERVER_URL`)
+/// and upstream restore (`SOCKET_NPM_REGISTRY`) at the mocks, anonymous.
+fn online_env(registry: &str, patch_server: &str) -> [(&'static str, String); 3] {
+    [
+        ("SOCKET_NO_API_TOKEN", "1".to_string()),
+        ("SOCKET_NPM_REGISTRY", registry.to_string()),
+        ("SOCKET_PATCH_SERVER_URL", patch_server.to_string()),
+    ]
+}
+
+/// `vendor --json --cwd <cwd> <extra...>` ONLINE against the mock registry
+/// / patch server (the takeover's upstream restore needs the registry).
+fn vendor_online_cli(
+    cwd: &Path,
+    registry: &str,
+    patch_server: &str,
+    extra: &[&str],
+) -> (i32, Value) {
+    let mut args = vec!["vendor", "--json", "--cwd", cwd.to_str().unwrap()];
+    args.extend_from_slice(extra);
+    let env = online_env(registry, patch_server);
+    let env: Vec<(&str, &str)> = env.iter().map(|(k, v)| (*k, v.as_str())).collect();
+    let (code, stdout, stderr) = run_cli(cwd, &args, &env);
+    let envelope: Value = serde_json::from_str(&stdout).unwrap_or_else(|e| {
+        panic!("vendor --json must emit an envelope: {e}\nstdout:\n{stdout}\nstderr:\n{stderr}")
+    });
+    (code, envelope)
+}
+
+/// `lock` with its (single) berry `checksum: 10c0/<hex>` value swapped for
+/// the fixture's placeholder, plus the value found — the upstream restore
+/// re-derives the checksum from the registry tarball, so a byte comparison
+/// against the pristine fixture compares everything else.
+fn split_berry_checksum(lock: &str) -> (String, String) {
+    let re = regex::Regex::new(r"checksum: (10c0/[0-9a-f]{128})").unwrap();
+    let found = re
+        .captures(lock)
+        .map(|c| c[1].to_string())
+        .unwrap_or_else(|| panic!("no 10c0 checksum in {lock:?}"));
+    let normalized = re
+        .replace(lock, format!("checksum: 10c0/{}", "3".repeat(128)).as_str())
+        .into_owned();
+    (normalized, found)
+}
+
 /// Mode takeovers on the Windows shapes, both directions, hermetic. Hosted →
-/// vendored: `vendor` reverts the CRLF hosted redirect (the ledger's CRLF
-/// fragments) before wiring, and `vendor --revert` then lands on the
-/// pristine CRLF + BOM pair. Vendored → hosted: `scan --mode hosted`
-/// reverts the vendored pair first (package.json back byte-exact, BOM and
-/// CRLF included), redirects the CRLF lock, and `rollback` restores the
-/// pristine lock.
+/// vendored: `vendor` restores the CRLF hosted pin's upstream registry
+/// entry (v5: re-resolved from the registry, no ledger) before wiring, and
+/// `vendor --revert` then lands on the upstream CRLF + BOM pair — not the
+/// hosted URL. Vendored → hosted: `scan --mode hosted` reverts the vendored
+/// pair first (package.json back byte-exact, BOM and CRLF included),
+/// redirects the CRLF lock, and `rollback` restores the upstream lock.
 #[tokio::test]
 async fn berry_crlf_takeovers_round_trip_both_directions() {
     let server = wiremock::MockServer::start().await;
     let hosted_url = mount_berry_hosted_api(&server).await;
+    mount_npm_registry(
+        &server,
+        "left-pad",
+        "1.3.0",
+        npm_tgz("left-pad", "1.3.0", ORIG_INDEX),
+    )
+    .await;
     let encoded = socket_patch_core::utils::uri::encode_uri_component(&hosted_url);
     let (pkg, lock) = (
         windows_shape(BERRY_WIN_PKG, true),
@@ -1148,19 +1261,19 @@ async fn berry_crlf_takeovers_round_trip_both_directions() {
     let hosted_lock = std::fs::read_to_string(root.join("yarn.lock")).unwrap();
     assert!(hosted_lock.contains(&encoded), "{hosted_lock:?}");
     assert_crlf(root, "hosted");
+    assert!(
+        !root.join(".socket/vendor/redirect-state.json").exists(),
+        "hosted mode writes no ledger"
+    );
 
-    let (code, env) = vendor_cli(root, &[]);
-    assert_eq!(code, 0, "vendor over the hosted redirect: {env:#}");
+    let (code, env) = vendor_online_cli(root, &server.uri(), &server.uri(), &[]);
+    assert_eq!(code, 0, "vendor over the hosted pin: {env:#}");
     assert_eq!(env["summary"]["applied"], 1, "{env:#}");
     assert!(
         env.to_string()
             .contains("vendor_takeover_reverted_redirect"),
         "the takeover is surfaced: {env:#}"
     );
-    assert!(
-        !root.join(".socket/vendor/redirect-state.json").exists(),
-        "the superseded redirect ledger is dropped"
-    );
     let vendored_lock = std::fs::read_to_string(root.join("yarn.lock")).unwrap();
     assert!(
         !vendored_lock.contains("__archiveUrl") && vendored_lock.contains(".socket/vendor/npm/"),
@@ -1169,9 +1282,16 @@ async fn berry_crlf_takeovers_round_trip_both_directions() {
     assert_crlf(root, "hosted→vendored");
     let (code, env) = vendor_cli(root, &["--revert"]);
     assert_eq!(code, 0, "revert: {env:#}");
+    let reverted = std::fs::read_to_string(root.join("yarn.lock")).unwrap();
+    let (normalized, upstream_checksum) = split_berry_checksum(&reverted);
     assert_eq!(
-        std::fs::read_to_string(root.join("yarn.lock")).unwrap(),
-        lock
+        normalized, lock,
+        "revert lands on the upstream registry entry (CRLF kept), not the hosted URL"
+    );
+    assert_ne!(
+        upstream_checksum,
+        format!("10c0/{}", "7".repeat(128)),
+        "the hosted grant's checksum is gone"
     );
     assert_eq!(
         std::fs::read_to_string(root.join("package.json")).unwrap(),
@@ -1203,23 +1323,26 @@ async fn berry_crlf_takeovers_round_trip_both_directions() {
         "fully hosted: {hosted_lock:?}"
     );
     assert_crlf(root, "vendored→hosted");
+    let env_pairs = online_env(&server.uri(), &server.uri());
+    let env_pairs: Vec<(&str, &str)> = env_pairs.iter().map(|(k, v)| (*k, v.as_str())).collect();
     let (code, stdout, stderr) = run_cli(
         root,
         &[
             "rollback",
             "--json",
             "--yes",
-            "--offline",
             "--cwd",
             root.to_str().unwrap(),
         ],
-        &[],
+        &env_pairs,
     );
     assert_eq!(code, 0, "rollback: {stdout}\n{stderr}");
+    let rolled_back = std::fs::read_to_string(root.join("yarn.lock")).unwrap();
+    let (normalized, checksum) = split_berry_checksum(&rolled_back);
+    assert_eq!(normalized, lock, "rollback restores the upstream CRLF lock");
     assert_eq!(
-        std::fs::read_to_string(root.join("yarn.lock")).unwrap(),
-        lock,
-        "rollback restores the pristine CRLF lock"
+        checksum, upstream_checksum,
+        "both unwinds re-derive the same upstream checksum"
     );
     assert_eq!(
         std::fs::read_to_string(root.join("package.json")).unwrap(),
@@ -1424,7 +1547,7 @@ async fn berry_takeovers_refuse_before_reverting_the_old_mode() {
             assert_eq!(
                 berry_wiring_snapshot(root),
                 before,
-                "{ctx}: the hosted lock edits and redirect ledger stay byte-identical"
+                "{ctx}: the hosted lock edits stay byte-identical"
             );
         }
     }
@@ -3178,23 +3301,45 @@ snapshots:
         std::fs::write(socket.join("blobs").join(after_hash), PATCHED_INDEX).unwrap();
     }
 
-    fn takeover_warnings(envelope: &Value) -> Vec<&str> {
-        envelope["warnings"]
-            .as_array()
-            .map(|w| {
-                w.iter()
-                    .filter(|e| e["code"] == "vendor_supersedes_redirect")
-                    .map(|e| e["detail"].as_str().unwrap_or(""))
-                    .collect()
-            })
-            .unwrap_or_default()
+    /// The hosted URLs above live on this origin: only
+    /// `https://patch.socket.dev` and the configured patch-server origin
+    /// count as hosted, so every post-scan run passes it.
+    const PATCH_ORIGIN: &str = "http://patch.test";
+
+    /// The npm registry's version document for the fixture package, as the
+    /// v5 upstream restore reads it (`SOCKET_NPM_REGISTRY`): it hands back
+    /// the pristine integrity the fixture lock started with.
+    async fn mock_registry(server: &MockServer) -> String {
+        let registry = format!("{}/registry", server.uri());
+        Mock::given(method("GET"))
+            .and(path(format!("/registry/{CONV_NAME}/{CONV_VERSION}")))
+            .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+                "name": CONV_NAME,
+                "version": CONV_VERSION,
+                "dist": {
+                    "tarball": format!(
+                        "https://registry.npmjs.org/{CONV_NAME}/-/{CONV_NAME}-{CONV_VERSION}.tgz"
+                    ),
+                    "integrity": UPSTREAM_SHA512
+                }
+            })))
+            .mount(server)
+            .await;
+        registry
     }
 
+    /// Hosted → vendored on a pnpm project, v5: the hosted run writes ONLY
+    /// the lock (no ledger); `vendor` over the hosted pin restores the
+    /// upstream registry entry first (`vendor_takeover_reverted_redirect`),
+    /// so the vendor ledger records the PRISTINE registry fragment as the
+    /// original; a re-vendor is a quiet no-op; `vendor --revert`
+    /// byte-restores the registry lock — never the hosted splice.
     #[tokio::test]
     #[serial]
-    async fn hosted_then_vendor_takeover_pre_reverts_redirect_and_round_trips() {
+    async fn hosted_then_vendor_takeover_restores_upstream_and_round_trips() {
         let server = MockServer::start().await;
         mock_hosted_api(&server).await;
+        let registry = mock_registry(&server).await;
 
         let tmp = tempfile::tempdir().unwrap();
         let root = tmp.path();
@@ -3202,7 +3347,7 @@ snapshots:
         let pristine_lock = std::fs::read(root.join("pnpm-lock.yaml")).unwrap();
 
         // 1. Hosted redirect: the lock's resolution is spliced to the hosted
-        //    tarball and the redirect ledger claims the purl.
+        //    tarball; no ledger is written.
         let code = scan_run(hosted_args(root, server.uri())).await;
         assert_eq!(code, 0, "scan --mode hosted must succeed");
         let hosted_lock_text = std::fs::read_to_string(root.join("pnpm-lock.yaml")).unwrap();
@@ -3211,19 +3356,12 @@ snapshots:
             "hosted splice missing:\n{hosted_lock_text}"
         );
         let ledger_path = root.join(".socket/vendor/redirect-state.json");
-        let ledger: Value =
-            serde_json::from_str(&std::fs::read_to_string(&ledger_path).unwrap()).unwrap();
-        assert!(
-            ledger["records"].get(CONV_PURL).is_some(),
-            "hosted run must record the purl: {ledger}"
-        );
+        assert!(!ledger_path.exists(), "hosted mode writes no ledger");
 
-        // 2. Vendor over the hosted-redirected lock (offline, staged blob).
-        //    The takeover PRE-REVERTS the hosted edits first — surfaced as
-        //    the `vendor_takeover_reverted_redirect` advisory — then vendors
-        //    from the clean registry baseline.
+        // 2. Vendor over the hosted lock (staged blob, online only for the
+        //    registry lookup of the restore).
         seed_manifest_and_blob(root);
-        let (code, env1) = vendor_cli(root, &[]);
+        let (code, env1) = vendor_online_cli(root, &registry, PATCH_ORIGIN, &[]);
         assert_eq!(
             code, 0,
             "vendor over the hosted lock must succeed: {env1:#}"
@@ -3231,16 +3369,6 @@ snapshots:
         find_event(&env1, "applied", None);
         find_event(&env1, "skipped", Some("vendor_takeover_reverted_redirect"));
 
-        // The pre-revert leaves nothing to supersede, so the
-        // vendor_supersedes_redirect warning must not fire — not on this run
-        // and not on any later one.
-        assert!(
-            takeover_warnings(&env1).is_empty(),
-            "the pre-revert must preempt vendor_supersedes_redirect: {env1:#}"
-        );
-
-        // The lock is FULLY vendored: local wiring present, no hosted
-        // residue.
         let vendored_lock_text = std::fs::read_to_string(root.join("pnpm-lock.yaml")).unwrap();
         assert!(
             !vendored_lock_text.contains(HOSTED_URL),
@@ -3250,43 +3378,11 @@ snapshots:
             vendored_lock_text.contains(".socket/vendor/"),
             "the vendored wiring must be present:\n{vendored_lock_text}"
         );
-
-        // The redirect ledger no longer carries the purl's halves: the
-        // takeover dropped its `records` entry and its
-        // `redirect_pnpm_resolution` edits (a residual non-package edit like
-        // the workspace-trust one may remain — it is the hosted flow's own
-        // config surface).
-        match std::fs::read_to_string(&ledger_path) {
-            Ok(text) => {
-                let after: Value = serde_json::from_str(&text).unwrap();
-                assert!(
-                    after["records"].get(CONV_PURL).is_none(),
-                    "the superseded record must be dropped: {after}"
-                );
-                let leftover: Vec<&Value> = after["edits"]
-                    .as_array()
-                    .map(|edits| {
-                        edits
-                            .iter()
-                            .filter(|e| e["key"].as_str().is_some_and(|k| k.contains(CONV_NAME)))
-                            .collect()
-                    })
-                    .unwrap_or_default();
-                assert!(
-                    leftover.is_empty(),
-                    "the superseded package edits must be dropped: {after}"
-                );
-            }
-            Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
-                // Fully emptied ledgers are deleted — also a valid outcome.
-            }
-            Err(e) => panic!("unreadable redirect ledger: {e}"),
-        }
+        assert!(!ledger_path.exists(), "still no hosted ledger");
 
         // The vendor ledger's wiring `original` embeds the PRISTINE registry
-        // fragment the pre-revert restored — never the grant-tokenized
-        // hosted splice (which would make `--revert` restore an expiring
-        // hosted URL with no CLI path back to registry state).
+        // fragment the restore produced — never the grant-tokenized hosted
+        // splice.
         let state: Value = serde_json::from_str(
             &std::fs::read_to_string(root.join(".socket/vendor/state.json")).unwrap(),
         )
@@ -3301,25 +3397,19 @@ snapshots:
             "vendor wiring must NOT record the hosted fragment: {state:#}"
         );
 
-        // 3. Re-vendor: an `already_vendored` no-op with NO takeover event
-        //    and NO supersede warning (pre-fix the stale ledger re-fired the
-        //    warning on every run).
-        let (code, env2) = vendor_cli(root, &[]);
+        // 3. Re-vendor: an `already_vendored` no-op with NO takeover event —
+        //    the lock no longer pins anything hosted.
+        let (code, env2) = vendor_online_cli(root, &registry, PATCH_ORIGIN, &[]);
         assert_eq!(code, 0, "re-vendor must succeed: {env2:#}");
         find_event(&env2, "skipped", Some("already_vendored"));
-        assert!(
-            takeover_warnings(&env2).is_empty(),
-            "a reconciled ledger must not re-fire the warning: {env2:#}"
-        );
         assert!(
             events(&env2)
                 .iter()
                 .all(|e| e["errorCode"] != "vendor_takeover_reverted_redirect"),
-            "a reconciled ledger must not re-fire the takeover: {env2:#}"
+            "nothing hosted is left to take over: {env2:#}"
         );
 
-        // 4. `vendor --revert` restores the REGISTRY lock byte-exactly — the
-        //    pre-redirect resolution, not the hosted splice.
+        // 4. `vendor --revert` restores the REGISTRY lock byte-exactly.
         let (code, renv) = vendor_cli(root, &["--revert"]);
         assert_eq!(code, 0, "revert must succeed: {renv:#}");
         assert_eq!(
@@ -3329,6 +3419,37 @@ snapshots:
         );
     }
 
+    /// Offline, the hosted pin's upstream entry cannot be re-resolved: the
+    /// takeover REFUSES the purl (`redirect_revert_failed`, checkout remedy)
+    /// and leaves the hosted lock exactly as found.
+    #[tokio::test]
+    #[serial]
+    async fn offline_vendor_over_hosted_pin_is_refused() {
+        let server = MockServer::start().await;
+        mock_hosted_api(&server).await;
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        write_pnpm_project(root);
+        assert_eq!(scan_run(hosted_args(root, server.uri())).await, 0);
+        let hosted_lock = std::fs::read(root.join("pnpm-lock.yaml")).unwrap();
+
+        seed_manifest_and_blob(root);
+        let (code, env) = vendor_cli(root, &["--patch-server-url", PATCH_ORIGIN]);
+        assert_eq!(code, 1, "{env:#}");
+        let failed = find_event(&env, "failed", Some("redirect_revert_failed"));
+        assert!(
+            failed
+                .to_string()
+                .contains("git checkout -- pnpm-lock.yaml"),
+            "the refusal names the checkout remedy: {failed:#}"
+        );
+        assert_eq!(
+            std::fs::read(root.join("pnpm-lock.yaml")).unwrap(),
+            hosted_lock,
+            "a refused takeover writes nothing"
+        );
+        assert!(!root.join(".socket/vendor/state.json").exists());
+    }
     /// package-lock.json twin of [`write_pnpm_project`]: a lockfileVersion 3
     /// lock resolving the package from the registry.
     fn write_package_lock_project(root: &Path) {
@@ -3365,8 +3486,8 @@ snapshots:
 
     /// Hosted → vendored takeover on a package-lock project: the hosted run
     /// auto-configures `allow-remote=all` in a NEW `.npmrc` (npm >= 12
-    /// refuses the hosted tarball otherwise); the vendor takeover reverts
-    /// the last package-lock redirect and, in the same transaction, deletes
+    /// refuses the hosted tarball otherwise); the vendor takeover restores
+    /// the last hosted pin to its upstream registry entry and, in the same transaction, deletes
     /// the `.npmrc` it created — vendored `file:` specs never need it (npm
     /// gates them by `allow-file`, default `all`).
     #[tokio::test]
@@ -3374,6 +3495,7 @@ snapshots:
     async fn hosted_then_vendor_takeover_removes_the_npmrc_allow_remote_config() {
         let server = MockServer::start().await;
         mock_hosted_api(&server).await;
+        let registry = mock_registry(&server).await;
         let tmp = tempfile::tempdir().unwrap();
         let root = tmp.path();
         write_package_lock_project(root);
@@ -3390,7 +3512,7 @@ snapshots:
         );
 
         seed_manifest_and_blob(root);
-        let (code, env) = vendor_cli(root, &[]);
+        let (code, env) = vendor_online_cli(root, &registry, PATCH_ORIGIN, &[]);
         assert_eq!(code, 0, "vendor over the hosted lock must succeed: {env:#}");
         find_event(&env, "applied", None);
         find_event(&env, "skipped", Some("vendor_takeover_reverted_redirect"));
@@ -3405,7 +3527,7 @@ snapshots:
         );
         assert!(
             !root.join(".socket/vendor/redirect-state.json").exists(),
-            "the emptied redirect ledger is deleted"
+            "no hosted ledger exists at any point"
         );
     }
 }
diff --git a/crates/socket-patch-cli/tests/in_process_vendor_bun_takeover.rs b/crates/socket-patch-cli/tests/in_process_vendor_bun_takeover.rs
index 4662a33a..9ff7df12 100644
--- a/crates/socket-patch-cli/tests/in_process_vendor_bun_takeover.rs
+++ b/crates/socket-patch-cli/tests/in_process_vendor_bun_takeover.rs
@@ -10,23 +10,29 @@
 //! from the compatibility matrix captures, and the packages tuple grammar
 //! is identical on versions 0/1/2).
 //!
+//! v5: hosted mode keeps no ledger — the hosted state is the lock's URL
+//! 3-tuple alone. Every unwind of a hosted pin (the vendor takeover,
+//! `rollback`, `remove`) restores the registry 4-tuple, re-resolving the
+//! integrity from the npm registry: here one shared wiremock mirror
+//! ([`registry_uri`], `SOCKET_NPM_REGISTRY`) serving the pristine
+//! integrities, with the `http://patch.test` origin named hosted via
+//! `SOCKET_PATCH_SERVER_URL`.
+//!
 //! Scenarios:
-//!   1. `scan --mode hosted` → `scan --mode vendored`: the takeover reverts
-//!      the hosted line, drops the redirect-ledger record, vendors from the
-//!      pristine registry line (the vendor ledger's `original` is the
-//!      REGISTRY tuple, never the hosted URL), and `vendor --revert`
+//!   1. `scan --mode hosted` → `scan --mode vendored`: the takeover restores
+//!      the registry line, vendors from it (the vendor ledger's `original`
+//!      is the REGISTRY tuple, never the hosted URL), and `vendor --revert`
 //!      restores the pristine bytes.
-//!   2. `vendor --dry-run` over the live hosted redirect previews the
-//!      takeover (`vendor_would_revert_redirect`) with no false
+//!   2. `vendor --dry-run` over the live hosted pin previews the takeover
+//!      (`vendor_would_revert_redirect`) with no false
 //!      `vendor_lock_entry_not_found` follow-up and no writes; the wet
 //!      `vendor` then completes it.
-//!   3. Two hosted records: a SCOPED `rollback <purl>` (per-purl path, the
-//!      whole-ledger replay is not eligible) unwinds only the targeted line
-//!      and record; the sibling stays hosted.
-//!   4. Same ledger, `remove <purl>`.
+//!   3. Two hosted pins: a SCOPED `rollback <purl>` restores only the
+//!      targeted line; the sibling stays hosted.
+//!   4. Same project, `remove <purl>`.
 //!   5. A hosted-wired lockfileVersion-1 WORKSPACE lock (hosted accepts it,
 //!      the vendored backend refuses it): `vendor` — dry and wet — refuses
-//!      `vendor_bun_workspace_unsupported` BEFORE the takeover reverts
+//!      `vendor_bun_workspace_unsupported` BEFORE the takeover restores
 //!      anything, so the hosted wiring survives byte-for-byte; the v2 twin
 //!      still takes over.
 //!
@@ -68,7 +74,6 @@ const CVE: &str = "CVE-2026-5555";
 /// The second hosted record of the scoped-unwind scenarios.
 const OTHER_NAME: &str = "other";
 const OTHER_PURL: &str = "pkg:npm/other@1.0.0";
-const OTHER_UUID: &str = "0a1b2c3d-4e5f-4a7b-8c9d-0e1f2a3b4c5d";
 const OTHER_HOSTED_URL: &str = "http://patch.test/patch/npm/other/1.0.0/55555555-5555-4555-8555-555555555555/0a1b2c3d-4e5f-4a7b-8c9d-0e1f2a3b4c5d/other-1.0.0.tgz";
 
 /// The registry 4-tuple lines exactly as bun 1.4.2 emits them (matrix
@@ -165,9 +170,8 @@ fn patch_record(uuid: &str) -> Value {
     })
 }
 
-/// `.socket/manifest.json` + the after-hash blob, so `vendor --offline`
-/// runs fully offline (hosted mode writes no manifest — its ledger is its
-/// store).
+/// `.socket/manifest.json` + the after-hash blob, so `vendor` needs no API
+/// (hosted mode writes no manifest).
 fn seed_manifest_and_blob(root: &Path) {
     let socket = root.join(".socket");
     std::fs::create_dir_all(socket.join("blobs")).unwrap();
@@ -282,9 +286,63 @@ fn manifestless_vex(
 
 // ───────────────────────── subprocess runner ─────────────────────────
 
+/// The `sha512-…` integrity of a registry 4-tuple line (its last string).
+fn line_integrity(line: &str) -> String {
+    line.rsplit('"')
+        .nth(1)
+        .filter(|s| s.starts_with("sha512-"))
+        .unwrap_or_else(|| panic!("no integrity in {line}"))
+        .to_string()
+}
+
+/// One npm registry mirror shared by every test in this binary: the
+/// version documents of `left-pad@1.3.0` and `other@1.0.0` carrying the
+/// integrities of the pristine registry lines, which is all the v5 upstream
+/// restore of a bun.lock entry reads. It runs on its own thread + runtime
+/// for the life of the process (the per-test runtimes come and go).
+fn registry_uri() -> &'static str {
+    static URI: std::sync::OnceLock<String> = std::sync::OnceLock::new();
+    URI.get_or_init(|| {
+        let (tx, rx) = std::sync::mpsc::channel();
+        std::thread::spawn(move || {
+            let rt = tokio::runtime::Builder::new_current_thread()
+                .enable_all()
+                .build()
+                .expect("registry mirror runtime");
+            rt.block_on(async move {
+                let server = MockServer::start().await;
+                for (name, version, line) in [
+                    (NAME, VERSION, LEFT_PAD_REGISTRY_LINE),
+                    (OTHER_NAME, "1.0.0", OTHER_REGISTRY_LINE),
+                ] {
+                    Mock::given(method("GET"))
+                        .and(path(format!("/{name}/{version}")))
+                        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+                            "name": name,
+                            "version": version,
+                            "dist": {
+                                "tarball": format!(
+                                    "https://registry.npmjs.org/{name}/-/{name}-{version}.tgz"
+                                ),
+                                "integrity": line_integrity(line)
+                            }
+                        })))
+                        .mount(&server)
+                        .await;
+                }
+                tx.send(server.uri()).expect("hand back the mirror uri");
+                std::future::pending::<()>().await;
+            });
+        });
+        rx.recv().expect("registry mirror started")
+    })
+}
+
 /// Run the built `socket-patch` binary with every ambient `SOCKET_*` var
 /// scrubbed (except the hermetic `SOCKET_NO_CONFIG`) and telemetry
-/// hard-disabled. Returns `(exit_code, stdout, stderr)`.
+/// hard-disabled; `http://patch.test` counts as the patch server
+/// (`SOCKET_PATCH_SERVER_URL`) and the registry is the shared mirror
+/// (`SOCKET_NPM_REGISTRY`). Returns `(exit_code, stdout, stderr)`.
 fn run_cli(cwd: &Path, args: &[&str]) -> (i32, String, String) {
     let mut cmd = Command::new(env!("CARGO_BIN_EXE_socket-patch"));
     cmd.args(args).current_dir(cwd);
@@ -293,7 +351,9 @@ fn run_cli(cwd: &Path, args: &[&str]) -> (i32, String, String) {
             cmd.env_remove(key);
         }
     }
-    cmd.env("SOCKET_TELEMETRY_DISABLED", "1");
+    cmd.env("SOCKET_TELEMETRY_DISABLED", "1")
+        .env("SOCKET_PATCH_SERVER_URL", "http://patch.test")
+        .env("SOCKET_NPM_REGISTRY", registry_uri());
     let out = cmd.output().expect("spawn socket-patch binary");
     (
         out.status.code().unwrap_or(-1),
@@ -336,14 +396,10 @@ fn scan_mode(cwd: &Path, api_url: &str, mode: &str, extra: &[&str]) -> (i32, Val
     run_json(cwd, &args)
 }
 
+/// `vendor --json` — online: a takeover's upstream restore reads the
+/// registry mirror.
 fn vendor_cli(cwd: &Path, extra: &[&str]) -> (i32, Value) {
-    let mut args = vec![
-        "vendor",
-        "--json",
-        "--offline",
-        "--cwd",
-        cwd.to_str().unwrap(),
-    ];
+    let mut args = vec!["vendor", "--json", "--cwd", cwd.to_str().unwrap()];
     args.extend_from_slice(extra);
     run_json(cwd, &args)
 }
@@ -376,29 +432,14 @@ fn vendored_rel_tgz() -> String {
 }
 
 /// Assertions shared by the takeover scenarios once the wet vendored run
-/// has happened: the redirect ledger no longer claims the purl, bun.lock
-/// carries the local tuple and no hosted residue, and the vendor ledger's
-/// recorded `original` is the PRISTINE registry line.
+/// has happened: no hosted ledger exists, bun.lock carries the local tuple
+/// and no hosted residue, and the vendor ledger's recorded `original` is
+/// the PRISTINE registry line (the takeover's upstream restore).
 fn assert_pure_vendored(root: &Path) {
-    match std::fs::read_to_string(root.join(".socket/vendor/redirect-state.json")) {
-        Ok(text) => {
-            let ledger: Value = serde_json::from_str(&text).unwrap();
-            assert!(
-                ledger["records"].get(PURL).is_none(),
-                "the superseded redirect record must be dropped: {ledger:#}"
-            );
-            assert!(
-                ledger["edits"]
-                    .as_array()
-                    .is_none_or(|edits| edits.iter().all(|e| e["key"] != NAME)),
-                "the superseded bun.lock edit must be dropped: {ledger:#}"
-            );
-        }
-        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
-            // An emptied ledger is deleted — the expected outcome here.
-        }
-        Err(e) => panic!("unreadable redirect ledger: {e}"),
-    }
+    assert!(
+        !root.join(".socket/vendor/redirect-state.json").exists(),
+        "no hosted ledger may exist"
+    );
 
     let lock = read(root, "bun.lock");
     assert!(
@@ -444,9 +485,7 @@ async fn bun_hosted_then_scan_vendored_takeover_round_trips_to_registry() {
     write_bun_project(root, &pristine_lock(), &[(NAME, VERSION)]);
     let pristine = std::fs::read(root.join("bun.lock")).unwrap();
 
-    // A: hosted redirect — registry 4-tuple → URL 3-tuple, ledger claims
-    //    the purl with one `redirect_bun_lock_package` edit whose original
-    //    is the registry line.
+    // A: hosted redirect — registry 4-tuple → URL 3-tuple; no ledger.
     let (code, env) = scan_mode(root, &server.uri(), "hosted", &[]);
     assert_eq!(code, 0, "scan --mode hosted must succeed: {env:#}");
     assert_eq!(env["redirect"]["redirected"], 1, "{env:#}");
@@ -456,18 +495,9 @@ async fn bun_hosted_then_scan_vendored_takeover_round_trips_to_registry() {
         hosted_line(NAME, NAME, HOSTED_URL, PATCHED_SHA512),
         "hosted URL 3-tuple written:\n{hosted_lock}"
     );
-    let ledger: Value =
-        serde_json::from_str(&read(root, ".socket/vendor/redirect-state.json")).unwrap();
     assert!(
-        ledger["records"].get(PURL).is_some(),
-        "hosted run must record the purl: {ledger:#}\nhosted envelope: {env:#}"
-    );
-    let edit = &ledger["edits"][0];
-    assert_eq!(edit["kind"], "redirect_bun_lock_package", "{ledger:#}");
-    assert_eq!(
-        edit["original"],
-        json!(LEFT_PAD_REGISTRY_LINE),
-        "{ledger:#}"
+        !root.join(".socket/vendor/redirect-state.json").exists(),
+        "hosted mode writes no ledger: {env:#}"
     );
     let scratch = tempfile::tempdir().unwrap();
     manifestless_vex(
@@ -493,8 +523,8 @@ async fn bun_hosted_then_scan_vendored_takeover_round_trips_to_registry() {
         "a dry run must not create the vendor ledger"
     );
 
-    // B: vendored scan over the LIVE hosted redirect — the takeover. Used
-    //    to exit 1 with `redirect_revert_failed` ("cannot replay yet").
+    // B: vendored scan over the LIVE hosted pin — the takeover restores the
+    //    registry line first, then vendors.
     let (code, env) = scan_mode(root, &server.uri(), "vendored", &[]);
     assert_eq!(
         code, 0,
@@ -695,15 +725,13 @@ async fn bun_digestless_vendored_line_is_taken_over_by_scan_hosted_and_rolls_bac
         !root.join(vendored_rel_tgz()).exists(),
         "the vendored artifact must be removed by the takeover"
     );
-    let ledger: Value =
-        serde_json::from_str(&read(root, ".socket/vendor/redirect-state.json")).unwrap();
-    assert_eq!(
-        ledger["edits"][0]["original"],
-        json!(LEFT_PAD_REGISTRY_LINE),
-        "the hosted ledger records the PRISTINE registry line as its original: {ledger:#}"
+    assert!(
+        !root.join(".socket/vendor/redirect-state.json").exists(),
+        "hosted mode writes no ledger"
     );
 
-    // Unscoped rollback of the hosted wiring lands on the pristine lock.
+    // Unscoped rollback of the hosted pin restores its upstream entry: the
+    // pristine lock.
     let (code, env) = run_json(
         root,
         &[
@@ -774,14 +802,15 @@ async fn bun_vendor_dry_run_previews_the_takeover_then_wet_vendor_completes_it()
     assert_eq!(code, 0, "{env:#}");
     let hosted_lock = std::fs::read(root.join("bun.lock")).unwrap();
     let ledger_path = root.join(".socket/vendor/redirect-state.json");
-    let hosted_ledger = std::fs::read(&ledger_path).unwrap();
+    assert!(!ledger_path.exists(), "hosted mode writes no ledger");
 
-    // The manifest record `vendor` acts on (offline: the staged blob).
+    // The manifest record `vendor` acts on (the staged blob).
     seed_manifest_and_blob(root);
 
-    // Dry run: the takeover is PROBED (write-free) and previewed; the
-    // backend preview does not run against the still-hosted lock, so no
-    // false `vendor_lock_entry_not_found` and no refusal. Nothing written.
+    // Dry run: the takeover's upstream restore is resolved write-free and
+    // previewed; the backend preview does not run against the still-hosted
+    // lock, so no false `vendor_lock_entry_not_found` and no refusal.
+    // Nothing written.
     let (code, env) = vendor_cli(root, &["--dry-run"]);
     assert_eq!(code, 0, "vendor --dry-run must succeed: {env:#}");
     let advisory = find_event(&env, "skipped", Some("vendor_would_revert_redirect"));
@@ -797,11 +826,7 @@ async fn bun_vendor_dry_run_previews_the_takeover_then_wet_vendor_completes_it()
         hosted_lock,
         "a dry run must not touch bun.lock"
     );
-    assert_eq!(
-        std::fs::read(&ledger_path).unwrap(),
-        hosted_ledger,
-        "a dry run must not touch the redirect ledger"
-    );
+    assert!(!ledger_path.exists(), "a dry run writes no hosted ledger");
     assert!(
         !root.join(".socket/vendor/state.json").exists(),
         "a dry run must not create the vendor ledger"
@@ -820,10 +845,9 @@ async fn bun_vendor_dry_run_previews_the_takeover_then_wet_vendor_completes_it()
 // 3./4. scoped rollback / remove of ONE of two hosted bun records
 // ─────────────────────────────────────────────────────────────────────
 
-/// A hosted-live bun project with TWO redirect records, written exactly as
-/// the hosted flow leaves them (ledger edits = verbatim lines, lock = the
-/// URL 3-tuples). Two records make a scoped unwind of one purl ineligible
-/// for the whole-ledger replay, so it takes the per-purl revert.
+/// A hosted-live bun project with TWO hosted pins, written exactly as the
+/// v5 hosted flow leaves it: the lock's URL 3-tuples and nothing else (no
+/// ledger).
 fn write_two_record_hosted_project(root: &Path) -> String {
     let pristine = pristine_lock_two();
     write_bun_project(root, &pristine, &[(NAME, VERSION), (OTHER_NAME, "1.0.0")]);
@@ -839,43 +863,11 @@ fn write_two_record_hosted_project(root: &Path) -> String {
         .replace(OTHER_REGISTRY_LINE, &other_hosted);
     assert_ne!(hosted, pristine);
     std::fs::write(root.join("bun.lock"), &hosted).unwrap();
-    let ledger = json!({
-        "version": 1,
-        "mode": "hosted",
-        "edits": [
-            {
-                "path": "bun.lock",
-                "kind": "redirect_bun_lock_package",
-                "action": "rewritten",
-                "key": NAME,
-                "original": LEFT_PAD_REGISTRY_LINE,
-                "new": left_pad_hosted,
-            },
-            {
-                "path": "bun.lock",
-                "kind": "redirect_bun_lock_package",
-                "action": "rewritten",
-                "key": OTHER_NAME,
-                "original": OTHER_REGISTRY_LINE,
-                "new": other_hosted,
-            }
-        ],
-        "records": {
-            PURL: patch_record(UUID),
-            OTHER_PURL: patch_record(OTHER_UUID),
-        }
-    });
-    std::fs::create_dir_all(root.join(".socket/vendor")).unwrap();
-    std::fs::write(
-        root.join(".socket/vendor/redirect-state.json"),
-        serde_json::to_vec_pretty(&ledger).unwrap(),
-    )
-    .unwrap();
     pristine
 }
 
 /// After unwinding ONLY `left-pad`: its line is the registry tuple, `other`
-/// is still hosted, and the ledger keeps exactly `other`'s record + edit.
+/// is still hosted, and no ledger exists.
 fn assert_only_left_pad_unwound(root: &Path, pristine: &str) {
     let lock = read(root, "bun.lock");
     assert_eq!(
@@ -887,15 +879,10 @@ fn assert_only_left_pad_unwound(root: &Path, pristine: &str) {
         lock_line(&lock, OTHER_NAME).contains(OTHER_HOSTED_URL),
         "other must stay hosted:\n{lock}"
     );
-    let ledger: Value =
-        serde_json::from_str(&read(root, ".socket/vendor/redirect-state.json")).unwrap();
     assert!(
-        ledger["records"].get(PURL).is_none() && ledger["records"].get(OTHER_PURL).is_some(),
-        "{ledger:#}"
+        !root.join(".socket/vendor/redirect-state.json").exists(),
+        "no hosted ledger may exist"
     );
-    let edits = ledger["edits"].as_array().unwrap();
-    assert_eq!(edits.len(), 1, "{ledger:#}");
-    assert_eq!(edits[0]["key"], OTHER_NAME, "{ledger:#}");
 }
 
 #[test]
@@ -904,8 +891,8 @@ fn bun_scoped_rollback_of_one_of_two_hosted_records_unwinds_only_that_purl() {
     let root = tmp.path();
     let pristine = write_two_record_hosted_project(root);
 
-    // Scoped rollback: per-purl path (two records ⇒ the replay is not
-    // eligible). Used to exit 1 with hosted.failed = ["cannot replay yet"].
+    // Scoped rollback: only left-pad's pin is restored to its upstream
+    // registry line; `other` stays hosted.
     let (code, env) = run_json(
         root,
         &[
@@ -923,8 +910,7 @@ fn bun_scoped_rollback_of_one_of_two_hosted_records_unwinds_only_that_purl() {
     assert_eq!(env["hosted"]["failed"], json!([]), "{env:#}");
     assert_only_left_pad_unwound(root, &pristine);
 
-    // The last record out: covers every record ⇒ whole-ledger replay;
-    // pristine lock, ledger deleted.
+    // The last pin out: pristine lock, no ledger anywhere.
     let (code, env) = run_json(
         root,
         &[
@@ -940,7 +926,7 @@ fn bun_scoped_rollback_of_one_of_two_hosted_records_unwinds_only_that_purl() {
     assert_eq!(read(root, "bun.lock"), pristine, "pristine lock restored");
     assert!(
         !root.join(".socket/vendor/redirect-state.json").exists(),
-        "emptied ledger deleted"
+        "no hosted ledger"
     );
 }
 
@@ -977,8 +963,8 @@ fn bun_scoped_remove_of_one_of_two_hosted_records_unwinds_only_that_purl() {
 // no path to resolve); the vendored backend refuses every pre-v2 workspace
 // lock (`vendor_bun_workspace_unsupported`). The Bun preflight runs inside
 // the engine loop before the takeover block, so a refused `vendor` (and its
-// dry run) never reverts the hosted line or drops the redirect-ledger
-// record first — which would leave the project unpatched in BOTH modes.
+// dry run) never restores the hosted line to upstream first — which would
+// leave the project unpatched in BOTH modes.
 
 const WS_CODE: &str = "vendor_bun_workspace_unsupported";
 
@@ -1047,7 +1033,6 @@ fn bun_vendor_silent_refusal_keeps_error_diagnosis() {
     let tmp = tempfile::tempdir().unwrap();
     let root = tmp.path();
     let lock = write_hosted_workspace_project(root, 1);
-    let ledger = std::fs::read(root.join(".socket/vendor/redirect-state.json")).unwrap();
     for dry_run in [true, false] {
         let mut args = vec![
             "vendor",
@@ -1066,7 +1051,7 @@ fn bun_vendor_silent_refusal_keeps_error_diagnosis() {
             stderr.contains("Cannot vendor") && stderr.contains("lockfileVersion-1"),
             "{stderr}"
         );
-        assert_hosted_wiring_intact(root, &lock, &ledger);
+        assert_hosted_wiring_intact(root, &lock);
     }
 }
 
@@ -1080,8 +1065,9 @@ fn pristine_workspace_lock(version: u64) -> String {
     )
 }
 
-/// A hosted-live WORKSPACE bun project with ONE redirect record, written
-/// exactly as `scan --mode hosted` leaves it, plus the manifest record and
+/// A hosted-live WORKSPACE bun project with ONE hosted pin, written
+/// exactly as `scan --mode hosted` leaves it (no ledger), plus the manifest
+/// record and
 /// blob a default-mode `get`/`scan` adds — the shape the plain `vendor`
 /// command acts on (a hosted-only project is a `noManifest` no-op).
 /// Returns the hosted lock text.
@@ -1104,49 +1090,22 @@ fn write_hosted_workspace_project(root: &Path, version: u64) -> String {
     let hosted = pristine.replace(LEFT_PAD_REGISTRY_LINE, &left_pad_hosted);
     assert_ne!(hosted, pristine, "the hosted splice must hit");
     std::fs::write(root.join("bun.lock"), &hosted).unwrap();
-    let ledger = json!({
-        "version": 1,
-        "mode": "hosted",
-        "edits": [{
-            "path": "bun.lock",
-            "kind": "redirect_bun_lock_package",
-            "action": "rewritten",
-            "key": NAME,
-            "original": LEFT_PAD_REGISTRY_LINE,
-            "new": left_pad_hosted,
-        }],
-        "records": { PURL: patch_record(UUID) },
-    });
-    std::fs::create_dir_all(root.join(".socket/vendor")).unwrap();
-    std::fs::write(
-        root.join(".socket/vendor/redirect-state.json"),
-        serde_json::to_vec_pretty(&ledger).unwrap(),
-    )
-    .unwrap();
     seed_manifest_and_blob(root);
     hosted
 }
 
-/// Every byte of the hosted wiring must survive a refused run: the lock,
-/// the redirect ledger (record + edit), and no vendor ledger or artifact.
-fn assert_hosted_wiring_intact(root: &Path, hosted_lock: &str, hosted_ledger: &[u8]) {
+/// Every byte of the hosted wiring must survive a refused run: the lock
+/// (the only hosted state), and no vendor ledger or artifact.
+fn assert_hosted_wiring_intact(root: &Path, hosted_lock: &str) {
     assert_eq!(
         read(root, "bun.lock"),
         hosted_lock,
         "bun.lock must stay byte-identical to the hosted lock"
     );
-    let ledger_path = root.join(".socket/vendor/redirect-state.json");
-    assert_eq!(
-        std::fs::read(&ledger_path).unwrap(),
-        hosted_ledger,
-        "the redirect ledger must stay byte-identical"
+    assert!(
+        !root.join(".socket/vendor/redirect-state.json").exists(),
+        "no hosted ledger may appear"
     );
-    let ledger: Value =
-        serde_json::from_str(&read(root, ".socket/vendor/redirect-state.json")).unwrap();
-    assert!(ledger["records"].get(PURL).is_some(), "{ledger:#}");
-    let edits = ledger["edits"].as_array().unwrap();
-    assert_eq!(edits.len(), 1, "{ledger:#}");
-    assert_eq!(edits[0]["key"], NAME, "{ledger:#}");
     assert!(
         !root.join(".socket/vendor/state.json").exists(),
         "a refused run must not create the vendor ledger"
@@ -1162,7 +1121,6 @@ fn bun_vendor_over_hosted_v1_workspace_lock_refuses_before_unhosting() {
     let tmp = tempfile::tempdir().unwrap();
     let root = tmp.path();
     let hosted_lock = write_hosted_workspace_project(root, 1);
-    let hosted_ledger = std::fs::read(root.join(".socket/vendor/redirect-state.json")).unwrap();
 
     // Dry run: previews the REFUSAL, not the takeover, with the wet run's
     // exit code — and writes nothing.
@@ -1179,12 +1137,12 @@ fn bun_vendor_over_hosted_v1_workspace_lock_refuses_before_unhosting() {
     assert_no_event_code(&env, "vendor_would_revert_redirect");
     assert_no_event_code(&env, "vendor_takeover_reverted_redirect");
     assert_no_event_code(&env, "redirect_revert_failed");
-    assert_hosted_wiring_intact(root, &hosted_lock, &hosted_ledger);
+    assert_hosted_wiring_intact(root, &hosted_lock);
 
-    // Wet run: the same refusal, BEFORE any revert — hosted wiring intact.
+    // Wet run: the same refusal, BEFORE any restore — hosted wiring intact.
     // Used to: `skipped vendor_takeover_reverted_redirect` then `failed
     // vendor_bun_workspace_unsupported`, registry tuple back in the lock,
-    // redirect-state.json deleted, `.socket/vendor/` empty.
+    // `.socket/vendor/` empty.
     let (code, env) = vendor_cli(root, &[]);
     assert_eq!(code, 1, "the wet run refuses: {env:#}");
     assert_eq!(env["status"], "partialFailure", "{env:#}");
@@ -1201,7 +1159,7 @@ fn bun_vendor_over_hosted_v1_workspace_lock_refuses_before_unhosting() {
     assert_no_event_code(&env, "vendor_takeover_reverted_redirect");
     assert_no_event_code(&env, "vendor_would_revert_redirect");
     assert_no_event_code(&env, "redirect_revert_failed");
-    assert_hosted_wiring_intact(root, &hosted_lock, &hosted_ledger);
+    assert_hosted_wiring_intact(root, &hosted_lock);
 
     // The manifest record survives too (the recovery path — a networked
     // `scan --mode hosted` — needs nothing this run could have dropped).
diff --git a/crates/socket-patch-cli/tests/in_process_vendor_bun_takeover/vlt.rs b/crates/socket-patch-cli/tests/in_process_vendor_bun_takeover/vlt.rs
index d1715cf9..347c36e2 100644
--- a/crates/socket-patch-cli/tests/in_process_vendor_bun_takeover/vlt.rs
+++ b/crates/socket-patch-cli/tests/in_process_vendor_bun_takeover/vlt.rs
@@ -1,13 +1,15 @@
 //! vlt mode takeovers (DESIGN §4.10) through the built binary:
 //!
 //! 1. hosted → vendored by `scan --mode vendored` and by `vendor`: the
-//!    takeover restores the pristine registry node from the redirect
-//!    ledger, the vendor ledger records REGISTRY originals (never the
+//!    takeover restores the pristine registry node (v5: re-resolved from
+//!    the registry — a wiremock mirror here — with no ledger), the vendor
+//!    ledger records REGISTRY originals (never the
 //!    hosted URL), the store copy vlt installed from the hosted pin is
 //!    invalidated, and `vendor --revert` lands on the registry lock;
 //! 2. vendored → hosted by `scan --mode hosted` and `get <uuid> --mode
 //!    hosted`: the vlt revert restores node, edges and package.json before
-//!    the hosted rewrite, and `rollback` lands on the registry lock;
+//!    the hosted rewrite, and `rollback` (the upstream restore) lands on
+//!    the registry lock;
 //! 3. refusals fire BEFORE the other mode is reverted: the complete vlt
 //!    vendored preflight in front of a hosted revert, and the hosted
 //!    artifact preflight in front of a vendored revert.
@@ -22,9 +24,15 @@ use wiremock::{Mock, MockServer, ResponseTemplate};
 use crate::vlt_hosted_common as hosted;
 use hosted::{ORG, PATCHED, PRISTINE, PURL, TILDE_ID, UUID};
 
+/// The registry lock as vlt rc.33+ writes it: `options.registries` recorded
+/// and the registry node carrying its tarball URL in slot [3]. The v5
+/// upstream restore re-derives slot [3] from the lock's own convention
+/// (see core `patch::redirect::upstream::vlt`), which the recorded
+/// `registries` pins — so the unwinds below land on these exact bytes.
 fn registry_lock() -> String {
     format!(
-        "{{\n  \"lockfileVersion\": 1,\n  \"options\": {{}},\n  \"nodes\": {{\n    {}\n  }},\n  \
+        "{{\n  \"lockfileVersion\": 1,\n  \"options\": {{\n    \"registries\": {{\n      \
+         \"npm\": \"https://registry.npmjs.org/\"\n    }}\n  }},\n  \"nodes\": {{\n    {}\n  }},\n  \
          \"edges\": {{\n    \"file~_d left-pad\": \"prod 1.3.0 {TILDE_ID}\"\n  }}\n}}\n",
         hosted::registry_node(TILDE_ID)
     )
@@ -72,6 +80,42 @@ async fn mock_api(server: &MockServer) {
     hosted::mock_discovery(server).await;
     hosted::mock_reference(server).await;
     hosted::mock_artifact(server).await;
+    mock_registry(server).await;
+}
+
+/// The npm registry's version document the v5 upstream restore reads for
+/// the hosted node (`SOCKET_NPM_REGISTRY` = `<server>/registry`): the
+/// pristine node's integrity and tarball.
+async fn mock_registry(server: &MockServer) {
+    Mock::given(method("GET"))
+        .and(path(format!(
+            "/registry/{}/{}",
+            hosted::NAME,
+            hosted::VERSION
+        )))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+            "name": hosted::NAME,
+            "version": hosted::VERSION,
+            "dist": { "tarball": hosted::REGISTRY_URL, "integrity": hosted::UPSTREAM_SHA512 }
+        })))
+        .mount(server)
+        .await;
+}
+
+/// The env naming `server` the patch server (its artifact URLs are hosted
+/// pins — v5 keeps no ledger to vouch for them) and its `/registry` the npm
+/// registry the upstream restore reads.
+fn online_env(server: &MockServer) -> [(&'static str, String); 2] {
+    [
+        ("SOCKET_PATCH_SERVER_URL", server.uri()),
+        ("SOCKET_NPM_REGISTRY", format!("{}/registry", server.uri())),
+    ]
+}
+
+fn run_online(root: &Path, argv: &[&str], server: &MockServer) -> (i32, Value, String) {
+    let env = online_env(server);
+    let env: Vec<(&str, &str)> = env.iter().map(|(k, v)| (*k, v.as_str())).collect();
+    hosted::run_json(root, argv, &env)
 }
 
 fn args<'a>(root: &'a str, uri: &'a str, head: &[&'a str]) -> Vec<&'a str> {
@@ -95,9 +139,10 @@ fn scan(root: &Path, server: &MockServer, mode: &str, extra: &[&str]) -> (i32, V
     let uri = server.uri();
     let mut argv = args(&cwd, &uri, &["scan", "--mode", mode]);
     argv.extend_from_slice(extra);
-    hosted::run_json(root, &argv, &[])
+    run_online(root, &argv, server)
 }
 
+/// `vendor --offline`: nothing hosted to restore.
 fn vendor(root: &Path, extra: &[&str]) -> (i32, Value, String) {
     let cwd = root.to_str().unwrap().to_string();
     let mut argv = vec!["vendor", "--offline", "--cwd", &cwd];
@@ -105,6 +150,15 @@ fn vendor(root: &Path, extra: &[&str]) -> (i32, Value, String) {
     hosted::run_json(root, &argv, &[])
 }
 
+/// `vendor` over a hosted pin on `server`: online, the takeover's upstream
+/// restore reads the registry mirror.
+fn vendor_online(root: &Path, server: &MockServer, extra: &[&str]) -> (i32, Value, String) {
+    let cwd = root.to_str().unwrap().to_string();
+    let mut argv = vec!["vendor", "--cwd", &cwd];
+    argv.extend_from_slice(extra);
+    run_online(root, &argv, server)
+}
+
 fn all_codes(env: &Value) -> Vec<String> {
     let mut out = Vec::new();
     fn walk(v: &Value, out: &mut Vec<String>) {
@@ -154,10 +208,12 @@ fn rel() -> String {
     format!(".socket/vendor/npm/{UUID}/left-pad-1.3.0/node_modules/left-pad")
 }
 
-fn redirect_ledger(root: &Path) -> Option<Value> {
-    std::fs::read(hosted::ledger_path(root))
-        .ok()
-        .map(|b| serde_json::from_slice(&b).unwrap())
+/// v5 hosted mode keeps no ledger: none may ever appear.
+fn assert_no_redirect_ledger(root: &Path) {
+    assert!(
+        !hosted::ledger_path(root).exists(),
+        "no hosted ledger may exist"
+    );
 }
 
 fn vendor_entry(root: &Path) -> Option<Value> {
@@ -202,13 +258,7 @@ fn assert_vendored_from_registry(root: &Path) {
         hosted::registry_node(TILDE_ID),
         "the vendor ledger records the REGISTRY node: {node:#}"
     );
-    let ledger = redirect_ledger(root);
-    assert!(
-        ledger.as_ref().is_none_or(|l| l["records"]
-            .as_object()
-            .is_none_or(|r| !r.contains_key(PURL))),
-        "the redirect record is dropped: {ledger:#?}"
-    );
+    assert_no_redirect_ledger(root);
     assert!(
         !hosted::store_dir(root, TILDE_ID).exists(),
         "the hosted store copy is invalidated"
@@ -257,9 +307,9 @@ async fn vlt_vendor_dry_run_previews_the_takeover_then_wet_vendor_completes_it()
     mock_api(&server).await;
     let hosted_lock = hosted_project(root, &server).await;
     seed_manifest(root);
-    let ledger = std::fs::read(hosted::ledger_path(root)).unwrap();
+    assert_no_redirect_ledger(root);
 
-    let (code, env, stderr) = vendor(root, &["--dry-run"]);
+    let (code, env, stderr) = vendor_online(root, &server, &["--dry-run"]);
     assert_eq!(code, 0, "{env:#}\n{stderr}");
     let codes = all_codes(&env);
     assert!(
@@ -271,13 +321,13 @@ async fn vlt_vendor_dry_run_previews_the_takeover_then_wet_vendor_completes_it()
         "the hosted node is registry-shaped: {env:#}"
     );
     assert_eq!(hosted::read(root, "vlt-lock.json"), hosted_lock);
-    assert_eq!(std::fs::read(hosted::ledger_path(root)).unwrap(), ledger);
+    assert_no_redirect_ledger(root);
     assert!(
         hosted::store_dir(root, TILDE_ID).exists(),
         "a dry run heals nothing"
     );
 
-    let (code, env, stderr) = vendor(root, &[]);
+    let (code, env, stderr) = vendor_online(root, &server, &[]);
     assert_eq!(code, 0, "{env:#}\n{stderr}");
     assert!(
         all_codes(&env).contains(&"vendor_takeover_reverted_redirect".to_string()),
@@ -306,7 +356,7 @@ async fn vendored_then_hosted(driver: &str) {
         let cwd = root.to_str().unwrap().to_string();
         let uri = server.uri();
         let argv = args(&cwd, &uri, &["get", UUID, "--mode", "hosted"]);
-        hosted::run_json(root, &argv, &[])
+        run_online(root, &argv, &server)
     };
     assert_eq!(code, 0, "[{driver}] {env:#}\n{stderr}");
     let lock = hosted::read(root, "vlt-lock.json");
@@ -331,8 +381,11 @@ async fn vendored_then_hosted(driver: &str) {
         !root.join(format!(".socket/vendor/npm/{UUID}")).exists(),
         "[{driver}] the vendored artifact is removed"
     );
+    assert_no_redirect_ledger(root);
+    // The upstream restore: online against the registry mirror, with the
+    // mock origin named hosted so the pin is found.
     let cwd = root.to_str().unwrap().to_string();
-    let (code, env, stderr) = hosted::run_json(root, &["rollback", "--cwd", &cwd], &[]);
+    let (code, env, stderr) = run_online(root, &["rollback", "--cwd", &cwd], &server);
     assert_eq!(code, 0, "[{driver}] rollback: {env:#}\n{stderr}");
     assert_eq!(
         hosted::read(root, "vlt-lock.json"),
@@ -363,21 +416,16 @@ async fn vlt_vendored_preflight_refuses_before_the_hosted_revert() {
     // so no driver may strip the live hosted pin on its behalf.
     let pkg = "{\n  \"dependencies\": {\n    \"left-pad\": \"1.3.0\"\n  },\n  \"devDependencies\": {\n    \"left-pad\": \"1.3.0\"\n  }\n}\n";
     std::fs::write(root.join("package.json"), pkg).unwrap();
-    let ledger = std::fs::read(hosted::ledger_path(root)).unwrap();
     let assert_intact = |what: &str| {
         assert_eq!(hosted::read(root, "vlt-lock.json"), hosted_lock, "[{what}]");
         assert_eq!(hosted::read(root, "package.json"), pkg, "[{what}]");
-        assert_eq!(
-            std::fs::read(hosted::ledger_path(root)).unwrap(),
-            ledger,
-            "[{what}]"
-        );
+        assert_no_redirect_ledger(root);
         assert!(vendor_entry(root).is_none(), "[{what}]");
         assert!(hosted::store_dir(root, TILDE_ID).exists(), "[{what}]");
     };
     for (what, dry) in [("vendor --dry-run", true), ("vendor", false)] {
         let extra: &[&str] = if dry { &["--dry-run"] } else { &[] };
-        let (code, env, stderr) = vendor(root, extra);
+        let (code, env, stderr) = vendor_online(root, &server, extra);
         assert_eq!(code, 1, "[{what}] {env:#}\n{stderr}");
         assert!(
             detail_of(&env, "vendor_lock_entry_unsupported").contains("multiple dependency fields"),
@@ -443,10 +491,10 @@ async fn vlt_hosted_artifact_preflight_refuses_before_the_vendored_revert() {
     assert!(root.join(rel()).join("index.js").is_file());
 }
 
-/// A vendor that fails after the takeover revert was persisted (here a
-/// patch-service artifact failing its integrity check) still heals the
-/// hosted store copy against the restored registry pin: the redirect
-/// record is gone, so no later run could find it again.
+/// A vendor that fails after the takeover's upstream restore was persisted
+/// (here a patch-service artifact failing its integrity check) still heals
+/// the hosted store copy against the restored registry pin: the lock no
+/// longer pins anything hosted, so no later run could find it again.
 #[tokio::test(flavor = "multi_thread")]
 async fn vlt_failed_vendor_after_the_takeover_revert_still_heals_the_store() {
     let tmp = tempfile::tempdir().unwrap();
@@ -479,7 +527,7 @@ async fn vlt_failed_vendor_after_the_takeover_revert_still_heals_the_store() {
         "--api-token",
         "fake",
     ];
-    let (code, env, stderr) = hosted::run_json(root, &argv, &[]);
+    let (code, env, stderr) = run_online(root, &argv, &server);
     assert_eq!(code, 1, "{env:#}\n{stderr}");
     let codes = all_codes(&env);
     assert!(
@@ -498,12 +546,7 @@ async fn vlt_failed_vendor_after_the_takeover_revert_still_heals_the_store() {
     assert_eq!(hosted::read(root, "vlt-lock.json"), registry_lock());
     assert_eq!(hosted::read(root, "package.json"), PACKAGE_JSON);
     assert!(vendor_entry(root).is_none());
-    assert!(
-        redirect_ledger(root).is_none_or(|l| l["records"]
-            .as_object()
-            .is_none_or(|r| !r.contains_key(PURL))),
-        "the redirect record is dropped"
-    );
+    assert_no_redirect_ledger(root);
     assert!(
         !hosted::store_dir(root, TILDE_ID).exists(),
         "the hosted store copy is invalidated"
diff --git a/crates/socket-patch-cli/tests/mode_migration_bun.rs b/crates/socket-patch-cli/tests/mode_migration_bun.rs
index 49452d22..46dced8c 100644
--- a/crates/socket-patch-cli/tests/mode_migration_bun.rs
+++ b/crates/socket-patch-cli/tests/mode_migration_bun.rs
@@ -20,6 +20,13 @@
 //! that matters — a fresh checkout's `bun install --frozen-lockfile` from
 //! an EMPTY cache materializes the bytes the lock claims.
 //!
+//! v5: hosted mode keeps no ledger. Every unwind of a hosted pin (the
+//! vendor takeover, `rollback`, `remove`) restores the entry's upstream
+//! registry 4-tuple, re-resolving the integrity from the npm registry —
+//! here a wiremock mirror of the pristine lock's integrities
+//! (`SOCKET_NPM_REGISTRY`), with the mock patch server named hosted via
+//! `SOCKET_PATCH_SERVER_URL` (see [`ONLINE_ENV`]).
+//!
 //! Fixture: `package.json` with two real registry deps, `left-pad@1.3.0`
 //! (the patched target) and `is-number@7.0.0` (dependency-free; the
 //! untouched bystander in the single-patch legs, the second hosted record
@@ -39,17 +46,17 @@
 //! stage the patched content).
 //!
 //! Scenarios:
-//!   1. vendored → hosted (`vendor --offline`, then `scan --mode hosted`):
+//!   1. vendored → hosted (`vendor`, then `scan --mode hosted`):
 //!      `redirect_takeover_reverted_vendored`, vendored ledger entry +
 //!      committed artifact gone, bun.lock = the hosted URL 3-tuple with no
-//!      `.socket/vendor/` residue, the redirect ledger's `original` is the
-//!      PRISTINE registry line (originals chain intact across migrations),
-//!      fresh frozen install → marker bytes; `rollback` → pristine bytes,
-//!      no vendor artifacts or ledgers, fresh install → original bytes.
+//!      `.socket/vendor/` residue and no hosted ledger, fresh frozen
+//!      install → marker bytes; `rollback` → pristine bytes (the upstream
+//!      restore), no vendor artifacts or ledgers, fresh install → original
+//!      bytes.
 //!   2. hosted → vendored, BOTH drivers on copies of one hosted project:
-//!      `vendor --offline` (staged manifest) and `scan --mode vendored`:
-//!      `vendor_takeover_reverted_redirect`, redirect ledger record + edit
-//!      dropped (file removed when emptied), bun.lock carries the local
+//!      `vendor` (staged manifest) and `scan --mode vendored`:
+//!      `vendor_takeover_reverted_redirect` (upstream restored first, no
+//!      ledger anywhere), bun.lock carries the local
 //!      `.socket/vendor/npm/<uuid>/` 3-tuple and not the hosted URL, the
 //!      vendor ledger's `original` is the pristine registry line, fresh
 //!      frozen install → marker bytes; `vendor --revert` → pristine bytes.
@@ -59,11 +66,10 @@
 //!      vendored --dry-run` classifies `would_vendor` (never `would_refuse`);
 //!      over a live vendored state `scan --mode hosted --dry-run` previews
 //!      `redirect_would_revert_vendored`; none of the previews writes a
-//!      byte (bun.lock, both ledgers, every file under `.socket/`), and the
+//!      byte (bun.lock, every file under `.socket/`), and the
 //!      wet runs then land exactly the takeovers previewed.
 //!   4. two hosted records in ONE scan; scoped `rollback <purl-a>` and, on
-//!      a fresh copy, `remove <purl-a>` (per-purl path — the whole-ledger
-//!      replay is not eligible) unwind ONLY a's line/record/edit; a fresh
+//!      a fresh copy, `remove <purl-a>` restore ONLY a's upstream line; a fresh
 //!      frozen install lands a's ORIGINAL bytes and b's MARKER bytes; the
 //!      unscoped `rollback` that follows restores the pristine lock.
 //!   5. unscoped `rollback` from each mixed state — after (1) and after
@@ -342,12 +348,23 @@ fn bun(cwd: &Path, args: &[&str], bun_home: &Path) -> Output {
     cmd.output().expect("failed to run bun")
 }
 
+/// The env every binary run of the current (serialized) test carries once
+/// [`mount_hosted_api`] has set it up: `SOCKET_PATCH_SERVER_URL` (the mock
+/// patch server's origin, so its hosted URLs count as hosted pins — v5
+/// keeps no ledger to vouch for them) and `SOCKET_NPM_REGISTRY` (the
+/// registry mirror the upstream restore reads). Every test is
+/// `#[serial]`, so one slot is enough.
+static ONLINE_ENV: std::sync::Mutex<Vec<(String, String)>> = std::sync::Mutex::new(Vec::new());
+
 /// The real binary with `--no-telemetry` appended: nothing in this suite
 /// should ever post a telemetry event, mocked API or not.
 fn run_socket(cwd: &Path, args: &[&str]) -> (i32, String, String) {
     let mut cmd = Command::new(binary());
     cmd.args(args).arg("--no-telemetry").current_dir(cwd);
     scrub_env(&mut cmd);
+    for (k, v) in ONLINE_ENV.lock().unwrap_or_else(|e| e.into_inner()).iter() {
+        cmd.env(k, v);
+    }
     let out = cmd.output().expect("failed to run socket-patch binary");
     (
         out.status.code().unwrap_or(-1),
@@ -408,15 +425,12 @@ fn vendored_scan(proj: &Path, api: &str, extra: &[&str]) -> (i32, String, String
     run_socket(proj, &args)
 }
 
-/// `vendor --json --offline` (+ extra) over the staged manifest.
+/// `vendor --json` (+ extra) over the staged manifest. Online: vendoring
+/// over a hosted pin restores its upstream registry entry first, which reads
+/// the registry (the [`ONLINE_ENV`] mirror); the staged manifest + blob keep
+/// everything else local.
 fn vendor_cmd(proj: &Path, extra: &[&str]) -> (i32, String, String) {
-    let mut args = vec![
-        "vendor",
-        "--json",
-        "--offline",
-        "--cwd",
-        proj.to_str().unwrap(),
-    ];
+    let mut args = vec!["vendor", "--json", "--cwd", proj.to_str().unwrap()];
     args.extend_from_slice(extra);
     run_socket(proj, &args)
 }
@@ -588,17 +602,6 @@ fn packages_line(lock: &str, name: &str) -> String {
         .to_string()
 }
 
-/// The redirect ledger's `redirect_bun_lock_package` edit keyed by the
-/// lock's package-map key (`name`), if any.
-fn ledger_edit_for(ledger: &Value, name: &str) -> Option<Value> {
-    ledger["edits"].as_array().and_then(|edits| {
-        edits
-            .iter()
-            .find(|e| e["kind"] == "redirect_bun_lock_package" && e["key"] == name)
-            .cloned()
-    })
-}
-
 fn warning_codes(v: &Value) -> Vec<String> {
     v.as_array()
         .map(|w| {
@@ -671,6 +674,8 @@ impl Fixture {
 /// package.json + real install + era assertions. `None` = skip (already
 /// reported), or a hard failure under the REQUIRED gate.
 fn stage_fixture(tag: &str) -> Option<Fixture> {
+    // A previous test's mock servers are gone: start with no online env.
+    ONLINE_ENV.lock().unwrap_or_else(|e| e.into_inner()).clear();
     let (bun_raw, bun_version) = bun_toolchain(tag)?;
     let tmp = tempfile::tempdir().unwrap();
     let proj = tmp.path().join("proj");
@@ -995,6 +1000,41 @@ async fn mount_hosted_api(
         )
         .mount(server)
         .await;
+    // The npm registry mirror the v5 upstream restore reads for a hosted
+    // bun.lock entry: each dep's version document carrying the integrity the
+    // PRISTINE lock recorded (bun's registry 4-tuple is `name@version`, `""`,
+    // deps, integrity — the integrity is the only registry-derived field).
+    for dep in [&DEP_A, &DEP_B] {
+        let line = fx.pristine_line(dep);
+        let integrity = line
+            .rsplit('"')
+            .nth(1)
+            .filter(|s| s.starts_with("sha512-"))
+            .unwrap_or_else(|| panic!("no integrity in the pristine line {line}"))
+            .to_string();
+        Mock::given(method("GET"))
+            .and(path(format!("/registry/{}/{}", dep.name, dep.version)))
+            .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+                "name": dep.name,
+                "version": dep.version,
+                "dist": {
+                    "tarball": format!(
+                        "https://registry.npmjs.org/{0}/-/{0}-{1}.tgz",
+                        dep.name, dep.version
+                    ),
+                    "integrity": integrity
+                }
+            })))
+            .mount(server)
+            .await;
+    }
+    *ONLINE_ENV.lock().unwrap_or_else(|e| e.into_inner()) = vec![
+        ("SOCKET_PATCH_SERVER_URL".to_string(), server.uri()),
+        (
+            "SOCKET_NPM_REGISTRY".to_string(),
+            format!("{}/registry", server.uri()),
+        ),
+    ];
     patches
 }
 
@@ -1002,10 +1042,9 @@ async fn mount_hosted_api(
 
 /// `proj` is PURELY hosted for `hp.dep`: no vendored ledger claim, no
 /// committed artifact (at either uuid), no `.socket/vendor/` residue in the
-/// lock, the packages line IS the URL 3-tuple, and the redirect ledger's
-/// record + edit are present with `original` == the PRISTINE registry line
-/// and `new` == the live line. Every other dep's line is byte-identical to
-/// the pristine lock.
+/// lock, the packages line IS the URL 3-tuple, and no hosted ledger is
+/// written (v5: the lock is the hosted state). Every other dep's line is
+/// byte-identical to the pristine lock.
 fn assert_pure_hosted(fx: &Fixture, proj: &Path, hp: &HostedPatch) {
     let dep = hp.dep;
     let state = read(proj, ".socket/vendor/state.json");
@@ -1047,57 +1086,23 @@ fn assert_pure_hosted(fx: &Fixture, proj: &Path, hp: &HostedPatch) {
             other.name
         );
     }
-    let ledger = read_json(proj, ".socket/vendor/redirect-state.json");
-    assert_eq!(
-        ledger["records"][dep.purl]["uuid"], dep.uuid_h,
-        "the redirect ledger must record the hosted patch: {ledger:#}"
-    );
-    let edit = ledger_edit_for(&ledger, dep.name).unwrap_or_else(|| {
-        panic!(
-            "no redirect_bun_lock_package edit for {}: {ledger:#}",
-            dep.name
-        )
-    });
-    assert_eq!(edit["path"], "bun.lock", "{edit:#}");
-    assert_eq!(
-        edit["original"],
-        json!(fx.pristine_line(dep)),
-        "the redirect ledger's `original` must be the PRISTINE registry line — never a \
-         `.socket/vendor/` local-path line (originals chain intact across migrations): {edit:#}"
-    );
-    assert_eq!(
-        edit["new"],
-        json!(packages_line(&lock, dep.name)),
-        "the redirect ledger's `new` must be the live lock line: {edit:#}"
+    assert!(
+        !proj.join(".socket/vendor/redirect-state.json").exists(),
+        "hosted mode writes no ledger"
     );
 }
 
-/// `proj` is PURELY vendored for `dep` at `uuid`: the redirect ledger no
-/// longer claims the purl (record and edit both gone; file removed when
-/// emptied), the packages line carries the local `.socket/vendor/npm/<uuid>/`
+/// `proj` is PURELY vendored for `dep` at `uuid`: no hosted ledger exists,
+/// the packages line carries the local `.socket/vendor/npm/<uuid>/`
 /// 3-tuple and no hosted URL, the artifact is committed, and the vendor
 /// ledger's `bun_lock_package` wiring records the PRISTINE registry line as
 /// its `original` (never the grant-tokenized hosted URL line). Every other
 /// dep's line is byte-identical to the pristine lock.
 fn assert_pure_vendored(fx: &Fixture, proj: &Path, dep: &Dep, uuid: &str, hosted_url: &str) {
-    match std::fs::read_to_string(proj.join(".socket/vendor/redirect-state.json")) {
-        Ok(text) => {
-            let ledger: Value = serde_json::from_str(&text).unwrap();
-            assert!(
-                ledger["records"].get(dep.purl).is_none(),
-                "the superseded redirect record must be dropped: {ledger:#}"
-            );
-            assert!(
-                ledger_edit_for(&ledger, dep.name).is_none(),
-                "the superseded bun.lock edit must be dropped: {ledger:#}"
-            );
-        }
-        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
-            // An emptied ledger is deleted — the expected outcome when this
-            // was the only hosted record.
-        }
-        Err(e) => panic!("unreadable redirect ledger: {e}"),
-    }
+    assert!(
+        !proj.join(".socket/vendor/redirect-state.json").exists(),
+        "no hosted ledger may exist"
+    );
     let lock = read(proj, "bun.lock");
     assert!(
         !lock.contains(hosted_url) && !lock.contains("/patch/npm/"),
@@ -1324,13 +1329,28 @@ fn take_over_to_hosted(fx: &Fixture, proj: &Path, api: &str, hp: &HostedPatch, t
                 bun_vex::Marker::Redirected,
                 &[(GHSA, &[CVE_VIEW])],
             );
+            // The stale uuid may only be NAMED by the advisory that says it
+            // was superseded (v5: no hosted ledger record shadows the
+            // manifest's, so the manifest record is what gets superseded) —
+            // never in an event or the document.
             assert!(
-                !out.stdout.contains(DEP_A.uuid_v)
+                !out.envelope["events"].to_string().contains(DEP_A.uuid_v)
                     && !std::fs::read_to_string(&out.output)
                         .unwrap()
                         .contains(DEP_A.uuid_v),
                 "the stale manifest uuid must not be attested ({tag}): {out}"
             );
+            let warnings = out.envelope["warnings"]
+                .as_array()
+                .cloned()
+                .unwrap_or_default();
+            assert!(
+                warnings
+                    .iter()
+                    .filter(|w| w.to_string().contains(DEP_A.uuid_v))
+                    .all(|w| w["code"] == "vex_record_superseded"),
+                "only the supersede advisory may name the stale uuid ({tag}): {out}"
+            );
         });
         eprintln!("BUN-VEX stale-manifest-{tag} hosted wired-uuid-wins ok");
     }
@@ -1354,8 +1374,8 @@ fn take_over_to_hosted(fx: &Fixture, proj: &Path, api: &str, hp: &HostedPatch, t
 /// committed artifact. Returns that uuid.
 #[derive(Clone, Copy, PartialEq, Debug)]
 enum VendoredDriver {
-    /// `vendor --json --offline` over a hand-staged manifest (uuid_v).
-    VendorOffline,
+    /// `vendor --json` over a hand-staged manifest (uuid_v).
+    VendorManifest,
     /// `scan --mode vendored --json --yes` — discovery + download from the
     /// mock API (uuid_h), then the same vendor engine.
     ScanVendored,
@@ -1374,11 +1394,11 @@ fn take_over_to_vendored(
     // cleartext-logging heuristic would otherwise taint every `{vendor_env}`
     // assertion message with the `uuid`-named half.
     let uuid = match driver {
-        VendoredDriver::VendorOffline => dep.uuid_v,
+        VendoredDriver::VendorManifest => dep.uuid_v,
         VendoredDriver::ScanVendored => dep.uuid_h,
     };
     let vendor_env = match driver {
-        VendoredDriver::VendorOffline => {
+        VendoredDriver::VendorManifest => {
             stage_manifest(fx, proj, dep);
             let (code, stdout, stderr) = vendor_cmd(proj, &[]);
             assert_eq!(code, 0, "vendor failed ({tag}): {stdout}\n{stderr}");
@@ -1419,7 +1439,7 @@ fn take_over_to_vendored(
     match driver {
         // Standalone `vendor` is fed by the staged manifest and leaves its
         // record in place — the legacy manifest-tracked shape.
-        VendoredDriver::VendorOffline => {
+        VendoredDriver::VendorManifest => {
             let manifest = read_json(proj, ".socket/manifest.json");
             assert_eq!(
                 manifest["patches"][dep.purl]["uuid"], uuid,
@@ -1454,7 +1474,7 @@ fn take_over_to_vendored(
     );
     eprintln!("HOSTED→VENDORED OK ({tag}, {driver:?}, bun {})", fx.bun_raw);
     let cve = match driver {
-        VendoredDriver::VendorOffline => CVE_MANIFEST,
+        VendoredDriver::VendorManifest => CVE_MANIFEST,
         VendoredDriver::ScanVendored => CVE_VIEW,
     };
     manifestless_vex(
@@ -1500,7 +1520,7 @@ async fn bun_vendored_then_hosted_takeover_leaves_pure_hosted() {
     };
     let proj = fx.proj.clone();
 
-    // A: vendor (offline) from the staged manifest.
+    // A: vendor from the staged manifest.
     stage_manifest(&fx, &proj, &DEP_A);
     let (code, stdout, stderr) = vendor_cmd(&proj, &[]);
     assert_eq!(code, 0, "vendor failed: {stdout}\n{stderr}");
@@ -1542,10 +1562,8 @@ async fn bun_hosted_then_vendored_takeover_round_trips_to_registry() {
     let patches = mount_hosted_api(&server, &fx, &[&DEP_A]).await;
     let hp = &patches[0];
 
-    // A: hosted redirect: registry 4-tuple → URL 3-tuple, ledger claims the
-    //    purl with one `redirect_bun_lock_package` edit whose original is
-    //    the pristine registry line; a fresh frozen install lands the
-    //    patched tree.
+    // A: hosted redirect: registry 4-tuple → URL 3-tuple (no ledger); a
+    //    fresh frozen install lands the patched tree.
     let (code, stdout, stderr) = hosted_scan(&proj, &server.uri(), &[]);
     assert_eq!(code, 0, "hosted scan failed: {stdout}\n{stderr}");
     let env = envelope(&stdout, &stderr);
@@ -1574,10 +1592,10 @@ async fn bun_hosted_then_vendored_takeover_round_trips_to_registry() {
         &by_vendor,
         &server.uri(),
         hp,
-        VendoredDriver::VendorOffline,
-        "vendor-offline",
+        VendoredDriver::VendorManifest,
+        "vendor-manifest",
     );
-    assert_vendor_revert_restores_pristine(&fx, &by_vendor, "vendor-offline");
+    assert_vendor_revert_restores_pristine(&fx, &by_vendor, "vendor-manifest");
 
     take_over_to_vendored(
         &fx,
@@ -1624,14 +1642,14 @@ async fn bun_dry_run_previews_match_wet_outcomes() {
     let (code, stdout, stderr) = hosted_scan(&hosted, &api, &[]);
     assert_eq!(code, 0, "hosted scan failed: {stdout}\n{stderr}");
     assert_pure_hosted(&fx, &hosted, hp);
-    // The manifest record `vendor` acts on (offline: the staged blob).
+    // The manifest record `vendor` acts on (the staged blob).
     stage_manifest(&fx, &hosted, &DEP_A);
     let before = snapshot(&hosted);
 
-    // `vendor --dry-run`: the takeover is PROBED (write-free per-purl revert
-    // on a ledger clone) and previewed; the backend preview does not run
-    // against the still-hosted lock, so no false `vendor_lock_entry_not_found`
-    // and no refusal.
+    // `vendor --dry-run`: the takeover's upstream restore is resolved
+    // write-free (registry lookup included) and previewed; the backend
+    // preview does not run against the still-hosted lock, so no false
+    // `vendor_lock_entry_not_found` and no refusal.
     let (code, stdout, stderr) = vendor_cmd(&hosted, &["--dry-run"]);
     assert_eq!(code, 0, "vendor --dry-run must succeed: {stdout}\n{stderr}");
     let env = envelope(&stdout, &stderr);
@@ -1741,7 +1759,7 @@ async fn bun_dry_run_previews_match_wet_outcomes() {
 // ─────────────────────────────────────────────────────────────────────────
 
 /// After unwinding ONLY DEP_A: its line is the pristine registry tuple,
-/// DEP_B is still hosted, the ledger keeps exactly DEP_B's record + edit,
+/// DEP_B is still hosted (the lock is the only hosted state — no ledger),
 /// and a fresh frozen install lands A's ORIGINAL and B's MARKER bytes.
 fn assert_only_a_unwound(fx: &Fixture, proj: &Path, b: &HostedPatch, tag: &str) {
     let lock = read(proj, "bun.lock");
@@ -1757,22 +1775,10 @@ fn assert_only_a_unwound(fx: &Fixture, proj: &Path, b: &HostedPatch, tag: &str)
         "{tag}: {} must stay hosted:\n{lock}",
         DEP_B.name
     );
-    let ledger = read_json(proj, ".socket/vendor/redirect-state.json");
     assert!(
-        ledger["records"].get(DEP_A.purl).is_none(),
-        "{tag}: A's record must be dropped: {ledger:#}"
-    );
-    assert_eq!(
-        ledger["records"][DEP_B.purl]["uuid"], DEP_B.uuid_h,
-        "{tag}: B's record must stay: {ledger:#}"
+        !proj.join(".socket/vendor/redirect-state.json").exists(),
+        "{tag}: no hosted ledger may exist"
     );
-    let edits = ledger["edits"].as_array().unwrap();
-    assert_eq!(
-        edits.len(),
-        1,
-        "{tag}: exactly B's edit must stay: {ledger:#}"
-    );
-    assert_eq!(edits[0]["key"], DEP_B.name, "{tag}: {ledger:#}");
     let fresh = fresh_frozen_install(fx, proj, &format!("fresh-{tag}"));
     assert_installed(&fresh, &DEP_A, &fx.a.orig, tag);
     assert_installed(&fresh, &DEP_B, &fx.b.patched, tag);
@@ -1790,7 +1796,7 @@ async fn bun_scoped_rollback_and_remove_unwind_one_of_two_hosted_records() {
     let patches = mount_hosted_api(&server, &fx, &[&DEP_A, &DEP_B]).await;
     let (a, b) = (&patches[0], &patches[1]);
 
-    // Both deps hosted-redirected in ONE scan: two records, two edits.
+    // Both deps hosted-redirected in ONE scan: two lock pins, no ledger.
     let (code, stdout, stderr) = hosted_scan(&proj, &server.uri(), &[]);
     assert_eq!(code, 0, "hosted scan failed: {stdout}\n{stderr}");
     let env = envelope(&stdout, &stderr);
@@ -1804,33 +1810,17 @@ async fn bun_scoped_rollback_and_remove_unwind_one_of_two_hosted_records() {
             hp.dep.name
         );
     }
-    let ledger = read_json(&proj, ".socket/vendor/redirect-state.json");
-    assert_eq!(
-        ledger["records"].as_object().map(|m| m.len()),
-        Some(2),
-        "{ledger:#}"
-    );
-    assert_eq!(
-        ledger["edits"].as_array().map(|e| e.len()),
-        Some(2),
-        "{ledger:#}"
+    assert!(
+        !proj.join(".socket/vendor/redirect-state.json").exists(),
+        "hosted mode writes no ledger"
     );
-    for hp in [a, b] {
-        let edit = ledger_edit_for(&ledger, hp.dep.name)
-            .unwrap_or_else(|| panic!("no edit for {}: {ledger:#}", hp.dep.name));
-        assert_eq!(
-            edit["original"],
-            json!(fx.pristine_line(hp.dep)),
-            "{edit:#}"
-        );
-    }
     let fresh = fresh_frozen_install(&fx, &proj, "fresh-two-hosted");
     assert_installed(&fresh, &DEP_A, &fx.a.patched, "two hosted records");
     assert_installed(&fresh, &DEP_B, &fx.b.patched, "two hosted records");
 
-    // Scoped rollback of A: per-purl path (two records ⇒ the whole-ledger
-    // replay is not eligible). Used to exit 1 with hosted.failed = ["cannot
-    // replay yet"].
+    // Scoped rollback of A: only A's pin is restored to its upstream
+    // registry entry (v5: re-resolved from the registry mirror); B's pin is
+    // left alone.
     let by_rollback = fx.dir("two-hosted-copy-rollback");
     copy_project(&proj, &by_rollback);
     let (code, stdout, stderr) = rollback_cmd(&by_rollback, &[DEP_A.purl]);
@@ -1841,8 +1831,7 @@ async fn bun_scoped_rollback_and_remove_unwind_one_of_two_hosted_records() {
     assert_eq!(env["hosted"]["failed"], json!([]), "{env:#}");
     assert_eq!(env["hosted"]["unsupported"], json!([]), "{env:#}");
     assert_only_a_unwound(&fx, &by_rollback, b, "scoped-rollback");
-    // Then the unscoped rollback: covers the last record ⇒ whole-ledger
-    // replay ⇒ pristine.
+    // Then the unscoped rollback restores the remaining pin ⇒ pristine.
     assert_unscoped_rollback_restores_pristine(&fx, &by_rollback, "after-scoped-rollback");
 
     // `remove <purl>` takes the same per-purl hosted leg.
@@ -1914,8 +1903,8 @@ async fn bun_rollback_from_each_mixed_state_restores_pristine() {
     assert_unscoped_rollback_restores_pristine(&fx, &one, "mixed-1");
 
     // State (2): hosted → vendored (scan-driven), then rollback: the
-    // vendored leg unwires + removes the artifact, the (emptied) redirect
-    // ledger is already gone, the manifest record is retired.
+    // vendored leg unwires + removes the artifact (the takeover already
+    // restored the upstream entry, so nothing hosted is left).
     let two = fx.dir("mixed-hosted-then-vendored");
     copy_project(&proj, &two);
     let (code, stdout, stderr) = hosted_scan(&two, &api, &[]);
diff --git a/crates/socket-patch-cli/tests/mode_migration_cargo.rs b/crates/socket-patch-cli/tests/mode_migration_cargo.rs
index 8b1d3b60..ec54b19b 100644
--- a/crates/socket-patch-cli/tests/mode_migration_cargo.rs
+++ b/crates/socket-patch-cli/tests/mode_migration_cargo.rs
@@ -11,7 +11,10 @@
 //! `registry = "socket-patch-…"` Cargo.toml pin after a vendored takeover), a
 //! double takeover must keep the unrecoverable crates.io lock originals in
 //! the vendored ledger, and the takeover classifier must never tell the user
-//! to delete the live ledger.
+//! to delete live hosted state. v5 hosted mode keeps no ledger: vendoring
+//! over a hosted pin first restores the crates.io entry (re-resolved from
+//! the sparse index — a wiremock here via `SOCKET_CRATES_INDEX`), and an
+//! unrestorable pin (offline) is refused.
 //!
 //! Each scenario drives the REAL binary against real cargo (network used for
 //! the crates.io fixture build only; the hosted registry is wiremock) and
@@ -22,8 +25,10 @@
 //! marker: `(redirected)` for the hosted uuid after vendored → hosted,
 //! `(vendored)` for the vendored uuid after hosted → vendored and after the
 //! A → B → A round trip. (0) with the manifest still naming the displaced
-//! patch (the wired uuid wins), (1) manifest deleted / ledger kept (zero
-//! API calls), (2) ledgers deleted (lockfile wiring + API record), (3)
+//! patch (the wired uuid wins), (1) manifest deleted / ledgers kept (zero
+//! API calls for a vendored pin; a hosted pin's record — v5 keeps no hosted
+//! ledger — comes from the API), (2) ledgers deleted (lockfile wiring + API
+//! record), (3)
 //! `--offline` with no ledger → `record_unavailable`, zero requests. The
 //! displaced patch is never attested.
 //!
@@ -66,6 +71,16 @@ fn binary() -> PathBuf {
 }
 
 fn run_socket(cwd: &Path, args: &[&str], cargo_home: &Path) -> (i32, String, String) {
+    run_socket_env(cwd, args, cargo_home, &[])
+}
+
+/// [`run_socket`] with extra env applied after the scrub.
+fn run_socket_env(
+    cwd: &Path,
+    args: &[&str],
+    cargo_home: &Path,
+    env: &[(&str, &str)],
+) -> (i32, String, String) {
     let mut cmd = Command::new(binary());
     cmd.args(args).current_dir(cwd);
     for (k, _) in std::env::vars_os() {
@@ -75,6 +90,9 @@ fn run_socket(cwd: &Path, args: &[&str], cargo_home: &Path) -> (i32, String, Str
     }
     cmd.env_remove("VIRTUAL_ENV");
     cmd.env("CARGO_HOME", cargo_home);
+    for (k, v) in env {
+        cmd.env(k, v);
+    }
     let out = cmd.output().expect("failed to run socket-patch binary");
     (
         out.status.code().unwrap_or(-1),
@@ -386,6 +404,53 @@ async fn mount_hosted_mocks(
     index_url
 }
 
+/// Serve a crates.io sparse-index row for DEP@`version` carrying the
+/// PRISTINE lock's checksum, from `server` under `/crates-index` — what the
+/// v5 upstream restore reads (`SOCKET_CRATES_INDEX`) to put a hosted
+/// Cargo.lock entry back on crates.io. Mirroring the pristine value keeps
+/// the unwind hermetic. Returns the index base.
+async fn mount_crates_index(server: &MockServer, version: &str, pristine_lock: &str) -> String {
+    let cksum = cargo_e2e_matrix::parse_lock(pristine_lock)
+        .into_iter()
+        .find(|p| p.name == DEP)
+        .and_then(|p| p.checksum)
+        .expect("pristine lock has a checksum");
+    let row = serde_json::json!({
+        "name": DEP, "vers": version, "deps": [], "cksum": cksum,
+        "features": {}, "yanked": false,
+    })
+    .to_string();
+    Mock::given(method("GET"))
+        .and(path(format!("/crates-index/{}", sparse_index_rel(DEP))))
+        .respond_with(ResponseTemplate::new(200).set_body_raw(row, "text/plain"))
+        .mount(server)
+        .await;
+    format!("{}/crates-index", server.uri())
+}
+
+/// Plain `vendor --json` ONLINE over a hosted pin on `server`'s origin
+/// (`--patch-server-url`), the crates index mirrored at `index`.
+fn vendor_over_hosted(
+    proj: &Path,
+    cargo_home: &Path,
+    server: &MockServer,
+    index: &str,
+) -> (i32, String, String) {
+    run_socket_env(
+        proj,
+        &[
+            "vendor",
+            "--json",
+            "--patch-server-url",
+            server.uri().as_str(),
+            "--cwd",
+            proj.to_str().unwrap(),
+        ],
+        cargo_home,
+        &[("SOCKET_CRATES_INDEX", index)],
+    )
+}
+
 /// Manifest-less VEX over a post-takeover fresh checkout: `wired` (uuid +
 /// marker) must attest, `displaced` never. Runs on a blocking thread (the
 /// shared `PatchApi` brings its own runtime).
@@ -452,17 +517,31 @@ impl TakeoverVex {
             assert_eq!(out.code, Some(0), "(0) with manifest:\n{out}");
             only_wired(out.doc(), "(0)");
         }
-        // (1) Manifest deleted, ledger kept.
+        // (1) Manifest deleted, ledgers kept. A vendored pin's record lives
+        //     in the vendor ledger (zero API calls); v5 hosted mode keeps no
+        //     ledger, so a hosted pin's record comes from the API.
         strip_manifest(fresh);
         let before = api.request_count();
         let out = run_vex(&bin, fresh, &run);
-        assert_eq!(out.code, Some(0), "(1) ledger-backed:\n{out}");
+        assert_eq!(out.code, Some(0), "(1) manifest deleted:\n{out}");
         only_wired(out.doc(), "(1)");
-        assert_eq!(
-            api.request_count(),
-            before,
-            "(1) the ledger record needs no API"
-        );
+        if matches!(marker, Marker::Redirected) {
+            assert!(
+                api.view_requests(uuid) >= 1,
+                "(1) the hosted record is fetched from the API"
+            );
+            assert_eq!(
+                api.view_requests(self.displaced),
+                0,
+                "(1) never asked for the displaced one"
+            );
+        } else {
+            assert_eq!(
+                api.request_count(),
+                before,
+                "(1) the vendor ledger record needs no API"
+            );
+        }
         // (2) Ledgers deleted: the lockfile wiring + the API's record.
         strip_ledgers(fresh);
         let out = run_vex(&bin, fresh, &run);
@@ -622,8 +701,8 @@ async fn vendored_then_hosted_takeover_leaves_pure_hosted() {
         "the orphaned committed tree must be removed"
     );
     assert!(
-        proj.join(".socket/vendor/redirect-state.json").exists(),
-        "hosted ledger written"
+        !proj.join(".socket/vendor/redirect-state.json").exists(),
+        "hosted mode writes no ledger"
     );
     let lock_block = package_block(&read(&proj, "Cargo.lock"), DEP).unwrap_or_default();
     assert!(
@@ -654,7 +733,7 @@ async fn vendored_then_hosted_takeover_leaves_pure_hosted() {
     .run()
     .await;
 
-    // D: a later vendored-flow no-op must NOT emit the inverted
+    // D: a later vendored-flow no-op must NOT emit the (removed)
     // vendor_supersedes_redirect warning (C4b: pre-fix it told the user to
     // delete the LIVE hosted ledger while the lock pointed at the sparse
     // index). Empty API + no manifest = the no-manifest no-op path.
@@ -785,8 +864,9 @@ async fn lockless_vendor_then_first_build_then_hosted_takeover() {
 }
 
 // ── C2 / C7: hosted → vendored takeover via the plain `vendor` command ──────
-// The primary migration entry point must revert the hosted edits first (from
-// the redirect ledger), surface the takeover, leave the project PURELY
+// The primary migration entry point must restore the hosted pin's crates.io
+// entry first (v5: from the sparse index), surface the takeover, leave the
+// project PURELY
 // vendored (fresh checkout builds offline under --locked), and a final
 // `vendor --revert` must restore the pristine pre-hosted project.
 #[tokio::test(flavor = "multi_thread")]
@@ -831,19 +911,16 @@ async fn hosted_then_vendored_takeover_leaves_pure_vendored() {
         "hosted pin present"
     );
 
+    assert!(
+        !proj.join(".socket/vendor/redirect-state.json").exists(),
+        "hosted mode writes no ledger"
+    );
+
     // B: plain `vendor` over the hosted state — the takeover.
+    let index =
+        mount_crates_index(&server, &version, &String::from_utf8_lossy(&lock_pristine)).await;
     stage_patch(&proj, &purl, &orig, &patched);
-    let (code, stdout, stderr) = run_socket(
-        &proj,
-        &[
-            "vendor",
-            "--json",
-            "--offline",
-            "--cwd",
-            proj.to_str().unwrap(),
-        ],
-        &cargo_home,
-    );
+    let (code, stdout, stderr) = vendor_over_hosted(&proj, &cargo_home, &server, &index);
     assert_eq!(code, 0, "vendor failed: {stdout}\n{stderr}");
     let envelope: serde_json::Value = serde_json::from_str(&stdout).expect("json envelope");
     assert_eq!(envelope["summary"]["applied"], 1, "{stdout}");
@@ -855,7 +932,7 @@ async fn hosted_then_vendored_takeover_leaves_pure_vendored() {
 
     // The project is FULLY vendored: the hosted Cargo.toml pin and the
     // registries block are gone, [patch.crates-io] + detached lock are in,
-    // and the hosted ledger record is dropped.
+    // and no hosted ledger exists.
     let toml = read(&proj, "Cargo.toml");
     assert!(
         !toml.contains("socket-patch-"),
@@ -875,7 +952,7 @@ async fn hosted_then_vendored_takeover_leaves_pure_vendored() {
     );
     assert!(
         !proj.join(".socket/vendor/redirect-state.json").exists(),
-        "the emptied hosted ledger must be removed: {}",
+        "no hosted ledger may exist: {}",
         read(&proj, ".socket/vendor/redirect-state.json")
     );
     let lock_block = package_block(&read(&proj, "Cargo.lock"), DEP).unwrap_or_default();
@@ -996,18 +1073,11 @@ async fn double_takeover_a_b_a_preserves_lock_originals() {
     );
     assert_eq!(code, 0, "hosted scan failed: {stdout}\n{stderr}");
 
-    // A again: vendor back.
-    let (code, stdout, stderr) = run_socket(
-        &proj,
-        &[
-            "vendor",
-            "--json",
-            "--offline",
-            "--cwd",
-            proj.to_str().unwrap(),
-        ],
-        &cargo_home,
-    );
+    // A again: vendor back (restoring the hosted pin's crates.io entry
+    // first).
+    let index =
+        mount_crates_index(&server, &version, &String::from_utf8_lossy(&lock_pristine)).await;
+    let (code, stdout, stderr) = vendor_over_hosted(&proj, &cargo_home, &server, &index);
     assert_eq!(code, 0, "re-vendor failed: {stdout}\n{stderr}");
 
     // The vendored ledger's lock originals are the PRISTINE crates.io values
@@ -1073,12 +1143,14 @@ async fn double_takeover_a_b_a_preserves_lock_originals() {
     );
 }
 
-// ── FAIL CLOSED: vendoring over a hosted redirect with no ledger refuses ────
-// When the redirect ledger is gone the hosted originals are unrecoverable —
-// the vendor run must refuse the purl with an actionable error instead of
-// creating the mixed unbuildable state and reporting success.
+// ── FAIL CLOSED: vendoring over an unrestorable hosted pin refuses ─────────
+// When the hosted pin's crates.io entry cannot be re-resolved (here:
+// `--offline`), the vendor run must refuse the purl with an actionable error
+// instead of creating the mixed unbuildable state and reporting success. The
+// cargo backend's `hosted_redirect_live` guard backstops a half-reverted
+// project whose lock is back on crates.io but whose manifest still pins.
 #[tokio::test(flavor = "multi_thread")]
-async fn vendor_over_hosted_without_ledger_is_refused() {
+async fn vendor_over_unrestorable_hosted_pin_is_refused() {
     let tmp = tempfile::tempdir().unwrap();
     let Some((proj, cargo_home, version, crate_dir)) = stage_fixture(tmp.path()) else {
         return;
@@ -1115,8 +1187,7 @@ async fn vendor_over_hosted_without_ledger_is_refused() {
     );
     assert_eq!(code, 0, "hosted scan failed: {stdout}\n{stderr}");
 
-    // The revert data is gone.
-    std::fs::remove_file(proj.join(".socket/vendor/redirect-state.json")).unwrap();
+    assert!(!proj.join(".socket/vendor/redirect-state.json").exists());
     let toml_before = read(&proj, "Cargo.toml");
     let lock_before = read(&proj, "Cargo.lock");
 
@@ -1127,6 +1198,8 @@ async fn vendor_over_hosted_without_ledger_is_refused() {
             "vendor",
             "--json",
             "--offline",
+            "--patch-server-url",
+            server.uri().as_str(),
             "--cwd",
             proj.to_str().unwrap(),
         ],
@@ -1134,8 +1207,10 @@ async fn vendor_over_hosted_without_ledger_is_refused() {
     );
     assert_eq!(code, 1, "must fail closed: {stdout}\n{stderr}");
     assert!(
-        stdout.contains("hosted_redirect_live"),
-        "actionable refusal code missing: {stdout}"
+        stdout.contains("redirect_revert_failed")
+            && stdout.contains("cannot vendor over the live hosted pin")
+            && stdout.contains("git checkout --"),
+        "actionable refusal (with the checkout remedy) missing: {stdout}"
     );
     // Nothing was half-applied: the hosted wiring is untouched and no
     // vendored artifact/wiring was created.
@@ -1186,6 +1261,15 @@ async fn vendor_over_hosted_without_ledger_is_refused() {
         stdout.contains("hosted_redirect_live"),
         "actionable refusal code missing: {stdout}"
     );
+    assert!(
+        stdout.contains("socket-patch rollback")
+            || stdout.contains("git checkout -- Cargo.toml Cargo.lock"),
+        "the refusal names the v5 remedy, not a ledger: {stdout}"
+    );
+    assert!(
+        !stdout.contains("redirect-state.json"),
+        "no ledger is named: {stdout}"
+    );
     assert_eq!(read(&proj, "Cargo.toml"), table_toml);
     assert_eq!(read(&proj, "Cargo.lock"), pristine_lock);
     assert!(!vendor_ledger_claims(&proj, &purl));
diff --git a/crates/socket-patch-cli/tests/mode_migration_npm.rs b/crates/socket-patch-cli/tests/mode_migration_npm.rs
index a2398ae3..f734f77a 100644
--- a/crates/socket-patch-cli/tests/mode_migration_npm.rs
+++ b/crates/socket-patch-cli/tests/mode_migration_npm.rs
@@ -2,16 +2,16 @@
 //! family must leave the project FULLY in the new mode — or refuse.
 //!
 //! Twin of `mode_migration_cargo.rs` for the yarn classic + berry lock
-//! flavors. Vendoring an npm purl over a LIVE hosted redirect must run the
-//! cross-mode pre-revert, or it would:
+//! flavors. Vendoring an npm purl over a LIVE hosted pin must first restore
+//! the pin's upstream registry entry (v5: re-resolved from the registry;
+//! hosted mode keeps no ledger), or it would:
 //!   (a) record the HOSTED patch.socket.dev lock fragment as the vendor
 //!       ledger's unrecoverable pre-vendor "original" (not the pristine
-//!       registry fragment),
-//!   (b) leave the redirect ledger's records + edits in place forever, so the
-//!       `vendor_supersedes_redirect` warning's promised auto-reconcile never
-//!       converges, and
-//!   (c) make `vendor --revert` land back on the (grant-tokenized, expiring)
+//!       registry fragment), and
+//!   (b) make `vendor --revert` land back on the (grant-tokenized, expiring)
 //!       hosted wiring with no CLI path back to registry state.
+//! The reverse direction's hosted state is the lock alone; `rollback`
+//! restores its upstream entry.
 //!
 //! Each scenario drives the REAL binary against a real `corepack yarn`
 //! (network used for the registry fixture install only; the hosted patch
@@ -112,9 +112,17 @@ fn corepack(cwd: &Path, pm: &str, args: &[&str], extra_env: &[(&str, &str)]) ->
 }
 
 fn run_socket(cwd: &Path, args: &[&str]) -> (i32, String, String) {
+    run_socket_env(cwd, args, &[])
+}
+
+/// [`run_socket`] with extra env applied after the scrub.
+fn run_socket_env(cwd: &Path, args: &[&str], env: &[(&str, &str)]) -> (i32, String, String) {
     let mut cmd = Command::new(binary());
     cmd.args(args).current_dir(cwd);
     scrub_socket_env(&mut cmd);
+    for (k, v) in env {
+        cmd.env(k, v);
+    }
     let out = cmd.output().expect("failed to run socket-patch binary");
     (
         out.status.code().unwrap_or(-1),
@@ -377,6 +385,44 @@ async fn mount_hosted_mocks(
     hosted_url
 }
 
+/// Serve, from `server` (as `SOCKET_NPM_REGISTRY`), the npm registry version
+/// document the v5 upstream restore reads for DEP — mirrored from what the
+/// PRISTINE classic lock recorded (`resolved "<tarball>#<sha1>"`,
+/// `integrity`). The restore of a hosted classic entry must reproduce the
+/// registry entry yarn wrote from exactly that document; mirroring it keeps
+/// the unwind hermetic (the binary's TLS stack need not reach the real
+/// registry). Returns the registry base to hand the binary.
+async fn mount_registry_from_classic_lock(server: &MockServer, lock: &str) -> String {
+    let block = lock
+        .split("\n\n")
+        .find(|b| {
+            b.contains(&format!("{DEP}@")) && b.contains(&format!("version \"{DEP_VERSION}\""))
+        })
+        .unwrap_or_else(|| panic!("no {DEP} block in the pristine lock:\n{lock}"));
+    let field = |name: &str| {
+        block
+            .lines()
+            .find_map(|l| l.trim().strip_prefix(&format!("{name} ")))
+            .map(|v| v.trim_matches('"').to_string())
+            .unwrap_or_else(|| panic!("no `{name}` in {block}"))
+    };
+    let resolved = field("resolved");
+    let (tarball, shasum) = resolved
+        .split_once('#')
+        .map(|(t, s)| (t.to_string(), Some(s.to_string())))
+        .unwrap_or((resolved.clone(), None));
+    Mock::given(method("GET"))
+        .and(path(format!("/registry/{DEP}/{DEP_VERSION}")))
+        .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+            "name": DEP,
+            "version": DEP_VERSION,
+            "dist": { "tarball": tarball, "integrity": field("integrity"), "shasum": shasum }
+        })))
+        .mount(server)
+        .await;
+    format!("{}/registry", server.uri())
+}
+
 fn run_hosted_scan(proj: &Path, server_uri: &str) -> (i32, String, String) {
     run_socket(
         proj,
@@ -501,7 +547,7 @@ fn fresh_checkout(proj: &Path, tmp: &Path, tag: &str, berry: bool) -> PathBuf {
 }
 
 /// Assertions shared by the classic and berry hosted→vendored legs:
-/// the redirect ledger is fully reconciled, the vendor ledger's recorded
+/// no hosted ledger exists, the vendor ledger's recorded
 /// originals are the PRISTINE registry fragments, a fresh checkout installs
 /// the patched bytes, and `vendor --revert` restores the registry lock
 /// byte-identically.
@@ -522,12 +568,11 @@ fn assert_pure_vendored_and_round_trip(
         "takeover advisory missing from the vendor envelope ({tag}): {vendor_stdout}"
     );
 
-    // (b) The superseded redirect ledger is DROPPED — records and edits both
-    // — so the vendor_supersedes_redirect warning can never fire again and
-    // no stale hosted originals survive as a revert replay hazard.
+    // v5 hosted mode keeps no ledger: the lock is the only hosted state,
+    // and the takeover's restore removed it.
     assert!(
         !proj.join(".socket/vendor/redirect-state.json").exists(),
-        "the emptied redirect ledger must be removed ({tag}): {}",
+        "no hosted ledger may exist ({tag}): {}",
         read(proj, ".socket/vendor/redirect-state.json")
     );
 
@@ -597,7 +642,7 @@ fn assert_pure_vendored_and_round_trip(
         "fresh vendored install must carry the PATCHED bytes ({tag})"
     );
 
-    // (c) Round trip: `vendor --revert` restores the REGISTRY lock
+    // (b) Round trip: `vendor --revert` restores the REGISTRY lock
     // byte-identically (pre-fix it restored the hosted fragment, with no CLI
     // path back to registry state).
     let (code, stdout, stderr) = run_socket(
@@ -756,21 +801,28 @@ async fn classic_hosted_then_vendored_takeover_round_trips_to_registry() {
     let lock = read(&proj, "yarn.lock");
     assert!(lock.contains(&hosted_url), "hosted wiring present:\n{lock}");
     assert!(
-        proj.join(".socket/vendor/redirect-state.json").exists(),
-        "hosted ledger written"
+        !proj.join(".socket/vendor/redirect-state.json").exists(),
+        "hosted mode writes no ledger"
     );
 
-    // B: vendor over the live hosted redirect — the takeover.
+    // B: vendor over the live hosted pin — the takeover. Online: the
+    // upstream restore re-resolves the registry entry (mirrored from the
+    // pristine lock), and the mock origin is named hosted via
+    // --patch-server-url.
+    let registry =
+        mount_registry_from_classic_lock(&server, &String::from_utf8_lossy(&lock_pristine)).await;
     stage_patch(&proj, &fx.orig, &fx.patched);
-    let (code, stdout, stderr) = run_socket(
+    let (code, stdout, stderr) = run_socket_env(
         &proj,
         &[
             "vendor",
             "--json",
-            "--offline",
+            "--patch-server-url",
+            server.uri().as_str(),
             "--cwd",
             proj.to_str().unwrap(),
         ],
+        &[("SOCKET_NPM_REGISTRY", registry.as_str())],
     );
     assert_eq!(code, 0, "vendor failed: {stdout}\n{stderr}");
     let envelope: serde_json::Value = serde_json::from_str(&stdout).expect("json envelope");
@@ -830,14 +882,18 @@ async fn berry_hosted_then_vendored_takeover_round_trips_to_registry() {
         "hosted wiring present:\n{lock}"
     );
 
-    // B: vendor over the live hosted redirect — the takeover.
+    // B: vendor over the live hosted pin — the takeover. Online against the
+    // REAL registry: berry's restore re-derives the 10c0 checksum from the
+    // registry tarball. The mock origin is named hosted via
+    // --patch-server-url.
     stage_patch(&proj, &fx.orig, &fx.patched);
     let (code, stdout, stderr) = run_socket(
         &proj,
         &[
             "vendor",
             "--json",
-            "--offline",
+            "--patch-server-url",
+            server.uri().as_str(),
             "--cwd",
             proj.to_str().unwrap(),
         ],
@@ -896,8 +952,8 @@ async fn berry_hosted_then_vendored_takeover_round_trips_to_registry() {
 // ── vendored → hosted takeover, yarn classic (reverse direction) ────────────
 // The hosted scan must revert the vendored wiring + ledger entry + committed
 // artifact FIRST (per purl, the exact `vendor --revert` machinery), then
-// redirect — leaving the project purely hosted with the redirect ledger's
-// originals recording the PRISTINE registry fragments.
+// redirect — leaving the project purely hosted (the lock is the only hosted
+// state), from which `rollback` restores the PRISTINE registry lock.
 #[tokio::test(flavor = "multi_thread")]
 #[serial_test::serial]
 async fn classic_vendored_then_hosted_takeover_leaves_pure_hosted() {
@@ -942,8 +998,8 @@ async fn classic_vendored_then_hosted_takeover_leaves_pure_hosted() {
     );
 
     // The project is FULLY hosted: no vendored ledger claim, no committed
-    // artifact, no `file:` lock residue; the hosted wiring is present and its
-    // ledger records the PRISTINE registry originals.
+    // artifact, no `file:` lock residue; the hosted wiring is present and no
+    // hosted ledger is written.
     assert!(
         !read(&proj, ".socket/vendor/state.json").contains(PURL),
         "the displaced vendored ledger entry must be dropped: {}",
@@ -959,11 +1015,9 @@ async fn classic_vendored_then_hosted_takeover_leaves_pure_hosted() {
         !lock.contains(".socket/vendor/"),
         "no vendored residue in the lock:\n{lock}"
     );
-    let ledger = read(&proj, ".socket/vendor/redirect-state.json");
     assert!(
-        ledger.contains("registry.yarnpkg.com") || ledger.contains("registry.npmjs.org"),
-        "the redirect ledger's originals must be the pristine registry \
-         fragments (originals chain intact across migrations): {ledger}"
+        !proj.join(".socket/vendor/redirect-state.json").exists(),
+        "hosted mode writes no ledger"
     );
 
     // Fresh checkout installs the patched bytes from the hosted tarball.
@@ -1000,6 +1054,31 @@ async fn classic_vendored_then_hosted_takeover_leaves_pure_hosted() {
             &lock_pristine,
         )
     });
+
+    // The originals chain across migrations: `rollback` restores the hosted
+    // pin's upstream registry entry, which is the pristine lock byte for
+    // byte (online: the entry is re-resolved from the registry document).
+    let registry =
+        mount_registry_from_classic_lock(&server, &String::from_utf8_lossy(&lock_pristine)).await;
+    let (code, stdout, stderr) = run_socket_env(
+        &proj,
+        &[
+            "rollback",
+            "--json",
+            "--yes",
+            "--patch-server-url",
+            server.uri().as_str(),
+            "--cwd",
+            proj.to_str().unwrap(),
+        ],
+        &[("SOCKET_NPM_REGISTRY", registry.as_str())],
+    );
+    assert_eq!(code, 0, "rollback failed: {stdout}\n{stderr}");
+    assert_eq!(
+        read(&proj, "yarn.lock"),
+        String::from_utf8_lossy(&lock_pristine),
+        "rollback lands on the pristine registry lock"
+    );
 }
 
 // ── vendored → hosted takeover, yarn berry (reverse direction) ─────────────
diff --git a/crates/socket-patch-cli/tests/mode_migration_vlt.rs b/crates/socket-patch-cli/tests/mode_migration_vlt.rs
index 8fd1ea9d..64349b26 100644
--- a/crates/socket-patch-cli/tests/mode_migration_vlt.rs
+++ b/crates/socket-patch-cli/tests/mode_migration_vlt.rs
@@ -97,10 +97,55 @@ fn vendor_cmd(proj: &Path, extra: &[&str]) -> SocketOut {
     socket(proj, &args, &[])
 }
 
+/// `<head> … --json --yes --cwd <dir> --api-url/--org/--api-token <svc>
+/// --patch-server-url <svc> <extra>` with `SOCKET_NPM_REGISTRY` = the
+/// harness registry. v5 keeps no hosted ledger: a hosted pin on the mock
+/// patch service is only recognized under `--patch-server-url`, and every
+/// unwind of it (rollback, remove, a vendored takeover) restores its
+/// upstream entry from the npm registry — here the harness registry.
+fn api_upstream(fx: &Fixture, dir: &Path, head: &[&str], extra: &[&str]) -> SocketOut {
+    let cwd = cwd_args(dir);
+    let uri = fx.svc.uri();
+    let mut args: Vec<&str> = head.to_vec();
+    args.extend([
+        "--json",
+        "--yes",
+        "--cwd",
+        &cwd,
+        "--api-url",
+        &uri,
+        "--org",
+        ORG,
+        "--api-token",
+        "sktsec_placeholder_value_for_tests_api",
+        "--patch-server-url",
+        &uri,
+    ]);
+    args.extend_from_slice(extra);
+    socket(dir, &args, &[("SOCKET_NPM_REGISTRY", &fx.reg.url())])
+}
+
+/// `vendor` over a (possibly) hosted project: no `--offline`, since the
+/// takeover restores the hosted pin's upstream entry first.
+fn vendor_upstream(fx: &Fixture, dir: &Path, extra: &[&str]) -> SocketOut {
+    api_upstream(fx, dir, &["vendor"], extra)
+}
+
+/// `rollback` of everything `dir` holds, hosted pins restored upstream.
+fn rollback_all(fx: &Fixture, dir: &Path, extra: &[&str]) -> SocketOut {
+    let svc = fx.svc.uri();
+    rollback_upstream(dir, &fx.reg.url(), Some(&svc), extra)
+}
+
+/// `remove <purl>` with hosted pins restored upstream.
+fn remove_upstream(fx: &Fixture, dir: &Path, purl: &str) -> SocketOut {
+    api_upstream(fx, dir, &["remove", purl], &[])
+}
+
 fn vendored_scan(fx: &Fixture, dir: &Path, extra: &[&str]) -> SocketOut {
     let mut args = vec!["--vendor-source", "build"];
     args.extend_from_slice(extra);
-    socket_api(dir, &fx.svc, &["scan", "--mode", "vendored"], &args)
+    api_upstream(fx, dir, &["scan", "--mode", "vendored"], &args)
 }
 
 fn hosted_scan(fx: &Fixture, dir: &Path, extra: &[&str]) -> SocketOut {
@@ -134,33 +179,12 @@ fn assert_pure_hosted(fx: &Fixture, dir: &Path, t: &PatchTarget) {
         !dir.join(format!(".socket/vendor/npm/{}", t.uuid)).exists(),
         "no vendored artifact left"
     );
-    let ledger: Value = serde_json::from_slice(
-        &std::fs::read(dir.join(".socket/vendor/redirect-state.json")).unwrap(),
-    )
-    .unwrap();
-    let before: Value = serde_json::from_slice(&fx.lock_before).unwrap();
-    let id = node_id(&before, &t.name, &t.version);
-    let original = ledger["edits"]
-        .as_array()
-        .unwrap()
-        .iter()
-        .find(|e| {
-            e["kind"] == "redirect_vlt_lock_node"
-                && e["original"]
-                    .as_str()
-                    .is_some_and(|o| o.starts_with(&format!("\"{id}\"")))
-        })
-        .and_then(|e| e["original"].as_str())
-        .unwrap_or_else(|| panic!("a ledger edit for {id}: {ledger:#}"))
-        .to_string();
-    let pristine = node_line(&String::from_utf8_lossy(&fx.lock_before), &id)
-        .unwrap()
-        .trim()
-        .trim_end_matches(',')
-        .to_string();
-    assert_eq!(
-        original, pristine,
-        "the ledger original is the pristine registry line"
+    // v5: no hosted ledger — the lock pin is the whole hosted state (the
+    // vendored takeover restored the upstream entry before pinning, which
+    // the unscoped rollback's byte-exact pristine lock proves).
+    assert!(
+        !dir.join(".socket/vendor/redirect-state.json").exists(),
+        "v5 hosted mode writes no redirect ledger"
     );
 }
 
@@ -181,11 +205,8 @@ fn assert_pure_vendored(dir: &Path, t: &PatchTarget) {
         "no hosted URL left: {text}"
     );
     assert!(
-        !dir.join(".socket/vendor/redirect-state.json").exists()
-            || !std::fs::read_to_string(dir.join(".socket/vendor/redirect-state.json"))
-                .unwrap()
-                .contains(&t.purl()),
-        "the redirect record is gone"
+        !dir.join(".socket/vendor/redirect-state.json").exists(),
+        "no hosted ledger (v5)"
     );
 }
 
@@ -198,7 +219,7 @@ fn assert_fresh(fx: &Fixture, dir: &Path, t: &PatchTarget, want: State, name: &s
 }
 
 fn assert_unscoped_rollback_pristine(fx: &Fixture, dir: &Path, name: &str) {
-    let out = rollback(dir, &[]);
+    let out = rollback_all(fx, dir, &[]);
     assert_eq!(out.code, 0, "{name}: {out}");
     assert_eq!(
         String::from_utf8_lossy(&lock_bytes(dir)),
@@ -239,9 +260,9 @@ async fn two_target_fixture(leg: Leg) -> Fixture {
 // ── 1–2. takeovers ────────────────────────────────────────────────────────
 
 /// Vendored → hosted through `scan --mode hosted` and through `get <uuid>
-/// --mode hosted`: the vendored entry, artifact and wiring go, the ledger
-/// original is the pristine registry line, a fresh checkout is patched;
-/// the unscoped rollback restores the pristine lock.
+/// --mode hosted`: the vendored entry, artifact and wiring go, no hosted
+/// ledger is written, a fresh checkout is patched; the unscoped rollback
+/// restores the pristine lock (the hosted pin back to its upstream entry).
 #[tokio::test(flavor = "multi_thread")]
 #[ignore = "real vlt: SOCKET_PATCH_VLT_E2E_JS"]
 async fn vlt_pinned_matrix_migration_vendored_then_hosted() {
@@ -281,9 +302,9 @@ async fn vlt_pinned_matrix_migration_vendored_then_hosted() {
 }
 
 /// Hosted → vendored through `scan --mode vendored` and through `vendor`
-/// (a staged manifest): the redirect record goes, the lock is vendored,
-/// fresh checkouts are patched, and `vendor --revert` restores the
-/// pristine lock.
+/// (a staged manifest): the takeover restores the hosted pin's upstream
+/// entry first, the lock is vendored, fresh checkouts are patched, and
+/// `vendor --revert` restores the pristine (upstream) lock.
 #[tokio::test(flavor = "multi_thread")]
 #[ignore = "real vlt: SOCKET_PATCH_VLT_E2E_JS"]
 async fn vlt_pinned_matrix_migration_hosted_then_vendored() {
@@ -300,7 +321,7 @@ async fn vlt_pinned_matrix_migration_hosted_then_vendored() {
             vendored_scan(&fx, &dir, &[])
         } else {
             stage_manifest(&dir, &[fx.t()]);
-            vendor_cmd(&dir, &[])
+            vendor_upstream(&fx, &dir, &[])
         };
         assert_eq!(out.code, 0, "{driver}: {out}");
         assert!(
@@ -349,7 +370,7 @@ async fn vlt_pinned_matrix_migration_dry_run_parity() {
     fx.vlt_ok(&fx.proj, &fx.leg.locked_install_args());
     stage_manifest(&fx.proj, &[fx.t()]);
     let before = project_bytes(&fx.proj);
-    let out = vendor_cmd(&fx.proj, &["--dry-run"]);
+    let out = vendor_upstream(&fx, &fx.proj, &["--dry-run"]);
     assert_eq!(out.code, 0, "{out}");
     assert!(
         has_code(&out.json(), "vendor_would_revert_redirect"),
@@ -371,7 +392,7 @@ async fn vlt_pinned_matrix_migration_dry_run_parity() {
         before,
         "the previews write nothing"
     );
-    let out = vendor_cmd(&fx.proj, &[]);
+    let out = vendor_upstream(&fx, &fx.proj, &[]);
     assert_eq!(out.code, 0, "{out}");
     assert!(
         has_code(&out.json(), "vendor_takeover_reverted_redirect"),
@@ -400,9 +421,10 @@ async fn vlt_pinned_matrix_migration_dry_run_parity() {
 
 // ── 4–5. scoped and unscoped unwinds ──────────────────────────────────────
 
-/// Two hosted records; `rollback <purl-a>` and, on a copy, `remove
-/// <purl-a>` unwind only a; a fresh checkout lands a's registry bytes and
-/// b's patch; the unscoped rollback then restores the pristine lock.
+/// Two hosted pins; `rollback <purl-a>` and, on a copy, `remove <purl-a>`
+/// restore only a's upstream entry; a fresh checkout lands a's registry
+/// bytes and b's patch; the unscoped rollback then restores the pristine
+/// lock.
 #[tokio::test(flavor = "multi_thread")]
 #[ignore = "real vlt: SOCKET_PATCH_VLT_E2E_JS"]
 async fn vlt_pinned_matrix_migration_scoped_unwind_one_of_two() {
@@ -417,32 +439,28 @@ async fn vlt_pinned_matrix_migration_scoped_unwind_one_of_two() {
     assert_pinned(&fx.proj, &fx.svc, &a);
     assert_pinned(&fx.proj, &fx.svc, &b);
     let copy = copy_project(&fx, &fx.proj, "remove-copy");
-    let out = rollback(&fx.proj, &[&a.purl()]);
+    let out = rollback_all(&fx, &fx.proj, &[&a.purl()]);
     assert_eq!(out.code, 0, "{out}");
-    let cwd = cwd_args(&copy);
-    let purl = a.purl();
-    let out = socket(
-        &copy,
-        &[
-            "remove",
-            &purl,
-            "--json",
-            "--yes",
-            "--offline",
-            "--cwd",
-            &cwd,
-        ],
-        &[],
+    assert_eq!(
+        out.json()["hosted"]["reverted"],
+        serde_json::json!([a.purl()]),
+        "only a is restored: {out}"
     );
+    let out = remove_upstream(&fx, &copy, &a.purl());
     assert_eq!(out.code, 0, "{out}");
+    let before: Value = serde_json::from_slice(&fx.lock_before).unwrap();
     for dir in [&fx.proj, &copy] {
         assert_not_pinned(dir, &a);
         assert_pinned(dir, &fx.svc, &b);
-        let ledger =
-            std::fs::read_to_string(dir.join(".socket/vendor/redirect-state.json")).unwrap();
+        let lock = read_lock(dir);
+        let id = node_id(&lock, &a.name, &a.version);
+        assert_eq!(
+            lock["nodes"][&id][2], before["nodes"][&id][2],
+            "a's registry integrity is back: {lock:#}"
+        );
         assert!(
-            !ledger.contains(&a.purl()) && ledger.contains(&b.purl()),
-            "{ledger}"
+            !dir.join(".socket/vendor/redirect-state.json").exists(),
+            "no hosted ledger (v5)"
         );
         assert_fresh(&fx, dir, &a, State::Pristine, "a-unwound");
         assert_fresh(&fx, dir, &b, State::Patched, "b-kept");
@@ -464,9 +482,9 @@ async fn vlt_pinned_matrix_migration_rollback_from_mixed() {
     let b = fx.svc.target(MS.0).clone();
     let out = hosted_scan(&fx, &fx.proj, &[]);
     assert_eq!(out.code, 0, "{out}");
-    let out = socket_api(
+    let out = api_upstream(
+        &fx,
         &fx.proj,
-        &fx.svc,
         &["get", &a.uuid, "--mode", "vendored"],
         &["--vendor-source", "build"],
     );
@@ -585,7 +603,7 @@ async fn vlt_pinned_matrix_migration_agent_rollback_after_takeovers() {
             vendored_scan(&fx, &dir, &[])
         };
         assert_eq!(out.code, 0, "{mode}: {out}");
-        let out = rollback(&dir, &[]);
+        let out = rollback_all(&fx, &dir, &[]);
         assert_eq!(out.code, 0, "{mode} rollback: {out}");
         assert_eq!(
             String::from_utf8_lossy(&lock_bytes(&dir)),
@@ -614,29 +632,15 @@ async fn vlt_pinned_matrix_migration_agent_rollback_after_takeovers() {
     assert_eq!(out.code, 0, "{out}");
     let out = hosted_scan(&fx, &dir, &[]);
     assert_eq!(out.code, 0, "{out}");
-    let out = socket_api(
+    let out = api_upstream(
+        &fx,
         &dir,
-        &fx.svc,
         &["get", &b.uuid, "--mode", "vendored"],
         &["--vendor-source", "build"],
     );
     assert_eq!(out.code, 0, "{out}");
     for t in [&a, &b] {
-        let cwd = cwd_args(&dir);
-        let purl = t.purl();
-        let out = socket(
-            &dir,
-            &[
-                "remove",
-                &purl,
-                "--json",
-                "--yes",
-                "--offline",
-                "--cwd",
-                &cwd,
-            ],
-            &[],
-        );
+        let out = remove_upstream(&fx, &dir, &t.purl());
         assert_eq!(out.code, 0, "remove {}: {out}", t.name);
     }
     assert_eq!(
@@ -700,9 +704,9 @@ fn npm_run(dir: &Path, args: &[&str]) -> std::process::Output {
     cmd.output().expect("spawn npm")
 }
 
-/// vlt → npm (`vlt-lock.json` deleted): the rollback refuses the vlt edits
-/// ("vlt-lock.json no longer exists") and keeps the ledger, writing no
-/// lock.
+/// vlt → npm (`vlt-lock.json` deleted): with the lock gone no hosted pin is
+/// left to discover (v5 keeps no ledger), so rollback finds no state and
+/// recreates nothing.
 #[tokio::test(flavor = "multi_thread")]
 #[ignore = "real vlt: SOCKET_PATCH_VLT_E2E_JS"]
 async fn vlt_pinned_matrix_migration_pm_switch_vlt_to_npm() {
@@ -712,19 +716,19 @@ async fn vlt_pinned_matrix_migration_pm_switch_vlt_to_npm() {
     let fx = Fixture::build(leg, Shape::left_pad()).await;
     fx.scan(&[]);
     std::fs::remove_file(fx.proj.join(VLT_LOCK)).unwrap();
-    let ledger = std::fs::read(fx.proj.join(".socket/vendor/redirect-state.json")).unwrap();
-    let out = rollback(&fx.proj, &[]);
-    assert_eq!(out.code, 1, "{out}");
     assert!(
-        out.stdout.contains("vlt-lock.json no longer exists"),
-        "{out}"
+        !fx.proj.join(".socket/vendor/redirect-state.json").exists(),
+        "v5 hosted mode writes no ledger"
     );
-    assert!(!fx.proj.join(VLT_LOCK).exists(), "nothing recreated");
+    let files = package_files(&fx.proj);
+    let out = rollback_all(&fx, &fx.proj, &[]);
     assert_eq!(
-        std::fs::read(fx.proj.join(".socket/vendor/redirect-state.json")).unwrap(),
-        ledger,
-        "the ledger is kept"
+        (out.code, out.json()["error"].as_str()),
+        (1, Some("Manifest not found")),
+        "no lock, no pin, nothing to roll back: {out}"
     );
+    assert!(!fx.proj.join(VLT_LOCK).exists(), "nothing recreated");
+    assert_eq!(package_files(&fx.proj), files, "and nothing written");
     fx.leg.ran();
 }
 
@@ -772,9 +776,9 @@ fn upgrade() -> Option<Toolchain> {
 }
 
 /// rc.14 hosted, then the upgraded vlt refuses the v0 lock; the lock is
-/// re-created, the rescan re-pins under the tilde DepID (superseding the
-/// recorded legacy edit), rollback is clean and VEX attests after the
-/// rescan.
+/// re-created, the rescan re-pins under the tilde DepID (no ledger to
+/// supersede), rollback restores the re-created lock byte-for-byte and VEX
+/// attests after the rescan.
 #[tokio::test(flavor = "multi_thread")]
 #[ignore = "real vlt: SOCKET_PATCH_VLT_E2E_JS"]
 async fn vlt_pinned_matrix_migration_upgrade_hosted() {
@@ -810,17 +814,15 @@ async fn vlt_pinned_matrix_migration_upgrade_hosted() {
         fx.vex_attested(fx.t()),
         "attested after the rescan: {doc:#}"
     );
-    let ledger =
-        std::fs::read_to_string(fx.proj.join(".socket/vendor/redirect-state.json")).unwrap();
     assert!(
-        !ledger.contains('·'),
-        "the legacy edit is superseded: {ledger}"
+        !fx.proj.join(".socket/vendor/redirect-state.json").exists(),
+        "v5 hosted mode writes no ledger"
     );
-    let out = rollback(&fx.proj, &[]);
+    let out = rollback_all(&fx, &fx.proj, &[]);
     assert_eq!(out.code, 0, "{out}");
     assert_eq!(
-        lock_bytes(&fx.proj),
-        relocked,
+        String::from_utf8_lossy(&lock_bytes(&fx.proj)),
+        String::from_utf8_lossy(&relocked),
         "rollback to the re-created lock"
     );
     fx.leg.ran();
diff --git a/crates/socket-patch-cli/tests/npm_e2e_common/manifestless.rs b/crates/socket-patch-cli/tests/npm_e2e_common/manifestless.rs
index 5412bb53..6827c560 100644
--- a/crates/socket-patch-cli/tests/npm_e2e_common/manifestless.rs
+++ b/crates/socket-patch-cli/tests/npm_e2e_common/manifestless.rs
@@ -16,8 +16,9 @@
 use std::path::{Path, PathBuf};
 
 use crate::vex_e2e_common::{
-    assert_absent, assert_attested, assert_not_attested, run_vex, seed_legacy_manifest,
-    statements_for, strip_ledgers, strip_manifest, Marker, PatchApi, VexOutcome, VexRun, VexVia,
+    assert_absent, assert_attested, assert_no_hosted_ledger, assert_not_attested, run_vex,
+    seed_legacy_manifest, statements_for, strip_ledgers, strip_manifest, Marker, PatchApi,
+    VexOutcome, VexRun, VexVia,
 };
 
 /// npm >= 12 needs `allow-remote=all` for a hosted redirect's lock (the
@@ -77,6 +78,8 @@ pub struct ManifestlessCase<'a> {
     /// the revert cell.
     pub registry_locks: Vec<(&'a str, Vec<u8>)>,
     /// Also drive embedded `apply --vex` / `vendor --vex` (manifest-less).
+    /// For a hosted flow `vendor` is skipped: over hosted pins it EJECTS
+    /// the project into `.socket/vendor/` (v5) instead of attesting it.
     pub embedded: &'a [VexVia],
 }
 
@@ -109,7 +112,10 @@ fn run(case: &ManifestlessCase<'_>, run: VexRun) -> VexOutcome {
     run_vex(&crate::vex_e2e_common::binary(), case.project, &run)
 }
 
-/// The manifest-less cells every npm hosted / vendored flow ends in:
+/// The manifest-less cells every npm hosted / vendored flow ends in. The
+/// flow's own state is checked first: a vendored flow wrote the vendor
+/// ledger; a hosted flow wrote NO ledger (v5 hosted state is the lockfile
+/// alone).
 ///
 /// 0. `legacy-manifest` (vendored only): the `.socket/manifest.json` a
 ///    pre-5.0 vendored run left beside its ledger (the ledger's embedded
@@ -117,31 +123,40 @@ fn run(case: &ManifestlessCase<'_>, run: VexRun) -> VexOutcome {
 /// 1. `manifest-deleted`: `.socket/manifest.json` removed (ledgers kept) →
 ///    standalone `vex` attests the purl with the right marker + vuln ids
 ///    (and every `embedded` command does too);
-/// 2. `ledgers-deleted`: both ledgers removed too → still attested, from
-///    lockfile discovery + the patch API (≥ 1 view request);
+/// 2. `ledgers-deleted`: the vendor ledger removed too → still attested,
+///    from lockfile discovery + the patch API (≥ 1 view request);
 /// 3. `offline`: no ledgers, `--offline` → `record_unavailable`, ZERO
 ///    requests;
 /// 4. `reverted`: ledgers restored, locks reverted to their registry bytes
-///    → NOT attested (default and `--no-verify`); with the ledgers gone as
-///    well nothing names the patch at all.
+///    → NOT attested (default and `--no-verify`): vendored → the stale
+///    ledger entry is `vendor_unwired`; hosted → nothing names the patch at
+///    all (the lock was the only hosted state). With the ledgers gone as
+///    well nothing names the patch either way.
 ///
 /// Leaves the project reverted (locks at registry bytes, no ledgers).
 pub fn manifestless_vex_matrix(case: &ManifestlessCase<'_>) -> MatrixReport {
     let mut report = MatrixReport::default();
     let label = &case.label;
     let p = case.project;
-    let ledger_paths = [
-        socket_patch_core::vendor::VENDOR_STATE_REL,
-        socket_patch_core::patch::redirect::REDIRECT_STATE_REL,
-    ];
-    let ledgers: Vec<(&str, Vec<u8>)> = ledger_paths
+    let hosted = case.marker != Marker::Vendored;
+    let ledgers: Vec<(&str, Vec<u8>)> = [socket_patch_core::vendor::VENDOR_STATE_REL]
         .iter()
         .filter_map(|rel| std::fs::read(p.join(rel)).ok().map(|b| (*rel, b)))
         .collect();
-    assert!(
-        !ledgers.is_empty(),
-        "[{label}] the flow must have written a ledger"
-    );
+    if hosted {
+        assert_no_hosted_ledger(p, &format!("[{label}]"));
+    } else {
+        assert!(
+            !ledgers.is_empty(),
+            "[{label}] the vendored flow must have written its ledger"
+        );
+    }
+    let embedded: Vec<VexVia> = case
+        .embedded
+        .iter()
+        .copied()
+        .filter(|via| !(hosted && *via == VexVia::Vendor))
+        .collect();
 
     // 0. a LEGACY vendored checkout: vendored mode is manifest-free now,
     //    but a pre-5.0 run left the record in `.socket/manifest.json`
@@ -162,7 +177,7 @@ pub fn manifestless_vex_matrix(case: &ManifestlessCase<'_>) -> MatrixReport {
     let out = run(case, VexRun::online(case.api));
     assert_eq!(out.code, Some(0), "[{label}] manifest-deleted:\n{out}");
     assert_attested(out.doc(), case.purl, case.uuid, case.marker, case.vulns);
-    for via in case.embedded {
+    for via in &embedded {
         let out = run(case, VexRun::online(case.api).via(*via));
         assert_eq!(out.code, Some(0), "[{label}] embedded {via:?}:\n{out}");
         assert_attested(out.doc(), case.purl, case.uuid, case.marker, case.vulns);
@@ -188,7 +203,7 @@ pub fn manifestless_vex_matrix(case: &ManifestlessCase<'_>) -> MatrixReport {
         "[{label}] the record must come from the patch API: {:?}",
         case.api.requests()
     );
-    for via in case.embedded {
+    for via in &embedded {
         let out = run(case, VexRun::online(case.api).via(*via));
         assert_eq!(
             out.code,
@@ -221,10 +236,6 @@ pub fn manifestless_vex_matrix(case: &ManifestlessCase<'_>) -> MatrixReport {
     for (lock, bytes) in &case.registry_locks {
         std::fs::write(p.join(lock), bytes).unwrap();
     }
-    let unwired = match case.marker {
-        Marker::Vendored => "vendor_unwired",
-        _ => "redirect_unwired",
-    };
     for no_verify in [false, true] {
         let mut r = VexRun::online(case.api);
         r.no_verify = no_verify;
@@ -235,7 +246,14 @@ pub fn manifestless_vex_matrix(case: &ManifestlessCase<'_>) -> MatrixReport {
             "[{label}] reverted (no_verify={no_verify}):\n{out}"
         );
         assert_absent(out.doc.as_ref(), case.purl);
-        assert_not_attested(&out.envelope, case.purl, unwired);
+        if hosted {
+            assert_eq!(
+                out.envelope["error"]["code"], "manifest_not_found",
+                "[{label}] reverted hosted lock: no hosted state is left:\n{out}"
+            );
+        } else {
+            assert_not_attested(&out.envelope, case.purl, "vendor_unwired");
+        }
     }
     strip_ledgers(p);
     let out = run(case, VexRun::online(case.api));
diff --git a/crates/socket-patch-cli/tests/redirect_npm_allow_remote.rs b/crates/socket-patch-cli/tests/redirect_npm_allow_remote.rs
index 4697de93..f8b7cfad 100644
--- a/crates/socket-patch-cli/tests/redirect_npm_allow_remote.rs
+++ b/crates/socket-patch-cli/tests/redirect_npm_allow_remote.rs
@@ -11,14 +11,21 @@
 //! The hosted run therefore AUTO-CONFIGURES it (the npm twin of the pnpm
 //! `trustLockfile` auto-config): it ensures `allow-remote=all` in the project
 //! `.npmrc` (created, or one line appended with every other byte kept),
-//! records the edit in the redirect ledger (`redirect_npmrc_allow_remote`)
-//! so `rollback` removes exactly what it added, respects an explicit other
-//! user value, honors `--no-npm-allow-remote-config` /
+//! respects an explicit other user value, honors `--no-npm-allow-remote-config` /
 //! `SOCKET_NO_NPM_ALLOW_REMOTE_CONFIG` and `--dry-run`, and ALWAYS warns
 //! (`redirect_npm_allow_remote`) with the whole-tree tradeoff — while a
 //! project whose npm-family redirect is not in an npm lock stays quiet.
 //!
-//! Hermetic: wiremock API, the built binary, no npm needed.
+//! v5 hosted mode keeps no ledger, so nothing records WHICH `.npmrc` bytes
+//! the run wrote. When `rollback` / `remove` restore the last npm-lock pin
+//! to its upstream registry entry, the `.npmrc` is deleted only when it is
+//! still byte-identical to the file a hosted run creates; any other file
+//! (the user's, or one hosted mode appended to) is kept as-is, and a line
+//! `allow-remote=all` left in it is reported (`npm_allow_remote_left`) for
+//! the user to remove if nothing else needs it.
+//!
+//! Hermetic: wiremock API + wiremock npm registry (`SOCKET_NPM_REGISTRY`,
+//! for the upstream restore), the built binary, no npm needed.
 
 use std::path::Path;
 
@@ -37,6 +44,7 @@ const UUID: &str = "11111111-1111-4111-8111-111111111111";
 const PATCHED_SHA512: &str = "sha512-PATCHEDpatchedPATCHEDpatched0123456789==";
 const UPSTREAM_SHA512: &str = "sha512-UPSTREAMupstream==";
 const CODE: &str = "redirect_npm_allow_remote";
+const LEFT: &str = "npm_allow_remote_left";
 
 fn hosted_url() -> String {
     format!(
@@ -92,6 +100,18 @@ async fn mock_api(server: &MockServer) {
         })))
         .mount(server)
         .await;
+    // The npm registry's version document (the upstream restore's source).
+    Mock::given(method("GET"))
+        .and(path(format!("/npm-registry/{NAME}/{VERSION}")))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+            "name": NAME, "version": VERSION,
+            "dist": {
+                "tarball": format!("https://registry.npmjs.org/{NAME}/-/{NAME}-{VERSION}.tgz"),
+                "integrity": UPSTREAM_SHA512,
+            }
+        })))
+        .mount(server)
+        .await;
     Mock::given(method("GET"))
         .and(path(format!("/v0/orgs/{ORG}/patches/view/{UUID}")))
         .respond_with(ResponseTemplate::new(200).set_body_json(json!({
@@ -225,44 +245,52 @@ fn allow_remote_warning(doc: &Value) -> Option<&str> {
         .and_then(|w| w["detail"].as_str())
 }
 
-/// The recorded `.npmrc` ledger edits (`(action, key, new)`).
-fn npmrc_edits(root: &Path) -> Vec<(String, String, String)> {
-    let Ok(text) = std::fs::read_to_string(root.join(".socket/vendor/redirect-state.json")) else {
-        return Vec::new();
-    };
-    let ledger: Value = serde_json::from_str(&text).unwrap();
-    ledger["edits"]
+/// v5 hosted mode records the `.npmrc` edit nowhere: no ledger is written.
+fn assert_no_ledger(root: &Path) {
+    assert!(
+        !root.join(".socket/vendor/redirect-state.json").exists(),
+        "hosted mode keeps no ledger"
+    );
+}
+
+/// The run-level warning `code` of a rollback/remove envelope, if any.
+fn run_warning<'a>(doc: &'a Value, code: &str) -> Option<&'a str> {
+    doc["warnings"]
         .as_array()
         .into_iter()
         .flatten()
-        .filter(|e| e["kind"] == "redirect_npmrc_allow_remote")
-        .map(|e| {
-            assert_eq!(e["path"], ".npmrc", "{e}");
-            (
-                e["action"].as_str().unwrap().to_string(),
-                e["key"].as_str().unwrap().to_string(),
-                e["new"].as_str().unwrap().to_string(),
-            )
-        })
-        .collect()
+        .find(|w| w["code"] == code)
+        .and_then(|w| w["detail"].as_str())
 }
 
-fn rollback(cwd: &Path, extra: &[&str]) -> (i32, Value) {
+/// The args + env every hosted rollback/remove needs here: the mock patch
+/// host recognized as hosted, and the npm registry pointed at the mock.
+fn hosted_unwind_env(server: &MockServer) -> (String, [&'static str; 2]) {
+    (
+        format!("{}/npm-registry", server.uri()),
+        ["--patch-server-url", "http://patch.test"],
+    )
+}
+
+fn rollback(cwd: &Path, server: &MockServer, extra: &[&str]) -> (i32, Value) {
     let cwd_s = cwd.to_str().unwrap().to_string();
+    let (registry, flags) = hosted_unwind_env(server);
     let mut args = vec!["rollback", "--json", "--cwd", &cwd_s];
+    args.extend_from_slice(&flags);
     args.extend_from_slice(extra);
-    let (code, stdout, stderr) = run_isolated(cwd, &args, &[]);
+    let (code, stdout, stderr) =
+        run_isolated(cwd, &args, &[("SOCKET_NPM_REGISTRY", registry.as_str())]);
     let doc = serde_json::from_str(&stdout)
         .unwrap_or_else(|e| panic!("not JSON ({e}):\n{stdout}\nstderr:\n{stderr}"));
     (code, doc)
 }
 
 /// A package-lock.json redirect CREATES `.npmrc` with exactly
-/// `allow-remote=all`, records a `created` ledger edit, and warns (JSON +
-/// human) with the npm 12 failure, the whole-tree tradeoff and the opt-out;
-/// the idempotent re-run records nothing new and still warns (the
-/// already-set variant); `rollback` deletes the file it created and
-/// restores the lock.
+/// `allow-remote=all` (no ledger records it), and warns (JSON + human) with
+/// the npm 12 failure, the whole-tree tradeoff and the opt-out; the
+/// idempotent re-run changes nothing and still warns (the already-set
+/// variant); `rollback` restores the lock to its upstream entry and deletes
+/// the still-pristine `.npmrc` the run created.
 #[tokio::test]
 async fn package_lock_redirect_writes_npmrc_warns_and_rollback_removes_it() {
     let server = MockServer::start().await;
@@ -290,10 +318,7 @@ async fn package_lock_redirect_writes_npmrc_warns_and_rollback_removes_it() {
         std::fs::read_to_string(tmp.path().join(".npmrc")).unwrap(),
         "allow-remote=all\n"
     );
-    assert_eq!(
-        npmrc_edits(tmp.path()),
-        vec![("created".into(), "allow-remote".into(), "all".into())]
-    );
+    assert_no_ledger(tmp.path());
     // The `.npmrc` write rides the hosted run's lock window: the lock is
     // released (unlinked) when the run ends.
     assert!(
@@ -309,7 +334,12 @@ async fn package_lock_redirect_writes_npmrc_warns_and_rollback_removes_it() {
         detail.contains("already sets `allow-remote=all`"),
         "{detail}"
     );
-    assert_eq!(npmrc_edits(tmp.path()).len(), 1, "no duplicate ledger edit");
+    assert_eq!(
+        std::fs::read_to_string(tmp.path().join(".npmrc")).unwrap(),
+        "allow-remote=all\n",
+        "no duplicate line"
+    );
+    assert_no_ledger(tmp.path());
 
     // Human output: the `Warning (<code>): …` line on stderr; --silent mutes it.
     let (code, _, stderr) = scan_hosted(tmp.path(), &server.uri(), &[]);
@@ -323,7 +353,7 @@ async fn package_lock_redirect_writes_npmrc_warns_and_rollback_removes_it() {
     assert!(!stderr.contains(CODE), "--silent is errors only: {stderr}");
 
     // Rollback: the created .npmrc is deleted with the lock redirect.
-    let (code, doc) = rollback(tmp.path(), &[]);
+    let (code, doc) = rollback(tmp.path(), &server, &[]);
     assert_eq!(code, 0, "{doc:#}");
     assert!(!tmp.path().join(".npmrc").exists(), "{doc:#}");
     // (The npm writer normalizes the trailing newline; compare the JSON.)
@@ -332,10 +362,7 @@ async fn package_lock_redirect_writes_npmrc_warns_and_rollback_removes_it() {
         json(&std::fs::read(tmp.path().join("package-lock.json")).unwrap()),
         json(&pristine)
     );
-    assert!(!tmp
-        .path()
-        .join(".socket/vendor/redirect-state.json")
-        .exists());
+    assert!(run_warning(&doc, LEFT).is_none(), "{doc:#}");
     assert!(
         !tmp.path().join(".socket").exists(),
         "a fully unwound hosted project keeps no .socket/ residue: {doc:#}"
@@ -343,9 +370,11 @@ async fn package_lock_redirect_writes_npmrc_warns_and_rollback_removes_it() {
 }
 
 /// An existing `.npmrc` (BOM + CRLF, no allow-remote) gets exactly one
-/// appended line in its own line ending; a user edit made AFTER the scan
-/// survives rollback, which removes only the appended line. The shrinkwrap
-/// flavor is configured the same way.
+/// appended line in its own line ending. With no ledger recording the
+/// append, rollback never edits a file the user owns: the `.npmrc` (and a
+/// user edit made AFTER the scan) survives byte-for-byte, and the leftover
+/// `allow-remote=all` line is reported (`npm_allow_remote_left`). The
+/// shrinkwrap flavor is configured the same way.
 #[tokio::test]
 async fn existing_npmrc_gets_one_line_and_rollback_keeps_user_edits() {
     let server = MockServer::start().await;
@@ -366,22 +395,24 @@ async fn existing_npmrc_gets_one_line_and_rollback_keeps_user_edits() {
         std::fs::read_to_string(tmp.path().join(".npmrc")).unwrap(),
         format!("{user}allow-remote=all\r\n")
     );
-    assert_eq!(
-        npmrc_edits(tmp.path()),
-        vec![("added".into(), "allow-remote".into(), "all".into())]
-    );
+    assert_no_ledger(tmp.path());
 
     // The user keeps editing the file after the scan.
     let mut live = std::fs::read_to_string(tmp.path().join(".npmrc")).unwrap();
     live.push_str("fund=false\r\n");
     std::fs::write(tmp.path().join(".npmrc"), &live).unwrap();
 
-    let (code, doc) = rollback(tmp.path(), &[]);
+    let (code, doc) = rollback(tmp.path(), &server, &[]);
     assert_eq!(code, 0, "{doc:#}");
+    assert_eq!(doc["hosted"]["reverted"], json!([PURL]), "{doc:#}");
     assert_eq!(
         std::fs::read_to_string(tmp.path().join(".npmrc")).unwrap(),
-        format!("{user}fund=false\r\n"),
-        "only the appended line is removed"
+        live,
+        "a user-owned .npmrc is never edited by the restore"
+    );
+    assert!(
+        run_warning(&doc, LEFT).is_some_and(|d| d.contains("allow-remote=all")),
+        "the leftover line is reported: {doc:#}"
     );
     // The reversal prunes the emptied `.socket/` — never the user's
     // `.npmrc`, which lives outside it and keeps their settings.
@@ -391,8 +422,8 @@ async fn existing_npmrc_gets_one_line_and_rollback_keeps_user_edits() {
     );
 }
 
-/// An explicit other value (`none` / `root`) is RESPECTED — never rewritten,
-/// no ledger edit — and named with the manual remedy; an `allow_remote`
+/// An explicit other value (`none` / `root`) is RESPECTED — never rewritten
+/// — and named with the manual remedy; an `allow_remote`
 /// spelling npm does not honor in `.npmrc` is left alone and the real key
 /// appended; an existing `allow-remote=all` is kept (already-set warning).
 #[tokio::test]
@@ -418,7 +449,7 @@ async fn explicit_values_are_respected_and_unhonored_spellings_are_not_trusted()
             npmrc,
             "an explicit user setting is never rewritten"
         );
-        assert!(npmrc_edits(tmp.path()).is_empty());
+        assert_no_ledger(tmp.path());
     }
 
     let tmp = tempfile::tempdir().unwrap();
@@ -440,9 +471,9 @@ async fn explicit_values_are_respected_and_unhonored_spellings_are_not_trusted()
     assert!(
         allow_remote_warning(&doc).is_some_and(|d| d.contains("already sets `allow-remote=all`"))
     );
-    assert!(npmrc_edits(tmp.path()).is_empty());
+    assert_no_ledger(tmp.path());
     // A user-owned setting survives rollback untouched.
-    let (code, doc) = rollback(tmp.path(), &[]);
+    let (code, doc) = rollback(tmp.path(), &server, &[]);
     assert_eq!(code, 0, "{doc:#}");
     assert_eq!(
         std::fs::read_to_string(tmp.path().join(".npmrc")).unwrap(),
@@ -498,7 +529,7 @@ async fn opt_out_dry_run_and_unredirected_projects() {
             !tmp.path().join(".npmrc").exists(),
             "opt-out writes nothing"
         );
-        assert!(npmrc_edits(tmp.path()).is_empty());
+        assert_no_ledger(tmp.path());
     }
 
     let tmp = tempfile::tempdir().unwrap();
@@ -555,7 +586,7 @@ async fn symlinked_npmrc_is_left_alone() {
         std::fs::read_to_string(tmp.path().join("shared.npmrc")).unwrap(),
         "fund=false\n"
     );
-    assert!(npmrc_edits(tmp.path()).is_empty());
+    assert_no_ledger(tmp.path());
 }
 
 /// Review findings, end to end:
@@ -565,8 +596,9 @@ async fn symlinked_npmrc_is_left_alone() {
 ///   below it is respected (writing above it would not have taken effect);
 /// - a CR-only file without the key is never spliced (manual remedy);
 /// - a section-scoped `allow-remote=all` (inert to npm) gets our top-level
-///   line, and rollback removes exactly ours instead of refusing the two
-///   copies as ambiguous.
+///   line; rollback restores the lock without editing the user's file (the
+///   section copy never makes the restore ambiguous or refused) and reports
+///   the leftover line.
 #[tokio::test]
 async fn npm_ini_line_and_section_rules_are_honored() {
     let server = MockServer::start().await;
@@ -591,7 +623,7 @@ async fn npm_ini_line_and_section_rules_are_honored() {
             npmrc,
             "an explicit value is never flipped"
         );
-        assert!(npmrc_edits(tmp.path()).is_empty());
+        assert_no_ledger(tmp.path());
     }
 
     let tmp = tempfile::tempdir().unwrap();
@@ -609,7 +641,7 @@ async fn npm_ini_line_and_section_rules_are_honored() {
         std::fs::read_to_string(tmp.path().join(".npmrc")).unwrap(),
         cr_only
     );
-    assert!(npmrc_edits(tmp.path()).is_empty());
+    assert_no_ledger(tmp.path());
 
     let tmp = tempfile::tempdir().unwrap();
     write_npm_project(tmp.path(), "package-lock.json");
@@ -621,22 +653,24 @@ async fn npm_ini_line_and_section_rules_are_honored() {
         std::fs::read_to_string(tmp.path().join(".npmrc")).unwrap(),
         format!("allow-remote=all\n{sectioned}")
     );
-    let (code, doc) = rollback(tmp.path(), &[]);
+    let (code, doc) = rollback(tmp.path(), &server, &[]);
     assert_eq!(
         code, 0,
-        "the section copy must not make the unwind ambiguous: {doc:#}"
+        "the section copy must not make the restore ambiguous: {doc:#}"
     );
     assert_eq!(
         std::fs::read_to_string(tmp.path().join(".npmrc")).unwrap(),
-        sectioned
+        format!("allow-remote=all\n{sectioned}"),
+        "a user-owned .npmrc is never edited by the restore"
     );
+    assert!(run_warning(&doc, LEFT).is_some(), "{doc:#}");
 }
 
 /// Review finding: only the project `.npmrc` was consulted. An explicit
 /// `allow-remote` in the env (which beats the project file) or in the
 /// user / global npm config (a machine / org policy a committed project
-/// line would silently override) is now respected — nothing written, no
-/// ledger edit — and the warning names the source and the remedy.
+/// line would silently override) is now respected — nothing written — and
+/// the warning names the source and the remedy.
 #[tokio::test]
 async fn outer_npm_config_layers_are_respected() {
     let server = MockServer::start().await;
@@ -672,7 +706,7 @@ async fn outer_npm_config_layers_are_respected() {
         !tmp.path().join(".npmrc").exists(),
         "no project override written"
     );
-    assert!(npmrc_edits(tmp.path()).is_empty());
+    assert_no_ledger(tmp.path());
 
     // global config under <prefix>/etc/npmrc, the prefix relocated the
     // way npm allows from the env (`npm_config_prefix` — it outranks the
@@ -748,10 +782,11 @@ async fn outer_npm_config_layers_are_respected() {
     );
 }
 
-/// Review finding: `remove` dropped the hosted leg's warnings, so a
-/// redirect-created `.npmrc` the user had since added to was rewritten
-/// with no `redirect_npmrc_allow_remote_modified` (CLI_CONTRACT promises
-/// it in rollback/remove `warnings[]`). Human stderr and JSON both carry it.
+/// Review finding: `remove` dropped the hosted leg's warnings. A
+/// redirect-created `.npmrc` the user has since added to is no longer the
+/// scaffold, so the restore keeps it byte-for-byte and warns that the
+/// `allow-remote=all` line is left (`npm_allow_remote_left`, in
+/// rollback/remove `warnings[]`). Human stderr and JSON both carry it.
 #[tokio::test]
 async fn remove_surfaces_the_npmrc_modified_warning() {
     let server = MockServer::start().await;
@@ -764,11 +799,17 @@ async fn remove_surfaces_the_npmrc_modified_warning() {
         std::fs::write(tmp.path().join(".npmrc"), "allow-remote=all\nfund=false\n").unwrap();
 
         let cwd_s = tmp.path().to_str().unwrap().to_string();
+        let (registry, flags) = hosted_unwind_env(&server);
         let mut args = vec!["remove", PURL, "--yes", "--cwd", &cwd_s];
+        args.extend_from_slice(&flags);
         if json {
             args.push("--json");
         }
-        let (code, stdout, stderr) = run_isolated(tmp.path(), &args, &[]);
+        let (code, stdout, stderr) = run_isolated(
+            tmp.path(),
+            &args,
+            &[("SOCKET_NPM_REGISTRY", registry.as_str())],
+        );
         assert_eq!(code, 0, "{stdout}\n{stderr}");
         if json {
             let doc: Value = serde_json::from_str(&stdout)
@@ -778,7 +819,7 @@ async fn remove_surfaces_the_npmrc_modified_warning() {
                     .as_array()
                     .into_iter()
                     .flatten()
-                    .any(|w| w["code"] == "redirect_npmrc_allow_remote_modified"),
+                    .any(|w| w["code"] == LEFT),
                 "{doc:#}"
             );
             assert!(
@@ -786,14 +827,18 @@ async fn remove_surfaces_the_npmrc_modified_warning() {
                 "--json keeps stderr quiet: {stderr}"
             );
         } else {
-            assert!(
-                stderr.contains("Warning (redirect_npmrc_allow_remote_modified): "),
-                "{stderr}"
-            );
+            assert!(stderr.contains(&format!("Warning ({LEFT}): ")), "{stderr}");
         }
         assert_eq!(
             std::fs::read_to_string(tmp.path().join(".npmrc")).unwrap(),
-            "fund=false\n"
+            "allow-remote=all\nfund=false\n",
+            "a modified .npmrc is kept byte-for-byte"
+        );
+        assert!(
+            !std::fs::read_to_string(tmp.path().join("package-lock.json"))
+                .unwrap()
+                .contains("patch.test"),
+            "the lock is back on the registry"
         );
     }
 }
diff --git a/crates/socket-patch-cli/tests/remove_duality_invariants.rs b/crates/socket-patch-cli/tests/remove_duality_invariants.rs
index ef7ecdf2..8cb2efb1 100644
--- a/crates/socket-patch-cli/tests/remove_duality_invariants.rs
+++ b/crates/socket-patch-cli/tests/remove_duality_invariants.rs
@@ -473,6 +473,10 @@ fn default_remove_sweeps_archives_too() {
 
 // ---------------------------------------------------------------------------
 // 4. Hosted-redirect leg
+//
+// v5 hosted state is the lockfile pin itself (no ledger): removing a hosted
+// patch restores the pin's DEFAULT UPSTREAM registry entry, re-resolved
+// from a mock npm registry (`SOCKET_NPM_REGISTRY`).
 // ---------------------------------------------------------------------------
 
 const NPM_PURL: &str = "pkg:npm/left-pad@1.3.0";
@@ -504,27 +508,64 @@ fn redirected_lock_text() -> String {
     )
 }
 
-/// One hand-written camelCase PatchRecord body (the shared record shape of
-/// the manifest and the redirect ledger).
-fn record_json(uuid: &str, description: &str) -> String {
-    format!(
-        r#"{{
-      "uuid": "{uuid}",
-      "exportedAt": "2024-01-01T00:00:00Z",
-      "files": {{}},
-      "vulnerabilities": {{}},
-      "description": "{description}",
-      "license": "MIT",
-      "tier": "free"
-    }}"#
-    )
+/// The exact bytes the upstream restore writes for [`redirected_lock_text`]:
+/// parse the fixture, put the registry's resolved/integrity back, serialize
+/// with the workspace's preserve_order serde_json + trailing newline. This
+/// pins the WHOLE file, not just the two fields.
+fn upstream_lock_text() -> String {
+    let mut expected: serde_json::Value = serde_json::from_str(&redirected_lock_text()).unwrap();
+    let entry = expected["packages"]["node_modules/left-pad"]
+        .as_object_mut()
+        .expect("lock entry object");
+    entry.insert("resolved".into(), serde_json::json!(ORIG_RESOLVED));
+    entry.insert("integrity".into(), serde_json::json!(ORIG_INTEGRITY));
+    format!("{}\n", serde_json::to_string_pretty(&expected).unwrap())
+}
+
+/// A mock npm registry serving left-pad@1.3.0's version document `dist`.
+/// wiremock serves from its own thread; the runtime only owns the server.
+struct NpmRegistry {
+    server: wiremock::MockServer,
+    _rt: tokio::runtime::Runtime,
+}
+
+impl NpmRegistry {
+    fn start(dist: serde_json::Value) -> Self {
+        use wiremock::matchers::{method, path};
+        use wiremock::{Mock, MockServer, ResponseTemplate};
+        let rt = tokio::runtime::Runtime::new().expect("tokio runtime");
+        let server = rt.block_on(async {
+            let server = MockServer::start().await;
+            Mock::given(method("GET"))
+                .and(path("/npm/left-pad/1.3.0"))
+                .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+                    "name": "left-pad",
+                    "version": "1.3.0",
+                    "dist": dist,
+                })))
+                .mount(&server)
+                .await;
+            server
+        });
+        Self { server, _rt: rt }
+    }
+
+    /// The registry's real entry for the fixture package.
+    fn upstream() -> Self {
+        Self::start(serde_json::json!({ "tarball": ORIG_RESOLVED, "integrity": ORIG_INTEGRITY }))
+    }
+
+    fn env(&self) -> String {
+        format!("{}/npm", self.server.uri())
+    }
 }
 
-/// Redirect ledger (real `RedirectState` schema: version/mode/edits/records)
-/// with ONE npm record and its recorded `redirect_npm_lock_entry` edit
-/// matching [`redirected_lock_text`].
-fn npm_redirect_ledger_text() -> String {
-    let record = record_json(NPM_UUID, "synthetic hosted npm patch");
+/// A PRE-V5 redirect ledger (v5 never writes one): one npm record and its
+/// recorded `redirect_npm_lock_entry` edit matching
+/// [`redirected_lock_text`], its recorded original deliberately DIFFERENT
+/// from the registry's entry (a replay would write it; the restore must
+/// not).
+fn legacy_npm_redirect_ledger_text() -> String {
     format!(
         r#"{{
   "version": 1,
@@ -535,12 +576,20 @@ fn npm_redirect_ledger_text() -> String {
       "kind": "redirect_npm_lock_entry",
       "action": "rewritten",
       "key": "node_modules/left-pad",
-      "original": {{ "resolved": "{ORIG_RESOLVED}", "integrity": "{ORIG_INTEGRITY}" }},
+      "original": {{ "resolved": "{ORIG_RESOLVED}", "integrity": "sha512-LEDGERledger==" }},
       "new": {{ "resolved": "{HOSTED_RESOLVED}", "integrity": "{HOSTED_INTEGRITY}" }}
     }}
   ],
   "records": {{
-    "{NPM_PURL}": {record}
+    "{NPM_PURL}": {{
+      "uuid": "{NPM_UUID}",
+      "exportedAt": "2024-01-01T00:00:00Z",
+      "files": {{}},
+      "vulnerabilities": {{}},
+      "description": "synthetic hosted npm patch",
+      "license": "MIT",
+      "tier": "free"
+    }}
   }}
 }}"#
     )
@@ -555,27 +604,30 @@ fn write_redirect_ledger_text(root: &Path, text: &str) -> PathBuf {
 }
 
 /// Hosted-only remove with no manifest at all (a hosted-only project's
-/// per-purl exit path): the redirect is unwound — lock restored to the
-/// pre-redirect entry, emptied ledger deleted — and the unwind IS the
-/// removal, so the `hosted_reverted` event counts toward
-/// `summary.removed` (the detached-vendored convention).
+/// per-purl exit path): the lockfile pin is restored to the upstream
+/// registry entry, and the restore IS the removal, so the
+/// `hosted_reverted` event counts toward `summary.removed` (the
+/// detached-vendored convention). No ledger is involved, and no `.socket/`
+/// state is left behind.
 #[test]
-fn hosted_only_remove_without_manifest_unwinds_redirect() {
+fn hosted_only_remove_without_manifest_restores_upstream() {
     let tmp = tempfile::tempdir().expect("tempdir");
-    let lock_text = redirected_lock_text();
     let lock_path = tmp.path().join("package-lock.json");
-    std::fs::write(&lock_path, &lock_text).unwrap();
-    let ledger_path = write_redirect_ledger_text(tmp.path(), &npm_redirect_ledger_text());
+    std::fs::write(&lock_path, redirected_lock_text()).unwrap();
+    let registry = NpmRegistry::upstream();
 
-    let (code, stdout, stderr) =
-        run_remove(tmp.path(), &[NPM_PURL, "--json", "--yes", "--offline"], &[]);
+    let (code, stdout, stderr) = run_remove(
+        tmp.path(),
+        &[NPM_PURL, "--json", "--yes"],
+        &[("SOCKET_NPM_REGISTRY", &registry.env())],
+    );
     assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
     let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
     assert_eq!(v["command"], "remove");
     assert_eq!(v["status"], "success", "envelope={v}");
     assert_eq!(
         v["summary"]["removed"], 1,
-        "the hosted unwind IS the removal on this path; envelope={v}"
+        "the hosted restore IS the removal on this path; envelope={v}"
     );
     let events = v["events"].as_array().expect("events array");
     assert!(
@@ -584,48 +636,37 @@ fn hosted_only_remove_without_manifest_unwinds_redirect() {
             && e["errorCode"] == "hosted_reverted"),
         "removed/hosted_reverted event expected; envelope={v}"
     );
-
-    // The lock holds exactly the pre-redirect entry again (same whole-file
-    // derivation as the manifest-path twin below).
-    let mut expected: serde_json::Value = serde_json::from_str(&lock_text).unwrap();
-    let entry = expected["packages"]["node_modules/left-pad"]
-        .as_object_mut()
-        .expect("lock entry object");
-    entry.insert("resolved".into(), serde_json::json!(ORIG_RESOLVED));
-    entry.insert("integrity".into(), serde_json::json!(ORIG_INTEGRITY));
-    let expected_text = format!("{}\n", serde_json::to_string_pretty(&expected).unwrap());
     assert_eq!(
         std::fs::read_to_string(&lock_path).unwrap(),
-        expected_text,
-        "the lock must hold exactly the pre-redirect entry"
+        upstream_lock_text(),
+        "the lock must hold exactly the upstream registry entry"
     );
     assert!(
-        !ledger_path.exists(),
-        "the emptied redirect ledger must be deleted"
-    );
-    assert!(
-        !tmp.path().join(".socket/manifest.json").exists(),
-        "no manifest may be materialized as a side effect"
+        !tmp.path().join(".socket").exists(),
+        "no manifest (or ledger) may be materialized as a side effect"
     );
 }
 
 /// The hosted leg on the manifest path: the identifier matches a manifest
-/// entry AND the redirect ledger's record for the same purl. The remove
-/// unwinds the redirect (per-purl npm revert): the lock entry gets its
-/// original resolved/integrity back byte-exactly, the emptied ledger is
-/// deleted, and the envelope carries the `hosted_reverted` event alongside
-/// the per-purl manifest removal.
+/// entry AND the lockfile's hosted pin for the same purl. The remove
+/// restores the pin's upstream entry byte-exactly — from the REGISTRY, not
+/// from a pre-v5 ledger left beside it (whose recorded original differs),
+/// which is retired once no hosted pin remains — and the envelope carries
+/// the `hosted_reverted` event alongside the per-purl manifest removal.
 #[test]
-fn hosted_remove_with_manifest_entry_unwinds_redirect() {
+fn hosted_remove_with_manifest_entry_restores_upstream() {
     let tmp = tempfile::tempdir().expect("tempdir");
-    let lock_text = redirected_lock_text();
     let lock_path = tmp.path().join("package-lock.json");
-    std::fs::write(&lock_path, &lock_text).unwrap();
-    let ledger_path = write_redirect_ledger_text(tmp.path(), &npm_redirect_ledger_text());
+    std::fs::write(&lock_path, redirected_lock_text()).unwrap();
+    let ledger_path = write_redirect_ledger_text(tmp.path(), &legacy_npm_redirect_ledger_text());
     let socket = write_manifest_files_empty(tmp.path(), NPM_PURL, NPM_UUID);
+    let registry = NpmRegistry::upstream();
 
-    let (code, stdout, stderr) =
-        run_remove(tmp.path(), &[NPM_PURL, "--json", "--yes", "--offline"], &[]);
+    let (code, stdout, stderr) = run_remove(
+        tmp.path(),
+        &[NPM_PURL, "--json", "--yes"],
+        &[("SOCKET_NPM_REGISTRY", &registry.env())],
+    );
     assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
     let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
     assert_eq!(v["status"], "success");
@@ -634,34 +675,22 @@ fn hosted_remove_with_manifest_entry_unwinds_redirect() {
         "the hosted_reverted event must not inflate the manifest-entry count"
     );
 
-    // The lock is restored byte-exactly: derive the expected bytes the same
-    // way the revert writes them (parse the fixture, put the originals back,
-    // serialize with the workspace's preserve_order serde_json + trailing
-    // newline). This pins the WHOLE file, not just the two fields.
-    let mut expected: serde_json::Value = serde_json::from_str(&lock_text).unwrap();
-    let entry = expected["packages"]["node_modules/left-pad"]
-        .as_object_mut()
-        .expect("lock entry object");
-    entry.insert("resolved".into(), serde_json::json!(ORIG_RESOLVED));
-    entry.insert("integrity".into(), serde_json::json!(ORIG_INTEGRITY));
-    let expected_text = format!("{}\n", serde_json::to_string_pretty(&expected).unwrap());
-    let reverted_text = std::fs::read_to_string(&lock_path).unwrap();
+    let restored = std::fs::read_to_string(&lock_path).unwrap();
     assert_eq!(
-        reverted_text, expected_text,
-        "the lock must hold exactly the pre-redirect entry"
+        restored,
+        upstream_lock_text(),
+        "the lock must hold exactly the upstream registry entry"
     );
     assert!(
-        !reverted_text.contains(NPM_UUID),
-        "no hosted artifact URL (patch uuid) may survive in the lock"
+        !restored.contains(NPM_UUID) && !restored.contains("LEDGER"),
+        "no hosted URL survives, and the ledger's recorded original was never replayed"
     );
-
-    // Record + edit dropped → empty ledger deleted outright.
     assert!(
         !ledger_path.exists(),
-        "the emptied redirect ledger must be deleted; envelope={v}"
+        "the pre-v5 ledger is retired once no hosted pin remains; envelope={v}"
     );
 
-    // Envelope: the hosted unwind event plus the plain per-purl removal.
+    // Envelope: the hosted restore event plus the plain per-purl removal.
     let events = v["events"].as_array().expect("events array");
     assert!(
         events.iter().any(|e| e["action"] == "removed"
@@ -685,77 +714,51 @@ fn hosted_remove_with_manifest_entry_unwinds_redirect() {
 }
 
 // ---------------------------------------------------------------------------
-// 5. Unsupported-ecosystem hosted purl fails closed
+// 5. A hosted pin the upstream restore refuses fails closed
 // ---------------------------------------------------------------------------
 
-const GEM_PURL: &str = "pkg:gem/rexml@3.2.5";
-const GEM_UUID: &str = "aaaa1111-2222-4333-8444-555566667777";
-
-/// Ledger with a gem record (no per-purl revert exists) AND a second npm
-/// record, so a `remove pkg:gem/…` identifier does NOT cover the full
-/// record set and the whole-ledger replay cannot serve it.
-fn gem_plus_npm_ledger_text() -> String {
-    let gem_record = record_json(GEM_UUID, "synthetic hosted gem patch");
-    let npm_record = record_json(NPM_UUID, "synthetic hosted npm patch");
-    format!(
-        r#"{{
-  "version": 1,
-  "mode": "hosted",
-  "edits": [
-    {{
-      "path": "Gemfile",
-      "kind": "redirect_gem_source_block",
-      "action": "added",
-      "key": "rexml",
-      "new": "source \"https://patch.socket.dev/gem/t0k3n\" do\n  gem \"rexml\"\nend\n"
-    }}
-  ],
-  "records": {{
-    "{GEM_PURL}": {gem_record},
-    "{NPM_PURL}": {npm_record}
-  }}
-}}"#
-    )
-}
-
-/// With a manifest entry for the gem purl (the manifest path; the
-/// manifest-less twin is below), the unsupported-ecosystem hosted
-/// target fails closed BEFORE the manifest mutation: exit 1, top-level
-/// `hosted_revert_unsupported`, and BOTH stores byte-identical.
+/// With a manifest entry for the purl (the manifest path; the
+/// manifest-less twin is below), a pin whose upstream entry cannot be
+/// re-derived (the registry records no integrity for it) fails closed
+/// BEFORE the manifest mutation: exit 1, top-level `hosted_revert_failed`
+/// naming the `git checkout` remedy, and the lock + manifest
+/// byte-identical.
 #[test]
-fn hosted_unsupported_ecosystem_remove_fails_closed() {
+fn hosted_refused_restore_remove_fails_closed() {
     let tmp = tempfile::tempdir().expect("tempdir");
-    let ledger_path = write_redirect_ledger_text(tmp.path(), &gem_plus_npm_ledger_text());
-    let ledger_before = std::fs::read(&ledger_path).unwrap();
-    let socket = write_manifest_files_empty(tmp.path(), GEM_PURL, GEM_UUID);
+    let lock_path = tmp.path().join("package-lock.json");
+    std::fs::write(&lock_path, redirected_lock_text()).unwrap();
+    let lock_before = std::fs::read(&lock_path).unwrap();
+    let socket = write_manifest_files_empty(tmp.path(), NPM_PURL, NPM_UUID);
     let manifest_before = std::fs::read(socket.join("manifest.json")).unwrap();
+    let registry = NpmRegistry::start(serde_json::json!({ "tarball": ORIG_RESOLVED }));
 
-    let (code, stdout, stderr) =
-        run_remove(tmp.path(), &[GEM_PURL, "--json", "--yes", "--offline"], &[]);
+    let (code, stdout, stderr) = run_remove(
+        tmp.path(),
+        &[NPM_PURL, "--json", "--yes"],
+        &[("SOCKET_NPM_REGISTRY", &registry.env())],
+    );
     assert_eq!(
         code, 1,
-        "unsupported hosted revert must fail; stdout=\n{stdout}\nstderr=\n{stderr}"
+        "a refused hosted restore must fail; stdout=\n{stdout}\nstderr=\n{stderr}"
     );
     let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
     assert_eq!(v["command"], "remove");
     assert_eq!(v["status"], "error");
-    assert_eq!(
-        v["error"]["code"], "hosted_revert_unsupported",
-        "envelope={v}"
-    );
+    assert_eq!(v["error"]["code"], "hosted_revert_failed", "envelope={v}");
     let msg = v["error"]["message"].as_str().expect("message string");
     assert!(
-        msg.contains(GEM_PURL) && msg.contains("scan --mode hosted"),
-        "the error must name the purl and the remedy; got {msg}"
+        msg.contains(&format!(
+            "cannot restore {NPM_PURL} to its upstream registry entry"
+        )) && msg.contains("the registry records no integrity")
+            && msg.contains("git checkout -- package-lock.json")
+            && msg.contains("The manifest was not modified."),
+        "the error must name the purl, the cause and the remedy; got {msg}"
     );
     assert_eq!(v["summary"]["removed"], 0);
 
-    // Fail-closed: ledger AND manifest byte-identical.
-    assert_eq!(
-        std::fs::read(&ledger_path).unwrap(),
-        ledger_before,
-        "the redirect ledger must be unchanged"
-    );
+    // Fail-closed: lock AND manifest byte-identical.
+    assert_eq!(std::fs::read(&lock_path).unwrap(), lock_before);
     assert_eq!(
         std::fs::read(socket.join("manifest.json")).unwrap(),
         manifest_before,
@@ -763,37 +766,36 @@ fn hosted_unsupported_ecosystem_remove_fails_closed() {
     );
 }
 
-/// Manifest-less twin of the unsupported-ecosystem refusal: the gem+npm
-/// ledger's gem identifier reaches the hosted-only removal path (the
-/// manifest-missing escape), where the gem record has no per-purl revert
-/// and the identifier does NOT cover the full record set (so the
-/// whole-ledger replay cannot serve it) — fail closed with
-/// `hosted_revert_unsupported`, ledger untouched.
+/// Manifest-less twin of the refusal: the identifier reaches the
+/// hosted-only removal path, where an `--offline` run cannot re-resolve the
+/// upstream entry — fail closed with `hosted_revert_failed`, the lock
+/// untouched and no `.socket/` state written.
 #[test]
-fn hosted_only_unsupported_remove_without_manifest_fails_closed() {
+fn hosted_only_refused_restore_remove_without_manifest_fails_closed() {
     let tmp = tempfile::tempdir().expect("tempdir");
-    let ledger_path = write_redirect_ledger_text(tmp.path(), &gem_plus_npm_ledger_text());
-    let ledger_before = std::fs::read(&ledger_path).unwrap();
+    let lock_path = tmp.path().join("package-lock.json");
+    std::fs::write(&lock_path, redirected_lock_text()).unwrap();
+    let lock_before = std::fs::read(&lock_path).unwrap();
 
     let (code, stdout, stderr) =
-        run_remove(tmp.path(), &[GEM_PURL, "--json", "--yes", "--offline"], &[]);
+        run_remove(tmp.path(), &[NPM_PURL, "--json", "--yes", "--offline"], &[]);
     assert_eq!(code, 1, "stdout=\n{stdout}\nstderr=\n{stderr}");
     let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
     assert_eq!(v["status"], "error", "envelope={v}");
-    assert_eq!(
-        v["error"]["code"], "hosted_revert_unsupported",
-        "envelope={v}"
-    );
+    assert_eq!(v["error"]["code"], "hosted_revert_failed", "envelope={v}");
     let msg = v["error"]["message"].as_str().unwrap_or_default();
     assert!(
-        msg.contains(GEM_PURL) && msg.contains("socket-patch rollback"),
-        "the refusal names the purl and the unscoped-rollback remedy; envelope={v}"
+        msg.contains(NPM_PURL)
+            && msg.contains("this run is offline")
+            && msg.contains("git checkout -- package-lock.json"),
+        "the refusal names the purl, the cause and the remedy; envelope={v}"
     );
     assert_eq!(
-        std::fs::read(&ledger_path).unwrap(),
-        ledger_before,
-        "the redirect ledger must be unchanged"
+        std::fs::read(&lock_path).unwrap(),
+        lock_before,
+        "the lock must be unchanged"
     );
+    assert!(!tmp.path().join(".socket").exists(), "nothing written");
 }
 
 // ---------------------------------------------------------------------------
diff --git a/crates/socket-patch-cli/tests/repair_invariants.rs b/crates/socket-patch-cli/tests/repair_invariants.rs
index 3588eadd..b92a0bbb 100644
--- a/crates/socket-patch-cli/tests/repair_invariants.rs
+++ b/crates/socket-patch-cli/tests/repair_invariants.rs
@@ -129,8 +129,8 @@ fn repair_with_no_manifest_emits_manifest_not_found_envelope() {
     );
 }
 
-/// A project whose ONLY trace is the hosted-mode redirect ledger
-/// (`.socket/vendor/redirect-state.json`) — no manifest, no vendor
+/// A project whose ONLY trace is a PRE-V5 hosted-mode redirect ledger
+/// (`.socket/vendor/redirect-state.json`; v5 never writes one) — no manifest, no vendor
 /// `state.json`, no `.socket/vendor/...` lockfile references — is a no-op for
 /// repair, not a `manifest_not_found` error. Hosted redirects point at
 /// patch.socket.dev URLs and leave no local artifacts to rebuild or sweep, so
@@ -177,6 +177,60 @@ fn repair_redirect_only_project_is_informational_no_op() {
     );
 }
 
+/// The v5 shape of a hosted-only project: NO ledger at all, just a lockfile
+/// whose entry pins a hosted patch (v5 hosted mode writes only lockfile
+/// edits). Repair discovers the pin and takes the same informational
+/// `redirect_only_project` skip — never `manifest_not_found` — and writes
+/// nothing (no `.socket/` appears).
+#[test]
+fn repair_hosted_lockfile_pin_only_project_is_informational_no_op() {
+    let tmp = tempfile::tempdir().expect("tempdir");
+    std::fs::write(
+        tmp.path().join("package-lock.json"),
+        r#"{
+  "name": "hosted-fixture",
+  "version": "0.0.0",
+  "lockfileVersion": 3,
+  "packages": {
+    "": { "name": "hosted-fixture", "version": "0.0.0" },
+    "node_modules/left-pad": {
+      "name": "left-pad",
+      "version": "1.3.0",
+      "resolved": "https://patch.socket.dev/patch/npm/left-pad/1.3.0/9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f/left-pad-1.3.0.tgz",
+      "integrity": "sha512-PATCHED=="
+    }
+  }
+}
+"#,
+    )
+    .unwrap();
+    let lock_before = std::fs::read(tmp.path().join("package-lock.json")).unwrap();
+
+    let (code, stdout) = run_repair(tmp.path(), &[]);
+    assert_eq!(
+        code, 0,
+        "hosted-pin-only repair must succeed; stdout=\n{stdout}"
+    );
+    let v: serde_json::Value = serde_json::from_str(&stdout).expect("envelope JSON");
+    assert_eq!(v["status"], "success", "{v}");
+    let events = v["events"].as_array().expect("events array");
+    assert!(
+        events
+            .iter()
+            .any(|e| e["action"] == "skipped" && e["errorCode"] == "redirect_only_project"),
+        "the hosted pin alone must take the redirect-only skip; got {v}"
+    );
+    assert_eq!(
+        std::fs::read(tmp.path().join("package-lock.json")).unwrap(),
+        lock_before,
+        "repair never touches hosted wiring"
+    );
+    assert!(
+        !tmp.path().join(".socket").exists(),
+        "a project with nothing to repair never grows .socket/"
+    );
+}
+
 /// The human (non-JSON) path of the redirect-only no-op: exit 0 with the
 /// informational message on stdout (not stderr, not an error).
 #[test]
diff --git a/crates/socket-patch-cli/tests/scan_invariants.rs b/crates/socket-patch-cli/tests/scan_invariants.rs
index d0b61f89..ad5978b1 100644
--- a/crates/socket-patch-cli/tests/scan_invariants.rs
+++ b/crates/socket-patch-cli/tests/scan_invariants.rs
@@ -1483,9 +1483,11 @@ async fn scan_agent_over_vendored_purl_surfaces_run_level_warning() {
     );
 }
 
-/// Write a hosted redirect ledger + a yarn.lock the ledger claims to have
-/// edited, whose resolved URL still pins the patch server (the live-wiring
-/// proof `redirect_record_live` reads).
+/// Write a yarn.lock whose resolved URL pins the Socket patch server — a
+/// hosted pin, which is the whole v5 hosted state — plus, when
+/// `with_record`, a pre-v5 redirect ledger recording the purl (edits and a
+/// record). v5 scan never reads that ledger, so it must not change any
+/// verdict: the lock pin alone decides.
 fn seed_live_hosted_wiring(root: &Path, purl: &str, uuid: &str, with_record: bool) {
     let hosted_url =
         format!("https://patch.socket.dev/patch/npm/minimist/1.2.2/tok/{uuid}/minimist-1.2.2.tgz");
@@ -1499,6 +1501,9 @@ fn seed_live_hosted_wiring(root: &Path, purl: &str, uuid: &str, with_record: boo
         ),
     )
     .unwrap();
+    if !with_record {
+        return;
+    }
     let vendor_dir = root.join(".socket/vendor");
     std::fs::create_dir_all(&vendor_dir).unwrap();
     let mut state = serde_json::json!({
@@ -1581,9 +1586,13 @@ async fn scan_agent_over_live_hosted_wiring_surfaces_run_level_warning() {
         "must name the migration path: {detail}"
     );
     assert!(
-        detail.contains("Do not delete"),
-        "must warn against hand-deleting the ledger (it holds the only \
-         revert originals): {detail}"
+        detail.contains("socket-patch rollback"),
+        "must name the upstream-restore path (v5 keeps no ledger to \
+         protect): {detail}"
+    );
+    assert!(
+        !detail.contains("ledger"),
+        "v5 hosted state is the lockfile pin, not a ledger: {detail}"
     );
     assert!(
         stderr.contains("hosted_wiring_retained"),
@@ -1591,13 +1600,11 @@ async fn scan_agent_over_live_hosted_wiring_surfaces_run_level_warning() {
     );
 }
 
-/// Coordination guard (lane B: hosted→vendored pre-revert): once another
-/// flow retires the redirect ledger RECORDS for a purl, the agent-flow
-/// warning must stay silent — it keys on records still live at scan time,
-/// never on leftover `edits` (which are append-only revert data and
-/// legitimately outlive the records).
+/// v5: the agent-flow warning keys on the lockfile's hosted pin alone — a
+/// project with NO redirect ledger at all (what v5 `scan --mode hosted`
+/// leaves behind) whose lock still pins the patch server must warn.
 #[tokio::test]
-async fn scan_agent_hosted_warning_silent_once_ledger_records_are_gone() {
+async fn scan_agent_hosted_warning_keys_on_the_lock_pin_without_a_ledger() {
     let mock = MockServer::start().await;
     let purl = "pkg:npm/minimist@1.2.2";
     let encoded = "pkg%3Anpm%2Fminimist%401.2.2";
@@ -1606,14 +1613,14 @@ async fn scan_agent_hosted_warning_silent_once_ledger_records_are_gone() {
     let tmp = tempfile::tempdir().expect("tempdir");
     write_root_package_json(tmp.path());
     write_npm_package(tmp.path(), "minimist", "1.2.2");
-    // Ledger with edits but NO records (the post-pre-revert shape) — and
-    // the lock text still carrying the uuid must not resurrect the warning.
+    // The lock pin only: no `.socket/` at all.
     seed_live_hosted_wiring(
         tmp.path(),
         purl,
         AGENT_WARN_UUID,
         /*with_record=*/ false,
     );
+    assert!(!tmp.path().join(".socket").exists());
 
     let (code, stdout, stderr) = run_scan(
         tmp.path(),
@@ -1622,14 +1629,17 @@ async fn scan_agent_hosted_warning_silent_once_ledger_records_are_gone() {
     );
     assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
     let v: serde_json::Value = serde_json::from_str(stdout.trim()).expect("valid JSON");
+    let w = find_warning(&v, "hosted_wiring_retained").unwrap_or_else(|| {
+        panic!("a live lock pin ⇒ hosted_wiring_retained, ledger or not; envelope={v}")
+    });
     assert!(
-        find_warning(&v, "hosted_wiring_retained").is_none(),
-        "no ledger records ⇒ no hosted_wiring_retained warning; envelope={v}"
+        w["detail"].as_str().unwrap_or_default().contains(purl),
+        "envelope={v}"
     );
 }
 
-/// Registry-clean lock (hosted wiring NOT live) with a leftover record:
-/// the live lock is the truth source — no warning.
+/// Registry-clean lock (hosted wiring NOT live) with a leftover pre-v5
+/// ledger record: the live lock is the truth source — no warning.
 #[tokio::test]
 async fn scan_agent_hosted_warning_silent_when_lock_is_registry_clean() {
     let mock = MockServer::start().await;
@@ -1717,9 +1727,9 @@ async fn report_only_scan_json_surfaces_hosted_redirect_state() {
          redirectState block; envelope={v}"
     );
     assert_eq!(state["mode"], "hosted", "envelope={v}");
-    assert_eq!(
-        state["ledger"], ".socket/vendor/redirect-state.json",
-        "the block must name the ledger it reports; envelope={v}"
+    assert!(
+        state.get("ledger").is_none() && state.get("ledgerKey").is_none(),
+        "v5: the block is built from lockfile pins and names no ledger; envelope={v}"
     );
     let records = state["records"].as_array().expect("records array");
     assert_eq!(records.len(), 1, "envelope={v}");
@@ -1746,16 +1756,18 @@ async fn report_only_scan_json_surfaces_hosted_redirect_state() {
     );
 }
 
-/// The block keys on ledger RECORDS: an edits-only ledger (the post-takeover
-/// / degraded shape) and a ledger-less project both omit it entirely.
+/// The block keys on the lockfiles' hosted PINS: a ledger-less project
+/// whose lock pins the patch server carries it (v5 hosted mode writes no
+/// ledger), and a project with neither a pin nor a ledger omits it.
 #[tokio::test]
-async fn report_only_scan_json_omits_redirect_state_without_ledger_records() {
+async fn report_only_scan_json_redirect_state_keys_on_lock_pins() {
     let mock = MockServer::start().await;
     let purl = "pkg:npm/minimist@1.2.2";
     let encoded = "pkg%3Anpm%2Fminimist%401.2.2";
     mount_patch_discovery(&mock, purl, encoded, AGENT_WARN_UUID).await;
 
-    // Edits-only ledger (records retired), live-looking lock text.
+    // Pin only, no ledger. `--prune` with no mode: the read-only discovery
+    // envelope (a bare scan is hosted, whose envelope omits the block).
     let tmp = tempfile::tempdir().expect("tempdir");
     write_root_package_json(tmp.path());
     write_npm_package(tmp.path(), "minimist", "1.2.2");
@@ -1765,33 +1777,37 @@ async fn report_only_scan_json_omits_redirect_state_without_ledger_records() {
         AGENT_WARN_UUID,
         /*with_record=*/ false,
     );
-    let (code, stdout, stderr) = run_scan(tmp.path(), &mock.uri(), &[]);
+    let (code, stdout, stderr) = run_scan(tmp.path(), &mock.uri(), &["--prune"]);
     assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
     let v: serde_json::Value = serde_json::from_str(stdout.trim()).expect("valid JSON");
-    assert!(
-        v.get("redirectState").is_none(),
-        "an edits-only ledger asserts no records ⇒ no redirectState block; \
-         envelope={v}"
+    let state = &v["redirectState"];
+    assert_eq!(state["mode"], "hosted", "envelope={v}");
+    assert_eq!(
+        state["records"],
+        serde_json::json!([{ "purl": purl, "uuid": AGENT_WARN_UUID }]),
+        "the lock pin is the record; envelope={v}"
     );
+    assert_eq!(state["wiringLive"], serde_json::json!([purl]), "envelope={v}");
 
-    // No ledger at all: the key must stay absent (additive contract).
+    // No pin, no ledger: the key must stay absent (additive contract).
     let clean = tempfile::tempdir().expect("tempdir");
     write_root_package_json(clean.path());
     write_npm_package(clean.path(), "minimist", "1.2.2");
-    let (code, stdout, stderr) = run_scan(clean.path(), &mock.uri(), &[]);
+    let (code, stdout, stderr) = run_scan(clean.path(), &mock.uri(), &["--prune"]);
     assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
     let v: serde_json::Value = serde_json::from_str(stdout.trim()).expect("valid JSON");
     assert!(
         v.get("redirectState").is_none(),
-        "no ledger ⇒ no redirectState block; envelope={v}"
+        "no hosted pin ⇒ no redirectState block; envelope={v}"
     );
 }
 
-/// Records with a registry-clean lock: the block still lists the records
-/// (the ledger is real state) but `wiringLive` is empty — the records/proof
-/// split mirrors the agent warning's live-lock gate.
+/// A pre-v5 ledger record whose lock entry is back on the registry is NOT
+/// hosted state: v5 reads hosted state from the lockfiles only, so the
+/// block is omitted (never guessed from ledger presence), and the agent
+/// warning stays silent.
 #[tokio::test]
-async fn report_only_scan_json_redirect_state_splits_records_from_live_proof() {
+async fn report_only_scan_json_ignores_a_stale_pre_v5_ledger_record() {
     let mock = MockServer::start().await;
     let purl = "pkg:npm/minimist@1.2.2";
     let encoded = "pkg%3Anpm%2Fminimist%401.2.2";
@@ -1816,25 +1832,25 @@ async fn report_only_scan_json_redirect_state_splits_records_from_live_proof() {
          integrity sha512-orig==\n",
     )
     .unwrap();
-
-    let (code, stdout, stderr) = run_scan(tmp.path(), &mock.uri(), &["--mode", "agent", "--dry-run"]);
-    assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
-    let v: serde_json::Value = serde_json::from_str(stdout.trim()).expect("valid JSON");
-    let state = &v["redirectState"];
-    assert!(
-        state.is_object(),
-        "records exist ⇒ block exists; envelope={v}"
-    );
-    assert_eq!(
-        state["records"].as_array().map(Vec::len),
-        Some(1),
-        "envelope={v}"
-    );
+    let ledger_before = std::fs::read(tmp.path().join(".socket/vendor/redirect-state.json")).unwrap();
+
+    for extra in [&["--prune"][..], &["--mode", "agent", "--dry-run"][..]] {
+        let (code, stdout, stderr) = run_scan(tmp.path(), &mock.uri(), extra);
+        assert_eq!(code, 0, "{extra:?}: stdout={stdout}; stderr={stderr}");
+        let v: serde_json::Value = serde_json::from_str(stdout.trim()).expect("valid JSON");
+        assert!(
+            v.get("redirectState").is_none(),
+            "{extra:?}: a stale pre-v5 ledger record is not hosted state; envelope={v}"
+        );
+        assert!(
+            find_warning(&v, "hosted_wiring_retained").is_none(),
+            "{extra:?}: envelope={v}"
+        );
+    }
     assert_eq!(
-        state["wiringLive"].as_array().map(Vec::len),
-        Some(0),
-        "registry-clean lock ⇒ empty wiringLive (never guess from ledger \
-         presence alone); envelope={v}"
+        std::fs::read(tmp.path().join(".socket/vendor/redirect-state.json")).unwrap(),
+        ledger_before,
+        "scan leaves a pre-v5 ledger byte-identical"
     );
 }
 
@@ -2008,12 +2024,11 @@ async fn vendored_mode_envelopes_omit_redirect_state() {
     );
 }
 
-/// The malformed-ledger degradation warning is advisory, so `--silent`
-/// ("errors only") must mute it — on the report-only path like everywhere
-/// else. The envelope itself is unchanged either way (no redirectState from
-/// a ledger that cannot be read).
+/// A malformed pre-v5 redirect ledger is IGNORED by scan (v5 never reads
+/// it): no warning on stderr with or without `--silent`, no redirectState,
+/// and the file is left byte-identical in place (never quarantined).
 #[tokio::test]
-async fn silent_gates_scan_malformed_ledger_warning() {
+async fn scan_ignores_a_malformed_pre_v5_ledger() {
     let mock = MockServer::start().await;
     let purl = "pkg:npm/minimist@1.2.2";
     let encoded = "pkg%3Anpm%2Fminimist%401.2.2";
@@ -2026,31 +2041,34 @@ async fn silent_gates_scan_malformed_ledger_warning() {
     std::fs::create_dir_all(&vendor_dir).unwrap();
     std::fs::write(vendor_dir.join("redirect-state.json"), "{ torn ledger").unwrap();
 
-    // Control: without --silent the corruption is surfaced on stderr.
-    let (code, stdout, stderr) = run_scan(tmp.path(), &mock.uri(), &["--mode", "agent", "--dry-run"]);
-    assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
-    assert!(
-        stderr.contains("malformed"),
-        "a malformed ledger must be surfaced when not silent: {stderr}"
-    );
-    let v: serde_json::Value = serde_json::from_str(stdout.trim()).expect("valid JSON");
-    assert!(
-        v.get("redirectState").is_none(),
-        "an unreadable ledger asserts nothing; envelope={v}"
-    );
-
-    // --silent mutes the advisory warning; the run is otherwise identical.
-    let (code, stdout, stderr) = run_scan(tmp.path(), &mock.uri(), &["--mode", "agent", "--dry-run", "--silent"]);
-    assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
-    assert!(
-        !stderr.contains("malformed"),
-        "--silent must mute the malformed-ledger warning: {stderr}"
-    );
+    for extra in [
+        &["--mode", "agent", "--dry-run"][..],
+        &["--mode", "agent", "--dry-run", "--silent"][..],
+        &["--prune"][..],
+    ] {
+        let (code, stdout, stderr) = run_scan(tmp.path(), &mock.uri(), extra);
+        assert_eq!(code, 0, "{extra:?}: stdout={stdout}; stderr={stderr}");
+        assert!(
+            !stderr.contains("malformed") && !stderr.contains("redirect ledger"),
+            "{extra:?}: a pre-v5 ledger is never read, so never reported: {stderr}"
+        );
+        let v: serde_json::Value = serde_json::from_str(stdout.trim()).expect("valid JSON");
+        assert!(
+            v.get("redirectState").is_none(),
+            "{extra:?}: envelope={v}"
+        );
+        assert_eq!(
+            std::fs::read(vendor_dir.join("redirect-state.json")).unwrap(),
+            b"{ torn ledger",
+            "{extra:?}: left in place, byte-identical"
+        );
+        assert!(!vendor_dir.join("redirect-state.json.corrupt").exists());
+    }
 }
 
 /// `wiringLive` (like the agent warning) only ever names packages this run
 /// actually counted: an `--ecosystems` filter that excludes the hosted
-/// ecosystem leaves the records listed — the ledger is still real state —
+/// ecosystem leaves the records listed — the lock pin is still real state —
 /// with an EMPTY wiringLive ("purl not crawled/queried this run" is a
 /// documented silent cause, distinct from "wiring unwound"). This also pins
 /// the zero-discovery envelope carrying the block at all.
@@ -2078,7 +2096,7 @@ async fn ecosystems_filter_keeps_records_but_not_wiring_live() {
     let state = &v["redirectState"];
     assert!(
         state.is_object(),
-        "records exist ⇒ the block rides even the filtered/zero-discovery \
+        "a pin exists ⇒ the block rides even the filtered/zero-discovery \
          envelope; envelope={v}"
     );
     assert_eq!(
diff --git a/crates/socket-patch-cli/tests/scan_ordered_concurrency_e2e.rs b/crates/socket-patch-cli/tests/scan_ordered_concurrency_e2e.rs
index 4ce81b0c..e57a7fef 100644
--- a/crates/socket-patch-cli/tests/scan_ordered_concurrency_e2e.rs
+++ b/crates/socket-patch-cli/tests/scan_ordered_concurrency_e2e.rs
@@ -842,36 +842,13 @@ async fn mount_hosted(server: &MockServer, failing: &[usize], delay: fn(usize) -
     }
 }
 
-/// The ledger with its run timestamps blanked, for a byte comparison.
-fn ledger_without_timestamps(root: &Path) -> String {
-    let raw = std::fs::read_to_string(root.join(".socket/vendor/redirect-state.json")).unwrap();
-    let mut v: serde_json::Value = serde_json::from_str(&raw).unwrap();
-    fn blank(v: &mut serde_json::Value) {
-        match v {
-            serde_json::Value::Object(map) => {
-                for (k, val) in map.iter_mut() {
-                    let key = k.to_ascii_lowercase();
-                    if key.ends_with("at") && val.is_string() {
-                        *val = serde_json::Value::String("<ts>".into());
-                    } else {
-                        blank(val);
-                    }
-                }
-            }
-            serde_json::Value::Array(items) => items.iter_mut().for_each(blank),
-            _ => {}
-        }
-    }
-    blank(&mut v);
-    serde_json::to_string_pretty(&v).unwrap()
-}
-
 /// A wet hosted run where 2 of 6 record views fail, with reversed
 /// latencies: the `record_fetch_failed` warnings keep `confirmed` order,
-/// and stdout, the rewritten lockfile and the ledger all equal a
-/// zero-latency run's.
+/// stdout and the rewritten lockfile equal a zero-latency run's, and (v5)
+/// neither run writes a redirect ledger — a failed record fetch only drops
+/// the purl from this run's in-memory VEX records.
 #[tokio::test]
-async fn hosted_record_fetch_failures_keep_order_and_ledger_bytes() {
+async fn hosted_record_fetch_failures_keep_order_and_lock_bytes() {
     let failing = [1usize, 3];
     let slow: fn(usize) -> Duration = |i| Duration::from_millis(50 * (6 - i as u64));
     let fast: fn(usize) -> Duration = |_| Duration::ZERO;
@@ -890,10 +867,16 @@ async fn hosted_record_fetch_failures_keep_order_and_ledger_bytes() {
         );
         assert_eq!(code, 0, "stdout={stdout} stderr={stderr}");
         let lock = std::fs::read_to_string(tmp.path().join("package-lock.json")).unwrap();
-        outcomes.push((stdout, lock, ledger_without_timestamps(tmp.path())));
+        assert!(
+            !tmp.path()
+                .join(".socket/vendor/redirect-state.json")
+                .exists(),
+            "v5 hosted mode writes no redirect ledger"
+        );
+        outcomes.push((stdout, lock));
     }
 
-    let (stdout, lock, ledger) = &outcomes[0];
+    let (stdout, lock) = &outcomes[0];
     let v: serde_json::Value = serde_json::from_str(stdout).unwrap();
     let warnings: Vec<&str> = v["redirect"]["warnings"]
         .as_array()
@@ -903,12 +886,19 @@ async fn hosted_record_fetch_failures_keep_order_and_ledger_bytes() {
         .map(|w| w["detail"].as_str().unwrap())
         .collect();
     assert_eq!(warnings.len(), 2, "{stdout}");
-    assert!(warnings[0].starts_with(&format!("{} redirected", purl(NAMES[1]))));
-    assert!(warnings[1].starts_with(&format!("{} redirected", purl(NAMES[3]))));
+    for (warning, idx) in warnings.iter().zip([1usize, 3]) {
+        assert_eq!(
+            *warning,
+            format!(
+                "{} redirected, but its patch record could not be fetched; this run's VEX \
+                 attestation omits it (`socket-patch vex` fetches it again once the API \
+                 answers)",
+                purl(NAMES[idx])
+            )
+        );
+    }
     for idx in 0..NAMES.len() {
         assert!(lock.contains(&hosted_url(idx)), "{lock}");
-        let has_record = ledger.contains(&format!("GHSA-conc-{idx:04}-aaaa"));
-        assert_eq!(has_record, !failing.contains(&idx), "{ledger}");
     }
 
     assert_eq!(outcomes[0], outcomes[1], "latency must not change the run");
diff --git a/crates/socket-patch-cli/tests/telemetry_e2e.rs b/crates/socket-patch-cli/tests/telemetry_e2e.rs
index 859dd758..fc4c5a38 100644
--- a/crates/socket-patch-cli/tests/telemetry_e2e.rs
+++ b/crates/socket-patch-cli/tests/telemetry_e2e.rs
@@ -967,16 +967,14 @@ async fn scan_delivers_telemetry_before_writing_to_a_closed_stdout() {
     }
 }
 
-/// The stderr twin of the closed-stdout test above: a malformed hosted
-/// redirect ledger makes a non-hosted scan warn on stderr (the lenient
-/// read-only consult) right after the scan event fires, BEFORE any stdout
-/// write — so with stderr closed that warning is the run's first
-/// SIGPIPE-raising write, and the background send must be flushed ahead of
-/// it. The agent preview (`--mode agent --dry-run`) does no network work
-/// between the event and the warning, so without the flush the delayed send
-/// deterministically loses the race (a bare scan is hosted and reads the
-/// ledger strictly, so it is not a case here); the vendored arm is covered
-/// too (its warning also precedes `discover_selected`'s flush).
+/// The stderr twin of the closed-stdout test above: with stderr closed
+/// from the start, the agent preview (`--mode agent --dry-run`) and the
+/// vendored arm must still deliver the delayed `patch_scanned` event.
+/// Before v5 a malformed hosted redirect ledger made these arms warn on
+/// stderr right after the event fired; v5 scan never reads that ledger (a
+/// pre-v5 one is ignored), so the project below keeps one to pin that no
+/// warning is written in that window at all, and the run still reaches its
+/// flush with the send delivered.
 #[tokio::test]
 async fn scan_delivers_telemetry_before_writing_to_a_closed_stderr() {
     const TELEMETRY_DELAY: std::time::Duration = std::time::Duration::from_millis(800);
@@ -1006,10 +1004,9 @@ async fn scan_delivers_telemetry_before_writing_to_a_closed_stderr() {
         let ledger_dir = tmp.path().join(".socket").join("vendor");
         std::fs::create_dir_all(&ledger_dir).expect("mkdir .socket/vendor");
         std::fs::write(ledger_dir.join("redirect-state.json"), "{ not json")
-            .expect("write malformed redirect ledger");
+            .expect("write malformed pre-v5 redirect ledger");
 
-        // Sanity: with stderr open the run does warn about the ledger, so
-        // the closed-stderr run below really has a write to die on.
+        // Sanity: with stderr open the pre-v5 ledger draws no warning.
         let out = build_cmd_with_token(
             WELL_SHAPED_TOKEN,
             tmp.path(),
@@ -1022,9 +1019,8 @@ async fn scan_delivers_telemetry_before_writing_to_a_closed_stderr() {
         .expect("run socket-patch");
         let stderr = String::from_utf8_lossy(&out.stderr);
         assert!(
-            stderr.starts_with("Warning: ") && stderr.contains("redirect-state.json"),
-            "{label}: the malformed redirect ledger's warning must be the \
-             run's first stderr write; got: {stderr}"
+            !stderr.contains("Warning") && !stderr.contains("redirect-state.json"),
+            "{label}: a pre-v5 redirect ledger is never read by scan; got: {stderr}"
         );
         mock.reset().await;
         Mock::given(method("POST"))
diff --git a/crates/socket-patch-cli/tests/vendor_eject.rs b/crates/socket-patch-cli/tests/vendor_eject.rs
new file mode 100644
index 00000000..f6752d91
--- /dev/null
+++ b/crates/socket-patch-cli/tests/vendor_eject.rs
@@ -0,0 +1,360 @@
+//! v5 WS2 eject: standalone `vendor` in a HOSTED project.
+//!
+//! A hosted project keeps no manifest and no ledger — its patch set is the
+//! hosted pins in its lockfiles. A plain `vendor` there EJECTS: each pin's
+//! record is fetched from the API (`patches/view/<uuid>`), vendored into
+//! `.socket/vendor/`, and the lock is rewired hosted → vendored (restoring
+//! the pin's upstream registry entry first, so `vendor --revert` later lands
+//! on the upstream registry entry, not the hosted URL).
+//!
+//! Every run goes through the built binary with a scrubbed environment: the
+//! API, the npm registry (`SOCKET_NPM_REGISTRY`) and the patch-server origin
+//! (`SOCKET_PATCH_SERVER_URL`, what makes the mock hosted URL count as
+//! hosted) all point at a wiremock; `SOCKET_VENDOR_SOURCE=build` keeps the
+//! vendoring service out of it.
+
+use std::path::{Path, PathBuf};
+use std::process::Command;
+
+use base64::Engine as _;
+use serde_json::{json, Value};
+use socket_patch_core::hash::git_sha256::compute_git_sha256_from_bytes;
+use wiremock::matchers::{method, path};
+use wiremock::{Mock, MockServer, ResponseTemplate};
+
+const ORG: &str = "test-org";
+const UUID: &str = "9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f";
+const GRANT: &str = "55555555-5555-4555-8555-555555555555";
+const PURL: &str = "pkg:npm/left-pad@1.3.0";
+const ORIG_INDEX: &[u8] = b"module.exports = () => 'orig';\n";
+const PATCHED_INDEX: &[u8] = b"module.exports = () => 'patched';\n";
+const HOSTED_INTEGRITY: &str = "sha512-HOSTEDpatchedHOSTEDpatched==";
+const UPSTREAM_INTEGRITY: &str = "sha512-UPSTREAMupstreamUPSTREAM==";
+
+struct Project {
+    tmp: tempfile::TempDir,
+    server: MockServer,
+}
+
+impl Project {
+    fn root(&self) -> &Path {
+        self.tmp.path()
+    }
+    fn lock_path(&self) -> PathBuf {
+        self.root().join("package-lock.json")
+    }
+    fn lock(&self) -> Value {
+        serde_json::from_slice(&std::fs::read(self.lock_path()).unwrap()).unwrap()
+    }
+    fn lock_bytes(&self) -> Vec<u8> {
+        std::fs::read(self.lock_path()).unwrap()
+    }
+    fn hosted_url(&self) -> String {
+        format!(
+            "{}/patch/npm/left-pad/1.3.0/{GRANT}/{UUID}/left-pad-1.3.0.tgz",
+            self.server.uri()
+        )
+    }
+    fn upstream_tarball(&self) -> String {
+        format!("{}/left-pad/-/left-pad-1.3.0.tgz", self.server.uri())
+    }
+    fn artifact(&self) -> PathBuf {
+        self.root()
+            .join(format!(".socket/vendor/npm/{UUID}/left-pad-1.3.0.tgz"))
+    }
+    fn redirect_state(&self) -> PathBuf {
+        self.root().join(".socket/vendor/redirect-state.json")
+    }
+
+    /// Run the binary against the mocks with every ambient `SOCKET_*` var
+    /// scrubbed.
+    fn run(&self, args: &[&str]) -> (i32, String, String) {
+        let mut cmd = Command::new(env!("CARGO_BIN_EXE_socket-patch"));
+        cmd.args(args)
+            .arg("--cwd")
+            .arg(self.root())
+            .current_dir(self.root());
+        for (key, _) in std::env::vars() {
+            if key.starts_with("SOCKET_") {
+                cmd.env_remove(key);
+            }
+        }
+        let uri = self.server.uri();
+        cmd.env("SOCKET_TELEMETRY_DISABLED", "1")
+            .env("SOCKET_API_URL", &uri)
+            .env("SOCKET_API_TOKEN", "fake-token")
+            .env("SOCKET_ORG_SLUG", ORG)
+            .env("SOCKET_NPM_REGISTRY", &uri)
+            .env("SOCKET_PATCH_SERVER_URL", &uri)
+            .env("SOCKET_VENDOR_SOURCE", "build");
+        let out = cmd.output().expect("spawn socket-patch");
+        (
+            out.status.code().unwrap_or(-1),
+            String::from_utf8_lossy(&out.stdout).into_owned(),
+            String::from_utf8_lossy(&out.stderr).into_owned(),
+        )
+    }
+
+    fn run_json(&self, args: &[&str]) -> (i32, Value) {
+        let mut all = args.to_vec();
+        all.push("--json");
+        let (code, stdout, stderr) = self.run(&all);
+        let env = serde_json::from_str(&stdout).unwrap_or_else(|e| {
+            panic!("--json must emit an envelope: {e}\nstdout:\n{stdout}\nstderr:\n{stderr}")
+        });
+        (code, env)
+    }
+}
+
+/// A hosted npm project: package-lock.json pins left-pad to the mock hosted
+/// tarball (what `scan --mode hosted` leaves behind), the installed copy
+/// carries the pristine file, and there is NO `.socket/` at all.
+async fn hosted_project(hosted: bool) -> Project {
+    let server = MockServer::start().await;
+    let tmp = tempfile::tempdir().unwrap();
+    let project = Project { tmp, server };
+    let root = project.root();
+    std::fs::write(
+        root.join("package.json"),
+        br#"{"name":"fixture","version":"1.0.0","private":true,"dependencies":{"left-pad":"1.3.0"}}"#,
+    )
+    .unwrap();
+    let pkg = root.join("node_modules/left-pad");
+    std::fs::create_dir_all(&pkg).unwrap();
+    std::fs::write(
+        pkg.join("package.json"),
+        br#"{"name":"left-pad","version":"1.3.0"}"#,
+    )
+    .unwrap();
+    std::fs::write(pkg.join("index.js"), ORIG_INDEX).unwrap();
+    let (resolved, integrity) = if hosted {
+        (project.hosted_url(), HOSTED_INTEGRITY.to_string())
+    } else {
+        (project.upstream_tarball(), UPSTREAM_INTEGRITY.to_string())
+    };
+    let lock = json!({
+        "name": "fixture",
+        "version": "1.0.0",
+        "lockfileVersion": 3,
+        "requires": true,
+        "packages": {
+            "": { "name": "fixture", "version": "1.0.0", "dependencies": { "left-pad": "1.3.0" } },
+            "node_modules/left-pad": {
+                "version": "1.3.0",
+                "resolved": resolved,
+                "integrity": integrity,
+                "license": "WTFPL"
+            }
+        }
+    });
+    let mut bytes = serde_json::to_vec_pretty(&lock).unwrap();
+    bytes.push(b'\n');
+    std::fs::write(root.join("package-lock.json"), bytes).unwrap();
+    project
+}
+
+/// The npm registry's version document for the upstream restore.
+async fn mock_registry(p: &Project) {
+    Mock::given(method("GET"))
+        .and(path("/left-pad/1.3.0"))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+            "name": "left-pad",
+            "version": "1.3.0",
+            "dist": {
+                "tarball": p.upstream_tarball(),
+                "integrity": UPSTREAM_INTEGRITY,
+                "shasum": "0000000000000000000000000000000000000000"
+            }
+        })))
+        .mount(&p.server)
+        .await;
+}
+
+/// `GET patches/view/<uuid>`: the record, with the patched blob inline.
+async fn mock_view(p: &Project) {
+    let before = compute_git_sha256_from_bytes(ORIG_INDEX);
+    let after = compute_git_sha256_from_bytes(PATCHED_INDEX);
+    Mock::given(method("GET"))
+        .and(path(format!("/v0/orgs/{ORG}/patches/view/{UUID}")))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+            "uuid": UUID,
+            "purl": PURL,
+            "publishedAt": "2026-01-01T00:00:00Z",
+            "files": {
+                "package/index.js": {
+                    "beforeHash": before,
+                    "afterHash": after,
+                    "blobContent": base64::engine::general_purpose::STANDARD.encode(PATCHED_INDEX)
+                }
+            },
+            "vulnerabilities": {},
+            "description": "eject fixture",
+            "license": "MIT",
+            "tier": "free"
+        })))
+        .mount(&p.server)
+        .await;
+}
+
+fn find_event<'a>(env: &'a Value, action: &str, code: Option<&str>) -> &'a Value {
+    env["events"]
+        .as_array()
+        .and_then(|events| {
+            events
+                .iter()
+                .find(|e| e["action"] == action && code.is_none_or(|c| e["errorCode"] == c))
+        })
+        .unwrap_or_else(|| panic!("no `{action}` event (errorCode={code:?}) in:\n{env:#}"))
+}
+
+/// (1) + (2): eject vendors the hosted pin into `.socket/vendor/`, rewires
+/// the lock to the vendored artifact, writes no hosted ledger and no
+/// manifest; `vendor --revert` then returns the lock to the UPSTREAM
+/// registry entry (registry tarball + upstream integrity), not the hosted
+/// URL.
+#[tokio::test]
+async fn eject_vendors_hosted_pins_and_revert_returns_to_upstream() {
+    let p = hosted_project(true).await;
+    mock_registry(&p).await;
+    mock_view(&p).await;
+
+    let (code, env) = p.run_json(&["vendor"]);
+    assert_eq!(code, 0, "eject must succeed: {env:#}");
+    let applied = find_event(&env, "applied", None);
+    assert_eq!(applied["purl"], PURL, "{env:#}");
+    // The eject restores upstream as its own planned step before vendoring,
+    // so the per-purl takeover warning never fires.
+    assert!(
+        !env.to_string().contains("vendor_takeover_reverted_redirect"),
+        "{env:#}"
+    );
+    assert!(
+        p.artifact().is_file(),
+        "the artifact lands in .socket/vendor/"
+    );
+    let lock = p.lock();
+    let entry = &lock["packages"]["node_modules/left-pad"];
+    let resolved = entry["resolved"].as_str().unwrap_or_default();
+    assert!(
+        resolved.contains(&format!(".socket/vendor/npm/{UUID}/left-pad-1.3.0.tgz")),
+        "the lock is wired to the vendored artifact: {lock:#}"
+    );
+    assert!(
+        !String::from_utf8_lossy(&p.lock_bytes()).contains(&p.hosted_url()),
+        "no hosted residue: {lock:#}"
+    );
+    assert!(!p.redirect_state().exists(), "no hosted ledger is written");
+    assert!(
+        !p.root().join(".socket/manifest.json").exists(),
+        "an eject is manifest-free"
+    );
+    let state: Value =
+        serde_json::from_slice(&std::fs::read(p.root().join(".socket/vendor/state.json")).unwrap())
+            .unwrap();
+    assert!(
+        state["entries"].get(PURL).is_some(),
+        "the vendor ledger tracks the ejected purl: {state:#}"
+    );
+
+    // A re-run is a no-op: nothing is hosted any more, so there is nothing
+    // to eject (the no-manifest path), and the lock stays vendored.
+    let vendored = p.lock_bytes();
+    let (code, env) = p.run_json(&["vendor"]);
+    assert_eq!(code, 0, "{env:#}");
+    assert_eq!(env["status"], "noManifest", "{env:#}");
+    assert_eq!(p.lock_bytes(), vendored);
+
+    let (code, env) = p.run_json(&["vendor", "--revert"]);
+    assert_eq!(code, 0, "revert must succeed: {env:#}");
+    let lock = p.lock();
+    let entry = &lock["packages"]["node_modules/left-pad"];
+    assert_eq!(
+        entry["resolved"],
+        p.upstream_tarball(),
+        "revert lands on the upstream registry tarball: {lock:#}"
+    );
+    assert_eq!(entry["integrity"], UPSTREAM_INTEGRITY, "{lock:#}");
+    assert!(!p.artifact().exists(), "the artifact is removed");
+    assert!(!p.redirect_state().exists());
+}
+
+/// Human eject: the first line announces the eject.
+#[tokio::test]
+async fn eject_human_output_announces_the_eject() {
+    let p = hosted_project(true).await;
+    mock_registry(&p).await;
+    mock_view(&p).await;
+
+    let (code, stdout, stderr) = p.run(&["vendor", "--dry-run"]);
+    assert_eq!(code, 0, "stdout:\n{stdout}\nstderr:\n{stderr}");
+    assert!(
+        stdout
+            .lines()
+            .next()
+            .is_some_and(|l| l.starts_with("Would eject 1 hosted package into .socket/vendor/")),
+        "dry-run first line: {stdout}"
+    );
+    assert!(!p.artifact().exists(), "a dry run vendors nothing");
+
+    let (code, stdout, stderr) = p.run(&["vendor"]);
+    assert_eq!(code, 0, "stdout:\n{stdout}\nstderr:\n{stderr}");
+    assert!(
+        stdout
+            .lines()
+            .next()
+            .is_some_and(|l| l.starts_with("Ejecting 1 hosted package into .socket/vendor/")),
+        "first line: {stdout}"
+    );
+    assert!(p.artifact().is_file());
+}
+
+/// (3): a failed view fetch is a `patch_fetch_failed` failure and exit 1;
+/// the hosted pin is left exactly as found.
+#[tokio::test]
+async fn eject_view_fetch_failure_is_patch_fetch_failed() {
+    let p = hosted_project(true).await;
+    mock_registry(&p).await;
+    Mock::given(method("GET"))
+        .and(path(format!("/v0/orgs/{ORG}/patches/view/{UUID}")))
+        .respond_with(ResponseTemplate::new(500))
+        .mount(&p.server)
+        .await;
+    let before = p.lock_bytes();
+
+    let (code, env) = p.run_json(&["vendor"]);
+    assert_eq!(code, 1, "{env:#}");
+    let failed = find_event(&env, "failed", Some("patch_fetch_failed"));
+    assert_eq!(failed["purl"], PURL, "{env:#}");
+    assert_eq!(p.lock_bytes(), before, "the hosted pin stays as found");
+    assert!(!p.artifact().exists(), "nothing is vendored");
+    assert!(!p.redirect_state().exists());
+}
+
+/// (4): no manifest and no hosted pins — the old calm no-op: exit 0,
+/// `noManifest`, nothing written, no API call.
+#[tokio::test]
+async fn no_manifest_and_no_hosted_pins_is_a_noop() {
+    let p = hosted_project(false).await;
+    let before = p.lock_bytes();
+
+    let (code, env) = p.run_json(&["vendor"]);
+    assert_eq!(code, 0, "{env:#}");
+    assert_eq!(env["status"], "noManifest", "{env:#}");
+    assert_eq!(p.lock_bytes(), before);
+    assert!(!p.root().join(".socket").exists(), "nothing is created");
+    assert!(
+        p.server
+            .received_requests()
+            .await
+            .unwrap_or_default()
+            .is_empty(),
+        "the no-op never talks to the API or the registry"
+    );
+
+    let (code, stdout, stderr) = p.run(&["vendor"]);
+    assert_eq!(code, 0, "stdout:\n{stdout}\nstderr:\n{stderr}");
+    assert!(
+        stdout.contains("No manifest found, nothing to vendor."),
+        "{stdout}"
+    );
+}
diff --git a/crates/socket-patch-cli/tests/vendor_eject_bun_lockb.rs b/crates/socket-patch-cli/tests/vendor_eject_bun_lockb.rs
new file mode 100644
index 00000000..0d64308e
--- /dev/null
+++ b/crates/socket-patch-cli/tests/vendor_eject_bun_lockb.rs
@@ -0,0 +1,391 @@
+//! v5 vendor over a HOSTED binary `bun.lockb` (Bun <= 1.1.x's default lock,
+//! and the legacy lock Bun 1.2 keeps reading).
+//!
+//! Hosted mode keeps no ledger, so vendoring over a hosted pin first
+//! restores the pin's upstream registry entry — for a binary lock, the
+//! native codec rebuilds Bun's npm registry record from the registry's
+//! `dist.tarball` / `dist.integrity`. Both entry points are covered: the
+//! per-purl takeover (`vendor` with the patch record staged) and the eject
+//! (`vendor` in a manifest-less hosted project). Each vendors, records the
+//! REGISTRY record as the vendor ledger's pre-vendor original, and
+//! `vendor --revert` returns the exact pre-hosted bytes (a format-1 lock the
+//! hosted rewrite promoted is demoted back; a lock whose workspace behaviors
+//! it normalized is refused with the checkout remedy). `rollback` of the
+//! hosted pin still refuses with the `git checkout -- bun.lockb` remedy, as
+//! does an offline vendor (the registry cannot be asked).
+//!
+//! The locks are real Bun-written fixtures
+//! (`socket-patch-core/tests/fixtures/bun-lockb`), wired hosted by the
+//! production binary rewriter; no `bun` binary is needed. Every run goes
+//! through the built binary with a scrubbed environment: the API, the npm
+//! registry (`SOCKET_NPM_REGISTRY`) and the patch-server origin
+//! (`SOCKET_PATCH_SERVER_URL`) all point at a wiremock.
+
+use std::path::Path;
+use std::process::Command;
+
+use base64::Engine as _;
+use serde_json::{json, Value};
+use socket_patch_core::hash::git_sha256::compute_git_sha256_from_bytes;
+use socket_patch_core::patch::redirect::{rewrite_bun_binary, DepOverride, RewriteResult};
+use wiremock::matchers::{method, path};
+use wiremock::{Mock, MockServer, ResponseTemplate};
+
+const ORG: &str = "test-org";
+const UUID: &str = "9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f";
+const GRANT: &str = "55555555-5555-4555-8555-555555555555";
+const PURL: &str = "pkg:npm/minimist@1.2.2";
+const ORIG_INDEX: &[u8] = b"module.exports = () => 'orig';\n";
+const PATCHED_INDEX: &[u8] = b"module.exports = () => 'patched';\n";
+/// The public registry's `dist` for minimist@1.2.2 — what every fixture pins.
+const UPSTREAM_TARBALL: &str = "https://registry.npmjs.org/minimist/-/minimist-1.2.2.tgz";
+const UPSTREAM_INTEGRITY: &str =
+    "sha512-rIqbOrKb8GJmx/5bc2M0QchhUouMXSpd1RTclXsB41JdL+VtnojfaJR+h7F9k18/4kHUsBFgk80Uk+q569vjPA==";
+
+fn fixture(dir: &str, file: &str) -> Vec<u8> {
+    std::fs::read(
+        Path::new(env!("CARGO_MANIFEST_DIR"))
+            .join("../socket-patch-core/tests/fixtures/bun-lockb")
+            .join(dir)
+            .join(file),
+    )
+    .unwrap()
+}
+
+struct Project {
+    tmp: tempfile::TempDir,
+    server: MockServer,
+    /// The Bun-written lock before the hosted rewrite.
+    pristine: Vec<u8>,
+}
+
+impl Project {
+    fn root(&self) -> &Path {
+        self.tmp.path()
+    }
+
+    fn lock(&self) -> Vec<u8> {
+        assert!(
+            !self.root().join("bun.lock").exists(),
+            "the CLI must never write a text bun.lock"
+        );
+        std::fs::read(self.root().join("bun.lockb")).unwrap()
+    }
+
+    fn hosted_url(&self) -> String {
+        format!(
+            "{}/patch/npm/minimist/1.2.2/{GRANT}/{UUID}/minimist-1.2.2.tgz",
+            self.server.uri()
+        )
+    }
+
+    fn run_json(&self, args: &[&str]) -> (i32, Value) {
+        let mut cmd = Command::new(env!("CARGO_BIN_EXE_socket-patch"));
+        cmd.args(args)
+            .args(["--json", "--cwd"])
+            .arg(self.root())
+            .current_dir(self.root());
+        for (key, _) in std::env::vars() {
+            if key.starts_with("SOCKET_") {
+                cmd.env_remove(key);
+            }
+        }
+        let uri = self.server.uri();
+        cmd.env("SOCKET_TELEMETRY_DISABLED", "1")
+            .env("SOCKET_API_URL", &uri)
+            .env("SOCKET_API_TOKEN", "fake-token")
+            .env("SOCKET_ORG_SLUG", ORG)
+            .env("SOCKET_NPM_REGISTRY", &uri)
+            .env("SOCKET_PATCH_SERVER_URL", &uri)
+            .env("SOCKET_VENDOR_SOURCE", "build");
+        let out = cmd.output().expect("spawn socket-patch");
+        let stdout = String::from_utf8_lossy(&out.stdout);
+        let env = serde_json::from_str(&stdout).unwrap_or_else(|e| {
+            panic!(
+                "--json must emit an envelope: {e}\nstdout:\n{stdout}\nstderr:\n{}",
+                String::from_utf8_lossy(&out.stderr)
+            )
+        });
+        (out.status.code().unwrap_or(-1), env)
+    }
+}
+
+fn record() -> Value {
+    json!({
+        "uuid": UUID,
+        "purl": PURL,
+        "exportedAt": "2026-01-01T00:00:00Z",
+        "publishedAt": "2026-01-01T00:00:00Z",
+        "files": {
+            "package/index.js": {
+                "beforeHash": compute_git_sha256_from_bytes(ORIG_INDEX),
+                "afterHash": compute_git_sha256_from_bytes(PATCHED_INDEX),
+            }
+        },
+        "vulnerabilities": {},
+        "description": "binary lock takeover fixture",
+        "license": "MIT",
+        "tier": "free"
+    })
+}
+
+/// A project whose Bun-`writer`-written bun.lockb pins minimist@1.2.2 to the
+/// mock hosted tarball (what `scan --mode hosted` leaves behind), with the
+/// pristine package installed and the registry + record view mocked.
+async fn hosted_project(writer: &str) -> Project {
+    let server = MockServer::start().await;
+    let tmp = tempfile::tempdir().unwrap();
+    let project = Project {
+        tmp,
+        server,
+        pristine: fixture(writer, "bun.lockb"),
+    };
+    let root = project.root();
+    std::fs::write(root.join("package.json"), fixture(writer, "package.json")).unwrap();
+    for (name, version) in [("minimist", "1.2.2"), ("is-number", "7.0.0")] {
+        let pkg = root.join("node_modules").join(name);
+        std::fs::create_dir_all(&pkg).unwrap();
+        std::fs::write(
+            pkg.join("package.json"),
+            format!(r#"{{"name":"{name}","version":"{version}"}}"#),
+        )
+        .unwrap();
+        std::fs::write(pkg.join("index.js"), ORIG_INDEX).unwrap();
+    }
+    let dep: DepOverride = serde_json::from_value(json!({
+        "ecosystem": "npm",
+        "name": "minimist",
+        "version": "1.2.2",
+        "token": GRANT,
+        "patchUuid": UUID,
+        "artifactUrl": project.hosted_url(),
+        "integrity": { "sha512": format!(
+            "sha512-{}", base64::engine::general_purpose::STANDARD.encode([42u8; 64])) }
+    }))
+    .unwrap();
+    let mut rewrite = RewriteResult::default();
+    rewrite_bun_binary(&project.pristine, &[dep], &mut rewrite);
+    assert!(rewrite.warnings.is_empty(), "{:?}", rewrite.warnings);
+    std::fs::write(root.join("bun.lockb"), &rewrite.binary_files["bun.lockb"]).unwrap();
+
+    Mock::given(method("GET"))
+        .and(path("/minimist/1.2.2"))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+            "name": "minimist",
+            "version": "1.2.2",
+            "dist": { "tarball": UPSTREAM_TARBALL, "integrity": UPSTREAM_INTEGRITY }
+        })))
+        .mount(&project.server)
+        .await;
+    let mut view = record();
+    view["files"]["package/index.js"]["blobContent"] =
+        json!(base64::engine::general_purpose::STANDARD.encode(PATCHED_INDEX));
+    Mock::given(method("GET"))
+        .and(path(format!("/v0/orgs/{ORG}/patches/view/{UUID}")))
+        .respond_with(ResponseTemplate::new(200).set_body_json(view))
+        .mount(&project.server)
+        .await;
+    project
+}
+
+/// `.socket/manifest.json` + the after-hash blob: the per-purl takeover
+/// (instead of the manifest-less eject).
+fn stage_record(root: &Path) {
+    let socket = root.join(".socket");
+    std::fs::create_dir_all(socket.join("blobs")).unwrap();
+    std::fs::write(
+        socket.join("manifest.json"),
+        serde_json::to_vec_pretty(&json!({ "patches": { PURL: record() } })).unwrap(),
+    )
+    .unwrap();
+    std::fs::write(
+        socket
+            .join("blobs")
+            .join(compute_git_sha256_from_bytes(PATCHED_INDEX)),
+        PATCHED_INDEX,
+    )
+    .unwrap();
+}
+
+fn codes(env: &Value) -> Vec<String> {
+    let mut out = Vec::new();
+    for key in ["events", "warnings"] {
+        for e in env[key].as_array().into_iter().flatten() {
+            for field in ["errorCode", "code"] {
+                if let Some(c) = e[field].as_str() {
+                    out.push(c.to_string());
+                }
+            }
+        }
+    }
+    out
+}
+
+/// The vendored project's shared assertions: the lock is wired to the
+/// committed artifact with no hosted residue, and the vendor ledger's
+/// recorded original is the REGISTRY record.
+fn assert_vendored(p: &Project, env: &Value) {
+    let lock = p.lock();
+    let text = String::from_utf8_lossy(&lock);
+    assert!(
+        text.contains(&format!(".socket/vendor/npm/{UUID}/minimist-1.2.2.tgz")),
+        "bun.lockb is wired to the vendored artifact: {env:#}"
+    );
+    assert!(
+        !text.contains(&p.server.uri()) && !text.contains(GRANT),
+        "no hosted residue is left in bun.lockb"
+    );
+    assert!(p
+        .root()
+        .join(format!(".socket/vendor/npm/{UUID}/minimist-1.2.2.tgz"))
+        .is_file());
+    let state: Value =
+        serde_json::from_slice(&std::fs::read(p.root().join(".socket/vendor/state.json")).unwrap())
+            .unwrap();
+    let original = state["entries"][PURL]["wiring"]
+        .as_array()
+        .and_then(|w| w.iter().find(|r| r["kind"] == "bun_lockb_package"))
+        .map(|r| r["original"].clone())
+        .unwrap_or_else(|| panic!("bun_lockb_package wiring: {state:#}"));
+    assert_eq!(original["name"], "minimist", "{original}");
+    assert_eq!(original["version"], "1.2.2", "{original}");
+    assert_eq!(original["resolution"], UPSTREAM_TARBALL, "{original}");
+    assert_eq!(original["integrity"], UPSTREAM_INTEGRITY, "{original}");
+}
+
+/// Bun 0.1.1 / 0.1.6 (binary format 1, which the hosted rewrite promotes to
+/// format 2 and the takeover's restore demotes again), 0.8.1 (uninitialized
+/// record padding), 1.1.38 (the last binary-only writer) and 1.2.0 (the
+/// legacy lock Bun 1.2 keeps): the takeover vendors over the hosted pin, and
+/// the revert gives back the pre-hosted bytes.
+#[tokio::test]
+async fn takeover_vendors_over_a_hosted_bun_lockb_and_reverts_exactly() {
+    for writer in ["0.1.1", "0.1.6", "0.8.1", "1.1.38", "1.2.0"] {
+        let p = hosted_project(writer).await;
+        stage_record(p.root());
+        let hosted = p.lock();
+
+        let (code, env) = p.run_json(&["vendor", "--dry-run"]);
+        assert_eq!(code, 0, "{writer}: dry run: {env:#}");
+        assert!(
+            codes(&env)
+                .iter()
+                .any(|c| c == "vendor_would_revert_redirect"),
+            "{writer}: {env:#}"
+        );
+        assert_eq!(p.lock(), hosted, "{writer}: a dry run writes nothing");
+
+        let (code, env) = p.run_json(&["vendor"]);
+        assert_eq!(code, 0, "{writer}: vendor over the hosted pin: {env:#}");
+        assert_eq!(env["status"], "success", "{writer}: {env:#}");
+        assert_eq!(env["summary"]["applied"], 1, "{writer}: {env:#}");
+        let codes = codes(&env);
+        assert!(
+            codes
+                .iter()
+                .any(|c| c == "vendor_takeover_reverted_redirect"),
+            "{writer}: {env:#}"
+        );
+        assert!(
+            !codes.iter().any(|c| c == "redirect_revert_failed"),
+            "{writer}: {env:#}"
+        );
+        assert_vendored(&p, &env);
+
+        let (code, env) = p.run_json(&["vendor", "--revert"]);
+        assert_eq!(code, 0, "{writer}: revert: {env:#}");
+        assert!(
+            p.lock() == p.pristine,
+            "{writer}: the revert restores the pre-hosted bun.lockb byte for byte"
+        );
+    }
+}
+
+/// The manifest-less eject over a hosted bun.lockb.
+#[tokio::test]
+async fn eject_vendors_a_hosted_bun_lockb_and_reverts_exactly() {
+    let p = hosted_project("1.1.38").await;
+    let (code, env) = p.run_json(&["vendor"]);
+    assert_eq!(code, 0, "eject must succeed: {env:#}");
+    assert_eq!(env["summary"]["applied"], 1, "{env:#}");
+    assert_vendored(&p, &env);
+    assert!(!p.root().join(".socket/manifest.json").exists());
+    let (code, env) = p.run_json(&["vendor", "--revert"]);
+    assert_eq!(code, 0, "revert: {env:#}");
+    assert!(p.lock() == p.pristine, "exact pre-hosted bytes");
+}
+
+/// A hosted lock whose workspace dependency behaviors the rewrite had to
+/// normalize cannot be given back byte for byte: the takeover refuses with
+/// the checkout remedy (dry and wet alike) and writes nothing.
+#[tokio::test]
+async fn takeover_refuses_a_workspace_normalized_hosted_bun_lockb() {
+    let p = hosted_project("1.1.45-extensions").await;
+    stage_record(p.root());
+    let hosted = p.lock();
+    for extra in [&["--dry-run"][..], &[][..]] {
+        let mut args = vec!["vendor"];
+        args.extend_from_slice(extra);
+        let (code, env) = p.run_json(&args);
+        assert_eq!(code, 1, "{extra:?}: {env:#}");
+        let refused = env["events"]
+            .as_array()
+            .and_then(|events| {
+                events
+                    .iter()
+                    .find(|e| e["errorCode"] == "redirect_revert_failed")
+            })
+            .unwrap_or_else(|| panic!("expected redirect_revert_failed: {env:#}"));
+        assert!(
+            refused["error"].as_str().is_some_and(|e| e
+                .contains("workspace dependency behaviors")
+                && e.contains("git checkout -- bun.lockb")),
+            "{env:#}"
+        );
+        assert_eq!(p.lock(), hosted, "{extra:?}: a refused vendor writes nothing");
+        assert!(!p.root().join(".socket/vendor").exists());
+    }
+}
+
+/// `rollback` of the hosted pin, and a vendor that cannot reach the
+/// registry, refuse with the checkout remedy and write nothing.
+#[tokio::test]
+async fn rollback_and_offline_vendor_refuse_with_the_checkout_remedy() {
+    let p = hosted_project("1.1.38").await;
+    stage_record(p.root());
+    let hosted = p.lock();
+
+    let (code, env) = p.run_json(&["vendor", "--offline"]);
+    assert_eq!(code, 1, "{env:#}");
+    let refused = env["events"]
+        .as_array()
+        .and_then(|events| {
+            events
+                .iter()
+                .find(|e| e["errorCode"] == "redirect_revert_failed")
+        })
+        .unwrap_or_else(|| panic!("expected redirect_revert_failed: {env:#}"));
+    assert!(
+        refused["error"]
+            .as_str()
+            .is_some_and(|e| e.contains("offline") && e.contains("git checkout -- bun.lockb")),
+        "{env:#}"
+    );
+    assert_eq!(p.lock(), hosted, "a refused vendor writes nothing");
+    assert!(!p.root().join(".socket/vendor").exists());
+
+    let (code, env) = p.run_json(&["rollback", "--yes"]);
+    assert_eq!(code, 1, "{env:#}");
+    let failed = env["hosted"]["failed"]
+        .as_array()
+        .cloned()
+        .unwrap_or_default();
+    assert!(
+        failed.iter().any(|f| f["purl"] == PURL
+            && f["error"]
+                .as_str()
+                .is_some_and(|e| e.contains("git checkout -- bun.lockb"))),
+        "{env:#}"
+    );
+    assert_eq!(p.lock(), hosted, "a refused rollback writes nothing");
+}
diff --git a/crates/socket-patch-cli/tests/vendor_eject_fresh_checkout.rs b/crates/socket-patch-cli/tests/vendor_eject_fresh_checkout.rs
new file mode 100644
index 00000000..792854c4
--- /dev/null
+++ b/crates/socket-patch-cli/tests/vendor_eject_fresh_checkout.rs
@@ -0,0 +1,358 @@
+//! v5 WS2 eject from a FRESH hosted checkout: only the committed manifests
+//! and lockfiles exist — no `node_modules`, no Cargo home, no `.socket/`.
+//!
+//! The eject is lockfile-only by contract: it restores each hosted pin's
+//! upstream registry entry first, so the vendor engine sees an ordinary
+//! registry pin with a registry checksum and fetches the pristine source
+//! from the registry (verified against that checksum) instead of requiring
+//! an installed tree. Every registry and API endpoint is a wiremock.
+
+use std::io::Write as _;
+use std::path::Path;
+use std::process::Command;
+
+use base64::Engine as _;
+use serde_json::{json, Value};
+use sha2::{Digest, Sha256, Sha512};
+use socket_patch_core::hash::git_sha256::compute_git_sha256_from_bytes;
+use wiremock::matchers::{method, path};
+use wiremock::{Mock, MockServer, ResponseTemplate};
+
+const ORG: &str = "test-org";
+
+/// A tar.gz with every file under a single `{prefix}/` top-level dir (an
+/// npm tarball uses `package/`, a `.crate` uses `{name}-{version}/`).
+fn tgz(prefix: &str, files: &[(&str, &[u8])]) -> Vec<u8> {
+    let mut builder = tar::Builder::new(Vec::new());
+    for (rel, content) in files {
+        let mut header = tar::Header::new_gnu();
+        header.set_size(content.len() as u64);
+        header.set_mode(0o644);
+        header.set_cksum();
+        builder
+            .append_data(&mut header, format!("{prefix}/{rel}"), *content)
+            .unwrap();
+    }
+    let mut enc = flate2::write::GzEncoder::new(Vec::new(), flate2::Compression::default());
+    enc.write_all(&builder.into_inner().unwrap()).unwrap();
+    enc.finish().unwrap()
+}
+
+async fn mock_view(server: &MockServer, uuid: &str, purl: &str, file: &str, orig: &[u8], patched: &[u8]) {
+    Mock::given(method("GET"))
+        .and(path(format!("/v0/orgs/{ORG}/patches/view/{uuid}")))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+            "uuid": uuid,
+            "purl": purl,
+            "publishedAt": "2026-01-01T00:00:00Z",
+            "files": {
+                file: {
+                    "beforeHash": compute_git_sha256_from_bytes(orig),
+                    "afterHash": compute_git_sha256_from_bytes(patched),
+                    "blobContent": base64::engine::general_purpose::STANDARD.encode(patched)
+                }
+            },
+            "vulnerabilities": {},
+            "description": "eject fixture",
+            "license": "MIT",
+            "tier": "free"
+        })))
+        .mount(server)
+        .await;
+}
+
+/// Run the binary with every ambient `SOCKET_*` var scrubbed, an empty
+/// `CARGO_HOME`, and the API / registries / patch origin on `server`.
+fn run_json(root: &Path, server: &MockServer, args: &[&str]) -> (i32, Value) {
+    run_json_with(root, server, args, &[])
+}
+
+fn run_json_with(
+    root: &Path,
+    server: &MockServer,
+    args: &[&str],
+    extra: &[(&str, String)],
+) -> (i32, Value) {
+    let cargo_home = root.join("../cargo-home");
+    std::fs::create_dir_all(&cargo_home).unwrap();
+    let mut cmd = Command::new(env!("CARGO_BIN_EXE_socket-patch"));
+    cmd.args(args)
+        .arg("--json")
+        .arg("--cwd")
+        .arg(root)
+        .current_dir(root);
+    for (key, _) in std::env::vars() {
+        if key.starts_with("SOCKET_") {
+            cmd.env_remove(key);
+        }
+    }
+    let uri = server.uri();
+    let out = cmd
+        .env("SOCKET_TELEMETRY_DISABLED", "1")
+        .env("SOCKET_API_URL", &uri)
+        .env("SOCKET_API_TOKEN", "fake-token")
+        .env("SOCKET_ORG_SLUG", ORG)
+        .env("SOCKET_NPM_REGISTRY", &uri)
+        .env("SOCKET_CRATES_INDEX", format!("{uri}/index"))
+        .env("SOCKET_CRATES_REGISTRY", format!("{uri}/crates"))
+        .env("SOCKET_PATCH_SERVER_URL", &uri)
+        .env("SOCKET_VENDOR_SOURCE", "build")
+        .env("CARGO_HOME", &cargo_home)
+        .envs(extra.iter().map(|(k, v)| (*k, v.as_str())))
+        .output()
+        .expect("spawn socket-patch");
+    let stdout = String::from_utf8_lossy(&out.stdout);
+    let env = serde_json::from_str(&stdout).unwrap_or_else(|e| {
+        panic!(
+            "--json must emit an envelope: {e}\nstdout:\n{stdout}\nstderr:\n{}",
+            String::from_utf8_lossy(&out.stderr)
+        )
+    });
+    (out.status.code().unwrap_or(-1), env)
+}
+
+fn applied(env: &Value, purl: &str) -> bool {
+    env["events"]
+        .as_array()
+        .is_some_and(|events| events.iter().any(|e| e["action"] == "applied" && e["purl"] == purl))
+}
+
+/// npm: a hosted package-lock.json with NO `node_modules`. The pristine
+/// tarball comes from the registry the restored entry names.
+#[tokio::test]
+async fn npm_eject_needs_no_installed_tree() {
+    const UUID: &str = "9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f";
+    const PURL: &str = "pkg:npm/left-pad@1.3.0";
+    const ORIG: &[u8] = b"module.exports = () => 'orig';\n";
+    const PATCHED: &[u8] = b"module.exports = () => 'patched';\n";
+    let server = MockServer::start().await;
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path().join("proj");
+    std::fs::create_dir_all(&root).unwrap();
+
+    let tarball = tgz(
+        "package",
+        &[
+            ("package.json", br#"{"name":"left-pad","version":"1.3.0"}"#),
+            ("index.js", ORIG),
+        ],
+    );
+    let integrity = format!(
+        "sha512-{}",
+        base64::engine::general_purpose::STANDARD.encode(Sha512::digest(&tarball))
+    );
+    let upstream = format!("{}/left-pad/-/left-pad-1.3.0.tgz", server.uri());
+    Mock::given(method("GET"))
+        .and(path("/left-pad/1.3.0"))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+            "name": "left-pad",
+            "version": "1.3.0",
+            "dist": { "tarball": upstream, "integrity": integrity }
+        })))
+        .mount(&server)
+        .await;
+    Mock::given(method("GET"))
+        .and(path("/left-pad/-/left-pad-1.3.0.tgz"))
+        .respond_with(ResponseTemplate::new(200).set_body_bytes(tarball))
+        .mount(&server)
+        .await;
+    mock_view(&server, UUID, PURL, "package/index.js", ORIG, PATCHED).await;
+
+    std::fs::write(
+        root.join("package.json"),
+        br#"{"name":"fixture","version":"1.0.0","private":true,"dependencies":{"left-pad":"1.3.0"}}"#,
+    )
+    .unwrap();
+    let hosted = format!(
+        "{}/patch/npm/left-pad/1.3.0/55555555-5555-4555-8555-555555555555/{UUID}/left-pad-1.3.0.tgz",
+        server.uri()
+    );
+    let lock = json!({
+        "name": "fixture", "version": "1.0.0", "lockfileVersion": 3, "requires": true,
+        "packages": {
+            "": { "name": "fixture", "version": "1.0.0", "dependencies": { "left-pad": "1.3.0" } },
+            "node_modules/left-pad": {
+                "version": "1.3.0", "resolved": hosted,
+                "integrity": "sha512-HOSTEDpatchedHOSTEDpatched==", "license": "WTFPL"
+            }
+        }
+    });
+    std::fs::write(
+        root.join("package-lock.json"),
+        serde_json::to_string_pretty(&lock).unwrap() + "\n",
+    )
+    .unwrap();
+    assert!(!root.join("node_modules").exists());
+
+    let (code, env) = run_json(&root, &server, &["vendor"]);
+    assert_eq!(code, 0, "a fresh hosted checkout ejects: {env:#}");
+    assert!(applied(&env, PURL), "{env:#}");
+    let artifact = root.join(format!(".socket/vendor/npm/{UUID}/left-pad-1.3.0.tgz"));
+    assert!(artifact.is_file(), "the artifact lands in .socket/vendor/");
+    let lock = std::fs::read_to_string(root.join("package-lock.json")).unwrap();
+    assert!(lock.contains(&format!(".socket/vendor/npm/{UUID}/left-pad-1.3.0.tgz")), "{lock}");
+    assert!(!lock.contains(&hosted), "no hosted residue: {lock}");
+}
+
+/// cargo: the hosted `Cargo.lock` / `Cargo.toml` pin with an EMPTY Cargo
+/// home. The restore re-resolves the crates.io checksum from the sparse
+/// index; the pristine `.crate` is downloaded and verified against it.
+#[tokio::test]
+async fn cargo_eject_needs_no_cargo_home() {
+    const UUID: &str = "55555555-5555-5555-5555-555555555555";
+    const TOKEN: &str = "11111111-1111-1111-1111-111111111111";
+    const PURL: &str = "pkg:cargo/serde@1.0.190";
+    const ORIG: &[u8] = b"pub fn serde() {}\n";
+    const PATCHED: &[u8] = b"pub fn serde() { /* patched */ }\n";
+    const TOML: &[u8] = b"[package]\nname = \"serde\"\nversion = \"1.0.190\"\n";
+    let server = MockServer::start().await;
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path().join("proj");
+    std::fs::create_dir_all(&root).unwrap();
+
+    let krate = tgz("serde-1.0.190", &[("Cargo.toml", TOML), ("src/lib.rs", ORIG)]);
+    let checksum = hex::encode(Sha256::digest(&krate));
+    Mock::given(method("GET"))
+        .and(path("/index/se/rd/serde"))
+        .respond_with(ResponseTemplate::new(200).set_body_string(
+            json!({"name": "serde", "vers": "1.0.190", "cksum": checksum}).to_string(),
+        ))
+        .mount(&server)
+        .await;
+    Mock::given(method("GET"))
+        .and(path("/crates/serde/serde-1.0.190.crate"))
+        .respond_with(ResponseTemplate::new(200).set_body_bytes(krate))
+        .mount(&server)
+        .await;
+    mock_view(&server, UUID, PURL, "package/src/lib.rs", ORIG, PATCHED).await;
+
+    // What `scan --mode hosted` leaves behind (the redirect golden
+    // `cargo/cargo/basic/expected`, minus the unrelated anyhow dep).
+    std::fs::write(
+        root.join("Cargo.toml"),
+        format!(
+            "[package]\nname = \"myapp\"\nversion = \"0.1.0\"\nedition = \"2021\"\n\n\
+             [dependencies]\nserde = {{ version = \"1.0.190\", registry = \"socket-patch-{UUID}\" }}\n"
+        ),
+    )
+    .unwrap();
+    let index = format!("sparse+https://patch.socket.dev/patch-registry/cargo/{TOKEN}/{UUID}/index/");
+    std::fs::write(
+        root.join("Cargo.lock"),
+        format!(
+            "version = 3\n\n[[package]]\nname = \"myapp\"\nversion = \"0.1.0\"\n\
+             dependencies = [\n \"serde\",\n]\n\n[[package]]\nname = \"serde\"\n\
+             version = \"1.0.190\"\nsource = \"{index}\"\nchecksum = \"{}\"\n",
+            "de".repeat(32)
+        ),
+    )
+    .unwrap();
+    std::fs::create_dir_all(root.join("src")).unwrap();
+    std::fs::write(root.join("src/main.rs"), "fn main() {}\n").unwrap();
+
+    let (code, env) = run_json(&root, &server, &["vendor"]);
+    assert_eq!(code, 0, "a fresh hosted cargo checkout ejects: {env:#}");
+    assert!(applied(&env, PURL), "{env:#}");
+    let toml = std::fs::read_to_string(root.join("Cargo.toml")).unwrap();
+    let lock = std::fs::read_to_string(root.join("Cargo.lock")).unwrap();
+    assert!(!toml.contains("socket-patch-"), "hosted registry key removed: {toml}");
+    assert!(!lock.contains("patch.socket.dev"), "no hosted residue: {lock}");
+    assert!(
+        std::fs::read_dir(root.join(".socket/vendor/cargo"))
+            .map(|mut d| d.next().is_some())
+            .unwrap_or(false),
+        "the crate is vendored under .socket/vendor/cargo"
+    );
+}
+
+/// A pure-Python wheel: the unzipped layout is site-packages.
+fn wheel(files: &[(&str, &[u8])]) -> Vec<u8> {
+    let mut zip = zip::ZipWriter::new(std::io::Cursor::new(Vec::new()));
+    let opts = zip::write::SimpleFileOptions::default();
+    for (name, content) in files {
+        zip.start_file(*name, opts).unwrap();
+        zip.write_all(content).unwrap();
+    }
+    zip.finish().unwrap().into_inner()
+}
+
+/// pypi: a hash-pinned hosted `requirements.txt` with NO virtualenv. The
+/// restore re-resolves the release file hash from the PyPI JSON API; the
+/// pristine wheel is downloaded and verified against it.
+#[tokio::test]
+async fn pypi_eject_needs_no_virtualenv() {
+    const UUID: &str = "2b1f6c1e-8d3a-4f6b-9c2d-7e5a9b1c3d11";
+    const PURL: &str = "pkg:pypi/six@1.16.0";
+    const WHEEL: &str = "six-1.16.0-py2.py3-none-any.whl";
+    const ORIG: &[u8] = b"# six\nVERSION = '1.16.0'\n";
+    const PATCHED: &[u8] = b"# six\nVERSION = '1.16.0'\nSAFE = True\n";
+    let server = MockServer::start().await;
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path().join("proj");
+    std::fs::create_dir_all(&root).unwrap();
+
+    let whl = wheel(&[
+        ("six.py", ORIG),
+        (
+            "six-1.16.0.dist-info/METADATA",
+            b"Metadata-Version: 2.1\nName: six\nVersion: 1.16.0\n\nbody\n",
+        ),
+        (
+            "six-1.16.0.dist-info/WHEEL",
+            b"Wheel-Version: 1.0\nRoot-Is-Purelib: true\nTag: py2-none-any\nTag: py3-none-any\n",
+        ),
+        (
+            "six-1.16.0.dist-info/RECORD",
+            b"six.py,,\nsix-1.16.0.dist-info/METADATA,,\nsix-1.16.0.dist-info/WHEEL,,\nsix-1.16.0.dist-info/RECORD,,\n",
+        ),
+    ]);
+    let sha = hex::encode(Sha256::digest(&whl));
+    let size = whl.len();
+    Mock::given(method("GET"))
+        .and(path("/pypi/six/1.16.0/json"))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+            "urls": [{
+                "filename": WHEEL,
+                "url": format!("{}/files/{WHEEL}", server.uri()),
+                "digests": { "sha256": sha },
+                "size": size,
+                "upload_time_iso_8601": "2021-05-05T14:18:17.000000Z"
+            }]
+        })))
+        .mount(&server)
+        .await;
+    Mock::given(method("GET"))
+        .and(path(format!("/files/{WHEEL}")))
+        .respond_with(ResponseTemplate::new(200).set_body_bytes(whl))
+        .mount(&server)
+        .await;
+    mock_view(&server, UUID, PURL, "six.py", ORIG, PATCHED).await;
+
+    let hosted = format!(
+        "https://patch.socket.dev/patch/pypi/six/1.16.0/11111111-1111-1111-1111-111111111111/{UUID}/{WHEEL}"
+    );
+    std::fs::write(
+        root.join("requirements.txt"),
+        // An unpatched hash-pinned sibling: it makes pip's hash-checking
+        // mode derivable, so the hosted line can be restored as `==` + hash.
+        format!(
+            "flask==2.0.1 --hash=sha256:{}\nsix @ {hosted} --hash=sha256:{}\n",
+            "cd".repeat(32),
+            "ab".repeat(32)
+        ),
+    )
+    .unwrap();
+
+    let (code, env) = run_json_with(&root, &server, &["vendor"], &[(
+        "SOCKET_PYPI_JSON_API",
+        format!("{}/pypi", server.uri()),
+    )]);
+    assert_eq!(code, 0, "a fresh hosted pypi checkout ejects: {env:#}");
+    assert!(applied(&env, PURL), "{env:#}");
+    let reqs = std::fs::read_to_string(root.join("requirements.txt")).unwrap();
+    assert!(!reqs.contains("patch.socket.dev"), "no hosted residue: {reqs}");
+    assert!(
+        reqs.contains(&format!(".socket/vendor/pypi/{UUID}/")),
+        "the requirement is wired to the vendored wheel: {reqs}"
+    );
+}
diff --git a/crates/socket-patch-cli/tests/vex_e2e_common/bun.rs b/crates/socket-patch-cli/tests/vex_e2e_common/bun.rs
index 6b495486..f94646f7 100644
--- a/crates/socket-patch-cli/tests/vex_e2e_common/bun.rs
+++ b/crates/socket-patch-cli/tests/vex_e2e_common/bun.rs
@@ -21,15 +21,17 @@
 //!    `(vendored)` marker and exactly the expected vulnerability ids (+ CVE
 //!    aliases); the embedded `apply --vex` (and, vendored, `vendor --vex`)
 //!    attest the same without touching the lock.
-//! 2. `ledgers-deleted` — `.socket/vendor/state.json` and
-//!    `redirect-state.json` deleted too: still attested, now from lockfile
-//!    discovery + the patch API (the view route is hit).
+//! 2. `ledgers-deleted` — `.socket/vendor/state.json` deleted too (a hosted
+//!    flow wrote no ledger at all in v5 — asserted up front): still
+//!    attested, now from lockfile discovery + the patch API (the view route
+//!    is hit).
 //! 3. `offline` — `--offline` with no ledgers: `record_unavailable`, exit 1,
 //!    ZERO requests to the API.
 //! 4. `reverted` — the lock put back to the registry version (ledgers and
 //!    committed artifacts kept, the patched install left in node_modules):
-//!    NOT attested (`redirect_unwired` / `vendor_unwired`), also under
-//!    `--no-verify`.
+//!    NOT attested, also under `--no-verify` — vendored: `vendor_unwired`;
+//!    hosted: nothing is discovered (exit 2 `manifest_not_found`), since the
+//!    lock was the only hosted state.
 //!
 //! Each passed step prints `BUN-VEX <tag> <mode> <step> ok` so a matrix log
 //! reads as a per-version results table.
@@ -61,7 +63,8 @@ impl BunMode {
     }
 
     /// The omission a ledger-backed record gets once the lock no longer
-    /// references it.
+    /// references it (hosted: only a PRE-v5 redirect ledger still earns
+    /// it; v5 hosted flows write no ledger).
     pub fn unwired_reason(self) -> &'static str {
         match self {
             BunMode::Hosted => "redirect_unwired",
@@ -200,6 +203,15 @@ fn matrix<F: FnOnce(&Path)>(project: &Path, scratch: &Path, case: &BunVexCase<'_
     let what = format!("{} {}", case.tag, mode.label());
     let ok = |step: &str| eprintln!("BUN-VEX {} {} {step} ok", case.tag, mode.label());
     let checkout = manifestless_checkout(project, &scratch.join(format!("vex-{}", case.tag)));
+    match mode {
+        BunMode::Hosted => assert_no_hosted_ledger(&checkout, &what),
+        BunMode::Vendored => assert!(
+            checkout
+                .join(socket_patch_core::vendor::VENDOR_STATE_REL)
+                .is_file(),
+            "{what}: the vendored flow must have written its ledger"
+        ),
+    }
     install(&checkout);
     let lock_path = checkout.join(case.lock);
     let wired_lock = std::fs::read(&lock_path).unwrap();
@@ -296,10 +308,6 @@ fn matrix<F: FnOnce(&Path)>(project: &Path, scratch: &Path, case: &BunVexCase<'_
             std::fs::write(path, bytes).unwrap();
         }
     }
-    assert!(
-        ledgers.iter().any(|(_, b)| b.is_some()),
-        "{what}: the flow left no ledger — the reverted step would be vacuous"
-    );
     std::fs::write(&lock_path, &case.registry_lock).unwrap();
     for no_verify in [false, true] {
         let run = VexRun {
@@ -307,12 +315,27 @@ fn matrix<F: FnOnce(&Path)>(project: &Path, scratch: &Path, case: &BunVexCase<'_
             ..online()
         };
         let out = run_vex(&bin, &checkout, &run);
-        assert_eq!(
-            out.code,
-            Some(1),
-            "{what} reverted (no_verify={no_verify}): {out}"
-        );
-        assert_skipped(&out.envelope, case.purl, mode.unwired_reason());
+        match mode {
+            BunMode::Vendored => {
+                assert_eq!(
+                    out.code,
+                    Some(1),
+                    "{what} reverted (no_verify={no_verify}): {out}"
+                );
+                assert_skipped(&out.envelope, case.purl, mode.unwired_reason());
+            }
+            BunMode::Hosted => {
+                assert_eq!(
+                    out.code,
+                    Some(2),
+                    "{what} reverted (no_verify={no_verify}): {out}"
+                );
+                assert_eq!(
+                    out.envelope["error"]["code"], "manifest_not_found",
+                    "{what} reverted (no_verify={no_verify}): no hosted state is left: {out}"
+                );
+            }
+        }
         assert_absent(out.doc.as_ref(), case.purl);
     }
     ok("reverted");
diff --git a/crates/socket-patch-cli/tests/vex_e2e_common/mod.rs b/crates/socket-patch-cli/tests/vex_e2e_common/mod.rs
index dfb2aea7..5d0f27e9 100644
--- a/crates/socket-patch-cli/tests/vex_e2e_common/mod.rs
+++ b/crates/socket-patch-cli/tests/vex_e2e_common/mod.rs
@@ -130,15 +130,68 @@ pub fn seed_legacy_manifest(project: &Path) -> usize {
     seeded
 }
 
-/// Delete both ledgers — `.socket/vendor/state.json` (vendor) and
-/// `.socket/vendor/redirect-state.json` (hosted) — so the lockfile wiring
-/// (+ committed `.socket/vendor/<eco>/<uuid>/` artifacts) is the ONLY
-/// evidence left. Artifacts are kept.
+/// Delete both ledgers — `.socket/vendor/state.json` (vendor) and a PRE-v5
+/// `.socket/vendor/redirect-state.json` (v5 hosted mode writes none) — so
+/// the lockfile wiring (+ committed `.socket/vendor/<eco>/<uuid>/`
+/// artifacts) is the ONLY evidence left. Artifacts are kept.
 pub fn strip_ledgers(project: &Path) {
     remove_if_present(&project.join(socket_patch_core::vendor::VENDOR_STATE_REL));
     remove_if_present(&project.join(socket_patch_core::patch::redirect::REDIRECT_STATE_REL));
 }
 
+/// The pre-v5 hosted ledger's path, relative to the project root. v5
+/// hosted mode never writes it; it is only read, as an extra local record
+/// source, when a checkout still commits one.
+pub const LEGACY_REDIRECT_LEDGER: &str = ".socket/vendor/redirect-state.json";
+
+/// Panic if a hosted run left a `.socket/vendor/redirect-state.json`
+/// behind: v5 hosted mode keeps its state in the lockfiles only.
+pub fn assert_no_hosted_ledger(project: &Path, what: &str) {
+    assert!(
+        !project.join(LEGACY_REDIRECT_LEDGER).exists(),
+        "{what}: v5 hosted mode writes no {LEGACY_REDIRECT_LEDGER}"
+    );
+}
+
+/// Commit a PRE-v5 hosted ledger (`.socket/vendor/redirect-state.json`)
+/// recording `purl` → the patch record carried by `view` (a
+/// [`patch_view`]-shaped API body) — the shape a checkout wired by an
+/// older socket-patch still carries. v5 reads it only as an extra local
+/// record source (so a hosted pin it describes attests offline); it never
+/// writes one.
+pub fn write_legacy_redirect_ledger(project: &Path, purl: &str, view: &Value) {
+    let files: serde_json::Map<String, Value> = view["files"]
+        .as_object()
+        .into_iter()
+        .flatten()
+        .map(|(k, f)| {
+            (
+                k.clone(),
+                serde_json::json!({
+                    "beforeHash": f["beforeHash"],
+                    "afterHash": f["afterHash"],
+                }),
+            )
+        })
+        .collect();
+    let record: socket_patch_core::manifest::schema::PatchRecord =
+        serde_json::from_value(serde_json::json!({
+            "uuid": view["uuid"],
+            "exportedAt": "2026-03-27T00:00:00Z",
+            "files": files,
+            "vulnerabilities": view["vulnerabilities"],
+            "description": view["description"],
+            "license": view["license"],
+            "tier": view["tier"],
+        }))
+        .expect("the view converts to a patch record");
+    let mut state = socket_patch_core::patch::redirect::RedirectState::new();
+    state.records.insert(purl.to_string(), record);
+    let path = project.join(LEGACY_REDIRECT_LEDGER);
+    std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+    std::fs::write(&path, serde_json::to_string_pretty(&state).unwrap()).unwrap();
+}
+
 fn remove_if_present(path: &Path) {
     match std::fs::remove_file(path) {
         Ok(()) => {}
diff --git a/crates/socket-patch-cli/tests/vex_e2e_common/uv.rs b/crates/socket-patch-cli/tests/vex_e2e_common/uv.rs
index a21d8a20..df5ff53a 100644
--- a/crates/socket-patch-cli/tests/vex_e2e_common/uv.rs
+++ b/crates/socket-patch-cli/tests/vex_e2e_common/uv.rs
@@ -49,13 +49,16 @@
 //!    vendored: `--offline` where the release allows) and prove the PATCHED
 //!    bytes are what Python imports;
 //! 4. manifest-less VEX there: (a) standalone `vex` attests the purl with
-//!    the right marker and vulnerability ids; (b) with both ledgers deleted
-//!    it still attests from lockfile discovery + the API record; (c)
-//!    `--offline` without ledgers is `record_unavailable` with ZERO requests;
-//!    (d) the embedded `apply --vex` (+ `vendor --vex` / `scan --redirect
-//!    --vex`) attest too; (e) the wiring reverted to the registry files with
-//!    the ledgers and artifacts left behind, reinstalled pristine by uv, is
-//!    NOT attested — verified or `--no-verify`, online or offline;
+//!    the right marker and vulnerability ids; (b) with the vendor ledger
+//!    deleted (a hosted flow writes none in v5 — asserted) it still attests
+//!    from lockfile discovery + the API record; (c) `--offline` without
+//!    ledgers is `record_unavailable` with ZERO requests; (d) the embedded
+//!    `apply --vex` (+ `vendor --vex` / `scan --redirect --vex`) attest too
+//!    (hosted: online, there is no local record); (e) the wiring reverted to
+//!    the registry files with the ledgers and artifacts left behind,
+//!    reinstalled pristine by uv, is NOT attested — verified or
+//!    `--no-verify`, online or offline (vendored: `vendor_unwired`; hosted:
+//!    nothing is discovered at all);
 //! 5. the lanes with project metadata also run a plain (re-resolving) `uv
 //!    sync` — for a transitive target this is the 0.5.6 boundary: older uv
 //!    re-resolves the override against the registry, reinstalls the
@@ -447,7 +450,12 @@ impl Report<'_> {
 
 // ── filesystem ─────────────────────────────────────────────────────────
 
+/// Copy `src` recursively to `dst`; a missing `src` copies nothing (a
+/// hosted flow commits no `.socket/` in v5).
 pub fn copy_tree(src: &Path, dst: &Path) {
+    if !src.is_dir() {
+        return;
+    }
     std::fs::create_dir_all(dst).unwrap();
     for entry in std::fs::read_dir(src).unwrap().flatten() {
         let to = dst.join(entry.file_name());
@@ -1044,7 +1052,10 @@ pub fn manifestless_matrix(m: &Matrix<'_>, row: &dyn Fn(&str, &str)) {
     attested(&vex(VexRun::online(m.api)), "manifest-deleted");
     // (b) ledgers deleted too: lockfile discovery + the API record.
     let ledgers = snapshot(fresh, &LEDGERS);
-    assert!(!ledgers.is_empty(), "the flow left no ledger");
+    match m.mode {
+        Mode::Hosted => crate::vex_e2e_common::assert_no_hosted_ledger(fresh, "hosted flow"),
+        Mode::Vendored => assert!(!ledgers.is_empty(), "the vendored flow left no ledger"),
+    }
     strip_ledgers(fresh);
     let before = m.api.view_requests(m.uuid);
     let out = vex(VexRun::online(m.api));
@@ -1066,6 +1077,13 @@ pub fn manifestless_matrix(m: &Matrix<'_>, row: &dyn Fn(&str, &str)) {
     // (d) embedded entry points, manifest-less, ledgers back.
     restore(fresh, &ledgers);
     for (label, run) in &m.embedded {
+        let mut run = run.clone();
+        if m.mode == Mode::Hosted && run.offline {
+            // v5 hosted mode keeps no local record: the embedded run
+            // fetches it like the standalone one.
+            run.offline = false;
+            run.proxy_url = Some(m.api.uri());
+        }
         let out = vex(run.clone());
         assert_eq!(out.code, Some(0), "[{label}]:\n{out}");
         assert_attested(out.doc(), m.purl, m.uuid, marker, m.vulns);
@@ -1109,16 +1127,28 @@ pub fn manifestless_matrix(m: &Matrix<'_>, row: &dyn Fn(&str, &str)) {
                 if no_verify { " --no-verify" } else { "" },
                 if online { " online" } else { " offline" }
             );
-            assert_eq!(out.code, Some(1), "[{step}]:\n{out}");
-            assert_not_attested(&out.envelope, m.purl, m.mode.unwired());
+            match m.mode {
+                Mode::Vendored => {
+                    assert_eq!(out.code, Some(1), "[{step}]:\n{out}");
+                    assert_not_attested(&out.envelope, m.purl, m.mode.unwired());
+                }
+                Mode::Hosted => {
+                    assert_eq!(out.code, Some(2), "[{step}]:\n{out}");
+                    assert_eq!(
+                        out.envelope["error"]["code"], "manifest_not_found",
+                        "[{step}]: no hosted state is left:\n{out}"
+                    );
+                }
+            }
         }
     }
+    let why = match m.mode {
+        Mode::Vendored => m.mode.unwired(),
+        Mode::Hosted => "nothing discovered",
+    };
     row(
         "reverted",
-        &format!(
-            "not attested ({}; verified + --no-verify)",
-            m.mode.unwired()
-        ),
+        &format!("not attested ({why}; verified + --no-verify)"),
     );
     restore(fresh, &wired);
 }
@@ -1527,7 +1557,21 @@ pub fn run_lane(suite: &str, uv: &Uv, mode: Mode, lane: Lane) {
         &|step, result| report.row(step, result),
     );
 
-    // ── 6. the real revert restores every wiring file ─────────────────
+    // ── 6. the real revert ────────────────────────────────────────────
+    // Vendored: `vendor --revert` restores every wiring file byte for
+    // byte. Hosted (v5): `rollback` rewrites each pin back to the DEFAULT
+    // upstream registry entry, re-resolved from the registry — or, where
+    // the lock gives it nothing to re-derive the entry's shape from,
+    // refuses that pin (exit 1) and leaves the files alone for a
+    // version-control restore.
+    let wired_files = snapshot(
+        &proj,
+        &built
+            .registry
+            .iter()
+            .map(|(f, _)| f.as_str())
+            .collect::<Vec<_>>(),
+    );
     let out = match mode {
         Mode::Hosted => {
             let uri = patch_server.clone().unwrap();
@@ -1545,6 +1589,10 @@ pub fn run_lane(suite: &str, uv: &Uv, mode: Mode, lane: Lane) {
                     "fake-token",
                     "--org",
                     ORG,
+                    // v5: the hosted pins ARE the state; one on the mock
+                    // origin counts only when that origin is configured.
+                    "--patch-server-url",
+                    &uri,
                 ],
             )
         }
@@ -1559,6 +1607,58 @@ pub fn run_lane(suite: &str, uv: &Uv, mode: Mode, lane: Lane) {
             ],
         ),
     };
+    if mode == Mode::Hosted {
+        let env: Value = serde_json::from_slice(&out.stdout)
+            .unwrap_or_else(|e| panic!("{}: ({e})\n{}", report.what("revert"), dump(&out)));
+        let still_wired = |f: &str| {
+            String::from_utf8_lossy(&std::fs::read(proj.join(f)).unwrap()).contains(uuid)
+        };
+        match out.status.code() {
+            Some(0) => {
+                assert_eq!(
+                    env["hosted"]["reverted"],
+                    json!([built.purl]),
+                    "{}:\n{}",
+                    report.what("revert"),
+                    dump(&out)
+                );
+                for (f, _) in &built.registry {
+                    assert!(
+                        !still_wired(f),
+                        "{}: {f} still names the hosted patch",
+                        report.what("revert")
+                    );
+                }
+                report.row("revert", "restored to the upstream registry entry");
+            }
+            _ => {
+                let error = env["hosted"]["failed"][0]["error"]
+                    .as_str()
+                    .unwrap_or_default()
+                    .to_string();
+                assert!(
+                    error.starts_with(&format!(
+                        "cannot restore {} to its upstream registry entry:",
+                        built.purl
+                    )) && error.contains("restore it from version control instead"),
+                    "{}:\n{}",
+                    report.what("revert"),
+                    dump(&out)
+                );
+                assert_eq!(
+                    snapshot(
+                        &proj,
+                        &wired_files.iter().map(|(f, _)| f.as_str()).collect::<Vec<_>>()
+                    ),
+                    wired_files,
+                    "{}: a refused pin writes nothing",
+                    report.what("revert")
+                );
+                report.row("revert", &format!("refused ({error})"));
+            }
+        }
+        return;
+    }
     assert_eq!(
         out.status.code(),
         Some(0),
@@ -1672,8 +1772,33 @@ pub struct Production<'a> {
     pub embedded: Vec<(&'a str, VexRun)>,
 }
 
-/// The first production record for one of `p.uuids`, from the ledgers or
-/// the manifest `p.proj` holds.
+/// The public patch view for `uuid` from the production proxy (the free
+/// tier needs no token), or `None` when it does not answer.
+fn fetch_public_view(uuid: &str) -> Option<Value> {
+    let url = format!(
+        "{}/patch/view/{uuid}",
+        socket_patch_core::constants::DEFAULT_PATCH_API_PROXY_URL
+    );
+    // Own thread + runtime: callers may already be inside a tokio runtime.
+    std::thread::spawn(move || {
+        let rt = tokio::runtime::Runtime::new().ok()?;
+        rt.block_on(async {
+            let resp = reqwest::get(&url).await.ok()?;
+            if !resp.status().is_success() {
+                return None;
+            }
+            resp.json::<Value>().await.ok()
+        })
+    })
+    .join()
+    .ok()
+    .flatten()
+}
+
+/// The first production record for one of `p.uuids`, from the vendor
+/// ledger or the manifest `p.proj` holds (or a pre-v5 redirect ledger) —
+/// and, for a hosted leg (v5 hosted mode keeps no local record), from the
+/// production patch API itself.
 fn production_record(p: &Production<'_>) -> Value {
     let read = |rel: &str| -> Value {
         std::fs::read(p.proj.join(rel))
@@ -1699,9 +1824,14 @@ fn production_record(p: &Production<'_>) -> Value {
     candidates
         .into_iter()
         .find(|r| r["uuid"].as_str().is_some_and(|u| p.uuids.contains(&u)))
+        .or_else(|| {
+            (p.mode == Mode::Hosted)
+                .then(|| p.uuids.iter().find_map(|u| fetch_public_view(u)))
+                .flatten()
+        })
         .unwrap_or_else(|| {
             panic!(
-                "{}: no production record for the leg's pinned patches in the ledgers",
+                "{}: no production record for the leg's pinned patches (local state or API)",
                 p.leg
             )
         })
diff --git a/crates/socket-patch-cli/tests/vex_e2e_common/vlt.rs b/crates/socket-patch-cli/tests/vex_e2e_common/vlt.rs
index 02a378f0..6baebf40 100644
--- a/crates/socket-patch-cli/tests/vex_e2e_common/vlt.rs
+++ b/crates/socket-patch-cli/tests/vex_e2e_common/vlt.rs
@@ -20,16 +20,18 @@
 //!    `(vendored)` marker and exactly the expected vulnerability ids (+ CVE
 //!    aliases); the embedded `apply --vex` (and, vendored, `vendor --vex`)
 //!    attest the same without touching the lock.
-//! 2. `ledgers-deleted` — `.socket/vendor/state.json` and
-//!    `redirect-state.json` deleted too: still attested, now from lockfile
-//!    discovery + the patch API (the view route is hit).
+//! 2. `ledgers-deleted` — `.socket/vendor/state.json` deleted too (a hosted
+//!    flow wrote no ledger at all in v5 — asserted up front): still
+//!    attested, now from lockfile discovery + the patch API (the view route
+//!    is hit).
 //! 3. `offline` — `--offline` with no ledgers: `record_unavailable`, exit 1,
 //!    ZERO requests to the API.
 //! 4. `reverted` — the lock (and, vendored, the importer package.json
 //!    files) put back to the registry version (ledgers and committed
-//!    artifacts kept, the patched install left in node_modules):
-//!    NOT attested (`redirect_unwired` / `vendor_unwired`), also under
-//!    `--no-verify`.
+//!    artifacts kept, the patched install left in node_modules): NOT
+//!    attested, also under `--no-verify` — vendored: `vendor_unwired`;
+//!    hosted: nothing is discovered (exit 2 `manifest_not_found`), since
+//!    the lock was the only hosted state.
 //!
 //! The checkout copies what git would commit: the root `node_modules/` is
 //! left out, and so is vlt's `node_modules/` inside a vendored package dir
@@ -68,7 +70,8 @@ impl VltMode {
     }
 
     /// The omission a ledger-backed record gets once the lock no longer
-    /// references it.
+    /// references it (hosted: only a PRE-v5 redirect ledger still earns
+    /// it; v5 hosted flows write no ledger).
     pub fn unwired_reason(self) -> &'static str {
         match self {
             VltMode::Hosted => "redirect_unwired",
@@ -234,6 +237,15 @@ fn matrix<F: FnOnce(&Path)>(project: &Path, scratch: &Path, case: &VltVexCase<'_
     let what = format!("{} {}", case.tag, mode.label());
     let ok = |step: &str| eprintln!("VLT-VEX {} {} {step} ok", case.tag, mode.label());
     let checkout = manifestless_checkout(project, &scratch.join(format!("vex-{}", case.tag)));
+    match mode {
+        VltMode::Hosted => assert_no_hosted_ledger(&checkout, &what),
+        VltMode::Vendored => assert!(
+            checkout
+                .join(socket_patch_core::vendor::VENDOR_STATE_REL)
+                .is_file(),
+            "{what}: the vendored flow must have written its ledger"
+        ),
+    }
     install(&checkout);
     let lock_path = checkout.join(VLT_LOCK);
     let wired_lock = std::fs::read(&lock_path).unwrap();
@@ -324,10 +336,6 @@ fn matrix<F: FnOnce(&Path)>(project: &Path, scratch: &Path, case: &VltVexCase<'_
             std::fs::write(path, bytes).unwrap();
         }
     }
-    assert!(
-        ledgers.iter().any(|(_, b)| b.is_some()),
-        "{what}: the flow left no ledger — the reverted step would be vacuous"
-    );
     std::fs::write(&lock_path, &case.registry_lock).unwrap();
     for (rel, bytes) in &case.registry_manifests {
         std::fs::write(checkout.join(rel), bytes).unwrap();
@@ -338,12 +346,27 @@ fn matrix<F: FnOnce(&Path)>(project: &Path, scratch: &Path, case: &VltVexCase<'_
             ..online()
         };
         let out = run_vex(&bin, &checkout, &run);
-        assert_eq!(
-            out.code,
-            Some(1),
-            "{what} reverted (no_verify={no_verify}): {out}"
-        );
-        assert_skipped(&out.envelope, case.purl, mode.unwired_reason());
+        match mode {
+            VltMode::Vendored => {
+                assert_eq!(
+                    out.code,
+                    Some(1),
+                    "{what} reverted (no_verify={no_verify}): {out}"
+                );
+                assert_skipped(&out.envelope, case.purl, mode.unwired_reason());
+            }
+            VltMode::Hosted => {
+                assert_eq!(
+                    out.code,
+                    Some(2),
+                    "{what} reverted (no_verify={no_verify}): {out}"
+                );
+                assert_eq!(
+                    out.envelope["error"]["code"], "manifest_not_found",
+                    "{what} reverted (no_verify={no_verify}): no hosted state is left: {out}"
+                );
+            }
+        }
         assert_absent(out.doc.as_ref(), case.purl);
     }
     ok("reverted");
diff --git a/crates/socket-patch-cli/tests/vex_pdm_hatch_common/mod.rs b/crates/socket-patch-cli/tests/vex_pdm_hatch_common/mod.rs
index 608b37a2..eb2ee9a0 100644
--- a/crates/socket-patch-cli/tests/vex_pdm_hatch_common/mod.rs
+++ b/crates/socket-patch-cli/tests/vex_pdm_hatch_common/mod.rs
@@ -22,8 +22,11 @@
 //! install in a fabricated `.venv` for the vendored build. The wired tree is
 //! snapshotted once per (flavor, mode) and every cell restores the snapshot
 //! into its own temp dir, then DELETES what the cell says to delete
-//! (`.socket/manifest.json`, the ledgers `.socket/vendor/state.json` /
-//! `.socket/vendor/redirect-state.json`, the venv) before running VEX.
+//! (`.socket/manifest.json`, the vendor ledger `.socket/vendor/state.json`,
+//! the venv) before running VEX. v5 hosted mode keeps no ledger at all —
+//! its only state is the wiring — so for hosted cells "ledgers kept" and
+//! "ledgers gone" are the same checkout, and an offline hosted run has no
+//! local record (`record_unavailable`).
 //!
 //! Hermetic: no network (the API is wiremock; `--offline` runs assert zero
 //! requests), no real Python / PDM / Hatch needed. The package is a
@@ -125,7 +128,24 @@ impl Mode {
         }
     }
 
-    /// The ledger file this mode's wiring run writes.
+    /// Whether this mode's wiring run writes a ledger: vendored keeps
+    /// `.socket/vendor/state.json`; v5 hosted keeps none (its state is the
+    /// wiring itself).
+    pub fn has_ledger(self) -> bool {
+        self == Mode::Vendored
+    }
+
+    /// The `keep` variants worth running for this mode: hosted has no
+    /// ledger, so [`LEDGERS_ONLY`] would only repeat [`NOTHING`].
+    pub fn ledger_keeps(self) -> &'static [Keep] {
+        match self {
+            Mode::Hosted => &[NOTHING],
+            Mode::Vendored => &[NOTHING, LEDGERS_ONLY],
+        }
+    }
+
+    /// The ledger file of this mode: the vendor ledger the vendored wiring
+    /// run writes, or the PRE-v5 hosted ledger v5 hosted mode never writes.
     pub fn ledger(self) -> &'static str {
         match self {
             Mode::Hosted => ".socket/vendor/redirect-state.json",
@@ -588,7 +608,9 @@ pub fn wired(flavor: &Flavor, mode: Mode) -> Arc<Wired> {
     });
     let what = wired.what();
     // Anti-vacuity: the run really rewired a project file, into the
-    // mode's reference shape, and left its ledger + artifact behind.
+    // mode's reference shape, and (vendored) left its ledger + artifact
+    // behind — while v5 hosted mode left NO ledger (its state is the
+    // wiring alone).
     let changed = wired.changed_files();
     assert!(!changed.is_empty(), "{what}: nothing was rewired");
     let wiring_text: String = changed.iter().map(|rel| text(&wired.files[*rel])).collect();
@@ -609,9 +631,10 @@ pub fn wired(flavor: &Flavor, mode: Mode) -> Arc<Wired> {
             );
         }
     }
-    assert!(
+    assert_eq!(
         wired.files.contains_key(mode.ledger()),
-        "{what}: the {} ledger must be written: {:?}",
+        mode.has_ledger(),
+        "{what}: the {} ledger must be written iff the mode keeps one: {:?}",
         mode.ledger(),
         wired.files.keys().collect::<Vec<_>>()
     );
@@ -740,9 +763,11 @@ pub fn b_no_local_record_is_record_unavailable(flavors: &[Flavor]) {
     }
 }
 
-/// c) ledger kept, manifest gone → attested OFFLINE from the ledger record
-/// (both `--offline` and `--offline --no-verify`); the committed `.socket/`
-/// exactly as the wiring run left it attests too.
+/// c) vendored: ledger kept, manifest gone → attested OFFLINE from the
+/// ledger record (both `--offline` and `--offline --no-verify`); the
+/// committed `.socket/` exactly as the wiring run left it attests too.
+/// Hosted: v5 left no local record anywhere, so the committed checkout
+/// offline is `record_unavailable` — and online attests from the API.
 pub fn c_ledger_without_manifest_attests_offline(flavors: &[Flavor]) {
     for (flavor, mode) in cells(flavors) {
         let wired = wired(&flavor, mode);
@@ -757,23 +782,55 @@ pub fn c_ledger_without_manifest_attests_offline(flavors: &[Flavor]) {
                     no_verify,
                     ..vex_run(Some(&api))
                 };
+                let out = vex(&cwd, &run);
+                let what = format!("{what} {keep:?} nv={no_verify}");
+                match mode {
+                    Mode::Vendored => assert_ok_attested(&out, mode, &what),
+                    Mode::Hosted => assert_omitted(&out, "record_unavailable", &what),
+                }
+            }
+            api.assert_no_requests();
+            if mode == Mode::Hosted {
+                let api = api_with(mode.uuid(), PURL);
                 assert_ok_attested(
-                    &vex(&cwd, &run),
+                    &vex(&cwd, &vex_run(Some(&api))),
                     mode,
-                    &format!("{what} {keep:?} nv={no_verify}"),
+                    &format!("{what} {keep:?} online"),
                 );
             }
-            api.assert_no_requests();
         }
     }
 }
 
-/// d) wiring reverted to the registry while ledger + artifact remain →
-/// `redirect_unwired` / `vendor_unwired`, `--no-verify` included; a legacy
-/// (pre-5.0) manifest put back as well still attests nothing; with the ledger gone too
-/// nothing is discovered at all (the orphaned wheel is never evidence).
+/// d) vendored: wiring reverted to the registry while ledger + artifact
+/// remain → `vendor_unwired`, `--no-verify` included; a legacy (pre-5.0)
+/// manifest put back as well still attests nothing; with the ledger gone
+/// too nothing is discovered at all (the orphaned wheel is never evidence).
+/// Hosted (no ledger in v5): the reverted wiring was the only hosted
+/// state, so nothing is discovered and the API is never asked.
 pub fn d_reverted_wiring_is_unwired_even_with_no_verify(flavors: &[Flavor]) {
     for (flavor, mode) in cells(flavors) {
+        if mode == Mode::Hosted {
+            let wired = wired(&flavor, mode);
+            let what = wired.what();
+            let (_tmp, cwd) = fresh();
+            wired.restore(&cwd, EVERYTHING);
+            wired.revert_wiring(&cwd);
+            let api = api_with(mode.uuid(), PURL);
+            for (offline, no_verify) in [(true, false), (true, true), (false, true)] {
+                let run = VexRun {
+                    offline,
+                    no_verify,
+                    ..vex_run(Some(&api))
+                };
+                assert_nothing_discovered(
+                    &vex(&cwd, &run),
+                    &format!("{what} offline={offline} nv={no_verify}"),
+                );
+            }
+            api.assert_no_requests();
+            continue;
+        }
         let wired = wired(&flavor, mode);
         let what = wired.what();
         let (_tmp, cwd) = fresh();
@@ -862,12 +919,12 @@ pub fn tamper_wheel(cwd: &Path) {
 }
 
 /// e) tampered installed tree (hosted) / tampered wheel member (vendored)
-/// → omitted, with or without the ledgers; `--no-verify` is the documented
-/// opt-out of hashing (the wiring/record gates still run).
+/// → omitted, with or without the (vendor) ledger; `--no-verify` is the
+/// documented opt-out of hashing (the wiring/record gates still run).
 pub fn e_tampered_evidence_is_omitted(flavors: &[Flavor]) {
     for (flavor, mode) in cells(flavors) {
         let wired = wired(&flavor, mode);
-        for keep in [NOTHING, LEDGERS_ONLY] {
+        for &keep in mode.ledger_keeps() {
             let what = format!("{} ledgers={}", wired.what(), keep.ledgers);
             let (_tmp, cwd) = fresh();
             wired.restore(&cwd, keep);
@@ -894,18 +951,12 @@ pub fn e_tampered_evidence_is_omitted(flavors: &[Flavor]) {
 
 /// f1) the Socket patch host swapped for a look-alike in every wired file:
 /// the uuid-shaped segments (grant token + patch uuid) are all still there.
-/// Without a ledger that is not a patch reference at all (nothing is looked
-/// up). With the redirect ledger kept, a uuid no allowlisted reference
-/// mentions falls back to the LEDGER's own recorded wiring (vex_sources.rs
-/// "liveness": self-hosted patch servers outside the allowlist) — which the
-/// unchanged sha256 pin still names — so it is NOT unwired, but nothing is
-/// installed and the lock is no longer a discovered Socket reference, so no
-/// lockfile-pin basis exists either: verification omits it
-/// (`package_not_found`).
+/// That is not a patch reference at all (nothing is looked up): v5 hosted
+/// keeps no ledger that could vouch for a host outside the allowlist.
 pub fn f_hosted_uuid_on_a_foreign_host_is_not_a_reference(flavors: &[Flavor]) {
     for flavor in flavors.iter().filter(|f| f.hosted) {
         let wired = wired(flavor, Mode::Hosted);
-        for keep in [NOTHING, LEDGERS_ONLY] {
+        for &keep in Mode::Hosted.ledger_keeps() {
             let what = format!("{} ledgers={}", wired.what(), keep.ledgers);
             let (_tmp, cwd) = fresh();
             wired.restore(&cwd, keep);
@@ -920,12 +971,8 @@ pub fn f_hosted_uuid_on_a_foreign_host_is_not_a_reference(flavors: &[Flavor]) {
             }
             let api = api_with(HOSTED_UUID, PURL);
             let out = vex(&cwd, &vex_run(Some(&api)));
-            if keep.ledgers {
-                assert_omitted(&out, "package_not_found", &what);
-            } else {
-                assert_nothing_discovered(&out, &what);
-                api.assert_no_requests();
-            }
+            assert_nothing_discovered(&out, &what);
+            api.assert_no_requests();
         }
     }
 }
@@ -1030,7 +1077,7 @@ pub fn g_hosted_installed_tree_states(flavors: &[Flavor]) {
     for flavor in flavors.iter().filter(|f| f.hosted) {
         let wired = wired(flavor, Mode::Hosted);
         for (bytes, expect) in [(PATCHED, None), (PRISTINE, Some("not_applied"))] {
-            for keep in [NOTHING, LEDGERS_ONLY] {
+            for &keep in Mode::Hosted.ledger_keeps() {
                 let what = format!(
                     "{} installed={expect:?} ledgers={}",
                     wired.what(),
@@ -1204,12 +1251,18 @@ pub fn embedded_rescan_of_a_manifest_less_checkout(
 /// `apply --vex` and `vendor --vex` on a manifest-less wired checkout (CI:
 /// install, then `socket-patch apply --vex out.json`): the patches the
 /// wiring names are attested although there is no manifest to apply —
-/// offline from the ledgers, and online from the API with no ledger.
+/// offline from the vendor ledger, and online from the API with no ledger.
+/// Hosted: `apply --vex` only, online (v5 keeps no local hosted record; and
+/// `vendor` on a hosted checkout is the eject flow, not a no-op).
 pub fn embedded_apply_and_vendor_vex_attest_a_manifest_less_checkout(flavors: &[Flavor]) {
     for (flavor, mode) in cells(flavors) {
         let wired = wired(&flavor, mode);
-        for via in [VexVia::Apply, VexVia::Vendor] {
-            for keep in [LEDGERS_ONLY, NOTHING] {
+        let vias: &[VexVia] = match mode {
+            Mode::Hosted => &[VexVia::Apply],
+            Mode::Vendored => &[VexVia::Apply, VexVia::Vendor],
+        };
+        for &via in vias {
+            for &keep in mode.ledger_keeps().iter().rev() {
                 let what = format!("{} {via:?} ledgers={}", wired.what(), keep.ledgers);
                 let (_tmp, cwd) = fresh();
                 wired.restore(&cwd, keep);
diff --git a/crates/socket-patch-cli/tests/vex_pipenv_pip_common/mod.rs b/crates/socket-patch-cli/tests/vex_pipenv_pip_common/mod.rs
index 0c8d06e5..0dadda5d 100644
--- a/crates/socket-patch-cli/tests/vex_pipenv_pip_common/mod.rs
+++ b/crates/socket-patch-cli/tests/vex_pipenv_pip_common/mod.rs
@@ -22,8 +22,11 @@
 //! install in a fabricated `.venv` for the vendored build. The wired tree is
 //! snapshotted once per (flavor, mode) and every cell restores the snapshot
 //! into its own temp dir, then DELETES what the cell says to delete
-//! (`.socket/manifest.json`, the ledgers `.socket/vendor/state.json` /
-//! `.socket/vendor/redirect-state.json`, the venv) before running VEX.
+//! (`.socket/manifest.json`, the vendor ledger `.socket/vendor/state.json`,
+//! the venv) before running VEX. v5 hosted mode keeps no ledger at all —
+//! its only state is the wiring — so for hosted cells "ledgers kept" and
+//! "ledgers gone" are the same checkout, and an offline hosted run has no
+//! local record (`record_unavailable`).
 //!
 //! Hermetic: no network (the API is wiremock; `--offline` runs assert zero
 //! requests), no real Python / Pipenv / pip needed. The package is a
@@ -134,7 +137,24 @@ impl Mode {
         }
     }
 
-    /// The ledger file this mode's wiring run writes.
+    /// Whether this mode's wiring run writes a ledger: vendored keeps
+    /// `.socket/vendor/state.json`; v5 hosted keeps none (its state is the
+    /// wiring itself).
+    pub fn has_ledger(self) -> bool {
+        self == Mode::Vendored
+    }
+
+    /// The `keep` variants worth running for this mode: hosted has no
+    /// ledger, so [`LEDGERS_ONLY`] would only repeat [`NOTHING`].
+    pub fn ledger_keeps(self) -> &'static [Keep] {
+        match self {
+            Mode::Hosted => &[NOTHING],
+            Mode::Vendored => &[NOTHING, LEDGERS_ONLY],
+        }
+    }
+
+    /// The ledger file of this mode: the vendor ledger the vendored wiring
+    /// run writes, or the PRE-v5 hosted ledger v5 hosted mode never writes.
     pub fn ledger(self) -> &'static str {
         match self {
             Mode::Hosted => ".socket/vendor/redirect-state.json",
@@ -611,7 +631,8 @@ pub fn wired(flavor: &Flavor, mode: Mode) -> Arc<Wired> {
     });
     let what = wired.what();
     // Anti-vacuity: the run really rewired a project file, into the mode's
-    // reference shape, and left its ledger + artifact behind.
+    // reference shape, and (vendored) left its ledger + artifact behind —
+    // while v5 hosted mode left NO ledger (its state is the wiring alone).
     let changed = wired.changed_files();
     assert!(!changed.is_empty(), "{what}: nothing was rewired");
     let wiring_text: String = changed.iter().map(|rel| text(&wired.files[*rel])).collect();
@@ -632,9 +653,10 @@ pub fn wired(flavor: &Flavor, mode: Mode) -> Arc<Wired> {
             );
         }
     }
-    assert!(
+    assert_eq!(
         wired.files.contains_key(mode.ledger()),
-        "{what}: the {} ledger must be written: {:?}",
+        mode.has_ledger(),
+        "{what}: the {} ledger must be written iff the mode keeps one: {:?}",
         mode.ledger(),
         wired.files.keys().collect::<Vec<_>>()
     );
@@ -715,7 +737,8 @@ pub fn assert_no_statement(out: &VexOutcome, what: &str) {
 
 /// a) no manifest, no ledgers, online → attested from the wiring alone;
 /// vex never writes the manifest or a ledger. Also the committed `.socket/`
-/// (ledger, plus the wheel when vendored) baseline, offline.
+/// baseline, offline: vendored (ledger + wheel) attests from it; hosted
+/// commits no local record, so offline it is `record_unavailable`.
 pub fn a_wiring_only_checkout_attests_online(flavors: &[Flavor]) {
     for (flavor, mode) in cells(flavors) {
         let wired = wired(&flavor, mode);
@@ -753,7 +776,12 @@ pub fn a_wiring_only_checkout_attests_online(flavors: &[Flavor]) {
             offline: true,
             ..vex_run(None)
         };
-        assert_ok_attested(&vex(&cwd2, &run), mode, &format!("{what} committed"));
+        let out = vex(&cwd2, &run);
+        let what = format!("{what} committed");
+        match mode {
+            Mode::Vendored => assert_ok_attested(&out, mode, &what),
+            Mode::Hosted => assert_omitted(&out, "record_unavailable", &what),
+        }
     }
 }
 
@@ -807,8 +835,10 @@ pub fn b_no_local_record_is_record_unavailable(flavors: &[Flavor]) {
     }
 }
 
-/// c) ledger present, manifest absent → attests OFFLINE from the ledger
-/// record, verified and `--no-verify`.
+/// c) everything the wiring run left, manifest absent, OFFLINE (verified
+/// and `--no-verify`). Vendored: the vendor ledger's record attests. Hosted:
+/// v5 left no local record, so offline is `record_unavailable` — and the
+/// same checkout online attests from the API.
 pub fn c_ledger_without_manifest_attests_offline(flavors: &[Flavor]) {
     for (flavor, mode) in cells(flavors) {
         let wired = wired(&flavor, mode);
@@ -822,20 +852,31 @@ pub fn c_ledger_without_manifest_attests_offline(flavors: &[Flavor]) {
                 no_verify,
                 ..vex_run(Some(&api))
             };
+            let out = vex(&cwd, &run);
+            let what = format!("{what} no_verify={no_verify}");
+            match mode {
+                Mode::Vendored => assert_ok_attested(&out, mode, &what),
+                Mode::Hosted => assert_omitted(&out, "record_unavailable", &what),
+            }
+        }
+        api.assert_no_requests();
+        if mode == Mode::Hosted {
+            let api = api_with(mode.uuid(), PURL);
             assert_ok_attested(
-                &vex(&cwd, &run),
+                &vex(&cwd, &vex_run(Some(&api))),
                 mode,
-                &format!("{what} no_verify={no_verify}"),
+                &format!("{what} online"),
             );
         }
-        api.assert_no_requests();
     }
 }
 
-/// d) wiring reverted to the registry while the ledger (+ artifact)
-/// remain → `redirect_unwired` / `vendor_unwired`, `--no-verify` included,
-/// online too (the API would vouch for the uuid); with the manifest back as
-/// well nothing is attested; with the ledger gone nothing is discovered.
+/// d) wiring reverted to the registry. Vendored, while the ledger (+
+/// artifact) remain → `vendor_unwired`, `--no-verify` included, online too
+/// (the API would vouch for the uuid); with the manifest back as well
+/// nothing is attested; with the ledger gone nothing is discovered. Hosted
+/// (no ledger in v5): the reverted wiring was the only hosted state, so
+/// nothing is discovered at all and the API is never asked.
 pub fn d_reverted_wiring_is_unwired_even_with_no_verify(flavors: &[Flavor]) {
     for (flavor, mode) in cells(flavors) {
         let wired = wired(&flavor, mode);
@@ -856,11 +897,15 @@ pub fn d_reverted_wiring_is_unwired_even_with_no_verify(flavors: &[Flavor]) {
                 no_verify,
                 ..vex_run(Some(&api))
             };
-            assert_omitted(
-                &vex(&cwd, &run),
-                mode.unwired(),
-                &format!("{what} offline={offline} no_verify={no_verify}"),
-            );
+            let out = vex(&cwd, &run);
+            let what = format!("{what} offline={offline} no_verify={no_verify}");
+            match mode {
+                Mode::Vendored => assert_omitted(&out, mode.unwired(), &what),
+                Mode::Hosted => assert_nothing_discovered(&out, &what),
+            }
+        }
+        if mode == Mode::Hosted {
+            api.assert_no_requests();
         }
         // A patched install left behind does not revive the claim either.
         install(&cwd, ".venv", PATCHED);
@@ -927,12 +972,12 @@ pub fn tamper_wheel(cwd: &Path) {
 }
 
 /// e) tampered installed tree (hosted) / tampered wheel member (vendored)
-/// → omitted, with and without the ledger; `--no-verify` is the documented
-/// opt-out of hashing (the wiring / record gates still run).
+/// → omitted, with and without the (vendor) ledger; `--no-verify` is the
+/// documented opt-out of hashing (the wiring / record gates still run).
 pub fn e_tampered_evidence_is_omitted(flavors: &[Flavor]) {
     for (flavor, mode) in cells(flavors) {
         let wired = wired(&flavor, mode);
-        for keep in [NOTHING, LEDGERS_ONLY] {
+        for &keep in mode.ledger_keeps() {
             let what = format!("{} ledgers={}", wired.what(), keep.ledgers);
             let (_tmp, cwd) = fresh();
             wired.restore(&cwd, keep);
@@ -959,17 +1004,16 @@ pub fn e_tampered_evidence_is_omitted(flavors: &[Flavor]) {
 
 /// f) the Socket patch host swapped for a look-alike in every wired file
 /// (the uuid-shaped segments — grant token + patch uuid — are all still
-/// there): with no ledger nothing is discovered and the API is never asked;
-/// with the stale ledger kept the verified run still omits it (no
-/// discovered pin, nothing installed), and a patched install is not enough
-/// either once the ledger is gone.
+/// there): nothing is discovered and the API is never asked, and a patched
+/// install is not enough either (v5 hosted keeps no ledger that could vouch
+/// for a host outside the allowlist).
 pub fn f_hosted_uuid_on_a_foreign_host_is_not_a_reference(flavors: &[Flavor]) {
     for flavor in flavors.iter().filter(|f| f.hosted) {
         let wired = wired(flavor, Mode::Hosted);
         let what = wired.what();
-        for keep in [NOTHING, LEDGERS_ONLY] {
+        {
             let (_tmp, cwd) = fresh();
-            wired.restore(&cwd, keep);
+            wired.restore(&cwd, NOTHING);
             for rel in wired.changed_files() {
                 let spoofed = text(&wired.files[rel]).replace(
                     "https://patch.socket.dev/",
@@ -980,22 +1024,12 @@ pub fn f_hosted_uuid_on_a_foreign_host_is_not_a_reference(flavors: &[Flavor]) {
             }
             let api = api_with(HOSTED_UUID, PURL);
             let out = vex(&cwd, &vex_run(Some(&api)));
-            let what = format!("{what} ledgers={}", keep.ledgers);
-            if keep.ledgers {
-                // The redirect ledger's own evidence (a host outside the
-                // discovery allowlist falls back to the ledger's recorded
-                // edit file still naming the uuid — the `--patch-server-url`
-                // escape hatch), but without a discovered integrity pin or
-                // an installed tree there is nothing to verify.
-                assert_omitted(&out, "package_not_found", &what);
-            } else {
-                assert_nothing_discovered(&out, &what);
-                api.assert_no_requests();
-                install(&cwd, ".venv", PATCHED);
-                let out = vex(&cwd, &vex_run(Some(&api)));
-                assert_nothing_discovered(&out, &format!("{what} installed"));
-                api.assert_no_requests();
-            }
+            assert_nothing_discovered(&out, &what);
+            api.assert_no_requests();
+            install(&cwd, ".venv", PATCHED);
+            let out = vex(&cwd, &vex_run(Some(&api)));
+            assert_nothing_discovered(&out, &format!("{what} installed"));
+            api.assert_no_requests();
         }
     }
 }
@@ -1096,7 +1130,7 @@ pub fn g_hosted_installed_tree_states(flavors: &[Flavor]) {
     for flavor in flavors.iter().filter(|f| f.hosted) {
         let wired = wired(flavor, Mode::Hosted);
         for (bytes, expect) in [(PATCHED, None), (PRISTINE, Some("not_applied"))] {
-            for keep in [NOTHING, LEDGERS_ONLY] {
+            for &keep in Mode::Hosted.ledger_keeps() {
                 let what = format!(
                     "{} installed={expect:?} ledgers={}",
                     wired.what(),
@@ -1260,12 +1294,18 @@ pub fn embedded_rescan_of_a_manifest_less_checkout(flavors: &[Flavor]) {
 /// `apply --vex` and `vendor --vex` on a manifest-less wired checkout (CI:
 /// install, then `socket-patch apply --vex out.json`): the patches the
 /// wiring names are attested although there is no manifest to apply —
-/// offline from the ledgers, and online from the API with no ledger.
+/// offline from the vendor ledger, and online from the API with no ledger.
+/// Hosted: `apply --vex` only, online (v5 keeps no local hosted record; and
+/// `vendor` on a hosted checkout is the eject flow, not a no-op).
 pub fn embedded_apply_and_vendor_vex_attest_a_manifest_less_checkout(flavors: &[Flavor]) {
     for (flavor, mode) in cells(flavors) {
         let wired = wired(&flavor, mode);
-        for via in [VexVia::Apply, VexVia::Vendor] {
-            for keep in [LEDGERS_ONLY, NOTHING] {
+        let vias: &[VexVia] = match mode {
+            Mode::Hosted => &[VexVia::Apply],
+            Mode::Vendored => &[VexVia::Apply, VexVia::Vendor],
+        };
+        for &via in vias {
+            for &keep in mode.ledger_keeps().iter().rev() {
                 let what = format!("{} {via:?} ledgers={}", wired.what(), keep.ledgers);
                 let (_tmp, cwd) = fresh();
                 wired.restore(&cwd, keep);
diff --git a/crates/socket-patch-cli/tests/vex_pipenv_pip_steps/mod.rs b/crates/socket-patch-cli/tests/vex_pipenv_pip_steps/mod.rs
index 776c4393..3a98ae00 100644
--- a/crates/socket-patch-cli/tests/vex_pipenv_pip_steps/mod.rs
+++ b/crates/socket-patch-cli/tests/vex_pipenv_pip_steps/mod.rs
@@ -11,10 +11,14 @@
 //! 3. `offline`: no manifest, no ledgers, `--offline` →
 //!    `record_unavailable` (and, against the mock, ZERO requests);
 //! 4. `reverted`: the wiring back on the registry, ledgers + artifacts kept
-//!    → NOT attested (`redirect_unwired` / `vendor_unwired`), offline and
-//!    online, with and without `--no-verify`;
+//!    → NOT attested, offline and online, with and without `--no-verify`:
+//!    `redirect_unwired` / `vendor_unwired` while a ledger still names the
+//!    patch; with no ledger at all (v5 hosted mode keeps none, so a reverted
+//!    hosted checkout holds no patch state anywhere) the run is the plain
+//!    `manifest_not_found` error;
 //! 5. `apply-vex`: `apply --vex` on the manifest-less checkout, ledgers
-//!    kept, offline → attested.
+//!    kept → attested: offline (zero requests) when a ledger supplies the
+//!    record, online from the API otherwise (v5 hosted mode).
 //!
 //! Every step runs on a scoped OS thread, so the helper is callable from
 //! `#[tokio::test]`s (the mock patch API owns its own runtime).
@@ -232,6 +236,7 @@ fn steps_inner(s: &Steps<'_>) {
         let p = copy("reverted");
         strip_manifest(&p);
         (s.revert)(&p);
+        let ledgered = has_ledger(&p);
         for (offline, no_verify) in [(true, false), (true, true), (false, false), (false, true)] {
             let out = s.run(
                 &p,
@@ -245,31 +250,56 @@ fn steps_inner(s: &Steps<'_>) {
                 "{} reverted offline={offline} no_verify={no_verify}",
                 s.what
             );
-            assert_eq!(out.code, Some(1), "{what}: {out}");
-            assert_absent(out.doc.as_ref(), s.purl);
-            assert_not_attested(&out.envelope, s.purl, s.unwired());
+            if ledgered {
+                assert_eq!(out.code, Some(1), "{what}: {out}");
+                assert_absent(out.doc.as_ref(), s.purl);
+                assert_not_attested(&out.envelope, s.purl, s.unwired());
+            } else {
+                // Nothing names the patch any more: no manifest, no ledger,
+                // no hosted wiring.
+                assert_eq!(out.code, Some(2), "{what}: {out}");
+                assert_eq!(
+                    out.envelope["error"]["code"], "manifest_not_found",
+                    "{what}: {out}"
+                );
+                assert_absent(out.doc.as_ref(), s.purl);
+            }
         }
     });
 
     s.step("apply-vex", || {
         let p = copy("apply-vex");
         strip_manifest(&p);
-        let silent = PatchApi::empty();
-        let out = s.run(
-            &p,
-            VexRun {
-                offline: true,
-                ..VexRun::online(&silent)
-            }
-            .via(VexVia::Apply),
-        );
-        assert_eq!(out.code, Some(0), "{} apply --vex: {out}", s.what);
-        s.assert_attested(&out, "apply-vex");
+        if has_ledger(&p) {
+            let silent = PatchApi::empty();
+            let out = s.run(
+                &p,
+                VexRun {
+                    offline: true,
+                    ..VexRun::online(&silent)
+                }
+                .via(VexVia::Apply),
+            );
+            assert_eq!(out.code, Some(0), "{} apply --vex: {out}", s.what);
+            s.assert_attested(&out, "apply-vex");
+            silent.assert_no_requests();
+        } else {
+            // No local record (a v5 hosted checkout): the API supplies it.
+            let out = s.run(&p, online().via(VexVia::Apply));
+            assert_eq!(out.code, Some(0), "{} apply --vex: {out}", s.what);
+            s.assert_attested(&out, "apply-vex");
+        }
         assert!(!p.join(".socket/manifest.json").exists(), "{}", s.what);
-        silent.assert_no_requests();
     });
 }
 
+/// Whether the checkout still holds a ledger that can name the patch (the
+/// vendor ledger, or a pre-v5 hosted ledger).
+fn has_ledger(project: &Path) -> bool {
+    project.join(".socket/vendor/state.json").exists()
+        || project.join(".socket/vendor/redirect-state.json").exists()
+}
+
 /// Copy `from` into `to` recursively (symlinks copied as the files they
 /// point at; a venv's interpreter links are not needed by VEX).
 pub fn copy_tree(from: &Path, to: &Path) {
diff --git a/crates/socket-patch-cli/tests/vex_pypi_real_common/mod.rs b/crates/socket-patch-cli/tests/vex_pypi_real_common/mod.rs
index 9af94bca..7ed0bf48 100644
--- a/crates/socket-patch-cli/tests/vex_pypi_real_common/mod.rs
+++ b/crates/socket-patch-cli/tests/vex_pypi_real_common/mod.rs
@@ -625,17 +625,29 @@ impl VexMatrix<'_> {
         );
         let uuid = self.mode.uuid();
 
-        // (1) manifest deleted, ledgers kept: offline from the ledger
-        // record (zero network), then online.
+        // (1) manifest deleted, ledgers kept: offline from the vendor
+        // ledger's record (zero network), then online. v5 hosted mode keeps
+        // no ledger, so a hosted checkout has no local record to go offline
+        // from (step 3 pins its `record_unavailable`).
         let api = self.api();
-        let offline = VexRun {
-            offline: true,
-            ..self.run_for(&api)
-        };
-        let out = run_vex(&bin, checkout, &offline);
-        assert_eq!(out.code, Some(0), "{}: {out}", self.what("ledger offline"));
-        assert_attested(out.doc(), PURL, uuid, self.mode.marker(), VULNS);
-        api.assert_no_requests();
+        if matches!(self.mode, Mode::Hosted) {
+            assert!(
+                !checkout
+                    .join(socket_patch_core::patch::redirect::REDIRECT_STATE_REL)
+                    .exists(),
+                "{}: v5 hosted mode writes no redirect ledger",
+                self.what("no ledger")
+            );
+        } else {
+            let offline = VexRun {
+                offline: true,
+                ..self.run_for(&api)
+            };
+            let out = run_vex(&bin, checkout, &offline);
+            assert_eq!(out.code, Some(0), "{}: {out}", self.what("ledger offline"));
+            assert_attested(out.doc(), PURL, uuid, self.mode.marker(), VULNS);
+            api.assert_no_requests();
+        }
         let out = run_vex(&bin, checkout, &self.run_for(&api));
         assert_eq!(
             out.code,
@@ -689,7 +701,14 @@ impl VexMatrix<'_> {
         self.done("ledgers-deleted");
 
         // Embedded forms on the same manifest-less, ledgerless checkout.
-        for via in [VexVia::Apply, VexVia::Vendor] {
+        // Hosted: `apply --vex` only — a manifest-less `vendor` over hosted
+        // pins EJECTS them into `.socket/vendor/` (v5), which is a rewire,
+        // not an attestation of the hosted wiring.
+        let embedded: &[VexVia] = match self.mode {
+            Mode::Hosted => &[VexVia::Apply],
+            Mode::Vendored => &[VexVia::Apply, VexVia::Vendor],
+        };
+        for &via in embedded {
             let out = run_vex(&bin, checkout, &self.run_for(&api).via(via));
             assert_eq!(
                 out.code,
@@ -742,8 +761,17 @@ impl VexMatrix<'_> {
             };
             let out = run_vex(&bin, checkout, &run);
             let what = self.what(&format!("reverted offline={offline} no_verify={no_verify}"));
-            assert_eq!(out.code, Some(1), "{what}: {out}");
-            assert_not_attested(&out.envelope, PURL, self.mode.unwired());
+            if matches!(self.mode, Mode::Hosted) {
+                // No ledger and no wiring: nothing names the patch any more.
+                assert_eq!(out.code, Some(2), "{what}: {out}");
+                assert_eq!(
+                    out.envelope["error"]["code"], "manifest_not_found",
+                    "{what}: {out}"
+                );
+            } else {
+                assert_eq!(out.code, Some(1), "{what}: {out}");
+                assert_not_attested(&out.envelope, PURL, self.mode.unwired());
+            }
             assert!(out.doc.is_none(), "{what}: {out}");
         }
         self.done("reverted");
diff --git a/crates/socket-patch-cli/tests/vlt_e2e_common/fixture.rs b/crates/socket-patch-cli/tests/vlt_e2e_common/fixture.rs
index c1303105..df11effa 100644
--- a/crates/socket-patch-cli/tests/vlt_e2e_common/fixture.rs
+++ b/crates/socket-patch-cli/tests/vlt_e2e_common/fixture.rs
@@ -327,10 +327,20 @@ impl Fixture {
         vex_doc_attests(&self.proj.join("out.vex.json"), t)
     }
 
+    /// The pre-v5 hosted ledger, if any file sits there. v5 hosted mode
+    /// never writes it, so every hosted leg expects `None`.
     pub fn ledger(&self) -> Option<Vec<u8>> {
         std::fs::read(self.proj.join(".socket/vendor/redirect-state.json")).ok()
     }
 
+    /// `rollback` of this fixture's hosted pins: discovered from the lock on
+    /// the mock patch service's origin, restored from the harness registry
+    /// (see [`rollback_upstream`]).
+    pub fn rollback(&self, extra: &[&str]) -> SocketOut {
+        let svc = self.svc.uri();
+        rollback_upstream(&self.proj, &self.reg.url(), Some(&svc), extra)
+    }
+
     pub fn store_ids(&self, t: &PatchTarget) -> Vec<String> {
         node_ids(&read_lock(&self.proj), &t.name, &t.version)
     }
diff --git a/crates/socket-patch-cli/tests/vlt_e2e_common/mod.rs b/crates/socket-patch-cli/tests/vlt_e2e_common/mod.rs
index 3a41ce66..4730ee81 100644
--- a/crates/socket-patch-cli/tests/vlt_e2e_common/mod.rs
+++ b/crates/socket-patch-cli/tests/vlt_e2e_common/mod.rs
@@ -1819,7 +1819,8 @@ pub fn get_hosted(proj: &Path, svc: &PatchService, uuid: &str, extra: &[&str]) -
     out.json()
 }
 
-/// `rollback --yes --json` (whole ledger) in `proj`.
+/// `rollback --yes --json` in `proj`: every hosted pin the lockfiles wire
+/// (v5 keeps no hosted ledger) plus the vendor ledger / manifest.
 pub fn rollback(proj: &Path, extra: &[&str]) -> SocketOut {
     let cwd = proj.to_str().unwrap().to_string();
     let mut args = vec!["rollback", "--json", "--yes", "--cwd", &cwd];
@@ -1827,6 +1828,27 @@ pub fn rollback(proj: &Path, extra: &[&str]) -> SocketOut {
     socket(proj, &args, &[])
 }
 
+/// [`rollback`] of HOSTED pins against the harness: `--patch-server-url
+/// <patch_server>` (when the pins sit on the mock patch service rather than
+/// `patch.socket.dev`; discovery recognizes no other host) and
+/// `SOCKET_NPM_REGISTRY=<registry>`, the npm registry the v5 upstream
+/// restore re-resolves each pin's integrity from (the harness registry, so
+/// synthetic packages restore too and the run stays hermetic).
+pub fn rollback_upstream(
+    proj: &Path,
+    registry: &str,
+    patch_server: Option<&str>,
+    extra: &[&str],
+) -> SocketOut {
+    let cwd = proj.to_str().unwrap().to_string();
+    let mut args = vec!["rollback", "--json", "--yes", "--cwd", &cwd];
+    if let Some(origin) = patch_server {
+        args.extend(["--patch-server-url", origin]);
+    }
+    args.extend_from_slice(extra);
+    socket(proj, &args, &[("SOCKET_NPM_REGISTRY", registry)])
+}
+
 pub fn redirect_warnings(doc: &Value) -> Vec<(String, String)> {
     let mut out = Vec::new();
     for w in [&doc["redirect"]["warnings"], &doc["warnings"]] {
diff --git a/crates/socket-patch-cli/tests/vlt_hosted_common/mod.rs b/crates/socket-patch-cli/tests/vlt_hosted_common/mod.rs
index 560bacb8..b41fbd77 100644
--- a/crates/socket-patch-cli/tests/vlt_hosted_common/mod.rs
+++ b/crates/socket-patch-cli/tests/vlt_hosted_common/mod.rs
@@ -537,3 +537,46 @@ pub fn vex_attests(path: &Path) -> bool {
             .any(|c| c["@id"] == PURL)
     })
 }
+
+/// v5 hosted mode writes no ledger: assert `.socket/vendor/redirect-state.json`
+/// does not exist under `root`.
+pub fn assert_no_ledger(root: &Path) {
+    let ledger = ledger_path(root);
+    assert!(
+        !ledger.exists(),
+        "v5 hosted mode must not write the redirect ledger, found {}",
+        ledger.display()
+    );
+}
+
+/// A pre-v5 ledger record (the `PatchRecord` shape) built from a
+/// `/patches/view` body: `publishedAt` becomes `exportedAt`, `purl` is
+/// dropped.
+pub fn legacy_record_from_view(view: &Value) -> Value {
+    let mut record = view.clone();
+    let obj = record.as_object_mut().expect("a view body is an object");
+    obj.remove("purl");
+    let exported = obj
+        .remove("publishedAt")
+        .unwrap_or_else(|| json!("2024-01-01T00:00:00Z"));
+    obj.insert("exportedAt".to_string(), exported);
+    obj.entry("description").or_insert_with(|| json!("x"));
+    obj.entry("license").or_insert_with(|| json!("MIT"));
+    obj.entry("tier").or_insert_with(|| json!("free"));
+    record
+}
+
+/// Write a pre-v5 hosted ledger (`.socket/vendor/redirect-state.json`)
+/// holding `records` (`(purl, PatchRecord JSON)`) and no edits — what an
+/// older socket-patch left behind; v5 reads it only as an extra local
+/// record source (vex) and never for planning (scan).
+pub fn write_legacy_ledger(root: &Path, records: &[(&str, Value)]) {
+    let map: serde_json::Map<String, Value> = records
+        .iter()
+        .map(|(purl, record)| (purl.to_string(), record.clone()))
+        .collect();
+    let ledger = json!({ "version": 1, "mode": "hosted", "records": map });
+    let path = ledger_path(root);
+    std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+    std::fs::write(&path, serde_json::to_vec_pretty(&ledger).unwrap()).unwrap();
+}
diff --git a/crates/socket-patch-cli/tests/yarn_berry_common/mod.rs b/crates/socket-patch-cli/tests/yarn_berry_common/mod.rs
index b9f5e7cf..04ce2881 100644
--- a/crates/socket-patch-cli/tests/yarn_berry_common/mod.rs
+++ b/crates/socket-patch-cli/tests/yarn_berry_common/mod.rs
@@ -54,11 +54,11 @@
 //!
 //! | cell | shape | expectation |
 //! |---|---|---|
-//! | `manifest-deleted` | ledgers + artifacts, `--immutable --check-cache` install | online + offline attest (ledger record); embedded `apply --vex` (+ `vendor --vex` / `scan --mode hosted --vex`) attest |
+//! | `manifest-deleted` | ledgers + artifacts (hosted: v5 writes no ledger, asserted), `--immutable --check-cache` install | online attests; offline attests from the vendor ledger record (hosted: `record_unavailable`, no local record); embedded `apply --vex` (+ `vendor --vex` / `scan --mode hosted --vex`) attest |
 //! | `ledgers-deleted` | lockfile (+ vendored artifact) only | online attests from the API record; embedded `apply --vex` attests |
 //! | `offline` | no ledgers, `--offline` | `record_unavailable`, exit 1, ZERO API requests |
 //! | `tampered` | installed file (hosted) / artifact member (vendored) altered | `hash_mismatch` / `vendor_hash_mismatch` |
-//! | `reverted` | lock (+ package.json) back to the registry, ledgers + artifacts kept, real `--immutable` install of the pristine bytes | `redirect_unwired` / `vendor_unwired` with AND without `--no-verify`, online and offline, zero API requests; with the ledgers gone too: nothing discovered |
+//! | `reverted` | lock (+ package.json) back to the registry, ledgers + artifacts kept, real `--immutable` install of the pristine bytes | vendored: `vendor_unwired`; hosted: nothing discovered (exit 2 `manifest_not_found`, the lock was the only hosted state) — with AND without `--no-verify`, online and offline, zero API requests; with the ledgers gone too: nothing discovered |
 //! | `reverted-lock-only` (vendored) | lock reverted, the `resolutions` mapping left behind | `vendor_unwired` (with and without `--no-verify`) |
 //! | `pnp-linker` | the SAME wired lock installed under `nodeLinker: pnp` | the documented PnP contract: standalone vex attests from the lock's `checksum:` pin (hosted) / the committed artifact (vendored); `apply --vex` refuses (`yarn_pnp_unsupported`) |
 //!
@@ -576,6 +576,25 @@ impl<'a> BerryVexFlow<'a> {
     fn assert_omitted_run(&self, out: &VexOutcome, reason: &str, ctx: &str) {
         crate::vex_e2e_common::assert_omitted(out, self.purl, reason, ctx);
     }
+
+    /// A reverted checkout: vendored, the stale ledger entry is
+    /// `vendor_unwired`; hosted (v5, no ledger), the lock was the only
+    /// hosted state, so nothing is discovered at all.
+    fn assert_reverted_run(&self, out: &VexOutcome, ctx: &str) {
+        match self.wiring {
+            BerryWiring::Vendored { .. } => {
+                self.assert_omitted_run(out, self.wiring.unwired_reason(), ctx)
+            }
+            BerryWiring::Hosted { .. } => {
+                assert_eq!(out.code, Some(2), "{ctx}: {out}");
+                assert_eq!(
+                    out.envelope["error"]["code"], "manifest_not_found",
+                    "{ctx}: no hosted state is left: {out}"
+                );
+                assert!(out.doc.is_none(), "{ctx}: no document: {out}");
+            }
+        }
+    }
 }
 
 /// Recursive copy (files and dirs; symlinks are followed).
@@ -635,10 +654,16 @@ pub fn run_manifestless_vex_matrix(flow: &BerryVexFlow<'_>) -> Vec<String> {
     // ── manifest-deleted: ledgers + artifacts travel, the real yarn installs ──
     let fresh = flow.checkout("vex-manifest-deleted", true);
     strip_manifest(&fresh);
-    assert!(
-        fresh.join(".socket/vendor").is_dir(),
-        "manifest-deleted: the flow must have left its .socket/vendor ledgers"
-    );
+    if is_hosted {
+        // v5 hosted mode keeps no redirect ledger: the yarn.lock pin is the
+        // whole hosted state, so this checkout already has no ledger.
+        crate::vex_e2e_common::assert_no_hosted_ledger(&fresh, "manifest-deleted");
+    } else {
+        assert!(
+            fresh.join(socket_patch_core::vendor::VENDOR_STATE_REL).is_file(),
+            "manifest-deleted: the vendored flow must have left its .socket/vendor ledger"
+        );
+    }
     flow.install(
         &fresh,
         &["install", "--immutable", "--check-cache"],
@@ -662,7 +687,12 @@ pub fn run_manifestless_vex_matrix(flow: &BerryVexFlow<'_>) -> Vec<String> {
     let before = api.request_count();
     let ctx = flow.cell_tag("manifest-deleted/offline-ledger");
     let out = run_vex(&bin, &fresh, &flow.offline(&api));
-    flow.assert_attested_run(&out, &ctx);
+    if is_hosted {
+        // No ledger, so no local record: offline, the hosted pin is omitted.
+        flow.assert_omitted_run(&out, "record_unavailable", &ctx);
+    } else {
+        flow.assert_attested_run(&out, &ctx);
+    }
     assert_eq!(
         api.request_count(),
         before,
@@ -861,7 +891,7 @@ pub fn run_manifestless_vex_matrix(flow: &BerryVexFlow<'_>) -> Vec<String> {
                 ..base.clone()
             };
             let out = run_vex(&bin, &reverted, &run);
-            flow.assert_omitted_run(&out, unwired, &ctx);
+            flow.assert_reverted_run(&out, &ctx);
         }
     }
     assert_eq!(
@@ -874,15 +904,21 @@ pub fn run_manifestless_vex_matrix(flow: &BerryVexFlow<'_>) -> Vec<String> {
     std::fs::write(reverted.join(flow.installed), flow.patched).unwrap();
     let ctx = flow.cell_tag("reverted/stale-patched-tree");
     let out = run_vex(&bin, &reverted, &flow.offline(&api));
-    flow.assert_omitted_run(&out, unwired, &ctx);
+    flow.assert_reverted_run(&out, &ctx);
     std::fs::write(reverted.join(flow.installed), flow.pristine).unwrap();
     let ctx = flow.cell_tag("reverted/apply--vex");
     let out = run_vex(&bin, &reverted, &flow.offline(&api).via(VexVia::Apply));
-    assert_ne!(
-        out.code,
-        Some(0),
-        "{ctx}: a stale ledger fails the requested VEX: {out}"
-    );
+    if is_hosted {
+        // Nothing references the patch anywhere: manifest-less `apply
+        // --vex` keeps its calm exit-0 no-op and writes no document.
+        assert_eq!(out.code, Some(0), "{ctx}: nothing to attest: {out}");
+    } else {
+        assert_ne!(
+            out.code,
+            Some(0),
+            "{ctx}: a stale ledger fails the requested VEX: {out}"
+        );
+    }
     assert!(out.doc.is_none(), "{ctx}: no document: {out}");
     strip_ledgers(&reverted);
     let ctx = flow.cell_tag("reverted/no-ledgers");
diff --git a/crates/socket-patch-core/src/patch/redirect/bun_binary.rs b/crates/socket-patch-core/src/patch/redirect/bun_binary.rs
index 55163ad9..7f7b1820 100644
--- a/crates/socket-patch-core/src/patch/redirect/bun_binary.rs
+++ b/crates/socket-patch-core/src/patch/redirect/bun_binary.rs
@@ -2,7 +2,6 @@
 //! scoped rollback independent of other packages in the same binary lock.
 use super::{DepOverride, FileEdit, RewriteResult, RewriteWarning};
 use crate::vendor::bun_lockb::BunLockb;
-use serde_json::Value;
 
 pub(crate) const KIND: &str = "redirect_bun_lockb_package";
 
@@ -107,91 +106,9 @@ pub fn rewrite_bun_binary(content: &[u8], overrides: &[DepOverride], result: &mu
     }
 }
 
-pub(crate) fn names(edit: &FileEdit, name: &str, version: &str) -> Result<bool, String> {
-    let original = edit
-        .original
-        .as_ref()
-        .ok_or("binary redirect is missing its original snapshot")?;
-    let new = edit
-        .new
-        .as_ref()
-        .ok_or("binary redirect is missing its rewritten snapshot")?;
-    for snapshot in [original, new] {
-        if snapshot.get("name").and_then(Value::as_str).is_none()
-            || snapshot.get("resolution").and_then(Value::as_str).is_none()
-            || !matches!(
-                snapshot.get("version"),
-                Some(Value::Null | Value::String(_))
-            )
-        {
-            return Err("binary redirect snapshot cannot be attributed to a package; restore the ledger before scoped rollback".into());
-        }
-    }
-    if original["name"] != new["name"] {
-        return Err("binary redirect snapshots disagree about package ownership".into());
-    }
-    if original["name"].as_str() != Some(name) {
-        return Ok(false);
-    }
-    let recover_version = |snapshot: &Value| -> Option<String> {
-        if let Some(version) = snapshot["version"]
-            .as_str()
-            .filter(|version| semver::Version::parse(version).is_ok())
-        {
-            return Some(version.into());
-        }
-        super::takeover::hosted_url_version(snapshot["resolution"].as_str()?, name).map(Into::into)
-    };
-    let versions: Vec<_> = [original, new]
-        .into_iter()
-        .filter_map(recover_version)
-        .collect();
-    let Some(first) = versions.first() else {
-        return Err("binary redirect snapshot names this package but its version cannot be recovered; restore the ledger before scoped rollback".into());
-    };
-    if versions.iter().any(|value| value != first) {
-        return Err("binary redirect snapshots disagree about package version".into());
-    }
-    Ok(first == version)
-}
-
-pub(crate) fn restore(content: &[u8], edit: &FileEdit) -> Result<Vec<u8>, String> {
-    if edit.path != "bun.lockb" || edit.kind != KIND {
-        return Err("unexpected binary lock edit path or kind".into());
-    }
-    let id = edit
-        .key
-        .as_deref()
-        .and_then(|s| s.parse().ok())
-        .ok_or("invalid binary package ID")?;
-    let original = edit
-        .original
-        .as_ref()
-        .ok_or("missing original binary package snapshot")?;
-    let new = edit
-        .new
-        .as_ref()
-        .ok_or("missing rewritten binary package snapshot")?;
-    let mut lock = BunLockb::parse(content)?;
-    // Another duplicate may already have been restored by the preceding
-    // edit. Resolve the still-hosted record first, so that duplicate's
-    // original cannot make us skip an active hosted resolution.
-    let id = match lock.find_snapshot_id(id, new)? {
-        Some(id) => id,
-        None if lock.find_snapshot_id(id, original)?.is_some() => return Ok(content.to_vec()),
-        None => {
-            return Err("bun.lockb package has drifted from its recorded hosted resolution".into())
-        }
-    };
-    lock.restore(id, original)?;
-    Ok(lock.bytes())
-}
-
 #[cfg(test)]
 mod tests {
-    use super::super::{
-        revert_npm_redirect_purl, revert_remaining_redirect_edits, Integrity, RedirectState,
-    };
+    use super::super::Integrity;
     use super::*;
     use base64::Engine;
     const FIXTURE: &[u8] =
@@ -218,168 +135,6 @@ mod tests {
         }
     }
 
-    fn state(edits: Vec<FileEdit>) -> RedirectState {
-        let mut state = RedirectState::new();
-        state.edits = edits;
-        for version in ["1.2.2", "1.2.8"] {
-            state.records.insert(
-                format!("pkg:npm/minimist@{version}"),
-                crate::manifest::schema::PatchRecord {
-                    uuid: version.into(),
-                    exported_at: String::new(),
-                    files: Default::default(),
-                    vulnerabilities: Default::default(),
-                    description: String::new(),
-                    license: String::new(),
-                    tier: String::new(),
-                },
-            );
-        }
-        state
-    }
-
-    #[tokio::test]
-    async fn scoped_revert_preserves_other_version_and_full_replay_restores_registry() {
-        let mut result = RewriteResult::default();
-        rewrite_bun_binary(FIXTURE, &[dep("1.2.2"), dep("1.2.8")], &mut result);
-        assert!(result.warnings.is_empty(), "{:?}", result.warnings);
-        assert_eq!(result.edits.len(), 2);
-        let bytes = &result.binary_files["bun.lockb"];
-        let mut rerun = RewriteResult::default();
-        rewrite_bun_binary(bytes, &[dep("1.2.2"), dep("1.2.8")], &mut rerun);
-        assert!(rerun.edits.is_empty());
-        assert!(rerun.binary_files.is_empty());
-        assert_eq!(rerun.confirmed_bun_binary_uuids.len(), 2);
-        let dir = tempfile::tempdir().unwrap();
-        std::fs::write(dir.path().join("bun.lockb"), bytes).unwrap();
-        let mut ledger = state(result.edits);
-        revert_npm_redirect_purl(
-            dir.path(),
-            &mut ledger.clone(),
-            "pkg:npm/minimist@1.2.2",
-            true,
-        )
-        .await
-        .unwrap();
-        assert_eq!(std::fs::read(dir.path().join("bun.lockb")).unwrap(), *bytes);
-        revert_npm_redirect_purl(dir.path(), &mut ledger, "pkg:npm/minimist@1.2.2", false)
-            .await
-            .unwrap();
-        assert_eq!(ledger.edits.len(), 1);
-        assert!(ledger.records.contains_key("pkg:npm/minimist@1.2.8"));
-        let partial =
-            BunLockb::parse(&std::fs::read(dir.path().join("bun.lockb")).unwrap()).unwrap();
-        let packages = partial.packages().unwrap();
-        assert!(packages
-            .iter()
-            .any(|p| p.name == "minimist" && p.version.as_deref() == Some("1.2.2")));
-        assert!(packages
-            .iter()
-            .any(|p| p.resolution == dep("1.2.8").artifact_url));
-        let replay = revert_remaining_redirect_edits(dir.path(), &mut ledger, false).await;
-        assert!(replay.refusals.is_empty(), "{:?}", replay.refusals);
-        assert!(ledger.edits.is_empty());
-        let restored =
-            BunLockb::parse(&std::fs::read(dir.path().join("bun.lockb")).unwrap()).unwrap();
-        assert_eq!(
-            restored.packages().unwrap(),
-            BunLockb::parse(FIXTURE).unwrap().packages().unwrap()
-        );
-    }
-
-    #[tokio::test]
-    async fn whole_replay_is_byte_exact_and_drift_is_transactional() {
-        let mut result = RewriteResult::default();
-        rewrite_bun_binary(FIXTURE, &[dep("1.2.2"), dep("1.2.8")], &mut result);
-        let dir = tempfile::tempdir().unwrap();
-        let bytes = result.binary_files["bun.lockb"].clone();
-        std::fs::write(dir.path().join("bun.lockb"), &bytes).unwrap();
-        // The whole-ledger replay restores the binary lock through the
-        // mode-preserving atomic writer, like the per-purl path.
-        #[cfg(unix)]
-        {
-            use std::os::unix::fs::PermissionsExt;
-            std::fs::set_permissions(
-                dir.path().join("bun.lockb"),
-                std::fs::Permissions::from_mode(0o600),
-            )
-            .unwrap();
-        }
-        let mut ledger = state(result.edits);
-        let replay = revert_remaining_redirect_edits(dir.path(), &mut ledger.clone(), false).await;
-        assert!(replay.refusals.is_empty(), "{:?}", replay.refusals);
-        assert_eq!(
-            std::fs::read(dir.path().join("bun.lockb")).unwrap(),
-            FIXTURE
-        );
-        #[cfg(unix)]
-        {
-            use std::os::unix::fs::PermissionsExt;
-            assert_eq!(
-                std::fs::metadata(dir.path().join("bun.lockb"))
-                    .unwrap()
-                    .permissions()
-                    .mode()
-                    & 0o777,
-                0o600,
-                "bun.lockb keeps its mode across the replay"
-            );
-        }
-        let mut drift = BunLockb::parse(&bytes).unwrap();
-        let first_id = ledger.edits[0].key.as_ref().unwrap().parse().unwrap();
-        drift
-            .set_package(
-                first_id,
-                "https://other.test/minimist-1.2.2.tgz",
-                dep("1.2.2").integrity.sha512.as_ref().unwrap(),
-            )
-            .unwrap();
-        let drift = drift.bytes();
-        std::fs::write(dir.path().join("bun.lockb"), &drift).unwrap();
-        let before = ledger.edits.clone();
-        let replay = revert_remaining_redirect_edits(dir.path(), &mut ledger, false).await;
-        assert_eq!(replay.refusals.len(), 1);
-        assert_eq!(ledger.edits, before);
-        assert_eq!(std::fs::read(dir.path().join("bun.lockb")).unwrap(), drift);
-        assert!(
-            revert_npm_redirect_purl(dir.path(), &mut ledger, "pkg:npm/minimist@1.2.2", true)
-                .await
-                .is_err()
-        );
-    }
-
-    #[tokio::test]
-    async fn scoped_binary_revert_refuses_unattributable_snapshots_without_dropping_records() {
-        let mut result = RewriteResult::default();
-        rewrite_bun_binary(FIXTURE, &[dep("1.2.2")], &mut result);
-        let root = tempfile::tempdir().unwrap();
-        let bytes = &result.binary_files["bun.lockb"];
-        std::fs::write(root.path().join("bun.lockb"), bytes).unwrap();
-        for malformed in [
-            serde_json::json!({"resolution": "https://patch.example.test/1.2.2/minimist-1.2.2.tgz", "version": null}),
-            serde_json::json!({"name": "minimist", "version": 12, "resolution": "https://patch.example.test/1.2.2/minimist-1.2.2.tgz"}),
-        ] {
-            let mut ledger = state(result.edits.clone());
-            ledger.edits[0].new = Some(malformed);
-            let original = serde_json::to_value(&ledger).unwrap();
-            for dry_run in [true, false] {
-                assert!(revert_npm_redirect_purl(
-                    root.path(),
-                    &mut ledger,
-                    "pkg:npm/minimist@1.2.2",
-                    dry_run
-                )
-                .await
-                .is_err());
-                assert_eq!(serde_json::to_value(&ledger).unwrap(), original);
-                assert_eq!(
-                    std::fs::read(root.path().join("bun.lockb")).unwrap(),
-                    *bytes
-                );
-            }
-        }
-    }
-
     #[test]
     fn malformed_metahash_cannot_confirm_an_existing_binary_redirect() {
         let mut result = RewriteResult::default();
@@ -399,47 +154,6 @@ mod tests {
             .any(|w| w.code == "redirect_bun_lockb_invalid"));
     }
 
-    #[tokio::test]
-    async fn scoped_binary_revert_refuses_same_name_without_a_recoverable_version() {
-        let mut result = RewriteResult::default();
-        rewrite_bun_binary(FIXTURE, &[dep("1.2.2")], &mut result);
-        let root = tempfile::tempdir().unwrap();
-        let bytes = &result.binary_files["bun.lockb"];
-        std::fs::write(root.path().join("bun.lockb"), bytes).unwrap();
-        let mut ledger = state(result.edits);
-        let edit = &mut ledger.edits[0];
-        for snapshot in [&mut edit.original, &mut edit.new] {
-            let value = snapshot.as_mut().unwrap();
-            value["version"] = Value::Null;
-            value["resolution"] =
-                Value::String("https://patch.example.test/unattributable.tgz".into());
-        }
-        let before = serde_json::to_value(&ledger).unwrap();
-        for dry_run in [true, false] {
-            assert!(revert_npm_redirect_purl(
-                root.path(),
-                &mut ledger,
-                "pkg:npm/minimist@1.2.2",
-                dry_run
-            )
-            .await
-            .unwrap_err()
-            .contains("version cannot be recovered"));
-            assert_eq!(serde_json::to_value(&ledger).unwrap(), before);
-            assert_eq!(
-                std::fs::read(root.path().join("bun.lockb")).unwrap(),
-                *bytes
-            );
-        }
-        // A known sibling version remains attributable and is left untouched.
-        let edit = &mut ledger.edits[0];
-        for snapshot in [&mut edit.original, &mut edit.new] {
-            snapshot.as_mut().unwrap()["resolution"] = Value::String(dep("1.2.8").artifact_url);
-        }
-        assert!(!names(&ledger.edits[0], "minimist", "1.2.2").unwrap());
-        assert!(names(&ledger.edits[0], "minimist", "1.2.8").unwrap());
-    }
-
     #[test]
     fn bad_digest_and_missing_version_leave_binary_untouched() {
         let mut invalid = dep("1.2.2");
@@ -453,44 +167,4 @@ mod tests {
             assert_eq!(result.warnings.len(), 1);
         }
     }
-
-    #[tokio::test]
-    async fn duplicate_binary_records_are_all_restored_before_dropping_the_ledger() {
-        let mut duplicate = BunLockb::parse(FIXTURE).unwrap();
-        let packages: Vec<_> = duplicate
-            .packages()
-            .unwrap()
-            .into_iter()
-            .filter(|p| p.name == "minimist")
-            .collect();
-        assert_eq!(packages.len(), 2);
-        let first = packages
-            .iter()
-            .find(|p| p.version.as_deref() == Some("1.2.2"))
-            .unwrap();
-        let other = packages.iter().find(|p| p.id != first.id).unwrap();
-        let original = duplicate.snapshot(first.id).unwrap();
-        duplicate.restore(other.id, &original).unwrap();
-        let before = duplicate.bytes();
-        let mut rewritten = RewriteResult::default();
-        rewrite_bun_binary(&before, &[dep("1.2.2")], &mut rewritten);
-        assert_eq!(
-            rewritten.edits.len(),
-            2,
-            "both identical package records are redirected"
-        );
-        let tmp = tempfile::tempdir().unwrap();
-        std::fs::write(
-            tmp.path().join("bun.lockb"),
-            &rewritten.binary_files["bun.lockb"],
-        )
-        .unwrap();
-        let mut ledger = state(rewritten.edits);
-        let reverted = revert_remaining_redirect_edits(tmp.path(), &mut ledger, false).await;
-        assert!(reverted.refusals.is_empty(), "{:?}", reverted.refusals);
-        assert!(ledger.edits.is_empty());
-        let restored =
-            BunLockb::parse(&std::fs::read(tmp.path().join("bun.lockb")).unwrap()).unwrap();
-        assert_eq!(restored.packages().unwrap(), duplicate.packages().unwrap());
-    }
 }
diff --git a/crates/socket-patch-core/src/patch/redirect/hosted_url.rs b/crates/socket-patch-core/src/patch/redirect/hosted_url.rs
new file mode 100644
index 00000000..4f9f780d
--- /dev/null
+++ b/crates/socket-patch-core/src/patch/redirect/hosted_url.rs
@@ -0,0 +1,46 @@
+//! Hosted-artifact URL leaf ownership: whether a hosted tarball URL names a
+//! given npm package version. Shared by the bun binary lock rewriter and the
+//! manifest-less VEX discovery of bun / vlt hosted refs.
+
+/// True when `url` is an http(s) artifact URL whose last path segment is
+/// `<bare>-<version>.tgz` — the leaf every hosted artifact URL for this
+/// `name@version` ends in. `<bare>` is the name without its `@scope/`: the
+/// vendor path layer (`tgz_rel_leaf`) keeps a scope as a directory level
+/// (`@scope/pkg-1.0.0.tgz`), and the hosted rewriter's prior-URL match
+/// (`is_prior_hosted_bun_spec`) compares the same last path segment, so
+/// `pkg-1.0.0.tgz` is the one spelling both agree on. Anything that fails
+/// to parse fails the match (closed). The exact-leaf comparison is the
+/// version discriminator: `pkg-1.3.0.tgz` never equals `pkg-11.3.0.tgz`
+/// or `pkg-1.3.0-rc1.tgz`.
+pub(crate) fn hosted_url_names(url: &str, name: &str, version: &str) -> bool {
+    if !url.starts_with("https://") && !url.starts_with("http://") {
+        return false;
+    }
+    let scheme_end = url
+        .find("://")
+        .expect("url starts with http(s):// — checked above")
+        + 3;
+    let Some(path_start) = url[scheme_end..].find('/').map(|i| i + scheme_end) else {
+        return false;
+    };
+    let leaf = url[path_start..].rsplit('/').next().unwrap_or_default();
+    let bare = name.rsplit('/').next().unwrap_or(name);
+    !leaf.is_empty() && leaf == format!("{bare}-{version}.tgz")
+}
+
+/// The version a hosted artifact `url` names for `name`: its last path
+/// segment is `<bare>-<version>.tgz` with a semver `<version>`, confirmed by
+/// [`hosted_url_names`]. How a hosted bun binary redirect's version is
+/// recovered (`bun_binary::names`) and how lockfile discovery reads a bun
+/// hosted ref's version.
+pub(crate) fn hosted_url_version<'u>(url: &'u str, name: &str) -> Option<&'u str> {
+    let bare = name.rsplit('/').next().unwrap_or(name);
+    let version = url
+        .rsplit('/')
+        .next()?
+        .strip_prefix(bare)?
+        .strip_prefix('-')?
+        .strip_suffix(".tgz")?;
+    (semver::Version::parse(version).is_ok() && hosted_url_names(url, name, version))
+        .then_some(version)
+}
diff --git a/crates/socket-patch-core/src/patch/redirect/mod.rs b/crates/socket-patch-core/src/patch/redirect/mod.rs
index 9f03dbaa..98fd7930 100644
--- a/crates/socket-patch-core/src/patch/redirect/mod.rs
+++ b/crates/socket-patch-core/src/patch/redirect/mod.rs
@@ -53,28 +53,23 @@ mod pnpm_equivalence_tests;
 mod poetry;
 #[cfg(test)]
 mod python_lock_equivalence_tests;
-mod replay;
 mod requirements;
 #[cfg(test)]
 mod rewrite_oracle_support;
 mod staged;
 mod state;
-mod takeover;
+mod hosted_url;
+pub mod upstream;
 pub mod vlt;
 pub mod vlt_heal;
 pub mod vlt_preflight;
-pub use replay::{revert_remaining_redirect_edits, GroupRefusal, ReplayOutcome};
 pub use state::{
-    drop_superseded_purl, load_redirect_state, persist_redirect_state, save_redirect_state,
+    load_redirect_state, save_redirect_state,
     CorruptRedirectState, RedirectState, REDIRECT_STATE_REL,
 };
 /// Hosted-artifact leaf ownership rule, shared with `vex`'s bun lockfile
 /// discovery (which recovers a URL tuple's version from that leaf).
-pub(crate) use takeover::{hosted_url_names, hosted_url_version};
-pub use takeover::{
-    redirect_revert_supported, revert_cargo_redirect_purl, revert_golang_redirect_purl,
-    revert_npm_redirect_purl, revert_redirect_purl, RedirectRevert,
-};
+pub(crate) use hosted_url::{hosted_url_names, hosted_url_version};
 
 /// One ecosystem's integrity hashes (mirrors the TS `PatchArtifactIntegrity`).
 #[derive(Debug, Clone, Default, Deserialize)]
@@ -3869,18 +3864,6 @@ fn yarn_classic_block_head(block: &str) -> Option<(String, Option<String>)> {
 /// can reproduce offline; matches the vendored backend's `SUPPORTED_CACHE_KEY`.
 const YARN_BERRY_SUPPORTED_CACHE_KEY: &str = "10c0";
 
-/// Whether ledger edits of `kind` are yarn.lock blocks — the fragments the
-/// yarn rewriters record in the lock's ON-DISK line endings, which the
-/// reverts (the per-purl takeover and the whole-ledger replay) may respell
-/// in the live lock's ending when a `core.autocrlf` checkout changed it
-/// ([`crate::utils::line_endings::fragments_in_eol_of`]).
-pub(crate) fn yarn_lock_fragment_kind(kind: &str) -> bool {
-    matches!(
-        kind,
-        "redirect_yarn_berry_entry" | "redirect_yarn_classic_entry"
-    )
-}
-
 /// A yarn.lock is berry (v2+) when it carries the `__metadata:` header block;
 /// anything else is a classic v1 lock. Shared by both yarn rewriters and
 /// lockfile discovery (`vex::discover::yarn`) so the grammar split cannot
diff --git a/crates/socket-patch-core/src/patch/redirect/npmrc.rs b/crates/socket-patch-core/src/patch/redirect/npmrc.rs
index e8497d85..ac102ef7 100644
--- a/crates/socket-patch-core/src/patch/redirect/npmrc.rs
+++ b/crates/socket-patch-core/src/patch/redirect/npmrc.rs
@@ -5,12 +5,9 @@
 //! lockfile entry whose `resolved` tarball URL is not served by the
 //! configured registry — exactly what a hosted redirect writes. The hosted
 //! flow therefore ensures `allow-remote=all` in the project `.npmrc`
-//! (creating the file, or appending one line) and records the edit in the
-//! redirect ledger under [`NPMRC_ALLOW_REMOTE_EDIT_KIND`], so every unwind
-//! path (rollback / remove replay, the per-purl npm revert behind scoped
-//! rollback and the vendored takeover, the vendored-supersedes-hosted
-//! reconcile) removes exactly what was added once no redirected npm lock
-//! entry needs it any more.
+//! (creating the file, or appending one line) and reports the edit under
+//! [`NPMRC_ALLOW_REMOTE_EDIT_KIND`]. The upstream restore (`upstream::npm`)
+//! removes the line again once no hosted npm lock entry needs it.
 //!
 //! The `.npmrc` grammar here is npm's as MEASURED against npm 12.1.0
 //! (`npm config get allow-remote` plus a real EALLOWREMOTE/ENOTFOUND install
@@ -36,9 +33,7 @@
 //! and — when the project file is silent — the user / global / builtin
 //! config files ([`resolve_outer_allow_remote`]).
 
-use std::collections::HashSet;
 
-use super::FileEdit;
 
 /// Repo-relative path of the project `.npmrc` the auto-config edits.
 pub const NPMRC_REL: &str = ".npmrc";
@@ -58,11 +53,6 @@ pub const NPMRC_ALLOW_REMOTE_LINE: &str = "allow-remote=all";
 /// The exact `.npmrc` the auto-config CREATES when none existed.
 pub const NPMRC_CREATED: &str = "allow-remote=all\n";
 
-/// The ledger kinds that record a package-lock.json / npm-shrinkwrap.json
-/// hosted splice — the entries that NEED `allow-remote=all` on npm >= 12.
-/// While any of them remains in the ledger the `.npmrc` edit stays.
-pub const NPM_LOCK_EDIT_KINDS: [&str; 2] = ["redirect_npm_lock_entry", "redirect_npm_lock_dep"];
-
 const BOM: char = '\u{feff}';
 
 /// ECMAScript whitespace — what npm's `ini` means by `\s` and by
@@ -637,303 +627,10 @@ pub fn plan_npmrc_allow_remote_with(existing: Option<&str>, outer: &OuterAllowRe
     NpmrcPlan::Append(format!("{bom}{}", lines.join("\n")))
 }
 
-/// What unwinding one recorded `.npmrc` edit does to the live file.
-#[derive(Debug, PartialEq)]
-pub enum NpmrcUnwind {
-    /// The file is gone, or no longer carries the line — already clean.
-    Unchanged,
-    /// Delete the file (a `created` edit whose file still holds exactly
-    /// [`NPMRC_CREATED`]).
-    Delete,
-    /// Write this content (the one line removed). `modified_created` is
-    /// set when a `created` file had grown other content: it is kept and
-    /// only the line goes, which callers surface as
-    /// `redirect_npmrc_allow_remote_modified`.
-    Write {
-        content: String,
-        modified_created: bool,
-    },
-}
-
-/// Is `line` (one `\n`-split element, maybe carrying a CRLF `\r` or the
-/// file's BOM) exactly the line the auto-config writes?
-fn is_our_line(line: &str) -> bool {
-    line.trim_start_matches(BOM).trim_end_matches('\r') == NPMRC_ALLOW_REMOTE_LINE
-}
-
-/// Unwind one recorded `.npmrc` edit (`action` `created` / `added`) against
-/// the live `content` (`None` = file absent). Exact inverse of
-/// [`plan_npmrc_allow_remote`]'s splice: the one matching line is removed
-/// with its line terminator, every other byte kept. Only TOP-LEVEL lines
-/// (before the first real ini `[section]` header — the scope the plan
-/// writes into and npm reads the key from) count: a copy under a section
-/// is inert user text, never ours. `Err` when the line appears more than
-/// once at top level (ambiguous — refuse rather than guess which copy the
-/// redirect owns).
-pub fn unwind_npmrc_allow_remote(
-    action: &str,
-    content: Option<&str>,
-) -> Result<NpmrcUnwind, String> {
-    let Some(content) = content else {
-        return Ok(NpmrcUnwind::Unchanged);
-    };
-    if action == "created" && content == NPMRC_CREATED {
-        return Ok(NpmrcUnwind::Delete);
-    }
-    let (bom, body) = match content.strip_prefix(BOM) {
-        Some(rest) => (&content[..BOM.len_utf8()], rest),
-        None => ("", content),
-    };
-    let mut lines: Vec<&str> = body.split('\n').collect();
-    let end = top_level_end(bom, &lines);
-    let hits: Vec<usize> = lines[..end]
-        .iter()
-        .enumerate()
-        .filter(|(_, l)| is_our_line(l))
-        .map(|(i, _)| i)
-        .collect();
-    match hits.as_slice() {
-        [] => Ok(NpmrcUnwind::Unchanged),
-        [i] => {
-            lines.remove(*i);
-            let rest = lines.join("\n");
-            // A created file reduced to nothing but its BOM/whitespace is the
-            // redirect's own file: delete it rather than leave a husk.
-            if action == "created" && rest.trim().is_empty() {
-                return Ok(NpmrcUnwind::Delete);
-            }
-            Ok(NpmrcUnwind::Write {
-                content: format!("{bom}{rest}"),
-                modified_created: action == "created",
-            })
-        }
-        _ => Err(format!(
-            "{NPMRC_REL}: the `{NPMRC_ALLOW_REMOTE_LINE}` line appears more than once — \
-             ambiguous, refusing to guess which copy the hosted redirect added; remove the \
-             duplicate, then re-run"
-        )),
-    }
-}
-
-/// The advisory for a redirect-created `.npmrc` that was modified since.
-pub fn npmrc_modified_warning() -> (String, String) {
-    (
-        "redirect_npmrc_allow_remote_modified".to_string(),
-        format!(
-            "{NPMRC_REL} was created by the hosted redirect but has been modified since — kept \
-             the file and removed only the `{NPMRC_ALLOW_REMOTE_LINE}` line"
-        ),
-    )
-}
-
-/// The unwind of every recorded `.npmrc` edit once no redirected npm lock
-/// entry needs `allow-remote=all` any more.
-#[derive(Debug, Default)]
-pub struct NpmrcUnwindPlan {
-    /// Ledger indices of the `.npmrc` edits to drop.
-    pub indices: Vec<usize>,
-    /// `None` — the file needs no change; `Some(None)` — delete it;
-    /// `Some(Some(text))` — write `text`.
-    pub staged: Option<Option<String>>,
-    /// Advisory (code, detail) pairs.
-    pub warnings: Vec<(String, String)>,
-}
-
-/// Is an unwind of the recorded `.npmrc` edit(s) due once `dropping` (the
-/// ledger indices the caller is about to remove) is gone? True iff a
-/// [`NPMRC_ALLOW_REMOTE_EDIT_KIND`] edit survives while no
-/// [`NPM_LOCK_EDIT_KINDS`] edit does. Callers check this BEFORE reading the
-/// live `.npmrc`, so a file that merely has an odd shape never refuses an
-/// unrelated revert while the setting is still needed.
-pub fn npmrc_unwind_due(edits: &[FileEdit], dropping: &HashSet<usize>) -> bool {
-    let live = |kinds: &[&str]| {
-        edits
-            .iter()
-            .enumerate()
-            .any(|(i, e)| !dropping.contains(&i) && kinds.contains(&e.kind.as_str()))
-    };
-    live(&[NPMRC_ALLOW_REMOTE_EDIT_KIND]) && !live(&NPM_LOCK_EDIT_KINDS)
-}
-
-/// "Last one out turns off the lights" for the `.npmrc` auto-config: when
-/// no [`NPM_LOCK_EDIT_KINDS`] edit survives outside `dropping` (the indices
-/// the caller is about to remove), plan the unwind of every recorded
-/// [`NPMRC_ALLOW_REMOTE_EDIT_KIND`] edit, newest first, against `current`
-/// (the live `.npmrc`). `Ok(None)` when an npm lock edit still needs the
-/// setting, or there is no `.npmrc` edit to unwind. `Err` on an ambiguous
-/// file or a tampered ledger path (callers fail closed).
-pub fn plan_unneeded_npmrc_unwind(
-    edits: &[FileEdit],
-    dropping: &HashSet<usize>,
-    current: Option<String>,
-) -> Result<Option<NpmrcUnwindPlan>, String> {
-    let still_needed = edits
-        .iter()
-        .enumerate()
-        .any(|(i, e)| !dropping.contains(&i) && NPM_LOCK_EDIT_KINDS.contains(&e.kind.as_str()));
-    if still_needed {
-        return Ok(None);
-    }
-    let indices: Vec<usize> = edits
-        .iter()
-        .enumerate()
-        .filter(|(i, e)| !dropping.contains(i) && e.kind == NPMRC_ALLOW_REMOTE_EDIT_KIND)
-        .map(|(i, _)| i)
-        .collect();
-    if indices.is_empty() {
-        return Ok(None);
-    }
-    let mut plan = NpmrcUnwindPlan {
-        indices: indices.clone(),
-        ..NpmrcUnwindPlan::default()
-    };
-    let mut content = current;
-    for &i in indices.iter().rev() {
-        let edit = &edits[i];
-        if edit.path != NPMRC_REL {
-            return Err(format!(
-                "the redirect ledger records a {} edit for `{}` (expected `{NPMRC_REL}`); \
-                 refusing to touch it",
-                edit.kind, edit.path
-            ));
-        }
-        match unwind_npmrc_allow_remote(&edit.action, content.as_deref())? {
-            NpmrcUnwind::Unchanged => {}
-            NpmrcUnwind::Delete => {
-                content = None;
-                plan.staged = Some(None);
-            }
-            NpmrcUnwind::Write {
-                content: next,
-                modified_created,
-            } => {
-                if modified_created {
-                    plan.warnings.push(npmrc_modified_warning());
-                }
-                content = Some(next.clone());
-                plan.staged = Some(Some(next));
-            }
-        }
-    }
-    Ok(Some(plan))
-}
-
-/// Read the live project `.npmrc` for an unwind: `Ok(None)` when absent.
-/// Refuses (`Err`) a symlink or any non-regular file HERE, at plan time —
-/// [`flush_npmrc`] would refuse it too, but only after the caller's other
-/// staged files (the reverted lock) had already been written, leaving the
-/// lock unwound while the ledger still records the redirect. FIFO-safe
-/// (non-blocking open + fstat), so a planted FIFO refuses fast instead of
-/// wedging the run.
-pub fn read_project_npmrc(project_root: &std::path::Path) -> Result<Option<String>, String> {
-    let path = project_root.join(NPMRC_REL);
-    match std::fs::symlink_metadata(&path) {
-        Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(None),
-        Err(e) => return Err(format!("inspect {NPMRC_REL}: {e}")),
-        Ok(meta) if !meta.is_file() => {
-            return Err(format!(
-                "{NPMRC_REL} is not a regular file (a symlink, directory or special file); \
-                 socket-patch never writes through one — replace it with a regular file, \
-                 then re-run"
-            ))
-        }
-        Ok(_) => {}
-    }
-    match crate::utils::fs::read_regular_to_string_sync(&path) {
-        Ok(text) => Ok(Some(text)),
-        Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(None),
-        Err(e) => Err(format!("read {NPMRC_REL}: {e}")),
-    }
-}
-
-/// Write (or delete) a planned `.npmrc` unwind through the reverts' shared
-/// staged flush: it refuses a non-regular file (a symlink or FIFO planted at
-/// the path) instead of writing through it, and writes atomically keeping
-/// the file's mode.
-pub async fn flush_npmrc(
-    project_root: &std::path::Path,
-    staged: &Option<String>,
-) -> Result<(), String> {
-    let one = super::staged::Staged::from([(NPMRC_REL.to_string(), staged.clone())]);
-    super::staged::flush_staged(project_root, &one, &super::staged::StagedBytes::new()).await
-}
-
-/// What [`unwind_unneeded_npmrc`] did.
-#[derive(Debug, Default, PartialEq)]
-pub struct NpmrcStandaloneUnwind {
-    /// The `.npmrc` itself was (or, on a dry run, would be) rewritten or
-    /// deleted.
-    pub file_changed: bool,
-    /// At least one recorded `.npmrc` edit was dropped from the ledger.
-    pub edits_dropped: bool,
-    /// Advisory (code, detail) pairs (e.g.
-    /// `redirect_npmrc_allow_remote_modified`).
-    pub warnings: Vec<(String, String)>,
-}
-
-/// Standalone "last one out" pass over a ledger the caller has just pruned
-/// WITHOUT an on-disk revert (the vendored-supersedes-hosted reconcile):
-/// when no npm lock edit remains, unwind the recorded `.npmrc` edits on
-/// disk (unless `dry_run`) and drop them from `state`. Returns what changed
-/// plus the advisory warnings (the caller surfaces them); the caller
-/// persists `state`. The ledger is only consulted — and the file only
-/// read — when it records a `.npmrc` edit at all.
-pub async fn unwind_unneeded_npmrc(
-    project_root: &std::path::Path,
-    state: &mut super::RedirectState,
-    dry_run: bool,
-) -> Result<NpmrcStandaloneUnwind, String> {
-    if !npmrc_unwind_due(&state.edits, &HashSet::new()) {
-        // Nothing recorded, or still needed: no read, no refusal over the
-        // file's shape.
-        return Ok(NpmrcStandaloneUnwind::default());
-    }
-    let current = read_project_npmrc(project_root)?;
-    let Some(plan) = plan_unneeded_npmrc_unwind(&state.edits, &HashSet::new(), current)? else {
-        return Ok(NpmrcStandaloneUnwind::default());
-    };
-    if !dry_run {
-        if let Some(staged) = &plan.staged {
-            flush_npmrc(project_root, staged).await?;
-        }
-    }
-    let drop: HashSet<usize> = plan.indices.iter().copied().collect();
-    let mut idx = 0usize;
-    state.edits.retain(|_| {
-        let keep = !drop.contains(&idx);
-        idx += 1;
-        keep
-    });
-    Ok(NpmrcStandaloneUnwind {
-        file_changed: plan.staged.is_some(),
-        edits_dropped: !plan.indices.is_empty(),
-        warnings: plan.warnings,
-    })
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
 
-    fn edit(kind: &str, action: &str) -> FileEdit {
-        FileEdit {
-            path: if kind == NPMRC_ALLOW_REMOTE_EDIT_KIND {
-                NPMRC_REL.into()
-            } else {
-                "package-lock.json".into()
-            },
-            kind: kind.into(),
-            action: action.into(),
-            key: Some(if kind == NPMRC_ALLOW_REMOTE_EDIT_KIND {
-                "allow-remote".into()
-            } else {
-                "node_modules/left-pad".into()
-            }),
-            original: None,
-            new: Some(serde_json::json!("all")),
-        }
-    }
-
     /// The measured npm 12.1.0 grammar (see the module doc): exact key
     /// spelling only, BOM / whitespace / CRLF / quotes / inline comments
     /// tolerated, comment lines and `[section]` bodies ignored, LAST
@@ -1081,44 +778,6 @@ mod tests {
         assert_eq!(text, "\u{feff}[x]\nallow-remote=all\n[sec]\ny=1\n");
     }
 
-    /// `[sec]\nallow-remote=all\n` (inert under a section) plans a
-    /// top-level append, so the unwind must count only top-level lines,
-    /// like the plan — counting BOTH copies would refuse as ambiguous and
-    /// block rollback, remove, the vendored takeover and the reconcile over
-    /// a state our own writer created.
-    #[test]
-    fn unwind_ignores_section_scoped_copies() {
-        let before = "[sec]\nallow-remote=all\n";
-        let NpmrcPlan::Append(text) = plan_npmrc_allow_remote(Some(before)) else {
-            panic!("append expected");
-        };
-        assert_eq!(text, "allow-remote=all\n[sec]\nallow-remote=all\n");
-        assert_eq!(
-            unwind_npmrc_allow_remote("added", Some(&text)).unwrap(),
-            NpmrcUnwind::Write {
-                content: before.into(),
-                modified_created: false
-            }
-        );
-        // Only a section copy left: nothing of ours to remove.
-        assert_eq!(
-            unwind_npmrc_allow_remote("added", Some(before)).unwrap(),
-            NpmrcUnwind::Unchanged
-        );
-        // The ledger-level plan agrees (the per-purl revert / reconcile path).
-        let edits = vec![edit(NPMRC_ALLOW_REMOTE_EDIT_KIND, "added")];
-        let plan = plan_unneeded_npmrc_unwind(&edits, &HashSet::new(), Some(text))
-            .unwrap()
-            .expect("unwind planned");
-        assert_eq!(plan.staged, Some(Some(before.into())));
-        // Two TOP-LEVEL copies are still genuinely ambiguous.
-        assert!(unwind_npmrc_allow_remote(
-            "added",
-            Some("allow-remote=all\nallow-remote=all\n[sec]\nallow-remote=all\n")
-        )
-        .is_err());
-    }
-
     fn cfg_env(vars: &[(&str, &str)]) -> NpmConfigEnv {
         NpmConfigEnv {
             vars: vars
@@ -1444,35 +1103,6 @@ mod tests {
         assert_eq!(strip_verbatim(unc.clone(), true), unc);
     }
 
-    #[test]
-    fn unwind_due_only_when_no_npm_lock_edit_survives() {
-        let edits = vec![
-            edit("redirect_npm_lock_entry", "rewritten"),
-            edit(NPMRC_ALLOW_REMOTE_EDIT_KIND, "created"),
-        ];
-        assert!(!npmrc_unwind_due(&edits, &HashSet::new()));
-        assert!(npmrc_unwind_due(&edits, &HashSet::from([0])));
-        assert!(!npmrc_unwind_due(&edits, &HashSet::from([0, 1])));
-        assert!(!npmrc_unwind_due(&edits[..1], &HashSet::new()));
-    }
-
-    /// The read used while PLANNING refuses a symlinked `.npmrc`, so the
-    /// per-purl revert never learns it is unwritable only at flush time,
-    /// after the reverted lock had landed.
-    #[cfg(unix)]
-    #[test]
-    fn read_project_npmrc_refuses_a_symlink_at_plan_time() {
-        let dir = tempfile::tempdir().unwrap();
-        assert_eq!(read_project_npmrc(dir.path()), Ok(None));
-        std::fs::write(dir.path().join("shared.npmrc"), "allow-remote=all\n").unwrap();
-        std::os::unix::fs::symlink("shared.npmrc", dir.path().join(".npmrc")).unwrap();
-        let err = read_project_npmrc(dir.path()).unwrap_err();
-        assert!(err.contains("not a regular file"), "{err}");
-        std::fs::remove_file(dir.path().join(".npmrc")).unwrap();
-        std::fs::create_dir(dir.path().join(".npmrc")).unwrap();
-        assert!(read_project_npmrc(dir.path()).is_err());
-    }
-
     #[test]
     fn plan_creates_when_absent() {
         assert_eq!(
@@ -1481,49 +1111,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn plan_appends_preserving_bytes_and_round_trips() {
-        let cases = [
-            (
-                "registry=https://r.example/\n",
-                "registry=https://r.example/\nallow-remote=all\n",
-            ),
-            ("a=1", "a=1\nallow-remote=all"),
-            ("a=1\n\n", "a=1\nallow-remote=all\n\n"),
-            ("a=1\r\nb=2\r\n", "a=1\r\nb=2\r\nallow-remote=all\r\n"),
-            ("\u{feff}a=1\n", "\u{feff}a=1\nallow-remote=all\n"),
-            ("", "allow-remote=all\n"),
-            ("\u{feff}", "\u{feff}allow-remote=all\n"),
-            ("\n", "allow-remote=all\n\n"),
-            ("; team config\n", "; team config\nallow-remote=all\n"),
-            // An `allow_remote` spelling npm ignores stays byte-identical.
-            ("allow_remote=all\n", "allow_remote=all\nallow-remote=all\n"),
-            // Never inside an ini section: before the first header.
-            ("a=1\n[sec]\nx=1\n", "a=1\nallow-remote=all\n[sec]\nx=1\n"),
-            ("[sec]\nx=1\n", "allow-remote=all\n[sec]\nx=1\n"),
-        ];
-        for (before, after) in cases {
-            let NpmrcPlan::Append(text) = plan_npmrc_allow_remote(Some(before)) else {
-                panic!("{before:?} must plan an append");
-            };
-            assert_eq!(text, after, "append into {before:?}");
-            assert_eq!(
-                npmrc_allow_remote(&text).as_deref(),
-                Some("all"),
-                "{text:?}"
-            );
-            // Exact inverse: the unwind restores the user's bytes.
-            assert_eq!(
-                unwind_npmrc_allow_remote("added", Some(&text)).unwrap(),
-                NpmrcUnwind::Write {
-                    content: before.to_string(),
-                    modified_created: false
-                },
-                "unwind of {text:?}"
-            );
-        }
-    }
-
     #[test]
     fn plan_respects_existing_values() {
         for text in [
@@ -1551,110 +1138,4 @@ mod tests {
         }
     }
 
-    #[test]
-    fn unwind_created_file() {
-        assert_eq!(
-            unwind_npmrc_allow_remote("created", Some(NPMRC_CREATED)).unwrap(),
-            NpmrcUnwind::Delete
-        );
-        assert_eq!(
-            unwind_npmrc_allow_remote("created", None).unwrap(),
-            NpmrcUnwind::Unchanged
-        );
-        // Grown since: keep the file, drop only our line, say so.
-        assert_eq!(
-            unwind_npmrc_allow_remote("created", Some("allow-remote=all\nfund=false\n")).unwrap(),
-            NpmrcUnwind::Write {
-                content: "fund=false\n".into(),
-                modified_created: true
-            }
-        );
-        // The user already removed our line: nothing to do.
-        assert_eq!(
-            unwind_npmrc_allow_remote("added", Some("fund=false\n")).unwrap(),
-            NpmrcUnwind::Unchanged
-        );
-        // A commented-out copy is not our line.
-        assert_eq!(
-            unwind_npmrc_allow_remote("added", Some("; allow-remote=all\n")).unwrap(),
-            NpmrcUnwind::Unchanged
-        );
-        // Ambiguous duplicates refuse.
-        assert!(
-            unwind_npmrc_allow_remote("added", Some("allow-remote=all\nallow-remote=all\n"))
-                .is_err()
-        );
-    }
-
-    #[test]
-    fn last_one_out_keeps_the_setting_while_npm_lock_edits_remain() {
-        let edits = vec![
-            edit("redirect_npm_lock_entry", "rewritten"),
-            edit(NPMRC_ALLOW_REMOTE_EDIT_KIND, "created"),
-        ];
-        // The lock edit survives: the setting is still needed.
-        assert!(
-            plan_unneeded_npmrc_unwind(&edits, &HashSet::new(), Some(NPMRC_CREATED.into()))
-                .unwrap()
-                .is_none()
-        );
-        // The lock edit is being dropped: unwind (delete the created file).
-        let plan =
-            plan_unneeded_npmrc_unwind(&edits, &HashSet::from([0]), Some(NPMRC_CREATED.into()))
-                .unwrap()
-                .expect("unwind planned");
-        assert_eq!(plan.indices, vec![1]);
-        assert_eq!(plan.staged, Some(None));
-        // A pnpm-only ledger with a stray `.npmrc` edit also unwinds.
-        let edits = vec![
-            edit("redirect_pnpm_resolution", "rewritten"),
-            edit(NPMRC_ALLOW_REMOTE_EDIT_KIND, "added"),
-        ];
-        let plan = plan_unneeded_npmrc_unwind(
-            &edits,
-            &HashSet::new(),
-            Some("a=1\nallow-remote=all\n".into()),
-        )
-        .unwrap()
-        .expect("unwind planned");
-        assert_eq!(plan.staged, Some(Some("a=1\n".into())));
-        // A tampered ledger path refuses.
-        let mut bad = edit(NPMRC_ALLOW_REMOTE_EDIT_KIND, "added");
-        bad.path = "../.npmrc".into();
-        assert!(plan_unneeded_npmrc_unwind(&[bad], &HashSet::new(), None).is_err());
-    }
-
-    #[tokio::test]
-    async fn standalone_unwind_removes_only_our_line_and_drops_the_edit() {
-        let dir = tempfile::tempdir().unwrap();
-        std::fs::write(
-            dir.path().join(".npmrc"),
-            "fund=false\r\nallow-remote=all\r\n",
-        )
-        .unwrap();
-        let mut state = super::super::RedirectState::new();
-        state
-            .edits
-            .push(edit(NPMRC_ALLOW_REMOTE_EDIT_KIND, "added"));
-        // Dry run: nothing written, edit still dropped from the (throwaway) state.
-        let mut probe = state.clone();
-        unwind_unneeded_npmrc(dir.path(), &mut probe, true)
-            .await
-            .unwrap();
-        assert!(probe.edits.is_empty());
-        assert_eq!(
-            std::fs::read_to_string(dir.path().join(".npmrc")).unwrap(),
-            "fund=false\r\nallow-remote=all\r\n"
-        );
-        let out = unwind_unneeded_npmrc(dir.path(), &mut state, false)
-            .await
-            .unwrap();
-        assert!(out.warnings.is_empty());
-        assert!(out.file_changed && out.edits_dropped, "{out:?}");
-        assert!(state.edits.is_empty());
-        assert_eq!(
-            std::fs::read_to_string(dir.path().join(".npmrc")).unwrap(),
-            "fund=false\r\n"
-        );
-    }
 }
diff --git a/crates/socket-patch-core/src/patch/redirect/pipenv.rs b/crates/socket-patch-core/src/patch/redirect/pipenv.rs
index 7725c9e6..1eaf8cfd 100644
--- a/crates/socket-patch-core/src/patch/redirect/pipenv.rs
+++ b/crates/socket-patch-core/src/patch/redirect/pipenv.rs
@@ -7,10 +7,10 @@ use serde_json::{json, Value};
 use super::{DepOverride, FileEdit, RewriteResult, RewriteWarning};
 use crate::crawlers::python_crawler::canonicalize_pypi_name;
 
-struct Property {
-    name: String,
-    range: Range<usize>,
-    value: Value,
+pub(super) struct Property {
+    pub(super) name: String,
+    pub(super) range: Range<usize>,
+    pub(super) value: Value,
 }
 
 fn properties(text: &str, offset: usize) -> Result<Vec<Property>, String> {
@@ -82,7 +82,7 @@ fn properties(text: &str, offset: usize) -> Result<Vec<Property>, String> {
     }
 }
 
-fn entries(text: &str) -> Result<Vec<(String, Property)>, String> {
+pub(super) fn entries(text: &str) -> Result<Vec<(String, Property)>, String> {
     // A UTF-8 BOM (Windows editors) is not JSON; parse past it. Offsets
     // below come from `text.find('{')`, so they stay byte-accurate.
     let value =
@@ -111,7 +111,7 @@ fn entries(text: &str) -> Result<Vec<(String, Property)>, String> {
     Ok(result)
 }
 
-fn format_entry(value: &Value, text: &str, start: usize) -> Result<String, String> {
+pub(super) fn format_entry(value: &Value, text: &str, start: usize) -> Result<String, String> {
     let mut bytes = Vec::new();
     let formatter = serde_json::ser::PrettyFormatter::with_indent(b"    ");
     value
@@ -162,82 +162,6 @@ pub(super) fn reserialized_around_reference(live: &Value, ours: &Value) -> bool
         .all(|key| live.get(key) == ours.get(key))
 }
 
-pub(super) fn restore(text: &str, edit: &FileEdit) -> Result<String, String> {
-    if edit.path != "Pipfile.lock" {
-        return Err("Pipenv edit must target Pipfile.lock".into());
-    }
-    let [section, name]: [String; 2] =
-        serde_json::from_str(edit.key.as_deref().ok_or("missing Pipenv key")?)
-            .map_err(|e| e.to_string())?;
-    let original = edit
-        .original
-        .as_ref()
-        .and_then(Value::as_str)
-        .ok_or("missing Pipenv original")?;
-    // The ledger is committed and tamper-able: only a JSON object may be
-    // spliced back into the lock (never arbitrary text that would corrupt
-    // it or smuggle in extra entries).
-    if !serde_json::from_str::<Value>(original).is_ok_and(|value| value.is_object()) {
-        return Err("Pipenv original is not a JSON object".into());
-    }
-    let new = edit
-        .new
-        .as_ref()
-        .and_then(Value::as_str)
-        .ok_or("missing Pipenv replacement")?;
-    let Some((_, entry)) = entries(text)?
-        .into_iter()
-        .find(|(category, entry)| category == &section && entry.name == name)
-    else {
-        // A relock that DROPPED the entry (`pipenv uninstall <pkg>`, a Pipfile
-        // edit + `pipenv lock`): the redirect is gone with it — nothing to
-        // unwind, the edit retires.
-        return Ok(text.into());
-    };
-    let live = &text[entry.range.clone()];
-    let ending = if text.contains("\r\n") { "\r\n" } else { "\n" };
-    let original_value: Value = serde_json::from_str(original).map_err(|e| e.to_string())?;
-    let new_value: Option<Value> = serde_json::from_str(new).ok();
-    // Comparisons are SEMANTIC (parsed JSON), so a line-ending conversion of
-    // the whole file (git autocrlf, a cross-OS checkout) or a re-serialization
-    // that only moved whitespace is neither drift nor a reason to refuse.
-    if live == original || entry.value == original_value {
-        return Ok(text.into());
-    }
-    // "Still ours": Pipenv re-serialized the entry around the very reference
-    // we wrote (see [`reserialized_around_reference`]).
-    let same_reference = new_value
-        .as_ref()
-        .is_some_and(|new_value| reserialized_around_reference(&entry.value, new_value));
-    if live != new && new_value.as_ref() != Some(&entry.value) && !same_reference {
-        // A relock (`pipenv lock`, `pipenv update`, `pipenv install <other>`
-        // on <= 2023) regenerates the entry to registry shape: the redirect
-        // is already gone and the user's fresh resolution is the desired end
-        // state, so the edit is retired instead of holding every pypi revert
-        // hostage forever. A DIFFERENT `file`/`path` reference (a user's own
-        // source, a hand edit) is real drift and still refuses.
-        let registry_shaped = entry
-            .value
-            .as_object()
-            .is_some_and(|object| !object.contains_key("file") && !object.contains_key("path"));
-        if registry_shaped {
-            return Ok(text.into());
-        }
-        return Err(format!("Pipenv entry {section}.{name} drifted"));
-    }
-    // Still our reference (byte-identical, re-serialized by Pipenv, or a
-    // `--keep-outdated` hybrid that kept our `file`/`path`): splice the
-    // recorded original back, in the live file's line ending.
-    let restored = if ending == "\r\n" {
-        original.replace("\r\n", "\n").replace('\n', "\r\n")
-    } else {
-        original.replace("\r\n", "\n")
-    };
-    let mut result = text.to_owned();
-    result.replace_range(entry.range, &restored);
-    Ok(result)
-}
-
 /// Whether any pypi override names a package this `Pipfile.lock` pins — the
 /// cheap pre-check that decides whether the installer probe
 /// (`pipenv --version`, up to 10 s) is worth running and whether its
@@ -452,7 +376,6 @@ fn plan(
             if object.get(source_key).and_then(Value::as_str) == Some(&url)
                 && object.get("hashes") == Some(&json!([format!("sha256:{sha}")]))
                 && !object.contains_key("version")
-                && !object.contains_key("index")
             {
                 continue;
             }
@@ -464,9 +387,18 @@ fn plan(
                 dep.name, dep.version
             )));
         }
+        // `index` stays exactly as Pipenv wrote it (present or absent): it
+        // is the one registry field the upstream restore cannot re-derive.
+        // Whether Pipenv records it depends on the release, the Pipfile
+        // spelling and the locking environment (2022.12.19 writes it for an
+        // `extras` table, 2026.8.0 does not; neither writes it for a
+        // marker-excluded package or a transitive one), so dropping it would
+        // make `rollback` guess. On a `file`/`path` entry it only selects
+        // the source group Pipenv installs the URL through — pip fetches
+        // the URL itself either way (measured on 2018.11.26 through
+        // 2026.8.0: install, `--deploy`, `sync`, `verify`).
         let mut new = object.clone();
         new.remove("version");
-        new.remove("index");
         new.remove("file");
         new.remove("path");
         new.insert(source_key.into(), Value::String(url.clone()));
@@ -529,11 +461,6 @@ mod tests {
                 );
             }
             assert_eq!(plan(&text, &dep, None).unwrap(), (text.clone(), Vec::new()));
-            let mut restored = text;
-            for edit in edits.iter().rev() {
-                restored = restore(&restored, edit).unwrap();
-            }
-            assert_eq!(restored, original);
         }
     }
 
@@ -629,17 +556,13 @@ mod tests {
     }
 
     #[test]
-    fn bom_prefixed_lock_is_rewritten_and_restored_with_the_bom_intact() {
+    fn bom_prefixed_lock_is_rewritten_with_the_bom_intact() {
         let dep = dependency("urllib3", "1.26.18", "patch-one");
         let original = format!("\u{feff}{}", lock());
         let (text, edits) = plan(&original, &dep, None).unwrap();
         assert!(text.starts_with('\u{feff}'), "the BOM is preserved");
         assert!(text.contains("patch.socket.dev"));
-        let mut restored = text;
-        for edit in edits.iter().rev() {
-            restored = restore(&restored, edit).unwrap();
-        }
-        assert_eq!(restored, original);
+        assert!(!edits.is_empty());
     }
 
     #[test]
@@ -663,50 +586,6 @@ mod tests {
         assert!(plan(&lock(), &missing_hash, None).is_err());
     }
 
-    /// `pipenv lock` (and `update`, and `install <other>` before 2024)
-    /// regenerates the redirected entry to registry shape. That is the
-    /// desired end state of a rollback, so the edit retires cleanly instead
-    /// of refusing forever; a foreign `file`/`path` reference is still drift.
-    /// A re-scan after the relock (second edit on the same key) unwinds
-    /// newest-first to the relocked text.
-    #[test]
-    fn relocked_registry_entry_retires_the_edit_instead_of_refusing() {
-        let dep = dependency("urllib3", "1.26.18", "patch-one");
-        // One category, so the relock below regenerates the ONLY redirect.
-        let mut value: Value = serde_json::from_str(&lock()).unwrap();
-        value.as_object_mut().unwrap().remove("tests");
-        let original = format_entry(&value, "{", 0).unwrap() + "\n";
-        let (redirected, edits) = plan(&original, &dep, None).unwrap();
-        assert_eq!(edits.len(), 1);
-        let redirected_entry = edits[0].new.as_ref().unwrap().as_str().unwrap();
-        let relocked_entry = format_entry(
-            &json!({"hashes": ["sha256:relocked"], "index": "pypi", "version": "==1.26.18"}),
-            &redirected,
-            redirected.find(redirected_entry).unwrap(),
-        )
-        .unwrap();
-        let relocked = redirected.replacen(redirected_entry, &relocked_entry, 1);
-        assert_eq!(
-            restore(&relocked, &edits[0]).unwrap(),
-            relocked,
-            "a registry-shaped entry is already unwound"
-        );
-        let foreign = redirected.replacen(
-            redirected_entry,
-            &format_entry(&json!({"file": "https://example.org/fork.whl"}), &redirected, 0).unwrap(),
-            1,
-        );
-        assert!(restore(&foreign, &edits[0]).is_err(), "a foreign reference is drift");
-
-        // Re-scan after the relock, then roll back newest-first.
-        let (again, second) = plan(&relocked, &dep, None).unwrap();
-        let mut current = again;
-        for edit in second.iter().chain(edits.iter()) {
-            current = restore(&current, edit).unwrap();
-        }
-        assert_eq!(current, relocked);
-    }
-
     #[test]
     fn lock_targets_requires_a_matching_pin_in_a_parseable_lock() {
         let dep = dependency("URLlib3", "1.26.18", "patch-one");
@@ -723,9 +602,10 @@ mod tests {
 
     /// `pipenv lock --keep-outdated` (2022) rewrites our entry into a
     /// file+version+index hybrid that Pipenv still installs from: it is
-    /// ours, so it is re-planned to the canonical shape instead of being
-    /// refused as a foreign source (which also vetoed the sibling rewriters);
-    /// a hybrid naming ANOTHER version is a real conflict.
+    /// ours, so it is re-planned to the canonical shape (`version` dropped,
+    /// Pipenv's `index` kept) instead of being refused as a foreign source
+    /// (which also vetoed the sibling rewriters); a hybrid naming ANOTHER
+    /// version is a real conflict.
     #[test]
     fn owned_hybrid_entries_are_replanned_not_refused() {
         let dep = dependency("urllib3", "1.26.18", "patch-one");
@@ -738,7 +618,7 @@ mod tests {
         assert!(!edits.is_empty(), "the hybrid is re-planned");
         let entry: Value = serde_json::from_str(&fixed).unwrap();
         assert!(entry["default"]["urllib3"].get("version").is_none());
-        assert!(entry["default"]["urllib3"].get("index").is_none());
+        assert_eq!(entry["default"]["urllib3"]["index"], json!("pypi"));
         assert!(entry["default"]["urllib3"]["file"].as_str().unwrap().contains("patch-one"));
 
         value["default"]["urllib3"]["version"] = json!("==2.0.0");
@@ -763,84 +643,25 @@ mod tests {
         assert!(owned_url(&dep.artifact_url, &dep), "the grant's own origin is ours");
         assert!(owned_url(public, &dep), "and so is the public service");
         assert!(!owned_url("https://patches.internal.example:8443/patch/pypi/urllib3/1.26.19/tok/patch-one/urllib3-1.26.19-py3-none-any.whl", &dep), "another version is not");
-        // Rotation on the custom origin restores through the chain.
-        let original = lock();
-        let (first, edits) = plan(&original, &dep, None).unwrap();
+        // Rotation on the custom origin re-points the owned entry.
+        let (first, _) = plan(&lock(), &dep, None).unwrap();
         dep.artifact_url = dep.artifact_url.replace("/tok/", "/rotated/");
         let (second, rotation) = plan(&first, &dep, None).unwrap();
-        let mut restored = second;
-        for edit in rotation.iter().chain(edits.iter()) {
-            restored = restore(&restored, edit).unwrap();
-        }
-        assert_eq!(restored, original);
+        assert!(!rotation.is_empty());
+        assert!(second.contains("/rotated/") && !second.contains("/tok/"));
     }
 
-    #[test]
-    fn restore_refuses_a_non_object_ledger_original() {
-        let dep = dependency("urllib3", "1.26.18", "patch-one");
-        let (text, edits) = plan(&lock(), &dep, None).unwrap();
-        for bad in ["\"just a string\"", "[1, 2]", "not json at all", "{\"a\": 1}, \"injected\": {}"] {
-            let mut edit = edits[0].clone();
-            edit.original = Some(Value::String(bad.to_string()));
-            assert!(restore(&text, &edit).is_err(), "{bad}");
-        }
-    }
-
-    #[test]
-    fn rollback_is_per_entry_preserves_unrelated_edits_and_refuses_drift() {
-        let mut value: Value = serde_json::from_str(&lock()).unwrap();
-        value["default"]["six"] = json!({"version":"==1.16.0"});
-        let original = serde_json::to_string_pretty(&value).unwrap();
-        let first = dependency("urllib3", "1.26.18", "patch-one");
-        let second = dependency("six", "1.16.0", "patch-two");
-        let (one, first_edits) = plan(&original, &first, None).unwrap();
-        let (two, second_edits) = plan(&one, &second, None).unwrap();
-        for first_removed in [true, false] {
-            let mut current = two.replace("unchanged", "unrelated-edit");
-            let edits = if first_removed {
-                first_edits
-                    .iter()
-                    .chain(second_edits.iter())
-                    .collect::<Vec<_>>()
-            } else {
-                second_edits.iter().chain(first_edits.iter()).collect()
-            };
-            for edit in edits {
-                current = restore(&current, edit).unwrap();
-            }
-            assert_eq!(current, original.replace("unchanged", "unrelated-edit"));
-        }
-        for edit in &first_edits {
-            let replacement = edit.new.as_ref().unwrap().as_str().unwrap();
-            // A tampered reference (its `#sha256=` pin) is drift…
-            let drift = two.replacen(replacement, &replacement.replace("#sha256=", "#sha256=0"), 1);
-            assert!(restore(&drift, edit).is_err());
-            // …while a re-serialized entry that kept our reference (Pipenv
-            // 2023+ relocking a marker-excluded entry restores the registry
-            // `hashes` and `version` next to it) is still ours and restores.
-            let mut value: Value = serde_json::from_str(&two).unwrap();
-            let section: &str = serde_json::from_str::<[String; 2]>(edit.key.as_deref().unwrap()).unwrap()[0].clone().leak();
-            value[section]["urllib3"]["hashes"] = json!(["sha256:upstream-a", "sha256:upstream-b"]);
-            value[section]["urllib3"]["version"] = json!("==1.26.18");
-            let kept = serde_json::to_string_pretty(&value).unwrap();
-            let restored: Value = serde_json::from_str(&restore(&kept, edit).unwrap()).unwrap();
-            assert!(restored[section]["urllib3"].get("file").is_none(), "{restored}");
-            let mut unsafe_edit = edit.clone();
-            unsafe_edit.path = "../Pipfile.lock".into();
-            assert!(restore(&two, &unsafe_edit).is_err());
-        }
-    }
 }
 
 #[cfg(test)]
 mod compatibility_tests {
     use super::*;
     #[test]
-    fn rotates_owned_grants_and_preserves_rollback_chain() {
+    fn rotates_owned_grants() {
         let mut dep = super::tests::dependency("urllib3", "1.26.18", "patch-one");
         for major in [Some(7), Some(11), Some(2018), Some(2026), None] {
             let original = super::tests::lock();
-            let (first, edits) = plan(&original, &dep, major).unwrap();
+            let (first, _) = plan(&original, &dep, major).unwrap();
             let parsed: Value = serde_json::from_str(&first).unwrap();
             let field = if major.is_some_and(|value| value < 2018) {
                 "path"
@@ -850,11 +671,8 @@ mod compatibility_tests {
             assert!(parsed["default"]["urllib3"][field].is_string());
             dep.artifact_url = dep.artifact_url.replace("/token/", "/rotated/");
             let (second, rotation) = plan(&first, &dep, major).unwrap();
-            let mut restored = second;
-            for edit in rotation.iter().chain(edits.iter()) {
-                restored = restore(&restored, edit).unwrap();
-            }
-            assert_eq!(restored, original);
+            assert!(!rotation.is_empty());
+            assert!(second.contains("/rotated/") && !second.contains("/token/"));
             dep.artifact_url = dep.artifact_url.replace("/rotated/", "/token/");
         }
     }
@@ -886,49 +704,4 @@ mod compatibility_tests {
         assert!(result.warnings.iter().any(|w| w.code == "redirect_pipenv_refused" && w.detail.contains("no Pipfile")));
     }
 
-    /// Rollback survives what git and Pipenv do to the lock between the
-    /// redirect and the revert: a whole-file CRLF<->LF conversion, Pipenv
-    /// re-serializing our entry (a `--keep-outdated` hybrid that kept our
-    /// reference), and a relock that dropped the entry altogether.
-    #[test]
-    fn rollback_tolerates_line_ending_conversion_hybrids_and_dropped_entries() {
-        let dep = super::tests::dependency("urllib3", "1.26.18", "patch-one");
-        let original = super::tests::lock();
-        let (redirected, edits) = plan(&original, &dep, None).unwrap();
-        // CRLF conversion of the redirected file → restores the original in CRLF.
-        let crlf = redirected.replace('\n', "\r\n");
-        let mut restored = crlf;
-        for edit in edits.iter().rev() {
-            restored = restore(&restored, edit).unwrap();
-        }
-        assert_eq!(restored, original.replace('\n', "\r\n"));
-        // LF file, CRLF-recorded edits (the redirect ran on a CRLF checkout).
-        let crlf_original = original.replace('\n', "\r\n");
-        let (crlf_redirected, crlf_edits) = plan(&crlf_original, &dep, None).unwrap();
-        let mut restored = crlf_redirected.replace("\r\n", "\n");
-        for edit in crlf_edits.iter().rev() {
-            restored = restore(&restored, edit).unwrap();
-        }
-        assert_eq!(restored, original);
-        // Hybrid: Pipenv re-added version/index next to our reference.
-        let mut value: Value = serde_json::from_str(&redirected).unwrap();
-        value["default"]["urllib3"]["version"] = json!("==1.26.18");
-        value["default"]["urllib3"]["index"] = json!("pypi");
-        let hybrid = serde_json::to_string_pretty(&value).unwrap();
-        let default_edit = edits.iter().find(|e| e.key.as_deref() == Some(r#"["default","urllib3"]"#)).unwrap();
-        let restored = restore(&hybrid, default_edit).unwrap();
-        let value: Value = serde_json::from_str(&restored).unwrap();
-        assert_eq!(value["default"]["urllib3"]["version"], json!("==1.26.18"));
-        assert!(value["default"]["urllib3"].get("file").is_none(), "{restored}");
-        // Dropped entry (`pipenv uninstall`): nothing to unwind, retires.
-        let mut value: Value = serde_json::from_str(&redirected).unwrap();
-        value["default"].as_object_mut().unwrap().remove("urllib3");
-        let dropped = serde_json::to_string_pretty(&value).unwrap();
-        assert_eq!(restore(&dropped, default_edit).unwrap(), dropped);
-        // A foreign reference is still drift.
-        let mut value: Value = serde_json::from_str(&redirected).unwrap();
-        value["default"]["urllib3"]["file"] = json!("https://example.org/fork.whl");
-        let foreign = serde_json::to_string_pretty(&value).unwrap();
-        assert!(restore(&foreign, default_edit).is_err());
-    }
 }
diff --git a/crates/socket-patch-core/src/patch/redirect/pnpm.rs b/crates/socket-patch-core/src/patch/redirect/pnpm.rs
index a5fa6a4d..90371b46 100644
--- a/crates/socket-patch-core/src/patch/redirect/pnpm.rs
+++ b/crates/socket-patch-core/src/patch/redirect/pnpm.rs
@@ -192,6 +192,39 @@ impl<'a> Resolution<'a> {
     }
 }
 
+impl Resolution<'_> {
+    /// The default-registry spelling of this resolution: `integrity` only
+    /// (pnpm omits `tarball` for a package the configured registry serves),
+    /// every other field kept in place — the inverse of
+    /// [`Resolution::rewrite`] for the v5 upstream restore.
+    pub fn restore(&self, integrity: &str) -> String {
+        let scalar = if integrity
+            .chars()
+            .any(|c| c.is_whitespace() || matches!(c, ',' | '[' | ']' | '{' | '}' | '\'' | '"'))
+        {
+            serde_json::to_string(integrity).expect("string serializes")
+        } else {
+            integrity.to_string()
+        };
+        let mut fields = vec![format!("integrity: {scalar}")];
+        fields.extend(
+            self.fields
+                .iter()
+                .filter(|(k, _)| !matches!(*k, "integrity" | "tarball"))
+                .map(|(k, v)| format!("{k}: {v}")),
+        );
+        if self.block {
+            format!(
+                "{}      {}",
+                self.newline,
+                fields.join(&format!("{}      ", self.newline))
+            )
+        } else {
+            format!("{{{}}}", fields.join(", "))
+        }
+    }
+}
+
 /// The key line every `packages:` entry's resolution map starts at.
 const RESOLUTION_KEY: &str = "    resolution:";
 
diff --git a/crates/socket-patch-core/src/patch/redirect/replay.rs b/crates/socket-patch-core/src/patch/redirect/replay.rs
deleted file mode 100644
index 8b643115..00000000
--- a/crates/socket-patch-core/src/patch/redirect/replay.rs
+++ /dev/null
@@ -1,3545 +0,0 @@
-//! Whole-ledger reverse replay of hosted-redirect edits.
-//!
-//! The per-purl reverts in [`super::takeover`] cover cargo, the
-//! npm-family lock flavors, and golang (which reuses the golang inverses
-//! here). Everything else the hosted rewriters touch —
-//! gem, pypi, composer, and the non-package rideshare edits
-//! (such as the pnpm `trustLockfile` auto-config) —
-//! has no per-purl revert (bun edits the per-purl revert does not claim
-//! also fall through to this replay): their unwind rides the ledger's
-//! designed whole-list contract ("edits appended in write order, a revert walks
-//! them in reverse", see [`super::state`]).
-//!
-//! [`revert_remaining_redirect_edits`] performs that walk over whatever
-//! edits are still in the ledger (callers run the per-purl reverts first;
-//! those drop the edits they claim). Each edit kind maps to an inverse in
-//! a closed per-kind table; edits are grouped by the ecosystem that wrote
-//! them and each GROUP is staged all-or-nothing — one drifted or
-//! unhandled edit refuses the whole group byte-untouched (the same
-//! fail-closed posture as the per-purl reverts), while other groups still
-//! proceed. maven and nuget record structured metadata (not file
-//! fragments), so their groups refuse with `hosted_revert_unsupported`
-//! until bespoke reverts exist; their records and edits stay in the
-//! ledger for a later `scan --mode hosted` normalize.
-//!
-//! Ledger accounting is per-outcome: successfully replayed (or
-//! already-at-original) edits are dropped from `state.edits`; a record is
-//! dropped only when every group its ecosystem writes ended clean, so a
-//! refused group keeps both its edits and its records — the
-//! intermediate-but-coherent ledger a retry needs. The caller persists.
-
-use super::staged::{flush_staged, staged_read, Staged, StagedBytes};
-use super::state::RedirectState;
-use serde_json::Value;
-use std::collections::{BTreeMap, BTreeSet};
-use std::path::Path;
-
-/// The exact pnpm-workspace.yaml the trust auto-config CREATES when no
-/// workspace file existed (see `plan_workspace_trust` in the hosted flow).
-/// A `created` trust edit deletes the file only while it still carries
-/// exactly this scaffold — anything else means the user built on it, and
-/// the revert downgrades to removing the one line it owns.
-const PNPM_TRUST_SCAFFOLD: &str = "packages:\n  - '.'\ntrustLockfile: true\n";
-
-/// The single line the trust auto-config APPENDS to an existing
-/// pnpm-workspace.yaml (`action: "added"`); its `new` records the VALUE
-/// (`"true"`), not the line, so the inverse is kind-specific.
-const PNPM_TRUST_LINE: &str = "trustLockfile: true";
-
-/// How one edit kind unwinds.
-#[derive(Debug, Clone, Copy, PartialEq)]
-enum Inverse {
-    /// `original` and `new` are both file fragments (action `rewritten` /
-    /// `updated`): restore by replacing `new` with `original` once.
-    /// `contains(new)` is checked BEFORE `contains(original)` — several
-    /// writers record an `original` that is a substring of `new` (the
-    /// Cargo.toml insert variant, the maven version suffix).
-    ReplaceFragment,
-    /// Like [`Inverse::ReplaceFragment`], but `new` legitimately occurs
-    /// several times and stands for every occurrence (a cargo v1 lock's
-    /// full-id dependency reference, named by several dependents).
-    ReplaceEveryFragment,
-    PipenvEntry,
-    HatchDocument,
-    /// action `added` with only `new` recorded: the redirect inserted the
-    /// fragment into a pre-existing file, so the inverse removes it once
-    /// (an absent fragment is the desired end state — no-op).
-    RemoveAddedFragment,
-    /// action `removed` with only `original` recorded: the redirect
-    /// pruned go.sum lines of the upstream module that the pristine file
-    /// needs back. Re-inserted at go's sorted position, so the file returns
-    /// byte for byte.
-    ReinsertRemoved,
-    /// go.sum lines the redirect added (`new`, `\n`-joined): each is removed
-    /// as a whole line, whatever the file's line endings.
-    RemoveAddedLines,
-    /// The appended cargo `[registries.…]` block (`redirect_cargo_registry`,
-    /// action `added`): removed together with exactly the one blank
-    /// separator the rewriter put before it — see
-    /// [`remove_appended_cargo_block`].
-    RemoveAppendedCargoBlock,
-    /// Cleanup of PRIOR socket wiring performed during a redirect refresh
-    /// (`redirect_golang_stale_*`). The removal already moved the file
-    /// toward pristine; restoring it would re-create socket wiring, so
-    /// the inverse is a no-op and the edit is simply dropped.
-    NoopDrop,
-    /// The pnpm `trustLockfile` auto-config (kind-specific: `created`
-    /// deletes the scaffold, `added` removes exactly one line).
-    PnpmTrust,
-    /// The npm `.npmrc` `allow-remote=all` auto-config (kind-specific:
-    /// `created` deletes the untouched file, `added` removes exactly one
-    /// line — see [`super::npmrc`]). Grouped with the npm lock kinds so a
-    /// surviving (refused) package-lock edit keeps the setting it needs.
-    NpmrcAllowRemote,
-    BunBinaryPackage,
-    /// A hosted vlt node splice: `original`'s slots [2] and [3] go back on
-    /// the line keyed by the recorded DepID ([`super::vlt::revert_vlt_slots`]).
-    VltSlots,
-    /// Owned by a per-purl revert (npm JSON kinds). Present here only
-    /// when that revert failed — refuse the group rather than guess.
-    PerPurlOnly,
-    /// No revert implementation exists for the recorded shape (maven /
-    /// nuget structured metadata, unknown future kinds).
-    Unsupported,
-}
-
-/// (group label, inverse) for one recorded edit. The group is the
-/// all-or-nothing staging unit — every kind an ecosystem writes lands in
-/// one group so correlated files (go.mod + go.sum, Gemfile +
-/// Gemfile.lock) revert together or not at all.
-fn classify(kind: &str, action: &str) -> (&'static str, Inverse) {
-    match kind {
-        "redirect_pipenv_entry" => ("pypi", Inverse::PipenvEntry),
-        "redirect_requirements_line"
-        | "redirect_uv_lock_wheel"
-        | "redirect_poetry_lock_package"
-        | "redirect_pdm_lock_package" => ("pypi", Inverse::ReplaceFragment),
-        "redirect_hatch_document" => ("pypi", Inverse::HatchDocument),
-        "redirect_composer_dist" => ("composer", Inverse::ReplaceFragment),
-        "redirect_cargo_toml_dep" | "redirect_cargo_lock_entry" => {
-            ("cargo", Inverse::ReplaceFragment)
-        }
-        super::CARGO_LOCK_REFERENCE_KIND => ("cargo", Inverse::ReplaceEveryFragment),
-        "redirect_cargo_registry" => (
-            "cargo",
-            if action == "added" {
-                Inverse::RemoveAppendedCargoBlock
-            } else {
-                Inverse::ReplaceFragment
-            },
-        ),
-        "redirect_pnpm_resolution" => ("pnpm", Inverse::ReplaceFragment),
-        "redirect_pnpm_workspace_trust" => ("pnpm", Inverse::PnpmTrust),
-        "redirect_yarn_classic_entry" | "redirect_yarn_berry_entry" => {
-            ("yarn", Inverse::ReplaceFragment)
-        }
-        "redirect_bun_lockb_package" => ("bun", Inverse::BunBinaryPackage),
-        "redirect_bun_lock_package" => ("bun", Inverse::ReplaceFragment),
-        super::vlt::KIND => ("vlt", Inverse::VltSlots),
-        "redirect_gemfile_lock_dependency_pin"
-        | "redirect_gemfile_lock_checksum"
-        | "redirect_gemfile_source_block" => (
-            "gem",
-            if action == "added" {
-                Inverse::RemoveAddedFragment
-            } else {
-                Inverse::ReplaceFragment
-            },
-        ),
-        "redirect_gemfile_lock_source_url" | "redirect_gemfile_source_url" => {
-            ("gem", Inverse::ReplaceFragment)
-        }
-        // The section-move record: the writer drained the spec (+ sublines)
-        // out of its upstream GEM section into a new socket GEM section but
-        // recorded only the bare remote URLs — not the moved block — so a
-        // URL swap would claim success while leaving the moved spec and the
-        // scaffold section in place. Refuse until the writer records enough
-        // to invert the move.
-        "redirect_gemfile_lock_gem_source" => ("gem", Inverse::Unsupported),
-        // "updated" carries the prior socket directive in `original`;
-        // the chain unwinds newest-first down to the first run's "added".
-        "redirect_golang_replace" => (
-            "golang",
-            if action == "added" {
-                Inverse::RemoveAddedFragment
-            } else {
-                Inverse::ReplaceFragment
-            },
-        ),
-        "redirect_golang_gosum" => ("golang", Inverse::RemoveAddedLines),
-        "redirect_golang_gosum_prune" => ("golang", Inverse::ReinsertRemoved),
-        "redirect_golang_stale_replace_removed" | "redirect_golang_stale_gosum_removed" => {
-            ("golang", Inverse::NoopDrop)
-        }
-        "redirect_npm_lock_entry" | "redirect_npm_lock_dep" => ("npm", Inverse::PerPurlOnly),
-        super::npmrc::NPMRC_ALLOW_REMOTE_EDIT_KIND => ("npm", Inverse::NpmrcAllowRemote),
-        "redirect_maven_repository"
-        | "redirect_maven_dep_management"
-        | "redirect_maven_config"
-        | "redirect_maven_trusted_checksums" => ("maven", Inverse::Unsupported),
-        "redirect_maven_dep_version" => ("maven", Inverse::ReplaceFragment),
-        "redirect_nuget_source" | "redirect_nuget_lock" => ("nuget", Inverse::Unsupported),
-        _ => ("unknown", Inverse::Unsupported),
-    }
-}
-
-/// Is `kind` a hosted-redirect edit this release has no replay arm for
-/// (a newer socket-patch's writer)?
-pub(super) fn is_unclassified_kind(kind: &str, action: &str) -> bool {
-    classify(kind, action).0 == "unknown"
-}
-
-/// The replay groups a record's ecosystem can have written edits into —
-/// the drop rule holds a record while ANY of its groups refused. npm
-/// purls fan across every npm-family lock flavor. Every ecosystem also
-/// lists the reserved "unknown" group: an edit kind this release cannot
-/// classify may belong to any record (a newer release's writer for a new
-/// lock flavor), so dropping a record beside one would strand that edit.
-fn groups_for_record_purl(purl: &str) -> &'static [&'static str] {
-    if purl.starts_with("pkg:npm/") {
-        &["npm", "yarn", "pnpm", "bun", "vlt", "unknown"]
-    } else if purl.starts_with("pkg:cargo/") {
-        &["cargo", "unknown"]
-    } else if purl.starts_with("pkg:gem/") {
-        &["gem", "unknown"]
-    } else if purl.starts_with("pkg:pypi/") {
-        &["pypi", "unknown"]
-    } else if purl.starts_with("pkg:composer/") {
-        &["composer", "unknown"]
-    } else if purl.starts_with("pkg:golang/") {
-        &["golang", "unknown"]
-    } else if purl.starts_with("pkg:maven/") {
-        &["maven", "unknown"]
-    } else if purl.starts_with("pkg:nuget/") {
-        &["nuget", "unknown"]
-    } else {
-        &["unknown"]
-    }
-}
-
-/// One refused group: its files were left byte-identical and its edits
-/// and records stay in the ledger.
-#[derive(Debug)]
-pub struct GroupRefusal {
-    pub group: String,
-    pub files: BTreeSet<String>,
-    pub reason: String,
-}
-
-/// What one replay pass did (or, on dry-run, would do).
-#[derive(Debug, Default)]
-pub struct ReplayOutcome {
-    /// Files whose staged revert flushed (repo-relative), including files
-    /// staged for deletion.
-    pub reverted_files: BTreeSet<String>,
-    /// Groups that refused fail-closed; their edits/records remain.
-    pub refusals: Vec<GroupRefusal>,
-    /// Advisory (code, detail) pairs, such as a modified trust scaffold.
-    pub warnings: Vec<(String, String)>,
-    /// Records dropped from the ledger (purls, sorted by BTreeMap walk).
-    pub dropped_records: Vec<String>,
-    /// Edits dropped from the ledger.
-    pub dropped_edits: usize,
-}
-
-impl ReplayOutcome {
-    /// True when every group replayed clean (a refusal-free pass).
-    pub fn fully_reverted(&self) -> bool {
-        self.refusals.is_empty()
-    }
-}
-
-/// Ledger paths are written by this tool as plain repo-relative slash
-/// paths; anything else (absolute, `..`, empty) refuses fail-closed
-/// rather than letting a tampered ledger write outside the project.
-fn safe_rel_path(path: &str) -> bool {
-    !path.is_empty()
-        && !path.starts_with('/')
-        && !path.starts_with('\\')
-        && !path.contains(':')
-        && !path.split(['/', '\\']).any(|c| c == "..")
-}
-
-/// Remove one inserted fragment, eating the separators the writer added
-/// around it. Position-based: several writers record the fragment WITHOUT
-/// the indentation they inserted it with (the gem DEPENDENCIES pin and
-/// CHECKSUMS line record `target.trim_start()`), so when everything
-/// between the fragment and its line start is whitespace the whole line
-/// is removed — a bare `replacen` would strand the orphaned indent onto
-/// the NEXT line and corrupt indentation-sensitive locks. An EOF-removed
-/// fragment additionally collapses the trailing blank run to the
-/// canonical single newline: the append shape (maybe-a-blank-separator +
-/// fragment + newline) is byte-AMBIGUOUS to invert — `"m\n\n" + "F\n"`
-/// and `"m\n" + "\nF\n"` produce identical files — so the tidy form (the
-/// one `go mod tidy` itself emits) is chosen.
-pub(super) fn remove_fragment_once(content: &str, fragment: &str) -> String {
-    // A CRLF file (its fragments recorded CRLF too) is inverted as LF and
-    // written back CRLF, so the separator bookkeeping below sees real line
-    // breaks instead of stranding a `\r` line.
-    let crlf = content.matches("\r\n").count();
-    if crlf > 0 && crlf == content.matches('\n').count() && content.contains(fragment) {
-        return remove_fragment_once(
-            &content.replace("\r\n", "\n"),
-            &fragment.replace("\r\n", "\n"),
-        )
-        .replace('\n', "\r\n");
-    }
-    let Some(pos) = content.find(fragment) else {
-        return content.to_string();
-    };
-    let mut end = pos + fragment.len();
-    // The fragment's own indentation, when the writer recorded it stripped.
-    let line_start = content[..pos].rfind('\n').map(|i| i + 1).unwrap_or(0);
-    let start = if content[line_start..pos]
-        .chars()
-        .all(|c| c == ' ' || c == '\t')
-    {
-        line_start
-    } else {
-        pos
-    };
-    // The removed line's own newline goes with it — but only when the
-    // whole line is removed: a fragment spliced out from behind a
-    // non-whitespace prefix (the user commented the line out) leaves the
-    // prefix as its own line, and eating the newline would join that
-    // prefix onto the FOLLOWING line, commenting it out too.
-    if start == line_start {
-        if content[end..].starts_with("\r\n") {
-            end += 2;
-        } else if content[end..].starts_with('\n') {
-            end += 1;
-        }
-    }
-    if end >= content.len() {
-        // EOF removal: collapse the (ambiguous) trailing separator run.
-        let trimmed = content[..start].trim_end_matches(['\r', '\n']);
-        if trimmed.is_empty() {
-            return String::new();
-        }
-        let eol = crate::vendor::common::detect_eol(content);
-        return format!("{trimmed}{eol}");
-    }
-    format!("{}{}", &content[..start], &content[end..])
-}
-
-/// Every line break in `text` is a CRLF (and there is at least one).
-fn is_all_crlf(text: &str) -> bool {
-    let crlf = text.matches("\r\n").count();
-    crlf > 0 && crlf == text.matches('\n').count()
-}
-
-/// One fragment-edit inverse, tolerant of a line-ending conversion between
-/// the scan and the revert (git `core.autocrlf` rewrites the committed
-/// files but never the JSON-escaped fragments in the ledger).
-#[derive(Debug, PartialEq)]
-pub(super) enum FragmentRevert {
-    /// `new` was found and put back to `original` (the file's own line
-    /// endings kept).
-    Reverted(String),
-    /// `new` is gone but `original` is present: already unwound.
-    AlreadyOriginal,
-    /// Neither fragment is present.
-    Drifted,
-}
-
-/// Replace `new` with `original` in `content` — once, or at `every`
-/// occurrence — matching regardless of CRLF/LF: an all-CRLF file is
-/// matched as LF and written back CRLF; any other file is matched with the
-/// recorded fragments, then with their LF forms. `new` is looked for
-/// before `original` (an `original` may be a substring of `new`).
-pub(super) fn revert_fragment_eol(
-    content: &str,
-    new: &str,
-    original: &str,
-    every: bool,
-) -> FragmentRevert {
-    if is_all_crlf(content) {
-        return match revert_fragment_eol(
-            &content.replace("\r\n", "\n"),
-            &new.replace("\r\n", "\n"),
-            &original.replace("\r\n", "\n"),
-            every,
-        ) {
-            FragmentRevert::Reverted(lf) => FragmentRevert::Reverted(lf.replace('\n', "\r\n")),
-            other => other,
-        };
-    }
-    let (lf_new, lf_original) = (new.replace("\r\n", "\n"), original.replace("\r\n", "\n"));
-    for (n, o) in [(new, original), (lf_new.as_str(), lf_original.as_str())] {
-        if content.contains(n) {
-            return FragmentRevert::Reverted(if every {
-                content.replace(n, o)
-            } else {
-                content.replacen(n, o, 1)
-            });
-        }
-    }
-    if content.contains(original) || content.contains(&lf_original) {
-        FragmentRevert::AlreadyOriginal
-    } else {
-        FragmentRevert::Drifted
-    }
-}
-
-/// Whether `content` holds `fragment`, ignoring CRLF/LF differences.
-pub(super) fn contains_eol(content: &str, fragment: &str) -> bool {
-    content.contains(fragment)
-        || content
-            .replace("\r\n", "\n")
-            .contains(&fragment.replace("\r\n", "\n"))
-}
-
-/// Invert the cargo rewriter's append of a `[registries.…]` block: it wrote
-/// `config + "\n" + block` (just `block` into an empty config) and records
-/// `block` — or `"\n" + block` when the config lacked a final newline (the
-/// extra newline it had to add first). Removing the recorded fragment plus
-/// the one newline before it therefore restores the config's exact bytes:
-/// a missing final newline or trailing blank lines included, and anything
-/// the user appended after the block kept. An all-CRLF file is inverted as
-/// LF and written back CRLF; a fragment recorded with the other line
-/// endings (a checkout converted them) still matches. `None` when the
-/// fragment is not in the file.
-pub(super) fn remove_appended_cargo_block(content: &str, fragment: &str) -> Option<String> {
-    if is_all_crlf(content) {
-        return remove_appended_cargo_block(
-            &content.replace("\r\n", "\n"),
-            &fragment.replace("\r\n", "\n"),
-        )
-        .map(|lf| lf.replace('\n', "\r\n"));
-    }
-    let lf_fragment = fragment.replace("\r\n", "\n");
-    let (pos, len) = match content.find(fragment) {
-        Some(pos) => (pos, fragment.len()),
-        None => (content.find(&lf_fragment)?, lf_fragment.len()),
-    };
-    let before = &content[..pos];
-    let before = before
-        .strip_suffix("\r\n")
-        .or_else(|| before.strip_suffix('\n'))
-        .unwrap_or(before);
-    Some(format!("{before}{}", &content[pos + len..]))
-}
-
-/// The string payloads of an edit, or `None` when a payload is missing or
-/// not a string (a shape the inverse table said must be there).
-fn str_payload(v: &Option<Value>) -> Option<&str> {
-    v.as_ref().and_then(Value::as_str)
-}
-
-/// Walk every edit still in `state` in reverse write order, grouped per
-/// ecosystem, staging each group's inverse and flushing it all-or-nothing.
-/// Mutates `state` (drops replayed edits and fully-unwound records) —
-/// the CALLER persists via `persist_redirect_state`. With `dry_run` the
-/// staging and every drift check run identically, but nothing is written
-/// and `state` is left untouched; the outcome reports what a wet run
-/// would do.
-pub async fn revert_remaining_redirect_edits(
-    project_root: &Path,
-    state: &mut RedirectState,
-    dry_run: bool,
-) -> ReplayOutcome {
-    let mut outcome = ReplayOutcome::default();
-
-    // Group edit indices by ecosystem, keeping ledger order within each.
-    let mut groups: BTreeMap<&'static str, Vec<usize>> = BTreeMap::new();
-    for (idx, edit) in state.edits.iter().enumerate() {
-        let (group, _) = classify(&edit.kind, &edit.action);
-        groups.entry(group).or_default().push(idx);
-    }
-
-    // Where a cargo `[registries.…]` block can still be referenced from:
-    // the root manifest and lock, plus every manifest the ledger pinned.
-    let mut cargo_probes: Vec<String> = vec!["Cargo.toml".to_string(), "Cargo.lock".to_string()];
-    for edit in state
-        .edits
-        .iter()
-        .filter(|e| e.kind == "redirect_cargo_toml_dep")
-    {
-        if !cargo_probes.contains(&edit.path) {
-            cargo_probes.push(edit.path.clone());
-        }
-    }
-
-    let mut drop_indices: BTreeSet<usize> = BTreeSet::new();
-    let mut refused_groups: BTreeSet<&'static str> = BTreeSet::new();
-    let mut pending_warnings: Vec<(String, String)> = Vec::new();
-
-    'group: for (group, indices) in &groups {
-        let mut staged: Staged = BTreeMap::new();
-        let mut staged_bytes: StagedBytes = BTreeMap::new();
-        let mut group_drops: BTreeSet<usize> = BTreeSet::new();
-        let mut group_warnings: Vec<(String, String)> = Vec::new();
-        let mut vanished_vlt: Vec<usize> = Vec::new();
-        let files: BTreeSet<String> = indices
-            .iter()
-            .map(|&i| state.edits[i].path.clone())
-            .collect();
-
-        let refuse = |reason: String, out: &mut ReplayOutcome| {
-            out.refusals.push(GroupRefusal {
-                group: (*group).to_string(),
-                files: files.clone(),
-                reason,
-            });
-        };
-
-        // Newest-first: chained re-redirects unwind through each step's
-        // `new` -> `original` until the first run's insertion is removed.
-        for &idx in indices.iter().rev() {
-            let edit = &state.edits[idx];
-            let (_, inverse) = classify(&edit.kind, &edit.action);
-            if !matches!(inverse, Inverse::NoopDrop | Inverse::Unsupported)
-                && !safe_rel_path(&edit.path)
-            {
-                refuse(
-                    format!("ledger edit for {} has an unsafe path", edit.kind),
-                    &mut outcome,
-                );
-                refused_groups.insert(group);
-                continue 'group;
-            }
-            match inverse {
-                Inverse::NoopDrop => {
-                    // Removal of prior socket wiring — already pristine-ward.
-                    group_drops.insert(idx);
-                }
-                Inverse::BunBinaryPackage => {
-                    let restored = async {
-                        let content = match staged_bytes.get(&edit.path) {
-                            Some(bytes) => bytes.clone(),
-                            None => crate::utils::fs::read_regular_to_bytes(
-                                &project_root.join(&edit.path),
-                            )
-                            .await
-                            .map_err(|error| {
-                                if error.kind() == std::io::ErrorKind::NotFound {
-                                    format!("{} no longer exists", edit.path)
-                                } else {
-                                    format!("read {}: {error}", edit.path)
-                                }
-                            })?,
-                        };
-                        super::bun_binary::restore(&content, edit)
-                    }
-                    .await;
-                    match restored {
-                        Ok(bytes) => {
-                            staged_bytes.insert(edit.path.clone(), bytes);
-                            group_drops.insert(idx);
-                        }
-                        Err(reason) => {
-                            refuse(reason, &mut outcome);
-                            refused_groups.insert(group);
-                            continue 'group;
-                        }
-                    }
-                }
-                Inverse::VltSlots => {
-                    let content = match staged_read(&staged, project_root, &edit.path).await {
-                        Ok(Some(content)) => content,
-                        Ok(None) => {
-                            refuse(format!("{} no longer exists", edit.path), &mut outcome);
-                            refused_groups.insert(group);
-                            continue 'group;
-                        }
-                        Err(error) => {
-                            refuse(error, &mut outcome);
-                            refused_groups.insert(group);
-                            continue 'group;
-                        }
-                    };
-                    match super::vlt::revert_vlt_slots(&content, edit) {
-                        Ok(super::vlt::SlotRevert::Restored(restored)) => {
-                            staged.insert(edit.path.clone(), Some(restored));
-                            group_drops.insert(idx);
-                        }
-                        Ok(super::vlt::SlotRevert::Unchanged) => {
-                            group_drops.insert(idx);
-                        }
-                        Ok(super::vlt::SlotRevert::Vanished) => {
-                            vanished_vlt.push(idx);
-                            group_drops.insert(idx);
-                        }
-                        Err(reason) => {
-                            refuse(reason, &mut outcome);
-                            refused_groups.insert(group);
-                            continue 'group;
-                        }
-                    }
-                }
-                Inverse::PerPurlOnly => {
-                    refuse(
-                        format!(
-                            "{} is owned by the per-purl npm revert, which did not claim it \
-                             (a prior per-purl refusal) — re-run `scan --mode hosted` to \
-                             normalize, then roll back again",
-                            edit.kind
-                        ),
-                        &mut outcome,
-                    );
-                    refused_groups.insert(group);
-                    continue 'group;
-                }
-                Inverse::Unsupported => {
-                    let reason = if *group == "unknown" {
-                        format!(
-                            "the redirect ledger holds a {} edit this socket-patch release \
-                             does not understand; upgrade socket-patch",
-                            edit.kind
-                        )
-                    } else {
-                        format!(
-                            "no hosted-redirect revert implementation for {} — re-run \
-                             `scan --mode hosted` to normalize, or restore the file from \
-                             version control",
-                            edit.kind
-                        )
-                    };
-                    refuse(reason, &mut outcome);
-                    refused_groups.insert(group);
-                    continue 'group;
-                }
-                Inverse::PipenvEntry => {
-                    let restored = match staged_read(&staged, project_root, &edit.path).await {
-                        Ok(Some(content)) => super::pipenv::restore(&content, edit)
-                            .map(|restored| (content, restored)),
-                        Ok(None) => Err(format!("{} no longer exists", edit.path)),
-                        Err(error) => Err(error),
-                    };
-                    match restored {
-                        Ok((content, restored)) => {
-                            // An already-unwound or retired entry returns the
-                            // text unchanged: no write, no `editedFiles` credit
-                            // (mirrors the ReplaceFragment already-original arm).
-                            if restored != content {
-                                staged.insert(edit.path.clone(), Some(restored));
-                            }
-                            group_drops.insert(idx);
-                        }
-                        Err(error) => {
-                            refuse(error, &mut outcome);
-                            refused_groups.insert(group);
-                            continue 'group;
-                        }
-                    }
-                }
-                Inverse::ReplaceFragment
-                | Inverse::ReplaceEveryFragment
-                | Inverse::HatchDocument => {
-                    let (Some(original), Some(new)) =
-                        (str_payload(&edit.original), str_payload(&edit.new))
-                    else {
-                        refuse(
-                            format!("{} edit is missing its recorded fragments", edit.kind),
-                            &mut outcome,
-                        );
-                        refused_groups.insert(group);
-                        continue 'group;
-                    };
-                    let content = match staged_read(&staged, project_root, &edit.path).await {
-                        Ok(Some(c)) => c,
-                        Ok(None) => {
-                            refuse(format!("{} no longer exists", edit.path), &mut outcome);
-                            refused_groups.insert(group);
-                            continue 'group;
-                        }
-                        Err(e) => {
-                            refuse(e, &mut outcome);
-                            refused_groups.insert(group);
-                            continue 'group;
-                        }
-                    };
-                    if inverse == Inverse::HatchDocument {
-                        match crate::vendor::restore_python_document(&content, original, new) {
-                            Ok((restored, false)) => {
-                                // Already at its original (the restore
-                                // short-circuits on `live == original`): no
-                                // write, no `editedFiles` credit; the ledger
-                                // edit still retires (mirrors the PipenvEntry
-                                // arm).
-                                if restored != content {
-                                    staged.insert(edit.path.clone(), Some(restored));
-                                }
-                                group_drops.insert(idx);
-                            }
-                            _ => {
-                                refuse(
-                                    format!("{}: Hatch configuration drifted", edit.path),
-                                    &mut outcome,
-                                );
-                                refused_groups.insert(group);
-                                continue 'group;
-                            }
-                        }
-                        continue;
-                    }
-                    // yarn lock fragments are whole blocks recorded in the
-                    // lock's on-disk line endings, and a `core.autocrlf`
-                    // checkout on another OS re-spells the lock (never the
-                    // committed ledger): when neither fragment matches
-                    // verbatim, try both in the live file's uniform ending.
-                    let respelled = (super::yarn_lock_fragment_kind(&edit.kind)
-                        && !content.contains(new)
-                        && !content.contains(original))
-                    .then(|| {
-                        crate::utils::line_endings::fragments_in_eol_of(&content, original, new)
-                    })
-                    .flatten();
-                    let (original, new) = match &respelled {
-                        Some((original, new)) => (original.as_str(), new.as_str()),
-                        None => (original, new),
-                    };
-                    // `new` before `original`: original may be a substring
-                    // of new (Cargo.toml insert, maven version suffix).
-                    // cargo: matched regardless of a CRLF/LF conversion since
-                    // the scan (a checkout's `core.autocrlf` rewrites the
-                    // files, never the ledger's escaped fragments).
-                    if *group == "cargo" {
-                        let every = inverse == Inverse::ReplaceEveryFragment;
-                        let lf = |t: &str| t.replace("\r\n", "\n");
-                        // ONE scan legitimately records identical cargo
-                        // edits (a manifest declaring the crate with the
-                        // same line in two sections), and each one unwinds
-                        // one occurrence — what `revert_cargo_redirect_purl`
-                        // does over this same ledger. So the file may hold
-                        // as many occurrences as there are identical edits
-                        // left to spend on them; only a surplus is
-                        // ambiguous.
-                        let twins = indices
-                            .iter()
-                            .filter(|&&i| {
-                                let other = &state.edits[i];
-                                !group_drops.contains(&i)
-                                    && other.path == edit.path
-                                    && other.kind == edit.kind
-                                    && other.action == edit.action
-                                    && other.key == edit.key
-                                    && other.original == edit.original
-                                    && other.new == edit.new
-                            })
-                            .count()
-                            .max(1);
-                        if !every && lf(&content).matches(&lf(new)).count() > twins {
-                            refuse(
-                                format!(
-                                    "{}: the redirected fragment appears more than once — \
-                                     ambiguous, refusing to guess",
-                                    edit.path
-                                ),
-                                &mut outcome,
-                            );
-                            refused_groups.insert(group);
-                            continue 'group;
-                        }
-                        match revert_fragment_eol(&content, new, original, every) {
-                            FragmentRevert::Reverted(restored) => {
-                                staged.insert(edit.path.clone(), Some(restored));
-                                group_drops.insert(idx);
-                            }
-                            // Same substring guard as below.
-                            FragmentRevert::AlreadyOriginal if !lf(new).contains(&lf(original)) => {
-                                group_drops.insert(idx);
-                            }
-                            _ => {
-                                refuse(
-                                    format!(
-                                        "{}: content matches neither the redirected nor the \
-                                         original fragment for {} — the file drifted; re-run \
-                                         `scan --mode hosted` to normalize",
-                                        edit.path, edit.kind
-                                    ),
-                                    &mut outcome,
-                                );
-                                refused_groups.insert(group);
-                                continue 'group;
-                            }
-                        }
-                        continue;
-                    }
-                    if content.contains(new) {
-                        if content.matches(new).count() > 1 {
-                            refuse(
-                                format!(
-                                    "{}: the redirected fragment appears more than once — \
-                                     ambiguous, refusing to guess",
-                                    edit.path
-                                ),
-                                &mut outcome,
-                            );
-                            refused_groups.insert(group);
-                            continue 'group;
-                        }
-                        staged.insert(edit.path.clone(), Some(content.replacen(new, original, 1)));
-                        group_drops.insert(idx);
-                    } else if content.contains(original) && !new.contains(original) {
-                        // Already at the pre-edit state (an interrupted
-                        // earlier revert, or a hand-fix) — nothing to do.
-                        // The `!new.contains(original)` guard matters:
-                        // several writers record an `original` that is a
-                        // SUBSTRING of `new` (the Cargo.toml insert variant
-                        // records the always-present table header), so its
-                        // presence proves nothing about the inserted part —
-                        // a drifted insert must refuse, not silently drop
-                        // the edit as reverted.
-                        group_drops.insert(idx);
-                    } else {
-                        // bun only: Bun 1.1.39–1.3.9 re-save our URL 3-tuple
-                        // WITHOUT its sha512 on any later lock re-save, so
-                        // the recorded `new` is on disk as a digest-less
-                        // 2-tuple — same key, spec and meta. That spelling
-                        // is the recorded wiring, not drift: put `original`
-                        // back over it. Anything else still refuses.
-                        let healed = if edit.kind == "redirect_bun_lock_package" {
-                            crate::vendor::bun_lock_text::restore_digestless_line(
-                                &content, new, original,
-                            )
-                        } else {
-                            Ok(None)
-                        };
-                        match healed {
-                            Ok(Some(restored)) => {
-                                staged.insert(edit.path.clone(), Some(restored));
-                                group_drops.insert(idx);
-                            }
-                            Ok(None) => {
-                                refuse(
-                                    format!(
-                                        "{}: content matches neither the redirected nor the \
-                                         original fragment for {} — the file drifted; re-run \
-                                         `scan --mode hosted` to normalize",
-                                        edit.path, edit.kind
-                                    ),
-                                    &mut outcome,
-                                );
-                                refused_groups.insert(group);
-                                continue 'group;
-                            }
-                            Err(ambiguous) => {
-                                refuse(format!("{}: {ambiguous}", edit.path), &mut outcome);
-                                refused_groups.insert(group);
-                                continue 'group;
-                            }
-                        }
-                    }
-                }
-                Inverse::RemoveAppendedCargoBlock => {
-                    let Some(new) = str_payload(&edit.new) else {
-                        refuse(
-                            format!("{} edit is missing its recorded fragment", edit.kind),
-                            &mut outcome,
-                        );
-                        refused_groups.insert(group);
-                        continue 'group;
-                    };
-                    // A block something still references (a hand-pinned dep)
-                    // stays: removing it would leave that pin naming an
-                    // undefined registry. The reverse walk has already
-                    // unwound this ledger's own references.
-                    let reg = edit.key.as_deref().unwrap_or_default();
-                    let index = new.split('"').nth(1).unwrap_or_default();
-                    let mut referenced = false;
-                    for probe in &cargo_probes {
-                        if let Ok(Some(text)) = staged_read(&staged, project_root, probe).await {
-                            if (!reg.is_empty() && text.contains(reg))
-                                || (!index.is_empty() && text.contains(index))
-                            {
-                                referenced = true;
-                                break;
-                            }
-                        }
-                    }
-                    if referenced {
-                        group_drops.insert(idx);
-                        continue;
-                    }
-                    match staged_read(&staged, project_root, &edit.path).await {
-                        Ok(Some(content)) => {
-                            // Absent fragment == already clean. A config the
-                            // rewrite created ends empty and goes with it.
-                            if let Some(restored) = remove_appended_cargo_block(&content, new) {
-                                staged.insert(
-                                    edit.path.clone(),
-                                    (!restored.is_empty()).then_some(restored),
-                                );
-                            }
-                            group_drops.insert(idx);
-                        }
-                        Ok(None) => {
-                            group_drops.insert(idx);
-                        }
-                        Err(e) => {
-                            refuse(e, &mut outcome);
-                            refused_groups.insert(group);
-                            continue 'group;
-                        }
-                    }
-                }
-                Inverse::RemoveAddedFragment => {
-                    let Some(new) = str_payload(&edit.new) else {
-                        refuse(
-                            format!("{} edit is missing its recorded fragment", edit.kind),
-                            &mut outcome,
-                        );
-                        refused_groups.insert(group);
-                        continue 'group;
-                    };
-                    match staged_read(&staged, project_root, &edit.path).await {
-                        // File gone entirely: the fragment is gone with it.
-                        Ok(None) => {
-                            group_drops.insert(idx);
-                        }
-                        Ok(Some(content)) => {
-                            if content.contains(new) {
-                                if content.matches(new).count() > 1 {
-                                    refuse(
-                                        format!(
-                                            "{}: the added fragment appears more than once — \
-                                             ambiguous, refusing to guess",
-                                            edit.path
-                                        ),
-                                        &mut outcome,
-                                    );
-                                    refused_groups.insert(group);
-                                    continue 'group;
-                                }
-                                staged.insert(
-                                    edit.path.clone(),
-                                    Some(remove_fragment_once(&content, new)),
-                                );
-                            }
-                            // Absent fragment == already clean.
-                            group_drops.insert(idx);
-                        }
-                        Err(e) => {
-                            refuse(e, &mut outcome);
-                            refused_groups.insert(group);
-                            continue 'group;
-                        }
-                    }
-                }
-                Inverse::ReinsertRemoved => {
-                    let Some(original) = str_payload(&edit.original) else {
-                        refuse(
-                            format!("{} edit is missing its recorded lines", edit.kind),
-                            &mut outcome,
-                        );
-                        refused_groups.insert(group);
-                        continue 'group;
-                    };
-                    let content = match staged_read(&staged, project_root, &edit.path).await {
-                        Ok(c) => c.unwrap_or_default(),
-                        Err(e) => {
-                            refuse(e, &mut outcome);
-                            refused_groups.insert(group);
-                            continue 'group;
-                        }
-                    };
-                    if let Some(restored) =
-                        crate::vendor::go_sum_edit::reinsert_lines(&content, original)
-                    {
-                        staged.insert(edit.path.clone(), Some(restored));
-                    }
-                    group_drops.insert(idx);
-                }
-                Inverse::RemoveAddedLines => {
-                    let Some(new) = str_payload(&edit.new) else {
-                        refuse(
-                            format!("{} edit is missing its recorded fragment", edit.kind),
-                            &mut outcome,
-                        );
-                        refused_groups.insert(group);
-                        continue 'group;
-                    };
-                    match staged_read(&staged, project_root, &edit.path).await {
-                        Ok(Some(content)) => {
-                            if new
-                                .lines()
-                                .filter(|l| !l.is_empty())
-                                .any(|line| content.lines().filter(|l| l == &line).count() > 1)
-                            {
-                                refuse(
-                                    format!(
-                                        "{}: an added line appears more than once — \
-                                         ambiguous, refusing to guess",
-                                        edit.path
-                                    ),
-                                    &mut outcome,
-                                );
-                                refused_groups.insert(group);
-                                continue 'group;
-                            }
-                            if let Some(removed) =
-                                crate::vendor::go_sum_edit::remove_lines(&content, new)
-                            {
-                                staged.insert(edit.path.clone(), Some(removed));
-                            }
-                            group_drops.insert(idx);
-                        }
-                        // File gone entirely: the lines are gone with it.
-                        Ok(None) => {
-                            group_drops.insert(idx);
-                        }
-                        Err(e) => {
-                            refuse(e, &mut outcome);
-                            refused_groups.insert(group);
-                            continue 'group;
-                        }
-                    }
-                }
-                Inverse::PnpmTrust => {
-                    let content = match staged_read(&staged, project_root, &edit.path).await {
-                        Ok(c) => c,
-                        Err(e) => {
-                            refuse(e, &mut outcome);
-                            refused_groups.insert(group);
-                            continue 'group;
-                        }
-                    };
-                    match (edit.action.as_str(), content) {
-                        // Whatever created it is already gone.
-                        (_, None) => {
-                            group_drops.insert(idx);
-                        }
-                        ("created", Some(c)) if c == PNPM_TRUST_SCAFFOLD => {
-                            staged.insert(edit.path.clone(), None);
-                            group_drops.insert(idx);
-                        }
-                        // Scaffold grew user content — keep the file, drop
-                        // only the line the redirect owns, and say so.
-                        (_, Some(c)) => {
-                            if c.contains(PNPM_TRUST_LINE) {
-                                if c.matches(PNPM_TRUST_LINE).count() > 1 {
-                                    refuse(
-                                        format!(
-                                            "{}: the `{PNPM_TRUST_LINE}` line appears more \
-                                             than once — ambiguous, refusing to guess",
-                                            edit.path
-                                        ),
-                                        &mut outcome,
-                                    );
-                                    refused_groups.insert(group);
-                                    continue 'group;
-                                }
-                                staged.insert(
-                                    edit.path.clone(),
-                                    Some(remove_fragment_once(&c, PNPM_TRUST_LINE)),
-                                );
-                                if edit.action == "created" {
-                                    group_warnings.push((
-                                        "redirect_pnpm_trust_scaffold_modified".into(),
-                                        format!(
-                                            "{} was created by the hosted redirect but has \
-                                             been modified since — kept the file and removed \
-                                             only the `trustLockfile: true` line",
-                                            edit.path
-                                        ),
-                                    ));
-                                }
-                            }
-                            group_drops.insert(idx);
-                        }
-                    }
-                }
-                Inverse::NpmrcAllowRemote => {
-                    // Refuse a symlinked / non-regular `.npmrc` while
-                    // planning — never at flush time, after sibling files
-                    // of the group may already have landed.
-                    if !staged.contains_key(&edit.path) {
-                        if let Ok(meta) =
-                            tokio::fs::symlink_metadata(project_root.join(&edit.path)).await
-                        {
-                            if !meta.is_file() {
-                                refuse(
-                                    format!("{} is not a regular file", edit.path),
-                                    &mut outcome,
-                                );
-                                refused_groups.insert(group);
-                                continue 'group;
-                            }
-                        }
-                    }
-                    let content = match staged_read(&staged, project_root, &edit.path).await {
-                        Ok(c) => c,
-                        Err(e) => {
-                            refuse(e, &mut outcome);
-                            refused_groups.insert(group);
-                            continue 'group;
-                        }
-                    };
-                    match super::npmrc::unwind_npmrc_allow_remote(&edit.action, content.as_deref())
-                    {
-                        Ok(super::npmrc::NpmrcUnwind::Unchanged) => {}
-                        Ok(super::npmrc::NpmrcUnwind::Delete) => {
-                            staged.insert(edit.path.clone(), None);
-                        }
-                        Ok(super::npmrc::NpmrcUnwind::Write {
-                            content,
-                            modified_created,
-                        }) => {
-                            staged.insert(edit.path.clone(), Some(content));
-                            if modified_created {
-                                group_warnings.push(super::npmrc::npmrc_modified_warning());
-                            }
-                        }
-                        Err(e) => {
-                            refuse(e, &mut outcome);
-                            refused_groups.insert(group);
-                            continue 'group;
-                        }
-                    }
-                    group_drops.insert(idx);
-                }
-            }
-        }
-
-        for &idx in &vanished_vlt {
-            let edit = &state.edits[idx];
-            let checked = match staged_read(&staged, project_root, &edit.path).await {
-                Ok(Some(content)) => super::vlt::revert_vanished(&content, edit),
-                Ok(None) => Err(format!("{} no longer exists", edit.path)),
-                Err(error) => Err(error),
-            };
-            match checked {
-                Ok(Some(restored)) => {
-                    staged.insert(edit.path.clone(), Some(restored));
-                }
-                Ok(None) => {}
-                Err(reason) => {
-                    refuse(reason, &mut outcome);
-                    refused_groups.insert(group);
-                    continue 'group;
-                }
-            }
-        }
-
-        // Commit the group: flush staged files (unless dry-run) through the
-        // shared guarded atomic writer, then mark its edits for dropping. A
-        // flush error refuses the group late — some files may already have
-        // landed (the same residual exposure the per-purl reverts document)
-        // — and keeps its ledger entries.
-        if !dry_run {
-            if let Err(reason) = flush_staged(project_root, &staged, &staged_bytes).await {
-                refuse(reason, &mut outcome);
-                refused_groups.insert(group);
-                continue 'group;
-            }
-        }
-        outcome.reverted_files.extend(staged.keys().cloned());
-        outcome.reverted_files.extend(staged_bytes.keys().cloned());
-        pending_warnings.extend(group_warnings);
-        drop_indices.extend(group_drops);
-    }
-
-    outcome.warnings.append(&mut pending_warnings);
-
-    if !dry_run {
-        // Drop replayed edits (reverse index order keeps indices valid).
-        for &idx in drop_indices.iter().rev() {
-            state.edits.remove(idx);
-            outcome.dropped_edits += 1;
-        }
-        // Drop each record whose every possible group ended clean.
-        let record_purls: Vec<String> = state.records.keys().cloned().collect();
-        for purl in record_purls {
-            let held = groups_for_record_purl(&purl)
-                .iter()
-                .any(|g| refused_groups.contains(g));
-            if !held {
-                state.records.remove(&purl);
-                outcome.dropped_records.push(purl);
-            }
-        }
-    } else {
-        outcome.dropped_edits = drop_indices.len();
-        for purl in state.records.keys() {
-            let held = groups_for_record_purl(purl)
-                .iter()
-                .any(|g| refused_groups.contains(g));
-            if !held {
-                outcome.dropped_records.push(purl.clone());
-            }
-        }
-    }
-
-    outcome
-}
-
-#[cfg(test)]
-mod tests {
-    use super::super::FileEdit;
-    use super::*;
-    use serde_json::json;
-    use tempfile::TempDir;
-
-    fn edit(
-        path: &str,
-        kind: &str,
-        action: &str,
-        original: Option<&str>,
-        new: Option<&str>,
-    ) -> FileEdit {
-        FileEdit {
-            path: path.into(),
-            kind: kind.into(),
-            action: action.into(),
-            key: Some("k".into()),
-            original: original.map(|s| Value::String(s.into())),
-            new: new.map(|s| Value::String(s.into())),
-        }
-    }
-
-    fn state_with(edits: Vec<FileEdit>, record_purls: &[&str]) -> RedirectState {
-        let mut state = RedirectState::new();
-        state.edits = edits;
-        for p in record_purls {
-            state.records.insert(
-                (*p).to_string(),
-                crate::manifest::schema::PatchRecord {
-                    uuid: "u".into(),
-                    exported_at: "now".into(),
-                    files: Default::default(),
-                    vulnerabilities: Default::default(),
-                    description: String::new(),
-                    license: String::new(),
-                    tier: "free".into(),
-                },
-            );
-        }
-        state
-    }
-
-    async fn write(root: &Path, rel: &str, content: &str) {
-        let p = root.join(rel);
-        if let Some(parent) = p.parent() {
-            tokio::fs::create_dir_all(parent).await.unwrap();
-        }
-        tokio::fs::write(p, content).await.unwrap();
-    }
-
-    async fn read(root: &Path, rel: &str) -> String {
-        tokio::fs::read_to_string(root.join(rel)).await.unwrap()
-    }
-
-    #[tokio::test]
-    async fn hatch_documents_revert_after_checkout_newline_conversion() {
-        let original = "[project]\ndependencies=[\"one==1\"]\n[tool.hatch.envs.default]\n";
-        let files = [("pyproject.toml".to_owned(), original.to_owned())]
-            .into_iter()
-            .collect();
-        let patched =
-            crate::utils::hatch::rewrite(&files, "one", "1", "https://patch.test/one.whl")
-                .unwrap()
-                .remove("pyproject.toml")
-                .unwrap();
-        for drift in [false, true] {
-            let dir = TempDir::new().unwrap();
-            let live = if drift {
-                patched.replace("one.whl", "changed.whl")
-            } else {
-                patched.replace('\n', "\r\n")
-            };
-            write(dir.path(), "pyproject.toml", &live).await;
-            let mut state = state_with(
-                vec![edit(
-                    "pyproject.toml",
-                    "redirect_hatch_document",
-                    "rewritten",
-                    Some(original),
-                    Some(&patched),
-                )],
-                &["pkg:pypi/one@1"],
-            );
-            let outcome = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-            assert_eq!(outcome.fully_reverted(), !drift);
-            if drift {
-                assert_eq!(read(dir.path(), "pyproject.toml").await, live);
-                assert_eq!(state.edits.len(), 1);
-            } else {
-                assert_eq!(
-                    read(dir.path(), "pyproject.toml").await,
-                    original.replace('\n', "\r\n")
-                );
-                assert!(state.edits.is_empty());
-            }
-        }
-    }
-
-    /// yarn lock edits replay across a `core.autocrlf` checkout switch: the
-    /// ledger's fragments are the lock's on-disk bytes at redirect time (the
-    /// berry and classic rewriters record CRLF blocks for a CRLF lock), the
-    /// live lock may since be in the OTHER uniform ending — the revert lands
-    /// on the original block in the live file's ending. A mixed live file
-    /// proves nothing and refuses; a non-yarn kind keeps the verbatim-only
-    /// contract.
-    #[tokio::test]
-    async fn yarn_edits_revert_across_a_checkout_line_ending_switch() {
-        let head = "# yarn\n\n__metadata:\n  version: 8\n  cacheKey: 10c0\n\n";
-        let original = "\"left-pad@npm:^1.3.0\":\n  version: 1.3.0\n  \
-                        resolution: \"left-pad@npm:1.3.0\"\n  checksum: 10c0/aaaa\n  \
-                        languageName: node\n  linkType: hard";
-        let new = "\"left-pad@npm:^1.3.0\":\n  version: 1.3.0\n  \
-                   resolution: \"left-pad@npm:1.3.0::__archiveUrl=http%3A%2F%2Fp.test%2Flp.tgz\"\n  \
-                   checksum: 10c0/bbbb\n  languageName: node\n  linkType: hard";
-        let spell = |text: &str, crlf: bool| {
-            if crlf {
-                text.replace('\n', "\r\n")
-            } else {
-                text.to_string()
-            }
-        };
-        for kind in ["redirect_yarn_berry_entry", "redirect_yarn_classic_entry"] {
-            for (recorded_crlf, live_crlf) in
-                [(true, true), (true, false), (false, true), (false, false)]
-            {
-                let label = format!("{kind} recorded_crlf={recorded_crlf} live_crlf={live_crlf}");
-                let dir = TempDir::new().unwrap();
-                write(
-                    dir.path(),
-                    "yarn.lock",
-                    &spell(&format!("{head}{new}\n"), live_crlf),
-                )
-                .await;
-                let mut state = state_with(
-                    vec![edit(
-                        "yarn.lock",
-                        kind,
-                        "rewritten",
-                        Some(&spell(original, recorded_crlf)),
-                        Some(&spell(new, recorded_crlf)),
-                    )],
-                    &["pkg:npm/left-pad@1.3.0"],
-                );
-                let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-                assert!(out.fully_reverted(), "{label}: {:?}", out.refusals);
-                assert_eq!(
-                    read(dir.path(), "yarn.lock").await,
-                    spell(&format!("{head}{original}\n"), live_crlf),
-                    "{label}"
-                );
-                assert!(state.edits.is_empty(), "{label}");
-            }
-        }
-
-        // A mixed live lock: refused whole, byte-untouched, edit kept.
-        let dir = TempDir::new().unwrap();
-        let mixed = format!("{}{}\n", spell(head, true), new);
-        write(dir.path(), "yarn.lock", &mixed).await;
-        let mut state = state_with(
-            vec![edit(
-                "yarn.lock",
-                "redirect_yarn_berry_entry",
-                "rewritten",
-                Some(&spell(original, true)),
-                Some(&spell(new, true)),
-            )],
-            &["pkg:npm/left-pad@1.3.0"],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(!out.fully_reverted(), "a mixed lock must refuse");
-        assert_eq!(read(dir.path(), "yarn.lock").await, mixed);
-        assert_eq!(state.edits.len(), 1);
-
-        // A non-yarn line-oriented kind keeps the verbatim-only contract.
-        let dir = TempDir::new().unwrap();
-        write(
-            dir.path(),
-            "requirements.txt",
-            "a==1\r\nleft-pad @ https://patch.example/x.whl\r\n",
-        )
-        .await;
-        let mut state = state_with(
-            vec![edit(
-                "requirements.txt",
-                "redirect_requirements_line",
-                "rewritten",
-                Some("a==1\nleft-pad==1.3.0"),
-                Some("a==1\nleft-pad @ https://patch.example/x.whl"),
-            )],
-            &["pkg:pypi/left-pad@1.3.0"],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(
-            !out.fully_reverted(),
-            "only yarn blocks are respelled across line endings"
-        );
-    }
-
-    // ---------- ReplaceFragment ----------
-
-    #[tokio::test]
-    async fn rewritten_fragment_replays_to_original() {
-        let dir = TempDir::new().unwrap();
-        write(
-            dir.path(),
-            "requirements.txt",
-            "left-pad @ https://patch.example/x.whl\n",
-        )
-        .await;
-        let mut state = state_with(
-            vec![edit(
-                "requirements.txt",
-                "redirect_requirements_line",
-                "rewritten",
-                Some("left-pad==1.3.0"),
-                Some("left-pad @ https://patch.example/x.whl"),
-            )],
-            &["pkg:pypi/left-pad@1.3.0"],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted(), "{:?}", out.refusals);
-        assert_eq!(
-            read(dir.path(), "requirements.txt").await,
-            "left-pad==1.3.0\n"
-        );
-        assert!(state.edits.is_empty());
-        assert!(state.records.is_empty());
-        assert_eq!(out.dropped_records, vec!["pkg:pypi/left-pad@1.3.0"]);
-    }
-
-    #[tokio::test]
-    async fn substring_original_checks_new_first() {
-        // The maven version-suffix shape: original is a substring of new.
-        let dir = TempDir::new().unwrap();
-        write(
-            dir.path(),
-            "pom.xml",
-            "<version>2.17.1-socket-abc</version>\n",
-        )
-        .await;
-        let mut state = state_with(
-            vec![edit(
-                "pom.xml",
-                "redirect_maven_dep_version",
-                "rewritten",
-                Some("2.17.1"),
-                Some("2.17.1-socket-abc"),
-            )],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted(), "{:?}", out.refusals);
-        assert_eq!(
-            read(dir.path(), "pom.xml").await,
-            "<version>2.17.1</version>\n"
-        );
-    }
-
-    #[tokio::test]
-    async fn drifted_fragment_refuses_the_whole_group_untouched() {
-        let dir = TempDir::new().unwrap();
-        // go.mod drifted; go.sum is revertable — but the golang group is
-        // all-or-nothing, so BOTH files stay byte-identical.
-        write(dir.path(), "go.mod", "module m\n").await;
-        write(dir.path(), "go.sum", "gopatch.socket.dev/x v1 h1:a\n").await;
-        let mut state = state_with(
-            vec![
-                edit(
-                    "go.mod",
-                    "redirect_golang_replace",
-                    "added",
-                    None,
-                    Some("replace x => gopatch.socket.dev/x v1"),
-                ),
-                edit(
-                    "go.mod",
-                    "redirect_golang_replace",
-                    "updated",
-                    Some("replace x => gopatch.socket.dev/x v0"),
-                    Some("replace x => WHAT-THE-FILE-NO-LONGER-HAS"),
-                ),
-                edit(
-                    "go.sum",
-                    "redirect_golang_gosum",
-                    "added",
-                    None,
-                    Some("gopatch.socket.dev/x v1 h1:a"),
-                ),
-            ],
-            &["pkg:golang/x@1"],
-        );
-        let before_mod = read(dir.path(), "go.mod").await;
-        let before_sum = read(dir.path(), "go.sum").await;
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert_eq!(out.refusals.len(), 1);
-        assert_eq!(out.refusals[0].group, "golang");
-        assert_eq!(read(dir.path(), "go.mod").await, before_mod);
-        assert_eq!(read(dir.path(), "go.sum").await, before_sum);
-        assert_eq!(state.edits.len(), 3, "refused group keeps its edits");
-        assert!(
-            state.records.contains_key("pkg:golang/x@1"),
-            "refused group keeps its records"
-        );
-    }
-
-    #[tokio::test]
-    async fn ambiguous_duplicate_fragment_refuses() {
-        let dir = TempDir::new().unwrap();
-        write(
-            dir.path(),
-            "composer.lock",
-            "https://patch.example/a\nhttps://patch.example/a\n",
-        )
-        .await;
-        let mut state = state_with(
-            vec![edit(
-                "composer.lock",
-                "redirect_composer_dist",
-                "rewritten",
-                Some("https://upstream.example/a"),
-                Some("https://patch.example/a"),
-            )],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert_eq!(out.refusals.len(), 1);
-        assert!(out.refusals[0].reason.contains("more than once"));
-    }
-
-    #[tokio::test]
-    async fn already_original_content_is_a_noop_drop() {
-        let dir = TempDir::new().unwrap();
-        write(dir.path(), "composer.lock", "https://upstream.example/a\n").await;
-        let mut state = state_with(
-            vec![edit(
-                "composer.lock",
-                "redirect_composer_dist",
-                "rewritten",
-                Some("https://upstream.example/a"),
-                Some("https://patch.example/a"),
-            )],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted());
-        assert!(state.edits.is_empty());
-        assert!(out.reverted_files.is_empty(), "nothing was written");
-    }
-
-    // ---------- chained re-redirects ----------
-
-    #[tokio::test]
-    async fn chained_reredirect_unwinds_newest_first_to_pristine() {
-        let dir = TempDir::new().unwrap();
-        write(
-            dir.path(),
-            "go.mod",
-            "module m\n\nreplace x => gopatch.socket.dev/x v2\n",
-        )
-        .await;
-        let mut state = state_with(
-            vec![
-                edit(
-                    "go.mod",
-                    "redirect_golang_replace",
-                    "added",
-                    None,
-                    Some("replace x => gopatch.socket.dev/x v1"),
-                ),
-                edit(
-                    "go.mod",
-                    "redirect_golang_replace",
-                    "updated",
-                    Some("replace x => gopatch.socket.dev/x v1"),
-                    Some("replace x => gopatch.socket.dev/x v2"),
-                ),
-            ],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted(), "{:?}", out.refusals);
-        assert_eq!(read(dir.path(), "go.mod").await, "module m\n");
-    }
-
-    // ---------- bun: digest-less re-saves (Bun 1.1.39–1.3.9, every text-lock release below 1.3.10) ----------
-
-    const BUN_URL: &str =
-        "https://patch.socket.dev/patch/npm/tok-1111/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/left-pad-1.3.0.tgz";
-    const BUN_REGISTRY_LINE: &str =
-        "    \"left-pad\": [\"left-pad@1.3.0\", \"\", {}, \"sha512-XI5M==\"],";
-
-    fn bun_url_line(sha: &str) -> String {
-        format!("    \"left-pad\": [\"left-pad@{BUN_URL}\", {{}}, \"{sha}\"],")
-    }
-
-    fn bun_digestless_line() -> String {
-        format!("    \"left-pad\": [\"left-pad@{BUN_URL}\", {{}}],")
-    }
-
-    fn bun_lock(entry: &str) -> String {
-        format!(
-            "{{\n  \"lockfileVersion\": 1,\n  \"packages\": {{\n    \"abbrev\": [\"abbrev@1.1.1\", \
-             \"\", {{}}, \"sha512-D==\"],\n\n{entry}\n  }}\n}}\n"
-        )
-    }
-
-    fn bun_edit(original: &str, new: &str) -> FileEdit {
-        edit(
-            "bun.lock",
-            "redirect_bun_lock_package",
-            "rewritten",
-            Some(original),
-            Some(new),
-        )
-    }
-
-    /// The live lock carries the digest-less 2-tuple Bun < 1.3.10 re-saved
-    /// our URL 3-tuple as; the recorded `new` is the 3-tuple. That is the
-    /// recorded wiring, not drift: the registry original comes back, the
-    /// edit and record are consumed.
-    #[tokio::test]
-    async fn bun_digestless_live_line_replays_to_the_registry_original() {
-        let dir = TempDir::new().unwrap();
-        write(dir.path(), "bun.lock", &bun_lock(&bun_digestless_line())).await;
-        let mut state = state_with(
-            vec![bun_edit(BUN_REGISTRY_LINE, &bun_url_line("sha512-AAAA=="))],
-            &["pkg:npm/left-pad@1.3.0"],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted(), "{:?}", out.refusals);
-        assert_eq!(
-            read(dir.path(), "bun.lock").await,
-            bun_lock(BUN_REGISTRY_LINE),
-            "the pristine registry line is restored, the decoy untouched"
-        );
-        assert!(state.edits.is_empty() && state.records.is_empty());
-        assert_eq!(out.dropped_records, vec!["pkg:npm/left-pad@1.3.0"]);
-
-        // CRLF lock (ledger recorded with `\r` on both fragments, as the
-        // rewriter does): every line keeps its `\r\n`.
-        let dir = TempDir::new().unwrap();
-        write(
-            dir.path(),
-            "bun.lock",
-            &bun_lock(&bun_digestless_line()).replace('\n', "\r\n"),
-        )
-        .await;
-        let mut state = state_with(
-            vec![bun_edit(
-                &format!("{BUN_REGISTRY_LINE}\r"),
-                &format!("{}\r", bun_url_line("sha512-AAAA==")),
-            )],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted(), "{:?}", out.refusals);
-        assert_eq!(
-            read(dir.path(), "bun.lock").await,
-            bun_lock(BUN_REGISTRY_LINE).replace('\n', "\r\n")
-        );
-    }
-
-    /// The hosted rewriter HEALS a digest-less tuple and records that heal
-    /// as a second edit for the same key (`original` = the 2-tuple). The
-    /// chain unwinds newest-first: heal → 2-tuple, then the first edit
-    /// recognises the 2-tuple as its digest-less `new` → registry line.
-    /// Same end state when Bun has since dropped the digest AGAIN (the
-    /// heal edit is then "already at its original" and simply drops).
-    #[tokio::test]
-    async fn bun_heal_chain_unwinds_to_the_registry_line() {
-        let healed = bun_url_line("sha512-AAAA==");
-        for live in [healed.clone(), bun_digestless_line()] {
-            let dir = TempDir::new().unwrap();
-            write(dir.path(), "bun.lock", &bun_lock(&live)).await;
-            let mut state = state_with(
-                vec![
-                    bun_edit(BUN_REGISTRY_LINE, &healed),
-                    bun_edit(&bun_digestless_line(), &healed),
-                ],
-                &["pkg:npm/left-pad@1.3.0"],
-            );
-            let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-            assert!(out.fully_reverted(), "live={live}: {:?}", out.refusals);
-            assert_eq!(
-                read(dir.path(), "bun.lock").await,
-                bun_lock(BUN_REGISTRY_LINE),
-                "live={live}: the chain must end at the pristine registry line"
-            );
-            assert!(state.edits.is_empty() && state.records.is_empty());
-        }
-    }
-
-    /// The relaxation is exactly "our tuple minus its digest": another
-    /// uuid/token in the URL, a re-laid meta object, a duplicate digest-less
-    /// instance, or a non-bun edit kind over the same bytes all still
-    /// refuse, leaving the file byte-identical.
-    #[tokio::test]
-    async fn bun_digestless_relaxation_is_narrow() {
-        let recorded_new = bun_url_line("sha512-AAAA==");
-        let other_uuid = bun_digestless_line().replace(
-            "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
-            "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb",
-        );
-        let other_meta = bun_digestless_line().replace("{}", "{ \"bin\": \"x\" }");
-        for (live, kind, reason) in [
-            (
-                bun_lock(&other_uuid),
-                "redirect_bun_lock_package",
-                "neither the redirected nor the original",
-            ),
-            (
-                bun_lock(&other_meta),
-                "redirect_bun_lock_package",
-                "neither the redirected nor the original",
-            ),
-            (
-                bun_lock(&format!(
-                    "{}\n{}",
-                    bun_digestless_line(),
-                    bun_digestless_line()
-                )),
-                "redirect_bun_lock_package",
-                "more than once",
-            ),
-            (
-                bun_lock(&bun_digestless_line()),
-                "redirect_pnpm_resolution",
-                "neither the redirected nor the original",
-            ),
-        ] {
-            let dir = TempDir::new().unwrap();
-            write(dir.path(), "bun.lock", &live).await;
-            let mut state = state_with(
-                vec![edit(
-                    "bun.lock",
-                    kind,
-                    "rewritten",
-                    Some(BUN_REGISTRY_LINE),
-                    Some(&recorded_new),
-                )],
-                &["pkg:npm/left-pad@1.3.0"],
-            );
-            let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-            assert_eq!(
-                out.refusals.len(),
-                1,
-                "{kind}: exactly one refusal expected, got {}",
-                out.refusals.len()
-            );
-            assert!(
-                out.refusals[0].reason.contains(reason),
-                "{kind}: {}",
-                out.refusals[0].reason
-            );
-            assert_eq!(read(dir.path(), "bun.lock").await, live, "file untouched");
-            assert_eq!(state.edits.len(), 1, "refused edit kept");
-            assert!(state.records.contains_key("pkg:npm/left-pad@1.3.0"));
-        }
-    }
-
-    // ---------- RemoveAddedFragment / ReinsertRemoved ----------
-
-    #[tokio::test]
-    async fn golang_round_trip_removes_added_and_reinserts_pruned() {
-        let dir = TempDir::new().unwrap();
-        write(
-            dir.path(),
-            "go.mod",
-            "module m\n\nreplace x => gopatch.socket.dev/x v1\n",
-        )
-        .await;
-        write(
-            dir.path(),
-            "go.sum",
-            "gopatch.socket.dev/x v1 h1:a\ngopatch.socket.dev/x v1/go.mod h1:b\n",
-        )
-        .await;
-        let mut state = state_with(
-            vec![
-                edit(
-                    "go.mod",
-                    "redirect_golang_replace",
-                    "added",
-                    None,
-                    Some("replace x => gopatch.socket.dev/x v1"),
-                ),
-                edit(
-                    "go.sum",
-                    "redirect_golang_gosum",
-                    "added",
-                    None,
-                    Some("gopatch.socket.dev/x v1 h1:a\ngopatch.socket.dev/x v1/go.mod h1:b"),
-                ),
-                edit(
-                    "go.sum",
-                    "redirect_golang_gosum_prune",
-                    "removed",
-                    Some("x v0.9 h1:orig\nx v0.9/go.mod h1:origmod"),
-                    None,
-                ),
-                edit(
-                    "go.mod",
-                    "redirect_golang_stale_replace_removed",
-                    "removed",
-                    Some("replace x => gopatch.socket.dev/x v0"),
-                    None,
-                ),
-            ],
-            &["pkg:golang/x@0.9"],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted(), "{:?}", out.refusals);
-        // The added replace line is gone (its blank separator too — the
-        // fragment+newline heuristic), and NOT the stale socket directive.
-        let go_mod = read(dir.path(), "go.mod").await;
-        assert!(!go_mod.contains("gopatch.socket.dev"), "{go_mod}");
-        // Pruned upstream sums are back; the fork's sums are gone.
-        let go_sum = read(dir.path(), "go.sum").await;
-        assert!(go_sum.contains("x v0.9 h1:orig"));
-        assert!(!go_sum.contains("gopatch.socket.dev"));
-        assert!(state.edits.is_empty());
-        assert!(state.records.is_empty());
-    }
-
-    /// The pruned pair goes back where `go mod tidy` writes it — module
-    /// path, then SEMVER version (`v1.9.0/go.mod` before `v1.10.0`, though
-    /// bytewise greater) — so go.sum is restored byte for byte.
-    #[tokio::test]
-    async fn reinsert_restores_the_go_sorted_position() {
-        let pristine = "example.com/leaf v1.0.0 h1:L=\n\
-                        example.com/leaf v1.0.0/go.mod h1:LM=\n\
-                        example.com/lib v1.9.0/go.mod h1:N9=\n\
-                        example.com/lib v1.10.0 h1:T=\n\
-                        example.com/lib v1.10.0/go.mod h1:TM=\n\
-                        example.com/zeta v0.1.0 h1:Z=\n";
-        for eol in ["\n", "\r\n"] {
-            let dir = TempDir::new().unwrap();
-            let pruned = pristine
-                .lines()
-                .filter(|l| !l.starts_with("example.com/lib v1.10.0"))
-                .map(|l| format!("{l}{eol}"))
-                .collect::<String>();
-            write(dir.path(), "go.sum", &pruned).await;
-            let mut state = state_with(
-                vec![edit(
-                    "go.sum",
-                    "redirect_golang_gosum_prune",
-                    "removed",
-                    Some("example.com/lib v1.10.0 h1:T=\nexample.com/lib v1.10.0/go.mod h1:TM="),
-                    None,
-                )],
-                &[],
-            );
-            let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-            assert!(out.fully_reverted(), "{:?}", out.refusals);
-            assert_eq!(
-                read(dir.path(), "go.sum").await,
-                pristine.replace('\n', eol),
-                "eol {eol:?}"
-            );
-        }
-    }
-
-    #[tokio::test]
-    async fn reinsert_is_idempotent_when_lines_are_already_back() {
-        let dir = TempDir::new().unwrap();
-        write(dir.path(), "go.sum", "x v0.9 h1:orig\n").await;
-        let mut state = state_with(
-            vec![edit(
-                "go.sum",
-                "redirect_golang_gosum_prune",
-                "removed",
-                Some("x v0.9 h1:orig"),
-                None,
-            )],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted());
-        assert_eq!(read(dir.path(), "go.sum").await, "x v0.9 h1:orig\n");
-    }
-
-    #[tokio::test]
-    async fn gem_added_pin_removal_preserves_sibling_indentation() {
-        // The gem writer records the DEPENDENCIES pin / CHECKSUMS line
-        // STRIPPED of its two-space indent; removal must take the whole
-        // line, never strand the indent onto the next line (which bundler
-        // then misparses).
-        let dir = TempDir::new().unwrap();
-        write(
-            dir.path(),
-            "Gemfile.lock",
-            "DEPENDENCIES\n  rack\n  rex (= 1.0.0)!\n  rspec\n",
-        )
-        .await;
-        let mut state = state_with(
-            vec![edit(
-                "Gemfile.lock",
-                "redirect_gemfile_lock_dependency_pin",
-                "added",
-                None,
-                Some("rex (= 1.0.0)!"),
-            )],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted(), "{:?}", out.refusals);
-        assert_eq!(
-            read(dir.path(), "Gemfile.lock").await,
-            "DEPENDENCIES\n  rack\n  rspec\n",
-            "sibling lines keep their exact indentation"
-        );
-    }
-
-    #[tokio::test]
-    async fn commented_out_added_fragment_removal_keeps_the_following_line() {
-        // The user disabled the redirect by commenting the directive out.
-        // Mid-line removal must not eat the line's newline — doing so
-        // joins the surviving comment prefix onto the NEXT line and
-        // comments out the `require` directive.
-        let dir = TempDir::new().unwrap();
-        write(
-            dir.path(),
-            "go.mod",
-            "module m\n// replace x v1.0.0 => gopatch.socket.dev/x v1\nrequire y v1.0.0\n",
-        )
-        .await;
-        let mut state = state_with(
-            vec![edit(
-                "go.mod",
-                "redirect_golang_replace",
-                "added",
-                None,
-                Some("replace x v1.0.0 => gopatch.socket.dev/x v1"),
-            )],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted(), "{:?}", out.refusals);
-        assert_eq!(
-            read(dir.path(), "go.mod").await,
-            "module m\n// \nrequire y v1.0.0\n",
-            "the require directive must survive on its own line"
-        );
-    }
-
-    #[tokio::test]
-    async fn anchor_shaped_original_never_reads_as_already_reverted() {
-        // The Cargo.toml insert variant records the always-present table
-        // header as `original` and header+insert as `new`. With the insert
-        // drifted, contains(original) is vacuously true — the edit must
-        // REFUSE, not silently drop as already-reverted.
-        let dir = TempDir::new().unwrap();
-        write(
-            dir.path(),
-            "Cargo.toml",
-            "[dependencies.cfg-if]\nregistry  =  \"socket-patch-u\"\n",
-        )
-        .await;
-        let mut state = state_with(
-            vec![edit(
-                "Cargo.toml",
-                "redirect_cargo_toml_dep",
-                "rewritten",
-                Some("[dependencies.cfg-if]"),
-                Some("[dependencies.cfg-if]\nregistry = \"socket-patch-u\""),
-            )],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert_eq!(out.refusals.len(), 1, "{out:?}");
-        assert!(out.refusals[0].reason.contains("drifted"));
-        assert_eq!(state.edits.len(), 1, "the edit must survive for a retry");
-    }
-
-    /// ONE scan records one cargo edit per OCCURRENCE, so a manifest that
-    /// declares the crate with the same line in two sections leaves two
-    /// IDENTICAL edits in the ledger. The whole-ledger replay — the
-    /// records-empty path a degraded (record-fetch-failed) run leaves
-    /// behind — must spend one edit per occurrence, exactly as the per-purl
-    /// `revert_cargo_redirect_purl` does over the same ledger. An
-    /// occurrence no edit accounts for is still ambiguous and refuses.
-    #[tokio::test]
-    async fn identical_cargo_edits_each_unwind_one_occurrence() {
-        let plain = "cfg-if = \"1\"";
-        let pinned = "cfg-if = { version = \"1\", registry = \"socket-patch-u\" }";
-        let two = |line: &str| format!("[dependencies]\n{line}\n\n[dev-dependencies]\n{line}\n");
-        let dir = TempDir::new().unwrap();
-        write(dir.path(), "Cargo.toml", &two(pinned)).await;
-        let cargo_edit = || {
-            edit(
-                "Cargo.toml",
-                "redirect_cargo_toml_dep",
-                "rewritten",
-                Some(plain),
-                Some(pinned),
-            )
-        };
-        let mut state = state_with(vec![cargo_edit(), cargo_edit()], &[]);
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted(), "{:?}", out.refusals);
-        assert_eq!(read(dir.path(), "Cargo.toml").await, two(plain));
-        assert!(state.edits.is_empty(), "{:?}", state.edits);
-
-        // A THIRD occurrence with only two edits to spend: nothing says
-        // which one the ledger owns, so the group refuses byte-untouched.
-        let dir = TempDir::new().unwrap();
-        let surplus = format!("{}\n[build-dependencies]\n{pinned}\n", two(pinned));
-        write(dir.path(), "Cargo.toml", &surplus).await;
-        let mut state = state_with(vec![cargo_edit(), cargo_edit()], &[]);
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert_eq!(out.refusals.len(), 1, "{out:?}");
-        assert!(
-            out.refusals[0].reason.contains("more than once"),
-            "{:?}",
-            out.refusals[0]
-        );
-        assert_eq!(read(dir.path(), "Cargo.toml").await, surplus);
-        assert_eq!(state.edits.len(), 2);
-    }
-
-    #[tokio::test]
-    async fn gem_section_move_record_fails_closed() {
-        // redirect_gemfile_lock_gem_source records only the bare URLs of a
-        // SECTION MOVE — not enough to invert it. Must refuse, never swap
-        // the URL and claim success.
-        let dir = TempDir::new().unwrap();
-        write(
-            dir.path(),
-            "Gemfile.lock",
-            "GEM\n  remote: https://patch.example/\n  specs:\n    rex (1.0.0)\n",
-        )
-        .await;
-        let mut state = state_with(
-            vec![edit(
-                "Gemfile.lock",
-                "redirect_gemfile_lock_gem_source",
-                "rewritten",
-                Some("https://rubygems.org/"),
-                Some("https://patch.example/"),
-            )],
-            &["pkg:gem/rex@1.0.0"],
-        );
-        let before = read(dir.path(), "Gemfile.lock").await;
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert_eq!(out.refusals.len(), 1);
-        assert!(out.refusals[0]
-            .reason
-            .contains("no hosted-redirect revert implementation"));
-        assert_eq!(read(dir.path(), "Gemfile.lock").await, before);
-        assert!(state.records.contains_key("pkg:gem/rex@1.0.0"));
-    }
-
-    #[tokio::test]
-    async fn gem_added_fragments_are_removed() {
-        let dir = TempDir::new().unwrap();
-        write(
-            dir.path(),
-            "Gemfile",
-            "source 'https://rubygems.org'\nsource 'https://patch.example' do\n  gem 'rex'\nend\n",
-        )
-        .await;
-        let mut state = state_with(
-            vec![edit(
-                "Gemfile",
-                "redirect_gemfile_source_block",
-                "added",
-                None,
-                Some("source 'https://patch.example' do\n  gem 'rex'\nend"),
-            )],
-            &["pkg:gem/rex@1.0.0"],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted(), "{:?}", out.refusals);
-        assert_eq!(
-            read(dir.path(), "Gemfile").await,
-            "source 'https://rubygems.org'\n"
-        );
-        assert!(state.records.is_empty());
-    }
-
-    // ---------- unsupported / per-purl-only ----------
-
-    #[tokio::test]
-    async fn maven_structured_edits_refuse_and_keep_the_record() {
-        let dir = TempDir::new().unwrap();
-        write(dir.path(), "pom.xml", "<project/>\n").await;
-        let mut state = state_with(
-            vec![FileEdit {
-                path: "pom.xml".into(),
-                kind: "redirect_maven_repository".into(),
-                action: "added".into(),
-                key: Some("socket-patch".into()),
-                original: None,
-                new: Some(json!({ "id": "socket-patch", "url": "https://patch.example" })),
-            }],
-            &["pkg:maven/g/a@1"],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert_eq!(out.refusals.len(), 1);
-        assert!(out.refusals[0]
-            .reason
-            .contains("no hosted-redirect revert implementation"));
-        assert_eq!(state.edits.len(), 1);
-        assert!(state.records.contains_key("pkg:maven/g/a@1"));
-    }
-
-    #[tokio::test]
-    async fn unknown_kind_fails_closed() {
-        let dir = TempDir::new().unwrap();
-        let mut state = state_with(
-            vec![edit(
-                "f",
-                "redirect_future_thing",
-                "rewritten",
-                Some("a"),
-                Some("b"),
-            )],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert_eq!(out.refusals.len(), 1);
-        assert_eq!(out.refusals[0].group, "unknown");
-        assert_eq!(state.edits.len(), 1);
-    }
-
-    const FUTURE_LOCK: &str =
-        "minimist@1.2.8 https://patch.socket.dev/npm/minimist/1.2.8/t/u/minimist-1.2.8.tgz\n";
-
-    fn future_lock_edit() -> FileEdit {
-        FileEdit {
-            key: Some("minimist@1.2.8".into()),
-            ..edit(
-                "future.lock",
-                "redirect_future_lock_entry",
-                "rewritten",
-                Some("minimist@1.2.8 sha512-r"),
-                Some("minimist@1.2.8 https://patch.socket.dev/npm/minimist/1.2.8/t/u/minimist-1.2.8.tgz"),
-            )
-        }
-    }
-
-    #[tokio::test]
-    async fn unclassified_kind_holds_the_npm_record_and_every_other_record() {
-        for dry_run in [true, false] {
-            let dir = TempDir::new().unwrap();
-            write(dir.path(), "future.lock", FUTURE_LOCK).await;
-            write(dir.path(), "composer.lock", "https://patch.example/c\n").await;
-            let mut state = state_with(
-                vec![
-                    future_lock_edit(),
-                    edit(
-                        "composer.lock",
-                        "redirect_composer_dist",
-                        "rewritten",
-                        Some("https://packagist.example/c"),
-                        Some("https://patch.example/c"),
-                    ),
-                ],
-                &["pkg:npm/minimist@1.2.8", "pkg:composer/v/c@1.0.0"],
-            );
-            let out = revert_remaining_redirect_edits(dir.path(), &mut state, dry_run).await;
-            assert_eq!(out.refusals.len(), 1, "{out:?}");
-            assert_eq!(out.refusals[0].group, "unknown");
-            assert_eq!(
-                out.refusals[0].reason,
-                "the redirect ledger holds a redirect_future_lock_entry edit this socket-patch \
-                 release does not understand; upgrade socket-patch"
-            );
-            assert!(out.dropped_records.is_empty(), "{out:?}");
-            assert!(state.records.contains_key("pkg:npm/minimist@1.2.8"));
-            assert!(state.records.contains_key("pkg:composer/v/c@1.0.0"));
-            assert_eq!(read(dir.path(), "future.lock").await, FUTURE_LOCK);
-            let kinds: Vec<&str> = state.edits.iter().map(|e| e.kind.as_str()).collect();
-            // The composer group still unwinds on disk; only its record waits
-            // for the unknown group to clear.
-            if dry_run {
-                assert_eq!(
-                    read(dir.path(), "composer.lock").await,
-                    "https://patch.example/c\n"
-                );
-                assert_eq!(
-                    kinds,
-                    ["redirect_future_lock_entry", "redirect_composer_dist"]
-                );
-            } else {
-                assert_eq!(
-                    read(dir.path(), "composer.lock").await,
-                    "https://packagist.example/c\n"
-                );
-                assert_eq!(kinds, ["redirect_future_lock_entry"]);
-            }
-        }
-    }
-
-    const VLT_REGISTRY_ENTRY: &str =
-        "\"~npm~minimist@1.2.8~peer.1\": [2,\"minimist\",\"sha512-r\"]";
-    const VLT_HOSTED_ENTRY: &str = "\"~npm~minimist@1.2.8~peer.1\": [2,\"minimist\",\"sha512-p\",\"https://patch.socket.dev/npm/minimist/1.2.8/t/u/minimist-1.2.8.tgz\"]";
-
-    fn vlt_lock(entry: &str) -> String {
-        format!(
-            "{{\r\n  \"lockfileVersion\": 1,\r\n  \"nodes\": {{\r\n    {entry},\r\n    \"~npm~zz@1.0.0\": [0,\"zz\",\"sha512-z\"]\r\n  }}\r\n}}\r\n"
-        )
-    }
-
-    fn vlt_edit() -> FileEdit {
-        FileEdit {
-            key: Some("minimist@1.2.8~peer.1".into()),
-            ..edit(
-                "vlt-lock.json",
-                super::super::vlt::KIND,
-                "rewritten",
-                Some(VLT_REGISTRY_ENTRY),
-                Some(VLT_HOSTED_ENTRY),
-            )
-        }
-    }
-
-    #[tokio::test]
-    async fn vlt_node_edits_replay_by_slots_and_drop_the_npm_record() {
-        let dir = TempDir::new().unwrap();
-        write(dir.path(), "vlt-lock.json", &vlt_lock(VLT_HOSTED_ENTRY)).await;
-        let mut state = state_with(vec![vlt_edit()], &["pkg:npm/minimist@1.2.8"]);
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted(), "{out:?}");
-        assert_eq!(
-            read(dir.path(), "vlt-lock.json").await,
-            vlt_lock(VLT_REGISTRY_ENTRY)
-        );
-        assert!(state.edits.is_empty() && state.records.is_empty());
-        assert_eq!(out.dropped_records, ["pkg:npm/minimist@1.2.8"]);
-    }
-
-    #[tokio::test]
-    async fn a_drifted_vlt_edit_holds_the_npm_record() {
-        let dir = TempDir::new().unwrap();
-        let drifted = VLT_HOSTED_ENTRY.replace("sha512-p", "sha512-x");
-        write(dir.path(), "vlt-lock.json", &vlt_lock(&drifted)).await;
-        let mut state = state_with(vec![vlt_edit()], &["pkg:npm/minimist@1.2.8"]);
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert_eq!(out.refusals.len(), 1, "{out:?}");
-        assert_eq!(out.refusals[0].group, "vlt");
-        assert!(out.refusals[0].reason.contains("drifted"), "{out:?}");
-        assert_eq!(read(dir.path(), "vlt-lock.json").await, vlt_lock(&drifted));
-        assert_eq!(state.edits.len(), 1);
-        assert!(state.records.contains_key("pkg:npm/minimist@1.2.8"));
-    }
-
-    #[tokio::test]
-    async fn vlt_replay_keeps_a_relaid_flag_and_trailing_slots() {
-        let dir = TempDir::new().unwrap();
-        let relaid = VLT_HOSTED_ENTRY.replacen("[2,", "[0,", 1).replacen(
-            "\"]",
-            "\",null,null,null,null,{  \"m\": \"bin.js\"}]",
-            1,
-        );
-        write(dir.path(), "vlt-lock.json", &vlt_lock(&relaid)).await;
-        let mut state = state_with(vec![vlt_edit()], &["pkg:npm/minimist@1.2.8"]);
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted(), "{out:?}");
-        assert_eq!(
-            read(dir.path(), "vlt-lock.json").await,
-            vlt_lock(
-                "\"~npm~minimist@1.2.8~peer.1\": [0,\"minimist\",\"sha512-r\",null,null,null,null,null,{  \"m\": \"bin.js\"}]"
-            )
-        );
-        assert!(state.edits.is_empty() && state.records.is_empty());
-    }
-
-    #[tokio::test]
-    async fn a_relocked_away_vlt_variant_reverts_whatever_the_ledger_order() {
-        let plain_registry = VLT_REGISTRY_ENTRY.replace("~peer.1", "");
-        let plain_hosted = VLT_HOSTED_ENTRY.replace("~peer.1", "");
-        let plain_edit = FileEdit {
-            key: Some("minimist@1.2.8".into()),
-            ..edit(
-                "vlt-lock.json",
-                super::super::vlt::KIND,
-                "rewritten",
-                Some(&plain_registry),
-                Some(&plain_hosted),
-            )
-        };
-        for edits in [
-            vec![plain_edit.clone(), vlt_edit()],
-            vec![vlt_edit(), plain_edit.clone()],
-        ] {
-            let dir = TempDir::new().unwrap();
-            write(dir.path(), "vlt-lock.json", &vlt_lock(&plain_hosted)).await;
-            let mut state = state_with(edits, &["pkg:npm/minimist@1.2.8"]);
-            let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-            assert!(out.fully_reverted(), "{out:?}");
-            assert_eq!(
-                read(dir.path(), "vlt-lock.json").await,
-                vlt_lock(&plain_registry)
-            );
-            assert!(state.edits.is_empty() && state.records.is_empty());
-        }
-
-        // vlt re-keyed the only pinned node and carried the pin with it.
-        let dir = TempDir::new().unwrap();
-        write(dir.path(), "vlt-lock.json", &vlt_lock(&plain_hosted)).await;
-        let mut state = state_with(vec![vlt_edit()], &["pkg:npm/minimist@1.2.8"]);
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted(), "{out:?}");
-        assert_eq!(
-            read(dir.path(), "vlt-lock.json").await,
-            vlt_lock(&plain_registry)
-        );
-        assert!(state.edits.is_empty() && state.records.is_empty());
-
-        let dir = TempDir::new().unwrap();
-        let other = plain_hosted.replace("sha512-p", "sha512-x");
-        write(dir.path(), "vlt-lock.json", &vlt_lock(&other)).await;
-        let mut state = state_with(vec![vlt_edit()], &["pkg:npm/minimist@1.2.8"]);
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert_eq!(out.refusals.len(), 1, "{out:?}");
-        assert!(
-            out.refusals[0].reason.contains("still pins its hosted URL"),
-            "{out:?}"
-        );
-        assert_eq!(read(dir.path(), "vlt-lock.json").await, vlt_lock(&other));
-    }
-
-    #[tokio::test]
-    async fn a_vlt_edit_whose_lock_is_gone_refuses() {
-        let dir = TempDir::new().unwrap();
-        let mut state = state_with(vec![vlt_edit()], &["pkg:npm/minimist@1.2.8"]);
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert_eq!(out.refusals[0].reason, "vlt-lock.json no longer exists");
-        assert!(state.records.contains_key("pkg:npm/minimist@1.2.8"));
-    }
-
-    #[test]
-    fn every_ecosystem_group_list_includes_the_unknown_group() {
-        for purl in [
-            "pkg:npm/a@1",
-            "pkg:cargo/a@1",
-            "pkg:gem/a@1",
-            "pkg:pypi/a@1",
-            "pkg:composer/v/a@1",
-            "pkg:golang/example.com/a@v1.0.0",
-            "pkg:maven/g/a@1",
-            "pkg:nuget/A@1",
-            "pkg:hex/a@1",
-        ] {
-            assert!(groups_for_record_purl(purl).contains(&"unknown"), "{purl}");
-        }
-        assert!(is_unclassified_kind(
-            "redirect_future_lock_entry",
-            "rewritten"
-        ));
-        assert!(!is_unclassified_kind("redirect_vlt_lock_node", "rewritten"));
-        assert!(!is_unclassified_kind(
-            "redirect_bun_lock_package",
-            "rewritten"
-        ));
-    }
-
-    #[tokio::test]
-    async fn leftover_npm_json_edit_refuses_and_holds_every_npm_family_record() {
-        let dir = TempDir::new().unwrap();
-        write(dir.path(), "package-lock.json", "{}\n").await;
-        write(
-            dir.path(),
-            "bun.lock",
-            "\"pkg\": [\"https://patch.example/t.tgz\"]\n",
-        )
-        .await;
-        let mut state = state_with(
-            vec![
-                FileEdit {
-                    path: "package-lock.json".into(),
-                    kind: "redirect_npm_lock_entry".into(),
-                    action: "rewritten".into(),
-                    key: Some("node_modules/a".into()),
-                    original: Some(json!({ "resolved": "u", "integrity": "i" })),
-                    new: Some(json!({ "resolved": "p", "integrity": "j" })),
-                },
-                edit(
-                    "bun.lock",
-                    "redirect_bun_lock_package",
-                    "rewritten",
-                    Some("\"pkg\": [\"https://upstream.example/t.tgz\"]"),
-                    Some("\"pkg\": [\"https://patch.example/t.tgz\"]"),
-                ),
-            ],
-            &["pkg:npm/a@1"],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        // The npm group refused; the bun group replayed.
-        assert_eq!(out.refusals.len(), 1);
-        assert_eq!(out.refusals[0].group, "npm");
-        assert!(read(dir.path(), "bun.lock")
-            .await
-            .contains("upstream.example"));
-        // npm-family records are held while ANY npm-family group refused.
-        assert!(state.records.contains_key("pkg:npm/a@1"));
-        assert_eq!(state.edits.len(), 1, "only the refused npm edit remains");
-    }
-
-    // ---------- npm .npmrc allow-remote ----------
-
-    fn npmrc_edit(action: &str) -> FileEdit {
-        FileEdit {
-            path: ".npmrc".into(),
-            kind: "redirect_npmrc_allow_remote".into(),
-            action: action.into(),
-            key: Some("allow-remote".into()),
-            original: None,
-            new: Some(json!("all")),
-        }
-    }
-
-    #[tokio::test]
-    async fn npmrc_created_file_is_deleted_when_unmodified() {
-        let dir = TempDir::new().unwrap();
-        write(dir.path(), ".npmrc", "allow-remote=all\n").await;
-        let mut state = state_with(vec![npmrc_edit("created")], &[]);
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted(), "{:?}", out.refusals);
-        assert!(!dir.path().join(".npmrc").exists());
-        assert!(state.edits.is_empty());
-    }
-
-    #[tokio::test]
-    async fn npmrc_appended_line_is_removed_exactly_and_user_edits_survive() {
-        let dir = TempDir::new().unwrap();
-        // The user added their own setting after our line (CRLF file).
-        write(
-            dir.path(),
-            ".npmrc",
-            "registry=https://r.example/\r\nallow-remote=all\r\nfund=false\r\n",
-        )
-        .await;
-        let mut state = state_with(vec![npmrc_edit("added")], &[]);
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted(), "{:?}", out.refusals);
-        assert_eq!(
-            read(dir.path(), ".npmrc").await,
-            "registry=https://r.example/\r\nfund=false\r\n"
-        );
-        assert!(out.warnings.is_empty(), "{:?}", out.warnings);
-    }
-
-    #[tokio::test]
-    async fn npmrc_modified_created_file_keeps_the_file_and_warns() {
-        let dir = TempDir::new().unwrap();
-        write(dir.path(), ".npmrc", "allow-remote=all\nfund=false\n").await;
-        let mut state = state_with(vec![npmrc_edit("created")], &[]);
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted(), "{:?}", out.refusals);
-        assert_eq!(read(dir.path(), ".npmrc").await, "fund=false\n");
-        assert!(out
-            .warnings
-            .iter()
-            .any(|(code, _)| code == "redirect_npmrc_allow_remote_modified"));
-    }
-
-    #[tokio::test]
-    async fn npmrc_edit_is_kept_while_an_npm_lock_edit_refuses() {
-        // A package-lock edit the per-purl revert failed to claim refuses
-        // the npm group — and with it the `.npmrc` setting that lock needs.
-        let dir = TempDir::new().unwrap();
-        write(dir.path(), ".npmrc", "allow-remote=all\n").await;
-        let mut state = state_with(
-            vec![
-                FileEdit {
-                    path: "package-lock.json".into(),
-                    kind: "redirect_npm_lock_entry".into(),
-                    action: "rewritten".into(),
-                    key: Some("node_modules/a".into()),
-                    original: Some(json!({"resolved": "https://registry/a-1.tgz"})),
-                    new: Some(json!({"resolved": "https://patch.example/a-1.tgz"})),
-                },
-                npmrc_edit("created"),
-            ],
-            &["pkg:npm/a@1"],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert_eq!(out.refusals.len(), 1, "{out:?}");
-        assert_eq!(out.refusals[0].group, "npm");
-        assert_eq!(read(dir.path(), ".npmrc").await, "allow-remote=all\n");
-        assert_eq!(state.edits.len(), 2);
-    }
-
-    #[tokio::test]
-    async fn npmrc_duplicate_line_refuses_and_dry_run_writes_nothing() {
-        let dir = TempDir::new().unwrap();
-        write(dir.path(), ".npmrc", "allow-remote=all\nallow-remote=all\n").await;
-        let mut state = state_with(vec![npmrc_edit("added")], &[]);
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert_eq!(out.refusals.len(), 1, "{out:?}");
-        assert_eq!(state.edits.len(), 1);
-
-        write(dir.path(), ".npmrc", "allow-remote=all\n").await;
-        let mut state = state_with(vec![npmrc_edit("created")], &[]);
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, true).await;
-        assert!(out.fully_reverted());
-        assert!(out.reverted_files.contains(".npmrc"));
-        assert_eq!(read(dir.path(), ".npmrc").await, "allow-remote=all\n");
-    }
-
-    /// The replay twin of the per-purl planning guard: a symlinked `.npmrc`
-    /// refuses the npm group while planning (the link and its target are
-    /// never written), and a section-scoped copy of the line does not make
-    /// the unwind ambiguous.
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn npmrc_symlink_refuses_at_plan_time_and_section_copies_are_inert() {
-        let dir = TempDir::new().unwrap();
-        write(dir.path(), "shared.npmrc", "allow-remote=all\n").await;
-        std::os::unix::fs::symlink("shared.npmrc", dir.path().join(".npmrc")).unwrap();
-        let mut state = state_with(vec![npmrc_edit("created")], &[]);
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert_eq!(out.refusals.len(), 1, "{out:?}");
-        assert!(
-            out.refusals[0].reason.contains("not a regular file"),
-            "{out:?}"
-        );
-        assert_eq!(state.edits.len(), 1);
-        assert_eq!(read(dir.path(), "shared.npmrc").await, "allow-remote=all\n");
-
-        let dir = TempDir::new().unwrap();
-        write(
-            dir.path(),
-            ".npmrc",
-            "allow-remote=all\n[sec]\nallow-remote=all\n",
-        )
-        .await;
-        let mut state = state_with(vec![npmrc_edit("added")], &[]);
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted(), "{out:?}");
-        assert_eq!(
-            read(dir.path(), ".npmrc").await,
-            "[sec]\nallow-remote=all\n"
-        );
-    }
-
-    // ---------- pnpm trust ----------
-
-    #[tokio::test]
-    async fn trust_scaffold_is_deleted_when_unmodified() {
-        let dir = TempDir::new().unwrap();
-        write(dir.path(), "pnpm-workspace.yaml", PNPM_TRUST_SCAFFOLD).await;
-        let mut state = state_with(
-            vec![FileEdit {
-                path: "pnpm-workspace.yaml".into(),
-                kind: "redirect_pnpm_workspace_trust".into(),
-                action: "created".into(),
-                key: Some("trustLockfile".into()),
-                original: None,
-                new: Some(json!("true")),
-            }],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted(), "{:?}", out.refusals);
-        assert!(!dir.path().join("pnpm-workspace.yaml").exists());
-    }
-
-    #[tokio::test]
-    async fn modified_trust_scaffold_keeps_the_file_and_drops_the_line() {
-        let dir = TempDir::new().unwrap();
-        write(
-            dir.path(),
-            "pnpm-workspace.yaml",
-            "packages:\n  - '.'\n  - 'packages/*'\ntrustLockfile: true\n",
-        )
-        .await;
-        let mut state = state_with(
-            vec![FileEdit {
-                path: "pnpm-workspace.yaml".into(),
-                kind: "redirect_pnpm_workspace_trust".into(),
-                action: "created".into(),
-                key: Some("trustLockfile".into()),
-                original: None,
-                new: Some(json!("true")),
-            }],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted());
-        assert_eq!(
-            read(dir.path(), "pnpm-workspace.yaml").await,
-            "packages:\n  - '.'\n  - 'packages/*'\n"
-        );
-        assert!(out
-            .warnings
-            .iter()
-            .any(|(code, _)| code == "redirect_pnpm_trust_scaffold_modified"));
-    }
-
-    #[tokio::test]
-    async fn appended_trust_line_is_removed_exactly() {
-        let dir = TempDir::new().unwrap();
-        write(
-            dir.path(),
-            "pnpm-workspace.yaml",
-            "packages:\n  - 'apps/*'\ntrustLockfile: true\n",
-        )
-        .await;
-        let mut state = state_with(
-            vec![FileEdit {
-                path: "pnpm-workspace.yaml".into(),
-                kind: "redirect_pnpm_workspace_trust".into(),
-                action: "added".into(),
-                key: Some("trustLockfile".into()),
-                original: None,
-                new: Some(json!("true")),
-            }],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted());
-        assert_eq!(
-            read(dir.path(), "pnpm-workspace.yaml").await,
-            "packages:\n  - 'apps/*'\n"
-        );
-    }
-
-    #[tokio::test]
-    async fn duplicated_trust_line_refuses_instead_of_removing_the_wrong_copy() {
-        // A commented-out copy of the trust line above the live one:
-        // removing the FIRST occurrence would strip the comment's text and
-        // leave the LIVE line active while claiming full revert. Must
-        // refuse like the ReplaceFragment / RemoveAddedFragment ambiguity
-        // guards.
-        let dir = TempDir::new().unwrap();
-        write(
-            dir.path(),
-            "pnpm-workspace.yaml",
-            "packages:\n  - '.'\n# trustLockfile: true — added by socket\ntrustLockfile: true\n",
-        )
-        .await;
-        let mut state = state_with(
-            vec![FileEdit {
-                path: "pnpm-workspace.yaml".into(),
-                kind: "redirect_pnpm_workspace_trust".into(),
-                action: "added".into(),
-                key: Some("trustLockfile".into()),
-                original: None,
-                new: Some(json!("true")),
-            }],
-            &[],
-        );
-        let before = read(dir.path(), "pnpm-workspace.yaml").await;
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert_eq!(out.refusals.len(), 1, "{out:?}");
-        assert_eq!(out.refusals[0].group, "pnpm");
-        assert!(out.refusals[0].reason.contains("more than once"));
-        assert_eq!(read(dir.path(), "pnpm-workspace.yaml").await, before);
-        assert_eq!(state.edits.len(), 1, "the edit must survive for a retry");
-    }
-
-    #[tokio::test]
-    async fn commented_out_trust_line_removal_keeps_the_following_line() {
-        // Single (commented) occurrence: removal proceeds, but must not
-        // eat the newline and comment out the key on the next line.
-        let dir = TempDir::new().unwrap();
-        write(
-            dir.path(),
-            "pnpm-workspace.yaml",
-            "packages:\n  - '.'\n# trustLockfile: true\nshamefullyHoist: true\n",
-        )
-        .await;
-        let mut state = state_with(
-            vec![FileEdit {
-                path: "pnpm-workspace.yaml".into(),
-                kind: "redirect_pnpm_workspace_trust".into(),
-                action: "added".into(),
-                key: Some("trustLockfile".into()),
-                original: None,
-                new: Some(json!("true")),
-            }],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted(), "{:?}", out.refusals);
-        assert_eq!(
-            read(dir.path(), "pnpm-workspace.yaml").await,
-            "packages:\n  - '.'\n# \nshamefullyHoist: true\n",
-            "the following key must survive on its own line"
-        );
-    }
-
-    // ---------- dry-run ----------
-
-    #[tokio::test]
-    async fn dry_run_reports_without_touching_disk_or_ledger() {
-        let dir = TempDir::new().unwrap();
-        write(
-            dir.path(),
-            "requirements.txt",
-            "left-pad @ https://patch.example/x.whl\n",
-        )
-        .await;
-        let mut state = state_with(
-            vec![edit(
-                "requirements.txt",
-                "redirect_requirements_line",
-                "rewritten",
-                Some("left-pad==1.3.0"),
-                Some("left-pad @ https://patch.example/x.whl"),
-            )],
-            &["pkg:pypi/left-pad@1.3.0"],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, true).await;
-        assert!(out.fully_reverted());
-        assert_eq!(out.dropped_edits, 1);
-        assert_eq!(out.dropped_records, vec!["pkg:pypi/left-pad@1.3.0"]);
-        assert!(out.reverted_files.contains("requirements.txt"));
-        // Disk and ledger untouched.
-        assert!(read(dir.path(), "requirements.txt")
-            .await
-            .contains("patch.example"));
-        assert_eq!(state.edits.len(), 1);
-        assert_eq!(state.records.len(), 1);
-    }
-
-    // ---------- safety ----------
-
-    #[tokio::test]
-    async fn unsafe_ledger_path_refuses() {
-        let dir = TempDir::new().unwrap();
-        for bad in ["/etc/passwd", "../outside", "a/../../b", "c:\\windows\\x"] {
-            let mut state = state_with(
-                vec![edit(
-                    bad,
-                    "redirect_requirements_line",
-                    "rewritten",
-                    Some("a"),
-                    Some("b"),
-                )],
-                &[],
-            );
-            let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-            assert_eq!(out.refusals.len(), 1, "path {bad:?} must refuse");
-            assert!(out.refusals[0].reason.contains("unsafe path"), "{bad:?}");
-        }
-    }
-
-    #[tokio::test]
-    async fn missing_file_for_rewritten_edit_is_a_drift_refusal() {
-        let dir = TempDir::new().unwrap();
-        let mut state = state_with(
-            vec![edit(
-                "composer.lock",
-                "redirect_composer_dist",
-                "rewritten",
-                Some("a"),
-                Some("b"),
-            )],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert_eq!(out.refusals.len(), 1);
-        assert!(out.refusals[0].reason.contains("no longer exists"));
-    }
-
-    /// A FIFO squatting bun.lockb must refuse fast instead of wedging the
-    /// replay (the same guard every other raw read in the engine has).
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn bun_lockb_fifo_squatting_the_path_refuses_the_group() {
-        let dir = TempDir::new().unwrap();
-        let fifo = dir.path().join("bun.lockb");
-        let c_path = std::ffi::CString::new(fifo.to_str().unwrap()).unwrap();
-        // SAFETY: a valid NUL-terminated path; mkfifo has no other preconditions.
-        assert_eq!(unsafe { libc::mkfifo(c_path.as_ptr(), 0o644) }, 0);
-        let mut state = state_with(
-            vec![edit(
-                "bun.lockb",
-                "redirect_bun_lockb_package",
-                "rewritten",
-                None,
-                None,
-            )],
-            &[],
-        );
-        let out = tokio::time::timeout(
-            std::time::Duration::from_secs(10),
-            revert_remaining_redirect_edits(dir.path(), &mut state, false),
-        )
-        .await
-        .expect("the FIFO guard must not wedge the replay");
-        assert_eq!(out.refusals.len(), 1, "{:?}", out.warnings);
-        assert!(
-            out.refusals[0].reason.contains("bun.lockb"),
-            "{}",
-            out.refusals[0].reason
-        );
-        assert_eq!(state.edits.len(), 1);
-    }
-
-    /// Every kind the hosted writers emit today must have a deliberate
-    /// classification — a new writer kind landing without a replay arm
-    /// falls to the "unknown" group, which fails closed at runtime; this
-    /// pin makes the gap loud at test time instead.
-    #[test]
-    fn every_known_writer_kind_is_classified() {
-        let known = [
-            ("redirect_requirements_line", "rewritten"),
-            ("redirect_uv_lock_wheel", "rewritten"),
-            ("redirect_composer_dist", "rewritten"),
-            ("redirect_cargo_toml_dep", "rewritten"),
-            ("redirect_cargo_lock_entry", "rewritten"),
-            ("redirect_cargo_registry", "rewritten"),
-            ("redirect_cargo_registry", "added"),
-            ("redirect_pnpm_resolution", "rewritten"),
-            ("redirect_pnpm_workspace_trust", "created"),
-            ("redirect_pnpm_workspace_trust", "added"),
-            ("redirect_yarn_classic_entry", "rewritten"),
-            ("redirect_yarn_berry_entry", "rewritten"),
-            ("redirect_bun_lock_package", "rewritten"),
-            ("redirect_bun_lockb_package", "rewritten"),
-            ("redirect_vlt_lock_node", "rewritten"),
-            ("redirect_gemfile_lock_dependency_pin", "rewritten"),
-            ("redirect_gemfile_lock_dependency_pin", "added"),
-            ("redirect_gemfile_lock_checksum", "rewritten"),
-            ("redirect_gemfile_lock_checksum", "added"),
-            ("redirect_gemfile_source_block", "rewritten"),
-            ("redirect_gemfile_source_block", "added"),
-            ("redirect_gemfile_lock_source_url", "rewritten"),
-            ("redirect_gemfile_lock_gem_source", "rewritten"),
-            ("redirect_gemfile_source_url", "rewritten"),
-            ("redirect_golang_replace", "added"),
-            ("redirect_golang_replace", "updated"),
-            ("redirect_golang_gosum", "added"),
-            ("redirect_golang_gosum_prune", "removed"),
-            ("redirect_golang_stale_replace_removed", "removed"),
-            ("redirect_golang_stale_gosum_removed", "removed"),
-            ("redirect_npm_lock_entry", "rewritten"),
-            ("redirect_npm_lock_dep", "rewritten"),
-            ("redirect_npmrc_allow_remote", "created"),
-            ("redirect_npmrc_allow_remote", "added"),
-            ("redirect_maven_repository", "added"),
-            ("redirect_maven_dep_management", "added"),
-            ("redirect_maven_dep_version", "rewritten"),
-            ("redirect_maven_config", "created"),
-            ("redirect_maven_trusted_checksums", "created"),
-            ("redirect_nuget_source", "rewritten"),
-            ("redirect_nuget_source", "added"),
-            ("redirect_nuget_lock", "rewritten"),
-        ];
-        for (kind, action) in known {
-            let (group, _) = classify(kind, action);
-            assert_ne!(
-                group, "unknown",
-                "writer kind {kind}/{action} has no replay classification"
-            );
-        }
-    }
-
-    // ---------- payload corruption (tampered / partially-written ledger) ----------
-
-    #[tokio::test]
-    async fn replace_arm_missing_payload_refuses_and_keeps_the_edit() {
-        let dir = TempDir::new().unwrap();
-        write(dir.path(), "composer.lock", "https://patch.example/a\n").await;
-        let mut state = state_with(
-            vec![edit(
-                "composer.lock",
-                "redirect_composer_dist",
-                "rewritten",
-                None,
-                Some("https://patch.example/a"),
-            )],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert_eq!(out.refusals.len(), 1, "{out:?}");
-        assert!(out.refusals[0]
-            .reason
-            .contains("missing its recorded fragments"));
-        assert_eq!(state.edits.len(), 1, "the edit must survive for a retry");
-        assert_eq!(
-            read(dir.path(), "composer.lock").await,
-            "https://patch.example/a\n"
-        );
-    }
-
-    #[tokio::test]
-    async fn replace_arm_non_string_payload_refuses() {
-        // A hand-edited or corrupted ledger can carry a non-string Value
-        // where the inverse table requires a fragment string — str_payload
-        // must reject it, not coerce.
-        let dir = TempDir::new().unwrap();
-        write(dir.path(), "composer.lock", "https://patch.example/a\n").await;
-        let mut state = state_with(
-            vec![FileEdit {
-                path: "composer.lock".into(),
-                kind: "redirect_composer_dist".into(),
-                action: "rewritten".into(),
-                key: Some("k".into()),
-                original: Some(json!(42)),
-                new: Some(Value::String("https://patch.example/a".into())),
-            }],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert_eq!(out.refusals.len(), 1, "{out:?}");
-        assert!(out.refusals[0]
-            .reason
-            .contains("missing its recorded fragments"));
-        assert_eq!(state.edits.len(), 1);
-        assert_eq!(
-            read(dir.path(), "composer.lock").await,
-            "https://patch.example/a\n"
-        );
-    }
-
-    #[tokio::test]
-    async fn remove_added_arm_missing_payload_refuses() {
-        let dir = TempDir::new().unwrap();
-        write(dir.path(), "go.sum", "gopatch.socket.dev/x v1 h1:a\n").await;
-        let mut state = state_with(
-            vec![edit("go.sum", "redirect_golang_gosum", "added", None, None)],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert_eq!(out.refusals.len(), 1, "{out:?}");
-        assert!(out.refusals[0]
-            .reason
-            .contains("missing its recorded fragment"));
-        assert_eq!(state.edits.len(), 1);
-        assert_eq!(
-            read(dir.path(), "go.sum").await,
-            "gopatch.socket.dev/x v1 h1:a\n"
-        );
-    }
-
-    #[tokio::test]
-    async fn reinsert_arm_missing_payload_refuses() {
-        let dir = TempDir::new().unwrap();
-        write(dir.path(), "go.sum", "x v1 h1:a\n").await;
-        let mut state = state_with(
-            vec![edit(
-                "go.sum",
-                "redirect_golang_gosum_prune",
-                "removed",
-                None,
-                None,
-            )],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert_eq!(out.refusals.len(), 1, "{out:?}");
-        assert!(out.refusals[0]
-            .reason
-            .contains("missing its recorded lines"));
-        assert_eq!(state.edits.len(), 1);
-        assert_eq!(read(dir.path(), "go.sum").await, "x v1 h1:a\n");
-    }
-
-    // ---------- read failures (FIFO / directory squats) ----------
-
-    #[tokio::test]
-    async fn directory_squatting_a_lockfile_refuses_each_arm_fail_fast() {
-        // A directory planted at the lockfile path makes open_regular_file
-        // return InvalidInput (open + fstat) — the fail-fast posture the
-        // `staged` module documents for its guarded reads. Every per-arm
-        // read must refuse the group with the read error and keep the ledger.
-        #[allow(clippy::type_complexity)]
-        let cases: [(&str, &str, &str, Option<&str>, Option<&str>); 4] = [
-            (
-                "composer.lock",
-                "redirect_composer_dist",
-                "rewritten",
-                Some("https://upstream.example/a"),
-                Some("https://patch.example/a"),
-            ),
-            (
-                "go.sum",
-                "redirect_golang_gosum",
-                "added",
-                None,
-                Some("gopatch.socket.dev/x v1 h1:a"),
-            ),
-            (
-                "go.sum",
-                "redirect_golang_gosum_prune",
-                "removed",
-                Some("x v0.9 h1:o"),
-                None,
-            ),
-            (
-                "pnpm-workspace.yaml",
-                "redirect_pnpm_workspace_trust",
-                "added",
-                None,
-                Some("true"),
-            ),
-        ];
-        for (path, kind, action, original, new) in cases {
-            let dir = TempDir::new().unwrap();
-            tokio::fs::create_dir_all(dir.path().join(path))
-                .await
-                .unwrap();
-            let mut state = state_with(vec![edit(path, kind, action, original, new)], &[]);
-            let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-            assert_eq!(
-                out.refusals.len(),
-                1,
-                "{kind}/{action} must refuse: {out:?}"
-            );
-            assert!(
-                out.refusals[0].reason.starts_with(&format!("read {path}:")),
-                "{kind}/{action}: {}",
-                out.refusals[0].reason
-            );
-            // The fstat guard's "not a regular file" text is unix-only: on
-            // Windows, opening a directory fails at CreateFileW with
-            // ERROR_ACCESS_DENIED before the guard runs. The refusal itself
-            // (count, `read {path}:` prefix, kept ledger) is platform-neutral.
-            #[cfg(unix)]
-            assert!(
-                out.refusals[0].reason.contains("not a regular file"),
-                "{kind}/{action}: {}",
-                out.refusals[0].reason
-            );
-            assert_eq!(state.edits.len(), 1, "{kind}/{action} must keep its edit");
-        }
-    }
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn fifo_squatting_a_lockfile_refuses_instead_of_wedging() {
-        use std::os::unix::ffi::OsStrExt;
-        let dir = TempDir::new().unwrap();
-        let path = dir.path().join("composer.lock");
-        let cpath = std::ffi::CString::new(path.as_os_str().as_bytes()).unwrap();
-        assert_eq!(unsafe { libc::mkfifo(cpath.as_ptr(), 0o644) }, 0);
-        let mut state = state_with(
-            vec![edit(
-                "composer.lock",
-                "redirect_composer_dist",
-                "rewritten",
-                Some("https://upstream.example/a"),
-                Some("https://patch.example/a"),
-            )],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert_eq!(out.refusals.len(), 1, "{out:?}");
-        assert!(
-            out.refusals[0].reason.starts_with("read composer.lock:"),
-            "{}",
-            out.refusals[0].reason
-        );
-        assert!(out.refusals[0].reason.contains("not a regular file"));
-        assert_eq!(state.edits.len(), 1);
-    }
-
-    // ---------- RemoveAddedFragment already-clean edges ----------
-
-    #[tokio::test]
-    async fn added_fragment_with_file_gone_drops_without_recreating_it() {
-        let dir = TempDir::new().unwrap();
-        let mut state = state_with(
-            vec![edit(
-                "go.sum",
-                "redirect_golang_gosum",
-                "added",
-                None,
-                Some("gopatch.socket.dev/x v1 h1:a"),
-            )],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted(), "{:?}", out.refusals);
-        assert!(state.edits.is_empty());
-        assert!(out.reverted_files.is_empty(), "nothing was written");
-        assert!(
-            !dir.path().join("go.sum").exists(),
-            "the deleted file must not be recreated"
-        );
-    }
-
-    #[tokio::test]
-    async fn added_fragment_already_absent_is_a_noop_drop() {
-        let dir = TempDir::new().unwrap();
-        write(dir.path(), "go.mod", "module m\n").await;
-        let mut state = state_with(
-            vec![edit(
-                "go.mod",
-                "redirect_golang_replace",
-                "added",
-                None,
-                Some("replace x => gopatch.socket.dev/x v1"),
-            )],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted(), "{:?}", out.refusals);
-        assert!(state.edits.is_empty());
-        assert!(out.reverted_files.is_empty(), "nothing was written");
-        assert_eq!(read(dir.path(), "go.mod").await, "module m\n");
-    }
-
-    #[tokio::test]
-    async fn duplicated_added_fragment_refuses_instead_of_guessing() {
-        // The RemoveAddedFragment twin of the ReplaceFragment ambiguity
-        // guard: two occurrences of the recorded fragment mean removal
-        // could hit the wrong one — refuse byte-untouched.
-        let dir = TempDir::new().unwrap();
-        write(
-            dir.path(),
-            "go.sum",
-            "gopatch.socket.dev/x v1 h1:a\ngopatch.socket.dev/x v1 h1:a\n",
-        )
-        .await;
-        let mut state = state_with(
-            vec![edit(
-                "go.sum",
-                "redirect_golang_gosum",
-                "added",
-                None,
-                Some("gopatch.socket.dev/x v1 h1:a"),
-            )],
-            &[],
-        );
-        let before = read(dir.path(), "go.sum").await;
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert_eq!(out.refusals.len(), 1, "{out:?}");
-        assert_eq!(out.refusals[0].group, "golang");
-        assert!(out.refusals[0].reason.contains("more than once"));
-        assert_eq!(read(dir.path(), "go.sum").await, before);
-        assert_eq!(state.edits.len(), 1, "the edit must survive for a retry");
-    }
-
-    // ---------- ReinsertRemoved edge shapes ----------
-
-    #[tokio::test]
-    async fn reinsert_into_unterminated_file_adds_a_separating_newline() {
-        // A go.sum whose last line lost its trailing newline (hand-edited
-        // or tool-truncated): the re-inserted pruned lines must not
-        // concatenate onto it.
-        let dir = TempDir::new().unwrap();
-        write(dir.path(), "go.sum", "x v1 h1:abc").await;
-        let mut state = state_with(
-            vec![edit(
-                "go.sum",
-                "redirect_golang_gosum_prune",
-                "removed",
-                Some("y v0.9 h1:o"),
-                None,
-            )],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted(), "{:?}", out.refusals);
-        assert_eq!(
-            read(dir.path(), "go.sum").await,
-            "x v1 h1:abc\ny v0.9 h1:o\n"
-        );
-    }
-
-    #[tokio::test]
-    async fn reinsert_recreates_a_deleted_gosum() {
-        // The user deleted go.sum entirely; the pruned upstream lines must
-        // still come back — the staged write lands on a nonexistent path
-        // (the flush-side symlink_metadata Err edge) and creates the file.
-        let dir = TempDir::new().unwrap();
-        let mut state = state_with(
-            vec![edit(
-                "go.sum",
-                "redirect_golang_gosum_prune",
-                "removed",
-                Some("y v0.9 h1:o"),
-                None,
-            )],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted(), "{:?}", out.refusals);
-        assert!(out.reverted_files.contains("go.sum"));
-        assert_eq!(read(dir.path(), "go.sum").await, "y v0.9 h1:o\n");
-        assert!(state.edits.is_empty());
-    }
-
-    // ---------- pnpm trust already-clean edges ----------
-
-    #[tokio::test]
-    async fn trust_edit_with_workspace_file_gone_drops_without_recreating_it() {
-        let dir = TempDir::new().unwrap();
-        let mut state = state_with(
-            vec![FileEdit {
-                path: "pnpm-workspace.yaml".into(),
-                kind: "redirect_pnpm_workspace_trust".into(),
-                action: "created".into(),
-                key: Some("trustLockfile".into()),
-                original: None,
-                new: Some(json!("true")),
-            }],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted(), "{:?}", out.refusals);
-        assert!(state.edits.is_empty());
-        assert!(
-            !dir.path().join("pnpm-workspace.yaml").exists(),
-            "the deleted workspace file must not be recreated"
-        );
-        assert!(out.reverted_files.is_empty(), "nothing was written");
-    }
-
-    #[tokio::test]
-    async fn trust_line_already_absent_leaves_the_file_untouched() {
-        let dir = TempDir::new().unwrap();
-        write(
-            dir.path(),
-            "pnpm-workspace.yaml",
-            "packages:\n  - 'apps/*'\n",
-        )
-        .await;
-        let mut state = state_with(
-            vec![FileEdit {
-                path: "pnpm-workspace.yaml".into(),
-                kind: "redirect_pnpm_workspace_trust".into(),
-                action: "created".into(),
-                key: Some("trustLockfile".into()),
-                original: None,
-                new: Some(json!("true")),
-            }],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted(), "{:?}", out.refusals);
-        assert!(state.edits.is_empty());
-        assert_eq!(
-            read(dir.path(), "pnpm-workspace.yaml").await,
-            "packages:\n  - 'apps/*'\n"
-        );
-        assert!(
-            out.warnings.is_empty(),
-            "no scaffold_modified warning: {:?}",
-            out.warnings
-        );
-        assert!(out.reverted_files.is_empty(), "nothing was written");
-    }
-
-    // ---------- flush-side guards ----------
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn symlinked_lockfile_reads_fine_but_refuses_at_flush() {
-        // open_regular_file follows the symlink at read time (open+fstat),
-        // but the flush-side symlink_metadata guard does not — a symlinked
-        // lockfile must refuse fail-closed rather than write through the
-        // link.
-        let dir = TempDir::new().unwrap();
-        write(dir.path(), "real.lock", "https://patch.example/a\n").await;
-        std::os::unix::fs::symlink(
-            dir.path().join("real.lock"),
-            dir.path().join("composer.lock"),
-        )
-        .unwrap();
-        let mut state = state_with(
-            vec![edit(
-                "composer.lock",
-                "redirect_composer_dist",
-                "rewritten",
-                Some("https://upstream.example/a"),
-                Some("https://patch.example/a"),
-            )],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert_eq!(out.refusals.len(), 1, "{out:?}");
-        assert_eq!(
-            out.refusals[0].reason,
-            "composer.lock is not a regular file"
-        );
-        assert_eq!(
-            read(dir.path(), "real.lock").await,
-            "https://patch.example/a\n",
-            "the symlink target must stay byte-identical"
-        );
-        assert_eq!(state.edits.len(), 1, "the edit must survive for a retry");
-    }
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn write_failure_at_flush_refuses_late_and_keeps_the_ledger() {
-        // Root bypasses mode bits (CI containers) — skip there.
-        if unsafe { libc::geteuid() } == 0 {
-            return;
-        }
-        use std::os::unix::fs::PermissionsExt;
-        let dir = TempDir::new().unwrap();
-        write(dir.path(), "composer.lock", "https://patch.example/a\n").await;
-        // The flush is an atomic stage + rename, so a read-only TARGET no
-        // longer blocks it (rename needs only the parent): make the parent
-        // directory read-only so the stage file cannot be created.
-        let writable = std::fs::metadata(dir.path()).unwrap().permissions();
-        std::fs::set_permissions(dir.path(), std::fs::Permissions::from_mode(0o555)).unwrap();
-        let mut state = state_with(
-            vec![edit(
-                "composer.lock",
-                "redirect_composer_dist",
-                "rewritten",
-                Some("https://upstream.example/a"),
-                Some("https://patch.example/a"),
-            )],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        // Restore before asserting so the TempDir can clean up on failure.
-        std::fs::set_permissions(dir.path(), writable).unwrap();
-        assert_eq!(out.refusals.len(), 1, "{out:?}");
-        assert!(
-            out.refusals[0].reason.starts_with("write composer.lock:"),
-            "{}",
-            out.refusals[0].reason
-        );
-        assert_eq!(state.edits.len(), 1, "the edit must survive for a retry");
-        assert_eq!(
-            read(dir.path(), "composer.lock").await,
-            "https://patch.example/a\n",
-            "the redirected fragment must still be present"
-        );
-        let litter: Vec<String> = std::fs::read_dir(dir.path())
-            .unwrap()
-            .map(|e| e.unwrap().file_name().to_string_lossy().into_owned())
-            .filter(|n| n.starts_with(".socket-stage-"))
-            .collect();
-        assert!(litter.is_empty(), "no stage litter on failure: {litter:?}");
-    }
-
-    /// The text flush goes through the mode-preserving atomic writer: a
-    /// `0600` lockfile keeps its bits across the revert (the plain writer
-    /// would swap in a fresh umask-mode inode).
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn flush_keeps_the_lockfile_mode() {
-        use std::os::unix::fs::PermissionsExt;
-        let dir = TempDir::new().unwrap();
-        write(dir.path(), "composer.lock", "https://patch.example/a\n").await;
-        let path = dir.path().join("composer.lock");
-        std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o600)).unwrap();
-        let mut state = state_with(
-            vec![edit(
-                "composer.lock",
-                "redirect_composer_dist",
-                "rewritten",
-                Some("https://upstream.example/a"),
-                Some("https://patch.example/a"),
-            )],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted(), "{:?}", out.refusals);
-        assert_eq!(
-            read(dir.path(), "composer.lock").await,
-            "https://upstream.example/a\n"
-        );
-        assert_eq!(
-            std::fs::metadata(&path).unwrap().permissions().mode() & 0o777,
-            0o600,
-            "the lockfile's mode must survive the atomic rewrite"
-        );
-    }
-
-    /// A Hatch document already at its recorded original (an interrupted
-    /// earlier revert, or a hand-fix) retires its ledger edit without a
-    /// byte-identical rewrite or an `editedFiles` credit — the same rule the
-    /// PipenvEntry and ReplaceFragment arms follow.
-    #[tokio::test]
-    async fn hatch_document_already_at_original_retires_without_a_write() {
-        let original = "[project]\nname = \"app\"\ndependencies = [\"one==1\"]\n";
-        let redirected =
-            "[project]\nname = \"app\"\ndependencies = [\"one @ https://patch.example/one.whl\"]\n";
-        let dir = TempDir::new().unwrap();
-        write(dir.path(), "pyproject.toml", original).await;
-        let mut state = state_with(
-            vec![edit(
-                "pyproject.toml",
-                "redirect_hatch_document",
-                "rewritten",
-                Some(original),
-                Some(redirected),
-            )],
-            &[],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted(), "{:?}", out.refusals);
-        assert!(
-            out.reverted_files.is_empty(),
-            "nothing was written: {out:?}"
-        );
-        assert!(state.edits.is_empty(), "the edit still retires");
-        assert_eq!(read(dir.path(), "pyproject.toml").await, original);
-    }
-
-    // ---------- record hold/drop per purl ecosystem ----------
-
-    #[tokio::test]
-    async fn cargo_and_composer_records_drop_when_their_groups_replay_clean() {
-        let dir = TempDir::new().unwrap();
-        write(
-            dir.path(),
-            "Cargo.lock",
-            "source = \"sparse+https://patch.example/\"\n",
-        )
-        .await;
-        write(dir.path(), "composer.lock", "https://patch.example/a\n").await;
-        let mut state = state_with(
-            vec![
-                edit(
-                    "Cargo.lock",
-                    "redirect_cargo_lock_entry",
-                    "rewritten",
-                    Some("source = \"registry+https://github.com/rust-lang/crates.io-index\""),
-                    Some("source = \"sparse+https://patch.example/\""),
-                ),
-                edit(
-                    "composer.lock",
-                    "redirect_composer_dist",
-                    "rewritten",
-                    Some("https://upstream.example/a"),
-                    Some("https://patch.example/a"),
-                ),
-            ],
-            &["pkg:cargo/cfg-if@1.0.0", "pkg:composer/a/b@1"],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert!(out.fully_reverted(), "{:?}", out.refusals);
-        assert_eq!(
-            out.dropped_records,
-            vec!["pkg:cargo/cfg-if@1.0.0", "pkg:composer/a/b@1"]
-        );
-        assert!(state.records.is_empty());
-        assert!(state.edits.is_empty());
-    }
-
-    #[tokio::test]
-    async fn nuget_and_unknown_ecosystem_records_are_held_by_their_refusals() {
-        let dir = TempDir::new().unwrap();
-        write(dir.path(), "packages.lock.json", "{}\n").await;
-        let mut state = state_with(
-            vec![
-                edit(
-                    "packages.lock.json",
-                    "redirect_nuget_lock",
-                    "rewritten",
-                    Some("a"),
-                    Some("b"),
-                ),
-                edit(
-                    "f",
-                    "redirect_future_thing",
-                    "rewritten",
-                    Some("a"),
-                    Some("b"),
-                ),
-            ],
-            &["pkg:nuget/A@1", "pkg:hex/x@1"],
-        );
-        let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-        assert_eq!(out.refusals.len(), 2, "{out:?}");
-        assert!(
-            state.records.contains_key("pkg:nuget/A@1"),
-            "a nuget record must be held while its Unsupported edits refuse"
-        );
-        assert!(
-            state.records.contains_key("pkg:hex/x@1"),
-            "an unknown-ecosystem record is tied to the reserved unknown group"
-        );
-        assert!(out.dropped_records.is_empty());
-        assert_eq!(state.edits.len(), 2);
-    }
-
-    // ---------- remove_fragment_once unit pins ----------
-
-    #[test]
-    fn remove_fragment_once_keeps_crlf_separators_straight() {
-        assert_eq!(
-            remove_fragment_once("[net]\r\nretry = 2\r\n\r\nF\r\nG\r\n", "F\r\nG\r\n"),
-            "[net]\r\nretry = 2\r\n"
-        );
-        assert_eq!(
-            remove_fragment_once("a\r\n\r\nF\r\n\r\nb\r\n", "F\r\n"),
-            "a\r\n\r\nb\r\n"
-        );
-    }
-
-    #[test]
-    fn remove_appended_cargo_block_inverts_exactly_what_was_appended() {
-        let block = "[registries.r]\nindex = \"i\"\n";
-        for (written, fragment, want) in [
-            // Empty config: the block alone (a created file ends empty).
-            (block.to_string(), block.to_string(), ""),
-            // One separator after a config ending in newline(s).
-            (format!("a\n\n{block}"), block.to_string(), "a\n"),
-            (format!("a\n\n\n{block}"), block.to_string(), "a\n\n"),
-            // No final newline: the added newline rides in the fragment.
-            (format!("a\n\n{block}"), format!("\n{block}"), "a"),
-            // The user appended after the block: kept.
-            (
-                format!("a\n\n{block}b = 1\n"),
-                block.to_string(),
-                "a\nb = 1\n",
-            ),
-            // CRLF file, and a CRLF-recorded fragment against an LF file.
-            (
-                format!("a\r\n\r\n{}", block.replace('\n', "\r\n")),
-                block.replace('\n', "\r\n"),
-                "a\r\n",
-            ),
-            (format!("a\n\n{block}"), block.replace('\n', "\r\n"), "a\n"),
-            (
-                format!("a\r\n\r\n{}", block.replace('\n', "\r\n")),
-                block.to_string(),
-                "a\r\n",
-            ),
-        ] {
-            assert_eq!(
-                remove_appended_cargo_block(&written, &fragment).as_deref(),
-                Some(want),
-                "{written:?}"
-            );
-        }
-        assert_eq!(remove_appended_cargo_block("a\n", block), None);
-    }
-
-    #[test]
-    fn remove_fragment_once_absent_fragment_is_identity() {
-        // Defensive edge: callers check contains() first, so the not-found
-        // arm must be a pure no-op if that invariant ever breaks.
-        assert_eq!(remove_fragment_once("a\nb\n", "zzz"), "a\nb\n");
-    }
-
-    #[test]
-    fn remove_fragment_once_sole_content_collapses_to_empty() {
-        // EOF removal of the only content: the trailing-separator collapse
-        // must yield an empty file, not a lone newline.
-        assert_eq!(remove_fragment_once("F\n", "F"), "");
-        assert_eq!(remove_fragment_once("\nF\n", "F"), "");
-    }
-    #[tokio::test]
-    async fn pipenv_replay_restores_categories_and_refuses_drift_atomically() {
-        use crate::patch::redirect::{rewrite_registry_redirect, DepOverride};
-        let dep: DepOverride=serde_json::from_value(serde_json::json!({"ecosystem":"pypi","name":"urllib3","version":"1.26.18","patchUuid":"one","token":"token","artifactUrl":"https://patch.socket.dev/patch/pypi/urllib3/1.26.18/token/one/urllib3-1.26.18-py3-none-any.whl","integrity":{"sha256":"a".repeat(64)}})).unwrap();
-        let original="{\"_meta\":{\"pipfile-spec\":6},\"default\":{\"urllib3\":{\"version\":\"==1.26.18\"}},\"tests\":{\"urllib3\":{\"version\":\"==1.26.18\"}}}";
-        let result = rewrite_registry_redirect(
-            &BTreeMap::from([("Pipfile.lock".into(), original.into())]),
-            &[dep],
-        );
-        for drift in [false, true] {
-            let dir = TempDir::new().unwrap();
-            let text = result.files["Pipfile.lock"].clone();
-            // Drift = the REFERENCE itself changed (its `#sha256=` pin here);
-            // a hashes-only change next to an intact reference is what a
-            // Pipenv relock does and rolls back (see pipenv::restore).
-            let live = if drift {
-                text.replacen("#sha256=", "#sha256=0", 1)
-            } else {
-                text
-            };
-            write(dir.path(), "Pipfile.lock", &live).await;
-            let mut state = state_with(result.edits.clone(), &["pkg:pypi/urllib3@1.26.18"]);
-            let before = state.edits.len();
-            let preview = revert_remaining_redirect_edits(dir.path(), &mut state, true).await;
-            assert_eq!(preview.fully_reverted(), !drift);
-            assert_eq!(read(dir.path(), "Pipfile.lock").await, live);
-            assert_eq!(state.edits.len(), before);
-            let outcome = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-            assert_eq!(outcome.fully_reverted(), !drift);
-            assert_eq!(
-                read(dir.path(), "Pipfile.lock").await,
-                if drift { live.as_str() } else { original }
-            );
-            assert_eq!(state.edits.is_empty(), !drift);
-        }
-    }
-}
diff --git a/crates/socket-patch-core/src/patch/redirect/requirements.rs b/crates/socket-patch-core/src/patch/redirect/requirements.rs
index 5e0b921c..d6d64c3c 100644
--- a/crates/socket-patch-core/src/patch/redirect/requirements.rs
+++ b/crates/socket-patch-core/src/patch/redirect/requirements.rs
@@ -7,14 +7,14 @@ use super::{DepOverride, FileEdit, RewriteResult, RewriteWarning};
 use crate::crawlers::python_crawler::canonicalize_pypi_name;
 use crate::utils::purl::percent_decode_purl_component;
 
-struct LogicalRequirement {
-    original: String,
-    text: String,
-    ending: String,
-    unterminated: bool,
+pub(super) struct LogicalRequirement {
+    pub(super) original: String,
+    pub(super) text: String,
+    pub(super) ending: String,
+    pub(super) unterminated: bool,
 }
 
-fn logical_requirements(content: &str) -> Vec<LogicalRequirement> {
+pub(super) fn logical_requirements(content: &str) -> Vec<LogicalRequirement> {
     let physical: Vec<&str> = content.split_inclusive('\n').collect();
     let mut requirements = Vec::new();
     let mut index = 0;
@@ -62,7 +62,7 @@ fn logical_requirements(content: &str) -> Vec<LogicalRequirement> {
     requirements
 }
 
-fn unquoted_index(text: &str, target: char, after_whitespace: bool) -> Option<usize> {
+pub(super) fn unquoted_index(text: &str, target: char, after_whitespace: bool) -> Option<usize> {
     let mut quote = None;
     let mut escaped = false;
     let mut previous = None;
@@ -87,7 +87,7 @@ fn unquoted_index(text: &str, target: char, after_whitespace: bool) -> Option<us
     None
 }
 
-fn requirement_tokens(text: &str) -> Vec<&str> {
+pub(super) fn requirement_tokens(text: &str) -> Vec<&str> {
     let mut tokens = Vec::new();
     let mut start = None;
     let mut quote = None;
diff --git a/crates/socket-patch-core/src/patch/redirect/staged.rs b/crates/socket-patch-core/src/patch/redirect/staged.rs
index cb344496..d5767557 100644
--- a/crates/socket-patch-core/src/patch/redirect/staged.rs
+++ b/crates/socket-patch-core/src/patch/redirect/staged.rs
@@ -33,22 +33,6 @@ pub(super) async fn read_rel(project_root: &Path, rel: &str) -> Result<Option<St
     }
 }
 
-/// Read a project file through the staged writes, so each unwind step sees
-/// what the earlier steps decided. Both the re-redirect chain (a step's
-/// `original` is the previous step's `new`) and the cargo registry block's
-/// still-referenced probe depend on that view, and neither may depend on the
-/// bytes having landed.
-pub(super) async fn staged_read(
-    staged: &Staged,
-    project_root: &Path,
-    rel: &str,
-) -> Result<Option<String>, String> {
-    match staged.get(rel) {
-        Some(pending) => Ok(pending.clone()),
-        None => read_rel(project_root, rel).await,
-    }
-}
-
 /// Commit the staged files. Only reached once every inverse resolved, so a
 /// drift refusal never gets here; an I/O fault partway through is the one
 /// remaining way to stop mid-set, and it surfaces as `Err` naming the path
diff --git a/crates/socket-patch-core/src/patch/redirect/state.rs b/crates/socket-patch-core/src/patch/redirect/state.rs
index d5a2da88..6d1b2f5d 100644
--- a/crates/socket-patch-core/src/patch/redirect/state.rs
+++ b/crates/socket-patch-core/src/patch/redirect/state.rs
@@ -1,18 +1,11 @@
-//! The hosted-mode ledger (`.socket/vendor/redirect-state.json`), written by
-//! hosted-mode `scan` (the default mode; also `--mode hosted` / the legacy
-//! `--redirect`).
+//! The retired pre-v5 hosted-mode ledger (`.socket/vendor/redirect-state.json`).
 //!
-//! Mirrors the vendor `state.json` shape but records a REMOTE per-dependency
-//! redirect (no local artifact bytes). It carries the recorded [`FileEdit`]s
-//! (which `rollback` and the hosted→vendored takeover replay in reverse to
-//! restore the pre-redirect files) plus, per redirected PURL, the manifest
-//! [`PatchRecord`] (file hashes + vulnerability metadata) so a post-install
-//! `socket-patch vex` can attest the redirected patches against the installed
-//! tree exactly as it does for `apply` / `vendor`. VEX folds `records`
-//! into its record view (keyed by PURL, the same key the manifest uses) —
-//! but only while the lockfile still wires each record's patch (the
-//! CLI's `commands::vex_sources` liveness gate): a stale ledger alone never
-//! attests.
+//! socket-patch v5 derives hosted state from the lockfiles (see
+//! `upstream::HostedPin` / `vex::discover`) and never writes this file. It
+//! is read only for migration: `list` and `vex` may borrow a record's patch
+//! details (vulnerabilities, file hashes) for a pin that is still wired in a
+//! lockfile, and `rollback` / `remove` delete it once no hosted pin remains.
+//! Its recorded edits are never replayed.
 
 use std::collections::BTreeMap;
 use std::path::{Path, PathBuf};
@@ -20,11 +13,10 @@ use std::path::{Path, PathBuf};
 use serde::{Deserialize, Serialize};
 
 use super::FileEdit;
-use crate::constants::SOCKET_DIR;
 use crate::manifest::schema::PatchRecord;
 use crate::utils::fs::read_regular_to_bytes;
-use crate::utils::purl::{canonical_purl, purl_name_version};
-use crate::utils::socket_dir::{remove_file_and_prune, write_json_ledger};
+
+use crate::utils::socket_dir::write_json_ledger;
 
 /// Repo-relative path of the redirect ledger.
 pub const REDIRECT_STATE_REL: &str = ".socket/vendor/redirect-state.json";
@@ -65,71 +57,6 @@ impl RedirectState {
         }
     }
 
-    /// The stored record keys whose canonical purl (qualifiers stripped,
-    /// percent-decoded — [`canonical_purl`]) matches `purl`, in ledger
-    /// order. Normally zero or one; a hand-edited ledger may carry the same
-    /// package under two spellings, and every caller must drop them all.
-    pub(crate) fn record_keys_for(&self, purl: &str) -> Vec<String> {
-        let target = canonical_purl(purl);
-        self.records
-            .keys()
-            .filter(|k| canonical_purl(k) == target)
-            .cloned()
-            .collect()
-    }
-
-    /// The first `redirect_*` edit this release cannot classify (a newer
-    /// socket-patch's writer) whose `key`, `original` or `new` names
-    /// `<name>@<version>` at a package-name boundary. Anything that claims
-    /// that package's ledger data must refuse while one exists: dropping the
-    /// record or its known edits would strand the unknown one.
-    pub(crate) fn unclassified_edit_naming(&self, name: &str, version: &str) -> Option<&FileEdit> {
-        let needle = format!("{name}@{version}");
-        let scoped = name.starts_with('@');
-        let names = |v: &Option<serde_json::Value>| match v {
-            Some(serde_json::Value::String(s)) => names_at_boundary(s, &needle, scoped),
-            Some(other) => names_at_boundary(&other.to_string(), &needle, scoped),
-            None => false,
-        };
-        self.edits.iter().find(|e| {
-            is_unclassified_redirect_edit(e)
-                && (e
-                    .key
-                    .as_deref()
-                    .is_some_and(|k| names_at_boundary(k, &needle, scoped))
-                    || names(&e.original)
-                    || names(&e.new))
-        })
-    }
-}
-
-fn is_unclassified_redirect_edit(edit: &FileEdit) -> bool {
-    edit.kind.starts_with("redirect_")
-        && super::replay::is_unclassified_kind(&edit.kind, &edit.action)
-}
-
-fn is_name_char(c: char) -> bool {
-    c.is_ascii_alphanumeric() || matches!(c, '-' | '.' | '_')
-}
-
-/// Does `text` contain `needle` starting at a package-name boundary? A
-/// match glued to a longer name (`left-pad@…` for `pad@…`) or to a scope
-/// (`@scope/a@…` for an unscoped `a@…`) names a different package.
-fn names_at_boundary(text: &str, needle: &str, scoped: bool) -> bool {
-    text.match_indices(needle).any(|(at, _)| {
-        let before = &text[..at];
-        match before.chars().next_back() {
-            None => true,
-            Some('/') => {
-                scoped
-                    || !before[..before.len() - 1]
-                        .rsplit(|c: char| !(is_name_char(c) || c == '@'))
-                        .next()
-                        .is_some_and(|segment| segment.starts_with('@'))
-            }
-            Some(c) => !is_name_char(c),
-        }
-    })
 }
 
 impl Default for RedirectState {
@@ -138,65 +65,31 @@ impl Default for RedirectState {
     }
 }
 
-/// A redirect ledger that exists on disk but cannot be loaded (torn write,
-/// truncation, hand-editing gone wrong, or an unreadable file). The ledger is
-/// the ONLY store of the pre-redirect lockfile originals a future revert
-/// needs, so a loader that shrugged this off as "no ledger" would let the
-/// next hosted run start fresh and silently overwrite that revert data.
-/// Instead every load distinguishes absent (fine, fresh start) from malformed
-/// (this error), and the hosted writer refuses to proceed.
+/// A pre-v5 redirect ledger that exists on disk but cannot be loaded (torn
+/// write, truncation, hand-editing gone wrong, or an unreadable file). Every
+/// load distinguishes absent from malformed so read-only consumers can
+/// surface it (as the `redirect_ledger_corrupt` warning) instead of silently
+/// treating it as "no ledger".
 #[derive(Debug)]
 pub struct CorruptRedirectState {
     /// Absolute path of the malformed ledger.
     pub path: PathBuf,
     /// What went wrong reading/parsing it.
     pub detail: String,
-    /// Where [`CorruptRedirectState::quarantine`] moved the file, when it did.
-    pub quarantined_to: Option<PathBuf>,
     /// True when the ledger could not be READ (an I/O error, or a directory /
     /// FIFO squatting the path) rather than parsed. The bytes on disk may be
-    /// perfectly valid revert data — or not a file at all — so
-    /// [`CorruptRedirectState::quarantine`] leaves them where they are and the
-    /// message asks for the I/O problem to be fixed, not for JSON repair.
+    /// perfectly valid pre-v5 data — or not a file at all — so the message
+    /// asks for the I/O problem to be fixed, not for JSON repair.
     pub unreadable: bool,
 }
 
-impl CorruptRedirectState {
-    /// Move the malformed ledger aside to `redirect-state.json.corrupt` so no
-    /// later run can overwrite the revert data it may still hold. Never
-    /// clobbers an existing `.corrupt` file (an earlier quarantine may hold
-    /// older revert data); on any failure the original file simply stays put
-    /// — the caller's hard error already prevents overwriting it. An
-    /// UNREADABLE ledger is never moved: it is not known to be malformed.
-    ///
-    /// The quarantine file is the one sanctioned `.socket/vendor/` residue:
-    /// the empty-directory prunes are non-recursive and leave both it and the
-    /// directory in place until the user resolves it.
-    pub async fn quarantine(&mut self) {
-        if self.unreadable {
-            return;
-        }
-        let target = match self.path.parent() {
-            Some(parent) => parent.join("redirect-state.json.corrupt"),
-            None => return,
-        };
-        if !matches!(tokio::fs::try_exists(&target).await, Ok(false)) {
-            return;
-        }
-        if tokio::fs::rename(&self.path, &target).await.is_ok() {
-            self.quarantined_to = Some(target);
-        }
-    }
-}
-
 impl std::fmt::Display for CorruptRedirectState {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         if self.unreadable {
             return write!(
                 f,
-                "the redirect ledger {} cannot be read ({}); it may hold the \
-                 pre-redirect lockfile values a future revert needs, so it was \
-                 left in place and will not be overwritten. Fix the file's \
+                "the pre-v5 redirect ledger {} cannot be read ({}); it was left \
+                 in place. Fix the file's \
                  permissions (or move a stray directory or special file at that \
                  path aside), then re-run.",
                 self.path.display(),
@@ -205,39 +98,21 @@ impl std::fmt::Display for CorruptRedirectState {
         }
         write!(
             f,
-            "the redirect ledger {} is malformed ({}); it records the \
-             pre-redirect lockfile values a future revert needs, so it will \
-             not be overwritten. ",
+            "the pre-v5 redirect ledger {} is malformed ({}); socket-patch v5 \
+             only reads it for migration and never overwrites it. Repair its \
+             JSON or restore it from version control, or delete it if you no \
+             longer need its patch details.",
             self.path.display(),
             self.detail
-        )?;
-        match &self.quarantined_to {
-            Some(target) => write!(
-                f,
-                "The unreadable file was moved aside to {}; to recover, repair \
-                 its JSON and rename it back to redirect-state.json, or restore \
-                 the ledger and the rewritten files from version control. If \
-                 the revert data is expendable, delete the moved-aside file and \
-                 re-run.",
-                target.display()
-            ),
-            None => write!(
-                f,
-                "To recover, repair its JSON, restore it from version control, \
-                 or move it aside if the revert data is expendable, then re-run."
-            ),
-        }
+        )
     }
 }
 
 impl std::error::Error for CorruptRedirectState {}
 
 /// Load the redirect ledger. Missing → `Ok(None)` (a fresh start is fine).
-/// Present but unreadable/malformed → [`CorruptRedirectState`], so no caller
-/// can mistake a torn ledger for "no ledger" and overwrite the revert data it
-/// still holds (see the type's docs). Read-only consumers may degrade a
-/// malformed ledger to "nothing to consult", but must surface it; the hosted
-/// writer must abort.
+/// Present but unreadable/malformed → [`CorruptRedirectState`]. Consumers
+/// degrade a malformed ledger to "nothing to consult", but must surface it.
 ///
 /// The bytes come from the (untrusted) project tree through the FIFO-safe
 /// [`read_regular_to_bytes`] — non-blocking on Unix, rejecting FIFOs /
@@ -255,7 +130,6 @@ pub async fn load_redirect_state(
             return Err(CorruptRedirectState {
                 path,
                 detail: e.to_string(),
-                quarantined_to: None,
                 unreadable: true,
             });
         }
@@ -265,19 +139,15 @@ pub async fn load_redirect_state(
         Err(e) => Err(CorruptRedirectState {
             path,
             detail: format!("invalid JSON: {e}"),
-            quarantined_to: None,
             unreadable: false,
         }),
     }
 }
 
-/// Persist the redirect ledger atomically (stage + fsync + rename, the same
-/// hardened writer the sibling vendor ledger uses). A bare `fs::write`
-/// truncates the target first, so a crash or `ENOSPC` mid-write would tear
-/// the only store of the pre-redirect originals a future revert needs. A
-/// byte-identical ledger already on disk (an idempotent hosted re-run) is
-/// left untouched. Always a write, never a delete — see
-/// [`persist_redirect_state`] for the emptied-ledger rule.
+/// Write a redirect ledger atomically. socket-patch v5 never writes this
+/// file: this exists only so tests (and migration tooling) can lay down a
+/// pre-v5 ledger fixture in the exact on-disk shape older releases wrote.
+#[doc(hidden)]
 pub async fn save_redirect_state(
     project_root: &Path,
     state: &RedirectState,
@@ -285,166 +155,13 @@ pub async fn save_redirect_state(
     write_json_ledger(&project_root.join(REDIRECT_STATE_REL), state).await
 }
 
-/// Drop one PURL's superseded takeover leftovers from the ledger: its
-/// `records` entry (canonical-purl match, qualifiers stripped and
-/// percent-decoded) and every recorded edit keyed to that package. This is
-/// the npm-family half of the hosted→vendored takeover reconciliation: the
-/// vendored flows call it ONLY after the LIVE lockfile provably wires the
-/// package to the committed `.socket/vendor/` artifact and no longer
-/// resolves the hosted URL — at that point the vendor ledger's wiring
-/// `original` embeds the hosted-spliced lock fragment, so `vendor --revert`
-/// stays lossless without these ledger edits, and keeping them would feed
-/// VEX/updates stale records and re-fire the takeover warning on every
-/// later run. CARGO purls are refused (returns `false`, drops nothing): a
-/// cargo takeover must revert the hosted edits ON DISK first — that path is
-/// [`revert_cargo_redirect_purl`](super::revert_cargo_redirect_purl), which
-/// does its own ledger drop.
-///
-/// The edit matcher is ARTIFACT-ANCHORED, never name-anchored. An edit is
-/// claimed when either:
-///
-/// * its `new` content references THIS purl's hosted artifact — every hosted
-///   artifact URL embeds the patch uuid (on ANY patch-server host; the same
-///   invariant the takeover classifier's `redirect_record_live` proof rests
-///   on), and a uuid is hex-and-dashes so it spells identically raw,
-///   `\/`-escaped (old composer) and percent-encoded (yarn-berry
-///   `::__archiveUrl=`). The uuid(s) come from this purl's own `records`
-///   entry, captured before it is removed. This is what claims the
-///   version-blind key shapes: npm `node_modules/…` path keys, legacy
-///   `dependencies` bare-name keys, bun `<prefix>/<name>` keys.
-/// * (secondary guard, for when the record — and with it the artifact URL —
-///   is unavailable) its key is a VERSION-EXACT instance key:
-///   `"name@version"`, pnpm v6 peer-suffixed `"name@version(peer…)"`, or the
-///   pnpm-v5 respelling `"name@version_peer…"`.
-///
-/// Never claim by NAME alone (`key == name`, key ends with `"/name"`): with
-/// two versions of one package hosted, vendoring one would delete BOTH
-/// versions' path-keyed edits, destroying the other version's revert
-/// originals. Version-blind keys with no artifact anchor are KEPT (fail-closed — they may be the other version's
-/// only revert data). Consequence for the CLI's takeover-overlap fallback
-/// matcher (which still matches edit keys by bare name, but ONLY when
-/// `records` is empty — the degraded record-fetch-failed ledger): a normal
-/// record-carrying ledger reconciles fully here (the record removal alone
-/// ends the overlap), while a degraded ledger's unattributable path-keyed
-/// edits stay and its takeover warning keeps advising the manual per-package
-/// cleanup — the correct outcome when the ledger lacks the records needed to
-/// attribute edits to a version safely.
-///
-/// Edits that are not package-keyed (e.g. the pnpm workspace-trust edit,
-/// keyed `"trustLockfile"`) stay: they belong to the hosted flow's own
-/// config surface and other still-redirected package(s) may ride on them.
-///
-/// A `redirect_*` edit kind this release cannot classify that names the
-/// purl or would be claimed by the rules above drops nothing and returns
-/// `false`: its lockfile may still resolve the hosted artifact.
-///
-/// Returns whether anything was removed. The caller persists the mutated
-/// ledger via [`persist_redirect_state`] (atomic; an emptied ledger is
-/// deleted).
-pub fn drop_superseded_purl(state: &mut RedirectState, purl: &str) -> bool {
-    let target = canonical_purl(purl);
-    if target.starts_with("pkg:cargo/") {
-        return false;
-    }
-    let Some((name, version)) = purl_name_version(&target) else {
-        return false;
-    };
-    let (name, version) = (name.to_string(), version.to_string());
-
-    if state.unclassified_edit_naming(&name, &version).is_some() {
-        return false;
-    }
-
-    let record_keys = state.record_keys_for(purl);
-    // THIS purl's patch uuid(s), captured before the records are removed —
-    // the artifact anchor (see the doc comment). Distinct purls (including
-    // two versions of one package) carry distinct patch uuids, so a uuid
-    // match is version-exact by construction.
-    let uuids: Vec<String> = record_keys
-        .iter()
-        .filter_map(|k| state.records.get(k))
-        .map(|r| r.uuid.clone())
-        // An empty uuid (hand-repaired or degraded ledger) is no anchor at
-        // all: `contains("")` matches EVERY edit, claiming other packages'
-        // revert data. Fail closed to the version-exact-only path instead.
-        .filter(|u| !u.is_empty())
-        .collect();
-
-    let name_at_version = format!("{name}@{version}");
-    let claims = |e: &FileEdit| {
-        let Some(key) = e.key.as_deref() else {
-            // No key ⇒ not attributable to any package; keep.
-            return false;
-        };
-        // Version-exact instance keys: `name@version`, pnpm v6 peer-suffixed
-        // `name@version(peer…)`, pnpm v5 respelled `name@version_peer…`, vlt
-        // peer/modifier variants `name@version~extra`.
-        let version_exact = key == name_at_version
-            || key
-                .strip_prefix(name_at_version.as_str())
-                .is_some_and(|rest| rest.starts_with(['(', '_', '~']));
-        // Artifact anchor: the edit's rewritten (`new`) content references
-        // this purl's hosted artifact (its patch uuid — spelling-invariant
-        // across raw / `\/`-escaped / percent-encoded URL forms).
-        let anchored = !uuids.is_empty()
-            && e.new.as_ref().is_some_and(|new| {
-                // A text-fragment payload is probed in place; only an object
-                // payload (a whole JSON lock entry) needs re-serializing.
-                let text: std::borrow::Cow<'_, str> = match new {
-                    serde_json::Value::String(s) => std::borrow::Cow::Borrowed(s.as_str()),
-                    other => std::borrow::Cow::Owned(other.to_string()),
-                };
-                uuids.iter().any(|uuid| text.contains(uuid.as_str()))
-            });
-        version_exact || anchored
-    };
-    if state
-        .edits
-        .iter()
-        .any(|e| is_unclassified_redirect_edit(e) && claims(e))
-    {
-        return false;
-    }
-
-    for key in &record_keys {
-        state.records.remove(key);
-    }
-    let edits_before = state.edits.len();
-    state.edits.retain(|e| !claims(e));
-
-    !record_keys.is_empty() || state.edits.len() != edits_before
-}
-
-/// Persist the redirect ledger via [`save_redirect_state`]'s atomic writer.
-/// An EMPTY ledger (no edits, no records) is DELETED instead: a residual
-/// empty file would keep takeover-overlap detection and VEX reading a ledger
-/// that asserts nothing. The delete then prunes a now-empty `.socket/vendor/`
-/// (best-effort, non-recursive — the vendor ledger, artifacts or a `.corrupt`
-/// quarantine keep it), so a fully unwound hosted project leaves no residue
-/// below `.socket/` itself, which the lock guard owns. A failed unlink
-/// propagates before any prune.
-pub async fn persist_redirect_state(
-    project_root: &Path,
-    state: &RedirectState,
-) -> std::io::Result<()> {
-    if state.edits.is_empty() && state.records.is_empty() {
-        return remove_file_and_prune(
-            &project_root.join(REDIRECT_STATE_REL),
-            &project_root.join(SOCKET_DIR),
-        )
-        .await;
-    }
-    save_redirect_state(project_root, state).await
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
     use crate::manifest::schema::{PatchFileInfo, PatchRecord, VulnerabilityInfo};
     use std::collections::HashMap;
 
-    /// The sample record's patch uuid — hosted artifact URLs embed it (the
-    /// artifact anchor `drop_superseded_purl` claims edits by).
+    /// The sample record's patch uuid.
     const SAMPLE_UUID: &str = "9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f";
 
     fn sample_record() -> PatchRecord {
@@ -481,12 +198,6 @@ mod tests {
         }
     }
 
-    /// The hosted artifact URL shape the patch server serves: the patch uuid
-    /// is a path segment, exactly the anchor `drop_superseded_purl` matches.
-    fn hosted_url(name: &str, version: &str, uuid: &str) -> String {
-        format!("https://patch.test/patch/npm/{name}/{version}/{uuid}/{name}-{version}.tgz")
-    }
-
     #[test]
     fn round_trips_records_through_json() {
         let mut state = RedirectState::new();
@@ -584,540 +295,6 @@ mod tests {
         assert_eq!(loaded.edits[1].kind, "redirect_kind_from_the_future");
     }
 
-    fn edit(path: &str, kind: &str, key: Option<&str>) -> FileEdit {
-        FileEdit {
-            path: path.to_string(),
-            kind: kind.to_string(),
-            action: "rewritten".to_string(),
-            key: key.map(str::to_string),
-            original: Some(serde_json::json!("orig")),
-            new: Some(serde_json::json!("new")),
-        }
-    }
-
-    /// An edit whose rewritten content points at a hosted artifact URL — the
-    /// shape the npm rewriter records (`new` = the spliced resolved/integrity
-    /// pair), carrying the artifact anchor.
-    fn edit_resolved(path: &str, kind: &str, key: &str, url: &str) -> FileEdit {
-        FileEdit {
-            path: path.to_string(),
-            kind: kind.to_string(),
-            action: "rewritten".to_string(),
-            key: Some(key.to_string()),
-            original: Some(serde_json::json!({
-                "resolved": "https://registry.npmjs.org/upstream.tgz",
-                "integrity": "sha512-UPSTREAM=="
-            })),
-            new: Some(serde_json::json!({ "resolved": url, "integrity": "sha512-P==" })),
-        }
-    }
-
-    /// The takeover reconciliation drops exactly the superseded package's
-    /// halves — its `records` entry and every edit keyed to it (pnpm
-    /// `name@version`, pnpm v6 peer-suffixed and v5 `_`-suffixed instances,
-    /// npm `node_modules/…` paths whose rewritten content carries this purl's
-    /// hosted artifact) — while other packages' data and non-package-keyed
-    /// edits (the pnpm workspace-trust edit) survive verbatim.
-    #[test]
-    fn drop_superseded_purl_removes_both_halves_and_only_them() {
-        let mut state = RedirectState::new();
-        state
-            .records
-            .insert("pkg:npm/left-pad@1.3.0".to_string(), sample_record());
-        state
-            .records
-            .insert("pkg:npm/minimist@1.2.2".to_string(), sample_record());
-        state.edits = vec![
-            edit(
-                "pnpm-lock.yaml",
-                "redirect_pnpm_resolution",
-                Some("left-pad@1.3.0"),
-            ),
-            // pnpm v6 peer-suffixed instance key for the SAME package.
-            edit(
-                "pnpm-lock.yaml",
-                "redirect_pnpm_resolution",
-                Some("left-pad@1.3.0(react@18.2.0)"),
-            ),
-            // pnpm v5 `_`-suffixed instance key (the rewriter's own respelled
-            // `/left-pad/1.3.0_react@18.2.0` key) for the same package.
-            edit(
-                "pnpm-lock.yaml",
-                "redirect_pnpm_resolution",
-                Some("left-pad@1.3.0_react@18.2.0"),
-            ),
-            // npm nested node_modules path for the same package: the key is
-            // version-blind, so the claim rides the artifact anchor in `new`.
-            edit_resolved(
-                "package-lock.json",
-                "redirect_npm_lock_entry",
-                "node_modules/a/node_modules/left-pad",
-                &hosted_url("left-pad", "1.3.0", SAMPLE_UUID),
-            ),
-            // Another package's edit — must survive.
-            edit(
-                "pnpm-lock.yaml",
-                "redirect_pnpm_resolution",
-                Some("minimist@1.2.2"),
-            ),
-            // Non-package-keyed workspace-trust edit — must survive.
-            edit(
-                "pnpm-workspace.yaml",
-                "redirect_pnpm_workspace_trust",
-                Some("trustLockfile"),
-            ),
-        ];
-
-        assert!(drop_superseded_purl(&mut state, "pkg:npm/left-pad@1.3.0"));
-
-        assert!(
-            !state.records.contains_key("pkg:npm/left-pad@1.3.0"),
-            "the superseded record must be dropped"
-        );
-        assert!(
-            state.records.contains_key("pkg:npm/minimist@1.2.2"),
-            "other packages' records must survive"
-        );
-        let keys: Vec<&str> = state
-            .edits
-            .iter()
-            .filter_map(|e| e.key.as_deref())
-            .collect();
-        assert_eq!(
-            keys,
-            vec!["minimist@1.2.2", "trustLockfile"],
-            "only the superseded package's edits may be dropped: {keys:?}"
-        );
-
-        // Idempotent: a second drop finds nothing and reports it.
-        assert!(!drop_superseded_purl(&mut state, "pkg:npm/left-pad@1.3.0"));
-    }
-
-    /// TWO versions of one package hosted at once: dropping the vendored one
-    /// must not touch the other version's halves. The npm path keys
-    /// (`node_modules/…/left-pad`) and legacy `dependencies` bare-name keys
-    /// carry NO version, so a name-anchored matcher would claim BOTH
-    /// versions' edits here — destroying left-pad@2.0.0's pre-redirect
-    /// originals (its only revert data) when left-pad@1.3.0 was vendored.
-    /// Only edits whose rewritten content references the dropped purl's own
-    /// hosted artifact go.
-    #[test]
-    fn drop_superseded_purl_never_claims_the_other_hosted_versions_edits() {
-        const UUID_V2: &str = "1a2b3c4d-5e6f-4a1b-8c2d-0f9e8d7c6b5a";
-        let url_v1 = hosted_url("left-pad", "1.3.0", SAMPLE_UUID);
-        let url_v2 = hosted_url("left-pad", "2.0.0", UUID_V2);
-        let mut state = RedirectState::new();
-        state
-            .records
-            .insert("pkg:npm/left-pad@1.3.0".to_string(), sample_record());
-        state.records.insert(
-            "pkg:npm/left-pad@2.0.0".to_string(),
-            record_with_uuid(UUID_V2),
-        );
-        state.edits = vec![
-            // v1's edits: a version-blind path key (anchored via `new`) and
-            // a version-exact pnpm key.
-            edit_resolved(
-                "package-lock.json",
-                "redirect_npm_lock_entry",
-                "node_modules/left-pad",
-                &url_v1,
-            ),
-            edit(
-                "pnpm-lock.yaml",
-                "redirect_pnpm_resolution",
-                Some("left-pad@1.3.0"),
-            ),
-            // v2's edits: a nested path key, a legacy bare-name key, and a
-            // version-exact pnpm key — ALL must survive dropping v1.
-            edit_resolved(
-                "package-lock.json",
-                "redirect_npm_lock_entry",
-                "node_modules/a/node_modules/left-pad",
-                &url_v2,
-            ),
-            edit_resolved(
-                "package-lock.json",
-                "redirect_npm_lock_dep",
-                "left-pad",
-                &url_v2,
-            ),
-            edit(
-                "pnpm-lock.yaml",
-                "redirect_pnpm_resolution",
-                Some("left-pad@2.0.0"),
-            ),
-        ];
-
-        assert!(drop_superseded_purl(&mut state, "pkg:npm/left-pad@1.3.0"));
-
-        assert!(
-            !state.records.contains_key("pkg:npm/left-pad@1.3.0"),
-            "the vendored version's record must be dropped"
-        );
-        assert!(
-            state.records.contains_key("pkg:npm/left-pad@2.0.0"),
-            "the still-hosted version's record must survive"
-        );
-        let keys: Vec<&str> = state
-            .edits
-            .iter()
-            .filter_map(|e| e.key.as_deref())
-            .collect();
-        assert_eq!(
-            keys,
-            vec![
-                "node_modules/a/node_modules/left-pad",
-                "left-pad",
-                "left-pad@2.0.0"
-            ],
-            "the other hosted version's edits are its only revert data and \
-             must survive verbatim: {keys:?}"
-        );
-    }
-
-    /// A DEGRADED ledger (record fetch failed: `records` empty, edits only)
-    /// offers no artifact anchor. The secondary guard must stay version-exact
-    /// — `name@version` plus the `(`/`_` instance suffixes — and version-blind
-    /// path/bare-name keys must be KEPT (they cannot be attributed to a
-    /// version, and dropping them could destroy another version's revert
-    /// originals). Fail closed: leftover keys mean the takeover warning's
-    /// manual advisory keeps firing, which is the correct degraded outcome.
-    #[test]
-    fn drop_superseded_purl_without_a_record_claims_only_version_exact_keys() {
-        let mut state = RedirectState::new();
-        state.edits = vec![
-            edit(
-                "pnpm-lock.yaml",
-                "redirect_pnpm_resolution",
-                Some("left-pad@1.3.0"),
-            ),
-            edit(
-                "pnpm-lock.yaml",
-                "redirect_pnpm_resolution",
-                Some("left-pad@1.3.0_react@18.2.0"),
-            ),
-            edit(
-                "pnpm-lock.yaml",
-                "redirect_pnpm_resolution",
-                Some("left-pad@1.3.0(react@18.2.0)"),
-            ),
-            // A LONGER version sharing the prefix: `1.3.0` must not claim
-            // `1.3.01`'s instances (the `_`/`(` boundary is load-bearing).
-            edit(
-                "pnpm-lock.yaml",
-                "redirect_pnpm_resolution",
-                Some("left-pad@1.3.01_react@18.2.0"),
-            ),
-            // Version-blind keys: unattributable without the anchor — keep.
-            edit_resolved(
-                "package-lock.json",
-                "redirect_npm_lock_entry",
-                "node_modules/left-pad",
-                "https://patch.test/no-uuid-here/left-pad-1.3.0.tgz",
-            ),
-            edit_resolved(
-                "package-lock.json",
-                "redirect_npm_lock_dep",
-                "left-pad",
-                "https://patch.test/no-uuid-here/left-pad-1.3.0.tgz",
-            ),
-        ];
-
-        assert!(drop_superseded_purl(&mut state, "pkg:npm/left-pad@1.3.0"));
-
-        let keys: Vec<&str> = state
-            .edits
-            .iter()
-            .filter_map(|e| e.key.as_deref())
-            .collect();
-        assert_eq!(
-            keys,
-            vec![
-                "left-pad@1.3.01_react@18.2.0",
-                "node_modules/left-pad",
-                "left-pad"
-            ],
-            "without an artifact anchor only version-exact instance keys may \
-             be claimed: {keys:?}"
-        );
-    }
-
-    fn future_lock_edit(name: &str, version: &str, url: &str) -> FileEdit {
-        FileEdit {
-            path: "future.lock".to_string(),
-            kind: "redirect_future_lock_entry".to_string(),
-            action: "rewritten".to_string(),
-            key: Some(format!("{name}@{version}")),
-            original: Some(serde_json::json!(format!("{name}@{version} sha512-r"))),
-            new: Some(serde_json::json!(format!("{name}@{version} {url}"))),
-        }
-    }
-
-    #[test]
-    fn drop_superseded_purl_drops_nothing_beside_an_unclassified_edit_naming_it() {
-        let url = hosted_url("left-pad", "1.3.0", SAMPLE_UUID);
-        let unanchored = hosted_url("left-pad", "1.3.0", "0e0e0e0e-0000-4000-8000-000000000000");
-        for (with_record, future_key, future_url) in [
-            (true, "left-pad@1.3.0", url.as_str()),
-            (false, "left-pad@1.3.0", url.as_str()),
-            (false, "left-pad@1.3.0~custom", unanchored.as_str()),
-        ] {
-            let mut state = RedirectState::new();
-            if with_record {
-                state
-                    .records
-                    .insert("pkg:npm/left-pad@1.3.0".to_string(), sample_record());
-            }
-            state.edits = vec![
-                edit_resolved(
-                    "yarn.lock",
-                    "redirect_yarn_classic_entry",
-                    "left-pad@1.3.0",
-                    &url,
-                ),
-                FileEdit {
-                    key: Some(future_key.to_string()),
-                    ..future_lock_edit("left-pad", "1.3.0", future_url)
-                },
-            ];
-            let before = serde_json::to_value(&state).unwrap();
-            assert!(!drop_superseded_purl(&mut state, "pkg:npm/left-pad@1.3.0"));
-            assert_eq!(
-                serde_json::to_value(&state).unwrap(),
-                before,
-                "{with_record} {future_key}"
-            );
-        }
-    }
-
-    #[test]
-    fn drop_superseded_purl_drops_nothing_when_an_unclassified_edit_is_anchored() {
-        let mut state = RedirectState::new();
-        state
-            .records
-            .insert("pkg:npm/left-pad@1.3.0".to_string(), sample_record());
-        state.edits = vec![FileEdit {
-            key: Some("nodes/0".to_string()),
-            ..edit_resolved(
-                "future.lock",
-                "redirect_future_lock_entry",
-                "unused",
-                &hosted_url("left-pad", "1.3.0", SAMPLE_UUID),
-            )
-        }];
-        let before = serde_json::to_value(&state).unwrap();
-        assert!(!drop_superseded_purl(&mut state, "pkg:npm/left-pad@1.3.0"));
-        assert_eq!(serde_json::to_value(&state).unwrap(), before);
-    }
-
-    #[test]
-    fn drop_superseded_purl_ignores_an_unclassified_edit_for_another_package() {
-        let mut state = RedirectState::new();
-        state
-            .records
-            .insert("pkg:npm/pad@1.3.0".to_string(), sample_record());
-        state.edits = vec![
-            edit(
-                "pnpm-lock.yaml",
-                "redirect_pnpm_resolution",
-                Some("pad@1.3.0"),
-            ),
-            future_lock_edit(
-                "left-pad",
-                "1.3.0",
-                &hosted_url("left-pad", "1.3.0", "0e0e0e0e-0000-4000-8000-000000000000"),
-            ),
-            future_lock_edit(
-                "@scope/pad",
-                "1.3.0",
-                &hosted_url(
-                    "@scope/pad",
-                    "1.3.0",
-                    "1e1e1e1e-0000-4000-8000-000000000000",
-                ),
-            ),
-        ];
-        assert!(drop_superseded_purl(&mut state, "pkg:npm/pad@1.3.0"));
-        assert!(state.records.is_empty());
-        let kinds: Vec<&str> = state.edits.iter().map(|e| e.kind.as_str()).collect();
-        assert_eq!(
-            kinds,
-            ["redirect_future_lock_entry", "redirect_future_lock_entry"]
-        );
-    }
-
-    #[test]
-    fn drop_superseded_purl_claims_vlt_variant_keys() {
-        let mut state = RedirectState::new();
-        state.edits = vec![
-            edit(
-                "vlt-lock.json",
-                "redirect_vlt_lock_node",
-                Some("left-pad@1.3.0"),
-            ),
-            edit(
-                "vlt-lock.json",
-                "redirect_vlt_lock_node",
-                Some("left-pad@1.3.0~peer.0df72515a50372ba"),
-            ),
-            edit(
-                "vlt-lock.json",
-                "redirect_vlt_lock_node",
-                Some("left-pad@1.3.0-rc.1~peer.1"),
-            ),
-        ];
-        assert!(drop_superseded_purl(&mut state, "pkg:npm/left-pad@1.3.0"));
-        let keys: Vec<&str> = state
-            .edits
-            .iter()
-            .filter_map(|e| e.key.as_deref())
-            .collect();
-        assert_eq!(keys, ["left-pad@1.3.0-rc.1~peer.1"]);
-    }
-
-    /// A version-boundary key (`left-pad@1.3.10`) and a different package
-    /// whose name merely ends with the target's (`not-left-pad`) must never
-    /// be claimed — the `/`-boundary and `(`-boundary checks are load-bearing.
-    #[test]
-    fn drop_superseded_purl_respects_name_and_version_boundaries() {
-        let mut state = RedirectState::new();
-        state.edits = vec![
-            edit(
-                "pnpm-lock.yaml",
-                "redirect_pnpm_resolution",
-                Some("left-pad@1.3.10"),
-            ),
-            edit(
-                "package-lock.json",
-                "redirect_npm_lock_entry",
-                Some("node_modules/not-left-pad"),
-            ),
-        ];
-        assert!(!drop_superseded_purl(&mut state, "pkg:npm/left-pad@1.3.1"));
-        assert_eq!(state.edits.len(), 2, "no foreign edit may be claimed");
-    }
-
-    /// Scoped names: the record key may carry the percent-encoded API form
-    /// while the caller passes the canonical decoded purl; both halves must
-    /// still be claimed (the path-keyed edit via the artifact anchor its
-    /// rewritten content carries).
-    #[test]
-    fn drop_superseded_purl_matches_percent_encoded_scoped_records() {
-        let mut state = RedirectState::new();
-        state
-            .records
-            .insert("pkg:npm/%40scope%2Fpkg@1.0.0".to_string(), sample_record());
-        state.edits = vec![edit_resolved(
-            "package-lock.json",
-            "redirect_npm_lock_entry",
-            "node_modules/@scope/pkg",
-            &hosted_url("%40scope%2Fpkg", "1.0.0", SAMPLE_UUID),
-        )];
-        assert!(drop_superseded_purl(&mut state, "pkg:npm/@scope/pkg@1.0.0"));
-        assert!(state.records.is_empty() && state.edits.is_empty());
-    }
-
-    /// Cargo purls are refused: their takeover must revert the hosted edits
-    /// ON DISK first (`revert_cargo_redirect_purl`), so a bare ledger drop
-    /// would destroy the only revert data. Fail closed by dropping nothing.
-    #[test]
-    fn drop_superseded_purl_refuses_cargo() {
-        let mut state = RedirectState::new();
-        state
-            .records
-            .insert("pkg:cargo/cfg-if@1.0.4".to_string(), sample_record());
-        state.edits = vec![edit(
-            "Cargo.lock",
-            "redirect_cargo_lock_entry",
-            Some("cfg-if@1.0.4"),
-        )];
-        assert!(!drop_superseded_purl(&mut state, "pkg:cargo/cfg-if@1.0.4"));
-        assert_eq!(state.records.len(), 1);
-        assert_eq!(state.edits.len(), 1);
-    }
-
-    /// A purl that cannot name one exact package instance — versionless
-    /// (`pkg:npm/left-pad`) or empty-named (`pkg:npm/@1.0.0`, whose only `@`
-    /// is at index 0) — is refused outright: nothing is dropped and `false`
-    /// is reported. Fail closed — without a `(name, version)` pair the
-    /// matcher could only claim by name, the exact over-deletion the
-    /// artifact anchor exists to prevent.
-    #[test]
-    fn drop_superseded_purl_unversioned_purl_drops_nothing() {
-        for bogus in ["pkg:npm/left-pad", "pkg:npm/@1.0.0"] {
-            let mut state = RedirectState::new();
-            state
-                .records
-                .insert("pkg:npm/left-pad@1.3.0".to_string(), sample_record());
-            state.edits = vec![edit(
-                "pnpm-lock.yaml",
-                "redirect_pnpm_resolution",
-                Some("left-pad@1.3.0"),
-            )];
-            assert!(
-                !drop_superseded_purl(&mut state, bogus),
-                "{bogus} names no exact instance and must report false"
-            );
-            assert_eq!(
-                state.records.len(),
-                1,
-                "{bogus} must drop no record (fail closed)"
-            );
-            assert_eq!(
-                state.edits.len(),
-                1,
-                "{bogus} must drop no edit (fail closed)"
-            );
-        }
-    }
-
-    /// An edit with NO key is not attributable to any package, so the retain
-    /// pass keeps it BEFORE consulting the artifact anchor — even when its
-    /// rewritten content happens to reference the dropped purl's own hosted
-    /// artifact. The documented fail-closed contract: a keyless edit may be
-    /// some other surface's only revert data, and keeping a stale edit is
-    /// recoverable where destroying revert originals is not.
-    #[test]
-    fn drop_superseded_purl_keeps_keyless_edits_even_when_anchored() {
-        let keyless = FileEdit {
-            path: "package-lock.json".to_string(),
-            kind: "redirect_npm_lock_entry".to_string(),
-            action: "rewritten".to_string(),
-            key: None,
-            original: Some(serde_json::json!("orig")),
-            new: Some(serde_json::json!({
-                "resolved": hosted_url("left-pad", "1.3.0", SAMPLE_UUID),
-                "integrity": "sha512-P=="
-            })),
-        };
-        let mut state = RedirectState::new();
-        state
-            .records
-            .insert("pkg:npm/left-pad@1.3.0".to_string(), sample_record());
-        state.edits = vec![
-            keyless.clone(),
-            edit(
-                "pnpm-lock.yaml",
-                "redirect_pnpm_resolution",
-                Some("left-pad@1.3.0"),
-            ),
-        ];
-
-        assert!(drop_superseded_purl(&mut state, "pkg:npm/left-pad@1.3.0"));
-
-        assert!(
-            state.records.is_empty(),
-            "the superseded record must still be dropped"
-        );
-        assert_eq!(
-            state.edits,
-            vec![keyless],
-            "the keyless edit must survive verbatim even though its rewritten \
-             content carries the dropped purl's artifact uuid"
-        );
-    }
-
     #[tokio::test]
     async fn load_missing_ledger_is_none() {
         let tmp = tempfile::tempdir().unwrap();
@@ -1165,9 +342,8 @@ mod tests {
 
     #[tokio::test]
     async fn load_malformed_ledger_is_a_hard_error_naming_the_file() {
-        // A torn/hand-mangled ledger must NOT load as "no ledger": a
-        // tolerant `None` would let the next hosted run start a fresh ledger
-        // and silently overwrite the only copy of the pre-redirect revert data.
+        // A torn/hand-mangled ledger must NOT load as "no ledger": callers
+        // surface it rather than silently ignoring it.
         let tmp = tempfile::tempdir().unwrap();
         let dir = tmp.path().join(".socket/vendor");
         tokio::fs::create_dir_all(&dir).await.unwrap();
@@ -1182,72 +358,14 @@ mod tests {
             "error must name the file: {message}"
         );
         assert!(
-            message.contains("revert"),
-            "error must explain what is at stake: {message}"
+            message.contains("pre-v5") && message.contains("never overwrites"),
+            "error must say the file is a read-only pre-v5 leftover: {message}"
         );
         // The pure load never mutates the project.
         assert!(dir.join("redirect-state.json").exists());
         assert!(!dir.join("redirect-state.json.corrupt").exists());
     }
 
-    #[tokio::test]
-    async fn quarantine_moves_the_malformed_ledger_aside_preserving_bytes() {
-        let tmp = tempfile::tempdir().unwrap();
-        let dir = tmp.path().join(".socket/vendor");
-        tokio::fs::create_dir_all(&dir).await.unwrap();
-        tokio::fs::write(dir.join("redirect-state.json"), b"{ torn ledger")
-            .await
-            .unwrap();
-        let mut err = load_redirect_state(tmp.path()).await.unwrap_err();
-        err.quarantine().await;
-        assert_eq!(
-            err.quarantined_to.as_deref(),
-            Some(dir.join("redirect-state.json.corrupt").as_path())
-        );
-        assert!(
-            err.to_string().contains("redirect-state.json.corrupt"),
-            "error must point at the moved-aside file: {err}"
-        );
-        assert!(!dir.join("redirect-state.json").exists());
-        assert_eq!(
-            tokio::fs::read(dir.join("redirect-state.json.corrupt"))
-                .await
-                .unwrap(),
-            b"{ torn ledger",
-            "quarantine must preserve the corrupt bytes verbatim"
-        );
-    }
-
-    #[tokio::test]
-    async fn quarantine_never_clobbers_an_earlier_corrupt_snapshot() {
-        let tmp = tempfile::tempdir().unwrap();
-        let dir = tmp.path().join(".socket/vendor");
-        tokio::fs::create_dir_all(&dir).await.unwrap();
-        tokio::fs::write(
-            dir.join("redirect-state.json.corrupt"),
-            b"older revert data",
-        )
-        .await
-        .unwrap();
-        tokio::fs::write(dir.join("redirect-state.json"), b"{ newer torn")
-            .await
-            .unwrap();
-        let mut err = load_redirect_state(tmp.path()).await.unwrap_err();
-        err.quarantine().await;
-        assert!(err.quarantined_to.is_none());
-        assert_eq!(
-            tokio::fs::read(dir.join("redirect-state.json.corrupt"))
-                .await
-                .unwrap(),
-            b"older revert data",
-            "an earlier quarantine snapshot must never be overwritten"
-        );
-        assert!(
-            dir.join("redirect-state.json").exists(),
-            "with the quarantine slot taken the malformed file stays put"
-        );
-    }
-
     /// mkfifo(2) directly, not the /usr/bin/mkfifo binary: spawning a child
     /// flakes under heavy parallel load (fork/exec starvation) and the
     /// syscall needs no process at all.
@@ -1290,30 +408,23 @@ mod tests {
             let _ = std::fs::OpenOptions::new().write(true).open(&fifo);
             panic!("load_redirect_state must complete promptly with a FIFO ledger");
         };
-        let mut err = result.unwrap_err();
+        let err = result.unwrap_err();
         assert_eq!(err.path, fifo, "the error must name the planted path");
         assert!(err.unreadable, "a non-regular file is an I/O problem");
         // The pure load never mutates the project — the FIFO stays put.
         assert!(fifo.exists());
-        // And neither does the quarantine: a file we could not read is not
-        // known to be malformed, so it is never moved aside.
-        err.quarantine().await;
-        assert!(err.quarantined_to.is_none());
-        assert!(fifo.exists());
-        assert!(!dir.join("redirect-state.json.corrupt").exists());
     }
 
     /// An I/O failure (here: a directory squatting the ledger path) is
     /// classified as UNREADABLE, not malformed: the message names the I/O
-    /// problem and does not tell the user to "repair its JSON", and
-    /// `quarantine` refuses to move the path aside.
+    /// problem and does not tell the user to "repair its JSON".
     #[tokio::test]
-    async fn load_unreadable_ledger_is_not_quarantined_or_called_malformed() {
+    async fn load_unreadable_ledger_is_not_called_malformed() {
         let tmp = tempfile::tempdir().unwrap();
         let squatter = tmp.path().join(REDIRECT_STATE_REL);
         tokio::fs::create_dir_all(&squatter).await.unwrap();
 
-        let mut err = load_redirect_state(tmp.path()).await.unwrap_err();
+        let err = load_redirect_state(tmp.path()).await.unwrap_err();
         assert!(err.unreadable);
         let message = err.to_string();
         assert!(
@@ -1324,16 +435,9 @@ mod tests {
             !message.contains("malformed") && !message.contains("repair its JSON"),
             "an unreadable ledger must not be described as malformed: {message}"
         );
-        err.quarantine().await;
-        assert!(err.quarantined_to.is_none());
         assert!(squatter.is_dir(), "the squatting path is left in place");
-        assert!(!tmp
-            .path()
-            .join(".socket/vendor/redirect-state.json.corrupt")
-            .exists());
 
-        // The malformed classification is unchanged: parse failures still
-        // say so and still quarantine.
+        // Parse failures are classified as malformed.
         tokio::fs::remove_dir(&squatter).await.unwrap();
         tokio::fs::write(&squatter, b"{ torn").await.unwrap();
         let err = load_redirect_state(tmp.path()).await.unwrap_err();
@@ -1341,63 +445,6 @@ mod tests {
         assert!(err.to_string().contains("malformed"));
     }
 
-    /// A record carrying an EMPTY uuid (a hand-repaired ledger — a workflow
-    /// the corrupt-ledger message itself instructs — or a degraded record
-    /// fetch) must not turn the artifact anchor into a match-everything
-    /// wildcard: `text.contains("")` is true for EVERY edit with rewritten
-    /// content, so dropping one purl would claim every other package's edits
-    /// and destroy their only revert data. No usable anchor ⇒ fall back to
-    /// the version-exact-only claim, exactly like the recordless ledger.
-    #[test]
-    fn drop_superseded_purl_empty_uuid_record_claims_no_anchored_edits() {
-        let mut state = RedirectState::new();
-        state
-            .records
-            .insert("pkg:npm/left-pad@1.3.0".to_string(), record_with_uuid(""));
-        state
-            .records
-            .insert("pkg:npm/minimist@1.2.2".to_string(), sample_record());
-        state.edits = vec![
-            edit(
-                "pnpm-lock.yaml",
-                "redirect_pnpm_resolution",
-                Some("left-pad@1.3.0"),
-            ),
-            // ANOTHER package's edits — its path-keyed lock entry (rewritten
-            // content carrying its own artifact URL) and its version-exact
-            // pnpm key. Both must survive dropping left-pad.
-            edit_resolved(
-                "package-lock.json",
-                "redirect_npm_lock_entry",
-                "node_modules/minimist",
-                &hosted_url("minimist", "1.2.2", SAMPLE_UUID),
-            ),
-            edit(
-                "pnpm-lock.yaml",
-                "redirect_pnpm_resolution",
-                Some("minimist@1.2.2"),
-            ),
-        ];
-
-        assert!(drop_superseded_purl(&mut state, "pkg:npm/left-pad@1.3.0"));
-
-        assert!(
-            state.records.contains_key("pkg:npm/minimist@1.2.2"),
-            "the other package's record must survive"
-        );
-        let keys: Vec<&str> = state
-            .edits
-            .iter()
-            .filter_map(|e| e.key.as_deref())
-            .collect();
-        assert_eq!(
-            keys,
-            vec!["node_modules/minimist", "minimist@1.2.2"],
-            "an empty uuid offers no anchor and may claim only the dropped \
-             purl's version-exact keys: {keys:?}"
-        );
-    }
-
     #[tokio::test]
     async fn save_writes_atomically_and_round_trips() {
         let tmp = tempfile::tempdir().unwrap();
@@ -1472,124 +519,4 @@ mod tests {
         );
     }
 
-    /// Persisting an EMPTY state into a project with no ledger must succeed
-    /// as a pure no-op: the delete-instead-of-write path tolerates NotFound
-    /// (a fresh project has nothing to delete) and must not scaffold
-    /// `.socket/` or leave a residual empty ledger behind.
-    #[tokio::test]
-    async fn persist_empty_state_with_no_ledger_is_a_no_op() {
-        let tmp = tempfile::tempdir().unwrap();
-        persist_redirect_state(tmp.path(), &RedirectState::new())
-            .await
-            .unwrap();
-        assert!(
-            !tmp.path().join(REDIRECT_STATE_REL).exists(),
-            "no ledger may be created by an empty persist"
-        );
-        assert!(
-            !tmp.path().join(".socket").exists(),
-            "an empty persist must not scaffold .socket/"
-        );
-    }
-
-    /// Emptying the ledger deletes it AND prunes the now-empty
-    /// `.socket/vendor/` it lived in — but never `.socket/` itself (the lock
-    /// guard owns that level).
-    #[tokio::test]
-    async fn persist_empty_state_prunes_the_emptied_vendor_dir() {
-        let tmp = tempfile::tempdir().unwrap();
-        let mut state = RedirectState::new();
-        state
-            .records
-            .insert("pkg:npm/left-pad@1.3.0".to_string(), sample_record());
-        save_redirect_state(tmp.path(), &state).await.unwrap();
-        // Something else lives in `.socket/` (the lock, a manifest…).
-        tokio::fs::write(tmp.path().join(".socket/apply.lock"), b"")
-            .await
-            .unwrap();
-
-        persist_redirect_state(tmp.path(), &RedirectState::new())
-            .await
-            .unwrap();
-
-        assert!(!tmp.path().join(REDIRECT_STATE_REL).exists());
-        assert!(
-            !tmp.path().join(".socket/vendor").exists(),
-            "an emptied hosted ledger leaves no .socket/vendor/ husk"
-        );
-        assert!(
-            tmp.path().join(".socket").exists(),
-            ".socket/ itself is never pruned here"
-        );
-    }
-
-    /// The prune is non-recursive: a `.corrupt` quarantine (the one
-    /// sanctioned residue) or the sibling vendor ledger keeps `.socket/vendor/`.
-    #[tokio::test]
-    async fn persist_empty_state_keeps_vendor_dir_with_siblings() {
-        let tmp = tempfile::tempdir().unwrap();
-        let mut state = RedirectState::new();
-        state
-            .records
-            .insert("pkg:npm/left-pad@1.3.0".to_string(), sample_record());
-        save_redirect_state(tmp.path(), &state).await.unwrap();
-        let dir = tmp.path().join(".socket/vendor");
-        tokio::fs::write(dir.join("redirect-state.json.corrupt"), b"older")
-            .await
-            .unwrap();
-
-        persist_redirect_state(tmp.path(), &RedirectState::new())
-            .await
-            .unwrap();
-
-        assert!(!dir.join("redirect-state.json").exists());
-        assert!(dir.join("redirect-state.json.corrupt").exists());
-        assert!(dir.exists(), "a non-empty vendor dir is kept");
-    }
-
-    /// A FAILED delete of the emptied ledger (anything but NotFound) must
-    /// propagate, never report success: callers treat `Ok` as "the ledger no
-    /// longer asserts anything", and a swallowed error would leave a live
-    /// ledger feeding VEX and takeover detection stale state.
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn persist_empty_state_propagates_non_notfound_delete_errors() {
-        use std::os::unix::fs::PermissionsExt;
-        let tmp = tempfile::tempdir().unwrap();
-        let dir = tmp.path().join(".socket/vendor");
-        tokio::fs::create_dir_all(&dir).await.unwrap();
-        let ledger = dir.join("redirect-state.json");
-        let mut nonempty = RedirectState::new();
-        nonempty
-            .records
-            .insert("pkg:npm/left-pad@1.3.0".to_string(), sample_record());
-        tokio::fs::write(&ledger, serde_json::to_string_pretty(&nonempty).unwrap())
-            .await
-            .unwrap();
-        // A read-only parent dir makes the unlink fail with EACCES.
-        std::fs::set_permissions(&dir, std::fs::Permissions::from_mode(0o555)).unwrap();
-        // Root ignores mode bits; skip there (CI containers sometimes run as root).
-        if std::fs::File::create(dir.join("probe")).is_ok() {
-            let _ = std::fs::set_permissions(&dir, std::fs::Permissions::from_mode(0o755));
-            let _ = std::fs::remove_file(dir.join("probe"));
-            eprintln!("skipping: running as root, 0555 does not block writes");
-            return;
-        }
-
-        let err = persist_redirect_state(tmp.path(), &RedirectState::new())
-            .await
-            .unwrap_err();
-        assert_eq!(
-            err.kind(),
-            std::io::ErrorKind::PermissionDenied,
-            "the delete failure must propagate verbatim: {err}"
-        );
-
-        // Restore so the tempdir can clean up, then confirm nothing was lost.
-        std::fs::set_permissions(&dir, std::fs::Permissions::from_mode(0o755)).unwrap();
-        assert!(
-            ledger.exists(),
-            "a failed delete must leave the ledger in place"
-        );
-    }
 }
diff --git a/crates/socket-patch-core/src/patch/redirect/takeover.rs b/crates/socket-patch-core/src/patch/redirect/takeover.rs
deleted file mode 100644
index 268bec13..00000000
--- a/crates/socket-patch-core/src/patch/redirect/takeover.rs
+++ /dev/null
@@ -1,5896 +0,0 @@
-//! Cross-mode takeover: per-purl revert of a HOSTED redirect, driven by the
-//! redirect ledger's recorded [`FileEdit`]s.
-//!
-//! The vendored flows (`vendor`, `scan --mode vendored`) call this BEFORE
-//! vendoring a package the hosted redirect ledger still claims, so a
-//! hosted→vendored migration leaves the project FULLY in vendored mode.
-//!
-//! Cargo: Cargo.toml loses its `registry = "socket-patch-…"` pin, Cargo.lock
-//! gets its original crates.io `source`/`checksum` back (so the subsequent
-//! vendor detach records the PRISTINE originals in the vendor ledger, not the
-//! hosted values), and the now-unused `[registries.socket-patch-…]` block is
-//! dropped. Without this, `[patch.crates-io]` cannot even apply (it only
-//! patches crates-io-sourced deps) and the project is unbuildable in both
-//! modes.
-//!
-//! npm family (package-lock/npm-shrinkwrap, yarn classic, yarn berry, pnpm,
-//! bun): each recorded lock edit's `original` fragment is replayed over its
-//! `new` fragment. For most flavors the follow-up vendor rewire happens to
-//! succeed either way (the vendored wiring replaces whatever resolution is
-//! present), but WITHOUT the pre-revert the vendor ledger records the
-//! grant-tokenized hosted fragment as its unrecoverable pre-vendor
-//! "original" (so `vendor --revert` restores an expiring hosted URL with no
-//! CLI path back to registry state), and the superseded redirect
-//! records/edits survive forever — a stale ledger that VEX/audits keep
-//! reading and a replay hazard for any later redirect revert. bun is
-//! stricter still: its hosted rewrite REPLACES the `name@version` spec the
-//! bun vendor backend keys on (registry 4-tuple → URL 3-tuple), so without
-//! the pre-revert the package cannot be vendored at all
-//! (`vendor_lock_entry_not_found`).
-//!
-//! golang: the module's go.mod `replace` and the socket module's go.sum
-//! lines are removed and the pruned upstream go.sum lines come back in
-//! go's sort order, so the vendor backend wires its `replace` over the
-//! pristine files instead of taking over the hosted directive.
-//!
-//! FAIL CLOSED: a file that matches neither the recorded redirected fragment
-//! nor the recorded original has drifted — the revert refuses (`Err`) rather
-//! than half-applying, and the caller must then refuse to vendor that purl.
-//! Refusing has to leave the project byte-identical across ALL the files the
-//! ledger claims, not just the one that drifted: the caller reports the purl
-//! as untouched ("cannot vendor over the live hosted redirect"), so an
-//! already-rewritten Cargo.lock behind that message would be a half-hosted
-//! project nobody is told about, and every retry refuses on the same drift.
-//! So each inverse is resolved against a staged view and NOTHING reaches disk
-//! until all of them have resolved.
-
-use std::collections::{BTreeMap, HashSet};
-use std::path::Path;
-use std::sync::LazyLock;
-
-use regex::Regex;
-use serde_json::Value;
-
-use crate::utils::purl::{
-    parse_cargo_purl, parse_golang_purl, parse_name_version, strip_purl_qualifiers,
-};
-use crate::vendor::go_mod_edit::{
-    is_hosted_module_path, parse_replace_entries, HOSTED_GO_MODULE_PREFIX,
-};
-
-use super::replay::FragmentRevert;
-use super::staged::{flush_staged, read_rel, staged_read, Staged, StagedBytes};
-use super::state::RedirectState;
-use super::FileEdit;
-
-/// What a redirect revert rewrote.
-#[derive(Debug, Default)]
-pub struct RedirectRevert {
-    /// Repo-relative files this revert actually rewrote or removed.
-    pub reverted_files: Vec<String>,
-    /// Advisory (code, detail) pairs — e.g. a redirect-created `.npmrc`
-    /// that was modified since (`redirect_npmrc_allow_remote_modified`).
-    pub warnings: Vec<(String, String)>,
-}
-
-/// Does [`revert_redirect_purl`] have an implementation for this purl's
-/// ecosystem? Callers (the vendor dispatch loop's cross-mode takeover gate)
-/// must consult this instead of hardcoding `pkg:cargo/`.
-pub fn redirect_revert_supported(purl: &str) -> bool {
-    purl.starts_with("pkg:cargo/")
-        || purl.starts_with("pkg:npm/")
-        || purl.starts_with("pkg:golang/")
-}
-
-/// Revert every hosted-redirect edit the ledger records for `purl`, then
-/// drop that purl's record and edits from `state`. The caller persists the
-/// mutated ledger (see `persist_redirect_state`). Dispatches per ecosystem;
-/// purls outside [`redirect_revert_supported`] are refused (fail closed).
-///
-/// `dry_run` resolves every inverse and drift check exactly like a wet run
-/// and skips ONLY the disk flush: the purl's record and edits are still
-/// dropped from `state`, so a composed preview (the whole-ledger replay run
-/// after the per-purl reverts inside one rollback) sees the post-claim
-/// ledger. Callers pass a throwaway clone and never persist it on a dry run
-/// (rollback.rs / vendor.rs do). Contrast `revert_remaining_redirect_edits`,
-/// whose dry run leaves its `state` untouched.
-pub async fn revert_redirect_purl(
-    project_root: &Path,
-    state: &mut RedirectState,
-    purl: &str,
-    dry_run: bool,
-) -> Result<RedirectRevert, String> {
-    if purl.starts_with("pkg:cargo/") {
-        revert_cargo_redirect_purl(project_root, state, purl, dry_run).await
-    } else if purl.starts_with("pkg:npm/") {
-        revert_npm_redirect_purl(project_root, state, purl, dry_run).await
-    } else if purl.starts_with("pkg:golang/") {
-        revert_golang_redirect_purl(project_root, state, purl, dry_run).await
-    } else {
-        Err(format!(
-            "no hosted-redirect revert implementation for {purl}"
-        ))
-    }
-}
-
-/// The ledger record whose canonical purl (qualifiers stripped,
-/// percent-decoded) matches `purl`: `(record key as stored, canonical purl)`.
-/// Refused when the ledger records no hosted redirect for the purl.
-fn find_record_key(state: &RedirectState, purl: &str) -> Result<(String, String), String> {
-    let Some(record_key) = state.record_keys_for(purl).into_iter().next() else {
-        return Err(format!(
-            "the redirect ledger records no hosted redirect for {purl}"
-        ));
-    };
-    // The target keeps the purl's ORIGINAL (percent-encoded) spelling minus
-    // its qualifiers: `parse_cargo_purl` / `parse_name_version` decode the
-    // components themselves, and `canonical_purl` here would decode a second
-    // time (a literal `%2B` in a name would become `+`).
-    Ok((record_key, strip_purl_qualifiers(purl).to_string()))
-}
-
-/// Refuse a per-purl claim while the ledger holds a `redirect_*` edit this
-/// release cannot classify that names `<name>@<version>`: claiming the rest
-/// and dropping the record would strand that edit (half a takeover).
-fn refuse_unclassified_edits(
-    state: &RedirectState,
-    name: &str,
-    version: &str,
-) -> Result<(), String> {
-    match state.unclassified_edit_naming(name, version) {
-        Some(e) => Err(format!(
-            "the redirect ledger holds a {} edit this socket-patch release does not \
-             understand; upgrade socket-patch",
-            e.kind
-        )),
-        None => Ok(()),
-    }
-}
-
-/// Drop the claimed edits (by ledger index) and the purl's record from the
-/// ledger — only after every inverse applied cleanly. The caller persists.
-fn drop_claimed(state: &mut RedirectState, claimed: Vec<usize>, record_key: &str) {
-    let drop: HashSet<usize> = claimed.into_iter().collect();
-    let mut idx = 0usize;
-    state.edits.retain(|_| {
-        let keep = !drop.contains(&idx);
-        idx += 1;
-        keep
-    });
-    state.records.remove(record_key);
-}
-
-/// `socket-patch-<uuid>` registry names as they appear in Cargo.toml pins,
-/// Cargo.lock sources and `[registries.…]` headers.
-static SOCKET_REGISTRY_UUID: LazyLock<Regex> = LazyLock::new(|| {
-    Regex::new(r"socket-patch-([0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12})")
-        .expect("static registry-uuid regex is valid")
-});
-
-/// The `socket-patch-<uuid>` registry uuids a recorded fragment names.
-fn registry_uuids(fragment: Option<&Value>) -> impl Iterator<Item = String> + '_ {
-    fragment
-        .and_then(Value::as_str)
-        .into_iter()
-        .flat_map(|s| SOCKET_REGISTRY_UUID.captures_iter(s))
-        .map(|c| c[1].to_string())
-}
-
-/// A Cargo.lock edit (keyed `<name>@<version>`): the entry / `[metadata]`
-/// fragments, or the dependents' full-id reference.
-fn is_cargo_lock_edit(e: &FileEdit) -> bool {
-    e.kind == "redirect_cargo_lock_entry" || e.kind == super::CARGO_LOCK_REFERENCE_KIND
-}
-
-/// Every patch uuid `name@version` was redirected at: its record's, plus
-/// each managed registry whose index URL one of its (version-keyed)
-/// Cargo.lock edits names — the older links of a re-redirect chain.
-fn cargo_lineage(state: &RedirectState, name: &str, version: &str, uuid: &str) -> HashSet<String> {
-    let lock_key = format!("{name}@{version}");
-    let lock_fragments: Vec<&str> = state
-        .edits
-        .iter()
-        .filter(|e| is_cargo_lock_edit(e) && e.key.as_deref() == Some(lock_key.as_str()))
-        .flat_map(|e| [e.original.as_ref(), e.new.as_ref()])
-        .flatten()
-        .filter_map(Value::as_str)
-        .collect();
-    let mut lineage: HashSet<String> = HashSet::from([uuid.to_string()]);
-    for e in state
-        .edits
-        .iter()
-        .filter(|e| e.kind == "redirect_cargo_registry")
-    {
-        let Some(u) = e
-            .key
-            .as_deref()
-            .and_then(|k| k.strip_prefix("socket-patch-"))
-        else {
-            continue;
-        };
-        let index = e
-            .new
-            .as_ref()
-            .and_then(Value::as_str)
-            .and_then(|block| block.split('"').nth(1));
-        if index.is_some_and(|index| lock_fragments.iter().any(|f| f.contains(index))) {
-            lineage.insert(u.to_string());
-        }
-    }
-    lineage
-}
-
-/// Revert every hosted-redirect edit the ledger records for `purl` (a cargo
-/// package), then drop that purl's record and edits from `state`. The caller
-/// persists the mutated ledger (see `persist_redirect_state`).
-///
-/// Chained re-redirects (the same purl redirected at successive patch uuids)
-/// unwind newest-first: each edit's `new` fragment is replaced by its
-/// `original`, and an intermediate edit whose `original` is already live is a
-/// no-op. `[registries.socket-patch-…]` blocks tied to this purl's uuids are
-/// removed only when nothing in Cargo.toml / Cargo.lock still references them.
-/// `dry_run` skips only the disk flush; the in-memory ledger claim still
-/// happens (see [`revert_redirect_purl`]).
-pub async fn revert_cargo_redirect_purl(
-    project_root: &Path,
-    state: &mut RedirectState,
-    purl: &str,
-    dry_run: bool,
-) -> Result<RedirectRevert, String> {
-    let (record_key, target) = find_record_key(state, purl)?;
-    let Some((name, version)) = parse_cargo_purl(&target) else {
-        return Err(format!("not a cargo purl: {purl}"));
-    };
-    let (name, version) = (name.into_owned(), version.into_owned());
-    refuse_unclassified_edits(state, &name, &version)?;
-    let lock_key = format!("{name}@{version}");
-
-    // Manifest edits are keyed by crate NAME (the shared golden ledger
-    // shape), so when another version of the crate is redirected too, its
-    // pins carry the same key. Attribute each such edit to the version its
-    // declaration's requirement selects — the planner's own rule, and the
-    // only one that also holds for ledgers an older, name-only CLI wrote
-    // (a declaration of one version pinned to, then re-pinned from, the
-    // other version's registry). An edit whose line carries no readable
-    // requirement (a table-form header / registry line) falls back to the
-    // registry it pins: skipped when that is a sibling lineage's. Without a
-    // sibling the claim stays name-wide, as before.
-    let siblings: Vec<(String, HashSet<String>)> = state
-        .records
-        .iter()
-        .filter(|(key, _)| **key != record_key)
-        .filter_map(|(key, rec)| {
-            let (n, v) = parse_cargo_purl(strip_purl_qualifiers(key))?;
-            (n == name && v != version)
-                .then(|| (v.to_string(), cargo_lineage(state, &n, &v, &rec.uuid)))
-        })
-        .collect();
-    let sibling_versions: Vec<String> = siblings.iter().map(|(v, _)| v.clone()).collect();
-    let sibling_uuids: HashSet<String> = siblings.into_iter().flat_map(|(_, u)| u).collect();
-    let is_my_manifest_edit = |e: &FileEdit| {
-        if sibling_versions.is_empty() {
-            return true;
-        }
-        let req = cargo_declared_req(e.original.as_ref());
-        match super::cargo_req_selects(req.as_deref(), &version, &sibling_versions) {
-            super::CargoReqMatch::Ours if req.is_some() => true,
-            super::CargoReqMatch::NotOurs => false,
-            _ => !registry_uuids(e.new.as_ref()).any(|u| sibling_uuids.contains(&u)),
-        }
-    };
-    let is_wiring_edit = |e: &FileEdit| {
-        (e.kind == "redirect_cargo_toml_dep"
-            && e.key.as_deref() == Some(name.as_str())
-            && is_my_manifest_edit(e))
-            || (is_cargo_lock_edit(e) && e.key.as_deref() == Some(lock_key.as_str()))
-    };
-    // Registry blocks tie to this purl via the `socket-patch-<uuid>` names in
-    // its record + wiring edits (a patch uuid is per purl, so this cannot
-    // claim another package's block) — never a sibling version's, which a
-    // re-pinned legacy declaration also names.
-    let mut uuids: HashSet<String> = HashSet::new();
-    uuids.insert(state.records[&record_key].uuid.clone());
-    for e in state.edits.iter().filter(|e| is_wiring_edit(e)) {
-        for v in [&e.original, &e.new] {
-            if let Some(s) = v.as_ref().and_then(Value::as_str) {
-                for c in SOCKET_REGISTRY_UUID.captures_iter(s) {
-                    if !sibling_uuids.contains(&c[1]) {
-                        uuids.insert(c[1].to_string());
-                    }
-                }
-            }
-        }
-    }
-    let is_registry_edit = |e: &FileEdit| {
-        e.kind == "redirect_cargo_registry"
-            && e.key
-                .as_deref()
-                .and_then(|k| k.strip_prefix("socket-patch-"))
-                .is_some_and(|u| uuids.contains(u))
-    };
-
-    let mine: Vec<usize> = state
-        .edits
-        .iter()
-        .enumerate()
-        .filter(|(_, e)| is_wiring_edit(e) || is_registry_edit(e))
-        .map(|(i, _)| i)
-        .collect();
-
-    // Every manifest the ledger ever pinned (workspace members included),
-    // plus the lock: where a registry block can still be referenced from.
-    let mut probes: Vec<String> = vec!["Cargo.toml".to_string(), "Cargo.lock".to_string()];
-    for e in state
-        .edits
-        .iter()
-        .filter(|e| e.kind == "redirect_cargo_toml_dep")
-    {
-        if !probes.contains(&e.path) {
-            probes.push(e.path.clone());
-        }
-    }
-
-    let mut out = RedirectRevert::default();
-    let mut staged: Staged = Staged::new();
-    // A block kept because it is still referenced normally leaves the
-    // ledger (it now belongs to whatever hand pin references it). The
-    // exception is a block another, still-recorded wiring edit pins to (an
-    // older CLI's cross-version pin): that edit stays in the ledger so the
-    // removal that retires the last such pin also removes the block.
-    let still_pinned: HashSet<String> = state
-        .edits
-        .iter()
-        .enumerate()
-        .filter(|(i, e)| e.kind == "redirect_cargo_toml_dep" && !mine.contains(i))
-        .flat_map(|(_, e)| registry_uuids(e.new.as_ref()).collect::<Vec<_>>())
-        .collect();
-    let mut kept: HashSet<usize> = HashSet::new();
-    // Newest-first: the hosted flow appends edits, so reverse index order
-    // unwinds re-redirect chains correctly (each step's `original` is the
-    // previous step's `new`), and the registry-block removals — recorded
-    // before their wiring edits — run last, after the references are gone.
-    for &i in mine.iter().rev() {
-        let edit = &state.edits[i];
-        match edit.kind.as_str() {
-            "redirect_cargo_toml_dep"
-            | "redirect_cargo_lock_entry"
-            | super::CARGO_LOCK_REFERENCE_KIND => {
-                let (Some(new), Some(orig)) = (
-                    edit.new.as_ref().and_then(Value::as_str),
-                    edit.original.as_ref().and_then(Value::as_str),
-                ) else {
-                    return Err(format!(
-                        "the redirect ledger edit for {} in {} records no original \
-                         fragment; cannot revert the hosted redirect",
-                        name, edit.path
-                    ));
-                };
-                let Some(content) = staged_read(&staged, project_root, &edit.path).await? else {
-                    return Err(format!(
-                        "{} no longer exists; cannot revert the recorded hosted \
-                         redirect for {name}@{version}",
-                        edit.path
-                    ));
-                };
-                // A full-id reference edit stands for every dependent's
-                // occurrence of that exact id. Matching ignores a CRLF/LF
-                // conversion since the scan (a Windows checkout's CRLF
-                // fragments against an LF checkout, and vice versa).
-                let every = edit.kind == super::CARGO_LOCK_REFERENCE_KIND;
-                match super::replay::revert_fragment_eol(&content, new, orig, every) {
-                    FragmentRevert::Reverted(reverted) => {
-                        staged.insert(edit.path.clone(), Some(reverted));
-                        out.reverted_files.push(edit.path.clone());
-                    }
-                    // Already at (or unwound to) the pre-redirect fragment.
-                    FragmentRevert::AlreadyOriginal => {}
-                    FragmentRevert::Drifted => {
-                        return Err(format!(
-                            "the {} entry for {name}@{version} has drifted from the \
-                             recorded hosted redirect (neither the redirected nor the \
-                             original fragment is present); refusing to touch it — \
-                             re-run `scan --mode hosted` to normalize the redirect, \
-                             or restore the crates.io wiring manually, then re-run",
-                            edit.path
-                        ));
-                    }
-                }
-            }
-            "redirect_cargo_registry" => {
-                let Some(block) = edit.new.as_ref().and_then(Value::as_str) else {
-                    continue; // nothing recorded to remove — leave the config
-                };
-                let Some(content) = staged_read(&staged, project_root, &edit.path).await? else {
-                    continue; // config already gone
-                };
-                if !super::replay::contains_eol(&content, block) {
-                    continue; // block already removed
-                }
-                // Keep the block while anything still references its registry
-                // name or index URL (defensive — a hand-edited project may
-                // have pinned another dep to it).
-                let reg = edit.key.as_deref().unwrap_or_default();
-                let index = block
-                    .split('"')
-                    .nth(1)
-                    .map(str::to_string)
-                    .unwrap_or_default();
-                let mut referenced = false;
-                for probe in &probes {
-                    if let Some(text) = staged_read(&staged, project_root, probe).await? {
-                        if (!reg.is_empty() && text.contains(reg))
-                            || (!index.is_empty() && text.contains(&index))
-                        {
-                            referenced = true;
-                            break;
-                        }
-                    }
-                }
-                if referenced {
-                    if reg
-                        .strip_prefix("socket-patch-")
-                        .is_some_and(|u| still_pinned.contains(u))
-                    {
-                        kept.insert(i);
-                    }
-                    continue;
-                }
-                // A REGENERATED block (`action: "rewritten"` — the rewriter
-                // replaced a degraded/commented region in place and recorded
-                // it as `original`) restores that pre-existing region instead
-                // of deleting it: the original bytes are the user's.
-                if let Some(orig) = edit.original.as_ref().and_then(Value::as_str) {
-                    if let FragmentRevert::Reverted(reverted) =
-                        super::replay::revert_fragment_eol(&content, block, orig, false)
-                    {
-                        staged.insert(edit.path.clone(), Some(reverted));
-                        out.reverted_files.push(edit.path.clone());
-                    }
-                    continue;
-                }
-                // The block leaves with exactly the blank separator the
-                // rewrite put before it, so the user's config comes back
-                // byte-for-byte — its trailing newlines (or missing final
-                // newline) included. A config the rewrite created ends
-                // empty and is deleted.
-                let Some(restored) = super::replay::remove_appended_cargo_block(&content, block)
-                else {
-                    continue;
-                };
-                staged.insert(
-                    edit.path.clone(),
-                    (!restored.is_empty()).then_some(restored),
-                );
-                out.reverted_files.push(edit.path.clone());
-            }
-            _ => {}
-        }
-    }
-
-    // Every inverse resolved — only now does any of it reach disk, so a
-    // refusal above left the project exactly as it was found. A dry run
-    // skips ONLY the disk flush: the in-memory ledger mutation below still
-    // happens, so composed previews (the whole-ledger replay running after
-    // the per-purl reverts inside one rollback) see exactly the state a
-    // wet run would hand them. The caller owns the state clone and never
-    // persists it on a dry run, so nothing durable changes.
-    if !dry_run {
-        flush_staged(project_root, &staged, &StagedBytes::new()).await?;
-    }
-
-    let mine: Vec<usize> = mine.into_iter().filter(|i| !kept.contains(i)).collect();
-    drop_claimed(state, mine, &record_key);
-    Ok(out)
-}
-
-/// Revert one Go module's hosted redirect: its go.mod `replace`, the
-/// socket module's go.sum lines, and the pruned upstream go.sum pair, then
-/// drop its record and edits from `state`. The claimed edits unwind through
-/// the whole-ledger replay's golang inverses, staged all-or-nothing. A
-/// go.mod whose directive for the module is no longer the recorded one has
-/// drifted and refuses byte-untouched.
-pub async fn revert_golang_redirect_purl(
-    project_root: &Path,
-    state: &mut RedirectState,
-    purl: &str,
-    dry_run: bool,
-) -> Result<RedirectRevert, String> {
-    let (record_key, target) = find_record_key(state, purl)?;
-    let Some((module, version)) = parse_golang_purl(&target) else {
-        return Err(format!("not a golang purl: {purl}"));
-    };
-    let (module, version) = (module.into_owned(), version.into_owned());
-    refuse_unclassified_edits(state, &module, &version)?;
-    let lhs = format!("{module} {version} =>");
-    let is_replace_edit = |e: &FileEdit| {
-        matches!(
-            e.kind.as_str(),
-            "redirect_golang_replace" | "redirect_golang_stale_replace_removed"
-        ) && e.key.as_deref() == Some(module.as_str())
-            && [&e.new, &e.original].iter().any(|v| {
-                v.as_ref()
-                    .and_then(Value::as_str)
-                    .is_some_and(|t| t.contains(&lhs))
-            })
-    };
-    // The socket modules this purl's directives pointed at: go.sum edits
-    // key by those, never by the upstream module.
-    let mut socket_modules: HashSet<String> = HashSet::new();
-    socket_modules.insert(format!(
-        "{HOSTED_GO_MODULE_PREFIX}{}",
-        state.records[&record_key].uuid
-    ));
-    for e in state.edits.iter().filter(|e| is_replace_edit(e)) {
-        for text in [&e.new, &e.original]
-            .into_iter()
-            .flatten()
-            .filter_map(Value::as_str)
-        {
-            for entry in parse_replace_entries(text) {
-                if let Some(rhs) = entry.rhs_module.filter(|m| is_hosted_module_path(m)) {
-                    socket_modules.insert(rhs);
-                }
-            }
-        }
-    }
-    let prune_key = format!("{module}@{version}");
-    let mine: Vec<usize> = state
-        .edits
-        .iter()
-        .enumerate()
-        .filter(|(_, e)| match e.kind.as_str() {
-            "redirect_golang_replace" | "redirect_golang_stale_replace_removed" => {
-                is_replace_edit(e)
-            }
-            "redirect_golang_gosum_prune" => e.key.as_deref() == Some(prune_key.as_str()),
-            "redirect_golang_gosum" => e
-                .key
-                .as_deref()
-                .and_then(|k| k.rsplit_once('@'))
-                .is_some_and(|(m, _)| socket_modules.contains(m)),
-            "redirect_golang_stale_gosum_removed" => {
-                e.key.as_deref().is_some_and(|k| socket_modules.contains(k))
-            }
-            _ => false,
-        })
-        .map(|(i, _)| i)
-        .collect();
-
-    // Drift: the newest recorded directive must still be live, or the
-    // module must carry no replace at all (already unwound).
-    let newest = mine
-        .iter()
-        .rev()
-        .map(|&i| &state.edits[i])
-        .find(|e| e.kind == "redirect_golang_replace");
-    if let Some(directive) = newest.and_then(|e| e.new.as_ref()).and_then(Value::as_str) {
-        let go_mod = read_rel(project_root, "go.mod").await?.unwrap_or_default();
-        if !go_mod.contains(directive)
-            && parse_replace_entries(&go_mod)
-                .iter()
-                .any(|e| e.module == module)
-        {
-            return Err(format!(
-                "go.mod's replace for {module} has drifted from the recorded hosted \
-                 redirect; refusing to touch it — re-run `scan --mode hosted` to \
-                 normalize the redirect, or remove the replace manually, then re-run"
-            ));
-        }
-    }
-
-    let mut claimed = RedirectState::new();
-    claimed.edits = mine.iter().map(|&i| state.edits[i].clone()).collect();
-    claimed
-        .records
-        .insert(record_key.clone(), state.records[&record_key].clone());
-    let replay =
-        super::replay::revert_remaining_redirect_edits(project_root, &mut claimed, dry_run).await;
-    if let Some(refusal) = replay.refusals.first() {
-        return Err(refusal.reason.clone());
-    }
-    drop_claimed(state, mine, &record_key);
-    Ok(RedirectRevert {
-        reverted_files: replay.reverted_files.into_iter().collect(),
-        warnings: replay.warnings,
-    })
-}
-
-/// The version requirement a recorded Cargo.toml declaration line carries:
-/// the `version = "…"` of an inline table, or the value of a plain
-/// `name = "…"` entry. `None` for a table-form header or `registry` line.
-fn cargo_declared_req(fragment: Option<&Value>) -> Option<String> {
-    static PLAIN_ENTRY: LazyLock<Regex> = LazyLock::new(|| {
-        Regex::new(r#"^\s*(?:"[^"]+"|'[^']+'|[A-Za-z0-9_-]+)\s*=\s*"([^"]+)""#)
-            .expect("static plain-entry regex is valid")
-    });
-    static INLINE_VERSION: LazyLock<Regex> = LazyLock::new(|| {
-        Regex::new(r#"\bversion\s*=\s*"([^"]*)""#).expect("static inline-version regex is valid")
-    });
-    let line = fragment.and_then(Value::as_str)?;
-    if line.contains('\n') || line.trim_start().starts_with('[') {
-        return None;
-    }
-    let req = if line.contains('{') {
-        INLINE_VERSION.captures(line)?[1].to_string()
-    } else {
-        PLAIN_ENTRY.captures(line)?[1].to_string()
-    };
-    semver::VersionReq::parse(req.trim()).is_ok().then_some(req)
-}
-
-/// The npm-family text-fragment edit kinds CLAIMED BY KEY: `original`/`new`
-/// hold the whole lock fragment as a string, the edit's `key` embeds
-/// `<name>@<version>`, and the revert is a `replacen(new, original)`.
-const NPM_TEXT_KINDS: [&str; 4] = [
-    "redirect_yarn_classic_entry",
-    "redirect_yarn_berry_entry",
-    "redirect_pnpm_resolution",
-    super::vlt::KIND,
-];
-
-/// The bun hosted rewriter's edit kind (`rewrite_bun_lock`): `original`/`new`
-/// hold the whole `packages` entry LINE, so it replays exactly like the
-/// [`NPM_TEXT_KINDS`]. It is CLAIMED differently: bun edits key by the
-/// lock's package map key — `minimist`, a nested `other/minimist`, or the
-/// alias of an `alias@npm:minimist@1.2.2` install — never by
-/// `name@version`, so ownership is read from the recorded line's spec
-/// (`elems[0]`), the field the rewriter itself matched on.
-const BUN_TEXT_KIND: &str = "redirect_bun_lock_package";
-
-/// Does this edit kind replay as a text fragment, fail-closed on drift?
-/// Most replace the whole fragment (`content.replacen(new, original, 1)`);
-/// vlt node edits revert slot by slot ([`super::vlt::revert_vlt_slots`]).
-fn replays_as_text_fragment(kind: &str) -> bool {
-    NPM_TEXT_KINDS.contains(&kind) || kind == BUN_TEXT_KIND
-}
-
-/// Ownership verdict for one [`BUN_TEXT_KIND`] edit.
-#[derive(Debug, PartialEq)]
-enum BunClaim {
-    /// The edit rewrote an instance of exactly this `name@version`.
-    Ours,
-    /// Another package, or another version of this one (a nested
-    /// `other/minimist` instance at 1.2.8 while reverting 1.2.2): not ours
-    /// to touch, and no reason to refuse.
-    Foreign,
-    /// The recorded fragments mention this package but neither one parses
-    /// under bun's entry grammar (hand-edited or truncated ledger), so
-    /// ownership cannot be decided. Deciding "foreign" would drop this
-    /// purl's record while stranding an edit that may be its own — half a
-    /// takeover — so the caller refuses.
-    Undecidable,
-}
-
-/// Attribute a bun.lock edit to `name@version` the way the hosted rewriter
-/// matched it: by the spec of the recorded line.
-///
-/// A registry 4-tuple's spec is exactly `<name>@<version>`; a hosted URL
-/// 3-tuple's spec is `<name>@<artifact url>`. Either fragment may be the
-/// hosted URL (a re-redirect chain records `original` = the PRIOR hosted
-/// line, `new` = the current one), so both are consulted and one match
-/// claims. The URL half is discriminated by version through its tarball
-/// leaf — see [`hosted_url_names`] — never by the name substring alone,
-/// which would claim a sibling version's edit and silently un-host it.
-fn bun_edit_ownership(edit: &FileEdit, name: &str, version: &str) -> BunClaim {
-    use crate::vendor::bun_lock_text::{decode_json_string, parse_entry_line};
-    fn fragment(v: &Option<Value>) -> Option<&str> {
-        v.as_ref().and_then(Value::as_str)
-    }
-    let spec_of = |line: &str| -> Option<String> {
-        let entry = parse_entry_line(line).ok()?;
-        decode_json_string(entry.elems.first()?)
-    };
-    let mut parsed_any = false;
-    for line in [fragment(&edit.original), fragment(&edit.new)]
-        .into_iter()
-        .flatten()
-    {
-        if let Some(spec) = spec_of(line) {
-            parsed_any = true;
-            if bun_spec_names(&spec, name, version) {
-                return BunClaim::Ours;
-            }
-        }
-    }
-    if parsed_any {
-        return BunClaim::Foreign;
-    }
-    // Neither fragment is a bun entry line. Only refuse when the raw text
-    // so much as mentions this package; an edit naming nothing of ours is
-    // someone else's problem and must not block this purl's takeover.
-    let probe = format!("\"{name}@");
-    let mentions = |v: &Option<Value>| fragment(v).is_some_and(|s| s.contains(&probe));
-    if mentions(&edit.original) || mentions(&edit.new) {
-        BunClaim::Undecidable
-    } else {
-        BunClaim::Foreign
-    }
-}
-
-/// Is `spec` (a bun.lock entry's decoded `elems[0]`) the registry spec
-/// `<name>@<version>` or a hosted artifact URL spec for that exact
-/// `name@version`?
-fn bun_spec_names(spec: &str, name: &str, version: &str) -> bool {
-    use crate::vendor::bun_lock_text::split_name_spec;
-    let Some((spec_name, rest)) = split_name_spec(spec) else {
-        return false;
-    };
-    spec_name == name && (rest == version || hosted_url_names(rest, name, version))
-}
-
-/// True when `url` is an http(s) artifact URL whose last path segment is
-/// `<bare>-<version>.tgz` — the leaf every hosted artifact URL for this
-/// `name@version` ends in. `<bare>` is the name without its `@scope/`: the
-/// vendor path layer (`tgz_rel_leaf`) keeps a scope as a directory level
-/// (`@scope/pkg-1.0.0.tgz`), and the hosted rewriter's prior-URL match
-/// (`is_prior_hosted_bun_spec`) compares the same last path segment, so
-/// `pkg-1.0.0.tgz` is the one spelling both agree on. Anything that fails
-/// to parse fails the match (closed). The exact-leaf comparison is the
-/// version discriminator: `pkg-1.3.0.tgz` never equals `pkg-11.3.0.tgz`
-/// or `pkg-1.3.0-rc1.tgz`.
-pub(crate) fn hosted_url_names(url: &str, name: &str, version: &str) -> bool {
-    if !url.starts_with("https://") && !url.starts_with("http://") {
-        return false;
-    }
-    let scheme_end = url
-        .find("://")
-        .expect("url starts with http(s):// — checked above")
-        + 3;
-    let Some(path_start) = url[scheme_end..].find('/').map(|i| i + scheme_end) else {
-        return false;
-    };
-    let leaf = url[path_start..].rsplit('/').next().unwrap_or_default();
-    let bare = name.rsplit('/').next().unwrap_or(name);
-    !leaf.is_empty() && leaf == format!("{bare}-{version}.tgz")
-}
-
-/// The version a hosted artifact `url` names for `name`: its last path
-/// segment is `<bare>-<version>.tgz` with a semver `<version>`, confirmed by
-/// [`hosted_url_names`]. How a hosted bun binary redirect's version is
-/// recovered (`bun_binary::names`) and how lockfile discovery reads a bun
-/// hosted ref's version.
-pub(crate) fn hosted_url_version<'u>(url: &'u str, name: &str) -> Option<&'u str> {
-    let bare = name.rsplit('/').next().unwrap_or(name);
-    let version = url
-        .rsplit('/')
-        .next()?
-        .strip_prefix(bare)?
-        .strip_prefix('-')?
-        .strip_suffix(".tgz")?;
-    (semver::Version::parse(version).is_ok() && hosted_url_names(url, name, version))
-        .then_some(version)
-}
-
-/// Revert every hosted-redirect edit the ledger records for `purl` (an npm
-/// package), then drop that purl's record and edits from `state`. The caller
-/// persists the mutated ledger (see `persist_redirect_state`).
-///
-/// Same fail-closed contract as [`revert_cargo_redirect_purl`]: every inverse
-/// is resolved against a staged view and NOTHING reaches disk until all of
-/// them have resolved, so a drift refusal leaves the project byte-identical
-/// across ALL the files the ledger claims. `dry_run` skips only the disk
-/// flush; the in-memory ledger claim still happens (see
-/// [`revert_redirect_purl`]).
-pub async fn revert_npm_redirect_purl(
-    project_root: &Path,
-    state: &mut RedirectState,
-    purl: &str,
-    dry_run: bool,
-) -> Result<RedirectRevert, String> {
-    let (record_key, target) = find_record_key(state, purl)?;
-    // The parse percent-decodes both components; the name keeps its `@scope/`.
-    let Some((name, version)) = parse_name_version(&target, "pkg:npm/") else {
-        return Err(format!("not an npm purl: {purl}"));
-    };
-    let (name, version) = (name.into_owned(), version.into_owned());
-    refuse_unclassified_edits(state, &name, &version)?;
-    let lock_key = format!("{name}@{version}");
-
-    // The package-lock/shrinkwrap files any `redirect_npm_lock_entry` edits
-    // touch, read ONCE from disk: the raw text is kept (`disk_texts`) so the
-    // replay below never re-reads a lock this attribution pass already
-    // loaded, and the parse is used for ownership — an ALIAS install (`npm i
-    // alias@npm:name`) keys its entry by the alias, so ownership is resolved
-    // through the entry's `name` field, exactly how the rewriter matched it
-    // (the rewrite never touches name/version, so the probe is symmetric).
-    let mut disk_texts: BTreeMap<String, Option<String>> = BTreeMap::new();
-    let mut disk_locks: BTreeMap<String, Option<Value>> = BTreeMap::new();
-    for e in &state.edits {
-        if e.kind == "redirect_npm_lock_entry" && !disk_texts.contains_key(&e.path) {
-            let text = read_rel(project_root, &e.path).await?;
-            let parsed = text
-                .as_deref()
-                .and_then(|c| serde_json::from_str::<Value>(c).ok());
-            disk_texts.insert(e.path.clone(), text);
-            disk_locks.insert(e.path.clone(), parsed);
-        }
-    }
-
-    // Claim this purl's edits. The berry/classic rewriters key edits by
-    // `<name>@<version>`; the pnpm rewriter keys by the canonical INSTANCE
-    // key — `<name>@<version>` for a plain instance, but one edit per
-    // resolved-peer instance keyed `<name>@<version>(<peer>@<ver>)…` (v6) or
-    // `<name>@<version>_<peer-suffix>` (v5) — so pnpm claims accept a `(`/`_`
-    // peer boundary after the exact version (never `-`/`.`/alnum, which
-    // would extend the version into a sibling's, e.g. 1.3.0 vs 1.3.0-rc1).
-    // The legacy npm v2 `dependencies` tree keys by bare name; the v3
-    // `packages` map keys by the lock path. The package-lock JSON kinds carry no version in their
-    // key, so ownership is version-discriminated the way the rewriter
-    // matched (entry `name`+`version`, mod.rs) — name-only would claim a
-    // SIBLING purl's edits (left-pad@1.2.0 vs @1.3.0 both hosted-redirected,
-    // or `npm i name@npm:other` aliasing another package onto this key path)
-    // and replaying those silently un-hosts the other purl while dropping
-    // its edits. bun edits key by the lock's package MAP key (`minimist`,
-    // nested `other/minimist`, an install alias) — never `name@version` —
-    // so they are attributed by the spec of the recorded line, the field
-    // the rewriter matched on (`bun_edit_ownership`); a sibling version's
-    // line is foreign, and a fragment that mentions the package but cannot
-    // be parsed at all refuses rather than guess (dropping the record while
-    // stranding a possibly-own edit would be half a takeover).
-    let mut mine: Vec<usize> = Vec::new();
-    for (i, e) in state.edits.iter().enumerate() {
-        let key = e.key.as_deref().unwrap_or_default();
-        let claimed = match e.kind.as_str() {
-            super::vlt::KIND => super::vlt::claims_key(key, &name, &version),
-            k if NPM_TEXT_KINDS.contains(&k) => {
-                key == lock_key
-                    || (k == "redirect_pnpm_resolution"
-                        && key
-                            .strip_prefix(lock_key.as_str())
-                            .is_some_and(|peer| peer.starts_with('(') || peer.starts_with('_')))
-            }
-            "redirect_npm_lock_dep" => key == name && edit_references_version(e, &version),
-            "redirect_npm_lock_entry" => {
-                let key_name = key
-                    .rsplit_once("node_modules/")
-                    .map(|(_, n)| n)
-                    .unwrap_or(key);
-                match disk_locks
-                    .get(&e.path)
-                    .and_then(|l| l.as_ref())
-                    .and_then(|l| l.get("packages"))
-                    .and_then(|p| p.get(key))
-                {
-                    // The entry is live: attribute it exactly the way the
-                    // rewriter matched it — effective name (the `name` field
-                    // npm writes for alias installs, else the key's trailing
-                    // path; the rewrite never touches either, so the probe
-                    // is symmetric) AND version.
-                    Some(entry) => {
-                        let entry_name = entry
-                            .get("name")
-                            .and_then(Value::as_str)
-                            .unwrap_or(key_name);
-                        entry_name == name
-                            && match entry.get("version").and_then(Value::as_str) {
-                                Some(v) => v == version,
-                                // Version field gone (hand-edited lock): fall
-                                // back to the recorded URLs, which must name
-                                // this exact package AND version — version
-                                // alone would claim a same-version alias
-                                // collision (`npm i <name>@npm:other`, name
-                                // field stripped too) whose live values ARE
-                                // its edit's `new` values, so the replay
-                                // would NOT fail closed and the sibling would
-                                // be silently un-hosted.
-                                None => edit_references_package(e, &name, &version),
-                            }
-                    }
-                    // Entry (or the whole lock) gone: keep the fail-closed
-                    // "no longer exists" refusal for edits attributable to
-                    // this purl — by key path + recorded URLs, or (an alias
-                    // install OF this package keys its entry by the ALIAS,
-                    // so the key path exonerates nothing) by recorded URLs
-                    // naming this exact package. Leaving the alias edit
-                    // unclaimed would drop the record while stranding it —
-                    // half a takeover. A sibling purl's edit is still not
-                    // ours to claim.
-                    None => {
-                        (key_name == name && edit_references_version(e, &version))
-                            || edit_references_package(e, &name, &version)
-                    }
-                }
-            }
-            super::bun_binary::KIND => super::bun_binary::names(e, &name, &version)?,
-            BUN_TEXT_KIND => match bun_edit_ownership(e, &name, &version) {
-                BunClaim::Ours => true,
-                BunClaim::Foreign => false,
-                // The WORKING remedy is the whole-ledger replay: a plain
-                // `bun install` keeps a hosted URL tuple byte-identically
-                // (it re-locks nothing), and hand-editing the ledger is
-                // exactly what the hosted flow tells users never to do.
-                BunClaim::Undecidable => {
-                    return Err(format!(
-                        "the redirect ledger records a {} hosted redirect edit \
-                         that mentions {name} but is not a bun packages entry \
-                         line, so it cannot be attributed to {lock_key}; run an \
-                         unscoped `socket-patch rollback` (the whole-ledger \
-                         replay unwinds bun.lock hosted edits), then re-run; do \
-                         not edit .socket/vendor/redirect-state.json by hand",
-                        e.path
-                    ));
-                }
-            },
-            _ => false,
-        };
-        if claimed {
-            mine.push(i);
-        }
-    }
-
-    let mut out = RedirectRevert::default();
-    let mut staged: Staged = Staged::new();
-    let mut staged_bytes: StagedBytes = StagedBytes::new();
-    let mut vanished_vlt: Vec<usize> = Vec::new();
-    // Newest-first: the hosted flow appends edits, so reverse index order
-    // unwinds re-redirect chains correctly (each step's `original` is the
-    // previous step's `new`).
-    for &i in mine.iter().rev() {
-        let edit = &state.edits[i];
-        if edit.kind == super::bun_binary::KIND {
-            if edit.path != "bun.lockb" {
-                return Err("unexpected binary lock edit path".into());
-            }
-            let path = project_root.join("bun.lockb");
-            let content = match staged_bytes.remove(&edit.path) {
-                Some(pending) => pending,
-                None => {
-                    let metadata = tokio::fs::symlink_metadata(&path)
-                        .await
-                        .map_err(|e| format!("cannot inspect bun.lockb: {e}"))?;
-                    if !metadata.is_file() {
-                        return Err("bun.lockb is not a regular file".into());
-                    }
-                    crate::utils::fs::read_regular_to_bytes(&path)
-                        .await
-                        .map_err(|e| format!("cannot read bun.lockb: {e}"))?
-                }
-            };
-            staged_bytes.insert(
-                edit.path.clone(),
-                super::bun_binary::restore(&content, edit)?,
-            );
-            if !out.reverted_files.iter().any(|p| p == "bun.lockb") {
-                out.reverted_files.push("bun.lockb".into());
-            }
-        } else if replays_as_text_fragment(&edit.kind) {
-            // Whole-fragment replay. For bun the fragments are whole lines
-            // (a CRLF lock's carry their trailing `\r`), so a
-            // `contains`/`replacen` on the raw content restores the line
-            // byte-exactly whatever the line ending.
-            let (Some(new), Some(orig)) = (
-                edit.new.as_ref().and_then(Value::as_str),
-                edit.original.as_ref().and_then(Value::as_str),
-            ) else {
-                return Err(format!(
-                    "the redirect ledger edit for {name} in {} records no \
-                     original fragment; cannot revert the hosted redirect",
-                    edit.path
-                ));
-            };
-            let Some(content) = staged_read(&staged, project_root, &edit.path).await? else {
-                return Err(format!(
-                    "{} no longer exists; cannot revert the recorded hosted \
-                     redirect for {lock_key}",
-                    edit.path
-                ));
-            };
-            if edit.kind == super::vlt::KIND {
-                match super::vlt::revert_vlt_slots(&content, edit)? {
-                    super::vlt::SlotRevert::Restored(restored) => {
-                        staged.insert(edit.path.clone(), Some(restored));
-                        out.reverted_files.push(edit.path.clone());
-                    }
-                    super::vlt::SlotRevert::Unchanged => {}
-                    super::vlt::SlotRevert::Vanished => vanished_vlt.push(i),
-                }
-                continue;
-            }
-            // A yarn block recorded on a CRLF checkout, replayed on an LF
-            // one (or the reverse — `core.autocrlf` re-spells the lock on
-            // every OS switch, never the committed ledger): when neither
-            // fragment matches verbatim, try both in the file's ending.
-            let respelled = (super::yarn_lock_fragment_kind(&edit.kind)
-                && !content.contains(new)
-                && !content.contains(orig))
-            .then(|| crate::utils::line_endings::fragments_in_eol_of(&content, orig, new))
-            .flatten();
-            let (orig, new) = match &respelled {
-                Some((orig, new)) => (orig.as_str(), new.as_str()),
-                None => (orig, new),
-            };
-            if content.contains(new) {
-                staged.insert(edit.path.clone(), Some(content.replacen(new, orig, 1)));
-                out.reverted_files.push(edit.path.clone());
-            } else if content.contains(orig) {
-                // Already at (or unwound to) the pre-redirect fragment.
-            } else {
-                // bun only: Bun 1.1.39–1.3.9 re-save our URL 3-tuple WITHOUT
-                // its sha512 on any later lock re-save, so the recorded
-                // `new` is on disk as a digest-less 2-tuple (same key, spec
-                // and meta). That spelling IS the recorded wiring — restore
-                // `orig` over it; a stale ledger of its own making must not
-                // block the takeover, scoped rollback or remove. Anything
-                // else still refuses (fail closed).
-                let healed = if edit.kind == BUN_TEXT_KIND {
-                    crate::vendor::bun_lock_text::restore_digestless_line(&content, new, orig)
-                        .map_err(|ambiguous| format!("{}: {ambiguous}", edit.path))?
-                } else {
-                    None
-                };
-                match healed {
-                    Some(restored) => {
-                        staged.insert(edit.path.clone(), Some(restored));
-                        out.reverted_files.push(edit.path.clone());
-                    }
-                    None => {
-                        return Err(format!(
-                            "the {} entry for {lock_key} has drifted from the recorded \
-                             hosted redirect (neither the redirected nor the original \
-                             fragment is present); refusing to touch it — re-run \
-                             `scan --mode hosted` to normalize the redirect, or \
-                             restore the registry wiring manually, then re-run",
-                            edit.path
-                        ));
-                    }
-                }
-            }
-        } else {
-            revert_npm_json_edit(
-                project_root,
-                &mut staged,
-                &disk_texts,
-                edit,
-                &name,
-                &version,
-                &mut out,
-            )
-            .await?;
-        }
-    }
-
-    for &i in &vanished_vlt {
-        let edit = &state.edits[i];
-        let Some(content) = staged_read(&staged, project_root, &edit.path).await? else {
-            return Err(format!(
-                "{} no longer exists; cannot revert the recorded hosted \
-                 redirect for {lock_key}",
-                edit.path
-            ));
-        };
-        if let Some(restored) = super::vlt::revert_vanished(&content, edit)? {
-            staged.insert(edit.path.clone(), Some(restored));
-            if !out.reverted_files.contains(&edit.path) {
-                out.reverted_files.push(edit.path.clone());
-            }
-        }
-    }
-
-    // LAST ONE OUT: the `.npmrc` `allow-remote=all` auto-config exists only
-    // for package-lock / shrinkwrap hosted entries (npm >= 12 refuses them
-    // without it). When this purl's revert leaves no such entry in the
-    // ledger, unwind the recorded `.npmrc` edit(s) in the SAME transaction —
-    // scoped rollback / remove of the last npm purl and the vendored
-    // takeover then leave no loosened install policy behind. An ambiguous
-    // `.npmrc` refuses the whole revert (nothing written), like any drift.
-    let mut npmrc_staged: Option<Option<String>> = None;
-    {
-        let dropping: HashSet<usize> = mine.iter().copied().collect();
-        // Checked BEFORE the read: the read refuses a symlinked / non-regular
-        // `.npmrc` here, at plan time — so the whole revert refuses with
-        // nothing written (flush_npmrc refusing it after flush_staged had
-        // already written the lock would strand a reverted lock behind a
-        // ledger that still records the redirect) — but only when the
-        // unwind is actually due.
-        if super::npmrc::npmrc_unwind_due(&state.edits, &dropping) {
-            let current = super::npmrc::read_project_npmrc(project_root)?;
-            if let Some(plan) =
-                super::npmrc::plan_unneeded_npmrc_unwind(&state.edits, &dropping, current)?
-            {
-                if plan.staged.is_some() {
-                    out.reverted_files.push(super::npmrc::NPMRC_REL.to_string());
-                }
-                npmrc_staged = plan.staged;
-                out.warnings.extend(plan.warnings);
-                mine.extend(plan.indices);
-            }
-        }
-    }
-
-    // Every inverse resolved — only now does any of it reach disk, so a
-    // refusal above left the project exactly as it was found. A dry run
-    // skips ONLY the disk flush: the in-memory ledger mutation below still
-    // happens, so composed previews (the whole-ledger replay running after
-    // the per-purl reverts inside one rollback) see exactly the state a
-    // wet run would hand them. The caller owns the state clone and never
-    // persists it on a dry run, so nothing durable changes.
-    if !dry_run {
-        flush_staged(project_root, &staged, &staged_bytes).await?;
-        // After the lock: an I/O fault here leaves the (reverted) lock plus
-        // a still-present `allow-remote=all` — never a hosted lock entry
-        // whose `.npmrc` setting was already taken away.
-        if let Some(npmrc) = &npmrc_staged {
-            super::npmrc::flush_npmrc(project_root, npmrc).await?;
-        }
-    }
-
-    drop_claimed(state, mine, &record_key);
-    Ok(out)
-}
-
-/// Does one of this edit's recorded `resolved` URLs reference `version`?
-///
-/// Version discriminator for the package-lock JSON edit kinds, whose keys
-/// carry no version (`redirect_npm_lock_dep` keys by bare name,
-/// `redirect_npm_lock_entry` by lock path): both the hosted artifact URL
-/// (`…/npm/<name>/<version>/…/<name>-<version>.tgz`) and the registry
-/// tarball URL (`…/-/<name>-<version>.tgz`) embed the version behind a
-/// `/<version>/` or `-<version>.tgz` delimiter, so sibling versions of the
-/// same package never
-/// match each other (`/1.3.0/` is not a substring of `/11.3.0/`, nor
-/// `-1.3.0.tgz` of `-11.3.0.tgz`). Checked against `new` and `original` so
-/// every link of a re-redirect chain (each hosted URL names this purl's
-/// version) attributes correctly. A false positive here is safe — the
-/// replay itself fails closed on any value mismatch — while name-only
-/// claiming silently un-hosts the sibling purl.
-fn edit_references_version(edit: &FileEdit, version: &str) -> bool {
-    let path_seg = format!("/{version}/");
-    let tarball = format!("-{version}.tgz");
-    [&edit.new, &edit.original].into_iter().any(|v| {
-        v.as_ref()
-            .and_then(|o| o.get("resolved"))
-            .and_then(Value::as_str)
-            .is_some_and(|s| s.contains(&path_seg) || s.contains(&tarball))
-    })
-}
-
-/// Does one of this edit's recorded `resolved` URLs reference BOTH `name`
-/// and `version`?
-///
-/// Name-discriminated twin of [`edit_references_version`], for the claims
-/// where the lock key path cannot vouch for the name (an alias install keys
-/// its entry by the alias, and `npm i <name>@npm:other` keys ANOTHER package
-/// by this name's path). The probes are the two URL shapes whole, not
-/// independent name/version substrings: the hosted artifact URL embeds the
-/// name and version as adjacent path segments
-/// (`…/npm/<name>/<version>/…/<bare>-<version>.tgz`) and the registry
-/// tarball URL as `…/<name>/-/<bare>-<version>.tgz` — where a scoped name's
-/// `@scope/` prefix is dropped from the BASENAME only, never from the path.
-/// A match for an UNSCOPED name whose preceding path segment is a scope
-/// (`…/@scope/<name>/…` — the slash closing `@scope` starts the probe) is
-/// rejected: it is a scoped sibling's URL, whose path and basename would
-/// otherwise satisfy independent substring probes at an identical version.
-/// So a sibling purl of a different name — bare or scoped — never matches
-/// even at an identical version.
-fn edit_references_package(edit: &FileEdit, name: &str, version: &str) -> bool {
-    let bare = name.rsplit('/').next().unwrap_or(name);
-    let hosted = format!("/{name}/{version}/");
-    let registry = format!("/{name}/-/{bare}-{version}.tgz");
-    let scoped_sibling = |s: &str, at: usize| {
-        !name.starts_with('@')
-            && s[..at]
-                .rsplit('/')
-                .next()
-                .is_some_and(|seg| seg.starts_with('@'))
-    };
-    let references = |s: &str| {
-        [&hosted, &registry].into_iter().any(|probe| {
-            let mut from = 0;
-            while let Some(pos) = s[from..].find(probe.as_str()) {
-                let at = from + pos;
-                if !scoped_sibling(s, at) {
-                    return true;
-                }
-                from = at + 1;
-            }
-            false
-        })
-    };
-    [&edit.new, &edit.original].into_iter().any(|v| {
-        v.as_ref()
-            .and_then(|o| o.get("resolved"))
-            .and_then(Value::as_str)
-            .is_some_and(references)
-    })
-}
-
-/// Replay one recorded package-lock JSON edit (`redirect_npm_lock_entry` /
-/// `redirect_npm_lock_dep`) through the staged view. `disk_texts` is the
-/// attribution pass's read of the lock (`None` = missing on disk), consulted
-/// before touching the disk again; `staged` still wins over both.
-async fn revert_npm_json_edit(
-    project_root: &Path,
-    staged: &mut Staged,
-    disk_texts: &BTreeMap<String, Option<String>>,
-    edit: &FileEdit,
-    name: &str,
-    version: &str,
-    out: &mut RedirectRevert,
-) -> Result<(), String> {
-    let content = match (staged.get(&edit.path), disk_texts.get(&edit.path)) {
-        (Some(pending), _) => pending.clone(),
-        (None, Some(on_disk)) => on_disk.clone(),
-        (None, None) => read_rel(project_root, &edit.path).await?,
-    };
-    let Some(content) = content else {
-        return Err(format!(
-            "{} no longer exists; cannot revert the recorded hosted redirect \
-             for {name}@{version}",
-            edit.path
-        ));
-    };
-    let mut lock: Value = serde_json::from_str(&content).map_err(|e| {
-        format!(
-            "{} is not valid JSON ({e}); cannot revert the recorded hosted \
-             redirect for {name}@{version}",
-            edit.path
-        )
-    })?;
-    let key = edit.key.as_deref().unwrap_or_default();
-    let changed = match edit.kind.as_str() {
-        "redirect_npm_lock_entry" => {
-            let Some(entry) = lock.get_mut("packages").and_then(|p| p.get_mut(key)) else {
-                return Err(format!(
-                    "the {} entry `{key}` for {name}@{version} no longer \
-                     exists; cannot revert the recorded hosted redirect",
-                    edit.path
-                ));
-            };
-            replay_resolved_integrity(entry, edit, &edit.path, key)?
-        }
-        "redirect_npm_lock_dep" => {
-            let Some(deps) = lock.get_mut("dependencies").and_then(Value::as_object_mut) else {
-                return Err(format!(
-                    "{} no longer holds a `dependencies` tree; cannot revert \
-                     the recorded hosted redirect for {name}@{version}",
-                    edit.path
-                ));
-            };
-            let mut any_found = false;
-            let mut changed = false;
-            revert_v2_deps(
-                deps,
-                name,
-                version,
-                edit,
-                &edit.path,
-                &mut any_found,
-                &mut changed,
-            )?;
-            if !any_found {
-                return Err(format!(
-                    "the {} `dependencies` entry for {name}@{version} no \
-                     longer exists; cannot revert the recorded hosted redirect",
-                    edit.path
-                ));
-            }
-            changed
-        }
-        other => {
-            return Err(format!(
-                "no revert implementation for redirect edit kind `{other}`"
-            ));
-        }
-    };
-    if changed {
-        staged.insert(edit.path.clone(), Some(super::serialize_json(&lock)));
-        out.reverted_files.push(edit.path.clone());
-    }
-    Ok(())
-}
-
-/// Replace an entry's `resolved`/`integrity` with the edit's recorded
-/// originals. `Ok(false)` when the entry already holds the originals;
-/// `Err` (drift, fail closed) when it holds neither the recorded redirected
-/// values nor the originals.
-fn replay_resolved_integrity(
-    entry: &mut Value,
-    edit: &FileEdit,
-    path: &str,
-    key: &str,
-) -> Result<bool, String> {
-    let field = |v: &Option<Value>, f: &str| -> Value {
-        v.as_ref()
-            .and_then(|o| o.get(f))
-            .cloned()
-            .unwrap_or(Value::Null)
-    };
-    let orig_res = field(&edit.original, "resolved");
-    let orig_int = field(&edit.original, "integrity");
-    let cur = |f: &str| entry.get(f).cloned().unwrap_or(Value::Null);
-    if cur("resolved") == orig_res && cur("integrity") == orig_int {
-        return Ok(false); // already at (or unwound to) the pre-redirect values
-    }
-    if cur("resolved") != field(&edit.new, "resolved")
-        || cur("integrity") != field(&edit.new, "integrity")
-    {
-        return Err(format!(
-            "the {path} entry `{key}` has drifted from the recorded hosted \
-             redirect (neither the redirected nor the original \
-             resolved/integrity is present); refusing to touch it — re-run \
-             `scan --mode hosted` to normalize the redirect, or restore the \
-             registry wiring manually, then re-run"
-        ));
-    }
-    let Some(obj) = entry.as_object_mut() else {
-        return Err(format!("the {path} entry `{key}` is not an object"));
-    };
-    for (f, orig) in [("resolved", orig_res), ("integrity", orig_int)] {
-        if orig.is_null() {
-            obj.remove(f);
-        } else {
-            obj.insert(f.to_string(), orig);
-        }
-    }
-    Ok(true)
-}
-
-/// Recursive twin of the rewriter's `rewrite_npm_v2_deps` walk: replay the
-/// edit's originals over every legacy `dependencies` node for this
-/// name+version. Bundled nodes mirror the rewriter's skip — they were never
-/// rewritten, so their registry-shaped (or absent) values must not read as
-/// drift.
-fn revert_v2_deps(
-    deps: &mut serde_json::Map<String, Value>,
-    name: &str,
-    version: &str,
-    edit: &FileEdit,
-    path: &str,
-    any_found: &mut bool,
-    changed: &mut bool,
-) -> Result<(), String> {
-    for (dep_name, entry) in deps.iter_mut() {
-        if dep_name == name
-            && entry.get("version").and_then(Value::as_str) == Some(version)
-            && entry.get("bundled").and_then(Value::as_bool) != Some(true)
-        {
-            *any_found = true;
-            if replay_resolved_integrity(entry, edit, path, dep_name)? {
-                *changed = true;
-            }
-        }
-        if let Some(nested) = entry.get_mut("dependencies").and_then(Value::as_object_mut) {
-            revert_v2_deps(nested, name, version, edit, path, any_found, changed)?;
-        }
-    }
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::manifest::schema::PatchRecord;
-    use std::collections::BTreeMap;
-    use std::collections::HashMap;
-
-    const UUID: &str = "6b7c8d9e-0f1a-4a1b-8c2d-3e4f5a6b7c8d";
-    const PURL: &str = "pkg:cargo/cfg-if@1.0.4";
-    const INDEX: &str = "sparse+http://127.0.0.1:5555/index/";
-    const CRATES_IO: &str = "registry+https://github.com/rust-lang/crates.io-index";
-
-    fn record() -> PatchRecord {
-        PatchRecord {
-            uuid: UUID.to_string(),
-            exported_at: String::new(),
-            files: HashMap::new(),
-            vulnerabilities: HashMap::new(),
-            description: String::new(),
-            license: String::new(),
-            tier: String::new(),
-        }
-    }
-
-    fn pristine_toml() -> String {
-        "[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n[dependencies]\ncfg-if = \"1.0\"\n"
-            .to_string()
-    }
-
-    fn pristine_lock_block() -> String {
-        format!(
-            "[[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\nsource = \"{CRATES_IO}\"\nchecksum = \"{}\"",
-            "9".repeat(64)
-        )
-    }
-
-    /// Run the real hosted rewriter over a pristine project, write its output
-    /// to a tempdir, and return the resulting ledger — the exact state the
-    /// takeover revert consumes in production.
-    async fn redirected_fixture() -> (tempfile::TempDir, RedirectState) {
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        let lock = format!(
-            "# This file is automatically @generated by Cargo.\nversion = 4\n\n{}\n",
-            pristine_lock_block()
-        );
-        let mut files: BTreeMap<String, String> = BTreeMap::new();
-        files.insert("Cargo.toml".into(), pristine_toml());
-        files.insert("Cargo.lock".into(), lock.clone());
-        let dep: crate::patch::redirect::DepOverride = serde_json::from_value(serde_json::json!({
-            "ecosystem": "cargo",
-            "name": "cfg-if",
-            "version": "1.0.4",
-            "token": "tok",
-            "patchUuid": UUID,
-            "artifactUrl": format!("http://127.0.0.1:5555/cfg-if-1.0.4.crate"),
-            "registryOverride": {
-                "kind": "cargo-sparse",
-                "indexUrl": INDEX,
-                "identifiers": {
-                    "name": "cfg-if", "version": "1.0.4",
-                    "cargoCksumSha256": "a".repeat(64),
-                },
-            },
-            "integrity": { "sha256": "a".repeat(64) },
-        }))
-        .unwrap();
-        let rewrite = crate::patch::redirect::rewrite_registry_redirect(&files, &[dep]);
-        tokio::fs::write(root.join("Cargo.toml"), &pristine_toml())
-            .await
-            .unwrap();
-        tokio::fs::write(root.join("Cargo.lock"), &lock)
-            .await
-            .unwrap();
-        for (rel, content) in &rewrite.files {
-            let path = root.join(rel);
-            if let Some(parent) = path.parent() {
-                tokio::fs::create_dir_all(parent).await.unwrap();
-            }
-            tokio::fs::write(&path, content).await.unwrap();
-        }
-        let mut state = RedirectState::new();
-        state.edits = rewrite.edits;
-        state.records.insert(PURL.to_string(), record());
-        (tmp, state)
-    }
-
-    /// Two redirected versions of one crate share the manifest edit key
-    /// (the crate name). Removing one version must revert ONLY its own
-    /// declaration + lock entry + registry block — claiming the sibling's
-    /// manifest edit would revert the other pin while its lock entry stayed
-    /// hosted (a broken build), and dropping the sibling's registry edit
-    /// would leave the created `.cargo/config.toml` behind on the second
-    /// removal.
-    #[tokio::test]
-    async fn multi_version_removes_each_version_independently() {
-        const UUID_OLD: &str = "3c5d7e9f-2a4b-4c6d-8e0f-1a3b5c7d9e1f";
-        const PURL_OLD: &str = "pkg:cargo/cfg-if@0.1.10";
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        let toml = "[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n[dependencies]\n\
-                    cfg-if = \"1.0\"\ncfg-if-legacy = { package = \"cfg-if\", version = \"0.1.10\" }\n";
-        let lock = format!(
-            "version = 4\n\n[[package]]\nname = \"cfg-if\"\nversion = \"0.1.10\"\n\
-             source = \"{CRATES_IO}\"\nchecksum = \"{}\"\n\n{}\n",
-            "8".repeat(64),
-            pristine_lock_block()
-        );
-        let dep = |version: &str, uuid: &str| -> crate::patch::redirect::DepOverride {
-            serde_json::from_value(serde_json::json!({
-                "ecosystem": "cargo", "name": "cfg-if", "version": version, "token": "tok",
-                "patchUuid": uuid,
-                "artifactUrl": format!("http://127.0.0.1:5555/cfg-if-{version}.crate"),
-                "registryOverride": {
-                    "kind": "cargo-sparse",
-                    "indexUrl": format!("sparse+http://127.0.0.1:5555/{uuid}/index/"),
-                    "identifiers": {
-                        "name": "cfg-if", "version": version,
-                        "cargoCksumSha256": "a".repeat(64),
-                    },
-                },
-                "integrity": { "sha256": "a".repeat(64) },
-            }))
-            .unwrap()
-        };
-        let mut files: BTreeMap<String, String> = BTreeMap::new();
-        files.insert("Cargo.toml".into(), toml.to_string());
-        files.insert("Cargo.lock".into(), lock.clone());
-        let rewrite = crate::patch::redirect::rewrite_registry_redirect(
-            &files,
-            &[dep("1.0.4", UUID), dep("0.1.10", UUID_OLD)],
-        );
-        assert_eq!(
-            rewrite.confirmed_cargo_uuids.len(),
-            2,
-            "{:?}",
-            rewrite.warnings
-        );
-        tokio::fs::write(root.join("Cargo.toml"), toml)
-            .await
-            .unwrap();
-        tokio::fs::write(root.join("Cargo.lock"), &lock)
-            .await
-            .unwrap();
-        for (rel, content) in &rewrite.files {
-            let path = root.join(rel);
-            tokio::fs::create_dir_all(path.parent().unwrap())
-                .await
-                .unwrap();
-            tokio::fs::write(&path, content).await.unwrap();
-        }
-        let mut state = RedirectState::new();
-        state.edits = rewrite.edits;
-        state.records.insert(PURL.to_string(), record());
-        let mut old = record();
-        old.uuid = UUID_OLD.to_string();
-        state.records.insert(PURL_OLD.to_string(), old);
-
-        revert_cargo_redirect_purl(root, &mut state, PURL, false)
-            .await
-            .expect("1.0.4 reverts");
-        let t = tokio::fs::read_to_string(root.join("Cargo.toml"))
-            .await
-            .unwrap();
-        assert!(
-            t.contains("cfg-if = \"1.0\"\n")
-                && t.contains(&format!("registry = \"socket-patch-{UUID_OLD}\"")),
-            "only the 1.0.4 pin is reverted: {t}"
-        );
-        let l = tokio::fs::read_to_string(root.join("Cargo.lock"))
-            .await
-            .unwrap();
-        assert!(
-            l.contains(&format!("sparse+http://127.0.0.1:5555/{UUID_OLD}/index/")),
-            "{l}"
-        );
-        let cfg = tokio::fs::read_to_string(root.join(".cargo/config.toml"))
-            .await
-            .unwrap();
-        assert!(
-            !cfg.contains(&format!("socket-patch-{UUID}]")) && cfg.contains(UUID_OLD),
-            "{cfg}"
-        );
-
-        revert_cargo_redirect_purl(root, &mut state, PURL_OLD, false)
-            .await
-            .expect("0.1.10 reverts");
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("Cargo.toml"))
-                .await
-                .unwrap(),
-            toml
-        );
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("Cargo.lock"))
-                .await
-                .unwrap(),
-            lock
-        );
-        assert!(
-            !root.join(".cargo/config.toml").exists(),
-            "the created config goes with the last block"
-        );
-        assert!(
-            state.edits.is_empty() && state.records.is_empty(),
-            "{:?}",
-            state.edits
-        );
-    }
-
-    /// A hosted override for `name@version` at patch `uuid`.
-    fn cargo_dep(name: &str, version: &str, uuid: &str) -> crate::patch::redirect::DepOverride {
-        serde_json::from_value(serde_json::json!({
-            "ecosystem": "cargo", "name": name, "version": version, "token": "tok",
-            "patchUuid": uuid,
-            "artifactUrl": format!("http://127.0.0.1:5555/{name}-{version}.crate"),
-            "registryOverride": {
-                "kind": "cargo-sparse",
-                "indexUrl": format!("sparse+http://127.0.0.1:5555/{uuid}/index/"),
-                "identifiers": {
-                    "name": name, "version": version,
-                    "cargoCksumSha256": "a".repeat(64),
-                },
-            },
-            "integrity": { "sha256": "a".repeat(64) },
-        }))
-        .unwrap()
-    }
-
-    /// Redirect `deps` (applied in order) over a pristine project with the
-    /// real rewriter, write the output to a tempdir, and return the ledger
-    /// with one record per purl.
-    async fn redirect_on_disk(
-        toml: &str,
-        lock: &str,
-        deps: &[(&str, &str, &str)],
-    ) -> (tempfile::TempDir, RedirectState) {
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        let mut files: BTreeMap<String, String> = BTreeMap::new();
-        files.insert("Cargo.toml".into(), toml.to_string());
-        files.insert("Cargo.lock".into(), lock.to_string());
-        let overrides: Vec<_> = deps
-            .iter()
-            .map(|(name, version, uuid)| cargo_dep(name, version, uuid))
-            .collect();
-        let rewrite = crate::patch::redirect::rewrite_registry_redirect(&files, &overrides);
-        assert_eq!(
-            rewrite.confirmed_cargo_uuids.len(),
-            deps.len(),
-            "{:?}",
-            rewrite.warnings
-        );
-        for (rel, content) in files.iter().chain(rewrite.files.iter()) {
-            let path = root.join(rel);
-            tokio::fs::create_dir_all(path.parent().unwrap())
-                .await
-                .unwrap();
-            tokio::fs::write(&path, content).await.unwrap();
-        }
-        let mut state = RedirectState::new();
-        state.edits = rewrite.edits;
-        for (name, version, uuid) in deps {
-            let mut rec = record();
-            rec.uuid = uuid.to_string();
-            state
-                .records
-                .insert(format!("pkg:cargo/{name}@{version}"), rec);
-        }
-        (tmp, state)
-    }
-
-    /// Redirect `deps`, then remove the purls in EVERY order: each order
-    /// must succeed and restore the manifest and lock byte-for-byte, with no
-    /// config and no ledger left.
-    async fn assert_removes_in_every_order(toml: &str, lock: &str, deps: &[(&str, &str, &str)]) {
-        let purls: Vec<String> = deps
-            .iter()
-            .map(|(name, version, _)| format!("pkg:cargo/{name}@{version}"))
-            .collect();
-        for order in [purls.clone(), purls.iter().rev().cloned().collect()] {
-            let (tmp, mut state) = redirect_on_disk(toml, lock, deps).await;
-            let root = tmp.path();
-            for purl in &order {
-                revert_cargo_redirect_purl(root, &mut state, purl, false)
-                    .await
-                    .unwrap_or_else(|e| panic!("remove {purl} (order {order:?}): {e}"));
-            }
-            assert_eq!(
-                tokio::fs::read_to_string(root.join("Cargo.toml"))
-                    .await
-                    .unwrap(),
-                toml,
-                "{order:?}"
-            );
-            assert_eq!(
-                tokio::fs::read_to_string(root.join("Cargo.lock"))
-                    .await
-                    .unwrap(),
-                lock,
-                "{order:?}"
-            );
-            assert!(!root.join(".cargo/config.toml").exists(), "{order:?}");
-            assert!(
-                state.edits.is_empty() && state.records.is_empty(),
-                "{order:?}: {:?}",
-                state.edits
-            );
-        }
-    }
-
-    /// A v1 lock names every dependency by its full id, so the root block
-    /// references BOTH patched cfg-if versions. Removing the versions in any
-    /// order must succeed — not only in exact reverse apply order.
-    #[tokio::test]
-    async fn v1_lock_multi_version_removes_in_any_order() {
-        const UUID_OLD: &str = "3c5d7e9f-2a4b-4c6d-8e0f-1a3b5c7d9e1f";
-        let toml = "[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n[dependencies]\n\
-                    cfg-if = \"1.0\"\ncfg-if-legacy = { package = \"cfg-if\", version = \"0.1.10\" }\n";
-        let lock = format!(
-            "[[package]]\nname = \"app\"\nversion = \"0.1.0\"\ndependencies = [\n \
-             \"cfg-if 0.1.10 ({CRATES_IO})\",\n \"cfg-if 1.0.4 ({CRATES_IO})\",\n]\n\n\
-             [[package]]\nname = \"cfg-if\"\nversion = \"0.1.10\"\nsource = \"{CRATES_IO}\"\n\n\
-             [[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\nsource = \"{CRATES_IO}\"\n\n\
-             [metadata]\n\"checksum cfg-if 0.1.10 ({CRATES_IO})\" = \"{}\"\n\
-             \"checksum cfg-if 1.0.4 ({CRATES_IO})\" = \"{}\"\n",
-            "8".repeat(64),
-            "9".repeat(64)
-        );
-        assert_removes_in_every_order(
-            toml,
-            &lock,
-            &[("cfg-if", "1.0.4", UUID), ("cfg-if", "0.1.10", UUID_OLD)],
-        )
-        .await;
-    }
-
-    const UUID_LEGACY: &str = "3c5d7e9f-2a4b-4c6d-8e0f-1a3b5c7d9e1f";
-
-    /// The two-declaration cfg-if project (1.0.4 as `cfg-if`, 0.1.10 as a
-    /// renamed `cfg-if-legacy`) and its crates.io lock.
-    fn multi_version_project() -> (String, String) {
-        let toml = "[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n[dependencies]\n\
-                    cfg-if = \"1.0\"\ncfg-if-legacy = { package = \"cfg-if\", version = \"0.1.10\" }\n";
-        let lock = format!(
-            "version = 4\n\n[[package]]\nname = \"cfg-if\"\nversion = \"0.1.10\"\n\
-             source = \"{CRATES_IO}\"\nchecksum = \"{}\"\n\n{}\n",
-            "8".repeat(64),
-            pristine_lock_block()
-        );
-        (toml.to_string(), lock)
-    }
-
-    /// Remove `order` from `state` over `root`, then require the pristine
-    /// project back with no config and an empty ledger.
-    async fn remove_all_and_expect_pristine(
-        root: &Path,
-        mut state: RedirectState,
-        order: &[&str],
-        toml: &str,
-        lock: &str,
-    ) {
-        for purl in order {
-            revert_cargo_redirect_purl(root, &mut state, purl, false)
-                .await
-                .unwrap_or_else(|e| panic!("remove {purl} (order {order:?}): {e}"));
-        }
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("Cargo.toml"))
-                .await
-                .unwrap(),
-            toml,
-            "{order:?}"
-        );
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("Cargo.lock"))
-                .await
-                .unwrap(),
-            lock,
-            "{order:?}"
-        );
-        assert!(!root.join(".cargo/config.toml").exists(), "{order:?}");
-        assert!(
-            state.edits.is_empty() && state.records.is_empty(),
-            "{order:?}: {:?}",
-            state.edits
-        );
-    }
-
-    /// A ledger an older CLI wrote with its name-only manifest matcher for
-    /// both cfg-if versions: each run pinned BOTH declarations to its own
-    /// registry, so the file ends with both on the 0.1.10 registry and the
-    /// ledger holds plain→1.0.4 then 1.0.4→0.1.10 edits for both lines.
-    /// Removing either version first must neither refuse as drifted (by
-    /// claiming only half of a declaration's chain) nor drop a
-    /// still-referenced registry edit and leave the config behind.
-    #[tokio::test]
-    async fn legacy_name_only_multi_version_ledger_removes_in_any_order() {
-        let (toml, lock) = multi_version_project();
-        let reg = |uuid: &str| format!("socket-patch-{uuid}");
-        let index = |uuid: &str| format!("sparse+http://127.0.0.1:5555/{uuid}/index/");
-        let line1 = |r: Option<&str>| match r {
-            None => "cfg-if = \"1.0\"".to_string(),
-            Some(r) => format!("cfg-if = {{ version = \"1.0\", registry = \"{r}\" }}"),
-        };
-        let line2 = |r: Option<&str>| {
-            match r {
-            None => "cfg-if-legacy = { package = \"cfg-if\", version = \"0.1.10\" }".to_string(),
-            Some(r) => format!(
-                "cfg-if-legacy = {{ package = \"cfg-if\", version = \"0.1.10\", registry = \"{r}\" }}"
-            ),
-        }
-        };
-        let block = |version: &str, source: &str, cksum: &str| {
-            format!(
-                "[[package]]\nname = \"cfg-if\"\nversion = \"{version}\"\nsource = \"{source}\"\n\
-                 checksum = \"{cksum}\""
-            )
-        };
-        let (a, b) = (reg(UUID), reg(UUID_LEGACY));
-        let edit =
-            |path: &str, kind: &str, key: &str, orig: Option<String>, new: String| FileEdit {
-                path: path.to_string(),
-                kind: kind.to_string(),
-                action: if orig.is_some() { "rewritten" } else { "added" }.to_string(),
-                key: Some(key.to_string()),
-                original: orig.map(Value::String),
-                new: Some(Value::String(new)),
-            };
-        let registry = |uuid: &str| {
-            edit(
-                ".cargo/config.toml",
-                "redirect_cargo_registry",
-                &reg(uuid),
-                None,
-                format!("[registries.{}]\nindex = \"{}\"\n", reg(uuid), index(uuid)),
-            )
-        };
-        let lock_edit = |version: &str, uuid: &str, crates_cksum: &str| {
-            edit(
-                "Cargo.lock",
-                "redirect_cargo_lock_entry",
-                &format!("cfg-if@{version}"),
-                Some(block(version, CRATES_IO, crates_cksum)),
-                block(version, &index(uuid), &"a".repeat(64)),
-            )
-        };
-        let toml_edit = |orig: String, new: String| {
-            edit(
-                "Cargo.toml",
-                "redirect_cargo_toml_dep",
-                "cfg-if",
-                Some(orig),
-                new,
-            )
-        };
-        let edits = vec![
-            registry(UUID),
-            toml_edit(line1(None), line1(Some(&a))),
-            toml_edit(line2(None), line2(Some(&a))),
-            lock_edit("1.0.4", UUID, &"9".repeat(64)),
-            registry(UUID_LEGACY),
-            toml_edit(line1(Some(&a)), line1(Some(&b))),
-            toml_edit(line2(Some(&a)), line2(Some(&b))),
-            lock_edit("0.1.10", UUID_LEGACY, &"8".repeat(64)),
-        ];
-        let live_toml = toml
-            .replace(&line1(None), &line1(Some(&b)))
-            .replace(&line2(None), &line2(Some(&b)));
-        let live_lock = lock
-            .replace(
-                &block("1.0.4", CRATES_IO, &"9".repeat(64)),
-                &block("1.0.4", &index(UUID), &"a".repeat(64)),
-            )
-            .replace(
-                &block("0.1.10", CRATES_IO, &"8".repeat(64)),
-                &block("0.1.10", &index(UUID_LEGACY), &"a".repeat(64)),
-            );
-        let live_config = format!(
-            "{}\n{}",
-            edits[0].new.as_ref().and_then(Value::as_str).unwrap(),
-            edits[4].new.as_ref().and_then(Value::as_str).unwrap()
-        );
-        for order in [
-            ["pkg:cargo/cfg-if@1.0.4", "pkg:cargo/cfg-if@0.1.10"],
-            ["pkg:cargo/cfg-if@0.1.10", "pkg:cargo/cfg-if@1.0.4"],
-        ] {
-            let tmp = tempfile::tempdir().unwrap();
-            let root = tmp.path();
-            tokio::fs::create_dir_all(root.join(".cargo"))
-                .await
-                .unwrap();
-            tokio::fs::write(root.join("Cargo.toml"), &live_toml)
-                .await
-                .unwrap();
-            tokio::fs::write(root.join("Cargo.lock"), &live_lock)
-                .await
-                .unwrap();
-            tokio::fs::write(root.join(".cargo/config.toml"), &live_config)
-                .await
-                .unwrap();
-            let mut state = RedirectState::new();
-            state.edits = edits.clone();
-            state.records.insert(PURL.to_string(), record());
-            let mut old = record();
-            old.uuid = UUID_LEGACY.to_string();
-            state
-                .records
-                .insert("pkg:cargo/cfg-if@0.1.10".to_string(), old);
-            remove_all_and_expect_pristine(root, state, &order, &toml, &lock).await;
-        }
-    }
-
-    /// An older CLI redirected only 1.0.4 and its name-only matcher also
-    /// pinned the 0.1.10 declaration to 1.0.4's registry; the current
-    /// planner then repaired it (superseding that pin with 0.1.10's own
-    /// registry) while redirecting 0.1.10. Removing 1.0.4 must not claim the
-    /// superseded mis-pin edit (whose fragments are both gone) and refuse as
-    /// drifted.
-    #[tokio::test]
-    async fn repaired_legacy_mispin_removes_in_any_order() {
-        let (toml, lock) = multi_version_project();
-        let legacy = "cfg-if-legacy = { package = \"cfg-if\", version = \"0.1.10\" }";
-        let mispinned = format!(
-            "cfg-if-legacy = {{ package = \"cfg-if\", version = \"0.1.10\", registry = \"socket-patch-{UUID}\" }}"
-        );
-        // The old CLI's run: 1.0.4 only, plus its mis-pin of the legacy line.
-        let mut files: BTreeMap<String, String> = BTreeMap::new();
-        files.insert("Cargo.toml".into(), toml.clone());
-        files.insert("Cargo.lock".into(), lock.clone());
-        let old_run = crate::patch::redirect::rewrite_registry_redirect(
-            &files,
-            &[cargo_dep("cfg-if", "1.0.4", UUID)],
-        );
-        let mut edits = old_run.edits.clone();
-        let at = edits
-            .iter()
-            .position(|e| e.kind == "redirect_cargo_toml_dep")
-            .unwrap();
-        let mut mispin = edits[at].clone();
-        mispin.original = Some(Value::String(legacy.to_string()));
-        mispin.new = Some(Value::String(mispinned.clone()));
-        edits.insert(at + 1, mispin);
-        let mut live = files.clone();
-        live.extend(old_run.files.clone());
-        let t = live["Cargo.toml"].replace(legacy, &mispinned);
-        live.insert("Cargo.toml".into(), t);
-        // The current CLI's run with both patches repairs the mis-pin.
-        let new_run = crate::patch::redirect::rewrite_registry_redirect(
-            &live,
-            &[
-                cargo_dep("cfg-if", "1.0.4", UUID),
-                cargo_dep("cfg-if", "0.1.10", UUID_LEGACY),
-            ],
-        );
-        assert!(new_run.warnings.is_empty(), "{:?}", new_run.warnings);
-        edits.extend(new_run.edits.clone());
-        live.extend(new_run.files.clone());
-        for order in [
-            ["pkg:cargo/cfg-if@1.0.4", "pkg:cargo/cfg-if@0.1.10"],
-            ["pkg:cargo/cfg-if@0.1.10", "pkg:cargo/cfg-if@1.0.4"],
-        ] {
-            let tmp = tempfile::tempdir().unwrap();
-            let root = tmp.path();
-            for (rel, content) in &live {
-                let path = root.join(rel);
-                tokio::fs::create_dir_all(path.parent().unwrap())
-                    .await
-                    .unwrap();
-                tokio::fs::write(&path, content).await.unwrap();
-            }
-            let mut state = RedirectState::new();
-            state.edits = edits.clone();
-            state.records.insert(PURL.to_string(), record());
-            let mut old = record();
-            old.uuid = UUID_LEGACY.to_string();
-            state
-                .records
-                .insert("pkg:cargo/cfg-if@0.1.10".to_string(), old);
-            remove_all_and_expect_pristine(root, state, &order, &toml, &lock).await;
-        }
-    }
-
-    /// The whole-ledger replay (rollback) inverts a v1 full-id reference
-    /// named by several dependents at every occurrence.
-    #[tokio::test]
-    async fn v1_lock_reference_named_by_several_dependents_replays_clean() {
-        let toml = "[workspace]\nmembers = [\"a\", \"b\"]\n\n\
-                    [workspace.dependencies]\ncfg-if = \"1.0\"\n";
-        let member = |name: &str| {
-            format!(
-                "[package]\nname = \"{name}\"\nversion = \"0.1.0\"\n\n\
-                 [dependencies]\ncfg-if = {{ workspace = true }}\n"
-            )
-        };
-        let lock = format!(
-            "[[package]]\nname = \"a\"\nversion = \"0.1.0\"\ndependencies = [\n \
-             \"cfg-if 1.0.4 ({CRATES_IO})\",\n]\n\n\
-             [[package]]\nname = \"b\"\nversion = \"0.1.0\"\ndependencies = [\n \
-             \"cfg-if 1.0.4 ({CRATES_IO})\",\n]\n\n\
-             [[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\nsource = \"{CRATES_IO}\"\n\n\
-             [metadata]\n\"checksum cfg-if 1.0.4 ({CRATES_IO})\" = \"{}\"\n",
-            "9".repeat(64)
-        );
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        let mut files: BTreeMap<String, String> = BTreeMap::new();
-        files.insert("Cargo.toml".into(), toml.to_string());
-        files.insert("Cargo.lock".into(), lock.clone());
-        files.insert("a/Cargo.toml".into(), member("a"));
-        files.insert("b/Cargo.toml".into(), member("b"));
-        let rewrite = crate::patch::redirect::rewrite_registry_redirect(
-            &files,
-            &[cargo_dep("cfg-if", "1.0.4", UUID)],
-        );
-        assert_eq!(
-            rewrite.confirmed_cargo_uuids.len(),
-            1,
-            "{:?}",
-            rewrite.warnings
-        );
-        let references: Vec<&FileEdit> = rewrite
-            .edits
-            .iter()
-            .filter(|e| e.kind == super::super::CARGO_LOCK_REFERENCE_KIND)
-            .collect();
-        assert_eq!(
-            references.len(),
-            1,
-            "one edit per full id: {:?}",
-            rewrite.edits
-        );
-        for (rel, content) in files.iter().chain(rewrite.files.iter()) {
-            let path = root.join(rel);
-            tokio::fs::create_dir_all(path.parent().unwrap())
-                .await
-                .unwrap();
-            tokio::fs::write(&path, content).await.unwrap();
-        }
-        let mut state = RedirectState::new();
-        state.edits = rewrite.edits;
-        state.records.insert(PURL.to_string(), record());
-        let outcome =
-            crate::patch::redirect::revert_remaining_redirect_edits(root, &mut state, false).await;
-        assert!(outcome.fully_reverted(), "{:?}", outcome.refusals);
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("Cargo.lock"))
-                .await
-                .unwrap(),
-            lock
-        );
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("Cargo.toml"))
-                .await
-                .unwrap(),
-            toml
-        );
-    }
-
-    /// Two different patched crates with one shared v1 dependent block.
-    #[tokio::test]
-    async fn v1_lock_two_crates_sharing_a_dependent_remove_in_any_order() {
-        const UUID_ITOA: &str = "4d6e8f0a-3b5c-4d7e-9f1a-2b4c6d8e0f2a";
-        let toml = "[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n[dependencies]\n\
-                    cfg-if = \"1.0\"\nitoa = \"1.0.11\"\n";
-        let lock = format!(
-            "[[package]]\nname = \"app\"\nversion = \"0.1.0\"\ndependencies = [\n \
-             \"cfg-if 1.0.4 ({CRATES_IO})\",\n \"itoa 1.0.11 ({CRATES_IO})\",\n]\n\n\
-             [[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\nsource = \"{CRATES_IO}\"\n\n\
-             [[package]]\nname = \"itoa\"\nversion = \"1.0.11\"\nsource = \"{CRATES_IO}\"\n\n\
-             [metadata]\n\"checksum cfg-if 1.0.4 ({CRATES_IO})\" = \"{}\"\n\
-             \"checksum itoa 1.0.11 ({CRATES_IO})\" = \"{}\"\n",
-            "8".repeat(64),
-            "9".repeat(64)
-        );
-        assert_removes_in_every_order(
-            toml,
-            &lock,
-            &[("cfg-if", "1.0.4", UUID), ("itoa", "1.0.11", UUID_ITOA)],
-        )
-        .await;
-    }
-
-    #[tokio::test]
-    async fn reverts_toml_lock_and_registry_block_and_drops_ledger_entries() {
-        let (tmp, mut state) = redirected_fixture().await;
-        let root = tmp.path();
-        // Sanity: the fixture really is hosted-wired.
-        let toml = tokio::fs::read_to_string(root.join("Cargo.toml"))
-            .await
-            .unwrap();
-        assert!(toml.contains("socket-patch-"), "{toml}");
-
-        let out = revert_cargo_redirect_purl(root, &mut state, PURL, false)
-            .await
-            .expect("revert succeeds");
-        assert!(!out.reverted_files.is_empty());
-
-        let toml = tokio::fs::read_to_string(root.join("Cargo.toml"))
-            .await
-            .unwrap();
-        assert_eq!(toml, pristine_toml(), "Cargo.toml restored byte-identical");
-        let lock = tokio::fs::read_to_string(root.join("Cargo.lock"))
-            .await
-            .unwrap();
-        assert!(
-            lock.contains(CRATES_IO),
-            "crates.io source restored: {lock}"
-        );
-        assert!(!lock.contains("sparse+"), "hosted index gone: {lock}");
-        assert!(
-            !root.join(".cargo/config.toml").exists(),
-            "socket-only config removed"
-        );
-        assert!(state.records.is_empty(), "record dropped");
-        assert!(state.edits.is_empty(), "edits dropped");
-    }
-
-    #[tokio::test]
-    async fn preserves_user_config_content_when_removing_the_registry_block() {
-        let (tmp, mut state) = redirected_fixture().await;
-        let root = tmp.path();
-        // Prepend user content to the config the rewrite created.
-        let cfg_path = root.join(".cargo/config.toml");
-        let cfg = tokio::fs::read_to_string(&cfg_path).await.unwrap();
-        tokio::fs::write(&cfg_path, format!("[net]\nretry = 2\n{cfg}"))
-            .await
-            .unwrap();
-
-        revert_cargo_redirect_purl(root, &mut state, PURL, false)
-            .await
-            .expect("revert succeeds");
-        let cfg = tokio::fs::read_to_string(&cfg_path).await.unwrap();
-        assert!(cfg.contains("[net]"), "user content kept: {cfg}");
-        assert!(!cfg.contains("socket-patch-"), "block removed: {cfg}");
-    }
-
-    #[tokio::test]
-    async fn refuses_on_drifted_lock_fail_closed() {
-        let (tmp, mut state) = redirected_fixture().await;
-        let root = tmp.path();
-        // A third party re-resolved the lock to a shape the ledger never saw.
-        tokio::fs::write(
-            root.join("Cargo.lock"),
-            "version = 4\n\n[[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\nsource = \"registry+https://corp.example/index\"\n",
-        )
-        .await
-        .unwrap();
-        let records_before = state.records.len();
-        let edits_before = state.edits.len();
-
-        let err = revert_cargo_redirect_purl(root, &mut state, PURL, false)
-            .await
-            .expect_err("drifted lock must refuse");
-        assert!(err.contains("drifted"), "{err}");
-        // The ledger keeps everything on refusal.
-        assert_eq!(state.records.len(), records_before);
-        assert_eq!(state.edits.len(), edits_before);
-    }
-
-    /// The unwind runs newest-first (edits are recorded config, manifest,
-    /// lock), so Cargo.lock's inverse resolves BEFORE Cargo.toml's. Drifting
-    /// only Cargo.toml therefore refuses at a point where the lock's inverse
-    /// has already been decided — and the caller reports the purl as
-    /// untouched ("cannot vendor over the live hosted redirect"), so a
-    /// revert that had written the lock by then would leave the project
-    /// half-hosted behind a message saying nothing happened.
-    #[tokio::test]
-    async fn a_later_drifted_edit_leaves_every_earlier_file_untouched() {
-        let (tmp, mut state) = redirected_fixture().await;
-        let root = tmp.path();
-        let drifted_toml =
-            "[package]\nname = \"app\"\nversion = \"0.1.0\"\n\n[dependencies]\ncfg-if = { version = \"1.0\", registry = \"corp-mirror\" }\n";
-        tokio::fs::write(root.join("Cargo.toml"), drifted_toml)
-            .await
-            .unwrap();
-        let lock_before = tokio::fs::read_to_string(root.join("Cargo.lock"))
-            .await
-            .unwrap();
-        let cfg_before = tokio::fs::read_to_string(root.join(".cargo/config.toml"))
-            .await
-            .unwrap();
-        assert!(
-            lock_before.contains("sparse+"),
-            "fixture is hosted-wired: {lock_before}"
-        );
-
-        let err = revert_cargo_redirect_purl(root, &mut state, PURL, false)
-            .await
-            .expect_err("drifted manifest must refuse");
-        assert!(err.contains("drifted"), "{err}");
-
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("Cargo.lock"))
-                .await
-                .unwrap(),
-            lock_before,
-            "Cargo.lock must be untouched — its inverse resolved before the refusal"
-        );
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("Cargo.toml"))
-                .await
-                .unwrap(),
-            drifted_toml,
-            "Cargo.toml untouched"
-        );
-        assert_eq!(
-            tokio::fs::read_to_string(root.join(".cargo/config.toml"))
-                .await
-                .unwrap(),
-            cfg_before,
-            ".cargo/config.toml untouched"
-        );
-        assert!(!state.records.is_empty(), "ledger keeps the record");
-        assert!(!state.edits.is_empty(), "ledger keeps the edits");
-    }
-
-    #[tokio::test]
-    async fn missing_record_is_an_error() {
-        let tmp = tempfile::tempdir().unwrap();
-        let mut state = RedirectState::new();
-        let err = revert_cargo_redirect_purl(tmp.path(), &mut state, PURL, false)
-            .await
-            .expect_err("no record");
-        assert!(err.contains("records no hosted redirect"), "{err}");
-    }
-
-    #[tokio::test]
-    async fn dry_run_previews_the_wet_summary_without_touching_disk_or_ledger() {
-        let (tmp, mut state) = redirected_fixture().await;
-        let root = tmp.path();
-        let toml_before = tokio::fs::read_to_string(root.join("Cargo.toml"))
-            .await
-            .unwrap();
-        let lock_before = tokio::fs::read_to_string(root.join("Cargo.lock"))
-            .await
-            .unwrap();
-        let cfg_before = tokio::fs::read_to_string(root.join(".cargo/config.toml"))
-            .await
-            .unwrap();
-        let records_before = state.records.len();
-        let edits_before = state.edits.len();
-
-        let dry = revert_cargo_redirect_purl(root, &mut state, PURL, true)
-            .await
-            .expect("dry-run revert succeeds");
-
-        // Nothing reached disk (the in-memory claim is checked below; the
-        // persisted ledger is the caller's and is never written on a dry run).
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("Cargo.toml"))
-                .await
-                .unwrap(),
-            toml_before,
-            "Cargo.toml untouched"
-        );
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("Cargo.lock"))
-                .await
-                .unwrap(),
-            lock_before,
-            "Cargo.lock untouched"
-        );
-        assert_eq!(
-            tokio::fs::read_to_string(root.join(".cargo/config.toml"))
-                .await
-                .unwrap(),
-            cfg_before,
-            ".cargo/config.toml untouched"
-        );
-        // The IN-MEMORY ledger is claimed exactly like a wet run (composed
-        // previews — the whole-ledger replay running after per-purl
-        // reverts — must see the post-claim state); the caller owns the
-        // clone and never persists it on a dry run.
-        assert!(
-            state.records.len() < records_before,
-            "record claimed in memory"
-        );
-        assert!(state.edits.len() < edits_before, "edits claimed in memory");
-
-        // The preview names exactly the files a wet run then reverts —
-        // re-run wet on a FRESH state clone of the same fixture.
-        let (tmp2, mut state2) = redirected_fixture().await;
-        let root = tmp2.path();
-        let wet = revert_cargo_redirect_purl(root, &mut state2, PURL, false)
-            .await
-            .expect("wet revert succeeds");
-        assert_eq!(dry.reverted_files, wet.reverted_files);
-    }
-
-    #[tokio::test]
-    async fn dry_run_still_fail_closes_on_drift() {
-        let (tmp, mut state) = redirected_fixture().await;
-        let root = tmp.path();
-        // Same drift as the wet refusal above: a third party re-resolved the
-        // lock to a shape the ledger never saw.
-        tokio::fs::write(
-            root.join("Cargo.lock"),
-            "version = 4\n\n[[package]]\nname = \"cfg-if\"\nversion = \"1.0.4\"\nsource = \"registry+https://corp.example/index\"\n",
-        )
-        .await
-        .unwrap();
-        let records_before = state.records.len();
-        let edits_before = state.edits.len();
-
-        let err = revert_cargo_redirect_purl(root, &mut state, PURL, true)
-            .await
-            .expect_err("drifted lock must refuse on a dry run too");
-        assert!(err.contains("drifted"), "{err}");
-        // The ledger keeps everything on refusal.
-        assert_eq!(state.records.len(), records_before);
-        assert_eq!(state.edits.len(), edits_before);
-    }
-
-    // ── npm family ───────────────────────────────────────────────────────
-
-    const NPM_PURL: &str = "pkg:npm/left-pad@1.3.0";
-    const NPM_URL: &str =
-        "http://127.0.0.1:5555/patch/npm/left-pad/1.3.0/tok/6b7c/left-pad-1.3.0.tgz";
-
-    fn npm_dep_for(name: &str, version: &str) -> crate::patch::redirect::DepOverride {
-        serde_json::from_value(serde_json::json!({
-            "ecosystem": "npm",
-            "name": name,
-            "version": version,
-            "token": "tok",
-            "patchUuid": UUID,
-            "artifactUrl": format!(
-                "http://127.0.0.1:5555/patch/npm/{name}/{version}/tok/6b7c/{name}-{version}.tgz"
-            ),
-            "integrity": {
-                "sha512": format!("sha512-{}==", "B".repeat(86)),
-                "sha1": "1".repeat(40),
-                "yarnBerry10c0": format!("10c0/{}", "b".repeat(128)),
-            },
-        }))
-        .unwrap()
-    }
-
-    fn npm_dep() -> crate::patch::redirect::DepOverride {
-        npm_dep_for("left-pad", "1.3.0")
-    }
-
-    /// Run the real hosted rewriter over one pristine lock (redirecting every
-    /// purl in `deps`), write its output to a tempdir, and return the
-    /// resulting ledger — the exact state the takeover revert consumes in
-    /// production.
-    async fn npm_redirected_fixture_multi(
-        rel: &str,
-        pristine: &str,
-        deps: &[(&str, crate::patch::redirect::DepOverride)],
-    ) -> (tempfile::TempDir, RedirectState) {
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        let mut files: BTreeMap<String, String> = BTreeMap::new();
-        files.insert(rel.to_string(), pristine.to_string());
-        let overrides: Vec<_> = deps.iter().map(|(_, d)| d.clone()).collect();
-        let rewrite = crate::patch::redirect::rewrite_registry_redirect(&files, &overrides);
-        let rewritten = rewrite
-            .files
-            .get(rel)
-            .unwrap_or_else(|| panic!("rewriter must rewrite {rel}: {:?}", rewrite.warnings));
-        tokio::fs::write(root.join(rel), rewritten).await.unwrap();
-        let mut state = RedirectState::new();
-        state.edits = rewrite.edits;
-        for (purl, _) in deps {
-            state.records.insert(purl.to_string(), record());
-        }
-        (tmp, state)
-    }
-
-    /// Run the real hosted rewriter over one pristine lock, write its output
-    /// to a tempdir, and return the resulting ledger — the exact state the
-    /// takeover revert consumes in production.
-    async fn npm_redirected_fixture(
-        rel: &str,
-        pristine: &str,
-    ) -> (tempfile::TempDir, RedirectState) {
-        npm_redirected_fixture_multi(rel, pristine, &[(NPM_PURL, npm_dep())]).await
-    }
-
-    fn classic_pristine() -> String {
-        "# yarn lockfile v1\n\n\nleft-pad@1.3.0:\n  version \"1.3.0\"\n  resolved \
-         \"https://registry.yarnpkg.com/left-pad/-/left-pad-1.3.0.tgz#5b8a\"\n  \
-         integrity sha512-original==\n"
-            .to_string()
-    }
-
-    // ---------- shared staging guards (twins of the replay's) ----------
-
-    /// A FIFO planted at a lockfile the ledger claims refuses fast (`read
-    /// <rel>: … not a regular file`) instead of wedging the takeover in a
-    /// blocking open; the ledger is untouched for a retry.
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn npm_fifo_squatting_the_lock_refuses_instead_of_wedging() {
-        use std::os::unix::ffi::OsStrExt;
-        let (tmp, mut state) = npm_redirected_fixture("yarn.lock", &classic_pristine()).await;
-        let root = tmp.path();
-        let path = root.join("yarn.lock");
-        tokio::fs::remove_file(&path).await.unwrap();
-        let cpath = std::ffi::CString::new(path.as_os_str().as_bytes()).unwrap();
-        assert_eq!(unsafe { libc::mkfifo(cpath.as_ptr(), 0o644) }, 0);
-        let edits_before = state.edits.len();
-        let err = revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect_err("a FIFO must refuse");
-        assert!(
-            err.starts_with("read yarn.lock:") && err.contains("not a regular file"),
-            "{err}"
-        );
-        assert_eq!(state.edits.len(), edits_before, "ledger untouched");
-        assert!(state.records.contains_key(NPM_PURL), "record kept");
-    }
-
-    /// A symlinked lockfile reads fine (the opener follows it) but refuses
-    /// at flush: a rename-over would replace the link with a detached
-    /// regular file. Nothing is written and the ledger is untouched.
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn npm_symlinked_lock_reads_fine_but_refuses_at_flush() {
-        let (tmp, mut state) = npm_redirected_fixture("yarn.lock", &classic_pristine()).await;
-        let root = tmp.path();
-        let redirected = tokio::fs::read_to_string(root.join("yarn.lock"))
-            .await
-            .unwrap();
-        tokio::fs::rename(root.join("yarn.lock"), root.join("real.lock"))
-            .await
-            .unwrap();
-        std::os::unix::fs::symlink(root.join("real.lock"), root.join("yarn.lock")).unwrap();
-        let edits_before = state.edits.len();
-        let err = revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect_err("a symlinked lock must refuse");
-        assert_eq!(err, "yarn.lock is not a regular file");
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("real.lock"))
-                .await
-                .unwrap(),
-            redirected,
-            "the symlink target must stay byte-identical"
-        );
-        assert!(
-            std::fs::symlink_metadata(root.join("yarn.lock"))
-                .unwrap()
-                .file_type()
-                .is_symlink(),
-            "the link itself must survive"
-        );
-        assert_eq!(state.edits.len(), edits_before, "ledger untouched");
-        assert!(state.records.contains_key(NPM_PURL), "record kept");
-    }
-
-    /// The text flush is the mode-preserving atomic writer: a `0600` lock
-    /// keeps its bits through the takeover revert.
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn npm_text_lock_revert_keeps_the_file_mode() {
-        use std::os::unix::fs::PermissionsExt;
-        let (tmp, mut state) = npm_redirected_fixture("yarn.lock", &classic_pristine()).await;
-        let root = tmp.path();
-        let path = root.join("yarn.lock");
-        std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o600)).unwrap();
-        revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("revert succeeds");
-        assert_eq!(
-            tokio::fs::read_to_string(&path).await.unwrap(),
-            classic_pristine()
-        );
-        assert_eq!(
-            std::fs::metadata(&path).unwrap().permissions().mode() & 0o777,
-            0o600,
-            "the lockfile's mode must survive the atomic rewrite"
-        );
-    }
-
-    fn berry_pristine() -> String {
-        "# This file is generated by running \"yarn install\" inside your project.\n\n\
-         __metadata:\n  version: 8\n  cacheKey: 10c0\n\n\
-         \"left-pad@npm:1.3.0\":\n  version: 1.3.0\n  resolution: \"left-pad@npm:1.3.0\"\n  \
-         checksum: 10c0/cccc\n  languageName: node\n  linkType: hard\n"
-            .to_string()
-    }
-
-    /// Pristine package-lock (lockfileVersion 2: BOTH the v3 `packages` map
-    /// and the legacy v2 `dependencies` tree), serialized exactly as the
-    /// rewriter serializes, so the revert round-trip is byte-comparable.
-    fn package_lock_pristine() -> String {
-        let lock = serde_json::json!({
-            "name": "app",
-            "version": "1.0.0",
-            "lockfileVersion": 2,
-            "requires": true,
-            "packages": {
-                "": { "name": "app", "version": "1.0.0" },
-                "node_modules/left-pad": {
-                    "version": "1.3.0",
-                    "resolved": "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
-                    "integrity": "sha512-pristine=="
-                }
-            },
-            "dependencies": {
-                "left-pad": {
-                    "version": "1.3.0",
-                    "resolved": "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
-                    "integrity": "sha512-pristine=="
-                }
-            }
-        });
-        format!("{}\n", serde_json::to_string_pretty(&lock).unwrap())
-    }
-
-    #[test]
-    fn revert_supported_gate_covers_cargo_and_npm_only() {
-        assert!(redirect_revert_supported("pkg:cargo/cfg-if@1.0.4"));
-        assert!(redirect_revert_supported("pkg:npm/left-pad@1.3.0"));
-        assert!(redirect_revert_supported("pkg:npm/%40scope/x@1.0.0"));
-        assert!(!redirect_revert_supported("pkg:gem/rack@3.0.0"));
-        assert!(!redirect_revert_supported("pkg:pypi/flask@2.0.0"));
-    }
-
-    #[tokio::test]
-    async fn npm_classic_lock_round_trips_and_drops_ledger_entries() {
-        let (tmp, mut state) = npm_redirected_fixture("yarn.lock", &classic_pristine()).await;
-        let root = tmp.path();
-        let wired = tokio::fs::read_to_string(root.join("yarn.lock"))
-            .await
-            .unwrap();
-        assert!(wired.contains(NPM_URL), "fixture is hosted-wired: {wired}");
-
-        let out = revert_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("revert succeeds");
-        assert_eq!(out.reverted_files, vec!["yarn.lock".to_string()]);
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("yarn.lock"))
-                .await
-                .unwrap(),
-            classic_pristine(),
-            "yarn.lock restored byte-identical"
-        );
-        assert!(state.records.is_empty(), "record dropped");
-        assert!(state.edits.is_empty(), "edits dropped");
-    }
-
-    fn future_lock_edit(name: &str, version: &str) -> FileEdit {
-        FileEdit {
-            path: "future.lock".into(),
-            kind: "redirect_future_lock_entry".into(),
-            action: "rewritten".into(),
-            key: Some(format!("{name}@{version}")),
-            original: Some(Value::String(format!("{name}@{version} sha512-r"))),
-            new: Some(Value::String(format!("{name}@{version} {NPM_URL}"))),
-        }
-    }
-
-    fn vlt_lock(entries: &[String]) -> String {
-        let body: Vec<String> = entries.iter().map(|e| format!("    {e}")).collect();
-        format!(
-            "{{\n  \"lockfileVersion\": 1,\n  \"nodes\": {{\n{}\n  }},\n  \"edges\": {{}}\n}}\n",
-            body.join(",\n")
-        )
-    }
-
-    fn vlt_entry(id: &str, slots: &str) -> String {
-        format!("\"{id}\": [0,\"left-pad\",{slots}]")
-    }
-
-    fn vlt_node_edit(key: &str, id: &str) -> FileEdit {
-        FileEdit {
-            path: "vlt-lock.json".into(),
-            kind: super::super::vlt::KIND.into(),
-            action: "rewritten".into(),
-            key: Some(key.into()),
-            original: Some(Value::String(vlt_entry(id, "\"sha512-r\""))),
-            new: Some(Value::String(vlt_entry(
-                id,
-                &format!("\"sha512-p\",\"{NPM_URL}\""),
-            ))),
-        }
-    }
-
-    #[tokio::test]
-    async fn npm_vlt_takeover_claims_every_variant_by_key_and_leaves_other_versions() {
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        let hosted = format!("\"sha512-p\",\"{NPM_URL}\"");
-        let wired = vlt_lock(&[
-            vlt_entry("·npm·left-pad@1.3.0·%E1%B9%97%3A3", &hosted),
-            vlt_entry("~npm~left-pad@1.3.0", &hosted),
-            vlt_entry("~npm~left-pad@1.3.0-rc.1", &hosted),
-            vlt_entry("~npm~left-pad@1.3.0~peer.2", &hosted),
-        ]);
-        tokio::fs::write(root.join("vlt-lock.json"), &wired)
-            .await
-            .unwrap();
-        let mut state = RedirectState::new();
-        state.records.insert(NPM_PURL.into(), record());
-        state.edits = vec![
-            vlt_node_edit(
-                "left-pad@1.3.0~%E1%B9%97%3A3",
-                "·npm·left-pad@1.3.0·%E1%B9%97%3A3",
-            ),
-            vlt_node_edit("left-pad@1.3.0", "~npm~left-pad@1.3.0"),
-            vlt_node_edit("left-pad@1.3.0-rc.1", "~npm~left-pad@1.3.0-rc.1"),
-            vlt_node_edit("left-pad@1.3.0~peer.2", "~npm~left-pad@1.3.0~peer.2"),
-        ];
-        revert_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("revert succeeds");
-        let registry = "\"sha512-r\"";
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("vlt-lock.json"))
-                .await
-                .unwrap(),
-            vlt_lock(&[
-                vlt_entry("·npm·left-pad@1.3.0·%E1%B9%97%3A3", registry),
-                vlt_entry("~npm~left-pad@1.3.0", registry),
-                vlt_entry("~npm~left-pad@1.3.0-rc.1", &hosted),
-                vlt_entry("~npm~left-pad@1.3.0~peer.2", registry),
-            ])
-        );
-        let keys: Vec<&str> = state
-            .edits
-            .iter()
-            .filter_map(|e| e.key.as_deref())
-            .collect();
-        assert_eq!(keys, ["left-pad@1.3.0-rc.1"]);
-        assert!(state.records.is_empty());
-    }
-
-    #[tokio::test]
-    async fn npm_vlt_takeover_refuses_a_drifted_line_untouched() {
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        let wired = vlt_lock(&[vlt_entry("~npm~left-pad@1.3.0", "\"sha512-other\"")]);
-        tokio::fs::write(root.join("vlt-lock.json"), &wired)
-            .await
-            .unwrap();
-        let mut state = RedirectState::new();
-        state.records.insert(NPM_PURL.into(), record());
-        state.edits = vec![vlt_node_edit("left-pad@1.3.0", "~npm~left-pad@1.3.0")];
-        let before = state.clone();
-        let err = revert_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .unwrap_err();
-        assert!(err.contains("drifted from the recorded redirect"), "{err}");
-        assert_eq!(
-            serde_json::to_value(&state).unwrap(),
-            serde_json::to_value(&before).unwrap()
-        );
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("vlt-lock.json"))
-                .await
-                .unwrap(),
-            wired
-        );
-    }
-
-    #[tokio::test]
-    async fn npm_vlt_takeover_keeps_a_relaid_flag_and_trailing_slots() {
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        let relaid = format!(
-            "\"~npm~left-pad@1.3.0\": [2,\"left-pad\",\"sha512-p\",\"{NPM_URL}\",null,null,null,null,{{  \"lp\": \"bin.js\"}}]"
-        );
-        tokio::fs::write(root.join("vlt-lock.json"), vlt_lock(&[relaid]))
-            .await
-            .unwrap();
-        let mut state = RedirectState::new();
-        state.records.insert(NPM_PURL.into(), record());
-        state.edits = vec![vlt_node_edit("left-pad@1.3.0", "~npm~left-pad@1.3.0")];
-        revert_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("revert succeeds");
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("vlt-lock.json"))
-                .await
-                .unwrap(),
-            vlt_lock(&["\"~npm~left-pad@1.3.0\": [2,\"left-pad\",\"sha512-r\",null,null,null,null,null,{  \"lp\": \"bin.js\"}]".to_string()])
-        );
-        assert!(state.edits.is_empty() && state.records.is_empty());
-    }
-
-    #[tokio::test]
-    async fn npm_vlt_takeover_reverts_a_relocked_away_variant_whatever_the_ledger_order() {
-        let hosted = format!("\"sha512-p\",\"{NPM_URL}\"");
-        let plain = vlt_node_edit("left-pad@1.3.0", "~npm~left-pad@1.3.0");
-        let peer = vlt_node_edit("left-pad@1.3.0~peer.2", "~npm~left-pad@1.3.0~peer.2");
-        for edits in [
-            vec![plain.clone(), peer.clone()],
-            vec![peer.clone(), plain.clone()],
-        ] {
-            let tmp = tempfile::tempdir().unwrap();
-            let root = tmp.path();
-            let wired = vlt_lock(&[vlt_entry("~npm~left-pad@1.3.0", &hosted)]);
-            tokio::fs::write(root.join("vlt-lock.json"), &wired)
-                .await
-                .unwrap();
-            let mut state = RedirectState::new();
-            state.records.insert(NPM_PURL.into(), record());
-            state.edits = edits;
-            revert_redirect_purl(root, &mut state, NPM_PURL, false)
-                .await
-                .expect("revert succeeds");
-            assert_eq!(
-                tokio::fs::read_to_string(root.join("vlt-lock.json"))
-                    .await
-                    .unwrap(),
-                vlt_lock(&[vlt_entry("~npm~left-pad@1.3.0", "\"sha512-r\"")])
-            );
-            assert!(state.edits.is_empty() && state.records.is_empty());
-        }
-    }
-
-    #[tokio::test]
-    async fn npm_vlt_takeover_follows_a_pin_vlt_carried_to_a_new_peer_context() {
-        let hosted = format!("\"sha512-p\",\"{NPM_URL}\"");
-        let old_id = "~npm~left-pad@1.3.0~peer.0df72515a50372ba";
-        let new_id = "~npm~left-pad@1.3.0~peer.32643a3290c32d5d";
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        let wired = vlt_lock(&[
-            vlt_entry(new_id, &hosted),
-            vlt_entry("~npm~right-pad@1.3.0", "\"sha512-q\""),
-        ]);
-        tokio::fs::write(root.join("vlt-lock.json"), &wired)
-            .await
-            .unwrap();
-        let mut state = RedirectState::new();
-        state.records.insert(NPM_PURL.into(), record());
-        state.edits = vec![vlt_node_edit(
-            "left-pad@1.3.0~peer.0df72515a50372ba",
-            old_id,
-        )];
-        revert_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("revert succeeds");
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("vlt-lock.json"))
-                .await
-                .unwrap(),
-            vlt_lock(&[
-                vlt_entry(new_id, "\"sha512-r\""),
-                vlt_entry("~npm~right-pad@1.3.0", "\"sha512-q\""),
-            ])
-        );
-        assert!(state.edits.is_empty() && state.records.is_empty());
-    }
-
-    #[tokio::test]
-    async fn npm_unclassified_edit_naming_the_purl_refuses_the_claim_untouched() {
-        for dry_run in [true, false] {
-            let (tmp, mut state) = npm_redirected_fixture("yarn.lock", &classic_pristine()).await;
-            let root = tmp.path();
-            state.edits.push(future_lock_edit("left-pad", "1.3.0"));
-            let wired = tokio::fs::read_to_string(root.join("yarn.lock"))
-                .await
-                .unwrap();
-            let before = state.clone();
-            let err = revert_redirect_purl(root, &mut state, NPM_PURL, dry_run)
-                .await
-                .unwrap_err();
-            assert_eq!(
-                err,
-                "the redirect ledger holds a redirect_future_lock_entry edit this socket-patch \
-                 release does not understand; upgrade socket-patch"
-            );
-            assert_eq!(
-                serde_json::to_value(&state).unwrap(),
-                serde_json::to_value(&before).unwrap(),
-                "nothing claimed"
-            );
-            assert_eq!(
-                tokio::fs::read_to_string(root.join("yarn.lock"))
-                    .await
-                    .unwrap(),
-                wired
-            );
-        }
-    }
-
-    #[tokio::test]
-    async fn npm_unclassified_edit_for_another_package_does_not_block_the_claim() {
-        let (tmp, mut state) = npm_redirected_fixture("yarn.lock", &classic_pristine()).await;
-        let root = tmp.path();
-        state.edits.push(future_lock_edit("left-pad", "1.3.1"));
-        revert_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("revert succeeds");
-        assert_eq!(state.edits.len(), 1);
-        assert_eq!(state.edits[0].kind, "redirect_future_lock_entry");
-    }
-
-    #[tokio::test]
-    async fn npm_unclassified_edit_for_a_longer_or_scoped_name_does_not_block_the_claim() {
-        for other in ["long-left-pad", "@scope/left-pad"] {
-            let (tmp, mut state) = npm_redirected_fixture("yarn.lock", &classic_pristine()).await;
-            state.edits.push(future_lock_edit(other, "1.3.0"));
-            revert_redirect_purl(tmp.path(), &mut state, NPM_PURL, false)
-                .await
-                .unwrap_or_else(|e| panic!("{other}: {e}"));
-            assert_eq!(state.edits.len(), 1, "{other}");
-            assert_eq!(state.edits[0].kind, "redirect_future_lock_entry", "{other}");
-        }
-    }
-
-    #[tokio::test]
-    async fn cargo_and_golang_claims_refuse_an_unclassified_edit_naming_them() {
-        let tmp = tempfile::tempdir().unwrap();
-        for (purl, name, version) in [
-            ("pkg:cargo/serde@1.0.0", "serde", "1.0.0"),
-            ("pkg:golang/example.com/m@v1.2.3", "example.com/m", "v1.2.3"),
-        ] {
-            let mut state = RedirectState::new();
-            state.records.insert(purl.into(), record());
-            state.edits.push(FileEdit {
-                path: "future.lock".into(),
-                kind: "redirect_future_lock_entry".into(),
-                action: "rewritten".into(),
-                key: None,
-                original: Some(serde_json::json!({ "id": format!("{name}@{version}") })),
-                new: Some(Value::String("x".into())),
-            });
-            let before = state.clone();
-            let err = revert_redirect_purl(tmp.path(), &mut state, purl, false)
-                .await
-                .unwrap_err();
-            assert!(err.contains("redirect_future_lock_entry edit"), "{err}");
-            assert_eq!(
-                serde_json::to_value(&state).unwrap(),
-                serde_json::to_value(&before).unwrap(),
-                "{purl}"
-            );
-        }
-    }
-
-    #[tokio::test]
-    async fn npm_berry_lock_round_trips_and_drops_ledger_entries() {
-        let (tmp, mut state) = npm_redirected_fixture("yarn.lock", &berry_pristine()).await;
-        let root = tmp.path();
-        let wired = tokio::fs::read_to_string(root.join("yarn.lock"))
-            .await
-            .unwrap();
-        assert!(
-            wired.contains("::__archiveUrl="),
-            "fixture is hosted-wired: {wired}"
-        );
-
-        revert_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("revert succeeds");
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("yarn.lock"))
-                .await
-                .unwrap(),
-            berry_pristine(),
-            "yarn.lock restored byte-identical"
-        );
-        assert!(state.records.is_empty(), "record dropped");
-        assert!(state.edits.is_empty(), "edits dropped");
-    }
-
-    /// A CRLF (and BOM'd) berry lock — yarn's own output on Windows —
-    /// round-trips through the takeover byte-exactly: the rewriter records
-    /// the CRLF fragments, the revert replays them. Across checkouts too: a
-    /// ledger written on a CRLF checkout reverts an LF checkout of the same
-    /// commit and vice versa (`core.autocrlf` re-spells the lock, never the
-    /// committed ledger), landing on the pristine lock in the LIVE file's
-    /// endings. A lock whose endings are mixed proves nothing: it refuses
-    /// as drift, byte-untouched, ledger intact.
-    #[tokio::test]
-    async fn npm_berry_crlf_lock_round_trips_across_checkouts() {
-        let respell = |text: &str, crlf: bool| {
-            let lf = text.replace("\r\n", "\n");
-            if crlf {
-                lf.replace('\n', "\r\n")
-            } else {
-                lf
-            }
-        };
-        for (label, bom, recorded_crlf, live_crlf) in [
-            ("crlf", "", true, true),
-            ("bom+crlf", "\u{feff}", true, true),
-            ("recorded crlf, reverted lf", "", true, false),
-            ("recorded lf, reverted crlf", "\u{feff}", false, true),
-        ] {
-            let pristine = format!("{bom}{}", respell(&berry_pristine(), recorded_crlf));
-            let (tmp, mut state) = npm_redirected_fixture("yarn.lock", &pristine).await;
-            let root = tmp.path();
-            let edit = state
-                .edits
-                .iter()
-                .find(|e| e.kind == "redirect_yarn_berry_entry")
-                .expect("berry edit");
-            let recorded = edit.original.as_ref().and_then(Value::as_str).unwrap();
-            assert_eq!(
-                recorded.contains("\r\n"),
-                recorded_crlf,
-                "{label}: the ledger records the on-disk endings: {recorded:?}"
-            );
-            let wired = tokio::fs::read_to_string(root.join("yarn.lock"))
-                .await
-                .unwrap();
-            tokio::fs::write(root.join("yarn.lock"), respell(&wired, live_crlf))
-                .await
-                .unwrap();
-
-            revert_redirect_purl(root, &mut state, NPM_PURL, false)
-                .await
-                .unwrap_or_else(|e| panic!("{label}: revert must succeed: {e}"));
-            assert_eq!(
-                tokio::fs::read_to_string(root.join("yarn.lock"))
-                    .await
-                    .unwrap(),
-                format!("{bom}{}", respell(&berry_pristine(), live_crlf)),
-                "{label}: the pristine lock, in the live file's endings"
-            );
-            assert!(state.edits.is_empty(), "{label}: edits dropped");
-        }
-
-        // Mixed live endings: neither the verbatim nor a respelled fragment
-        // is provable — refuse, touch nothing, keep the ledger.
-        let pristine = respell(&berry_pristine(), true);
-        let (tmp, mut state) = npm_redirected_fixture("yarn.lock", &pristine).await;
-        let root = tmp.path();
-        let wired = tokio::fs::read_to_string(root.join("yarn.lock"))
-            .await
-            .unwrap();
-        let mixed = wired.replacen("  languageName: node\r\n", "  languageName: node\n", 1);
-        assert_ne!(mixed, wired, "the fixture edit must hit");
-        tokio::fs::write(root.join("yarn.lock"), &mixed)
-            .await
-            .unwrap();
-        let edits_before = state.edits.len();
-        let err = revert_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect_err("a mixed lock must refuse");
-        assert!(err.contains("drifted"), "{err}");
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("yarn.lock"))
-                .await
-                .unwrap(),
-            mixed,
-            "byte-untouched"
-        );
-        assert_eq!(state.edits.len(), edits_before, "ledger intact");
-    }
-
-    #[tokio::test]
-    async fn npm_package_lock_v2_round_trips_both_trees() {
-        let (tmp, mut state) =
-            npm_redirected_fixture("package-lock.json", &package_lock_pristine()).await;
-        let root = tmp.path();
-        assert_eq!(state.edits.len(), 2, "packages + dependencies edits");
-        let wired = tokio::fs::read_to_string(root.join("package-lock.json"))
-            .await
-            .unwrap();
-        assert!(wired.contains(NPM_URL), "fixture is hosted-wired: {wired}");
-
-        revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("revert succeeds");
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("package-lock.json"))
-                .await
-                .unwrap(),
-            package_lock_pristine(),
-            "package-lock.json restored byte-identical (both trees)"
-        );
-        assert!(state.records.is_empty(), "record dropped");
-        assert!(state.edits.is_empty(), "edits dropped");
-    }
-
-    fn npmrc_edit(action: &str) -> FileEdit {
-        FileEdit {
-            path: ".npmrc".into(),
-            kind: super::super::npmrc::NPMRC_ALLOW_REMOTE_EDIT_KIND.into(),
-            action: action.into(),
-            key: Some("allow-remote".into()),
-            original: None,
-            new: Some(serde_json::json!("all")),
-        }
-    }
-
-    /// Pristine lockfileVersion 3 package-lock holding two registry deps.
-    fn two_dep_package_lock() -> String {
-        let entry = |name: &str, version: &str| {
-            serde_json::json!({
-                "version": version,
-                "resolved": format!("https://registry.npmjs.org/{name}/-/{name}-{version}.tgz"),
-                "integrity": "sha512-pristine=="
-            })
-        };
-        let lock = serde_json::json!({
-            "name": "app", "version": "1.0.0", "lockfileVersion": 3, "requires": true,
-            "packages": {
-                "": { "name": "app", "version": "1.0.0" },
-                "node_modules/left-pad": entry("left-pad", "1.3.0"),
-                "node_modules/other": entry("other", "2.0.0"),
-            }
-        });
-        format!("{}\n", serde_json::to_string_pretty(&lock).unwrap())
-    }
-
-    /// The `.npmrc` `allow-remote=all` auto-config is unwound in the SAME
-    /// transaction as the LAST package-lock purl's revert (created file
-    /// deleted), and never while another package-lock entry still needs it.
-    #[tokio::test]
-    async fn npm_revert_unwinds_npmrc_only_when_the_last_lock_entry_goes() {
-        let (tmp, mut state) = npm_redirected_fixture_multi(
-            "package-lock.json",
-            &two_dep_package_lock(),
-            &[
-                (NPM_PURL, npm_dep()),
-                ("pkg:npm/other@2.0.0", npm_dep_for("other", "2.0.0")),
-            ],
-        )
-        .await;
-        let root = tmp.path();
-        tokio::fs::write(root.join(".npmrc"), "allow-remote=all\n")
-            .await
-            .unwrap();
-        state.edits.push(npmrc_edit("created"));
-
-        // The last-but-one lock entry goes: .npmrc stays.
-        let out = revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("first revert");
-        assert!(!out.reverted_files.iter().any(|f| f == ".npmrc"), "{out:?}");
-        assert_eq!(
-            tokio::fs::read_to_string(root.join(".npmrc"))
-                .await
-                .unwrap(),
-            "allow-remote=all\n",
-            "still needed by the other package-lock entry"
-        );
-        assert!(state
-            .edits
-            .iter()
-            .any(|e| e.kind == "redirect_npmrc_allow_remote"));
-
-        // Dry run of the last one: previews the removal, writes nothing.
-        let mut probe = state.clone();
-        let out = revert_npm_redirect_purl(root, &mut probe, "pkg:npm/other@2.0.0", true)
-            .await
-            .expect("dry-run revert");
-        assert!(out.reverted_files.iter().any(|f| f == ".npmrc"), "{out:?}");
-        assert!(root.join(".npmrc").exists(), "dry run writes nothing");
-
-        let out = revert_npm_redirect_purl(root, &mut state, "pkg:npm/other@2.0.0", false)
-            .await
-            .expect("last revert");
-        assert!(out.reverted_files.iter().any(|f| f == ".npmrc"), "{out:?}");
-        assert!(
-            !root.join(".npmrc").exists(),
-            "the created .npmrc is deleted"
-        );
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("package-lock.json"))
-                .await
-                .unwrap(),
-            two_dep_package_lock()
-        );
-        assert!(
-            state.edits.is_empty() && state.records.is_empty(),
-            "{state:?}"
-        );
-    }
-
-    /// An APPENDED line is removed exactly (user bytes, BOM and CRLF kept);
-    /// an ambiguous duplicate refuses the whole revert byte-untouched.
-    #[tokio::test]
-    async fn npm_revert_removes_only_the_appended_npmrc_line() {
-        let (tmp, mut state) =
-            npm_redirected_fixture("package-lock.json", &package_lock_pristine()).await;
-        let root = tmp.path();
-        let wired = tokio::fs::read_to_string(root.join("package-lock.json"))
-            .await
-            .unwrap();
-        state.edits.push(npmrc_edit("added"));
-
-        tokio::fs::write(
-            root.join(".npmrc"),
-            "allow-remote=all\r\n; mine\r\nallow-remote=all\r\n",
-        )
-        .await
-        .unwrap();
-        let err = revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect_err("ambiguous .npmrc refuses");
-        assert!(err.contains("more than once"), "{err}");
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("package-lock.json"))
-                .await
-                .unwrap(),
-            wired,
-            "a refusal leaves the lock untouched"
-        );
-
-        tokio::fs::write(
-            root.join(".npmrc"),
-            "\u{feff}registry=https://r.example/\r\nallow-remote=all\r\n",
-        )
-        .await
-        .unwrap();
-        revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("revert succeeds");
-        assert_eq!(
-            tokio::fs::read_to_string(root.join(".npmrc"))
-                .await
-                .unwrap(),
-            "\u{feff}registry=https://r.example/\r\n"
-        );
-        assert!(state.edits.is_empty(), "{state:?}");
-    }
-
-    /// A symlinked `.npmrc` refuses while planning — never at
-    /// `flush_npmrc` time, after `flush_staged` had written the reverted
-    /// lock while the ledger still recorded the redirect: lock
-    /// byte-identical, ledger untouched. While another
-    /// package-lock entry still needs the setting, the odd `.npmrc` shape
-    /// does not block the revert at all (the file is never read).
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn npm_revert_refuses_a_symlinked_npmrc_before_writing_anything() {
-        let (tmp, mut state) = npm_redirected_fixture_multi(
-            "package-lock.json",
-            &two_dep_package_lock(),
-            &[
-                (NPM_PURL, npm_dep()),
-                ("pkg:npm/other@2.0.0", npm_dep_for("other", "2.0.0")),
-            ],
-        )
-        .await;
-        let root = tmp.path();
-        tokio::fs::write(root.join("shared.npmrc"), "allow-remote=all\n")
-            .await
-            .unwrap();
-        std::os::unix::fs::symlink("shared.npmrc", root.join(".npmrc")).unwrap();
-        state.edits.push(npmrc_edit("created"));
-
-        // Not the last lock entry: the unwind is not due, the link is fine.
-        revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("first revert is not blocked by the .npmrc shape");
-
-        let wired = tokio::fs::read_to_string(root.join("package-lock.json"))
-            .await
-            .unwrap();
-        let before = state.clone();
-        let err = revert_npm_redirect_purl(root, &mut state, "pkg:npm/other@2.0.0", false)
-            .await
-            .expect_err("symlinked .npmrc refuses the last revert");
-        assert!(err.contains("not a regular file"), "{err}");
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("package-lock.json"))
-                .await
-                .unwrap(),
-            wired,
-            "the lock must not be reverted behind the refusal"
-        );
-        assert_eq!(state.edits.len(), before.edits.len(), "ledger untouched");
-        assert_eq!(
-            state.records.len(),
-            before.records.len(),
-            "ledger untouched"
-        );
-        assert!(root
-            .join(".npmrc")
-            .symlink_metadata()
-            .unwrap()
-            .file_type()
-            .is_symlink());
-    }
-
-    /// Pristine pnpm v6 lock holding a PLAIN instance and a resolved-peer
-    /// instance of the same purl: the rewriter records one edit per
-    /// instance, keying the peered one `<name>@<version>(<peer>@<ver>)`.
-    fn pnpm_v6_pristine() -> String {
-        [
-            "lockfileVersion: '6.0'",
-            "",
-            "dependencies:",
-            "  left-pad:",
-            "    specifier: 1.3.0",
-            "    version: 1.3.0",
-            "",
-            "packages:",
-            "",
-            "  /left-pad@1.3.0:",
-            "    resolution: {integrity: sha512-pristine==}",
-            "    dev: false",
-            "",
-            "  /left-pad@1.3.0(react@18.2.0):",
-            "    resolution: {integrity: sha512-pristine==}",
-            "    dev: false",
-            "",
-        ]
-        .join("\n")
-    }
-
-    /// Pristine pnpm v5 lock: same two-instance shape, `/name/version` keys
-    /// with the peer combination spelled as a `_<suffix>` (respelled
-    /// `<name>@<version>_<suffix>` in the recorded instance key).
-    fn pnpm_v5_pristine() -> String {
-        [
-            "lockfileVersion: 5.4",
-            "",
-            "specifiers:",
-            "  left-pad: 1.3.0",
-            "",
-            "dependencies:",
-            "  left-pad: 1.3.0",
-            "",
-            "packages:",
-            "",
-            "  /left-pad/1.3.0:",
-            "    resolution: {integrity: sha512-pristine==}",
-            "    dev: false",
-            "",
-            "  /left-pad/1.3.0_react@18.2.0:",
-            "    resolution: {integrity: sha512-pristine==}",
-            "    dev: false",
-            "",
-        ]
-        .join("\n")
-    }
-
-    /// The pnpm rewriter keys a resolved-peer instance's edit
-    /// `<name>@<version>(<peer>@<ver>)`, not bare `<name>@<version>` — the
-    /// takeover claim must cover it. A missed instance is a silent HALF
-    /// takeover: the plain entry reverts, the record is dropped, the peered
-    /// edit is stranded in the ledger, and every dependent resolving through
-    /// the peered instance keeps installing the expiring hosted tarball.
-    #[tokio::test]
-    async fn npm_pnpm_v6_peered_instance_takeover_reverts_every_instance() {
-        let (tmp, mut state) = npm_redirected_fixture("pnpm-lock.yaml", &pnpm_v6_pristine()).await;
-        let root = tmp.path();
-        assert_eq!(
-            state.edits.len(),
-            2,
-            "plain + peered instance edits: {:?}",
-            state.edits
-        );
-        let wired = tokio::fs::read_to_string(root.join("pnpm-lock.yaml"))
-            .await
-            .unwrap();
-        assert_eq!(
-            wired.matches(NPM_URL).count(),
-            2,
-            "both instances hosted-wired: {wired}"
-        );
-
-        revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("revert succeeds");
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("pnpm-lock.yaml"))
-                .await
-                .unwrap(),
-            pnpm_v6_pristine(),
-            "pnpm-lock.yaml restored byte-identical (both instances)"
-        );
-        assert!(state.records.is_empty(), "record dropped");
-        assert!(
-            state.edits.is_empty(),
-            "no stranded instance edits: {:?}",
-            state.edits
-        );
-    }
-
-    /// v5 twin of the peered-instance claim: the `_<peer-suffix>` instance
-    /// key (`left-pad@1.3.0_react@18.2.0`) must be claimed too.
-    #[tokio::test]
-    async fn npm_pnpm_v5_suffixed_instance_takeover_reverts_every_instance() {
-        let (tmp, mut state) = npm_redirected_fixture("pnpm-lock.yaml", &pnpm_v5_pristine()).await;
-        let root = tmp.path();
-        assert_eq!(
-            state.edits.len(),
-            2,
-            "plain + suffixed instance edits: {:?}",
-            state.edits
-        );
-
-        revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("revert succeeds");
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("pnpm-lock.yaml"))
-                .await
-                .unwrap(),
-            pnpm_v5_pristine(),
-            "pnpm-lock.yaml restored byte-identical (both instances)"
-        );
-        assert!(state.records.is_empty(), "record dropped");
-        assert!(
-            state.edits.is_empty(),
-            "no stranded instance edits: {:?}",
-            state.edits
-        );
-    }
-
-    /// The peered-instance claim is boundary-checked: `left-pad@1.3.0-rc1`'s
-    /// peered key starts with `left-pad@1.3.0`, but `-` extends the version —
-    /// taking over 1.3.0 must not claim (and replay) the prerelease sibling's
-    /// edit.
-    #[tokio::test]
-    async fn npm_pnpm_prerelease_sibling_peered_edit_is_not_claimed() {
-        let rc1_url =
-            "http://127.0.0.1:5555/patch/npm/left-pad/1.3.0-rc1/tok/6b7c/left-pad-1.3.0-rc1.tgz";
-        let lock = format!(
-            "lockfileVersion: '6.0'\n\npackages:\n\n  /left-pad@1.3.0:\n    \
-             resolution: {{integrity: sha512-h==, tarball: {NPM_URL}}}\n\n  \
-             /left-pad@1.3.0-rc1(react@18.2.0):\n    \
-             resolution: {{integrity: sha512-h2==, tarball: {rc1_url}}}\n"
-        );
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        tokio::fs::write(root.join("pnpm-lock.yaml"), &lock)
-            .await
-            .unwrap();
-        let mut state = RedirectState::new();
-        state.records.insert(NPM_PURL.to_string(), record());
-        state
-            .records
-            .insert("pkg:npm/left-pad@1.3.0-rc1".to_string(), record());
-        state.edits.push(FileEdit {
-            path: "pnpm-lock.yaml".into(),
-            kind: "redirect_pnpm_resolution".into(),
-            action: "rewritten".into(),
-            key: Some("left-pad@1.3.0".into()),
-            original: Some(Value::String("{integrity: sha512-p==}".into())),
-            new: Some(Value::String(format!(
-                "{{integrity: sha512-h==, tarball: {NPM_URL}}}"
-            ))),
-        });
-        state.edits.push(FileEdit {
-            path: "pnpm-lock.yaml".into(),
-            kind: "redirect_pnpm_resolution".into(),
-            action: "rewritten".into(),
-            key: Some("left-pad@1.3.0-rc1(react@18.2.0)".into()),
-            original: Some(Value::String("{integrity: sha512-p2==}".into())),
-            new: Some(Value::String(format!(
-                "{{integrity: sha512-h2==, tarball: {rc1_url}}}"
-            ))),
-        });
-
-        revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("takeover of 1.3.0 succeeds without touching 1.3.0-rc1");
-
-        let lock_after = tokio::fs::read_to_string(root.join("pnpm-lock.yaml"))
-            .await
-            .unwrap();
-        assert!(
-            !lock_after.contains(NPM_URL),
-            "1.3.0 un-hosted: {lock_after}"
-        );
-        assert!(
-            lock_after.contains(rc1_url),
-            "1.3.0-rc1 still hosted-wired: {lock_after}"
-        );
-        assert_eq!(
-            state.edits.len(),
-            1,
-            "the sibling keeps its edit: {:?}",
-            state.edits
-        );
-        assert!(
-            state.records.contains_key("pkg:npm/left-pad@1.3.0-rc1")
-                && !state.records.contains_key(NPM_PURL),
-            "{:?}",
-            state.records.keys()
-        );
-    }
-
-    /// Pristine package-lock (lockfileVersion 2, both trees) holding TWO
-    /// versions of left-pad — the sibling-purl fixture the claim matcher
-    /// must not cross-claim.
-    fn two_version_lock_pristine() -> String {
-        let lp = |v: &str| {
-            serde_json::json!({
-                "version": v,
-                "resolved": format!("https://registry.npmjs.org/left-pad/-/left-pad-{v}.tgz"),
-                "integrity": format!("sha512-pristine-{v}=="),
-            })
-        };
-        let lock = serde_json::json!({
-            "name": "app",
-            "version": "1.0.0",
-            "lockfileVersion": 2,
-            "requires": true,
-            "packages": {
-                "": { "name": "app", "version": "1.0.0" },
-                "node_modules/a": {
-                    "version": "1.0.0",
-                    "resolved": "https://registry.npmjs.org/a/-/a-1.0.0.tgz",
-                    "integrity": "sha512-a=="
-                },
-                "node_modules/a/node_modules/left-pad": lp("1.2.0"),
-                "node_modules/left-pad": lp("1.3.0"),
-            },
-            "dependencies": {
-                "a": {
-                    "version": "1.0.0",
-                    "resolved": "https://registry.npmjs.org/a/-/a-1.0.0.tgz",
-                    "integrity": "sha512-a==",
-                    "dependencies": { "left-pad": lp("1.2.0") }
-                },
-                "left-pad": lp("1.3.0"),
-            }
-        });
-        format!("{}\n", serde_json::to_string_pretty(&lock).unwrap())
-    }
-
-    /// Two hosted-redirected VERSIONS of the same package: taking over one
-    /// purl must not claim (and silently un-host) the sibling's lock edits —
-    /// the package-lock JSON edit keys carry no version, so a name-only
-    /// matcher replays the sibling's `original` back over its live hosted
-    /// wiring and drops its edits while its ledger record survives edit-less.
-    #[tokio::test]
-    async fn npm_two_versions_takeover_of_one_leaves_the_siblings_redirect_intact() {
-        let sibling_purl = "pkg:npm/left-pad@1.2.0";
-        let (tmp, mut state) = npm_redirected_fixture_multi(
-            "package-lock.json",
-            &two_version_lock_pristine(),
-            &[
-                (NPM_PURL, npm_dep()),
-                (sibling_purl, npm_dep_for("left-pad", "1.2.0")),
-            ],
-        )
-        .await;
-        let root = tmp.path();
-        // 2 edits per purl: one v3 `packages` entry + one v2 `dependencies`
-        // node each.
-        assert_eq!(state.edits.len(), 4, "{:?}", state.edits);
-        let sibling_url = npm_dep_for("left-pad", "1.2.0").artifact_url.clone();
-        let wired = tokio::fs::read_to_string(root.join("package-lock.json"))
-            .await
-            .unwrap();
-        assert!(wired.contains(NPM_URL) && wired.contains(&sibling_url));
-
-        revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("takeover of 1.3.0 succeeds without touching 1.2.0");
-
-        let lock = tokio::fs::read_to_string(root.join("package-lock.json"))
-            .await
-            .unwrap();
-        assert!(!lock.contains(NPM_URL), "1.3.0 un-hosted: {lock}");
-        assert!(
-            lock.contains("left-pad/-/left-pad-1.3.0.tgz"),
-            "1.3.0 back on the registry: {lock}"
-        );
-        assert_eq!(
-            lock.matches(&sibling_url).count(),
-            2,
-            "1.2.0 still hosted-wired in BOTH trees: {lock}"
-        );
-        assert!(
-            state.records.contains_key(sibling_purl) && !state.records.contains_key(NPM_PURL),
-            "only 1.3.0's record dropped: {:?}",
-            state.records.keys()
-        );
-        assert_eq!(
-            state.edits.len(),
-            2,
-            "1.2.0 keeps its two edits: {:?}",
-            state.edits
-        );
-
-        // The sibling's own takeover still round-trips the file to pristine.
-        revert_npm_redirect_purl(root, &mut state, sibling_purl, false)
-            .await
-            .expect("takeover of 1.2.0 succeeds");
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("package-lock.json"))
-                .await
-                .unwrap(),
-            two_version_lock_pristine(),
-            "package-lock.json restored byte-identical"
-        );
-        assert!(state.records.is_empty() && state.edits.is_empty());
-    }
-
-    /// `npm i left-pad@npm:other` keys package `other` under the lock path
-    /// `node_modules/left-pad`: taking over left-pad must not claim that
-    /// entry's edit through the key name (the entry's `name` field exonerates
-    /// it, exactly as the rewriter matched), while an alias install OF
-    /// left-pad (`npm i mylp@npm:left-pad`) must still be claimed through
-    /// the `name` field.
-    #[tokio::test]
-    async fn npm_alias_collision_takeover_claims_by_entry_name_not_key_path() {
-        let other_purl = "pkg:npm/other@1.3.0";
-        let lock = serde_json::json!({
-            "name": "app",
-            "version": "1.0.0",
-            "lockfileVersion": 3,
-            "requires": true,
-            "packages": {
-                "": { "name": "app", "version": "1.0.0" },
-                // Alias of ANOTHER package onto this key path — same version
-                // on purpose, so only the name field can exonerate it.
-                "node_modules/left-pad": {
-                    "name": "other",
-                    "version": "1.3.0",
-                    "resolved": "https://registry.npmjs.org/other/-/other-1.3.0.tgz",
-                    "integrity": "sha512-pristine-other=="
-                },
-                // Alias OF the target package: claimed via the name field.
-                "node_modules/mylp": {
-                    "name": "left-pad",
-                    "version": "1.3.0",
-                    "resolved": "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
-                    "integrity": "sha512-pristine-1.3.0=="
-                },
-                "node_modules/b/node_modules/left-pad": {
-                    "version": "1.3.0",
-                    "resolved": "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
-                    "integrity": "sha512-pristine-1.3.0=="
-                },
-            },
-        });
-        let pristine = format!("{}\n", serde_json::to_string_pretty(&lock).unwrap());
-        let (tmp, mut state) = npm_redirected_fixture_multi(
-            "package-lock.json",
-            &pristine,
-            &[
-                (NPM_PURL, npm_dep()),
-                (other_purl, npm_dep_for("other", "1.3.0")),
-            ],
-        )
-        .await;
-        let root = tmp.path();
-        assert_eq!(state.edits.len(), 3, "{:?}", state.edits);
-        let other_url = npm_dep_for("other", "1.3.0").artifact_url.clone();
-
-        revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("takeover of left-pad succeeds without touching `other`");
-
-        let lock = tokio::fs::read_to_string(root.join("package-lock.json"))
-            .await
-            .unwrap();
-        assert!(
-            !lock.contains(NPM_URL),
-            "both left-pad entries (path-keyed AND alias-keyed) un-hosted: {lock}"
-        );
-        assert!(
-            lock.contains(&other_url),
-            "`other` (aliased onto node_modules/left-pad) still hosted-wired: {lock}"
-        );
-        assert!(
-            state.records.contains_key(other_purl) && !state.records.contains_key(NPM_PURL),
-            "{:?}",
-            state.records.keys()
-        );
-        assert_eq!(
-            state.edits.len(),
-            1,
-            "other keeps its edit: {:?}",
-            state.edits
-        );
-
-        revert_npm_redirect_purl(root, &mut state, other_purl, false)
-            .await
-            .expect("takeover of other succeeds");
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("package-lock.json"))
-                .await
-                .unwrap(),
-            pristine,
-            "package-lock.json restored byte-identical"
-        );
-        assert!(state.records.is_empty() && state.edits.is_empty());
-    }
-
-    /// The version-scoped claim must not soften the fail-closed contract: a
-    /// lock entry that VANISHED after being redirected still refuses (its
-    /// edit is attributed by key path + recorded URLs), never a silent
-    /// record-drop that strands the edit.
-    #[tokio::test]
-    async fn npm_missing_lock_entry_still_fails_closed() {
-        let lock = serde_json::json!({
-            "name": "app",
-            "version": "1.0.0",
-            "lockfileVersion": 3,
-            "requires": true,
-            "packages": {
-                "": { "name": "app", "version": "1.0.0" },
-                "node_modules/left-pad": {
-                    "version": "1.3.0",
-                    "resolved": "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
-                    "integrity": "sha512-pristine=="
-                },
-            },
-        });
-        let pristine = format!("{}\n", serde_json::to_string_pretty(&lock).unwrap());
-        let (tmp, mut state) = npm_redirected_fixture("package-lock.json", &pristine).await;
-        let root = tmp.path();
-        // A third party pruned the entry from the lock after the redirect.
-        let mut on_disk: Value = serde_json::from_str(
-            &tokio::fs::read_to_string(root.join("package-lock.json"))
-                .await
-                .unwrap(),
-        )
-        .unwrap();
-        on_disk
-            .get_mut("packages")
-            .and_then(Value::as_object_mut)
-            .unwrap()
-            .remove("node_modules/left-pad")
-            .expect("fixture entry present");
-        tokio::fs::write(
-            root.join("package-lock.json"),
-            serde_json::to_string_pretty(&on_disk).unwrap(),
-        )
-        .await
-        .unwrap();
-        let edits_before = state.edits.len();
-
-        let err = revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect_err("vanished entry must refuse");
-        assert!(err.contains("no longer exists"), "{err}");
-        assert!(!state.records.is_empty(), "ledger keeps the record");
-        assert_eq!(state.edits.len(), edits_before, "ledger keeps the edits");
-    }
-
-    /// `npm i mylp@npm:left-pad` records an edit keyed by the ALIAS lock path
-    /// (`node_modules/mylp`); after `npm uninstall mylp` regenerates the lock
-    /// without that entry, the takeover must still attribute the edit to this
-    /// purl (via its recorded URLs — the key path says "mylp") and refuse
-    /// fail-closed exactly like the path-keyed vanished entry above — never
-    /// report success with the alias edit stranded in the ledger behind a
-    /// dropped record (half a takeover).
-    #[tokio::test]
-    async fn npm_vanished_alias_keyed_entry_fails_closed_not_half_takeover() {
-        let lock = serde_json::json!({
-            "name": "app",
-            "version": "1.0.0",
-            "lockfileVersion": 3,
-            "requires": true,
-            "packages": {
-                "": { "name": "app", "version": "1.0.0" },
-                "node_modules/left-pad": {
-                    "version": "1.3.0",
-                    "resolved": "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
-                    "integrity": "sha512-pristine=="
-                },
-                // Alias install OF the target package: the rewriter matches
-                // it via the `name` field and keys its edit by this path.
-                "node_modules/mylp": {
-                    "name": "left-pad",
-                    "version": "1.3.0",
-                    "resolved": "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
-                    "integrity": "sha512-pristine=="
-                },
-            },
-        });
-        let pristine = format!("{}\n", serde_json::to_string_pretty(&lock).unwrap());
-        let (tmp, mut state) = npm_redirected_fixture("package-lock.json", &pristine).await;
-        let root = tmp.path();
-        assert_eq!(
-            state.edits.len(),
-            2,
-            "path-keyed + alias-keyed edits: {:?}",
-            state.edits
-        );
-        // `npm uninstall mylp` regenerated the lock: the alias entry is gone,
-        // the surviving entry keeps the hosted `resolved`.
-        let mut on_disk: Value = serde_json::from_str(
-            &tokio::fs::read_to_string(root.join("package-lock.json"))
-                .await
-                .unwrap(),
-        )
-        .unwrap();
-        on_disk
-            .get_mut("packages")
-            .and_then(Value::as_object_mut)
-            .unwrap()
-            .remove("node_modules/mylp")
-            .expect("fixture alias entry present");
-        let on_disk_text = serde_json::to_string_pretty(&on_disk).unwrap();
-        tokio::fs::write(root.join("package-lock.json"), &on_disk_text)
-            .await
-            .unwrap();
-        let edits_before = state.edits.len();
-
-        let err = revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect_err("vanished alias-keyed entry must refuse, not strand its edit");
-        assert!(err.contains("no longer exists"), "{err}");
-        assert!(!state.records.is_empty(), "ledger keeps the record");
-        assert_eq!(state.edits.len(), edits_before, "ledger keeps the edits");
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("package-lock.json"))
-                .await
-                .unwrap(),
-            on_disk_text,
-            "nothing reached disk on refusal"
-        );
-    }
-
-    /// `npm i left-pad@npm:other` keys package `other` under
-    /// `node_modules/left-pad`; a hand edit strips BOTH the `name` and
-    /// `version` fields from that live entry. Taking over left-pad must not
-    /// claim `other`'s edit through a version-only URL fallback — the entry's
-    /// live values ARE that edit's `new` values, so the replay would NOT fail
-    /// closed: `other` would be silently un-hosted and its edit dropped while
-    /// its record survives edit-less.
-    #[tokio::test]
-    async fn npm_version_gone_fallback_does_not_claim_alias_collision_sibling() {
-        let other_purl = "pkg:npm/other@1.3.0";
-        let lock = serde_json::json!({
-            "name": "app",
-            "version": "1.0.0",
-            "lockfileVersion": 3,
-            "requires": true,
-            "packages": {
-                "": { "name": "app", "version": "1.0.0" },
-                // Alias of ANOTHER package onto this key path — same version
-                // on purpose.
-                "node_modules/left-pad": {
-                    "name": "other",
-                    "version": "1.3.0",
-                    "resolved": "https://registry.npmjs.org/other/-/other-1.3.0.tgz",
-                    "integrity": "sha512-pristine-other=="
-                },
-                // The real target package, nested.
-                "node_modules/b/node_modules/left-pad": {
-                    "version": "1.3.0",
-                    "resolved": "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
-                    "integrity": "sha512-pristine-1.3.0=="
-                },
-            },
-        });
-        let pristine = format!("{}\n", serde_json::to_string_pretty(&lock).unwrap());
-        let (tmp, mut state) = npm_redirected_fixture_multi(
-            "package-lock.json",
-            &pristine,
-            &[
-                (NPM_PURL, npm_dep()),
-                (other_purl, npm_dep_for("other", "1.3.0")),
-            ],
-        )
-        .await;
-        let root = tmp.path();
-        assert_eq!(state.edits.len(), 2, "{:?}", state.edits);
-        let other_url = npm_dep_for("other", "1.3.0").artifact_url.clone();
-        // Hand edit / merge artifact: strip the alias entry's name+version.
-        let mut on_disk: Value = serde_json::from_str(
-            &tokio::fs::read_to_string(root.join("package-lock.json"))
-                .await
-                .unwrap(),
-        )
-        .unwrap();
-        let entry = on_disk
-            .get_mut("packages")
-            .and_then(|p| p.get_mut("node_modules/left-pad"))
-            .and_then(Value::as_object_mut)
-            .unwrap();
-        entry.remove("name").expect("fixture name field present");
-        entry
-            .remove("version")
-            .expect("fixture version field present");
-        tokio::fs::write(
-            root.join("package-lock.json"),
-            serde_json::to_string_pretty(&on_disk).unwrap(),
-        )
-        .await
-        .unwrap();
-
-        revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("takeover of left-pad succeeds without touching `other`");
-
-        let lock = tokio::fs::read_to_string(root.join("package-lock.json"))
-            .await
-            .unwrap();
-        assert!(!lock.contains(NPM_URL), "left-pad un-hosted: {lock}");
-        assert!(
-            lock.contains(&other_url),
-            "`other` (aliased onto node_modules/left-pad, fields stripped) \
-             still hosted-wired: {lock}"
-        );
-        assert!(
-            state.records.contains_key(other_purl) && !state.records.contains_key(NPM_PURL),
-            "{:?}",
-            state.records.keys()
-        );
-        assert_eq!(
-            state.edits.len(),
-            1,
-            "other keeps its edit: {:?}",
-            state.edits
-        );
-    }
-
-    /// Narrowing guard for the version-gone fallback: with only the `version`
-    /// field hand-stripped from the target's own live entry, the recorded
-    /// URLs name this exact package+version, so the takeover still claims and
-    /// reverts it rather than stranding the edit.
-    #[tokio::test]
-    async fn npm_version_stripped_target_entry_is_still_claimed_via_recorded_urls() {
-        let lock = serde_json::json!({
-            "name": "app",
-            "version": "1.0.0",
-            "lockfileVersion": 3,
-            "requires": true,
-            "packages": {
-                "": { "name": "app", "version": "1.0.0" },
-                "node_modules/left-pad": {
-                    "version": "1.3.0",
-                    "resolved": "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
-                    "integrity": "sha512-pristine=="
-                },
-            },
-        });
-        let pristine = format!("{}\n", serde_json::to_string_pretty(&lock).unwrap());
-        let (tmp, mut state) = npm_redirected_fixture("package-lock.json", &pristine).await;
-        let root = tmp.path();
-        let mut on_disk: Value = serde_json::from_str(
-            &tokio::fs::read_to_string(root.join("package-lock.json"))
-                .await
-                .unwrap(),
-        )
-        .unwrap();
-        on_disk
-            .get_mut("packages")
-            .and_then(|p| p.get_mut("node_modules/left-pad"))
-            .and_then(Value::as_object_mut)
-            .unwrap()
-            .remove("version")
-            .expect("fixture version field present");
-        tokio::fs::write(
-            root.join("package-lock.json"),
-            serde_json::to_string_pretty(&on_disk).unwrap(),
-        )
-        .await
-        .unwrap();
-
-        revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("revert succeeds");
-        let lock = tokio::fs::read_to_string(root.join("package-lock.json"))
-            .await
-            .unwrap();
-        assert!(!lock.contains(NPM_URL), "left-pad un-hosted: {lock}");
-        assert!(state.records.is_empty(), "record dropped");
-        assert!(state.edits.is_empty(), "edits dropped");
-    }
-
-    /// Scope-blindness guard for the version-gone URL fallback: `npm i
-    /// left-pad@npm:@scope/left-pad` keys the SCOPED fork under
-    /// `node_modules/left-pad`, and its registry URL
-    /// (`…/@scope/left-pad/-/left-pad-1.3.0.tgz`) embeds both `/left-pad/`
-    /// (the slash closing `@scope`) and the bare `left-pad-1.3.0.tgz`
-    /// basename. With the entry's `name`+`version` hand-stripped, taking
-    /// over unscoped left-pad must not claim the scoped sibling's edit
-    /// through those substrings — the entry's live values ARE that edit's
-    /// `new` values, so the replay would NOT fail closed: @scope/left-pad
-    /// would be silently un-hosted and its edit dropped while its record
-    /// survives edit-less.
-    #[tokio::test]
-    async fn npm_version_gone_fallback_does_not_claim_scoped_sibling_of_same_bare_name() {
-        let scoped_purl = "pkg:npm/@scope/left-pad@1.3.0";
-        let lock = serde_json::json!({
-            "name": "app",
-            "version": "1.0.0",
-            "lockfileVersion": 3,
-            "requires": true,
-            "packages": {
-                "": { "name": "app", "version": "1.0.0" },
-                // The scoped fork aliased onto the bare key path — same bare
-                // name AND version on purpose.
-                "node_modules/left-pad": {
-                    "name": "@scope/left-pad",
-                    "version": "1.3.0",
-                    "resolved": "https://registry.npmjs.org/@scope/left-pad/-/left-pad-1.3.0.tgz",
-                    "integrity": "sha512-pristine-scoped=="
-                },
-                // The real target package, nested.
-                "node_modules/b/node_modules/left-pad": {
-                    "version": "1.3.0",
-                    "resolved": "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
-                    "integrity": "sha512-pristine-1.3.0=="
-                },
-            },
-        });
-        let pristine = format!("{}\n", serde_json::to_string_pretty(&lock).unwrap());
-        let (tmp, mut state) = npm_redirected_fixture_multi(
-            "package-lock.json",
-            &pristine,
-            &[
-                (NPM_PURL, npm_dep()),
-                (scoped_purl, npm_dep_for("@scope/left-pad", "1.3.0")),
-            ],
-        )
-        .await;
-        let root = tmp.path();
-        assert_eq!(state.edits.len(), 2, "{:?}", state.edits);
-        let scoped_url = npm_dep_for("@scope/left-pad", "1.3.0").artifact_url.clone();
-        // Hand edit / merge artifact: strip the alias entry's name+version.
-        let mut on_disk: Value = serde_json::from_str(
-            &tokio::fs::read_to_string(root.join("package-lock.json"))
-                .await
-                .unwrap(),
-        )
-        .unwrap();
-        let entry = on_disk
-            .get_mut("packages")
-            .and_then(|p| p.get_mut("node_modules/left-pad"))
-            .and_then(Value::as_object_mut)
-            .unwrap();
-        entry.remove("name").expect("fixture name field present");
-        entry
-            .remove("version")
-            .expect("fixture version field present");
-        tokio::fs::write(
-            root.join("package-lock.json"),
-            serde_json::to_string_pretty(&on_disk).unwrap(),
-        )
-        .await
-        .unwrap();
-
-        revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("takeover of left-pad succeeds without touching @scope/left-pad");
-
-        let lock = tokio::fs::read_to_string(root.join("package-lock.json"))
-            .await
-            .unwrap();
-        assert!(!lock.contains(NPM_URL), "left-pad un-hosted: {lock}");
-        assert!(
-            lock.contains(&scoped_url),
-            "@scope/left-pad (aliased onto node_modules/left-pad, fields \
-             stripped) still hosted-wired: {lock}"
-        );
-        assert!(
-            state.records.contains_key(scoped_purl) && !state.records.contains_key(NPM_PURL),
-            "{:?}",
-            state.records.keys()
-        );
-        assert_eq!(
-            state.edits.len(),
-            1,
-            "the scoped sibling keeps its edit: {:?}",
-            state.edits
-        );
-    }
-
-    /// Fail-closed-direction twin of the scoped-sibling guard: with
-    /// @scope/left-pad installed at its own scoped path and then
-    /// uninstalled (its entry vanished, its edit orphaned in the ledger),
-    /// taking over UNSCOPED left-pad@1.3.0 must not claim the orphan
-    /// through the URL fallback — claiming it refuses with "entry
-    /// `node_modules/@scope/left-pad` … no longer exists", a spurious
-    /// permanent refusal for a purl whose own wiring is intact.
-    #[tokio::test]
-    async fn npm_vanished_scoped_sibling_entry_does_not_block_the_unscoped_takeover() {
-        let scoped_purl = "pkg:npm/@scope/left-pad@1.3.0";
-        let lock = serde_json::json!({
-            "name": "app",
-            "version": "1.0.0",
-            "lockfileVersion": 3,
-            "requires": true,
-            "packages": {
-                "": { "name": "app", "version": "1.0.0" },
-                "node_modules/left-pad": {
-                    "version": "1.3.0",
-                    "resolved": "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
-                    "integrity": "sha512-pristine-1.3.0=="
-                },
-                "node_modules/@scope/left-pad": {
-                    "version": "1.3.0",
-                    "resolved": "https://registry.npmjs.org/@scope/left-pad/-/left-pad-1.3.0.tgz",
-                    "integrity": "sha512-pristine-scoped=="
-                },
-            },
-        });
-        let pristine = format!("{}\n", serde_json::to_string_pretty(&lock).unwrap());
-        let (tmp, mut state) = npm_redirected_fixture_multi(
-            "package-lock.json",
-            &pristine,
-            &[
-                (NPM_PURL, npm_dep()),
-                (scoped_purl, npm_dep_for("@scope/left-pad", "1.3.0")),
-            ],
-        )
-        .await;
-        let root = tmp.path();
-        assert_eq!(state.edits.len(), 2, "{:?}", state.edits);
-        // `npm uninstall @scope/left-pad` regenerated the lock without the
-        // scoped entry; the ledger still holds its edit.
-        let mut on_disk: Value = serde_json::from_str(
-            &tokio::fs::read_to_string(root.join("package-lock.json"))
-                .await
-                .unwrap(),
-        )
-        .unwrap();
-        on_disk
-            .get_mut("packages")
-            .and_then(Value::as_object_mut)
-            .unwrap()
-            .remove("node_modules/@scope/left-pad")
-            .expect("fixture scoped entry present");
-        tokio::fs::write(
-            root.join("package-lock.json"),
-            serde_json::to_string_pretty(&on_disk).unwrap(),
-        )
-        .await
-        .unwrap();
-
-        revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("takeover of left-pad succeeds despite the scoped orphan edit");
-
-        let lock = tokio::fs::read_to_string(root.join("package-lock.json"))
-            .await
-            .unwrap();
-        assert!(!lock.contains(NPM_URL), "left-pad un-hosted: {lock}");
-        assert!(
-            state.records.contains_key(scoped_purl) && !state.records.contains_key(NPM_PURL),
-            "{:?}",
-            state.records.keys()
-        );
-        assert_eq!(
-            state.edits.len(),
-            1,
-            "the scoped orphan edit survives for its own takeover: {:?}",
-            state.edits
-        );
-        assert_eq!(
-            state.edits[0].key.as_deref(),
-            Some("node_modules/@scope/left-pad"),
-            "{:?}",
-            state.edits
-        );
-    }
-
-    #[tokio::test]
-    async fn npm_refuses_on_drifted_lock_fail_closed() {
-        let (tmp, mut state) = npm_redirected_fixture("yarn.lock", &classic_pristine()).await;
-        let root = tmp.path();
-        // A third party re-resolved the entry to a shape the ledger never saw.
-        let drifted = classic_pristine().replace(
-            "https://registry.yarnpkg.com/left-pad/-/left-pad-1.3.0.tgz#5b8a",
-            "https://corp.example/left-pad-1.3.0.tgz#dead",
-        );
-        tokio::fs::write(root.join("yarn.lock"), &drifted)
-            .await
-            .unwrap();
-        let records_before = state.records.len();
-        let edits_before = state.edits.len();
-
-        let err = revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect_err("drifted lock must refuse");
-        assert!(err.contains("drifted"), "{err}");
-        // The ledger keeps everything on refusal, and the file is untouched.
-        assert_eq!(state.records.len(), records_before);
-        assert_eq!(state.edits.len(), edits_before);
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("yarn.lock"))
-                .await
-                .unwrap(),
-            drifted
-        );
-    }
-
-    #[tokio::test]
-    async fn npm_missing_record_is_an_error() {
-        let tmp = tempfile::tempdir().unwrap();
-        let mut state = RedirectState::new();
-        let err = revert_npm_redirect_purl(tmp.path(), &mut state, NPM_PURL, false)
-            .await
-            .expect_err("no record");
-        assert!(err.contains("records no hosted redirect"), "{err}");
-    }
-
-    // ── bun ──────────────────────────────────────────────────────────────
-
-    /// Real text-lock grammar (bun 1.4.2 matrix capture, lockfileVersion 2;
-    /// the `packages` tuple grammar is identical on 0/1/2): the root
-    /// `left-pad@1.3.0` registry 4-tuple, a nested `haspad/left-pad`
-    /// instance at the SIBLING version 1.2.0, and an unrelated `other`.
-    fn bun_pristine() -> String {
-        r#"{
-  "lockfileVersion": 2,
-  "configVersion": 1,
-  "workspaces": {
-    "": {
-      "name": "takeover-fixture",
-      "dependencies": {
-        "haspad": "1.0.0",
-        "left-pad": "1.3.0",
-        "other": "1.0.0",
-      },
-    },
-  },
-  "packages": {
-    "haspad": ["haspad@1.0.0", "", { "dependencies": { "left-pad": "^1.2.0" } }, "sha512-hh=="],
-
-    "left-pad": ["left-pad@1.3.0", "", {}, "sha512-XI5MPzVNApjAyhQzphX8BkmKsKUxD4LdyK24iZeQGinBN9yTQT3bFlCBy/aVx2HrNcqQGsdot8ghrjyrvMCoEA=="],
-
-    "other": ["other@1.0.0", "", {}, "sha512-oo=="],
-
-    "haspad/left-pad": ["left-pad@1.2.0", "", {}, "sha512-OQadpCyFCT/VLniZQgym8d3/ofIJtuZyw2ibsVeIUOexKgW/osn8+mMFJbwGMPeDC4GnLzD8q115WPCDx4YRWg=="],
-  }
-}
-"#
-        .to_string()
-    }
-
-    /// The packages-entry line keyed `key` (verbatim, without its line
-    /// terminator).
-    fn bun_line(lock: &str, key: &str) -> String {
-        let prefix = format!("    \"{key}\": [");
-        lock.split('\n')
-            .find(|l| l.starts_with(&prefix))
-            .unwrap_or_else(|| panic!("no `{key}` entry in:\n{lock}"))
-            .trim_end_matches('\r')
-            .to_string()
-    }
-
-    async fn read_lock(root: &Path) -> String {
-        tokio::fs::read_to_string(root.join("bun.lock"))
-            .await
-            .unwrap()
-    }
-
-    /// The takeover claims the purl's `redirect_bun_lock_package` edit
-    /// by the recorded line's spec and replays the registry line back,
-    /// leaving the sibling-version and foreign entries untouched.
-    #[tokio::test]
-    async fn npm_bun_lock_takeover_restores_the_registry_line_and_drops_the_ledger() {
-        let (tmp, mut state) = npm_redirected_fixture("bun.lock", &bun_pristine()).await;
-        let root = tmp.path();
-        let wired = read_lock(root).await;
-        assert!(wired.contains(NPM_URL), "fixture is hosted-wired:\n{wired}");
-        assert_eq!(
-            state
-                .edits
-                .iter()
-                .filter(|e| e.kind == BUN_TEXT_KIND)
-                .count(),
-            1,
-            "one bun edit for the one 1.3.0 instance: {:?}",
-            state.edits
-        );
-
-        let out = revert_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("bun takeover revert succeeds");
-        assert_eq!(out.reverted_files, vec!["bun.lock".to_string()]);
-        assert_eq!(
-            read_lock(root).await,
-            bun_pristine(),
-            "bun.lock restored byte-identical"
-        );
-        assert!(state.records.is_empty(), "record dropped");
-        assert!(state.edits.is_empty(), "edit consumed");
-    }
-
-    /// (a) A hosted edit for ANOTHER VERSION of the same package (the nested
-    /// `haspad/left-pad` at 1.2.0) is not this purl's to claim: reverting
-    /// 1.3.0 leaves the 1.2.0 line hosted and its record + edit in the
-    /// ledger.
-    #[tokio::test]
-    async fn npm_bun_sibling_version_edit_is_neither_claimed_nor_a_refusal() {
-        const SIBLING: &str = "pkg:npm/left-pad@1.2.0";
-        let (tmp, mut state) = npm_redirected_fixture_multi(
-            "bun.lock",
-            &bun_pristine(),
-            &[
-                (NPM_PURL, npm_dep()),
-                (SIBLING, npm_dep_for("left-pad", "1.2.0")),
-            ],
-        )
-        .await;
-        let root = tmp.path();
-        let wired = read_lock(root).await;
-        let sibling_line = bun_line(&wired, "haspad/left-pad");
-        assert!(
-            sibling_line.contains("/left-pad/1.2.0/")
-                && sibling_line.contains("left-pad-1.2.0.tgz"),
-            "sibling instance is hosted-wired too: {sibling_line}"
-        );
-        assert_eq!(state.edits.len(), 2, "{:?}", state.edits);
-
-        revert_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("takeover of 1.3.0 succeeds");
-        let after = read_lock(root).await;
-        assert_eq!(
-            bun_line(&after, "left-pad"),
-            bun_line(&bun_pristine(), "left-pad"),
-            "the 1.3.0 line is back to its registry tuple"
-        );
-        assert_eq!(
-            bun_line(&after, "haspad/left-pad"),
-            sibling_line,
-            "the sibling version's hosted line is untouched"
-        );
-        assert_eq!(state.edits.len(), 1, "{:?}", state.edits);
-        assert_eq!(state.edits[0].key.as_deref(), Some("haspad/left-pad"));
-        assert!(
-            state.records.contains_key(SIBLING) && !state.records.contains_key(NPM_PURL),
-            "{:?}",
-            state.records.keys()
-        );
-    }
-
-    /// The digest-less spelling Bun 1.1.39–1.3.9 re-save a URL 3-tuple as
-    /// (`bun add`, `bun install` after a manifest change): the recorded
-    /// `new` is no longer on disk byte-for-byte, but the 2-tuple with the
-    /// same key/spec/meta IS our wiring — the claim must not refuse as
-    /// drift (that would block hosted→vendored takeover, scoped `rollback`
-    /// and `remove` for every user on those releases). The registry line comes
-    /// back and the ledger is cleared.
-    fn drop_digest(line: &str) -> String {
-        let cut = line
-            .rfind(", \"sha512-")
-            .unwrap_or_else(|| panic!("no sha512 element in {line}"));
-        let tail = if line.trim_end_matches('\r').ends_with("],") {
-            "],"
-        } else {
-            "]"
-        };
-        let cr = if line.ends_with('\r') { "\r" } else { "" };
-        format!("{}{tail}{cr}", &line[..cut])
-    }
-
-    #[tokio::test]
-    async fn npm_bun_digestless_live_line_is_claimed_and_restored() {
-        let (tmp, mut state) = npm_redirected_fixture("bun.lock", &bun_pristine()).await;
-        let root = tmp.path();
-        let wired = read_lock(root).await;
-        let wired_line = bun_line(&wired, "left-pad");
-        let digestless = drop_digest(&wired_line);
-        assert!(
-            digestless.ends_with("{}],") && !digestless.contains("sha512"),
-            "{digestless}"
-        );
-        tokio::fs::write(
-            root.join("bun.lock"),
-            wired.replace(&wired_line, &digestless),
-        )
-        .await
-        .unwrap();
-
-        let out = revert_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("the digest-less spelling of our own wiring must not refuse");
-        assert_eq!(out.reverted_files, vec!["bun.lock".to_string()]);
-        assert_eq!(
-            read_lock(root).await,
-            bun_pristine(),
-            "registry line restored"
-        );
-        assert!(state.records.is_empty() && state.edits.is_empty());
-    }
-
-    /// Both hosted instances re-saved digest-less; reverting 1.3.0 restores
-    /// ONLY its line — the sibling 1.2.0 keeps its digest-less hosted
-    /// 2-tuple untouched (it is that purl's wiring, not ours to heal).
-    #[tokio::test]
-    async fn npm_bun_digestless_sibling_stays_untouched() {
-        const SIBLING: &str = "pkg:npm/left-pad@1.2.0";
-        let (tmp, mut state) = npm_redirected_fixture_multi(
-            "bun.lock",
-            &bun_pristine(),
-            &[
-                (NPM_PURL, npm_dep()),
-                (SIBLING, npm_dep_for("left-pad", "1.2.0")),
-            ],
-        )
-        .await;
-        let root = tmp.path();
-        let wired = read_lock(root).await;
-        let main_line = bun_line(&wired, "left-pad");
-        let sibling_line = bun_line(&wired, "haspad/left-pad");
-        let sibling_digestless = drop_digest(&sibling_line);
-        let live = wired
-            .replace(&main_line, &drop_digest(&main_line))
-            .replace(&sibling_line, &sibling_digestless);
-        tokio::fs::write(root.join("bun.lock"), &live)
-            .await
-            .unwrap();
-
-        revert_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("takeover of 1.3.0 succeeds");
-        let after = read_lock(root).await;
-        assert_eq!(
-            bun_line(&after, "left-pad"),
-            bun_line(&bun_pristine(), "left-pad")
-        );
-        assert_eq!(
-            bun_line(&after, "haspad/left-pad"),
-            sibling_digestless,
-            "the sibling's digest-less hosted line is left exactly as found"
-        );
-        assert_eq!(state.edits.len(), 1);
-        assert!(state.records.contains_key(SIBLING) && !state.records.contains_key(NPM_PURL));
-    }
-
-    /// A digest-less 2-tuple at ANOTHER uuid (someone re-granted the patch
-    /// and Bun re-saved it) is not the recorded wiring: still drift, still
-    /// a refusal, file byte-identical.
-    #[tokio::test]
-    async fn npm_bun_digestless_line_at_another_uuid_still_refuses() {
-        let (tmp, mut state) = npm_redirected_fixture("bun.lock", &bun_pristine()).await;
-        let root = tmp.path();
-        let wired = read_lock(root).await;
-        let wired_line = bun_line(&wired, "left-pad");
-        let foreign = drop_digest(&wired_line).replace("/6b7c/", "/7c8d/");
-        assert_ne!(
-            foreign,
-            drop_digest(&wired_line),
-            "the uuid segment must differ"
-        );
-        let live = wired.replace(&wired_line, &foreign);
-        tokio::fs::write(root.join("bun.lock"), &live)
-            .await
-            .unwrap();
-
-        let err = revert_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect_err("another uuid's digest-less line is drift");
-        assert!(err.contains("drifted"), "{err}");
-        assert_eq!(
-            read_lock(root).await,
-            live,
-            "refusal leaves the lock untouched"
-        );
-        assert_eq!(state.edits.len(), 1);
-        assert!(state.records.contains_key(NPM_PURL));
-    }
-
-    /// (b) Scoped package + re-redirect chain: the hosted rewrite destroys
-    /// the `@scope/pkg@1.0.0` spec, so the SECOND redirect (a rotated
-    /// artifact URL) records a hosted-URL line as its `original`. That edit
-    /// is claimed through the URL's tarball leaf (`pkg-1.0.0.tgz` — the
-    /// scope is a path level, not part of the basename) plus the full
-    /// scoped name in the spec; `@other/pkg` and bare `pkg`, whose leaves
-    /// are identical, stay hosted. Both links unwind newest-first to the
-    /// registry line.
-    #[tokio::test]
-    async fn npm_bun_scoped_package_claims_the_re_redirect_chain_by_spec_and_leaf() {
-        const SCOPED: &str = "pkg:npm/%40scope/pkg@1.0.0";
-        const OTHER_SCOPE: &str = "pkg:npm/%40other/pkg@1.0.0";
-        const BARE: &str = "pkg:npm/pkg@1.0.0";
-        let pristine = r#"{
-  "lockfileVersion": 2,
-  "configVersion": 1,
-  "workspaces": {
-    "": {
-      "name": "scoped-fixture",
-      "dependencies": {
-        "@other/pkg": "1.0.0",
-        "@scope/pkg": "1.0.0",
-        "pkg": "1.0.0",
-      },
-    },
-  },
-  "packages": {
-    "@other/pkg": ["@other/pkg@1.0.0", "", {}, "sha512-o1=="],
-
-    "@scope/pkg": ["@scope/pkg@1.0.0", "", {}, "sha512-s1=="],
-
-    "pkg": ["pkg@1.0.0", "", {}, "sha512-p1=="],
-  }
-}
-"#;
-        let (tmp, mut state) = npm_redirected_fixture_multi(
-            "bun.lock",
-            pristine,
-            &[
-                (SCOPED, npm_dep_for("@scope/pkg", "1.0.0")),
-                (OTHER_SCOPE, npm_dep_for("@other/pkg", "1.0.0")),
-                (BARE, npm_dep_for("pkg", "1.0.0")),
-            ],
-        )
-        .await;
-        let root = tmp.path();
-        let first = read_lock(root).await;
-        let first_scoped_line = bun_line(&first, "@scope/pkg");
-        assert!(
-            first_scoped_line.contains("/@scope/pkg/1.0.0/"),
-            "{first_scoped_line}"
-        );
-
-        // Second redirect of ONLY @scope/pkg with a rotated artifact URL
-        // (same origin + leaf, different uuid path segment): the rewriter's
-        // prior-hosted match re-pins it and records the chain link.
-        let mut rotated = npm_dep_for("@scope/pkg", "1.0.0");
-        rotated.artifact_url = rotated.artifact_url.replace("/6b7c/", "/7c8d/");
-        let mut files: BTreeMap<String, String> = BTreeMap::new();
-        files.insert("bun.lock".into(), first.clone());
-        let rewrite = crate::patch::redirect::rewrite_registry_redirect(&files, &[rotated]);
-        let second = rewrite
-            .files
-            .get("bun.lock")
-            .unwrap_or_else(|| panic!("re-redirect must rewrite: {:?}", rewrite.warnings))
-            .clone();
-        assert!(
-            bun_line(&second, "@scope/pkg").contains("/7c8d/"),
-            "{second}"
-        );
-        tokio::fs::write(root.join("bun.lock"), &second)
-            .await
-            .unwrap();
-        state.edits.extend(rewrite.edits);
-        assert_eq!(state.edits.len(), 4, "{:?}", state.edits);
-        let chain_link = state.edits.last().unwrap();
-        assert!(
-            chain_link.original.as_ref().and_then(Value::as_str)
-                == Some(first_scoped_line.as_str()),
-            "the chain link's original is the PRIOR hosted line: {chain_link:?}"
-        );
-
-        revert_redirect_purl(root, &mut state, "pkg:npm/@scope/pkg@1.0.0", false)
-            .await
-            .expect("scoped takeover succeeds");
-        let after = read_lock(root).await;
-        assert_eq!(
-            bun_line(&after, "@scope/pkg"),
-            bun_line(pristine, "@scope/pkg"),
-            "both chain links unwound to the registry tuple"
-        );
-        assert_eq!(
-            bun_line(&after, "@other/pkg"),
-            bun_line(&first, "@other/pkg"),
-            "same-leaf scoped sibling stays hosted"
-        );
-        assert_eq!(
-            bun_line(&after, "pkg"),
-            bun_line(&first, "pkg"),
-            "same-leaf bare sibling stays hosted"
-        );
-        assert_eq!(state.edits.len(), 2, "{:?}", state.edits);
-        assert!(
-            state
-                .edits
-                .iter()
-                .all(|e| matches!(e.key.as_deref(), Some("@other/pkg") | Some("pkg"))),
-            "{:?}",
-            state.edits
-        );
-        assert!(
-            !state.records.contains_key(SCOPED)
-                && state.records.contains_key(OTHER_SCOPE)
-                && state.records.contains_key(BARE),
-            "{:?}",
-            state.records.keys()
-        );
-    }
-
-    /// The claim rule in isolation: registry spec by exact version, hosted
-    /// URL spec by exact tarball leaf, full (scoped) name in every case;
-    /// anything else — sibling versions, local vendored paths, workspace
-    /// specs, URLs without a path — is not ours.
-    #[test]
-    fn bun_spec_names_discriminates_name_and_version() {
-        assert!(bun_spec_names("left-pad@1.3.0", "left-pad", "1.3.0"));
-        assert!(!bun_spec_names("left-pad@1.3.0-rc1", "left-pad", "1.3.0"));
-        assert!(!bun_spec_names("left-pad@11.3.0", "left-pad", "1.3.0"));
-        assert!(!bun_spec_names("left-pad@1.3.0", "other", "1.3.0"));
-        assert!(bun_spec_names(
-            &format!("left-pad@{NPM_URL}"),
-            "left-pad",
-            "1.3.0"
-        ));
-        assert!(!bun_spec_names(
-            "left-pad@http://127.0.0.1:5555/p/left-pad-11.3.0.tgz",
-            "left-pad",
-            "1.3.0"
-        ));
-        assert!(!bun_spec_names(
-            "left-pad@http://127.0.0.1:5555/p/left-pad-1.3.0-rc1.tgz",
-            "left-pad",
-            "1.3.0"
-        ));
-        // Vendored local path, workspace and origin-only specs are never
-        // hosted redirects.
-        assert!(!bun_spec_names(
-            "left-pad@.socket/vendor/npm/6b7c/left-pad-1.3.0.tgz",
-            "left-pad",
-            "1.3.0"
-        ));
-        assert!(!bun_spec_names(
-            "left-pad@workspace:packages/left-pad",
-            "left-pad",
-            "1.3.0"
-        ));
-        assert!(!bun_spec_names(
-            "left-pad@https://patch.socket.dev",
-            "left-pad",
-            "1.3.0"
-        ));
-        // Scoped: the leaf is the BARE basename whether the URL keeps the
-        // scope as a path level (production, test fixtures) or not; the
-        // full scoped name must match the spec's name.
-        assert!(bun_spec_names(
-            "@scope/pkg@https://patch.socket.dev/patch/npm/@scope/pkg/1.0.0/t/u/pkg-1.0.0.tgz",
-            "@scope/pkg",
-            "1.0.0"
-        ));
-        assert!(bun_spec_names(
-            "@scope/pkg@http://127.0.0.1:5555/patch/npm/@scope/pkg/1.0.0/tok/6b7c/@scope/pkg-1.0.0.tgz",
-            "@scope/pkg",
-            "1.0.0"
-        ));
-        assert!(!bun_spec_names(
-            "@other/pkg@https://h/patch/npm/@other/pkg/1.0.0/t/u/pkg-1.0.0.tgz",
-            "@scope/pkg",
-            "1.0.0"
-        ));
-        assert!(!bun_spec_names(
-            "pkg@https://h/patch/npm/pkg/1.0.0/t/u/pkg-1.0.0.tgz",
-            "@scope/pkg",
-            "1.0.0"
-        ));
-        assert!(bun_spec_names("@scope/pkg@1.0.0", "@scope/pkg", "1.0.0"));
-    }
-
-    /// (c) Drift: the line was re-resolved by a third party since the
-    /// redirect (neither the hosted nor the registry line is present) —
-    /// the same fail-closed refusal the yarn/pnpm text kinds give, with the
-    /// file and ledger left exactly as found.
-    #[tokio::test]
-    async fn npm_bun_drifted_line_refuses_fail_closed() {
-        let (tmp, mut state) = npm_redirected_fixture("bun.lock", &bun_pristine()).await;
-        let root = tmp.path();
-        let wired = read_lock(root).await;
-        let drifted = wired.replace(
-            &bun_line(&wired, "left-pad"),
-            "    \"left-pad\": [\"left-pad@https://corp.example/mirror/left-pad-1.3.0.tgz\", {}, \"sha512-corp==\"],",
-        );
-        assert_ne!(drifted, wired);
-        tokio::fs::write(root.join("bun.lock"), &drifted)
-            .await
-            .unwrap();
-        let records_before = state.records.len();
-        let edits_before = state.edits.len();
-
-        let err = revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect_err("drifted line must refuse");
-        assert!(err.contains("drifted"), "{err}");
-        assert!(err.contains("bun.lock"), "{err}");
-        assert_eq!(read_lock(root).await, drifted, "file untouched");
-        assert_eq!(state.records.len(), records_before);
-        assert_eq!(state.edits.len(), edits_before);
-    }
-
-    /// (d) CRLF lock: the recorded lines carry (or, for a rewriter that
-    /// normalized the rewritten line, lack) a trailing `\r`; the whole-line
-    /// replace restores the pristine CRLF bytes either way.
-    #[tokio::test]
-    async fn npm_bun_crlf_lock_round_trips_byte_exact() {
-        let pristine = bun_pristine().replace('\n', "\r\n");
-        let (tmp, mut state) = npm_redirected_fixture("bun.lock", &pristine).await;
-        let root = tmp.path();
-        let wired = read_lock(root).await;
-        assert!(wired.contains(NPM_URL), "{wired}");
-        assert!(
-            wired.contains("\r\n"),
-            "CRLF preserved elsewhere: {wired:?}"
-        );
-
-        revert_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("CRLF takeover succeeds");
-        assert_eq!(
-            read_lock(root).await,
-            pristine,
-            "CRLF bun.lock restored byte-identical"
-        );
-        assert!(state.records.is_empty() && state.edits.is_empty());
-    }
-
-    /// (e) Two hosted records (different packages): the takeover of one
-    /// restores only its line and keeps the other purl's record + edit —
-    /// the state a scoped `rollback <purl>` / `remove <purl>` needs.
-    #[tokio::test]
-    async fn npm_bun_two_hosted_records_takeover_of_one_leaves_the_other_hosted() {
-        const OTHER: &str = "pkg:npm/other@1.0.0";
-        let (tmp, mut state) = npm_redirected_fixture_multi(
-            "bun.lock",
-            &bun_pristine(),
-            &[
-                (NPM_PURL, npm_dep()),
-                (OTHER, npm_dep_for("other", "1.0.0")),
-            ],
-        )
-        .await;
-        let root = tmp.path();
-        let wired = read_lock(root).await;
-        let other_line = bun_line(&wired, "other");
-        assert!(other_line.contains("other-1.0.0.tgz"), "{other_line}");
-
-        let out = revert_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("takeover succeeds");
-        assert_eq!(out.reverted_files, vec!["bun.lock".to_string()]);
-        let after = read_lock(root).await;
-        assert_eq!(
-            bun_line(&after, "left-pad"),
-            bun_line(&bun_pristine(), "left-pad")
-        );
-        assert_eq!(bun_line(&after, "other"), other_line, "other stays hosted");
-        assert_eq!(state.edits.len(), 1);
-        assert_eq!(state.edits[0].key.as_deref(), Some("other"));
-        assert_eq!(state.records.len(), 1);
-        assert!(state.records.contains_key(OTHER));
-
-        // Taking over the second one finishes the job.
-        revert_redirect_purl(root, &mut state, OTHER, false)
-            .await
-            .expect("second takeover succeeds");
-        assert_eq!(read_lock(root).await, bun_pristine());
-        assert!(state.records.is_empty() && state.edits.is_empty());
-    }
-
-    /// bun's dry run mirrors the cargo/yarn contract: every inverse and
-    /// drift check resolves, nothing reaches disk, the in-memory ledger is
-    /// claimed, and the preview names the files a wet run rewrites.
-    #[tokio::test]
-    async fn npm_bun_dry_run_previews_without_touching_disk() {
-        let (tmp, mut state) = npm_redirected_fixture("bun.lock", &bun_pristine()).await;
-        let root = tmp.path();
-        let wired = read_lock(root).await;
-
-        let dry = revert_redirect_purl(root, &mut state, NPM_PURL, true)
-            .await
-            .expect("dry-run revert succeeds");
-        assert_eq!(dry.reverted_files, vec!["bun.lock".to_string()]);
-        assert_eq!(read_lock(root).await, wired, "disk untouched");
-        assert!(state.records.is_empty(), "record claimed in memory");
-        assert!(state.edits.is_empty(), "edit claimed in memory");
-    }
-
-    /// A hand-edited ledger whose bun fragments mention the package but are
-    /// not entry lines cannot be attributed: refuse with the WORKING remedy
-    /// (the whole-ledger `rollback` replay) — never `bun install`, which
-    /// keeps a hosted URL tuple byte-identically — and keep the ledger.
-    #[tokio::test]
-    async fn npm_bun_unparseable_edit_mentioning_the_package_refuses_with_the_rollback_remedy() {
-        let tmp = tempfile::tempdir().unwrap();
-        let mut state = RedirectState::new();
-        state.records.insert(NPM_PURL.to_string(), record());
-        state.edits.push(FileEdit {
-            path: "bun.lock".into(),
-            kind: BUN_TEXT_KIND.into(),
-            action: "rewritten".into(),
-            key: Some("left-pad".into()),
-            original: Some(Value::String("\"left-pad@1.3.0\" (truncated".into())),
-            new: Some(Value::String(format!("\"left-pad@{NPM_URL}\" (truncated"))),
-        });
-        let err = revert_npm_redirect_purl(tmp.path(), &mut state, NPM_PURL, false)
-            .await
-            .expect_err("undecidable bun edit must refuse");
-        assert!(err.contains("unscoped `socket-patch rollback`"), "{err}");
-        assert!(err.contains("do not edit"), "{err}");
-        assert!(!err.contains("bun install"), "{err}");
-        assert!(!state.records.is_empty(), "ledger keeps the record");
-        assert!(!state.edits.is_empty(), "ledger keeps the edit");
-    }
-
-    /// An alias install (`bun add alias@npm:left-pad@1.3.0`) keys the entry
-    /// by the alias; the rewriter matched it by spec, and so does the
-    /// claim.
-    #[tokio::test]
-    async fn npm_bun_alias_keyed_instance_is_claimed_by_spec() {
-        let pristine = r#"{
-  "lockfileVersion": 2,
-  "configVersion": 1,
-  "workspaces": {
-    "": {
-      "name": "alias-fixture",
-      "dependencies": {
-        "alias": "npm:left-pad@1.3.0",
-      },
-    },
-  },
-  "packages": {
-    "alias": ["left-pad@1.3.0", "", {}, "sha512-XI5M=="],
-  }
-}
-"#;
-        let (tmp, mut state) = npm_redirected_fixture("bun.lock", pristine).await;
-        let root = tmp.path();
-        assert_eq!(state.edits[0].key.as_deref(), Some("alias"));
-        revert_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("alias takeover succeeds");
-        assert_eq!(read_lock(root).await, pristine);
-        assert!(state.records.is_empty() && state.edits.is_empty());
-    }
-
-    /// A user hand-restored bun.lock (git checkout): the revert is a clean
-    /// no-op that still drops the ledger entries.
-    #[tokio::test]
-    async fn npm_bun_hand_restored_lock_is_a_noop_that_drops_the_ledger() {
-        let (tmp, mut state) = npm_redirected_fixture("bun.lock", &bun_pristine()).await;
-        let root = tmp.path();
-        tokio::fs::write(root.join("bun.lock"), bun_pristine())
-            .await
-            .unwrap();
-        let out = revert_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("revert succeeds");
-        assert!(out.reverted_files.is_empty(), "{:?}", out.reverted_files);
-        assert_eq!(read_lock(root).await, bun_pristine());
-        assert!(state.records.is_empty() && state.edits.is_empty());
-    }
-
-    // ── refusal / degenerate arms of the fail-closed contract ────────────
-
-    #[tokio::test]
-    async fn unsupported_ecosystem_purl_is_refused() {
-        let tmp = tempfile::tempdir().unwrap();
-        let mut state = RedirectState::new();
-        let err = revert_redirect_purl(tmp.path(), &mut state, "pkg:gem/rack@3.0.0", false)
-            .await
-            .expect_err("unsupported ecosystem must refuse");
-        assert!(
-            err.contains("no hosted-redirect revert implementation"),
-            "{err}"
-        );
-        assert!(err.contains("pkg:gem/rack@3.0.0"), "names the purl: {err}");
-    }
-
-    /// A hand-edited ledger can hold a VERSIONLESS record key; the canon
-    /// match finds it, but the purl parse must still refuse fail-closed
-    /// rather than guess a version.
-    #[tokio::test]
-    async fn versionless_cargo_purl_record_is_refused() {
-        let tmp = tempfile::tempdir().unwrap();
-        let mut state = RedirectState::new();
-        state
-            .records
-            .insert("pkg:cargo/cfg-if".to_string(), record());
-        let err = revert_cargo_redirect_purl(tmp.path(), &mut state, "pkg:cargo/cfg-if", false)
-            .await
-            .expect_err("versionless purl must refuse");
-        assert!(err.contains("not a cargo purl"), "{err}");
-        assert!(!state.records.is_empty(), "ledger keeps the record");
-    }
-
-    /// npm twin of the versionless-record refusal.
-    #[tokio::test]
-    async fn npm_versionless_purl_record_is_refused() {
-        let tmp = tempfile::tempdir().unwrap();
-        let mut state = RedirectState::new();
-        state
-            .records
-            .insert("pkg:npm/left-pad".to_string(), record());
-        let err = revert_npm_redirect_purl(tmp.path(), &mut state, "pkg:npm/left-pad", false)
-            .await
-            .expect_err("versionless purl must refuse");
-        assert!(err.contains("not an npm purl"), "{err}");
-        assert!(!state.records.is_empty(), "ledger keeps the record");
-    }
-
-    /// Corrupt ledger (hand-edited): a wiring edit without an `original`
-    /// fragment cannot be inverted — refuse and leave every claimed file
-    /// AND the ledger untouched.
-    #[tokio::test]
-    async fn cargo_edit_without_original_fragment_is_refused_fail_closed() {
-        let (tmp, mut state) = redirected_fixture().await;
-        let root = tmp.path();
-        let toml_before = tokio::fs::read_to_string(root.join("Cargo.toml"))
-            .await
-            .unwrap();
-        let lock_before = tokio::fs::read_to_string(root.join("Cargo.lock"))
-            .await
-            .unwrap();
-        let cfg_before = tokio::fs::read_to_string(root.join(".cargo/config.toml"))
-            .await
-            .unwrap();
-        let records_before = state.records.len();
-        let edits_before = state.edits.len();
-        state
-            .edits
-            .iter_mut()
-            .find(|e| e.kind == "redirect_cargo_toml_dep")
-            .expect("fixture records a toml wiring edit")
-            .original = None;
-
-        let err = revert_cargo_redirect_purl(root, &mut state, PURL, false)
-            .await
-            .expect_err("edit without an original must refuse");
-        assert!(err.contains("records no original fragment"), "{err}");
-
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("Cargo.toml"))
-                .await
-                .unwrap(),
-            toml_before,
-            "Cargo.toml untouched"
-        );
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("Cargo.lock"))
-                .await
-                .unwrap(),
-            lock_before,
-            "Cargo.lock untouched — its inverse resolved before the refusal"
-        );
-        assert_eq!(
-            tokio::fs::read_to_string(root.join(".cargo/config.toml"))
-                .await
-                .unwrap(),
-            cfg_before,
-            ".cargo/config.toml untouched"
-        );
-        assert_eq!(state.records.len(), records_before);
-        assert_eq!(state.edits.len(), edits_before);
-    }
-
-    /// Cargo.lock deleted after the redirect: refuse, and leave the OTHER
-    /// claimed files and the ledger exactly as found — the contract this
-    /// module exists for.
-    #[tokio::test]
-    async fn cargo_missing_lock_file_refuses_and_leaves_the_rest_untouched() {
-        let (tmp, mut state) = redirected_fixture().await;
-        let root = tmp.path();
-        let toml_before = tokio::fs::read_to_string(root.join("Cargo.toml"))
-            .await
-            .unwrap();
-        let cfg_before = tokio::fs::read_to_string(root.join(".cargo/config.toml"))
-            .await
-            .unwrap();
-        tokio::fs::remove_file(root.join("Cargo.lock"))
-            .await
-            .unwrap();
-        let records_before = state.records.len();
-        let edits_before = state.edits.len();
-
-        let err = revert_cargo_redirect_purl(root, &mut state, PURL, false)
-            .await
-            .expect_err("deleted lock must refuse");
-        assert!(err.contains("no longer exists"), "{err}");
-        assert!(err.contains("Cargo.lock"), "{err}");
-
-        assert!(!root.join("Cargo.lock").exists(), "not resurrected");
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("Cargo.toml"))
-                .await
-                .unwrap(),
-            toml_before,
-            "Cargo.toml untouched (still hosted-wired)"
-        );
-        assert_eq!(
-            tokio::fs::read_to_string(root.join(".cargo/config.toml"))
-                .await
-                .unwrap(),
-            cfg_before,
-            ".cargo/config.toml untouched"
-        );
-        assert_eq!(state.records.len(), records_before);
-        assert_eq!(state.edits.len(), edits_before);
-    }
-
-    /// A user hand-restored Cargo.toml to the pre-redirect wiring: that edit
-    /// is a no-op (already at `original`) and the rest still reverts.
-    #[tokio::test]
-    async fn cargo_hand_restored_manifest_is_a_noop_and_the_rest_reverts() {
-        let (tmp, mut state) = redirected_fixture().await;
-        let root = tmp.path();
-        tokio::fs::write(root.join("Cargo.toml"), pristine_toml())
-            .await
-            .unwrap();
-
-        let out = revert_cargo_redirect_purl(root, &mut state, PURL, false)
-            .await
-            .expect("revert succeeds");
-        assert!(
-            out.reverted_files.iter().any(|f| f == "Cargo.lock"),
-            "{:?}",
-            out.reverted_files
-        );
-        assert!(
-            !out.reverted_files.iter().any(|f| f == "Cargo.toml"),
-            "hand-restored file skipped: {:?}",
-            out.reverted_files
-        );
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("Cargo.toml"))
-                .await
-                .unwrap(),
-            pristine_toml()
-        );
-        let lock = tokio::fs::read_to_string(root.join("Cargo.lock"))
-            .await
-            .unwrap();
-        assert!(
-            lock.contains(CRATES_IO) && !lock.contains("sparse+"),
-            "Cargo.lock restored: {lock}"
-        );
-        assert!(
-            !root.join(".cargo/config.toml").exists(),
-            "socket-only config removed"
-        );
-        assert!(state.records.is_empty(), "record dropped");
-        assert!(state.edits.is_empty(), "edits dropped");
-    }
-
-    /// `rm -rf .cargo` after the redirect: the registry-block edit is
-    /// skipped and the takeover still succeeds.
-    #[tokio::test]
-    async fn cargo_registry_config_already_deleted_is_skipped() {
-        let (tmp, mut state) = redirected_fixture().await;
-        let root = tmp.path();
-        tokio::fs::remove_file(root.join(".cargo/config.toml"))
-            .await
-            .unwrap();
-
-        let out = revert_cargo_redirect_purl(root, &mut state, PURL, false)
-            .await
-            .expect("revert succeeds");
-        assert!(
-            !out.reverted_files.iter().any(|f| f.contains(".cargo")),
-            "{:?}",
-            out.reverted_files
-        );
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("Cargo.toml"))
-                .await
-                .unwrap(),
-            pristine_toml(),
-            "Cargo.toml restored byte-identical"
-        );
-        assert!(
-            !root.join(".cargo/config.toml").exists(),
-            "config not resurrected"
-        );
-        assert!(state.records.is_empty(), "record dropped");
-        assert!(state.edits.is_empty(), "edits dropped");
-    }
-
-    /// Removing the block the redirect APPENDED to an existing config (the
-    /// legacy `.cargo/config` here) restores the user's bytes — no trailing
-    /// blank line (`[net]\nretry = 2\n\n`) left behind — and never touches
-    /// blank runs of the user's own elsewhere in the file.
-    #[tokio::test]
-    async fn appended_registry_block_revert_restores_the_config_bytes() {
-        let cases = [
-            "[net]\nretry = 2\n",
-            "[net]\n\n\n\nretry = 2\n",
-            "# a comment\n\n[http]\ntimeout = 5\n",
-            "[net]\r\nretry = 2\r\n",
-            // No final newline, trailing blank lines, whitespace only.
-            "[net]\nretry = 2",
-            "[net]\r\nretry = 2",
-            "[net]\nretry = 2\n\n",
-            "[net]\r\nretry = 2\r\n\r\n",
-            "\n",
-        ];
-        // Both unwind paths: `remove <purl>` and the whole-ledger replay.
-        for (user_cfg, replay) in cases.iter().flat_map(|cfg| [(*cfg, false), (*cfg, true)]) {
-            let tmp = tempfile::tempdir().unwrap();
-            let root = tmp.path();
-            let lock = format!("version = 4\n\n{}\n", pristine_lock_block());
-            let mut files: BTreeMap<String, String> = BTreeMap::new();
-            files.insert("Cargo.toml".into(), pristine_toml());
-            files.insert("Cargo.lock".into(), lock.clone());
-            files.insert(".cargo/config".into(), user_cfg.to_string());
-            let dep: crate::patch::redirect::DepOverride =
-                serde_json::from_value(serde_json::json!({
-                    "ecosystem": "cargo", "name": "cfg-if", "version": "1.0.4",
-                    "token": "tok", "patchUuid": UUID,
-                    "artifactUrl": "http://127.0.0.1:5555/cfg-if-1.0.4.crate",
-                    "registryOverride": {
-                        "kind": "cargo-sparse", "indexUrl": INDEX,
-                        "identifiers": {
-                            "name": "cfg-if", "version": "1.0.4",
-                            "cargoCksumSha256": "a".repeat(64),
-                        },
-                    },
-                    "integrity": { "sha256": "a".repeat(64) },
-                }))
-                .unwrap();
-            let rewrite = crate::patch::redirect::rewrite_registry_redirect(&files, &[dep]);
-            tokio::fs::create_dir_all(root.join(".cargo"))
-                .await
-                .unwrap();
-            for (rel, content) in files.iter().chain(rewrite.files.iter()) {
-                tokio::fs::write(root.join(rel), content).await.unwrap();
-            }
-            let mut state = RedirectState::new();
-            state.edits = rewrite.edits;
-            state.records.insert(PURL.to_string(), record());
-
-            if replay {
-                let outcome = crate::patch::redirect::revert_remaining_redirect_edits(
-                    root, &mut state, false,
-                )
-                .await;
-                assert!(outcome.fully_reverted(), "{:?}", outcome.refusals);
-            } else {
-                revert_cargo_redirect_purl(root, &mut state, PURL, false)
-                    .await
-                    .expect("revert succeeds");
-            }
-            assert_eq!(
-                tokio::fs::read_to_string(root.join(".cargo/config"))
-                    .await
-                    .unwrap(),
-                user_cfg,
-                "replay: {replay}"
-            );
-            assert_eq!(
-                tokio::fs::read_to_string(root.join("Cargo.toml"))
-                    .await
-                    .unwrap(),
-                pristine_toml()
-            );
-            assert_eq!(
-                tokio::fs::read_to_string(root.join("Cargo.lock"))
-                    .await
-                    .unwrap(),
-                lock
-            );
-        }
-    }
-
-    /// A CRLF project (manifest, lock and legacy config) is
-    /// redirected with CRLF kept and `remove` restores every byte.
-    #[tokio::test]
-    async fn crlf_project_reverts_byte_for_byte() {
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        let crlf = |s: &str| s.replace('\n', "\r\n");
-        let mut files: BTreeMap<String, String> = BTreeMap::new();
-        files.insert("Cargo.toml".into(), crlf(&pristine_toml()));
-        files.insert(
-            "Cargo.lock".into(),
-            crlf(&format!("version = 4\n\n{}\n", pristine_lock_block())),
-        );
-        files.insert(".cargo/config".into(), crlf("[net]\nretry = 2\n"));
-        let dep: crate::patch::redirect::DepOverride = serde_json::from_value(serde_json::json!({
-            "ecosystem": "cargo", "name": "cfg-if", "version": "1.0.4",
-            "token": "tok", "patchUuid": UUID,
-            "artifactUrl": "http://127.0.0.1:5555/cfg-if-1.0.4.crate",
-            "registryOverride": {
-                "kind": "cargo-sparse", "indexUrl": INDEX,
-                "identifiers": {
-                    "name": "cfg-if", "version": "1.0.4",
-                    "cargoCksumSha256": "a".repeat(64),
-                },
-            },
-            "integrity": { "sha256": "a".repeat(64) },
-        }))
-        .unwrap();
-        let rewrite = crate::patch::redirect::rewrite_registry_redirect(&files, &[dep]);
-        assert_eq!(rewrite.files.len(), 3, "{:?}", rewrite.warnings);
-        tokio::fs::create_dir_all(root.join(".cargo"))
-            .await
-            .unwrap();
-        for (rel, content) in files.iter().chain(rewrite.files.iter()) {
-            tokio::fs::write(root.join(rel), content).await.unwrap();
-        }
-        let mut state = RedirectState::new();
-        state.edits = rewrite.edits;
-        state.records.insert(PURL.to_string(), record());
-        revert_cargo_redirect_purl(root, &mut state, PURL, false)
-            .await
-            .expect("revert succeeds");
-        for (rel, content) in &files {
-            assert_eq!(
-                &tokio::fs::read_to_string(root.join(rel)).await.unwrap(),
-                content,
-                "{rel}"
-            );
-        }
-    }
-
-    /// A ledger recorded on one side of a line-ending conversion reverts
-    /// files checked out on the other: a Windows scan (CRLF fragments,
-    /// JSON-escaped, so git never converts them) removed on an LF checkout,
-    /// and an LF scan removed on a CRLF (`core.autocrlf`) checkout — through
-    /// `remove` and through the whole-ledger replay — neither may refuse as
-    /// "drifted" because no fragment matches byte-for-byte.
-    #[tokio::test]
-    async fn revert_survives_a_checkout_line_ending_conversion() {
-        let crlf = |s: &str| s.replace('\n', "\r\n");
-        let lf = |s: &str| s.replace("\r\n", "\n");
-        let pristine: Vec<(&str, String)> = vec![
-            ("Cargo.toml", pristine_toml()),
-            (
-                "Cargo.lock",
-                format!("version = 4\n\n{}\n", pristine_lock_block()),
-            ),
-            (".cargo/config", "[net]\nretry = 2\n".to_string()),
-        ];
-        for (scan_crlf, replay) in [(true, false), (false, false), (true, true), (false, true)] {
-            let tmp = tempfile::tempdir().unwrap();
-            let root = tmp.path();
-            let scanned = |s: &str| if scan_crlf { crlf(s) } else { s.to_string() };
-            let checked_out = |s: &str| if scan_crlf { lf(s) } else { crlf(s) };
-            let files: BTreeMap<String, String> = pristine
-                .iter()
-                .map(|(rel, text)| (rel.to_string(), scanned(text)))
-                .collect();
-            let rewrite = crate::patch::redirect::rewrite_registry_redirect(
-                &files,
-                &[cargo_dep("cfg-if", "1.0.4", UUID)],
-            );
-            assert_eq!(rewrite.files.len(), 3, "{:?}", rewrite.warnings);
-            tokio::fs::create_dir_all(root.join(".cargo"))
-                .await
-                .unwrap();
-            for (rel, content) in files.iter().chain(rewrite.files.iter()) {
-                tokio::fs::write(root.join(rel), checked_out(content))
-                    .await
-                    .unwrap();
-            }
-            // The ledger round-trips through its JSON file unchanged.
-            let mut state: RedirectState = serde_json::from_str(
-                &serde_json::to_string(&{
-                    let mut state = RedirectState::new();
-                    state.edits = rewrite.edits.clone();
-                    state.records.insert(PURL.to_string(), record());
-                    state
-                })
-                .unwrap(),
-            )
-            .unwrap();
-            if replay {
-                let outcome = crate::patch::redirect::revert_remaining_redirect_edits(
-                    root, &mut state, false,
-                )
-                .await;
-                assert!(
-                    outcome.fully_reverted(),
-                    "scan crlf {scan_crlf}: {:?}",
-                    outcome.refusals
-                );
-            } else {
-                revert_cargo_redirect_purl(root, &mut state, PURL, false)
-                    .await
-                    .unwrap_or_else(|e| panic!("scan crlf {scan_crlf}: {e}"));
-            }
-            for (rel, text) in &pristine {
-                assert_eq!(
-                    tokio::fs::read_to_string(root.join(rel)).await.unwrap(),
-                    checked_out(text),
-                    "{rel} (scan crlf {scan_crlf}, replay {replay})"
-                );
-            }
-        }
-    }
-
-    /// The socket block was already hand-removed (the config now holds only
-    /// user content): skip it, byte-untouched, and still succeed.
-    #[tokio::test]
-    async fn cargo_registry_block_hand_removed_keeps_user_config_untouched() {
-        let (tmp, mut state) = redirected_fixture().await;
-        let root = tmp.path();
-        let user_cfg = "[net]\nretry = 2\n";
-        tokio::fs::write(root.join(".cargo/config.toml"), user_cfg)
-            .await
-            .unwrap();
-
-        let out = revert_cargo_redirect_purl(root, &mut state, PURL, false)
-            .await
-            .expect("revert succeeds");
-        assert!(
-            !out.reverted_files.iter().any(|f| f.contains(".cargo")),
-            "{:?}",
-            out.reverted_files
-        );
-        assert_eq!(
-            tokio::fs::read_to_string(root.join(".cargo/config.toml"))
-                .await
-                .unwrap(),
-            user_cfg,
-            "user config byte-untouched"
-        );
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("Cargo.toml"))
-                .await
-                .unwrap(),
-            pristine_toml()
-        );
-        assert!(state.records.is_empty(), "record dropped");
-        assert!(state.edits.is_empty(), "edits dropped");
-    }
-
-    /// The whole-ledger replay keeps a hand-pinned block too (removing it
-    /// would leave the hand pin naming an undefined registry), while still
-    /// unwinding the wiring it owns.
-    #[tokio::test]
-    async fn replay_keeps_a_registry_block_still_referenced() {
-        let (tmp, mut state) = redirected_fixture().await;
-        let root = tmp.path();
-        let reg = format!("socket-patch-{UUID}");
-        let pinned_line = format!("other = {{ version = \"1.0\", registry = \"{reg}\" }}\n");
-        let wired_toml = tokio::fs::read_to_string(root.join("Cargo.toml"))
-            .await
-            .unwrap();
-        tokio::fs::write(
-            root.join("Cargo.toml"),
-            format!("{wired_toml}{pinned_line}"),
-        )
-        .await
-        .unwrap();
-        let outcome =
-            crate::patch::redirect::revert_remaining_redirect_edits(root, &mut state, false).await;
-        assert!(outcome.fully_reverted(), "{:?}", outcome.refusals);
-        let cfg = tokio::fs::read_to_string(root.join(".cargo/config.toml"))
-            .await
-            .unwrap();
-        assert!(cfg.contains(&reg), "block kept while referenced: {cfg}");
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("Cargo.toml"))
-                .await
-                .unwrap(),
-            format!("{}{pinned_line}", pristine_toml())
-        );
-        assert!(state.edits.is_empty(), "{:?}", state.edits);
-    }
-
-    /// A user hand-pinned a SECOND dep to the socket registry: the block is
-    /// kept while anything still references it (the documented defensive
-    /// keep), and the takeover still reverts the wiring it owns.
-    #[tokio::test]
-    async fn cargo_registry_block_kept_while_still_referenced() {
-        let (tmp, mut state) = redirected_fixture().await;
-        let root = tmp.path();
-        let reg = format!("socket-patch-{UUID}");
-        let pinned_line = format!("other = {{ version = \"1.0\", registry = \"{reg}\" }}\n");
-        let wired_toml = tokio::fs::read_to_string(root.join("Cargo.toml"))
-            .await
-            .unwrap();
-        tokio::fs::write(
-            root.join("Cargo.toml"),
-            format!("{wired_toml}{pinned_line}"),
-        )
-        .await
-        .unwrap();
-
-        let out = revert_cargo_redirect_purl(root, &mut state, PURL, false)
-            .await
-            .expect("revert succeeds");
-
-        let cfg = tokio::fs::read_to_string(root.join(".cargo/config.toml"))
-            .await
-            .unwrap();
-        assert!(cfg.contains(&reg), "block kept while referenced: {cfg}");
-        assert!(
-            !out.reverted_files.iter().any(|f| f.contains(".cargo")),
-            "{:?}",
-            out.reverted_files
-        );
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("Cargo.toml"))
-                .await
-                .unwrap(),
-            format!("{}{pinned_line}", pristine_toml()),
-            "cfg-if wiring reverted, hand pin survives"
-        );
-        let lock = tokio::fs::read_to_string(root.join("Cargo.lock"))
-            .await
-            .unwrap();
-        assert!(
-            lock.contains(CRATES_IO) && !lock.contains("sparse+"),
-            "Cargo.lock restored: {lock}"
-        );
-        // The edits/record are dropped by design even when the block is
-        // kept: the kept block now belongs to the user's hand pin, and a
-        // stale ledger claim over it would poison later reverts.
-        assert!(state.records.is_empty(), "record dropped");
-        assert!(state.edits.is_empty(), "edits dropped");
-    }
-
-    /// A REGENERATED block (`action: "rewritten"` — the rewriter replaced a
-    /// degraded/commented region in place and recorded it as `original`)
-    /// restores that pre-existing region instead of deleting the block: the
-    /// original bytes are the user's.
-    #[tokio::test]
-    async fn cargo_regenerated_registry_block_restores_the_user_region() {
-        let (tmp, mut state) = redirected_fixture().await;
-        let root = tmp.path();
-        let user_region = "# corp mirror config (degraded)\n";
-        state
-            .edits
-            .iter_mut()
-            .find(|e| e.kind == "redirect_cargo_registry")
-            .expect("fixture records a registry edit")
-            .original = Some(Value::String(user_region.into()));
-
-        let out = revert_cargo_redirect_purl(root, &mut state, PURL, false)
-            .await
-            .expect("revert succeeds");
-        let cfg = tokio::fs::read_to_string(root.join(".cargo/config.toml"))
-            .await
-            .unwrap();
-        assert!(
-            cfg.contains("# corp mirror config"),
-            "user region restored: {cfg}"
-        );
-        assert!(!cfg.contains("socket-patch-"), "block gone: {cfg}");
-        assert!(
-            out.reverted_files.iter().any(|f| f.contains(".cargo")),
-            "{:?}",
-            out.reverted_files
-        );
-        assert!(state.records.is_empty(), "record dropped");
-        assert!(state.edits.is_empty(), "edits dropped");
-    }
-
-    /// Corrupt-ledger guard, npm text kinds: an edit without an `original`
-    /// fragment refuses and leaves the file and ledger untouched.
-    #[tokio::test]
-    async fn npm_text_edit_without_original_fragment_is_refused_fail_closed() {
-        let (tmp, mut state) = npm_redirected_fixture("yarn.lock", &classic_pristine()).await;
-        let root = tmp.path();
-        let wired = tokio::fs::read_to_string(root.join("yarn.lock"))
-            .await
-            .unwrap();
-        let records_before = state.records.len();
-        let edits_before = state.edits.len();
-        state
-            .edits
-            .iter_mut()
-            .find(|e| e.kind == "redirect_yarn_classic_entry")
-            .expect("fixture records a classic edit")
-            .original = None;
-
-        let err = revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect_err("edit without an original must refuse");
-        assert!(err.contains("records no original fragment"), "{err}");
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("yarn.lock"))
-                .await
-                .unwrap(),
-            wired,
-            "yarn.lock untouched (still hosted-wired)"
-        );
-        assert_eq!(state.records.len(), records_before);
-        assert_eq!(state.edits.len(), edits_before);
-    }
-
-    /// yarn.lock deleted after the redirect: refuse; ledger intact.
-    #[tokio::test]
-    async fn npm_missing_text_lock_refuses_and_keeps_the_ledger() {
-        let (tmp, mut state) = npm_redirected_fixture("yarn.lock", &classic_pristine()).await;
-        let root = tmp.path();
-        tokio::fs::remove_file(root.join("yarn.lock"))
-            .await
-            .unwrap();
-        let records_before = state.records.len();
-        let edits_before = state.edits.len();
-
-        let err = revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect_err("deleted lock must refuse");
-        assert!(err.contains("no longer exists"), "{err}");
-        assert!(err.contains("yarn.lock"), "{err}");
-        assert!(!root.join("yarn.lock").exists(), "not resurrected");
-        assert_eq!(state.records.len(), records_before);
-        assert_eq!(state.edits.len(), edits_before);
-    }
-
-    /// A user hand-restored the text lock to pristine: the revert is a clean
-    /// no-op that still drops the ledger entries (the takeover is complete).
-    #[tokio::test]
-    async fn npm_hand_restored_text_lock_is_a_noop_that_drops_the_ledger() {
-        let (tmp, mut state) = npm_redirected_fixture("yarn.lock", &classic_pristine()).await;
-        let root = tmp.path();
-        tokio::fs::write(root.join("yarn.lock"), classic_pristine())
-            .await
-            .unwrap();
-
-        let out = revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("revert succeeds");
-        assert!(
-            out.reverted_files.is_empty(),
-            "nothing rewritten: {:?}",
-            out.reverted_files
-        );
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("yarn.lock"))
-                .await
-                .unwrap(),
-            classic_pristine(),
-            "yarn.lock untouched"
-        );
-        assert!(state.records.is_empty(), "record dropped");
-        assert!(state.edits.is_empty(), "edits dropped");
-    }
-
-    /// package-lock.json deleted for the JSON kinds: the claim survives via
-    /// the recorded-URL attribution (the lock can no longer vouch for the
-    /// entry), then the replay refuses fail-closed.
-    #[tokio::test]
-    async fn npm_missing_package_lock_refuses_via_url_attribution() {
-        let (tmp, mut state) =
-            npm_redirected_fixture("package-lock.json", &package_lock_pristine()).await;
-        let root = tmp.path();
-        assert_eq!(state.edits.len(), 2, "packages + dependencies edits");
-        tokio::fs::remove_file(root.join("package-lock.json"))
-            .await
-            .unwrap();
-
-        let err = revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect_err("deleted lock must refuse");
-        assert!(err.contains("no longer exists"), "{err}");
-        assert!(!state.records.is_empty(), "ledger keeps the record");
-        assert_eq!(state.edits.len(), 2, "ledger keeps the edits");
-    }
-
-    /// package-lock.json is no longer valid JSON: the disk-lock parse
-    /// degrades to `None` (so the claim still happens via recorded URLs) and
-    /// the replay refuses on the parse.
-    #[tokio::test]
-    async fn npm_invalid_json_package_lock_refuses_fail_closed() {
-        let (tmp, mut state) =
-            npm_redirected_fixture("package-lock.json", &package_lock_pristine()).await;
-        let root = tmp.path();
-        tokio::fs::write(root.join("package-lock.json"), "{ not json")
-            .await
-            .unwrap();
-        let edits_before = state.edits.len();
-
-        let err = revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect_err("invalid JSON must refuse");
-        assert!(err.contains("is not valid JSON"), "{err}");
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("package-lock.json"))
-                .await
-                .unwrap(),
-            "{ not json",
-            "file untouched"
-        );
-        assert!(!state.records.is_empty(), "ledger keeps the record");
-        assert_eq!(state.edits.len(), edits_before, "ledger keeps the edits");
-    }
-
-    /// JSON-kind drift refusal: the v3 `packages` entry was re-resolved to a
-    /// shape the ledger never saw — refuse, file byte-untouched.
-    #[tokio::test]
-    async fn npm_json_drifted_package_lock_entry_refuses_fail_closed() {
-        let (tmp, mut state) =
-            npm_redirected_fixture("package-lock.json", &package_lock_pristine()).await;
-        let root = tmp.path();
-        let mut on_disk: Value = serde_json::from_str(
-            &tokio::fs::read_to_string(root.join("package-lock.json"))
-                .await
-                .unwrap(),
-        )
-        .unwrap();
-        on_disk
-            .get_mut("packages")
-            .and_then(|p| p.get_mut("node_modules/left-pad"))
-            .and_then(Value::as_object_mut)
-            .unwrap()
-            .insert(
-                "resolved".into(),
-                Value::String("https://corp.example/left-pad-1.3.0.tgz".into()),
-            );
-        let drifted = serde_json::to_string_pretty(&on_disk).unwrap();
-        tokio::fs::write(root.join("package-lock.json"), &drifted)
-            .await
-            .unwrap();
-        let edits_before = state.edits.len();
-
-        let err = revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect_err("drifted entry must refuse");
-        assert!(err.contains("drifted"), "{err}");
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("package-lock.json"))
-                .await
-                .unwrap(),
-            drifted,
-            "nothing reached disk on refusal"
-        );
-        assert!(!state.records.is_empty(), "ledger keeps the record");
-        assert_eq!(state.edits.len(), edits_before, "ledger keeps the edits");
-    }
-
-    /// A user hand-restored package-lock.json to pristine: both trees replay
-    /// as `Ok(false)` no-ops and the ledger entries still drop.
-    #[tokio::test]
-    async fn npm_hand_restored_package_lock_is_a_noop_that_drops_the_ledger() {
-        let (tmp, mut state) =
-            npm_redirected_fixture("package-lock.json", &package_lock_pristine()).await;
-        let root = tmp.path();
-        tokio::fs::write(root.join("package-lock.json"), package_lock_pristine())
-            .await
-            .unwrap();
-
-        let out = revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("revert succeeds");
-        assert!(
-            out.reverted_files.is_empty(),
-            "nothing rewritten: {:?}",
-            out.reverted_files
-        );
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("package-lock.json"))
-                .await
-                .unwrap(),
-            package_lock_pristine(),
-            "package-lock.json untouched"
-        );
-        assert!(state.records.is_empty(), "record dropped");
-        assert!(state.edits.is_empty(), "edits dropped");
-    }
-
-    /// npm upgraded the lock to a v3-only shape after the redirect (the
-    /// legacy `dependencies` tree is gone) — the recorded v2 edit refuses,
-    /// and the v3 entry's hosted wiring stays exactly as found (nothing
-    /// half-applied).
-    #[tokio::test]
-    async fn npm_v2_dependencies_tree_gone_refuses_fail_closed() {
-        let (tmp, mut state) =
-            npm_redirected_fixture("package-lock.json", &package_lock_pristine()).await;
-        let root = tmp.path();
-        let mut on_disk: Value = serde_json::from_str(
-            &tokio::fs::read_to_string(root.join("package-lock.json"))
-                .await
-                .unwrap(),
-        )
-        .unwrap();
-        on_disk
-            .as_object_mut()
-            .unwrap()
-            .remove("dependencies")
-            .expect("fixture v2 tree present");
-        let v3_only = serde_json::to_string_pretty(&on_disk).unwrap();
-        tokio::fs::write(root.join("package-lock.json"), &v3_only)
-            .await
-            .unwrap();
-        let edits_before = state.edits.len();
-
-        let err = revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect_err("vanished v2 tree must refuse");
-        assert!(
-            err.contains("no longer holds a `dependencies` tree"),
-            "{err}"
-        );
-        let after = tokio::fs::read_to_string(root.join("package-lock.json"))
-            .await
-            .unwrap();
-        assert_eq!(after, v3_only, "nothing reached disk on refusal");
-        assert!(
-            after.contains(NPM_URL),
-            "the v3 entry keeps its hosted wiring: {after}"
-        );
-        assert!(!state.records.is_empty(), "ledger keeps the record");
-        assert_eq!(state.edits.len(), edits_before, "ledger keeps the edits");
-    }
-
-    /// The v2 `dependencies` node for this purl vanished (the tree survives):
-    /// `any_found` stays false and the replay refuses.
-    #[tokio::test]
-    async fn npm_v2_dependencies_node_gone_refuses_fail_closed() {
-        let (tmp, mut state) =
-            npm_redirected_fixture("package-lock.json", &package_lock_pristine()).await;
-        let root = tmp.path();
-        let mut on_disk: Value = serde_json::from_str(
-            &tokio::fs::read_to_string(root.join("package-lock.json"))
-                .await
-                .unwrap(),
-        )
-        .unwrap();
-        on_disk
-            .get_mut("dependencies")
-            .and_then(Value::as_object_mut)
-            .unwrap()
-            .remove("left-pad")
-            .expect("fixture v2 node present");
-        let pruned = serde_json::to_string_pretty(&on_disk).unwrap();
-        tokio::fs::write(root.join("package-lock.json"), &pruned)
-            .await
-            .unwrap();
-        let edits_before = state.edits.len();
-
-        let err = revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect_err("vanished v2 node must refuse");
-        assert!(
-            err.contains("`dependencies` entry") && err.contains("no longer exists"),
-            "{err}"
-        );
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("package-lock.json"))
-                .await
-                .unwrap(),
-            pruned,
-            "nothing reached disk on refusal"
-        );
-        assert!(!state.records.is_empty(), "ledger keeps the record");
-        assert_eq!(state.edits.len(), edits_before, "ledger keeps the edits");
-    }
-
-    /// A drift inside a v2 `dependencies` node propagates out of the
-    /// recursive walk as the same fail-closed refusal.
-    #[tokio::test]
-    async fn npm_v2_dependencies_node_drift_refuses_fail_closed() {
-        let (tmp, mut state) =
-            npm_redirected_fixture("package-lock.json", &package_lock_pristine()).await;
-        let root = tmp.path();
-        let mut on_disk: Value = serde_json::from_str(
-            &tokio::fs::read_to_string(root.join("package-lock.json"))
-                .await
-                .unwrap(),
-        )
-        .unwrap();
-        on_disk
-            .get_mut("dependencies")
-            .and_then(|d| d.get_mut("left-pad"))
-            .and_then(Value::as_object_mut)
-            .unwrap()
-            .insert("integrity".into(), Value::String("sha512-corp==".into()));
-        let drifted = serde_json::to_string_pretty(&on_disk).unwrap();
-        tokio::fs::write(root.join("package-lock.json"), &drifted)
-            .await
-            .unwrap();
-        let edits_before = state.edits.len();
-
-        let err = revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect_err("drifted v2 node must refuse");
-        assert!(err.contains("drifted"), "{err}");
-        let after = tokio::fs::read_to_string(root.join("package-lock.json"))
-            .await
-            .unwrap();
-        assert_eq!(after, drifted, "nothing reached disk on refusal");
-        assert!(
-            after.contains(NPM_URL),
-            "the v3 entry keeps its hosted wiring: {after}"
-        );
-        assert!(!state.records.is_empty(), "ledger keeps the record");
-        assert_eq!(state.edits.len(), edits_before, "ledger keeps the edits");
-    }
-
-    /// Pristine v3-only lock whose entry has `resolved` but NO `integrity`
-    /// key: the rewriter records `integrity: null` in `original`, so the
-    /// revert must REMOVE the hosted integrity field, not leave it stale.
-    fn no_integrity_lock_pristine() -> String {
-        let lock = serde_json::json!({
-            "name": "app",
-            "version": "1.0.0",
-            "lockfileVersion": 3,
-            "requires": true,
-            "packages": {
-                "": { "name": "app", "version": "1.0.0" },
-                "node_modules/left-pad": {
-                    "version": "1.3.0",
-                    "resolved": "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz"
-                }
-            }
-        });
-        format!("{}\n", serde_json::to_string_pretty(&lock).unwrap())
-    }
-
-    #[tokio::test]
-    async fn npm_entry_without_integrity_round_trips_the_field_removal() {
-        let (tmp, mut state) =
-            npm_redirected_fixture("package-lock.json", &no_integrity_lock_pristine()).await;
-        let root = tmp.path();
-        let wired = tokio::fs::read_to_string(root.join("package-lock.json"))
-            .await
-            .unwrap();
-        assert!(
-            wired.contains("\"integrity\""),
-            "the rewriter wrote a hosted integrity: {wired}"
-        );
-
-        let out = revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("revert succeeds");
-        assert_eq!(out.reverted_files, vec!["package-lock.json".to_string()]);
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("package-lock.json"))
-                .await
-                .unwrap(),
-            no_integrity_lock_pristine(),
-            "integrity key REMOVED on revert, not left null/stale"
-        );
-        assert!(state.records.is_empty(), "record dropped");
-        assert!(state.edits.is_empty(), "edits dropped");
-    }
-
-    /// A bun.lock edit belonging to a DIFFERENT package is neither claimed
-    /// nor a refusal: this purl's takeover proceeds and the foreign edit and
-    /// its record stay in the ledger untouched.
-    #[tokio::test]
-    async fn npm_foreign_bun_edit_is_neither_claimed_nor_a_refusal() {
-        let (tmp, mut state) = npm_redirected_fixture("yarn.lock", &classic_pristine()).await;
-        let root = tmp.path();
-        state
-            .records
-            .insert("pkg:npm/other@1.0.0".to_string(), record());
-        state.edits.push(FileEdit {
-            path: "bun.lock".into(),
-            kind: "redirect_bun_lock_package".into(),
-            action: "rewritten".into(),
-            key: Some("other".into()),
-            original: Some(Value::String(
-                "    \"other\": [\"other@1.0.0\", \"reg\", {}, \"sha512-p==\"],".into(),
-            )),
-            new: Some(Value::String(
-                "    \"other\": [\"other@http://127.0.0.1:5555/patch/npm/other/1.0.0/tok/6b7c/other-1.0.0.tgz\", {}, \"sha512-h==\"],"
-                    .into(),
-            )),
-        });
-
-        revert_npm_redirect_purl(root, &mut state, NPM_PURL, false)
-            .await
-            .expect("takeover succeeds despite the foreign bun edit");
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("yarn.lock"))
-                .await
-                .unwrap(),
-            classic_pristine(),
-            "yarn.lock restored byte-identical"
-        );
-        assert_eq!(
-            state.edits.len(),
-            1,
-            "the foreign bun edit survives: {:?}",
-            state.edits
-        );
-        assert_eq!(state.edits[0].kind, "redirect_bun_lock_package");
-        assert!(
-            state.records.contains_key("pkg:npm/other@1.0.0")
-                && !state.records.contains_key(NPM_PURL),
-            "{:?}",
-            state.records.keys()
-        );
-    }
-
-    const GO_PURL: &str = "pkg:golang/example.com/lib@v1.10.0";
-    const GO_UUID: &str = "7d8e9f0a-1b2c-4d3e-8f4a-5b6c7d8e9f0a";
-    const GO_OTHER_PURL: &str = "pkg:golang/example.com/other@v0.2.0";
-    const GO_OTHER_UUID: &str = "8e9f0a1b-2c3d-4e4f-9a5b-6c7d8e9f0a1b";
-    const GO_ZIP_H1: &str = "h1:mU9vN/n1hbXktM62lJ6MbRKOk3aI8NDH+szCf62RXtE=";
-    const GO_MOD_H1: &str = "h1:XgagPTRZSCprrzR+3Ro36/XJpibdovhAbsKThYI8bxg=";
-
-    fn go_override(module: &str, version: &str, uuid: &str) -> crate::patch::redirect::DepOverride {
-        let socket_module = format!("patch.socket.dev/gopatch/{uuid}");
-        let socket_version = format!("{version}-socketpatch.1");
-        serde_json::from_value(serde_json::json!({
-            "ecosystem": "golang",
-            "name": module,
-            "version": version,
-            "token": "",
-            "patchUuid": uuid,
-            "artifactUrl": format!("https://patch.socket.dev/{socket_module}/@v/{socket_version}.zip"),
-            "registryOverride": {
-                "kind": "goproxy",
-                "indexUrl": "https://patch.socket.dev",
-                "identifiers": {
-                    "name": module, "version": version,
-                    "goModulePath": socket_module,
-                    "goModuleVersion": socket_version,
-                },
-            },
-            "integrity": { "dirhashH1": GO_ZIP_H1, "goModH1": GO_MOD_H1 },
-        }))
-        .unwrap()
-    }
-
-    /// go's own go.sum order: `v1.9.0/go.mod` sorts BEFORE `v1.10.0`
-    /// (semver), although it is bytewise greater.
-    fn go_pristine(eol: &str) -> (String, String) {
-        let go_mod = "module example.com/app\n\ngo 1.21\n\nrequire (\n\texample.com/lib v1.10.0\n\texample.com/other v0.2.0\n)\n"
-            .replace('\n', eol);
-        let go_sum = "example.com/leaf v1.0.0 h1:L=\n\
-                      example.com/leaf v1.0.0/go.mod h1:LM=\n\
-                      example.com/lib v1.9.0/go.mod h1:N9=\n\
-                      example.com/lib v1.10.0 h1:T=\n\
-                      example.com/lib v1.10.0/go.mod h1:TM=\n\
-                      example.com/other v0.2.0 h1:O=\n\
-                      example.com/other v0.2.0/go.mod h1:OM=\n"
-            .replace('\n', eol);
-        (go_mod, go_sum)
-    }
-
-    /// Both modules hosted-redirected by the real rewriter, written to disk.
-    async fn go_redirected_fixture(eol: &str) -> (tempfile::TempDir, RedirectState) {
-        let tmp = tempfile::tempdir().unwrap();
-        let (go_mod, go_sum) = go_pristine(eol);
-        let mut files: BTreeMap<String, String> = BTreeMap::new();
-        files.insert("go.mod".into(), go_mod);
-        files.insert("go.sum".into(), go_sum);
-        let rewrite = crate::patch::redirect::rewrite_registry_redirect(
-            &files,
-            &[
-                go_override("example.com/lib", "v1.10.0", GO_UUID),
-                go_override("example.com/other", "v0.2.0", GO_OTHER_UUID),
-            ],
-        );
-        assert!(rewrite.warnings.is_empty(), "{:?}", rewrite.warnings);
-        for (rel, content) in &rewrite.files {
-            tokio::fs::write(tmp.path().join(rel), content)
-                .await
-                .unwrap();
-        }
-        let mut state = RedirectState::new();
-        state.edits = rewrite.edits;
-        let mut lib = record();
-        lib.uuid = GO_UUID.to_string();
-        let mut other = record();
-        other.uuid = GO_OTHER_UUID.to_string();
-        state.records.insert(GO_PURL.to_string(), lib);
-        state.records.insert(GO_OTHER_PURL.to_string(), other);
-        (tmp, state)
-    }
-
-    /// hosted → vendored takeover of one Go module: its replace and gopatch
-    /// go.sum lines go, its pruned go.sum pair comes back where go sorts it,
-    /// and its ledger record is dropped. The other hosted module is intact.
-    #[tokio::test]
-    async fn golang_per_purl_revert_unwinds_only_that_module() {
-        for eol in ["\n", "\r\n"] {
-            let (tmp, mut state) = go_redirected_fixture(eol).await;
-            let root = tmp.path();
-            assert!(redirect_revert_supported(GO_PURL));
-            revert_redirect_purl(root, &mut state, GO_PURL, false)
-                .await
-                .expect("golang takeover revert succeeds");
-
-            let go_mod = tokio::fs::read_to_string(root.join("go.mod"))
-                .await
-                .unwrap();
-            let go_sum = tokio::fs::read_to_string(root.join("go.sum"))
-                .await
-                .unwrap();
-            assert!(!go_mod.contains(GO_UUID), "{go_mod:?}");
-            assert!(
-                go_mod.contains(&format!(
-                    "replace example.com/other v0.2.0 => patch.socket.dev/gopatch/{GO_OTHER_UUID}"
-                )),
-                "{go_mod:?}"
-            );
-            let expected_sum = format!(
-                "example.com/leaf v1.0.0 h1:L={eol}\
-                 example.com/leaf v1.0.0/go.mod h1:LM={eol}\
-                 example.com/lib v1.9.0/go.mod h1:N9={eol}\
-                 example.com/lib v1.10.0 h1:T={eol}\
-                 example.com/lib v1.10.0/go.mod h1:TM={eol}\
-                 patch.socket.dev/gopatch/{GO_OTHER_UUID} v0.2.0-socketpatch.1 {GO_ZIP_H1}{eol}\
-                 patch.socket.dev/gopatch/{GO_OTHER_UUID} v0.2.0-socketpatch.1/go.mod {GO_MOD_H1}{eol}"
-            );
-            assert_eq!(go_sum, expected_sum, "eol {eol:?}");
-            assert!(!state.records.contains_key(GO_PURL));
-            assert!(state.records.contains_key(GO_OTHER_PURL));
-            assert!(
-                state.edits.iter().all(|e| {
-                    let text = format!("{:?}{:?}{:?}", e.key, e.new, e.original);
-                    !text.contains(GO_UUID) && !text.contains("example.com/lib")
-                }),
-                "{:?}",
-                state.edits
-            );
-
-            // The remaining module unwinds through the same path, back to
-            // the pristine bytes.
-            revert_redirect_purl(root, &mut state, GO_OTHER_PURL, false)
-                .await
-                .expect("second revert succeeds");
-            let (pristine_mod, pristine_sum) = go_pristine(eol);
-            assert_eq!(
-                tokio::fs::read_to_string(root.join("go.mod"))
-                    .await
-                    .unwrap(),
-                pristine_mod
-            );
-            assert_eq!(
-                tokio::fs::read_to_string(root.join("go.sum"))
-                    .await
-                    .unwrap(),
-                pristine_sum
-            );
-            assert!(state.records.is_empty() && state.edits.is_empty());
-        }
-    }
-
-    /// A go.mod whose socket replace was hand-edited away from the recorded
-    /// directive has drifted: refuse, byte-untouched, ledger kept.
-    #[tokio::test]
-    async fn golang_per_purl_revert_refuses_a_drifted_replace() {
-        let (tmp, mut state) = go_redirected_fixture("\n").await;
-        let root = tmp.path();
-        let go_mod = tokio::fs::read_to_string(root.join("go.mod"))
-            .await
-            .unwrap();
-        let drifted = go_mod.replace(
-            &format!("patch.socket.dev/gopatch/{GO_UUID} v1.10.0-socketpatch.1"),
-            "../my-fork",
-        );
-        tokio::fs::write(root.join("go.mod"), &drifted)
-            .await
-            .unwrap();
-        let go_sum = tokio::fs::read_to_string(root.join("go.sum"))
-            .await
-            .unwrap();
-        let before = state.clone();
-
-        let err = revert_redirect_purl(root, &mut state, GO_PURL, false)
-            .await
-            .expect_err("a drifted replace refuses");
-        assert!(err.contains("go.mod"), "{err}");
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("go.mod"))
-                .await
-                .unwrap(),
-            drifted
-        );
-        assert_eq!(
-            tokio::fs::read_to_string(root.join("go.sum"))
-                .await
-                .unwrap(),
-            go_sum
-        );
-        assert_eq!(state.records.len(), before.records.len());
-        assert_eq!(state.edits.len(), before.edits.len());
-    }
-}
diff --git a/crates/socket-patch-core/src/patch/redirect/upstream/bun_lockb.rs b/crates/socket-patch-core/src/patch/redirect/upstream/bun_lockb.rs
new file mode 100644
index 00000000..aaf71292
--- /dev/null
+++ b/crates/socket-patch-core/src/patch/redirect/upstream/bun_lockb.rs
@@ -0,0 +1,382 @@
+//! bun.lockb upstream restore: every package record whose remote-tarball
+//! resolution is a hosted URL naming an in-scope patch uuid is rebuilt as
+//! Bun's npm registry record for the pin's `name@version` — the registry's
+//! `dist.tarball` and `dist.integrity` (via the `SOCKET_NPM_REGISTRY`-aware
+//! [`super::UpstreamClient`]), through the native codec
+//! ([`BunLockb::set_registry_package`], which also re-derives the metadata
+//! hash Bun's frozen install checks). Every other byte is the file's own.
+//!
+//! Where the hosted rewrite had to normalize the lock, the codec marked it
+//! (see `vendor::bun_lockb`): a lock promoted from binary format 1 is
+//! demoted back to its exact format-1 bytes once every hosted record is
+//! rebuilt, and a lock whose workspace dependency behaviors were normalized
+//! (not invertible) is refused — the checkout remedy, never a non-exact lock.
+//!
+//! Only reached under [`super::RestoreOptions::bun_lockb`]: see there for
+//! why `rollback` keeps refusing a binary lock.
+
+use std::collections::BTreeSet;
+
+use super::npm::{by_uuid, fetch_dists, refuse_all_in};
+use super::{Ctx, FormatResult, HostedPin, View};
+use crate::vendor::bun_lockb::{BunLockb, NORMALIZED_FORMAT_1, NORMALIZED_WORKSPACE};
+
+pub(super) async fn restore(
+    view: &mut View<'_>,
+    pins: &[&HostedPin],
+    files: &[String],
+    ctx: &Ctx<'_>,
+) -> FormatResult {
+    let mut result = FormatResult::default();
+    let pins = by_uuid(pins);
+    for rel in files {
+        let bytes = match view.read_bytes(rel).await {
+            Ok(Some(bytes)) => bytes,
+            Ok(None) => {
+                refuse_all_in(&pins, rel, &mut result, format!("{rel} no longer exists"));
+                continue;
+            }
+            Err(e) => {
+                refuse_all_in(&pins, rel, &mut result, e);
+                continue;
+            }
+        };
+        let mut lock = match BunLockb::parse(&bytes).and_then(|lock| {
+            lock.validate_mutation()?;
+            Ok(lock)
+        }) {
+            Ok(lock) => lock,
+            Err(e) => {
+                refuse_all_in(&pins, rel, &mut result, e);
+                continue;
+            }
+        };
+        let flags = lock.normalized_flags();
+        if flags & NORMALIZED_WORKSPACE != 0 {
+            refuse_all_in(
+                &pins,
+                rel,
+                &mut result,
+                format!(
+                    "the hosted rewrite normalized {rel}'s workspace dependency behaviors, \
+                     so its original bytes cannot be rebuilt"
+                ),
+            );
+            continue;
+        }
+        let packages = match lock.packages() {
+            Ok(packages) => packages,
+            Err(e) => {
+                refuse_all_in(&pins, rel, &mut result, e);
+                continue;
+            }
+        };
+        // (package id, uuid, name, version) per hosted record.
+        let mut hits: Vec<(usize, String, String, String)> = Vec::new();
+        for p in &packages {
+            // Registry records carry a version; a hosted record is a
+            // remote tarball, which the codec reports without one.
+            if p.version.is_some() {
+                continue;
+            }
+            let Some(uuid) = ctx.hosted_uuid(&p.resolution) else {
+                continue;
+            };
+            let Some(pin) = pins.get(uuid.as_str()) else {
+                continue;
+            };
+            match pin.name_version() {
+                Some((name, version)) if name == p.name => {
+                    hits.push((p.id, uuid, name, version));
+                }
+                _ => result.refuse(
+                    &uuid,
+                    format!(
+                        "the {rel} package #{} ({}) wiring it is not {}",
+                        p.id, p.name, pin.purl
+                    ),
+                ),
+            }
+        }
+        let wanted: BTreeSet<(String, String, String)> = hits
+            .iter()
+            .map(|(_, u, n, v)| (u.clone(), n.clone(), v.clone()))
+            .collect();
+        let dists = fetch_dists(&wanted, ctx, &mut result).await;
+        let mut changed = false;
+        let mut restored = Vec::new();
+        for (id, uuid, name, version) in hits {
+            if result.refused.contains_key(&uuid) {
+                continue;
+            }
+            let Some(dist) = dists.get(&(name.clone(), version.clone())) else {
+                continue;
+            };
+            let Some(integrity) = dist.integrity.as_deref() else {
+                result.refuse(
+                    &uuid,
+                    format!("the registry records no integrity for {name}@{version}"),
+                );
+                continue;
+            };
+            // Transactional per record: a failed rebuild leaves `lock` as is.
+            match lock.set_registry_package(id, &version, &dist.tarball, integrity) {
+                Ok(()) => {
+                    restored.push(uuid);
+                    changed = true;
+                }
+                Err(e) => result.refuse(&uuid, format!("{rel} package #{id}: {e}")),
+            }
+        }
+        if changed && flags & NORMALIZED_FORMAT_1 != 0 {
+            // The hosted rewrite promoted a format-1 lock: give back its
+            // exact original bytes, or nothing.
+            match lock.demote_legacy_format() {
+                Ok(Some(original)) => lock = original,
+                Ok(None) => {}
+                Err(e) => {
+                    for uuid in restored.drain(..) {
+                        result.refuse(&uuid, format!("{rel}: {e}"));
+                    }
+                    changed = false;
+                }
+            }
+        }
+        result.handled.extend(restored);
+        if changed {
+            view.write_bytes(rel, lock.bytes());
+        }
+    }
+    result
+}
+
+#[cfg(test)]
+mod tests {
+    use super::super::{restore_upstream, PinStatus, RestoreOptions, RestoreOutcome};
+    use super::*;
+    use crate::patch::redirect::{rewrite_bun_binary, DepOverride, Integrity, RewriteResult};
+    use base64::Engine;
+    use wiremock::matchers::{method, path};
+    use wiremock::{Mock, MockServer, ResponseTemplate};
+
+    const UUID: &str = "77777777-7777-4777-8777-777777777777";
+    const TOKEN: &str = "11111111-1111-4111-8111-111111111111";
+    const UPSTREAM_URL: &str = "https://registry.npmjs.org/minimist/-/minimist-1.2.2.tgz";
+
+    fn fixture(dir: &str) -> Vec<u8> {
+        std::fs::read(
+            std::path::Path::new(env!("CARGO_MANIFEST_DIR"))
+                .join("tests/fixtures/bun-lockb")
+                .join(dir)
+                .join("bun.lockb"),
+        )
+        .unwrap()
+    }
+
+    /// `original` as `scan --mode hosted` leaves it: minimist@1.2.2 on the
+    /// patch server.
+    fn hosted(original: &[u8]) -> Vec<u8> {
+        let dep = DepOverride {
+            ecosystem: "npm".into(),
+            name: "minimist".into(),
+            namespace: None,
+            version: "1.2.2".into(),
+            token: TOKEN.into(),
+            patch_uuid: UUID.into(),
+            artifact_url: format!(
+                "https://patch.socket.dev/patch/npm/{TOKEN}/{UUID}/minimist-1.2.2.tgz"
+            ),
+            berry_zip_url: None,
+            registry_override: None,
+            integrity: Integrity {
+                sha512: Some(format!(
+                    "sha512-{}",
+                    base64::engine::general_purpose::STANDARD.encode([42; 64])
+                )),
+                ..Default::default()
+            },
+        };
+        let mut result = RewriteResult::default();
+        rewrite_bun_binary(original, &[dep], &mut result);
+        assert!(result.warnings.is_empty(), "{:?}", result.warnings);
+        result.binary_files.remove("bun.lockb").expect("rewritten")
+    }
+
+    fn minimist(bytes: &[u8]) -> crate::vendor::bun_lockb::BinaryPackage {
+        BunLockb::parse_packages(bytes)
+            .unwrap()
+            .into_iter()
+            .find(|p| p.name == "minimist" && p.version.as_deref() == Some("1.2.2"))
+            .expect("the registry record")
+    }
+
+    /// An npm registry answering minimist@1.2.2 with the fixture's digest.
+    async fn registry(integrity: &str) -> MockServer {
+        let server = MockServer::start().await;
+        Mock::given(method("GET"))
+            .and(path("/minimist/1.2.2"))
+            .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+                "dist": { "tarball": UPSTREAM_URL, "integrity": integrity }
+            })))
+            .mount(&server)
+            .await;
+        server
+    }
+
+    /// Discover the hosted pin in `lock` and restore it.
+    async fn run(lock: &[u8], opts: &RestoreOptions) -> (RestoreOutcome, Vec<u8>) {
+        let tmp = tempfile::tempdir().unwrap();
+        std::fs::write(tmp.path().join("bun.lockb"), lock).unwrap();
+        let discovery = crate::vex::discover_patched_refs(tmp.path()).await;
+        let pins = HostedPin::all(&discovery);
+        assert_eq!(pins.len(), 1, "{pins:?}");
+        assert_eq!(pins[0].purl, "pkg:npm/minimist@1.2.2");
+        assert_eq!(pins[0].files, ["bun.lockb"]);
+        let outcome = restore_upstream(tmp.path(), &pins, opts).await;
+        assert!(outcome.flush_error.is_none(), "{:?}", outcome.flush_error);
+        (
+            outcome,
+            std::fs::read(tmp.path().join("bun.lockb")).unwrap(),
+        )
+    }
+
+    fn vendor_opts() -> RestoreOptions {
+        RestoreOptions {
+            bun_lockb: true,
+            ..RestoreOptions::default()
+        }
+    }
+
+    /// Every binary writer gets its exact pre-hosted bytes back — including
+    /// the uninitialized padding early writers leave in registry records,
+    /// and a format-1 lock (0.1.1 / 0.1.6), which the hosted rewrite
+    /// promoted to format 2 and the restore demotes again.
+    #[tokio::test]
+    #[serial_test::serial]
+    async fn hosted_record_restores_byte_exact_on_every_writer() {
+        for dir in [
+            "0.1.1",
+            "0.1.6",
+            "0.1.7",
+            "0.5.9",
+            "0.6.7",
+            "0.6.8",
+            "0.8.1",
+            "0.8.1-production",
+            "0.8.1-production-complex",
+            "1.0.0",
+            "1.0.0-production",
+            "1.0.36",
+            "1.1.0",
+            "1.1.38",
+            "1.1.45",
+            "1.2.0",
+            "1.2.23",
+            "1.3.0",
+            "1.3.14",
+            "1.4.2",
+            "two-versions",
+        ] {
+            let original = fixture(dir);
+            let upstream = minimist(&original);
+            assert_eq!(upstream.resolution, UPSTREAM_URL, "{dir}");
+            let server = registry(upstream.integrity.as_deref().unwrap()).await;
+            std::env::set_var("SOCKET_NPM_REGISTRY", server.uri());
+            let lock = hosted(&original);
+            let (outcome, after) = run(&lock, &vendor_opts()).await;
+            std::env::remove_var("SOCKET_NPM_REGISTRY");
+            assert_eq!(outcome.pins[0].status, PinStatus::Restored, "{dir}");
+            assert_eq!(outcome.reverted_files, ["bun.lockb"], "{dir}");
+            assert!(after == original, "{dir}: not byte-exact");
+        }
+    }
+
+    /// Where the hosted rewrite had to normalize workspace dependency
+    /// behaviors (not invertible), the restore refuses with the checkout
+    /// remedy and writes nothing, instead of returning a non-exact lock.
+    #[tokio::test]
+    #[serial_test::serial]
+    async fn workspace_normalized_locks_refuse() {
+        for dir in ["1.1.45-extensions", "1.2.23-extensions", "1.4.2-extensions"] {
+            let original = fixture(dir);
+            let upstream = minimist(&original);
+            let server = registry(upstream.integrity.as_deref().unwrap()).await;
+            std::env::set_var("SOCKET_NPM_REGISTRY", server.uri());
+            let lock = hosted(&original);
+            assert_eq!(
+                BunLockb::parse(&lock).unwrap().normalized_flags(),
+                crate::vendor::bun_lockb::NORMALIZED_WORKSPACE,
+                "{dir}"
+            );
+            let (outcome, after) = run(&lock, &vendor_opts()).await;
+            std::env::remove_var("SOCKET_NPM_REGISTRY");
+            let why: Vec<&str> = outcome.refused().map(|(_, why)| why).collect();
+            assert_eq!(why.len(), 1, "{dir}: {why:?}");
+            assert!(why[0].contains("workspace dependency behaviors"), "{why:?}");
+            assert!(why[0].contains("git checkout -- bun.lockb"), "{why:?}");
+            assert!(outcome.reverted_files.is_empty(), "{dir}");
+            assert!(after == lock, "{dir}");
+        }
+    }
+
+    /// A promoted format-1 lock whose mark this codec did not write exactly
+    /// (here: an unknown flag bit) is refused, never demoted to a guess.
+    #[tokio::test]
+    #[serial_test::serial]
+    async fn promoted_format_1_lock_that_does_not_invert_refuses() {
+        let original = fixture("0.1.6");
+        let upstream = minimist(&original);
+        let server = registry(upstream.integrity.as_deref().unwrap()).await;
+        std::env::set_var("SOCKET_NPM_REGISTRY", server.uri());
+        let mut lock = hosted(&original);
+        let count = u64::from_le_bytes(lock[86..94].try_into().unwrap()) as usize;
+        let package_start = u64::from_le_bytes(lock[110..118].try_into().unwrap()) as usize;
+        // The root resolution's flag byte (its last).
+        let flags_at = package_start + count * 16 + 63;
+        assert_eq!(lock[flags_at], crate::vendor::bun_lockb::NORMALIZED_FORMAT_1);
+        lock[flags_at] |= 0x40;
+        BunLockb::parse(&lock).unwrap().validate_mutation().unwrap();
+        let (outcome, after) = run(&lock, &vendor_opts()).await;
+        std::env::remove_var("SOCKET_NPM_REGISTRY");
+        let why: Vec<&str> = outcome.refused().map(|(_, why)| why).collect();
+        assert_eq!(why.len(), 1, "{why:?}");
+        assert!(why[0].contains("format-1"), "{why:?}");
+        assert!(why[0].contains("git checkout -- bun.lockb"), "{why:?}");
+        assert!(after == lock);
+    }
+
+    /// Without the vendor opt-in (the `rollback` posture), or offline,
+    /// nothing is written and the refusal names the checkout remedy; a dry
+    /// run resolves the restore and writes nothing.
+    #[tokio::test]
+    #[serial_test::serial]
+    async fn refusals_and_dry_run_leave_the_lock_untouched() {
+        let original = fixture("1.1.38");
+        let upstream = minimist(&original);
+        let server = registry(upstream.integrity.as_deref().unwrap()).await;
+        std::env::set_var("SOCKET_NPM_REGISTRY", server.uri());
+        let lock = hosted(&original);
+        let rollback = RestoreOptions::default();
+        let offline = RestoreOptions {
+            offline: true,
+            ..vendor_opts()
+        };
+        for opts in [&rollback, &offline] {
+            let (outcome, after) = run(&lock, opts).await;
+            let why: Vec<&str> = outcome.refused().map(|(_, why)| why).collect();
+            assert_eq!(why.len(), 1, "{why:?}");
+            assert!(why[0].contains("git checkout -- bun.lockb"), "{why:?}");
+            assert!(outcome.reverted_files.is_empty());
+            assert!(after == lock);
+        }
+        let dry = RestoreOptions {
+            dry_run: true,
+            ..vendor_opts()
+        };
+        let (outcome, after) = run(&lock, &dry).await;
+        std::env::remove_var("SOCKET_NPM_REGISTRY");
+        assert_eq!(outcome.pins[0].status, PinStatus::Restored);
+        assert_eq!(outcome.reverted_files, ["bun.lockb"]);
+        assert!(after == lock);
+    }
+}
diff --git a/crates/socket-patch-core/src/patch/redirect/upstream/cargo.rs b/crates/socket-patch-core/src/patch/redirect/upstream/cargo.rs
new file mode 100644
index 00000000..da6fa754
--- /dev/null
+++ b/crates/socket-patch-core/src/patch/redirect/upstream/cargo.rs
@@ -0,0 +1,409 @@
+//! Cargo upstream restore: `Cargo.lock` entries back on crates.io (source +
+//! the index's checksum), every `Cargo.toml` declaration loses its
+//! `registry = "socket-patch-<uuid>"` pin, and the project cargo config
+//! drops the `[registries.socket-patch-<uuid>]` block nothing references
+//! any more.
+//!
+//! The hosted rewriter only ever pins crates.io dependencies (it refuses a
+//! dep declared against any other registry), so the upstream source is
+//! always crates.io's. A declaration's original spelling is not recorded:
+//! the shorthand `name = { version = "…", registry = "…" }` the rewriter
+//! produces from `name = "…"` collapses back to that shorthand, and every
+//! other form just loses the pin.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use regex::Regex;
+
+use super::{Ctx, FormatResult, HostedPin, View};
+
+/// How Cargo.lock names crates.io (cargo keeps this spelling even when it
+/// fetches over the sparse protocol).
+const CRATES_IO_SOURCE: &str = "registry+https://github.com/rust-lang/crates.io-index";
+
+/// The project cargo configs, in cargo's read preference.
+const CARGO_CONFIGS: [&str; 2] = [".cargo/config", ".cargo/config.toml"];
+
+fn registry_name(uuid: &str) -> String {
+    format!("socket-patch-{uuid}")
+}
+
+struct LockHit {
+    uuid: String,
+    name: String,
+    version: String,
+    /// The hosted source string (`sparse+https://…/index/`).
+    source: String,
+}
+
+fn quoted_field(block: &str, field: &str) -> Option<String> {
+    block.lines().find_map(|l| {
+        let rest = l.strip_prefix(field)?.trim_start().strip_prefix('=')?;
+        let v = rest.trim();
+        v.strip_prefix('"')?.strip_suffix('"').map(str::to_string)
+    })
+}
+
+pub(crate) async fn restore(
+    view: &mut View<'_>,
+    pins: &[&HostedPin],
+    _files: &[String],
+    ctx: &Ctx<'_>,
+) -> FormatResult {
+    let mut result = FormatResult::default();
+    let by_uuid: BTreeMap<&str, &HostedPin> = pins.iter().map(|p| (p.uuid.as_str(), *p)).collect();
+
+    // ── Cargo.lock ──
+    let lock_raw = match view.read("Cargo.lock").await {
+        Ok(t) => t,
+        Err(e) => {
+            for pin in pins {
+                result.refuse(&pin.uuid, e.clone());
+            }
+            return result;
+        }
+    };
+    if let Some(raw) = lock_raw {
+        let crlf = raw.contains("\r\n");
+        let mut lock = raw.replace("\r\n", "\n");
+        let mut hits: Vec<LockHit> = Vec::new();
+        let mut from = 0;
+        while let Some((start, end)) = super::super::next_lock_block(&lock, from) {
+            from = end.max(start + 1);
+            let block = &lock[start..end];
+            let Some(source) = quoted_field(block, "source") else {
+                continue;
+            };
+            let Some(uuid) = ctx.hosted_uuid(&source) else {
+                continue;
+            };
+            if !by_uuid.contains_key(uuid.as_str()) {
+                continue;
+            }
+            match (quoted_field(block, "name"), quoted_field(block, "version")) {
+                (Some(name), Some(version)) => hits.push(LockHit {
+                    uuid,
+                    name,
+                    version,
+                    source,
+                }),
+                _ => result.refuse(&uuid, "its Cargo.lock entry names no crate and version"),
+            }
+        }
+        let lookups = hits.iter().map(|h| async move {
+            (
+                h.uuid.clone(),
+                ctx.client.cargo_cksum(&h.name, &h.version).await,
+            )
+        });
+        let cksums: BTreeMap<String, Result<String, String>> =
+            futures_util::future::join_all(lookups).await.into_iter().collect();
+        let mut changed = false;
+        for hit in &hits {
+            let cksum = match cksums.get(&hit.uuid) {
+                Some(Ok(c)) => c.clone(),
+                Some(Err(why)) => {
+                    result.refuse(&hit.uuid, format!("{}@{}: {why}", hit.name, hit.version));
+                    continue;
+                }
+                None => continue,
+            };
+            if result.refused.contains_key(&hit.uuid) {
+                continue;
+            }
+            // The entry's own source + checksum lines.
+            let mut from = 0;
+            while let Some((start, end)) = super::super::next_lock_block(&lock, from) {
+                from = end.max(start + 1);
+                let block = lock[start..end].to_string();
+                if quoted_field(&block, "source").as_deref() != Some(hit.source.as_str())
+                    || quoted_field(&block, "name").as_deref() != Some(hit.name.as_str())
+                    || quoted_field(&block, "version").as_deref() != Some(hit.version.as_str())
+                {
+                    continue;
+                }
+                let rebuilt: Vec<String> = block
+                    .split('\n')
+                    .map(|l| {
+                        if l.starts_with("source = ") {
+                            format!("source = \"{CRATES_IO_SOURCE}\"")
+                        } else if l.starts_with("checksum = ") {
+                            format!("checksum = \"{cksum}\"")
+                        } else {
+                            l.to_string()
+                        }
+                    })
+                    .collect();
+                lock.replace_range(start..end, &rebuilt.join("\n"));
+                from = start + 1;
+            }
+            // Dependents' full-id references and the v1 `[metadata]` key.
+            lock = lock.replace(&format!("({})", hit.source), &format!("({CRATES_IO_SOURCE})"));
+            let metadata_key = format!(
+                "\"checksum {} {} ({CRATES_IO_SOURCE})\" = \"",
+                hit.name, hit.version
+            );
+            let rebuilt: Vec<String> = lock
+                .split('\n')
+                .map(|l| match l.strip_prefix(&metadata_key) {
+                    Some(_) => format!("{metadata_key}{cksum}\""),
+                    None => l.to_string(),
+                })
+                .collect();
+            lock = rebuilt.join("\n");
+            result.handled.insert(hit.uuid.clone());
+            changed = true;
+        }
+        if changed {
+            view.write(
+                "Cargo.lock",
+                if crlf { lock.replace('\n', "\r\n") } else { lock },
+            );
+        }
+    }
+
+    // ── Cargo.toml pins ──
+    let root = view.root().to_path_buf();
+    let mut manifests: Vec<String> = vec!["Cargo.toml".to_string()];
+    manifests.extend(
+        tokio::task::spawn_blocking(move || crate::utils::cargo_workspace::member_manifests(&root))
+            .await
+            .unwrap_or_default(),
+    );
+    for rel in &manifests {
+        let Ok(Some(text)) = view.read(rel).await else {
+            continue;
+        };
+        let mut changed = false;
+        let mut out: Vec<String> = Vec::new();
+        for line in text.split('\n') {
+            let mut kept = Some(line.to_string());
+            for pin in pins {
+                if result.refused.contains_key(&pin.uuid) {
+                    continue;
+                }
+                let reg = registry_name(&pin.uuid);
+                let Some(current) = kept.as_deref() else {
+                    break;
+                };
+                if !current.contains(&format!("\"{reg}\"")) {
+                    continue;
+                }
+                match unpin_line(current, &reg) {
+                    Some(next) => {
+                        kept = next;
+                        changed = true;
+                        result.handled.insert(pin.uuid.clone());
+                    }
+                    None => result.refuse(
+                        &pin.uuid,
+                        format!("{rel} pins it with a declaration socket-patch cannot unpin"),
+                    ),
+                }
+            }
+            if let Some(line) = kept {
+                out.push(line);
+            }
+        }
+        if changed {
+            view.write(rel, out.join("\n"));
+        }
+    }
+
+    // ── cargo config registry blocks ──
+    let mut referenced: BTreeSet<String> = BTreeSet::new();
+    for rel in manifests.iter().map(String::as_str).chain(["Cargo.lock"]) {
+        if let Ok(Some(text)) = view.read(rel).await {
+            for pin in pins {
+                let reg = registry_name(&pin.uuid);
+                if text.contains(&reg) || lock_names_index(&text, &pin.uuid) {
+                    referenced.insert(pin.uuid.clone());
+                }
+            }
+        }
+    }
+    for rel in CARGO_CONFIGS {
+        let Ok(Some(config)) = view.read(rel).await else {
+            continue;
+        };
+        let mut next = config.clone();
+        for pin in pins {
+            if result.refused.contains_key(&pin.uuid) || referenced.contains(&pin.uuid) {
+                continue;
+            }
+            if let Some(removed) = remove_registry_block(&next, &registry_name(&pin.uuid)) {
+                next = removed;
+                result.handled.insert(pin.uuid.clone());
+            }
+        }
+        if next != config {
+            if next.trim().is_empty() {
+                view.remove(rel);
+            } else {
+                view.write(rel, next);
+            }
+        }
+    }
+    let _ = by_uuid;
+    result
+}
+
+/// Whether a Cargo.lock still sources a crate from the hosted index of
+/// `uuid` (a pin this pass did not restore).
+fn lock_names_index(text: &str, uuid: &str) -> bool {
+    text.contains(&format!("/{uuid}/index/"))
+}
+
+static SHORTHAND_RE: std::sync::LazyLock<Regex> = std::sync::LazyLock::new(|| {
+    Regex::new(
+        r#"^(\s*[^=\s][^=]*?\s*=\s*)\{ version = "([^"]+)", registry = "(socket-patch-[0-9a-fA-F-]{36})" \}(.*)$"#,
+    )
+    .expect("static shorthand regex is valid")
+});
+
+/// The line with its `registry = "<reg>"` pin removed: `Some(None)` drops
+/// the whole line (the table form's inserted `registry = …` line),
+/// `Some(Some(line))` is the unpinned declaration, `None` a spelling this
+/// restore does not recognize.
+fn unpin_line(line: &str, reg: &str) -> Option<Option<String>> {
+    let trimmed = line.trim();
+    let body = trimmed.split('#').next().unwrap_or(trimmed).trim();
+    if body == format!("registry = \"{reg}\"") {
+        return Some(None);
+    }
+    if let Some(c) = SHORTHAND_RE.captures(line) {
+        if &c[3] == reg {
+            return Some(Some(format!("{}\"{}\"{}", &c[1], &c[2], &c[4])));
+        }
+    }
+    let open = line.find('{')?;
+    let close = open + line[open..].find('}')?;
+    let inner = &line[open + 1..close];
+    let pin_re = Regex::new(&format!(
+        r#",?\s*registry\s*=\s*"{}"\s*,?"#,
+        regex::escape(reg)
+    ))
+    .expect("registry pin regex is valid");
+    let m = pin_re.find(inner)?;
+    let mut rest = String::new();
+    rest.push_str(inner[..m.start()].trim_end());
+    let tail = inner[m.end()..].trim_start();
+    if !tail.is_empty() {
+        if !rest.trim().is_empty() {
+            rest.push_str(", ");
+        }
+        rest.push_str(tail.trim_end());
+    }
+    let rest = rest.trim().trim_end_matches(',').trim();
+    let rebuilt = if rest.is_empty() {
+        format!("{}{{}}{}", &line[..open], &line[close + 1..])
+    } else {
+        format!("{}{{ {rest} }}{}", &line[..open], &line[close + 1..])
+    };
+    Some(Some(rebuilt))
+}
+
+/// The config with its `[registries.<reg>]` block (and the blank separator
+/// the rewriter put before it) removed; `None` when absent.
+fn remove_registry_block(config: &str, reg: &str) -> Option<String> {
+    let crlf = config.contains("\r\n");
+    let lf = config.replace("\r\n", "\n");
+    let header = format!("[registries.{reg}]");
+    let lines: Vec<&str> = lf.split('\n').collect();
+    let i = lines.iter().position(|l| l.trim() == header)?;
+    let mut end = lines.len();
+    for (j, l) in lines.iter().enumerate().skip(i + 1) {
+        if l.trim_start().starts_with('[') {
+            end = j;
+            break;
+        }
+    }
+    while end > i + 1 && lines[end - 1].trim().is_empty() {
+        end -= 1;
+    }
+    let fragment = format!("{}\n", lines[i..end].join("\n"));
+    let removed = remove_appended_cargo_block(&lf, &fragment)
+        .or_else(|| {
+            // The block ends the file with no final newline.
+            remove_appended_cargo_block(&lf, fragment.trim_end_matches('\n'))
+        })?;
+    Some(if crlf {
+        removed.replace('\n', "\r\n")
+    } else {
+        removed
+    })
+}
+
+/// Invert the cargo rewriter's append of a `[registries.…]` block: it wrote
+/// `config + "\n" + block` (just `block` into an empty config), or
+/// `config + "\n\n" + block` when the config lacked a final newline.
+/// Removing the block plus the one newline before it restores the config's
+/// exact bytes, a missing final newline or trailing blank lines included,
+/// and anything the user appended after the block kept. An all-CRLF file is
+/// inverted as LF and written back CRLF. `None` when the block is not in
+/// the file.
+fn remove_appended_cargo_block(content: &str, fragment: &str) -> Option<String> {
+    if !content.is_empty() && content.matches('\n').count() == content.matches("\r\n").count() {
+        return remove_appended_cargo_block(
+            &content.replace("\r\n", "\n"),
+            &fragment.replace("\r\n", "\n"),
+        )
+        .map(|lf| lf.replace('\n', "\r\n"));
+    }
+    let lf_fragment = fragment.replace("\r\n", "\n");
+    let (pos, len) = match content.find(fragment) {
+        Some(pos) => (pos, fragment.len()),
+        None => (content.find(&lf_fragment)?, lf_fragment.len()),
+    };
+    let before = &content[..pos];
+    let before = before
+        .strip_suffix("\r\n")
+        .or_else(|| before.strip_suffix('\n'))
+        .unwrap_or(before);
+    Some(format!("{before}{}", &content[pos + len..]))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const REG: &str = "socket-patch-55555555-5555-5555-5555-555555555555";
+
+    #[test]
+    fn shorthand_collapses_back() {
+        let line = format!("serde = {{ version = \"1.0.190\", registry = \"{REG}\" }}");
+        assert_eq!(
+            unpin_line(&line, REG),
+            Some(Some("serde = \"1.0.190\"".to_string()))
+        );
+    }
+
+    #[test]
+    fn inline_table_loses_only_the_pin() {
+        let line = format!(
+            "serde = {{ version = \"1\", features = [\"derive\"], registry = \"{REG}\" }} # hi"
+        );
+        assert_eq!(
+            unpin_line(&line, REG),
+            Some(Some(
+                "serde = { version = \"1\", features = [\"derive\"] } # hi".to_string()
+            ))
+        );
+    }
+
+    #[test]
+    fn table_form_line_is_dropped() {
+        assert_eq!(unpin_line(&format!("registry = \"{REG}\""), REG), Some(None));
+    }
+
+    #[test]
+    fn appended_block_leaves_the_config_byte_identical() {
+        let original = "[net]\ngit-fetch-with-cli = true\n";
+        let hosted = format!(
+            "{original}\n[registries.{REG}]\nindex = \"sparse+https://patch.socket.dev/x/index/\"\n"
+        );
+        assert_eq!(remove_registry_block(&hosted, REG).as_deref(), Some(original));
+        let created = format!("[registries.{REG}]\nindex = \"sparse+https://x/\"\n");
+        assert_eq!(remove_registry_block(&created, REG).as_deref(), Some(""));
+    }
+}
diff --git a/crates/socket-patch-core/src/patch/redirect/upstream/client.rs b/crates/socket-patch-core/src/patch/redirect/upstream/client.rs
new file mode 100644
index 00000000..5be77710
--- /dev/null
+++ b/crates/socket-patch-core/src/patch/redirect/upstream/client.rs
@@ -0,0 +1,681 @@
+//! Registry lookups for the upstream restore: what a default-registry lock
+//! entry pins, re-resolved from the public registry (each base overridable
+//! by the same env vars the vendored fetch honors, so tests and mirrors can
+//! point it elsewhere).
+
+use std::collections::HashMap;
+
+use serde_json::Value;
+use tokio::sync::Mutex;
+
+use crate::vendor::registry_fetch::{
+    build_registry_client, npm_registry_base, pypi_json_api_base, RegistryClient,
+};
+
+/// An npm version's `dist` block.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct NpmDist {
+    /// The registry's tarball URL for the version.
+    pub tarball: String,
+    /// The SRI `dist.integrity` (sha512 on every modern publish).
+    pub integrity: Option<String>,
+    /// The hex sha1 `dist.shasum`.
+    pub shasum: Option<String>,
+}
+
+/// A Go module version's two go.sum hashes.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct GoSums {
+    /// `h1:` of the module zip.
+    pub zip_h1: String,
+    /// `h1:` of the module's go.mod.
+    pub mod_h1: String,
+}
+
+/// One release file of a PyPI version, from the JSON API's `urls[]`.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct PypiFile {
+    /// The distribution filename (`<name>-<ver>-<tags>.whl`, `.tar.gz`, …).
+    pub filename: String,
+    /// The file's download URL (files.pythonhosted.org on PyPI).
+    pub url: String,
+    /// Lowercase hex sha256 (`digests.sha256`).
+    pub sha256: String,
+    /// Size in bytes.
+    pub size: Option<u64>,
+    /// `upload_time_iso_8601` (microsecond precision, `Z`): the same instant
+    /// the PEP 691 simple API reports as `upload-time`, which is what uv
+    /// records.
+    pub upload_time: Option<String>,
+}
+
+/// The sparse crates.io index; override with `SOCKET_CRATES_INDEX`.
+pub(crate) const DEFAULT_CRATES_INDEX: &str = "https://index.crates.io";
+
+fn crates_index_base() -> String {
+    std::env::var("SOCKET_CRATES_INDEX")
+        .ok()
+        .map(|v| v.trim_end_matches('/').to_string())
+        .filter(|v| !v.is_empty())
+        .unwrap_or_else(|| DEFAULT_CRATES_INDEX.to_string())
+}
+
+/// The sparse-index path of a crate (`cargo`'s `index_path` layout).
+fn crates_index_path(name: &str) -> String {
+    let lower = name.to_ascii_lowercase();
+    match lower.len() {
+        1 => format!("1/{lower}"),
+        2 => format!("2/{lower}"),
+        3 => format!("3/{}/{lower}", &lower[..1]),
+        _ => format!("{}/{}/{lower}", &lower[..2], &lower[2..4]),
+    }
+}
+
+/// The RubyGems compact index root; override with `SOCKET_RUBYGEMS_URL`.
+pub(crate) const DEFAULT_RUBYGEMS: &str = "https://rubygems.org";
+
+fn rubygems_base() -> String {
+    std::env::var("SOCKET_RUBYGEMS_URL")
+        .ok()
+        .map(|v| v.trim().trim_end_matches('/').to_string())
+        .filter(|v| !v.is_empty())
+        .unwrap_or_else(|| DEFAULT_RUBYGEMS.to_string())
+}
+
+/// Packagist's composer v2 metadata repository; override with
+/// `SOCKET_PACKAGIST_URL`.
+pub(crate) const DEFAULT_PACKAGIST: &str = "https://repo.packagist.org";
+
+fn packagist_base() -> String {
+    std::env::var("SOCKET_PACKAGIST_URL")
+        .ok()
+        .map(|v| v.trim().trim_end_matches('/').to_string())
+        .filter(|v| !v.is_empty())
+        .unwrap_or_else(|| DEFAULT_PACKAGIST.to_string())
+}
+
+/// The `checksum:` (sha256 hex of the `.gem`) a compact-index `info/<name>`
+/// file records for the ruby-platform `version` — the value bundler writes
+/// into `CHECKSUMS`. Lines are `<version>[-<platform>] <deps>|<reqs>`, the
+/// requirement list carrying `checksum:<hex>`.
+pub(crate) fn compact_index_checksum(info: &str, version: &str) -> Option<String> {
+    info.lines().find_map(|line| {
+        let (head, reqs) = line.split_once('|')?;
+        let token = head.split(' ').next()?;
+        if token != version {
+            return None;
+        }
+        reqs.split(',')
+            .find_map(|r| r.trim().strip_prefix("checksum:"))
+            .and_then(crate::utils::digest::sha256_hex)
+    })
+}
+
+/// Expand a packagist `p2` version list. `minified: composer/2.0` documents
+/// (composer's `MetadataMinifier`) list each version as the DIFF against the
+/// previous expanded one: every key it carries replaces the inherited value,
+/// and the string `"__unset"` removes the key.
+pub(crate) fn expand_packagist_versions(versions: &[Value], minified: bool) -> Vec<Value> {
+    if !minified {
+        return versions.to_vec();
+    }
+    let mut out = Vec::with_capacity(versions.len());
+    let mut current: Option<serde_json::Map<String, Value>> = None;
+    for v in versions {
+        let Some(obj) = v.as_object() else {
+            continue;
+        };
+        let next = match current.take() {
+            None => obj.clone(),
+            Some(mut prev) => {
+                for (k, val) in obj {
+                    if val.as_str() == Some("__unset") {
+                        prev.remove(k);
+                    } else {
+                        prev.insert(k.clone(), val.clone());
+                    }
+                }
+                prev
+            }
+        };
+        out.push(Value::Object(next.clone()));
+        current = Some(next);
+    }
+    out
+}
+
+/// The offline refusal every lookup returns under `--offline`.
+pub(crate) const OFFLINE: &str =
+    "the upstream entry must be re-resolved from the registry, and this run is offline";
+
+type Cache<T> = Mutex<HashMap<(String, String), Result<T, String>>>;
+
+/// One client per restore run; every lookup is cached (success and
+/// failure alike) so a pin wired in several files costs one request.
+pub(crate) struct UpstreamClient {
+    http: RegistryClient,
+    offline: bool,
+    npm: Cache<NpmDist>,
+    npm_tarballs: Cache<Vec<u8>>,
+    cargo: Cache<String>,
+    go: Cache<GoSums>,
+    rubygems: Cache<String>,
+    packagist: Cache<Vec<Value>>,
+    pypi: Cache<Vec<PypiFile>>,
+    nuget: Cache<String>,
+}
+
+impl UpstreamClient {
+    pub(crate) fn new(offline: bool) -> Self {
+        UpstreamClient {
+            http: build_registry_client(),
+            offline,
+            npm: Mutex::default(),
+            npm_tarballs: Mutex::default(),
+            cargo: Mutex::default(),
+            go: Mutex::default(),
+            rubygems: Mutex::default(),
+            packagist: Mutex::default(),
+            pypi: Mutex::default(),
+            nuget: Mutex::default(),
+        }
+    }
+
+    async fn get_json(&self, url: &str) -> Result<Value, String> {
+        let resp = self
+            .http
+            .get(url)
+            .header("accept", "application/json")
+            .send()
+            .await
+            .map_err(|e| format!("GET {url}: {e}"))?;
+        let status = resp.status();
+        if !status.is_success() {
+            return Err(format!("GET {url}: HTTP {status}"));
+        }
+        let text = resp
+            .text()
+            .await
+            .map_err(|e| format!("reading {url}: {e}"))?;
+        serde_json::from_str(&text).map_err(|e| format!("{url} is not JSON: {e}"))
+    }
+
+    async fn get_text(&self, url: &str) -> Result<String, String> {
+        let bytes = crate::vendor::registry_fetch::download(&self.http, url).await?;
+        String::from_utf8(bytes).map_err(|_| format!("{url} is not UTF-8"))
+    }
+
+    /// `dist` of `name@version` from the npm registry's version document.
+    pub(crate) async fn npm_dist(&self, name: &str, version: &str) -> Result<NpmDist, String> {
+        let key = (name.to_string(), version.to_string());
+        if let Some(hit) = self.npm.lock().await.get(&key) {
+            return hit.clone();
+        }
+        let result = self.fetch_npm_dist(name, version).await;
+        self.npm.lock().await.insert(key, result.clone());
+        result
+    }
+
+    async fn fetch_npm_dist(&self, name: &str, version: &str) -> Result<NpmDist, String> {
+        if self.offline {
+            return Err(OFFLINE.to_string());
+        }
+        let encoded_name = name.replace('/', "%2f");
+        let url = format!(
+            "{}/{encoded_name}/{}",
+            npm_registry_base(),
+            crate::utils::uri::encode_uri_component(version)
+        );
+        let doc = self.get_json(&url).await?;
+        let dist = doc
+            .get("dist")
+            .ok_or_else(|| format!("{url} carries no `dist` block"))?;
+        let str_field = |k: &str| dist.get(k).and_then(Value::as_str).map(str::to_string);
+        let tarball = str_field("tarball")
+            .ok_or_else(|| format!("{url} carries no `dist.tarball`"))?;
+        Ok(NpmDist {
+            tarball,
+            integrity: str_field("integrity"),
+            shasum: str_field("shasum"),
+        })
+    }
+
+    /// The verified upstream tarball bytes of `name@version` (checked
+    /// against the registry's `dist.integrity`).
+    pub(crate) async fn npm_tarball(&self, name: &str, version: &str) -> Result<Vec<u8>, String> {
+        let key = (name.to_string(), version.to_string());
+        if let Some(hit) = self.npm_tarballs.lock().await.get(&key) {
+            return hit.clone();
+        }
+        let result = async {
+            let dist = self.npm_dist(name, version).await?;
+            let integrity = dist
+                .integrity
+                .clone()
+                .ok_or_else(|| format!("the registry records no integrity for {name}@{version}"))?;
+            let bytes = crate::vendor::registry_fetch::download(&self.http, &dist.tarball).await?;
+            crate::vendor::registry_fetch::verify_sri(&bytes, &integrity)?;
+            Ok(bytes)
+        }
+        .await;
+        self.npm_tarballs.lock().await.insert(key, result.clone());
+        result
+    }
+
+    /// The crates.io `cksum` (sha256 hex of the `.crate`) of
+    /// `name@version`, from the sparse index.
+    pub(crate) async fn cargo_cksum(&self, name: &str, version: &str) -> Result<String, String> {
+        let key = (name.to_string(), version.to_string());
+        if let Some(hit) = self.cargo.lock().await.get(&key) {
+            return hit.clone();
+        }
+        let result = async {
+            if self.offline {
+                return Err(OFFLINE.to_string());
+            }
+            let url = format!("{}/{}", crates_index_base(), crates_index_path(name));
+            let text = self.get_text(&url).await?;
+            for line in text.lines().filter(|l| !l.trim().is_empty()) {
+                let Ok(row) = serde_json::from_str::<Value>(line) else {
+                    continue;
+                };
+                if row.get("vers").and_then(Value::as_str) == Some(version) {
+                    return row
+                        .get("cksum")
+                        .and_then(Value::as_str)
+                        .filter(|c| crate::utils::digest::is_hex64_lower(c))
+                        .map(str::to_string)
+                        .ok_or_else(|| format!("{url} lists {version} without a checksum"));
+                }
+            }
+            Err(format!("{url} does not list {name} {version}"))
+        }
+        .await;
+        self.cargo.lock().await.insert(key, result.clone());
+        result
+    }
+
+    /// Every release file of `name@version` from PyPI's JSON API (`GET
+    /// <api>/<name>/<version>/json`, base overridable with
+    /// `SOCKET_PYPI_JSON_API`), sorted by filename — the order Poetry, PDM,
+    /// Pipenv and pip-compile record them in. `name` is PEP 503
+    /// canonicalized first (PyPI redirects every other spelling to it).
+    pub(crate) async fn pypi_files(
+        &self,
+        name: &str,
+        version: &str,
+    ) -> Result<Vec<PypiFile>, String> {
+        let name = crate::crawlers::python_crawler::canonicalize_pypi_name(name);
+        let key = (name.clone(), version.to_string());
+        if let Some(hit) = self.pypi.lock().await.get(&key) {
+            return hit.clone();
+        }
+        let result = async {
+            if self.offline {
+                return Err(OFFLINE.to_string());
+            }
+            let url = format!(
+                "{}/{name}/{}/json",
+                pypi_json_api_base(),
+                crate::utils::uri::encode_uri_component(version)
+            );
+            let doc = self.get_json(&url).await?;
+            pypi_release_files(&doc).map_err(|why| format!("{url} {why}"))
+        }
+        .await;
+        self.pypi.lock().await.insert(key, result.clone());
+        result
+    }
+
+    /// The go.sum hashes of `module@version`, computed from the module
+    /// proxy's `.zip` and `.mod` the way `go` computes them.
+    pub(crate) async fn go_sums(&self, module: &str, version: &str) -> Result<GoSums, String> {
+        let key = (module.to_string(), version.to_string());
+        if let Some(hit) = self.go.lock().await.get(&key) {
+            return hit.clone();
+        }
+        let result = async {
+            if self.offline {
+                return Err(OFFLINE.to_string());
+            }
+            if let Some(sumdb) = gosumdb_base(module) {
+                let url = format!(
+                    "{sumdb}/lookup/{}@{}",
+                    crate::crawlers::go_crawler::encode_module_path(module),
+                    crate::crawlers::go_crawler::encode_module_path(version)
+                );
+                let text = self.get_text(&url).await?;
+                let zip_key = format!("{module} {version} ");
+                let mod_key = format!("{module} {version}/go.mod ");
+                let pick = |key: &str| {
+                    text.lines()
+                        .find_map(|l| l.strip_prefix(key))
+                        .map(|h| h.trim().to_string())
+                        .filter(|h| crate::vendor::go_sum_edit::is_h1_dirhash(h))
+                };
+                return match (pick(&zip_key), pick(&mod_key)) {
+                    (Some(zip_h1), Some(mod_h1)) => Ok(GoSums { zip_h1, mod_h1 }),
+                    _ => Err(format!("{url} does not list both go.sum lines of {module} {version}")),
+                };
+            }
+            let proxy = crate::vendor::registry_fetch::goproxy_base(module)?;
+            let escaped = crate::crawlers::go_crawler::encode_module_path(module);
+            let escaped_version = crate::crawlers::go_crawler::encode_module_path(version);
+            let base = format!("{proxy}/{escaped}/@v/{escaped_version}");
+            let zip = crate::vendor::registry_fetch::download(&self.http, &format!("{base}.zip"))
+                .await?;
+            let zip_h1 = crate::vendor::registry_fetch::go_h1_of_zip(&zip)?;
+            let go_mod =
+                crate::vendor::registry_fetch::download(&self.http, &format!("{base}.mod")).await?;
+            Ok(GoSums {
+                zip_h1,
+                mod_h1: go_mod_h1(&go_mod),
+            })
+        }
+        .await;
+        self.go.lock().await.insert(key, result.clone());
+        result
+    }
+
+    /// The rubygems.org sha256 of the ruby-platform `name-version.gem`,
+    /// from the compact index bundler itself reads (`info/<name>`).
+    pub(crate) async fn rubygems_sha256(&self, name: &str, version: &str) -> Result<String, String> {
+        let key = (name.to_string(), version.to_string());
+        if let Some(hit) = self.rubygems.lock().await.get(&key) {
+            return hit.clone();
+        }
+        let result = async {
+            if self.offline {
+                return Err(OFFLINE.to_string());
+            }
+            if !crate::vendor::gemfile_lock::is_plain_gem_token(name) {
+                return Err(format!("{name:?} is not a plain gem name"));
+            }
+            let url = format!("{}/info/{name}", rubygems_base());
+            let text = self.get_text(&url).await?;
+            compact_index_checksum(&text, version)
+                .ok_or_else(|| format!("{url} lists no ruby-platform {version} with a checksum"))
+        }
+        .await;
+        self.rubygems.lock().await.insert(key, result.clone());
+        result
+    }
+
+    /// Every version packagist serves for the composer package `name`
+    /// (lowercase `vendor/package`), expanded: the stable `p2/<name>.json`
+    /// list, or the `~dev` one when `dev` (composer splits branches out).
+    pub(crate) async fn packagist_versions(&self, name: &str, dev: bool) -> Result<Vec<Value>, String> {
+        let key = (name.to_string(), if dev { "~dev" } else { "" }.to_string());
+        if let Some(hit) = self.packagist.lock().await.get(&key) {
+            return hit.clone();
+        }
+        let result = async {
+            if self.offline {
+                return Err(OFFLINE.to_string());
+            }
+            let safe = name.split('/').count() == 2
+                && name.split('/').all(|p| {
+                    !p.is_empty()
+                        && !p.starts_with('.')
+                        && p.bytes().all(|b| {
+                            b.is_ascii_lowercase() || b.is_ascii_digit() || b"._-".contains(&b)
+                        })
+                });
+            if !safe {
+                return Err(format!("{name:?} is not a packagist package name"));
+            }
+            let url = format!("{}/p2/{name}{}.json", packagist_base(), key.1);
+            let doc = self.get_json(&url).await?;
+            let versions = doc
+                .get("packages")
+                .and_then(|p| p.get(name))
+                .and_then(Value::as_array)
+                .ok_or_else(|| format!("{url} lists no versions of {name}"))?;
+            let minified = doc.get("minified").and_then(Value::as_str) == Some("composer/2.0");
+            Ok(expand_packagist_versions(versions, minified))
+        }
+        .await;
+        self.packagist.lock().await.insert(key, result.clone());
+        result
+    }
+
+    /// The `packages.lock.json` `contentHash` of `id@version` on nuget.org
+    /// (base64 sha512 of the `.nupkg`): the `packageHash` of the catalog
+    /// entry its registration leaf points at — the hash nuget.org computed
+    /// over the repository-signed package, without downloading it.
+    pub(crate) async fn nuget_content_hash(&self, id: &str, version: &str) -> Result<String, String> {
+        let key = (id.to_ascii_lowercase(), version.to_ascii_lowercase());
+        if let Some(hit) = self.nuget.lock().await.get(&key) {
+            return hit.clone();
+        }
+        let result = async {
+            if self.offline {
+                return Err(OFFLINE.to_string());
+            }
+            let (id_lower, version_lower) = &key;
+            let url = format!(
+                "{}/v3/registration5-gz-semver2/{}/{}.json",
+                nuget_api_base(),
+                crate::utils::uri::encode_uri_component(id_lower),
+                crate::utils::uri::encode_uri_component(version_lower)
+            );
+            let leaf = self.get_json_maybe_gzip(&url).await?;
+            let catalog = leaf
+                .get("catalogEntry")
+                .and_then(Value::as_str)
+                .ok_or_else(|| format!("{url} names no catalog entry"))?;
+            let entry = self.get_json_maybe_gzip(catalog).await?;
+            let same_id = entry
+                .get("id")
+                .and_then(Value::as_str)
+                .is_some_and(|i| i.eq_ignore_ascii_case(id_lower));
+            let same_version = entry
+                .get("version")
+                .and_then(Value::as_str)
+                .is_some_and(|v| {
+                    crate::vendor::nuget_feed::normalize_nuget_version(v)
+                        .eq_ignore_ascii_case(version_lower)
+                });
+            if !same_id || !same_version {
+                return Err(format!("{catalog} is not the catalog entry of {id} {version}"));
+            }
+            let sha512 = entry
+                .get("packageHashAlgorithm")
+                .and_then(Value::as_str)
+                .is_some_and(|a| a.eq_ignore_ascii_case("SHA512"));
+            match entry.get("packageHash").and_then(Value::as_str) {
+                Some(hash) if sha512 && is_base64_digest(hash) => Ok(hash.to_string()),
+                _ => Err(format!("{catalog} records no SHA512 packageHash")),
+            }
+        }
+        .await;
+        self.nuget.lock().await.insert(key, result.clone());
+        result
+    }
+
+    /// A JSON document that nuget.org may serve gzip-encoded whatever the
+    /// request asked for (the `registration5-gz-*` hives).
+    async fn get_json_maybe_gzip(&self, url: &str) -> Result<Value, String> {
+        use std::io::Read as _;
+        let mut bytes = crate::vendor::registry_fetch::download(&self.http, url).await?;
+        if bytes.starts_with(&[0x1f, 0x8b]) {
+            let mut plain = Vec::new();
+            flate2::read::GzDecoder::new(bytes.as_slice())
+                .take(crate::vendor::registry_fetch::MAX_DOWNLOAD_BYTES)
+                .read_to_end(&mut plain)
+                .map_err(|e| format!("{url}: bad gzip body: {e}"))?;
+            bytes = plain;
+        }
+        serde_json::from_slice(&bytes).map_err(|e| format!("{url} is not JSON: {e}"))
+    }
+}
+
+/// nuget.org's API host; `SOCKET_NUGET_URL` names another (tests, mirrors
+/// serving the same `/v3/registration5-gz-semver2/` hive).
+pub(crate) const DEFAULT_NUGET_API: &str = "https://api.nuget.org";
+
+fn nuget_api_base() -> String {
+    std::env::var("SOCKET_NUGET_URL")
+        .ok()
+        .map(|v| v.trim().trim_end_matches('/').to_string())
+        .filter(|v| !v.is_empty())
+        .unwrap_or_else(|| DEFAULT_NUGET_API.to_string())
+}
+
+/// A base64 digest token (the alphabet and padding only: the lock stores
+/// whatever nuget.org recorded, so its length is not second-guessed).
+fn is_base64_digest(s: &str) -> bool {
+    let body = s.trim_end_matches('=');
+    !body.is_empty()
+        && s.len() - body.len() <= 2
+        && body
+            .bytes()
+            .all(|b| b.is_ascii_alphanumeric() || b == b'+' || b == b'/')
+}
+
+/// The release files of a PyPI JSON API version document, sorted by
+/// filename.
+fn pypi_release_files(doc: &Value) -> Result<Vec<PypiFile>, String> {
+    let urls = doc
+        .get("urls")
+        .and_then(Value::as_array)
+        .ok_or("carries no `urls` list")?;
+    let mut files = Vec::with_capacity(urls.len());
+    for file in urls {
+        let str_field = |k: &str| file.get(k).and_then(Value::as_str).map(str::to_string);
+        let filename = str_field("filename")
+            .filter(|f| !f.is_empty() && !f.contains(['/', '\\']))
+            .ok_or("lists a file without a plain filename")?;
+        let url = str_field("url").ok_or_else(|| format!("lists {filename} without a url"))?;
+        let sha256 = file
+            .get("digests")
+            .and_then(|d| d.get("sha256"))
+            .and_then(Value::as_str)
+            .map(str::to_ascii_lowercase)
+            .filter(|h| crate::utils::digest::is_hex64_lower(h))
+            .ok_or_else(|| format!("lists {filename} without a sha256 digest"))?;
+        files.push(PypiFile {
+            filename,
+            url,
+            sha256,
+            size: file.get("size").and_then(Value::as_u64),
+            upload_time: str_field("upload_time_iso_8601"),
+        });
+    }
+    if files.is_empty() {
+        return Err("lists no release files".to_string());
+    }
+    files.sort_by(|a, b| a.filename.cmp(&b.filename));
+    Ok(files)
+}
+
+/// Go's checksum database, `sum.golang.org`; `SOCKET_GOSUMDB_URL` names
+/// another (tests, mirrors).
+pub(crate) const DEFAULT_GOSUMDB: &str = "https://sum.golang.org";
+
+/// The checksum database go would consult for `module`, or `None` when go
+/// would not (`GOSUMDB=off`, or the module matches `GONOSUMDB` /
+/// `GOPRIVATE`) — the hashes are then computed from the module proxy's
+/// bytes instead. An explicit `SOCKET_GOSUMDB_URL` always wins.
+fn gosumdb_base(module: &str) -> Option<String> {
+    if let Ok(v) = std::env::var("SOCKET_GOSUMDB_URL") {
+        let v = v.trim().trim_end_matches('/').to_string();
+        if !v.is_empty() {
+            return Some(v);
+        }
+    }
+    let nonempty = |key: &str| std::env::var(key).ok().filter(|v| !v.trim().is_empty());
+    if nonempty("GOSUMDB").is_some_and(|v| v.trim() == "off") {
+        return None;
+    }
+    if let Some(patterns) = nonempty("GONOSUMDB").or_else(|| nonempty("GOPRIVATE")) {
+        if crate::vendor::registry_fetch::go_match_prefix_patterns(&patterns, module) {
+            return None;
+        }
+    }
+    Some(DEFAULT_GOSUMDB.to_string())
+}
+
+/// x/mod `dirhash.Hash1` over the single file `go.mod` — the `/go.mod h1:`
+/// go.sum line.
+pub(crate) fn go_mod_h1(go_mod: &[u8]) -> String {
+    use base64::Engine as _;
+    use sha2::{Digest, Sha256};
+    let file_sum = hex::encode(Sha256::digest(go_mod));
+    let summary = format!("{file_sum}  go.mod\n");
+    format!(
+        "h1:{}",
+        base64::engine::general_purpose::STANDARD.encode(Sha256::digest(summary.as_bytes()))
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn crates_index_paths_follow_cargo_layout() {
+        assert_eq!(crates_index_path("a"), "1/a");
+        assert_eq!(crates_index_path("ab"), "2/ab");
+        assert_eq!(crates_index_path("abc"), "3/a/abc");
+        assert_eq!(crates_index_path("Serde"), "se/rd/serde");
+    }
+
+    #[test]
+    fn compact_index_checksum_picks_the_ruby_platform_line() {
+        let sha = "a".repeat(64);
+        let other = "b".repeat(64);
+        let info = format!(
+            "---\n1.0.0 |checksum:{other}\n1.1.0 dep:>= 0|checksum:{sha},ruby:>= 2.7\n\
+             1.1.0-java |checksum:{other}\n"
+        );
+        assert_eq!(compact_index_checksum(&info, "1.1.0"), Some(sha));
+        assert_eq!(compact_index_checksum(&info, "2.0.0"), None);
+        assert_eq!(compact_index_checksum("1.0.0 |ruby:>= 2", "1.0.0"), None);
+    }
+
+    #[test]
+    fn packagist_minified_versions_inherit_and_unset() {
+        let versions = serde_json::json!([
+            {"name": "a/b", "version": "2.0.0", "source": {"type": "git"}, "dist": {"url": "x"}},
+            {"version": "1.0.0", "source": "__unset"},
+            {"version": "0.9.0", "dist": {"url": "y"}}
+        ]);
+        let expanded = expand_packagist_versions(versions.as_array().unwrap(), true);
+        assert_eq!(expanded.len(), 3);
+        assert_eq!(expanded[1]["name"], "a/b");
+        assert!(expanded[1].get("source").is_none());
+        assert_eq!(expanded[1]["dist"]["url"], "x");
+        assert!(expanded[2].get("source").is_none());
+        assert_eq!(expanded[2]["dist"]["url"], "y");
+        let raw = expand_packagist_versions(versions.as_array().unwrap(), false);
+        assert!(raw[1].get("name").is_none());
+    }
+
+    #[test]
+    fn pypi_release_files_are_validated_and_sorted() {
+        let doc = serde_json::json!({ "urls": [
+            { "filename": "x-1.tar.gz", "url": "https://f/x-1.tar.gz",
+              "digests": { "sha256": "B".repeat(64) }, "size": 3,
+              "upload_time_iso_8601": "2023-01-01T00:00:00.123456Z" },
+            { "filename": "x-1-py3-none-any.whl", "url": "https://f/x.whl",
+              "digests": { "sha256": "a".repeat(64) } },
+        ]});
+        let files = pypi_release_files(&doc).unwrap();
+        assert_eq!(files[0].filename, "x-1-py3-none-any.whl");
+        assert_eq!(files[1].sha256, "b".repeat(64));
+        assert_eq!(files[1].size, Some(3));
+        assert!(pypi_release_files(&serde_json::json!({ "urls": [] })).is_err());
+        let bad = serde_json::json!({ "urls": [{ "filename": "x.whl", "url": "u",
+            "digests": { "sha256": "zz" } }] });
+        assert!(pypi_release_files(&bad).unwrap_err().contains("sha256"));
+    }
+
+    #[test]
+    fn go_mod_h1_matches_the_x_mod_recipe() {
+        // `module example.com/m\n` — cross-checked with `go mod download
+        // -json` output for a one-line module file.
+        let h1 = go_mod_h1(b"module example.com/m\n");
+        assert!(h1.starts_with("h1:") && h1.ends_with('='), "{h1}");
+    }
+}
diff --git a/crates/socket-patch-core/src/patch/redirect/upstream/composer.rs b/crates/socket-patch-core/src/patch/redirect/upstream/composer.rs
new file mode 100644
index 00000000..52e6b8c4
--- /dev/null
+++ b/crates/socket-patch-core/src/patch/redirect/upstream/composer.rs
@@ -0,0 +1,484 @@
+//! Composer upstream restore: a hosted `composer.lock` entry's `dist` goes
+//! back to what packagist serves for the version (`type`, `url`,
+//! `reference`, `shasum`), and the `source` block the hosted rewriter
+//! deleted (`redirect_composer_dist`) is re-inserted right before it — both
+//! re-derived from packagist's composer v2 metadata (`p2/<name>.json`, or
+//! `p2/<name>~dev.json` for a branch version), the document composer itself
+//! resolved the entry from.
+//!
+//! The rewrite keeps `dist.reference` (the upstream commit), so it is the
+//! cross-check: packagist must still serve that exact reference for the
+//! version, or the lock pinned something packagist no longer describes (a
+//! moved tag, another repository) and the pin is refused.
+//!
+//! Only packagist-sourced entries are restored: the entry must carry
+//! packagist's `notification-url`, or — composer omits it for hand-trimmed
+//! and some older locks — `composer.json` must declare no custom
+//! `repositories`. Anything else may have come from a private repository
+//! whose metadata this restore cannot read, so it is refused.
+//!
+//! The lock is edited as text so every other byte stays composer's: the
+//! blocks are rebuilt in composer's key order at the indent the entry
+//! already uses, with the file's own slash style (`\/` in locks written by
+//! composer versions that escaped slashes) and line endings.
+//! `content-hash` hashes composer.json, not the lock, and is untouched.
+
+use std::collections::BTreeMap;
+
+use serde_json::Value;
+
+use super::super::{find_composer_entry, json_object_end_from, json_string_field, ComposerEntry};
+use super::{Ctx, FormatResult, HostedPin, View};
+use crate::crawlers::composer_crawler::normalize_version;
+
+const COMPOSER_LOCK: &str = "composer.lock";
+const DIST_KEY: &str = "\"dist\": {";
+const SOURCE_KEY: &str = "\"source\": {";
+/// The `notification-url` composer records for packagist packages.
+const PACKAGIST_NOTIFY: &str = "https://packagist.org/downloads/";
+
+/// One hosted entry to restore.
+struct Hit {
+    uuid: String,
+    /// Lowercase `vendor/package` (the purl name; packagist's key).
+    name: String,
+    /// The version as the lock spells it (`v2.0.0`, `dev-main`).
+    locked_version: String,
+    /// The purl version, for re-locating the entry.
+    purl_version: String,
+    /// The lock's surviving `dist.reference`.
+    reference: Option<String>,
+}
+
+/// Whether composer resolves `version` from the `~dev` metadata file
+/// (branch versions: `dev-<branch>` and `<x.y>.x-dev`).
+fn is_dev_version(version: &str) -> bool {
+    let lower = version.to_ascii_lowercase();
+    lower.starts_with("dev-") || lower.ends_with("-dev")
+}
+
+/// The `[start, end]` byte range of the entry's `"dist": {…}` object.
+fn dist_range(content: &str, entry: (usize, usize)) -> Option<(usize, usize)> {
+    let start = entry.0 + content[entry.0..=entry.1].find(DIST_KEY)?;
+    let end = json_object_end_from(content, start + DIST_KEY.len())?;
+    Some((start, end))
+}
+
+/// A JSON string literal in the lock's style: `\/` when the lock escapes
+/// slashes (older composer), plain otherwise (composer 2's
+/// `JSON_UNESCAPED_SLASHES`).
+fn json_str(value: &str, escaped_slashes: bool) -> String {
+    let lit = Value::String(value.to_string()).to_string();
+    if escaped_slashes {
+        lit.replace('/', "\\/")
+    } else {
+        lit
+    }
+}
+
+/// `"<key>": {` + the string fields of `obj` named in `keys` (in that order,
+/// absent ones skipped) at `inner`, closed at `outer` — composer's pretty
+/// print. `None` when `obj` lacks a string `type` or `url`.
+fn render_block(
+    key: &str,
+    obj: &serde_json::Map<String, Value>,
+    keys: &[&str],
+    inner: &str,
+    outer: &str,
+    eol: &str,
+    escaped: bool,
+) -> Option<String> {
+    for required in ["type", "url"] {
+        obj.get(required)?.as_str()?;
+    }
+    let fields: Vec<String> = keys
+        .iter()
+        .filter_map(|k| {
+            let v = obj.get(*k)?.as_str()?;
+            Some(format!("{inner}\"{k}\": {}", json_str(v, escaped)))
+        })
+        .collect();
+    Some(format!(
+        "\"{key}\": {{{eol}{}{eol}{outer}}}",
+        fields.join(&format!(",{eol}"))
+    ))
+}
+
+/// Leading whitespace of the line holding byte `at`.
+fn indent_at(content: &str, at: usize) -> &str {
+    let line_start = content[..at].rfind('\n').map_or(0, |i| i + 1);
+    let line = &content[line_start..];
+    &line[..line.len() - line.trim_start_matches([' ', '\t']).len()]
+}
+
+/// Whether `composer.json` points composer at anything but packagist.
+/// `Err` when it exists but cannot be read as JSON (the refusal reason).
+fn declares_custom_repositories(composer_json: Option<&str>) -> Result<bool, String> {
+    let Some(text) = composer_json else {
+        return Ok(false);
+    };
+    let doc: Value =
+        serde_json::from_str(text).map_err(|e| format!("composer.json is not JSON: {e}"))?;
+    Ok(match doc.get("repositories") {
+        None | Some(Value::Null) => false,
+        Some(Value::Array(a)) => !a.is_empty(),
+        Some(Value::Object(o)) => !o.is_empty(),
+        Some(_) => true,
+    })
+}
+
+/// The packagist version entry that locked `locked` (exact pretty version
+/// first, then composer's leading-`v` normalization).
+fn pick_version<'v>(versions: &'v [Value], locked: &str) -> Result<&'v Value, String> {
+    let version_of = |v: &&Value| v.get("version").and_then(Value::as_str).map(str::to_string);
+    let exact: Vec<&Value> = versions
+        .iter()
+        .filter(|v| version_of(v).as_deref() == Some(locked))
+        .collect();
+    let candidates = if exact.is_empty() {
+        versions
+            .iter()
+            .filter(|v| {
+                version_of(v).is_some_and(|x| normalize_version(&x) == normalize_version(locked))
+            })
+            .collect()
+    } else {
+        exact
+    };
+    match candidates.as_slice() {
+        [one] => Ok(one),
+        [] => Err(format!("packagist does not list version {locked}")),
+        _ => Err(format!("packagist lists version {locked} more than once")),
+    }
+}
+
+pub(crate) async fn restore(
+    view: &mut View<'_>,
+    pins: &[&HostedPin],
+    _files: &[String],
+    ctx: &Ctx<'_>,
+) -> FormatResult {
+    let mut result = FormatResult::default();
+    let content = match view.read(COMPOSER_LOCK).await {
+        Ok(Some(text)) => text,
+        Ok(None) => {
+            for pin in pins {
+                result.refuse(&pin.uuid, "composer.lock no longer exists");
+            }
+            return result;
+        }
+        Err(e) => {
+            for pin in pins {
+                result.refuse(&pin.uuid, e.clone());
+            }
+            return result;
+        }
+    };
+    let composer_json = view.read("composer.json").await.ok().flatten();
+    let custom_repos = declares_custom_repositories(composer_json.as_deref());
+
+    let mut hits: Vec<Hit> = Vec::new();
+    for pin in pins {
+        let Some((name, version)) = pin.name_version() else {
+            result.refuse(&pin.uuid, format!("{} is not a composer purl", pin.purl));
+            continue;
+        };
+        let ComposerEntry::Found(start, end) = find_composer_entry(&content, &name, &version)
+        else {
+            continue;
+        };
+        let entry = &content[start..=end];
+        let Some((d_start, d_end)) = dist_range(&content, (start, end)) else {
+            continue;
+        };
+        let dist = &content[d_start..=d_end];
+        let wired = json_string_field(dist, "url")
+            .and_then(|u| ctx.hosted_uuid(u))
+            .is_some_and(|u| u == pin.uuid);
+        if !wired {
+            continue;
+        }
+        // Packagist gate (module docs).
+        match json_string_field(entry, "notification-url").map(|u| u.replace("\\/", "/")) {
+            Some(u) if u == PACKAGIST_NOTIFY => {}
+            Some(u) => {
+                result.refuse(
+                    &pin.uuid,
+                    format!("{name} was locked from {u}, not packagist, whose metadata this restore cannot read"),
+                );
+                continue;
+            }
+            None => match &custom_repos {
+                Ok(false) => {}
+                Ok(true) => {
+                    result.refuse(
+                        &pin.uuid,
+                        format!(
+                            "composer.json declares custom repositories and the {name} lock \
+                             entry does not record packagist as its origin"
+                        ),
+                    );
+                    continue;
+                }
+                Err(why) => {
+                    result.refuse(&pin.uuid, why.clone());
+                    continue;
+                }
+            },
+        }
+        let Some(locked_version) = json_string_field(entry, "version") else {
+            continue;
+        };
+        hits.push(Hit {
+            uuid: pin.uuid.clone(),
+            name: name.to_ascii_lowercase(),
+            locked_version: locked_version.to_string(),
+            purl_version: version,
+            reference: json_string_field(dist, "reference").map(|r| r.replace("\\/", "/")),
+        });
+    }
+    if hits.is_empty() {
+        return result;
+    }
+
+    let lookups = hits.iter().map(|h| async move {
+        (
+            h.uuid.clone(),
+            ctx.client
+                .packagist_versions(&h.name, is_dev_version(&h.locked_version))
+                .await,
+        )
+    });
+    let metadata: BTreeMap<String, Result<Vec<Value>, String>> =
+        futures_util::future::join_all(lookups)
+            .await
+            .into_iter()
+            .collect();
+
+    let escaped = content.contains("\\/");
+    let eol = if content.contains("\r\n") {
+        "\r\n"
+    } else {
+        "\n"
+    };
+    let mut content = content;
+    let mut changed = false;
+    for hit in &hits {
+        let label = format!("{}@{}", hit.name, hit.locked_version);
+        let versions = match metadata.get(&hit.uuid) {
+            Some(Ok(v)) => v,
+            Some(Err(why)) => {
+                result.refuse(&hit.uuid, format!("{label}: {why}"));
+                continue;
+            }
+            None => continue,
+        };
+        let upstream = match pick_version(versions, &hit.locked_version) {
+            Ok(v) => v,
+            Err(why) => {
+                result.refuse(&hit.uuid, format!("{label}: {why}"));
+                continue;
+            }
+        };
+        let Some(dist) = upstream.get("dist").and_then(Value::as_object) else {
+            result.refuse(
+                &hit.uuid,
+                format!("{label}: packagist serves no dist for it"),
+            );
+            continue;
+        };
+        let upstream_ref = dist.get("reference").and_then(Value::as_str);
+        if upstream_ref != hit.reference.as_deref() {
+            result.refuse(
+                &hit.uuid,
+                format!(
+                    "{label}: the lock pins dist.reference {:?} but packagist now serves {:?}",
+                    hit.reference.as_deref().unwrap_or("<none>"),
+                    upstream_ref.unwrap_or("<none>")
+                ),
+            );
+            continue;
+        }
+        // Offsets moved with every earlier hit's edit: locate again.
+        let ComposerEntry::Found(start, end) =
+            find_composer_entry(&content, &hit.name, &hit.purl_version)
+        else {
+            continue;
+        };
+        let Some((d_start, d_end)) = dist_range(&content, (start, end)) else {
+            continue;
+        };
+        let outer = indent_at(&content, d_start).to_string();
+        let block = &content[d_start..=d_end];
+        let inner = block
+            .split('\n')
+            .nth(1)
+            .map(|l| &l[..l.len() - l.trim_start_matches([' ', '\t']).len()])
+            .filter(|i| !i.is_empty())
+            .map(str::to_string)
+            .unwrap_or_else(|| format!("{outer}    "));
+        let Some(dist_text) = render_block(
+            "dist",
+            dist,
+            &["type", "url", "reference", "shasum"],
+            &inner,
+            &outer,
+            eol,
+            escaped,
+        ) else {
+            result.refuse(
+                &hit.uuid,
+                format!("{label}: packagist's dist has no type or url"),
+            );
+            continue;
+        };
+        // Re-insert the source the rewriter dropped — unless the entry
+        // still carries one (a lock redirected before the drop, or a
+        // source it could not remove).
+        let has_source = content[start..d_start].contains(SOURCE_KEY);
+        let source_text = match upstream.get("source").and_then(Value::as_object) {
+            Some(source) if !has_source => {
+                match render_block(
+                    "source",
+                    source,
+                    &["type", "url", "reference"],
+                    &inner,
+                    &outer,
+                    eol,
+                    escaped,
+                ) {
+                    Some(text) => format!("{text},{eol}{outer}"),
+                    None => {
+                        result.refuse(
+                            &hit.uuid,
+                            format!("{label}: packagist's source has no type or url"),
+                        );
+                        continue;
+                    }
+                }
+            }
+            _ => String::new(),
+        };
+        content.replace_range(d_start..=d_end, &format!("{source_text}{dist_text}"));
+        changed = true;
+        result.handled.insert(hit.uuid.clone());
+    }
+    if changed {
+        view.write(COMPOSER_LOCK, content);
+    }
+    result
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+
+    #[test]
+    fn dev_versions_use_the_dev_metadata_file() {
+        assert!(is_dev_version("dev-main"));
+        assert!(is_dev_version("2.x-dev"));
+        assert!(is_dev_version("2.1.x-DEV"));
+        assert!(!is_dev_version("v2.0.0"));
+        assert!(!is_dev_version("2.0.0-beta1"));
+    }
+
+    #[test]
+    fn blocks_render_in_composer_order_and_slash_style() {
+        let dist = json!({
+            "shasum": "",
+            "url": "https://api.github.com/repos/a/b/zipball/abc",
+            "type": "zip",
+            "reference": "abc",
+            "mirrors": [{"url": "x"}]
+        });
+        let obj = dist.as_object().unwrap();
+        let keys = ["type", "url", "reference", "shasum"];
+        assert_eq!(
+            render_block(
+                "dist",
+                obj,
+                &keys,
+                "                ",
+                "            ",
+                "\n",
+                false
+            )
+            .unwrap(),
+            "\"dist\": {\n                \"type\": \"zip\",\n                \"url\": \
+             \"https://api.github.com/repos/a/b/zipball/abc\",\n                \
+             \"reference\": \"abc\",\n                \"shasum\": \"\"\n            }"
+        );
+        let escaped = render_block("dist", obj, &keys, "  ", "", "\r\n", true).unwrap();
+        assert!(escaped.contains("\"https:\\/\\/api.github.com\\/repos\\/a\\/b\\/zipball\\/abc\""));
+        assert!(escaped.contains(",\r\n  \"reference\""));
+        // No shasum upstream: the key stays absent (fixture no-shasum-key).
+        let bare = json!({"type": "zip", "url": "u", "reference": "r"});
+        assert!(!render_block(
+            "dist",
+            bare.as_object().unwrap(),
+            &keys,
+            " ",
+            "",
+            "\n",
+            false
+        )
+        .unwrap()
+        .contains("shasum"));
+        assert!(render_block(
+            "dist",
+            json!({"url": "u"}).as_object().unwrap(),
+            &keys,
+            "",
+            "",
+            "\n",
+            false
+        )
+        .is_none());
+    }
+
+    #[test]
+    fn custom_repositories_gate() {
+        assert_eq!(declares_custom_repositories(None), Ok(false));
+        assert_eq!(declares_custom_repositories(Some("{}")), Ok(false));
+        assert_eq!(
+            declares_custom_repositories(Some(r#"{"repositories": []}"#)),
+            Ok(false)
+        );
+        assert_eq!(
+            declares_custom_repositories(Some(
+                r#"{"repositories": [{"type": "vcs", "url": "https://git.example/x"}]}"#
+            )),
+            Ok(true)
+        );
+        assert_eq!(
+            declares_custom_repositories(Some(r#"{"repositories": {"packagist.org": false}}"#)),
+            Ok(true)
+        );
+        assert!(declares_custom_repositories(Some("{")).is_err());
+    }
+
+    #[test]
+    fn version_pick_prefers_the_pretty_spelling() {
+        let versions = vec![
+            json!({"version": "2.0.0"}),
+            json!({"version": "v2.0.0"}),
+            json!({"version": "1.0.0"}),
+        ];
+        assert_eq!(
+            pick_version(&versions, "v2.0.0").unwrap()["version"],
+            "v2.0.0"
+        );
+        assert_eq!(
+            pick_version(&versions, "1.0.0").unwrap()["version"],
+            "1.0.0"
+        );
+        assert_eq!(
+            pick_version(&[json!({"version": "v3.0.0"})], "3.0.0").unwrap()["version"],
+            "v3.0.0"
+        );
+        assert!(pick_version(&versions, "9.9.9").is_err());
+        let dup = vec![json!({"version": "2.0.0"}), json!({"version": "2.0.0"})];
+        assert!(pick_version(&dup, "2.0.0").is_err());
+    }
+}
diff --git a/crates/socket-patch-core/src/patch/redirect/upstream/gem.rs b/crates/socket-patch-core/src/patch/redirect/upstream/gem.rs
new file mode 100644
index 00000000..cae1d699
--- /dev/null
+++ b/crates/socket-patch-core/src/patch/redirect/upstream/gem.rs
@@ -0,0 +1,960 @@
+//! RubyGems upstream restore: a hosted gem goes back to the upstream `GEM`
+//! section of `Gemfile.lock` / `gems.locked`, and the `source "<patch
+//! registry>" do … end` block the hosted rewriter (`rewrite_gem`) put into
+//! `Gemfile` / `gems.rb` is undone. Discovery records only the lock; the
+//! manifest is its bundler sibling ([`bundler_manifest_for`]).
+//!
+//! The lock states a hosted gem can be in, and what each restore does:
+//!
+//! * **Converged** (bundler ≥ 2.2 after the rewrite or an unfrozen install;
+//!   the rewriter writes it itself in the `CHECKSUMS` era): the gem's spec
+//!   (+ its dependency sub-lines) sits in a `GEM` section of its own whose
+//!   single remote is the patch registry. The section is deleted and the
+//!   spec moves back, in name order, into the upstream `GEM` section: the
+//!   one remaining non-Socket single-remote section, or — when there are
+//!   several — the one naming the manifest's global `source`, else the
+//!   rubygems.org one; anything else is ambiguous and refused.
+//! * **Merged** (bundler ≤ 2.1 writes every rubygems source into ONE `GEM`
+//!   section): the Socket `remote:` line is dropped from it.
+//! * **Mixed** (bundler < 2.6: the rewriter edits only the manifest and the
+//!   lock still records the upstream source; see `redirect_gem_frozen_install`):
+//!   discovery finds no pin for it (no lock wiring), so it is only unwound
+//!   when a caller hands in a pin for it — the manifest block alone is then
+//!   undone, and the untouched lock says exactly how the gem was declared.
+//!
+//! In every state a `CHECKSUMS` entry is re-pinned to the upstream sha256
+//! from the rubygems.org compact index (`info/<name>`, what bundler itself
+//! records; other upstream remotes are refused: their index may need
+//! credentials and is not the default registry), and the `DEPENDENCIES`
+//! source pin (`name (= v)!`) loses its `!`.
+//!
+//! What the rewrite discards is NOT derivable, so the restore picks the
+//! installable reading and documents it:
+//!
+//! * the original declaration's version constraint (`"~> 7.0"`, or none),
+//!   quote style, parenthesized form and comment: the gem comes back as
+//!   `gem "<name>", "<version>"[, <options>]` — the exact pin the lock
+//!   records as `name (= version)`, so the pair stays frozen-installable
+//!   (the mixed state keeps the lock's own constraint instead);
+//! * the blank lines and indentation the rewriter's `^\s*gem` match
+//!   swallowed before the declaration: see [`declaration_prefix`];
+//! * whether the gem was declared at all. The rewriter APPENDS a block for a
+//!   transitive gem and adds its `DEPENDENCIES` entry, but a direct gem on
+//!   the manifest's last line produces the same bytes. The block and entry
+//!   are removed only when that is provable: an option-less block the
+//!   rewriter could not have written in place (a blank line before it —
+//!   the in-place match swallows every blank line before the declaration)
+//!   that another locked spec depends on. Otherwise the gem is kept as a
+//!   direct pin: a stray exact pin installs the same bytes, while dropping
+//!   a real declaration would stop `Bundler.require` loading the gem.
+//! * a `CHECKSUMS` entry the rewriter ADDED is only recognizable next to
+//!   bundler's own bare entry for the gem (then it is dropped); otherwise it
+//!   is re-pinned in place.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use regex::Regex;
+
+use super::{Ctx, FormatResult, HostedPin, View};
+use crate::utils::line_endings::{to_lf, LineEndings};
+use crate::vendor::gem::{gem_declaration_any, quoted_literal};
+use crate::vendor::gemfile_lock::{
+    bundler_manifest_for, parse_spec, same_remote, split_checksum_entry, BUNDLER_LOCKS,
+};
+
+/// The default upstream `GEM` remote.
+const RUBYGEMS_REMOTE: &str = "https://rubygems.org/";
+
+// ── lock model (LF text, split on `\n`) ─────────────────────────────────────
+
+fn is_header(line: &str) -> bool {
+    !line.is_empty() && !line.starts_with(' ')
+}
+
+/// Exactly `n` spaces of indent, then content.
+fn indented(line: &str, n: usize) -> Option<&str> {
+    let rest = line.get(n..)?;
+    (line[..n].bytes().all(|b| b == b' ') && !rest.starts_with(' ') && !rest.is_empty())
+        .then_some(rest)
+}
+
+/// One 4-space spec entry and its 6-space dependency sub-lines.
+struct Entry {
+    line: usize,
+    /// The last sub-line (== `line` when it has none).
+    last: usize,
+    name: String,
+    version: String,
+    platform: bool,
+}
+
+/// One `GEM` section: `[start, end)` runs from its header to the next
+/// header (its trailing blank separator included).
+struct GemSec {
+    start: usize,
+    end: usize,
+    remotes: Vec<(usize, String)>,
+    specs_line: Option<usize>,
+    entries: Vec<Entry>,
+}
+
+/// `[start, end)` of every section, with its header.
+fn section_ranges<'l>(lines: &[&'l str]) -> Vec<(&'l str, usize, usize)> {
+    let mut out: Vec<(&str, usize, usize)> = Vec::new();
+    for (i, line) in lines.iter().enumerate() {
+        if is_header(line) {
+            if let Some(last) = out.last_mut() {
+                last.2 = i;
+            }
+            out.push((line.trim_end(), i, lines.len()));
+        }
+    }
+    out
+}
+
+fn gem_sections(lines: &[&str]) -> Vec<GemSec> {
+    let mut out = Vec::new();
+    for (header, start, end) in section_ranges(lines) {
+        if header != "GEM" {
+            continue;
+        }
+        let mut sec = GemSec {
+            start,
+            end,
+            remotes: Vec::new(),
+            specs_line: None,
+            entries: Vec::new(),
+        };
+        for (k, line) in lines.iter().enumerate().take(end).skip(start + 1) {
+            if let Some(key) = indented(line, 2) {
+                if let Some(url) = key.strip_prefix("remote:") {
+                    sec.remotes.push((k, url.trim().to_string()));
+                } else if key.trim_end() == "specs:" {
+                    sec.specs_line = Some(k);
+                }
+            } else if let Some(entry) = indented(line, 4).filter(|_| sec.specs_line.is_some()) {
+                let spec = parse_spec(entry.trim_end());
+                sec.entries.push(Entry {
+                    line: k,
+                    last: k,
+                    name: spec.map(|s| s.name).unwrap_or(entry).to_string(),
+                    version: spec.map(|s| s.version).unwrap_or_default().to_string(),
+                    platform: spec.is_none_or(|s| s.platform.is_some()),
+                });
+            } else if line.starts_with("      ") {
+                if let Some(e) = sec.entries.last_mut() {
+                    e.last = k;
+                }
+            }
+        }
+        out.push(sec);
+    }
+    out
+}
+
+/// The line range of the column-0 section `header`, header excluded.
+fn named_section(lines: &[&str], header: &str) -> Option<(usize, usize)> {
+    section_ranges(lines)
+        .into_iter()
+        .find(|(h, _, _)| *h == header)
+        .map(|(_, s, e)| (s + 1, e))
+}
+
+/// The `DEPENDENCIES` entry of `name`: its line and trimmed text.
+fn dependency_line<'l>(lines: &[&'l str], name: &str) -> Option<(usize, &'l str)> {
+    let (s, e) = named_section(lines, "DEPENDENCIES")?;
+    (s..e).find_map(|k| {
+        let entry = indented(lines[k], 2)?.trim_end();
+        let dep = entry.split([' ', '(']).next()?.trim_end_matches('!');
+        (dep == name).then_some((k, entry))
+    })
+}
+
+/// Whether another locked spec depends on `name` (a 6-space sub-line).
+fn is_subdependency(lines: &[&str], name: &str) -> bool {
+    lines
+        .iter()
+        .any(|l| indented(l, 6).is_some_and(|d| d.split([' ', '(']).next() == Some(name)))
+}
+
+/// How the lock wires patch `uuid`.
+enum Wiring {
+    /// A `GEM` section of its own (index into the sections).
+    Own(usize),
+    /// One `remote:` line (the line index) of a multi-remote section.
+    Merged(usize, usize),
+}
+
+fn wiring(secs: &[GemSec], uuid: &str, ctx: &Ctx<'_>) -> Result<Option<Wiring>, String> {
+    let hits: Vec<(usize, usize)> = secs
+        .iter()
+        .enumerate()
+        .flat_map(|(i, s)| {
+            s.remotes
+                .iter()
+                .filter(|(_, r)| ctx.hosted_uuid(r).as_deref() == Some(uuid))
+                .map(move |(k, _)| (i, *k))
+        })
+        .collect();
+    match hits.as_slice() {
+        [] => Ok(None),
+        [(i, k)] if secs[*i].remotes.len() > 1 => Ok(Some(Wiring::Merged(*i, *k))),
+        [(i, _)] => Ok(Some(Wiring::Own(*i))),
+        _ => Err("several GEM remotes name the patch".to_string()),
+    }
+}
+
+/// The upstream section a spec moves back to (module docs).
+fn choose_upstream(
+    secs: &[GemSec],
+    own: usize,
+    globals: &[String],
+    ctx: &Ctx<'_>,
+) -> Result<usize, String> {
+    let candidates: Vec<usize> = (0..secs.len())
+        .filter(|&i| {
+            i != own
+                && secs[i].remotes.len() == 1
+                && ctx.hosted_uuid(&secs[i].remotes[0].1).is_none()
+        })
+        .collect();
+    let remote = |i: &usize| secs[*i].remotes[0].1.as_str();
+    match candidates.as_slice() {
+        [] => Err("the lock has no upstream GEM section to move it back to".to_string()),
+        [one] => Ok(*one),
+        _ => {
+            let single = |keep: &dyn Fn(&usize) -> bool| match candidates
+                .iter()
+                .filter(|i| keep(i))
+                .collect::<Vec<_>>()
+                .as_slice()
+            {
+                [one] => Some(**one),
+                _ => None,
+            };
+            if let Some(one) = single(&|i| globals.iter().any(|g| same_remote(g, remote(i))))
+                .or_else(|| single(&|i| same_remote(remote(i), RUBYGEMS_REMOTE)))
+            {
+                return Ok(one);
+            }
+            Err(format!(
+                "the lock has {} upstream GEM sections and none is singled out by the \
+                 manifest's global source or rubygems.org",
+                candidates.len()
+            ))
+        }
+    }
+}
+
+/// The line after which a spec named `name-version` sorts into `sec`
+/// (bundler writes specs sorted by full name).
+fn insertion_point(sec: &GemSec, full_name: &str) -> Option<usize> {
+    let pred = sec
+        .entries
+        .iter()
+        .rfind(|e| {
+            let full = if e.version.is_empty() {
+                e.name.clone()
+            } else {
+                format!("{}-{}", e.name, e.version)
+            };
+            full.as_str() < full_name
+        });
+    pred.map(|e| e.last).or(sec.specs_line)
+}
+
+/// A lock restore step's outcome.
+enum LockEdit {
+    /// The `CHECKSUMS` entry must be re-pinned from `remote` first.
+    NeedsSha {
+        remote: Option<String>,
+    },
+    Done(String),
+}
+
+/// One pin's coordinates.
+struct Gem<'p> {
+    uuid: &'p str,
+    name: String,
+    version: String,
+}
+
+/// Restore `gem` in the LF lock text (module docs). `transitive`: drop the
+/// `DEPENDENCIES` entry instead of unpinning it.
+fn lock_edit(
+    lock: &str,
+    gem: &Gem<'_>,
+    globals: &[String],
+    transitive: bool,
+    sha: Option<&str>,
+    ctx: &Ctx<'_>,
+) -> Result<LockEdit, String> {
+    let lines: Vec<&str> = lock.split('\n').collect();
+    let secs = gem_sections(&lines);
+    let wiring = wiring(&secs, gem.uuid, ctx)?;
+    let mut drop: BTreeSet<usize> = BTreeSet::new();
+    let mut replace: BTreeMap<usize, String> = BTreeMap::new();
+    let mut insert_after: BTreeMap<usize, Vec<&str>> = BTreeMap::new();
+    let is_ours = |e: &Entry| e.name == gem.name && e.version == gem.version && !e.platform;
+    let checksum_remote = match &wiring {
+        Some(Wiring::Own(si)) => {
+            let sec = &secs[*si];
+            let entry = match sec.entries.as_slice() {
+                [e] if is_ours(e) => e,
+                _ => {
+                    return Err(format!(
+                        "its Socket GEM section does not lock exactly {} ({})",
+                        gem.name, gem.version
+                    ))
+                }
+            };
+            let up = choose_upstream(&secs, *si, globals, ctx)?;
+            let at = insertion_point(&secs[up], &format!("{}-{}", gem.name, gem.version))
+                .ok_or("the upstream GEM section has no `specs:` list")?;
+            drop.extend(sec.start..sec.end);
+            insert_after.insert(at, lines[entry.line..=entry.last].to_vec());
+            Some(secs[up].remotes[0].1.clone())
+        }
+        Some(Wiring::Merged(si, line)) => {
+            let sec = &secs[*si];
+            if !sec.entries.iter().any(is_ours) {
+                return Err(format!(
+                    "its merged GEM section does not lock {} ({})",
+                    gem.name, gem.version
+                ));
+            }
+            drop.insert(*line);
+            let rest: Vec<&String> = sec
+                .remotes
+                .iter()
+                .filter(|(k, _)| k != line)
+                .map(|(_, r)| r)
+                .collect();
+            match rest.as_slice() {
+                [one] => Some((*one).clone()),
+                _ => None,
+            }
+        }
+        None => {
+            let holders: Vec<&GemSec> = secs
+                .iter()
+                .filter(|s| s.entries.iter().any(is_ours))
+                .collect();
+            match holders.as_slice() {
+                [s] if s.remotes.len() == 1 => Some(s.remotes[0].1.clone()),
+                _ => None,
+            }
+        }
+    };
+    if wiring.is_some() {
+        if let Some((k, entry)) = dependency_line(&lines, &gem.name) {
+            if transitive {
+                drop.insert(k);
+            } else if let Some(unpinned) = entry.strip_suffix('!') {
+                replace.insert(k, format!("  {unpinned}"));
+            }
+        }
+    }
+    if let Some((s, e)) = named_section(&lines, "CHECKSUMS") {
+        let mut with_sha = Vec::new();
+        let mut bare = false;
+        for (k, line) in lines.iter().enumerate().take(e).skip(s) {
+            let Some(entry) = indented(line, 2) else {
+                continue;
+            };
+            let Some((name, token, tail)) = split_checksum_entry(entry.trim_end()) else {
+                continue;
+            };
+            if name != gem.name || token != gem.version {
+                continue;
+            }
+            if tail.contains("sha256=") {
+                with_sha.push(k);
+            } else {
+                bare = true;
+            }
+        }
+        match with_sha.as_slice() {
+            [] => {}
+            [k] if bare => {
+                drop.insert(*k);
+            }
+            [k] => {
+                let Some(sha) = sha else {
+                    return Ok(LockEdit::NeedsSha {
+                        remote: checksum_remote,
+                    });
+                };
+                let re = Regex::new(r"sha256=[0-9A-Fa-f]*").expect("static sha256 regex is valid");
+                replace.insert(
+                    *k,
+                    re.replace(lines[*k], format!("sha256={sha}")).into_owned(),
+                );
+            }
+            _ => return Err("CHECKSUMS pins it more than once".to_string()),
+        }
+    }
+    let mut out: Vec<String> = Vec::with_capacity(lines.len());
+    for (k, line) in lines.iter().enumerate() {
+        if !drop.contains(&k) {
+            out.push(replace.get(&k).cloned().unwrap_or_else(|| line.to_string()));
+        }
+        if let Some(block) = insert_after.get(&k) {
+            out.extend(block.iter().map(|l| l.to_string()));
+        }
+    }
+    Ok(LockEdit::Done(out.join("\n")))
+}
+
+// ── manifest (Gemfile / gems.rb) ────────────────────────────────────────────
+
+/// The rewriter's `source "<index>" do\n  gem "n", "v"[, opts]\nend` block.
+struct Block {
+    start: usize,
+    /// Past the `end` line's line break.
+    end: usize,
+    opts: Option<String>,
+    /// Whether a line break followed `end` (the declaration's own).
+    eol: bool,
+}
+
+fn find_block(
+    text: &str,
+    gem: &Gem<'_>,
+    rel: &str,
+    ctx: &Ctx<'_>,
+) -> Result<Option<Block>, String> {
+    let re = Regex::new(&format!(
+        r#"(?m)^source "([^"\r\n]*)" do\r?\n  gem "{}", "{}"(?:, ([^\r\n]*))?\r?\nend(\r?\n|\z)"#,
+        regex::escape(&gem.name),
+        regex::escape(&gem.version)
+    ))
+    .expect("source-block regex from escaped coordinates is valid");
+    let hits: Vec<Block> = re
+        .captures_iter(text)
+        .filter(|c| ctx.hosted_uuid(&c[1]).as_deref() == Some(gem.uuid))
+        .map(|c| {
+            let m = c.get(0).expect("group 0 is the whole match");
+            Block {
+                start: m.start(),
+                end: m.end(),
+                opts: c.get(2).map(|o| o.as_str().to_string()),
+                eol: !c[3].is_empty(),
+            }
+        })
+        .collect();
+    let rest_mentions = |b: Option<&Block>| {
+        let rest = match b {
+            Some(b) => format!("{}{}", &text[..b.start], &text[b.end..]),
+            None => text.to_string(),
+        };
+        rest.contains(gem.uuid)
+    };
+    match hits.as_slice() {
+        [] if rest_mentions(None) => Err(format!(
+            "{rel} wires it in a shape other than the source block socket-patch writes"
+        )),
+        [] => Ok(None),
+        [_] if rest_mentions(hits.first()) => Err(format!(
+            "{rel} names the patch outside the source block socket-patch writes"
+        )),
+        [_] => Ok(hits.into_iter().next()),
+        _ => Err(format!("{rel} declares it in several Socket source blocks")),
+    }
+}
+
+/// The line before byte `at` (without its line break); `None` at the start.
+fn line_before(text: &str, at: usize) -> Option<&str> {
+    let before = text[..at].strip_suffix('\n')?;
+    let before = before.strip_suffix('\r').unwrap_or(before);
+    Some(&before[before.rfind('\n').map_or(0, |i| i + 1)..])
+}
+
+fn indent_of(line: &str) -> &str {
+    &line[..line.len() - line.trim_start().len()]
+}
+
+/// Whether the rewriter can only have APPENDED `block` (a transitive gem):
+/// its in-place rewrite swallows every blank line before the declaration,
+/// so a blank line right before the block rules it out.
+fn provably_appended(text: &str, block: &Block) -> bool {
+    line_before(text, block.start).is_some_and(|l| l.trim().is_empty())
+}
+
+/// The blank line + indent to put before a declaration restored in place of
+/// `block`. The rewriter's `^\s*gem` match swallowed whatever whitespace
+/// preceded the original line, which no file records, so this re-derives the
+/// conventional layout from the neighbors: inside a block (`group … do`)
+/// or right after another declaration or a comment, the neighbor's indent
+/// and no blank line; after anything else (`source`, `ruby`, `end`, …) one
+/// blank line and the indent of the declaration that follows, if any.
+fn declaration_prefix(text: &str, block: &Block, eol: &str) -> String {
+    let Some(prev) = line_before(text, block.start) else {
+        return String::new();
+    };
+    let trimmed = prev.trim();
+    if trimmed.is_empty() {
+        return String::new();
+    }
+    let code = trimmed.split('#').next().unwrap_or_default().trim_end();
+    if code == "do" || code.ends_with(" do") || (code.ends_with('|') && code.contains(" do |")) {
+        return format!("{}  ", indent_of(prev));
+    }
+    if trimmed.starts_with('#') || gem_declaration_any(trimmed).is_some() {
+        return indent_of(prev).to_string();
+    }
+    let next = text[block.end..].split('\n').next().unwrap_or_default();
+    let indent = if gem_declaration_any(next.trim()).is_some() {
+        indent_of(next)
+    } else {
+        ""
+    };
+    format!("{eol}{indent}")
+}
+
+/// How the gem comes back into the manifest.
+enum Decl {
+    /// Gone: the block was the rewriter's append for a transitive gem.
+    Transitive,
+    /// `gem "<name>"<args>[, <opts>]`; `args` is the version constraint list
+    /// (`, "7.0.0"`).
+    Direct(String),
+}
+
+fn restore_manifest(text: &str, block: &Block, gem: &Gem<'_>, decl: &Decl) -> String {
+    let eol = if text.contains("\r\n") { "\r\n" } else { "\n" };
+    let replacement = match decl {
+        Decl::Transitive => String::new(),
+        Decl::Direct(args) => {
+            let opts = block
+                .opts
+                .as_deref()
+                .map(|o| format!(", {o}"))
+                .unwrap_or_default();
+            format!(
+                "{}gem \"{}\"{args}{opts}{}",
+                if provably_appended(text, block) {
+                    String::new()
+                } else {
+                    declaration_prefix(text, block, eol)
+                },
+                gem.name,
+                if block.eol { eol } else { "" }
+            )
+        }
+    };
+    format!(
+        "{}{replacement}{}",
+        &text[..block.start],
+        &text[block.end..]
+    )
+}
+
+/// The manifest's global `source "<url>"` declarations (no block).
+fn global_sources(manifest: &str) -> Vec<String> {
+    manifest
+        .lines()
+        .filter_map(|l| {
+            let rest = l.trim().strip_prefix("source")?.trim_start();
+            let (rest, paren) = match rest.strip_prefix('(') {
+                Some(r) => (r.trim_start(), true),
+                None => (rest, false),
+            };
+            let (_, url, tail) = quoted_literal(rest)?;
+            let tail = tail.trim_start();
+            let tail = if paren { tail.strip_prefix(')')? } else { tail };
+            let code = tail.split('#').next().unwrap_or_default().trim();
+            code.is_empty().then(|| url.to_string())
+        })
+        .collect()
+}
+
+/// The version-constraint args of a `DEPENDENCIES` entry (`rails (~> 7.0,
+/// >= 7.0.1)` → `, "~> 7.0", ">= 7.0.1"`).
+fn constraint_args(entry: &str) -> String {
+    let entry = entry.trim_end_matches('!');
+    let Some((_, rest)) = entry.split_once(" (") else {
+        return String::new();
+    };
+    rest.trim_end_matches(')')
+        .split(", ")
+        .filter(|c| !c.is_empty())
+        .map(|c| format!(", \"{c}\""))
+        .collect()
+}
+
+pub(crate) async fn restore(
+    view: &mut View<'_>,
+    pins: &[&HostedPin],
+    files: &[String],
+    ctx: &Ctx<'_>,
+) -> FormatResult {
+    let mut result = FormatResult::default();
+    for lock_rel in BUNDLER_LOCKS {
+        let manifest_rel = bundler_manifest_for(lock_rel);
+        if !files.iter().any(|f| f == lock_rel || f == manifest_rel) {
+            continue;
+        }
+        let (lock_raw, manifest_raw) =
+            match (view.read(lock_rel).await, view.read(manifest_rel).await) {
+                (Ok(l), Ok(m)) => (l, m),
+                (Err(e), _) | (_, Err(e)) => {
+                    for pin in pins {
+                        result.refuse(&pin.uuid, e.clone());
+                    }
+                    continue;
+                }
+            };
+        let endings = lock_raw.as_deref().map(LineEndings::of);
+        let mut lock: Option<String> = lock_raw.as_deref().map(|t| to_lf(t).into_owned());
+        let mut manifest = manifest_raw.clone();
+        let globals = manifest.as_deref().map(global_sources).unwrap_or_default();
+        for pin in pins {
+            if result.refused.contains_key(&pin.uuid) {
+                continue;
+            }
+            let Some((name, version)) = pin.name_version() else {
+                result.refuse(&pin.uuid, format!("{} is not a gem purl", pin.purl));
+                continue;
+            };
+            let gem = Gem {
+                uuid: &pin.uuid,
+                name,
+                version,
+            };
+            match restore_one(
+                &gem,
+                lock.as_deref(),
+                manifest.as_deref(),
+                manifest_rel,
+                &globals,
+                ctx,
+            )
+            .await
+            {
+                Ok(None) => {}
+                Ok(Some((next_lock, next_manifest))) => {
+                    if endings == Some(LineEndings::Mixed) && next_lock != lock {
+                        result.refuse(
+                            &pin.uuid,
+                            format!("{lock_rel} mixes CRLF and LF line endings"),
+                        );
+                        continue;
+                    }
+                    lock = next_lock;
+                    manifest = next_manifest;
+                    result.handled.insert(pin.uuid.clone());
+                }
+                Err(why) => result.refuse(&pin.uuid, why),
+            }
+        }
+        if let (Some(next), Some(endings)) = (lock, endings) {
+            let next = endings.restore(&next).into_owned();
+            if lock_raw.as_deref() != Some(next.as_str()) {
+                view.write(lock_rel, next);
+            }
+        }
+        if manifest != manifest_raw {
+            if let Some(next) = manifest {
+                view.write(manifest_rel, next);
+            }
+        }
+    }
+    result
+}
+
+/// Restore one gem in a lock + manifest pair: `Ok(None)` when neither wires
+/// it, else the next `(lock, manifest)` texts.
+async fn restore_one(
+    gem: &Gem<'_>,
+    lock: Option<&str>,
+    manifest: Option<&str>,
+    manifest_rel: &str,
+    globals: &[String],
+    ctx: &Ctx<'_>,
+) -> Result<Option<(Option<String>, Option<String>)>, String> {
+    let block = match manifest {
+        Some(text) => find_block(text, gem, manifest_rel, ctx)?,
+        None => None,
+    };
+    let lines: Vec<&str> = lock.map(|l| l.split('\n').collect()).unwrap_or_default();
+    let wired = match lock {
+        Some(_) => wiring(&gem_sections(&lines), gem.uuid, ctx)?.is_some(),
+        None => false,
+    };
+    if !wired && block.is_none() {
+        return Ok(None);
+    }
+    let decl = if wired {
+        let transitive = block.as_ref().is_some_and(|b| {
+            b.opts.is_none()
+                && manifest.is_some_and(|m| provably_appended(m, b))
+                && is_subdependency(&lines, &gem.name)
+        });
+        if transitive {
+            Decl::Transitive
+        } else {
+            Decl::Direct(format!(", \"{}\"", gem.version))
+        }
+    } else if lock.is_some() {
+        // Mixed state: the lock was never touched, so its DEPENDENCIES say
+        // how (and whether) the manifest declared the gem.
+        match dependency_line(&lines, &gem.name) {
+            Some((_, entry)) => Decl::Direct(constraint_args(entry)),
+            None => Decl::Transitive,
+        }
+    } else {
+        Decl::Direct(format!(", \"{}\"", gem.version))
+    };
+    let transitive = matches!(decl, Decl::Transitive);
+    let next_lock = match lock {
+        None => None,
+        Some(text) => Some(
+            match lock_edit(text, gem, globals, transitive, None, ctx)? {
+                LockEdit::Done(next) => next,
+                LockEdit::NeedsSha { remote } => {
+                    let remote = remote.ok_or("its upstream GEM remote is ambiguous")?;
+                    if !same_remote(&remote, RUBYGEMS_REMOTE) {
+                        return Err(format!(
+                        "its upstream GEM remote {remote} is not rubygems.org, so its CHECKSUMS \
+                         sha256 cannot be re-derived"
+                    ));
+                    }
+                    let sha = ctx
+                        .client
+                        .rubygems_sha256(&gem.name, &gem.version)
+                        .await
+                        .map_err(|why| format!("{} {}: {why}", gem.name, gem.version))?;
+                    match lock_edit(text, gem, globals, transitive, Some(&sha), ctx)? {
+                        LockEdit::Done(next) => next,
+                        LockEdit::NeedsSha { .. } => unreachable!("a sha was supplied"),
+                    }
+                }
+            },
+        ),
+    };
+    let next_manifest = match (manifest, &block) {
+        (Some(text), Some(b)) => Some(restore_manifest(text, b, gem, &decl)),
+        _ => manifest.map(str::to_string),
+    };
+    Ok(Some((next_lock, next_manifest)))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const UUID: &str = "77777777-7777-7777-7777-777777777777";
+    const IDX: &str = "https://patch.socket.dev/patch-registry/gem/11111111-1111-1111-1111-111111111111/77777777-7777-7777-7777-777777777777/";
+
+    fn ctx_with<'a>(client: &'a super::super::UpstreamClient) -> Ctx<'a> {
+        Ctx {
+            client,
+            origins: &[],
+            bun_lockb: false,
+        }
+    }
+
+    fn gem() -> Gem<'static> {
+        Gem {
+            uuid: UUID,
+            name: "rails".into(),
+            version: "7.0.0".into(),
+        }
+    }
+
+    fn done(e: LockEdit) -> String {
+        match e {
+            LockEdit::Done(t) => t,
+            LockEdit::NeedsSha { .. } => panic!("unexpected sha request"),
+        }
+    }
+
+    #[test]
+    fn converged_section_moves_back_in_name_order() {
+        let client = super::super::UpstreamClient::new(true);
+        let ctx = ctx_with(&client);
+        let hosted = format!(
+            "GEM\n  remote: {IDX}\n  specs:\n    rails (7.0.0)\n      rack (>= 2)\n\nGEM\n  \
+             remote: https://rubygems.org/\n  specs:\n    puma (6.0.0)\n    rack (3.0.0)\n    \
+             zeitwerk (2.6.0)\n\nPLATFORMS\n  ruby\n\nDEPENDENCIES\n  puma\n  rails (= 7.0.0)!\n\n\
+             BUNDLED WITH\n   2.4.0\n"
+        );
+        let want = "GEM\n  remote: https://rubygems.org/\n  specs:\n    puma (6.0.0)\n    rack \
+                    (3.0.0)\n    rails (7.0.0)\n      rack (>= 2)\n    zeitwerk (2.6.0)\n\nPLATFORMS\n  \
+                    ruby\n\nDEPENDENCIES\n  puma\n  rails (= 7.0.0)\n\nBUNDLED WITH\n   2.4.0\n";
+        // No CHECKSUMS (bundler 2.2–2.5): no registry lookup, offline works.
+        assert_eq!(
+            done(lock_edit(&hosted, &gem(), &[], false, None, &ctx).unwrap()),
+            want
+        );
+        // Transitive: the DEPENDENCIES entry the rewriter added goes.
+        let out = done(lock_edit(&hosted, &gem(), &[], true, None, &ctx).unwrap());
+        assert!(out.contains("DEPENDENCIES\n  puma\n\n"), "{out}");
+    }
+
+    #[test]
+    fn checksums_need_the_upstream_sha() {
+        let client = super::super::UpstreamClient::new(true);
+        let ctx = ctx_with(&client);
+        let hosted = format!(
+            "GEM\n  remote: https://rubygems.org/\n  specs:\n\nGEM\n  remote: {IDX}\n  specs:\n    \
+             rails (7.0.0)\n\nDEPENDENCIES\n  rails (= 7.0.0)!\n\nCHECKSUMS\n  rails (7.0.0) \
+             sha256={}\n",
+            "d".repeat(64)
+        );
+        match lock_edit(&hosted, &gem(), &[], false, None, &ctx).unwrap() {
+            LockEdit::NeedsSha { remote } => {
+                assert_eq!(remote.as_deref(), Some("https://rubygems.org/"))
+            }
+            LockEdit::Done(_) => panic!("CHECKSUMS entry left patched"),
+        }
+        let sha = "2".repeat(64);
+        assert_eq!(
+            done(lock_edit(&hosted, &gem(), &[], false, Some(&sha), &ctx).unwrap()),
+            format!(
+                "GEM\n  remote: https://rubygems.org/\n  specs:\n    rails (7.0.0)\n\nDEPENDENCIES\n  \
+                 rails (= 7.0.0)\n\nCHECKSUMS\n  rails (7.0.0) sha256={sha}\n"
+            )
+        );
+        // The rewriter's ADDED entry next to bundler's bare one is dropped.
+        let added = hosted.replace("CHECKSUMS\n", "CHECKSUMS\n  rails (7.0.0)\n");
+        assert!(
+            done(lock_edit(&added, &gem(), &[], false, None, &ctx).unwrap())
+                .ends_with("CHECKSUMS\n  rails (7.0.0)\n")
+        );
+    }
+
+    #[test]
+    fn merged_section_drops_only_the_socket_remote() {
+        let client = super::super::UpstreamClient::new(true);
+        let ctx = ctx_with(&client);
+        let hosted = format!(
+            "GEM\n  remote: https://rubygems.org/\n  remote: {IDX}\n  specs:\n    puma (6.0.0)\n    \
+             rails (7.0.0)\n\nDEPENDENCIES\n  puma\n  rails (= 7.0.0)!\n\nBUNDLED WITH\n   2.1.4\n"
+        );
+        assert_eq!(
+            done(lock_edit(&hosted, &gem(), &[], false, None, &ctx).unwrap()),
+            "GEM\n  remote: https://rubygems.org/\n  specs:\n    puma (6.0.0)\n    rails (7.0.0)\n\n\
+             DEPENDENCIES\n  puma\n  rails (= 7.0.0)\n\nBUNDLED WITH\n   2.1.4\n"
+        );
+    }
+
+    #[test]
+    fn ambiguous_or_foreign_sections_are_refused() {
+        let client = super::super::UpstreamClient::new(true);
+        let ctx = ctx_with(&client);
+        let two_upstreams = format!(
+            "GEM\n  remote: https://gems.example/\n  specs:\n\nGEM\n  remote: https://mirror.example/\n  \
+             specs:\n\nGEM\n  remote: {IDX}\n  specs:\n    rails (7.0.0)\n\nDEPENDENCIES\n  rails (= 7.0.0)!\n"
+        );
+        assert!(lock_edit(&two_upstreams, &gem(), &[], false, None, &ctx).is_err());
+        // The manifest's global source singles one out.
+        let globals = vec!["https://mirror.example".to_string()];
+        let out = done(lock_edit(&two_upstreams, &gem(), &globals, false, None, &ctx).unwrap());
+        assert!(
+            out.contains("remote: https://mirror.example/\n  specs:\n    rails (7.0.0)\n"),
+            "{out}"
+        );
+        // A Socket section locking another gem too is not ours to split.
+        let extra = format!(
+            "GEM\n  remote: https://rubygems.org/\n  specs:\n\nGEM\n  remote: {IDX}\n  specs:\n    \
+             rack (3.0.0)\n    rails (7.0.0)\n\nDEPENDENCIES\n  rails (= 7.0.0)!\n"
+        );
+        assert!(lock_edit(&extra, &gem(), &[], false, None, &ctx).is_err());
+        let none = format!(
+            "GEM\n  remote: {IDX}\n  specs:\n    rails (7.0.0)\n\nDEPENDENCIES\n  rails!\n"
+        );
+        assert!(lock_edit(&none, &gem(), &[], false, None, &ctx).is_err());
+    }
+
+    #[test]
+    fn manifest_blocks_restore_in_place() {
+        let client = super::super::UpstreamClient::new(true);
+        let ctx = ctx_with(&client);
+        let block = format!("source \"{IDX}\" do\n  gem \"rails\", \"7.0.0\"\nend");
+        let direct = Decl::Direct(", \"7.0.0\"".into());
+        let run = |text: &str, decl: &Decl| {
+            let b = find_block(text, &gem(), "Gemfile", &ctx).unwrap().unwrap();
+            restore_manifest(text, &b, &gem(), decl)
+        };
+        // After a global source: one blank line comes back.
+        let t = format!("source \"https://rubygems.org\"\n{block}\ngem \"puma\"\n");
+        assert_eq!(
+            run(&t, &direct),
+            "source \"https://rubygems.org\"\n\ngem \"rails\", \"7.0.0\"\ngem \"puma\"\n"
+        );
+        // Inside a group: the group's indent + 2, options kept.
+        let t = format!(
+            "group :test do\nsource \"{IDX}\" do\n  gem \"rails\", \"7.0.0\", require: false\nend\nend\n"
+        );
+        assert_eq!(
+            run(&t, &direct),
+            "group :test do\n  gem \"rails\", \"7.0.0\", require: false\nend\n"
+        );
+        // CRLF manifest (the rewriter wrote its block in LF).
+        let t = format!("source \"https://rubygems.org\"\r\ngem \"puma\"\r\n{block}\n");
+        assert_eq!(
+            run(&t, &direct),
+            "source \"https://rubygems.org\"\r\ngem \"puma\"\r\ngem \"rails\", \"7.0.0\"\r\n"
+        );
+        // Transitive append removed; mixed-state constraint kept.
+        let t = format!("source \"https://rubygems.org\"\n\ngem \"puma\"\n\n{block}\n");
+        assert_eq!(
+            run(&t, &Decl::Transitive),
+            "source \"https://rubygems.org\"\n\ngem \"puma\"\n\n"
+        );
+        let t = format!("gem \"puma\"\n{block}\n");
+        assert_eq!(
+            run(&t, &Decl::Direct(constraint_args("rails (>= 6, ~> 7.0)"))),
+            "gem \"puma\"\ngem \"rails\", \">= 6\", \"~> 7.0\"\n"
+        );
+    }
+
+    #[test]
+    fn manifest_shapes_it_cannot_unwind_are_refused() {
+        let client = super::super::UpstreamClient::new(true);
+        let ctx = ctx_with(&client);
+        let block = format!("source \"{IDX}\" do\n  gem \"rails\", \"7.0.0\"\nend\n");
+        assert!(find_block(&format!("{block}{block}"), &gem(), "Gemfile", &ctx).is_err());
+        let edited = format!("source \"{IDX}\" do\n  gem \"rails\", \"~> 7.0\"\nend\n");
+        assert!(find_block(&edited, &gem(), "Gemfile", &ctx).is_err());
+        assert!(find_block("gem \"rails\"\n", &gem(), "Gemfile", &ctx)
+            .unwrap()
+            .is_none());
+    }
+
+    #[test]
+    fn provably_transitive_needs_a_blank_line_before_the_block() {
+        let client = super::super::UpstreamClient::new(true);
+        let ctx = ctx_with(&client);
+        let block = format!("source \"{IDX}\" do\n  gem \"rails\", \"7.0.0\"\nend\n");
+        let appended = format!("gem \"puma\"\n\n{block}");
+        let b = find_block(&appended, &gem(), "Gemfile", &ctx)
+            .unwrap()
+            .unwrap();
+        assert!(provably_appended(&appended, &b));
+        let ambiguous = format!("gem \"puma\"\n{block}");
+        let b = find_block(&ambiguous, &gem(), "Gemfile", &ctx)
+            .unwrap()
+            .unwrap();
+        assert!(!provably_appended(&ambiguous, &b));
+        assert!(is_subdependency(
+            &["    x (1.0)", "      rails (>= 7)"],
+            "rails"
+        ));
+        assert!(!is_subdependency(&["    rails (7.0.0)"], "rails"));
+    }
+
+    #[test]
+    fn global_sources_skip_blocks() {
+        let m = format!("source 'https://rubygems.org'\nsource(\"https://b.example\")\nsource \"{IDX}\" do\nend\n");
+        assert_eq!(
+            global_sources(&m),
+            vec![
+                "https://rubygems.org".to_string(),
+                "https://b.example".to_string()
+            ]
+        );
+    }
+}
diff --git a/crates/socket-patch-core/src/patch/redirect/upstream/golang.rs b/crates/socket-patch-core/src/patch/redirect/upstream/golang.rs
new file mode 100644
index 00000000..4ce16051
--- /dev/null
+++ b/crates/socket-patch-core/src/patch/redirect/upstream/golang.rs
@@ -0,0 +1,113 @@
+//! Go upstream restore: drop the hosted `replace M v => patch.socket.dev/
+//! gopatch/<uuid> …` directive and the socket module's go.sum lines, and put
+//! the upstream module's two go.sum lines back (re-derived from the module
+//! proxy exactly as `go` hashes them) — the pair the hosted rewriter pruned.
+//!
+//! A directive the hosted run took over from the user (a pre-existing
+//! `replace` it superseded) is not recorded anywhere, so the restore always
+//! lands on the plain upstream module; the refusal message of a formats the
+//! restore cannot handle names the checkout remedy instead.
+
+use super::{Ctx, FormatResult, HostedPin, View};
+use crate::vendor::go_mod_edit::{
+    hosted_module_uuid, parse_replace_entries, remove_replace_entry, ReplaceOwner,
+};
+use crate::vendor::go_sum_edit::{reinsert_lines, remove_module_prefix_lines};
+
+pub(crate) async fn restore(
+    view: &mut View<'_>,
+    pins: &[&HostedPin],
+    _files: &[String],
+    ctx: &Ctx<'_>,
+) -> FormatResult {
+    let mut result = FormatResult::default();
+    let go_mod = match view.read("go.mod").await {
+        Ok(Some(text)) => text,
+        Ok(None) => {
+            for pin in pins {
+                result.refuse(&pin.uuid, "go.mod no longer exists");
+            }
+            return result;
+        }
+        Err(e) => {
+            for pin in pins {
+                result.refuse(&pin.uuid, e.clone());
+            }
+            return result;
+        }
+    };
+    let entries = parse_replace_entries(&go_mod);
+    // (uuid, module, version, socket module path) per hosted directive.
+    let mut hits: Vec<(String, String, String, String)> = Vec::new();
+    for pin in pins {
+        let Some((module, version)) = pin.name_version() else {
+            result.refuse(&pin.uuid, format!("{} is not a golang purl", pin.purl));
+            continue;
+        };
+        let directive = entries.iter().find(|e| {
+            e.module == module
+                && e.rhs_module
+                    .as_deref()
+                    .and_then(hosted_module_uuid)
+                    .is_some_and(|u| u == pin.uuid)
+        });
+        let Some(directive) = directive else {
+            continue;
+        };
+        let version = directive.version.clone().unwrap_or(version);
+        let socket_module = directive.rhs_module.clone().unwrap_or_default();
+        hits.push((pin.uuid.clone(), module, version, socket_module));
+    }
+    if hits.is_empty() {
+        return result;
+    }
+    let lookups = hits.iter().map(|(uuid, module, version, _)| async move {
+        (uuid.clone(), ctx.client.go_sums(module, version).await)
+    });
+    let sums: std::collections::BTreeMap<String, Result<super::client::GoSums, String>> =
+        futures_util::future::join_all(lookups).await.into_iter().collect();
+
+    let mut go_mod_next = go_mod.clone();
+    let mut go_sum = view.read("go.sum").await.ok().flatten();
+    let go_sum_original = go_sum.clone();
+    for (uuid, module, version, socket_module) in &hits {
+        let sums = match sums.get(uuid) {
+            Some(Ok(s)) => s,
+            Some(Err(why)) => {
+                result.refuse(uuid, format!("{module}@{version}: {why}"));
+                continue;
+            }
+            None => continue,
+        };
+        match remove_replace_entry(&go_mod_next, module, ReplaceOwner::Hosted) {
+            Ok(Some(next)) => go_mod_next = next,
+            Ok(None) => {}
+            Err(e) => {
+                result.refuse(uuid, format!("go.mod: {e}"));
+                continue;
+            }
+        }
+        if let Some(text) = go_sum.as_deref() {
+            let mut next = remove_module_prefix_lines(text, socket_module)
+                .unwrap_or_else(|| text.to_string());
+            let upstream = format!(
+                "{module} {version} {}\n{module} {version}/go.mod {}\n",
+                sums.zip_h1, sums.mod_h1
+            );
+            if let Some(reinserted) = reinsert_lines(&next, &upstream) {
+                next = reinserted;
+            }
+            go_sum = Some(next);
+        }
+        result.handled.insert(uuid.clone());
+    }
+    if go_mod_next != go_mod {
+        view.write("go.mod", go_mod_next);
+    }
+    if go_sum != go_sum_original {
+        if let Some(text) = go_sum {
+            view.write("go.sum", text);
+        }
+    }
+    result
+}
diff --git a/crates/socket-patch-core/src/patch/redirect/upstream/maven.rs b/crates/socket-patch-core/src/patch/redirect/upstream/maven.rs
new file mode 100644
index 00000000..35166b00
--- /dev/null
+++ b/crates/socket-patch-core/src/patch/redirect/upstream/maven.rs
@@ -0,0 +1,596 @@
+//! Maven upstream restore: the inverse of `rewrite_maven_pom`, no network.
+//!
+//! The hosted rewrite pins `<version><base>-socket.<hex8></version>` (the
+//! literal, or an added `<dependencyManagement>` entry for a GA with no
+//! literal version), inserts a `<repository>` with id
+//! `socket-patch-<uuid>`, and — when both hashes were known — appends the
+//! trusted-checksums resolver lines to `.mvn/maven.config` and the
+//! suffixed jar/pom lines to `.mvn/checksums/checksums.sha256`.
+//!
+//! Everything but the `.mvn` provenance is derivable from the pom itself:
+//! the base version is the suffix's prefix, and the added blocks have the
+//! writer's exact shape. An added `<dependencyManagement>` entry is told
+//! from a rewritten one of the user's by that shape and position (right
+//! after the section's `<dependencies>`, only authored entries before it),
+//! by being the GA's only literal version, and — when the pom declares the
+//! GA directly without a version and has no `<parent>` or BOM import to
+//! manage it — never (the entry is then what supplies the version, so it
+//! was the user's). The `.mvn` files are removed only when they hold
+//! nothing but what hosted mode writes; otherwise the resolver lines stay
+//! and a warning says so (whether they pre-existed is not recorded).
+//! Checksum lines keep the file's remaining order (the rewriter re-sorted
+//! and dropped malformed lines; that is not recoverable).
+
+use regex::Regex;
+
+use super::npm::{by_uuid, read_or_refuse, refuse_all_in};
+use super::{Ctx, FormatResult, HostedPin, View};
+use crate::patch::redirect::{
+    maven_tag_inner_range, maven_tag_text_in, MAVEN_DEPENDENCY_BLOCK_RE, MVN_CHECKSUMS, MVN_CONFIG,
+    MVN_CONFIG_ARGS,
+};
+
+/// The line break and indent `insert_maven_dependency_management` writes
+/// before its entry.
+const DM_ENTRY_LEAD: &str = "\n      ";
+
+/// The `<dependencyManagement>` entry `insert_maven_dependency_management`
+/// writes, from its `<dependency>` tag on.
+fn authored_dm_block(group: &str, artifact: &str, version: &str) -> String {
+    format!(
+        "<dependency>\n        <groupId>{group}</groupId>\n        <artifactId>{artifact}</artifactId>\n        <version>{version}</version>\n      </dependency>"
+    )
+}
+
+/// The wrappers the rewriter authors from scratch before `</project>`, as
+/// they read once every entry is gone.
+const EMPTY_REPOSITORIES: &str = "  <repositories>\n  </repositories>\n</project>";
+const EMPTY_DEP_MANAGEMENT: &str =
+    "  <dependencyManagement>\n    <dependencies>\n    </dependencies>\n  </dependencyManagement>\n</project>";
+
+/// One `<dependency>` block of a GA.
+struct DepMatch {
+    start: usize,
+    end: usize,
+    version: Option<(usize, usize)>,
+    version_text: Option<String>,
+}
+
+fn dep_matches(pom: &str, group: &str, artifact: &str) -> Vec<DepMatch> {
+    MAVEN_DEPENDENCY_BLOCK_RE
+        .find_iter(pom)
+        .filter(|m| {
+            maven_tag_text_in(pom, "groupId", m.start(), m.end()).as_deref() == Some(group)
+                && maven_tag_text_in(pom, "artifactId", m.start(), m.end()).as_deref()
+                    == Some(artifact)
+        })
+        .map(|m| {
+            let version = maven_tag_inner_range(pom, "version", m.start(), m.end());
+            DepMatch {
+                start: m.start(),
+                end: m.end(),
+                version,
+                version_text: version.map(|(s, e)| pom[s..e].trim().to_string()),
+            }
+        })
+        .collect()
+}
+
+/// Is the block at `start` in the rewriter's insertion position: right
+/// after `<dependencyManagement><dependencies>`, with only authored
+/// Socket-pinned entries between?
+fn after_dm_open(pom: &str, start: usize) -> bool {
+    let open = Regex::new(r"(?s)<dependencyManagement>\s*<dependencies>\z")
+        .expect("static dependencyManagement-open regex is valid");
+    let authored = Regex::new(
+        r"\n      <dependency>\n        <groupId>[^<]*</groupId>\n        <artifactId>[^<]*</artifactId>\n        <version>[^<]*-socket\.[0-9a-f]{8}</version>\n      </dependency>\z",
+    )
+    .expect("static authored-entry regex is valid");
+    let Some(mut prefix) = pom[..start].strip_suffix(DM_ENTRY_LEAD) else {
+        return false;
+    };
+    loop {
+        if open.is_match(prefix) {
+            return true;
+        }
+        match authored.find(prefix) {
+            Some(m) => prefix = &prefix[..m.start()],
+            None => return false,
+        }
+    }
+}
+
+/// `(start, end)` of every `<dependencyManagement>` element.
+fn dm_sections(pom: &str) -> Vec<(usize, usize)> {
+    let re = Regex::new(r"(?s)<dependencyManagement>.*?</dependencyManagement>")
+        .expect("static dependencyManagement regex is valid");
+    re.find_iter(pom).map(|m| (m.start(), m.end())).collect()
+}
+
+/// Remove the `socket-patch-<uuid>` repository of `pom`: the element and
+/// the line break before it (the rewriter's own insertion), when it sits
+/// on lines of its own.
+fn remove_repository(pom: &str, uuid: &str, ctx: &Ctx<'_>) -> Result<String, String> {
+    let re =
+        Regex::new(r"(?s)<repository>.*?</repository>").expect("static repository regex is valid");
+    let id = format!("socket-patch-{uuid}");
+    let found: Vec<(usize, usize)> = re
+        .find_iter(pom)
+        .filter(|m| maven_tag_text_in(pom, "id", m.start(), m.end()).as_deref() == Some(&id))
+        .map(|m| (m.start(), m.end()))
+        .collect();
+    let (start, end) = match found.as_slice() {
+        [one] => *one,
+        [] => return Err(format!("pom.xml has no <repository> with id {id}")),
+        _ => {
+            return Err(format!(
+                "pom.xml has several <repository> elements with id {id}"
+            ))
+        }
+    };
+    let url = maven_tag_text_in(pom, "url", start, end).unwrap_or_default();
+    if ctx.hosted_uuid(&url).as_deref() != Some(uuid) {
+        return Err(format!(
+            "the pom.xml repository {id} does not point at the Socket patch server"
+        ));
+    }
+    let line_start = pom[..start].rfind('\n');
+    let own_line = line_start.is_some_and(|ls| pom[ls + 1..start].trim().is_empty())
+        && (pom[end..].starts_with('\n') || pom[end..].starts_with("\r\n"));
+    let Some(line_start) = line_start.filter(|_| own_line) else {
+        return Err(format!(
+            "the pom.xml repository {id} is not on lines of its own"
+        ));
+    };
+    let cut = if pom[..line_start].ends_with('\r') {
+        line_start - 1
+    } else {
+        line_start
+    };
+    Ok(format!("{}{}", &pom[..cut], &pom[end..]))
+}
+
+/// Restore one pin in `pom`, or say why not.
+fn restore_pin(
+    pom: &str,
+    group: &str,
+    artifact: &str,
+    base: &str,
+    uuid: &str,
+    ctx: &Ctx<'_>,
+) -> Result<String, String> {
+    let suffixed = format!("{base}-socket.{}", &uuid[..8]);
+    let mut text = remove_repository(pom, uuid, ctx)?;
+
+    let matches = dep_matches(&text, group, artifact);
+    if !matches
+        .iter()
+        .any(|m| m.version_text.as_deref() == Some(suffixed.as_str()))
+    {
+        return Err(format!(
+            "pom.xml declares no {group}:{artifact} <version>{suffixed}</version>"
+        ));
+    }
+    let versioned = matches.iter().filter(|m| m.version.is_some()).count();
+    let sections = dm_sections(&text);
+    let managed = |pos: usize| sections.iter().any(|(s, e)| pos >= *s && pos < *e);
+    // A versionless direct declaration with nothing but this pom's own
+    // `<dependencyManagement>` to manage it: that entry is the user's.
+    let entry_is_users = matches
+        .iter()
+        .any(|m| m.version.is_none() && !managed(m.start))
+        && !text.contains("<parent>")
+        && !text.contains("<scope>import</scope>");
+
+    let mut edits: Vec<(usize, usize, String)> = Vec::new();
+    for m in matches
+        .iter()
+        .filter(|m| m.version_text.as_deref() == Some(suffixed.as_str()))
+    {
+        let authored = versioned == 1
+            && !entry_is_users
+            && text[m.start..m.end] == authored_dm_block(group, artifact, &suffixed)
+            && after_dm_open(&text, m.start);
+        if authored {
+            edits.push((m.start - DM_ENTRY_LEAD.len(), m.end, String::new()));
+        } else {
+            let (s, e) = m
+                .version
+                .expect("a match with a version text has its range");
+            edits.push((s, e, base.to_string()));
+        }
+    }
+    edits.sort_by(|a, b| b.0.cmp(&a.0));
+    for (s, e, with) in edits {
+        text.replace_range(s..e, &with);
+    }
+
+    if text.contains(&suffixed) {
+        return Err(format!(
+            "pom.xml still names {suffixed} outside a <dependency> version (a property or \
+             plugin configuration socket-patch did not write)"
+        ));
+    }
+    if text.contains(&format!("socket-patch-{uuid}")) {
+        return Err(format!("pom.xml still names socket-patch-{uuid}"));
+    }
+    Ok(text)
+}
+
+/// The `<module>` directories a pom lists (plain relative paths only).
+fn modules(pom: &str) -> Vec<String> {
+    let re = Regex::new(r"<module>\s*([^<]*?)\s*</module>").expect("static module regex is valid");
+    re.captures_iter(pom)
+        .map(|c| c[1].trim_end_matches('/').to_string())
+        .filter(|m| {
+            !m.is_empty()
+                && !m.starts_with('/')
+                && !m.contains('\\')
+                && m.split('/')
+                    .all(|seg| !seg.is_empty() && seg != "." && seg != "..")
+        })
+        .collect()
+}
+
+pub(crate) async fn restore(
+    view: &mut View<'_>,
+    pins: &[&HostedPin],
+    files: &[String],
+    ctx: &Ctx<'_>,
+) -> FormatResult {
+    let mut result = FormatResult::default();
+    let pins = by_uuid(pins);
+    for rel in files {
+        let Some(original) = read_or_refuse(view, rel, &pins, &mut result).await else {
+            continue;
+        };
+        let dir = rel
+            .rsplit_once('/')
+            .map(|(d, _)| format!("{d}/"))
+            .unwrap_or_default();
+        let module_poms: Vec<String> = modules(&original)
+            .into_iter()
+            .map(|m| {
+                if m.ends_with(".xml") {
+                    format!("{dir}{m}")
+                } else {
+                    format!("{dir}{m}/pom.xml")
+                }
+            })
+            .collect();
+        let mut text = original.clone();
+        // Checksum-file path prefixes of the restored pins.
+        let mut checksum_dirs: Vec<String> = Vec::new();
+        let mut restored: Vec<&str> = Vec::new();
+        for pin in pins.values().filter(|p| p.files.contains(rel)) {
+            let Some((name, base)) = pin.name_version() else {
+                result.refuse(&pin.uuid, format!("{} is not a Maven purl", pin.purl));
+                continue;
+            };
+            let Some((group, artifact)) = name.split_once('/') else {
+                result.refuse(&pin.uuid, format!("{} names no groupId", pin.purl));
+                continue;
+            };
+            if pin.uuid.len() < 8 {
+                result.refuse(&pin.uuid, format!("{} is not a patch uuid", pin.uuid));
+                continue;
+            }
+            let suffixed = format!("{base}-socket.{}", &pin.uuid[..8]);
+            let mut in_module = None;
+            for module in &module_poms {
+                if let Ok(Some(child)) = view.read(module).await {
+                    if child.contains(&suffixed)
+                        || child.contains(&format!("socket-patch-{}", pin.uuid))
+                    {
+                        in_module = Some(module.clone());
+                        break;
+                    }
+                }
+            }
+            if let Some(module) = in_module {
+                result.refuse(
+                    &pin.uuid,
+                    format!(
+                        "the module pom {module} also pins {group}:{artifact} {suffixed}, and \
+                         socket-patch restores only the root {rel}"
+                    ),
+                );
+                continue;
+            }
+            match restore_pin(&text, group, artifact, &base, &pin.uuid, ctx) {
+                Ok(next) => {
+                    text = next;
+                    checksum_dirs.push(format!(
+                        "{}/{artifact}/{suffixed}/",
+                        group.replace('.', "/")
+                    ));
+                    restored.push(&pin.uuid);
+                }
+                Err(why) => result.refuse(&pin.uuid, why),
+            }
+        }
+        // The from-scratch wrappers, once emptied (repositories come last).
+        for empty in [EMPTY_REPOSITORIES, EMPTY_DEP_MANAGEMENT] {
+            if text.contains(empty) && !original.contains(empty) {
+                text = text.replacen(empty, "</project>", 1);
+            }
+        }
+        if restored.is_empty() {
+            continue;
+        }
+        if let Err(why) = crate::vendor::maven_pom::parse_pom(&text) {
+            refuse_all_in(
+                &pins,
+                rel,
+                &mut result,
+                format!("restoring {rel} would not leave a readable pom: {why}"),
+            );
+            continue;
+        }
+        view.write(rel, text);
+        restore_mvn(view, &dir, &checksum_dirs, &mut result).await;
+        result
+            .handled
+            .extend(restored.into_iter().map(str::to_string));
+    }
+    result
+}
+
+/// Drop the restored pins' trusted-checksum lines, and the `.mvn` files
+/// themselves when nothing but hosted mode's content is left.
+async fn restore_mvn(
+    view: &mut View<'_>,
+    dir: &str,
+    checksum_dirs: &[String],
+    result: &mut FormatResult,
+) {
+    let sums_rel = format!("{dir}{MVN_CHECKSUMS}");
+    let config_rel = format!("{dir}{MVN_CONFIG}");
+    let Ok(Some(sums)) = view.read(&sums_rel).await else {
+        return;
+    };
+    let path_of = |line: &str| {
+        line.trim_end_matches('\r')
+            .split_once("  ")
+            .map(|(_, p)| p.to_string())
+    };
+    let kept: Vec<&str> = sums
+        .split('\n')
+        .filter(|line| {
+            !path_of(line).is_some_and(|p| checksum_dirs.iter().any(|d| p.starts_with(d.as_str())))
+        })
+        .collect();
+    let rest = kept.join("\n");
+    if rest == sums {
+        return;
+    }
+    let config = view.read(&config_rel).await.ok().flatten();
+    let written_config = format!("{}\n", MVN_CONFIG_ARGS.join("\n"));
+    let has_resolver_lines = config.as_deref().is_some_and(|c| {
+        c.lines()
+            .any(|l| MVN_CONFIG_ARGS.contains(&l.trim_end_matches('\r')))
+    });
+    if rest.trim().is_empty() {
+        view.remove(&sums_rel);
+        if config.as_deref() == Some(written_config.as_str()) {
+            view.remove(&config_rel);
+            return;
+        }
+    } else {
+        view.write(&sums_rel, rest.clone());
+    }
+    let other_hosted = rest.lines().any(|l| {
+        path_of(l).is_some_and(|p| {
+            p.split('/')
+                .any(|seg| crate::vendor::maven_pom::split_socket_version(seg).is_some())
+        })
+    });
+    if has_resolver_lines && !other_hosted {
+        result.warnings.push((
+            "maven_trusted_checksums_left",
+            format!(
+                "{config_rel} keeps the trusted-checksums resolver lines (`-Daether.…`), which \
+                 hosted mode may have added; no hosted pin needs them any more, so remove them \
+                 if nothing else does"
+            ),
+        ));
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::super::{restore_upstream, HostedPin, PinStatus, RestoreOptions, RestoreOutcome};
+    use std::collections::BTreeMap;
+
+    const UUID: &str = "77777777-7777-7777-7777-777777777777";
+    const SUFFIXED: &str = "1.7.36-socket.77777777";
+
+    fn fixture(case: &str, side: &str, rel: &str) -> String {
+        let p = format!(
+            "{}/tests/fixtures/redirect/maven/pom/{case}/{side}/{rel}",
+            env!("CARGO_MANIFEST_DIR")
+        );
+        std::fs::read_to_string(p).unwrap()
+    }
+
+    /// Restore the slf4j pin (offline: Maven needs no network) over
+    /// `files`; the outcome, and the tree after.
+    async fn run(files: &[(&str, String)]) -> (RestoreOutcome, BTreeMap<String, String>) {
+        let tmp = tempfile::tempdir().unwrap();
+        for (rel, text) in files {
+            let p = tmp.path().join(rel);
+            std::fs::create_dir_all(p.parent().unwrap()).unwrap();
+            std::fs::write(p, text).unwrap();
+        }
+        let pins = [HostedPin {
+            purl: "pkg:maven/org.slf4j/slf4j-api@1.7.36".into(),
+            uuid: UUID.into(),
+            files: vec!["pom.xml".into()],
+        }];
+        let opts = RestoreOptions {
+            offline: true,
+            ..RestoreOptions::default()
+        };
+        let outcome = restore_upstream(tmp.path(), &pins, &opts).await;
+        let mut after = BTreeMap::new();
+        for entry in walkdir::WalkDir::new(tmp.path())
+            .into_iter()
+            .filter_map(Result::ok)
+        {
+            if entry.file_type().is_file() {
+                let rel = entry.path().strip_prefix(tmp.path()).unwrap();
+                after.insert(
+                    rel.to_string_lossy().replace('\\', "/"),
+                    std::fs::read_to_string(entry.path()).unwrap(),
+                );
+            }
+        }
+        (outcome, after)
+    }
+
+    fn refusal(outcome: &RestoreOutcome) -> String {
+        match &outcome.pins[0].status {
+            PinStatus::Refused(why) => why.clone(),
+            PinStatus::Restored => panic!("restored"),
+        }
+    }
+
+    #[tokio::test]
+    async fn refusals_change_nothing() {
+        let hosted = fixture("basic", "expected", "pom.xml");
+        let with_module = hosted.replace(
+            "  <packaging>jar</packaging>",
+            "  <packaging>pom</packaging>\n  <modules>\n    <module>core</module>\n  </modules>",
+        );
+        let module_pom = format!("<project><version>{SUFFIXED}</version></project>\n");
+        let with_property = hosted.replace(
+            "  <packaging>jar</packaging>",
+            &format!(
+                "  <packaging>jar</packaging>\n  <properties>\n    <slf.v>{SUFFIXED}</slf.v>\n  </properties>"
+            ),
+        );
+        let no_repo = fixture("basic", "input", "pom.xml").replace("1.7.36", SUFFIXED);
+        let inline_repo = hosted.replace("\n    <repository>", "<repository>");
+        let cases: Vec<(Vec<(&str, String)>, &str)> = vec![
+            (
+                vec![("pom.xml", with_module), ("core/pom.xml", module_pom)],
+                "module pom core/pom.xml also pins",
+            ),
+            (
+                vec![("pom.xml", with_property)],
+                "outside a <dependency> version",
+            ),
+            (vec![("pom.xml", no_repo)], "no <repository> with id"),
+            (vec![("pom.xml", inline_repo)], "not on lines of its own"),
+            (
+                vec![(
+                    "pom.xml",
+                    hosted.replace(SUFFIXED, "1.7.36-socket.12345678"),
+                )],
+                "declares no org.slf4j:slf4j-api",
+            ),
+        ];
+        for (files, needle) in cases {
+            let (outcome, after) = run(&files).await;
+            let why = refusal(&outcome);
+            assert!(why.contains(needle), "{needle}: {why}");
+            assert!(why.contains("git checkout -- pom.xml"), "{why}");
+            for (rel, text) in &files {
+                assert_eq!(after.get(*rel), Some(text), "{needle}: {rel}");
+            }
+        }
+    }
+
+    #[tokio::test]
+    async fn crlf_pom_round_trips() {
+        let input = fixture("basic", "input", "pom.xml").replace('\n', "\r\n");
+        let hosted = fixture("basic", "expected", "pom.xml");
+        let repos =
+            &hosted[hosted.find("  <repositories>").unwrap()..hosted.find("</project>").unwrap()];
+        let hosted_crlf = input
+            .replace(
+                "<version>1.7.36</version>",
+                &format!("<version>{SUFFIXED}</version>"),
+            )
+            .replace("</project>", &format!("{repos}</project>"));
+        let (outcome, after) = run(&[("pom.xml", hosted_crlf)]).await;
+        assert_eq!(outcome.pins[0].status, PinStatus::Restored);
+        assert_eq!(after["pom.xml"], input);
+    }
+
+    #[tokio::test]
+    async fn managed_entry_is_removed_when_a_parent_manages_the_direct_dependency() {
+        // No literal version anywhere, a <parent> to manage it: the rewriter
+        // added the <dependencyManagement> pin.
+        let input = fixture("transitive-depmgmt", "input", "pom.xml")
+            .replace(
+                "  <modelVersion>4.0.0</modelVersion>\n",
+                "  <modelVersion>4.0.0</modelVersion>\n  <parent>\n    <groupId>p</groupId>\n    <artifactId>p</artifactId>\n    <version>1</version>\n  </parent>\n",
+            )
+            .replace(
+                "  </dependencies>",
+                "    <dependency>\n      <groupId>org.slf4j</groupId>\n      <artifactId>slf4j-api</artifactId>\n    </dependency>\n  </dependencies>",
+            );
+        let hosted = fixture("transitive-depmgmt", "expected", "pom.xml");
+        let added = &hosted
+            [hosted.find("  <dependencyManagement>").unwrap()..hosted.find("</project>").unwrap()];
+        let hosted = input.replace("</project>", &format!("{added}</project>"));
+        let (outcome, after) = run(&[("pom.xml", hosted)]).await;
+        assert_eq!(outcome.pins[0].status, PinStatus::Restored);
+        assert_eq!(after["pom.xml"], input);
+    }
+
+    #[tokio::test]
+    async fn existing_mvn_lines_are_kept_and_warned() {
+        let config = format!(
+            "-Dmaven.test.skip=true\n{}\n",
+            super::MVN_CONFIG_ARGS.join("\n")
+        );
+        let files = vec![
+            ("pom.xml", fixture("basic", "expected", "pom.xml")),
+            (".mvn/maven.config", config.clone()),
+            (
+                ".mvn/checksums/checksums.sha256",
+                fixture("basic", "expected", ".mvn/checksums/checksums.sha256"),
+            ),
+        ];
+        let (outcome, after) = run(&files).await;
+        assert_eq!(outcome.pins[0].status, PinStatus::Restored);
+        assert_eq!(after["pom.xml"], fixture("basic", "input", "pom.xml"));
+        assert_eq!(after[".mvn/maven.config"], config);
+        assert!(!after.contains_key(".mvn/checksums/checksums.sha256"));
+        assert!(
+            outcome
+                .warnings
+                .iter()
+                .any(|(code, _)| *code == "maven_trusted_checksums_left"),
+            "{:?}",
+            outcome.warnings
+        );
+    }
+
+    #[tokio::test]
+    async fn other_checksum_lines_keep_their_order() {
+        let other = format!(
+            "{}  zz/other/1.0/other-1.0.jar\n{}  aa/first/1.0/first-1.0.jar\n",
+            "e".repeat(64),
+            "f".repeat(64)
+        );
+        let sums = format!(
+            "{other}{}",
+            fixture("basic", "expected", ".mvn/checksums/checksums.sha256")
+        );
+        let files = vec![
+            ("pom.xml", fixture("basic", "expected", "pom.xml")),
+            (
+                ".mvn/maven.config",
+                fixture("basic", "expected", ".mvn/maven.config"),
+            ),
+            (".mvn/checksums/checksums.sha256", sums),
+        ];
+        let (outcome, after) = run(&files).await;
+        assert_eq!(outcome.pins[0].status, PinStatus::Restored);
+        assert_eq!(after[".mvn/checksums/checksums.sha256"], other);
+        assert!(after.contains_key(".mvn/maven.config"));
+    }
+}
diff --git a/crates/socket-patch-core/src/patch/redirect/upstream/mod.rs b/crates/socket-patch-core/src/patch/redirect/upstream/mod.rs
new file mode 100644
index 00000000..b7a94f3b
--- /dev/null
+++ b/crates/socket-patch-core/src/patch/redirect/upstream/mod.rs
@@ -0,0 +1,665 @@
+//! Hosted → upstream restore: the v5 unwind of a hosted redirect.
+//!
+//! v5 hosted mode keeps no ledger (`scan`/`get --mode hosted` write only
+//! lockfile edits), so an unwind cannot replay recorded fragments. Instead,
+//! for every hosted pin the lockfiles carry (`vex::discover`'s hosted refs:
+//! purl + patch uuid + the files wiring it), this module rewrites the lock
+//! entry back to the DEFAULT UPSTREAM registry entry for `name@version`,
+//! re-resolving whatever the entry pins (tarball URL, integrity, checksum)
+//! from the public registry: the npm registry's version document, the
+//! crates.io sparse index, the Go module proxy, and so on.
+//!
+//! Where that is impossible — a format whose entry carries fields only the
+//! package manager can compute, an offline run, a registry that does not
+//! answer, a binary `bun.lockb` outside a vendor takeover
+//! ([`RestoreOptions::bun_lockb`]) — the pin is REFUSED with a message naming
+//! the remedy (`git checkout -- <lockfile>`). A refusal is all-or-nothing
+//! per pin: a pin refused in one of its files is restored in none of them,
+//! so no pin is ever left half hosted.
+//!
+//! Nothing reaches disk until every pin resolved (the staged view below),
+//! and a dry run resolves everything exactly like a wet run — network
+//! lookups included — and skips only the flush.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::path::Path;
+
+use crate::vex::discover::{Discovery, PatchedRef, WiringMode};
+
+mod bun_lockb;
+mod cargo;
+mod client;
+mod composer;
+mod gem;
+mod golang;
+mod maven;
+mod npm;
+mod nuget;
+mod pypi;
+mod pypi_locks;
+mod uv;
+mod vlt;
+
+pub(crate) use client::UpstreamClient;
+
+use super::staged::{flush_staged, read_rel, Staged, StagedBytes};
+
+/// One hosted pin to restore: a `(purl, patch uuid)` pair and the
+/// root-relative files lockfile discovery found it wired in.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct HostedPin {
+    /// Canonical base purl (no qualifiers), as discovery spells it.
+    pub purl: String,
+    /// The hosted patch uuid.
+    pub uuid: String,
+    /// Root-relative files that wire this pin, sorted and deduplicated.
+    pub files: Vec<String>,
+}
+
+impl HostedPin {
+    /// Group a discovery's HOSTED refs into pins, one per `(purl, uuid)`.
+    pub fn from_refs<'a>(refs: impl IntoIterator<Item = &'a PatchedRef>) -> Vec<HostedPin> {
+        let mut grouped: BTreeMap<(String, String), BTreeSet<String>> = BTreeMap::new();
+        for r in refs {
+            if r.mode != WiringMode::Hosted {
+                continue;
+            }
+            grouped
+                .entry((r.purl.clone(), r.uuid.clone()))
+                .or_default()
+                .insert(r.source_file.to_string_lossy().replace('\\', "/"));
+        }
+        grouped
+            .into_iter()
+            .map(|((purl, uuid), files)| HostedPin {
+                purl,
+                uuid,
+                files: files.into_iter().collect(),
+            })
+            .collect()
+    }
+
+    /// Every hosted pin a discovery holds.
+    pub fn all(discovery: &Discovery) -> Vec<HostedPin> {
+        Self::from_refs(&discovery.refs)
+    }
+
+    /// `(name, version)` of the purl, percent-decoded.
+    pub(crate) fn name_version(&self) -> Option<(String, String)> {
+        let (_, name, version) = crate::utils::purl::purl_parts(&self.purl)?;
+        Some((name, version))
+    }
+}
+
+/// Hosted wiring the lockfiles mention that is NOT an attributable pin: a
+/// Socket-hosted patch identity discovery recognized in `files` but could
+/// not tie to one package version (a lock another lock contradicts, a
+/// malformed or unattributable reference, a lockless registry pin). It is
+/// still hosted state — management commands must refuse around it, never
+/// read it as "no hosted patches".
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ContestedWiring {
+    /// The hosted patch uuid the files name.
+    pub uuid: String,
+    /// Root-relative files naming it, sorted and deduplicated.
+    pub files: Vec<String>,
+    /// Discovery's own findings for those files (`code: detail`), if any.
+    pub details: Vec<String>,
+}
+
+/// The project's hosted state as raw wiring: the attributable pins (what
+/// restores and ejects act on) and the contested wiring (what they must
+/// refuse around). VEX eligibility is a separate judgment over the same
+/// discovery; this inventory keeps everything the lockfiles wire.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct HostedInventory {
+    pub pins: Vec<HostedPin>,
+    pub contested: Vec<ContestedWiring>,
+}
+
+impl HostedInventory {
+    pub fn of(discovery: &Discovery) -> Self {
+        let pins = HostedPin::all(discovery);
+        let norm = |p: &Path| p.to_string_lossy().replace('\\', "/");
+        let pinned: BTreeSet<&str> = pins.iter().map(|p| p.uuid.as_str()).collect();
+        // A hosted URL also carries its grant token as a uuid-shaped
+        // segment, so an unpinned recognized uuid in a file that DOES carry
+        // pins is contested only when discovery flagged that file.
+        let pinned_files: BTreeSet<&str> = pins
+            .iter()
+            .flat_map(|p| p.files.iter().map(String::as_str))
+            .collect();
+        let flagged_files: BTreeSet<String> = discovery
+            .diagnostics
+            .iter()
+            .filter(|d| {
+                matches!(
+                    d.code,
+                    crate::vex::discover::DIAG_REF_INVALID
+                        | crate::vex::discover::DIAG_REF_UNATTRIBUTABLE
+                )
+            })
+            .map(|d| norm(&d.file))
+            .collect();
+        let mut contested: BTreeMap<String, BTreeSet<String>> = BTreeMap::new();
+        for r in &discovery.recognized {
+            let file = norm(&r.file);
+            if r.mode == WiringMode::Hosted
+                && !pinned.contains(r.uuid.as_str())
+                && (!pinned_files.contains(file.as_str()) || flagged_files.contains(&file))
+            {
+                contested
+                    .entry(r.uuid.clone())
+                    .or_default()
+                    .insert(norm(&r.file));
+            }
+        }
+        for pin in &discovery.unlocked_pins {
+            if !pinned.contains(pin.uuid.as_str()) {
+                contested
+                    .entry(pin.uuid.clone())
+                    .or_default()
+                    .insert(norm(&pin.file));
+            }
+        }
+        let contested = contested
+            .into_iter()
+            .map(|(uuid, files)| {
+                let details = discovery
+                    .diagnostics
+                    .iter()
+                    .filter(|d| files.contains(&norm(&d.file)))
+                    .map(|d| format!("{}: {}", d.code, d.detail))
+                    .collect::<BTreeSet<_>>()
+                    .into_iter()
+                    .collect();
+                ContestedWiring {
+                    uuid,
+                    files: files.into_iter().collect(),
+                    details,
+                }
+            })
+            .collect();
+        HostedInventory { pins, contested }
+    }
+
+    /// Whether the lockfiles wire any hosted patch at all.
+    pub fn is_empty(&self) -> bool {
+        self.pins.is_empty() && self.contested.is_empty()
+    }
+
+    /// The refusal a management command raises while contested wiring
+    /// exists: which files, why, and the remedy. `None` when uncontested.
+    pub fn contested_refusal(&self) -> Option<String> {
+        if self.contested.is_empty() {
+            return None;
+        }
+        let files: BTreeSet<&str> = self
+            .contested
+            .iter()
+            .flat_map(|c| c.files.iter().map(String::as_str))
+            .collect();
+        let files: Vec<&str> = files.into_iter().collect();
+        let details: Vec<&str> = self
+            .contested
+            .iter()
+            .flat_map(|c| c.details.iter().map(String::as_str))
+            .collect::<BTreeSet<_>>()
+            .into_iter()
+            .collect();
+        // Files, not uuids: a hosted URL also carries its grant token as a
+        // uuid-shaped segment, so the recognized set over-names patches.
+        let mut msg = format!(
+            "{} wire(s) Socket-hosted patches that cannot be attributed to one package \
+             version (the lockfiles disagree, or the reference is malformed), so socket-patch \
+             cannot manage them safely",
+            files.join(", ")
+        );
+        if !details.is_empty() {
+            msg.push_str(&format!(" ({})", details.join("; ")));
+        }
+        msg.push_str(&format!(
+            "; reconcile the lockfiles (re-run `socket-patch scan --mode hosted`) or restore \
+             them from version control (`git checkout -- {}`)",
+            files.join(" ")
+        ));
+        Some(msg)
+    }
+}
+
+/// Knobs for [`restore_upstream`].
+#[derive(Debug, Clone, Default)]
+pub struct RestoreOptions {
+    /// Resolve everything, write nothing.
+    pub dry_run: bool,
+    /// No network: every pin whose restore needs a registry lookup is
+    /// refused with the checkout remedy.
+    pub offline: bool,
+    /// Extra patch-server origins whose URLs count as hosted (the
+    /// operator's `--patch-server-url`), exactly as discovery takes them.
+    pub patch_server_origins: Vec<String>,
+    /// Restore hosted pins in a binary `bun.lockb` by rebuilding the npm
+    /// registry record (see `bun_lockb`). Off, they are refused with the
+    /// checkout remedy. The rebuild is exact for a lock the hosted rewrite
+    /// wrote (a promoted format-1 lock is demoted back; a lock whose
+    /// workspace dependency behaviors it normalized is refused), but only a
+    /// vendor takeover — which re-records the rebuilt record as its own
+    /// pre-vendor original — opts in; `rollback` keeps refusing.
+    pub bun_lockb: bool,
+}
+
+/// What happened to one pin.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum PinStatus {
+    /// Every file wiring the pin now resolves the upstream registry entry
+    /// (or would, on a dry run).
+    Restored,
+    /// Nothing was changed for this pin. The message names the remedy.
+    Refused(String),
+}
+
+/// One pin's outcome.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct PinResult {
+    pub purl: String,
+    pub uuid: String,
+    pub status: PinStatus,
+    /// The files that wired the pin.
+    pub files: Vec<String>,
+}
+
+/// What [`restore_upstream`] did.
+#[derive(Debug, Default)]
+pub struct RestoreOutcome {
+    /// One entry per input pin, in input order.
+    pub pins: Vec<PinResult>,
+    /// Root-relative files rewritten or removed (or that would be, on a
+    /// dry run), sorted.
+    pub reverted_files: Vec<String>,
+    /// Advisory `(code, detail)` pairs.
+    pub warnings: Vec<(&'static str, String)>,
+    /// A write failure after every pin resolved: some files may have
+    /// landed. `None` on a clean flush (and always on a dry run).
+    pub flush_error: Option<String>,
+}
+
+impl RestoreOutcome {
+    pub fn restored(&self) -> impl Iterator<Item = &PinResult> {
+        self.pins
+            .iter()
+            .filter(|p| p.status == PinStatus::Restored)
+    }
+
+    pub fn refused(&self) -> impl Iterator<Item = (&PinResult, &str)> {
+        self.pins.iter().filter_map(|p| match &p.status {
+            PinStatus::Refused(why) => Some((p, why.as_str())),
+            PinStatus::Restored => None,
+        })
+    }
+}
+
+/// The remedy every refusal names: restore the file from version control.
+pub fn checkout_remedy(files: &[String]) -> String {
+    if files.is_empty() {
+        return "restore the lockfile from version control (`git checkout -- <lockfile>`)"
+            .to_string();
+    }
+    format!(
+        "restore it from version control instead (`git checkout -- {}`)",
+        files.join(" ")
+    )
+}
+
+/// The staged project view the restorers work over: reads fall through to
+/// disk, writes stay in memory until [`restore_upstream`] flushes them.
+pub(crate) struct View<'a> {
+    root: &'a Path,
+    staged: Staged,
+    /// Original on-disk text of every file read, so a write that restores
+    /// the exact original bytes is not reported as a change.
+    originals: BTreeMap<String, Option<String>>,
+    /// Binary files (bun.lockb): staged bytes and their on-disk originals.
+    staged_bytes: StagedBytes,
+    original_bytes: BTreeMap<String, Option<Vec<u8>>>,
+}
+
+impl<'a> View<'a> {
+    fn new(root: &'a Path) -> Self {
+        View {
+            root,
+            staged: Staged::new(),
+            originals: BTreeMap::new(),
+            staged_bytes: StagedBytes::new(),
+            original_bytes: BTreeMap::new(),
+        }
+    }
+
+    /// The current (staged) bytes of the binary file `rel`; `Ok(None)` when
+    /// absent. FIFO-guarded like [`Self::read`].
+    pub(crate) async fn read_bytes(&mut self, rel: &str) -> Result<Option<Vec<u8>>, String> {
+        if let Some(pending) = self.staged_bytes.get(rel) {
+            return Ok(Some(pending.clone()));
+        }
+        if let Some(original) = self.original_bytes.get(rel) {
+            return Ok(original.clone());
+        }
+        let bytes = match crate::utils::fs::read_regular_to_bytes(&self.root.join(rel)).await {
+            Ok(bytes) => Some(bytes),
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => None,
+            Err(e) => return Err(format!("read {rel}: {e}")),
+        };
+        self.original_bytes.insert(rel.to_string(), bytes.clone());
+        Ok(bytes)
+    }
+
+    pub(crate) fn write_bytes(&mut self, rel: &str, content: Vec<u8>) {
+        self.staged_bytes.insert(rel.to_string(), content);
+    }
+
+    /// Binary files whose staged bytes differ from what was read from disk.
+    fn changed_bytes(&self) -> StagedBytes {
+        self.staged_bytes
+            .iter()
+            .filter(|(rel, pending)| {
+                self.original_bytes.get(*rel).and_then(Option::as_ref) != Some(*pending)
+            })
+            .map(|(rel, pending)| (rel.clone(), pending.clone()))
+            .collect()
+    }
+
+    pub(crate) fn root(&self) -> &Path {
+        self.root
+    }
+
+    /// The current (staged) text of `rel`; `Ok(None)` when absent.
+    pub(crate) async fn read(&mut self, rel: &str) -> Result<Option<String>, String> {
+        if let Some(pending) = self.staged.get(rel) {
+            return Ok(pending.clone());
+        }
+        if let Some(original) = self.originals.get(rel) {
+            return Ok(original.clone());
+        }
+        let text = read_rel(self.root, rel).await?;
+        self.originals.insert(rel.to_string(), text.clone());
+        Ok(text)
+    }
+
+    pub(crate) fn write(&mut self, rel: &str, content: String) {
+        self.staged.insert(rel.to_string(), Some(content));
+    }
+
+    pub(crate) fn remove(&mut self, rel: &str) {
+        self.staged.insert(rel.to_string(), None);
+    }
+
+    /// Files whose staged state differs from what was read from disk.
+    fn changed(&self) -> Staged {
+        self.staged
+            .iter()
+            .filter(|(rel, pending)| self.originals.get(*rel) != Some(*pending))
+            .map(|(rel, pending)| (rel.clone(), pending.clone()))
+            .collect()
+    }
+}
+
+/// Per-format restore result, merged across formats by the driver.
+#[derive(Debug, Default)]
+pub(crate) struct FormatResult {
+    /// Pins (by uuid) this format refused, with the reason (the driver
+    /// appends the remedy).
+    pub refused: BTreeMap<String, String>,
+    /// Pins (by uuid) this format found wired and restored in the view.
+    pub handled: BTreeSet<String>,
+    pub warnings: Vec<(&'static str, String)>,
+}
+
+impl FormatResult {
+    pub(crate) fn refuse(&mut self, uuid: &str, why: impl Into<String>) {
+        self.refused
+            .entry(uuid.to_string())
+            .or_insert_with(|| why.into());
+    }
+
+    fn merge(&mut self, other: FormatResult) {
+        for (uuid, why) in other.refused {
+            self.refused.entry(uuid).or_insert(why);
+        }
+        self.handled.extend(other.handled);
+        self.warnings.extend(other.warnings);
+    }
+}
+
+/// Shared context handed to every format restorer.
+pub(crate) struct Ctx<'a> {
+    pub client: &'a UpstreamClient,
+    pub origins: &'a [String],
+    /// [`RestoreOptions::bun_lockb`].
+    pub bun_lockb: bool,
+}
+
+impl Ctx<'_> {
+    /// The hosted patch uuid `url` names, under the same host allowlist
+    /// discovery applies.
+    pub(crate) fn hosted_uuid(&self, url: &str) -> Option<String> {
+        super::hosted_patch_uuid(url, self.origins)
+    }
+}
+
+/// The lock formats a pin's files belong to. One restorer per format sees
+/// every in-scope pin wired in that format's files at once.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
+enum Format {
+    NpmLock,
+    YarnLock,
+    PnpmLock,
+    BunLock,
+    /// Binary bun.lockb (restored only under [`RestoreOptions::bun_lockb`]).
+    BunLockb,
+    Cargo,
+    Golang,
+    Gem,
+    Composer,
+    PipfileLock,
+    PoetryLock,
+    PdmLock,
+    Requirements,
+    /// Hatch direct references (`pyproject.toml`, `hatch.toml`).
+    Hatch,
+    /// uv.lock, PEP 723 script locks and PEP 751 pylock files (the uv
+    /// restorer also edits their paired `pyproject.toml` / script).
+    PythonLock,
+    VltLock,
+    Maven,
+    NuGet,
+    Unsupported,
+}
+
+fn format_of(rel: &str) -> Format {
+    let leaf = rel.rsplit('/').next().unwrap_or(rel);
+    match leaf {
+        "package-lock.json" | "npm-shrinkwrap.json" => Format::NpmLock,
+        "yarn.lock" => Format::YarnLock,
+        "pnpm-lock.yaml" | "shrinkwrap.yaml" => Format::PnpmLock,
+        "bun.lock" => Format::BunLock,
+        "bun.lockb" => Format::BunLockb,
+        "Cargo.toml" | "Cargo.lock" | "config.toml" | "config" => Format::Cargo,
+        "go.mod" | "go.sum" | "go.work" => Format::Golang,
+        "Gemfile.lock" | "gems.locked" | "Gemfile" | "gems.rb" => Format::Gem,
+        "composer.lock" => Format::Composer,
+        "Pipfile.lock" => Format::PipfileLock,
+        "poetry.lock" => Format::PoetryLock,
+        "pdm.lock" => Format::PdmLock,
+        "pyproject.toml" | "hatch.toml" => Format::Hatch,
+        leaf if crate::utils::python_lock::is_python_lock_name(leaf) => Format::PythonLock,
+        // The root requirements.txt and the `-r` includes discovery walks.
+        leaf if leaf.ends_with(".txt") => Format::Requirements,
+        "vlt-lock.json" => Format::VltLock,
+        "pom.xml" => Format::Maven,
+        "nuget.config" | "NuGet.config" | "NuGet.Config" | "packages.lock.json" => Format::NuGet,
+        _ => Format::Unsupported,
+    }
+}
+
+/// Restore every pin in `pins` to its default upstream registry entry.
+/// See the module docs for the contract.
+pub async fn restore_upstream(
+    root: &Path,
+    pins: &[HostedPin],
+    opts: &RestoreOptions,
+) -> RestoreOutcome {
+    let client = UpstreamClient::new(opts.offline);
+    let ctx = Ctx {
+        client: &client,
+        origins: &opts.patch_server_origins,
+        bun_lockb: opts.bun_lockb,
+    };
+
+    // Pins refused so far (uuid → reason). Each pass restores the pins not
+    // yet refused over a FRESH view; a pass that refuses a new pin is rerun
+    // without it, so the final view restores exactly the surviving set.
+    let mut refused: BTreeMap<String, String> = BTreeMap::new();
+    let (view, result) = loop {
+        let active: Vec<&HostedPin> = pins
+            .iter()
+            .filter(|p| !refused.contains_key(&p.uuid))
+            .collect();
+        let mut view = View::new(root);
+        let result = restore_pass(&mut view, &active, &ctx).await;
+        let mut grew = false;
+        for (uuid, why) in &result.refused {
+            if !refused.contains_key(uuid) {
+                refused.insert(uuid.clone(), why.clone());
+                grew = true;
+            }
+        }
+        // A pin no restorer claimed has wiring nothing here can unwind.
+        for pin in &active {
+            if !result.handled.contains(&pin.uuid) && !refused.contains_key(&pin.uuid) {
+                refused.insert(
+                    pin.uuid.clone(),
+                    format!(
+                        "no hosted wiring for {} was found in {} that socket-patch can \
+                         restore to the upstream registry entry",
+                        pin.purl,
+                        if pin.files.is_empty() {
+                            "the lockfiles".to_string()
+                        } else {
+                            pin.files.join(", ")
+                        }
+                    ),
+                );
+                grew = true;
+            }
+        }
+        if !grew {
+            break (view, result);
+        }
+    };
+
+    let changed = view.changed();
+    let changed_bytes = view.changed_bytes();
+    let reverted_files: BTreeSet<String> = changed
+        .keys()
+        .chain(changed_bytes.keys())
+        .cloned()
+        .collect();
+    let flush_error = if opts.dry_run || (changed.is_empty() && changed_bytes.is_empty()) {
+        None
+    } else {
+        flush_staged(root, &changed, &changed_bytes).await.err()
+    };
+
+    let pins_out = pins
+        .iter()
+        .map(|pin| PinResult {
+            purl: pin.purl.clone(),
+            uuid: pin.uuid.clone(),
+            status: match refused.get(&pin.uuid) {
+                Some(why) => PinStatus::Refused(format!(
+                    "cannot restore {} to its upstream registry entry: {why}; {}",
+                    pin.purl,
+                    checkout_remedy(&pin.files)
+                )),
+                None => PinStatus::Restored,
+            },
+            files: pin.files.clone(),
+        })
+        .collect();
+
+    RestoreOutcome {
+        pins: pins_out,
+        reverted_files: reverted_files.into_iter().collect(),
+        warnings: result.warnings,
+        flush_error,
+    }
+}
+
+/// One restore pass over `view` for the `active` pins.
+async fn restore_pass(view: &mut View<'_>, active: &[&HostedPin], ctx: &Ctx<'_>) -> FormatResult {
+    let mut by_format: BTreeMap<Format, (Vec<&HostedPin>, BTreeSet<String>)> = BTreeMap::new();
+    for pin in active {
+        for file in &pin.files {
+            let slot = by_format.entry(format_of(file)).or_default();
+            if !slot.0.iter().any(|p| p.uuid == pin.uuid) {
+                slot.0.push(pin);
+            }
+            slot.1.insert(file.clone());
+        }
+    }
+    let mut out = FormatResult::default();
+    for (format, (pins, files)) in by_format {
+        let files: Vec<String> = files.into_iter().collect();
+        let result = match format {
+            Format::NpmLock => npm::restore_npm_locks(view, &pins, &files, ctx).await,
+            Format::YarnLock => npm::restore_yarn_locks(view, &pins, &files, ctx).await,
+            Format::PnpmLock => npm::restore_pnpm_locks(view, &pins, &files, ctx).await,
+            Format::BunLock => npm::restore_bun_locks(view, &pins, &files, ctx).await,
+            Format::BunLockb if ctx.bun_lockb => {
+                bun_lockb::restore(view, &pins, &files, ctx).await
+            }
+            Format::Cargo => cargo::restore(view, &pins, &files, ctx).await,
+            Format::Golang => golang::restore(view, &pins, &files, ctx).await,
+            Format::Gem => gem::restore(view, &pins, &files, ctx).await,
+            Format::Composer => composer::restore(view, &pins, &files, ctx).await,
+            Format::PipfileLock => pypi::restore_pipfile_lock(view, &pins, &files, ctx).await,
+            Format::PoetryLock => pypi_locks::restore_poetry(view, &pins, &files, ctx).await,
+            Format::PdmLock => pypi_locks::restore_pdm(view, &pins, &files, ctx).await,
+            Format::Requirements => pypi::restore_requirements(view, &pins, &files, ctx).await,
+            Format::Hatch => pypi::restore_hatch(view, &pins, &files, ctx).await,
+            Format::PythonLock => uv::restore(view, &pins, &files, ctx).await,
+            Format::VltLock => vlt::restore(view, &pins, &files, ctx).await,
+            Format::Maven => maven::restore(view, &pins, &files, ctx).await,
+            Format::NuGet => nuget::restore(view, &pins, &files, ctx).await,
+            Format::Unsupported | Format::BunLockb => {
+                let mut r = FormatResult::default();
+                for pin in &pins {
+                    let unsupported: Vec<&str> = pin
+                        .files
+                        .iter()
+                        .filter(|f| format_of(f) == format)
+                        .map(String::as_str)
+                        .collect();
+                    let why = if format == Format::BunLockb {
+                        format!(
+                            "{} is a binary lock whose rebuilt registry record is not \
+                             byte-exact for every lock, so it is not restored here",
+                            unsupported.join(", ")
+                        )
+                    } else {
+                        format!(
+                            "socket-patch cannot re-derive the upstream entry in {}",
+                            unsupported.join(", ")
+                        )
+                    };
+                    r.refuse(&pin.uuid, why);
+                }
+                r
+            }
+        };
+        out.merge(result);
+    }
+    // The npm-family side settings a hosted run may have written, once no
+    // npm-family lock entry needs them any more.
+    npm::cleanup_side_config(view, ctx, &mut out).await;
+    out
+}
diff --git a/crates/socket-patch-core/src/patch/redirect/upstream/npm.rs b/crates/socket-patch-core/src/patch/redirect/upstream/npm.rs
new file mode 100644
index 00000000..d7a0a2d9
--- /dev/null
+++ b/crates/socket-patch-core/src/patch/redirect/upstream/npm.rs
@@ -0,0 +1,742 @@
+//! npm-family upstream restores: package-lock.json / npm-shrinkwrap.json,
+//! yarn.lock (classic and berry), pnpm-lock.yaml, bun.lock — plus the
+//! npm-family side settings a hosted run writes (`.npmrc`
+//! `allow-remote=all`, pnpm-workspace.yaml `trustLockfile: true`).
+//!
+//! Every restorer rewrites ONLY entries whose resolution is a hosted URL
+//! naming one of the in-scope patch uuids; every other byte of the file is
+//! the file's own. The upstream values come from the npm registry's
+//! version document (`dist.tarball`, `dist.integrity`, `dist.shasum`).
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use regex::Regex;
+use serde_json::Value;
+
+use super::client::NpmDist;
+use super::{Ctx, FormatResult, HostedPin, View};
+use crate::utils::line_endings::{to_lf, LineEndings};
+
+/// The pins by uuid.
+pub(super) fn by_uuid<'p>(pins: &[&'p HostedPin]) -> BTreeMap<&'p str, &'p HostedPin> {
+    pins.iter().map(|p| (p.uuid.as_str(), *p)).collect()
+}
+
+/// Resolve the dist of every `(uuid, name, version)` wanted, concurrently.
+/// A failed lookup refuses its pin.
+pub(super) async fn fetch_dists(
+    wanted: &BTreeSet<(String, String, String)>,
+    ctx: &Ctx<'_>,
+    result: &mut FormatResult,
+) -> BTreeMap<(String, String), NpmDist> {
+    let lookups = wanted.iter().map(|(uuid, name, version)| async move {
+        (
+            uuid.clone(),
+            name.clone(),
+            version.clone(),
+            ctx.client.npm_dist(name, version).await,
+        )
+    });
+    let mut out = BTreeMap::new();
+    for (uuid, name, version, dist) in futures_util::future::join_all(lookups).await {
+        match dist {
+            Ok(dist) => {
+                out.insert((name, version), dist);
+            }
+            Err(why) => result.refuse(&uuid, format!("{name}@{version}: {why}")),
+        }
+    }
+    out
+}
+
+// ── package-lock.json / npm-shrinkwrap.json ─────────────────────────────────
+
+/// One hosted entry of an npm lock: its JSON pointer, and what it stands for.
+struct NpmHit {
+    pointer: String,
+    uuid: String,
+    name: String,
+    version: String,
+}
+
+fn npm_lock_hits(lock: &Value, ctx: &Ctx<'_>) -> Vec<NpmHit> {
+    let mut hits = Vec::new();
+    if let Some(packages) = lock.get("packages").and_then(Value::as_object) {
+        for (key, entry) in packages {
+            let Some((_, key_name)) = key.rsplit_once("node_modules/") else {
+                continue;
+            };
+            let Some(uuid) = entry
+                .get("resolved")
+                .and_then(Value::as_str)
+                .and_then(|u| ctx.hosted_uuid(u))
+            else {
+                continue;
+            };
+            let name = entry
+                .get("name")
+                .and_then(Value::as_str)
+                .unwrap_or(key_name)
+                .to_string();
+            let Some(version) = entry.get("version").and_then(Value::as_str) else {
+                continue;
+            };
+            hits.push(NpmHit {
+                pointer: format!("/packages/{}", json_pointer_escape(key)),
+                uuid,
+                name,
+                version: version.to_string(),
+            });
+        }
+    }
+    if let Some(deps) = lock.get("dependencies").and_then(Value::as_object) {
+        v2_hits(deps, "/dependencies", ctx, &mut hits, 0);
+    }
+    hits
+}
+
+fn v2_hits(
+    deps: &serde_json::Map<String, Value>,
+    prefix: &str,
+    ctx: &Ctx<'_>,
+    hits: &mut Vec<NpmHit>,
+    depth: usize,
+) {
+    if depth > 64 {
+        return;
+    }
+    for (name, entry) in deps {
+        let pointer = format!("{prefix}/{}", json_pointer_escape(name));
+        if let (Some(uuid), Some(version)) = (
+            entry
+                .get("resolved")
+                .and_then(Value::as_str)
+                .and_then(|u| ctx.hosted_uuid(u)),
+            entry.get("version").and_then(Value::as_str),
+        ) {
+            hits.push(NpmHit {
+                pointer: pointer.clone(),
+                uuid,
+                name: name.clone(),
+                version: version.to_string(),
+            });
+        }
+        if let Some(nested) = entry.get("dependencies").and_then(Value::as_object) {
+            v2_hits(nested, &format!("{pointer}/dependencies"), ctx, hits, depth + 1);
+        }
+    }
+}
+
+fn json_pointer_escape(key: &str) -> String {
+    key.replace('~', "~0").replace('/', "~1")
+}
+
+pub(crate) async fn restore_npm_locks(
+    view: &mut View<'_>,
+    pins: &[&HostedPin],
+    files: &[String],
+    ctx: &Ctx<'_>,
+) -> FormatResult {
+    let mut result = FormatResult::default();
+    let pins = by_uuid(pins);
+    for rel in files {
+        let Some(text) = read_or_refuse(view, rel, &pins, &mut result).await else {
+            continue;
+        };
+        let Ok(mut lock) = serde_json::from_str::<Value>(&text) else {
+            refuse_all_in(&pins, rel, &mut result, format!("{rel} is not valid JSON"));
+            continue;
+        };
+        let hits: Vec<NpmHit> = npm_lock_hits(&lock, ctx)
+            .into_iter()
+            .filter(|h| pins.contains_key(h.uuid.as_str()))
+            .collect();
+        let wanted: BTreeSet<(String, String, String)> = hits
+            .iter()
+            .map(|h| (h.uuid.clone(), h.name.clone(), h.version.clone()))
+            .collect();
+        let dists = fetch_dists(&wanted, ctx, &mut result).await;
+        let mut changed = false;
+        for hit in &hits {
+            if result.refused.contains_key(&hit.uuid) {
+                continue;
+            }
+            let Some(dist) = dists.get(&(hit.name.clone(), hit.version.clone())) else {
+                continue;
+            };
+            let Some(integrity) = dist.integrity.as_deref() else {
+                result.refuse(
+                    &hit.uuid,
+                    format!(
+                        "the registry records no integrity for {}@{}",
+                        hit.name, hit.version
+                    ),
+                );
+                continue;
+            };
+            let Some(entry) = lock.pointer_mut(&hit.pointer).and_then(Value::as_object_mut)
+            else {
+                continue;
+            };
+            entry.insert("resolved".into(), Value::String(dist.tarball.clone()));
+            entry.insert("integrity".into(), Value::String(integrity.to_string()));
+            result.handled.insert(hit.uuid.clone());
+            changed = true;
+        }
+        if changed {
+            view.write(rel, super::super::serialize_json(&lock));
+        }
+    }
+    result
+}
+
+/// Read `rel` through the view; a missing or unreadable file refuses every
+/// pin discovery found in it.
+pub(super) async fn read_or_refuse(
+    view: &mut View<'_>,
+    rel: &str,
+    pins: &BTreeMap<&str, &HostedPin>,
+    result: &mut FormatResult,
+) -> Option<String> {
+    match view.read(rel).await {
+        Ok(Some(text)) => Some(text),
+        Ok(None) => {
+            refuse_all_in(pins, rel, result, format!("{rel} no longer exists"));
+            None
+        }
+        Err(e) => {
+            refuse_all_in(pins, rel, result, e);
+            None
+        }
+    }
+}
+
+pub(super) fn refuse_all_in(
+    pins: &BTreeMap<&str, &HostedPin>,
+    rel: &str,
+    result: &mut FormatResult,
+    why: String,
+) {
+    for pin in pins.values() {
+        if pin.files.iter().any(|f| f == rel) {
+            result.refuse(&pin.uuid, why.clone());
+        }
+    }
+}
+
+// ── yarn.lock ────────────────────────────────────────────────────────────────
+
+/// yarn v1's default registry host, used for a classic lock's `resolved`
+/// unless `SOCKET_NPM_REGISTRY` names another.
+const YARN_CLASSIC_REGISTRY: &str = "https://registry.yarnpkg.com";
+
+fn yarn_classic_tarball(dist: &NpmDist) -> String {
+    if std::env::var("SOCKET_NPM_REGISTRY").is_ok_and(|v| !v.trim().is_empty()) {
+        return dist.tarball.clone();
+    }
+    match dist
+        .tarball
+        .strip_prefix(crate::vendor::registry_fetch::DEFAULT_NPM_REGISTRY)
+    {
+        Some(rest) => format!("{YARN_CLASSIC_REGISTRY}{rest}"),
+        None => dist.tarball.clone(),
+    }
+}
+
+pub(crate) async fn restore_yarn_locks(
+    view: &mut View<'_>,
+    pins: &[&HostedPin],
+    files: &[String],
+    ctx: &Ctx<'_>,
+) -> FormatResult {
+    let mut result = FormatResult::default();
+    let pins = by_uuid(pins);
+    for rel in files {
+        let Some(raw) = read_or_refuse(view, rel, &pins, &mut result).await else {
+            continue;
+        };
+        if super::super::is_berry_lock(&raw) {
+            restore_berry(view, rel, &raw, &pins, ctx, &mut result).await;
+        } else {
+            restore_classic(view, rel, &raw, &pins, ctx, &mut result).await;
+        }
+    }
+    result
+}
+
+async fn restore_classic(
+    view: &mut View<'_>,
+    rel: &str,
+    raw: &str,
+    pins: &BTreeMap<&str, &HostedPin>,
+    ctx: &Ctx<'_>,
+    result: &mut FormatResult,
+) {
+    let eol = LineEndings::of(raw);
+    if eol == LineEndings::Mixed {
+        refuse_all_in(pins, rel, result, format!("{rel} mixes line endings"));
+        return;
+    }
+    let content = to_lf(raw);
+    let mut blocks: Vec<String> = content.split("\n\n").map(String::from).collect();
+    let resolved_re =
+        Regex::new(r#"\n {2}resolved "([^"]*)""#).expect("static resolved-line regex is valid");
+    let integrity_re =
+        Regex::new(r"\n {2}integrity [^\n]*").expect("static integrity-line regex is valid");
+    let version_re =
+        Regex::new(r#"\n {2}version "([^"]*)""#).expect("static version-line regex is valid");
+
+    // (block index, uuid, name, version) per hosted block.
+    let mut hits: Vec<(usize, String, String, String)> = Vec::new();
+    for (i, block) in blocks.iter().enumerate() {
+        let Some(uuid) = resolved_re
+            .captures(block)
+            .and_then(|c| ctx.hosted_uuid(&c[1]))
+        else {
+            continue;
+        };
+        if !pins.contains_key(uuid.as_str()) {
+            continue;
+        }
+        let name = super::super::yarn_classic_block_head(block).and_then(|(_, n)| n);
+        let version = version_re.captures(block).map(|c| c[1].to_string());
+        match (name, version) {
+            (Some(name), Some(version)) => hits.push((i, uuid, name, version)),
+            _ => result.refuse(
+                &uuid,
+                format!("a {rel} entry wiring it names no single package and version"),
+            ),
+        }
+    }
+    let wanted = hits
+        .iter()
+        .map(|(_, u, n, v)| (u.clone(), n.clone(), v.clone()))
+        .collect();
+    let dists = fetch_dists(&wanted, ctx, result).await;
+    let mut changed = false;
+    for (i, uuid, name, version) in hits {
+        if result.refused.contains_key(&uuid) {
+            continue;
+        }
+        let Some(dist) = dists.get(&(name.clone(), version.clone())) else {
+            continue;
+        };
+        let Some(integrity) = dist.integrity.as_deref() else {
+            result.refuse(
+                &uuid,
+                format!("the registry records no integrity for {name}@{version}"),
+            );
+            continue;
+        };
+        let frag = dist
+            .shasum
+            .as_deref()
+            .map(|s| format!("#{s}"))
+            .unwrap_or_default();
+        let resolved = format!(
+            "\n  resolved \"{}{frag}\"",
+            yarn_classic_tarball(dist).replace('$', "$$")
+        );
+        let mut block = resolved_re
+            .replace(&blocks[i], resolved.as_str())
+            .into_owned();
+        if integrity_re.is_match(&block) {
+            block = integrity_re
+                .replace(&block, format!("\n  integrity {integrity}").as_str())
+                .into_owned();
+        }
+        blocks[i] = block;
+        result.handled.insert(uuid);
+        changed = true;
+    }
+    if changed {
+        view.write(rel, eol.restore(&blocks.join("\n\n")).into_owned());
+    }
+}
+
+async fn restore_berry(
+    view: &mut View<'_>,
+    rel: &str,
+    raw: &str,
+    pins: &BTreeMap<&str, &HostedPin>,
+    ctx: &Ctx<'_>,
+    result: &mut FormatResult,
+) {
+    use crate::vendor::yarn_classic_lock::{split_berry_key_patterns, split_pattern};
+
+    let (bom, body) = match raw.strip_prefix('\u{feff}') {
+        Some(rest) => ("\u{feff}", rest),
+        None => ("", raw),
+    };
+    let yarnrc_rel = match rel.rsplit_once('/') {
+        Some((dir, _)) => format!("{dir}/.yarnrc.yml"),
+        None => ".yarnrc.yml".to_string(),
+    };
+    let yarnrc = view.read(&yarnrc_rel).await.ok().flatten();
+    if let Err(w) = super::super::preflight_yarn_berry_hosted(raw, yarnrc.as_deref()) {
+        refuse_all_in(pins, rel, result, w.detail);
+        return;
+    }
+    let eol = LineEndings::of(body);
+    let content = to_lf(body).into_owned();
+    let mut blocks: Vec<String> = content.split("\n\n").map(String::from).collect();
+    let resolution_re = Regex::new(r#"\n {2}resolution: "([^"]*)""#)
+        .expect("static resolution-line regex is valid");
+    let checksum_re =
+        Regex::new(r"\n {2}checksum: [^\n]*").expect("static checksum-line regex is valid");
+    let version_re =
+        Regex::new(r"\n {2}version: ([^\n]*)").expect("static version-line regex is valid");
+
+    let mut hits: Vec<(usize, String, String, String)> = Vec::new();
+    for (i, block) in blocks.iter().enumerate() {
+        let Some(resolution) = resolution_re.captures(block).map(|c| c[1].to_string()) else {
+            continue;
+        };
+        let Some((_, archive)) = resolution.split_once("::__archiveUrl=") else {
+            continue;
+        };
+        let archive = archive.split('&').next().unwrap_or(archive);
+        let Some(uuid) = ctx.hosted_uuid(archive) else {
+            continue;
+        };
+        if !pins.contains_key(uuid.as_str()) {
+            continue;
+        }
+        let key = block
+            .lines()
+            .next()
+            .and_then(|l| l.strip_suffix(':'))
+            .unwrap_or("");
+        let patterns = split_berry_key_patterns(key);
+        let names: BTreeSet<String> = patterns
+            .iter()
+            .filter_map(|p| split_pattern(p).map(|(n, _)| n.to_string()))
+            .collect();
+        let version = version_re
+            .captures(block)
+            .map(|c| c[1].trim().trim_matches('"').to_string());
+        match (names.len(), names.into_iter().next(), version) {
+            (1, Some(name), Some(version)) => hits.push((i, uuid, name.to_string(), version)),
+            _ => result.refuse(
+                &uuid,
+                format!("a {rel} entry wiring it names no single package and version"),
+            ),
+        }
+    }
+    let mut changed = false;
+    for (i, uuid, name, version) in hits {
+        if result.refused.contains_key(&uuid) {
+            continue;
+        }
+        let checksum = match ctx.client.npm_tarball(&name, &version).await.and_then(|tgz| {
+            crate::vendor::berry_zip::berry_cache_checksum_10c0(&tgz, &name)
+        }) {
+            Ok(c) => crate::vendor::yarn_berry_lock::checksum_in_lock_spelling(&content, &c),
+            Err(why) => {
+                result.refuse(&uuid, format!("{name}@{version}: {why}"));
+                continue;
+            }
+        };
+        let resolution = format!("\n  resolution: \"{name}@npm:{version}\"").replace('$', "$$");
+        let mut block = resolution_re
+            .replace(&blocks[i], resolution.as_str())
+            .into_owned();
+        if checksum_re.is_match(&block) {
+            block = checksum_re
+                .replace(&block, format!("\n  checksum: {checksum}").as_str())
+                .into_owned();
+        }
+        blocks[i] = block;
+        result.handled.insert(uuid);
+        changed = true;
+    }
+    if changed {
+        view.write(
+            rel,
+            format!("{bom}{}", eol.restore(&blocks.join("\n\n"))),
+        );
+    }
+}
+
+// ── pnpm-lock.yaml ───────────────────────────────────────────────────────────
+
+pub(crate) async fn restore_pnpm_locks(
+    view: &mut View<'_>,
+    pins: &[&HostedPin],
+    files: &[String],
+    ctx: &Ctx<'_>,
+) -> FormatResult {
+    use super::super::pnpm;
+
+    let mut result = FormatResult::default();
+    let pins = by_uuid(pins);
+    for rel in files {
+        let Some(text) = read_or_refuse(view, rel, &pins, &mut result).await else {
+            continue;
+        };
+        // (resolution range, uuid, name, version, rebuilt-without-integrity)
+        let mut hits: Vec<(std::ops::Range<usize>, String, String, String)> = Vec::new();
+        for entry in pnpm::entries(&text) {
+            let Some(resolution) = pnpm::resolution(&entry) else {
+                continue;
+            };
+            let Some(uuid) = resolution.tarball().and_then(|t| ctx.hosted_uuid(t)) else {
+                continue;
+            };
+            let Some(pin) = pins.get(uuid.as_str()) else {
+                continue;
+            };
+            let Some((name, version)) = pin.name_version() else {
+                result.refuse(&uuid, format!("{} is not an npm purl", pin.purl));
+                continue;
+            };
+            if pnpm::suffix(entry.key, &name, &version).is_none() {
+                result.refuse(
+                    &uuid,
+                    format!(
+                        "the {rel} entry `{}` wiring it is not {name}@{version}",
+                        entry.key
+                    ),
+                );
+                continue;
+            }
+            hits.push((resolution.range.clone(), uuid, name, version));
+        }
+        let wanted = hits
+            .iter()
+            .map(|(_, u, n, v)| (u.clone(), n.clone(), v.clone()))
+            .collect();
+        let dists = fetch_dists(&wanted, ctx, &mut result).await;
+        let mut splices: Vec<(std::ops::Range<usize>, String)> = Vec::new();
+        let mut handled: Vec<String> = Vec::new();
+        for entry in pnpm::entries(&text) {
+            let Some(resolution) = pnpm::resolution(&entry) else {
+                continue;
+            };
+            let Some((_, uuid, name, version)) =
+                hits.iter().find(|(r, ..)| *r == resolution.range)
+            else {
+                continue;
+            };
+            if result.refused.contains_key(uuid) {
+                continue;
+            }
+            let Some(integrity) = dists
+                .get(&(name.clone(), version.clone()))
+                .and_then(|d| d.integrity.clone())
+            else {
+                result.refuse(
+                    uuid,
+                    format!("the registry records no integrity for {name}@{version}"),
+                );
+                continue;
+            };
+            splices.push((resolution.range.clone(), resolution.restore(&integrity)));
+            handled.push(uuid.clone());
+        }
+        // A refusal recorded after a splice was planned (a second instance
+        // of the same pin) drops that pin's splices too.
+        let splices: Vec<_> = splices
+            .into_iter()
+            .zip(&handled)
+            .filter(|(_, u)| !result.refused.contains_key(*u))
+            .map(|(s, _)| s)
+            .collect();
+        if splices.is_empty() {
+            continue;
+        }
+        let mut out = String::with_capacity(text.len());
+        let mut cursor = 0;
+        let mut sorted = splices;
+        sorted.sort_by_key(|(r, _)| r.start);
+        for (range, replacement) in sorted {
+            out.push_str(&text[cursor..range.start]);
+            out.push_str(&replacement);
+            cursor = range.end;
+        }
+        out.push_str(&text[cursor..]);
+        for uuid in handled {
+            if !result.refused.contains_key(&uuid) {
+                result.handled.insert(uuid);
+            }
+        }
+        view.write(rel, out);
+    }
+    result
+}
+
+// ── bun.lock ─────────────────────────────────────────────────────────────────
+
+pub(crate) async fn restore_bun_locks(
+    view: &mut View<'_>,
+    pins: &[&HostedPin],
+    files: &[String],
+    ctx: &Ctx<'_>,
+) -> FormatResult {
+    use crate::vendor::bun_lock_text::{decode_json_string, split_name_spec};
+
+    let mut result = FormatResult::default();
+    let pins = by_uuid(pins);
+    for rel in files {
+        let Some(text) = read_or_refuse(view, rel, &pins, &mut result).await else {
+            continue;
+        };
+        let (mut lines, entries) = match super::super::parse_bun_hosted_lock(&text) {
+            Ok(parsed) => parsed,
+            Err(w) => {
+                refuse_all_in(&pins, rel, &mut result, w.detail);
+                continue;
+            }
+        };
+        // (line, uuid, name, version, deps)
+        let mut hits: Vec<(usize, String, String, String, String)> = Vec::new();
+        for entry in &entries {
+            if !matches!(entry.elems.len(), 2 | 3) || !entry.elems[1].starts_with('{') {
+                continue;
+            }
+            let Some(spec) = entry.elems.first().and_then(|e| decode_json_string(e)) else {
+                continue;
+            };
+            let Some((name, url)) = split_name_spec(&spec) else {
+                continue;
+            };
+            let Some(uuid) = ctx.hosted_uuid(url) else {
+                continue;
+            };
+            let Some(pin) = pins.get(uuid.as_str()) else {
+                continue;
+            };
+            match pin.name_version() {
+                Some((pin_name, version)) if pin_name == name => hits.push((
+                    entry.line_idx,
+                    uuid,
+                    name.to_string(),
+                    version,
+                    entry.elems[1].clone(),
+                )),
+                _ => result.refuse(
+                    &uuid,
+                    format!("the {rel} entry `{}` wiring it is not {}", entry.key, pin.purl),
+                ),
+            }
+        }
+        let wanted = hits
+            .iter()
+            .map(|(_, u, n, v, _)| (u.clone(), n.clone(), v.clone()))
+            .collect();
+        let dists = fetch_dists(&wanted, ctx, &mut result).await;
+        let mut changed = false;
+        for (line_idx, uuid, name, version, deps) in hits {
+            if result.refused.contains_key(&uuid) {
+                continue;
+            }
+            let Some(integrity) = dists
+                .get(&(name.clone(), version.clone()))
+                .and_then(|d| d.integrity.clone())
+            else {
+                result.refuse(
+                    &uuid,
+                    format!("the registry records no integrity for {name}@{version}"),
+                );
+                continue;
+            };
+            let Some(entry) = entries.iter().find(|e| e.line_idx == line_idx) else {
+                continue;
+            };
+            let original = &lines[line_idx];
+            let cr = if original.ends_with('\r') { "\r" } else { "" };
+            let json = |s: &str| serde_json::to_string(s).expect("a str serializes to JSON");
+            lines[line_idx] = format!(
+                "{indent}{key}: [{spec}, \"\", {deps}, {integrity}]{comma}{cr}",
+                indent = entry.indent,
+                key = entry.key_raw,
+                spec = json(&format!("{name}@{version}")),
+                integrity = json(&integrity),
+                comma = if entry.trailing_comma { "," } else { "" },
+            );
+            result.handled.insert(uuid);
+            changed = true;
+        }
+        if changed {
+            view.write(rel, lines.join("\n"));
+        }
+    }
+    result
+}
+
+// ── side settings ────────────────────────────────────────────────────────────
+
+/// Whether any npm / pnpm lock in the view still resolves a hosted URL.
+async fn still_hosted(view: &mut View<'_>, rels: &[&str], ctx: &Ctx<'_>) -> bool {
+    for rel in rels {
+        let Ok(Some(text)) = view.read(rel).await else {
+            continue;
+        };
+        if !crate::vex::discover::hosted_uuids_in_text(&text, ctx.origins).is_empty() {
+            return true;
+        }
+    }
+    false
+}
+
+/// Remove the `.npmrc` / pnpm-workspace.yaml a hosted run CREATED (still
+/// byte-identical to the scaffold) once no lock entry needs it; warn about
+/// the setting when the file carries other content too (the line may be
+/// the user's own, so it is never removed from a file the user wrote).
+pub(crate) async fn cleanup_side_config(
+    view: &mut View<'_>,
+    ctx: &Ctx<'_>,
+    result: &mut FormatResult,
+) {
+    use super::super::npmrc::{NPMRC_ALLOW_REMOTE_LINE, NPMRC_CREATED, NPMRC_REL};
+
+    let restored_npm_lock = view.staged.keys().any(|k| {
+        matches!(
+            k.rsplit('/').next(),
+            Some("package-lock.json" | "npm-shrinkwrap.json")
+        )
+    });
+    if restored_npm_lock
+        && !still_hosted(view, &["package-lock.json", "npm-shrinkwrap.json"], ctx).await
+    {
+        if let Ok(Some(npmrc)) = view.read(NPMRC_REL).await {
+            if npmrc == NPMRC_CREATED {
+                view.remove(NPMRC_REL);
+            } else if npmrc
+                .lines()
+                .any(|l| l.trim() == NPMRC_ALLOW_REMOTE_LINE)
+            {
+                result.warnings.push((
+                    "npm_allow_remote_left",
+                    format!(
+                        "{NPMRC_REL} keeps `{NPMRC_ALLOW_REMOTE_LINE}`, which hosted mode may \
+                         have added; no lock entry needs it any more, so remove the line if \
+                         nothing else does"
+                    ),
+                ));
+            }
+        }
+    }
+
+    let restored_pnpm = view
+        .staged
+        .keys()
+        .any(|k| k == "pnpm-lock.yaml");
+    if restored_pnpm && !still_hosted(view, &["pnpm-lock.yaml"], ctx).await {
+        const WORKSPACE: &str = "pnpm-workspace.yaml";
+        if let Ok(Some(ws)) = view.read(WORKSPACE).await {
+            if ws == "packages:\n  - '.'\ntrustLockfile: true\n" {
+                view.remove(WORKSPACE);
+            } else if ws.lines().any(|l| l.trim_end() == "trustLockfile: true") {
+                result.warnings.push((
+                    "pnpm_trust_lockfile_left",
+                    format!(
+                        "{WORKSPACE} keeps `trustLockfile: true`, which hosted mode may have \
+                         added; no lock entry needs it any more, so remove the line if nothing \
+                         else does"
+                    ),
+                ));
+            }
+        }
+    }
+}
diff --git a/crates/socket-patch-core/src/patch/redirect/upstream/nuget.rs b/crates/socket-patch-core/src/patch/redirect/upstream/nuget.rs
new file mode 100644
index 00000000..77b5a2eb
--- /dev/null
+++ b/crates/socket-patch-core/src/patch/redirect/upstream/nuget.rs
@@ -0,0 +1,568 @@
+//! NuGet upstream restore: the inverse of `rewrite_nuget` over the root
+//! `nuget.config` (the file discovery names) and its `packages.lock.json`.
+//!
+//! The config loses the `<add key="socket-patch-<uuid>" …/>` source and its
+//! exact-id `<packageSource>` mapping. A `<packageSourceMapping>` left with
+//! nothing but a `*` fan-out for every remaining source — the shape the
+//! rewriter authors around a from-scratch mapping — routes exactly like no
+//! mapping at all, so it is dropped too. What stays: a `nuget.org` source
+//! the rewriter seeded into a source-less config (indistinguishable from
+//! one the user wrote), and a config it created from scratch (identical to
+//! a user's default config, so it is kept and a warning says so).
+//!
+//! Every lock entry of the id gets nuget.org's `contentHash` back (the
+//! catalog `packageHash`, see [`UpstreamClient::nuget_content_hash`]) — only
+//! when the restored config resolves the id from nuget.org alone: another
+//! feed (or several) may serve different bytes, and socket-patch cannot
+//! tell which one the original lock came from, so such a pin is refused.
+//!
+//! [`UpstreamClient::nuget_content_hash`]: super::UpstreamClient::nuget_content_hash
+
+use regex::Regex;
+use serde_json::Value;
+
+use super::npm::{by_uuid, read_or_refuse, refuse_all_in};
+use super::{Ctx, FormatResult, HostedPin, View};
+use crate::vendor::nuget_config::{parse_config, NugetConfig};
+use crate::vendor::nuget_feed::normalize_nuget_version;
+
+const PACKAGES_LOCK: &str = "packages.lock.json";
+const NUGET_ORG_INDEX: &str = "https://api.nuget.org/v3/index.json";
+
+fn is_nuget_org(url: &str) -> bool {
+    url.trim()
+        .trim_end_matches('/')
+        .eq_ignore_ascii_case(NUGET_ORG_INDEX)
+}
+
+/// The config's first quoted value of `attr` inside the tag text `tag`.
+fn attr_value(tag: &str, attr: &str) -> Option<String> {
+    let re = Regex::new(&format!(
+        r#"\s{attr}\s*=\s*(?:"([^"]*)"|'([^']*)')"#,
+        attr = regex::escape(attr)
+    ))
+    .expect("escaped attribute regex is valid");
+    re.captures(tag)
+        .and_then(|c| c.get(1).or_else(|| c.get(2)))
+        .map(|m| m.as_str().to_string())
+}
+
+/// Remove one pin's source definition and mapping, each with the line
+/// break before it (the rewriter's own insertion).
+fn remove_source(config: &str, uuid: &str, id: &str, ctx: &Ctx<'_>) -> Result<String, String> {
+    let key = format!("socket-patch-{uuid}");
+    let quoted = format!(r#"(?:"{k}"|'{k}')"#, k = regex::escape(&key));
+    let add_re = Regex::new(&format!(
+        r"(?:\r?\n[ \t]*)?<add\s[^>]*?key\s*=\s*{quoted}[^>]*?/>"
+    ))
+    .expect("escaped add regex is valid");
+    let adds: Vec<(usize, usize)> = add_re
+        .find_iter(config)
+        .filter(|m| {
+            attr_value(m.as_str(), "value")
+                .and_then(|v| ctx.hosted_uuid(&v))
+                .as_deref()
+                == Some(uuid)
+        })
+        .map(|m| (m.start(), m.end()))
+        .collect();
+    let [(add_start, add_end)] = adds[..] else {
+        return Err(format!(
+            "the config does not define the Socket source {key} exactly once"
+        ));
+    };
+    let mut out = format!("{}{}", &config[..add_start], &config[add_end..]);
+
+    let map_re = Regex::new(&format!(
+        r"(?s)(?:\r?\n[ \t]*)?<packageSource\s+key\s*=\s*{quoted}\s*>(.*?)</packageSource\s*>"
+    ))
+    .expect("escaped packageSource regex is valid");
+    let maps: Vec<regex::Captures<'_>> = map_re.captures_iter(&out).collect();
+    let [only] = &maps[..] else {
+        return Err(format!("the config does not map {key} exactly once"));
+    };
+    let pattern_re = Regex::new(r#"<package\s+pattern\s*=\s*(?:"([^"]*)"|'([^']*)')\s*/>"#)
+        .expect("static package-pattern regex is valid");
+    let patterns: Vec<String> = pattern_re
+        .captures_iter(&only[1])
+        .filter_map(|c| {
+            c.get(1)
+                .or_else(|| c.get(2))
+                .map(|m| m.as_str().trim().to_string())
+        })
+        .collect();
+    if !matches!(&patterns[..], [p] if p.eq_ignore_ascii_case(id)) {
+        return Err(format!(
+            "the config maps {key} to {patterns:?}, not to the one package {id}"
+        ));
+    }
+    let whole = only.get(0).expect("group 0 always matches");
+    out = format!("{}{}", &out[..whole.start()], &out[whole.end()..]);
+    if out.contains(&key) {
+        return Err(format!("the config still names {key} elsewhere"));
+    }
+    Ok(out)
+}
+
+/// Drop a `<packageSourceMapping>` that no longer routes anything: empty,
+/// or a `*` fan-out for exactly every remaining source.
+fn drop_fanout_mapping(config: &str) -> String {
+    let Some(cfg) = parse_config(config) else {
+        return config.to_string();
+    };
+    let mut mapped: Vec<&str> = cfg.mappings.iter().map(|(k, _)| k.as_str()).collect();
+    let mut sources: Vec<&str> = cfg.sources.iter().map(|(k, _)| k.as_str()).collect();
+    mapped.sort_unstable();
+    sources.sort_unstable();
+    let fanout_only = cfg
+        .mappings
+        .iter()
+        .all(|(_, patterns)| matches!(&patterns[..], [p] if p == "*"));
+    if !(cfg.mappings.is_empty() || (fanout_only && mapped == sources)) {
+        return config.to_string();
+    }
+    let re = Regex::new(r"(?s)<packageSourceMapping\s*>.*?</packageSourceMapping\s*>")
+        .expect("static packageSourceMapping regex is valid");
+    let found: Vec<(usize, usize)> = re.find_iter(config).map(|m| (m.start(), m.end())).collect();
+    let [(start, end)] = found[..] else {
+        return config.to_string();
+    };
+    // The whole lines when the element has them to itself.
+    let line_start = config[..start].rfind('\n').map_or(0, |i| i + 1);
+    let tail = &config[end..];
+    let eol = if tail.starts_with("\r\n") {
+        2
+    } else if tail.starts_with('\n') {
+        1
+    } else {
+        0
+    };
+    if config[line_start..start].trim().is_empty() && eol > 0 {
+        format!("{}{}", &config[..line_start], &config[end + eol..])
+    } else {
+        format!("{}{}", &config[..start], tail)
+    }
+}
+
+/// Does `pattern` route `id`, and how specifically (NuGet: an exact id
+/// beats the longest `prefix*`, which beats `*`)?
+fn pattern_score(pattern: &str, id: &str) -> Option<usize> {
+    match pattern.strip_suffix('*') {
+        Some(prefix) => (id.len() >= prefix.len()
+            && id[..prefix.len()].eq_ignore_ascii_case(prefix))
+        .then_some(prefix.len()),
+        None => pattern.eq_ignore_ascii_case(id).then_some(usize::MAX),
+    }
+}
+
+/// `Ok` when the restored config resolves `id` from nuget.org alone.
+fn check_upstream_feed(cfg: &NugetConfig, id: &str, config_rel: &str) -> Result<(), String> {
+    let enabled: Vec<&(String, String)> = cfg
+        .sources
+        .iter()
+        .filter(|(k, _)| !cfg.disabled.contains(k))
+        .collect();
+    let candidates: Vec<&(String, String)> = if cfg.mappings.is_empty() {
+        enabled
+    } else {
+        let scored: Vec<(usize, &str)> = cfg
+            .mappings
+            .iter()
+            .filter_map(|(key, patterns)| {
+                patterns
+                    .iter()
+                    .filter_map(|p| pattern_score(p, id))
+                    .max()
+                    .map(|s| (s, key.as_str()))
+            })
+            .collect();
+        let Some(best) = scored.iter().map(|(s, _)| *s).max() else {
+            return Err(format!("no package source in {config_rel} maps {id}"));
+        };
+        enabled
+            .into_iter()
+            .filter(|(k, _)| scored.iter().any(|(s, key)| *s == best && key == k))
+            .collect()
+    };
+    // No source at all: NuGet falls back to the user-level default, nuget.org.
+    if candidates.iter().all(|(_, url)| is_nuget_org(url)) {
+        return Ok(());
+    }
+    let names: Vec<String> = candidates
+        .iter()
+        .map(|(k, url)| format!("{k} ({url})"))
+        .collect();
+    Err(format!(
+        "{id} resolves from {} under {config_rel}, not from nuget.org alone, so the original \
+         contentHash cannot be re-derived",
+        names.join(", ")
+    ))
+}
+
+pub(crate) async fn restore(
+    view: &mut View<'_>,
+    pins: &[&HostedPin],
+    files: &[String],
+    ctx: &Ctx<'_>,
+) -> FormatResult {
+    let mut result = FormatResult::default();
+    let pins = by_uuid(pins);
+    for rel in files {
+        let (dir, leaf) = match rel.rsplit_once('/') {
+            Some((d, l)) => (format!("{d}/"), l),
+            None => (String::new(), rel.as_str()),
+        };
+        if leaf == PACKAGES_LOCK {
+            // Restored together with the config that wires it; a pin no
+            // config claims is refused by the driver.
+            continue;
+        }
+        let Some(original) = read_or_refuse(view, rel, &pins, &mut result).await else {
+            continue;
+        };
+        let wired: Vec<&HostedPin> = pins
+            .values()
+            .copied()
+            .filter(|p| p.files.contains(rel))
+            .collect();
+        let mut text = original.clone();
+        let mut restored: Vec<(&HostedPin, String, String)> = Vec::new();
+        for pin in &wired {
+            let Some((id, version)) = pin.name_version() else {
+                result.refuse(&pin.uuid, format!("{} is not a NuGet purl", pin.purl));
+                continue;
+            };
+            match remove_source(&text, &pin.uuid, &id, ctx) {
+                Ok(next) => {
+                    text = next;
+                    restored.push((pin, id, version));
+                }
+                Err(why) => result.refuse(&pin.uuid, format!("{rel}: {why}")),
+            }
+        }
+        if restored.is_empty() {
+            continue;
+        }
+        text = drop_fanout_mapping(&text);
+        let Some(cfg) = parse_config(&text) else {
+            refuse_all_in(
+                &pins,
+                rel,
+                &mut result,
+                format!("restoring {rel} would not leave well-formed XML"),
+            );
+            continue;
+        };
+
+        let lock_rel = format!("{dir}{PACKAGES_LOCK}");
+        let lock_text = match view.read(&lock_rel).await {
+            Ok(t) => t,
+            Err(e) => {
+                refuse_all_in(&pins, rel, &mut result, e);
+                continue;
+            }
+        };
+        let mut lock: Option<Value> = match lock_text.as_deref().map(serde_json::from_str) {
+            None => None,
+            Some(Ok(v)) => Some(v),
+            Some(Err(_)) => {
+                refuse_all_in(
+                    &pins,
+                    rel,
+                    &mut result,
+                    format!("{lock_rel} is not valid JSON"),
+                );
+                continue;
+            }
+        };
+        for (pin, id, version) in &restored {
+            let Some(lock) = lock.as_mut() else {
+                continue;
+            };
+            let entries: Vec<&mut serde_json::Map<String, Value>> = lock
+                .get_mut("dependencies")
+                .and_then(Value::as_object_mut)
+                .into_iter()
+                .flat_map(|fws| fws.values_mut())
+                .filter_map(Value::as_object_mut)
+                .flat_map(|fw| fw.iter_mut())
+                .filter(|(k, _)| k.eq_ignore_ascii_case(id))
+                .filter_map(|(_, e)| e.as_object_mut())
+                .filter(|e| e.contains_key("contentHash"))
+                .collect();
+            if entries.is_empty() {
+                continue;
+            }
+            if let Err(why) = check_upstream_feed(&cfg, id, rel) {
+                result.refuse(&pin.uuid, why);
+                continue;
+            }
+            let norm = normalize_nuget_version(version);
+            let hash = match ctx.client.nuget_content_hash(id, &norm).await {
+                Ok(h) => h,
+                Err(why) => {
+                    result.refuse(&pin.uuid, format!("{id} {version}: {why}"));
+                    continue;
+                }
+            };
+            for entry in entries {
+                let keeps_resolved = entry
+                    .get("resolved")
+                    .and_then(Value::as_str)
+                    .is_some_and(|r| normalize_nuget_version(r).eq_ignore_ascii_case(&norm));
+                if !keeps_resolved {
+                    entry.insert("resolved".into(), Value::String(norm.clone()));
+                }
+                entry.insert("contentHash".into(), Value::String(hash.clone()));
+            }
+        }
+        // A refusal in this file reruns the pass without that pin; write
+        // only a file every wired pin restored in.
+        if restored
+            .iter()
+            .any(|(p, ..)| result.refused.contains_key(&p.uuid))
+        {
+            continue;
+        }
+        if text == super::super::default_nuget_config() {
+            result.warnings.push((
+                "nuget_default_config_left",
+                format!(
+                    "{rel} now holds only the nuget.org source; if hosted mode created it, \
+                     delete it"
+                ),
+            ));
+        }
+        view.write(rel, text);
+        if let (Some(lock), Some(before)) = (lock, lock_text) {
+            let after = super::super::serialize_json(&lock);
+            if serde_json::from_str::<Value>(&before).ok().as_ref() != Some(&lock) {
+                view.write(&lock_rel, after);
+            }
+        }
+        result
+            .handled
+            .extend(restored.iter().map(|(p, ..)| p.uuid.clone()));
+    }
+    result
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn pattern_scores_follow_nuget_precedence() {
+        assert_eq!(pattern_score("*", "Newtonsoft.Json"), Some(0));
+        assert_eq!(pattern_score("Newtonsoft.*", "newtonsoft.json"), Some(11));
+        assert_eq!(
+            pattern_score("newtonsoft.json", "Newtonsoft.Json"),
+            Some(usize::MAX)
+        );
+        assert_eq!(pattern_score("Contoso.*", "Newtonsoft.Json"), None);
+        assert_eq!(
+            pattern_score("Newtonsoft.Json.Bson", "Newtonsoft.Json"),
+            None
+        );
+    }
+
+    fn cfg(text: &str) -> NugetConfig {
+        parse_config(text).unwrap()
+    }
+
+    #[test]
+    fn upstream_feed_must_be_nuget_org_alone() {
+        let only_org = cfg(
+            r#"<configuration><packageSources><add key="nuget.org" value="https://api.nuget.org/v3/index.json/" /></packageSources></configuration>"#,
+        );
+        assert!(check_upstream_feed(&only_org, "A", "nuget.config").is_ok());
+        let none = cfg("<configuration></configuration>");
+        assert!(check_upstream_feed(&none, "A", "nuget.config").is_ok());
+        let two = cfg(
+            r#"<configuration><packageSources><add key="nuget.org" value="https://api.nuget.org/v3/index.json" /><add key="corp" value="https://corp/v3/index.json" /></packageSources></configuration>"#,
+        );
+        let why = check_upstream_feed(&two, "A", "nuget.config").unwrap_err();
+        assert!(why.contains("corp (https://corp/v3/index.json)"), "{why}");
+        // A mapping that routes the id to nuget.org only settles it.
+        let mapped = cfg(
+            r#"<configuration><packageSources><add key="nuget.org" value="https://api.nuget.org/v3/index.json" /><add key="corp" value="https://corp/v3/index.json" /></packageSources><packageSourceMapping><packageSource key="nuget.org"><package pattern="A" /></packageSource><packageSource key="corp"><package pattern="*" /></packageSource></packageSourceMapping></configuration>"#,
+        );
+        assert!(check_upstream_feed(&mapped, "a", "nuget.config").is_ok());
+        let why = check_upstream_feed(&mapped, "B", "nuget.config").unwrap_err();
+        assert!(why.contains("corp"), "{why}");
+        // A disabled second source is not a candidate.
+        let disabled = cfg(
+            r#"<configuration><packageSources><add key="nuget.org" value="https://api.nuget.org/v3/index.json" /><add key="corp" value="https://corp/v3/index.json" /></packageSources><disabledPackageSources><add key="corp" value="true" /></disabledPackageSources></configuration>"#,
+        );
+        assert!(check_upstream_feed(&disabled, "A", "nuget.config").is_ok());
+        let unmapped = cfg(
+            r#"<configuration><packageSources><add key="nuget.org" value="https://api.nuget.org/v3/index.json" /></packageSources><packageSourceMapping><packageSource key="nuget.org"><package pattern="Other" /></packageSource></packageSourceMapping></configuration>"#,
+        );
+        assert!(check_upstream_feed(&unmapped, "A", "nuget.config")
+            .unwrap_err()
+            .contains("maps"));
+    }
+
+    #[test]
+    fn fanout_mapping_is_dropped_only_when_it_routes_nothing() {
+        let fanout = "<configuration>\n  <packageSources>\n    <add key=\"a\" value=\"https://a/\" />\n  </packageSources>\n  <packageSourceMapping>\n    <packageSource key=\"a\">\n      <package pattern=\"*\" />\n    </packageSource>\n  </packageSourceMapping>\n</configuration>\n";
+        assert_eq!(
+            drop_fanout_mapping(fanout),
+            "<configuration>\n  <packageSources>\n    <add key=\"a\" value=\"https://a/\" />\n  </packageSources>\n</configuration>\n"
+        );
+        // A second source without a fan-out is excluded by the mapping.
+        let partial = fanout.replace(
+            "  </packageSources>",
+            "    <add key=\"b\" value=\"https://b/\" />\n  </packageSources>",
+        );
+        assert_eq!(drop_fanout_mapping(&partial), partial);
+        // A real pattern keeps it.
+        let pinned = fanout.replace("pattern=\"*\"", "pattern=\"Foo.*\"");
+        assert_eq!(drop_fanout_mapping(&pinned), pinned);
+    }
+
+    use super::super::{restore_upstream, HostedPin, PinStatus, RestoreOptions, RestoreOutcome};
+    use wiremock::matchers::{method, path};
+    use wiremock::{Mock, MockServer, ResponseTemplate};
+
+    const UUID: &str = "66666666-6666-6666-6666-666666666666";
+    const UPSTREAM: &str =
+        "ckEKf1MtNHGmiyXVMOQUWA1NhmENd95EZ8h2znGTaccCdgF/RgjlfKWRH+iEdgEx68wOpY+UFhWisuq3tHFA==";
+    const PATCHED: &str = "PATCHEDcontenthashPATCHEDcontenthashAA==";
+
+    fn index_url() -> String {
+        format!(
+            "https://patch.socket.dev/patch-registry/nuget/11111111-1111-1111-1111-111111111111/{UUID}/index.json"
+        )
+    }
+
+    /// What `rewrite_nuget` makes of `config` for Newtonsoft.Json.
+    fn hosted_config(config: &str) -> String {
+        super::super::super::add_nuget_source(
+            config,
+            &format!("socket-patch-{UUID}"),
+            &index_url(),
+            "Newtonsoft.Json",
+        )
+        .unwrap()
+    }
+
+    fn lock(hash: &str) -> String {
+        format!(
+            "{{\n  \"version\": 1,\n  \"dependencies\": {{\n    \"net6.0\": {{\n      \"Newtonsoft.Json\": {{\n        \"type\": \"Direct\",\n        \"requested\": \"[13.0.3, )\",\n        \"resolved\": \"13.0.3\",\n        \"contentHash\": \"{hash}\"\n      }}\n    }},\n    \"net8.0\": {{\n      \"newtonsoft.json\": {{\n        \"type\": \"Transitive\",\n        \"resolved\": \"13.0.3\",\n        \"contentHash\": \"{hash}\"\n      }}\n    }}\n  }}\n}}\n"
+        )
+    }
+
+    async fn nuget_org() -> MockServer {
+        let server = MockServer::start().await;
+        let catalog = format!("{}/catalog0/data/newtonsoft.json.13.0.3.json", server.uri());
+        Mock::given(method("GET"))
+            .and(path(
+                "/v3/registration5-gz-semver2/newtonsoft.json/13.0.3.json",
+            ))
+            .respond_with(
+                ResponseTemplate::new(200)
+                    .set_body_json(serde_json::json!({ "catalogEntry": catalog })),
+            )
+            .mount(&server)
+            .await;
+        Mock::given(method("GET"))
+            .and(path("/catalog0/data/newtonsoft.json.13.0.3.json"))
+            .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+                "id": "Newtonsoft.Json",
+                "version": "13.0.3",
+                "packageHash": UPSTREAM,
+                "packageHashAlgorithm": "SHA512",
+            })))
+            .mount(&server)
+            .await;
+        server
+    }
+
+    /// Restore the Newtonsoft.Json pin over `config` + `lock(PATCHED)`.
+    async fn run(config: &str, offline: bool) -> (RestoreOutcome, String, String) {
+        let server = nuget_org().await;
+        std::env::set_var("SOCKET_NUGET_URL", server.uri());
+        let tmp = tempfile::tempdir().unwrap();
+        std::fs::write(tmp.path().join("nuget.config"), config).unwrap();
+        std::fs::write(tmp.path().join(PACKAGES_LOCK), lock(PATCHED)).unwrap();
+        let pins = [HostedPin {
+            purl: "pkg:nuget/Newtonsoft.Json@13.0.3".into(),
+            uuid: UUID.into(),
+            files: vec!["nuget.config".into()],
+        }];
+        let opts = RestoreOptions {
+            offline,
+            ..RestoreOptions::default()
+        };
+        let outcome = restore_upstream(tmp.path(), &pins, &opts).await;
+        std::env::remove_var("SOCKET_NUGET_URL");
+        let read = |rel: &str| std::fs::read_to_string(tmp.path().join(rel)).unwrap();
+        (outcome, read("nuget.config"), read(PACKAGES_LOCK))
+    }
+
+    const USER_MAPPING: &str = "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<configuration>\n  <packageSources>\n    <add key=\"nuget.org\" value=\"https://api.nuget.org/v3/index.json\" />\n    <add key=\"corp\" value=\"https://corp.example/v3/index.json\" />\n  </packageSources>\n  <packageSourceMapping>\n    <packageSource key=\"nuget.org\">\n      <package pattern=\"*\" />\n    </packageSource>\n    <packageSource key=\"corp\">\n      <package pattern=\"Contoso.*\" />\n    </packageSource>\n  </packageSourceMapping>\n</configuration>\n";
+
+    #[tokio::test]
+    #[serial_test::serial]
+    async fn an_existing_mapping_keeps_the_users_entries() {
+        let (outcome, config, lock_after) = run(&hosted_config(USER_MAPPING), false).await;
+        assert_eq!(
+            outcome.pins[0].status,
+            PinStatus::Restored,
+            "{:?}",
+            outcome.pins
+        );
+        assert_eq!(config, USER_MAPPING);
+        assert_eq!(lock_after, lock(UPSTREAM));
+        assert!(outcome.warnings.is_empty(), "{:?}", outcome.warnings);
+    }
+
+    #[tokio::test]
+    #[serial_test::serial]
+    async fn a_config_created_from_scratch_is_kept_and_warned() {
+        let default = super::super::super::default_nuget_config();
+        let (outcome, config, lock_after) = run(&hosted_config(&default), false).await;
+        assert_eq!(outcome.pins[0].status, PinStatus::Restored);
+        assert_eq!(config, default);
+        assert_eq!(lock_after, lock(UPSTREAM));
+        assert!(outcome
+            .warnings
+            .iter()
+            .any(|(code, _)| *code == "nuget_default_config_left"));
+    }
+
+    #[tokio::test]
+    #[serial_test::serial]
+    async fn refusals_change_nothing() {
+        let routed_to_corp = USER_MAPPING.replace("Contoso.*", "Newtonsoft.*");
+        let two_patterns = hosted_config(USER_MAPPING).replace(
+            "<package pattern=\"Newtonsoft.Json\" />",
+            "<package pattern=\"Newtonsoft.Json\" />\n      <package pattern=\"Other\" />",
+        );
+        let cases = [
+            (hosted_config(USER_MAPPING), true, "offline"),
+            (
+                hosted_config(&routed_to_corp),
+                false,
+                "corp (https://corp.example/v3/index.json)",
+            ),
+            (two_patterns, false, "not to the one package"),
+            (
+                USER_MAPPING.to_string(),
+                false,
+                "does not define the Socket source",
+            ),
+        ];
+        for (config, offline, needle) in cases {
+            let (outcome, after, lock_after) = run(&config, offline).await;
+            let PinStatus::Refused(why) = &outcome.pins[0].status else {
+                panic!("{needle}: restored");
+            };
+            assert!(why.contains(needle), "{needle}: {why}");
+            assert!(why.contains("git checkout -- nuget.config"), "{why}");
+            assert_eq!(after, config, "{needle}");
+            assert_eq!(lock_after, lock(PATCHED), "{needle}");
+        }
+    }
+}
diff --git a/crates/socket-patch-core/src/patch/redirect/upstream/pypi.rs b/crates/socket-patch-core/src/patch/redirect/upstream/pypi.rs
new file mode 100644
index 00000000..29d1c394
--- /dev/null
+++ b/crates/socket-patch-core/src/patch/redirect/upstream/pypi.rs
@@ -0,0 +1,1014 @@
+//! PyPI upstream restores for the formats whose hosted rewrite is a single
+//! reference swap: `Pipfile.lock` entries, `requirements.txt` lines and
+//! Hatch's PEP 508 direct references (`pyproject.toml` / `hatch.toml`).
+//! The TOML locks live in [`super::pypi_locks`] (Poetry, PDM) and
+//! [`super::uv`] (uv, PEP 723 script locks, PEP 751 pylock).
+//!
+//! Every restorer rewrites ONLY the entries whose reference is a hosted URL
+//! naming an in-scope patch uuid; the version is the pin's (the hosted
+//! rewriters drop every `==` pin, and discovery reads it back from the
+//! url). Hashes are re-resolved from PyPI's JSON API
+//! ([`super::client::UpstreamClient::pypi_files`]): every release file,
+//! sorted by filename — what Pipenv and pip-compile record.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use regex::Regex;
+use serde_json::{json, Value};
+use toml_edit::{DocumentMut, Item};
+
+use super::client::PypiFile;
+use super::{Ctx, FormatResult, HostedPin, View};
+use crate::crawlers::python_crawler::canonicalize_pypi_name;
+use crate::utils::python_lock::preserve_line_endings;
+use crate::vendor::common::pep508_name;
+
+/// The pins by uuid.
+pub(super) fn by_uuid<'p>(pins: &[&'p HostedPin]) -> BTreeMap<&'p str, &'p HostedPin> {
+    pins.iter().map(|p| (p.uuid.as_str(), *p)).collect()
+}
+
+/// The in-scope pin a hosted `location` names.
+pub(super) fn pin_of<'p>(
+    location: &str,
+    pins: &BTreeMap<&str, &'p HostedPin>,
+    ctx: &Ctx<'_>,
+) -> Option<&'p HostedPin> {
+    let uuid = ctx.hosted_uuid(location)?;
+    pins.get(uuid.as_str()).copied()
+}
+
+/// `(canonical name, version)` of a pin, or its refusal.
+pub(super) fn pin_coords(pin: &HostedPin, result: &mut FormatResult) -> Option<(String, String)> {
+    match pin.name_version() {
+        Some((name, version)) => Some((canonicalize_pypi_name(&name), version)),
+        None => {
+            result.refuse(&pin.uuid, format!("{} is not a pypi purl", pin.purl));
+            None
+        }
+    }
+}
+
+/// Read `rel` through the view; a missing or unreadable file refuses every
+/// pin discovery found in it.
+pub(super) async fn read_or_refuse(
+    view: &mut View<'_>,
+    rel: &str,
+    pins: &BTreeMap<&str, &HostedPin>,
+    result: &mut FormatResult,
+) -> Option<String> {
+    match view.read(rel).await {
+        Ok(Some(text)) => Some(text),
+        Ok(None) => {
+            refuse_all_in(pins, rel, result, format!("{rel} no longer exists"));
+            None
+        }
+        Err(e) => {
+            refuse_all_in(pins, rel, result, e);
+            None
+        }
+    }
+}
+
+pub(super) fn refuse_all_in(
+    pins: &BTreeMap<&str, &HostedPin>,
+    rel: &str,
+    result: &mut FormatResult,
+    why: String,
+) {
+    for pin in pins.values() {
+        if pin.files.iter().any(|f| f == rel) {
+            result.refuse(&pin.uuid, why.clone());
+        }
+    }
+}
+
+/// The release files of every `(uuid, name, version)` wanted, fetched
+/// concurrently and keyed by `(name, version)`. A failed lookup refuses its
+/// pin.
+pub(super) async fn fetch_release_files(
+    wanted: &BTreeSet<(String, String, String)>,
+    ctx: &Ctx<'_>,
+    result: &mut FormatResult,
+) -> BTreeMap<(String, String), Vec<PypiFile>> {
+    let lookups = wanted.iter().map(|(uuid, name, version)| async move {
+        (
+            uuid.clone(),
+            name.clone(),
+            version.clone(),
+            ctx.client.pypi_files(name, version).await,
+        )
+    });
+    let mut out = BTreeMap::new();
+    for (uuid, name, version, files) in futures_util::future::join_all(lookups).await {
+        match files {
+            Ok(files) => {
+                out.insert((name, version), files);
+            }
+            Err(why) => result.refuse(&uuid, format!("{name}=={version}: {why}")),
+        }
+    }
+    out
+}
+
+/// Whether every wheel of a release installs on every platform and every
+/// Python 3 (`py3` in its python tag, `none` ABI, `any` platform), so a
+/// lock that keeps only the files its targets can install — PDM without
+/// `cross_platform`, uv's `requires-python` / environment filtering — still
+/// records all of them. Sdists always qualify.
+pub(super) fn universal_release(files: &[PypiFile]) -> bool {
+    files.iter().all(|f| {
+        let Some(stem) = f.filename.strip_suffix(".whl") else {
+            return true;
+        };
+        let tags: Vec<&str> = stem.rsplitn(4, '-').collect();
+        matches!(tags.as_slice(), [platform, abi, python, _]
+            if *platform == "any" && *abi == "none" && python.split('.').any(|t| t == "py3"))
+    })
+}
+
+/// A TOML basic string.
+pub(super) fn toml_quote(s: &str) -> String {
+    let mut out = String::with_capacity(s.len() + 2);
+    out.push('"');
+    for c in s.chars() {
+        match c {
+            '"' => out.push_str("\\\""),
+            '\\' => out.push_str("\\\\"),
+            c if c.is_control() => out.push_str(&format!("\\u{:04X}", c as u32)),
+            c => out.push(c),
+        }
+    }
+    out.push('"');
+    out
+}
+
+/// A TOML value parsed from `text`, keeping its own layout; its outer
+/// decor is cleared so it renders after `key = ` like any other value.
+pub(super) fn toml_value(text: &str) -> Option<toml_edit::Value> {
+    let doc: DocumentMut = format!("v = {text}\n").parse().ok()?;
+    let mut value = doc.get("v")?.as_value()?.clone();
+    value.decor_mut().clear();
+    Some(value)
+}
+
+/// `entries` as the multi-line array Poetry and PDM write (4-space indent,
+/// trailing comma; `[]` when empty).
+pub(super) fn multiline_toml_array(entries: &[String]) -> String {
+    if entries.is_empty() {
+        return "[]".to_string();
+    }
+    let mut out = String::from("[\n");
+    for entry in entries {
+        out.push_str("    ");
+        out.push_str(entry);
+        out.push_str(",\n");
+    }
+    out.push(']');
+    out
+}
+
+// ── Pipfile.lock ─────────────────────────────────────────────────────────────
+
+/// Whether `url` is PyPI's simple index (the only upstream the restore can
+/// re-derive hashes for).
+pub(super) fn is_pypi_simple(url: &str) -> bool {
+    matches!(
+        url.trim()
+            .trim_end_matches('/')
+            .to_ascii_lowercase()
+            .as_str(),
+        "https://pypi.org/simple" | "https://pypi.python.org/simple"
+    )
+}
+
+/// Whether the registry entry restored for `name` resolves from PyPI (the
+/// only upstream whose hashes the restore can re-derive). The hosted
+/// rewrite keeps the entry's `index` exactly as Pipenv wrote it, so the
+/// restore never picks one: `entry_index` is carried back verbatim and only
+/// checked here. Pipenv records `index` by release, Pipfile spelling and
+/// locking environment (2022.12.19 writes it for an `extras` table and
+/// 2026.8.0 does not; neither for a marker-excluded or a transitive
+/// package) — nothing the lock's other entries could reveal.
+fn pipenv_index_is_pypi(
+    doc: &Value,
+    entry_index: Option<&str>,
+    pipfile: Option<&str>,
+    name: &str,
+) -> Result<(), String> {
+    let sources: Vec<(&str, &str)> = doc
+        .pointer("/_meta/sources")
+        .and_then(Value::as_array)
+        .into_iter()
+        .flatten()
+        .filter_map(|s| {
+            Some((
+                s.get("name").and_then(Value::as_str)?,
+                s.get("url").and_then(Value::as_str)?,
+            ))
+        })
+        .collect();
+    if !sources.iter().any(|(_, url)| is_pypi_simple(url)) {
+        return Err(format!(
+            "no package index in Pipfile.lock `_meta.sources` is PyPI ({}), so the \
+             upstream hashes cannot be re-derived",
+            sources
+                .iter()
+                .map(|(_, u)| *u)
+                .collect::<Vec<_>>()
+                .join(", ")
+        ));
+    }
+    let is_pypi = |index: &str| {
+        sources
+            .iter()
+            .any(|(n, url)| *n == index && is_pypi_simple(url))
+    };
+    if let Some(index) = entry_index {
+        if !is_pypi(index) {
+            return Err(format!(
+                "Pipfile.lock installs {name} from index {index:?}, not PyPI"
+            ));
+        }
+    }
+    if let Some(explicit) = pipfile.and_then(|p| pipfile_explicit_index(p, name)) {
+        if !is_pypi(&explicit) {
+            return Err(format!(
+                "the Pipfile installs {name} from index {explicit:?}, not PyPI"
+            ));
+        }
+    }
+    Ok(())
+}
+
+/// The `index = "…"` a Pipfile declares for `name` in any package category.
+fn pipfile_explicit_index(pipfile: &str, name: &str) -> Option<String> {
+    let doc: DocumentMut = pipfile.trim_start_matches('\u{feff}').parse().ok()?;
+    let canon = canonicalize_pypi_name(name);
+    for (category, table) in doc.iter() {
+        if matches!(category, "source" | "requires" | "pipenv" | "scripts") {
+            continue;
+        }
+        let Some(table) = table.as_table_like() else {
+            continue;
+        };
+        for (key, item) in table.iter() {
+            if canonicalize_pypi_name(key) != canon {
+                continue;
+            }
+            if let Some(index) = item
+                .as_table_like()
+                .and_then(|t| t.get("index"))
+                .and_then(Item::as_str)
+            {
+                return Some(index.to_string());
+            }
+        }
+    }
+    None
+}
+
+/// One hosted `Pipfile.lock` entry.
+struct PipenvHit {
+    /// Index into the lock's `pipenv::entries`.
+    entry: usize,
+    uuid: String,
+    name: String,
+    version: String,
+}
+
+pub(crate) async fn restore_pipfile_lock(
+    view: &mut View<'_>,
+    pins: &[&HostedPin],
+    files: &[String],
+    ctx: &Ctx<'_>,
+) -> FormatResult {
+    let mut result = FormatResult::default();
+    let pins = by_uuid(pins);
+    for rel in files {
+        let Some(text) = read_or_refuse(view, rel, &pins, &mut result).await else {
+            continue;
+        };
+        let (entries, doc) = match (
+            super::super::pipenv::entries(&text),
+            crate::vendor::lock_inventory::pypi::parse_pipfile_lock(&text),
+        ) {
+            (Ok(entries), Ok(doc)) => (entries, doc),
+            (Err(e), _) => {
+                refuse_all_in(&pins, rel, &mut result, format!("{rel}: {e}"));
+                continue;
+            }
+            (_, Err(e)) => {
+                refuse_all_in(
+                    &pins,
+                    rel,
+                    &mut result,
+                    format!("{rel} is not valid JSON: {e}"),
+                );
+                continue;
+            }
+        };
+        let mut hits: Vec<PipenvHit> = Vec::new();
+        for (i, (_, entry)) in entries.iter().enumerate() {
+            let Some(object) = entry.value.as_object() else {
+                continue;
+            };
+            let reference = object
+                .get("file")
+                .or_else(|| object.get("path"))
+                .and_then(Value::as_str);
+            let Some(pin) = reference.and_then(|r| pin_of(r, &pins, ctx)) else {
+                continue;
+            };
+            let Some((_, version)) = pin_coords(pin, &mut result) else {
+                continue;
+            };
+            if object.contains_key("file") && object.contains_key("path") {
+                result.refuse(
+                    &pin.uuid,
+                    format!("{rel}: {} carries both `file` and `path`", entry.name),
+                );
+                continue;
+            }
+            if let Some(pinned) = object.get("version").and_then(Value::as_str) {
+                if pinned != format!("=={version}") {
+                    result.refuse(
+                        &pin.uuid,
+                        format!(
+                            "{rel}: {} pins {pinned} beside the hosted {version} reference",
+                            entry.name
+                        ),
+                    );
+                    continue;
+                }
+            }
+            hits.push(PipenvHit {
+                entry: i,
+                uuid: pin.uuid.clone(),
+                name: entry.name.clone(),
+                version,
+            });
+        }
+        if hits.is_empty() {
+            continue;
+        }
+        let pipfile_rel = match rel.rsplit_once('/') {
+            Some((dir, _)) => format!("{dir}/Pipfile"),
+            None => "Pipfile".to_string(),
+        };
+        let pipfile = view.read(&pipfile_rel).await.ok().flatten();
+        let wanted = hits
+            .iter()
+            .filter(|h| !result.refused.contains_key(&h.uuid))
+            .map(|h| {
+                (
+                    h.uuid.clone(),
+                    canonicalize_pypi_name(&h.name),
+                    h.version.clone(),
+                )
+            })
+            .collect();
+        let released = fetch_release_files(&wanted, ctx, &mut result).await;
+        let mut splices: Vec<(std::ops::Range<usize>, String, String)> = Vec::new();
+        for hit in &hits {
+            if result.refused.contains_key(&hit.uuid) {
+                continue;
+            }
+            let (_, entry) = &entries[hit.entry];
+            let mut object = entry.value.as_object().cloned().unwrap_or_default();
+            // `index` (and every other key but the reference, `version` and
+            // `hashes`) is carried back as the entry holds it: the hosted
+            // rewrite left Pipenv's own value, and a relock hybrid (Pipenv
+            // 2023+ keeps our reference on a marker-excluded entry and
+            // restores `version`/`hashes` around it) holds what Pipenv
+            // just wrote.
+            let entry_index = object.get("index").and_then(Value::as_str);
+            if let Err(why) = pipenv_index_is_pypi(&doc, entry_index, pipfile.as_deref(), &hit.name)
+            {
+                result.refuse(&hit.uuid, format!("{rel}: {why}"));
+                continue;
+            }
+            let Some(release) =
+                released.get(&(canonicalize_pypi_name(&hit.name), hit.version.clone()))
+            else {
+                continue;
+            };
+            object.remove("file");
+            object.remove("path");
+            object.insert("version".into(), json!(format!("=={}", hit.version)));
+            let mut hashes: Vec<String> = release
+                .iter()
+                .map(|f| format!("sha256:{}", f.sha256))
+                .collect();
+            hashes.sort();
+            hashes.dedup();
+            object.insert("hashes".into(), json!(hashes));
+            let mut value = Value::Object(object);
+            value.sort_all_objects();
+            match super::super::pipenv::format_entry(&value, &text, entry.range.start) {
+                Ok(rendered) => splices.push((entry.range.clone(), rendered, hit.uuid.clone())),
+                Err(e) => result.refuse(&hit.uuid, format!("{rel}: {e}")),
+            }
+        }
+        let mut next = text.clone();
+        splices.sort_by_key(|(range, _, _)| std::cmp::Reverse(range.start));
+        let mut changed = false;
+        for (range, rendered, uuid) in splices {
+            // A pin refused in another entry of this lock stays hosted in all.
+            if result.refused.contains_key(&uuid) {
+                continue;
+            }
+            next.replace_range(range, &rendered);
+            result.handled.insert(uuid);
+            changed = true;
+        }
+        if changed {
+            view.write(rel, next);
+        }
+    }
+    result
+}
+
+// ── requirements.txt ─────────────────────────────────────────────────────────
+
+static HOSTED_LINE_RE: std::sync::LazyLock<Regex> = std::sync::LazyLock::new(|| {
+    Regex::new(r"^([A-Za-z0-9][A-Za-z0-9._-]*)(\s*\[[^\]\r\n]*\])?\s*@\s*(\S+)(.*)$")
+        .expect("static hosted requirement regex is valid")
+});
+
+/// Whether a requirements line carries a `--hash` option.
+fn has_hash_option(tokens: &[&str]) -> bool {
+    tokens
+        .iter()
+        .any(|t| *t == "--hash" || t.starts_with("--hash="))
+}
+
+/// A hosted requirement line, cut into what its registry spelling keeps.
+struct HostedLine {
+    uuid: String,
+    version: String,
+    /// BOM + indentation before the name.
+    prefix: String,
+    name: String,
+    extras: String,
+    marker: String,
+    options: String,
+    comment: String,
+}
+
+/// The in-scope hosted line `requirement` is, if any: `Err((uuid, why))`
+/// when it is one that cannot be restored.
+fn hosted_line(
+    requirement: &super::super::requirements::LogicalRequirement,
+    pins: &BTreeMap<&str, &HostedPin>,
+    ctx: &Ctx<'_>,
+) -> Option<Result<HostedLine, (String, String)>> {
+    use super::super::requirements::{requirement_tokens, unquoted_index};
+    let text = requirement.text.trim();
+    let caps = HOSTED_LINE_RE.captures(text)?;
+    let pin = pin_of(&caps[3], pins, ctx)?;
+    let version = match pin.name_version() {
+        Some((name, version))
+            if canonicalize_pypi_name(&caps[1]) == canonicalize_pypi_name(&name) =>
+        {
+            version
+        }
+        _ => {
+            return Some(Err((
+                pin.uuid.clone(),
+                format!(
+                    "{:?} is wired to the hosted artifact of another package",
+                    &caps[1]
+                ),
+            )))
+        }
+    };
+    let rest = caps.get(4).map_or("", |m| m.as_str());
+    let (body, comment) =
+        unquoted_index(rest, '#', true).map_or((rest, ""), |i| (&rest[..i], &rest[i..]));
+    let tokens = requirement_tokens(body);
+    let marker_len = tokens.iter().take_while(|t| !t.starts_with("--")).count();
+    let marker = tokens[..marker_len].join(" ");
+    let mut options = Vec::new();
+    let mut rest_tokens = tokens[marker_len..].iter();
+    while let Some(token) = rest_tokens.next() {
+        if *token == "--hash" {
+            rest_tokens.next();
+        } else if !token.starts_with("--hash=") {
+            options.push(*token);
+        }
+    }
+    let unprefixed = requirement
+        .original
+        .strip_prefix('\u{feff}')
+        .unwrap_or(&requirement.original);
+    let indent = &unprefixed[..unprefixed.len() - unprefixed.trim_start_matches([' ', '\t']).len()];
+    let bom = if requirement.original.starts_with('\u{feff}') {
+        "\u{feff}"
+    } else {
+        ""
+    };
+    Some(Ok(HostedLine {
+        uuid: pin.uuid.clone(),
+        version,
+        prefix: format!("{bom}{indent}"),
+        name: caps[1].to_string(),
+        extras: caps.get(2).map_or("", |m| m.as_str().trim()).to_string(),
+        marker,
+        options: options.join(" "),
+        comment: comment.trim().to_string(),
+    }))
+}
+
+pub(crate) async fn restore_requirements(
+    view: &mut View<'_>,
+    pins: &[&HostedPin],
+    files: &[String],
+    ctx: &Ctx<'_>,
+) -> FormatResult {
+    use super::super::requirements::{logical_requirements, requirement_tokens};
+    let mut result = FormatResult::default();
+    let pins = by_uuid(pins);
+    for rel in files {
+        let Some(text) = read_or_refuse(view, rel, &pins, &mut result).await else {
+            continue;
+        };
+        let mut requirements = logical_requirements(&text);
+        let mut hits: Vec<(usize, HostedLine)> = Vec::new();
+        // The file's hash-checking mode, read off every line the hosted
+        // rewrite did not write.
+        let (mut require_hashes, mut hashed, mut unhashed) = (false, 0usize, 0usize);
+        // The continuation indent of a hashed line pip-compile style
+        // (`name==v \` then one indented `--hash=…` per line).
+        let mut continuation: Option<String> = None;
+        for (i, requirement) in requirements.iter().enumerate() {
+            match hosted_line(requirement, &pins, ctx) {
+                Some(Ok(line)) => {
+                    hits.push((i, line));
+                    continue;
+                }
+                Some(Err((uuid, why))) => {
+                    result.refuse(&uuid, format!("{rel}: {why}"));
+                    continue;
+                }
+                None => {}
+            }
+            let (code, _) = crate::utils::requirements::split_comment(&requirement.text);
+            let code = code.trim();
+            if code.is_empty() {
+                continue;
+            }
+            let tokens = requirement_tokens(code);
+            if tokens.contains(&"--require-hashes") {
+                require_hashes = true;
+            }
+            if code.starts_with('-') {
+                continue;
+            }
+            // Another pin's hosted line (always hashed) says nothing about
+            // the original mode.
+            if tokens
+                .iter()
+                .any(|t| ctx.hosted_uuid(t.trim_end_matches(';')).is_some())
+            {
+                continue;
+            }
+            if has_hash_option(&tokens) {
+                hashed += 1;
+                if continuation.is_none() {
+                    continuation = requirement
+                        .original
+                        .split('\n')
+                        .nth(1)
+                        .filter(|l| l.trim_start().starts_with("--hash"))
+                        .map(|l| l[..l.len() - l.trim_start().len()].to_string());
+                }
+            } else {
+                unhashed += 1;
+            }
+        }
+        if hits.is_empty() {
+            continue;
+        }
+        let hash_mode = match (require_hashes || hashed > 0, unhashed > 0) {
+            (true, false) => Ok(true),
+            (false, true) => Ok(false),
+            (true, true) => Err(format!(
+                "{rel} mixes hashed and unhashed requirements, so whether the original line \
+                 carried `--hash` options is not derivable"
+            )),
+            (false, false) => Err(format!(
+                "every requirement in {rel} is a hosted pin, so whether the original used pip's \
+                 hash-checking mode (`--hash`) is not derivable"
+            )),
+        };
+        let hash_mode = match hash_mode {
+            Ok(mode) => mode,
+            Err(why) => {
+                for (_, line) in &hits {
+                    result.refuse(&line.uuid, why.clone());
+                }
+                continue;
+            }
+        };
+        let released = if hash_mode {
+            let wanted = hits
+                .iter()
+                .map(|(_, l)| {
+                    (
+                        l.uuid.clone(),
+                        canonicalize_pypi_name(&l.name),
+                        l.version.clone(),
+                    )
+                })
+                .collect();
+            fetch_release_files(&wanted, ctx, &mut result).await
+        } else {
+            BTreeMap::new()
+        };
+        let eol = if text.contains("\r\n") { "\r\n" } else { "\n" };
+        let mut rewritten: Vec<(usize, String, String)> = Vec::new();
+        for (i, line) in &hits {
+            if result.refused.contains_key(&line.uuid) {
+                continue;
+            }
+            let mut out = format!(
+                "{}{}{}=={}",
+                line.prefix, line.name, line.extras, line.version
+            );
+            for suffix in [&line.marker, &line.options] {
+                if !suffix.is_empty() {
+                    out.push(' ');
+                    out.push_str(suffix);
+                }
+            }
+            if hash_mode {
+                let Some(release) =
+                    released.get(&(canonicalize_pypi_name(&line.name), line.version.clone()))
+                else {
+                    continue;
+                };
+                let mut hashes: Vec<&str> = release.iter().map(|f| f.sha256.as_str()).collect();
+                hashes.sort();
+                hashes.dedup();
+                for hash in hashes {
+                    match &continuation {
+                        Some(indent) => {
+                            out.push_str(&format!(" \\{eol}{indent}--hash=sha256:{hash}"))
+                        }
+                        None => out.push_str(&format!(" --hash=sha256:{hash}")),
+                    }
+                }
+            }
+            if !line.comment.is_empty() {
+                out.push(' ');
+                out.push_str(&line.comment);
+            }
+            rewritten.push((*i, out, line.uuid.clone()));
+        }
+        let mut changed = false;
+        for (i, out, uuid) in rewritten {
+            if result.refused.contains_key(&uuid) {
+                continue;
+            }
+            requirements[i].original = out;
+            result.handled.insert(uuid);
+            changed = true;
+        }
+        if changed {
+            let next: String = requirements
+                .into_iter()
+                .map(|r| r.original + &r.ending)
+                .collect();
+            view.write(rel, next);
+        }
+    }
+    result
+}
+
+// ── Hatch: pyproject.toml / hatch.toml ───────────────────────────────────────
+
+/// `declared[extras] @ <location>[ ; marker]` → `(declared, extras,
+/// location, marker)`.
+fn direct_reference(spec: &str) -> Option<(&str, &str, &str, &str)> {
+    let spec = spec.trim();
+    let declared = pep508_name(spec);
+    if declared.is_empty() {
+        return None;
+    }
+    let mut rest = spec[declared.len()..].trim_start();
+    let mut extras = "";
+    if rest.starts_with('[') {
+        let end = rest.find(']')?;
+        extras = &rest[..=end];
+        rest = rest[end + 1..].trim_start();
+    }
+    let rest = rest.strip_prefix('@')?.trim_start();
+    let end = rest.find(char::is_whitespace).unwrap_or(rest.len());
+    let location = rest[..end].trim_end_matches(';');
+    let after = &rest[location.len()..];
+    let marker = after.trim().strip_prefix(';').map_or("", str::trim);
+    Some((declared, extras, location, marker))
+}
+
+/// Restore every hosted direct reference in one dependency array; the uuids
+/// restored are added to `restored`, a mismatched one refuses.
+fn restore_hatch_array(
+    item: &mut Item,
+    pins: &BTreeMap<&str, &HostedPin>,
+    ctx: &Ctx<'_>,
+    result: &mut FormatResult,
+    restored: &mut BTreeSet<String>,
+) -> usize {
+    let Some(array) = item.as_array_mut() else {
+        return 0;
+    };
+    let mut count = 0;
+    for entry in array.iter_mut() {
+        let Some(spec) = entry.as_str() else {
+            continue;
+        };
+        let Some((declared, extras, location, marker)) = direct_reference(spec) else {
+            continue;
+        };
+        let Some(pin) = pin_of(location, pins, ctx) else {
+            continue;
+        };
+        let Some((name, version)) = pin_coords(pin, result) else {
+            continue;
+        };
+        if canonicalize_pypi_name(declared) != name {
+            result.refuse(
+                &pin.uuid,
+                format!("{declared:?} is wired to the hosted artifact of another package"),
+            );
+            continue;
+        }
+        let mut next = format!("{declared}{extras}=={version}");
+        if !marker.is_empty() {
+            next.push_str(" ; ");
+            next.push_str(marker);
+        }
+        let decor = entry.decor().clone();
+        *entry = toml_edit::Value::from(next);
+        *entry.decor_mut() = decor;
+        restored.insert(pin.uuid.clone());
+        count += 1;
+    }
+    count
+}
+
+/// Every `dependencies` / `extra-dependencies` array of an `envs` table.
+fn restore_hatch_envs(
+    envs: Option<&mut Item>,
+    pins: &BTreeMap<&str, &HostedPin>,
+    ctx: &Ctx<'_>,
+    result: &mut FormatResult,
+    restored: &mut BTreeSet<String>,
+) {
+    let Some(envs) = envs.and_then(Item::as_table_like_mut) else {
+        return;
+    };
+    for (_, env) in envs.iter_mut() {
+        let Some(env) = env.as_table_like_mut() else {
+            continue;
+        };
+        for key in ["dependencies", "extra-dependencies"] {
+            if let Some(item) = env.get_mut(key) {
+                restore_hatch_array(item, pins, ctx, result, restored);
+            }
+        }
+    }
+}
+
+/// Remove `keys`' last table's `allow-direct-references = true` (the Hatch
+/// permission the hosted rewrite set), then every table on the path that is
+/// left empty.
+fn drop_direct_reference_permission(doc: &mut DocumentMut, keys: &[&str]) -> bool {
+    fn walk(table: &mut dyn toml_edit::TableLike, keys: &[&str]) -> bool {
+        let Some((first, rest)) = keys.split_first() else {
+            return table.get("allow-direct-references").and_then(Item::as_bool) == Some(true)
+                && table.remove("allow-direct-references").is_some();
+        };
+        let Some(child) = table.get_mut(first).and_then(Item::as_table_like_mut) else {
+            return false;
+        };
+        let removed = walk(child, rest);
+        if removed && child.is_empty() {
+            table.remove(first);
+        }
+        removed
+    }
+    walk(doc.as_table_mut(), keys)
+}
+
+pub(crate) async fn restore_hatch(
+    view: &mut View<'_>,
+    pins: &[&HostedPin],
+    files: &[String],
+    ctx: &Ctx<'_>,
+) -> FormatResult {
+    use crate::utils::hatch::HATCH_FILES;
+    let mut result = FormatResult::default();
+    let pins = by_uuid(pins);
+    let mut docs: BTreeMap<&str, (String, DocumentMut)> = BTreeMap::new();
+    for rel in HATCH_FILES {
+        let text = if files.iter().any(|f| f == rel) {
+            match read_or_refuse(view, rel, &pins, &mut result).await {
+                Some(text) => text,
+                None => continue,
+            }
+        } else {
+            match view.read(rel).await {
+                Ok(Some(text)) => text,
+                _ => continue,
+            }
+        };
+        match text.trim_start_matches('\u{feff}').parse::<DocumentMut>() {
+            Ok(doc) => {
+                docs.insert(rel, (text, doc));
+            }
+            Err(e) => refuse_all_in(&pins, rel, &mut result, format!("{rel}: {e}")),
+        }
+    }
+    let mut restored: BTreeSet<String> = BTreeSet::new();
+    let mut project_restored = 0;
+    if let Some((_, doc)) = docs.get_mut("pyproject.toml") {
+        if let Some(project) = doc.get_mut("project").and_then(Item::as_table_like_mut) {
+            if let Some(item) = project.get_mut("dependencies") {
+                project_restored +=
+                    restore_hatch_array(item, &pins, ctx, &mut result, &mut restored);
+            }
+            if let Some(groups) = project
+                .get_mut("optional-dependencies")
+                .and_then(Item::as_table_like_mut)
+            {
+                for (_, item) in groups.iter_mut() {
+                    project_restored +=
+                        restore_hatch_array(item, &pins, ctx, &mut result, &mut restored);
+                }
+            }
+        }
+        if let Some(groups) = doc
+            .get_mut("dependency-groups")
+            .and_then(Item::as_table_like_mut)
+        {
+            for (_, item) in groups.iter_mut() {
+                project_restored +=
+                    restore_hatch_array(item, &pins, ctx, &mut result, &mut restored);
+            }
+        }
+        let hatch = doc
+            .get_mut("tool")
+            .and_then(Item::as_table_like_mut)
+            .and_then(|t| t.get_mut("hatch"));
+        restore_hatch_envs(
+            hatch.and_then(|h| h.get_mut("envs")),
+            &pins,
+            ctx,
+            &mut result,
+            &mut restored,
+        );
+    }
+    if let Some((_, doc)) = docs.get_mut("hatch.toml") {
+        restore_hatch_envs(doc.get_mut("envs"), &pins, ctx, &mut result, &mut restored);
+    }
+    // The permission the rewrite set once a PROJECT table got a direct
+    // reference: dropped when none is left there (whatever its prior value,
+    // it then governs nothing).
+    let project_direct = docs.get("pyproject.toml").is_some_and(|(_, doc)| {
+        crate::vendor::common::pyproject_dependency_specs(doc)
+            .into_iter()
+            .any(|(_, spec)| spec.split(';').next().is_some_and(|r| r.contains('@')))
+    });
+    if project_restored > 0 && !project_direct {
+        let external = docs
+            .get("hatch.toml")
+            .is_some_and(|(_, doc)| doc.contains_key("metadata"));
+        let (file, keys): (&str, &[&str]) = if external {
+            ("hatch.toml", &["metadata"])
+        } else {
+            ("pyproject.toml", &["tool", "hatch", "metadata"])
+        };
+        if let Some((_, doc)) = docs.get_mut(file) {
+            drop_direct_reference_permission(doc, keys);
+        }
+    }
+    let restored: BTreeSet<String> = restored
+        .into_iter()
+        .filter(|u| !result.refused.contains_key(u))
+        .collect();
+    if !restored.is_empty() {
+        for (rel, (text, doc)) in docs {
+            let bom = if text.starts_with('\u{feff}') {
+                "\u{feff}"
+            } else {
+                ""
+            };
+            let next = preserve_line_endings(&text, format!("{bom}{doc}"));
+            if next != text {
+                view.write(rel, next);
+            }
+        }
+    }
+    result.handled.extend(restored);
+    result
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn file(name: &str) -> PypiFile {
+        PypiFile {
+            filename: name.into(),
+            url: format!("https://files.example/{name}"),
+            sha256: "a".repeat(64),
+            size: None,
+            upload_time: None,
+        }
+    }
+
+    #[test]
+    fn universal_release_accepts_only_pure_python3_wheels() {
+        assert!(universal_release(&[
+            file("x-1.tar.gz"),
+            file("x-1-py3-none-any.whl")
+        ]));
+        assert!(universal_release(&[file("x-1-py2.py3-none-any.whl")]));
+        assert!(universal_release(&[file("x-1-2-py3-none-any.whl")]));
+        assert!(!universal_release(&[file("x-1-py27-none-any.whl")]));
+        assert!(!universal_release(&[file(
+            "x-1-cp311-cp311-manylinux_2_17_x86_64.whl"
+        )]));
+        assert!(!universal_release(&[file("x-1-py3-abi3-any.whl")]));
+    }
+
+    #[test]
+    fn direct_references_split_like_the_hatch_rewriter_writes_them() {
+        assert_eq!(
+            direct_reference("Urllib3[socks] @ https://h/u.whl#sha256=ab ; python_version >= '3'"),
+            Some((
+                "Urllib3",
+                "[socks]",
+                "https://h/u.whl#sha256=ab",
+                "python_version >= '3'"
+            ))
+        );
+        assert_eq!(
+            direct_reference("urllib3 @ https://h/u.whl"),
+            Some(("urllib3", "", "https://h/u.whl", ""))
+        );
+        assert_eq!(direct_reference("urllib3==1.0"), None);
+    }
+
+    #[test]
+    fn pipenv_index_must_name_pypi_and_is_never_chosen() {
+        let doc = json!({"_meta": {"sources": [
+            {"name": "private", "url": "https://mirror.example/simple"},
+            {"name": "pypi", "url": "https://pypi.org/simple/"},
+        ]}});
+        // The entry's own index (or none at all) is checked, never picked.
+        assert!(pipenv_index_is_pypi(&doc, Some("pypi"), None, "x").is_ok());
+        assert!(pipenv_index_is_pypi(&doc, None, None, "x").is_ok());
+        assert!(pipenv_index_is_pypi(&doc, Some("private"), None, "x")
+            .unwrap_err()
+            .contains("not PyPI"));
+        assert!(pipenv_index_is_pypi(&doc, Some("gone"), None, "x")
+            .unwrap_err()
+            .contains("not PyPI"));
+        let pipfile = "[packages]\nX = { version = \"==1\", index = \"private\" }\n";
+        assert!(pipenv_index_is_pypi(&doc, None, Some(pipfile), "x")
+            .unwrap_err()
+            .contains("the Pipfile installs"));
+        let pipfile = "[packages]\nX = { version = \"==1\", index = \"pypi\" }\n";
+        assert!(pipenv_index_is_pypi(&doc, Some("pypi"), Some(pipfile), "x").is_ok());
+        let mirror = json!({"_meta": {"sources": [{"name": "m", "url": "https://m/simple"}]}});
+        assert!(pipenv_index_is_pypi(&mirror, None, None, "x")
+            .unwrap_err()
+            .contains("is PyPI"));
+        // Two spellings of PyPI: whichever the entry names is PyPI.
+        let twice = json!({"_meta": {"sources": [
+            {"name": "a", "url": "https://pypi.org/simple"},
+            {"name": "b", "url": "https://pypi.python.org/simple"},
+        ]}});
+        assert!(pipenv_index_is_pypi(&twice, Some("b"), None, "x").is_ok());
+    }
+
+    #[test]
+    fn toml_values_keep_their_layout() {
+        let rendered = multiline_toml_array(&[format!(
+            "{{file = {}, hash = \"sha256:ab\"}}",
+            toml_quote("a.whl")
+        )]);
+        let value = toml_value(&rendered).unwrap();
+        let mut doc: DocumentMut = "files = []\n".parse().unwrap();
+        doc["files"] = Item::Value(value);
+        assert_eq!(
+            doc.to_string(),
+            "files = [\n    {file = \"a.whl\", hash = \"sha256:ab\"},\n]\n"
+        );
+        assert_eq!(multiline_toml_array(&[]), "[]");
+        assert_eq!(toml_quote("a\"b\\"), "\"a\\\"b\\\\\"");
+    }
+}
diff --git a/crates/socket-patch-core/src/patch/redirect/upstream/pypi_locks.rs b/crates/socket-patch-core/src/patch/redirect/upstream/pypi_locks.rs
new file mode 100644
index 00000000..ac105569
--- /dev/null
+++ b/crates/socket-patch-core/src/patch/redirect/upstream/pypi_locks.rs
@@ -0,0 +1,403 @@
+//! Poetry and PDM upstream restores.
+//!
+//! * `poetry.lock` (`utils::poetry_lock::rewrite_poetry_lock`): the hosted
+//!   rewrite adds `[package.source] type = "url"` (lock 1.0 also a
+//!   `reference = ""` and a `#sha256=…&` url fragment) and replaces the
+//!   package's files with the patched wheel — `files = [...]` on lock 2.x,
+//!   `[metadata.files].<name>` on 1.0/1.1, where it ALSO adds a package-level
+//!   `files` no Poetry 1.x lock carries. The restore drops the source table
+//!   (a package without one is a PyPI package — the rewriter refuses every
+//!   pre-existing source) and re-derives every release file from PyPI.
+//!   A 1.0/1.1 `[metadata.files]` entry is either every release file (a
+//!   lock written while PyPI's JSON API still fed old Poetry its files) or
+//!   `[]` (what Poetry 1.0/1.1 record against today's PyPI), and the
+//!   registry cannot say which. The rewriter keeps that bit in the patched
+//!   entry's layout (`utils::poetry_lock::legacy_files_entry`): one file
+//!   per line, as Poetry renders a non-empty entry, when the original listed
+//!   files; inline when it was `[]`. The restore reads the layout back and
+//!   writes the full release list or `[]`, so every generation round-trips
+//!   byte-exactly.
+//! * `pdm.lock` (`utils::pdm_lock::rewrite_pdm_lock`): the rewrite adds a
+//!   package `url` and replaces its files, inline or in the lock_version 2
+//!   `[metadata.files]."<name>[extras] <version>"` table, in every extras
+//!   variant. A lock without `cross_platform` keeps only the files its
+//!   targets install; which ones is re-derivable only when every wheel is
+//!   pure Python 3 ([`super::pypi::universal_release`]), otherwise the pin
+//!   is refused.
+//!
+//! Both edit a parsed `toml_edit` document, so every byte outside the
+//! restored package entries is the file's own.
+
+use std::collections::BTreeSet;
+
+use toml_edit::{DocumentMut, Item};
+
+use super::client::PypiFile;
+use super::pypi::{
+    by_uuid, fetch_release_files, multiline_toml_array, pin_of, read_or_refuse, refuse_all_in,
+    toml_quote, toml_value, universal_release,
+};
+use super::{Ctx, FormatResult, HostedPin, View};
+use crate::crawlers::python_crawler::canonicalize_pypi_name;
+use crate::utils::poetry_lock::is_multiline_array;
+use crate::utils::python_lock::preserve_line_endings;
+
+/// One hosted package entry of a TOML lock.
+struct LockHit {
+    /// Index into the lock's `[[package]]` array.
+    index: usize,
+    uuid: String,
+    name: String,
+    version: String,
+}
+
+/// The `files` array value Poetry / PDM write for `release`: one
+/// `{<key> = …, hash = "sha256:…"}` per file.
+fn files_value(release: &[PypiFile], by_url: bool) -> Option<toml_edit::Value> {
+    let key = if by_url { "url" } else { "file" };
+    let mut located: Vec<(&str, &PypiFile)> = release
+        .iter()
+        .map(|f| (if by_url { f.url.as_str() } else { f.filename.as_str() }, f))
+        .collect();
+    // PDM orders each entry's files by the location it writes: a `static_urls`
+    // lock by URL (so an sdist under `0c/…` precedes a wheel under `b0/…`),
+    // a plain lock by filename.
+    located.sort_by(|a, b| a.0.cmp(b.0));
+    let entries: Vec<String> = located
+        .iter()
+        .map(|(location, f)| {
+            format!(
+                "{{{key} = {}, hash = {}}}",
+                toml_quote(location),
+                toml_quote(&format!("sha256:{}", f.sha256))
+            )
+        })
+        .collect();
+    toml_value(&multiline_toml_array(&entries))
+}
+
+/// Replace `key`'s value in place (keeping the key and its position), or
+/// insert it.
+fn set_value(table: &mut dyn toml_edit::TableLike, key: &str, value: toml_edit::Value) {
+    match table.get_mut(key) {
+        Some(item) => *item = Item::Value(value),
+        None => {
+            table.insert(key, Item::Value(value));
+        }
+    }
+}
+
+/// Parse `rel`'s lock; a malformed one refuses every pin wired in it.
+async fn parse_lock(
+    view: &mut View<'_>,
+    rel: &str,
+    pins: &std::collections::BTreeMap<&str, &HostedPin>,
+    result: &mut FormatResult,
+) -> Option<(String, DocumentMut)> {
+    let text = read_or_refuse(view, rel, pins, result).await?;
+    match text.parse::<DocumentMut>() {
+        Ok(doc) => Some((text, doc)),
+        Err(e) => {
+            refuse_all_in(pins, rel, result, format!("{rel} is not valid TOML: {e}"));
+            None
+        }
+    }
+}
+
+/// The hosted entries of a lock's `[[package]]` array: `location` reads a
+/// package's install location (Poetry's `[package.source]` url, PDM's
+/// `url`). An entry naming another package or version than its pin
+/// refuses it.
+fn lock_hits(
+    doc: &DocumentMut,
+    rel: &str,
+    pins: &std::collections::BTreeMap<&str, &HostedPin>,
+    ctx: &Ctx<'_>,
+    location: impl Fn(&toml_edit::Table) -> Option<&str>,
+    result: &mut FormatResult,
+) -> Vec<LockHit> {
+    let mut hits = Vec::new();
+    let Some(packages) = doc.get("package").and_then(Item::as_array_of_tables) else {
+        return hits;
+    };
+    for (index, package) in packages.iter().enumerate() {
+        let Some(pin) = location(package).and_then(|l| pin_of(l, pins, ctx)) else {
+            continue;
+        };
+        let name = package.get("name").and_then(Item::as_str).unwrap_or("");
+        let version = package.get("version").and_then(Item::as_str).unwrap_or("");
+        let agrees = pin.name_version().is_some_and(|(n, v)| {
+            canonicalize_pypi_name(&n) == canonicalize_pypi_name(name) && v == version
+        });
+        if !agrees {
+            result.refuse(
+                &pin.uuid,
+                format!(
+                    "{rel}: the entry wiring it names {name:?} {version:?}, not {}",
+                    pin.purl
+                ),
+            );
+            continue;
+        }
+        hits.push(LockHit {
+            index,
+            uuid: pin.uuid.clone(),
+            name: name.to_string(),
+            version: version.to_string(),
+        });
+    }
+    hits
+}
+
+fn wanted(hits: &[LockHit], result: &FormatResult) -> BTreeSet<(String, String, String)> {
+    hits.iter()
+        .filter(|h| !result.refused.contains_key(&h.uuid))
+        .map(|h| {
+            (
+                h.uuid.clone(),
+                canonicalize_pypi_name(&h.name),
+                h.version.clone(),
+            )
+        })
+        .collect()
+}
+
+/// Write `doc` back when any hit survived, marking the survivors handled.
+fn finish(
+    view: &mut View<'_>,
+    rel: &str,
+    text: &str,
+    doc: &DocumentMut,
+    restored: BTreeSet<String>,
+    result: &mut FormatResult,
+) {
+    if restored.iter().all(|u| result.refused.contains_key(u)) {
+        return;
+    }
+    view.write(rel, preserve_line_endings(text, doc.to_string()));
+    result.handled.extend(restored);
+}
+
+// ── poetry.lock ──────────────────────────────────────────────────────────────
+
+pub(crate) async fn restore_poetry(
+    view: &mut View<'_>,
+    pins: &[&HostedPin],
+    files: &[String],
+    ctx: &Ctx<'_>,
+) -> FormatResult {
+    let mut result = FormatResult::default();
+    let pins = by_uuid(pins);
+    for rel in files {
+        let Some((text, mut doc)) = parse_lock(view, rel, &pins, &mut result).await else {
+            continue;
+        };
+        let hits = lock_hits(
+            &doc,
+            rel,
+            &pins,
+            ctx,
+            |package| {
+                let source = package.get("source")?;
+                (source.get("type").and_then(Item::as_str) == Some("url"))
+                    .then(|| source.get("url").and_then(Item::as_str))
+                    .flatten()
+            },
+            &mut result,
+        );
+        if hits.is_empty() {
+            continue;
+        }
+        let format = match crate::utils::poetry_lock::lock_version(&doc) {
+            Ok("0") => Err("Poetry 0.12 locks (format \"0\") ignore url sources".to_string()),
+            Ok(format) => Ok(format.to_string()),
+            Err(e) => Err(e),
+        };
+        let format = match format {
+            Ok(format) => format,
+            Err(why) => {
+                for hit in &hits {
+                    result.refuse(&hit.uuid, format!("{rel}: {why}"));
+                }
+                continue;
+            }
+        };
+        let released = fetch_release_files(&wanted(&hits, &result), ctx, &mut result).await;
+        let legacy = !format.starts_with('2');
+        // Poetry 1.x locks keep files in `[metadata.files]` only; the
+        // package-level copy is the rewriter's unless a package it never
+        // touched (no source table) has one too.
+        let siblings_carry_files = doc
+            .get("package")
+            .and_then(Item::as_array_of_tables)
+            .is_some_and(|packages| {
+                packages
+                    .iter()
+                    .any(|p| !p.contains_key("source") && p.contains_key("files"))
+            });
+        let mut restored = BTreeSet::new();
+        for hit in &hits {
+            if result.refused.contains_key(&hit.uuid) {
+                continue;
+            }
+            let Some(release) =
+                released.get(&(canonicalize_pypi_name(&hit.name), hit.version.clone()))
+            else {
+                continue;
+            };
+            let Some(value) = files_value(release, false) else {
+                result.refuse(&hit.uuid, "the release file list does not render as TOML");
+                continue;
+            };
+            if legacy {
+                let canon = canonicalize_pypi_name(&hit.name);
+                let table = doc
+                    .get_mut("metadata")
+                    .and_then(Item::as_table_like_mut)
+                    .and_then(|m| m.get_mut("files"))
+                    .and_then(Item::as_table_like_mut);
+                let key = table.as_ref().and_then(|t| {
+                    t.iter()
+                        .find(|(k, _)| canonicalize_pypi_name(k) == canon)
+                        .map(|(k, _)| k.to_string())
+                });
+                let (Some(table), Some(key)) = (table, key) else {
+                    result.refuse(
+                        &hit.uuid,
+                        format!("{rel} has no [metadata.files] entry for {}", hit.name),
+                    );
+                    continue;
+                };
+                // The rewriter lays the patched entry out one file per line
+                // only when the original listed files; an inline one
+                // replaced Poetry's empty `[]`.
+                let listed = table.get(&key).is_some_and(is_multiline_array);
+                let entry = if listed {
+                    value.clone()
+                } else {
+                    toml_edit::Value::Array(toml_edit::Array::new())
+                };
+                set_value(table, &key, entry);
+            }
+            let Some(package) = doc
+                .get_mut("package")
+                .and_then(Item::as_array_of_tables_mut)
+                .and_then(|p| p.get_mut(hit.index))
+            else {
+                continue;
+            };
+            package.remove("source");
+            if legacy && !siblings_carry_files {
+                package.remove("files");
+            } else {
+                set_value(package, "files", value);
+            }
+            restored.insert(hit.uuid.clone());
+        }
+        finish(view, rel, &text, &doc, restored, &mut result);
+    }
+    result
+}
+
+// ── pdm.lock ─────────────────────────────────────────────────────────────────
+
+pub(crate) async fn restore_pdm(
+    view: &mut View<'_>,
+    pins: &[&HostedPin],
+    files: &[String],
+    ctx: &Ctx<'_>,
+) -> FormatResult {
+    use crate::utils::pdm_lock::{legacy_files_key, lock_version, validate_strategy};
+    let mut result = FormatResult::default();
+    let pins = by_uuid(pins);
+    for rel in files {
+        let Some((text, mut doc)) = parse_lock(view, rel, &pins, &mut result).await else {
+            continue;
+        };
+        let hits = lock_hits(
+            &doc,
+            rel,
+            &pins,
+            ctx,
+            |package| package.get("url").and_then(Item::as_str),
+            &mut result,
+        );
+        if hits.is_empty() {
+            continue;
+        }
+        let shape = lock_version(doc.as_table()).and_then(|version| {
+            let flags = validate_strategy(doc.as_table())?;
+            Ok((version.to_string(), flags))
+        });
+        let (version, flags) = match shape {
+            Ok(shape) => shape,
+            Err(why) => {
+                for hit in &hits {
+                    result.refuse(&hit.uuid, format!("{rel}: {why}"));
+                }
+                continue;
+            }
+        };
+        let static_urls = flags.iter().any(|f| f == "static_urls");
+        // lock_version 2 (PDM 0.x/1.x) always recorded every release file.
+        let cross_platform = version == "2" || flags.iter().any(|f| f == "cross_platform");
+        let released = fetch_release_files(&wanted(&hits, &result), ctx, &mut result).await;
+        let mut restored = BTreeSet::new();
+        for hit in &hits {
+            if result.refused.contains_key(&hit.uuid) {
+                continue;
+            }
+            let Some(release) =
+                released.get(&(canonicalize_pypi_name(&hit.name), hit.version.clone()))
+            else {
+                continue;
+            };
+            if !cross_platform && !universal_release(release) {
+                result.refuse(
+                    &hit.uuid,
+                    format!(
+                        "{rel} (lock_version {version}, no cross_platform strategy) records only \
+                         the files its lock targets install, and {}=={} ships platform- or \
+                         interpreter-specific wheels, so which ones it kept is not derivable",
+                        hit.name, hit.version
+                    ),
+                );
+                continue;
+            }
+            let Some(value) = files_value(release, static_urls) else {
+                result.refuse(&hit.uuid, "the release file list does not render as TOML");
+                continue;
+            };
+            let Some(package) = doc
+                .get_mut("package")
+                .and_then(Item::as_array_of_tables_mut)
+                .and_then(|p| p.get_mut(hit.index))
+            else {
+                continue;
+            };
+            if package.contains_key("files") {
+                package.remove("url");
+                set_value(package, "files", value);
+            } else {
+                let key = legacy_files_key(package);
+                package.remove("url");
+                let table = doc
+                    .get_mut("metadata")
+                    .and_then(Item::as_table_like_mut)
+                    .and_then(|m| m.get_mut("files"))
+                    .and_then(Item::as_table_like_mut);
+                let (Some(table), Some(key)) = (table, key) else {
+                    result.refuse(
+                        &hit.uuid,
+                        format!("{rel} has no [metadata.files] entry for {}", hit.name),
+                    );
+                    continue;
+                };
+                set_value(table, &key, value);
+            }
+            restored.insert(hit.uuid.clone());
+        }
+        finish(view, rel, &text, &doc, restored, &mut result);
+    }
+    result
+}
diff --git a/crates/socket-patch-core/src/patch/redirect/upstream/uv.rs b/crates/socket-patch-core/src/patch/redirect/upstream/uv.rs
new file mode 100644
index 00000000..321b01de
--- /dev/null
+++ b/crates/socket-patch-core/src/patch/redirect/upstream/uv.rs
@@ -0,0 +1,1197 @@
+//! uv upstream restore: `uv.lock`, PEP 723 script locks (`<script>.py.lock`)
+//! and PEP 751 `pylock.toml` / `pylock.<name>.toml`, plus the paired
+//! metadata the hosted rewrite edits (`pyproject.toml`'s `[tool.uv]`, a
+//! script's PEP 723 block).
+//!
+//! What the hosted rewrite (`utils::python_lock` + `utils::python_script`)
+//! changed, and how each piece comes back:
+//!
+//! * the entry's `source = { registry = R }` became `{ url = <artifact> }`
+//!   (pylock: `index = R` was dropped) — R is the ONE registry every other
+//!   registry package of the lock names, and must be PyPI's simple index;
+//!   no sibling, or several registries, refuses;
+//! * `sdist` / `wheels` were replaced by the patched wheel (pylock: an
+//!   `archive`) — re-derived from PyPI's JSON API in the artifact shape a
+//!   sibling registry package shows (which of `size` / `upload-time` /
+//!   `hashes` this uv release records, one wheel per line or not). uv keeps
+//!   only the wheels its `requires-python` and environments can install, so
+//!   a release with any wheel that is not pure Python 3 is refused, as is a
+//!   lock whose `[options]` / `[tool.uv]` filter files (`exclude-newer`,
+//!   `no-binary`, `no-build`);
+//! * `[package.metadata]` (the patched wheel's metadata) was added — removed;
+//! * dependents' `{ name, source = { registry = R } }` references were
+//!   repointed at the url — pointed back;
+//! * the root package's `requires-dist` / `requires-dev` entries, the
+//!   `[manifest]` `constraints` / `build-constraints` / `requirements` and
+//!   `overrides` entries lost their `specifier` for the url — re-derived
+//!   from the paired metadata's declarations in uv's spelling (a
+//!   multi-clause specifier only when another entry of the lock shows how
+//!   this uv joins clauses), and an `overrides` entry the rewrite added for
+//!   a transitive dependency is removed with its `override-dependencies`
+//!   line;
+//! * the metadata's `[tool.uv.sources].<name> = { url }` is removed.
+//!
+//! uv 0.2 `[[distribution]]` locks are refused (their artifact grammar
+//! changed across 0.2.x releases).
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use toml_edit::{DocumentMut, Item, TableLike, Value};
+
+use super::client::PypiFile;
+use super::pypi::{
+    by_uuid, fetch_release_files, is_pypi_simple, pin_of, read_or_refuse, refuse_all_in,
+    toml_quote, toml_value, universal_release,
+};
+use super::{Ctx, FormatResult, HostedPin, View};
+use crate::crawlers::python_crawler::canonicalize_pypi_name;
+use crate::utils::python_lock::{paired_metadata_rel, preserve_line_endings, UvSource};
+use crate::vendor::common::pep508_name;
+
+/// One hosted entry of a lock.
+struct Hit {
+    index: usize,
+    uuid: String,
+    /// PEP 503 canonical name.
+    name: String,
+    version: String,
+}
+
+/// How the lock's other registry packages record their artifacts.
+struct Shape {
+    /// The one registry index they name.
+    registry: String,
+    /// Artifact table keys, in order (`url`, `hash`, `size`, …).
+    keys: Vec<String>,
+    /// `upload-time` is a TOML datetime (pylock), not a string (uv.lock).
+    datetime: bool,
+    /// `wheels` puts one entry per line.
+    multiline: bool,
+    /// A sibling package's key order (pylock re-places `index` by it).
+    package_keys: Vec<String>,
+}
+
+pub(crate) async fn restore(
+    view: &mut View<'_>,
+    pins: &[&HostedPin],
+    files: &[String],
+    ctx: &Ctx<'_>,
+) -> FormatResult {
+    let mut result = FormatResult::default();
+    let pins = by_uuid(pins);
+    for rel in files {
+        restore_lock(view, rel, &pins, ctx, &mut result).await;
+    }
+    result
+}
+
+async fn restore_lock(
+    view: &mut View<'_>,
+    rel: &str,
+    pins: &BTreeMap<&str, &HostedPin>,
+    ctx: &Ctx<'_>,
+    result: &mut FormatResult,
+) {
+    let Some(text) = read_or_refuse(view, rel, pins, result).await else {
+        return;
+    };
+    let mut doc = match text.parse::<DocumentMut>() {
+        Ok(doc) => doc,
+        Err(e) => {
+            refuse_all_in(pins, rel, result, format!("{rel} is not valid TOML: {e}"));
+            return;
+        }
+    };
+    let (collection, pep751) = crate::utils::python_lock::lock_package_collection(&doc);
+    let hits = lock_hits(&doc, collection, pep751, rel, pins, ctx, result);
+    if hits.is_empty() {
+        return;
+    }
+    let refuse_hits = |result: &mut FormatResult, why: &str| {
+        for hit in &hits {
+            result.refuse(&hit.uuid, format!("{rel}: {why}"));
+        }
+    };
+    if collection == "distribution" {
+        return refuse_hits(
+            result,
+            "uv 0.2 `[[distribution]]` locks changed their artifact grammar across releases; \
+             which one this lock follows is not derivable",
+        );
+    }
+    let version_ok = if pep751 {
+        doc.get("lock-version").and_then(Item::as_str) == Some("1.0")
+    } else {
+        doc.get("version").and_then(Item::as_integer) == Some(1)
+    };
+    if !version_ok {
+        return refuse_hits(result, "unsupported lock version");
+    }
+    if doc
+        .get("options")
+        .and_then(Item::as_table_like)
+        .is_some_and(|o| o.contains_key("exclude-newer"))
+    {
+        return refuse_hits(
+            result,
+            "the lock's `exclude-newer` option filters release files by upload time",
+        );
+    }
+    let shape = match lock_shape(&doc, collection, pep751, &hits) {
+        Ok(shape) => shape,
+        Err(why) => return refuse_hits(result, &why),
+    };
+
+    // The paired metadata (a project lock with no pyproject beside it was
+    // edited alone).
+    let metadata_rel = if pep751 {
+        None
+    } else {
+        paired_metadata_rel(rel.rsplit('/').next().unwrap_or(rel)).map(|leaf| {
+            match rel.rsplit_once('/') {
+                Some((dir, _)) => format!("{dir}/{leaf}"),
+                None => leaf.to_string(),
+            }
+        })
+    };
+    let script = crate::utils::python_lock::is_script_lock_name(rel);
+    let mut metadata = match &metadata_rel {
+        Some(m) => match load_metadata(view, m, script).await {
+            Ok(meta) => meta,
+            Err(why) => return refuse_hits(result, &why),
+        },
+        None => None,
+    };
+    if let Some(meta) = &metadata {
+        let uv = tool_uv(&meta.doc);
+        if uv.is_some_and(|uv| {
+            uv.iter()
+                .any(|(k, _)| k.starts_with("no-binary") || k.starts_with("no-build"))
+        }) {
+            return refuse_hits(
+                result,
+                "the project's uv `no-binary` / `no-build` settings change which artifacts \
+                 the lock records",
+            );
+        }
+    }
+
+    let wanted = hits
+        .iter()
+        .filter(|h| !result.refused.contains_key(&h.uuid))
+        .map(|h| (h.uuid.clone(), h.name.clone(), h.version.clone()))
+        .collect();
+    let released = fetch_release_files(&wanted, ctx, result).await;
+    let styles = SpecStyle::learn(&doc, metadata.as_ref());
+
+    let mut restored: BTreeSet<String> = BTreeSet::new();
+    for hit in &hits {
+        if result.refused.contains_key(&hit.uuid) {
+            continue;
+        }
+        let Some(release) = released.get(&(hit.name.clone(), hit.version.clone())) else {
+            continue;
+        };
+        let artifacts = match render_artifacts(release, &shape) {
+            Ok(artifacts) => artifacts,
+            Err(why) => {
+                result.refuse(
+                    &hit.uuid,
+                    format!("{rel}: {}=={}: {why}", hit.name, hit.version),
+                );
+                continue;
+            }
+        };
+        let restore = if pep751 {
+            restore_pylock_entry(&mut doc, hit, &shape, artifacts)
+        } else {
+            restore_uv_entry(&mut doc, hit, &shape, artifacts, ctx)
+                .and_then(|()| restore_requirements(&mut doc, hit, metadata.as_ref(), &styles, ctx))
+        };
+        if let Err(why) = restore {
+            result.refuse(&hit.uuid, format!("{rel}: {why}"));
+            continue;
+        }
+        if let Some(meta) = metadata.as_mut() {
+            if restore_metadata(meta, hit, ctx) {
+                result.warnings.push((
+                    "upstream_uv_override_removed",
+                    format!(
+                        "{}: removed the `{}=={}` override-dependencies entry the hosted run \
+                         adds for a transitive dependency",
+                        meta.rel, hit.name, hit.version
+                    ),
+                ));
+            }
+        }
+        restored.insert(hit.uuid.clone());
+    }
+    if restored.is_empty() {
+        return;
+    }
+    view.write(rel, preserve_line_endings(&text, doc.to_string()));
+    if let Some(meta) = metadata {
+        if let Some(next) = meta.render() {
+            if next != meta.text {
+                view.write(&meta.rel, next);
+            }
+        }
+    }
+    result.handled.extend(restored);
+}
+
+/// The hosted entries of the lock; an entry naming another package or
+/// version than its pin refuses it.
+fn lock_hits(
+    doc: &DocumentMut,
+    collection: &str,
+    pep751: bool,
+    rel: &str,
+    pins: &BTreeMap<&str, &HostedPin>,
+    ctx: &Ctx<'_>,
+    result: &mut FormatResult,
+) -> Vec<Hit> {
+    let mut hits = Vec::new();
+    let Some(packages) = doc.get(collection).and_then(Item::as_array_of_tables) else {
+        return hits;
+    };
+    for (index, package) in packages.iter().enumerate() {
+        let location = if pep751 {
+            package
+                .get("archive")
+                .and_then(Item::as_table_like)
+                .and_then(|a| a.get("url"))
+                .and_then(Item::as_str)
+        } else {
+            UvSource::of(package).and_then(UvSource::url)
+        };
+        let Some(pin) = location.and_then(|l| pin_of(l, pins, ctx)) else {
+            continue;
+        };
+        let name = package.get("name").and_then(Item::as_str).unwrap_or("");
+        let version = package.get("version").and_then(Item::as_str).unwrap_or("");
+        let agrees = pin.name_version().is_some_and(|(n, v)| {
+            canonicalize_pypi_name(&n) == canonicalize_pypi_name(name) && v == version
+        });
+        if !agrees {
+            result.refuse(
+                &pin.uuid,
+                format!(
+                    "{rel}: the entry wiring it names {name:?} {version:?}, not {}",
+                    pin.purl
+                ),
+            );
+            continue;
+        }
+        hits.push(Hit {
+            index,
+            uuid: pin.uuid.clone(),
+            name: canonicalize_pypi_name(name),
+            version: version.to_string(),
+        });
+    }
+    hits
+}
+
+/// The registry and artifact shape the lock's other registry packages show.
+fn lock_shape(
+    doc: &DocumentMut,
+    collection: &str,
+    pep751: bool,
+    hits: &[Hit],
+) -> Result<Shape, String> {
+    let hit_indices: BTreeSet<usize> = hits.iter().map(|h| h.index).collect();
+    let packages = doc
+        .get(collection)
+        .and_then(Item::as_array_of_tables)
+        .ok_or("the lock has no package array")?;
+    let mut registries: BTreeSet<&str> = BTreeSet::new();
+    let mut shape: Option<(Vec<String>, bool, bool, Vec<String>)> = None;
+    for (i, package) in packages.iter().enumerate() {
+        if hit_indices.contains(&i) {
+            continue;
+        }
+        let registry = if pep751 {
+            package.get("index").and_then(Item::as_str)
+        } else {
+            UvSource::of(package).and_then(UvSource::registry)
+        };
+        let Some(registry) = registry else {
+            continue;
+        };
+        registries.insert(registry);
+        if shape.is_some() {
+            continue;
+        }
+        let first = package
+            .get("wheels")
+            .and_then(Item::as_array)
+            .and_then(|a| a.iter().next())
+            .or_else(|| package.get("sdist").and_then(Item::as_value));
+        let Some(artifact) = first.and_then(Value::as_inline_table) else {
+            continue;
+        };
+        let keys: Vec<String> = artifact.iter().map(|(k, _)| k.to_string()).collect();
+        let datetime = artifact
+            .get("upload-time")
+            .is_some_and(|v| v.as_datetime().is_some());
+        let multiline = package
+            .get("wheels")
+            .and_then(Item::as_array)
+            .is_none_or(|a| a.to_string().contains('\n'));
+        let package_keys = package.iter().map(|(k, _)| k.to_string()).collect();
+        shape = Some((keys, datetime, multiline, package_keys));
+    }
+    let registry = match registries.len() {
+        0 => {
+            return Err(
+                "no sibling registry package shows the registry and artifact fields this uv \
+                 release records"
+                    .to_string(),
+            )
+        }
+        1 => registries
+            .into_iter()
+            .next()
+            .unwrap_or_default()
+            .to_string(),
+        _ => {
+            return Err(format!(
+                "the lock's packages come from several registries ({}); the entry's is \
+                 ambiguous",
+                registries.into_iter().collect::<Vec<_>>().join(", ")
+            ))
+        }
+    };
+    if !is_pypi_simple(&registry) {
+        return Err(format!(
+            "the lock's registry {registry} is not PyPI, so its release files cannot be \
+             re-derived"
+        ));
+    }
+    let (keys, datetime, multiline, package_keys) = shape.ok_or(
+        "no sibling registry package records an artifact, so which artifact fields this uv \
+         release records is not derivable",
+    )?;
+    let known = ["url", "hash", "hashes", "size", "upload-time", "name"];
+    if let Some(unknown) = keys.iter().find(|k| !known.contains(&k.as_str())) {
+        return Err(format!(
+            "sibling artifacts carry an unknown field `{unknown}`"
+        ));
+    }
+    Ok(Shape {
+        registry,
+        keys,
+        datetime,
+        multiline,
+        package_keys,
+    })
+}
+
+/// uv's millisecond timestamp of a PyPI `upload_time_iso_8601`
+/// (`2023-10-17T17:46:21.184066Z` → `2023-10-17T17:46:21.184Z`; trailing
+/// fractional zeros are not printed).
+fn upload_time(iso: &str) -> Option<String> {
+    let iso = iso.strip_suffix('Z')?;
+    let (seconds, fraction) = iso.split_once('.').unwrap_or((iso, ""));
+    if seconds.len() != 19 || !fraction.bytes().all(|b| b.is_ascii_digit()) {
+        return None;
+    }
+    let mut millis: String = fraction.chars().take(3).collect();
+    while millis.ends_with('0') {
+        millis.pop();
+    }
+    Some(if millis.is_empty() {
+        format!("{seconds}Z")
+    } else {
+        format!("{seconds}.{millis}Z")
+    })
+}
+
+/// One artifact inline table in the sibling shape.
+fn render_artifact(file: &PypiFile, shape: &Shape) -> Result<String, String> {
+    let mut fields = Vec::with_capacity(shape.keys.len());
+    for key in &shape.keys {
+        let value = match key.as_str() {
+            "url" => toml_quote(&file.url),
+            "name" => toml_quote(&file.filename),
+            "hash" => toml_quote(&format!("sha256:{}", file.sha256)),
+            "hashes" => format!("{{ sha256 = {} }}", toml_quote(&file.sha256)),
+            "size" => file
+                .size
+                .ok_or_else(|| format!("PyPI reports no size for {}", file.filename))?
+                .to_string(),
+            "upload-time" => {
+                let time = file
+                    .upload_time
+                    .as_deref()
+                    .and_then(upload_time)
+                    .ok_or_else(|| format!("PyPI reports no upload time for {}", file.filename))?;
+                if shape.datetime {
+                    time
+                } else {
+                    toml_quote(&time)
+                }
+            }
+            other => return Err(format!("unknown artifact field `{other}`")),
+        };
+        fields.push(format!("{key} = {value}"));
+    }
+    Ok(format!("{{ {} }}", fields.join(", ")))
+}
+
+/// `(sdist, wheels)` values for a release, in the sibling shape.
+fn render_artifacts(
+    release: &[PypiFile],
+    shape: &Shape,
+) -> Result<(Option<Value>, Option<Value>), String> {
+    if !universal_release(release) {
+        return Err(
+            "the release ships platform- or interpreter-specific wheels, and which of them uv \
+             kept (requires-python and environment filtering) is not derivable"
+                .to_string(),
+        );
+    }
+    let (wheels, sdists): (Vec<&PypiFile>, Vec<&PypiFile>) =
+        release.iter().partition(|f| f.filename.ends_with(".whl"));
+    let sdist = match sdists.as_slice() {
+        [] => None,
+        [one] => Some(render_artifact(one, shape)?),
+        _ => return Err("the release has several source distributions".to_string()),
+    };
+    let wheels = if wheels.is_empty() {
+        None
+    } else {
+        let entries = wheels
+            .iter()
+            .map(|f| render_artifact(f, shape))
+            .collect::<Result<Vec<_>, _>>()?;
+        Some(if shape.multiline {
+            super::pypi::multiline_toml_array(&entries)
+        } else {
+            format!("[{}]", entries.join(", "))
+        })
+    };
+    let parse = |text: Option<String>| -> Result<Option<Value>, String> {
+        text.map(|t| toml_value(&t).ok_or("an artifact does not render as TOML".to_string()))
+            .transpose()
+    };
+    Ok((parse(sdist)?, parse(wheels)?))
+}
+
+fn inline_source(registry: &str) -> Value {
+    toml_value(&format!("{{ registry = {} }}", toml_quote(registry)))
+        .expect("a registry source renders as TOML")
+}
+
+/// Replace `item`'s value, keeping its decor.
+fn replace_keeping_decor(slot: &mut Value, mut value: Value) {
+    *value.decor_mut() = slot.decor().clone();
+    *slot = value;
+}
+
+/// The package entry itself, and every dependent reference to it.
+fn restore_uv_entry(
+    doc: &mut DocumentMut,
+    hit: &Hit,
+    shape: &Shape,
+    (sdist, wheels): (Option<Value>, Option<Value>),
+    ctx: &Ctx<'_>,
+) -> Result<(), String> {
+    let package = doc
+        .get_mut("package")
+        .and_then(Item::as_array_of_tables_mut)
+        .and_then(|p| p.get_mut(hit.index))
+        .ok_or("the package entry vanished")?;
+    match package.get_mut("source").and_then(Item::as_value_mut) {
+        Some(slot) => replace_keeping_decor(slot, inline_source(&shape.registry)),
+        None => return Err("the package source is not an inline table".to_string()),
+    }
+    for key in ["sdist", "wheels", "wheel", "archive"] {
+        package.remove(key);
+    }
+    if let Some(sdist) = sdist {
+        package.insert("sdist", Item::Value(sdist));
+    }
+    if let Some(wheels) = wheels {
+        package.insert("wheels", Item::Value(wheels));
+    }
+    package.remove("metadata");
+    restore_refs(doc.as_item_mut(), hit, &shape.registry, ctx);
+    Ok(())
+}
+
+/// Dependents' `{ name, source = { url } }` references back to the registry.
+fn restore_refs(item: &mut Item, hit: &Hit, registry: &str, ctx: &Ctx<'_>) {
+    match item {
+        Item::Value(value) => restore_ref_value(value, hit, registry, ctx),
+        Item::Table(table) => {
+            for (_, item) in table.iter_mut() {
+                restore_refs(item, hit, registry, ctx);
+            }
+        }
+        Item::ArrayOfTables(tables) => {
+            for table in tables.iter_mut() {
+                for (_, item) in table.iter_mut() {
+                    restore_refs(item, hit, registry, ctx);
+                }
+            }
+        }
+        Item::None => {}
+    }
+}
+
+fn restore_ref_value(value: &mut Value, hit: &Hit, registry: &str, ctx: &Ctx<'_>) {
+    match value {
+        Value::Array(array) => {
+            for value in array.iter_mut() {
+                restore_ref_value(value, hit, registry, ctx);
+            }
+        }
+        Value::InlineTable(table) => {
+            let names_hit = table
+                .get("name")
+                .and_then(Value::as_str)
+                .is_some_and(|n| canonicalize_pypi_name(n) == hit.name);
+            let hosted = table
+                .get("source")
+                .and_then(Value::as_inline_table)
+                .and_then(|s| s.get("url"))
+                .and_then(Value::as_str)
+                .and_then(|u| ctx.hosted_uuid(u))
+                .is_some_and(|u| u == hit.uuid);
+            if names_hit && hosted {
+                if let Some(slot) = table.get_mut("source") {
+                    replace_keeping_decor(slot, inline_source(registry));
+                }
+            }
+            for (_, value) in table.iter_mut() {
+                restore_ref_value(value, hit, registry, ctx);
+            }
+        }
+        _ => {}
+    }
+}
+
+/// The pylock entry: `archive` out, `index` + `sdist` + `wheels` back in the
+/// sibling's key order.
+fn restore_pylock_entry(
+    doc: &mut DocumentMut,
+    hit: &Hit,
+    shape: &Shape,
+    (sdist, wheels): (Option<Value>, Option<Value>),
+) -> Result<(), String> {
+    let package = doc
+        .get_mut("packages")
+        .and_then(Item::as_array_of_tables_mut)
+        .and_then(|p| p.get_mut(hit.index))
+        .ok_or("the package entry vanished")?;
+    package.remove("archive");
+    package.insert("index", toml_edit::value(shape.registry.clone()));
+    if let Some(sdist) = sdist {
+        package.insert("sdist", Item::Value(sdist));
+    }
+    if let Some(wheels) = wheels {
+        package.insert("wheels", Item::Value(wheels));
+    }
+    // Keys the sibling orders sort by its order; any other key keeps its
+    // place after the known key before it.
+    let rank = |key: &str| shape.package_keys.iter().position(|k| k == key);
+    let current: Vec<String> = package.iter().map(|(k, _)| k.to_string()).collect();
+    let mut ranks: BTreeMap<String, (usize, usize)> = BTreeMap::new();
+    let mut last = 0;
+    for (i, key) in current.iter().enumerate() {
+        if let Some(r) = rank(key) {
+            last = r;
+        }
+        ranks.insert(
+            key.clone(),
+            (last, if rank(key).is_some() { 0 } else { 1 + i }),
+        );
+    }
+    package.sort_values_by(|a, _, b, _| ranks.get(a.get()).cmp(&ranks.get(b.get())));
+    Ok(())
+}
+
+// ── requirement specifiers ───────────────────────────────────────────────────
+
+/// The paired metadata document: a pyproject, or a script's PEP 723 block.
+struct Metadata {
+    rel: String,
+    text: String,
+    script: bool,
+    doc: DocumentMut,
+}
+
+impl Metadata {
+    /// The new file text; `None` when it no longer renders.
+    fn render(&self) -> Option<String> {
+        let body = self.doc.to_string();
+        if self.script {
+            crate::utils::python_script::replace_script_metadata(&self.text, &body).ok()
+        } else {
+            Some(preserve_line_endings(&self.text, body))
+        }
+    }
+}
+
+async fn load_metadata(
+    view: &mut View<'_>,
+    rel: &str,
+    script: bool,
+) -> Result<Option<Metadata>, String> {
+    let Some(text) = view.read(rel).await? else {
+        return if script {
+            Err(format!(
+                "the script {rel} the lock belongs to no longer exists"
+            ))
+        } else {
+            Ok(None)
+        };
+    };
+    let body = if script {
+        crate::utils::python_script::script_metadata(&text)
+            .map_err(|e| format!("{rel}: {e}"))?
+            .1
+    } else {
+        text.clone()
+    };
+    let doc = body
+        .parse::<DocumentMut>()
+        .map_err(|e| format!("{rel} is not valid TOML: {e}"))?;
+    Ok(Some(Metadata {
+        rel: rel.to_string(),
+        text,
+        script,
+        doc,
+    }))
+}
+
+fn tool_uv(doc: &DocumentMut) -> Option<&dyn TableLike> {
+    doc.get("tool")
+        .and_then(Item::as_table_like)
+        .and_then(|t| t.get("uv"))
+        .and_then(Item::as_table_like)
+}
+
+fn strings(item: Option<&Item>) -> Vec<&str> {
+    item.and_then(Item::as_array)
+        .into_iter()
+        .flatten()
+        .filter_map(Value::as_str)
+        .collect()
+}
+
+/// Which declarations a lock requirement array mirrors.
+#[derive(Clone, Copy)]
+enum Declared<'a> {
+    /// Root `requires-dist`: `[project]` dependencies and extras.
+    Dist,
+    /// Root `requires-dev.<group>`: a PEP 735 group or uv's legacy
+    /// `dev-dependencies` (group `dev`).
+    Dev(&'a str),
+    /// `[manifest] <key>` ↔ `[tool.uv] <key>` (a script's `dependencies`
+    /// for `requirements`).
+    Manifest(&'a str),
+}
+
+/// Every declaration string `declared` covers in the metadata.
+fn declarations<'d>(meta: &'d Metadata, declared: Declared<'_>) -> Vec<&'d str> {
+    let doc = &meta.doc;
+    let uv = tool_uv(doc);
+    match declared {
+        Declared::Dist => {
+            let project = doc.get("project");
+            let mut out = strings(project.and_then(|p| p.get("dependencies")));
+            if let Some(extras) = project
+                .and_then(|p| p.get("optional-dependencies"))
+                .and_then(Item::as_table_like)
+            {
+                for (_, group) in extras.iter() {
+                    out.extend(strings(Some(group)));
+                }
+            }
+            out
+        }
+        Declared::Dev(group) => {
+            let mut out = strings(
+                doc.get("dependency-groups")
+                    .and_then(Item::as_table_like)
+                    .and_then(|g| g.get(group)),
+            );
+            if group == "dev" {
+                out.extend(strings(uv.and_then(|u| u.get("dev-dependencies"))));
+            }
+            out
+        }
+        Declared::Manifest("requirements") => strings(doc.get("dependencies")),
+        Declared::Manifest(key) => {
+            let key = match key {
+                "constraints" => "constraint-dependencies",
+                "build-constraints" => "build-constraint-dependencies",
+                "overrides" => "override-dependencies",
+                other => other,
+            };
+            strings(uv.and_then(|u| u.get(key)))
+        }
+    }
+}
+
+/// The normalized version clauses of a PEP 508 registry requirement (`[]`
+/// when unconstrained), or why uv's spelling of them is not derivable.
+fn spec_clauses(spec: &str) -> Result<Vec<String>, String> {
+    static VERSION: std::sync::LazyLock<regex::Regex> = std::sync::LazyLock::new(|| {
+        regex::Regex::new(
+            r"^[0-9]+(\.[0-9]+)*(\.\*)?((a|b|rc)[0-9]+)?(\.post[0-9]+)?(\.dev[0-9]+)?$",
+        )
+        .expect("static version regex is valid")
+    });
+    let name = pep508_name(spec);
+    let mut rest = spec.trim_start()[name.len()..].trim_start();
+    if rest.starts_with('[') {
+        rest = rest[rest.find(']').map_or(rest.len(), |i| i + 1)..].trim_start();
+    }
+    let constraint = rest.split(';').next().unwrap_or("").trim();
+    let constraint = constraint
+        .strip_prefix('(')
+        .and_then(|c| c.strip_suffix(')'))
+        .unwrap_or(constraint);
+    let compact: String = constraint.chars().filter(|c| !c.is_whitespace()).collect();
+    if compact.is_empty() {
+        return Ok(Vec::new());
+    }
+    if compact.starts_with('@') {
+        return Err(format!("{spec:?} is a direct reference"));
+    }
+    compact
+        .split(',')
+        .map(|clause| {
+            let op = ["==", "!=", "~=", "<=", ">=", "<", ">"]
+                .into_iter()
+                .find(|op| clause.starts_with(op) && !clause.starts_with("==="))
+                .ok_or_else(|| format!("uv's spelling of {spec:?} is not derivable"))?;
+            let version = clause[op.len()..].to_ascii_lowercase();
+            if !VERSION.is_match(&version) {
+                return Err(format!("uv's spelling of {spec:?} is not derivable"));
+            }
+            Ok(format!("{op}{version}"))
+        })
+        .collect()
+}
+
+/// How this uv joins a multi-clause specifier, learned from the lock's own
+/// multi-clause entries against their declarations.
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+struct SpecStyle {
+    separator: &'static str,
+    sorted: bool,
+}
+
+impl SpecStyle {
+    const CANDIDATES: [SpecStyle; 4] = [
+        SpecStyle {
+            separator: ", ",
+            sorted: false,
+        },
+        SpecStyle {
+            separator: ",",
+            sorted: false,
+        },
+        SpecStyle {
+            separator: ", ",
+            sorted: true,
+        },
+        SpecStyle {
+            separator: ",",
+            sorted: true,
+        },
+    ];
+
+    fn join(self, clauses: &[String]) -> String {
+        let mut clauses = clauses.to_vec();
+        if self.sorted {
+            clauses.sort();
+        }
+        clauses.join(self.separator)
+    }
+
+    /// The styles every multi-clause lock entry agrees with; empty when the
+    /// lock shows none.
+    fn learn(doc: &DocumentMut, meta: Option<&Metadata>) -> Vec<SpecStyle> {
+        let Some(meta) = meta else {
+            return Vec::new();
+        };
+        let mut evidence: Vec<(String, Vec<String>)> = Vec::new();
+        for (declared, array) in requirement_arrays_ref(doc) {
+            for entry in array.iter().filter_map(Value::as_inline_table) {
+                let (Some(name), Some(specifier)) = (
+                    entry.get("name").and_then(Value::as_str),
+                    entry.get("specifier").and_then(Value::as_str),
+                ) else {
+                    continue;
+                };
+                if !specifier.contains(',') {
+                    continue;
+                }
+                if let Ok(Some(clauses)) = declared_clauses(meta, declared, name) {
+                    evidence.push((specifier.to_string(), clauses));
+                }
+            }
+        }
+        if evidence.is_empty() {
+            return Vec::new();
+        }
+        Self::CANDIDATES
+            .into_iter()
+            .filter(|style| evidence.iter().all(|(s, c)| style.join(c) == *s))
+            .collect()
+    }
+}
+
+/// The one clause list every declaration of `name` in `declared` agrees
+/// on; `Ok(None)` when nothing declares it.
+fn declared_clauses(
+    meta: &Metadata,
+    declared: Declared<'_>,
+    name: &str,
+) -> Result<Option<Vec<String>>, String> {
+    let canon = canonicalize_pypi_name(name);
+    let mut found: Option<Vec<String>> = None;
+    for spec in declarations(meta, declared) {
+        if canonicalize_pypi_name(pep508_name(spec)) != canon {
+            continue;
+        }
+        let clauses = spec_clauses(spec)?;
+        match &found {
+            Some(prior) if *prior != clauses => {
+                return Err(format!(
+                    "{} declares {name} with different specifiers; which one each lock entry \
+                     mirrors is not derivable",
+                    meta.rel
+                ))
+            }
+            _ => found = Some(clauses),
+        }
+    }
+    Ok(found)
+}
+
+/// Every lock requirement array with the declarations it mirrors
+/// (read-only twin of [`restore_requirements`]'s walk).
+fn requirement_arrays_ref(doc: &DocumentMut) -> Vec<(Declared<'_>, &toml_edit::Array)> {
+    let mut out = Vec::new();
+    for package in doc
+        .get("package")
+        .and_then(Item::as_array_of_tables)
+        .into_iter()
+        .flatten()
+    {
+        let Some(metadata) = package.get("metadata").and_then(Item::as_table_like) else {
+            continue;
+        };
+        if let Some(array) = metadata.get("requires-dist").and_then(Item::as_array) {
+            out.push((Declared::Dist, array));
+        }
+        if let Some(groups) = metadata.get("requires-dev").and_then(Item::as_table_like) {
+            for (group, item) in groups.iter() {
+                if let Some(array) = item.as_array() {
+                    out.push((Declared::Dev(group), array));
+                }
+            }
+        }
+    }
+    if let Some(manifest) = doc.get("manifest").and_then(Item::as_table_like) {
+        for key in [
+            "requirements",
+            "constraints",
+            "build-constraints",
+            "overrides",
+        ] {
+            if let Some(array) = manifest.get(key).and_then(Item::as_array) {
+                out.push((Declared::Manifest(key), array));
+            }
+        }
+    }
+    out
+}
+
+/// The hosted requirement entries of one array: `url` out, the declared
+/// `specifier` back; an `overrides` entry with no declaration left is the
+/// rewrite's own and is dropped.
+fn restore_requirement_array(
+    array: &mut toml_edit::Array,
+    declared: Declared<'_>,
+    hit: &Hit,
+    meta: Option<&Metadata>,
+    styles: &[SpecStyle],
+    ctx: &Ctx<'_>,
+    transitive_override: bool,
+) -> Result<(), String> {
+    let mut drop: Vec<usize> = Vec::new();
+    for (i, value) in array.iter_mut().enumerate() {
+        let Some(entry) = value.as_inline_table_mut() else {
+            continue;
+        };
+        let names_hit = entry
+            .get("name")
+            .and_then(Value::as_str)
+            .is_some_and(|n| canonicalize_pypi_name(n) == hit.name);
+        let hosted = entry
+            .get("url")
+            .and_then(Value::as_str)
+            .and_then(|u| ctx.hosted_uuid(u))
+            .is_some_and(|u| u == hit.uuid);
+        if !names_hit || !hosted {
+            continue;
+        }
+        if matches!(declared, Declared::Manifest("overrides")) && transitive_override {
+            drop.push(i);
+            continue;
+        }
+        let meta = meta.ok_or(
+            "the lock's requirement entries name the hosted artifact but its paired metadata \
+             file is missing, so their specifiers are not derivable",
+        )?;
+        let clauses = declared_clauses(meta, declared, &hit.name)?.ok_or_else(|| {
+            format!(
+                "{} no longer declares {}, so the lock entry's specifier is not derivable",
+                meta.rel, hit.name
+            )
+        })?;
+        let specifier = match clauses.as_slice() {
+            [] => None,
+            [one] => Some(one.clone()),
+            _ => match styles {
+                [style, ..] => Some(style.join(&clauses)),
+                [] => {
+                    return Err(format!(
+                        "no other entry of the lock shows how this uv spells a multi-clause \
+                         specifier such as {}'s",
+                        hit.name
+                    ))
+                }
+            },
+        };
+        entry.remove("url");
+        if let Some(specifier) = specifier {
+            entry.insert("specifier", Value::from(specifier));
+        }
+    }
+    for i in drop.into_iter().rev() {
+        array.remove(i);
+    }
+    Ok(())
+}
+
+/// Every requirement array of the lock (root metadata, `[manifest]`).
+fn restore_requirements(
+    doc: &mut DocumentMut,
+    hit: &Hit,
+    meta: Option<&Metadata>,
+    styles: &[SpecStyle],
+    ctx: &Ctx<'_>,
+) -> Result<(), String> {
+    // A transitive dependency's `overrides` entry is the rewrite's own when
+    // the metadata's `override-dependencies` holds exactly the pin it adds.
+    let transitive_override = meta.is_some_and(|m| pushed_override(m, hit).is_some());
+    for package in doc
+        .get_mut("package")
+        .and_then(Item::as_array_of_tables_mut)
+        .into_iter()
+        .flat_map(|p| p.iter_mut())
+    {
+        let Some(metadata) = package
+            .get_mut("metadata")
+            .and_then(Item::as_table_like_mut)
+        else {
+            continue;
+        };
+        if let Some(array) = metadata
+            .get_mut("requires-dist")
+            .and_then(Item::as_array_mut)
+        {
+            restore_requirement_array(array, Declared::Dist, hit, meta, styles, ctx, false)?;
+        }
+        if let Some(groups) = metadata
+            .get_mut("requires-dev")
+            .and_then(Item::as_table_like_mut)
+        {
+            for (group, item) in groups.iter_mut() {
+                let group = group.get().to_string();
+                if let Some(array) = item.as_array_mut() {
+                    restore_requirement_array(
+                        array,
+                        Declared::Dev(&group),
+                        hit,
+                        meta,
+                        styles,
+                        ctx,
+                        false,
+                    )?;
+                }
+            }
+        }
+    }
+    let mut emptied_manifest = false;
+    if let Some(manifest) = doc.get_mut("manifest").and_then(Item::as_table_like_mut) {
+        for key in [
+            "requirements",
+            "constraints",
+            "build-constraints",
+            "overrides",
+        ] {
+            let Some(array) = manifest.get_mut(key).and_then(Item::as_array_mut) else {
+                continue;
+            };
+            restore_requirement_array(
+                array,
+                Declared::Manifest(key),
+                hit,
+                meta,
+                styles,
+                ctx,
+                transitive_override,
+            )?;
+            if key == "overrides" && array.is_empty() {
+                manifest.remove(key);
+            }
+        }
+        emptied_manifest = manifest.is_empty();
+    }
+    if emptied_manifest {
+        doc.remove("manifest");
+    }
+    Ok(())
+}
+
+// ── paired metadata ──────────────────────────────────────────────────────────
+
+/// Whether the metadata declares `hit` directly (the rewrite adds an
+/// override only for a transitive dependency).
+fn declares_directly(meta: &Metadata, hit: &Hit) -> bool {
+    let names = |spec: &&str| canonicalize_pypi_name(pep508_name(spec)) == hit.name;
+    if meta.script {
+        return strings(meta.doc.get("dependencies")).iter().any(names);
+    }
+    crate::vendor::common::pyproject_dependency_specs(&meta.doc)
+        .iter()
+        .any(|(_, spec)| names(spec))
+        || strings(tool_uv(&meta.doc).and_then(|u| u.get("dev-dependencies")))
+            .iter()
+            .any(names)
+}
+
+/// The index of the `override-dependencies` entry the rewrite adds for a
+/// transitive `hit` (`<name>==<version>`), when present.
+fn pushed_override(meta: &Metadata, hit: &Hit) -> Option<usize> {
+    if declares_directly(meta, hit) {
+        return None;
+    }
+    let want = format!("{}=={}", hit.name, hit.version);
+    strings(tool_uv(&meta.doc).and_then(|u| u.get("override-dependencies")))
+        .iter()
+        .position(|spec| {
+            let compact: String = spec.chars().filter(|c| !c.is_whitespace()).collect();
+            canonicalize_pypi_name(pep508_name(&compact)) == hit.name
+                && compact[pep508_name(&compact).len()..] == want[hit.name.len()..]
+        })
+}
+
+/// Remove the metadata's hosted `[tool.uv.sources]` entry for `hit` and,
+/// for a transitive dependency, the override the rewrite added; tables left
+/// empty go too. `true` when an override was removed.
+fn restore_metadata(meta: &mut Metadata, hit: &Hit, ctx: &Ctx<'_>) -> bool {
+    let pushed = pushed_override(meta, hit);
+    let Some(tool) = meta.doc.get_mut("tool").and_then(Item::as_table_like_mut) else {
+        return false;
+    };
+    let Some(uv) = tool.get_mut("uv").and_then(Item::as_table_like_mut) else {
+        return false;
+    };
+    if let Some(sources) = uv.get_mut("sources").and_then(Item::as_table_like_mut) {
+        let key = sources
+            .iter()
+            .find(|(k, v)| {
+                canonicalize_pypi_name(k) == hit.name
+                    && v.as_table_like()
+                        .and_then(|t| t.get("url"))
+                        .and_then(Item::as_str)
+                        .and_then(|u| ctx.hosted_uuid(u))
+                        .is_some_and(|u| u == hit.uuid)
+            })
+            .map(|(k, _)| k.to_string());
+        if let Some(key) = key {
+            sources.remove(&key);
+        }
+        if sources.is_empty() {
+            uv.remove("sources");
+        }
+    }
+    let mut removed = false;
+    if let Some(index) = pushed {
+        if let Some(overrides) = uv
+            .get_mut("override-dependencies")
+            .and_then(Item::as_array_mut)
+        {
+            overrides.remove(index);
+            removed = true;
+            if overrides.is_empty() {
+                uv.remove("override-dependencies");
+            }
+        }
+    }
+    if uv.is_empty() {
+        tool.remove("uv");
+    }
+    if tool.is_empty() {
+        meta.doc.remove("tool");
+    }
+    removed
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn upload_times_are_milliseconds_without_trailing_zeros() {
+        assert_eq!(
+            upload_time("2023-10-17T17:46:21.184066Z").as_deref(),
+            Some("2023-10-17T17:46:21.184Z")
+        );
+        assert_eq!(
+            upload_time("2023-10-17T17:46:21.100Z").as_deref(),
+            Some("2023-10-17T17:46:21.1Z")
+        );
+        assert_eq!(
+            upload_time("2023-10-17T17:46:21.000400Z").as_deref(),
+            Some("2023-10-17T17:46:21Z")
+        );
+        assert_eq!(
+            upload_time("2023-10-17T17:46:21Z").as_deref(),
+            Some("2023-10-17T17:46:21Z")
+        );
+        assert_eq!(upload_time("2023-10-17 17:46"), None);
+    }
+
+    #[test]
+    fn specifier_clauses_normalize_or_refuse() {
+        assert_eq!(
+            spec_clauses("urllib3[socks] >= 1.26 , <2 ; python_version>'3'").unwrap(),
+            [">=1.26", "<2"]
+        );
+        assert_eq!(spec_clauses("urllib3 (==1.26.18)").unwrap(), ["==1.26.18"]);
+        assert!(spec_clauses("urllib3").unwrap().is_empty());
+        assert_eq!(spec_clauses("x~=2.0.dev1").unwrap(), ["~=2.0.dev1"]);
+        assert!(spec_clauses("x===1.0").is_err());
+        assert!(spec_clauses("x>=1.0+local").is_err());
+        assert!(spec_clauses("x @ https://h/x.whl").is_err());
+    }
+
+    #[test]
+    fn spec_style_joins() {
+        let clauses = vec![">=1".to_string(), "<2".to_string()];
+        assert_eq!(SpecStyle::CANDIDATES[0].join(&clauses), ">=1, <2");
+        assert_eq!(SpecStyle::CANDIDATES[3].join(&clauses), "<2,>=1");
+    }
+}
diff --git a/crates/socket-patch-core/src/patch/redirect/upstream/vlt.rs b/crates/socket-patch-core/src/patch/redirect/upstream/vlt.rs
new file mode 100644
index 00000000..92cc0724
--- /dev/null
+++ b/crates/socket-patch-core/src/patch/redirect/upstream/vlt.rs
@@ -0,0 +1,596 @@
+//! vlt-lock.json upstream restore: the inverse of the hosted node splice
+//! (`redirect::vlt`), which rewrites only slot [2] (integrity) and slot [3]
+//! (resolved URL) of each default-registry node of `name@version`.
+//!
+//! Slot [2] comes back from the npm registry's `dist.integrity`. Slot [3]
+//! follows the lock's own convention, since vlt versions disagree on it:
+//! 0.0.0-x … 1.0.0-rc.32 write no resolved URL for a registry node (a
+//! 3-tuple, or `null` when later slots exist), rc.33 and 1.x write the
+//! tarball URL on the node's registry. The convention is read from the
+//! lock's other default-registry nodes of the same DepID era; with none to
+//! read, a legacy-era (`·`) id never carries one, and a tilde-era (`~`)
+//! id carries one when the lock records `options.registries` (the rc.33+
+//! writer), the node sits on the default alias, and the tarball URL is not
+//! under a recorded `options.registry` (vlt's own save rule, unchanged from
+//! rc.33 through 1.2.0: slot [3] is written only when no `registry` is
+//! configured or the resolved URL does not start with it; real rc.33,
+//! 1.0.4, 1.0.10 and 1.2.0 locks of a `config.registry` project are
+//! byte-identical 3-tuples — fixture `capture-1.2.0-config-registry`).
+//!
+//! Every hosted instance of a pin is restored together, and every other
+//! byte of the lock (flags, trailing slots, indent, comma, `\r`) is kept.
+
+use serde_json::{Map, Value};
+
+use super::npm::{by_uuid, fetch_dists, read_or_refuse, refuse_all_in};
+use super::{Ctx, FormatResult, HostedPin, View};
+use crate::vendor::vlt_lock_text::{
+    entry_text, is_default_registry, nodes_block, parse_node_line, render_entry_line,
+    render_tuple_with_slots, sniff_lock, split_dep_id, split_lines, DepIdEra, DepIdKind, LockSniff,
+};
+
+/// The public npm registry, the default registry of an unconfigured lock.
+const NPM_REGISTRY: &str = "https://registry.npmjs.org/";
+
+/// One hosted node line to restore.
+struct Hit {
+    line: usize,
+    uuid: String,
+    name: String,
+    version: String,
+    era: DepIdEra,
+    /// The decoded registry segment of the DepID.
+    segment: String,
+}
+
+/// The default alias of a lock (`default-registry-alias`, else `npm`).
+fn default_alias(options: Option<&Map<String, Value>>) -> &str {
+    options
+        .and_then(|o| o.get("default-registry-alias"))
+        .and_then(Value::as_str)
+        .unwrap_or("npm")
+}
+
+/// The registry base URL a default-registry segment resolves to.
+fn registry_base(segment: &str, options: Option<&Map<String, Value>>) -> String {
+    if reqwest::Url::parse(segment).is_ok_and(|u| matches!(u.scheme(), "http" | "https")) {
+        return segment.to_string();
+    }
+    let alias = if segment.is_empty() {
+        default_alias(options)
+    } else {
+        segment
+    };
+    let str_opt = |v: Option<&Value>| v.and_then(Value::as_str).map(str::to_string);
+    str_opt(
+        options
+            .and_then(|o| o.get("registries"))
+            .and_then(|r| r.get(alias)),
+    )
+    .or_else(|| str_opt(options.and_then(|o| o.get("registry"))))
+    .unwrap_or_else(|| NPM_REGISTRY.to_string())
+}
+
+/// The conventional tarball URL of `name@version` on `base`.
+fn tarball_url(base: &str, name: &str, version: &str) -> String {
+    crate::vendor::registry_fetch::npm_tarball_url(base.trim_end_matches('/'), name, version)
+}
+
+/// Does the lock record a resolved URL (slot [3]) for a default-registry
+/// node of `era` on `segment`? `siblings` are the `(era, has_url)` of the
+/// lock's non-hosted default-registry nodes.
+fn records_url(
+    era: DepIdEra,
+    segment: &str,
+    siblings: &[(DepIdEra, bool)],
+    options: Option<&Map<String, Value>>,
+) -> bool {
+    let same_era: Vec<bool> = siblings
+        .iter()
+        .filter(|(e, _)| *e == era)
+        .map(|(_, url)| *url)
+        .collect();
+    if !same_era.is_empty() {
+        let with = same_era.iter().filter(|u| **u).count();
+        return with * 2 >= same_era.len();
+    }
+    era == DepIdEra::Tilde
+        && options
+            .and_then(|o| o.get("registries"))
+            .is_some_and(Value::is_object)
+        && (segment.is_empty() || segment == default_alias(options))
+        && !under_configured_registry(segment, options)
+}
+
+/// Would a default-registry node on `segment` resolve under the lock's
+/// recorded `options.registry`? vlt omits slot [3] for such a node
+/// (`lockfile/save.ts`: `customRegistry = resolved && (!registry ||
+/// !resolved.startsWith(registry))`).
+fn under_configured_registry(segment: &str, options: Option<&Map<String, Value>>) -> bool {
+    let Some(registry) = options
+        .and_then(|o| o.get("registry"))
+        .and_then(Value::as_str)
+        .filter(|r| !r.is_empty())
+    else {
+        return false;
+    };
+    let resolved_prefix = format!("{}/", registry_base(segment, options).trim_end_matches('/'));
+    resolved_prefix.starts_with(registry)
+}
+
+pub(crate) async fn restore(
+    view: &mut View<'_>,
+    pins: &[&HostedPin],
+    files: &[String],
+    ctx: &Ctx<'_>,
+) -> FormatResult {
+    let mut result = FormatResult::default();
+    let pins = by_uuid(pins);
+    for rel in files {
+        let Some(text) = read_or_refuse(view, rel, &pins, &mut result).await else {
+            continue;
+        };
+        let parsed = match sniff_lock(&text) {
+            LockSniff::Readable(parsed) => parsed,
+            LockSniff::Bom => {
+                refuse_all_in(
+                    &pins,
+                    rel,
+                    &mut result,
+                    format!("{rel} starts with a UTF-8 BOM"),
+                );
+                continue;
+            }
+            LockSniff::NotJsonObject => {
+                refuse_all_in(
+                    &pins,
+                    rel,
+                    &mut result,
+                    format!("{rel} is not a JSON object"),
+                );
+                continue;
+            }
+            LockSniff::UnsupportedVersion(raw) => {
+                refuse_all_in(
+                    &pins,
+                    rel,
+                    &mut result,
+                    format!("{rel} has unsupported lockfileVersion {raw}"),
+                );
+                continue;
+            }
+        };
+        let options = parsed.options();
+        let lines = split_lines(&text);
+        let Some(span) = nodes_block(&lines) else {
+            refuse_all_in(
+                &pins,
+                rel,
+                &mut result,
+                format!("{rel} nodes section is not in vlt's canonical layout"),
+            );
+            continue;
+        };
+
+        let mut hits: Vec<Hit> = Vec::new();
+        let mut siblings: Vec<(DepIdEra, bool)> = Vec::new();
+        let mut seen_keys = std::collections::BTreeSet::new();
+        for i in span.entry_lines() {
+            let Some(line) = parse_node_line(lines[i]) else {
+                // A line outside the node grammar that still names an
+                // in-scope patch cannot be restored slot by slot.
+                for uuid in crate::vex::discover::hosted_uuids_in_text(lines[i], ctx.origins) {
+                    if pins.contains_key(uuid.as_str()) {
+                        result.refuse(
+                            &uuid,
+                            format!("a {rel} node wiring it is outside vlt's node grammar"),
+                        );
+                    }
+                }
+                continue;
+            };
+            let entry = &line.entry;
+            let duplicate = !seen_keys.insert(entry.key);
+            let slot3: Option<String> = entry
+                .slot(3)
+                .and_then(|raw| serde_json::from_str::<Option<String>>(raw).ok())
+                .flatten();
+            let dep_id = split_dep_id(entry.key);
+            let hosted = slot3.as_deref().and_then(|u| ctx.hosted_uuid(u));
+            let Some(uuid) = hosted else {
+                if let Some(dep_id) = dep_id.filter(|d| {
+                    d.kind == DepIdKind::Registry && is_default_registry(&d.first, options)
+                }) {
+                    siblings.push((dep_id.era, slot3.is_some()));
+                }
+                continue;
+            };
+            let Some(pin) = pins.get(uuid.as_str()) else {
+                continue;
+            };
+            let Some((name, version)) = pin.name_version() else {
+                result.refuse(&uuid, format!("{} is not an npm purl", pin.purl));
+                continue;
+            };
+            if duplicate {
+                result.refuse(&uuid, format!("{rel} has {} more than once", entry.key));
+                continue;
+            }
+            let matches = dep_id.as_ref().filter(|d| {
+                d.kind == DepIdKind::Registry
+                    && d.registry_identity() == Some((name.as_str(), version.as_str()))
+                    && entry.name().as_deref() == Some(name.as_str())
+            });
+            let Some(dep_id) = matches else {
+                result.refuse(
+                    &uuid,
+                    format!(
+                        "the {rel} node `{}` wiring it is not {name}@{version}",
+                        entry.key
+                    ),
+                );
+                continue;
+            };
+            if !is_default_registry(&dep_id.first, options) {
+                result.refuse(
+                    &uuid,
+                    format!(
+                        "the {rel} node `{}` wiring it is not on vlt's default registry",
+                        entry.key
+                    ),
+                );
+                continue;
+            }
+            hits.push(Hit {
+                line: i,
+                uuid,
+                name,
+                version,
+                era: dep_id.era,
+                segment: dep_id.first.clone(),
+            });
+        }
+
+        let wanted = hits
+            .iter()
+            .map(|h| (h.uuid.clone(), h.name.clone(), h.version.clone()))
+            .collect();
+        let dists = fetch_dists(&wanted, ctx, &mut result).await;
+        let mut out: Vec<String> = lines.iter().map(|l| (*l).to_string()).collect();
+        let mut planned: Vec<&str> = Vec::new();
+        for hit in &hits {
+            if result.refused.contains_key(&hit.uuid) {
+                continue;
+            }
+            let Some(integrity) = dists
+                .get(&(hit.name.clone(), hit.version.clone()))
+                .and_then(|d| d.integrity.clone())
+            else {
+                result.refuse(
+                    &hit.uuid,
+                    format!(
+                        "the registry records no integrity for {}@{}",
+                        hit.name, hit.version
+                    ),
+                );
+                continue;
+            };
+            let line = parse_node_line(lines[hit.line]).expect("the hit line parsed above");
+            let json = |s: &str| serde_json::to_string(s).expect("a str serializes to JSON");
+            let slot3 = records_url(hit.era, &hit.segment, &siblings, options).then(|| {
+                json(&tarball_url(
+                    &registry_base(&hit.segment, options),
+                    &hit.name,
+                    &hit.version,
+                ))
+            });
+            let tuple = render_tuple_with_slots(
+                &line.entry.elems,
+                Some(&json(&integrity)),
+                slot3.as_deref(),
+            );
+            out[hit.line] =
+                render_entry_line(&entry_text(line.entry.key, &tuple), line.comma, line.cr);
+            planned.push(&hit.uuid);
+        }
+        // A pin refused after one of its instances was planned (a later
+        // instance failed) restores none of them.
+        let mut changed = false;
+        for hit in &hits {
+            if result.refused.contains_key(&hit.uuid) {
+                out[hit.line] = lines[hit.line].to_string();
+            } else if planned.contains(&hit.uuid.as_str()) {
+                changed = true;
+            }
+        }
+        if !changed {
+            continue;
+        }
+        let restored = out.join("\n");
+        if serde_json::from_str::<Value>(&restored).is_err() {
+            refuse_all_in(
+                &pins,
+                rel,
+                &mut result,
+                format!("restoring {rel} would not leave valid JSON"),
+            );
+            continue;
+        }
+        for uuid in planned {
+            if !result.refused.contains_key(uuid) {
+                result.handled.insert(uuid.to_string());
+            }
+        }
+        view.write(rel, restored);
+    }
+    result
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn opts(json: &str) -> Map<String, Value> {
+        serde_json::from_str(json).unwrap()
+    }
+
+    #[test]
+    fn registry_base_follows_the_segment() {
+        let o =
+            opts(r#"{"registries":{"npm":"https://mirror.example/npm/","corp":"https://corp/"}}"#);
+        assert_eq!(registry_base("", Some(&o)), "https://mirror.example/npm/");
+        assert_eq!(
+            registry_base("npm", Some(&o)),
+            "https://mirror.example/npm/"
+        );
+        assert_eq!(registry_base("corp", Some(&o)), "https://corp/");
+        assert_eq!(
+            registry_base("https://registry.example.com/", Some(&o)),
+            "https://registry.example.com/"
+        );
+        assert_eq!(registry_base("npm", None), NPM_REGISTRY);
+        let scalar = opts(r#"{"registry":"https://r.example/"}"#);
+        assert_eq!(registry_base("", Some(&scalar)), "https://r.example/");
+        assert_eq!(
+            tarball_url("https://mirror.example/npm/", "@a/b", "1.0.0"),
+            "https://mirror.example/npm/@a/b/-/b-1.0.0.tgz"
+        );
+    }
+
+    #[test]
+    fn slot3_convention_prefers_same_era_siblings() {
+        let with_registries = opts(r#"{"registries":{"npm":"https://registry.npmjs.org/"}}"#);
+        // Siblings decide, whatever the options say.
+        assert!(!records_url(
+            DepIdEra::Tilde,
+            "npm",
+            &[(DepIdEra::Tilde, false)],
+            Some(&with_registries)
+        ));
+        assert!(records_url(
+            DepIdEra::Tilde,
+            "npm",
+            &[(DepIdEra::Tilde, true)],
+            None
+        ));
+        // Another era's siblings do not.
+        assert!(!records_url(
+            DepIdEra::Legacy,
+            "npm",
+            &[(DepIdEra::Tilde, true)],
+            Some(&with_registries)
+        ));
+        // No siblings: the rc.33+ writer records `registries`.
+        assert!(records_url(
+            DepIdEra::Tilde,
+            "npm",
+            &[],
+            Some(&with_registries)
+        ));
+        assert!(!records_url(DepIdEra::Tilde, "npm", &[], None));
+        assert!(!records_url(
+            DepIdEra::Tilde,
+            "https://registry.example.com/",
+            &[],
+            Some(&with_registries)
+        ));
+        let alias = opts(r#"{"default-registry-alias":"corp","registries":{"corp":"https://c/"}}"#);
+        assert!(records_url(DepIdEra::Tilde, "corp", &[], Some(&alias)));
+        // A recorded `registry` the node resolves under: vlt (rc.33 … 1.2.0
+        // with `config.registry`) writes no slot [3].
+        let configured = opts(
+            r#"{"registry":"http://127.0.0.1:4873/","registries":{"npm":"http://127.0.0.1:4873/"}}"#,
+        );
+        assert!(!records_url(DepIdEra::Tilde, "npm", &[], Some(&configured)));
+        // ...but a node on another registry than the configured one does.
+        let elsewhere = opts(
+            r#"{"registry":"https://registry.npmjs.org/","registries":{"npm":"http://127.0.0.1:4873/"}}"#,
+        );
+        assert!(records_url(DepIdEra::Tilde, "npm", &[], Some(&elsewhere)));
+    }
+
+    use super::super::{restore_upstream, RestoreOptions, RestoreOutcome};
+    use wiremock::matchers::{method, path};
+    use wiremock::{Mock, MockServer, ResponseTemplate};
+
+    const LP_UUID: &str = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
+    const FS_UUID: &str = "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb";
+    const LP_UPSTREAM: &str = "sha512-XI5MPzVNApjAyhQzphX8BkmKsKUxD4LdyK24iZeQGinBN9yTQT3bFlCBy/aVx2HrNcqQGsdot8ghrjyrvMCoEA==";
+    const FS_UPSTREAM: &str = "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==";
+
+    fn hosted(uuid: &str, leaf: &str) -> String {
+        format!(
+            "https://patch.socket.dev/patch/npm/11111111-1111-1111-1111-111111111111/{uuid}/{leaf}"
+        )
+    }
+
+    fn pin(purl: &str, uuid: &str) -> HostedPin {
+        HostedPin {
+            purl: purl.into(),
+            uuid: uuid.into(),
+            files: vec!["vlt-lock.json".into()],
+        }
+    }
+
+    async fn run(lock: &str, pins: &[HostedPin], offline: bool) -> (RestoreOutcome, String) {
+        let tmp = tempfile::tempdir().unwrap();
+        std::fs::write(tmp.path().join("vlt-lock.json"), lock).unwrap();
+        let opts = RestoreOptions {
+            offline,
+            ..RestoreOptions::default()
+        };
+        let outcome = restore_upstream(tmp.path(), pins, &opts).await;
+        let after = std::fs::read_to_string(tmp.path().join("vlt-lock.json")).unwrap();
+        (outcome, after)
+    }
+
+    /// An npm registry that knows `(name, version, integrity?)`.
+    async fn registry(docs: &[(&str, &str, Option<&str>)]) -> MockServer {
+        let server = MockServer::start().await;
+        for (name, version, integrity) in docs {
+            let mut dist = serde_json::json!({ "tarball": format!("https://registry.npmjs.org/{name}/-/{name}-{version}.tgz") });
+            if let Some(i) = integrity {
+                dist["integrity"] = (*i).into();
+            }
+            Mock::given(method("GET"))
+                .and(path(format!("/{name}/{version}")))
+                .respond_with(
+                    ResponseTemplate::new(200).set_body_json(serde_json::json!({ "dist": dist })),
+                )
+                .mount(&server)
+                .await;
+        }
+        server
+    }
+
+    fn refused(outcome: &RestoreOutcome) -> Vec<String> {
+        outcome.refused().map(|(_, why)| why.to_string()).collect()
+    }
+
+    #[tokio::test]
+    #[serial_test::serial]
+    async fn legacy_crlf_lock_restores_3_tuples_and_null_slots() {
+        let server = registry(&[
+            ("left-pad", "1.3.0", Some(LP_UPSTREAM)),
+            ("fsevents", "2.3.3", Some(FS_UPSTREAM)),
+        ])
+        .await;
+        std::env::set_var("SOCKET_NPM_REGISTRY", server.uri());
+        let lock = |lp: &str, fs: &str| {
+            format!(
+                "{{\r\n  \"lockfileVersion\": 0,\r\n  \"options\": {{}},\r\n  \"nodes\": {{\r\n    \"··fsevents@2.3.3\": [1,\"fsevents\",{fs},null,null,{{\"os\":[\"darwin\"]}}],\r\n    \"··left-pad@1.3.0\": [0,\"left-pad\",{lp}]\r\n  }},\r\n  \"edges\": {{}}\r\n}}\r\n"
+            )
+        };
+        let hosted_lock = lock(
+            &format!(
+                "\"sha512-AAAA==\",\"{}\"",
+                hosted(LP_UUID, "left-pad-1.3.0.tgz")
+            ),
+            &format!(
+                "\"sha512-BBBB==\",\"{}\"",
+                hosted(FS_UUID, "fsevents-2.3.3.tgz")
+            ),
+        );
+        let pins = [
+            pin("pkg:npm/left-pad@1.3.0", LP_UUID),
+            pin("pkg:npm/fsevents@2.3.3", FS_UUID),
+        ];
+        let (outcome, after) = run(&hosted_lock, &pins, false).await;
+        std::env::remove_var("SOCKET_NPM_REGISTRY");
+        assert!(refused(&outcome).is_empty(), "{:?}", refused(&outcome));
+        assert_eq!(
+            after,
+            lock(
+                &format!("\"{LP_UPSTREAM}\""),
+                &format!("\"{FS_UPSTREAM}\",null")
+            )
+        );
+    }
+
+    #[tokio::test]
+    #[serial_test::serial]
+    async fn every_instance_of_a_pin_is_restored_with_the_url_convention() {
+        let server = registry(&[("left-pad", "1.3.0", Some(LP_UPSTREAM))]).await;
+        std::env::set_var("SOCKET_NPM_REGISTRY", server.uri());
+        let url = hosted(LP_UUID, "left-pad-1.3.0.tgz");
+        let text = format!(
+            "{{\n  \"lockfileVersion\": 1,\n  \"options\": {{}},\n  \"nodes\": {{\n    \"~npm~left-pad@1.3.0\": [0,\"left-pad\",\"sha512-AA==\",\"{url}\"],\n    \"~npm~left-pad@1.3.0~peer.1\": [0,\"left-pad\",\"sha512-AA==\",\"{url}\"],\n    \"~npm~ms@2.1.3\": [0,\"ms\",\"sha512-M==\",\"https://registry.npmjs.org/ms/-/ms-2.1.3.tgz\"]\n  }},\n  \"edges\": {{}}\n}}\n"
+        );
+        let (outcome, after) = run(&text, &[pin("pkg:npm/left-pad@1.3.0", LP_UUID)], false).await;
+        std::env::remove_var("SOCKET_NPM_REGISTRY");
+        assert!(refused(&outcome).is_empty(), "{:?}", refused(&outcome));
+        let upstream = format!(
+            "[0,\"left-pad\",\"{LP_UPSTREAM}\",\"https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz\"]"
+        );
+        assert_eq!(after.matches(&upstream).count(), 2, "{after}");
+        assert!(!after.contains("patch.socket.dev"));
+    }
+
+    #[tokio::test]
+    #[serial_test::serial]
+    async fn missing_registry_integrity_refuses() {
+        let server = registry(&[("left-pad", "1.3.0", None)]).await;
+        std::env::set_var("SOCKET_NPM_REGISTRY", server.uri());
+        let text = format!(
+            "{{\n  \"lockfileVersion\": 1,\n  \"nodes\": {{\n    \"~npm~left-pad@1.3.0\": [0,\"left-pad\",\"sha512-AA==\",\"{}\"]\n  }}\n}}\n",
+            hosted(LP_UUID, "left-pad-1.3.0.tgz")
+        );
+        let (outcome, after) = run(&text, &[pin("pkg:npm/left-pad@1.3.0", LP_UUID)], false).await;
+        std::env::remove_var("SOCKET_NPM_REGISTRY");
+        let why = refused(&outcome);
+        assert!(why[0].contains("records no integrity"), "{why:?}");
+        assert!(why[0].contains("git checkout -- vlt-lock.json"), "{why:?}");
+        assert_eq!(after, text);
+    }
+
+    #[tokio::test]
+    async fn refusals_leave_the_lock_untouched() {
+        let url = hosted(LP_UUID, "left-pad-1.3.0.tgz");
+        let lp = [pin("pkg:npm/left-pad@1.3.0", LP_UUID)];
+        let cases = [
+            // Offline: slot [2] must come from the registry.
+            (
+                format!("{{\n  \"lockfileVersion\": 1,\n  \"nodes\": {{\n    \"~npm~left-pad@1.3.0\": [0,\"left-pad\",\"sha512-AA==\",\"{url}\"]\n  }}\n}}\n"),
+                "offline",
+            ),
+            // A hosted URL on a non-default registry node.
+            (
+                format!("{{\n  \"lockfileVersion\": 1,\n  \"options\": {{\"registries\": {{\"corp\": \"https://corp/\"}}}},\n  \"nodes\": {{\n    \"~corp~left-pad@1.3.0\": [0,\"left-pad\",\"sha512-AA==\",\"{url}\"]\n  }}\n}}\n"),
+                "not on vlt's default registry",
+            ),
+            // A node of another package.
+            (
+                format!("{{\n  \"lockfileVersion\": 1,\n  \"nodes\": {{\n    \"~npm~right-pad@1.3.0\": [0,\"right-pad\",\"sha512-AA==\",\"{url}\"]\n  }}\n}}\n"),
+                "is not left-pad@1.3.0",
+            ),
+            // The same DepID twice.
+            (
+                format!("{{\n  \"lockfileVersion\": 1,\n  \"nodes\": {{\n    \"~npm~left-pad@1.3.0\": [0,\"left-pad\",\"sha512-AA==\",\"{url}\"],\n    \"~npm~left-pad@1.3.0\": [0,\"left-pad\",\"sha512-AA==\",\"{url}\"]\n  }}\n}}\n"),
+                "more than once",
+            ),
+            // Not vlt's one-node-per-line layout.
+            (
+                format!("{{\"lockfileVersion\": 1, \"nodes\": {{\"~npm~left-pad@1.3.0\": [0,\"left-pad\",\"sha512-AA==\",\"{url}\"]}}}}\n"),
+                "canonical layout",
+            ),
+            (
+                format!("\u{feff}{{\n  \"nodes\": {{\n    \"~npm~left-pad@1.3.0\": [0,\"left-pad\",\"sha512-AA==\",\"{url}\"]\n  }}\n}}\n"),
+                "BOM",
+            ),
+            (
+                format!("{{\n  \"lockfileVersion\": 2,\n  \"nodes\": {{\n    \"~npm~left-pad@1.3.0\": [0,\"left-pad\",\"sha512-AA==\",\"{url}\"]\n  }}\n}}\n"),
+                "lockfileVersion 2",
+            ),
+        ];
+        for (text, needle) in cases {
+            let (outcome, after) = run(&text, &lp, true).await;
+            let why = refused(&outcome);
+            assert!(
+                matches!(&why[..], [w] if w.contains(needle)),
+                "{needle}: {why:?}"
+            );
+            assert_eq!(after, text, "{needle}");
+            assert!(outcome.reverted_files.is_empty(), "{needle}");
+        }
+    }
+}
diff --git a/crates/socket-patch-core/src/patch/redirect/vlt.rs b/crates/socket-patch-core/src/patch/redirect/vlt.rs
index bf256b82..14986852 100644
--- a/crates/socket-patch-core/src/patch/redirect/vlt.rs
+++ b/crates/socket-patch-core/src/patch/redirect/vlt.rs
@@ -586,26 +586,6 @@ fn same_slots(a: &NodeEntry<'_>, b: &NodeEntry<'_>) -> bool {
     slot_value(a, 2) == slot_value(b, 2) && slot_value(a, 3) == slot_value(b, 3)
 }
 
-fn drift(id: &str, why: &str) -> String {
-    format!(
-        "vlt-lock.json {why}; restore the registry pin for {id} manually, or re-run \
-         `socket-patch scan --mode hosted` and then roll back"
-    )
-}
-
-/// What [`revert_vlt_slots`] found on the line keyed by an edit's DepID.
-#[derive(Debug, PartialEq)]
-pub(crate) enum SlotRevert {
-    /// The lock text with `original`'s slots back on that line.
-    Restored(String),
-    /// The line already holds `original`'s slots.
-    Unchanged,
-    /// No line has the DepID. Every instance of a `name@version` shares one
-    /// hosted URL, so [`revert_vanished`] runs only after the transaction's
-    /// other edits are staged.
-    Vanished,
-}
-
 /// The recorded DepID and entries of a [`KIND`] edit.
 fn recorded(edit: &FileEdit) -> Result<(NodeEntry<'_>, NodeEntry<'_>), String> {
     fn fragment(v: &Option<Value>) -> Option<&str> {
@@ -626,91 +606,6 @@ fn recorded(edit: &FileEdit) -> Result<(NodeEntry<'_>, NodeEntry<'_>), String> {
     Ok((original, new))
 }
 
-/// Undo one [`KIND`] edit by slots. The line keyed by the recorded DepID
-/// gets `original`'s slots [2] and [3] back while its current flags,
-/// trailing slots, indent, comma and `\r` stay, so a lock vlt re-laid since
-/// the rewrite still reverts. A line that already holds `original`'s slots
-/// is [`SlotRevert::Unchanged`]; anything else on that line is drift.
-pub(crate) fn revert_vlt_slots(text: &str, edit: &FileEdit) -> Result<SlotRevert, String> {
-    let (original, new) = recorded(edit)?;
-    let id = original.key;
-    let lines = split_lines(text);
-    let Some(span) = nodes_block(&lines) else {
-        return Err(drift(id, "nodes section is not in vlt's canonical layout"));
-    };
-    let prefix = format!("    \"{id}\": ");
-    let keyed: Vec<usize> = span
-        .entry_lines()
-        .filter(|&i| lines[i].starts_with(prefix.as_str()))
-        .collect();
-    match keyed.as_slice() {
-        [] => Ok(SlotRevert::Vanished),
-        [idx] => {
-            let Some(line) = parse_node_line(lines[*idx]) else {
-                return Err(drift(
-                    id,
-                    &format!("entry {id} is outside vlt's node grammar"),
-                ));
-            };
-            if same_slots(&line.entry, &original) {
-                return Ok(SlotRevert::Unchanged);
-            }
-            if !same_slots(&line.entry, &new) {
-                return Err(drift(
-                    id,
-                    &format!("entry {id} drifted from the recorded redirect"),
-                ));
-            }
-            let tuple = render_tuple_with_slots(
-                &line.entry.elems,
-                original.slot(2).filter(|s| *s != "null"),
-                original.slot(3).filter(|s| *s != "null"),
-            );
-            let mut out: Vec<String> = lines.iter().map(|l| (*l).to_string()).collect();
-            out[*idx] = render_entry_line(&entry_text(id, &tuple), line.comma, line.cr);
-            Ok(SlotRevert::Restored(out.join("\n")))
-        }
-        _ => Err(drift(id, &format!("has {id} more than once"))),
-    }
-}
-
-/// Finish a [`SlotRevert::Vanished`] edit against `text`, the lock with
-/// every other edit of the same revert already staged. `Ok(None)`: a
-/// re-lock dropped the pin, so nothing is left to revert. `Ok(Some(text))`:
-/// vlt re-keyed the node (a new peer context) and carried the pin, so every
-/// default-registry instance of the same `name@version` that holds exactly
-/// `new`'s slots gets `original`'s back. The hosted URL on any other line
-/// is drift.
-pub(crate) fn revert_vanished(text: &str, edit: &FileEdit) -> Result<Option<String>, String> {
-    let (original, new) = recorded(edit)?;
-    let Some(url) = slot_value(&new, 3).and_then(|v| v.as_str().map(str::to_string)) else {
-        return Ok(None);
-    };
-    if !text.contains(url.as_str()) {
-        return Ok(None);
-    }
-    let lines = split_lines(text);
-    let mut out: Vec<String> = lines.iter().map(|l| (*l).to_string()).collect();
-    let carried = carried_pin_lines(text, &lines, &new);
-    for &i in &carried {
-        let line = parse_node_line(lines[i]).expect("carried_pin_lines parsed this line");
-        let tuple = render_tuple_with_slots(
-            &line.entry.elems,
-            original.slot(2).filter(|s| *s != "null"),
-            original.slot(3).filter(|s| *s != "null"),
-        );
-        out[i] = render_entry_line(&entry_text(line.entry.key, &tuple), line.comma, line.cr);
-    }
-    let restored = out.join("\n");
-    if carried.is_empty() || restored.contains(url.as_str()) {
-        return Err(drift(
-            new.key,
-            &format!("no longer has {}, but still pins its hosted URL", new.key),
-        ));
-    }
-    Ok(Some(restored))
-}
-
 /// The nodes-section lines of `text` that hold `new`'s pin under another
 /// DepID: default-registry instances of the same `name@version` whose
 /// slots [2] and [3] are exactly `new`'s.
@@ -850,10 +745,6 @@ mod tests {
         format!("\"{ID}\": [0,\"left-pad\",\"{REG_SHA}\",\"{REG_URL}\"]")
     }
 
-    fn hosted_entry() -> String {
-        format!("\"{ID}\": [0,\"left-pad\",\"{SHA}\",\"{URL}\"]")
-    }
-
     #[test]
     fn vlt_drives_needs_the_lock_and_the_sentinel_or_no_sibling() {
         let sentinel = (VLT_HIDDEN_LOCK_REL, "");
@@ -1070,173 +961,6 @@ mod tests {
         assert!(result.warnings.is_empty());
     }
 
-    fn revert(lock: &str, edit: &FileEdit) -> Result<Option<String>, String> {
-        match revert_vlt_slots(lock, edit)? {
-            SlotRevert::Restored(text) => Ok(Some(text)),
-            SlotRevert::Unchanged => Ok(None),
-            SlotRevert::Vanished => revert_vanished(lock, edit),
-        }
-    }
-
-    #[test]
-    fn revert_restores_the_slots_after_a_comma_move() {
-        let edit = vlt_edit(&registry_entry(), &hosted_entry());
-        let lone = lock_with(&[&hosted_entry()]);
-        assert_eq!(
-            revert(&lone, &edit).unwrap().unwrap(),
-            lock_with(&[&registry_entry()])
-        );
-        let sibling = "\"~npm~zz@1.0.0\": [0,\"zz\",\"sha512-z\"]";
-        let moved = lock_with(&[&hosted_entry(), sibling]);
-        assert_eq!(
-            revert(&moved, &edit).unwrap().unwrap(),
-            lock_with(&[&registry_entry(), sibling])
-        );
-    }
-
-    #[test]
-    fn revert_keeps_a_changed_flag_and_new_trailing_slots() {
-        let edit = vlt_edit(&registry_entry(), &hosted_entry());
-        let relaid = lock_with(&[&format!(
-            "\"{ID}\": [2,\"left-pad\",\"{SHA}\",\"{URL}\",null,null,null,null,{{  \"lp\": \"bin.js\"}}]"
-        )]);
-        assert_eq!(
-            revert(&relaid, &edit).unwrap().unwrap(),
-            lock_with(&[&format!(
-                "\"{ID}\": [2,\"left-pad\",\"{REG_SHA}\",\"{REG_URL}\",null,null,null,null,{{  \"lp\": \"bin.js\"}}]"
-            )])
-        );
-    }
-
-    #[test]
-    fn revert_of_a_three_tuple_original() {
-        let original = format!("\"{ID}\": [0,\"left-pad\",\"{REG_SHA}\"]");
-        let edit = vlt_edit(&original, &hosted_entry());
-        assert_eq!(
-            revert(&lock_with(&[&hosted_entry()]), &edit)
-                .unwrap()
-                .unwrap(),
-            lock_with(&[&original])
-        );
-        let five = lock_with(&[&format!(
-            "\"{ID}\": [1,\"left-pad\",\"{SHA}\",\"{URL}\",\"lib\"]"
-        )]);
-        assert_eq!(
-            revert(&five, &edit).unwrap().unwrap(),
-            lock_with(&[&format!(
-                "\"{ID}\": [1,\"left-pad\",\"{REG_SHA}\",null,\"lib\"]"
-            )])
-        );
-    }
-
-    #[test]
-    fn revert_after_an_lf_resave_of_a_crlf_lock() {
-        let edit = vlt_edit(&registry_entry(), &hosted_entry());
-        let crlf = lock_with(&[&hosted_entry()]).replace('\n', "\r\n");
-        assert_eq!(
-            revert(&crlf, &edit).unwrap().unwrap(),
-            lock_with(&[&registry_entry()]).replace('\n', "\r\n")
-        );
-        let lf = lock_with(&[&hosted_entry()]);
-        assert_eq!(
-            revert(&lf, &edit).unwrap().unwrap(),
-            lock_with(&[&registry_entry()])
-        );
-    }
-
-    #[test]
-    fn revert_already_reverted() {
-        let edit = vlt_edit(&registry_entry(), &hosted_entry());
-        assert_eq!(revert(&lock_with(&[&registry_entry()]), &edit), Ok(None));
-        let relaid = lock_with(&[&format!(
-            "\"{ID}\": [2,\"left-pad\",\"{REG_SHA}\",\"{REG_URL}\"]"
-        )]);
-        assert_eq!(revert(&relaid, &edit), Ok(None));
-        let relocked = lock_with(&[&format!(
-            "\"~npm~left-pad@1.3.0~peer.1\": [0,\"left-pad\",\"{REG_SHA}\",\"{REG_URL}\"]"
-        )]);
-        assert_eq!(revert(&relocked, &edit), Ok(None));
-    }
-
-    #[test]
-    fn revert_refuses_drift() {
-        let edit = vlt_edit(&registry_entry(), &hosted_entry());
-        let other = lock_with(&[&format!(
-            "\"{ID}\": [0,\"left-pad\",\"sha512-OTHER==\",\"{URL}\"]"
-        )]);
-        assert!(revert(&other, &edit).unwrap_err().contains("drifted"));
-        let moved = lock_with(&[&format!(
-            "\"~npm~left-pad@1.3.0~peer.1\": [0,\"left-pad\",\"sha512-OTHER==\",\"{URL}\"]"
-        )]);
-        let err = revert(&moved, &edit).unwrap_err();
-        assert!(err.contains("still pins its hosted URL"), "{err}");
-        assert!(err.contains("restore the registry pin for ~npm~left-pad@1.3.0 manually"));
-        let elsewhere = lock_with(&[&format!(
-            "\"~npm~right-pad@1.3.0\": [0,\"right-pad\",\"{SHA}\",\"{URL}\"]"
-        )]);
-        let err = revert(&elsewhere, &edit).unwrap_err();
-        assert!(err.contains("still pins its hosted URL"), "{err}");
-        let foreign = format!(
-            "{{\n  \"lockfileVersion\": 1,\n  \"options\": {{\"registries\": {{\"acme\": \
-             \"https://acme.test/\"}}}},\n  \"nodes\": {{\n    \"~acme~left-pad@1.3.0\": \
-             [0,\"left-pad\",\"{SHA}\",\"{URL}\"]\n  }},\n  \"edges\": {{}}\n}}\n"
-        );
-        let err = revert(&foreign, &edit).unwrap_err();
-        assert!(err.contains("still pins its hosted URL"), "{err}");
-        let twice = format!(
-            "{{\n  \"nodes\": {{\n    {},\n    {}\n  }}\n}}\n",
-            hosted_entry(),
-            hosted_entry()
-        );
-        assert!(revert(&twice, &edit)
-            .unwrap_err()
-            .contains("more than once"));
-        let multi = format!("{{\n  \"nodes\": {{\n    \"{ID}\": [\n      0\n    ]\n  }}\n}}\n");
-        assert!(revert(&multi, &edit).unwrap_err().contains("node grammar"));
-        assert!(revert("{\"nodes\": {}}", &edit)
-            .unwrap_err()
-            .contains("canonical"));
-    }
-
-    #[test]
-    fn revert_follows_a_pin_vlt_carried_to_a_new_peer_context() {
-        let old_id = "~npm~left-pad@1.3.0~peer.0df72515a50372ba";
-        let new_id = "~npm~left-pad@1.3.0~peer.32643a3290c32d5d";
-        let edit = vlt_edit(
-            &format!("\"{old_id}\": [0,\"left-pad\",\"{REG_SHA}\"]"),
-            &format!("\"{old_id}\": [0,\"left-pad\",\"{SHA}\",\"{URL}\"]"),
-        );
-        let sibling = "\"~npm~zz@1.0.0\": [0,\"zz\",\"sha512-z\"]";
-        let rekeyed = lock_with(&[
-            &format!("\"{new_id}\": [2,\"left-pad\",\"{SHA}\",\"{URL}\",null,null,null,\"lib\"]"),
-            sibling,
-        ]);
-        assert_eq!(
-            revert(&rekeyed, &edit).unwrap().unwrap(),
-            lock_with(&[
-                &format!(
-                    "\"{new_id}\": [2,\"left-pad\",\"{REG_SHA}\",null,null,null,null,\"lib\"]"
-                ),
-                sibling,
-            ])
-        );
-        let crlf = lock_with(&[&format!(
-            "\"{new_id}\": [0,\"left-pad\",\"{SHA}\",\"{URL}\"]"
-        )])
-        .replace('\n', "\r\n");
-        assert_eq!(
-            revert(&crlf, &edit).unwrap().unwrap(),
-            lock_with(&[&format!("\"{new_id}\": [0,\"left-pad\",\"{REG_SHA}\"]")])
-                .replace('\n', "\r\n")
-        );
-        let both = lock_with(&[
-            &format!("\"{new_id}\": [0,\"left-pad\",\"{SHA}\",\"{URL}\"]"),
-            &format!("\"~npm~right-pad@1.3.0\": [0,\"right-pad\",\"sha512-R==\",\"{URL}\"]"),
-        ]);
-        let err = revert(&both, &edit).unwrap_err();
-        assert!(err.contains("still pins its hosted URL"), "{err}");
-    }
-
     #[test]
     fn a_superseding_edit_keeps_the_pristine_slots_of_a_carried_pin() {
         let old_id = "~npm~left-pad@1.3.0~peer.1";
@@ -1262,19 +986,4 @@ mod tests {
         assert_eq!(carried_pin_original(&relocked, &old), None);
     }
 
-    #[test]
-    fn revert_refuses_a_malformed_ledger_edit() {
-        let mut edit = vlt_edit(&registry_entry(), &hosted_entry());
-        edit.original = None;
-        assert!(revert(&lock_with(&[&hosted_entry()]), &edit).is_err());
-        let edit = vlt_edit("not an entry", &hosted_entry());
-        assert!(revert(&lock_with(&[&hosted_entry()]), &edit).is_err());
-        let edit = vlt_edit(
-            &format!("\"~npm~other@1.0.0\": [0,\"other\",\"{REG_SHA}\"]"),
-            &hosted_entry(),
-        );
-        assert!(revert(&lock_with(&[&hosted_entry()]), &edit)
-            .unwrap_err()
-            .contains("two different DepIDs"));
-    }
 }
diff --git a/crates/socket-patch-core/src/patch/redirect/vlt_heal.rs b/crates/socket-patch-core/src/patch/redirect/vlt_heal.rs
index 5bbeb1ac..96645fd4 100644
--- a/crates/socket-patch-core/src/patch/redirect/vlt_heal.rs
+++ b/crates/socket-patch-core/src/patch/redirect/vlt_heal.rs
@@ -458,6 +458,29 @@ pub async fn invalidate(root: &Path, state: &InstallState, stale: &[String]) ->
     out
 }
 
+/// The Socket-hosted vlt nodes of `lock` (read BEFORE a restore rewrites
+/// it) that stand for one of `purls` — the ledger-free rollback heal's
+/// targets. No patch record rides along (v5 keeps no hosted ledger), so the
+/// heal judges each installed copy against the lock's own pins.
+pub fn lock_targets(lock: &str, origins: &[String], purls: &[String]) -> Vec<LedgerTarget> {
+    let wanted: Vec<String> = purls.iter().map(|p| canonical_purl(p)).collect();
+    socket_owned_instances(lock, origins)
+        .into_iter()
+        .filter_map(|instance| {
+            let purl = crate::utils::purl::npm_purl(&instance.name, &instance.version)?;
+            let canon = canonical_purl(&purl);
+            let at = wanted.iter().position(|w| *w == canon)?;
+            Some(LedgerTarget {
+                purl: purls[at].clone(),
+                dep_id: instance.dep_id,
+                name: instance.name,
+                record: None,
+                flags: instance.flags,
+            })
+        })
+        .collect()
+}
+
 /// The vlt nodes the ledger's `redirect_vlt_lock_node` edits name for each
 /// of `purls`, with the purl's patch record. With the pre-revert `lock`,
 /// a node vlt re-keyed (a new peer context) is named by the DepID its pin
diff --git a/crates/socket-patch-core/src/utils/line_endings.rs b/crates/socket-patch-core/src/utils/line_endings.rs
index b3d155f0..889f6ad3 100644
--- a/crates/socket-patch-core/src/utils/line_endings.rs
+++ b/crates/socket-patch-core/src/utils/line_endings.rs
@@ -81,39 +81,6 @@ pub(crate) fn majority_terminator(text: &str) -> &'static str {
     }
 }
 
-/// A recorded `(original, new)` fragment pair of a line-oriented text edit,
-/// respelled in `content`'s line endings when the two disagree wholesale.
-///
-/// The yarn rewriters record their fragments in the lock's on-disk form
-/// (CRLF lines for a CRLF lock), and every revert matches them
-/// byte-exactly. But the committed ledger keeps those JSON-escaped
-/// fragments verbatim while a `core.autocrlf` checkout re-spells the lock
-/// itself: Git for Windows' default install converts LF to CRLF on
-/// checkout, and a macOS or Linux clone of the same commit is LF. When the
-/// live file is uniformly one style and the fragments uniformly the other,
-/// they record the same edit; anything else (a mixed file, fragments that
-/// disagree with each other) proves nothing and stays a drift refusal.
-pub(crate) fn fragments_in_eol_of(
-    content: &str,
-    original: &str,
-    new: &str,
-) -> Option<(String, String)> {
-    let fragments = match (LineEndings::of(original), LineEndings::of(new)) {
-        (a, b) if a == b => a,
-        (LineEndings::None, style) | (style, LineEndings::None) => style,
-        _ => return None,
-    };
-    match (LineEndings::of(content), fragments) {
-        (LineEndings::Crlf, LineEndings::Lf) => {
-            Some((original.replace('\n', "\r\n"), new.replace('\n', "\r\n")))
-        }
-        (LineEndings::Lf, LineEndings::Crlf) => {
-            Some((original.replace("\r\n", "\n"), new.replace("\r\n", "\n")))
-        }
-        _ => None,
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -153,28 +120,4 @@ mod tests {
         assert_eq!(majority_terminator("{}"), "\n", "no break: LF, not os.EOL");
     }
 
-    #[test]
-    fn fragments_are_respelled_only_across_uniform_styles() {
-        let (orig, new) = ("k:\n  a: 1\n", "k:\n  a: 2\n");
-        assert_eq!(
-            fragments_in_eol_of("x\r\nk:\r\n  a: 2\r\n", orig, new),
-            Some(("k:\r\n  a: 1\r\n".into(), "k:\r\n  a: 2\r\n".into()))
-        );
-        let (orig, new) = ("k:\r\n  a: 1", "k:\r\n  a: 2");
-        assert_eq!(
-            fragments_in_eol_of("x\nk:\n  a: 2\n", orig, new),
-            Some(("k:\n  a: 1".into(), "k:\n  a: 2".into()))
-        );
-        // Same style, a mixed file, disagreeing or line-free fragments:
-        // nothing to respell.
-        assert_eq!(fragments_in_eol_of("x\n", "a\nb", "a\nc"), None);
-        assert_eq!(fragments_in_eol_of("x\r\ny\n", "a\nb", "a\nc"), None);
-        assert_eq!(fragments_in_eol_of("x\r\n", "a\nb", "a\r\nc"), None);
-        assert_eq!(fragments_in_eol_of("x\r\n", "ab", "ac"), None);
-        // One single-line side takes the other side's style.
-        assert_eq!(
-            fragments_in_eol_of("x\r\n", "ab", "a\nc"),
-            Some(("ab".into(), "a\r\nc".into()))
-        );
-    }
 }
diff --git a/crates/socket-patch-core/src/utils/poetry_lock.rs b/crates/socket-patch-core/src/utils/poetry_lock.rs
index 48b40b8a..a59f79a6 100644
--- a/crates/socket-patch-core/src/utils/poetry_lock.rs
+++ b/crates/socket-patch-core/src/utils/poetry_lock.rs
@@ -42,6 +42,72 @@ pub(crate) fn metadata_files<'d>(lock: &'d DocumentMut, name: &str) -> Vec<&'d d
     table_likes(entry)
 }
 
+/// Whether a `[metadata.files]` entry is laid out one file per line, which is
+/// how Poetry 1.0/1.1 write every NON-empty entry (tomlkit `multiline(True)`);
+/// an empty one is `[]`.
+pub(crate) fn is_multiline_array(item: &Item) -> bool {
+    item.as_array().is_some_and(|array| {
+        let has_break = |raw: Option<&str>| raw.is_some_and(|s| s.contains('\n'));
+        has_break(array.trailing().as_str())
+            || array
+                .iter()
+                .any(|v| has_break(v.decor().prefix().and_then(|p| p.as_str())))
+    })
+}
+
+/// The patched `[metadata.files]` entry (lock 1.0/1.1) replacing
+/// `table[name]`, laid out as the entry it replaces: one file per line
+/// (Poetry's own rendering) when that entry listed files, inline when it was
+/// Poetry's empty `[]` (what Poetry 1.0/1.1 record against today's PyPI JSON
+/// API). The layout is the only record of which the lock had: the hosted
+/// restore (`patch::redirect::upstream::pypi_locks`) reads it back to put
+/// either the full release list or `[]` back. A `rewritten` package (one
+/// already carrying a source: a rotated hosted url) keeps the layout of the
+/// entry it has, which is the original's bit, so re-runs are idempotent.
+fn legacy_files_entry(table: &dyn TableLike, name: &str, files: Array, rewritten: bool) -> Item {
+    let canon = canonicalize_pypi_name(name);
+    let existing = table.get(name).or_else(|| {
+        table
+            .iter()
+            .find(|(key, _)| canonicalize_pypi_name(key) == canon)
+            .map(|(_, item)| item)
+    });
+    let populated = if rewritten {
+        existing.is_some_and(is_multiline_array)
+    } else {
+        existing
+            .and_then(Item::as_array)
+            .is_some_and(|existing| !existing.is_empty())
+    };
+    if !populated {
+        return value(files);
+    }
+    let entries: Vec<String> = files
+        .iter()
+        .filter_map(Value::as_inline_table)
+        .map(|entry| {
+            let field = |key: &str| {
+                entry
+                    .get(key)
+                    .map(|v| {
+                        let mut v = v.clone();
+                        v.decor_mut().clear();
+                        v.to_string()
+                    })
+                    .unwrap_or_default()
+            };
+            format!("    {{file = {}, hash = {}}},\n", field("file"), field("hash"))
+        })
+        .collect();
+    match format!("[\n{}]", entries.concat()).parse::<Value>() {
+        Ok(mut multiline) => {
+            multiline.decor_mut().clear();
+            Item::Value(multiline)
+        }
+        Err(_) => value(files),
+    }
+}
+
 /// The lock generation: `"0"`, `"1.0"`, `"1.1"`, or any `"2.<minor>"` (Poetry
 /// bumps the minor additively — 2.0 → 2.1 kept every shape we rewrite, and the
 /// vendored loader already accepts newer minors with an advisory; the hosted
@@ -290,6 +356,7 @@ pub fn rewrite_poetry_lock_in<'a>(
         // without it), even for archive sources.
         source.insert("reference", value(""));
     }
+    let rewritten = package.contains_key("source");
     package.insert("source", Item::Table(source));
     if matches!(format.as_str(), "1.0" | "1.1") && source_type == "url" {
         // Poetry >= 1.2 verifies url sources against the package's own
@@ -318,7 +385,8 @@ pub fn rewrite_poetry_lock_in<'a>(
             hashes.push(sha256.as_str());
             table.insert(&package_name, value(hashes));
         } else {
-            table.insert(&package_name, value(files));
+            let entry = legacy_files_entry(table, &package_name, files, rewritten);
+            table.insert(&package_name, entry);
         }
     }
     let mut rewritten = lock.to_string();
@@ -968,6 +1036,7 @@ mod parse_reuse_equivalence_tests {
             // without it), even for archive sources.
             source.insert("reference", value(""));
         }
+        let rewritten = package.contains_key("source");
         package.insert("source", Item::Table(source));
         if matches!(format.as_str(), "1.0" | "1.1") && source_type == "url" {
             // Poetry >= 1.2 verifies url sources against the package's own
@@ -996,7 +1065,8 @@ mod parse_reuse_equivalence_tests {
                 hashes.push(sha256.as_str());
                 table.insert(&package_name, value(hashes));
             } else {
-                table.insert(&package_name, value(files));
+                let entry = legacy_files_entry(table, &package_name, files, rewritten);
+                table.insert(&package_name, entry);
             }
         }
         let mut rewritten = lock.to_string();
diff --git a/crates/socket-patch-core/src/vendor/berry_zip.rs b/crates/socket-patch-core/src/vendor/berry_zip.rs
index 17cab520..0cd59e62 100644
--- a/crates/socket-patch-core/src/vendor/berry_zip.rs
+++ b/crates/socket-patch-core/src/vendor/berry_zip.rs
@@ -64,7 +64,7 @@ const MODE_FILE_EXEC: u32 = 0o100755;
 /// — `./`, `..`, `//`, absolute — and duplicate paths) is an `Err` — a wrong
 /// checksum would brick the user's `yarn install` with a YN0018, so we never
 /// guess.
-pub(super) fn berry_cache_checksum_10c0(
+pub(crate) fn berry_cache_checksum_10c0(
     tgz_bytes: &[u8],
     package_ident: &str,
 ) -> Result<String, String> {
diff --git a/crates/socket-patch-core/src/vendor/bun_lock_text.rs b/crates/socket-patch-core/src/vendor/bun_lock_text.rs
index 539f5a2c..2dbe53d9 100644
--- a/crates/socket-patch-core/src/vendor/bun_lock_text.rs
+++ b/crates/socket-patch-core/src/vendor/bun_lock_text.rs
@@ -273,92 +273,6 @@ pub(crate) fn decode_json_string(token: &str) -> Option<String> {
     serde_json::from_str::<String>(token).ok()
 }
 
-/// Is `live` the wiring `recorded` describes, allowing ONLY for a dropped
-/// integrity element?
-///
-/// Bun 1.1.39–1.3.9 re-save a URL or local-tarball tuple WITHOUT its
-/// trailing `"sha512-…"` whenever the lock is re-saved for any other reason
-/// (`bun add <pkg>`, `bun install` after a package.json or workspace
-/// change): the 3-tuple `["name@<url|path>", {meta}, "sha512-…"]` comes
-/// back as the 2-tuple `["name@<url|path>", {meta}]` — spec and meta
-/// intact, digest gone — every text-lock release below 1.3.10 does it
-/// (verified on real 1.1.45 at lockfileVersion 0, 1.2.23 and 1.3.9; 1.3.10,
-/// 1.3.14 and 1.4.2 keep the digest). Those releases never verified a tarball
-/// tuple's digest in the first place, so the install is unchanged; only a
-/// byte-exact comparison against the recorded line would call it drift.
-///
-/// True when the two lines are byte-equal modulo a trailing `\r` (a CRLF
-/// lock read against an LF ledger or vice versa), or when both parse under
-/// bun's entry grammar, name the same map key, decode to the same spec,
-/// carry the same verbatim `{meta}` object, and `live` has exactly the
-/// two leading elements of a `recorded` 3-tuple whose third element is an
-/// SRI integrity string. Anything else — a different URL/uuid, a different
-/// version, a re-laid meta object, a parse failure, a 3-tuple with a
-/// different digest — is NOT the same wiring (fail closed).
-pub(crate) fn same_wiring_modulo_integrity(live: &str, recorded: &str) -> bool {
-    let live = live.strip_suffix('\r').unwrap_or(live);
-    let recorded = recorded.strip_suffix('\r').unwrap_or(recorded);
-    if live == recorded {
-        return true;
-    }
-    let (Ok(live), Ok(recorded)) = (parse_entry_line(live), parse_entry_line(recorded)) else {
-        return false;
-    };
-    if live.key != recorded.key || live.elems.len() != 2 || recorded.elems.len() != 3 {
-        return false;
-    }
-    let live_spec = decode_json_string(&live.elems[0]);
-    let recorded_spec = decode_json_string(&recorded.elems[0]);
-    live_spec.is_some()
-        && live_spec == recorded_spec
-        && live.elems[1].starts_with('{')
-        && live.elems[1] == recorded.elems[1]
-        && decode_json_string(&recorded.elems[2]).is_some_and(|sri| sri.starts_with("sha512-"))
-}
-
-/// Replay helper for a recorded whole-line bun.lock edit whose `new` line
-/// is no longer present byte-for-byte: find the ONE live packages line
-/// that is the same wiring modulo integrity ([`same_wiring_modulo_integrity`])
-/// and replace it with `original`, keeping the live line's own line ending.
-///
-/// `Ok(None)` when no live line matches (the caller keeps its drift
-/// refusal); `Err` when more than one does (ambiguous — never guess which
-/// instance the edit meant, mirroring the byte-exact replay's duplicate
-/// refusal). Line-oriented on a bare `split('\n')` so a CRLF lock keeps
-/// every `\r` exactly where it was.
-pub(crate) fn restore_digestless_line(
-    content: &str,
-    recorded_new: &str,
-    original: &str,
-) -> Result<Option<String>, String> {
-    let mut lines: Vec<&str> = content.split('\n').collect();
-    let matches: Vec<usize> = lines
-        .iter()
-        .enumerate()
-        .filter(|(_, line)| same_wiring_modulo_integrity(line, recorded_new))
-        .map(|(idx, _)| idx)
-        .collect();
-    match matches.as_slice() {
-        [] => Ok(None),
-        [idx] => {
-            let live_cr = lines[*idx].ends_with('\r');
-            let restored = original.strip_suffix('\r').unwrap_or(original);
-            let restored = if live_cr {
-                format!("{restored}\r")
-            } else {
-                restored.to_string()
-            };
-            lines[*idx] = &restored;
-            Ok(Some(lines.join("\n")))
-        }
-        _ => Err(
-            "the digest-less spelling of the redirected entry appears more than once — \
-                  ambiguous, refusing to guess"
-                .to_string(),
-        ),
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -603,140 +517,4 @@ mod tests {
         }
     }
 
-    /// Bun 1.1.39–1.3.9 re-save a URL/local tuple as the digest-less
-    /// 2-tuple; that spelling — and only that spelling — is the same
-    /// wiring as the recorded 3-tuple. Every other difference is drift.
-    #[test]
-    fn same_wiring_modulo_integrity_accepts_only_a_dropped_digest() {
-        let url = "https://patch.socket.dev/patch/npm/tok/uuid/left-pad-1.3.0.tgz";
-        let recorded = format!(
-            "    \"left-pad\": [\"left-pad@{url}\", {{}}, \"sha512-{}==\"],",
-            "A".repeat(86)
-        );
-        let digestless = format!("    \"left-pad\": [\"left-pad@{url}\", {{}}],");
-        assert!(same_wiring_modulo_integrity(&digestless, &recorded));
-        // Byte-equal lines match trivially; a trailing `\r` on either side
-        // (CRLF lock vs LF ledger, or the reverse) is not drift.
-        assert!(same_wiring_modulo_integrity(&recorded, &recorded));
-        assert!(same_wiring_modulo_integrity(
-            &format!("{recorded}\r"),
-            &recorded
-        ));
-        assert!(same_wiring_modulo_integrity(
-            &recorded,
-            &format!("{recorded}\r")
-        ));
-        assert!(same_wiring_modulo_integrity(
-            &format!("{digestless}\r"),
-            &recorded
-        ));
-        assert!(same_wiring_modulo_integrity(
-            &digestless,
-            &format!("{recorded}\r")
-        ));
-
-        // Vendored local-tarball spelling, scoped name (the scope dir stays
-        // in the leaf, so the spec carries TWO `@`), deps meta object.
-        let path = ".socket/vendor/npm/9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f/@scope/pkg-1.0.0.tgz";
-        let meta =
-            r#"{ "dependencies": { "left-pad": "1.3.0" }, "bin": { "scope-pkg": "cli.js" } }"#;
-        let recorded_scoped =
-            format!("    \"@scope/pkg\": [\"@scope/pkg@{path}\", {meta}, \"sha512-Q==\"],");
-        let digestless_scoped = format!("    \"@scope/pkg\": [\"@scope/pkg@{path}\", {meta}],");
-        assert!(same_wiring_modulo_integrity(
-            &digestless_scoped,
-            &recorded_scoped
-        ));
-
-        // Drift, every flavor: another uuid in the URL, another version's
-        // leaf, another key, a re-laid meta object, a 3-tuple with a
-        // DIFFERENT digest, a 4-tuple, an unparseable line, and the
-        // reverse direction (a 3-tuple live line against a 2-tuple record).
-        let other_uuid = digestless.replace("/uuid/", "/other/");
-        assert!(!same_wiring_modulo_integrity(&other_uuid, &recorded));
-        let other_version = digestless.replace("left-pad-1.3.0.tgz", "left-pad-1.2.0.tgz");
-        assert!(!same_wiring_modulo_integrity(&other_version, &recorded));
-        let other_key = digestless.replace("\"left-pad\":", "\"nested/left-pad\":");
-        assert!(!same_wiring_modulo_integrity(&other_key, &recorded));
-        let other_meta = digestless.replace("{}", "{ \"bin\": \"x\" }");
-        assert!(!same_wiring_modulo_integrity(&other_meta, &recorded));
-        let other_digest = recorded.replace(&"A".repeat(86), &"B".repeat(86));
-        assert!(!same_wiring_modulo_integrity(&other_digest, &recorded));
-        let registry = "    \"left-pad\": [\"left-pad@1.3.0\", \"\", {}, \"sha512-X==\"],";
-        assert!(!same_wiring_modulo_integrity(registry, &recorded));
-        assert!(!same_wiring_modulo_integrity(
-            "    \"left-pad\": [",
-            &recorded
-        ));
-        assert!(!same_wiring_modulo_integrity(&recorded, &digestless));
-        // A recorded 3-tuple whose third element is not an SRI string is
-        // not "a tuple that lost its digest" — no relaxation applies.
-        let non_sri = format!("    \"left-pad\": [\"left-pad@{url}\", {{}}, \"\"],");
-        assert!(!same_wiring_modulo_integrity(&digestless, &non_sri));
-        // The workspace 2-tuple of a version-0 lock is a 2-tuple too; it
-        // never equals a tarball record (different spec).
-        let ws = "    \"consumer\": [\"consumer@workspace:packages/consumer\", {}],";
-        assert!(!same_wiring_modulo_integrity(ws, &recorded));
-    }
-
-    /// The replay side: the one digest-less live line is swapped for the
-    /// recorded original with the LIVE line's ending kept; no match is
-    /// `Ok(None)` (the caller refuses as drift), two matches refuse.
-    #[test]
-    fn restore_digestless_line_replaces_the_unique_match_and_keeps_eol() {
-        let url = "https://patch.socket.dev/patch/npm/tok/uuid/left-pad-1.3.0.tgz";
-        let original = "    \"left-pad\": [\"left-pad@1.3.0\", \"\", {}, \"sha512-X==\"],";
-        let recorded_new = format!("    \"left-pad\": [\"left-pad@{url}\", {{}}, \"sha512-A==\"],");
-        let digestless = format!("    \"left-pad\": [\"left-pad@{url}\", {{}}],");
-        let decoy = "    \"abbrev\": [\"abbrev@1.1.1\", \"\", {}, \"sha512-D==\"],";
-        let lock = format!(
-            "{{\n  \"lockfileVersion\": 1,\n  \"packages\": {{\n    {decoy}\n\n{digestless}\n  }}\n}}\n"
-        );
-        let restored = restore_digestless_line(&lock, &recorded_new, original)
-            .unwrap()
-            .expect("the digest-less line must be found");
-        assert_eq!(restored, lock.replace(&digestless, original));
-        assert!(restored.contains(decoy), "the decoy is untouched");
-
-        // CRLF lock against an LF ledger: the restored line takes the
-        // file's `\r\n`, every other `\r` stays.
-        let crlf = lock.replace('\n', "\r\n");
-        let restored = restore_digestless_line(&crlf, &recorded_new, original)
-            .unwrap()
-            .expect("CRLF digest-less line must be found");
-        assert_eq!(restored, crlf.replace(&digestless, original));
-        assert_eq!(
-            restored.matches('\n').count(),
-            restored.matches("\r\n").count()
-        );
-        // LF lock against a CRLF ledger (`\r` recorded on both fragments):
-        // the restored line stays LF.
-        let restored = restore_digestless_line(
-            &lock,
-            &format!("{recorded_new}\r"),
-            &format!("{original}\r"),
-        )
-        .unwrap()
-        .expect("LF digest-less line must be found against a CRLF ledger");
-        assert_eq!(restored, lock.replace(&digestless, original));
-        assert!(!restored.contains('\r'));
-
-        // Nothing matching (the entry was re-resolved to the registry, or
-        // another uuid): `Ok(None)`, the caller's drift refusal stands.
-        let relocked = lock.replace(&digestless, original);
-        assert_eq!(
-            restore_digestless_line(&relocked, &recorded_new, original).unwrap(),
-            None
-        );
-        let other = lock.replace("/uuid/", "/other/");
-        assert_eq!(
-            restore_digestless_line(&other, &recorded_new, original).unwrap(),
-            None
-        );
-        // Two digest-less instances under the same key text (a hand-duplicated
-        // line): ambiguous, refuse rather than guess.
-        let dup = lock.replace(&digestless, &format!("{digestless}\n{digestless}"));
-        let err = restore_digestless_line(&dup, &recorded_new, original).unwrap_err();
-        assert!(err.contains("more than once"), "{err}");
-    }
 }
diff --git a/crates/socket-patch-core/src/vendor/bun_lockb.rs b/crates/socket-patch-core/src/vendor/bun_lockb.rs
index 0fff28eb..27751bcd 100644
--- a/crates/socket-patch-core/src/vendor/bun_lockb.rs
+++ b/crates/socket-patch-core/src/vendor/bun_lockb.rs
@@ -20,6 +20,19 @@ const HEADER: &[u8] = b"#!/usr/bin/env bun\nbun-lockfile-format-v0\n";
 const TOTAL_AT: usize = HEADER.len() + 4 + 32;
 const PACKAGES_AT: usize = TOTAL_AT + 8;
 const INTEGRITY_LEN: usize = 65;
+/// Written by this codec in the last eight bytes of the root package's
+/// resolution (its value union, which a root resolution never reads — early
+/// writers leave uninitialized bytes there, and every supported reader
+/// ignores them) when an edit had to normalize the lock: seven magic bytes,
+/// then a [`NORMALIZED_FORMAT_1`] / [`NORMALIZED_WORKSPACE`] flag byte. v5
+/// hosted mode keeps no ledger, so this is how a later upstream restore knows
+/// the lock's pre-rewrite bytes differ from its registry form.
+const NORMALIZED_MAGIC: &[u8; 7] = b"sktpnrm";
+/// The lock was promoted from binary format 1 ([`BunLockb::demote_legacy_format`]
+/// inverts it exactly).
+pub(crate) const NORMALIZED_FORMAT_1: u8 = 1;
+/// Workspace dependency behaviors were normalized (not invertible).
+pub(crate) const NORMALIZED_WORKSPACE: u8 = 2;
 
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub(crate) struct BinaryPackage {
@@ -341,10 +354,23 @@ impl BunLockb {
         } else {
             target.strip_prefix("file:").unwrap_or(target)
         };
+        if remote && old_tag == 80 {
+            // Re-pinning a hosted record: its superseded URL leaves the pool
+            // tail instead of accumulating there.
+            let replaced = self.data[at + 8..at + 16].to_vec();
+            self.data[at + 8..at + 16].fill(0);
+            self.drop_tail_string(&replaced)?;
+        }
         let pointer = self.intern(target)?;
         // Tarball variants have distinct cache identities. Keeping npm tag 2
         // would allow Bun to reuse an already-cached, unpatched name@version.
-        self.data[at..at + self.resolution_size].fill(0);
+        // A remote (hosted) tarball keeps the registry record's bytes the
+        // tarball variant never reads (padding, semver): v5 hosted mode keeps
+        // no ledger, and they let `set_registry_package` rebuild the exact
+        // registry record — including a writer's uninitialized padding.
+        if !remote {
+            self.data[at..at + self.resolution_size].fill(0);
+        }
         self.data[at] = if remote { 80 } else { 8 };
         self.data[at + 8..at + 16].copy_from_slice(&pointer);
         let integrity_at = self.integrity_at(id);
@@ -354,6 +380,129 @@ impl BunLockb {
         Ok(())
     }
 
+    /// Rebuild package `id` (a tarball record) as Bun's npm registry record
+    /// for `version` (resolution tag 2) resolving `url` with `integrity` —
+    /// the inverse of [`Self::set_package`] when no snapshot of the original
+    /// record survives (v5 hosted mode keeps no ledger).
+    ///
+    /// When the record still carries the registry record's inactive bytes
+    /// (a hosted rewrite by `set_package` retains them) and they spell
+    /// `version`, they are kept verbatim — padding, semver and prerelease
+    /// tags included — so the rebuild is byte-exact. Otherwise the record is
+    /// built the way Bun writes one: zero padding, the semver triple and
+    /// empty prerelease/build tags; a prerelease or build version is then
+    /// refused, since its tags carry Bun's own string hashes.
+    ///
+    /// The URL is interned, so a registry URL the pool still holds is
+    /// re-used at its original offset, and the string the replaced record
+    /// pointed at is trimmed from the pool tail when nothing else references
+    /// it: a lock whose tarball string the hosted rewrite appended gets its
+    /// pre-rewrite pool back.
+    pub(crate) fn set_registry_package(
+        &mut self,
+        id: usize,
+        version: &str,
+        url: &str,
+        integrity: &str,
+    ) -> Result<(), String> {
+        let mut candidate = self.clone();
+        candidate.set_registry_package_inner(id, version, url, integrity)?;
+        let rebuilt = candidate.package(id)?;
+        if rebuilt.version.as_deref() != Some(version) || rebuilt.resolution != url {
+            return Err("bun.lockb: rebuilt registry record does not read back".into());
+        }
+        *self = candidate;
+        Ok(())
+    }
+
+    fn set_registry_package_inner(
+        &mut self,
+        id: usize,
+        version: &str,
+        url: &str,
+        integrity: &str,
+    ) -> Result<(), String> {
+        self.check_id(id)?;
+        self.check_editable()?;
+        let style = self.hash_style()?;
+        if !(url.starts_with("https://") || url.starts_with("http://")) || url.contains('\0') {
+            return Err("bun.lockb: the registry tarball URL is not an http(s) URL".into());
+        }
+        let digest = encode_integrity(integrity)?;
+        let at = self.resolution_at(id);
+        if !matches!(self.data[at], 8 | 80) {
+            return Err("bun.lockb: only tarball packages can be restored to the registry".into());
+        }
+        // Format 1 has no URL column; the hosted rewrite promoted it already.
+        self.promote_legacy_format()?;
+        self.normalize_workspace_behaviors()?;
+        let at = self.resolution_at(id);
+        let replaced = self.data[at + 8..at + 16].to_vec();
+        // The registry record's inactive bytes the hosted rewrite retained
+        // (see `set_package`), when they still spell `version`.
+        let mut record = self.data[at..at + self.resolution_size].to_vec();
+        let retained = self.version_at(at + 16).is_ok_and(|v| v == version);
+        if !retained {
+            let triple: Vec<u64> = version
+                .split('.')
+                .map(|part| {
+                    (!part.is_empty() && part.bytes().all(|b| b.is_ascii_digit()))
+                        .then(|| part.parse::<u64>().ok())
+                        .flatten()
+                })
+                .collect::<Option<Vec<_>>>()
+                .filter(|parts| parts.len() == 3)
+                .ok_or_else(|| {
+                    format!(
+                        "bun.lockb: cannot rebuild the registry record of version {version} \
+                         (only plain major.minor.patch versions are supported)"
+                    )
+                })?;
+            record.fill(0);
+            for (i, number) in triple.into_iter().enumerate() {
+                if self.format == 3 {
+                    record[16 + i * 8..24 + i * 8].copy_from_slice(&number.to_le_bytes());
+                } else {
+                    let number = u32::try_from(number)
+                        .map_err(|_| "bun.lockb: version exceeds this binary format")?;
+                    record[16 + i * 4..20 + i * 4].copy_from_slice(&number.to_le_bytes());
+                }
+            }
+        }
+        // Unlink the replaced record first, so its string (appended by the
+        // rewrite) can leave the pool tail before the registry URL interns.
+        self.data[at..at + self.resolution_size].fill(0);
+        self.drop_tail_string(&replaced)?;
+        let pointer = self.intern(url)?;
+        let at = self.resolution_at(id);
+        record[0] = 2;
+        record[8..16].copy_from_slice(&pointer);
+        self.data[at..at + self.resolution_size].copy_from_slice(&record);
+        let integrity_at = self.integrity_at(id);
+        self.data[integrity_at..integrity_at + INTEGRITY_LEN].copy_from_slice(&digest);
+        self.normalize_production_pool()?;
+        self.update_hash(style)?;
+        Ok(())
+    }
+
+    /// Trim the out-of-line string `pointer` names from the pool when it is
+    /// the pool's (8-byte padded) tail and nothing references it any more.
+    fn drop_tail_string(&mut self, pointer: &[u8]) -> Result<(), String> {
+        if pointer.len() != 8 || pointer[7] & 0x80 == 0 {
+            return Ok(());
+        }
+        let start = u32::from_le_bytes(pointer[..4].try_into().unwrap()) as usize;
+        let len = (u32::from_le_bytes(pointer[4..].try_into().unwrap()) & 0x7fff_ffff) as usize;
+        let end = len
+            .checked_add(7)
+            .map(|n| n & !7)
+            .and_then(|n| start.checked_add(n));
+        if end == Some(self.strings.data.len()) {
+            self.trim_unreferenced_tail(start)?;
+        }
+        Ok(())
+    }
+
     pub(crate) fn restore(&mut self, id: usize, snapshot: &Value) -> Result<(), String> {
         let mut candidate = self.clone();
         candidate.restore_inner(id, snapshot)?;
@@ -556,18 +705,25 @@ impl BunLockb {
     // Some writers also persist the unexpanded workspace:* literal while their
     // binary loader expects its resolved path. Canonical path literals (used by
     // older writers) compare correctly in every supported binary reader.
+    // Either change is lossy, so the lock is marked NORMALIZED_WORKSPACE: an
+    // upstream restore then refuses instead of returning a non-exact lock.
     fn normalize_workspace_behaviors(&mut self) -> Result<(), String> {
         let changes = self.workspace_literal_changes()?;
         let dependencies = self.dependency_array()?;
+        let mut changed = !changes.is_empty();
         for dep in self.data[dependencies.data].chunks_exact_mut(26) {
             if dep[16] & 0x20 != 0 && dep[16] & 0x1e != 0 {
                 dep[16] &= !0x20;
+                changed = true;
             }
         }
         for (at, path) in changes {
             let pointer = self.intern(&path)?;
             self.data[at..at + 8].copy_from_slice(&pointer);
         }
+        if changed {
+            self.mark_normalized(NORMALIZED_WORKSPACE)?;
+        }
         Ok(())
     }
 
@@ -841,9 +997,105 @@ impl BunLockb {
             let at = self.resolution_at(id);
             self.data[at + 8..at + 16].copy_from_slice(&pointer);
         }
+        // The root's last eight resolution bytes are new here (format 1 has
+        // 56), so the mark overwrites nothing the original lock held.
+        self.mark_normalized(NORMALIZED_FORMAT_1)
+    }
+
+    /// Where [`NORMALIZED_MAGIC`] lives: the root package's (id 0, tag 1)
+    /// last eight resolution bytes.
+    fn normalized_mark_at(&self) -> Option<usize> {
+        (self.count > 0 && self.data[self.resolution_at(0)] == 1)
+            .then(|| self.resolution_at(0) + self.resolution_size - 8)
+    }
+
+    fn mark_normalized(&mut self, flag: u8) -> Result<(), String> {
+        let at = self
+            .normalized_mark_at()
+            .ok_or("bun.lockb: the lock has no root package record")?;
+        let flags = self.normalized_flags() | flag;
+        self.data[at..at + 7].copy_from_slice(NORMALIZED_MAGIC);
+        self.data[at + 7] = flags;
         Ok(())
     }
 
+    /// The [`NORMALIZED_FORMAT_1`] / [`NORMALIZED_WORKSPACE`] flags a
+    /// previous edit by this codec recorded (0 for a lock Bun wrote).
+    pub(crate) fn normalized_flags(&self) -> u8 {
+        match self.normalized_mark_at() {
+            Some(at) if &self.data[at..at + 7] == NORMALIZED_MAGIC => self.data[at + 7],
+            _ => 0,
+        }
+    }
+
+    /// The exact format-1 lock [`Self::promote_legacy_format`] made this one
+    /// from, or `None` when this lock was not promoted by it. Verified: the
+    /// result promotes back to exactly these bytes, so any other edit since
+    /// (a record still hosted, Bun re-saving the lock) is an error rather
+    /// than a guess.
+    pub(crate) fn demote_legacy_format(&self) -> Result<Option<Self>, String> {
+        let flags = self.normalized_flags();
+        if self.format != 2 || flags & NORMALIZED_FORMAT_1 == 0 {
+            return Ok(None);
+        }
+        let not_exact = || "bun.lockb: the lock's original binary format-1 bytes cannot be rebuilt";
+        if flags != NORMALIZED_FORMAT_1 {
+            return Err(not_exact().into());
+        }
+        self.check_editable()?;
+        let resolution_start = self.package_start + self.count * 16;
+        let resolution_end = resolution_start + self.count * 64;
+        let package_end =
+            self.package_start + self.count * (204 + if self.fields == 8 { 49 } else { 0 });
+        let delta = self.count * 8;
+        let mut arrays = Vec::new();
+        let mut pos = package_end;
+        for _ in 0..6 {
+            let array = read_array(&self.data, pos, self.total)?;
+            pos = array.data.end;
+            arrays.push(array);
+        }
+        let mut data = Vec::with_capacity(self.data.len() - delta);
+        data.extend_from_slice(&self.data[..resolution_start]);
+        let mut url_offsets = Vec::new();
+        for id in 0..self.count {
+            let record = &self.data[resolution_start + id * 64..resolution_start + (id + 1) * 64];
+            if record[0] == 2 {
+                if record[15] & 0x80 != 0 {
+                    url_offsets.push(u32_at(record, 8)? as usize);
+                }
+                data.extend_from_slice(&record[..8]);
+                data.extend_from_slice(&record[16..]);
+            } else {
+                data.extend_from_slice(&record[..56]);
+            }
+        }
+        data.extend_from_slice(&self.data[resolution_end..]);
+        data[HEADER.len()..HEADER.len() + 4].copy_from_slice(&1u32.to_le_bytes());
+        put_u64(&mut data, PACKAGES_AT + 32, package_end - delta);
+        for array in arrays.iter().chain(self.extensions.iter()) {
+            let at = array.descriptor - delta;
+            put_u64(&mut data, at, array.data.start - delta);
+            put_u64(&mut data, at + 8, array.data.end - delta);
+        }
+        put_u64(&mut data, TOTAL_AT, self.total - delta);
+        let demoted = Self::parse(&data).map_err(|_| not_exact())?;
+        // The promotion appended the registry URLs it interned to the pool;
+        // try each place their run can start (the earliest first).
+        url_offsets.sort_unstable();
+        url_offsets.dedup();
+        let pool = demoted.strings.data.len();
+        for start in url_offsets.into_iter().filter(|s| *s <= pool).chain([pool]) {
+            let mut candidate = demoted.clone();
+            candidate.resize_pool(start, &[])?;
+            let mut promoted = candidate.clone();
+            if promoted.promote_legacy_format().is_ok() && promoted.data == self.data {
+                return Ok(Some(candidate));
+            }
+        }
+        Err(not_exact().into())
+    }
+
     fn update_hash(&mut self, style: (bool, bool)) -> Result<(), String> {
         let hash = self.meta_hash(style)?;
         self.data[HEADER.len() + 4..TOTAL_AT].copy_from_slice(&hash);
@@ -1506,6 +1758,114 @@ mod tests {
         }
     }
 
+    const HOSTED: &str = "https://patch.socket.dev/patch/npm/11111111-1111-4111-8111-111111111111/77777777-7777-4777-8777-777777777777/minimist-1.2.2.tgz";
+
+    #[test]
+    fn registry_rebuild_inverts_a_hosted_rewrite_without_a_snapshot() {
+        for version in VERSIONS.iter().copied().chain(["0.5.9", "two-versions"]) {
+            let original = fixture(version);
+            let mut lock = BunLockb::parse(&original).unwrap();
+            let package = lock
+                .packages()
+                .unwrap()
+                .into_iter()
+                .find(|p| p.name == "minimist" && p.version.as_deref() == Some("1.2.2"))
+                .unwrap();
+            lock.set_package(package.id, HOSTED, &digest()).unwrap();
+            // A re-pin (a later grant's URL) drops the superseded URL.
+            let first = lock.bytes();
+            let token = "11111111-1111-4111-8111-111111111111";
+            let repin = HOSTED.replace(token, "33333333-3333-4333-8333-333333333333");
+            lock.set_package(package.id, &repin, &digest()).unwrap();
+            assert_eq!(lock.bytes().len(), first.len(), "{version}");
+            assert!(
+                !lock.bytes().windows(token.len()).any(|w| w == token.as_bytes()),
+                "{version}: the superseded URL is gone"
+            );
+            // A remote tarball keeps the registry record's inactive bytes; a
+            // local (vendored) one does not.
+            let at = lock.resolution_at(package.id);
+            assert_eq!(lock.data[at], 80, "{version}");
+            if BunLockb::parse(&original).unwrap().format != 1 {
+                assert_eq!(
+                    lock.data[at + 16..at + lock.resolution_size],
+                    original[at + 16..at + lock.resolution_size],
+                    "{version}"
+                );
+            }
+            lock.set_registry_package(
+                package.id,
+                "1.2.2",
+                &package.resolution,
+                package.integrity.as_deref().unwrap(),
+            )
+            .unwrap_or_else(|e| panic!("{version}: {e}"));
+            lock.validate_mutation().unwrap();
+            let restored = lock.package(package.id).unwrap();
+            assert_eq!(restored.version.as_deref(), Some("1.2.2"), "{version}");
+            assert_eq!(restored.resolution, package.resolution, "{version}");
+            assert_eq!(restored.integrity, package.integrity, "{version}");
+            // Format 1 stays promoted to format 2 (marked so), and demotes
+            // back to its exact bytes; every other writer's come back as is.
+            if matches!(version, "0.1.1" | "0.1.6") {
+                assert_eq!(lock.normalized_flags(), NORMALIZED_FORMAT_1, "{version}");
+                let demoted = lock.demote_legacy_format().unwrap().expect("promoted");
+                assert!(demoted.bytes() == original, "exact demotion: {version}");
+            } else {
+                assert_eq!(lock.normalized_flags(), 0, "{version}");
+                assert!(lock.demote_legacy_format().unwrap().is_none(), "{version}");
+                assert!(lock.bytes() == original, "exact rebuild: {version}");
+            }
+        }
+        let mut local = BunLockb::parse(&fixture("0.8.1")).unwrap();
+        local
+            .set_package(1, ".socket/vendor/npm/x/minimist-1.2.2.tgz", &digest())
+            .unwrap();
+        let at = local.resolution_at(1);
+        assert!(local.data[at + 16..at + local.resolution_size].iter().all(|b| *b == 0));
+    }
+
+    #[test]
+    fn registry_rebuild_from_a_zeroed_hosted_record() {
+        // A hosted record whose registry bytes are gone (an older rewrite, or
+        // Bun re-saving the record) is rebuilt the way Bun writes one.
+        for version in ["0.8.1", "1.0.0", "1.1.38", "1.2.0", "1.2.23", "1.4.2"] {
+            let original = fixture(version);
+            let mut lock = BunLockb::parse(&original).unwrap();
+            let package = lock.package(1).unwrap();
+            assert_eq!(package.name, "minimist", "{version}");
+            lock.set_package(1, HOSTED, &digest()).unwrap();
+            let at = lock.resolution_at(1);
+            let size = lock.resolution_size;
+            lock.data[at + 1..at + 8].fill(0);
+            lock.data[at + 16..at + size].fill(0);
+            lock.validate_mutation().unwrap();
+            let hosted = lock.bytes();
+            let err = lock
+                .set_registry_package(1, "1.2.2-beta.1", &package.resolution, &digest())
+                .unwrap_err();
+            assert!(err.contains("major.minor.patch"), "{version}: {err}");
+            assert!(lock.bytes() == hosted, "{version}: transactional");
+            lock.set_registry_package(
+                1,
+                "1.2.2",
+                &package.resolution,
+                package.integrity.as_deref().unwrap(),
+            )
+            .unwrap();
+            lock.validate_mutation().unwrap();
+            assert_eq!(lock.package(1).unwrap().version.as_deref(), Some("1.2.2"));
+            // Writers that zero their padding get their exact bytes back.
+            if version != "0.8.1" {
+                assert!(lock.bytes() == original, "{version}");
+            }
+            // A registry record is not a tarball record to restore.
+            assert!(lock
+                .set_registry_package(1, "1.2.2", &package.resolution, &digest())
+                .is_err());
+        }
+    }
+
     #[test]
     fn workspace_scripts_git_catalog_extensions_retain_valid_metahashes() {
         for version in ["1.1.45-extensions", "1.2.23-extensions", "1.4.2-extensions"] {
diff --git a/crates/socket-patch-core/src/vendor/cargo.rs b/crates/socket-patch-core/src/vendor/cargo.rs
index 54ea86a6..78308656 100644
--- a/crates/socket-patch-core/src/vendor/cargo.rs
+++ b/crates/socket-patch-core/src/vendor/cargo.rs
@@ -784,25 +784,23 @@ async fn cargo_wet_preflight(
     uuid: &str,
 ) -> Result<cargo_lock::LockEntryProbe, VendorOutcome> {
     // Cross-mode takeover guard (fail-closed): a LIVE hosted-redirect wiring
-    // for this crate must be reverted from the redirect ledger BEFORE
-    // vendoring — the CLI vendored flows do exactly that. Reaching this point
-    // with the residue still present means the redirect ledger is missing or
-    // corrupt (no recorded originals to revert with); proceeding would bake
+    // for this crate must be restored to its crates.io entry BEFORE
+    // vendoring — the CLI vendored flows do exactly that (the upstream
+    // restore). Reaching this point with the residue still present means
+    // that restore did not run or could not undo it; proceeding would bake
     // the hosted registry values into this entry's lock originals as if they
     // were pristine, leave Cargo.toml pinned to the hosted registry, and
     // report success on an unbuildable half-migrated project. Refuse with the
     // manual remediation instead. Runs after the dry-run branch: a preview
-    // must not report the wet run's ledger-driven revert as a failure.
+    // must not report the wet run's restore as a failure.
     if let Some(residue) = hosted_redirect_residue(project_root, name, version).await {
         return Err(refused(
             "hosted_redirect_live",
             format!(
-                "{residue}, but no redirect ledger record can revert it \
-                 (.socket/vendor/redirect-state.json is missing or does not \
-                 record this package); restore the ledger, or manually remove \
-                 the `registry = \"socket-patch-…\"` key from Cargo.toml, \
-                 restore the crates.io source/checksum in Cargo.lock, and drop \
-                 the `[registries.socket-patch-…]` block, then re-run"
+                "{residue}, and it was not restored to its crates.io entry; run \
+                 `socket-patch rollback` for this package first, or restore \
+                 Cargo.toml and Cargo.lock from version control (`git checkout \
+                 -- Cargo.toml Cargo.lock`), then re-run"
             ),
         ));
     }
@@ -4203,12 +4201,12 @@ mod tests {
         );
     }
 
-    /// FAIL CLOSED: vendoring over a LIVE hosted redirect with no ledger to
-    /// revert it must refuse — proceeding would record the hosted registry
+    /// FAIL CLOSED: vendoring over a LIVE hosted redirect the upstream
+    /// restore did not undo must refuse — proceeding would record the hosted registry
     /// values as the entry's "originals" and leave Cargo.toml pinned to the
     /// hosted registry (unbuildable in both modes) while reporting success.
     #[tokio::test]
-    async fn test_refuses_live_hosted_redirect_without_ledger() {
+    async fn test_refuses_live_hosted_redirect_left_unrestored() {
         let (dir, blobs, pristine, record) = fixture().await;
         let root = dir.path();
         let index = "sparse+http://127.0.0.1:5555/index/";
@@ -4245,7 +4243,12 @@ mod tests {
             run_vendor(PURL, root, &blobs, &pristine, &record, false).await,
             "hosted_redirect_live",
         );
-        assert!(detail.contains("redirect-state.json"), "{detail}");
+        assert!(
+            detail.contains("socket-patch rollback")
+                && detail.contains("git checkout -- Cargo.toml Cargo.lock"),
+            "the refusal names the restore remedies: {detail}"
+        );
+        assert!(!detail.contains("redirect-state.json"), "{detail}");
         // Nothing was half-vendored.
         assert!(!root.join(format!(".socket/vendor/cargo/{UUID}")).exists());
 
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/pypi.rs b/crates/socket-patch-core/src/vendor/lock_inventory/pypi.rs
index 597cd880..6bd242b5 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/pypi.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/pypi.rs
@@ -583,8 +583,20 @@ async fn inventory_pdm_lock(view: &ProjectView<'_>) -> Option<Vec<LockfileEntry>
 /// out.
 async fn inventory_requirements_txt(view: &ProjectView<'_>) -> Option<Vec<LockfileEntry>> {
     let text = view.read_text("requirements.txt").await.ok()?;
+    let lines = crate::utils::requirements::logical_lines(&text);
+    // An exact pin's `--hash=sha256:` digests verify a PyPI download only
+    // while the file resolves from the public index: an index option
+    // (`-i` / `--index-url` / `--extra-index-url` / `-f`) may serve other
+    // bytes under the same name, so it keeps every pin unverifiable (the
+    // Pipfile.lock `public_index` rule).
+    let public_index = lines.iter().all(|line| {
+        let code = crate::utils::requirements::strip_comment(&line.text).trim_start();
+        !["-i", "--index-url", "--extra-index-url", "-f", "--find-links"]
+            .iter()
+            .any(|opt| code.starts_with(opt))
+    });
     let mut out = Vec::new();
-    for line in crate::utils::requirements::logical_lines(&text) {
+    for line in lines {
         let (code, comment) = crate::utils::requirements::split_comment(&line.text);
         let t = code.trim();
         if t.is_empty() || t.starts_with('-') {
@@ -592,8 +604,18 @@ async fn inventory_requirements_txt(view: &ProjectView<'_>) -> Option<Vec<Lockfi
         }
         // `name==version` (extras, env markers, hash options stripped) —
         // the shared exact-pin rule discovery reads requirements with.
+        let mut integrity = LockIntegrity::None;
         let (name, version) = match crate::utils::requirements::exact_pin(t) {
-            Some((raw_name, version)) => (canonicalize_pypi_name(raw_name), version.to_string()),
+            Some((raw_name, version)) => {
+                let hashes: Vec<String> = crate::utils::requirements::hash_options(t)
+                    .into_iter()
+                    .filter_map(|h| sha256_hex(&h))
+                    .collect();
+                if public_index && !hashes.is_empty() {
+                    integrity = LockIntegrity::Sha256AnyOf(hashes);
+                }
+                (canonicalize_pypi_name(raw_name), version.to_string())
+            }
             None => {
                 let Some((raw_name, reference)) = crate::utils::requirements::direct_reference(t)
                     .and_then(|(n, r)| Some((n, socket_reference_coords(r)?)))
@@ -627,7 +649,7 @@ async fn inventory_requirements_txt(view: &ProjectView<'_>) -> Option<Vec<Lockfi
             name,
             version,
             resolved: None,
-            integrity: LockIntegrity::None,
+            integrity,
         });
     }
     if out.is_empty() {
diff --git a/crates/socket-patch-core/src/vendor/mod.rs b/crates/socket-patch-core/src/vendor/mod.rs
index 9dae4b77..faafcbf1 100644
--- a/crates/socket-patch-core/src/vendor/mod.rs
+++ b/crates/socket-patch-core/src/vendor/mod.rs
@@ -48,7 +48,7 @@
 pub mod path;
 pub mod state;
 
-mod berry_zip;
+pub(crate) mod berry_zip;
 mod bun_binary;
 pub mod bun_lock;
 pub(crate) mod bun_lock_text;
@@ -107,6 +107,7 @@ pub(crate) mod yarn_classic_lock;
 mod yarn_layering_tests;
 
 pub use path::{ecosystem_dir_for_purl, parse_vendor_path};
+#[cfg(test)]
 pub(crate) use pypi_lock::restore_document as restore_python_document;
 pub use source::{DeferredFetchFn, DeferredMiss, DeferredPackage, PackageSource};
 // `vex::discover` validates lockfile-recorded npm names with the same rule the
diff --git a/crates/socket-patch-core/src/vendor/registry_fetch.rs b/crates/socket-patch-core/src/vendor/registry_fetch.rs
index 533ad810..51b0d187 100644
--- a/crates/socket-patch-core/src/vendor/registry_fetch.rs
+++ b/crates/socket-patch-core/src/vendor/registry_fetch.rs
@@ -38,7 +38,7 @@ pub const DEFAULT_NPM_REGISTRY: &str = "https://registry.npmjs.org";
 /// Whole-package caps — wider than `patch/package.rs`'s patch-archive caps
 /// because these are full upstream packages, but still bounded so a
 /// poisoned lockfile cannot turn the fetch into a disk/memory bomb.
-const MAX_DOWNLOAD_BYTES: u64 = 128 * 1024 * 1024;
+pub(crate) const MAX_DOWNLOAD_BYTES: u64 = 128 * 1024 * 1024;
 // `pub(crate)`: `common::read_zip_members` is the in-memory twin of
 // [`extract_zip`] and must refuse exactly the same archives, so it reads the
 // one set of caps rather than carrying a copy that can drift.
@@ -1071,7 +1071,7 @@ async fn fetch_gem(
 /// hash, and Pipfile.lock, which records every release file's hash).
 pub const DEFAULT_PYPI_JSON_API: &str = "https://pypi.org/pypi";
 
-fn pypi_json_api_base() -> String {
+pub(crate) fn pypi_json_api_base() -> String {
     std::env::var("SOCKET_PYPI_JSON_API")
         .ok()
         .map(|v| v.trim_end_matches('/').to_string())
@@ -1211,7 +1211,7 @@ async fn fetch_pypi(
 /// crates.io static download host; override with `SOCKET_CRATES_REGISTRY`.
 pub const DEFAULT_CRATES_REGISTRY: &str = "https://static.crates.io/crates";
 
-fn crates_registry_base() -> String {
+pub(crate) fn crates_registry_base() -> String {
     std::env::var("SOCKET_CRATES_REGISTRY")
         .ok()
         .map(|v| v.trim_end_matches('/').to_string())
@@ -1261,7 +1261,7 @@ pub const DEFAULT_GOPROXY: &str = "https://proxy.golang.org";
 /// the module matches GONOPROXY (defaulting to GOPRIVATE). Falling back to a
 /// public proxy there would send a private module path off the machine.
 /// A non-empty `SOCKET_GOPROXY` is an explicit choice and always wins.
-fn goproxy_base(module: &str) -> Result<String, String> {
+pub(crate) fn goproxy_base(module: &str) -> Result<String, String> {
     if let Ok(v) = std::env::var("SOCKET_GOPROXY") {
         let v = v.trim_end_matches('/').to_string();
         if !v.is_empty() {
@@ -1304,7 +1304,7 @@ fn goproxy_base(module: &str) -> Result<String, String> {
 /// glob match a leading path-element prefix of `target`? A glob with
 /// syntax this matcher does not implement (`[...]`, `\`) counts as a
 /// match, so an unrecognized private pattern never leaks a module path.
-fn go_match_prefix_patterns(globs: &str, target: &str) -> bool {
+pub(crate) fn go_match_prefix_patterns(globs: &str, target: &str) -> bool {
     globs
         .split(',')
         .map(str::trim)
@@ -1339,7 +1339,7 @@ fn go_glob_match(pattern: &[u8], name: &[u8]) -> bool {
 ///
 /// Runs in the ecosystem-agnostic service-download path whenever the
 /// service reports a `dirhashH1`.
-fn go_h1_of_zip(bytes: &[u8]) -> Result<String, String> {
+pub(crate) fn go_h1_of_zip(bytes: &[u8]) -> Result<String, String> {
     Ok(walk_module_zip(bytes, None)?.h1)
 }
 
@@ -1863,7 +1863,7 @@ pub async fn stage_local_dir_artifact(
 /// Capped download. http(s) only; the cap is enforced on the declared
 /// Content-Length AND the actual stream (a lying server cannot blow past
 /// it).
-async fn download(client: &reqwest::Client, url: &str) -> Result<Vec<u8>, String> {
+pub(crate) async fn download(client: &reqwest::Client, url: &str) -> Result<Vec<u8>, String> {
     if !(url.starts_with("https://") || url.starts_with("http://")) {
         return Err(format!("refusing non-http(s) artifact URL `{url}`"));
     }
@@ -2012,7 +2012,7 @@ fn verify_integrity(bytes: &[u8], integrity: &LockIntegrity) -> Result<(), Fetch
 /// legacy package unvendorable whenever the prebuilt-artifact service misses.
 /// The bare-hex twin of this trust
 /// decision already lives in the `LockIntegrity::Sha1Hex` arm above.
-fn verify_sri(bytes: &[u8], sri: &str) -> Result<(), String> {
+pub(crate) fn verify_sri(bytes: &[u8], sri: &str) -> Result<(), String> {
     let mut best: Option<(u8, &str, &str)> = None;
     for token in sri.split_whitespace() {
         let Some((algo, b64)) = token.split_once('-') else {
diff --git a/crates/socket-patch-core/src/vex/discover/mod.rs b/crates/socket-patch-core/src/vex/discover/mod.rs
index 34b3c3ef..5f895fca 100644
--- a/crates/socket-patch-core/src/vex/discover/mod.rs
+++ b/crates/socket-patch-core/src/vex/discover/mod.rs
@@ -916,6 +916,21 @@ pub(crate) fn socket_patch_name_uuid(name: &str, vendored: bool) -> Option<Strin
 /// work per anchor, so a tampered multi-megabyte lock costs one linear pass
 /// per anchor kind.
 fn socket_identities(text: &str, origins: &[String]) -> BTreeSet<(String, WiringMode)> {
+    socket_identities_inner(text, origins)
+}
+
+/// The hosted patch uuids `text` mentions, under the same recognition
+/// rules as discovery's sweep (the upstream restore's "does anything in
+/// this file still need the hosted-side setting" probe).
+pub(crate) fn hosted_uuids_in_text(text: &str, origins: &[String]) -> BTreeSet<String> {
+    socket_identities(text, origins)
+        .into_iter()
+        .filter(|(_, mode)| *mode == WiringMode::Hosted)
+        .map(|(uuid, _)| uuid)
+        .collect()
+}
+
+fn socket_identities_inner(text: &str, origins: &[String]) -> BTreeSet<(String, WiringMode)> {
     let mut found = BTreeSet::new();
     let norm = decode_escapes(text)
         .replace("\\/", "/")
diff --git a/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2018.11.26/extras/Pipfile b/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2018.11.26/extras/Pipfile
new file mode 100644
index 00000000..913743e2
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2018.11.26/extras/Pipfile
@@ -0,0 +1,9 @@
+[[source]]
+url = "https://pypi.org/simple"
+verify_ssl = true
+name = "pypi"
+
+[packages]
+urllib3 = {version="==1.26.18", extras = ["socks"]}
+
+[dev-packages]
diff --git a/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2018.11.26/extras/Pipfile.lock b/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2018.11.26/extras/Pipfile.lock
new file mode 100644
index 00000000..e2d4d3e2
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2018.11.26/extras/Pipfile.lock
@@ -0,0 +1,38 @@
+{
+    "_meta": {
+        "hash": {
+            "sha256": "18be5a21c83ba496f896da8e84834fc611041ecd0242c6a7671f05e804327b02"
+        },
+        "pipfile-spec": 6,
+        "requires": {},
+        "sources": [
+            {
+                "name": "pypi",
+                "url": "https://pypi.org/simple",
+                "verify_ssl": true
+            }
+        ]
+    },
+    "default": {
+        "pysocks": {
+            "hashes": [
+                "sha256:08e69f092cc6dbe92a0fdd16eeb9b9ffbc13cadfe5ca4c7bd92ffb078b293299",
+                "sha256:2725bd0a9925919b9b51739eea5f9e2bae91e83288108a9ad338b2e3a4435ee5",
+                "sha256:3f8804571ebe159c380ac6de37643bb4685970655d3bba243530d6558b799aa0"
+            ],
+            "version": "==1.7.1"
+        },
+        "urllib3": {
+            "extras": [
+                "socks"
+            ],
+            "hashes": [
+                "sha256:34b97092d7e0a3a8cf7cd10e386f401b3737364026c45e622aa02903dffe0f07",
+                "sha256:f8ecc1bba5667413457c529ab955bf8c67b45db799d159066261719e328580a0"
+            ],
+            "index": "pypi",
+            "version": "==1.26.18"
+        }
+    },
+    "develop": {}
+}
diff --git a/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2018.11.26/marker-excluded/Pipfile b/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2018.11.26/marker-excluded/Pipfile
new file mode 100644
index 00000000..5a24c71e
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2018.11.26/marker-excluded/Pipfile
@@ -0,0 +1,9 @@
+[[source]]
+url = "https://pypi.org/simple"
+verify_ssl = true
+name = "pypi"
+
+[packages]
+urllib3 = {version="==1.26.18", markers="python_version > '4'"}
+
+[dev-packages]
diff --git a/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2018.11.26/marker-excluded/Pipfile.lock b/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2018.11.26/marker-excluded/Pipfile.lock
new file mode 100644
index 00000000..740945ef
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2018.11.26/marker-excluded/Pipfile.lock
@@ -0,0 +1,28 @@
+{
+    "_meta": {
+        "hash": {
+            "sha256": "f8e0c7b92c5284e6714e10e481dd901db34954cbb471d506a870bc626cfa67c9"
+        },
+        "pipfile-spec": 6,
+        "requires": {},
+        "sources": [
+            {
+                "name": "pypi",
+                "url": "https://pypi.org/simple",
+                "verify_ssl": true
+            }
+        ]
+    },
+    "default": {
+        "urllib3": {
+            "hashes": [
+                "sha256:34b97092d7e0a3a8cf7cd10e386f401b3737364026c45e622aa02903dffe0f07",
+                "sha256:f8ecc1bba5667413457c529ab955bf8c67b45db799d159066261719e328580a0"
+            ],
+            "index": "pypi",
+            "markers": "python_version > '4'",
+            "version": "==1.26.18"
+        }
+    },
+    "develop": {}
+}
diff --git a/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2022.12.19/extras/Pipfile b/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2022.12.19/extras/Pipfile
new file mode 100644
index 00000000..913743e2
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2022.12.19/extras/Pipfile
@@ -0,0 +1,9 @@
+[[source]]
+url = "https://pypi.org/simple"
+verify_ssl = true
+name = "pypi"
+
+[packages]
+urllib3 = {version="==1.26.18", extras = ["socks"]}
+
+[dev-packages]
diff --git a/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2022.12.19/extras/Pipfile.lock b/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2022.12.19/extras/Pipfile.lock
new file mode 100644
index 00000000..e2d4d3e2
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2022.12.19/extras/Pipfile.lock
@@ -0,0 +1,38 @@
+{
+    "_meta": {
+        "hash": {
+            "sha256": "18be5a21c83ba496f896da8e84834fc611041ecd0242c6a7671f05e804327b02"
+        },
+        "pipfile-spec": 6,
+        "requires": {},
+        "sources": [
+            {
+                "name": "pypi",
+                "url": "https://pypi.org/simple",
+                "verify_ssl": true
+            }
+        ]
+    },
+    "default": {
+        "pysocks": {
+            "hashes": [
+                "sha256:08e69f092cc6dbe92a0fdd16eeb9b9ffbc13cadfe5ca4c7bd92ffb078b293299",
+                "sha256:2725bd0a9925919b9b51739eea5f9e2bae91e83288108a9ad338b2e3a4435ee5",
+                "sha256:3f8804571ebe159c380ac6de37643bb4685970655d3bba243530d6558b799aa0"
+            ],
+            "version": "==1.7.1"
+        },
+        "urllib3": {
+            "extras": [
+                "socks"
+            ],
+            "hashes": [
+                "sha256:34b97092d7e0a3a8cf7cd10e386f401b3737364026c45e622aa02903dffe0f07",
+                "sha256:f8ecc1bba5667413457c529ab955bf8c67b45db799d159066261719e328580a0"
+            ],
+            "index": "pypi",
+            "version": "==1.26.18"
+        }
+    },
+    "develop": {}
+}
diff --git a/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2022.12.19/marker-excluded/Pipfile b/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2022.12.19/marker-excluded/Pipfile
new file mode 100644
index 00000000..5a24c71e
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2022.12.19/marker-excluded/Pipfile
@@ -0,0 +1,9 @@
+[[source]]
+url = "https://pypi.org/simple"
+verify_ssl = true
+name = "pypi"
+
+[packages]
+urllib3 = {version="==1.26.18", markers="python_version > '4'"}
+
+[dev-packages]
diff --git a/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2022.12.19/marker-excluded/Pipfile.lock b/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2022.12.19/marker-excluded/Pipfile.lock
new file mode 100644
index 00000000..e050d943
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2022.12.19/marker-excluded/Pipfile.lock
@@ -0,0 +1,27 @@
+{
+    "_meta": {
+        "hash": {
+            "sha256": "f8e0c7b92c5284e6714e10e481dd901db34954cbb471d506a870bc626cfa67c9"
+        },
+        "pipfile-spec": 6,
+        "requires": {},
+        "sources": [
+            {
+                "name": "pypi",
+                "url": "https://pypi.org/simple",
+                "verify_ssl": true
+            }
+        ]
+    },
+    "default": {
+        "urllib3": {
+            "hashes": [
+                "sha256:34b97092d7e0a3a8cf7cd10e386f401b3737364026c45e622aa02903dffe0f07",
+                "sha256:f8ecc1bba5667413457c529ab955bf8c67b45db799d159066261719e328580a0"
+            ],
+            "markers": "python_version > '4'",
+            "version": "==1.26.18"
+        }
+    },
+    "develop": {}
+}
diff --git a/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2026.8.0/extras/Pipfile b/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2026.8.0/extras/Pipfile
new file mode 100644
index 00000000..913743e2
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2026.8.0/extras/Pipfile
@@ -0,0 +1,9 @@
+[[source]]
+url = "https://pypi.org/simple"
+verify_ssl = true
+name = "pypi"
+
+[packages]
+urllib3 = {version="==1.26.18", extras = ["socks"]}
+
+[dev-packages]
diff --git a/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2026.8.0/extras/Pipfile.lock b/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2026.8.0/extras/Pipfile.lock
new file mode 100644
index 00000000..db691aa8
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2026.8.0/extras/Pipfile.lock
@@ -0,0 +1,39 @@
+{
+    "_meta": {
+        "hash": {
+            "sha256": "18be5a21c83ba496f896da8e84834fc611041ecd0242c6a7671f05e804327b02"
+        },
+        "pipfile-spec": 6,
+        "requires": {},
+        "sources": [
+            {
+                "name": "pypi",
+                "url": "https://pypi.org/simple",
+                "verify_ssl": true
+            }
+        ]
+    },
+    "default": {
+        "pysocks": {
+            "hashes": [
+                "sha256:08e69f092cc6dbe92a0fdd16eeb9b9ffbc13cadfe5ca4c7bd92ffb078b293299",
+                "sha256:2725bd0a9925919b9b51739eea5f9e2bae91e83288108a9ad338b2e3a4435ee5",
+                "sha256:3f8804571ebe159c380ac6de37643bb4685970655d3bba243530d6558b799aa0"
+            ],
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3'",
+            "version": "==1.7.1"
+        },
+        "urllib3": {
+            "extras": [
+                "socks"
+            ],
+            "hashes": [
+                "sha256:34b97092d7e0a3a8cf7cd10e386f401b3737364026c45e622aa02903dffe0f07",
+                "sha256:f8ecc1bba5667413457c529ab955bf8c67b45db799d159066261719e328580a0"
+            ],
+            "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'",
+            "version": "==1.26.18"
+        }
+    },
+    "develop": {}
+}
diff --git a/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2026.8.0/marker-excluded/Pipfile b/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2026.8.0/marker-excluded/Pipfile
new file mode 100644
index 00000000..5a24c71e
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2026.8.0/marker-excluded/Pipfile
@@ -0,0 +1,9 @@
+[[source]]
+url = "https://pypi.org/simple"
+verify_ssl = true
+name = "pypi"
+
+[packages]
+urllib3 = {version="==1.26.18", markers="python_version > '4'"}
+
+[dev-packages]
diff --git a/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2026.8.0/marker-excluded/Pipfile.lock b/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2026.8.0/marker-excluded/Pipfile.lock
new file mode 100644
index 00000000..e050d943
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/pipenv-shapes/2026.8.0/marker-excluded/Pipfile.lock
@@ -0,0 +1,27 @@
+{
+    "_meta": {
+        "hash": {
+            "sha256": "f8e0c7b92c5284e6714e10e481dd901db34954cbb471d506a870bc626cfa67c9"
+        },
+        "pipfile-spec": 6,
+        "requires": {},
+        "sources": [
+            {
+                "name": "pypi",
+                "url": "https://pypi.org/simple",
+                "verify_ssl": true
+            }
+        ]
+    },
+    "default": {
+        "urllib3": {
+            "hashes": [
+                "sha256:34b97092d7e0a3a8cf7cd10e386f401b3737364026c45e622aa02903dffe0f07",
+                "sha256:f8ecc1bba5667413457c529ab955bf8c67b45db799d159066261719e328580a0"
+            ],
+            "markers": "python_version > '4'",
+            "version": "==1.26.18"
+        }
+    },
+    "develop": {}
+}
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/capture-1.2.0-config-registry/expected-confirmation.json b/crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/capture-1.2.0-config-registry/expected-confirmation.json
new file mode 100644
index 00000000..7cfc5070
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/capture-1.2.0-config-registry/expected-confirmation.json
@@ -0,0 +1,7 @@
+{
+  "confirmed": [
+    "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa"
+  ],
+  "refused": [],
+  "vltDrives": true
+}
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/capture-1.2.0-config-registry/expected-edits.json b/crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/capture-1.2.0-config-registry/expected-edits.json
new file mode 100644
index 00000000..78994cde
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/capture-1.2.0-config-registry/expected-edits.json
@@ -0,0 +1,10 @@
+[
+  {
+    "path": "vlt-lock.json",
+    "kind": "redirect_vlt_lock_node",
+    "action": "rewritten",
+    "key": "left-pad@1.3.0",
+    "original": "\"~npm~left-pad@1.3.0\": [0,\"left-pad\",\"sha512-XI5MPzVNApjAyhQzphX8BkmKsKUxD4LdyK24iZeQGinBN9yTQT3bFlCBy/aVx2HrNcqQGsdot8ghrjyrvMCoEA==\"]",
+    "new": "\"~npm~left-pad@1.3.0\": [0,\"left-pad\",\"sha512-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==\",\"https://patch.socket.dev/patch/npm/11111111-1111-1111-1111-111111111111/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/left-pad-1.3.0.tgz\"]"
+  }
+]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/capture-1.2.0-config-registry/expected-warnings.json b/crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/capture-1.2.0-config-registry/expected-warnings.json
new file mode 100644
index 00000000..fe51488c
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/capture-1.2.0-config-registry/expected-warnings.json
@@ -0,0 +1 @@
+[]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/capture-1.2.0-config-registry/expected/vlt-lock.json b/crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/capture-1.2.0-config-registry/expected/vlt-lock.json
new file mode 100644
index 00000000..0716ebd9
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/capture-1.2.0-config-registry/expected/vlt-lock.json
@@ -0,0 +1,15 @@
+{
+  "lockfileVersion": 1,
+  "options": {
+    "registry": "https://registry.npmjs.org/",
+    "registries": {
+      "npm": "https://registry.npmjs.org/"
+    }
+  },
+  "nodes": {
+    "~npm~left-pad@1.3.0": [0,"left-pad","sha512-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==","https://patch.socket.dev/patch/npm/11111111-1111-1111-1111-111111111111/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/left-pad-1.3.0.tgz"]
+  },
+  "edges": {
+    "file~_d left-pad": "prod 1.3.0 ~npm~left-pad@1.3.0"
+  }
+}
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/capture-1.2.0-config-registry/input/vlt-lock.json b/crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/capture-1.2.0-config-registry/input/vlt-lock.json
new file mode 100644
index 00000000..fc070e4d
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/capture-1.2.0-config-registry/input/vlt-lock.json
@@ -0,0 +1,15 @@
+{
+  "lockfileVersion": 1,
+  "options": {
+    "registry": "https://registry.npmjs.org/",
+    "registries": {
+      "npm": "https://registry.npmjs.org/"
+    }
+  },
+  "nodes": {
+    "~npm~left-pad@1.3.0": [0,"left-pad","sha512-XI5MPzVNApjAyhQzphX8BkmKsKUxD4LdyK24iZeQGinBN9yTQT3bFlCBy/aVx2HrNcqQGsdot8ghrjyrvMCoEA=="]
+  },
+  "edges": {
+    "file~_d left-pad": "prod 1.3.0 ~npm~left-pad@1.3.0"
+  }
+}
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/capture-1.2.0-config-registry/overrides.json b/crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/capture-1.2.0-config-registry/overrides.json
new file mode 100644
index 00000000..10e9e18a
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/capture-1.2.0-config-registry/overrides.json
@@ -0,0 +1,13 @@
+[
+  {
+    "ecosystem": "npm",
+    "name": "left-pad",
+    "version": "1.3.0",
+    "token": "11111111-1111-1111-1111-111111111111",
+    "patchUuid": "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+    "artifactUrl": "https://patch.socket.dev/patch/npm/11111111-1111-1111-1111-111111111111/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/left-pad-1.3.0.tgz",
+    "integrity": {
+      "sha512": "sha512-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=="
+    }
+  }
+]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/lock-v1-both-registry-keys/expected-edits.json b/crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/lock-v1-both-registry-keys/expected-edits.json
index 5a1e33aa..78994cde 100644
--- a/crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/lock-v1-both-registry-keys/expected-edits.json
+++ b/crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/lock-v1-both-registry-keys/expected-edits.json
@@ -4,7 +4,7 @@
     "kind": "redirect_vlt_lock_node",
     "action": "rewritten",
     "key": "left-pad@1.3.0",
-    "original": "\"~npm~left-pad@1.3.0\": [0,\"left-pad\",\"sha512-XI5MPzVNApjAyhQzphX8BkmKsKUxD4LdyK24iZeQGinBN9yTQT3bFlCBy/aVx2HrNcqQGsdot8ghrjyrvMCoEA==\",\"https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz\"]",
+    "original": "\"~npm~left-pad@1.3.0\": [0,\"left-pad\",\"sha512-XI5MPzVNApjAyhQzphX8BkmKsKUxD4LdyK24iZeQGinBN9yTQT3bFlCBy/aVx2HrNcqQGsdot8ghrjyrvMCoEA==\"]",
     "new": "\"~npm~left-pad@1.3.0\": [0,\"left-pad\",\"sha512-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==\",\"https://patch.socket.dev/patch/npm/11111111-1111-1111-1111-111111111111/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/left-pad-1.3.0.tgz\"]"
   }
 ]
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/lock-v1-both-registry-keys/input/vlt-lock.json b/crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/lock-v1-both-registry-keys/input/vlt-lock.json
index 1f881fcb..fc070e4d 100644
--- a/crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/lock-v1-both-registry-keys/input/vlt-lock.json
+++ b/crates/socket-patch-core/tests/fixtures/redirect/npm/vlt/lock-v1-both-registry-keys/input/vlt-lock.json
@@ -7,7 +7,7 @@
     }
   },
   "nodes": {
-    "~npm~left-pad@1.3.0": [0,"left-pad","sha512-XI5MPzVNApjAyhQzphX8BkmKsKUxD4LdyK24iZeQGinBN9yTQT3bFlCBy/aVx2HrNcqQGsdot8ghrjyrvMCoEA==","https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz"]
+    "~npm~left-pad@1.3.0": [0,"left-pad","sha512-XI5MPzVNApjAyhQzphX8BkmKsKUxD4LdyK24iZeQGinBN9yTQT3bFlCBy/aVx2HrNcqQGsdot8ghrjyrvMCoEA=="]
   },
   "edges": {
     "file~_d left-pad": "prod 1.3.0 ~npm~left-pad@1.3.0"
diff --git a/crates/socket-patch-core/tests/fixtures/vex-discover-golden/pipenv-shapes.json b/crates/socket-patch-core/tests/fixtures/vex-discover-golden/pipenv-shapes.json
new file mode 100644
index 00000000..72fd9a02
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/vex-discover-golden/pipenv-shapes.json
@@ -0,0 +1,92 @@
+{
+  "pipenv-shapes/2018.11.26/extras": {
+    "refs": [],
+    "diagnostics": [],
+    "recognized": [],
+    "unlocked_pins": [],
+    "elsewhere": [
+      {
+        "purl": "pkg:pypi/pysocks@1.7.1",
+        "file": "Pipfile.lock"
+      },
+      {
+        "purl": "pkg:pypi/urllib3@1.26.18",
+        "file": "Pipfile.lock"
+      }
+    ],
+    "live_claims": []
+  },
+  "pipenv-shapes/2018.11.26/marker-excluded": {
+    "refs": [],
+    "diagnostics": [],
+    "recognized": [],
+    "unlocked_pins": [],
+    "elsewhere": [
+      {
+        "purl": "pkg:pypi/urllib3@1.26.18",
+        "file": "Pipfile.lock"
+      }
+    ],
+    "live_claims": []
+  },
+  "pipenv-shapes/2022.12.19/extras": {
+    "refs": [],
+    "diagnostics": [],
+    "recognized": [],
+    "unlocked_pins": [],
+    "elsewhere": [
+      {
+        "purl": "pkg:pypi/pysocks@1.7.1",
+        "file": "Pipfile.lock"
+      },
+      {
+        "purl": "pkg:pypi/urllib3@1.26.18",
+        "file": "Pipfile.lock"
+      }
+    ],
+    "live_claims": []
+  },
+  "pipenv-shapes/2022.12.19/marker-excluded": {
+    "refs": [],
+    "diagnostics": [],
+    "recognized": [],
+    "unlocked_pins": [],
+    "elsewhere": [
+      {
+        "purl": "pkg:pypi/urllib3@1.26.18",
+        "file": "Pipfile.lock"
+      }
+    ],
+    "live_claims": []
+  },
+  "pipenv-shapes/2026.8.0/extras": {
+    "refs": [],
+    "diagnostics": [],
+    "recognized": [],
+    "unlocked_pins": [],
+    "elsewhere": [
+      {
+        "purl": "pkg:pypi/pysocks@1.7.1",
+        "file": "Pipfile.lock"
+      },
+      {
+        "purl": "pkg:pypi/urllib3@1.26.18",
+        "file": "Pipfile.lock"
+      }
+    ],
+    "live_claims": []
+  },
+  "pipenv-shapes/2026.8.0/marker-excluded": {
+    "refs": [],
+    "diagnostics": [],
+    "recognized": [],
+    "unlocked_pins": [],
+    "elsewhere": [
+      {
+        "purl": "pkg:pypi/urllib3@1.26.18",
+        "file": "Pipfile.lock"
+      }
+    ],
+    "live_claims": []
+  }
+}
diff --git a/crates/socket-patch-core/tests/fixtures/vex-discover-golden/redirect-npm.json b/crates/socket-patch-core/tests/fixtures/vex-discover-golden/redirect-npm.json
index ede25a19..4b37774b 100644
--- a/crates/socket-patch-core/tests/fixtures/vex-discover-golden/redirect-npm.json
+++ b/crates/socket-patch-core/tests/fixtures/vex-discover-golden/redirect-npm.json
@@ -4082,6 +4082,56 @@
     ],
     "live_claims": []
   },
+  "redirect/npm/vlt/capture-1.2.0-config-registry/expected": {
+    "refs": [
+      {
+        "purl": "pkg:npm/left-pad@1.3.0",
+        "uuid": "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+        "mode": "hosted",
+        "source_file": "vlt-lock.json",
+        "artifact_rel": null,
+        "locked_integrity": "Sri(\"sha512-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==\")",
+        "integrity_required": true,
+        "url": "https://patch.socket.dev/patch/npm/11111111-1111-1111-1111-111111111111/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/left-pad-1.3.0.tgz",
+        "lockfile_basis_ok": true
+      }
+    ],
+    "diagnostics": [],
+    "recognized": [
+      {
+        "uuid": "11111111-1111-1111-1111-111111111111",
+        "mode": "hosted",
+        "file": "vlt-lock.json"
+      },
+      {
+        "uuid": "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+        "mode": "hosted",
+        "file": "vlt-lock.json"
+      }
+    ],
+    "unlocked_pins": [],
+    "elsewhere": [],
+    "live_claims": [
+      {
+        "mode": "hosted",
+        "uuid": "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+        "purl": "pkg:npm/left-pad@1.3.0"
+      }
+    ]
+  },
+  "redirect/npm/vlt/capture-1.2.0-config-registry/input": {
+    "refs": [],
+    "diagnostics": [],
+    "recognized": [],
+    "unlocked_pins": [],
+    "elsewhere": [
+      {
+        "purl": "pkg:npm/left-pad@1.3.0",
+        "file": "vlt-lock.json"
+      }
+    ],
+    "live_claims": []
+  },
   "redirect/npm/vlt/crlf/expected": {
     "refs": [
       {
diff --git a/crates/socket-patch-core/tests/hosted_inventory.rs b/crates/socket-patch-core/tests/hosted_inventory.rs
new file mode 100644
index 00000000..6e3d16dc
--- /dev/null
+++ b/crates/socket-patch-core/tests/hosted_inventory.rs
@@ -0,0 +1,75 @@
+//! The hosted inventory keeps contested wiring: a hosted lock another lock
+//! contradicts is not an attributable pin, but it is still hosted state
+//! management commands must refuse around.
+
+use socket_patch_core::patch::redirect::upstream::HostedInventory;
+
+const PATCH: &str = "11111111-1111-4111-8111-111111111111";
+const GRANT: &str = "22222222-2222-4222-8222-222222222222";
+
+fn lock(resolved: &str, integrity: &str) -> String {
+    format!(
+        r#"{{"name":"app","version":"1.0.0","lockfileVersion":3,"requires":true,"packages":{{"":{{"name":"app","version":"1.0.0","dependencies":{{"left-pad":"1.3.0"}}}},"node_modules/left-pad":{{"version":"1.3.0","resolved":"{resolved}","integrity":"{integrity}"}}}}}}"#
+    )
+}
+
+fn hosted_url() -> String {
+    format!("https://patch.socket.dev/patch/npm/left-pad/1.3.0/{GRANT}/{PATCH}/left-pad-1.3.0.tgz")
+}
+
+fn write_project(root: &std::path::Path, shrinkwrap_hosted: bool, lock_hosted: bool) {
+    std::fs::write(
+        root.join("package.json"),
+        r#"{"name":"app","version":"1.0.0","dependencies":{"left-pad":"1.3.0"}}"#,
+    )
+    .unwrap();
+    let upstream = lock(
+        "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
+        "sha512-upstream==",
+    );
+    let hosted = lock(&hosted_url(), "sha512-patched==");
+    std::fs::write(
+        root.join("package-lock.json"),
+        if lock_hosted { &hosted } else { &upstream },
+    )
+    .unwrap();
+    if shrinkwrap_hosted {
+        std::fs::write(root.join("npm-shrinkwrap.json"), &hosted).unwrap();
+    }
+}
+
+async fn inventory(root: &std::path::Path) -> HostedInventory {
+    HostedInventory::of(&socket_patch_core::vex::discover_patched_refs(root).await)
+}
+
+#[tokio::test]
+async fn contradicted_hosted_lock_is_contested_not_absent() {
+    let tmp = tempfile::tempdir().unwrap();
+    write_project(tmp.path(), true, false);
+    let inv = inventory(tmp.path()).await;
+    assert!(inv.pins.is_empty(), "no attributable pin: {inv:?}");
+    assert!(!inv.is_empty(), "contested wiring is hosted state: {inv:?}");
+    let refusal = inv.contested_refusal().expect("a refusal");
+    assert!(refusal.contains("npm-shrinkwrap.json"), "{refusal}");
+    assert!(refusal.contains("git checkout -- npm-shrinkwrap.json"), "{refusal}");
+    assert!(refusal.contains("patched_ref_unattributable"), "{refusal}");
+    assert!(!refusal.contains(GRANT), "the grant token is not a patch: {refusal}");
+}
+
+#[tokio::test]
+async fn attributable_pin_is_not_contested() {
+    let tmp = tempfile::tempdir().unwrap();
+    write_project(tmp.path(), false, true);
+    let inv = inventory(tmp.path()).await;
+    assert_eq!(inv.pins.len(), 1, "{inv:?}");
+    assert_eq!(inv.pins[0].uuid, PATCH);
+    assert!(inv.contested.is_empty(), "{inv:?}");
+    assert!(inv.contested_refusal().is_none());
+}
+
+#[tokio::test]
+async fn registry_only_project_has_no_hosted_state() {
+    let tmp = tempfile::tempdir().unwrap();
+    write_project(tmp.path(), false, false);
+    assert!(inventory(tmp.path()).await.is_empty());
+}
diff --git a/crates/socket-patch-core/tests/poetry_hosted.rs b/crates/socket-patch-core/tests/poetry_hosted.rs
index 74ad3cd6..80fae366 100644
--- a/crates/socket-patch-core/tests/poetry_hosted.rs
+++ b/crates/socket-patch-core/tests/poetry_hosted.rs
@@ -1,6 +1,5 @@
 use socket_patch_core::patch::redirect::{
-    revert_remaining_redirect_edits, rewrite_registry_redirect, DepOverride, Integrity,
-    RedirectState,
+    rewrite_registry_redirect, DepOverride, Integrity,
 };
 use socket_patch_core::utils::poetry_lock::rewrite_poetry_lock;
 use std::collections::BTreeMap;
@@ -39,8 +38,8 @@ fn patch() -> DepOverride {
     }
 }
 
-#[tokio::test]
-async fn native_lock_generations_redirect_idempotently_and_restore_every_byte() {
+#[test]
+fn native_lock_generations_redirect_idempotently() {
     for version in VERSIONS {
         for crlf in [false, true] {
             let pristine = if crlf {
@@ -75,23 +74,6 @@ async fn native_lock_generations_redirect_idempotently_and_restore_every_byte()
             assert!(again.warnings.is_empty(), "{version}: {:?}", again.warnings);
             assert!(again.files.is_empty());
             assert!(again.edits.is_empty());
-            let directory = tempfile::tempdir().unwrap();
-            tokio::fs::write(directory.path().join("poetry.lock"), redirected)
-                .await
-                .unwrap();
-            let mut state = RedirectState {
-                edits: result.edits,
-                ..RedirectState::default()
-            };
-            let outcome =
-                revert_remaining_redirect_edits(directory.path(), &mut state, false).await;
-            assert!(outcome.fully_reverted(), "{:?}", outcome.refusals);
-            assert_eq!(
-                tokio::fs::read_to_string(directory.path().join("poetry.lock"))
-                    .await
-                    .unwrap(),
-                pristine
-            );
         }
     }
 }
@@ -120,6 +102,31 @@ fn hosted_shapes_match_each_lock_generations_installer() {
     let doc: toml_edit::DocumentMut = lock10.parse().unwrap();
     assert!(doc["package"][0]["files"].is_array(), "{lock10}");
 
+    // A legacy entry that listed files is replaced one file per line (as
+    // Poetry renders it), an empty `[]` one inline: the layout is how the
+    // hosted rollback tells which to put back.
+    let populated = original("1.0.10").replace(
+        "urllib3 = []",
+        "urllib3 = [\n    {file = \"urllib3-1.26.18.tar.gz\", hash = \"sha256:f8ecc1bba5667413457c529ab955bf8c67b45db799d159066261719e328580a0\"},\n]",
+    );
+    let lock10_populated = rewrite_registry_redirect(
+        &BTreeMap::from([("poetry.lock".to_string(), populated)]),
+        &[patch()],
+    )
+    .files["poetry.lock"]
+        .clone();
+    assert!(
+        lock10_populated.contains(&format!(
+            "urllib3 = [\n    {{file = \"{WHEEL}\", hash = \"sha256:{sha}\"}},\n]"
+        )),
+        "{lock10_populated}"
+    );
+    let rerun = rewrite_registry_redirect(
+        &BTreeMap::from([("poetry.lock".to_string(), lock10_populated)]),
+        &[patch()],
+    );
+    assert!(rerun.files.is_empty() && rerun.warnings.is_empty(), "{:?}", rerun.warnings);
+
     let lock11 = rewrite_registry_redirect(
         &BTreeMap::from([("poetry.lock".to_string(), original("1.2.2"))]),
         &[patch()],
@@ -227,124 +234,6 @@ fn invalid_inputs_never_produce_edits() {
     assert_eq!(result.warnings[0].code, "redirect_poetry_missing_sha256");
 }
 
-#[tokio::test]
-async fn drift_keeps_the_lock_and_rollback_ledger() {
-    let files = BTreeMap::from([("poetry.lock".into(), original("1.1.15"))]);
-    let result = rewrite_registry_redirect(&files, &[patch()]);
-    let changed = result.files["poetry.lock"].replace("sha256:aaaa", "sha256:bbbb");
-    let directory = tempfile::tempdir().unwrap();
-    tokio::fs::write(directory.path().join("poetry.lock"), &changed)
-        .await
-        .unwrap();
-    let mut state = RedirectState {
-        edits: result.edits,
-        ..RedirectState::default()
-    };
-    let outcome = revert_remaining_redirect_edits(directory.path(), &mut state, false).await;
-    assert!(!outcome.fully_reverted());
-    assert!(!state.edits.is_empty());
-    assert_eq!(
-        tokio::fs::read_to_string(directory.path().join("poetry.lock"))
-            .await
-            .unwrap(),
-        changed
-    );
-}
-
-#[tokio::test]
-async fn either_patch_reverts_independently_with_unrelated_edits() {
-    for version in VERSIONS.iter().filter(|version| **version != "0.12.17") {
-        for crlf in [false, true] {
-            for first_name in ["urllib3", "six"] {
-                let mut lock: toml_edit::DocumentMut = original(version).parse().unwrap();
-                let packages = lock["package"].as_array_of_tables_mut().unwrap();
-                let mut second = packages.get(0).unwrap().clone();
-                second["name"] = toml_edit::value("six");
-                second["version"] = toml_edit::value("1.16.0");
-                second.set_position(None);
-                second.remove("extras");
-                packages.push(second);
-                if let Some(files) = lock["metadata"].get_mut("files") {
-                    if let Some(value) = files.get("urllib3").cloned() {
-                        files["six"] = value;
-                    }
-                }
-                let pristine = lock.to_string();
-                let pristine = if crlf {
-                    pristine.replace('\n', "\r\n")
-                } else {
-                    pristine
-                };
-                let second_patch = DepOverride {
-                    name: "six".into(),
-                    version: "1.16.0".into(),
-                    artifact_url: URL.replace("urllib3", "six").replace("1.26.18", "1.16.0"),
-                    ..patch()
-                };
-                let files = BTreeMap::from([("poetry.lock".into(), pristine.clone())]);
-                let first = rewrite_registry_redirect(&files, &[patch()]);
-                assert!(
-                    !first.files.is_empty(),
-                    "{version}: {:?}\n{pristine}",
-                    first.warnings
-                );
-                let second = rewrite_registry_redirect(&first.files, &[second_patch]);
-                assert!(
-                    !second.files.is_empty(),
-                    "{version}: {:?}\n{}",
-                    second.warnings,
-                    first.files["poetry.lock"]
-                );
-                assert!(
-                    second
-                        .warnings
-                        .iter()
-                        .all(|w| w.code == "redirect_poetry_stale_install_risk"),
-                    "{:?}",
-                    second.warnings
-                );
-                let directory = tempfile::tempdir().unwrap();
-                let unrelated = if crlf {
-                    "# retained user edit\r\n"
-                } else {
-                    "# retained user edit\n"
-                };
-                tokio::fs::write(
-                    directory.path().join("poetry.lock"),
-                    format!("{unrelated}{}", second.files["poetry.lock"]),
-                )
-                .await
-                .unwrap();
-                let mut states: Vec<_> = [first, second]
-                    .into_iter()
-                    .map(|result| RedirectState {
-                        edits: result.edits,
-                        ..RedirectState::default()
-                    })
-                    .collect();
-                if first_name == "six" {
-                    states.reverse();
-                }
-                for state in &mut states {
-                    let outcome =
-                        revert_remaining_redirect_edits(directory.path(), state, false).await;
-                    assert!(
-                        outcome.fully_reverted(),
-                        "{version}: {:?}",
-                        outcome.refusals
-                    );
-                }
-                assert_eq!(
-                    tokio::fs::read_to_string(directory.path().join("poetry.lock"))
-                        .await
-                        .unwrap(),
-                    format!("{unrelated}{pristine}")
-                );
-            }
-        }
-    }
-}
-
 #[test]
 fn absent_entries_warn_once_and_missing_sha256_is_gated_once_per_dep() {
     let files = BTreeMap::from([
@@ -373,32 +262,17 @@ fn absent_entries_warn_once_and_missing_sha256_is_gated_once_per_dep() {
 /// A future Poetry that bumps the lock minor (2.2) is rewritten like 2.1 in
 /// hosted mode — the vendored loader already accepts it with an advisory, and
 /// the same lock must not be a silent no-op on one path and applied on another.
-#[tokio::test]
-async fn newer_2x_minor_redirects_and_reverts() {
+#[test]
+fn newer_2x_minor_redirects() {
     let lock = original("2.4.3").replace("lock-version = \"2.1\"", "lock-version = \"2.2\"");
     let files = BTreeMap::from([("poetry.lock".to_string(), lock.clone())]);
     let result = rewrite_registry_redirect(&files, &[patch()]);
     assert!(result.warnings.is_empty(), "{:?}", result.warnings);
     assert!(result.files["poetry.lock"].contains(URL));
-    let directory = tempfile::tempdir().unwrap();
-    tokio::fs::write(directory.path().join("poetry.lock"), &result.files["poetry.lock"])
-        .await
-        .unwrap();
-    let mut state = RedirectState {
-        edits: result.edits,
-        ..RedirectState::default()
-    };
-    let outcome = revert_remaining_redirect_edits(directory.path(), &mut state, false).await;
-    assert!(outcome.fully_reverted(), "{:?}", outcome.refusals);
-    assert_eq!(
-        tokio::fs::read_to_string(directory.path().join("poetry.lock")).await.unwrap(),
-        lock
-    );
 }
 
 /// A rotated grant token (or republished patch) supersedes the earlier hosted
-/// URL in place; rollback of the SECOND run restores the FIRST run's fragment,
-/// exactly as the ledger records it.
+/// URL in place.
 #[test]
 fn rotated_grant_token_supersedes_the_prior_hosted_url() {
     let files = BTreeMap::from([("poetry.lock".to_string(), original("1.8.5"))]);
@@ -413,65 +287,3 @@ fn rotated_grant_token_supersedes_the_prior_hosted_url() {
     assert_eq!(second.edits.len(), 1);
     assert!(second.edits[0].original.as_ref().unwrap().as_str().unwrap().contains(URL));
 }
-
-/// A relock (or hand edit) that drops the inserted `files` line but keeps
-/// `[package.source]` must be REFUSED by rollback, never mistaken for an
-/// already-reverted lock (the fragment's boundary header keeps the pristine
-/// unit from matching as a prefix, which would delete the ledger and leave the
-/// lock redirecting with upstream hashes in `[metadata.files]`).
-#[tokio::test]
-async fn dropped_files_line_with_source_kept_is_refused_not_converged() {
-    for version in ["1.2.2", "2.4.3"] {
-        let pristine = original(version);
-        let files = BTreeMap::from([("poetry.lock".to_string(), pristine.clone())]);
-        let result = rewrite_registry_redirect(&files, &[patch()]);
-        let redirected = &result.files["poetry.lock"];
-        let drifted: String = redirected
-            .lines()
-            .filter(|line| !line.starts_with("files = [{ file = "))
-            .collect::<Vec<_>>()
-            .join("\n")
-            + "\n";
-        assert_ne!(drifted, *redirected, "{version}: the files line must have been removed");
-        assert!(drifted.contains("[package.source]"));
-        let directory = tempfile::tempdir().unwrap();
-        tokio::fs::write(directory.path().join("poetry.lock"), &drifted).await.unwrap();
-        let mut state = RedirectState {
-            edits: result.edits.clone(),
-            ..RedirectState::default()
-        };
-        let outcome = revert_remaining_redirect_edits(directory.path(), &mut state, false).await;
-        assert!(!outcome.fully_reverted(), "{version}: must refuse, not report success");
-        assert_eq!(
-            tokio::fs::read_to_string(directory.path().join("poetry.lock")).await.unwrap(),
-            drifted,
-            "{version}: a refused revert writes nothing"
-        );
-        assert!(!state.edits.is_empty(), "{version}: the ledger keeps its edits for a re-scan");
-    }
-}
-
-/// Lock 1.0 only APPENDS `[package.source]` to the unit. A lock restored to
-/// pristine by hand (or by Poetry 1.0's own bare `poetry lock`, which drops
-/// the source) must let rollback converge and clear the ledger instead of
-/// refusing with a spurious drift.
-#[tokio::test]
-async fn lock_1_0_rollback_converges_on_a_hand_restored_lock() {
-    let pristine = original("1.0.10");
-    let files = BTreeMap::from([("poetry.lock".to_string(), pristine.clone())]);
-    let result = rewrite_registry_redirect(&files, &[patch()]);
-    assert!(!result.edits.is_empty());
-    let directory = tempfile::tempdir().unwrap();
-    tokio::fs::write(directory.path().join("poetry.lock"), &pristine).await.unwrap();
-    let mut state = RedirectState {
-        edits: result.edits,
-        ..RedirectState::default()
-    };
-    let outcome = revert_remaining_redirect_edits(directory.path(), &mut state, false).await;
-    assert!(outcome.fully_reverted(), "{:?}", outcome.refusals);
-    assert!(state.edits.is_empty());
-    assert_eq!(
-        tokio::fs::read_to_string(directory.path().join("poetry.lock")).await.unwrap(),
-        pristine
-    );
-}
diff --git a/crates/socket-patch-core/tests/redirect_golden_reverse_replay.rs b/crates/socket-patch-core/tests/redirect_golden_reverse_replay.rs
deleted file mode 100644
index 8c45b54c..00000000
--- a/crates/socket-patch-core/tests/redirect_golden_reverse_replay.rs
+++ /dev/null
@@ -1,252 +0,0 @@
-//! Reverse replay of the vlt redirect goldens: each `npm/vlt` case's
-//! `expected-edits.json`, recorded as a hosted ledger over its `expected/`
-//! tree, must unwind `vlt-lock.json` to the `input/` bytes. The same edits are
-//! what the depscan server writes into its PR ledgers, so this is also the
-//! proof that socket-patch reverts a server-written vlt redirect.
-//!
-//! Each case runs up to four ways: as written, after vlt's LF re-save of a
-//! CRLF lock, after a re-save that appended a sibling node (which moves the
-//! trailing comma), and after a re-lock that dropped the last node while
-//! earlier instances of the same package may still carry its hosted URL.
-//! Both the whole-ledger replay and the per-purl revert are exercised.
-
-use std::collections::BTreeMap;
-use std::fs;
-use std::path::{Path, PathBuf};
-
-use socket_patch_core::manifest::schema::PatchRecord;
-use socket_patch_core::patch::redirect::{
-    revert_redirect_purl, revert_remaining_redirect_edits, FileEdit, RedirectState,
-};
-
-const VLT_LOCK: &str = "vlt-lock.json";
-const KIND: &str = "redirect_vlt_lock_node";
-
-fn cases_root() -> PathBuf {
-    Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/redirect/npm/vlt")
-}
-
-struct Case {
-    name: String,
-    input: String,
-    expected: String,
-    edits: Vec<FileEdit>,
-    purls: Vec<String>,
-}
-
-fn npm_purl(name: &str, namespace: Option<&str>, version: &str) -> String {
-    match namespace {
-        Some(ns) if !ns.is_empty() => format!("pkg:npm/%40{}/{name}@{version}", &ns[1..]),
-        _ => format!("pkg:npm/{name}@{version}"),
-    }
-}
-
-fn load_cases() -> Vec<Case> {
-    let mut dirs: Vec<PathBuf> = fs::read_dir(cases_root())
-        .unwrap()
-        .map(|e| e.unwrap().path())
-        .filter(|p| p.join("input").is_dir())
-        .collect();
-    dirs.sort();
-    let mut cases = Vec::new();
-    for dir in dirs {
-        let edits: Vec<FileEdit> =
-            serde_json::from_str(&fs::read_to_string(dir.join("expected-edits.json")).unwrap())
-                .unwrap();
-        let edits: Vec<FileEdit> = edits.into_iter().filter(|e| e.kind == KIND).collect();
-        if edits.is_empty() {
-            continue;
-        }
-        let overrides: Vec<serde_json::Value> =
-            serde_json::from_str(&fs::read_to_string(dir.join("overrides.json")).unwrap()).unwrap();
-        let purls = overrides
-            .iter()
-            .map(|o| {
-                npm_purl(
-                    o["name"].as_str().unwrap(),
-                    o["namespace"].as_str(),
-                    o["version"].as_str().unwrap(),
-                )
-            })
-            .collect();
-        cases.push(Case {
-            name: dir.file_name().unwrap().to_string_lossy().into_owned(),
-            input: fs::read_to_string(dir.join("input").join(VLT_LOCK)).unwrap(),
-            expected: fs::read_to_string(dir.join("expected").join(VLT_LOCK)).unwrap(),
-            edits,
-            purls,
-        });
-    }
-    cases
-}
-
-fn record(uuid: &str) -> PatchRecord {
-    PatchRecord {
-        uuid: uuid.to_string(),
-        exported_at: "2026-09-25T00:00:00Z".to_string(),
-        files: Default::default(),
-        vulnerabilities: Default::default(),
-        description: String::new(),
-        license: String::new(),
-        tier: "free".to_string(),
-    }
-}
-
-fn ledger(case: &Case) -> RedirectState {
-    let mut state = RedirectState::new();
-    state.edits = case.edits.clone();
-    for purl in &case.purls {
-        state.records.insert(purl.clone(), record("u"));
-    }
-    state
-}
-
-/// The lock after vlt re-saved it with a node appended at the end of the
-/// nodes section, so the formerly last entry gains a comma.
-fn with_appended_node(text: &str) -> String {
-    let mut lines: Vec<String> = text.split('\n').map(str::to_string).collect();
-    let (_, close) = nodes_section(&lines);
-    let last = close - 1;
-    let cr = if lines[last].ends_with('\r') {
-        "\r"
-    } else {
-        ""
-    };
-    let body = lines[last].trim_end_matches('\r').to_string();
-    assert!(!body.ends_with(','), "the last node has no comma");
-    lines[last] = format!("{body},{cr}");
-    lines.insert(
-        close,
-        format!("    \"~npm~zzz-appended@1.0.0\": [0,\"zzz-appended\",\"sha512-zz==\"]{cr}"),
-    );
-    lines.join("\n")
-}
-
-/// The nodes section's line range: the opening line and the closing one.
-fn nodes_section(lines: &[String]) -> (usize, usize) {
-    let open = lines
-        .iter()
-        .position(|l| l.trim_end_matches('\r') == "  \"nodes\": {")
-        .expect("nodes section");
-    let close = (open + 1..lines.len())
-        .find(|&i| matches!(lines[i].trim_end_matches('\r'), "  }" | "  },"))
-        .expect("nodes section end");
-    (open, close)
-}
-
-/// The lock after vlt re-locked its last node away (the new last entry
-/// loses its comma), or `None` when fewer than two nodes remain.
-fn without_last_node(text: &str) -> Option<String> {
-    let mut lines: Vec<String> = text.split('\n').map(str::to_string).collect();
-    let (open, close) = nodes_section(&lines);
-    if close - open < 3 {
-        return None;
-    }
-    lines.remove(close - 1);
-    let last = &mut lines[close - 2];
-    let cr = last.ends_with('\r');
-    let body = last
-        .trim_end_matches('\r')
-        .trim_end_matches(',')
-        .to_string();
-    *last = if cr { format!("{body}\r") } else { body };
-    Some(lines.join("\n"))
-}
-
-fn variants(case: &Case) -> Vec<(&'static str, String, String)> {
-    let mut out = vec![("as-written", case.expected.clone(), case.input.clone())];
-    if case.expected.contains('\r') {
-        out.push((
-            "lf-resave",
-            case.expected.replace("\r\n", "\n"),
-            case.input.replace("\r\n", "\n"),
-        ));
-    }
-    out.push((
-        "comma-moved",
-        with_appended_node(&case.expected),
-        with_appended_node(&case.input),
-    ));
-    if let (Some(on_disk), Some(want)) = (
-        without_last_node(&case.expected),
-        without_last_node(&case.input),
-    ) {
-        out.push(("last-node-relocked-away", on_disk, want));
-    }
-    out
-}
-
-fn stage(lock: &str) -> tempfile::TempDir {
-    let dir = tempfile::tempdir().unwrap();
-    fs::write(dir.path().join(VLT_LOCK), lock).unwrap();
-    dir
-}
-
-#[tokio::test]
-async fn vlt_goldens_replay_back_to_their_input() {
-    let cases = load_cases();
-    assert!(
-        cases.len() >= 30,
-        "only {} vlt cases with edits",
-        cases.len()
-    );
-    for case in &cases {
-        for (variant, on_disk, want) in variants(case) {
-            let dir = stage(&on_disk);
-            let mut state = ledger(case);
-            let out = revert_remaining_redirect_edits(dir.path(), &mut state, false).await;
-            assert!(
-                out.fully_reverted(),
-                "{} {variant}: {:?}",
-                case.name,
-                out.refusals
-            );
-            assert!(state.edits.is_empty(), "{} {variant}", case.name);
-            assert!(state.records.is_empty(), "{} {variant}", case.name);
-            assert_eq!(
-                fs::read_to_string(dir.path().join(VLT_LOCK)).unwrap(),
-                want,
-                "{} {variant}: replay",
-                case.name
-            );
-
-            let again = revert_remaining_redirect_edits(dir.path(), &mut ledger(case), false).await;
-            assert!(again.fully_reverted(), "{} {variant}: rerun", case.name);
-            assert_eq!(
-                fs::read_to_string(dir.path().join(VLT_LOCK)).unwrap(),
-                want,
-                "{} {variant}: an already reverted lock stays put",
-                case.name
-            );
-        }
-    }
-}
-
-#[tokio::test]
-async fn vlt_goldens_revert_per_purl_back_to_their_input() {
-    for case in &load_cases() {
-        for (variant, on_disk, want) in variants(case) {
-            let dir = stage(&on_disk);
-            let mut state = ledger(case);
-            let mut touched: BTreeMap<String, usize> = BTreeMap::new();
-            for purl in &case.purls {
-                let out = revert_redirect_purl(dir.path(), &mut state, purl, false)
-                    .await
-                    .unwrap_or_else(|e| panic!("{} {variant} {purl}: {e}", case.name));
-                *touched.entry(purl.clone()).or_default() += out.reverted_files.len();
-            }
-            assert!(
-                state.edits.is_empty(),
-                "{} {variant}: every vlt edit is claimed by its purl: {:?}",
-                case.name,
-                state.edits
-            );
-            assert_eq!(
-                fs::read_to_string(dir.path().join(VLT_LOCK)).unwrap(),
-                want,
-                "{} {variant}: per-purl revert ({touched:?})",
-                case.name
-            );
-        }
-    }
-}
diff --git a/crates/socket-patch-core/tests/upstream_restore_golden.rs b/crates/socket-patch-core/tests/upstream_restore_golden.rs
new file mode 100644
index 00000000..4cf52500
--- /dev/null
+++ b/crates/socket-patch-core/tests/upstream_restore_golden.rs
@@ -0,0 +1,1909 @@
+//! The v5 hosted unwind, pinned against the shared redirect goldens: each
+//! case's `expected/` tree (what `scan --mode hosted` writes) restored to
+//! the upstream registry entry must give back the `input/` bytes — with the
+//! upstream values served by a mock registry that knows only what `input/`
+//! pins, exactly as the public registry would answer.
+//!
+//! A case is exercised when its rewrite is invertible without a ledger (the
+//! list below names the ones whose original spelling is not derivable, and
+//! why); every other case must round-trip byte for byte.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::fs;
+use std::path::{Path, PathBuf};
+
+use serial_test::serial;
+use socket_patch_core::patch::redirect::{rewrite_registry_redirect_with_pipenv_version, DepOverride};
+use socket_patch_core::patch::redirect::upstream::{
+    restore_upstream, HostedPin, PinStatus, RestoreOptions,
+};
+use wiremock::matchers::{method, path};
+use wiremock::{Mock, MockServer, ResponseTemplate};
+
+fn fixtures() -> PathBuf {
+    Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/redirect")
+}
+
+fn walk(dir: &Path) -> BTreeMap<String, String> {
+    let mut out = BTreeMap::new();
+    if !dir.is_dir() {
+        return out;
+    }
+    for entry in walkdir::WalkDir::new(dir).into_iter().filter_map(Result::ok) {
+        if entry.file_type().is_file() {
+            let rel = entry
+                .path()
+                .strip_prefix(dir)
+                .unwrap()
+                .to_string_lossy()
+                .replace('\\', "/");
+            out.insert(rel, fs::read_to_string(entry.path()).unwrap());
+        }
+    }
+    out
+}
+
+/// Tokens of `pattern` that `input` holds and `expected` does not: the
+/// upstream values the hosted rewrite replaced.
+fn vanished(input: &BTreeMap<String, String>, expected: &BTreeMap<String, String>, re: &str) -> Vec<String> {
+    let re = regex::Regex::new(re).unwrap();
+    let all = |files: &BTreeMap<String, String>| -> BTreeSet<String> {
+        files
+            .values()
+            .flat_map(|t| re.captures_iter(t).map(|c| c[1].to_string()).collect::<Vec<_>>())
+            .collect()
+    };
+    let after = all(expected);
+    let mut out: Vec<String> = all(input).into_iter().filter(|t| !after.contains(t)).collect();
+    out.sort();
+    out
+}
+
+struct Case {
+    dir: PathBuf,
+    input: BTreeMap<String, String>,
+    expected: BTreeMap<String, String>,
+    overrides: Vec<serde_json::Value>,
+}
+
+fn load(flavor: &str) -> Vec<Case> {
+    let root = fixtures().join(flavor);
+    let mut dirs: Vec<PathBuf> = fs::read_dir(&root)
+        .unwrap()
+        .map(|e| e.unwrap().path())
+        .filter(|p| p.join("input").is_dir() && p.join("expected").is_dir())
+        .collect();
+    dirs.sort();
+    dirs.into_iter()
+        .map(|dir| {
+            let input = walk(&dir.join("input"));
+            // `expected/` holds only the files the rewrite changed.
+            let mut expected = input.clone();
+            expected.extend(walk(&dir.join("expected")));
+            let overrides = serde_json::from_str(
+                &fs::read_to_string(dir.join("overrides.json")).unwrap(),
+            )
+            .unwrap();
+            Case {
+                dir,
+                input,
+                expected,
+                overrides,
+            }
+        })
+        // A rewrite happened, from a pristine tree (re-redirect cases start
+        // hosted: there is no upstream `input/` to come back to).
+        .filter(|c| {
+            c.input != c.expected && !c.input.values().any(|t| t.contains("patch.socket.dev"))
+        })
+        .collect()
+}
+
+async fn run_case(case: &Case) -> (BTreeMap<String, String>, Vec<(String, PinStatus)>) {
+    run_case_with(case, None, &RestoreOptions::default()).await
+}
+
+/// [`run_case`] with explicit pins (instead of discovery's) and options.
+async fn run_case_with(
+    case: &Case,
+    pins: Option<Vec<HostedPin>>,
+    opts: &RestoreOptions,
+) -> (BTreeMap<String, String>, Vec<(String, PinStatus)>) {
+    let tmp = tempfile::tempdir().unwrap();
+    for (rel, text) in &case.expected {
+        let p = tmp.path().join(rel);
+        fs::create_dir_all(p.parent().unwrap()).unwrap();
+        fs::write(p, text).unwrap();
+    }
+    let pins = match pins {
+        Some(p) => p,
+        None => {
+            let discovery = socket_patch_core::vex::discover_patched_refs(tmp.path()).await;
+            HostedPin::all(&discovery)
+        }
+    };
+    let outcome = restore_upstream(tmp.path(), &pins, opts).await;
+    assert!(outcome.flush_error.is_none(), "{:?}", outcome.flush_error);
+    let statuses = outcome
+        .pins
+        .iter()
+        .map(|p| (p.purl.clone(), p.status.clone()))
+        .collect();
+    (walk(tmp.path()), statuses)
+}
+
+fn assert_round_trip(case: &Case, after: &BTreeMap<String, String>, statuses: &[(String, PinStatus)]) {
+    assert!(!statuses.is_empty(), "{}: discovery found no hosted pin", case.dir.display());
+    for (purl, status) in statuses {
+        assert_eq!(*status, PinStatus::Restored, "{}: {purl}", case.dir.display());
+    }
+    for (rel, want) in &case.input {
+        assert_eq!(
+            after.get(rel),
+            Some(want),
+            "{}: {rel} did not round-trip",
+            case.dir.display()
+        );
+    }
+    let extra: Vec<&String> = after.keys().filter(|k| !case.input.contains_key(*k)).collect();
+    assert!(extra.is_empty(), "{}: left behind {extra:?}", case.dir.display());
+}
+
+/// Sets env vars for the guard's lifetime (tests using it are `#[serial]`).
+struct EnvGuard(Vec<(String, Option<String>)>);
+
+impl EnvGuard {
+    fn set(vars: &[(&str, String)]) -> Self {
+        let saved = vars
+            .iter()
+            .map(|(k, _)| (k.to_string(), std::env::var(k).ok()))
+            .collect();
+        for (k, v) in vars {
+            std::env::set_var(k, v);
+        }
+        EnvGuard(saved)
+    }
+}
+
+impl Drop for EnvGuard {
+    fn drop(&mut self) {
+        for (k, v) in self.0.drain(..) {
+            match v {
+                Some(v) => std::env::set_var(&k, v),
+                None => std::env::remove_var(&k),
+            }
+        }
+    }
+}
+
+/// Serve an npm version document for every single-override npm case.
+async fn npm_mock(case: &Case) -> MockServer {
+    let server = MockServer::start().await;
+    let integrity = vanished(&case.input, &case.expected, r"(sha512-[A-Za-z0-9+/=]+)");
+    let shasum = vanished(&case.input, &case.expected, r"#([0-9a-f]{40})\b");
+    let tarballs = vanished(
+        &case.input,
+        &case.expected,
+        r##"(https://registry\.[a-z]+\.(?:org|com)/[^"#\s]+\.tgz)"##,
+    );
+    for o in &case.overrides {
+        let name = match o["namespace"].as_str() {
+            Some(ns) if !ns.is_empty() => format!("{ns}/{}", o["name"].as_str().unwrap()),
+            _ => o["name"].as_str().unwrap().to_string(),
+        };
+        let version = o["version"].as_str().unwrap();
+        let leaf = name.rsplit('/').next().unwrap();
+        let tarball = tarballs
+            .iter()
+            .find(|t| t.ends_with(&format!("/{leaf}-{version}.tgz")))
+            .cloned()
+            .unwrap_or_else(|| format!("https://registry.npmjs.org/{name}/-/{leaf}-{version}.tgz"));
+        let mut dist = serde_json::json!({ "tarball": tarball });
+        if let [only] = integrity.as_slice() {
+            dist["integrity"] = only.clone().into();
+        }
+        if let [only] = shasum.as_slice() {
+            dist["shasum"] = only.clone().into();
+        }
+        Mock::given(method("GET"))
+            .and(path(format!("/{}/{version}", name.replace('/', "%2f"))))
+            .respond_with(
+                ResponseTemplate::new(200)
+                    .set_body_json(serde_json::json!({ "name": name, "version": version, "dist": dist })),
+            )
+            .mount(&server)
+            .await;
+    }
+    server
+}
+
+async fn npm_flavor(flavor: &str, not_invertible: &[&str]) {
+    let mut ran = 0;
+    for case in load(flavor) {
+        let name = case.dir.file_name().unwrap().to_string_lossy().into_owned();
+        if not_invertible.contains(&name.as_str()) {
+            continue;
+        }
+        let server = npm_mock(&case).await;
+        let _env = EnvGuard::set(&[("SOCKET_NPM_REGISTRY", server.uri())]);
+        let (after, statuses) = run_case(&case).await;
+        assert_round_trip(&case, &after, &statuses);
+        ran += 1;
+    }
+    assert!(ran > 0, "{flavor}: no case ran");
+}
+
+#[tokio::test]
+#[serial]
+async fn package_lock_goldens_round_trip() {
+    npm_flavor("npm/package-lock-v3", &[]).await;
+}
+
+#[tokio::test]
+#[serial]
+async fn yarn_classic_goldens_round_trip() {
+    npm_flavor("npm/yarn-classic", &[]).await;
+}
+
+#[tokio::test]
+#[serial]
+async fn pnpm_goldens_round_trip() {
+    // nested-rush-lock: a nested (Rush) lock is outside root-only discovery.
+    npm_flavor("npm/pnpm", &["nested-rush-lock"]).await;
+}
+
+#[tokio::test]
+#[serial]
+async fn bun_goldens_round_trip() {
+    // custom-registry: the entry's registry slot is not recorded; the
+    // restore writes the default registry (""). scoped-package: its artifact
+    // leaf names another package, so discovery (rightly) claims no pin.
+    npm_flavor("npm/bun", &["custom-registry", "scoped-package"]).await;
+}
+
+/// `(name, version, checksum)` of every checksummed entry of a Cargo.lock.
+fn cargo_checksums(lock: &str) -> Vec<(String, String, String)> {
+    let mut out = Vec::new();
+    for block in lock.split("[[package]]").skip(1) {
+        let field = |k: &str| {
+            block.lines().find_map(|l| {
+                l.strip_prefix(&format!("{k} = \""))
+                    .and_then(|r| r.strip_suffix('"'))
+                    .map(str::to_string)
+            })
+        };
+        if let (Some(n), Some(v), Some(c)) = (field("name"), field("version"), field("checksum")) {
+            out.push((n, v, c));
+        }
+    }
+    out
+}
+
+#[tokio::test]
+#[serial]
+async fn cargo_goldens_round_trip() {
+    let mut ran = 0;
+    for case in load("cargo/cargo") {
+        let server = MockServer::start().await;
+        let Some(lock) = case.input.get("Cargo.lock") else {
+            continue;
+        };
+        let mut by_crate: BTreeMap<String, Vec<String>> = BTreeMap::new();
+        for (n, v, c) in cargo_checksums(lock) {
+            by_crate
+                .entry(n.clone())
+                .or_default()
+                .push(serde_json::json!({ "name": n, "vers": v, "cksum": c }).to_string());
+        }
+        for (name, rows) in by_crate {
+            let lower = name.to_ascii_lowercase();
+            let index_path = match lower.len() {
+                1 => format!("/1/{lower}"),
+                2 => format!("/2/{lower}"),
+                3 => format!("/3/{}/{lower}", &lower[..1]),
+                _ => format!("/{}/{}/{lower}", &lower[..2], &lower[2..4]),
+            };
+            Mock::given(method("GET"))
+                .and(path(index_path))
+                .respond_with(ResponseTemplate::new(200).set_body_string(rows.join("\n")))
+                .mount(&server)
+                .await;
+        }
+        let _env = EnvGuard::set(&[("SOCKET_CRATES_INDEX", server.uri())]);
+        let (after, statuses) = run_case(&case).await;
+        assert_round_trip(&case, &after, &statuses);
+        ran += 1;
+    }
+    assert!(ran > 0);
+}
+
+#[tokio::test]
+#[serial]
+async fn golang_goldens_round_trip() {
+    let mut ran = 0;
+    for case in load("golang/gomod") {
+        let server = MockServer::start().await;
+        let sum = case.input.get("go.sum").cloned().unwrap_or_default();
+        let mut by_module: BTreeMap<String, Vec<String>> = BTreeMap::new();
+        for line in sum.lines() {
+            let mut parts = line.split_whitespace();
+            let (Some(m), Some(v)) = (parts.next(), parts.next()) else {
+                continue;
+            };
+            let v = v.trim_end_matches("/go.mod");
+            by_module
+                .entry(format!("{m}@{v}"))
+                .or_default()
+                .push(line.to_string());
+        }
+        for (id, lines) in by_module {
+            Mock::given(method("GET"))
+                .and(path(format!("/lookup/{id}")))
+                .respond_with(ResponseTemplate::new(200).set_body_string(format!(
+                    "12345\n{}\n\ngo.sum database tree\n",
+                    lines.join("\n")
+                )))
+                .mount(&server)
+                .await;
+        }
+        let _env = EnvGuard::set(&[("SOCKET_GOSUMDB_URL", server.uri())]);
+        let (after, statuses) = run_case(&case).await;
+        assert_round_trip(&case, &after, &statuses);
+        ran += 1;
+    }
+    assert!(ran > 0);
+}
+
+// ── rubygems ────────────────────────────────────────────────────────────────
+
+/// A case built by running the hosted rewriter over `input`, for the edge
+/// shapes the shared goldens do not cover.
+fn synthetic(label: &str, input: &[(&str, &str)], overrides: serde_json::Value) -> Case {
+    let input: BTreeMap<String, String> = input
+        .iter()
+        .map(|(k, v)| (k.to_string(), v.to_string()))
+        .collect();
+    let deps: Vec<socket_patch_core::patch::redirect::DepOverride> =
+        serde_json::from_value(overrides.clone()).unwrap();
+    let rewrite = socket_patch_core::patch::redirect::rewrite_registry_redirect(&input, &deps);
+    assert!(
+        !rewrite.files.is_empty(),
+        "{label}: the rewrite changed nothing: {:?}",
+        rewrite.warnings
+    );
+    let mut expected = input.clone();
+    expected.extend(rewrite.files);
+    Case {
+        dir: PathBuf::from(format!("synthetic/{label}")),
+        input,
+        expected,
+        overrides: overrides.as_array().unwrap().clone(),
+    }
+}
+
+impl Case {
+    fn clone_with(&self, label: &str) -> Case {
+        Case {
+            dir: self.dir.with_file_name(label),
+            input: self.input.clone(),
+            expected: self.expected.clone(),
+            overrides: self.overrides.clone(),
+        }
+    }
+
+    /// Apply `edit` to the named file of both trees.
+    fn edit_both(&mut self, rel: &str, edit: impl Fn(&str) -> String) {
+        for files in [&mut self.input, &mut self.expected] {
+            let next = edit(&files[rel]);
+            files.insert(rel.to_string(), next);
+        }
+    }
+}
+
+/// Assert the (single) pin was refused naming `want` and the checkout
+/// remedy for `lock`, with nothing written.
+fn assert_refused(
+    case: &Case,
+    after: &BTreeMap<String, String>,
+    statuses: &[(String, PinStatus)],
+    lock: &str,
+    want: &str,
+) {
+    match &statuses[0].1 {
+        PinStatus::Refused(why) => {
+            assert!(why.contains(want), "{}: {why}", case.dir.display());
+            assert!(why.contains(&format!("checkout -- {lock}")), "{why}");
+        }
+        other => panic!("{}: expected a refusal, got {other:?}", case.dir.display()),
+    }
+    assert_eq!(after, &case.expected, "{}: a refused pin must change nothing", case.dir.display());
+}
+
+fn offline() -> RestoreOptions {
+    RestoreOptions {
+        offline: true,
+        ..RestoreOptions::default()
+    }
+}
+
+const GEM_UUID: &str = "77777777-7777-7777-7777-777777777777";
+const GEM_INDEX: &str = "https://patch.socket.dev/patch-registry/gem/11111111-1111-1111-1111-111111111111/77777777-7777-7777-7777-777777777777/";
+
+fn gem_override(name: &str, version: &str) -> serde_json::Value {
+    serde_json::json!([{
+        "ecosystem": "gem",
+        "name": name,
+        "version": version,
+        "token": "11111111-1111-1111-1111-111111111111",
+        "patchUuid": GEM_UUID,
+        "artifactUrl": format!("{GEM_INDEX}gems/{name}-{version}.gem"),
+        "registryOverride": {
+            "kind": "rubygems-compact-index",
+            "indexUrl": GEM_INDEX,
+            "identifiers": {"name": name, "version": version, "gemChecksumSha256": "de".repeat(32)}
+        },
+        "integrity": {"sha256": "de".repeat(32)}
+    }])
+}
+
+/// Serve a compact-index `info/<name>` for every sha256-pinned gem of the
+/// input locks.
+async fn gem_mock(case: &Case) -> MockServer {
+    let server = MockServer::start().await;
+    let re = regex::Regex::new(r"(?m)^  ([A-Za-z0-9._-]+) \(([^)]+)\) sha256=([0-9a-f]{64})\r?$")
+        .unwrap();
+    let mut by_gem: BTreeMap<String, Vec<String>> = BTreeMap::new();
+    for rel in ["Gemfile.lock", "gems.locked"] {
+        let Some(text) = case.input.get(rel) else {
+            continue;
+        };
+        for c in re.captures_iter(text) {
+            by_gem
+                .entry(c[1].to_string())
+                .or_default()
+                .push(format!("{} dep:>= 0|checksum:{},ruby:>= 2.7", &c[2], &c[3]));
+        }
+    }
+    for (name, lines) in by_gem {
+        Mock::given(method("GET"))
+            .and(path(format!("/info/{name}")))
+            .respond_with(
+                ResponseTemplate::new(200).set_body_string(format!("---\n{}\n", lines.join("\n"))),
+            )
+            .mount(&server)
+            .await;
+    }
+    server
+}
+
+async fn gem_run(case: &Case) -> (BTreeMap<String, String>, Vec<(String, PinStatus)>) {
+    let server = gem_mock(case).await;
+    let _env = EnvGuard::set(&[("SOCKET_RUBYGEMS_URL", server.uri())]);
+    run_case(case).await
+}
+
+#[tokio::test]
+#[serial]
+async fn gem_goldens_round_trip() {
+    let mut ran = 0;
+    for case in load("gem/bundler") {
+        let (after, statuses) = gem_run(&case).await;
+        assert_round_trip(&case, &after, &statuses);
+        ran += 1;
+    }
+    assert!(ran > 0);
+}
+
+const GEM_LOCK: &str = "GEM\n  remote: https://rubygems.org/\n  specs:\n    puma (6.0.0)\n      nio4r (~> 2.0)\n    rails (7.0.0)\n      rack (>= 2)\n    zeitwerk (2.6.0)\n\nPLATFORMS\n  ruby\n\nDEPENDENCIES\n  puma\n  rails (= 7.0.0)\n\nCHECKSUMS\n  puma (6.0.0) sha256=1111111111111111111111111111111111111111111111111111111111111111\n  rails (7.0.0) sha256=2222222222222222222222222222222222222222222222222222222222222222\n  zeitwerk (2.6.0) sha256=3333333333333333333333333333333333333333333333333333333333333333\n\nBUNDLED WITH\n   2.6.2\n";
+
+/// [`GEM_LOCK`] with `zeitwerk` a dependency of puma only (transitive).
+fn transitive_lock() -> String {
+    GEM_LOCK.replace(
+        "      nio4r (~> 2.0)\n",
+        "      nio4r (~> 2.0)\n      zeitwerk (~> 2.6)\n",
+    )
+}
+
+#[tokio::test]
+#[serial]
+async fn gem_edge_shapes_round_trip() {
+    let gemfile = "source \"https://rubygems.org\"\n\ngem \"puma\"\n\ngroup :test do\n  gem \"rails\", \"7.0.0\", require: false\nend\n";
+    let crlf_gemfile = "source \"https://rubygems.org\"\r\n\r\ngem \"rails\", \"7.0.0\"\r\ngem \"puma\"\r\n";
+    let two_sources_gemfile = "source \"https://rubygems.org\"\n\ngem \"rails\", \"7.0.0\"\nsource \"https://gems.example.com\" do\n  gem \"private-gem\"\nend\n";
+    let two_sources_lock = "GEM\n  remote: https://gems.example.com/\n  specs:\n    private-gem (1.0.0)\n\nGEM\n  remote: https://rubygems.org/\n  specs:\n    rails (7.0.0)\n\nPLATFORMS\n  ruby\n\nDEPENDENCIES\n  private-gem!\n  rails (= 7.0.0)\n\nCHECKSUMS\n  private-gem (1.0.0) sha256=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n  rails (7.0.0) sha256=2222222222222222222222222222222222222222222222222222222222222222\n\nBUNDLED WITH\n   2.6.2\n";
+    // Provably transitive: the rewriter appended after a trailing blank
+    // line, which its in-place rewrite would have swallowed.
+    let transitive_gemfile = "source \"https://rubygems.org\"\n\ngem \"puma\"\n\n";
+    let transitive = transitive_lock().replace("  rails (= 7.0.0)\n", "");
+    let cases = [
+        synthetic(
+            "group-with-options",
+            &[("Gemfile", gemfile), ("Gemfile.lock", GEM_LOCK)],
+            gem_override("rails", "7.0.0"),
+        ),
+        synthetic(
+            "gems-rb",
+            &[("gems.rb", gemfile), ("gems.locked", GEM_LOCK)],
+            gem_override("rails", "7.0.0"),
+        ),
+        synthetic(
+            "crlf",
+            &[
+                ("Gemfile", crlf_gemfile),
+                ("Gemfile.lock", &GEM_LOCK.replace('\n', "\r\n")),
+            ],
+            gem_override("rails", "7.0.0"),
+        ),
+        synthetic(
+            "multiple-gem-sections",
+            &[("Gemfile", two_sources_gemfile), ("Gemfile.lock", two_sources_lock)],
+            gem_override("rails", "7.0.0"),
+        ),
+        synthetic(
+            "transitive-appended",
+            &[("Gemfile", transitive_gemfile), ("Gemfile.lock", &transitive)],
+            gem_override("zeitwerk", "2.6.0"),
+        ),
+    ];
+    for case in &cases {
+        let (after, statuses) = gem_run(case).await;
+        assert_round_trip(case, &after, &statuses);
+    }
+}
+
+#[tokio::test]
+#[serial]
+async fn gem_pre_checksums_states() {
+    let gemfile = "source \"https://rubygems.org\"\n\ngem \"rails\", \"~> 7.0\"\ngem \"puma\"\n";
+    let checksums = GEM_LOCK
+        .split("\nCHECKSUMS\n")
+        .nth(1)
+        .unwrap()
+        .split("\n\n")
+        .next()
+        .unwrap();
+    let lock = GEM_LOCK
+        .replace("  rails (= 7.0.0)\n", "  rails (~> 7.0)\n")
+        .replace(&format!("\nCHECKSUMS\n{checksums}\n"), "")
+        .replace("2.6.2", "2.5.22");
+    assert!(!lock.contains("CHECKSUMS"));
+    // Mixed: the rewriter edits only the Gemfile, so discovery finds no pin;
+    // hand the restore one. The untouched lock keeps the original constraint.
+    let mut mixed = synthetic(
+        "mixed",
+        &[("Gemfile", gemfile), ("Gemfile.lock", &lock)],
+        gem_override("rails", "7.0.0"),
+    );
+    assert_eq!(mixed.expected["Gemfile.lock"], lock);
+    let pin = HostedPin {
+        purl: "pkg:gem/rails@7.0.0".into(),
+        uuid: GEM_UUID.into(),
+        files: vec!["Gemfile".into()],
+    };
+    let (after, statuses) = run_case_with(&mixed, Some(vec![pin]), &offline()).await;
+    assert_round_trip(&mixed, &after, &statuses);
+
+    // Bundler 2.2–2.5 then converges the pair itself (a Socket GEM section,
+    // a `!` pin, no CHECKSUMS): restorable offline. Not derivable: `~> 7.0`
+    // comes back as the exact pin the lock records.
+    let restored_lock = lock.replace("  rails (~> 7.0)\n", "  rails (= 7.0.0)\n");
+    let restored_gemfile = gemfile.replace("\"~> 7.0\"", "\"7.0.0\"");
+    let converged = lock
+        .replace("    rails (7.0.0)\n      rack (>= 2)\n", "")
+        .replace(
+            "GEM\n  remote: https://rubygems.org/",
+            &format!(
+                "GEM\n  remote: {GEM_INDEX}\n  specs:\n    rails (7.0.0)\n      rack (>= 2)\n\n\
+                 GEM\n  remote: https://rubygems.org/"
+            ),
+        )
+        .replace("  rails (~> 7.0)\n", "  rails (= 7.0.0)!\n");
+    mixed.expected.insert("Gemfile.lock".into(), converged);
+    let (after, statuses) = run_case_with(&mixed, None, &offline()).await;
+    assert_eq!(statuses, vec![("pkg:gem/rails@7.0.0".to_string(), PinStatus::Restored)]);
+    assert_eq!(after["Gemfile.lock"], restored_lock);
+    assert_eq!(after["Gemfile"], restored_gemfile);
+
+    // Bundler ≤ 2.1 merged section: only the Socket remote line goes.
+    let merged = lock
+        .replace(
+            "GEM\n  remote: https://rubygems.org/\n",
+            &format!("GEM\n  remote: https://rubygems.org/\n  remote: {GEM_INDEX}\n"),
+        )
+        .replace("  rails (~> 7.0)\n", "  rails (= 7.0.0)!\n");
+    mixed.expected.insert("Gemfile.lock".into(), merged);
+    let (after, statuses) = run_case_with(&mixed, None, &offline()).await;
+    assert_eq!(statuses, vec![("pkg:gem/rails@7.0.0".to_string(), PinStatus::Restored)]);
+    assert_eq!(after["Gemfile.lock"], restored_lock);
+    assert_eq!(after["Gemfile"], restored_gemfile);
+}
+
+#[tokio::test]
+#[serial]
+async fn gem_transitive_without_proof_stays_declared() {
+    // The rewriter's append for a transitive gem is indistinguishable from a
+    // direct last-line declaration, so it is kept as a direct exact pin.
+    let gemfile = "source \"https://rubygems.org\"\n\ngem \"puma\"\n";
+    let lock = transitive_lock().replace("  rails (= 7.0.0)\n", "");
+    let case = synthetic(
+        "transitive-ambiguous",
+        &[("Gemfile", gemfile), ("Gemfile.lock", &lock)],
+        gem_override("zeitwerk", "2.6.0"),
+    );
+    let (after, statuses) = gem_run(&case).await;
+    assert_eq!(statuses[0].1, PinStatus::Restored);
+    assert_eq!(after["Gemfile"], format!("{gemfile}gem \"zeitwerk\", \"2.6.0\"\n"));
+    assert_eq!(
+        after["Gemfile.lock"],
+        lock.replace("  puma\n", "  puma\n  zeitwerk (= 2.6.0)\n")
+    );
+}
+
+#[tokio::test]
+#[serial]
+async fn gem_refusals_leave_everything_hosted() {
+    let gemfile = "source \"https://rubygems.org\"\n\ngem \"rails\", \"7.0.0\"\ngem \"puma\"\n";
+    let case = synthetic(
+        "refusals",
+        &[("Gemfile", gemfile), ("Gemfile.lock", GEM_LOCK)],
+        gem_override("rails", "7.0.0"),
+    );
+    // Offline: the CHECKSUMS sha256 needs the registry.
+    let (after, statuses) = run_case_with(&case, None, &offline()).await;
+    assert_refused(&case, &after, &statuses, "Gemfile.lock", "offline");
+    // The registry does not know the gem.
+    {
+        let server = MockServer::start().await;
+        let _env = EnvGuard::set(&[("SOCKET_RUBYGEMS_URL", server.uri())]);
+        let (after, statuses) = run_case(&case).await;
+        assert_refused(&case, &after, &statuses, "Gemfile.lock", "404");
+    }
+    // The upstream section is another registry's.
+    let mut foreign = case.clone_with("foreign-upstream");
+    foreign.edit_both("Gemfile.lock", |t| {
+        t.replace("remote: https://rubygems.org/", "remote: https://gems.example.com/")
+    });
+    let (after, statuses) = gem_run(&foreign).await;
+    assert_refused(&foreign, &after, &statuses, "Gemfile.lock", "not rubygems.org");
+    // Two upstream sections, neither singled out.
+    let mut ambiguous = case.clone_with("ambiguous-upstream");
+    ambiguous.edit_both("Gemfile.lock", |t| {
+        t.replace(
+            "PLATFORMS",
+            "GEM\n  remote: https://gems.example.com/\n  specs:\n    other (1.0.0)\n\nPLATFORMS",
+        )
+    });
+    ambiguous.edit_both("Gemfile", |t| t.replace("source \"https://rubygems.org\"\n", ""));
+    ambiguous.edit_both("Gemfile.lock", |t| t.replace("remote: https://rubygems.org/", "remote: https://mirror.example.com/"));
+    let (after, statuses) = gem_run(&ambiguous).await;
+    assert_refused(&ambiguous, &after, &statuses, "Gemfile.lock", "upstream GEM sections");
+    // The Gemfile block was hand-edited.
+    let mut edited = case.clone_with("edited-block");
+    edited.expected.insert(
+        "Gemfile".into(),
+        edited.expected["Gemfile"].replace("  gem \"rails\", \"7.0.0\"", "  gem \"rails\", \"~> 7.0\""),
+    );
+    let (after, statuses) = gem_run(&edited).await;
+    assert_refused(&edited, &after, &statuses, "Gemfile.lock", "shape other than the source block");
+}
+
+// ── composer ────────────────────────────────────────────────────────────────
+
+/// Serve packagist `p2` metadata for every entry of the input lock, in
+/// composer/2.0 minified form behind a decoy version (so the expansion —
+/// inherited keys, `__unset` — is exercised). `tweak` edits each served
+/// version's diff.
+async fn composer_mock(case: &Case, tweak: impl Fn(&mut serde_json::Value)) -> MockServer {
+    let server = MockServer::start().await;
+    let lock: serde_json::Value = serde_json::from_str(&case.input["composer.lock"]).unwrap();
+    let mut by_file: BTreeMap<String, (String, Vec<serde_json::Value>)> = BTreeMap::new();
+    for section in ["packages", "packages-dev"] {
+        for entry in lock[section].as_array().cloned().unwrap_or_default() {
+            let name = entry["name"].as_str().unwrap().to_ascii_lowercase();
+            let version = entry["version"].as_str().unwrap();
+            let dev = version.starts_with("dev-") || version.ends_with("-dev");
+            let file = format!("{name}{}", if dev { "~dev" } else { "" });
+            let mut diff = serde_json::json!({
+                "version": version,
+                "dist": entry["dist"],
+                "source": entry.get("source").cloned().unwrap_or_else(|| "__unset".into()),
+            });
+            tweak(&mut diff);
+            let (_, versions) = by_file.entry(file).or_insert_with(|| {
+                (
+                    name.clone(),
+                    vec![serde_json::json!({
+                        "name": name,
+                        "version": "99.0.0",
+                        "type": "library",
+                        "source": {"type": "git", "url": "https://decoy.example/x.git", "reference": "decoy"},
+                        "dist": {"type": "zip", "url": "https://decoy.example/x.zip", "reference": "decoy", "shasum": "decoy"}
+                    })],
+                )
+            });
+            versions.push(diff);
+        }
+    }
+    for (file, (name, versions)) in by_file {
+        Mock::given(method("GET"))
+            .and(path(format!("/p2/{file}.json")))
+            .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+                "packages": { name: versions },
+                "minified": "composer/2.0"
+            })))
+            .mount(&server)
+            .await;
+    }
+    server
+}
+
+async fn composer_run(
+    case: &Case,
+    tweak: impl Fn(&mut serde_json::Value),
+) -> (BTreeMap<String, String>, Vec<(String, PinStatus)>) {
+    let server = composer_mock(case, tweak).await;
+    let _env = EnvGuard::set(&[("SOCKET_PACKAGIST_URL", server.uri())]);
+    run_case(case).await
+}
+
+#[tokio::test]
+#[serial]
+async fn composer_goldens_round_trip() {
+    // Every composer golden with a rewrite is invertible.
+    let mut ran = 0;
+    for case in load("composer/composer-lock") {
+        let (after, statuses) = composer_run(&case, |_| {}).await;
+        assert_round_trip(&case, &after, &statuses);
+        ran += 1;
+    }
+    assert!(ran >= 5, "{ran}");
+}
+
+fn composer_override(name: &str, version: &str) -> serde_json::Value {
+    let (ns, leaf) = name.split_once('/').unwrap();
+    serde_json::json!([{
+        "ecosystem": "composer",
+        "name": leaf,
+        "namespace": ns,
+        "version": version,
+        "token": "11111111-1111-1111-1111-111111111111",
+        "patchUuid": "44444444-4444-4444-4444-444444444444",
+        "artifactUrl": format!(
+            "https://patch.socket.dev/patch/composer/{name}/{version}/11111111-1111-1111-1111-111111111111/44444444-4444-4444-4444-444444444444/{leaf}.zip"
+        ),
+        "integrity": {"sha1": "abcdef0123456789abcdef0123456789abcdef01"}
+    }])
+}
+
+const COMPOSER_LOCK: &str = r#"{
+    "_readme": [
+        "This file locks the dependencies of your project to a known state"
+    ],
+    "content-hash": "abc123",
+    "packages": [
+        {
+            "name": "psr/log",
+            "version": "1.1.4",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/php-fig/log.git",
+                "reference": "d49695b909c3b7628b6289db5479a1c204601f11"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/php-fig/log/zipball/d49695b909c3b7628b6289db5479a1c204601f11",
+                "reference": "d49695b909c3b7628b6289db5479a1c204601f11",
+                "shasum": ""
+            },
+            "type": "library",
+            "notification-url": "https://packagist.org/downloads/"
+        }
+    ],
+    "packages-dev": [
+        {
+            "name": "acme/tool",
+            "version": "dev-main",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/acme/tool.git",
+                "reference": "0123456789abcdef0123456789abcdef01234567"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/acme/tool/zipball/0123456789abcdef0123456789abcdef01234567",
+                "reference": "0123456789abcdef0123456789abcdef01234567",
+                "shasum": ""
+            },
+            "type": "library",
+            "notification-url": "https://packagist.org/downloads/"
+        }
+    ]
+}
+"#;
+
+#[tokio::test]
+#[serial]
+async fn composer_edge_shapes_round_trip() {
+    // Older composer escaped every slash; the rewriter matches names as
+    // written, so only the URL values are escaped here.
+    let escaped = regex::Regex::new(r#""(url|notification-url)": "([^"]*)""#)
+        .unwrap()
+        .replace_all(COMPOSER_LOCK, |c: &regex::Captures| {
+            format!("\"{}\": \"{}\"", &c[1], c[2].replace('/', "\\/"))
+        })
+        .into_owned();
+    let crlf = COMPOSER_LOCK.replace('\n', "\r\n");
+    let cases = [
+        synthetic(
+            "dev-version-packages-dev",
+            &[("composer.lock", COMPOSER_LOCK)],
+            composer_override("acme/tool", "dev-main"),
+        ),
+        synthetic(
+            "prod-entry",
+            &[("composer.lock", COMPOSER_LOCK)],
+            composer_override("psr/log", "1.1.4"),
+        ),
+        synthetic(
+            "escaped-slashes",
+            &[("composer.lock", &escaped)],
+            composer_override("acme/tool", "dev-main"),
+        ),
+        synthetic("crlf", &[("composer.lock", &crlf)], composer_override("psr/log", "1.1.4")),
+    ];
+    for case in &cases {
+        let (after, statuses) = composer_run(case, |_| {}).await;
+        assert_round_trip(case, &after, &statuses);
+    }
+}
+
+#[tokio::test]
+#[serial]
+async fn composer_refusals_leave_everything_hosted() {
+    let case = synthetic(
+        "refusals",
+        &[("composer.lock", COMPOSER_LOCK)],
+        composer_override("psr/log", "1.1.4"),
+    );
+    // Packagist now serves another commit for the version.
+    let (after, statuses) =
+        composer_run(&case, |d| d["dist"]["reference"] = "feedface".into()).await;
+    assert_refused(&case, &after, &statuses, "composer.lock", "packagist now serves");
+    // Packagist does not list the version.
+    let (after, statuses) = composer_run(&case, |d| d["version"] = "0.0.1".into()).await;
+    assert_refused(&case, &after, &statuses, "composer.lock", "does not list version 1.1.4");
+    // Offline.
+    let (after, statuses) = run_case_with(&case, None, &offline()).await;
+    assert_refused(&case, &after, &statuses, "composer.lock", "offline");
+    // Locked from another repository.
+    let mut foreign = case.clone_with("foreign");
+    foreign.edit_both("composer.lock", |t| {
+        t.replacen("https://packagist.org/downloads/", "https://repo.example.com/downloads/", 1)
+    });
+    let (after, statuses) = composer_run(&foreign, |_| {}).await;
+    assert_refused(&foreign, &after, &statuses, "composer.lock", "not packagist");
+    // No notification-url, and composer.json names custom repositories.
+    let mut custom = case.clone_with("custom-repos");
+    custom.edit_both("composer.lock", |t| {
+        t.replacen(
+            ",\n            \"notification-url\": \"https://packagist.org/downloads/\"",
+            "",
+            1,
+        )
+    });
+    for files in [&mut custom.input, &mut custom.expected] {
+        files.insert(
+            "composer.json".into(),
+            r#"{"repositories": [{"type": "composer", "url": "https://repo.example.com"}]}"#.into(),
+        );
+    }
+    let (after, statuses) = composer_run(&custom, |_| {}).await;
+    assert_refused(&custom, &after, &statuses, "composer.lock", "custom repositories");
+}
+
+// ── PyPI ─────────────────────────────────────────────────────────────────────
+//
+// The shared goldens hold one requirements and one uv case; the other
+// formats round-trip their native fixtures (`tests/fixtures/poetry`,
+// `pdm-native`, `pipenv`) and synthetic locks through the REAL hosted
+// rewriter, with a mock PyPI JSON API serving the release files the input
+// pins.
+
+const PYPI_UUID: &str = "33333333-3333-3333-3333-333333333333";
+const URLLIB3_WHEEL: &str = "urllib3-1.26.18-py2.py3-none-any.whl";
+const URLLIB3_WHEEL_SHA: &str = "34b97092d7e0a3a8cf7cd10e386f401b3737364026c45e622aa02903dffe0f07";
+const URLLIB3_SDIST: &str = "urllib3-1.26.18.tar.gz";
+const URLLIB3_SDIST_SHA: &str = "f8ecc1bba5667413457c529ab955bf8c67b45db799d159066261719e328580a0";
+
+fn pypi_dep(name: &str, version: &str, leaf: &str, uuid: &str) -> DepOverride {
+    serde_json::from_value(serde_json::json!({
+        "ecosystem": "pypi", "name": name, "version": version,
+        "token": "11111111-1111-1111-1111-111111111111",
+        "patchUuid": uuid,
+        "artifactUrl": format!(
+            "https://patch.socket.dev/patch/pypi/{name}/{version}/11111111-1111-1111-1111-111111111111/{uuid}/{leaf}"
+        ),
+        "integrity": { "sha256": "d".repeat(64) }
+    }))
+    .unwrap()
+}
+
+fn urllib3_dep() -> DepOverride {
+    pypi_dep("urllib3", "1.26.18", URLLIB3_WHEEL, PYPI_UUID)
+}
+
+/// The mock PyPI URL of a release file.
+/// PyPI's blake2b-bucketed file URLs, with real urllib3 1.26.18's buckets: the
+/// sdist sorts before the wheel by URL, the reverse of filename order.
+fn pypi_file_url(filename: &str) -> String {
+    let bucket = if filename.ends_with(".tar.gz") { "0c/39" } else { "b0/53" };
+    format!("https://files.pythonhosted.org/packages/{bucket}/{filename}")
+}
+
+/// One PyPI JSON API release: name, version, `(filename, sha256, size,
+/// upload_time_iso_8601)` per file.
+type Release<'a> = (&'a str, &'a str, Vec<(&'a str, &'a str, u64, &'a str)>);
+
+fn urllib3_release() -> Release<'static> {
+    (
+        "urllib3",
+        "1.26.18",
+        vec![
+            (URLLIB3_WHEEL, URLLIB3_WHEEL_SHA, 143835, "2023-10-17T17:46:21.184066Z"),
+            (URLLIB3_SDIST, URLLIB3_SDIST_SHA, 305687, "2023-10-17T17:46:24.000000Z"),
+        ],
+    )
+}
+
+/// Serve `GET /pypi/<name>/<version>/json` for every release, with
+/// `SOCKET_PYPI_JSON_API` pointed at it for the guard's lifetime.
+async fn pypi_mock(releases: &[Release<'_>]) -> (MockServer, EnvGuard) {
+    let server = MockServer::start().await;
+    for (name, version, files) in releases {
+        let urls: Vec<serde_json::Value> = files
+            .iter()
+            .map(|(filename, sha, size, uploaded)| {
+                serde_json::json!({
+                    "filename": filename,
+                    "url": pypi_file_url(filename),
+                    "digests": { "sha256": sha },
+                    "size": size,
+                    "upload_time_iso_8601": uploaded,
+                })
+            })
+            .collect();
+        Mock::given(method("GET"))
+            .and(path(format!("/pypi/{name}/{version}/json")))
+            .respond_with(
+                ResponseTemplate::new(200).set_body_json(serde_json::json!({ "urls": urls })),
+            )
+            .mount(&server)
+            .await;
+    }
+    let env = EnvGuard::set(&[("SOCKET_PYPI_JSON_API", format!("{}/pypi", server.uri()))]);
+    (server, env)
+}
+
+fn tree(files: &[(&str, String)]) -> BTreeMap<String, String> {
+    files.iter().map(|(k, v)| (k.to_string(), v.clone())).collect()
+}
+
+/// `input` as the real hosted rewriter leaves it.
+fn hosted(
+    input: &BTreeMap<String, String>,
+    deps: &[DepOverride],
+    pipenv: Option<u32>,
+) -> BTreeMap<String, String> {
+    let result =
+        rewrite_registry_redirect_with_pipenv_version(input, deps, &BTreeMap::new(), pipenv, false);
+    let mut out = input.clone();
+    out.extend(result.files);
+    out
+}
+
+/// Discover and restore `files` in a scratch project.
+async fn restore_tree(
+    files: &BTreeMap<String, String>,
+    opts: &RestoreOptions,
+) -> (BTreeMap<String, String>, Vec<(String, PinStatus)>) {
+    let tmp = tempfile::tempdir().unwrap();
+    for (rel, text) in files {
+        let p = tmp.path().join(rel);
+        fs::create_dir_all(p.parent().unwrap()).unwrap();
+        fs::write(p, text).unwrap();
+    }
+    let discovery = socket_patch_core::vex::discover_patched_refs(tmp.path()).await;
+    let pins = HostedPin::all(&discovery);
+    let outcome = restore_upstream(tmp.path(), &pins, opts).await;
+    assert!(outcome.flush_error.is_none(), "{:?}", outcome.flush_error);
+    let statuses = outcome
+        .pins
+        .iter()
+        .map(|p| (p.purl.clone(), p.status.clone()))
+        .collect();
+    (walk(tmp.path()), statuses)
+}
+
+/// Hosted-rewrite `input`, restore it, and require the input bytes back.
+async fn assert_pypi_round_trip(
+    label: &str,
+    input: &BTreeMap<String, String>,
+    deps: &[DepOverride],
+    pipenv: Option<u32>,
+) {
+    let rewritten = hosted(input, deps, pipenv);
+    assert_ne!(&rewritten, input, "{label}: the hosted rewrite changed nothing");
+    let (after, statuses) = restore_tree(&rewritten, &RestoreOptions::default()).await;
+    assert!(!statuses.is_empty(), "{label}: discovery found no hosted pin");
+    for (purl, status) in &statuses {
+        assert_eq!(*status, PinStatus::Restored, "{label}: {purl}");
+    }
+    for (rel, want) in input {
+        assert_eq!(after.get(rel), Some(want), "{label}: {rel} did not round-trip");
+    }
+    let extra: Vec<&String> = after.keys().filter(|k| !input.contains_key(*k)).collect();
+    assert!(extra.is_empty(), "{label}: left behind {extra:?}");
+}
+
+/// Hosted-rewrite `input` and restore it, expecting every pin refused:
+/// the joined refusals, the hosted tree and the tree after the restore.
+async fn pypi_refusal(
+    input: &BTreeMap<String, String>,
+    deps: &[DepOverride],
+    opts: &RestoreOptions,
+) -> (String, BTreeMap<String, String>, BTreeMap<String, String>) {
+    let rewritten = hosted(input, deps, None);
+    assert_ne!(&rewritten, input, "the hosted rewrite changed nothing");
+    let (after, statuses) = restore_tree(&rewritten, opts).await;
+    let refusals: Vec<String> = statuses
+        .iter()
+        .filter_map(|(_, s)| match s {
+            PinStatus::Refused(why) => Some(why.clone()),
+            PinStatus::Restored => None,
+        })
+        .collect();
+    assert!(!refusals.is_empty() && refusals.len() == statuses.len(), "{statuses:?}");
+    (refusals.join("\n"), rewritten, after)
+}
+
+fn fixture(rel: &str) -> String {
+    fs::read_to_string(Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures").join(rel))
+        .unwrap()
+}
+
+#[tokio::test]
+#[serial]
+async fn requirements_golden_restores_modulo_name_casing() {
+    // NOT byte-invertible: the hosted line spells the name as the grant does
+    // (`Requests`); the original spelling (`requests`) is not recorded.
+    let mut ran = 0;
+    for case in load("pypi/requirements") {
+        let (after, statuses) = run_case(&case).await;
+        assert!(!statuses.is_empty());
+        for (purl, status) in &statuses {
+            assert_eq!(*status, PinStatus::Restored, "{}: {purl}", case.dir.display());
+        }
+        assert_eq!(
+            after["requirements.txt"].to_ascii_lowercase(),
+            case.input["requirements.txt"].to_ascii_lowercase()
+        );
+        ran += 1;
+    }
+    assert!(ran > 0);
+}
+
+#[tokio::test]
+#[serial]
+async fn uv_golden_without_a_registry_sibling_is_refused() {
+    // NOT invertible: the lock holds no other registry package, so which
+    // artifact fields this uv release records (`size`, `upload-time`) and
+    // how it lays out `wheels` is not derivable.
+    let (_server, _env) = pypi_mock(&[(
+        "click",
+        "8.1.7",
+        vec![("click-8.1.7-py3-none-any.whl", URLLIB3_WHEEL_SHA, 1, "2023-08-17T17:29:10Z")],
+    )])
+    .await;
+    let mut ran = 0;
+    for case in load("pypi/uv") {
+        let (after, statuses) = run_case(&case).await;
+        assert!(!statuses.is_empty());
+        for (purl, status) in &statuses {
+            assert!(
+                matches!(status, PinStatus::Refused(why)
+                    if why.contains("sibling") && why.contains("git checkout -- uv.lock")),
+                "{}: {purl} {status:?}",
+                case.dir.display()
+            );
+        }
+        assert_eq!(after, case.expected, "a refused pin must leave the files untouched");
+        ran += 1;
+    }
+    assert!(ran > 0);
+}
+
+#[tokio::test]
+#[serial]
+async fn poetry_every_lock_generation_round_trips() {
+    let (_server, _env) = pypi_mock(&[urllib3_release()]).await;
+    let files = format!(
+        "urllib3 = [\n    {{file = \"{URLLIB3_WHEEL}\", hash = \"sha256:{URLLIB3_WHEEL_SHA}\"}},\n    {{file = \"{URLLIB3_SDIST}\", hash = \"sha256:{URLLIB3_SDIST_SHA}\"}},\n]"
+    );
+    for version in [
+        "1.0.10", "1.1.15", "1.2.2", "1.3.2", "1.4.2", "1.5.1", "1.6.1", "1.7.1", "1.8.5", "2.0.1",
+        "2.1.4", "2.2.1", "2.3.4", "2.4.3",
+    ] {
+        // The 1.0/1.1 fixtures were locked without hashes (`urllib3 = []`);
+        // a real lock lists every release file.
+        let lock =
+            fixture(&format!("poetry/{version}/poetry.lock")).replace("urllib3 = []", &files);
+        for eol in ["\n", "\r\n"] {
+            let input = tree(&[("poetry.lock", lock.replace('\n', eol))]);
+            let label = format!("poetry {version} {eol:?}");
+            assert_pypi_round_trip(&label, &input, &[urllib3_dep()], None).await;
+        }
+    }
+}
+
+/// The backtest's `direct` and `crlf` shapes (`scripts/backtest-poetry.py`):
+/// every native lock exactly as its Poetry wrote it — the 1.0/1.1 ones with
+/// the empty `urllib3 = []` today's PyPI leaves them — LF and CRLF, through
+/// the real hosted rewriter and back.
+#[tokio::test]
+#[serial]
+async fn poetry_native_lock_generations_round_trip_byte_exactly() {
+    let (_server, _env) = pypi_mock(&[urllib3_release()]).await;
+    for version in [
+        "1.0.10", "1.1.15", "1.2.2", "1.3.2", "1.4.2", "1.5.1", "1.6.1", "1.7.1", "1.8.5", "2.0.1",
+        "2.1.4", "2.2.1", "2.3.4", "2.4.3",
+    ] {
+        let lock = fixture(&format!("poetry/{version}/poetry.lock")).replace("\r\n", "\n");
+        for eol in ["\n", "\r\n"] {
+            let input = tree(&[("poetry.lock", lock.replace('\n', eol))]);
+            let label = format!("poetry {version} native {eol:?}");
+            assert_pypi_round_trip(&label, &input, &[urllib3_dep()], None).await;
+        }
+    }
+}
+
+#[tokio::test]
+#[serial]
+async fn poetry_multi_package_lock_restores_only_the_pin() {
+    let (_server, _env) = pypi_mock(&[urllib3_release()]).await;
+    let lock = fixture("poetry/2.4.3/poetry.lock").replace(
+        "\n[metadata]",
+        "\n[[package]]\nname = \"idna\"\nversion = \"3.4\"\ndescription = \"x\"\noptional = false\npython-versions = \">=3.5\"\ngroups = [\"main\"]\nfiles = [\n    {file = \"idna-3.4-py3-none-any.whl\", hash = \"sha256:aaaa\"},\n]\n\n[metadata]",
+    );
+    let input = tree(&[("poetry.lock", lock)]);
+    assert_pypi_round_trip("poetry siblings", &input, &[urllib3_dep()], None).await;
+}
+
+#[tokio::test]
+#[serial]
+async fn pdm_every_supported_format_round_trips() {
+    let (_server, _env) = pypi_mock(&[urllib3_release()]).await;
+    let mut ran = 0;
+    let dir = Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/pdm-native");
+    for entry in fs::read_dir(dir).unwrap() {
+        let path = entry.unwrap().path();
+        if path.extension().and_then(|e| e.to_str()) != Some("lock") {
+            continue;
+        }
+        let lock = fs::read_to_string(&path).unwrap();
+        for eol in ["\n", "\r\n"] {
+            let input = tree(&[("pdm.lock", lock.replace('\n', eol))]);
+            // Formats the hosted rewriter refuses (PDM 1.15, 2.0–2.7) have
+            // nothing to restore.
+            if hosted(&input, &[urllib3_dep()], None) == input {
+                continue;
+            }
+            let label = format!("{} {eol:?}", path.display());
+            assert_pypi_round_trip(&label, &input, &[urllib3_dep()], None).await;
+            ran += 1;
+        }
+    }
+    assert!(ran >= 10, "{ran}");
+}
+
+#[tokio::test]
+#[serial]
+async fn pdm_static_urls_round_trip() {
+    let (_server, _env) = pypi_mock(&[urllib3_release()]).await;
+    let lock = fixture("pdm-native/2.29.2.lock")
+        .replace(
+            "strategy = [\"inherit_metadata\"]",
+            "strategy = [\"inherit_metadata\", \"static_urls\"]",
+        )
+        .replace(
+            &format!("{{file = \"{URLLIB3_WHEEL}\""),
+            &format!("{{url = \"{}\"", pypi_file_url(URLLIB3_WHEEL)),
+        )
+        .replace(
+            &format!("{{file = \"{URLLIB3_SDIST}\""),
+            &format!("{{url = \"{}\"", pypi_file_url(URLLIB3_SDIST)),
+        );
+    // PDM writes a static_urls entry's files in URL order (sdist first here).
+    let wheel_line = format!("    {{url = \"{}\", hash = \"sha256:{URLLIB3_WHEEL_SHA}\"}},\n", pypi_file_url(URLLIB3_WHEEL));
+    assert!(lock.contains(&wheel_line), "{lock}");
+    let lock = lock.replacen(&wheel_line, "", 1).replacen("\n]\n", &format!("\n{wheel_line}]\n"), 1);
+    assert!(
+        lock.find(URLLIB3_SDIST).unwrap() < lock.find(URLLIB3_WHEEL).unwrap(),
+        "{lock}"
+    );
+    let input = tree(&[("pdm.lock", lock)]);
+    assert_pypi_round_trip("pdm static_urls", &input, &[urllib3_dep()], None).await;
+}
+
+#[tokio::test]
+#[serial]
+async fn pdm_narrowed_lock_with_platform_wheels_is_refused() {
+    let wheel = "urllib3-1.26.18-cp311-cp311-manylinux_2_17_x86_64.whl";
+    let mut release = urllib3_release();
+    release.2.push((wheel, URLLIB3_WHEEL_SHA, 1, "2023-10-17T17:46:21Z"));
+    let (_server, _env) = pypi_mock(&[release]).await;
+    let input = tree(&[("pdm.lock", fixture("pdm-native/2.29.2.lock"))]);
+    let (why, rewritten, after) =
+        pypi_refusal(&input, &[urllib3_dep()], &RestoreOptions::default()).await;
+    assert!(why.contains("not derivable") && why.contains("cross_platform"), "{why}");
+    assert!(why.contains("git checkout -- pdm.lock"), "{why}");
+    assert_eq!(after, rewritten);
+    // A cross-platform lock records every file, whatever its tags.
+    let input = tree(&[("pdm.lock", fixture("pdm-native/2.11.2.lock"))]);
+    let rewritten = hosted(&input, &[urllib3_dep()], None);
+    let (after, statuses) = restore_tree(&rewritten, &RestoreOptions::default()).await;
+    assert_eq!(statuses[0].1, PinStatus::Restored);
+    assert!(after["pdm.lock"].contains(wheel));
+}
+
+/// serde_json's 2-space pretty output re-indented to Pipenv's 4 spaces.
+fn reindent4(text: &str) -> String {
+    text.lines()
+        .map(|l| {
+            let n = l.len() - l.trim_start().len();
+            format!("{}{}", " ".repeat(n * 2), l.trim_start())
+        })
+        .collect::<Vec<_>>()
+        .join("\n")
+}
+
+#[tokio::test]
+#[serial]
+async fn pipfile_lock_fixture_and_every_category_round_trip() {
+    let (_server, _env) = pypi_mock(&[urllib3_release()]).await;
+    let dir = "pipenv/2026.8.0";
+    let input = tree(&[
+        ("Pipfile.lock", fixture(&format!("{dir}/Pipfile.lock"))),
+        ("Pipfile", fixture(&format!("{dir}/Pipfile"))),
+    ]);
+    assert_pypi_round_trip("pipenv fixture", &input, &[urllib3_dep()], None).await;
+
+    // Several categories (a custom one too), extras, markers, a registry
+    // sibling; LF and CRLF.
+    let hashes = serde_json::json!([
+        format!("sha256:{URLLIB3_WHEEL_SHA}"),
+        format!("sha256:{URLLIB3_SDIST_SHA}")
+    ]);
+    let lock = serde_json::json!({
+        "_meta": { "hash": { "sha256": "x" }, "pipfile-spec": 6, "requires": {},
+                   "sources": [{ "name": "pypi", "url": "https://pypi.org/simple", "verify_ssl": true }] },
+        "default": {
+            "idna": { "hashes": ["sha256:aaaa"], "index": "pypi", "version": "==3.4" },
+            "urllib3": { "extras": ["socks"], "hashes": hashes, "index": "pypi",
+                         "markers": "python_version >= '3'", "version": "==1.26.18" }
+        },
+        "develop": { "urllib3": { "hashes": hashes, "index": "pypi", "version": "==1.26.18" } },
+        "tests": { "urllib3": { "hashes": hashes, "index": "pypi", "version": "==1.26.18" } }
+    });
+    let text = reindent4(&serde_json::to_string_pretty(&lock).unwrap()) + "\n";
+    for eol in ["\n", "\r\n"] {
+        let input = tree(&[
+            ("Pipfile.lock", text.replace('\n', eol)),
+            ("Pipfile", "[packages]\nurllib3 = \"*\"\n".into()),
+        ]);
+        let label = format!("pipenv categories {eol:?}");
+        assert_pypi_round_trip(&label, &input, &[urllib3_dep()], None).await;
+    }
+    // Pipenv 7.x–2017 writes `path` (and, before 2018, no `index`).
+    let old = text.replace(",\n            \"index\": \"pypi\"", "").replace("\"index\": \"pypi\",\n            ", "");
+    assert!(!old.contains("\"index\""), "{old}");
+    let input = tree(&[("Pipfile.lock", old), ("Pipfile", "[packages]\n".into())]);
+    assert_pypi_round_trip("pipenv 2017", &input, &[urllib3_dep()], Some(11)).await;
+}
+
+/// Real `pipenv lock` output for the backtest's `extras` and
+/// `marker-excluded` shapes (`scripts/backtest-pipenv.py`), under
+/// `tests/fixtures/pipenv-shapes/<release>/<shape>/`. Whether Pipenv
+/// records `index` differs by release for the SAME Pipfile — 2018.11.26
+/// writes it on both, 2022.12.19 only on the `extras` entry (the
+/// marker-excluded one is written without resolving, and its transitive
+/// `pysocks` gets none), 2026.8.0 on neither (an inline-table Pipfile entry
+/// gets only an explicit `index`) — so the hosted entry keeps Pipenv's
+/// `index` and the restore carries it back instead of guessing it. LF and
+/// CRLF (the backtest's `crlf` shape) both round-trip byte for byte.
+#[tokio::test]
+#[serial]
+async fn pipfile_lock_real_pipenv_shapes_round_trip_their_index() {
+    let (_server, _env) = pypi_mock(&[urllib3_release()]).await;
+    let cases = [
+        ("2018.11.26", "extras", Some(2018), Some("pypi")),
+        ("2018.11.26", "marker-excluded", Some(2018), Some("pypi")),
+        ("2022.12.19", "extras", Some(2022), Some("pypi")),
+        ("2022.12.19", "marker-excluded", Some(2022), None),
+        ("2026.8.0", "extras", Some(2026), None),
+        ("2026.8.0", "marker-excluded", Some(2026), None),
+    ];
+    for (release, shape, major, index) in cases {
+        let dir = format!("pipenv-shapes/{release}/{shape}");
+        let lock = fixture(&format!("{dir}/Pipfile.lock"));
+        let pipfile = fixture(&format!("{dir}/Pipfile"));
+        let pristine: serde_json::Value = serde_json::from_str(&lock).unwrap();
+        assert_eq!(
+            pristine["default"]["urllib3"].get("index").and_then(|v| v.as_str()),
+            index,
+            "{dir}: fixture drifted from what Pipenv writes"
+        );
+        for eol in ["\n", "\r\n"] {
+            let input = tree(&[
+                ("Pipfile.lock", lock.replace('\n', eol)),
+                ("Pipfile", pipfile.replace('\n', eol)),
+            ]);
+            let label = format!("pipenv {release} {shape} {eol:?}");
+            // The hosted entry keeps Pipenv's `index` (present or absent)
+            // and every other registry-independent key.
+            let hosted_lock = hosted(&input, &[urllib3_dep()], major)["Pipfile.lock"].clone();
+            let entry: serde_json::Value = serde_json::from_str(&hosted_lock).unwrap();
+            let entry = &entry["default"]["urllib3"];
+            assert!(entry.get("file").is_some() && entry.get("version").is_none(), "{label}: {entry}");
+            for key in ["index", "markers", "extras"] {
+                assert_eq!(entry.get(key), pristine["default"]["urllib3"].get(key), "{label}: {key}");
+            }
+            assert_pypi_round_trip(&label, &input, &[urllib3_dep()], major).await;
+        }
+    }
+}
+
+/// `pipenv lock` 2023+ over a hosted marker-excluded entry (the backtest's
+/// `rollbackAfterRelockRetires` hybrid, measured on 2026.8.0) keeps our
+/// `file` reference and writes `version` and the registry `hashes` back
+/// around it — no `index`, as for the original entry. `rollback` must turn
+/// it back into the pristine registry entry, not add an `index` Pipenv
+/// never wrote.
+#[tokio::test]
+#[serial]
+async fn pipfile_lock_marker_excluded_relock_hybrid_restores_the_original() {
+    let (_server, _env) = pypi_mock(&[urllib3_release()]).await;
+    let dir = "pipenv-shapes/2026.8.0/marker-excluded";
+    let lock = fixture(&format!("{dir}/Pipfile.lock"));
+    let input = tree(&[
+        ("Pipfile.lock", lock.clone()),
+        ("Pipfile", fixture(&format!("{dir}/Pipfile"))),
+    ]);
+    let rewritten = hosted(&input, &[urllib3_dep()], Some(2026));
+    let mut relocked: serde_json::Value =
+        serde_json::from_str(&rewritten["Pipfile.lock"]).unwrap();
+    let pristine: serde_json::Value = serde_json::from_str(&lock).unwrap();
+    let entry = relocked["default"]["urllib3"].as_object_mut().unwrap();
+    assert!(entry.contains_key("file") && !entry.contains_key("index"), "{entry:?}");
+    entry.insert("hashes".into(), pristine["default"]["urllib3"]["hashes"].clone());
+    entry.insert("version".into(), serde_json::json!("==1.26.18"));
+    relocked.sort_all_objects();
+    let hybrid = reindent4(&serde_json::to_string_pretty(&relocked).unwrap()) + "\n";
+    let mut tree_in = rewritten.clone();
+    tree_in.insert("Pipfile.lock".into(), hybrid);
+    let (after, statuses) = restore_tree(&tree_in, &RestoreOptions::default()).await;
+    assert!(!statuses.is_empty(), "the hybrid is still a hosted pin");
+    for (purl, status) in &statuses {
+        assert_eq!(*status, PinStatus::Restored, "{purl}");
+    }
+    assert_eq!(after["Pipfile.lock"], lock, "the hybrid restores the pristine bytes");
+}
+
+#[tokio::test]
+#[serial]
+async fn pipfile_lock_refusals() {
+    let dir = "pipenv/2026.8.0";
+    let pipfile = fixture(&format!("{dir}/Pipfile"));
+    let lock = fixture(&format!("{dir}/Pipfile.lock"));
+    {
+        let (_server, _env) = pypi_mock(&[urllib3_release()]).await;
+        // Offline: the hashes need PyPI.
+        let input = tree(&[("Pipfile.lock", lock.clone()), ("Pipfile", pipfile.clone())]);
+        let offline = RestoreOptions {
+            offline: true,
+            ..Default::default()
+        };
+        let (why, rewritten, after) = pypi_refusal(&input, &[urllib3_dep()], &offline).await;
+        assert!(why.contains("offline") && why.contains("git checkout -- Pipfile.lock"), "{why}");
+        assert_eq!(after, rewritten);
+        // A mirror as the only source.
+        let mirror = lock.replace("https://pypi.org/simple", "https://mirror.example/simple");
+        let input = tree(&[("Pipfile.lock", mirror), ("Pipfile", pipfile.clone())]);
+        let (why, _, _) = pypi_refusal(&input, &[urllib3_dep()], &RestoreOptions::default()).await;
+        assert!(why.contains("is PyPI"), "{why}");
+        // The Pipfile routes the package to another index.
+        let routed = pipfile.replace(
+            "urllib3 = \"==1.26.18\"",
+            "urllib3 = { version = \"==1.26.18\", index = \"private\" }",
+        );
+        let input = tree(&[("Pipfile.lock", lock.clone()), ("Pipfile", routed)]);
+        let (why, _, _) = pypi_refusal(&input, &[urllib3_dep()], &RestoreOptions::default()).await;
+        assert!(why.contains("not PyPI"), "{why}");
+    }
+    // PyPI does not know the release.
+    let (_server, _env) = pypi_mock(&[]).await;
+    let input = tree(&[("Pipfile.lock", lock), ("Pipfile", pipfile)]);
+    let (why, _, _) = pypi_refusal(&input, &[urllib3_dep()], &RestoreOptions::default()).await;
+    assert!(why.contains("404"), "{why}");
+}
+
+#[tokio::test]
+#[serial]
+async fn requirements_round_trips_in_both_hash_modes() {
+    let (_server, _env) = pypi_mock(&[urllib3_release()]).await;
+    // pip-compile --generate-hashes: continuation lines, `# via` comments.
+    let compiled = format!(
+        "#\n# pip-compile --generate-hashes\n#\nidna==3.4 \\\n    --hash=sha256:aaaa \\\n    --hash=sha256:bbbb\n    # via foo\nurllib3[socks]==1.26.18 ; python_version >= \"3\" \\\n    --hash=sha256:{URLLIB3_WHEEL_SHA} \\\n    --hash=sha256:{URLLIB3_SDIST_SHA}\n    # via -r requirements.in\n"
+    );
+    // Single-line hashes, a BOM, indentation, an inline comment, an option.
+    let single = format!(
+        "\u{feff}idna==3.4 --hash=sha256:aaaa\n  urllib3==1.26.18 --no-binary :none: --hash=sha256:{URLLIB3_WHEEL_SHA} --hash=sha256:{URLLIB3_SDIST_SHA} # keep\n"
+    );
+    let plain =
+        "-i https://pypi.org/simple\nflask==2.0.1\nurllib3[socks]==1.26.18 ; sys_platform == \"linux\" # pinned\n"
+            .to_string();
+    for (label, text) in [("compiled", compiled), ("single", single), ("plain", plain)] {
+        for eol in ["\n", "\r\n"] {
+            let input = tree(&[("requirements.txt", text.replace('\n', eol))]);
+            let label = format!("requirements {label} {eol:?}");
+            assert_pypi_round_trip(&label, &input, &[urllib3_dep()], None).await;
+        }
+    }
+}
+
+#[tokio::test]
+#[serial]
+async fn requirements_hash_mode_ambiguity_is_refused() {
+    let (_server, _env) = pypi_mock(&[urllib3_release()]).await;
+    let input = tree(&[("requirements.txt", "urllib3==1.26.18\n".into())]);
+    let (why, _, _) = pypi_refusal(&input, &[urllib3_dep()], &RestoreOptions::default()).await;
+    assert!(why.contains("hash-checking mode") && why.contains("not derivable"), "{why}");
+    let input = tree(&[(
+        "requirements.txt",
+        "idna==3.4 --hash=sha256:aaaa\nsix==1.16.0\nurllib3==1.26.18\n".into(),
+    )]);
+    let (why, _, _) = pypi_refusal(&input, &[urllib3_dep()], &RestoreOptions::default()).await;
+    assert!(why.contains("mixes hashed and unhashed"), "{why}");
+    // `--require-hashes` alone settles it.
+    let input = tree(&[(
+        "requirements.txt",
+        format!("--require-hashes\nurllib3==1.26.18 --hash=sha256:{URLLIB3_WHEEL_SHA} --hash=sha256:{URLLIB3_SDIST_SHA}\n"),
+    )]);
+    assert_pypi_round_trip("require-hashes", &input, &[urllib3_dep()], None).await;
+    // Offline needs no lookup without hashes…
+    let offline = RestoreOptions {
+        offline: true,
+        ..Default::default()
+    };
+    let input = tree(&[("requirements.txt", "flask==2.0.1\nurllib3==1.26.18\n".into())]);
+    let rewritten = hosted(&input, &[urllib3_dep()], None);
+    let (after, statuses) = restore_tree(&rewritten, &offline).await;
+    assert_eq!(statuses[0].1, PinStatus::Restored);
+    assert_eq!(after["requirements.txt"], input["requirements.txt"]);
+    // …and is refused in hash mode.
+    let input = tree(&[(
+        "requirements.txt",
+        format!("idna==3.4 --hash=sha256:aaaa\nurllib3==1.26.18 --hash=sha256:{URLLIB3_WHEEL_SHA}\n"),
+    )]);
+    let (why, _, _) = pypi_refusal(&input, &[urllib3_dep()], &offline).await;
+    assert!(why.contains("offline"), "{why}");
+}
+
+#[tokio::test]
+#[serial]
+async fn a_refused_pin_leaves_the_other_pins_restored() {
+    // PyPI knows urllib3 only: idna's hashes cannot be re-derived.
+    let (_server, _env) = pypi_mock(&[urllib3_release()]).await;
+    let idna = pypi_dep("idna", "3.4", "idna-3.4-py3-none-any.whl", "44444444-4444-4444-4444-444444444444");
+    let input = tree(&[(
+        "requirements.txt",
+        format!(
+            "six==1.16.0 --hash=sha256:aaaa\nidna==3.4 --hash=sha256:bbbb\nurllib3==1.26.18 --hash=sha256:{URLLIB3_WHEEL_SHA} --hash=sha256:{URLLIB3_SDIST_SHA}\n"
+        ),
+    )]);
+    let rewritten = hosted(&input, &[urllib3_dep(), idna], None);
+    let (after, statuses) = restore_tree(&rewritten, &RestoreOptions::default()).await;
+    let status = |purl: &str| &statuses.iter().find(|(p, _)| p == purl).unwrap().1;
+    assert_eq!(*status("pkg:pypi/urllib3@1.26.18"), PinStatus::Restored);
+    assert!(matches!(status("pkg:pypi/idna@3.4"), PinStatus::Refused(why) if why.contains("404")));
+    let lines: Vec<&str> = after["requirements.txt"].lines().collect();
+    assert_eq!(lines[0], "six==1.16.0 --hash=sha256:aaaa");
+    assert!(lines[1].starts_with("idna @ https://patch.socket.dev/"), "{lines:?}");
+    assert_eq!(lines[2], input["requirements.txt"].lines().nth(2).unwrap());
+}
+
+#[tokio::test]
+#[serial]
+async fn hatch_round_trips_with_the_direct_reference_permission() {
+    let (_server, _env) = pypi_mock(&[]).await;
+    let cases = [
+        // The permission tables did not exist.
+        "[project]\nname = \"x\"\ndependencies = [\"Urllib3[socks]==1.26.18 ; python_version >= '3'\", \"idna\"]\n\n[build-system]\nrequires = [\"hatchling\"]\nbuild-backend = \"hatchling.build\"\n",
+        // `[tool.hatch]` existed; extras and environments too.
+        "[project]\nname = \"x\"\ndependencies = [\n    \"urllib3==1.26.18\",\n]\n\n[project.optional-dependencies]\nsocks = [\"urllib3[socks]==1.26.18\"]\n\n[tool.hatch.envs.default]\ndependencies = [\"urllib3==1.26.18\"]\n",
+        // Environment-only: no permission is written.
+        "[project]\nname = \"x\"\ndependencies = []\n\n[tool.hatch.envs.test]\nextra-dependencies = [\"urllib3==1.26.18\"] # pinned\n",
+    ];
+    for text in cases {
+        for eol in ["\n", "\r\n"] {
+            let input = tree(&[("pyproject.toml", text.replace('\n', eol))]);
+            let label = format!("hatch {text:?} {eol:?}");
+            assert_pypi_round_trip(&label, &input, &[urllib3_dep()], None).await;
+        }
+    }
+    // hatch.toml environments and its `[metadata]` permission.
+    let input = tree(&[
+        ("pyproject.toml", "[project]\nname = \"x\"\ndependencies = [\"urllib3==1.26.18\"]\n".into()),
+        ("hatch.toml", "[metadata]\nallow-direct-references = true\n\n[envs.default]\ndependencies = [\"urllib3==1.26.18\"]\n".into()),
+    ]);
+    let rewritten = hosted(&input, &[urllib3_dep()], None);
+    assert!(rewritten["hatch.toml"].contains("allow-direct-references = true"));
+    let (after, statuses) = restore_tree(&rewritten, &RestoreOptions::default()).await;
+    assert_eq!(statuses[0].1, PinStatus::Restored, "{statuses:?}");
+    assert_eq!(after["pyproject.toml"], input["pyproject.toml"]);
+    // The permission governs nothing once no direct reference is left.
+    assert!(!after["hatch.toml"].contains("allow-direct-references"));
+    assert!(after["hatch.toml"].contains("dependencies = [\"urllib3==1.26.18\"]"));
+}
+
+// ── uv ───────────────────────────────────────────────────────────────────────
+
+/// A uv.lock (revision 2 artifact shape) holding a registry `idna`, the
+/// virtual root `proj` and `urllib3`; `root_deps` / `requires_dist` are the
+/// root's `dependencies` and `requires-dist` entries.
+fn uv_lock(root_deps: &str, requires_dist: &str, tail: &str) -> String {
+    format!(
+        "version = 1\nrevision = 2\nrequires-python = \">=3.8\"\n\n\
+[[package]]\nname = \"idna\"\nversion = \"3.4\"\nsource = {{ registry = \"https://pypi.org/simple\" }}\n\
+sdist = {{ url = \"https://files.pythonhosted.org/packages/aa/idna-3.4.tar.gz\", hash = \"sha256:{a}\", size = 183077, upload-time = \"2022-09-14T19:41:00.123Z\" }}\n\
+wheels = [\n    {{ url = \"https://files.pythonhosted.org/packages/bb/idna-3.4-py3-none-any.whl\", hash = \"sha256:{b}\", size = 61538, upload-time = \"2022-09-14T19:40:59.1Z\" }},\n]\n\n\
+[[package]]\nname = \"proj\"\nversion = \"0.1.0\"\nsource = {{ virtual = \".\" }}\ndependencies = [\n{root_deps}]\n\n\
+[package.metadata]\nrequires-dist = [\n{requires_dist}]\n\n\
+[[package]]\nname = \"urllib3\"\nversion = \"1.26.18\"\nsource = {{ registry = \"https://pypi.org/simple\" }}\n\
+sdist = {{ url = \"{sdist_url}\", hash = \"sha256:{URLLIB3_SDIST_SHA}\", size = 305687, upload-time = \"2023-10-17T17:46:24Z\" }}\n\
+wheels = [\n    {{ url = \"{wheel_url}\", hash = \"sha256:{URLLIB3_WHEEL_SHA}\", size = 143835, upload-time = \"2023-10-17T17:46:21.184Z\" }},\n]\n\n\
+[package.optional-dependencies]\nsocks = [\n    {{ name = \"pysocks\" }},\n]\n{tail}",
+        a = "a".repeat(64),
+        b = "b".repeat(64),
+        sdist_url = pypi_file_url(URLLIB3_SDIST),
+        wheel_url = pypi_file_url(URLLIB3_WHEEL),
+    )
+}
+
+#[tokio::test]
+#[serial]
+async fn uv_project_locks_round_trip() {
+    let (_server, _env) = pypi_mock(&[urllib3_release()]).await;
+    // A direct dependency (extras, a multi-clause specifier whose spelling
+    // the idna entry shows), LF and CRLF.
+    let lock = uv_lock(
+        "    { name = \"idna\" },\n    { name = \"urllib3\", extra = [\"socks\"] },\n",
+        "    { name = \"idna\", specifier = \">=3, <4\" },\n    { name = \"urllib3\", extras = [\"socks\"], specifier = \">=1.26, <2\" },\n",
+        "",
+    );
+    let pyproject = "[project]\nname = \"proj\"\nversion = \"0.1.0\"\ndependencies = [\"idna>=3,<4\", \"urllib3[socks] >= 1.26, < 2\"]\n";
+    for eol in ["\n", "\r\n"] {
+        let input = tree(&[
+            ("uv.lock", lock.replace('\n', eol)),
+            ("pyproject.toml", pyproject.replace('\n', eol)),
+        ]);
+        assert_pypi_round_trip(&format!("uv direct {eol:?}"), &input, &[urllib3_dep()], None).await;
+    }
+    // A transitive dependency: the override the rewrite pins in the
+    // pyproject and the lock's `[manifest]` both go again.
+    let lock = uv_lock(
+        "    { name = \"idna\" },\n",
+        "    { name = \"idna\", specifier = \">=3\" },\n",
+        "",
+    );
+    let pyproject = "[project]\nname = \"proj\"\nversion = \"0.1.0\"\ndependencies = [\"idna>=3\"]\n\n[tool.uv]\ndev-dependencies = []\n";
+    let input = tree(&[("uv.lock", lock), ("pyproject.toml", pyproject.into())]);
+    let rewritten = hosted(&input, &[urllib3_dep()], None);
+    assert!(rewritten["pyproject.toml"].contains("override-dependencies"));
+    assert!(rewritten["uv.lock"].contains("[manifest]"));
+    assert_pypi_round_trip("uv transitive", &input, &[urllib3_dep()], None).await;
+    // A lock-only checkout, with a dependent's source-qualified reference.
+    let lock = uv_lock(
+        "    { name = \"idna\" },\n    { name = \"urllib3\", source = { registry = \"https://pypi.org/simple\" } },\n",
+        "    { name = \"idna\", specifier = \">=3\" },\n",
+        "",
+    );
+    let input = tree(&[("uv.lock", lock)]);
+    assert_pypi_round_trip("uv lock-only", &input, &[urllib3_dep()], None).await;
+}
+
+#[tokio::test]
+#[serial]
+async fn uv_script_lock_round_trips() {
+    let (_server, _env) = pypi_mock(&[urllib3_release()]).await;
+    let script = "#!/usr/bin/env python3\n# /// script\n# dependencies = [\"idna>=3\", \"urllib3==1.26.18\"]\n# ///\nprint('hi')\n";
+    let lock = uv_lock("", "", "\n[manifest]\nrequirements = [\n    { name = \"idna\", specifier = \">=3\" },\n    { name = \"urllib3\", specifier = \"==1.26.18\" },\n]\n")
+        .replace(
+            "[[package]]\nname = \"proj\"\nversion = \"0.1.0\"\nsource = { virtual = \".\" }\ndependencies = [\n]\n\n[package.metadata]\nrequires-dist = [\n]\n\n",
+            "",
+        );
+    assert!(!lock.contains("proj"), "{lock}");
+    let input = tree(&[("tool.py", script.into()), ("tool.py.lock", lock)]);
+    assert_pypi_round_trip("uv script", &input, &[urllib3_dep()], None).await;
+}
+
+#[tokio::test]
+#[serial]
+async fn pylock_round_trips() {
+    let (_server, _env) = pypi_mock(&[urllib3_release()]).await;
+    let lock = format!(
+        "lock-version = \"1.0\"\ncreated-by = \"uv\"\nrequires-python = \">=3.8\"\n\n\
+[[packages]]\nname = \"idna\"\nversion = \"3.4\"\nindex = \"https://pypi.org/simple\"\n\
+sdist = {{ url = \"https://files.pythonhosted.org/packages/aa/idna-3.4.tar.gz\", upload-time = 2022-09-14T19:41:00.123Z, size = 183077, hashes = {{ sha256 = \"{a}\" }} }}\n\
+wheels = [{{ url = \"https://files.pythonhosted.org/packages/bb/idna-3.4-py3-none-any.whl\", upload-time = 2022-09-14T19:40:59.1Z, size = 61538, hashes = {{ sha256 = \"{b}\" }} }}]\n\n\
+[[packages]]\nname = \"urllib3\"\nversion = \"1.26.18\"\nindex = \"https://pypi.org/simple\"\n\
+sdist = {{ url = \"{sdist_url}\", upload-time = 2023-10-17T17:46:24Z, size = 305687, hashes = {{ sha256 = \"{URLLIB3_SDIST_SHA}\" }} }}\n\
+wheels = [{{ url = \"{wheel_url}\", upload-time = 2023-10-17T17:46:21.184Z, size = 143835, hashes = {{ sha256 = \"{URLLIB3_WHEEL_SHA}\" }} }}]\n",
+        a = "a".repeat(64),
+        b = "b".repeat(64),
+        sdist_url = pypi_file_url(URLLIB3_SDIST),
+        wheel_url = pypi_file_url(URLLIB3_WHEEL),
+    );
+    let input = tree(&[("pylock.toml", lock)]);
+    assert_pypi_round_trip("pylock", &input, &[urllib3_dep()], None).await;
+}
+
+#[tokio::test]
+#[serial]
+async fn uv_refusals() {
+    let direct = uv_lock(
+        "    { name = \"idna\" },\n    { name = \"urllib3\" },\n",
+        "    { name = \"idna\", specifier = \">=3\" },\n    { name = \"urllib3\", specifier = \">=1.26, <2\" },\n",
+        "",
+    );
+    let pyproject = "[project]\nname = \"proj\"\nversion = \"0.1.0\"\ndependencies = [\"idna>=3\", \"urllib3>=1.26,<2\"]\n";
+    {
+        let (_server, _env) = pypi_mock(&[urllib3_release()]).await;
+        // No other entry shows how this uv joins specifier clauses.
+        let input = tree(&[("uv.lock", direct.clone()), ("pyproject.toml", pyproject.into())]);
+        let (why, rewritten, after) =
+            pypi_refusal(&input, &[urllib3_dep()], &RestoreOptions::default()).await;
+        assert!(why.contains("multi-clause"), "{why}");
+        assert!(why.contains("git checkout -- uv.lock"), "{why}");
+        assert_eq!(after, rewritten, "a refused pin leaves every file hosted");
+        // Another registry than PyPI.
+        let mirror = direct.replace("https://pypi.org/simple", "https://mirror.example/simple");
+        let input = tree(&[("uv.lock", mirror)]);
+        let (why, _, _) = pypi_refusal(&input, &[urllib3_dep()], &RestoreOptions::default()).await;
+        assert!(why.contains("not PyPI"), "{why}");
+        // Several registries.
+        let mixed = direct.replace(
+            "[[package]]\nname = \"proj\"",
+            "[[package]]\nname = \"six\"\nversion = \"1.16.0\"\nsource = { registry = \"https://mirror.example/simple\" }\n\n[[package]]\nname = \"proj\"",
+        );
+        let input = tree(&[("uv.lock", mixed)]);
+        let (why, _, _) = pypi_refusal(&input, &[urllib3_dep()], &RestoreOptions::default()).await;
+        assert!(why.contains("several registries"), "{why}");
+        // `exclude-newer` filters files by upload time.
+        let newer = direct.replace(
+            "requires-python = \">=3.8\"\n",
+            "requires-python = \">=3.8\"\n\n[options]\nexclude-newer = \"2024-01-01T00:00:00Z\"\n",
+        );
+        let input = tree(&[("uv.lock", newer)]);
+        let (why, _, _) = pypi_refusal(&input, &[urllib3_dep()], &RestoreOptions::default()).await;
+        assert!(why.contains("exclude-newer"), "{why}");
+        // Offline.
+        let input = tree(&[("uv.lock", direct.clone())]);
+        let offline = RestoreOptions {
+            offline: true,
+            ..Default::default()
+        };
+        let (why, _, _) = pypi_refusal(&input, &[urllib3_dep()], &offline).await;
+        assert!(why.contains("offline"), "{why}");
+    }
+    // A release with interpreter-specific wheels.
+    let mut release = urllib3_release();
+    release.2.push(("urllib3-1.26.18-cp311-cp311-win_amd64.whl", URLLIB3_WHEEL_SHA, 1, "2023-10-17T17:46:21Z"));
+    let (_server, _env) = pypi_mock(&[release]).await;
+    let input = tree(&[("uv.lock", direct)]);
+    let (why, _, _) = pypi_refusal(&input, &[urllib3_dep()], &RestoreOptions::default()).await;
+    assert!(why.contains("interpreter-specific wheels"), "{why}");
+}
+
+/// Serve each override's npm version document with the slot-[2] integrity
+/// its `input/` vlt-lock.json node records.
+async fn vlt_mock(case: &Case) -> MockServer {
+    let server = MockServer::start().await;
+    let lock: serde_json::Value = case
+        .input
+        .get("vlt-lock.json")
+        .and_then(|t| serde_json::from_str(t).ok())
+        .unwrap_or_default();
+    let empty = serde_json::Map::new();
+    let nodes = lock["nodes"].as_object().unwrap_or(&empty);
+    for o in &case.overrides {
+        let name = match o["namespace"].as_str() {
+            Some(ns) if !ns.is_empty() => format!("{ns}/{}", o["name"].as_str().unwrap()),
+            _ => o["name"].as_str().unwrap().to_string(),
+        };
+        let version = o["version"].as_str().unwrap();
+        let integrity = nodes.iter().find_map(|(id, tuple)| {
+            (tuple[1].as_str() == Some(name.as_str()) && id.contains(&format!("@{version}")))
+                .then(|| tuple[2].as_str().map(str::to_string))
+                .flatten()
+        });
+        let leaf = name.rsplit('/').next().unwrap();
+        let mut dist = serde_json::json!({
+            "tarball": format!("https://registry.npmjs.org/{name}/-/{leaf}-{version}.tgz"),
+        });
+        if let Some(integrity) = integrity {
+            dist["integrity"] = integrity.into();
+        }
+        Mock::given(method("GET"))
+            .and(path(format!("/{}/{version}", name.replace('/', "%2f"))))
+            .respond_with(ResponseTemplate::new(200).set_body_json(
+                serde_json::json!({ "name": name, "version": version, "dist": dist }),
+            ))
+            .mount(&server)
+            .await;
+    }
+    server
+}
+
+#[tokio::test]
+#[serial]
+async fn vlt_goldens_round_trip() {
+    // sibling-package-lock-vlt-installed, sibling-refused-in-vlt: vlt-lock.json
+    // refused a package whose package-lock.json entry the rewrite still
+    // pinned; with vlt-lock.json upstream that pin is not live wiring, so
+    // discovery (rightly) reports no pin to restore there.
+    let not_invertible = ["sibling-package-lock-vlt-installed", "sibling-refused-in-vlt"];
+    let mut ran = 0;
+    for case in load("npm/vlt") {
+        let name = case.dir.file_name().unwrap().to_string_lossy().into_owned();
+        if not_invertible.contains(&name.as_str()) {
+            continue;
+        }
+        let server = vlt_mock(&case).await;
+        let _env = EnvGuard::set(&[("SOCKET_NPM_REGISTRY", server.uri())]);
+        let (after, statuses) = run_case(&case).await;
+        assert_round_trip(&case, &after, &statuses);
+        ran += 1;
+    }
+    assert!(ran > 0);
+}
+
+#[tokio::test]
+#[serial]
+async fn maven_goldens_round_trip() {
+    // mvn-config-merge: `.mvn/maven.config` existed, so whether the appended
+    // resolver lines were the user's is not derivable; they stay (warned).
+    // no-suffix-fallback: a same-GAV repository is tied to no artifact, so
+    // discovery reports no pin to restore.
+    let not_invertible = ["mvn-config-merge", "no-suffix-fallback"];
+    let mut ran = 0;
+    for case in load("maven/pom") {
+        let name = case.dir.file_name().unwrap().to_string_lossy().into_owned();
+        if not_invertible.contains(&name.as_str()) {
+            continue;
+        }
+        let (after, statuses) = run_case(&case).await;
+        assert_round_trip(&case, &after, &statuses);
+        ran += 1;
+    }
+    assert!(ran > 0);
+}
+
+#[tokio::test]
+#[serial]
+async fn maven_config_merge_keeps_the_resolver_lines() {
+    let case = load("maven/pom")
+        .into_iter()
+        .find(|c| c.dir.ends_with("mvn-config-merge"))
+        .unwrap();
+    let (after, statuses) = run_case(&case).await;
+    assert!(matches!(statuses[..], [(_, PinStatus::Restored)]), "{statuses:?}");
+    for rel in ["pom.xml", ".mvn/checksums/checksums.sha256"] {
+        assert_eq!(after.get(rel), case.input.get(rel), "{rel}");
+    }
+    assert_eq!(
+        after.get(".mvn/maven.config"),
+        case.expected.get(".mvn/maven.config")
+    );
+}
+
+/// Serve nuget.org's registration leaf and catalog entry for every package
+/// the `input/` lock pins, with the contentHash it records.
+async fn nuget_mock(case: &Case) -> MockServer {
+    let server = MockServer::start().await;
+    let lock: serde_json::Value =
+        serde_json::from_str(case.input.get("packages.lock.json").unwrap()).unwrap();
+    for fw in lock["dependencies"].as_object().unwrap().values() {
+        for (id, entry) in fw.as_object().unwrap() {
+            let (id, version) = (id.to_lowercase(), entry["resolved"].as_str().unwrap());
+            let catalog = format!("{}/catalog0/data/{id}.{version}.json", server.uri());
+            Mock::given(method("GET"))
+                .and(path(format!("/v3/registration5-gz-semver2/{id}/{version}.json")))
+                .respond_with(
+                    ResponseTemplate::new(200)
+                        .set_body_json(serde_json::json!({ "catalogEntry": catalog })),
+                )
+                .mount(&server)
+                .await;
+            Mock::given(method("GET"))
+                .and(path(format!("/catalog0/data/{id}.{version}.json")))
+                .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+                    "id": id,
+                    "version": version,
+                    "packageHash": entry["contentHash"],
+                    "packageHashAlgorithm": "SHA512",
+                })))
+                .mount(&server)
+                .await;
+        }
+    }
+    server
+}
+
+/// The NuGet cases that do not round-trip byte for byte, and why.
+const NUGET_NOT_INVERTIBLE: [&str; 3] = [
+    // The rewriter seeded a nuget.org source into a source-less config,
+    // which reads exactly like a user's own nuget.org source (`basic`); it
+    // stays.
+    "empty-sources",
+    "empty-sources-selfclosing",
+    // Two feeds serve every package once the Socket mapping is gone, so the
+    // original contentHash's feed is ambiguous: refused.
+    "no-preexisting-mapping",
+];
+
+#[tokio::test]
+#[serial]
+async fn nuget_goldens_round_trip() {
+    let mut ran = 0;
+    for case in load("nuget/packages-lock") {
+        let name = case.dir.file_name().unwrap().to_string_lossy().into_owned();
+        if NUGET_NOT_INVERTIBLE.contains(&name.as_str()) {
+            continue;
+        }
+        let server = nuget_mock(&case).await;
+        let _env = EnvGuard::set(&[("SOCKET_NUGET_URL", server.uri())]);
+        let (after, statuses) = run_case(&case).await;
+        assert_round_trip(&case, &after, &statuses);
+        ran += 1;
+    }
+    assert!(ran > 0);
+}
+
+#[tokio::test]
+#[serial]
+async fn nuget_non_invertible_goldens_restore_or_refuse_as_documented() {
+    for name in NUGET_NOT_INVERTIBLE {
+        let case = load("nuget/packages-lock")
+            .into_iter()
+            .find(|c| c.dir.ends_with(name))
+            .unwrap();
+        let server = nuget_mock(&case).await;
+        let _env = EnvGuard::set(&[("SOCKET_NUGET_URL", server.uri())]);
+        let (after, statuses) = run_case(&case).await;
+        let [(_, status)] = &statuses[..] else {
+            panic!("{name}: {statuses:?}");
+        };
+        if name == "no-preexisting-mapping" {
+            let PinStatus::Refused(why) = status else {
+                panic!("{name}: {status:?}");
+            };
+            assert!(why.contains("corp-feed") && why.contains("git checkout"), "{why}");
+            assert_eq!(after, case.expected, "{name}: a refusal changes nothing");
+        } else {
+            assert_eq!(*status, PinStatus::Restored, "{name}");
+            assert_eq!(after.get("packages.lock.json"), case.input.get("packages.lock.json"));
+            let config = &after["nuget.config"];
+            assert!(!config.contains("socket-patch") && !config.contains("packageSourceMapping"));
+        }
+    }
+}
diff --git a/crates/socket-patch-core/tests/uv_hosted.rs b/crates/socket-patch-core/tests/uv_hosted.rs
index 8c432806..81428d28 100644
--- a/crates/socket-patch-core/tests/uv_hosted.rs
+++ b/crates/socket-patch-core/tests/uv_hosted.rs
@@ -1,8 +1,7 @@
 use std::collections::BTreeMap;
 
 use socket_patch_core::patch::redirect::{
-    revert_remaining_redirect_edits, rewrite_registry_redirect, DepOverride, Integrity,
-    RedirectState,
+    rewrite_registry_redirect, DepOverride, Integrity,
 };
 
 fn patch(name: &str) -> DepOverride {
@@ -34,8 +33,8 @@ fn files() -> BTreeMap<String, String> {
     ])
 }
 
-#[tokio::test]
-async fn script_redirect_and_revert_restore_every_original_byte() {
+#[test]
+fn script_redirect_is_idempotent() {
     let original = files();
     let overrides = [patch("alpha"), patch("bravo")];
     let result = rewrite_registry_redirect(&original, &overrides);
@@ -45,28 +44,6 @@ async fn script_redirect_and_revert_restore_every_original_byte() {
     assert!(again.warnings.is_empty(), "{:?}", again.warnings);
     assert!(again.files.is_empty());
     assert!(again.edits.is_empty());
-
-    let directory = tempfile::tempdir().unwrap();
-    for (path, contents) in &result.files {
-        tokio::fs::write(directory.path().join(path), contents)
-            .await
-            .unwrap();
-    }
-    let mut state = RedirectState {
-        edits: result.edits,
-        ..RedirectState::default()
-    };
-    let outcome = revert_remaining_redirect_edits(directory.path(), &mut state, false).await;
-    assert!(outcome.fully_reverted(), "{:?}", outcome.refusals);
-    assert!(state.edits.is_empty());
-    for (path, contents) in original {
-        assert_eq!(
-            tokio::fs::read_to_string(directory.path().join(path))
-                .await
-                .unwrap(),
-            contents
-        );
-    }
 }
 
 #[test]
@@ -85,42 +62,8 @@ fn conflicting_or_missing_script_metadata_refuses_lock_changes() {
     assert_eq!(result.warnings[0].code, "redirect_uv_script_missing");
 }
 
-#[tokio::test]
-async fn script_drift_keeps_both_paired_files_during_revert() {
-    let result = rewrite_registry_redirect(&files(), &[patch("alpha")]);
-    let directory = tempfile::tempdir().unwrap();
-    for (path, contents) in &result.files {
-        tokio::fs::write(directory.path().join(path), contents)
-            .await
-            .unwrap();
-    }
-    let changed = result.files["example.py"].replace("dependencies =", "dependencies  =");
-    tokio::fs::write(directory.path().join("example.py"), &changed)
-        .await
-        .unwrap();
-    let mut state = RedirectState {
-        edits: result.edits,
-        ..RedirectState::default()
-    };
-    let outcome = revert_remaining_redirect_edits(directory.path(), &mut state, false).await;
-    assert!(!outcome.fully_reverted());
-    assert_eq!(
-        tokio::fs::read_to_string(directory.path().join("example.py"))
-            .await
-            .unwrap(),
-        changed
-    );
-    assert_eq!(
-        tokio::fs::read_to_string(directory.path().join("example.py.lock"))
-            .await
-            .unwrap(),
-        result.files["example.py.lock"]
-    );
-    assert!(!state.edits.is_empty());
-}
-
-#[tokio::test]
-async fn native_projects_keep_sources_and_metadata_in_sync() {
+#[test]
+fn native_projects_keep_sources_and_metadata_in_sync() {
     use socket_patch_core::patch::redirect::rewrite_registry_redirect_with_python_metadata;
 
     for direct in [true, false] {
@@ -174,26 +117,6 @@ async fn native_projects_keep_sources_and_metadata_in_sync() {
             rewrite_registry_redirect_with_python_metadata(&result.files, &[dep], &metadata);
         assert!(again.files.is_empty(), "{:?}", again.files);
         assert!(again.warnings.is_empty(), "{:?}", again.warnings);
-        let directory = tempfile::tempdir().unwrap();
-        for (file, content) in result.files {
-            tokio::fs::write(directory.path().join(file), content)
-                .await
-                .unwrap();
-        }
-        let mut state = RedirectState {
-            edits: result.edits,
-            ..RedirectState::default()
-        };
-        let outcome = revert_remaining_redirect_edits(directory.path(), &mut state, false).await;
-        assert!(outcome.fully_reverted(), "{:?}", outcome.refusals);
-        for (file, content) in original {
-            assert_eq!(
-                tokio::fs::read_to_string(directory.path().join(file))
-                    .await
-                    .unwrap(),
-                content
-            );
-        }
     }
 }
 
diff --git a/crates/socket-patch-node/npm/test/smoke.mjs b/crates/socket-patch-node/npm/test/smoke.mjs
index a333ade1..826932ca 100644
--- a/crates/socket-patch-node/npm/test/smoke.mjs
+++ b/crates/socket-patch-node/npm/test/smoke.mjs
@@ -210,8 +210,8 @@ test('streamed session redirects the package-lock fixture', async () => {
   const paths = result.changedFiles.map((f) => f.path)
   assert.deepEqual(paths, [...paths].sort())
   assert.ok(
-    paths.some((p) => p.startsWith('.socket/')),
-    `a wet run writes the ledger (changed: ${paths.join(', ')})`,
+    !paths.some((p) => p.startsWith('.socket/')),
+    `v5 hosted mode writes only lockfile/config edits, no ledger (changed: ${paths.join(', ')})`,
   )
   assert.deepEqual(result.changedBinaryFiles, [])
   assert.deepEqual(result.deletedFiles, [])
@@ -222,7 +222,7 @@ test('streamed session redirects the package-lock fixture', async () => {
   assert.ok(calls.fetchPatch >= 1)
 })
 
-test('dry run previews the lockfile without a ledger or patch fetches', async () => {
+test('dry run previews the lockfile without patch fetches', async () => {
   const { provider, calls } = fakeProvider()
   const selection = addon.selectHostedScanPaths(tree)
   const session = new addon.HostedScanSession({ orgSlug: 'test-org', dryRun: true }, provider)
diff --git a/docs/ecosystems.md b/docs/ecosystems.md
index d1d6d3ca..53e19101 100644
--- a/docs/ecosystems.md
+++ b/docs/ecosystems.md
@@ -39,8 +39,9 @@ The backticked slug in each row is the value `-e`/`--ecosystems` accepts (e.g.
   committed shrinkwrap). npm 12 defaults `allow-remote=none` and refuses the
   redirected tarballs (EALLOWREMOTE) unless the project `.npmrc` sets
   `allow-remote=all`, so the hosted run writes it (new file, or one appended
-  line; ledger-recorded as `redirect_npmrc_allow_remote` and removed again by
-  `rollback` / `remove` / the vendored takeover) and always warns
+  line; once `rollback` / `remove` / the vendored takeover has restored the last
+  hosted lock entry, a file holding only that line is deleted, otherwise the line
+  stays with an `npm_allow_remote_left` warning) and always warns
   `redirect_npm_allow_remote` with the tradeoff (any url-resolved dependency is
   then admitted; sha512 pins stay enforced). Commit `.npmrc` with the lock. An
   explicit user `allow-remote=none` / `root` is respected (never rewritten or
@@ -107,9 +108,13 @@ The backticked slug in each row is the value `-e`/`--ecosystems` accepts (e.g.
   malformed binary locks fail closed before patching. Hosted → vendored and
   vendored → hosted conversions both work
   in place (mode takeover) — on a lock the vendored backend refuses (a pre-version-2
-  `workspace:` lock) `vendor` reports the refusal before the hosted revert and leaves the
-  purl hosted-patched — and `rollback <purl>` / `remove <purl>` unwind one of several
-  hosted bun redirects.
+  `workspace:` lock) `vendor` reports the refusal before the upstream restore and leaves the
+  purl hosted-patched — and `rollback <purl>` / `remove <purl>` restore one of several
+  hosted bun packages to its upstream registry entry. A hosted `bun.lockb` entry is not
+  rolled back (v5.0 keeps no hosted ledger, and a rebuilt binary record is not byte-exact
+  for every lock): rollback and remove refuse it with the `git checkout -- bun.lockb`
+  remedy, while the hosted → vendored takeover rebuilds its npm registry record natively
+  and vendors over it.
   Bun verifies the sha512 of URL and local-tarball tuples only from 1.3.10 (registry
   tuples from 1.2.0), so on 1.1.39–1.3.9 a hosted or vendored rewrite removes digest
   enforcement for the patched package. Every boundary here is measured against real
@@ -301,9 +306,9 @@ claimed only for `en`-equivalent locales (`LANG` unset, `C`, `POSIX` or `en_US`)
 test job sets `LANG=C` and `LC_ALL=C`. Vendored ownership and revert match by entry text,
 so they do not depend on the order.
 
-**Compatibility of ledgers.** vlt ledgers (`redirect_vlt_lock_node` hosted edits and
-`flavor: "vlt"` vendored entries) require the socket-patch release that adds vlt support:
-an older release does not understand them.
+**Compatibility of ledgers.** vlt vendor ledgers (`flavor: "vlt"` entries) require the
+socket-patch release that adds vlt support: an older release does not understand them.
+Hosted vlt pins need no ledger (v5.0): `rollback` restores them from the npm registry.
 
 ## Maven & NuGet caveats
 
diff --git a/docs/testing/bun-compatibility.md b/docs/testing/bun-compatibility.md
index d4748450..53ad0feb 100644
--- a/docs/testing/bun-compatibility.md
+++ b/docs/testing/bun-compatibility.md
@@ -42,7 +42,7 @@ other npm lockfile flavors.
 | Version-0 lock (Bun 1.1.39–1.1.45 `--save-text-lockfile`) with `workspace:` packages — 2-tuple entries `"consumer": ["consumer@workspace:packages/consumer", { "dependencies": { … } }]` | Refused `redirect_bun_workspace_unsupported`, lock untouched, exit 0. Remedy: delete `bun.lock` and re-lock with Bun ≥ 1.2 (writes lockfileVersion 1, which hosted mode accepts; 2 on Bun ≥ 1.4). A plain in-place `bun install` bumps the version only when a workspace depends on another workspace (root → member — the matrix's `workspace` shape, the only shape it was measured on); otherwise Bun 1.2.0 keeps version 0 and 1.2.23+ fail to resolve (see [In-place re-versioning](#installer-boundaries-measured)). | Refused `vendor_bun_workspace_unsupported` (pre-version-2 policy, next row); its remedy tail for a version-0 lock says to re-lock with Bun ≥ 1.2 before trying `--mode hosted`, which refuses version 0 too. | Works. |
 | Version-1 lock (Bun 1.2–1.3 default) with `workspace:` packages — 1-tuple entries `["consumer@workspace:packages/consumer"]` | Rewritten (golden `lock-v1-workspace`; matrix 1.2.0–1.3.14 `workspace` / `workspace-nested`). | Refused `vendor_bun_workspace_unsupported` before any write. Policy, not a grammar limit: Bun 1.2.x–1.3.x resolve a workspace member's local-tarball path relative to the MEMBER (our root-relative tuple ENOENTs on `bun install`), 1.4.x relative to the lockfile, and a committed lockfileVersion-2 lock is the only proof that every consumer runs Bun ≥ 1.4 (1.3.x cannot parse v2). A deliberate over-approximation: a package declared only by the workspace ROOT vendors and installs on v1 too, but the lock cannot cheaply prove which workspace declares a hoisted entry. Remedy in the detail: delete `bun.lock`, re-run `bun install` with Bun ≥ 1.4 (an in-place `bun install` keeps the existing version), or — version 1 — use `--mode hosted`, which accepts version-1 workspace locks (a version-0 lock is told to re-lock with Bun ≥ 1.2 first). NOT refused: purls the vendor ledger wires at the selected uuid, purls whose every matching lock tuple already points into `.socket/vendor/npm/` (any uuid — a superseding patch re-pins in place; the lock-derived rule the engine uses), in-sync re-runs and `repair` rebuilds. `vendor` and the vendor step run the same preflight BEFORE a hosted → vendored takeover's revert, so a hosted-redirected purl on such a lock stays hosted-patched (`failed vendor_bun_workspace_unsupported`, lock and ledgers untouched; `vendor --dry-run` previews the same code). A `.socket/vendor/state.json` the preflight cannot read is `vendor_state_unreadable`, fail-closed. | Works. |
 | Version-2 lock (Bun 1.4+) with `workspace:` packages, nested versions included | Rewritten (golden `lock-v2-workspace-nested` — provenance: its nested same-version `consumer/left-pad` entry is a synthetic, grammar-valid extension of the 1.4.2 capture; bun hoists identical resolutions and never writes that entry itself, but bun 1.4.2 installs the fixture unchanged, and it is the only case pinning the rewrite of every matching tuple in one lock). | Vendored (matrix 1.4.0 / 1.4.2 `workspace`, `workspace-nested`, `already-vendored-workspace`). | Works. |
-| Binary `bun.lockb` (binary format revisions 1, 2 and 3) | Package resolution and integrity records are rewritten in place. The CLI does not spawn Bun or produce a text lock. | Native local-tarball wiring, committed artifact, repair and hosted ⇄ vendored takeover. | Registry package records are inventoried directly, including lockfile-only projects without `node_modules`. |
+| Binary `bun.lockb` (binary format revisions 1, 2 and 3) | Package resolution and integrity records are rewritten in place. The CLI does not spawn Bun or produce a text lock. `rollback` / `remove` cannot restore a hosted `bun.lockb` entry to its upstream registry entry (v5.0 keeps no ledger to replay, and the binary lock is not re-derived), so they refuse it with the `git checkout -- bun.lockb` remedy. | Native local-tarball wiring, committed artifact, repair and vendored → hosted takeover. Hosted → vendored rebuilds a hosted `bun.lockb` pin's npm registry record from the registry (byte-exact for a lock socket-patch wired hosted), then vendors; `vendor --revert` returns the pre-hosted lock. Offline it refuses (`redirect_revert_failed`), leaving it hosted. | Registry package records are inventoried directly, including lockfile-only projects without `node_modules`. |
 | Truncated, corrupt or unrecognized binary `bun.lockb` | Refused with `redirect_bun_lockb_invalid`, preserving the lock. | Refused with `vendor_bun_lockb_invalid` before downloads or artifact creation. | The inventory reports the malformed lock. |
 | `bun.lock` with a `lockfileVersion` ≥ 3, no integer version, or a `packages` section outside bun's single-line grammar | Refused `redirect_bun_lock_unsupported`. | Refused `vendor_lockfile_version_unsupported` (preflight and engine). | The inventory skips the lock. |
 
@@ -65,19 +65,22 @@ code-tagged refusal on stderr; `--dry-run` previews it as the additive
 `would_refuse` action. Agent-mode `get --save-only` is not preflighted.
 
 **Mode conversion.** Hosted → vendored (`scan` / `get --mode vendored`,
-`vendor` over a hosted-redirected `bun.lock`) reverts the hosted line to its
-pristine registry tuple, drops the redirect-ledger record and vendors
-(`vendor_takeover_reverted_redirect`; `vendor --dry-run` PROBES the revert and
-reports `vendor_would_revert_redirect`) — but only after the Bun vendored
+`vendor` over a hosted `bun.lock`) restores the hosted line to its upstream
+registry tuple — re-resolved from the npm registry, since v5.0 keeps no hosted
+ledger — and vendors (`vendor_takeover_reverted_redirect`; `vendor --dry-run`
+resolves the same restore and reports `vendor_would_revert_redirect`) — but only after the Bun vendored
 preflight accepted the lock: on a lock the vendored backend refuses (a
 pre-version-2 `workspace:` lock) `vendor`, the vendor step and the dry run
-report `failed vendor_bun_workspace_unsupported` BEFORE the revert, leaving the
-hosted wiring, the redirect ledger and `bun.lock` byte-untouched (the purl
+report `failed vendor_bun_workspace_unsupported` BEFORE the restore, leaving the
+hosted wiring and `bun.lock` byte-untouched (the purl
 stays hosted-patched). Vendored → hosted reverts the vendored
 wiring, ledger entry and committed artifact first
 (`redirect_takeover_reverted_vendored`). `rollback <purl>` / `remove <purl>`
-unwind one of several hosted bun records; an unscoped `rollback` unwinds
-everything through the whole-ledger replay. Pinned hermetically by
+restore one of several hosted bun packages to its upstream registry tuple; an
+unscoped `rollback` restores every hosted pin the same way (no ledger replay).
+A hosted `bun.lockb` pin is refused by `rollback` / `remove` (`git checkout --
+bun.lockb`); the hosted → vendored takeover rebuilds its registry record and
+vendors (`tests/vendor_eject_bun_lockb.rs`, real Bun in `tests/e2e_bun_lockb.rs`). Pinned hermetically by
 `tests/in_process_vendor_bun_takeover.rs`, against real Bun by
 `tests/mode_migration_bun.rs` (CI: Bun 1.4.2 on three OSes, 1.3.14 on Linux)
 and by the matrix's `hosted-then-vendored` / `vendored-then-hosted` shapes.
@@ -93,10 +96,18 @@ normalized to the equivalent representation accepted by old and new readers;
 the original encoding is retained for rollback. Unknown versions and invalid
 offsets fail closed.
 
-Hosted redirects and vendoring use per-package binary snapshots in their ledgers.
-This allows a scoped rollback or mode switch to restore one package while keeping
-other packages wired. Whole-ledger reverse replay restores the original binary
-bytes when no external re-save occurred. Scoped rollback restores package
+Vendoring uses per-package binary snapshots in its ledger. This allows a scoped
+rollback or mode switch to restore one package while keeping other packages wired.
+Hosted mode (v5.0) keeps no ledger. The hosted → vendored takeover (and the
+eject) rebuild a hosted `bun.lockb` entry as Bun's npm registry record from the
+registry's `dist.tarball` / `dist.integrity`; the hosted rewrite keeps the
+registry record's inactive bytes, so that rebuild is byte-exact. A lock the
+rewrite had to normalize is marked in the root package's resolution value
+bytes (never read for a root resolution): a format-1 lock it promoted is
+demoted back to its exact format-1 bytes (verified by promoting again), and a
+lock whose workspace dependency behaviors it normalized is refused with the
+checkout remedy. `rollback` and `remove` refuse a hosted
+`bun.lockb` entry instead (restore `bun.lockb` from version control). Scoped rollback restores package
 resolutions and may retain equivalent binary normalization; if Bun itself has
 subsequently upgraded the binary schema, rollback preserves that schema and
 restores the original package resolutions.
@@ -275,8 +286,7 @@ runners) from the GitHub releases and verifies it against `SHASUMS256.txt`. Ever
   `["name@<url|path>", {meta}]`, spec and meta intact; 1.3.10, 1.3.14 and
   1.4.2 keep the digest. The CLI recognises that spelling as its own wiring:
   the repeat hosted run heals it (`redirected: 1`, no
-  `redirect_bun_entry_not_found`, a second ledger edit whose `original` is
-  the 2-tuple), the vendored re-run stays `already_vendored` and re-pins the
+  `redirect_bun_entry_not_found`), the vendored re-run stays `already_vendored` and re-pins the
   digest on disk, `repair` rebuilds through it, and `rollback` / scoped
   `rollback` / `remove` / `vendor --revert` / both takeovers accept the
   digest-less spelling of a recorded line and restore the registry original
@@ -374,9 +384,10 @@ asserted: supported → 0; hosted refusals → 0 with `redirect.redirected == 0`
 
 **Every supported case verifies:**
 
-- the ledger record (redirect ledger for hosted, vendor ledger for vendored — no
-  mode writes `.socket/manifest.json`, and every cell asserts its absence) names
-  the expected published patch uuid;
+- the patch uuid (the hosted URL in the lock for hosted — v5.0 writes no hosted
+  ledger — and the vendor ledger record for vendored; no mode writes
+  `.socket/manifest.json`, and every cell asserts its absence) is the expected
+  published patch uuid;
 - a fresh `bun install --frozen-lockfile` and a fresh ordinary `bun install`
   (empty caches, no `node_modules`) install the record's exact `afterHash`
   bytes and leave the lockfile byte-identical;
diff --git a/docs/testing/hosted-production-e2e.md b/docs/testing/hosted-production-e2e.md
index f8af9328..c874d891 100644
--- a/docs/testing/hosted-production-e2e.md
+++ b/docs/testing/hosted-production-e2e.md
@@ -133,7 +133,7 @@ does (the core `fetch_artifact_probe`) and branches on what it sees:
 
 | Probe | Asserted |
 |---|---|
-| `Content-Encoding` other than identity | the clean refusal: `redirect_vlt_artifact_unverifiable` naming the encoding, `vlt-lock.json` byte-identical, no redirect ledger. With `SOCKET_PATCH_VLT_HOSTED_PRODUCTION_REQUIRED=1` the encoded response is itself a failure. |
+| `Content-Encoding` other than identity | the clean refusal: `redirect_vlt_artifact_unverifiable` naming the encoding, `vlt-lock.json` byte-identical (v5 hosted mode writes no ledger either way). With `SOCKET_PATCH_VLT_HOSTED_PRODUCTION_REQUIRED=1` the encoded response is itself a failure. |
 | identity | the full proof: slot [2] is the served sha512, and a fresh checkout's `vlt ci` installs the patched minimist |
 
 So the leg neither breaks nor goes vacuous when the serve fix
diff --git a/docs/testing/pipenv-compatibility.md b/docs/testing/pipenv-compatibility.md
index df7a0144..32145f5f 100644
--- a/docs/testing/pipenv-compatibility.md
+++ b/docs/testing/pipenv-compatibility.md
@@ -17,7 +17,7 @@ requirements.txt lanes of the same ecosystem.
 
 | Input | Hosted | Vendored | Agent |
 |-------|--------|----------|-------|
-| `Pipfile.lock`, `pipfile-spec: 6` (Pipenv 7 and later) | Every category (`default`, `develop`, Pipenv 2022+ named categories) that pins the patched release becomes `{"file" \| "path": "<url>#sha256=<hex>", "hashes": ["sha256:<hex>"]}` with `markers`/`extras` preserved and `version`/`index` dropped. `path` for Pipenv 7–11, `file` from 2018. `_meta` (the Pipfile content hash) and the Pipfile are untouched. | Every matching category refers to the committed wheel under `.socket/vendor/pypi/<uuid>/`; wheels with extras use `path` (Pipenv 2022's file-URL bug). Requires Pipenv 2018 or later (`pypi_pipenv_installer_unsupported`). | Independent of the lock: patches the installed distribution in the project's venv — in-project `.venv`, `VIRTUAL_ENV`, or Pipenv's default `$WORKON_HOME/<dir>-<hash>[-<python>]` (discovered without running Pipenv). |
+| `Pipfile.lock`, `pipfile-spec: 6` (Pipenv 7 and later) | Every category (`default`, `develop`, Pipenv 2022+ named categories) that pins the patched release becomes `{"file" \| "path": "<url>#sha256=<hex>", "hashes": ["sha256:<hex>"]}` with `markers`/`extras`/`index` kept as Pipenv wrote them and `version` dropped. `path` for Pipenv 7–11, `file` from 2018. `_meta` (the Pipfile content hash) and the Pipfile are untouched. | Every matching category refers to the committed wheel under `.socket/vendor/pypi/<uuid>/`; wheels with extras use `path` (Pipenv 2022's file-URL bug). Requires Pipenv 2018 or later (`pypi_pipenv_installer_unsupported`). | Independent of the lock: patches the installed distribution in the project's venv — in-project `.venv`, `VIRTUAL_ENV`, or Pipenv's default `$WORKON_HOME/<dir>-<hash>[-<python>]` (discovered without running Pipenv). |
 | `Pipfile.lock`, `pipfile-spec` < 6 (Pipenv 0–6) | Refused (`redirect_pipenv_skipped`), lock untouched. | Refused (`pypi_pipenv_spec_unsupported`). | Works. |
 | Lock-only checkout (nothing installed) | Discovered from the lock and redirected. | Discovered from the lock; the pristine wheel is fetched by one of the lock's recorded digests (Pipenv records every release file's sha256 without filenames) through PyPI's JSON API, verified against the same digest, and the patched wheel comes from the service. | Nothing to patch (no installed distribution); the lock's pins are listed as lockfile-only packages. |
 
diff --git a/docs/testing/vlt-compatibility.md b/docs/testing/vlt-compatibility.md
index 7129edf7..3129c0d3 100644
--- a/docs/testing/vlt-compatibility.md
+++ b/docs/testing/vlt-compatibility.md
@@ -20,6 +20,14 @@ vlt project, and the caveats users meet, are in
 | E | 1.0.8 … 1.1.1 | `1` | as C, `peer.<16 hex>` | the registry URL |
 | F | 1.2.0 | `1` | as E; the global store (`store-linker`) | the registry URL |
 
+On every release that writes slot [3], it is omitted when the project
+configures `registry` and the node's tarball URL starts with it (vlt's
+`lockfile/save.ts`; the lock then records `options.registry`): with
+`config.registry` and `registries.npm` both set to the default registry,
+1.0.0-rc.33, 1.0.4, 1.0.10 and 1.2.0 all write a byte-identical 3-tuple lock
+(fixture `capture-1.2.0-config-registry`). The upstream restore follows the
+same rule.
+
 Hosted mode writes the patched sha512 into slot [2] and the hosted URL into
 slot [3] of every default-registry node (appending slot [3] to a 3-tuple);
 vendored mode turns the node into a `file` node for the D19 directory
diff --git a/scripts/backtest-bun.py b/scripts/backtest-bun.py
index 80de166f..d5ddb883 100644
--- a/scripts/backtest-bun.py
+++ b/scripts/backtest-bun.py
@@ -53,17 +53,24 @@
 Manifest-less VEX (every supported cell, after the installs): a fresh checkout
 of the committed state with .socket/manifest.json deleted and a real frozen
 `bun install` must be attested by standalone `vex` against the public patch
-API — the patched purl under the ledger record's uuid with the `(redirected)` /
-`(vendored)` marker and exactly the record's vulnerability ids (+ CVE aliases),
-also through the embedded `apply --vex`; with both ledgers deleted too
-(lockfile discovery + the API); `--offline` with no ledgers must omit it as
-`record_unavailable` (exit 1); and with the lock put back to the registry
-version (ledgers, artifacts and the patched install kept) it must NOT be
-attested, also under `--no-verify` (`redirect_unwired` / `vendor_unwired`).
+API — the patched purl under the record's uuid (vendored: the vendor
+ledger's record; hosted: v5 writes NO redirect ledger, so the public API's
+`/patch/view/<uuid>` record) with the `(redirected)` / `(vendored)` marker and
+exactly the record's vulnerability ids (+ CVE aliases), also through the
+embedded `apply --vex`; with the vendor ledger deleted too (lockfile discovery
++ the API); `--offline` with no ledger must omit it as `record_unavailable`
+(exit 1); and with the lock put back to the registry version (vendor ledger,
+artifacts and the patched install kept) it must NOT be attested, also under
+`--no-verify` (`vendor_unwired`; hosted: nothing names the patch any more —
+`manifest_not_found`, exit 2).
 
 Every cell records the CLI exit codes (main, repeat, rollback, conversion),
 the exact refusal-code set, the repeat-run envelope semantics, digest
 enforcement, and after rollback the lockfile presence rules and byte identity.
+A hosted rollback restores the DEFAULT upstream registry entry re-resolved
+from the npm registry (a custom-registry slot comes back as bun's default
+`""`); a hosted bun.lockb is binary, so its rollback refuses with the
+`git checkout -- bun.lockb` remedy and the cell applies that remedy.
 
 Provenance: `--cli-revision` is the branch-resolvable commit the row is about
 (PR head, or the pushed commit); `--cli-build-sha` (or the CLI_BUILD_SHA
@@ -227,6 +234,8 @@ class DownloadError(RuntimeError):
     """A release asset arrived but failed verification (truncated / tampered)."""
 
 
+USER_AGENT = 'SocketPatchCLI-backtest/1.0'
+
 RETRYABLE = (urllib.error.URLError, TimeoutError, ConnectionError, http.client.HTTPException)
 
 
@@ -235,7 +244,8 @@ def fetch(url, dest, attempts=5):
     stalls retry; any other HTTP error is final."""
     for attempt in range(1, attempts + 1):
         try:
-            with urllib.request.urlopen(url, timeout=60) as response, open(dest, 'wb') as out:
+            request = urllib.request.Request(url, headers={'User-Agent': USER_AGENT})
+            with urllib.request.urlopen(request, timeout=60) as response, open(dest, 'wb') as out:
                 shutil.copyfileobj(response, out)
             return
         except RETRYABLE as error:
@@ -558,18 +568,47 @@ def rerun_clean(code, envelope, mode):
             and not set(codes) - INFORMATIONAL - {'already_vendored'})
 
 
+PUBLIC_PATCH_API = 'https://patches-api.socket.dev'
+_PUBLISHED_RECORDS = {}
+
+
+def published_record(uuid):
+    """The public proxy's `/patch/view/<uuid>` record (cached per run)."""
+    if uuid not in _PUBLISHED_RECORDS:
+        url = f'{PUBLIC_PATCH_API}/patch/view/{uuid}'
+        for attempt in range(1, 6):
+            try:
+                request = urllib.request.Request(url, headers={'Accept': 'application/json', 'User-Agent': USER_AGENT})
+                with urllib.request.urlopen(request, timeout=60) as response:
+                    _PUBLISHED_RECORDS[uuid] = json.loads(response.read().decode('utf-8'))
+                break
+            except RETRYABLE:
+                if attempt == 5:
+                    raise
+                time.sleep(10 * attempt)
+    return _PUBLISHED_RECORDS[uuid]
+
+
+def hosted_wired(project):
+    """Whether a bun lock of `project` pins the hosted patch UUID."""
+    return any(UUID.encode() in (project / name).read_bytes()
+               for name in ('bun.lock', 'bun.lockb') if (project / name).is_file())
+
+
 def ledger_record(project, mode):
-    """The patch record the mode's ledger holds for PURL (None when absent).
+    """The patch record for PURL the mode's state carries (None when absent).
 
-    Both ledgers embed the record — hosted under `records`, vendored under the
-    entry's `record`; vendored mode never writes `.socket/manifest.json`."""
-    path = project / ('.socket/vendor/redirect-state.json' if mode == 'hosted'
-                      else '.socket/vendor/state.json')
+    Vendored: the vendor ledger's entry `record` (vendored mode never writes
+    `.socket/manifest.json`). Hosted: v5 writes no ledger — the lock pin is
+    the state — so the record is the public API's for the pinned uuid."""
+    if mode == 'hosted':
+        if (project / '.socket/vendor/redirect-state.json').exists():
+            raise RuntimeError('hosted mode wrote the pre-v5 redirect ledger')
+        return published_record(UUID) if hosted_wired(project) else None
+    path = project / '.socket/vendor/state.json'
     if not path.is_file():
         return None
     state = json.loads(path.read_text(encoding='utf-8'))
-    if mode == 'hosted':
-        return state.get('records', {}).get(PURL)
     return state.get('entries', {}).get(PURL, {}).get('record')
 
 
@@ -577,18 +616,33 @@ def load_json(path):
     return json.loads(path.read_text(encoding='utf-8')) if path.is_file() else None
 
 
-def wired_fragments(project, mode):
-    """The {original, new} bun.lock line pair the mode's ledger recorded for
-    PURL: the hosted ledger's `redirect_bun_lock_package` edit, or the
-    vendored ledger's `bun_lock_package` wiring."""
+def wired_fragments(project, mode, before=None, after=None):
+    """The {original, new} bun.lock line pair for PURL: the vendored ledger's
+    `bun_lock_package` wiring, or — hosted, which keeps no ledger in v5 — the
+    text-lock line pinning the hosted UUID in `after` (the lock the CLI wrote)
+    and the line with the same key in `before` (the registry lock)."""
     if mode == 'hosted':
-        edits = load_json(project / '.socket/vendor/redirect-state.json')['edits']
-        return next(e for e in edits if e['path'] in ('bun.lock', 'bun.lockb') and
-                    e['kind'] in ('redirect_bun_lock_package', 'redirect_bun_lockb_package'))
+        new = next(line for line in after.decode('utf-8').split('\n') if UUID in line)
+        key = new[:new.index(': [') + 3]
+        original = next(line for line in before.decode('utf-8').split('\n') if line.startswith(key))
+        return {'original': original.rstrip('\r'), 'new': new.rstrip('\r')}
     wiring = load_json(project / '.socket/vendor/state.json')['entries'][PURL]['wiring']
     return next(w for w in wiring if w['file'] in ('bun.lock', 'bun.lockb'))
 
 
+def hosted_lockb_digest(lockb):
+    """The raw sha512 the hosted bun.lockb pins for the patched tarball: the
+    digest of the hosted artifact its URL names (downloaded — the binary lock
+    stores the integrity as raw bytes, and v5 keeps no ledger to read it from)."""
+    match = re.search(rb'https://patch\.socket\.dev/[\x21-\x7e]+?\.tgz', lockb)
+    if match is None:
+        raise RuntimeError('the hosted bun.lockb names no patch.socket.dev tarball')
+    url = match.group(0).decode('ascii')
+    request = urllib.request.Request(url, headers={'User-Agent': USER_AGENT})
+    with urllib.request.urlopen(request, timeout=60) as response:
+        return hashlib.sha512(response.read()).digest()
+
+
 def wired_line(text, recorded_new):
     """The live bun.lock line carrying the recorded wiring `recorded_new`:
     byte-identical, or the digest-less 2-tuple Bun < 1.3.10 re-saves it as
@@ -800,12 +854,16 @@ def install(binary, label, flags=(), cache=None):
                 # bun writes "" for its default registry, so `.npmrc` alone never
                 # fills the slot: inject the full-URL form bun emits for any other
                 # registry and prove bun installs from it before the CLI runs.
-                text = lock.read_text(encoding='utf-8')
+                # Bytes, not text mode: Windows text I/O would turn the lock's LF
+                # into CRLF, and the restore (which keeps the lock's line endings)
+                # would then never match the LF pre-injection bytes.
+                pre_injection = lock.read_bytes()
+                text = pre_injection.decode('utf-8')
                 injected = text.replace('["minimist@1.2.2", ""', f'["minimist@1.2.2", "{REGISTRY_SLOT}"')
                 checks['registrySlotInjected'] = injected != text
-                lock.write_text(injected, encoding='utf-8')
+                lock.write_bytes(injected.encode('utf-8'))
                 code, _ = install(bun, 'registry-accepted', ['--frozen-lockfile'])
-                checks['registrySlotAccepted'] = code == 0 and lock.read_text(encoding='utf-8') == injected
+                checks['registrySlotAccepted'] = code == 0 and lock.read_bytes() == injected.encode('utf-8')
             original = {name: (project / name).read_bytes()
                         for name in [*files, 'bun.lock', 'bun.lockb'] if (project / name).exists()}
             row['originalSha256'] = {n: sha256(b) for n, b in original.items()}
@@ -848,7 +906,9 @@ def install(binary, label, flags=(), cache=None):
 
             if shape in CONVERSION_SHAPES:
                 # First mode (or the first vendoring): must land and install.
+                before_conversion = lock.read_bytes()
                 code, output = run(cli_command(['scan'], pre_mode), project, env, case / 'conversion.log', False)
+                after_conversion = lock.read_bytes()
                 exit_codes['conversion'] = code
                 pre_envelope = parse_envelope(output)
                 save(case / 'conversion-output.json', pre_envelope)
@@ -868,7 +928,7 @@ def install(binary, label, flags=(), cache=None):
                     code, _ = install(bun, 'member', cache='cache')
                     text = lock.read_text(encoding='utf-8')
                     checks['memberInstall'] = code == 0 and 'workspace:packages/consumer' in text
-                    wiring = wired_fragments(project, pre_mode)
+                    wiring = wired_fragments(project, pre_mode, before_conversion, after_conversion)
                     # Bun < 1.3.10 re-saves URL/local tarball tuples WITHOUT
                     # their sha512 (the 2-tuple `["name@<spec>", {meta}]`);
                     # 1.3.10+ keep the 3-tuple. Either spelling is the CLI's
@@ -935,12 +995,13 @@ def install(binary, label, flags=(), cache=None):
                         raise RuntimeError(f'Expected one applied patch: {output[-4000:]}')
                 record = ledger_record(project, main_mode)
                 if record is None:
-                    raise RuntimeError(f'No ledger record for {PURL} in {main_mode} mode')
+                    raise RuntimeError(f'No patch record for {PURL} in {main_mode} mode')
                 row['patchUuid'] = record['uuid']
                 checks['publishedPatch'] = record['uuid'] == UUID
-                # Neither ledger-backed mode writes .socket/manifest.json: vendored
-                # is manifest-free and hosted persists only the redirect ledger.
+                # Neither mode writes .socket/manifest.json: vendored is
+                # manifest-free and hosted (v5) persists only the lock pin.
                 checks['noManifest'] = not manifest.exists()
+                checks['noRedirectLedger'] = not (project / '.socket/vendor/redirect-state.json').exists()
                 patched_lock = lock.read_bytes()
                 lockb_origin = lock.name == 'bun.lockb'
                 lock_text = patched_lock.decode('utf-8', errors='replace')
@@ -948,9 +1009,10 @@ def install(binary, label, flags=(), cache=None):
                     checks['takeoverReported'] = 'vendor_takeover_reverted_redirect' in codes
                     checks['localPathTuple'] = (f'.socket/vendor/npm/{UUID}/minimist-1.2.2.tgz'
                                                 if lockb_origin else LOCAL_TUPLE_SPEC) in lock_text
-                    redirect_ledger = load_json(project / '.socket/vendor/redirect-state.json')
-                    checks['redirectLedgerRecordGone'] = (redirect_ledger is None
-                                                          or PURL not in redirect_ledger.get('records', {}))
+                    # The takeover restored the upstream registry entry before
+                    # vendoring, so no hosted URL is left and the vendor
+                    # ledger's recorded original is the registry line.
+                    checks['hostedPinGone'] = 'patch.socket.dev' not in lock_text
                     original_wiring = wired_fragments(project, main_mode)['original']
                     if lockb_origin:
                         checks['vendorLedgerOriginalPristine'] = (
@@ -978,9 +1040,10 @@ def install(binary, label, flags=(), cache=None):
                     checks['lockEolPreserved'] = crlf_only(patched_lock)
                 if lockb_origin:
                     checks['nativeBinaryPreserved'] = (project / 'bun.lockb').is_file() and not (project / 'bun.lock').exists()
-                    wiring = wired_fragments(project, main_mode)
-                    checks['binaryPackageSnapshot'] = (isinstance(wiring.get('original'), dict) and
-                                                       isinstance(wiring.get('new'), dict))
+                    if main_mode != 'hosted':
+                        wiring = wired_fragments(project, main_mode)
+                        checks['binaryPackageSnapshot'] = (isinstance(wiring.get('original'), dict) and
+                                                           isinstance(wiring.get('new'), dict))
                 capture = case / 'tree'
                 if capture.exists():
                     shutil.rmtree(capture)
@@ -1060,7 +1123,8 @@ def vex(label, *extra, via='vex'):
                 checks['vexApplyEmbedded'] = (code == 0 and envelope.get('status') == 'noManifest'
                                               and vex_attested(doc, PURL, record['uuid'], marker, vulns))
                 saved_ledgers = {rel: (checkout / rel).read_bytes() for rel in LEDGERS if (checkout / rel).is_file()}
-                checks['vexLedgerPresent'] = bool(saved_ledgers)
+                # Vendored commits its vendor ledger; hosted (v5) none at all.
+                checks['vexLedgerPresent'] = bool(saved_ledgers) == (main_mode != 'hosted')
                 for rel in saved_ledgers:
                     (checkout / rel).unlink()
                 code, _, doc = vex('ledgersDeleted')
@@ -1071,12 +1135,14 @@ def vex(label, *extra, via='vex'):
                 for rel, data in saved_ledgers.items():
                     (checkout / rel).write_bytes(data)
                 (checkout / lock.name).write_bytes(original[lock.name])
-                unwired = 'redirect_unwired' if main_mode == 'hosted' else 'vendor_unwired'
                 for label, extra in (('reverted', []), ('revertedNoVerify', ['--no-verify'])):
                     code, envelope, doc = vex(label, *extra)
-                    checks['vex' + label[0].upper() + label[1:]] = (
-                        code == 1 and vex_skip_reason(envelope, PURL) == unwired
-                        and not vex_statements(doc, PURL))
+                    if main_mode == 'hosted':
+                        # No ledger and no wiring: nothing names the patch.
+                        dead = (code == 2 and (envelope.get('error') or {}).get('code') == 'manifest_not_found')
+                    else:
+                        dead = code == 1 and vex_skip_reason(envelope, PURL) == 'vendor_unwired'
+                    checks['vex' + label[0].upper() + label[1:]] = dead and not vex_statements(doc, PURL)
                 shutil.rmtree(checkout, ignore_errors=True)
                 code, repeat = run(command, project, env, case / 'repeat.log', False)
                 exit_codes['repeat'] = code
@@ -1118,8 +1184,11 @@ def vex(label, *extra, via='vex'):
                     checks['repairFrozenPatchedBytes'] = code == 0 and oracle(project, record, 'after')[0]
                     checks['repairStableLock'] = lock.read_bytes() == patched_lock
                 if lockb_origin:
-                    digest = wired_fragments(project, main_mode)['new']['integrity']
-                    raw_digest = base64.b64decode(digest.removeprefix('sha512-'))
+                    if main_mode == 'hosted':
+                        raw_digest = hosted_lockb_digest(patched_lock)
+                    else:
+                        digest = wired_fragments(project, main_mode)['new']['integrity']
+                        raw_digest = base64.b64decode(digest.removeprefix('sha512-'))
                     tampered = patched_lock.replace(raw_digest, bytes(len(raw_digest)))
                 else:
                     tampered = tamper_digests(patched_lock, UUID.encode())
@@ -1153,10 +1222,27 @@ def vex(label, *extra, via='vex'):
                 rolled = parse_envelope(output)
                 rollback_codes = [w.get('code') for w in rolled.get('warnings', [])]
                 row['rollbackWarnings'] = rollback_codes
-                checks['rollbackSucceeded'] = code == 0 and rolled.get('status') == 'success'
+                expected_files = dict(original)
+                if main_mode == 'hosted' and lockb_origin:
+                    # bun.lockb is binary: the v5 upstream restore refuses it
+                    # with the version-control remedy and writes nothing; the
+                    # cell then applies that remedy.
+                    failed = (rolled.get('hosted') or {}).get('failed') or []
+                    checks['rollbackLockbRefused'] = (
+                        code == 1 and any(f.get('purl') == PURL and
+                                          'git checkout -- bun.lockb' in (f.get('error') or '')
+                                          for f in failed)
+                        and lock.read_bytes() == patched_lock)
+                    lock.write_bytes(original['bun.lockb'])
+                else:
+                    checks['rollbackSucceeded'] = code == 0 and rolled.get('status') == 'success'
+                    if main_mode == 'hosted' and shape == 'custom-registry':
+                        # The upstream restore writes the DEFAULT registry entry:
+                        # bun's "" slot, i.e. the lock before the slot injection.
+                        expected_files['bun.lock'] = pre_injection
                 checks['rollbackOriginalFiles'] = all(
                     (project / n).exists() and (project / n).read_bytes() == b
-                    for n, b in original.items() if not (binary_schema_upgraded and n == 'bun.lockb'))
+                    for n, b in expected_files.items() if not (binary_schema_upgraded and n == 'bun.lockb'))
                 if binary_schema_upgraded:
                     _, restored_dump = run([bun, lock.name], project, env,
                                            case / 'rollback-binary-dump.log')
diff --git a/scripts/backtest-pdm.py b/scripts/backtest-pdm.py
index 4612cb20..c2fda379 100644
--- a/scripts/backtest-pdm.py
+++ b/scripts/backtest-pdm.py
@@ -57,6 +57,8 @@
 import threading
 import time
 import traceback
+import urllib.error
+import urllib.request
 from datetime import datetime, timezone
 from pathlib import Path
 
@@ -756,15 +758,44 @@ def refusal_codes(mode, envelope):
             return sorted({e.get("errorCode") for e in envelope.get("vendor", {}).get("events", []) if e.get("errorCode")})
         return sorted({p.get("errorCode") for p in envelope.get("apply", {}).get("patches", []) if p.get("errorCode")})
 
+    def hosted_uuid(text):
+        """The patch uuid of the first patch.socket.dev URL in `text` (the
+        LAST uuid-shaped path segment: an earlier one may be a grant token)."""
+        m = re.search(r"https://patch\.socket\.dev/[^\s\"'#]+", text)
+        if not m:
+            return None
+        uuids = re.findall(r"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}", m[0])
+        return uuids[-1] if uuids else None
+
+    def published_record(uuid):
+        """`GET https://patches-api.socket.dev/patch/view/<uuid>` (the public proxy)."""
+        url = f"https://patches-api.socket.dev/patch/view/{uuid}"
+        for attempt in range(1, 6):
+            try:
+                req = urllib.request.Request(url, headers={"Accept": "application/json", "User-Agent": "SocketPatchCLI-backtest/1.0"})
+                with urllib.request.urlopen(req, timeout=60) as resp:
+                    return json.loads(resp.read().decode("utf-8"))
+            except (urllib.error.URLError, TimeoutError, ConnectionError):
+                if attempt == 5:
+                    raise
+                time.sleep(10 * attempt)
+
     def record_hashes(project, mode):
-        """The first patch record the mode's store holds: the redirect ledger's
-        `records` (hosted), the vendor ledger entry's embedded `record`
-        (vendored — vendored mode never writes `.socket/manifest.json`), or the
-        manifest's `patches` (agent)."""
-        ledger = project / {"hosted": ".socket/vendor/redirect-state.json", "vendored": ".socket/vendor/state.json"}.get(mode, ".socket/manifest.json")
-        if not ledger.exists():
-            return {}, {}, None
-        data = json.loads(ledger.read_text(encoding="utf-8"))
+        """The first patch record the mode's store holds: hosted (v5 keeps no
+        ledger) the public API's record for the uuid the lock pins, the vendor
+        ledger entry's embedded `record` (vendored — vendored mode never
+        writes `.socket/manifest.json`), or the manifest's `patches` (agent)."""
+        if mode == "hosted":
+            texts = [p.read_text(encoding="utf-8") for p in (project / "pdm.lock", project / "pyproject.toml") if p.exists()]
+            uuid = next((u for u in map(hosted_uuid, texts) if u), None)
+            if uuid is None:
+                return {}, {}, None
+            data = {"records": {PURL_BASE: published_record(uuid)}}
+        else:
+            ledger = project / {"vendored": ".socket/vendor/state.json"}.get(mode, ".socket/manifest.json")
+            if not ledger.exists():
+                return {}, {}, None
+            data = json.loads(ledger.read_text(encoding="utf-8"))
         if mode == "hosted":
             recs = data.get("records") or {}
         elif mode == "vendored":
@@ -783,8 +814,8 @@ def record_hashes(project, mode):
 
     def ledger_cleared(project, mode):
         if mode == "hosted":
-            p = project / ".socket/vendor/redirect-state.json"
-            return not p.exists() or not json.loads(p.read_text(encoding="utf-8")).get("records")
+            # v5 hosted mode never writes the redirect ledger at all.
+            return not (project / ".socket/vendor/redirect-state.json").exists()
         if mode == "vendored":
             # Vendored mode is manifest-free: the ledger is the only store.
             st = project / ".socket/vendor/state.json"
@@ -822,28 +853,31 @@ def manifestless_vex(check, info, version, case, project, lockname, pristine_loc
         standalone `vex` (public patch API, no token) must:
 
           vexManifestDeleted  attest PURL_BASE via `uuid` with the mode's
-                              `(redirected)` / `(vendored)` marker (ledgers kept)
+                              `(redirected)` / `(vendored)` marker (vendor
+                              ledger kept; hosted keeps none in v5)
           vexLedgersDeleted   still attest with both ledgers deleted (lockfile
                               discovery + the patch API record)
           vexOfflineUnavailable  `--offline`, no ledger: exit 1, omitted
                               `record_unavailable`
-          vexRevertedUnwired  lock restored to the registry, ledgers +
-                              artifacts kept: exit 1, omitted
-                              `redirect_unwired` / `vendor_unwired`, with and
-                              without `--no-verify`
+          vexRevertedUnwired  lock restored to the registry, vendor ledger +
+                              artifacts kept: exit 1, omitted `vendor_unwired`
+                              (hosted: nothing names the patch any more —
+                              exit 2 `manifest_not_found`), with and without
+                              `--no-verify`
           vexApplyEmbedded    `apply --vex` on the manifest-less checkout
                               attests too
 
         (Refused lock formats get `vexRefusedAttestsNothing` instead.)
         """
         marker = "(redirected)" if mode == "hosted" else "(vendored)"
-        unwired = "redirect_unwired" if mode == "hosted" else "vendor_unwired"
+        unwired = "vendor_unwired"
         vdir = case / "vex-checkout"
         shutil.rmtree(vdir, ignore_errors=True)
         vdir.mkdir()
         for name in ("pyproject.toml", lockname):
             shutil.copyfile(project / name, vdir / name)
-        shutil.copytree(project / ".socket", vdir / ".socket")
+        if (project / ".socket").is_dir():
+            shutil.copytree(project / ".socket", vdir / ".socket")
         (vdir / ".socket/manifest.json").unlink(missing_ok=True)
         ledgers = [vdir / ".socket/vendor/state.json", vdir / ".socket/vendor/redirect-state.json"]
         saved = {p: p.read_bytes() for p in ledgers if p.exists()}
@@ -900,9 +934,13 @@ def omitted(env, reason):
         reverted = {}
         for flags in ((), ("--no-verify",), ("--offline", "--no-verify")):
             r, env_, doc = vex("vex-reverted%s.log" % "".join(flags).replace("--", "-"), *flags)
-            reverted[" ".join(flags) or "default"] = {"exit": r.rc, "omitted": omitted(env_, unwired), "attested": attested(doc)}
+            if mode == "hosted":
+                dead = r.rc == 2 and (env_.get("error") or {}).get("code") == "manifest_not_found"
+            else:
+                dead = r.rc == 1 and omitted(env_, unwired)
+            reverted[" ".join(flags) or "default"] = {"exit": r.rc, "dead": dead, "attested": attested(doc)}
         notes["reverted"] = reverted
-        check("vexRevertedUnwired", bool(saved) and all(v["exit"] == 1 and v["omitted"] and not v["attested"] for v in reverted.values()), reverted)
+        check("vexRevertedUnwired", bool(saved) == (mode != "hosted") and all(v["dead"] and not v["attested"] for v in reverted.values()), reverted)
         if not args.keep_environments:
             for path in (vvenv, vhome, vcache):
                 shutil.rmtree(path, ignore_errors=True)
@@ -1164,6 +1202,9 @@ def uninstall(log):
         after, before, uuid = record_hashes(project, mode)
         info["uuid"] = uuid
         check("recordHasFiles", bool(after))
+        if mode == "hosted":
+            # v5: the lock pin is the whole hosted state — no ledger, ever.
+            check("noLedger", not (project / ".socket/vendor/redirect-state.json").exists())
         if mode == "vendored":
             wheel_dir = project / ".socket/vendor/pypi" / (uuid or "")
             check("vendoredWheelPresent", wheel_dir.is_dir() and any(wheel_dir.glob("*.whl")))
@@ -1232,6 +1273,8 @@ def uninstall(log):
             check("reinstallOk", ok, r.tail(300))
         # relock -> re-scan -> rollback (must restore the relocked bytes)
         saved = case / "saved-socket"
+        # v5 hosted mode may leave no `.socket/` at all.
+        (project / ".socket").mkdir(exist_ok=True)
         shutil.copytree(project / ".socket", saved)
         if excluded:
             # The marker kept PDM from installing urllib3, so put the upstream
diff --git a/scripts/backtest-pipenv.py b/scripts/backtest-pipenv.py
index 610a67fe..1131de80 100755
--- a/scripts/backtest-pipenv.py
+++ b/scripts/backtest-pipenv.py
@@ -51,6 +51,8 @@
 import threading
 import time
 import traceback
+import urllib.error
+import urllib.request
 import uuid as uuid_mod
 from datetime import datetime, timezone
 from pathlib import Path
@@ -238,6 +240,38 @@ def vex_attests(rc, doc, purl_base, uuid, marker):
     )
 
 
+def hosted_uuid(text):
+    """The patch uuid of the first patch.socket.dev URL in `text` (the LAST
+    uuid-shaped path segment: an earlier one may be a grant token)."""
+    m = re.search(r"https://patch\.socket\.dev/[^\s\"'#]+", text)
+    if not m:
+        return None
+    uuids = re.findall(r"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}", m[0])
+    return uuids[-1] if uuids else None
+
+
+def published_record(uuid):
+    """`GET https://patches-api.socket.dev/patch/view/<uuid>` (the public proxy):
+    v5 hosted mode keeps no ledger, so this is the record a hosted pin names."""
+    url = f"https://patches-api.socket.dev/patch/view/{uuid}"
+    for attempt in range(1, 6):
+        try:
+            req = urllib.request.Request(url, headers={"Accept": "application/json", "User-Agent": "SocketPatchCLI-backtest/1.0"})
+            with urllib.request.urlopen(req, timeout=60) as resp:
+                return json.loads(resp.read().decode("utf-8"))
+        except (urllib.error.URLError, TimeoutError, ConnectionError):
+            if attempt == 5:
+                raise
+            time.sleep(10 * attempt)
+
+
+def vex_nothing_named(rc, envelope, doc, purl_base):
+    """A standalone `vex --json` run over a checkout that names the patch
+    nowhere (no manifest, no ledger, no wiring): `manifest_not_found`, exit 2."""
+    return (rc == 2 and not vex_statements_for(doc, purl_base)
+            and ((envelope or {}).get("error") or {}).get("code") == "manifest_not_found")
+
+
 def vex_omits(rc, envelope, doc, purl_base, reason):
     """A standalone `vex --json` run did NOT attest `purl_base` and reported
     it skipped with `reason` (exit 1: nothing else to attest)."""
@@ -608,7 +642,11 @@ def envelope_warnings(mode, envelope):
 
     def record_hashes(project, mode):
         if mode == "hosted":
-            recs = json.loads((project / ".socket/vendor/redirect-state.json").read_text())["records"]
+            # v5 hosted mode keeps no ledger: the lock pin names the uuid.
+            uuid = hosted_uuid((project / "Pipfile.lock").read_text())
+            if uuid is None:
+                raise RuntimeError("the hosted Pipfile.lock pins no patch.socket.dev uuid")
+            recs = {PURL_BASE: published_record(uuid)}
         elif mode == "vendored":
             # Vendored mode never writes `.socket/manifest.json`: the ledger
             # entry embeds the patch record.
@@ -970,13 +1008,16 @@ def cli_run(penv_, *rest, log):
         if mode == "hosted":
             expected_key = "path" if 7 <= major < 2018 else "file"
             check("lockHasPatchUrl", b"patch.socket.dev" in lock_after and b"#sha256=" in lock_after)
+            check("noLedger", not (project / ".socket/vendor/redirect-state.json").exists())
         else:
             has_extras = any(isinstance(e, dict) and e.get("extras") for _, _, e in lock_entries(pristine_lock.decode()))
             expected_key = "path" if has_extras else "file"
             check("lockHasVendoredRef", b".socket/vendor/pypi" in lock_after)
         check("expectedSourceKey", keys == [expected_key], {"expected": expected_key, "got": keys})
         pristine_entries = {(s, k): e for s, k, e in lock_entries(pristine_lock.decode())}
-        check("allCategoriesRewritten", entries and all(("file" in e or "path" in e) and "version" not in e and "index" not in e for _, _, e in entries) and {(s, k) for s, k, _ in entries} == set(pristine_entries), {"pristine": sorted(pristine_entries), "rewritten": sorted((s, k) for s, k, _ in entries)})
+        # Hosted keeps Pipenv's own `index` (rollback carries it back; nothing
+        # else can re-derive it); vendored drops it.
+        check("allCategoriesRewritten", entries and all(("file" in e or "path" in e) and "version" not in e and (e.get("index") == pristine_entries.get((s, k), {}).get("index") if mode == "hosted" else "index" not in e) for s, k, e in entries) and {(s, k) for s, k, _ in entries} == set(pristine_entries), {"pristine": sorted(pristine_entries), "rewritten": sorted((s, k) for s, k, _ in entries)})
         check("markersExtrasPreserved", all(e.get("markers") == pristine_entries.get((s, k), {}).get("markers") and e.get("extras") == pristine_entries.get((s, k), {}).get("extras") for s, k, e in entries))
         after, before, uuid = record_hashes(project, mode)
         info["uuid"] = uuid
@@ -1073,10 +1114,11 @@ def cli_run(penv_, *rest, log):
         marker = b"patch.socket.dev" if mode == "hosted" else b".socket/vendor/pypi"
         info["relock"] = {"exit": rl.rc, "lockBytesUnchanged": relocked == lock_after, "patchSourceKept": marker in relocked, "pipfileUnchanged": (project / "Pipfile").read_bytes() == pristine_pipfile, "tail": rl.tail(300) if not rl.ok() else None}
         # A relock regenerated the entry: `rollback` must retire the redirect
-        # cleanly (exit 0, ledger cleared) instead of refusing forever — judged
-        # in a copy so the main flow keeps its state. Two relock outcomes exist:
-        # registry shape (the reference is gone; the relocked lock is the desired
-        # end state and must be kept) and the Pipenv 2023+ hybrid of a
+        # cleanly instead of refusing forever — judged in a copy so the main
+        # flow keeps its state. Two relock outcomes exist: registry shape (the
+        # reference is gone; the relocked lock is the desired end state and
+        # must be kept — hosted keeps no ledger in v5, so there is nothing
+        # left to roll back at all) and the Pipenv 2023+ hybrid of a
         # marker-excluded entry (our reference kept, upstream hashes + version
         # restored around it); that entry is still ours and must roll back to
         # the original registry entry, leaving no Socket reference behind.
@@ -1095,19 +1137,25 @@ def cli_run(penv_, *rest, log):
                 lock_ok = marker not in post and urllib3_entries(post) == urllib3_entries(pristine_lock)
             else:
                 lock_ok = post == relocked
-            check("rollbackAfterRelockRetires", rrb.ok() and cleared and lock_ok, {"exit": rrb.rc, "cleared": cleared, "hybridRelock": hybrid, "lockKeptRelocked": post == relocked, "lockRestoredOriginal": post == pristine_lock, "referenceLeft": marker in post, "envelope": {k: erb2.get(k) for k in ("status", "hosted", "vendoredReverted", "failed") if k in erb2}, "tail": rrb.tail(400) if not rrb.ok() else None})
+            if mode == "hosted" and not hybrid:
+                # No pin, no ledger, no manifest: nothing to roll back.
+                retired = rrb.rc == 1 and erb2.get("error") == "Manifest not found"
+            else:
+                retired = rrb.ok()
+            check("rollbackAfterRelockRetires", retired and cleared and lock_ok, {"exit": rrb.rc, "cleared": cleared, "hybridRelock": hybrid, "lockKeptRelocked": post == relocked, "lockRestoredOriginal": post == pristine_lock, "referenceLeft": marker in post, "envelope": {k: erb2.get(k) for k in ("status", "hosted", "vendoredReverted", "failed") if k in erb2}, "tail": rrb.tail(400) if not rrb.ok() else None})
         (project / "Pipfile.lock").write_bytes(lock_after)
         (project / "Pipfile").write_bytes(pristine_pipfile)
 
-        # Rollback restores every byte and clears the ledgers.
+        # Rollback restores every byte (hosted: the upstream PyPI entry,
+        # re-resolved from the registry) and clears the ledgers.
         rb = cli_run(penv, "rollback", log="rollback.log")
         erb = rb.json_or_empty()
         check("rollbackExit0", rb.ok(), rb.tail(600) if not rb.ok() else None)
         check("rollbackRestoresLockBytes", (project / "Pipfile.lock").read_bytes() == pristine_lock)
         check("rollbackKeepsPipfile", (project / "Pipfile").read_bytes() == pristine_pipfile)
         if mode == "hosted":
-            ledger = project / ".socket/vendor/redirect-state.json"
-            check("rollbackClearsRedirectLedger", not ledger.exists() or not json.loads(ledger.read_text()).get("records"))
+            check("rollbackNoRedirectLedger", not (project / ".socket/vendor/redirect-state.json").exists())
+            check("rollbackRestoredUpstream", PURL_BASE in ((erb.get("hosted") or {}).get("reverted") or []), erb.get("hosted"))
         if mode == "vendored":
             check("rollbackRemovesVendoredWheel", not (project / ".socket/vendor/pypi" / (uuid or "x")).exists())
             state = project / ".socket/vendor/state.json"
@@ -1129,13 +1177,14 @@ def cli_run(penv_, *rest, log):
 
     def manifestless_vex(case, fresh, penv, mode, uuid, pristine_lock, pristine_pipfile):
         """Manifest-less VEX over the installed fresh clone, each step on its
-        own copy: the manifest deleted (ledgers kept) attests; the ledgers
-        deleted too still attest (lockfile discovery + the public proxy's
-        record); `--offline` without a local record is `record_unavailable`;
-        the lock reverted to the registry (ledgers + artifacts kept) is not
-        attested, `--no-verify` included."""
+        own copy: the manifest deleted (vendor ledger kept; hosted keeps none
+        in v5) attests; the ledgers deleted too still attest (lockfile
+        discovery + the public proxy's record); `--offline` without a local
+        record is `record_unavailable`; the lock reverted to the registry
+        (vendor ledger + artifacts kept) is not attested, `--no-verify`
+        included — hosted then names the patch nowhere at all."""
         marker = "redirected" if mode == "hosted" else "vendored"
-        unwired = "redirect_unwired" if mode == "hosted" else "vendor_unwired"
+        unwired = "vendor_unwired"
         out = {}
 
         def copy(name, strip_ledgers=False):
@@ -1174,7 +1223,9 @@ def verdict(ok, rc, env, tail):
         (d / "Pipfile").write_bytes(pristine_pipfile)
         for label, flags in (("reverted", ()), ("revertedNoVerify", ("--no-verify",))):
             rc, env_, doc, tail = vex(d, label, *flags)
-            out[label] = verdict(vex_omits(rc, env_, doc, PURL_BASE, unwired), rc, env_, tail)
+            dead = (vex_nothing_named(rc, env_, doc, PURL_BASE) if mode == "hosted"
+                    else vex_omits(rc, env_, doc, PURL_BASE, unwired))
+            out[label] = verdict(dead, rc, env_, tail)
         return out
 
     def vex_info(vx):
diff --git a/scripts/backtest-poetry.py b/scripts/backtest-poetry.py
index 499fef96..f10d4fcf 100755
--- a/scripts/backtest-poetry.py
+++ b/scripts/backtest-poetry.py
@@ -33,7 +33,9 @@
 import shutil
 import subprocess
 import sys
+import time
 import traceback
+import urllib.error
 import urllib.request
 from datetime import datetime, timezone
 from pathlib import Path
@@ -286,8 +288,12 @@ def oracle(python, names, cwd, log):
 
     def record_hashes(project, mode):
         if mode == "hosted":
-            ledger = json.loads((project / ".socket/vendor/redirect-state.json").read_text())
-            recs = ledger["records"]
+            # v5 hosted mode keeps no ledger: the lock pin names the patch
+            # uuid and the record is the public API's.
+            uuid = hosted_uuid((project / "poetry.lock").read_text())
+            if uuid is None:
+                raise RuntimeError("the hosted lock pins no patch.socket.dev uuid")
+            recs = {PURL_BASE: published_record(uuid)}
         elif mode == "vendored":
             # Vendored mode never writes `.socket/manifest.json`: the ledger
             # entry embeds the patch record.
@@ -302,11 +308,33 @@ def record_hashes(project, mode):
             rec.get("uuid"),
         )
 
+    def hosted_uuid(text):
+        """The patch uuid of the first patch.socket.dev URL in `text` (the
+        LAST uuid-shaped path segment: an earlier one may be a grant token)."""
+        m = re.search(r"https://patch\.socket\.dev/[^\s\"'#]+", text)
+        if not m:
+            return None
+        uuids = re.findall(r"[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}", m[0])
+        return uuids[-1] if uuids else None
+
+    def published_record(uuid):
+        """`GET https://patches-api.socket.dev/patch/view/<uuid>` (the public proxy)."""
+        url = f"https://patches-api.socket.dev/patch/view/{uuid}"
+        for attempt in range(1, 6):
+            try:
+                req = urllib.request.Request(url, headers={"Accept": "application/json", "User-Agent": "SocketPatchCLI-backtest/1.0"})
+                with urllib.request.urlopen(req, timeout=60) as resp:
+                    return json.loads(resp.read().decode("utf-8"))
+            except (urllib.error.URLError, TimeoutError, ConnectionError):
+                if attempt == 5:
+                    raise
+                time.sleep(10 * attempt)
+
     def manifestless_vex(case, fresh, mode, uuid, pristine_lock, check, info):
         """Steps (1)-(4) of the manifest-less VEX matrix over `fresh` (an
         installed clone of the committed state, `.socket/` included)."""
         marker = "(redirected)" if mode == "hosted" else "(vendored)"
-        unwired = "redirect_unwired" if mode == "hosted" else "vendor_unwired"
+        unwired = "vendor_unwired"
         runs = []
 
         def vex(*extra):
@@ -340,12 +368,14 @@ def attests(rc, d):
         def skipped(envelope, code):
             return any(e.get("action") == "skipped" and e.get("errorCode") == code for e in envelope.get("events", []))
 
-        # (1) manifest deleted: online, and offline from the committed ledger.
+        # (1) manifest deleted: online, and (vendored) offline from the
+        # committed vendor ledger. v5 hosted keeps no ledger: no local record.
         (fresh / ".socket/manifest.json").unlink(missing_ok=True)
         rc, _, d = vex()
         check("vexManifestDeleted", attests(rc, d), runs[-1])
-        rc, _, d = vex("--offline")
-        check("vexLedgerOffline", attests(rc, d), runs[-1])
+        if mode != "hosted":
+            rc, _, d = vex("--offline")
+            check("vexLedgerOffline", attests(rc, d), runs[-1])
         # (2) ledgers deleted too: lockfile discovery + the patch API.
         ledgers = {}
         for rel in (".socket/vendor/state.json", ".socket/vendor/redirect-state.json"):
@@ -354,7 +384,7 @@ def skipped(envelope, code):
                 ledgers[path] = path.read_bytes()
                 path.unlink()
         rc, _, d = vex()
-        check("vexLedgersDeleted", bool(ledgers) and attests(rc, d), runs[-1])
+        check("vexLedgersDeleted", bool(ledgers) == (mode != "hosted") and attests(rc, d), runs[-1])
         # (3) offline without ledgers: nothing to attest from, no network.
         rc, e, d = vex("--offline")
         check("vexOfflineRecordUnavailable", rc == 1 and d is None and skipped(e, "record_unavailable"), runs[-1])
@@ -366,7 +396,11 @@ def skipped(envelope, code):
         ok = True
         for extra in ((), ("--no-verify",), ("--offline", "--no-verify")):
             rc, e, d = vex(*extra)
-            ok = ok and rc == 1 and d is None and skipped(e, unwired)
+            if mode == "hosted":
+                # No ledger and no wiring: nothing names the patch any more.
+                ok = ok and rc == 2 and d is None and (e.get("error") or {}).get("code") == "manifest_not_found"
+            else:
+                ok = ok and rc == 1 and d is None and skipped(e, unwired)
         check("vexRevertedUnwired", ok, runs[-3:])
         (fresh / "poetry.lock").write_bytes(committed_lock)
         info["manifestlessVex"] = runs
@@ -603,6 +637,7 @@ def check(name, value, note=None):
             check("lockHasFileSource", b'type = "file"' in lock_after)
         if mode == "hosted":
             check("lockHasUrlSource", b'type = "url"' in lock_after and b"patch.socket.dev" in lock_after)
+            check("noLedger", not (project / ".socket/vendor/redirect-state.json").exists())
 
         # idempotent re-scan
         r2 = Run(cli_cmd(project, "scan", "--mode", mode), project, env, case / "rescan.log")
@@ -691,14 +726,16 @@ def check(name, value, note=None):
             else:
                 (project / "poetry.lock").write_bytes(lock_after)
 
-        # Rollback restores every byte and clears the ledgers.
+        # Rollback restores every byte (hosted: the upstream PyPI entry,
+        # re-resolved from the registry) and clears the ledgers.
         rb = Run(cli_cmd(project, "rollback"), project, env, case / "rollback.log")
         erb = rb.json_or_empty()
         check("rollbackExit0", rb.ok(), (rb.out + rb.err)[-600:] if not rb.ok() else None)
         check("rollbackRestoresLockBytes", (project / "poetry.lock").read_bytes() == pristine_lock)
         check("rollbackKeepsPyproject", (project / "pyproject.toml").read_bytes() == pristine_pyproject)
         if mode == "hosted":
-            check("rollbackClearsRedirectLedger", not (project / ".socket/vendor/redirect-state.json").exists() or not json.loads((project / ".socket/vendor/redirect-state.json").read_text()).get("records"))
+            check("rollbackNoRedirectLedger", not (project / ".socket/vendor/redirect-state.json").exists())
+            check("rollbackRestoredUpstream", PURL_BASE in ((erb.get("hosted") or {}).get("reverted") or []), erb.get("hosted"))
         if mode == "vendored":
             check("rollbackRemovesVendoredWheel", not (project / ".socket/vendor/pypi" / (uuid or "x")).exists())
         if mode == "agent":
diff --git a/scripts/backtest-uv.py b/scripts/backtest-uv.py
index cce3633a..38be686d 100644
--- a/scripts/backtest-uv.py
+++ b/scripts/backtest-uv.py
@@ -845,12 +845,13 @@ def vex(case, key, rows, *flags):
 def vex_matrix(version):
     """Manifest-less VEX over every installed hosted / vendored case: with
     `.socket/manifest.json` deleted, `vex` must attest urllib3 with the
-    mode's marker; with both ledgers deleted too it must still attest (the
-    lockfile references + the public patch API); `--offline` then has no
-    record (`record_unavailable`); and for the native project cases, the
-    pair reverted to the registry lock with the ledgers left behind must
-    NOT attest — verified or `--no-verify`. Each case runs in a copy, so
-    the other phases' results are untouched."""
+    mode's marker; with the vendor ledger deleted too (v5 hosted writes no
+    ledger at all) it must still attest (the lockfile references + the
+    public patch API); `--offline` then has no record
+    (`record_unavailable`); and for the native project cases, the pair
+    reverted to the registry lock (a vendor ledger left behind) must NOT
+    attest — verified or `--no-verify`. Each case runs in a copy, so the
+    other phases' results are untouched."""
     base = ROOT / 'matrix' / version
     rows = []
     cases = [
diff --git a/scripts/backtest-vlt.py b/scripts/backtest-vlt.py
index ae142c2d..ed8b5436 100644
--- a/scripts/backtest-vlt.py
+++ b/scripts/backtest-vlt.py
@@ -1286,19 +1286,22 @@ def rolled_back(self, row, checks, vlt, original, text):
         self.limitation(row, checks, ['rollbackOriginalBytes'])
 
     def ledger_record(self):
+        """The patch record the mode's state names for PURL. Hosted (v5) keeps
+        no ledger — the lock pin is the whole state — so it is the published
+        record (`ctx['record']`, the API's `/patch/view/<uuid>`) whenever the
+        lock pins UUID; a pre-v5 redirect ledger on disk is a regression."""
         if self.mode == 'hosted':
-            path = self.project / '.socket/vendor/redirect-state.json'
-            key = 'records'
-        else:
-            path = self.project / '.socket/vendor/state.json'
-            key = 'entries'
+            if (self.project / '.socket/vendor/redirect-state.json').exists():
+                return None
+            lock = self.project / 'vlt-lock.json'
+            wired = lock.is_file() and UUID in lock.read_text(encoding='utf-8')
+            return self.record if wired else None
+        path = self.project / '.socket/vendor/state.json'
         if not path.is_file():
             return None
         state = json.loads(path.read_text(encoding='utf-8'))
-        item = (state.get(key) or {}).get(PURL)
-        if item is None:
-            return None
-        return item if self.mode == 'hosted' else item.get('record')
+        item = (state.get('entries') or {}).get(PURL)
+        return None if item is None else item.get('record')
 
     def check_hosted(self, row, checks, before_lock, vlt, original):
         if self.unchanged(row):
@@ -1494,10 +1497,13 @@ def run_with_retries(cell_factory, job, attempts=3):
 # The downgrade scenario (DESIGN §2.4 / §8.4 `downgrade`).
 
 def downgrade(args, ctx, vlt):
-    """vlt ledgers written by this build, then the published release's
+    """vlt state written by this build, then the published release's
     `rollback` and `vendor --revert`: each must leave the project untouched
     (fail closed) or fully reverted, never half-reverted (a dropped record
-    beside a still-redirected lock, a reverted lock with the payload left)."""
+    beside a still-redirected lock, a reverted lock with the payload left).
+    v5 hosted mode writes NO ledger (the lock pin is the state), so the
+    hosted leg asserts exactly that; a pre-v5 published release then has no
+    ledger to replay and must leave the project untouched."""
     out = ctx['out'] / 'downgrade'
     if out.exists():
         shutil.rmtree(out)
@@ -1522,7 +1528,7 @@ def downgrade(args, ctx, vlt):
             if mode == 'hosted' and not probe_artifact(
                     ctx['artifact_url'], ctx['artifact_sha512'], out / 'probe')['verifies']:
                 # The live artifact is content-encoded, so this build refuses to
-                # write a hosted vlt ledger; write it through the identity mirror.
+                # pin it; write the hosted pin through the identity mirror.
                 mirror = IdentityMirror().__enter__()
                 env = dict(env, SOCKET_PROXY_URL=mirror.url)
                 extra = ['--patch-server-url', mirror.url]
@@ -1537,13 +1543,20 @@ def downgrade(args, ctx, vlt):
             written = snapshot(project)
             ledger = '.socket/vendor/redirect-state.json' if mode == 'hosted' \
                 else '.socket/vendor/state.json'
-            state = json.loads(written.get(ledger, b'{}'))
-            kinds = [e.get('kind') for e in state.get('edits', [])] if mode == 'hosted' else [
-                e.get('flavor') for e in (state.get('entries') or {}).values()]
-            row['ledgerKinds'] = kinds
-            if code != 0 or ('redirect_vlt_lock_node' if mode == 'hosted' else 'vlt') not in kinds:
-                raise RuntimeError(f'this build wrote no vlt {mode} ledger (exit {code}): '
-                                   f'{tail(output, 1500)}')
+            if mode == 'hosted':
+                row['ledgerKinds'] = []
+                pinned = UUID.encode() in written.get('vlt-lock.json', b'')
+                if code != 0 or not pinned or ledger in written:
+                    raise RuntimeError(f'this build must pin the hosted vlt lock and write no '
+                                       f'ledger (exit {code}, pinned={pinned}, '
+                                       f'ledger={ledger in written}): {tail(output, 1500)}')
+            else:
+                state = json.loads(written.get(ledger, b'{}'))
+                kinds = [e.get('flavor') for e in (state.get('entries') or {}).values()]
+                row['ledgerKinds'] = kinds
+                if code != 0 or 'vlt' not in kinds:
+                    raise RuntimeError(f'this build wrote no vlt {mode} ledger (exit {code}): '
+                                       f'{tail(output, 1500)}')
             command = ['rollback'] if mode == 'hosted' else ['vendor', '--revert']
             code, output, _ = run([published, *command, '--json', '--yes', '--no-telemetry',
                                    '--cwd', project], project, ctx['cli_env'], log)

From 06437d25a4cc6dd2489b00398a9a025f68bf3c7a Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Mon, 28 Sep 2026 15:18:33 +0200
Subject: [PATCH 14/32] WS5: one VendoredBackend for vendored
 apply/revert/repair; cut repair's ledger rebuild (#283)

* Consolidate vendored apply/revert/repair into one VendoredBackend

vendor, scan/get --mode vendored, vendor --revert, rollback's vendored
leg, remove and repair now go through one VendoredBackend { apply,
revert, repair } over the shared engine (vendor_records_reusing,
dispatch_revert_one_opts). The boxed_* scan shims collapse into one
boxed_vendor_step; the engine future stays boxed inside apply for the
Windows 1 MiB main-thread stack.

repair no longer re-synthesizes vendor ledger entries from lockfiles. A
lockfile reference with no ledger entry fails with vendor_ledger_missing
(artifact-level event: uuid + details.{ecosystem,path}); the remedy is
restoring state.json from version control. Missing or corrupt artifacts
are re-vendored through the same engine as vendor, so the patch
service's prebuilt artifact is downloaded first under --vendor-source
auto, with the local build as the fallback. The fingerprint post-verify,
set-aside of corrupt bytes and carried-inventory refresh are kept.

Removed with the rebuild: repair_vendor.rs, gem Gemfile wiring
reconstruction, and registry_fetch::fetch_npm_unverified. The packing
code (npm_pack, pypi_wheel, berry_zip, registry_fetch, prestage) stays:
depscan does not call it (verified against depscan master 784013d6), but
it is the CLI's own --vendor-source build/auto fallback.

Tests for the reconstruction path are replaced by vendor_ledger_missing
pins per flavor; CLI_CONTRACT, README, CHANGELOG and the v5 plan are
updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DMhWChtaNX5FJYNDq3NBJa

* Point the vlt coverage map at the renamed repair test

vlt-coverage.json still named vlt_repair_reconstructs_the_ledger_from_the_lock,
and vendor_vlt_lock_out_of_sync lost the only assertion the coverage
check could see when the lock-only reference test switched to
vendor_ledger_missing. vendor_vlt_out_of_sync now asserts the refusal
detail.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DMhWChtaNX5FJYNDq3NBJa

* Drop the ledger-less mirror leg from the bun binary workspace test

native_binary_alias_and_transitive still expected repair to rebuild a
workspace mirror after deleting state.json. Repair now reports that as
vendor_ledger_missing (pinned in native_binary_hosted_vendored_takeover_roundtrip),
so the leg is gone; the missing/corrupt mirror legs keep running and
assert the ledger stays byte-identical.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DMhWChtaNX5FJYNDq3NBJa

* Pass --mode agent to the gated agent-mode get fixtures

get defaults to hosted since 5e5f5ed, which moved the agent-mode
fixtures to --mode agent but missed the #[ignore]d real-toolchain
suites (e2e_vlt, e2e_npm, e2e_pypi, e2e_gem, e2e_safety_pnpm). Their
plain `get <uuid>` now redirects instead of applying in place, so e.g.
vlt_pinned_matrix_agent_get_and_remove saw the copy Absent. This PR
touches the vlt-compatibility path filter, which surfaced it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DMhWChtaNX5FJYNDq3NBJa

* Keep an unpersistable inventory refresh loud, drop reconstruction persist tests

A carried-inventory refresh whose ledger write fails now reports
vendor_inventory_refreshed next to vendor_state_write_failed and keeps
the member-verified rebuild on disk, instead of falling through to
vendor_artifact_rebuild_failed and removing it. The persist-failure
tests for the removed backfill / anchored / soft reconstruction paths
go with them; they only run as non-root, which is why the root sandbox
skipped them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DMhWChtaNX5FJYNDq3NBJa

* Restore the macOS-only PatchedFixture hash fields

The dead-field clippy fix removed before_hash/after_hash, but the macOS
immutable-flag rollback tests read them, so test (macos-latest) no
longer compiled. Keep the fields and allow dead_code off macOS only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DMhWChtaNX5FJYNDq3NBJa

* Keep repair on the recorded artifact identity

Review of #283 found two regressions in the shared-engine repair:

- A corrupt artifact was moved aside before staging, so its
  afterHash-verified members were no longer harvested: an offline repair
  that the previous implementation completed failed with "no local
  source". The members are now harvested first and passed as the seed.
- The post-verify reloaded the ledger the re-vendor had just written, so a
  service archive with different bytes (same members, new gzip mtime) was
  committed as `rebuilt` with a rewired lock and new fingerprint. Repair
  now verifies against the original entry; when the result is not the
  recorded artifact, that candidate's wiring files and ledger entry are
  put back from a pre-run snapshot, and a service copy falls back to a
  build-only rebuild. Legitimate backend migrations of a verified rebuild
  (the cargo version retag) are kept.

Both reproductions are pinned in repair_vendor_e2e.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DMhWChtaNX5FJYNDq3NBJa

* Make repair's wiring undo FIFO-safe, atomic and symlink-preserving

Bugbot on #283: the identity-undo snapshot read lockfiles with bare
tokio::fs::read (a FIFO at a wiring path blocks open(2)) and skipped
symlinked lockfiles, and the put-back wrote them in place (no
stage+fsync+rename, mode bits dropped).

The snapshot now reads through read_regular_to_bytes and records a
symlinked lockfile's link text; the undo re-links a link that the
engine's rename replaced, then writes the target through
atomic_write_bytes_preserving_mode. Pinned by
repair_identity_undo_follows_a_symlinked_lockfile.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DMhWChtaNX5FJYNDq3NBJa

---------

Co-authored-by: Claude <noreply@anthropic.com>
---
 .github/workflows/bun-compatibility.yml       |    4 +-
 .github/workflows/vlt-compatibility.yml       |    4 +-
 CHANGELOG.md                                  |   24 +
 README.md                                     |   12 +-
 crates/socket-patch-cli/CLI_CONTRACT.md       |   76 +-
 crates/socket-patch-cli/src/commands/get.rs   |   41 +-
 crates/socket-patch-cli/src/commands/mod.rs   |    2 +-
 .../socket-patch-cli/src/commands/remove.rs   |   23 +-
 .../socket-patch-cli/src/commands/repair.rs   |   35 +-
 .../src/commands/repair_vendor.rs             | 2658 -----------------
 .../socket-patch-cli/src/commands/rollback.rs |  114 +-
 .../socket-patch-cli/src/commands/scan/mod.rs |    2 +-
 .../src/commands/scan/vendor_flow.rs          |  378 +--
 .../socket-patch-cli/src/commands/vendor.rs   |  276 +-
 .../src/commands/vendored_backend/mod.rs      |  262 ++
 .../src/commands/vendored_backend/repair.rs   | 1675 +++++++++++
 .../coverage_fix_repair_vendor_predelete.rs   |  104 +-
 .../tests/covgap_commands_repair_vendor.rs    | 1076 +------
 .../tests/covgap_commands_rollback.rs         |   10 +-
 .../tests/covgap_commands_scan_vendor_flow.rs |    2 +-
 .../socket-patch-cli/tests/e2e_bun_lockb.rs   |   43 +-
 crates/socket-patch-cli/tests/e2e_gem.rs      |    4 +-
 crates/socket-patch-cli/tests/e2e_npm.rs      |    4 +-
 crates/socket-patch-cli/tests/e2e_pypi.rs     |    4 +-
 .../socket-patch-cli/tests/e2e_safety_pnpm.rs |    6 +-
 .../tests/e2e_vendor_composer_build.rs        |    6 +-
 crates/socket-patch-cli/tests/e2e_vlt.rs      |    2 +-
 .../tests/in_process_vendor/vlt.rs            |   46 +-
 .../tests/repair_vendor_e2e.rs                | 1169 ++------
 .../tests/repair_vendor_flavors_e2e.rs        |  270 +-
 .../tests/repair_vendor_flavors_e2e/vlt.rs    |   75 +-
 .../tests/scan_vendor_step_error_e2e.rs       |    2 +-
 crates/socket-patch-core/src/vendor/gem.rs    |  649 +---
 .../src/vendor/registry_fetch.rs              |   83 +-
 docs/design/v5-plan.md                        |   53 +
 docs/testing/vlt-coverage.json                |    2 +-
 36 files changed, 2855 insertions(+), 6341 deletions(-)
 delete mode 100644 crates/socket-patch-cli/src/commands/repair_vendor.rs
 create mode 100644 crates/socket-patch-cli/src/commands/vendored_backend/mod.rs
 create mode 100644 crates/socket-patch-cli/src/commands/vendored_backend/repair.rs

diff --git a/.github/workflows/bun-compatibility.yml b/.github/workflows/bun-compatibility.yml
index d5982448..41ac781b 100644
--- a/.github/workflows/bun-compatibility.yml
+++ b/.github/workflows/bun-compatibility.yml
@@ -43,7 +43,7 @@ on:
       - 'crates/socket-patch-cli/src/commands/scan/**'
       - 'crates/socket-patch-cli/src/commands/rollback.rs'
       - 'crates/socket-patch-cli/src/commands/vendor.rs'
-      - 'crates/socket-patch-cli/src/commands/repair_vendor.rs'
+      - 'crates/socket-patch-cli/src/commands/vendored_backend/**'
       - 'crates/socket-patch-cli/src/commands/remove.rs'
   # Main runs are the only rust-cache writers (save-if below), so a
   # path-filtered push trigger is what seeds the cache the PR builds restore
@@ -75,7 +75,7 @@ on:
       - 'crates/socket-patch-cli/src/commands/scan/**'
       - 'crates/socket-patch-cli/src/commands/rollback.rs'
       - 'crates/socket-patch-cli/src/commands/vendor.rs'
-      - 'crates/socket-patch-cli/src/commands/repair_vendor.rs'
+      - 'crates/socket-patch-cli/src/commands/vendored_backend/**'
       - 'crates/socket-patch-cli/src/commands/remove.rs'
   workflow_dispatch:
     inputs:
diff --git a/.github/workflows/vlt-compatibility.yml b/.github/workflows/vlt-compatibility.yml
index 6fd588bd..65839664 100644
--- a/.github/workflows/vlt-compatibility.yml
+++ b/.github/workflows/vlt-compatibility.yml
@@ -37,7 +37,7 @@ on:
       - 'crates/socket-patch-cli/src/commands/remove.rs'
       - 'crates/socket-patch-cli/src/commands/setup.rs'
       - 'crates/socket-patch-cli/src/commands/vendor.rs'
-      - 'crates/socket-patch-cli/src/commands/repair_vendor.rs'
+      - 'crates/socket-patch-cli/src/commands/vendored_backend/**'
       - 'crates/socket-patch-cli/src/commands/get.rs'
       - 'crates/socket-patch-cli/src/commands/vlt_preflight.rs'
       - 'crates/socket-patch-cli/src/commands/scan/**'
@@ -74,7 +74,7 @@ on:
       - 'crates/socket-patch-cli/src/commands/remove.rs'
       - 'crates/socket-patch-cli/src/commands/setup.rs'
       - 'crates/socket-patch-cli/src/commands/vendor.rs'
-      - 'crates/socket-patch-cli/src/commands/repair_vendor.rs'
+      - 'crates/socket-patch-cli/src/commands/vendored_backend/**'
       - 'crates/socket-patch-cli/src/commands/get.rs'
       - 'crates/socket-patch-cli/src/commands/vlt_preflight.rs'
       - 'crates/socket-patch-cli/src/commands/scan/**'
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2689764a..0f92db53 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -226,6 +226,30 @@ into the new version's section — see docs/releasing.md.
   (`https://repo.packagist.org`) and `SOCKET_NUGET_URL`
   (`https://api.nuget.org`).
 
+- **`repair` no longer rebuilds the vendor ledger from lockfiles.** A
+  lockfile that references `.socket/vendor/<eco>/<uuid>/` with no entry in
+  `.socket/vendor/state.json` now fails with `vendor_ledger_missing` (an
+  artifact-level `failed` event with `uuid` and `details.{ecosystem,path}`;
+  exit 1) instead of re-synthesizing the entry (`details.ledgerRestored` is
+  gone). The rewired lockfile cannot supply the pre-vendor originals a
+  revert needs, so the remedy is restoring `state.json` from version
+  control (or `git checkout -- <lockfile>` and re-vendoring). The unverified
+  npm "rebuild from the wired integrity" rung and the gem Gemfile wiring
+  reconstruction went with it; `rollback`'s missing-ledger error now asks
+  for `state.json` to be restored instead of naming `repair`.
+- **`repair` re-vendors broken artifacts the way `vendor` does.** Missing
+  or corrupt vendored artifacts go through the same vendored backend as
+  `vendor` / `scan --mode vendored` / `get --mode vendored`, so under the
+  default `--vendor-source auto` the patch service's prebuilt artifact is
+  downloaded again, with a local build as the fallback (and the only
+  source under `--offline` / `--vendor-source build`). The result is still
+  verified against the ledger fingerprint before it counts as `rebuilt`.
+  Failure details are now `vendor`'s own (for example "no installed
+  package found on disk"), and a drifted installed copy of a gem or pypi
+  release variant is no longer force-overwritten by repair — it fails the
+  same installed-variant check `vendor` applies. Internally, `vendor`, `scan`/`get --mode vendored`, `vendor --revert`,
+  `rollback`'s vendored leg, `remove` and `repair` now share one
+  `VendoredBackend { apply, revert, repair }`.
 - **Vendored runs refuse lock-text failures before downloading them.**
   `scan --mode vendored` and `get --mode vendored` evaluate the vendor
   backends' pure lock-text gates — pnpm, yarn classic and yarn berry
diff --git a/README.md b/README.md
index 82e6ef3a..645bf414 100644
--- a/README.md
+++ b/README.md
@@ -476,7 +476,7 @@ need the network and refuse to run with `--offline`.
 | [`remove`](#remove) | The single-patch form of `rollback`: restore, unwind, drop the record and GC for one PURL/UUID (a hosted patch is restored to upstream) |
 | [`vendor --revert`](#vendor) | **Un-vendors wholesale**: restores the recorded original lockfile fragments byte-for-byte and removes the `.socket/vendor/` artifacts (a package vendored over a hosted pin returns to upstream, not to hosted) |
 | [`scan --prune`](#scan) | Agent mode: **reconciles, doesn't reverse** — drops manifest entries for packages that have left the project and garbage-collects orphan blob/diff/archive files |
-| [`repair`](#repair) (alias `gc`) | **Restores health, not originals**: re-downloads missing blobs, rebuilds missing/corrupt vendored artifacts, and cleans up unused ones |
+| [`repair`](#repair) (alias `gc`) | **Restores health, not originals**: re-downloads missing blobs, re-vendors missing/corrupt vendored artifacts, and cleans up unused ones |
 
 And `setup --remove` reverts the install hooks that `setup` added.
 
@@ -497,7 +497,7 @@ And `setup --remove` reverts the install hooks that `setup` added.
 | [`setup`](#setup) | Wire install hooks (npm, Python, Bundler, Composer) that re-apply patches after install |
 | [`rollback`](#rollback) | Undo patches in every mode: restore original files, unwind vendored lockfile wiring, and restore hosted lockfile entries to upstream |
 | [`remove`](#remove) | Remove one patch by PURL or UUID (rolls back first) |
-| [`repair`](#repair) | Download missing patch artifacts, rebuild vendored artifacts, clean up unused ones (alias: `gc`) |
+| [`repair`](#repair) | Download missing patch artifacts, re-vendor broken vendored artifacts, clean up unused ones (alias: `gc`) |
 
 `socket-patch --update` updates the CLI itself (see [Updating](#updating)).
 
@@ -1215,14 +1215,18 @@ socket-patch remove "pkg:npm/lodash@4.17.20" --json
 
 ### `repair`
 
-Download missing blobs, rebuild missing or corrupt vendored artifacts, and clean up unused
+Download missing blobs, re-vendor missing or corrupt vendored artifacts, and clean up unused
 blobs.
 
 Alias: `gc`
 
 `repair` cleans up the `.socket/` directory without running a scan — useful when you've
 manually adjusted the manifest, recovered from a partial-failure state, or just want to
-free space. It also rebuilds missing or corrupt vendored artifacts. For the combined
+free space. It also re-vendors missing or corrupt vendored artifacts the same way `vendor`
+does (the patch service's prebuilt artifact first, a local build as the fallback), checked
+against `.socket/vendor/state.json`. `repair` does not recreate a lost `state.json`: if a
+lockfile points into `.socket/vendor/` and the ledger has no entry for it, `repair` fails with
+`vendor_ledger_missing` — restore `state.json` from version control. For the combined
 agent-mode workflow (discover + apply + GC in one pass), use `scan --sync` instead.
 
 Like every other mutating command, `repair` takes the `.socket/apply.lock` advisory lock
diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index 978a22d4..f5e53273 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -17,7 +17,7 @@ This document defines the **public surface** of the `socket-patch` binary. Anyth
 | `setup` | — | Agent mode: wire automatic-patching install hooks (npm/pypi/gem/composer) |
 | `rollback` | — | **Full-state rollback (v5.0, MAJOR)**: restore original files AND unwind vendored lockfile wiring / restore hosted pins to their upstream registry entries, remove the rolled-back entries from the manifest, and GC their blobs/archives; takes optional variadic positional `targets` (PURL \| UUID \| path glob). See [Rollback command contract](#rollback-command-contract-v50) |
 | `remove` | — | Agent mode: remove a patch from manifest (rolls back first); requires positional `identifier` |
-| `repair` | `gc` | Agent mode: download missing blobs, rebuild missing/corrupt vendored artifacts, and clean up unused ones (refuses with `lock_held` when a live process holds the lock; see "Lock lifecycle" below) |
+| `repair` | `gc` | Agent mode: download missing blobs, re-vendor missing/corrupt vendored artifacts (never re-synthesizing a lost ledger), and clean up unused ones (refuses with `lock_held` when a live process holds the lock; see "Lock lifecycle" below) |
 
 Rows are in `--help` order (v5.0): the hosted/vendored workflow (`scan` → `vex` → `vendor`, with `list` to inspect), then the agent-mode (in-place patching) commands.
 
@@ -682,38 +682,41 @@ into memory via the patch-view endpoint. A vendored project's `.socket/` holds o
 by an agent-mode manifest, or as the `{"patches": {}}` husk left after a legacy record migrated
 into the ledger).
 
-**Vendored artifact repair (v3.5)**: `repair` health-checks every ledger entry — per-file
+**Vendored artifact repair (v5.0)**: `repair` health-checks every ledger entry — per-file
 afterHashes inside the artifact plus, for file-shaped artifacts (`.tgz`/`.whl`), the whole file
 against the ledger's recorded sha256 (the rewired lock integrity references those exact bytes) —
-and REBUILDS missing/corrupt artifacts through the normal vendor backends. The wired hot paths
-rebuild the artifact only: lockfiles stay byte-identical and the ledger entry is not re-recorded
-(the first run's entry holds the only pre-vendor originals). Pristine sources follow the same
-ladder as vendor: the installed copy first (works under `--offline`), then a lockfile-verified
-registry fetch, then the pre-vendor registry fragment recovered from the ledger's wiring
-`original`s (`recover_lock_entry`) — always integrity-verified fail-closed, and the rebuilt
-artifact is re-verified against the recorded fingerprint before the run counts it (`rebuilt`
-event; a mismatch removes the artifact and fails with `vendor_artifact_rebuild_failed`).
-Lockfile references to `.socket/vendor/<eco>/<uuid>/...` with NO ledger coverage (the ledger was
-deleted wholesale) are RECONSTRUCTED: the uuid comes from the path (the recovery rule above), the
-record from the manifest — or the patch API, yielding an entry with the record embedded (the same
-`detached: true` + `record` shape every `scan`/`get --mode vendored` entry has)
-— and a fresh ledger entry is persisted with the rebuilt artifact's fingerprint. When nothing is
-installed and the ledger is gone, npm-family reconstruction has one more rung: the REWIRED
-lockfile still records the integrity of the packed vendored tarball, so the pristine copy is
-fetched (unverified, conventional registry URL, `SOCKET_NPM_REGISTRY` honored) and the
-deterministically REBUILT artifact must reproduce that wired integrity — a tampered pristine
-source changes the rebuilt bytes and fails closed (`vendor_artifact_rebuild_failed`, nothing
-kept). Reconstructed entries carry no pre-vendor wiring originals, so a later `--revert` degrades
-to the documented `vendor_lock_entry_drifted` guidance (re-resolve with the package manager). Because of this
-phase, `repair` no longer errors with `manifest_not_found` when the project has a vendor ledger
-or vendor-path lockfile references — it runs the vendored phase alone. A **hosted-only** project
-(no manifest, no vendor ledger, no vendored references — only hosted pins in its lockfiles, v5.0,
-or a pre-v5 `.socket/vendor/redirect-state.json`) is a no-op: `repair` exits 0 with a
-`redirect_only_project` skip pointing at `scan --mode hosted` (hosted pins have no local artifacts
-to repair), rather than the `manifest_not_found` error a
-bare directory still gets. Step 1's source download
-likewise skips vendored-in-sync manifest entries (their content lives in the committed artifact),
-so repairing a vendored project never re-litters `.socket/blobs`. `--dry-run` previews
+and RE-VENDORS missing/corrupt artifacts through the same vendored backend `vendor`, `scan --mode
+vendored` and `get --mode vendored` use. The artifact therefore comes from the same place a fresh
+vendor gets it: under the default `--vendor-source auto` the patch service's prebuilt artifact is
+downloaded again, with a local build from a lockfile-verified pristine source as the fallback
+(and the only source under `--offline` / `--vendor-source build`). The wired hot paths rebuild
+the artifact only: lockfiles stay byte-identical and the ledger entry keeps its recorded
+pre-vendor originals. The re-vendored artifact is verified against the ledger fingerprint before
+the run counts it (`rebuilt` event; a mismatch removes the artifact and fails with
+`vendor_artifact_rebuild_failed`). The check is always against the ORIGINAL ledger entry: a source
+that produces other bytes (a service archive re-packed since vendoring) is never committed — its
+wiring and ledger entry are put back and repair falls back to the deterministic local build. A
+corrupt artifact's afterHash-verified members are harvested as patch content (so `--offline`
+repairs it from the installed copy) before it is moved aside for the rebuild, and put back when
+nothing replaced it.
+
+**The ledger is not rebuilt from lockfiles (v5.0).** A lockfile reference to
+`.socket/vendor/<eco>/<uuid>/...` with NO ledger entry (state.json deleted or never committed)
+fails with `vendor_ledger_missing` (an artifact-level `failed` event carrying `uuid` and
+`details.{ecosystem,path}`; exit 1) — the pre-vendor originals a revert needs cannot be recovered
+from the rewired lockfile. Recovery: restore `.socket/vendor/state.json` from version control and
+re-run `repair`, or restore the lockfile (`git checkout -- <lockfile>`) and re-vendor. Earlier
+releases re-synthesized such entries (`details.ledgerRestored`); ledgers they wrote keep working.
+
+Because of this phase, `repair` does not error with `manifest_not_found` when the project has a
+vendor ledger or vendor-path lockfile references — it runs the vendored phase alone. A
+**hosted-only** project (no manifest, no vendor ledger, no vendored references — only hosted pins
+in its lockfiles, v5.0, or a pre-v5 `.socket/vendor/redirect-state.json`) is a no-op: `repair`
+exits 0 with a `redirect_only_project` skip pointing at `scan --mode hosted` (hosted pins have no
+local artifacts to repair), rather than the `manifest_not_found` error a bare directory still
+gets. Step 1's source download skips
+vendored manifest entries and lockfile-referenced uuids (their content lives in the committed
+artifact), so repairing a vendored project never re-litters `.socket/blobs`. `--dry-run` previews
 (`details.wouldRebuild`); `--offline` rebuilds only from fully local sources and fails per-entry
 otherwise; `vendor`/`scan --vendor` re-runs get the same rebuild for wired-but-broken artifacts
 (`vendor_artifact_rebuilt` warning) and recover registry resolutions for missing committed
@@ -936,7 +939,7 @@ worse, lets a warm cache silently serve unpatched bytes):
 
 A bare `rollback` (or a scoped one, for its scope) restores the SYSTEM to unpatched and cleans up the local state, in phases under one `apply.lock` acquisition:
 
-1. **State discovery.** A missing manifest is no longer fatal when the vendor ledger or the lockfiles' hosted pins hold work (`rollback` runs manifest-less on hosted-only / vendored projects — every `scan`/`get --mode vendored` and v5 `scan --mode hosted` project is manifest-less). The **truly-empty** project — no manifest, no vendor ledger, no hosted pin — keeps the legacy "Manifest not found" exit 1 (JSON: the legacy `{status: "error", error: "Manifest not found", path}` shape), with one v5.0 exception: when a pre-v5 `.socket/vendor/redirect-state.json` is the only thing left, nothing pins it any more, so a wet run deletes it and exits 0 (human `Removed the pre-v5 hosted ledger .socket/vendor/redirect-state.json: no lockfile pins a hosted patch.`, `Would remove …` on `--dry-run`, which deletes nothing; JSON `{status: "success", rolledBack: 0, alreadyOriginal: 0, failed: 0, dryRun, warnings, legacyRedirectLedgerRemoved}` — a minimal envelope without the keys below; a failed delete is the `legacy_redirect_ledger_kept` warning, still exit 0). A project whose lockfiles still reference `.socket/vendor/` artifacts but whose vendor ledger is missing errors naming `socket-patch repair` (reconstruct the ledger, then roll back). **Corrupt-ledger containment**: an unreadable vendor ledger fails ONLY the legs that need it — the vendored leg, manifest cleanup, and GC are skipped fail-closed (`vendor_state_unreadable` warning) while the agent and hosted legs still run; it drives `partial_failure` exit 1, and an emergency restore is never blocked by it. When the ONLY state on disk is an unreadable vendor ledger, the run fails closed naming the store. A pre-v5 redirect ledger is never read by rollback (v4's `redirect_state_unreadable` is no longer emitted).
+1. **State discovery.** A missing manifest is no longer fatal when the vendor ledger or the lockfiles' hosted pins hold work (`rollback` runs manifest-less on hosted-only / vendored projects — every `scan`/`get --mode vendored` and v5 `scan --mode hosted` project is manifest-less). The **truly-empty** project — no manifest, no vendor ledger, no hosted pin — keeps the legacy "Manifest not found" exit 1 (JSON: the legacy `{status: "error", error: "Manifest not found", path}` shape), with one v5.0 exception: when a pre-v5 `.socket/vendor/redirect-state.json` is the only thing left, nothing pins it any more, so a wet run deletes it and exits 0 (human `Removed the pre-v5 hosted ledger .socket/vendor/redirect-state.json: no lockfile pins a hosted patch.`, `Would remove …` on `--dry-run`, which deletes nothing; JSON `{status: "success", rolledBack: 0, alreadyOriginal: 0, failed: 0, dryRun, warnings, legacyRedirectLedgerRemoved}` — a minimal envelope without the keys below; a failed delete is the `legacy_redirect_ledger_kept` warning, still exit 0). A project whose lockfiles still reference `.socket/vendor/` artifacts but whose vendor ledger is missing errors asking for `.socket/vendor/state.json` to be restored from version control first (v5.0: `repair` no longer reconstructs the ledger). **Corrupt-ledger containment**: an unreadable vendor ledger fails ONLY the legs that need it — the vendored leg, manifest cleanup, and GC are skipped fail-closed (`vendor_state_unreadable` warning) while the agent and hosted legs still run; it drives `partial_failure` exit 1, and an emergency restore is never blocked by it. When the ONLY state on disk is an unreadable vendor ledger, the run fails closed naming the store. A pre-v5 redirect ledger is never read by rollback (v4's `redirect_state_unreadable` is no longer emitted).
 2. **Agent leg** — the existing in-place restore machinery, unchanged (v5.0 presentation: the human `No patches found in manifest` line prints only for an unscoped run with no work in ANY leg — a run whose work is all vendored/hosted stays quiet about the manifest): multi-copy restore, release-variant narrowing, the before-blob gate (+ on-demand download; a gate abort still exits 1 with per-package `missing_blob` failure results **and** skips manifest cleanup + GC entirely — nothing was restored, and the retry's revert data must survive), local-go redirect drop, and the `not_installed` exit-0 asymmetry verbatim. Vendor-owned purls are still excluded here (see the vendored-mode section) — they are handled by the next leg instead of being punted to other commands.
 3. **Vendored leg** — each in-scope ledger entry (embedded-record entries included) is reverted through the vendor backends: lockfile wiring restored, artifact dir deleted (and its emptied `.socket/vendor/<eco>/` husk pruned, v5.0), ledger entry dropped + persisted per purl (crash-consistent, like `vendor --revert`). A **drift-keep** (the backend refused a drifted lock) keeps the entry, the artifact, AND the manifest record (`vendoredKept`, exit 1 — the system is still patched); a failure is recorded and other entries proceed.
 4. **Hosted leg** — each in-scope hosted pin is restored to its default upstream registry entry; see "Hosted unwind coverage" below. After a hosted leg with no failure, a wet run deletes a pre-v5 `redirect-state.json` once no lockfile pins a hosted patch any more (a failed delete is the `legacy_redirect_ledger_kept` warning).
@@ -1134,7 +1137,7 @@ Env-only knobs (no CLI flag) read by the vendor auto-fetch / artifact-rebuild pa
 
 | Env var | Default | Notes |
 |---|---|---|
-| `SOCKET_NPM_REGISTRY` | `https://registry.npmjs.org` | Base for conventional npm tarball URLs (vendor auto-fetch + the npm-family lockfile-integrity reconstruction rung in `repair`) and, v5.0, the version documents (`<base>/<name>/<version>`, a scoped name's `/` as `%2f`; `dist.tarball` / `integrity` / `shasum`) the npm-family and vlt upstream restore reads. |
+| `SOCKET_NPM_REGISTRY` | `https://registry.npmjs.org` | Base for conventional npm tarball URLs (vendor auto-fetch, including `repair`'s local-build fallback) and, v5.0, the version documents (`<base>/<name>/<version>`, a scoped name's `/` as `%2f`; `dist.tarball` / `integrity` / `shasum`) the npm-family and vlt upstream restore reads. |
 | `SOCKET_CRATES_REGISTRY` | `https://static.crates.io/crates` | crates.io static `.crate` download host. |
 | `SOCKET_GOPROXY` | `https://proxy.golang.org` | Go module proxy. Wins over the standard `GOPROXY` env var, whose first element is used otherwise. When that element is `off` or `direct`, or the module matches `GONOPROXY` (default `GOPRIVATE`), go would not ask a proxy, so the pristine fetch is refused (`vendor_fetch_unverifiable` + the calm `package_not_installed` skip) instead of falling back to `proxy.golang.org`. |
 | `SOCKET_MAVEN_REGISTRY` | `https://repo1.maven.org/maven2` | maven2 base for the fallback upstream-pom download. |
@@ -1237,7 +1240,7 @@ Every `--json` invocation emits a single JSON object that follows the **unified
 | `failed`     | every command                         | A specific patch attempt failed. `errorCode` + `error` set. |
 | `removed`    | `gc`/`repair`, `remove`, `rollback`   | Data was removed from `.socket/` (or files rolled back). `bytes` optional. |
 | `verified`   | `apply --dry-run`, `scan --dry-run`   | The patch *would* apply cleanly. `files` lists previewed changes. |
-| `rebuilt`    | `repair`                              | A missing/corrupt vendored artifact was rebuilt in place (or its lost ledger entry restored — `details.ledgerRestored`). `summary.rebuilt` counts these (the field is omitted while zero). |
+| `rebuilt`    | `repair`                              | A missing/corrupt vendored artifact was re-vendored in place (v5.0: never a lost ledger entry — see `vendor_ledger_missing`). `summary.rebuilt` counts these (the field is omitted while zero). |
 
 ### Stable `errorCode` tags
 
@@ -1276,7 +1279,8 @@ Every `--json` invocation emits a single JSON object that follows the **unified
 | `already_vendored`        | `skipped`        | vendor: artifact + wiring already in sync for this patch uuid. |
 | `unsafe_coordinates`      | `failed`         | vendor: purl/uuid would escape `.socket/vendor/` (tampered manifest/state); refused before any write. |
 | `revert_failed`           | `failed`         | vendor --revert: a recorded entry could not be reverted. |
-| `vendor_wiring_unknown_revert_blocked` | `skipped` (beside the `failed`/`revert_failed` event) | vendor --revert: the ledger entry was reconstructed by `repair` without wiring records and the live lockfile still resolves through the artifact — the revert refuses (fail-closed) instead of deleting a tarball the lock points at. Recovery: `socket-patch repair`, then restore the pre-vendor lock (or re-lock without the override) and re-run the revert. repair: an npm ledger entry whose `flavor` this release does not know (written by a newer socket-patch) is skipped, never health-checked or rebuilt, and the artifact, wiring and ledger stay as found (a lone `skipped` event; the run's exit is unaffected). Recovery: upgrade socket-patch. |
+| `vendor_ledger_missing` | `failed` (artifact-level: `uuid` + `details.{ecosystem,path}`, no purl) | repair (v5.0): a lockfile references `.socket/vendor/<eco>/<uuid>/` but the vendor ledger has no entry for it; repair no longer rebuilds ledger entries from lockfiles. Recovery: restore `.socket/vendor/state.json` from version control and re-run `repair`, or `git checkout -- <lockfile>` and re-vendor. |
+| `vendor_wiring_unknown_revert_blocked` | `skipped` (beside the `failed`/`revert_failed` event) | vendor --revert: the ledger entry was reconstructed by a pre-v5 `repair` without wiring records and the live lockfile still resolves through the artifact — the revert refuses (fail-closed) instead of deleting a tarball the lock points at. Recovery: `socket-patch repair`, then restore the pre-vendor lock (or re-lock without the override) and re-run the revert. repair: an npm ledger entry whose `flavor` this release does not know (written by a newer socket-patch) is skipped, never health-checked or rebuilt, and the artifact, wiring and ledger stay as found (a lone `skipped` event; the run's exit is unaffected). Recovery: upgrade socket-patch. |
 | `ecosystem_not_setup`     | `skipped`        | vex: the patch is applied and byte-verified but its ecosystem has no install hook configured and is not declared in the manifest's `setup.manual`, so it is omitted from the document (Property 7). |
 | `stale_install`           | `skipped`        | vex (in-run `scan --mode hosted --vex`): a hosted stale-install probe found positively unpatched installed bytes, so the purl is omitted even under `--vex-no-verify` (see the gem / Python stale-install guards). |
 | `record_unavailable`      | `skipped`        | vex (manifest-less): a lockfile-wired patch has no local record (manifest, this run's hosted records or a pre-v5 redirect ledger, vendor ledger) and none could be fetched — `--offline`, transport error, 404, or a refused (paid) patch. Omitted, never attested from the `socket-patch.vendor.json` marker. |
@@ -1326,7 +1330,7 @@ Every `--json` invocation emits a single JSON object that follows the **unified
 | `vendor_flavor_changed` | `failed` | vendor (npm): the purl's vendor ledger entry was written for another lockfile `flavor` than the one the router now detects (for example `npm` → `vlt` after switching package managers). Remedy: `socket-patch vendor --revert` it first, then re-vendor. Refused before any write. |
 | `vendor_artifact_gitignored` | `failed` | vendor (vlt): inside a git work tree, `git check-ignore --no-index` reports the new artifact's uuid directory as ignored by a rule its own `.gitignore` cannot override (such as a root `.socket/` rule; the detail names the rule). Remedy: drop that rule for `.socket/vendor/`. Refused before any write. |
 | `vendor_artifact_gitignore_unchecked` | warning | vendor (vlt): git is installed but could not answer the ignore check for the written vendored directory (it failed to start, ran past 30 s, or `rev-parse` / `check-ignore` exited with an error); the package is vendored and the detail names what failed. Remedy: make sure no ignore rule covers `.socket/` before committing. Git absent, or a project outside any work tree, raises nothing. |
-| `vendor_ledger_entry_missing` | `failed` | vendor (vlt): the only installed copy is vlt's link to a committed vendored directory, but the vendor ledger has no entry for the package; run `socket-patch repair` to restore it. Replaces the `package_not_installed` skip. |
+| `vendor_ledger_entry_missing` | `failed` | vendor (vlt): the only installed copy is vlt's link to a committed vendored directory, but the vendor ledger has no entry for the package; restore `.socket/vendor/state.json` from version control (v5.0: `repair` no longer re-synthesizes it). Replaces the `package_not_installed` skip. |
 | `vendor_artifact_missing` | `skipped` (warning) / `failed` | vendor: the committed artifact is gone — the registry resolution is recovered from the ledger and the artifact rebuilt (warning); repair `--offline` with no local source surfaces it as the per-entry failure instead. |
 | `vendor_artifact_corrupt` | `failed` | repair `--offline`: the committed artifact fails verification (member afterHashes or the ledger's whole-file sha256) and no local source can rebuild it. Online repairs rebuild instead. |
 | `vendor_artifact_reused` | `skipped` (verbose note) | vendor / scan `--vendor` (pypi): the wiring was dropped by a relock but the committed wheel the ledger vouches for verified, so it was re-wired as-is — no service download, no rebuild; the lock pins the first run's sha again. |
diff --git a/crates/socket-patch-cli/src/commands/get.rs b/crates/socket-patch-cli/src/commands/get.rs
index 16b7063c..e6a2c1ad 100644
--- a/crates/socket-patch-cli/src/commands/get.rs
+++ b/crates/socket-patch-cli/src/commands/get.rs
@@ -3884,36 +3884,28 @@ async fn run_get_vendored(
         ))
         .await
     };
-    let mut has_errors = dl_code != 0;
     fold_narrowing_into_result(&mut result, narrow_skips, narrow_warnings);
 
     // The vendor step (scan's, verbatim): apply lock, in-memory staging
     // seeded with the blobs fetched above, the engine over exactly the
     // records fetched above (moved in — nothing here needs them afterwards)
-    // and over this run's client. A per-patch download failure does not
-    // skip it (scan parity).
-    match super::scan::boxed_scan_vendor_step(
-        &args.common,
+    // and over this run's client, then the run's telemetry. A per-patch
+    // download failure does not skip it (scan parity).
+    match super::scan::boxed_vendor_step(super::scan::VendorStep {
+        common: &args.common,
         records,
-        blobs,
-        api_client.clone(),
+        seed: blobs,
+        client: api_client.clone(),
         use_public_proxy,
-    )
+        report_empty: true,
+        prior: None,
+        download_errors: dl_code != 0,
+        telemetry_token,
+        telemetry_org,
+    })
     .await
     {
-        Ok((vendor_errors, venv)) => {
-            has_errors |= vendor_errors;
-            // Telemetry follows the RUN outcome, not the vendor step alone:
-            // a download-phase refusal/failure exits 1 and must not report
-            // a successful vendoring of zero patches (scan's arms agree).
-            crate::commands::vendor::track_outcomes_for_vendor(
-                has_errors,
-                &venv,
-                args.common.dry_run,
-                telemetry_token,
-                telemetry_org,
-            )
-            .await;
+        Ok((has_errors, venv)) => {
             if args.common.json {
                 result["status"] = serde_json::json!(if has_errors {
                     "partial_failure"
@@ -3927,13 +3919,6 @@ async fn run_get_vendored(
             i32::from(has_errors)
         }
         Err((code, message, venv)) => {
-            socket_patch_core::telemetry::track_patch_vendor_failed(
-                &message,
-                args.common.dry_run,
-                telemetry_token,
-                telemetry_org,
-            )
-            .await;
             if args.common.json {
                 // A vendor envelope built before the failure (events
                 // included) must reach the JSON consumer even though the
diff --git a/crates/socket-patch-cli/src/commands/mod.rs b/crates/socket-patch-cli/src/commands/mod.rs
index f30ee99e..7b56b9d7 100644
--- a/crates/socket-patch-cli/src/commands/mod.rs
+++ b/crates/socket-patch-cli/src/commands/mod.rs
@@ -7,7 +7,7 @@ pub mod list;
 pub(crate) mod lock_cli;
 pub mod remove;
 pub mod repair;
-pub(crate) mod repair_vendor;
+pub(crate) mod vendored_backend;
 pub mod rollback;
 pub mod scan;
 pub mod setup;
diff --git a/crates/socket-patch-cli/src/commands/remove.rs b/crates/socket-patch-cli/src/commands/remove.rs
index c21fbfd7..0033502d 100644
--- a/crates/socket-patch-cli/src/commands/remove.rs
+++ b/crates/socket-patch-cli/src/commands/remove.rs
@@ -14,9 +14,10 @@ use std::time::Duration;
 
 use super::get::short_uuid;
 use super::rollback::{
-    pin_before_hash_blobs, revert_vendor_entry, rollback_patches_inner, run_hosted_leg,
-    sweep_failure, sweep_unused_artifacts, HostedLegOutcome, InnerSelection, VendorRevertStep,
+    pin_before_hash_blobs, rollback_patches_inner, run_hosted_leg, sweep_failure,
+    sweep_unused_artifacts, HostedLegOutcome, InnerSelection,
 };
+use crate::commands::vendored_backend::{RevertedEntry, VendorRevertStep, VendoredBackend};
 use crate::args::{apply_env_toggles, GlobalArgs};
 use crate::commands::lock_cli::acquire_or_emit;
 use crate::json_envelope::{Command, Envelope, EnvelopeError, PatchAction, PatchEvent, Status};
@@ -1153,9 +1154,19 @@ async fn revert_vendored_matches(
         keep_artifact: args.preserve_state,
     };
     let mut leg = RemoveVendorLeg::default();
-    for key in keys {
-        let result = revert_vendor_entry(&args.common.cwd, key, state, opts).await;
-        for w in &result.warnings {
+    // Stops at the first hard failure: remove aborts there, leaving the
+    // remaining matches (and the manifest) untouched.
+    let reverted = VendoredBackend::new(&args.common, None)
+        .revert(keys, state, opts, true)
+        .await;
+    for RevertedEntry {
+        key,
+        warnings,
+        step,
+        ..
+    } in reverted
+    {
+        for w in &warnings {
             if loud {
                 eprintln!("Warning ({}): {}", w.code, w.detail);
             }
@@ -1164,7 +1175,7 @@ async fn revert_vendored_matches(
                     .with_reason(w.code, w.detail.clone()),
             );
         }
-        match result.step {
+        match step {
             VendorRevertStep::Missing => {}
             VendorRevertStep::Failed(why) => {
                 track_patch_remove_failed(
diff --git a/crates/socket-patch-cli/src/commands/repair.rs b/crates/socket-patch-cli/src/commands/repair.rs
index f4aa08ec..039075cd 100644
--- a/crates/socket-patch-cli/src/commands/repair.rs
+++ b/crates/socket-patch-cli/src/commands/repair.rs
@@ -80,7 +80,7 @@ pub async fn run(args: RepairArgs) -> i32 {
         let mut has_vendor_traces = tokio::fs::metadata(&state_file).await.is_ok();
         if !has_vendor_traces {
             let refs =
-                crate::commands::repair_vendor::scan_vendor_references(&args.common.cwd).await;
+                crate::commands::vendored_backend::repair::scan_vendor_references(&args.common.cwd).await;
             has_vendor_traces = !refs.is_empty();
             vendor_references = Some(refs);
         }
@@ -150,7 +150,7 @@ pub async fn run(args: RepairArgs) -> i32 {
     // scanned this ledger-less project.
     let vendor_references = match vendor_references {
         Some(refs) => refs,
-        None => crate::commands::repair_vendor::scan_vendor_references(&args.common.cwd).await,
+        None => crate::commands::vendored_backend::repair::scan_vendor_references(&args.common.cwd).await,
     };
 
     // The API client is built lazily: `repair_inner` constructs it only on
@@ -420,9 +420,10 @@ async fn repair_inner(
     let ledger = socket_patch_core::vendor::load_state(&args.common.cwd).await;
     let no_entries = std::collections::HashMap::new();
     let vendor_entries = ledger.as_ref().map(|s| &s.entries).unwrap_or(&no_entries);
-    // Lockfile vendor references count as vendored even before the ledger
-    // is reconstructed, so a no-ledger repair doesn't download sources for
-    // entries the vendored phase is about to own.
+    // Lockfile vendor references count as vendored even with no ledger
+    // entry: the committed artifact is the patch, so a no-ledger repair
+    // must not litter `.socket/` with sources for it (the vendored phase
+    // reports the missing ledger instead).
     let referenced_uuids: std::collections::HashSet<String> = vendor_references
         .iter()
         .map(|(_, uuid, _)| uuid.clone())
@@ -535,19 +536,25 @@ async fn repair_inner(
         }
     }
 
-    // Step 1.5: vendored artifacts — health-check the ledger (and any
-    // lockfile vendor references with no ledger coverage) and rebuild
-    // missing/corrupt artifacts. Runs under `--download-only` too:
+    // Step 1.5: vendored artifacts — health-check the ledger and re-vendor
+    // missing/corrupt artifacts through the vendored backend (the patch
+    // service first, like `vendor`); lockfile vendor references with no
+    // ledger entry are reported. Runs under `--download-only` too:
     // restoring artifacts IS repair's download half. The reference scan
     // and ledger load above are handed over, not repeated.
-    let vendor_rebuilt = crate::commands::repair_vendor::repair_vendored_artifacts_with_references(
+    let vendor_rebuilt = crate::commands::vendored_backend::VendoredBackend::new(
         &args.common,
-        manifest.as_ref(),
-        &socket_dir,
+        None,
+    )
+    .repair(
+        crate::commands::vendored_backend::repair::RepairRequest {
+            manifest: manifest.as_ref(),
+            socket_dir: &socket_dir,
+            references: &vendor_references,
+            ledger,
+            client: client.as_ref(),
+        },
         &mut env,
-        &vendor_references,
-        ledger,
-        client.as_ref(),
     )
     .await;
     if !quiet && vendor_rebuilt > 0 {
diff --git a/crates/socket-patch-cli/src/commands/repair_vendor.rs b/crates/socket-patch-cli/src/commands/repair_vendor.rs
deleted file mode 100644
index 662f5cd1..00000000
--- a/crates/socket-patch-cli/src/commands/repair_vendor.rs
+++ /dev/null
@@ -1,2658 +0,0 @@
-//! `repair`'s vendored-artifact phase: rebuild committed vendor artifacts
-//! that are referenced (ledger entry and/or rewired lockfile) but missing
-//! or corrupt on disk.
-//!
-//! Detection is the core health check ([`check_vendored_artifact`]: per-file
-//! afterHashes + the whole-file ledger sha256 for file-shaped artifacts).
-//! Rebuilds re-dispatch the normal vendor backends — their wired hot paths
-//! rebuild the ARTIFACT only and never touch lockfiles or re-record ledger
-//! originals — fed by the same pristine-source ladder as `vendor` (installed
-//! copy → lockfile-verified registry fetch → ledger-recovered pre-vendor
-//! fragment), with patch content staged in memory.
-//!
-//! Lockfile references with NO ledger coverage (`.socket/vendor` deleted
-//! wholesale, state.json included) are RECONSTRUCTED: the uuid is recovered
-//! from the lockfile path itself (the contract's uuid-in-path rule), the
-//! record from the manifest (or the patch API, yielding a detached entry),
-//! and a fresh ledger entry is re-synthesized so sweep/GC/revert know the
-//! artifact again — stamped with the lockfile FLAVOR the reference was
-//! found in (npm family and pypi), so a later `vendor --revert` routes to the
-//! backend whose unwired-revert guard probes the right lockfile. WIRING reconstruction is
-//! per-ecosystem: gem recognizes
-//! its own Gemfile/lock wiring and rebuilds full revert-capable records
-//! ([`socket_patch_core::vendor::gem::reconstruct_gem_wiring`]); the other
-//! ecosystems' pre-vendor originals are registry integrity material no
-//! offline source can reproduce, so their entries keep empty wiring and the
-//! gap is surfaced loudly (`vendor_wiring_unknown`, riding the envelope's
-//! run-level `warnings[]` — the entry itself repaired fine, so it must not
-//! ride `events[]` as a `skipped` consumers count) — a gem `--revert` of
-//! such an entry refuses instead of stranding the pair edit. Existing gem
-//! entries with EMPTY wiring (persisted by pre-reconstruction repairs) are
-//! backfilled the same way during the ledger-driven pass while healthy.
-//!
-//! Dir-shaped rebuilds are always LOCAL (the pristine ladder + the recorded
-//! patch), while `vendor` may have used the patch service's prebuilt
-//! artifact (a converter-generated stub gemspec the local build cannot
-//! reproduce): a rebuild whose patched members verify but whose tree
-//! differs from the recorded fileInventory refreshes the inventory from
-//! the verified rebuild (`vendor_inventory_refreshed`) instead of failing
-//! deterministically on every repair.
-//!
-//! Reconstruction never fingerprints the LIVE artifact into the restored
-//! ledger (trust-on-first-use: a tampered unpatched file would become the
-//! canonical tree later repairs enforce and VEX attests). A surviving
-//! artifact is only restored as-is when an independent anchor vouches for
-//! its exact bytes (the rewired npm-family lockfile integrity); otherwise
-//! its fingerprint is derived from a member-verified local rebuild, and
-//! when no trustworthy pristine source exists the entry is restored
-//! fingerprint-less with `vendor_inventory_unverified` — the legacy
-//! member-only state — never from the unverifiable live tree.
-
-use std::collections::{HashMap, HashSet};
-use std::path::{Path, PathBuf};
-
-use socket_patch_core::api::client::{get_api_client_with_overrides, ApiClient};
-use socket_patch_core::constants::SOCKET_DIR;
-use socket_patch_core::manifest::schema::{PatchManifest, PatchRecord};
-use socket_patch_core::patch::copy_tree::remove_tree;
-use socket_patch_core::utils::fs::read_regular_to_string;
-use socket_patch_core::utils::purl::{
-    normalize_purl, percent_decode_purl_component, strip_purl_qualifiers,
-};
-use socket_patch_core::vendor::state::{VendorArtifact, WiringRecord};
-use socket_patch_core::vendor::{
-    self, artifact_is_file_shaped, check_vendored_artifact, compute_dir_inventory, file_sha256_hex,
-    lock_inventory, parse_vendor_path, registry_fetch, ArtifactHealth, VendorEntry, VendorOutcome,
-    VendorState, VendorWarning,
-};
-use socket_patch_core::vex::time::now_rfc3339;
-
-use crate::args::GlobalArgs;
-use crate::commands::fetch_stage::{stage_vendor_sources_in_memory, MemStageOutcome};
-use crate::commands::vendor::{
-    dispatch_vendor_one, ecosystem_in_scope, fetch_pristine_package, persist_vendor_entry,
-    record_warning, PristineFetch,
-};
-use crate::ecosystem_dispatch::{find_packages_for_rollback, partition_purls};
-use crate::json_envelope::{Envelope, PatchAction, PatchEvent, RunWarning};
-use crate::ui::plural;
-
-/// One broken vendored unit queued for rebuild.
-struct Candidate {
-    purl: String,
-    entry: VendorEntry,
-    record: PatchRecord,
-    detached: bool,
-    /// True when the ledger entry was re-synthesized from a lockfile
-    /// reference (it must be persisted after a successful rebuild).
-    reconstructed: bool,
-    reason: &'static str,
-    /// True for a healthy-by-members RECONSTRUCTED entry with no
-    /// independent integrity anchor (dir-shaped trees; file artifacts no
-    /// npm-family lock records an integrity for): the live bytes must never
-    /// be fingerprinted into the restored ledger (trust-on-first-use), so
-    /// the fingerprint is derived from a member-verified local rebuild —
-    /// and every pre-rebuild failure falls back to a fingerprint-less
-    /// restore plus a `vendor_inventory_unverified` warning instead of a
-    /// hard failure (the artifact itself still verifies member-wise).
-    soft: bool,
-}
-
-/// Files the vendor backends rewire — the search space for
-/// `.socket/vendor/<eco>/<uuid>/<leaf>` references when the ledger is gone.
-/// The Python locks the root LISTS (`pylock*.toml`, `*.py.lock` + script)
-/// and the requirements `-r` include tree are appended at scan time.
-const WIRING_FILES: &[&str] = &[
-    "vlt-lock.json",
-    "package-lock.json",
-    "npm-shrinkwrap.json",
-    "pnpm-lock.yaml",
-    "yarn.lock",
-    "bun.lock",
-    "package.json",
-    "Cargo.toml",
-    "Cargo.lock",
-    // Pre-v5 vendored cargo wiring (migrated into Cargo.toml on re-run).
-    ".cargo/config.toml",
-    ".cargo/config",
-    "go.mod",
-    "composer.json",
-    "composer.lock",
-    "Gemfile",
-    "Gemfile.lock",
-    "uv.lock",
-    "pyproject.toml",
-    "poetry.lock",
-    "pdm.lock",
-    "Pipfile.lock",
-    "requirements.txt",
-];
-
-/// Scan the wiring-bearing files for vendored-artifact references,
-/// returning deduped `(ecosystem, uuid, artifact relpath)` triples. Pure
-/// text scan plus native binary Bun resolution records and the canonical
-/// path parser — the same recovery rule the CLI contract documents.
-pub(crate) async fn scan_vendor_references(project_root: &Path) -> Vec<(String, String, String)> {
-    let mut seen: HashSet<(String, String)> = HashSet::new();
-    let mut out = Vec::new();
-    if !project_root.join("bun.lock").exists() {
-        if let Ok(paths) =
-            socket_patch_core::vendor::bun_lock::binary_vendor_paths(project_root).await
-        {
-            for path in paths {
-                if let Some(parts) = parse_vendor_path(&path) {
-                    if seen.insert((parts.eco.to_string(), parts.uuid.clone())) {
-                        let rel =
-                            format!(".socket/vendor/{}/{}/{}", parts.eco, parts.uuid, parts.leaf);
-                        out.push((parts.eco, parts.uuid, rel));
-                    }
-                }
-            }
-        }
-    }
-
-    let mut files: Vec<String> = WIRING_FILES
-        .iter()
-        .map(|file| (*file).to_string())
-        .collect();
-    files.extend(vendor::vlt_lock::vlt_importer_package_jsons(project_root).await);
-    if let Ok(paths) = socket_patch_core::utils::python_lock::python_lock_paths(project_root) {
-        for path in paths {
-            if let Some(script) =
-                socket_patch_core::utils::python_lock::script_of_lock(&path).map(str::to_string)
-            {
-                files.push(script);
-            }
-            files.push(path);
-        }
-    }
-    // The requirements planner writes a vendored pin where the original pin
-    // was — possibly inside a `-r` include — so the root requirements.txt
-    // alone would miss it (and the orphan sweep, which reuses this scan,
-    // would delete the include-referenced wheel). An unreadable include
-    // tree degrades to the root file, matching the per-file tolerance
-    // below.
-    if let Ok(includes) = socket_patch_core::vendor::requirements_include_names(project_root).await
-    {
-        files.extend(includes);
-    }
-    files.sort();
-    files.dedup();
-    for file in files {
-        // FIFO-safe: a pipe under a wiring-file name must be skipped, not
-        // waited on forever in open(2).
-        let Ok(text) = read_regular_to_string(&project_root.join(file)).await else {
-            continue;
-        };
-        let mut rest = text.as_str();
-        while let Some(idx) = rest.find(".socket") {
-            let slice = &rest[idx..];
-            // `:` ends a reference too: pnpm snapshot keys are
-            // `name@file:<path>:` and yaml mappings suffix the path with a
-            // colon — npm names/versions never contain one.
-            let end = slice
-                .find([
-                    '"', '\'', '`', ' ', '\t', '\n', '\r', ',', ')', ']', '}', ';', ':',
-                ])
-                .unwrap_or(slice.len());
-            let candidate = slice[..end].replace('\\', "/");
-            if let Some(parts) = parse_vendor_path(&candidate) {
-                if seen.insert((parts.eco.to_string(), parts.uuid.clone())) {
-                    out.push((
-                        parts.eco.to_string(),
-                        parts.uuid.clone(),
-                        candidate.trim_start_matches("./").to_string(),
-                    ));
-                }
-            }
-            rest = &rest[idx + ".socket".len()..];
-        }
-    }
-    out.sort();
-    out
-}
-
-fn synth_entry(eco: &str, uuid: &str, artifact_path: &str, base_purl: &str) -> VendorEntry {
-    VendorEntry {
-        ecosystem: eco.to_string(),
-        base_purl: base_purl.to_string(),
-        uuid: uuid.to_string(),
-        artifact: VendorArtifact {
-            path: artifact_path.to_string(),
-            sha256: String::new(),
-            size: None,
-            platform_locked: None,
-            file_inventory: None,
-        },
-        wiring: Vec::new(),
-        lock: None,
-        took_over_go_patches: false,
-        detached: false,
-        record: None,
-        flavor: None,
-        uv: None,
-        pnpm: None,
-        poetry: None,
-        pdm: None,
-        pipenv: None,
-    }
-}
-
-/// The npm lockfile FLAVOR whose lock carries the
-/// `.socket/vendor/npm/<uuid>/` reference, for stamping onto a
-/// re-synthesized ledger entry. The strings are `VendorEntry::flavor`'s
-/// stable vocabulary (guarded by npm_flavor's `flavor_strings_are_stable`
-/// test). Stamping matters: `revert_npm_any` routes by flavor, and each
-/// backend's unwired-revert guard probes ITS OWN lockfile — a
-/// pnpm-reconstructed entry left at flavor-None would be guarded against
-/// package-lock.json instead of pnpm-lock.yaml. Locks are checked in the
-/// vendor router's own precedence order (vlt > bun > pnpm > yarn > npm) for the
-/// pathological multi-lock case; content sniffs mirror
-/// `detect_npm_lock_flavor` (crate-private to core, so re-derived here).
-/// `None` when genuinely unknowable — no recognizable lock carries the
-/// reference, or the referencing lock's grammar is unrecognized — which
-/// routes to the package-lock backend, whose guard also fails closed on
-/// unwired entries.
-async fn detect_reference_flavor(project_root: &Path, eco: &str, uuid: &str) -> Option<String> {
-    if eco == "pypi" {
-        let needle = format!(".socket/vendor/pypi/{uuid}/");
-        let mut files =
-            socket_patch_core::utils::python_lock::python_lock_paths(project_root).ok()?;
-        // uv.lock outranks the standalone locks (the vendor backend's own
-        // precedence): a pylock EXPORTED from the wired project lock must not
-        // relabel the entry `python-lock`. Alphabetical order would.
-        files.sort_by_key(|file| file != "uv.lock");
-        for file in files {
-            if read_regular_to_string(&project_root.join(&file))
-                .await
-                .ok()
-                .is_some_and(|text| text.contains(&needle))
-            {
-                return Some(
-                    if file == "uv.lock" {
-                        "uv"
-                    } else {
-                        "python-lock"
-                    }
-                    .to_string(),
-                );
-            }
-        }
-        return None;
-    }
-    if eco != "npm" {
-        return None;
-    }
-    let needle = format!(".socket/vendor/npm/{uuid}/");
-    let read = |name: &'static str| async move {
-        read_regular_to_string(&project_root.join(name)).await.ok()
-    };
-    if let Some(text) = read("vlt-lock.json").await {
-        if text.contains(&needle) {
-            return vendor::vlt_lock::vlt_lock_sniff_ok(&text).then(|| "vlt".to_string());
-        }
-    }
-    if read("bun.lock").await.is_some_and(|t| t.contains(&needle)) {
-        return Some("bun".to_string());
-    }
-    if !project_root.join("bun.lock").exists()
-        && socket_patch_core::vendor::bun_lock::binary_vendor_paths(project_root)
-            .await
-            .is_ok_and(|paths| paths.iter().any(|p| p.contains(&needle)))
-    {
-        return Some("bun".into());
-    }
-    if let Some(text) = read("pnpm-lock.yaml").await {
-        if text.contains(&needle) {
-            // Same version allowlist as core's `sniff_lock_grammar`.
-            return match text
-                .lines()
-                .find_map(|l| l.strip_prefix("lockfileVersion:"))
-                .map(|v| v.trim().trim_matches(['\'', '"']))
-            {
-                Some("9.0") => Some("pnpm".to_string()),
-                Some("5.4") | Some("6.0") => Some("pnpm-legacy".to_string()),
-                _ => None,
-            };
-        }
-    }
-    if let Some(text) = read("yarn.lock").await {
-        if text.contains(&needle) {
-            // Same head sniff as core's `sniff_yarn_lock` (BOM skipped,
-            // CRLF-tolerant); berry wins.
-            let head: Vec<&str> = text
-                .strip_prefix('\u{feff}')
-                .unwrap_or(&text)
-                .lines()
-                .take(30)
-                .collect();
-            return if head.iter().any(|l| l.starts_with("__metadata:")) {
-                Some("yarn-berry".to_string())
-            } else if head.iter().any(|l| l.trim() == "# yarn lockfile v1") {
-                Some("yarn-classic".to_string())
-            } else {
-                None
-            };
-        }
-    }
-    for name in ["npm-shrinkwrap.json", "package-lock.json"] {
-        if read(name).await.is_some_and(|t| t.contains(&needle)) {
-            return Some("package-lock".to_string());
-        }
-    }
-    None
-}
-
-/// What wiring a re-synthesized ledger entry could recover.
-enum WiringReconstruction {
-    /// The backend recognized its own wiring in the live project files:
-    /// full revert-capable records, plus any degradation notes to surface.
-    Wired(Vec<WiringRecord>, Vec<VendorWarning>),
-    /// No wiring recoverable — unsupported ecosystem, or files vendor's
-    /// grammar does not recognize. The entry keeps empty wiring and the
-    /// gap is surfaced loudly.
-    Unknown(String),
-}
-
-/// Per-ecosystem wiring reconstruction for a no-ledger repair. gem is the
-/// one ecosystem whose wiring is fully self-describing (the pair edit's
-/// originals are derivable from its own emitted forms); the npm family and
-/// the rest record pre-vendor REGISTRY integrity fragments that no offline
-/// source can reproduce — never guessed at.
-async fn reconstruct_entry_wiring(
-    project_root: &Path,
-    entry: &VendorEntry,
-) -> WiringReconstruction {
-    match entry.ecosystem.as_str() {
-        "gem" => match vendor::gem::reconstruct_gem_wiring(project_root, entry).await {
-            Ok((wiring, notes)) => WiringReconstruction::Wired(wiring, notes),
-            Err(detail) => WiringReconstruction::Unknown(detail),
-        },
-        _ => WiringReconstruction::Unknown(
-            "this ecosystem's pre-vendor lock fragments are not offline-recoverable".to_string(),
-        ),
-    }
-}
-
-/// Record one artifact that cannot be repaired. An error, so the line
-/// prints even under `--silent` (`json` mutes it: the envelope carries it).
-fn fail(env: &mut Envelope, json: bool, purl: &str, code: &str, detail: String) {
-    if !json {
-        eprintln!("{}", format_repair_failure(purl, &detail));
-    }
-    env.record(PatchEvent::new(PatchAction::Failed, purl.to_string()).with_error(code, detail));
-    env.mark_partial_failure();
-}
-
-/// Report every candidate whose patch content this run could not obtain:
-/// a soft one is restored without a fingerprint (counted as rebuilt), any
-/// other fails with its own reason code. Shared by the two staging arms —
-/// "nothing could be staged" (the whole pass ends here) and "these purls
-/// could not, while others staged fine" (the pass continues without them).
-/// `unrebuildable` names candidates that already failed earlier and must
-/// not be reported twice.
-fn report_no_local_source(
-    env: &mut Envelope,
-    common: &GlobalArgs,
-    candidates: &[Candidate],
-    unrebuildable: &HashSet<String>,
-    rebuilt: &mut usize,
-) {
-    for c in candidates {
-        if unrebuildable.contains(&c.purl) {
-            continue;
-        }
-        if c.soft {
-            soft_restore_without_fingerprint(
-                env,
-                common,
-                &c.purl,
-                &c.entry,
-                "its patch content has no local source to rebuild from",
-            );
-            *rebuilt += 1;
-            continue;
-        }
-        fail(
-            env,
-            common.json,
-            &c.purl,
-            c.reason,
-            format!(
-                "the vendored artifact at {} is broken and its patch content has \
-                 no local source ({})",
-                c.entry.artifact.path,
-                if common.offline {
-                    "--offline prevents fetching it"
-                } else {
-                    "download failed"
-                }
-            ),
-        );
-    }
-}
-
-/// `Error: Cannot repair vendored artifact for <purl>: <detail>`.
-fn format_repair_failure(purl: &str, detail: &str) -> String {
-    format!(
-        "Error: Cannot repair vendored artifact for {}: {detail}",
-        normalize_purl(purl)
-    )
-}
-
-/// The `repair --dry-run` preview of vendored rebuilds: a heading, then
-/// `  - <purl> (<why>: <path>)` per artifact. `items` are
-/// `(purl, reason code, artifact path)`.
-fn format_rebuild_preview(items: &[(String, &str, &str)]) -> Vec<String> {
-    let mut lines = vec![format!(
-        "Would rebuild {}:",
-        plural(items.len(), "vendored artifact", "vendored artifacts")
-    )];
-    lines.extend(items.iter().map(|(purl, reason, path)| {
-        format!("  - {purl} ({}: {path})", rebuild_reason_label(reason))
-    }));
-    lines
-}
-
-/// Plain words for a rebuild candidate's reason code.
-fn rebuild_reason_label(code: &str) -> &str {
-    match code {
-        "vendor_artifact_missing" => "missing",
-        "vendor_artifact_corrupt" => "corrupt",
-        "vendor_inventory_unverified" => "unverified",
-        other => other,
-    }
-}
-
-/// The npm-family lockfiles and the vlt importers' package.json files as
-/// they are now, for the unverified-source rebuild's put-back. Read through
-/// the FIFO-safe opener: a FIFO or device at one of these paths is left out
-/// of the snapshot at once instead of blocking the repair in open(2), like
-/// any other file that cannot be read.
-async fn snapshot_npm_wiring_files(cwd: &Path) -> Vec<(PathBuf, Option<Vec<u8>>)> {
-    let mut names: Vec<String> = [
-        "vlt-lock.json",
-        "package-lock.json",
-        "npm-shrinkwrap.json",
-        "pnpm-lock.yaml",
-        "yarn.lock",
-        "bun.lock",
-        "bun.lockb",
-    ]
-    .iter()
-    .map(|n| (*n).to_string())
-    .collect();
-    names.extend(vendor::vlt_lock::vlt_importer_package_jsons(cwd).await);
-    let mut snap = Vec::new();
-    for name in names {
-        let p = cwd.join(name);
-        if let Ok(bytes) = socket_patch_core::utils::fs::read_regular_to_bytes(&p).await {
-            snap.push((p, Some(bytes)));
-        }
-    }
-    snap
-}
-
-/// A soft (healthy-by-members, unanchored) reconstruction whose trustworthy
-/// rebuild cannot proceed: the entry stays restored WITHOUT a whole-file
-/// fingerprint — the legacy member-only state pass 1 keeps warning about
-/// (`vendor_inventory_missing` for gems) — and the gap is surfaced, instead
-/// of either failing the repair or canonizing the unverifiable live tree.
-/// The entry itself was already persisted by the pre-rebuild restore.
-fn soft_restore_without_fingerprint(
-    env: &mut Envelope,
-    common: &GlobalArgs,
-    purl: &str,
-    entry: &VendorEntry,
-    why: &str,
-) {
-    let artifact_path = entry.artifact.path.as_str();
-    // A vlt lock rewired to the vendored dir keeps no registry resolution,
-    // so `vendor` alone has no pristine copy to re-vendor from.
-    let remedy = if entry.flavor.as_deref() == Some(vendor::vlt_lock::FLAVOR) {
-        "restore the registry version spec in the package.json files that name the vendored \
-         dir, run `vlt install`, then run `socket-patch vendor` to re-vendor and record one"
-    } else {
-        "run `socket-patch vendor` to re-vendor and record one"
-    };
-    record_warning(
-        env,
-        purl,
-        &VendorWarning::new(
-            "vendor_inventory_unverified",
-            format!(
-                "the ledger entry was reconstructed but its artifact has no independent \
-                 integrity anchor and {why}; the entry was restored without a whole-file \
-                 fingerprint (only the patched members were verified) — {remedy}"
-            ),
-        ),
-        common,
-    );
-    env.record(
-        PatchEvent::new(PatchAction::Rebuilt, purl.to_string()).with_details(serde_json::json!({
-            "path": artifact_path,
-            "ledgerRestored": true,
-            "artifactRebuilt": false,
-        })),
-    );
-}
-
-/// `vendor_wiring_unknown` advises about what a FUTURE `vendor --revert`
-/// can restore — the entry itself was restored/verified fine, so the
-/// advisory rides the envelope's run-level `warnings[]` (the documented
-/// carrier for non-fatal advisories) rather than a per-purl `skipped`
-/// event, which consumers count as work not done. The purl is baked into
-/// `detail` by the callers so attribution survives the run-level move.
-fn warn_wiring_unknown(env: &mut Envelope, common: &GlobalArgs, detail: String) {
-    if !common.silent && !common.json {
-        eprintln!("Warning (vendor_wiring_unknown): {detail}");
-    }
-    env.warnings.push(RunWarning {
-        code: "vendor_wiring_unknown".to_string(),
-        detail,
-    });
-}
-
-/// Best-effort removal of a vendored uuid dir after a failed post-verify
-/// (never leave unverifiable bytes behind). Prunes the emptied
-/// `.socket/vendor/<eco>/` (and `vendor/`) husks like every other artifact
-/// removal, stopping at `.socket/`; a sibling unit or the ledger keeps them.
-async fn remove_vendor_dir(cwd: &Path, eco: &str, uuid: &str) {
-    if let Some(rel) = vendor::path::vendor_uuid_dir_rel(eco, uuid) {
-        let _ = socket_patch_core::utils::socket_dir::remove_tree_and_prune(
-            &cwd.join(rel),
-            &cwd.join(SOCKET_DIR),
-        )
-        .await;
-    }
-}
-
-/// Move the live uuid dir aside (same parent, `<uuid>.pre-rebuild`) so the
-/// backends' rebuild-on-MISSING trigger fires while the bytes stay
-/// recoverable: the dispatch can still refuse or fail — the in-hand
-/// installed copy may itself be broken in ways no pre-rebuild rung probes
-/// — and a failed dispatch replaced nothing, so the artifact
-/// (member-healthy for a soft candidate, corrupt-but-diagnosable for a
-/// pass-1 one) must be restorable instead of leaving the wired lockfiles
-/// pointing at a bare ENOENT (see the NOTE above the staging step).
-/// Returns `(live, kept)` for [`restore_aside_vendor_dir`]; on a rename
-/// failure falls back to plain removal (the rebuild trigger must fire)
-/// and returns `None`.
-async fn set_aside_vendor_dir(cwd: &Path, eco: &str, uuid: &str) -> Option<(PathBuf, PathBuf)> {
-    let rel = vendor::path::vendor_uuid_dir_rel(eco, uuid)?;
-    let live = cwd.join(&rel);
-    let kept = cwd.join(format!("{rel}.pre-rebuild"));
-    // A crashed earlier run's leftover must not wedge the rename.
-    let _ = remove_tree(&kept).await;
-    if tokio::fs::rename(&live, &kept).await.is_ok() {
-        Some((live, kept))
-    } else {
-        let _ = remove_tree(&live).await;
-        None
-    }
-}
-
-/// Put the pre-rebuild bytes back after a dispatch that produced no
-/// replacement (clearing any partial husk the failed backend left first).
-async fn restore_aside_vendor_dir(live: &Path, kept: &Path) {
-    let _ = remove_tree(live).await;
-    let _ = tokio::fs::rename(kept, live).await;
-}
-
-/// Crash recovery for [`set_aside_vendor_dir`]'s transient: a run killed
-/// between the move-aside and the backend's replacement leaves
-/// `.socket/vendor/<eco>/<uuid>.pre-rebuild` as the ONLY copy of bytes the
-/// rewired lockfiles still point at, with the live path a bare ENOENT. Put
-/// every such leftover back where the wiring expects it before pass 1
-/// classifies the unit (it then re-derives corrupt/soft/healthy from the
-/// restored bytes exactly as the crashed run did). A leftover whose live
-/// sibling EXISTS is left alone: the live dir may be the completed
-/// replacement or a partial husk, and only the health pass can tell — a
-/// unit it condemns is set aside again, which clears the leftover. Wet
-/// runs only; scope-gated like every other unit; best-effort throughout.
-async fn restore_orphaned_pre_rebuild_dirs(common: &GlobalArgs) {
-    const SUFFIX: &str = ".pre-rebuild";
-    let vendor_root = common.cwd.join(".socket/vendor");
-    let Ok(mut ecos) = tokio::fs::read_dir(&vendor_root).await else {
-        return;
-    };
-    while let Ok(Some(eco_dir)) = ecos.next_entry().await {
-        let eco = eco_dir.file_name().to_string_lossy().into_owned();
-        if !ecosystem_in_scope(common, &eco) || !eco_dir.path().is_dir() {
-            continue;
-        }
-        let Ok(mut units) = tokio::fs::read_dir(eco_dir.path()).await else {
-            continue;
-        };
-        while let Ok(Some(unit)) = units.next_entry().await {
-            let name = unit.file_name().to_string_lossy().into_owned();
-            let Some(uuid) = name.strip_suffix(SUFFIX) else {
-                continue;
-            };
-            let live = eco_dir.path().join(uuid);
-            if unit.path().is_dir() && tokio::fs::symlink_metadata(&live).await.is_err() {
-                let _ = tokio::fs::rename(unit.path(), &live).await;
-            }
-        }
-    }
-}
-
-/// The vendored-artifact phase of `repair`. Runs between the download and
-/// cleanup phases (and under `--download-only` — restoring artifacts IS
-/// repair's job). `manifest` is `None` when the project has no
-/// `.socket/manifest.json` (detached/reconstruction-only repairs).
-/// Returns the number of artifacts rebuilt (for the human summary line);
-/// failures are carried by `env` (`Failed` events + partial-failure status).
-///
-/// `references` is [`scan_vendor_references`]'s `(ecosystem, uuid,
-/// artifact relpath)` output for `common.cwd` and `ledger` the caller's
-/// `load_state` outcome — both taken by repair.rs under the apply lock
-/// this phase runs under (the lockfiles and ledger they describe are the
-/// ones the reconstruction below rewires), so neither is re-read here. An
-/// unreadable ledger fails this phase loudly (`vendor_state_unreadable`);
-/// the caller's own degrade-to-empty policy for its download scoping is
-/// its own. `run_client` is the run's API client when the caller already
-/// built one (repair.rs's lazily built download-phase `client`): the uuid lookups and the
-/// staging fetch reuse it instead of constructing a second (or third) one
-/// and re-printing its token advisory; `None` builds lazily on first need.
-pub(crate) async fn repair_vendored_artifacts_with_references(
-    common: &GlobalArgs,
-    manifest: Option<&PatchManifest>,
-    socket_dir: &Path,
-    env: &mut Envelope,
-    references: &[(String, String, String)],
-    ledger: std::io::Result<VendorState>,
-    run_client: Option<&ApiClient>,
-) -> usize {
-    let quiet = common.json || common.silent;
-    let mut rebuilt = 0usize;
-
-    if !common.dry_run {
-        restore_orphaned_pre_rebuild_dirs(common).await;
-    }
-
-    let mut state = match ledger {
-        Ok(s) => s,
-        Err(e) => {
-            // Errors print even under --silent; without this line the
-            // run exits 1 after a clean-looking repair report.
-            if !common.json {
-                eprintln!(
-                    "{}",
-                    crate::commands::vendor::format_state_unreadable(&e.to_string())
-                );
-            }
-            env.record(
-                PatchEvent::artifact(PatchAction::Failed)
-                    .with_error("vendor_state_unreadable", e.to_string()),
-            );
-            env.mark_partial_failure();
-            return rebuilt;
-        }
-    };
-
-    // ── Pass 1: ledger-driven health check ───────────────────────────────
-    // Shared across both passes so the API client (and its one-time
-    // token-shape stderr advisory) is constructed at most once per run —
-    // seeded from the run's client when the caller has one.
-    let mut api_client: Option<ApiClient> = run_client.cloned();
-    let mut candidates: Vec<Candidate> = Vec::new();
-    let mut ledger_purls: Vec<String> = state.entries.keys().cloned().collect();
-    ledger_purls.sort();
-    for purl in &ledger_purls {
-        let entry = state.entries[purl].clone();
-        if !ecosystem_in_scope(common, &entry.ecosystem) {
-            continue;
-        }
-        // `detached` is the "no manifest owner" flag. The manifest-driven
-        // standalone `vendor` embeds the record too, so an embedded record
-        // does not imply detached: a manifest-owned entry keeps taking the
-        // manifest's record (a manifest that moved on to a newer patch uuid
-        // must still surface as vendor_uuid_mismatch below, never repair the
-        // stale artifact from the embedded copy), and the embedded copy
-        // stands in only when there is no manifest at all.
-        let record = match (entry.detached, &entry.record, manifest) {
-            (true, Some(r), _) => r.clone(),
-            (_, _, Some(m)) => {
-                match m
-                    .patches
-                    .get(purl)
-                    .cloned()
-                    .or_else(|| m.patches.values().find(|r| r.uuid == entry.uuid).cloned())
-                {
-                    Some(r) => r,
-                    // Dropped from the manifest: the vendor reconcile owns
-                    // reverting it — not repair's call.
-                    None => continue,
-                }
-            }
-            // No manifest at all: the embedded copy, else (a ledger written
-            // before standalone `vendor` embedded records) recover the record
-            // from the API below, like a reconstruction.
-            (_, Some(r), None) => r.clone(),
-            (_, None, None) => {
-                match fetch_record_by_uuid(common, &mut api_client, &entry.uuid).await {
-                    Some((_, r)) => r,
-                    None => {
-                        fail(
-                            env,
-                            common.json,
-                            purl,
-                            "vendor_artifact_unrepairable",
-                            format!(
-                                "no manifest record for patch {} and the patch view could not \
-                             be fetched (offline or API failure)",
-                                entry.uuid
-                            ),
-                        );
-                        continue;
-                    }
-                }
-            }
-        };
-        if record.uuid != entry.uuid {
-            env.record(
-                PatchEvent::new(PatchAction::Skipped, purl.clone()).with_reason(
-                    "vendor_uuid_mismatch",
-                    "the manifest's patch uuid moved on; run `socket-patch vendor` (or \
-                     `scan --mode vendored`) to re-vendor",
-                ),
-            );
-            continue;
-        }
-        // Pre-v5 cargo wiring in `.cargo/config*`: move it into the root
-        // Cargo.toml (the v5 location) and record the move in the ledger —
-        // or restore the manifest entry a pre-v5 multi-version vendor lost —
-        // and tag an untagged copy + lock entry with the patch uuid.
-        let entry = if entry.ecosystem == "cargo" {
-            match vendor::cargo::migrate_legacy_wiring(&entry, &common.cwd, common.dry_run).await {
-                Ok(Some((migrated, warnings))) => {
-                    for warning in &warnings {
-                        record_warning(env, purl, warning, common);
-                    }
-                    if common.dry_run {
-                        entry
-                    } else if persist_vendor_entry(
-                        common,
-                        env,
-                        &mut state,
-                        purl,
-                        migrated.clone(),
-                        entry.detached,
-                        &record,
-                    )
-                    .await
-                    {
-                        continue;
-                    } else {
-                        migrated
-                    }
-                }
-                Ok(None) => entry,
-                Err(detail) => {
-                    record_warning(
-                        env,
-                        purl,
-                        &VendorWarning::new(
-                            "cargo_legacy_wiring_kept",
-                            format!(
-                                "the vendored wiring for {} could not be written into \
-                                 Cargo.toml ({detail}); any pre-v5 .cargo/config wiring was \
-                                 left in place",
-                                normalize_purl(purl)
-                            ),
-                        ),
-                        common,
-                    );
-                    entry
-                }
-            }
-        } else {
-            entry
-        };
-        let health = check_vendored_artifact(&common.cwd, &entry, &record).await;
-        if health == ArtifactHealth::Healthy || workspace_copy_issue(&health) {
-            let mut healed = entry.clone();
-            match repair_workspace_copies(&common.cwd, &mut healed, common.dry_run).await {
-                Ok(true) => {
-                    if common.dry_run {
-                        env.record(
-                            PatchEvent::new(PatchAction::Verified, purl.clone()).with_details(
-                                serde_json::json!({
-                                    "vendorArtifact": true, "wouldRestoreWorkspaceArtifacts": true,
-                                }),
-                            ),
-                        );
-                    } else if !persist_vendor_entry(
-                        common,
-                        env,
-                        &mut state,
-                        purl,
-                        healed,
-                        entry.detached,
-                        &record,
-                    )
-                    .await
-                    {
-                        env.record(
-                            PatchEvent::new(PatchAction::Rebuilt, purl.clone()).with_details(
-                                serde_json::json!({
-                                    "path": entry.artifact.path, "workspaceArtifactsRestored": true,
-                                    "artifactRebuilt": false,
-                                }),
-                            ),
-                        );
-                        rebuilt += 1;
-                    }
-                    continue;
-                }
-                Ok(false) => {}
-                Err(detail) => {
-                    fail(
-                        env,
-                        common.json,
-                        purl,
-                        "vendor_artifact_unrepairable",
-                        detail,
-                    );
-                    continue;
-                }
-            }
-            if workspace_copy_issue(&health) {
-                continue;
-            }
-        }
-        match health {
-            ArtifactHealth::Healthy => {
-                // vlt's `<uuid>/.gitignore` and `.gitattributes` are not
-                // part of the artifact: a missing or edited one is simply
-                // rewritten.
-                if entry.ecosystem == "npm"
-                    && entry.flavor.as_deref() == Some(vendor::vlt_lock::FLAVOR)
-                    && !common.dry_run
-                {
-                    if let Err(e) =
-                        vendor::vlt_lock::restore_vlt_uuid_metadata(&entry, &common.cwd).await
-                    {
-                        fail(
-                            env,
-                            common.json,
-                            purl,
-                            "vendor_artifact_unrepairable",
-                            format!("cannot restore the vendored dir's .gitignore: {e}"),
-                        );
-                        continue;
-                    }
-                }
-                // Dir-shaped artifacts from pre-inventory vendors: the
-                // health check above could only verify the PATCHED members
-                // — unpatched-file drift is invisible until a re-vendor
-                // records the whole-tree inventory. Name the gap for gem
-                // only: vlt also records inventories but has no
-                // pre-inventory entries to warn about, and the other
-                // dir-shaped backends (cargo/golang/composer) don't record
-                // one, so a re-vendor there records nothing and the advice
-                // would be permanent per-run noise.
-                if entry.ecosystem == "gem"
-                    && !artifact_is_file_shaped(&entry.artifact.path)
-                    && entry.artifact.file_inventory.is_none()
-                {
-                    record_warning(
-                        env,
-                        purl,
-                        &VendorWarning::new(
-                            "vendor_inventory_missing",
-                            format!(
-                                "the ledger entry for {} records no file inventory \
-                                 (pre-inventory vendor); only the patched members were \
-                                 verified — re-vendor to make unpatched-file drift \
-                                 detectable",
-                                normalize_purl(purl)
-                            ),
-                        ),
-                        common,
-                    );
-                }
-                // Empty-wiring gem entries (pre-reconstruction repairs
-                // persisted these): backfill full revert-capable wiring
-                // from the live pair via the same recognizers the
-                // no-ledger reconstruction trusts, so `vendor --revert`
-                // stops refusing with manual cleanup steps.
-                if entry.ecosystem == "gem" && entry.wiring.is_empty() {
-                    match vendor::gem::reconstruct_gem_wiring(&common.cwd, &entry).await {
-                        Ok((wiring, notes)) => {
-                            if common.dry_run {
-                                env.record(
-                                    PatchEvent::new(PatchAction::Verified, purl.clone())
-                                        .with_details(serde_json::json!({
-                                            "vendorArtifact": true,
-                                            "wouldRestoreWiring": true,
-                                        })),
-                                );
-                                continue;
-                            }
-                            for w in &notes {
-                                record_warning(env, purl, w, common);
-                            }
-                            let mut healed = entry.clone();
-                            healed.wiring = wiring;
-                            let detached = healed.detached;
-                            if persist_vendor_entry(
-                                common, env, &mut state, purl, healed, detached, &record,
-                            )
-                            .await
-                            {
-                                continue;
-                            }
-                            env.record(
-                                PatchEvent::new(PatchAction::Rebuilt, purl.clone()).with_details(
-                                    serde_json::json!({
-                                        "path": entry.artifact.path,
-                                        "wiringRestored": true,
-                                        "artifactRebuilt": false,
-                                    }),
-                                ),
-                            );
-                            rebuilt += 1;
-                        }
-                        Err(detail) => {
-                            warn_wiring_unknown(
-                                env,
-                                common,
-                                format!(
-                                    "the ledger entry for {} records no pre-vendor wiring \
-                                     originals and they cannot be reconstructed from the \
-                                     live files ({detail}); `vendor --revert` cannot \
-                                     restore the project files for this entry",
-                                    normalize_purl(purl)
-                                ),
-                            );
-                        }
-                    }
-                }
-            }
-            ArtifactHealth::StaleUuid => {
-                env.record(
-                    PatchEvent::new(PatchAction::Skipped, purl.clone()).with_reason(
-                        "vendor_uuid_mismatch",
-                        "a re-vendor is pending for this package; run `socket-patch vendor`",
-                    ),
-                );
-            }
-            ArtifactHealth::Unverifiable { reason } => {
-                fail(
-                    env,
-                    common.json,
-                    purl,
-                    "vendor_artifact_unrepairable",
-                    format!("the ledger entry cannot be verified ({reason}); fix state.json"),
-                );
-            }
-            ArtifactHealth::UnknownFlavor { flavor } => {
-                record_warning(
-                    env,
-                    purl,
-                    &VendorWarning::new(
-                        "vendor_wiring_unknown_revert_blocked",
-                        format!(
-                            "{} was vendored for the npm flavor `{flavor}`, which this \
-                             socket-patch release does not understand; left untouched — \
-                             upgrade socket-patch",
-                            normalize_purl(purl)
-                        ),
-                    ),
-                    common,
-                );
-            }
-            health @ (ArtifactHealth::Missing | ArtifactHealth::Corrupt { .. }) => {
-                let reason = if matches!(health, ArtifactHealth::Missing) {
-                    "vendor_artifact_missing"
-                } else {
-                    "vendor_artifact_corrupt"
-                };
-                let detached = entry.detached;
-                candidates.push(Candidate {
-                    purl: purl.clone(),
-                    entry,
-                    record,
-                    detached,
-                    reconstructed: false,
-                    reason,
-                    soft: false,
-                });
-            }
-        }
-    }
-
-    // ── Pass 2: lockfile references with no ledger coverage ─────────────
-    let covered: HashSet<(String, String)> = state
-        .entries
-        .values()
-        .map(|e| (e.ecosystem.clone(), e.uuid.clone()))
-        .collect();
-    for (eco, uuid, relpath) in references.iter().cloned() {
-        if covered.contains(&(eco.clone(), uuid.clone())) || !ecosystem_in_scope(common, &eco) {
-            continue;
-        }
-        // The record: manifest by uuid first, else the patch API (the entry
-        // is then detached — exactly the manifest-less vendoring shape).
-        let (purl, record, detached) =
-            match manifest.and_then(|m| m.patches.iter().find(|(_, r)| r.uuid == uuid)) {
-                Some((p, r)) => (p.clone(), r.clone(), false),
-                None => match fetch_record_by_uuid(common, &mut api_client, &uuid).await {
-                    Some((purl, r)) => (purl, r, true),
-                    None => {
-                        fail(
-                            env,
-                            common.json,
-                            &format!("pkg:{eco}/unknown@{uuid}"),
-                            "vendor_artifact_missing",
-                            format!(
-                                "the lockfile references .socket/vendor/{eco}/{uuid}/ but the \
-                             vendor ledger is gone and the patch view could not be fetched \
-                             (offline or API failure); restore .socket/vendor/state.json or \
-                             re-run online"
-                            ),
-                        );
-                        continue;
-                    }
-                },
-            };
-        let mut entry = synth_entry(&eco, &uuid, &relpath, strip_purl_qualifiers(&purl));
-        // Stamp the flavor the reference was found in (knowable right here:
-        // the scan above read specific lockfiles), so `vendor --revert`
-        // routes to the backend whose unwired-revert guard probes the RIGHT
-        // lockfile. Genuinely unknowable stays None (guarded fallback).
-        entry.flavor = detect_reference_flavor(&common.cwd, &eco, &uuid).await;
-        entry.detached = detached;
-        if detached {
-            entry.record = Some(record.clone());
-        }
-        // Wiring reconstruction (fail-closed): gem rebuilds full
-        // revert-capable records from its own recognizable pair edit; the
-        // rest keep empty wiring with the gap surfaced loudly — reverting
-        // such an entry cannot restore the project files.
-        match reconstruct_entry_wiring(&common.cwd, &entry).await {
-            WiringReconstruction::Wired(wiring, notes) => {
-                entry.wiring = wiring;
-                for w in &notes {
-                    record_warning(env, &purl, w, common);
-                }
-            }
-            WiringReconstruction::Unknown(detail) => {
-                warn_wiring_unknown(
-                    env,
-                    common,
-                    format!(
-                        "the ledger entry for {} was reconstructed without pre-vendor \
-                         wiring originals ({detail}); `vendor --revert` cannot restore \
-                         the project files for this entry",
-                        normalize_purl(&purl)
-                    ),
-                );
-            }
-        }
-        match check_vendored_artifact(&common.cwd, &entry, &record).await {
-            health if health == ArtifactHealth::Healthy || workspace_copy_issue(&health) => {
-                // The re-synthesized entry records no sha256/fileInventory,
-                // so the health check above verified only the patched
-                // members — whole-file drift (an altered UNPATCHED member)
-                // is invisible to it. The live bytes must therefore NEVER be
-                // fingerprinted into the restored ledger: that would be
-                // trust-on-first-use, canonizing a tampered tree that later
-                // repairs enforce and VEX attests. Only an INDEPENDENT
-                // anchor can vouch for the exact bytes — the rewired
-                // npm-family lockfile integrity, when one records this
-                // artifact. A "surviving" artifact that no longer matches it
-                // leaves the package manager broken, so it must be rebuilt,
-                // never blessed into the reconstructed ledger.
-                let mut anchored = false;
-                if let Some(wired) =
-                    lock_inventory::wired_vendor_integrity(&common.cwd, &entry.artifact.path).await
-                {
-                    let name = npm_coords(&entry.base_purl)
-                        .map(|(n, _)| n)
-                        .unwrap_or_default();
-                    let intact = match tokio::fs::read(common.cwd.join(&entry.artifact.path)).await
-                    {
-                        Ok(bytes) => {
-                            registry_fetch::artifact_matches_integrity(&bytes, &name, &wired)
-                                .is_ok()
-                        }
-                        Err(_) => false,
-                    };
-                    if !intact {
-                        candidates.push(Candidate {
-                            purl,
-                            entry,
-                            record,
-                            detached,
-                            reconstructed: true,
-                            reason: "vendor_artifact_corrupt",
-                            soft: false,
-                        });
-                        continue;
-                    }
-                    anchored = true;
-                }
-                if common.dry_run {
-                    let mut details = serde_json::json!({
-                        "vendorArtifact": true,
-                        "wouldRestoreLedgerEntry": true,
-                        "path": relpath,
-                    });
-                    if workspace_copy_issue(&health) {
-                        details["wouldRestoreWorkspaceArtifacts"] = serde_json::Value::Bool(true);
-                    }
-                    if !anchored {
-                        // The fingerprint would come from a rebuild, never
-                        // the live tree.
-                        details["wouldRebuild"] = serde_json::Value::Bool(true);
-                    }
-                    env.record(
-                        PatchEvent::new(PatchAction::Verified, purl.clone()).with_details(details),
-                    );
-                    continue;
-                }
-                if anchored {
-                    // The artifact bytes are exactly what the rewired
-                    // lockfile's integrity records; only the ledger was
-                    // lost. Restore the entry (sha/size recomputed from the
-                    // VERIFIED bytes) so GC/sweep/revert know the artifact
-                    // again — without it the next `scan --prune` would sweep
-                    // the uuid dir as an orphan.
-                    fill_artifact_fingerprint(&common.cwd, &mut entry).await;
-                    if let Err(detail) =
-                        repair_workspace_copies(&common.cwd, &mut entry, false).await
-                    {
-                        fail(
-                            env,
-                            common.json,
-                            &purl,
-                            "vendor_artifact_unrepairable",
-                            detail,
-                        );
-                        continue;
-                    }
-                    let save_failed = persist_vendor_entry(
-                        common, env, &mut state, &purl, entry, detached, &record,
-                    )
-                    .await;
-                    if save_failed {
-                        continue;
-                    }
-                    env.record(
-                        PatchEvent::new(PatchAction::Rebuilt, purl.clone()).with_details(
-                            serde_json::json!({
-                                "path": relpath,
-                                "ledgerRestored": true,
-                                "artifactRebuilt": false,
-                            }),
-                        ),
-                    );
-                    rebuilt += 1;
-                    continue;
-                }
-                // No anchor (dir-shaped trees — gem, cargo —, file
-                // artifacts absent from every npm-family lock): queue a
-                // SOFT rebuild. The canonical fingerprint is derived from a
-                // member-verified local rebuild (pristine source + the
-                // recorded patch, the same dispatch as every other rebuild
-                // here); when no trustworthy pristine source exists the
-                // entry is restored WITHOUT a fingerprint — the legacy
-                // member-only state pass 1 keeps warning about — instead of
-                // canonizing the live tree.
-                candidates.push(Candidate {
-                    purl,
-                    entry,
-                    record,
-                    detached,
-                    reconstructed: true,
-                    reason: "vendor_inventory_unverified",
-                    soft: true,
-                });
-            }
-            ArtifactHealth::Unverifiable { reason }
-                if reason == "vendor_workspace_artifact_invalid" =>
-            {
-                fail(env, common.json, &purl, "vendor_artifact_unrepairable",
-                    "workspace tarball paths cannot be validated; fix the binary lock or symbolic links before repairing".into());
-            }
-            _ => {
-                candidates.push(Candidate {
-                    purl,
-                    entry,
-                    record,
-                    detached,
-                    reconstructed: true,
-                    reason: "vendor_artifact_missing",
-                    soft: false,
-                });
-            }
-        }
-    }
-
-    if candidates.is_empty() {
-        return rebuilt;
-    }
-
-    // ── Dry run: preview only ────────────────────────────────────────────
-    if common.dry_run {
-        if !quiet {
-            let items: Vec<(String, &str, &str)> = candidates
-                .iter()
-                .map(|c| {
-                    let purl = normalize_purl(&c.purl).into_owned();
-                    (purl, c.reason, c.entry.artifact.path.as_str())
-                })
-                .collect();
-            println!();
-            for line in format_rebuild_preview(&items) {
-                println!("{line}");
-            }
-        }
-        for c in &candidates {
-            env.record(
-                PatchEvent::new(PatchAction::Verified, c.purl.clone()).with_details(
-                    serde_json::json!({
-                        "vendorArtifact": true,
-                        "wouldRebuild": true,
-                        "reason": c.reason,
-                        "path": c.entry.artifact.path,
-                    }),
-                ),
-            );
-        }
-        return rebuilt;
-    }
-
-    if !quiet {
-        println!();
-        println!(
-            "Rebuilding {}...",
-            plural(
-                candidates.len(),
-                "broken vendored artifact",
-                "broken vendored artifacts"
-            )
-        );
-    }
-
-    // ── Soft reconstructions: restore the ledger entry FIRST ─────────────
-    // Fingerprint-less: the restore must survive even when no trustworthy
-    // rebuild source turns up below, and the fingerprint slot is only ever
-    // refilled from a member-verified rebuild — never the live tree. The
-    // early persist also lets the rebuild's own persist carry the
-    // reconstructed wiring originals forward by identity.
-    let mut unrebuildable: HashSet<String> = HashSet::new();
-    for c in &candidates {
-        if c.soft
-            && persist_vendor_entry(
-                common,
-                env,
-                &mut state,
-                &c.purl,
-                c.entry.clone(),
-                c.detached,
-                &c.record,
-            )
-            .await
-        {
-            // The state write failed (Failed event already recorded):
-            // nothing below could persist either.
-            unrebuildable.insert(c.purl.clone());
-        }
-    }
-
-    // NOTE: corrupt artifacts are NOT deleted here. Clearing waits until
-    // the rebuild loop below, where the patch sources and a pristine
-    // package source are both in hand (and even there it is a MOVE-ASIDE,
-    // restored when the dispatch fails) — see the comment there. Destroying
-    // the corrupt copy before the rebuild-source ladder runs would, on any
-    // no-source outcome (--offline, node_modules gone, fetch failure),
-    // convert a corrupt-but-diagnosable integrity-mismatch state into a
-    // bare ENOENT on the next install (the lock still points at the
-    // artifact) and erase the forensic evidence of the tamper.
-
-    // ── Patch content (in memory, like all vendor flows) ────────────────
-    let records_map: HashMap<String, PatchRecord> = candidates
-        .iter()
-        .map(|c| (c.purl.clone(), c.record.clone()))
-        .collect();
-    let synth = PatchManifest {
-        patches: records_map,
-        setup: None,
-    };
-    // The ledger this pass already holds feeds the staging harvest; repair's
-    // download phase writes blobs to disk (harvested from socket_dir), so
-    // there is no in-memory seed.
-    let staged = match stage_vendor_sources_in_memory(
-        common,
-        &synth,
-        socket_dir,
-        &common.cwd,
-        Ok(&state.entries),
-        HashMap::new(),
-        api_client.as_ref(),
-    )
-    .await
-    {
-        MemStageOutcome::Ready(s) => s,
-        MemStageOutcome::Unavailable => {
-            report_no_local_source(env, common, &candidates, &unrebuildable, &mut rebuilt);
-            return rebuilt;
-        }
-    };
-    // Staging could obtain SOME candidates' content but not others'. The
-    // ones it could not get the same report the all-unavailable arm above
-    // gives, and leave the pass; the rest are still rebuilt.
-    if !staged.unavailable().is_empty() {
-        let (stuck, rest): (Vec<Candidate>, Vec<Candidate>) = candidates
-            .into_iter()
-            .partition(|c| staged.unavailable().iter().any(|(purl, _)| purl == &c.purl));
-        report_no_local_source(env, common, &stuck, &unrebuildable, &mut rebuilt);
-        candidates = rest;
-        if candidates.is_empty() {
-            return rebuilt;
-        }
-    }
-    let sources = staged.as_patch_sources();
-
-    // ── Pristine package sources ─────────────────────────────────────────
-    let purls: Vec<String> = candidates.iter().map(|c| c.purl.clone()).collect();
-    let partitioned = partition_purls(&purls, common.ecosystems.as_deref());
-    let crawler_options = common.crawler_options();
-    // Ledger keys are the manifest spelling — QUALIFIED for release-variant
-    // ecosystems (gem `?platform=`, pypi `?artifact_id=`, maven
-    // `?classifier=&ext=`) — while the crawler knows only base purls. A
-    // base-keyed result map would make the `contains_key(&c.purl)` checks
-    // below miss every installed
-    // qualified-key package and fall through to a needless registry fetch
-    // (or, offline, a spurious unrepairable / fingerprint-less restore).
-    // The rollback variant fans each base path back out to every qualified
-    // caller purl — the same fix `vendor_records` carries.
-    let mut all_packages = find_packages_for_rollback(&partitioned, &crawler_options, quiet).await;
-    crate::commands::vendor::drop_vendored_installs(&common.cwd, &mut all_packages);
-    let inventory = lock_inventory::inventory_project(&common.cwd).await;
-    let client = registry_fetch::build_registry_client();
-    let mut holders: Vec<registry_fetch::FetchedPackage> = Vec::new();
-    // Reconstructed npm candidates fetched UNVERIFIED from the conventional
-    // registry: their rebuilt tarball MUST match the integrity the rewired
-    // lockfile records (the trust anchor) before anything is persisted.
-    let mut must_verify: HashMap<String, lock_inventory::LockIntegrity> = HashMap::new();
-    for c in &candidates {
-        if unrebuildable.contains(&c.purl) {
-            continue;
-        }
-        if all_packages.contains_key(&c.purl) {
-            // Installed copy: works offline too. But for a RECONSTRUCTED
-            // entry the copy is an unverified source — the ledger that
-            // recorded the artifact sha is gone, so the rewired lockfile's
-            // integrity is the ONLY trust anchor. A copy that drifted since
-            // vendoring (build-tool artifacts, edited unpatched files) packs
-            // into a tarball the package manager would reject on its next
-            // install; register the wired integrity so the rebuilt artifact
-            // is verified below, exactly like the unverified-registry rung.
-            if c.reconstructed {
-                if let Some(wired) =
-                    lock_inventory::wired_vendor_integrity(&common.cwd, &c.entry.artifact.path)
-                        .await
-                {
-                    must_verify.insert(c.purl.clone(), wired);
-                }
-            }
-            continue;
-        }
-        if common.offline {
-            if c.soft {
-                soft_restore_without_fingerprint(
-                    env,
-                    common,
-                    &c.purl,
-                    &c.entry,
-                    "the package is not installed and --offline prevents fetching a \
-                     pristine copy to rebuild from",
-                );
-                rebuilt += 1;
-            } else {
-                fail(
-                    env,
-                    common.json,
-                    &c.purl,
-                    c.reason,
-                    format!(
-                        "the vendored artifact at {} is broken, the package is not installed, \
-                         and --offline prevents fetching a pristine copy",
-                        c.entry.artifact.path
-                    ),
-                );
-            }
-            unrebuildable.insert(c.purl.clone());
-            continue;
-        }
-        let pristine =
-            fetch_pristine_package(&common.cwd, &inventory, &client, &c.purl, Some(&c.entry)).await;
-        // The `Unverifiable` reason carries the precise, fragment-aware cause
-        // (e.g. a pdm/poetry/pipenv lock records the wheel hash but no fetchable
-        // registry URL) — surface it instead of the blanket "no recoverable
-        // registry fragment", which falsely implies the ledger recorded nothing.
-        let unverifiable_reason = match &pristine {
-            PristineFetch::Unverifiable(d) => Some(d.clone()),
-            _ => None,
-        };
-        match pristine {
-            // Repair always rebuilds locally, so the pristine tree is read
-            // either way: materialise it right here, where an extraction
-            // failure is still the fetch failure it was before the write
-            // moved off the fetch.
-            PristineFetch::Fetched(fetched) => {
-                match fetched.dir().await.map(std::path::Path::to_path_buf) {
-                    Ok(dir) => {
-                        all_packages.insert(c.purl.clone(), dir);
-                        holders.push(fetched);
-                    }
-                    Err(detail) => {
-                        if c.soft {
-                            soft_restore_without_fingerprint(
-                                env,
-                                common,
-                                &c.purl,
-                                &c.entry,
-                                &format!("the pristine fetch failed ({detail})"),
-                            );
-                            rebuilt += 1;
-                        } else {
-                            fail(env, common.json, &c.purl, "vendor_fetch_failed", detail);
-                        }
-                        unrebuildable.insert(c.purl.clone());
-                    }
-                }
-            }
-            PristineFetch::NoSource | PristineFetch::Unverifiable(_) => {
-                // Last rung (npm): the REWIRED lockfile still records the
-                // integrity of our packed tarball. Fetch the pristine copy
-                // unverified, rebuild deterministically, and verify the
-                // REBUILT artifact against that wired integrity below —
-                // end-to-end fail-closed without ledger or installed copy.
-                if c.entry.ecosystem == "npm" {
-                    if let Some(wired) =
-                        lock_inventory::wired_vendor_integrity(&common.cwd, &c.entry.artifact.path)
-                            .await
-                    {
-                        if let Some((name, version)) = npm_coords(&c.entry.base_purl) {
-                            match registry_fetch::fetch_npm_unverified(&name, &version, &client)
-                                .await
-                            {
-                                Ok(fetched) => {
-                                    match fetched.dir().await.map(std::path::Path::to_path_buf) {
-                                        Ok(dir) => {
-                                            all_packages.insert(c.purl.clone(), dir);
-                                            holders.push(fetched);
-                                            must_verify.insert(c.purl.clone(), wired);
-                                        }
-                                        Err(d) => {
-                                            fail(
-                                                env,
-                                                common.json,
-                                                &c.purl,
-                                                "vendor_fetch_failed",
-                                                d,
-                                            );
-                                            unrebuildable.insert(c.purl.clone());
-                                        }
-                                    }
-                                    continue;
-                                }
-                                Err(registry_fetch::FetchError::Failed(d))
-                                | Err(registry_fetch::FetchError::Unverifiable(d)) => {
-                                    fail(env, common.json, &c.purl, "vendor_fetch_failed", d);
-                                    unrebuildable.insert(c.purl.clone());
-                                    continue;
-                                }
-                            }
-                        }
-                    }
-                }
-                if c.soft {
-                    soft_restore_without_fingerprint(
-                        env,
-                        common,
-                        &c.purl,
-                        &c.entry,
-                        "no verifiable pristine source exists to rebuild from (the package \
-                         is not installed, the lockfile is rewired to the vendored artifact, \
-                         and the reconstructed entry records no recoverable registry \
-                         fragment)",
-                    );
-                    rebuilt += 1;
-                    unrebuildable.insert(c.purl.clone());
-                    continue;
-                }
-                let detail = if c.entry.artifact.platform_locked == Some(true) {
-                    "the vendored wheel is platform-locked (compiled); reinstall the \
-                     package on this platform and re-run repair, or run `socket-patch \
-                     vendor` to rebuild it"
-                        .to_string()
-                } else if let Some(reason) = unverifiable_reason {
-                    reason
-                } else {
-                    "no verifiable pristine source: no installed copy was found, the \
-                     lockfile is rewired to the (broken) vendored artifact, and the \
-                     ledger records no recoverable registry fragment"
-                        .to_string()
-                };
-                fail(
-                    env,
-                    common.json,
-                    &c.purl,
-                    "vendor_artifact_unrepairable",
-                    detail,
-                );
-                unrebuildable.insert(c.purl.clone());
-            }
-            PristineFetch::Failed(detail) => {
-                if c.soft {
-                    soft_restore_without_fingerprint(
-                        env,
-                        common,
-                        &c.purl,
-                        &c.entry,
-                        &format!("the pristine fetch failed ({detail})"),
-                    );
-                    rebuilt += 1;
-                } else {
-                    fail(env, common.json, &c.purl, "vendor_fetch_failed", detail);
-                }
-                unrebuildable.insert(c.purl.clone());
-            }
-        }
-    }
-
-    // ── Rebuild via the normal backends ──────────────────────────────────
-    let vendored_at = now_rfc3339();
-    let pipenv_version = tokio::sync::OnceCell::new();
-    let installed_sites = socket_patch_core::vendor::pypi::InstalledSiteListings::default();
-    for c in candidates {
-        if unrebuildable.contains(&c.purl) {
-            continue;
-        }
-        let Some(pkg_path) = all_packages.get(&c.purl).cloned() else {
-            continue; // failed above
-        };
-        // Clear the live uuid dir only NOW — the patch sources and the
-        // pristine source are both in hand. The backends' wired hot paths
-        // rebuild on MISSING (one uniform trigger for every ecosystem),
-        // and the live bytes must never blend into the rebuild:
-        //  - corrupt: the recorded fingerprint already condemned them;
-        //  - soft: the healthy-by-members live tree is exactly what cannot
-        //    be trusted — the fingerprint below derives from the
-        //    member-verified rebuild, never the live bytes.
-        // Cleared by MOVE-ASIDE, not deletion: an in-hand source does not
-        // make the dispatch infallible (the installed copy may itself be
-        // broken in ways no pre-rebuild rung probes), and a dispatch that
-        // refuses or fails replaced nothing — the bytes go back rather
-        // than leaving the wired lockfiles pointing at a bare ENOENT and
-        // destroying the evidence the NOTE above the staging step keeps.
-        let aside = if c.soft || c.reason == "vendor_artifact_corrupt" {
-            set_aside_vendor_dir(&common.cwd, &c.entry.ecosystem, &c.entry.uuid).await
-        } else {
-            None
-        };
-        // For an unverified-source rebuild the rewired lockfile is the trust
-        // anchor: snapshot the wiring files so a failed post-verify can put
-        // them back byte-for-byte. The backend's re-wire may refresh the
-        // recorded integrity/checksum to the rebuilt tarball's — blessing
-        // exactly the drifted bytes the verify below is about to reject.
-        let wiring_snapshot: Option<vendor::bun_lock::BinaryWorkspaceArtifactSnapshot> =
-            if must_verify.contains_key(&c.purl) {
-                let mut snap = match vendor::bun_lock::snapshot_binary_workspace_artifacts(
-                    &common.cwd,
-                    &c.entry,
-                ) {
-                    Ok(snap) => snap,
-                    Err(detail) => {
-                        if let Some((live, kept)) = &aside {
-                            restore_aside_vendor_dir(live, kept).await;
-                        }
-                        fail(
-                            env,
-                            common.json,
-                            &c.purl,
-                            "vendor_artifact_unrepairable",
-                            detail,
-                        );
-                        continue;
-                    }
-                };
-                snap.extend(snapshot_npm_wiring_files(&common.cwd).await);
-                Some(snap)
-            } else {
-                None
-            };
-        let outcome = dispatch_vendor_one(
-            &c.purl,
-            pkg_path.as_path().into(),
-            &common.cwd,
-            &c.record,
-            &sources,
-            &vendored_at,
-            false,
-            false,
-            // Repair rebuilds locally from the recorded patch — no service.
-            None,
-            &pipenv_version,
-            &installed_sites,
-        )
-        .await;
-        match outcome {
-            None => {
-                if let Some((live, kept)) = &aside {
-                    restore_aside_vendor_dir(live, kept).await;
-                }
-                fail(
-                    env,
-                    common.json,
-                    &c.purl,
-                    "vendor_artifact_unrepairable",
-                    "no vendor backend for this ecosystem in this build".to_string(),
-                );
-            }
-            Some(VendorOutcome::Refused { code, detail }) => {
-                if let Some((live, kept)) = &aside {
-                    restore_aside_vendor_dir(live, kept).await;
-                }
-                fail(env, common.json, &c.purl, code, detail);
-            }
-            Some(VendorOutcome::Done {
-                result,
-                entry,
-                warnings,
-            }) => {
-                if !result.success {
-                    if let Some((live, kept)) = &aside {
-                        restore_aside_vendor_dir(live, kept).await;
-                    }
-                    fail(
-                        env,
-                        common.json,
-                        &c.purl,
-                        "vendor_artifact_rebuild_failed",
-                        result.error.unwrap_or_else(|| "rebuild failed".to_string()),
-                    );
-                    continue;
-                }
-                // The rebuild replaced the artifact: the set-aside copy is
-                // condemned bytes now (post-verify failures below keep
-                // their existing nothing-kept contract).
-                if let Some((_, kept)) = &aside {
-                    if let Some(w) =
-                        vendor::vlt_lock::keep_vlt_links(&c.entry, kept, &common.cwd).await
-                    {
-                        record_warning(env, &c.purl, &w, common);
-                    }
-                    let _ = remove_tree(kept).await;
-                }
-                for w in &warnings {
-                    // The Rebuilt event below carries the rebuild signal.
-                    if w.code != "vendor_artifact_rebuilt" {
-                        record_warning(env, &c.purl, w, common);
-                    }
-                }
-                // Unverified pristine source: the rebuilt tarball must
-                // reproduce the integrity the rewired lockfile records.
-                if let Some(wired) = must_verify.get(&c.purl) {
-                    let abs = common.cwd.join(&c.entry.artifact.path);
-                    let verdict = match tokio::fs::read(&abs).await {
-                        Ok(bytes) => {
-                            let name = npm_coords(&c.entry.base_purl)
-                                .map(|(n, _)| n)
-                                .unwrap_or_default();
-                            registry_fetch::artifact_matches_integrity(&bytes, &name, wired)
-                        }
-                        Err(e) => Err(format!("cannot read the rebuilt artifact: {e}")),
-                    };
-                    if let Err(detail) = verdict {
-                        remove_vendor_dir(&common.cwd, &c.entry.ecosystem, &c.entry.uuid).await;
-                        // Put the trust anchor back exactly as it was: the
-                        // backend's re-wire may have refreshed the recorded
-                        // integrity to the rejected rebuild's.
-                        if let Some(snap) = &wiring_snapshot {
-                            for (path, bytes) in snap {
-                                if let Some(bytes) = bytes {
-                                    let _ = tokio::fs::write(path, bytes).await;
-                                } else {
-                                    let _ = tokio::fs::remove_file(path).await;
-                                }
-                            }
-                        }
-                        fail(
-                            env,
-                            common.json,
-                            &c.purl,
-                            "vendor_artifact_rebuild_failed",
-                            format!(
-                                "the rebuilt artifact does not match the integrity the \
-                                 lockfile records ({detail}); the pristine source may have \
-                                 been tampered with — nothing was kept"
-                            ),
-                        );
-                        continue;
-                    }
-                }
-                // The entry whose recorded fingerprint the post-check must
-                // match: a backend-returned entry (drift healed / wiring
-                // re-recorded) wins; a reconstructed entry gets its
-                // fingerprint computed from the rebuilt bytes.
-                let from_backend = entry.is_some();
-                let mut check_entry = entry.unwrap_or_else(|| c.entry.clone());
-                // An artifact-only rebuild hands back a refreshed entry with
-                // no wiring of its own: re-attach the repaired entry's
-                // records (a reconstructed entry is not in the ledger yet,
-                // so the persist below has nothing to carry them from).
-                if from_backend {
-                    vendor::carry_forward_wiring(&c.entry, &mut check_entry);
-                }
-                // The backend's refreshed entry already re-inventoried the
-                // member-verified rebuild; a changed inventory is the same
-                // provenance flip the post-verify refresh below reports.
-                if from_backend
-                    && c.entry.artifact.file_inventory.is_some()
-                    && check_entry.artifact.file_inventory != c.entry.artifact.file_inventory
-                {
-                    record_warning(
-                        env,
-                        &c.purl,
-                        &VendorWarning::new(
-                            "vendor_inventory_refreshed",
-                            INVENTORY_REFRESHED_DETAIL,
-                        ),
-                        common,
-                    );
-                }
-                if !from_backend && c.reconstructed {
-                    fill_artifact_fingerprint(&common.cwd, &mut check_entry).await;
-                }
-                if (from_backend || c.reconstructed)
-                    && persist_vendor_entry(
-                        common,
-                        env,
-                        &mut state,
-                        &c.purl,
-                        check_entry.clone(),
-                        c.detached,
-                        &c.record,
-                    )
-                    .await
-                {
-                    continue;
-                }
-                // ── Fail-closed post-verify ──────────────────────────────
-                let mut health =
-                    check_vendored_artifact(&common.cwd, &check_entry, &c.record).await;
-                // A dir-shaped rebuild whose PATCHED members all verify but
-                // whose tree differs from the recorded inventory: the entry
-                // recorded the OTHER build source's tree (the patch
-                // service's prebuilt artifact carries a converter-generated
-                // stub gemspec; repair always rebuilds locally). Failing
-                // here would delete the rebuild, strand the wired pair on a
-                // dead dir, and deterministically re-fail every later
-                // repair — so refresh the inventory from the verified
-                // rebuild instead, loudly. A backend entry whose inventory
-                // is the repaired entry's own (carried forward — the cargo
-                // backend records none) is the same case.
-                if (!from_backend
-                    || check_entry.artifact.file_inventory == c.entry.artifact.file_inventory)
-                    && !c.reconstructed
-                    && matches!(&health, ArtifactHealth::Corrupt { reason }
-                        if reason == "vendor_inventory_mismatch")
-                {
-                    let abs = common
-                        .cwd
-                        .join(check_entry.artifact.path.replace('\\', "/"));
-                    if let Ok(inv) = artifact_dir_inventory(&check_entry, &abs).await {
-                        check_entry.artifact.file_inventory = Some(inv);
-                        health =
-                            check_vendored_artifact(&common.cwd, &check_entry, &c.record).await;
-                        if health == ArtifactHealth::Healthy {
-                            record_warning(
-                                env,
-                                &c.purl,
-                                &VendorWarning::new(
-                                    "vendor_inventory_refreshed",
-                                    INVENTORY_REFRESHED_DETAIL,
-                                ),
-                                common,
-                            );
-                            if persist_vendor_entry(
-                                common,
-                                env,
-                                &mut state,
-                                &c.purl,
-                                check_entry.clone(),
-                                c.detached,
-                                &c.record,
-                            )
-                            .await
-                            {
-                                continue;
-                            }
-                        }
-                    }
-                }
-                match health {
-                    ArtifactHealth::Healthy => {
-                        if !quiet {
-                            println!(
-                                "Rebuilt {} ({})",
-                                normalize_purl(&c.purl),
-                                check_entry.artifact.path
-                            );
-                        }
-                        env.record(
-                            PatchEvent::new(PatchAction::Rebuilt, c.purl.clone()).with_details(
-                                serde_json::json!({
-                                    "path": check_entry.artifact.path,
-                                    "reason": c.reason,
-                                    "ledgerRestored": c.reconstructed,
-                                }),
-                            ),
-                        );
-                        rebuilt += 1;
-                    }
-                    other => {
-                        // The deterministic rebuild did not reproduce the
-                        // recorded artifact (e.g. a tampered ledger sha):
-                        // remove it rather than leave unverifiable bytes.
-                        remove_vendor_dir(&common.cwd, &check_entry.ecosystem, &check_entry.uuid)
-                            .await;
-                        fail(
-                            env,
-                            common.json,
-                            &c.purl,
-                            "vendor_artifact_rebuild_failed",
-                            format!(
-                                "the rebuilt artifact does not match the recorded \
-                                 fingerprint ({other:?}); if state.json was edited, run \
-                                 `socket-patch vendor` to re-vendor from scratch",
-                            ),
-                        );
-                    }
-                }
-            }
-        }
-    }
-    drop(holders);
-    rebuilt
-}
-
-/// Detail of the `vendor_inventory_refreshed` advisory.
-const INVENTORY_REFRESHED_DETAIL: &str = "the rebuilt artifact's patched files verify but its \
-     tree differs from the recorded file inventory (the \
-     entry was likely vendored from the patch service's \
-     prebuilt artifact; repair rebuilds locally); the \
-     inventory was refreshed from the verified rebuild — \
-     run `socket-patch vendor` to restore the \
-     service-built tree";
-
-/// Compute and record the artifact fingerprint on a re-synthesized ledger
-/// entry: sha256 + size for file-shaped artifacts, the whole-tree file
-/// inventory for dir-shaped ones. An uninventoriable dir stays `None` —
-/// the entry then behaves as pre-inventory (member-only verification).
-async fn fill_artifact_fingerprint(project_root: &Path, entry: &mut VendorEntry) {
-    let norm = entry.artifact.path.replace('\\', "/");
-    let abs = project_root.join(&norm);
-    if !artifact_is_file_shaped(&norm) {
-        entry.artifact.file_inventory = artifact_dir_inventory(entry, &abs).await.ok();
-        return;
-    }
-    if let Some(hex) = file_sha256_hex(&abs).await {
-        entry.artifact.sha256 = hex;
-    }
-    if let Ok(meta) = tokio::fs::metadata(&abs).await {
-        entry.artifact.size = Some(meta.len());
-    }
-}
-
-/// A dir artifact's inventory: an npm dir (vlt's package dir) leaves out
-/// its `node_modules/`, which holds vlt's links and is never part of it.
-async fn artifact_dir_inventory(
-    entry: &VendorEntry,
-    abs: &Path,
-) -> Result<std::collections::BTreeMap<String, String>, String> {
-    if entry.ecosystem == "npm" {
-        vendor::compute_package_dir_inventory(abs).await
-    } else {
-        compute_dir_inventory(abs).await
-    }
-}
-
-fn workspace_copy_issue(health: &ArtifactHealth) -> bool {
-    matches!(health, ArtifactHealth::Corrupt { reason }
-        if reason == "vendor_workspace_artifact_missing" || reason == "vendor_workspace_artifact_corrupt")
-}
-
-/// Preserve package originals while adopting/rebuilding every member-relative
-/// copy from a canonical tarball whose whole-file fingerprint is trusted.
-async fn repair_workspace_copies(
-    root: &Path,
-    entry: &mut VendorEntry,
-    dry_run: bool,
-) -> Result<bool, String> {
-    let (wiring, mut changed) =
-        vendor::bun_lock::repair_binary_workspace_artifacts(root, entry, dry_run).await?;
-    for record in wiring {
-        match entry
-            .wiring
-            .iter_mut()
-            .find(|previous| previous.kind == record.kind && previous.file == record.file)
-        {
-            Some(previous) if *previous != record => {
-                *previous = record;
-                changed = true;
-            }
-            Some(_) => {}
-            None => {
-                entry.wiring.push(record);
-                changed = true;
-            }
-        }
-    }
-    Ok(changed)
-}
-
-/// Fetch one patch view by uuid (proxy-aware) and shape it as a manifest
-/// record; `None` offline or on any API failure. `client_cache` holds the
-/// one API client the whole vendored-artifact phase shares — construction
-/// re-prints the token-shape stderr advisory, so N uuid lookups must not
-/// print it N times. Built lazily: a run with nothing to look up never
-/// constructs (or warns) at all.
-async fn fetch_record_by_uuid(
-    common: &GlobalArgs,
-    client_cache: &mut Option<ApiClient>,
-    uuid: &str,
-) -> Option<(String, PatchRecord)> {
-    if common.offline {
-        return None;
-    }
-    if client_cache.is_none() {
-        *client_cache = Some(
-            get_api_client_with_overrides(common.api_client_overrides())
-                .await
-                .0,
-        );
-    }
-    let client = client_cache
-        .as_ref()
-        .expect("client_cache was just initialized above");
-    let patch = client.fetch_patch(uuid).await.ok()??;
-    Some(crate::commands::get::record_from_patch_response(&patch))
-}
-
-/// `pkg:npm/<name>@<version>` → (name, version); the name may be scoped.
-/// `base_purl` is stored verbatim percent-encoded (`pkg:npm/%40scope/…`),
-/// so each component is decoded like the npm backend's own coordinate
-/// parser — the registry fetch and the berry cache-checksum recipe both
-/// need the decoded name.
-fn npm_coords(base_purl: &str) -> Option<(String, String)> {
-    let rest = strip_purl_qualifiers(base_purl).strip_prefix("pkg:npm/")?;
-    let (name_raw, version_raw) = rest.rsplit_once('@')?;
-    if name_raw.is_empty() || version_raw.is_empty() {
-        return None;
-    }
-    let name = name_raw
-        .split('/')
-        .map(percent_decode_purl_component)
-        .collect::<Vec<_>>()
-        .join("/");
-    let version = percent_decode_purl_component(version_raw).into_owned();
-    Some((name, version))
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    /// The unverified-rebuild snapshot reads vlt-lock.json and the other
-    /// npm-family locks through the FIFO-safe opener: a FIFO at any of them
-    /// is left out of the snapshot at once instead of blocking the repair
-    /// in open(2), and the regular files are still captured.
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn wiring_snapshot_skips_fifo_locks_instead_of_wedging() {
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        let fifos = [root.join("vlt-lock.json"), root.join("package-lock.json")];
-        for fifo in &fifos {
-            let c = std::ffi::CString::new(fifo.to_str().unwrap()).unwrap();
-            // SAFETY: plain libc call on a valid C string.
-            assert_eq!(unsafe { libc::mkfifo(c.as_ptr(), 0o644) }, 0);
-        }
-        std::fs::write(root.join("pnpm-lock.yaml"), b"lockfileVersion: '9.0'\n").unwrap();
-
-        let snap = match tokio::time::timeout(
-            std::time::Duration::from_secs(5),
-            snapshot_npm_wiring_files(root),
-        )
-        .await
-        {
-            Ok(snap) => snap,
-            Err(_) => {
-                use std::os::unix::fs::OpenOptionsExt as _;
-                for fifo in &fifos {
-                    let _ = std::fs::OpenOptions::new()
-                        .write(true)
-                        .custom_flags(libc::O_NONBLOCK)
-                        .open(fifo);
-                }
-                panic!("the wiring snapshot must fail fast on FIFO locks");
-            }
-        };
-        let names: Vec<String> = snap
-            .iter()
-            .map(|(p, _)| p.file_name().unwrap().to_string_lossy().into_owned())
-            .collect();
-        assert_eq!(names, ["pnpm-lock.yaml"]);
-        assert_eq!(snap[0].1.as_deref(), Some(&b"lockfileVersion: '9.0'\n"[..]));
-    }
-
-    /// Build a local native binary resolution through the public binary
-    /// rewrite entry point, which shares the codec with vendor's backend.
-    fn native_binary_vendor_fixture(uuid: &str) -> Vec<u8> {
-        use socket_patch_core::patch::redirect::{
-            rewrite_bun_binary, DepOverride, Integrity, RewriteResult,
-        };
-        let bytes =
-            include_bytes!("../../../socket-patch-core/tests/fixtures/bun-lockb/1.1.45/bun.lockb");
-        let mut result = RewriteResult::default();
-        rewrite_bun_binary(
-            bytes,
-            &[DepOverride {
-                ecosystem: "npm".into(),
-                name: "minimist".into(),
-                namespace: None,
-                version: "1.2.2".into(),
-                token: String::new(),
-                patch_uuid: uuid.into(),
-                artifact_url: format!("./.socket/vendor/npm/{uuid}/minimist-1.2.2.tgz"),
-                berry_zip_url: None,
-                registry_override: None,
-                integrity: Integrity {
-                    sha512: Some(format!("sha512-{}", "A".repeat(86) + "==")),
-                    ..Default::default()
-                },
-            }],
-            &mut result,
-        );
-        assert!(result.warnings.is_empty(), "{:?}", result.warnings);
-        result.binary_files.remove("bun.lockb").unwrap()
-    }
-
-    #[tokio::test]
-    async fn binary_bun_repair_recovers_live_references_and_flavor_without_a_ledger() {
-        let root = tempfile::tempdir().unwrap();
-        let uuid = "11111111-1111-4111-8111-111111111111";
-        tokio::fs::write(
-            root.path().join("bun.lockb"),
-            native_binary_vendor_fixture(uuid),
-        )
-        .await
-        .unwrap();
-        let references = scan_vendor_references(root.path()).await;
-        assert_eq!(
-            references,
-            vec![(
-                "npm".into(),
-                uuid.into(),
-                format!(".socket/vendor/npm/{uuid}/minimist-1.2.2.tgz")
-            )]
-        );
-        assert_eq!(
-            detect_reference_flavor(root.path(), "npm", uuid)
-                .await
-                .as_deref(),
-            Some("bun")
-        );
-        assert!(!root.path().join(".socket/vendor/state.json").exists());
-
-        // Text takes precedence even if the older binary still references
-        // an artifact. Reconstruction must not revive stale dependencies.
-        tokio::fs::write(root.path().join("bun.lock"), "{}\n")
-            .await
-            .unwrap();
-        assert!(scan_vendor_references(root.path()).await.is_empty());
-        assert_eq!(
-            detect_reference_flavor(root.path(), "npm", uuid).await,
-            None
-        );
-        tokio::fs::remove_file(root.path().join("bun.lock"))
-            .await
-            .unwrap();
-        tokio::fs::write(root.path().join("bun.lockb"), b"malformed")
-            .await
-            .unwrap();
-        assert!(scan_vendor_references(root.path()).await.is_empty());
-        assert_eq!(
-            detect_reference_flavor(root.path(), "npm", uuid).await,
-            None
-        );
-    }
-
-    /// A FIFO under a wiring-file name (here the paired `<script>.py` of a
-    /// `*.py.lock`, which the lister cannot filter because it derives the
-    /// script name without stat'ing it) must not wedge `repair`: a
-    /// plain `read_to_string` blocks in open(2) waiting for a writer. Every
-    /// reference read must go through the FIFO-safe reader and skip it.
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn repair_returns_with_fifo_script() {
-        use std::time::Duration;
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        let uuid = "11111111-1111-4111-8111-111111111111";
-        let path = format!(".socket/vendor/pypi/{uuid}/requests-2.28.1-py3-none-any.whl");
-        tokio::fs::write(
-            root.join("tool.py.lock"),
-            format!("archive = {{ path = '{path}' }}"),
-        )
-        .await
-        .unwrap();
-        let fifos = ["tool.py", "bun.lock"];
-        for name in fifos {
-            let c = std::ffi::CString::new(root.join(name).to_str().unwrap()).unwrap();
-            assert_eq!(
-                unsafe { libc::mkfifo(c.as_ptr(), 0o644) },
-                0,
-                "mkfifo {name}"
-            );
-        }
-        // Release valve: if a read DID wedge in open(2), connecting a
-        // writer lets the blocking thread finish so the runtime can shut
-        // down and the test fails on the timeout instead of hanging.
-        let release = || {
-            use std::os::unix::fs::OpenOptionsExt as _;
-            for name in fifos {
-                let _ = std::fs::OpenOptions::new()
-                    .write(true)
-                    .custom_flags(libc::O_NONBLOCK)
-                    .open(root.join(name));
-            }
-        };
-
-        let scanned =
-            tokio::time::timeout(Duration::from_secs(5), scan_vendor_references(root)).await;
-        release();
-        let refs = scanned.expect("scan_vendor_references must not wedge on a FIFO script");
-        assert_eq!(
-            refs,
-            vec![("pypi".to_string(), uuid.to_string(), path.clone())],
-            "the lock reference is still recovered around the FIFO"
-        );
-
-        let flavor = tokio::time::timeout(
-            Duration::from_secs(5),
-            detect_reference_flavor(root, "npm", uuid),
-        )
-        .await;
-        release();
-        assert_eq!(
-            flavor.expect("detect_reference_flavor must not wedge on a FIFO lock"),
-            None
-        );
-    }
-
-    /// The requirements planner writes vendored pins into `-r` includes,
-    /// so a reference may live ONLY in an include. Reading the root
-    /// requirements.txt alone would leave such a wheel unrecoverable by
-    /// `repair` and deletable by the orphan sweep.
-    #[tokio::test]
-    async fn scan_recovers_include_hosted_requirements_reference() {
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        let uuid = "11111111-1111-4111-8111-111111111111";
-        let path = format!(".socket/vendor/pypi/{uuid}/six-1.16.0-py2.py3-none-any.whl");
-        tokio::fs::write(root.join("requirements.txt"), "-r requirements/base.txt\n")
-            .await
-            .unwrap();
-        tokio::fs::create_dir(root.join("requirements"))
-            .await
-            .unwrap();
-        tokio::fs::write(
-            root.join("requirements/base.txt"),
-            format!(
-                "./{path} --hash=sha256:{}  # socket-patch vendor: six==1.16.0\n",
-                "0".repeat(64)
-            ),
-        )
-        .await
-        .unwrap();
-        let refs = scan_vendor_references(root).await;
-        assert_eq!(
-            refs,
-            vec![("pypi".to_string(), uuid.to_string(), path)],
-            "{refs:?}"
-        );
-    }
-
-    #[tokio::test]
-    async fn scan_recovers_vlt_lock_and_workspace_package_json_references() {
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        let in_lock = "11111111-1111-4111-8111-111111111111";
-        let in_member = "22222222-2222-4222-8222-222222222222";
-        let lock_path =
-            format!(".socket/vendor/npm/{in_lock}/left-pad-1.3.0/node_modules/left-pad");
-        let member_path = format!(".socket/vendor/npm/{in_member}/debug-4.3.4/node_modules/debug");
-        let node_id = format!(
-            "file~{}",
-            lock_path
-                .replace('/', "+")
-                .replace("node_modules", "node__modules")
-        );
-        tokio::fs::write(
-            root.join("vlt-lock.json"),
-            format!(
-                "{{\n  \"lockfileVersion\": 1,\n  \"options\": {{}},\n  \"nodes\": {{\n    \
-                 \"{node_id}\": [0,\"left-pad\",null,\"{lock_path}\"],\n    \
-                 \"~npm~debug@4.3.4\": [0,\"debug\",\"sha512-D==\"]\n  }},\n  \"edges\": {{\n    \
-                 \"file~_d left-pad\": \"prod file:./{lock_path} {node_id}\",\n    \
-                 \"workspace~packages+a debug\": \"prod 4.3.4 ~npm~debug@4.3.4\"\n  }}\n}}\n"
-            ),
-        )
-        .await
-        .unwrap();
-        tokio::fs::write(
-            root.join("package.json"),
-            "{\"dependencies\":{\"left-pad\":\"1.3.0\"}}",
-        )
-        .await
-        .unwrap();
-        tokio::fs::create_dir_all(root.join("packages/a"))
-            .await
-            .unwrap();
-        tokio::fs::write(
-            root.join("packages/a/package.json"),
-            format!("{{\"dependencies\":{{\"debug\":\"file:../../{member_path}\"}}}}"),
-        )
-        .await
-        .unwrap();
-        assert_eq!(
-            scan_vendor_references(root).await,
-            vec![
-                ("npm".to_string(), in_lock.to_string(), lock_path),
-                ("npm".to_string(), in_member.to_string(), member_path),
-            ]
-        );
-    }
-
-    #[tokio::test]
-    async fn scan_recovers_script_and_pep751_vendor_references() {
-        let tmp = tempfile::tempdir().unwrap();
-        let uuid = "11111111-1111-4111-8111-111111111111";
-        let path = format!(".socket/vendor/pypi/{uuid}/requests-2.28.1-py3-none-any.whl");
-        for file in ["example.py.lock", "pylock.dev.toml"] {
-            tokio::fs::write(
-                tmp.path().join(file),
-                format!("archive = {{ path = '{path}' }}"),
-            )
-            .await
-            .unwrap();
-        }
-        let references = scan_vendor_references(tmp.path()).await;
-        assert_eq!(
-            references,
-            vec![("pypi".to_string(), uuid.to_string(), path.clone())]
-        );
-        assert_eq!(
-            detect_reference_flavor(tmp.path(), "pypi", uuid)
-                .await
-                .as_deref(),
-            Some("python-lock")
-        );
-        // The project lock outranks a pylock exported from it.
-        tokio::fs::write(
-            tmp.path().join("uv.lock"),
-            format!("version = 1\n\n[[package]]\nname = \"requests\"\nversion = \"2.28.1\"\nsource = {{ path = \"{path}\" }}\n"),
-        )
-        .await
-        .unwrap();
-        assert_eq!(
-            detect_reference_flavor(tmp.path(), "pypi", uuid)
-                .await
-                .as_deref(),
-            Some("uv")
-        );
-    }
-
-    /// pnpm writes vendored paths in THREE spellings — override values,
-    /// `tarball:` fields, and snapshot KEYS with a trailing colon. The
-    /// scanner must yield the clean relpath whichever form it meets first.
-    #[tokio::test]
-    async fn scan_handles_pnpm_snapshot_key_colons() {
-        let tmp = tempfile::tempdir().unwrap();
-        let uuid = "11111111-1111-4111-8111-111111111111";
-        let lock = format!(
-            "overrides:\n  left-pad@1.3.0: file:.socket/vendor/npm/{uuid}/left-pad-1.3.0.tgz\n\n\
-             snapshots:\n\n  left-pad@file:.socket/vendor/npm/{uuid}/left-pad-1.3.0.tgz:\n    {{}}\n"
-        );
-        tokio::fs::write(tmp.path().join("pnpm-lock.yaml"), &lock)
-            .await
-            .unwrap();
-        let refs = scan_vendor_references(tmp.path()).await;
-        assert_eq!(refs.len(), 1, "{refs:?}");
-        assert_eq!(
-            refs[0].2,
-            format!(".socket/vendor/npm/{uuid}/left-pad-1.3.0.tgz"),
-            "no trailing colon: {refs:?}"
-        );
-
-        // Snapshot-key-only lock (the key form is the FIRST occurrence).
-        let lock = format!(
-            "snapshots:\n\n  left-pad@file:.socket/vendor/npm/{uuid}/left-pad-1.3.0.tgz:\n    {{}}\n"
-        );
-        tokio::fs::write(tmp.path().join("pnpm-lock.yaml"), &lock)
-            .await
-            .unwrap();
-        let refs = scan_vendor_references(tmp.path()).await;
-        assert_eq!(refs.len(), 1, "{refs:?}");
-        assert!(
-            refs[0].2.ends_with("left-pad-1.3.0.tgz"),
-            "trailing colon must be cut: {refs:?}"
-        );
-    }
-
-    /// The scanner's false-positive guard: a `.socket` mention that is NOT
-    /// a parseable vendored-artifact path (the committed manifest, a
-    /// non-uuid path segment) must never be reported as a vendor reference
-    /// — `parse_vendor_path`'s reject branch is what keeps `repair` from
-    /// reconstructing ledger entries out of ordinary `.socket/` mentions.
-    #[tokio::test]
-    async fn scan_ignores_non_vendor_socket_mentions() {
-        let tmp = tempfile::tempdir().unwrap();
-        tokio::fs::write(
-            tmp.path().join("package.json"),
-            r#"{
-  "name": "t",
-  "socketManifest": ".socket/manifest.json",
-  "notAVendorPath": ".socket/vendor/npm/not-a-uuid/x.tgz"
-}"#,
-        )
-        .await
-        .unwrap();
-        let refs = scan_vendor_references(tmp.path()).await;
-        assert!(
-            refs.is_empty(),
-            "non-vendor .socket mentions must be rejected: {refs:?}"
-        );
-    }
-
-    /// A lock that is PRESENT but does not reference the uuid must not
-    /// claim the entry: the probe falls through past pnpm-lock.yaml and
-    /// yarn.lock to the lock that actually carries the reference.
-    #[tokio::test]
-    async fn detect_reference_flavor_falls_through_present_unreferencing_locks() {
-        let uuid = "11111111-1111-4111-8111-111111111111";
-        let mention = format!("resolved: file:.socket/vendor/npm/{uuid}/left-pad-1.3.0.tgz\n");
-        let tmp = tempfile::tempdir().unwrap();
-        tokio::fs::write(
-            tmp.path().join("pnpm-lock.yaml"),
-            "lockfileVersion: '9.0'\n",
-        )
-        .await
-        .unwrap();
-        tokio::fs::write(tmp.path().join("yarn.lock"), "# yarn lockfile v1\n")
-            .await
-            .unwrap();
-        tokio::fs::write(tmp.path().join("package-lock.json"), &mention)
-            .await
-            .unwrap();
-        assert_eq!(
-            detect_reference_flavor(tmp.path(), "npm", uuid).await,
-            Some("package-lock".to_string()),
-            "present-but-unreferencing locks must fall through to the referencing one"
-        );
-    }
-
-    /// [`remove_vendor_dir`] is a best-effort guard that must never GUESS a
-    /// path: an eco/uuid pair that cannot map to a canonical vendor dir
-    /// (unknown ecosystem dir, non-canonical uuid) removes NOTHING, while
-    /// the mappable pair removes exactly its uuid dir.
-    #[tokio::test]
-    async fn remove_vendor_dir_refuses_unmappable_eco_or_uuid() {
-        let tmp = tempfile::tempdir().unwrap();
-        let uuid = "11111111-1111-4111-8111-111111111111";
-        let dir = tmp.path().join(format!(".socket/vendor/npm/{uuid}"));
-        tokio::fs::create_dir_all(&dir).await.unwrap();
-        tokio::fs::write(dir.join("x.tgz"), b"bytes").await.unwrap();
-
-        remove_vendor_dir(tmp.path(), "jsr", uuid).await;
-        assert!(dir.is_dir(), "an unmappable ecosystem must remove nothing");
-        remove_vendor_dir(tmp.path(), "npm", "not-a-uuid").await;
-        assert!(dir.is_dir(), "a non-canonical uuid must remove nothing");
-        remove_vendor_dir(tmp.path(), "npm", uuid).await;
-        assert!(!dir.exists(), "the canonical pair removes its uuid dir");
-        assert!(
-            !tmp.path().join(".socket/vendor").exists(),
-            "the emptied <eco>/ and vendor/ husks are pruned"
-        );
-        assert!(
-            tmp.path().join(".socket").is_dir(),
-            ".socket/ is never removed"
-        );
-    }
-
-    /// The empty-component rejects: a purl with no name or no version can
-    /// never drive a registry fetch — `npm_coords` must return `None`, not
-    /// empty coordinates.
-    #[test]
-    fn npm_coords_rejects_empty_name_or_version() {
-        assert_eq!(npm_coords("pkg:npm/@1.2.3"), None, "empty name");
-        assert_eq!(npm_coords("pkg:npm/left-pad@"), None, "empty version");
-    }
-
-    /// The reconstruction stamps [`VendorEntry::flavor`] from whichever
-    /// lockfile carries the vendored reference, so `vendor --revert` routes
-    /// to the backend whose unwired-revert guard probes the RIGHT lockfile.
-    /// The strings must stay npm_flavor's stable vocabulary; unknowable
-    /// shapes stay `None` (the guarded package-lock fallback route).
-    #[tokio::test]
-    async fn detect_reference_flavor_maps_referencing_lock_to_stable_flavor() {
-        let uuid = "11111111-1111-4111-8111-111111111111";
-        let mention = format!("resolved: file:.socket/vendor/npm/{uuid}/left-pad-1.3.0.tgz\n");
-        let case = |files: Vec<(&'static str, String)>, want: Option<&'static str>| async move {
-            let tmp = tempfile::tempdir().unwrap();
-            for (name, text) in &files {
-                tokio::fs::write(tmp.path().join(name), text).await.unwrap();
-            }
-            assert_eq!(
-                detect_reference_flavor(tmp.path(), "npm", uuid).await,
-                want.map(str::to_string),
-                "files: {:?}",
-                files.iter().map(|(n, _)| n).collect::<Vec<_>>()
-            );
-        };
-
-        // Each flavor's lock, referenced → its stable string.
-        case(
-            vec![("package-lock.json", mention.clone())],
-            Some("package-lock"),
-        )
-        .await;
-        case(
-            vec![("npm-shrinkwrap.json", mention.clone())],
-            Some("package-lock"),
-        )
-        .await;
-        case(
-            vec![(
-                "pnpm-lock.yaml",
-                format!("lockfileVersion: '9.0'\n{mention}"),
-            )],
-            Some("pnpm"),
-        )
-        .await;
-        case(
-            vec![("pnpm-lock.yaml", format!("lockfileVersion: 5.4\n{mention}"))],
-            Some("pnpm-legacy"),
-        )
-        .await;
-        case(
-            vec![(
-                "pnpm-lock.yaml",
-                format!("lockfileVersion: '6.0'\n{mention}"),
-            )],
-            Some("pnpm-legacy"),
-        )
-        .await;
-        case(
-            vec![("yarn.lock", format!("# yarn lockfile v1\n{mention}"))],
-            Some("yarn-classic"),
-        )
-        .await;
-        case(
-            vec![("yarn.lock", format!("__metadata:\n  version: 8\n{mention}"))],
-            Some("yarn-berry"),
-        )
-        .await;
-        case(vec![("bun.lock", mention.clone())], Some("bun")).await;
-        let vlt_lock = |version: &str| {
-            format!(
-                "{{\n  \"lockfileVersion\": {version},\n  \"nodes\": {{\n    \"file~x\": \
-                 [0,\"left-pad\",null,\".socket/vendor/npm/{uuid}/left-pad-1.3.0/node_modules/\
-                 left-pad\"]\n  }}\n}}\n"
-            )
-        };
-        case(vec![("vlt-lock.json", vlt_lock("1"))], Some("vlt")).await;
-        case(vec![("vlt-lock.json", vlt_lock("0"))], Some("vlt")).await;
-        // vlt precedes every other lock, and an unreadable one is unknowable.
-        case(
-            vec![
-                ("vlt-lock.json", vlt_lock("1")),
-                ("bun.lock", mention.clone()),
-                ("package-lock.json", mention.clone()),
-            ],
-            Some("vlt"),
-        )
-        .await;
-        case(
-            vec![
-                ("vlt-lock.json", vlt_lock("2")),
-                ("package-lock.json", mention.clone()),
-            ],
-            None,
-        )
-        .await;
-        case(
-            vec![
-                ("vlt-lock.json", "{}".to_string()),
-                ("package-lock.json", mention.clone()),
-            ],
-            Some("package-lock"),
-        )
-        .await;
-
-        // Unknowable stays None: unrecognized grammars, or no referencing
-        // lock at all (an unreferenced lock must not claim the entry).
-        case(
-            vec![("pnpm-lock.yaml", format!("lockfileVersion: 5.3\n{mention}"))],
-            None,
-        )
-        .await;
-        case(vec![("yarn.lock", mention.clone())], None).await;
-        case(
-            vec![("package-lock.json", "no reference here".to_string())],
-            None,
-        )
-        .await;
-        case(vec![], None).await;
-
-        // The referencing lock wins over an unreferenced sibling.
-        case(
-            vec![
-                ("package-lock.json", "no reference here".to_string()),
-                ("yarn.lock", format!("# yarn lockfile v1\n{mention}")),
-            ],
-            Some("yarn-classic"),
-        )
-        .await;
-
-        // Non-npm ecosystems never carry an npm flavor.
-        let tmp = tempfile::tempdir().unwrap();
-        tokio::fs::write(tmp.path().join("package-lock.json"), &mention)
-            .await
-            .unwrap();
-        assert_eq!(detect_reference_flavor(tmp.path(), "gem", uuid).await, None);
-    }
-
-    /// `base_purl` is stored VERBATIM percent-encoded (`pkg:npm/%40scope/…`,
-    /// manifest/ledger key parity — see npm_common's coordinate tests), but
-    /// the registry fetch and the berry cache-checksum recipe both need the
-    /// DECODED npm name.
-    #[test]
-    fn npm_coords_percent_decodes_scoped_names() {
-        assert_eq!(
-            npm_coords("pkg:npm/%40scope/sdk@1.12.0"),
-            Some(("@scope/sdk".to_string(), "1.12.0".to_string()))
-        );
-        // Already-decoded and unscoped spellings pass through unchanged.
-        assert_eq!(
-            npm_coords("pkg:npm/@scope/sdk@1.12.0"),
-            Some(("@scope/sdk".to_string(), "1.12.0".to_string()))
-        );
-        assert_eq!(
-            npm_coords("pkg:npm/left-pad@1.3.0?foo=bar"),
-            Some(("left-pad".to_string(), "1.3.0".to_string()))
-        );
-        assert_eq!(npm_coords("pkg:npm/left-pad"), None);
-    }
-}
-
-/// Exact-string tests for the vendored-repair human lines.
-#[cfg(test)]
-mod ui_format_tests {
-    use super::*;
-
-    #[test]
-    fn repair_failure_line_has_error_prefix() {
-        assert_eq!(
-            format_repair_failure("pkg:npm/%40s/x@1.0.0", "no pristine source"),
-            "Error: Cannot repair vendored artifact for pkg:npm/@s/x@1.0.0: no pristine source"
-        );
-    }
-
-    #[test]
-    fn rebuild_preview_singular_and_plural() {
-        let one = vec![(
-            "pkg:npm/minimist@1.2.5".to_string(),
-            "vendor_artifact_missing",
-            ".socket/vendor/npm/u/minimist-1.2.5.tgz",
-        )];
-        assert_eq!(
-            format_rebuild_preview(&one),
-            vec![
-                "Would rebuild 1 vendored artifact:",
-                "  - pkg:npm/minimist@1.2.5 (missing: .socket/vendor/npm/u/minimist-1.2.5.tgz)",
-            ]
-        );
-        let two = vec![
-            (
-                "pkg:npm/a@1".to_string(),
-                "vendor_artifact_corrupt",
-                "p/a.tgz",
-            ),
-            (
-                "pkg:gem/b@1".to_string(),
-                "vendor_inventory_unverified",
-                "p/b",
-            ),
-        ];
-        assert_eq!(
-            format_rebuild_preview(&two),
-            vec![
-                "Would rebuild 2 vendored artifacts:",
-                "  - pkg:npm/a@1 (corrupt: p/a.tgz)",
-                "  - pkg:gem/b@1 (unverified: p/b)",
-            ]
-        );
-        assert_eq!(rebuild_reason_label("something_else"), "something_else");
-    }
-}
diff --git a/crates/socket-patch-cli/src/commands/rollback.rs b/crates/socket-patch-cli/src/commands/rollback.rs
index 12ccdb31..e3306e16 100644
--- a/crates/socket-patch-cli/src/commands/rollback.rs
+++ b/crates/socket-patch-cli/src/commands/rollback.rs
@@ -17,7 +17,7 @@ use socket_patch_core::patch::rollback::{
 use socket_patch_core::telemetry::{track_patch_rollback_failed, track_patch_rolled_back};
 use socket_patch_core::utils::purl::{patch_matches, strip_purl_qualifiers};
 use socket_patch_core::patch::redirect::upstream::HostedPin;
-use socket_patch_core::vendor::{save_state, RevertOpts, VendorState, VendorWarning};
+use socket_patch_core::vendor::{RevertOpts, VendorState};
 use std::collections::{HashMap, HashSet};
 use std::path::{Path, PathBuf};
 use std::time::Duration;
@@ -25,7 +25,7 @@ use std::time::Duration;
 use crate::args::{apply_env_toggles, parse_bool_flag, GlobalArgs};
 use crate::commands::apply::is_local_go;
 use crate::commands::lock_cli::acquire_or_emit;
-use crate::commands::vendor::dispatch_revert_one_opts;
+use crate::commands::vendored_backend::{RevertedEntry, VendorRevertStep, VendoredBackend};
 use crate::ecosystem_dispatch::{find_all_packages_for_rollback, partition_purls};
 use crate::json_envelope::Command as EnvelopeCommand;
 use crate::looks_like_uuid;
@@ -827,76 +827,6 @@ pub(crate) struct HostedLegOutcome {
     pub(crate) edited_files: std::collections::BTreeSet<String>,
 }
 
-/// What one vendored ledger entry's revert did. Silent by design — the
-/// caller owns the print and envelope vocabulary. Shared by `rollback`'s
-/// vendored leg and both of `remove`'s vendored paths, so the drift-keep
-/// and `--preserve-state` rules are identical by construction.
-pub(crate) enum VendorRevertStep {
-    /// `key` has no ledger entry (a divergent ledger, or an earlier leg
-    /// already reverted it): a silent no-op.
-    Missing,
-    /// The backend refused; nothing changed for this entry.
-    Failed(String),
-    /// Drift-keep: the lock changed under us and the backend left both the
-    /// wiring and the artifact alone. Per `RevertOutcome`'s contract the
-    /// ledger entry — and any manifest record — must survive.
-    Kept,
-    /// Dry run: the revert (or, with `keep_artifact`, the unwire) would
-    /// succeed. Nothing changed.
-    WouldRevert,
-    /// `keep_artifact`: wiring restored; artifact and ledger entry kept
-    /// byte-identical. Its wiring records now describe already-reverted
-    /// fragments, which later reverts replay as silent no-ops (the
-    /// liveness contract), and a re-vendor re-wires from the live lock.
-    Preserved,
-    /// Reverted on disk, dropped from the ledger, ledger saved (per entry,
-    /// so the run is crash-consistent like `vendor --revert`).
-    Reverted,
-    /// Reverted on disk and dropped from the in-memory ledger, but the
-    /// ledger write failed.
-    LedgerWriteFailed(String),
-}
-
-pub(crate) struct VendorRevertResult {
-    pub(crate) warnings: Vec<VendorWarning>,
-    pub(crate) step: VendorRevertStep,
-}
-
-/// Revert the vendored ledger entry `key` (see [`VendorRevertStep`]).
-pub(crate) async fn revert_vendor_entry(
-    cwd: &Path,
-    key: &str,
-    state: &mut VendorState,
-    opts: RevertOpts,
-) -> VendorRevertResult {
-    let Some(entry) = state.entries.get(key).cloned() else {
-        return VendorRevertResult {
-            warnings: Vec::new(),
-            step: VendorRevertStep::Missing,
-        };
-    };
-    let outcome = dispatch_revert_one_opts(&entry, cwd, opts).await;
-    let step = if !outcome.success {
-        VendorRevertStep::Failed(outcome.error.unwrap_or_else(|| "unknown error".into()))
-    } else if outcome.kept_artifact {
-        VendorRevertStep::Kept
-    } else if opts.dry_run {
-        VendorRevertStep::WouldRevert
-    } else if opts.keep_artifact {
-        VendorRevertStep::Preserved
-    } else {
-        state.entries.remove(key);
-        match save_state(cwd, state).await {
-            Ok(()) => VendorRevertStep::Reverted,
-            Err(e) => VendorRevertStep::LedgerWriteFailed(e.to_string()),
-        }
-    };
-    VendorRevertResult {
-        warnings: outcome.warnings,
-        step,
-    }
-}
-
 /// One GC pass over `.socket/blobs`, `diffs` and `packages` against
 /// `reference` (the post-removal manifest with the revert blobs a later
 /// rollback needs pinned in). Each directory reports separately: callers
@@ -952,50 +882,58 @@ async fn run_vendored_leg(
         keep_artifact: preserve,
     };
     let loud = !common.json && !common.silent;
-    for key in keys {
-        let result = revert_vendor_entry(&common.cwd, key, state, opts).await;
-        for w in &result.warnings {
+    let reverted = VendoredBackend::new(common, None)
+        .revert(keys, state, opts, false)
+        .await;
+    for RevertedEntry {
+        key,
+        warnings,
+        step,
+        ..
+    } in reverted
+    {
+        for w in &warnings {
             if loud {
                 eprintln!("Warning ({}): {}", w.code, w.detail);
             }
             out.warnings.push((w.code.to_string(), w.detail.clone()));
         }
-        match result.step {
+        match step {
             VendorRevertStep::Missing => {}
             VendorRevertStep::Failed(why) => {
                 // Errors print even under --silent.
                 if !common.json {
                     eprintln!("Error: Failed to revert vendoring for {key}: {why}");
                 }
-                out.failed.push((key.clone(), why));
+                out.failed.push((key, why));
             }
             VendorRevertStep::Kept => out.kept.push((
-                key.clone(),
+                key,
                 "lockfile wiring drifted; vendored state left untouched".to_string(),
             )),
             VendorRevertStep::WouldRevert if preserve => {
                 if loud {
                     println!("Would unwire vendoring for {key} (artifact preserved)");
                 }
-                out.preserved.push(key.clone());
+                out.preserved.push(key);
             }
             VendorRevertStep::WouldRevert => {
                 if loud {
                     println!("Would revert vendoring for {key}");
                 }
-                out.reverted.push(key.clone());
+                out.reverted.push(key);
             }
             VendorRevertStep::Preserved => {
                 if loud {
                     println!("Unwired vendoring for {key} (artifact preserved)");
                 }
-                out.preserved.push(key.clone());
+                out.preserved.push(key);
             }
             VendorRevertStep::Reverted => {
                 if loud {
                     println!("Reverted vendoring for {key}");
                 }
-                out.reverted.push(key.clone());
+                out.reverted.push(key);
             }
             VendorRevertStep::LedgerWriteFailed(e) => {
                 let why = format!("vendor ledger write failed: {e}");
@@ -1003,7 +941,7 @@ async fn run_vendored_leg(
                 if !common.json {
                     eprintln!("Error: Failed to revert vendoring for {key}: {why}");
                 }
-                out.failed.push((key.clone(), why));
+                out.failed.push((key, why));
             }
         }
     }
@@ -1259,14 +1197,16 @@ pub async fn run(args: RollbackArgs) -> i32 {
             return 0;
         }
         // Ledger-less but still wired? (a deleted/uncommitted state.json
-        // with lockfiles still consuming `.socket/vendor/` artifacts is a
-        // supported recovery state — `repair` reconstructs the ledger.)
-        let wired = crate::commands::repair_vendor::scan_vendor_references(&cwd).await;
+        // with lockfiles still consuming `.socket/vendor/` artifacts: the
+        // ledger holds the pre-vendor originals, so it must come back from
+        // version control first.)
+        let wired = crate::commands::vendored_backend::repair::scan_vendor_references(&cwd).await;
         if !wired.is_empty() {
             emit_rollback_error(
                 args.common.json,
                 "lockfiles still reference .socket/vendor/ artifacts but the vendor ledger \
-                 is missing — run `socket-patch repair` to reconstruct it, then roll back",
+                 is missing — restore .socket/vendor/state.json from version control, then \
+                 roll back (or restore the lockfiles with `git checkout -- <lockfile>`)",
             );
             return 1;
         }
diff --git a/crates/socket-patch-cli/src/commands/scan/mod.rs b/crates/socket-patch-cli/src/commands/scan/mod.rs
index 0b9ff3c3..adaa869c 100644
--- a/crates/socket-patch-cli/src/commands/scan/mod.rs
+++ b/crates/socket-patch-cli/src/commands/scan/mod.rs
@@ -56,7 +56,7 @@ pub(crate) use self::hosted::boxed_run_redirect_selected;
 use self::hosted::run_redirect;
 pub(crate) use self::hosted::{vlt_rollback_heal, vlt_takeover_heal};
 pub(crate) use self::vendor_flow::{
-    boxed_scan_vendor_step, preview_vendor_json, print_dry_run_refusals,
+    boxed_vendor_step, preview_vendor_json, print_dry_run_refusals, VendorStep,
 };
 use self::vendor_flow::{
     boxed_vendor_interactive_path, boxed_vendor_json_path, fold_vendored_skips_into_apply,
diff --git a/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs b/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs
index 7930eb43..db4aa9bb 100644
--- a/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs
+++ b/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs
@@ -20,7 +20,7 @@
 use socket_patch_core::api::client::ApiClient;
 use socket_patch_core::api::types::{BatchPackagePatches, PatchResponse, PatchSearchResult};
 use socket_patch_core::manifest::operations::{read_manifest, write_manifest};
-use socket_patch_core::manifest::schema::{PatchManifest, PatchRecord};
+use socket_patch_core::manifest::schema::PatchRecord;
 use socket_patch_core::telemetry::{track_patch_vendor_failed, PendingTelemetry};
 use socket_patch_core::utils::purl::strip_purl_qualifiers;
 use socket_patch_core::vendor::{load_state, lookup_entry, save_state, VendorState};
@@ -30,13 +30,11 @@ use std::time::Duration;
 
 use crate::args::GlobalArgs;
 use crate::commands::bun_preflight::bun_vendor_preflight_with_ledger;
-use crate::commands::fetch_stage::{
-    drop_unstageable, stage_vendor_sources_in_memory, MemStageOutcome,
-};
 use crate::commands::get::{download_patch_records_reusing, DetachedDownload, DownloadParams};
 use crate::commands::lock_cli::lock_failure;
-use crate::commands::vendor::{
-    note_classic_migration_risk, track_outcomes_for_vendor, vendor_records_reusing,
+use crate::commands::vendor::{note_classic_migration_risk, track_outcomes_for_vendor};
+use crate::commands::vendored_backend::{
+    records_manifest, ApplyRequest, NoLocalSource, VendoredBackend, NO_LOCAL_SOURCE_MESSAGE,
 };
 use crate::commands::vlt_preflight::{vlt_refusal_for, vlt_vendor_preflight_selected};
 use crate::ecosystem_dispatch::NpmCrawlSnapshot;
@@ -147,35 +145,101 @@ pub(crate) fn print_dry_run_refusals(preview: &serde_json::Value) {
     }
 }
 
-/// The vendor step shared by `scan --vendor`'s JSON and interactive arms
-/// (and, through [`boxed_scan_vendor_step`], `get --mode vendored`):
-/// acquire the apply lock, stage the in-memory `records` (from
-/// [`download_patch_records_reusing`], whose blob `seed` spares the stager a
-/// second view fetch), drive [`vendor_records_reusing`] detached (every
-/// ledger entry embeds its record) over the run's `client`, then migrate any
-/// legacy manifest records the ledger now owns and run the run-level
-/// advisories, all under the lock.
+/// Everything the vendor step takes: the in-memory `records` to vendor
+/// (from [`download_patch_records_reusing`] or `get`'s download phase), the
+/// blob `seed` that phase fetched (so the stager fetches no view twice),
+/// the run's API client, and the run outcome so far for telemetry.
+pub(crate) struct VendorStep<'a> {
+    pub(crate) common: &'a GlobalArgs,
+    pub(crate) records: HashMap<String, PatchRecord>,
+    pub(crate) seed: HashMap<String, Vec<u8>>,
+    pub(crate) client: ApiClient,
+    pub(crate) use_public_proxy: bool,
+    /// Print "No vendorable patches in scope." when there are no records
+    /// at all (the step is a silent no-op then). `get --mode vendored` and
+    /// scan's JSON arm want it; scan's interactive arm prints its own
+    /// closing line instead (see [`format_nothing_vendored`]).
+    pub(crate) report_empty: bool,
+    /// The npm half of scan's crawl, for the engine to reuse instead of
+    /// walking the untouched tree again (see `vendor_records_reusing`).
+    pub(crate) prior: Option<&'a NpmCrawlSnapshot>,
+    /// The download phase failed or refused some patch: the run exits 1
+    /// and its telemetry must not report a clean vendoring.
+    pub(crate) download_errors: bool,
+    pub(crate) telemetry_token: Option<&'a str>,
+    pub(crate) telemetry_org: Option<&'a str>,
+}
+
+/// The one vendored-apply entry of `scan --mode vendored` (JSON and
+/// interactive arms) and `get --mode vendored`: acquire the apply lock,
+/// drive [`VendoredBackend::apply`] detached (every ledger entry embeds its
+/// record) over the run's client, migrate any legacy manifest records the
+/// ledger now owns, run the run-level advisories — all under the lock —
+/// then report the run's telemetry.
 ///
 /// An empty `records` map is a no-op BEFORE the lock: nothing is staged and
 /// no `.socket/` is created.
 ///
-/// `Err((code, message, envelope))` is a lock/stage failure the caller folds
-/// into its own output shape. A lock failure carries no envelope; a staging
-/// failure (`no_local_source`) hands back the step's envelope demoted to
-/// `partialFailure`, so `.vendor.status` inside a `"status":"error"` result
-/// never reads `success`.
-async fn run_scan_vendor_step(
+/// `Ok((has_errors, envelope))` — `has_errors` includes
+/// [`VendorStep::download_errors`]. `Err((code, message, envelope))` is a
+/// lock/stage failure the caller folds into its own output shape. A lock
+/// failure carries no envelope; a staging failure (`no_local_source`) hands
+/// back the step's envelope demoted to `partialFailure`, so
+/// `.vendor.status` inside a `"status":"error"` result never reads
+/// `success`.
+async fn run_vendor_step(step: VendorStep<'_>) -> VendorStepResult {
+    let VendorStep {
+        common,
+        records,
+        seed,
+        client,
+        use_public_proxy,
+        report_empty,
+        prior,
+        download_errors,
+        telemetry_token,
+        telemetry_org,
+    } = step;
+    let outcome = vendor_under_lock(
+        common,
+        records,
+        seed,
+        client,
+        use_public_proxy,
+        report_empty,
+        prior,
+    )
+    .await;
+    match &outcome {
+        // Telemetry follows the RUN outcome: a download-phase failure (a
+        // Bun refusal, a failed view fetch) exits 1 and must not report a
+        // successful vendoring of zero patches.
+        Ok((vendor_errors, venv)) => {
+            track_outcomes_for_vendor(
+                download_errors || *vendor_errors,
+                venv,
+                common.dry_run,
+                telemetry_token,
+                telemetry_org,
+            )
+            .await
+        }
+        Err((_, message, _)) => {
+            track_patch_vendor_failed(message, common.dry_run, telemetry_token, telemetry_org)
+                .await
+        }
+    }
+    outcome.map(|(vendor_errors, venv)| (download_errors || vendor_errors, venv))
+}
+
+/// [`run_vendor_step`]'s locked half (see there).
+async fn vendor_under_lock(
     common: &GlobalArgs,
     records: HashMap<String, PatchRecord>,
     seed: HashMap<String, Vec<u8>>,
     client: ApiClient,
     use_public_proxy: bool,
-    // Print "No vendorable patches in scope." when there are no records at
-    // all (the step is a silent no-op then). `get --mode vendored` wants
-    // it; scan's interactive arm prints its own closing line instead.
     report_empty: bool,
-    // The npm half of scan's crawl, for the engine to reuse instead of
-    // walking the untouched tree again (see `vendor_records_reusing`).
     prior: Option<&NpmCrawlSnapshot>,
 ) -> VendorStepResult {
     let mut env = Envelope::new(EnvelopeCommand::Vendor);
@@ -200,28 +264,39 @@ async fn run_scan_vendor_step(
 
     // Staging probes blobs by the records' hashes; a manifest VIEW over the
     // in-memory records (a move, not a clone) is all it needs.
-    let manifest = PatchManifest {
-        patches: records,
-        setup: None,
-    };
-    let has_errors = match stage_and_vendor(
-        common,
-        &socket_dir,
-        &manifest,
-        seed,
-        client,
-        use_public_proxy,
-        &mut env,
-        prior,
-    )
-    .await
-    {
+    let manifest = records_manifest(records);
+    // The SAME service-config assembler the `vendor` command uses
+    // (`--vendor-source` / `--vendor-url` / `--patch-server-url`), so
+    // `scan --mode vendored` and `vendor` commit byte-identical artifacts.
+    let service = common.vendor_service_config(Some(client), use_public_proxy);
+    let applied = VendoredBackend::new(common, Some(&service))
+        .apply(
+            ApplyRequest {
+                manifest: &manifest,
+                socket_dir: &socket_dir,
+                // Loaded ONCE under the lock: the staging harvest reads it,
+                // then the engine takes it over for its persists.
+                ledger: load_state(&common.cwd).await,
+                seed,
+                // Always detached: vendored mode is manifest-free.
+                detached: true,
+                force: false,
+                prior,
+            },
+            &mut env,
+        )
+        .await;
+    let has_errors = match applied {
         Ok(has_errors) => has_errors,
-        Err((code, message)) => {
+        Err(NoLocalSource) => {
             // The step ran and is aborting: hand its envelope (demoted) to
             // the caller's fold.
             env.mark_partial_failure();
-            return Err((code, message, Some(Box::new(env))));
+            return Err((
+                "no_local_source",
+                NO_LOCAL_SOURCE_MESSAGE.to_string(),
+                Some(Box::new(env)),
+            ));
         }
     };
     migrate_legacy_manifest_records(common, &manifest_path, &manifest.patches, &mut env).await;
@@ -232,67 +307,6 @@ async fn run_scan_vendor_step(
     Ok((has_errors, env))
 }
 
-/// Stage `manifest`'s patch sources in memory (seeded with the download
-/// phase's blobs, harvesting the committed artifacts the ledger names for
-/// the rest) and drive the vendor engine over them (detached: every entry
-/// embeds its record). The caller holds the apply lock. `Err` is the
-/// `no_local_source` fold (staging could not obtain the patch content —
-/// offline, or the view fetch failed).
-#[allow(clippy::too_many_arguments)]
-pub(crate) async fn stage_and_vendor(
-    common: &GlobalArgs,
-    socket_dir: &Path,
-    manifest: &PatchManifest,
-    seed: HashMap<String, Vec<u8>>,
-    client: ApiClient,
-    use_public_proxy: bool,
-    env: &mut Envelope,
-    prior: Option<&NpmCrawlSnapshot>,
-) -> Result<bool, (&'static str, String)> {
-    // Loaded ONCE under the lock: the staging harvest reads it here, then
-    // the engine takes it over for its persists. An unreadable ledger
-    // harvests nothing and is the engine's report.
-    let ledger = load_state(&common.cwd).await;
-    let staged = match stage_vendor_sources_in_memory(
-        common,
-        manifest,
-        socket_dir,
-        &common.cwd,
-        ledger.as_ref().map(|s| &s.entries),
-        seed,
-        Some(&client),
-    )
-    .await
-    {
-        MemStageOutcome::Ready(s) => s,
-        MemStageOutcome::Unavailable => {
-            return Err((
-                "no_local_source",
-                "patch artifacts unavailable (offline or download failure)".to_string(),
-            ));
-        }
-    };
-    let sources = staged.as_patch_sources();
-    // A record whose content this run could not obtain is reported
-    // per-package and left out of the engine run; the rest still vendors.
-    let (records, staging_errors) = drop_unstageable(env, &manifest.patches, staged.unavailable());
-    // The SAME service-config assembler the `vendor` command uses
-    // (`--vendor-source` / `--vendor-url` / `--patch-server-url`), so
-    // `scan --mode vendored` and `vendor` commit byte-identical artifacts.
-    let service = common.vendor_service_config(Some(client), use_public_proxy);
-    let engine_errors = boxed_vendor_records(
-        common,
-        &records,
-        &sources,
-        Some(&service),
-        ledger,
-        env,
-        prior,
-    )
-    .await;
-    Ok(staging_errors || engine_errors)
-}
-
 /// The ledger key addressable as `purl`: the exact key, else the entry
 /// whose resolved `base_purl` equals it (see [`lookup_entry`]).
 fn ledger_key_for(state: &VendorState, purl: &str) -> Option<String> {
@@ -507,46 +521,30 @@ async fn run_vendor_json_path(
     );
     let (dl_code, dl_json, records, blobs) =
         boxed_download_patch_records(&selected, &params, api_client, HashMap::new(), prior).await;
-    let mut has_errors = dl_code != 0;
     result["download"] = dl_json;
 
     // 2) The vendor engine, under the same lock as apply/vendor (a no-op
     //    that creates nothing when there is nothing to vendor).
-    let vendor_code = match boxed_scan_vendor_step_reusing(
-        &args.common,
+    let vendor_code = match boxed_vendor_step(VendorStep {
+        common: &args.common,
         records,
-        blobs,
-        api_client.clone(),
+        seed: blobs,
+        client: api_client.clone(),
         use_public_proxy,
+        report_empty: true,
         prior,
-    )
+        download_errors: dl_code != 0,
+        telemetry_token,
+        telemetry_org,
+    })
     .await
     {
-        Ok((vendor_errors, venv)) => {
-            has_errors |= vendor_errors;
-            // Telemetry follows the RUN outcome: a download-phase failure
-            // (a Bun refusal, a failed view fetch) exits 1 and must not
-            // report a successful vendoring of zero patches.
-            track_outcomes_for_vendor(
-                has_errors,
-                &venv,
-                args.common.dry_run,
-                telemetry_token,
-                telemetry_org,
-            )
-            .await;
+        Ok((has_errors, venv)) => {
             result["vendor"] =
                 serde_json::to_value(&venv).unwrap_or_else(|_| serde_json::json!({}));
             i32::from(has_errors)
         }
         Err((code, message, venv)) => {
-            track_patch_vendor_failed(
-                &message,
-                args.common.dry_run,
-                telemetry_token,
-                telemetry_org,
-            )
-            .await;
             // A step that ran (and died at staging) hands back its demoted
             // envelope; it must reach the JSON consumer even though the run
             // aborts here. A lock failure carries none — no `vendor` key.
@@ -622,49 +620,35 @@ async fn run_vendor_interactive_path(
     }
     let (dl_code, dl_json, records, blobs) =
         boxed_download_patch_records(selected, params, api_client, prefetched, prior).await;
-    let mut has_errors = dl_code != 0;
     // Patches the download phase could not get (it reported each one).
     let download_failed = dl_json["failed"].as_u64().unwrap_or(0);
     // The vendor step is a silent no-op on an empty record set (it can't
     // know why it is empty); this arm can.
     let nothing_to_vendor = records.is_empty();
-    let code = match boxed_scan_vendor_step_quiet_empty(
-        &args.common,
+    let code = match boxed_vendor_step(VendorStep {
+        common: &args.common,
         records,
-        blobs,
-        api_client.clone(),
+        seed: blobs,
+        client: api_client.clone(),
         use_public_proxy,
+        report_empty: false,
         prior,
-    )
+        download_errors: dl_code != 0,
+        telemetry_token,
+        telemetry_org,
+    })
     .await
     {
-        Ok((vendor_errors, venv)) => {
-            has_errors |= vendor_errors;
+        Ok((has_errors, _venv)) => {
             if nothing_to_vendor && !args.common.silent {
                 println!("{}", format_nothing_vendored(download_failed));
             }
-            // Run-outcome telemetry, same as the JSON arm above.
-            track_outcomes_for_vendor(
-                has_errors,
-                &venv,
-                args.common.dry_run,
-                telemetry_token,
-                telemetry_org,
-            )
-            .await;
             i32::from(has_errors)
         }
         // Human mode prints no per-event lines even on success, so the
         // carried envelope has no human rendering to feed — JSON mode is
         // where the reconcile events must survive (see the JSON fold above).
         Err((code, message, _envelope)) => {
-            track_patch_vendor_failed(
-                &message,
-                args.common.dry_run,
-                telemetry_token,
-                telemetry_org,
-            )
-            .await;
             eprintln!("{}", format_vendor_step_error(code, &message));
             return 1;
         }
@@ -864,67 +848,14 @@ pub(super) fn boxed_vendor_interactive_path<'a>(
     ))
 }
 
-/// Transient-frame boxed constructor for [`run_scan_vendor_step`] — the
-/// one entry for scan's two arms and for `get --mode vendored`. Same
-/// Windows-stack rationale as [`boxed_vendor_json_path`], one level down.
-pub(crate) fn boxed_scan_vendor_step<'a>(
-    common: &'a GlobalArgs,
-    records: HashMap<String, PatchRecord>,
-    seed: HashMap<String, Vec<u8>>,
-    client: ApiClient,
-    use_public_proxy: bool,
+/// Transient-frame boxed constructor for [`run_vendor_step`] — the one
+/// vendored-apply entry for scan's two arms and for `get --mode vendored`.
+/// Same Windows-stack rationale as [`boxed_vendor_json_path`], one level
+/// down (the engine itself is boxed inside `VendoredBackend::apply`).
+pub(crate) fn boxed_vendor_step<'a>(
+    step: VendorStep<'a>,
 ) -> std::pin::Pin<Box<dyn std::future::Future<Output = VendorStepResult> + 'a>> {
-    Box::pin(run_scan_vendor_step(
-        common,
-        records,
-        seed,
-        client,
-        use_public_proxy,
-        true,
-        None,
-    ))
-}
-
-/// [`boxed_scan_vendor_step`] handing the engine scan's npm crawl to reuse
-/// (see `vendor_records_reusing`).
-fn boxed_scan_vendor_step_reusing<'a>(
-    common: &'a GlobalArgs,
-    records: HashMap<String, PatchRecord>,
-    seed: HashMap<String, Vec<u8>>,
-    client: ApiClient,
-    use_public_proxy: bool,
-    prior: Option<&'a NpmCrawlSnapshot>,
-) -> std::pin::Pin<Box<dyn std::future::Future<Output = VendorStepResult> + 'a>> {
-    Box::pin(run_scan_vendor_step(
-        common,
-        records,
-        seed,
-        client,
-        use_public_proxy,
-        true,
-        prior,
-    ))
-}
-
-/// [`boxed_scan_vendor_step`] without the empty-run line, for scan's
-/// interactive arm, which prints its own (see [`format_nothing_vendored`]).
-fn boxed_scan_vendor_step_quiet_empty<'a>(
-    common: &'a GlobalArgs,
-    records: HashMap<String, PatchRecord>,
-    seed: HashMap<String, Vec<u8>>,
-    client: ApiClient,
-    use_public_proxy: bool,
-    prior: Option<&'a NpmCrawlSnapshot>,
-) -> std::pin::Pin<Box<dyn std::future::Future<Output = VendorStepResult> + 'a>> {
-    Box::pin(run_scan_vendor_step(
-        common,
-        records,
-        seed,
-        client,
-        use_public_proxy,
-        false,
-        prior,
-    ))
+    Box::pin(run_vendor_step(step))
 }
 
 /// Transient-frame boxed constructor for the download-phase future used
@@ -942,25 +873,6 @@ fn boxed_download_patch_records<'a>(
     ))
 }
 
-/// Transient-frame boxed constructor for the vendor engine itself
-/// ([`vendor_records_reusing`]) — the deepest, largest future on the scan-vendor
-/// chain. See [`boxed_vendor_json_path`] for the Windows-stack rationale.
-fn boxed_vendor_records<'a>(
-    common: &'a GlobalArgs,
-    records: &'a HashMap<String, PatchRecord>,
-    sources: &'a socket_patch_core::patch::apply::PatchSources<'a>,
-    service: Option<&'a socket_patch_core::vendor::VendorServiceConfig>,
-    ledger: std::io::Result<VendorState>,
-    env: &'a mut Envelope,
-    prior: Option<&'a NpmCrawlSnapshot>,
-) -> std::pin::Pin<Box<dyn std::future::Future<Output = bool> + 'a>> {
-    // Always detached: vendored mode is manifest-free. The ledger is the
-    // one the harvest just read, so the engine does not reload it.
-    Box::pin(vendor_records_reusing(
-        common, records, sources, /*detached=*/ true, false, env, service, ledger, prior,
-    ))
-}
-
 #[cfg(test)]
 mod migration_tests {
     use super::{
diff --git a/crates/socket-patch-cli/src/commands/vendor.rs b/crates/socket-patch-cli/src/commands/vendor.rs
index 275cf503..efc8f044 100644
--- a/crates/socket-patch-cli/src/commands/vendor.rs
+++ b/crates/socket-patch-cli/src/commands/vendor.rs
@@ -46,11 +46,10 @@ use std::time::Duration;
 use crate::args::{apply_env_toggles, GlobalArgs};
 use crate::commands::apply::{representative_file, result_to_event, variant_matches_installed};
 use crate::commands::bun_preflight::bun_vendor_preflight_pairs;
-use crate::commands::fetch_stage::{
-    drop_unstageable, stage_vendor_sources_in_memory, MemStageOutcome,
-};
 use crate::commands::lock_cli::acquire_or_emit;
-use crate::commands::rollback::VendorRevertStep;
+use crate::commands::vendored_backend::{
+    ApplyRequest, RevertedEntry, VendorRevertStep, VendoredBackend, NO_LOCAL_SOURCE_MESSAGE,
+};
 use crate::commands::vex::{
     generate_vex_from_manifest_path, generate_vex_without_manifest, ManifestlessVex, VexEmbedArgs,
 };
@@ -280,12 +279,11 @@ struct OrphanSweep {
 /// interrupted run). Unparseable dirs are never returned (and never
 /// deleted). Returns the orphans so callers can emit events / counts.
 ///
-/// A missing ledger entry does NOT prove missing wiring: `repair`
-/// reconstructs entries from lockfiles that still point into
-/// `.socket/vendor/` precisely because that state occurs (a deleted
-/// state.json, a partial commit). Deleting such a dir would break the next
-/// install, so every candidate is checked against the wiring-bearing files
-/// first — the same lockfile scan `repair` reconstructs from — and a
+/// A missing ledger entry does NOT prove missing wiring: lockfiles can
+/// still point into `.socket/vendor/` after a deleted state.json or a
+/// partial commit. Deleting such a dir would break the next install, so
+/// every candidate is checked against the wiring-bearing files first — the
+/// same lockfile scan `repair` reports `vendor_ledger_missing` from — and a
 /// referenced dir is kept for the caller to warn about.
 async fn sweep_orphan_vendor_dirs(cwd: &Path, state: &VendorState, dry_run: bool) -> OrphanSweep {
     let recorded_units: HashSet<(&str, &str)> = state
@@ -303,7 +301,7 @@ async fn sweep_orphan_vendor_dirs(cwd: &Path, state: &VendorState, dry_run: bool
         return out;
     }
     let wired: HashSet<(String, String)> =
-        crate::commands::repair_vendor::scan_vendor_references(cwd)
+        crate::commands::vendored_backend::repair::scan_vendor_references(cwd)
             .await
             .into_iter()
             .map(|(eco, uuid, _path)| (eco, uuid))
@@ -412,7 +410,7 @@ fn advisory_tier(code: &str) -> AdvisoryTier {
 /// The human line for a vendor advisory, or `None` when it is hidden at
 /// this verbosity. The stable code is kept on real warnings (it is what
 /// a user searches for); notes carry only the detail.
-fn format_advisory(code: &str, detail: &str, verbose: bool) -> Option<String> {
+pub(crate) fn format_advisory(code: &str, detail: &str, verbose: bool) -> Option<String> {
     match advisory_tier(code) {
         AdvisoryTier::Verbose if !verbose => None,
         AdvisoryTier::Verbose | AdvisoryTier::Note => Some(format!("Note: {detail}")),
@@ -1246,29 +1244,37 @@ async fn run_eject(args: &VendorArgs, pins: Vec<HostedPin>) -> i32 {
                 detail: detail.clone(),
             });
         }
-        let manifest = PatchManifest {
-            patches: records,
-            setup: None,
-        };
-        match crate::commands::scan::vendor_flow::stage_and_vendor(
-            common,
-            &socket_dir,
-            &manifest,
-            blobs,
-            client.clone(),
-            use_public_proxy,
-            &mut env,
-            None,
-        )
-        .await
-        {
+        let manifest = crate::commands::vendored_backend::records_manifest(records);
+        // The same vendored apply as `scan --mode vendored`: detached (the
+        // eject is manifest-free) over this run's client and the shared
+        // service-config assembler.
+        let service = common.vendor_service_config(Some(client.clone()), use_public_proxy);
+        let applied = VendoredBackend::new(common, Some(&service))
+            .apply(
+                ApplyRequest {
+                    manifest: &manifest,
+                    socket_dir: &socket_dir,
+                    ledger: load_state(&common.cwd).await,
+                    seed: blobs,
+                    detached: true,
+                    force: false,
+                    prior: None,
+                },
+                &mut env,
+            )
+            .await;
+        match applied {
             Ok(has_errors) => exit = i32::from(has_errors),
-            Err((code, message)) => {
-                env.mark_error(EnvelopeError::new(code, message.clone()));
+            Err(_) => {
+                let code = "no_local_source";
+                env.mark_error(EnvelopeError::new(code, NO_LOCAL_SOURCE_MESSAGE));
                 if !common.json {
                     eprintln!(
                         "{}",
-                        crate::commands::scan::vendor_flow::format_vendor_step_error(code, &message)
+                        crate::commands::scan::vendor_flow::format_vendor_step_error(
+                            code,
+                            NO_LOCAL_SOURCE_MESSAGE
+                        )
                     );
                 }
                 exit = 1;
@@ -1424,52 +1430,36 @@ async fn run_vendor(
     let (mut has_errors, ledger) = reconcile_dropped(&manifest, common, env).await;
 
     let socket_dir = crate::args::socket_dir_of(manifest_path, &common.cwd);
-    // Vendor stages patch content IN MEMORY: existing .socket artifacts are
-    // read in place, missing content is fetched per patch — vendoring never
-    // writes blobs or temp files (the committed artifact is the patch). No
-    // seed: this manifest-driven command has no download phase.
-    let staged = match stage_vendor_sources_in_memory(
-        common,
-        &manifest,
-        &socket_dir,
-        &common.cwd,
-        ledger.as_ref().map(|s| &s.entries),
-        HashMap::new(),
-        service.client.as_ref(),
-    )
-    .await
-    {
-        MemStageOutcome::Ready(s) => s,
-        MemStageOutcome::Unavailable => {
+    if manifest.patches.is_empty() && !common.json && !common.silent {
+        println!("The manifest has no patches; nothing to vendor.");
+    }
+    // The shared vendored apply: in-memory staging (committed .socket
+    // artifacts read in place, missing content fetched per patch — no seed:
+    // this manifest-driven command has no download phase) → the engine.
+    let applied = VendoredBackend::new(common, Some(service))
+        .apply(
+            ApplyRequest {
+                manifest: &manifest,
+                socket_dir: &socket_dir,
+                ledger,
+                seed: HashMap::new(),
+                detached: false,
+                force: args.force,
+                prior: None,
+            },
+            env,
+        )
+        .await;
+    match applied {
+        Ok(errors) => has_errors |= errors,
+        Err(_) => {
             env.mark_error(EnvelopeError::new(
                 "no_local_source",
-                "patch artifacts unavailable (offline or download failure)",
+                NO_LOCAL_SOURCE_MESSAGE,
             ));
             return 1;
         }
-    };
-    let sources = staged.as_patch_sources();
-    // A patch whose content this run could not obtain is an unsatisfiable
-    // PACKAGE, reported per-package and left out of the engine run — the
-    // rest of the manifest still vendors (the stager reserves its
-    // whole-run `no_local_source` bail for "nothing is stageable").
-    let (records, staging_errors) = drop_unstageable(env, &manifest.patches, staged.unavailable());
-    has_errors |= staging_errors;
-
-    if manifest.patches.is_empty() && !common.json && !common.silent {
-        println!("The manifest has no patches; nothing to vendor.");
     }
-    has_errors |= vendor_records(
-        common,
-        &records,
-        &sources,
-        false,
-        args.force,
-        env,
-        Some(service),
-        ledger,
-    )
-    .await;
 
     if has_errors {
         // A run where EVERY event failed still reads as "partialFailure":
@@ -2167,8 +2157,8 @@ async fn plan_service_downloads(
 /// handed over for this run's persists; an unreadable one is reported here
 /// as `vendor_state_unreadable`. Returns whether any non-benign failure
 /// occurred.
-// The eighth parameter is the caller's one ledger load; bundling it with the
-// run flags would only move the same arguments into a struct.
+// Tests drive the engine without a prior crawl through this shim.
+#[cfg(test)]
 #[allow(clippy::too_many_arguments)]
 pub(crate) async fn vendor_records(
     common: &GlobalArgs,
@@ -3334,7 +3324,7 @@ pub(crate) async fn vendor_records_reusing(
                     None => {
                         let detail = format!(
                             "installed from the vendored artifact {dir}, but the vendor ledger \
-                             has no entry for it; run `socket-patch repair` to restore the entry"
+                             has no entry for it; restore .socket/vendor/state.json from version control"
                         );
                         report_vendor_failure(common, purl, &detail);
                         env.record(
@@ -3470,16 +3460,8 @@ fn flavor_install_command(flavor: &str) -> Option<&'static str> {
 /// pristine source. The committed-artifact rung stages it
 /// inventory-verified instead. Returns the dropped purls whose copy
 /// resolved into a vendored uuid dir, with that dir
-/// (`.socket/vendor/<eco>/<uuid>/`).
-pub(crate) fn drop_vendored_installs(
-    cwd: &Path,
-    packages: &mut HashMap<String, std::path::PathBuf>,
-) -> HashMap<String, String> {
-    drop_vendored_installs_by(cwd, packages, |path| Some(path.as_path()))
-}
-
-/// [`drop_vendored_installs`] over any source map: `path_of` names an
-/// entry's installed location, and entries without one are kept.
+/// (`.socket/vendor/<eco>/<uuid>/`). Works over any source map: `path_of`
+/// names an entry's installed location, and entries without one are kept.
 fn drop_vendored_installs_by<V>(
     cwd: &Path,
     packages: &mut HashMap<String, V>,
@@ -3553,55 +3535,65 @@ pub(crate) async fn reconcile_dropped(
     };
     let stale = manifest_dropped_purls(&state, manifest, common);
     let mut had_error = false;
-    for purl in stale {
-        let entry = state.entries.get(&purl).cloned().expect("listed above");
-        let outcome = dispatch_revert_one(&entry, &common.cwd, common.dry_run).await;
-        for w in &outcome.warnings {
+    let reverted = VendoredBackend::new(common, None)
+        .revert(&stale, &mut state, RevertOpts::new(common.dry_run), false)
+        .await;
+    for RevertedEntry {
+        key: purl,
+        warnings,
+        step,
+        ..
+    } in reverted
+    {
+        for w in &warnings {
             record_warning(env, &purl, w, common);
         }
-        if outcome.success {
-            if outcome.kept_artifact {
-                // Drift-skip keep: the backend left the drifted lock alone
-                // and kept the artifacts, so the ledger entry must survive
-                // too — and the genuine outcome is a COUNTED skip, not a
-                // removal.
+        match step {
+            VendorRevertStep::Missing | VendorRevertStep::Preserved => {}
+            // Drift-skip keep: the backend left the drifted lock alone and
+            // kept the artifacts, so the ledger entry must survive too — and
+            // the genuine outcome is a COUNTED skip, not a removal.
+            VendorRevertStep::Kept => env.record(
+                PatchEvent::new(PatchAction::Skipped, purl.clone()).with_reason(
+                    "vendor_revert_kept",
+                    "patch no longer in manifest, but its lock entries drifted since \
+                     vendoring; artifacts and ledger entry kept",
+                ),
+            ),
+            VendorRevertStep::WouldRevert | VendorRevertStep::Reverted => {
+                if !common.json && !common.silent {
+                    println!("{}", format_reconciled(&purl, common.dry_run));
+                }
                 env.record(
-                    PatchEvent::new(PatchAction::Skipped, purl.clone()).with_reason(
-                        "vendor_revert_kept",
-                        "patch no longer in manifest, but its lock entries drifted since \
-                         vendoring; artifacts and ledger entry kept",
-                    ),
+                    PatchEvent::new(PatchAction::Removed, purl.clone())
+                        .with_reason("vendor_reconciled", "patch no longer in manifest"),
                 );
-                continue;
-            }
-            if !common.json && !common.silent {
-                println!("{}", format_reconciled(&purl, common.dry_run));
             }
-            env.record(
-                PatchEvent::new(PatchAction::Removed, purl.clone())
-                    .with_reason("vendor_reconciled", "patch no longer in manifest"),
-            );
-            if !common.dry_run {
-                state.entries.remove(&purl);
-                // Per-purl save, exactly like `--revert`: crash-consistent
-                // with the wiring just restored, and a failed write fails
-                // the purl rather than leaving it in the ledger silently.
-                if let Err(e) = save_state(&common.cwd, &state).await {
-                    had_error = true;
-                    env.record(
-                        PatchEvent::new(PatchAction::Failed, purl.clone())
-                            .with_error("vendor_state_write_failed", e.to_string()),
-                    );
+            // Reverted on disk, and saved per purl exactly like `--revert`:
+            // a failed write fails the purl rather than leaving it in the
+            // ledger silently.
+            VendorRevertStep::LedgerWriteFailed(e) => {
+                if !common.json && !common.silent {
+                    println!("{}", format_reconciled(&purl, common.dry_run));
                 }
+                env.record(
+                    PatchEvent::new(PatchAction::Removed, purl.clone())
+                        .with_reason("vendor_reconciled", "patch no longer in manifest"),
+                );
+                had_error = true;
+                env.record(
+                    PatchEvent::new(PatchAction::Failed, purl.clone())
+                        .with_error("vendor_state_write_failed", e),
+                );
+            }
+            VendorRevertStep::Failed(detail) => {
+                had_error = true;
+                report_revert_failure(common, &purl, &detail);
+                env.record(
+                    PatchEvent::new(PatchAction::Failed, purl.clone())
+                        .with_error("revert_failed", detail),
+                );
             }
-        } else {
-            had_error = true;
-            let detail = outcome.error.unwrap_or_else(|| "unknown error".into());
-            report_revert_failure(common, &purl, &detail);
-            env.record(
-                PatchEvent::new(PatchAction::Failed, purl.clone())
-                    .with_error("revert_failed", detail),
-            );
         }
     }
     (had_error, Ok(state))
@@ -3626,23 +3618,24 @@ async fn run_revert(args: &VendorArgs, env: &mut Envelope) -> i32 {
     let mut reverted_flavors: HashSet<String> = HashSet::new();
 
     // The one vendored-revert primitive every reverting command shares
-    // (rollback's vendored leg, both of remove's paths): dispatch →
-    // drift-keep → per-entry ledger save. Only the event vocabulary and
-    // the human lines are this command's.
-    for purl in &recorded {
-        // Captured before the revert drops the entry from the ledger.
-        let flavor = state.entries.get(purl).and_then(|e| e.flavor.clone());
-        let result = crate::commands::rollback::revert_vendor_entry(
-            &common.cwd,
-            purl,
-            &mut state,
-            RevertOpts::new(common.dry_run),
-        )
+    // (rollback's vendored leg, both of remove's paths, the manifest
+    // reconcile): dispatch → drift-keep → per-entry ledger save. Only the
+    // event vocabulary and the human lines are this command's.
+    let reverted = VendoredBackend::new(common, None)
+        .revert(&recorded, &mut state, RevertOpts::new(common.dry_run), false)
         .await;
-        for w in &result.warnings {
+    for RevertedEntry {
+        key: purl,
+        flavor,
+        warnings,
+        step,
+    } in reverted
+    {
+        let purl = &purl;
+        for w in &warnings {
             record_warning(env, purl, w, common);
         }
-        match result.step {
+        match step {
             // Every key came from this ledger; `--revert` never preserves.
             VendorRevertStep::Missing | VendorRevertStep::Preserved => {}
             VendorRevertStep::Failed(why) => {
@@ -4579,8 +4572,7 @@ mod gc_tests {
     /// vendor-produced one), so the lock must no longer resolve through
     /// the artifact for the revert to proceed: the unwired-revert guard
     /// refuses to delete an artifact a live lock still points at (the
-    /// repair-reconstruction brick; pinned end-to-end in
-    /// repair_vendor_e2e / repair_vendor_flavors_e2e). Re-lock the
+    /// pre-v5 repair-reconstruction brick). Re-lock the
     /// fixture to the registry — the realistic reclaim shape.
     #[tokio::test]
     async fn vendor_gc_reverts_manifest_dropped_entry() {
diff --git a/crates/socket-patch-cli/src/commands/vendored_backend/mod.rs b/crates/socket-patch-cli/src/commands/vendored_backend/mod.rs
new file mode 100644
index 00000000..65a7dd9b
--- /dev/null
+++ b/crates/socket-patch-cli/src/commands/vendored_backend/mod.rs
@@ -0,0 +1,262 @@
+//! The one vendored-mode backend: [`VendoredBackend`] with its three
+//! operations, shared by every command that vendors, un-vendors or repairs.
+//!
+//! * [`VendoredBackend::apply`] — stage the patch content in memory, run
+//!   the vendor engine ([`vendor_records_reusing`]), persist each ledger
+//!   entry. `vendor`, `scan --mode vendored` (JSON and interactive arms)
+//!   and `get --mode vendored` are its callers; they differ only in where
+//!   the patch records come from (the manifest, or the download phase's
+//!   in-memory records) and in their output shape.
+//! * [`VendoredBackend::revert`] — revert ledger entries through the
+//!   per-ecosystem backends (drift-keep, `--preserve-state` and dry-run
+//!   classification in one place). `vendor --revert`, the manifest
+//!   reconcile, `rollback`'s vendored leg and both of `remove`'s paths map
+//!   its [`VendorRevertStep`]s onto their own event vocabulary.
+//! * [`VendoredBackend::repair`] — health-check the ledger and re-vendor
+//!   missing or corrupt artifacts through `apply`, so a repair downloads
+//!   the patch service's prebuilt artifact exactly like the original
+//!   `vendor` did (local build as the `--vendor-source auto` fallback).
+//!   Lockfile references with no ledger entry are reported, never
+//!   re-synthesized (see [`repair`]).
+//!
+//! The backends themselves (`dispatch_vendor_one`, `dispatch_revert_one*`)
+//! stay in `vendor.rs`; this module is the policy layer over them.
+
+pub(crate) mod repair;
+
+use std::collections::HashMap;
+use std::path::Path;
+
+use socket_patch_core::manifest::schema::{PatchManifest, PatchRecord};
+use socket_patch_core::vendor::{
+    save_state, RevertOpts, VendorServiceConfig, VendorState, VendorWarning,
+};
+
+use crate::args::GlobalArgs;
+use crate::commands::fetch_stage::{
+    drop_unstageable, stage_vendor_sources_in_memory, MemStageOutcome,
+};
+use crate::commands::vendor::{dispatch_revert_one_opts, vendor_records_reusing};
+use crate::ecosystem_dispatch::NpmCrawlSnapshot;
+use crate::json_envelope::Envelope;
+
+/// The vendored-mode backend for one run: the run's global args and its
+/// patch-service config (`None` = build-only; `--revert` never needs one).
+pub(crate) struct VendoredBackend<'a> {
+    pub(crate) common: &'a GlobalArgs,
+    pub(crate) service: Option<&'a VendorServiceConfig>,
+}
+
+/// What [`VendoredBackend::apply`] vendors.
+pub(crate) struct ApplyRequest<'a> {
+    /// The patch records to vendor, keyed by (manifest-spelled) purl. A
+    /// manifest VIEW: staging probes blobs by the records' hashes.
+    pub(crate) manifest: &'a PatchManifest,
+    /// The `.socket/` dir whose committed blobs/diffs/packages staging
+    /// reads in place.
+    pub(crate) socket_dir: &'a Path,
+    /// The vendor ledger, loaded ONCE by the caller under its apply lock:
+    /// the staging harvest reads it, then the engine takes it over for its
+    /// persists. An unreadable one is the engine's loud report.
+    pub(crate) ledger: std::io::Result<VendorState>,
+    /// Blob content the caller already holds (the download phase's), so
+    /// the stager fetches no view twice.
+    pub(crate) seed: HashMap<String, Vec<u8>>,
+    /// `true` for manifest-free vendoring (`scan`/`get --mode vendored`,
+    /// and repair of an entry with no manifest owner).
+    pub(crate) detached: bool,
+    /// `vendor --force`.
+    pub(crate) force: bool,
+    /// The npm half of a crawl this process already made over an untouched
+    /// tree (see [`vendor_records_reusing`]).
+    pub(crate) prior: Option<&'a NpmCrawlSnapshot>,
+}
+
+/// Staging obtained no patch content at all (offline, or every view fetch
+/// failed): nothing reached the engine. Callers report it as
+/// `no_local_source` in their own output shape.
+#[derive(Debug)]
+pub(crate) struct NoLocalSource;
+
+/// The contract message of [`NoLocalSource`].
+pub(crate) const NO_LOCAL_SOURCE_MESSAGE: &str =
+    "patch artifacts unavailable (offline or download failure)";
+
+impl<'a> VendoredBackend<'a> {
+    pub(crate) fn new(common: &'a GlobalArgs, service: Option<&'a VendorServiceConfig>) -> Self {
+        Self { common, service }
+    }
+
+    /// Vendor `req.manifest`'s records. The caller holds the apply lock.
+    ///
+    /// Patch content is staged IN MEMORY (committed `.socket` artifacts read
+    /// in place, the rest fetched per patch over the service config's API
+    /// client) — vendoring never writes blobs. A record whose content could
+    /// not be obtained is reported per package (`no_local_source`) and left
+    /// out; the rest still vendors. `Ok(has_errors)` otherwise.
+    ///
+    /// The engine future is boxed here — this is its transient frame, so no
+    /// caller's poll frame embeds it (Windows' 1 MiB main-thread stack; see
+    /// `scan_run_fits_windows_main_thread_stack`).
+    pub(crate) async fn apply(
+        &self,
+        req: ApplyRequest<'_>,
+        env: &mut Envelope,
+    ) -> Result<bool, NoLocalSource> {
+        let common = self.common;
+        let staged = match stage_vendor_sources_in_memory(
+            common,
+            req.manifest,
+            req.socket_dir,
+            &common.cwd,
+            req.ledger.as_ref().map(|s| &s.entries),
+            req.seed,
+            self.service.and_then(|s| s.client.as_ref()),
+        )
+        .await
+        {
+            MemStageOutcome::Ready(s) => s,
+            MemStageOutcome::Unavailable => return Err(NoLocalSource),
+        };
+        let sources = staged.as_patch_sources();
+        let (records, staging_errors) =
+            drop_unstageable(env, &req.manifest.patches, staged.unavailable());
+        let engine_errors = Box::pin(vendor_records_reusing(
+            common,
+            &records,
+            &sources,
+            req.detached,
+            req.force,
+            env,
+            self.service,
+            req.ledger,
+            req.prior,
+        ))
+        .await;
+        Ok(staging_errors || engine_errors)
+    }
+
+    /// Revert the ledger entries `keys` (in order) with `opts`, mutating
+    /// `state` and saving the ledger per reverted entry (crash-consistent).
+    /// Silent: callers own the human lines and the event vocabulary. With
+    /// `stop_on_failure` the loop ends after the first hard failure (a
+    /// backend refusal or a ledger write failure), which is the last
+    /// element returned — `remove` aborts there without touching the rest.
+    pub(crate) async fn revert(
+        &self,
+        keys: &[String],
+        state: &mut VendorState,
+        opts: RevertOpts,
+        stop_on_failure: bool,
+    ) -> Vec<RevertedEntry> {
+        let mut out = Vec::with_capacity(keys.len());
+        for key in keys {
+            // Captured before a clean revert drops the entry.
+            let flavor = state.entries.get(key).and_then(|e| e.flavor.clone());
+            let result = revert_vendor_entry(&self.common.cwd, key, state, opts).await;
+            let hard_failure = matches!(
+                result.step,
+                VendorRevertStep::Failed(_) | VendorRevertStep::LedgerWriteFailed(_)
+            );
+            out.push(RevertedEntry {
+                key: key.clone(),
+                flavor,
+                warnings: result.warnings,
+                step: result.step,
+            });
+            if stop_on_failure && hard_failure {
+                break;
+            }
+        }
+        out
+    }
+}
+
+/// One entry [`VendoredBackend::revert`] handled.
+pub(crate) struct RevertedEntry {
+    /// The ledger key.
+    pub(crate) key: String,
+    /// The entry's npm-family lockfile flavor, read before the revert (for
+    /// the reinstall hints).
+    pub(crate) flavor: Option<String>,
+    /// The backend's advisories.
+    pub(crate) warnings: Vec<VendorWarning>,
+    pub(crate) step: VendorRevertStep,
+}
+
+/// What one vendored ledger entry's revert did. The drift-keep and
+/// `--preserve-state` rules are identical for every caller by construction.
+pub(crate) enum VendorRevertStep {
+    /// `key` has no ledger entry (a divergent ledger, or an earlier leg
+    /// already reverted it): a silent no-op.
+    Missing,
+    /// The backend refused; nothing changed for this entry.
+    Failed(String),
+    /// Drift-keep: the lock changed under us and the backend left both the
+    /// wiring and the artifact alone. Per `RevertOutcome`'s contract the
+    /// ledger entry — and any manifest record — must survive.
+    Kept,
+    /// Dry run: the revert (or, with `keep_artifact`, the unwire) would
+    /// succeed. Nothing changed.
+    WouldRevert,
+    /// `keep_artifact`: wiring restored; artifact and ledger entry kept
+    /// byte-identical. Its wiring records now describe already-reverted
+    /// fragments, which later reverts replay as silent no-ops (the
+    /// liveness contract), and a re-vendor re-wires from the live lock.
+    Preserved,
+    /// Reverted on disk, dropped from the ledger, ledger saved (per entry,
+    /// so the run is crash-consistent like `vendor --revert`).
+    Reverted,
+    /// Reverted on disk and dropped from the in-memory ledger, but the
+    /// ledger write failed.
+    LedgerWriteFailed(String),
+}
+
+pub(crate) struct VendorRevertResult {
+    pub(crate) warnings: Vec<VendorWarning>,
+    pub(crate) step: VendorRevertStep,
+}
+
+/// Revert the vendored ledger entry `key` (see [`VendorRevertStep`]).
+pub(crate) async fn revert_vendor_entry(
+    cwd: &Path,
+    key: &str,
+    state: &mut VendorState,
+    opts: RevertOpts,
+) -> VendorRevertResult {
+    let Some(entry) = state.entries.get(key).cloned() else {
+        return VendorRevertResult {
+            warnings: Vec::new(),
+            step: VendorRevertStep::Missing,
+        };
+    };
+    let outcome = dispatch_revert_one_opts(&entry, cwd, opts).await;
+    let step = if !outcome.success {
+        VendorRevertStep::Failed(outcome.error.unwrap_or_else(|| "unknown error".into()))
+    } else if outcome.kept_artifact {
+        VendorRevertStep::Kept
+    } else if opts.dry_run {
+        VendorRevertStep::WouldRevert
+    } else if opts.keep_artifact {
+        VendorRevertStep::Preserved
+    } else {
+        state.entries.remove(key);
+        match save_state(cwd, state).await {
+            Ok(()) => VendorRevertStep::Reverted,
+            Err(e) => VendorRevertStep::LedgerWriteFailed(e.to_string()),
+        }
+    };
+    VendorRevertResult {
+        warnings: outcome.warnings,
+        step,
+    }
+}
+
+/// A patch-record map as the manifest view [`ApplyRequest::manifest`]
+/// takes (no `setup` block — vendoring never reads it).
+pub(crate) fn records_manifest(patches: HashMap<String, PatchRecord>) -> PatchManifest {
+    PatchManifest {
+        patches,
+        setup: None,
+    }
+}
diff --git a/crates/socket-patch-cli/src/commands/vendored_backend/repair.rs b/crates/socket-patch-cli/src/commands/vendored_backend/repair.rs
new file mode 100644
index 00000000..390195db
--- /dev/null
+++ b/crates/socket-patch-cli/src/commands/vendored_backend/repair.rs
@@ -0,0 +1,1675 @@
+//! [`VendoredBackend::repair`] — `repair`'s vendored-artifact phase:
+//! re-vendor committed vendor artifacts that the ledger records but that
+//! are missing or corrupt on disk.
+//!
+//! Detection is the core health check ([`check_vendored_artifact`]: per-file
+//! afterHashes + the whole-file ledger sha256 for file-shaped artifacts, the
+//! whole-tree inventory for dir-shaped ones). A broken artifact is
+//! re-vendored through [`VendoredBackend::apply`] — the same engine, the
+//! same `--vendor-source` policy and the same pristine-source ladder as
+//! `vendor` itself — so under the default `auto` source the patch
+//! service's prebuilt artifact is downloaded again (a local build is the
+//! fallback when the service has none, and the only source under
+//! `--offline`/`--vendor-source build`). The backends' wired hot paths
+//! rebuild the ARTIFACT only; lockfiles and the recorded pre-vendor
+//! originals are left alone. A rebuild is verified against its ledger entry
+//! afterwards, fail-closed.
+//!
+//! The ledger is the only source of truth: a lockfile that references
+//! `.socket/vendor/<eco>/<uuid>/` with NO ledger entry (state.json deleted
+//! or never committed) is reported as `vendor_ledger_missing` — repair no
+//! longer re-synthesizes ledger entries from lockfile text, because the
+//! pre-vendor originals a revert needs cannot be recovered from the
+//! rewired lockfile. The remedy is restoring `.socket/vendor/state.json`
+//! from version control and re-running repair.
+
+use std::collections::{HashMap, HashSet};
+use std::path::{Path, PathBuf};
+
+use socket_patch_core::api::client::{get_api_client_with_overrides, ApiClient};
+use socket_patch_core::constants::SOCKET_DIR;
+use socket_patch_core::manifest::schema::{PatchManifest, PatchRecord};
+use socket_patch_core::patch::copy_tree::remove_tree;
+use socket_patch_core::utils::fs::{
+    atomic_write_bytes_preserving_mode, read_regular_to_bytes, read_regular_to_string,
+};
+use socket_patch_core::utils::purl::normalize_purl;
+use socket_patch_core::vendor::{
+    self, artifact_is_file_shaped, check_vendored_artifact, load_state, parse_vendor_path,
+    ArtifactHealth, VendorEntry, VendorState, VendorWarning,
+};
+
+use super::{records_manifest, ApplyRequest, VendoredBackend, NO_LOCAL_SOURCE_MESSAGE};
+use crate::args::GlobalArgs;
+use crate::commands::vendor::{
+    ecosystem_in_scope, format_advisory, persist_vendor_entry, record_warning,
+};
+use crate::json_envelope::{Envelope, PatchAction, PatchEvent};
+use crate::ui::plural;
+
+/// One broken vendored unit queued for re-vendoring.
+#[derive(Clone)]
+struct Candidate {
+    purl: String,
+    entry: VendorEntry,
+    record: PatchRecord,
+    detached: bool,
+    reason: &'static str,
+}
+
+/// Files the vendor backends rewire — the search space for
+/// `.socket/vendor/<eco>/<uuid>/<leaf>` references. The Python locks the
+/// root LISTS (`pylock*.toml`, `*.py.lock` + script) and the requirements
+/// `-r` include tree are appended at scan time.
+const WIRING_FILES: &[&str] = &[
+    "vlt-lock.json",
+    "package-lock.json",
+    "npm-shrinkwrap.json",
+    "pnpm-lock.yaml",
+    "yarn.lock",
+    "bun.lock",
+    "package.json",
+    "Cargo.toml",
+    "Cargo.lock",
+    // Pre-v5 vendored cargo wiring (migrated into Cargo.toml on re-run).
+    ".cargo/config.toml",
+    ".cargo/config",
+    "go.mod",
+    "composer.json",
+    "composer.lock",
+    "Gemfile",
+    "Gemfile.lock",
+    "uv.lock",
+    "pyproject.toml",
+    "poetry.lock",
+    "pdm.lock",
+    "Pipfile.lock",
+    "requirements.txt",
+];
+
+/// Scan the wiring-bearing files for vendored-artifact references,
+/// returning deduped `(ecosystem, uuid, artifact relpath)` triples. Pure
+/// text scan plus native binary Bun resolution records and the canonical
+/// path parser. Used by repair (references the ledger does not cover), by
+/// the orphan sweeps (`vendor --revert`, `scan --prune`: a dir a lockfile
+/// still points at is never deleted) and by rollback.
+pub(crate) async fn scan_vendor_references(project_root: &Path) -> Vec<(String, String, String)> {
+    let mut seen: HashSet<(String, String)> = HashSet::new();
+    let mut out = Vec::new();
+    if !project_root.join("bun.lock").exists() {
+        if let Ok(paths) =
+            socket_patch_core::vendor::bun_lock::binary_vendor_paths(project_root).await
+        {
+            for path in paths {
+                if let Some(parts) = parse_vendor_path(&path) {
+                    if seen.insert((parts.eco.to_string(), parts.uuid.clone())) {
+                        let rel =
+                            format!(".socket/vendor/{}/{}/{}", parts.eco, parts.uuid, parts.leaf);
+                        out.push((parts.eco, parts.uuid, rel));
+                    }
+                }
+            }
+        }
+    }
+
+    let files = wiring_files(project_root).await;
+    for file in files {
+        // FIFO-safe: a pipe under a wiring-file name must be skipped, not
+        // waited on forever in open(2).
+        let Ok(text) = read_regular_to_string(&project_root.join(file)).await else {
+            continue;
+        };
+        let mut rest = text.as_str();
+        while let Some(idx) = rest.find(".socket") {
+            let slice = &rest[idx..];
+            // `:` ends a reference too: pnpm snapshot keys are
+            // `name@file:<path>:` and yaml mappings suffix the path with a
+            // colon — npm names/versions never contain one.
+            let end = slice
+                .find([
+                    '"', '\'', '`', ' ', '\t', '\n', '\r', ',', ')', ']', '}', ';', ':',
+                ])
+                .unwrap_or(slice.len());
+            let candidate = slice[..end].replace('\\', "/");
+            if let Some(parts) = parse_vendor_path(&candidate) {
+                if seen.insert((parts.eco.to_string(), parts.uuid.clone())) {
+                    out.push((
+                        parts.eco.to_string(),
+                        parts.uuid.clone(),
+                        candidate.trim_start_matches("./").to_string(),
+                    ));
+                }
+            }
+            rest = &rest[idx + ".socket".len()..];
+        }
+    }
+    out.sort();
+    out
+}
+
+/// Every wiring-bearing file name the vendor backends may rewrite, relative
+/// to `project_root`: [`WIRING_FILES`], vlt importer manifests, the Python
+/// locks the root lists (and their scripts) and the requirements `-r`
+/// include tree. Sorted and deduplicated; entries need not exist.
+async fn wiring_files(project_root: &Path) -> Vec<String> {
+    let mut files: Vec<String> = WIRING_FILES
+        .iter()
+        .map(|file| (*file).to_string())
+        .collect();
+    files.extend(vendor::vlt_lock::vlt_importer_package_jsons(project_root).await);
+    if let Ok(paths) = socket_patch_core::utils::python_lock::python_lock_paths(project_root) {
+        for path in paths {
+            if let Some(script) =
+                socket_patch_core::utils::python_lock::script_of_lock(&path).map(str::to_string)
+            {
+                files.push(script);
+            }
+            files.push(path);
+        }
+    }
+    // The requirements planner writes a vendored pin where the original pin
+    // was — possibly inside a `-r` include — so the root requirements.txt
+    // alone would miss it (and the orphan sweep, which reuses this scan,
+    // would delete the include-referenced wheel). An unreadable include
+    // tree degrades to the root file, matching the per-file tolerance
+    // below.
+    if let Ok(includes) = socket_patch_core::vendor::requirements_include_names(project_root).await
+    {
+        files.extend(includes);
+    }
+    files.sort();
+    files.dedup();
+    files
+}
+
+/// Record one artifact that cannot be repaired. An error, so the line
+/// prints even under `--silent` (`json` mutes it: the envelope carries it).
+fn fail(env: &mut Envelope, json: bool, purl: &str, code: &str, detail: String) {
+    if !json {
+        eprintln!("{}", format_repair_failure(purl, &detail));
+    }
+    env.record(PatchEvent::new(PatchAction::Failed, purl.to_string()).with_error(code, detail));
+    env.mark_partial_failure();
+}
+
+/// `Error: Cannot repair vendored artifact for <purl>: <detail>`.
+fn format_repair_failure(purl: &str, detail: &str) -> String {
+    format!(
+        "Error: Cannot repair vendored artifact for {}: {detail}",
+        normalize_purl(purl)
+    )
+}
+
+/// The `repair --dry-run` preview of vendored rebuilds: a heading, then
+/// `  - <purl> (<why>: <path>)` per artifact. `items` are
+/// `(purl, reason code, artifact path)`.
+fn format_rebuild_preview(items: &[(String, &str, &str)]) -> Vec<String> {
+    let mut lines = vec![format!(
+        "Would rebuild {}:",
+        plural(items.len(), "vendored artifact", "vendored artifacts")
+    )];
+    lines.extend(items.iter().map(|(purl, reason, path)| {
+        format!("  - {purl} ({}: {path})", rebuild_reason_label(reason))
+    }));
+    lines
+}
+
+/// Plain words for a rebuild candidate's reason code.
+fn rebuild_reason_label(code: &str) -> &str {
+    match code {
+        "vendor_artifact_missing" => "missing",
+        "vendor_artifact_corrupt" => "corrupt",
+        other => other,
+    }
+}
+
+/// The `vendor_ledger_missing` detail for a lockfile reference no ledger
+/// entry owns.
+fn format_ledger_missing(eco: &str, uuid: &str) -> String {
+    format!(
+        "a lockfile references .socket/vendor/{eco}/{uuid}/ but the vendor ledger \
+         (.socket/vendor/state.json) has no entry for it, and repair does not rebuild the \
+         ledger from lockfiles; restore state.json from version control and re-run \
+         `socket-patch repair`, or restore the lockfile (`git checkout -- <lockfile>`) and \
+         re-vendor"
+    )
+}
+
+/// Best-effort removal of a vendored uuid dir after a failed post-verify
+/// (never leave unverifiable bytes behind). Prunes the emptied
+/// `.socket/vendor/<eco>/` (and `vendor/`) husks like every other artifact
+/// removal, stopping at `.socket/`; a sibling unit or the ledger keeps them.
+async fn remove_vendor_dir(cwd: &Path, eco: &str, uuid: &str) {
+    if let Some(rel) = vendor::path::vendor_uuid_dir_rel(eco, uuid) {
+        let _ = socket_patch_core::utils::socket_dir::remove_tree_and_prune(
+            &cwd.join(rel),
+            &cwd.join(SOCKET_DIR),
+        )
+        .await;
+    }
+}
+
+/// Move the live uuid dir aside (same parent, `<uuid>.pre-rebuild`) so the
+/// engine's rebuild-on-MISSING trigger fires while the bytes stay
+/// recoverable: the re-vendor can still refuse or fail, and a failed one
+/// replaced nothing, so the corrupt-but-diagnosable artifact must be
+/// restorable instead of leaving the wired lockfiles pointing at a bare
+/// ENOENT (and the tamper evidence erased). Returns `(live, kept)` for
+/// [`restore_aside_vendor_dir`]; on a rename failure falls back to plain
+/// removal (the rebuild trigger must fire) and returns `None`.
+async fn set_aside_vendor_dir(cwd: &Path, eco: &str, uuid: &str) -> Option<(PathBuf, PathBuf)> {
+    let rel = vendor::path::vendor_uuid_dir_rel(eco, uuid)?;
+    let live = cwd.join(&rel);
+    let kept = cwd.join(format!("{rel}.pre-rebuild"));
+    // A crashed earlier run's leftover must not wedge the rename.
+    let _ = remove_tree(&kept).await;
+    if tokio::fs::rename(&live, &kept).await.is_ok() {
+        Some((live, kept))
+    } else {
+        let _ = remove_tree(&live).await;
+        None
+    }
+}
+
+/// Put the pre-rebuild bytes back after a re-vendor that produced no
+/// replacement (clearing any partial husk the failed backend left first).
+async fn restore_aside_vendor_dir(live: &Path, kept: &Path) {
+    let _ = remove_tree(live).await;
+    let _ = tokio::fs::rename(kept, live).await;
+}
+
+/// Crash recovery for [`set_aside_vendor_dir`]'s transient: a run killed
+/// between the move-aside and the replacement leaves
+/// `.socket/vendor/<eco>/<uuid>.pre-rebuild` as the ONLY copy of bytes the
+/// rewired lockfiles still point at, with the live path a bare ENOENT. Put
+/// every such leftover back where the wiring expects it before the health
+/// pass classifies the unit. A leftover whose live sibling EXISTS is left
+/// alone: the live dir may be the completed replacement or a partial husk,
+/// and only the health pass can tell — a unit it condemns is set aside
+/// again, which clears the leftover. Wet runs only; scope-gated like every
+/// other unit; best-effort throughout.
+async fn restore_orphaned_pre_rebuild_dirs(common: &GlobalArgs) {
+    const SUFFIX: &str = ".pre-rebuild";
+    let vendor_root = common.cwd.join(".socket/vendor");
+    let Ok(mut ecos) = tokio::fs::read_dir(&vendor_root).await else {
+        return;
+    };
+    while let Ok(Some(eco_dir)) = ecos.next_entry().await {
+        let eco = eco_dir.file_name().to_string_lossy().into_owned();
+        if !ecosystem_in_scope(common, &eco) || !eco_dir.path().is_dir() {
+            continue;
+        }
+        let Ok(mut units) = tokio::fs::read_dir(eco_dir.path()).await else {
+            continue;
+        };
+        while let Ok(Some(unit)) = units.next_entry().await {
+            let name = unit.file_name().to_string_lossy().into_owned();
+            let Some(uuid) = name.strip_suffix(SUFFIX) else {
+                continue;
+            };
+            let live = eco_dir.path().join(uuid);
+            if unit.path().is_dir() && tokio::fs::symlink_metadata(&live).await.is_err() {
+                let _ = tokio::fs::rename(unit.path(), &live).await;
+            }
+        }
+    }
+}
+
+/// What [`VendoredBackend::repair`] repairs against.
+pub(crate) struct RepairRequest<'a> {
+    /// `None` when the project has no `.socket/manifest.json` (vendored
+    /// mode is manifest-free).
+    pub(crate) manifest: Option<&'a PatchManifest>,
+    pub(crate) socket_dir: &'a Path,
+    /// [`scan_vendor_references`]'s output for `common.cwd`, taken by the
+    /// caller under the apply lock this phase runs under.
+    pub(crate) references: &'a [(String, String, String)],
+    /// The caller's one `load_state` outcome (under the same lock). An
+    /// unreadable ledger fails this phase loudly (`vendor_state_unreadable`).
+    pub(crate) ledger: std::io::Result<VendorState>,
+    /// The run's API client when the caller already built one: the uuid
+    /// lookups and the re-vendor reuse it instead of constructing another
+    /// (and re-printing its token advisory); `None` builds lazily on first
+    /// need.
+    pub(crate) client: Option<&'a ApiClient>,
+}
+
+impl VendoredBackend<'_> {
+    /// The vendored-artifact phase of `repair` (see the module docs). Runs
+    /// between the download and cleanup phases, under the caller's apply
+    /// lock (and under `--download-only` — restoring artifacts IS repair's
+    /// job). Returns the number of artifacts repaired, for the human
+    /// summary; failures are carried by `env` (`Failed` events +
+    /// partial-failure status).
+    ///
+    /// `self.service` is ignored: repair assembles its own service config
+    /// from `--vendor-source` over the run's client, built only when there
+    /// is something to re-vendor.
+    pub(crate) async fn repair(&self, req: RepairRequest<'_>, env: &mut Envelope) -> usize {
+        let common = self.common;
+        let quiet = common.json || common.silent;
+        let mut repaired = 0usize;
+
+        if !common.dry_run {
+            restore_orphaned_pre_rebuild_dirs(common).await;
+        }
+
+        let mut state = match req.ledger {
+            Ok(s) => s,
+            Err(e) => {
+                // Errors print even under --silent; without this line the
+                // run exits 1 after a clean-looking repair report.
+                if !common.json {
+                    eprintln!(
+                        "{}",
+                        crate::commands::vendor::format_state_unreadable(&e.to_string())
+                    );
+                }
+                env.record(
+                    PatchEvent::artifact(PatchAction::Failed)
+                        .with_error("vendor_state_unreadable", e.to_string()),
+                );
+                env.mark_partial_failure();
+                return repaired;
+            }
+        };
+
+        // The one API client of this phase (and its one-time token-shape
+        // stderr advisory), seeded from the run's client when there is one.
+        let mut api_client: Option<ApiClient> = req.client.cloned();
+        let mut candidates: Vec<Candidate> = Vec::new();
+
+        // ── Health check: every in-scope ledger entry ────────────────────
+        let mut ledger_purls: Vec<String> = state.entries.keys().cloned().collect();
+        ledger_purls.sort();
+        for purl in &ledger_purls {
+            let entry = state.entries[purl].clone();
+            if !ecosystem_in_scope(common, &entry.ecosystem) {
+                continue;
+            }
+            // `detached` is the "no manifest owner" flag. Every entry
+            // embeds its record, so an embedded record does not imply
+            // detached: a manifest-owned entry keeps taking the manifest's
+            // record (a manifest that moved on to a newer patch uuid must
+            // still surface as vendor_uuid_mismatch below, never repair the
+            // stale artifact from the embedded copy), and the embedded copy
+            // stands in only when there is no manifest at all.
+            let record = match (entry.detached, &entry.record, req.manifest) {
+                (true, Some(r), _) => r.clone(),
+                (_, _, Some(m)) => {
+                    match m
+                        .patches
+                        .get(purl)
+                        .cloned()
+                        .or_else(|| m.patches.values().find(|r| r.uuid == entry.uuid).cloned())
+                    {
+                        Some(r) => r,
+                        // Dropped from the manifest: the vendor reconcile
+                        // owns reverting it — not repair's call.
+                        None => continue,
+                    }
+                }
+                // No manifest at all: the embedded copy, else (a ledger
+                // written before every entry embedded its record) the patch
+                // view from the API.
+                (_, Some(r), None) => r.clone(),
+                (_, None, None) => {
+                    match fetch_record_by_uuid(common, &mut api_client, &entry.uuid).await {
+                        Some((_, r)) => r,
+                        None => {
+                            fail(
+                                env,
+                                common.json,
+                                purl,
+                                "vendor_artifact_unrepairable",
+                                format!(
+                                    "no manifest record for patch {} and the patch view \
+                                     could not be fetched (offline or API failure)",
+                                    entry.uuid
+                                ),
+                            );
+                            continue;
+                        }
+                    }
+                }
+            };
+            if record.uuid != entry.uuid {
+                env.record(
+                    PatchEvent::new(PatchAction::Skipped, purl.clone()).with_reason(
+                        "vendor_uuid_mismatch",
+                        "the manifest's patch uuid moved on; run `socket-patch vendor` (or \
+                         `scan --mode vendored`) to re-vendor",
+                    ),
+                );
+                continue;
+            }
+            // Pre-v5 cargo wiring in `.cargo/config*`: move it into the
+            // root Cargo.toml (the v5 location) and record the move in the
+            // ledger — or restore the manifest entry a pre-v5
+            // multi-version vendor lost — and tag an untagged copy + lock
+            // entry with the patch uuid.
+            let entry = if entry.ecosystem == "cargo" {
+                match vendor::cargo::migrate_legacy_wiring(&entry, &common.cwd, common.dry_run)
+                    .await
+                {
+                    Ok(Some((migrated, warnings))) => {
+                        for warning in &warnings {
+                            record_warning(env, purl, warning, common);
+                        }
+                        if common.dry_run {
+                            entry
+                        } else if persist_vendor_entry(
+                            common,
+                            env,
+                            &mut state,
+                            purl,
+                            migrated.clone(),
+                            entry.detached,
+                            &record,
+                        )
+                        .await
+                        {
+                            continue;
+                        } else {
+                            migrated
+                        }
+                    }
+                    Ok(None) => entry,
+                    Err(detail) => {
+                        record_warning(
+                            env,
+                            purl,
+                            &VendorWarning::new(
+                                "cargo_legacy_wiring_kept",
+                                format!(
+                                    "the vendored wiring for {} could not be written into \
+                                     Cargo.toml ({detail}); any pre-v5 .cargo/config wiring \
+                                     was left in place",
+                                    normalize_purl(purl)
+                                ),
+                            ),
+                            common,
+                        );
+                        entry
+                    }
+                }
+            } else {
+                entry
+            };
+            let health = check_vendored_artifact(&common.cwd, &entry, &record).await;
+            if health == ArtifactHealth::Healthy || workspace_copy_issue(&health) {
+                let mut healed = entry.clone();
+                match repair_workspace_copies(&common.cwd, &mut healed, common.dry_run).await {
+                    Ok(true) => {
+                        if common.dry_run {
+                            env.record(
+                                PatchEvent::new(PatchAction::Verified, purl.clone()).with_details(
+                                    serde_json::json!({
+                                        "vendorArtifact": true,
+                                        "wouldRestoreWorkspaceArtifacts": true,
+                                    }),
+                                ),
+                            );
+                        } else if !persist_vendor_entry(
+                            common,
+                            env,
+                            &mut state,
+                            purl,
+                            healed,
+                            entry.detached,
+                            &record,
+                        )
+                        .await
+                        {
+                            env.record(
+                                PatchEvent::new(PatchAction::Rebuilt, purl.clone()).with_details(
+                                    serde_json::json!({
+                                        "path": entry.artifact.path,
+                                        "workspaceArtifactsRestored": true,
+                                        "artifactRebuilt": false,
+                                    }),
+                                ),
+                            );
+                            repaired += 1;
+                        }
+                        continue;
+                    }
+                    Ok(false) => {}
+                    Err(detail) => {
+                        fail(
+                            env,
+                            common.json,
+                            purl,
+                            "vendor_artifact_unrepairable",
+                            detail,
+                        );
+                        continue;
+                    }
+                }
+                if workspace_copy_issue(&health) {
+                    continue;
+                }
+            }
+            match health {
+                ArtifactHealth::Healthy => {
+                    // vlt's `<uuid>/.gitignore` and `.gitattributes` are not
+                    // part of the artifact: a missing or edited one is
+                    // simply rewritten.
+                    if entry.ecosystem == "npm"
+                        && entry.flavor.as_deref() == Some(vendor::vlt_lock::FLAVOR)
+                        && !common.dry_run
+                    {
+                        if let Err(e) =
+                            vendor::vlt_lock::restore_vlt_uuid_metadata(&entry, &common.cwd).await
+                        {
+                            fail(
+                                env,
+                                common.json,
+                                purl,
+                                "vendor_artifact_unrepairable",
+                                format!("cannot restore the vendored dir's .gitignore: {e}"),
+                            );
+                            continue;
+                        }
+                    }
+                    // Dir-shaped gem artifacts from pre-inventory vendors:
+                    // the health check could only verify the PATCHED members
+                    // — unpatched-file drift is invisible until a re-vendor
+                    // records the whole-tree inventory. Named for gem only:
+                    // vlt also records inventories but has no pre-inventory
+                    // entries, and the other dir-shaped backends
+                    // (cargo/golang/composer) record none, so the advice
+                    // would be permanent per-run noise there.
+                    if entry.ecosystem == "gem"
+                        && !artifact_is_file_shaped(&entry.artifact.path)
+                        && entry.artifact.file_inventory.is_none()
+                    {
+                        record_warning(
+                            env,
+                            purl,
+                            &VendorWarning::new(
+                                "vendor_inventory_missing",
+                                format!(
+                                    "the ledger entry for {} records no file inventory \
+                                     (pre-inventory vendor); only the patched members were \
+                                     verified — re-vendor to make unpatched-file drift \
+                                     detectable",
+                                    normalize_purl(purl)
+                                ),
+                            ),
+                            common,
+                        );
+                    }
+                }
+                ArtifactHealth::StaleUuid => {
+                    env.record(
+                        PatchEvent::new(PatchAction::Skipped, purl.clone()).with_reason(
+                            "vendor_uuid_mismatch",
+                            "a re-vendor is pending for this package; run `socket-patch vendor`",
+                        ),
+                    );
+                }
+                ArtifactHealth::Unverifiable { reason } => {
+                    fail(
+                        env,
+                        common.json,
+                        purl,
+                        "vendor_artifact_unrepairable",
+                        format!("the ledger entry cannot be verified ({reason}); fix state.json"),
+                    );
+                }
+                ArtifactHealth::UnknownFlavor { flavor } => {
+                    record_warning(
+                        env,
+                        purl,
+                        &VendorWarning::new(
+                            "vendor_wiring_unknown_revert_blocked",
+                            format!(
+                                "{} was vendored for the npm flavor `{flavor}`, which this \
+                                 socket-patch release does not understand; left untouched — \
+                                 upgrade socket-patch",
+                                normalize_purl(purl)
+                            ),
+                        ),
+                        common,
+                    );
+                }
+                health @ (ArtifactHealth::Missing | ArtifactHealth::Corrupt { .. }) => {
+                    let reason = if matches!(health, ArtifactHealth::Missing) {
+                        "vendor_artifact_missing"
+                    } else {
+                        "vendor_artifact_corrupt"
+                    };
+                    let detached = entry.detached;
+                    candidates.push(Candidate {
+                        purl: purl.clone(),
+                        entry,
+                        record,
+                        detached,
+                        reason,
+                    });
+                }
+            }
+        }
+
+        // ── Lockfile references no ledger entry owns ─────────────────────
+        // Reported, never re-synthesized: the pre-vendor originals a revert
+        // replays are not recoverable from the rewired lockfile.
+        let covered: HashSet<(String, String)> = state
+            .entries
+            .values()
+            .map(|e| (e.ecosystem.clone(), e.uuid.clone()))
+            .collect();
+        for (eco, uuid, path) in req.references {
+            if covered.contains(&(eco.clone(), uuid.clone())) || !ecosystem_in_scope(common, eco) {
+                continue;
+            }
+            // No ledger entry means no purl to name: the event carries the
+            // uuid and the referenced path instead.
+            let detail = format_ledger_missing(eco, uuid);
+            if !common.json {
+                eprintln!("Error: Cannot repair vendored artifact {path}: {detail}");
+            }
+            env.record(
+                PatchEvent::artifact(PatchAction::Failed)
+                    .with_uuid(uuid.clone())
+                    .with_error("vendor_ledger_missing", detail)
+                    .with_details(serde_json::json!({ "ecosystem": eco, "path": path })),
+            );
+            env.mark_partial_failure();
+        }
+
+        if candidates.is_empty() {
+            return repaired;
+        }
+
+        // ── Dry run: preview only ────────────────────────────────────────
+        if common.dry_run {
+            if !quiet {
+                let items: Vec<(String, &str, &str)> = candidates
+                    .iter()
+                    .map(|c| {
+                        let purl = normalize_purl(&c.purl).into_owned();
+                        (purl, c.reason, c.entry.artifact.path.as_str())
+                    })
+                    .collect();
+                println!();
+                for line in format_rebuild_preview(&items) {
+                    println!("{line}");
+                }
+            }
+            for c in &candidates {
+                env.record(
+                    PatchEvent::new(PatchAction::Verified, c.purl.clone()).with_details(
+                        serde_json::json!({
+                            "vendorArtifact": true,
+                            "wouldRebuild": true,
+                            "reason": c.reason,
+                            "path": c.entry.artifact.path,
+                        }),
+                    ),
+                );
+            }
+            return repaired;
+        }
+
+        if !quiet {
+            println!();
+            println!(
+                "Rebuilding {}...",
+                plural(
+                    candidates.len(),
+                    "broken vendored artifact",
+                    "broken vendored artifacts"
+                )
+            );
+        }
+
+        // ── Re-vendor through the shared apply engine ────────────────────
+        // Repair restores the RECORDED artifact; it never re-vendors. The
+        // engine runs with the lockfiles and ledger snapshotted and put back
+        // afterwards, and every candidate is verified against its original
+        // ledger entry, so a source that produces different bytes (a service
+        // archive re-gzipped since vendoring) can never be committed.
+        //
+        // The afterHash-verified members of a corrupt artifact are harvested
+        // first: they are patch content staging can use offline, and the
+        // move-aside below takes the artifact out of the path staging reads.
+        let candidate_records: HashMap<String, PatchRecord> = candidates
+            .iter()
+            .map(|c| (c.purl.clone(), c.record.clone()))
+            .collect();
+        let seed =
+            vendor::harvest_artifact_blobs_from(&common.cwd, &state.entries, &candidate_records)
+                .await;
+        let snapshot = snapshot_wiring(&common.cwd, &candidates).await;
+        // A corrupt artifact is moved aside so the engine's
+        // rebuild-on-missing path fires; it goes back if nothing replaced
+        // it. A missing one has nothing to keep.
+        let mut aside: HashMap<String, (PathBuf, PathBuf)> = HashMap::new();
+        for c in &candidates {
+            if c.reason == "vendor_artifact_corrupt" {
+                if let Some(pair) =
+                    set_aside_vendor_dir(&common.cwd, &c.entry.ecosystem, &c.entry.uuid).await
+                {
+                    aside.insert(c.purl.clone(), pair);
+                }
+            }
+        }
+        if api_client.is_none() && !common.offline {
+            api_client = Some(
+                get_api_client_with_overrides(common.api_client_overrides())
+                    .await
+                    .0,
+            );
+        }
+        let use_public_proxy = api_client
+            .as_ref()
+            .is_some_and(ApiClient::uses_public_proxy);
+        let service = common.vendor_service_config(api_client, use_public_proxy);
+        // The engine runs quiet into a scratch envelope: repair speaks in
+        // its own vocabulary (`rebuilt`, "Cannot repair …") and translates
+        // each candidate's outcome below.
+        let mut engine_common = common.clone();
+        engine_common.json = true;
+        engine_common.silent = true;
+        let mut scratch = Envelope::new(crate::json_envelope::Command::Vendor);
+        let mut no_source = run_engine(
+            &engine_common,
+            Some(&service),
+            &candidates,
+            &seed,
+            req.socket_dir,
+            &mut scratch,
+        )
+        .await;
+
+        // A service archive that is not the recorded artifact: undo what
+        // the engine wired for it and rebuild locally (deterministic), then
+        // verify again.
+        let mut retry: Vec<Candidate> = Vec::new();
+        for c in &candidates {
+            let from_service = scratch.events.iter().any(|e| {
+                e.purl.as_deref() == Some(c.purl.as_str())
+                    && e.error_code.as_deref() == Some("vendor_prebuilt_downloaded")
+            });
+            if from_service
+                && !keeps_identity(&check_vendored_artifact(&common.cwd, &c.entry, &c.record).await)
+            {
+                undo_candidate(&common.cwd, c, &snapshot).await;
+                remove_vendor_dir(&common.cwd, &c.entry.ecosystem, &c.entry.uuid).await;
+                retry.push(c.clone());
+            }
+        }
+        if !retry.is_empty() {
+            scratch.events.retain(|e| {
+                !retry
+                    .iter()
+                    .any(|c| e.purl.as_deref() == Some(c.purl.as_str()))
+            });
+            no_source |= run_engine(
+                &engine_common,
+                None,
+                &retry,
+                &seed,
+                req.socket_dir,
+                &mut scratch,
+            )
+            .await;
+        }
+        let mut state = load_state(&common.cwd).await.unwrap_or(state);
+
+        for c in candidates {
+            let kept = aside.remove(&c.purl);
+            let outcome = EngineOutcome::of(&scratch, &c.purl);
+            forward_advisories(env, common, &scratch, &c.purl);
+            // Verified against the ORIGINAL entry: the recorded identity is
+            // the target, never a fingerprint this run just wrote.
+            let mut health = check_vendored_artifact(&common.cwd, &c.entry, &c.record).await;
+            // The entry to keep: the backend's (a tagged cargo rebuild
+            // re-records its wiring) when it rebuilt the recorded artifact,
+            // else the original.
+            let mut entry = state
+                .entries
+                .get(&c.purl)
+                .filter(|e| e.uuid == c.entry.uuid)
+                .cloned()
+                .unwrap_or_else(|| c.entry.clone());
+            // A dir-shaped rebuild whose PATCHED members verify but whose
+            // tree differs from an inventory the backend carried over
+            // unchanged (the cargo backend records none of its own): the
+            // entry recorded another build source's tree (the patch
+            // service's prebuilt artifact). Failing would delete a verified
+            // rebuild and re-fail every later repair, so refresh the
+            // inventory from the rebuild instead, loudly.
+            if c.entry.artifact.file_inventory.is_some()
+                && matches!(&health, ArtifactHealth::Corrupt { reason }
+                    if reason == "vendor_inventory_mismatch")
+            {
+                let abs = common.cwd.join(entry.artifact.path.replace('\\', "/"));
+                if let Ok(inv) = artifact_dir_inventory(&entry, &abs).await {
+                    let mut refreshed = entry.clone();
+                    refreshed.artifact.file_inventory = Some(inv);
+                    if check_vendored_artifact(&common.cwd, &refreshed, &c.record).await
+                        == ArtifactHealth::Healthy
+                    {
+                        record_warning(
+                            env,
+                            &c.purl,
+                            &VendorWarning::new(
+                                "vendor_inventory_refreshed",
+                                INVENTORY_REFRESHED_DETAIL,
+                            ),
+                            common,
+                        );
+                        if persist_vendor_entry(
+                            common,
+                            env,
+                            &mut state,
+                            &c.purl,
+                            refreshed.clone(),
+                            c.detached,
+                            &c.record,
+                        )
+                        .await
+                        {
+                            // The write failure is the outcome (already
+                            // recorded): keep the member-verified rebuild
+                            // on disk, but never claim it `rebuilt`.
+                            env.mark_partial_failure();
+                            if let Some((_, kept)) = &kept {
+                                let _ = remove_tree(kept).await;
+                            }
+                            continue;
+                        }
+                        entry = refreshed;
+                        health = ArtifactHealth::Healthy;
+                    }
+                }
+            }
+            let produced = outcome.failure.is_none()
+                && (outcome.rebuilt
+                    || (outcome.in_sync
+                        && tokio::fs::symlink_metadata(common.cwd.join(&entry.artifact.path))
+                            .await
+                            .is_ok()));
+            if produced && health == ArtifactHealth::Healthy {
+                if let Some((_, kept)) = &kept {
+                    if let Some(w) =
+                        vendor::vlt_lock::keep_vlt_links(&c.entry, kept, &common.cwd).await
+                    {
+                        record_warning(env, &c.purl, &w, common);
+                    }
+                    let _ = remove_tree(kept).await;
+                }
+                if !quiet {
+                    println!(
+                        "Rebuilt {} ({})",
+                        normalize_purl(&c.purl),
+                        entry.artifact.path
+                    );
+                }
+                env.record(
+                    PatchEvent::new(PatchAction::Rebuilt, c.purl.clone()).with_details(
+                        serde_json::json!({
+                            "path": entry.artifact.path,
+                            "reason": c.reason,
+                        }),
+                    ),
+                );
+                repaired += 1;
+                continue;
+            }
+            // Not the recorded artifact: put back the wiring and ledger entry
+            // the engine may have rewritten for it.
+            undo_candidate(&common.cwd, &c, &snapshot).await;
+            if produced {
+                // The re-vendor did not reproduce the recorded artifact
+                // (e.g. a tampered ledger sha): remove it rather than leave
+                // unverifiable bytes behind.
+                remove_vendor_dir(&common.cwd, &c.entry.ecosystem, &c.entry.uuid).await;
+                if let Some((_, kept)) = &kept {
+                    let _ = remove_tree(kept).await;
+                }
+                fail(
+                    env,
+                    common.json,
+                    &c.purl,
+                    "vendor_artifact_rebuild_failed",
+                    format!(
+                        "the rebuilt artifact does not match the recorded fingerprint \
+                         ({health:?}); if state.json was edited, run `socket-patch vendor` \
+                         to re-vendor from scratch",
+                    ),
+                );
+                continue;
+            }
+            // Nothing replaced the artifact: put the pre-rebuild bytes back.
+            if let Some((live, kept)) = &kept {
+                restore_aside_vendor_dir(live, kept).await;
+            }
+            let (code, detail) = match outcome.failure {
+                // The dispatch ran and failed: repair's rebuild vocabulary.
+                Some((code, detail)) if code == "apply_failed" => {
+                    ("vendor_artifact_rebuild_failed".to_string(), detail)
+                }
+                // No pristine source: a compiled wheel can only come back
+                // from an install on its own platform.
+                Some((code, _))
+                    if code == "vendor_artifact_unrepairable"
+                        && c.entry.artifact.platform_locked == Some(true) =>
+                {
+                    (
+                        code,
+                        "the vendored wheel is platform-locked (compiled) and no pristine \
+                         source was found; reinstall the package on this platform and re-run \
+                         repair, or run `socket-patch vendor` to rebuild it"
+                            .to_string(),
+                    )
+                }
+                Some((code, detail)) => (code, detail),
+                None if no_source || outcome.no_source => (
+                    c.reason.to_string(),
+                    format!(
+                        "the vendored artifact at {} is broken and its patch content could \
+                         not be obtained (no local source: {})",
+                        c.entry.artifact.path,
+                        if common.offline {
+                            "--offline prevents fetching it"
+                        } else {
+                            NO_LOCAL_SOURCE_MESSAGE
+                        }
+                    ),
+                ),
+                None => (
+                    c.reason.to_string(),
+                    format!(
+                        "the vendored artifact at {} is broken and could not be re-vendored",
+                        c.entry.artifact.path
+                    ),
+                ),
+            };
+            // An offline run that could not re-vendor says why.
+            let detail = if common.offline && !detail.contains("--offline") {
+                format!("{detail} (--offline prevents fetching a source)")
+            } else {
+                detail
+            };
+            fail(env, common.json, &c.purl, &code, detail);
+        }
+        repaired
+    }
+}
+
+/// The `vendor_inventory_refreshed` detail.
+const INVENTORY_REFRESHED_DETAIL: &str = "the re-vendored artifact's patched files verify but its \
+     tree differs from the recorded file inventory (the entry was likely vendored from a \
+     different source, such as the patch service's prebuilt artifact); the inventory was \
+     refreshed from the verified rebuild — run `socket-patch vendor` to restore the \
+     service-built tree";
+
+/// Run the vendor engine over `candidates` (manifest-owned and detached
+/// groups separately) into `scratch`. `service: None` is a build-only run.
+/// `true` when staging obtained no patch content for a group.
+async fn run_engine(
+    engine_common: &GlobalArgs,
+    service: Option<&vendor::VendorServiceConfig>,
+    candidates: &[Candidate],
+    seed: &HashMap<String, Vec<u8>>,
+    socket_dir: &Path,
+    scratch: &mut Envelope,
+) -> bool {
+    let engine = VendoredBackend::new(engine_common, service);
+    let mut no_source = false;
+    for detached in [false, true] {
+        let records: HashMap<String, PatchRecord> = candidates
+            .iter()
+            .filter(|c| c.detached == detached)
+            .map(|c| (c.purl.clone(), c.record.clone()))
+            .collect();
+        if records.is_empty() {
+            continue;
+        }
+        let manifest = records_manifest(records);
+        let applied = engine
+            .apply(
+                ApplyRequest {
+                    manifest: &manifest,
+                    socket_dir,
+                    ledger: load_state(&engine_common.cwd).await,
+                    seed: seed.clone(),
+                    detached,
+                    force: false,
+                    prior: None,
+                },
+                scratch,
+            )
+            .await;
+        no_source |= applied.is_err();
+    }
+    no_source
+}
+
+/// One wiring file as it was before the re-vendor: its bytes (`None`: it
+/// did not exist) and, for a symlinked lockfile, the link text — lockfile
+/// writers rename over the path, which replaces a link with a file.
+struct WiringSnapshot {
+    path: PathBuf,
+    link: Option<PathBuf>,
+    bytes: Option<Vec<u8>>,
+}
+
+/// Snapshot each candidate's recorded wiring files — what a re-vendor may
+/// rewrite for it. Reads are FIFO-safe; a non-regular file is skipped.
+async fn snapshot_wiring(cwd: &Path, candidates: &[Candidate]) -> Vec<WiringSnapshot> {
+    let mut rels: Vec<String> = Vec::new();
+    for c in candidates {
+        rels.extend(c.entry.wiring.iter().map(|w| w.file.clone()));
+    }
+    rels.sort();
+    rels.dedup();
+    let mut out = Vec::with_capacity(rels.len());
+    for rel in rels {
+        let path = cwd.join(&rel);
+        let bytes = match read_regular_to_bytes(&path).await {
+            Ok(bytes) => Some(bytes),
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => None,
+            Err(_) => continue,
+        };
+        let link = tokio::fs::read_link(&path).await.ok();
+        out.push(WiringSnapshot { path, link, bytes });
+    }
+    out
+}
+
+/// Whether a rebuilt artifact still is the recorded one: healthy against
+/// the original entry, or (dir-shaped) its patched members verify and only
+/// the recorded whole-tree inventory differs — the inventory-refresh case.
+fn keeps_identity(health: &ArtifactHealth) -> bool {
+    match health {
+        ArtifactHealth::Healthy => true,
+        ArtifactHealth::Corrupt { reason } => reason == "vendor_inventory_mismatch",
+        _ => false,
+    }
+}
+
+/// Undo what a re-vendor may have written for `c`: its recorded wiring
+/// files go back to their snapshotted bytes (a replaced symlink is
+/// re-linked and its target rewritten) and its ledger entry to the
+/// original. Other candidates' files are left alone.
+async fn undo_candidate(cwd: &Path, c: &Candidate, snapshot: &[WiringSnapshot]) {
+    let wired: HashSet<PathBuf> = c.entry.wiring.iter().map(|w| cwd.join(&w.file)).collect();
+    for snap in snapshot.iter().filter(|s| wired.contains(&s.path)) {
+        if let Some(link) = &snap.link {
+            if tokio::fs::read_link(&snap.path).await.ok().as_ref() != Some(link) {
+                let _ = tokio::fs::remove_file(&snap.path).await;
+                if relink(link, &snap.path).await.is_err() {
+                    continue;
+                }
+            }
+        }
+        if read_regular_to_bytes(&snap.path).await.ok() == snap.bytes {
+            continue;
+        }
+        match &snap.bytes {
+            // Staged, fsynced and renamed over the link's target (or the
+            // file itself), keeping its mode.
+            Some(bytes) => {
+                let target = tokio::fs::canonicalize(&snap.path)
+                    .await
+                    .unwrap_or_else(|_| snap.path.clone());
+                let _ = atomic_write_bytes_preserving_mode(&target, bytes).await;
+            }
+            None => {
+                let _ = tokio::fs::remove_file(&snap.path).await;
+            }
+        }
+    }
+    if let Ok(mut state) = load_state(cwd).await {
+        if state.entries.get(&c.purl) != Some(&c.entry) {
+            state.entries.insert(c.purl.clone(), c.entry.clone());
+            let _ = vendor::save_state(cwd, &state).await;
+        }
+    }
+}
+
+#[cfg(unix)]
+async fn relink(link: &Path, at: &Path) -> std::io::Result<()> {
+    tokio::fs::symlink(link, at).await
+}
+
+#[cfg(windows)]
+async fn relink(link: &Path, at: &Path) -> std::io::Result<()> {
+    tokio::fs::symlink_file(link, at).await
+}
+
+/// One candidate's outcome in the engine's scratch envelope.
+struct EngineOutcome {
+    /// The engine vendored it (`applied`).
+    rebuilt: bool,
+    /// The engine found the wiring in sync (`already_vendored`). A backend
+    /// whose committed artifact was missing re-acquires it and still
+    /// reports in-sync (the lock already pins those bytes), so this counts
+    /// as produced when the artifact exists afterwards.
+    in_sync: bool,
+    /// Its failure or genuine skip, as `(code, detail)`.
+    failure: Option<(String, String)>,
+    /// Staging could not obtain its patch content (`no_local_source`).
+    no_source: bool,
+}
+
+/// Engine skip codes that are a package's OUTCOME (everything else a
+/// `Skipped` event carries is an uncounted advisory).
+const OUTCOME_SKIPS: &[&str] = &["package_not_installed", "vendor_unsupported_ecosystem"];
+
+/// Engine advisories repair does not forward: its own `rebuilt` event and
+/// candidate reason already say it.
+const SUPPRESSED_ADVISORIES: &[&str] = &["vendor_artifact_missing", "vendor_artifact_rebuilt"];
+
+impl EngineOutcome {
+    fn of(scratch: &Envelope, purl: &str) -> Self {
+        let mut out = EngineOutcome {
+            rebuilt: false,
+            in_sync: false,
+            failure: None,
+            no_source: false,
+        };
+        for ev in scratch
+            .events
+            .iter()
+            .filter(|e| e.purl.as_deref() == Some(purl))
+        {
+            let code = ev.error_code.clone().unwrap_or_default();
+            let detail = ev
+                .error
+                .clone()
+                .or_else(|| ev.reason.clone())
+                .unwrap_or_default();
+            match ev.action {
+                PatchAction::Applied => out.rebuilt = true,
+                PatchAction::Skipped if code == "already_vendored" => out.in_sync = true,
+                PatchAction::Failed if out.failure.is_none() => {
+                    out.no_source |= code == "no_local_source";
+                    out.failure = Some((code, detail));
+                }
+                PatchAction::Skipped
+                    if out.failure.is_none() && OUTCOME_SKIPS.contains(&code.as_str()) =>
+                {
+                    out.failure = Some(("vendor_artifact_unrepairable".to_string(), detail));
+                }
+                _ => {}
+            }
+        }
+        if !out.rebuilt && !out.in_sync && out.failure.is_none() {
+            if let Some(e) = &scratch.error {
+                out.failure = Some((e.code.clone(), e.message.clone()));
+            }
+        }
+        out
+    }
+}
+
+/// Carry the engine's advisories for `purl` into repair's envelope (as
+/// uncounted events, like every vendor advisory) and onto stderr at the
+/// vendor command's own tiers.
+fn forward_advisories(env: &mut Envelope, common: &GlobalArgs, scratch: &Envelope, purl: &str) {
+    for ev in scratch
+        .events
+        .iter()
+        .filter(|e| e.purl.as_deref() == Some(purl) && matches!(e.action, PatchAction::Skipped))
+    {
+        let code = ev.error_code.as_deref().unwrap_or_default();
+        if OUTCOME_SKIPS.contains(&code) || SUPPRESSED_ADVISORIES.contains(&code) {
+            continue;
+        }
+        let detail = ev.reason.as_deref().unwrap_or_default();
+        if !common.silent && !common.json {
+            if let Some(line) = format_advisory(code, detail, common.verbose) {
+                eprintln!("{line}");
+            }
+        }
+        env.events.push(ev.clone());
+    }
+}
+
+/// A dir artifact's inventory: an npm dir (vlt's package dir) leaves out
+/// its `node_modules/`, which holds vlt's links and is never part of it.
+async fn artifact_dir_inventory(
+    entry: &VendorEntry,
+    abs: &Path,
+) -> Result<std::collections::BTreeMap<String, String>, String> {
+    if entry.ecosystem == "npm" {
+        vendor::compute_package_dir_inventory(abs).await
+    } else {
+        vendor::compute_dir_inventory(abs).await
+    }
+}
+
+fn workspace_copy_issue(health: &ArtifactHealth) -> bool {
+    matches!(health, ArtifactHealth::Corrupt { reason }
+        if reason == "vendor_workspace_artifact_missing" || reason == "vendor_workspace_artifact_corrupt")
+}
+
+/// Preserve package originals while adopting/rebuilding every member-relative
+/// copy from a canonical tarball whose whole-file fingerprint is trusted.
+async fn repair_workspace_copies(
+    root: &Path,
+    entry: &mut VendorEntry,
+    dry_run: bool,
+) -> Result<bool, String> {
+    let (wiring, mut changed) =
+        vendor::bun_lock::repair_binary_workspace_artifacts(root, entry, dry_run).await?;
+    for record in wiring {
+        match entry
+            .wiring
+            .iter_mut()
+            .find(|previous| previous.kind == record.kind && previous.file == record.file)
+        {
+            Some(previous) if *previous != record => {
+                *previous = record;
+                changed = true;
+            }
+            Some(_) => {}
+            None => {
+                entry.wiring.push(record);
+                changed = true;
+            }
+        }
+    }
+    Ok(changed)
+}
+
+/// Fetch one patch view by uuid (proxy-aware) and shape it as a manifest
+/// record; `None` offline or on any API failure. `client_cache` holds the
+/// one API client the whole vendored-artifact phase shares — construction
+/// re-prints the token-shape stderr advisory, so N uuid lookups must not
+/// print it N times. Built lazily: a run with nothing to look up never
+/// constructs (or warns) at all.
+async fn fetch_record_by_uuid(
+    common: &GlobalArgs,
+    client_cache: &mut Option<ApiClient>,
+    uuid: &str,
+) -> Option<(String, PatchRecord)> {
+    if common.offline {
+        return None;
+    }
+    if client_cache.is_none() {
+        *client_cache = Some(
+            get_api_client_with_overrides(common.api_client_overrides())
+                .await
+                .0,
+        );
+    }
+    let client = client_cache
+        .as_ref()
+        .expect("client_cache was just initialized above");
+    let patch = client.fetch_patch(uuid).await.ok()??;
+    Some(crate::commands::get::record_from_patch_response(&patch))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Build a local native binary resolution through the public binary
+    /// rewrite entry point, which shares the codec with vendor's backend.
+    fn native_binary_vendor_fixture(uuid: &str) -> Vec<u8> {
+        use socket_patch_core::patch::redirect::{
+            rewrite_bun_binary, DepOverride, Integrity, RewriteResult,
+        };
+        let bytes = include_bytes!(
+            "../../../../socket-patch-core/tests/fixtures/bun-lockb/1.1.45/bun.lockb"
+        );
+        let mut result = RewriteResult::default();
+        rewrite_bun_binary(
+            bytes,
+            &[DepOverride {
+                ecosystem: "npm".into(),
+                name: "minimist".into(),
+                namespace: None,
+                version: "1.2.2".into(),
+                token: String::new(),
+                patch_uuid: uuid.into(),
+                artifact_url: format!("./.socket/vendor/npm/{uuid}/minimist-1.2.2.tgz"),
+                berry_zip_url: None,
+                registry_override: None,
+                integrity: Integrity {
+                    sha512: Some(format!("sha512-{}", "A".repeat(86) + "==")),
+                    ..Default::default()
+                },
+            }],
+            &mut result,
+        );
+        assert!(result.warnings.is_empty(), "{:?}", result.warnings);
+        result.binary_files.remove("bun.lockb").unwrap()
+    }
+
+    #[tokio::test]
+    async fn binary_bun_references_are_scanned_without_a_ledger() {
+        let root = tempfile::tempdir().unwrap();
+        let uuid = "11111111-1111-4111-8111-111111111111";
+        tokio::fs::write(
+            root.path().join("bun.lockb"),
+            native_binary_vendor_fixture(uuid),
+        )
+        .await
+        .unwrap();
+        let references = scan_vendor_references(root.path()).await;
+        assert_eq!(
+            references,
+            vec![(
+                "npm".into(),
+                uuid.into(),
+                format!(".socket/vendor/npm/{uuid}/minimist-1.2.2.tgz")
+            )]
+        );
+        assert!(!root.path().join(".socket/vendor/state.json").exists());
+
+        // Text takes precedence even if the older binary still references
+        // an artifact: a stale binary must not keep an artifact "wired".
+        tokio::fs::write(root.path().join("bun.lock"), "{}\n")
+            .await
+            .unwrap();
+        assert!(scan_vendor_references(root.path()).await.is_empty());
+        tokio::fs::remove_file(root.path().join("bun.lock"))
+            .await
+            .unwrap();
+        tokio::fs::write(root.path().join("bun.lockb"), b"malformed")
+            .await
+            .unwrap();
+        assert!(scan_vendor_references(root.path()).await.is_empty());
+    }
+
+    /// A FIFO under a wiring-file name (here the paired `<script>.py` of a
+    /// `*.py.lock`, which the lister cannot filter because it derives the
+    /// script name without stat'ing it) must not wedge `repair`: a
+    /// plain `read_to_string` blocks in open(2) waiting for a writer. Every
+    /// reference read must go through the FIFO-safe reader and skip it.
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn repair_returns_with_fifo_script() {
+        use std::time::Duration;
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        let uuid = "11111111-1111-4111-8111-111111111111";
+        let path = format!(".socket/vendor/pypi/{uuid}/requests-2.28.1-py3-none-any.whl");
+        tokio::fs::write(
+            root.join("tool.py.lock"),
+            format!("archive = {{ path = '{path}' }}"),
+        )
+        .await
+        .unwrap();
+        let fifos = ["tool.py", "bun.lock"];
+        for name in fifos {
+            let c = std::ffi::CString::new(root.join(name).to_str().unwrap()).unwrap();
+            assert_eq!(
+                unsafe { libc::mkfifo(c.as_ptr(), 0o644) },
+                0,
+                "mkfifo {name}"
+            );
+        }
+        // Release valve: if a read DID wedge in open(2), connecting a
+        // writer lets the blocking thread finish so the runtime can shut
+        // down and the test fails on the timeout instead of hanging.
+        let release = || {
+            use std::os::unix::fs::OpenOptionsExt as _;
+            for name in fifos {
+                let _ = std::fs::OpenOptions::new()
+                    .write(true)
+                    .custom_flags(libc::O_NONBLOCK)
+                    .open(root.join(name));
+            }
+        };
+
+        let scanned =
+            tokio::time::timeout(Duration::from_secs(5), scan_vendor_references(root)).await;
+        release();
+        let refs = scanned.expect("scan_vendor_references must not wedge on a FIFO script");
+        assert_eq!(
+            refs,
+            vec![("pypi".to_string(), uuid.to_string(), path.clone())],
+            "the lock reference is still recovered around the FIFO"
+        );
+    }
+
+    /// The requirements planner writes vendored pins into `-r` includes,
+    /// so a reference may live ONLY in an include. Reading the root
+    /// requirements.txt alone would leave such a wheel unrecoverable by
+    /// `repair` and deletable by the orphan sweep.
+    #[tokio::test]
+    async fn scan_recovers_include_hosted_requirements_reference() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        let uuid = "11111111-1111-4111-8111-111111111111";
+        let path = format!(".socket/vendor/pypi/{uuid}/six-1.16.0-py2.py3-none-any.whl");
+        tokio::fs::write(root.join("requirements.txt"), "-r requirements/base.txt\n")
+            .await
+            .unwrap();
+        tokio::fs::create_dir(root.join("requirements"))
+            .await
+            .unwrap();
+        tokio::fs::write(
+            root.join("requirements/base.txt"),
+            format!(
+                "./{path} --hash=sha256:{}  # socket-patch vendor: six==1.16.0\n",
+                "0".repeat(64)
+            ),
+        )
+        .await
+        .unwrap();
+        let refs = scan_vendor_references(root).await;
+        assert_eq!(
+            refs,
+            vec![("pypi".to_string(), uuid.to_string(), path)],
+            "{refs:?}"
+        );
+    }
+
+    #[tokio::test]
+    async fn scan_recovers_vlt_lock_and_workspace_package_json_references() {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        let in_lock = "11111111-1111-4111-8111-111111111111";
+        let in_member = "22222222-2222-4222-8222-222222222222";
+        let lock_path =
+            format!(".socket/vendor/npm/{in_lock}/left-pad-1.3.0/node_modules/left-pad");
+        let member_path = format!(".socket/vendor/npm/{in_member}/debug-4.3.4/node_modules/debug");
+        let node_id = format!(
+            "file~{}",
+            lock_path
+                .replace('/', "+")
+                .replace("node_modules", "node__modules")
+        );
+        tokio::fs::write(
+            root.join("vlt-lock.json"),
+            format!(
+                "{{\n  \"lockfileVersion\": 1,\n  \"options\": {{}},\n  \"nodes\": {{\n    \
+                 \"{node_id}\": [0,\"left-pad\",null,\"{lock_path}\"],\n    \
+                 \"~npm~debug@4.3.4\": [0,\"debug\",\"sha512-D==\"]\n  }},\n  \"edges\": {{\n    \
+                 \"file~_d left-pad\": \"prod file:./{lock_path} {node_id}\",\n    \
+                 \"workspace~packages+a debug\": \"prod 4.3.4 ~npm~debug@4.3.4\"\n  }}\n}}\n"
+            ),
+        )
+        .await
+        .unwrap();
+        tokio::fs::write(
+            root.join("package.json"),
+            "{\"dependencies\":{\"left-pad\":\"1.3.0\"}}",
+        )
+        .await
+        .unwrap();
+        tokio::fs::create_dir_all(root.join("packages/a"))
+            .await
+            .unwrap();
+        tokio::fs::write(
+            root.join("packages/a/package.json"),
+            format!("{{\"dependencies\":{{\"debug\":\"file:../../{member_path}\"}}}}"),
+        )
+        .await
+        .unwrap();
+        assert_eq!(
+            scan_vendor_references(root).await,
+            vec![
+                ("npm".to_string(), in_lock.to_string(), lock_path),
+                ("npm".to_string(), in_member.to_string(), member_path),
+            ]
+        );
+    }
+
+    #[tokio::test]
+    async fn scan_recovers_script_and_pep751_vendor_references() {
+        let tmp = tempfile::tempdir().unwrap();
+        let uuid = "11111111-1111-4111-8111-111111111111";
+        let path = format!(".socket/vendor/pypi/{uuid}/requests-2.28.1-py3-none-any.whl");
+        for file in ["example.py.lock", "pylock.dev.toml"] {
+            tokio::fs::write(
+                tmp.path().join(file),
+                format!("archive = {{ path = '{path}' }}"),
+            )
+            .await
+            .unwrap();
+        }
+        let references = scan_vendor_references(tmp.path()).await;
+        assert_eq!(
+            references,
+            vec![("pypi".to_string(), uuid.to_string(), path.clone())]
+        );
+    }
+
+    /// pnpm writes vendored paths in THREE spellings — override values,
+    /// `tarball:` fields, and snapshot KEYS with a trailing colon. The
+    /// scanner must yield the clean relpath whichever form it meets first.
+    #[tokio::test]
+    async fn scan_handles_pnpm_snapshot_key_colons() {
+        let tmp = tempfile::tempdir().unwrap();
+        let uuid = "11111111-1111-4111-8111-111111111111";
+        let lock = format!(
+            "overrides:\n  left-pad@1.3.0: file:.socket/vendor/npm/{uuid}/left-pad-1.3.0.tgz\n\n\
+             snapshots:\n\n  left-pad@file:.socket/vendor/npm/{uuid}/left-pad-1.3.0.tgz:\n    {{}}\n"
+        );
+        tokio::fs::write(tmp.path().join("pnpm-lock.yaml"), &lock)
+            .await
+            .unwrap();
+        let refs = scan_vendor_references(tmp.path()).await;
+        assert_eq!(refs.len(), 1, "{refs:?}");
+        assert_eq!(
+            refs[0].2,
+            format!(".socket/vendor/npm/{uuid}/left-pad-1.3.0.tgz"),
+            "no trailing colon: {refs:?}"
+        );
+
+        // Snapshot-key-only lock (the key form is the FIRST occurrence).
+        let lock = format!(
+            "snapshots:\n\n  left-pad@file:.socket/vendor/npm/{uuid}/left-pad-1.3.0.tgz:\n    {{}}\n"
+        );
+        tokio::fs::write(tmp.path().join("pnpm-lock.yaml"), &lock)
+            .await
+            .unwrap();
+        let refs = scan_vendor_references(tmp.path()).await;
+        assert_eq!(refs.len(), 1, "{refs:?}");
+        assert!(
+            refs[0].2.ends_with("left-pad-1.3.0.tgz"),
+            "trailing colon must be cut: {refs:?}"
+        );
+    }
+
+    /// The scanner's false-positive guard: a `.socket` mention that is NOT
+    /// a parseable vendored-artifact path (the committed manifest, a
+    /// non-uuid path segment) must never be reported as a vendor reference
+    /// — `parse_vendor_path`'s reject branch is what keeps `repair` from
+    /// reconstructing ledger entries out of ordinary `.socket/` mentions.
+    #[tokio::test]
+    async fn scan_ignores_non_vendor_socket_mentions() {
+        let tmp = tempfile::tempdir().unwrap();
+        tokio::fs::write(
+            tmp.path().join("package.json"),
+            r#"{
+  "name": "t",
+  "socketManifest": ".socket/manifest.json",
+  "notAVendorPath": ".socket/vendor/npm/not-a-uuid/x.tgz"
+}"#,
+        )
+        .await
+        .unwrap();
+        let refs = scan_vendor_references(tmp.path()).await;
+        assert!(
+            refs.is_empty(),
+            "non-vendor .socket mentions must be rejected: {refs:?}"
+        );
+    }
+
+    /// [`remove_vendor_dir`] is a best-effort guard that must never GUESS a
+    /// path: an eco/uuid pair that cannot map to a canonical vendor dir
+    /// (unknown ecosystem dir, non-canonical uuid) removes NOTHING, while
+    /// the mappable pair removes exactly its uuid dir.
+    #[tokio::test]
+    async fn remove_vendor_dir_refuses_unmappable_eco_or_uuid() {
+        let tmp = tempfile::tempdir().unwrap();
+        let uuid = "11111111-1111-4111-8111-111111111111";
+        let dir = tmp.path().join(format!(".socket/vendor/npm/{uuid}"));
+        tokio::fs::create_dir_all(&dir).await.unwrap();
+        tokio::fs::write(dir.join("x.tgz"), b"bytes").await.unwrap();
+
+        remove_vendor_dir(tmp.path(), "jsr", uuid).await;
+        assert!(dir.is_dir(), "an unmappable ecosystem must remove nothing");
+        remove_vendor_dir(tmp.path(), "npm", "not-a-uuid").await;
+        assert!(dir.is_dir(), "a non-canonical uuid must remove nothing");
+        remove_vendor_dir(tmp.path(), "npm", uuid).await;
+        assert!(!dir.exists(), "the canonical pair removes its uuid dir");
+        assert!(
+            !tmp.path().join(".socket/vendor").exists(),
+            "the emptied <eco>/ and vendor/ husks are pruned"
+        );
+        assert!(
+            tmp.path().join(".socket").is_dir(),
+            ".socket/ is never removed"
+        );
+    }
+}
+
+/// Exact-string tests for the vendored-repair human lines.
+#[cfg(test)]
+mod ui_format_tests {
+    use super::*;
+
+    #[test]
+    fn repair_failure_line_has_error_prefix() {
+        assert_eq!(
+            format_repair_failure("pkg:npm/%40s/x@1.0.0", "no pristine source"),
+            "Error: Cannot repair vendored artifact for pkg:npm/@s/x@1.0.0: no pristine source"
+        );
+    }
+
+    #[test]
+    fn rebuild_preview_singular_and_plural() {
+        let one = vec![(
+            "pkg:npm/minimist@1.2.5".to_string(),
+            "vendor_artifact_missing",
+            ".socket/vendor/npm/u/minimist-1.2.5.tgz",
+        )];
+        assert_eq!(
+            format_rebuild_preview(&one),
+            vec![
+                "Would rebuild 1 vendored artifact:",
+                "  - pkg:npm/minimist@1.2.5 (missing: .socket/vendor/npm/u/minimist-1.2.5.tgz)",
+            ]
+        );
+        let two = vec![
+            (
+                "pkg:npm/a@1".to_string(),
+                "vendor_artifact_corrupt",
+                "p/a.tgz",
+            ),
+            ("pkg:gem/b@1".to_string(), "vendor_artifact_missing", "p/b"),
+        ];
+        assert_eq!(
+            format_rebuild_preview(&two),
+            vec![
+                "Would rebuild 2 vendored artifacts:",
+                "  - pkg:npm/a@1 (corrupt: p/a.tgz)",
+                "  - pkg:gem/b@1 (missing: p/b)",
+            ]
+        );
+        assert_eq!(rebuild_reason_label("something_else"), "something_else");
+    }
+}
diff --git a/crates/socket-patch-cli/tests/coverage_fix_repair_vendor_predelete.rs b/crates/socket-patch-cli/tests/coverage_fix_repair_vendor_predelete.rs
index e403c3d6..762fafe6 100644
--- a/crates/socket-patch-cli/tests/coverage_fix_repair_vendor_predelete.rs
+++ b/crates/socket-patch-cli/tests/coverage_fix_repair_vendor_predelete.rs
@@ -1,12 +1,10 @@
-//! Repair's pre-rebuild uuid-dir clearing must never DESTROY an artifact
-//! the dispatch then fails to replace. The rebuild loop clears the live
-//! dir right before `dispatch_vendor_one` (the backends rebuild on
-//! MISSING), but the dispatch itself can still refuse or fail — e.g. the
-//! in-hand installed copy is broken in a way no pre-rebuild rung probes —
-//! and a failed dispatch replaces nothing: the wired lockfiles are left
-//! pointing at a bare ENOENT, and (for pass-1 corrupt candidates) the
-//! forensic bytes the NOTE above repair's staging step promises to keep
-//! are gone. Gem fixtures modeled on repair_vendor_e2e's.
+//! Repair's pre-rebuild set-aside must never DESTROY an artifact the
+//! re-vendor then fails to replace. A corrupt artifact is moved aside so
+//! the backends rebuild on MISSING, but the dispatch itself can still
+//! refuse or fail — e.g. the installed copy is broken in a way no
+//! pre-rebuild rung probes — and a failed dispatch replaced nothing: the
+//! forensic bytes must come back. Gem fixtures modeled on
+//! repair_vendor_e2e's.
 
 use std::path::{Path, PathBuf};
 use std::process::Command;
@@ -144,18 +142,6 @@ async fn mount_gem_patch_api(mock: &MockServer) {
         .await;
 }
 
-/// Serve the after-blob (no-ledger repairs re-download in step 1).
-async fn mount_blob(mock: &MockServer) {
-    Mock::given(method("GET"))
-        .and(path(format!(
-            "/v0/orgs/{ORG_SLUG}/patches/blob/{}",
-            git_sha256(AFTER)
-        )))
-        .respond_with(ResponseTemplate::new(200).set_body_bytes(AFTER))
-        .mount(mock)
-        .await;
-}
-
 fn run_cli(root: &Path, mock_uri: &str, argv: &[&str]) -> (i32, String, String) {
     let mut full = argv.to_vec();
     full.extend_from_slice(&[
@@ -212,82 +198,6 @@ fn vendor_gem_project(root: &Path, mock_uri: &str) -> PathBuf {
     copy
 }
 
-/// Ledger loss + member-healthy vendored dir → SOFT candidate; the
-/// installed copy is still DISCOVERABLE (the crawler only needs the gem
-/// dir with `lib/`) but its patched file is gone, so every pre-rebuild
-/// soft fallback is bypassed (a rebuild source is "in hand") and the
-/// dispatch itself fails the gem backend's fail-closed
-/// missing_existing_patch_files pre-check. The failed dispatch replaced
-/// nothing: the member-healthy artifact the wired Gemfile/Gemfile.lock
-/// still resolve through must SURVIVE — a broken installed copy must
-/// never be more destructive than an absent one (which keeps the tree,
-/// see repair_vendor_e2e's G1d). RED before the move-aside fix: the uuid
-/// dir was deleted up front and `bundle install` ENOENTs on the wired
-/// path.
-#[tokio::test]
-async fn repair_keeps_healthy_soft_artifact_when_rebuild_dispatch_fails() {
-    let mock = MockServer::start().await;
-    mount_gem_patch_api(&mock).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_gem_fixture(tmp.path());
-    let copy = vendor_gem_project(tmp.path(), &mock.uri());
-    let gemfile_wired = std::fs::read(tmp.path().join("Gemfile")).unwrap();
-
-    std::fs::remove_file(tmp.path().join(".socket/vendor/state.json")).unwrap();
-    std::fs::remove_file(
-        tmp.path()
-            .join(format!(
-                "vendor/bundle/ruby/3.4.0/gems/{GEM_NAME}-{GEM_VERSION}/lib/padlock.rb"
-            )),
-    )
-    .unwrap();
-
-    mount_blob(&mock).await;
-    let (code, stdout, stderr) = run_cli(
-        tmp.path(),
-        &mock.uri(),
-        &["repair", "--download-mode", "file"],
-    );
-    // The rebuild failure stays loud...
-    assert_eq!(code, 1, "stdout={stdout} stderr={stderr}");
-    let v = parse_env(&stdout);
-    assert!(
-        events_of(&v)
-            .iter()
-            .any(|e| e["action"] == "failed" && e["purl"] == GEM_PURL),
-        "envelope={v}"
-    );
-    // ...but the healthy artifact must not have been destroyed.
-    assert_eq!(
-        std::fs::read(copy.join("lib/padlock.rb"))
-            .expect("the vendored artifact must survive the failed rebuild"),
-        AFTER,
-        "member-healthy vendored copy intact"
-    );
-    assert_eq!(
-        std::fs::read(copy.join("padlock.gemspec")).unwrap(),
-        GEMSPEC_STUB
-    );
-    assert!(
-        !tmp.path()
-            .join(format!(".socket/vendor/gem/{GEM_UUID}.pre-rebuild"))
-            .exists(),
-        "no set-aside residue after the restore"
-    );
-    // The pre-persisted fingerprint-less entry points at real bytes, and
-    // the pair is still wired to them.
-    let state: serde_json::Value = serde_json::from_str(
-        &std::fs::read_to_string(tmp.path().join(".socket/vendor/state.json")).unwrap(),
-    )
-    .unwrap();
-    assert_eq!(state["entries"][GEM_PURL]["uuid"], GEM_UUID, "state={state}");
-    assert_eq!(
-        std::fs::read(tmp.path().join("Gemfile")).unwrap(),
-        gemfile_wired,
-        "the wired Gemfile is untouched"
-    );
-}
-
 /// The pass-1 corrupt twin of the same root: a ledgered artifact whose
 /// unpatched member was tampered (Corrupt via inventory mismatch) queues
 /// a rebuild, but the dispatch REFUSES (the installed stub gemspec the
diff --git a/crates/socket-patch-cli/tests/covgap_commands_repair_vendor.rs b/crates/socket-patch-cli/tests/covgap_commands_repair_vendor.rs
index 357c8e75..64717291 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_repair_vendor.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_repair_vendor.rs
@@ -1,20 +1,16 @@
 //! Coverage-gap tests for `repair`'s vendored-artifact phase
-//! (`commands/repair_vendor.rs`): the record-resolution edges of pass 1
-//! (corrupt ledger, dropped/moved-on manifest records, API-recovered
-//! records), the tampered-state health arms (StaleUuid / Unverifiable),
-//! dry-run previews of ledger/wiring reconstruction, the pristine ladder's
-//! ledger-recovered registry rung (Fetched and Failed), the rebuild loop's
-//! Refused/rebuild-failed arms, soft-restore fallbacks, `--ecosystems`
-//! scoping, and the human (non-`--json`) output lines.
-//!
+//! (`commands/vendored_backend/repair.rs`): record resolution (corrupt
+//! ledger, dropped/moved-on manifest records, API-recovered records), the
+//! tampered-state health arms (StaleUuid / Unverifiable), the re-vendor's
+//! failure arms and detail selection, `--ecosystems` scoping, and the
+//! human (non-`--json`) output lines.//!
 //! Fixtures and helpers mirror `repair_vendor_e2e.rs` (this suite owns its
 //! own copies).
 //!
 //! A vendored run (`scan --vendor`) is manifest-free: every ledger entry is
 //! `detached` with its record embedded and `.socket/manifest.json` is never
 //! written. The manifest-backed repair arms (dropped / moved-on manifest
-//! records, the `(None, None)` uuid recovery, pass 2's manifest-by-uuid
-//! reconstruction) belong to LEGACY manifest-mode projects, which the tests
+//! records, the `(None, None)` uuid recovery) belong to LEGACY manifest-mode projects, which the tests
 //! build by hand-migrating the fixture with [`to_legacy_manifest_mode`].
 
 use std::path::{Path, PathBuf};
@@ -399,7 +395,7 @@ fn run_cli(root: &Path, mock_uri: &str, argv: &[&str]) -> (i32, String, String)
 }
 
 /// The human-output twin of [`run_cli`]: identical flags minus `--json`
-/// (every `!quiet` println/eprintln in repair_vendor.rs is dead under
+/// (every `!quiet` println/eprintln in vendored_backend/repair.rs is dead under
 /// `--json`, so these lines are only reachable here).
 fn run_cli_human(root: &Path, mock_uri: &str, argv: &[&str]) -> (i32, String, String) {
     run_cli_with(root, mock_uri, argv, false, &[])
@@ -436,11 +432,6 @@ fn events_of(v: &serde_json::Value) -> Vec<serde_json::Value> {
     v["events"].as_array().cloned().unwrap_or_default()
 }
 
-/// Run-level `warnings[]` (`{code, detail}`); empty when omitted.
-fn warnings_of(v: &serde_json::Value) -> Vec<serde_json::Value> {
-    v["warnings"].as_array().cloned().unwrap_or_default()
-}
-
 fn read_state(root: &Path) -> serde_json::Value {
     serde_json::from_str(&std::fs::read_to_string(root.join(".socket/vendor/state.json")).unwrap())
         .unwrap()
@@ -877,320 +868,6 @@ async fn repair_fails_closed_on_unsafe_ledger_artifact_path() {
     );
 }
 
-// ───────────── pass 2: reference with no ledger, no manifest, offline ─────────────
-
-/// Lockfile reference with the ledger gone (a vendored run never writes a
-/// manifest, so no local record survives), `--offline`:
-/// the failure is attributed to a SYNTHETIC purl carrying the recovered
-/// uuid (`pkg:npm/unknown@<uuid>`) and advises restoring state.json or
-/// re-running online. Nothing on disk is touched.
-#[tokio::test]
-async fn repair_no_ledger_no_manifest_offline_fails_with_synthetic_purl() {
-    let mock = MockServer::start().await;
-    mount_patch_api(&mock).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_fixture(
-        tmp.path(),
-        "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
-        "sha512-orig==",
-    );
-    let tgz = vendor_project(tmp.path(), &mock.uri());
-    let tgz_bytes = std::fs::read(&tgz).unwrap();
-    let lock_bytes = std::fs::read(tmp.path().join("package-lock.json")).unwrap();
-
-    std::fs::remove_file(tmp.path().join(".socket/vendor/state.json")).unwrap();
-    assert!(
-        !tmp.path().join(".socket/manifest.json").exists(),
-        "vendored runs write no manifest"
-    );
-
-    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair", "--offline"]);
-    assert_eq!(code, 1, "stdout={stdout} stderr={stderr}");
-    let v = parse_env(&stdout);
-    assert!(
-        events_of(&v).iter().any(|e| e["action"] == "failed"
-            && e["purl"] == format!("pkg:npm/unknown@{UUID}")
-            && e["errorCode"] == "vendor_artifact_missing"
-            && e["error"]
-                .as_str()
-                .unwrap_or("")
-                .contains("restore .socket/vendor/state.json or re-run online")),
-        "envelope={v}"
-    );
-    assert_eq!(
-        std::fs::read(&tgz).unwrap(),
-        tgz_bytes,
-        "the surviving artifact is untouched"
-    );
-    assert_eq!(
-        std::fs::read(tmp.path().join("package-lock.json")).unwrap(),
-        lock_bytes,
-        "the lock is untouched"
-    );
-}
-
-// ─────────────────────── dry-run previews ───────────────────────
-
-/// Dry-run preview of an ANCHORED ledger reconstruction (artifact intact,
-/// wired lock integrity vouches): `wouldRestoreLedgerEntry` with NO
-/// `wouldRebuild`, and state.json is not recreated.
-#[tokio::test]
-async fn repair_dry_run_previews_anchored_ledger_restore() {
-    let mock = MockServer::start().await;
-    mount_patch_api(&mock).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_fixture(
-        tmp.path(),
-        "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
-        "sha512-orig==",
-    );
-    vendor_project(tmp.path(), &mock.uri());
-    std::fs::remove_file(tmp.path().join(".socket/vendor/state.json")).unwrap();
-
-    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair", "--dry-run"]);
-    assert_eq!(code, 0, "stdout={stdout} stderr={stderr}");
-    let v = parse_env(&stdout);
-    let preview = events_of(&v)
-        .into_iter()
-        .find(|e| e["action"] == "verified" && e["purl"] == PURL)
-        .unwrap_or_else(|| panic!("expected a verified preview: {v}"));
-    assert_eq!(
-        preview["details"]["wouldRestoreLedgerEntry"], true,
-        "envelope={v}"
-    );
-    assert!(
-        preview["details"].get("wouldRebuild").is_none(),
-        "an anchored surviving artifact previews restore-only: {preview}"
-    );
-    assert!(
-        !tmp.path().join(".socket/vendor/state.json").exists(),
-        "dry run writes no ledger"
-    );
-}
-
-/// Dry-run preview of an UNANCHORED reconstruction (gem dir — no lockfile
-/// integrity can vouch): `wouldRestoreLedgerEntry` AND `wouldRebuild`
-/// (the fingerprint would come from a rebuild, never the live tree), and
-/// neither the ledger nor the copy dir is touched.
-#[tokio::test]
-async fn repair_dry_run_previews_unanchored_reconstruction_rebuild() {
-    let mock = MockServer::start().await;
-    mount_gem_patch_api(&mock).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_gem_fixture(tmp.path(), false);
-    let copy = vendor_gem_project(tmp.path(), &mock.uri(), AFTER);
-    std::fs::remove_file(tmp.path().join(".socket/vendor/state.json")).unwrap();
-
-    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair", "--dry-run"]);
-    assert_eq!(code, 0, "stdout={stdout} stderr={stderr}");
-    let v = parse_env(&stdout);
-    let preview = events_of(&v)
-        .into_iter()
-        .find(|e| e["action"] == "verified" && e["purl"] == GEM_PURL)
-        .unwrap_or_else(|| panic!("expected a verified preview: {v}"));
-    assert_eq!(
-        preview["details"]["wouldRestoreLedgerEntry"], true,
-        "envelope={v}"
-    );
-    assert_eq!(
-        preview["details"]["wouldRebuild"], true,
-        "an unanchored survivor previews a trust-restoring rebuild: {preview}"
-    );
-    assert!(
-        !tmp.path().join(".socket/vendor/state.json").exists(),
-        "dry run writes no ledger"
-    );
-    assert_eq!(
-        std::fs::read(copy.join("lib/padlock.rb")).unwrap(),
-        AFTER,
-        "dry run touches no artifact bytes"
-    );
-}
-
-// ─────────────────── pass-1 gem wiring backfill edges ───────────────────
-
-/// Dry-run preview of the pass-1 empty-wiring gem backfill:
-/// `wouldRestoreWiring` — and the persisted wiring stays empty.
-#[tokio::test]
-async fn repair_dry_run_previews_gem_wiring_backfill() {
-    let mock = MockServer::start().await;
-    mount_gem_patch_api(&mock).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_gem_fixture(tmp.path(), false);
-    vendor_gem_project(tmp.path(), &mock.uri(), AFTER);
-
-    let mut state = read_state(tmp.path());
-    state["entries"][GEM_PURL]["wiring"] = serde_json::json!([]);
-    write_state(tmp.path(), &state);
-
-    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair", "--dry-run"]);
-    assert_eq!(code, 0, "stdout={stdout} stderr={stderr}");
-    let v = parse_env(&stdout);
-    assert!(
-        events_of(&v).iter().any(|e| e["action"] == "verified"
-            && e["purl"] == GEM_PURL
-            && e["details"]["wouldRestoreWiring"] == true),
-        "envelope={v}"
-    );
-    let state = read_state(tmp.path());
-    assert_eq!(
-        state["entries"][GEM_PURL]["wiring"]
-            .as_array()
-            .map(Vec::len),
-        Some(0),
-        "dry run must not persist the backfilled wiring: {state}"
-    );
-}
-
-/// The pass-1 backfill's degradation-notes loop: on a CHECKSUMS lock the
-/// reconstruction succeeds with the unrecoverable-sha256 note, which must
-/// ride the envelope as a skipped advisory NEXT TO the wiringRestored
-/// rebuilt event.
-#[tokio::test]
-async fn repair_backfill_surfaces_unrecoverable_checksum_note() {
-    let mock = MockServer::start().await;
-    mount_gem_patch_api(&mock).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_gem_fixture(tmp.path(), true);
-    vendor_gem_project(tmp.path(), &mock.uri(), AFTER);
-
-    let mut state = read_state(tmp.path());
-    state["entries"][GEM_PURL]["wiring"] = serde_json::json!([]);
-    write_state(tmp.path(), &state);
-
-    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair"]);
-    assert_eq!(code, 0, "stdout={stdout} stderr={stderr}");
-    let v = parse_env(&stdout);
-    assert!(
-        events_of(&v).iter().any(|e| e["action"] == "rebuilt"
-            && e["purl"] == GEM_PURL
-            && e["details"]["wiringRestored"] == true
-            && e["details"]["artifactRebuilt"] == false),
-        "envelope={v}"
-    );
-    assert!(
-        events_of(&v).iter().any(|e| e["action"] == "skipped"
-            && e["purl"] == GEM_PURL
-            && e["errorCode"] == "vendor_checksum_unrecoverable"),
-        "the degradation note rides the envelope: {v}"
-    );
-    let state = read_state(tmp.path());
-    assert!(
-        !state["entries"][GEM_PURL]["wiring"]
-            .as_array()
-            .unwrap_or(&Vec::new())
-            .is_empty(),
-        "the backfilled wiring is persisted: {state}"
-    );
-}
-
-/// Pass-1 backfill reconstruction FAILURE (Gemfile deleted while the
-/// artifact stays healthy): the gap rides the run-level `warnings[]` as
-/// `vendor_wiring_unknown` naming the purl — never a skipped event — the
-/// run stays exit 0, and the wiring stays empty.
-#[tokio::test]
-async fn repair_backfill_failure_warns_wiring_unknown() {
-    let mock = MockServer::start().await;
-    mount_gem_patch_api(&mock).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_gem_fixture(tmp.path(), false);
-    vendor_gem_project(tmp.path(), &mock.uri(), AFTER);
-
-    let mut state = read_state(tmp.path());
-    state["entries"][GEM_PURL]["wiring"] = serde_json::json!([]);
-    write_state(tmp.path(), &state);
-    std::fs::remove_file(tmp.path().join("Gemfile")).unwrap();
-
-    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair"]);
-    assert_eq!(code, 0, "stdout={stdout} stderr={stderr}");
-    let v = parse_env(&stdout);
-    assert!(
-        warnings_of(&v)
-            .iter()
-            .any(|w| w["code"] == "vendor_wiring_unknown"
-                && w["detail"].as_str().unwrap_or("").contains(GEM_PURL)
-                && w["detail"]
-                    .as_str()
-                    .unwrap_or("")
-                    .contains("cannot be reconstructed")),
-        "the backfill failure rides run-level warnings[]: {v}"
-    );
-    assert!(
-        !events_of(&v)
-            .iter()
-            .any(|e| e["errorCode"] == "vendor_wiring_unknown"),
-        "no skipped event for the run-level advisory: {v}"
-    );
-    let state = read_state(tmp.path());
-    assert_eq!(
-        state["entries"][GEM_PURL]["wiring"]
-            .as_array()
-            .map(Vec::len),
-        Some(0),
-        "an unreconstructable wiring stays empty: {state}"
-    );
-}
-
-/// The pass-2 twin: a NO-LEDGER gem reconstruction whose Gemfile is gone
-/// maps the reconstruction error to WiringReconstruction::Unknown — the
-/// run-level warning says the entry "was reconstructed without pre-vendor
-/// wiring originals", the re-synthesized entry persists with empty wiring,
-/// and when the soft rebuild's dispatch then REFUSES (`gemfile_missing`)
-/// the healthy set-aside artifact bytes are restored, not destroyed.
-#[tokio::test]
-async fn repair_reconstruction_without_gemfile_warns_wiring_unknown() {
-    let mock = MockServer::start().await;
-    mount_gem_patch_api(&mock).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_gem_fixture(tmp.path(), false);
-    let copy = vendor_gem_project(tmp.path(), &mock.uri(), AFTER);
-
-    std::fs::remove_file(tmp.path().join(".socket/vendor/state.json")).unwrap();
-    std::fs::remove_file(tmp.path().join("Gemfile")).unwrap();
-
-    mount_blob(&mock).await;
-    let (code, stdout, stderr) = run_cli(
-        tmp.path(),
-        &mock.uri(),
-        &["repair", "--download-mode", "file"],
-    );
-    let v = parse_env(&stdout);
-    assert!(
-        warnings_of(&v)
-            .iter()
-            .any(|w| w["code"] == "vendor_wiring_unknown"
-                && w["detail"].as_str().unwrap_or("").contains(GEM_PURL)
-                && w["detail"]
-                    .as_str()
-                    .unwrap_or("")
-                    .contains("was reconstructed without pre-vendor wiring originals")),
-        "the pass-2 reconstruction gap rides run-level warnings[]: {v}"
-    );
-    // The soft rebuild's gem dispatch REFUSES without a Gemfile
-    // (`gemfile_missing`), staying loud — and the refused dispatch replaced
-    // nothing, so the healthy set-aside artifact is restored below.
-    assert_eq!(code, 1, "stdout={stdout} stderr={stderr}");
-    assert!(
-        events_of(&v).iter().any(|e| e["action"] == "failed"
-            && e["purl"] == GEM_PURL
-            && e["errorCode"] == "gemfile_missing"),
-        "envelope={v}"
-    );
-    let state = read_state(tmp.path());
-    assert_eq!(
-        state["entries"][GEM_PURL]["wiring"]
-            .as_array()
-            .map(Vec::len),
-        Some(0),
-        "no guessed wiring on the re-synthesized entry: {state}"
-    );
-    assert_eq!(
-        std::fs::read(copy.join("lib/padlock.rb")).unwrap(),
-        AFTER,
-        "the healthy artifact bytes survive the reconstruction"
-    );
-}
-
 // ────────────── pristine ladder: ledger-recovered registry rung ──────────────
 
 /// The PristineFetch::Fetched rung under repair: artifact AND node_modules
@@ -1274,56 +951,6 @@ async fn repair_fails_when_ledger_recovered_fetch_fails() {
     assert!(!tgz.exists(), "a failed fetch must not invent an artifact");
 }
 
-/// The UNVERIFIED-registry reconstruction rung when the conventional fetch
-/// fails: `fetch_npm_unverified`'s error maps to `vendor_fetch_failed`, the
-/// candidate goes unrebuildable, and the rewired lock stays byte-identical.
-#[tokio::test]
-async fn repair_reconstruction_unverified_fetch_failure() {
-    let mock = MockServer::start().await;
-    mount_patch_api(&mock).await;
-    Mock::given(method("GET"))
-        .and(path("/left-pad/-/left-pad-1.3.0.tgz"))
-        .respond_with(ResponseTemplate::new(500))
-        .mount(&mock)
-        .await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_fixture(
-        tmp.path(),
-        "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
-        "sha512-orig==",
-    );
-    let tgz = vendor_project(tmp.path(), &mock.uri());
-    let lock_bytes = std::fs::read(tmp.path().join("package-lock.json")).unwrap();
-
-    // Fresh-clone hole: vendor tree gone AND nothing installed — only the
-    // rewired lock (whose recorded integrity is the trust anchor) is left.
-    std::fs::remove_dir_all(tmp.path().join(".socket/vendor")).unwrap();
-    std::fs::remove_dir_all(tmp.path().join("node_modules")).unwrap();
-
-    mount_blob(&mock).await;
-    let (code, stdout, stderr) = run_cli_with(
-        tmp.path(),
-        &mock.uri(),
-        &["repair", "--download-mode", "file"],
-        true,
-        &[("SOCKET_NPM_REGISTRY", &mock.uri())],
-    );
-    assert_eq!(code, 1, "stdout={stdout} stderr={stderr}");
-    let v = parse_env(&stdout);
-    assert!(
-        events_of(&v).iter().any(|e| e["action"] == "failed"
-            && e["purl"] == PURL
-            && e["errorCode"] == "vendor_fetch_failed"),
-        "envelope={v}"
-    );
-    assert!(!tgz.exists(), "nothing rebuilt from the failed fetch");
-    assert_eq!(
-        std::fs::read(tmp.path().join("package-lock.json")).unwrap(),
-        lock_bytes,
-        "the trust-anchor lock is untouched"
-    );
-}
-
 // ─────────────────── rebuild-loop failure arms ───────────────────
 
 /// The rebuild dispatch REFUSES (package-lock.json deleted along with the
@@ -1418,163 +1045,23 @@ async fn human_repair_rebuild_failure_does_not_claim_complete() {
     );
 }
 
-// ─────────────────── soft-restore fallbacks ───────────────────
+// ─────────────── qualified ledger keys resolve the installed copy ───────────────
 
-/// Staging itself is Unavailable (offline, one candidate's patch content
-/// has no local source): the SOFT candidate is restored fingerprint-less
-/// and counted rebuilt, while the non-soft sibling fails — one run, both
-/// arms. The gem's content IS harvestable from its healthy artifact, but
-/// staging is all-or-nothing across the candidate set, exactly the shape
-/// this fallback exists for. Legacy manifest-mode fixture: offline, the
-/// manifest is the only record source once the ledger is gone.
+/// Ledger keys are the manifest spelling — for release-variant ecosystems
+/// the QUALIFIED purl production publishes (`pkg:gem/…?platform=ruby`) —
+/// while the crawler knows only base purls. Repair must resolve the
+/// installed copy through the qualified-aware resolver (the one
+/// `vendor_records` uses): a base-keyed lookup never matches a qualified
+/// ledger key, so an INSTALLED package would read as absent and the rebuild
+/// would fall through to `vendor_artifact_missing` (offline) or the
+/// registry-fetch rung (online; no rubygems route is mounted here).
 #[tokio::test]
-async fn repair_soft_restore_when_staging_unavailable() {
-    const AFTER_GEM: &[u8] = b"gem after\n";
+async fn repair_rebuilds_qualified_ledger_key_from_installed_copy() {
     let mock = MockServer::start().await;
-    mount_batch(&mock, true, true).await;
-    mount_npm_routes(&mock).await;
-    mount_gem_routes(&mock, AFTER_GEM).await;
+    mount_gem_patch_api(&mock).await;
     let tmp = tempfile::tempdir().unwrap();
-    write_fixture(
-        tmp.path(),
-        "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
-        "sha512-orig==",
-    );
     write_gem_fixture(tmp.path(), false);
-    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["scan", "--vendor", "--yes"]);
-    assert_eq!(code, 0, "combined vendor setup failed: {stdout} {stderr}");
-    let tgz = tmp
-        .path()
-        .join(format!(".socket/vendor/npm/{UUID}/left-pad-1.3.0.tgz"));
-    assert!(tgz.is_file(), "setup must vendor the npm tarball");
-    let copy = tmp.path().join(gem_copy_rel());
-    assert_eq!(
-        std::fs::read(copy.join("lib/padlock.rb")).expect("vendored gem lib"),
-        AFTER_GEM,
-        "setup must vendor the patched gem copy"
-    );
-
-    // Legacy manifest-mode project with its ledger gone; npm artifact
-    // broken (non-soft), gem artifact healthy (soft). Offline: the npm
-    // after-blob has no local source, so the in-memory staging is
-    // Unavailable for the whole candidate set.
-    to_legacy_manifest_mode(tmp.path());
-    std::fs::remove_file(tmp.path().join(".socket/vendor/state.json")).unwrap();
-    std::fs::remove_file(&tgz).unwrap();
-
-    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair", "--offline"]);
-    assert_eq!(code, 1, "stdout={stdout} stderr={stderr}");
-    let v = parse_env(&stdout);
-    // The soft gem candidate: fingerprint-less restore, counted rebuilt.
-    assert!(
-        events_of(&v).iter().any(|e| e["action"] == "rebuilt"
-            && e["purl"] == GEM_PURL
-            && e["details"]["ledgerRestored"] == true
-            && e["details"]["artifactRebuilt"] == false),
-        "envelope={v}"
-    );
-    assert!(
-        events_of(&v).iter().any(|e| e["action"] == "skipped"
-            && e["purl"] == GEM_PURL
-            && e["errorCode"] == "vendor_inventory_unverified"
-            && e["reason"]
-                .as_str()
-                .unwrap_or("")
-                .contains("no local source to rebuild from")),
-        "the fingerprint gap is surfaced: {v}"
-    );
-    // The non-soft npm candidate stays a loud failure.
-    assert!(
-        events_of(&v).iter().any(|e| e["action"] == "failed"
-            && e["purl"] == PURL
-            && e["error"].as_str().unwrap_or("").contains("--offline")),
-        "envelope={v}"
-    );
-    let state = read_state(tmp.path());
-    assert!(
-        state["entries"][GEM_PURL]["artifact"]["fileInventory"].is_null(),
-        "no fingerprint was invented for the soft restore: {state}"
-    );
-    assert_eq!(
-        std::fs::read(copy.join("lib/padlock.rb")).unwrap(),
-        AFTER_GEM,
-        "the soft-restored artifact bytes are untouched"
-    );
-}
-
-/// `--offline` + soft candidate + package NOT installed: staging succeeds
-/// (the healthy artifact's own blobs are harvested), but the pristine
-/// ladder cannot fetch — the entry is soft-restored fingerprint-less with
-/// the offline cause named. Legacy manifest-mode fixture (the manifest is
-/// the offline record source once the ledger is gone).
-#[tokio::test]
-async fn repair_offline_soft_restore_without_installed_copy() {
-    let mock = MockServer::start().await;
-    mount_gem_patch_api(&mock).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_gem_fixture(tmp.path(), false);
-    let copy = vendor_gem_project(tmp.path(), &mock.uri(), AFTER);
-
-    to_legacy_manifest_mode(tmp.path());
-    std::fs::remove_file(tmp.path().join(".socket/vendor/state.json")).unwrap();
-    std::fs::remove_dir_all(tmp.path().join("vendor/bundle")).unwrap();
-
-    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair", "--offline"]);
-    assert_eq!(code, 0, "stdout={stdout} stderr={stderr}");
-    let v = parse_env(&stdout);
-    assert!(
-        events_of(&v).iter().any(|e| e["action"] == "rebuilt"
-            && e["purl"] == GEM_PURL
-            && e["details"]["ledgerRestored"] == true
-            && e["details"]["artifactRebuilt"] == false),
-        "envelope={v}"
-    );
-    assert!(
-        events_of(&v).iter().any(|e| e["action"] == "skipped"
-            && e["purl"] == GEM_PURL
-            && e["errorCode"] == "vendor_inventory_unverified"
-            && e["reason"]
-                .as_str()
-                .unwrap_or("")
-                .contains("--offline prevents fetching")),
-        "the offline cause is named: {v}"
-    );
-    let state = read_state(tmp.path());
-    assert!(
-        state["entries"][GEM_PURL]["artifact"]["fileInventory"].is_null(),
-        "the live tree must not be fingerprinted in: {state}"
-    );
-    assert!(
-        !state["entries"][GEM_PURL]["wiring"]
-            .as_array()
-            .unwrap_or(&Vec::new())
-            .is_empty(),
-        "the reconstructed wiring is persisted: {state}"
-    );
-    assert_eq!(
-        std::fs::read(copy.join("lib/padlock.rb")).unwrap(),
-        AFTER,
-        "the artifact bytes are untouched"
-    );
-}
-
-// ─────────────── qualified ledger keys resolve the installed copy ───────────────
-
-/// Ledger keys are the manifest spelling — for release-variant ecosystems
-/// the QUALIFIED purl production publishes (`pkg:gem/…?platform=ruby`) —
-/// while the crawler knows only base purls. Repair must resolve the
-/// installed copy through the qualified-aware resolver (the one
-/// `vendor_records` uses): a base-keyed lookup never matches a qualified
-/// ledger key, so an INSTALLED package would read as absent and the rebuild
-/// would fall through to `vendor_artifact_missing` (offline) or the
-/// registry-fetch rung (online; no rubygems route is mounted here).
-#[tokio::test]
-async fn repair_rebuilds_qualified_ledger_key_from_installed_copy() {
-    let mock = MockServer::start().await;
-    mount_gem_patch_api(&mock).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_gem_fixture(tmp.path(), false);
-    let copy = vendor_gem_project(tmp.path(), &mock.uri(), AFTER);
+    let copy = vendor_gem_project(tmp.path(), &mock.uri(), AFTER);
 
     // Re-key the ledger entry to the qualified spelling (`basePurl` stays
     // bare — exactly what `scan --vendor` records for a served qualified
@@ -1688,11 +1175,9 @@ async fn repair_restores_crashed_set_aside_leftover_before_classifying() {
 
 // ─────────────── precise unrepairable detail selection ───────────────
 
-/// A non-soft pass-1 gem candidate with a precise Unverifiable cause
-/// (artifact gone, installed copy gone, no CHECKSUMS sha recorded): the
-/// recover-error detail is surfaced VERBATIM in
-/// `vendor_artifact_unrepairable` — not the blanket "no verifiable pristine
-/// source" text, which falsely implies the ledger recorded nothing.
+/// A gem candidate with no pristine source (artifact gone, installed copy
+/// gone, no CHECKSUMS sha recorded to verify a registry fetch against):
+/// `vendor_artifact_unrepairable` naming the missing source.
 #[tokio::test]
 async fn repair_gem_unverifiable_reason_is_surfaced() {
     let mock = MockServer::start().await;
@@ -1717,24 +1202,21 @@ async fn repair_gem_unverifiable_reason_is_surfaced() {
     );
     let detail = failed["error"].as_str().unwrap_or("");
     assert!(
-        detail.contains("the ledger cannot recover")
-            && detail.contains("no pre-vendor Gemfile.lock checksum recorded"),
-        "the precise recover-error must be surfaced verbatim: {failed}"
-    );
-    assert!(
-        !detail.contains("no verifiable pristine source"),
-        "the blanket text must not mask the precise cause: {failed}"
+        detail.contains("no installed package found on disk"),
+        "the missing source is named: {failed}"
     );
+    assert!(!copy.exists(), "no artifact is invented without a source");
 }
 
 // ─────────────── backend warning forwarding during rebuilds ───────────────
 
-/// Non-`vendor_artifact_rebuilt` backend warnings surface during a repair
-/// rebuild: a drifted installed copy is force-applied and its
-/// `vendor_content_mismatch_overwritten` advisory rides the envelope next
-/// to the rebuilt event.
+/// A drifted installed copy of a release-variant ecosystem (gem): repair
+/// re-vendors through the same engine as `vendor`, whose installed-variant
+/// probe does not accept a copy matching neither the before nor the after
+/// hash — so the rebuild fails loudly (no artifact invented), exactly like
+/// a `vendor` re-run over the same tree.
 #[tokio::test]
-async fn repair_forwards_backend_content_mismatch_warning() {
+async fn repair_refuses_a_drifted_variant_install() {
     let mock = MockServer::start().await;
     mount_gem_patch_api(&mock).await;
     let tmp = tempfile::tempdir().unwrap();
@@ -1752,25 +1234,15 @@ async fn repair_forwards_backend_content_mismatch_warning() {
     .unwrap();
 
     let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair"]);
-    assert_eq!(code, 0, "stdout={stdout} stderr={stderr}");
+    assert_eq!(code, 1, "stdout={stdout} stderr={stderr}");
     let v = parse_env(&stdout);
     assert!(
-        events_of(&v).iter().any(|e| e["action"] == "skipped"
+        events_of(&v).iter().any(|e| e["action"] == "failed"
             && e["purl"] == GEM_PURL
-            && e["errorCode"] == "vendor_content_mismatch_overwritten"),
-        "the backend advisory is forwarded: {v}"
-    );
-    assert!(
-        events_of(&v)
-            .iter()
-            .any(|e| e["action"] == "rebuilt" && e["purl"] == GEM_PURL),
+            && e["errorCode"] == "vendor_artifact_unrepairable"),
         "envelope={v}"
     );
-    assert_eq!(
-        std::fs::read(copy.join("lib/padlock.rb")).unwrap(),
-        AFTER,
-        "the rebuild force-applied the patched content"
-    );
+    assert!(!copy.exists(), "no artifact is invented from a drifted copy");
 }
 
 // ─────────────────────── --ecosystems scoping ───────────────────────
@@ -1861,29 +1333,6 @@ async fn repair_human_output_lines() {
     );
 }
 
-/// The human-mode `vendor_wiring_unknown` warning line (the run-level
-/// advisory's stderr twin).
-#[tokio::test]
-async fn repair_human_warns_wiring_unknown() {
-    let mock = MockServer::start().await;
-    mount_gem_patch_api(&mock).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_gem_fixture(tmp.path(), false);
-    vendor_gem_project(tmp.path(), &mock.uri(), AFTER);
-
-    let mut state = read_state(tmp.path());
-    state["entries"][GEM_PURL]["wiring"] = serde_json::json!([]);
-    write_state(tmp.path(), &state);
-    std::fs::remove_file(tmp.path().join("Gemfile")).unwrap();
-
-    let (code, stdout, stderr) = run_cli_human(tmp.path(), &mock.uri(), &["repair"]);
-    assert_eq!(code, 0, "stdout={stdout} stderr={stderr}");
-    assert!(
-        stderr.contains("Warning (vendor_wiring_unknown):"),
-        "the run-level advisory is printed to stderr: {stderr}"
-    );
-}
-
 // ────────────── unrepairable-detail selection: remaining arms ──────────────
 
 /// A broken PLATFORM-LOCKED artifact with no pristine source anywhere (not
@@ -1939,9 +1388,8 @@ async fn repair_platform_locked_detail_when_no_pristine_source() {
 }
 
 /// A tampered `base_purl` (version lost) inside a ledger entry whose lock
-/// still records the wired trust anchor: the unverified-registry rung must
-/// fail CLOSED on the unparsable coordinates (never fetch garbage), falling
-/// through to the precise ledger-recovery error instead.
+/// still records the wired trust anchor, with nothing installed: repair
+/// fails CLOSED (never fetches garbage) and invents no artifact.
 #[tokio::test]
 async fn repair_tampered_base_purl_surfaces_precise_unverifiable_detail() {
     let mock = MockServer::start().await;
@@ -1976,8 +1424,8 @@ async fn repair_tampered_base_purl_surfaces_precise_unverifiable_detail() {
         failed["error"]
             .as_str()
             .unwrap_or("")
-            .contains("the ledger cannot recover one"),
-        "the precise recovery error must surface: {failed}"
+            .contains("no installed package found on disk"),
+        "the missing source is named: {failed}"
     );
     assert!(
         !tgz.exists(),
@@ -1985,100 +1433,6 @@ async fn repair_tampered_base_purl_surfaces_precise_unverifiable_detail() {
     );
 }
 
-// ────────────── soft reconstruction + pristine fetch FAILURE ──────────────
-
-/// A SOFT reconstruction (healthy-by-members, no lock integrity anchors the
-/// vendored tarball) whose pristine registry fetch then FAILS (500): the
-/// entry stays restored fingerprint-less with the fetch failure named —
-/// never a hard failure, never a live-tree fingerprint. The lock shape: the
-/// registry resolution survived for left-pad while a second spec references
-/// the vendored tarball WITHOUT integrity (a hand-migrated lock), so the
-/// reference is found but nothing anchors the artifact bytes.
-#[tokio::test]
-async fn repair_soft_restore_when_pristine_fetch_fails() {
-    let mock = MockServer::start().await;
-    mount_patch_api(&mock).await;
-    Mock::given(method("GET"))
-        .and(path("/left-pad/-/left-pad-1.3.0.tgz"))
-        .respond_with(ResponseTemplate::new(500))
-        .mount(&mock)
-        .await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_fixture(
-        tmp.path(),
-        "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
-        "sha512-orig==",
-    );
-    let tgz = vendor_project(tmp.path(), &mock.uri());
-    let tgz_bytes = std::fs::read(&tgz).unwrap();
-
-    // Ledger gone, package not installed; the hand-shaped lock keeps the
-    // fetchable registry resolution AND an unanchored vendored reference.
-    std::fs::remove_file(tmp.path().join(".socket/vendor/state.json")).unwrap();
-    std::fs::remove_dir_all(tmp.path().join("node_modules")).unwrap();
-    let lock = serde_json::json!({
-        "name": "covgap-repair-vendor",
-        "version": "0.0.0",
-        "lockfileVersion": 3,
-        "requires": true,
-        "packages": {
-            "": {
-                "name": "covgap-repair-vendor",
-                "version": "0.0.0",
-                "dependencies": { "left-pad": "^1.3.0" }
-            },
-            "node_modules/left-pad": {
-                "version": "1.3.0",
-                "resolved": format!("{}/left-pad/-/left-pad-1.3.0.tgz", mock.uri()),
-                "integrity": sri_of(&pristine_tgz())
-            },
-            "node_modules/left-pad-vendored": {
-                "version": "1.3.0",
-                "resolved": format!("file:.socket/vendor/npm/{UUID}/left-pad-1.3.0.tgz")
-            }
-        }
-    });
-    std::fs::write(
-        tmp.path().join("package-lock.json"),
-        serde_json::to_vec_pretty(&lock).unwrap(),
-    )
-    .unwrap();
-
-    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair"]);
-    assert_eq!(code, 0, "stdout={stdout} stderr={stderr}");
-    let v = parse_env(&stdout);
-    assert!(
-        events_of(&v).iter().any(|e| e["action"] == "rebuilt"
-            && e["purl"] == PURL
-            && e["details"]["ledgerRestored"] == true
-            && e["details"]["artifactRebuilt"] == false),
-        "the soft candidate is restored, not failed: {v}"
-    );
-    assert!(
-        events_of(&v).iter().any(|e| e["action"] == "skipped"
-            && e["purl"] == PURL
-            && e["errorCode"] == "vendor_inventory_unverified"
-            && e["reason"]
-                .as_str()
-                .unwrap_or("")
-                .contains("the pristine fetch failed")),
-        "the fetch failure is named in the fingerprint-gap advisory: {v}"
-    );
-    let state = read_state(tmp.path());
-    assert!(
-        state["entries"][PURL]["artifact"]["sha256"]
-            .as_str()
-            .unwrap_or("")
-            .is_empty(),
-        "the live tarball must never be fingerprinted in: {state}"
-    );
-    assert_eq!(
-        std::fs::read(&tgz).unwrap(),
-        tgz_bytes,
-        "the healthy artifact bytes are untouched"
-    );
-}
-
 // ────────────── record recovery shares ONE api client per run ──────────────
 
 /// TWO manifest-less, record-less (legacy manifest-mode) ledger entries
@@ -2134,8 +1488,8 @@ async fn repair_recovers_multiple_records_by_uuid_sharing_one_client() {
 /// A (tampered/hand-migrated) ledger entry keyed by a purl whose ecosystem
 /// has NO vendor backend (`pkg:jsr/…`), its artifact corrupt and its
 /// package "installed" (JSR cache staged via `DENO_DIR`): the dispatch
-/// returns no backend, repair fails with `vendor_artifact_unrepairable`
-/// naming the missing backend — and the set-aside corrupt bytes are put
+/// has no backend, repair fails with `vendor_artifact_unrepairable`
+/// naming the unsupported ecosystem — and the set-aside corrupt bytes are put
 /// BACK (the failed dispatch replaced nothing; forensic evidence survives).
 #[tokio::test]
 async fn repair_no_backend_for_purl_restores_set_aside_bytes() {
@@ -2216,7 +1570,7 @@ async fn repair_no_backend_for_purl_restores_set_aside_bytes() {
             && e["error"]
                 .as_str()
                 .unwrap_or("")
-                .contains("no vendor backend for this ecosystem")),
+                .contains("vendoring is not supported for this ecosystem")),
         "envelope={v}"
     );
     assert_eq!(
@@ -2251,7 +1605,7 @@ async fn repair_no_backend_for_purl_restores_set_aside_bytes() {
             && e["error"]
                 .as_str()
                 .unwrap_or("")
-                .contains("no vendor backend for this ecosystem")),
+                .contains("vendoring is not supported for this ecosystem")),
         "envelope={v}"
     );
     assert!(
@@ -2264,66 +1618,6 @@ async fn repair_no_backend_for_purl_restores_set_aside_bytes() {
     );
 }
 
-// ────────── must-verify rebuild at a renamed lock reference ──────────
-
-/// The lock's vendored reference was hand-RENAMED (leaf drift) and the
-/// ledger is gone: the reconstruction records the renamed path, the rebuild
-/// dispatch rebuilds/wires the CANONICAL leaf, and the trust-anchor verify
-/// then cannot read the artifact at the reconstructed path — fail closed:
-/// uuid dir removed ("nothing was kept") and the snapshotted trust-anchor
-/// lock restored byte-for-byte (the backend's re-wire must not survive).
-#[tokio::test]
-async fn repair_reconstruction_renamed_leaf_fails_closed_and_restores_lock() {
-    let mock = MockServer::start().await;
-    mount_patch_api(&mock).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_fixture(
-        tmp.path(),
-        "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
-        "sha512-orig==",
-    );
-    vendor_project(tmp.path(), &mock.uri());
-
-    // Rename the leaf inside the rewired lock, then lose the whole vendor
-    // tree (ledger + artifact) — the fresh-clone hole plus leaf drift.
-    let lock_path = tmp.path().join("package-lock.json");
-    let renamed = std::fs::read_to_string(&lock_path)
-        .unwrap()
-        .replace("left-pad-1.3.0.tgz", "custom-left-pad.tgz");
-    std::fs::write(&lock_path, &renamed).unwrap();
-    std::fs::remove_dir_all(tmp.path().join(".socket/vendor")).unwrap();
-
-    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair"]);
-    assert_eq!(code, 1, "stdout={stdout} stderr={stderr}");
-    let v = parse_env(&stdout);
-    let failed = events_of(&v)
-        .into_iter()
-        .find(|e| {
-            e["action"] == "failed"
-                && e["purl"] == PURL
-                && e["errorCode"] == "vendor_artifact_rebuild_failed"
-        })
-        .unwrap_or_else(|| panic!("expected a rebuild failure: {v}"));
-    assert!(
-        failed["error"]
-            .as_str()
-            .unwrap_or("")
-            .contains("cannot read the rebuilt artifact"),
-        "the unreadable reconstructed path is the named cause: {failed}"
-    );
-    assert!(
-        !tmp.path()
-            .join(format!(".socket/vendor/npm/{UUID}"))
-            .exists(),
-        "nothing is kept from the rejected rebuild"
-    );
-    assert_eq!(
-        std::fs::read_to_string(&lock_path).unwrap(),
-        renamed,
-        "the trust-anchor lock is restored byte-for-byte from the snapshot"
-    );
-}
-
 // ────────── set-aside degrades to removal when the rename is blocked ──────────
 
 /// The eco level (`.socket/vendor/npm/`) is read-only, so the set-aside
@@ -2413,264 +1707,6 @@ fn writable_vendor_dir(root: &Path) {
 
 // ────────────── ledger-write failures stay loud, everywhere ──────────────
 
-/// Pass-1 gem wiring BACKFILL whose ledger write fails: the
-/// `vendor_state_write_failed` failure is the outcome — no `wiringRestored`
-/// rebuilt event may claim the backfill happened.
-#[cfg(unix)]
-#[tokio::test]
-async fn repair_backfill_persist_failure_stays_loud() {
-    if is_root() {
-        eprintln!("skipped: read-only-dir contraption is inert as root");
-        return;
-    }
-    let mock = MockServer::start().await;
-    mount_gem_patch_api(&mock).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_gem_fixture(tmp.path(), false);
-    vendor_gem_project(tmp.path(), &mock.uri(), AFTER);
-
-    let mut state = read_state(tmp.path());
-    state["entries"][GEM_PURL]["wiring"] = serde_json::json!([]);
-    write_state(tmp.path(), &state);
-    readonly_vendor_dir(tmp.path());
-
-    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair"]);
-    writable_vendor_dir(tmp.path());
-    assert_eq!(code, 1, "stdout={stdout} stderr={stderr}");
-    let v = parse_env(&stdout);
-    assert!(
-        events_of(&v).iter().any(|e| e["action"] == "failed"
-            && e["purl"] == GEM_PURL
-            && e["errorCode"] == "vendor_state_write_failed"),
-        "envelope={v}"
-    );
-    assert!(
-        !events_of(&v)
-            .iter()
-            .any(|e| e["action"] == "rebuilt" && e["details"]["wiringRestored"] == true),
-        "an unpersisted backfill must not claim wiringRestored: {v}"
-    );
-    let state = read_state(tmp.path());
-    assert_eq!(
-        state["entries"][GEM_PURL]["wiring"]
-            .as_array()
-            .map(Vec::len),
-        Some(0),
-        "the committed ledger still has the empty wiring: {state}"
-    );
-}
-
-/// Pass-2 ANCHORED ledger restore whose state write fails: the failure is
-/// surfaced per purl, no `ledgerRestored` event is emitted, and the intact
-/// artifact is untouched.
-#[cfg(unix)]
-#[tokio::test]
-async fn repair_anchored_restore_persist_failure_stays_loud() {
-    if is_root() {
-        eprintln!("skipped: read-only-dir contraption is inert as root");
-        return;
-    }
-    let mock = MockServer::start().await;
-    mount_patch_api(&mock).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_fixture(
-        tmp.path(),
-        "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
-        "sha512-orig==",
-    );
-    let tgz = vendor_project(tmp.path(), &mock.uri());
-    let tgz_bytes = std::fs::read(&tgz).unwrap();
-
-    std::fs::remove_file(tmp.path().join(".socket/vendor/state.json")).unwrap();
-    readonly_vendor_dir(tmp.path());
-
-    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair"]);
-    writable_vendor_dir(tmp.path());
-    assert_eq!(code, 1, "stdout={stdout} stderr={stderr}");
-    let v = parse_env(&stdout);
-    assert!(
-        events_of(&v).iter().any(|e| e["action"] == "failed"
-            && e["purl"] == PURL
-            && e["errorCode"] == "vendor_state_write_failed"),
-        "envelope={v}"
-    );
-    assert!(
-        !events_of(&v)
-            .iter()
-            .any(|e| e["action"] == "rebuilt" && e["purl"] == PURL),
-        "an unpersisted anchored restore must not claim ledgerRestored: {v}"
-    );
-    assert!(
-        !tmp.path().join(".socket/vendor/state.json").exists(),
-        "no ledger could be written"
-    );
-    assert_eq!(
-        std::fs::read(&tgz).unwrap(),
-        tgz_bytes,
-        "the anchored artifact is untouched"
-    );
-}
-
-/// The SOFT-reconstruction early persist fails: the candidate goes
-/// unrebuildable up front, so the later ladder must not double-report it —
-/// staging proceeds (harvest from the healthy artifact) but the pristine
-/// loop and rebuild loop both skip the purl: exactly one failed event, no
-/// soft-restore advisory, no rebuilt event.
-#[cfg(unix)]
-#[tokio::test]
-async fn repair_soft_persist_failure_skips_downstream_ladder() {
-    if is_root() {
-        eprintln!("skipped: read-only-dir contraption is inert as root");
-        return;
-    }
-    let mock = MockServer::start().await;
-    mount_gem_patch_api(&mock).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_gem_fixture(tmp.path(), false);
-    let copy = vendor_gem_project(tmp.path(), &mock.uri(), AFTER);
-
-    std::fs::remove_file(tmp.path().join(".socket/vendor/state.json")).unwrap();
-    readonly_vendor_dir(tmp.path());
-
-    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair"]);
-    writable_vendor_dir(tmp.path());
-    assert_eq!(code, 1, "stdout={stdout} stderr={stderr}");
-    let v = parse_env(&stdout);
-    let failed: Vec<serde_json::Value> = events_of(&v)
-        .into_iter()
-        .filter(|e| e["action"] == "failed" && e["purl"] == GEM_PURL)
-        .collect();
-    assert_eq!(
-        failed.len(),
-        1,
-        "exactly one failure for the unpersistable soft candidate: {v}"
-    );
-    assert_eq!(failed[0]["errorCode"], "vendor_state_write_failed", "{v}");
-    assert!(
-        !events_of(&v).iter().any(|e| e["purl"] == GEM_PURL
-            && (e["action"] == "rebuilt" || e["errorCode"] == "vendor_inventory_unverified")),
-        "no restore is claimed and no fingerprint advisory rides a dead restore: {v}"
-    );
-    assert_eq!(
-        std::fs::read(copy.join("lib/padlock.rb")).unwrap(),
-        AFTER,
-        "the healthy artifact bytes are untouched"
-    );
-}
-
-/// The Unavailable-staging fallback must ALSO skip a purl the early soft
-/// persist already failed: one combined run — the gem soft candidate's
-/// state write fails, the npm blob has no offline source — yields the state
-/// failure for the gem (no soft-restore advisory) and the offline failure
-/// for the npm candidate. Legacy manifest-mode fixture (the manifest is the
-/// offline record source once the ledger is gone).
-#[cfg(unix)]
-#[tokio::test]
-async fn repair_unavailable_staging_skips_unpersistable_soft_candidate() {
-    if is_root() {
-        eprintln!("skipped: read-only-dir contraption is inert as root");
-        return;
-    }
-    const AFTER_GEM: &[u8] = b"gem after\n";
-    let mock = MockServer::start().await;
-    mount_batch(&mock, true, true).await;
-    mount_npm_routes(&mock).await;
-    mount_gem_routes(&mock, AFTER_GEM).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_fixture(
-        tmp.path(),
-        "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
-        "sha512-orig==",
-    );
-    write_gem_fixture(tmp.path(), false);
-    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["scan", "--vendor", "--yes"]);
-    assert_eq!(code, 0, "combined vendor setup failed: {stdout} {stderr}");
-    let tgz = tmp
-        .path()
-        .join(format!(".socket/vendor/npm/{UUID}/left-pad-1.3.0.tgz"));
-
-    to_legacy_manifest_mode(tmp.path());
-    std::fs::remove_file(tmp.path().join(".socket/vendor/state.json")).unwrap();
-    std::fs::remove_file(&tgz).unwrap();
-    readonly_vendor_dir(tmp.path());
-
-    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair", "--offline"]);
-    writable_vendor_dir(tmp.path());
-    assert_eq!(code, 1, "stdout={stdout} stderr={stderr}");
-    let v = parse_env(&stdout);
-    assert!(
-        events_of(&v).iter().any(|e| e["action"] == "failed"
-            && e["purl"] == GEM_PURL
-            && e["errorCode"] == "vendor_state_write_failed"),
-        "envelope={v}"
-    );
-    assert!(
-        events_of(&v).iter().any(|e| e["action"] == "failed"
-            && e["purl"] == PURL
-            && e["error"].as_str().unwrap_or("").contains("--offline")),
-        "the non-soft candidate still fails on the missing source: {v}"
-    );
-    assert!(
-        !events_of(&v)
-            .iter()
-            .any(|e| e["action"] == "rebuilt" || e["errorCode"] == "vendor_inventory_unverified"),
-        "no restore is claimed for the unpersistable candidate: {v}"
-    );
-}
-
-/// A SUCCESSFUL rebuild of a RECONSTRUCTED entry whose ledger write then
-/// fails: the artifact is legitimately rebuilt on disk (and trust-anchor
-/// verified), but the run reports the state failure and never claims
-/// `rebuilt` (the post-verify is skipped — an unpersisted entry must not be
-/// attested). A plain pass-1 rebuild never persists (nothing about the
-/// entry changed), so the persist-after-rebuild step is only reachable via
-/// a reconstruction (or a backend-returned entry).
-#[cfg(unix)]
-#[tokio::test]
-async fn repair_rebuild_persist_failure_stays_loud() {
-    if is_root() {
-        eprintln!("skipped: read-only-dir contraption is inert as root");
-        return;
-    }
-    let mock = MockServer::start().await;
-    mount_patch_api(&mock).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_fixture(
-        tmp.path(),
-        "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
-        "sha512-orig==",
-    );
-    let tgz = vendor_project(tmp.path(), &mock.uri());
-
-    // Ledger gone + artifact gone, installed copy kept: pass 2 reconstructs
-    // the entry, the rebuild dispatch succeeds from the installed copy, and
-    // ONLY the ledger write fails (the eco subdir stays writable).
-    std::fs::remove_file(tmp.path().join(".socket/vendor/state.json")).unwrap();
-    std::fs::remove_file(&tgz).unwrap();
-    readonly_vendor_dir(tmp.path());
-
-    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair"]);
-    writable_vendor_dir(tmp.path());
-    assert_eq!(code, 1, "stdout={stdout} stderr={stderr}");
-    let v = parse_env(&stdout);
-    assert!(
-        events_of(&v).iter().any(|e| e["action"] == "failed"
-            && e["purl"] == PURL
-            && e["errorCode"] == "vendor_state_write_failed"),
-        "envelope={v}"
-    );
-    assert!(
-        !events_of(&v)
-            .iter()
-            .any(|e| e["action"] == "rebuilt" && e["purl"] == PURL),
-        "an unpersisted rebuild must not be claimed: {v}"
-    );
-    assert!(
-        tgz.is_file(),
-        "the rebuild itself succeeded before the ledger write failed"
-    );
-}
-
 /// The INVENTORY-REFRESH persist failing: the refreshed entry cannot be
 /// recorded, so the run surfaces `vendor_state_write_failed` next to the
 /// `vendor_inventory_refreshed` advisory and never claims `rebuilt`.
@@ -2730,29 +1766,3 @@ async fn repair_inventory_refresh_persist_failure_stays_loud() {
 mod vlt_hosted_common;
 #[path = "vlt_hosted_common/vendored.rs"]
 mod vlt_vendored;
-
-/// A lost ledger over a vlt dir artifact, offline and with nothing
-/// installed: no lock integrity anchors a dir, so the entry is restored
-/// fingerprint-less with `vendor_inventory_unverified` (never the live
-/// tree fingerprinted), stamped `flavor: "vlt"`, the artifact kept.
-#[test]
-fn repair_offline_restores_a_vlt_entry_without_a_fingerprint() {
-    let tmp = tempfile::tempdir().unwrap();
-    let root = tmp.path();
-    vlt_vendored::vendored_project(root, true);
-    std::fs::remove_file(root.join(".socket/vendor/state.json")).unwrap();
-    std::fs::remove_dir_all(root.join("node_modules")).unwrap();
-    let cwd = root.to_str().unwrap().to_string();
-    let (code, env, stderr) =
-        vlt_hosted_common::run_json(root, &["repair", "--offline", "--cwd", &cwd], &[]);
-    assert_eq!(code, 0, "{env:#}\n{stderr}");
-    assert!(
-        env.to_string().contains("vendor_inventory_unverified"),
-        "{env:#}"
-    );
-    let entry = vlt_vendored::state(root)["entries"][vlt_hosted_common::PURL].clone();
-    assert_eq!(entry["flavor"], "vlt", "{entry:#}");
-    assert_eq!(entry["artifact"]["path"], vlt_vendored::rel(), "{entry:#}");
-    assert!(entry["artifact"]["fileInventory"].is_null(), "{entry:#}");
-    assert!(root.join(vlt_vendored::rel()).join("index.js").is_file());
-}
diff --git a/crates/socket-patch-cli/tests/covgap_commands_rollback.rs b/crates/socket-patch-cli/tests/covgap_commands_rollback.rs
index ded85f9b..e5e8430a 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_rollback.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_rollback.rs
@@ -655,12 +655,12 @@ fn path_scope_warns_about_out_of_scope_restored_copies() {
 }
 
 /// Ledger-less but still WIRED: a lockfile that consumes `.socket/vendor/`
-/// artifacts with NO ledger and NO manifest is a supported recovery state —
-/// rollback must refuse with the `socket-patch repair` guidance (exit 1),
+/// artifacts with NO ledger and NO manifest — rollback must refuse with the
+/// restore-`state.json` guidance (exit 1),
 /// never fall through to the bare "Manifest not found" error, and must not
 /// touch the wired lock.
 #[test]
-fn ledgerless_wired_lock_errors_with_repair_guidance() {
+fn ledgerless_wired_lock_errors_with_state_json_guidance() {
     let tmp = tempfile::tempdir().expect("tempdir");
     // A v3 package-lock whose resolution points into `.socket/vendor/` —
     // exactly what a deleted/uncommitted state.json leaves behind.
@@ -691,9 +691,9 @@ fn ledgerless_wired_lock_errors_with_repair_guidance() {
     assert!(
         v["error"].as_str().is_some_and(|e| {
             e.contains("lockfiles still reference .socket/vendor/ artifacts")
-                && e.contains("socket-patch repair")
+                && e.contains("restore .socket/vendor/state.json")
         }),
-        "the error must carry the repair guidance, not 'Manifest not found'; stdout=\n{stdout}"
+        "the error must carry the state.json guidance, not 'Manifest not found'; stdout=\n{stdout}"
     );
     assert_eq!(
         std::fs::read(tmp.path().join("package-lock.json")).unwrap(),
diff --git a/crates/socket-patch-cli/tests/covgap_commands_scan_vendor_flow.rs b/crates/socket-patch-cli/tests/covgap_commands_scan_vendor_flow.rs
index 090c5f38..cf23ca75 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_scan_vendor_flow.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_scan_vendor_flow.rs
@@ -7,7 +7,7 @@
 //!   `scan_vendor_e2e.rs`);
 //! * the legal-but-never-executed `--dry-run --prune` combination in the
 //!   vendor JSON path (GC preview field names, nothing mutated);
-//! * every error constructor of `run_scan_vendor_step` — `lock_held`,
+//! * every error constructor of `run_vendor_step` — `lock_held`,
 //!   `lock_io` (a directory squatting on `apply.lock`; a file squatting on
 //!   `.socket` itself) and `no_local_source` — through the JSON error fold
 //!   (a lock failure precedes the step and carries NO `vendor` key; a
diff --git a/crates/socket-patch-cli/tests/e2e_bun_lockb.rs b/crates/socket-patch-cli/tests/e2e_bun_lockb.rs
index d51b6c77..ae24a544 100644
--- a/crates/socket-patch-cli/tests/e2e_bun_lockb.rs
+++ b/crates/socket-patch-cli/tests/e2e_bun_lockb.rs
@@ -914,21 +914,29 @@ async fn native_binary_hosted_vendored_takeover_roundtrip() {
     assert_eq!(repaired["summary"]["rebuilt"], 1, "repair: {repaired}");
     fixture.frozen("repaired", &fixture.patched, "minimist");
 
-    // Recovery also discovers native binary wiring when the local ledger was
-    // lost. Save the original ledger only to continue the unrelated takeover
-    // and exact-rollback assertions after this recovery proof.
+    // A lost ledger is reported, not re-synthesized — and the reference is
+    // still discovered from the native binary lock. Save the original
+    // ledger to continue the takeover and exact-rollback assertions.
     let state_path = project.join(".socket/vendor/state.json");
     let saved_state = std::fs::read(&state_path).unwrap();
     std::fs::remove_file(&state_path).unwrap();
-    std::fs::remove_dir_all(project.join(".socket/vendor/npm")).unwrap();
-    let recovered = cli(project, &["repair", "--offline", "--yes"]);
-    assert_eq!(
-        recovered["summary"]["rebuilt"], 1,
+    let output = command(env!("CARGO_BIN_EXE_socket-patch"), project)
+        .args(["repair", "--offline", "--yes", "--cwd"])
+        .arg(project)
+        .args(["--json", "--no-telemetry"])
+        .output()
+        .unwrap();
+    assert_eq!(output.status.code(), Some(1), "ledgerless repair must fail");
+    let recovered: Value = serde_json::from_slice(&output.stdout).unwrap();
+    assert!(
+        recovered["events"]
+            .as_array()
+            .into_iter()
+            .flatten()
+            .any(|e| e["errorCode"] == "vendor_ledger_missing"),
         "ledgerless repair: {recovered}"
     );
-    let state: Value = serde_json::from_slice(&std::fs::read(&state_path).unwrap()).unwrap();
-    assert_eq!(state["entries"][PURL]["flavor"], "bun");
-    fixture.frozen("ledgerless-repair", &fixture.patched, "minimist");
+    assert!(!state_path.exists(), "no ledger is synthesized");
     std::fs::write(&state_path, saved_state).unwrap();
 
     let before = snapshot(project);
@@ -1046,19 +1054,12 @@ async fn native_binary_alias_and_transitive() {
                 mirror.is_file(),
                 "workspace requires its committed tarball copy"
             );
-            for (label, corrupt, remove_ledger) in [
-                ("missing-mirror", false, false),
-                ("corrupt-mirror", true, false),
-                ("ledgerless-mirror", false, true),
-            ] {
+            for (label, corrupt) in [("missing-mirror", false), ("corrupt-mirror", true)] {
                 if corrupt {
                     std::fs::write(&mirror, b"corrupt workspace artifact").unwrap();
                 } else {
                     std::fs::remove_file(&mirror).unwrap();
                 }
-                if remove_ledger {
-                    std::fs::remove_file(&ledger).unwrap();
-                }
                 let repaired = cli(&fixture.project, &["repair", "--offline", "--yes"]);
                 assert_eq!(
                     repaired["summary"]["rebuilt"], 1,
@@ -1066,9 +1067,9 @@ async fn native_binary_alias_and_transitive() {
                 );
                 fixture.frozen(label, &fixture.patched, target);
             }
-            // The separately proven ledgerless recovery cannot recover an
-            // original registry snapshot. Restore it to exercise exact revert.
-            std::fs::write(&ledger, original_state).unwrap();
+            // Repair keeps the ledger byte-identical (the exact revert below
+            // replays its originals).
+            assert_eq!(std::fs::read(&ledger).unwrap(), original_state);
         }
         cli(&fixture.project, &["vendor", "--revert"]);
         fixture.pristine();
diff --git a/crates/socket-patch-cli/tests/e2e_gem.rs b/crates/socket-patch-cli/tests/e2e_gem.rs
index da04518f..db8af0af 100644
--- a/crates/socket-patch-cli/tests/e2e_gem.rs
+++ b/crates/socket-patch-cli/tests/e2e_gem.rs
@@ -484,7 +484,7 @@ fn test_gem_full_lifecycle() {
     let gem_dir = find_gem_dir(cwd);
 
     // -- GET: download + apply patch ------------------------------------------
-    assert_run_ok(cwd, &["get", GEM_UUID], "get");
+    assert_run_ok(cwd, &["get", GEM_UUID, "--mode", "agent"], "get");
 
     let manifest_path = cwd.join(".socket/manifest.json");
     assert!(
@@ -583,7 +583,7 @@ fn test_gem_dry_run() {
     let gem_dir = find_gem_dir(cwd);
 
     // Download without applying.
-    assert_run_ok(cwd, &["get", GEM_UUID, "--no-apply"], "get --no-apply");
+    assert_run_ok(cwd, &["get", GEM_UUID, "--mode", "agent", "--no-apply"], "get --no-apply");
 
     // Read manifest to get file list and expected hashes.
     let manifest_path = cwd.join(".socket/manifest.json");
diff --git a/crates/socket-patch-cli/tests/e2e_npm.rs b/crates/socket-patch-cli/tests/e2e_npm.rs
index 91af8d1d..89f40f9a 100644
--- a/crates/socket-patch-cli/tests/e2e_npm.rs
+++ b/crates/socket-patch-cli/tests/e2e_npm.rs
@@ -175,7 +175,7 @@ fn test_npm_full_lifecycle() {
     );
 
     // -- GET: download + apply patch ---------------------------------------
-    assert_run_ok(cwd, &["get", NPM_UUID], "get");
+    assert_run_ok(cwd, &["get", NPM_UUID, "--mode", "agent"], "get");
 
     // Manifest should exist and contain the patch.
     let manifest_path = cwd.join(".socket/manifest.json");
@@ -286,7 +286,7 @@ fn test_npm_dry_run() {
     assert_eq!(git_sha256_file(&index_js), BEFORE_HASH);
 
     // Download the patch *without* applying.
-    assert_run_ok(cwd, &["get", NPM_UUID, "--no-apply"], "get --no-apply");
+    assert_run_ok(cwd, &["get", NPM_UUID, "--mode", "agent", "--no-apply"], "get --no-apply");
 
     // File should still be original.
     assert_eq!(
diff --git a/crates/socket-patch-cli/tests/e2e_pypi.rs b/crates/socket-patch-cli/tests/e2e_pypi.rs
index 1d1dda17..ffa19f60 100644
--- a/crates/socket-patch-cli/tests/e2e_pypi.rs
+++ b/crates/socket-patch-cli/tests/e2e_pypi.rs
@@ -244,7 +244,7 @@ fn test_pypi_full_lifecycle() {
         .collect();
 
     // -- GET: download + apply patch ---------------------------------------
-    assert_run_ok(cwd, &["get", PYPI_UUID], "get");
+    assert_run_ok(cwd, &["get", PYPI_UUID, "--mode", "agent"], "get");
 
     let manifest_path = cwd.join(".socket/manifest.json");
     assert!(
@@ -440,7 +440,7 @@ fn test_pypi_dry_run() {
     let original_hash = git_sha256_file(&messages_py);
 
     // Download without applying.
-    assert_run_ok(cwd, &["get", PYPI_UUID, "--no-apply"], "get --no-apply");
+    assert_run_ok(cwd, &["get", PYPI_UUID, "--mode", "agent", "--no-apply"], "get --no-apply");
 
     // File should be unchanged.
     assert_eq!(
diff --git a/crates/socket-patch-cli/tests/e2e_safety_pnpm.rs b/crates/socket-patch-cli/tests/e2e_safety_pnpm.rs
index 26af7beb..7af95861 100644
--- a/crates/socket-patch-cli/tests/e2e_safety_pnpm.rs
+++ b/crates/socket-patch-cli/tests/e2e_safety_pnpm.rs
@@ -293,7 +293,7 @@ fn apply_in_a_does_not_mutate_b_or_store() {
     };
 
     // -- get + apply in proj_a only ----------------------------------
-    assert_run_ok(&fx.proj_a, &["get", NPM_UUID], "socket-patch get");
+    assert_run_ok(&fx.proj_a, &["get", NPM_UUID, "--mode", "agent"], "socket-patch get");
 
     // proj_a is patched.
     assert_eq!(
@@ -397,7 +397,7 @@ fn pnpm_install_in_b_does_not_revert_a() {
         store_id
     };
 
-    assert_run_ok(&fx.proj_a, &["get", NPM_UUID], "socket-patch get");
+    assert_run_ok(&fx.proj_a, &["get", NPM_UUID, "--mode", "agent"], "socket-patch get");
     assert_eq!(git_sha256_file(&index_a), AFTER_HASH);
 
     // Re-run pnpm install in proj_b with frozen lockfile — this
@@ -475,7 +475,7 @@ fn apply_in_pnpm_project_emits_layout_note() {
     let root = tempfile::tempdir().unwrap();
     let fx = setup_two_pnpm_projects(root.path());
 
-    let (_stdout, stderr) = assert_run_ok(&fx.proj_a, &["get", NPM_UUID], "socket-patch get");
+    let (_stdout, stderr) = assert_run_ok(&fx.proj_a, &["get", NPM_UUID, "--mode", "agent"], "socket-patch get");
 
     // The exact phrasing is a stable contract. A bare `contains("pnpm")`
     // is worthless here — every pnpm store path printed on stderr
diff --git a/crates/socket-patch-cli/tests/e2e_vendor_composer_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_composer_build.rs
index 8809b85f..6119c3c5 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_composer_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_composer_build.rs
@@ -1025,9 +1025,9 @@ async fn composer_scan_vendor_detached_vex_fresh_checkout_install() {
 // artifact instead of driving composer, so they need neither the toolchain
 // nor the network and run in the normal `test` job (no `#[ignore]`).
 
-/// `repair`-reconstructed ledger entry: recovered from the lockfile path, so
-/// it owns the artifact but records NO pre-vendor wiring (see
-/// `repair_vendor.rs`'s `synth_entry`).
+/// A ledger entry with NO pre-vendor wiring (the shape a pre-v5 `repair`
+/// reconstructed from the lockfile path): it owns the artifact but has
+/// nothing to replay.
 const UUID_RECONSTRUCTED: &str = "1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d";
 /// Un-ledgered artifact dir that composer.lock still points at.
 const UUID_ORPHAN_WIRED: &str = "2b3c4d5e-6f7a-4b8c-9d0e-1f2a3b4c5d6e";
diff --git a/crates/socket-patch-cli/tests/e2e_vlt.rs b/crates/socket-patch-cli/tests/e2e_vlt.rs
index dc9e45e5..7d1dcb0e 100644
--- a/crates/socket-patch-cli/tests/e2e_vlt.rs
+++ b/crates/socket-patch-cli/tests/e2e_vlt.rs
@@ -151,7 +151,7 @@ async fn vlt_pinned_matrix_agent_get_and_remove() {
         return;
     };
     let fx = Fixture::build(leg, Shape::with_bystander().warm()).await;
-    let out = socket_api(&fx.proj, &fx.svc, &["get", UUID], &[]);
+    let out = socket_api(&fx.proj, &fx.svc, &["get", UUID, "--mode", "agent"], &[]);
     assert_eq!(out.code, 0, "{out}");
     assert_eq!(state(&fx.proj, fx.t()), State::Patched);
     let purl = fx.t().purl();
diff --git a/crates/socket-patch-cli/tests/in_process_vendor/vlt.rs b/crates/socket-patch-cli/tests/in_process_vendor/vlt.rs
index fd045afc..647d6c7f 100644
--- a/crates/socket-patch-cli/tests/in_process_vendor/vlt.rs
+++ b/crates/socket-patch-cli/tests/in_process_vendor/vlt.rs
@@ -576,11 +576,13 @@ fn vendor_vlt_refuses_multi_field_declaration() {
 
 #[test]
 fn vendor_vlt_out_of_sync() {
-    refused_with(
+    let detail = refused_with(
         &direct_lock().render(),
         &ROOT_PKG.replace("\"1.3.0\"", "\"^1.3.0\""),
         "vendor_vlt_lock_out_of_sync",
     );
+    assert!(detail.contains("but vlt-lock.json locks"), "{detail}");
+    assert!(detail.contains("run `vlt install` first"), "{detail}");
 }
 
 #[test]
@@ -900,7 +902,7 @@ fn link_vendored_dir(root: &Path, uuid: &str) {
 }
 
 #[test]
-fn vendor_vlt_linked_install_without_a_ledger_entry_points_at_repair() {
+fn vendor_vlt_linked_install_without_a_ledger_entry_points_at_state_json() {
     let tmp = tempfile::tempdir().unwrap();
     let root = tmp.path();
     direct_project(root);
@@ -923,7 +925,7 @@ fn vendor_vlt_linked_install_without_a_ledger_entry_points_at_repair() {
         detail,
         format!(
             "installed from the vendored artifact .socket/vendor/npm/{UUID}/, but the vendor \
-             ledger has no entry for it; run `socket-patch repair` to restore the entry"
+             ledger has no entry for it; restore .socket/vendor/state.json from version control"
         )
     );
     assert!(
@@ -932,41 +934,17 @@ fn vendor_vlt_linked_install_without_a_ledger_entry_points_at_repair() {
     );
     assert_eq!(read(root, VLT_LOCK), lock);
 
+    // Repair reports the lost ledger rather than re-synthesizing it.
     let cwd = root.to_str().unwrap().to_string();
     let (code, env, _) = socket(root, &["repair", "--json", "--offline", "--cwd", &cwd], &[]);
-    assert_eq!(code, 0, "{env:#}");
-    let unverified = events(&env)
-        .into_iter()
-        .find(|e| e["errorCode"] == "vendor_inventory_unverified")
-        .unwrap_or_else(|| panic!("{env:#}"));
-    assert!(
-        unverified["reason"].as_str().unwrap().ends_with(
-            "restore the registry version spec in the package.json files that name the \
-             vendored dir, run `vlt install`, then run `socket-patch vendor` to re-vendor and \
-             record one"
-        ),
-        "{unverified:#}"
-    );
-    let entry = ledger_entry(root, PURL);
-    assert_eq!(entry["flavor"], "vlt", "{env:#}");
-    assert_eq!(entry["uuid"], UUID, "{env:#}");
-    // The reconstructed entry has no inventory: the rerun says so instead
-    // of claiming nothing is installed.
-    assert!(entry["artifact"]["fileInventory"].is_null(), "{entry:#}");
-    let (code, env, _) = vendor(root, &[]);
     assert_eq!(code, 1, "{env:#}");
-    let skip = events(&env)
-        .into_iter()
-        .find(|e| e["errorCode"] == "package_not_installed")
-        .unwrap_or_else(|| panic!("{env:#}"));
-    assert_eq!(
-        skip["reason"],
-        format!(
-            "the only installed copy is the vendored artifact .socket/vendor/npm/{UUID}/, which \
-             is not a pristine source, and its ledger entry records no file inventory to stage \
-             the committed artifact against"
-        )
+    assert!(
+        events(&env)
+            .iter()
+            .any(|e| e["errorCode"] == "vendor_ledger_missing" && e["uuid"] == UUID),
+        "{env:#}"
     );
+    assert!(!root.join(".socket/vendor/state.json").exists(), "{env:#}");
     assert_eq!(read(root, VLT_LOCK), lock);
 }
 
diff --git a/crates/socket-patch-cli/tests/repair_vendor_e2e.rs b/crates/socket-patch-cli/tests/repair_vendor_e2e.rs
index e942d2c3..ca3f90b3 100644
--- a/crates/socket-patch-cli/tests/repair_vendor_e2e.rs
+++ b/crates/socket-patch-cli/tests/repair_vendor_e2e.rs
@@ -1,14 +1,13 @@
-//! End-to-end tests for `repair`'s vendored-artifact phase: artifacts
-//! referenced by the ledger and/or rewired lockfiles but missing/corrupt on
-//! disk are rebuilt fail-closed (and the ledger itself is reconstructed from
-//! lockfile references when it was deleted wholesale). Mock API + real npm
+//! End-to-end tests for `repair`'s vendored-artifact phase: artifacts the
+//! ledger records but that are missing/corrupt on disk are re-vendored
+//! fail-closed; lockfile references with no ledger entry are reported
+//! (`vendor_ledger_missing`), never reconstructed. Mock API + real npm
 //! lockfile fixtures, driven through the built binary.
 //!
 //! The gem rows exercise the dir-shaped counterparts: whole-tree
-//! fileInventory tamper detection, full wiring reconstruction from the live
-//! Gemfile/lock pair (revert then byte-restores), and the loud empty-wiring
-//! revert refusal. Their fixture pair is hand-written, modeled byte-for-byte
-//! on real `bundle lock` output (bundler 4.0.15).
+//! fileInventory tamper detection, inventory refresh, and the loud
+//! empty-wiring revert refusal. Their fixture pair is hand-written, modeled
+//! byte-for-byte on real `bundle lock` output (bundler 4.0.15).
 
 use std::path::{Path, PathBuf};
 use std::process::Command;
@@ -188,20 +187,6 @@ async fn mount_patch_api(mock: &MockServer) {
         .await;
 }
 
-/// Serve the after-blob for the `--download-mode file` repairs below. A
-/// vendored project has no manifest, so repair's download step (manifest
-/// records only) never fires and the route is a harmless safety net.
-async fn mount_blob(mock: &MockServer) {
-    Mock::given(method("GET"))
-        .and(path(format!(
-            "/v0/orgs/{ORG_SLUG}/patches/blob/{}",
-            git_sha256(AFTER)
-        )))
-        .respond_with(ResponseTemplate::new(200).set_body_bytes(AFTER))
-        .mount(mock)
-        .await;
-}
-
 fn run_cli(root: &Path, mock_uri: &str, argv: &[&str]) -> (i32, String, String) {
     let mut full = argv.to_vec();
     full.extend_from_slice(&[
@@ -246,11 +231,6 @@ fn events_of(v: &serde_json::Value) -> Vec<serde_json::Value> {
     v["events"].as_array().cloned().unwrap_or_default()
 }
 
-/// Run-level `warnings[]` (`{code, detail}`); empty when omitted.
-fn warnings_of(v: &serde_json::Value) -> Vec<serde_json::Value> {
-    v["warnings"].as_array().cloned().unwrap_or_default()
-}
-
 /// 1. Deleted tarball → `repair` rebuilds it byte-identically (installed
 ///    copy + view-fetched patch content), lockfile and ledger untouched.
 #[tokio::test]
@@ -586,447 +566,86 @@ fn assert_socket_dir_lean(root: &Path) {
     );
 }
 
-/// 7. The whole `.socket/vendor` tree (state.json included) deleted: repair
-///    reconstructs the ledger entry from the lockfile's vendor-path
-///    reference — the record comes back from the patch API by uuid, since a
-///    vendored project has no manifest — and rebuilds the artifact.
+/// 7. The ledger is gone (only `state.json`, or the whole `.socket/vendor`
+///    tree) while the lockfile still points into `.socket/vendor/`: repair
+///    does NOT re-synthesize the entry (the rewired lock cannot supply the
+///    pre-vendor originals a revert needs). It fails with
+///    `vendor_ledger_missing` naming the uuid and path, writes no ledger,
+///    leaves the lockfile and any surviving artifact alone — and once
+///    `state.json` is restored, the next repair is clean.
 #[tokio::test]
-async fn repair_reconstructs_ledger_from_lockfile_references() {
-    let mock = MockServer::start().await;
-    mount_patch_api(&mock).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_fixture(
-        tmp.path(),
-        "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
-        "sha512-orig==",
-    );
-    let tgz = vendor_project(tmp.path(), &mock.uri(), &[]);
-    let lock1 = std::fs::read(tmp.path().join("package-lock.json")).unwrap();
-
-    std::fs::remove_dir_all(tmp.path().join(".socket/vendor")).unwrap();
-
-    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair"]);
-    assert_eq!(code, 0, "stdout={stdout} stderr={stderr}");
-    let v = parse_env(&stdout);
-    assert_eq!(v["summary"]["rebuilt"], 1, "envelope={v}");
-    assert!(tgz.is_file(), "artifact rebuilt");
-    assert_eq!(
-        std::fs::read(tmp.path().join("package-lock.json")).unwrap(),
-        lock1,
-        "lockfile untouched"
-    );
-    // npm wiring originals are registry integrity material repair cannot
-    // reconstruct offline: the gap is a run-level ADVISORY (the entry
-    // itself repaired fine), so it rides `warnings[]` naming the purl —
-    // never `events[]` as a `skipped` a consumer would count as work not
-    // done.
-    assert!(
-        warnings_of(&v)
-            .iter()
-            .any(|w| w["code"] == "vendor_wiring_unknown"
-                && w["detail"].as_str().unwrap_or("").contains(PURL)),
-        "the wiring gap rides run-level warnings[] with the purl: {v}"
-    );
-    assert!(
-        !events_of(&v)
-            .iter()
-            .any(|e| e["errorCode"] == "vendor_wiring_unknown"),
-        "no skipped event for the run-level advisory: {v}"
-    );
-
-    // The re-synthesized ledger entry: same uuid, fingerprint of the
-    // rebuilt bytes, DETACHED with the API-recovered record embedded (no
-    // manifest owns it).
-    let state: serde_json::Value = serde_json::from_str(
-        &std::fs::read_to_string(tmp.path().join(".socket/vendor/state.json")).unwrap(),
-    )
-    .unwrap();
-    let entry = &state["entries"][PURL];
-    assert_eq!(entry["uuid"], UUID, "state={state}");
-    assert_eq!(entry["detached"], serde_json::json!(true), "state={state}");
-    assert_eq!(entry["record"]["uuid"], UUID, "state={state}");
-    assert_eq!(
-        entry["artifact"]["sha256"],
-        sha256_hex(&std::fs::read(&tgz).unwrap()),
-        "recomputed fingerprint matches the rebuilt artifact: {state}"
-    );
-    assert_socket_dir_lean(tmp.path());
-
-    // Revert fails CLOSED: there are no recorded originals to replay and
-    // the rewired lock still resolves through the artifact — removing it
-    // would brick every later `npm ci` (see test 12 for the full recovery
-    // arc).
-    let (code, stdout, _) = run_cli(tmp.path(), &mock.uri(), &["vendor", "--revert"]);
-    assert_ne!(
-        code, 0,
-        "revert of a still-wired reconstructed entry must refuse: {stdout}"
-    );
-    let v = parse_env(&stdout);
-    assert!(
-        events_of(&v)
-            .iter()
-            .any(|e| e["errorCode"] == "vendor_wiring_unknown_revert_blocked"),
-        "envelope={v}"
-    );
-    assert!(tgz.exists(), "the artifact the lock references survives");
-}
-
-/// 7b. Only `state.json` was lost; the committed artifact survived INTACT.
-///     Repair restores the ledger entry from the lockfile reference without
-///     rebuilding — the artifact bytes stay untouched and the re-synthesized
-///     entry fingerprints them.
-#[tokio::test]
-async fn repair_restores_ledger_for_intact_surviving_artifact() {
-    let mock = MockServer::start().await;
-    mount_patch_api(&mock).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_fixture(
-        tmp.path(),
-        "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
-        "sha512-orig==",
-    );
-    let tgz = vendor_project(tmp.path(), &mock.uri(), &[]);
-    let vendored_bytes = std::fs::read(&tgz).unwrap();
-
-    std::fs::remove_file(tmp.path().join(".socket/vendor/state.json")).unwrap();
-
-    mount_blob(&mock).await;
-    let (code, stdout, stderr) = run_cli(
-        tmp.path(),
-        &mock.uri(),
-        &["repair", "--download-mode", "file"],
-    );
-    assert_eq!(code, 0, "stdout={stdout} stderr={stderr}");
-    let v = parse_env(&stdout);
-    assert!(
-        events_of(&v)
-            .iter()
-            .any(|e| e["action"] == "rebuilt" && e["details"]["ledgerRestored"] == true),
-        "envelope={v}"
-    );
-    assert_eq!(
-        std::fs::read(&tgz).unwrap(),
-        vendored_bytes,
-        "an intact artifact is restored, not rebuilt"
-    );
-    let state: serde_json::Value = serde_json::from_str(
-        &std::fs::read_to_string(tmp.path().join(".socket/vendor/state.json")).unwrap(),
-    )
-    .unwrap();
-    assert_eq!(
-        state["entries"][PURL]["artifact"]["sha256"],
-        sha256_hex(&vendored_bytes),
-        "state={state}"
-    );
-}
-
-/// 7c. `state.json` lost AND the surviving artifact DRIFTED from the wired
-///     lock integrity while its patched members still verify (an unpatched
-///     member was altered — exactly the drift the whole-file ledger sha
-///     would have caught, but the re-synthesized entry has no sha yet).
-///     Reconstruction must not bless the drifted bytes into the new ledger:
-///     the artifact is rebuilt and reproduces the wired integrity.
-#[tokio::test]
-async fn repair_ledger_reconstruction_rejects_drifted_surviving_artifact() {
-    let mock = MockServer::start().await;
-    mount_patch_api(&mock).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_fixture(
-        tmp.path(),
-        "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
-        "sha512-orig==",
-    );
-    let tgz = vendor_project(tmp.path(), &mock.uri(), &[]);
-    let lock: serde_json::Value = serde_json::from_str(
-        &std::fs::read_to_string(tmp.path().join("package-lock.json")).unwrap(),
-    )
-    .unwrap();
-    let wired_sri = lock["packages"]["node_modules/left-pad"]["integrity"]
-        .as_str()
-        .expect("vendor wired the lock integrity")
-        .to_string();
-
-    std::fs::remove_file(tmp.path().join(".socket/vendor/state.json")).unwrap();
-    // Drift: an UNPATCHED member changes; the patched member keeps its
-    // AFTER bytes, so per-file afterHashes still verify.
-    let mut drifted = tar::Builder::new(flate2::write::GzEncoder::new(
-        Vec::new(),
-        flate2::Compression::default(),
-    ));
-    for (p, bytes) in [
-        (
-            "package/package.json",
-            br#"{"name":"left-pad","version":"1.3.0","scripts":{"postinstall":"evil"}}"#.as_slice(),
-        ),
-        ("package/index.js", AFTER),
-    ] {
-        let mut header = tar::Header::new_gnu();
-        header.set_size(bytes.len() as u64);
-        header.set_mode(0o644);
-        header.set_cksum();
-        drifted.append_data(&mut header, p, bytes).unwrap();
-    }
-    let drifted = drifted.into_inner().unwrap().finish().unwrap();
-    assert_ne!(sri_of(&drifted), wired_sri, "fixture must actually drift");
-    std::fs::write(&tgz, &drifted).unwrap();
-
-    mount_blob(&mock).await;
-    let (code, stdout, stderr) = run_cli(
-        tmp.path(),
-        &mock.uri(),
-        &["repair", "--download-mode", "file"],
-    );
-    assert_eq!(code, 0, "stdout={stdout} stderr={stderr}");
-    let v = parse_env(&stdout);
-    // THE regression: after a successful repair the committed artifact must
-    // be the bytes the rewired lock records — not the drifted ones blessed
-    // into the reconstructed ledger.
-    assert_eq!(
-        sri_of(&std::fs::read(&tgz).unwrap()),
-        wired_sri,
-        "envelope={v}"
-    );
-    let state: serde_json::Value = serde_json::from_str(
-        &std::fs::read_to_string(tmp.path().join(".socket/vendor/state.json")).unwrap(),
-    )
-    .unwrap();
-    assert_eq!(
-        state["entries"][PURL]["artifact"]["sha256"],
-        sha256_hex(&std::fs::read(&tgz).unwrap()),
-        "state={state}"
-    );
-}
-
-/// 7d. `.socket/vendor` deleted wholesale AND the installed copy's UNPATCHED
-///     member tampered (the patched file keeps its pristine bytes, so the
-///     backend's per-file checks all pass). The reconstruction rebuilds from
-///     the installed copy, so the rebuilt artifact cannot reproduce the wired
-///     lock integrity — the same trust anchor tests 9/10 enforce for the
-///     unverified-fetch rung. It must be rejected fail-closed (nothing kept,
-///     exit 1), never blessed into the reconstructed ledger while `npm ci`
-///     stays broken.
-#[tokio::test]
-async fn repair_reconstruction_rejects_tampered_installed_copy() {
-    let mock = MockServer::start().await;
-    mount_patch_api(&mock).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_fixture(
-        tmp.path(),
-        "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
-        "sha512-orig==",
-    );
-    let tgz = vendor_project(tmp.path(), &mock.uri(), &[]);
+async fn repair_reports_missing_ledger_instead_of_reconstructing() {
+    for wholesale in [false, true] {
+        let mock = MockServer::start().await;
+        mount_patch_api(&mock).await;
+        let tmp = tempfile::tempdir().unwrap();
+        write_fixture(
+            tmp.path(),
+            "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
+            "sha512-orig==",
+        );
+        let tgz = vendor_project(tmp.path(), &mock.uri(), &[]);
+        let tgz_bytes = std::fs::read(&tgz).unwrap();
+        let lock1 = std::fs::read(tmp.path().join("package-lock.json")).unwrap();
+        let state_path = tmp.path().join(".socket/vendor/state.json");
+        let state1 = std::fs::read(&state_path).unwrap();
 
-    std::fs::remove_dir_all(tmp.path().join(".socket/vendor")).unwrap();
-    // Tamper the installed copy's UNPATCHED member; name/version stay intact
-    // so the crawler still finds the package, and the patched index.js keeps
-    // its BEFORE bytes so per-file hash checks pass.
-    std::fs::write(
-        tmp.path().join("node_modules/left-pad/package.json"),
-        br#"{"name":"left-pad","version":"1.3.0","scripts":{"postinstall":"evil"}}"#,
-    )
-    .unwrap();
+        if wholesale {
+            std::fs::remove_dir_all(tmp.path().join(".socket/vendor")).unwrap();
+        } else {
+            std::fs::remove_file(&state_path).unwrap();
+        }
 
-    mount_blob(&mock).await;
-    let (code, stdout, stderr) = run_cli(
-        tmp.path(),
-        &mock.uri(),
-        &["repair", "--download-mode", "file"],
-    );
-    assert_eq!(code, 1, "stdout={stdout} stderr={stderr}");
-    let v = parse_env(&stdout);
-    assert!(
-        events_of(&v).iter().any(|e| e["action"] == "failed"
-            && e["errorCode"] == "vendor_artifact_rebuild_failed"
-            && e["error"]
+        let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair"]);
+        assert_eq!(code, 1, "wholesale={wholesale} stdout={stdout} stderr={stderr}");
+        let v = parse_env(&stdout);
+        let missing: Vec<_> = events_of(&v)
+            .into_iter()
+            .filter(|e| e["errorCode"] == "vendor_ledger_missing")
+            .collect();
+        assert_eq!(missing.len(), 1, "wholesale={wholesale} envelope={v}");
+        let ev = &missing[0];
+        assert_eq!(ev["action"], "failed", "{ev}");
+        assert_eq!(ev["uuid"], UUID, "{ev}");
+        assert!(ev.get("purl").is_none(), "no fabricated purl: {ev}");
+        assert_eq!(ev["details"]["ecosystem"], "npm", "{ev}");
+        assert!(
+            ev["details"]["path"]
                 .as_str()
                 .unwrap_or("")
-                .contains("integrity the lockfile records")),
-        "envelope={v}"
-    );
-    assert!(
-        !tgz.exists(),
-        "a rebuild that cannot reproduce the wired integrity must not be kept"
-    );
-}
-
-/// 8. No ledger AND no manifest — only the rewired lockfile: the uuid in
-///    the lock path drives an API view fetch and the entry is re-created
-///    DETACHED (manifest-invisible), with the artifact rebuilt.
-#[tokio::test]
-async fn repair_reconstructs_detached_from_lockfile_only() {
-    let mock = MockServer::start().await;
-    mount_patch_api(&mock).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_fixture(
-        tmp.path(),
-        "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
-        "sha512-orig==",
-    );
-    let tgz = vendor_project(tmp.path(), &mock.uri(), &[]);
-
-    std::fs::remove_dir_all(tmp.path().join(".socket")).unwrap();
-
-    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair"]);
-    assert_eq!(code, 0, "stdout={stdout} stderr={stderr}");
-    let v = parse_env(&stdout);
-    assert_eq!(v["summary"]["rebuilt"], 1, "envelope={v}");
-    assert!(tgz.is_file(), "artifact rebuilt");
-
-    let state: serde_json::Value = serde_json::from_str(
-        &std::fs::read_to_string(tmp.path().join(".socket/vendor/state.json")).unwrap(),
-    )
-    .unwrap();
-    let entry = &state["entries"][PURL];
-    assert_eq!(entry["uuid"], UUID, "state={state}");
-    assert_eq!(
-        entry["detached"], true,
-        "manifest-less reconstruction is detached: {state}"
-    );
-    assert_eq!(
-        entry["record"]["uuid"], UUID,
-        "the record is embedded for future repairs/VEX: {state}"
-    );
-}
-
-/// 9. The hardest reconstruction: no ledger, no manifest help needed beyond
-///    the record, and NO installed copy. The rewired lockfile's recorded
-///    integrity is the trust anchor: the pristine tarball is fetched
-///    unverified from the conventional registry URL and the REBUILT
-///    artifact must reproduce the wired integrity.
-#[tokio::test]
-async fn repair_reconstructs_without_installed_copy_via_wired_integrity() {
-    let mock = MockServer::start().await;
-    mount_patch_api(&mock).await;
-    Mock::given(method("GET"))
-        .and(path("/left-pad/-/left-pad-1.3.0.tgz"))
-        .respond_with(ResponseTemplate::new(200).set_body_bytes(pristine_tgz()))
-        .mount(&mock)
-        .await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_fixture(
-        tmp.path(),
-        "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
-        "sha512-orig==",
-    );
-    let tgz = vendor_project(tmp.path(), &mock.uri(), &[]);
-
-    // Fresh-clone hole: vendor tree gone AND nothing installed.
-    std::fs::remove_dir_all(tmp.path().join(".socket/vendor")).unwrap();
-    std::fs::remove_dir_all(tmp.path().join("node_modules")).unwrap();
-
-    mount_blob(&mock).await;
-    let out = Command::new(binary())
-        .args([
-            "repair",
-            "--download-mode",
-            "file",
-            "--json",
-            "--api-url",
-            &mock.uri(),
-            "--api-token",
-            "fake-token",
-            "--org",
-            ORG_SLUG,
-        ])
-        .current_dir(tmp.path())
-        .env("SOCKET_TELEMETRY_DISABLED", "1")
-        .env("SOCKET_NPM_REGISTRY", mock.uri())
-        .output()
-        .expect("run");
-    let stdout = String::from_utf8_lossy(&out.stdout);
-    let stderr = String::from_utf8_lossy(&out.stderr);
-    assert_eq!(
-        out.status.code(),
-        Some(0),
-        "stdout={stdout} stderr={stderr}"
-    );
-    let v = parse_env(&stdout);
-    assert_eq!(v["summary"]["rebuilt"], 1, "envelope={v}");
-    assert!(tgz.is_file(), "artifact rebuilt from the unverified fetch");
-
-    // The rebuilt tarball's integrity is exactly what the lock records.
-    let lock = std::fs::read_to_string(tmp.path().join("package-lock.json")).unwrap();
-    let rebuilt_sri = sri_of(&std::fs::read(&tgz).unwrap());
-    assert!(
-        lock.contains(&rebuilt_sri),
-        "rebuilt sri {rebuilt_sri} must be the wired one; lock={lock}"
-    );
-}
+                .starts_with(&format!(".socket/vendor/npm/{UUID}/")),
+            "{ev}"
+        );
+        assert!(
+            ev["error"].as_str().unwrap_or("").contains("state.json"),
+            "the remedy names state.json: {ev}"
+        );
+        assert!(
+            v["summary"]["rebuilt"].is_null() || v["summary"]["rebuilt"] == 0,
+            "nothing is rebuilt without a ledger: {v}"
+        );
+        assert!(!state_path.exists(), "no ledger is synthesized");
+        assert_eq!(
+            std::fs::read(tmp.path().join("package-lock.json")).unwrap(),
+            lock1,
+            "lockfile untouched"
+        );
+        if wholesale {
+            assert!(!tgz.exists(), "nothing is rebuilt without a ledger");
+            continue;
+        }
+        assert_eq!(std::fs::read(&tgz).unwrap(), tgz_bytes, "artifact untouched");
 
-/// 10. A tampered pristine source changes the deterministic rebuild, which
-///     then fails the wired-integrity check: nothing is kept, exit 1.
-#[tokio::test]
-async fn repair_reconstruction_rejects_tampered_pristine_source() {
-    let mock = MockServer::start().await;
-    mount_patch_api(&mock).await;
-    // The "registry" serves a tarball whose non-patched member differs.
-    let mut tampered = tar::Builder::new(flate2::write::GzEncoder::new(
-        Vec::new(),
-        flate2::Compression::default(),
-    ));
-    for (p, bytes) in [
-        (
-            "package/package.json",
-            br#"{"name":"left-pad","version":"1.3.0","scripts":{"postinstall":"evil"}}"#.as_slice(),
-        ),
-        ("package/index.js", BEFORE),
-    ] {
-        let mut header = tar::Header::new_gnu();
-        header.set_size(bytes.len() as u64);
-        header.set_mode(0o644);
-        header.set_cksum();
-        tampered.append_data(&mut header, p, bytes).unwrap();
+        // Restoring the ledger from version control is the recovery.
+        std::fs::write(&state_path, &state1).unwrap();
+        let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair"]);
+        assert_eq!(code, 0, "stdout={stdout} stderr={stderr}");
+        let v = parse_env(&stdout);
+        assert!(
+            !events_of(&v).iter().any(|e| e["action"] == "failed"),
+            "restored ledger repairs clean: {v}"
+        );
     }
-    let tampered = tampered.into_inner().unwrap().finish().unwrap();
-    Mock::given(method("GET"))
-        .and(path("/left-pad/-/left-pad-1.3.0.tgz"))
-        .respond_with(ResponseTemplate::new(200).set_body_bytes(tampered))
-        .mount(&mock)
-        .await;
-
-    let tmp = tempfile::tempdir().unwrap();
-    write_fixture(
-        tmp.path(),
-        "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
-        "sha512-orig==",
-    );
-    let tgz = vendor_project(tmp.path(), &mock.uri(), &[]);
-    std::fs::remove_dir_all(tmp.path().join(".socket/vendor")).unwrap();
-    std::fs::remove_dir_all(tmp.path().join("node_modules")).unwrap();
-
-    mount_blob(&mock).await;
-    let out = Command::new(binary())
-        .args([
-            "repair",
-            "--download-mode",
-            "file",
-            "--json",
-            "--api-url",
-            &mock.uri(),
-            "--api-token",
-            "fake-token",
-            "--org",
-            ORG_SLUG,
-        ])
-        .current_dir(tmp.path())
-        .env("SOCKET_TELEMETRY_DISABLED", "1")
-        .env("SOCKET_NPM_REGISTRY", mock.uri())
-        .output()
-        .expect("run");
-    let stdout = String::from_utf8_lossy(&out.stdout);
-    assert_eq!(out.status.code(), Some(1), "stdout={stdout}");
-    let v = parse_env(&stdout);
-    assert!(
-        events_of(&v).iter().any(|e| e["action"] == "failed"
-            && e["errorCode"] == "vendor_artifact_rebuild_failed"
-            && e["error"]
-                .as_str()
-                .unwrap_or("")
-                .contains("integrity the lockfile records")),
-        "envelope={v}"
-    );
-    assert!(!tgz.exists(), "a tampered rebuild must not be kept");
 }
 
 /// Dry run previews the rebuild without touching disk.
@@ -1044,131 +663,15 @@ async fn repair_dry_run_previews_rebuild() {
     std::fs::remove_file(&tgz).unwrap();
 
     let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair", "--dry-run"]);
-    assert_eq!(code, 0, "stdout={stdout} stderr={stderr}");
-    let v = parse_env(&stdout);
-    assert!(
-        events_of(&v).iter().any(|e| e["action"] == "verified"
-            && e["details"]["wouldRebuild"] == true
-            && e["purl"] == PURL),
-        "envelope={v}"
-    );
-    assert!(!tgz.exists(), "dry run writes nothing");
-}
-
-/// 12. The flavor-None brick, exactly as observed empirically (real project,
-///     2026-08-18): only `state.json` is lost, the artifact and the rewired
-///     `package-lock.json` survive. `repair` reconstructs the entry with
-///     EMPTY wiring (npm pre-vendor lock fragments are not
-///     offline-recoverable) — and `vendor --revert` of that entry used to
-///     exit 0 while DELETING the tarball the lock still resolves through,
-///     silently bricking every later `npm ci` (ENOENT on the file: spec).
-///     Now: the revert fails closed (`vendor_wiring_unknown_revert_blocked`),
-///     the artifact and lock survive, `repair` stays idempotent, and once
-///     the pre-vendor lock is restored a normal revert removes the orphaned
-///     artifact cleanly. The reconstruction also stamps the flavor it found
-///     the reference in (`package-lock`), so revert routes to the backend
-///     whose guard probes the RIGHT lockfile.
-#[tokio::test]
-async fn revert_of_reconstructed_package_lock_entry_fails_closed_then_recovers() {
-    let mock = MockServer::start().await;
-    mount_patch_api(&mock).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_fixture(
-        tmp.path(),
-        "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
-        "sha512-orig==",
-    );
-    let lock_pre = std::fs::read(tmp.path().join("package-lock.json")).unwrap();
-    let tgz = vendor_project(tmp.path(), &mock.uri(), &[]);
-    let lock_vendored = std::fs::read(tmp.path().join("package-lock.json")).unwrap();
-
-    // Ledger gone; artifact + rewired lock intact (the empirical shape).
-    // The anchored reconstruction restores the entry with wiring: [].
-    std::fs::remove_file(tmp.path().join(".socket/vendor/state.json")).unwrap();
-    mount_blob(&mock).await;
-    let (code, stdout, stderr) = run_cli(
-        tmp.path(),
-        &mock.uri(),
-        &["repair", "--download-mode", "file"],
-    );
-    assert_eq!(code, 0, "reconstruction: stdout={stdout} stderr={stderr}");
-    let state_path = tmp.path().join(".socket/vendor/state.json");
-    let state: serde_json::Value =
-        serde_json::from_str(&std::fs::read_to_string(&state_path).unwrap()).unwrap();
-    assert_eq!(
-        state["entries"][PURL]["wiring"].as_array().map(Vec::len),
-        Some(0),
-        "npm wiring is not offline-recoverable: {state}"
-    );
-    let stamped_flavor = state["entries"][PURL]["flavor"].clone();
-
-    // Nothing to replay + the lock still resolves through the artifact:
-    // revert must refuse loudly instead of silently removing the tarball.
-    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["vendor", "--revert"]);
-    assert_ne!(
-        code, 0,
-        "revert of an empty-wiring entry the lock still references must fail closed: \
-         stdout={stdout} stderr={stderr}"
-    );
-    let v = parse_env(&stdout);
-    assert!(
-        events_of(&v)
-            .iter()
-            .any(|e| e["errorCode"] == "vendor_wiring_unknown_revert_blocked"),
-        "envelope={v}"
-    );
-    assert!(
-        tgz.is_file(),
-        "the artifact the lock still references must survive the refusal"
-    );
-    assert_eq!(
-        std::fs::read(tmp.path().join("package-lock.json")).unwrap(),
-        lock_vendored,
-        "the lock stays untouched by the refusal"
-    );
-
-    // The reconstruction identified the referencing lockfile, so the entry
-    // carries the detected flavor — not None (which would depend on the
-    // flavor-None fallback route for its guard).
-    assert_eq!(
-        stamped_flavor,
-        serde_json::json!("package-lock"),
-        "reconstruction stamps the detected flavor"
-    );
-
-    // Recovery, exactly as the refusal advises: `repair` keeps the vendored
-    // artifact healthy (idempotent — the entry and tarball survive)...
-    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair"]);
-    assert_eq!(
-        code, 0,
-        "repair after refusal: stdout={stdout} stderr={stderr}"
-    );
-    assert!(tgz.is_file(), "repair keeps the artifact");
-
-    // ...and once the pre-vendor lock is restored (the manual-restore arm —
-    // the wiring originals are unrecoverable by design), a normal revert
-    // removes the now-orphaned artifact cleanly.
-    std::fs::write(tmp.path().join("package-lock.json"), &lock_pre).unwrap();
-    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["vendor", "--revert"]);
-    assert_eq!(code, 0, "final revert: stdout={stdout} stderr={stderr}");
+    assert_eq!(code, 0, "stdout={stdout} stderr={stderr}");
     let v = parse_env(&stdout);
     assert!(
-        events_of(&v)
-            .iter()
-            .any(|e| e["action"] == "removed" && e["purl"] == PURL),
+        events_of(&v).iter().any(|e| e["action"] == "verified"
+            && e["details"]["wouldRebuild"] == true
+            && e["purl"] == PURL),
         "envelope={v}"
     );
-    assert!(
-        !tmp.path()
-            .join(format!(".socket/vendor/npm/{UUID}"))
-            .exists(),
-        "the orphaned artifact dir is removed"
-    );
-    assert_eq!(
-        std::fs::read(tmp.path().join("package-lock.json")).unwrap(),
-        lock_pre,
-        "clean end state: the restored pre-vendor lock is untouched"
-    );
+    assert!(!tgz.exists(), "dry run writes nothing");
 }
 
 // ────────────────────────────── gem rows ──────────────────────────────
@@ -1357,267 +860,6 @@ fn vendor_gem_project(root: &Path, mock_uri: &str) -> PathBuf {
     copy
 }
 
-/// G1. Ledger deleted, wired pair + artifact survive: repair reconstructs
-///     the ENTRY — wiring included — byte-identically to the original
-///     ledger, and a subsequent `vendor --revert` byte-restores Gemfile and
-///     Gemfile.lock and removes the artifact. RED without wiring
-///     reconstruction: the revert "succeeds" silently while both files keep
-///     pointing at the deleted dir.
-#[tokio::test]
-async fn repair_reconstructs_gem_wiring_and_revert_byte_restores() {
-    let mock = MockServer::start().await;
-    mount_gem_patch_api(&mock).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_gem_fixture(tmp.path(), false);
-    let gemfile_before = std::fs::read(tmp.path().join("Gemfile")).unwrap();
-    let lock_before = std::fs::read(tmp.path().join("Gemfile.lock")).unwrap();
-    let copy = vendor_gem_project(tmp.path(), &mock.uri());
-    let state_path = tmp.path().join(".socket/vendor/state.json");
-    let state_before = std::fs::read(&state_path).unwrap();
-    // Anti-vacuity: the pair is actually wired before the ledger loss.
-    let wired_gemfile = std::fs::read(tmp.path().join("Gemfile")).unwrap();
-    assert_ne!(wired_gemfile, gemfile_before, "Gemfile must be wired");
-
-    std::fs::remove_file(&state_path).unwrap();
-
-    mount_blob(&mock).await;
-    let (code, stdout, stderr) = run_cli(
-        tmp.path(),
-        &mock.uri(),
-        &["repair", "--download-mode", "file"],
-    );
-    assert_eq!(code, 0, "stdout={stdout} stderr={stderr}");
-    let v = parse_env(&stdout);
-    assert!(
-        events_of(&v)
-            .iter()
-            .any(|e| e["action"] == "rebuilt" && e["details"]["ledgerRestored"] == true),
-        "envelope={v}"
-    );
-    assert!(
-        !events_of(&v)
-            .iter()
-            .any(|e| e["errorCode"] == "vendor_wiring_unknown")
-            && !warnings_of(&v)
-                .iter()
-                .any(|w| w["code"] == "vendor_wiring_unknown"),
-        "gem wiring IS reconstructable — no unknown-wiring warning: {v}"
-    );
-    // THE oracle: the reconstructed ledger equals the original, wiring,
-    // fileInventory and all (deterministic sorted serialization).
-    assert_eq!(
-        std::fs::read(&state_path).unwrap(),
-        state_before,
-        "reconstructed state.json must be byte-identical to the original"
-    );
-
-    let (code, stdout, _) = run_cli(tmp.path(), &mock.uri(), &["vendor", "--revert"]);
-    assert_eq!(code, 0, "revert after reconstruction: {stdout}");
-    assert_eq!(
-        std::fs::read(tmp.path().join("Gemfile")).unwrap(),
-        gemfile_before,
-        "Gemfile byte-restored"
-    );
-    assert_eq!(
-        std::fs::read(tmp.path().join("Gemfile.lock")).unwrap(),
-        lock_before,
-        "Gemfile.lock byte-restored"
-    );
-    assert!(!copy.exists(), "artifact dir removed");
-    assert!(
-        !tmp.path().join(".socket/vendor").exists(),
-        "fully-reverted project carries no vendor residue"
-    );
-}
-
-/// G1b. Same reconstruction on a bundler ≥ 2.6 CHECKSUMS lock: the
-///      pre-vendor `sha256=` token is not offline-recoverable, so repair
-///      surfaces `vendor_checksum_unrecoverable` and the revert restores
-///      everything EXCEPT that one line, which stays in bundler's bare form
-///      (a plain `bundle install` refills it — verified on 4.0.15).
-#[tokio::test]
-async fn repair_reconstruction_flags_unrecoverable_gem_checksum() {
-    let mock = MockServer::start().await;
-    mount_gem_patch_api(&mock).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_gem_fixture(tmp.path(), true);
-    let lock_before = std::fs::read_to_string(tmp.path().join("Gemfile.lock")).unwrap();
-    let gemfile_before = std::fs::read(tmp.path().join("Gemfile")).unwrap();
-    vendor_gem_project(tmp.path(), &mock.uri());
-
-    std::fs::remove_file(tmp.path().join(".socket/vendor/state.json")).unwrap();
-
-    mount_blob(&mock).await;
-    let (code, stdout, stderr) = run_cli(
-        tmp.path(),
-        &mock.uri(),
-        &["repair", "--download-mode", "file"],
-    );
-    assert_eq!(code, 0, "stdout={stdout} stderr={stderr}");
-    let v = parse_env(&stdout);
-    assert!(
-        events_of(&v)
-            .iter()
-            .any(|e| e["action"] == "skipped" && e["errorCode"] == "vendor_checksum_unrecoverable"),
-        "the unrecoverable sha256 must be surfaced: {v}"
-    );
-
-    let (code, stdout, _) = run_cli(tmp.path(), &mock.uri(), &["vendor", "--revert"]);
-    assert_eq!(code, 0, "revert: {stdout}");
-    assert_eq!(
-        std::fs::read(tmp.path().join("Gemfile")).unwrap(),
-        gemfile_before
-    );
-    let lock_after = std::fs::read_to_string(tmp.path().join("Gemfile.lock")).unwrap();
-    let expected = lock_before.replace(
-        &format!("  {GEM_NAME} ({GEM_VERSION}) sha256={}\n", "e".repeat(64)),
-        &format!("  {GEM_NAME} ({GEM_VERSION})\n"),
-    );
-    assert_ne!(expected, lock_before, "fixture must carry the sha256 line");
-    assert_eq!(
-        lock_after, expected,
-        "everything byte-restored except the bare CHECKSUMS entry"
-    );
-}
-
-/// G1c. No-ledger restore must NEVER canonize a tampered tree
-///      (trust-on-first-use): an UNPATCHED file in the vendored gem dir is
-///      tampered and the ledger deleted. The re-synthesized entry has no
-///      fileInventory, so the health check sees only the patched members
-///      (Healthy) — and no npm-family lock records an integrity for a gem
-///      dir. Repair must derive the canonical fingerprint from a
-///      member-verified LOCAL REBUILD (installed copy + recorded patch),
-///      healing the tamper; the restored ledger is byte-identical to the
-///      pre-tamper original. RED without the fix: the LIVE dir was
-///      fingerprinted into the restored ledger — the tampered gemspec
-///      survives as the canonical tree later repairs enforce and VEX
-///      attests.
-#[tokio::test]
-async fn repair_no_ledger_restore_never_canonizes_tampered_gem_tree() {
-    let mock = MockServer::start().await;
-    mount_gem_patch_api(&mock).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_gem_fixture(tmp.path(), false);
-    let copy = vendor_gem_project(tmp.path(), &mock.uri());
-    let state_path = tmp.path().join(".socket/vendor/state.json");
-    let state_before = std::fs::read(&state_path).unwrap();
-
-    // Tamper an UNPATCHED member (the stub gemspec); the patched member
-    // keeps its AFTER bytes so member-only verification still passes.
-    let tampered = b"Gem::Specification.new do |s|\n  s.name = \"padlock\"\n  s.version = \"1.2.0\"\n  s.require_paths = [\"lib\", \"exfil\"]\nend\n";
-    std::fs::write(copy.join("padlock.gemspec"), tampered).unwrap();
-    std::fs::remove_file(&state_path).unwrap();
-
-    mount_blob(&mock).await;
-    let (code, stdout, stderr) = run_cli(
-        tmp.path(),
-        &mock.uri(),
-        &["repair", "--download-mode", "file"],
-    );
-    assert_eq!(code, 0, "stdout={stdout} stderr={stderr}");
-    let v = parse_env(&stdout);
-    // The tamper is healed: the rebuild reproduced the pristine stub...
-    assert_eq!(
-        std::fs::read(copy.join("padlock.gemspec")).unwrap(),
-        GEMSPEC_STUB,
-        "the tampered unpatched file must be rebuilt, not kept: {v}"
-    );
-    assert_eq!(std::fs::read(copy.join("lib/padlock.rb")).unwrap(), AFTER);
-    // ...and the restored ledger equals the pre-tamper original — the
-    // tampered tree was never fingerprinted in.
-    assert_eq!(
-        std::fs::read(&state_path).unwrap(),
-        state_before,
-        "reconstructed state.json must equal the pre-tamper original"
-    );
-    // A later repair finds the canonical tree healthy — nothing to rebuild.
-    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair"]);
-    assert_eq!(code, 0, "stdout={stdout} stderr={stderr}");
-    let v2 = parse_env(&stdout);
-    assert!(
-        !events_of(&v2).iter().any(|e| e["action"] == "rebuilt"),
-        "second repair must find nothing to rebuild: {v2}"
-    );
-}
-
-/// G1d. Same no-ledger tamper, but NO trustworthy rebuild source exists
-///      (the installed copy is gone, and a reconstructed gem entry records
-///      no pre-vendor registry checksum to fetch by): repair must restore
-///      the ledger entry WITHOUT a fileInventory — surfacing
-///      `vendor_inventory_unverified` — so later runs stay in the legacy
-///      member-only-warn state (`vendor_inventory_missing`) instead of
-///      enforcing the tampered live tree as canonical. RED without the
-///      fix: the entry carries an inventory hashing the tampered bytes,
-///      no warning fires, and later repairs report fully Healthy.
-#[tokio::test]
-async fn repair_no_ledger_restore_without_pristine_source_stays_unverified() {
-    let mock = MockServer::start().await;
-    mount_gem_patch_api(&mock).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_gem_fixture(tmp.path(), false);
-    let copy = vendor_gem_project(tmp.path(), &mock.uri());
-
-    let tampered = b"tampered unpatched member\n";
-    std::fs::write(copy.join("padlock.gemspec"), tampered).unwrap();
-    std::fs::remove_file(tmp.path().join(".socket/vendor/state.json")).unwrap();
-    // No pristine source: the installed copy is gone, and the reconstructed
-    // wiring carries no CHECKSUMS sha256 (offline-unrecoverable, see G1b).
-    std::fs::remove_dir_all(tmp.path().join("vendor/bundle")).unwrap();
-
-    mount_blob(&mock).await;
-    let (code, stdout, stderr) = run_cli(
-        tmp.path(),
-        &mock.uri(),
-        &["repair", "--download-mode", "file"],
-    );
-    assert_eq!(code, 0, "stdout={stdout} stderr={stderr}");
-    let v = parse_env(&stdout);
-    assert!(
-        events_of(&v)
-            .iter()
-            .any(|e| e["errorCode"] == "vendor_inventory_unverified"),
-        "the unverifiable fingerprint must be surfaced: {v}"
-    );
-    assert!(
-        events_of(&v)
-            .iter()
-            .any(|e| e["action"] == "rebuilt" && e["details"]["ledgerRestored"] == true),
-        "the ledger entry is still restored: {v}"
-    );
-    let state: serde_json::Value = serde_json::from_str(
-        &std::fs::read_to_string(tmp.path().join(".socket/vendor/state.json")).unwrap(),
-    )
-    .unwrap();
-    assert!(
-        state["entries"][GEM_PURL]["artifact"]["fileInventory"].is_null(),
-        "the tampered live tree must NOT be fingerprinted into the ledger: {state}"
-    );
-    assert!(
-        !state["entries"][GEM_PURL]["wiring"]
-            .as_array()
-            .unwrap_or(&Vec::new())
-            .is_empty(),
-        "the reconstructed wiring is still persisted: {state}"
-    );
-    // No pristine source: repair must not have invented bytes either.
-    assert_eq!(
-        std::fs::read(copy.join("padlock.gemspec")).unwrap(),
-        tampered.as_slice(),
-        "the artifact is left as-is in the legacy member-only state"
-    );
-    // Later repairs keep naming the gap instead of enforcing the tampered
-    // tree as canonical.
-    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair"]);
-    assert_eq!(code, 0, "stdout={stdout} stderr={stderr}");
-    let v2 = parse_env(&stdout);
-    assert!(
-        events_of(&v2)
-            .iter()
-            .any(|e| e["errorCode"] == "vendor_inventory_missing"),
-        "later repairs stay in the legacy-warn state: {v2}"
-    );
-}
-
 /// G2. Empty-wiring gem entry (a reconstructed ledger without recoverable
 ///     originals, synthesized here): `vendor --revert` must FAIL loudly —
 ///     naming vendor_wiring_unknown — and keep the artifact and both files
@@ -1671,64 +913,6 @@ async fn revert_of_empty_wiring_gem_entry_fails_loudly() {
     );
 }
 
-/// G2b. The same empty-wiring population, healed at the repair seam: a
-///     LEDGERED gem entry whose wiring is empty (pre-reconstruction repairs
-///     persisted exactly these) gets full revert-capable wiring backfilled
-///     from the live pair while the artifact is healthy — byte-identical to
-///     the original ledger for the exact-pin fixture — and the revert
-///     byte-restores both files. RED without the pass-1
-///     backfill: repair exits 0 leaving `"wiring": []`, no wiringRestored
-///     event, and the revert fails.
-#[tokio::test]
-async fn repair_backfills_wiring_for_empty_wiring_gem_entry() {
-    let mock = MockServer::start().await;
-    mount_gem_patch_api(&mock).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_gem_fixture(tmp.path(), false);
-    let gemfile_before = std::fs::read(tmp.path().join("Gemfile")).unwrap();
-    let lock_before = std::fs::read(tmp.path().join("Gemfile.lock")).unwrap();
-    let copy = vendor_gem_project(tmp.path(), &mock.uri());
-    let state_path = tmp.path().join(".socket/vendor/state.json");
-    let state_before = std::fs::read(&state_path).unwrap();
-
-    let mut state: serde_json::Value =
-        serde_json::from_str(&std::fs::read_to_string(&state_path).unwrap()).unwrap();
-    state["entries"][GEM_PURL]["wiring"] = serde_json::json!([]);
-    std::fs::write(&state_path, serde_json::to_vec_pretty(&state).unwrap()).unwrap();
-
-    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair"]);
-    assert_eq!(code, 0, "stdout={stdout} stderr={stderr}");
-    let v = parse_env(&stdout);
-    assert!(
-        events_of(&v).iter().any(|e| e["action"] == "rebuilt"
-            && e["purl"] == GEM_PURL
-            && e["details"]["wiringRestored"] == true
-            && e["details"]["artifactRebuilt"] == false),
-        "envelope={v}"
-    );
-    // THE oracle: the backfilled ledger equals the original byte-for-byte
-    // (the exact-pin fixture reconstructs losslessly).
-    assert_eq!(
-        std::fs::read(&state_path).unwrap(),
-        state_before,
-        "backfilled state.json must be byte-identical to the original"
-    );
-
-    let (code, stdout, _) = run_cli(tmp.path(), &mock.uri(), &["vendor", "--revert"]);
-    assert_eq!(code, 0, "revert after backfill: {stdout}");
-    assert_eq!(
-        std::fs::read(tmp.path().join("Gemfile")).unwrap(),
-        gemfile_before,
-        "Gemfile byte-restored"
-    );
-    assert_eq!(
-        std::fs::read(tmp.path().join("Gemfile.lock")).unwrap(),
-        lock_before,
-        "Gemfile.lock byte-restored"
-    );
-    assert!(!copy.exists(), "artifact dir removed");
-}
-
 /// G3. Dir-shaped tamper matrix: an altered UNPATCHED file (the stub
 ///     gemspec), a deleted file, and a planted extra file must each flip
 ///     the health check to Corrupt — repair rebuilds the exact recorded
@@ -2023,17 +1207,14 @@ async fn repair_offline_without_sources_fails_loudly() {
     assert!(!tgz.exists());
 }
 
-/// Manifest-less VEX over what `repair` restores for npm: (a) a deleted
-/// tarball rebuilt byte-identically, (b) a WHOLESALE-deleted `.socket/vendor`
-/// (ledger reconstructed from the lockfile reference, empty wiring). Either
-/// way the checkout attests `(vendored)` with the manifest deleted, with the
-/// ledgers deleted (lockfile discovery + patch API), never `--offline`
-/// (`record_unavailable`, zero requests), and not once the lock is reverted
-/// (`vendor_unwired` — the reconstructed entry's empty wiring probes the
-/// root locks, which no longer mention it — `--no-verify` too).
+/// Manifest-less VEX over what `repair` restores for npm: a deleted
+/// tarball rebuilt byte-identically. The checkout attests `(vendored)` with
+/// the manifest deleted, with the ledgers deleted (lockfile discovery +
+/// patch API), never `--offline` (`record_unavailable`, zero requests), and
+/// not once the lock is reverted (`vendor_unwired`, `--no-verify` too).
 #[tokio::test]
 async fn repaired_vendored_state_attests_manifest_less() {
-    for wholesale in [false, true] {
+    {
         let mock = MockServer::start().await;
         mount_patch_api(&mock).await;
         let tmp = tempfile::tempdir().unwrap();
@@ -2044,19 +1225,9 @@ async fn repaired_vendored_state_attests_manifest_less() {
         );
         let pristine = std::fs::read(tmp.path().join("package-lock.json")).unwrap();
         let tgz = vendor_project(tmp.path(), &mock.uri(), &[]);
-        let argv: &[&str] = if wholesale {
-            std::fs::remove_dir_all(tmp.path().join(".socket/vendor")).unwrap();
-            mount_blob(&mock).await;
-            &["repair", "--download-mode", "file"]
-        } else {
-            std::fs::remove_file(&tgz).unwrap();
-            &["repair"]
-        };
-        let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), argv);
-        assert_eq!(
-            code, 0,
-            "wholesale={wholesale} stdout={stdout} stderr={stderr}"
-        );
+        std::fs::remove_file(&tgz).unwrap();
+        let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair"]);
+        assert_eq!(code, 0, "stdout={stdout} stderr={stderr}");
         assert!(tgz.is_file(), "repair rebuilt the artifact");
 
         let checkout = tmp.path().join("checkout");
@@ -2074,7 +1245,7 @@ async fn repaired_vendored_state_attests_manifest_less() {
                         ),
                     )]);
                     npm_e2e_common::manifestless_vex_matrix(&npm_e2e_common::ManifestlessCase {
-                        label: format!("repair wholesale={wholesale}"),
+                        label: "repair".to_string(),
                         project: &checkout,
                         purl: PURL,
                         uuid: UUID,
@@ -2129,3 +1300,153 @@ fn repair_previews_then_rebuilds_a_deleted_vlt_dir() {
     );
     assert!(uuid_dir.join(".gitignore").is_file());
 }
+
+/// Rewrite a `.tgz` through `edit` over its (path, bytes) members, then
+/// re-gzip with `mtime` in the gzip header.
+fn retar(tgz: &[u8], mtime: u32, edit: impl FnOnce(&mut Vec<(String, Vec<u8>)>)) -> Vec<u8> {
+    use std::io::Read as _;
+    let mut archive = tar::Archive::new(flate2::read::GzDecoder::new(tgz));
+    let mut members: Vec<(String, Vec<u8>)> = Vec::new();
+    for entry in archive.entries().unwrap() {
+        let mut entry = entry.unwrap();
+        let path = entry.path().unwrap().to_string_lossy().into_owned();
+        let mut bytes = Vec::new();
+        entry.read_to_end(&mut bytes).unwrap();
+        members.push((path, bytes));
+    }
+    edit(&mut members);
+    let gz = flate2::GzBuilder::new()
+        .mtime(mtime)
+        .write(Vec::new(), flate2::Compression::default());
+    let mut builder = tar::Builder::new(gz);
+    for (path, bytes) in &members {
+        let mut header = tar::Header::new_gnu();
+        header.set_size(bytes.len() as u64);
+        header.set_mode(0o644);
+        header.set_cksum();
+        builder.append_data(&mut header, path, bytes.as_slice()).unwrap();
+    }
+    builder.into_inner().unwrap().finish().unwrap()
+}
+
+/// A corrupt artifact that still carries the valid patched member (an
+/// unrelated member was added): `repair --offline` harvests the verified
+/// patched bytes BEFORE setting the artifact aside, rebuilds from the
+/// pristine installed copy, and restores the byte-exact recorded archive.
+#[tokio::test]
+async fn repair_offline_harvests_a_corrupt_artifacts_valid_members() {
+    let mock = MockServer::start().await;
+    mount_patch_api(&mock).await;
+    let tmp = tempfile::tempdir().unwrap();
+    write_fixture(
+        tmp.path(),
+        "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
+        "sha512-orig==",
+    );
+    let tgz = vendor_project(tmp.path(), &mock.uri(), &[]);
+    let tgz_bytes = std::fs::read(&tgz).unwrap();
+    let lock1 = std::fs::read(tmp.path().join("package-lock.json")).unwrap();
+    let state1 = std::fs::read(tmp.path().join(".socket/vendor/state.json")).unwrap();
+    assert!(!tmp.path().join(".socket/blobs").exists(), "no local blobs");
+
+    let corrupt = retar(&tgz_bytes, 0, |m| {
+        m.push(("package/extra.txt".into(), b"planted\n".to_vec()))
+    });
+    std::fs::write(&tgz, &corrupt).unwrap();
+
+    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair", "--offline"]);
+    assert_eq!(code, 0, "stdout={stdout} stderr={stderr}");
+    let v = parse_env(&stdout);
+    assert_eq!(v["summary"]["rebuilt"], 1, "envelope={v}");
+    assert_eq!(std::fs::read(&tgz).unwrap(), tgz_bytes, "byte-exact archive");
+    assert_eq!(
+        std::fs::read(tmp.path().join("package-lock.json")).unwrap(),
+        lock1
+    );
+    assert_eq!(
+        std::fs::read(tmp.path().join(".socket/vendor/state.json")).unwrap(),
+        state1
+    );
+}
+
+/// Repair keeps the ORIGINAL artifact identity: a service archive with the
+/// same members but different bytes (only the gzip mtime changed) is not
+/// committed. Repair falls back to the deterministic local build, restores
+/// the recorded bytes, and leaves the lockfile and ledger byte-identical.
+#[tokio::test]
+async fn repair_never_rewires_to_different_service_bytes() {
+    identity_kept_over_different_service_bytes(false).await;
+}
+
+/// Same, with the wired `package-lock.json` a symlink to the real lock: the
+/// put-back rewrites the link's target and leaves the link in place.
+#[cfg(unix)]
+#[tokio::test]
+async fn repair_identity_undo_follows_a_symlinked_lockfile() {
+    identity_kept_over_different_service_bytes(true).await;
+}
+
+async fn identity_kept_over_different_service_bytes(symlinked_lock: bool) {
+    let mock = MockServer::start().await;
+    mount_patch_api(&mock).await;
+    let tmp = tempfile::tempdir().unwrap();
+    write_fixture(
+        tmp.path(),
+        "https://registry.npmjs.org/left-pad/-/left-pad-1.3.0.tgz",
+        "sha512-orig==",
+    );
+    let tgz = vendor_project(tmp.path(), &mock.uri(), &[]);
+    // The wired lock moved behind a symlink after vendoring.
+    #[cfg(unix)]
+    if symlinked_lock {
+        let lock = tmp.path().join("package-lock.json");
+        std::fs::rename(&lock, tmp.path().join("real-lock.json")).unwrap();
+        std::os::unix::fs::symlink("real-lock.json", &lock).unwrap();
+    }
+    let tgz_bytes = std::fs::read(&tgz).unwrap();
+    let lock1 = std::fs::read(tmp.path().join("package-lock.json")).unwrap();
+    let state1 = std::fs::read(tmp.path().join(".socket/vendor/state.json")).unwrap();
+
+    let service_bytes = retar(&tgz_bytes, 1_234_567, |_| {});
+    assert_ne!(service_bytes, tgz_bytes, "fixture: the bytes must differ");
+    let serve = "/serve/left-pad-1.3.0.tgz";
+    Mock::given(method("POST"))
+        .and(path(format!("/v0/orgs/{ORG_SLUG}/patches/package")))
+        .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+            "results": { UUID: {
+                "status": "granted",
+                "url": format!("{}{serve}", mock.uri()),
+                "artifacts": [{ "kind": "tarball", "url": format!("{}{serve}", mock.uri()),
+                                "integrity": { "sha512": sri_of(&service_bytes) } }]
+            }}
+        })))
+        .with_priority(1)
+        .mount(&mock)
+        .await;
+    Mock::given(method("GET"))
+        .and(path(serve))
+        .respond_with(ResponseTemplate::new(200).set_body_bytes(service_bytes.clone()))
+        .mount(&mock)
+        .await;
+
+    std::fs::remove_file(&tgz).unwrap();
+    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair"]);
+    assert_eq!(code, 0, "stdout={stdout} stderr={stderr}");
+    let v = parse_env(&stdout);
+    assert_eq!(v["summary"]["rebuilt"], 1, "envelope={v}");
+    assert_eq!(std::fs::read(&tgz).unwrap(), tgz_bytes, "the recorded bytes");
+    assert_eq!(
+        std::fs::read(tmp.path().join("package-lock.json")).unwrap(),
+        lock1,
+        "lockfile untouched"
+    );
+    assert_eq!(
+        std::fs::read(tmp.path().join(".socket/vendor/state.json")).unwrap(),
+        state1,
+        "ledger untouched"
+    );
+    if symlinked_lock {
+        let meta = std::fs::symlink_metadata(tmp.path().join("package-lock.json")).unwrap();
+        assert!(meta.file_type().is_symlink(), "the lockfile link is kept");
+    }
+}
diff --git a/crates/socket-patch-cli/tests/repair_vendor_flavors_e2e.rs b/crates/socket-patch-cli/tests/repair_vendor_flavors_e2e.rs
index e5ad4ddf..f12d2aaf 100644
--- a/crates/socket-patch-cli/tests/repair_vendor_flavors_e2e.rs
+++ b/crates/socket-patch-cli/tests/repair_vendor_flavors_e2e.rs
@@ -9,9 +9,9 @@
 //!       the flavor's install wiring (lock rewrite) is left intact;
 //!   (b) corrupt the vendored tarball → detected (ledger sha) and rebuilt;
 //!   (c) tamper the ledger sha        → fail-closed, exit 1, artifact removed;
-//!   (d) delete the ledger wholesale  → RECONSTRUCTED from the lockfile's
-//!       vendored-tarball reference (`scan_vendor_references` tokenizes the
-//!       pnpm/yarn/bun locks) and the artifact rebuilt.
+//!   (d) delete the ledger wholesale  → the lockfile's vendored-tarball
+//!       reference (`scan_vendor_references` tokenizes the pnpm/yarn/bun
+//!       locks) is reported as `vendor_ledger_missing`, never reconstructed.
 //!
 //! The fixtures run the ACTUAL `scan --vendor` flow in-test the way the
 //! capstones stage it — a hand-written flavor lock (the pre-vendor shape each
@@ -399,19 +399,6 @@ async fn mount_patch_api_with(mock: &MockServer, extra: &[(&str, &[u8], &[u8])])
         .await;
 }
 
-/// Serve the after-blob for `--download-mode file` repairs (the ledger-gone
-/// reconstruction path runs before the vendored entry is re-synthesized, so
-/// its patch content is fetched via the blob endpoint).
-async fn mount_blob(mock: &MockServer) {
-    Mock::given(method("GET"))
-        .and(path(format!(
-            "/v0/orgs/{ORG_SLUG}/patches/blob/{}",
-            git_sha256(AFTER)
-        )))
-        .respond_with(ResponseTemplate::new(200).set_body_bytes(AFTER))
-        .mount(mock)
-        .await;
-}
 
 /// Runs through `common::run_with_env`, which seed-then-scrubs the ambient
 /// `SOCKET_*` surface the binary binds via clap `env=` (SOCKET_DRY_RUN,
@@ -711,9 +698,9 @@ async fn repair_fails_closed_on_tampered_bun_ledger_sha() {
     tampered_ledger_fails_closed(Flavor::Bun(BunLock::V1)).await;
 }
 
-// ── (d) ledger deleted wholesale → reconstruct from lockfile references ─────
+// ── (d) ledger deleted wholesale → reported, never reconstructed ──────────
 
-async fn ledger_gone_reconstructs_from_lock(flavor: Flavor) {
+async fn ledger_gone_is_reported(flavor: Flavor) {
     let mock = MockServer::start().await;
     mount_patch_api(&mock).await;
     let tmp = tempfile::tempdir().unwrap();
@@ -724,259 +711,44 @@ async fn ledger_gone_reconstructs_from_lock(flavor: Flavor) {
     // The whole .socket/vendor tree (state.json included) is gone — only the
     // rewired lockfile pins the vendored tarball. `scan_vendor_references`
     // must tokenize the flavor lock and recover the (npm, uuid, relpath)
-    // reference to reconstruct the entry and rebuild the artifact.
+    // reference, which repair reports instead of re-synthesizing a ledger.
     std::fs::remove_dir_all(tmp.path().join(".socket/vendor")).unwrap();
 
-    mount_blob(&mock).await;
-    let (code, stdout, stderr) = run_cli(
-        tmp.path(),
-        &mock.uri(),
-        &["repair", "--download-mode", "file"],
-    );
-    assert_eq!(code, 0, "{}: stdout={stdout} stderr={stderr}", flavor.tag());
-    let v = parse_env(&stdout);
-    assert_eq!(v["summary"]["rebuilt"], 1, "{}: envelope={v}", flavor.tag());
-    assert!(tgz.is_file(), "{}: artifact rebuilt", flavor.tag());
-    assert_eq!(
-        std::fs::read(tmp.path().join(flavor.lock_name())).unwrap(),
-        lock1,
-        "{}: lockfile untouched by reconstruction",
-        flavor.tag()
-    );
-
-    // The re-synthesized ledger entry names the uuid recovered from the
-    // lockfile path and fingerprints the rebuilt bytes.
-    let state: serde_json::Value = serde_json::from_str(
-        &std::fs::read_to_string(tmp.path().join(".socket/vendor/state.json")).unwrap(),
-    )
-    .unwrap();
-    let entry = &state["entries"][PURL];
-    assert_eq!(entry["uuid"], UUID, "{}: state={state}", flavor.tag());
-    assert_eq!(
-        entry["artifact"]["sha256"],
-        hex::encode(Sha256::digest(std::fs::read(&tgz).unwrap())),
-        "{}: recomputed fingerprint matches the rebuilt artifact: {state}",
-        flavor.tag()
-    );
-    assert_wiring_intact(tmp.path(), flavor);
-}
-
-// ── (e) ledger gone + drifted installed copy → fail-closed ─────────────────
-//
-// The reconstructed entry records no sha; the rewired lockfile's integrity
-// (pnpm `integrity:`, berry `checksum: 10c0/…`, bun tuple sha512) is the ONLY
-// anchor for the rebuilt bytes. A rebuild packed from an installed copy that
-// drifted since vendoring (a file added by a build tool, an edited unpatched
-// file) can never match that integrity — the package manager rejects the
-// artifact on its next install. Repair must fail closed, not report success
-// and bless the drifted bytes into a fresh ledger (which would make every
-// later repair see Healthy and never fix it).
-
-async fn ledger_gone_drifted_copy_fails_closed(flavor: Flavor) {
-    let mock = MockServer::start().await;
-    mount_patch_api(&mock).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_fixture(tmp.path(), flavor);
-    let tgz = vendor_project(tmp.path(), &mock.uri(), flavor);
-    let lock1 = std::fs::read(tmp.path().join(flavor.lock_name())).unwrap();
-
-    // Drift an UNPATCHED part of the installed copy (patched-file tampering
-    // is already caught by the beforeHash gate; this is invisible to it).
-    std::fs::write(
-        tmp.path().join("node_modules").join(DEP).join("drifted.js"),
-        b"injected after vendoring\n",
-    )
-    .unwrap();
-    std::fs::remove_dir_all(tmp.path().join(".socket/vendor")).unwrap();
-
-    mount_blob(&mock).await;
-    let (code, stdout, stderr) = run_cli(
-        tmp.path(),
-        &mock.uri(),
-        &["repair", "--download-mode", "file"],
-    );
-    assert_eq!(
-        code,
-        1,
-        "{}: a rebuild that cannot match the lockfile's recorded integrity must fail closed: \
-         stdout={stdout} stderr={stderr}",
-        flavor.tag()
-    );
+    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair"]);
+    assert_eq!(code, 1, "{}: stdout={stdout} stderr={stderr}", flavor.tag());
     let v = parse_env(&stdout);
     assert!(
-        events_of(&v)
-            .iter()
-            .any(|e| e["action"] == "failed" && e["errorCode"] == "vendor_artifact_rebuild_failed"),
+        events_of(&v).iter().any(|e| e["action"] == "failed"
+            && e["errorCode"] == "vendor_ledger_missing"
+            && e["uuid"] == UUID),
         "{}: envelope={v}",
         flavor.tag()
     );
+    assert!(!tgz.exists(), "{}: nothing rebuilt", flavor.tag());
     assert!(
-        !tgz.exists(),
-        "{}: an artifact the lockfile rejects must not be left on disk",
+        !tmp.path().join(".socket/vendor/state.json").exists(),
+        "{}: no ledger synthesized",
         flavor.tag()
     );
     assert_eq!(
         std::fs::read(tmp.path().join(flavor.lock_name())).unwrap(),
         lock1,
-        "{}: the lockfile (the trust anchor) stays untouched",
+        "{}: lockfile untouched",
         flavor.tag()
     );
 }
 
 #[tokio::test]
-async fn repair_fails_closed_on_drifted_copy_pnpm() {
-    ledger_gone_drifted_copy_fails_closed(Flavor::Pnpm).await;
-}
-
-#[tokio::test]
-async fn repair_fails_closed_on_drifted_copy_yarn_berry() {
-    ledger_gone_drifted_copy_fails_closed(Flavor::YarnBerry).await;
-}
-
-#[tokio::test]
-async fn repair_fails_closed_on_drifted_copy_bun() {
-    ledger_gone_drifted_copy_fails_closed(Flavor::Bun(BunLock::V1)).await;
-}
-
-#[tokio::test]
-async fn repair_reconstructs_pnpm_ledger_from_lockfile() {
-    ledger_gone_reconstructs_from_lock(Flavor::Pnpm).await;
-}
-
-// ── (f) reconstructed empty-wiring entry: revert must not brick installs ────
-//
-// Empirically confirmed brick (real pnpm@10.34.5 project, 2026-08-18): after
-// `repair` reconstructs a ledger-gone vendored entry from the lockfile, the
-// entry carries EMPTY wiring (npm-family pre-vendor lock fragments are not
-// offline-recoverable). Deleting the vendored tarball pnpm-lock.yaml still
-// resolves through would make every later `pnpm install` fail ENOENT, so a
-// subsequent `vendor --revert` on the npm-family backends fails closed
-// (`vendor_wiring_unknown_revert_blocked`) when there is nothing to replay
-// and the lock still references the artifact, and still remove genuinely
-// orphaned artifacts once the lock no longer does. `repair`'s reconstruction
-// also stamps the flavor it found the reference in (asserted below), so the
-// revert routes to the backend whose guard probes the RIGHT lockfile; a
-// flavor-None entry falls back to the package-lock backend, which is
-// guarded too (repair_vendor_e2e.rs test 12).
-
-#[tokio::test]
-async fn revert_of_reconstructed_pnpm_entry_fails_closed_then_recovers() {
-    let mock = MockServer::start().await;
-    mount_patch_api(&mock).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_fixture(tmp.path(), Flavor::Pnpm);
-    let lock_pre = std::fs::read(tmp.path().join("pnpm-lock.yaml")).unwrap();
-    let pkg_pre = std::fs::read(tmp.path().join("package.json")).unwrap();
-    let tgz = vendor_project(tmp.path(), &mock.uri(), Flavor::Pnpm);
-    let lock_vendored = std::fs::read(tmp.path().join("pnpm-lock.yaml")).unwrap();
-
-    // Ledger gone; artifact + rewired lock intact (the empirical shape).
-    // The anchored reconstruction restores the entry with wiring: [].
-    std::fs::remove_file(tmp.path().join(".socket/vendor/state.json")).unwrap();
-    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair"]);
-    assert_eq!(code, 0, "reconstruction: stdout={stdout} stderr={stderr}");
-    let state_path = tmp.path().join(".socket/vendor/state.json");
-    let state: serde_json::Value =
-        serde_json::from_str(&std::fs::read_to_string(&state_path).unwrap()).unwrap();
-    assert_eq!(
-        state["entries"][PURL]["wiring"].as_array().map(Vec::len),
-        Some(0),
-        "npm wiring is not offline-recoverable: {state}"
-    );
-    // The reconstruction found the reference in pnpm-lock.yaml (v9), so the
-    // entry is stamped with the pnpm flavor — revert routes to the pnpm
-    // backend and its guard probes pnpm-lock.yaml, not package-lock.json.
-    assert_eq!(
-        state["entries"][PURL]["flavor"],
-        serde_json::json!("pnpm"),
-        "reconstruction stamps the detected flavor: {state}"
-    );
-
-    // Nothing to replay + the lock still resolves through the artifact:
-    // revert must refuse loudly instead of silently removing the tarball.
-    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["vendor", "--revert"]);
-    assert_ne!(
-        code, 0,
-        "revert of an empty-wiring entry the lock still references must fail closed: \
-         stdout={stdout} stderr={stderr}"
-    );
-    let v = parse_env(&stdout);
-    assert!(
-        events_of(&v)
-            .iter()
-            .any(|e| e["errorCode"] == "vendor_wiring_unknown_revert_blocked"),
-        "envelope={v}"
-    );
-    assert!(
-        tgz.is_file(),
-        "the artifact the lock still references must survive the refusal"
-    );
-    assert_eq!(
-        std::fs::read(tmp.path().join("pnpm-lock.yaml")).unwrap(),
-        lock_vendored,
-        "the lock stays untouched by the refusal"
-    );
-
-    // Recovery, exactly as the refusal advises: `repair` keeps the vendored
-    // artifact healthy (idempotent — the entry and tarball survive)...
-    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair"]);
-    assert_eq!(
-        code, 0,
-        "repair after refusal: stdout={stdout} stderr={stderr}"
-    );
-    assert!(tgz.is_file(), "repair keeps the artifact");
-
-    // ...and once the pre-vendor surfaces are restored (the manual-restore
-    // arm — the wiring originals are unrecoverable by design), a normal
-    // revert removes the now-orphaned artifact cleanly.
-    std::fs::write(tmp.path().join("pnpm-lock.yaml"), &lock_pre).unwrap();
-    std::fs::write(tmp.path().join("package.json"), &pkg_pre).unwrap();
-    let ws = tmp.path().join("pnpm-workspace.yaml");
-    if ws.exists() {
-        std::fs::remove_file(&ws).unwrap();
-    }
-    let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["vendor", "--revert"]);
-    assert_eq!(code, 0, "final revert: stdout={stdout} stderr={stderr}");
-    let v = parse_env(&stdout);
-    assert!(
-        events_of(&v)
-            .iter()
-            .any(|e| e["action"] == "removed" && e["purl"] == PURL),
-        "envelope={v}"
-    );
-    assert!(
-        !tmp.path()
-            .join(format!(".socket/vendor/npm/{UUID}"))
-            .exists(),
-        "the orphaned artifact dir is removed"
-    );
-    assert_eq!(
-        std::fs::read(tmp.path().join("pnpm-lock.yaml")).unwrap(),
-        lock_pre,
-        "clean end state: the restored pre-vendor lock is untouched"
-    );
-    // The ledger entry is gone — either the state file was removed with its
-    // last entry, or it persists with an empty entries map.
-    match std::fs::read_to_string(&state_path) {
-        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {}
-        Ok(text) => {
-            let state: serde_json::Value = serde_json::from_str(&text).unwrap();
-            assert_eq!(
-                state["entries"].as_object().map(serde_json::Map::len),
-                Some(0),
-                "ledger entry gone: {state}"
-            );
-        }
-        Err(e) => panic!("unreadable state.json: {e}"),
-    }
+async fn repair_reports_missing_pnpm_ledger() {
+    ledger_gone_is_reported(Flavor::Pnpm).await;
 }
 
 #[tokio::test]
-async fn repair_reconstructs_yarn_berry_ledger_from_lockfile() {
-    ledger_gone_reconstructs_from_lock(Flavor::YarnBerry).await;
+async fn repair_reports_missing_yarn_berry_ledger() {
+    ledger_gone_is_reported(Flavor::YarnBerry).await;
 }
 
 #[tokio::test]
-async fn repair_reconstructs_bun_ledger_from_lockfile() {
-    ledger_gone_reconstructs_from_lock(Flavor::Bun(BunLock::V1)).await;
+async fn repair_reports_missing_bun_ledger() {
+    ledger_gone_is_reported(Flavor::Bun(BunLock::V1)).await;
 }
diff --git a/crates/socket-patch-cli/tests/repair_vendor_flavors_e2e/vlt.rs b/crates/socket-patch-cli/tests/repair_vendor_flavors_e2e/vlt.rs
index efdfb896..8779d2e8 100644
--- a/crates/socket-patch-cli/tests/repair_vendor_flavors_e2e/vlt.rs
+++ b/crates/socket-patch-cli/tests/repair_vendor_flavors_e2e/vlt.rs
@@ -10,8 +10,8 @@
 //!     → corrupt, rebuilt;
 //! (c) a planted regular file under the package's `node_modules/` →
 //!     corrupt (`vendor_inventory_mismatch`), rebuilt without it;
-//! (d) ledger deleted → reconstructed from `vlt-lock.json` (flavor `vlt`),
-//!     rebuilt member-verified, and its revert blocked by the unwired guard;
+//! (d) ledger deleted → the `vlt-lock.json` reference is reported
+//!     (`vendor_ledger_missing`), never reconstructed;
 //! (e) the orphan sweep keeps a lock-wired dir leaf and removes an
 //!     unreferenced one;
 //! (f) a deleted `<uuid>/.gitignore` is rewritten, no rebuild;
@@ -194,46 +194,34 @@ async fn vlt_repair_rebuilds_over_a_planted_file() {
 }
 
 #[tokio::test]
-async fn vlt_repair_reconstructs_the_ledger_from_the_lock() {
+async fn vlt_repair_reports_a_missing_ledger() {
     for lock in LOCKS {
         let mock = wiremock::MockServer::start().await;
         mount_patch_api(&mock).await;
-        super::mount_blob(&mock).await;
         let tmp = tempfile::tempdir().unwrap();
         write_fixture(tmp.path(), lock, None);
         vendor_project(tmp.path(), &mock.uri(), lock);
-        let inv = inventory(tmp.path());
+        let lock_bytes = std::fs::read(tmp.path().join("vlt-lock.json")).unwrap();
         std::fs::remove_file(tmp.path().join(".socket/vendor/state.json")).unwrap();
-        let v = repair(tmp.path(), &mock.uri());
-        let entry = state(tmp.path())["entries"][PURL].clone();
-        assert_eq!(entry["flavor"], "vlt", "{lock:?}: {entry:#}\n{v}");
-        assert_eq!(entry["artifact"]["path"], rel(), "{lock:?}");
-        assert_eq!(
-            entry["artifact"]["fileInventory"], inv,
-            "{lock:?}: the fingerprint comes from a member-verified rebuild: {v}"
-        );
+        let (code, stdout, stderr) = run_cli(tmp.path(), &mock.uri(), &["repair"]);
+        assert_eq!(code, 1, "{lock:?}: {stdout}\n{stderr}");
+        let v = parse_env(&stdout);
         assert!(
-            v["warnings"]
-                .as_array()
-                .into_iter()
-                .flatten()
-                .any(|w| w["code"] == "vendor_wiring_unknown"),
+            events_of(&v).iter().any(|e| e["action"] == "failed"
+                && e["errorCode"] == "vendor_ledger_missing"
+                && e["uuid"] == UUID),
             "{lock:?}: {v}"
         );
-        let (code, stdout, _) = common::run_with_env(
-            tmp.path(),
-            &["vendor", "--revert", "--json"],
-            &[("SOCKET_TELEMETRY_DISABLED", "1")],
-        );
-        let r = parse_env(&stdout);
-        assert_ne!(code, 0, "{lock:?}: {r}");
         assert!(
-            events_of(&r)
-                .iter()
-                .any(|e| e["errorCode"] == "vendor_wiring_unknown_revert_blocked"),
-            "{lock:?}: the unwired guard: {r}"
+            !tmp.path().join(".socket/vendor/state.json").exists(),
+            "{lock:?}: no ledger synthesized"
+        );
+        assert_eq!(
+            std::fs::read(tmp.path().join("vlt-lock.json")).unwrap(),
+            lock_bytes,
+            "{lock:?}"
         );
-        assert!(tmp.path().join(rel()).join("index.js").is_file());
+        assert!(tmp.path().join(rel()).join("index.js").is_file(), "{lock:?}");
     }
 }
 
@@ -339,14 +327,13 @@ async fn vlt_repair_keeps_a_devdependency_stripped_manifest_healthy() {
 
 /// `package.json` edited back to the registry spec since vendoring: only
 /// `vlt-lock.json` names the vendored dir. The orphan sweep keeps it, and
-/// a ledger-less repair finds the reference and refuses the out-of-sync
-/// declaration instead of dropping the dir.
+/// a ledger-less repair finds the reference and reports the missing ledger
+/// instead of dropping the dir.
 #[tokio::test]
 async fn vlt_lock_only_reference_is_kept_and_judged() {
     for lock in LOCKS {
         let mock = wiremock::MockServer::start().await;
         mount_patch_api(&mock).await;
-        super::mount_blob(&mock).await;
         let tmp = tempfile::tempdir().unwrap();
         write_fixture(tmp.path(), lock, None);
         let registry_pkg = std::fs::read(tmp.path().join("package.json")).unwrap();
@@ -375,23 +362,21 @@ async fn vlt_lock_only_reference_is_kept_and_judged() {
         let v = parse_env(&stdout);
         assert!(
             events_of(&v).iter().any(|e| e["action"] == "failed"
-                && e["purl"] == PURL
-                && e["errorCode"] == "vendor_vlt_lock_out_of_sync"),
-            "{lock:?}: the lock-only reference is found and judged: {v}"
+                && e["uuid"] == UUID
+                && e["errorCode"] == "vendor_ledger_missing"),
+            "{lock:?}: the lock-only reference is found and reported: {v}"
         );
         assert!(dir.join("index.js").is_file(), "{lock:?}: {v}");
     }
 }
 
-/// A must-verify rebuild (a pnpm-wired entry reconstructed from its lock
-/// integrity) in a project that also carries `vlt-lock.json`: the vlt
-/// backend drives the re-wire, the rebuilt artifact fails the post-verify,
-/// and every wiring file, vlt's included, is put back byte-for-byte.
+/// A ledger-less pnpm-wired project that also carries `vlt-lock.json`:
+/// repair reports the missing ledger and touches no wiring file, vlt's
+/// included.
 #[tokio::test]
-async fn vlt_wiring_files_are_restored_after_a_failed_post_verify() {
+async fn vlt_wiring_files_are_untouched_by_a_ledger_less_repair() {
     let mock = wiremock::MockServer::start().await;
     mount_patch_api(&mock).await;
-    super::mount_blob(&mock).await;
     let tmp = tempfile::tempdir().unwrap();
     let root = tmp.path();
     super::write_fixture(root, super::Flavor::Pnpm);
@@ -419,20 +404,20 @@ async fn vlt_wiring_files_are_restored_after_a_failed_post_verify() {
         .collect();
     std::fs::remove_dir_all(root.join(".socket/vendor")).unwrap();
 
-    let (code, stdout, stderr) = run_cli(root, &mock.uri(), &["repair", "--download-mode", "file"]);
+    let (code, stdout, stderr) = run_cli(root, &mock.uri(), &["repair"]);
     assert_eq!(code, 1, "{stdout}\n{stderr}");
     let v = parse_env(&stdout);
     assert!(
         events_of(&v)
             .iter()
-            .any(|e| e["action"] == "failed" && e["purl"] == PURL),
+            .any(|e| e["action"] == "failed" && e["errorCode"] == "vendor_ledger_missing"),
         "{v}"
     );
     for (file, bytes) in files.iter().zip(&before) {
         assert_eq!(
             &std::fs::read(root.join(file)).unwrap(),
             bytes,
-            "{file} is restored: {v}"
+            "{file} is untouched: {v}"
         );
     }
     assert!(
diff --git a/crates/socket-patch-cli/tests/scan_vendor_step_error_e2e.rs b/crates/socket-patch-cli/tests/scan_vendor_step_error_e2e.rs
index 5be3ba1c..c53e4d07 100644
--- a/crates/socket-patch-cli/tests/scan_vendor_step_error_e2e.rs
+++ b/crates/socket-patch-cli/tests/scan_vendor_step_error_e2e.rs
@@ -1,7 +1,7 @@
 //! Regression: the vendor step's ERROR returns must still hand the JSON
 //! consumer the step's `vendor` envelope — demoted — instead of dropping it.
 //!
-//! `scan --vendor`'s vendor step (`run_scan_vendor_step`) takes the apply
+//! `scan --vendor`'s vendor step (`run_vendor_step`) takes the apply
 //! lock, stages the fetched records' patch content in memory, then drives
 //! the vendor engine. Vendored mode is manifest-free: the step never reads
 //! the manifest and never reconciles ledger entries against it, so a
diff --git a/crates/socket-patch-core/src/vendor/gem.rs b/crates/socket-patch-core/src/vendor/gem.rs
index adbff138..162a05fd 100644
--- a/crates/socket-patch-core/src/vendor/gem.rs
+++ b/crates/socket-patch-core/src/vendor/gem.rs
@@ -1374,9 +1374,9 @@ pub async fn revert_gem_opts(
     let uuid_dir = project_root.join(&uuid_dir_rel);
     let mut warnings = Vec::new();
 
-    // Fail-closed guard: an entry with NO wiring records (a ledger repair
-    // reconstructed without recoverable wiring, or a hand-stripped
-    // state.json) must not "succeed" by deleting the artifact — the
+    // Fail-closed guard: an entry with NO wiring records (one an older
+    // socket-patch repair re-synthesized from the lockfiles, or a
+    // hand-stripped state.json) must not "succeed" by deleting the artifact — the
     // Gemfile `path:` and the lock's PATH section would keep pointing at
     // the removed dir and the next `bundle install` hard-fails. Refuse
     // loudly with the manual cleanup steps instead. (Every entry
@@ -1390,8 +1390,8 @@ pub async fn revert_gem_opts(
             .map(|(n, _)| n.into_owned())
             .unwrap_or_else(|| "<unknown>".to_string());
         return RevertOutcome::failed(format!(
-            "vendor_wiring_unknown: the ledger records no wiring for `{name}` (a \
-             reconstructed entry without recoverable originals); refusing to delete {} and \
+            "vendor_wiring_unknown: the ledger records no wiring for `{name}` (an \
+             entry without recoverable originals); refusing to delete {} and \
              strand the pair edit — manually remove the `path:` option (or the socket-patch \
              managed block) for `{name}` from the Gemfile, restore its registry entry in \
              Gemfile.lock (or delete the lock and re-run `bundle install`), then delete \
@@ -1480,265 +1480,6 @@ pub async fn revert_gem_opts(
     outcome
 }
 
-// ── ledger reconstruction ───────────────────────────────────────────────────
-
-/// Re-synthesize the wiring records for a gem entry whose ledger was lost
-/// (`repair`'s no-ledger reconstruction), by recognizing this backend's OWN
-/// emitted wiring in the live Gemfile + Gemfile.lock pair — the same
-/// recognizers the re-vendor-new-uuid path trusts. Everything is
-/// grammar-strict and fail-closed: any shape vendor does not write yields
-/// `Err` and the caller keeps an empty-wiring entry (whose revert then
-/// refuses loudly) instead of guessing.
-///
-/// Three documented degradations, all inherent to a lost ledger:
-///
-/// * a REWRITTEN declaration's pre-vendor line is reconstructed in the
-///   canonical exact-pin form (`gem "<name>", "<version>"` + preserved
-///   trailing options) — the user's original version constraint lived only
-///   in the lost ledger, and the exact pin restores a consistent,
-///   installable pair resolving to the same version;
-/// * a trailing `#` comment on the pre-vendor gem line is unrecoverable:
-///   vendor's exact-pin rewrite drops it (the verbatim line lived only in
-///   the lost ledger), so the reconstructed original restores the line
-///   comment-less;
-/// * a CHECKSUMS `sha256=` token is NOT recomputable offline, so no
-///   checksum record is emitted: revert leaves bundler's bare path-gem
-///   entry, which a non-frozen `bundle install` refills byte-identically
-///   (bundler 4.0.15 verified; frozen installs fail with a self-explanatory
-///   `empty CHECKSUMS entry` message until then) — surfaced as the
-///   `vendor_checksum_unrecoverable` warning. The warning is deliberately
-///   conservative: a gem whose PRE-vendor CHECKSUMS entry was already bare
-///   (real for file-sourced gems — bundler 4.0.15 writes no `sha256=` for
-///   them; vendor then records no checksum wiring at all and the bare-line
-///   revert is byte-perfect) is indistinguishable from a lost token, so it
-///   warns too.
-///
-/// The transitive-vs-declared split is recovered from the Gemfile form:
-/// vendor appends the managed fence exactly when the gem was undeclared,
-/// which is also exactly when the pre-vendor DEPENDENCIES entry was absent.
-pub async fn reconstruct_gem_wiring(
-    project_root: &Path,
-    entry: &VendorEntry,
-) -> Result<(Vec<WiringRecord>, Vec<VendorWarning>), String> {
-    let Some((name, version)) = parse_gem_purl(&entry.base_purl) else {
-        return Err(format!("not a gem purl: {}", entry.base_purl));
-    };
-    let (name, version) = (name.as_ref(), version.as_ref());
-    // SECURITY: the coordinates come from a re-synthesized entry
-    // (manifest/API purl) and are matched against Gemfile/lock line
-    // grammar — the same fail-closed token guard as `vendor_gem`.
-    if !is_safe_single_segment(name)
-        || !is_safe_single_segment(version)
-        || !is_plain_gem_token(name)
-        || !is_plain_gem_token(version)
-    {
-        return Err(format!("unsafe gem coordinates `{name}` @ `{version}`"));
-    }
-    let rel = entry.artifact.path.replace('\\', "/");
-    let leaf = format!("{name}-{version}");
-    match parse_vendor_path(&rel) {
-        Some(p) if p.eco == "gem" && p.uuid == entry.uuid && p.leaf == leaf => {}
-        _ => {
-            return Err(format!(
-                "artifact path `{rel}` is not this entry's canonical vendored dir"
-            ));
-        }
-    }
-
-    // ── Gemfile: exactly one declaration, carrying OUR `path:` ───────────
-    let gemfile_text = read_regular_to_string(&project_root.join(GEMFILE))
-        .await
-        .map_err(|e| format!("unreadable Gemfile: {e}"))?;
-    let lines: Vec<&str> = gemfile_text.split('\n').collect();
-    let mut found: Option<usize> = None;
-    for (i, line) in lines.iter().enumerate() {
-        let trimmed = line.trim_start();
-        if trimmed.starts_with('#') {
-            continue;
-        }
-        if gem_declaration(trimmed, name).is_some() && found.replace(i).is_some() {
-            return Err(format!(
-                "`gem \"{name}\"` is declared more than once in the Gemfile"
-            ));
-        }
-    }
-    let Some(idx) = found else {
-        return Err(format!("the Gemfile does not declare `{name}`"));
-    };
-    let line = lines[idx];
-    if line.trim_start().len() != line.len() {
-        return Err(format!(
-            "the `gem \"{name}\"` declaration is indented — not the wiring vendor writes"
-        ));
-    }
-    let managed = idx > 0
-        && lines[idx - 1] == MANAGED_OPEN
-        && lines.get(idx + 1).is_some_and(|l| *l == MANAGED_CLOSE);
-    let gemfile_record = if managed {
-        // The Append plan always emits exactly this double-quoted,
-        // option-free line; revert deletes the whole fenced block.
-        if line != format!("gem \"{name}\", \"{version}\", path: \"{rel}\"") {
-            return Err(format!(
-                "the managed block line for `{name}` is not the form vendor writes"
-            ));
-        }
-        WiringRecord {
-            file: GEMFILE.to_string(),
-            kind: GEMFILE_WIRING_KIND.to_string(),
-            action: WiringAction::Added,
-            key: Some(name.to_string()),
-            original: None,
-            new: Some(Value::String(format!(
-                "{MANAGED_OPEN}\n{line}\n{MANAGED_CLOSE}\n"
-            ))),
-        }
-    } else {
-        let de_vendored = devendored_gem_line(line, name, version, &rel).ok_or_else(|| {
-            format!(
-                "the `gem \"{name}\"` line is not the exact-pin + `path:` form vendor \
-                 writes; its pre-vendor original cannot be reconstructed"
-            )
-        })?;
-        WiringRecord {
-            file: GEMFILE.to_string(),
-            kind: GEMFILE_WIRING_KIND.to_string(),
-            action: WiringAction::Rewritten,
-            key: Some(name.to_string()),
-            original: Some(Value::String(de_vendored)),
-            new: Some(Value::String(line.to_string())),
-        }
-    };
-
-    // ── Gemfile.lock: our PATH section + the `!` DEPENDENCIES pin ────────
-    let lock_text = read_regular_to_string(&project_root.join(GEMFILE_LOCK))
-        .await
-        .map_err(|e| format!("unreadable Gemfile.lock: {e}"))?;
-    let lock_lines: Vec<String> = lock_text.split('\n').map(str::to_string).collect();
-    let (ps, pe) = find_our_path_section(&lock_lines, name, version)
-        .ok_or_else(|| format!("Gemfile.lock has no PATH section wiring `{name}`"))?;
-    let remote_line = format!("  remote: {rel}");
-    let target = format!("    {name} ({version})");
-    let block_start = (ps..pe)
-        .find(|&i| lock_lines[i] == target)
-        .ok_or_else(|| format!("the PATH section for `{name}` lost its spec entry"))?;
-    let mut block_end = block_start + 1;
-    while block_end < pe && lock_lines[block_end].starts_with("      ") {
-        block_end += 1;
-    }
-    // Grammar-strict, mirroring the re-vendor rewire guard: besides the
-    // spec block, the section must be exactly what vendor wrote — and its
-    // remote must be THIS entry's uuid dir, not some other patch's.
-    let non_block: Vec<&str> = (ps..pe)
-        .filter(|i| !(block_start..block_end).contains(i))
-        .map(|i| lock_lines[i].as_str())
-        .filter(|l| !l.is_empty())
-        .collect();
-    if non_block.len() != 3
-        || non_block[0] != "PATH"
-        || non_block[1] != remote_line
-        || non_block[2] != "  specs:"
-    {
-        return Err(format!(
-            "the Gemfile.lock PATH section for `{name} ({version})` is not the shape \
-             vendor writes"
-        ));
-    }
-    let new_dep_line = format!("  {name} (= {version})!");
-    let (ds, de) = section_span(&lock_lines, "DEPENDENCIES")
-        .ok_or_else(|| "Gemfile.lock has no DEPENDENCIES section".to_string())?;
-    if !(ds..de).any(|i| lock_lines[i] == new_dep_line) {
-        return Err(format!(
-            "Gemfile.lock DEPENDENCIES lacks the `{name} (= {version})!` pin vendor writes"
-        ));
-    }
-
-    let block = &lock_lines[block_start..block_end];
-    let mut new_lines: Vec<Value> = vec![
-        Value::String("PATH".to_string()),
-        Value::String(remote_line),
-        Value::String("  specs:".to_string()),
-    ];
-    new_lines.extend(block.iter().map(|l| Value::String(l.clone())));
-    new_lines.push(Value::String(new_dep_line));
-    let mut original_lines: Vec<Value> = block.iter().map(|l| Value::String(l.clone())).collect();
-    if !managed {
-        // Declared gem ⇒ DEPENDENCIES carried an entry pre-vendor. The
-        // canonical exact-pin form pairs with the reconstructed Gemfile
-        // line (see the function docs for the degradation contract).
-        original_lines.push(Value::String(format!("  {name} (= {version})")));
-    }
-    let lock_record = WiringRecord {
-        file: GEMFILE_LOCK.to_string(),
-        kind: LOCK_WIRING_KIND.to_string(),
-        action: WiringAction::Rewritten,
-        key: Some(name.to_string()),
-        original: Some(Value::Array(original_lines)),
-        new: Some(Value::Array(new_lines)),
-    };
-
-    // ── CHECKSUMS: bare path-form entry expected; sha256 unrecoverable ───
-    let mut warnings: Vec<VendorWarning> = Vec::new();
-    if let Some((cs, ce)) = section_span(&lock_lines, "CHECKSUMS") {
-        let bare = format!("  {name} ({version})");
-        for line in &lock_lines[cs + 1..ce] {
-            match checksum_entry(line) {
-                Some((n, v)) if n == name && v == version => {
-                    if line.as_str() != bare {
-                        return Err(format!(
-                            "Gemfile.lock CHECKSUMS still carries a registry `sha256=` \
-                             entry for `{name} ({version})` while the lock is path-wired \
-                             — not a state vendor writes; re-resolve the lock before \
-                             repairing"
-                        ));
-                    }
-                    warnings.push(VendorWarning::new(
-                        "vendor_checksum_unrecoverable",
-                        format!(
-                            "the pre-vendor CHECKSUMS `sha256=` line for {name} ({version}) \
-                             is not recoverable from a reconstructed ledger; after `vendor \
-                             --revert`, run a non-frozen `bundle install` once to refill it \
-                             (frozen installs fail on the empty entry until then)"
-                        ),
-                    ));
-                }
-                Some(_) => {}
-                None if checksum_line_names_gem(line, name) => {
-                    return Err(format!(
-                        "Gemfile.lock CHECKSUMS entry for `{name}` is not parseable: {line:?}"
-                    ));
-                }
-                None => {}
-            }
-        }
-    }
-
-    Ok((vec![gemfile_record, lock_record], warnings))
-}
-
-/// Strip our `path:` option back out of a line the exact-pin rewrite
-/// emitted: `gem {q}{name}{q}, {q}{version}{q}, path: {q}{rel}{q}[, opts]` →
-/// `gem {q}{name}{q}, {q}{version}{q}[, opts]`. `None` for any other shape
-/// (fail-closed), including trailing options that would re-select a source.
-fn devendored_gem_line(line: &str, name: &str, version: &str, rel: &str) -> Option<String> {
-    for q in ['"', '\''] {
-        let head = format!("gem {q}{name}{q}, {q}{version}{q}");
-        let with_path = format!("{head}, path: {q}{rel}{q}");
-        if line == with_path {
-            return Some(head);
-        }
-        if let Some(opts) = line
-            .strip_prefix(with_path.as_str())
-            .and_then(|t| t.strip_prefix(", "))
-        {
-            if opts.is_empty() || rest_blocks_edit(&format!(", {opts}")).is_some() {
-                return None;
-            }
-            return Some(format!("{head}, {opts}"));
-        }
-    }
-    None
-}
-
 // ── Gemfile editing ──────────────────────────────────────────────────────────
 
 /// The planned Gemfile edit.
@@ -5742,232 +5483,13 @@ mod tests {
         assert_eq!(code, "vendor_service_offline_conflict");
     }
 
-    // ── ledger reconstruction ────────────────────────────────────────────
+    // ── empty-wiring guards ──────────────────────────────────────────────
 
     const GEMFILE_PINNED: &str =
         "source \"https://rubygems.org\"\n\ngem \"puma\"\ngem \"rack\", \"3.2.6\"\n";
     const LOCK_PINNED: &str = "GEM\n  remote: https://rubygems.org/\n  specs:\n    puma (6.4.2)\n      nio4r (~> 2.0)\n    rack (3.2.6)\n      base64 (>= 0.1.0)\n\nPLATFORMS\n  arm64-darwin-23\n  ruby\n\nDEPENDENCIES\n  puma\n  rack (= 3.2.6)\n\nBUNDLED WITH\n   2.5.22\n";
 
-    /// STRONG oracle for an exact-pin declaration: reconstruction from the
-    /// live wired pair must reproduce vendor's own recorded wiring
-    /// byte-for-byte — and reverting with the reconstructed records must
-    /// byte-restore both files, exactly like the real ledger would.
-    #[tokio::test]
-    async fn reconstruction_reproduces_vendor_wiring_for_pinned_declaration() {
-        let (_tmp, root, installed, blobs, record) = fixture(GEMFILE_PINNED, LOCK_PINNED).await;
-        let (result, entry, _w) =
-            unwrap_done(run_vendor(&root, &blobs, &installed, &record, false).await);
-        assert!(result.success, "vendor failed: {:?}", result.error);
-        let entry = entry.expect("wired entry");
-
-        let (wiring, warnings) = reconstruct_gem_wiring(&root, &entry).await.unwrap();
-        assert_eq!(
-            wiring, entry.wiring,
-            "reconstructed wiring must equal what vendor recorded"
-        );
-        assert!(
-            warnings.is_empty(),
-            "no CHECKSUMS section, no degradation notes: {warnings:?}"
-        );
-
-        // Revert with ONLY the reconstructed records: byte-restored pair,
-        // artifact gone.
-        let mut synth = entry.clone();
-        synth.wiring = wiring;
-        let outcome = revert_gem(&synth, &root, false).await;
-        assert!(outcome.success, "revert failed: {:?}", outcome.error);
-        assert_eq!(
-            tokio::fs::read_to_string(root.join(GEMFILE)).await.unwrap(),
-            GEMFILE_PINNED
-        );
-        assert_eq!(
-            tokio::fs::read_to_string(root.join(GEMFILE_LOCK))
-                .await
-                .unwrap(),
-            LOCK_PINNED
-        );
-        assert!(!root.join(copy_rel()).exists(), "artifact removed");
-    }
-
-    /// Transitive gem (managed fence): the reconstructed Added record must
-    /// equal vendor's, and the lock original must carry NO dependencies
-    /// entry (revert deletes the added pin).
-    #[tokio::test]
-    async fn reconstruction_reproduces_vendor_wiring_for_managed_block() {
-        let (_tmp, root, installed, blobs, record) =
-            fixture(GEMFILE_TRANSITIVE, LOCK_TRANSITIVE).await;
-        let (result, entry, _w) =
-            unwrap_done(run_vendor(&root, &blobs, &installed, &record, false).await);
-        assert!(result.success, "vendor failed: {:?}", result.error);
-        let entry = entry.expect("wired entry");
-
-        let (wiring, _) = reconstruct_gem_wiring(&root, &entry).await.unwrap();
-        assert_eq!(wiring, entry.wiring);
-
-        let mut synth = entry.clone();
-        synth.wiring = wiring;
-        let outcome = revert_gem(&synth, &root, false).await;
-        assert!(outcome.success, "revert failed: {:?}", outcome.error);
-        assert_eq!(
-            tokio::fs::read_to_string(root.join(GEMFILE)).await.unwrap(),
-            GEMFILE_TRANSITIVE
-        );
-        assert_eq!(
-            tokio::fs::read_to_string(root.join(GEMFILE_LOCK))
-                .await
-                .unwrap(),
-            LOCK_TRANSITIVE
-        );
-    }
-
-    /// The documented degradation: a RANGE constraint (`~> 3.1`) lived only
-    /// in the lost ledger, so the reconstructed originals pin the exact
-    /// locked version — a consistent, installable pair, hand-pinned here.
-    #[tokio::test]
-    async fn reconstruction_degrades_range_constraint_to_exact_pin() {
-        let (_tmp, root, installed, blobs, record) = fixture(GEMFILE_DIRECT, LOCK_DIRECT).await;
-        let (result, entry, _w) =
-            unwrap_done(run_vendor(&root, &blobs, &installed, &record, false).await);
-        assert!(result.success, "vendor failed: {:?}", result.error);
-        let entry = entry.expect("wired entry");
-
-        let (wiring, _) = reconstruct_gem_wiring(&root, &entry).await.unwrap();
-        assert_eq!(
-            wiring[0].original,
-            Some(Value::String("gem \"rack\", \"3.2.6\"".to_string())),
-            "canonical exact pin, NOT the unrecoverable `~> 3.1`"
-        );
-        let lock_original = wiring[1].original.as_ref().unwrap().as_array().unwrap();
-        assert_eq!(
-            lock_original.last().unwrap(),
-            &Value::String("  rack (= 3.2.6)".to_string()),
-            "the DEPENDENCIES restore pairs with the pinned Gemfile line"
-        );
-
-        // The reverted pair is CONSISTENT (both halves pin 3.2.6).
-        let mut synth = entry.clone();
-        synth.wiring = wiring;
-        let outcome = revert_gem(&synth, &root, false).await;
-        assert!(outcome.success, "revert failed: {:?}", outcome.error);
-        let gemfile = tokio::fs::read_to_string(root.join(GEMFILE)).await.unwrap();
-        assert!(gemfile.contains("gem \"rack\", \"3.2.6\"\n"), "{gemfile}");
-        assert!(!gemfile.contains("path:"), "{gemfile}");
-        let lock = tokio::fs::read_to_string(root.join(GEMFILE_LOCK))
-            .await
-            .unwrap();
-        assert!(lock.contains("\n  rack (= 3.2.6)\n"), "{lock}");
-        assert!(!lock.contains("PATH"), "{lock}");
-    }
-
-    /// Trailing options ride the reconstruction (`require: false` dropped
-    /// on restore would auto-require the gem at boot).
-    #[tokio::test]
-    async fn reconstruction_preserves_trailing_options() {
-        let gemfile =
-            "source \"https://rubygems.org\"\n\ngem \"puma\"\ngem \"rack\", \"3.2.6\", require: false\n";
-        let (_tmp, root, installed, blobs, record) = fixture(gemfile, LOCK_PINNED).await;
-        let (result, entry, _w) =
-            unwrap_done(run_vendor(&root, &blobs, &installed, &record, false).await);
-        assert!(result.success, "vendor failed: {:?}", result.error);
-        let entry = entry.expect("wired entry");
-
-        let (wiring, _) = reconstruct_gem_wiring(&root, &entry).await.unwrap();
-        assert_eq!(
-            wiring[0].original,
-            Some(Value::String(
-                "gem \"rack\", \"3.2.6\", require: false".to_string()
-            ))
-        );
-    }
-
-    /// A bare CHECKSUMS entry (bundler ≥ 2.6 lock): the `sha256=` token is
-    /// not offline-recoverable, so reconstruction emits NO checksum record
-    /// (revert leaves the bare line for a plain `bundle install` to refill
-    /// — bundler 4.0.15 verified) and surfaces the gap as a warning.
-    #[tokio::test]
-    async fn reconstruction_flags_unrecoverable_checksum() {
-        let lock = format!(
-            "GEM\n  remote: https://rubygems.org/\n  specs:\n    puma (6.4.2)\n      nio4r (~> 2.0)\n    rack (3.2.6)\n      base64 (>= 0.1.0)\n\nPLATFORMS\n  arm64-darwin-23\n  ruby\n\nDEPENDENCIES\n  puma\n  rack (= 3.2.6)\n\nCHECKSUMS\n  puma (6.4.2) sha256={}\n  rack (3.2.6) sha256={}\n\nBUNDLED WITH\n   2.5.22\n",
-            "a".repeat(64),
-            "b".repeat(64),
-        );
-        let (_tmp, root, installed, blobs, record) = fixture(GEMFILE_PINNED, &lock).await;
-        let (result, entry, _w) =
-            unwrap_done(run_vendor(&root, &blobs, &installed, &record, false).await);
-        assert!(result.success, "vendor failed: {:?}", result.error);
-        let entry = entry.expect("wired entry");
-        assert_eq!(entry.wiring.len(), 3, "vendor recorded a checksum record");
-
-        let (wiring, warnings) = reconstruct_gem_wiring(&root, &entry).await.unwrap();
-        assert_eq!(
-            wiring.len(),
-            2,
-            "no checksum record — the sha256 is unrecoverable: {wiring:?}"
-        );
-        assert_eq!(warnings.len(), 1, "{warnings:?}");
-        assert_eq!(warnings[0].code, "vendor_checksum_unrecoverable");
-    }
-
-    /// Fail-closed refusals: anything that is not vendor's own emitted
-    /// wiring yields `Err`, never guessed-at records.
-    #[tokio::test]
-    async fn reconstruction_refuses_foreign_or_mismatched_wiring() {
-        let (_tmp, root, installed, blobs, record) = fixture(GEMFILE_PINNED, LOCK_PINNED).await;
-        let (result, entry, _w) =
-            unwrap_done(run_vendor(&root, &blobs, &installed, &record, false).await);
-        assert!(result.success, "vendor failed: {:?}", result.error);
-        let entry = entry.expect("wired entry");
-
-        // A user fork's path: (not our vendored dir) in place of ours.
-        let gemfile_path = root.join(GEMFILE);
-        let wired = tokio::fs::read_to_string(&gemfile_path).await.unwrap();
-        tokio::fs::write(
-            &gemfile_path,
-            wired.replace(&copy_rel(), "vendor/forks/rack"),
-        )
-        .await
-        .unwrap();
-        let err = reconstruct_gem_wiring(&root, &entry).await.unwrap_err();
-        assert!(err.contains("exact-pin"), "{err}");
-        tokio::fs::write(&gemfile_path, &wired).await.unwrap();
-
-        // A DIFFERENT patch uuid's dir wired in the pair: not this entry's.
-        let mut other = entry.clone();
-        other.uuid = "11111111-2222-4333-8444-555555555555".to_string();
-        other.artifact.path =
-            ".socket/vendor/gem/11111111-2222-4333-8444-555555555555/rack-3.2.6".to_string();
-        let err = reconstruct_gem_wiring(&root, &other).await.unwrap_err();
-        assert!(
-            err.contains("exact-pin") || err.contains("PATH section"),
-            "{err}"
-        );
-
-        // The lock lost the `!` pin.
-        let lock_path = root.join(GEMFILE_LOCK);
-        let wired_lock = tokio::fs::read_to_string(&lock_path).await.unwrap();
-        tokio::fs::write(
-            &lock_path,
-            wired_lock.replace("  rack (= 3.2.6)!", "  rack (= 3.2.6)"),
-        )
-        .await
-        .unwrap();
-        let err = reconstruct_gem_wiring(&root, &entry).await.unwrap_err();
-        assert!(err.contains("(= 3.2.6)!"), "{err}");
-        tokio::fs::write(&lock_path, &wired_lock).await.unwrap();
-
-        // A registry `sha256=` CHECKSUMS entry while path-wired (the stale
-        // pre-CHECKSUMS-aware state): never silently blessed.
-        let stale = format!(
-            "{wired_lock}\nCHECKSUMS\n  rack (3.2.6) sha256={}\n",
-            "c".repeat(64)
-        );
-        tokio::fs::write(&lock_path, stale).await.unwrap();
-        let err = reconstruct_gem_wiring(&root, &entry).await.unwrap_err();
-        assert!(err.contains("sha256"), "{err}");
-    }
-
-    /// The empty-wiring revert guard: a reconstructed entry without
-    /// recoverable wiring must FAIL loudly — deleting the artifact would
+    /// The empty-wiring revert guard: an entry without recoverable wiring must FAIL loudly — deleting the artifact would
     /// strand the Gemfile `path:` + lock PATH section on a dead dir. The
     /// files and the artifact stay untouched.
     #[tokio::test]
@@ -7773,44 +7295,6 @@ mod tests {
         assert!(matches!(plan, GemfilePlan::Append { .. }));
     }
 
-    /// [`devendored_gem_line`] fail-closed shapes: trailing `, ` (empty
-    /// opts) and a source-selecting trailing option must never reconstruct;
-    /// the plain and kept-options forms are the positive controls.
-    #[test]
-    fn devendored_gem_line_fail_closed_shapes() {
-        let rel = copy_rel();
-        let with_path = format!("gem \"rack\", \"3.2.6\", path: \"{rel}\"");
-        assert_eq!(
-            devendored_gem_line(&with_path, "rack", "3.2.6", &rel).as_deref(),
-            Some("gem \"rack\", \"3.2.6\"")
-        );
-        assert_eq!(
-            devendored_gem_line(
-                &format!("{with_path}, require: false"),
-                "rack",
-                "3.2.6",
-                &rel
-            )
-            .as_deref(),
-            Some("gem \"rack\", \"3.2.6\", require: false")
-        );
-        assert_eq!(
-            devendored_gem_line(&format!("{with_path}, "), "rack", "3.2.6", &rel),
-            None,
-            "trailing `, ` (empty opts) is fail-closed"
-        );
-        assert_eq!(
-            devendored_gem_line(
-                &format!("{with_path}, source: \"x\""),
-                "rack",
-                "3.2.6",
-                &rel
-            ),
-            None,
-            "a source-selecting trailing option is fail-closed"
-        );
-    }
-
     /// The Append splice on a Gemfile with NO trailing newline must insert
     /// one before the managed block — never concatenate onto the last line.
     #[tokio::test]
@@ -7832,125 +7316,6 @@ mod tests {
         );
     }
 
-    // ── ledger reconstruction fail-closed error legs (coverage-gap) ───────
-
-    /// Every non-vendor shape must yield `Err` — a wrong `Ok` here would let
-    /// repair fabricate wiring records for state vendor never wrote.
-    #[tokio::test]
-    async fn reconstruction_error_legs_fail_closed() {
-        let (_tmp, root, installed, blobs, record) = fixture(GEMFILE_PINNED, LOCK_PINNED).await;
-        let (result, entry, _w) =
-            unwrap_done(run_vendor(&root, &blobs, &installed, &record, false).await);
-        assert!(result.success, "{:?}", result.error);
-        let entry = entry.expect("wired entry");
-
-        // Entry-side guards (before any file access).
-        let mut bad = entry.clone();
-        bad.base_purl = "pkg:npm/x@1.0.0".to_string();
-        let err = reconstruct_gem_wiring(&root, &bad).await.unwrap_err();
-        assert!(err.contains("not a gem purl"), "{err}");
-
-        let mut bad = entry.clone();
-        bad.base_purl = "pkg:gem/rack@3.2.6+x".to_string();
-        let err = reconstruct_gem_wiring(&root, &bad).await.unwrap_err();
-        assert!(err.contains("unsafe gem coordinates"), "{err}");
-
-        let mut bad = entry.clone();
-        bad.artifact.path = "vendor/forks/rack".to_string();
-        let err = reconstruct_gem_wiring(&root, &bad).await.unwrap_err();
-        assert!(err.contains("canonical vendored dir"), "{err}");
-
-        // Gemfile-side guards.
-        let gemfile_path = root.join(GEMFILE);
-        let wired = tokio::fs::read_to_string(&gemfile_path).await.unwrap();
-
-        tokio::fs::write(&gemfile_path, format!("{wired}gem \"rack\", \"3.2.6\"\n"))
-            .await
-            .unwrap();
-        let err = reconstruct_gem_wiring(&root, &entry).await.unwrap_err();
-        assert!(err.contains("more than once"), "{err}");
-
-        tokio::fs::write(&gemfile_path, GEMFILE_TRANSITIVE)
-            .await
-            .unwrap();
-        let err = reconstruct_gem_wiring(&root, &entry).await.unwrap_err();
-        assert!(err.contains("does not declare"), "{err}");
-
-        let wired_line = format!("gem \"rack\", \"3.2.6\", path: \"{}\"", copy_rel());
-        tokio::fs::write(
-            &gemfile_path,
-            wired.replace(&wired_line, &format!("  {wired_line}")),
-        )
-        .await
-        .unwrap();
-        let err = reconstruct_gem_wiring(&root, &entry).await.unwrap_err();
-        assert!(err.contains("indented"), "{err}");
-        tokio::fs::write(&gemfile_path, &wired).await.unwrap();
-
-        // Lock-side guard: a foreign line inside our PATH section.
-        let lock_path = root.join(GEMFILE_LOCK);
-        let wired_lock = tokio::fs::read_to_string(&lock_path).await.unwrap();
-        let tampered = wired_lock.replace(
-            "      base64 (>= 0.1.0)\n\nGEM",
-            "      base64 (>= 0.1.0)\n    extra (1.0)\n\nGEM",
-        );
-        assert_ne!(tampered, wired_lock, "fixture edit must hit our section");
-        tokio::fs::write(&lock_path, &tampered).await.unwrap();
-        let err = reconstruct_gem_wiring(&root, &entry).await.unwrap_err();
-        assert!(err.contains("not the shape"), "{err}");
-        tokio::fs::write(&lock_path, &wired_lock).await.unwrap();
-
-        // Control: the untampered pair still reconstructs.
-        assert!(reconstruct_gem_wiring(&root, &entry).await.is_ok());
-    }
-
-    /// The managed-fence line must be EXACTLY the form vendor writes —
-    /// trailing options on it are not vendor's output.
-    #[tokio::test]
-    async fn reconstruction_managed_block_tampered_line_fails_closed() {
-        let (_tmp, root, installed, blobs, record) =
-            fixture(GEMFILE_TRANSITIVE, LOCK_TRANSITIVE).await;
-        let (result, entry, _w) =
-            unwrap_done(run_vendor(&root, &blobs, &installed, &record, false).await);
-        assert!(result.success, "{:?}", result.error);
-        let entry = entry.expect("wired entry");
-
-        let gemfile_path = root.join(GEMFILE);
-        let wired = tokio::fs::read_to_string(&gemfile_path).await.unwrap();
-        let needle = format!("path: \"{}\"", copy_rel());
-        let tampered = wired.replace(&needle, &format!("{needle}, require: false"));
-        assert_ne!(tampered, wired);
-        tokio::fs::write(&gemfile_path, &tampered).await.unwrap();
-
-        let err = reconstruct_gem_wiring(&root, &entry).await.unwrap_err();
-        assert!(err.contains("not the form vendor writes"), "{err}");
-    }
-
-    /// A CHECKSUMS line that names the gem but breaks the entry grammar
-    /// fails reconstruction closed.
-    #[tokio::test]
-    async fn reconstruction_unparseable_checksum_line_fails_closed() {
-        let lock = format!(
-            "GEM\n  remote: https://rubygems.org/\n  specs:\n    puma (6.4.2)\n      nio4r (~> 2.0)\n    rack (3.2.6)\n      base64 (>= 0.1.0)\n\nPLATFORMS\n  arm64-darwin-23\n  ruby\n\nDEPENDENCIES\n  puma\n  rack (= 3.2.6)\n\nCHECKSUMS\n  puma (6.4.2) sha256={}\n  rack (3.2.6) sha256={}\n\nBUNDLED WITH\n   2.5.22\n",
-            "a".repeat(64),
-            "b".repeat(64),
-        );
-        let (_tmp, root, installed, blobs, record) = fixture(GEMFILE_PINNED, &lock).await;
-        let (result, entry, _w) =
-            unwrap_done(run_vendor(&root, &blobs, &installed, &record, false).await);
-        assert!(result.success, "{:?}", result.error);
-        let entry = entry.expect("wired entry");
-
-        let lock_path = root.join(GEMFILE_LOCK);
-        let wired = tokio::fs::read_to_string(&lock_path).await.unwrap();
-        let tampered = wired.replace("\n  rack (3.2.6)\n", "\n  rack (3.2.6)x\n");
-        assert_ne!(tampered, wired, "fixture edit must hit the bare line");
-        tokio::fs::write(&lock_path, &tampered).await.unwrap();
-
-        let err = reconstruct_gem_wiring(&root, &entry).await.unwrap_err();
-        assert!(err.contains("not parseable"), "{err}");
-    }
-
     /// [`gemspec_declares_extensions`] alternate operators and the
     /// [`gemspec_attr_rhs`] line-start `==` comparison (not an assignment).
     #[test]
diff --git a/crates/socket-patch-core/src/vendor/registry_fetch.rs b/crates/socket-patch-core/src/vendor/registry_fetch.rs
index 51b0d187..ddf5de82 100644
--- a/crates/socket-patch-core/src/vendor/registry_fetch.rs
+++ b/crates/socket-patch-core/src/vendor/registry_fetch.rs
@@ -28,7 +28,7 @@ use crate::crawlers::go_crawler::encode_module_path;
 use crate::patch::apply::is_safe_relative_subpath;
 use crate::patch::path_safety::is_safe_single_segment;
 
-use super::lock_inventory::{LockIntegrity, LockfileEntry, SourceKind};
+use super::lock_inventory::{LockIntegrity, LockfileEntry};
 
 /// The default npm registry; override with `SOCKET_NPM_REGISTRY` (the
 /// enterprise-mirror / test escape hatch — `.npmrc` parsing is out of
@@ -1679,27 +1679,17 @@ async fn fetch_golang(
 async fn fetch_npm(
     entry: &LockfileEntry,
     client: &reqwest::Client,
-) -> Result<FetchedPackage, FetchError> {
-    fetch_npm_inner(entry, client, true).await
-}
-
-async fn fetch_npm_inner(
-    entry: &LockfileEntry,
-    client: &reqwest::Client,
-    verify: bool,
 ) -> Result<FetchedPackage, FetchError> {
     // A foreign berry cacheKey is decidable from the lockfile alone: refuse
     // BEFORE the download, keeping the Unverifiable no-network contract (and
     // not spending a full tarball download on an entry we could never
     // verify).
-    if verify {
-        if let LockIntegrity::BerryChecksum(expected) = &entry.integrity {
-            if !expected.starts_with("10c0/") {
-                return Err(FetchError::Unverifiable(format!(
-                    "yarn berry checksum `{expected}` uses a cacheKey other than 10c0; \
-                     the cache-zip recipe is not reproducible for it"
-                )));
-            }
+    if let LockIntegrity::BerryChecksum(expected) = &entry.integrity {
+        if !expected.starts_with("10c0/") {
+            return Err(FetchError::Unverifiable(format!(
+                "yarn berry checksum `{expected}` uses a cacheKey other than 10c0; \
+                 the cache-zip recipe is not reproducible for it"
+            )));
         }
     }
     let url = entry
@@ -1707,26 +1697,22 @@ async fn fetch_npm_inner(
         .clone()
         .unwrap_or_else(|| npm_tarball_url(&npm_registry_base(), &entry.name, &entry.version));
     let bytes = download(client, &url).await.map_err(FetchError::Failed)?;
-    if !verify {
-        // fetch_npm_unverified: the caller owns end-to-end verification.
-    } else {
-        match &entry.integrity {
-            // yarn berry locks never hash the tarball itself — the checksum is
-            // sha512 of the deterministic cache zip. Rebuild it from the fetched
-            // bytes (the same spike-pinned recipe the berry wiring uses) and
-            // compare. Only cacheKey 10c0 (yarn 4 default) is reproducible.
-            LockIntegrity::BerryChecksum(expected) => {
-                let actual = super::berry_zip::berry_cache_checksum_10c0(&bytes, &entry.name)
-                    .map_err(FetchError::Failed)?;
-                if &actual != expected {
-                    return Err(FetchError::Failed(format!(
-                        "yarn berry cache checksum mismatch: lockfile records {expected}, \
-                         the fetched tarball rebuilds to {actual}"
-                    )));
-                }
+    match &entry.integrity {
+        // yarn berry locks never hash the tarball itself — the checksum is
+        // sha512 of the deterministic cache zip. Rebuild it from the fetched
+        // bytes (the same spike-pinned recipe the berry wiring uses) and
+        // compare. Only cacheKey 10c0 (yarn 4 default) is reproducible.
+        LockIntegrity::BerryChecksum(expected) => {
+            let actual = super::berry_zip::berry_cache_checksum_10c0(&bytes, &entry.name)
+                .map_err(FetchError::Failed)?;
+            if &actual != expected {
+                return Err(FetchError::Failed(format!(
+                    "yarn berry cache checksum mismatch: lockfile records {expected}, \
+                     the fetched tarball rebuilds to {actual}"
+                )));
             }
-            other => verify_integrity(&bytes, other)?,
         }
+        other => verify_integrity(&bytes, other)?,
     }
 
     let tmp = tempfile::tempdir()
@@ -1899,32 +1885,6 @@ pub(crate) async fn download(client: &reqwest::Client, url: &str) -> Result<Vec<
     Ok(bytes)
 }
 
-/// Fetch + stage an npm package from its conventional registry URL WITHOUT
-/// content verification. The download/extract caps still apply.
-///
-/// SECURITY: callers MUST end-to-end verify whatever they derive from the
-/// staged copy against an independent trust anchor before committing it —
-/// repair's ledger reconstruction verifies the deterministically REBUILT
-/// vendored tarball against the integrity the rewired lockfile records
-/// (`artifact_matches_integrity`); a tampered pristine source then changes
-/// the rebuilt bytes and fails closed.
-pub async fn fetch_npm_unverified(
-    name: &str,
-    version: &str,
-    client: &reqwest::Client,
-) -> Result<FetchedPackage, FetchError> {
-    let entry = LockfileEntry {
-        ecosystem: "npm",
-        source_kind: SourceKind::Unspecified,
-        name: name.to_string(),
-        version: version.to_string(),
-        purl: format!("pkg:npm/{name}@{version}"),
-        resolved: None,
-        integrity: LockIntegrity::None,
-    };
-    fetch_npm_inner(&entry, client, false).await
-}
-
 /// Whole-artifact verification against a lock-recorded integrity (the same
 /// verifiers the fetch path uses, including the berry cache-zip rebuild).
 /// `name` feeds the berry cache-zip recipe; ignored otherwise.
@@ -2317,6 +2277,7 @@ fn walk_tar_gz(
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::vendor::lock_inventory::SourceKind;
     use wiremock::matchers::{method, path as url_path};
     use wiremock::{Mock, MockServer, ResponseTemplate};
 
diff --git a/docs/design/v5-plan.md b/docs/design/v5-plan.md
index 5d131f99..0fd781e1 100644
--- a/docs/design/v5-plan.md
+++ b/docs/design/v5-plan.md
@@ -103,6 +103,59 @@ patch-UI review.
   `../depscan` (grep for `socket-patch`, `vendor-source`, `npm_pack`,
   `hosted-bundle`, napi usage) before deleting anything; if used, keep it as
   a library path.
+- **Depscan check (done 2026-09-27 against SocketDev/depscan master 784013d6;
+  re-verified from a fresh clone by the WS5 routine — no spawn/exec of
+  the CLI, no Cargo/napi dependency on socket-patch crates):**
+  depscan does **not** use the CLI's local rebuild/pack path.
+  - Server-side prebuilt packages (what patch.socket.dev and the CLI's
+    `--vendor-source service|auto` download) are built by depscan's own
+    TypeScript **patch-package-converter** (`workspaces/patches/src/repack/`:
+    per-ecosystem repackers, upstream downloaders, `berry-cache-zip.ts` — a
+    TS port of `berry_zip.rs`, not a call into it). It re-downloads the
+    upstream archive, verifies `before_sha` + the registry digest, applies
+    the patched bytes and repacks. No spawn/exec of `socket-patch`, no napi.
+  - The `socket-patch` binary appears in depscan only as: the
+    `submodules/socket-patch` build for the autotester image and dev tools
+    (`tools/validate-patch.ts`, `tools/patch-mode-smoke.ts`) — both drive
+    `apply`/`scan`; `pnpm dlx @socketsecurity/socket-patch apply` postinstall
+    snippets; the `@socketsecurity/socket-patch/schema` manifest-schema
+    re-export; and the api-v0 e2e suites (`89`–`94_socket-patch-vendor-*`,
+    `82_…telemetry-coverage` runs `repair` on an empty manifest) that drive
+    the real CLI against the live API. `hosted-bundle`, `vendor-source`,
+    `npm_pack` and `socket-patch-node` have no production references.
+  - Consequence: `npm_pack.rs`, `pypi_wheel.rs`, `berry_zip.rs`,
+    `registry_fetch.rs`, `prestage.rs` are **CLI-internal**. They stay for
+    now anyway: they are the CLI's own `--vendor-source build` / `auto`
+    fallback (offline and service-outage vendoring) and `prestage.rs` +
+    `registry_fetch::artifact_matches_integrity` also serve the service
+    path. Dropping the local build is a separate product decision (it
+    would make vendoring service-only), not part of WS5.
+  - Side note for WS1: `workspaces/app/src/autopatch-pr/github-patch-pr-hosted.ts`
+    still writes `.socket/vendor/redirect-state.json` into hosted PRs so a
+    post-install `socket-patch vex` can attest them; WS1's "never write the
+    ledger" needs a depscan follow-up (or vex keeps reading it).
+- **Done in WS5:** `commands/vendored_backend.rs` owns `VendoredBackend {
+  apply, revert, repair }`. `vendor`, `scan --mode vendored` (JSON and
+  interactive arms) and `get --mode vendored` all go through `apply`
+  (in-memory staging → `vendor_records_reusing` → per-package ledger
+  persist); `vendor --revert`, `rollback`'s vendored leg and both of
+  `remove`'s paths go through `revert`; `repair` goes through `repair`,
+  which health-checks ledger entries and re-vendors broken ones through the
+  same `apply` engine (patch.socket.dev prebuilt first under the default
+  `--vendor-source auto`, local build as the fallback). Lockfile references
+  with no ledger entry are reported (`vendor_ledger_missing`, an
+  artifact-level event with `uuid` + `details.{ecosystem,path}`), never
+  re-synthesized. Cut with it: the gem Gemfile wiring reconstruction and
+  empty-wiring backfill, the unverified npm "rebuild to the wired
+  integrity" rung (`registry_fetch::fetch_npm_unverified`), soft
+  fingerprint-less restores, and `details.ledgerRestored`.
+- **Behavior notes (WS5):** repair now inherits `vendor`'s pristine-source
+  ladder and messages, so (a) a drifted installed copy of a release-variant
+  ecosystem (gem/pypi) fails the installed-variant probe and is reported as
+  `vendor_artifact_unrepairable` ("no installed package found on disk")
+  instead of being force-overwritten; (b) the old ledger-recovery detail
+  strings are replaced by the engine's. The carried-inventory refresh
+  (`vendor_inventory_refreshed`) and fingerprint post-verify are kept.
 
 ### WS6 — Unified ledgers/context  *(branch `v5/project-context`)*
 - After WS1 only two stores remain (manifest for agent mode, vendor
diff --git a/docs/testing/vlt-coverage.json b/docs/testing/vlt-coverage.json
index 27daf119..3321a66e 100644
--- a/docs/testing/vlt-coverage.json
+++ b/docs/testing/vlt-coverage.json
@@ -272,7 +272,7 @@
     ],
     "vendored/repair": [
       "vlt_repair_rebuilds_a_deleted_dir",
-      "vlt_repair_reconstructs_the_ledger_from_the_lock",
+      "vlt_repair_reports_a_missing_ledger",
       "vlt_pinned_matrix_vendored_repair_rebuilds"
     ],
     "vendored/remove": [

From c7aa5a5b9d5f5680cc91256ddcb3fa1950682aca Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Mon, 28 Sep 2026 18:35:43 +0200
Subject: [PATCH 15/32] v5 fix: unblock the e2e tier on the v5 base (#288)

* Cancel only superseded PR runs in CI

A CI or compatibility run is now cancelled only when a newer push to
the same pull request replaces it. Push, dispatch and scheduled runs
always finish, so a manually dispatched run on the v5 base branch (its
only CI verdict, since push CI runs on main alone) is no longer killed
by a later dispatch or by the non-main cancel rule, and main keeps
finishing its rust-cache saves.

CI now groups PR runs by PR number, like the compatibility workflows
already do.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AfGnDQMy2FvpExneXmR1qp

* Expect native path separators in scan headers

scan_hosted_paths_run_once_per_project_directory compared the
per-directory `== apps/a ==` header against a literal forward-slash
path, but scan prints the directory glob matched, which Windows
spells `apps\a`. The Windows test leg failed on this since 62f07c7,
and because every e2e job waits on `test`, the whole e2e tier was
skipped on v5 PRs. Build the expected header from path components.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AfGnDQMy2FvpExneXmR1qp

* Run the vlt agent get test in agent mode

get defaults to hosted mode since 5e5f5ed, so the real-vlt
get_and_remove leg ran a hosted get and found the installed copy
unpatched (Absent, expected Patched). Pass --mode agent, as the other
agent-mode fixtures already do. Same change as cc5f1b6 on #285; it
blocked the e2e tier's e2e_vlt jobs now that they run.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AfGnDQMy2FvpExneXmR1qp

* Run the pnpm safety e2e gets in agent mode

get defaults to hosted mode since 5e5f5ed, so the three pnpm safety
tests ran a hosted redirect and found proj_a's installed copy
unpatched and no pnpm-layout note. They test the in-place apply
path, so pass --mode agent. These e2e-tier tests had not run since
that change because a red base test skipped the tier.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AfGnDQMy2FvpExneXmR1qp

* Let the NuGet hosted e2e run without .socket/

v5 hosted mode writes no `.socket/` directory (the lock pins are the
whole hosted state), so the hosted leg's fresh_checkout panicked with
NotFound copying a tree that no longer exists. Copy it only when the
run left one; the vendored leg still carries its ledger through.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AfGnDQMy2FvpExneXmR1qp

---------

Co-authored-by: Claude <noreply@anthropic.com>
---
 .github/workflows/bun-compatibility.yml               |  6 +++---
 .github/workflows/ci.yml                              | 11 ++++++-----
 .github/workflows/go-compatibility.yml                |  2 +-
 .github/workflows/pdm-compatibility.yml               |  2 +-
 .github/workflows/poetry-compatibility.yml            |  2 +-
 .github/workflows/vlt-compatibility.yml               |  6 +++---
 .../tests/covgap_commands_scan_mod.rs                 |  5 +++--
 .../socket-patch-cli/tests/e2e_nuget_dotnet_build.rs  |  5 ++++-
 8 files changed, 22 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/bun-compatibility.yml b/.github/workflows/bun-compatibility.yml
index 41ac781b..3f6b325f 100644
--- a/.github/workflows/bun-compatibility.yml
+++ b/.github/workflows/bun-compatibility.yml
@@ -95,11 +95,11 @@ on:
 permissions:
   contents: read
 
-# Supersede stale PR runs. The `main` guard is load-bearing: main runs are the
-# ONLY rust-cache writers (save-if), so they must never be cancelled mid-save.
+# Supersede stale PR runs only: main runs are the ONLY rust-cache writers
+# (save-if), so push, dispatch and schedule runs are never cancelled mid-save.
 concurrency:
   group: bun-patch-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
   CARGO_PROFILE_DEV_DEBUG: '0'
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index eb2d4722..bba0540d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,12 +17,13 @@ on:
 permissions:
   contents: read
 
-# Supersede stale runs on force-push / rapid PR updates. The `main` guard is
-# load-bearing: main runs are the ONLY rust-cache writers (save-if), so they
-# must never be cancelled mid-save.
+# A newer push to the same PR supersedes its older run; nothing else is
+# cancelled. Push, dispatch and schedule runs always finish: main runs are
+# the ONLY rust-cache writers (save-if) and must not die mid-save, and a
+# dispatched base-branch run is the base's only CI verdict.
 concurrency:
-  group: ci-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   clippy:
diff --git a/.github/workflows/go-compatibility.yml b/.github/workflows/go-compatibility.yml
index 18149fad..3f0e6b9b 100644
--- a/.github/workflows/go-compatibility.yml
+++ b/.github/workflows/go-compatibility.yml
@@ -30,7 +30,7 @@ permissions:
 
 concurrency:
   group: go-compat-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
   SOCKET_NO_CONFIG: '1'
diff --git a/.github/workflows/pdm-compatibility.yml b/.github/workflows/pdm-compatibility.yml
index ef4401b6..b417cb72 100644
--- a/.github/workflows/pdm-compatibility.yml
+++ b/.github/workflows/pdm-compatibility.yml
@@ -48,7 +48,7 @@ permissions:
 
 concurrency:
   group: pdm-compat-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
   SOCKET_NO_CONFIG: '1'
diff --git a/.github/workflows/poetry-compatibility.yml b/.github/workflows/poetry-compatibility.yml
index 49367717..c4b07934 100644
--- a/.github/workflows/poetry-compatibility.yml
+++ b/.github/workflows/poetry-compatibility.yml
@@ -40,7 +40,7 @@ permissions:
 
 concurrency:
   group: poetry-compat-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
   SOCKET_NO_CONFIG: '1'
diff --git a/.github/workflows/vlt-compatibility.yml b/.github/workflows/vlt-compatibility.yml
index 65839664..284164b7 100644
--- a/.github/workflows/vlt-compatibility.yml
+++ b/.github/workflows/vlt-compatibility.yml
@@ -117,11 +117,11 @@ on:
 permissions:
   contents: read
 
-# Supersede stale PR runs; main runs are the only rust-cache writers, so they
-# are never cancelled mid-save.
+# Supersede stale PR runs only: main runs are the only rust-cache writers, so
+# push, dispatch and schedule runs are never cancelled mid-save.
 concurrency:
   group: vlt-compat-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 env:
   CARGO_PROFILE_DEV_DEBUG: '0'
diff --git a/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs b/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs
index 72219731..c5e57a55 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs
@@ -1484,8 +1484,9 @@ async fn scan_hosted_paths_run_once_per_project_directory() {
 
     let (code, stdout, stderr) = run_scan_human(tmp.path(), &mock.uri(), &["apps/*"]);
     assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
-    for app in ["apps/a", "apps/b"] {
-        let header = format!("== {} ==", std::path::Path::new(app).display());
+    // glob rebuilds matches with the native separator (`apps\a` on Windows).
+    for app in ["a", "b"] {
+        let header = format!("== {} ==", Path::new("apps").join(app).display());
         assert!(stdout.contains(&header), "missing {header:?}: {stdout}");
     }
     assert_eq!(stdout.matches("Redirected 0 packages").count(), 2, "{stdout}");
diff --git a/crates/socket-patch-cli/tests/e2e_nuget_dotnet_build.rs b/crates/socket-patch-cli/tests/e2e_nuget_dotnet_build.rs
index 9b4ccd72..6cd2272e 100644
--- a/crates/socket-patch-cli/tests/e2e_nuget_dotnet_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_nuget_dotnet_build.rs
@@ -306,7 +306,10 @@ fn fresh_checkout(from: &Path, to: &Path) {
     for f in ["app.csproj", "nuget.config", "packages.lock.json"] {
         std::fs::copy(from.join(f), to.join(f)).unwrap_or_else(|e| panic!("copy {f}: {e}"));
     }
-    copy_tree(&from.join(".socket"), &to.join(".socket"));
+    // v5 hosted mode writes no `.socket/`: the lock pins are its whole state.
+    if from.join(".socket").is_dir() {
+        copy_tree(&from.join(".socket"), &to.join(".socket"));
+    }
     strip_manifest(to);
     let blobs = to.join(".socket/blobs");
     if blobs.exists() {

From c02ccf8ef80e12385b2a81a48e12b53ea84ab048 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Mon, 28 Sep 2026 18:35:56 +0200
Subject: [PATCH 16/32] Add the NuGet vendoring design (docs only) (#285)

* Drop unused fields from the rollback covgap fixture

`cargo clippy --all-targets -- -D warnings` failed on the dead
before_hash/after_hash fields of PatchedFixture.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R11RZRvYFL3fzmEnkFAU4A

* Add an opt-in NuGet fallback vendoring layout

Setting SOCKET_PATCH_NUGET_LAYOUT=fallback vendors a patched NuGet
package under a Socket-only version V' (the upstream version plus a 4th
part derived from the patch uuid). The package is committed already
extracted, as a NuGet fallback package folder under
.socket/vendor/nuget/<uuid>/. It is wired through a generated
socket-patch.targets file (imported via CustomAfterDirectoryBuildTargets
from a Directory.Build.props block) and byte-exact packages.lock.json
splices.

Because nothing else can produce V', the patched bytes never enter or
collide with the shared global packages folder, and nuget.config and
source mapping are left alone. Restore-time and build-time guards fail
closed on a tampered, incomplete or missing seed, or an unpatched
resolution (SOCKETPATCH001/002/005/007).

Supported shapes: SDK-style solutions with per-project lock files under
--locked-mode, and Central Package Management with or without transitive
pinning. Other shapes are refused with explicit codes.

The default layout is unchanged. A repo is opted in only by the env var
or an existing nuget-fallback ledger entry.

Tests:
- unit tests;
- lock goldens captured from real dotnet;
- an ignored real-SDK e2e (sln_locked, cpm_locked, cpm_pinning,
  sln_patch_update).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R11RZRvYFL3fzmEnkFAU4A

* Add the NuGet vendoring design

docs/design/nuget-vendoring.md covers:
- the verified NuGet facts behind the design;
- the four candidate designs and the judge scores;
- the decision (unique-version fallback seed);
- the mechanism, supported shapes, failure modes, signing policy and
  migration;
- the server/CLI split, the test plan and the adversarial review
  dispositions;
- where the prototype overrides the design.

The raw research and review notes are committed alongside in
nuget-vendoring-research/.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R11RZRvYFL3fzmEnkFAU4A

* Run the vlt agent get test in agent mode

get now defaults to hosted mode (5e5f5ed), so the real-vlt
get_and_remove leg ran a hosted get and found the installed copy
unpatched. It now passes --mode agent, like the other agent-mode
fixtures that commit updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R11RZRvYFL3fzmEnkFAU4A

* Gate the rollback fixture's blob hashes to macOS

d9a3f53 removed PatchedFixture's before_hash/after_hash as dead code,
but a macOS-only test reads them, which broke the macOS build. Restore
the fields under #[cfg(target_os = "macos")], so they exist where they
are read and clippy stays clean elsewhere.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R11RZRvYFL3fzmEnkFAU4A

* Move the NuGet fallback prototype to a follow-up branch

Vendored NuGet is future work for v5, so the opt-in fallback layout
prototype (9 new modules, routing hooks and a real-dotnet e2e) moves
to v5/nuget-vendoring-prototype, unmerged. This branch keeps the
design doc, its research notes and the two test fixes. The doc now
points at the prototype branch.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R11RZRvYFL3fzmEnkFAU4A

---------

Co-authored-by: Claude <noreply@anthropic.com>
---
 .../adversarial-env.md                        | 162 ++++
 .../adversarial-integrity.md                  | 192 ++++
 .../adversarial-lifecycle.md                  | 305 ++++++
 .../adversarial-shapes.md                     | 161 +++
 .../nuget-vendoring-research/code-map.md      | 228 +++++
 .../design/nuget-vendoring-research/critic.md |  84 ++
 .../nuget-vendoring-research/depscan.md       | 204 ++++
 .../nuget-vendoring-research/lock-cache.md    |  81 ++
 .../design/nuget-vendoring-research/shapes.md | 155 +++
 .../nuget-vendoring-research/signing.md       | 102 ++
 .../nuget-vendoring-research/sources.md       | 134 +++
 docs/design/nuget-vendoring.md                | 914 ++++++++++++++++++
 12 files changed, 2722 insertions(+)
 create mode 100644 docs/design/nuget-vendoring-research/adversarial-env.md
 create mode 100644 docs/design/nuget-vendoring-research/adversarial-integrity.md
 create mode 100644 docs/design/nuget-vendoring-research/adversarial-lifecycle.md
 create mode 100644 docs/design/nuget-vendoring-research/adversarial-shapes.md
 create mode 100644 docs/design/nuget-vendoring-research/code-map.md
 create mode 100644 docs/design/nuget-vendoring-research/critic.md
 create mode 100644 docs/design/nuget-vendoring-research/depscan.md
 create mode 100644 docs/design/nuget-vendoring-research/lock-cache.md
 create mode 100644 docs/design/nuget-vendoring-research/shapes.md
 create mode 100644 docs/design/nuget-vendoring-research/signing.md
 create mode 100644 docs/design/nuget-vendoring-research/sources.md
 create mode 100644 docs/design/nuget-vendoring.md

diff --git a/docs/design/nuget-vendoring-research/adversarial-env.md b/docs/design/nuget-vendoring-research/adversarial-env.md
new file mode 100644
index 00000000..20b9e347
--- /dev/null
+++ b/docs/design/nuget-vendoring-research/adversarial-env.md
@@ -0,0 +1,162 @@
+# Adversarial review: NuGet vendoring v2 (unique-version fallback seed) on real environments and CI
+
+I found one blocker and seven majors. The blocker is that git line-ending normalization breaks the committed seed. On a fresh CI clone the build fails with SOCKETPATCH002, while it still passes on the author's machine. The design's core behaviour survived the attacks I ran: the redirects, SOCKETPATCH005, the Docker-style bypass and symlinked checkouts all behaved as designed.
+
+**How I tested.** SDK 8.0.131 with HOME, NUGET_PACKAGES, NUGET_HTTP_CACHE_PATH, TMPDIR and DOTNET_CLI_HOME isolated under `scratchpad/adv-env/`, one dotnet process at a time. I built a Lib/App sln fixture with locks. `adv-env/r1/.socket/vendor/nuget/socket-patch.targets` is the §6.3 targets file rendered almost exactly (seed-presence check, direct redirect and the full guard). I added only two `Message` lines for diagnostics. The seed is the design-D 13.0.1 seed under a uuid root. Clones of the fixture are in `adv-env/c1`, `c2` and `c3`. Git experiments are in `adv-env/git1`.
+
+Labels: **VERIFIED** means I ran it here. **REASONED** means I did not run it.
+
+---
+
+## BLOCKER
+
+### B1. Git EOL normalization changes seed bytes, so every fresh clone fails SOCKETPATCH002 (VERIFIED)
+- **Scenario.**
+  - The repo has `* text=auto` in `.gitattributes`. That is the Visual Studio template default and is common in .NET repos.
+  - Newtonsoft's nuspec, `LICENSE.md` and `lib/*/Newtonsoft.Json.xml` are CRLF. I checked: 38/38, 20/20 and 11305/11305 lines are CRLF.
+  - Git stores them as LF in the index. The author's working tree stays CRLF and `git status` is clean, so every local build passes.
+- **Wrong outcome.**
+  - On a fresh CI clone the files check out as LF. The inventory check then fails:
+    - `error SOCKETPATCH002: seed modified: …/13.0.1.1843260417/LICENSE.md`
+  - VERIFIED in `adv-env/c1`, built after `git clone`.
+  - The same class of failure also occurs with:
+    - `core.autocrlf=true` (the Git for Windows installer default): LF text files become CRLF on checkout. VERIFIED: a committed LF `x.json` came back `\r\n` in the autocrlf clone.
+    - `core.autocrlf=input` on the author's machine.
+    - `*.xml text eol=crlf` rules.
+    - A root LFS rule such as `*.dll filter=lfs`. With `actions/checkout`'s default `lfs: false`, CI gets pointer files and fails SOCKETPATCH002. That failure is loud, but it is a surprise.
+- **Fix.**
+  - The CLI writes `.socket/vendor/nuget/.gitattributes` **before** the user's first `git add`:
+    ```
+    /*-*-*-*-*/** -text -filter -diff -merge
+    socket-patch.targets text eol=lf
+    .gitignore text eol=lf
+    ```
+  - VERIFIED: `git check-attr` shows text, filter and eol all unset under a hostile root file (`* text=auto`, `*.dll filter=lfs`, `*.xml text eol=crlf`). An autocrlf=true clone then passes the hash check, and `dotnet build` succeeds (`adv-env/c2`).
+  - Blobs committed before the attribute existed stay normalized. I had to `git rm --cached` and re-add them.
+  - So `vendor --check` must compare the inventory against the committed blobs (`git cat-file` of `HEAD:<path>`), not the working tree. It should also check `git ls-files --eol` and refuse or fix with `vendor_nuget_eol_normalized`. Otherwise the author's green local run hides the CI failure.
+  - Add a golden-image e2e leg: commit, then `git clone`, then build. Run it with both `text=auto` and `autocrlf=true`.
+
+---
+
+## MAJOR
+
+### M1. The same V′ in the GPF (same bytes) fails SOCKETPATCH003 and prints destructive advice (VERIFIED)
+- **Scenario.** A shared machine or self-hosted runner with a shared `~/.nuget/packages`, where one repo uses the feed tier (§10) or, later, hosted V′ (§11.2) for the same patch. Those tiers extract `<idl>/<V′>/` into the GPF, and the GPF beats fallback folders at asset resolution.
+- **Wrong outcome.**
+  - The fallback-tier repo resolves the GPF copy and fails:
+    - `error SOCKETPATCH003: foreign …/gpf/newtonsoft.json/13.0.1.1843260417/lib/netstandard2.0/Newtonsoft.Json.dll`
+  - This happens even with byte-identical files. VERIFIED in `adv-env/c2`: I copied the seed into the GPF, `restore --locked-mode` succeeded, and the build failed.
+  - The error text says "Delete that package folder". Doing that breaks the other repo, which re-extracts the package, and the two repos keep undoing each other.
+  - This contradicts the design's own rule that one V′ is always one byte sequence (§6.1).
+- **Fix.**
+  - Key `SocketPatchNuGetHashes` by `<idl>/<V′>/<relpath>`, not by `<uuid>/…`. Hash the consumed files wherever they resolved.
+  - Accept files from a foreign root when all of them match the inventory. Fail SOCKETPATCH003 only when they differ. This is also the feed-tier guard, so the two tiers share one code path.
+  - Alternatively, add a tier bit to V′ so fallback V′ never appears in any feed. That costs a bit of the 29-bit uuid space.
+
+### M2. The guard runs in design-time builds, contrary to §9 and G9 (VERIFIED)
+- **Scenario.** VS, Rider or C# Dev Kit run a design-time build (`ResolveAssemblyReferencesDesignTime`, `DesignTimeBuild=true`).
+- **Wrong outcome.**
+  - `ResolvePackageAssets` runs, so the `AfterTargets` guard runs too. VERIFIED: `SPGUARD-RAN DesignTimeBuild='true'`.
+  - Any SOCKETPATCH001/002/003/005 condition, such as a stale restore right after `git pull`, fails the design-time build. IntelliSense then shows "project load" errors and references go unresolved on every edit.
+  - §9 states "The guard runs only in real builds", which is incorrect.
+- **Fix.** Add `and '$(DesignTimeBuild)' != 'true'` to the guard condition. Optionally, emit SOCKETPATCH005/003 as warnings when `$(BuildingInsideVisualStudio)` is true and keep the errors for the command line. Fix the §9 text.
+
+### M3. Windows paths are about 80 characters deeper than the GPF (REASONED, lengths computed)
+- **Scenario.** The seed sits at `.socket\vendor\nuget\<36-char uuid>\<idlower>\<V′ with a 10-digit part>\…`.
+  - Under the GitHub Actions workspace, `D:\a\my-service-repo\my-service-repo\` plus the Microsoft.Extensions.DependencyInjection.Abstractions `lib/netstandard2.1/*.xml` gives **242** characters.
+  - The repo-relative part is only 205, so the §9 warning ("seed path > 240") never fires.
+  - `runtimes/<rid>/native/…` and satellite paths are deeper still.
+- **Wrong outcome.**
+  - Git for Windows (`core.longpaths` is false by default) fails checkout with "Filename too long".
+  - MSBuild.exe on .NET Framework and some tools hit MAX_PATH. The same package works fine from `%USERPROFILE%\.nuget\packages`.
+- **Fix.**
+  - Use a uuid8 directory name (with collision refusal).
+  - Compute the warning on an **absolute** path under a pessimistic prefix: 60 characters for CI, or the real root.
+  - Refuse above 250 unless `--allow-long-paths`.
+  - Document `git config core.longpaths true`.
+  - Add the Windows leg to the prototype acceptance criteria, not only to promotion.
+
+### M4. EOL-sensitive byte comparisons in the hot path, `--check` and revert break on Windows and on mixed teams (REASONED; the conversion is VERIFIED in B1)
+- **Scenario.** `fallback_in_sync` and `--check` require the targets file and `.gitignore` to be byte-equal to a fresh render. Lock and import records compare the live text with the recorded `new` or `original`.
+  - With autocrlf=true, a Windows checkout turns LF-committed files into CRLF (VERIFIED for `.json`).
+- **Wrong outcome.**
+  - `vendor --check` fails on every Windows CI job.
+  - The hot path re-renders on every run.
+  - Lock and import revert on Windows treats every record as drift. It keeps the seed, and the revert is not clean.
+- **Fix.**
+  - Pin `eol=lf` on the generated files via B1's `.gitattributes`.
+  - For user-tree files (locks, `Directory.Build.targets`), compare after normalizing CRLF to LF. Splice using the live file's detected EOL.
+  - Store records as EOL-neutral text plus the observed EOL.
+
+### M5. Mixed packages.config and SDK repos are left undefined (REASONED)
+- **Scenario.** An enterprise solution has old packages.config web apps and new SDK libraries that use the same id@V. This is very common.
+- **Wrong outcome.**
+  - §5 and §7.1 route packages.config to legacy and allow one tier per repo. `vendor_nuget_layout_mixed` refuses a same-id legacy entry.
+  - So either the whole patch is refused, or the legacy path runs. The legacy path brings back the nuget.config catch-all mapping and same-version GPF poisoning for the whole machine, which is exactly what v2 set out to remove.
+  - The design never says which of the two happens.
+- **Fix.**
+  - Define a single entry with two wiring sets: the legacy feed for packages.config projects only, and the fallback tier for SDK projects.
+  - Alternatively, refuse explicitly with `vendor_nuget_mixed_project_styles` and describe the options.
+  - Either way, add a docker leg that uses nuget.exe under mono (for example the `mono` image), since no packages.config coverage exists today.
+
+### M6. `vendor --check` and the hot path depend on restore outputs (REASONED)
+- **Scenario.** A typical CI job runs `git clean -fdx` (or starts from a fresh checkout), then `socket-patch vendor --check`, then `dotnet restore`.
+- **Wrong outcome.**
+  - Lockless projects have no `obj/project.assets.json`.
+  - `plan_closure` then refuses with `vendor_nuget_unrestored`, or reports `closure_changed`, so the pre-restore check fails for no real reason.
+- **Fix.**
+  - Persist the closure in state and make `--check` validate against it.
+  - Recompute the closure only when assets are present.
+  - Add a fallback that plans from `dotnet msbuild -getItem:PackageReference` without a restore.
+
+### M7. Renovate and Dependabot rewrite or misread the generated targets file (REASONED)
+- **Renovate.** Renovate's nuget manager matches `\.(props|targets)$` and parses `PackageReference Update=… Version=`. It can propose `[13.0.1.N]` → `[13.0.3]` in `socket-patch.targets`.
+  - Renovate's default `ignorePaths` (`**/vendor/**`, dot-matching) probably covers `.socket/vendor/nuget/`.
+  - But any repo that sets `ignorePaths` replaces that default and is then exposed.
+- **Dependabot.** Dependabot's native (MSBuild-evaluating) updater sees the evaluated version V′ and may try to edit the file where it is declared, or skip the dependency.
+- **Wrong outcome.**
+  - The redirect silently pins some other version.
+  - `SocketPatchNuGetUpstream` only knows 13.0.1, so SOCKETPATCH005 does not fire.
+  - The patch drops out, and only the lock diff and a later `--check` show it.
+- **Fix.**
+  - Put the versions in properties (`Version="$(_SpV_3f9a01bc)"`) so regex tools see no literal.
+  - Add a render-hash self-check: a `SocketPatchTargetsHash` property that the CLI verifies, plus a SOCKETPATCH006 build warning when the file was edited.
+  - Have `vendor` print or emit `ignorePaths: [".socket/**"]` for Renovate.
+  - Add a Q3 experiment with the Dependabot nuget updater container.
+
+---
+
+## MINOR
+
+| # | Scenario | Outcome | Fix |
+|---|---|---|---|
+| m1 | Sparse checkout in cone mode on monorepos: root files are included, root directories are not. | `.socket/` is absent and every build fails MSB4019. VERIFIED (`adv-env/c3`). Loud, but a friction failure mode for every sparse user. | Emit a comment above the Import that names `git sparse-checkout add .socket/vendor/nuget`. `vendor` prints it. Document it for Scalar users. |
+| m2 | Declared literal `[13.0.1]` or `13.0.1.0` in a new project. | The redirect does not engage and SOCKETPATCH005 fires. VERIFIED for both. The failure is loud, but CLI planning treats it as "literal known". | Emit one redirect condition per observed normalized-equal literal (`13.0.1`, `13.0.1.0`, `[13.0.1]`, `[13.0.1, )`). |
+| m3 | Docker `COPY *.csproj` → `restore` without DBT or `.socket` → `COPY . .` → `build --no-restore`. | SOCKETPATCH005, so fail-closed as designed. VERIFIED. Every Dockerfile needs `COPY Directory.Build.targets .socket/vendor/nuget`, and the layer cache is invalidated per patch. | Document it. `vendor` scans for `Dockerfile*` with `dotnet restore` and warns `vendor_nuget_dockerfile_copy`. |
+| m4 | `git clean -fdx` after `vendor` but before commit. | The untracked seed and targets are deleted. The tracked DBT edit stays, giving MSB4019. | Print "commit `.socket/vendor/nuget`" in the outcome. `--check` detects untracked seeds. |
+| m5 | Seeds for big packages (native runtimes, analyzers, satellites). | GitHub hard-limits files to 100 MB and warns at 50 MB. The whole package goes into history once per uuid, and org pre-receive hooks may demand LFS. | Cap file and seed size with `vendor_nuget_seed_too_large`. Record a per-repo LFS opt-in only with `checkout lfs:true` documented. Future G-experiment: prune the seed to the closure's TFMs and RIDs (contentHash comes only from `.nupkg.metadata`). |
+| m6 | Seed entries that differ only by case, on macOS or Windows. | Checkout collision and SOCKETPATCH002. | Refuse at vendor time on a case-folded inventory collision. |
+| m7 | Seed missing, VS restore (no SOCKETPATCH001 there), lockless, and a source that serves V′. V′ is predictable from the committed uuid. | An attacker's `build/*.targets` imports at evaluation, before any guard. This needs control of the id on a source (private or virtual feeds, unreserved ids). | The server-side collision check must cover the org's configured upstreams, not just nuget.org. Refuse the fallback tier for ids that are not prefix-reserved on multi-upstream feeds, or make redirects depend on `Exists(seed)` combined with a hard evaluation error. |
+| m8 | GitHub dependency graph, Trivy and CycloneDX read `packages.lock.json`. | They see `12.0.1.N`, so alerts persist and Dependabot security PRs bump the version and drop the patch. Tools that fetch nuspec metadata from nuget.org for V′ fail. | depscan SBOM mapping (already a GA blocker). Document the alert behaviour. Consider emitting Dependabot `ignore` entries. |
+| m9 | actions/setup-dotnet `cache: true` keys on the hash of the lock files. | One cache miss per vendor or revert. Also, `NUGET_PACKAGES=${{github.workspace}}/.nuget/packages` puts the GPF inside the repo, and `discover_projects` does not skip `.nuget/` (template packages contain `*.csproj`). | Skip every dot-directory and any directory that is a configured package folder during discovery. |
+| m10 | Concurrent restores or builds. | No writes to seed roots, so this is safe (REASONED). The pack hook writes `obj/socket-patch-pack/`, per project. | None needed. Add one parallel `-m` sln leg to the docker suite. |
+
+---
+
+## Attacks that failed (the design holds)
+- **Symlinked checkout path.** The resolved paths and `SocketPatchNuGetDir` stay consistent, so the guard passes. VERIFIED.
+- **Guard cost.** 52 ms per project for the full 8.7 MB Newtonsoft seed, with `GetFileHash` at 10 ms. Stamp-free hashing is affordable. VERIFIED.
+- **Guard targets as written.** They parse and work on SDK 8: the unquoted `StartsWith($(...))`, the `Substring` key and the `%(SpKey)` batching. That is partial G1 evidence, one root only. VERIFIED.
+- **Direct redirect, auto-follow and locked-mode restore from the fallback root with a warm upstream 13.0.1 in the GPF.** VERIFIED.
+- **Accepted from earlier research, not re-run here:** `NUGET_PACKAGES`, `--packages`, `RestorePackagesPath`, `locals all --clear` and offline for the patched package (VERIFIED-D and VERIFIED-C).
+
+## Required design changes, in priority order
+1. Write the nested `.gitattributes` from B1, and have `--check` compare against committed blobs.
+2. Make the hash guard location-independent, as in M1.
+3. Skip the guard in design-time builds.
+4. Use a uuid8 directory and compute the MAX_PATH check on absolute paths.
+5. Compare EOL-neutrally in the hot path, `--check` and revert.
+6. Define the mixed packages.config policy.
+7. Make `--check` work before any restore.
+8. Stop exposing literal versions in the targets file, and add a render-hash check.
+9. Add real-clone e2e legs (`text=auto`, `autocrlf=true`, sparse, Windows) to the **prototype** acceptance criteria.
\ No newline at end of file
diff --git a/docs/design/nuget-vendoring-research/adversarial-integrity.md b/docs/design/nuget-vendoring-research/adversarial-integrity.md
new file mode 100644
index 00000000..24678743
--- /dev/null
+++ b/docs/design/nuget-vendoring-research/adversarial-integrity.md
@@ -0,0 +1,192 @@
+# Adversarial integrity review: NuGet vendoring v2 (unique-version fallback seed)
+
+**Verdict: not ready.** The design's integrity story has one gap that decides everything else. Nothing pins the set of files in the committed seed, and every check (lock `contentHash`, the `SOCKETPATCH002` tables, `.nupkg.metadata`, `state.json` `fileInventory`) points back at other files in the same repo. I proved these gaps with dotnet runs:
+- a tampered seed, or one with files added, passes `--locked-mode`;
+- files added to the seed run as MSBuild code before the guard runs, and can switch the guard off;
+- an environment variable switches the guard off;
+- a nested `Directory.Build.targets` added later silently builds upstream;
+- git's `* text=auto` rewrites seed bytes, so `SOCKETPATCH002` fails on every clean clone.
+
+Most fixes are cheap.
+
+**Setup.** .NET SDK 8.0.131. HOME, NUGET_PACKAGES, NUGET_HTTP_CACHE_PATH, TMPDIR and DOTNET_CLI_HOME were isolated under `<scratch>/adv-integrity/` (`env.sh`). The package feed was an offline local folder holding upstream Newtonsoft.Json 13.0.1. The seed was the design-D e1 seed `13.0.1.1843260417`, placed at `.socket/vendor/nuget/u1/`. The fixture repo is `adv-integrity/base`. It uses the design's §6.3 guard logic (redirect, `SOCKETPATCH005`/`003`/`002`, and the `SocketPatchSeedFile` hash check) almost unchanged. The other experiments ran in `x0` to `x5`.
+
+Labels: **VERIFIED** means I ran it here. **REASONED** means it follows from verified facts or from the code but I did not run it. **DOCS** means it comes from documentation only.
+
+---
+
+## Blockers
+
+### B1. The seed's file set is not pinned. Added files are consumed, run before the guard, and can turn it off. The lock pins nothing.
+- **Scenario.** A PR, a bad merge, or a compromised dependency bot changes a seed dll. It also adds `build/netstandard2.0/Newtonsoft.Json.props` and `.targets`, which are not in the nuspec, not in `fileInventory`, and not in `SocketPatchSeedFile`.
+- **Result (VERIFIED, `x1`).**
+  - On a fresh clone, `dotnet restore --locked-mode` succeeds with the tampered dll. The lock `contentHash` is compared only with `.nupkg.metadata`, and that file sits in the seed and was not changed.
+  - NuGet enumerates the seed directory, so the added `build/` files go into `project.assets.json` and are imported: the props through `nuget.g.props`, the targets through `nuget.g.targets`.
+  - The props set `SocketPatchNuGetGuard=false`. `dotnet build` then prints `EVIL: injected seed build/ code executed` and `Build succeeded`. No `SOCKETPATCH002` is raised, even though the dll was changed.
+- **What this means.**
+  - In the fallback tier the lock gives version identity only, not integrity. The claim in §2.5/§4 that the patched package is integrity-pinned is overstated.
+  - The design's inventory check hashes only the files it lists, never "these files and no others". It also runs only when `_SpLocal != ''`.
+  - A single added file in a large, binary-heavy seed diff is easy for a reviewer to miss.
+- **Severity: blocker.**
+- **Fixes (all needed):**
+  1. **Set-equality check at restore time.** Add a target at `BeforeTargets="_GenerateRestoreGraph;CollectPackageReferences"` that globs `$(SocketPatchNuGetDir)<uuid>/**` (including dotfiles) and fails if the glob differs from the inventory or any hash differs. Restore runs in its own evaluation before `nuget.g.*` is regenerated, so on a clean CI checkout the check runs before the planted code is imported. Run it unconditionally, not gated on `_SpLocal`.
+  2. **The CLI checks set equality too.** `fallback_in_sync`, `verify.rs` and `vendor --check` should walk the directory, reject any extra file, symlink or non-regular file, and compare against `fileInventory`.
+  3. **Anchor the seed outside the repo.** Add `vendor --check --online`, which rebuilds the expected tree from an independent source and diffs the committed seed against it byte for byte. The source is either the SRI-checked service `nupkg-socket-version`, or the upstream nupkg (with its signature or depscan `upstreamSha512` checked) plus the patch afterHashes. Recommend it as the CI gate. Without it, every pin is self-referential (see M6).
+  4. **Harden the guard property.** Covered in M1.
+
+### B2. Git line-ending normalisation changes seed bytes, so SOCKETPATCH002 fails on clean clones.
+- **Scenario.** The repo has `* text=auto` in `.gitattributes`, as the common VisualStudio template does, or a developer uses `core.autocrlf=true`, the Git for Windows default.
+- **Result (VERIFIED, `x5`, `x4`).**
+  - With `* text=auto`, `git add` normalises CRLF to LF in `newtonsoft.json.nuspec`, `LICENSE.md` and `lib/*/Newtonsoft.Json.xml`. The clone's hashes differ from the originals (for example the nuspec goes from `a1d0fb81…` to `2fd73470…`). The dll is unchanged.
+  - With `autocrlf=true`, LF-only text members such as `socket-patched.txt` are rewritten on checkout.
+- **Wrong outcome.**
+  - The developer who vendored still has the original bytes and passes. Every other clone and CI fails `SOCKETPATCH002` on the `SocketPatchSeedFile` rows.
+  - The hot path always sees drift, so `vendor` rewrites the seed every run.
+  - Legacy mode never hit this, because a `.nupkg` is binary to git.
+- **Severity: blocker** (correctness and CI friction; it makes the integrity guard useless in practice).
+- **Fix.**
+  - Generate `.socket/vendor/nuget/.gitattributes` containing `* -text -diff -merge -filter`. This also turns off LFS.
+  - After writing, run `git check-attr text eol filter -- <seed files>`. Refuse with `vendor_artifact_git_transformed` if any file is still text or filtered.
+  - Add a case to the Docker test: a repo with `* text=auto`, then clone and build.
+  - If `*.dll filter=lfs` survives (the negation does not win), LFS pointer files in the checkout give a loud `SOCKETPATCH002` rather than a silent failure, but refuse at vendor time anyway.
+
+---
+
+## Major
+
+### M1. The guard can be turned off by an environment variable, package props, or a Directory.Build.rsp.
+- **VERIFIED (`x3`):**
+  - `SocketPatchNuGetGuard=false dotnet build` with a tampered seed dll ends in `Build succeeded`. MSBuild reads environment variables as properties. One stray variable in a CI template turns off every guard in the org.
+  - B1 showed that package-level props can do the same.
+- **REASONED:** a committed `Directory.Build.rsp` containing `-p:SocketPatchNuGetGuard=false`, or `SocketPatchNuGetAllowUnpatched=true` in the environment, does the same thing and is easy to miss in review.
+- **Fix (VERIFIED, `x1` second run).**
+  - Assign `<SocketPatchNuGetGuard>true</SocketPatchNuGetGuard>` unconditionally in `socket-patch.targets`. The `-pp` output shows `Directory.Build.targets` imported after the package `build/*.targets` (line 9218 vs 9173). A project or package cannot override that assignment, and neither can an environment variable. Only a global `-p:` can. With this change, the props attack was stopped and `SOCKETPATCH002` fired.
+  - Because our file is imported last, our `SocketPatchNuGetGuard` target definition also wins over a package that redefines the target (VERIFIED). A `BeforeTargets` hook in the planted code is still arbitrary code, which is why B1's restore-time check is the real defence.
+  - Replace the free `SocketPatchNuGetAllowUnpatched` property with a project allowlist generated by the CLI from `state.json`.
+  - Make `vendor --check` flag `Directory.Build.rsp` and `MSBuild.rsp` files that mention `SocketPatch*`.
+
+### M2. A nested Directory.Build.targets added later hides the import. The project builds upstream silently and SOCKETPATCH005 never runs.
+- **VERIFIED (`x3`).**
+  - Adding `src/Directory.Build.targets`, which does not chain to the root, plus a new `src/New/New.csproj` that references 13.0.1, gives `Build succeeded`.
+  - A new lock is created with `resolved: 13.0.1` and the upstream hash. No `SOCKETPATCH*` error appears.
+- **Why the design misses it.** §4 and §9 say `SOCKETPATCH005` covers new projects. It covers them only if the import is reached. `ImportDirectoryBuildTargets=false` added later behaves the same way.
+- **Severity: major.** The build silently ships the known-vulnerable version.
+- **Fix.**
+  - `vendor --check` (the CI gate) evaluates every discovered project with `dotnet msbuild -getProperty:SocketPatchNuGetTargetsImported` (batched, or with `-graph` from the sln). It fails if any project that resolves the patched id at V is missing the import.
+  - Also, when writing a nested DBT, prefer adding the `GetPathOfFileAbove` chain line.
+  - Document that the protection holds only up to the next nested DBT.
+
+### M3. A copy of V′ in the global packages folder takes priority over the committed seed.
+The global packages folder (GPF) is NuGet's shared package cache.
+- **VERIFIED (`x2`).**
+  - When `$NUGET_PACKAGES/newtonsoft.json/13.0.1.1843260417/` holds different dll bytes and a copy of the seed's `.nupkg.metadata`, `restore --locked-mode` succeeds and resolves from the GPF.
+  - The guard then fires `SOCKETPATCH003` correctly.
+  - If that GPF copy also carries a `build/*.props` that sets `SocketPatchNuGetGuard=false`, the build ends in `Build succeeded` with the other bytes in `bin/`.
+- **Consequences.**
+  - (a) §9's "NU1403 when locked" holds only when the planted `.nupkg.metadata` hash differs. A copied directory, for example from a cache-sync tool, passes. With M1's fix, `SOCKETPATCH003` still catches it.
+  - (b) **Cross-tier false positive (REASONED from the verified priority).** Once any feed-tier repo, or the future hosted V′ (§11.2), puts builder-0 V′ into a shared CI or developer GPF, every fallback-tier repo using that uuid fails `SOCKETPATCH003` on that machine, although the bytes are identical. The GPF is never refreshed, so the failure persists until someone deletes the entry by hand.
+- **Fix.**
+  - Make the resolved-root check depend on content. Accept a foreign root when the package's whole file set hashes equal the inventory (same set-equality as B1), and fail otherwise.
+  - Also narrow the `StartsWith` prefix from `SocketPatchNuGetDir` to the exact `<uuid>` root. Today one uuid's V′ served from a different uuid directory passes (minor).
+
+### M4. Builder bit 1 does not map to a single byte sequence. In the feed tier this gives persistent NU1403 on a shared GPF.
+- **REASONED.** Builder 1 covers three different byte producers:
+  - the CLI re-versioning the same-version service nupkg;
+  - `local_rebuild` from upstream;
+  - either of those produced by a different CLI version, where zip writer details change.
+- **Consequence.** The §6.1 promise that one V′ equals one byte sequence everywhere is false for builder 1.
+  - In the feed tier on a shared runner GPF, the first writer wins. The second repo gets NU1403 on every locked restore on that runner. The research also verified that a failed locked restore still writes to the GPF, so the failure persists.
+  - Lockless projects silently use the other repo's bytes. `SOCKETPATCH002` catches this only if the table covers every consumed file.
+  - In the fallback tier the only cost is lock churn between developers.
+- **Severity: major for the feed tier, minor for the fallback tier.**
+- **Fix, any one of:**
+  - the feed tier requires builder 0 (service bytes) only;
+  - for local builds, derive N from the V′ nupkg's sha512 instead of the uuid, and record the uuid in state and in a nuspec field;
+  - freeze `reversion_nupkg` output with a cross-version golden, and forbid `local_rebuild` under builder 1 (give it a third code).
+
+### M5. Revert drift repair "from the signed-content-hash of a GPF copy" trusts a poisoned cache.
+- **REASONED from the verified facts (first writer wins; the legacy layout wrote patched same-version bytes to `<idl>/<V>/`).**
+  - After legacy use, or on any shared or poisoned GPF, §7.4 step 1 computes the "upstream" hash from patched or tampered bytes and writes it into the committed lock under upstream V.
+  - The local locked restore then passes against the poisoned cache, which blesses it. CI either gets NU1403, or, if CI shares the cache, keeps the bad bytes.
+- **Fix.**
+  - Repair only from depscan `upstreamContentHash`, or from a freshly downloaded nuget.org nupkg whose repository signature has been checked.
+  - Never repair from the GPF. If a GPF copy is used at all, require `.nupkg.metadata.source` to be nuget.org, a valid `.signature.p7s`, and `dotnet nuget verify` to pass.
+
+### M6. Provenance of the unpatched files is lost, and verify has no external anchor.
+- **REASONED.**
+  - A normal restore checks nuget.org's repository signature on every extraction.
+  - Vendoring drops the signature once (it has to; NU3008). The fallback tier then never checks anything again (VERIFIED earlier: V-D9 and signing §b).
+  - For the unpatched members of the seed, integrity therefore rests on one HTTPS download on the vendoring machine.
+  - `verify` and `--check` compare state against seed against lock against targets. All of these are repo data. Only afterHashes (patched files only) come from the server.
+- **Fix.**
+  - At vendor time, check the upstream nupkg's repository signature, or its sha512 against depscan `upstreamSha512` or the nuget.org catalog `packageHash`.
+  - Record `upstreamSha512` and afterHashes in state.
+  - `--check --online` (B1 fix 3) recomputes the full expected tree.
+  - Make depscan item #3 a GA requirement, not only a revert aid.
+
+### M7. Feed-tier trust: a repo-level, self-signed author trustedSigner applies to every package id.
+- **DOCS and VERIFIED mechanics.** The signing research verified that trustedSigners merge across config levels and that `allowUntrustedRoot` passes `require`. NuGet documentation says `<author>` trust has no `owners` or id scope.
+- **Scenario.** Whoever holds the pfx (§10) can sign any package id, with any content, and it passes the enterprise's `require` in this repo. The design also normalises repos extending enterprise trust. A contributor could equally add their own fingerprint, and it would look like routine socket-patch churn.
+- **Fix.**
+  - Generate an ephemeral key per uuid, sign, and destroy the private key before writing the fingerprint, so the trust covers exactly the bytes already signed.
+  - Better: never write trustedSigners. Print the `<author>` block for the admin to add to machine-level config, or wait for depscan's CA-issued certificate with an RFC 3161 timestamp (item #8) and trust Socket's certificate once at org level.
+  - `vendor --check` flags any repo trustedSigner not recorded in state.
+
+### M8. Name handling: percent-decoding after validation allows path traversal; MSBuild metacharacters allow injection.
+- **REASONED from the code.**
+  - `read_zip_members` (`crates/socket-patch-core/src/vendor/common.rs:336`) checks the **raw** name with `is_safe_relative_subpath`. §6.2 then percent-decodes. `%2E%2E%2Fx`, `lib%2F..%2F..%2Fx`, or `%5C` passes the raw check and decodes to traversal. Decoded names can also collide (`a%20b` and `a b`) or differ only in case.
+  - `is_plain_archive_name` allows `$ @ % ; ' ( )`. These are interpolated into `Include=`, `Condition=` and the `;path=hash;` `Contains` tables. `%XX` is unescaped by MSBuild, `;` splits items, `@(...)` and `$(Prop.Method())` are expanded. The result is a broken or forgeable inventory (a crafted name containing `=HASH;` can satisfy `Contains`) and property expansion at evaluation.
+  - `state.json` fields (id, versions, uuid, project paths) are rendered into the targets file by `regenerate_shared` straight from disk.
+- **Fix.**
+  - Decode, then re-run `is_safe_relative_subpath`, `is_plain_archive_name` and `names_are_unambiguous`, case-folded.
+  - Refuse names containing `$ @ % ; ' = ( )`. Otherwise MSBuild-escape (`%24 %40 %25 %3B %27`) and XML-escape every interpolated value.
+  - Check id against `^[A-Za-z0-9_.-]+$`, versions against the parser, uuids against strict UUID format, and project paths on every render, not only in the prelude.
+  - Zip-bomb protection is already there (`MAX_ENTRIES`, per-entry and total caps enforced against the actual decompressed size). Reuse it and keep it.
+
+### M9. Guard coverage: packages without lib or ref assets are not checked at all.
+- **REASONED.**
+  - `_SpCand` is built only from runtime, compile, native and resource items. For an analyzer-only or build-only package (source generators, SourceLink, MSBuild task packages), `_SpLocal` is empty.
+  - Then nothing is hashed, the `SocketPatchSeedFile` check is skipped (gated on `_SpLocal`), and `SOCKETPATCH003`/`005` never run.
+  - Even for lib packages, analyzers and `build/` files are not in `_SpCand`, although they run inside the compiler and MSBuild.
+- **Fix.**
+  - Decide "patched package present" from the `project.assets.json` `libraries` and `targets` keys, not from asset items.
+  - Add `@(Analyzer)` to the candidates.
+  - Run the full-inventory check (B1) unconditionally at restore.
+  - Gate G1 on an analyzer-only fixture.
+
+---
+
+## Minor
+
+- **m1. Symlinks (REASONED).**
+  - Committed symlinks inside the seed, or on its ancestors (`.socket`, `vendor`, `nuget`, `<uuid>`), pass `SOCKETPATCH003`, because that check compares path strings without resolving symlinks. A seed linked outside the repo also opens a check-then-use race between hashing and compilation.
+  - Revert's "delete the seed and prune" through a symlinked ancestor deletes outside the repo. Rust's `remove_dir_all` does not follow a symlink passed as its own argument, but it does traverse symlinked ancestors in the path.
+  - Fix: apply the existing `refuse_symlinked`/`first_symlink` to the seed and all its ancestors in apply, verify and revert, and refuse non-regular files in the inventory walk.
+- **m2. The signature policy is checked only at vendor time (REASONED).** A `require` added later to a repo, ancestor or user config is bypassed silently. The design documents only the CI-only case. Fix: `vendor --check` probes the policy again, and the restore-time target warns when it can see `signatureValidationMode` in `$(RestoreConfigFile)` or repo configs.
+- **m3. Seed nuspec edits.** An added `<dependency>` in the nuspec pulls in a new package. That is loud under locked mode (NU1004) and silent when lockless. B1's set-and-hash check at restore closes it. The current design only checks the nuspec after resolution, and only when `_SpLocal` is non-empty.
+- **m4. Wording in §9.** "V′ present elsewhere → NU1403 when locked" holds only when the planted `.nupkg.metadata` hash differs (VERIFIED `x2`). The row should say that `SOCKETPATCH003`/`002` is the actual defence.
+- **m5. Stale `obj/` (REASONED, low).** A pre-vendor `project.assets.json` followed by `build --no-restore` is caught by `SOCKETPATCH005`. After a revert, a stale assets file pointing at a deleted seed gives a loud missing-file error. Both are fine; keep them as test legs.
+- **m6. Hash tables.** They depend on `GetFileHash` giving uppercase hex and on case-sensitive `String.Contains`. This works (VERIFIED `x0`: the metadata comparison passes, and editing `.nupkg.metadata` gives `SOCKETPATCH002`). Pin it with a golden test so a lowercase render never ships.
+
+---
+
+## Verified experiment log
+
+| ID | Where | Result |
+|---|---|---|
+| x0 | `adv-integrity/x0` | Baseline passes: locked restore, `packageFolders` = GPF then the seed, guard `ok local=2`. The `SocketPatchSeedFile` hash check works: editing `.nupkg.metadata` gives `SOCKETPATCH002`. |
+| x1 | `x1` | Tampered dll plus unlisted `build/*.props`/`.targets` in the seed: locked restore passes, the planted targets run, the guard is off, `Build succeeded`. With an unconditional `SocketPatchNuGetGuard=true` in our targets: `SOCKETPATCH002` fires, and a planted redefinition of the guard target is ignored. The `-pp` output shows the DBT imported after the package `build/*.targets`. |
+| x2 | `x2` | V′ in the GPF with a copied `.nupkg.metadata` and other bytes: locked restore passes and resolves from the GPF, `SOCKETPATCH003` fires. Adding planted props that disable the guard: `Build succeeded` with the other bytes. |
+| x3 | `x3` | A new nested `src/Directory.Build.targets` that does not chain: the new project builds upstream 13.0.1, a new lock is written, no error. The environment variable `SocketPatchNuGetGuard=false` hides a tampered seed. |
+| x4/x5 | `x4`, `x5c` | `* text=auto` changes the hashes of the nuspec, LICENSE and xml members; `autocrlf=true` changes LF-only text members; the dll is unchanged. |
+
+## Priority fixes before the prototype is accepted
+1. Restore-time full-set check of the seed, plus a CLI set-equality walk (B1).
+2. Generated `.gitattributes` with `* -text -diff -merge -filter`, plus a `git check-attr` probe (B2).
+3. Unconditional guard assignment and a CLI-managed allowlist (M1).
+4. `vendor --check` evaluates every project for the import (M2) and supports `--online` rebuild verification (B1, M6).
+5. A resolved-root check that also compares content hashes (M3).
+6. Decode-then-validate names and escape MSBuild metacharacters (M8).
+7. Candidates chosen from the assets file, including analyzers (M9).
+8. Remove GPF-based drift repair (M5).
+9. For the feed tier: builder 0 only, or content-derived V′ (M4), and no pfx-holder trust written at repo level (M7).
\ No newline at end of file
diff --git a/docs/design/nuget-vendoring-research/adversarial-lifecycle.md b/docs/design/nuget-vendoring-research/adversarial-lifecycle.md
new file mode 100644
index 00000000..60883f9d
--- /dev/null
+++ b/docs/design/nuget-vendoring-research/adversarial-lifecycle.md
@@ -0,0 +1,305 @@
+# Adversarial lifecycle review: NuGet vendoring v2 (unique-version fallback seed)
+
+## Verdict
+
+The build-time mechanism holds up: V′, the fallback folder, evaluation-time redirects and the guards. The weak part is the lifecycle, which the design does not specify well enough to implement.
+
+The design adds generated files shared by every NuGet entry: `socket-patch.targets`, `.gitignore`, and one DBT import per directory. It then tracks them with per-entry records, inside a CLI that:
+- saves the ledger and sweeps old uuid dirs *after* the backend returns;
+- drops cross-uuid wiring on re-vendor;
+- keeps "preserved" entries byte-identical.
+
+Those three behaviours cause the two lifecycle blockers:
+- **Patch update:** the most common lifecycle event breaks restore for every project in the repo.
+- **Revert after an update, or reverting in the wrong order:** leaves an import to a deleted targets file. Restore then quietly rewrites locks to upstream.
+
+A third blocker is the git line-ending problem: under the common `* text=auto` rule, the committed seed does not survive a clone byte-for-byte.
+
+With the fixes below the design is still workable. §15 should grow by one structural piece: a pass that regenerates the shared NuGet outputs from the final ledger state.
+
+## Experiments run (SDK 8.0.131)
+
+All runs used an isolated `HOME`, `NUGET_PACKAGES`, `NUGET_HTTP_CACHE_PATH`, `TMPDIR` and `DOTNET_CLI_HOME`, under `<scratch>/adv-lifecycle/`. Env script: `adv-lifecycle/env.sh`. The fixture is a copy of design-D `e1/r` (Lib, App, Tool; 13.0.1 and 12.0.1 redirected to `.1843260417`).
+
+| ID | Experiment | Result |
+|---|---|---|
+| **V1** | Cold GPF, then `dotnet restore S.sln --locked-mode` on the vendored repo | **VERIFIED.** Afterwards the GPF holds only `newtonsoft.json.bson/1.0.2`. It holds **no** `newtonsoft.json` at any version, because upstream 13.0.1 and 12.0.1 are never downloaded. `packageFolders` = [gpf, `.socket/vendor/nuget/packages`]. |
+| **V2** | Add one non-existent uuid root to `RestoreAdditionalProjectFallbackFolders` | **VERIFIED.** `error NU1301: The local source '…' doesn't exist` for **every** project that imports the targets: Lib, App and Tool, including projects that do not use the patched package. |
+| **V3** | Unguarded `Import` of `socket-patch.targets` with the targets file deleted | **VERIFIED.** A plain `dotnet restore` **succeeds without error**, because NuGet's restore evaluation ignores missing imports. It **rewrites `Lib/packages.lock.json` from `13.0.1.1843260417` back to upstream `13.0.1`**. Only `dotnet build` then fails with MSB4019. A later `--locked-mode` restore passes against the rewritten upstream lock. |
+| **V4** | Commit the extracted seed in a repo with `.gitattributes` `* text=auto`, then `git clone` | **VERIFIED.** In the clone, `newtonsoft.json.nuspec`, `LICENSE.md` and `lib/*/Newtonsoft.Json.xml` have different sha256 (CRLF became LF). The vendoring machine's tree still reports clean. The dll and `.nupkg.metadata` are unchanged. The fix below is also VERIFIED under both `text=auto` and `core.autocrlf=true`: a nested `.socket/vendor/nuget/.gitattributes` containing `* -text -diff -merge -filter` gives byte-identical clones. |
+
+Everything else below is **REASONED**, from the code as cited or from the verified facts above.
+
+## Findings
+
+### B1. Patch update to a new uuid breaks every restore, pins a dead V′, and makes revert unrecoverable (BLOCKER)
+
+**Scenario.** Patch A (uuid `3f9a…`, 13.0.1 → V′a) is vendored. The manifest moves to patch B (new uuid) for the same purl, and the user runs `socket-patch vendor`.
+
+**What the code does** (`vendor.rs` `record_vendor_entry` :1020, `sweep_stale_artifact` :1073):
+1. The backend runs while A's entry is **still in the ledger**.
+2. The CLI then replaces the entry under the same key.
+3. The CLI deletes A's uuid dir.
+
+**What goes wrong:**
+- §7.1 step 5 renders the targets from "state on disk minus *this* uuid (B) plus this entry". So it renders **both** A and B:
+  - A's root stays in `RestoreAdditionalProjectFallbackFolders`;
+  - there are two `Update` redirects for the same declared 13.0.1, and the later one wins;
+  - SOCKETPATCH001 checks A's seed.
+- After `sweep_stale_artifact` deletes A's dir, every project fails with NU1301 (V2) or SOCKETPATCH001. Nothing regenerates the targets after the sweep.
+- `plan_closure` and `plan_lock_edits` look for entries that resolve to **V**. After A, every lock resolves to V′a, so B finds no closure and makes no lock edits (or refuses). The targets redirect to V′b while the locks pin V′a, which gives NU1004 in locked mode.
+- If B does edit V′a → V′b, it records `original` = the V′a text. `carry_forward_wiring` (`state.rs:418`) fills an original **only when `original` is None**. So B's revert would restore V′a, a version whose seed is gone (NU1301 or NU1102).
+- The prelude checks `vendor_nuget_duplicate_patch` and `vendor_nuget_version_collision` against A's entry for the same purl and may refuse the update outright.
+
+**Fix:**
+- The shared-output render must exclude every entry with the same ledger key or basePurl as the entry being written.
+- More robustly, regenerate `socket-patch.targets` and `.gitignore` in a CLI step that runs **after** `persist_vendor_entry`, `sweep_stale_artifact` and each revert's `save_state` (see P1).
+- The closure planner and lock planner must treat any `resolved` that `parse_socket_nuget_version` decodes to (id, V) as "ours". For those entries they should record `original: None`, so that `carry_forward_wiring` fills in the true upstream original from A (the key `<lockrel>#<tfm>#<id>` is uuid-agnostic, so the match works).
+- Duplicate and collision checks must ignore the entry being replaced.
+- Add a docker leg: vendor A, update to B, run a locked restore, revert, then `git diff --exit-code`.
+
+### B2. Import records are "reference-counted" per entry, but the ledger cannot hold them, leaving the repo unbuildable after revert (BLOCKER)
+
+**Scenario 1 (patch update, then revert).** B's apply finds the imports already present. `inject_import` returns None, so nothing is recorded. `carry_forward_wiring` performs its union **only when `prev.uuid == entry.uuid`** (`state.rs:461`), so A's `nuget_msbuild_import` records are dropped. When B is reverted:
+- no import record remains;
+- step 2 deletes the targets because no entries are left;
+- every DBT still imports a missing file.
+
+**Scenario 2 (two ids, reverted in creation order).** Entries X and Y exist, and X created the imports. `vendor --revert` walks keys in sorted order and saves after each entry (`rollback.rs:891-902`). X is not last, so its import records vanish with X's ledger entry. Y has none, so the imports stay.
+
+**Scenario 3 (crash).** The process is killed between the import write and the ledger save. The next run sees the imports as pre-existing and has no record to undo them.
+
+**Outcome.** Every `dotnet build` fails with MSB4019. Worse, by V3 every plain `dotnet restore` (Dependabot, Renovate, `dotnet list package`, IDE restore) **silently rewrites the locks to upstream**. A bot PR can then commit unpatched locks.
+
+**Fix:**
+- Stop tracking imports in per-entry records.
+- Make import removal deterministic and free of records: on the last `nuget-fallback` revert, discover every DBT (same discovery as apply) and excise exactly the line carrying `Label="socket-patch"`.
+- Delete a DBT only if its whole text equals `created_dbt(import_rel)`.
+- Optionally keep a state-level `nugetShared` object (an additive optional field on `VendorState`) with the created and edited DBT originals, for byte-exact restore.
+- **Order:** remove the imports first, and delete the targets only after every import is gone. If any excision drifts, write a no-op stub `socket-patch.targets` (just `<Project/>`) rather than deleting it.
+
+### B3. The committed seed is not byte-stable through git (BLOCKER for Windows and VS-template repos)
+
+**Scenario.** The repo has `.gitattributes` `* text=auto` (the stock Visual Studio template), `core.autocrlf=true` on Windows, or an LFS rule such as `*.dll filter=lfs`.
+
+**Outcome (V4).** Every fresh clone or CI checkout has different bytes for the nuspec, xml docs and LICENSE. Then:
+- the seed-inventory hash in the guard fails with SOCKETPATCH002 on **every build except the vendoring machine's**;
+- `fallback_in_sync` never holds, so each `socket-patch vendor` rewrites the seed, and git hides this because it normalises;
+- patched text members (content files, `build/*.targets`, `.ps1`) also fail afterHash verification;
+- with LFS, clones without LFS get pointer files.
+
+The legacy layout is immune because a `.nupkg` is binary. So this is a regression specific to the new layout.
+
+**Fix:**
+- Generate `.socket/vendor/nuget/.gitattributes` with `* -text -diff -merge -filter` (V4 verified that it fixes `text=auto` and autocrlf).
+- After writing, probe with `git check-attr text filter eol` on each seed file, and refuse with `vendor_artifact_git_transformed` if any file is still transformed.
+- Add `.gitattributes` to the reserved names (§11.4) and the hot-path render check.
+
+### M1. Preserved, kept or failed-save entries are re-wired by the next render (MAJOR)
+
+**Scenario.** One of:
+- `rollback --preserve-state` or `remove --preserve-state`: `VendorRevertStep::Preserved` keeps the entry byte-identical (`rollback.rs:860-864`);
+- drift-keep (`Kept`);
+- `LedgerWriteFailed`.
+
+After that, any later NuGet vendor or revert, or even the hot path of a *different* entry ("targets byte-equal to a fresh render"), renders from all `nuget-fallback` entries. The supposedly reverted patch comes back into the targets.
+
+**Outcome:**
+- Locked projects: NU1004, because their locks were restored to upstream.
+- Lockless projects: silently patched again.
+- If the seed was deleted: NU1301 for every project (V2).
+
+**Fix.** Render only the entries that are actually wired. Add `nuget.wired: bool`, or `unwiredAt`, to `NugetMeta`, and set it false on Preserved and Kept. Never render an entry whose seed directory is missing; emit a warning instead.
+
+### M2. Revert step order defeats drift-keep, and deletes the targets before import removal can fail (MAJOR)
+
+**Scenario.** §7.4 step 2 regenerates the targets **without** this uuid. Step 4 then keeps the seed only if "the live targets file still names the uuid". That can never be true at step 4, so drift-keep never fires. The seed is deleted while a drifted lock still pins V′. The result is NU1004 when locked, and a dangling V′ pin for any tool that reads the lock.
+
+Step 2 also deletes the targets before step 3 tries to excise the imports, which is the B2 failure mode.
+
+**Fix.** Use this order:
+1. lock records;
+2. compute keep = any drifted record whose live text still contains V′;
+3. if keep, leave the uuid in the targets, keep the seed, and return `kept_artifact`;
+4. otherwise remove imports (last entry only, per B2);
+5. regenerate or delete the targets;
+6. delete the seed.
+
+### M3. On a clean machine the package never counts as installed: repair, update and migration have no pristine source (MAJOR)
+
+**Scenario.** CI or a teammate's clone. V1 shows the GPF never holds upstream `newtonsoft.json/13.0.1` again after vendoring. With §7.5, the crawler skips the seed folders. The loop (`vendor.rs:1840-1910`) therefore sees the purl as missing, and what happens next depends on the case:
+- **Same uuid:** `ledger_covers` returns true for a directory artifact with `sha256: ""` (`state.rs:293` checks existence only), so the source becomes `Deferred`. The `vend_installed!` `debug_assert!(PackageSource::Installed)` (`vendor.rs:171`) then panics in debug and test builds. In release, `installed_dir` is a hint path. This does exist for legacy with a cold GPF, but legacy's first restore repairs it; in fallback it is permanent.
+- **New uuid (patch update), `repair` (service None, `repair_vendor.rs:1632`), or `--offline`:** there is no fetch rung, so `package_not_installed` and exit 1. A NuGet patch can then only be updated where the service is reachable, or after revert, restore and re-vendor.
+
+**Fix:**
+- Add a NuGet pristine-fetch rung: nuget.org flatcontainer, `<idl>/<v>/<idl>.<v>.nupkg`.
+- Verify it fail-closed against the upstream `contentHash` that the ledger already holds in each `nuget_lock_entry_v2` `original`. For signed packages, compute the signed-content hash (zip without `.signature.p7s`, signing §e) instead of hashing the file.
+- Treat that fragment like npm's "ledger-recovered pre-vendor registry fragment".
+- Replace the `debug_assert` for nuget-fallback entries. The fallback hot path must never read `installed_dir`.
+
+### M4. The hot path and `--check` fail on CI before restore, and the closure re-plan misreads its own output (MAJOR)
+
+**Scenario.** §7.2 requires the recomputed closure plan to match `nuget.projects`, and §7.1 refuses `vendor_nuget_unrestored` when a project has neither a lock nor an assets file.
+
+**Outcome:**
+- On a fresh clone (no `obj/`), lockless projects have neither, so `socket-patch vendor` or `--check` refuses or reports "closure changed" on every CI run.
+- Even with locks, the post-vendor lock resolves **V′**, not V. A `pin` project's entry has become `Direct`, so without V′-awareness it looks like `direct`. `auto-follow` is ambiguous in the same way. The re-plan then "re-keys" and churns the targets.
+
+**Fix:**
+- Persist the plan in state and treat it as authoritative.
+- Re-plan only from csproj and CPM text plus the locks, with decoded V′ counted as V. Missing assets for a project already in the plan is not a refusal.
+- Keep `vendor_nuget_unrestored` only for **new** projects that the plan has not seen.
+
+### M5. Older binaries (v4.0.0 is released) corrupt fallback entries; the "flavor gate in the same PR" protects only v5+ (MAJOR)
+
+**Scenario.** A teammate, or a CI action pinned to v4, runs `socket-patch vendor --revert` or `vendor` on a repo with `nuget-fallback` entries.
+
+**v4 revert** (`nuget_feed.rs:772-873`):
+- every kind is unknown, so each produces a `vendor_lock_entry_drifted` warning;
+- drift-keep probes only single-segment wiring files for the literal `.socket/vendor/nuget/<uuid>`;
+- `Directory.Build.targets` contains only the targets path, so the probe finds nothing;
+- the seed is deleted and the call reports success;
+- `revert_vendor_entry` drops the entry;
+- the targets and locks still reference the uuid, so NU1301 in every project (V2), with no ledger entry left.
+
+**v4 vendor:** `config_wired` is false (there is no `socket-patch-<uuid>` in `nuget.config`), so v4 runs a full legacy apply on top. It:
+- writes a `.nupkg` into the same uuid dir;
+- adds a source and catch-all to `nuget.config`;
+- rewrites the root lock;
+- writes a legacy entry. Because the uuid is the same, `carry_forward_wiring` merges the fallback records into it, and that entry then routes to the legacy revert.
+
+`load_state` has no version gate (`state.rs:562-590`), so bumping `VENDOR_STATE_VERSION` does not help.
+
+**Fix:**
+- In the root DBT, emit one comment per uuid: `<!-- socket-patch: .socket/vendor/nuget/<uuid> -->`. v4's drift-keep then keeps the seed and the entry, which is fail-safe. This also fixes M6's liveness probe.
+- In v5, route any entry that carries `nuget_lock_entry_v2` or `nuget_msbuild_import` records to the fallback backend, whatever its `flavor`.
+- Detect and heal a legacy `socket-patch-<uuid>` source that sits beside a fallback seed.
+- Document the minimum version.
+
+### M6. VEX silently stops attesting fallback-vendored patches (MAJOR, missing from the §15 module table)
+
+**Scenario.** `vex/discover/nuget.rs` is driven entirely by `nuget.config` (source plus mapping). The vendored liveness probe list for nuget is `CONFIG_NAMES` (`vex/discover/mod.rs:1750`). `vendored_wiring_in_files` looks for the literal `.socket/vendor/nuget/<uuid>`.
+
+The fallback entry's recorded files are the DBT (which has only the targets path) and the locks (which have only V′). The targets file uses `$(SocketPatchNuGetDir)<uuid>`, which is not the literal string. So `vendored_wiring_live` returns false and the entry reads as dead.
+
+**Outcome.** VEX output drops the patch without any error.
+
+**Fix:**
+- Add a fallback extractor: parse `socket-patch.targets` (uuid roots plus `Update`/`Include` V′) and every discovered lock (decode V′ to purl@V plus the uuid prefix).
+- Add `.socket/vendor/nuget/socket-patch.targets` and the discovered locks to the nuget probe files.
+- Spell the uuid dir literally in the targets, as a comment or in the SOCKETPATCH001 path.
+- Set `artifact_rel` to the seed directory.
+- Put all of this in prototype scope.
+
+### M7. Partial-failure unwind is unsafe for shared outputs and reused seeds (MAJOR)
+
+**Scenario:**
+- §7.1 step 4 may *reuse* an existing, already committed seed, for example on a closure re-plan. The unwind for steps 5–8 then "deletes the seed".
+- Step 5 overwrites the shared targets and `.gitignore`, which have no recorded original.
+- A lock edit fails at project k of N, for example on an unparseable lock.
+
+**Outcome.** A committed seed can be deleted while the targets still name it (NU1301 everywhere, V2). Alternatively, the new targets file is left behind with only some locks edited, which gives NU1004.
+
+**Fix:**
+- Snapshot the bytes of `socket-patch.targets`, `.gitignore` and `.gitattributes` before step 5, and restore them on unwind.
+- Delete the seed only if this run created it.
+- Stage all lock splices in memory and write them last, each by temp file and rename. Unwind must restore every written file.
+
+### M8. Migration from the legacy layout destroys its own pristine source and leaves the repo unpatched on refusal (MAJOR)
+
+**Scenario.** §11.1 runs the legacy revert (step 1) before the fallback apply (step 2).
+
+**Problems:**
+- The legacy revert deletes the committed patched `.nupkg`, which is the only local copy of the patched bytes.
+- On a legacy machine the GPF `newtonsoft.json/13.0.1/*.nupkg` is **the patched one**, extracted from our feed. `local_rebuild` would therefore apply the patch to already-patched bytes, and the before-hash gate fails.
+- Any fallback-only refusal (`exact_dependency`, `dbt_disabled`, `unrestored`, `version_literal_unknown`) that fires after step 1 leaves the repo **unpatched**.
+
+**Fix:**
+1. Run `fallback_prelude` and `plan_closure` first.
+2. Materialise V′ with `reversion_nupkg(committed_legacy_nupkg)`, builder Local, and verify the afterHashes.
+3. Only then revert the legacy wiring and write the fallback wiring, as one unit that can be unwound.
+4. The migration must fail as a whole and leave legacy intact.
+
+### M9. Restore does not fail closed when the targets file is missing (MAJOR; contradicts §6.4)
+
+§6.4 says an unguarded import means "it never degrades silently to upstream". V3 shows otherwise:
+- `dotnet restore` ignores the missing import and **rewrites the locks to upstream**;
+- only build fails.
+
+Restore-only pipelines therefore produce unpatched locks without any error: Dependabot/Renovate lock refresh, `dotnet restore` Docker layers without `.socket/`, and `dotnet list package --vulnerable`.
+
+**Fix.** Update §6.4 and §9 to describe this accurately. Recommend `socket-patch vendor --check` as a required CI step, and document that lock diffs from V′ to V in bot PRs mean the patch was dropped. In Docker, the COPY step must include `.socket/vendor/nuget/` whenever it copies `Directory.Build.targets`.
+
+### M10. Transitive pins keep themselves alive and never disengage (MAJOR)
+
+**Scenario.** Tool pins `[12.0.1.N]` because Bson 1.0.2 pulls in 12.0.1. Later Bson is removed, or bumped to a version that needs 13.x.
+
+**Outcome:**
+- **Bson removed:** the pin's condition (the project has no PackageReference for the id) still holds. Tool keeps a direct dependency on patched 12.0.1 indefinitely, and `Publish="true"` ships the dll.
+- **Bson needs ≥ 13:** NU1605 against the exact pin.
+- The in-use probe ("any lock resolves V′") is satisfied by our own pin, so gc never reclaims the entry.
+
+**Fix.** The in-use probe and `vendor --check` must ignore edges the tool created itself. A pin counts as in use only if some other package in the assets or lock `dependencies` still lists the id at a range V′ satisfies. Otherwise, report `vendor_nuget_pin_orphaned` and drop the pin on the next `vendor`.
+
+### M11. The layout choice does not persist, so repos end up with mixed layouts (MAJOR)
+
+**Scenario.**
+- `--nuget-layout` defaults to `feed`.
+- Only *existing* entries are sticky.
+- The flag is threaded only into `dispatch_vendor_one` and the preflight. It is not on `scan --mode vendored`, `get --mode vendored` or `repair`.
+
+**Outcome.** A teammate or CI adding a new NuGet patch without the flag vendors it in the legacy layout. The repo then has both a `nuget.config` catch-all and fallback targets. This is untested, and legacy GPF poisoning returns for that id.
+
+**Fix.** Infer the layout: if any `nuget-fallback` entry exists, new entries use fallback. Or persist a `nugetLayout` optional top-level field in the state. Put the flag on `GlobalArgs`.
+
+### Minor findings
+
+| # | Scenario | Outcome | Fix |
+|---|---|---|---|
+| m1 | A user edits `socket-patch.targets`, for example to add `SocketPatchNuGetAllowUnpatched` or exclude a project | The next render overwrites the edit without warning | Store the render sha in state. If the on-disk file differs from the last render, warn `vendor_nuget_targets_edited` and refuse without `--force`. Provide a supported user hook: an optional `socket-patch.user.targets` imported last, plus per-project properties. |
+| m2 | "Import into every nearest DBT" reaches git submodules, `dotnet new` template content (`PackageType=Template`), samples, or vendored third-party trees | Submodule edits cannot be committed from the superproject, so projects there resolve upstream silently. Templates ship a broken import to their consumers. | Limit to projects in the same git worktree (`git rev-parse --show-toplevel`). Skip template content. Warn `vendor_nuget_import_skipped`. |
+| m3 | A new subdirectory is added later with its own DBT that does not chain to the parent | The targets are never imported, so SOCKETPATCH005 cannot fire and the project is silently unpatched. §4's claim that 005 covers new projects is only partly true. | Say so explicitly. Have `vendor --check` list uncovered projects, and make `--check` part of the recommended CI step. |
+| m4 | Developers with and without service access (builder 0 vs 1), and Q4 | Different V′ for the same uuid. Lock and targets churn as soon as anyone runs `--force` or a re-plan. | Hot path accepts either builder for the same uuid. Never switch builders without an explicit `--nuget-rebuild-service`. |
+| m5 | Dry run | Earlier entries in the run are not persisted, so the preview render leaves them out and understates the diff | Render from the in-memory run state. |
+| m6 | Directory artifact with `sha256: ""` | `ledger_covers`, `list` and orphan labelling rely on existence only. The `path.rs` leaf parser expects a `.nupkg` leaf. | Add a `fileInventory`-based intact check for nuget-fallback artifacts, and a nested leaf parser. |
+| m7 | NU1903 on V′ | VERIFIED during V1: `NU1903 … 12.0.1.1843260417 has a known high severity vulnerability`. This is the same as before the patch, but still a false positive once patched. Under `TreatWarningsAsErrors` or `NuGetAuditLevel` it fails the build. NuGetAuditSuppress is out of prototype scope. | Bring NuGetAuditSuppress into the prototype for NuGet ≥ 6.11, or document the gap. |
+
+## P1. Can the prototype (§15) be built in the current code structure?
+
+Only with CLI changes that §15 does not list. What is missing:
+
+1. **No per-ecosystem finalize hook.** Shared outputs derived from the whole ledger need a `vendor::nuget_fallback::sync_shared(cwd, &VendorState)` call after every ledger mutation:
+   - `run_vendor` after `persist_vendor_entry` and `sweep_stale_artifact`;
+   - `run_revert`, `rollback`, `remove` (`revert_vendor_entry` after `save_state`);
+   - `run_vendor_gc`, `repair`, and scan/get vendored.
+
+   Doing this inside the backend is what causes B1 and M1.
+2. **`carry_forward_wiring` contract.**
+   - The backend must emit `original: None` for lock entries already at a Socket V′.
+   - Import wiring must move out of per-entry records (B2).
+   - A new-uuid re-vendor unions nothing.
+3. **Layout plumbing is more than two call sites.**
+   - `vendor::service_preflight` (`vendor/mod.rs:918`) is a public 6-argument function with no ledger access, so `layout_for(entry_flavor, …)` cannot be evaluated there without a signature change.
+   - `dispatch_vendor_one` has callers at `vendor.rs:2636` and `repair_vendor.rs:1632`, and is also reached through `vendor_records` from scan and get. The flag belongs on `GlobalArgs`.
+4. `vend_installed!` `debug_assert` and a NuGet fetch rung (M3).
+5. VEX discovery and liveness (M6), the in-use probe with self-edge exclusion (M10), and crawler skipping all have to be in scope. Otherwise `vex`, `gc` and `list` regress as soon as the flag is used.
+6. A v4 hybrid-entry router plus the DBT uuid comment (M5).
+
+Scale: the core modules in the §15 table look sized correctly. The CLI and VEX work above probably adds another 30–40% and touches 6–8 more files. None of it conflicts with the backend and dispatch shape.
+
+## Recommended design edits (summary)
+
+1. Add §6.7 "Shared outputs":
+   - `sync_shared` after every ledger save;
+   - render only wired entries whose seed is present;
+   - record-free import excision, removing imports before the targets;
+   - a stub targets file on drift;
+   - a generated `.gitattributes` checked with `git check-attr`.
+2. Add §7.6 "Patch update":
+   - V′-aware planner;
+   - `original: None` carry-forward;
+   - exclude the entry being replaced;
+   - a docker leg for update, revert and a clean diff.
+3. Reorder §7.4 revert as in M2. Reorder §11.1 migration as in M8.
+4. Correct §6.4 and §9 on restore behaviour when the targets file is missing (V3), and make `vendor --check` the documented CI gate.
+5. Extend §15 scope: VEX, the in-use probe, the fetch rung, the v4 hybrid router, layout inference, and the finalize hook.
\ No newline at end of file
diff --git a/docs/design/nuget-vendoring-research/adversarial-shapes.md b/docs/design/nuget-vendoring-research/adversarial-shapes.md
new file mode 100644
index 00000000..6ed57854
--- /dev/null
+++ b/docs/design/nuget-vendoring-research/adversarial-shapes.md
@@ -0,0 +1,161 @@
+# Adversarial review: NuGet vendoring v2 (unique-version fallback seed), project shapes
+
+**Environment.** .NET SDK 8.0.131 on Linux, with HOME, NUGET_PACKAGES, NUGET_HTTP_CACHE_PATH, TMPDIR and DOTNET_CLI_HOME isolated per experiment. I ran one dotnet process at a time.
+
+**Where everything is.** Experiments are under `<scratch>/adv-shapes/exp/e{1,2,3,5,7,8,9}`. The generator is `adv-shapes/gen.py`: it renders the §6.3 targets as the design wrote them (guard, SOCKETPATCH001, pack guard) using design-D's real seeds (`13.0.1.1843260417`, `12.0.1.1843260417`). Lock "after" states come from `restore --force-evaluate`, which is the ideal output the CLI's edits would have to match.
+
+**Labels.** VERIFIED means I ran it. REASONED means I did not.
+
+## What held up (VERIFIED)
+- The §6.3 guard works as written, with no MSB4096 metadata errors.
+  - SOCKETPATCH002 fires on a tampered dll that is consumed, and on a tampered seed file that is not.
+  - SOCKETPATCH005 fires.
+  - `GetFileHash` keeps the custom `Sha256` metadata.
+- SOCKETPATCH001 (`BeforeTargets=CollectPackageReferences`) fires in normal restore and in static-graph restore, with and without `--locked-mode`. That covers part of G4.
+- CPM with transitive pinning on, under a static-graph `--locked-mode` restore, passes (part of G7).
+- The pack range restore fixes both a direct CPM reference and a CentralTransitive pin: the nuspec says `13.0.1`.
+- Package ids that differ only in case are redirected (`newtonsoft.JSON`). F# (`.fsproj`) works. GlobalPackageReference and nuget.g.targets are imported before DBT, so `Update` reaches them.
+
+---
+
+## Blockers
+
+### B1. An exact `[V′]` spreads through ProjectReference and breaks projects the closure never sees (VERIFIED, e2)
+**Setup.** Lib has Newtonsoft 13.0.1 (patched). Lib12 has 12.0.1 (patched). Lib3 has 13.0.3 (unpatched).
+- AppA references Lib and Lib3. It resolved 13.0.3 before vendoring.
+- AppB references Lib and Lib12. It resolved 13.0.1.
+- AppC has a direct 13.0.3 reference and references Lib.
+
+**Results after vendoring:**
+- **AppA:** `NU1107 Version conflict: AppA -> Lib -> Newtonsoft.Json (= 13.0.1.1843260417) / AppA -> Lib3 -> (>= 13.0.3)`. This is a hard restore failure. AppA is not in the closure, because it resolves 13.0.3, not V, so the prelude never checks it.
+- **AppB:** `NU1107` between `(= 13.0.1.N)` and `(= 12.0.1.N)`. Patching two versions of one id breaks any project that reaches both. This is exactly the "multi-version of the same id" shape the design says is Supported.
+- **AppC:** `NU1608` (Lib requires `= 13.0.1.N` but 13.0.3 resolved). This breaks the build under `TreatWarningsAsErrors`.
+- **Locks outside the closure change too.** AppA's and AppC's `packages.lock.json` Project entries (`"Newtonsoft.Json": "[13.0.1, )"` → `"[13.0.1.N, 13.0.1.N]"`) change even though those projects are not in the closure. The CLI only edits locks in the closure, so AppC gets **`NU1004 ... references lib whose dependencies has changed`** in locked mode.
+
+**Fix (the range part is VERIFIED):**
+1. Redirect to `[V′, )` instead of `[V′]`. After that change:
+   - AppA resolves 13.0.3, as before.
+   - AppB resolves 13.0.1.N (lowest applicable).
+   - AppC resolves 13.0.3, with no NU1608.
+   - Lib and Lib12 resolve V′.
+   - No NU1107.
+2. Close the drift that `[V′, )` opens with a new guard, SOCKETPATCH006. Put a marker item (`<SocketPatchRedirect Include="newtonsoft.json/13.0.1.N"/>`) inside the same conditioned ItemGroup as the redirect. The guard fails if a project where the redirect engaged resolved the id at anything other than V′. Do not make NU1603 a repo-wide error: that would break existing builds that already have approximate matches on other packages.
+3. The planner must edit the `Project`-entry range in **every** lock whose graph includes a redirected project, not only locks in the closure. Record each edit for revert.
+4. Update the range-restore replace string to the `[V′, )` form.
+
+### B2. With chained nested DBT files, the once-guard imports the targets too early (VERIFIED, e7)
+**Setup.** A common pattern: `src/Directory.Build.targets` imports the root DBT on its first line through `GetPathOfFileAbove`, then declares `<PackageReference Include="Newtonsoft.Json" Version="13.0.1"/>`.
+
+**Why it breaks.** The root DBT's import runs first and sets `SocketPatchNuGetTargetsImported`. The import the design injects as the last child of `src/Directory.Build.targets` is then skipped. The redirect ItemGroup is therefore evaluated before the PackageReference exists.
+
+**Results:**
+- Restore resolves **upstream 13.0.1**.
+- The build fails with SOCKETPATCH005, so it is loud. In locked mode it fails NU1004 against the edited lock.
+- When the project was planned as `pin`, the misfire is worse. The pin condition `@(PackageReference…)==''` is true at that point, so the pin is added next to the later Include. The result is `NU1504 Duplicate 'PackageReference'`, and the version that wins is arbitrary.
+
+**Fix (VERIFIED on SDK 8).** Stop injecting into DBT files. Put one line in the root, or nearest, `Directory.Build.props`:
+```xml
+<CustomAfterDirectoryBuildTargets>$(CustomAfterDirectoryBuildTargets);$(MSBuildThisFileDirectory).socket/vendor/nuget/socket-patch.targets</CustomAfterDirectoryBuildTargets>
+```
+- `Microsoft.Common.targets:55` imports that property after the whole DBT chain, so ordering no longer matters. With this line the redirect applied and the build passed.
+- It is also imported without the `ImportDirectoryBuildTargets` condition, so `vendor_nuget_dbt_disabled` becomes unnecessary.
+- This needs a gating experiment on SDK 6 and 7 (MSBuild 17.0 to 17.7) to confirm the property exists there.
+
+### B3. Windows `core.autocrlf=true`, the Git for Windows default, breaks every build (VERIFIED by simulation, e1/clone)
+**Cause.** An extracted seed contains text files: `.nuspec`, `lib/**/*.xml`, `LICENSE.md`, `.nupkg.metadata`, and content, build and props files. With `autocrlf=true`, git rewrites them to CRLF on checkout.
+
+**Result.** Every affected project fails with `SOCKETPATCH002 vendored NuGet seed file modified`. Today's layout commits a binary `.nupkg` and is immune, so this is a regression specific to the new layout.
+
+**Fix (VERIFIED: the clone builds).** Generate `.socket/vendor/nuget/.gitattributes` containing `* -text -diff -merge`, and treat it as a reserved name. Also decide how to handle a root `.gitattributes` that puts `*.dll` under git LFS: a clone without LFS gets pointer files and fails SOCKETPATCH002. Either add `-filter` or refuse with `vendor_artifact_lfs`.
+
+---
+
+## Major
+
+### M1. A multi-target transitive pin is not conditioned on TFM (VERIFIED, e3)
+**Setup.** ToolA targets `net8.0;netstandard2.0`. Bson is referenced only for netstandard2.0.
+
+**Result.** The §6.3 pin has no `$(TargetFramework)` condition. It adds `Newtonsoft.Json [12.0.1.N]` as a new **Direct** dependency to `net8.0`, which previously had `{}`.
+- The CLI plans edits only for the TFMs where the id resolves, so locked mode fails NU1004.
+- Lockless builds start shipping a new dll for net8.0.
+- If the other TFM resolved a higher version, this becomes an NU1605 downgrade.
+
+**Fix.**
+- Add `and '$(TargetFramework)' == '<alias>'` to each pin condition.
+- Map aliases to lock keys. The lock uses `.NETStandard,Version=v2.0`, not `netstandard2.0` (VERIFIED), so this needs a real alias-to-framework mapping. Refuse custom aliases.
+
+### M2. A consumer outside the `.socket` root breaks, and the B1 fix would make it silent (VERIFIED, e8)
+**Setup.** A project outside the root (a sibling repo, or a monorepo where `.socket` lives in a subdirectory) references the patched Lib through ProjectReference.
+
+**Results:**
+- With `[V′]`: `NU1102 Unable to find Newtonsoft.Json (= 13.0.1.N)`. The consumer does not import the targets, so it has no fallback folder.
+- With `[V′, )`: `NU1603` and a silent resolve of **13.0.2**.
+
+**Fix.**
+- The planner walks ProjectReferences in both directions. It refuses (`vendor_nuget_external_consumer`) when a project outside the root references a redirected project, or when a redirected project is listed in a `.sln` or `.slnf` above the root.
+- Document that `.socket` must sit at the root of the solution.
+
+### M3. SOCKETPATCH004 fires after the leaking `.nupkg` is already written (VERIFIED, e5)
+**Result.** With range restore disabled, `dotnet pack -o out3` fails SOCKETPATCH004, but `out3/Lib.1.0.0.nupkg` already exists and has `<dependency id="Newtonsoft.Json" version="[13.0.1.1843260417]"/>`. PackTask writes the nuspec and the nupkg in the same step. A later `nuget push out/*.nupkg`, or a retry, publishes a package that consumers cannot restore. The "fail-closed" claim is false.
+
+**Fix.**
+- Add a pre-check `BeforeTargets="GenerateNuspec"` against the rewritten pack assets.
+- On a post-check failure, delete `@(NuGetPackOutput)` before raising the error.
+
+### M4. The pack guard fails with MSB4184 when `obj` holds more than one nuspec (VERIFIED, e5)
+**Result.** Pack once, then again with `-p:Version=1.0.1`. `$(NuspecOutputAbsolutePath)*.nuspec` matches both `Lib.1.0.0.nuspec` and `Lib.1.0.1.nuspec`, and `ReadAllText("a;b")` fails the pack. Local and CI version bumps hit this routinely.
+
+**Fix.** Read exactly `$(NuspecOutputAbsolutePath)$(PackageId).$(PackageVersion).nuspec`, or filter `@(NuGetPackOutput)` by extension.
+
+### M5. The guard does not run for non-SDK csproj files that use PackageReference (REASONED; no mono here)
+**Cause.** Legacy WPF and WinForms csproj files with PackageReference import DBT, so the redirect applies. They do not have `ResolvePackageAssets` or `RuntimeCopyLocalItems`, so SOCKETPATCH002, 003 and 005 silently never run.
+
+**Fix.** Detect a project with no `Sdk` that uses PackageReference, and refuse it or route it to legacy. Alternatively, hook `ResolveNuGetPackageAssets` and `@(ReferenceCopyLocalPaths)` and gate that on the Windows leg (G8).
+
+### M6. NuGetAudit still flags V′ (VERIFIED, e1)
+**Result.** `warning NU1903: Package 'Newtonsoft.Json' 12.0.1.1843260417 has a known high severity vulnerability`. §2.3's "no false NU1903" holds only when the advisory's fixed version is V's own next patch. Here the fix is in 13.0.1, so `12.0.1.N` still falls inside `< 13.0.1`.
+- Repos that treat NU1903 as an error stay broken after patching.
+- NuGetAuditSuppress is out of the prototype's scope and needs NuGet 6.11 or later (SDK 8.0.4xx). The 8.0.1xx SDK here cannot use it.
+
+**Fix.** State the limitation in the design. Ship NuGetAuditSuppress with the prototype. On older SDKs, emit an informational `vendor_nuget_audit_still_flags`.
+
+### M7. The closure planner misses whole project types and version spellings (VERIFIED and REASONED)
+- **VERIFIED (e9):** `Version="13.0.1.0"` means the same to NuGet as 13.0.1, but the literal redirect does not match it. The result is SOCKETPATCH005, and NU1004 if the CLI edited the lock. Render one condition per recorded literal spelling, or refuse the non-canonical spelling.
+- **REASONED:** the enumerator looks only at `*.csproj|fsproj|vbproj`. It misses NoTargets and Traversal `.proj` files (from `global.json` `msbuild-sdks`), `.sqlproj`, `.esproj`, and others. They import DBT, so they get redirected with no lock edits. Enumerate `*.*proj` plus the projects listed in the sln.
+- **REASONED:** property-expanded versions (Arcade `eng/Versions.props`) and `NuGetLockFilePath=$(MSBuildProjectDirectory)/…` depend on `dotnet msbuild -getItem`/`-getProperty`, which need MSBuild 17.8, i.e. SDK 8. Repos whose `global.json` pins SDK 6 or 7 get refused. Also, a `global.json` SDK that is not installed on the vendoring machine breaks every `dotnet msbuild` call.
+
+---
+
+## Minor
+
+1. **The lock golden table is wrong for CPM with pinning on (VERIFIED, e5).** With the uniform `PackageVersion Update`, the entry stays `CentralTransitive` and only `requested` becomes `[V′, V′]`. It does not turn into Direct.
+2. **Pin conversion reorders lock entries (VERIFIED, e3).** NuGet writes Direct entries first. Plain and locked restores do not rewrite a lock whose order differs, but `--force-evaluate`, Dependabot relocks, and the `--nuget-relock` text-diff check all see churn. Compare semantically, and write the canonical order.
+3. **One tampered seed file fails every project (VERIFIED, e1).** The whole-inventory `SocketPatchSeedFile` hash made Tool, which only uses the 12.0.1 seed, fail for a tampered 13.0.1 seed. The cost also scales with the total seed size times the number of projects; think of native-heavy packages such as SkiaSharp. Filter on `PackageKey` for the packages this project resolved.
+4. **An exact-bracket declared literal `[13.0.1]` is widened by pack range restore to `[13.0.1, )` (REASONED).** Render the replacement from the recorded literal.
+5. **F# FSharp.Core and other implicit, SDK-versioned references drift across SDK versions (REASONED; props file checked).** Their version comes from the SDK that `global.json` resolves (`Microsoft.FSharp.NetSdk.props:95`). Refuse ids with `IsImplicitlyDefined`.
+6. **The `vendor_nuget_tool_manifest` refusal is aimed at the wrong thing (REASONED).** `dotnet-tools.json` lists tool packages, and their dependencies are bundled inside those packages. MSBuild never resolves them. Say that tools cannot be patched, and keep the crawler from reporting that they are covered.
+7. **RID lock sections list only packages with RID-specific assets (VERIFIED, e3/Rid).** Newtonsoft is absent from `net8.0/linux-x64`. RID edits matter only for packages that ship `runtimes/`. Add goldens for such a package, for example SqlClient.
+8. **Windows MAX_PATH.** A 36-character uuid directory plus a long id plus a 4-part V′ is about 225 characters under `C:\agent\_work\1\s`. Use a short uuid8 directory.
+9. **Analyzer-only packages are invisible to the guard (G1 still open).**
+
+---
+
+## How the verdict changes
+
+The D base is sound for GPF safety, source mapping, and CPM with static-graph restore. It is **not** ready for its own "Supported" rows:
+- multiple versions of one id;
+- a patched library consumed next to a higher-versioned sibling;
+- nested DBT chaining;
+- multi-TFM transitive-only projects;
+- Windows checkouts.
+
+**Minimum changes before prototype acceptance:**
+1. `[V′, )` redirect plus SOCKETPATCH006.
+2. Project-range edits in every lock that consumes a redirected project.
+3. Injection through `CustomAfterDirectoryBuildTargets`.
+4. TFM-conditioned pins.
+5. The seed `.gitattributes`.
+6. Pack guard pre-check, deletion of the bad nupkg, and an exact nuspec path.
+7. The external-consumer refusal.
+
+Add e2, e3, e7 and the autocrlf clone as docker and e2e legs.
\ No newline at end of file
diff --git a/docs/design/nuget-vendoring-research/code-map.md b/docs/design/nuget-vendoring-research/code-map.md
new file mode 100644
index 00000000..c96fd65c
--- /dev/null
+++ b/docs/design/nuget-vendoring-research/code-map.md
@@ -0,0 +1,228 @@
+# socket-patch NuGet implementation map (branch v5/nuget-vendoring, read-only)
+
+All paths are relative to `/home/user/socket-patch/crates/`. Where a line number carries a `~` it points to the right block but is not exact.
+
+## 1. Backend interface a new vendored layout must implement
+
+**There is no trait.** Backends are free functions with one shared signature. The CLI calls them through `match` arms.
+
+**Vendor entry** (the same 9 arguments for every backend), `socket-patch-core/src/vendor/nuget_feed.rs:399`:
+```rust
+pub async fn vendor_nuget(purl: &str, installed_dir: &Path, project_root: &Path,
+    record: &PatchRecord, sources: &PatchSources<'_>, vendored_at: &str,
+    dry_run: bool, force: bool, service: Option<&VendorServiceConfig>) -> VendorOutcome
+```
+
+**Revert entry**, `nuget_feed.rs:762` and `:772`:
+```rust
+pub async fn revert_nuget(entry: &VendorEntry, project_root: &Path, dry_run: bool) -> RevertOutcome
+pub async fn revert_nuget_opts(entry: &VendorEntry, project_root: &Path, opts: RevertOpts) -> RevertOutcome
+```
+
+**Service preflight**, `nuget_feed.rs:372`:
+```rust
+pub(crate) async fn service_preflight(purl, project_root, record) -> Option<PlannedDownload>
+```
+- It must run the same refusal checks as `vendor_nuget`, so the download plan never asks the service for a package the loop will refuse. Today it shares `nuget_prelude` (`:243`) for this.
+- It is routed from `vendor/mod.rs:918` (the nuget arm is at `:932`).
+
+**Dispatch points** in `socket-patch-cli/src/commands/vendor.rs`:
+- `dispatch_vendor_one` (`:112`) uses the `vend_installed!` macro (`:168-190`). That macro asserts `PackageSource::Installed`, because NuGet and Maven have no registry-fetch rung. The nuget arm is at `:215`.
+- `SERVICE_ECOSYSTEMS` includes nuget (`:135`).
+- `dispatch_revert_one_opts` (`:237`), nuget arm at `:245`.
+- `dispatch_in_use_one` (`:256`) returns `None` for nuget, so there is no in-use probe.
+
+**Types**
+- `vendor/mod.rs`:
+  - `VendorWarning` `:142`
+  - `VendorServiceConfig` `:268`
+  - `VendorOutcome::{Refused{code,detail}, Done{result: ApplyResult, entry: Option<VendorEntry>, warnings}}` `:785`
+  - `RevertOpts{dry_run, keep_artifact}` `:801`
+  - `RevertOutcome{success, warnings, error, kept_artifact}` `:824`
+  - `force_apply_staged` `:732`, which applies the patch into a private stage and is hash-gated.
+- `vendor/state.rs`:
+  - `VendorArtifact{path, sha256, size, platform_locked, file_inventory}` `:52`
+  - `WiringAction{Rewritten, Added}` `:83`
+  - `WiringRecord{file, kind, action, key, original, new}` `:97`
+  - `VendorEntry` `:212`
+  - `VendorState` `:324`
+  - `VENDOR_STATE_REL = ".socket/vendor/state.json"` `:43`
+  - `VENDOR_MARKER_FILE = "socket-patch.vendor.json"` `:764`
+  - `VendorEntry::committed_artifact_intact` (a sha256 check of file artifacts), right after `:212`.
+
+**Shared helpers to hook into**
+- `vendor/common.rs`: `refused`, `done`, `already_patched_result`, `prepare_memory_repack`/`MemoryRepack`, `rebuild_zip`, `write_zip_entries`, `zip_bytes_match_after_hashes`, `any_live_file_references` (`:993`), `prune_empty_vendor_levels`.
+- `vendor/path.rs`:
+  - `vendor_uuid_dir_rel("nuget", uuid)`
+  - leaf parser for `nuget` at `:280-286`, with `split_nuget_leaf` at `:207`
+  - ecosystem list at `:44`
+- `vendor/ledger_snapshots.rs:56-62`: `WHOLE_FILE_KINDS` includes `"nuget_config_source"`. Whole-file values of 1024 bytes or more (`SNAPSHOT_MIN_BYTES`) are stored as diff ops, and those ledgers are written as version 2.
+- `vendor/verify.rs:93-102, 488-498, 711`: `.nupkg` is treated as a single committed zip file, and its members are checked against the afterHashes.
+- `vendor/reuse.rs:1-12`: the reuse path is for npm/pypi only. NuGet decides "in sync" from the committed artifact itself.
+- `vendor/service_fetch.rs:155-240`: `service_archive_copy` returns `ServiceCopy::{Used, HardFail, FallBack}` (the Tier-A path).
+- `socket-patch-cli/src/commands/repair_vendor.rs:105-129`: `WIRING_FILES` **does not include `nuget.config`** (see §7).
+
+## 2. Current on-disk layout, edits, state record and revert
+
+**Artifact**
+- Path: `.socket/vendor/nuget/<uuid>/<idLower>.<versionNorm>.nupkg` (`nupkg_leaf` `:172`, `normalize_nuget_version` `:125`). The normalizer mirrors the TS `normalizeNuGetVersion` and the two must stay in sync.
+- Marker `socket-patch.vendor.json` is written beside it (`:664`).
+- The uuid dir is the local folder feed itself (module doc `:8-18`).
+
+**Source key:** `socket-patch-<uuid>` (prelude, around `:280`).
+
+**nuget.config** (`build_config_edit` `:1161`)
+- Config lookup is root-only. `existing_config_path` (`:1145`) probes `nuget.config`, then `NuGet.Config`. It does not probe `NuGet.config`, although `nuget_config.rs:228` `CONFIG_NAMES` lists all three.
+- **No config:** writes a fresh file (`:1171-1195`) containing the nuget.org source plus ours, and a mapping of `nuget.org → *` plus `socket → <exact id>`. It is written to `project_root/nuget.config` (`:599`).
+- **Existing config** (`:1196-1285`):
+  - Anchors are found on a comment-blanked view (`blank_comments` `:1292`).
+  - Our `<add>` is inserted before `</packageSources>`. A self-closing `<packageSources/>` is expanded (`:1390`), and if the section is missing it is created before `</configuration>`.
+  - If `</packageSourceMapping>` exists, only our `<packageSource>` block is appended.
+  - Otherwise a new mapping is created that fans `*` out to every pre-existing source key (`parse_config_source_keys` `:1330`). nuget.org is seeded if there are none.
+  - It errors if there is no `</configuration>`.
+
+**packages.lock.json** (`edit_lock` `:1545`)
+- Only the root `project_root/packages.lock.json` is considered (`:93`).
+- Every `dependencies.<tfm>.<id>` entry (case-insensitive) whose `resolved` normalizes to the version (`locked_at` `:208`) gets `contentHash` replaced with `base64(sha512(nupkg))` (`content_hash` `:1116`).
+- This is a string replace of the quoted old hash, so formatting is preserved.
+- Entries that disagree on the hash cause a failure. An entry with no match gives the `vendor_nuget_lock_entry_absent` warning (`~:633`). A missing lock gives `vendor_nuget_no_lockfile` (`:653`).
+
+**Edit order:** artifact → config → lock. A failure in the lock step unwinds the config and deletes the uuid dir (`unwind_config` `:1641`, called around `:619` and `:646`).
+
+**state.json entry** (`nuget_entry` `:713`)
+- Fields: `ecosystem:"nuget"`, `basePurl`, `uuid`, `artifact{path, sha256 (plain hex of the nupkg), size}`. All the extras (`lock`, `flavor`, `uv`, …) are `None`.
+- The CLI adds `detached`/`record`.
+- Wiring records, in application order (`:678-705`):
+  1. `nuget_config_source`: `file` = the config basename; `Added` if we created the file, otherwise `Rewritten`; `key` = the source key; `original` = the whole pre-vendor file text (or none); `new` = the whole post-edit file text. This is the authoritative revert record.
+  2. `nuget_config_mapping`: `Added`, `key` = the id, `new` = the mapping fragment. Audit only.
+  3. `nuget_lock_entry`: `Rewritten`, `key` = the id, `original` = the old contentHash, `new` = the new one.
+- Example: `socket-patch-cli/tests/fixtures/legacy-ledgers/nuget/wired/.socket/vendor/state.json`.
+
+**Hot path** (prelude, around `:318-345`; `vendor_nuget` `:437-535`)
+- `config_wired` is a plain substring test: does the config text contain the source key?
+- `in_sync` also requires the committed nupkg's members to match the afterHashes, and the lock to be pinned (or to have no matching entry).
+- Wired and in sync: returns `AlreadyPatched` with no entry.
+- Wired but stale: rebuilds only the artifact and re-pins the lock (with `original: None`; the CLI's `carry_forward_wiring` fills it in), and warns `vendor_artifact_rebuilt`. The config is never touched on this path.
+
+**Revert** (`revert_nuget_opts` `:772`)
+- The uuid is validated first.
+- Records are walked in reverse:
+  - Lock (`revert_lock_record` `:1606`): replaces our hash with the original. If ours is gone but the original is present, it counts as done. Otherwise it is drift.
+  - Mapping record: no-op.
+  - Config (`revert_config_record` `:1419`):
+    - The file name must be a safe single segment.
+    - If the live file is byte-identical to `new`: restore `original`, or delete the file if we created it.
+    - Otherwise: excise only our verbatim `<add …/>` line and our `<packageSource key=…>` block (`excise_source_mapping` `:1507`).
+    - If neither is present: drift (`Ok(false)`).
+    - The catch-all mapping is left in place.
+- **Drift-keep** (`:844-860`): if any record drifted and a live wiring file still contains the uuid dir path, the artifact is kept (`kept_artifact`) so the exclusive mapping is not left pointing at a missing dir.
+- Otherwise `remove_tree_and_prune` runs (`:871`). `keep_artifact` supports `--preserve-state`.
+
+## 3. Supported and refused project shapes
+
+**Explicit refusals** (prelude `:250-310`)
+- Not a NuGet purl, non-canonical uuid, or id/version outside `[A-Za-z0-9._+-]` → `unsafe_coordinates`.
+- Unreadable config → `vendor_nuget_config_unreadable`.
+- Unreadable lock → `vendor_nuget_lock_unreadable`.
+- No cached `.nupkg` → `vendor_nupkg_not_found` (`:962`).
+- A config without `</configuration>` → a failed result (not a refusal).
+
+**Everything else is accepted without detection:**
+
+| Shape | Handling today |
+|---|---|
+| **No lockfile** | Accepted with a warning. There is no content pin (`:653`; `docs/ecosystems.md:382-386`). |
+| **Existing mapping** | Accepted. Our block is appended (`:1255-1260`). Nothing checks whether another source already maps the same exact id. NuGet then treats both sources as eligible, so the patched copy is not guaranteed. The vex doc lists this as a non-goal (`vex/discover/nuget.rs:59-65`). |
+| **Multi-project / per-project locks** | Only the root `packages.lock.json` and root `nuget.config` are used (`:93`, `:1145`). Locks in sub-projects are never pinned. Parent-dir or user-level configs, `<clear/>`, and custom `NuGetLockFilePath` are not handled (`vex/discover/nuget.rs:59-65`). The crawler reads `obj/project.assets.json` one level deep (`crawlers/nuget_crawler.rs:483-498`), but only to find package folders. |
+| **CPM (`Directory.Packages.props`)** | Not referenced anywhere. No refusal and no special handling. A typical CPM solution keeps its locks per project, so it falls into the "no lockfile" warning path. |
+| **packages.config** | Recognized as a .NET marker (`nuget_crawler.rs:419-436`), and the legacy `packages/<Name>.<Version>/` dir is crawled. `vendor_nuget` accepts that dir as `installed_dir` (doc `:392-397`). No special handling and no test for restore under packages.config. |
+| **Warm global cache** | Every real-restore test uses a cold `NUGET_PACKAGES` (`docker_e2e_vendor_nuget.rs:185-224`; `e2e_nuget_dotnet_build.rs` also uses a "cold `NUGET_PACKAGES`"). A same-id/version pristine copy already in `~/.nuget/packages` is untested. |
+
+## 4. How the patched .nupkg is built (`materialise_patched_nupkg` `:892`)
+
+1. **Service first.** `service_archive_copy(service, record, name, ".nupkg")` (`service_fetch.rs:169`).
+   - It POSTs `/v0/orgs/{slug}/patches/package` (or the public proxy's `/patch/package`) and GETs the grant URL (`api/client.rs:1106-1113`).
+   - The SRI is checked, and every member must hash to its afterHash, before the bytes are written verbatim.
+   - An integrity mismatch is always a hard failure.
+   - A miss under `auto` falls back to the local build. Under `--vendor-source=service` it is refused (`vendor_prebuilt_required`).
+2. **Local rebuild** (`local_rebuild` `:949`).
+   - `locate_cached_nupkg(installed_dir)` (`:1123`) takes the first `*.nupkg` in the crawler's package dir. That is `~/.nuget/packages/<idLower>/<ver>/` or `$NUGET_PACKAGES`, or the legacy `packages/<Name>.<Ver>/`. **The pristine bytes therefore come from the global packages folder** (or the legacy folder), never from a registry: NuGet has no fetch rung (`vendor.rs:168-170`).
+   - The in-memory repack (`prepare_memory_repack`, which also stages `.nupkg.metadata` and `*.nupkg.sha512`), then `force_apply_staged`, which also runs the sidecar fixup.
+   - Deterministic lexicographic re-zip that drops `.signature.p7s` (`rebuild_nupkg_bytes` `:1079`, `SIGNATURE_PART` `:108`).
+   - The upstream id and version are kept, with the same filename leaf.
+
+## 5. Hosted NuGet (`patch/redirect/mod.rs`)
+
+**Entry point:** `rewrite_nuget` (`:5317`), registered at `:449`.
+- It reads only a root `nuget.config` (lowercase) and `packages.lock.json` (`scan/hosted.rs:75-76`, `mod.rs:5330`, `:5346`). If there is no config it starts from `default_nuget_config()` (`:5127`).
+- An unparseable lock skips the whole NuGet rewrite (`redirect_nuget_lock_unparseable`).
+- Per dep it requires a `nuget-v3` override and a sha512 (`:5362-5376`).
+
+**Config**
+- `add_nuget_source` (`:5142`) adds `<add key="socket-patch-<uuid>" value="<indexUrl>"/>`. It seeds nuget.org when the new mapping would otherwise have no catch-all target.
+- If there is no mapping, it creates socket-exact-id plus a `*` catch-all for each pre-existing source. If a mapping exists, it prepends only ours after `<packageSourceMapping>`.
+
+**Lock**
+- For every framework entry whose id matches (**id only, not version**; `:5431`), it sets `resolved` = `nugetVersionNorm` and `contentHash` = the SRI with `sha512-` stripped.
+
+**URL form** (fixtures `socket-patch-core/tests/fixtures/redirect/nuget/packages-lock/{basic,empty-sources,empty-sources-selfclosing,no-preexisting-mapping}`):
+- index: `https://patch.socket.dev/patch-registry/nuget/<grantToken>/<uuid>/index.json`
+- artifact: `…/<uuid>/flat/<idLower>/<ver>/<idLower>.<ver>.nupkg`
+- The data comes from `api_client.fetch_registry_references` (`scan/hosted.rs:1244`, `client.rs:748-776`, same POST `…/patches/package`). Integrity is taken from the reference's `tarball`-kind artifact (`hosted.rs:1281-1287`).
+
+**Why hosted revert is unsupported**
+- The config `FileEdit` records only `new: {source, pattern}` with `original: None` (`:5413-5421`). No pre-edit snapshot exists, so it cannot be inverted.
+- `replay.rs:181` classifies `redirect_nuget_source` and `redirect_nuget_lock` as `Inverse::Unsupported`; the module doc `:20-23` says these groups refuse with `hosted_revert_unsupported`.
+- `takeover.rs:79-83` `redirect_revert_supported` covers only cargo, npm and golang. So vendored takeover of a hosted NuGet purl is also blocked (`vendor.rs:1585`, `:2416`), and `remove.rs:1359` reports `hosted_revert_unsupported`.
+- The v5 plan (`docs/design/v5-plan.md` WS1) replaces this with a re-resolve from nuget v3.
+- Hosted in-memory mode can't take inventory from NuGet either (`hosted_memory/roots.rs:51` `UNSUPPORTED_MARKERS`).
+
+## 6. Tests and how to run them
+
+Run everything from `/home/user/socket-patch`.
+
+| Test | Needs | Gate / command |
+|---|---|---|
+| Inline unit tests in `nuget_feed.rs` (from `:1662`, roughly 3.7k lines: config surgery, lock, revert, drift, hot path, service, tamper guards) | nothing | `cargo test -p socket-patch-core --lib nuget_feed` |
+| `socket-patch-core/tests/covgap_vendor_nuget_feed.rs` (TMPDIR failure; `cfg(unix)`) | nothing | `cargo test -p socket-patch-core --test covgap_vendor_nuget_feed` |
+| `crawler_nuget_e2e.rs`, `redirect_golden.rs` (shared TS goldens), redirect `mod.rs` tests `:7915+`, `replay.rs:3406` | nothing | `cargo test -p socket-patch-core` |
+| `socket-patch-cli/tests/e2e_vex_lockfile/nuget.rs` (module in the `e2e_vex_lockfile` binary; hermetic, wiremock, no dotnet) | nothing | `cargo test -p socket-patch-cli --test e2e_vex_lockfile nuget` |
+| `e2e_nuget.rs` (crawl only, wiremock proxy) | nothing | `#[ignore]` at `:182`, `:250`; run with `cargo test -p socket-patch-cli --test e2e_nuget -- --ignored` |
+| `e2e_nuget_dotnet_build.rs` (hosted `:725` + vendored `:834`, real SDK, needs nuget.org) | host `dotnet` + network | `#[ignore]`; soft-skips without dotnet unless `SOCKET_PATCH_DOTNET_E2E_REQUIRED=1`; `SOCKET_PATCH_DOTNET_E2E_VERSION=8` picks the SDK; `cargo test -p socket-patch-cli --all-features --test e2e_nuget_dotnet_build -- --ignored` |
+| `docker_e2e_nuget.rs` (apply chain, `:570`, `:607`) | Docker image `socket-patch-test-nuget:latest` | `#![cfg(feature="docker-e2e")]`; soft-skips if the image is missing (`:482`); `cargo test -p socket-patch-cli --features docker-e2e --test docker_e2e_nuget` |
+| `docker_e2e_vendor_nuget.rs` (`:472`: 3-stage vendor → cold offline `--locked-mode` restore → RED/TAMPER(NU1403) → idempotence and revert) | Docker (SDK 8.0) | `--features docker-e2e --test docker_e2e_vendor_nuget` |
+| `setup_matrix_nuget.rs` | host guard runs; `dotnet()` is `#[ignore]` (baseline gap) | `--features setup-e2e --test setup_matrix_nuget` |
+| Other hermetic CLI tests (`in_process_get_hosted_ecosystems.rs:532`, `in_process_scan.rs:1374`, `in_process_rollback_all_ecosystems.rs:552`, `e2e_safety_advisories.rs:412-671`, `ecosystem_dispatch_e2e.rs:310,986`, `vendor_ecosystem_fixtures/mod.rs:748`, `e2e_vex_vendor.rs`, `e2e_vendored_production.rs`) | nothing (production suites are canaries) | normal `cargo test -p socket-patch-cli --test <name>` |
+
+**Docker images:** build `tests/docker/Dockerfile.base` tagged `socket-patch-test-base:latest`, then `tests/docker/Dockerfile.nuget` (FROM `mcr.microsoft.com/dotnet/sdk:8.0`, copies the binary from base) tagged `socket-patch-test-nuget:latest`.
+
+**CI (`.github/workflows/ci.yml`)**
+- `coverage-docker` (`:455`, matrix `:479`) and `e2e-docker` (`:1390`, matrix `:1398`) run `docker_e2e_nuget`, adding `docker_e2e_vendor_nuget` at `:561` and `:1447`.
+- `e2e` (`:675`) runs `suite: e2e_nuget` (`:696`) and `e2e_nuget_dotnet_build` for dotnet 6/7/8/9/10 on ubuntu and 8 on macOS (`:1057-1064`, setup-dotnet at `:1248`, env at `:1351`). The default filter is `--ignored` (`:1353`).
+- `setup-matrix` (`:1634`) is non-blocking.
+
+## 7. Known TODOs and limitations
+
+- `v5-plan.md:30-31`: "a better vendored story for … NuGet (… NuGet feed is fragile). Keep the current behavior; do not invest further now."
+- There are no literal `TODO`/`FIXME` comments in the NuGet files. Documented non-goals are in `vex/discover/nuget.rs:59-65`: parent/user configs, per-project locks, `<clear/>`, a non-Socket source that also maps the id, and `NuGetLockFilePath`.
+- **Orphan-sweep gap.** `nuget.config` is missing from `repair_vendor.rs` `WIRING_FILES` (`:105-129`). That list feeds both `repair`'s ledger reconstruction and `sweep_orphan_vendor_dirs` (`vendor.rs:283-326`). Separately, the config names the uuid dir rather than a leaf file. Together this likely means repair cannot recover a NuGet entry, and the sweep could delete a NuGet uuid dir that is still wired. This comes from reading the code only; no test was run to confirm it.
+- Config-name mismatch: vendor probes 2 spellings, vex/crawler probe 3, hosted probes only `nuget.config`.
+- The hosted lock rewrite matches on id regardless of version (`redirect/mod.rs:5431`).
+- The same id+version as upstream means the global-cache collision is untested (every test uses a cold `NUGET_PACKAGES`).
+- The signature is dropped, so the package reads as unsigned. This relies on NuGet's default signature validation mode being `accept` (`:15-18`).
+- Sidecar (agent mode): `patch/sidecars/nuget.rs:1-18` deletes `.nupkg.metadata` and only advises when `.nupkg.sha512` is present.
+- `dispatch_in_use_one` has no NuGet probe (`vendor.rs:256-265`).
+
+## 8. The NuGet crawler (`socket-patch-core/src/crawlers/nuget_crawler.rs`)
+
+- **Global mode** (`:37-49`): uses `--global-prefix` if given, else `NUGET_PACKAGES`, else `~/.nuget/packages` (`nuget_home` `:392`).
+- **Local mode** is gated by `is_dotnet_project(cwd)` (`:406`): a root entry that is `*.csproj`, `*.fsproj`, `*.vbproj`, `*.sln` or `*.slnx`, or `nuget.config` / `packages.config` in any casing. When the gate passes, paths are returned in this order:
+  1. `<cwd>/packages/` (legacy)
+  2. the global cache
+  3. the `packageFolders` keys of `obj/project.assets.json` in cwd and one level of subdirectories (`:472-512`)
+- **Layouts** (`classify_package_entry` `:228`):
+  - Global: `<name>/<version>/`, where the version must start with a digit (`:286-328`).
+  - Legacy: `<Name>.<Version>/`, split at the first `.`+digit (`:453`).
+  - A package is verified by `lib/` or a `*.nuspec` (`:331`).
+- It crawls **every package in those folders**. It does not filter by the project's dependency graph (it does not read assets targets or the lock).
+- The purl comes from the directory name, which is lowercased in the global cache.
\ No newline at end of file
diff --git a/docs/design/nuget-vendoring-research/critic.md b/docs/design/nuget-vendoring-research/critic.md
new file mode 100644
index 00000000..a1d8a80e
--- /dev/null
+++ b/docs/design/nuget-vendoring-research/critic.md
@@ -0,0 +1,84 @@
+# NuGet vendoring research: critic pass (contradictions, verified gaps, open questions)
+
+I ran six experiments myself on SDK 8.0.131. Two results change the design:
+- **A committed repo-local package folder only survives if it is set through `RestorePackagesPath`.** If it is set through `nuget.config` `globalPackagesFolder`, a user's `dotnet nuget locals --clear` deletes it.
+- **Once a package is in that folder, NuGet never looks at sources or `packageSourceMapping` for it.** That makes the folder the only offline mechanism that does not depend on source mapping. The catch is that it also skips signature checks.
+
+Full notes are in `<scratch>/research/critic/FINDINGS.md`, with the helpers (`env.sh`, `mkpatch.py`) and `seed/`, `tmpl/`, `exp/` next to it. In the text below, "package folder" means NuGet's global packages folder (normally `~/.nuget/packages`), and "seed" means a patched package pre-extracted into a repo-local package folder.
+
+**Isolation incident.** My first experiment ran `dotnet nuget locals all --clear` before I had set `TMPDIR`. It cleared the shared `/tmp/NuGetScratchroot`, which is NuGet's temp directory. A restore running in another agent at that moment could have failed. `env.sh` now sets `TMPDIR`, and every later experiment used it.
+
+## 1. Contradictions and tensions between reports
+
+1. **Option C, the repo-local package folder, conflicts with the signing report.**
+   - The shapes and lock-cache reports recommend seeding a repo-local package folder.
+   - The signing report verified that anything already extracted into a package folder skips signature validation, even under `signatureValidationMode=require`. It says this "quietly gets around enterprise policy; should not document it".
+   - Consequence: if we adopt option C, the tool itself has to check the effective signature policy. It should refuse, or require a Socket author signer, when the policy is `require`. It cannot rely on NuGet to enforce it.
+2. **Which unique-version form to use.**
+   - The sources report recommends `X.Y.Z.N-socket.M`; the shapes and lock-cache reports recommend `X.Y.Z.N`.
+   - The trade-off: plain `X.Y.Z.N` collides with a real upstream 4-part version. The prerelease form never collides, but `pack` warns about it: **VERIFIED** `warning NU5104: A stable release of a package should not have a prerelease dependency` for `[13.0.3.1-socket.1]`, and no warning for `[13.0.3.1]`.
+   - Both forms leak into the nuspec of a packed library: **VERIFIED** `version="[13.0.3.1-socket.1]"` and `version="[13.0.3.1]"`.
+3. **How serious NU3005 is.**
+   - The shapes report says keeping the signature "does not work" and cites NU3005.
+   - The lock-cache and signing reports verified that NU3005 is only a warning and the package installs as unsigned.
+   - Reconciled: a malformed signature entry means "treated as unsigned". It fails only under `require` (NU3004) or when warnings are treated as errors (DOCS).
+4. **Whether NuGet trusts `.nupkg.sha512`.**
+   - The sources report says its content is ignored in a hierarchical feed; the lock-cache report says its text is copied when `.nupkg.metadata` is rebuilt for an unsigned package in the package folder.
+   - Both are correct, in different contexts. Either way the file is not a trust anchor.
+5. **Implications across reports for today's code.**
+   - The code map says vendoring appends an exact-id mapping to our feed. The shapes report verified that id-wide mapping breaks every other version of that id in the repo (NU1102 for Tool's 12.0.1). So current vendoring likely breaks multi-version repos whenever `nuget.config` already has a mapping.
+   - The hosted lock rewrite matches on id regardless of version (`redirect/mod.rs:5431`). Combined with the shapes finding that one id resolves to different versions per project, this would rewrite the wrong versions' entries.
+6. **Different bytes from the two build routes.**
+   - depscan repacks STORE-only; the local rebuild uses its own deterministic re-zip. The signing report verified that every layout change changes `contentHash`.
+   - So the service route and the local route give different lock pins. Verify and revert must hash the committed artifact, never a rebuild.
+
+## 2. DOCS claims worth verifying
+
+| Claim | Status |
+|---|---|
+| A dot-prefixed folder is excluded from SDK default globs (shapes) | **VERIFIED.** `.socket/nuget-packages/zz/1.0.0/Broken.cs` under a root-level csproj: `-getItem:Compile` lists only `Program.cs` and the build succeeds. Control: the same file in `pkgs-visible/` fails with `error CS1040`. |
+| Local folder feeds are not HTTP-cached (lock-cache) | **VERIFIED (partial).** After restoring from a folder feed there are no newtonsoft entries in `NUGET_HTTP_CACHE_PATH`, and `.nupkg.metadata` `source` is the folder path. |
+| An exact `[x]` dependency against a 4-part version gives NU1608 | Not verified. It needs a real package with an exact-version dependency. It matters for option B together with `TreatWarningsAsErrors`. |
+| CPM allows one `PackageVersion` per id | Not verified. Cheap to check. |
+| `require` mode has no per-package exemption; an untimestamped signature expires with its certificate | Not verified. The first is probably right given the NU3004 behaviour. |
+| nuget.exe behaviour for packages.config | Unverifiable here (see §4). |
+
+## 3. Research topics nobody covered, and my results
+
+Of the topics on the list, only packages.config is still open (§4). The rest are covered at least partly. These next ones were not on the list; the first four are now answered:
+
+- **V1: `dotnet nuget locals --clear` against a committed seed.**
+  - With `RestorePackagesPath=$(MSBuildThisFileDirectory).socket/nuget-packages` in `Directory.Build.props`, `locals all --list` does not show the repo folder, and `--clear` leaves the seed in place. **VERIFIED**
+  - With `nuget.config` `<add key="globalPackagesFolder" value=".socket/nuget-packages"/>` it printed `Clearing NuGet global packages folder: .../r/.socket/nuget-packages` and **deleted the committed seed**. **VERIFIED**
+  - Design rule: never point `globalPackagesFolder` in `nuget.config` at committed data.
+- **V2: a seed bypasses sources and mapping.**
+  - The mapping mapped only `Humanizer.*` to nuget.org and left Newtonsoft.Json unmapped: restore succeeded, with no NU1100, from the seed. **VERIFIED**
+  - The only source was `./does-not-exist`, `obj/` was deleted, and `dotnet restore --locked-mode` printed `Restored ... (in 252 ms)`. `dotnet run` printed `{"a":1}` and the output dll ends with `SOCKETPATCHED`. **VERIFIED**
+  - This confirms the lock-cache claim that mapping is never consulted once a package is in the folder.
+- **V2b: restore does not touch the seed.** `diff -r` of the seed before and after restore, build and run found no differences, so the git tree stays clean. **VERIFIED**
+- **V3: dot-folder globbing.** See the table in §2. A repo-local folder under a root csproj must be dot-prefixed, or covered by `DefaultItemExcludes`. **VERIFIED**
+- **Still uncovered:**
+  - `NuGetLockFilePath` and the `RestoreLockedMode` property
+  - static-graph restore (`RestoreUseStaticGraphEvaluation`)
+  - whether Visual Studio or nuget.exe honour `RestorePackagesPath`
+  - `dotnet test` with a repo-local folder
+  - macOS and Windows case-insensitivity for the seed path
+  - Dependabot/Renovate rewriting the version or lock
+
+## 4. Remaining unknowns
+
+- **packages.config.** A legacy csproj that imports `Microsoft.Common.targets` with a `packages.config`, run through `dotnet msbuild -t:restore -p:RestorePackagesConfig=true`, printed `Nothing to do. None of the projects specified contain packages to restore.` **VERIFIED.** DOCS: packages.config restore exists only in desktop MSBuild or nuget.exe. mono and nuget.exe are not installed, so it cannot be tested on this machine; it needs a Windows or mono CI leg.
+- **CI overrides.** A CI job that passes `-p:RestorePackagesPath` or `--packages` bypasses the seed. With the upstream hash in the lock this silently gives an unpatched build; with the patched hash it fails with NU1403 (shapes, VERIFIED). There is no way to prevent it, only to fail closed.
+- **Signature policy with a seed** (see §1.1). We would need a detection rule for an effective `require` policy across the user, machine and repo configs.
+- **Pack leak for option B.** There is no verified mitigation other than limiting option B to non-packable projects or transitive `PrivateAssets=all` redirects.
+
+## 5. Implications for vendoring a patched package with the upstream id+version
+
+1. The id+version can stay the same **only inside a package folder the repo owns**:
+   - **Location:** `RestorePackagesPath=$(MSBuildThisFileDirectory).socket/nuget-packages`. Import it from an Exists-guarded `.socket` props file that is chained into every nearest `Directory.Build.props`. The folder must be dot-prefixed (V3) and must not be set through `nuget.config` (V1).
+   - **Seed contents:** `<idlower>/<vernorm>/` holding `.nupkg.metadata`, the lowercase nuspec and `lib/`. No `.nupkg` or `.sha512` is needed. Git sees no changes after a restore (V2b).
+   - **Lock pin:** put the patched hash in both `.nupkg.metadata` and every lock in the closure, so bypassing the folder fails closed with NU1403.
+   - **Cost:** every other package also downloads into the repo folder, so `.gitignore` needs negation rules for the seed.
+2. With the seed in place, **no `nuget.config` edit is needed for the patched package** (V2). That removes the fragile source-mapping surgery, including the catch-all `*` and the multi-version NU1102 breakage. Revert is: delete the seed, restore the original lock hashes, and remove the props import. There is no global-cache eviction, because the shared package folder is never used.
+3. The seed skips signature validation. The tool must detect an effective `signatureValidationMode=require` and refuse, or sign the package and document the `<author>` signer entry. Otherwise the tool silently weakens the organisation's policy.
+4. Any shared-cache variant, meaning today's folder feed plus mapping, cannot be made safe. All reports agree on this: the first copy written wins, the wrong copy leaks both ways, and NU1403 repeats until the entry is evicted.
\ No newline at end of file
diff --git a/docs/design/nuget-vendoring-research/depscan.md b/docs/design/nuget-vendoring-research/depscan.md
new file mode 100644
index 00000000..cd26a6d4
--- /dev/null
+++ b/docs/design/nuget-vendoring-research/depscan.md
@@ -0,0 +1,204 @@
+# depscan backend research for NuGet vendoring (for socket-patch v5)
+
+## TL;DR
+- depscan already builds **one prebuilt patched `.nupkg` per patch**. It keeps the **same id and version as upstream**, repacks the zip STORE-only, strips `.signature.p7s` and adds no signature. The bytes are written once to object storage, and their **sha512 SRI** is saved as `package_integrity`.
+- You can get it two ways:
+  - **Artifact route:** `/patch/nuget/...`. The vendoring service (`POST /v0/orgs/{org}/patches/package`) returns this URL, and socket-patch's `service_fetch.rs` already downloads and checks it.
+  - **Single-package NuGet v3 feed:** `/patch-registry/nuget/{token}/{uuid}/index.json`, used by hosted mode.
+- **For unsigned packages, NuGet's `contentHash` is the base64 sha512 of the nupkg bytes.** That equals `package_integrity` with the `sha512-` prefix removed. A dotnet e2e test proves this.
+- **A patched-version suffix exists for Maven (`<base>-socket.<hex8>`) and Go (`<base>-socketpatch.<n>`). NuGet has none.** NuGet is always served under the upstream id+version.
+- **Nothing is signed anywhere.** `sign.ts` is an identity stub, and there is no key custody.
+- **No NuGet-specific vendoring artifact exists server-side**, beyond the plain `.nupkg`. For comparison, gem has a stub gemspec, Go has the gopatch zip and npm has a berry zip.
+
+---
+
+## 1. Hosted NuGet serving (patch-server)
+
+**Server entry:** `depscan/workspaces/patches/src/services/patch-serving/server.ts:65-80` registers three route families:
+- `/patch/...`: `registerPatchServeRoute` in `serve-route.ts`
+- `/patch-registry/...`: `registerPatchRegistryRoutes` in `registry-routes.ts:32`, one regex route that parses `req.path`
+- `/gopatch/...`
+
+**URL grammar:** `depscan/workspaces/lib/src/socket-patch/patch-url.ts:1-23`. These parsers are shared by the server and SBOM recognition.
+- Artifact URL: `https://{host}/patch/{eco}/{name}/{version}/{token}/{patch-uuid}/{filename}` (`parsePatchServeUrl`, :82)
+- Registry URL: `https://{host}/patch-registry/{eco}/{token}/{patch-uuid}/<tail>` (`parsePatchRegistryUrl`, :156)
+- Vendored path: `file:.socket/vendor/{eco}/{patch-uuid}/{leaf}` (`parseSocketVendorPath`, :253, a TS port of socket-patch `vendor/path.rs`)
+
+**NuGet v3 feed:** `nugetDecision` in `patch-serving/registry-decision.ts:361-427`. This is a pure function. It serves a feed containing exactly one package version, pinned by the uuid in the URL:
+
+| tail | response |
+|---|---|
+| `index.json` | Service index with only two resources: `PackageBaseAddress/3.0.0` → `{base}/flat/` and `RegistrationsBaseUrl/3.6.0` → `{base}/reg/` (:370-387). No search, autocomplete or catalog. |
+| `flat/{idLower}/index.json` | `{versions:[verNorm]}` (:389-396) |
+| `flat/{idLower}/{verNorm}/{idLower}.{verNorm}.nupkg` | Streams the object-store bytes with `ETag: "<sha512 SRI>"` (:397-406) |
+| `reg/{idLower}/index.json` | Minimal registration: one page, one leaf, with `catalogEntry:{id,version}` and `packageContent`. **No `packageHash`, no dependency groups, no `listed`** (:407-425) |
+
+**Gates, before any of the above** (`evaluateRegistryDecision`, :190-222):
+- `unpublished_at` set → 410
+- ecosystem mismatch → 404
+- `package_status !== 'built'` → 408, or 404 if the build failed
+
+**Artifact headers:** `archive-response-headers.ts:11`
+- `Cache-Control: public, max-age=3600, no-transform`, deliberately not `immutable`, so that revoking a grant still has an effect.
+- There is no `X-Socket-Patch-Unsigned` header, although `sign.ts` suggests one.
+
+**Bytes served:** the output of `nugetRepacker` in `patches/src/repack/repackers/nuget.ts:35-69`:
+- Unzips the upstream nupkg and substitutes the patched files.
+- Leaves the nuspec, id and version unchanged.
+- Removes `.signature.p7s` via `stripSignedArchiveMetadata` (`patches-shared/src/archive/repack-utils.ts:1290-1314`).
+- Re-zips with `store: true`, level 0 (`repack-utils.ts:696-701`).
+- The doc comment (:24-33) says unsigned output is the "current v1 contract".
+
+**Upstream fetch:** `patches/src/repack/upstream/nuget.ts:13-62`.
+- Downloads from `api.nuget.org/v3-flatcontainer` using the lowercased id and normalized version.
+- Does **not** verify against the registry `packageHash`. Per the comment at :49-59, only the per-file `before_sha` check applies.
+
+**Hash computation:** `patches/src/services/patch-package/build.ts:309-320`.
+- Computes `sha512-<b64>` (`package_integrity`), sha256 (`package_blob_file_hash`), sha1 and md5 over the archive.
+- Storage is write-once (:235-240); `gcs-store.ts:194-205` re-hashes on read-back.
+
+**Proof that `contentHash` equals `package_integrity` without the prefix:** `patches/src/test/integration/installers/nuget.installer.e2e.test.ts:1-36, 166-261`.
+- Uses a real `dotnet restore` against a folder feed with `<clear/>`.
+- Runs `--locked-mode` with fresh `NUGET_PACKAGES` and `NUGET_HTTP_CACHE_PATH`.
+- A negative leg swaps in the upstream package and expects NU1403.
+- Note: the test isolates the global packages folder precisely **because** the same id+version collides in the global packages cache.
+
+## 2. Vendoring service contract (server ↔ client pairing)
+
+**Endpoint:** `POST /v0/orgs/{org_slug}/patches/package`, defined in `depscan/workspaces/api-v0/src/endpoints/orgs/patches/package.ts:252-258` (operationId `getPatchPackages`).
+- **Request** (:37-42): `{uuids[], freeOnly}`.
+- **Response** (:137-169): `results[uuid] = {status, url, purl, artifacts[], registryOverride}`.
+  - `status` is one of `granted | reused | pending_build | build_failed | withdrawn | forbidden | not_found`.
+  - `artifacts[].kind` is one of `tarball | yarn-berry-zip | gem-stub-gemspec` (:121-134).
+  - Integrity fields: `{sha512, sha256, sha1, md5, dirhashH1, goModH1, yarnBerry10c0}` (:46-62).
+
+**Public proxy:** `POST /patch/package` in `depscan/workspaces/patches-api-proxy/src/server.ts:1003-1030` forwards to the same endpoint and forces `freeOnly`.
+
+**Core logic:** `depscan/workspaces/app/src/patches/patch-package-references.ts`
+- `getPatchPackageReferences` (:933).
+- `buildPatchPackageArtifacts` (:469-530): the tarball comes first and carries sha512, sha256, sha1 and md5. For NuGet that is the only artifact; it points at the `/patch/nuget/...` serve URL.
+- `buildRegistryOverride` for NuGet (:668-683) returns:
+  - `kind: 'nuget-v3'`
+  - `indexUrl: {base}/index.json`
+  - `nugetIdLower` and `nugetVersionNorm`
+  - **no hash** in the identifiers; the rewriter uses the artifact's sha512.
+
+**Client side (socket-patch):**
+
+| Step | File and lines |
+|---|---|
+| Choose endpoint: authenticated vs `/patch/package` proxy | `crates/socket-patch-core/src/api/client.rs:742-743`, `vendor_package_url` :1373-1386 |
+| Two-step request, then download; `patch_server_url` rewrites the download host | `fetch_vendor_package` :1115-1160, `_once` :1242-1350 |
+| Secondary artifacts | client.rs :1310-1348 |
+| Checks the sha512 SRI floor (plus Go `h1:`) and fails closed on mismatch | `vendor/service_fetch.rs:88-138` (`fetch_verified_archive`) |
+| Maven/NuGet path: service first, else local rebuild; `--vendor-source=service` hard-fails | `service_fetch.rs:170-200` (`service_archive_copy`) |
+| NuGet vendoring calls it | `vendor/nuget_feed.rs:906` |
+| Hosted-mode rewriter reads `nuget_id_lower` / `nuget_version_norm` | `patch/redirect/mod.rs:126-127, 449, 5126-5280` |
+
+The hosted-mode rewriter is mirrored in depscan: `depscan/workspaces/app/src/patches/registry-rewrite/nuget.ts:1-232`. It:
+- adds a source plus a `packageSourceMapping`, with a catch-all for existing sources (:160-211);
+- sets `contentHash` to the sha512 without the prefix and `resolved` to `nugetVersionNorm` (:69-112).
+
+**Answer to (2): yes, a prebuilt patched `.nupkg` is already available for vendoring.** socket-patch already consumes it through `service_fetch`. There is no NuGet-specific variant: no renamed or re-versioned build and no signed build.
+
+## 3. Patched-version suffix and distinct-identity precedents
+
+**Maven: `<base>-socket.<first-8-hex-of-uuid>`**
+- Derivation: `depscan/workspaces/app/src/patches/maven-suffix.ts:1-65`. `suffixMavenPom` rewrites the pom's `<version>` and literalizes `${project.version}`, or returns null so the caller falls back to the same GAV.
+- Serve: `registry-decision.ts:~430-470`. When the pom rewrite succeeds, the artifact is served only under the suffixed version and the bare-upstream paths return 404. There is deliberately no `maven-metadata.xml`, so version ranges cannot resolve it (fail-closed).
+- The pom's sha256 is published as `mavenPomSha256` (`package.ts:93-101`) for a trusted-checksum pin.
+- Note: the jar bytes themselves are not re-versioned; only the pom is.
+
+**Go: `<base>-socketpatch.<n>`, with the module re-homed to `patch.socket.dev/gopatch/<uuid>`**
+- `depscan/workspaces/lib/src/go/gopatch.ts:21-64`.
+- `GopatchFlavor` (`repack/ecosystem-repacker.ts:65-80`) is a **second stored artifact** with its own sha512 and `h1:`, stored in `build.ts:395-405, 485-500`.
+- Changed content must bump `<n>`, never reuse a version (`build.ts:487-491`; `patch-sync/import-db.ts:56`).
+
+**Other secondary vendoring artifacts:**
+- gem stub gemspec: `repackers/gem-stub-gemspec.ts`, stored in `build.ts:412-419`.
+- npm yarn-berry cache zip: `build.ts:344-390`.
+
+**NuGet:** none. There is no `-socket.N` prerelease, no `+socket` metadata and no distinct id. `normalizeNuGetVersion` actually **drops** `+metadata` (`repack/nuget-version.ts:1-35`). That makes `+socket` useless as a distinguisher, because NuGet also ignores build metadata for identity and for the global packages cache path.
+
+**Other ecosystems' vendored artifacts server-side:**
+- There is exactly one pipeline: the converter build in `services/patch-package/build.ts` feeding the `published_patches.package_*` columns (`queue.ts:410`), then the serve route.
+- There is no separate "vendor" build; vendoring reuses the hosted tarball.
+
+## 4. NuGet identity in depscan
+
+**PURL:** `depscan/workspaces/lib/src/purl/schema/nuget.ts:1-25`.
+- `pkg:nuget/<name>@<version>`, with no namespace.
+- The name keeps its case (spec: case-sensitive in the archive, case-insensitive for lookup).
+- `purl-full-name.ts:258-263` sets namespace to null.
+
+**Version normalization (three implementations kept in sync):**
+- `patches/src/repack/nuget-version.ts:15-35`: lowercase, drop `+meta`, strip leading zeros, pad to 3 parts, drop a zero 4th part.
+- `app/src/patches/patch-package-references.ts:555-590`.
+- socket-patch `vendor/nuget_feed.rs`.
+
+Serve paths, the upstream fetch and `nugetVersionNorm` all use the normalized form. The serve decision checks the tail against the row using `idLower` and `verNorm`.
+
+**SBOM:** the pipeline NuGet tasks (`pipeline/src/task/cs/nuget/**`) have **no Socket-patch reference detection**. That detection exists for npm, pypi and gem only (grep of `detectSocketPatchReference`/`parseSocketVendorPath` in `pipeline/src`). A patched NuGet dependency therefore shows up as plain upstream `name@version`. If the NuGet package id or version changed, SBOM/purl mapping would need new detection.
+
+## 5. Signing
+
+- `patches/src/repack/sign.ts:1-38`: `defaultSign` returns null.
+- The comments list a future `authenticode-p7s` kind for NuGet, but state "no key custody / KMS / HSM exists yet".
+- Columns `package_signature` and `package_signature_kind` exist (`ecosystem-repacker.ts:55-62`; `queue.ts:410-411`) and are always null.
+- There are **no repository or author signatures** for any ecosystem.
+- Consequence: consumers using `signatureValidationMode=require` or `<trustedSigners>` will reject Socket nupkgs. The nuget repacker comment (:27-31) acknowledges this.
+
+---
+
+## What could live server-side for NuGet vendoring
+
+1. **Keep today's prebuilt `.nupkg` and add the missing integrity pieces.**
+   - Feasibility: exists; the additions are trivial.
+   - The artifact and its sha512 are already served. `contentHash` is the sha512 payload of that artifact.
+   - Cheap additions:
+     - put `packageHash`/`packageHashAlgorithm` into the registration leaf in `registry-decision.ts:407-425`;
+     - add dependency groups taken from the nuspec so the registration is spec-complete.
+   - This does not remove the global-packages-cache collision.
+
+2. **A Socket-suffixed NuGet flavor, `<ver>-socket.<hex8>` (prerelease), as a second artifact.**
+   - Feasibility: moderate. The Maven and Go flavors are close templates: `GopatchFlavor` storage in `build.ts:395-500`, and the fail-closed serve/404 pattern for bare paths in `mavenDecision`.
+   - Work required:
+     - rewrite `<version>` in the nuspec;
+     - rename the entry `{id}.nuspec` and possibly rebuild `[Content_Types].xml`/`_rels`;
+     - the flat path, registration and `normalizeNuGetVersion` then handle the new version as-is;
+     - add `nugetSuffixedVersion` to `RegistryOverrideIdentifiers` and a new `artifacts[].kind` (for example `nupkg-socket`).
+   - Benefit: removes the global-packages-cache collision, source-mapping ambiguity and fall-through to nuget.org.
+   - Costs:
+     - a prerelease version changes resolution semantics: floating ranges ignore prereleases, NU5104 warnings appear, and transitive `>= x` constraints are still satisfied;
+     - the consumer must change `<PackageReference Version>` or use central package management (CPM) / `Directory.Packages.props`;
+     - SBOM must learn to map `-socket.` back to the upstream purl (see §4).
+   - Using `+socket` metadata instead of a prerelease is **not viable**, because NuGet drops it for identity.
+
+3. **A distinct package id, e.g. `Socket.Patched.<Id>`.**
+   - Feasibility: low.
+   - Assembly and type identity would not change, but every transitive dependent still references the original id. It would need a shim or `PackageReference` aliasing that NuGet does not support. Not recommended.
+
+4. **Serve the vendored feed metadata server-side.**
+   - Feasibility: exists for hosted mode.
+   - The single-package v3 feed can be "ejected": socket-patch already gets the bytes. A local feed only needs the nupkg (a folder feed needs no metadata). Nothing extra is needed from the server.
+
+5. **Repository signature (`.signature.p7s`) with a Socket certificate.**
+   - Feasibility: not feasible now. There is no key custody (`sign.ts`).
+   - It would also make `contentHash` follow the signed-package rules, so it would no longer equal the plain sha512. The e2e test's claim would change.
+
+6. **Upstream `packageHash` recording, for the restore-upstream / revert of workstream WS1.**
+   - Feasibility: small to moderate.
+   - The server does not fetch or store the upstream nuget.org `packageHash` (`upstream/nuget.ts:49-59` skips it).
+   - Persisting the upstream sha512 and signed `contentHash` would let the CLI restore the original `packages.lock.json` entry offline. This addresses "hosted revert unsupported".
+
+7. **SBOM recognition of patched NuGet dependencies.**
+   - Feasibility: moderate. It does not exist today for NuGet.
+   - Needed if option 2 or 3 ships. It is useful even for same-version packages, via the `nuget.config` source URL or a `.socket/vendor/nuget/<uuid>` path.
+
+**Items that do not exist anywhere in depscan:**
+- a NuGet version suffix or distinct id;
+- any signing;
+- `packageHash` in the served registration;
+- an upstream NuGet digest check;
+- a vendoring-specific NuGet artifact;
+- NuGet patch detection in SBOM.
\ No newline at end of file
diff --git a/docs/design/nuget-vendoring-research/lock-cache.md b/docs/design/nuget-vendoring-research/lock-cache.md
new file mode 100644
index 00000000..19a75141
--- /dev/null
+++ b/docs/design/nuget-vendoring-research/lock-cache.md
@@ -0,0 +1,81 @@
+# NuGet lock-file and package-cache research (SDK 8.0.131, Linux)
+
+Every experiment ran with its own fresh HOME, NUGET_PACKAGES and NUGET_HTTP_CACHE_PATH under `<scratch>/research/lock-cache/exp/<name>/`. Full notes, commands and outputs are in `<scratch>/research/lock-cache/FINDINGS.md`. The helper scripts (`env.sh`, `mkapp.sh`, `lockhash.sh`, `work/mkver.py`) and the test feeds are in the same directory.
+
+Terms used below:
+- **GPF** is the global packages folder, normally `~/.nuget/packages`.
+- **Patched** means a copy of Newtonsoft.Json 13.0.3 with bytes appended to `lib/net6.0/Newtonsoft.Json.dll` and a `SOCKET_PATCHED.txt` file added.
+- **Upstream** means the unmodified package from nuget.org.
+
+## (a) What the lock file contains
+- **VERIFIED:** For a signed package, `contentHash` is the base64 sha512 of the .nupkg with the `.signature.p7s` entry removed. It is not the hash of the file as downloaded. `zip -d t.nupkg .signature.p7s; openssl dgst -sha512 -binary t.nupkg | base64` gave `HrC5BXdl…`, which matches the lock file. The hash of the raw file is `mbJSvHfR…`, which is what the GPF's `newtonsoft.json.13.0.3.nupkg.sha512` holds.
+- **VERIFIED:** For an unsigned package, `contentHash` is the sha512 of the file bytes (`hNLqr27u…` for the patched copy, both ways).
+- **VERIFIED:** `.nupkg.metadata` in the GPF holds `{"version":2,"contentHash":<same kind of hash as the lock>,"source":<feed>}`.
+- **VERIFIED** entry shapes:
+  - Direct: `{"type":"Direct","requested":"[13.0.3, )","resolved":"13.0.3","contentHash":…,"dependencies":{…}}`
+  - Transitive: `{"type":"Transitive","resolved","contentHash"}`
+  - Project: `{"type":"Project","dependencies":{"Humanizer.Core":"[2.14.1, )"}}`, with no hash
+  - CentralTransitive: `{"type":"CentralTransitive","requested":"[13.0.3.1, )",…}`. This needs Central Package Management with `CentralPackageTransitivePinningEnabled`.
+
+## (b) What restore does when hashes don't match
+- **VERIFIED, cold cache:** Empty GPF, feed has the patched package, lock pins the upstream hash, `--locked-mode`. It fails with `error NU1403: Package content hash validation failed for Newtonsoft.Json.13.0.3. The package is different than the last restore.` But the patched package has already been fully extracted into the GPF, `.nupkg.metadata` included. **A failed restore still poisons the cache.**
+- **VERIFIED:** GPF has upstream, lock pins patched, feed has patched: NU1403. Nothing is re-downloaded and the GPF is unchanged.
+- **VERIFIED:** GPF has patched, lock pins upstream: NU1403.
+- **VERIFIED, what NuGet compares against:**
+  - I left the upstream bytes in the GPF and edited only the `contentHash` in `.nupkg.metadata` to the patched hash. A locked restore against the patched lock **succeeded**.
+  - Editing only `.nupkg.sha512` still gave NU1403.
+  - So when a package is already in the GPF, NuGet compares the lock hash with the `.nupkg.metadata` value only. It never rehashes the .nupkg, the extracted files, or the feed bytes.
+- **VERIFIED:** NU1403 also happens **without** `--locked-mode` whenever a `packages.lock.json` exists and its hash differs.
+- **VERIFIED, other error codes:**
+  - NU1004: locked mode after a PackageReference changed (`The package references have changed for net8.0…`).
+  - NU1605: a direct reference to 13.0.3-socket.1 while a dependency needs >=13.0.3 (`Detected package downgrade: Newtonsoft.Json from 13.0.3 to 13.0.3-socket.1`). The SDK treats this warning as an error, yet the lock file was still rewritten.
+  - NU1102: the lock pins a version the feed doesn't have.
+- **VERIFIED, signatures:**
+  - Keeping a stale signature that is well-formed and is the last zip entry gives `error NU3008: The package integrity check failed. The package has changed since it was signed.`
+  - A misplaced or malformed signature entry gives only `warning NU3005` and the restore continues.
+  - Signatures are checked only when a package is extracted, not when it is already in the GPF.
+
+## (c) The GPF never refreshes an existing package
+- **VERIFIED:** I tampered with a dll inside the GPF. The locked restore passed and the tampered dll was used.
+- **VERIFIED:** `.nupkg.metadata` is the marker that a package is complete.
+  - Delete it but keep `.sha512`: NuGet recreates `.nupkg.metadata` from the local files (`"source": null`) and does not re-extract.
+  - How it recreates the hash: for a signed package it recomputes the hash from the .nupkg; for an unsigned one it copies the text of `.sha512`.
+  - Delete both files: the package is downloaded and extracted again (the tampered dll went back to its original size).
+- **VERIFIED:** `dotnet restore --no-cache --force --force-evaluate` does not refresh a GPF entry.
+- **VERIFIED, stale copies leak both ways without a lock file:**
+  - After the failed restore above left the patched copy in the GPF, an unrelated nuget.org project with no lock file built against it (its output dll ends in `SOCKETPATCH`).
+  - The other way round: GPF has upstream, feed has patched, no lock. Restore quietly used upstream and wrote a lock with the upstream hash.
+
+## (d) Repo-local GPF
+- **VERIFIED:** A relative `globalPackagesFolder` in nuget.config resolves relative to the nuget.config file, not the current directory. Restoring the solution from `src/app` created the folder at the solution root.
+- **VERIFIED:** Restore, build and publish all used it (`project.assets.json` packageFolders and `NuGetPackageRoot` in `nuget.g.props`). `$HOME/.nuget/packages` was never created. `dotnet test` was not run.
+- **VERIFIED, which setting wins:** `RestorePackagesPath` (MSBuild property) beats the `NUGET_PACKAGES` env var, which beats nuget.config. So a CI job that sets `NUGET_PACKAGES` overrides a nuget.config setting, but not a `Directory.Build.props` property.
+- **VERIFIED:** A relative `RestorePackagesPath` in `Directory.Build.props` resolves per project directory, giving one GPF per project. Use `$(MSBuildThisFileDirectory)`.
+- **DOCS:** The HTTP cache stays machine-wide. Local folder feeds are not HTTP-cached.
+
+## (e) Fallback folders
+- **VERIFIED:** I pointed nuget.config's `<fallbackPackageFolders>` at a folder holding the extracted patched package. It was used in place and not copied to the GPF (the GPF stayed empty), and the built dll was the patched one. The lock hash came from the fallback's `.nupkg.metadata` and was byte-identical to the lock produced from a feed.
+- **VERIFIED:** The minimum a fallback entry needs is `.nupkg.metadata`, the nuspec and `lib/`. It needs neither the .nupkg nor `.sha512`, and it worked with the only source pointing at a folder that doesn't exist. Without `.nupkg.metadata` the entry is ignored and NuGet goes to the source (NU1301).
+- **VERIFIED:** An upstream lock against a patched fallback gives NU1403. The hash check only trusts the value written in `.nupkg.metadata`.
+- **VERIFIED, the GPF beats fallback folders:** if the GPF already holds upstream 13.0.3, a patched lock fails with NU1403, and with no lock the upstream copy is used silently. A committed fallback folder is therefore not a vendoring mechanism on its own. It only works together with an isolated GPF.
+
+## (f) The lock doesn't record the source
+- **VERIFIED:** A lock generated from nuget.org passed a locked restore from a local folder feed holding the same bytes, and the lock stayed byte-identical. The lock only pins id, version and contentHash.
+
+## (g) Version suffixes
+- **VERIFIED:** `13.0.3+socket.1` collides completely with 13.0.3.
+  - The GPF path is `newtonsoft.json/13.0.3`, the lock says `resolved "13.0.3"`, and it says `requested "[13.0.3, )"` even when the csproj says `Version="13.0.3+socket.1"`.
+  - A second nuget.org project on the same GPF then built against the patched dll.
+- **VERIFIED:** `13.0.3-socket.1` gets its own GPF folder, but it sorts below 13.0.3. That causes NU1605 whenever something needs >=13.0.3.
+- **VERIFIED:** A four-part `13.0.3.1` gets its own GPF folder and sorts above 13.0.3, so there's no downgrade error. It works as a direct reference and as a CentralTransitive pin.
+- **DOCS:** A dependency with an exact `[13.0.3]` range would give NU1608. A real upstream 13.0.3.1 would collide, but that's rare.
+
+## What this means for vendoring a patched copy with the same id+version as upstream
+1. **A shared GPF can't be made safe.** The first copy written wins and is never refreshed. Patched bytes leak to other projects and CI caches, and upstream bytes leak in. A failed locked restore still leaves the wrong copy behind.
+2. **The lock hash detects the problem but can't fix it.** It only compares against `.nupkg.metadata`. The only recovery is deleting that GPF entry, so hosted or cached-CI revert needs cache eviction as well as rewriting the lock.
+3. **Robust options:**
+   - **(a) Repo-local GPF** set with `RestorePackagesPath=$(MSBuildThisFileDirectory)…` in `Directory.Build.props`. It beats `NUGET_PACKAGES` and covers restore, build and publish. It could be pre-seeded with the extracted patched package (a `.nupkg.metadata` file plus a minimal file set) and gitignore everything else.
+   - **(b) A distinct four-part version** such as 13.0.3.1, with Central Package Management transitive pinning. This removes the collision entirely. Don't use `+metadata` (it collides) or `-prerelease` (NU1605).
+   - **(c) A committed fallback folder.** It gives offline use without copying into the GPF, but only if the GPF doesn't already have that id+version, so it depends on (a).
+4. **Always drop `.signature.p7s`** (otherwise NU3008). The patched package's lock hash is then just the sha512 of the rebuilt file, and the current rewrite of the lock `contentHash` must use that.
+5. **The current design's catch-all `*` source mapping doesn't help.** Once the package is in any GPF, the mapping is never consulted.
\ No newline at end of file
diff --git a/docs/design/nuget-vendoring-research/shapes.md b/docs/design/nuget-vendoring-research/shapes.md
new file mode 100644
index 00000000..59802b45
--- /dev/null
+++ b/docs/design/nuget-vendoring-research/shapes.md
@@ -0,0 +1,155 @@
+# NuGet vendoring across project shapes: findings
+
+All tests ran on .NET SDK 8.0.131 on Linux. Each experiment had its own HOME, NUGET_PACKAGES and NUGET_HTTP_CACHE_PATH under `exp/<name>/`. Patched packages were built by `mkpatch.py`: it appends `SOCKETPATCHED` to the netstandard2.0 dll, adds `socket-patched.txt`, drops the signature and can rewrite the nuspec `<version>`.
+
+The main test solution has three projects:
+- **Lib** references Newtonsoft.Json 13.0.1 directly.
+- **App** has a ProjectReference to Lib.
+- **Tool** references Newtonsoft.Json.Bson 1.0.2, which pulls in Newtonsoft.Json ≥12.0.1, resolved as 12.0.1.
+
+Full notes are in `<scratch>/research/shapes/FINDINGS.md`. The templates, `env.sh`, `mkpatch.py` and the feeds are in the same directory.
+
+## 1. Multi-project solution with PackageReference and lock files
+
+**VERIFIED:** each project's lock lists the package itself:
+- Lib: `"type": "Direct", "requested": "[13.0.1, )"`.
+- App: `"Transitive"`, with its own contentHash, plus a `lib` entry of `"type": "Project"` whose dependencies are `{"Newtonsoft.Json": "[13.0.1, )"}`.
+- Tool: `Transitive 12.0.1`.
+
+So one package id shows up in every lock in the closure, and it can resolve to a different version in each project.
+
+**A (same id+version):**
+- **Source mapping works per package id, not per version.**
+  - VERIFIED: once Newtonsoft.Json was mapped only to the local feed, Tool failed with `NU1102 Unable to find package Newtonsoft.Json with version (>= 12.0.1) … Versions from nuget.org were not considered`.
+  - Every version of that id used anywhere in the repo has to be in the local feed, or the id has to be mapped to both sources.
+  - VERIFIED: mapping to both worked 3 out of 3 times, and the local feed won each time.
+  - DOCS: which source wins when both hold the same version is not guaranteed.
+- **Every project in the closure needs its lock contentHash rewritten.**
+  - VERIFIED: without it, Lib and App failed with `NU1403 Package content hash validation failed`.
+  - For an unsigned rebuilt package, contentHash = base64(sha512(nupkg)). VERIFIED: restore passed after rewriting it that way.
+- **Global cache poisoning is fatal.** VERIFIED: with upstream 13.0.1 already in the global packages folder, restore failed with `NU1403`, even with `--force`.
+- **No-op restore can hide the problem.** VERIFIED: with `obj/` left from an earlier good restore, restore did nothing and hid the poisoned cache.
+- **The patched copy leaks into other repos.** VERIFIED: an unrelated project with no lock file, using only nuget.org and sharing the same cache, silently got the patched 13.0.1.
+- **Keeping the original signature does not work.** VERIFIED: `NU3005 … signature file entry is invalid … compression method (8)`.
+- **Pack is correct.** VERIFIED: the nuspec says `version="13.0.1"`, so there is no leak.
+
+**B (unique version):**
+- **A prerelease suffix is ruled out.**
+  - VERIFIED: `-socket.1` sorts below the release. It triggered a false vulnerability warning, `NU1903 … 13.0.1-socket.1 has a known high severity vulnerability`.
+  - VERIFIED: next to a dependency that needs ≥12.0.1 it fails with `NU1605 Detected package downgrade: … from 12.0.1 to 12.0.1-socket.1`.
+- **Build metadata does not create a new identity.** VERIFIED: `13.0.1+socket.1` is stripped and resolves as 13.0.1, which is the same as A.
+- **A 4th version part works.** VERIFIED: `12.0.1.1` / `13.0.1.1` had no NU1605 and no false NU1903.
+- **Metadata conditions must go inside a target.** VERIFIED: a `%(Version)` condition on an item Update outside a target fails with `MSB4191`.
+- **Working repo-wide redirect, no csproj edits** (VERIFIED):
+  - `Directory.Build.targets` imports `.socket/vendor/nuget/socket.targets`.
+  - That file has a target with `BeforeTargets="CollectPackageReferences"`, which rewrites any PackageReference with `'%(Identity)'=='Newtonsoft.Json' and '%(Version)'=='13.0.1'` to `13.0.1.1`.
+  - Resulting locks: Lib Direct `[13.0.1.1, )`; App Transitive 13.0.1.1, with its `lib` project entry changed to `[13.0.1.1, )`; a project with a direct 13.0.3 is left alone.
+  - Then a `--locked-mode` restore with an empty cache passes, and build/publish output contains the patched dll.
+- **Old locks fail and must be regenerated for the whole closure.** VERIFIED: `NU1004 The package reference … version has changed`, and on App `NU1004 The project references lib whose dependencies has changed`.
+- **If the vendor feed is unusable, restore silently moves to a different version.**
+  - VERIFIED: with a ≥13.0.1.1 reference and the feed unmapped, NuGet picked 13.0.2 from nuget.org with only `NU1601 … ended up with Newtonsoft.Json 13.0.2`.
+  - VERIFIED: exact brackets `[13.0.1.1]` turn this into a hard `NU1102`.
+- **`RestoreAdditionalProjectSources` only helps when the repo has no source mapping.**
+  - VERIFIED: set from an imported props file, it adds the feed without touching nuget.config.
+  - VERIFIED: when the repo has source mapping, that feed is used only if mapped by its **absolute path**. A relative key failed (NU1102). So nuget.config has to be edited anyway.
+- **Pack leaks the new version to consumers.**
+  - VERIFIED: the nuspec gets `version="13.0.1.1"` (or `[13.0.1.1]` with brackets).
+  - VERIFIED: a consumer with an empty cache then fails with `NU1102`. Without brackets it would drift to 13.0.2 with NU1601.
+  - VERIFIED: a transitive redirect with PrivateAssets=all does not leak.
+
+**C (repo-local package folder):**
+- **`RestorePackagesPath` in Directory.Build.props wins.**
+  - VERIFIED: `RestorePackagesPath=$(MSBuildThisFileDirectory).socket/nuget-packages` beat the NUGET_PACKAGES env var (the env cache stayed empty).
+  - VERIFIED: a pre-extracted patched `newtonsoft.json/13.0.1` was used as is; other packages were downloaded into the repo folder.
+- **The seed can be minimal.** VERIFIED: `.nupkg.metadata` + nuspec + lib/ is enough; the .nupkg and .sha512 are not needed and NuGet does not re-hash the files.
+- **The seed can carry the upstream hash, so the locks stay as they are.** VERIFIED: a `.nupkg.metadata` with the upstream contentHash, with locks untouched, passed `--locked-mode` and the patched dll was built.
+- **It survives forced restores.** VERIFIED: `restore --force --no-cache` left the seed in place.
+- **A CI override bypasses it.**
+  - VERIFIED: with `-p:RestorePackagesPath=…` and the upstream hash in the locks, restore silently downloads the unpatched package.
+  - VERIFIED: with the patched hash in the locks, it fails closed with NU1403.
+- **Fallback folders are unsafe.** VERIFIED: `RestoreFallbackFolders` works with an empty cache, but if the cache already holds upstream 13.0.1, the cache wins and the result is silently unpatched.
+- **Folder name and CI cost** (DOCS): a dot-prefixed folder is excluded from SDK default globs. Every package then lives in the repo, so a `.gitignore` with negation rules is needed and CI caching of the global folder stops helping.
+- **Pack is correct.** VERIFIED: the nuspec says 13.0.1.
+
+## 2. Central Package Management
+
+- **Lock entry types** (VERIFIED):
+  - Transitive packages that have a PackageVersion appear as `"CentralTransitive"` even with pinning off.
+  - Tool showed `requested [13.0.1, )` but `resolved 12.0.1`.
+  - A project with a VersionOverride shows as Direct.
+- **Turning pinning on changes nothing until locks are re-evaluated.** VERIFIED: with existing locks, both `--locked-mode` and a plain restore passed and kept Tool at 12.0.1. Only `--force-evaluate` moved it to 13.0.1.
+- **Redirect without editing Directory.Packages.props** (VERIFIED):
+  - A `<PackageVersion Update="Newtonsoft.Json" Condition="'@(PackageVersion->WithMetadataValue('Identity','Newtonsoft.Json')->WithMetadataValue('Version','13.0.1'))' != ''" Version="13.0.1.1"/>` in the imported targets file works. A non-matching version check did not redirect.
+  - Lib and App moved to 13.0.1.1. The VersionOverride project was untouched.
+  - Without pinning, Tool's requested range became `[13.0.1.1, )` but it still resolved 12.0.1.
+  - With pinning, Tool moved to 13.0.1.1.
+  - Old locks fail with `NU1004 Mistmatch between the requestedVersion of a lock file dependency marked as CentralTransitive…`.
+- **Transitive-only project without pinning** (VERIFIED):
+  - Needs `<PackageReference Include=… VersionOverride="12.0.1.1" PrivateAssets="all"/>` scoped to that project.
+  - `Version=` fails with `NU1008`. If the repo sets `CentralPackageVersionOverrideEnabled=false`, it fails with `NU1013`.
+- **Pinning should not be the patch mechanism.** CPM allows one PackageVersion per id (DOCS). Turning pinning on changes other projects' versions: VERIFIED, Tool went from 12.0.1 to 13.0.1.
+- **Answer to "only Directory.Packages.props?"** No. An imported targets file can do the redirect, but every lock in the closure still has to change.
+
+## 3. packages.config
+
+- **Not testable here.** VERIFIED: `which mono nuget` finds nothing. `dotnet restore` on the solution, on the csproj, and `msbuild -t:restore -p:RestorePackagesConfig=true` all print `Nothing to do. None of the projects specified contain packages to restore.`
+- **How nuget.exe works** (DOCS):
+  - It restores to `<solutionDir>/packages/<Id>.<Version>/`, or to `repositoryPath` if set in nuget.config.
+  - There is no lock file and no contentHash; projects reference dlls through HintPath.
+  - It skips any folder that already holds `<Id>.<Version>.nupkg`.
+- **Verdicts:**
+  - C (pre-seed or commit the `packages/` folder) is the practical option.
+  - B needs every packages.config and HintPath edited.
+  - A with a folder feed works, but the packages/ folder poisons it the same way the global cache does.
+
+## 4. Directory.Build.props/targets injection
+
+- **Only the nearest file is imported.**
+  - VERIFIED: a nested `src/Directory.Build.props` hides the root one.
+  - VERIFIED: chaining with `$([MSBuild]::GetPathOfFileAbove(Directory.Build.props, $(MSBuildThisFileDirectory)..))` restores it.
+  - VERIFIED: the root .targets file is still found independently of the .props.
+  - So the injector must add its Import to the nearest existing file for every project.
+- **A separate imported file works.** VERIFIED: an Exists-guarded `.socket/vendor/nuget/socket.props|targets` worked for all the properties and items above.
+- **Limits outside MSBuild** (DOCS): source mapping can only be set in nuget.config. `Directory.Build.rsp` affects the msbuild CLI only.
+
+## 5. Transitive redirect
+
+VERIFIED: a per-project PackageReference with PrivateAssets=all (or VersionOverride under CPM) changes the lock entry from Transitive or CentralTransitive to Direct, with the new requested range. The parent's dependency line stays the same (Bson still lists `"Newtonsoft.Json": "12.0.1"`). No csproj edits are needed.
+
+## 6. Build, publish and pack
+
+- **Build and publish:** VERIFIED patched dll in the output for A, B (4th part) and C.
+- **Pack:** VERIFIED A and C are correct. B leaks the new version into the nuspec whenever the package is a direct dependency of a packable project.
+
+## 7. Floating versions and ranges
+
+- **Resolution:** VERIFIED `13.0.*` and `13.*` resolve 13.0.4 today; `[13.0.1,14.0)` resolves 13.0.1.
+- **Lock files win:** VERIFIED a plain restore with an existing lock keeps the locked versions.
+- **4th-part versions are not picked up on their own:** VERIFIED 13.0.1.1 was not chosen for the range with `--force-evaluate`, so B has to replace the floating spec with the exact version.
+- **A and C patch whatever the lock resolved:** DOCS/inferred, re-evaluating after upstream publishes a newer version silently drops the patch.
+
+## Verdicts
+
+| Shape | A (same version) | B (4th-part version + redirect) | C (repo-local packages folder) |
+|---|---|---|---|
+| Multi-project sln | Fragile: id-wide mapping, hash rewrite in every lock, cache poisoning and leaks to other repos | Works with the imported-targets redirect and exact brackets; locks must be regenerated; pack leaks | Works and is isolated from the global cache; a CI override bypasses it |
+| CPM | Same as sln | Works with a PackageVersion Update; transitive-only projects need VersionOverride; the pinning trap | Works |
+| packages.config | Poor | Heavy edits | Best (seed `packages/`) |
+| Transitive-only | Automatic (id-based) | Per-project redirect, lock type becomes Direct | Automatic |
+| pack/consumers | Correct | Leaks the new version | Correct |
+| Floating/ranges | Tied to the lock | Must pin exactly | Tied to the lock |
+
+## What this means for a patched copy with the upstream id+version
+
+- **Same id+version is inherently unsafe in any shared cache.** Both the global packages folder and the packages/ folder are keyed on id/version alone. Every A failure seen here comes from that: NU1403 poisoning, silent leaks into other repos, per-id mapping breaking other versions.
+- **The same identity is only safe in a cache the repo owns (C).**
+  - Recommended form: an Exists-guarded `RestorePackagesPath` import chained into every nearest Directory.Build.props.
+  - Seed a minimal extracted package.
+  - Write the patched contentHash into both `.nupkg.metadata` and the locks, so that bypassing the folder fails closed (NU1403) instead of silently restoring upstream.
+  - Do not use fallback folders.
+- **If a unique version (B) is used:**
+  - Use a 4th version part, never a prerelease suffix or `+metadata`.
+  - Pin it with exact brackets.
+  - Apply the redirect through an imported targets file, not csproj edits.
+  - Regenerate the locks for the whole closure.
+  - Handle the pack leak, for example by limiting B to non-packable projects.
\ No newline at end of file
diff --git a/docs/design/nuget-vendoring-research/signing.md b/docs/design/nuget-vendoring-research/signing.md
new file mode 100644
index 00000000..810aa2ef
--- /dev/null
+++ b/docs/design/nuget-vendoring-research/signing.md
@@ -0,0 +1,102 @@
+# NuGet signing and verification when vendoring a patched same-id+version nupkg
+
+**Headline:** once we change a package we have to drop its `.signature.p7s`. Keeping it fails restore with NU3008, even on Linux with no special settings. Dropping it works under the default policy but fails under `require` with NU3004. Signing, or not signing, never changes the lock `contentHash`. That means we can sign with a Socket certificate and keep lock pinning as it is.
+
+Setup: .NET SDK 8.0.131 on Linux. Each experiment had a fresh HOME, NUGET_PACKAGES and NUGET_HTTP_CACHE_PATH under `exp/<name>/`. The test package was Newtonsoft.Json 13.0.3 from nuget.org, which is author-signed and carries the nuget.org repository countersignature. The "patch" appends bytes to `lib/net6.0/Newtonsoft.Json.dll`. Restores used a single local folder feed (`<clear/>`) with `RestorePackagesWithLockFile`.
+
+## Environment
+- **VERIFIED:** signature verification is on by default on Linux with SDK 8. `dotnet nuget verify` prints `X.509 certificate chain validation will use the fallback certificate bundle at '/usr/lib/dotnet/sdk/8.0.131/trustedroots/codesignctl.pem'`. A tampered signed package fails restore with no env var or config set.
+- **VERIFIED:** the certificate revocation servers can't be reached from here. Genuine packages only get NU3018/NU3028 `RevocationStatusUnknown` warnings, even in `require` mode.
+- **VERIFIED:** timestamp.digicert.com returns HTTP 403 through the proxy, so I could not test timestamped signing.
+
+## (a) Keeping vs dropping `.signature.p7s` (default mode, `accept`)
+- **VERIFIED:** modified dll with the signature kept fails: `error NU3008: ... The package integrity check failed. The package has changed since it was signed.`
+- **VERIFIED:** re-zipping with no content change and the signature kept also fails with NU3008. The signature covers the zip bytes, not just the file contents.
+- **VERIFIED:** modified dll with the signature dropped installs cleanly, with no warnings.
+- **VERIFIED:** `DOTNET_NUGET_SIGNATURE_VERIFICATION=false` turns verification off entirely. The tampered, still-signed package then installs.
+- **VERIFIED:** if the signature entry has non-zero external file attributes (Python `zipfile` writes `0o600<<16` by default), restore only warns (`NU3005: The package signature file entry is invalid ... 'external file attributes' has an invalid value (25165824)`) and installs the package as if it were unsigned.
+
+## (b) `require` mode (enterprise setup)
+The config was `signatureValidationMode=require` plus a `<trustedSigners><repository name="nuget.org" serviceIndex="https://api.nuget.org/v3/index.json">` entry with the three nuget.org repository certificate fingerprints (SHA256 `0E5F38F5…`, `5A2901D6…`, `1F4B311D…`).
+
+- **VERIFIED:** the genuine package installs even from a local folder feed. Repository trust is tied to the certificate, not the source URL.
+- **VERIFIED:** the unsigned patched package fails: `error NU3004: ... signatureValidationMode is set to require, so packages are allowed only if signed by trusted signers; however, this package is unsigned.`
+- **VERIFIED:** the patched package with the upstream signature kept fails with NU3008.
+- **VERIFIED:** `DOTNET_NUGET_SIGNATURE_VERIFICATION=false` overrides `require`, and the unsigned package installs.
+- **VERIFIED:** config precedence. With `require` in the user-level `~/.nuget/NuGet/NuGet.Config` and `accept` in the repo's `nuget.config`, the unsigned package installs, so a repo config can weaken the policy. With `require` at user level only, it fails with NU3004.
+- **VERIFIED:** `trustedSigners` add up across config levels. The user level had `require` plus the nuget.org `<repository>`; the repo level added only an `<author>`. Both the Socket-signed patched package and genuine nuget.org packages installed.
+- **VERIFIED:** if the global packages folder already holds the extracted patched package, restore succeeds under `require` with no check at all. Signatures are only verified when a package is extracted into that folder.
+- **DOCS:** `require` mode has no per-package or per-source exemption. `trustedSigners` entries are per certificate: an `<author>` fingerprint, or a `<repository>` fingerprint with optional `<owners>`. `allowUntrustedRoot` only relaxes chain building for a listed certificate; it does not let unsigned packages through.
+
+## (c) Signing with a self-signed certificate (`dotnet nuget sign`)
+I made the certificate with `openssl req -x509` (extended key use codeSigning, key use digitalSignature) and exported it to a pfx.
+
+- **VERIFIED:** signing works on Linux in about 1.1 s with exit code 0. `dotnet nuget sign moddrop.nupkg --certificate-path cert.pfx --certificate-password pw -o signed` warns NU3002 (no timestamper), NU3042 (root not in the codesignctl.pem bundle) and `NU3018: UntrustedRoot: self-signed certificate`.
+- **VERIFIED:** restore results for the signed patched package:
+
+| Config | Result |
+|---|---|
+| Default `accept`, nothing trusted | Installs, with warnings NU3018 ("signing certificate is not trusted by the trust provider"), NU3027 (not timestamped) and NU3042 |
+| `require` + `<author>` fingerprint, `allowUntrustedRoot="false"` | `error NU3018` |
+| `require` + `<author>` fingerprint, `allowUntrustedRoot="true"` | Installs, only a NU3027 warning |
+| `require`, no `<author>` | `error NU3018` plus `error NU3034: This package is signed but not by a trusted signer` |
+
+- **VERIFIED:** re-signing a package that still has the upstream signature fails without `--overwrite` (`NU3001: The package already contains a signature`). With `--overwrite` it succeeds and installs under `require` with the author trusted.
+- **VERIFIED:** `dotnet nuget sign` writes a valid signature entry even when the input zip has Python-style attributes.
+- **VERIFIED (from `--help`):** the CLI can only create author signatures, so we cannot make a repository signature like nuget.org's. **DOCS:** repository signing exists only in the NuGet.Packaging API.
+- **DOCS:** a signature without a timestamp stops being valid when the certificate expires.
+- **Cost:** about a second per package, and no system trust store changes are needed. The user does have to add one `<author>` entry with `allowUntrustedRoot="true"` if they use `require`.
+
+## (d) `dotnet nuget verify --all` (all VERIFIED)
+- Unsigned: `error: NU3004: The package is not signed.` (exit 1)
+- Modified with the upstream signature kept: prints `Signature type: Author` and `Signature type: Repository`, then `error: NU3008` (exit 1).
+- Self-signed: `error: NU3018 ... not trusted by the trust provider` (exit 1). `--certificate-fingerprint` alone does not change that. With `--configfile` pointing at a config that has the `<author allowUntrustedRoot="true">` entry, it exits 0 with only a NU3027 warning.
+- Genuine: `Successfully verified package`, with revocation warnings.
+
+## (e) Global packages folder metadata and `contentHash`
+- **VERIFIED:** the package's folder holds `.nupkg.metadata` (`{version:2, contentHash, source}`), `<id>.<ver>.nupkg.sha512`, a byte-identical copy of the nupkg, and an extracted `.signature.p7s`. The metadata records nothing about the signer.
+- **VERIFIED: the lock `contentHash` does not depend on the signature file.** This corrects the assumption in the brief.
+  - For signed packages, `contentHash` is the SHA-512 of the archive with the `.signature.p7s` entry removed from both the file data and the central directory, and the end-of-archive record offsets and counts adjusted. My `signed_content_hash.py` reproduces the upstream `HrC5BXdl…zQ==` exactly.
+  - That differs from SHA-512 of the whole file (`mbJSvHfR…kg==`), which is what `.nupkg.sha512` stores.
+  - The unsigned patched package, the Socket-signed one and the re-signed one all produce the same `contentHash` (`Lb2f3WlJ…`), equal to SHA-512 of the unsigned file.
+  - `dotnet nuget sign` appends the signature and leaves every other byte unchanged. Swapping signed and unsigned files passes `--locked-mode`.
+- **VERIFIED:** when the global packages folder already has upstream and the lock pins the patched hash, `--locked-mode` fails with `error NU1403: Package content hash validation failed`. Without a lock file, restore silently uses upstream and writes the upstream hash into the new lock.
+
+## (f) Zip layout and packaging metadata files (all VERIFIED; unsigned packages in `accept` mode all installed)
+- These variants all restored fine:
+  - `.psmdcp` removed, even though `_rels/.rels` still points to it
+  - `_rels/.rels` and `.psmdcp` both removed
+  - `[Content_Types].xml` removed
+  - all three removed
+  - a new file with an extension not listed in `[Content_Types].xml` (`.patchmeta`, extracted to `lib/net6.0/`)
+  - entries in reverse order
+  - all entries stored without compression
+- The version with all three files removed, then self-signed, installed under `require`. The console app built with `-m:1`, ran, and the copied dll ended with the patch marker.
+- The global packages folder never contains `[Content_Types].xml`, `_rels` or `.psmdcp`.
+- Every layout change produced a different `contentHash`, so the repack must be deterministic for the hash to be reproducible.
+- **DOCS:** other tools that read these files the Office-document way (older `nuget.exe push`, Package Explorer) may still expect them. Keeping them, and adding a `Default` entry for any new extension, costs nothing.
+
+## Implications for each vendoring mechanism
+1. **Same id+version, unsigned (current approach).**
+   - Works under `accept`. Always fails under `require` (NU3004), with no per-package exemption.
+   - The upstream `.signature.p7s` must always be removed (NU3008). A hand-written signature entry with non-zero attributes is silently treated as unsigned.
+   - The lock pin, plain SHA-512 of the file, is correct for unsigned packages.
+   - The main risk is a collision with an existing copy in the global packages folder (NU1403 in locked mode, silently using upstream otherwise). That comes from reusing id+version, not from signing.
+2. **Same id+version, signed by Socket or a repo-local author certificate.**
+   - The lock hash is unaffected, and signing is cheap.
+   - Under `accept` the only cost is warnings: NU3018/NU3042 go away only if the certificate chains to a root in the SDK bundle, and NU3027 goes away only with a timestamp.
+   - Under `require` the user needs one `<author>` entry with `allowUntrustedRoot="true"` for a self-signed certificate. It can go in the repo's `nuget.config` because it merges with the enterprise-level `trustedSigners`. This is the setup to document for enterprises.
+   - A self-signed or repo-local key is only as trustworthy as whoever can write to the repo.
+   - A CA-issued Socket code-signing certificate with a timestamp would remove `allowUntrustedRoot` and the warnings. Signing could happen on Socket's server, because the signature does not affect the lock hash. We cannot reproduce the nuget.org repository signature.
+3. **Pre-filling the global packages folder or a fallback folder.** This skips verification even under `require`, which means it quietly gets around enterprise policy. We should not document it.
+4. **A renamed id or new version (e.g. `13.0.3-socket.1`).** The signing situation is the same (unsigned fails NU3004 under `require` unless Socket-signed), but it removes the global-folder and lock collisions. This is inferred, not run.
+5. **Overrides we should not recommend.** `DOTNET_NUGET_SIGNATURE_VERIFICATION=false` and a repo-level `signatureValidationMode=accept` both work, but both quietly weaken an organization's policy. The tool should detect an effective `require` and fail with a clear message pointing to the `<author>` instruction.
+
+Everything is in `<scratch>/research/signing/`:
+- `FINDINGS.md` — full notes with commands and output
+- `env.sh`, `run.sh` — setup and restore scripts
+- `repack.py` — rebuilds the test packages
+- `signed_content_hash.py` — the signed-package hash calculation
+- `cert/` — the test certificate
+- `v/`, `signed*/` — the package variants
+- `exp/<name>/` — one folder per experiment
\ No newline at end of file
diff --git a/docs/design/nuget-vendoring-research/sources.md b/docs/design/nuget-vendoring-research/sources.md
new file mode 100644
index 00000000..dae0627e
--- /dev/null
+++ b/docs/design/nuget-vendoring-research/sources.md
@@ -0,0 +1,134 @@
+# NuGet sources, packageSourceMapping and nuget.config research (SDK 8.0.131, NuGet 6.8.2)
+
+The tool harness refused to let me write `FINDINGS.md`, so the notes are below instead of in that file. The experiment dirs, helpers (`env.sh`), test packages and the delayed-HTTP feed server are under `<scratch>/research/sources/` (in `exp/`, `pkgs/` and `httpfeed/server.py`). Every experiment ran with a fresh HOME, NUGET_PACKAGES, NUGET_HTTP_CACHE_PATH and DOTNET_CLI_HOME.
+
+To tell which bytes won, I read `gpf/<id>/<ver>/SOCKET_PATCHED.txt` and the `source` field in `.nupkg.metadata`. "gpf" below means the global packages folder (`~/.nuget/packages`).
+
+**Command not available:** `dotnet nuget config paths` does not exist in 8.0.131. It fails with `error: Unrecognized command or argument 'config'` (VERIFIED). I used `dotnet restore -v:n` (the "NuGet Config files used" and "Feeds used" lines) and strace instead.
+
+## (a) Local folder feeds
+
+**Flat feed**
+- A file named `<id>.*.nupkg` resolves. The filename match is case-insensitive (`Newtonsoft.Json.13.0.3.nupkg`, lowercase and UPPERCASE all worked). Even `Newtonsoft.Json.13.0.3-whatever.nupkg` worked, because the version comes from the nuspec inside the package (VERIFIED).
+- These fail with NU1101 (VERIFIED):
+  - `zzz-random.nupkg`
+  - `Newtonsoft.Json.nupkg`
+  - a nupkg in a subdirectory (the flat feed is not recursive)
+
+**Hierarchical feed (`<id>/<ver>/`)** (VERIFIED)
+- It needs three files:
+  - the lowercase nupkg,
+  - `.nupkg.sha512`, which acts as the existence marker (nupkg + nuspec without it gives NU1101),
+  - `<id>.nuspec` (nupkg + sha512 without it gives `error NU5037: The package is missing the required nuspec file`).
+- **Linux needs lowercase.** A `Newtonsoft.Json/13.0.3/Newtonsoft.Json.13.0.3.nupkg` layout gives NU1101.
+- **The `.sha512` content is not trusted.** I put garbage in it, and the gpf and lock contentHash still came out as the real SHA512 of the nupkg (`dkeh7b…`). NuGet re-hashes the package on install.
+- **Dependencies come from the loose `.nuspec`, not the one inside the nupkg.** A loose nuspec with an extra dependency made restore pull Humanizer.Core. The nuspec extracted into gpf had no such dependency. So the loose nuspec must be byte-identical to the inner one.
+
+**`dotnet nuget push -s <dir>`** (VERIFIED)
+- An empty dir gets a flat file, `Newtonsoft.Json.13.0.3.nupkg`.
+- A dir that already has one full hierarchical entry (nupkg + nuspec + sha512) gets a full expanded entry: lowercase dirs, `.nupkg.sha512`, nuspec, `.nupkg.metadata` and all extracted files. It is not a `nuget add`-style minimal entry.
+
+**Performance:** a flat feed with 1 vs 201 `Newtonsoft.Json.*` files restored in 236–263 ms either way (VERIFIED). The difference doesn't matter at our scale.
+
+**Signatures**
+- Keeping the original `.signature.p7s` on modified contents gives `error NU3008: The package integrity check failed. The package has changed since it was signed.` This happens even under the default `accept` mode (VERIFIED). The signature must be dropped.
+- An unsigned package under `signatureValidationMode=require` gives `error NU3004 ... this package is unsigned` (VERIFIED).
+
+**Global packages folder poisoning** (VERIFIED)
+- I restored upstream 13.0.3, then switched the config to only the patched feed and ran `restore --force`. There was no error, the gpf entry stayed upstream (`source: https://api.nuget.org/...`), and the assets file kept the upstream hash. A matching id+version in gpf means the feeds are never asked.
+- With the patched contentHash in the lock file, `--locked-mode` gives `error NU1403: Package content hash validation failed ... different than the last restore`. Upstream was still written to gpf. After that, restoring with the patched feed also fails NU1403 until the gpf entry is deleted.
+
+## (b) packageSourceMapping
+
+**Exclusivity** (VERIFIED)
+- Once any mapping exists, a package that no pattern matches fails: `error NU1100: Unable to resolve 'Humanizer.Core (>= 2.14.1)' ... PackageSourceMapping is enabled, the following source(s) were not considered: loc, nuget.org.`
+- The catch-all is skipped for an id that a more specific pattern matches. With `nuget.org:*`, `loc:Newtonsoft.Json` and an empty loc, the result is `NU1101 ... No packages exist with this id in source(s): loc ... not considered: nuget.org`. There is no fallback.
+
+**Pattern precedence** (VERIFIED)
+- The longest prefix wins: `Newtonsoft.Js*` on loc beats `Newtonsoft.*` on nuget.org.
+- An exact id beats a prefix: `Newtonsoft.Json` on nuget.org beats `Newtonsoft.*` on loc.
+- If the same pattern is on two sources, both are eligible. With loc empty it silently falls back to nuget.org; with both holding the package, it becomes the race described in (d).
+- Pattern matching is case-insensitive. The source key is case-sensitive: a mapping for `LOC` against a source `loc` gives NU1100.
+
+**Missing or disabled source** (VERIFIED)
+- A mapping to a key with no `<add>` entry gives NU1100.
+- A mapping to a source that exists but is disabled also gives NU1100.
+
+**Multiple config files** (VERIFIED)
+- **A user-level mapping silently hides a repo source that has no mapping.** User `~/.nuget/NuGet/NuGet.Config` mapped `nuget.org:*`; the repo added `loc` with no mapping. Upstream was installed with no error.
+- **Different keys combine across files.** User `nuget.org:*` plus repo `loc:Newtonsoft.Json` gave the patched package.
+- **The same key in a nearer file replaces the farther file's patterns.** User `nuget.org:{*, Newtonsoft.Json}` plus repo `nuget.org:{Humanizer.*}` made Newtonsoft.Json fail NU1100.
+- **`<clear/>` inside `<packageSourceMapping>` drops the user-level mappings.** Anything the repo file doesn't map then fails NU1100.
+
+## (c) nuget.config precedence
+
+**Discovery** (VERIFIED, strace): NuGet probes `nuget.config`, `NuGet.config` and `NuGet.Config` in every ancestor directory up to `/`. It then reads:
+- `$HOME/.nuget/NuGet/NuGet.Config`
+- `$HOME/.nuget/NuGet/config/` (a directory of extra user-level configs)
+- `/etc/opt/NuGet/Config/` (machine-wide)
+- `/etc/opt/NuGet/NuGetDefaults.config`
+
+**File-name casing on Linux** (VERIFIED)
+- `nuget.config`, `NuGet.config` and `NuGet.Config` all work. `NUGET.CONFIG` and `Nuget.Config` are ignored.
+- If several are in one directory, only one is read, in the order `nuget.config` > `NuGet.config` > `NuGet.Config`.
+
+**Merging** (VERIFIED)
+- Configs are merged and applied from farthest to nearest.
+- `<clear/>` in `packageSources` removes only sources from farther files. In the child it removes the parent's and the user's sources; in the parent it removes only the user's.
+- A relative source value (`./feed`) resolves against the directory of the config file that declares it.
+
+**`--source` and `RestoreSources`** (VERIFIED)
+- Both replace the configured sources, but the mapping still applies.
+- A `--source` value equal to a configured source's value takes that source's key and mapping.
+- An unconfigured path is named by its path, so it matches no mapping and fails NU1100 (`not considered: /other, nuget.org`).
+- `-p:RestoreSources=<nuget.org URL>` drops loc, so Newtonsoft.Json fails NU1100.
+
+## (d) Same id+version from two sources, no mapping (VERIFIED)
+- **Local folder vs nuget.org:** the local folder won every time, in both config orders and with a cold or warm HTTP cache (4 runs each).
+- **Two local folders:** the first-listed one won 6/6 times, and swapping the order flipped the result.
+- **Local HTTP feed:** with 0 s delay it won in both orders. With 3 s delay it lost to nuget.org in both orders.
+
+Conclusion: the first source to respond wins, so the result depends on timing and is nondeterministic on real networks.
+
+## (e) RestoreAdditionalProjectSources in Directory.Build.props (VERIFIED)
+- **With no mapping anywhere:** the source is added (it shows in "Feeds used") and joins the race.
+- **With any mapping** (e.g. `nuget.org:*`): it is ignored and upstream is installed silently.
+- **A mapping keyed by the absolute path works.** A relative value is named by its resolved absolute path, so a mapping keyed `feed` fails NU1100. This setup can't be committed portably.
+
+## (f) Giving the patched package a unique version
+
+**It resolves only from our feed** (VERIFIED)
+- `13.0.3-socket.1` resolved from loc with no mapping.
+- `13.0.3.1-socket.1` resolved from an HTTP feed with 3 s delay even though nuget.org was faster (restore took 9.95 s). There is no race when only one source has the version.
+
+**When our feed is missing** (VERIFIED)
+- An exact `[13.0.3.1]` or `[13.0.3-socket.1]` gives `error NU1102: Unable to find package Newtonsoft.Json with version (= 13.0.3.1) - Found 0 version(s) in loc - Found 86 version(s) in nuget.org [ Nearest version: 13.0.4-beta1 ]`.
+- A plain `13.0.3-socket.1` gives `warning NU1603 ... approximate best match of Newtonsoft.Json 13.0.3 was resolved` (upstream, silently).
+- A plain `13.0.3.1` gives NU1603 and resolves upstream **13.0.4**.
+
+**Interaction with other packages' dependency ranges** (VERIFIED)
+- A dependency asking `>=13.0.1` plus a direct `13.0.3-socket.1` is fine.
+- A dependency asking `>=13.0.3` plus a direct `13.0.3-socket.1` gives `error NU1605: Warning As Error: Detected package downgrade: Newtonsoft.Json from 13.0.3 to 13.0.3-socket.1`. A prerelease sorts below its base version.
+- A dependency asking `>=13.0.3` works with a direct `13.0.3.1` and with `13.0.3.1-socket.1`. The latter sorts above 13.0.3 and below 13.0.4, and also below any future upstream 13.0.3.1.
+- `13.0.3+socket.1` (build metadata) is treated as 13.0.3 and came from nuget.org, so it is useless.
+
+**Transitive-only use needs a pin** (VERIFIED)
+- If only a dependency references it (`>=13.0.1`), restore picks upstream 13.0.1.
+- Central Package Management works: `ManagePackageVersionsCentrally` + `CentralPackageTransitivePinningEnabled` + `PackageVersion 13.0.3.1-socket.1` gave the patched package with no direct reference.
+
+**No cache collision:** the unique version gets its own gpf dir (`newtonsoft.json/13.0.3.1-socket.1`), so it can't collide with a cached upstream 13.0.3 (VERIFIED).
+
+## What this means for vendoring a patched copy with the same id+version
+
+1. **Same id+version can't be made robust.**
+   - gpf wins silently, even with `--force` (VERIFIED).
+   - A poisoned gpf, CI cache or shared runner gives permanent NU1403 or silent unpatched builds (VERIFIED).
+   - Without a mapping the winner is timing-dependent (VERIFIED).
+   - A mapping can be undone by a user-level, CI or ancestor-dir config: an unmapped repo source, a replaced pattern list for the same key, `<clear/>`, or `--source` / `RestoreSources` (all VERIFIED).
+   - The current catch-all `*` workaround turns every package no pattern matches into an NU1100 risk once another config adds its own mapping.
+2. **A unique version is deterministic** and needs no `packageSourceMapping`. Use `X.Y.Z.N-socket.M` (4-part base plus prerelease tag), not `X.Y.Z-socket.N` (NU1605 against any `>=X.Y.Z` dependency) and not `+meta` (same identity as upstream).
+   - Reference it with an exact bracket `[v]` (via `Directory.Packages.props` with transitive pinning, or a direct PackageReference), so a missing vendor dir fails hard with NU1102 instead of the NU1603 silent upgrade to upstream (VERIFIED).
+   - Revert is just restoring the original version string; no gpf cleanup is needed.
+   - Trade-offs (DOCS/inference): the lock file changes version and contentHash, and packable libraries would publish a dependency on a version consumers can't get.
+3. **Feed format:** prefer a flat folder with `<id>.<ver>.nupkg`, which needs no sidecar files (VERIFIED). A hierarchical feed needs a lowercase path, a `.sha512` marker (its content is ignored) and a loose nuspec byte-identical to the inner one (VERIFIED). Declare the feed with a relative path in a lowercase `nuget.config` at the repo root (VERIFIED). Don't use `RestoreAdditionalProjectSources` (VERIFIED).
+4. **Signatures:** always strip `.signature.p7s` (NU3008 otherwise). Repos using `signatureValidationMode=require` will reject any rebuilt package (NU3004), so detect that and refuse.
\ No newline at end of file
diff --git a/docs/design/nuget-vendoring.md b/docs/design/nuget-vendoring.md
new file mode 100644
index 00000000..67c3f329
--- /dev/null
+++ b/docs/design/nuget-vendoring.md
@@ -0,0 +1,914 @@
+# NuGet vendoring v2: unique-version fallback seed
+
+**Status:** draft, revision 3. Revision 2 added the four adversarial reviews (§16). Revision 3 records where the prototype overrides the design (§0). Vendored NuGet redesign stays future work for v5 (see `v5-plan.md`). This document lands on its own; the prototype code lives on the branch [`v5/nuget-vendoring-prototype`](https://github.com/SocketDev/socket-patch/tree/v5/nuget-vendoring-prototype) and is not merged.
+
+---
+
+## 0. Where the prototype overrides this design
+
+The prototype on the branch [`v5/nuget-vendoring-prototype`](https://github.com/SocketDev/socket-patch/tree/v5/nuget-vendoring-prototype) was built after the design review. Building it and testing it against real `dotnet` changed several decisions. When anything below conflicts with this table, **this table wins**. The full list is in §17.
+
+| Design text | Prototype (authoritative) | Why |
+|---|---|---|
+| `.socket/vendor/nuget` is listed as an "anchor" fallback folder, so restore fails with NU1301 when it is missing (§6.3, G12) | **Removed.** The DBP block now holds a `SocketPatchNuGetImportCheck` target that fails restore with **SOCKETPATCH007** when `socket-patch.targets` was not imported | With the anchor, anyone could plant `<id>/<ver>/` next to the uuid dirs and NuGet would restore it under `--locked-mode` with no seed check. The security review reproduced this on SDK 8. SOCKETPATCH007 is proven by e2e for both locked and unlocked restore. |
+| V′ carries a builder bit: `N = 2^30 + ((u32 >> 3) << 1) + builder` (§6.1) | `N = 2^30 + (u32(uuid[0..8]) >> 2)`, with **no builder bit** | contentHash is `base64(sha512(canonical zip of the seed file set))`. It does not depend on whether the bytes came from the service or a local rebuild, so one uuid gives one V′ and one hash. |
+| Seed dirs named by uuid8 (§6.2) | Full canonical uuid: `.socket/vendor/nuget/<uuid>/<idlower>/<V′>/` | Keeps `vendor_uuid_dir_rel`, the orphan sweep and the path parsers unchanged. Long Windows paths are still an open item (G8). |
+| `--nuget-layout` flag on `GlobalArgs`, and a `nugetShared` ledger section (§5, §6.7) | Opt in with `SOCKET_PATCH_NUGET_LAYOUT=fallback`, or automatically once the ledger has a `nuget-fallback` entry. A purl the ledger holds as a legacy feed entry keeps the feed layout. Shared outputs are rendered from the per-uuid markers, using the ledger `fileInventory` when there is one. | Keeps the prototype contained in the core backend with a few CLI routing lines. It needs no new ledger schema. |
+| Lock revert from per-edit records (§6.5, §7.4) | One `nuget_lock_file_v2` record per lock. Revert **unsplices only this entry's V′ values**, back to the recorded originals. | Seeds that share a lock can be reverted in any order, and edits made after vendoring are kept. |
+| SOCKETPATCH003/004/006, per-project transitive pins, `--check`, pack range restore, VEX extractor | Not in the prototype. Transitive-only use refuses with `vendor_nuget_transitive_only` (CPM with transitive pinning is supported). | Scope (§15 was too large for one PR). |
+
+## 1. Status and summary
+
+**Status.** Proposed. This design ships as an opt-in layout, `--nuget-layout=fallback`, next to today's feed layout. Today's layout stays the default until the promotion criteria in §15 are met. Hosted mode is unchanged. packages.config projects stay on the legacy layout. A repo that has both packages.config and SDK projects using the same id@V is refused (§5).
+
+**Summary.** The patched package gets its own version, V′, that nothing else can produce. For a stable 3-part upstream version, V′ adds a 4th part derived from the patch uuid, for example `13.0.1` → `13.0.1.1340506222`. The package is committed already extracted, as a NuGet fallback package folder at `.socket/vendor/nuget/<uuid8>/<idlower>/<V′>/`.
+
+The CLI adds one generated block to the nearest `Directory.Build.props` (DBP) of every SDK project. The block has three parts:
+- It appends `.socket/vendor/nuget/socket-patch.targets` to `CustomAfterDirectoryBuildTargets`. MSBuild imports that property after the whole `Directory.Build.targets` chain.
+- It adds a restore-time `SocketPatchNuGetImportCheck` target. If the targets file was not imported, for example because `.socket/vendor/nuget` is missing, restore fails with SOCKETPATCH007. (§0: this replaces the original anchor fallback folder.)
+- It adds one literal uuid comment per patch.
+
+The generated targets file does five things:
+1. It adds each uuid8 directory to `RestoreAdditionalProjectFallbackFolders`.
+2. It redirects the planned references to the floor range `[V′, )`, using evaluation-time `Update` and `Include` items. Direct references, CPM `PackageVersion`, and TFM-conditioned transitive pins are all handled. An exact `[V′]` is not used, because it spreads through ProjectReference (§16, S-B1).
+3. At restore time, it checks that the files in the seed are exactly the recorded set and have the recorded hashes (SOCKETPATCH001/002).
+4. At build time, it checks the files that were actually consumed:
+   - where they resolved from, and whether their content matches (SOCKETPATCH003);
+   - whether the project resolved the unpatched V (SOCKETPATCH005);
+   - whether a project where a redirect engaged resolved anything other than V′ (SOCKETPATCH006).
+5. It writes the original version range back into packed nuspecs, checks the nuspec before and after pack, and deletes a nupkg that leaks V′ (SOCKETPATCH004).
+
+The CLI also edits, entry by entry, every lock whose graph contains a redirected project. It writes `.socket/vendor/nuget/.gitattributes` so that git stores the seed bytes exactly as written.
+
+**Why this shape:**
+- The global packages folder (GPF) is never read or written for the patched package. Every other package keeps its normal GPF and caches.
+- `nuget.config` is never edited in the fallback tier.
+- Source mapping, user, CI and ancestor configs, `--source`, `NUGET_PACKAGES`, `--packages` and `locals --clear` do not affect the patched package.
+- Revert is deterministic: remove the generated block, restore the recorded lock entries, delete the seed. No cache eviction is needed.
+
+**What the lock gives, and what it does not.** In the fallback tier the lock `contentHash` is compared only with the committed `.nupkg.metadata`, so it pins version identity only. Byte integrity comes from three checks:
+- the restore-time set-and-hash check of the seed;
+- the build-time check of consumed files;
+- `vendor --check --online`, which rebuilds the expected seed from an anchor outside the repo (§7.3).
+
+**Enterprise `signatureValidationMode=require`.** A fallback folder is never signature-verified. These repos need the feed tier (§10). That tier is out of prototype scope and waits on depscan's CA-issued signing.
+
+## 2. Background: verified NuGet facts
+
+The research reports cited below, for example `lock-cache §c`, `sources §b` and `adv-env`, are committed in [`nuget-vendoring-research/`](nuget-vendoring-research/). They are the raw notes of the parallel research agents and the adversarial reviewers. `<scratch>` paths in them refer to the throwaway sandbox the experiments ran in.
+
+All runs used .NET SDK 8.0.131 (NuGet 6.8.2) on Linux. Labels:
+- **VERIFIED**: run in the original research; the report is cited.
+- **VERIFIED-D / -C**: run by the candidate authors.
+- **VERIFIED-ADV**: run by the adversarial reviewers: `adv-shapes eN`, `adv-env`, `adv-integrity xN`, `adv-lifecycle VN`.
+- **DOCS**: documentation only.
+- **REASONED**: inferred from code or from verified facts; not run.
+- **UNVERIFIED**: a proposal waiting on a gating experiment (§14).
+
+### 2.1 Why the same id+version cannot be made safe
+| Fact | Status |
+|---|---|
+| The GPF is keyed by id/version only. The first writer wins, and the entry is never refreshed, even with `--force --no-cache --force-evaluate`. | VERIFIED lock-cache §c, sources §a |
+| A failed `--locked-mode` restore (NU1403) still extracts the wrong copy into the GPF. | VERIFIED lock-cache §b |
+| Lock `contentHash` is compared only with `.nupkg.metadata`. A tampered dll passes locked restore. | VERIFIED lock-cache §b/§c; VERIFIED-ADV x1 (a seed) |
+| Patched bytes leak to other lockless projects on the same GPF, and the reverse happens too. | VERIFIED lock-cache §c, shapes §1A |
+| For the **same** id+version, the GPF beats a fallback folder. This is also true for V′: a GPF copy of V′ wins over the seed. | VERIFIED lock-cache §e; VERIFIED-ADV x2, adv-env M1 |
+| A fallback folder is used in place and never copied into the GPF. The minimum content is `.nupkg.metadata`, the nuspec and `lib/`. NuGet enumerates the whole directory, so extra `build/` files are imported. | VERIFIED lock-cache §e; VERIFIED-D V-D1/2; VERIFIED-ADV x1 |
+| A missing folder in `RestoreAdditionalProjectFallbackFolders` gives NU1301 in every project that imports it. | VERIFIED-ADV V2 |
+| Restore ignores missing imports. It rewrites locks to upstream, and only `build` fails with MSB4019. | VERIFIED-ADV V3 |
+
+### 2.2 Source routing is fragile
+| Fact | Status |
+|---|---|
+| Source mapping is exclusive and matches by id, not version. Mapping an id to a local feed breaks the id's other versions (NU1102). | VERIFIED sources §b |
+| When two sources hold the same id+version, the first to respond wins, so the result is nondeterministic. | VERIFIED sources §d |
+| A user-level mapping hides an unmapped repo source. A nearer file replaces a farther file's patterns for the same key. `<clear/>` drops farther levels. | VERIFIED sources §b/§c |
+| Config probing covers 3 spellings in every ancestor, then user, `config/*.config` and machine files. | VERIFIED sources §c |
+
+### 2.3 Version identity
+| Fact | Status |
+|---|---|
+| `X.Y.Z+meta` collides with X.Y.Z. `X.Y.Z-socket.N` sorts below X.Y.Z, which gives NU1605 and a false NU1903. | VERIFIED lock-cache §g, shapes §1B |
+| A 4-part `X.Y.Z.N` gets its own GPF directory and sorts above X.Y.Z. It works as a direct reference and as a CentralTransitive pin. | VERIFIED lock-cache §g, shapes §1B |
+| NuGetAudit still flags V′ whenever the advisory's vulnerable range includes V′. Example: `12.0.1.N` against the `< 13.0.1` advisory. "No false NU1903" holds only when the fix is V's next release. | VERIFIED-ADV e1, V1 (this corrects revision 1) |
+| An exact `[V′]` spreads through ProjectReference. It causes NU1107 against a sibling's `>= 13.0.3`, NU1107 across two patched versions of one id, and NU1608 in consumers. | VERIFIED-ADV e2 |
+| With `[V′, )` the declaring project resolves V′, AppA/AppC resolve 13.0.3 as before, and AppB resolves 13.0.1.N. No NU1107 or NU1608. | VERIFIED-ADV e2 |
+| When V′ is unreachable (an external consumer), `[V′, )` silently resolves the next higher version (NU1603). | VERIFIED-ADV e8 |
+| Floating ranges never select a 4th-part version. | VERIFIED shapes §7 |
+| A unique version leaks into packed nuspecs. | VERIFIED shapes §1B |
+| `Version="13.0.1.0"` means the same as 13.0.1 to NuGet but does not match the literal condition. | VERIFIED-ADV e9 |
+
+### 2.4 MSBuild and injection
+| Fact | Status |
+|---|---|
+| Only the nearest DBP/DBT is imported. Chaining with `GetPathOfFileAbove` works. | VERIFIED shapes §4 |
+| With chained DBTs, an import at the end of a nested DBT runs too early when it has a once-guard, so the redirect misses items declared later. | VERIFIED-ADV e7 |
+| `CustomAfterDirectoryBuildTargets`, set in DBP, is imported after the whole DBT chain (`Microsoft.Common.targets:55`), without the `ImportDirectoryBuildTargets` condition. | VERIFIED-ADV e7 (SDK 8 only) |
+| Our file, imported after DBT, comes after package `build/*.targets`. An unconditional property assignment there beats env vars and package props; only a global `-p:` beats it. | VERIFIED-ADV x1 |
+| `@(Item->WithMetadataValue(...))` conditions on evaluation-time ItemGroups work for PackageReference and PackageVersion Update. GlobalPackageReference and case-variant ids are covered. | VERIFIED shapes §2; VERIFIED-D e1/e7; VERIFIED-ADV (shapes) |
+| A PrivateAssets=all pin becomes a Direct lock entry and does not leak into pack. Without `Publish="true"` the dll is missing from publish output. | VERIFIED shapes §5; VERIFIED-D V-D11 |
+| A pin without a `$(TargetFramework)` condition adds a new Direct dependency to every TFM. | VERIFIED-ADV e3 |
+| The `AfterTargets=ResolvePackageAssets` guard runs in design-time builds. | VERIFIED-ADV (adv-env M2) |
+| Evaluation-time redirects work under static-graph restore (sln, and CPM with pinning on). SOCKETPATCH001 at `BeforeTargets=CollectPackageReferences` fires in normal and static-graph restore. | VERIFIED-D V-D3b; VERIFIED-ADV (shapes) |
+| The guard as written runs cleanly: it parses, batches, and preserves `GetFileHash` metadata. Cost is 52 ms per project for an 8.7 MB seed. | VERIFIED-ADV (shapes, env) |
+
+### 2.5 Integrity, signing and git
+| Fact | Status |
+|---|---|
+| For an unsigned nupkg, contentHash = base64(sha512(file)). For a signed nupkg it is computed with `.signature.p7s` removed. Signing never changes contentHash. | VERIFIED lock-cache §a, signing §e |
+| depscan's SRI with `sha512-` removed equals the unsigned contentHash. | VERIFIED depscan §1 |
+| Keeping the upstream signature on changed bytes gives NU3008. An unsigned package under `require` gives NU3004. Package and fallback folders are never verified. | VERIFIED signing §a/§b; VERIFIED-D V-D9 |
+| A self-signed author cert plus `<author allowUntrustedRoot>` passes `require`. `<author>` trust has no id scope. | VERIFIED signing §b/§c; DOCS |
+| `* text=auto`, `core.autocrlf=true` and `eol` rules rewrite seed text members. The author's tree stays clean, and every clone gets different bytes. | VERIFIED-ADV adv-env B1, x4/x5, V4 |
+| A nested `.gitattributes` with `* -text -diff -merge -filter` gives byte-identical clones under hostile root rules. | VERIFIED-ADV adv-env c2, V4 |
+| Seed files added outside the nuspec are imported and can disable a guard whose assignment is conditional. | VERIFIED-ADV x1 |
+
+## 3. Candidates considered
+
+| Key | Summary | Judge mean (/100) |
+|---|---|---|
+| A (feed hardened) | Same-version local feed, chain-aware mapping, pins in every lock, gitignored per-generation `RestorePackagesPath` | 59.6 |
+| B (unique version via feed) | `X.Y.Z.(D+1)-socket.p<uuid8>.<rev>` in a local feed, with per-project redirects | 70.5 |
+| C (repo-local seed) | Same id+version seeded into a committed repo-wide `RestorePackagesPath` | 70.2 |
+| D (unique-version fallback seed) | 4th-part V′ in a committed fallback folder; no config edits | **76.3** (chosen by 2 of 3 judges) |
+
+Mean judge scores per criterion (1–10; the total is out of 100, with correctness, GPF safety and integrity weighted double). Each judge scored through a different lens: shapes and environments, integrity and supply chain, and operability.
+
+| Candidate | correctness | integrity | gpf safety | diff size | revert | ci friction | impl cost | server side | total |
+|---|---|---|---|---|---|---|---|---|---|
+| A-feed-hardened | 5.7 | 7.0 | 7.7 | 5.7 | 6.3 | 3.7 | 3.7 | 5.7 | 59.6 |
+| B-unique-version | 6.3 | 7.7 | 9.7 | 5.7 | 8.0 | 5.3 | 2.7 | 8.3 | 70.5 |
+| C-repo-local-seed | 7.7 | 7.3 | 9.3 | 4.3 | 8.0 | 4.0 | 6.3 | 5.7 | 70.2 |
+| D-wildcard | 7.7 | 7.3 | 9.7 | 5.7 | 8.7 | 8.3 | 4.7 | 7.7 | 76.3 |
+
+## 4. Decision
+
+**D is the base.** The grafts from the other candidates:
+- **From C:** the resolved-root and consumed-file hash guard, now content-aware; `.gitignore` negations checked with `git check-ignore`; eviction of GPF entries leaked by the legacy layout, identified through `.nupkg.metadata` `source`.
+- **From B:** an invertible V′ derivation shared with depscan; the declared-version guard; refusal when a dependency constraint excludes V′; server-recorded upstream hashes; a sandboxed relock; the pack-roots policy; NuGetAuditSuppress.
+- **From A:** version-precise pins in every affected lock; config-chain discovery, used for signature policy only; the WIRING_FILES and sweep fix; the fix for the id-only hosted lock match at `redirect/mod.rs:5431`.
+
+**C was rejected** because a repo-wide `RestorePackagesPath` moves every package into the repo. That throws away the CI and developer GPF caches and breaks Docker layers and scripts, which is an operational regression for every repo.
+
+**Structural changes after adversarial review:**
+1. The floor range `[V′, )` replaces `[V′]`. SOCKETPATCH006 is added, and lock edits reach every consumer of a redirected project.
+2. The injection point moves from a DBT Import line to a DBP `CustomAfterDirectoryBuildTargets` block.
+3. A generated `.gitattributes` is added, and `--check` compares against committed blobs.
+4. A restore-time set-equality check of the seed is added. The guard property is assigned unconditionally. Exemptions come from a CLI-managed allowlist.
+5. The foreign-root check depends on content, and hash keys are `<idl>/<V′>/<rel>`.
+6. Shared outputs are regenerated by a CLI finalize hook (`sync_shared`) that runs after every ledger mutation. Removing the block needs no records.
+7. Patch updates, revert ordering, migration ordering and v4 compatibility are specified (§7.4–§7.7).
+8. Directories are named by uuid8, and the long-path check uses absolute paths.
+
+## 5. Tiers and layout selection
+
+| Tier | When | Mechanism |
+|---|---|---|
+| **fallback** | SDK-style PackageReference projects with no visible require policy | Committed extracted seed. Prototype scope. |
+| **feed** | A require policy is visible, the depscan org policy says require, or `--nuget-tier=feed` | Signed V′ nupkg in a per-uuid flat feed. Builder 0 (service bytes) only. Post-prototype, blocked on G6 and depscan #8 (§10). |
+| **legacy** | packages.config-only repos, `--nuget-layout=feed`, and existing legacy entries | Today's `nuget_feed.rs`, unchanged. |
+
+**Selection rules:**
+- The layout is selected by `--nuget-layout <feed|fallback>` on `GlobalArgs`, so it applies to vendor, scan, get and repair. The environment variable is `SOCKET_NUGET_LAYOUT`. The default is `feed` until promotion.
+- **Inference:** if any `nuget-fallback` entry exists, or the top-level optional `state.nugetLayout == "fallback"`, new NuGet entries use fallback whatever the flag says. The first fallback vendor sets `nugetLayout`.
+- **Hybrid router:** an entry whose `flavor` is `nuget-fallback`, or that carries `nuget_lock_entry_v2` records, always routes to the fallback backend. This covers entries that an older binary relabelled (§11.3).
+- **Refusals:**
+  - `vendor_nuget_tier_mixed`: more than one tier per repo.
+  - `vendor_nuget_mixed_project_styles`: packages.config and SDK projects resolve the same id@V. A dual-wiring entry is open question Q5.
+
+## 6. Mechanism
+
+### 6.1 Deriving V′
+The function is pure and must be identical in `vendor/nuget_version.rs` and in depscan `lib/src/nuget/socket-version.ts`, with shared golden vectors. Its inputs are the normalized upstream V, the uuid, and the builder (service = 0, local = 1).
+
+| Upstream V | V′ | Status |
+|---|---|---|
+| Stable, ≤ 3 parts or zero 4th part | `V.N`, where `N = 2^30 + ((u32(uuid[0..8]) >> 3) << 1) + builder`, in [2^30, 2^31−1] | Form VERIFIED-D (e1/e7) |
+| 4-part with D > 0 | `A.B.C.(D+1)-socket.p<uuid8>.<builder>` | Refused (`vendor_nuget_version_unsuffixable`) until G5 |
+| Prerelease | `X.Y.Z-pre.socket.p<uuid8>.<builder>` | Refused until G5 |
+
+- **Example:** uuid `3f9a01bc-…` gives `13.0.1.1340506222` for a service build, and `…223` for a local build.
+- **Collision refusals:**
+  - `vendor_nuget_version_collision`: two entries for the same id@V derive the same V′.
+  - `vendor_nuget_version_gap`: a published version of the id lies in (V, V′]. For example, an upstream 4-part `13.0.1.5` would change floor-range resolution. The server checks nuget.org and the org's configured upstreams (adv-env m7). The CLI repeats the check against the flatcontainer index when it is online.
+- **One V′, one byte sequence:** service artifacts are write-once per uuid. Builder 1 is not a single byte producer (adv-integrity M4), but in the fallback tier V′ bytes exist only in the committed seed, so the only cost is lock churn. The feed tier accepts builder 0 only.
+- The hot path accepts either builder for an existing uuid. The builder changes only with `--nuget-rebuild-service` (Q4).
+
+### 6.2 On-disk layout (fallback tier)
+```
+Directory.Build.props                  EDITED (socket-patch block) or CREATED
+src/Directory.Build.props              EDITED where it is the nearest DBP of an SDK project
+src/Lib/packages.lock.json             EDITED (entries for id@V and Project ranges only)
+src/AppA/packages.lock.json            EDITED (Project range only: consumer of a redirected project)
+.socket/vendor/state.json              flavor "nuget-fallback", nugetLayout, nugetShared
+.socket/vendor/nuget/
+  socket-patch.targets                 GENERATED by sync_shared (LF, -text)
+  .gitignore                           GENERATED (negations)
+  .gitattributes                       GENERATED
+  3f9a01bc/                            fallback root (uuid8; full uuid in marker + state)
+    socket-patch.vendor.json
+    newtonsoft.json/13.0.1.1340506222/
+      .nupkg.metadata                  {"version":2,"contentHash":"<b64 sha512 of V′ nupkg>","source":null}
+      newtonsoft.json.nuspec
+      lib/netstandard2.0/Newtonsoft.Json.dll   (patched)
+      …
+```
+
+**`.gitattributes`:**
+```
+* -text -diff -merge -filter
+/socket-patch.targets -text diff
+/.gitignore -text diff
+/.gitattributes -text diff
+```
+
+**`.gitignore`:**
+```
+!/3f9a01bc/
+!/3f9a01bc/**
+!/socket-patch.targets
+!/.gitattributes
+```
+
+**Post-write checks.** After writing, the CLI runs:
+- `git check-ignore` on the seed files, refusing with `vendor_artifact_gitignored`;
+- `git check-attr text eol filter` on the seed files, refusing with `vendor_artifact_git_transformed`, for example when a root LFS rule survives.
+
+**Seed extraction.** The seed is extracted from the V′ nupkg following NuGet's own rules:
+- entry names are percent-decoded, **then** validated with `is_safe_relative_subpath`, `is_plain_archive_name` and `names_are_unambiguous`, compared case-folded;
+- names containing any of `$ @ % ; ' = ( )` are refused (`vendor_nuget_unsafe_member`);
+- OPC parts and `.signature.p7s` are dropped;
+- the nuspec is renamed to `<idlower>.nuspec`;
+- no `.nupkg` or `.sha512` is written;
+- the existing zip-bomb caps (`MAX_ENTRIES`, per-entry and total limits) are reused.
+
+**Size and path limits:**
+- `vendor_nuget_seed_too_large` if any file is over 50 MB or the seed is over 200 MB (configurable).
+- `vendor_nuget_long_path` warns when the absolute path, under a pessimistic 60-character CI prefix or the real root, exceeds 240 characters. Above 250 characters the CLI refuses unless `--allow-long-paths` is given.
+
+### 6.3 Directory.Build.props block
+```xml
+  <!-- socket-patch:begin (generated; run `socket-patch vendor --revert` to remove) -->
+  <!-- socket-patch: .socket/vendor/nuget/3f9a01bc uuid=3f9a01bc-… -->
+  <PropertyGroup Label="socket-patch">
+    <CustomAfterDirectoryBuildTargets Condition="!$(CustomAfterDirectoryBuildTargets.Contains('socket-patch.targets'))">$(CustomAfterDirectoryBuildTargets);$(MSBuildThisFileDirectory).socket/vendor/nuget/socket-patch.targets</CustomAfterDirectoryBuildTargets>
+    <RestoreAdditionalProjectFallbackFolders>$(RestoreAdditionalProjectFallbackFolders);$(MSBuildThisFileDirectory).socket/vendor/nuget</RestoreAdditionalProjectFallbackFolders>
+  </PropertyGroup>
+  <!-- socket-patch:end -->
+```
+
+**Placement.** The block goes in the nearest DBP of **every** SDK project in the same git worktree, including projects that do not use the patched package. That lets SOCKETPATCH005 and 006 cover projects added later. Submodules, template content (`PackageType=Template`) and dot-directories are skipped, with warning `vendor_nuget_import_skipped`. Nested files use a relative `../` path. If the root has no DBP, the CLI creates `<Project>` containing the block and nothing else.
+
+**What the block does:**
+- **Import ordering.** The targets are imported after the entire DBT chain, which fixes the nested-chain misfire (VERIFIED-ADV e7, SDK 8). The `Contains` guard dedupes chained DBPs. Whether the property exists on SDK 6 and 7 is G10.
+- **Restore fail-closed.** Superseded (§0). The anchor folder let anyone plant packages. The prototype's `SocketPatchNuGetImportCheck` target fails restore with SOCKETPATCH007 instead. VERIFIED in the e2e.
+- **v4 compatibility.** The literal uuid comments let v4 drift-keep and VEX liveness see the uuid (§11.3).
+
+**Refusals:**
+- `vendor_nuget_dbp_disabled`: a project sets `ImportDirectoryBuildProps=false`.
+- `vendor_nuget_non_sdk_project`: a non-SDK project uses PackageReference, because the guard would never run there (adv-shapes M5).
+
+### 6.4 `socket-patch.targets` (generated; illustrative, deterministic, sorted)
+The example repo:
+- Lib has a direct 13.0.1 reference.
+- AppA references Lib and Lib3 (13.0.3).
+- Tool gets 12.0.1 through Bson, for netstandard2.0 only.
+- Web uses CPM.
+
+```xml
+<Project>
+  <!-- Generated by socket-patch from .socket/vendor/state.json; render sha256 recorded in state. Do not edit. -->
+  <!-- socket-patch: .socket/vendor/nuget/3f9a01bc  .socket/vendor/nuget/7c21d0e4 -->
+  <PropertyGroup>
+    <SocketPatchNuGetTargetsImported>true</SocketPatchNuGetTargetsImported>
+    <SocketPatchNuGetGuard>true</SocketPatchNuGetGuard>
+    <SocketPatchNuGetDir>$([MSBuild]::NormalizeDirectory('$(MSBuildThisFileDirectory)'))</SocketPatchNuGetDir>
+    <SocketPatchRepoRoot>$([MSBuild]::NormalizeDirectory('$(MSBuildThisFileDirectory)', '..', '..', '..'))</SocketPatchRepoRoot>
+    <SocketPatchProject>$([MSBuild]::MakeRelative('$(SocketPatchRepoRoot)', '$(MSBuildProjectFullPath)').Replace('\', '/'))</SocketPatchProject>
+    <_SpV_3f9a01bc>13.0.1.1340506222</_SpV_3f9a01bc>
+    <_SpV_7c21d0e4>12.0.1.1994350720</_SpV_7c21d0e4>
+    <RestoreAdditionalProjectFallbackFolders>$(RestoreAdditionalProjectFallbackFolders);$(SocketPatchNuGetDir)3f9a01bc;$(SocketPatchNuGetDir)7c21d0e4</RestoreAdditionalProjectFallbackFolders>
+    <_SpPatched>;newtonsoft.json/$(_SpV_3f9a01bc);newtonsoft.json/$(_SpV_7c21d0e4);</_SpPatched>
+    <_SpUpstream>;newtonsoft.json/13.0.1;newtonsoft.json/12.0.1;</_SpUpstream>
+    <_SpAllowUnpatched>;src/Legacy/Legacy.csproj;</_SpAllowUnpatched>
+    <_SpHashes>;newtonsoft.json/13.0.1.1340506222/lib/netstandard2.0/newtonsoft.json.dll=4F33…BD;…;</_SpHashes>
+  </PropertyGroup>
+
+  <!-- 3f9a01bc: Newtonsoft.Json 13.0.1 -> V′; one condition per recorded spelling of 13.0.1 -->
+  <ItemGroup Condition="'@(PackageReference->WithMetadataValue('Identity','Newtonsoft.Json')->WithMetadataValue('Version','13.0.1'))' != '' or '@(PackageReference->WithMetadataValue('Identity','Newtonsoft.Json')->WithMetadataValue('Version','13.0.1.0'))' != ''">
+    <PackageReference Update="Newtonsoft.Json" Version="[$(_SpV_3f9a01bc), )" />
+    <SocketPatchRedirect Include="newtonsoft.json/$(_SpV_3f9a01bc)" />
+    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-5crp-9r3c-p9vr" />
+  </ItemGroup>
+  <ItemGroup Condition="'$(ManagePackageVersionsCentrally)' == 'true' and '@(PackageVersion->WithMetadataValue('Identity','Newtonsoft.Json')->WithMetadataValue('Version','13.0.1'))' != ''">
+    <PackageVersion Update="Newtonsoft.Json" Version="[$(_SpV_3f9a01bc), )" />
+    <SocketPatchRedirect Include="newtonsoft.json/$(_SpV_3f9a01bc)" />
+  </ItemGroup>
+
+  <!-- 7c21d0e4: 12.0.1 transitive-only in Tool, netstandard2.0 only, while its direct parent Bson is still referenced -->
+  <ItemGroup Condition="'$(SocketPatchProject)' == 'src/Tool/Tool.csproj' and '$(TargetFramework)' == 'netstandard2.0' and '@(PackageReference->WithMetadataValue('Identity','Newtonsoft.Json'))' == '' and '@(PackageReference->WithMetadataValue('Identity','Newtonsoft.Json.Bson'))' != ''">
+    <PackageReference Include="Newtonsoft.Json" Version="[$(_SpV_7c21d0e4), )" PrivateAssets="all" Publish="true" />
+    <SocketPatchRedirect Include="newtonsoft.json/$(_SpV_7c21d0e4)" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <SocketPatchSeedFile Include="$(SocketPatchNuGetDir)3f9a01bc/newtonsoft.json/13.0.1.1340506222/.nupkg.metadata" Sha256="C3E7…AF" PackageKey="newtonsoft.json/13.0.1.1340506222" />
+    <!-- … one row per seed file, every uuid -->
+  </ItemGroup>
+
+  <!-- restore time: the seed must be exactly the inventory (SOCKETPATCH001), with the recorded hashes (SOCKETPATCH002) -->
+  <Target Name="SocketPatchNuGetSeedCheck" BeforeTargets="_GenerateRestoreGraph;CollectPackageReferences" Condition="'$(SocketPatchNuGetGuard)' != 'false' and '$(_SpSeedChecked)' != 'true'">
+    <ItemGroup>
+      <_SpOnDisk Include="$(SocketPatchNuGetDir)3f9a01bc/**;$(SocketPatchNuGetDir)7c21d0e4/**" Exclude="$(SocketPatchNuGetDir)*/socket-patch.vendor.json" />
+      <_SpExtra Include="@(_SpOnDisk)" Exclude="@(SocketPatchSeedFile)" />
+      <_SpMissing Include="@(SocketPatchSeedFile)" Condition="!Exists('%(FullPath)')" />
+    </ItemGroup>
+    <Error Condition="'@(_SpMissing)@(_SpExtra)' != ''" Code="SOCKETPATCH001" Text="socket-patch: vendored NuGet seed does not match its inventory (missing: @(_SpMissing); unexpected: @(_SpExtra)). Run 'git checkout -- .socket/vendor/nuget' or 'socket-patch vendor'." />
+    <GetFileHash Files="@(SocketPatchSeedFile)" Algorithm="SHA256"><Output TaskParameter="Items" ItemName="_SpSeedHashed" /></GetFileHash>
+    <Error Condition="'%(_SpSeedHashed.FileHash)' != '%(_SpSeedHashed.Sha256)'" Code="SOCKETPATCH002" Text="socket-patch: vendored NuGet seed file modified: %(_SpSeedHashed.Identity)." />
+    <PropertyGroup><_SpSeedChecked>true</_SpSeedChecked></PropertyGroup>
+  </Target>
+
+  <!-- build time: consumed files (G1). Skipped in design-time builds. -->
+  <Target Name="SocketPatchNuGetGuard" AfterTargets="ResolvePackageAssets" Condition="'$(SocketPatchNuGetGuard)' != 'false' and '$(DesignTimeBuild)' != 'true'">
+    <ItemGroup>
+      <_SpCand Include="@(RuntimeCopyLocalItems);@(ResolvedCompileFileDefinitions);@(RuntimeTargetsCopyLocalItems);@(NativeCopyLocalItems);@(ResourceCopyLocalItems);@(Analyzer)"
+               SpKey=";$([System.String]::Copy('%(NuGetPackageId)/%(NuGetPackageVersion)').ToLowerInvariant());" />
+      <_SpPatched Include="@(_SpCand)" Condition="$(_SpPatched.Contains('%(SpKey)'))" />
+      <_SpUnpatched Include="@(_SpCand)" Condition="$(_SpUpstream.Contains('%(SpKey)'))" />
+      <_SpDrift Include="@(_SpCand)" Condition="'@(SocketPatchRedirect)' != '' and '%(NuGetPackageId)' != '' and $([System.String]::Copy('@(SocketPatchRedirect)').ToLowerInvariant().Contains('$([System.String]::Copy('%(NuGetPackageId)').ToLowerInvariant())/')) and !$(_SpPatched.Contains('%(SpKey)'))" />
+    </ItemGroup>
+    <Error Condition="'@(_SpUnpatched)' != '' and !$(_SpAllowUnpatched.Contains(';$(SocketPatchProject);'))" Code="SOCKETPATCH005" Text="socket-patch: $(SocketPatchProject) resolved UNPATCHED %(_SpUnpatched.NuGetPackageId) %(_SpUnpatched.NuGetPackageVersion), which is vendored-patched in this repo. Run 'socket-patch vendor'." />
+    <Error Condition="'@(_SpDrift)' != ''" Code="SOCKETPATCH006" Text="socket-patch: $(SocketPatchProject) redirects %(_SpDrift.NuGetPackageId) to the Socket-patched version but resolved %(_SpDrift.NuGetPackageVersion). Run 'socket-patch vendor' to re-plan." />
+    <GetFileHash Files="@(_SpPatched)" Algorithm="SHA256" Condition="'@(_SpPatched)' != ''"><Output TaskParameter="Items" ItemName="_SpHashed" /></GetFileHash>
+    <ItemGroup>
+      <_SpBad Include="@(_SpHashed)" Condition="!$(_SpHashes.Contains(';%(SpKeyPath)=%(FileHash);'))" />
+    </ItemGroup>
+    <Error Condition="'@(_SpBad)' != ''" Code="SOCKETPATCH003" Text="socket-patch: %(_SpBad.NuGetPackageId) %(_SpBad.NuGetPackageVersion) resolved from '%(_SpBad.FullPath)' with content that differs from the vendored patch. Another tool placed a different copy of this version in a package folder; remove it only if no other repo relies on it." />
+  </Target>
+  <!-- pack targets: §6.6 -->
+</Project>
+```
+
+**Notes on the file:**
+- **Content-aware foreign root.** `SpKeyPath` is `<idl>/<V′>/<rel>`, computed from the path relative to the package root it resolved in. The mechanics are G15. A byte-identical copy in the GPF passes. A different copy fails SOCKETPATCH003. The error message no longer tells the user to delete the folder.
+- **Package presence.** Presence is decided from `@(_SpCand)`, which now includes `@(Analyzer)`. For packages with no lib, ref or analyzer assets, the guard also reads the `libraries` keys of `project.assets.json` (G1).
+- **Guard escape hatch.** `SocketPatchNuGetGuard` is assigned unconditionally, so the only way to turn it off is a global `-p:SocketPatchNuGetGuard=false`. `vendor --check` flags `*.rsp` files that mention `SocketPatch*`.
+- **SOCKETPATCH005 exemptions.** Projects are exempted only through `_SpAllowUnpatched`, which is rendered from `state.nuget.allowUnpatched` (`socket-patch vendor --nuget-allow-unpatched <proj>`). There is no free-form property any more.
+- **Versions behind properties.** Versions sit in `_SpV_*` properties, so regex updaters see no literals. If a bot edits them anyway, SOCKETPATCH006 fires, and `--check` compares the render sha.
+- **Split CPM.** When one central PackageVersion resolves differently across projects, the CLI emits the per-project form `('$(SocketPatchProject)'=='a' or …)` (VERIFIED-D e7). A CPM transitive-only project gets a Version-less `Include` pin plus `Publish="true"`. A `VersionOverride` equal to V gets `VersionOverride="[V′, )"`. VersionOverrides to other versions are left alone.
+- **TFM conditions.** Pin TFM conditions use the alias taken from assets `project.frameworks`. A multi-TFM pin with no assets file, or with a custom alias, is refused (`vendor_nuget_tfm_alias_unknown`).
+
+### 6.5 Lock edits
+**Which lock.** For each project, in order:
+1. a static `NuGetLockFilePath` (a dynamic value is refused with `vendor_nuget_lockpath_dynamic`);
+2. `packages.<Project>.lock.json`;
+3. `packages.lock.json`.
+
+**Edits.** Splices are byte-preserving and TFM/RID-scoped. The exact `[V′, )` text is G11; the goldens are re-captured from `--force-evaluate`.
+
+| Project role | Before | After |
+|---|---|---|
+| Direct / CPM direct | `Direct`, `requested "[13.0.1, )"`, `resolved 13.0.1` | `Direct`, `requested "[V′, )"`, `resolved V′`, `contentHash <seed>` |
+| CPM uniform, pinning on (CentralTransitive) | `CentralTransitive`, `requested "[13.0.1, )"` | stays `CentralTransitive`; `requested "[V′, )"` plus new resolved and hash (VERIFIED-ADV e5 corrects revision 1) |
+| Transitive pin | `Transitive` | `Direct` with `requested` inserted. Written in NuGet's canonical order: Direct entries first (VERIFIED-ADV e3). |
+| Auto-follow consumer that resolved V | `Transitive 13.0.1` | `Transitive V′` plus hash |
+| Consumer that resolved R > V (AppA/AppC) | unchanged | unchanged. Its resolution is R because R > V′ is guaranteed by the gap check. |
+| `Project` entry listing a redirected project | `"[13.0.1, )"` | `"[V′, )"`, in **every** lock whose graph contains that project |
+
+**Records.**
+- One record per edit: `nuget_lock_entry_v2` (key `<lockrel>#<tfm>[/<rid>]#<id>`) or `nuget_lock_project_range`.
+- Records are stored EOL-neutral, together with the observed EOL.
+- Live-text comparisons normalize CRLF to LF, and splices use the live file's EOL.
+- Relock comparison is semantic (parsed JSON), not textual.
+
+### 6.6 Pack
+- **Range restore** (`AfterTargets=_GetAbsoluteOutputPathsForPack`, VERIFIED-D V-D6 and VERIFIED-ADV e5): `"[V′, )"` is replaced with the **recorded original literal range**, for example `[13.0.1]` stays exact.
+- **Pre-check**, `BeforeTargets=GenerateNuspec`: fail SOCKETPATCH004 if the rewritten assets still contain any V′.
+- **Post-check**, `AfterTargets=GenerateNuspec`: read exactly `$(NuspecOutputAbsolutePath)$(PackageId).$(PackageVersion).nuspec`. This avoids MSB4184 when several nuspecs are present (VERIFIED-ADV e5). On failure, `<Delete Files="@(NuGetPackOutput)"/>` runs before the error, because the nupkg was already written (VERIFIED-ADV e5).
+- Both checks are G2. If G2 fails on any supported SDK, packable projects with a direct patched reference are refused (`vendor_nuget_packable_direct`). Opt-in: `--nuget-pack-policy=roots`.
+
+### 6.7 State
+```json
+{"ecosystem":"nuget","flavor":"nuget-fallback","basePurl":"pkg:nuget/Newtonsoft.Json@13.0.1","uuid":"3f9a01bc-…",
+ "artifact":{"path":".socket/vendor/nuget/3f9a01bc/newtonsoft.json/13.0.1.1340506222","sha256":"",
+   "fileInventory":{"lib/netstandard2.0/Newtonsoft.Json.dll":"4f33…","…":"…"}},
+ "nuget":{"tier":"fallback","wired":true,"upstreamVersion":"13.0.1","patchedVersion":"13.0.1.1340506222",
+   "builder":"local","contentHash":"FRVi…","upstreamSha512":"…","upstreamContentHash":"…","packPolicy":"restore-ranges",
+   "literals":["13.0.1","13.0.1.0"],"allowUnpatched":[],
+   "projects":[{"path":"src/Lib/Lib.csproj","role":"direct","declared":"13.0.1","tfms":["net8.0"]},
+               {"path":"src/AppA/AppA.csproj","role":"range-consumer","tfms":["net8.0"]}]},
+ "wiring":[
+   {"file":"src/Lib/packages.lock.json","kind":"nuget_lock_entry_v2","key":"…#net8.0#Newtonsoft.Json","original":"…","new":"…"},
+   {"file":"Directory.Build.props","kind":"nuget_uuid_anchor","action":"Referenced"}]}
+```
+Top-level additions to `VendorState`, all additive and optional:
+- `nugetLayout`;
+- `nugetShared`: `{renderSha256, props:[{file, created, original}]}`.
+
+**Rules:**
+- The DBP block is owned by the state, not by any entry. `nuget_uuid_anchor` is a reference only: v5 never reverts from it, and it exists so v4 sees the file (§11.3).
+- `nuget.projects` is the authoritative closure (§7.2).
+- `wired=false` marks Preserved or Kept entries. `sync_shared` never renders them.
+- `fileInventory` intactness replaces the existence-only `ledger_covers` check for directory artifacts.
+
+## 7. Algorithms
+
+### 7.1 Apply (`vendor_nuget_fallback`)
+1. **Prelude** (`fallback_prelude`, shared with `service_preflight`). It refuses on:
+   - unsafe coordinates;
+   - `version_unsuffixable`, `version_gap`, `version_collision`;
+   - signature policy: config chain for every project directory, plus `DOTNET_NUGET_SIGNATURE_VERIFICATION`;
+   - `mixed_project_styles`, `dbp_disabled`, `non_sdk_project`;
+   - `external_consumer`: a project outside the root references a redirected project, or an `.sln`/`.slnf` above the root lists one;
+   - `exact_dependency`: a dependency constraint excludes V′;
+   - `version_literal_unknown`: property-expanded versions on an SDK without `-getItem` (< 8), which are refused;
+   - `sdk_unavailable`: the SDK that `global.json` pins is not installed;
+   - `implicit_reference`: `IsImplicitlyDefined`, for example FSharp.Core;
+   - `tool_only`: tool packages cannot be patched this way, and the crawler must not claim that they are covered;
+   - `tier_mixed`, `layout_mixed`.
+
+   Entries that share this entry's ledger key or basePurl are excluded from the duplicate and collision checks.
+2. **Closure plan** (`plan_closure`):
+   - Enumerate `*.*proj` plus the projects listed in the sln. Skip dot-directories, `bin`, `obj`, `node_modules` and configured package folders.
+   - Read assets, or else the lock, or else csproj and CPM text.
+   - Count a `resolved` that decodes (`parse_socket_nuget_version`) to (id, V) as V.
+   - Roles: `direct`, `cpm-uniform`, `cpm-split`, `auto-follow`, `pin`, and `range-consumer`. A range-consumer is any project whose graph reaches a redirected project; ProjectReferences are walked in both directions.
+   - Projects that are already planned and have no assets are not refused. `vendor_nuget_unrestored` applies only to **new** projects with neither a lock nor assets.
+3. **Materialise the V′ nupkg:**
+   - from the service `nupkg-socket-version` artifact (builder 0), or
+   - by running `reversion_nupkg` on the SRI-verified same-version service nupkg or on `local_rebuild` output (builder 1).
+
+   The upstream is verified by its repository signature, or by sha512 against depscan `upstreamSha512`. Every patched member is checked against its afterHash.
+4. **Stage everything in memory:** the seed tree, all lock splices, and the new DBP blocks.
+5. **Write, with snapshots:**
+   - Write the seed atomically (temp directory, then rename). Reuse it if it already matches `fileInventory`.
+   - Snapshot the bytes of every file about to be touched, then write the locks and DBPs, each by temp file and rename.
+6. Optional `--nuget-relock`: a sandboxed `--force-evaluate` run with a throwaway `NUGET_PACKAGES`, then a semantic diff against the planned key set.
+7. **Unwind** on any failure in steps 5–6: restore every snapshot, and delete the seed only if this run created it.
+8. Return `VendorOutcome::Done`. The CLI then persists the entry, sweeps stale artifacts, and calls **`sync_shared`**.
+
+### 7.2 `sync_shared(cwd, &VendorState)`, the CLI finalize hook
+It is called after every ledger mutation: `run_vendor` (after persist and sweep), revert, rollback, remove, gc, repair, and scan/get in vendored mode. It runs:
+- in memory during `--dry-run`;
+- idempotently; on failure it reports `vendor_nuget_shared_sync_failed` and exits non-zero.
+
+What it does:
+1. It selects entries that are `nuget-fallback`, `wired`, and whose seed directory is present. For an entry that is wired but has a missing seed, it warns and does not render it.
+2. If the selection is non-empty:
+   - it renders `socket-patch.targets`, `.gitignore` and `.gitattributes`, and writes the DBP blocks into every nearest DBP;
+   - it refuses without `--force` when the on-disk targets differ from `nugetShared.renderSha256` (`vendor_nuget_targets_edited`).
+3. If the selection is empty:
+   - it removes the block from every discovered DBP, plus every DBP listed in `nugetShared.props`, without needing any per-entry records;
+   - it deletes a DBP whose text equals the created text; otherwise it restores `original` when the rest of the file is unchanged;
+   - it deletes the targets file only after every block is gone. If any excision drifts, it writes a stub `<Project/>` targets file instead;
+   - it deletes `.gitignore` and `.gitattributes` last.
+
+### 7.3 Hot path, `--check`, `--check --online`
+**In sync**, which returns `AlreadyPatched`, requires all of:
+- the seed file set equals `fileInventory`, with no extra, symlinked or non-regular files, and the hashes match;
+- `.nupkg.metadata` equals the recorded contentHash;
+- the shared outputs are byte-equal to the render (they are `-text`, so this is safe);
+- every lock record's live text equals `new`, compared EOL-neutral;
+- a re-plan from csproj, CPM and locks, with V′ counted as V, matches `nuget.projects`.
+
+A changed closure is re-planned and re-keyed, and warns `vendor_nuget_closure_changed`.
+
+**`--check`** does everything above, plus:
+- it compares seed hashes against the **committed** blobs (`git cat-file HEAD:<path>`) and checks `git ls-files --eol`, reporting `vendor_nuget_eol_normalized`;
+- it evaluates every discovered project with `dotnet msbuild -getProperty:SocketPatchNuGetTargetsImported` (batched). Any project that resolves the id at V without importing the targets fails (`vendor_nuget_project_uncovered`);
+- it probes the signature policy again;
+- it flags repo trustedSigners that are not in state, and `.rsp` overrides;
+- it reports untracked seeds, stale keys, unused entries and orphaned pins.
+
+It works before any restore, because it relies on the persisted closure.
+
+**`--check --online`** also rebuilds the expected tree from an anchor outside the repo and diffs it byte for byte. The anchor is either the service artifact (SRI) or upstream plus afterHashes. This is the recommended required CI step.
+
+### 7.4 Revert
+Steps, in order:
+1. **Lock records.**
+   - Live text equal to `new`: splice `original` back.
+   - Live text equal to `original`: the record is done.
+   - Otherwise it is drift. Drift is repaired **only** from depscan `upstreamContentHash`, or from a freshly downloaded nuget.org nupkg whose repository signature was checked. It is never repaired from the GPF (adv-integrity M5).
+2. **keep** = any drifted record whose live text still contains V′. If keep is set, the entry becomes `wired=true`, `kept_artifact`, and the process stops here.
+3. The CLI drops the entry, or marks it `wired=false` for Preserved, then saves state and runs `sync_shared`. That regenerates the targets or removes the blocks, deleting the targets only after the blocks are gone.
+4. It deletes the seed and prunes empty levels. It first runs `refuse_symlinked`/`first_symlink` on the seed and all its ancestors.
+5. No GPF eviction is needed (VERIFIED-D V-D12).
+
+### 7.5 Patch update (a new uuid for the same purl)
+- The planner treats the old V′a as V (step 2). Lock edits V′a → V′b record `original: None`, so `carry_forward_wiring` fills in A's true upstream original. The key has no uuid in it.
+- `carry_forward_wiring` merges import state across uuids implicitly, because that state now lives in the state-level `nugetShared`.
+- The old entry is excluded from the prelude checks. The CLI replaces the entry, sweeps A's seed, and then runs `sync_shared`, which renders only B.
+- Docker leg: vendor A, update to B, locked restore, revert, then `git diff --exit-code`.
+
+### 7.6 Migration from the legacy layout (`--migrate-nuget`)
+1. Run `fallback_prelude` and `plan_closure` first. A refusal leaves legacy intact.
+2. Materialise V′ by running `reversion_nupkg` on the **committed legacy `.nupkg`** (builder 1), and verify the afterHashes. Local rebuild is not used, because the GPF holds patched bytes.
+3. As one unwindable unit: run the legacy revert (config, catch-all when the live text equals the legacy `new`, root lock), then apply fallback.
+4. Opt-in `--nuget-evict-legacy-cache`: delete `<idl>/<V>/` GPF entries whose `.nupkg.metadata` `source` is a `.socket/vendor/nuget/<uuid>` path, and print the command for CI caches.
+
+### 7.7 Pristine source on clean machines
+When the GPF never holds upstream V, a rung fetches `https://api.nuget.org/v3-flatcontainer/<idl>/<v>/<idl>.<v>.nupkg`. It verifies the result fail-closed against the upstream contentHash recorded in the ledger (the `original` of any `nuget_lock_entry_v2`), using the signed-content hash. Repair, patch update and `--offline` use this rung.
+
+For fallback entries, `vend_installed!` no longer `debug_assert`s `Installed`, and the hot path never reads `installed_dir`.
+
+### 7.8 Crawler, VEX, in-use
+- **Crawler:** `nuget_crawler.rs` skips `.socket/vendor/nuget/**` packageFolders and maps V′ to (upstream purl, uuid).
+- **VEX:** the fallback extractor parses `socket-patch.targets` (literal uuid comments and `_SpV_*`) and the discovered locks (V′ decoded). The nuget probe files gain the targets file, the DBPs and the locks.
+- **In use:** an entry is in use when a lock or assets file resolves V′ for a reason other than our own pin. A pin with no remaining parent edge gives `vendor_nuget_pin_orphaned` and is dropped on the next `vendor`.
+
+## 8. Supported shapes (fallback tier)
+
+| Shape | Status | Evidence / notes |
+|---|---|---|
+| SDK sln, per-project locks, `--locked-mode`, warm or cold GPF | Supported | VERIFIED-D V-D3/V-D10, VERIFIED-ADV (env). Goldens for the `[V′, )` form: G11. |
+| Patched library consumed next to a higher sibling (AppA/AppC) | Supported | `[V′, )` plus Project-range edits in every consumer lock (VERIFIED-ADV e2) |
+| Multiple patched versions of one id reached by one project | Supported | Resolves the higher V′ (VERIFIED-ADV e2) |
+| CPM, pinning off/on, VersionOverride | Supported | VERIFIED-D V-D7; static graph with pinning on VERIFIED-ADV |
+| Transitive-only, multi-TFM | Supported | TFM-conditioned pin (VERIFIED-ADV e3 shows the need; the fix is G11) |
+| Nested and chained DBT/DBP | Supported | `CustomAfterDirectoryBuildTargets` (VERIFIED-ADV e7 on SDK 8; SDK 6/7 is G10) |
+| No lockfile | Supported, warning `vendor_nuget_no_lockfile` | 001/002/003/005/006 |
+| Spelling variants `13.0.1.0`, `[13.0.1]` | Supported | One condition per recorded spelling. A new spelling in a new project gives loud 005. |
+| `*.proj` NoTargets/Traversal, `.fsproj`, `.sqlproj` | Supported if SDK-style | Enumerated through `*.*proj` plus the sln |
+| Any source mapping, `<clear/>`, `--source`, `NUGET_PACKAGES`, `--packages`, `locals --clear` | Supported | VERIFIED-D V-D2/4/5b/9 |
+| Byte-identical V′ in a shared GPF | Supported | Content-aware 003 (G15) |
+| Windows checkout with `autocrlf`, `* text=auto`, LFS rules | Supported | `.gitattributes` (VERIFIED-ADV c2/V4). A surviving LFS rule is refused. |
+| Packable library with a direct patched dependency | Supported with warning, or refused until G2 | §6.6 |
+| Project outside the `.socket` root referencing a redirected project | Refused: `vendor_nuget_external_consumer` | VERIFIED-ADV e8 |
+| Non-SDK csproj with PackageReference | Refused: `vendor_nuget_non_sdk_project` | REASONED (no mono) |
+| Mixed packages.config and SDK on the same id@V | Refused: `vendor_nuget_mixed_project_styles` | Q5 |
+| packages.config only | Legacy layout | |
+| Property-expanded version on SDK < 8, or `global.json` SDK missing | Refused | REASONED |
+| Implicit SDK references (FSharp.Core) | Refused | REASONED |
+| 4-part non-zero or prerelease upstream | Refused until G5 | |
+| `require` policy visible | Refused (fallback tier) | Feed tier is post-prototype |
+| Submodules, template content | Skipped with warning | |
+
+## 9. Failure modes
+
+| Situation | Result | Loud? |
+|---|---|---|
+| Seed file missing or added (for example planted `build/*.props`) | SOCKETPATCH001 at restore, before `nuget.g.*` is regenerated on a clean checkout | Yes (G13) |
+| Seed file edited | SOCKETPATCH002 at restore and build | Yes |
+| All of `.socket/vendor/nuget` missing | SOCKETPATCH007 at restore (prototype, VERIFIED in the e2e), then MSB4019 at build | Yes |
+| Only `socket-patch.targets` missing | Restore **succeeds and rewrites locks to upstream** (V3). Build gives MSB4019, and `--check` fails. | Build only; the CI gate is `--check` |
+| V′ elsewhere, different bytes | SOCKETPATCH003. NU1403 applies only if `.nupkg.metadata` differs (VERIFIED-ADV x2). | Yes |
+| V′ elsewhere, same bytes | Accepted | — |
+| New or renamed project that imports the targets | SOCKETPATCH005, and NU1004 when locked | Yes |
+| New nested DBP that does not chain to the root | **Silent at build** (VERIFIED-ADV x3, DBT analogue). Caught by `--check` import evaluation. | CI gate |
+| Redirect engaged but drifted (bot edit, parent bump, NU1603) | SOCKETPATCH006 | Yes |
+| Bot bumps the declared version | Redirect disengages; the lock diff shows V′ → new; `--check` flags the unused entry | In PR |
+| Env var or package props setting `SocketPatchNuGetGuard=false` | Ignored (unconditional assignment) | — |
+| Global `-p:SocketPatchNuGetGuard=false` | Guards off (escape hatch) | User choice |
+| Planted `build/*.targets` on a dev machine that already restored | Arbitrary code before the guard; residual risk | Accepted; mitigated by `--check --online` in CI |
+| Design-time build | Redirects apply; the guard is skipped | — (G16) |
+| Docker `COPY *.csproj` without DBP/.socket | Locked: NU1004. Lockless: SOCKETPATCH005 at full build. `vendor` warns `vendor_nuget_dockerfile_copy`. | Yes |
+| Sparse checkout without `.socket/` | NU1301/MSB4019. The block comment names `git sparse-checkout add .socket/vendor/nuget`. | Yes |
+| CI-only `require` policy | Silently bypassed; closed by depscan org policy #6 | No (accepted gap) |
+| NuGetAudit when V′ is still in an advisory range | NuGetAuditSuppress (NuGet ≥ 6.11). Older SDKs emit info `vendor_nuget_audit_still_flags`. | Parity with pre-patch |
+| SBOM and dependency-graph tools reading locks | They see V′; depscan mapping (#4); document Dependabot alert behaviour | Docs |
+| Missing seed + VS nomination restore + lockless + attacker feed serving V′ | Possible code execution | Accepted residual. Server gap check covers org upstreams. |
+
+## 10. Signing and enterprise policy (feed tier; post-prototype)
+
+- **Fallback tier:** it never claims signature enforcement. It refuses under a visible `require`, never writes `accept`, and never sets `DOTNET_NUGET_SIGNATURE_VERIFICATION`.
+- **Feed tier:**
+  - Builder 0 only, so shared GPFs stay safe (adv-integrity M4).
+  - It adds exactly one `<add>` for the per-uuid feed. Id-exact mapping is added only where a repo mapping already exists. It refuses with `vendor_nuget_feed_mapping_conflict` when the only mapping is outside the repo and the repo uses several versions of the id.
+  - **Trust:** it never writes a pfx-holder `<author>` to repo config by default. The default path is depscan's CA-issued certificate plus RFC3161 timestamp (#8), trusted once at org or machine level. The opt-in `--nuget-sign-ephemeral` generates a per-uuid key, signs, destroys the key, then writes the fingerprint, so trust covers exactly the bytes already signed. `--check` flags unrecorded trustedSigners.
+  - **Guard:** the same content-aware 003/002 as the fallback tier.
+  - Gated by G6.
+
+## 11. Compatibility
+
+### 11.1 Hosted
+- Unchanged until WS1 (`hosted_revert_unsupported`).
+- Later, hosted can serve V′ from v3 and reuse the targets file.
+- Independent fix: version-precise hosted lock matching at `redirect/mod.rs:5431`.
+
+### 11.2 Repair and sweep
+- WIRING_FILES gains the three `nuget.config` spellings, the discovered DBP and DBT files, and `packages*.lock.json`.
+- Reserved names: `socket-patch.targets`, `.gitignore`, `.gitattributes`.
+- A wiring file that names a uuid directory makes that directory live.
+
+### 11.3 Older binaries (v4.0.0 is released)
+- **The risk (REASONED from code).** Without mitigation, v4's revert deletes the seed while the locks and targets still reference it. v4's vendor applies a legacy layout on top.
+- **Mitigations:**
+  - The literal `.socket/vendor/nuget/<uuid>` comments in the root DBP block, plus a `nuget_uuid_anchor` record, make v4's drift-keep keep the seed and the entry (fail-safe).
+  - The v5 hybrid router (§5) and a heal step: detect a legacy `socket-patch-<uuid>` source next to a fallback seed, remove it, and restore the lock.
+  - `revert_nuget_opts` fails closed on an unknown flavor (v5).
+  - The minimum version is documented.
+- **Test:** G14 runs the real v4 binary against a fallback repo.
+
+## 12. Server/CLI split (depscan)
+
+| # | depscan addition | Needed for |
+|---|---|---|
+| 1 | `lib/src/nuget/socket-version.ts` derive/parse, with golden vectors shared with Rust | GA |
+| 2 | `nuget-socket-version` repacker (V′ nuspec, STORE-only, deterministic, write-once). Refuses versions in (V, V′] on nuget.org **and the org's configured upstreams**. | GA |
+| 3 | `artifacts[].kind="nupkg-socket-version"`, `nugetPatchedVersion`, `upstreamContentHash`, `upstreamSha512` | **GA** (provenance, drift repair, `--check --online`) |
+| 4 | SBOM mapping V′ → upstream purl plus uuid; recognise the fallback folders. Bump task versions, run `generate-task-metadata`, use `RunTask` helpers. | **GA blocker** |
+| 5 | Fixed-advisory GHSA list per patch (NuGetAuditSuppress) | Prototype nice-to-have; the CLI can fall back to local advisory data |
+| 6 | Org `nugetSignaturePolicy: require` | GA for enterprises |
+| 7 | `nuget-seed` artifact (extracted layout plus inventory), tested with real dotnet | Post-GA |
+| 8 | CA-issued Socket author signing plus timestamp | Feed tier |
+| 9 | Hosted V′ in flat and registration indexes | Later |
+
+Identity and bytes (about 30% of the logic) belong to the server. All repo and machine wiring is 100% CLI.
+
+## 13. Test plan
+
+**Hermetic unit tests** (`cargo test -p socket-patch-core --lib nuget_`):
+- `nuget_version`: vectors, round-trip, gap refusal.
+- `nuget_lock`: goldens from real `--force-evaluate` output for `[V′, )`, covering:
+  - each role, including CentralTransitive with pinning on, range-consumers and canonical Direct ordering;
+  - CRLF and no trailing newline;
+  - RID goldens for a `runtimes/` package (SqlClient);
+  - EOL-neutral revert and drift.
+- `nuget_targets`: render golden with uppercase-hex pinning; XML and MSBuild escaping; DBP block inject and excise on CRLF, BOM, `<Project/>`, chained DBPs; stub rendering.
+- `nuget_seed`: decode-then-validate traversal cases (`%2E%2E%2F`, `%5C`), metacharacter refusal, case-fold collisions, OPC drops, `reversion_nupkg` determinism.
+- `nuget_projects`: closure on fixtures (e2 AppA/AppB/AppC, multi-TFM e3, external consumer e8, spellings e9, submodule, template).
+- `nuget_policy`: chain merge.
+- `sync_shared`: update, revert order, Preserved, dry run.
+
+**Real-dotnet e2e** (`e2e_nuget_dotnet_build.rs`; SDK 6–10 ubuntu, 8 macOS, **windows-latest**). Legs:
+- `sln_locked`, `cpm_locked`;
+- warm GPF;
+- `RestorePackagesPath`/`NUGET_PACKAGES`;
+- `locals --clear`;
+- tamper (002) and planted file (001);
+- env-var disable ignored;
+- pack (range restore, 004 pre and post, output deleted);
+- revert plus `git diff --exit-code`.
+
+**Docker** (`docker_e2e_vendor_nuget.rs`):
+- static graph; no lockfile;
+- 005 rename; 006 bot edit;
+- anchor NU1301; `--packages` then `--no-restore`;
+- hostile user mapping;
+- require refusal;
+- migration plus eviction;
+- idempotence;
+- G3 two roots;
+- e2/e3/e7/e8 fixtures;
+- same-bytes V′ in the GPF (003 passes) and different bytes (003 fails);
+- patch update A→B then revert;
+- two-id revert in both orders;
+- crash between write and save (resume via `sync_shared`);
+- v4 binary (G14);
+- parallel `-m`;
+- mono image for the packages.config refusal.
+
+**Real-clone legs** (prototype acceptance): commit, `git clone`, build under `* text=auto`, `autocrlf=true`, a `*.dll filter=lfs` root rule, and sparse checkout.
+
+**Regression:** every existing `nuget_feed` test passes unchanged with the default layout.
+
+## 14. Gating experiments and open questions
+
+| ID | Question | Blocks |
+|---|---|---|
+| G1 | Content-aware guard with multiple roots; `@(Analyzer)`; analyzer-only and build-only packages via the assets `libraries` | Prototype |
+| G2 | Pack pre/post checks and `@(NuGetPackOutput)` deletion on SDK 6–10 | Packable support |
+| G3 | Multiple uuid roots plus the anchor root together | Prototype |
+| G4 | SOCKETPATCH005/006 on renamed projects (001 is VERIFIED-ADV) | Prototype |
+| G5 | Prerelease-tagged V′ forms | 4-part/prerelease |
+| G6 | Feed tier with V′ under `require`; shared GPF across repos | Feed tier |
+| G7 | Static graph plus `dotnet test` across CPM variants | Promotion |
+| G8 | macOS/Windows path case; nuget.exe packages.config | Promotion |
+| G9 | VS/Rider design-time restore honours redirects | Docs |
+| G10 | `CustomAfterDirectoryBuildTargets` on SDK 6/7; chained-DBP dedupe | **Prototype** |
+| G11 | `[V′, )` lock goldens, TFM-conditioned pins, no NU1603 when the seed is present | **Prototype** |
+| G12 | The anchor fallback folder gives NU1301 at restore when `.socket/vendor/nuget` is missing, and nothing when present | **Prototype** |
+| G13 | Restore-time set check: glob includes dotfiles, runs under static graph, runs before a planted `build/` file on a clean checkout | **Prototype** |
+| G14 | v4.0.0 revert and vendor against a fallback repo keep the seed (fail-safe) | **Prototype** |
+| G15 | `SpKeyPath` computation for GPF-resolved files | Prototype |
+| G16 | Guard skipped when `DesignTimeBuild=true` in VS, Rider and C# Dev Kit | Promotion |
+| Q1 | Should SOCKETPATCH005/006 be warnings for one release? | Product |
+| Q2 | Is org require policy (#6) enough, or should the feed tier be default for paid orgs? | Product |
+| Q3 | Renovate and Dependabot behaviour on the targets file; emit `ignorePaths: [".socket/**"]`? | Docs |
+| Q4 | Re-vendor builder-1 seeds to builder 0 once the service artifact ships? | Post-GA |
+| Q5 | Dual wiring (legacy for packages.config plus fallback for SDK) for mixed repos? | Post-prototype |
+
+## 15. Prototype scope
+
+**Goal.** A working prototype for SDK sln with locks in locked mode, and for CPM, with no change to default behaviour.
+
+**Gating.**
+- `--nuget-layout` on `GlobalArgs`, with the inference rules from §5.
+- `layout_for(entry, state, run)` is used by `dispatch_vendor_one` (callers at `vendor.rs:2636` and `repair_vendor.rs:1632`, and via `vendor_records`).
+- `service_preflight` changes signature to take `&VendorState`.
+- The revert arm uses the hybrid router.
+
+**In scope:**
+- Fallback tier; 3-part V′.
+- All roles, including range-consumers.
+- The DBP block, the anchor, and `sync_shared`.
+- `.gitattributes` with probes.
+- Guards 001–006 and the pack checks.
+- NuGetAuditSuppress.
+- Hot path, `--check` (including `--online`), revert.
+- Patch update.
+- The pristine fetch rung.
+- VEX extractor, crawler skip, in-use probe.
+- v4 anchor and hybrid router.
+- Flavor gate, WIRING_FILES, sweep.
+- Name validation and escaping.
+
+**Out of scope:** the feed tier and signing; 4-part and prerelease upstreams; packages.config (legacy, and mixed repos are refused); `--nuget-relock`; migration (refused with `vendor_nuget_layout_mixed`); hosted, apart from the `:5431` fix.
+
+**Modules** (under `crates/socket-patch-core/src/vendor/` unless noted):
+
+| Module | Items |
+|---|---|
+| `nuget_version.rs` | `NugetBuilder`, `SocketNugetVersion`, `socket_nuget_version`, `parse_socket_nuget_version`, `check_version_gap` |
+| `nuget_projects.rs` | `NugetProject`, `discover_projects` (`*.*proj`, sln, worktree-bounded), `plan_closure` (V′-aware, bidirectional), `ProjectRole::{Direct, CpmUniform, CpmSplit, AutoFollow, Pin{tfm_alias, parent}, RangeConsumer}`, `excluding_constraints`, `external_consumers` |
+| `nuget_lock.rs` | `LockEntryEdit`, `plan_lock_edits`, `splice` (EOL-aware), `revert_lock_entry_record`, `semantic_eq` |
+| `nuget_seed.rs` | `reversion_nupkg`, `extract_seed` (decode then validate), `seed_inventory`, `walk_seed_strict`, `write_seed_atomic` |
+| `nuget_targets.rs` | `render_targets`, `render_gitignore`, `render_gitattributes`, `render_dbp_block`, `inject_block`, `excise_block`, `msbuild_escape` |
+| `nuget_shared.rs` | `sync_shared(cwd, &VendorState, dry_run)` |
+| `nuget_policy.rs` | `effective_signature_mode` |
+| `nuget_fallback.rs` | `vendor_nuget_fallback`, `revert_nuget_fallback_opts`, `service_preflight`, `fallback_prelude`, `fallback_in_sync`, `layout_for`, `fetch_pristine` |
+| `state.rs` | `NugetMeta` (with `wired`, `literals`, `allowUnpatched`, upstream hashes), `nugetLayout`, `nugetShared`, `fileInventory` intactness in `ledger_covers` |
+| `ledger_snapshots.rs`, `path.rs`, `verify.rs` | new kinds; uuid8 nested leaf parser; reserved names; set-equality verify |
+| `nuget_feed.rs` | flavor gate; `CONFIG_NAMES` |
+| `crawlers/nuget_crawler.rs`, `vex/discover/nuget.rs`, `vex/discover/mod.rs:1750` | skip seeds; fallback extractor; probe files |
+| CLI `vendor.rs`, `rollback.rs`, `remove`, `gc`, `repair_vendor.rs`, scan/get | `sync_shared` calls; `vend_installed!` fix; in-use probe; `GlobalArgs` flag |
+
+The CLI and VEX work adds roughly 30–40% over the revision 1 estimate.
+
+**Prototype acceptance:**
+- the §13 unit goldens;
+- sln and CPM e2e on SDK 6–10, plus Windows and macOS;
+- the docker suite and the real-clone legs;
+- G1, G3, G4, G10–G15;
+- zero changes to existing NuGet test outcomes.
+
+**Promotion to default** additionally requires G2, G7, G8 and G16; depscan #2–#4; and one release as opt-in.
+
+## 16. Adversarial review
+
+Dispositions: **Fixed** (design changed), **Refused** (moved to refused shapes), **Accepted** (risk kept, with rationale), **Open** (gating experiment or question).
+
+### Shapes
+| ID | Finding | Disposition |
+|---|---|---|
+| S-B1 | `[V′]` spreads via ProjectReference (NU1107, NU1608, NU1004 outside the closure) | **Fixed:** `[V′, )`, SOCKETPATCH006, range-consumer lock edits, gap check (§6.1, §6.4, §6.5). Goldens G11. |
+| S-B2 | Once-guard on a chained DBT imports too early; pin gives NU1504 | **Fixed:** DBP `CustomAfterDirectoryBuildTargets` (§6.3). SDK 6/7 is G10. |
+| S-B3 | autocrlf breaks the seed | **Fixed:** generated `.gitattributes` plus `check-attr`; LFS refused (§6.2) |
+| S-M1 | Pins not TFM-conditioned | **Fixed:** alias condition from assets; unknown alias refused |
+| S-M2 | Consumer outside the root breaks, or goes silent under `[V′, )` | **Refused:** `vendor_nuget_external_consumer`; 006 covers in-root drift |
+| S-M3 | 004 fires after the nupkg is written | **Fixed:** pre-check plus deletion of `NuGetPackOutput` (G2) |
+| S-M4 | Several nuspecs give MSB4184 | **Fixed:** exact nuspec path |
+| S-M5 | Non-SDK PackageReference projects are unguarded | **Refused:** `vendor_nuget_non_sdk_project` |
+| S-M6 | NU1903 still fires on V′ | **Fixed:** §2.3 corrected; NuGetAuditSuppress in prototype; info code on < 6.11 |
+| S-M7 | Literal spellings, `*.proj` types, SDK < 8 `-getItem` | **Fixed:** one condition per spelling, `*.*proj` plus sln; SDK < 8 property versions and missing SDK refused |
+| S-minor | CPM golden, canonical order, per-package seed hashing, exact literal in pack, implicit refs, tool wording, RID goldens, MAX_PATH, analyzers | **Fixed:** §6.5, §6.6, §7.1, §13, uuid8. Seed hashing moved to a once-per-restore check (`_SpSeedChecked`). Analyzers are G1. |
+
+### Environments and CI
+| ID | Finding | Disposition |
+|---|---|---|
+| E-B1 | EOL normalization fails fresh clones | **Fixed:** `.gitattributes`, `--check` against HEAD blobs, `ls-files --eol`, clone legs in acceptance |
+| E-M1 | Same-bytes V′ in the GPF fails 003 with destructive advice | **Fixed:** content-aware 003, `<idl>/<V′>` keys, new message (G15) |
+| E-M2 | Guard runs in design-time builds | **Fixed:** `DesignTimeBuild` condition; §9 corrected (G16) |
+| E-M3 | Windows path depth | **Fixed:** uuid8 directory, absolute-path check with refusal, Windows leg in prototype |
+| E-M4 | EOL-sensitive comparisons | **Fixed:** generated files `-text`; EOL-neutral records and splices |
+| E-M5 | Mixed packages.config/SDK undefined | **Refused:** `vendor_nuget_mixed_project_styles`; dual wiring is Q5 |
+| E-M6 | `--check` needs restore outputs | **Fixed:** persisted closure is authoritative; unrestored applies only to new projects |
+| E-M7 | Renovate/Dependabot edit the targets | **Fixed:** property-indirected versions, render sha, 006 catches edits. Q3 stays open. |
+| E-minor | Sparse checkout, Docker COPY, `git clean`, seed size, case collisions, predictable-V′ attack, SBOM alerts, setup-dotnet cache, concurrency | **Fixed/Accepted:** block comment; `vendor_nuget_dockerfile_copy`; untracked-seed check; size caps; case-fold refusal; server gap check over org upstreams (residual accepted, §9); depscan #4; dot-directory skip; no fix needed for concurrency |
+
+### Integrity
+| ID | Finding | Disposition |
+|---|---|---|
+| I-B1 | Seed file set unpinned; planted files disable the guard; lock pins nothing | **Fixed:** restore-time set and hash check (G13), strict CLI walk, `--check --online`, unconditional guard. §1 wording narrowed. **Accepted residual:** a dev machine that already restored a planted seed runs its code; CI `--online` is the defence. |
+| I-B2 | Git transforms seed bytes | **Fixed** (same as E-B1) |
+| I-M1 | Env var, props or rsp disable the guard | **Fixed:** unconditional assignment (VERIFIED-ADV x1), CLI allowlist, rsp flagging |
+| I-M2 | New nested DBT hides the import silently | **Fixed/Accepted:** `--check` evaluates every project's import; documented as the CI gate. Build-time silence is accepted. |
+| I-M3 | GPF V′ beats the seed | **Fixed:** content-aware 003; §9 wording corrected; exact per-uuid root is no longer needed because keys are content-based |
+| I-M4 | Builder 1 is not one byte sequence | **Fixed:** feed tier accepts builder 0 only. **Accepted** for the fallback tier: only lock churn. |
+| I-M5 | Drift repair from a poisoned GPF | **Fixed:** repair only from depscan or a signature-verified download |
+| I-M6 | Upstream provenance lost | **Fixed:** signature or sha512 check at vendor; `upstreamSha512` recorded; depscan #3 is GA |
+| I-M7 | Repo-level pfx author trust is id-unscoped | **Fixed:** feed tier defaults to CA cert; ephemeral-key opt-in; `--check` flags trustedSigners |
+| I-M8 | Percent-decoding traversal and MSBuild injection | **Fixed:** decode then validate, metacharacter refusal, escaping, strict validation at render |
+| I-M9 | Analyzer and build-only packages unguarded | **Fixed:** `@(Analyzer)`, assets `libraries`, unconditional restore check (G1) |
+| I-minor | Symlinks, late `require`, nuspec edits, §9 wording, stale obj, hex-case golden | **Fixed:** symlink refusal on ancestors; `--check` policy re-probe; set check; wording; test legs; golden |
+
+### Lifecycle
+| ID | Finding | Disposition |
+|---|---|---|
+| L-B1 | Patch update renders both uuids, pins a dead V′, breaks revert | **Fixed:** `sync_shared` after persist and sweep; V′-aware planner; `original: None` carry-forward; replaced entry excluded (§7.5) |
+| L-B2 | Import records lost across uuids, order and crashes | **Fixed:** state-owned block, record-free excision, blocks removed before the targets, stub on drift (§7.2) |
+| L-B3 | Seed not byte-stable through git | **Fixed** (E-B1) |
+| L-M1 | Preserved or Kept entries re-wired | **Fixed:** `wired` flag; missing seeds are never rendered |
+| L-M2 | Revert order defeats drift-keep | **Fixed:** §7.4 order |
+| L-M3 | No pristine source on clean machines; `debug_assert` panic | **Fixed:** fetch rung verified against ledger hashes; assert removed for fallback (§7.7) |
+| L-M4 | Hot path and `--check` before restore; re-plan misreads V′ | **Fixed:** persisted plan; V′ decoded as V |
+| L-M5 | v4 binaries corrupt fallback entries | **Fixed/Open:** literal uuid anchor, hybrid router, heal step; G14 |
+| L-M6 | VEX silently drops fallback patches | **Fixed:** extractor and probe files in prototype scope |
+| L-M7 | Unsafe unwind of shared outputs and reused seeds | **Fixed:** staged writes, snapshots, delete only what this run created |
+| L-M8 | Migration destroys its own source | **Fixed:** prelude first, re-version the committed legacy nupkg, one atomic unit (§7.6) |
+| L-M9 | Restore does not fail closed on a missing targets file | **Fixed/Accepted:** anchor NU1301 when `.socket` is gone (G12); targets-only deletion accepted, with `--check` as CI gate; §9 corrected |
+| L-M10 | Transitive pins keep themselves alive | **Fixed:** pin conditioned on the direct parent; in-use probe excludes self-edges; `pin_orphaned` |
+| L-M11 | Layout choice does not persist | **Fixed:** `GlobalArgs` flag, inference, `nugetLayout` |
+| L-P1 | Prototype needs CLI hooks not in §15 | **Fixed:** §15 scope and module table extended (+30–40%) |
+| L-minor | User edits of the targets, submodules/templates, builder churn, dry run, directory `ledger_covers`, NU1903 | **Fixed:** render sha plus `targets_edited`; worktree bound plus skip; builder sticky; in-memory render; inventory intactness; S-M6 |
+
+## 17. Prototype (follow-up branch `v5/nuget-vendoring-prototype`): what was built and how it deviates
+
+**Code:** `crates/socket-patch-core/src/vendor/nuget_{version,seed,lock,targets,fallback}.rs`, plus small routing hooks in `vendor/mod.rs`, `commands/vendor.rs` and `commands/repair_vendor.rs`.
+
+**Tests:**
+- unit tests in each module;
+- lock fixtures captured from real `dotnet` in `crates/socket-patch-core/tests/fixtures/nuget-fallback/{sln,cpm,cpmpin,cpm-tool}`. NuGet's own `--force-evaluate` output is the golden for the splice;
+- `crates/socket-patch-cli/tests/e2e_nuget_fallback_dotnet.rs`, which is `#[ignore]` and runs against the real SDK and nuget.org. Its legs are `sln_locked`, `cpm_locked`, `cpm_pinning` and `sln_patch_update`.
+
+The default layout is unchanged: every existing NuGet test passes untouched.
+
+Implementation: `crates/socket-patch-core/src/vendor/nuget_{version,lock,seed,targets,fallback}.rs`.
+
+### Behaviour deviations (deliberate)
+
+1. **Lock rule for a range at V that resolved elsewhere.** The spec only edits entries whose `resolved` is V. NuGet also rewrites `requested "[V, )"` → `"[V′, )"` on a `CentralTransitive` (or `Direct`) entry that resolved to some other version (cpm-tool `Tool`: `resolved 12.0.1`). Without this edit, `--locked-mode` fails NU1004. The splice now makes the requested-only edit (`resolved` and `contentHash` are left unchanged), and the golden `cpm-tool` fixture proves it.
+2. **`CentralTransitive` at V counts for transitive-only too.** Under CPM *without* pinning, a `CentralTransitive` V entry is refused `vendor_nuget_transitive_only` when the project has no `Project` reference to a redirected project. This follows from NuGet itself: without pinning the central version is not applied, so the entry resolves upstream V and the build guard would fire. With `CentralPackageTransitivePinningEnabled` it is redirected. Pinning is detected by a repo-global text scan.
+3. **Layout selection is per purl.** The env var or any `nuget-fallback` ledger entry selects the fallback layout, except for a purl the ledger already holds as a legacy feed entry: that purl keeps routing to `nuget_feed` (vendor and service preflight), so an in-sync legacy entry never fails `vendor_nuget_layout_mixed` once the repo opts in. The refusal stays in the backend for direct callers. The earlier "targets file exists" signal was dropped: `.socket/` writes are outside the group commit, so a failed or crashed run could leave the targets behind and silently opt the repo in.
+4. **DBP block text.**
+   - The begin comment is `(generated; remove with: socket-patch vendor revert)`. An XML comment cannot contain `--`, and a DBP that fails to load is silently ignored by restore.
+   - `<rel>` is rendered with its trailing slash (`""` / `../`), which gives `$(MSBuildThisFileDirectory).socket/...` and never `//.socket`.
+   - **The anchor line is gone.** Registering `.socket/vendor/nuget` itself as a fallback folder let anyone plant `<id>/<ver>/` beside the uuid dirs and have NuGet restore it under `--locked-mode` with no seed check (security review, reproduced on SDK 8). The block now holds a `SocketPatchNuGetImportCheck` target instead (`BeforeTargets="_GenerateRestoreGraph;CollectPackageReferences"`, condition `'$(SocketPatchNuGetTargetsImported)' != 'true'`), which fails restore with **SOCKETPATCH007** when the targets were not imported (the vendored tree is missing; restore ignores the missing import). The e2e proves it for locked and unlocked restore. `-p:SocketPatchNuGetGuard=false` disables it like the other guards.
+   - A props file socket-patch **created** carries `socket-patch:begin created` on its begin line. Only such a file is deleted on the last revert, when nothing but its block was added (compared with BOM and CRLF normalised). A user's own `<Project>\n</Project>\n` is kept, and a CRLF checkout of a created file is still deleted. Re-rendering a block keeps the tag.
+   - The `</Project>` insertion point (and a self-closing `<Project/>`) is found with comments blanked, so a `</Project>` inside a trailing comment is never used.
+5. **The render inputs live in the marker.**
+   - `socket-patch.vendor.json` gains an optional `nuget` section: `id`, `version`, `socketVersion`, `contentHash`, `spellings`, `inventory`, and `wired` (default true).
+   - `sync_shared` renders the seed inventory from the marker, never from the disk, so a tampered seed is never re-baselined.
+   - The marker is not trusted alone: when the ledger has a `nuget-fallback` entry for the uuid, its `artifact.file_inventory` replaces the marker's inventory in the render. The one exception is the seed the current vendor run just wrote (`RenderScope::fresh`). The markers are also diffable in `.gitattributes` (`/*/socket-patch.vendor.json -text diff`), so a changed hash shows in review.
+   - The `AlreadyPatched` fast path also requires every patched file in the seed to hash to its `afterHash`.
+   - A `--preserve-state` revert (`keep_artifact`) writes `wired: false`. The seed stays on disk but is no longer rendered into the targets.
+6. **Extra refusal codes** beyond the spec list:
+   - `vendor_nuget_nuspec_patched`: the patch rewrites the root nuspec, which the layout re-versions.
+   - `vendor_nuget_version_literal_unknown`: a `$(Property)` or item version for the id.
+   - `vendor_nuget_lock_unreadable`: an unparseable or unreadable lock.
+   - `vendor_nuget_seed_failed`: the canonical zip failed.
+   - `vendor_nuget_symlink_unsupported`: a project file, `Directory.Build.props` or `packages.lock.json` under the root is a symlink (an atomic rewrite would replace the link, and a skipped linked props file would silently shadow the wiring). `sync_shared` and revert refuse the same way before writing anything.
+   - `vendor_nuget_repo_too_large`: the discovery walk hit its 100,000-entry cap. Vendor refuses, and `sync_shared` / revert fail before writing, instead of silently wiring only part of the tree.
+   - Coordinates containing `--` refuse `unsafe_coordinates` (they are rendered into XML comments); `.` / `..` and `--` never render from a marker either.
+   - Floating (`*`) or bracketed ranges naming V in csproj/props text refuse `vendor_nuget_range_unsupported`, the same code as lock ranges.
+7. **Member-name validation.**
+   - Names are percent-decoded first.
+   - They must then pass `is_safe_relative_subpath` + `is_plain_archive_name` + `names_are_unambiguous` (printable ASCII; no `\ : * ? " < > |`; no case-fold collisions).
+   - Names containing `$ @ % ; '` are refused instead of escaped.
+   - Members named `.nupkg.metadata`, `*.nupkg` or `*.nupkg.sha512` are refused.
+   - OPC parts (`[Content_Types].xml`, `_rels/`, `package/`) and `.signature.p7s` are dropped, compared case-insensitively.
+   - The nuspec `<id>` must match the purl id.
+8. **`vendor_nuget_no_lockfile`** is emitted when **no** discovered `packages.lock.json` references the id (at V, V′ or an older Socket version of V), not per project.
+9. **Signature policy is conservative.**
+   - The CLI refuses if *any* config sets `signatureValidationMode=require`. It checks every dir from each SDK project dir up to the root, the root and its ancestors (all three config spellings), `~/.nuget/NuGet/NuGet.Config`, and `%APPDATA%/NuGet/NuGet.Config`.
+   - NuGet's nearest-wins override is not modelled, and `DOTNET_NUGET_SIGNATURE_VERIFICATION` is not read.
+10. **contentHash bytes.** The canonical zip is built with the existing `write_zip_entries` (zip-crate deflate level 6, fixed DOS time, mode 0644), so its hash differs from the Python-built fixture hash (`DDiM…`). NuGet only string-compares lock ↔ `.nupkg.metadata`, and the real-dotnet e2e proves the Rust value works.
+11. **Wiring record shape and per-entry revert.**
+    - One `nuget_lock_file_v2` record per lock that pins the id after the splice (edited now or already spliced): `key` is the id, `original` and `new` hold the whole text. Recording unchanged-but-spliced locks keeps their revert across a partial re-vendor.
+    - The kind is registered in `ledger_snapshots::WHOLE_FILE_KINDS`, so large `new` values are diff-encoded (ledger version 2).
+    - When the pre-edit lock already names a Socket version of V anywhere (a re-vendor, same or older uuid), `original` is `None` and `carry_forward_wiring` fills it from the replaced entry.
+    - **The revert does not restore whole files.** `nuget_lock::unsplice_lock` puts back only this entry's values (V′ in `resolved`, `requested`, Project `[V′, )` ranges, and the matching `contentHash`), each to the value the recorded `original` held at the same JSON path (else plain V / `[V, )`; a hash only from `original`). Another seed's splice, a package or framework added since, and EOLs are untouched, so seeds sharing a lock revert in any order and a stale carried-forward original cannot discard later edits. When no upstream hash is recorded the entry is left at V′ and reported `vendor_lock_entry_drifted` (the seed is then kept).
+12. **Seed rebuild.** An existing but stale seed dir for the same uuid is rebuilt through `<uuid>.socket-stage` + `swap_stage_into_place`. If a later step fails, the unwind deletes the seed only when this run created it, so a replaced stale seed is not restored.
+13. **Self-closing `<Project/>` DBP.** It is expanded to `<Project>…</Project>`, and excision leaves `<Project>\n</Project>` rather than byte-restoring the self-closing spelling (the file is kept, never deleted, since socket-patch did not create it). The same applies to a `</Project>` sharing a line with other content, where one extra EOL remains.
+14. **Seed materialisation.**
+    - The new `nuget_feed::patched_nupkg_bytes` wraps the unchanged `materialise_patched_nupkg` (service download → local rebuild) in a private temp stage.
+    - `config_wired=true` is passed only so a failed build does not prune the stage's parents.
+    - The seed is then extracted from those same-version bytes.
+15. **Patch update (new uuid).** `splice_lock` treats any value at an *older* Socket version of the same V (resolved, requested, Project range) as a re-splice target and moves it to the new V′ and hash. The vendor run leaves the superseded uuid's seed out of the render (`RenderScope::exclude`), and the CLI re-runs `sync_shared` after `sweep_stale_artifact` deletes the old uuid dir. The new `sln_patch_update` e2e leg proves the flow with real dotnet.
+
+### Verified with real dotnet (SDK 8.0.131, nuget.org)
+`e2e_nuget_fallback_dotnet` covers `sln_locked`, `cpm_locked`, `cpm_pinning` and `sln_patch_update`. The first three each do the following:
+- runs the real `socket-patch scan --mode vendored --vendor-source build` with `SOCKET_PATCH_NUGET_LAYOUT=fallback`;
+- on a fresh copy, runs `restore --locked-mode` with a cold GPF: the locks are unchanged and the App (and Tool) bin dll carries the patched bytes;
+- does the same with a warm GPF that holds upstream 13.0.1;
+- tampers a seed file and checks for `SOCKETPATCH002`, then restores the committed bytes and checks that restore passes;
+- removes `.socket/vendor/nuget` from a checkout and checks that locked and unlocked restore fail `SOCKETPATCH007`;
+- re-runs vendor **without** the env var (the ledger alone selects the layout) and checks that no project file changes;
+- runs `vendor --revert` without the env var and checks that the tree outside `.socket/` is byte-identical and no `.socket/vendor/` remains;
+- runs a locked restore and build of the reverted tree and checks that the pristine dll is back.
+
+`sln_patch_update` vendors uuid 1, then a newer patch (uuid 2) without the env var, and checks: no `vendor_nuget_no_lockfile`, both locks at V′₂ only, the targets name only uuid 2, the uuid 1 dir is gone, a cold locked restore leaves the locks unchanged and builds the uuid 2 bytes, and `vendor --revert` restores the pre-vendor tree byte for byte.
+
+### Known gaps (out of scope / follow-ups)
+- The following are not implemented:
+  - SOCKETPATCH003/004/006, pack range restore, per-project transitive pins, packages.config, the feed tier and signing, migration from the legacy layout (refused as `vendor_nuget_layout_mixed` for the same purl only), and `--check`.
+  - Post-write git probes: `vendor_artifact_gitignored` / `_git_transformed`.
+  - Long-path warning, size caps beyond the existing zip-bomb caps, and the version-gap/collision checks against nuget.org.
+- **Lock discovery** reads only `<projdir>/packages.lock.json`. `NuGetLockFilePath` and `packages.<Project>.lock.json` are ignored.
+- **Version literals** are found only as `Version=` attributes or `<Version>` children of `PackageReference` / `PackageVersion` / `GlobalPackageReference` in `*.csproj|fsproj|vbproj|props|targets` text. MSBuild evaluation is not used.
+- **DBP placement** only considers DBPs inside the root. A `Directory.Build.props` *above* the repo root that a project relied on is shadowed by the created root DBP, because the created file does not import the parent.
+- **Repair.** It can re-synthesise a fallback entry from the targets file (flavor stamped `nuget-fallback`), but not its lock wiring records. A revert of such a reconstructed entry deletes the seed and leaves the locks spliced.
+- **Service download path.** Every e2e vendor uses `--vendor-source build`; the fallback's use of a downloaded service artifact (`patched_nupkg_bytes` → service copy, fallback `service_preflight`) is covered only by unit tests of the shared feed pipeline.
+- **SOCKETPATCH005** (the build guard) is not exercised by the e2e.
+- **Marker trust.** A uuid dir with no ledger entry (state.json lost, or before the entry is committed) still renders from its own marker.
+- **Orphan sweep.** It now treats uuid dirs named in `socket-patch.targets` as wired.
+- **Migration.** A purl held by a legacy feed entry keeps the feed layout even with the env var set; migrating it needs a `vendor --revert` first.
+- **VEX.** There is no fallback extractor. Discovery returns nothing for fallback repos (the golden `vex-discover-golden/nuget-fallback.json` records empty results; there is no crash). Ledger-based VEX verifies the seed dir through the existing dir-artifact path, members plus `fileInventory`.
+- **Crawler.** After a restore, `obj/project.assets.json` lists the fallback folder as a package folder, so the crawler may report `newtonsoft.json@13.0.1.<N>` as an installed package. This is not mapped back to the upstream purl.
+- **Pre-existing failures, unrelated.**
+  - `cargo clippy --workspace --all-targets --all-features -- -D warnings` fails only in the untouched `crates/socket-patch-cli/tests/covgap_commands_rollback.rs:152` (dead fields `before_hash`/`after_hash`).
+  - 9 core lib tests fail in this environment regardless of this change (it runs as root: read-only-permission tests and an RSS measurement).
+  - `cargo fmt --all` reformats ~75 unrelated files on HEAD. Those changes were reverted; only the files touched here are rustfmt-clean.
+

From 388eea317ffd51f0efb1d4f28634127bf0c97e5d Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Mon, 28 Sep 2026 18:36:00 +0200
Subject: [PATCH 17/32] docs: keep v5 waste review and repacking design (#289)

Keep the v5 waste review and the repacking-to-depscan design from
PR #286 as reference docs. #286 is being closed without merging, and
its findings now belong to follow-up PRs. Each doc starts with a line
that links the triage map on #286, which gives every finding's owner.

Co-authored-by: Claude <noreply@anthropic.com>
---
 docs/design/repacking-to-depscan.md | 1014 +++++++++++++++++++++++++++
 docs/design/v5-waste-review.md      |  360 ++++++++++
 2 files changed, 1374 insertions(+)
 create mode 100644 docs/design/repacking-to-depscan.md
 create mode 100644 docs/design/v5-waste-review.md

diff --git a/docs/design/repacking-to-depscan.md b/docs/design/repacking-to-depscan.md
new file mode 100644
index 00000000..fc516a54
--- /dev/null
+++ b/docs/design/repacking-to-depscan.md
@@ -0,0 +1,1014 @@
+# Repacking moves to depscan (server-primary, one local class)
+
+> Reference copy of PR #286, which was closed without merging. Each
+> finding's owner (workstream, in-flight PR or owner decision) is in
+> the [triage map](https://github.com/SocketDev/socket-patch/pull/286#issuecomment-5869109317).
+
+Status: chosen design, pending owner sign-off on the open questions (last
+section). Baseline: socket-patch `release/v5-prerelease` at 8ae7dc37,
+depscan `master` at 93e149c9ba. Supporting evidence: the repacking inventory
+of both repos and the verified waste findings (cited as F01–F80). Line
+numbers are at those baselines; depscan paths carry a `depscan:` prefix.
+Where a claim rests on an in-flight v5 branch, the branch is named.
+
+## Summary
+
+- **depscan becomes the producer of installable patched bytes** for every
+  vendorable ecosystem except maven/nuget (frozen, unchanged). The CLI
+  resolves, downloads, verifies, and wires. It computes no lock pin except
+  the one class below, and a pin it does compute is always cross-checked
+  against the server's value where one exists.
+- **Exactly one local builder stays**: the pypi wheel built from the
+  installed dist (`pypi_wheel.rs`). It runs only when the server returns a
+  terminal `refused { localBuild: "allowed" }` verdict: releases with no
+  servable wheel for the requested tags (the installed binary was
+  necessarily built on the user's machine), or an upstream file over the
+  serve cap. The verdict is keyed on (uuid, requested wheel) and carries a
+  TTL, because PyPI can add wheels to a release later; the ledger's
+  `producer` keeps the choice sticky. It never runs because of an outage.
+- **One producer per artifact, and the ledger keeps it sticky.** Vendor
+  `state.json` records `producer`, `recipe`, `generation`, and
+  `statementDigest`. Outages, 5xx responses and `pending_build` fail
+  retryably and leave the lock untouched. The integrity flip that #250 and
+  `reuse.rs` exist to hide can no longer happen. Reuse stays, as the
+  network-free re-run path.
+- **Contract v2 is additive, on the existing endpoint** `POST
+  /v0/orgs/{slug}/patches/package` (and its anonymous twin `POST
+  /patch/package`). It adds per-uuid `refused`, `format`, `generation`,
+  `retryAfterSeconds`, pypi wheel variants, and a detached signed
+  statement (DSSE over JCS). Offline use gets a content-addressed user
+  cache and a signed export bundle. v1 stays schema-compatible: the only
+  changes are `yarn-berry-zip.url` becoming null and an additive
+  `yarnBerry10c0` on the tarball integrity.
+- **Sequencing respects WS5.** Everything before step 24 is additive and
+  flag-gated. Flipping the default (step 24) and deleting the builders
+  (Phase 4; about 2,050 CLI src LOC and about 1,260 test LOC) both need
+  the owner to reverse the WS5 caveat after #283 merges; step 24 also
+  needs 30 days of telemetry. CI minutes saved: about 0. This is a
+  correctness and maintenance change, not a CI lever. The CI levers are
+  F51 (≈280 job-min), F41, F52, F53 and F55 (see v5-waste-review.md
+  Top-10); F78, which contains F63, is a transient saving during the v5
+  draft train.
+
+## Current state
+
+### Who builds what
+
+LOC counts treat `#[cfg(test)] mod` as the boundary between src and test.
+"Byte-identical" means the CLI's local build equals the server artifact.
+
+| Flavor (all PM versions stay) | Server artifact (depscan:workspaces/patches/src/repack) | Server src/test LOC | CLI local build | CLI build src/test LOC | Lock pin (vendored) | Byte-identical? |
+|---|---|---|---|---|---|---|
+| npm, pnpm 1–10 incl. legacy, bun.lock/bun.lockb | tgz, `repackers/npm.ts` (upstream order, mtime 0, zlib default; depscan:workspaces/patches-shared/src/archive/repack-utils.ts:597-660) | 557 / 467 (npm incl. berry) | `npm_pack.rs:73-177` (sorted, mtime 499162500, flate2 level 6) plus `npm_common.rs:248-396` stage branch | 177 / 247 plus about 149 | sha512 SRI | **No** |
+| yarn classic | same tgz | — | same | — | sha1 `#hash` plus integrity | **No** |
+| yarn berry | tgz plus `yarnBerry10c0` (`berry-cache-zip.ts`, a TS port of `berry_zip.rs`); `.berry.zip` sidecar stored and never read (F33) | 353 / 167 | `berry_zip.rs` recompute over the local tgz | 333 / 320 | `checksum 10c0/…` plus `hash=` (first 6 hex of tgz sha512, `yarn_berry_lock.rs:272-277`) | Recipe yes; input tgz differs, so **no** in practice |
+| vlt | same tgz | — | `npm_dir.rs` `stage_patch_dir` local branch (about 594-730) | about 137 | none vendored (directory); hosted pins raw sha512 | n/a (extracted) |
+| pypi: uv, poetry, pdm, pipenv, requirements, hatch | wheel only with `artifact_id`/`packaging=wheel` qualifier, else the sdist (`pypiPurlWantsWheel`); bz2/xz sdists refused after download (`repackers/pypi.ts:131-138`, F69) | 411 / 816 | `pypi_wheel.rs` from installed site-packages RECORD, Deflated zip | 696 / 1,288 | wheel sha256 | **No** |
+| gem (Bundler, all eras) | `.gem` plus stub `.gemspec`; platform gems refused | 777 / 768 | `gem.rs` `materialise_patched_copy` (1192-1339) | 148 | none (PATH source, CHECKSUMS stripped) | n/a (extracted) |
+| cargo (lock v1–v4) | `.crate` plus sparse-index line | 982 / 976 | `cargo.rs` `copy_and_patch` | 86 | none (path dep, `.cargo-checksum.json` dropped at `cargo.rs:394`) | n/a (extracted) |
+| golang | module zip plus gopatch zip plus go.mod, dirhashH1; no-go.mod modules refused (depscan:…/repackers/golang.ts:109-115) | 792 / 485 | FallBack arm (`golang.rs` about 291-354) into `patch/redirect/golang_local.rs` (agent-mode code, stays) | about 64 | none (dir `replace`, no go.sum) | n/a (extracted, h1 verified) |
+| composer | dist zip (STORE) | 308 / 352 | `composer_lock.rs` `copy_and_patch` | 60 | none (path dist) | n/a (extracted) |
+| maven | jar (STORE) plus pom | 483 / 523 | `local_rebuild_jar`/`rebuild_jar_bytes` (Deflate, `maven_repo.rs:776-862`; the byte difference is shown by the test at :4112) | about 160 | `.sha1` sidecars | **No** (frozen) |
+| nuget | nupkg (STORE, unsigned) | 167 / 187 | `nuget_feed.rs` `local_rebuild` | 130 | contentHash = b64(sha512) | untested (frozen) |
+
+Shared machinery:
+- CLI side:
+  - `registry_fetch.rs`: 2,316 src and 2,914 test LOC. It holds the
+    pristine ladder, the verifiers and the extractors.
+  - `source.rs`: 222 / 135.
+  - `reuse.rs`: 382 / 741.
+  - `service_fetch.rs`: 321 / 564.
+  - `prestage.rs`: service-only, despite being listed in WS5.
+- Server side:
+  - `upstream/*`: about 3,043 LOC including tests.
+  - `patches-shared/src/archive`: 2,041 / 1,894.
+  - `services/patch-package`: 3,031 / 646.
+  - repack overall: 6,015 / 4,976, 133 tap tests.
+- Churn:
+  - The CLI builders are cold: npm_pack 4 commits, berry_zip 4,
+    pypi_wheel 7.
+  - The server repack is under active hardening: 31 commits, including
+    #22388, #23523, #25259, #26792 and #26857.
+- Bug history:
+  - CLI builders: no packing-specific fix commit. The npm_pack (4),
+    berry_zip (4) and pypi_wheel (7) commits are all omnibus or feature
+    PRs.
+  - Shared machinery: registry_fetch has 11 commits (16 with `--follow`,
+    15 of them fix-matching), including #175 (bundler audit, 13 bugs),
+    #241 (poetry) and #242 (pipenv). service_fetch has #249 (trust
+    hardening) and #194 (cargo fail-closed); reuse.rs came from #250.
+  - Server `pypi.ts`: 5 fix subjects (#21508 sdist reliability, #22724
+    src-layout rescue, #22752 version spelling, #23523 artifact
+    integrity, #25259 bz2/xz).
+
+**Integrity today:**
+- **Hosted mode already derives no pin.** Every value comes from the
+  server (`scan/hosted.rs:1282-1318`). The CLI hashes only to verify: vlt
+  preflight, wheel METADATA, and gem stale-cache warnings.
+- **Vendored mode produces pins locally** whenever `auto` falls back:
+  - The fallback triggers on Pending, Unavailable, Failed, layout or
+    afterHash mismatch, or no client (`service_fetch.rs:170-265`).
+    `IntegrityMismatch` is always a hard failure.
+  - The CLI ignores the server's `yarnBerry10c0` (`api/client.rs:1278-1280`).
+  - Repair on the base branch is build-only (`commands/vendor.rs:123-126`).
+  - A pypi dry run always previews the local build (`pypi.rs:1807-1809`).
+
+**Waste the two producers cause:**
+- `reuse.rs:1-12` says in its own header that it exists so "a prebuilt ↔
+  local source flip between two runs (a service outage, or its recovery)"
+  does not rewrite the lock.
+- The Auto/Service policy is hand-rolled in 7 backends (F32; 35-45
+  duplicated lines each). The shared `service_archive_copy` serves only
+  maven and nuget.
+- Every vendored reference is one POST per uuid at quota 20 each
+  (`client.rs:1429-1437`, F28).
+- Qualifier-less pypi purls are a guaranteed service miss, downloaded in
+  full before being rejected (F70, F71).
+- The 12 `e2e_vendor_*_build.rs` capstones (15,853 LOC, about 92 tests) and
+  the 58 `--vendor-source build` call sites (in 36 test files at 8ae7dc37;
+  the same on v5/integration) test only the local builder.
+
+**Unmeasured:** the real service-hit versus local-fallback rate. CLI
+telemetry does not record the vendor source. `patch_vendored` is also
+unclassified server-side, and its endpoint sunsets on 2026-12-31 (F22).
+
+### WS5 caveat answer: does depscan use CLI packing code?
+
+**No.** depscan has:
+- no napi or FFI link to socket-patch-core;
+- no crate dependency;
+- no subprocess packing.
+
+It imports only the `@socketsecurity/socket-patch/schema` TS types
+(depscan:workspaces/lib/src/socket-patch/manifest-schema.ts:9). The CLI
+binary runs in depscan only in tests and tools, plus `socket-patch apply`
+in the autotester image (depscan:docker/Dockerfile.autotester-worker:19-25)
+and the pipeline postinstall `pnpm dlx @socketsecurity/socket-patch@4.0.0
+apply` (depscan:workspaces/pipeline/package.json:15-16). Both are
+agent-mode apply, not vendoring.
+`berry-cache-zip.ts` is a port of `berry_zip.rs`, not a consumer of it.
+Deleting the CLI builders is therefore a CLI-only product decision.
+
+Two couplings are still real:
+1. **depscan api-v0 e2e vendor suites 89-94** run in `auto` and silently
+   fall back to the local builder on a service miss. Removing the builder
+   weakens them without failing them.
+2. **WS1 (#280) consumes CLI helpers.** It consumes `registry_fetch` and
+   `berry_zip` (origin/v5/ledger-free-hosted
+   `patch/redirect/upstream/client.rs:11,204,256-257,361-369,500-504,592`,
+   `upstream/vlt.rs:76`, `upstream/npm.rs:432`). Those helpers stay (see
+   What must stay).
+
+`prestage.rs` is not a local-rebuild file: it pre-extracts service
+archives.
+
+## Design
+
+### Principles
+
+1. **One producer per (uuid, variant).** The server's verdict decides it,
+   never availability. The verdict is terminal; the ledger's recorded
+   `producer` keeps it sticky across runs.
+2. **The CLI computes a pin only for `producer = local`.** Otherwise the pin
+   is copied from the reference and cross-checked against the verified
+   bytes. The two must agree, or the result is `IntegrityMismatch`.
+3. **Acquire before wiring.** Every artifact in the run is acquired and
+   verified into the cache before any project file is written. Per-package
+   failures leave that package's lock untouched.
+4. **Trust decisions happen in one verify step.** It never falls back to
+   another source on mismatch.
+5. **maven and nuget keep today's artifact acquisition and wiring
+   byte-for-byte:** `service_archive_copy`, the local rebuild, and
+   `--vendor-source build`. They do take part in the batch reference POST
+   (step 1), which is behavior-neutral. Under contract 2 the CLI maps a
+   `refused` answer for a maven/nuget uuid onto the existing v1
+   `build_failed`/fallback arm (or requests those uuids under contract 1),
+   so `service_archive_copy` behavior is unchanged.
+
+### When the one local build is allowed
+
+A class may build locally only when all three of these hold:
+- (a) the server's refusal is terminal for the requested artifact (for
+  pypi: the uuid plus the requested filename or tags; see the TTL note
+  below the table);
+- (b) the correct bytes depend on the user's machine;
+- (c) the CLI can build deterministically from local state.
+
+| Class | Resolution |
+|---|---|
+| npm family, berry, vlt | server only; local packing deleted |
+| gem (ruby platform), cargo, composer | server only; `copy_and_patch` arms deleted |
+| gem platform | refused on both sides (`gem.rs:209-237`); unchanged |
+| golang without go.mod | server synthesizes `module <path>` as proxy.golang.org does; lifts golang.ts:109-115 |
+| pypi, upstream wheel exists (bare or sdist purl) | server builds the wheel variant the lock pins |
+| pypi, no servable wheel (sdist-only, no tag match, bz2/xz-only) | `refused {code: pypi_no_servable_wheel, localBuild: allowed}` → `pypi_wheel.rs` from the installed dist |
+| pypi, upstream file larger than the serve cap (torch, tensorflow, jaxlib, `nvidia-*` wheels) | `refused {code: artifact_too_large, localBuild: allowed}`, emitted before download from the size in the PyPI JSON → `pypi_wheel.rs` (no cap on the installed dist) |
+| npm family, upstream tarball larger than the serve cap | `refused {code: artifact_too_large, localBuild: forbidden}`, emitted before download from the packument; an accepted regression (Open questions) |
+| output exceeds the CLI's extraction caps | `refused {code: artifact_exceeds_client_caps, localBuild: forbidden}` (see Risks) |
+| maven ext/classifier, all maven/nuget | frozen: current behavior, including `auto` fallback |
+
+The serve cap is `MAX_SERVABLE_ARCHIVE_BYTES` = 100 MiB
+(depscan:workspaces/patches/src/services/patch-package/build.ts:37-44), and
+upstream downloads are capped at 256 MiB
+(depscan:workspaces/patches-shared/src/archive/repack-utils.ts:23). Today
+the output-size check runs after the build, as a deterministic
+`build_failed`; without the pre-download refusal, large pypi releases
+would lose their only working path.
+
+`pypi_no_servable_wheel` is not immutable: PyPI accepts new wheels for an
+existing release at any time (late cp313 or musllinux wheels are common),
+and "no tag match" depends on the requester's platform. The refusal is
+keyed on (uuid, requested filename or tags) and carries a TTL. Flips are
+prevented by the ledger: once an artifact is recorded as
+`producer = local`, later runs keep it until `--repin`.
+
+The retained recipe is versioned as `local:pypi-wheel/1`. It pins today's
+bytes: lexicographic order, RECORD last, and fixed stamps, via
+`common.rs:248` Deflated.
+
+`Cargo.lock:457-465` shows flate2 1.1.9 pulling both `miniz_oxide` and
+`zlib-rs`, so a dependency bump could silently change the bytes. To guard
+against that:
+- a committed golden vector asserts the output bytes;
+- the backend is pinned explicitly;
+- any byte change bumps the recipe id.
+
+Bytes built under an old id stay reusable. Repairing one under a new CLI
+fails closed with a `--repin` remedy.
+
+### API contract (depscan)
+
+**Endpoints.**
+- Authenticated: `POST /v0/orgs/{slug}/patches/package`
+  (depscan:workspaces/api-v0/src/endpoints/orgs/patches/package.ts, quota 20
+  at :293, max 500 uuids at :330). It is backed by
+  depscan:workspaces/app/src/patches/patch-package-references.ts.
+- Anonymous: `POST /patch/package` in
+  depscan:workspaces/patches-api-proxy/src/server.ts:1003. It already
+  forwards the parsed body verbatim except for forcing `freeOnly`
+  (:1043-1066), and it caps bodies at 256 KiB
+  (`MAX_PATCH_PROXY_BODY_BYTES`, :199).
+  depscan:workspaces/purl-api-proxy/routes/patch.ts is a pass-through
+  `/patch/*` alias (including `package`) with its own 1 MB cap.
+- **Body size.** A 500-uuid request with `variants` must fit the 256 KiB
+  cap. The CLI caps `variants` per request and chunks at fewer than 500
+  uuids when variants are present.
+- No new artifact routes. Bytes stay on patch.socket.dev.
+
+**Request (v2).** Additions are marked `+`.
+
+```
+{ "uuids": ["<uuid>", …],                  // ≤ 500
+  "freeOnly": false,
++ "contract": 2,
++ "variants": { "<uuid>": {
++     "pypiWheelFilename": "foo-1.2.3-cp311-cp311-manylinux_2_17_x86_64.whl",
++     "pypiUpstreamSha256": ["<hex>", …],
++     "pypiWheelTags": ["cp311-cp311-manylinux_2_17_x86_64"],
++     "generation": 1 } } }                 // optional; repair only
+```
+
+`pypiWheelFilename` is the upstream file the project's lock pins (uv, pdm
+and poetry list per-file hashes). `pypiUpstreamSha256` covers locks that
+pin hashes with no filenames (Pipfile.lock, `requirements --hash`): the
+server maps each hash to the upstream file through the PyPI JSON it
+already reads, so those flavors need no installed dist and the CLI keeps
+no hash-to-URL resolver. `pypiWheelTags` is the last fallback: it comes
+from the installed `*.dist-info/WHEEL` when the lock pins neither, for
+example requirements without hashes. `generation` lets repair request the
+generation its ledger recorded.
+
+**Response (v2).** The endpoint returns `{ results: { <uuid>: … } }`
+(depscan:workspaces/api-v0/src/endpoints/orgs/patches/package.ts:147-174,
+343-372). The sketch is one value of that map; additions are marked `+`.
+
+```
+{ + "contract": 2,
+    "results": { "<uuid>": {
+      "status": "granted" | "reused" | "pending_build" | "build_failed"
+              | "refused" (+, v2 only) | "withdrawn" | "forbidden" | "not_found",
+      "url": "…" | null,                     // tarball URL; unchanged
+      "purl": "…" | null,                    // unchanged
+  +   "retryAfterSeconds": 20,               // pending_build only
+  +   "failureCode": "UNSUPPORTED_ARCHIVE_FORMAT", // build_failed only; static
+  +   "refusal": { "code": "pypi_no_servable_wheel" | "artifact_too_large"
+  +                      | "artifact_exceeds_client_caps" | "gem_platform"
+  +                      | "maven_classifier",
+  +                "localBuild": "allowed" | "forbidden" },  // refused only
+  +   "generation": 1,
+      "artifacts": [{
+        "kind": "tarball" | "gem-stub-gemspec",
+  +     "format": "npm-tgz" | "whl" | "sdist-tgz" | "sdist-zip" | "gem"
+  +             | "crate" | "go-zip" | "composer-zip" | "jar" | "nupkg",
+  +     "variant": "default" | "<upstream wheel filename>",
+  +     "filename": "…",
+        "url": "…", "contentType": "…", "sizeBytes": 123,
+  +     "recipe": "depscan-repack/npm@1",
+        "integrity": { "sha512": "sha512-…", "sha256": "…", "sha1": "…",
+                       "md5": "…", "dirhashH1": "h1:…", "goModH1": "h1:…",
+                       "yarnBerry10c0": "10c0/…" } }],  // 10c0 now on the tarball
+  +   "statement": { "payloadType": "application/vnd.in-toto+json",
+  +                  "payload": "<b64 JCS statement>",
+  +                  "signatures": [{ "keyid": "sp-2026-1", "sig": "<b64>" }] }
+  +              | null,                     // null until backfilled
+      "registryOverride": { … } } } }        // unchanged (hosted mode)
+```
+
+Schema notes: `status` and `kind` are `SEnum`s (package.ts:128-131,
+148-159), so the status enum gains `refused`, emitted under contract 2
+only. Every new field is a nullable `SStruct` member. PEP 658 metadata
+(F60: `pypiMetadata: { url, sha256 }` per wheel artifact, so hosted scan
+stops downloading whole wheels) is a later additive v2 field and is not
+in this plan.
+
+**Versioning rules:**
+- **v1 stays schema-compatible.** With `contract` absent or equal to 1,
+  the response is today's except that, after step 4, `yarn-berry-zip.url`
+  is null (the schema already allows it, depscan:…/package.ts:124-133; no
+  CLI reads it, F33), and `yarnBerry10c0` is also added to the tarball's
+  integrity (additive; old hosted CLIs pick it up through
+  `integrity.clone()`):
+  - `kind: "tarball"` stays the authored variant, so v4 and v5.0 CLIs keep
+    their `find(kind == "tarball")` (`client.rs:1279-1283`) and their
+    `auto` fallback.
+  - `refused` is reported as `build_failed`.
+  - The `yarn-berry-zip` entry `{url: null, integrity.yarnBerry10c0}` keeps
+    being emitted until v1 itself sunsets. v4/v5.0 hosted scan
+    (`scan/hosted.rs:1290-1300`), `hosted_memory/redirect.rs:110-151` and
+    depscan's GitHub-app hosted PR flow
+    (depscan:workspaces/app/src/autopatch-pr/github-patch-pr-hosted.ts:400-426)
+    read the 10c0 checksum only from that entry; without it their berry
+    rewriter fails closed ("has no yarnBerry10c0",
+    depscan:workspaces/app/src/patches/registry-rewrite/yarn-berry.ts:139-143).
+  - `r{n}` URLs are never sent to v1 callers. For a uuid with a
+    generation ≥ 2, v1 is answered with the gen-1 artifact and its hashes
+    under the legacy URL. Old Rust and TS path parsers (vex discover,
+    rollback, list; depscan:workspaces/lib/src/socket-patch/patch-url.ts)
+    do not know the segment.
+- **v2 changes:** `yarnBerry10c0` is on the tarball's integrity, and
+  `yarn-berry-zip` is not emitted. `r{n}` URLs appear only in contract-2
+  responses.
+- **Unknown fields are ignored.** The CLI response types derive
+  `Deserialize` without `deny_unknown_fields` (`api/types.rs`).
+- **Negotiation.** The CLI sends the highest contract it supports. The
+  server answers `min(requested, supported)` and echoes `contract` in the
+  response. A breaking change needs contract 3.
+- **Failure strings are static and low-cardinality**, per depscan
+  AGENTS.md; per-call detail goes to `logContext`.
+  - Deterministic statuses (`build_failed`, `refused`) never carry
+    `retryAfterSeconds`.
+  - Only `pending_build` and transient upstream failures are retryable.
+- **Generations are immutable.** `generation` bumps only on an admin
+  regenerate, and the old generation's bytes stay served. Each generation
+  is a row in a per-generation table (step 7), so older URLs, hashes and
+  statements stay resolvable.
+
+**Signed statement (in-toto v1, JCS-canonical, DSSE-wrapped).**
+
+```
+{ "_type": "https://in-toto.io/Statement/v1",
+  "subject": [{ "name": "<filename>",
+                "digest": { "sha512": "<hex>", "sha256": "<hex>" } }],
+  "predicateType": "https://socket.dev/patch-artifact/v1",
+  "predicate": {
+    "uuid": "…", "purl": "…", "ecosystem": "npm", "variant": "default",
+    "generation": 1, "recipe": "depscan-repack/npm@1",
+    "upstream": { "filename": "…", "url": "…", "sha512": "sha512-…" },
+    "patchRecordDigest": "sha256:<hex of JCS(record projection)>",
+    "pins": { "sri": "sha512-…", "sha1": "…", "sha256": "…",
+              "yarnBerry10c0": "10c0/…", "dirhashH1": "h1:…",
+              "goModH1": "h1:…", "cargoCksum": "…",
+              "gemChecksumSha256": "…" } } }
+```
+
+- **DSSE binding.** `payloadType` is `application/vnd.in-toto+json`, as the
+  in-toto Statement v1 binding requires, so standard in-toto, sigstore
+  and cosign tooling can verify it. The socket-specific version lives in
+  `predicateType` (`https://socket.dev/patch-artifact/v1`).
+- **`patchRecordDigest`.** The CLI's `.socket/manifest.json` record and
+  the server's DB row carry different field sets, so the digest is over
+  an explicit minimal projection:
+  `{uuid, purl, files: [{path, beforeHash, afterHash}] sorted by path}`.
+  The predicate schema specifies it, and a shared golden vector is used by
+  both the Rust verifier and the TS signer.
+- **`upstream.sha512`** is the registry digest where one exists. Where
+  none does (GitHub-backed composer dists, legacy npm packages), it is the
+  server's own hash of the downloaded bytes, and beforeSha is the only
+  upstream anchor.
+
+**Signing:**
+- The signer runs at build time with a GCP KMS asymmetric key (Ed25519 or
+  P-256, non-exportable). It is *detached*: it never touches archive
+  bytes.
+- The in-format seam `depscan:workspaces/patches/src/repack/sign.ts`
+  (`defaultSign` always returns null) is deleted, as F38 recommends.
+  Statements are a separate build step after the write-once store.
+- **Backfill.** Existing built rows get statements from their persisted
+  digests and columns, with no rebuild. An unsigned legacy row is never
+  made unvendorable.
+- **Revocation.** `GET https://patch.socket.dev/.well-known/socket-patch-keys.json`
+  serves the key list plus a revocation list. The list is signed by an
+  offline root key whose public half is embedded in the CLI.
+- **The CLI never trusts a key fetched at runtime.** Signing keys are
+  embedded (current plus next); the fetched document only *revokes*
+  embedded keys.
+
+### CLI flow (vendor, scan --mode vendored, get vendored, repair, WS2 eject)
+
+The flow is one shared `acquire_service_artifact` inside #283's
+`VendoredBackend`, replacing the 7 hand-rolled policies (F32). maven and
+nuget stay on `service_archive_copy`.
+
+1. **Plan.**
+   - Collect records from one of three places:
+     - `.socket/manifest.json`;
+     - hosted pins (WS2 eject);
+     - a bundle.
+   - Compute selection keys: for pypi, the lock's wheel filename, else
+     the lock's pinned sha256 hashes (Pipfile.lock, `requirements
+     --hash`), else the installed `WHEEL` tags. No other ecosystem needs a
+     key or an installed copy.
+2. **Reuse, with no network.** Use `reuse::verify_committed_artifact`
+   (`reuse.rs:212-318`) or `reusable_committed_dir` against the ledger.
+   An in-sync artifact is finished here. This is a hard contract:
+   `vendor_rerun_no_network_e2e.rs` stays.
+3. **Resolve.** Send one batch POST per 500 uuids (fewer when `variants`
+   would push the body past the proxy's 256 KiB cap) with `contract: 2`
+   plus `variants` (F28). `hosted.rs:1244` gets the same 500-chunking, because
+   it gets a 400 above 500 today.
+4. **Decide.** The action depends on the reference answer and on the
+   producer recorded in the ledger:
+
+| Reference answer | Ledger producer | Action |
+|---|---|---|
+| granted / reused | any or none | acquire → verify → wire; same sha as the ledger means no lock change |
+| granted, same uuid, new `generation` | service | `vendor_artifact_regenerated`: keep the committed bytes; `--repin` adopts the new ones |
+| pending_build | – | poll with `retryAfterSeconds` plus jitter up to `--vendor-wait` (default 120 s interactive, 0 in CI), then `vendor_artifact_pending` (retryable) |
+| refused, localBuild=allowed | – or local | local `pypi_wheel` from the installed dist; if not installed: "install, then re-run" |
+| refused, localBuild=forbidden | – | `vendor_unsupported_variant` (hard) |
+| build_failed | – | `vendor_prebuilt_unavailable` (hard, no local build) |
+| granted, but the bytes fail layout or afterHash membership (server defect, #23144) | any | `vendor_prebuilt_defective` (hard, no local build); server-side metric |
+| granted gem, stub gemspec missing or invalid (#221; pre-stub-rollout rows) | any | `vendor_prebuilt_stub_missing` / `vendor_prebuilt_stub_invalid` (hard); a server backfill (regenerate) of pre-stub rows is a prerequisite for the gem flip. Native-extension gems get no stub by design (gem.rs:922-926), so the server should answer them with a `refused` code instead |
+| granted npm, berry lock, `yarnBerry10c0` null (the error-isolated berry rebuild failed, depscan build.ts:364-382) | any | `vendor_berry_checksum_unavailable` (hard) |
+| network error, 5xx, timeout | local | local pypi rebuild (ledger stickiness: `producer = local` is kept); a result whose sha256 differs from the ledger fails closed with a `--repin` remedy |
+| network error, 5xx, timeout | service, legacy-local, or none | `vendor_service_unavailable` (retryable); the lock is untouched |
+| withdrawn / not_found | any | refuse to wire; report existing wiring for `vendor --revert` |
+| any digest or signature mismatch | any | `IntegrityMismatch`, hard; never retried from another source |
+
+5. **Acquire** from the first source that has the bytes:
+   - (a) `--bundle <dir|tar>` (repeatable) or `SOCKET_PATCH_BUNDLE`;
+   - (b) the user cache `$XDG_CACHE_HOME/socket-patch/artifacts/sha512/<h2>/<hex>`,
+     with the reference and statement indexed under
+     `index/<uuid>/<generation>/<variant>.json`;
+   - (c) the service GET through the `vendor_prefetch` download window
+     (F28), capped by `MAX_VENDOR_PACKAGE_BYTES`.
+
+   `--offline` stops after (b).
+6. **Verify**, in this order:
+   - (i) the statement signature, if present; it is required for bundle
+     sources and, after backfill, everywhere (see Rollout);
+   - (ii) size, sha512 and sha256 against the reference *and* the
+     statement subject (`fetch_verified_archive`,
+     `service_fetch.rs:89-142`);
+   - (iii) canonical decode and afterHash membership (#249):
+     `tgz_bytes_match_after_hashes` (`npm_common.rs:658`), or
+     `zip_bytes_match_after_hashes` / `copy_matches_after_hashes`
+     (`common.rs`);
+   - (iv) go h1 via `verify_go_h1` (`registry_fetch.rs:1507`);
+   - (v) `patchRecordDigest` equals the digest of the projection of the
+     record being wired;
+   - (vi) berry only: `berry_cache_checksum_10c0` recomputed over the
+     verified tgz must equal the server value. This turns the Rust/TS
+     twin (F35) into a runtime tripwire.
+7. **Gate.**
+   - By default, packages that failed are listed with their class, and
+     packages that verified are wired.
+   - `--require-all` refuses to wire anything if any required artifact is
+     missing. It is the plan-then-commit mode for CI that wants
+     all-or-nothing.
+   - Exit codes separate retryable (pending or unavailable) from hard
+     failures.
+8. **Wire.**
+   - Directory flavors are extracted through the existing validators and
+     caps (`prestage.rs` pool, `registry_fetch.rs` `extract_*`/`validate_*`).
+   - Lock writers are unchanged; WS3 owns them.
+   - Pins come from the reference or statement. Local compute is allowed
+     only for `producer = local`.
+9. **Ledger.**
+   - The `state.json` entry gains
+     `{producer, recipe, generation, statementDigest}`.
+   - Missing fields on old entries read as `legacy-local` or
+     `legacy-service`, inferred from the existing source code.
+   - The statement is written as `<artifact>.statement.json` next to the
+     vendored artifact, so `vex` can attest offline.
+
+**Dry run.** A dry run calls the reference API only, with no GET, and
+prints the real pins. It previews a local build only for
+`refused/localBuild=allowed`. This fixes `pypi.rs:1807-1809` and
+`npm_common.rs` "a dry run previews the local build".
+
+**Repair (#283).** Repair re-acquires through (a)→(b)→(c) from the ledger's
+producer:
+- A missing `legacy-local` artifact is re-pinned to service bytes. Only
+  the integrity and URL slots are spliced (the #269 vlt precedent), and
+  repair emits `vendor_repinned_to_service`. #283's fail-closed ledger
+  check (`vendored_backend/repair.rs:1-24` on origin/v5/vendor-backend)
+  gains this arm instead of refusing.
+- Nothing else re-pins silently. `vendor --repin` does it on purpose.
+
+**Flags:**
+- `--vendor-source` stays parseable in v5, because depscan
+  `99_socket-patch-cargo-modes.js:205,552` passes it.
+  - `auto` (the default) follows the table above.
+  - `service` is strict: no local bytes ever, so it also refuses
+    `localBuild=allowed` and the local-producer outage row.
+  - `build` stays valid only for maven and nuget. Anywhere else it exits 2
+    with `vendor_source_build_removed` after deletion.
+- New flags: `--bundle`, `--export-bundle`, `--prefetch` (fill the cache,
+  no wiring), `--vendor-wait`, `--require-all`, `--repin`.
+- WS8 hides the rarely used ones from `-h`.
+
+### Per-format integrity after the change
+
+| Flavor | Bytes on disk | CLI verifies before write | Lock pin | Pin source |
+|---|---|---|---|---|
+| npm, pnpm 1–10, bun.lock/bun.lockb | served tgz verbatim | sha512 + sha256 vs reference and statement; tgz afterHash | sha512 SRI | reference; `PackedTarball::from_bytes` (`npm_pack.rs:47-60`) must agree; `bun_lock.rs:403` rehash stays verify-only |
+| yarn classic | same | same | sha1 `#hash` plus integrity | reference sha1, cross-checked |
+| yarn berry | same | same plus the 10c0 tripwire | `10c0/…` plus `hash=` | reference `yarnBerry10c0`; hash6 sliced from the verified sha512 |
+| vlt (vendored) | tgz extracted to dir (`npm_dir` `try_service_dir`, 890-970) | tgz digests plus tree afterHash | none | — |
+| pypi (service) | served wheel verbatim | sha256 + sha512; zip afterHash | wheel sha256 | reference |
+| pypi (local class) | `local:pypi-wheel/1` build | afterHash of staged tree | wheel sha256 | local; ledger `producer = local` |
+| gem | `.gem` → data.tar.gz dir plus served stub gemspec | digests; gem data validators; stub validity | none | — |
+| cargo | `.crate` extracted; `.cargo-checksum.json` dropped; `cargo_tag` | digests | none | — |
+| golang | module zip extracted; dir `replace` | digests plus `verify_go_h1` against dirhashH1 | none (no go.sum) | — |
+| composer | dist zip extracted; path dist | digests (no upstream digest exists; beforeSha anchors server-side) | none | — |
+| maven, nuget | unchanged | unchanged | unchanged | unchanged |
+
+## Offline / airgap
+
+- **A committed `.socket/vendor/` is the offline store.** Installs never
+  need Socket, and re-runs and repair of in-sync artifacts make no network
+  calls. Both are unchanged.
+- **Cache.** The user cache is immutable and sha512-keyed, so CI can share
+  it across projects (actions/cache or an equivalent).
+- **First vendoring or repair on an air-gapped machine uses a bundle:**
+  - On a connected machine, `socket-patch vendor --export-bundle <dir>`
+    reads only the manifest and lockfiles and writes nothing into the
+    project. All pypi variants are included by default, so the bundle does
+    not depend on the target platform.
+  - On the air-gapped machine: `vendor --offline --bundle <dir>`.
+  - The layout doubles as a mirror an operator can host (internal HTTP,
+    Artifactory generic):
+
+    ```
+    <dir>/bundle.json                  {schema:1, createdAt, apiBase, org, cliVersion, keysetVersion}
+    <dir>/index/<uuid>.json            {record, reference (contract-2 entry), statement}
+    <dir>/cas/sha512/<h[0:2]>/<hex>    artifact bytes
+    <dir>/keys.json                    signed revocation list at export time
+    ```
+  - Records are carried too, so WS2 eject works offline.
+  - Bundles carry no maven/nuget artifacts. Those frozen ecosystems keep
+    today's `--offline --vendor-source build` path.
+  - Bundle entries **must** carry a valid statement. The statement binds
+    the record digest and the artifact digests, so the carrier is
+    untrusted.
+- **What is lost.** A new, non-pypi patch cannot be vendored with no
+  network, no cache and no bundle. Today that case builds locally
+  (`--offline --vendor-source build`). The pypi local class and
+  local-producer artifacts still work offline. This is an explicit owner
+  decision (Open questions).
+
+## Outage behavior & idempotence
+
+| Situation | Result |
+|---|---|
+| Service down; committed artifacts in sync | success, no network (reuse); unchanged |
+| Service down; artifact in cache or bundle | success, fully verified |
+| Service down; nothing local; producer service, legacy or none | per-package `vendor_service_unavailable` (retryable); lock untouched; remedy: retry, or `--export-bundle` elsewhere plus `--bundle` |
+| Service down; producer local (pypi class) | local rebuild, same recipe id. Byte identity holds only on the same machine with the same installed dist: an sdist-only C extension compiles differently per machine. A rebuild whose sha256 differs from the ledger fails closed with a `--repin` remedy |
+| `pending_build` | `--vendor-wait` polling, then retryable exit |
+| Recovery storm | `retryAfterSeconds` plus client jitter plus the per-uuid breaker kept on the download step (F28) |
+| Admin regenerate | new generation row, new object key; old generations stay resolvable through the per-generation table; CLI keeps committed bytes (`vendor_artifact_regenerated`), and repair of a missing artifact requests the ledger's generation |
+| CDN re-encodes a body | hard `IntegrityMismatch`; `no-transform` stays on every artifact byte response (depscan:…/patch-serving/archive-response-headers.ts:11) |
+
+**Relation to #250 and `reuse.rs`:**
+- #250 (e0246295) added reuse because the auto fallback flipped between two
+  producers across an outage and its recovery.
+- With R1 (the verdict decides the producer) and R3 (an outage is not a
+  refusal), no run can pick a different producer than the ledger
+  recorded. Service bytes are write-once per (uuid, generation), so a
+  re-acquire returns identical bytes.
+- `reuse.rs` stays for network-free re-runs, and its header is rewritten.
+  `select_prior_entry` loses its flip-hiding reason and can shrink after
+  deletion; that saving is unmeasured and not counted.
+- A new invariant test runs every fixture capstone twice, the second time
+  with reuse disabled, and asserts byte-identical locks and artifacts.
+
+**Server side:**
+- **Write-once stays** (`STORED_OBJECT_CONFLICT`,
+  depscan:workspaces/patches/src/services/patch-package/build.ts:425-470).
+- **Regenerate never deletes in place.** All three regenerate/reset paths
+  fold into `resetOne()` (F39) and mint generation N+1 under a new object
+  key. `deleteGcsObject` is retired for referenced keys.
+- **Hosted URLs become immutable too.** Hosted installer URLs gain an
+  optional `r{n}` segment, emitted only for generation ≥ 2 and only in
+  contract-2 responses. A URL without it means generation 1 forever, and
+  v1 callers keep getting the gen-1 artifact under that URL. The Rust path
+  parser learns it in the same step, with a shared redirect golden that
+  includes an `r{n}` case in the TS_LAGGING/RUST_IMPLEMENTED lists.
+- **Per-generation storage.** `published_patches` is one row per patch
+  with a single `package_object_key`, `package_integrity` and
+  `package_size_bytes`, and the serve route resolves URL to object key
+  through that row
+  (depscan:workspaces/patches/src/services/patch-serving/serve-route.ts:125-140).
+  A scalar generation column cannot keep old generations served. A table
+  `published_patch_generations(uuid, variant, generation, object_key,
+  digests, size, statement)` holds one row per generation; serve-decision
+  resolves (uuid, generation parsed from `r{n}`, defaulting to 1) through
+  it.
+
+## Integrity, provenance & signing
+
+Chain of trust:
+1. **Upstream digest verified server-side**
+   (depscan:workspaces/patches/src/repack/upstream/*: packument
+   integrity, PyPI sha256, crates cksum, sumdb h1, maven sha1) and
+   persisted as `upstreamIntegrity`. Coverage is not universal:
+   - composer: sha1 when Packagist supplies `dist.shasum`, else beforeSha
+     only (GitHub-backed dists; upstream/composer.ts:65-71);
+   - npm: packument integrity or shasum, else beforeSha only (legacy
+     packages; upstream/npm.ts:125-130).
+2. **Each patched file** is anchored by beforeSha in
+   `substitutePatchedFiles`.
+3. **The repack is built once**, written write-once and read back. The
+   publish-time dry run builds the same bytes only on the same host and
+   zlib build. F61: have the converter adopt that build instead of
+   rebuilding (optional).
+4. **The detached statement** binds uuid → purl → upstream digest → record
+   digest → artifact digests → pins, signed through KMS.
+5. **The CLI verifies** the signature, then the digests, then the
+   afterHash, then the berry tripwire (verify step 6). Only
+   `producer = local` pins are computed locally.
+
+Ride-along fixes:
+- **Wheel signatures.** Strip `RECORD.jws` and `RECORD.p7s` in
+  `regenerateWheelRecord`
+  (depscan:workspaces/patches-shared/src/archive/repack-utils.ts:~1330,
+  F38). With a single producer, the served wheel must match what
+  `pypi_wheel.rs:570-585` already does. This is a behavior change and
+  bumps the converter version. It applies to new builds only; existing
+  bytes are immutable.
+- **Dead signature columns.** `package_signature` and
+  `package_signature_kind` are always null and read only by the admin
+  package-job API
+  (depscan:workspaces/next-app/src/pages/api/admin/patches/package-job.ts:88-89,114).
+  They are also written by patch-sync (patch-sync/import.ts:174-175) and
+  queue.ts (:410-411, :733-734). Step 13b stops the writes and drops them
+  with a safe migration; statements live in the per-generation table.
+- **Maven.** The `META-INF/*.SF` gap is recorded only (maven is frozen).
+
+**Provenance on disk.** The ledger holds
+`producer/recipe/generation/statementDigest`, and
+`<artifact>.statement.json` sits next to each vendored artifact.
+
+**Audit.** A depscan CI golden re-runs the repackers offline over the
+shared fixture corpus, split by format. The gzip bytes are
+zlib-build-sensitive and differ between a dev machine and the CI runner
+(depscan:workspaces/patches-shared/src/archive/repack-utils.ts:632-640),
+so:
+- gzip-bearing artifacts (npm tgz, pypi sdist tar.gz, the `.gem`'s
+  data.tar.gz, cargo `.crate`): the golden pins the sha256 of the
+  decompressed tar stream plus per-member afterHashes, and treats the
+  committed bundle bytes as opaque signed inputs, not re-derived outputs;
+- STORE-zip formats (wheel, go module zip, composer zip, jar, nupkg) and
+  `yarnBerry10c0`: the golden asserts byte-exact digest reproduction.
+
+## Cache/CDN/storage cost
+
+**Build:**
+- The default artifact costs nothing new; the converter already builds
+  every published row after publish.
+- Added: pypi wheel variants, built lazily, keyed by
+  `(uuid, upstream filename)` that a client actually requested. Cost is
+  bounded by real demand, not by wheel-matrix width.
+- Added: go no-go.mod builds, which are rare.
+- Removed: the `.berry.zip` store and read-back per npm patch. The zip
+  rebuild stays, because it is the 10c0 source: the `berryChecksum10c0`
+  and `berryZip` locals (build.ts:349-350), the `rebuildBerryCacheZip`
+  call and the sha512 at :373-387 are kept.
+
+**Storage:**
+- One fewer GCS object per npm patch (F33). Berry zips use STORE, so each
+  is likely larger than its tgz (inference, unmeasured).
+- Added: the variant wheels.
+- A regenerate adds a generation instead of replacing one. Old
+  generations are kept, because committed pins may reference them and the
+  server cannot know.
+
+**Origin I/O.** Send crc32c/md5 on the PUT and read back only on a 412
+(F34; md5 is already computed at build.ts:315/532). This removes 1–4 full
+GETs per build.
+
+**Egress:**
+- Vendoring downloads once per (project, patch), then reuses git, the
+  cache or a bundle.
+- The CLI's eager pristine fetches from public registries disappear (F80).
+- The wasted sdist downloads disappear, up to the 256 MiB cap each
+  (F70, F71).
+- Quota drops from N×20 to ceil(N/500)×20 per run (F28).
+
+**CDN:**
+- Keep `public, max-age=3600, no-transform` on artifact bytes.
+- The per-org token in the path fragments edge keys, and revocation must
+  bite, so no `immutable`.
+- Revisit `immutable` for generation-keyed URLs only after infra confirms
+  patch.socket.dev's edge-cache and auth behavior. Metadata and
+  go-import responses keep their current headers (F37 verification: that is
+  intentional).
+
+**Sizing.** Before step 11 (pypi variant queue), a read-only query
+through the Grafana skill: count built pypi rows by selected artifact
+kind, plus wheels per release from the PyPI JSON. This query is an
+explicit gate on step 11.
+
+**Unmeasured:** variant-wheel storage, the berry.zip bytes removed, and
+the egress delta. The step 5 dashboards and the pre-step-11 sizing query
+produce them, and the owner reviews them before enabling
+`patchPypiVariants`.
+
+## What gets deleted
+
+Deletion happens after the gate, at Phase 4. The numbers are measured by
+line span at 8ae7dc37. Rows marked ~ are re-measured after #283 and #280
+land, because WS5 rewrites vendor.rs by ±318 lines.
+
+| Item | Files | src LOC | test LOC |
+|---|---|---:|---:|
+| npm_pack `pack_deterministic`, `pack_to_bytes`, `collect_regular_files`, `NPM_PACK_MTIME` (keep `from_bytes`) | `vendor/npm_pack.rs:73-177` | 105 | ~210 of 247 |
+| npm_common local stage-and-pack branch | `vendor/npm_common.rs:248-396` | ~149 | in-file tests edited |
+| vlt local stage branch in `stage_patch_dir` | `vendor/npm_dir.rs:~594-730` | ~137 | edited |
+| registry_fetch pristine ladder: `FetchedPackage`, `fetch_and_stage`, `fetch_{npm,npm_inner,cargo,golang,composer,gem,pypi}`, `resolve_pypi_url_by_hash`, `crates_registry_base`, `stage_local_artifact(_dir)`, `fetch_npm_unverified` (**not** the WS1 keep-list) | `vendor/registry_fetch.rs` | ~700 | ~650 |
+| `PackageSource` Pending/Deferred (keep the `path()` naming query) | `vendor/source.rs` | ~200 of 222 | 135 |
+| cargo `copy_and_patch` | `vendor/cargo.rs` | 86 | edited |
+| composer `copy_and_patch` | `vendor/composer_lock.rs` | 60 | edited |
+| gem `materialise_patched_copy` | `vendor/gem.rs:1192-1339` | 148 | edited |
+| golang vendored FallBack arm (`golang_local.rs` stays) | `vendor/golang.rs:~291-354` | ~64 | edited |
+| Auto/Service policy arms in 7 backends, collapsed into one mapping (F32; 35-45 lines each) | 7 backends | ~220 net | edited |
+| vendor.rs pristine ladder: `fetch_pristine_package`, `missing_local_rung`, `MissingRung::Fetch` | `commands/vendor.rs` | ~147 | — |
+| `VendorSource::Build` outside maven/nuget, args plumbing | `vendor/mod.rs`, `args.rs` | ~30 | — |
+| `berry_zip_url` plumbing (F33; re-measure on #280, which adds another `berry_zip_url: None` site at upstream/bun_lockb.rs:154) | redirect/hosted | ~3 | 41 |
+| Pristine fetch-order e2e | `tests/vendor_pristine_fetch_order_e2e.rs` | — | 228 |
+| **Total (CLI)** | | **~2,050** | **~1,260** |
+
+Rewritten, not deleted or counted:
+- the 12 capstones (15,853 LOC), which move onto fixture bundles;
+- the 58 `--vendor-source build` call sites (8ae7dc37), which become
+  `auto` against bundles (maven and nuget keep `build`);
+- the fallback assertions in the in-process and covgap tests;
+- `yarn_layering_tests.rs:114`;
+- the pypi `in_sync_local_rebuild` tests.
+
+CLI additions (estimated):
+- src, about 900: the acquire mapping, the cache, bundle import and
+  export, statement verification with the embedded keyset, ledger fields,
+  and the decision table.
+- tests, about 900.
+- Net src change: about −1,150.
+
+**CI.** No job is deleted, and about 0 job-minutes are saved per run.
+- These keep running because they test wiring across every PM version,
+  which the owner keeps:
+  - the 58 vendored e2e legs (about 177 job-min; the 5 maven legs stay on
+    `build`, and the other 53 switch to fixture bundles);
+  - cargo-vex-matrix (18 legs);
+  - docker vendor jobs.
+- The non-maven legs switch from local builds to fixture bundles at
+  similar cost.
+- One test binary goes (`vendor_pristine_fetch_order_e2e`).
+- depscan adds a fixture-freshness golden of about 1–2 min.
+- The CI levers are F51 (≈280 job-min), F41, F52, F53 and F55 (see
+  v5-waste-review.md Top-10); F78, which contains F63, is a transient
+  saving during the v5 draft train. None is credited here.
+
+depscan changes:
+
+| Change | LOC | Source |
+|---|---:|---|
+| Deleted: `.berry.zip` store/read-back/serve/reset branches (build.ts:351-353 object key/size/integrity locals, :473-482 `storeSidecarObject`; serve-decision.ts:45-50, :145-157; serve-route.ts:136-137). The `rebuildBerryCacheZip` call and the sha512 at build.ts:373-387 stay | ~150 | F33 |
+| Deleted: dead `sign.ts` seam plus threads (convert-patch.ts:220, run-repack-cli.ts:371) | ~60 | F38 |
+| Deleted (co-landing in step 9): serve-route stream-pump duplication; admin reset paths onto `resetOne` | ~100 + ~45 | F37, F39 |
+| Added (estimate): contract v2 ~150; verdict columns, per-generation table plus batched backfill and patch-sync ~220; generation-in-key, serve-decision through the generation table, and `r{n}` ~170; pypi variant queue ~450; go no-go.mod ~80; statements plus keys route plus backfill ~350; fixture exporter plus golden ~200; metrics ~60 | ~1,680 | — |
+
+### What must stay
+
+- **Verifiers:**
+  - `artifact_matches_integrity`, `verify_integrity` and `verify_sri`
+    (`registry_fetch.rs:1931-2058`);
+  - `go_h1_of_zip` and `verify_go_h1` (1342-1524).
+    `verify_sri` and `go_h1_of_zip` are private at 8ae7dc37; WS1 makes
+    them `pub(crate)` and calls them (origin/v5/ledger-free-hosted
+    `upstream/client.rs:257,367`);
+  - `PackedTarball::from_bytes`;
+  - `zip_bytes_match_after_hashes` and `copy_matches_after_hashes`
+    (`common.rs`);
+  - `tgz_bytes_match_after_hashes`.
+- **`berry_zip.rs` (333 / 320), permanently.** It is a verifier
+  (`registry_fetch.rs:1943`, `artifact_matches_integrity`; the :1719 call
+  sits inside the pristine npm fetch that step 27 deletes) and the runtime
+  10c0 tripwire, and WS1 calls `berry_cache_checksum_10c0`
+  (`upstream/npm.rs:432`).
+- **The WS1 keep-list in `registry_fetch.rs`:**
+  - `download`, `MAX_DOWNLOAD_BYTES`, `DEFAULT_NPM_REGISTRY` (WS1
+    `upstream/npm.rs:239`);
+  - `build_registry_client`, `RegistryClient`, `npm_registry_base`,
+    `npm_tarball_url`, `pypi_json_api_base`;
+  - `goproxy_base`, `go_match_prefix_patterns` and `go_glob_match`.
+
+  WS1 imports all of them on origin/v5/ledger-free-hosted. Ownership
+  moves with F16's shared registry module if that lands.
+- **Acquisition and verification plumbing:** all `extract_*`/`validate_*`
+  functions and the caps; `service_fetch.rs`; `prestage.rs`;
+  `reuse.rs` (`verify_committed_artifact`); `vendor_prefetch.rs` as a
+  download-only window.
+- **`pypi_wheel.rs` (696 / 1,288).** It is the one local class.
+- **`golang_local.rs`.** It is agent-mode redirect (`apply.rs:14`), not
+  vendoring.
+- **Everything maven/nuget:** `local_rebuild_jar`, the nuget
+  `local_rebuild`, `common.rs` `rebuild_zip` and the memory repack (about
+  150 src), `service_archive_copy`, and their legs.
+- **depscan:** `berry-cache-zip.ts` and its test (the 10c0 source), and
+  the zip rebuild in build.ts.
+
+## Migration plan
+
+Prerequisites:
+- **Phase 3 step 24 and Phase 4 need the owner's reversal.** After #283
+  (WS5) merges, the owner reverses the WS5 caveat for non-maven/nuget
+  ecosystems, with the Phase 0 data in hand. Step 24 removes the local
+  rebuild from the default path, so it cannot land while WS5 keeps it.
+- **depscan gitlink bumps** follow F79's three steps:
+  1. release tip;
+  2. v5/integration (#279+#281+#283), with 89-94 required not to skip;
+  3. past #280, together with the GitHub-app ledger change.
+
+  This plan's bumps come after step 3, and each one is pre-flighted with
+  the `socket_patch_ref` workflow input.
+
+Flags:
+- depscan (feature_flags table): `patchPackageContractV2`,
+  `patchPypiVariants`, `patchArtifactStatements`,
+  `patchGenerationKeys`.
+- CLI: `SOCKET_VENDOR_POLICY=legacy|server-primary` and
+  `SOCKET_PATCH_REQUIRE_STATEMENT`.
+
+Server steps always deploy before the CLI step that needs them.
+
+| # | Repo | Scope (one PR) | Gate | Rollback | Coordinates with |
+|---|---|---|---|---|---|
+| **Phase 0: independent wins and measurement (no policy change)** | | | | | |
+| 1 | CLI | Batch reference resolution, chunked at 500 (F28); chunk `hosted.rs:1244`. maven/nuget uuids take part in the batch POST (behavior-neutral; their acquisition and wiring are unchanged) | in_process_vendor, vendor_prefetch, hosted e2e green | revert | WS4 #282 (hosted engine moves; land on whichever is first, port the other) |
+| 2 | CLI | Single `acquire_service_artifact` in `VendoredBackend` (F32); warning codes kept as parameters | all vendored e2e legs byte-identical output | revert | after #283 merges |
+| 3 | CLI | Drop `berry_zip_url` (F33); decide `.whl` before download (F70/F71) | unit plus pypi e2e | revert | WS3 #281 touches the same files |
+| 4 | depscan | Stop storing/serving `.berry.zip` after a log check for GETs (F33), keeping the v1 `yarn-berry-zip` entry with `url: null` and adding `yarnBerry10c0` to the tarball integrity; update the v1 response snapshot; RECORD.jws/.p7s strip (F38); upload checksums (F34) | patch-package tests, installer e2e; Grafana check of `.berry.zip` requests | revert; zip columns kept until a later drop | — |
+| 5 | depscan | `patch_package_reference_status_total{ecosystem,status}`, `package_status` gauges, gate counters for the future hard codes (defective afterHash/layout, missing or invalid gem stub, null berry 10c0, over-cap outputs), `/patches/package` SLO alert in workspaces/grafana-dashboards; classify `patch_vendored` (F22) | dashboards render | revert | F22 sunset 2026-12-31 |
+| 6 | CLI | `patch_vendored` carries `source=reuse|cache|bundle|service|local` plus a static reason | telemetry e2e | revert | WS8 (no user-visible change) |
+| **Phase 1: server contract v2 (additive)** | | | | | |
+| 7 | depscan | Nullable column `package_refusal_code` (plain ADD COLUMN); table `published_patch_generations(uuid, variant, generation, object_key, digests, size, statement)` with CONCURRENTLY indexes; batched background backfill (one generation-1 row per built patch, refusal codes from build state); patch-sync import/export of the new column and table; regenerate DB types | migration on a staging copy; no long locks | columns unused, harmless | — |
+| 8 | depscan | Contract v2 in patch-package-references.ts and package.ts; `refused` (SEnum, v2 only), `format`, `variant`, `generation`, `recipe`, `retryAfterSeconds`; `variants.pypiUpstreamSha256` and per-uuid `generation`; static refusals `artifact_too_large` (before download, from the upstream size) and `artifact_exceeds_client_caps` against a caps fixture shared with the CLI; github-patch-pr-hosted.ts reads 10c0 from the tarball integrity | v1 response snapshot unchanged relative to post-step-4 master; flag `patchPackageContractV2` | flag off | — |
+| 9 | depscan | Generation-in-key; serve-decision resolves (uuid, generation from `r{n}`, default 1) through `published_patch_generations`; admin routes onto `resetOne` (F39); serve-route onto `serveStoredArtifact` (F37); `r{n}` URL segment, emitted in contract-2 responses only (v1 keeps gen 1 under the legacy URL), plus the lib patch-url.ts grammar | serve integration tests; regenerate-immutability test (gen-1 URL and hashes still served after gen 2); flag `patchGenerationKeys` | flag off (gen 1 only) | CLI step 10 must parse `r{n}` before any gen ≥ 2 is minted |
+| 10 | CLI | Path parser accepts `r{n}`; shared redirect golden with an `r{n}` case in TS_LAGGING/RUST_IMPLEMENTED | redirect goldens (shared with depscan golden.test.ts) | revert | WS3 #281 goldens |
+| 11 | depscan | pypi variant queue `published_patch_variants` (index CONCURRENTLY; claim with `UPDATE … RETURNING` plus `FOR UPDATE SKIP LOCKED`); per-variant static failure codes; `refused pypi_no_servable_wheel` keyed on (uuid, requested filename/tags) with a TTL; `refused artifact_too_large` (localBuild allowed) | pre-step-11 sizing query reviewed; real-Postgres integration harness; installer e2e for uv/pip/poetry | flag `patchPypiVariants` off | — |
+| 12 | depscan | go no-go.mod synthesis matching proxy.golang.org bytes; bz2/xz sdists rejected before download (F69) | golang repack tests; hosted go e2e | revert | — |
+| 13 | depscan | Statement signer (KMS) post-store, `payloadType` `application/vnd.in-toto+json`, `patchRecordDigest` over the minimal record projection with a golden vector shared with the Rust verifier; backfill statements for built rows from persisted digests; `.well-known/socket-patch-keys.json`; delete the `sign.ts` seam | real file-backed test key (a KMS double needs explicit approval); flag `patchArtifactStatements` | flag off (`statement: null`) | — |
+| 13b | depscan | Stop writing `package_signature*` (queue.ts:410-411, :733-734; patch-sync/import.ts:174-175) and drop them from the admin package-job API (next-app package-job.ts:88-89,114); after one deploy, drop both columns (the drop needs no long lock); regenerate DB types | migration on a staging copy | revert before the drop | — |
+| 14 | depscan | Fixture exporter: `run-repack-cli --patched-dir` over one patch per flavor → bundle layout signed with a test key, committed to socket-patch `crates/socket-patch-core/tests/fixtures/served/`; depscan golden split by format (gzip-bearing: gunzipped-tar sha256 plus per-member afterHashes, committed bytes opaque; STORE zips and 10c0: byte-exact digests); berry 10c0 vectors including sorted-vs-upstream order, CRLF, exec bits, tombstones and the Rust fail-closed cases (F35) | golden green in both repos | revert | submodule bump |
+| **Phase 2: CLI consumes v2 (additive, v5.x minor)** | | | | | |
+| 15 | CLI | Contract v2 client; format-before-download; `variants.pypiWheelFilename`/`pypiUpstreamSha256`/tags, chunked under the 256 KiB proxy cap; for maven/nuget uuids, v2 `refused` maps onto the existing v1 `build_failed`/fallback arm (or those uuids are requested under contract 1), so `service_archive_copy` behavior is unchanged | fixture-bundle tests; api-v0 e2e | revert | WS3 python family |
+| 16 | CLI | Ledger fields `producer/recipe/generation/statementDigest`; legacy inference | ledger round-trip tests; old state.json reads | fields ignored by old code | WS6 `Ledgers` view |
+| 17 | CLI | User CAS cache, `--prefetch`, `--offline` source order | offline e2e | revert | — |
+| 18 | CLI | Statement verification, embedded keyset plus signed revocation list; `<artifact>.statement.json`; vex reads it | tamper tests (bad sig, revoked key, digest swap) | revert | vex (WS1 discover) |
+| 19 | CLI | `--export-bundle` / `--bundle` (records included; WS2 eject offline) | export → import round trip, air-gap e2e | revert | WS2 |
+| 20a/b/c | CLI | Re-point capstones to fixture bundles: npm family (npm, pnpm, yarn classic/berry, bun, vlt); pypi; gem/cargo/composer/golang | every PM-version leg green; no change to maven/nuget legs | revert per family | compatibility workflows unchanged |
+| 21 | CLI | Berry tripwire; pin `local:pypi-wheel/1` deflate backend plus a golden byte vector | berry e2e matrix (7 legs); pypi goldens | revert | — |
+| **Phase 3: policy flip** | | | | | |
+| 22 | CLI | §Decide table behind `SOCKET_VENDOR_POLICY=server-primary`; repin arms (`--repin`, repair `vendor_repinned_to_service`); dry-run parity; `--vendor-wait`; `--require-all` | reuse-disabled idempotence invariant; decision-table unit tests; regenerate test | env back to `legacy` | #283 repair.rs |
+| 23 | depscan | Submodule bump with 89-94 pinned to require no skip, a strict `service` leg added, and 99 cargo-modes dropping `build` | depscan pre-flight green | revert gitlink | F79 step order |
+| 24 | CLI | Flip the default to `server-primary` once the Phase 0 gate holds (30 days, per-ecosystem `pending + build_failed + fallback` < owner threshold); CLI_CONTRACT, CHANGELOG, README "Work offline" | gate data reviewed by owner; WS5 caveat reversed by owner (Open question 1) | set default back | release notes |
+| 25 | CLI | `SOCKET_PATCH_REQUIRE_STATEMENT` default on, after the step 13 backfill is complete and one release has passed | zero `statement: null` in reference metrics | default off | — |
+| **Phase 4: delete (one release after 24, zero `legacy` policy use in telemetry, WS5 caveat reversed)** | | | | | |
+| 26 | CLI | npm-family local packers (npm_pack pack fns, npm_common/npm_dir local branches) | all npm-family legs | git revert (irreversible for users only after release) | — |
+| 27 | CLI | registry_fetch ladder minus the WS1 keep-list; `source.rs`; vendor.rs ladder; `vendor_pristine_fetch_order_e2e.rs` | WS1 hosted restore tests green | git revert | #280 merged first |
+| 28 | CLI | Directory-backend local arms (cargo, composer, gem, golang FallBack); collapse FallBack variants; `--vendor-source build` exits 2 outside maven/nuget | all vendored legs; cargo-vex-matrix | git revert | WS8 exit-2 convention |
+| 29 | depscan | Submodule bump; api-v0 vendor suites updated | pre-flight | revert gitlink | — |
+| **Phase 5 (optional)** | | | | | |
+| 30 | depscan | Sandboxed sdist→wheel for pure `py3-none-any` results (autotester container infra), shrinking the pypi local class to C-extension sdist-only releases | installer e2e | flag | owner decision |
+
+Release boundary:
+- Phases 0–3 ship in v5.x minors, except that step 24 is itself a
+  behavior change (the default stops building locally on outages,
+  `pending_build` and `build_failed`) and needs the same v5.x-vs-v6 owner
+  call as Phase 4.
+- Phase 4 changes CLI behavior (`build` refused, `--offline` narrower).
+  Ship it in v5.x with one release of deprecation warnings, or in v6
+  (owner call).
+- Removing the `--vendor-source` flag itself is v6.
+
+## Risks & mitigations
+
+| Risk | Mitigation |
+|---|---|
+| First vendoring of a new patch depends on the server | committed artifacts, cache, bundles; retryable exits; SLO alert; `--vendor-wait` |
+| Server defects ship to every vendored user (#23144 defective rebuilds; #24466 invalid gem stub, which #221 papered over with a local fallback) | CLI keeps afterHash and stub-validity checks, which fail closed with specific codes; depscan installer e2e plus the fixture golden; generation-in-key rolls fixes out without breaking pins |
+| Hit rate is unknown | Phase 0 metrics; flip gated on 30 days per ecosystem |
+| Locks that pin locally built bytes (F72 blocker 3) | reuse keeps them; re-pin only on `--repin` or when repair finds the artifact missing; one notice code |
+| Air-gapped users lose ad-hoc local builds | bundles and mirror layout; pypi local class stays; owner decision |
+| pypi variant fan-out | lazy, keyed by requested filename; sizing SQL first; berry.zip removal offsets storage |
+| `r{n}` grammar change touches hosted URLs | only minted for gen ≥ 2 after the CLI parser ships (step 10 before step 9's flag), and only in contract-2 responses: v4/v5.0 CLIs on v1 keep getting gen 1 under the legacy URL; shared golden with an `r{n}` case |
+| Server and CLI extraction caps differ: the server allows 200,000 entries and 256 MiB (depscan:…/repack-utils.ts:23,30); the CLI extractors allow 60,000 entries and 128 MiB per entry (`registry_fetch.rs:41-47`, used by `cargo.rs` extract_tgz, `golang.rs`, `common.rs`), and `patch/package.rs` is stricter still. With no local path, the server can serve an artifact the CLI must refuse | Phase 1 (step 8): the server emits static `artifact_exceeds_client_caps` when the output exceeds the CLI's published caps, checked against one caps fixture shared by both repos (or the CLI caps are raised to match) |
+| Large upstream artifacts exceed the 100 MiB serve cap | `artifact_too_large` refusal before download; pypi falls back to the local class; npm family is an accepted regression (Open questions) |
+| KMS or key custody | non-exportable KMS key; embedded current plus next key; signed revocation from an offline root; statements optional online until step 25 |
+| Retained pypi recipe drifts on a dependency bump | golden byte vector, pinned backend, versioned recipe id |
+| Old CLIs | v1 contract schema-compatible (only `yarn-berry-zip.url` becomes null; the entry and its 10c0 stay until v1 sunsets); `tarball` stays the authored variant; no `r{n}` URLs on v1 |
+| depscan 89-94 masked a divergence via silent fallback | step 23 pins service mode and fails on skips |
+| WS1 breakage from deletions | the WS1 keep-list is carved out; step 27 runs after #280 with its tests as the gate |
+| Test doubles | capstones use committed bundles on the real import path, not a loopback service; depscan uses real Postgres, the file store and a file-backed key; any KMS or registry double needs explicit approval |
+
+## Design panel (record)
+
+Four variants were scored by three judges (integrity, ops, delivery), on a
+0–10 scale:
+
+| Variant | Integrity | Ops | Delivery | Total | Claimed CLI src/test deleted |
+|---|---:|---:|---:|---:|---|
+| A: server-only plus signed bundle | **8** | 6 | 6.5 | 20.5 | 3,400 / 2,580 |
+| **B: server-primary, minimal fallback (winner)** | 7 | **8** | **7.5** | **22.5** | 2,200 / 1,200 |
+| C: content-addressed store plus signed manifests | 7 | 6.5 | 5.5 | 19.0 | 3,090 / 2,820 |
+| D: spec-first shared builder (crate plus wasm) | 6 | 6 | 5 | 17.0 | 950 / 1,200 |
+
+**Why B won** (two of three lenses, highest total):
+- It prevents flip-flop structurally, with sticky producers and "an outage
+  is not a refusal", instead of hiding it.
+- It keeps the one local build that has no server substitute, so there is
+  no pypi airgap regression and no new sdist lock-writer arm.
+- It is the smallest correct server change.
+- It has an honest rollback at every phase, and it keeps `berry_zip` for
+  WS1.
+
+**Corrections applied to B:**
+- The registry_fetch row now carves out the WS1 keep-list (`download`,
+  `goproxy_base`, `go_match_prefix_patterns`, `MAX_DOWNLOAD_BYTES`,
+  `npm_tarball_url`, …) and is re-measured down to about 700.
+- The policy-duplication citation is F32 (220), not F31.
+- `no-transform` applies to artifact bytes only (F37 verification).
+
+**Grafted:**
+- from A: the user CAS cache; bundle export and import carrying records;
+  the SLO and gauges; acquire-before-wire with opt-in `--require-all`;
+  `<artifact>.statement.json`; the fixture-bundle capstones instead of a
+  loopback service double; the v1 compatibility rule; the note to
+  re-measure after #283;
+- from C: JCS canonicalization; the backfill of verdicts, generations and
+  statements for existing rows; the mirror layout; `r{n}` immutable
+  hosted URLs; upload checksums; F37 and F39 co-landing;
+- from A and the integrity judge: signing promoted from optional to
+  planned (step 13), with a signed revocation list;
+- from D: the flate2 backend caveat applied to the retained pypi recipe,
+  and a fixture golden as a reproducibility audit.
+
+**Rejected alternatives:**
+- **A as a whole.** It deletes `berry_zip` and the WS1 helpers. Old rows
+  fail closed without statements, and there is no backfill. Its
+  all-or-nothing default is harsh. Eager variant fan-out is costly. It
+  needs a new sdist lock arm.
+- **C as a whole.** It has the largest blast radius: hosted serving is
+  re-routed through a new CAS. It deletes `berry_zip`, which breaks WS1.
+  It accepts JWKS keys over TLS, which collapses trust back to TLS. A
+  1-year digest-keyed shared cache plus `stale-if-error` weakens
+  revocation. Its automatic one-time re-pin in `vendor` is a silent
+  substitution path.
+- **D.** Byte identity across 5 targets plus wasm is unproven, and the
+  fallback profile is 3–5× larger. It adds a permanent cross-repo crate
+  and wasm release chain. It has no signing, deletes the least code (about
+  300 net src), and covers only npm and pypi.
+
+## Open questions for the owner
+
+1. Reverse the WS5 caveat (drop the local rebuild everywhere except the
+   pypi class, and except maven/nuget) once the Phase 0 gate passes? What
+   per-ecosystem thresholds?
+2. Ship Phase 4 in v5.x after one deprecation release, or in v6?
+3. Accept the narrower `--offline`: reuse, cache, bundle, and the pypi
+   local class only. Today `--offline` builds locally for every ecosystem.
+   Also accept that npm-family packages whose upstream tarball exceeds the
+   100 MiB serve cap become unvendorable (`artifact_too_large`, no local
+   build)?
+4. Signing: approve KMS key custody, the offline root key for revocation,
+   and making statements mandatory online (step 25).
+5. Accept the optional `r{n}` hosted URL segment, which is a URL grammar
+   change shared with the depscan TS parser and the goldens.
+6. pypi variant caps: is lazy on-request enough, or should pure wheels
+   also be built eagerly for faster first vendoring?
+7. Phase 5 sandboxed sdist→wheel builds: worth the autotester-infra
+   dependency?
+8. Telemetry: move `patch_vendored` to `/v1/orgs/{slug}/events` or extend
+   the 2026-12-31 sunset (F22)? The Phase 0 gate depends on it.
diff --git a/docs/design/v5-waste-review.md b/docs/design/v5-waste-review.md
new file mode 100644
index 00000000..1d1f89c4
--- /dev/null
+++ b/docs/design/v5-waste-review.md
@@ -0,0 +1,360 @@
+# v5 waste review: socket-patch + depscan patch system
+
+> Reference copy of PR #286, which was closed without merging. Each
+> finding's owner (workstream, in-flight PR or owner decision) is in
+> the [triage map](https://github.com/SocketDev/socket-patch/pull/286#issuecomment-5869109317).
+
+Scope: socket-patch at `release/v5-prerelease` (8ae7dc37; in-flight branches
+#279–#283 and `v5/integration` f8b8d80a where noted) and depscan `master`
+(repack in `workspaces/patches/src/repack`, serving in
+`workspaces/patches/src/services/patch-serving` and
+`workspaces/patches-api-proxy/src/server.ts`, api-v0 endpoints). Respects the
+owner decisions in [v5-plan.md](v5-plan.md): vlt stays, every PM version
+stays, `setup` goes, hosted ledger goes, maven/nuget vendoring is frozen, and
+WS5 (#283) keeps the local rebuild. Nothing here proposes dropping vlt or any
+PM version; CI tiering only moves legs between PR, main push and nightly.
+
+Companion: [repacking-to-depscan.md](repacking-to-depscan.md) (what each repo
+builds and what moving the rest of repacking to depscan would take).
+
+## Summary
+
+**Method.** Both repos were inventoried: the CLI's local rebuild, the
+per-ecosystem builders, hosted/napi, depscan repack, depscan's use of the
+CLI, CI and test cost, and churn and bug history. Findings were swept over 9
+dimensions: cross-repo duplication, intra-repo duplication, dead code, test
+overlap, CI matrix, redundant network, repacking, expensive abstractions, and
+high-cost/low-value features. A gap review then covered the diff channel,
+the upstream fetchers vs the CLI pristine ladder, signing, fallback-rate
+observability, patches-harness-contract, patch-publication, the cost of the
+in-flight PRs, and the depscan bump break list. Each finding was
+independently re-verified on three criteria: facts (re-measure every
+claim), value (is it really waste, and does it conflict with owner
+decisions?) and savings (≥150 LOC or ≥2 CI job-min/run). A finding was kept
+when at least two held. Verified numbers replace the initial estimates.
+
+**Counts.** 85 raw findings were de-duplicated to 75, and the gap round
+added 31 (106 reviewed). 80 were kept and 26 dropped. Of the 80 kept, 69 are
+waste (ranked below) and 11 are measurements or checks that found no waste.
+
+**Top line (net new, after de-duplicating against v5-plan WS1–WS8 and PRs
+#279–#283):**
+- Actionable now: about **32.8k lines**: 9.1k code, 14.9k test, and 8.8k of
+  docs and workflow YAML.
+- Gated on a precondition or owner decision: a further **15.7k lines** (6.3k
+  code, 9.4k test). 10.5k of that is the depscan TS rewriter twin (F01).
+- CI: about **478 job-min per socket-patch `ci.yml` PR run**, or 438 on a
+  main push, against a 945 job-min main-push run. Add about 95 job-min
+  across the compatibility workflows per PR push that triggers them (F55 65
+  pdm, F57 12 npm/pnpm, F56 ≈10 vlt, F54 8 pdm Windows; pdm-compat alone
+  ≈73), and about 9.5 per depscan api-v0 CI run (roughly 130 runs a day).
+- The biggest single lever is build-once fan-out for the e2e matrix (F51,
+  280 job-min per run). The biggest code/test levers are the #257
+  equivalence oracles (F03, 6.5k), the depscan TS rewriter twin (F01, 10.5k,
+  gated) and depscan's stale refactor docs (F02, 8.2k lines).
+- Precondition for reading any v5 CI: the base branch is red on one
+  assertion (F77), so the e2e tier has not run on any v5 PR.
+
+## Ranked findings
+
+Rank is verified savings × confidence (3/3 upheld over 2/3) × low risk.
+Runtime-only findings (0 LOC, 0 CI) rank by avoided work per run. `sp` means
+socket-patch, `ds` means depscan. LOC is verified lines removed (src + test,
+or YAML/docs where noted). CI is job-min per run of the named workflow. "⊂
+Fnn" means the figure is contained in another finding and is not counted
+again.
+
+| # | id | finding | repo | category | evidence | verified LOC | CI min/run | risk | already planned? | recommendation |
+|---|----|---------|------|----------|----------|-------------:|-----------:|------|------------------|----------------|
+| 1 | F51 | e2e matrix recompiles the CLI and its test binary in each of 176 legs | sp | ci-matrix | .github/workflows/ci.yml:1098,1355; run 36359489402: 176 legs = 530 job-min, 2m06s compile vs 0.03s test | 0 | 280 | L | no | Per-OS `e2e-build` job (`cargo test --no-run --message-format=json`), upload the binaries, legs run the downloaded suite; pattern at vlt-compatibility.yml:143-187. Restore the CARGO_BIN_EXE path or add an override. Every leg and PM version stays. |
+| 2 | F03 | ~7.5k LOC of test-only "verbatim previous implementation" oracles from #257 | sp | test-overlap | crates/socket-patch-core/src/crawlers/*/oracle.rs (2,680); crates/socket-patch-core/src/patch/redirect/pnpm_equivalence_tests.rs:1-7; xorshift constant in 23 files | 6,500 | 0.5 | L-M | no (WS3 names them as a gate) | Snapshot the generated inputs into the redirect goldens first, keep one shared test RNG, delete the crawler oracles plus their inline `mod equivalence` blocks now, and delete each rewriter oracle in its WS3 family PR. |
+| 3 | F02 | depscan patches/docs/refactor: 9.4k lines; 61% of cited paths no longer exist | ds | dead-code (docs) | depscan:workspaces/patches/docs/refactor (37 files, 9,398 lines; 181/297 paths missing; README.md:3 "temporary") | 8,222 docs | 0 | none | no | Delete everything except DAG/ (1,176 lines, backfill still active); reword the dag-lift comments that cite missing files. |
+| 4 | F41 | e2e-docker is a strict subset of coverage-docker | sp | test-overlap | ci.yml:1390 vs :455; 9 legs 65.1 vs 89.2 job-min; bind-mount at crates/socket-patch-cli/tests/docker_e2e_cargo.rs:34-49 | 65 YAML | 65 | L | no | Drop per-push e2e-docker, or run it nightly as the check of the full-LTO release binary (it is the only per-push run of that binary). |
+| 5 | F04 | covgap_/coverage_fix_/in_process_ categories no longer mean anything; one command's tests span up to 16 binaries | sp | test-overlap | crates/socket-patch-cli/tests: covgap_* 25 files/27.6k LOC, in_process_* 38/34.3k; get_modes_e2e.rs:465 covers in_process_get_modes.rs:649 | 4,000 | ⊂ F58 | L-M | partial (WS7 deletes covgap_setup*, excluded) | When WS5/WS8 touch a command, merge its files into one suite (in-process + subprocess modules) and delete sampled duplicates. Stop adding covgap_* files. |
+| 6 | F53 | Dockerfile.base release build rebuilt with no cache 27× per run; binary unused in coverage-docker | sp | ci-matrix | ci.yml:518,1421,1662; 121.5 job-min of base builds (12.9% of run) | 0 | 68 (≈35 after F41) | L | partial (setup-matrix share = WS7, excluded) | Build once, then `docker save`/load or ghcr (gha cache is unusable with `driver: docker`, ci.yml:486-494). Keep a binary for the Dockerfile.gem/deno build-time `--version` checks. |
+| 7 | F55 | pdm capstone recompiles e2e_vex_build in 30 legs and repeats 7 ci.yml rows | sp | ci-matrix | pdm-compatibility.yml:151-182; run 36363939533 capstone 30 legs/91 job-min, 2m03s compile vs 9.5s tests | 0 | 65 (per pdm-compat run) | L | no | `needs: build` plus a `--no-run` test-binary artifact. Exclude the 7 cells ci.yml gates, guarded by a leg-checker like scripts/tests/test_ci_vlt_rows.py. Every PDM version stays. |
+| 8 | F52 | Tier PM-version legs: boundaries on PRs, every version on main push/nightly | sp | ci-matrix | ci.yml e2e include: 176 rows, 155 version-keyed, 78 ubuntu middle rows; no `schedule` trigger (ci.yml:3-16) | 0 | ≈90 PR (≈40 after F51) | M | no | Mark middle rows `tier: full` and skip them on `pull_request`; keep them on main push, nightly and dispatch. Keep the boundary versions named in ci.yml comments on PRs. Most of the 78 middle rows are such named boundaries (bundler, pdm, hatch, vlt eras, uv 0.5.4/0.5.5, poetry lock formats, maven); about 33 carry none, so ≈90 standalone (33 × 2.75). The recorded 140 holds only if all 78 move. |
+| 9 | F06 | depscan legacy/ hosts the live admin package-detail engine; it blocks the 2026-11-04 table drop | ds | dead-code | depscan:workspaces/patches/src/legacy/fetch-autopatch-package-status.ts (3,093; 68 commits); depscan:workspaces/patches/src/api/commands/review/upgrade-risk.ts:14,181-207 | 3,000 (incl. F19) | 0 | M | partial (depscan legacy/README.md:30-31) | Before 2026-11-04: make the upgrade-risk lookup one query, give detail a version-scoped path, port the admin page to the read-models, then delete the engine, poc-result.ts, queue-driven-suites.ts and their tests. |
+| 10 | F01 | GitHub-app hosted PR flow keeps a ~6k-LOC TS port of the Rust rewriter; the napi engine has 0 consumers | both | cross-repo-dup | depscan:workspaces/app/src/patches/registry-rewrite (5,978 src + 5,582 test); depscan:workspaces/app/src/autopatch-pr/github-patch-pr-hosted.ts:63,308,494; depscan 9752b91237 (cargo drift) | 10,500 (gated) | 1 | M-H | partial (WS4 keeps napi; no depscan adoption plan) | After bumps past WS1 and WS4, call the Rust engine (socket-patch-node or `hosted-bundle` subprocess) and delete the TS rewriters. Freeze the TS port until then. The 141 goldens gate byte-identity. |
+| 11 | F47 | cargo-vex 17-leg cross recompiles every leg; repeats e2e_safety_cargo_build | sp | ci-matrix | ci.yml:1531-1577 (18 legs/48.2 job-min); e2e safety rows 11.1 job-min; lock knob headline-only at crates/socket-patch-cli/tests/e2e_safety_cargo_build.rs:326 | 10 YAML | 30 (≈23 after F51) | L-M | no | Drop the 3 e2e_safety rows from the e2e matrix. Run a pairwise toolchain×lock subset on PRs and the full cross on main/nightly. Build once per OS. |
+| 12 | F11 | depscan break list for the #279 bump: 30 loud setup e2e failures | both | cross-repo-dup | depscan:workspaces/api-v0/e2e-tests/tests/59_socket-patch-setup.js (1,344; 27 setup calls), 82_socket-patch-telemetry-coverage.js:229-262, 65_patch-telemetry.js:478-502 | 1,380 | 2 | L | partial (WS7 covers only the CLI side) | In the depscan bump past #279, delete 59_socket-patch-setup.js (the apply edge cases at :812-1114 also run `setup --yes`; move only the bun `--help` subtest at :1170 elsewhere if it is wanted) and the 82 setup case at :229-262. Retire 65's patch_setup case after an owner check. |
+| 13 | F09 | Python lock family missing from WS3's PR order; 4–5 readers per format | sp | intra-dup | v5-plan.md:75-76; check_target_guards ×4 at crates/socket-patch-core/src/vendor/pypi_poetry.rs:207, pypi_uv.rs:312, pypi_pdm.rs:184, pypi_pipenv.rs:162; utils/pdm_lock.rs:129 = utils/poetry_lock.rs:105 | 1,600 | 0 | M | extends WS3 | Add a Python PR to WS3 (formats/{poetry,pdm,pipfile,pylock_uv,requirements} on utils/python_lock). One generic guard with one documented fork rule. |
+| 14 | F12 | 8 npm-family vendored backends repeat one vendor/revert skeleton; pnpm vs pnpm-legacy clone survives #281 | sp | intra-dup | crates/socket-patch-core/src/vendor/{npm_lock.rs:90, pnpm_lock.rs:110, pnpm_lock_legacy.rs:287, bun_lock.rs:327} (2,076 + 1,428 LOC); 256–367 cloned lines | 1,200 | 0 | M | extends WS3/WS5 | One `NpmFlavorBackend` trait and one driver in npm_common over utils/group_commit.rs; derive Default on VendorEntry (57 literals). |
+| 15 | F49 | default suite compiled twice per `test` leg (feature-set mismatch) | sp | ci-matrix | ci.yml:331-332 (`--all-features --no-run`, then default), :372-373; documented as intentional at :336-338 | 2 YAML | 18 | L | no | Use one feature set for `--no-run` and the run in test and test-release. Owner to confirm the #150 rationale. |
+| 16 | F58 | 238 CLI integration-test binaries, 78 with ≤3 tests; linking dominates test/test-release | sp | test-overlap | crates/socket-patch-cli/tests (238 files; 23 with 0–1 tests); ci.yml:335-341 "~240 test binaries" | 0 | 20 (≈30 combined with F49, F04) | M | no | Consolidate into multi-module crates per command family (as tests/e2e_vex_build/), keeping `#[serial]` (565 uses in 58 files). About 21 setup binaries go with WS7 anyway. |
+| 17 | F10 | CRLF/corrupt/dry-run/round-trip invariants re-tested per writer | sp | test-overlap | 79 CRLF fns in 44 files (crates/socket-patch-core/src/patch/redirect/mod.rs 11); 232 dry_run fns | 1,400 | 0.3 | M | extends WS3 | One property harness over every LockModel impl (CRLF in = out, plan+restore identity, dry run writes nothing, rerun is a no-op). Move edge cases into its fixtures. |
+| 18 | F39 | 3 regenerate/reset paths; the admin routes delete Go zips before requeue and skip the gopatch refusal | ds | intra-dup | depscan:workspaces/patches/src/services/patch-package/reset-decision.ts:32-39 vs depscan:workspaces/next-app/src/pages/api/admin/patches/regenerate-range.ts:242-264 (no force guard) | 100 | 0 | L | no | Both admin routes call resetOne() in reset-ops.ts. This removes a live hazard: a range regenerate over a Go patch breaks committed go.sum pins. |
+| 19 | F19 | admin package-detail "lite" engine dead since #18370 | ds | dead-code | fetch-autopatch-package-status.ts:2211-2709 and :305-352; depscan:workspaces/next-app/src/pages/api/admin/autopatch/package-detail.ts:3,27,42,47-62 | 560 (⊂ F06) | 0 | L | no | Delete now, independent of F06. |
+| 20 | F24 | patches-harness-contract carries a dead autopatch-backport config module | ds | dead-code | depscan:workspaces/patches-harness-contract/src/autopatch-backport-config.ts (273) + test (143) | 425 | 0 | L | no | Delete; fix doc paths; inline the depscan:workspaces/patches/src/services/patch-publication/dependent-merges.ts:21-26 pass-through (`trx: any`). |
+| 21 | F20 | purl-api-proxy keeps a full /patch/* forward that no client calls | ds | dead-code | depscan:workspaces/purl-api-proxy/routes/patch.ts (181), lib/patch-target.ts (121), lib/forward-headers.ts (57); CLI default is patches-api (crates/socket-patch-core/src/api/client.rs:1922) | 560 | 0 | L-M | no | Confirm zero traffic in gateway logs, then delete the route, guard, forward-headers, their tests and PATCHES_ORIGIN. abort-client-response and upstream-origin are shared and stay. |
+| 22 | F16 | WS1 upstream/* builds a second per-format grammar outside WS3 formats/ and imports a module #281 deletes | sp | intra-dup | origin/v5/ledger-free-hosted crates/socket-patch-core/src/patch/redirect/upstream/* (8,359 @08c30b7e; 8,752 @65aa0744); formats/mod.rs:71 stub; upstream/gem.rs:61 uses removed `vendor::gemfile_lock` | 900 | 0 | M | partial (WS3 restore_upstream stub) | Rebase #280 onto integration. Split each upstream/<fmt>.rs into a pure `formats::<fmt>::restore_upstream(pins)` and one async resolver. This also fixes the compile break. |
+| 23 | F07 | real-installer pdm/pipenv/poetry backtests duplicated in depscan (hatch and pip exist only in depscan), run against pinned CLI SHAs | both | cross-repo-dup | depscan:tools/pipeline/{pdm,pipenv,poetry,hatch,pip}-patch-backtest.py (3,759); depscan:.github/workflows/pdm-patch-compatibility.yaml:20 SOCKET_PATCH_REVISION; scripts/backtest-{pdm,pipenv,poetry}.py | 2,900 (gated) | 30 (ds, per pypi trigger) | M | no | socket-patch compatibility workflows publish versioned captures; depscan SBOM tests consume them via the submodule; delete depscan's pdm workflow and the pdm/pipenv/poetry scripts; delete depscan's hatch workflow and script only after socket-patch adds a hatch capture. F74 is the interim step. |
+| 24 | F73 | depscan api-v0 shards rebuild the pinned CLI every run despite a 963 MB cache hit | ds | ci-matrix | depscan:workspaces/github-actions/src/jobs/test-api-v0.ts:82-91,146; depscan:.github/workflows/pull-request.yaml:2273-2277; 7 runs, mean 7.9 job-min | 0 | 7.5 (~130 runs/day) | L | no | Cache the binary keyed on `HEAD:submodules/socket-patch`, or build it once and share it; the 7.5 is this cache alone. Optional, not counted: a path-gated shard for the 23 patch e2e files (see D26; the filter must keep the lib/app/pipeline import paths). |
+| 25 | F23 | deploy-patches prod/staging workflows are 500-line twins edited in lockstep | ds | intra-dup | depscan:.github/workflows/deploy-patches-{prod,staging}.yaml (500 each; 68-line diff; 62 shared commits) | 440 YAML | 0 | L | no | One `workflow_call` workflow plus two dispatch wrappers; keep environment protection bound to the right job. |
+| 26 | F21 | hidden legacy scan spellings and the v3 SOCKET_PATCH_* env shim survive v5 | both | dead-code | crates/socket-patch-cli/src/commands/scan/mod.rs:291,312,322,326; crates/socket-patch-core/src/utils/env_compat.rs:20-68,108-117,165-178; depscan:workspaces/patches/src/test/integration/live/hosted-live.e2e.test.ts:569-571 | 450 | 0 | L (env, --detached) / M (flags) | partial (WS8 hid, kept) | In v5.0 drop `--detached` and SOCKET_PATCH_*. Drop or warn-and-map `--redirect/--apply/--vendor`. Update the depscan tests in the same bump. |
+| 27 | F29 | `--one-off` on get/rollback exists only to error | sp | dead-code | crates/socket-patch-cli/src/commands/rollback.rs:98-115,1123-1158; crates/socket-patch-cli/src/commands/get.rs:506-521,2623-2657 | 260 | 0 | L | no (WS8 kept it) | Remove the flag, SOCKET_ONE_OFF, the tests and the CLI_CONTRACT/README rows in v5.0. |
+| 28 | F30 | `.socket/packages/<uuid>.tar.gz` is never written but still probed, overlaid and swept | sp | dead-code | crates/socket-patch-core/src/api/blob_fetcher.rs:30-38; crates/socket-patch-cli/src/commands/fetch_stage.rs:212-235,339,460; apply.rs:1048-1056 | 250 | 0 | L | no | Delete resolve_from_archive, packages_path, the pkg_present arm and the sweeps (keep the archive helpers shared with diffs). gc sweeps the leftover dir for one release. Drop `appliedVia: "package"`. |
+| 29 | F57 | vlt-serve-watchdog cannot alert; npm/pnpm compatibility have no path filter | sp | ci-matrix | vlt-serve-watchdog.yml:18,28; npm-compatibility.yml:9-13; pnpm-compatibility.yml:3-7 | 0 | 12 (PR pushes) | L | no | Path-filter npm/pnpm like bun-compatibility.yml. Arm the watchdog after a manual dispatch confirms depscan #26856/#26867 in prod, or run it daily until then. |
+| 30 | F54 | pdm-compat Windows native legs vacuous (47/47 SKIP, green) | sp | ci-matrix | scripts/backtest-pdm.py:484-486,1320-1324,1352-1355; job 108746808097 | 0 | 8 | L | no | Treat a bootstrap failure or 100% SKIP as ERROR. Then either fix `Scripts\python.exe` (adds ~50–60 job-min) or drop the 16 Windows rows. |
+| 31 | F46 | e2e_maven/e2e_nuget/e2e_composer rows spend ~2.5 min each on 0.03 s hermetic tests | sp | ci-matrix | ci.yml:686,688-693,696; crates/socket-patch-cli/tests/e2e_nuget.rs:182,250 and e2e_maven.rs:102,229 `#[ignore]` | 13 YAML | 7 (≈3 after F51) | L | extends follow-up (v5-plan.md:134-135) | Un-ignore the 4 hermetic tests so `test` runs them; delete the 3 rows. |
+| 32 | F33 | npm `.berry.zip` sidecar is built, stored, served, never read | both | dead-code | crates/socket-patch-core/src/patch/redirect/mod.rs:166 (0 reads); depscan:workspaces/patches/src/services/patch-package/build.ts:475-482; serve-decision.ts:145-157 | 150 | 0 | L | no | CLI: drop `berry_zip_url` (44 lines). depscan: keep the rebuild (it is the 10c0 source) but stop storing and serving the zip after an access-log check; api-v0 package.ts:124-133 exposes it publicly. Drop the columns later. |
+| 33 | F25 | parse_memo: process-global parse caches that work around per-package re-parsing | sp | expensive-abstraction | crates/socket-patch-core/src/vendor/parse_memo.rs (275; 21 statics in 16 files) | 320 | 0 | L | extends WS3/WS6 | Delete once LockModel parses once per run through ProjectContext; add no new sites. |
+| 34 | F32 | Auto/Service fallback policy hand-rolled in 7 backends; the shared helper serves only frozen maven/nuget | sp | intra-dup | crates/socket-patch-core/src/vendor/service_fetch.rs:170-265 (callers maven_repo.rs:713, nuget_feed.rs:906); golang.rs:550-563,701-731 | 220 | 0 | M | extends WS5 | `acquire_service_artifact(cfg, record, verdict_fn)` → Used/FallBack/HardFail inside VendoredBackend. Ready arms stay per backend; warning codes become parameters. |
+| 35 | F27 | the GitHub app mirrors the redirect-state.json schema that WS1 deletes | both | cross-repo-dup | depscan:workspaces/app/src/autopatch-pr/github-patch-pr-hosted.ts:81,235-300,534-575 | 300 | 0 | L | partial (WS1 CLI side) | In the depscan bump past #280, stop writing the ledger. The CLI keeps legacy reads (v5-plan.md:47-48), so this is a stale writer, not an attestation loss. Fixture captures are not prunable LOC. |
+| 36 | F28 | vendored path POSTs /patches/package once per uuid; the endpoint takes 500 | both | redundant-network | crates/socket-patch-core/src/api/client.rs:1429-1437; crates/socket-patch-core/src/api/vendor_prefetch.rs (601 src); depscan:workspaces/api-v0/src/endpoints/orgs/patches/package.ts:287,330 | 300 | 0 | M | no | One chunked batch reference POST per vendor run; keep per-package GETs and the breaker. Also chunk hosted scan's unchunked call (client.rs:759-776), which returns 400 above 500 uuids. |
+| 37 | F18 | one-off cargo index-line backfill runs inside every converter cycle | ds | high-cost-low-value | depscan:workspaces/patches/src/services/patch-package/converter.ts:341-352; queue.ts:593-686; cargo-index-backfill.test.ts (429) | 690 (gated) | 0.3 | L | no | Gate: backlog count = 0 (added 2026-09-28, not yet drained). Then a one-shot admin script, or a flag defaulting off. |
+| 38 | F14 | depscan diff channel: on-demand bsdiff task, hidden route, proxy with per-request view preflight | ds | high-cost-low-value | depscan:workspaces/api-v0/src/endpoints/orgs/patches/diff.ts:93-107; generate-patch-diff-archive-task.ts:41-56,133 (throws in a task); depscan:workspaces/patches-api-proxy/src/server.ts:1263-1345 | 1,130 (gated) | 0.5 | M | no | Needs an owner decision on CLI diff mode: D19 showed default `repair` writes diff-only sources, so the channel is not dead (see F67). Meanwhile remove the task throws and the doubled preflight. If retired, a 404 is a safe interim (crates/socket-patch-core/src/api/blob_fetcher.rs:274-281). |
+| 39 | F22 | 14 of 18 CLI telemetry events are never classified server-side; the endpoint sunsets 2026-12-31 | both | high-cost-low-value | crates/socket-patch-core/src/telemetry.rs:33-57,449-913; depscan:workspaces/api-v0/src/endpoints/orgs/telemetry-discriminators.ts:17-43; telemetry.ts:145 | 450 (gated) | 0 | L | no | Owner decision. Either classify the v5 events and move to `/v1/orgs/{slug}/events` (or get the sunset extended), or delete the unread track_* wrappers. |
+| 40 | F56 | vlt capstones run in ci.yml (35 rows) and in vlt-compat install-proof (70 legs) | sp | ci-matrix | ci.yml:917-955 (112.5 job-min); vlt-compatibility.yml:189-270 | 0 | 60 (≈10 beyond F51) | L | no | vlt and every vlt version stay. Put the rows on F51's build-once; install-proof excludes the 35 cells ci.yml gates, enforced by test_ci_vlt_rows.py. |
+| 41 | F74 | depscan pdm/hatch workflows trigger on pypi task code they never run | ds | ci-matrix | depscan:.github/workflows/pdm-patch-compatibility.yaml:8,20,39; runs 36239865114 (72.1 job-min), 36239865149 (114.9) | 0 | 15 (⊂ F07) | L | partial (F07) | Drop the `pipeline/src/task/python/pypi/**` trigger and add the fixtures/pdm path. Cache the CLI keyed on SOCKET_PATCH_REVISION. |
+| 42 | F13 | shared redirect goldens cover ecosystems unevenly; each repo keeps unshared rewriter tests | both | cross-repo-dup | crates/socket-patch-core/tests/fixtures/redirect: 141 cases (vlt 68; pnpm 2; gem/golang/uv 1; poetry/pdm/pipenv 0) | 1,200 (alt. to F01) | 0 | L-M | partial (WS3 gate) | Only if F01 is not done: move byte-asserting TS and Rust cases into shared fixture dirs, starting with pnpm, package-lock, gem, golang and uv. |
+| 43 | F37 | serve-route.ts re-inlines the stream/304/HEAD logic that serve-artifact.ts centralizes | ds | intra-dup | depscan:workspaces/patches/src/services/patch-serving/serve-route.ts:158-268; #26856 had to patch both | 110 | 0 | L | no | Route through `serveStoredArtifact({headFastPath: true})`; share `makeDeny`. Metadata Cache-Control is intentionally different, so it is not drift. |
+| 44 | F35 | Berry 10c0 checksum implemented twice with hand-copied fixtures; vendored CLI ignores the server value | both | cross-repo-dup | crates/socket-patch-core/src/vendor/berry_zip.rs:335; depscan:workspaces/patches/src/repack/berry-cache-zip.test.ts:1-7; crates/socket-patch-core/src/api/client.rs:1278-1280 | 120 | 0 | L | no | Both implementations stay. Share the fixtures via crates/socket-patch-core/tests/fixtures/berry_zip, read by both; vendored takes the server's yarnBerry10c0 for service artifacts. repacking-to-depscan.md goes further: its verify step 6(vi) always recomputes over the verified tgz as a runtime tripwire, and step 14 puts the vectors under tests/fixtures/served/. |
+| 45 | F36 | two npm-registry tarball fetchers inside depscan | ds | intra-dup | depscan:workspaces/patches/src/repack/upstream/npm.ts:56-60,89-145 vs depscan:workspaces/patches-shared/src/registry/npm-registry-source.ts; socket-patch-publishing-tool.ts:1264-1268 | 110 | 0 | L-M | no | Make npm.ts an adapter over fetchNpmTarballBytes (fetch-archive.ts is shared infra and stays); use the packument URL in the publishing tool. |
+| 46 | F38 | signature handling diverges; depscan signer seam and signature columns are dead | both | dead-code | depscan:workspaces/patches/src/repack/sign.ts (defaultSign → null); repack-utils.ts:1333-1370 keeps RECORD.jws; crates/socket-patch-core/src/vendor/pypi_wheel.rs:570-585 | 110 | 0 | L | no | Strip RECORD.jws/.p7s in depscan; delete the sign seam; stop writing package_signature. Leave CLI maven alone (frozen). |
+| 47 | F34 | every stored object is streamed back in full after upload | ds | expensive-abstraction | depscan:workspaces/patches/src/services/patch-package/build.ts:209,456; gcs-store.ts:108-117 (no checksum header) | 150 | 0 | L | no | Send md5/crc32c (md5 is already computed at build.ts:315,532) and read back only on a 412 collision. The berry and reset parts are in F33/F39. |
+| 48 | F43 | public core fns with zero callers survive because rustc exempts pub | sp | dead-code | on integration f8b8d80a: crates/socket-patch-core/src/vendor/bun_lock.rs:89; vlt_lock.rs:1441; lock_inventory/view.rs:57,219,264 | 55 | 0 | L | no | Delete the 5 zero-caller fns and DirEntryInfo; move test-only helpers under cfg(test); add `#![warn(unreachable_pub)]`. |
+| 49 | F48 | module-wide `#[allow(dead_code)]` on vlt_lock_text masks a dead method | sp | dead-code | crates/socket-patch-core/src/vendor/mod.rs:102; vlt_lock_text.rs:782 | 7 | 0 | none | no | Remove the allow; delete EdgeEntry::entry_text; use `cfg_attr` on find_node_dirs_sync. |
+| 50 | F15 | setup leftovers: frozen hook wheel and Bundler plugin source, plus SetupConfig | sp | dead-code | pypi/socket-patch-hook, gem/socket-patch-bundler (1,053); crates/socket-patch-core/src/manifest/schema.rs:39-60 (43 `setup: None`) | 1,100 (70 new) | 0 | L | yes, WS7 (1,030) | Owner confirms, then delete both dirs; replace the initializers with `..Default::default()`. |
+| 51 | F40 | setup-matrix (9 docker legs) is continue-on-error and tests `setup` | sp | ci-matrix | ci.yml:1634-1700; run 36359489402: 50.9 + e2e setup rows | 70 YAML | 56 | none | yes, WS7 (#279, already on integration) | Land WS7. |
+| 52 | F17 | napi addon + hosted-bundle have 0 consumers; parity upkeep in 3 PRs | sp | high-cost-low-value | crates/socket-patch-cli/src/hosted_memory (4,546); crates/socket-patch-cli/src/commands/hosted_bundle.rs; ci.yml:77-105 node-addon 2m34s | 0 counted (750 claimed; parity retirement refuted, D4) | 1 | L | WS4 (owner keeps both engines) | After #280 lands and #282 is rebased onto it (F26), make no more hosted edits outside core/hosted. Run node-addon and parity only on `core/hosted/**` PRs until depscan adopts (F01). |
+| 53 | F45 | publish dry run re-extracts the file map and re-unpacks upstream to disk to list names (no re-download) | ds | repacking | depscan:workspaces/patches/src/api/commands/review/validate-upstream-anchors.ts:118,178-190; publish.ts:1437-1454 | 30 | 0 | L | no | Fold into F61: convertPatchToPackage returns the entry order; drop the re-unpack. |
+| 54 | F61 | one publish downloads upstream up to 3× and repacks twice | ds | repacking | validate-upstream-anchors.ts:74-86 (build discarded); depscan:workspaces/patches/src/services/patch-package/converter.ts:444-454; certify.ts:200-213,351 | 0 | 0 | L-M | no | Stage the dry-run archive by (purl, upstream digest) and let the converter adopt it after a digest re-verify, or cache verified upstream bytes by digest. |
+| 55 | F59 | after WS1, vex refetches every record per run | sp | redundant-network | origin/v5/ledger-free-hosted crates/socket-patch-cli/src/commands/vex_sources.rs:888-960 (fetch_patch per uuid :930, fresh client :911) | 0 | 0 | L | partial (WS1/WS6) | Pass fetched records through WS6 ProjectContext, or add an immutable per-uuid on-disk cache (honouring `--offline`). Otherwise each vex run pays about +N views. |
+| 56 | F71 | qualifier-less pypi patches: the CLI downloads the served sdist before rejecting it | both | redundant-network | crates/socket-patch-core/src/vendor/pypi.rs:1015-1041,1918-1926; crates/socket-patch-core/src/api/client.rs:1302-1308; depscan:workspaces/patches-shared/src/archive/ecosystem-archive-format.ts:146-165 | 0 | 0 | L | no | Decide from the step-1 artifact filename before the GET; server exposes artifact kind. |
+| 57 | F70 | same waste seen from the vendored download path (one fix with F71) | sp | redundant-network | client.rs:1627-1631,1723 (256 MiB cap); crates/socket-patch-core/src/vendor/pypi.rs:1920,2040 | 0 | 0 | L | no | Same change as F71; add one shared sdist-served pypi golden. |
+| 58 | F80 | auto mode eagerly fetches pristine upstream for uninstalled packages (only cargo defers) | sp | redundant-network | crates/socket-patch-cli/src/commands/vendor.rs:1838-1913 | −15 | 0 | L-M | no | Generalize the `cargo_via_service` deferral (PackageSource::Deferred) to every service-backed ecosystem. Superseded if repacking-to-depscan.md Phase 4 lands; the Deferred arm is deleted there (step 27). |
+| 59 | F60 | hosted scan downloads each patched wheel in full to read METADATA | both | redundant-network | crates/socket-patch-cli/src/commands/scan/hosted.rs:1974-2096; crates/socket-patch-core/src/vendor/pypi.rs:89-127 | 0 | 0 | M | no | depscan persists PEP 658 metadata + hash and returns them from /patches/package; the CLI uses them and falls back to the download. |
+| 60 | F66 | converter reads patched blobs one at a time | ds | other | depscan:workspaces/patches/src/repack/convert-patch.ts:140-185 | 0 | 0 | L | no | Bounded concurrency (~16), start the upstream download first; the dry-run adapter should honour abortSignal (validate-upstream-anchors.ts:323-327). |
+| 61 | F69 | pypi bz2/xz sdists are selected, downloaded (≤256 MiB), then refused | ds | high-cost-low-value | depscan:workspaces/patches/src/repack/upstream/pypi.ts:152-168; repackers/pypi.ts:131-138; repack-utils.ts:771-797 | 0 | 0 | L | no | Reject non-.tar.gz/.zip sdists in the selector before downloading; add an xz arm. No CLI change. |
+| 62 | F67 | disk stager treats diff-archive presence as full coverage; created files fail after default `repair` | sp | other (latent bug) | crates/socket-patch-cli/src/commands/fetch_stage.rs:212-235,316-320; crates/socket-patch-cli/src/commands/apply.rs:236,281; depscan generate-patch-diff-archive-task.ts:84-92 | 0 | 0 | L | no | Plausible, not reproduced. Make `repair` default to file mode, or require blobs for files with an empty before_hash; add a created-file test. |
+| 63 | F50 | next depscan bump fails golden.test.ts on the 68 new vlt cases | both | cross-repo-dup | depscan:workspaces/app/src/patches/registry-rewrite/golden.test.ts:50-60; crates/socket-patch-core/tests/redirect_golden.rs:22-37 | 0 | 0 | L | no | Add a per-flavor TS_IMPLEMENTED allow-list mirroring RUST_IMPLEMENTED; do not port vlt to TS. |
+| 64 | F77 | one red base test skips the e2e tier on all v5 PRs | sp | ci-matrix | crates/socket-patch-cli/tests/e2e_redirect_cargo_build.rs:829; ci.yml:676 `needs: test` | 0 | one-off (~3,100 spent) | L | no | Fix or quarantine case (3) and decide offline-vex-without-ledger semantics in WS1; rebase #279–#283. Do first. |
+| 65 | F78 | in-flight v5 PRs: 344 runs, 34% cancelled or failed; #280 3.75 h without a CI verdict | sp | ci-matrix | ci.yml:22-24; run 36371317869 cancelled at 22 min after 303 job-min | 0 | ~200 per draft push (transient) | L | no | For drafts, run heavy CI and compatibility workflows on ready_for_review, a label or dispatch; put cheap gating jobs first. |
+| 66 | F63 | five drafts cut in parallel from one base on the same hot files | sp | ci-matrix | merge-base 8ae7dc37 for all; crates/socket-patch-cli/src/commands/get.rs and tests/covgap_commands_rollback.rs touched by all 5 | 0 | ⊂ F78 | L | no | Rebase serially (WS1 → WS3 → WS4 → WS5 → WS7/8); skip compatibility workflows on drafts. |
+| 67 | F26 | #282 moves the hosted ledger into core while #280 deletes it | sp | other | origin/v5/one-hosted-engine crates/socket-patch-core/src/hosted/ledger.rs (311); merge-tree: 10 conflicts | 0 terminal (311 churn) | 0 | L | partial (WS4 depends on WS1) | Land #280 first, rebase #282, drop core/hosted/ledger.rs except the migration-only reader. |
+| 68 | F44 | #279 WS8 edits hosted text and tests that #280 deletes and #282 moves | sp | other | #279 469a6711/f200524f; core/hosted/guidance.rs:46-107 on #282 still says "redirect" | 0 terminal (30 churn) | 0 | L | WS8 | Apply the WS8 hosted wording after #282, in core/hosted/guidance.rs. |
+| 69 | F05 | two builders per archive-shaped artifact produce different bytes; reuse.rs hides the flip | both | repacking | crates/socket-patch-core/src/vendor/npm_pack.rs:21-43 vs depscan:workspaces/patches-shared/src/archive/repack-utils.ts:597-660; crates/socket-patch-core/src/vendor/reuse.rs:1-12 | 0 counted (3,300 if rebuild dropped) | 0 | M | WS5 caveat; #283 keeps rebuild | The owner keeps the local rebuild (WS5; blockers in F72). The only actionable part is aligning the npm recipe (upstream order, mtime 0) so both builders produce the same bytes and reuse.rs shrinks; this stays useful while WS5 keeps the rebuild. See repacking-to-depscan.md for the gated deletion path (gross ~2,050 src / ~1,260 test, net ≈ −1,150 src after ~900 src / ~900 test of additions). |
+
+## Measurements and checked-not-waste
+
+These are kept as facts. They are not ranked and their LOC is not counted as
+net-new.
+
+| id | what it established | use |
+|----|---------------------|-----|
+| F08 | WS1 test surface: 80 test files and 326 refs to redirect-state; about 2.2k LOC of ledger-only tests | Within WS1: delete ledger-only corrupt/replay tests instead of porting them; keep tests for the legacy-read migration (v5-plan.md:47). |
+| F31 | hosted.rs ↔ hosted_memory still share 161 verbatim lines on integration; only #282 removes them | Counted inside WS4 (#282). |
+| F42 | Deprecated aliases, tool_command and the CI old-path grep are already deleted on integration | Done; list them as breaking changes in the v5 notes. |
+| F62 | bun.lockb writer and vex/discover reuse the shared codecs | Not waste; WS3 `wired_refs()` absorbs the glue. |
+| F64 | Per-PR deletion ledger (see Totals) | Use it for the de-duplication below. |
+| F65 | #283 keeps the local rebuild and resolves repair/service | The #283 plan note is the WS5-caveat answer. |
+| F68 | The diff archive and the repacked package serve different modes | Assess the diff channel against blobs, never against repacking. |
+| F72 | Server fail-closed classes make the local rebuild the only vendoring path for them (pypi qualifier-less/wheel-only, locally pinned wheels and tarballs, bzip2 sdists) | Blocks F05; verification removed gem platform and go no-go.mod as blockers. |
+| F75 | depscan repack tests are 0.4% of Tap Unit and 0.9% of Tap Integration time | Do not cut repack tests; patches Tap cost is orchestration and backtests. |
+| F76 | Map corrections: repack 6,015 src / 4,976 test (111 `tap.test` + 22 `t.test`); berry_zip.rs 333 src; reuse.rs 382 src; purl-api-proxy path | Figures used here. |
+| F79 | Bump depscan's gitlink in three steps (base tip, then integration, then past #280), pre-flighting each SHA | Sequencing for F11, F27 and F50. |
+
+## Top-10 cuts
+
+| # | id | cut | code | test | docs/YAML | CI job-min/run |
+|---|----|-----|-----:|-----:|----------:|---------------:|
+| 1 | F51 | e2e build-once fan-out | 0 | 0 | 0 | 280 (ci.yml) |
+| 2 | F03 | delete #257 oracles after snapshotting inputs | 0 | 6,500 | 0 | 0.5 |
+| 3 | F02 | delete depscan refactor docs except DAG/ | 0 | 0 | 8,222 | 0 |
+| 4 | F41 | drop per-push e2e-docker | 0 | 0 | 65 | 65 (ci.yml) |
+| 5 | F04 | one test suite per command | 0 | 4,000 | 0 | ⊂ F58 |
+| 6 | F53 | build Dockerfile.base once | 0 | 0 | 0 | ≈35 after F41 (ci.yml) |
+| 7 | F55 | pdm capstone build-once + dedupe | 0 | 0 | 0 | 65 (pdm-compat) |
+| 8 | F52 | tier middle PM versions off PRs | 0 | 0 | 0 | ≈40 after F51 (ci.yml, PR only) |
+| 9 | F06 | retire depscan legacy engine (incl. F19) | 2,750 | 250 | 0 | 0 |
+| 10 | F01 | depscan calls the Rust engine; delete TS twin (gated) | 5,000 (gated) | 5,500 (gated) | 0 | 1 (depscan) |
+| | | **total** | **7,750** | **16,250** | **8,287** | **≈420 ci.yml per PR run (≈380 main push) + 65 pdm-compat + 1 depscan (F01, gated)** |
+
+32.3k lines in all, including the gated F01 (10.5k); 21.8k actionable now.
+
+## Totals
+
+### Net-new savings (not in v5-plan or PRs #279–#283)
+
+| bucket | (a) code | (b) test | (c) docs/non-code | total |
+|--------|---------:|---------:|------------------:|------:|
+| Actionable now | 9,137 | 14,925 | 8,752 | 32,814 |
+| Gated (F01 adoption, F07 capture contract, F14 diff-mode decision, F18 backlog drain, F22 telemetry decision) | 6,275 | 9,395 | 0 | 15,670 |
+| **Net-new total** | **15,412** | **24,320** | **8,752** | **48,484** |
+
+- Code (a): F06 2,750, F09 1,600, F12 1,200, F16 900, F20 360, F25 320,
+  F24 280, F32 220, F21 150, F28 150, F30 150, F34 150, F27 140, F33 100,
+  F39 100, F36/F37/F38 110 each, F15 (SetupConfig part) 70, F29 90, F43 55,
+  F45 30, F48 7, F80 −15. Gated: F01 5,000, F14 565, F22 450, F18 260.
+- Test (b): F03 6,500, F04 4,000, F10 1,400, F11 1,380, F21 300, F06 250,
+  F20 200, F29 170, F27 160, F28 150, F24 145, F35 120, F30 100, F33 50.
+  Gated: F01 5,500, F07 2,900 (Python harness), F18 430, F14 565.
+- Docs and non-code (c): F02 8,222 (depscan refactor docs), F23 440 (depscan
+  deploy YAML), F41 65, F46 13, F47 10, F49 2 (ci.yml).
+- (d) CI job-min per run, de-duplicated:
+  - socket-patch `ci.yml`: F51 280, F41 65, F52 ≈40 (after F51, PR only),
+    F53 ≈35 (after F41), F47 ≈23 (after F51), F49+F58 ≈30 combined, F46 ≈3
+    (after F51), F17 1, F03 0.5, F10 0.3. Total **≈478 per PR run, ≈438 per
+    main push**, against 945 for main push 36359489402. The standalone sum
+    is about 585 (F52 at ≈90); the difference is the overlaps below.
+  - Compatibility workflows, per triggered PR push: F55 65, F57 12, F56 ≈10
+    (install-proof dedupe beyond F51), F54 8. About **95**.
+  - depscan, actionable: F73 7.5 + F11 2 ≈ **9.5 per api-v0 CI run** (~130
+    runs/day). Gated: F01 1, F14 0.5, F18 0.3 (Tap unit/integration, not
+    api-v0). F07 adds 30 per pdm/hatch trigger (F74's 15 is its interim
+    subset).
+  - Transient, during the v5 train only: F78 about 200 per draft push. F78
+    uses the savings verification's ≈200 rather than the recorded 250
+    (compatibility workflows are path-filtered). F63's recorded 475 is an
+    upper bound on the same cancelled runs and is not counted. F77: about
+    3,100 job-min already spent on runs whose result was known in advance.
+
+### Overlaps not double counted
+
+- F19 ⊂ F06 (same file); F74 ⊂ F07; F70 = F71 (one fix); F63 ⊂ F78;
+  F45 ⊂ F61's change.
+- F13 is the alternative to F01: its TS half is inside F01's 5.5k test LOC.
+  It is excluded.
+- F17's 750 is excluded because hosted_memory_parity retirement was refuted
+  (D4); only its CI gating (1) counts. F31 is WS4.
+- F56's ci.yml half (≈50 of 60) is inside F51. F52 and F46 shrink once F51
+  cuts leg cost from about 3.0 to about 1.2 min.
+- F47's 3 e2e_safety rows are F51 legs (11.1 job-min at full cost); after
+  F51 they save ≈4, so F47 ≈23 is counted, not 30.
+- F53 after F41 keeps only coverage-docker's builder stage; its setup-matrix
+  share is WS7.
+- F49, F58 and F04 overlap (fewer binaries and one compile), so ≈30 is
+  counted, not 43.
+- F11 carries the depscan setup test deletion; F40 and F73 mention the same
+  59 file and are not counted again.
+- F27 carries the depscan ledger change; F11(e) is the same item.
+- F26 and F44 are churn avoided (0 terminal LOC).
+- F05 (3,300) is excluded: the owner keeps the rebuild, and F72 lists the
+  blockers.
+- Residual risk of double counting: F10 vs F04 (≤0.7k of e2e/in_process
+  CRLF tests); F04 vs F08 (ledger tests inside covgap files, which WS1 owns).
+
+### Already planned (context, not counted)
+
+Per-PR ledger (F64, verified; `git diff --shortstat 8ae7dc37`):
+
+| branch | + / − | net | note |
+|--------|-------|----:|------|
+| #279 remove-setup-and-ui (WS7/WS8) | +1,599 / −31,648 | −30,049 | setup removal |
+| #280 ledger-free-hosted (WS1) @08c30b7e | +21,968 / −21,268 | +700 | adds upstream/* 8.4k (see F16); at 65aa0744: +23,055 / −21,269, net +1,786; upstream/* 8,752 |
+| #281 lock-models (WS3) @85421f3b | +4,495 / −3,353 | +1,142 | |
+| #282 one-hosted-engine (WS4) | +5,209 / −4,634 | +575 | ports ledger into core (F26) |
+| #283 vendor-backend (WS5) | +2,776 / −6,325 | −3,549 | keeps local rebuild |
+| v5/integration (#279+#281+#283) | +7,974 / −40,841 | −32,867 | tests 9,256 → 8,589 |
+
+- Setup removal is 77.5% of integration's gross deletions and about 91% of
+  its net. WS1, WS3 and WS4 are net additions until F16 and F26 are folded
+  in. Report v5 savings from integration totals, never per PR.
+- Findings that fall inside this planned work: F08 (2.2k WS1 tests), F15
+  (1,030 of 1,100, WS7), F31 (WS4), F40 (70 YAML, 56 job-min, WS7), F42
+  (follow-ups, done). Also excluded: F04's covgap_setup* (2,717), F58's ~21
+  setup binaries, F10's core/setup CRLF tests, and F53's setup-matrix image
+  builds.
+- Extends-plan items are counted as net-new because the plan does not name
+  their deletions: F09, F10, F16, F25 (WS3); F12, F32 (WS3/WS5); F21, F29
+  (WS8); F46 (follow-ups); F27, F59 (WS1/WS6 counterparts); F17 (WS4
+  sequencing).
+
+## Repacking summary
+
+Full treatment: [repacking-to-depscan.md](repacking-to-depscan.md).
+- depscan builds every served artifact asynchronously after publish:
+  `published_patches` is the queue, patch-package-converter does the build,
+  and outputs are write-once GCS objects. Only registry metadata is
+  assembled per request. depscan repack is 6,015 src / 4,976 test LOC.
+- The CLI's local builders are about 2.8k src (npm_pack, berry_zip,
+  pypi_wheel, reuse, part of registry_fetch; F05 correction). They are the
+  `auto` fallback, `build`, `--offline` and dry-run path. The 9-file map
+  total of 6,515 src / 7,780 test includes golang_local.rs and prestage.rs,
+  which are not the local build. Of the local build,
+  repacking-to-depscan.md deletes ~2,050 src / ~1,260 test if the WS5
+  caveat is reversed; pypi_wheel (the one local class), berry_zip (the
+  verifier and WS1), the verifiers and maven/nuget stay.
+- The two builders' bytes differ for every archive-shaped ecosystem (F05).
+  #283 keeps the rebuild; F72 lists the classes only it can vendor.
+- Waste on the server: F61 and F45 (publish re-downloads and repacks), F66
+  (serial blob reads), F69 (bz2/xz after download), F33/F34/F38/F39
+  (sidecars, read-back, sign seam, reset paths), F36 (second npm fetcher).
+- Waste in the CLI: F70/F71 (discarded sdist downloads), F80 (eager
+  pristine fetch), F28 (per-uuid reference POSTs).
+- Shared: F35 (10c0 twins, fixtures only).
+- Not waste: repack test time (F75); diff vs repack (F68).
+- The service-hit vs local-fallback rate is still unmeasured. CLI telemetry
+  does not record vendor-source fallback. Any decision to drop the rebuild
+  needs that number first (see Caveats).
+
+## Dropped findings (refuted; do not re-raise)
+
+| # | finding | refuted because |
+|---|---------|-----------------|
+| D1 | Two lockfile patch-reference recognizers with unequal fixture corpora | Both are needed: the offline fail-closed CLI and the server SBOM resolve. Nothing is removable (0 LOC). |
+| D2 | Go hosted pin implemented three times | False: the CLI has one go.sum writer; rewrite_golang calls go_sum_edit (redirect/mod.rs:7160). |
+| D3 | #280 carries dead takeover.rs/replay.rs/client.rs.orig | Stale snapshot: the #280 head already deleted them (9b0f61b8). |
+| D4 | hosted_memory_parity becomes a self-comparison after WS4 | False: the memory side keeps its own discovery, roots and selection front end; savings overstated ~10×. |
+| D5 | vlt scenarios tested up to 4 times | Not duplicates: synthetic in-process trees vs real-installer e2e; deletion would drop unique coverage. |
+| D6 | depscan api-v0 e2e retests CLI internals; vendor suites never hit the server | False: 89–94 seed real patches and download through live api-v0. |
+| D7 | Test LOC concentrated in low-churn code; lock_inventory barely tested | Measurement error (test-only files counted as src); 0 savings. |
+| D8 | depscan repack operator CLIs are dead | Manual operator tools, not dead code. |
+| D9 | CLI fetches full patch views instead of metadata/batch records | Most call sites reuse the full view for the download; the fix adds code (a new client method and proxy route) and removes none. |
+| D10 | Vendored staging downloads blobs before asking the service | False for scan/get: they seed blobs from the records download; the fix needs an endpoint the client lacks. |
+| D11 | vlt preflight downloads every hosted tarball each scan | The bodies feed heal and stale detection; the fix adds code; 0 savings. |
+| D12 | Telemetry builds a new HTTPS client per event | Each command sends once; negligible savings. |
+| D13 | scan/vex/vendor re-crawl in separate processes | By design (VEX attests current disk bytes); `scan --vex` already reuses the crawl; 0 savings. |
+| D14 | Self-evolving harness: 10.3k LOC plus 2×1 TiB Filestore | Infra is gated per env (prod disabled); the cost claim is wrong. |
+| D15 | Maven/NuGet vendoring costs 13k LOC and ~87 job-min | Most of it is hosted maven/nuget (not frozen; WS1 extends it) or setup (WS7). |
+| D16 | ledger_snapshots v2 schema is waste | The proposed redesign is the one reverted for data loss (5c173d6c); net savings ≈0. |
+| D17 | Self-update subsystem is high-cost/low-value | Standalone install is the headline channel (Windows needs it); 0 savings proposed. |
+| D18 | WS1 makes berry_zip/registry_fetch load-bearing | Already load-bearing across vendored paths; the recommendation moves code, it deletes none. |
+| D19 | Default diff mode always downloads blobs; delete the bsdiff channel | The default `repair` writes diff-only sources that later apply from, so the channel does save bytes (see F14, F67). |
+| D20 | Size/entry caps differ between the server and CLI fetchers | Mostly false (the CLI is more permissive on served artifacts); not waste. |
+| D21 | depscan upstream fetchers have no fetch/verify tests | False: 8 live repack-checksum e2e suites (3,219 LOC); it is a coverage gap, not waste. |
+| D22 | Missing-digest policy differs (composer/old npm) | Not waste; misreads when the CLI composer fetch runs. |
+| D23 | Sidecar md5 computed for every artifact but served only to maven | Negligible (~15 LOC); misreads the maven freeze. |
+| D24 | Service-hit vs fallback rate unobservable | Service side is observable (patchServer.downloads); the fix adds code. The data gap is kept as a caveat. |
+| D25 | Build-state gauges lack an ecosystem label | Per-ecosystem failure counters already exist; the fix adds code. |
+| D26 | depscan "patches - Installer E2E" path filter too broad | A safe filter must keep imported lib/app/pipeline paths; savings fall below the bar. |
+
+## Caveats
+
+- **History.** socket-patch history starts at 2025-11-10 (51ea2850). Churn
+  and fix-commit counts cover about 10.5 months, and subject-only vs
+  body-matching `--grep=fix` counts differ; the verification notes say
+  which. depscan
+  counts use `--follow` where files moved.
+- **Moving branches.** #280 and #281 moved during the review (#280 f1cc47bb
+  → 08c30b7e → dc634b31 → 65aa0744). F16, F26, F44 and F59 cite branch heads and need a
+  re-check before acting.
+- **Line numbers.** They are against release/v5-prerelease 8ae7dc37 unless
+  marked integration (f8b8d80a) or branch. ci.yml lines differ by about 22
+  between the two.
+- **socket-patch CI minutes.** Job-minutes from the Actions job API: main
+  push 36359489402 (246 jobs, 944.9 job-min) and PR runs 36363939533,
+  36363939563, 36368399706, 36362334985. They are job-minutes, not wall-clock
+  and not billed minutes (macOS bills 10×, Windows 2×). Some logs were read
+  only from the 5,000-line tail, so compile shares were sampled. Numbers
+  "after Fnn" are derived, not measured.
+- **depscan CI minutes.** An early estimate came from
+  localdev/tap/test-durations.json and was corrected by measuring 7 runs
+  (F75). Deploy and pdm/hatch runs report 0 billable ms (non-billed runners),
+  so their totals come from per-job durations.
+- **Production data.** None of it was queried. Grafana SQL and gateway logs
+  are needed for F18 (backlog count), F20 (purl-api /patch traffic), F33
+  (.berry.zip fetches), F71 (bare-purl pypi share), F14 (diff-route
+  telemetry), and the service-hit vs local-fallback rate that any
+  local-rebuild decision needs.
+- **Not measured.** The full cost of a depscan submodule bump was not run
+  end to end (F11 is grep-based; its vendor suites 89–94 were not run
+  against integration). F67 is plausible but not reproduced.
+- **Savings.** They assume the recommended change, not deletion by default.
+  Savings lens refuted but 2 of 3 upheld: F13, F17, F28, F34–F39, F43, F45,
+  F48, F80 (figures are the corrected ones, or 0 where the correction says
+  nothing is removable). Value lens refuted but 2 of 3 upheld: F05, F10,
+  F14, F18, F23, F24, F25, F27, F63, F78. The 0-LOC ranked findings F44,
+  F50, F59–F61, F66, F67, F69–F71 and F77 also had the savings lens refuted
+  and count nothing. The rank column does not show votes; this list does.

From 0f2de18eeee328c541b1d855456fdcbd71bb5da5 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Mon, 28 Sep 2026 18:36:05 +0200
Subject: [PATCH 18/32] v5 design: staged patch rollout (socket.yml + scan
 limit) (#290)

* Plan staged patch rollout for v5

Adds the design for rolling Socket patches out gradually: a
`patches:` block in socket.yml that narrows what scan may patch
(paths, ecosystems, packages, severity floor, on/off), and a
severity-ordered per-run cap on new patches so each scan lands the
next few most critical fixes.

The plan splits the work into two parallel items with a frozen
interface, lists every hard-coded filter and where it belongs, and
covers the depscan autopatch follow-up. configuration.md now records
that socket-patch reads socket.yml for selection policy only, with
the trust boundary unchanged.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Revise rollout plan after adversarial review

Three independent reviews (ambiguity, churn, trust boundary) found
gaps that would have let the two implementations disagree or let a
repo file widen or stall the rollout. The plan now:

- matches paths against marker files with the backend's top-down
  gitignore rules, so projectIgnorePaths means the same everywhere
- uses one data source for severity, supersession and ordering
- spends the budget only on patches the planning pass proves can
  land, and admits nothing new when a lookup failed
- uses the merged recorded view in every mode and engine
- has depscan read the policy from the base commit for PR jobs
- hardens file handling (regular files, aliases, size, encoding,
  trusted repo root) and reports what a policy hides

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Close interface gaps in the rollout plan

A final consistency pass found places where the two work items
would have produced incompatible code: base purls admitted in one
directory being charged again in the next, no defined hand-off of
the unfiltered offers from the severity filter to classification,
no shared repo-relative path helper, and override sources the JSON
must report but the interface could not carry. The shared contract
now defines each of these, and the parity tests match each engine's
budget scope.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Clarify who shapes scan's selection output

The plan said both that the selector returns the shared offers
struct (work item A) and that it returns admitted/deferred rows
(work item B). The selector now returns the offers, and B adds the
rollout stage after it.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Apply socket.yml policy in memory path selection

Bugbot on #290: the plan had the in-memory engine's path selector
apply only the built-in test/fixture ignores, because it runs before
socket.yml is read. A negation such as `!/e2e/tests/` could then
never bring those trees back in depscan, while it works on disk.

Selection is now two-phase: the caller fetches the root policy
file(s) first and passes their text to selectHostedScanPaths, which
applies the full path policy. A listed policy file that is not passed
fails closed. A new memory test covers the negation case.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>
---
 docs/design/configuration.md  |   65 ++-
 docs/design/staged-rollout.md | 1031 +++++++++++++++++++++++++++++++++
 docs/design/v5-plan.md        |    7 +
 3 files changed, 1089 insertions(+), 14 deletions(-)
 create mode 100644 docs/design/staged-rollout.md

diff --git a/docs/design/configuration.md b/docs/design/configuration.md
index 4bc48634..4c4a617c 100644
--- a/docs/design/configuration.md
+++ b/docs/design/configuration.md
@@ -1,8 +1,9 @@
 # Configuration design: env vars, the socket-cli config file, and what we deliberately don't read
 
-Status: **implemented** (v3.5). This document records the settled design so
-future configuration surface grows inside it instead of inventing new
-mechanisms.
+Status: **implemented** (v3.5); section 4 (`socket.yml` patch policy) is
+**planned** for v5.0 (see `staged-rollout.md`). This document records the
+settled design so future configuration surface grows inside it instead of
+inventing new mechanisms.
 
 ## Problem
 
@@ -69,13 +70,49 @@ UX policy and are ignored.
 - The python `socketsecurity` CLI already accepts `SOCKET_API_TOKEN`, so
   the canonical names are the cross-tool bridge; no `SOCKET_SECURITY_*`
   aliases were added.
-- `socket.yml` stays a scanning-product surface (projectIgnorePaths /
-  issueRules / githubApp); socket-patch does not read it.
+- `socket.yml` is shared with the scanning product (projectIgnorePaths /
+  triggerPaths / issueRules / githubApp). As of v5.0 socket-patch reads
+  exactly two of its keys, `projectIgnorePaths` and a new `patches` block,
+  and nothing else (section 4).
 - `SOCKET_PROXY_URL` (the public patch **endpoint**) must never be
   conflated with socket-cli's `apiProxy` (an HTTP **forward proxy**).
   Forward-proxy behavior comes from the standard
   `HTTP_PROXY`/`HTTPS_PROXY`/`NO_PROXY` vars, which reqwest honors.
 
+### 4. `socket.yml` carries patch selection policy, never settings (v5.0)
+
+Revisits the v3.5 position that socket-patch does not read `socket.yml`.
+Staged rollout needs a repo-owned, reviewable place to say which projects,
+ecosystems and packages may be patched, a severity floor and a per-run cap
+on new patches (`staged-rollout.md`). `socket.yml` is where Socket users
+already express repo policy, it lives at the repo root, and a new
+top-level `patches:` key is stripped or ignored by every existing parser.
+
+The trust boundary is unchanged and gains its positive half:
+
+- A repository file may **narrow or pace** what `scan` patches. It may
+  never widen it, name an endpoint or credential, choose a mode or download
+  format, or disable a safety interlock. The parser has no fields for any
+  of those; such keys are unknown keys and fail validation.
+- Because the file only narrows, an unreadable file or an invalid
+  `patches` block fails closed (exit 1, `socket_yml_invalid`, nothing
+  written) instead of being treated as absent. (A repo with no `patches`
+  block and a malformed `projectIgnorePaths` gets a warning, so repos that
+  never opted in do not start failing.) This is the opposite of the socket-cli `config.json` rule above
+  (corrupt → warn and ignore), and deliberately so: ignoring a broken
+  user-level login file loses a convenience; ignoring a broken repo policy
+  widens the rollout.
+- Lookup is bounded to the repository (nearest `.git` ancestor of
+  `--cwd` owned by the user, honoring `GIT_CEILING_DIRECTORIES`, else
+  `--cwd`), root files only, regular files only.
+- Flags and env vars still win over the file for scalars (CLI > env >
+  file > default) and intersect with it for list filters;
+  `--no-socket-yml` / `SOCKET_NO_SOCKET_YML` ignores the file.
+- Only `scan` (every mode) and the in-memory engine honor it. Commands
+  that report, attest or undo existing state (`list`, `vex`, `rollback`,
+  `remove`, `repair`, `apply`, `vendor`) ignore it; `get` bypasses it with
+  a warning.
+
 ## Explicitly rejected
 
 | Idea | Why not |
@@ -83,21 +120,21 @@ UX policy and are ignored.
 | Auto-loading `.env` / `.env.local` | Trust boundary: the tool mutates installed packages while holding an API token; a file in a *cloned repo* must never redirect endpoints, disable interlocks, or spend the token. Also the wrong convention class — npm/cargo/pip/git read no `.env`; dotenv is an app-runtime convention. Users who want it have direnv/mise/dotenvx. |
 | A new socket-patch config file (`.socket/config.toml`, …) | Duplicates socket-cli's persisted config; one more file format to trust, document, and migrate. |
 | Writing to socket-cli's `config.json` | No login flow here; shared mutable state and format drift for zero benefit. |
-| Honoring endpoints/credentials from repo-level files (manifest, socket.yml) | Same trust boundary as `.env`. Stated as a contract property in `CLI_CONTRACT.md`. |
+| Honoring endpoints/credentials/interlock switches from repo-level files (manifest, socket.yml) | Same trust boundary as `.env`. Stated as a contract property in `CLI_CONTRACT.md`. Selection policy that only narrows is the one exception (section 4). |
+| A `version: 3` socket.yml for the `patches` block | socket-cli rejects any version but 2; older ajv parsers would treat 3 as 2 anyway. The block is additive under `version: 2`. |
+| Per-directory `socket.yml` files | No existing consumer supports them; one root file with `includePaths` covers monorepos. |
 | `SOCKET_CLI_CONFIG` (ephemeral full-JSON config override) | Imports socket-cli's whole config vocabulary as a permanent compat contract. |
 | Mapping `apiProxy` → anything | Forward-proxy vs patch-endpoint semantic trap; `HTTP_PROXY` et al. already work. |
 | `enforcedOrgs` / `skipAskToPersistDefaultOrg` | Interactive socket-cli UX policy with no socket-patch analog. |
 
 ## Deferred (designated homes, no implementation yet)
 
-- **Project-level behavioral defaults** (`ecosystems`, `downloadMode`,
-  `vendorSource`): if demand materializes, they go in the manifest `setup`
-  block (`setup.defaults`, camelCase) — the manifest already controls what
-  gets patched, so behavioral defaults there grant no new capability, and
-  the serde struct simply has no fields for URLs/credentials/interlocks.
-  Requires teaching the TS zod twin
-  (`npm/socket-patch/src/schema/manifest-schema.ts`) to model `setup`.
-  Precedence would be flag > env > `setup.defaults` > default.
+- **Project-level behavioral defaults** (`downloadMode`, `vendorSource`,
+  mode): not planned. The v3.5 idea of a manifest `setup.defaults` block is
+  obsolete in v5 (hosted and vendored projects have no manifest and `setup`
+  is removed). Selection policy (ecosystems, packages, paths, severity,
+  per-run cap) went to `socket.yml` `patches` instead (section 4). Anything
+  that is not pure narrowing stays out of repo files.
 - **Env cleanup sweep**: core's direct env readers (`SOCKET_OFFLINE` in
   `utils/env_compat.rs`, `SOCKET_TELEMETRY_DISABLED` in `telemetry.rs`)
   still match only `1|true`, unlike `parse_bool_flag`'s vocabulary (the CLI
diff --git a/docs/design/staged-rollout.md b/docs/design/staged-rollout.md
new file mode 100644
index 00000000..38f916e8
--- /dev/null
+++ b/docs/design/staged-rollout.md
@@ -0,0 +1,1031 @@
+# Staged patch rollout: `socket.yml` patch policy + `scan --max-new-patches`
+
+Status: **planned** (v5.0). Target branch `release/v5-prerelease`.
+Two work items, built in parallel: **A** (policy file + filters) and
+**B** (per-run limit + ordering + reporting). Section 9 specifies both.
+
+## 1. Goal
+
+Make it easy to roll Socket patches out gradually:
+
+1. **Repo policy in `socket.yml`.** Say which projects, ecosystems and
+   packages socket-patch may patch, and a severity floor. Defaults apply
+   when the file or the block is absent. The hard-coded repo-path filter
+   that exists today moves here as an overridable default.
+2. **A per-run cap on new patches.** `scan` adds at most N patches to
+   packages that have none yet, most severe first. Repeated runs converge:
+   each run lands the next N.
+
+Non-goals: open-PR accounting (a CLI patching a working tree has no PR
+state; that stays in depscan), schedules, release-age cooldowns (security
+fixes are exempt from cooldowns in Dependabot and Renovate too), and
+per-directory `socket.yml` files.
+
+## 2. What exists today (research summary)
+
+### 2.1 `socket.yml` v2 and its consumers
+
+| Parser | Where | Unknown top-level keys | Wrong type on a known key |
+|---|---|---|---|
+| P1 `@socketsecurity/config` 3.0.1 (archived; bundled in `socket` 1.x) | `socket-config-js/index.js:30-88` | stripped (ajv `removeAdditional: 'failing'`, `additionalProperties: false` at top level and under `githubApp`) | file rejected |
+| P2 depscan copy (GitHub App, fix-PR) | `workspaces/lib/src/config-js/socket-yaml-schema.ts`, `parse-socket-yaml.ts` | stripped (same ajv options) | whole file rejected; PR check goes neutral with "error processing the socket.yml" (`diff-report-runner/index.ts:441-464`) |
+| P3 socket-cli 2.x | `src/util/socket-yaml.mts` | ignored (hand-written picker) | that key dropped |
+| P4 Coana | not available | unverified | reads `projectIgnorePaths` only |
+
+- Keys in the wild: `version` (integer; P1/P2 accept any integer, P3
+  rejects anything but 2), `projectIgnorePaths`, `triggerPaths`,
+  `issueRules`, `githubApp.*`. Nothing mentions patches.
+- **A new top-level `patches:` key breaks no parser** as long as the file
+  keeps `version: 2`. P1/P2 strip it, P3 ignores it. None of them will
+  ever see it; socket-patch is its only reader.
+- Lookup: the GitHub App reads only the repo-root `socket.yml` /
+  `socket.yaml` at the scanned commit, and when both exist `socket.yaml`
+  wins (git tree order, `get-socket-repo-config.ts:96-120`). socket-cli
+  walks up from cwd and prefers `socket.yml`. The docs say `socket.yml`
+  wins. Nobody merges multiple files; there are no per-directory files.
+- Glob semantics (backend): the `ignore` npm package, i.e. **gitignore
+  rules**, case-insensitive, tested against each manifest **file** path
+  (`list-files.ts:476-507`). A leading `/` or a
+  middle `/` anchors to the repo root, a bare name matches at any depth, a
+  trailing `/` matches directories only, `!` negates, last match wins, a
+  child of an excluded directory cannot be re-included.
+- An unquoted `**` entry is a YAML error. Case-insensitivity and the
+  "excluded parent" rule are the two things users trip over.
+
+### 2.2 socket-patch v5 today
+
+- Selection per package: `socket_patch_core::api::ranking`
+  (`ranking.rs:85`): merged patches (>= 2 advisories) newest first, then
+  severity, then publish date, then tier/uuid. `RankKey.severity` is forced
+  to 0 for merged patches, so it is **not** the patch's real severity.
+  `severity_order` (`ranking.rs:41`) and `max_severity_order` are.
+- Per-patch data: severity (max, uppercase), advisory ids, tier, optional
+  `publishedAt` (batch endpoint usually lacks it). No CVSS, EPSS, KEV,
+  reachability or direct/transitive information anywhere.
+- Scan selects patches in five disk call sites plus one in the in-memory
+  engine: `discover_selected` (`scan/mod.rs:553`, called from `mod.rs:1999`,
+  `hosted.rs:1063`, `vendor_flow.rs:473`, `mod.rs:2349`), the human
+  agent/vendored arm (`mod.rs:2386-2402` via `get.rs:1097`), and
+  `hosted_memory/discover.rs:286` (`select_top_ranked`, called at
+  `hosted_memory/mod.rs:537`).
+- Existing filters: `--ecosystems`, `--package` (`package_spec_matches`,
+  `mod.rs:383`), PATH globs (`path_scope.rs`), all applied after the prune
+  universe is captured (`mod.rs:1480`).
+- Recorded state: `merge_ledger_records_for_updates` (`discovery.rs:412`,
+  manifest > hosted lockfile pins > vendor ledger) and `detect_updates`
+  (`discovery.rs:452`) with `batch_supersedes` (`ranking.rs:157`). The
+  in-memory engine has **no** hosted-pin discovery.
+- `docs/design/configuration.md` said socket-patch never reads
+  `socket.yml`. This plan reverses that (section 3); the doc is updated in
+  the same PR.
+
+### 2.3 Hard-coded filtering inventory
+
+socket-patch (paths relative to `crates/`):
+
+| # | Location | What | Verdict |
+|---|---|---|---|
+| H1 | `socket-patch-cli/src/hosted_memory/roots.rs:56-67` `EXCLUDED_ROOT_SEGMENTS` | the in-memory engine never detects a project root under `node_modules .git .socket .yarn vendor test tests fixtures __fixtures__ testdata` | **Move** `test tests fixtures __fixtures__ testdata` to the overridable default `ignorePaths` (section 4.3), applied on disk too. Keep `node_modules .git .socket .yarn vendor` structural. |
+| H2 | `socket-patch-core/src/crawlers/npm_crawler.rs:19-27` `SKIP_DIRS` (dist build coverage tmp temp `__pycache__` vendor) | npm workspace walk looking for nested `node_modules` | Stays: crawler heuristic, not selection policy |
+| H3 | `socket-patch-cli/src/hosted_memory/select.rs:46,53-70` | cargo `target/` and `cargo vendor` output skipped | Stays: correctness |
+| H4 | `socket-patch-cli/src/hosted_memory/roots.rs:40-53` | maven/nuget unsupported in memory | Stays: capability |
+| H5 | `socket-patch-cli/src/hosted_memory/mod.rs:274` `ecosystem_allowed` | `options.ecosystems` | Stays: the in-memory `--ecosystems`; intersects with the file |
+| H6 | `crawlers/python_crawler.rs:288`, dot-dir skips in `cargo_crawler.rs:373`, `go_crawler.rs:344`, `nuget_crawler.rs:236`, `ruby_crawler.rs:576` | discovery locations | Stays: crawler heuristics |
+| H7 | `ruby_crawler.rs:823` BUNDLE_PATH containment | refuse config roots outside the project | Stays: **safety** |
+| H8 | `scan/mod.rs:596-603`, `get.rs:1101-1107` tier filter | paid patches for free orgs | Stays: entitlement |
+| H9 | `scan/mod.rs:723-762` agent partition | vendored / not-installed skips | Stays: ownership safety |
+| H10 | `scan/hosted.rs:1256-1296` non-granted references | not_found, forbidden, pending_build, build_failed, withdrawn | Stays: server truth |
+| H11 | `hosted.rs:1352-1402`, `hosted.rs:1448`, core rewriter refusals, vendor revert allowlists, `vlt_lock_text.rs:311` | write safety, format gates, ledger-poisoning guards | Stays: **safety** |
+
+No package-name, uuid or repo denylists exist anywhere in socket-patch.
+
+depscan (`feat/socket-patch-cli-autopatch`, PR #26860; `workspaces/app/src/autopatch-pr/cli/` unless noted):
+
+| # | Location | What | Verdict |
+|---|---|---|---|
+| D1 | `run-job.ts:94-102,293`; `next-app/.../socket-patch-cli/enqueue.ts:104` | per-org `socketPatchCliAutopatch` flag | Server (kill switch) |
+| D2 | `provider/create-patch-provider.ts:189-279` | `enablePatchesAccess`, paid entitlement | Server (entitlement) |
+| D3 | `lib/src/socket-patch/autopatch-job.ts:152-169` | per-job admin `config.ecosystems` allowlist, `batchSize` (lookup batch, not a patch cap) | Server; ecosystems **intersect** with `patches.ecosystems` |
+| D4 | `repo-files.ts:290-513` | tree/path/size/depth caps, unsafe path drops | Server (safety) |
+| D5 | `pull-request-rules.ts:473-491` | fork/default/protected heads are check-only | Server (safety) |
+| D6 | `next-app/src/lib/admin/autopatch/socket-patch-cli-branches.ts:10-31` | branch-name guards | Server |
+| D7 | legacy `patch-pr-worker.ts:65-109`, `github-patch-pr.ts:262-283,1598-1740`, `github-patch-pr-hosted.ts:196-486`, `compute-full-patch-set.ts:41-273` | already-applied, not-in-SBOM, unpublished, deprecated, vlt gates | Server (correctness); not policy |
+
+Nothing in depscan filters by repo path, package or severity, and nothing
+caps patches per PR. The only repo-path policy in the whole system is H1,
+and it lives in the engine. It is the one hard-coded filter that moves.
+
+### 2.4 Prior art (vocabulary borrowed, complexity not)
+
+| Tool | Limit | Counts | Order when capped |
+|---|---|---|---|
+| Dependabot | `open-pull-requests-limit` (5; security updates exempt) | open PRs | undocumented; shuffled |
+| Renovate | `prConcurrentLimit`, `prHourlyLimit` (security fixes bypass) | open PRs / new per hour | vulnerability, `prPriority`, update type, title |
+| Snyk | 5 open upgrade PRs; backlog "one PR a day, top vulnerability" | open PRs / per day | priority score |
+| GitLab auto-remediation | 10 open MRs, "three vulnerabilities at a time, highest severity first", `high` threshold | open MRs + per run | severity |
+| OSV-Scanner | `--apply-top=N`, `--min-severity` | per run | fixed |
+
+Borrowed: gitignore paths (`projectIgnorePaths`), `include`/`ignore`
+pairs, `enabled`, a severity floor spelled as a minimum (`--min-severity`,
+Snyk/GitLab/OSV), a per-run new-item cap (GitLab/OSV/Snyk backlog), a
+fixed total order (not Dependabot's shuffle), deny-wins.
+
+
+## 3. Trust boundary (decision)
+
+The rule in `CLI_CONTRACT.md` ("Repo-level files never carry endpoints,
+credentials, or interlock-disablers") stays and gains its positive half:
+
+> A repository file may **narrow or pace** what `scan` patches. It may
+> never name an endpoint or credential, pick a mode or download format,
+> turn off a safety check, or make `scan` patch anything it would not
+> patch with no file present. The one exception is negating the built-in
+> test/fixture path ignores (4.3), which are repo policy by nature.
+
+Every `patches:` key only removes candidates (`enabled`, `includePaths`,
+`ignorePaths`, `ecosystems`, `packages`, `ignorePackages`, `minSeverity`)
+or delays them (`maxNewPatches`). No key can add a package, bypass the tier
+filter, the agent partition, reference grants, containment checks or any
+refusal in H7-H11. The parser has no fields for URLs, tokens, org, mode,
+download mode or any `--no-*` safety switch; such keys are unknown keys and
+fail validation (4.4).
+
+Failure direction follows from that: because the file only narrows, an
+unreadable or invalid policy must not mean "no policy". It fails closed.
+And because a policy can hide security fixes, what it hides is always
+reported (4.7, 7.3), never silent.
+
+## 4. `socket.yml` grammar (work item A)
+
+### 4.1 Keys
+
+```yaml
+version: 2                     # required for socket-patch to honor `patches`
+projectIgnorePaths:            # existing scanner key; socket-patch honors it too
+  - "crates/*/tests/fixtures/**"
+patches:                       # new; every key optional
+  enabled: true                # bool. Default true. false = report only.
+  includePaths: ["/services/payments/"]   # gitignore list. Absent = every project.
+  ignorePaths: ["/legacy/"]    # gitignore list, evaluated after the defaults. Default [].
+  ecosystems: [npm, pypi]      # allowlist of --ecosystems names. Absent = all.
+  packages: ["pkg:npm/lodash"] # allowlist of --package specs. Absent = all.
+  ignorePackages: ["pkg:npm/left-pad"]  # denylist of --package specs. Default [].
+  minSeverity: high            # critical|high|medium|moderate|low. Absent = no floor.
+  maxNewPatches: 5             # integer 0..=4294967295. Absent = unlimited. 0 = upgrades only.
+```
+
+- camelCase, like every existing socket.yml key.
+- Ecosystem names are any `Ecosystem::cli_name()` (`npm pypi cargo gem
+  golang maven composer nuget deno`), case-insensitive, valid whatever the
+  build supports; an unsupported ecosystem simply matches nothing.
+- Package specs use exactly the `--package` grammar and matcher
+  (`package_spec_matches`, moved from the cli crate to core by A): a name
+  (full or last segment, case-insensitive) or a purl with or without a
+  version; qualifiers ignored. A bare name matches across ecosystems and
+  by last segment (`core` matches `@babel/core`), so the docs recommend
+  purls in `packages`/`ignorePackages`. Invalid spec: empty, or `pkg:`
+  without a type and name.
+- `moderate` is an alias of `medium` everywhere (file, flag, env, napi).
+- An empty allowlist (`includePaths: []`, `ecosystems: []`,
+  `packages: []`) is an error ("use `enabled: false`"), never "all".
+- Deny wins: `ignorePackages` beats `packages`, ignore paths beat
+  `includePaths`.
+
+### 4.2 Precedence against flags and env
+
+| Setting | Rule |
+|---|---|
+| List filters (paths vs PATH args; `ecosystems` vs `--ecosystems`; `packages`/`ignorePackages` vs `--package`) | **intersect**: flags narrow further, never widen |
+| `minSeverity` | `--min-severity <critical\|high\|medium\|moderate\|low\|none>` > `SOCKET_MIN_SEVERITY` > file > no floor |
+| `maxNewPatches` | `--max-new-patches <N\|none>` > `SOCKET_MAX_NEW_PATCHES` > file > unlimited |
+| whole file | `--no-socket-yml` / `SOCKET_NO_SOCKET_YML` (bool, the contract's spellings) skips the file; built-in default path ignores still apply |
+
+Scalars follow the contract's CLI > env > default order, with the file as
+the layer above the default. The person running the CLI is trusted; the
+file is the repo's default. Every new flag has an env binding. An empty env
+value is unset (repo-wide rule); a malformed flag or env value is a usage
+error (exit 2). depscan adds its own server ceiling (7.1).
+
+### 4.3 Paths
+
+- **Subject: marker files.** The backend tests `projectIgnorePaths`
+  against manifest file paths, so socket-patch does the same for every
+  path list. A project root's **markers** are the lockfile/manifest files
+  in its directory that the engine reads for it (disk: the root's
+  lockfiles per the formats registry, plus its manifest; memory:
+  `hosted_memory/roots.rs` marker files). Paths are repo-relative with `/`
+  separators, e.g. `services/api/package-lock.json`, `package-lock.json`
+  for the repo-root project.
+  - A root is **ignored** iff **every** marker is ignored.
+  - With `includePaths` set, a root is **included** iff **any** marker
+    matches `includePaths`.
+  - Admitted iff included and not ignored.
+  This makes `/package-lock.json`, `**/yarn.lock`, `examples/**` and
+  `crates/x/fixtures/**` mean what they mean to the scanner, and needs no
+  special form for the repo-root project (target only it with
+  `includePaths: ["/*", "!/*/"]`).
+- **Semantics: npm `ignore` exactly.** gitignore rules, case-insensitive,
+  anchored at the repo root: a leading or middle `/` anchors, a bare name
+  matches at any depth, a trailing `/` matches directories only, `!`
+  negates, last match wins. Evaluation walks **top-down**: for
+  `a/b/c.lock`, test `a/`, then `a/b/`, then the file; the first ignored
+  ancestor decides and a negation cannot re-include anything under it
+  (`fixtures/` + `!/a/fixtures/keep/` leaves `keep` ignored, as in the
+  backend). Do not use `ignore::gitignore`'s `matched_path_or_any_parents`
+  as-is: it walks bottom-up and would re-include. Implement the walk over
+  `Gitignore::matched(path, is_dir)`. `includePaths` uses the same walk
+  with "matched" in place of "ignored".
+- A golden fixture of (patterns, path, expected) generated from the npm
+  `ignore` package is checked into the tests; the Rust matcher must agree
+  on all of it.
+- **Pattern hygiene.** Reject (4.4) patterns that contain a `..` segment, a
+  drive letter, NUL, or exceed 1024 bytes. Backslash is gitignore's escape
+  character, not a separator (documented).
+- **Evaluation order** of the ignore lists (one combined list, last match
+  wins within a path, top-down across ancestors):
+  1. built-in defaults: `test/ tests/ fixtures/ __fixtures__/ testdata/`
+  2. `projectIgnorePaths`
+  3. `patches.ignorePaths`
+
+  Re-include a default with a negation: `ignorePaths: ["!/e2e/tests/"]`.
+  Adding an unrelated ignore never re-enables fixtures. The defaults are
+  now case-insensitive (`Test/` too), unlike H1. The backend's own
+  scanner defaults (`coverage`, `bower_components`, …) are not mirrored:
+  those are not dependency roots socket-patch would find.
+- **Defaults apply to discovered roots only.** Step 1 never applies to a
+  root the user named explicitly:
+
+  | Mode / entry point | Explicit roots | Discovered roots |
+  |---|---|---|
+  | disk hosted/vendored | `--cwd` with no PATH; a literal (non-glob) PATH | PATH-glob matches (`run_project_dirs` carries the flag per directory) |
+  | disk agent | `--cwd` (its only project; agent PATHs are package globs, not roots) | none |
+  | in-memory | roots given in `projectRoots` | roots found by detection |
+
+  Steps 2-3 and `includePaths` apply to every root.
+- **Structural excludes** (`node_modules .git .socket .yarn vendor`) stay
+  hard-coded and cannot be negated.
+- **Granularity.** A workspace member that shares the root lockfile is part
+  of the root project; exclude it with `ignorePackages`, not paths.
+- **Outside the repo.** Roots are canonicalized; a PATH that resolves
+  outside the repo root (4.5) is a usage error (exit 2). One policy per
+  invocation.
+
+### 4.4 Validation (fail closed)
+
+socket-patch validates `version`, `projectIgnorePaths` and `patches`, and
+checks top-level key names for case variants of `patches`. It does not
+validate any other key.
+
+Checks run in this order: file access, encoding, YAML, top-level shape,
+case-variant check, version gate, keys.
+
+| Situation | Behavior |
+|---|---|
+| No file; empty or comment-only file | no file: defaults |
+| Not a regular file after resolving (directory, FIFO, device), resolves outside the repo root, larger than 64 KiB (read at most 64 KiB + 1 from the opened handle; metadata from the same handle) | **error** |
+| Invalid UTF-8, UTF-16, NUL bytes (a UTF-8 BOM is stripped; CRLF is fine) | **error** |
+| YAML syntax error, duplicate key, top level not a mapping, nesting deeper than 32 | **error** |
+| An anchor, alias or merge key (`<<`) inside `patches` or `projectIgnorePaths` | **error** (bounds expansion; nobody needs them here) |
+| Top-level key equal to `patch` or `patches` ignoring case but not exactly `patches` | **error**: a misspelled block must not mean "no policy" |
+| `patches` present and `version` is not 2 (integer 2 or string `"2"`, as ajv coerces), including missing | **error** ("patches requires version: 2") |
+| `patches: null` or `patches: {}` | defaults |
+| Unknown key under `patches` | **error**, with a did-you-mean hint (edit distance <= 2) and "a newer socket-patch may support it; upgrade or remove it" |
+| Wrong type (no coercion: `"false"` is not a bool; YAML 1.2, so `no` is a string), unknown severity, `maxNewPatches` not an integer in range, empty allowlist, invalid pattern or spec, a list over 1000 entries, an entry over 1024 bytes | **error** naming the key path (`patches.minSeverity`) |
+| `projectIgnorePaths` with a `patches` block present: a string is coerced to a one-element list (as ajv does); anything else not a list of strings is an **error** | |
+| `projectIgnorePaths` with **no** `patches` block: same coercion; otherwise warning `socket_yml_ignored_value` and the key is ignored | repos that never opted in do not start failing on a scanner key |
+| No `patches` block, any `version` | `projectIgnorePaths` honored whatever the version, as the backend (P2) does |
+| Both `socket.yml` and `socket.yaml` at the root | validate both (either invalid is an error). If their `projectIgnorePaths` and `patches` are equal as parsed values (order-sensitive), use `socket.yml`; otherwise **error** `socket_yml_ambiguous`. The existing consumers disagree on which file wins, so we refuse to pick. |
+| Only a case variant exists (`Socket.yml`) | not read (the name must match a directory entry exactly, via `read_dir`, so case-insensitive disks behave like the memory tree); warning `socket_yml_name_case` |
+
+**Error behavior.** Before any write, `scan` fails with exit **1** and
+`errorCode: socket_yml_invalid` (or `socket_yml_ambiguous`). The message
+names the file, the key path and the remedy (fix the file, or
+`--no-socket-yml`). Exit 1, not 2: it is a bad input file, like an invalid
+manifest. Scan's JSON is still the legacy shape (not the unified envelope):
+the error output is scan's existing error object `{"status": "error",
+"error": "<message>"}` plus an additive `"errorCode"`; no `policy` or
+`rollout` block is emitted on error.
+
+Every string copied from the file into output (patterns, specs, key names)
+is truncated to 200 characters with control characters stripped; depscan
+additionally renders them as escaped code spans (7.3).
+
+Keys are only ever added in minor releases and never change meaning. An
+older pinned CLI fails on a newer key by design, and the error says so.
+
+### 4.5 Lookup
+
+1. Canonicalize `--cwd`. Repo root := the nearest ancestor (inclusive)
+   containing `.git` (a directory, or a file for worktrees and submodules),
+   not walking past any directory in `GIT_CEILING_DIRECTORIES`, and, on
+   Unix, only if `.git` is owned by the current user or root (git's
+   safe.directory spirit; otherwise warning `socket_yml_repo_untrusted`
+   and the walk stops). With no qualifying `.git`, repo root := `--cwd`.
+   Never the home directory unless `--cwd` is it; never above `--cwd`
+   without a `.git`.
+2. Read `<repo root>/socket.yml` and `<repo root>/socket.yaml` only.
+   Nested files are never read (one file per repo, as in the GitHub App).
+   A symlinked socket.yml is followed only if it resolves to a regular
+   file inside the repo root.
+3. In memory, the repo root is the tree root; the caller supplies the
+   file's content to path selection and to the session (7.2). A socket.yml the tree lists but the engine never
+   receives, or receives only as present-without-content (symlink,
+   oversize, LFS pointer, binary), is `socket_yml_invalid`, never absent.
+4. `--global` / `--global-prefix` scans have no repo and ignore the file.
+
+### 4.6 Commands
+
+| Command | Policy |
+|---|---|
+| `scan` (hosted, vendored, agent; wet and `--dry-run`), `hosted-bundle`, the napi engine | honor filters and limit |
+| `get` | explicit intent: ignores filters and limit; warns `policy_bypassed` when the target would have been filtered; never fails on the policy (an invalid file just skips the warning) |
+| `apply`, `list`, `vex`, `rollback`, `remove`, `repair`, `vendor` (eject/revert) | ignore it: they report, attest or undo existing state |
+
+**Narrowing never removes.** The policy runs after the prune universe is
+captured (`mod.rs:1480`), so `--prune` still judges the full crawl. A
+package that already has a recorded patch but is now excluded by paths,
+ecosystems, packages or `enabled: false` is **retained**: not passed to the
+hosted rewriters, vendor engine or agent apply; not upgraded; not taken
+over; left byte-identical. It is reported under `policy.retained[]` with
+`upgradeAvailable`. Removing a patch is only ever `rollback`/`remove`, or
+the dependency leaving the lockfile.
+
+**Severity floor.** One data source: the by-package records the selector
+already fetches (`fetch_patch_details` on disk, the provider's by-package
+lookup in memory), severity = `max_severity_order` over the patch's
+`vulnerabilities`, never `RankKey.severity` (forced to 0 for merged
+patches) and never the batch list. The floor restricts which candidates
+may **win** per-package ranking; a lower-ranked patch above the floor can
+still win. With a floor set, unknown severity is filtered (fail closed;
+note `minSeverity: low` therefore drops unknown-severity patches, which the
+recipes say). Supersession of a recorded patch is judged against the
+**unfiltered** offer list (5.1): the floor never turns a recorded patch
+into "no longer offered". A recorded package with no candidate above the
+floor keeps its recorded patch (ALREADY).
+
+`enabled: false`: discovery and the table still run; nothing is written;
+every candidate is reported filtered with `policy_disabled`; warning
+`patches_disabled`; exit 0. Upgrades are frozen too.
+
+### 4.7 JSON (`policy` block, owned by A)
+
+Additive top-level key on every successful `scan --json` result (MINOR),
+always present. Policy warnings go to scan's top-level `warnings[]`.
+
+```json
+"policy": {
+  "source": "file",
+  "path": "socket.yml",
+  "sha256": "…",
+  "enabled": true,
+  "minSeverity": {"value": "high", "source": "file"},
+  "counts": {"filtered": 3, "retained": 1},
+  "filtered": [
+    {"purl": "pkg:npm/qs@6.5.2", "uuid": null, "project": "services/legacy",
+     "reason": "policy_path_excluded", "detail": "/legacy/ (patches.ignorePaths)"}
+  ],
+  "retained": [
+    {"purl": "pkg:npm/lodash@4.17.20", "project": "", "recordedUuid": "…",
+     "reason": "policy_package_ignored", "upgradeAvailable": true}
+  ]
+}
+```
+
+| `source` | When | `path` / `sha256` |
+|---|---|---|
+| `none` | no file, empty file, file ignored (`--global`), or only a case variant | null |
+| `file` | a root file was read (with or without a `patches` block) | the file used (`socket.yml` when both are equal) / its bytes' hash |
+| `bypassed` | `--no-socket-yml` / `SOCKET_NO_SOCKET_YML` | null |
+
+- `project` is the repo-relative root directory; the repo root is `""`
+  (the memory engine's spelling) everywhere.
+- `minSeverity.source` is `flag|env|file|default`; `value` null = no floor.
+- `uuid` is null when the package was filtered before any patch lookup
+  (path, ecosystem, package reasons). A root filtered as a whole is one
+  entry with `purl: null`.
+- `counts.filtered` counts entries of `filtered[]`; `counts.retained`
+  counts entries of `retained[]`.
+- Reason codes (stable): `policy_disabled`, `policy_path_excluded`,
+  `policy_path_not_included`, `policy_ecosystem`,
+  `policy_package_not_listed`, `policy_package_ignored`, `policy_severity`
+  (detail `unknown < high` or `medium < high`).
+- Human output: one line, e.g. `Policy (socket.yml): 3 skipped by filters,
+  1 patched package held.` Filtered critical/high candidates are always
+  named on the human path (a policy must not silently hide them);
+  `--verbose` lists everything.
+
+## 5. Per-run limit (work item B)
+
+### 5.1 Classification
+
+**Recorded view.** Always the merged view, in every mode and both engines:
+`merge_ledger_records_for_updates` (manifest > hosted lockfile pins >
+vendor ledger), scoped to the lockfiles and state files of the project
+root being written. The in-memory engine reads the same three stores from
+the tree (`.socket/manifest.json`, `.socket/vendor/state.json`, hosted
+pins discovered from the in-memory lockfiles; new, B). When the lockfiles
+of one root pin a purl to different uuids, the recorded uuid is the
+selected uuid if it is among them, else the smallest (today's rule).
+
+**Supersession** uses the by-package records (the same data as selection
+and the severity floor), with the `batch_supersedes` rungs applied to
+them: merged over unmerged, higher severity between unmerged, a real,
+strictly later publish date. It is judged against the **unfiltered** offer
+list. B adds the by-package twin of `batch_supersedes` in `ranking.rs`;
+`detect_updates` and scan's `updates[]` switch to it so classification,
+selection and reporting can never disagree.
+
+After filtering and per-package selection, each selected `(project root,
+purl)` row is:
+
+| Class | Rule | Counts toward the cap | Writer receives |
+|---|---|---|---|
+| ALREADY | recorded uuid == selected uuid, or the selection does not supersede the recorded uuid | no | the **recorded** uuid (re-confirmed idempotently) |
+| UPGRADE | the selection supersedes the recorded uuid, or the recorded uuid is no longer offered at all (unfiltered) | no | the selected uuid |
+| NEW | nothing recorded for this base purl in this project root | **yes** | the selected uuid, if admitted |
+| ALREADY (kept) | recorded, offers exist in `Offers.unfiltered` but none survive the floor | no | the recorded uuid (counted in `counts.already`) |
+
+- NEW is per project root. Widening `includePaths` makes piloted packages
+  NEW in the added roots, so they go through the cap again.
+- UPGRADEs are exempt (decision): rollout risk is about whether a package
+  runs patched code at all, and an upgrade fixes more in an already-patched
+  package. `enabled: false` freezes everything; `maxNewPatches: 0` freezes
+  new packages only.
+- **Known limit: version bumps.** When a dependency moves to a new version
+  its hosted pin goes with the old lockfile entry, so the new version is
+  NEW and goes through the cap. (Hosted state cannot tell a bump from a new
+  package.) Documented.
+- **Qualifier twins** (wheel/sdist, gem platforms) share a base purl. If
+  one twin lands and another was ineligible, the next run sees the base
+  purl as recorded and the late twin lands as ALREADY/UPGRADE, uncapped.
+  Documented; it is one package.
+
+### 5.2 Eligibility, budget and ordering
+
+- **Eligibility is decided by the planning pass**, the same pass
+  `--dry-run` runs, before any budget is spent. A NEW row is eligible only
+  if every check that can be decided without writing passes:
+  - tier filter;
+  - agent partition (vendored / not installed);
+  - vendored preflight;
+  - hosted reference grant `granted`, with a usable purl and url;
+  - vlt artifact preflight;
+  - symlink refusals;
+  - rewriter planning shows at least one lockfile edit that would pin it
+    (no refusal, entry found).
+
+  Ineligible rows keep their existing skip reasons and never hold a slot,
+  so a patch that cannot land can never stall the rollout.
+- **One fetch strategy.** References are requested for every eligible-so-far
+  candidate (NEW, UPGRADE and ALREADY) in the run's normal batches, before
+  budgeting; never lazily in rank order. A reference or lookup failure that
+  affects only rows that end up deferred never fails the run or the root;
+  it becomes warning `rollout_reference_failed`.
+- **Incomplete data.** With a finite cap, if any batch, detail or reference
+  lookup failed for a package that could have been NEW, no NEW row is
+  admitted this run (all NEW rows deferred) and warning
+  `rollout_incomplete_lookup` is emitted. Otherwise a failure would let
+  lower-ranked patches take the missing ones' slots. ALREADY and UPGRADE
+  rows proceed as today.
+- **Unit:** a distinct **base purl** (ecosystem + name + version,
+  qualifiers stripped, via one shared core function `canonical_base_purl`)
+  among eligible NEW rows. Admitting a base purl admits all of its eligible
+  NEW rows in every root of the invocation; it costs 1 slot.
+- **Scope of the budget:**
+  - in-memory engine: one budget across all roots (collect, plan, apply);
+  - disk: one budget per invocation. `run_project_dirs` visits
+    directories in sorted order and passes the **remaining** budget to
+    each, together with the set of base purls already admitted (a base
+    purl admitted in an earlier directory is admitted free in later ones);
+    each directory spends the budget in rank order. `scan --json` accepts one
+    directory, so a CI job per directory gets N per directory. Documented.
+- **Order** (ascending; total; no time-dependent keys):
+  1. in-flight first (in-memory option `inFlightPatches` only, matched by
+     base purl; absent on the CLI)
+  2. severity of the selected patch (`max_severity_order`: critical, high,
+     medium, low, unknown)
+  3. advisory count, descending (merged patches first within a severity)
+  4. ecosystem `cli_name`, ascending
+  5. canonical base purl, ascending bytewise
+  6. smallest selected uuid across the base purl's rows, ascending
+
+  A base purl in several roots uses the minimum key over its rows.
+  `publishedAt` is not a key: it would reorder the queue whenever a date is
+  missing. Per-package ranking (which patch a package gets) still uses
+  `publishedAt` as today; this order only decides which packages go first.
+- **Write failures** after admission (I/O at commit time) consume budget
+  and are reported as failures. No backfill within a run, so `--dry-run`
+  predicts the wet run exactly.
+- **`maxNewPatches: 0`** admits no NEW rows; ALREADY and UPGRADE proceed.
+- Everything eligible and NEW beyond the budget is **deferred**: not
+  written, not downloaded, not vendored, reported with its rank.
+
+### 5.3 Convergence and determinism
+
+- Same inputs, same plan, same bytes. The limit is stateless: run k lands
+  the top N; on run k+1 they are ALREADY and the next N land. M waiting
+  patches take **at most** ceil(M/N) committed runs, absent new or
+  ineligible patches.
+- A newly published or re-scored higher-severity patch moves ahead of the
+  queue. That is intended ("most critical first") and visible, because
+  every deferred entry carries its rank and severity.
+- Low-severity patches can wait indefinitely while higher ones keep
+  arriving. Documented; it is the point of severity ordering.
+- **CI that does not commit** the scan's result never advances recorded
+  state, so a cap there means "only the top N, every run". The recipes
+  say: commit the lockfile changes (or use a PR bot), or set no cap in
+  non-committing jobs.
+- `pending_build` references are transient: a row can be ineligible one
+  run and eligible the next. The plan is still a function of the inputs.
+- `--dry-run` fetches reference grants like a wet run (it must, to decide
+  eligibility), so it has the same server-side effects a dry run has
+  today.
+
+### 5.4 Modes
+
+| Mode | ALREADY / UPGRADE surface | Deferred rows |
+|---|---|---|
+| hosted (disk) | re-confirmed / rewritten, as today | never rewritten; mirrored into `redirect.skipped[]` with reason `rollout_deferred` |
+| vendored | `already_vendored` / `would_revendor` | never downloaded or vendored |
+| agent | `skipped` / `updated` | never downloaded; not in `apply.patches[]` |
+| in-memory (napi, hosted-bundle) | as hosted | in `ProjectResult.deferred[]` and `skipped[]` with `rollout_deferred` |
+
+Recorded state is the merged view (5.1) in every row. A takeover of an
+existing vendored or hosted entry counts as recorded, not NEW. `--dry-run`
+makes exactly the same decisions.
+
+### 5.5 JSON (`rollout` block, owned by B)
+
+Additive top-level key on every successful `scan --json` result (MINOR),
+always present:
+
+```json
+"rollout": {
+  "maxNewPatches": {"value": 5, "source": "file"},
+  "counts": {"new": 5, "deferred": 9, "upgrade": 1, "already": 12},
+  "deferred": [
+    {"purl": "pkg:npm/minimist@1.2.5", "uuids": ["…"], "severity": "critical",
+     "advisoryCount": 1, "projects": ["services/api", "services/web"], "rank": 6}
+  ]
+}
+```
+
+- `maxNewPatches.value` null = unlimited; `source` is
+  `flag|env|file|default|cap`.
+- `counts.new` and `counts.deferred` count base purls (admitted this run,
+  or would be under `--dry-run`; deferred). `counts.upgrade` and
+  `counts.already` count `(project, purl)` rows.
+- `deferred[]` is in rank order; `purl` is the base purl; `uuids` lists
+  the distinct selected uuids across its rows and qualifier twins; `rank`
+  is 1-based among **eligible** NEW base purls. Ineligible rows are not
+  ranked; they appear under their existing skip reasons.
+- Human output (after the mode's summary, then the Next-steps renderer):
+
+  ```
+  Rollout: 5 of 14 new patches applied (maxNewPatches=5 from socket.yml); 1 upgrade, 12 already applied.
+  Next steps:
+    9 new patches deferred; commit these changes and run scan again to apply the next 5.
+    Next up: minimist@1.2.5 (critical), qs@6.5.2 (high), …
+  ```
+- Exit code unchanged (0) when patches are deferred or filtered.
+- `jq` recipe for CI: `jq '.rollout.counts.deferred'`.
+
+## 6. Rollout recipes
+
+```yaml
+# R1 Canary: one new patch per run
+version: 2
+patches:
+  maxNewPatches: 1
+```
+
+```yaml
+# R2 Critical first: widen by editing one line
+version: 2
+patches:
+  minSeverity: critical   # later: high, then low, then remove the key
+  maxNewPatches: 5        # (low still skips patches whose severity is unknown)
+```
+
+```yaml
+# R3 One directory first (monorepo)
+version: 2
+patches:
+  includePaths:
+    - "/services/payments/"
+    # add "/services/checkout/" next sprint
+  maxNewPatches: 5
+```
+
+```yaml
+# R4 One ecosystem, hold one package
+version: 2
+patches:
+  ecosystems: [npm]
+  ignorePackages: ["pkg:npm/left-pad"]
+```
+
+```yaml
+# R5 Weekly drip with the depscan autopatch PR
+version: 2
+patches:
+  maxNewPatches: 5        # the PR keeps the same 5 until merged, then the next 5
+```
+
+```yaml
+# R6 Pause
+version: 2
+patches:
+  enabled: false          # report only; existing patches stay in place
+# or keep upgrades flowing but add nothing new:
+#   maxNewPatches: 0
+```
+
+A cap only advances when the scan's changes are committed (or merged by a
+PR bot). In a CI job that scans without committing, set no cap.
+
+One-off overrides from the command line: `socket-patch scan
+--max-new-patches none` (drain the queue this run), `--min-severity none`,
+`--no-socket-yml` (ignore the file entirely).
+
+## 7. depscan autopatch service
+
+### 7.1 Behavior with the new engine
+
+- `repo` jobs rebuild one commit from the base SHA each run. With
+  `maxNewPatches: 5`, "recorded" means recorded on the **base** branch, so
+  every rebuild proposes the same top 5 until the PR merges, then the next
+  5. `inFlightPatches` (the base purls already in the open PR) keeps a
+  reviewed patch from being displaced by a newly published one mid-review.
+- **Policy source.** Both job kinds read socket.yml from the **base** SHA:
+  the reviewed, merged policy. A pull request cannot loosen the policy
+  that judges its own check (for example by adding `ignorePackages` for
+  the vulnerable dependency it introduces). If the PR head changes
+  `patches` or `projectIgnorePaths`, the check run says so and lists what
+  the head's policy would additionally filter.
+- `pull_request` jobs honor the filters and pass `maxNewPatches: "none"`
+  and **no** `maxNewPatchesCap`: deferring there would leave the check
+  permanently showing work.
+- Effective limit for `repo` jobs = min(repo value, `maxNewPatchesCap`).
+  The server can tighten, never loosen; the cap applies to every value
+  including `"none"`. Org-level kill switches, entitlement and safety
+  (D1-D6) always win.
+
+### 7.2 Engine API changes (napi `HostedScanOptions` / result, and the `hosted-bundle` harness)
+
+| Owner | Change |
+|---|---|
+| A | Two-phase selection so the memory engine applies the same path policy as disk. `selectHostedScanPaths` gains an option `policyFiles?: Array<{path: string, text: string} \| {path: string, missing: true}>`, one entry per root `socket.yml` / `socket.yaml` the listing contains (the both-files rule of 4.4 applies): the caller fetches those root blobs first (they are root files, known from the tree listing) and passes the content. The selector parses it with the same loader and applies the **full** path policy (defaults, `projectIgnorePaths`, `patches` lists, negations) when choosing which files to fetch, so an `ignorePaths` negation re-includes a default-ignored tree in memory exactly as on disk. If the listing has a root policy file with no matching entry, or an entry is `missing: true`, or the text is invalid, the selector returns `policyError` (never "no policy"). The session re-parses the same text and fails `socket_yml_invalid` if the policy content that arrives differs (sha256) from what the selector saw |
+| A | the session applies the full policy to detected roots **before** the `max_projects` check (`hosted_memory/mod.rs:377`) |
+| A | options `noSocketYml?: boolean`, `minSeverity?: "critical"\|"high"\|"medium"\|"moderate"\|"low"\|"none"` |
+| A | result: session-level `policy` block (4.7) and `policyError?: {code, detail}`; on error no root is processed and no files change; `skipped[].reason` gains the `policy_*` codes |
+| B | options `maxNewPatches?: number \| "none"`, `maxNewPatchesCap?: number`, `inFlightPatches?: string[]` (base purls) |
+| B | result: session-level `rollout` block (5.5); `ProjectResult.deferred[]`; `skipped[]` rows with `rollout_deferred` |
+| B | hosted-pin discovery over the in-memory lockfiles and reading `.socket/manifest.json` / `.socket/vendor/state.json` from the tree, for the merged recorded view. A finite cap must never ship in the engine without it: every merged pin would look NEW and the rollout would stall at N. |
+| B | restructure the per-root loop around `hosted_memory/mod.rs:537` into collect all roots → plan once → apply, so the budget is run-wide |
+
+`hosted-bundle` rejects unknown fields, so each owner adds its fields there
+too.
+
+### 7.3 depscan follow-up (after A and B merge; separate PR in depscan)
+
+1. Bump the socket-patch submodule and rebuild the addon.
+2. Fetch the root socket.yml / socket.yaml blob from the **base** SHA
+   for both job kinds **before** calling `selectHostedScanPaths`, and
+   pass them as `policyFiles` (7.2); stream the same content to the session.
+   Never let the file be dropped by the size/path caps silently: a
+   missing or oversize policy blob is passed as `missing: true`, which the
+   engine turns into `policyError`.
+3. Pass `inFlightPatches` (base purls in the open patch-all PR); for
+   `pull_request` jobs pass `maxNewPatches: "none"` and no cap.
+4. New job outcome `policy_invalid` (from `policyError`): leave the
+   existing PR untouched, surface the error on the admin page and in the
+   check-run text.
+5. PR body and check run: a "Deferred (next batch)" table with severity
+   and rank; `policy.filtered`/`retained` counts, naming every critical or
+   high candidate the policy suppressed; a note when the PR head changes
+   the policy. Render every file-derived string as an escaped code span,
+   truncated.
+6. Stats: `patchesDeferred`, `patchesFiltered`.
+7. Optional server cap per org (future setting) passed as
+   `maxNewPatchesCap`; keep passing the admin `config.ecosystems` (D3) as
+   `ecosystems`, which intersects with the file.
+8. Do **not** add `patches` with strict types to the ajv schema in
+   `socket-yaml-schema.ts`: a typo there rejects the whole file and turns
+   PR checks neutral. If wanted for docs, add a permissive `{type: object}`.
+9. Docs repo: a `patches` section on the socket.yml page; fix the two
+   stale statements found in research (which file wins when both exist;
+   v1 files are rejected by the GitHub App).
+
+A closed or rejected rolling PR re-proposes the same patches next run;
+`ignorePackages` is the documented way to decline one.
+
+## 8. Decisions log
+
+| # | Decision | Why |
+|---|---|---|
+| 1 | Top-level `patches:` in socket.yml v2; no `version: 3` | breaks no parser (P1/P2 strip, P3 ignores); P3 rejects any version but 2 |
+| 2 | socket-patch reads socket.yml (reverses configuration.md) | owner request; policy that only narrows fits the trust boundary |
+| 3 | Keys `enabled includePaths ignorePaths ecosystems packages ignorePackages minSeverity maxNewPatches` | include/ignore pairs mirror existing keys; `packages` covers single-package pilots; `maxNewPatches` says it counts new patches only |
+| 4 | Paths match marker **files**, npm-`ignore` semantics, top-down, case-insensitive; golden parity fixture | identical meaning to `projectIgnorePaths` in the backend; no root special form |
+| 5 | socket-patch also honors `projectIgnorePaths` (leniently when there is no `patches` block) | users expect one ignore list; repos that never opted in do not start failing |
+| 6 | Defaults `test/ tests/ fixtures/ __fixtures__/ testdata/` first, overridden by `!`; discovered roots only | moves H1; replace-on-set would re-enable fixtures on any unrelated edit |
+| 7 | Strict validation of `patches`, fail closed, exit 1 `socket_yml_invalid` | a broken narrowing rule must not widen the rollout |
+| 8 | Both files: error only if the parts we read differ | consumers disagree on precedence; repos that have both keep working |
+| 9 | Repo root = nearest trusted `.git` ancestor (ceiling dirs honored), else `--cwd`; root files only; PATHs outside it are exit 2 | matches the GitHub App; memory can mirror it; never reads outside the checkout |
+| 10 | Flags intersect lists; scalars CLI > env > file > default; `--no-socket-yml` with env | contract precedence and "every flag has an env var" |
+| 11 | `maxNewPatches: 0` = upgrades only; absent / `none` = unlimited | literal meaning; avoids the Dependabot/Renovate 0 disagreement |
+| 12 | Unknown severity is filtered when a floor is set | fail closed |
+| 13 | One data source (by-package records) for floor, supersession, classification and order | selection, classification and reporting can never disagree |
+| 14 | NEW per (project root, base purl); budget per base purl; memory run-wide, disk per invocation carried across directories | a widened pilot re-enters the cap; one package in many roots costs 1 |
+| 15 | Upgrades exempt from the cap | rollout risk is per package; keeps patched packages current |
+| 16 | Order: severity, advisory count, ecosystem, base purl, uuid; no `publishedAt` | total and time-independent |
+| 17 | Eligibility = everything the planning pass can decide; fetch-all references; incomplete lookups admit no NEW rows | a broken patch never holds a slot; failures never reshuffle the queue |
+| 18 | Filtered packages with recorded patches are retained, never removed or upgraded | narrowing freezes, never removes |
+| 19 | `get` bypasses the policy with a warning | explicit intent |
+| 20 | Separate `policy` (A) and `rollout` (B) JSON blocks | clean ownership seam; both additive |
+| 21 | depscan reads the policy from the base SHA for PR jobs too | a PR cannot loosen the policy judging it |
+| 22 | Everything ships in 5.0 | honoring `projectIgnorePaths`, disk default ignores and fail-closed file errors change scan's default behavior (MAJOR) |
+
+## 9. Work items
+
+Both items branch from `release/v5-prerelease` (suggested branches
+`v5/rollout-policy` for A, `v5/rollout-limit` for B). **Merge order: A,
+then B.** B rebases onto A and owns the final integration (9.3). The
+seams are small and listed in 9.0: the step 5 → step 7 `Offers` struct
+(A), the repo-relative path helpers (A), the file's `maxNewPatches` value
+(A → B), and the pipeline order.
+
+### 9.0 Shared contract (frozen by this plan)
+
+Scan pipeline, in order (disk and memory):
+
+1. load policy (A); fail closed before any write
+2. crawl; capture the prune universe (unchanged)
+3. root filter, ecosystem/package filter, retained set (A)
+4. batch API, by-package details (unchanged fetches)
+5. candidate severity filter on by-package records (A); `discover_selected`
+   returns `Offers` (below) so B sees both the unfiltered and the
+   floor-filtered candidates
+6. per-package ranking (unchanged `ranking`)
+7. classify, planning pass for eligibility, budget, deferral (B)
+8. writers (receive only admitted NEW rows, ALREADY rows with the recorded
+   uuid, and UPGRADE rows)
+
+```rust
+// crates/socket-patch-core/src/policy/mod.rs — OWNER A
+pub struct SelectionPolicy { /* private fields */ }
+pub enum PolicySource { None, File { path: String, sha256: String }, Bypassed }
+pub enum FilterReason {
+    Disabled, PathExcluded { pattern: String, list: &'static str }, PathNotIncluded,
+    Ecosystem, PackageNotListed, PackageIgnored { spec: String },
+    Severity { found: Option<String>, floor: String },
+}
+impl FilterReason { pub fn code(&self) -> &'static str; pub fn detail(&self) -> String; }
+pub enum PolicyError {
+    Invalid { file: String, key: String, message: String },
+    Ambiguous { files: [String; 2] },
+}
+impl PolicyError { pub fn code(&self) -> &'static str; } // socket_yml_invalid | socket_yml_ambiguous
+pub enum RootFile { Absent, Present(Vec<u8>), PresentWithoutContent }
+pub trait PolicyFs { fn read_root_file(&self, name: &str, cap: usize) -> std::io::Result<RootFile>; }
+pub enum OverrideSource { Flag, Env }
+pub struct PolicyOverrides { pub bypass: bool, pub min_severity: Option<(Option<u8>, OverrideSource)> } // (None, _) = "none"
+pub struct PolicyWarning { pub code: &'static str, pub detail: String }
+pub struct Root<'a> { pub rel_dir: &'a str, pub markers: &'a [String], pub explicit: bool }
+impl SelectionPolicy {
+    pub fn unrestricted() -> Self;                          // built-in default ignores only
+    pub fn load(fs: &dyn PolicyFs, o: &PolicyOverrides) -> Result<(Self, Vec<PolicyWarning>), PolicyError>;
+    pub fn source(&self) -> &PolicySource;
+    pub fn enabled(&self) -> bool;
+    pub fn admits_root(&self, root: &Root) -> Result<(), FilterReason>;
+    pub fn admits_purl(&self, purl: &str) -> Result<(), FilterReason>;        // ecosystem + packages
+    pub fn admits_severity(&self, severity_order: u8) -> Result<(), FilterReason>;
+    pub fn max_new_patches(&self) -> Option<u32>;  // the file's value; None when source() is None or Bypassed, or the key is absent
+}
+pub fn package_spec_matches(spec: &str, purl: &str) -> bool; // moved from cli scan/mod.rs:383
+pub fn find_repo_root(cwd: &Path) -> PathBuf;                // 4.5
+pub fn repo_relative(repo_root: &Path, dir: &Path) -> String; // "" for the repo root, `/` separators
+
+// crates/socket-patch-core/src/policy/mod.rs — OWNER A (the step 5 → 7 seam)
+pub struct Offers {
+    pub unfiltered: BTreeMap<String, Vec<PatchSearchResult>>, // purl → every offer (after tier)
+    pub selected: BTreeMap<String, PatchSearchResult>,        // purl → winner among floor-admitted offers
+}
+
+// crates/socket-patch-core/src/rollout.rs — OWNER B
+pub enum Recorded { None, Same, Kept { uuid: String }, Superseded { old_uuid: String } }
+pub struct Candidate {
+    pub project: String, pub purl: String, pub base_purl: String, pub uuid: String,
+    pub ecosystem: &'static str, pub severity_order: u8, pub advisory_count: usize,
+    pub recorded: Recorded, pub eligible: bool, pub in_flight: bool,
+}
+pub enum MaxNewSource { Flag, Env, File, Default, Cap }
+pub struct MaxNew { pub value: Option<u32>, pub source: MaxNewSource }
+pub fn resolve_max_new(flag: Option<Option<u32>>, env: Option<Option<u32>>,
+                       file: Option<u32>, cap: Option<u32>) -> MaxNew;
+pub fn canonical_base_purl(purl: &str) -> String;
+pub fn rollout_cmp(a: &Candidate, b: &Candidate) -> std::cmp::Ordering;
+pub struct RolloutCounts { pub new: u32, pub deferred: u32, pub upgrade: u32, pub already: u32 }
+pub struct RolloutPlan {
+    pub admitted: Vec<Candidate>, pub deferred: Vec<(Candidate, u32)>,
+    pub counts: RolloutCounts,
+    pub remaining: Option<u32>,                       // carried to the next directory
+    pub admitted_base_purls: BTreeSet<String>,        // carried too
+}
+// Rows whose base_purl is in `already_admitted` are admitted without spending budget.
+pub fn plan_rollout(candidates: Vec<Candidate>, max_new: &MaxNew, incomplete: bool,
+                    already_admitted: &BTreeSet<String>) -> RolloutPlan; // pure
+
+// crates/socket-patch-core/src/api/ranking.rs — OWNER B (addition)
+pub fn search_result_supersedes(candidate: &PatchSearchResult, recorded: &PatchSearchResult) -> bool;
+```
+
+Rules both items follow:
+- Severity input is always `max_severity_order` over the by-package
+  record's `vulnerabilities`, never `RankKey.severity`, never the batch
+  list.
+- Skip-reason strings are the stable codes in 4.7 and 5.5; warnings go to
+  scan's top-level `warnings[]`.
+- JSON: A owns the top-level `policy` block; B owns the top-level
+  `rollout` block. Neither edits the other's.
+- CLI args: A adds a `#[command(flatten)]` `SocketYmlArgs`
+  (`--no-socket-yml`, `--min-severity`) in `scan/socket_yml_args.rs`; B
+  adds a flattened `RolloutArgs` (`--max-new-patches`) in
+  `scan/rollout_args.rs`. Both derive `Default`; each adds its field to
+  the ~18 `ScanArgs` struct literals. B resolves the adjacent-line
+  conflicts on rebase.
+- `run_project_dirs` changes: A adds the per-directory `explicit` flag;
+  B adds the carried remaining budget. B resolves the overlap on rebase.
+
+### 9.1 Work item A — socket.yml loading and filtering
+
+Scope:
+- `crates/socket-patch-core/src/policy/{mod.rs, socket_yml.rs, paths.rs}`;
+  `pub mod policy;` in `crates/socket-patch-core/src/lib.rs`; move
+  `package_spec_matches` to core (the cli re-uses it).
+- Dependencies, exact-pinned in `Cargo.toml`: a maintained YAML 1.2 serde
+  crate that reports duplicate keys and can refuse aliases and bound depth
+  (e.g. `serde_norway`; prove each property with a test, pick another
+  crate otherwise), and `ignore` (for `Gitignore::matched`; the top-down
+  walk is ours). No other new deps.
+- Loader: lookup (4.5, incl. ceiling dirs and ownership), regular-file,
+  size and symlink confinement on the opened handle, exact-name match,
+  encoding, both-files rule, strict validation with key paths and
+  did-you-mean (4.4), `PolicyFs` for disk and memory.
+- Path matcher (4.3): marker-file subject, npm-`ignore` top-down
+  semantics, defaults + lists in order, `includePaths`, pattern hygiene;
+  golden fixture generated from npm `ignore` (commit the generator script
+  under `scripts/` and the fixture under `crates/socket-patch-core/tests/`).
+- Filters at the pipeline points in 9.0:
+  - disk: root filter in `project_dirs` / `run_project_dirs`
+    (`scan/mod.rs:1268-1320`, carrying `explicit`) and the agent project;
+    `admits_purl` next to `--package` (`scan/mod.rs:1490-1511`); severity
+    filter on by-package candidates before `select_patches`
+    (`discover_selected`, `scan/mod.rs:553`, and the human arm,
+    `mod.rs:2386-2402`); retained set computed from the recorded view and
+    excluded from writers.
+  - memory: full path policy in `selectHostedScanPaths`
+    (`hosted_memory/select.rs`), from the caller-supplied `policyFiles`
+    text (7.2, two-phase); the same root filter in the session before
+    `max_projects` (`hosted_memory/mod.rs:377`); `admits_purl` at
+    `hosted_memory/mod.rs:428-432`; severity filter before
+    `select_top_ranked`.
+- Move `test tests fixtures __fixtures__ testdata` out of
+  `EXCLUDED_ROOT_SEGMENTS` (`hosted_memory/roots.rs:56-67`) into the
+  built-in default ignores, and apply them to disk PATH-glob expansion.
+- `enabled: false` report-only path; `get`'s `policy_bypassed` warning;
+  `--global` ignores the file; PATHs outside the repo root → exit 2.
+- Flags: `--no-socket-yml`/`SOCKET_NO_SOCKET_YML`,
+  `--min-severity`/`SOCKET_MIN_SEVERITY` (`SocketYmlArgs`).
+- napi + hosted-bundle (7.2, A rows); `npm/index.d.ts` types.
+- JSON `policy` block (4.7), human policy line (naming suppressed
+  critical/high), error output with `errorCode`, warnings
+  `socket_yml_ignored_value`, `socket_yml_name_case`,
+  `socket_yml_repo_untrusted`, `patches_disabled`, `policy_bypassed`;
+  output string hygiene.
+
+Tests:
+- Unit (core, table-driven): every row of 4.4 in order; the npm-`ignore`
+  golden fixture (anchoring, bare names, trailing `/`, `!`, excluded
+  parents, case); marker rule (all markers ignored / any included);
+  defaults + negation; explicit vs discovered; package specs incl.
+  invalid ones; severity floor incl. unknown and `moderate`; both-files
+  equal / different / one invalid; lookup with `.git` dir, `.git` file,
+  none, `GIT_CEILING_DIRECTORIES`, foreign-owned `.git`; symlink inside
+  and outside, directory, FIFO; alias bomb; oversize; BOM, CRLF, UTF-16.
+- Parser contract: `tests/cli_parse_scan.rs` rows for both flags and env
+  vars (empty = unset, malformed = exit 2).
+- E2E (wiremock, `tests/in_process_scan.rs` style): hosted, vendored,
+  agent and `--dry-run` with a socket.yml filtering by path, ecosystem,
+  package and severity; invalid file → exit 1, `errorCode`, no bytes
+  changed; `--no-socket-yml`; narrowing after a patch is applied leaves the
+  pinned package byte-identical in all three modes (retained); a recorded
+  merged patch below a new floor is kept, not replaced; `--prune` universe
+  unchanged; PATH outside the repo → exit 2.
+- Parity: `tests/hosted_memory_parity.rs` gains a socket.yml fixture
+  (single-lockfile roots) where disk and memory filter the same roots and
+  packages; a memory test where the tree lists socket.yml but its content
+  is withheld → `policyError`; a memory test where
+  `ignorePaths: ["!/e2e/tests/"]` re-includes a default-ignored root, so
+  its lockfile is selected, fetched and patched as on disk.
+- This repo's own `socket.yml` keeps working (its `projectIgnorePaths`
+  now also excludes the fixtures from patching).
+
+Docs (A): `CLI_CONTRACT.md` (new "socket.yml patch policy" section:
+grammar, precedence, paths, lookup, validation, commands; flag + env rows;
+error codes; `policy` JSON block; the trust-boundary bullet gains the
+"narrow or pace" sentence), README (scan section: "Roll out gradually"
+with recipes R1-R4, R6), CHANGELOG `[Unreleased]` (Added: socket.yml
+patch policy; Changed (BREAKING): scan honors `projectIgnorePaths`,
+default test/fixture ignores on discovered roots, invalid socket.yml with
+a `patches` block fails scan).
+
+### 9.2 Work item B — limit, ordering, reporting
+
+Scope:
+- `crates/socket-patch-core/src/rollout.rs`; `pub mod rollout;` in
+  `crates/socket-patch-core/src/lib.rs`; `search_result_supersedes` in
+  `ranking.rs`, and `detect_updates` / `updates[]` switched to by-package
+  supersession; move the `detect_updates` call (today `scan/mod.rs:1912`,
+  on batch data) after `discover_selected` so it receives the by-package
+  offers.
+- Make `discover_selected` (`scan/mod.rs:553`) the single disk selection
+  point: route the human agent/vendored arm (`mod.rs:2386-2402`) through
+  it, and add the step-7 stage after it (classify its `Offers`, planning
+  pass, `plan_rollout`) yielding `{admitted, deferred}`, so hosted
+  (`run_redirect_selected`, `hosted.rs:1196`), vendored and agent writers
+  receive only the rows 9.0 step 8 allows (ALREADY with the recorded
+  uuid). `discover_selected`'s return type is A's `Offers`.
+- Classification from the merged recorded view (5.1); the planning pass
+  for eligibility (hosted: grants, purl/url, vlt preflight, symlink
+  refusals, rewriter planning; vendored: preflight; agent: partition);
+  fetch-all references; `rollout_reference_failed` and
+  `rollout_incomplete_lookup`; `plan_rollout`; the remaining budget
+  carried through `run_project_dirs` in sorted directory order.
+- In-memory engine (7.2, B rows): pin discovery and state-file reads,
+  collect → plan → apply, options and result fields, `npm/index.d.ts`,
+  hosted-bundle fields.
+- Flag: `--max-new-patches <N|none>`/`SOCKET_MAX_NEW_PATCHES`
+  (`RolloutArgs`); `resolve_max_new` including the file value from A
+  (9.3).
+- JSON `rollout` block (5.5), `redirect.skipped[]` mirror, human
+  "Rollout:" line and the Next-steps deferred line (hosted
+  `format_next_steps`, `hosted.rs:3457`, and the agent/vendored
+  summaries).
+
+Tests:
+- Unit (core): `rollout_cmp` total order (property test: every
+  permutation sorts the same); `plan_rollout` caps only eligible NEW,
+  counts base purls, one package across roots costs 1, 0 = no NEW, `none`
+  = unlimited, ineligible rows hold no slot, `incomplete` admits nothing
+  NEW, in-flight first, remaining budget; `resolve_max_new` precedence
+  table incl. cap on `none`; `canonical_base_purl` twins;
+  `search_result_supersedes` rungs.
+- E2E (wiremock): hosted, vendored, agent, `--dry-run`: 9 candidates with
+  `--max-new-patches 3` apply the 3 most severe; a rerun on the result
+  applies the next 3; a third run the last 3; a fourth changes nothing;
+  dry-run output equals the wet run's decisions; upgrades land regardless
+  of the cap; a withdrawn, a `bad_purl` and a vlt-withheld top-ranked
+  patch hold no slot; a failed detail lookup with a cap admits nothing
+  NEW; two PATH directories share one budget in sorted order; JSON
+  `rollout` and `redirect.skipped[]`; exit 0.
+- Parity: `hosted_memory_parity.rs` single-root cap fixture: disk and
+  memory admit and defer the same rows. Two-root fixture: assert memory's
+  run-wide order and disk's per-directory order separately (they differ by
+  design, 5.2). A memory rerun with pins (and with a committed
+  manifest / vendor state) lands the next N.
+- Parser contract rows for the flag and env var.
+
+Docs (B): `CLI_CONTRACT.md` (limit semantics: classification,
+eligibility, unit, budget scope, order, convergence, version-bump and
+twin notes, starvation and non-committing CI; flag + env rows; `rollout`
+block; `rollout_deferred`; warnings; `jq` recipe; "Which patch gets
+selected" gains the cross-package order and the by-package supersession
+change), README (recipe R5, `--max-new-patches`), CHANGELOG
+`[Unreleased]` Added (and Changed: `updates[]` uses by-package data).
+
+### 9.3 Integration (B, after rebasing on A)
+
+- Pass `policy.max_new_patches()` as the `file` layer of `resolve_max_new`.
+- Resolve the `ScanArgs` struct-literal and `run_project_dirs` conflicts.
+- Combined e2e: a socket.yml with `includePaths`, `minSeverity: high` and
+  `maxNewPatches: 2` over a two-root fixture, disk and memory, three runs to
+  convergence, asserting each engine's own budget scope (5.2);
+  `--no-socket-yml` drops the file's cap but keeps a flag cap.
+- Switch `Candidate.project` to A's `repo_relative` and consume A's
+  `Offers` (before A lands, B uses canonical `--cwd` as the repo root and
+  treats the selected offers as the unfiltered list).
+- If B is ready before A merges, B ships with the file layer passed as
+  `None` and wires it in a follow-up commit on its branch once A lands.
+
+## 10. Open questions (decided by default, revisit with evidence)
+
+- A separate upgrade cap (`maxUpgrades`) if server-side republishes rotate
+  too many pins at once. Default: none.
+- CVSS/EPSS/KEV or reachability as ordering keys once the patch API
+  exposes them; they would slot between severity and advisory count.
+- A generated JSON Schema for the `patches` block, shared with depscan and
+  the docs, to keep validators from drifting.
+- Recognizing a dependency version bump of an already-patched package as
+  exempt from the cap (needs state hosted mode does not keep).
diff --git a/docs/design/v5-plan.md b/docs/design/v5-plan.md
index 0fd781e1..03126805 100644
--- a/docs/design/v5-plan.md
+++ b/docs/design/v5-plan.md
@@ -183,6 +183,13 @@ patch-UI review.
   exit 2 for all usage errors; scan/get JSON onto `json_envelope`.
 - Full item list: 22 findings from the UI review (sizes S/M/L, contract flags).
 
+### WS9 — Staged patch rollout  *(branches `v5/rollout-policy` (A), `v5/rollout-limit` (B))*
+- Added 2026-09-28 at the owner's request. `socket.yml` `patches:` policy
+  (paths, ecosystems, packages, severity floor, enabled) read by `scan`
+  and the in-memory engine, plus `scan --max-new-patches` (severity-ordered
+  per-run cap on new patches). Full plan and the two work-item specs:
+  `docs/design/staged-rollout.md`. Merge order A then B.
+
 ## Remaining small follow-ups
 - ci.yml `e2e_cargo`/`e2e_golang` rows select `--ignored` but have no ignored
   tests (vacuous legs) → give them `--include-ignored` or drop the rows.

From 28cebf7c2043e215afdd24a0c20971272e0abac5 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Mon, 28 Sep 2026 18:51:50 +0200
Subject: [PATCH 19/32] Attribute vlt pins and uv overrides in ledger-free
 hosted rollback

Discovery's sweep recognizes every uuid-shaped segment of a hosted URL,
so it also records the pin's grant token. HostedInventory counted that
token as contested wiring in two ledger-free shapes:

- uv: the paired pyproject.toml repeats the uv.lock pin's URL in
  [tool.uv.sources] (the transitive override case), but pyproject.toml
  is not a pin file.
- vlt: a vlt-lock.json whose pins are refs but withheld from the lock
  basis (a lock some vlt release discards) is a flagged pin file.

Unscoped rollback then failed with hosted_wiring_contested after it had
already restored the pin. The token of an attributed pin's own URL is
now excused in a file that also names that pin's patch uuid. Any other
unpinned uuid, a half-reverted pair and a contradicted lock are still
contested.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 crates/socket-patch-cli/CLI_CONTRACT.md       |   5 +-
 .../src/patch/redirect/upstream/mod.rs        |  59 ++++++++
 .../tests/hosted_inventory.rs                 | 133 ++++++++++++++++++
 3 files changed, 196 insertions(+), 1 deletion(-)

diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index f5e53273..6cb0eb91 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -589,7 +589,10 @@ records and registry entries cannot be fetched offline — making zero network r
 included). A hosted wiring that discovery cannot attribute (a lock mentioning a recognized hosted
 uuid it rejected, or a pin with no lockfile) is refused with `hosted_wiring_contested` (exit 1,
 nothing touched) rather than ejecting a partial set; `rollback`, `remove` and `list` refuse the same
-way (`list` degrades to a warning when it can still list). `--vex` works as on the manifest-driven
+way (`list` degrades to a warning when it can still list). The grant token of an attributed pin's
+own URL is never contested wiring where the same file also names that pin's patch uuid (a uv
+pin's paired `pyproject.toml` `[tool.uv.sources]` entry, a vlt pin in a `vlt-lock.json` whose pins
+are withheld from the lock basis); any other unattributed uuid still is. `--vex` works as on the manifest-driven
 path. Without hosted pins the no-manifest no-op below is unchanged.
 
 **Prebuilt vendor artifacts (`--vendor-source`)**: by default (`auto`) `vendor` first tries to
diff --git a/crates/socket-patch-core/src/patch/redirect/upstream/mod.rs b/crates/socket-patch-core/src/patch/redirect/upstream/mod.rs
index b7a94f3b..4e0eaf2a 100644
--- a/crates/socket-patch-core/src/patch/redirect/upstream/mod.rs
+++ b/crates/socket-patch-core/src/patch/redirect/upstream/mod.rs
@@ -141,11 +141,50 @@ impl HostedInventory {
             })
             .map(|d| norm(&d.file))
             .collect();
+        // The grant tokens of the attributable pins' own hosted URLs. The
+        // sweep recognizes every uuid-shaped segment of a hosted URL, so a
+        // file that repeats an attributed pin's URL names its token too:
+        // the paired `pyproject.toml` `[tool.uv.sources]` entry of a
+        // `uv.lock` pin (no pin file itself), or a `vlt-lock.json` whose pins
+        // are refs but withheld from the lock basis (a flagged pin file).
+        // Without a ledger that token is NOT unattributed hosted wiring: it
+        // is excused in a file that also names the pin's own patch uuid.
+        let pin_tokens: BTreeMap<String, BTreeSet<&str>> = {
+            let mut tokens: BTreeMap<String, BTreeSet<&str>> = BTreeMap::new();
+            for r in &discovery.refs {
+                if r.mode != WiringMode::Hosted {
+                    continue;
+                }
+                let Some(url) = r.url.as_deref() else {
+                    continue;
+                };
+                for token in url_uuid_segments(url) {
+                    if token != r.uuid {
+                        tokens.entry(token).or_default().insert(r.uuid.as_str());
+                    }
+                }
+            }
+            tokens
+        };
+        let hosted_in_file: BTreeSet<(String, &str)> = discovery
+            .recognized
+            .iter()
+            .filter(|r| r.mode == WiringMode::Hosted)
+            .map(|r| (norm(&r.file), r.uuid.as_str()))
+            .collect();
+        let is_pin_token = |uuid: &str, file: &str| {
+            pin_tokens.get(uuid).is_some_and(|patches| {
+                patches
+                    .iter()
+                    .any(|patch| hosted_in_file.contains(&(file.to_string(), *patch)))
+            })
+        };
         let mut contested: BTreeMap<String, BTreeSet<String>> = BTreeMap::new();
         for r in &discovery.recognized {
             let file = norm(&r.file);
             if r.mode == WiringMode::Hosted
                 && !pinned.contains(r.uuid.as_str())
+                && !is_pin_token(&r.uuid, &file)
                 && (!pinned_files.contains(file.as_str()) || flagged_files.contains(&file))
             {
                 contested
@@ -227,6 +266,26 @@ impl HostedInventory {
     }
 }
 
+/// The canonical-uuid path segments of a hosted URL discovery already
+/// accepted (`\/` unescaped; a wholly percent-encoded URL decoded first;
+/// each segment percent-decoded after splitting).
+fn url_uuid_segments(url: &str) -> Vec<String> {
+    use crate::patch::path_safety::is_canonical_uuid;
+    use crate::utils::purl::percent_decode_purl_component;
+    let unescaped = url.trim().replace("\\/", "/");
+    let lower = unescaped.to_ascii_lowercase();
+    let decoded = if lower.starts_with("https%3a%2f%2f") || lower.starts_with("http%3a%2f%2f") {
+        percent_decode_purl_component(&unescaped).into_owned()
+    } else {
+        unescaped
+    };
+    let path = decoded.split(['?', '#']).next().unwrap_or_default();
+    path.split('/')
+        .map(|s| percent_decode_purl_component(s).into_owned())
+        .filter(|s| is_canonical_uuid(s))
+        .collect()
+}
+
 /// Knobs for [`restore_upstream`].
 #[derive(Debug, Clone, Default)]
 pub struct RestoreOptions {
diff --git a/crates/socket-patch-core/tests/hosted_inventory.rs b/crates/socket-patch-core/tests/hosted_inventory.rs
index 6e3d16dc..1bb3772d 100644
--- a/crates/socket-patch-core/tests/hosted_inventory.rs
+++ b/crates/socket-patch-core/tests/hosted_inventory.rs
@@ -73,3 +73,136 @@ async fn registry_only_project_has_no_hosted_state() {
     write_project(tmp.path(), false, false);
     assert!(inventory(tmp.path()).await.is_empty());
 }
+
+// ── attributed pins' grant tokens ────────────────────────────────────────
+// With no ledger, the lock content alone attributes a hosted pin, and the
+// discovery sweep also recognizes the grant token of the pin's URL. That
+// token is the pin's own, not unattributed wiring, wherever the file names
+// the pin's patch too; any other unpinned patch uuid stays contested.
+
+const OTHER_PATCH: &str = "33333333-3333-4333-8333-333333333333";
+const SHA512: &str = "sha512-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==";
+
+fn vlt_lock(nodes: &[(&str, &str)]) -> String {
+    // No `lockfileVersion`: a lock some vlt release discards, so its hosted
+    // pins are refs withheld from the lock basis (a flagged pin file).
+    let nodes: Vec<String> = nodes
+        .iter()
+        .map(|(id, url)| format!("    \"{id}\": [0,\"left-pad\",\"{SHA512}\",\"{url}\"]"))
+        .collect();
+    format!(
+        "{{\n  \"options\": {{}},\n  \"nodes\": {{\n{}\n  }},\n  \"edges\": {{}}\n}}\n",
+        nodes.join(",\n")
+    )
+}
+
+#[tokio::test]
+async fn vlt_pin_withheld_from_the_lock_basis_is_not_contested() {
+    let tmp = tempfile::tempdir().unwrap();
+    std::fs::write(
+        tmp.path().join("vlt-lock.json"),
+        vlt_lock(&[("·npm·left-pad@1.3.0", &hosted_url())]),
+    )
+    .unwrap();
+    let inv = inventory(tmp.path()).await;
+    assert_eq!(inv.pins.len(), 1, "{inv:?}");
+    assert_eq!(inv.pins[0].uuid, PATCH);
+    assert!(inv.contested.is_empty(), "{inv:?}");
+}
+
+#[tokio::test]
+async fn vlt_flagged_lock_naming_another_patch_is_still_contested() {
+    let tmp = tempfile::tempdir().unwrap();
+    // Same grant token, but a second node wires a patch no ref attributes
+    // (its leaf names another package version, so it is diagnosed).
+    let bogus = format!(
+        "https://patch.socket.dev/patch/npm/left-pad/1.3.0/{GRANT}/{OTHER_PATCH}/left-pad-9.9.9.tgz"
+    );
+    std::fs::write(
+        tmp.path().join("vlt-lock.json"),
+        vlt_lock(&[
+            ("·npm·left-pad@1.3.0", &hosted_url()),
+            ("·npm·left-pad@1.3.0·peer", &bogus),
+        ]),
+    )
+    .unwrap();
+    let inv = inventory(tmp.path()).await;
+    let contested: Vec<&str> = inv.contested.iter().map(|c| c.uuid.as_str()).collect();
+    assert!(contested.contains(&OTHER_PATCH), "{inv:?}");
+    assert!(!contested.contains(&GRANT), "{inv:?}");
+    assert!(inv.contested_refusal().is_some());
+}
+
+fn uv_url(patch: &str) -> String {
+    format!(
+        "https://patch.socket.dev/patch/pypi/six/1.17.0/{GRANT}/{patch}/six-1.17.0-py2.py3-none-any.whl"
+    )
+}
+
+fn write_uv_project(root: &std::path::Path, pyproject_patch: &str, extra_source: Option<&str>) {
+    let url = uv_url(PATCH);
+    let hash = "a".repeat(64);
+    std::fs::write(
+        root.join("uv.lock"),
+        format!(
+            "version = 1\nrequires-python = \">=3.8\"\n\n\
+             [[package]]\nname = \"app\"\nversion = \"0.1.0\"\nsource = {{ virtual = \".\" }}\n\
+             dependencies = [{{ name = \"six\" }}]\n\n\
+             [[package]]\nname = \"six\"\nversion = \"1.17.0\"\nsource = {{ url = \"{url}\" }}\n\
+             wheels = [{{ url = \"{url}\", hash = \"sha256:{hash}\" }}]\n"
+        ),
+    )
+    .unwrap();
+    let extra = extra_source
+        .map(|u| format!("other = {{ url = \"{u}\" }}\n"))
+        .unwrap_or_default();
+    std::fs::write(
+        root.join("pyproject.toml"),
+        format!(
+            "[project]\nname = \"app\"\nversion = \"0.1.0\"\ndependencies = []\n\n\
+             [tool.uv]\noverride-dependencies = [\"six==1.17.0\"]\n\n\
+             [tool.uv.sources]\nsix = {{ url = \"{}\" }}\n{extra}",
+            uv_url(pyproject_patch)
+        ),
+    )
+    .unwrap();
+}
+
+#[tokio::test]
+async fn uv_transitive_override_pin_is_not_contested_by_its_pyproject() {
+    let tmp = tempfile::tempdir().unwrap();
+    write_uv_project(tmp.path(), PATCH, None);
+    let inv = inventory(tmp.path()).await;
+    assert_eq!(inv.pins.len(), 1, "{inv:?}");
+    assert_eq!(inv.pins[0].uuid, PATCH);
+    assert_eq!(inv.pins[0].files, vec!["uv.lock".to_string()]);
+    assert!(inv.contested.is_empty(), "{inv:?}");
+}
+
+#[tokio::test]
+async fn uv_pyproject_naming_an_unpinned_patch_is_still_contested() {
+    let tmp = tempfile::tempdir().unwrap();
+    // pyproject.toml also routes another package to a patch no lock pins,
+    // under the same grant token.
+    let other = format!(
+        "https://patch.socket.dev/patch/pypi/other/1.0.0/{GRANT}/{OTHER_PATCH}/other-1.0.0-py3-none-any.whl"
+    );
+    write_uv_project(tmp.path(), PATCH, Some(&other));
+    let inv = inventory(tmp.path()).await;
+    assert_eq!(inv.pins.len(), 1, "{inv:?}");
+    let contested: Vec<&str> = inv.contested.iter().map(|c| c.uuid.as_str()).collect();
+    assert_eq!(contested, vec![OTHER_PATCH], "{inv:?}");
+    let refusal = inv.contested_refusal().expect("a refusal");
+    assert!(refusal.contains("pyproject.toml"), "{refusal}");
+}
+
+#[tokio::test]
+async fn half_reverted_uv_pair_is_still_contested() {
+    let tmp = tempfile::tempdir().unwrap();
+    // The lock and its pyproject name different patches: nothing is
+    // attributable, so the token is no pin's and both stay contested.
+    write_uv_project(tmp.path(), OTHER_PATCH, None);
+    let inv = inventory(tmp.path()).await;
+    assert!(inv.pins.is_empty(), "{inv:?}");
+    assert!(inv.contested_refusal().is_some(), "{inv:?}");
+}

From 73c0c4f50d6b78acca6f55539afb5cb09e164d33 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Mon, 28 Sep 2026 20:18:26 +0200
Subject: [PATCH 20/32] WS3: one lockfile model per ecosystem (#281)

* Drop never-read fields from the rollback covgap fixture

clippy -D warnings rejects the dead before_hash/after_hash fields.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018BYsX2VfVNKHvfFAJnFryc

* Read pnpm-lock.yaml through one format model

formats::pnpm owns the pnpm lock grammar in every generation (shrinkwrap,
5.x block, 5.4/6.0/9.0 flow, Rush nested locks): PnpmLock::parse once, then
entries(), resolves(), wired_refs(), wired_integrity(), vendored_in_use(),
plan_hosted() and the restore_upstream() hook. The redirect rewriter's pnpm
leg, the lock inventory, lockfile discovery, repair's integrity anchor and
flavor sniff, the vendored v9/legacy planners and get's pnpm-PnP probe all
read through it instead of their own walkers.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018BYsX2VfVNKHvfFAJnFryc

* Derive every wiring-file list from formats::registry()

The hosted candidate list, repair's vendored-reference search space,
lockfile discovery's vendored-liveness probe, the in-memory engine's root
markers and file ecosystems, the npm flavor probe guard and pnpm detection
now filter one table instead of keeping five parallel lists. The hosted
candidate order is pinned by value.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018BYsX2VfVNKHvfFAJnFryc

* Read Cargo.lock through one format model

formats::cargo owns the lock read model (LockedPackage, v1 [metadata]
checksums, [[patch.unused]], dependency references) behind CargoLock:
entries() for the inventory, packages() for lockfile discovery and the
vendor probes, dependents() for the hosted planner's unpinnable-dependents
refusal (which re-parsed the lock with its own walker), vendored_in_use()
for the vendored-copy claim, and the restore_upstream() hook.

The hosted planner's Cargo.lock splice moves to formats::cargo::hosted with
the line-grammar probes the rewriter reads with (is_locked,
locked_versions), replacing three copies of the header probe.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018BYsX2VfVNKHvfFAJnFryc

* Read composer.lock through one format model

formats::composer owns the entry walk (ComposerLockPackage, now with its
ownership gate wired_to) behind ComposerLock: entries() for the inventory
and packages() for lockfile discovery and the vendored backend. The
vendored backend's entry_is_wired and repair's recorded-fragment reader,
which read dist fields straight off the JSON, go through the entry model.
The hosted planner's byte scanner moves verbatim to
formats::composer::hosted; its equivalence oracle stays green.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018BYsX2VfVNKHvfFAJnFryc

* Read Bundler locks through one format model

vendor::gemfile_lock becomes formats::gem: GemfileLock::parse plus
entries() for the inventory (moved out of lock_inventory::gem, which keeps
only its view I/O and ledger recovery's remote set), the restore_upstream()
hook, and gem_download_url. The hosted planner's lock-source convergence
moves verbatim to formats::gem::hosted.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018BYsX2VfVNKHvfFAJnFryc

* Keep the rollback fixture's hashes for the macOS-only test

The blob-retention test that reads before_hash/after_hash is
#[cfg(target_os = "macos")]; allow the fields as dead elsewhere instead of
dropping them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018BYsX2VfVNKHvfFAJnFryc

* Route the yarn grammar split and bun.lock prelude through formats

formats::yarn owns the one yarn.lock grammar decision: sniff_grammar (the
head sniff the vendor flavor probe, the lock-inventory view and repair's
reference flavor each re-derived) and is_berry_lock (the whole-file check
the hosted rewriters and discovery share; the classic vendored backend's
refusal gate now uses it too, so a BOM'd berry lock no longer slips past
it). formats::bun::BunTextLock is the gate + split + packages parse five
bun.lock readers copied; each keeps its own refusal wording.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018BYsX2VfVNKHvfFAJnFryc

* Read repair's yarn/bun trust anchor through the entry models

wired_vendor_integrity scanned yarn.lock and bun.lock with a six-line
forward window from any line naming the artifact. It now reads the entry
models lockfile discovery uses: live classic blocks' integrity, berry
checksum (yarn 4.0.x bare hex promoted under cacheKey 10c0), and bun's
tarball tuple. That fixes a berry block whose carried dependencies pushed
checksum out of the window (no anchor), a bare-hex checksum (no anchor), a
shadowed classic block being read, and bun's digest-less re-save borrowing
the next package's sha512 (a wrong anchor). Entries that disagree yield no
anchor.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018BYsX2VfVNKHvfFAJnFryc

* Pin gem CHECKSUMS through the shared entry grammar

The hosted writer found the dep's CHECKSUMS row with a regex that only
matched a lowercase terminal sha256, while the discovery reader accepts
uppercase digests, extra digest tokens and bare entries. Any of those fell
through to the insert branch and added a second, conflicting row (which
the reader then treats as no pin). The writer now locates the entry with
formats::gem's split_checksum_entry inside the CHECKSUMS section and
replaces that row in place, keeping its line ending and recording the old
row verbatim for revert.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018BYsX2VfVNKHvfFAJnFryc

* Answer pnpm in-use from the model's parse; drop the placeholder hook

PnpmLock computes its vendored-uuid set at parse time with one walk over
the packages/snapshots block keys (the vendored planners' key grammar,
each line's \r dropped). pnpm_entry_in_use memoizes the same set per lock
bytes instead of keeping LockIndex's copy and the LF-only
vendored_in_use_lines scan. A CRLF lock now answers like its LF twin (in
use) instead of undeterminable; the unwired-revert guard still refuses.

formats::LockModel with its default-unsupported restore_upstream() is
removed: hosted upstream restoration belongs to the ledger-free hosted
workstream and should land on these models, not beside them as a
placeholder.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018BYsX2VfVNKHvfFAJnFryc

* Move the maven pom and nuget config readers into formats

vendor::maven_pom becomes formats::maven and nuget_config's routing reader
becomes formats::nuget; the NuGet config file names and the stat-only
same-file check stay in vendor::nuget_config with the callers' I/O.
Lockfile discovery, their only reader, imports the models directly; the
purity guards follow the files.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018BYsX2VfVNKHvfFAJnFryc

* Splice Cargo.lock at the spans of its one parse

CargoLock::parse now reads the lock with toml_edit's spanned Document and
records each [[package]]'s header, version/source/checksum value spans and
string values, every table header, the [root] strings and the [metadata]
lines. The hosted planner (CargoLock::plan_hosted) splices at those spans,
and the rewriter's is_locked / locked_versions probes answer from the same
parse, so the separate `[[package]]\nname = ...` text grammar, its regexes
and block walkers are gone.

The previous line-grammar planner is kept test-only as the oracle:
randomized v1 and v3/v4 locks (plus twins, [root], sourceless v1, bare
blocks, 1.2k-block locks) plan to identical bytes and FileEdits for every
package, a re-run, and a second package over the result. The one allowed
difference is a lock the old grammar could not read (a final block with no
newline after `version`), which the span planner now finds.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018BYsX2VfVNKHvfFAJnFryc

---------

Co-authored-by: Claude <noreply@anthropic.com>
---
 crates/socket-patch-cli/src/commands/get.rs   |  156 +-
 .../src/commands/scan/hosted.rs               |  181 +-
 .../src/commands/vendored_backend/repair.rs   |   40 +-
 .../src/hosted_memory/redirect.rs             |   35 +-
 .../src/hosted_memory/roots.rs                |   37 +-
 crates/socket-patch-core/src/constants.rs     |  120 +-
 .../socket-patch-core/src/formats/bun/mod.rs  |   49 +
 .../src/formats/cargo/hosted.rs               |  273 +++
 .../src/formats/cargo/mod.rs                  |  506 ++++++
 .../src/formats/composer/hosted.rs            |  317 ++++
 .../src/formats/composer/mod.rs               |  176 ++
 .../src/formats/gem/hosted.rs                 |  307 ++++
 .../gemfile_lock.rs => formats/gem/mod.rs}    |   78 +-
 .../maven_pom.rs => formats/maven/mod.rs}     |    0
 crates/socket-patch-core/src/formats/mod.rs   |   92 +
 .../src/formats/nuget/mod.rs                  |  233 +++
 .../pnpm.rs => formats/pnpm/grammar.rs}       |   15 +-
 .../src/formats/pnpm/hosted.rs                |  426 +++++
 .../src/formats/pnpm/lines.rs                 |  149 ++
 .../socket-patch-core/src/formats/pnpm/mod.rs |  584 +++++++
 .../socket-patch-core/src/formats/registry.rs |  223 +++
 .../socket-patch-core/src/formats/yarn/mod.rs |   86 +
 crates/socket-patch-core/src/lib.rs           |    1 +
 .../src/package_json/find.rs                  |   16 +-
 .../redirect/cargo_lock_equivalence_tests.rs  |  427 ++++-
 .../redirect/composer_equivalence_tests.rs    |    2 +
 .../patch/redirect/group_equivalence_tests.rs |    2 +-
 .../src/patch/redirect/mod.rs                 | 1527 ++---------------
 .../patch/redirect/pnpm_equivalence_tests.rs  |    4 +-
 .../src/patch/redirect/upstream/cargo.rs      |   91 +-
 .../src/patch/redirect/upstream/client.rs     |    2 +-
 .../src/patch/redirect/upstream/composer.rs   |    4 +-
 .../src/patch/redirect/upstream/gem.rs        |    2 +-
 .../src/patch/redirect/upstream/maven.rs      |    4 +-
 .../src/patch/redirect/upstream/npm.rs        |    2 +-
 .../src/patch/redirect/upstream/nuget.rs      |    2 +-
 .../socket-patch-core/src/vendor/bun_lock.rs  |   38 +-
 .../src/vendor/cargo_lock.rs                  |  182 +-
 .../src/vendor/composer_lock.rs               |   20 +-
 crates/socket-patch-core/src/vendor/gem.rs    |    2 +-
 .../src/vendor/lock_inventory/bun.rs          |    9 +-
 .../src/vendor/lock_inventory/cargo.rs        |   43 +-
 .../src/vendor/lock_inventory/composer.rs     |  119 +-
 .../src/vendor/lock_inventory/gem.rs          |   57 +-
 .../src/vendor/lock_inventory/mod.rs          |   18 +-
 .../src/vendor/lock_inventory/pnpm.rs         |  193 +--
 .../src/vendor/lock_inventory/recover.rs      |   49 +-
 .../src/vendor/lock_inventory/tests.rs        |   76 +-
 .../src/vendor/lock_inventory/view.rs         |   33 +-
 .../src/vendor/lock_inventory/wired.rs        |  129 +-
 crates/socket-patch-core/src/vendor/mod.rs    |    2 -
 .../src/vendor/npm_flavor.rs                  |   38 +-
 .../src/vendor/nuget_config.rs                |  234 +--
 .../socket-patch-core/src/vendor/pnpm_lock.rs |  298 +---
 .../src/vendor/pnpm_lock_legacy.rs            |  107 +-
 .../src/vendor/yarn_classic_lock.rs           |    2 +-
 .../src/vex/discover/cargo.rs                 |   26 +-
 .../src/vex/discover/composer.rs              |    6 +-
 .../socket-patch-core/src/vex/discover/gem.rs |    8 +-
 .../src/vex/discover/maven.rs                 |    2 +-
 .../socket-patch-core/src/vex/discover/mod.rs |   32 +-
 .../socket-patch-core/src/vex/discover/npm.rs |   23 +-
 .../src/vex/discover/nuget.rs                 |    3 +-
 63 files changed, 4532 insertions(+), 3386 deletions(-)
 create mode 100644 crates/socket-patch-core/src/formats/bun/mod.rs
 create mode 100644 crates/socket-patch-core/src/formats/cargo/hosted.rs
 create mode 100644 crates/socket-patch-core/src/formats/cargo/mod.rs
 create mode 100644 crates/socket-patch-core/src/formats/composer/hosted.rs
 create mode 100644 crates/socket-patch-core/src/formats/composer/mod.rs
 create mode 100644 crates/socket-patch-core/src/formats/gem/hosted.rs
 rename crates/socket-patch-core/src/{vendor/gemfile_lock.rs => formats/gem/mod.rs} (81%)
 rename crates/socket-patch-core/src/{vendor/maven_pom.rs => formats/maven/mod.rs} (100%)
 create mode 100644 crates/socket-patch-core/src/formats/mod.rs
 create mode 100644 crates/socket-patch-core/src/formats/nuget/mod.rs
 rename crates/socket-patch-core/src/{patch/redirect/pnpm.rs => formats/pnpm/grammar.rs} (95%)
 create mode 100644 crates/socket-patch-core/src/formats/pnpm/hosted.rs
 create mode 100644 crates/socket-patch-core/src/formats/pnpm/lines.rs
 create mode 100644 crates/socket-patch-core/src/formats/pnpm/mod.rs
 create mode 100644 crates/socket-patch-core/src/formats/registry.rs
 create mode 100644 crates/socket-patch-core/src/formats/yarn/mod.rs

diff --git a/crates/socket-patch-cli/src/commands/get.rs b/crates/socket-patch-cli/src/commands/get.rs
index e6a2c1ad..2716181e 100644
--- a/crates/socket-patch-cli/src/commands/get.rs
+++ b/crates/socket-patch-cli/src/commands/get.rs
@@ -11,6 +11,7 @@ use socket_patch_core::api::types::{
 };
 use socket_patch_core::crawlers::fuzzy_match::fuzzy_match_packages;
 use socket_patch_core::crawlers::{CrawlerOptions, Ecosystem};
+use socket_patch_core::formats::pnpm::PnpmLock;
 use socket_patch_core::manifest::operations::{read_manifest, write_manifest};
 use socket_patch_core::manifest::schema::{
     PatchFileInfo, PatchManifest, PatchRecord, VulnerabilityInfo,
@@ -1498,47 +1499,6 @@ fn purl_has_version(purl: &str) -> bool {
         })
 }
 
-/// Does the raw pnpm-lock text RESOLVE `name@version`? Boundary-anchored
-/// probes over the three lock grammars — a plain `contains` collides on
-/// version prefixes (`left-pad@1.3.0` matches inside
-/// `left-pad@1.3.0-beta.1`), name suffixes (`pad@1.3.0` inside
-/// `left-pad@1.3.0`), and unscoped-inside-scoped names (`name@1.0.0` inside
-/// `@scope/name@1.0.0`). The needles cover v6/v9's `name@version` and v5's
-/// `/name/version` key spellings; a match counts only when the preceding
-/// char cannot extend the name (start/whitespace/quote, or a `/` delimiter
-/// itself preceded by such a boundary) and the following char cannot extend
-/// the version (so `:`, `'`, `(`, and v5's `_peer` suffix all accept).
-/// Heuristic by design: a false negative degrades to a calm skip, a false
-/// positive costs one grant request the rewriter's per-dep confirmation
-/// then ignores.
-fn pnpm_lock_resolves(text: &str, name: &str, version: &str) -> bool {
-    let version_boundary = |c: char| !(c.is_ascii_alphanumeric() || matches!(c, '.' | '-' | '+'));
-    let name_boundary = |c: char| matches!(c, ' ' | '\t' | '\n' | '\r' | '\'' | '"');
-    for needle in [format!("{name}@{version}"), format!("/{name}/{version}")] {
-        for (pos, _) in text.match_indices(needle.as_str()) {
-            let before_ok = match text[..pos].chars().next_back() {
-                None => true,
-                // v5/v6's leading key delimiter — legitimate only when the
-                // char before it is itself a boundary (otherwise this is a
-                // scoped `@scope/<name>` tail: a DIFFERENT package).
-                Some('/') => text[..pos - 1]
-                    .chars()
-                    .next_back()
-                    .is_none_or(name_boundary),
-                Some(c) => name_boundary(c),
-            };
-            let after_ok = text[pos + needle.len()..]
-                .chars()
-                .next()
-                .is_none_or(version_boundary);
-            if before_ok && after_ok {
-                return true;
-            }
-        }
-    }
-    false
-}
-
 /// Outcome of the coarse installed-VERSION narrowing over a CVE/GHSA/PURL
 /// search fan-out (see [`filter_to_installed_purls`]).
 struct InstalledNarrowing {
@@ -1576,7 +1536,7 @@ struct InstalledNarrowing {
 /// `yarn_pnp_unsupported`, not a false "not installed"). pnpm PnP skips
 /// carry `pnpm_pnp_unsupported` in agent/vendored modes; hosted mode — the
 /// refusal's own remedy — keeps the versions the raw pnpm-lock.yaml text
-/// resolves ([`pnpm_lock_resolves`]), labels a judged miss
+/// resolves ([`PnpmLock::resolves`]), labels a judged miss
 /// `package_not_installed` like any other mode, and reserves the layout
 /// code for an unreadable lock (no judgment possible).
 ///
@@ -1645,6 +1605,7 @@ async fn filter_to_installed_purls(
     let pnpm_pnp_lock_text: Option<String> = (pnp_pnpm && mode == super::scan::ScanMode::Hosted)
         .then(|| std::fs::read_to_string(common.cwd.join("pnpm-lock.yaml")).ok())
         .flatten();
+    let pnpm_pnp_lock = pnpm_pnp_lock_text.as_deref().map(PnpmLock::parse);
 
     let mut out = InstalledNarrowing {
         kept: Vec::new(),
@@ -1674,8 +1635,8 @@ async fn filter_to_installed_purls(
             // The pnpm PnP refusal's own remedy is the hosted lockfile
             // rewrite — but only for versions the lock ACTUALLY resolves:
             // keeping the whole fan-out would request grants for every
-            // version ever patched. Anchored probe over the raw lock text
-            // (see `pnpm_lock_resolves`); a hit is kept (the rewriter's
+            // version ever patched. The lock model's key probe
+            // (`PnpmLock::resolves`); a hit is kept (the rewriter's
             // per-dep confirmation still decides). A judged MISS is a
             // genuine "version not resolved" verdict — the layout blocked
             // nothing — so it carries the same `package_not_installed` code
@@ -1684,9 +1645,9 @@ async fn filter_to_installed_purls(
             let decoded = canon(&result.purl);
             let coord = decoded.strip_prefix("pkg:npm/").unwrap_or(&decoded);
             if mode == super::scan::ScanMode::Hosted {
-                match (pnpm_pnp_lock_text.as_deref(), coord.rsplit_once('@')) {
-                    (Some(text), Some((name, version))) => {
-                        if pnpm_lock_resolves(text, name, version) {
+                match (&pnpm_pnp_lock, coord.rsplit_once('@')) {
+                    (Some(lock), Some((name, version))) => {
+                        if lock.resolves(name, version) {
                             out.kept.push(result.clone());
                             continue;
                         }
@@ -3983,77 +3944,6 @@ pub(crate) fn base64_decode(input: &str) -> Result<Vec<u8>, String> {
 mod tests {
     use super::*;
 
-    /// The pnpm-PnP hosted lock probe must be boundary-anchored: plain
-    /// substring matching collides on version prefixes, name suffixes, and
-    /// unscoped-inside-scoped names.
-    #[test]
-    fn pnpm_lock_resolves_is_boundary_anchored() {
-        // v9/v6/v5 key spellings all resolve.
-        assert!(pnpm_lock_resolves(
-            "lockfileVersion: '9.0'\n\nsnapshots:\n\n  left-pad@1.3.0:\n",
-            "left-pad",
-            "1.3.0"
-        ));
-        assert!(pnpm_lock_resolves(
-            "  /left-pad@1.3.0:\n    resolution: {}\n",
-            "left-pad",
-            "1.3.0"
-        ));
-        assert!(pnpm_lock_resolves(
-            "  /left-pad/1.3.0:\n    resolution: {}\n",
-            "left-pad",
-            "1.3.0"
-        ));
-        // Peer-qualified keys still resolve: v9 `(peer)` and v5 `_peer`.
-        assert!(pnpm_lock_resolves(
-            "  'left-pad@1.3.0(react@18.0.0)':\n",
-            "left-pad",
-            "1.3.0"
-        ));
-        assert!(pnpm_lock_resolves(
-            "  /left-pad/1.3.0_react@18.0.0:\n",
-            "left-pad",
-            "1.3.0"
-        ));
-        // Scoped names resolve in both quoted-v9 and v6 spellings.
-        assert!(pnpm_lock_resolves(
-            "  '@scope/name@1.0.0':\n",
-            "@scope/name",
-            "1.0.0"
-        ));
-        assert!(pnpm_lock_resolves(
-            "  /@scope/name@1.0.0:\n",
-            "@scope/name",
-            "1.0.0"
-        ));
-
-        // Version-prefix collision: 1.3.0 must NOT match 1.3.0-beta.1.
-        assert!(!pnpm_lock_resolves(
-            "  left-pad@1.3.0-beta.1:\n",
-            "left-pad",
-            "1.3.0"
-        ));
-        // Name-suffix collision: `pad` must NOT match inside `left-pad`.
-        assert!(!pnpm_lock_resolves("  left-pad@1.3.0:\n", "pad", "1.3.0"));
-        assert!(!pnpm_lock_resolves("  /left-pad/1.3.0:\n", "pad", "1.3.0"));
-        // Unscoped-inside-scoped: `name` must NOT match `@scope/name`.
-        assert!(!pnpm_lock_resolves(
-            "  '@scope/name@1.0.0':\n",
-            "name",
-            "1.0.0"
-        ));
-        assert!(!pnpm_lock_resolves(
-            "  /@scope/name@1.0.0:\n",
-            "name",
-            "1.0.0"
-        ));
-        // Absent version: never resolves.
-        assert!(!pnpm_lock_resolves(
-            "  left-pad@1.3.0:\n",
-            "left-pad",
-            "2.0.0"
-        ));
-    }
     use socket_patch_core::api::types::{PatchFileResponse, VulnerabilityResponse};
     use std::collections::HashMap;
 
@@ -5032,36 +4922,6 @@ mod tests {
         );
     }
 
-    // --- pnpm_lock_resolves: needle at byte 0 ------------------------------
-    // The boundary probe reads the char BEFORE the match; a match at the very
-    // start of the text has none (`None => true`). A regression that indexes
-    // `text[..pos - 1]` unconditionally would underflow/panic here.
-
-    #[test]
-    fn pnpm_lock_resolves_needle_at_start_of_text() {
-        // pos == 0, plain v9 spelling: no preceding char is a valid boundary.
-        assert!(pnpm_lock_resolves("left-pad@1.3.0:\n", "left-pad", "1.3.0"));
-        // pos == 0, v5/v6 `/name/version` and `/name@version` spellings: the
-        // leading `/` delimiter itself has nothing before it.
-        assert!(pnpm_lock_resolves(
-            "/left-pad/1.3.0:\n",
-            "left-pad",
-            "1.3.0"
-        ));
-        assert!(pnpm_lock_resolves(
-            "/left-pad@1.3.0:\n",
-            "left-pad",
-            "1.3.0"
-        ));
-        // Still boundary-checked at the start of text: a scoped tail whose
-        // name begins mid-token must NOT match.
-        assert!(!pnpm_lock_resolves(
-            "@scope/left-pad@1.3.0:\n",
-            "left-pad",
-            "1.3.0"
-        ));
-    }
-
     // --- write_all_patch_blobs ---------------------------------------------
     // The per-patch fan-out over write_blob_entry: the FIRST bad entry must
     // fail the whole patch (Err(())) and leave nothing outside the blobs
diff --git a/crates/socket-patch-cli/src/commands/scan/hosted.rs b/crates/socket-patch-cli/src/commands/scan/hosted.rs
index 6231254a..a78063ff 100644
--- a/crates/socket-patch-cli/src/commands/scan/hosted.rs
+++ b/crates/socket-patch-cli/src/commands/scan/hosted.rs
@@ -9,6 +9,7 @@ use std::time::Duration;
 use futures_util::StreamExt;
 use socket_patch_core::api::client::hold_back_debug;
 use socket_patch_core::api::types::BatchPackagePatches;
+use socket_patch_core::formats::registry;
 use socket_patch_core::patch::apply_lock::LockGuard;
 use socket_patch_core::patch::redirect::DepOverride;
 use socket_patch_core::utils::concurrent::{
@@ -27,71 +28,11 @@ pub(crate) use vlt::rollback_heal as vlt_rollback_heal;
 pub(crate) use vlt::takeover_heal as vlt_takeover_heal;
 
 /// Candidate lockfiles / registry configs the redirect rewriters may touch —
-/// read from the project when present and handed to `rewrite_registry_redirect`.
-pub(crate) const REDIRECT_CANDIDATE_FILES: &[&str] = &[
-    "package-lock.json",
-    "npm-shrinkwrap.json",
-    "pnpm-lock.yaml",
-    // pnpm <=2 uses the same package identities under the old filename.
-    "shrinkwrap.yaml",
-    "node_modules/.modules.yaml",
-    "yarn.lock",
-    // A berry lock's cache-config gate reads `.yarnrc.yml`; bun's text lock is
-    // `bun.lock`; binary locks are read separately below.
-    ".yarnrc.yml",
-    "bun.lock",
-    "bun.lockb",
-    // vlt: the lock is rewritten, vlt.json is read-only (the old-lockfile
-    // advisory), and the hidden lock is only stat'ed as the install-state
-    // sentinel.
-    "vlt-lock.json",
-    "vlt.json",
-    "node_modules/.vlt-lock.json",
-    "requirements.txt",
-    "uv.lock",
-    "poetry.lock",
-    "pdm.lock",
-    "Pipfile.lock",
-    "pyproject.toml",
-    "hatch.toml",
-    "Cargo.toml",
-    "Cargo.lock",
-    ".cargo/config.toml",
-    // The LEGACY extensionless spelling: cargo reads `.cargo/config` in
-    // preference to `config.toml` when both exist, so the rewriter must see
-    // it (it wires the managed registry into whichever one is present) —
-    // otherwise the `[registries.…]` block lands in a file cargo ignores.
-    ".cargo/config",
-    "composer.lock",
-    "nuget.config",
-    "packages.lock.json",
-    "Gemfile",
-    "Gemfile.lock",
-    // Bundler's modern manifest spelling — preferred over Gemfile when both
-    // exist (the gem rewriter picks the pair bundler reads and fails closed
-    // on diverging spellings).
-    "gems.rb",
-    "gems.locked",
-    // The golang rewriter edits the main module's go.mod (fork-style
-    // `replace`) and go.sum (the socket module's two h1: lines). go.sum may
-    // legitimately be absent — the rewriter creates it in that case.
-    "go.mod",
-    "go.sum",
-    "pom.xml",
-    // Maven Trusted Checksums files the fail-closed maven rewriter merges into
-    // (read so an existing user config / checksum set is preserved, not
-    // clobbered).
-    ".mvn/maven.config",
-    ".mvn/checksums/checksums.sha256",
-    // Gradle build scripts are never edited — their presence only feeds the
-    // maven rewriter's paste-able `exclusiveContent` snippet warning.
-    "settings.gradle",
-    "settings.gradle.kts",
-    "build.gradle",
-    "build.gradle.kts",
-    // deno.lock is deliberately absent: no redirect rewriter edits its
-    // integrity entries.
-];
+/// read from the project when present and handed to
+/// `rewrite_registry_redirect`: the [`registry::HOSTED`] rows of the format
+/// registry, in its read order.
+pub(crate) static REDIRECT_CANDIDATE_FILES: std::sync::LazyLock<Vec<&'static str>> =
+    std::sync::LazyLock::new(|| registry::paths_with(registry::HOSTED));
 
 /// Most hosted wheel-metadata downloads in flight at once, below the patch
 /// API's own in-flight cap: each one buffers a whole wheel (up to
@@ -304,41 +245,11 @@ pub(crate) fn pnpm_trust_configured_detail(server: &str, created: bool, dry_run:
     )
 }
 
-/// `lockfileVersion` major sniffed from a pnpm-lock.yaml head. pnpm 9-12
-/// emit `lockfileVersion: '9.0'` (single doc, first line); pnpm 8 emits
-/// `'6.0'`, pnpm 7 an unquoted `5.4`. `None` when no parseable version line
-/// exists — callers treat that as "not trust-policy era" and stay
-/// hands-off (fail closed: never write config for a lock we can't read).
-pub(crate) fn pnpm_lock_version_major(lock_text: &str) -> Option<u32> {
-    lock_text.lines().find_map(|line| {
-        let rest = line.strip_prefix("lockfileVersion:")?;
-        let value = rest.trim().trim_matches(|c| c == '\'' || c == '"');
-        value.split('.').next()?.parse::<u32>().ok()
-    })
-}
-
-/// Whether a pnpm lock may belong to pnpm 1–4, which spell the store flag
-/// `--store` (pnpm 1–3 can silently ignore `--store-dir`; early pnpm 4
-/// rejects it): a `shrinkwrapVersion` lock (pnpm 1–2) or lockfileVersion
-/// 5.0–5.2 (pnpm 3–5). Later locks never get the `--store` note.
-pub(crate) fn pnpm_lock_may_need_store_flag(lock_text: &str) -> bool {
-    lock_text.lines().any(|line| {
-        if line.starts_with("shrinkwrapVersion:") {
-            return true;
-        }
-        let Some(rest) = line.strip_prefix("lockfileVersion:") else {
-            return false;
-        };
-        let value = rest.trim().trim_matches(|c| c == '\'' || c == '"');
-        let mut parts = value.split('.');
-        let major = parts.next().and_then(|m| m.parse::<u32>().ok());
-        let minor = parts
-            .next()
-            .and_then(|m| m.parse::<u32>().ok())
-            .unwrap_or(0);
-        major == Some(5) && minor <= 2
-    })
-}
+// The pnpm lock-version sniffs live with the format's model.
+pub(crate) use socket_patch_core::formats::pnpm::{
+    lock_version_major as pnpm_lock_version_major,
+    may_need_store_flag as pnpm_lock_may_need_store_flag,
+};
 
 /// The planned pnpm-workspace.yaml `trustLockfile: true` edit.
 pub(crate) enum TrustPlan {
@@ -1849,7 +1760,7 @@ pub(crate) async fn run_redirect_selected(
     let mut rush_warnings: Vec<serde_json::Value> = Vec::new();
     let mut rush_lock_keys: Vec<String> = Vec::new();
     if !candidates.is_empty() || !dry_run_takeover_urls.is_empty() {
-        for name in REDIRECT_CANDIDATE_FILES {
+        for name in REDIRECT_CANDIDATE_FILES.iter() {
             if *name == "bun.lockb" {
                 continue;
             }
@@ -3528,7 +3439,6 @@ mod tests {
         wrap_tokens, wrap_words, TAKEOVER_INFO_CODES,
     };
     use super::{wheel_metadata_concurrency, WHEEL_METADATA_CONCURRENCY};
-    use socket_patch_core::constants::npm_family;
     use socket_patch_core::patch::redirect::DepOverride;
     use socket_patch_core::utils::concurrent::API_CONCURRENCY_ENV;
 
@@ -4751,25 +4661,54 @@ mod tests {
     }
 
     #[test]
-    fn redirect_candidates_match_the_shared_npm_family_table() {
-        // Drift guard, both directions, without classifying the non-npm
-        // rows: every table row flagged redirect_candidate must be in the
-        // candidate list, and no npm-family row NOT so flagged may appear
-        // (binary candidates are read separately).
-        for name in npm_family::names_with(|r| r.redirect_candidate) {
-            assert!(
-                REDIRECT_CANDIDATE_FILES.contains(&name),
-                "{name} is flagged redirect_candidate but missing from \
-                 REDIRECT_CANDIDATE_FILES"
-            );
-        }
-        for name in npm_family::names_with(|r| !r.redirect_candidate) {
-            assert!(
-                !REDIRECT_CANDIDATE_FILES.contains(&name),
-                "{name} is deliberately NOT a redirect candidate (see the \
-                 npm_family table) but appears in REDIRECT_CANDIDATE_FILES"
-            );
-        }
+    fn redirect_candidates_are_pinned_by_value() {
+        // Hardcoded on purpose: the candidate list is derived from the
+        // format registry, so a row dropped (or a HOSTED flag lost) there
+        // must fail here instead of silently shrinking what hosted reads.
+        assert_eq!(
+            *REDIRECT_CANDIDATE_FILES,
+            [
+                "package-lock.json",
+                "npm-shrinkwrap.json",
+                "pnpm-lock.yaml",
+                "shrinkwrap.yaml",
+                "node_modules/.modules.yaml",
+                "yarn.lock",
+                ".yarnrc.yml",
+                "bun.lock",
+                "bun.lockb",
+                "vlt-lock.json",
+                "vlt.json",
+                "node_modules/.vlt-lock.json",
+                "requirements.txt",
+                "uv.lock",
+                "poetry.lock",
+                "pdm.lock",
+                "Pipfile.lock",
+                "pyproject.toml",
+                "hatch.toml",
+                "Cargo.toml",
+                "Cargo.lock",
+                ".cargo/config.toml",
+                ".cargo/config",
+                "composer.lock",
+                "nuget.config",
+                "packages.lock.json",
+                "Gemfile",
+                "Gemfile.lock",
+                "gems.rb",
+                "gems.locked",
+                "go.mod",
+                "go.sum",
+                "pom.xml",
+                ".mvn/maven.config",
+                ".mvn/checksums/checksums.sha256",
+                "settings.gradle",
+                "settings.gradle.kts",
+                "build.gradle",
+                "build.gradle.kts",
+            ]
+        );
     }
     // ── Human-output formatting ────────────────────────────────────────────
 
diff --git a/crates/socket-patch-cli/src/commands/vendored_backend/repair.rs b/crates/socket-patch-cli/src/commands/vendored_backend/repair.rs
index 390195db..2744cd6a 100644
--- a/crates/socket-patch-cli/src/commands/vendored_backend/repair.rs
+++ b/crates/socket-patch-cli/src/commands/vendored_backend/repair.rs
@@ -28,6 +28,7 @@ use std::path::{Path, PathBuf};
 
 use socket_patch_core::api::client::{get_api_client_with_overrides, ApiClient};
 use socket_patch_core::constants::SOCKET_DIR;
+use socket_patch_core::formats::registry;
 use socket_patch_core::manifest::schema::{PatchManifest, PatchRecord};
 use socket_patch_core::patch::copy_tree::remove_tree;
 use socket_patch_core::utils::fs::{
@@ -57,36 +58,6 @@ struct Candidate {
     reason: &'static str,
 }
 
-/// Files the vendor backends rewire — the search space for
-/// `.socket/vendor/<eco>/<uuid>/<leaf>` references. The Python locks the
-/// root LISTS (`pylock*.toml`, `*.py.lock` + script) and the requirements
-/// `-r` include tree are appended at scan time.
-const WIRING_FILES: &[&str] = &[
-    "vlt-lock.json",
-    "package-lock.json",
-    "npm-shrinkwrap.json",
-    "pnpm-lock.yaml",
-    "yarn.lock",
-    "bun.lock",
-    "package.json",
-    "Cargo.toml",
-    "Cargo.lock",
-    // Pre-v5 vendored cargo wiring (migrated into Cargo.toml on re-run).
-    ".cargo/config.toml",
-    ".cargo/config",
-    "go.mod",
-    "composer.json",
-    "composer.lock",
-    "Gemfile",
-    "Gemfile.lock",
-    "uv.lock",
-    "pyproject.toml",
-    "poetry.lock",
-    "pdm.lock",
-    "Pipfile.lock",
-    "requirements.txt",
-];
-
 /// Scan the wiring-bearing files for vendored-artifact references,
 /// returning deduped `(ecosystem, uuid, artifact relpath)` triples. Pure
 /// text scan plus native binary Bun resolution records and the canonical
@@ -148,13 +119,14 @@ pub(crate) async fn scan_vendor_references(project_root: &Path) -> Vec<(String,
 }
 
 /// Every wiring-bearing file name the vendor backends may rewrite, relative
-/// to `project_root`: [`WIRING_FILES`], vlt importer manifests, the Python
+/// to `project_root`: the registry's vendored wiring files
+/// ([`registry::VENDORED`]), vlt importer manifests, the Python
 /// locks the root lists (and their scripts) and the requirements `-r`
 /// include tree. Sorted and deduplicated; entries need not exist.
 async fn wiring_files(project_root: &Path) -> Vec<String> {
-    let mut files: Vec<String> = WIRING_FILES
-        .iter()
-        .map(|file| (*file).to_string())
+    let mut files: Vec<String> = registry::paths_with(registry::VENDORED)
+        .into_iter()
+        .map(str::to_string)
         .collect();
     files.extend(vendor::vlt_lock::vlt_importer_package_jsons(project_root).await);
     if let Ok(paths) = socket_patch_core::utils::python_lock::python_lock_paths(project_root) {
diff --git a/crates/socket-patch-cli/src/hosted_memory/redirect.rs b/crates/socket-patch-cli/src/hosted_memory/redirect.rs
index 7848425c..06af3a67 100644
--- a/crates/socket-patch-cli/src/hosted_memory/redirect.rs
+++ b/crates/socket-patch-cli/src/hosted_memory/redirect.rs
@@ -160,35 +160,12 @@ pub(crate) fn build_candidates(
 /// The ecosystem a candidate file's rewriter belongs to (`None` for files
 /// no rewriter edits), for the symlinked-read refusal.
 fn file_ecosystem(rel: &str) -> Option<&'static str> {
+    if let Some(eco) = socket_patch_core::formats::registry::hosted_file_ecosystem(rel) {
+        return Some(eco);
+    }
     let base = rel.rsplit('/').next().unwrap_or(rel);
-    Some(match base {
-        "package-lock.json"
-        | "npm-shrinkwrap.json"
-        | "pnpm-lock.yaml"
-        | "shrinkwrap.yaml"
-        | ".modules.yaml"
-        | "yarn.lock"
-        | ".yarnrc.yml"
-        | "bun.lock"
-        | "bun.lockb"
-        | "vlt-lock.json"
-        | "vlt.json"
-        | ".vlt-lock.json" => "npm",
-        "requirements.txt" | "uv.lock" | "poetry.lock" | "pdm.lock" | "Pipfile.lock"
-        | "pyproject.toml" | "hatch.toml" => "pypi",
-        "Cargo.toml" | "Cargo.lock" | "config.toml" | "config" => "cargo",
-        "composer.lock" => "composer",
-        "nuget.config" | "packages.lock.json" => "nuget",
-        "Gemfile" | "Gemfile.lock" | "gems.rb" | "gems.locked" => "gem",
-        "go.mod" | "go.sum" => "golang",
-        "pom.xml" | "maven.config" | "checksums.sha256" => "maven",
-        _ if socket_patch_core::utils::python_lock::is_python_lock_name(base)
-            || base.ends_with(".py") =>
-        {
-            "pypi"
-        }
-        _ => return None,
-    })
+    (socket_patch_core::utils::python_lock::is_python_lock_name(base) || base.ends_with(".py"))
+        .then_some("pypi")
 }
 
 /// A project's state between the reference grants and the wheel-metadata
@@ -484,7 +461,7 @@ pub(crate) fn plan(
                 None => false,
             }
         };
-        for name in REDIRECT_CANDIDATE_FILES {
+        for name in REDIRECT_CANDIDATE_FILES.iter() {
             if *name == "bun.lockb" {
                 continue;
             }
diff --git a/crates/socket-patch-cli/src/hosted_memory/roots.rs b/crates/socket-patch-cli/src/hosted_memory/roots.rs
index 002cac15..053cf801 100644
--- a/crates/socket-patch-cli/src/hosted_memory/roots.rs
+++ b/crates/socket-patch-cli/src/hosted_memory/roots.rs
@@ -7,34 +7,11 @@
 
 use std::collections::{BTreeMap, BTreeSet};
 
+use socket_patch_core::formats::registry;
 use socket_patch_core::utils::python_lock::is_python_lock_name;
 
 use super::types::IgnoredPath;
 
-/// Lock markers that make their directory a project root, with the
-/// ecosystem each belongs to.
-pub(crate) const ROOT_LOCK_MARKERS: [(&str, &str); 19] = [
-    ("package-lock.json", "npm"),
-    ("npm-shrinkwrap.json", "npm"),
-    ("pnpm-lock.yaml", "npm"),
-    ("yarn.lock", "npm"),
-    ("bun.lock", "npm"),
-    ("bun.lockb", "npm"),
-    ("vlt-lock.json", "npm"),
-    ("rush.json", "npm"),
-    ("uv.lock", "pypi"),
-    ("poetry.lock", "pypi"),
-    ("pdm.lock", "pypi"),
-    ("Pipfile.lock", "pypi"),
-    ("requirements.txt", "pypi"),
-    ("Cargo.lock", "cargo"),
-    ("go.mod", "golang"),
-    ("go.sum", "golang"),
-    ("composer.lock", "composer"),
-    ("Gemfile.lock", "gem"),
-    ("gems.locked", "gem"),
-];
-
 /// Marker files of the ecosystems the in-memory engine cannot inventory
 /// (disk discovers them only through installed-tree crawlers).
 pub(crate) const UNSUPPORTED_MARKERS: [(&str, &[&str]); 2] = [
@@ -66,10 +43,11 @@ pub(crate) const EXCLUDED_ROOT_SEGMENTS: [&str; 10] = [
     "testdata",
 ];
 
-/// The ecosystem a root marker basename belongs to.
+/// The ecosystem a root marker basename belongs to: a [`registry::ROOT`]
+/// row (manifests alone never make a root) or a PEP 751 / PEP 723 lock.
 pub(crate) fn marker_ecosystem(base: &str) -> Option<&'static str> {
-    if let Some((_, eco)) = ROOT_LOCK_MARKERS.iter().find(|(name, _)| *name == base) {
-        return Some(eco);
+    if let Some(row) = registry::root_marker(base) {
+        return Some(row.ecosystem);
     }
     is_python_lock_name(base).then_some("pypi")
 }
@@ -133,10 +111,7 @@ pub(crate) fn detect_roots<'a>(
             ignore("ecosystem_filtered", &mut ignored);
             continue;
         }
-        let key: &'static str = ROOT_LOCK_MARKERS
-            .iter()
-            .find(|(name, _)| *name == base)
-            .map_or("python-lock", |(name, _)| name);
+        let key: &'static str = registry::root_marker(base).map_or("python-lock", |row| row.path);
         markers.entry(dir.to_string()).or_default().insert(key);
         marker_paths
             .entry(dir.to_string())
diff --git a/crates/socket-patch-core/src/constants.rs b/crates/socket-patch-core/src/constants.rs
index 5a6fefeb..18287b85 100644
--- a/crates/socket-patch-core/src/constants.rs
+++ b/crates/socket-patch-core/src/constants.rs
@@ -65,123 +65,11 @@ mod tests {
     }
 }
 
-/// The npm-family package managers' shared file-name knowledge.
-///
-/// npm, pnpm, yarn (classic and berry) and bun spell their lockfiles and
-/// layout markers across several subsystems — the vendor flavor probe
-/// (`vendor::npm_flavor`), the hosted-redirect candidate list (the CLI's
-/// `scan::hosted`), the crawler layout probe (`crawlers::pkg_managers`) and
-/// setup's PM detection (`package_json::find`). Those sites accept
-/// INTENTIONALLY divergent subsets: binary locks have a native byte reader, and the
-/// `pnpm-lock.yml` spelling is accepted only by setup detection. This table
-/// encodes each divergence once, visibly, instead of homogenizing them.
-///
-/// What is actually guard-tested (equality against the flagged rows):
-/// `vendor::npm_flavor`'s wiring-family list, `scan::hosted`'s
-/// REDIRECT_CANDIDATE_FILES npm subset, and `package_json::find`'s pnpm
-/// markers (plus a hardcoded pin so the table and its consumers cannot
-/// shrink together). NOT table-guarded: `crawlers::pkg_managers`' own
-/// bun/yarn lockfile literals and `npm_flavor`'s probe decision literals —
-/// those are pinned behaviorally by their unit tests instead; only
-/// PNP_MARKERS is shared with the crawler.
+/// The npm-family package managers' shared file names. Which subsystem
+/// accepts which of them (the intentionally divergent subsets: binary locks
+/// have a native byte reader, `pnpm-lock.yml` is only a pnpm marker) is
+/// one flag on one row of [`crate::formats::registry()`].
 pub mod npm_family {
-    /// One file-name row and the roles in which consumers accept it.
-    pub struct FileRow {
-        pub name: &'static str,
-        /// `vendor::npm_flavor`'s probe recognizes it (wiring family member).
-        pub vendor_probe: bool,
-        /// `scan::hosted` hands it to `rewrite_registry_redirect`.
-        pub redirect_candidate: bool,
-        /// `package_json::find::detect_package_manager` treats it as a pnpm
-        /// marker.
-        pub detects_pnpm: bool,
-    }
-
-    pub const FILES: &[FileRow] = &[
-        FileRow {
-            name: "package-lock.json",
-            vendor_probe: true,
-            redirect_candidate: true,
-            detects_pnpm: false,
-        },
-        FileRow {
-            name: "npm-shrinkwrap.json",
-            vendor_probe: true,
-            redirect_candidate: true,
-            detects_pnpm: false,
-        },
-        FileRow {
-            name: "pnpm-lock.yaml",
-            vendor_probe: true,
-            redirect_candidate: true,
-            detects_pnpm: true,
-        },
-        // Setup-detection-only spellings: the vendor probe and redirect
-        // rewriters have never accepted these, and widening them there is a
-        // behavior change to make deliberately, not by table accident.
-        FileRow {
-            name: "pnpm-lock.yml",
-            vendor_probe: false,
-            redirect_candidate: false,
-            detects_pnpm: true,
-        },
-        FileRow {
-            name: "pnpm-workspace.yaml",
-            vendor_probe: false,
-            redirect_candidate: false,
-            detects_pnpm: true,
-        },
-        FileRow {
-            name: "yarn.lock",
-            vendor_probe: true,
-            redirect_candidate: true,
-            detects_pnpm: false,
-        },
-        // Berry's cache-config gate: read by the redirect rewriters only.
-        FileRow {
-            name: ".yarnrc.yml",
-            vendor_probe: false,
-            redirect_candidate: true,
-            detects_pnpm: false,
-        },
-        FileRow {
-            name: "bun.lock",
-            vendor_probe: true,
-            redirect_candidate: true,
-            detects_pnpm: false,
-        },
-        // Binary Bun locks are read and rewritten natively.
-        FileRow {
-            name: "bun.lockb",
-            vendor_probe: true,
-            redirect_candidate: true,
-            detects_pnpm: false,
-        },
-        FileRow {
-            name: "vlt-lock.json",
-            vendor_probe: true,
-            redirect_candidate: true,
-            detects_pnpm: false,
-        },
-        // vlt's config: a read-only redirect input, never wired.
-        FileRow {
-            name: "vlt.json",
-            vendor_probe: false,
-            redirect_candidate: true,
-            detects_pnpm: false,
-        },
-        // deno.lock is deliberately absent: deno is its own ecosystem
-        // (JSR-crawled); no npm-family vendor/redirect/detection path treats
-        // deno.lock as an npm lock today. Adding it here is a feature
-        // decision, not a spelling fix.
-    ];
-
-    /// The names of every row `pick` flags — consumer guard tests compare
-    /// their local lists against this.
-    pub fn names_with(pick: impl Fn(&FileRow) -> bool) -> Vec<&'static str> {
-        FILES.iter().filter(|r| pick(r)).map(|r| r.name).collect()
-    }
-
     /// Yarn Plug'n'Play loader files — any one present means "packages are
     /// not on disk" (crawler must refuse; vendor probe refuses). Yarn 3+
     /// emits `.pnp.cjs`, Yarn 2.x emitted `.pnp.js`, newer installs may add
diff --git a/crates/socket-patch-core/src/formats/bun/mod.rs b/crates/socket-patch-core/src/formats/bun/mod.rs
new file mode 100644
index 00000000..54020760
--- /dev/null
+++ b/crates/socket-patch-core/src/formats/bun/mod.rs
@@ -0,0 +1,49 @@
+//! Bun's text lock (`bun.lock`): the one fail-closed prelude every reader
+//! starts from.
+//!
+//! The line grammar itself lives in `vendor::bun_lock_text` (the single-line
+//! `"key": [tuple]` entry parser both backends splice with), and the binary
+//! `bun.lockb` has its own codec (`vendor::bun_lockb`). What was copied at
+//! every call site — gate the `lockfileVersion` head, split the text into
+//! the splice's line coordinates, parse the `packages` section — is
+//! [`BunTextLock::parse`]; each caller keeps its own refusal wording.
+
+use crate::vendor::bun_lock_text::{check_lock_version, parse_packages_section, BunEntry};
+
+/// Why [`BunTextLock::parse`] refused a lock.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) enum BunTextError {
+    /// The `lockfileVersion` head is missing or unsupported; the detail is
+    /// the shared gate's user-facing text (one message for every mode).
+    Version(String),
+    /// The `packages` section deviates from bun's emitted single-line
+    /// grammar.
+    Packages(String),
+}
+
+impl BunTextError {
+    /// The refusal detail, whichever step refused.
+    pub(crate) fn detail(self) -> String {
+        match self {
+            BunTextError::Version(detail) | BunTextError::Packages(detail) => detail,
+        }
+    }
+}
+
+/// A text `bun.lock`, gated and parsed once.
+pub(crate) struct BunTextLock {
+    /// The text split on `\n` (a CRLF lock keeps each `\r`): the line
+    /// coordinates [`BunEntry::line_idx`] and the splices index.
+    pub(crate) lines: Vec<String>,
+    /// Every `packages` entry, in lock order.
+    pub(crate) entries: Vec<BunEntry>,
+}
+
+impl BunTextLock {
+    pub(crate) fn parse(text: &str) -> Result<Self, BunTextError> {
+        check_lock_version(text).map_err(BunTextError::Version)?;
+        let lines: Vec<String> = text.split('\n').map(str::to_string).collect();
+        let entries = parse_packages_section(&lines).map_err(BunTextError::Packages)?;
+        Ok(BunTextLock { lines, entries })
+    }
+}
diff --git a/crates/socket-patch-core/src/formats/cargo/hosted.rs b/crates/socket-patch-core/src/formats/cargo/hosted.rs
new file mode 100644
index 00000000..4545b401
--- /dev/null
+++ b/crates/socket-patch-core/src/formats/cargo/hosted.rs
@@ -0,0 +1,273 @@
+//! The hosted planner's `Cargo.lock` leg: repoint a crate's `[[package]]`
+//! block (and a v1 lock's `[metadata]` checksum and full-id references) at
+//! the Socket-hosted index, as splices at the byte spans [`CargoLock::parse`]
+//! recorded — the one parse the rewriter's lock probes
+//! ([`CargoLock::is_locked`], [`CargoLock::locked_versions`]) and the
+//! dependents check read, so a probe and the splice always agree on which
+//! blocks exist. Everything outside the spliced values keeps its bytes.
+
+use std::ops::Range;
+
+use serde_json::Value;
+
+use crate::patch::redirect::FileEdit;
+
+use super::CargoLock;
+
+/// The Cargo.lock edit kind for dependents' full-id references: `original`
+/// / `new` are the quoted `"<name> <version> (<source>)"` ids, keyed
+/// `<name>@<version>`, and the inverse replaces EVERY occurrence of `new`.
+pub(crate) const CARGO_LOCK_REFERENCE_KIND: &str = "redirect_cargo_lock_reference";
+
+/// Apply non-overlapping `splices` (ranges into `text`) to `text`.
+fn splice(text: &str, mut splices: Vec<(Range<usize>, String)>) -> String {
+    splices.sort_by_key(|(r, _)| std::cmp::Reverse(r.start));
+    let mut out = text.to_string();
+    for (range, with) in splices {
+        out.replace_range(range, &with);
+    }
+    out
+}
+
+/// Where a line inserted after the one `value` ends sits: just past that
+/// line's newline, or at `end` (the block's last byte) with the newline to
+/// prepend when the line ends the text.
+fn after_line(content: &str, value: &Range<usize>, end: usize) -> (usize, bool) {
+    match content[value.end..end].find('\n') {
+        Some(n) => (value.end + n + 1, false),
+        None => (end, true),
+    }
+}
+
+impl CargoLock {
+    /// End of the `[[package]]` block headed at `header`: the next table
+    /// header (another block, `[metadata]`, `[[patch.unused]]`, a
+    /// `[patch.*]` table) or EOF, excluding the newline(s) before it — so a
+    /// recorded original/new stops after the block's last content byte (the
+    /// TS rewriter's `(?=\n*$)` lookahead) while the file keeps its
+    /// newlines. Never before the end of the `version` line (`version`: its
+    /// value span): a block of just its identity keeps that line's newline.
+    fn block_end(&self, content: &str, header: usize, version: &Range<usize>) -> usize {
+        let headers = self.spans().map_or(&[][..], |s| &s.headers);
+        let mut end = headers
+            .iter()
+            .copied()
+            .find(|&h| h > header)
+            .unwrap_or(content.len());
+        let floor = if content[version.end..end].starts_with('\n') {
+            version.end + 1
+        } else {
+            version.end
+        };
+        while end > floor && content.as_bytes()[end - 1] == b'\n' {
+            end -= 1;
+        }
+        end
+    }
+
+    /// Repoint the crate's `[[package]]` at the hosted index with the
+    /// patched `.crate`'s checksum, in whichever Cargo.lock format the file
+    /// is (`content`: the text this model was parsed from):
+    ///
+    /// * v2–v4: `source` + an inline `checksum` in the entry;
+    /// * v1 (cargo < 1.41, still read by every cargo): the entry carries only
+    ///   `source`; the checksum lives in the trailing `[metadata]` table under
+    ///   `"checksum <name> <version> (<source>)"`, and every dependent names
+    ///   the crate by its FULL package id `"<name> <version> (<source>)"`.
+    ///   Both are keyed by the source, so both must follow it — a v1 lock
+    ///   with only the entry repointed names a package that no longer exists
+    ///   (cargo discards the lock and re-resolves; `--locked` fails) and pins
+    ///   nothing.
+    ///
+    /// Full-id references are rewritten in any format (v2+ spells them that
+    /// way when a name + version is ambiguous). Each changed fragment is its
+    /// own `redirect_cargo_lock_entry` edit (unique text, so the fragment
+    /// revert is unambiguous) — the entry and the `[metadata]` line — and the
+    /// dependents' references are one `redirect_cargo_lock_reference` edit
+    /// holding the quoted full id, reverted at every occurrence.
+    pub(crate) fn plan_hosted(
+        &self,
+        content: &str,
+        crate_name: &str,
+        version: &str,
+        index_url: &str,
+        cksum: &str,
+    ) -> CargoLockPlan {
+        let Some(spans) = self.spans() else {
+            return CargoLockPlan::NotFound;
+        };
+        // Every block for this name@version. A Cargo.lock may legitimately
+        // hold TWO blocks for one name@version from different sources — after
+        // a redirect, a transitive crates.io copy resolves beside the
+        // socket-registry copy, and cargo sorts the crates.io block FIRST —
+        // so the first hit alone would repoint the wrong twin.
+        let hits: Vec<usize> = (0..self.packages.len())
+            .filter(|&i| self.packages[i].name == crate_name && self.packages[i].version == version)
+            .collect();
+        let i = match hits.as_slice() {
+            [] => return CargoLockPlan::NotFound,
+            [only] => *only,
+            twins => {
+                // Exactly one twin already at the target index is OURS (a
+                // re-run over a redirected lock); anything else cannot be
+                // attributed and the dep is skipped transactionally.
+                let mut ours = twins
+                    .iter()
+                    .copied()
+                    .filter(|&i| self.packages[i].source.as_deref() == Some(index_url));
+                match (ours.next(), ours.next()) {
+                    (Some(i), None) => i,
+                    _ => return CargoLockPlan::Ambiguous,
+                }
+            }
+        };
+        let pkg = &self.packages[i];
+        let at = &spans.packages[i];
+        let block_start = at.header;
+        let block_end = self.block_end(content, block_start, &at.version);
+        let original = &content[block_start..block_end];
+        let old_source = pkg.source.as_deref();
+
+        // A v1 lock keeps the checksum in `[metadata]`, keyed by the package
+        // id — the chosen block's OWN source when it has one, so a
+        // multi-source twin's line is never taken for ours.
+        let metadata_line = spans.metadata.iter().find(|(key, _)| match old_source {
+            Some(source) => *key == super::metadata_checksum_key(crate_name, version, source),
+            None => key
+                .strip_prefix(&format!("checksum {crate_name} {version} ("))
+                .and_then(|rest| rest.strip_suffix(')'))
+                .is_some_and(|source| !source.contains([')', '"'])),
+        });
+
+        // The block's own splices, relative to `block_start`.
+        let rel = |r: &Range<usize>| (r.start - block_start)..(r.end - block_start);
+        let quoted_index = format!("\"{index_url}\"");
+        let checksum_line = format!("checksum = \"{cksum}\"");
+        let mut block_splices = Vec::new();
+        match &at.source {
+            Some(source) => {
+                block_splices.push((rel(source), quoted_index.clone()));
+                if metadata_line.is_none() {
+                    match &at.checksum {
+                        Some(checksum) => {
+                            block_splices.push((rel(checksum), format!("\"{cksum}\"")));
+                        }
+                        None => {
+                            let end = source.end - block_start;
+                            block_splices.push((end..end, format!("\n{checksum_line}")));
+                        }
+                    }
+                }
+            }
+            None => {
+                let mut lines = format!("source = {quoted_index}");
+                if metadata_line.is_none() {
+                    match &at.checksum {
+                        Some(checksum) => {
+                            block_splices.push((rel(checksum), format!("\"{cksum}\"")));
+                        }
+                        None => {
+                            lines.push('\n');
+                            lines.push_str(&checksum_line);
+                        }
+                    }
+                }
+                let (insert, prepend) = after_line(content, &at.version, block_end);
+                let insert = insert - block_start;
+                let text = if prepend {
+                    format!("\n{lines}")
+                } else {
+                    format!("{lines}\n")
+                };
+                block_splices.push((insert..insert, text));
+            }
+        }
+        let rebuilt = splice(original, block_splices);
+
+        let key = format!("{crate_name}@{version}");
+        let edit = |original: &str, new: &str| FileEdit {
+            path: "Cargo.lock".into(),
+            kind: "redirect_cargo_lock_entry".into(),
+            action: "rewritten".into(),
+            key: Some(key.clone()),
+            original: Some(Value::String(original.to_string())),
+            new: Some(Value::String(new.to_string())),
+        };
+        let mut edits = Vec::new();
+        let mut splices = Vec::new();
+        if rebuilt != original {
+            edits.push(edit(original, &rebuilt));
+            splices.push((block_start..block_end, rebuilt));
+        }
+        if let Some((_, line)) = metadata_line {
+            let pinned = format!("\"checksum {crate_name} {version} ({index_url})\" = \"{cksum}\"");
+            if content[line.clone()] != pinned {
+                edits.push(edit(&content[line.clone()], &pinned));
+                splices.push((line.clone(), pinned));
+            }
+        }
+        // Dependents' full-id references to the OLD source, recorded as ONE
+        // `redirect_cargo_lock_reference` edit holding just the quoted id —
+        // never a dependent's whole block: a block referencing two patched
+        // packages (the root of a v1 lock) would hold two overlapping block
+        // edits, and reverting the first-applied one alone would find neither
+        // of its fragments. The id names this name + version + source exactly,
+        // so its inverse puts back EVERY occurrence, independently of any
+        // other package's edits and in any removal order. The oldest v1 locks
+        // keep the ROOT package in a standalone `[root]` table with its own
+        // full-id `dependencies`; those follow too, or the lock would keep
+        // naming a package it no longer contains (`--locked` fails; an
+        // unlocked build silently re-resolves).
+        if let Some(old) = old_source.filter(|old| *old != index_url) {
+            let from = format!("\"{crate_name} {version} ({old})\"");
+            let to = format!("\"{crate_name} {version} ({index_url})\"");
+            let others = spans
+                .packages
+                .iter()
+                .enumerate()
+                .filter(|&(j, _)| j != i)
+                .flat_map(|(_, p)| &p.strings);
+            let refs: Vec<Range<usize>> = spans
+                .root_strings
+                .iter()
+                .chain(others)
+                .filter(|r| content[(*r).clone()] == from)
+                .cloned()
+                .collect();
+            if !refs.is_empty() {
+                splices.extend(refs.into_iter().map(|r| (r, to.clone())));
+                edits.push(FileEdit {
+                    kind: CARGO_LOCK_REFERENCE_KIND.into(),
+                    ..edit(&from, &to)
+                });
+            }
+        }
+        // Already redirected (re-run): every fragment is at the target values;
+        // a recorded edit would have original == new and grow the ledger
+        // forever.
+        if edits.is_empty() {
+            return CargoLockPlan::AlreadyRedirected;
+        }
+        CargoLockPlan::Rewritten {
+            content: splice(content, splices),
+            edits,
+        }
+    }
+}
+
+/// Outcome of the Cargo.lock `[[package]]` plan — distinguishes a re-run
+/// over an already-redirected block (no edit, no warning) from a genuinely
+/// missing package (the caller warns AND skips the dep entirely).
+#[derive(Debug)]
+pub(crate) enum CargoLockPlan {
+    Rewritten {
+        content: String,
+        edits: Vec<FileEdit>,
+    },
+    AlreadyRedirected,
+    NotFound,
+    /// Several `[[package]]` blocks for the name@version (multi-source twins)
+    /// and not exactly one of them at the target index — which twin is ours
+    /// cannot be decided, so the caller warns AND skips the dep entirely.
+    Ambiguous,
+}
diff --git a/crates/socket-patch-core/src/formats/cargo/mod.rs b/crates/socket-patch-core/src/formats/cargo/mod.rs
new file mode 100644
index 00000000..58b4dc2b
--- /dev/null
+++ b/crates/socket-patch-core/src/formats/cargo/mod.rs
@@ -0,0 +1,506 @@
+//! `Cargo.lock` (formats v1–v4) and its hosted splices: the ONE model of
+//! the format.
+//!
+//! [`CargoLock`] parses a lock once (`toml_edit`) and answers what the modes
+//! ask of it:
+//!
+//! * [`CargoLock::entries`] — the registry inventory (`scan` / `get`
+//!   lockfile supplements, `vendor`'s pristine fetch);
+//! * [`CargoLock::packages`] — every `[[package]]` as cargo resolves it
+//!   ([`LockedPackage`], a v1 lock's `[metadata]` checksums included), the
+//!   raw material lockfile discovery (`vex::discover::cargo`) classifies as
+//!   hosted / vendored refs and the vendor probes rank;
+//! * [`CargoLock::dependents`] — the packages whose `dependencies` name a
+//!   crate (the hosted planner's unpinnable-dependents refusal);
+//! * [`CargoLock::vendored_in_use`] — whether the lock builds a vendored
+//!   `[patch]` copy ([`CopyClaim`]);
+//! * [`CargoLock::plan_hosted`] ([`hosted`]) — the hosted planner's lock
+//!   splice, at the byte spans [`CargoLock::parse`] records, and the
+//!   [`CargoLock::is_locked`] / [`CargoLock::locked_versions`] probes the
+//!   hosted rewriter reads with;
+//! * the vendored planner (`vendor::cargo_lock`) edits the same document
+//!   with `toml_edit`;
+//!
+//! Everything here is pure; the callers own the reads.
+
+pub(crate) mod hosted;
+
+use std::ops::Range;
+
+use toml_edit::{Document, DocumentMut, Item, Table, Value};
+
+use crate::utils::digest::is_hex;
+use crate::utils::purl::simple_purl;
+use crate::vendor::cargo_tag;
+use crate::vendor::lock_inventory::{LockIntegrity, LockfileEntry, SourceKind};
+
+
+// ── entry model ──
+
+/// The `[metadata]` key a v1 lock files `name`+`version`'s checksum under.
+pub(crate) fn metadata_checksum_key(name: &str, version: &str, source: &str) -> String {
+    format!("checksum {name} {version} ({source})")
+}
+
+/// One `[[package]]` of a parsed `Cargo.lock`, as cargo resolves it — the
+/// read model every Cargo.lock reader shares (the lock inventory, the vendor
+/// probes, lockfile discovery, the hosted planner's dependents check), so a v1 lock's `[metadata]` checksums
+/// and a missing `source` read the same everywhere.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct LockedPackage {
+    pub(crate) name: String,
+    pub(crate) version: String,
+    /// `None` for a workspace member, a path dependency, or a `[patch]` path
+    /// copy (the vendored "detached" shape).
+    pub(crate) source: Option<String>,
+    /// The inline `checksum` (v2+), else a v1 lock's `[metadata]`
+    /// `"checksum <name> <version> (<source>)"` entry — the same pin.
+    pub(crate) checksum: Option<String>,
+    /// The `dependencies` references as spelled (`"name"`, `"name
+    /// version"`, `"name version (source)"`; see [`parse_ref`]).
+    pub(crate) dependencies: Vec<String>,
+}
+
+/// Every `[[package]]` of `doc` (lock formats v1–v4), in lock order; an
+/// entry without a string `name` and `version` is skipped. A lock with no
+/// packages has no `package` key and yields nothing.
+pub(crate) fn locked_packages(doc: &DocumentMut) -> Vec<LockedPackage> {
+    read_packages(doc.as_table(), false)
+        .into_iter()
+        .map(|(pkg, _)| pkg)
+        .collect()
+}
+
+/// Where one `[[package]]`'s pieces sit in the lock text it was parsed
+/// from — what the hosted splice ([`hosted`]) edits, so it rewrites exactly
+/// the bytes the read model read. Every range is a TOML value's own span
+/// (quotes included).
+#[derive(Debug, Clone, Default)]
+pub(crate) struct PackageSpans {
+    /// Offset of the block's `[[package]]` header.
+    pub(crate) header: usize,
+    pub(crate) version: Range<usize>,
+    pub(crate) source: Option<Range<usize>>,
+    /// The inline (v2+) `checksum`.
+    pub(crate) checksum: Option<Range<usize>>,
+    /// Every string value in the block (`dependencies`, a v1 `replace`):
+    /// where a full package id `"name version (source)"` can be spelled.
+    pub(crate) strings: Vec<Range<usize>>,
+}
+
+/// [`locked_packages`] over any root table, with each package's
+/// [`PackageSpans`] when the table was parsed with spans (`spanned`).
+fn read_packages(root: &Table, spanned: bool) -> Vec<(LockedPackage, Option<PackageSpans>)> {
+    let metadata = root.get("metadata").and_then(Item::as_table_like);
+    let metadata_checksum = |name: &str, version: &str, source: Option<&str>| {
+        let key = metadata_checksum_key(name, version, source?);
+        metadata?.get(&key)?.as_str().map(str::to_string)
+    };
+    root.get("package")
+        .and_then(Item::as_array_of_tables)
+        .map(|pkgs| {
+            pkgs.iter()
+                .filter_map(|t| {
+                    let name = t.get("name")?.as_str()?.to_string();
+                    let version = t.get("version")?.as_str()?.to_string();
+                    let source = t.get("source").and_then(Item::as_str).map(str::to_string);
+                    let checksum = t
+                        .get("checksum")
+                        .and_then(Item::as_str)
+                        .map(str::to_string)
+                        .or_else(|| metadata_checksum(&name, &version, source.as_deref()));
+                    let dependencies = t
+                        .get("dependencies")
+                        .and_then(Item::as_array)
+                        .map(|deps| {
+                            deps.iter()
+                                .filter_map(|d| d.as_str().map(str::to_string))
+                                .collect()
+                        })
+                        .unwrap_or_default();
+                    let spans = if spanned { package_spans(t) } else { None };
+                    Some((
+                        LockedPackage {
+                            name,
+                            version,
+                            source,
+                            checksum,
+                            dependencies,
+                        },
+                        spans,
+                    ))
+                })
+                .collect()
+        })
+        .unwrap_or_default()
+}
+
+/// The [`PackageSpans`] of a spanned `[[package]]` table.
+fn package_spans(t: &Table) -> Option<PackageSpans> {
+    let value_span = |key: &str| t.get(key).and_then(Item::as_value).and_then(Value::span);
+    let mut strings = Vec::new();
+    string_spans(t, &mut strings);
+    Some(PackageSpans {
+        header: t.span()?.start,
+        version: value_span("version")?,
+        source: value_span("source"),
+        checksum: value_span("checksum"),
+        strings,
+    })
+}
+
+/// The span of every string value under `t`, arrays and inline tables
+/// included.
+fn string_spans(t: &Table, out: &mut Vec<Range<usize>>) {
+    fn value(v: &Value, out: &mut Vec<Range<usize>>) {
+        match v {
+            Value::String(_) => out.extend(v.span()),
+            Value::Array(a) => a.iter().for_each(|v| value(v, out)),
+            Value::InlineTable(t) => t.iter().for_each(|(_, v)| value(v, out)),
+            _ => {}
+        }
+    }
+    for (_, item) in t.iter() {
+        match item {
+            Item::Value(v) => value(v, out),
+            Item::Table(t) => string_spans(t, out),
+            _ => {}
+        }
+    }
+}
+
+/// The start of every table header (`[x]` / `[[x]]`) in a spanned lock,
+/// sorted: what bounds a `[[package]]` block. Implicit tables (a dotted
+/// `[patch.crates-io]`'s `patch`) have no header of their own.
+fn header_starts(root: &Table, text: &str) -> Vec<usize> {
+    fn walk(t: &Table, text: &str, out: &mut Vec<usize>) {
+        for (_, item) in t.iter() {
+            let tables: Vec<&Table> = match item {
+                Item::Table(t) => vec![t],
+                Item::ArrayOfTables(a) => a.iter().collect(),
+                _ => continue,
+            };
+            for t in tables {
+                if let Some(span) = t.span().filter(|s| text[s.clone()].starts_with('[')) {
+                    out.push(span.start);
+                }
+                walk(t, text, out);
+            }
+        }
+    }
+    let mut out = Vec::new();
+    walk(root, text, &mut out);
+    out.sort_unstable();
+    out
+}
+
+/// The spanned lock's `[metadata]` entries: each key as read, and the
+/// span of its whole `"key" = "value"` line.
+fn metadata_lines(root: &Table) -> Vec<(String, Range<usize>)> {
+    let Some(metadata) = root.get("metadata").and_then(Item::as_table) else {
+        return Vec::new();
+    };
+    metadata
+        .iter()
+        .filter_map(|(key, item)| {
+            let start = metadata.key(key)?.span()?.start;
+            let end = item.as_value()?.span()?.end;
+            Some((key.to_string(), start..end))
+        })
+        .collect()
+}
+
+/// `(name, version)` of every `[[patch.unused]]` entry: a `[patch]` cargo
+/// resolved and then did NOT use in the crate graph — the lock's own record
+/// that a patch (e.g. a vendored copy) is not what builds.
+pub(crate) fn unused_patches(root: &Table) -> Vec<(String, String)> {
+    root.get("patch")
+        .and_then(|patch| patch.get("unused"))
+        .and_then(Item::as_array_of_tables)
+        .map(|entries| {
+            entries
+                .iter()
+                .filter_map(|t| {
+                    Some((
+                        t.get("name")?.as_str()?.to_string(),
+                        t.get("version")?.as_str()?.to_string(),
+                    ))
+                })
+                .collect()
+        })
+        .unwrap_or_default()
+}
+
+/// How `Cargo.lock` relates to the `[patch]` path copy of `name`@`version`
+/// vendored for patch `uuid` ([`vendored_copy_claim`]).
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) enum CopyClaim<'a> {
+    /// The lock builds this copy.
+    Consumed,
+    /// The lock builds the copy tagged for ANOTHER patch uuid (and none
+    /// tagged for this one): a stale lock, or a `[patch]` override
+    /// elsewhere.
+    OtherTag(&'a str),
+    /// The copy is tagged, but the lock holds only UNTAGGED sourceless
+    /// entries: cargo built some other untagged crate (a config-level
+    /// override, a user path dependency), never this copy.
+    UntaggedOverride,
+    /// No sourceless entry for it, or cargo recorded the patch as
+    /// `[[patch.unused]]`.
+    NotConsumed,
+}
+
+/// Whether the lock BUILDS the `[patch]` path copy of `name`@`version`
+/// vendored for patch `uuid`. `copy_tagged`: the copy's own `Cargo.toml`
+/// carries a Socket version tag (every copy vendored since tagged
+/// versions; `false` for a copy vendored before them, or none on disk).
+///
+/// * a SOURCELESS entry at the tagged version `<version>+socket.<uuid>`
+///   (and no `[[patch.unused]]` for it) is this copy — whatever untagged
+///   sourceless siblings exist (real cargo 1.97 locks a member's own path
+///   dependency on a same-version fork beside the tagged copy);
+/// * otherwise a sourceless entry tagged for ANOTHER uuid is another
+///   copy's resolution → [`CopyClaim::OtherTag`], even beside an untagged
+///   sibling;
+/// * an UNTAGGED sourceless entry is the pre-tag legacy shape only while
+///   the copy is untagged too: cargo locks a tagged copy at its tagged
+///   version, so for a tagged copy the untagged entry is something else
+///   cargo built → [`CopyClaim::UntaggedOverride`].
+///
+/// A sourceless entry alone does not prove the copy builds — a path
+/// dependency on the user's own checkout of the crate is sourceless too,
+/// and cargo records the `[patch]` it resolved but left out of the graph as
+/// `[[patch.unused]]` (real cargo 1.97: `serde = { path = "my-serde" }`
+/// beside a stale `[patch]` locks a sourceless serde AND
+/// `[[patch.unused]] serde`).
+pub(crate) fn vendored_copy_claim<'a>(
+    pkgs: &'a [LockedPackage],
+    unused: &[(String, String)],
+    name: &str,
+    version: &str,
+    uuid: &str,
+    copy_tagged: bool,
+) -> CopyClaim<'a> {
+    let mut own = false;
+    let mut other: Option<&'a str> = None;
+    let mut untagged = false;
+    for p in pkgs
+        .iter()
+        .filter(|p| p.name == name && p.source.is_none() && cargo_tag::denotes(&p.version, version))
+    {
+        match cargo_tag::tag_uuid(&p.version) {
+            Some(tag) if tag == uuid => own = true,
+            Some(tag) => {
+                other.get_or_insert(tag);
+            }
+            None => untagged = true,
+        }
+    }
+    let unused_hit = unused
+        .iter()
+        .any(|(n, v)| n == name && cargo_tag::denotes(v, version));
+    if own {
+        return if unused_hit {
+            CopyClaim::NotConsumed
+        } else {
+            CopyClaim::Consumed
+        };
+    }
+    if let Some(tag) = other {
+        return CopyClaim::OtherTag(tag);
+    }
+    if !untagged || unused_hit {
+        return CopyClaim::NotConsumed;
+    }
+    if copy_tagged {
+        CopyClaim::UntaggedOverride
+    } else {
+        CopyClaim::Consumed
+    }
+}
+
+/// `(name, version, source)` of a dependency reference string
+/// (`"name"`, `"name version"`, `"name version (source)"`).
+pub(crate) fn parse_ref(spelled: &str) -> (&str, Option<&str>, Option<&str>) {
+    let mut parts = spelled.splitn(3, ' ');
+    let name = parts.next().unwrap_or_default();
+    let version = parts.next();
+    let source = parts
+        .next()
+        .and_then(|s| s.strip_prefix('('))
+        .and_then(|s| s.strip_suffix(')'));
+    (name, version, source)
+}
+
+
+// ── the model ──
+
+/// One `Cargo.lock`, parsed once (see the module docs).
+#[derive(Debug)]
+pub struct CargoLock {
+    packages: Vec<LockedPackage>,
+    unused: Vec<(String, String)>,
+    /// Present when parsed from text ([`CargoLock::parse`]): where each
+    /// package, table header and `[metadata]` line sits in it.
+    spans: Option<LockSpans>,
+}
+
+/// The byte spans of a [`CargoLock`] parsed from text.
+#[derive(Debug)]
+pub(crate) struct LockSpans {
+    /// Parallel to [`CargoLock::packages`].
+    pub(crate) packages: Vec<PackageSpans>,
+    /// Every table header's start, sorted.
+    pub(crate) headers: Vec<usize>,
+    /// The string values of a v1 lock's standalone `[root]` table.
+    pub(crate) root_strings: Vec<Range<usize>>,
+    /// `[metadata]` keys and their line spans.
+    pub(crate) metadata: Vec<(String, Range<usize>)>,
+}
+
+impl CargoLock {
+    /// The model of an already-parsed lock document (no spans: a
+    /// `DocumentMut` keeps none).
+    pub fn from_doc(doc: &DocumentMut) -> Self {
+        CargoLock {
+            packages: locked_packages(doc),
+            unused: unused_patches(doc.as_table()),
+            spans: None,
+        }
+    }
+
+    /// Parse a lock text, keeping every span the hosted splice edits;
+    /// `Err` when it is not TOML (cargo itself refuses to build from it).
+    pub fn parse(text: &str) -> Result<Self, toml_edit::TomlError> {
+        let doc = Document::parse(text)?;
+        let root = doc.as_table();
+        let mut packages = Vec::new();
+        let mut spans = Vec::new();
+        let mut spanned = true;
+        for (pkg, span) in read_packages(root, true) {
+            packages.push(pkg);
+            match span {
+                Some(span) => spans.push(span),
+                None => spanned = false,
+            }
+        }
+        let root_strings = root
+            .get("root")
+            .and_then(Item::as_table)
+            .map(|t| {
+                let mut out = Vec::new();
+                string_spans(t, &mut out);
+                out
+            })
+            .unwrap_or_default();
+        Ok(CargoLock {
+            unused: unused_patches(root),
+            spans: spanned.then(|| LockSpans {
+                packages: spans,
+                headers: header_starts(root, text),
+                root_strings,
+                metadata: metadata_lines(root),
+            }),
+            packages,
+        })
+    }
+
+    /// The spans, when parsed from text.
+    pub(crate) fn spans(&self) -> Option<&LockSpans> {
+        self.spans.as_ref()
+    }
+
+    /// Whether the lock holds a `[[package]]` for `name`@`version`.
+    pub(crate) fn is_locked(&self, name: &str, version: &str) -> bool {
+        self.packages
+            .iter()
+            .any(|p| p.name == name && p.version == version)
+    }
+
+    /// Every version of `name` the lock holds, sorted and deduplicated.
+    pub(crate) fn locked_versions(&self, name: &str) -> Vec<String> {
+        let mut versions: Vec<String> = self
+            .packages
+            .iter()
+            .filter(|p| p.name == name)
+            .map(|p| p.version.clone())
+            .collect();
+        versions.sort();
+        versions.dedup();
+        versions
+    }
+
+    /// Every `[[package]]`, in lock order.
+    pub(crate) fn packages(&self) -> &[LockedPackage] {
+        &self.packages
+    }
+
+    /// The registry inventory: one entry per SOURCED `[[package]]`
+    /// (workspace members and vendored copies have none), under its purl
+    /// identity (a Socket tag stripped). Only a crates.io entry whose
+    /// checksum is a 64-hex `.crate` sha256 — and whose version is not
+    /// tagged — carries a verifier; git / custom-registry sources stay
+    /// listed for discovery without one.
+    pub fn entries(&self) -> Vec<LockfileEntry> {
+        let mut out = Vec::new();
+        for pkg in &self.packages {
+            let Some(source) = &pkg.source else {
+                continue; // workspace member
+            };
+            let version = cargo_tag::strip_tag(&pkg.version).to_string();
+            let tagged = version != pkg.version;
+            let Some(purl) = simple_purl("cargo", &pkg.name, &version) else {
+                continue;
+            };
+            let crates_io = source.contains("github.com/rust-lang/crates.io-index")
+                || source.contains("index.crates.io");
+            // The crates.io provenance is recorded exactly where the checksum
+            // is kept as the `.crate`'s sha256.
+            let (integrity, source_kind) = match &pkg.checksum {
+                Some(c) if crates_io && !tagged && is_hex(c, 64) => {
+                    (LockIntegrity::Sha256Hex(c.clone()), SourceKind::CratesIo)
+                }
+                _ => (LockIntegrity::None, SourceKind::Unspecified),
+            };
+            out.push(LockfileEntry {
+                ecosystem: "cargo",
+                source_kind,
+                purl,
+                name: pkg.name.clone(),
+                version,
+                resolved: None,
+                integrity,
+            });
+        }
+        out
+    }
+
+    /// Every package whose `dependencies` reference `name` at `version` (or
+    /// by plain name, which cargo writes while the name is unambiguous), in
+    /// lock order.
+    pub(crate) fn dependents<'a>(
+        &'a self,
+        name: &'a str,
+        version: &'a str,
+    ) -> impl Iterator<Item = &'a LockedPackage> + 'a {
+        self.packages.iter().filter(move |p| {
+            p.dependencies.iter().any(|d| {
+                let (n, v, _) = parse_ref(d);
+                n == name && v.is_none_or(|v| v == version)
+            })
+        })
+    }
+
+    /// How the lock relates to the vendored `[patch]` copy of
+    /// `name`@`version` for patch `uuid` ([`vendored_copy_claim`]).
+    pub(crate) fn vendored_in_use(
+        &self,
+        name: &str,
+        version: &str,
+        uuid: &str,
+        copy_tagged: bool,
+    ) -> CopyClaim<'_> {
+        vendored_copy_claim(&self.packages, &self.unused, name, version, uuid, copy_tagged)
+    }
+}
+
diff --git a/crates/socket-patch-core/src/formats/composer/hosted.rs b/crates/socket-patch-core/src/formats/composer/hosted.rs
new file mode 100644
index 00000000..0ab5dae3
--- /dev/null
+++ b/crates/socket-patch-core/src/formats/composer/hosted.rs
@@ -0,0 +1,317 @@
+//! The hosted planner's `composer.lock` leg: repoint a package's `dist` at
+//! its Socket-hosted archive (url + `shasum`, dropping the `source` block
+//! composer would otherwise prefer) as a byte splice over composer's own
+//! pretty-printed JSON, so every untouched byte — key order, escapes, line
+//! endings — survives. A serde round trip cannot give those offsets, which
+//! is why this scanner is separate from the read model in the parent.
+
+use std::collections::BTreeMap;
+use std::sync::LazyLock;
+
+use regex::Regex;
+use serde_json::Value;
+
+use crate::crawlers::composer_crawler::normalize_version;
+use crate::patch::redirect::{
+    artifact_url_present, full_name, DepOverride, FileEdit, RewriteResult, RewriteWarning,
+};
+
+/// Byte offset of the `}` closing the JSON object that CONTAINS `from`, which
+/// must be a position inside that object. Brace counting skips string literals,
+/// so a brace inside a description or URL cannot move the boundary.
+///
+/// Walks bytes, not chars: every byte it acts on is ASCII, and no byte of a
+/// multi-byte UTF-8 sequence is, so the offsets are the char walk's (an
+/// escaped multi-byte char clears `escaped` on its lead byte).
+pub(crate) fn json_object_end_from(text: &str, from: usize) -> Option<usize> {
+    let mut depth = 0usize;
+    let mut in_string = false;
+    let mut escaped = false;
+    for (offset, &byte) in text.as_bytes()[from..].iter().enumerate() {
+        if in_string {
+            match byte {
+                _ if escaped => escaped = false,
+                b'\\' => escaped = true,
+                b'"' => in_string = false,
+                _ => {}
+            }
+            continue;
+        }
+        match byte {
+            b'"' => in_string = true,
+            b'{' => depth += 1,
+            b'}' if depth == 0 => return Some(from + offset),
+            b'}' => depth -= 1,
+            _ => {}
+        }
+    }
+    None
+}
+
+/// Value of the first `"<key>": "<value>"` pair in `text` (composer writes its
+/// lock with exactly one space after the colon, the same shape the surgical
+/// `dist` regexes below assume).
+pub(crate) fn json_string_field<'a>(text: &'a str, key: &str) -> Option<&'a str> {
+    let pattern = format!("\"{key}\": \"");
+    let start = text.find(&pattern)? + pattern.len();
+    let end = text[start..].find('"')? + start;
+    Some(&text[start..end])
+}
+
+/// Outcome of locating a package entry in a composer.lock.
+pub(crate) enum ComposerEntry {
+    /// Inclusive byte range from the entry's `"name"` key to the `}` closing
+    /// the entry — composer writes `name` first, so this covers every key the
+    /// rewriter edits.
+    Found(usize, usize),
+    /// The name matched but the lock pins this OTHER version.
+    VersionMismatch(String),
+    NotFound,
+}
+
+/// Locate `pkg`'s entry in a composer.lock (either `packages[]` or
+/// `packages-dev[]` — the scan is over the whole file).
+///
+/// Names match CASE-INSENSITIVELY, the way the composer crawler and the vendor
+/// backend already match them: packagist canonicalizes to lowercase, but
+/// hand-written mixed-case locks install fine and would otherwise silently miss
+/// the redirect. The locked version must match the patched one through
+/// composer's leading-`v` normalization (locks carry the pretty `v6.4.1`, PURLs
+/// the bare `6.4.1`); matching on name alone would repoint whatever version
+/// the lock happened to hold at a patch built for a different one.
+pub(crate) fn find_composer_entry(content: &str, pkg: &str, version: &str) -> ComposerEntry {
+    let mut mismatched: Option<String> = None;
+    for (name_idx, _) in content.match_indices("\"name\": \"") {
+        // The name is the value at `name_idx` — the entry's first field —
+        // and its closing quote precedes any `}` the object walk can stop
+        // at, so test it before walking to the end of the object: most
+        // occurrences name some other package.
+        if !json_string_field(&content[name_idx..], "name")
+            .is_some_and(|n| n.eq_ignore_ascii_case(pkg))
+        {
+            continue;
+        }
+        let Some(end) = json_object_end_from(content, name_idx) else {
+            continue;
+        };
+        let entry = &content[name_idx..=end];
+        // Every package entry carries `version`; an `authors[]`/`support`
+        // object that happens to have a matching `name` does not.
+        let Some(locked) = json_string_field(entry, "version") else {
+            continue;
+        };
+        if normalize_version(locked) == normalize_version(version) {
+            return ComposerEntry::Found(name_idx, end);
+        }
+        mismatched = Some(locked.to_string());
+    }
+    match mismatched {
+        Some(locked) => ComposerEntry::VersionMismatch(locked),
+        None => ComposerEntry::NotFound,
+    }
+}
+
+/// Append `"shasum": "<sha1>"` as the last key of a `"dist": { … }` block,
+/// indented like the keys already in it. VCS/zipball dists omit `shasum`
+/// entirely; redirecting such a block without inserting the pin would leave the
+/// hosted artifact unverified, so composer would install whatever the URL returned.
+/// `block` is the whole dist object and already holds at least a `url`.
+pub(crate) fn append_composer_shasum(block: &str, sha1: &str) -> String {
+    let Some(close) = block.rfind('}') else {
+        return block.to_string();
+    };
+    let head = block[..close].trim_end();
+    let indent: String = head[head.rfind('\n').map_or(0, |i| i + 1)..]
+        .chars()
+        .take_while(|c| c.is_whitespace())
+        .collect();
+    format!(
+        "{head},\n{indent}\"shasum\": \"{sha1}\"{}",
+        &block[head.len()..]
+    )
+}
+
+pub(crate) static COMPOSER_DIST_TYPE_RE: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(r#"("type": ")[^"]*(")"#).expect("static dist type regex is valid")
+});
+pub(crate) static COMPOSER_DIST_URL_RE: LazyLock<Regex> =
+    LazyLock::new(|| Regex::new(r#"("url": ")[^"]*(")"#).expect("static dist url regex is valid"));
+pub(crate) static COMPOSER_DIST_SHASUM_RE: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(r#"("shasum": ")[^"]*(")"#).expect("static dist shasum regex is valid")
+});
+
+/// Byte offset of the entry's `"source": {` key when that object is the
+/// dist block's IMMEDIATE predecessor (only `,` + whitespace between them) —
+/// the layout composer itself always writes (`source` then `dist`).
+/// `None` when the entry has no source object there.
+pub(crate) fn composer_source_before_dist(
+    content: &str,
+    entry_start: usize,
+    dist_start: usize,
+) -> Option<usize> {
+    const SOURCE_KEY: &str = "\"source\": {";
+    let source_start = entry_start + content[entry_start..dist_start].rfind(SOURCE_KEY)?;
+    let source_end = json_object_end_from(content, source_start + SOURCE_KEY.len())?;
+    (source_end < dist_start && content[source_end + 1..dist_start].trim() == ",")
+        .then_some(source_start)
+}
+
+pub(crate) fn rewrite_composer_lock(
+    files: &BTreeMap<String, String>,
+    overrides: &[DepOverride],
+    result: &mut RewriteResult,
+) {
+    let composer: Vec<&DepOverride> = overrides
+        .iter()
+        .filter(|o| o.ecosystem == "composer")
+        .collect();
+    if composer.is_empty() {
+        return;
+    }
+    // Parity with `redirect_npm_no_lockfile`: a granted dep the project has
+    // no lock to pin must be SAID, not silently dropped from the redirected
+    // count (a composer.json + installed vendor tree without a lock is
+    // discovered and granted like any other).
+    if !files.contains_key("composer.lock") {
+        result.warnings.push(RewriteWarning {
+            code: "redirect_composer_no_lockfile".into(),
+            detail: "no composer.lock present; composer redirect skipped".into(),
+        });
+        return;
+    }
+    const DIST_KEY: &str = "\"dist\": {";
+    let mut content = files["composer.lock"].clone();
+    let type_re: &Regex = &COMPOSER_DIST_TYPE_RE;
+    let url_re: &Regex = &COMPOSER_DIST_URL_RE;
+    let shasum_re: &Regex = &COMPOSER_DIST_SHASUM_RE;
+    let mut changed = false;
+    for dep in &composer {
+        let composer_name = full_name(dep);
+        let Some(sha1) = dep.integrity.sha1.clone() else {
+            result.warnings.push(RewriteWarning {
+                code: "redirect_composer_missing_sha1".into(),
+                detail: format!("{composer_name} has no sha1 (dist.shasum) integrity"),
+            });
+            continue;
+        };
+        let (entry_start, entry_end) =
+            match find_composer_entry(&content, &composer_name, &dep.version) {
+                ComposerEntry::Found(start, end) => (start, end),
+                ComposerEntry::VersionMismatch(locked) => {
+                    result.warnings.push(RewriteWarning {
+                        code: "redirect_composer_version_mismatch".into(),
+                        detail: format!(
+                            "composer.lock pins {composer_name}@{locked}, not the patched {}",
+                            dep.version
+                        ),
+                    });
+                    continue;
+                }
+                ComposerEntry::NotFound => {
+                    result.warnings.push(RewriteWarning {
+                        code: "redirect_composer_pkg_not_found".into(),
+                        detail: format!(
+                            "no composer.lock package named {composer_name}@{}",
+                            dep.version
+                        ),
+                    });
+                    continue;
+                }
+            };
+        // The dist block MUST belong to the located entry. Scanning forward
+        // from the name for the next `"dist": {` would walk into the FOLLOWING
+        // package whenever the target was installed from source, repointing a
+        // bystander's url + shasum — a checksum-clean install of the wrong
+        // code. A target with no dist of its own pins nothing: fail closed.
+        let Some(dist_start) = content[entry_start..=entry_end]
+            .find(DIST_KEY)
+            .map(|offset| entry_start + offset)
+        else {
+            result.warnings.push(RewriteWarning {
+                code: "redirect_composer_no_dist".into(),
+                detail: format!("{composer_name} has no dist block"),
+            });
+            continue;
+        };
+        let Some(dist_end) = json_object_end_from(&content, dist_start + DIST_KEY.len()) else {
+            result.warnings.push(RewriteWarning {
+                code: "redirect_composer_lock_malformed".into(),
+                detail: format!("{composer_name}'s dist block is unterminated"),
+            });
+            continue;
+        };
+        let block = content[dist_start..=dist_end].to_string();
+        // Already redirected (either slash spelling): recording an edit whose
+        // `original` IS the hosted url would grow the ledger on every re-run
+        // and poison a future revert.
+        if artifact_url_present(&block, &dep.artifact_url) && block.contains(&sha1) {
+            continue;
+        }
+        if !block.contains("\"url\": \"") {
+            result.warnings.push(RewriteWarning {
+                code: "redirect_composer_no_dist_url".into(),
+                detail: format!("{composer_name}'s dist block has no url to redirect"),
+            });
+            continue;
+        }
+        let mut rewritten = type_re.replace(&block, "${1}zip${2}").to_string();
+        rewritten = url_re
+            .replace(
+                &rewritten,
+                format!("${{1}}{}${{2}}", dep.artifact_url).as_str(),
+            )
+            .to_string();
+        rewritten = if rewritten.contains("\"shasum\": \"") {
+            shasum_re
+                .replace(&rewritten, format!("${{1}}{sha1}${{2}}").as_str())
+                .to_string()
+        } else {
+            append_composer_shasum(&rewritten, &sha1)
+        };
+        // Drop the entry's `source` (the vendored backend does the same):
+        // when the dist download fails — checksum mismatch, an expired grant
+        // token, a patch-server outage — composer 1 and composer 2 before its
+        // source-fallback cutoff (2.2 LTS included) print "Now trying to
+        // download from source" and silently install the PRISTINE upstream
+        // commit from git, and `--prefer-source` / `preferred-install:
+        // source` always does. With the source gone the hosted archive is
+        // the only way to install the package, so a failed fetch fails the
+        // install instead of shipping the vulnerable code. The edit then
+        // spans `"source": {…},\n<indent>"dist": {…}`, so the ledger's
+        // fragment revert puts both blocks back byte-for-byte.
+        let (edit_start, original) =
+            match composer_source_before_dist(&content, entry_start, dist_start) {
+                Some(source_start) => (source_start, content[source_start..=dist_end].to_string()),
+                None => {
+                    if content[entry_start..=entry_end].contains("\"source\": {") {
+                        result.warnings.push(RewriteWarning {
+                            code: "redirect_composer_source_kept".into(),
+                            detail: format!(
+                                "{composer_name}'s source block does not directly precede its \
+                                 dist and was left in place; a failed hosted download may fall \
+                                 back to it"
+                            ),
+                        });
+                    }
+                    (dist_start, block.clone())
+                }
+            };
+        if rewritten != original {
+            // In place: a fresh whole-lock copy per edit would hold one
+            // lock-sized buffer per redirected dep.
+            content.replace_range(edit_start..=dist_end, &rewritten);
+            changed = true;
+            result.edits.push(FileEdit {
+                path: "composer.lock".into(),
+                kind: "redirect_composer_dist".into(),
+                action: "rewritten".into(),
+                key: Some(composer_name),
+                original: Some(Value::String(original)),
+                new: Some(Value::String(rewritten)),
+            });
+        }
+    }
+    if changed {
+        result.files.insert("composer.lock".into(), content);
+    }
+}
diff --git a/crates/socket-patch-core/src/formats/composer/mod.rs b/crates/socket-patch-core/src/formats/composer/mod.rs
new file mode 100644
index 00000000..1da78fce
--- /dev/null
+++ b/crates/socket-patch-core/src/formats/composer/mod.rs
@@ -0,0 +1,176 @@
+//! `composer.lock`: the ONE model of the format.
+//!
+//! [`ComposerLock`] reads a parsed lock once and answers what the modes ask
+//! of it:
+//!
+//! * [`ComposerLock::entries`] — the registry inventory;
+//! * [`ComposerLock::packages`] — every `packages` / `packages-dev` entry
+//!   ([`ComposerLockPackage`]), the raw material lockfile discovery
+//!   (`vex::discover::composer`) classifies as hosted / vendored refs and
+//!   the vendored backend (`vendor::composer_lock`) indexes its edits and
+//!   its ownership gate ([`ComposerLockPackage::wired_to`]) by;
+//! * [`hosted::rewrite_composer_lock`] — the hosted planner's byte splice;
+
+pub(crate) mod hosted;
+
+use serde_json::Value;
+
+use crate::crawlers::composer_crawler::normalize_version;
+use crate::patch::path_safety;
+use crate::utils::digest::sha1_hex;
+use crate::vendor::lock_inventory::{http_url, LockIntegrity, LockfileEntry, SourceKind};
+use crate::vendor::path::{parse_vendor_path, VendorPathParts};
+
+
+// ── entry model ──
+
+/// One entry of a parsed `composer.lock` (see [`composer_lock_packages`]).
+pub(crate) struct ComposerLockPackage<'a> {
+    /// `packages` or `packages-dev`.
+    pub(crate) section: &'static str,
+    /// The position in the section ARRAY, counting non-object elements too:
+    /// what a writer indexes `lock[section][index]` with.
+    pub(crate) index: usize,
+    pub(crate) name: Option<&'a str>,
+    /// As locked — the pretty `v`-prefixed spelling; callers normalize
+    /// through [`normalize_version`].
+    pub(crate) version: Option<&'a str>,
+    /// The `dist` object: what composer's default `--prefer-dist` install
+    /// consumes, and the block both backends rewrite.
+    pub(crate) dist: Option<&'a Value>,
+}
+
+impl<'a> ComposerLockPackage<'a> {
+    /// One section element read as an entry (a recorded wiring fragment is
+    /// read through this too, so it answers exactly as the live lock would).
+    pub(crate) fn of(section: &'static str, index: usize, pkg: &'a Value) -> Self {
+        ComposerLockPackage {
+            section,
+            index,
+            name: pkg.get("name").and_then(Value::as_str),
+            version: pkg.get("version").and_then(Value::as_str),
+            dist: pkg.get("dist"),
+        }
+    }
+
+    /// A string field of the entry's `dist`.
+    pub(crate) fn dist_str(&self, key: &str) -> Option<&str> {
+        self.dist?.get(key)?.as_str()
+    }
+
+    /// The `dist.shasum` pin: a 40-hex sha1 of the dist archive (any case,
+    /// lowercased), whatever the dist `type` — the inventory additionally
+    /// requires a `zip` dist at its call site.
+    pub(crate) fn dist_sha1(&self) -> Option<LockIntegrity> {
+        self.dist_str("shasum")
+            .and_then(sha1_hex)
+            .map(LockIntegrity::Sha1Hex)
+    }
+
+    /// The Socket-vendored path `dist.url` names, anchored anywhere
+    /// ([`parse_vendor_path`]: the writers' ownership rule, not discovery's
+    /// root-anchored attestation grammar).
+    pub(crate) fn dist_vendor_path(&self) -> Option<VendorPathParts> {
+        self.dist_str("url").and_then(parse_vendor_path)
+    }
+
+    /// Whether the entry's `dist.url` points into patch `uuid`'s vendored
+    /// composer copy — the ownership gate every restore / strand check
+    /// applies.
+    pub(crate) fn wired_to(&self, uuid: &str) -> bool {
+        self.dist_vendor_path()
+            .is_some_and(|p| p.eco == "composer" && p.uuid == uuid)
+    }
+}
+
+/// Every entry composer installs from a parsed `composer.lock`, in lock
+/// order: `packages`, then `packages-dev` (composer installs both by
+/// default; a missing or non-array section is empty). The one walk the
+/// inventory and lockfile discovery (`vex::discover::composer`) share.
+pub(crate) fn composer_lock_packages(doc: &Value) -> Vec<ComposerLockPackage<'_>> {
+    let mut out = Vec::new();
+    for section in ["packages", "packages-dev"] {
+        for (index, pkg) in doc
+            .get(section)
+            .and_then(Value::as_array)
+            .into_iter()
+            .flatten()
+            .enumerate()
+        {
+            out.push(ComposerLockPackage::of(section, index, pkg));
+        }
+    }
+    out
+}
+
+
+// ── the model ──
+
+/// One `composer.lock`, read once (see the module docs).
+pub struct ComposerLock<'a> {
+    packages: Vec<ComposerLockPackage<'a>>,
+}
+
+impl<'a> ComposerLock<'a> {
+    /// The model of a parsed lock document.
+    pub fn from_doc(doc: &'a Value) -> Self {
+        ComposerLock {
+            packages: composer_lock_packages(doc),
+        }
+    }
+
+    /// Every entry, in install order ([`composer_lock_packages`]).
+    pub(crate) fn packages(&self) -> &[ComposerLockPackage<'a>] {
+        &self.packages
+    }
+
+    /// The registry inventory: every entry with a safe `vendor/name` and
+    /// version, names lowercased to the canonical packagist form and
+    /// versions normalized through the crawler's [`normalize_version`] (so
+    /// installed and lockfile rows agree). Our own vendored path dists are
+    /// skipped; `dist.shasum` (the zip's sha1, frequently empty) is the
+    /// verifier of a zip dist only.
+    pub fn entries(&self) -> Vec<LockfileEntry> {
+        let mut out = Vec::new();
+        for pkg in &self.packages {
+            let (Some(name), Some(version)) = (pkg.name, pkg.version) else {
+                continue;
+            };
+            let name = name.to_ascii_lowercase();
+            // Share the crawler's normalization rather than re-deriving it:
+            // it strips `v` AND `V` (both are legal Composer tags), and a
+            // lockfile row that normalizes differently from the installed
+            // row double-counts the package — one installed `@1.2.3` plus a
+            // phantom lockfile-only `@V1.2.3`, both POSTed.
+            let version = normalize_version(version).to_string();
+            if !path_safety::is_safe_multi_segment(&name)
+                || name.split('/').count() != 2
+                || !path_safety::is_safe_single_segment(&version)
+            {
+                continue;
+            }
+            // Our own vendored entries use a path dist — skip.
+            if pkg.dist_str("type") == Some("path") || pkg.dist_vendor_path().is_some() {
+                continue;
+            }
+            let dist_url = pkg.dist_str("url").unwrap_or("");
+            let is_zip = pkg.dist_str("type") == Some("zip");
+            let integrity = match pkg.dist_sha1() {
+                Some(sha1) if is_zip => sha1,
+                _ => LockIntegrity::None,
+            };
+            let purl = format!("pkg:composer/{name}@{version}");
+            out.push(LockfileEntry {
+                ecosystem: "composer",
+                source_kind: SourceKind::Unspecified,
+                name,
+                version,
+                purl,
+                resolved: is_zip.then(|| http_url(dist_url)).flatten(),
+                integrity,
+            });
+        }
+        out
+    }
+}
+
diff --git a/crates/socket-patch-core/src/formats/gem/hosted.rs b/crates/socket-patch-core/src/formats/gem/hosted.rs
new file mode 100644
index 00000000..0416c359
--- /dev/null
+++ b/crates/socket-patch-core/src/formats/gem/hosted.rs
@@ -0,0 +1,307 @@
+//! The hosted planner's Bundler-lock leg: converge a redirected gem's source
+//! attribution (its spec block moved into a patch-registry `GEM` section,
+//! DEPENDENCIES source-pinned) as a line splice that keeps every line's own
+//! `\r\n` / `\n` ending. The read model in the parent keeps no spans or
+//! endings, which is why this walker is separate from it.
+
+use regex::Regex;
+use serde_json::Value;
+
+use crate::patch::redirect::{gem_index_url_pattern, DepOverride, FileEdit, RewriteResult};
+
+/// A lock line without its `\r?\n` ending (never more than one of each).
+fn gem_lock_line_content(line: &str) -> &str {
+    let line = line.strip_suffix('\n').unwrap_or(line);
+    line.strip_suffix('\r').unwrap_or(line)
+}
+
+/// The gem name of a 2-space DEPENDENCIES entry (`  rails`, `  rails!`,
+/// `  rails (= 7.0.0)!`) — the text before any constraint, sans source pin.
+fn gem_lock_dependency_name(entry: &str) -> &str {
+    let entry = entry.trim_start();
+    let entry = entry.split(" (").next().unwrap_or(entry);
+    entry.trim_end_matches('!')
+}
+
+/// One parsed `GEM` section of a Gemfile.lock: its header line index, its
+/// `remote:` lines (index + URL) and the exclusive end index — the start of
+/// the next column-0 header (trailing blank separator included) or EOF.
+struct GemLockSection {
+    start: usize,
+    remotes: Vec<(usize, String)>,
+    end: usize,
+}
+
+/// Converge the lock's source attribution for one redirected dep so the
+/// Gemfile + lock pair is what bundler itself would write after an install
+/// from the redirected Gemfile (verified frozen-installable on bundler 4):
+/// the dep's spec entry (+ its dependency sublines) moves out of the
+/// upstream `GEM` section into a patch-registry `GEM` section
+/// (`remote: <index-url>`), and DEPENDENCIES pins `<name> (= <version>)!`
+/// (bundler's source-pin spelling for a block-scoped exact-version gem) —
+/// added in sorted position when the dep was transitive. Without this the
+/// CHECKSUMS pin leaves a MIXED state bundler refuses: the lock still
+/// attributes the gem to the upstream remote, so the prescribed unfrozen
+/// install exits 37 "mismatched checksums" and a frozen install exits 16.
+///
+/// Idempotent and rotation-aware: a section whose remote matches the
+/// token-wildcard pattern is recognized as ours (never duplicated) and its
+/// remote is refreshed in place under a rotated grant
+/// (`redirect_gemfile_lock_source_url`, mirroring the Gemfile refresh).
+///
+/// Returns true when the lock ends converged (already, or via edits recorded
+/// into `result`); false when the dep cannot be attributed safely — spec
+/// entry absent or duplicated, a legacy multi-remote `GEM` section, or no
+/// DEPENDENCIES section — in which case nothing is touched and the caller
+/// surfaces the frozen-install caveat.
+pub(crate) fn converge_gem_lock_source(
+    lk: &mut String,
+    dep: &DepOverride,
+    index_url: &str,
+    lock_name: &str,
+    lock_changed: &mut bool,
+    result: &mut RewriteResult,
+) -> bool {
+    let eol = if lk.contains("\r\n") { "\r\n" } else { "\n" };
+    let mut lines: Vec<String> = lk.split_inclusive('\n').map(str::to_string).collect();
+    let is_header = |c: &str| !c.is_empty() && !c.starts_with(' ');
+
+    // Parse: GEM sections, the dep's 4-space spec entry, DEPENDENCIES range.
+    let spec_content = format!("    {} ({})", dep.name, dep.version);
+    let mut sections: Vec<GemLockSection> = Vec::new();
+    let mut spec_at: Vec<(usize, usize)> = Vec::new(); // (section idx, line idx)
+    let mut deps_range: Option<(usize, usize)> = None; // exclusive of header
+    let mut i = 0;
+    while i < lines.len() {
+        let c = gem_lock_line_content(&lines[i]);
+        if !is_header(c) {
+            i += 1;
+            continue;
+        }
+        let header_is_gem = c == "GEM";
+        let start = i;
+        let mut remotes = Vec::new();
+        let mut j = i + 1;
+        while j < lines.len() && !is_header(gem_lock_line_content(&lines[j])) {
+            let cj = gem_lock_line_content(&lines[j]);
+            if header_is_gem {
+                if let Some(url) = cj.strip_prefix("  remote: ") {
+                    remotes.push((j, url.to_string()));
+                }
+                if cj == spec_content {
+                    spec_at.push((sections.len(), j));
+                }
+            }
+            j += 1;
+        }
+        if header_is_gem {
+            sections.push(GemLockSection {
+                start,
+                remotes,
+                end: j,
+            });
+        } else if c == "DEPENDENCIES" {
+            deps_range = Some((start + 1, j));
+        }
+        i = j;
+    }
+
+    let spec_pos = if spec_at.len() == 1 {
+        Some(spec_at[0])
+    } else {
+        None
+    };
+    let (Some((sec_idx, spec_idx)), Some((deps_start, deps_end))) = (spec_pos, deps_range) else {
+        return false;
+    };
+    if sections[sec_idx].remotes.len() != 1 {
+        return false;
+    }
+    // Bundler always writes source sections before DEPENDENCIES — the pin
+    // edit below runs first on that premise (its lines sit after the parsed
+    // spec/remote/end indices, so they never shift). A hand-edited lock with
+    // DEPENDENCIES before the dep's GEM section breaks the premise: the
+    // transitive-dep pin INSERT would leave the spec-move splicing on stale
+    // indices. Fail soft to the mixed state instead.
+    if deps_start < sections[sec_idx].end {
+        return false;
+    }
+    let (remote_idx, remote_url) = sections[sec_idx].remotes[0].clone();
+    let socket_remote_re = Regex::new(&format!("^{}$", gem_index_url_pattern(dep, index_url)))
+        .expect("anchored index-url pattern from the escaped URL is valid");
+    let mut changed = false;
+
+    // DEPENDENCIES pin first — its lines sit AFTER the GEM sections, so the
+    // spec move below never invalidates these indices (and vice versa would).
+    let target = format!("  {} (= {})!", dep.name, dep.version);
+    let is_entry = |c: &str| c.starts_with("  ") && !c.starts_with("   ");
+    let entry_idx = (deps_start..deps_end).find(|&k| {
+        let ck = gem_lock_line_content(&lines[k]);
+        is_entry(ck) && gem_lock_dependency_name(ck) == dep.name
+    });
+    match entry_idx {
+        Some(k) if gem_lock_line_content(&lines[k]) == target => {}
+        Some(k) => {
+            let old = gem_lock_line_content(&lines[k]).trim_start().to_string();
+            let ending = lines[k][gem_lock_line_content(&lines[k]).len()..].to_string();
+            lines[k] = format!("{target}{ending}");
+            result.edits.push(FileEdit {
+                path: lock_name.into(),
+                kind: "redirect_gemfile_lock_dependency_pin".into(),
+                action: "rewritten".into(),
+                key: Some(dep.name.clone()),
+                original: Some(Value::String(old)),
+                new: Some(Value::String(target.trim_start().to_string())),
+            });
+            changed = true;
+        }
+        None => {
+            // Transitive dep: bundler keeps DEPENDENCIES sorted by name.
+            let mut at = deps_end;
+            for (k, line) in lines.iter().enumerate().take(deps_end).skip(deps_start) {
+                let ck = gem_lock_line_content(line);
+                if ck.is_empty()
+                    || (is_entry(ck) && gem_lock_dependency_name(ck) > dep.name.as_str())
+                {
+                    at = k;
+                    break;
+                }
+            }
+            lines.insert(at, format!("{target}{eol}"));
+            result.edits.push(FileEdit {
+                path: lock_name.into(),
+                kind: "redirect_gemfile_lock_dependency_pin".into(),
+                action: "added".into(),
+                key: Some(dep.name.clone()),
+                original: None,
+                new: Some(Value::String(target.trim_start().to_string())),
+            });
+            changed = true;
+        }
+    }
+
+    if socket_remote_re.is_match(&remote_url) {
+        // Already ours. Rotated grant: refresh the remote in place.
+        if remote_url != index_url {
+            let ending =
+                lines[remote_idx][gem_lock_line_content(&lines[remote_idx]).len()..].to_string();
+            lines[remote_idx] = format!("  remote: {index_url}{ending}");
+            result.edits.push(FileEdit {
+                path: lock_name.into(),
+                kind: "redirect_gemfile_lock_source_url".into(),
+                action: "rewritten".into(),
+                key: Some(dep.name.clone()),
+                original: Some(Value::String(remote_url)),
+                new: Some(Value::String(index_url.to_string())),
+            });
+            changed = true;
+        }
+    } else {
+        // Move the spec (+ sublines) into a patch-registry section of its
+        // own, inserted where bundler itself writes it: bundler emits the
+        // rubygems `GEM` sections sorted by source identifier
+        // (`SourceList#lock_rubygems_sources`: `sort_by(&:identifier)`, i.e.
+        // by the section's remote URLs), so the new section goes before the
+        // first `GEM` section whose remotes sort after the index URL, else
+        // after the last one. A frozen install re-renders the lock, and
+        // since bundler 4.0.19 (rubygems#9750, "fail instead of warning when
+        // frozen mode can't update the lockfile") any difference is fatal:
+        // "Your lockfile needs to be updated, but it can't be because frozen
+        // mode is set". Appending after `https://rubygems.org/` when the
+        // patch registry (`https://patch.socket.dev/…`) sorts first would break
+        // every converged hosted pair under `BUNDLE_FROZEN` / deployment
+        // mode (verified: 4.0.15 installs it, 4.0.21 refuses it).
+        let mut last = spec_idx;
+        while last + 1 < lines.len()
+            && gem_lock_line_content(&lines[last + 1]).starts_with("      ")
+        {
+            last += 1;
+        }
+        let moved: Vec<String> = lines.drain(spec_idx..=last).collect();
+        let n = moved.len();
+        // Section bounds after the drain (every drained line sat inside
+        // section `sec_idx`, which keeps its start).
+        let bounds = |k: usize| -> (usize, usize) {
+            let s = &sections[k];
+            match k.cmp(&sec_idx) {
+                std::cmp::Ordering::Less => (s.start, s.end),
+                std::cmp::Ordering::Equal => (s.start, s.end - n),
+                std::cmp::Ordering::Greater => (s.start - n, s.end - n),
+            }
+        };
+        let identifier = |k: usize| -> String {
+            sections[k]
+                .remotes
+                .iter()
+                .map(|(_, url)| url.as_str())
+                .collect::<Vec<_>>()
+                .join(", ")
+        };
+        let insert_at = (0..sections.len())
+            .find(|&k| identifier(k).as_str() > index_url)
+            .map(|k| bounds(k).0)
+            .unwrap_or_else(|| bounds(sections.len() - 1).1);
+        let mut block: Vec<String> = Vec::with_capacity(moved.len() + 4);
+        block.push(format!("GEM{eol}"));
+        block.push(format!("  remote: {index_url}{eol}"));
+        block.push(format!("  specs:{eol}"));
+        for line in moved {
+            // Moved lines keep their own bytes; only a final line that lacked
+            // a newline (EOF) gains the file's ending.
+            if line.ends_with('\n') {
+                block.push(line);
+            } else {
+                block.push(format!("{line}{eol}"));
+            }
+        }
+        block.push(eol.to_string());
+        lines.splice(insert_at..insert_at, block);
+        result.edits.push(FileEdit {
+            path: lock_name.into(),
+            kind: "redirect_gemfile_lock_gem_source".into(),
+            action: "rewritten".into(),
+            key: Some(dep.name.clone()),
+            original: Some(Value::String(remote_url)),
+            new: Some(Value::String(index_url.to_string())),
+        });
+        changed = true;
+    }
+
+    if changed {
+        *lk = lines.concat();
+        *lock_changed = true;
+    }
+    true
+}
+
+/// The byte span (line content, ending excluded) of the `CHECKSUMS` entry
+/// for exactly `name (version)` — the platform-less spec the hosted planner
+/// pins — read with the shared entry grammar
+/// ([`super::split_checksum_entry`]): a 2-space entry inside the column-0
+/// `CHECKSUMS` section, whatever digests it carries (bare, uppercase,
+/// several algorithms). The first such entry; `None` when there is none.
+/// CRLF endings stay outside the span.
+pub(crate) fn checksum_entry_span(lock: &str, name: &str, version: &str) -> Option<(usize, usize)> {
+    let mut offset = 0;
+    let mut in_checksums = false;
+    for line in lock.split_inclusive('\n') {
+        let start = offset;
+        offset += line.len();
+        let content = gem_lock_line_content(line);
+        if !content.is_empty() && !content.starts_with(' ') {
+            in_checksums = content == "CHECKSUMS";
+            continue;
+        }
+        let Some(entry) = content.strip_prefix("  ").filter(|e| !e.starts_with(' ')) else {
+            continue;
+        };
+        if in_checksums
+            && super::split_checksum_entry(entry)
+                .is_some_and(|(n, token, _)| n == name && token == version)
+        {
+            return Some((start, start + content.len()));
+        }
+    }
+    None
+}
+
diff --git a/crates/socket-patch-core/src/vendor/gemfile_lock.rs b/crates/socket-patch-core/src/formats/gem/mod.rs
similarity index 81%
rename from crates/socket-patch-core/src/vendor/gemfile_lock.rs
rename to crates/socket-patch-core/src/formats/gem/mod.rs
index 4ec9c095..a8054fc1 100644
--- a/crates/socket-patch-core/src/vendor/gemfile_lock.rs
+++ b/crates/socket-patch-core/src/formats/gem/mod.rs
@@ -1,7 +1,9 @@
-//! Read model of a Bundler lockfile (`Gemfile.lock` / `gems.locked`),
-//! shared by every reader of one: the lock inventory (the registry gems a
-//! lock resolves, their `CHECKSUMS` pins and remotes) and lockfile discovery
-//! (`vex::discover::gem`: the Socket-wired `GEM` / `PATH` sections). One
+//! A Bundler lockfile (`Gemfile.lock` / `gems.locked`): the ONE read model
+//! of the format, shared by every reader of one: the lock inventory
+//! ([`GemfileLock::entries`]: the registry gems a lock resolves, their
+//! `CHECKSUMS` pins and remotes), ledger recovery's remote set and lockfile
+//! discovery (`vex::discover::gem`: the Socket-wired `GEM` / `PATH`
+//! sections). One
 //! parse means both agree on which section a spec belongs to, which remote
 //! serves it and which checksum pins it.
 //!
@@ -16,10 +18,14 @@
 //! section at all) is collected in [`GemfileLock::problems`] for the
 //! readers that must refuse such a lock.
 
+pub(crate) mod hosted;
+
 use std::collections::{BTreeSet, HashMap};
 
 use crate::utils::digest::sha256_hex;
-use crate::vendor::lock_inventory::LockIntegrity;
+use crate::utils::purl::simple_purl;
+use crate::vendor::lock_inventory::{http_url, LockIntegrity, LockfileEntry, SourceKind};
+
 
 /// The Bundler lockfiles, legacy spelling first: `Gemfile.lock` and
 /// `gems.locked` (what bundler writes instead when the manifest is
@@ -143,6 +149,68 @@ impl<'t> GemfileLock<'t> {
     }
 }
 
+impl<'t> GemfileLock<'t> {
+    /// Parse a lock text ([`parse`]).
+    pub fn parse(text: &'t str) -> Self {
+        parse(text)
+    }
+
+    /// The registry inventory: `GEM`-section `specs:` entries plus the
+    /// bundler >= 2.6 `CHECKSUMS` sha256 pins when present (older locks stay
+    /// discovery-only). Platform-suffixed specs are skipped (platform gems
+    /// are unsupported for vendoring). Each spec resolves against its OWN
+    /// section's remote (bundler >= 2 emits one GEM section per source); a
+    /// section with several distinct remotes (a legacy bundler 1.x
+    /// multisource lock) leaves its specs without a resolved URL, fail
+    /// closed. What bundler would refuse (`problems`) still inventories
+    /// whatever parsed. `None` when nothing is inventoried.
+    pub fn entries(&self) -> Option<Vec<LockfileEntry>> {
+        let gem_sections: Vec<&Section<'_>> = self.gem_sections().collect();
+        let mut out = Vec::new();
+        for section in &gem_sections {
+            let remotes: Vec<&str> = section.remote_bases().collect();
+            for spec in section.specs.iter().filter_map(|line| line.parsed) {
+                if spec.platform.is_some() {
+                    continue;
+                }
+                let Some(purl) = simple_purl("gem", spec.name, spec.version) else {
+                    continue;
+                };
+                let (name, version) = (spec.name, spec.version);
+                let integrity = self.integrity(name, version).unwrap_or(LockIntegrity::None);
+                let resolved = match remotes.as_slice() {
+                    [base] => gem_download_url(base, name, version),
+                    // No remote (a missing `remote:` line defaults to rubygems.org
+                    // ONLY when the whole lock has one remote-less GEM section —
+                    // the pre-multisource shape) or several remotes: fail closed.
+                    [] if gem_sections.len() == 1 => {
+                        gem_download_url("https://rubygems.org", name, version)
+                    }
+                    _ => None,
+                };
+                out.push(LockfileEntry {
+                    ecosystem: "gem",
+                    source_kind: SourceKind::Unspecified,
+                    purl,
+                    resolved,
+                    name: name.to_string(),
+                    version: version.to_string(),
+                    integrity,
+                });
+            }
+        }
+        (!out.is_empty()).then_some(out)
+    }
+}
+
+
+/// Where a rubygems-compatible registry at `base` (no trailing `/`) serves
+/// `name`-`version`'s `.gem` — the inventory's resolved URL and ledger
+/// recovery's fetch URL. `None` for a non-http(s) base.
+pub(crate) fn gem_download_url(base: &str, name: &str, version: &str) -> Option<String> {
+    http_url(&format!("{base}/downloads/{name}-{version}.gem"))
+}
+
 /// Parse a Bundler lock (see the module docs).
 pub(crate) fn parse(text: &str) -> GemfileLock<'_> {
     let mut sections: Vec<Section<'_>> = Vec::new();
diff --git a/crates/socket-patch-core/src/vendor/maven_pom.rs b/crates/socket-patch-core/src/formats/maven/mod.rs
similarity index 100%
rename from crates/socket-patch-core/src/vendor/maven_pom.rs
rename to crates/socket-patch-core/src/formats/maven/mod.rs
diff --git a/crates/socket-patch-core/src/formats/mod.rs b/crates/socket-patch-core/src/formats/mod.rs
new file mode 100644
index 00000000..f3ea013a
--- /dev/null
+++ b/crates/socket-patch-core/src/formats/mod.rs
@@ -0,0 +1,92 @@
+//! One model per lockfile format.
+//!
+//! Each submodule owns everything the modes read from (and plan against)
+//! one lock format: the entry grammar, the key rules, the version sniff and
+//! the planners that splice it. A model parses a lock text once and answers
+//! from that parse:
+//!
+//! * `entries()` — the registry inventory (`vendor::lock_inventory`'s
+//!   per-format views wrap it with their I/O);
+//! * `wired_refs()` — the entries that name a Socket-hosted or vendored
+//!   artifact, the raw material of lockfile discovery (`vex::discover`) and
+//!   `repair`'s trust anchors;
+//! * `plan_hosted()` / the vendored planners — the edits `scan --mode
+//!   hosted` and `vendor` make;
+//! * `in_use()` — whether a vendored artifact is still consumed.
+//!
+//! Restoring a hosted pin to its upstream entry (hosted rollback) is the
+//! ledger-free-hosted workstream's; it lands on these models rather than
+//! beside them.
+//!
+//! Models are PURE: text (or a parsed document) in, answers out. Every read
+//! stays with the caller, so the disk engines and the in-memory hosted
+//! engine (`MemoryProject`) share one parse per format. An architecture
+//! test below enforces it.
+//!
+//! [`registry()`] is the one table of which project files carry a lock or
+//! its wiring, and in which roles.
+
+pub mod cargo;
+pub mod composer;
+pub mod gem;
+pub(crate) mod maven;
+pub(crate) mod nuget;
+pub mod pnpm;
+pub(crate) mod bun;
+pub mod registry;
+pub mod yarn;
+
+pub use registry::registry;
+
+/// ARCHITECTURE GUARD (module docs): format models do no I/O and apply no
+/// host policy.
+#[cfg(test)]
+mod architecture_tests {
+    use std::path::Path;
+
+    const IMPURE: [&str; 9] = [
+        "tokio::fs",
+        "std::fs",
+        "read_regular_",
+        "File::open",
+        "OpenOptions",
+        "hosted_patch_uuid",
+        "hosted_patch_url_uuids",
+        "async fn",
+        ".await",
+    ];
+
+    fn rs_files(dir: &Path, out: &mut Vec<std::path::PathBuf>) {
+        for entry in std::fs::read_dir(dir).expect("read formats dir") {
+            let path = entry.expect("dir entry").path();
+            if path.is_dir() {
+                rs_files(&path, out);
+            } else if path.extension().is_some_and(|e| e == "rs") {
+                out.push(path);
+            }
+        }
+    }
+
+    #[test]
+    fn format_models_are_pure() {
+        let dir = Path::new(env!("CARGO_MANIFEST_DIR")).join("src/formats");
+        let mut files = Vec::new();
+        rs_files(&dir, &mut files);
+        assert!(files.len() >= 4, "only {} format files found", files.len());
+        for path in files {
+            let src = std::fs::read_to_string(&path).expect("read format source");
+            let prod = src.split("#[cfg(test)]").next().unwrap_or_default();
+            let code: String = prod
+                .lines()
+                .filter(|l| !l.trim_start().starts_with("//"))
+                .collect::<Vec<_>>()
+                .join("\n");
+            let used: Vec<&str> = IMPURE.iter().copied().filter(|n| code.contains(n)).collect();
+            assert!(
+                used.is_empty(),
+                "{}: a format model uses {used:?} — models are pure (module docs)",
+                path.display()
+            );
+        }
+    }
+}
diff --git a/crates/socket-patch-core/src/formats/nuget/mod.rs b/crates/socket-patch-core/src/formats/nuget/mod.rs
new file mode 100644
index 00000000..294b4ca7
--- /dev/null
+++ b/crates/socket-patch-core/src/formats/nuget/mod.rs
@@ -0,0 +1,233 @@
+//! NuGet config files: the routing reader (the per-directory names NuGet
+//! probes and the stat-only same-file check stay with the callers' I/O in
+//! `vendor::nuget_config`).
+//!
+//! The reader is a minimal, bounded XML tokenizer (no parser dependency)
+//! that records only what NuGet routes by: `<add>` directly under
+//! `configuration/packageSources`, the mapping elements directly under
+//! `configuration/packageSourceMapping`, and `disabledPackageSources`
+//! entries whose `value` is `true`. Comments, CDATA, processing instructions
+//! and DOCTYPEs are skipped; an unterminated tag or comment, an unquoted
+//! attribute or a mismatched close tag makes the whole file `None`.
+
+use std::collections::BTreeSet;
+
+// ── pure reader ──
+
+/// Bound on element nesting — the config is tamper-able input (real configs
+/// are three levels deep).
+const MAX_XML_DEPTH: usize = 64;
+
+/// The parts of a `nuget.config` that route packages.
+#[derive(Debug, Default)]
+pub(crate) struct NugetConfig {
+    /// `configuration/packageSources/add` `(key, value)`, document order.
+    pub(crate) sources: Vec<(String, String)>,
+    /// `configuration/packageSourceMapping/packageSource` `(key, patterns)`,
+    /// one row per element, document order.
+    pub(crate) mappings: Vec<(String, Vec<String>)>,
+    /// Keys `configuration/disabledPackageSources` turns off.
+    pub(crate) disabled: BTreeSet<String>,
+}
+
+/// One open (or self-closing) tag.
+struct Tag<'a> {
+    name: &'a str,
+    attrs: Vec<(&'a str, String)>,
+    self_closing: bool,
+}
+
+impl Tag<'_> {
+    fn attr(&self, name: &str) -> Option<&str> {
+        self.attrs
+            .iter()
+            .find(|(n, _)| *n == name)
+            .map(|(_, v)| v.as_str())
+    }
+}
+
+/// Parse the routing parts of `text`, or `None` when it is not well-formed
+/// enough to trust (see the module docs).
+pub(crate) fn parse_config(text: &str) -> Option<NugetConfig> {
+    let mut cfg = NugetConfig::default();
+    let mut stack: Vec<&str> = Vec::new();
+    // Index into `cfg.mappings` of the open `<packageSource>` element.
+    let mut open_mapping: Option<usize> = None;
+    let mut i = 0;
+    while let Some(rel) = text[i..].find('<') {
+        let at = i + rel;
+        let rest = &text[at..];
+        if let Some(comment) = rest.strip_prefix("<!--") {
+            i = at + 4 + comment.find("-->")? + 3;
+        } else if rest.starts_with("<![CDATA[") {
+            i = at + rest.find("]]>")? + 3;
+        } else if rest.starts_with("<?") {
+            i = at + rest.find("?>")? + 2;
+        } else if rest.starts_with("<!") {
+            // DOCTYPE and friends (no internal subsets in a NuGet config).
+            i = at + rest.find('>')? + 1;
+        } else if let Some(close) = rest.strip_prefix("</") {
+            let end = close.find('>')?;
+            if stack.pop()? != close[..end].trim() {
+                return None;
+            }
+            i = at + 2 + end + 1;
+        } else {
+            let (tag, consumed) = parse_open_tag(&rest[1..])?;
+            i = at + 1 + consumed;
+            visit(&stack, &tag, &mut cfg, &mut open_mapping);
+            if !tag.self_closing {
+                if stack.len() >= MAX_XML_DEPTH {
+                    return None;
+                }
+                stack.push(tag.name);
+            }
+        }
+    }
+    stack.is_empty().then_some(cfg)
+}
+
+/// Record `tag` if it sits where NuGet reads routing data.
+fn visit(stack: &[&str], tag: &Tag<'_>, cfg: &mut NugetConfig, open_mapping: &mut Option<usize>) {
+    match (stack, tag.name) {
+        (["configuration", "packageSources"], "add") => {
+            if let (Some(key), Some(value)) = (tag.attr("key"), tag.attr("value")) {
+                cfg.sources.push((key.to_string(), value.to_string()));
+            }
+        }
+        (["configuration", "disabledPackageSources"], "add") => {
+            if let (Some(key), Some(value)) = (tag.attr("key"), tag.attr("value")) {
+                if value.trim().eq_ignore_ascii_case("true") {
+                    cfg.disabled.insert(key.to_string());
+                }
+            }
+        }
+        (["configuration", "packageSourceMapping"], "packageSource") => {
+            *open_mapping = match tag.attr("key") {
+                Some(key) => {
+                    cfg.mappings.push((key.to_string(), Vec::new()));
+                    (!tag.self_closing).then(|| cfg.mappings.len() - 1)
+                }
+                None => None,
+            };
+        }
+        (["configuration", "packageSourceMapping", "packageSource"], "package") => {
+            if let (Some(idx), Some(pattern)) = (*open_mapping, tag.attr("pattern")) {
+                cfg.mappings[idx].1.push(pattern.trim().to_string());
+            }
+        }
+        _ => {}
+    }
+}
+
+/// Parse an open tag starting right after its `<`: `(tag, bytes consumed
+/// through the closing `>`)`. Attribute values must be quoted (either XML
+/// quote) and are entity-decoded.
+fn parse_open_tag(s: &str) -> Option<(Tag<'_>, usize)> {
+    let name_end = s.find(|c: char| c.is_whitespace() || c == '/' || c == '>')?;
+    let name = &s[..name_end];
+    if name.is_empty() {
+        return None;
+    }
+    let mut attrs = Vec::new();
+    let mut j = name_end;
+    loop {
+        j += leading_ws(&s[j..]);
+        let t = &s[j..];
+        if t.starts_with("/>") {
+            return Some((
+                Tag {
+                    name,
+                    attrs,
+                    self_closing: true,
+                },
+                j + 2,
+            ));
+        }
+        if t.starts_with('>') {
+            return Some((
+                Tag {
+                    name,
+                    attrs,
+                    self_closing: false,
+                },
+                j + 1,
+            ));
+        }
+        let attr_end = t.find(|c: char| c.is_whitespace() || matches!(c, '=' | '>' | '/'))?;
+        if attr_end == 0 {
+            return None;
+        }
+        let attr = &t[..attr_end];
+        j += attr_end;
+        j += leading_ws(&s[j..]);
+        j += s[j..].strip_prefix('=').map(|_| 1)?;
+        j += leading_ws(&s[j..]);
+        let t = &s[j..];
+        let quote = t.chars().next().filter(|q| matches!(q, '"' | '\''))?;
+        let close = t[1..].find(quote)?;
+        let raw = &t[1..1 + close];
+        if raw.contains('<') {
+            return None;
+        }
+        attrs.push((attr, decode_entities(raw)));
+        j += 1 + close + 1;
+    }
+}
+
+fn leading_ws(s: &str) -> usize {
+    s.len() - s.trim_start().len()
+}
+
+/// Decode the five predefined XML entities and numeric character references;
+/// anything else is kept literally (it then fails the later grammar checks
+/// rather than being guessed at).
+fn decode_entities(raw: &str) -> String {
+    if !raw.contains('&') {
+        return raw.to_string();
+    }
+    let mut out = String::with_capacity(raw.len());
+    let mut rest = raw;
+    while let Some(amp) = rest.find('&') {
+        out.push_str(&rest[..amp]);
+        let tail = &rest[amp..];
+        let decoded = tail.find(';').filter(|&semi| semi <= 10).and_then(|semi| {
+            let entity = &tail[1..semi];
+            let ch = match entity {
+                "amp" => Some('&'),
+                "lt" => Some('<'),
+                "gt" => Some('>'),
+                "quot" => Some('"'),
+                "apos" => Some('\''),
+                _ => entity
+                    .strip_prefix("#x")
+                    .and_then(|hex| u32::from_str_radix(hex, 16).ok())
+                    .or_else(|| entity.strip_prefix('#').and_then(|d| d.parse().ok()))
+                    .and_then(char::from_u32),
+            }?;
+            Some((ch, semi + 1))
+        });
+        match decoded {
+            Some((ch, len)) => {
+                out.push(ch);
+                rest = &tail[len..];
+            }
+            None => {
+                out.push('&');
+                rest = &tail[1..];
+            }
+        }
+    }
+    out.push_str(rest);
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    #[test]
+    fn entity_decoding_is_minimal_and_safe() {
+        assert_eq!(super::decode_entities("a&amp;b&lt;&#x2F;&#47;"), "a&b<//");
+        assert_eq!(super::decode_entities("&bogus;&"), "&bogus;&");
+        assert_eq!(super::decode_entities("&#xD800;"), "&#xD800;");
+    }
+}
diff --git a/crates/socket-patch-core/src/patch/redirect/pnpm.rs b/crates/socket-patch-core/src/formats/pnpm/grammar.rs
similarity index 95%
rename from crates/socket-patch-core/src/patch/redirect/pnpm.rs
rename to crates/socket-patch-core/src/formats/pnpm/grammar.rs
index 90371b46..4b84251d 100644
--- a/crates/socket-patch-core/src/patch/redirect/pnpm.rs
+++ b/crates/socket-patch-core/src/formats/pnpm/grammar.rs
@@ -1,13 +1,16 @@
-//! Read pnpm's package blocks without reserializing unrelated YAML. The old
-//! shrinkwrap and lockfile 5.1/5.2 formats use block resolutions; newer locks
-//! use flow mappings. Peer suffixes are identities, not part of the version.
+//! The `packages:` entry grammar: read pnpm's package blocks without
+//! reserializing unrelated YAML. The old shrinkwrap and lockfile 5.1/5.2
+//! formats use block resolutions; newer locks use flow mappings. Peer
+//! suffixes are identities, not part of the version. The hosted planner
+//! ([`super::hosted`]), the lock inventory and lockfile discovery all read
+//! entries through this one walk.
 
 use std::ops::Range;
 
 /// Early pnpm 1 writes shrinkwrapVersion 3 without a minor version and
 /// unconditionally drops registry tarball URLs on install. Its frozen flag
 /// cannot preserve this redirect (verified with pnpm 1.0.0).
-pub(super) fn unsupported_early_shrinkwrap(content: &str) -> bool {
+pub(crate) fn unsupported_early_shrinkwrap(content: &str) -> bool {
     let version = content
         .lines()
         .find_map(|line| line.strip_prefix("shrinkwrapVersion:"));
@@ -100,7 +103,7 @@ pub(crate) fn entry_field<'a>(entry: &Entry<'a>, field: &str) -> Option<&'a str>
 }
 
 /// Loose identity match, also used to refuse unsupported suffixes atomically.
-pub(super) fn suffix<'a>(key: &'a str, name: &str, version: &str) -> Option<&'a str> {
+pub(crate) fn suffix<'a>(key: &'a str, name: &str, version: &str) -> Option<&'a str> {
     let key = unquote(key);
     let key = key.strip_prefix('/').unwrap_or(key);
     let suffix = key
@@ -116,7 +119,7 @@ pub(super) fn suffix<'a>(key: &'a str, name: &str, version: &str) -> Option<&'a
     Some(suffix)
 }
 
-pub(super) fn supported_suffix(suffix: &str) -> bool {
+pub(crate) fn supported_suffix(suffix: &str) -> bool {
     if suffix.is_empty() || suffix.starts_with('_') {
         return true;
     }
diff --git a/crates/socket-patch-core/src/formats/pnpm/hosted.rs b/crates/socket-patch-core/src/formats/pnpm/hosted.rs
new file mode 100644
index 00000000..c491bd22
--- /dev/null
+++ b/crates/socket-patch-core/src/formats/pnpm/hosted.rs
@@ -0,0 +1,426 @@
+//! The hosted planner: repoint every instance of a patched `name@version`
+//! across a project's pnpm lock set at its Socket-hosted tarball, as
+//! resolution splices over the [`super::grammar`] entries (the redirect
+//! rewriter's pnpm leg).
+
+use std::borrow::Cow;
+use std::collections::BTreeMap;
+
+use serde_json::Value;
+
+use crate::patch::redirect::{full_name, DepOverride, FileEdit, RewriteResult, RewriteWarning};
+
+use super::grammar as pnpm;
+
+/// Whether `entry` resolves to exactly `artifact_url` — the per-instance
+/// residual-gate predicate.
+fn pnpm_resolves_to(entry: &pnpm::Entry<'_>, artifact_url: &str) -> bool {
+    pnpm::resolution(entry).is_some_and(|r| r.tarball() == Some(artifact_url))
+}
+
+/// One pnpm lock under rewrite. `text` is the lock as of the last
+/// materialization; `pending` holds the resolution splices committed since,
+/// in `text`'s byte coordinates, and `spliced` the entries they touch.
+///
+/// The logical (post-splice) lock is `text` with `pending` applied. Parsing
+/// once and indexing is sound because a resolution splice never changes the
+/// entry structure: the replaced range and its replacement are only
+/// resolution-field material (6-space-indented `k: v` child lines of a block
+/// resolution, or the `{…}` flow value after `    resolution:`), and no raw
+/// newline can enter a value (`Resolution::rewrite` JSON-quotes whitespace).
+/// So every column-0 line (the shrinkwrap-version sniff) and every entry
+/// boundary line survives unchanged, and an entry no pending splice touched
+/// has byte-identical key and body. An entry that WAS touched is re-read
+/// only after materializing, so a later dep with the same name@version (a
+/// duplicate override) sees the rewritten text exactly as before.
+struct PnpmLockState<'f> {
+    path: &'f String,
+    text: Cow<'f, str>,
+    early_shrinkwrap: bool,
+    /// (key span, body span) per `packages:` entry, in file order.
+    entries: Vec<(std::ops::Range<usize>, std::ops::Range<usize>)>,
+    /// Entry indices sorted by normalized (unquoted, `/`-stripped) key.
+    sorted: Vec<usize>,
+    pending: Vec<(std::ops::Range<usize>, String)>,
+    spliced: std::collections::HashSet<usize>,
+    changed: bool,
+}
+
+impl<'f> PnpmLockState<'f> {
+    fn new(path: &'f String, text: &'f str) -> Self {
+        let mut state = PnpmLockState {
+            path,
+            text: Cow::Borrowed(text),
+            early_shrinkwrap: pnpm::unsupported_early_shrinkwrap(text),
+            entries: Vec::new(),
+            sorted: Vec::new(),
+            pending: Vec::new(),
+            spliced: Default::default(),
+            changed: false,
+        };
+        state.reindex();
+        state
+    }
+
+    fn reindex(&mut self) {
+        let text: &str = &self.text;
+        let base = text.as_ptr() as usize;
+        self.entries = pnpm::entries(text)
+            .iter()
+            .map(|e| {
+                let key_start = e.key.as_ptr() as usize - base;
+                (
+                    key_start..key_start + e.key.len(),
+                    e.offset..e.offset + e.body.len(),
+                )
+            })
+            .collect();
+        let mut sorted: Vec<usize> = (0..self.entries.len()).collect();
+        sorted.sort_by(|&a, &b| self.norm_key(a).cmp(self.norm_key(b)).then(a.cmp(&b)));
+        self.sorted = sorted;
+    }
+
+    fn entry(&self, i: usize) -> pnpm::Entry<'_> {
+        let (key, body) = &self.entries[i];
+        pnpm::Entry {
+            key: &self.text[key.clone()],
+            body: &self.text[body.clone()],
+            offset: body.start,
+        }
+    }
+
+    /// The key as [`pnpm::suffix`] compares it.
+    fn norm_key(&self, i: usize) -> &str {
+        let key = pnpm::unquote(&self.text[self.entries[i].0.clone()]);
+        key.strip_prefix('/').unwrap_or(key)
+    }
+
+    /// Entries whose key names `fname@version` (any suffix), in file order —
+    /// the same set a full [`pnpm::suffix`] scan of the logical lock yields.
+    fn hits(&mut self, fname: &str, version: &str) -> Vec<usize> {
+        let hits = self.lookup(fname, version);
+        if hits.iter().any(|i| self.spliced.contains(i)) {
+            self.materialize();
+            return self.lookup(fname, version);
+        }
+        hits
+    }
+
+    fn lookup(&self, fname: &str, version: &str) -> Vec<usize> {
+        let mut out = Vec::new();
+        for sep in ['@', '/'] {
+            let prefix = format!("{fname}{sep}{version}");
+            let start = self
+                .sorted
+                .partition_point(|&i| self.norm_key(i) < prefix.as_str());
+            out.extend(
+                self.sorted[start..]
+                    .iter()
+                    .take_while(|&&i| self.norm_key(i).starts_with(prefix.as_str()))
+                    .copied(),
+            );
+        }
+        out.sort_unstable();
+        out.dedup();
+        out.retain(|&i| pnpm::suffix(self.entry(i).key, fname, version).is_some());
+        out
+    }
+
+    /// Fold `pending` into `text` and re-parse.
+    fn materialize(&mut self) {
+        if self.pending.is_empty() {
+            return;
+        }
+        #[cfg(debug_assertions)]
+        let keys_before: Vec<String> = (0..self.entries.len())
+            .map(|i| self.entry(i).key.to_string())
+            .collect();
+        let mut pending = std::mem::take(&mut self.pending);
+        pending.sort_by_key(|(range, _)| range.start);
+        let mut out = String::with_capacity(self.text.len());
+        let mut cursor = 0usize;
+        for (range, replacement) in pending {
+            out.push_str(&self.text[cursor..range.start]);
+            out.push_str(&replacement);
+            cursor = range.end;
+        }
+        out.push_str(&self.text[cursor..]);
+        self.text = Cow::Owned(out);
+        self.spliced.clear();
+        self.reindex();
+        #[cfg(debug_assertions)]
+        debug_assert_eq!(
+            keys_before,
+            (0..self.entries.len())
+                .map(|i| self.entry(i).key.to_string())
+                .collect::<Vec<_>>(),
+            "a resolution splice changed the pnpm entry structure"
+        );
+    }
+
+    fn into_rewritten(mut self) -> Option<(&'f String, String)> {
+        if !self.changed {
+            return None;
+        }
+        self.materialize();
+        Some((self.path, self.text.into_owned()))
+    }
+}
+
+pub(crate) fn plan_hosted(
+    files: &BTreeMap<String, String>,
+    overrides: &[DepOverride],
+    result: &mut RewriteResult,
+) {
+    let npm: Vec<&DepOverride> = overrides.iter().filter(|o| o.ecosystem == "npm").collect();
+    // A pnpm lock lives at the project root or at any nested path (e.g. Rush
+    // repos keep them under `common/config/rush/`); every such files-map key
+    // is rewritten under the same grammar. Deterministic order: BTreeMap
+    // iterates keys sorted, so goldens are stable across every lock in the set.
+    let lock_keys: Vec<&String> = files
+        .keys()
+        .filter(|k| {
+            matches!(
+                k.rsplit('/').next(),
+                Some("pnpm-lock.yaml" | "shrinkwrap.yaml")
+            )
+        })
+        .collect();
+    if npm.is_empty() || lock_keys.is_empty() {
+        return;
+    }
+    // Each lock is parsed and indexed ONCE; splices accumulate per lock and
+    // are applied in one pass at the end (see `PnpmLockState`).
+    let mut locks: Vec<PnpmLockState> = lock_keys
+        .iter()
+        .map(|k| PnpmLockState::new(k, &files[*k]))
+        .collect();
+    for dep in &npm {
+        let fname = full_name(dep);
+        let hits: Vec<Vec<usize>> = locks
+            .iter_mut()
+            .map(|lock| lock.hits(&fname, &dep.version))
+            .collect();
+        let unsafe_locks: Vec<_> = locks
+            .iter()
+            .zip(&hits)
+            .filter(|(lock, hits)| lock.early_shrinkwrap && !hits.is_empty())
+            .map(|(lock, _)| lock.path.as_str())
+            .collect();
+        if !unsafe_locks.is_empty() {
+            result.refused_pnpm_uuids.insert(dep.patch_uuid.clone());
+            result.warnings.push(RewriteWarning {
+                code: "redirect_pnpm_legacy_lockfile_unsupported".into(),
+                detail: format!("{} uses early pnpm 1 shrinkwrapVersion 3 without a supported minor version. Those installers discard hosted tarball URLs; {fname}@{} was left unchanged in every lock. Upgrade to a tested pnpm release (1.43.1 or newer) and regenerate the lock, or use `scan --mode agent` for installed-file patching.", unsafe_locks.join(", "), dep.version),
+            });
+            continue;
+        }
+        let Some(sha512) = dep.integrity.sha512.clone() else {
+            result.warnings.push(RewriteWarning {
+                code: "redirect_pnpm_missing_sha512".into(),
+                detail: format!("{fname}@{} has no sha512 integrity", dep.version),
+            });
+            continue;
+        };
+        // Every peer instance must be redirected, including nested peer
+        // contexts and the block resolutions emitted by pnpm 1–5.
+        let mut matched_any = false;
+        // Per-lock rewrites are PLANNED first and committed only after the
+        // residual gate below proves no instance of this dep escaped the
+        // splice grammar in ANY lock — committing lock-by-lock as we go
+        // would ship exactly the partial rewrite the gate exists to refuse.
+        type Splice = (usize, std::ops::Range<usize>, String);
+        let mut planned: Vec<(usize, Vec<Splice>, Vec<FileEdit>)> = Vec::new();
+        let mut residuals: Vec<(&str, Vec<String>)> = Vec::new();
+        for (idx, (lock, hits)) in locks.iter().zip(&hits).enumerate() {
+            // (entry, byte range to replace, replacement text) per instance,
+            // plus one FileEdit per instance keyed by the canonical instance
+            // key — per-instance edits keep the revert ledger lossless when
+            // several instances of one dep live in the same lock.
+            let mut splices: Vec<Splice> = Vec::new();
+            let mut instance_edits: Vec<FileEdit> = Vec::new();
+            // Residual gate, judged per instance on its POST-splice body:
+            // any instance of this exact name@version still resolving
+            // somewhere other than the hosted artifact — in a spelling the
+            // splice grammar cannot parse (e.g. an unbalanced peer suffix) —
+            // makes this a partial rewrite. Shipping it would confirm and
+            // VEX-attest the dep while dependents through the unmatched
+            // instance keep installing the unpatched upstream tarball, so
+            // the dep is refused instead.
+            let mut leftover: Vec<String> = Vec::new();
+            for &i in hits {
+                let entry = lock.entry(i);
+                let suffix = pnpm::suffix(entry.key, &fname, &dep.version)
+                    .expect("hits only holds entries naming this dep");
+                let resolution = if pnpm::supported_suffix(suffix) {
+                    pnpm::resolution(&entry)
+                } else {
+                    None
+                };
+                let Some(resolution) = resolution else {
+                    if !pnpm_resolves_to(&entry, &dep.artifact_url) {
+                        leftover.push(entry.key.to_string());
+                    }
+                    continue;
+                };
+                matched_any = true;
+                let original = &lock.text[resolution.range.clone()];
+                let rebuilt = resolution.rewrite(&sha512, &dep.artifact_url);
+                let rel =
+                    resolution.range.start - entry.offset..resolution.range.end - entry.offset;
+                let body = format!(
+                    "{}{rebuilt}{}",
+                    &entry.body[..rel.start],
+                    &entry.body[rel.end..]
+                );
+                let after = pnpm::Entry {
+                    key: entry.key,
+                    body: &body,
+                    offset: 0,
+                };
+                if !pnpm_resolves_to(&after, &dep.artifact_url) {
+                    leftover.push(entry.key.to_string());
+                }
+                if rebuilt == original {
+                    continue;
+                }
+                instance_edits.push(FileEdit {
+                    path: lock.path.clone(),
+                    kind: "redirect_pnpm_resolution".into(),
+                    action: "rewritten".into(),
+                    key: Some(format!("{fname}@{}{suffix}", dep.version)),
+                    original: Some(Value::String(original.to_string())),
+                    new: Some(Value::String(rebuilt.clone())),
+                });
+                splices.push((i, resolution.range, rebuilt));
+            }
+            if !leftover.is_empty() {
+                residuals.push((lock.path.as_str(), leftover));
+                continue;
+            }
+            if !splices.is_empty() {
+                planned.push((idx, splices, instance_edits));
+            }
+        }
+        // ANY residual anywhere refuses the dep across the WHOLE lock set —
+        // nothing rewritten, nothing recorded, nothing confirmed: a rewrite
+        // committed in one lock while another still resolves the dep
+        // upstream would confirm the dep set-wide.
+        if !residuals.is_empty() {
+            result.refused_pnpm_uuids.insert(dep.patch_uuid.clone());
+            for (lock_key, keys) in &residuals {
+                result.warnings.push(RewriteWarning {
+                    code: "redirect_pnpm_unsupported_lock_key".into(),
+                    detail: format!(
+                        "{fname}@{} still resolves through pnpm lock key(s) whose \
+                         resolution the redirect grammar cannot repoint: {} in \
+                         {lock_key}; the dep is left unredirected in EVERY lock \
+                         (nothing rewritten, nothing confirmed) — regenerate the \
+                         lock with a current pnpm (lockfileVersion 9) and re-run",
+                        dep.version,
+                        keys.join(", ")
+                    ),
+                });
+            }
+            continue;
+        }
+        for (idx, splices, mut instance_edits) in planned {
+            let lock = &mut locks[idx];
+            for (i, range, replacement) in splices {
+                lock.spliced.insert(i);
+                lock.pending.push((range, replacement));
+            }
+            lock.changed = true;
+            result.edits.append(&mut instance_edits);
+        }
+        // The entry-not-found warning fires only when the dep matched in NO
+        // pnpm lock across the whole set, not once per lock. A VENDORED dep
+        // is named as such: `socket-patch vendor` removes the registry
+        // resolution this grammar looks for (v9 respells the packages key
+        // `<name>@file:.socket/vendor/…`; v5/v6 rekey it to a bare `file:`
+        // key but keep the `<name>@<version>: file:…` overrides line), so
+        // the generic not-locked wording would send users on a wild-goose
+        // `pnpm install` when the real path is a mode switch. Fail-closed
+        // either way: nothing is rewritten for the dep.
+        if !matched_any {
+            let v9_vendored_key = format!("{fname}@file:");
+            let override_key = format!("{fname}@{}", dep.version);
+            // Scanned over the post-splice text, so fold pending splices in.
+            for lock in locks.iter_mut() {
+                lock.materialize();
+            }
+            let vendored = locks.iter().any(|lock| {
+                lock.text.lines().any(|line| {
+                    let t = line.trim_start();
+                    let t = t.strip_prefix('\'').unwrap_or(t);
+                    // v9 packages/snapshots key (leading `/` in v6 spelling).
+                    // The vendor backend always writes the RELATIVE
+                    // `file:.socket/vendor/…` spelling here, so anchoring on
+                    // it keeps a user's own `file:` dep of the same name
+                    // from being misreported as vendored.
+                    let key = t.strip_prefix('/').unwrap_or(t);
+                    if key
+                        .strip_prefix(&v9_vendored_key)
+                        .is_some_and(|rest| rest.starts_with(".socket/vendor/"))
+                    {
+                        return true;
+                    }
+                    // overrides / root-dep line: `<name>@<version>: file:…`
+                    // (pnpm <=8 absolutizes the value, so only the
+                    // `.socket/vendor/` tail is stable enough to match).
+                    t.strip_prefix(&override_key)
+                        .map(|rest| rest.strip_prefix('\'').unwrap_or(rest))
+                        .and_then(|rest| rest.strip_prefix(':'))
+                        .is_some_and(|rest| {
+                            rest.contains("file:") && rest.contains(".socket/vendor/")
+                        })
+                })
+            });
+            if vendored {
+                result.warnings.push(RewriteWarning {
+                    code: "redirect_pnpm_entry_vendored".into(),
+                    detail: format!(
+                        "{fname}@{} has no registry resolution because it is \
+                         VENDORED (the lock resolves it to a \
+                         file:.socket/vendor/… tarball); the hosted redirect \
+                         does not apply — run `socket-patch vendor --revert` to \
+                         restore the registry resolution, then re-run `scan \
+                         --mode hosted`",
+                        dep.version
+                    ),
+                });
+            } else {
+                result.warnings.push(RewriteWarning {
+                    code: "redirect_pnpm_entry_not_found".into(),
+                    detail: format!("no resolution for {fname}@{}", dep.version),
+                });
+            }
+        }
+    }
+    for lock in locks {
+        if let Some((key, content)) = lock.into_rewritten() {
+            result.files.insert(key.clone(), content);
+        }
+    }
+}
+
+/// Test-only reference for the residual gate: every instance of this exact
+/// name@version in `content` that does not resolve to `artifact_url`.
+/// Production judges the same predicate inline, per instance, on each
+/// indexed hit's post-splice body in `plan_hosted`; snapshots and
+/// other versions do not participate in resolution.
+#[cfg(test)]
+pub(crate) fn pnpm_unrewritten_instances(
+    content: &str,
+    fname: &str,
+    version: &str,
+    artifact_url: &str,
+) -> Vec<String> {
+    pnpm::entries(content)
+        .into_iter()
+        .filter_map(|entry| {
+            pnpm::suffix(entry.key, fname, version)?;
+            (!pnpm_resolves_to(&entry, artifact_url)).then(|| entry.key.to_string())
+        })
+        .collect()
+}
diff --git a/crates/socket-patch-core/src/formats/pnpm/lines.rs b/crates/socket-patch-core/src/formats/pnpm/lines.rs
new file mode 100644
index 00000000..ce1726f1
--- /dev/null
+++ b/crates/socket-patch-core/src/formats/pnpm/lines.rs
@@ -0,0 +1,149 @@
+//! The line-block grammar the vendored planners splice with.
+//! pnpm-lock.yaml is machine-emitted with a fixed 2/4/6/8-space shape; these
+//! helpers find sections and 2-space-keyed blocks and never interpret YAML
+//! generically. Lines are split on `\n` only, so a CRLF lock keeps its `\r`
+//! on every line (the planners refuse or preserve it explicitly).
+
+pub(crate) fn split_lines(text: &str) -> Vec<String> {
+    text.split('\n').map(str::to_string).collect()
+}
+
+/// `(header_idx, end_idx)` of a top-level `name:` section; `end` is the
+/// first following column-0 line (exclusive), so trailing blank separator
+/// lines belong to the section.
+pub(crate) fn section_bounds(lines: &[String], name: &str) -> Option<(usize, usize)> {
+    let header = format!("{name}:");
+    let start = lines.iter().position(|l| l == &header)?;
+    let end = lines
+        .iter()
+        .enumerate()
+        .skip(start + 1)
+        .find(|(_, l)| !l.is_empty() && !l.starts_with(' '))
+        .map(|(i, _)| i)
+        .unwrap_or(lines.len());
+    Some((start, end))
+}
+
+/// One 2-space-keyed block inside a section (`[header, end)`; `end` stops at
+/// the blank separator / next block header, so the captured fragment is the
+/// verbatim entry without surrounding blanks).
+pub(crate) struct YamlBlock {
+    pub(crate) header: usize,
+    pub(crate) end: usize,
+    pub(crate) key: String,
+    /// The key exactly as spelled in the file (incl. quotes) — rekeys
+    /// preserve the file's quoting style.
+    pub(crate) repr: String,
+    /// Inline value after `:` (e.g. `{}` for empty snapshots), `""` if none.
+    pub(crate) rest: String,
+}
+
+impl YamlBlock {
+    /// The inline-rest suffix to re-emit after the (re)written key.
+    pub(crate) fn rest_suffix(&self) -> String {
+        if self.rest.is_empty() {
+            String::new()
+        } else {
+            format!(" {}", self.rest)
+        }
+    }
+}
+
+/// The next block at or after line `i` (within `[i, end)`).
+pub(crate) fn next_block(lines: &[String], mut i: usize, end: usize) -> Option<YamlBlock> {
+    while i < end {
+        if let Some((key, repr, rest)) = parse_key_line(&lines[i], 2) {
+            let mut j = i + 1;
+            while j < end && !lines[j].is_empty() && indent_of(&lines[j]) >= 4 {
+                j += 1;
+            }
+            return Some(YamlBlock {
+                header: i,
+                end: j,
+                key: key.to_string(),
+                repr: repr.to_string(),
+                rest: rest.to_string(),
+            });
+        }
+        i += 1;
+    }
+    None
+}
+
+pub(crate) fn indent_of(line: &str) -> usize {
+    line.len() - line.trim_start_matches(' ').len()
+}
+
+/// Parse a mapping line at exactly `indent` spaces into
+/// `(key, verbatim_key_repr, value_after_colon)`. Accepts pnpm's bare keys
+/// and both quote styles (single quotes are what pnpm emits for `@`-leading
+/// keys); the value separator is the first `:` followed by a space or EOL
+/// (keys themselves contain `:` in `file:` specs).
+///
+/// All three are slices of `line`. Every scan below runs this over whole
+/// `packages:` / `snapshots:` sections once per vendored package, so owning
+/// copies would dominate the surgery's CPU on a multi-megabyte lock. A
+/// caller that keeps a piece past the next edit to `lines` copies it itself.
+pub(crate) fn parse_key_line(line: &str, indent: usize) -> Option<(&str, &str, &str)> {
+    if line.len() <= indent || !line.as_bytes()[..indent].iter().all(|&b| b == b' ') {
+        return None;
+    }
+    let s = &line[indent..];
+    let c0 = s.as_bytes()[0];
+    if c0 == b' ' {
+        return None;
+    }
+    if c0 == b'\'' || c0 == b'"' {
+        let quote = c0 as char;
+        let close = s[1..].find(quote)? + 1;
+        let after = &s[close + 1..];
+        let rest = after.strip_prefix(':')?;
+        let rest = rest.strip_prefix(' ').unwrap_or(rest);
+        return Some((&s[1..close], &s[..close + 1], rest));
+    }
+    let bytes = s.as_bytes();
+    for i in 0..bytes.len() {
+        if bytes[i] == b':' && (i + 1 == bytes.len() || bytes[i + 1] == b' ') {
+            if i == 0 {
+                return None;
+            }
+            let rest = if i + 1 < bytes.len() { &s[i + 2..] } else { "" };
+            return Some((&s[..i], &s[..i], rest));
+        }
+    }
+    None
+}
+
+/// Strip one matching pair of surrounding quotes from a mapping VALUE
+/// (pnpm quotes values that would misparse as plain YAML scalars, e.g. the
+/// default-catalog specifier `'catalog:'`).
+pub(crate) fn unquote_value(value: &str) -> &str {
+    let bytes = value.as_bytes();
+    if bytes.len() >= 2
+        && (bytes[0] == b'\'' || bytes[0] == b'"')
+        && bytes[bytes.len() - 1] == bytes[0]
+    {
+        &value[1..value.len() - 1]
+    } else {
+        value
+    }
+}
+
+/// pnpm quotes `@`-leading keys with single quotes; everything we write is
+/// otherwise bare.
+pub(crate) fn yaml_key(key: &str) -> String {
+    if key.starts_with('@') {
+        format!("'{key}'")
+    } else {
+        key.to_string()
+    }
+}
+
+/// Re-spell `key` in the same quoting style as the original `repr`.
+pub(crate) fn yaml_key_like(key: &str, original_repr: &str) -> String {
+    match original_repr.as_bytes().first() {
+        Some(b'\'') => format!("'{key}'"),
+        Some(b'"') => format!("\"{key}\""),
+        _ => yaml_key(key),
+    }
+}
diff --git a/crates/socket-patch-core/src/formats/pnpm/mod.rs b/crates/socket-patch-core/src/formats/pnpm/mod.rs
new file mode 100644
index 00000000..1d495d69
--- /dev/null
+++ b/crates/socket-patch-core/src/formats/pnpm/mod.rs
@@ -0,0 +1,584 @@
+//! `pnpm-lock.yaml` in every generation (pnpm <= 2's `shrinkwrap.yaml`,
+//! lockfile 5.x block resolutions, 5.4 / 6.0 / 9.0 flow resolutions) and
+//! Rush's nested pnpm locks: the ONE model of the format.
+//!
+//! [`PnpmLock`] parses a lock text once and answers every question the
+//! modes ask of it:
+//!
+//! * [`PnpmLock::entries`] — the registry inventory (`scan` / `get`
+//!   lockfile supplements, `vendor`'s pristine fetch);
+//! * [`PnpmLock::resolves`] — whether the lock resolves a `name@version`
+//!   at all (`get`'s installed-version narrowing under pnpm PnP);
+//! * [`PnpmLock::wired_refs`] — every entry whose resolution names a
+//!   tarball, the raw material lockfile discovery (`vex::discover::npm`)
+//!   classifies as hosted / vendored refs, and [`PnpmLock::wired_integrity`]
+//!   repair's trust anchor for a vendored artifact;
+//! * [`PnpmLock::vendored_in_use`] — whether a vendored artifact is still
+//!   consumed (both vendored backends' revert guards and ledger liveness);
+//! * [`plan_hosted`] — the hosted planner (the redirect rewriter's pnpm
+//!   leg: resolution splices over the whole lock set);
+//! * the vendored planners (`vendor::pnpm_lock` for lockfileVersion 9.0,
+//!   `vendor::pnpm_lock_legacy` for 5.4 / 6.0) splice with [`lines`] and
+//!   route on [`sniff_lock_grammar`];
+//!
+//! Everything here is pure (text in, answers out); the callers own the
+//! reads.
+
+pub(crate) mod grammar;
+pub(crate) mod hosted;
+pub(crate) mod lines;
+
+pub(crate) use grammar::{entry_field, is_pnpm_lock_text, Entry, Resolution};
+pub(crate) use hosted::plan_hosted;
+
+use std::collections::HashSet;
+
+use crate::constants::npm_family::PNPM_LOCK;
+use crate::utils::digest::is_sri_pin;
+use crate::vendor::lock_inventory::{http_url, LockIntegrity, LockfileEntry};
+use crate::vendor::path::parse_vendor_path;
+
+
+// ── entry model ──
+
+/// One `packages:` entry of a pnpm lock, read with the entry grammar
+/// ([`grammar::entries`] / [`grammar::resolution`]: two-space keys, a flat
+/// flow or block `resolution:` map, CRLF included).
+pub(crate) struct PnpmPackage<'a> {
+    /// The packages key, trimmed and unquoted.
+    pub(crate) key: &'a str,
+    pub(crate) entry: Entry<'a>,
+    /// The entry's `resolution:` map; `None` when it has none or the
+    /// grammar refuses it (duplicate keys, nested values, aliases).
+    pub(crate) resolution: Option<Resolution<'a>>,
+}
+
+impl<'a> PnpmPackage<'a> {
+    /// The unquoted tokens of the entry's raw `resolution:` text
+    /// ([`grammar::resolution_raw_lines`] split on whitespace and flow
+    /// punctuation) — what a reader inspects when the grammar refused the
+    /// map (`resolution` is `None`) and it must still tell a Socket-shaped
+    /// value from anything else.
+    pub(crate) fn resolution_tokens(&self) -> Vec<&'a str> {
+        grammar::resolution_raw_lines(&self.entry)
+            .into_iter()
+            .flat_map(|text| {
+                text.split(|c: char| c.is_whitespace() || matches!(c, ',' | '{' | '}' | '[' | ']'))
+            })
+            .map(|token| grammar::unquote(token.trim()))
+            .filter(|token| !token.is_empty())
+            .collect()
+    }
+}
+
+/// Every `packages:` entry of a pnpm lock text, in lock order — the ONE
+/// entry walk the inventory, lockfile discovery and repair share. Every
+/// entry is returned (registry, rekeyed vendored, hosted, directory, git);
+/// each consumer applies its own key and resolution rules.
+pub(crate) fn pnpm_packages(text: &str) -> Vec<PnpmPackage<'_>> {
+    grammar::entries(text)
+        .into_iter()
+        .map(|entry| PnpmPackage {
+            key: grammar::unquote(entry.key.trim()),
+            resolution: grammar::resolution(&entry),
+            entry,
+        })
+        .collect()
+}
+
+/// The `(integrity, tarball)` of one recorded `packages:` block — a
+/// vendored planner's wiring fragment (its key line and body, as
+/// recorded), each unquoted; `None` unless the fragment is exactly one
+/// entry with a flat resolution.
+pub(crate) fn fragment_resolution(block: &[String]) -> Option<(Option<String>, Option<String>)> {
+    let text = format!("packages:\n{}\n", block.join("\n"));
+    let packages = pnpm_packages(&text);
+    let [package] = packages.as_slice() else {
+        return None;
+    };
+    let resolution = package.resolution.as_ref()?;
+    Some((
+        resolution.integrity().map(str::to_string),
+        resolution.tarball().map(str::to_string),
+    ))
+}
+
+/// How a pnpm packages key names its package.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum PnpmKey<'a> {
+    /// A registry key in any lock generation ([`pnpm_registry_key`]).
+    Registry { name: &'a str, version: &'a str },
+    /// v9's rekeyed vendored entry `name@file:<rel>` (`vendor::pnpm_lock`);
+    /// `path` is the raw `file:<rel>` spec, peer suffix stripped.
+    V9File { name: &'a str, path: &'a str },
+    /// v5.4 / v6.0's rekeyed vendored entry, the bare `file:<rel>` key
+    /// (`vendor::pnpm_lock_legacy`); the name is on the entry's `name:`
+    /// line.
+    LegacyFile { path: &'a str },
+    /// Anything else (url, git, `link:`, v5 non-default-registry keys).
+    Other,
+}
+
+/// Classify a packages key, in this order: a legacy `file:` key, a v9
+/// `name@file:` key (the `@` after a scope's leading one), a registry key,
+/// else [`PnpmKey::Other`]. The `file:` paths are returned raw — the CALLER
+/// anchors them (lockfile discovery with its root-anchored `vendor_ref`,
+/// the writers with `parse_vendor_path`).
+pub(crate) fn classify_pnpm_key(key: &str) -> PnpmKey<'_> {
+    let base = strip_pnpm_peer_suffix(key);
+    if base.starts_with("file:") {
+        PnpmKey::LegacyFile { path: base }
+    } else if let Some(at) = base.get(1..).and_then(|rest| rest.find("@file:")) {
+        PnpmKey::V9File {
+            name: &base[..at + 1],
+            path: &base[at + 2..],
+        }
+    } else {
+        match pnpm_registry_key(base) {
+            Some((name, version)) => PnpmKey::Registry { name, version },
+            None => PnpmKey::Other,
+        }
+    }
+}
+
+/// The uuid of the `.socket/vendor/npm/<uuid>/` artifact a rekeyed
+/// vendored key (v9 `name@file:<rel>` or legacy bare `file:<rel>`, in a
+/// `packages:` or `snapshots:` section) resolves to.
+pub(crate) fn vendored_npm_uuid(key: &str) -> Option<String> {
+    let path = match classify_pnpm_key(key) {
+        PnpmKey::V9File { path, .. } | PnpmKey::LegacyFile { path } => path,
+        PnpmKey::Registry { .. } | PnpmKey::Other => return None,
+    };
+    parse_vendor_path(path)
+        .filter(|parts| parts.eco == "npm")
+        .map(|parts| parts.uuid)
+}
+
+/// A pnpm packages key without its v6+ peer suffix (`(peer@1.0.0)…`).
+pub(crate) fn strip_pnpm_peer_suffix(key: &str) -> &str {
+    key.find('(').map_or(key, |p| key[..p].trim_end())
+}
+
+/// `(name, version)` of a REGISTRY-form pnpm packages key, in every lock
+/// generation's grammar — v9 `name@version`, v6 (pnpm 8) the same behind a
+/// leading `/`, v5.4 (pnpm 7) and shrinkwrap `/name/version`; names may be
+/// scoped in all of them. Peer suffixes are stripped: v6/v9 append
+/// `(peer@1.2.3)…` after the version, v5 appends `_peer@x` / `_<hash>` to
+/// the version itself. `None` for anything that is not a plain registry
+/// version (digit-first): `file:` / `link:` / url / git keys and v5
+/// non-default-registry keys. The ONE key rule every reader shares, so all
+/// of them read a key as the same package.
+pub(crate) fn pnpm_registry_key(key: &str) -> Option<(&str, &str)> {
+    let base = strip_pnpm_peer_suffix(key);
+    let (base, legacy) = match base.strip_prefix('/') {
+        Some(stripped) => (stripped, true),
+        None => (base, false),
+    };
+    let (name, version) = split_pnpm_key(base, legacy)?;
+    let version = version.split('_').next().unwrap_or(version);
+    version
+        .chars()
+        .next()
+        .is_some_and(|c| c.is_ascii_digit())
+        .then_some((name, version))
+}
+
+/// Split a peer-paren-stripped, slash-stripped pnpm packages key into
+/// `(name, version)`; `None` is skipped by the caller, never guessed.
+/// `legacy` marks a key that carried the v5/v6 leading `/` — only those may
+/// use the v5 `name/version` grammar. What tells v5 `/@scope/name/1.2.3`
+/// apart from v6 `/@scope/name@1.2.3` is the segment after the last `/`:
+/// a v5 version (its `_peer`/`_hash` suffix dropped) starts with a digit
+/// and never contains `@`, while a v6 scoped key's trailing segment is
+/// `name@version`. v5 non-default-registry keys (`example.com/name/1.2.3`)
+/// carry no leading `/` and fall through to the `@` split, where they are
+/// dropped fail-closed downstream.
+fn split_pnpm_key(base: &str, legacy: bool) -> Option<(&str, &str)> {
+    if legacy {
+        if let Some((name, rest)) = base.rsplit_once('/') {
+            let version = rest.split('_').next().unwrap_or(rest);
+            if !name.is_empty()
+                && version.chars().next().is_some_and(|c| c.is_ascii_digit())
+                && !version.contains('@')
+            {
+                return Some((name, version));
+            }
+        }
+    }
+    let at = base.rfind('@').filter(|&p| p > 0)?;
+    Some((&base[..at], &base[at + 1..]))
+}
+
+// ── lock version ──
+
+/// Which vendorable pnpm lock grammar a `pnpm-lock.yaml` head declares.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum PnpmLockGrammar {
+    /// `lockfileVersion: '9.0'` — the `vendor::pnpm_lock` backend.
+    V9,
+    /// `lockfileVersion: 5.4` (pnpm 7, bare float spelling).
+    V54,
+    /// `lockfileVersion: '6.0'` (pnpm 8).
+    V60,
+}
+
+impl PnpmLockGrammar {
+    /// Human name for diagnostics (`pnpm 7 (lockfileVersion 5.4)`).
+    pub fn describe(self) -> &'static str {
+        match self {
+            PnpmLockGrammar::V9 => "pnpm >= 9 (lockfileVersion 9.0)",
+            PnpmLockGrammar::V54 => "pnpm 7 (lockfileVersion 5.4)",
+            PnpmLockGrammar::V60 => "pnpm 8 (lockfileVersion 6.0)",
+        }
+    }
+}
+
+/// The `lockfileVersion:` a lock head (its first five lines) declares,
+/// unquoted.
+fn head_lock_version(text: &str) -> Option<String> {
+    text.lines()
+        .take(5)
+        .find_map(|line| line.strip_prefix("lockfileVersion:"))
+        .map(|rest| rest.trim().trim_matches(['\'', '"']).to_string())
+}
+
+/// The full vendor allowlist sniff (5.4 / 6.0 / 9.0) the flavor router
+/// uses; anything else refuses with a version-aware remedy: pre-allowlist
+/// versions (pnpm <= 6's 5.x line) are fixed by upgrading pnpm, but a
+/// FUTURE version means the user's pnpm already outgrew this build —
+/// looping them back to "re-lock with pnpm >= 9" would hand them the lock
+/// they have.
+pub fn sniff_lock_grammar(text: &str) -> Result<PnpmLockGrammar, String> {
+    match head_lock_version(text).as_deref() {
+        Some("9.0") => Ok(PnpmLockGrammar::V9),
+        Some("5.4") => Ok(PnpmLockGrammar::V54),
+        Some("6.0") => Ok(PnpmLockGrammar::V60),
+        Some(v) => {
+            let major = v.split('.').next().and_then(|m| m.parse::<u32>().ok());
+            Err(match major {
+                Some(m) if m < 9 => format!(
+                    "{PNPM_LOCK} has lockfileVersion {v}; supported versions are 5.4 \
+                     (pnpm 7), 6.0 (pnpm 8), and 9.0 (pnpm >= 9) — re-lock with pnpm >= 9"
+                ),
+                _ => format!(
+                    "{PNPM_LOCK} has lockfileVersion {v}; this socket-patch build supports \
+                     lockfileVersions 5.4, 6.0, and 9.0 — re-lock with a pnpm release that \
+                     emits one of them, or update socket-patch"
+                ),
+            })
+        }
+        None => Err(format!(
+            "{PNPM_LOCK} has no lockfileVersion in its head; supported versions are 5.4, \
+             6.0, and 9.0 — re-lock with pnpm >= 9"
+        )),
+    }
+}
+
+/// The `(major, minor)` of every `lockfileVersion:` line of a lock (the
+/// first one decides), unquoted; a missing minor reads as 0.
+fn lock_versions(text: &str) -> impl Iterator<Item = (Option<u32>, u32)> + '_ {
+    text.lines().filter_map(|line| {
+        let rest = line.strip_prefix("lockfileVersion:")?;
+        let value = rest.trim().trim_matches(|c| c == '\'' || c == '"');
+        let mut parts = value.split('.');
+        let major = parts.next().and_then(|m| m.parse::<u32>().ok());
+        let minor = parts.next().and_then(|m| m.parse::<u32>().ok()).unwrap_or(0);
+        Some((major, minor))
+    })
+}
+
+/// `lockfileVersion` major of a pnpm lock. pnpm 9-12 emit
+/// `lockfileVersion: '9.0'` (single doc, first line); pnpm 8 emits `'6.0'`,
+/// pnpm 7 an unquoted `5.4`. `None` when no parseable version line exists —
+/// the hosted trust-config gate treats that as "not trust-policy era" and
+/// stays hands-off (fail closed: never write config for a lock it can't
+/// read).
+pub fn lock_version_major(text: &str) -> Option<u32> {
+    lock_versions(text).find_map(|(major, _)| major)
+}
+
+/// Whether a pnpm lock may belong to pnpm 1–4, which spell the store flag
+/// `--store` (pnpm 1–3 can silently ignore `--store-dir`; early pnpm 4
+/// rejects it): a `shrinkwrapVersion` lock (pnpm 1–2) or lockfileVersion
+/// 5.0–5.2 (pnpm 3–5). Later locks never get the `--store` note.
+pub fn may_need_store_flag(text: &str) -> bool {
+    text.lines().any(|line| line.starts_with("shrinkwrapVersion:"))
+        || lock_versions(text).any(|(major, minor)| major == Some(5) && minor <= 2)
+}
+
+/// The lockfileVersion the v9 vendored planner splices.
+const V9_LOCK_VERSION: &str = "9.0";
+
+/// `lockfileVersion: '9.0'` head check (accept pnpm's single quotes plus
+/// double-quoted/bare spellings) — the v9 vendored planner's own guard.
+/// The flavor router sniffs with [`sniff_lock_grammar`] instead, whose
+/// allowlist also routes the legacy 5.4/6.0 grammars to their planner;
+/// this check only fires if a non-9.0 lock reaches the v9 planner directly.
+pub(crate) fn check_v9_lock_version(text: &str) -> Result<(), String> {
+    match head_lock_version(text) {
+        Some(v) if v == V9_LOCK_VERSION => Ok(()),
+        Some(v) => {
+            // The remedy must point the right way: 5.x (pnpm 7) / 6.x
+            // (pnpm 8) locks predate the v9 grammar and upgrading pnpm
+            // re-locks them, but a HIGHER version means the user's pnpm
+            // already outgrew this build — telling them "re-lock with
+            // pnpm >= 9" would loop them back to the lock they have.
+            let major = v.split('.').next().and_then(|m| m.parse::<u32>().ok());
+            Err(match major {
+                Some(m) if m < 9 => format!(
+                    "{PNPM_LOCK} has lockfileVersion {v}; only {V9_LOCK_VERSION} is \
+                     supported — re-lock with pnpm >= 9"
+                ),
+                _ => format!(
+                    "{PNPM_LOCK} has lockfileVersion {v}; this socket-patch build supports \
+                     lockfileVersion {V9_LOCK_VERSION} — re-lock with a pnpm release \
+                     that emits it, or update socket-patch"
+                ),
+            })
+        }
+        None => Err(format!(
+            "{PNPM_LOCK} has no lockfileVersion in its head; only \
+             {V9_LOCK_VERSION} is supported — re-lock with pnpm >= 9"
+        )),
+    }
+}
+
+// ── the model ──
+
+/// One pnpm lock, parsed once (see the module docs).
+pub struct PnpmLock<'t> {
+    text: &'t str,
+    packages: Vec<PnpmPackage<'t>>,
+    /// [`vendored_npm_uuids`] of the text.
+    vendored: HashSet<String>,
+}
+
+/// One `packages:` entry whose resolution names a tarball — a candidate
+/// hosted or vendored ref ([`PnpmLock::wired_refs`]).
+pub(crate) struct PnpmTarballRef<'p> {
+    pub(crate) tarball: &'p str,
+    /// The resolution's `integrity`, unfiltered (a caller that needs an SRI
+    /// pin checks it with `is_sri_pin`).
+    pub(crate) integrity: Option<&'p str>,
+}
+
+impl<'t> PnpmLock<'t> {
+    /// Parse a lock text (any content: a non-pnpm text has no entries).
+    pub fn parse(text: &'t str) -> Self {
+        PnpmLock {
+            text,
+            packages: pnpm_packages(text),
+            vendored: vendored_npm_uuids(text),
+        }
+    }
+
+    pub fn text(&self) -> &'t str {
+        self.text
+    }
+
+    /// Whether the text is a pnpm lock at all ([`is_pnpm_lock_text`]).
+    pub fn is_pnpm_lock(&self) -> bool {
+        is_pnpm_lock_text(self.text)
+    }
+
+    /// Every `packages:` entry, in lock order.
+    pub(crate) fn packages(&self) -> &[PnpmPackage<'t>] {
+        &self.packages
+    }
+
+    fn has_packages_section(&self) -> bool {
+        self.text
+            .lines()
+            .any(|l| l.trim_end_matches('\r') == "packages:")
+    }
+
+    /// The registry inventory: one entry per plain-registry packages key
+    /// (every key generation, [`pnpm_registry_key`]), flow and block
+    /// resolutions, CRLF included. A resolution the grammar refuses leaves
+    /// the entry listed without a verifier; our own vendored tarballs are
+    /// not registry dependencies and are dropped. `None` when the lock has
+    /// no `packages:` section.
+    pub fn entries(&self) -> Option<Vec<LockfileEntry>> {
+        if !self.has_packages_section() {
+            return None;
+        }
+        let mut out = Vec::new();
+        for package in &self.packages {
+            // Only plain registry versions: `file:`/`link:`/`https:`/git
+            // specs are not registry-resolvable.
+            let Some((name, version)) = pnpm_registry_key(package.key) else {
+                continue;
+            };
+            let resolution = package.resolution.as_ref();
+            let integrity = resolution
+                .and_then(|r| r.integrity())
+                .map(|i| LockIntegrity::Sri(i.to_string()))
+                .unwrap_or(LockIntegrity::None);
+            let tarball = resolution.and_then(|r| r.tarball());
+            if tarball.is_some_and(|t| parse_vendor_path(t).is_some()) {
+                continue;
+            }
+            out.push(LockfileEntry::npm(
+                name,
+                version,
+                tarball.and_then(http_url),
+                integrity,
+            ));
+        }
+        Some(out)
+    }
+
+    /// Whether some packages key resolves exactly `name@version` (any peer
+    /// suffix, any key generation).
+    pub fn resolves(&self, name: &str, version: &str) -> bool {
+        self.packages
+            .iter()
+            .any(|p| pnpm_registry_key(p.key) == Some((name, version)))
+    }
+
+    /// Every packages entry whose flat resolution names a `tarball:`, in
+    /// lock order.
+    pub(crate) fn wired_refs(&self) -> impl Iterator<Item = PnpmTarballRef<'_>> {
+        self.packages.iter().filter_map(|package| {
+            let resolution = package.resolution.as_ref()?;
+            Some(PnpmTarballRef {
+                tarball: resolution.tarball()?,
+                integrity: resolution.integrity(),
+            })
+        })
+    }
+
+    /// The SRI pin the lock records for the vendored artifact at
+    /// `artifact_rel` (forward-slashed, no `./`): the `integrity` of the
+    /// first entry whose tarball is `file:<rel>` and carries an SRI pin.
+    pub fn wired_integrity(&self, artifact_rel: &str) -> Option<String> {
+        self.wired_refs()
+            .filter(|r| {
+                let path = r.tarball.strip_prefix("file:").unwrap_or(r.tarball);
+                path.trim_start_matches("./") == artifact_rel
+            })
+            .find_map(|r| r.integrity.filter(|sri| is_sri_pin(sri)))
+            .map(str::to_string)
+    }
+
+    /// Is the vendored npm artifact of patch `uuid` still consumed by this
+    /// lock? `true` when a `packages:` / `snapshots:` block is keyed by it
+    /// ([`vendored_npm_uuid`] — v9's `name@file:` and legacy's bare `file:`
+    /// keys alike); `false` when the lock carries none (the `overrides:`
+    /// declaration alone never counts: pnpm keeps it mirrored from
+    /// package.json even when nothing matches it). CRLF locks read like LF
+    /// ones.
+    pub fn vendored_in_use(&self, uuid: &str) -> bool {
+        self.vendored.contains(uuid)
+    }
+}
+
+/// The uuid of every `packages:` / `snapshots:` block key that resolves
+/// into `.socket/vendor/npm/<uuid>/` — the block-key grammar the vendored
+/// planners splice with ([`lines::parse_key_line`] at two-space indent),
+/// read in one walk with each line's `\r` dropped, so a CRLF lock (a
+/// Windows autocrlf checkout) answers like its LF twin.
+pub(crate) fn vendored_npm_uuids(text: &str) -> HashSet<String> {
+    let mut out = HashSet::new();
+    let mut in_section = false;
+    for line in text.split('\n') {
+        let line = line.strip_suffix('\r').unwrap_or(line);
+        if !line.is_empty() && !line.starts_with(' ') {
+            in_section = line == "packages:" || line == "snapshots:";
+            continue;
+        }
+        if !in_section {
+            continue;
+        }
+        if let Some(uuid) = lines::parse_key_line(line, 2).and_then(|(key, _, _)| vendored_npm_uuid(key)) {
+            out.insert(uuid);
+        }
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const UUID: &str = "11111111-1111-4111-8111-111111111111";
+
+    #[test]
+    fn resolves_reads_every_key_generation_boundary_anchored() {
+        let lock = |keys: &str| format!("lockfileVersion: '9.0'\n\npackages:\n\n{keys}");
+        let yes = [
+            ("  left-pad@1.3.0:\n    resolution: {integrity: sha512-x}\n", "left-pad", "1.3.0"),
+            ("  /left-pad@1.3.0:\n    resolution: {}\n", "left-pad", "1.3.0"),
+            ("  /left-pad/1.3.0:\n    resolution: {}\n", "left-pad", "1.3.0"),
+            ("  'left-pad@1.3.0(react@18.0.0)':\n    dev: false\n", "left-pad", "1.3.0"),
+            ("  /left-pad/1.3.0_react@18.0.0:\n    dev: false\n", "left-pad", "1.3.0"),
+            ("  '@scope/name@1.0.0':\n    dev: false\n", "@scope/name", "1.0.0"),
+            ("  /@scope/name@1.0.0:\n    dev: false\n", "@scope/name", "1.0.0"),
+            ("  /@scope/name/1.0.0:\n    dev: false\n", "@scope/name", "1.0.0"),
+        ];
+        for (keys, name, version) in yes {
+            assert!(PnpmLock::parse(&lock(keys)).resolves(name, version), "{keys}");
+        }
+        let no = [
+            ("  left-pad@1.3.0-beta.1:\n    dev: false\n", "left-pad", "1.3.0"),
+            ("  left-pad@1.3.0:\n    dev: false\n", "pad", "1.3.0"),
+            ("  /left-pad/1.3.0:\n    dev: false\n", "pad", "1.3.0"),
+            ("  '@scope/name@1.0.0':\n    dev: false\n", "name", "1.0.0"),
+            ("  /@scope/name@1.0.0:\n    dev: false\n", "name", "1.0.0"),
+            ("  left-pad@1.3.1:\n    dev: false\n", "left-pad", "1.3.0"),
+            (
+                &format!("  left-pad@file:.socket/vendor/npm/{UUID}/left-pad-1.3.0.tgz:\n    version: 1.3.0\n"),
+                "left-pad",
+                "1.3.0",
+            ),
+        ];
+        for (keys, name, version) in no {
+            assert!(!PnpmLock::parse(&lock(keys)).resolves(name, version), "{keys}");
+        }
+        // Keys outside `packages:` (importers, overrides) resolve nothing.
+        let importers = "lockfileVersion: '9.0'\n\nimporters:\n\n  left-pad@1.3.0:\n    x: y\n";
+        assert!(!PnpmLock::parse(importers).resolves("left-pad", "1.3.0"));
+    }
+
+    #[test]
+    fn vendored_in_use_reads_v9_and_legacy_keys_and_crlf() {
+        let v9 = format!(
+            "lockfileVersion: '9.0'\n\npackages:\n\n  a@file:.socket/vendor/npm/{UUID}/a-1.0.0.tgz:\n    resolution: {{integrity: sha512-x, tarball: file:.socket/vendor/npm/{UUID}/a-1.0.0.tgz}}\n    version: 1.0.0\n"
+        );
+        let legacy = format!(
+            "lockfileVersion: 5.4\n\npackages:\n\n  file:.socket/vendor/npm/{UUID}/a-1.0.0.tgz:\n    resolution: {{integrity: sha512-x, tarball: file:.socket/vendor/npm/{UUID}/a-1.0.0.tgz}}\n    name: a\n    version: 1.0.0\n"
+        );
+        let snapshot = format!(
+            "lockfileVersion: '9.0'\n\nsnapshots:\n\n  a@file:.socket/vendor/npm/{UUID}/a-1.0.0.tgz: {{}}\n"
+        );
+        for text in [&v9, &legacy, &snapshot] {
+            assert!(PnpmLock::parse(text).vendored_in_use(UUID), "{text}");
+            let other = "22222222-2222-4222-8222-222222222222";
+            assert!(!PnpmLock::parse(text).vendored_in_use(other));
+            let crlf = text.replace('\n', "\r\n");
+            assert!(PnpmLock::parse(&crlf).vendored_in_use(UUID), "CRLF reads like LF");
+        }
+        // An overrides declaration alone is not usage.
+        let overrides = format!(
+            "lockfileVersion: '9.0'\n\noverrides:\n  a@1.0.0: file:.socket/vendor/npm/{UUID}/a-1.0.0.tgz\n"
+        );
+        assert!(!PnpmLock::parse(&overrides).vendored_in_use(UUID));
+    }
+
+    #[test]
+    fn wired_integrity_reads_the_vendored_entry_pin_only() {
+        let sri = "sha512-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==";
+        let rel = format!(".socket/vendor/npm/{UUID}/a-1.0.0.tgz");
+        for text in [
+            format!("lockfileVersion: '9.0'\n\npackages:\n\n  a@file:{rel}:\n    resolution: {{integrity: {sri}, tarball: file:{rel}}}\n    version: 1.0.0\n"),
+            format!("lockfileVersion: 5.4\r\n\r\npackages:\r\n\r\n  file:{rel}:\r\n    resolution: {{integrity: {sri}, tarball: file:{rel}}}\r\n    name: a\r\n"),
+        ] {
+            assert_eq!(PnpmLock::parse(&text).wired_integrity(&rel).as_deref(), Some(sri));
+        }
+        // A neighbouring registry entry's pin never leaks into the answer.
+        let neighbour = format!(
+            "lockfileVersion: '9.0'\n\npackages:\n\n  a@file:{rel}:\n    version: 1.0.0\n\n  b@1.0.0:\n    resolution: {{integrity: {sri}}}\n"
+        );
+        assert_eq!(PnpmLock::parse(&neighbour).wired_integrity(&rel), None);
+    }
+}
diff --git a/crates/socket-patch-core/src/formats/registry.rs b/crates/socket-patch-core/src/formats/registry.rs
new file mode 100644
index 00000000..dd89a862
--- /dev/null
+++ b/crates/socket-patch-core/src/formats/registry.rs
@@ -0,0 +1,223 @@
+//! Which project files carry a lock or its wiring, per ecosystem, and in
+//! which roles — the ONE table the hosted planners' candidate reads, the
+//! vendored planners' wiring search, lockfile discovery's vendored-liveness
+//! probe, the in-memory engine's root detection and the npm-family flavor
+//! probes all filter.
+//!
+//! The roles intentionally diverge per file (a binary Bun lock has a native
+//! reader and is never text-scanned for wiring; `pnpm-lock.yml` is only a
+//! package-manager marker; Gradle scripts are read by the hosted Maven
+//! planner for their presence only); each divergence is one flag on one
+//! row. Paths are root-relative with `/` separators. Dynamic sets — PEP 751
+//! / PEP 723 Python locks, vlt importer manifests, requirements `-r`
+//! includes, Rush's nested pnpm locks — are enumerated by their callers.
+
+/// Read by the hosted planners (`scan --mode hosted`, the in-memory
+/// engine's candidate reads).
+pub const HOSTED: u8 = 1 << 0;
+/// Rewired by a vendored planner: the search space for
+/// `.socket/vendor/<eco>/<uuid>/<leaf>` references when the vendor ledger
+/// is gone (`repair`).
+pub const VENDORED: u8 = 1 << 1;
+/// A lock (or wiring config) a vendored artifact is consumed through — the
+/// liveness probe of a ledger entry whose recorded wiring files are gone
+/// (`vex::discover`), and the npm-family flavor probe's lock family.
+pub const PROBE: u8 = 1 << 2;
+/// Makes its directory a project root (the in-memory hosted engine).
+pub const ROOT: u8 = 1 << 3;
+/// Marks a pnpm project for package-manager detection.
+pub const PNPM_MARKER: u8 = 1 << 4;
+/// Read by the hosted planners for its presence (or as advisory input)
+/// only: no hosted rewriter edits it, so it names no ecosystem for the
+/// symlinked-read refusal.
+pub const PRESENCE_ONLY: u8 = 1 << 5;
+
+/// One row of the [`registry`].
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct FormatFile {
+    /// Root-relative path.
+    pub path: &'static str,
+    /// Vendor-ecosystem tag (`npm`, `pypi`, `cargo`, …).
+    pub ecosystem: &'static str,
+    /// The roles, a mask of [`HOSTED`], [`VENDORED`], [`PROBE`], [`ROOT`],
+    /// [`PNPM_MARKER`] and [`PRESENCE_ONLY`].
+    pub roles: u8,
+}
+
+impl FormatFile {
+    pub fn has(&self, role: u8) -> bool {
+        self.roles & role != 0
+    }
+
+    /// The path's last segment.
+    pub fn basename(&self) -> &'static str {
+        self.path.rsplit('/').next().unwrap_or(self.path)
+    }
+}
+
+const fn row(path: &'static str, ecosystem: &'static str, roles: u8) -> FormatFile {
+    FormatFile {
+        path,
+        ecosystem,
+        roles,
+    }
+}
+
+/// In the hosted planners' read order.
+const REGISTRY: &[FormatFile] = &[
+    // ── npm family ──
+    row("package-lock.json", "npm", HOSTED | VENDORED | PROBE | ROOT),
+    row("npm-shrinkwrap.json", "npm", HOSTED | VENDORED | PROBE | ROOT),
+    row(
+        "pnpm-lock.yaml",
+        "npm",
+        HOSTED | VENDORED | PROBE | ROOT | PNPM_MARKER,
+    ),
+    // Package-manager detection only: the vendor probe and the hosted
+    // planners have never accepted these spellings.
+    row("pnpm-lock.yml", "npm", PNPM_MARKER),
+    row("pnpm-workspace.yaml", "npm", PNPM_MARKER),
+    // pnpm <= 2 uses the same package identities under the old filename.
+    row("shrinkwrap.yaml", "npm", HOSTED),
+    row("node_modules/.modules.yaml", "npm", HOSTED),
+    row("yarn.lock", "npm", HOSTED | VENDORED | PROBE | ROOT),
+    // A berry lock's cache-config gate: read by the hosted planners only.
+    row(".yarnrc.yml", "npm", HOSTED),
+    row("bun.lock", "npm", HOSTED | VENDORED | PROBE | ROOT),
+    // Binary Bun locks are read and rewritten natively, never text-scanned
+    // for wiring.
+    row("bun.lockb", "npm", HOSTED | PROBE | ROOT),
+    row("vlt-lock.json", "npm", HOSTED | VENDORED | PROBE | ROOT),
+    // vlt's config: a read-only hosted input (the old-lockfile advisory).
+    row("vlt.json", "npm", HOSTED),
+    // The hidden lock is only stat'ed as the install-state sentinel.
+    row("node_modules/.vlt-lock.json", "npm", HOSTED),
+    // The vendored planners' override surface; manifests never make a root.
+    row("package.json", "npm", VENDORED),
+    row("rush.json", "npm", ROOT),
+    // ── pypi ──
+    row("requirements.txt", "pypi", HOSTED | VENDORED | PROBE | ROOT),
+    row("uv.lock", "pypi", HOSTED | VENDORED | PROBE | ROOT),
+    row("poetry.lock", "pypi", HOSTED | VENDORED | PROBE | ROOT),
+    row("pdm.lock", "pypi", HOSTED | VENDORED | PROBE | ROOT),
+    row("Pipfile.lock", "pypi", HOSTED | VENDORED | PROBE | ROOT),
+    row("pyproject.toml", "pypi", HOSTED | VENDORED | PROBE),
+    row("hatch.toml", "pypi", HOSTED | PROBE),
+    // ── cargo ──
+    row("Cargo.toml", "cargo", HOSTED | VENDORED | PROBE),
+    row("Cargo.lock", "cargo", HOSTED | VENDORED | ROOT),
+    row(".cargo/config.toml", "cargo", HOSTED | VENDORED | PROBE),
+    // The LEGACY extensionless spelling: cargo reads `.cargo/config` in
+    // preference to `config.toml` when both exist, so the hosted planner
+    // must see it (it wires the managed registry into whichever one is
+    // present); vendored wiring before v5 lived there too.
+    row(".cargo/config", "cargo", HOSTED | VENDORED | PROBE),
+    // ── composer ──
+    row("composer.json", "composer", VENDORED),
+    row("composer.lock", "composer", HOSTED | VENDORED | PROBE | ROOT),
+    // ── nuget ──
+    row("nuget.config", "nuget", HOSTED | PROBE),
+    row("NuGet.config", "nuget", PROBE),
+    row("NuGet.Config", "nuget", PROBE),
+    row("packages.lock.json", "nuget", HOSTED),
+    // ── gem ──
+    row("Gemfile", "gem", HOSTED | VENDORED),
+    row("Gemfile.lock", "gem", HOSTED | VENDORED | PROBE | ROOT),
+    // Bundler's modern manifest spelling — preferred over Gemfile when both
+    // exist (the gem planner picks the pair bundler reads and fails closed
+    // on diverging spellings).
+    row("gems.rb", "gem", HOSTED),
+    row("gems.locked", "gem", HOSTED | ROOT),
+    // ── golang ──
+    // The hosted planner edits the main module's go.mod (fork-style
+    // `replace`) and go.sum (the socket module's two h1: lines); go.sum may
+    // legitimately be absent — the planner creates it then.
+    row("go.mod", "golang", HOSTED | VENDORED | PROBE | ROOT),
+    row("go.sum", "golang", HOSTED | ROOT),
+    // ── maven ──
+    row("pom.xml", "maven", HOSTED | PROBE),
+    // Maven Trusted Checksums files the fail-closed maven planner merges
+    // into (read so an existing user config / checksum set is preserved).
+    row(".mvn/maven.config", "maven", HOSTED),
+    row(".mvn/checksums/checksums.sha256", "maven", HOSTED),
+    // Gradle build scripts are never edited — their presence only feeds the
+    // maven planner's paste-able `exclusiveContent` snippet warning.
+    row("settings.gradle", "maven", HOSTED | PRESENCE_ONLY),
+    row("settings.gradle.kts", "maven", HOSTED | PRESENCE_ONLY),
+    row("build.gradle", "maven", HOSTED | PRESENCE_ONLY),
+    row("build.gradle.kts", "maven", HOSTED | PRESENCE_ONLY),
+    // deno.lock is deliberately absent: deno is its own ecosystem
+    // (JSR-crawled) and no planner edits its integrity entries.
+];
+
+/// Every row, in the hosted planners' read order.
+pub fn registry() -> &'static [FormatFile] {
+    REGISTRY
+}
+
+/// The paths of every row carrying `role`, in registry order.
+pub fn paths_with(role: u8) -> Vec<&'static str> {
+    REGISTRY
+        .iter()
+        .filter(|f| f.has(role))
+        .map(|f| f.path)
+        .collect()
+}
+
+/// The [`PROBE`] paths of `ecosystem`, in registry order.
+pub fn probe_paths(ecosystem: &str) -> Vec<&'static str> {
+    REGISTRY
+        .iter()
+        .filter(|f| f.ecosystem == ecosystem && f.has(PROBE))
+        .map(|f| f.path)
+        .collect()
+}
+
+/// The ecosystem whose hosted planner edits a candidate file, by basename
+/// (`rel` may be nested, e.g. a Rush lock or a workspace member's
+/// `Cargo.toml`); `None` for files no hosted rewriter edits.
+pub fn hosted_file_ecosystem(rel: &str) -> Option<&'static str> {
+    let base = rel.rsplit('/').next().unwrap_or(rel);
+    REGISTRY
+        .iter()
+        .find(|f| f.has(HOSTED) && !f.has(PRESENCE_ONLY) && f.basename() == base)
+        .map(|f| f.ecosystem)
+}
+
+/// The [`ROOT`] row a basename names.
+pub fn root_marker(base: &str) -> Option<&'static FormatFile> {
+    REGISTRY.iter().find(|f| f.has(ROOT) && f.path == base)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn paths_are_unique_and_root_markers_are_root_level() {
+        let mut paths: Vec<&str> = REGISTRY.iter().map(|f| f.path).collect();
+        paths.sort_unstable();
+        let before = paths.len();
+        paths.dedup();
+        assert_eq!(before, paths.len(), "duplicate registry path");
+        for f in REGISTRY.iter().filter(|f| f.has(ROOT)) {
+            assert!(!f.path.contains('/'), "{}: a root marker is a basename", f.path);
+        }
+    }
+
+    #[test]
+    fn hosted_file_ecosystem_matches_basenames_of_edited_files_only() {
+        assert_eq!(hosted_file_ecosystem("package-lock.json"), Some("npm"));
+        assert_eq!(
+            hosted_file_ecosystem("common/config/rush/pnpm-lock.yaml"),
+            Some("npm")
+        );
+        assert_eq!(hosted_file_ecosystem(".modules.yaml"), Some("npm"));
+        assert_eq!(hosted_file_ecosystem("crates/a/Cargo.toml"), Some("cargo"));
+        assert_eq!(hosted_file_ecosystem(".cargo/config"), Some("cargo"));
+        assert_eq!(hosted_file_ecosystem("checksums.sha256"), Some("maven"));
+        assert_eq!(hosted_file_ecosystem("build.gradle"), None);
+        assert_eq!(hosted_file_ecosystem("package.json"), None);
+        assert_eq!(hosted_file_ecosystem("NuGet.Config"), None);
+    }
+}
diff --git a/crates/socket-patch-core/src/formats/yarn/mod.rs b/crates/socket-patch-core/src/formats/yarn/mod.rs
new file mode 100644
index 00000000..c7f51d5b
--- /dev/null
+++ b/crates/socket-patch-core/src/formats/yarn/mod.rs
@@ -0,0 +1,86 @@
+//! `yarn.lock`, classic (v1) and berry (v2+): the grammar split every
+//! reader of the file routes on.
+//!
+//! The entry grammars themselves (`vendor::yarn_classic_lock`'s block walk,
+//! `lock_inventory::yarn`'s entry models) and the hosted splices are still
+//! read through their current homes; this module owns the one decision
+//! they all start from — which grammar a lock is — so the vendor flavor
+//! probe, the lock-inventory view, repair's reference flavor, both hosted
+//! rewriters and lockfile discovery cannot disagree on it.
+
+/// Which grammar a `yarn.lock` head declares.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum YarnLockGrammar {
+    /// A column-0 `__metadata:` key (yarn >= 2).
+    Berry,
+    /// The `# yarn lockfile v1` comment header.
+    Classic,
+}
+
+/// How many head lines [`sniff_grammar`] reads.
+const SNIFF_HEAD_LINES: usize = 30;
+
+/// Why [`sniff_grammar`] found neither grammar, for the refusal detail.
+pub const UNIDENTIFIED_DETAIL: &str = "yarn.lock carries neither the `# yarn lockfile v1` \
+     header nor a berry `__metadata:` key; cannot identify the lockfile version";
+
+/// The head sniff: berry when one of the first lines is a column-0
+/// `__metadata:` key, else classic when one is the `# yarn lockfile v1`
+/// header, else `None`. Berry wins the check — a berry lock must never be
+/// mistaken for classic. CRLF lines split like LF ones; a leading BOM is
+/// not key text.
+pub fn sniff_grammar(text: &str) -> Option<YarnLockGrammar> {
+    let head: Vec<&str> = strip_bom(text).lines().take(SNIFF_HEAD_LINES).collect();
+    if head.iter().any(|l| l.starts_with("__metadata:")) {
+        Some(YarnLockGrammar::Berry)
+    } else if head.iter().any(|l| l.trim() == "# yarn lockfile v1") {
+        Some(YarnLockGrammar::Classic)
+    } else {
+        None
+    }
+}
+
+/// A yarn.lock is berry (v2+) when ANY line carries the `__metadata:`
+/// header key; anything else is a classic v1 lock. The whole-file check
+/// both hosted rewriters, lockfile discovery and the classic vendored
+/// backend's refusal gate share. A leading BOM is encoding, not key text
+/// (yarn's YAML parser drops it), so a header-less lock opening with
+/// `\u{feff}__metadata:` is berry too.
+pub fn is_berry_lock(content: &str) -> bool {
+    strip_bom(content)
+        .lines()
+        .any(|line| line.starts_with("__metadata:"))
+}
+
+fn strip_bom(text: &str) -> &str {
+    text.strip_prefix('\u{feff}').unwrap_or(text)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn sniff_prefers_berry_and_skips_a_bom() {
+        assert_eq!(sniff_grammar("__metadata:\n  version: 8\n"), Some(YarnLockGrammar::Berry));
+        assert_eq!(
+            sniff_grammar("\u{feff}# yarn lockfile v1\r\n"),
+            Some(YarnLockGrammar::Classic)
+        );
+        assert_eq!(
+            sniff_grammar("# yarn lockfile v1\n__metadata:\n"),
+            Some(YarnLockGrammar::Berry)
+        );
+        assert_eq!(sniff_grammar("a@1:\n  version \"1\"\n"), None);
+        let deep = format!("{}# yarn lockfile v1\n", "\n".repeat(SNIFF_HEAD_LINES));
+        assert_eq!(sniff_grammar(&deep), None);
+    }
+
+    #[test]
+    fn is_berry_lock_reads_the_whole_file_and_skips_a_bom() {
+        assert!(is_berry_lock("\u{feff}__metadata:\n"));
+        let deep = format!("{}__metadata:\n", "\n".repeat(100));
+        assert!(is_berry_lock(&deep));
+        assert!(!is_berry_lock("# yarn lockfile v1\n  __metadata:\n"));
+    }
+}
diff --git a/crates/socket-patch-core/src/lib.rs b/crates/socket-patch-core/src/lib.rs
index 04a2a6f9..01ed5652 100644
--- a/crates/socket-patch-core/src/lib.rs
+++ b/crates/socket-patch-core/src/lib.rs
@@ -1,6 +1,7 @@
 pub mod api;
 pub mod constants;
 pub mod crawlers;
+pub mod formats;
 pub mod hash;
 pub mod manifest;
 pub mod package_json;
diff --git a/crates/socket-patch-core/src/package_json/find.rs b/crates/socket-patch-core/src/package_json/find.rs
index 7912e153..34c648ad 100644
--- a/crates/socket-patch-core/src/package_json/find.rs
+++ b/crates/socket-patch-core/src/package_json/find.rs
@@ -3,6 +3,7 @@ use tokio::fs;
 
 use super::detect::{strip_bom, PackageManager};
 use crate::constants::npm_family;
+use crate::formats::registry;
 use crate::utils::fs::{entry_file_type, is_dir, list_dir_entries, read_regular_to_string};
 use crate::vendor::vlt_lock_text::{sniff_lock, LockSniff};
 
@@ -11,7 +12,8 @@ use crate::vendor::vlt_lock_text::{sniff_lock, LockSniff};
 /// over pnpm's, and only the start directory is consulted: an ancestor
 /// `vlt.json` does not make a nested package a vlt project. The accepted
 /// pnpm marker spellings (including the `pnpm-lock.yml` variant no other
-/// subsystem accepts) live in the shared [`npm_family`] table.
+/// subsystem accepts) are the format registry's
+/// [`PNPM_MARKER`](registry::PNPM_MARKER) rows.
 pub async fn detect_package_manager(start_path: &Path) -> PackageManager {
     for name in npm_family::VLT_SETUP_MARKERS {
         let path = start_path.join(name);
@@ -24,7 +26,7 @@ pub async fn detect_package_manager(start_path: &Path) -> PackageManager {
             return PackageManager::Vlt;
         }
     }
-    for name in npm_family::names_with(|r| r.detects_pnpm) {
+    for name in registry::paths_with(registry::PNPM_MARKER) {
         if fs::metadata(start_path.join(name)).await.is_ok() {
             return PackageManager::Pnpm;
         }
@@ -753,11 +755,11 @@ mod tests {
 
     #[tokio::test]
     async fn detect_package_manager_accepts_every_table_flagged_pnpm_marker() {
-        // Behavioral pin on the shared npm_family table wiring: every row
-        // flagged detects_pnpm (including the `pnpm-lock.yml` spelling no
+        // Behavioral pin on the format registry wiring: every row
+        // flagged PNPM_MARKER (including the `pnpm-lock.yml` spelling no
         // other subsystem accepts) flips detection to Pnpm; an empty root
         // stays Npm.
-        for name in crate::constants::npm_family::names_with(|r| r.detects_pnpm) {
+        for name in registry::paths_with(registry::PNPM_MARKER) {
             let dir = tempfile::tempdir().unwrap();
             fs::write(dir.path().join(name), "").await.unwrap();
             assert!(
@@ -778,11 +780,11 @@ mod tests {
     #[test]
     fn pnpm_marker_spellings_are_pinned_by_value() {
         // Hardcoded on purpose, breaking the self-reference: production code
-        // iterates the same names_with(detects_pnpm) expression the guard
+        // iterates the same registry PNPM_MARKER expression the guard
         // test above does, so a row deleted from the table would shrink code
         // and guard together while `.yml` detection silently vanished. This
         // list cannot shrink with them.
-        let mut spellings = crate::constants::npm_family::names_with(|r| r.detects_pnpm);
+        let mut spellings = registry::paths_with(registry::PNPM_MARKER);
         spellings.sort_unstable();
         assert_eq!(
             spellings,
diff --git a/crates/socket-patch-core/src/patch/redirect/cargo_lock_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/cargo_lock_equivalence_tests.rs
index ad4e20a0..570ee762 100644
--- a/crates/socket-patch-core/src/patch/redirect/cargo_lock_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/cargo_lock_equivalence_tests.rs
@@ -1,11 +1,274 @@
-//! Equivalence oracle for the Cargo.lock block bound, which now searches the
-//! trailing-table markers only up to the next `[[package]]` instead of to
-//! EOF. The previous implementation is kept as
-//! [`lock_block_end_unbounded`]; every consumer (`plan_cargo_lock`,
-//! `next_lock_block`) is a function of the bound alone, so equality at every
-//! body offset of every lock shape is equality of the rewriter.
+//! Equivalence oracle for the Cargo.lock hosted splice, which now edits the
+//! byte spans of the lock's one parse ([`CargoLock::parse`] →
+//! [`CargoLock::plan_hosted`]) instead of searching the text for cargo's
+//! canonical `[[package]]\nname = …\nversion = …\n` header. The previous
+//! line-grammar planner is kept below, test-only, as the oracle: over every
+//! canonical lock shape (v1 `[metadata]` + full-id references, v3/v4 inline
+//! checksums, multi-source twins, `[root]`, trailers, a missing final
+//! newline) both must produce identical bytes and identical `FileEdit`s,
+//! for every package of every lock and a re-run over the result. (Locks the
+//! old grammar could not read — a comment or reordered key inside a block —
+//! are where the two differ by design: the span planner finds them.)
+
+use std::sync::LazyLock;
+
+use regex::Regex;
+use serde_json::Value;
+
+use crate::formats::cargo::hosted::{CargoLockPlan, CARGO_LOCK_REFERENCE_KIND};
+use crate::formats::cargo::CargoLock;
+use crate::patch::redirect::FileEdit;
+
+// ── the oracle: the previous line-grammar planner, verbatim ──
+
+/// The line-anchored header cargo writes for `name`@`version`.
+fn package_head(name: &str, version: &str) -> String {
+    format!("[[package]]\nname = \"{name}\"\nversion = \"{version}\"\n")
+}
+
+/// Every offset of `needle` in `content` that starts a line.
+fn line_anchored<'c>(content: &'c str, needle: &'c str) -> impl Iterator<Item = usize> + 'c {
+    content
+        .match_indices(needle)
+        .map(|(at, _)| at)
+        .filter(|&at| at == 0 || content.as_bytes()[at - 1] == b'\n')
+}
+
+static CARGO_LOCK_SOURCE_LINE_RE: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(r#"(?m)^source = "([^"]*)"$"#).expect("static lock source-line regex is valid")
+});
+static CARGO_LOCK_CHECKSUM_LINE_RE: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(r#"(?m)^checksum = "[^"]*"$"#).expect("static lock checksum-line regex is valid")
+});
+// `$` (not `\n`) so it also anchors a source line that ENDS the block: the
+// trailing newline sits outside the block region.
+static CARGO_LOCK_AFTER_SOURCE_RE: LazyLock<Regex> = LazyLock::new(|| {
+    Regex::new(r#"(?m)^(source = "[^"]*")$"#).expect("static source-line anchor regex is valid")
+});
+
+/// Repoint the crate's `[[package]]` at the hosted index with the patched
+/// `.crate`'s checksum, in whichever Cargo.lock format the file is:
+///
+/// * v2–v4: `source` + an inline `checksum` in the entry;
+/// * v1 (cargo < 1.41, still read by every cargo): the entry carries only
+///   `source`; the checksum lives in the trailing `[metadata]` table under
+///   `"checksum <name> <version> (<source>)"`, and every dependent names the
+///   crate by its FULL package id `"<name> <version> (<source>)"`. Both are
+///   keyed by the source, so both must follow it — a v1 lock with only the
+///   entry repointed names a package that no longer exists (cargo discards
+///   the lock and re-resolves; `--locked` fails) and pins nothing.
+///
+/// Full-id references are rewritten in any format (v2+ spells them that way
+/// when a name + version is ambiguous). Each changed fragment is its own
+/// `redirect_cargo_lock_entry` edit (unique text, so the fragment revert is
+/// unambiguous) — the entry and the `[metadata]` line — and the dependents'
+/// references are one `redirect_cargo_lock_reference` edit holding the
+/// quoted full id, reverted at every occurrence.
+fn plan_cargo_lock(
+    content: &str,
+    crate_name: &str,
+    version: &str,
+    index_url: &str,
+    cksum: &str,
+) -> CargoLockPlan {
+    // Rust's regex has NO lookahead, so bound the [[package]] block by string
+    // search (see [`lock_block_end`]): from its header to the next block or
+    // trailing table (or EOF), so the bytes after the block (incl. the final
+    // newline) are preserved.
+    let head = package_head(crate_name, version);
+    // Every line-anchored header for this name@version. A Cargo.lock may
+    // legitimately hold TWO blocks for one name@version from different
+    // sources — after a redirect, a transitive crates.io copy resolves beside
+    // the socket-registry copy, and cargo sorts the crates.io block FIRST —
+    // so the first hit alone would repoint the wrong twin.
+    let heads: Vec<usize> = line_anchored(content, &head).collect();
+    let block_start = match heads.as_slice() {
+        [] => return CargoLockPlan::NotFound,
+        [only] => *only,
+        twins => {
+            // Exactly one twin already at the target index is OURS (a re-run
+            // over a redirected lock); anything else cannot be attributed and
+            // the dep is skipped transactionally.
+            let target_source = format!("source = \"{index_url}\"");
+            let mut ours = twins.iter().copied().filter(|&at| {
+                let body_start = at + head.len();
+                content[body_start..lock_block_end(content, body_start)]
+                    .lines()
+                    .any(|line| line == target_source)
+            });
+            match (ours.next(), ours.next()) {
+                (Some(at), None) => at,
+                _ => return CargoLockPlan::Ambiguous,
+            }
+        }
+    };
+    let body_start = block_start + head.len();
+    let block_end = lock_block_end(content, body_start);
+    let original = content[block_start..block_end].to_string();
+    let mut body = content[body_start..block_end].to_string();
+    let old_source = CARGO_LOCK_SOURCE_LINE_RE
+        .captures(&body)
+        .map(|c| c[1].to_string());
+    if old_source.is_some() {
+        body = CARGO_LOCK_SOURCE_LINE_RE
+            .replace(&body, format!("source = \"{index_url}\"").as_str())
+            .to_string();
+    } else {
+        body = format!("source = \"{index_url}\"\n{body}");
+    }
+    // A v1 lock keeps the checksum in `[metadata]`, keyed by the package id
+    // — the chosen block's OWN source when it has one, so a multi-source
+    // twin's line is never taken for ours.
+    let metadata_source = old_source
+        .as_deref()
+        .map_or_else(|| r#"[^)"]*"#.to_string(), regex::escape);
+    let metadata_re = Regex::new(&format!(
+        r#"(?m)^"checksum {} {} \({metadata_source}\)" = "[^"]*"$"#,
+        regex::escape(crate_name),
+        regex::escape(version)
+    ))
+    .expect("escaped lock metadata-line regex is valid");
+    let metadata_line = metadata_re.find(content).map(|m| m.as_str().to_string());
+    if metadata_line.is_none() {
+        if CARGO_LOCK_CHECKSUM_LINE_RE.is_match(&body) {
+            body = CARGO_LOCK_CHECKSUM_LINE_RE
+                .replace(&body, format!("checksum = \"{cksum}\"").as_str())
+                .to_string();
+        } else {
+            body = CARGO_LOCK_AFTER_SOURCE_RE
+                .replace(&body, format!("${{1}}\nchecksum = \"{cksum}\"").as_str())
+                .to_string();
+        }
+    }
+    let rebuilt = format!("{head}{body}");
+    let key = format!("{crate_name}@{version}");
+    let edit = |original: &str, new: &str| FileEdit {
+        path: "Cargo.lock".into(),
+        kind: "redirect_cargo_lock_entry".into(),
+        action: "rewritten".into(),
+        key: Some(key.clone()),
+        original: Some(Value::String(original.to_string())),
+        new: Some(Value::String(new.to_string())),
+    };
+    let mut edits = Vec::new();
+    let mut new_content = content.to_string();
+    if rebuilt != original {
+        new_content.replace_range(block_start..block_end, &rebuilt);
+        edits.push(edit(&original, &rebuilt));
+    }
+    if let Some(line) = metadata_line {
+        let pinned = format!("\"checksum {crate_name} {version} ({index_url})\" = \"{cksum}\"");
+        if line != pinned {
+            new_content = new_content.replacen(&line, &pinned, 1);
+            edits.push(edit(&line, &pinned));
+        }
+    }
+    // Dependents' full-id references to the OLD source, recorded as ONE
+    // `redirect_cargo_lock_reference` edit holding just the quoted id —
+    // never a dependent's whole block: a block referencing two patched
+    // packages (the root of a v1 lock) would hold two overlapping block
+    // edits, and reverting the first-applied one alone would find neither of
+    // its fragments. The id names this name + version + source exactly, so its
+    // inverse puts back EVERY occurrence, independently of any other
+    // package's edits and in any removal order.
+    if let Some(old) = old_source.filter(|old| old != index_url) {
+        let from = format!("\"{crate_name} {version} ({old})\"");
+        let to = format!("\"{crate_name} {version} ({index_url})\"");
+        let mut repointed_any = false;
+        // The oldest v1 locks keep the ROOT package in a standalone `[root]`
+        // table instead of the `[[package]]` array, with its own full-id
+        // `dependencies`. It precedes the array, so the block walk below
+        // never reaches it and the lock would keep naming a package it no
+        // longer contains (`--locked` fails; an unlocked build silently
+        // re-resolves).
+        if let Some((start, end)) = lock_root_table(&new_content) {
+            if new_content[start..end].contains(&from) {
+                let repointed = new_content[start..end].replace(&from, &to);
+                new_content.replace_range(start..end, &repointed);
+                repointed_any = true;
+            }
+        }
+        let mut cursor = 0;
+        while let Some((start, end)) = next_lock_block(&new_content, cursor) {
+            if new_content[start..end].contains(&from) {
+                let repointed = new_content[start..end].replace(&from, &to);
+                new_content.replace_range(start..end, &repointed);
+                repointed_any = true;
+                cursor = start + repointed.len();
+            } else {
+                cursor = end;
+            }
+        }
+        if repointed_any {
+            edits.push(FileEdit {
+                kind: CARGO_LOCK_REFERENCE_KIND.into(),
+                ..edit(&from, &to)
+            });
+        }
+    }
+    // Already redirected (re-run): every fragment is at the target values; a
+    // recorded edit would have original == new and grow the ledger forever.
+    if edits.is_empty() {
+        return CargoLockPlan::AlreadyRedirected;
+    }
+    CargoLockPlan::Rewritten {
+        content: new_content,
+        edits,
+    }
+}
+
+/// The v1 `[root]` table's span, when the lock has one: cargo before the
+/// `[root]` removal recorded the root package there rather than in the
+/// `[[package]]` array, and its `dependencies` spell full package ids the
+/// same way. Bounded by [`lock_block_end`], like a package block.
+fn lock_root_table(content: &str) -> Option<(usize, usize)> {
+    const HEADER: &str = "[root]\n";
+    let at = content
+        .match_indices(HEADER)
+        .map(|(at, _)| at)
+        .find(|&at| at == 0 || content.as_bytes()[at - 1] == b'\n')?;
+    Some((at, lock_block_end(content, at + HEADER.len())))
+}
+
+/// The next `[[package]]` block starting at or after `from`, as
+/// [`lock_block_end`] bounds it.
+fn next_lock_block(content: &str, from: usize) -> Option<(usize, usize)> {
+    let rel = content.get(from..)?.find("[[package]]\n")?;
+    let start = from + rel;
+    if start != 0 && content.as_bytes()[start - 1] != b'\n' {
+        return next_lock_block(content, start + 1);
+    }
+    Some((
+        start,
+        lock_block_end(content, start + "[[package]]\n".len()),
+    ))
+}
+
+/// End of the `[[package]]` block whose body starts at `body_start`,
+/// excluding the newline(s) before the next block / trailing table / EOF (so
+/// a recorded original/new stops after the block's last content byte — the
+/// TS rewriter's `(?=\n*$)` lookahead — while the file keeps its newlines).
+fn lock_block_end(content: &str, body_start: usize) -> usize {
+    // The next block, or the `[metadata]` / `[[patch.unused]]` tables that
+    // trail the packages. The trailing tables are searched only up to the
+    // next block: they sit after every `[[package]]` (absent entirely from
+    // v3/v4 locks), and an unbounded search per block scanned to EOF for
+    // every block of every dep. Each marker holds its only `\n` at offset 0,
+    // so a hit starting before the next block also ends by it — the bounded
+    // minimum is the unbounded one.
+    let rest = &content[body_start..];
+    let next_block = rest.find("\n[[package]]").unwrap_or(rest.len());
+    let mut end = ["\n[metadata]", "\n[[patch.unused]]", "\n[patch"]
+        .iter()
+        .filter_map(|marker| rest[..next_block].find(marker))
+        .min()
+        .map_or(body_start + next_block, |rel| body_start + rel);
+    while end > body_start && content.as_bytes()[end - 1] == b'\n' {
+        end -= 1;
+    }
+    end
+}
 
-use super::*;
 
 /// Deterministic xorshift64* — no `rand` dev-dependency.
 struct Rng(u64);
@@ -113,82 +376,128 @@ fn synth_lock(rng: &mut Rng, blocks: usize, v1: bool) -> String {
     out
 }
 
-fn assert_bound_matches_at(content: &str, body_start: usize, what: &str) {
+
+// ── the comparison ──
+
+const INDEX: &str = "sparse+https://socket.example/cargo/index/";
+
+fn plan_new(lock: &str, name: &str, version: &str, cksum: &str) -> CargoLockPlan {
+    CargoLock::parse(lock)
+        .expect("synthesized locks parse")
+        .plan_hosted(lock, name, version, INDEX, cksum)
+}
+
+/// A plan as comparable data.
+fn shape(plan: &CargoLockPlan) -> (String, Option<String>, Vec<FileEdit>) {
+    match plan {
+        CargoLockPlan::Rewritten { content, edits } => {
+            ("rewritten".into(), Some(content.clone()), edits.clone())
+        }
+        CargoLockPlan::AlreadyRedirected => ("already".into(), None, Vec::new()),
+        CargoLockPlan::NotFound => ("not-found".into(), None, Vec::new()),
+        CargoLockPlan::Ambiguous => ("ambiguous".into(), None, Vec::new()),
+    }
+}
+
+fn assert_same(lock: &str, name: &str, version: &str, cksum: &str, what: &str) -> Option<String> {
+    let old = plan_cargo_lock(lock, name, version, INDEX, cksum);
+    let new = plan_new(lock, name, version, cksum);
+    let (old, new) = (shape(&old), shape(&new));
+    // The one shape the line grammar cannot read and cargo can: the block's
+    // canonical header without the newline after `version` (a final block
+    // at EOF with no trailing newline). The span planner finds it.
+    let canonical_head = format!("[[package]]\nname = \"{name}\"\nversion = \"{version}\"\n");
+    if old.0 == "not-found" && new.0 != "not-found" && !lock.contains(&canonical_head) {
+        return new.1;
+    }
+    assert_eq!(new.0, old.0, "{what}: {name}@{version} outcome\n{lock}");
+    assert_eq!(new.1, old.1, "{what}: {name}@{version} bytes\n{lock}");
     assert_eq!(
-        lock_block_end(content, body_start),
-        lock_block_end_unbounded(content, body_start),
-        "{what}: bound at body offset {body_start}"
+        serde_json::to_value(&new.2).unwrap(),
+        serde_json::to_value(&old.2).unwrap(),
+        "{what}: {name}@{version} edits"
     );
+    new.1
 }
 
-/// Every char boundary is a body offset: the bound must agree even where
-/// the rewriter never asks, so no future caller can find a divergence.
-fn assert_bound_matches_everywhere(content: &str, what: &str) {
-    for (at, _) in content.char_indices() {
-        assert_bound_matches_at(content, at, what);
+/// `(name, version)` of every `[[package]]` the lock holds, in order.
+fn targets(lock: &str) -> Vec<(String, String)> {
+    CargoLock::parse(lock)
+        .expect("synthesized locks parse")
+        .packages()
+        .iter()
+        .map(|p| (p.name.clone(), p.version.clone()))
+        .collect()
+}
+
+/// Every package of `lock`, planned by both, then a second package planned
+/// over the first's output and a re-run of the first (the no-op path).
+fn assert_lock(lock: &str, rng: &mut Rng, what: &str) {
+    let all = targets(lock);
+    for (name, version) in &all {
+        let cksum = format!("{:016x}{:016x}", rng.next(), rng.next());
+        let Some(once) = assert_same(lock, name, version, &cksum, what) else {
+            continue;
+        };
+        assert_same(&once, name, version, &cksum, &format!("{what} re-run"));
+        if let Some((other, other_version)) = all.get(rng.below(all.len())) {
+            assert_same(&once, other, other_version, "00ff", &format!("{what} then another"));
+        }
     }
-    assert_bound_matches_at(content, content.len(), what);
+    // An absent package, on both sides.
+    assert_same(lock, "absent-crate", "9.9.9", "00", what);
 }
 
 #[test]
-fn bound_matches_unbounded_at_every_offset_of_random_locks() {
+fn span_splice_matches_the_line_grammar_on_random_locks() {
     let mut rng = Rng(0x9E37_79B9_7F4A_7C15);
     for case in 0..300 {
         let v1 = rng.chance(50);
         let blocks = rng.below(12);
         let lock = synth_lock(&mut rng, blocks, v1);
-        assert_bound_matches_everywhere(&lock, &format!("case {case} (v1={v1})"));
-        let crlf = lock.replace('\n', "\r\n");
-        assert_bound_matches_everywhere(&crlf, &format!("case {case} crlf"));
+        assert_lock(&lock, &mut rng, &format!("case {case} (v1={v1})"));
     }
 }
 
+/// Hand-written shapes the generator does not produce: multi-source twins
+/// (one at the target index, and none), a v1 `[root]` table, a v1 block with
+/// no source, a source ending the text, and blocks with neither line.
 #[test]
-fn bound_matches_unbounded_on_hand_written_edges() {
-    for lock in [
-        "",
-        "\n",
-        "[[package]]\n",
-        "[[package]]\nname = \"a\"\nversion = \"1.0.0\"",
-        "[[package]]\nname = \"a\"\nversion = \"1.0.0\"\n\n\n",
-        // Trailing tables immediately after the last block, and before it.
-        "[[package]]\nname = \"a\"\n[metadata]\n\"x\" = \"y\"\n",
-        "[[package]]\nname = \"a\"\n\n[patch.crates-io]\n\n[[package]]\nname = \"b\"\n",
-        "[[package]]\nname = \"a\"\n\n[[patch.unused]]\nname = \"u\"\n\n[metadata]\n",
-        // A trailer before a later block (not cargo-shaped, still must agree).
-        "[[package]]\nname = \"a\"\n\n[metadata]\n\n[[package]]\nname = \"b\"\n",
-        // Look-alikes without the leading newline.
-        "[[package]]\nname = \"a [metadata]\"\nx = \" [[package]]\"\n",
-        "\n\n[[package]]\n\n\n[[package]]\n\n",
+fn span_splice_matches_the_line_grammar_on_hand_written_locks() {
+    let crates_io = CRATES_IO;
+    let twins_ours = format!(
+        "version = 3\n\n[[package]]\nname = \"t\"\nversion = \"1.0.0\"\nsource = \"{crates_io}\"\nchecksum = \"aa\"\n\n[[package]]\nname = \"t\"\nversion = \"1.0.0\"\nsource = \"{INDEX}\"\nchecksum = \"bb\"\n"
+    );
+    let twins_neither = twins_ours.replace(INDEX, "registry+https://other.example/index");
+    let v1_root = format!(
+        "[root]\nname = \"app\"\nversion = \"0.1.0\"\ndependencies = [\n \"d 1.0.0 ({crates_io})\",\n]\n\n[[package]]\nname = \"d\"\nversion = \"1.0.0\"\nsource = \"{crates_io}\"\n\n[[package]]\nname = \"u\"\nversion = \"2.0.0\"\nsource = \"{crates_io}\"\ndependencies = [\n \"d 1.0.0 ({crates_io})\",\n]\n\n[metadata]\n\"checksum d 1.0.0 ({crates_io})\" = \"cc\"\n\"checksum u 2.0.0 ({crates_io})\" = \"dd\"\n"
+    );
+    let sourceless_v1 = "[[package]]\nname = \"s\"\nversion = \"1.0.0\"\n\n[metadata]\n\"checksum s 1.0.0 (registry+x)\" = \"ee\"\n".to_string();
+    let source_at_eof = format!("[[package]]\nname = \"e\"\nversion = \"1.0.0\"\nsource = \"{crates_io}\"");
+    let bare = "version = 3\n\n[[package]]\nname = \"b\"\nversion = \"1.0.0\"\n\n[[package]]\nname = \"c\"\nversion = \"1.0.0\"\n".to_string();
+    let mut rng = Rng(0xD1B5_4A32_D192_ED03);
+    for (what, lock) in [
+        ("twins, one ours", twins_ours),
+        ("twins, neither ours", twins_neither),
+        ("v1 [root]", v1_root),
+        ("v1 sourceless", sourceless_v1),
+        ("source at EOF", source_at_eof),
+        ("bare blocks", bare),
     ] {
-        assert_bound_matches_everywhere(lock, &format!("{lock:?}"));
+        assert_lock(&lock, &mut rng, what);
     }
 }
 
-/// The large-lock shape: ≥1k blocks, where the unbounded search was
-/// quadratic. Checked at every block body (what `plan_cargo_lock` asks for)
-/// and along the `next_lock_block` walk its dependents loop takes.
+/// The large-lock shape: ≥1k blocks, both formats, a sample of targets.
 #[test]
-fn bound_matches_unbounded_at_every_block_of_a_large_lock() {
-    let mut rng = Rng(0xD1B5_4A32_D192_ED03);
+fn span_splice_matches_the_line_grammar_on_a_large_lock() {
+    let mut rng = Rng(0x2545_F491_4F6C_DD1D);
     for v1 in [false, true] {
         let lock = synth_lock(&mut rng, 1_200, v1);
-        let mut blocks = 0;
-        for (at, _) in lock.match_indices("[[package]]\n") {
-            assert_bound_matches_at(&lock, at + "[[package]]\n".len(), "large");
-            blocks += 1;
-        }
-        assert!(blocks >= 1_000, "fixture keeps the ≥1k-block shape");
-        // The walk `plan_cargo_lock` does for dependents visits the same
-        // blocks with the same spans under either bound.
-        let mut cursor = 0;
-        while let Some((start, end)) = next_lock_block(&lock, cursor) {
-            assert_eq!(
-                end,
-                lock_block_end_unbounded(&lock, start + "[[package]]\n".len()),
-                "large (v1={v1}): block at {start}"
-            );
-            cursor = end;
+        let all = targets(&lock);
+        assert!(all.len() >= 1_000, "fixture keeps the ≥1k-block shape");
+        for (name, version) in all.iter().step_by(97) {
+            assert_same(&lock, name, version, "abcd", &format!("large (v1={v1})"));
         }
     }
 }
diff --git a/crates/socket-patch-core/src/patch/redirect/composer_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/composer_equivalence_tests.rs
index 488c5f74..187c3c25 100644
--- a/crates/socket-patch-core/src/patch/redirect/composer_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/composer_equivalence_tests.rs
@@ -6,6 +6,8 @@
 //! output bytes, FileEdit list and warnings on randomized locks.
 
 use super::*;
+use crate::crawlers::composer_crawler::normalize_version;
+use crate::formats::composer::hosted::*;
 
 fn json_object_end_from_oracle(text: &str, from: usize) -> Option<usize> {
     let mut depth = 0usize;
diff --git a/crates/socket-patch-core/src/patch/redirect/group_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/group_equivalence_tests.rs
index d6fb3831..65bfdeb8 100644
--- a/crates/socket-patch-core/src/patch/redirect/group_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/group_equivalence_tests.rs
@@ -23,7 +23,7 @@ fn serial_oracle(
     let overrides = withhold(&overrides, &result.refused_pipenv_uuids);
     let overrides: &[DepOverride] = &overrides;
     rewrite_npm_lock(files, overrides, &mut result);
-    rewrite_pnpm_lock(files, overrides, &mut result);
+    plan_hosted(files, overrides, &mut result);
     rewrite_yarn_classic(files, overrides, &mut result);
     rewrite_yarn_berry(files, overrides, &mut result);
     rewrite_bun_lock(files, overrides, &mut result);
diff --git a/crates/socket-patch-core/src/patch/redirect/mod.rs b/crates/socket-patch-core/src/patch/redirect/mod.rs
index 98fd7930..95a18343 100644
--- a/crates/socket-patch-core/src/patch/redirect/mod.rs
+++ b/crates/socket-patch-core/src/patch/redirect/mod.rs
@@ -23,7 +23,6 @@ use regex::Regex;
 use serde::{Deserialize, Serialize};
 use serde_json::{json, Value};
 
-use crate::crawlers::composer_crawler::normalize_version;
 use crate::utils::digest::is_hex64_lower;
 use crate::utils::line_endings::{to_lf, LineEndings};
 use crate::vendor::yarn_berry_lock::yarnrc_compression_level;
@@ -45,9 +44,19 @@ pub mod npmrc;
 mod pdm;
 mod pipenv;
 pub mod presence;
-// pub(crate): manifest-less VEX discovery (`vex::discover::npm`) reads
-// hosted pnpm locks with the SAME grammar this rewriter writes them in.
-pub(crate) mod pnpm;
+// The pnpm entry grammar and hosted planner live with the format's model.
+#[cfg(test)]
+use crate::formats::pnpm::grammar as pnpm;
+use crate::formats::pnpm::plan_hosted;
+use crate::formats::cargo::CargoLock;
+use crate::formats::composer::hosted::rewrite_composer_lock;
+use crate::formats::gem::hosted::{checksum_entry_span, converge_gem_lock_source};
+pub(crate) use crate::formats::yarn::is_berry_lock;
+use crate::formats::cargo::hosted::CargoLockPlan;
+#[cfg(test)]
+use crate::formats::cargo::hosted::CARGO_LOCK_REFERENCE_KIND;
+#[cfg(test)]
+use crate::formats::pnpm::hosted::pnpm_unrewritten_instances;
 #[cfg(test)]
 mod pnpm_equivalence_tests;
 mod poetry;
@@ -252,7 +261,7 @@ pub struct RewriteResult {
 }
 
 /// Combined name as it appears in registry coordinates / lock keys.
-fn full_name(dep: &DepOverride) -> String {
+pub(crate) fn full_name(dep: &DepOverride) -> String {
     match &dep.namespace {
         Some(ns) if !ns.is_empty() => format!("{ns}/{}", dep.name),
         _ => dep.name.clone(),
@@ -425,7 +434,7 @@ fn rewriter_groups<'a>(
     vec![
         Box::new(move |result| {
             rewrite_npm_lock(files, overrides, result);
-            rewrite_pnpm_lock(files, overrides, result);
+            plan_hosted(files, overrides, result);
             rewrite_yarn_classic(files, overrides, result);
             rewrite_yarn_berry(files, overrides, result);
             rewrite_bun_lock(files, overrides, result);
@@ -1343,7 +1352,12 @@ fn rewrite_cargo(
             Absent,
         }
         let lock_commit = if let Some(lock_text) = cargo_lock.as_ref() {
-            match plan_cargo_lock(lock_text, &dep.name, &dep.version, index_url, &cksum) {
+            // A lock that does not parse never reaches here: the dependents
+            // check above refuses it.
+            let plan = CargoLock::parse(lock_text).map_or(CargoLockPlan::NotFound, |lock| {
+                lock.plan_hosted(lock_text, &dep.name, &dep.version, index_url, &cksum)
+            });
+            match plan {
                 CargoLockPlan::Rewritten { content, edits } => LockCommit::Write(content, edits),
                 CargoLockPlan::AlreadyRedirected => LockCommit::InPlace,
                 CargoLockPlan::NotFound => {
@@ -1480,11 +1494,7 @@ fn cargo_not_declared_detail(
     } else {
         "Cargo.toml".to_string()
     };
-    let head = format!("[[package]]\nname = \"{crate_name}\"\nversion = \"{version}\"\n");
-    let transitive = lock.is_some_and(|lock| {
-        lock.match_indices(head.as_str())
-            .any(|(at, _)| at == 0 || lock.as_bytes()[at - 1] == b'\n')
-    });
+    let transitive = cargo_lock_holds(lock, crate_name, version);
     if transitive {
         format!(
             "{crate_name}@{version} is a transitive-only dependency (Cargo.lock resolves it, \
@@ -1514,11 +1524,7 @@ fn cargo_requirement_excludes_detail(
         .map(|(path, req)| format!("\"{req}\" in {path}"))
         .collect::<Vec<_>>()
         .join(", ");
-    let head = format!("[[package]]\nname = \"{crate_name}\"\nversion = \"{version}\"\n");
-    let locked = lock.is_some_and(|lock| {
-        lock.match_indices(head.as_str())
-            .any(|(at, _)| at == 0 || lock.as_bytes()[at - 1] == b'\n')
-    });
+    let locked = cargo_lock_holds(lock, crate_name, version);
     let remedy = if locked {
         "; Cargo.lock resolves it for another package, which a pin cannot reach — patch it \
          with `socket-patch scan --mode vendored`"
@@ -1585,34 +1591,13 @@ fn cargo_unpinnable_dependents(
     version: &str,
     pinned_packages: &std::collections::BTreeSet<(&str, &str)>,
 ) -> Vec<String> {
-    let Ok(doc) = lock.parse::<toml_edit::DocumentMut>() else {
+    let Ok(lock) = CargoLock::parse(lock) else {
         return vec!["Cargo.lock (it does not parse as TOML)".to_string()];
     };
-    let Some(packages) = doc
-        .get("package")
-        .and_then(toml_edit::Item::as_array_of_tables)
-    else {
-        return Vec::new();
-    };
     let mut out = Vec::new();
-    for package in packages.iter() {
-        let field = |key: &str| package.get(key).and_then(toml_edit::Item::as_str);
-        let (Some(name), Some(pkg_version)) = (field("name"), field("version")) else {
-            continue;
-        };
-        let depends = package
-            .get("dependencies")
-            .and_then(toml_edit::Item::as_array)
-            .is_some_and(|deps| {
-                deps.iter().filter_map(|d| d.as_str()).any(|d| {
-                    let mut parts = d.splitn(3, ' ');
-                    parts.next() == Some(crate_name) && parts.next().is_none_or(|v| v == version)
-                })
-            });
-        if !depends {
-            continue;
-        }
-        match field("source") {
+    for package in lock.dependents(crate_name, version) {
+        let (name, pkg_version) = (package.name.as_str(), package.version.as_str());
+        match &package.source {
             Some(source) => {
                 let kind = if source.starts_with("git+") {
                     "git"
@@ -2399,23 +2384,23 @@ enum CargoWorkspaceEntry {
     OtherPackage,
 }
 
+/// Whether a Cargo.lock (when there is one, and it parses) resolves
+/// `crate_name`@`version`.
+fn cargo_lock_holds(lock: Option<&str>, crate_name: &str, version: &str) -> bool {
+    lock.and_then(|lock| CargoLock::parse(lock).ok())
+        .is_some_and(|lock| lock.is_locked(crate_name, version))
+}
+
 /// Every version of `crate_name` a Cargo.lock holds other than `version`.
 fn cargo_lock_other_versions(lock: Option<&str>, crate_name: &str, version: &str) -> Vec<String> {
     let Some(lock) = lock else {
         return Vec::new();
     };
-    let head = format!("[[package]]\nname = \"{crate_name}\"\nversion = \"");
-    let mut versions: Vec<String> = lock
-        .match_indices(head.as_str())
-        .filter(|&(at, _)| at == 0 || lock.as_bytes()[at - 1] == b'\n')
-        .filter_map(|(at, _)| {
-            let rest = &lock[at + head.len()..];
-            rest.split_once('"').map(|(v, _)| v.to_string())
-        })
-        .filter(|v| v != version)
-        .collect();
-    versions.sort();
-    versions.dedup();
+    let Ok(lock) = CargoLock::parse(lock) else {
+        return Vec::new();
+    };
+    let mut versions = lock.locked_versions(crate_name);
+    versions.retain(|v| v != version);
     versions
 }
 
@@ -2863,286 +2848,6 @@ fn plan_cargo_toml(
     })
 }
 
-/// The Cargo.lock edit kind for dependents' full-id references: `original`
-/// / `new` are the quoted `"<name> <version> (<source>)"` ids, keyed
-/// `<name>@<version>`, and the inverse replaces EVERY occurrence of `new`.
-pub(crate) const CARGO_LOCK_REFERENCE_KIND: &str = "redirect_cargo_lock_reference";
-
-static CARGO_LOCK_SOURCE_LINE_RE: LazyLock<Regex> = LazyLock::new(|| {
-    Regex::new(r#"(?m)^source = "([^"]*)"$"#).expect("static lock source-line regex is valid")
-});
-static CARGO_LOCK_CHECKSUM_LINE_RE: LazyLock<Regex> = LazyLock::new(|| {
-    Regex::new(r#"(?m)^checksum = "[^"]*"$"#).expect("static lock checksum-line regex is valid")
-});
-// `$` (not `\n`) so it also anchors a source line that ENDS the block: the
-// trailing newline sits outside the block region.
-static CARGO_LOCK_AFTER_SOURCE_RE: LazyLock<Regex> = LazyLock::new(|| {
-    Regex::new(r#"(?m)^(source = "[^"]*")$"#).expect("static source-line anchor regex is valid")
-});
-
-/// Repoint the crate's `[[package]]` at the hosted index with the patched
-/// `.crate`'s checksum, in whichever Cargo.lock format the file is:
-///
-/// * v2–v4: `source` + an inline `checksum` in the entry;
-/// * v1 (cargo < 1.41, still read by every cargo): the entry carries only
-///   `source`; the checksum lives in the trailing `[metadata]` table under
-///   `"checksum <name> <version> (<source>)"`, and every dependent names the
-///   crate by its FULL package id `"<name> <version> (<source>)"`. Both are
-///   keyed by the source, so both must follow it — a v1 lock with only the
-///   entry repointed names a package that no longer exists (cargo discards
-///   the lock and re-resolves; `--locked` fails) and pins nothing.
-///
-/// Full-id references are rewritten in any format (v2+ spells them that way
-/// when a name + version is ambiguous). Each changed fragment is its own
-/// `redirect_cargo_lock_entry` edit (unique text, so the fragment revert is
-/// unambiguous) — the entry and the `[metadata]` line — and the dependents'
-/// references are one `redirect_cargo_lock_reference` edit holding the
-/// quoted full id, reverted at every occurrence.
-fn plan_cargo_lock(
-    content: &str,
-    crate_name: &str,
-    version: &str,
-    index_url: &str,
-    cksum: &str,
-) -> CargoLockPlan {
-    // Rust's regex has NO lookahead, so bound the [[package]] block by string
-    // search (see [`lock_block_end`]): from its header to the next block or
-    // trailing table (or EOF), so the bytes after the block (incl. the final
-    // newline) are preserved.
-    let head = format!("[[package]]\nname = \"{crate_name}\"\nversion = \"{version}\"\n");
-    // Every line-anchored header for this name@version. A Cargo.lock may
-    // legitimately hold TWO blocks for one name@version from different
-    // sources — after a redirect, a transitive crates.io copy resolves beside
-    // the socket-registry copy, and cargo sorts the crates.io block FIRST —
-    // so the first hit alone would repoint the wrong twin.
-    let heads: Vec<usize> = content
-        .match_indices(head.as_str())
-        .map(|(at, _)| at)
-        .filter(|&at| at == 0 || content.as_bytes()[at - 1] == b'\n')
-        .collect();
-    let block_start = match heads.as_slice() {
-        [] => return CargoLockPlan::NotFound,
-        [only] => *only,
-        twins => {
-            // Exactly one twin already at the target index is OURS (a re-run
-            // over a redirected lock); anything else cannot be attributed and
-            // the dep is skipped transactionally.
-            let target_source = format!("source = \"{index_url}\"");
-            let mut ours = twins.iter().copied().filter(|&at| {
-                let body_start = at + head.len();
-                content[body_start..lock_block_end(content, body_start)]
-                    .lines()
-                    .any(|line| line == target_source)
-            });
-            match (ours.next(), ours.next()) {
-                (Some(at), None) => at,
-                _ => return CargoLockPlan::Ambiguous,
-            }
-        }
-    };
-    let body_start = block_start + head.len();
-    let block_end = lock_block_end(content, body_start);
-    let original = content[block_start..block_end].to_string();
-    let mut body = content[body_start..block_end].to_string();
-    let old_source = CARGO_LOCK_SOURCE_LINE_RE
-        .captures(&body)
-        .map(|c| c[1].to_string());
-    if old_source.is_some() {
-        body = CARGO_LOCK_SOURCE_LINE_RE
-            .replace(&body, format!("source = \"{index_url}\"").as_str())
-            .to_string();
-    } else {
-        body = format!("source = \"{index_url}\"\n{body}");
-    }
-    // A v1 lock keeps the checksum in `[metadata]`, keyed by the package id
-    // — the chosen block's OWN source when it has one, so a multi-source
-    // twin's line is never taken for ours.
-    let metadata_source = old_source
-        .as_deref()
-        .map_or_else(|| r#"[^)"]*"#.to_string(), regex::escape);
-    let metadata_re = Regex::new(&format!(
-        r#"(?m)^"checksum {} {} \({metadata_source}\)" = "[^"]*"$"#,
-        regex::escape(crate_name),
-        regex::escape(version)
-    ))
-    .expect("escaped lock metadata-line regex is valid");
-    let metadata_line = metadata_re.find(content).map(|m| m.as_str().to_string());
-    if metadata_line.is_none() {
-        if CARGO_LOCK_CHECKSUM_LINE_RE.is_match(&body) {
-            body = CARGO_LOCK_CHECKSUM_LINE_RE
-                .replace(&body, format!("checksum = \"{cksum}\"").as_str())
-                .to_string();
-        } else {
-            body = CARGO_LOCK_AFTER_SOURCE_RE
-                .replace(&body, format!("${{1}}\nchecksum = \"{cksum}\"").as_str())
-                .to_string();
-        }
-    }
-    let rebuilt = format!("{head}{body}");
-    let key = format!("{crate_name}@{version}");
-    let edit = |original: &str, new: &str| FileEdit {
-        path: "Cargo.lock".into(),
-        kind: "redirect_cargo_lock_entry".into(),
-        action: "rewritten".into(),
-        key: Some(key.clone()),
-        original: Some(Value::String(original.to_string())),
-        new: Some(Value::String(new.to_string())),
-    };
-    let mut edits = Vec::new();
-    let mut new_content = content.to_string();
-    if rebuilt != original {
-        new_content.replace_range(block_start..block_end, &rebuilt);
-        edits.push(edit(&original, &rebuilt));
-    }
-    if let Some(line) = metadata_line {
-        let pinned = format!("\"checksum {crate_name} {version} ({index_url})\" = \"{cksum}\"");
-        if line != pinned {
-            new_content = new_content.replacen(&line, &pinned, 1);
-            edits.push(edit(&line, &pinned));
-        }
-    }
-    // Dependents' full-id references to the OLD source, recorded as ONE
-    // `redirect_cargo_lock_reference` edit holding just the quoted id —
-    // never a dependent's whole block: a block referencing two patched
-    // packages (the root of a v1 lock) would hold two overlapping block
-    // edits, and reverting the first-applied one alone would find neither of
-    // its fragments. The id names this name + version + source exactly, so its
-    // inverse puts back EVERY occurrence, independently of any other
-    // package's edits and in any removal order.
-    if let Some(old) = old_source.filter(|old| old != index_url) {
-        let from = format!("\"{crate_name} {version} ({old})\"");
-        let to = format!("\"{crate_name} {version} ({index_url})\"");
-        let mut repointed_any = false;
-        // The oldest v1 locks keep the ROOT package in a standalone `[root]`
-        // table instead of the `[[package]]` array, with its own full-id
-        // `dependencies`. It precedes the array, so the block walk below
-        // never reaches it and the lock would keep naming a package it no
-        // longer contains (`--locked` fails; an unlocked build silently
-        // re-resolves).
-        if let Some((start, end)) = lock_root_table(&new_content) {
-            if new_content[start..end].contains(&from) {
-                let repointed = new_content[start..end].replace(&from, &to);
-                new_content.replace_range(start..end, &repointed);
-                repointed_any = true;
-            }
-        }
-        let mut cursor = 0;
-        while let Some((start, end)) = next_lock_block(&new_content, cursor) {
-            if new_content[start..end].contains(&from) {
-                let repointed = new_content[start..end].replace(&from, &to);
-                new_content.replace_range(start..end, &repointed);
-                repointed_any = true;
-                cursor = start + repointed.len();
-            } else {
-                cursor = end;
-            }
-        }
-        if repointed_any {
-            edits.push(FileEdit {
-                kind: CARGO_LOCK_REFERENCE_KIND.into(),
-                ..edit(&from, &to)
-            });
-        }
-    }
-    // Already redirected (re-run): every fragment is at the target values; a
-    // recorded edit would have original == new and grow the ledger forever.
-    if edits.is_empty() {
-        return CargoLockPlan::AlreadyRedirected;
-    }
-    CargoLockPlan::Rewritten {
-        content: new_content,
-        edits,
-    }
-}
-
-/// The v1 `[root]` table's span, when the lock has one: cargo before the
-/// `[root]` removal recorded the root package there rather than in the
-/// `[[package]]` array, and its `dependencies` spell full package ids the
-/// same way. Bounded by [`lock_block_end`], like a package block.
-fn lock_root_table(content: &str) -> Option<(usize, usize)> {
-    const HEADER: &str = "[root]\n";
-    let at = content
-        .match_indices(HEADER)
-        .map(|(at, _)| at)
-        .find(|&at| at == 0 || content.as_bytes()[at - 1] == b'\n')?;
-    Some((at, lock_block_end(content, at + HEADER.len())))
-}
-
-/// The next `[[package]]` block starting at or after `from`, as
-/// [`lock_block_end`] bounds it.
-fn next_lock_block(content: &str, from: usize) -> Option<(usize, usize)> {
-    let rel = content.get(from..)?.find("[[package]]\n")?;
-    let start = from + rel;
-    if start != 0 && content.as_bytes()[start - 1] != b'\n' {
-        return next_lock_block(content, start + 1);
-    }
-    Some((
-        start,
-        lock_block_end(content, start + "[[package]]\n".len()),
-    ))
-}
-
-/// End of the `[[package]]` block whose body starts at `body_start`,
-/// excluding the newline(s) before the next block / trailing table / EOF (so
-/// a recorded original/new stops after the block's last content byte — the
-/// TS rewriter's `(?=\n*$)` lookahead — while the file keeps its newlines).
-fn lock_block_end(content: &str, body_start: usize) -> usize {
-    // The next block, or the `[metadata]` / `[[patch.unused]]` tables that
-    // trail the packages. The trailing tables are searched only up to the
-    // next block: they sit after every `[[package]]` (absent entirely from
-    // v3/v4 locks), and an unbounded search per block scanned to EOF for
-    // every block of every dep. Each marker holds its only `\n` at offset 0,
-    // so a hit starting before the next block also ends by it — the bounded
-    // minimum is the unbounded one.
-    let rest = &content[body_start..];
-    let next_block = rest.find("\n[[package]]").unwrap_or(rest.len());
-    let mut end = ["\n[metadata]", "\n[[patch.unused]]", "\n[patch"]
-        .iter()
-        .filter_map(|marker| rest[..next_block].find(marker))
-        .min()
-        .map_or(body_start + next_block, |rel| body_start + rel);
-    while end > body_start && content.as_bytes()[end - 1] == b'\n' {
-        end -= 1;
-    }
-    end
-}
-
-/// The previous, unbounded [`lock_block_end`], kept as the equivalence
-/// oracle.
-#[cfg(test)]
-fn lock_block_end_unbounded(content: &str, body_start: usize) -> usize {
-    let mut end = [
-        "\n[[package]]",
-        "\n[metadata]",
-        "\n[[patch.unused]]",
-        "\n[patch",
-    ]
-    .iter()
-    .filter_map(|marker| content[body_start..].find(marker))
-    .min()
-    .map_or(content.len(), |rel| body_start + rel);
-    while end > body_start && content.as_bytes()[end - 1] == b'\n' {
-        end -= 1;
-    }
-    end
-}
-
-/// Outcome of the Cargo.lock `[[package]]` plan — distinguishes a re-run
-/// over an already-redirected block (no edit, no warning) from a genuinely
-/// missing package (the caller warns AND skips the dep entirely).
-enum CargoLockPlan {
-    Rewritten {
-        content: String,
-        edits: Vec<FileEdit>,
-    },
-    AlreadyRedirected,
-    NotFound,
-    /// Several `[[package]]` blocks for the name@version (multi-source twins)
-    /// and not exactly one of them at the target index — which twin is ours
-    /// cannot be decided, so the caller warns AND skips the dep entirely.
-    Ambiguous,
-}
-
 struct CargoConfigPlan {
     content: String,
     edit: FileEdit,
@@ -3245,421 +2950,6 @@ fn plan_cargo_config(
     })
 }
 
-// ── pnpm-lock.yaml ───────────────────────────────────────────────────────────
-
-/// Test-only reference for the residual gate: every instance of this exact
-/// name@version in `content` that does not resolve to `artifact_url`.
-/// Production judges the same predicate inline, per instance, on each
-/// indexed hit's post-splice body in `rewrite_pnpm_lock`; snapshots and
-/// other versions do not participate in resolution.
-#[cfg(test)]
-fn pnpm_unrewritten_instances(
-    content: &str,
-    fname: &str,
-    version: &str,
-    artifact_url: &str,
-) -> Vec<String> {
-    pnpm::entries(content)
-        .into_iter()
-        .filter_map(|entry| {
-            pnpm::suffix(entry.key, fname, version)?;
-            (!pnpm_resolves_to(&entry, artifact_url)).then(|| entry.key.to_string())
-        })
-        .collect()
-}
-
-/// Whether `entry` resolves to exactly `artifact_url` — the per-instance
-/// residual-gate predicate.
-fn pnpm_resolves_to(entry: &pnpm::Entry<'_>, artifact_url: &str) -> bool {
-    pnpm::resolution(entry).is_some_and(|r| r.tarball() == Some(artifact_url))
-}
-
-/// One pnpm lock under rewrite. `text` is the lock as of the last
-/// materialization; `pending` holds the resolution splices committed since,
-/// in `text`'s byte coordinates, and `spliced` the entries they touch.
-///
-/// The logical (post-splice) lock is `text` with `pending` applied. Parsing
-/// once and indexing is sound because a resolution splice never changes the
-/// entry structure: the replaced range and its replacement are only
-/// resolution-field material (6-space-indented `k: v` child lines of a block
-/// resolution, or the `{…}` flow value after `    resolution:`), and no raw
-/// newline can enter a value (`Resolution::rewrite` JSON-quotes whitespace).
-/// So every column-0 line (the shrinkwrap-version sniff) and every entry
-/// boundary line survives unchanged, and an entry no pending splice touched
-/// has byte-identical key and body. An entry that WAS touched is re-read
-/// only after materializing, so a later dep with the same name@version (a
-/// duplicate override) sees the rewritten text exactly as before.
-struct PnpmLockState<'f> {
-    path: &'f String,
-    text: Cow<'f, str>,
-    early_shrinkwrap: bool,
-    /// (key span, body span) per `packages:` entry, in file order.
-    entries: Vec<(std::ops::Range<usize>, std::ops::Range<usize>)>,
-    /// Entry indices sorted by normalized (unquoted, `/`-stripped) key.
-    sorted: Vec<usize>,
-    pending: Vec<(std::ops::Range<usize>, String)>,
-    spliced: std::collections::HashSet<usize>,
-    changed: bool,
-}
-
-impl<'f> PnpmLockState<'f> {
-    fn new(path: &'f String, text: &'f str) -> Self {
-        let mut state = PnpmLockState {
-            path,
-            text: Cow::Borrowed(text),
-            early_shrinkwrap: pnpm::unsupported_early_shrinkwrap(text),
-            entries: Vec::new(),
-            sorted: Vec::new(),
-            pending: Vec::new(),
-            spliced: Default::default(),
-            changed: false,
-        };
-        state.reindex();
-        state
-    }
-
-    fn reindex(&mut self) {
-        let text: &str = &self.text;
-        let base = text.as_ptr() as usize;
-        self.entries = pnpm::entries(text)
-            .iter()
-            .map(|e| {
-                let key_start = e.key.as_ptr() as usize - base;
-                (
-                    key_start..key_start + e.key.len(),
-                    e.offset..e.offset + e.body.len(),
-                )
-            })
-            .collect();
-        let mut sorted: Vec<usize> = (0..self.entries.len()).collect();
-        sorted.sort_by(|&a, &b| self.norm_key(a).cmp(self.norm_key(b)).then(a.cmp(&b)));
-        self.sorted = sorted;
-    }
-
-    fn entry(&self, i: usize) -> pnpm::Entry<'_> {
-        let (key, body) = &self.entries[i];
-        pnpm::Entry {
-            key: &self.text[key.clone()],
-            body: &self.text[body.clone()],
-            offset: body.start,
-        }
-    }
-
-    /// The key as [`pnpm::suffix`] compares it.
-    fn norm_key(&self, i: usize) -> &str {
-        let key = pnpm::unquote(&self.text[self.entries[i].0.clone()]);
-        key.strip_prefix('/').unwrap_or(key)
-    }
-
-    /// Entries whose key names `fname@version` (any suffix), in file order —
-    /// the same set a full [`pnpm::suffix`] scan of the logical lock yields.
-    fn hits(&mut self, fname: &str, version: &str) -> Vec<usize> {
-        let hits = self.lookup(fname, version);
-        if hits.iter().any(|i| self.spliced.contains(i)) {
-            self.materialize();
-            return self.lookup(fname, version);
-        }
-        hits
-    }
-
-    fn lookup(&self, fname: &str, version: &str) -> Vec<usize> {
-        let mut out = Vec::new();
-        for sep in ['@', '/'] {
-            let prefix = format!("{fname}{sep}{version}");
-            let start = self
-                .sorted
-                .partition_point(|&i| self.norm_key(i) < prefix.as_str());
-            out.extend(
-                self.sorted[start..]
-                    .iter()
-                    .take_while(|&&i| self.norm_key(i).starts_with(prefix.as_str()))
-                    .copied(),
-            );
-        }
-        out.sort_unstable();
-        out.dedup();
-        out.retain(|&i| pnpm::suffix(self.entry(i).key, fname, version).is_some());
-        out
-    }
-
-    /// Fold `pending` into `text` and re-parse.
-    fn materialize(&mut self) {
-        if self.pending.is_empty() {
-            return;
-        }
-        #[cfg(debug_assertions)]
-        let keys_before: Vec<String> = (0..self.entries.len())
-            .map(|i| self.entry(i).key.to_string())
-            .collect();
-        let mut pending = std::mem::take(&mut self.pending);
-        pending.sort_by_key(|(range, _)| range.start);
-        let mut out = String::with_capacity(self.text.len());
-        let mut cursor = 0usize;
-        for (range, replacement) in pending {
-            out.push_str(&self.text[cursor..range.start]);
-            out.push_str(&replacement);
-            cursor = range.end;
-        }
-        out.push_str(&self.text[cursor..]);
-        self.text = Cow::Owned(out);
-        self.spliced.clear();
-        self.reindex();
-        #[cfg(debug_assertions)]
-        debug_assert_eq!(
-            keys_before,
-            (0..self.entries.len())
-                .map(|i| self.entry(i).key.to_string())
-                .collect::<Vec<_>>(),
-            "a resolution splice changed the pnpm entry structure"
-        );
-    }
-
-    fn into_rewritten(mut self) -> Option<(&'f String, String)> {
-        if !self.changed {
-            return None;
-        }
-        self.materialize();
-        Some((self.path, self.text.into_owned()))
-    }
-}
-
-fn rewrite_pnpm_lock(
-    files: &BTreeMap<String, String>,
-    overrides: &[DepOverride],
-    result: &mut RewriteResult,
-) {
-    let npm: Vec<&DepOverride> = overrides.iter().filter(|o| o.ecosystem == "npm").collect();
-    // A pnpm lock lives at the project root or at any nested path (e.g. Rush
-    // repos keep them under `common/config/rush/`); every such files-map key
-    // is rewritten under the same grammar. Deterministic order: BTreeMap
-    // iterates keys sorted, so goldens are stable across every lock in the set.
-    let lock_keys: Vec<&String> = files
-        .keys()
-        .filter(|k| {
-            matches!(
-                k.rsplit('/').next(),
-                Some("pnpm-lock.yaml" | "shrinkwrap.yaml")
-            )
-        })
-        .collect();
-    if npm.is_empty() || lock_keys.is_empty() {
-        return;
-    }
-    // Each lock is parsed and indexed ONCE; splices accumulate per lock and
-    // are applied in one pass at the end (see `PnpmLockState`).
-    let mut locks: Vec<PnpmLockState> = lock_keys
-        .iter()
-        .map(|k| PnpmLockState::new(k, &files[*k]))
-        .collect();
-    for dep in &npm {
-        let fname = full_name(dep);
-        let hits: Vec<Vec<usize>> = locks
-            .iter_mut()
-            .map(|lock| lock.hits(&fname, &dep.version))
-            .collect();
-        let unsafe_locks: Vec<_> = locks
-            .iter()
-            .zip(&hits)
-            .filter(|(lock, hits)| lock.early_shrinkwrap && !hits.is_empty())
-            .map(|(lock, _)| lock.path.as_str())
-            .collect();
-        if !unsafe_locks.is_empty() {
-            result.refused_pnpm_uuids.insert(dep.patch_uuid.clone());
-            result.warnings.push(RewriteWarning {
-                code: "redirect_pnpm_legacy_lockfile_unsupported".into(),
-                detail: format!("{} uses early pnpm 1 shrinkwrapVersion 3 without a supported minor version. Those installers discard hosted tarball URLs; {fname}@{} was left unchanged in every lock. Upgrade to a tested pnpm release (1.43.1 or newer) and regenerate the lock, or use `scan --mode agent` for installed-file patching.", unsafe_locks.join(", "), dep.version),
-            });
-            continue;
-        }
-        let Some(sha512) = dep.integrity.sha512.clone() else {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_pnpm_missing_sha512".into(),
-                detail: format!("{fname}@{} has no sha512 integrity", dep.version),
-            });
-            continue;
-        };
-        // Every peer instance must be redirected, including nested peer
-        // contexts and the block resolutions emitted by pnpm 1–5.
-        let mut matched_any = false;
-        // Per-lock rewrites are PLANNED first and committed only after the
-        // residual gate below proves no instance of this dep escaped the
-        // splice grammar in ANY lock — committing lock-by-lock as we go
-        // would ship exactly the partial rewrite the gate exists to refuse.
-        type Splice = (usize, std::ops::Range<usize>, String);
-        let mut planned: Vec<(usize, Vec<Splice>, Vec<FileEdit>)> = Vec::new();
-        let mut residuals: Vec<(&str, Vec<String>)> = Vec::new();
-        for (idx, (lock, hits)) in locks.iter().zip(&hits).enumerate() {
-            // (entry, byte range to replace, replacement text) per instance,
-            // plus one FileEdit per instance keyed by the canonical instance
-            // key — per-instance edits keep the revert ledger lossless when
-            // several instances of one dep live in the same lock.
-            let mut splices: Vec<Splice> = Vec::new();
-            let mut instance_edits: Vec<FileEdit> = Vec::new();
-            // Residual gate, judged per instance on its POST-splice body:
-            // any instance of this exact name@version still resolving
-            // somewhere other than the hosted artifact — in a spelling the
-            // splice grammar cannot parse (e.g. an unbalanced peer suffix) —
-            // makes this a partial rewrite. Shipping it would confirm and
-            // VEX-attest the dep while dependents through the unmatched
-            // instance keep installing the unpatched upstream tarball, so
-            // the dep is refused instead.
-            let mut leftover: Vec<String> = Vec::new();
-            for &i in hits {
-                let entry = lock.entry(i);
-                let suffix = pnpm::suffix(entry.key, &fname, &dep.version)
-                    .expect("hits only holds entries naming this dep");
-                let resolution = if pnpm::supported_suffix(suffix) {
-                    pnpm::resolution(&entry)
-                } else {
-                    None
-                };
-                let Some(resolution) = resolution else {
-                    if !pnpm_resolves_to(&entry, &dep.artifact_url) {
-                        leftover.push(entry.key.to_string());
-                    }
-                    continue;
-                };
-                matched_any = true;
-                let original = &lock.text[resolution.range.clone()];
-                let rebuilt = resolution.rewrite(&sha512, &dep.artifact_url);
-                let rel =
-                    resolution.range.start - entry.offset..resolution.range.end - entry.offset;
-                let body = format!(
-                    "{}{rebuilt}{}",
-                    &entry.body[..rel.start],
-                    &entry.body[rel.end..]
-                );
-                let after = pnpm::Entry {
-                    key: entry.key,
-                    body: &body,
-                    offset: 0,
-                };
-                if !pnpm_resolves_to(&after, &dep.artifact_url) {
-                    leftover.push(entry.key.to_string());
-                }
-                if rebuilt == original {
-                    continue;
-                }
-                instance_edits.push(FileEdit {
-                    path: lock.path.clone(),
-                    kind: "redirect_pnpm_resolution".into(),
-                    action: "rewritten".into(),
-                    key: Some(format!("{fname}@{}{suffix}", dep.version)),
-                    original: Some(Value::String(original.to_string())),
-                    new: Some(Value::String(rebuilt.clone())),
-                });
-                splices.push((i, resolution.range, rebuilt));
-            }
-            if !leftover.is_empty() {
-                residuals.push((lock.path.as_str(), leftover));
-                continue;
-            }
-            if !splices.is_empty() {
-                planned.push((idx, splices, instance_edits));
-            }
-        }
-        // ANY residual anywhere refuses the dep across the WHOLE lock set —
-        // nothing rewritten, nothing recorded, nothing confirmed: a rewrite
-        // committed in one lock while another still resolves the dep
-        // upstream would confirm the dep set-wide.
-        if !residuals.is_empty() {
-            result.refused_pnpm_uuids.insert(dep.patch_uuid.clone());
-            for (lock_key, keys) in &residuals {
-                result.warnings.push(RewriteWarning {
-                    code: "redirect_pnpm_unsupported_lock_key".into(),
-                    detail: format!(
-                        "{fname}@{} still resolves through pnpm lock key(s) whose \
-                         resolution the redirect grammar cannot repoint: {} in \
-                         {lock_key}; the dep is left unredirected in EVERY lock \
-                         (nothing rewritten, nothing confirmed) — regenerate the \
-                         lock with a current pnpm (lockfileVersion 9) and re-run",
-                        dep.version,
-                        keys.join(", ")
-                    ),
-                });
-            }
-            continue;
-        }
-        for (idx, splices, mut instance_edits) in planned {
-            let lock = &mut locks[idx];
-            for (i, range, replacement) in splices {
-                lock.spliced.insert(i);
-                lock.pending.push((range, replacement));
-            }
-            lock.changed = true;
-            result.edits.append(&mut instance_edits);
-        }
-        // The entry-not-found warning fires only when the dep matched in NO
-        // pnpm lock across the whole set, not once per lock. A VENDORED dep
-        // is named as such: `socket-patch vendor` removes the registry
-        // resolution this grammar looks for (v9 respells the packages key
-        // `<name>@file:.socket/vendor/…`; v5/v6 rekey it to a bare `file:`
-        // key but keep the `<name>@<version>: file:…` overrides line), so
-        // the generic not-locked wording would send users on a wild-goose
-        // `pnpm install` when the real path is a mode switch. Fail-closed
-        // either way: nothing is rewritten for the dep.
-        if !matched_any {
-            let v9_vendored_key = format!("{fname}@file:");
-            let override_key = format!("{fname}@{}", dep.version);
-            // Scanned over the post-splice text, so fold pending splices in.
-            for lock in locks.iter_mut() {
-                lock.materialize();
-            }
-            let vendored = locks.iter().any(|lock| {
-                lock.text.lines().any(|line| {
-                    let t = line.trim_start();
-                    let t = t.strip_prefix('\'').unwrap_or(t);
-                    // v9 packages/snapshots key (leading `/` in v6 spelling).
-                    // The vendor backend always writes the RELATIVE
-                    // `file:.socket/vendor/…` spelling here, so anchoring on
-                    // it keeps a user's own `file:` dep of the same name
-                    // from being misreported as vendored.
-                    let key = t.strip_prefix('/').unwrap_or(t);
-                    if key
-                        .strip_prefix(&v9_vendored_key)
-                        .is_some_and(|rest| rest.starts_with(".socket/vendor/"))
-                    {
-                        return true;
-                    }
-                    // overrides / root-dep line: `<name>@<version>: file:…`
-                    // (pnpm <=8 absolutizes the value, so only the
-                    // `.socket/vendor/` tail is stable enough to match).
-                    t.strip_prefix(&override_key)
-                        .map(|rest| rest.strip_prefix('\'').unwrap_or(rest))
-                        .and_then(|rest| rest.strip_prefix(':'))
-                        .is_some_and(|rest| {
-                            rest.contains("file:") && rest.contains(".socket/vendor/")
-                        })
-                })
-            });
-            if vendored {
-                result.warnings.push(RewriteWarning {
-                    code: "redirect_pnpm_entry_vendored".into(),
-                    detail: format!(
-                        "{fname}@{} has no registry resolution because it is \
-                         VENDORED (the lock resolves it to a \
-                         file:.socket/vendor/… tarball); the hosted redirect \
-                         does not apply — run `socket-patch vendor --revert` to \
-                         restore the registry resolution, then re-run `scan \
-                         --mode hosted`",
-                        dep.version
-                    ),
-                });
-            } else {
-                result.warnings.push(RewriteWarning {
-                    code: "redirect_pnpm_entry_not_found".into(),
-                    detail: format!("no resolution for {fname}@{}", dep.version),
-                });
-            }
-        }
-    }
-    for lock in locks {
-        if let Some((key, content)) = lock.into_rewritten() {
-            result.files.insert(key.clone(), content);
-        }
-    }
-}
-
 // ── yarn.lock (classic) ──────────────────────────────────────────────────────
 fn rewrite_yarn_classic(
     files: &BTreeMap<String, String>,
@@ -3864,20 +3154,6 @@ fn yarn_classic_block_head(block: &str) -> Option<(String, Option<String>)> {
 /// can reproduce offline; matches the vendored backend's `SUPPORTED_CACHE_KEY`.
 const YARN_BERRY_SUPPORTED_CACHE_KEY: &str = "10c0";
 
-/// A yarn.lock is berry (v2+) when it carries the `__metadata:` header block;
-/// anything else is a classic v1 lock. Shared by both yarn rewriters and
-/// lockfile discovery (`vex::discover::yarn`) so the grammar split cannot
-/// drift. A leading BOM is encoding, not key text (yarn's YAML parser drops
-/// it), so a header-less lock opening with `\u{feff}__metadata:` is berry
-/// too.
-pub(crate) fn is_berry_lock(content: &str) -> bool {
-    content
-        .strip_prefix('\u{feff}')
-        .unwrap_or(content)
-        .lines()
-        .any(|line| line.starts_with("__metadata:"))
-}
-
 /// The `cacheKey:` value from the `__metadata` block (berry writes it unquoted:
 /// `  cacheKey: 10c0`), mirroring the vendored backend's `berry_field`.
 fn berry_cache_key(content: &str) -> Option<String> {
@@ -4249,24 +3525,21 @@ pub fn preflight_bun_hosted(content: &str) -> Result<(), RewriteWarning> {
 fn parse_bun_hosted_lock(
     content: &str,
 ) -> Result<(Vec<String>, Vec<crate::vendor::bun_lock_text::BunEntry>), RewriteWarning> {
-    use crate::vendor::bun_lock_text::{
-        check_lock_version, has_workspace_packages, lock_version, parse_packages_section,
-    };
+    use crate::vendor::bun_lock_text::{has_workspace_packages, lock_version};
 
     // The shared gate's `Err` text IS the detail: hosted and vendored refuse
     // an unsupported head with one message (and one remedy per arm — a
     // future version means "update socket-patch", a missing integer means
     // "re-lock"), so the two modes cannot drift apart.
-    if let Err(detail) = check_lock_version(content) {
-        return Err(RewriteWarning {
-            code: "redirect_bun_lock_unsupported".into(),
-            detail,
-        });
-    }
-    let lines: Vec<String> = content.split('\n').map(str::to_string).collect();
-    let entries = match parse_packages_section(&lines) {
-        Ok(entries) => entries,
-        Err(_) => {
+    let (lines, entries) = match crate::formats::bun::BunTextLock::parse(content) {
+        Ok(lock) => (lock.lines, lock.entries),
+        Err(crate::formats::bun::BunTextError::Version(detail)) => {
+            return Err(RewriteWarning {
+                code: "redirect_bun_lock_unsupported".into(),
+                detail,
+            });
+        }
+        Err(crate::formats::bun::BunTextError::Packages(_)) => {
             // Fail-closed: never line-splice a lock whose packages section
             // deviates from bun's emitted single-line grammar.
             return Err(RewriteWarning {
@@ -4806,306 +4079,6 @@ pub fn artifact_url_spellings(artifact_url: &str) -> [String; 2] {
     [artifact_url.to_string(), artifact_url.replace('/', "\\/")]
 }
 
-/// Byte offset of the `}` closing the JSON object that CONTAINS `from`, which
-/// must be a position inside that object. Brace counting skips string literals,
-/// so a brace inside a description or URL cannot move the boundary.
-///
-/// Walks bytes, not chars: every byte it acts on is ASCII, and no byte of a
-/// multi-byte UTF-8 sequence is, so the offsets are the char walk's (an
-/// escaped multi-byte char clears `escaped` on its lead byte).
-fn json_object_end_from(text: &str, from: usize) -> Option<usize> {
-    let mut depth = 0usize;
-    let mut in_string = false;
-    let mut escaped = false;
-    for (offset, &byte) in text.as_bytes()[from..].iter().enumerate() {
-        if in_string {
-            match byte {
-                _ if escaped => escaped = false,
-                b'\\' => escaped = true,
-                b'"' => in_string = false,
-                _ => {}
-            }
-            continue;
-        }
-        match byte {
-            b'"' => in_string = true,
-            b'{' => depth += 1,
-            b'}' if depth == 0 => return Some(from + offset),
-            b'}' => depth -= 1,
-            _ => {}
-        }
-    }
-    None
-}
-
-/// Value of the first `"<key>": "<value>"` pair in `text` (composer writes its
-/// lock with exactly one space after the colon, the same shape the surgical
-/// `dist` regexes below assume).
-fn json_string_field<'a>(text: &'a str, key: &str) -> Option<&'a str> {
-    let pattern = format!("\"{key}\": \"");
-    let start = text.find(&pattern)? + pattern.len();
-    let end = text[start..].find('"')? + start;
-    Some(&text[start..end])
-}
-
-/// Outcome of locating a package entry in a composer.lock.
-enum ComposerEntry {
-    /// Inclusive byte range from the entry's `"name"` key to the `}` closing
-    /// the entry — composer writes `name` first, so this covers every key the
-    /// rewriter edits.
-    Found(usize, usize),
-    /// The name matched but the lock pins this OTHER version.
-    VersionMismatch(String),
-    NotFound,
-}
-
-/// Locate `pkg`'s entry in a composer.lock (either `packages[]` or
-/// `packages-dev[]` — the scan is over the whole file).
-///
-/// Names match CASE-INSENSITIVELY, the way the composer crawler and the vendor
-/// backend already match them: packagist canonicalizes to lowercase, but
-/// hand-written mixed-case locks install fine and would otherwise silently miss
-/// the redirect. The locked version must match the patched one through
-/// composer's leading-`v` normalization (locks carry the pretty `v6.4.1`, PURLs
-/// the bare `6.4.1`); matching on name alone would repoint whatever version
-/// the lock happened to hold at a patch built for a different one.
-fn find_composer_entry(content: &str, pkg: &str, version: &str) -> ComposerEntry {
-    let mut mismatched: Option<String> = None;
-    for (name_idx, _) in content.match_indices("\"name\": \"") {
-        // The name is the value at `name_idx` — the entry's first field —
-        // and its closing quote precedes any `}` the object walk can stop
-        // at, so test it before walking to the end of the object: most
-        // occurrences name some other package.
-        if !json_string_field(&content[name_idx..], "name")
-            .is_some_and(|n| n.eq_ignore_ascii_case(pkg))
-        {
-            continue;
-        }
-        let Some(end) = json_object_end_from(content, name_idx) else {
-            continue;
-        };
-        let entry = &content[name_idx..=end];
-        // Every package entry carries `version`; an `authors[]`/`support`
-        // object that happens to have a matching `name` does not.
-        let Some(locked) = json_string_field(entry, "version") else {
-            continue;
-        };
-        if normalize_version(locked) == normalize_version(version) {
-            return ComposerEntry::Found(name_idx, end);
-        }
-        mismatched = Some(locked.to_string());
-    }
-    match mismatched {
-        Some(locked) => ComposerEntry::VersionMismatch(locked),
-        None => ComposerEntry::NotFound,
-    }
-}
-
-/// Append `"shasum": "<sha1>"` as the last key of a `"dist": { … }` block,
-/// indented like the keys already in it. VCS/zipball dists omit `shasum`
-/// entirely; redirecting such a block without inserting the pin would leave the
-/// hosted artifact unverified, so composer would install whatever the URL returned.
-/// `block` is the whole dist object and already holds at least a `url`.
-fn append_composer_shasum(block: &str, sha1: &str) -> String {
-    let Some(close) = block.rfind('}') else {
-        return block.to_string();
-    };
-    let head = block[..close].trim_end();
-    let indent: String = head[head.rfind('\n').map_or(0, |i| i + 1)..]
-        .chars()
-        .take_while(|c| c.is_whitespace())
-        .collect();
-    format!(
-        "{head},\n{indent}\"shasum\": \"{sha1}\"{}",
-        &block[head.len()..]
-    )
-}
-
-static COMPOSER_DIST_TYPE_RE: LazyLock<Regex> = LazyLock::new(|| {
-    Regex::new(r#"("type": ")[^"]*(")"#).expect("static dist type regex is valid")
-});
-static COMPOSER_DIST_URL_RE: LazyLock<Regex> =
-    LazyLock::new(|| Regex::new(r#"("url": ")[^"]*(")"#).expect("static dist url regex is valid"));
-static COMPOSER_DIST_SHASUM_RE: LazyLock<Regex> = LazyLock::new(|| {
-    Regex::new(r#"("shasum": ")[^"]*(")"#).expect("static dist shasum regex is valid")
-});
-
-/// Byte offset of the entry's `"source": {` key when that object is the
-/// dist block's IMMEDIATE predecessor (only `,` + whitespace between them) —
-/// the layout composer itself always writes (`source` then `dist`).
-/// `None` when the entry has no source object there.
-fn composer_source_before_dist(
-    content: &str,
-    entry_start: usize,
-    dist_start: usize,
-) -> Option<usize> {
-    const SOURCE_KEY: &str = "\"source\": {";
-    let source_start = entry_start + content[entry_start..dist_start].rfind(SOURCE_KEY)?;
-    let source_end = json_object_end_from(content, source_start + SOURCE_KEY.len())?;
-    (source_end < dist_start && content[source_end + 1..dist_start].trim() == ",")
-        .then_some(source_start)
-}
-
-fn rewrite_composer_lock(
-    files: &BTreeMap<String, String>,
-    overrides: &[DepOverride],
-    result: &mut RewriteResult,
-) {
-    let composer: Vec<&DepOverride> = overrides
-        .iter()
-        .filter(|o| o.ecosystem == "composer")
-        .collect();
-    if composer.is_empty() {
-        return;
-    }
-    // Parity with `redirect_npm_no_lockfile`: a granted dep the project has
-    // no lock to pin must be SAID, not silently dropped from the redirected
-    // count (a composer.json + installed vendor tree without a lock is
-    // discovered and granted like any other).
-    if !files.contains_key("composer.lock") {
-        result.warnings.push(RewriteWarning {
-            code: "redirect_composer_no_lockfile".into(),
-            detail: "no composer.lock present; composer redirect skipped".into(),
-        });
-        return;
-    }
-    const DIST_KEY: &str = "\"dist\": {";
-    let mut content = files["composer.lock"].clone();
-    let type_re: &Regex = &COMPOSER_DIST_TYPE_RE;
-    let url_re: &Regex = &COMPOSER_DIST_URL_RE;
-    let shasum_re: &Regex = &COMPOSER_DIST_SHASUM_RE;
-    let mut changed = false;
-    for dep in &composer {
-        let composer_name = full_name(dep);
-        let Some(sha1) = dep.integrity.sha1.clone() else {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_composer_missing_sha1".into(),
-                detail: format!("{composer_name} has no sha1 (dist.shasum) integrity"),
-            });
-            continue;
-        };
-        let (entry_start, entry_end) =
-            match find_composer_entry(&content, &composer_name, &dep.version) {
-                ComposerEntry::Found(start, end) => (start, end),
-                ComposerEntry::VersionMismatch(locked) => {
-                    result.warnings.push(RewriteWarning {
-                        code: "redirect_composer_version_mismatch".into(),
-                        detail: format!(
-                            "composer.lock pins {composer_name}@{locked}, not the patched {}",
-                            dep.version
-                        ),
-                    });
-                    continue;
-                }
-                ComposerEntry::NotFound => {
-                    result.warnings.push(RewriteWarning {
-                        code: "redirect_composer_pkg_not_found".into(),
-                        detail: format!(
-                            "no composer.lock package named {composer_name}@{}",
-                            dep.version
-                        ),
-                    });
-                    continue;
-                }
-            };
-        // The dist block MUST belong to the located entry. Scanning forward
-        // from the name for the next `"dist": {` would walk into the FOLLOWING
-        // package whenever the target was installed from source, repointing a
-        // bystander's url + shasum — a checksum-clean install of the wrong
-        // code. A target with no dist of its own pins nothing: fail closed.
-        let Some(dist_start) = content[entry_start..=entry_end]
-            .find(DIST_KEY)
-            .map(|offset| entry_start + offset)
-        else {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_composer_no_dist".into(),
-                detail: format!("{composer_name} has no dist block"),
-            });
-            continue;
-        };
-        let Some(dist_end) = json_object_end_from(&content, dist_start + DIST_KEY.len()) else {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_composer_lock_malformed".into(),
-                detail: format!("{composer_name}'s dist block is unterminated"),
-            });
-            continue;
-        };
-        let block = content[dist_start..=dist_end].to_string();
-        // Already redirected (either slash spelling): recording an edit whose
-        // `original` IS the hosted url would grow the ledger on every re-run
-        // and poison a future revert.
-        if artifact_url_present(&block, &dep.artifact_url) && block.contains(&sha1) {
-            continue;
-        }
-        if !block.contains("\"url\": \"") {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_composer_no_dist_url".into(),
-                detail: format!("{composer_name}'s dist block has no url to redirect"),
-            });
-            continue;
-        }
-        let mut rewritten = type_re.replace(&block, "${1}zip${2}").to_string();
-        rewritten = url_re
-            .replace(
-                &rewritten,
-                format!("${{1}}{}${{2}}", dep.artifact_url).as_str(),
-            )
-            .to_string();
-        rewritten = if rewritten.contains("\"shasum\": \"") {
-            shasum_re
-                .replace(&rewritten, format!("${{1}}{sha1}${{2}}").as_str())
-                .to_string()
-        } else {
-            append_composer_shasum(&rewritten, &sha1)
-        };
-        // Drop the entry's `source` (the vendored backend does the same):
-        // when the dist download fails — checksum mismatch, an expired grant
-        // token, a patch-server outage — composer 1 and composer 2 before its
-        // source-fallback cutoff (2.2 LTS included) print "Now trying to
-        // download from source" and silently install the PRISTINE upstream
-        // commit from git, and `--prefer-source` / `preferred-install:
-        // source` always does. With the source gone the hosted archive is
-        // the only way to install the package, so a failed fetch fails the
-        // install instead of shipping the vulnerable code. The edit then
-        // spans `"source": {…},\n<indent>"dist": {…}`, so the ledger's
-        // fragment revert puts both blocks back byte-for-byte.
-        let (edit_start, original) =
-            match composer_source_before_dist(&content, entry_start, dist_start) {
-                Some(source_start) => (source_start, content[source_start..=dist_end].to_string()),
-                None => {
-                    if content[entry_start..=entry_end].contains("\"source\": {") {
-                        result.warnings.push(RewriteWarning {
-                            code: "redirect_composer_source_kept".into(),
-                            detail: format!(
-                                "{composer_name}'s source block does not directly precede its \
-                                 dist and was left in place; a failed hosted download may fall \
-                                 back to it"
-                            ),
-                        });
-                    }
-                    (dist_start, block.clone())
-                }
-            };
-        if rewritten != original {
-            // In place: a fresh whole-lock copy per edit would hold one
-            // lock-sized buffer per redirected dep.
-            content.replace_range(edit_start..=dist_end, &rewritten);
-            changed = true;
-            result.edits.push(FileEdit {
-                path: "composer.lock".into(),
-                kind: "redirect_composer_dist".into(),
-                action: "rewritten".into(),
-                key: Some(composer_name),
-                original: Some(Value::String(original)),
-                new: Some(Value::String(rewritten)),
-            });
-        }
-    }
-    if changed {
-        result.files.insert("composer.lock".into(), content);
-    }
-}
-
 // ── nuget (nuget.config + packages.lock.json) ────────────────────────────────
 fn default_nuget_config() -> String {
     "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<configuration>\n  <packageSources>\n    <add key=\"nuget.org\" value=\"https://api.nuget.org/v3/index.json\" />\n  </packageSources>\n</configuration>\n".to_string()
@@ -5662,7 +4635,7 @@ pub fn hosted_patch_url_uuids(url: &str, extra_origins: &[String]) -> Option<Vec
 /// the index URL itself as the segment immediately preceding the patch-uuid
 /// level, so the idempotency guard never silently degrades into the
 /// nesting-corruption failure mode when a caller forgets the token.
-fn gem_index_url_pattern(dep: &DepOverride, index_url: &str) -> String {
+pub(crate) fn gem_index_url_pattern(dep: &DepOverride, index_url: &str) -> String {
     let mut url_pat = regex::escape(index_url);
     let derived_token = grant_token_path_segment(index_url, &dep.patch_uuid);
     let rotating = [
@@ -5718,271 +4691,6 @@ fn gem_spelling_residue(content: &str, deps: &[&DepOverride]) -> String {
     residue.trim_end().to_string()
 }
 
-/// A lock line without its `\r?\n` ending (never more than one of each).
-fn gem_lock_line_content(line: &str) -> &str {
-    let line = line.strip_suffix('\n').unwrap_or(line);
-    line.strip_suffix('\r').unwrap_or(line)
-}
-
-/// The gem name of a 2-space DEPENDENCIES entry (`  rails`, `  rails!`,
-/// `  rails (= 7.0.0)!`) — the text before any constraint, sans source pin.
-fn gem_lock_dependency_name(entry: &str) -> &str {
-    let entry = entry.trim_start();
-    let entry = entry.split(" (").next().unwrap_or(entry);
-    entry.trim_end_matches('!')
-}
-
-/// One parsed `GEM` section of a Gemfile.lock: its header line index, its
-/// `remote:` lines (index + URL) and the exclusive end index — the start of
-/// the next column-0 header (trailing blank separator included) or EOF.
-struct GemLockSection {
-    start: usize,
-    remotes: Vec<(usize, String)>,
-    end: usize,
-}
-
-/// Converge the lock's source attribution for one redirected dep so the
-/// Gemfile + lock pair is what bundler itself would write after an install
-/// from the redirected Gemfile (verified frozen-installable on bundler 4):
-/// the dep's spec entry (+ its dependency sublines) moves out of the
-/// upstream `GEM` section into a patch-registry `GEM` section
-/// (`remote: <index-url>`), and DEPENDENCIES pins `<name> (= <version>)!`
-/// (bundler's source-pin spelling for a block-scoped exact-version gem) —
-/// added in sorted position when the dep was transitive. Without this the
-/// CHECKSUMS pin leaves a MIXED state bundler refuses: the lock still
-/// attributes the gem to the upstream remote, so the prescribed unfrozen
-/// install exits 37 "mismatched checksums" and a frozen install exits 16.
-///
-/// Idempotent and rotation-aware: a section whose remote matches the
-/// token-wildcard pattern is recognized as ours (never duplicated) and its
-/// remote is refreshed in place under a rotated grant
-/// (`redirect_gemfile_lock_source_url`, mirroring the Gemfile refresh).
-///
-/// Returns true when the lock ends converged (already, or via edits recorded
-/// into `result`); false when the dep cannot be attributed safely — spec
-/// entry absent or duplicated, a legacy multi-remote `GEM` section, or no
-/// DEPENDENCIES section — in which case nothing is touched and the caller
-/// surfaces the frozen-install caveat.
-fn converge_gem_lock_source(
-    lk: &mut String,
-    dep: &DepOverride,
-    index_url: &str,
-    lock_name: &str,
-    lock_changed: &mut bool,
-    result: &mut RewriteResult,
-) -> bool {
-    let eol = if lk.contains("\r\n") { "\r\n" } else { "\n" };
-    let mut lines: Vec<String> = lk.split_inclusive('\n').map(str::to_string).collect();
-    let is_header = |c: &str| !c.is_empty() && !c.starts_with(' ');
-
-    // Parse: GEM sections, the dep's 4-space spec entry, DEPENDENCIES range.
-    let spec_content = format!("    {} ({})", dep.name, dep.version);
-    let mut sections: Vec<GemLockSection> = Vec::new();
-    let mut spec_at: Vec<(usize, usize)> = Vec::new(); // (section idx, line idx)
-    let mut deps_range: Option<(usize, usize)> = None; // exclusive of header
-    let mut i = 0;
-    while i < lines.len() {
-        let c = gem_lock_line_content(&lines[i]);
-        if !is_header(c) {
-            i += 1;
-            continue;
-        }
-        let header_is_gem = c == "GEM";
-        let start = i;
-        let mut remotes = Vec::new();
-        let mut j = i + 1;
-        while j < lines.len() && !is_header(gem_lock_line_content(&lines[j])) {
-            let cj = gem_lock_line_content(&lines[j]);
-            if header_is_gem {
-                if let Some(url) = cj.strip_prefix("  remote: ") {
-                    remotes.push((j, url.to_string()));
-                }
-                if cj == spec_content {
-                    spec_at.push((sections.len(), j));
-                }
-            }
-            j += 1;
-        }
-        if header_is_gem {
-            sections.push(GemLockSection {
-                start,
-                remotes,
-                end: j,
-            });
-        } else if c == "DEPENDENCIES" {
-            deps_range = Some((start + 1, j));
-        }
-        i = j;
-    }
-
-    let spec_pos = if spec_at.len() == 1 {
-        Some(spec_at[0])
-    } else {
-        None
-    };
-    let (Some((sec_idx, spec_idx)), Some((deps_start, deps_end))) = (spec_pos, deps_range) else {
-        return false;
-    };
-    if sections[sec_idx].remotes.len() != 1 {
-        return false;
-    }
-    // Bundler always writes source sections before DEPENDENCIES — the pin
-    // edit below runs first on that premise (its lines sit after the parsed
-    // spec/remote/end indices, so they never shift). A hand-edited lock with
-    // DEPENDENCIES before the dep's GEM section breaks the premise: the
-    // transitive-dep pin INSERT would leave the spec-move splicing on stale
-    // indices. Fail soft to the mixed state instead.
-    if deps_start < sections[sec_idx].end {
-        return false;
-    }
-    let (remote_idx, remote_url) = sections[sec_idx].remotes[0].clone();
-    let socket_remote_re = Regex::new(&format!("^{}$", gem_index_url_pattern(dep, index_url)))
-        .expect("anchored index-url pattern from the escaped URL is valid");
-    let mut changed = false;
-
-    // DEPENDENCIES pin first — its lines sit AFTER the GEM sections, so the
-    // spec move below never invalidates these indices (and vice versa would).
-    let target = format!("  {} (= {})!", dep.name, dep.version);
-    let is_entry = |c: &str| c.starts_with("  ") && !c.starts_with("   ");
-    let entry_idx = (deps_start..deps_end).find(|&k| {
-        let ck = gem_lock_line_content(&lines[k]);
-        is_entry(ck) && gem_lock_dependency_name(ck) == dep.name
-    });
-    match entry_idx {
-        Some(k) if gem_lock_line_content(&lines[k]) == target => {}
-        Some(k) => {
-            let old = gem_lock_line_content(&lines[k]).trim_start().to_string();
-            let ending = lines[k][gem_lock_line_content(&lines[k]).len()..].to_string();
-            lines[k] = format!("{target}{ending}");
-            result.edits.push(FileEdit {
-                path: lock_name.into(),
-                kind: "redirect_gemfile_lock_dependency_pin".into(),
-                action: "rewritten".into(),
-                key: Some(dep.name.clone()),
-                original: Some(Value::String(old)),
-                new: Some(Value::String(target.trim_start().to_string())),
-            });
-            changed = true;
-        }
-        None => {
-            // Transitive dep: bundler keeps DEPENDENCIES sorted by name.
-            let mut at = deps_end;
-            for (k, line) in lines.iter().enumerate().take(deps_end).skip(deps_start) {
-                let ck = gem_lock_line_content(line);
-                if ck.is_empty()
-                    || (is_entry(ck) && gem_lock_dependency_name(ck) > dep.name.as_str())
-                {
-                    at = k;
-                    break;
-                }
-            }
-            lines.insert(at, format!("{target}{eol}"));
-            result.edits.push(FileEdit {
-                path: lock_name.into(),
-                kind: "redirect_gemfile_lock_dependency_pin".into(),
-                action: "added".into(),
-                key: Some(dep.name.clone()),
-                original: None,
-                new: Some(Value::String(target.trim_start().to_string())),
-            });
-            changed = true;
-        }
-    }
-
-    if socket_remote_re.is_match(&remote_url) {
-        // Already ours. Rotated grant: refresh the remote in place.
-        if remote_url != index_url {
-            let ending =
-                lines[remote_idx][gem_lock_line_content(&lines[remote_idx]).len()..].to_string();
-            lines[remote_idx] = format!("  remote: {index_url}{ending}");
-            result.edits.push(FileEdit {
-                path: lock_name.into(),
-                kind: "redirect_gemfile_lock_source_url".into(),
-                action: "rewritten".into(),
-                key: Some(dep.name.clone()),
-                original: Some(Value::String(remote_url)),
-                new: Some(Value::String(index_url.to_string())),
-            });
-            changed = true;
-        }
-    } else {
-        // Move the spec (+ sublines) into a patch-registry section of its
-        // own, inserted where bundler itself writes it: bundler emits the
-        // rubygems `GEM` sections sorted by source identifier
-        // (`SourceList#lock_rubygems_sources`: `sort_by(&:identifier)`, i.e.
-        // by the section's remote URLs), so the new section goes before the
-        // first `GEM` section whose remotes sort after the index URL, else
-        // after the last one. A frozen install re-renders the lock, and
-        // since bundler 4.0.19 (rubygems#9750, "fail instead of warning when
-        // frozen mode can't update the lockfile") any difference is fatal:
-        // "Your lockfile needs to be updated, but it can't be because frozen
-        // mode is set". Appending after `https://rubygems.org/` when the
-        // patch registry (`https://patch.socket.dev/…`) sorts first would break
-        // every converged hosted pair under `BUNDLE_FROZEN` / deployment
-        // mode (verified: 4.0.15 installs it, 4.0.21 refuses it).
-        let mut last = spec_idx;
-        while last + 1 < lines.len()
-            && gem_lock_line_content(&lines[last + 1]).starts_with("      ")
-        {
-            last += 1;
-        }
-        let moved: Vec<String> = lines.drain(spec_idx..=last).collect();
-        let n = moved.len();
-        // Section bounds after the drain (every drained line sat inside
-        // section `sec_idx`, which keeps its start).
-        let bounds = |k: usize| -> (usize, usize) {
-            let s = &sections[k];
-            match k.cmp(&sec_idx) {
-                std::cmp::Ordering::Less => (s.start, s.end),
-                std::cmp::Ordering::Equal => (s.start, s.end - n),
-                std::cmp::Ordering::Greater => (s.start - n, s.end - n),
-            }
-        };
-        let identifier = |k: usize| -> String {
-            sections[k]
-                .remotes
-                .iter()
-                .map(|(_, url)| url.as_str())
-                .collect::<Vec<_>>()
-                .join(", ")
-        };
-        let insert_at = (0..sections.len())
-            .find(|&k| identifier(k).as_str() > index_url)
-            .map(|k| bounds(k).0)
-            .unwrap_or_else(|| bounds(sections.len() - 1).1);
-        let mut block: Vec<String> = Vec::with_capacity(moved.len() + 4);
-        block.push(format!("GEM{eol}"));
-        block.push(format!("  remote: {index_url}{eol}"));
-        block.push(format!("  specs:{eol}"));
-        for line in moved {
-            // Moved lines keep their own bytes; only a final line that lacked
-            // a newline (EOF) gains the file's ending.
-            if line.ends_with('\n') {
-                block.push(line);
-            } else {
-                block.push(format!("{line}{eol}"));
-            }
-        }
-        block.push(eol.to_string());
-        lines.splice(insert_at..insert_at, block);
-        result.edits.push(FileEdit {
-            path: lock_name.into(),
-            kind: "redirect_gemfile_lock_gem_source".into(),
-            action: "rewritten".into(),
-            key: Some(dep.name.clone()),
-            original: Some(Value::String(remote_url)),
-            new: Some(Value::String(index_url.to_string())),
-        });
-        changed = true;
-    }
-
-    if changed {
-        *lk = lines.concat();
-        *lock_changed = true;
-    }
-    true
-}
-
 fn rewrite_gem(
     files: &BTreeMap<String, String>,
     overrides: &[DepOverride],
@@ -6335,46 +5043,30 @@ fn rewrite_gem(
                 });
                 continue;
             }
-            let sum_line_re = Regex::new(
-                &(String::from(r"(?m)^(  ")
-                    + &regex::escape(&dep.name)
-                    + r" \("
-                    + &regex::escape(&dep.version)
-                    + r"\)) sha256=([0-9a-f]+)(\r?)$"),
-            )
-            .expect("checksum-line regex from the escaped name/version is valid");
             let new_val = format!("{} ({}) sha256={sha256}", dep.name, dep.version);
-            // Already redirected (re-run): the CHECKSUMS line is at the
-            // target value; recording an edit would grow the ledger forever.
-            let already_re =
-                Regex::new(&(String::from(r"(?m)^  ") + &regex::escape(&new_val) + r"\r?$"))
-                    .expect("already-redirected regex from the escaped line is valid");
             let mut checksums_era = true;
-            if already_re.is_match(lk) {
-                // no-op
-            } else if let Some(m) = sum_line_re.captures(lk) {
-                // The pre-edit line goes into the ledger as `original` so a
-                // revert can restore the upstream sha.
-                let old_val = format!(
-                    "{} ({}) sha256={}",
-                    dep.name,
-                    dep.version,
-                    m.get(2)
-                        .expect("sum_line_re always captures group 2 (sha hex)")
-                        .as_str()
-                );
-                *lk = sum_line_re
-                    .replace(lk, format!("${{1}} sha256={sha256}${{3}}").as_str())
-                    .to_string();
-                lock_changed = true;
-                result.edits.push(FileEdit {
-                    path: lock_name.into(),
-                    kind: "redirect_gemfile_lock_checksum".into(),
-                    action: "rewritten".into(),
-                    key: Some(dep.name.clone()),
-                    original: Some(Value::String(old_val)),
-                    new: Some(Value::String(new_val)),
-                });
+            // The entry for exactly `name (version)`, read with the shared
+            // Bundler-lock grammar the discovery reader uses — whatever
+            // digests it carries (bare, uppercase, several algorithms), so it
+            // is REPLACED, never shadowed by a second, conflicting entry.
+            if let Some((start, end)) = checksum_entry_span(lk, &dep.name, &dep.version) {
+                let old_val = lk[start + 2..end].to_string();
+                // Already redirected (re-run): the entry is at the target
+                // value; recording an edit would grow the ledger forever.
+                if old_val != new_val {
+                    lk.replace_range(start + 2..end, &new_val);
+                    lock_changed = true;
+                    // The pre-edit entry goes into the ledger verbatim as
+                    // `original` so a revert restores the upstream digests.
+                    result.edits.push(FileEdit {
+                        path: lock_name.into(),
+                        kind: "redirect_gemfile_lock_checksum".into(),
+                        action: "rewritten".into(),
+                        key: Some(dep.name.clone()),
+                        original: Some(Value::String(old_val)),
+                        new: Some(Value::String(new_val)),
+                    });
+                }
             } else if checksums_re.is_match(lk) {
                 *lk = checksums_re
                     .replace(
@@ -11237,6 +9929,77 @@ mod tests {
         )
     }
 
+    /// The CHECKSUMS writer finds the dep's entry with the shared Bundler-lock
+    /// grammar the discovery reader uses, so every spelling that reader
+    /// accepts — lowercase, uppercase, extra digest tokens (space- or
+    /// comma-joined), a bare entry, CRLF — is REPLACED by the patched pin:
+    /// exactly one `rails (7.0.0)` row survives, it reads back as the
+    /// patched sha, and the ledger holds the old entry verbatim for revert.
+    #[test]
+    fn gem_checksum_rewrite_replaces_every_spelling_the_reader_accepts() {
+        let lower = "2".repeat(64);
+        let upper = "A".repeat(64);
+        let sha512 = "b".repeat(128);
+        let patched = "f".repeat(64);
+        let entries = [
+            format!("rails (7.0.0) sha256={lower}"),
+            format!("rails (7.0.0) sha256={upper}"),
+            format!("rails (7.0.0) sha256={lower} sha512={sha512}"),
+            format!("rails (7.0.0) sha256={lower},sha512={sha512}"),
+            "rails (7.0.0)".to_string(),
+        ];
+        for crlf in [false, true] {
+            for entry in &entries {
+                let mut lock = gem_lock(&format!("  {entry}"));
+                if crlf {
+                    lock = lock.replace('\n', "\r\n");
+                }
+                let mut files = BTreeMap::new();
+                files.insert(
+                    "Gemfile".to_string(),
+                    "source \"https://rubygems.org\"\n\ngem \"rails\", \"7.0.0\"\n".to_string(),
+                );
+                files.insert("Gemfile.lock".to_string(), lock);
+                let r = rewrite_registry_redirect(&files, &[gem_override("rails", "7.0.0")]);
+                let out = r.files.get("Gemfile.lock").expect("lock rewritten");
+                let rows: Vec<&str> = out
+                    .lines()
+                    .filter(|l| l.trim_start().starts_with("rails (7.0.0)") && l.starts_with("  ") && !l.starts_with("    "))
+                    .collect();
+                assert_eq!(
+                    rows,
+                    [format!("  rails (7.0.0) sha256={patched}")],
+                    "{entry} (crlf={crlf}): exactly one patched row\n{out}"
+                );
+                let eol = if crlf { "\r\n" } else { "\n" };
+                assert!(
+                    out.contains(&format!("  rails (7.0.0) sha256={patched}{eol}")),
+                    "{entry}: the entry keeps its line ending: {out:?}"
+                );
+                let model = crate::formats::gem::GemfileLock::parse(out);
+                assert_eq!(model.checksum("rails", "7.0.0"), Some(patched.as_str()), "{entry}");
+                assert!(!out.contains("\r\r"), "line endings kept: {out:?}");
+                let edit = r
+                    .edits
+                    .iter()
+                    .find(|e| e.kind == "redirect_gemfile_lock_checksum")
+                    .expect("checksum edit recorded");
+                assert_eq!(edit.action, "rewritten", "{entry}");
+                assert_eq!(edit.original, Some(Value::String(entry.clone())), "{entry}");
+
+                // A re-run over the rewritten lock records nothing new.
+                files.insert("Gemfile".to_string(), r.files["Gemfile"].clone());
+                files.insert("Gemfile.lock".to_string(), out.clone());
+                let again = rewrite_registry_redirect(&files, &[gem_override("rails", "7.0.0")]);
+                assert!(
+                    !again.edits.iter().any(|e| e.kind == "redirect_gemfile_lock_checksum"),
+                    "{entry}: rerun is a no-op: {:?}",
+                    again.edits
+                );
+            }
+        }
+    }
+
     /// The edit must splice by the regex match's byte range: a substring
     /// replace of the matched line's TEXT finds an identical commented-out
     /// duplicate earlier in the file first and corrupts the comment while the
@@ -13839,7 +12602,7 @@ packages:
     }
 
     /// The same boundaries, judged by the PRODUCTION inline residual gate
-    /// (`rewrite_pnpm_lock` over indexed hits), not the reference probe: an
+    /// (`plan_hosted` over indexed hits), not the reference probe: an
     /// instance already on the hosted artifact, a longer version sharing
     /// the prefix, a different quoted scoped package and resolution-less
     /// `snapshots:` keys never count as residuals, v6 nested-paren and v5
@@ -14955,7 +13718,7 @@ packages:
             pnpm_v9_lock("left-pad", "1.3.0").replace('\n', "\r\n"),
         );
         let mut r = RewriteResult::default();
-        rewrite_pnpm_lock(&files, std::slice::from_ref(&ovr), &mut r);
+        plan_hosted(&files, std::slice::from_ref(&ovr), &mut r);
         let out = &r.files["pnpm-lock.yaml"];
         assert!(out.contains("tarball: http://patch.test/left-pad-1.3.0.tgz"));
         assert!(!out.replace("\r\n", "").contains('\n'));
diff --git a/crates/socket-patch-core/src/patch/redirect/pnpm_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/pnpm_equivalence_tests.rs
index 60bd8516..906427f0 100644
--- a/crates/socket-patch-core/src/patch/redirect/pnpm_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/pnpm_equivalence_tests.rs
@@ -1,7 +1,7 @@
 //! Equivalence oracle for the indexed pnpm hosted rewriter: the previous
 //! implementation (re-parse every lock per dep, splice per dep) is kept here
 //! verbatim as `rewrite_pnpm_lock_oracle`, and the production
-//! `rewrite_pnpm_lock` must produce the identical `RewriteResult` — output
+//! `plan_hosted` must produce the identical `RewriteResult` — output
 //! bytes, the FileEdit list (order and `original` fragments), warnings and
 //! refusals — on depscan-sized synthetic locks and on randomized mixes of
 //! every lock flavor the grammar handles.
@@ -14,7 +14,7 @@ fn assert_equivalent(files: &BTreeMap<String, String>, overrides: &[DepOverride]
     let mut want = RewriteResult::default();
     rewrite_pnpm_lock_oracle(files, overrides, &mut want);
     let mut got = RewriteResult::default();
-    rewrite_pnpm_lock(files, overrides, &mut got);
+    plan_hosted(files, overrides, &mut got);
     assert_same(&want, &got, "pnpm");
     got
 }
diff --git a/crates/socket-patch-core/src/patch/redirect/upstream/cargo.rs b/crates/socket-patch-core/src/patch/redirect/upstream/cargo.rs
index da6fa754..c44d7919 100644
--- a/crates/socket-patch-core/src/patch/redirect/upstream/cargo.rs
+++ b/crates/socket-patch-core/src/patch/redirect/upstream/cargo.rs
@@ -16,6 +16,7 @@ use std::collections::{BTreeMap, BTreeSet};
 use regex::Regex;
 
 use super::{Ctx, FormatResult, HostedPin, View};
+use crate::formats::cargo::CargoLock;
 
 /// How Cargo.lock names crates.io (cargo keeps this spelling even when it
 /// fetches over the sparse protocol).
@@ -30,20 +31,14 @@ fn registry_name(uuid: &str) -> String {
 
 struct LockHit {
     uuid: String,
+    /// The package's position in [`CargoLock::packages`].
+    index: usize,
     name: String,
     version: String,
     /// The hosted source string (`sparse+https://…/index/`).
     source: String,
 }
 
-fn quoted_field(block: &str, field: &str) -> Option<String> {
-    block.lines().find_map(|l| {
-        let rest = l.strip_prefix(field)?.trim_start().strip_prefix('=')?;
-        let v = rest.trim();
-        v.strip_prefix('"')?.strip_suffix('"').map(str::to_string)
-    })
-}
-
 pub(crate) async fn restore(
     view: &mut View<'_>,
     pins: &[&HostedPin],
@@ -66,29 +61,34 @@ pub(crate) async fn restore(
     if let Some(raw) = lock_raw {
         let crlf = raw.contains("\r\n");
         let mut lock = raw.replace("\r\n", "\n");
+        // The one parse of the lock: every package with its value spans.
+        let model = match CargoLock::parse(&lock) {
+            Ok(model) => model,
+            Err(_) => {
+                for pin in pins {
+                    result.refuse(&pin.uuid, "Cargo.lock does not parse as TOML");
+                }
+                return result;
+            }
+        };
         let mut hits: Vec<LockHit> = Vec::new();
-        let mut from = 0;
-        while let Some((start, end)) = super::super::next_lock_block(&lock, from) {
-            from = end.max(start + 1);
-            let block = &lock[start..end];
-            let Some(source) = quoted_field(block, "source") else {
+        for (i, pkg) in model.packages().iter().enumerate() {
+            let Some(source) = &pkg.source else {
                 continue;
             };
-            let Some(uuid) = ctx.hosted_uuid(&source) else {
+            let Some(uuid) = ctx.hosted_uuid(source) else {
                 continue;
             };
             if !by_uuid.contains_key(uuid.as_str()) {
                 continue;
             }
-            match (quoted_field(block, "name"), quoted_field(block, "version")) {
-                (Some(name), Some(version)) => hits.push(LockHit {
-                    uuid,
-                    name,
-                    version,
-                    source,
-                }),
-                _ => result.refuse(&uuid, "its Cargo.lock entry names no crate and version"),
-            }
+            hits.push(LockHit {
+                uuid,
+                index: i,
+                name: pkg.name.clone(),
+                version: pkg.version.clone(),
+                source: source.clone(),
+            });
         }
         let lookups = hits.iter().map(|h| async move {
             (
@@ -99,6 +99,7 @@ pub(crate) async fn restore(
         let cksums: BTreeMap<String, Result<String, String>> =
             futures_util::future::join_all(lookups).await.into_iter().collect();
         let mut changed = false;
+        let mut restored: Vec<(&LockHit, String)> = Vec::new();
         for hit in &hits {
             let cksum = match cksums.get(&hit.uuid) {
                 Some(Ok(c)) => c.clone(),
@@ -111,32 +112,26 @@ pub(crate) async fn restore(
             if result.refused.contains_key(&hit.uuid) {
                 continue;
             }
-            // The entry's own source + checksum lines.
-            let mut from = 0;
-            while let Some((start, end)) = super::super::next_lock_block(&lock, from) {
-                from = end.max(start + 1);
-                let block = lock[start..end].to_string();
-                if quoted_field(&block, "source").as_deref() != Some(hit.source.as_str())
-                    || quoted_field(&block, "name").as_deref() != Some(hit.name.as_str())
-                    || quoted_field(&block, "version").as_deref() != Some(hit.version.as_str())
-                {
-                    continue;
-                }
-                let rebuilt: Vec<String> = block
-                    .split('\n')
-                    .map(|l| {
-                        if l.starts_with("source = ") {
-                            format!("source = \"{CRATES_IO_SOURCE}\"")
-                        } else if l.starts_with("checksum = ") {
-                            format!("checksum = \"{cksum}\"")
-                        } else {
-                            l.to_string()
-                        }
-                    })
-                    .collect();
-                lock.replace_range(start..end, &rebuilt.join("\n"));
-                from = start + 1;
+            restored.push((hit, cksum));
+        }
+        // The entries' own source + checksum values, spliced at the parse's
+        // spans (every hit is a distinct block: its source names its uuid).
+        let spans = model.spans().expect("a lock parsed from text carries spans");
+        let mut splices: Vec<(std::ops::Range<usize>, String)> = Vec::new();
+        for (hit, cksum) in &restored {
+            let at = &spans.packages[hit.index];
+            if let Some(source) = &at.source {
+                splices.push((source.clone(), format!("\"{CRATES_IO_SOURCE}\"")));
             }
+            if let Some(checksum) = &at.checksum {
+                splices.push((checksum.clone(), format!("\"{cksum}\"")));
+            }
+        }
+        splices.sort_by_key(|(r, _)| std::cmp::Reverse(r.start));
+        for (range, with) in splices {
+            lock.replace_range(range, &with);
+        }
+        for (hit, cksum) in &restored {
             // Dependents' full-id references and the v1 `[metadata]` key.
             lock = lock.replace(&format!("({})", hit.source), &format!("({CRATES_IO_SOURCE})"));
             let metadata_key = format!(
diff --git a/crates/socket-patch-core/src/patch/redirect/upstream/client.rs b/crates/socket-patch-core/src/patch/redirect/upstream/client.rs
index 5be77710..ffa47b9f 100644
--- a/crates/socket-patch-core/src/patch/redirect/upstream/client.rs
+++ b/crates/socket-patch-core/src/patch/redirect/upstream/client.rs
@@ -388,7 +388,7 @@ impl UpstreamClient {
             if self.offline {
                 return Err(OFFLINE.to_string());
             }
-            if !crate::vendor::gemfile_lock::is_plain_gem_token(name) {
+            if !crate::formats::gem::is_plain_gem_token(name) {
                 return Err(format!("{name:?} is not a plain gem name"));
             }
             let url = format!("{}/info/{name}", rubygems_base());
diff --git a/crates/socket-patch-core/src/patch/redirect/upstream/composer.rs b/crates/socket-patch-core/src/patch/redirect/upstream/composer.rs
index 52e6b8c4..b804342c 100644
--- a/crates/socket-patch-core/src/patch/redirect/upstream/composer.rs
+++ b/crates/socket-patch-core/src/patch/redirect/upstream/composer.rs
@@ -27,7 +27,9 @@ use std::collections::BTreeMap;
 
 use serde_json::Value;
 
-use super::super::{find_composer_entry, json_object_end_from, json_string_field, ComposerEntry};
+use crate::formats::composer::hosted::{
+    find_composer_entry, json_object_end_from, json_string_field, ComposerEntry,
+};
 use super::{Ctx, FormatResult, HostedPin, View};
 use crate::crawlers::composer_crawler::normalize_version;
 
diff --git a/crates/socket-patch-core/src/patch/redirect/upstream/gem.rs b/crates/socket-patch-core/src/patch/redirect/upstream/gem.rs
index cae1d699..e42e183c 100644
--- a/crates/socket-patch-core/src/patch/redirect/upstream/gem.rs
+++ b/crates/socket-patch-core/src/patch/redirect/upstream/gem.rs
@@ -58,7 +58,7 @@ use regex::Regex;
 use super::{Ctx, FormatResult, HostedPin, View};
 use crate::utils::line_endings::{to_lf, LineEndings};
 use crate::vendor::gem::{gem_declaration_any, quoted_literal};
-use crate::vendor::gemfile_lock::{
+use crate::formats::gem::{
     bundler_manifest_for, parse_spec, same_remote, split_checksum_entry, BUNDLER_LOCKS,
 };
 
diff --git a/crates/socket-patch-core/src/patch/redirect/upstream/maven.rs b/crates/socket-patch-core/src/patch/redirect/upstream/maven.rs
index 35166b00..7b90cbde 100644
--- a/crates/socket-patch-core/src/patch/redirect/upstream/maven.rs
+++ b/crates/socket-patch-core/src/patch/redirect/upstream/maven.rs
@@ -318,7 +318,7 @@ pub(crate) async fn restore(
         if restored.is_empty() {
             continue;
         }
-        if let Err(why) = crate::vendor::maven_pom::parse_pom(&text) {
+        if let Err(why) = crate::formats::maven::parse_pom(&text) {
             refuse_all_in(
                 &pins,
                 rel,
@@ -382,7 +382,7 @@ async fn restore_mvn(
     let other_hosted = rest.lines().any(|l| {
         path_of(l).is_some_and(|p| {
             p.split('/')
-                .any(|seg| crate::vendor::maven_pom::split_socket_version(seg).is_some())
+                .any(|seg| crate::formats::maven::split_socket_version(seg).is_some())
         })
     });
     if has_resolver_lines && !other_hosted {
diff --git a/crates/socket-patch-core/src/patch/redirect/upstream/npm.rs b/crates/socket-patch-core/src/patch/redirect/upstream/npm.rs
index d7a0a2d9..8bcb5d10 100644
--- a/crates/socket-patch-core/src/patch/redirect/upstream/npm.rs
+++ b/crates/socket-patch-core/src/patch/redirect/upstream/npm.rs
@@ -466,7 +466,7 @@ pub(crate) async fn restore_pnpm_locks(
     files: &[String],
     ctx: &Ctx<'_>,
 ) -> FormatResult {
-    use super::super::pnpm;
+    use crate::formats::pnpm::grammar as pnpm;
 
     let mut result = FormatResult::default();
     let pins = by_uuid(pins);
diff --git a/crates/socket-patch-core/src/patch/redirect/upstream/nuget.rs b/crates/socket-patch-core/src/patch/redirect/upstream/nuget.rs
index 77b5a2eb..3531f7d0 100644
--- a/crates/socket-patch-core/src/patch/redirect/upstream/nuget.rs
+++ b/crates/socket-patch-core/src/patch/redirect/upstream/nuget.rs
@@ -23,7 +23,7 @@ use serde_json::Value;
 
 use super::npm::{by_uuid, read_or_refuse, refuse_all_in};
 use super::{Ctx, FormatResult, HostedPin, View};
-use crate::vendor::nuget_config::{parse_config, NugetConfig};
+use crate::formats::nuget::{parse_config, NugetConfig};
 use crate::vendor::nuget_feed::normalize_nuget_version;
 
 const PACKAGES_LOCK: &str = "packages.lock.json";
diff --git a/crates/socket-patch-core/src/vendor/bun_lock.rs b/crates/socket-patch-core/src/vendor/bun_lock.rs
index 71643202..161d7b22 100644
--- a/crates/socket-patch-core/src/vendor/bun_lock.rs
+++ b/crates/socket-patch-core/src/vendor/bun_lock.rs
@@ -37,13 +37,14 @@ use serde_json::Value;
 use sha2::{Digest, Sha512};
 
 use crate::constants::SOCKET_DIR;
+use crate::formats::bun::{BunTextError, BunTextLock};
 use crate::manifest::schema::PatchRecord;
 use crate::patch::apply::PatchSources;
 use crate::utils::fs::{atomic_write_bytes_preserving_mode, read_regular_to_string};
 use crate::utils::socket_dir::remove_tree_and_prune;
 use crate::vendor::bun_lock_text::{
-    check_lock_version, decode_json_string, has_workspace_packages, lock_version, packages_bounds,
-    parse_entry_line, parse_packages_section, split_name_spec, BunEntry,
+    decode_json_string, has_workspace_packages, lock_version, packages_bounds,
+    parse_entry_line, split_name_spec, BunEntry,
 };
 
 use super::common::{already_patched_result, refused};
@@ -216,10 +217,9 @@ pub async fn preflight_vendor(project_root: &Path) -> Result<(), (&'static str,
         }
         Err(error) => return Err(("vendor_lockfile_missing", error.to_string())),
     };
-    check_lock_version(&text).map_err(|detail| ("vendor_lockfile_version_unsupported", detail))?;
-    let lines = text.split('\n').map(str::to_string).collect::<Vec<_>>();
-    let entries = parse_packages_section(&lines)
-        .map_err(|detail| ("vendor_lockfile_version_unsupported", detail))?;
+    let entries = BunTextLock::parse(&text)
+        .map_err(|e| ("vendor_lockfile_version_unsupported", e.detail()))?
+        .entries;
     check_workspace_compatibility(&text, &entries)
 }
 
@@ -288,10 +288,9 @@ pub async fn wired_instances_all_ours(
         }
         Err(error) => return Err(("vendor_lockfile_missing", error.to_string())),
     };
-    check_lock_version(&text).map_err(|detail| ("vendor_lockfile_version_unsupported", detail))?;
-    let lines = text.split('\n').map(str::to_string).collect::<Vec<_>>();
-    let entries = parse_packages_section(&lines)
-        .map_err(|detail| ("vendor_lockfile_version_unsupported", detail))?;
+    let entries = BunTextLock::parse(&text)
+        .map_err(|e| ("vendor_lockfile_version_unsupported", e.detail()))?
+        .entries;
     let target_spec = format!("{name}@{version}");
     let target_leaf = tgz_rel_leaf(&name, &version);
     let mut matched = 0usize;
@@ -659,16 +658,15 @@ pub(super) async fn read_project(project_root: &Path) -> Result<BunProject, Box<
             )));
         }
     };
-    if let Err(detail) = check_lock_version(&lock_text) {
-        return Err(Box::new(refused(
-            "vendor_lockfile_version_unsupported",
-            detail,
-        )));
-    }
-    let lines: Vec<String> = lock_text.split('\n').map(str::to_string).collect();
-    let entries = match parse_packages_section(&lines) {
-        Ok(entries) => entries,
-        Err(detail) => {
+    let (lines, entries) = match BunTextLock::parse(&lock_text) {
+        Ok(lock) => (lock.lines, lock.entries),
+        Err(BunTextError::Version(detail)) => {
+            return Err(Box::new(refused(
+                "vendor_lockfile_version_unsupported",
+                detail,
+            )));
+        }
+        Err(BunTextError::Packages(detail)) => {
             // SECURITY/fail-closed: never line-splice a lock whose packages
             // section does not match the pinned single-line grammar.
             return Err(Box::new(refused(
diff --git a/crates/socket-patch-core/src/vendor/cargo_lock.rs b/crates/socket-patch-core/src/vendor/cargo_lock.rs
index 2a800d93..7e50bcca 100644
--- a/crates/socket-patch-core/src/vendor/cargo_lock.rs
+++ b/crates/socket-patch-core/src/vendor/cargo_lock.rs
@@ -64,6 +64,9 @@ use std::sync::Arc;
 use toml_edit::{DocumentMut, Item, Table};
 
 use super::cargo_tag;
+use crate::formats::cargo::{
+    locked_packages, metadata_checksum_key, parse_ref, LockedPackage,
+};
 use super::parse_memo::ParseMemo;
 use super::state::CargoLockOriginal;
 use crate::utils::fs::{atomic_write_bytes_preserving_mode, read_regular_to_string};
@@ -211,170 +214,6 @@ fn set_version(table: &mut Table, version: &str) {
     }
 }
 
-/// The `[metadata]` key a v1 lock files `name`+`version`'s checksum under.
-fn metadata_checksum_key(name: &str, version: &str, source: &str) -> String {
-    format!("checksum {name} {version} ({source})")
-}
-
-/// One `[[package]]` of a parsed `Cargo.lock`, as cargo resolves it — the
-/// read model every Cargo.lock reader shares (the lock inventory, the vendor
-/// probes below, lockfile discovery), so a v1 lock's `[metadata]` checksums
-/// and a missing `source` read the same everywhere.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub(crate) struct LockedPackage {
-    pub(crate) name: String,
-    pub(crate) version: String,
-    /// `None` for a workspace member, a path dependency, or a `[patch]` path
-    /// copy (the vendored "detached" shape).
-    pub(crate) source: Option<String>,
-    /// The inline `checksum` (v2+), else a v1 lock's `[metadata]`
-    /// `"checksum <name> <version> (<source>)"` entry — the same pin.
-    pub(crate) checksum: Option<String>,
-}
-
-/// Every `[[package]]` of `doc` (lock formats v1–v4), in lock order; an
-/// entry without a string `name` and `version` is skipped. A lock with no
-/// packages has no `package` key and yields nothing.
-pub(crate) fn locked_packages(doc: &DocumentMut) -> Vec<LockedPackage> {
-    let metadata = doc.get("metadata").and_then(Item::as_table_like);
-    let metadata_checksum = |name: &str, version: &str, source: Option<&str>| {
-        let key = metadata_checksum_key(name, version, source?);
-        metadata?.get(&key)?.as_str().map(str::to_string)
-    };
-    doc.get("package")
-        .and_then(Item::as_array_of_tables)
-        .map(|pkgs| {
-            pkgs.iter()
-                .filter_map(|t| {
-                    let name = t.get("name")?.as_str()?.to_string();
-                    let version = t.get("version")?.as_str()?.to_string();
-                    let source = t.get("source").and_then(Item::as_str).map(str::to_string);
-                    let checksum = t
-                        .get("checksum")
-                        .and_then(Item::as_str)
-                        .map(str::to_string)
-                        .or_else(|| metadata_checksum(&name, &version, source.as_deref()));
-                    Some(LockedPackage {
-                        name,
-                        version,
-                        source,
-                        checksum,
-                    })
-                })
-                .collect()
-        })
-        .unwrap_or_default()
-}
-
-/// `(name, version)` of every `[[patch.unused]]` entry: a `[patch]` cargo
-/// resolved and then did NOT use in the crate graph — the lock's own record
-/// that a patch (e.g. a vendored copy) is not what builds.
-pub(crate) fn unused_patches(doc: &DocumentMut) -> Vec<(String, String)> {
-    doc.get("patch")
-        .and_then(|patch| patch.get("unused"))
-        .and_then(Item::as_array_of_tables)
-        .map(|entries| {
-            entries
-                .iter()
-                .filter_map(|t| {
-                    Some((
-                        t.get("name")?.as_str()?.to_string(),
-                        t.get("version")?.as_str()?.to_string(),
-                    ))
-                })
-                .collect()
-        })
-        .unwrap_or_default()
-}
-
-/// How `Cargo.lock` relates to the `[patch]` path copy of `name`@`version`
-/// vendored for patch `uuid` ([`vendored_copy_claim`]).
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub(crate) enum CopyClaim<'a> {
-    /// The lock builds this copy.
-    Consumed,
-    /// The lock builds the copy tagged for ANOTHER patch uuid (and none
-    /// tagged for this one): a stale lock, or a `[patch]` override
-    /// elsewhere.
-    OtherTag(&'a str),
-    /// The copy is tagged, but the lock holds only UNTAGGED sourceless
-    /// entries: cargo built some other untagged crate (a config-level
-    /// override, a user path dependency), never this copy.
-    UntaggedOverride,
-    /// No sourceless entry for it, or cargo recorded the patch as
-    /// `[[patch.unused]]`.
-    NotConsumed,
-}
-
-/// Whether the lock BUILDS the `[patch]` path copy of `name`@`version`
-/// vendored for patch `uuid`. `copy_tagged`: the copy's own `Cargo.toml`
-/// carries a Socket version tag (every copy vendored since tagged
-/// versions; `false` for a copy vendored before them, or none on disk).
-///
-/// * a SOURCELESS entry at the tagged version `<version>+socket.<uuid>`
-///   (and no `[[patch.unused]]` for it) is this copy — whatever untagged
-///   sourceless siblings exist (real cargo 1.97 locks a member's own path
-///   dependency on a same-version fork beside the tagged copy);
-/// * otherwise a sourceless entry tagged for ANOTHER uuid is another
-///   copy's resolution → [`CopyClaim::OtherTag`], even beside an untagged
-///   sibling;
-/// * an UNTAGGED sourceless entry is the pre-tag legacy shape only while
-///   the copy is untagged too: cargo locks a tagged copy at its tagged
-///   version, so for a tagged copy the untagged entry is something else
-///   cargo built → [`CopyClaim::UntaggedOverride`].
-///
-/// A sourceless entry alone does not prove the copy builds — a path
-/// dependency on the user's own checkout of the crate is sourceless too,
-/// and cargo records the `[patch]` it resolved but left out of the graph as
-/// `[[patch.unused]]` (real cargo 1.97: `serde = { path = "my-serde" }`
-/// beside a stale `[patch]` locks a sourceless serde AND
-/// `[[patch.unused]] serde`).
-pub(crate) fn vendored_copy_claim<'a>(
-    pkgs: &'a [LockedPackage],
-    unused: &[(String, String)],
-    name: &str,
-    version: &str,
-    uuid: &str,
-    copy_tagged: bool,
-) -> CopyClaim<'a> {
-    let mut own = false;
-    let mut other: Option<&'a str> = None;
-    let mut untagged = false;
-    for p in pkgs
-        .iter()
-        .filter(|p| p.name == name && p.source.is_none() && cargo_tag::denotes(&p.version, version))
-    {
-        match cargo_tag::tag_uuid(&p.version) {
-            Some(tag) if tag == uuid => own = true,
-            Some(tag) => {
-                other.get_or_insert(tag);
-            }
-            None => untagged = true,
-        }
-    }
-    let unused_hit = unused
-        .iter()
-        .any(|(n, v)| n == name && cargo_tag::denotes(v, version));
-    if own {
-        return if unused_hit {
-            CopyClaim::NotConsumed
-        } else {
-            CopyClaim::Consumed
-        };
-    }
-    if let Some(tag) = other {
-        return CopyClaim::OtherTag(tag);
-    }
-    if !untagged || unused_hit {
-        return CopyClaim::NotConsumed;
-    }
-    if copy_tagged {
-        CopyClaim::UntaggedOverride
-    } else {
-        CopyClaim::Consumed
-    }
-}
-
 /// A v1 lock: no top-level `version` key and a `[metadata]` table (kept,
 /// even emptied, by [`detach_lock_entry`] — so a detached v1 lock still
 /// reads as v1 on restore).
@@ -406,19 +245,6 @@ fn dependency_tables_mut(doc: &mut DocumentMut) -> Vec<&mut Table> {
     out
 }
 
-/// `(name, version, source)` of a dependency reference string
-/// (`"name"`, `"name version"`, `"name version (source)"`).
-fn parse_ref(spelled: &str) -> (&str, Option<&str>, Option<&str>) {
-    let mut parts = spelled.splitn(3, ' ');
-    let name = parts.next().unwrap_or_default();
-    let version = parts.next();
-    let source = parts
-        .next()
-        .and_then(|s| s.strip_prefix('('))
-        .and_then(|s| s.strip_suffix(')'));
-    (name, version, source)
-}
-
 /// Rewrite every dependency reference to `name` at exactly `version` —
 /// `"name version"`, or `"name version (source)"` when `source` is given —
 /// to `to`, keeping each entry's formatting.
@@ -949,6 +775,7 @@ async fn count_lock_entries_unmemoized(project_root: &Path, name: &str, version:
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::formats::cargo::{vendored_copy_claim, CopyClaim};
 
     const SOURCE: &str = "registry+https://github.com/rust-lang/crates.io-index";
     const CHECKSUM: &str = "9d8f4e3bd2c8f1f5d1a3f5e7c9b1d3f5e7a9b1c3d5f7e9a1b3c5d7e9f1a3b5c7";
@@ -2065,6 +1892,7 @@ mod tests {
             version: version.into(),
             source: source.map(str::to_string),
             checksum: None,
+            dependencies: Vec::new(),
         };
         let tagged = format!("1.0.4+socket.{UUID}");
         let other = format!("1.0.4+socket.{UUID2}");
diff --git a/crates/socket-patch-core/src/vendor/composer_lock.rs b/crates/socket-patch-core/src/vendor/composer_lock.rs
index c2119f6d..58a575dd 100644
--- a/crates/socket-patch-core/src/vendor/composer_lock.rs
+++ b/crates/socket-patch-core/src/vendor/composer_lock.rs
@@ -50,7 +50,7 @@ use super::common::{
     prune_empty_vendor_levels, refused, serialize_json, service_offline_conflict, stage_dir_for,
     swap_stage_into_place, synthesized_result,
 };
-use super::lock_inventory::{composer_lock_packages, ComposerLockPackage};
+use crate::formats::composer::{composer_lock_packages, ComposerLockPackage};
 use super::parse_memo::ParseMemo;
 use super::path::{parse_vendor_path, vendor_uuid_dir_rel};
 use super::registry_fetch::{extract_on_blocking_pool, extract_zip};
@@ -905,29 +905,21 @@ fn find_lock_entry(lock: &Value, pkg_lc: &str, version: &str) -> Option<(&'stati
 }
 
 /// The index in `lock[section]` of the FIRST entry named `pkg` (any case),
-/// if its dist is still [`wired_to`] `uuid`. The ownership gate of a restore:
+/// if its dist is still [`ComposerLockPackage::wired_to`] `uuid`. The ownership gate of a restore:
 /// a registry dist (composer update reverted it) or a different uuid (a
 /// newer vendor run owns the entry) is third-party state — never clobber it.
 fn wired_entry_index(lock: &Value, section: &str, pkg: &str, uuid: &str) -> Option<usize> {
     composer_lock_packages(lock)
         .into_iter()
         .find(|p| p.section == section && p.name.is_some_and(|n| n.eq_ignore_ascii_case(pkg)))
-        .filter(|p| wired_to(p, uuid))
+        .filter(|p| p.wired_to(uuid))
         .map(|p| p.index)
 }
 
-/// Whether the entry's `dist.url` points into patch `uuid`'s vendored
-/// composer copy — the ownership gate every restore / strand check applies.
-fn wired_to(pkg: &ComposerLockPackage<'_>, uuid: &str) -> bool {
-    pkg.dist_vendor_path()
-        .is_some_and(|p| p.eco == "composer" && p.uuid == uuid)
-}
-
 /// True when the live entry already carries our path dist.
 fn entry_is_wired(entry: &Value, dist_url: &str) -> bool {
-    let dist = entry.get("dist");
-    dist.and_then(|d| d.get("type")).and_then(Value::as_str) == Some("path")
-        && dist.and_then(|d| d.get("url")).and_then(Value::as_str) == Some(dist_url)
+    let pkg = ComposerLockPackage::of("packages", 0, entry);
+    pkg.dist_str("type") == Some("path") && pkg.dist_str("url") == Some(dist_url)
 }
 
 /// Rebuild the lock entry for the path dist (see module doc): every original
@@ -1019,7 +1011,7 @@ async fn stranded_wired_packages(
 fn stranded_in(lock: &Value, uuid: &str, restorable: &HashSet<String>) -> Vec<String> {
     let mut out: Vec<String> = Vec::new();
     for pkg in composer_lock_packages(lock) {
-        let Some(name) = pkg.name.filter(|_| wired_to(&pkg, uuid)) else {
+        let Some(name) = pkg.name.filter(|_| pkg.wired_to(uuid)) else {
             continue;
         };
         let name = name.to_lowercase();
diff --git a/crates/socket-patch-core/src/vendor/gem.rs b/crates/socket-patch-core/src/vendor/gem.rs
index 162a05fd..2d5dd4ef 100644
--- a/crates/socket-patch-core/src/vendor/gem.rs
+++ b/crates/socket-patch-core/src/vendor/gem.rs
@@ -70,7 +70,7 @@ use super::common::{
     prune_empty_vendor_levels, refused, service_offline_conflict, stage_dir_for,
     swap_stage_into_place, synthesized_result,
 };
-use super::gemfile_lock::{is_plain_gem_token, split_checksum_entry, split_entry};
+use crate::formats::gem::{is_plain_gem_token, split_checksum_entry, split_entry};
 use super::path::{parse_vendor_path, vendor_uuid_dir_rel};
 use super::registry_fetch::{extract_gem_data, extract_on_blocking_pool};
 use super::service_fetch::{
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/bun.rs b/crates/socket-patch-core/src/vendor/lock_inventory/bun.rs
index bbb20df1..f1c26c85 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/bun.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/bun.rs
@@ -3,6 +3,7 @@
 use std::path::Path;
 
 use crate::constants::npm_family::{BUN_LOCK, BUN_LOCKB};
+use crate::formats::bun::{BunTextError, BunTextLock};
 use crate::vendor::bun_lock_text::{self, BunEntry};
 use crate::vendor::bun_lockb::BunLockb;
 
@@ -18,9 +19,11 @@ use super::{http_url, LockIntegrity, LockfileEntry, UnsupportedNpmLayout};
 /// lock the backends refuse — a hand re-indented one included — is one
 /// neither the inventory nor lockfile discovery reads.
 pub(crate) fn bun_text_entries(text: &str) -> Result<Vec<BunEntry>, String> {
-    bun_lock_text::check_lock_version(text)?;
-    let lines: Vec<String> = text.split('\n').map(str::to_string).collect();
-    bun_lock_text::parse_packages_section(&lines).map_err(|e| format!("{BUN_LOCK}: {e}"))
+    match BunTextLock::parse(text) {
+        Ok(lock) => Ok(lock.entries),
+        Err(BunTextError::Version(detail)) => Err(detail),
+        Err(BunTextError::Packages(e)) => Err(format!("{BUN_LOCK}: {e}")),
+    }
 }
 
 // ── file selection ──
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/cargo.rs b/crates/socket-patch-core/src/vendor/lock_inventory/cargo.rs
index f334b46e..37caa503 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/cargo.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/cargo.rs
@@ -3,17 +3,16 @@
 #[cfg(test)]
 use std::path::Path;
 
-use crate::utils::digest::is_hex;
-use crate::utils::purl::simple_purl;
+use crate::formats::cargo::CargoLock;
 
 use super::view::ProjectView;
-use super::{dedup_prefer_integrity, LockIntegrity, LockfileEntry, SourceKind};
+use super::{dedup_prefer_integrity, LockfileEntry};
 
 // ── registry view ──
 
-/// Inventory `Cargo.lock` `[[package]]` entries, read through the vendor
-/// backend's lock model ([`crate::vendor::cargo_lock::locked_packages`]; a v1 lock's
-/// `[metadata]` checksums included). Only crates.io-sourced entries are
+/// Inventory `Cargo.lock` `[[package]]` entries, read through the
+/// format's model ([`CargoLock::entries`]; a v1 lock's `[metadata]`
+/// checksums included). Only crates.io-sourced entries are
 /// fetchable (their `checksum` is the sha256 of the `.crate` file);
 /// workspace members and vendored copies (no `source`; a vendored copy's
 /// version carries the `+socket.<uuid>` tag, see `vendor::cargo_tag`) are
@@ -52,35 +51,5 @@ pub(super) async fn inventory_cargo_lock_raw_in(
             std::sync::Arc::new(view.read_text("Cargo.lock").await.ok()?.parse().ok()?)
         }
     };
-    let mut out = Vec::new();
-    for pkg in crate::vendor::cargo_lock::locked_packages(&doc) {
-        let Some(source) = pkg.source else {
-            continue; // workspace member
-        };
-        let version = crate::vendor::cargo_tag::strip_tag(&pkg.version).to_string();
-        let tagged = version != pkg.version;
-        let Some(purl) = simple_purl("cargo", &pkg.name, &version) else {
-            continue;
-        };
-        let crates_io = source.contains("github.com/rust-lang/crates.io-index")
-            || source.contains("index.crates.io");
-        // The crates.io provenance is recorded exactly where the checksum is
-        // kept as the `.crate`'s sha256.
-        let (integrity, source_kind) = match pkg.checksum {
-            Some(c) if crates_io && !tagged && is_hex(&c, 64) => {
-                (LockIntegrity::Sha256Hex(c), SourceKind::CratesIo)
-            }
-            _ => (LockIntegrity::None, SourceKind::Unspecified),
-        };
-        out.push(LockfileEntry {
-            ecosystem: "cargo",
-            source_kind,
-            purl,
-            name: pkg.name,
-            version,
-            resolved: None,
-            integrity,
-        });
-    }
-    Some(out)
+    Some(CargoLock::from_doc(&doc).entries())
 }
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/composer.rs b/crates/socket-patch-core/src/vendor/lock_inventory/composer.rs
index 25227762..207f5088 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/composer.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/composer.rs
@@ -1,85 +1,15 @@
-//! `composer.lock`: the shared entry walk ([`composer_lock_packages`]) and
-//! its registry view.
+//! `composer.lock`: the registry view, read through the format's model
+//! ([`ComposerLock`]).
 
 #[cfg(test)]
 use std::path::Path;
 
 use serde_json::Value;
 
-use crate::crawlers::composer_crawler::normalize_version;
-use crate::patch::path_safety;
-use crate::utils::digest::sha1_hex;
-use crate::vendor::path::{parse_vendor_path, VendorPathParts};
+use crate::formats::composer::ComposerLock;
 
 use super::view::ProjectView;
-use super::{dedup_prefer_integrity, http_url, LockIntegrity, LockfileEntry, SourceKind};
-
-// ── entry model ──
-
-/// One entry of a parsed `composer.lock` (see [`composer_lock_packages`]).
-pub(crate) struct ComposerLockPackage<'a> {
-    /// `packages` or `packages-dev`.
-    pub(crate) section: &'static str,
-    /// The position in the section ARRAY, counting non-object elements too:
-    /// what a writer indexes `lock[section][index]` with.
-    pub(crate) index: usize,
-    pub(crate) name: Option<&'a str>,
-    /// As locked — the pretty `v`-prefixed spelling; callers normalize
-    /// through [`normalize_version`].
-    pub(crate) version: Option<&'a str>,
-    /// The `dist` object: what composer's default `--prefer-dist` install
-    /// consumes, and the block both backends rewrite.
-    pub(crate) dist: Option<&'a Value>,
-}
-
-impl ComposerLockPackage<'_> {
-    /// A string field of the entry's `dist`.
-    pub(crate) fn dist_str(&self, key: &str) -> Option<&str> {
-        self.dist?.get(key)?.as_str()
-    }
-
-    /// The `dist.shasum` pin: a 40-hex sha1 of the dist archive (any case,
-    /// lowercased), whatever the dist `type` — the inventory additionally
-    /// requires a `zip` dist at its call site.
-    pub(crate) fn dist_sha1(&self) -> Option<LockIntegrity> {
-        self.dist_str("shasum")
-            .and_then(sha1_hex)
-            .map(LockIntegrity::Sha1Hex)
-    }
-
-    /// The Socket-vendored path `dist.url` names, anchored anywhere
-    /// ([`parse_vendor_path`]: the writers' ownership rule, not discovery's
-    /// root-anchored attestation grammar).
-    pub(crate) fn dist_vendor_path(&self) -> Option<VendorPathParts> {
-        self.dist_str("url").and_then(parse_vendor_path)
-    }
-}
-
-/// Every entry composer installs from a parsed `composer.lock`, in lock
-/// order: `packages`, then `packages-dev` (composer installs both by
-/// default; a missing or non-array section is empty). The one walk the
-/// inventory and lockfile discovery (`vex::discover::composer`) share.
-pub(crate) fn composer_lock_packages(doc: &Value) -> Vec<ComposerLockPackage<'_>> {
-    let mut out = Vec::new();
-    for section in ["packages", "packages-dev"] {
-        for (index, pkg) in doc
-            .get(section)
-            .and_then(Value::as_array)
-            .into_iter()
-            .flatten()
-            .enumerate()
-        {
-            out.push(ComposerLockPackage {
-                section,
-                index,
-                name: pkg.get("name").and_then(Value::as_str),
-                version: pkg.get("version").and_then(Value::as_str),
-                dist: pkg.get("dist"),
-            });
-        }
-    }
-    out
-}
+use super::{dedup_prefer_integrity, LockfileEntry};
 
 // ── registry view ──
 
@@ -109,44 +39,5 @@ pub(super) async fn inventory_composer_lock_raw_in(
 ) -> Option<Vec<LockfileEntry>> {
     let bytes = view.read_bytes("composer.lock").await.ok()?;
     let doc: Value = serde_json::from_slice(&bytes).ok()?;
-    let mut out = Vec::new();
-    for pkg in composer_lock_packages(&doc) {
-        let (Some(name), Some(version)) = (pkg.name, pkg.version) else {
-            continue;
-        };
-        let name = name.to_ascii_lowercase();
-        // Share the crawler's normalization rather than re-deriving it:
-        // it strips `v` AND `V` (both are legal Composer tags), and a
-        // lockfile row that normalizes differently from the installed
-        // row double-counts the package — one installed `@1.2.3` plus a
-        // phantom lockfile-only `@V1.2.3`, both POSTed.
-        let version = normalize_version(version).to_string();
-        if !path_safety::is_safe_multi_segment(&name)
-            || name.split('/').count() != 2
-            || !path_safety::is_safe_single_segment(&version)
-        {
-            continue;
-        }
-        // Our own vendored entries use a path dist — skip.
-        if pkg.dist_str("type") == Some("path") || pkg.dist_vendor_path().is_some() {
-            continue;
-        }
-        let dist_url = pkg.dist_str("url").unwrap_or("");
-        let is_zip = pkg.dist_str("type") == Some("zip");
-        let integrity = match pkg.dist_sha1() {
-            Some(sha1) if is_zip => sha1,
-            _ => LockIntegrity::None,
-        };
-        let purl = format!("pkg:composer/{name}@{version}");
-        out.push(LockfileEntry {
-            ecosystem: "composer",
-            source_kind: SourceKind::Unspecified,
-            name,
-            version,
-            purl,
-            resolved: is_zip.then(|| http_url(dist_url)).flatten(),
-            integrity,
-        });
-    }
-    Some(out)
+    Some(ComposerLock::from_doc(&doc).entries())
 }
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/gem.rs b/crates/socket-patch-core/src/vendor/lock_inventory/gem.rs
index 61643eba..72543adc 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/gem.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/gem.rs
@@ -3,12 +3,12 @@
 
 use std::path::Path;
 
+pub(super) use crate::formats::gem::gem_download_url;
+use crate::formats::gem::GemfileLock;
 use crate::utils::fs::read_regular_to_string;
-use crate::utils::purl::simple_purl;
-use crate::vendor::gemfile_lock::{self, Section};
 
 use super::view::ProjectView;
-use super::{dedup_prefer_integrity, http_url, LockIntegrity, LockfileEntry, SourceKind};
+use super::{dedup_prefer_integrity, LockfileEntry};
 
 // ── registry view ──
 
@@ -50,52 +50,7 @@ pub(super) async fn inventory_gemfile_lock_raw_in(
     // The shared lock model (lockfile discovery reads it too); what bundler
     // would refuse (`problems`) still inventories whatever parsed — this is
     // read-only discovery.
-    let lock = gemfile_lock::parse(&text);
-    let gem_sections: Vec<&Section<'_>> = lock.gem_sections().collect();
-    let mut out = Vec::new();
-    for section in &gem_sections {
-        let remotes: Vec<&str> = section.remote_bases().collect();
-        for spec in section.specs.iter().filter_map(|line| line.parsed) {
-            if spec.platform.is_some() {
-                continue;
-            }
-            let Some(purl) = simple_purl("gem", spec.name, spec.version) else {
-                continue;
-            };
-            let (name, version) = (spec.name, spec.version);
-            let integrity = lock.integrity(name, version).unwrap_or(LockIntegrity::None);
-            let resolved = match remotes.as_slice() {
-                [base] => gem_download_url(base, name, version),
-                // No remote (a missing `remote:` line defaults to rubygems.org
-                // ONLY when the whole lock has one remote-less GEM section —
-                // the pre-multisource shape) or several remotes: fail closed.
-                [] if gem_sections.len() == 1 => {
-                    gem_download_url("https://rubygems.org", name, version)
-                }
-                _ => None,
-            };
-            out.push(LockfileEntry {
-                ecosystem: "gem",
-                source_kind: SourceKind::Unspecified,
-                purl,
-                resolved,
-                name: name.to_string(),
-                version: version.to_string(),
-                integrity,
-            });
-        }
-    }
-    if out.is_empty() {
-        return None;
-    }
-    Some(out)
-}
-
-/// Where a rubygems-compatible registry at `base` (no trailing `/`) serves
-/// `name`-`version`'s `.gem` — the inventory's resolved URL and ledger
-/// recovery's fetch URL. `None` for a non-http(s) base.
-pub(super) fn gem_download_url(base: &str, name: &str, version: &str) -> Option<String> {
-    http_url(&format!("{base}/downloads/{name}-{version}.gem"))
+    GemfileLock::parse(&text).entries()
 }
 
 /// The DISTINCT `GEM remote:` bases across ALL GEM sections of the
@@ -113,8 +68,8 @@ pub(super) async fn gem_remotes(project_root: &Path) -> Vec<String> {
     let Ok(text) = read_regular_to_string(&project_root.join("Gemfile.lock")).await else {
         return Vec::new();
     };
-    let lock = gemfile_lock::parse(&text);
-    lock.gem_remote_bases()
+    GemfileLock::parse(&text)
+        .gem_remote_bases()
         .into_iter()
         .map(str::to_string)
         .collect()
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/mod.rs b/crates/socket-patch-core/src/vendor/lock_inventory/mod.rs
index 15330b99..1cacfe2e 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/mod.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/mod.rs
@@ -36,7 +36,7 @@
 //!    [`inventory_project_every_lock`] unions for ledger liveness).
 //!
 //! Formats whose reader a writer already owns keep the model there
-//! (`cargo_lock::locked_packages`, `gemfile_lock`, `utils::python_lock` /
+//! (`formats::cargo`, `formats::gem`, `utils::python_lock` /
 //! `poetry_lock`, `utils::requirements`), and only the registry view lives
 //! here. [`LockfileEntry::source_kind`] carries provenance a view knows
 //! positively (crates.io), which ledger liveness reads instead of inferring
@@ -70,11 +70,9 @@ pub mod view;
 pub(crate) mod wired;
 pub(crate) mod yarn;
 
-pub(crate) use self::composer::{composer_lock_packages, ComposerLockPackage};
 pub(crate) use self::npm::{npm_lock_nodes, NpmLockNode};
 #[cfg(test)]
 pub(crate) use self::npm_family::inventory_npm_lock;
-pub(crate) use self::pnpm::pnpm_registry_key;
 pub(crate) use self::pypi::pipfile_lock_entries;
 pub use self::recover::recover_lock_entry;
 pub use self::view::{MemoryEntry, MemoryProject, ProjectView};
@@ -173,7 +171,7 @@ pub struct LockfileEntry {
 }
 
 impl LockfileEntry {
-    fn npm(
+    pub(crate) fn npm(
         name: impl Into<String>,
         version: impl Into<String>,
         resolved: Option<String>,
@@ -364,7 +362,7 @@ fn dedup_prefer_integrity(raw: Vec<LockfileEntry>) -> Vec<LockfileEntry> {
 /// (drops `git+…`, `file:…`, `link:…` — content the registry conventions
 /// cannot reproduce; such entries stay listed for discovery but the fetch
 /// layer's integrity rule decides fetchability).
-fn http_url(raw: &str) -> Option<String> {
+pub(crate) fn http_url(raw: &str) -> Option<String> {
     (raw.starts_with("https://") || raw.starts_with("http://")).then(|| raw.to_string())
 }
 
@@ -374,8 +372,8 @@ fn http_url(raw: &str) -> Option<String> {
 /// `// ── file selection ──` (stat / list only, never a content read), and
 /// `// ── registry view ──` (unrestricted) — so lockfile discovery can
 /// import the models without bypassing its recognizing ctx reads. The same
-/// rule covers the other readers discovery imports: `vendor::maven_pom`,
-/// `vendor::nuget_config`'s reader half, and the `// ── pure reader ──`
+/// rule covers the other readers discovery imports: `formats::maven`,
+/// `formats::nuget`, and the `// ── pure reader ──`
 /// regions of the writer-owned `go_mod_edit`, `go_sum_edit`,
 /// `cargo_config` and `cargo_manifest`.
 #[cfg(test)]
@@ -471,7 +469,7 @@ mod architecture_tests {
             check(name, &text);
         }
         // Vendor-side readers lockfile discovery imports.
-        for rel in ["vendor/nuget_config.rs", "vendor/maven_pom.rs"] {
+        for rel in ["formats/nuget/mod.rs", "formats/maven/mod.rs"] {
             let text = std::fs::read_to_string(src.join(rel)).expect("read reader module");
             check(rel, &text);
         }
@@ -483,8 +481,8 @@ mod architecture_tests {
             "vendor/go_sum_edit.rs",
             "vendor/cargo_config.rs",
             "vendor/cargo_manifest.rs",
-            "vendor/nuget_config.rs",
-            "vendor/maven_pom.rs",
+            "formats/nuget/mod.rs",
+            "formats/maven/mod.rs",
         ] {
             let text = std::fs::read_to_string(src.join(rel)).expect("read reader module");
             assert!(
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/pnpm.rs b/crates/socket-patch-core/src/vendor/lock_inventory/pnpm.rs
index 9d78c288..27aefcef 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/pnpm.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/pnpm.rs
@@ -1,160 +1,16 @@
 //! `pnpm-lock.yaml` (every generation, pnpm <= 2's `shrinkwrap.yaml`) and
-//! Rush's pnpm locks: the entry model lockfile discovery shares
-//! ([`pnpm_packages`], [`classify_pnpm_key`]), Rush's lock enumeration and
-//! the registry view.
+//! Rush's pnpm locks: Rush's lock enumeration and the registry view over the
+//! format's model ([`crate::formats::pnpm::PnpmLock`]).
 
 use std::path::Path;
 
 use crate::constants::npm_family::{PNPM_LOCK, RUSH_COMMON_LOCK_REL, RUSH_SUBSPACES_DIR};
+use crate::formats::pnpm::PnpmLock;
 use crate::patch::path_safety::is_safe_single_segment;
-use crate::patch::redirect::pnpm;
 use crate::utils::fs::read_regular_to_string;
-use crate::vendor::path::parse_vendor_path;
 
 use super::view::ProjectView;
-use super::{http_url, LockIntegrity, LockfileEntry};
-
-// ── entry model ──
-
-/// One `packages:` entry of a pnpm lock, read with the hosted rewriter's
-/// own grammar ([`pnpm::entries`] / [`pnpm::resolution`]: two-space keys, a
-/// flat flow or block `resolution:` map, CRLF included).
-pub(crate) struct PnpmPackage<'a> {
-    /// The packages key, trimmed and unquoted.
-    pub(crate) key: &'a str,
-    pub(crate) entry: pnpm::Entry<'a>,
-    /// The entry's `resolution:` map; `None` when it has none or the
-    /// grammar refuses it (duplicate keys, nested values, aliases).
-    pub(crate) resolution: Option<pnpm::Resolution<'a>>,
-}
-
-impl<'a> PnpmPackage<'a> {
-    /// The unquoted tokens of the entry's raw `resolution:` text
-    /// ([`pnpm::resolution_raw_lines`] split on whitespace and flow
-    /// punctuation) — what a reader inspects when the grammar refused the
-    /// map (`resolution` is `None`) and it must still tell a Socket-shaped
-    /// value from anything else.
-    pub(crate) fn resolution_tokens(&self) -> Vec<&'a str> {
-        pnpm::resolution_raw_lines(&self.entry)
-            .into_iter()
-            .flat_map(|text| {
-                text.split(|c: char| c.is_whitespace() || matches!(c, ',' | '{' | '}' | '[' | ']'))
-            })
-            .map(|token| pnpm::unquote(token.trim()))
-            .filter(|token| !token.is_empty())
-            .collect()
-    }
-}
-
-/// Every `packages:` entry of a pnpm lock text, in lock order — the ONE
-/// entry walk the lock inventory and lockfile discovery
-/// (`vex::discover::npm`) share. Every entry is returned (registry, rekeyed
-/// vendored, hosted, directory, git); each consumer applies its own key and
-/// resolution rules.
-pub(crate) fn pnpm_packages(text: &str) -> Vec<PnpmPackage<'_>> {
-    pnpm::entries(text)
-        .into_iter()
-        .map(|entry| PnpmPackage {
-            key: pnpm::unquote(entry.key.trim()),
-            resolution: pnpm::resolution(&entry),
-            entry,
-        })
-        .collect()
-}
-
-/// How a pnpm packages key names its package.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum PnpmKey<'a> {
-    /// A registry key in any lock generation ([`pnpm_registry_key`]).
-    Registry { name: &'a str, version: &'a str },
-    /// v9's rekeyed vendored entry `name@file:<rel>` (`vendor::pnpm_lock`);
-    /// `path` is the raw `file:<rel>` spec, peer suffix stripped.
-    V9File { name: &'a str, path: &'a str },
-    /// v5.4 / v6.0's rekeyed vendored entry, the bare `file:<rel>` key
-    /// (`vendor::pnpm_lock_legacy`); the name is on the entry's `name:`
-    /// line.
-    LegacyFile { path: &'a str },
-    /// Anything else (url, git, `link:`, v5 non-default-registry keys).
-    Other,
-}
-
-/// Classify a packages key, in this order: a legacy `file:` key, a v9
-/// `name@file:` key (the `@` after a scope's leading one), a registry key,
-/// else [`PnpmKey::Other`]. The `file:` paths are returned raw — the CALLER
-/// anchors them (lockfile discovery with its root-anchored `vendor_ref`,
-/// the writers with `parse_vendor_path`).
-pub(crate) fn classify_pnpm_key(key: &str) -> PnpmKey<'_> {
-    let base = strip_pnpm_peer_suffix(key);
-    if base.starts_with("file:") {
-        PnpmKey::LegacyFile { path: base }
-    } else if let Some(at) = base.get(1..).and_then(|rest| rest.find("@file:")) {
-        PnpmKey::V9File {
-            name: &base[..at + 1],
-            path: &base[at + 2..],
-        }
-    } else {
-        match pnpm_registry_key(base) {
-            Some((name, version)) => PnpmKey::Registry { name, version },
-            None => PnpmKey::Other,
-        }
-    }
-}
-
-/// A pnpm packages key without its v6+ peer suffix (`(peer@1.0.0)…`).
-pub(crate) fn strip_pnpm_peer_suffix(key: &str) -> &str {
-    key.find('(').map_or(key, |p| key[..p].trim_end())
-}
-
-/// `(name, version)` of a REGISTRY-form pnpm packages key, in every lock
-/// generation's grammar — v9 `name@version`, v6 (pnpm 8) the same behind a
-/// leading `/`, v5.4 (pnpm 7) and shrinkwrap `/name/version`; names may be
-/// scoped in all of them. Peer suffixes are stripped: v6/v9 append
-/// `(peer@1.2.3)…` after the version, v5 appends `_peer@x` / `_<hash>` to
-/// the version itself. `None` for anything that is not a plain registry
-/// version (digit-first): `file:` / `link:` / url / git keys and v5
-/// non-default-registry keys. The ONE key rule the lock inventory and
-/// lockfile discovery (`vex::discover::npm`) share, so both read a key as
-/// the same package.
-pub(crate) fn pnpm_registry_key(key: &str) -> Option<(&str, &str)> {
-    let base = strip_pnpm_peer_suffix(key);
-    let (base, legacy) = match base.strip_prefix('/') {
-        Some(stripped) => (stripped, true),
-        None => (base, false),
-    };
-    let (name, version) = split_pnpm_key(base, legacy)?;
-    let version = version.split('_').next().unwrap_or(version);
-    version
-        .chars()
-        .next()
-        .is_some_and(|c| c.is_ascii_digit())
-        .then_some((name, version))
-}
-
-/// Split a peer-paren-stripped, slash-stripped pnpm packages key into
-/// `(name, version)`; `None` is skipped by the caller, never guessed.
-/// `legacy` marks a key that carried the v5/v6 leading `/` — only those may
-/// use the v5 `name/version` grammar. What tells v5 `/@scope/name/1.2.3`
-/// apart from v6 `/@scope/name@1.2.3` is the segment after the last `/`:
-/// a v5 version (its `_peer`/`_hash` suffix dropped) starts with a digit
-/// and never contains `@`, while a v6 scoped key's trailing segment is
-/// `name@version`. v5 non-default-registry keys (`example.com/name/1.2.3`)
-/// carry no leading `/` and fall through to the `@` split, where they are
-/// dropped fail-closed downstream.
-fn split_pnpm_key(base: &str, legacy: bool) -> Option<(&str, &str)> {
-    if legacy {
-        if let Some((name, rest)) = base.rsplit_once('/') {
-            let version = rest.split('_').next().unwrap_or(rest);
-            if !name.is_empty()
-                && version.chars().next().is_some_and(|c| c.is_ascii_digit())
-                && !version.contains('@')
-            {
-                return Some((name, version));
-            }
-        }
-    }
-    let at = base.rfind('@').filter(|&p| p > 0)?;
-    Some((&base[..at], &base[at + 1..]))
-}
+use super::LockfileEntry;
 
 // ── file selection ──
 
@@ -210,50 +66,15 @@ pub(super) async fn inventory_pnpm_lock_rel_in(
 }
 
 /// Inventory a specific `pnpm-lock.yaml` (path given explicitly so the Rush
-/// fallback can point it at `common/config/rush/…` and subspace locks).
-/// Entries come from the shared entry model ([`pnpm_packages`] — the walk
-/// lockfile discovery uses too): flow and block `resolution:` maps, every
-/// key generation ([`pnpm_registry_key`]), CRLF included. A resolution the
-/// grammar refuses leaves the entry listed without a verifier. `None` when
-/// the lock has no `packages:` section.
+/// fallback can point it at `common/config/rush/…` and subspace locks):
+/// [`PnpmLock::entries`], `None` when the lock has no `packages:` section.
 pub(super) async fn inventory_pnpm_lock_at(lock_path: &Path) -> Option<Vec<LockfileEntry>> {
     let text = read_regular_to_string(lock_path).await.ok()?;
     pnpm_lock_text_inventory(&text)
 }
 
 fn pnpm_lock_text_inventory(text: &str) -> Option<Vec<LockfileEntry>> {
-    if !text
-        .lines()
-        .any(|l| l.trim_end_matches('\r') == "packages:")
-    {
-        return None;
-    }
-    let mut out = Vec::new();
-    for package in pnpm_packages(text) {
-        // Only plain registry versions: `file:`/`link:`/`https:`/git specs
-        // are not registry-resolvable.
-        let Some((name, version)) = pnpm_registry_key(package.key) else {
-            continue;
-        };
-        let resolution = package.resolution;
-        let integrity = resolution
-            .as_ref()
-            .and_then(|r| r.integrity())
-            .map(|i| LockIntegrity::Sri(i.to_string()))
-            .unwrap_or(LockIntegrity::None);
-        let tarball = resolution.as_ref().and_then(|r| r.tarball());
-        // Our own vendored spec: not a registry dependency.
-        if tarball.is_some_and(|t| parse_vendor_path(t).is_some()) {
-            continue;
-        }
-        out.push(LockfileEntry::npm(
-            name,
-            version,
-            tarball.and_then(http_url),
-            integrity,
-        ));
-    }
-    Some(out)
+    PnpmLock::parse(text).entries()
 }
 
 /// Inventory a Rush monorepo's pnpm locks. Rush keeps a single
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/recover.rs b/crates/socket-patch-core/src/vendor/lock_inventory/recover.rs
index 0e58a9a8..83303ed8 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/recover.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/recover.rs
@@ -6,6 +6,7 @@ use std::path::Path;
 use serde_json::Value;
 
 use crate::crawlers::python_crawler::canonicalize_pypi_name;
+use crate::formats::composer::ComposerLockPackage;
 use crate::utils::digest::{is_hex, is_sri_pin, sha256_hex};
 use crate::utils::purl::percent_decode_purl_component;
 
@@ -63,22 +64,19 @@ pub async fn recover_lock_entry(
         "composer" => {
             let original = wiring_original(entry, &["composer_lock_package"])
                 .ok_or_else(|| "no pre-vendor composer.lock fragment recorded".to_string())?;
-            let dist = original
-                .get("dist")
-                .ok_or_else(|| "the pre-vendor composer.lock fragment has no dist".to_string())?;
-            let url = dist
-                .get("url")
-                .and_then(serde_json::Value::as_str)
+            // The fragment is the entry as the lock held it; read it with
+            // the lock model's own field rules.
+            let pkg = ComposerLockPackage::of("packages", 0, original);
+            if pkg.dist.is_none() {
+                return Err("the pre-vendor composer.lock fragment has no dist".to_string());
+            }
+            let url = pkg
+                .dist_str("url")
                 .and_then(http_url)
                 .ok_or_else(|| "the pre-vendor dist has no http(s) url".to_string())?;
-            let shasum = dist
-                .get("shasum")
-                .and_then(serde_json::Value::as_str)
-                .filter(|s| is_hex(s, 40))
-                .ok_or_else(|| {
-                    "the pre-vendor dist records no shasum; refusing an unverifiable fetch"
-                        .to_string()
-                })?;
+            let integrity = pkg.dist_sha1().ok_or_else(|| {
+                "the pre-vendor dist records no shasum; refusing an unverifiable fetch".to_string()
+            })?;
             Ok(LockfileEntry {
                 ecosystem: "composer",
                 source_kind: SourceKind::Unspecified,
@@ -86,7 +84,7 @@ pub async fn recover_lock_entry(
                 name,
                 version,
                 resolved: Some(url),
-                integrity: LockIntegrity::Sha1Hex(shasum.to_ascii_lowercase()),
+                integrity,
             })
         }
         "gem" => {
@@ -320,22 +318,17 @@ fn recover_npm_fragment(
             return Ok(mk(resolved, LockIntegrity::Sri(sri.to_string())));
         }
     }
-    // pnpm: the original is the packages block's lines; pull
-    // `resolution: {integrity: …, tarball: …}`.
+    // pnpm: the original is the packages block's lines, read with the
+    // format model's entry grammar.
     if let Some(lines) = wiring_original(entry, &["pnpm_lock_package"]).and_then(lines_of) {
-        let mut sri = None;
-        let mut tarball = None;
-        for line in &lines {
-            if let Some(v) = inline_yaml_field(line, "integrity:") {
-                sri = sri.or(Some(v));
-            }
-            if let Some(v) = inline_yaml_field(line, "tarball:") {
-                tarball = tarball.or(http_url(&v));
+        if let Some((Some(sri), tarball)) = crate::formats::pnpm::fragment_resolution(&lines) {
+            if is_sri_pin(&sri) {
+                return Ok(mk(
+                    tarball.as_deref().and_then(http_url),
+                    LockIntegrity::Sri(sri),
+                ));
             }
         }
-        if let Some(sri) = sri.filter(|s| is_sri_pin(s)) {
-            return Ok(mk(tarball, LockIntegrity::Sri(sri)));
-        }
     }
     // yarn classic: block lines carry `integrity <sri>` (preferred) and/or
     // `resolved "<url>#<sha1>"`.
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/tests.rs b/crates/socket-patch-core/src/vendor/lock_inventory/tests.rs
index e6f31357..5d0a45f5 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/tests.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/tests.rs
@@ -2409,6 +2409,80 @@ async fn wired_vendor_integrity_reads_rewired_yarn_classic_and_skips_bad_json_lo
     );
 }
 
+/// The yarn / bun branches of `wired_vendor_integrity` read the entry
+/// models lockfile discovery reads, not a line window: a berry block whose
+/// carried sections push `checksum:` far below the reference, yarn 4.0.x's
+/// bare-hex checksum, a CRLF classic lock, a shadowed classic block (yarn
+/// keeps the last one) and bun's digest-less re-save (which must never
+/// borrow the next tuple's sha512).
+#[tokio::test]
+async fn wired_vendor_integrity_reads_yarn_and_bun_entries_structurally() {
+    let rel = ".socket/vendor/npm/9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f/left-pad-1.3.0.tgz";
+    let hex = "ab".repeat(64);
+    let berry = |checksum: &str| {
+        format!(
+            "__metadata:\n  version: 8\n  cacheKey: 10c0\n\n\
+             \"left-pad@file:./{rel}::locator=app%40workspace%3A.\":\n  \
+             version: 1.3.0\n  \
+             resolution: \"left-pad@file:./{rel}#./{rel}::hash=abc&locator=app%40workspace%3A.\"\n  \
+             dependencies:\n    a: \"npm:1.0.0\"\n    b: \"npm:1.0.0\"\n    c: \"npm:1.0.0\"\n    d: \"npm:1.0.0\"\n    e: \"npm:1.0.0\"\n  \
+             checksum: {checksum}\n  \
+             languageName: node\n  \
+             linkType: hard\n"
+        )
+    };
+    for (checksum, want) in [
+        (format!("10c0/{hex}"), format!("10c0/{hex}")),
+        (hex.clone(), format!("10c0/{hex}")),
+    ] {
+        let tmp = tempfile::tempdir().unwrap();
+        write(tmp.path(), "yarn.lock", &berry(&checksum)).await;
+        assert_eq!(
+            wired_vendor_integrity(tmp.path(), rel).await,
+            Some(LockIntegrity::BerryChecksum(want)),
+            "{checksum}"
+        );
+    }
+
+    let classic = |key: &str, sri: &str| {
+        format!(
+            "{key}:\n  version \"1.3.0\"\n  resolved \"file:./{rel}#0000000000000000000000000000000000000000\"\n  integrity {sri}\n"
+        )
+    };
+    let tmp = tempfile::tempdir().unwrap();
+    let lock = format!(
+        "# yarn lockfile v1\n\n{}\n{}",
+        classic("left-pad@^1.3.0", "sha512-shadowed=="),
+        classic("left-pad@^1.3.0", "sha512-live==")
+    )
+    .replace('\n', "\r\n");
+    write(tmp.path(), "yarn.lock", &lock).await;
+    assert_eq!(
+        wired_vendor_integrity(tmp.path(), rel).await,
+        Some(LockIntegrity::Sri("sha512-live==".into())),
+        "the live (last) block of a CRLF lock"
+    );
+
+    let bun = |ours: &str| {
+        format!(
+            "{{\n  \"lockfileVersion\": 1,\n  \"workspaces\": {{\n    \"\": {{\n      \"name\": \"app\",\n    }},\n  }},\n  \"packages\": {{\n    \"left-pad\": [\"left-pad@./{rel}\", {{}}{ours}],\n\n    \"right-pad\": [\"right-pad@1.0.0\", \"\", {{}}, \"sha512-theirs==\"],\n  }}\n}}\n"
+        )
+    };
+    let tmp = tempfile::tempdir().unwrap();
+    write(tmp.path(), "bun.lock", &bun(", \"sha512-ours==\"")).await;
+    assert_eq!(
+        wired_vendor_integrity(tmp.path(), rel).await,
+        Some(LockIntegrity::Sri("sha512-ours==".into()))
+    );
+    let tmp = tempfile::tempdir().unwrap();
+    write(tmp.path(), "bun.lock", &bun("")).await;
+    assert_eq!(
+        wired_vendor_integrity(tmp.path(), rel).await,
+        None,
+        "a digest-less re-save pins nothing"
+    );
+}
+
 /// `PnpmPackage::resolution_tokens` exposes the raw `resolution:` value the
 /// grammar refused (a nested map, a duplicate key, a wrapped flow map), so
 /// lockfile discovery can still tell a Socket-shaped entry from anything
@@ -2419,7 +2493,7 @@ fn pnpm_resolution_tokens_cover_maps_the_grammar_refuses() {
     let lock = format!(
         "lockfileVersion: '9.0'\n\npackages:\n\n  x@1.0.0:\n    resolution:\n      tarball: {url}\n      nested:\n        a: b\n\n  y@1.0.0:\n    resolution: {{integrity: sha512-a}}\n    resolution: {{tarball: '{url}'}}\n\n  z@1.0.0:\n    resolution: {{integrity: sha512-z,\n      tarball: \"{url}\"}}\n\n  ok@1.0.0:\n    resolution: {{integrity: sha512-ok}}\n"
     );
-    let packages = super::pnpm::pnpm_packages(&lock);
+    let packages = crate::formats::pnpm::pnpm_packages(&lock);
     let by_key = |key: &str| packages.iter().find(|p| p.key == key).unwrap();
     for key in ["x@1.0.0", "y@1.0.0", "z@1.0.0"] {
         let package = by_key(key);
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/view.rs b/crates/socket-patch-core/src/vendor/lock_inventory/view.rs
index 4f603f1d..7161b358 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/view.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/view.rs
@@ -16,7 +16,8 @@ use crate::utils::fs::{
     read_regular_to_bytes, read_regular_to_string, read_regular_to_string_sync,
 };
 use crate::vendor::npm_flavor::NpmLockFlavor;
-use crate::vendor::pnpm_lock_legacy::{sniff_lock_grammar, PnpmLockGrammar};
+use crate::formats::pnpm::{sniff_lock_grammar, PnpmLockGrammar};
+use crate::formats::yarn::{sniff_grammar, YarnLockGrammar, UNIDENTIFIED_DETAIL};
 use crate::vendor::VendorWarning;
 
 /// One in-memory file.
@@ -289,10 +290,6 @@ impl ProjectView<'_> {
     }
 }
 
-/// How many head lines the yarn content sniff reads (mirrors the disk
-/// probe).
-const YARN_SNIFF_HEAD_LINES: usize = 30;
-
 /// [`crate::vendor::npm_flavor::detect_npm_lock_flavor`] over a
 /// [`ProjectView`]. The disk variant IS the disk probe; the memory variant
 /// follows the same decision table, with pnpm's own Plug'n'Play layout
@@ -350,24 +347,16 @@ pub(crate) async fn detect_npm_lock_flavor_in(
         }
         if exists("yarn.lock") {
             let text = read_lock("yarn.lock")?;
-            let head: Vec<&str> = text
-                .strip_prefix('\u{feff}')
-                .unwrap_or(&text)
-                .lines()
-                .take(YARN_SNIFF_HEAD_LINES)
-                .collect();
-            if head.iter().any(|l| l.starts_with("__metadata:")) {
-                break 'flavor NpmLockFlavor::YarnBerry;
-            }
-            if head.iter().any(|l| l.trim() == "# yarn lockfile v1") {
-                break 'flavor NpmLockFlavor::YarnClassic;
+            match sniff_grammar(&text) {
+                Some(YarnLockGrammar::Berry) => break 'flavor NpmLockFlavor::YarnBerry,
+                Some(YarnLockGrammar::Classic) => break 'flavor NpmLockFlavor::YarnClassic,
+                None => {
+                    return Err((
+                        "vendor_lockfile_version_unsupported",
+                        UNIDENTIFIED_DETAIL.to_string(),
+                    ))
+                }
             }
-            return Err((
-                "vendor_lockfile_version_unsupported",
-                "yarn.lock carries neither the `# yarn lockfile v1` header nor a berry \
-                 `__metadata:` key; cannot identify the lockfile version"
-                    .to_string(),
-            ));
         }
         if exists(NPM_LOCKS[0]) || exists(NPM_LOCKS[1]) {
             break 'flavor NpmLockFlavor::PackageLock;
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/wired.rs b/crates/socket-patch-core/src/vendor/lock_inventory/wired.rs
index 35c2a2f3..9ed45e49 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/wired.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/wired.rs
@@ -6,15 +6,22 @@ use std::path::Path;
 use toml_edit::{DocumentMut, Item};
 
 use crate::constants::npm_family::{BUN_LOCK, BUN_LOCKB, NPM_LOCKS, PNPM_LOCK};
+use crate::formats::pnpm::PnpmLock;
 use crate::utils::digest::is_sri_pin;
 use crate::utils::fs::{read_regular_to_bytes, read_regular_to_string};
 use crate::utils::python_lock::{
     lock_artifact, lock_package_collection, package_artifacts, uv_source_location,
 };
+use crate::formats::yarn::is_berry_lock;
+use crate::vendor::bun_lock_text::{decode_json_string, split_name_spec};
 use crate::vendor::bun_lockb::BunLockb;
+use crate::vendor::yarn_berry_lock::berry_field;
+use crate::vendor::yarn_classic_lock::classic_field;
+use crate::vex::discover::{vendor_ref, vendor_ref_decorated};
 
+use super::bun::bun_text_entries;
 use super::npm::npm_lock_nodes;
-use super::recover::inline_yaml_field;
+use super::yarn::{berry_checksum_pin, berry_entries, classic_entries};
 use super::LockIntegrity;
 
 /// The integrity the REWIRED npm-family lockfile records for a vendored
@@ -23,11 +30,10 @@ use super::LockIntegrity;
 /// anchor for repair's no-ledger reconstruction: a rebuilt tarball that
 /// matches it is exactly what the package manager would have installed.
 ///
-/// package-lock/shrinkwrap are parsed as JSON; the text formats (pnpm,
-/// yarn classic/berry, bun) are scanned with a bounded forward window from
-/// each reference line. vlt yields `None`: its `file` nodes pin no
-/// integrity (slot [2] is `null`), and `vlt-lock.json` is never scanned,
-/// because the forward window would pick up a neighbouring node's sha512.
+/// package-lock/shrinkwrap are parsed as JSON, pnpm through its format
+/// model, yarn (classic and berry) and bun.lock through the entry models
+/// lockfile discovery reads. vlt yields `None`: its `file` nodes pin no
+/// integrity (slot [2] is `null`).
 pub async fn wired_vendor_integrity(
     project_root: &Path,
     artifact_rel: &str,
@@ -130,48 +136,89 @@ pub async fn wired_vendor_integrity(
         }
     }
 
-    // Text locks: any line referencing the artifact path, integrity within
-    // a short forward window (the same block).
-    for lock in [PNPM_LOCK, "yarn.lock", BUN_LOCK] {
-        let Ok(text) = read_regular_to_string(&project_root.join(lock)).await else {
-            continue;
+    // pnpm: the format model's vendored entry (every key generation).
+    if let Ok(text) = read_regular_to_string(&project_root.join(PNPM_LOCK)).await {
+        if let Some(sri) = PnpmLock::parse(&text).wired_integrity(rel) {
+            return Some(LockIntegrity::Sri(sri));
+        }
+    }
+
+    // yarn: the entry models lockfile discovery reads (live blocks only —
+    // yarn keeps the last block per pattern), classic `integrity` SRI or
+    // berry `checksum:` (yarn 4.0.x bare hex promoted under cacheKey 10c0).
+    if let Ok(text) = read_regular_to_string(&project_root.join("yarn.lock")).await {
+        let pins: Vec<LockIntegrity> = if is_berry_lock(&text) {
+            let lock = berry_entries(&text);
+            lock.entries
+                .iter()
+                .filter(|e| e.live)
+                .filter(|e| {
+                    e.locator()
+                        .and_then(|l| vendor_ref_decorated(l.reference))
+                        .is_some_and(|v| v.artifact_rel == rel)
+                })
+                .filter_map(|e| {
+                    berry_field(&e.block.lines, "checksum")
+                        .and_then(|c| berry_checksum_pin(c, lock.cache_key.as_deref()))
+                })
+                .collect()
+        } else {
+            classic_entries(&text)
+                .iter()
+                .filter(|e| e.live)
+                .filter(|e| {
+                    classic_field(&e.block.lines, "resolved")
+                        .and_then(vendor_ref_decorated)
+                        .is_some_and(|v| v.artifact_rel == rel)
+                })
+                .filter_map(|e| classic_field(&e.block.lines, "integrity"))
+                .filter(|sri| is_sri_pin(sri))
+                .map(|sri| LockIntegrity::Sri(sri.to_string()))
+                .collect()
         };
-        let lines: Vec<&str> = text.lines().collect();
-        for (i, line) in lines.iter().enumerate() {
-            if !line.contains(rel) {
-                continue;
-            }
-            for probe in lines.iter().take((i + 6).min(lines.len())).skip(i) {
-                // pnpm `resolution: {integrity: …}` / classic `integrity …`
-                // / bun tuple `"sha512-…"`.
-                if let Some(v) = inline_yaml_field(probe, "integrity:") {
-                    if is_sri_pin(&v) {
-                        return Some(LockIntegrity::Sri(v));
-                    }
-                }
-                if let Some(rest) = probe.trim().strip_prefix("integrity ") {
-                    let v = rest.trim().trim_matches('"');
-                    if is_sri_pin(v) {
-                        return Some(LockIntegrity::Sri(v.to_string()));
-                    }
-                }
-                if let Some(sri) = probe.split('"').rev().find(|tok| is_sri_pin(tok)) {
-                    return Some(LockIntegrity::Sri(sri.to_string()));
-                }
-                // yarn berry: `checksum: 10c0/…`.
-                if let Some(v) = inline_yaml_field(probe, "checksum:") {
-                    if v.split_once('/')
-                        .is_some_and(|(k, b)| !k.is_empty() && !b.is_empty())
-                    {
-                        return Some(LockIntegrity::BerryChecksum(v));
-                    }
-                }
+        if let Some(pin) = unanimous(pins) {
+            return Some(pin);
+        }
+    }
+
+    // bun.lock: our tarball tuple `[spec, {meta}, "sha512-…"]` (bun
+    // < 1.3.10 re-saves it digest-less, which pins nothing).
+    if let Ok(text) = read_regular_to_string(&project_root.join(BUN_LOCK)).await {
+        if let Ok(entries) = bun_text_entries(&text) {
+            let pins: Vec<LockIntegrity> = entries
+                .iter()
+                .filter(|e| {
+                    matches!(e.elems.len(), 2 | 3)
+                        && e.elems[1].starts_with('{')
+                        && e.elems
+                            .first()
+                            .and_then(|spec| decode_json_string(spec))
+                            .is_some_and(|spec| {
+                                split_name_spec(&spec)
+                                    .and_then(|(_, target)| vendor_ref(target))
+                                    .is_some_and(|v| v.artifact_rel == rel)
+                            })
+                })
+                .filter_map(|e| e.elems.get(2).and_then(|sri| decode_json_string(sri)))
+                .filter(|sri| is_sri_pin(sri))
+                .map(LockIntegrity::Sri)
+                .collect();
+            if let Some(pin) = unanimous(pins) {
+                return Some(pin);
             }
         }
     }
     None
 }
 
+/// The one pin every entry agrees on; `None` when there is none or the
+/// entries disagree (no anchor beats a wrong one).
+fn unanimous(pins: Vec<LockIntegrity>) -> Option<LockIntegrity> {
+    let mut pins = pins.into_iter();
+    let first = pins.next()?;
+    pins.all(|p| p == first).then_some(first)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/crates/socket-patch-core/src/vendor/mod.rs b/crates/socket-patch-core/src/vendor/mod.rs
index faafcbf1..5d6fc529 100644
--- a/crates/socket-patch-core/src/vendor/mod.rs
+++ b/crates/socket-patch-core/src/vendor/mod.rs
@@ -62,13 +62,11 @@ pub mod cargo_tag;
 pub(crate) mod common;
 pub mod composer_lock;
 pub mod gem;
-pub(crate) mod gemfile_lock;
 pub mod go_mod_edit;
 pub mod go_sum_edit;
 pub mod golang;
 pub(crate) mod ledger_snapshots;
 pub mod lock_inventory;
-pub(crate) mod maven_pom;
 pub mod maven_repo;
 pub(crate) mod npm_common;
 pub(crate) mod npm_dir;
diff --git a/crates/socket-patch-core/src/vendor/npm_flavor.rs b/crates/socket-patch-core/src/vendor/npm_flavor.rs
index 25a976a0..a0ffe424 100644
--- a/crates/socket-patch-core/src/vendor/npm_flavor.rs
+++ b/crates/socket-patch-core/src/vendor/npm_flavor.rs
@@ -25,7 +25,8 @@ use crate::manifest::schema::PatchRecord;
 use crate::patch::apply::PatchSources;
 use crate::utils::fs::{read_regular_to_bytes, read_regular_to_string};
 
-use super::pnpm_lock_legacy::PnpmLockGrammar;
+use crate::formats::pnpm::PnpmLockGrammar;
+use crate::formats::yarn::{sniff_grammar, YarnLockGrammar, UNIDENTIFIED_DETAIL};
 use super::source::PackageSource;
 use super::state::VendorEntry;
 use super::{
@@ -91,11 +92,6 @@ use crate::constants::npm_family::{
     BUN_LOCK, BUN_LOCKB, NPM_LOCKS, PNPM_LOCK, PNP_MARKERS, VLT_LOCK,
 };
 
-/// How many head lines the yarn content sniff reads (the v1 header sits in
-/// the leading comment block; berry's `__metadata:` is the first top-level
-/// key after it).
-const YARN_SNIFF_HEAD_LINES: usize = 30;
-
 /// Every lockfile name the probe knows, grouped into wiring families: the
 /// flavor that owns a family wires (or supersedes) every file in it, so only
 /// files OUTSIDE the detected family get the multiple-lockfiles warning.
@@ -215,7 +211,7 @@ pub(crate) async fn detect_npm_lock_flavor(
         //    anything else refuses with the sniff's version-aware remedy.
         if exists(PNPM_LOCK).await {
             let text = read_lock(project_root, PNPM_LOCK).await?;
-            match pnpm_lock_legacy::sniff_lock_grammar(&text) {
+            match crate::formats::pnpm::sniff_lock_grammar(&text) {
                 Ok(PnpmLockGrammar::V9) => break 'flavor NpmLockFlavor::Pnpm,
                 Ok(PnpmLockGrammar::V54 | PnpmLockGrammar::V60) => {
                     break 'flavor NpmLockFlavor::PnpmLegacy
@@ -322,29 +318,19 @@ async fn read_lock(project_root: &Path, name: &str) -> Result<String, (&'static
 /// mistaken for classic.
 async fn sniff_yarn_lock(project_root: &Path) -> Result<NpmLockFlavor, (&'static str, String)> {
     let text = read_lock(project_root, "yarn.lock").await?;
-    // CRLF lines split like LF ones; a leading BOM is not key text.
-    let head: Vec<&str> = text
-        .strip_prefix('\u{feff}')
-        .unwrap_or(&text)
-        .lines()
-        .take(YARN_SNIFF_HEAD_LINES)
-        .collect();
     // Berry wins the check (it must never be mistaken for classic). The
     // node-modules linker keeps packages on disk for staging, and berry's
     // cache-zip checksum is reproducible from our tarball (berry_zip), so the
     // backend can wire it; PnP (caught earlier by the `.pnp.*` markers) is the
     // only berry layout vendor refuses.
-    if head.iter().any(|l| l.starts_with("__metadata:")) {
-        return Ok(NpmLockFlavor::YarnBerry);
-    }
-    if head.iter().any(|l| l.trim() == "# yarn lockfile v1") {
-        return Ok(NpmLockFlavor::YarnClassic);
+    match sniff_grammar(&text) {
+        Some(YarnLockGrammar::Berry) => return Ok(NpmLockFlavor::YarnBerry),
+        Some(YarnLockGrammar::Classic) => return Ok(NpmLockFlavor::YarnClassic),
+        None => {}
     }
     Err((
         "vendor_lockfile_version_unsupported",
-        "yarn.lock carries neither the `# yarn lockfile v1` header nor a berry \
-         `__metadata:` key; cannot identify the lockfile version"
-            .to_string(),
+        UNIDENTIFIED_DETAIL.to_string(),
     ))
 }
 
@@ -852,9 +838,9 @@ mod lock_text_refusal_tests {
 #[cfg(test)]
 mod tests {
     #[test]
-    fn probe_lockfile_names_match_the_shared_npm_family_table() {
-        // Drift guard: the probe's wiring families and the shared
-        // constants::npm_family table must agree on which file names the
+    fn probe_lockfile_names_match_the_format_registry() {
+        // Drift guard: the probe's wiring families and the format
+        // registry's npm PROBE rows must agree on which file names the
         // vendor probe recognizes. A new lockfile spelling added in one
         // place must show up in the other (and in every other consumer's
         // guard test) instead of drifting silently.
@@ -863,7 +849,7 @@ mod tests {
             .flat_map(|(_, names)| names.iter().copied())
             .collect();
         from_families.sort_unstable();
-        let mut from_table = crate::constants::npm_family::names_with(|r| r.vendor_probe);
+        let mut from_table = crate::formats::registry::probe_paths("npm");
         from_table.sort_unstable();
         assert_eq!(from_families, from_table);
     }
diff --git a/crates/socket-patch-core/src/vendor/nuget_config.rs b/crates/socket-patch-core/src/vendor/nuget_config.rs
index 50c9583e..21f58ae1 100644
--- a/crates/socket-patch-core/src/vendor/nuget_config.rs
+++ b/crates/socket-patch-core/src/vendor/nuget_config.rs
@@ -1,225 +1,5 @@
-//! NuGet config files: the routing reader, then the per-directory names
-//! NuGet probes and a stat-only same-file check.
-//!
-//! The reader is a minimal, bounded XML tokenizer (no parser dependency)
-//! that records only what NuGet routes by: `<add>` directly under
-//! `configuration/packageSources`, the mapping elements directly under
-//! `configuration/packageSourceMapping`, and `disabledPackageSources`
-//! entries whose `value` is `true`. Comments, CDATA, processing instructions
-//! and DOCTYPEs are skipped; an unterminated tag or comment, an unquoted
-//! attribute or a mismatched close tag makes the whole file `None`.
-
-use std::collections::BTreeSet;
-
-// ── pure reader ──
-
-/// Bound on element nesting — the config is tamper-able input (real configs
-/// are three levels deep).
-const MAX_XML_DEPTH: usize = 64;
-
-/// The parts of a `nuget.config` that route packages.
-#[derive(Debug, Default)]
-pub(crate) struct NugetConfig {
-    /// `configuration/packageSources/add` `(key, value)`, document order.
-    pub(crate) sources: Vec<(String, String)>,
-    /// `configuration/packageSourceMapping/packageSource` `(key, patterns)`,
-    /// one row per element, document order.
-    pub(crate) mappings: Vec<(String, Vec<String>)>,
-    /// Keys `configuration/disabledPackageSources` turns off.
-    pub(crate) disabled: BTreeSet<String>,
-}
-
-/// One open (or self-closing) tag.
-struct Tag<'a> {
-    name: &'a str,
-    attrs: Vec<(&'a str, String)>,
-    self_closing: bool,
-}
-
-impl Tag<'_> {
-    fn attr(&self, name: &str) -> Option<&str> {
-        self.attrs
-            .iter()
-            .find(|(n, _)| *n == name)
-            .map(|(_, v)| v.as_str())
-    }
-}
-
-/// Parse the routing parts of `text`, or `None` when it is not well-formed
-/// enough to trust (see the module docs).
-pub(crate) fn parse_config(text: &str) -> Option<NugetConfig> {
-    let mut cfg = NugetConfig::default();
-    let mut stack: Vec<&str> = Vec::new();
-    // Index into `cfg.mappings` of the open `<packageSource>` element.
-    let mut open_mapping: Option<usize> = None;
-    let mut i = 0;
-    while let Some(rel) = text[i..].find('<') {
-        let at = i + rel;
-        let rest = &text[at..];
-        if let Some(comment) = rest.strip_prefix("<!--") {
-            i = at + 4 + comment.find("-->")? + 3;
-        } else if rest.starts_with("<![CDATA[") {
-            i = at + rest.find("]]>")? + 3;
-        } else if rest.starts_with("<?") {
-            i = at + rest.find("?>")? + 2;
-        } else if rest.starts_with("<!") {
-            // DOCTYPE and friends (no internal subsets in a NuGet config).
-            i = at + rest.find('>')? + 1;
-        } else if let Some(close) = rest.strip_prefix("</") {
-            let end = close.find('>')?;
-            if stack.pop()? != close[..end].trim() {
-                return None;
-            }
-            i = at + 2 + end + 1;
-        } else {
-            let (tag, consumed) = parse_open_tag(&rest[1..])?;
-            i = at + 1 + consumed;
-            visit(&stack, &tag, &mut cfg, &mut open_mapping);
-            if !tag.self_closing {
-                if stack.len() >= MAX_XML_DEPTH {
-                    return None;
-                }
-                stack.push(tag.name);
-            }
-        }
-    }
-    stack.is_empty().then_some(cfg)
-}
-
-/// Record `tag` if it sits where NuGet reads routing data.
-fn visit(stack: &[&str], tag: &Tag<'_>, cfg: &mut NugetConfig, open_mapping: &mut Option<usize>) {
-    match (stack, tag.name) {
-        (["configuration", "packageSources"], "add") => {
-            if let (Some(key), Some(value)) = (tag.attr("key"), tag.attr("value")) {
-                cfg.sources.push((key.to_string(), value.to_string()));
-            }
-        }
-        (["configuration", "disabledPackageSources"], "add") => {
-            if let (Some(key), Some(value)) = (tag.attr("key"), tag.attr("value")) {
-                if value.trim().eq_ignore_ascii_case("true") {
-                    cfg.disabled.insert(key.to_string());
-                }
-            }
-        }
-        (["configuration", "packageSourceMapping"], "packageSource") => {
-            *open_mapping = match tag.attr("key") {
-                Some(key) => {
-                    cfg.mappings.push((key.to_string(), Vec::new()));
-                    (!tag.self_closing).then(|| cfg.mappings.len() - 1)
-                }
-                None => None,
-            };
-        }
-        (["configuration", "packageSourceMapping", "packageSource"], "package") => {
-            if let (Some(idx), Some(pattern)) = (*open_mapping, tag.attr("pattern")) {
-                cfg.mappings[idx].1.push(pattern.trim().to_string());
-            }
-        }
-        _ => {}
-    }
-}
-
-/// Parse an open tag starting right after its `<`: `(tag, bytes consumed
-/// through the closing `>`)`. Attribute values must be quoted (either XML
-/// quote) and are entity-decoded.
-fn parse_open_tag(s: &str) -> Option<(Tag<'_>, usize)> {
-    let name_end = s.find(|c: char| c.is_whitespace() || c == '/' || c == '>')?;
-    let name = &s[..name_end];
-    if name.is_empty() {
-        return None;
-    }
-    let mut attrs = Vec::new();
-    let mut j = name_end;
-    loop {
-        j += leading_ws(&s[j..]);
-        let t = &s[j..];
-        if t.starts_with("/>") {
-            return Some((
-                Tag {
-                    name,
-                    attrs,
-                    self_closing: true,
-                },
-                j + 2,
-            ));
-        }
-        if t.starts_with('>') {
-            return Some((
-                Tag {
-                    name,
-                    attrs,
-                    self_closing: false,
-                },
-                j + 1,
-            ));
-        }
-        let attr_end = t.find(|c: char| c.is_whitespace() || matches!(c, '=' | '>' | '/'))?;
-        if attr_end == 0 {
-            return None;
-        }
-        let attr = &t[..attr_end];
-        j += attr_end;
-        j += leading_ws(&s[j..]);
-        j += s[j..].strip_prefix('=').map(|_| 1)?;
-        j += leading_ws(&s[j..]);
-        let t = &s[j..];
-        let quote = t.chars().next().filter(|q| matches!(q, '"' | '\''))?;
-        let close = t[1..].find(quote)?;
-        let raw = &t[1..1 + close];
-        if raw.contains('<') {
-            return None;
-        }
-        attrs.push((attr, decode_entities(raw)));
-        j += 1 + close + 1;
-    }
-}
-
-fn leading_ws(s: &str) -> usize {
-    s.len() - s.trim_start().len()
-}
-
-/// Decode the five predefined XML entities and numeric character references;
-/// anything else is kept literally (it then fails the later grammar checks
-/// rather than being guessed at).
-fn decode_entities(raw: &str) -> String {
-    if !raw.contains('&') {
-        return raw.to_string();
-    }
-    let mut out = String::with_capacity(raw.len());
-    let mut rest = raw;
-    while let Some(amp) = rest.find('&') {
-        out.push_str(&rest[..amp]);
-        let tail = &rest[amp..];
-        let decoded = tail.find(';').filter(|&semi| semi <= 10).and_then(|semi| {
-            let entity = &tail[1..semi];
-            let ch = match entity {
-                "amp" => Some('&'),
-                "lt" => Some('<'),
-                "gt" => Some('>'),
-                "quot" => Some('"'),
-                "apos" => Some('\''),
-                _ => entity
-                    .strip_prefix("#x")
-                    .and_then(|hex| u32::from_str_radix(hex, 16).ok())
-                    .or_else(|| entity.strip_prefix('#').and_then(|d| d.parse().ok()))
-                    .and_then(char::from_u32),
-            }?;
-            Some((ch, semi + 1))
-        });
-        match decoded {
-            Some((ch, len)) => {
-                out.push(ch);
-                rest = &tail[len..];
-            }
-            None => {
-                out.push('&');
-                rest = &tail[1..];
-            }
-        }
-    }
-    out.push_str(rest);
-    out
-}
+//! NuGet config file selection: the per-directory names NuGet probes and a
+//! stat-only same-file check (the routing reader is `formats::nuget`).
 
 // ── file selection ──
 
@@ -242,13 +22,3 @@ pub(crate) async fn same_file(a: &std::path::Path, b: &std::path::Path) -> bool
     let _ = (a, b);
     false
 }
-
-#[cfg(test)]
-mod tests {
-    #[test]
-    fn entity_decoding_is_minimal_and_safe() {
-        assert_eq!(super::decode_entities("a&amp;b&lt;&#x2F;&#47;"), "a&b<//");
-        assert_eq!(super::decode_entities("&bogus;&"), "&bogus;&");
-        assert_eq!(super::decode_entities("&#xD800;"), "&#xD800;");
-    }
-}
diff --git a/crates/socket-patch-core/src/vendor/pnpm_lock.rs b/crates/socket-patch-core/src/vendor/pnpm_lock.rs
index f62b4ae6..5c000e87 100644
--- a/crates/socket-patch-core/src/vendor/pnpm_lock.rs
+++ b/crates/socket-patch-core/src/vendor/pnpm_lock.rs
@@ -72,6 +72,13 @@ use super::state::{
 };
 use super::{RevertOpts, RevertOutcome, VendorOutcome, VendorWarning};
 use crate::constants::npm_family::PNPM_LOCK;
+use crate::formats::pnpm::{
+    check_v9_lock_version as check_lock_version, vendored_npm_uuids,
+};
+use crate::formats::pnpm::lines::{
+    indent_of, next_block, parse_key_line, section_bounds, split_lines, unquote_value, yaml_key,
+    yaml_key_like, YamlBlock,
+};
 
 const PACKAGE_JSON: &str = "package.json";
 const PNPM_WORKSPACE: &str = "pnpm-workspace.yaml";
@@ -83,10 +90,6 @@ const PNPM_WORKSPACE: &str = "pnpm-workspace.yaml";
 /// workspace the way `packages/*` would.
 const WS_SCAFFOLD_PACKAGES: [&str; 2] = ["packages:", "  - '.'"];
 
-/// The only lockfileVersion the surgery has byte-exact fixtures for (both
-/// pnpm 9 and 10 emit it).
-const SUPPORTED_LOCK_VERSION: &str = "9.0";
-
 /// Wiring kinds (the `WiringRecord.kind` discriminators this backend owns).
 pub(super) const KIND_PKG_OVERRIDE: &str = "pnpm_pkg_override";
 const KIND_WS_OVERRIDE: &str = "pnpm_ws_override";
@@ -559,48 +562,12 @@ pub async fn pnpm_entry_in_use(entry: &VendorEntry, project_root: &Path) -> Opti
     if check_lock_version(&text).is_err() {
         return None;
     }
-    // CRLF (a Windows autocrlf checkout) breaks every structural probe
-    // below: the scan would find nothing and call a lock that still
-    // resolves through the artifact "provably orphaned" — undeterminable,
-    // keep (the unwired-revert guard then refuses, fail-closed).
-    if text.contains('\r') {
-        return None;
-    }
     // Every `packages:`/`snapshots:` block key resolving into
-    // `.socket/vendor/npm/<uuid>/`, collected once per lock bytes (see
-    // [`LockIndex`]) once these bytes are probed again; the first probe
-    // runs [`pnpm_entry_in_use_scan`], the per-call scan it answers for.
-    let doc = LOCK_MEMO.parse_infallible(text.as_bytes(), || LockDoc::new(split_lines(&text)));
-    doc.note_probe();
-    Some(match doc.index() {
-        Some(index) => index.vendored_npm_uuids.contains(&entry.uuid),
-        None => pnpm_entry_in_use_scan(&entry.uuid, &doc.lines),
-    })
-}
-
-/// The pre-index [`pnpm_entry_in_use`] body over already-split lines: the
-/// answer for a lock probed once, and the equivalence oracle for the
-/// indexed answer.
-fn pnpm_entry_in_use_scan(uuid: &str, lines: &[String]) -> bool {
-    for section in ["packages", "snapshots"] {
-        let Some((start, end)) = section_bounds(lines, section) else {
-            continue;
-        };
-        let mut i = start + 1;
-        while let Some(block) = next_block(lines, i, end) {
-            let resolved_to_ours = block
-                .key
-                .find("@file:")
-                .map(|at| &block.key[at + 1..])
-                .and_then(parse_vendor_path)
-                .is_some_and(|p| p.eco == "npm" && p.uuid == uuid);
-            if resolved_to_ours {
-                return true;
-            }
-            i = block.end;
-        }
-    }
-    false
+    // `.socket/vendor/npm/<uuid>/` — the format model's one walk
+    // ([`vendored_npm_uuids`], CRLF read like LF), collected once per lock
+    // bytes: a revert pass probes once per ledger entry.
+    let vendored = IN_USE_MEMO.parse_infallible(text.as_bytes(), || vendored_npm_uuids(&text));
+    Some(vendored.contains(&entry.uuid))
 }
 
 /// FAIL-CLOSED revert guard for a ledger entry with NO wiring records,
@@ -1120,46 +1087,6 @@ impl EditCtx<'_> {
 
 // ─────────────────────────── pre-flight checks ───────────────────────────
 
-/// `lockfileVersion: '9.0'` head check (accept pnpm's single quotes plus
-/// double-quoted/bare spellings) — the v9 BACKEND's own guard. The flavor
-/// router sniffs with [`super::pnpm_lock_legacy::sniff_lock_grammar`]
-/// instead, whose allowlist also routes the legacy 5.4/6.0 grammars to
-/// their backend; this check only fires if a non-9.0 lock reaches
-/// `vendor_pnpm` directly.
-pub(super) fn check_lock_version(text: &str) -> Result<(), String> {
-    let version = text
-        .lines()
-        .take(5)
-        .find_map(|line| line.strip_prefix("lockfileVersion:"))
-        .map(|rest| rest.trim().trim_matches(['\'', '"']).to_string());
-    match version {
-        Some(v) if v == SUPPORTED_LOCK_VERSION => Ok(()),
-        Some(v) => {
-            // The remedy must point the right way: 5.x (pnpm 7) / 6.x
-            // (pnpm 8) locks predate the v9 grammar and upgrading pnpm
-            // re-locks them, but a HIGHER version means the user's pnpm
-            // already outgrew this build — telling them "re-lock with
-            // pnpm >= 9" would loop them back to the lock they have.
-            let major = v.split('.').next().and_then(|m| m.parse::<u32>().ok());
-            Err(match major {
-                Some(m) if m < 9 => format!(
-                    "{PNPM_LOCK} has lockfileVersion {v}; only {SUPPORTED_LOCK_VERSION} is \
-                     supported — re-lock with pnpm >= 9"
-                ),
-                _ => format!(
-                    "{PNPM_LOCK} has lockfileVersion {v}; this socket-patch build supports \
-                     lockfileVersion {SUPPORTED_LOCK_VERSION} — re-lock with a pnpm release \
-                     that emits it, or update socket-patch"
-                ),
-            })
-        }
-        None => Err(format!(
-            "{PNPM_LOCK} has no lockfileVersion in its head; only \
-             {SUPPORTED_LOCK_VERSION} is supported — re-lock with pnpm >= 9"
-        )),
-    }
-}
-
 /// The package-name component of a pnpm override key
 /// (`[@scope/]name[@range]`, possibly behind a `parent>child` selector
 /// chain — the override targets the LAST segment).
@@ -2297,6 +2224,9 @@ fn matching_blocks<L: EditLines>(
 /// is split afresh. The backend re-seeds the slot with the lock it wrote.
 static LOCK_MEMO: ParseMemo<LockDoc> = ParseMemo::new();
 
+/// [`pnpm_entry_in_use`]'s vendored-uuid set, per lock bytes.
+static IN_USE_MEMO: ParseMemo<HashSet<String>> = ParseMemo::new();
+
 /// One lock's lines plus their [`LockIndex`] — a pure function of the
 /// lines, so of the bytes the memo keys on — built only once the same lines
 /// are probed a second time ([`INDEX_AFTER_PROBES`]).
@@ -2547,9 +2477,6 @@ struct LockIndex {
     first_importer_ver_paren: HashMap<String, usize>,
     first_importer_dep_ver_paren: HashMap<(String, String), usize>,
     first_importer_catalog: HashMap<(String, String), usize>,
-    /// The uuid of every packages/snapshots key resolving into
-    /// `.socket/vendor/npm/<uuid>/` ([`pnpm_entry_in_use`]).
-    vendored_npm_uuids: HashSet<String>,
 }
 
 /// Every prefix of `s` that ends right before a `(`.
@@ -2658,20 +2585,6 @@ impl LockIndex {
                 i = importer.end;
             }
         }
-
-        for section in [&index.packages, &index.snapshots] {
-            for block in &section.blocks {
-                if let Some(parts) = block
-                    .key
-                    .find("@file:")
-                    .map(|at| &block.key[at + 1..])
-                    .and_then(parse_vendor_path)
-                    .filter(|p| p.eco == "npm")
-                {
-                    index.vendored_npm_uuids.insert(parts.uuid);
-                }
-            }
-        }
         index
     }
 
@@ -3245,155 +3158,7 @@ async fn unwind_override_surfaces(
     }
 }
 
-// ───────────────────────────── guarded reads ──────────────────────────────
-
-// ─────────────────────── yaml-ish line-block helpers ──────────────────────
-// pnpm-lock.yaml is machine-emitted with a fixed 2/4/6/8-space shape; these
-// helpers splice line blocks and never interpret YAML generically.
-
-pub(super) fn split_lines(text: &str) -> Vec<String> {
-    text.split('\n').map(str::to_string).collect()
-}
-
-/// `(header_idx, end_idx)` of a top-level `name:` section; `end` is the
-/// first following column-0 line (exclusive), so trailing blank separator
-/// lines belong to the section.
-pub(super) fn section_bounds(lines: &[String], name: &str) -> Option<(usize, usize)> {
-    let header = format!("{name}:");
-    let start = lines.iter().position(|l| l == &header)?;
-    let end = lines
-        .iter()
-        .enumerate()
-        .skip(start + 1)
-        .find(|(_, l)| !l.is_empty() && !l.starts_with(' '))
-        .map(|(i, _)| i)
-        .unwrap_or(lines.len());
-    Some((start, end))
-}
-
-/// One 2-space-keyed block inside a section (`[header, end)`; `end` stops at
-/// the blank separator / next block header, so the captured fragment is the
-/// verbatim entry without surrounding blanks).
-pub(super) struct YamlBlock {
-    pub(super) header: usize,
-    pub(super) end: usize,
-    pub(super) key: String,
-    /// The key exactly as spelled in the file (incl. quotes) — rekeys
-    /// preserve the file's quoting style.
-    repr: String,
-    /// Inline value after `:` (e.g. `{}` for empty snapshots), `""` if none.
-    rest: String,
-}
-
-impl YamlBlock {
-    /// The inline-rest suffix to re-emit after the (re)written key.
-    fn rest_suffix(&self) -> String {
-        if self.rest.is_empty() {
-            String::new()
-        } else {
-            format!(" {}", self.rest)
-        }
-    }
-}
-
-/// The next block at or after line `i` (within `[i, end)`).
-pub(super) fn next_block(lines: &[String], mut i: usize, end: usize) -> Option<YamlBlock> {
-    while i < end {
-        if let Some((key, repr, rest)) = parse_key_line(&lines[i], 2) {
-            let mut j = i + 1;
-            while j < end && !lines[j].is_empty() && indent_of(&lines[j]) >= 4 {
-                j += 1;
-            }
-            return Some(YamlBlock {
-                header: i,
-                end: j,
-                key: key.to_string(),
-                repr: repr.to_string(),
-                rest: rest.to_string(),
-            });
-        }
-        i += 1;
-    }
-    None
-}
-
-pub(super) fn indent_of(line: &str) -> usize {
-    line.len() - line.trim_start_matches(' ').len()
-}
-
-/// Parse a mapping line at exactly `indent` spaces into
-/// `(key, verbatim_key_repr, value_after_colon)`. Accepts pnpm's bare keys
-/// and both quote styles (single quotes are what pnpm emits for `@`-leading
-/// keys); the value separator is the first `:` followed by a space or EOL
-/// (keys themselves contain `:` in `file:` specs).
-///
-/// All three are slices of `line`. Every scan below runs this over whole
-/// `packages:` / `snapshots:` sections once per vendored package, so owning
-/// copies would dominate the surgery's CPU on a multi-megabyte lock. A
-/// caller that keeps a piece past the next edit to `lines` copies it itself.
-pub(super) fn parse_key_line(line: &str, indent: usize) -> Option<(&str, &str, &str)> {
-    if line.len() <= indent || !line.as_bytes()[..indent].iter().all(|&b| b == b' ') {
-        return None;
-    }
-    let s = &line[indent..];
-    let c0 = s.as_bytes()[0];
-    if c0 == b' ' {
-        return None;
-    }
-    if c0 == b'\'' || c0 == b'"' {
-        let quote = c0 as char;
-        let close = s[1..].find(quote)? + 1;
-        let after = &s[close + 1..];
-        let rest = after.strip_prefix(':')?;
-        let rest = rest.strip_prefix(' ').unwrap_or(rest);
-        return Some((&s[1..close], &s[..close + 1], rest));
-    }
-    let bytes = s.as_bytes();
-    for i in 0..bytes.len() {
-        if bytes[i] == b':' && (i + 1 == bytes.len() || bytes[i + 1] == b' ') {
-            if i == 0 {
-                return None;
-            }
-            let rest = if i + 1 < bytes.len() { &s[i + 2..] } else { "" };
-            return Some((&s[..i], &s[..i], rest));
-        }
-    }
-    None
-}
-
-/// Strip one matching pair of surrounding quotes from a mapping VALUE
-/// (pnpm quotes values that would misparse as plain YAML scalars, e.g. the
-/// default-catalog specifier `'catalog:'`).
-fn unquote_value(value: &str) -> &str {
-    let bytes = value.as_bytes();
-    if bytes.len() >= 2
-        && (bytes[0] == b'\'' || bytes[0] == b'"')
-        && bytes[bytes.len() - 1] == bytes[0]
-    {
-        &value[1..value.len() - 1]
-    } else {
-        value
-    }
-}
-
-/// pnpm quotes `@`-leading keys with single quotes; everything we write is
-/// otherwise bare.
-pub(super) fn yaml_key(key: &str) -> String {
-    if key.starts_with('@') {
-        format!("'{key}'")
-    } else {
-        key.to_string()
-    }
-}
-
-/// Re-spell `key` in the same quoting style as the original `repr`.
-pub(super) fn yaml_key_like(key: &str, original_repr: &str) -> String {
-    match original_repr.as_bytes().first() {
-        Some(b'\'') => format!("'{key}'"),
-        Some(b'"') => format!("\"{key}\""),
-        _ => yaml_key(key),
-    }
-}
+// ─────────────────────────── wiring record helpers ──────────────────────────
 
 pub(super) fn lines_value(lines: &[String]) -> Value {
     Value::Array(lines.iter().map(|l| Value::String(l.clone())).collect())
@@ -5285,7 +5050,7 @@ snapshots:
     /// pnpm >= 9" would loop those users back to the lock they have.
     #[test]
     fn lock_version_remedy_is_version_aware() {
-        use super::super::pnpm_lock_legacy::{sniff_lock_grammar, PnpmLockGrammar};
+        use crate::formats::pnpm::{sniff_lock_grammar, PnpmLockGrammar};
 
         assert!(check_lock_version("lockfileVersion: '9.0'\n").is_ok());
         assert_eq!(
@@ -5896,13 +5661,13 @@ snapshots:
         );
     }
 
-    /// A CRLF lock breaks the packages/snapshots section probes, so the
-    /// in-use scan finds nothing and would call a still-referenced artifact
-    /// "provably orphaned" (`Some(false)`) — letting the unwired-revert
-    /// guard delete it out from under the lock. CRLF must be undeterminable
-    /// (`None`), which the guard refuses on while the lock exists.
+    /// A CRLF lock (a Windows autocrlf checkout) must never read as
+    /// "provably orphaned" while it still resolves through the artifact —
+    /// that would let the unwired-revert guard delete it out from under the
+    /// lock. The in-use walk reads CRLF like LF, so it answers `Some(true)`
+    /// and the guard refuses.
     #[tokio::test]
-    async fn crlf_lock_is_undeterminable_for_in_use_and_unwired_revert_refuses() {
+    async fn crlf_lock_reads_as_in_use_and_unwired_revert_refuses() {
         let (fx, entry) = reconstructed_fixture().await;
         let crlf_lock = fx.read(PNPM_LOCK).await.replace('\n', "\r\n");
         tokio::fs::write(fx.root().join(PNPM_LOCK), &crlf_lock)
@@ -5911,8 +5676,8 @@ snapshots:
 
         assert_eq!(
             pnpm_entry_in_use(&entry, fx.root()).await,
-            None,
-            "a CRLF lock is undeterminable, never provably orphaned"
+            Some(true),
+            "a CRLF lock still consuming the artifact reads as in use"
         );
         let outcome = revert_pnpm(&entry, fx.root(), false).await;
         assert!(!outcome.success, "unwired revert must refuse: {outcome:?}");
@@ -8574,13 +8339,12 @@ snapshots:
                     "seed {seed} {name}"
                 );
             }
-            for uuid in [UUID, OTHER_UUID] {
-                assert_eq!(
-                    index.vendored_npm_uuids.contains(uuid),
-                    pnpm_entry_in_use_scan(uuid, &lines),
-                    "seed {seed} in-use {uuid}"
-                );
-            }
+            // The in-use walk reads a CRLF lock like its LF twin.
+            assert_eq!(
+                vendored_npm_uuids(&text),
+                vendored_npm_uuids(&text.replace('\n', "\r\n")),
+                "seed {seed} in-use"
+            );
             for name in NAMES {
                 for version in VERSIONS {
                     let scan = check_rewritable_refs_with(&lines, name, version, None);
diff --git a/crates/socket-patch-core/src/vendor/pnpm_lock_legacy.rs b/crates/socket-patch-core/src/vendor/pnpm_lock_legacy.rs
index f82b4567..5e4236db 100644
--- a/crates/socket-patch-core/src/vendor/pnpm_lock_legacy.rs
+++ b/crates/socket-patch-core/src/vendor/pnpm_lock_legacy.rs
@@ -73,9 +73,12 @@ use super::npm_common::{
 use super::path::parse_vendor_path;
 use super::pnpm_lock::{
     apply_pkg_override, check_lock_override, classify_pkg_override, commit_surfaces, drifted,
-    guard_unwired_revert, lines_value, next_block, overrides_record, parse_key_line,
-    revert_overrides_line, revert_pkg_record, section_bounds, split_lines, value_lines,
-    vendor_value_is_for, yaml_key, yaml_key_like, KIND_LOCK_OVERRIDES,
+    guard_unwired_revert, lines_value, overrides_record, revert_overrides_line,
+    revert_pkg_record, value_lines, vendor_value_is_for, KIND_LOCK_OVERRIDES,
+};
+use crate::formats::pnpm::{sniff_lock_grammar, PnpmLock, PnpmLockGrammar};
+use crate::formats::pnpm::lines::{
+    next_block, parse_key_line, section_bounds, split_lines, yaml_key, yaml_key_like,
 };
 use super::source::PackageSource;
 use super::state::{
@@ -164,67 +167,6 @@ pub fn normalize_canonical_root(path: &str) -> String {
     }
 }
 
-// ───────────────────────────── grammar sniff ──────────────────────────────
-
-/// Which pnpm lock grammar a `pnpm-lock.yaml` head declares.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub(crate) enum PnpmLockGrammar {
-    /// `lockfileVersion: '9.0'` — the [`super::pnpm_lock`] backend.
-    V9,
-    /// `lockfileVersion: 5.4` (pnpm 7, bare float spelling).
-    V54,
-    /// `lockfileVersion: '6.0'` (pnpm 8).
-    V60,
-}
-
-/// The full vendor allowlist sniff (5.4 / 6.0 / 9.0) the flavor router
-/// uses; anything else refuses with a version-aware remedy: pre-allowlist
-/// versions (pnpm <= 6's 5.x line) are fixed by upgrading pnpm, but a
-/// FUTURE version means the user's pnpm already outgrew this build —
-/// looping them back to "re-lock with pnpm >= 9" would hand them the lock
-/// they have.
-pub(crate) fn sniff_lock_grammar(text: &str) -> Result<PnpmLockGrammar, String> {
-    let version = text
-        .lines()
-        .take(5)
-        .find_map(|line| line.strip_prefix("lockfileVersion:"))
-        .map(|rest| rest.trim().trim_matches(['\'', '"']).to_string());
-    match version.as_deref() {
-        Some("9.0") => Ok(PnpmLockGrammar::V9),
-        Some("5.4") => Ok(PnpmLockGrammar::V54),
-        Some("6.0") => Ok(PnpmLockGrammar::V60),
-        Some(v) => {
-            let major = v.split('.').next().and_then(|m| m.parse::<u32>().ok());
-            Err(match major {
-                Some(m) if m < 9 => format!(
-                    "{PNPM_LOCK} has lockfileVersion {v}; supported versions are 5.4 \
-                     (pnpm 7), 6.0 (pnpm 8), and 9.0 (pnpm >= 9) — re-lock with pnpm >= 9"
-                ),
-                _ => format!(
-                    "{PNPM_LOCK} has lockfileVersion {v}; this socket-patch build supports \
-                     lockfileVersions 5.4, 6.0, and 9.0 — re-lock with a pnpm release that \
-                     emits one of them, or update socket-patch"
-                ),
-            })
-        }
-        None => Err(format!(
-            "{PNPM_LOCK} has no lockfileVersion in its head; supported versions are 5.4, \
-             6.0, and 9.0 — re-lock with pnpm >= 9"
-        )),
-    }
-}
-
-impl PnpmLockGrammar {
-    /// Human name for diagnostics (`pnpm 7 (lockfileVersion 5.4)`).
-    fn describe(self) -> &'static str {
-        match self {
-            PnpmLockGrammar::V9 => "pnpm >= 9 (lockfileVersion 9.0)",
-            PnpmLockGrammar::V54 => "pnpm 7 (lockfileVersion 5.4)",
-            PnpmLockGrammar::V60 => "pnpm 8 (lockfileVersion 6.0)",
-        }
-    }
-}
-
 // ───────────────────────────── edit context ──────────────────────────────
 
 struct Ctx<'a> {
@@ -795,27 +737,7 @@ pub async fn pnpm_legacy_entry_in_use(entry: &VendorEntry, project_root: &Path)
         Ok(PnpmLockGrammar::V54 | PnpmLockGrammar::V60) => {}
         _ => return None,
     }
-    // CRLF (a Windows autocrlf checkout) breaks every structural probe
-    // below: the scan would find nothing and call a lock that still
-    // resolves through the artifact "provably orphaned" — undeterminable,
-    // keep (the unwired-revert guard then refuses, fail-closed).
-    if text.contains('\r') {
-        return None;
-    }
-    let lines = split_lines(&text);
-    let Some((start, end)) = section_bounds(&lines, "packages") else {
-        return Some(false);
-    };
-    let mut i = start + 1;
-    while let Some(block) = next_block(&lines, i, end) {
-        let ours =
-            parse_vendor_path(&block.key).is_some_and(|p| p.eco == "npm" && p.uuid == entry.uuid);
-        if ours {
-            return Some(true);
-        }
-        i = block.end;
-    }
-    Some(false)
+    Some(PnpmLock::parse(&text).vendored_in_use(&entry.uuid))
 }
 
 // ─────────────────────────── pre-flight checks ───────────────────────────
@@ -3071,13 +2993,12 @@ packages:
         assert_eq!(pnpm_legacy_entry_in_use(&entry, fx.root()).await, None);
     }
 
-    /// A CRLF-converted lock (a Windows autocrlf checkout) is UNDETERMINABLE
-    /// for the in-use probe — `sniff_lock_grammar` tolerates the `\r` (its
-    /// `trim()` eats it) but every LF-exact section probe misses, so without
-    /// the guard the probe calls a lock that still resolves through the
-    /// artifact "provably orphaned" and the unwired-revert guard deletes it.
+    /// A CRLF-converted lock (a Windows autocrlf checkout) must never read
+    /// as "provably orphaned" while it still resolves through the artifact
+    /// (the unwired-revert guard would delete it): the in-use walk reads
+    /// CRLF like LF and answers `Some(true)`.
     #[tokio::test]
-    async fn crlf_lock_is_undeterminable_for_in_use_and_unwired_revert_refuses() {
+    async fn crlf_lock_reads_as_in_use_and_unwired_revert_refuses() {
         let fx = fixture_with(T_BEFORE_PKG, T7_BEFORE_LOCK).await;
         let (_, entry, _) = expect_done(fx.vendor(false).await);
         let mut entry = entry.unwrap();
@@ -3088,8 +3009,8 @@ packages:
 
         assert_eq!(
             pnpm_legacy_entry_in_use(&entry, fx.root()).await,
-            None,
-            "a CRLF lock is undeterminable, never provably orphaned"
+            Some(true),
+            "a CRLF lock still consuming the artifact reads as in use"
         );
 
         // The empty-wiring (repair-reconstructed) revert rides that verdict.
diff --git a/crates/socket-patch-core/src/vendor/yarn_classic_lock.rs b/crates/socket-patch-core/src/vendor/yarn_classic_lock.rs
index cd65d524..38e5e905 100644
--- a/crates/socket-patch-core/src/vendor/yarn_classic_lock.rs
+++ b/crates/socket-patch-core/src/vendor/yarn_classic_lock.rs
@@ -277,7 +277,7 @@ pub async fn vendor_yarn_classic<'a>(
 /// separates classic from berry, but rewriting a berry lock with classic
 /// grammar would corrupt it — never proceed past a `__metadata:` key.
 fn refuse_berry_lock(text: &str) -> Result<(), Box<VendorOutcome>> {
-    if text.lines().any(|l| l.starts_with("__metadata:")) {
+    if crate::formats::yarn::is_berry_lock(text) {
         return Err(Box::new(refused(
             "vendor_lockfile_version_unsupported",
             "yarn.lock is a yarn berry (v2+) lockfile (top-level `__metadata:` key); the \
diff --git a/crates/socket-patch-core/src/vex/discover/cargo.rs b/crates/socket-patch-core/src/vex/discover/cargo.rs
index 8c537427..86aab22d 100644
--- a/crates/socket-patch-core/src/vex/discover/cargo.rs
+++ b/crates/socket-patch-core/src/vex/discover/cargo.rs
@@ -118,14 +118,12 @@ use super::{
     Discovery, PatchedRef, TomlDiag, UnlockedPin, VendorRef, DIAG_REF_INVALID,
     DIAG_REF_UNATTRIBUTABLE,
 };
+use crate::formats::cargo::{CargoLock, CopyClaim, LockedPackage};
 use crate::utils::digest::is_hex64_lower;
 use crate::vendor::cargo_config::{
     effective_config_rel, patch_entries, registry_definitions, CargoPatchEntry, CONFIG_LEGACY,
     CONFIG_TOML, SOCKET_REGISTRY_PREFIX,
 };
-use crate::vendor::cargo_lock::{
-    locked_packages, unused_patches, vendored_copy_claim, CopyClaim, LockedPackage,
-};
 use crate::vendor::cargo_manifest::{crates_io_url_alias_tables, is_crates_io_source};
 use crate::vendor::cargo_tag;
 use crate::vendor::lock_inventory::LockIntegrity;
@@ -269,26 +267,21 @@ fn unattributed_tags(lock: &Lock, wired: &[VendorRef], out: &mut Discovery) {
 
 // ── reads ────────────────────────────────────────────────────────────────
 
-/// The state of the root `Cargo.lock`, read through the vendor backend's
-/// own lock model ([`locked_packages`] / [`unused_patches`]).
+/// The state of the root `Cargo.lock`, read through the format's model
+/// ([`CargoLock`]).
 #[derive(Debug)]
 enum Lock {
     /// No lock (or unreadable — diagnosed by the read).
     Absent,
     /// Present but not TOML (diagnosed).
     Unparseable,
-    Parsed {
-        pkgs: Vec<LockedPackage>,
-        /// `(name, version)` of every `[[patch.unused]]` entry: a `[patch]`
-        /// cargo resolved and then did NOT use in the crate graph.
-        unused: Vec<(String, String)>,
-    },
+    Parsed(CargoLock),
 }
 
 impl Lock {
     fn packages(&self) -> &[LockedPackage] {
         match self {
-            Lock::Parsed { pkgs, .. } => pkgs,
+            Lock::Parsed(lock) => lock.packages(),
             Lock::Absent | Lock::Unparseable => &[],
         }
     }
@@ -305,10 +298,7 @@ async fn load_lock(ctx: &DiscoverCtx<'_>, out: &mut Discovery) -> Lock {
     // checksums read as the same pin the inline v2+ `checksum` is — the
     // hosted rewriter writes it there for a v1 lock); `[[patch.unused]]` is
     // never a package — it is the "not wired" shape, kept apart.
-    Lock::Parsed {
-        pkgs: locked_packages(&doc),
-        unused: unused_patches(&doc),
-    }
+    Lock::Parsed(CargoLock::from_doc(&doc))
 }
 
 /// Guarded read + parse of a TOML file (`None`: missing, unreadable, or
@@ -747,9 +737,9 @@ async fn vendored_from_patches(
             }
         }
         let copy_tagged = matches!(tag, CopyTag::Tagged(_) | CopyTag::Unreadable);
-        if let Lock::Parsed { pkgs, unused } = lock {
+        if let Lock::Parsed(lock) = lock {
             let why =
-                match vendored_copy_claim(pkgs, unused, name, version, &vref.uuid, copy_tagged) {
+                match lock.vendored_in_use(name, version, &vref.uuid, copy_tagged) {
                     CopyClaim::Consumed => None,
                     CopyClaim::OtherTag(other) => Some(format!(
                         "{CARGO_LOCK} builds the copy tagged for patch {other} ({name} {})",
diff --git a/crates/socket-patch-core/src/vex/discover/composer.rs b/crates/socket-patch-core/src/vex/discover/composer.rs
index 8562e74b..568d9ca5 100644
--- a/crates/socket-patch-core/src/vex/discover/composer.rs
+++ b/crates/socket-patch-core/src/vex/discover/composer.rs
@@ -61,7 +61,7 @@ use super::{
     DiscoverCtx, Discovery, LocateOpts, PatchedRef, DIAG_LOCKFILE_UNPARSEABLE, DIAG_REF_INVALID,
 };
 use crate::crawlers::composer_crawler::normalize_version;
-use crate::vendor::lock_inventory::{composer_lock_packages, ComposerLockPackage};
+use crate::formats::composer::{ComposerLock, ComposerLockPackage};
 
 /// The lock both backends rewrite (root-relative).
 const COMPOSER_LOCK: &str = "composer.lock";
@@ -89,8 +89,8 @@ pub(crate) async fn extract(ctx: &DiscoverCtx<'_>, out: &mut Discovery) {
     // The inventory's own walk: `packages` then `packages-dev` (a missing
     // or non-array section — composer writes `"packages-dev": []`, older /
     // hand-trimmed locks may omit it — is simply empty).
-    for entry in composer_lock_packages(&doc) {
-        entry_ref(ctx, file, &entry, out);
+    for entry in ComposerLock::from_doc(&doc).packages() {
+        entry_ref(ctx, file, entry, out);
     }
 }
 
diff --git a/crates/socket-patch-core/src/vex/discover/gem.rs b/crates/socket-patch-core/src/vex/discover/gem.rs
index da1ef1e9..77f7388a 100644
--- a/crates/socket-patch-core/src/vex/discover/gem.rs
+++ b/crates/socket-patch-core/src/vex/discover/gem.rs
@@ -10,7 +10,7 @@
 //!
 //! ## Lock grammar
 //!
-//! Read with the lock inventory's own model ([`gemfile_lock`]): column-0
+//! Read with the lock inventory's own model ([`GemfileLock`]): column-0
 //! section headers, 2-space `remote:` keys, 4-space `specs:` entries,
 //! `CHECKSUMS` and `DEPENDENCIES` pins, CRLF tolerated. A file the model
 //! flags — conflict markers, indented text before the first header, or no
@@ -126,8 +126,8 @@ use super::{
     PatchedRef, DIAG_LOCKFILE_UNPARSEABLE, DIAG_REF_INVALID, DIAG_REF_UNATTRIBUTABLE,
 };
 use crate::vendor::gem::{gem_declaration_any, quoted_literal};
-use crate::vendor::gemfile_lock::{
-    self, bundler_manifest_for, same_remote, GemfileLock, Section, SpecLine, BUNDLER_LOCKS,
+use crate::formats::gem::{
+    bundler_manifest_for, same_remote, GemfileLock, Section, SpecLine, BUNDLER_LOCKS,
 };
 
 pub(crate) async fn extract(ctx: &DiscoverCtx<'_>, out: &mut Discovery) {
@@ -136,7 +136,7 @@ pub(crate) async fn extract(ctx: &DiscoverCtx<'_>, out: &mut Discovery) {
         let Some(text) = ctx.read_text(file, out).await else {
             continue;
         };
-        let lock = gemfile_lock::parse(&text);
+        let lock = GemfileLock::parse(&text);
         // A readable lock with a `GEM` section listing several remotes.
         let merged = lock.problems.is_empty() && lock.gem_sections().any(|s| s.remotes.len() > 1);
         let blocks = if merged {
diff --git a/crates/socket-patch-core/src/vex/discover/maven.rs b/crates/socket-patch-core/src/vex/discover/maven.rs
index 9908e52c..d90720e7 100644
--- a/crates/socket-patch-core/src/vex/discover/maven.rs
+++ b/crates/socket-patch-core/src/vex/discover/maven.rs
@@ -93,7 +93,7 @@ use crate::patch::redirect::{
 };
 use crate::utils::digest::sha256_hex;
 use crate::vendor::lock_inventory::LockIntegrity;
-use crate::vendor::maven_pom::{
+use crate::formats::maven::{
     is_maven_coordinate, is_maven_version_text, parse_pom, split_socket_version, Pom, PomDep,
     PomRepo,
 };
diff --git a/crates/socket-patch-core/src/vex/discover/mod.rs b/crates/socket-patch-core/src/vex/discover/mod.rs
index 5f895fca..9a923263 100644
--- a/crates/socket-patch-core/src/vex/discover/mod.rs
+++ b/crates/socket-patch-core/src/vex/discover/mod.rs
@@ -33,10 +33,10 @@
 //! (`npm_lock_nodes`, `pnpm::pnpm_packages`, `yarn::classic_entries` /
 //! `berry_entries`, `BunLockb::parse_packages`, `vlt::vlt_lock_model`) and,
 //! for the other formats, the readers the writers own (`cargo_lock` /
-//! `cargo_config`, `go_mod_edit` / `go_sum_edit`, `gemfile_lock`,
-//! `composer_lock_packages`, the
+//! `cargo_config`, `go_mod_edit` / `go_sum_edit`, `formats::gem`,
+//! `formats::composer`, the
 //! `utils::python_lock` / `poetry_lock` / `requirements` / `hatch` readers,
-//! `maven_pom`, `nuget_config` / `nuget_feed`). The inventory's registry
+//! `formats::maven`, `nuget_config` / `nuget_feed`). The inventory's registry
 //! views drop the Socket-owned entries (they feed registry discovery and
 //! fetches); the extractors here classify and validate exactly those. File
 //! selection and I/O stay with each consumer: discovery reads every present
@@ -1738,33 +1738,15 @@ pub async fn vendored_wiring_live(root: &Path, recorded: &[&str], eco: &str, uui
 }
 
 /// The root files a vendored `eco` artifact can be wired from — the vendor
-/// backends' lockfile / wiring config for that ecosystem (npm: every
-/// npm-family lock the `vendor_probe` table flags, `vlt-lock.json`
-/// included; cargo: the root `Cargo.toml` `[patch.crates-io]` table and the
+/// backends' lockfile / wiring config for that ecosystem, the format
+/// registry's [`crate::formats::registry::PROBE`] rows (npm: every
+/// npm-family lock, `vlt-lock.json` included; cargo: the root `Cargo.toml` `[patch.crates-io]` table and the
 /// pre-v5 `.cargo/config.toml` / `.cargo/config` spellings; maven /
 /// nuget: the repository / source that serves the vendored dir). Manifests
 /// such as package.json are deliberately absent: the lock is what the
 /// install consumes.
 pub fn vendored_wiring_probe_files(root: &Path, eco: &str) -> Vec<String> {
-    let fixed: Vec<&str> = match eco {
-        "npm" => crate::constants::npm_family::names_with(|r| r.vendor_probe),
-        "pypi" => vec![
-            "uv.lock",
-            "poetry.lock",
-            "pdm.lock",
-            "Pipfile.lock",
-            "requirements.txt",
-            "pyproject.toml",
-            "hatch.toml",
-        ],
-        "cargo" => vec!["Cargo.toml", ".cargo/config.toml", ".cargo/config"],
-        "golang" => vec!["go.mod"],
-        "gem" => vec!["Gemfile.lock"],
-        "composer" => vec!["composer.lock"],
-        "maven" => vec!["pom.xml"],
-        "nuget" => crate::vendor::nuget_config::CONFIG_NAMES.to_vec(),
-        _ => Vec::new(),
-    };
+    let fixed = crate::formats::registry::probe_paths(eco);
     let mut files: Vec<String> = fixed.into_iter().map(str::to_string).collect();
     if eco == "pypi" {
         // pylock.toml / pylock.<name>.toml / *.py.lock.
diff --git a/crates/socket-patch-core/src/vex/discover/npm.rs b/crates/socket-patch-core/src/vex/discover/npm.rs
index a9ddfe3a..3dbfcc55 100644
--- a/crates/socket-patch-core/src/vex/discover/npm.rs
+++ b/crates/socket-patch-core/src/vex/discover/npm.rs
@@ -47,14 +47,12 @@ use super::{
     DIAG_REF_UNATTRIBUTABLE,
 };
 use crate::constants::npm_family::{NPM_LOCKS, PNPM_LOCK, PNPM_SHRINKWRAP_LEGACY};
-use crate::patch::redirect::pnpm::{entry_field, is_pnpm_lock_text};
-use crate::utils::digest::is_sri_pin;
-use crate::vendor::lock_inventory::pnpm::{
-    classify_pnpm_key, pnpm_packages, rush_lock_rels, PnpmKey, PnpmPackage,
-};
-use crate::vendor::lock_inventory::{
-    npm_lock_nodes, pnpm_registry_key, LockIntegrity, NpmLockNode,
+use crate::formats::pnpm::{
+    classify_pnpm_key, entry_field, pnpm_registry_key, PnpmKey, PnpmLock, PnpmPackage,
 };
+use crate::utils::digest::is_sri_pin;
+use crate::vendor::lock_inventory::pnpm::rush_lock_rels;
+use crate::vendor::lock_inventory::{npm_lock_nodes, LockIntegrity, NpmLockNode};
 
 pub(crate) async fn extract(ctx: &DiscoverCtx<'_>, out: &mut Discovery) {
     let mut locks: Vec<NpmLockRefs> = Vec::new();
@@ -267,14 +265,14 @@ fn entry_ref(
 /// `pnpm-workspace.yaml`) is configuration that routes nothing once no
 /// dependency in the graph matches it (rule 10: pins, not definitions). The
 /// entries come from the entry model the lock inventory shares
-/// ([`pnpm_packages`]), which reads the hosted rewriter's own block grammar
+/// ([`PnpmLock::packages`]), which reads the hosted rewriter's own block grammar
 /// (two-space keys, a flat flow or block `resolution:` map), so every shape
 /// it writes is read back identically, CRLF included; keys are classified
 /// by [`classify_pnpm_key`]. An entry is a ref when its `resolution`
 /// `tarball:` is
 ///
 /// * a Socket-HOSTED url ([`DiscoverCtx::hosted_uuid`]) →
-///   [`WiringMode::Hosted`]. The hosted rewriter (`rewrite_pnpm_lock`) keeps
+///   [`WiringMode::Hosted`]. The hosted rewriter (`formats::pnpm::plan_hosted`) keeps
 ///   the registry KEY and replaces only the resolution with `{integrity:
 ///   sha512-…, tarball: <url>}` (or the block-map spelling in pnpm <= 5
 ///   locks), so name@version come from the key in each generation's grammar
@@ -326,7 +324,8 @@ async fn extract_pnpm_lock(ctx: &DiscoverCtx<'_>, file: &str, out: &mut Discover
     let Some(text) = ctx.read_text(file, out).await else {
         return;
     };
-    if !is_pnpm_lock_text(&text) {
+    let lock = PnpmLock::parse(&text);
+    if !lock.is_pnpm_lock() {
         out.diag(
             DIAG_LOCKFILE_UNPARSEABLE,
             file,
@@ -334,8 +333,8 @@ async fn extract_pnpm_lock(ctx: &DiscoverCtx<'_>, file: &str, out: &mut Discover
         );
         return;
     }
-    for package in pnpm_packages(&text) {
-        pnpm_entry_ref(ctx, file, &package, out);
+    for package in lock.packages() {
+        pnpm_entry_ref(ctx, file, package, out);
     }
 }
 
diff --git a/crates/socket-patch-core/src/vex/discover/nuget.rs b/crates/socket-patch-core/src/vex/discover/nuget.rs
index 61006586..d7f3cd95 100644
--- a/crates/socket-patch-core/src/vex/discover/nuget.rs
+++ b/crates/socket-patch-core/src/vex/discover/nuget.rs
@@ -74,7 +74,8 @@ use super::{
     DIAG_REF_UNATTRIBUTABLE,
 };
 use crate::vendor::lock_inventory::LockIntegrity;
-use crate::vendor::nuget_config::{parse_config, same_file, NugetConfig, CONFIG_NAMES};
+use crate::formats::nuget::{parse_config, NugetConfig};
+use crate::vendor::nuget_config::{same_file, CONFIG_NAMES};
 use crate::vendor::nuget_feed::{is_plain_nuget_token, nuget_lock_entries, nupkg_leaf};
 use crate::vendor::path::VENDOR_DIR;
 

From f6bdad5436ac89f703cf44c7f6fb06ffa1c9726f Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Mon, 28 Sep 2026 21:19:31 +0200
Subject: [PATCH 21/32] v5: remove `setup` (WS7) + patch UI streamlining (WS8)
 (#279)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Remove the setup subcommand and its install hooks (v5 WS7)

`socket-patch setup` (and --check/--remove/--exclude) is gone, with every
install hook it wired: npm postinstall/dependencies scripts, the
socket-patch[hook] .pth wheel, the in-tree Bundler plugin + Gemfile block,
and Composer post-install/update scripts. `apply` stays; agent mode in CI
is `scan --mode agent` once, then `socket-patch apply` after each install.

Deleted: commands/setup.rs, core setup/** and the setup-only package_json
helpers, the setup tests and setup-matrix suites, the setup-e2e feature,
the setup-matrix CI job, tests/setup_matrix and scripts/setup-matrix.sh.
vex's install-hook "Property 7" filter goes with it. The socket-patch-hook
wheel and socket-patch-bundler gem are dropped from the build and publish
workflows (sources kept, frozen, pending an owner decision).

Also the plan's small follow-ups: drop the core crate's deprecated
re-export aliases (and the CI grep that guarded them), the unused
utils::process::tool_command, the vacuous e2e_cargo/e2e_golang CI rows,
add the merged 01019627 and 9c2b4925 gem patches to the vendored
production e2e, and retire the backtest-poetry "known crawler gap" label.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PQaKzoW5dSw9u5pgAAvVRj

* Streamline the patch UI (v5 WS8)

- `-h` lists about eight options per command (`cli_command()` marks the
  rest hide_short_help; `--help` is unchanged); `scan --apply/--vendor`
  are hidden (still accepted).
- Human warnings drop the `(code)` tag (`Warning: …`, `GC: skipped: …`);
  JSON keeps every code. Error lines keep theirs.
- Human text says "hosted", not "redirect" (JSON keys unchanged).
- npm's allow-remote notice is one line; `--verbose`/JSON keep the full
  policy text.
- One `ui::next_steps` renderer for hosted and vendored results.
- Hosted and vendored `get` never prompt: top-ranked patch per package,
  like scan, in JSON too. Agent-mode `get` keeps its picker and confirm.
- `list` with nothing to list says `No patches in this project. Run
  \`socket-patch scan\`.` (exit codes unchanged: 1 missing, 0 empty).
- One cancel line (`ui::CANCELLED`) and one paid upsell (`ui::PAID_UPGRADE`).
- `get`'s self-enforced flag conflicts and `rollback --one-off` exit 2,
  like every other usage error.

Docs: CLI_CONTRACT (human output conventions, exit codes, get prompts),
README, CHANGELOG [Unreleased], v5 plan status. Tests updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PQaKzoW5dSw9u5pgAAvVRj

* Pin the real-vlt get_and_remove leg to --mode agent

`get <uuid>` defaults to hosted since v5, so the leg's in-place
patched/pristine assertions need agent mode spelled out.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PQaKzoW5dSw9u5pgAAvVRj

* Match the hosted-ledger persist-failure wording in two covgap tests

These chmod-guarded tests skip under root, so the WS8 wording change
("hosted redirect ledger" -> "hosted ledger") only showed up in CI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PQaKzoW5dSw9u5pgAAvVRj

* Empty list exits 0; group help by task; document the setup upgrade

Review follow-ups:
- `list` on a project with no manifest and no ledger record is an empty
  list: exit 0, the empty-project line (human) or the success envelope
  with `events: []` (`--json`). Only an unreadable or invalid manifest
  fails. Hosted mode writes no manifest, so this is the normal case.
- Root help groups the commands by task (patch, undo, ship, agent mode)
  instead of calling get/rollback/remove "older agent-mode commands";
  the subcommand list follows the same order. `-h` keeps --cwd,
  --ecosystems and --offline, and moves `scan --prune` to --help.
- README gains "Upgrading from `setup`": move to hosted or keep agent
  mode, and the exact hook to delete per ecosystem. The CHANGELOG and
  the frozen hook/plugin READMEs link it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PQaKzoW5dSw9u5pgAAvVRj

* Carry the hosted wording and code-free warnings onto #280's new tests and docs

#280 added tests and contract lines with the pre-WS8 human strings
("Would redirect", "<purl> redirected, but its patch record ...",
`Warning (<code>): ...`). Switch them to this branch's conventions.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PQaKzoW5dSw9u5pgAAvVRj

* Give the cargo safety VEX baseline a vulnerability to attest

With setup's install-hook filter gone, the manifest-backed agent-mode
cargo patch attests, but the staged minimal manifest carries no
vulnerabilities, so vex ended no_applicable_patches (exit 1). Add one
vulnerability to the entry before the baseline run.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PQaKzoW5dSw9u5pgAAvVRj

---------

Co-authored-by: Claude <noreply@anthropic.com>
---
 .github/workflows/ci.yml                      |  119 +-
 .github/workflows/publish-pypi.yml            |   24 +-
 .github/workflows/publish-rubygems.yml        |   53 +-
 .github/workflows/release.yml                 |    5 +-
 .github/workflows/vlt-compatibility.yml       |    2 -
 CHANGELOG.md                                  |  133 +-
 README.md                                     |  362 +-
 crates/socket-patch-cli/CLI_CONTRACT.md       |  313 +-
 crates/socket-patch-cli/Cargo.toml            |   10 -
 crates/socket-patch-cli/src/args.rs           |   40 +-
 crates/socket-patch-cli/src/commands/apply.rs |   11 +-
 crates/socket-patch-cli/src/commands/get.rs   |  112 +-
 crates/socket-patch-cli/src/commands/list.rs  |   23 +-
 crates/socket-patch-cli/src/commands/mod.rs   |  126 +-
 .../socket-patch-cli/src/commands/remove.rs   |   28 +-
 .../socket-patch-cli/src/commands/repair.rs   |   10 +-
 .../socket-patch-cli/src/commands/rollback.rs |   21 +-
 .../socket-patch-cli/src/commands/scan/gc.rs  |    8 +-
 .../src/commands/scan/hosted.rs               |  219 +-
 .../src/commands/scan/hosted/python.rs        |    2 +-
 .../src/commands/scan/hosted/vlt.rs           |    2 +-
 .../socket-patch-cli/src/commands/scan/mod.rs |   55 +-
 .../src/commands/scan/render.rs               |    6 +-
 crates/socket-patch-cli/src/commands/setup.rs | 3018 -----------------
 .../socket-patch-cli/src/commands/update.rs   |   17 +-
 .../socket-patch-cli/src/commands/vendor.rs   |   68 +-
 crates/socket-patch-cli/src/commands/vex.rs   |  282 +-
 .../src/commands/vex_consumed.rs              |    2 +-
 .../src/commands/vex_sources.rs               |   10 +-
 .../src/ecosystem_dispatch.rs                 |   37 +-
 .../socket-patch-cli/src/hosted_memory/mod.rs |    4 +-
 .../src/hosted_memory/redirect.rs             |    2 +-
 crates/socket-patch-cli/src/json_envelope.rs  |    4 +-
 crates/socket-patch-cli/src/lib.rs            |  144 +-
 crates/socket-patch-cli/src/main.rs           |    1 -
 crates/socket-patch-cli/src/ui/mod.rs         |   16 +-
 crates/socket-patch-cli/src/ui/prompt.rs      |   18 -
 crates/socket-patch-cli/src/ui/text.rs        |   32 +
 .../tests/apply_invariants.rs                 |    2 +-
 .../socket-patch-cli/tests/apply_network.rs   |    2 +-
 .../tests/cli_argv_non_utf8.rs                |    4 +-
 .../tests/cli_config_fallback.rs              |   91 -
 .../tests/cli_env_deprecation.rs              |   48 +-
 .../tests/cli_gem_variant_mismatch_policy.rs  |    8 +-
 .../socket-patch-cli/tests/cli_global_args.rs |   10 +-
 .../socket-patch-cli/tests/cli_parse_list.rs  |  132 +-
 .../socket-patch-cli/tests/cli_parse_main.rs  |   11 +-
 .../socket-patch-cli/tests/cli_parse_setup.rs |  558 ---
 .../tests/cli_remove_silent.rs                |   10 +-
 .../tests/cli_setup_silent.rs                 |  308 --
 crates/socket-patch-cli/tests/cli_sigpipe.rs  |    2 +-
 ...overage_fix_scan_hosted_dryrun_vendored.rs |   10 +-
 .../tests/covgap_commands_apply.rs            |    4 +-
 .../tests/covgap_commands_get.rs              |   16 +-
 .../tests/covgap_commands_remove.rs           |    8 +-
 .../tests/covgap_commands_rollback.rs         |    6 +-
 .../tests/covgap_commands_scan_hosted.rs      |   67 +-
 .../tests/covgap_commands_scan_mod.rs         |   25 +-
 .../tests/covgap_commands_setup.rs            | 1979 -----------
 .../tests/covgap_commands_update.rs           |    4 +-
 .../tests/covgap_commands_vendor.rs           |    2 +-
 .../tests/covgap_commands_vex.rs              |   16 +-
 .../socket-patch-cli/tests/covgap_output.rs   |    9 +-
 .../tests/covgap_setup_composer_mod.rs        |  146 -
 .../tests/covgap_setup_gem_mod.rs             |  164 -
 .../tests/covgap_setup_gem_version.rs         |  198 --
 .../tests/covgap_setup_pypi_detect.rs         |  230 --
 .../tests/docker_e2e_cargo.rs                 |    7 +-
 .../tests/docker_e2e_composer.rs              |    7 +-
 .../socket-patch-cli/tests/docker_e2e_gem.rs  |    7 +-
 .../tests/docker_e2e_golang.rs                |    7 +-
 .../tests/docker_e2e_maven.rs                 |    7 +-
 .../socket-patch-cli/tests/docker_e2e_npm.rs  |   17 +-
 .../tests/docker_e2e_nuget.rs                 |    7 +-
 .../socket-patch-cli/tests/docker_e2e_pypi.rs |    7 +-
 .../tests/e2e_embedded_vex.rs                 |   23 +-
 .../tests/e2e_redirect_gem_stale_install.rs   |    6 +-
 .../tests/e2e_safety_cargo_build.rs           |   33 +-
 .../socket-patch-cli/tests/e2e_safety_lock.rs |    2 +-
 .../socket-patch-cli/tests/e2e_safety_vlt.rs  |   20 +-
 .../tests/e2e_safety_yarn_pnp.rs              |    8 +-
 .../tests/e2e_vendored_production.rs          |   14 +
 crates/socket-patch-cli/tests/e2e_vex.rs      |   40 +-
 .../tests/e2e_vex_build/deno.rs               |    3 -
 .../tests/e2e_vex_lockfile/deno.rs            |   13 +-
 .../tests/e2e_vex_lockfile/maven.rs           |   11 -
 .../tests/e2e_vex_lockfile/nuget.rs           |    7 -
 .../tests/e2e_vex_redirect.rs                 |   42 +-
 .../socket-patch-cli/tests/e2e_vex_vendor.rs  |  225 +-
 crates/socket-patch-cli/tests/e2e_vlt.rs      |  284 +-
 .../tests/ecosystem_dispatch_e2e.rs           |   37 +-
 .../tests/get_edge_cases_e2e.rs               |    2 +-
 .../socket-patch-cli/tests/get_modes_e2e.rs   |   14 +-
 .../tests/help_text_hygiene.rs                |   52 +-
 .../tests/in_process_gem_config_warning.rs    |    4 +-
 .../socket-patch-cli/tests/in_process_get.rs  |    4 +-
 .../tests/in_process_get_modes.rs             |    2 +-
 .../tests/in_process_redirect.rs              |   17 +-
 .../tests/in_process_redirect_poetry.rs       |    5 +-
 .../socket-patch-cli/tests/in_process_scan.rs |    9 +-
 .../tests/interactive_prompts_e2e.rs          |  174 +-
 .../tests/output_modes_e2e.rs                 |   59 +-
 .../tests/redirect_npm_allow_remote.rs        |   20 +-
 .../tests/repair_invariants.rs                |    2 +-
 .../tests/rollback_invariants.rs              |   13 +-
 .../socket-patch-cli/tests/scan_invariants.rs |    4 +-
 .../tests/scan_ordered_concurrency_e2e.rs     |    6 +-
 .../socket-patch-cli/tests/scan_vendor_e2e.rs |    2 +-
 .../tests/setup_contract_gaps.rs              |  843 -----
 .../tests/setup_invariants.rs                 | 1427 --------
 .../tests/setup_matrix_common/mod.rs          |  715 ----
 .../tests/setup_matrix_composer.rs            |  363 --
 .../tests/setup_matrix_deno.rs                |  370 --
 .../tests/setup_matrix_env_guard.rs           |  114 -
 .../tests/setup_matrix_gem.rs                 | 1874 ----------
 .../tests/setup_matrix_maven.rs               |  460 ---
 .../tests/setup_matrix_monorepo.rs            |  329 --
 .../tests/setup_matrix_npm.rs                 |  300 --
 .../tests/setup_matrix_nuget.rs               |  321 --
 .../tests/setup_matrix_pypi.rs                |  535 ---
 .../tests/setup_matrix_static.rs              |   91 -
 .../tests/setup_pth_invariants.rs             |  624 ----
 .../tests/setup_terminal_output.rs            |  273 --
 .../tests/vex_terminal_output.rs              |   54 +-
 .../tests/vlt-leg-manifest.json               |   65 -
 .../tests/vlt_e2e_common/fixture.rs           |    2 +-
 .../tests/vlt_hosted_common/mod.rs            |    4 +-
 crates/socket-patch-core/src/constants.rs     |    4 -
 .../src/crawlers/npm_crawler.rs               |    4 +-
 .../src/crawlers/ruby_crawler.rs              |   37 +-
 crates/socket-patch-core/src/lib.rs           |    9 -
 .../socket-patch-core/src/manifest/schema.rs  |   16 +-
 .../src/package_json/detect.rs                | 1266 -------
 .../src/package_json/find.rs                  | 2095 ------------
 .../socket-patch-core/src/package_json/mod.rs |    3 -
 .../src/package_json/update.rs                |  903 -----
 crates/socket-patch-core/src/patch/apply.rs   |    4 +-
 crates/socket-patch-core/src/patch/mod.rs     |    8 -
 .../src/patch/redirect/mod.rs                 |    2 +-
 .../src/setup/composer/mod.rs                 |  935 -----
 crates/socket-patch-core/src/setup/gem/mod.rs | 2157 ------------
 .../src/setup/gem/templates/gemspec.tmpl      |   22 -
 .../src/setup/gem/templates/plugins.rb.tmpl   |  306 --
 .../socket-patch-core/src/setup/gem/update.rs | 1253 -------
 .../src/setup/gem/version.rs                  |  427 ---
 crates/socket-patch-core/src/setup/mod.rs     |   20 -
 crates/socket-patch-core/src/setup/npm.rs     |   10 -
 .../src/setup/pypi/detect.rs                  |  429 ---
 .../socket-patch-core/src/setup/pypi/edit.rs  | 1297 -------
 .../socket-patch-core/src/setup/pypi/mod.rs   |   20 -
 crates/socket-patch-core/src/telemetry.rs     |   21 +-
 .../socket-patch-core/src/update/channel.rs   |    2 +-
 crates/socket-patch-core/src/utils/fs.rs      |    4 +-
 crates/socket-patch-core/src/utils/hatch.rs   |   10 +-
 crates/socket-patch-core/src/utils/mod.rs     |    9 -
 crates/socket-patch-core/src/utils/process.rs |   16 +-
 crates/socket-patch-core/src/utils/serde.rs   |    9 +
 .../src/utils/toml_edit_ext.rs                |    4 +-
 .../src/vendor/npm_common.rs                  |    2 +-
 .../socket-patch-core/src/vendor/npm_dir.rs   |    2 +-
 crates/socket-patch-core/src/vendor/pypi.rs   |    8 +-
 .../src/vendor/pypi_hatch.rs                  |    2 +-
 .../src/vendor/pypi_requirements.rs           |   10 +-
 .../socket-patch-core/src/vendor/vlt_lock.rs  |    4 +-
 .../src/vendor/vlt_lock_text.rs               |   12 +-
 crates/socket-patch-core/src/vex/product.rs   |    2 +-
 .../tests/crawler_monorepo_gaps.rs            |    5 +-
 .../tests/crawler_npm_e2e.rs                  |    4 +-
 .../tests/crawler_ruby_e2e.rs                 |   11 +-
 docs/design/v5-plan.md                        |   28 +
 docs/ecosystems.md                            |   22 +-
 docs/testing/hatch.md                         |    2 +-
 docs/testing/poetry-compatibility.md          |    7 +-
 docs/testing/vendored-production-e2e.md       |    2 +-
 docs/testing/vlt-compatibility.md             |   13 +-
 docs/testing/vlt-coverage.json                |   25 -
 docs/testing/yarn-berry-compatibility.md      |    4 -
 gem/socket-patch-bundler/README.md            |    7 +
 gem/socket-patch/lib/socket_patch/launcher.rb |    2 +-
 gem/socket-patch/socket-patch.gemspec         |    4 +-
 pypi/socket-patch-hook/README.md              |    8 +
 pypi/socket-patch/pyproject.toml              |    9 -
 pypi/socket-patch/socket_patch/__init__.py    |    3 +-
 scripts/backtest-poetry.py                    |   45 +-
 scripts/build-pypi-wheels.py                  |  114 +-
 scripts/burn-down-tests.ts                    |    2 +-
 scripts/harden-tests.config.ts                |    2 +-
 scripts/optimize-test-perf.config.ts          |    4 +-
 scripts/setup-matrix.sh                       |  299 --
 scripts/tests/test_check_vlt_legs.py          |    2 -
 scripts/tests/test_vlt_coverage.py            |    6 +-
 scripts/version-sync.sh                       |   20 +-
 tests/docker/Dockerfile.gem-b1                |   46 -
 tests/docker/Dockerfile.gem-b4                |   45 -
 tests/docker/Dockerfile.npm                   |   11 +-
 tests/docker/Dockerfile.pypi                  |    4 +-
 tests/docker/README.md                        |   99 -
 tests/setup_matrix/README.md                  |  194 --
 tests/setup_matrix/matrix.json                |  318 --
 tests/setup_matrix/results/.gitignore         |    3 -
 tests/setup_matrix/run-case.sh                |  883 -----
 tests/setup_matrix/shims/npx                  |   45 -
 tests/setup_matrix/shims/pnpm                 |   38 -
 203 files changed, 1535 insertions(+), 31541 deletions(-)
 delete mode 100644 crates/socket-patch-cli/src/commands/setup.rs
 delete mode 100644 crates/socket-patch-cli/tests/cli_parse_setup.rs
 delete mode 100644 crates/socket-patch-cli/tests/cli_setup_silent.rs
 delete mode 100644 crates/socket-patch-cli/tests/covgap_commands_setup.rs
 delete mode 100644 crates/socket-patch-cli/tests/covgap_setup_composer_mod.rs
 delete mode 100644 crates/socket-patch-cli/tests/covgap_setup_gem_mod.rs
 delete mode 100644 crates/socket-patch-cli/tests/covgap_setup_gem_version.rs
 delete mode 100644 crates/socket-patch-cli/tests/covgap_setup_pypi_detect.rs
 delete mode 100644 crates/socket-patch-cli/tests/setup_contract_gaps.rs
 delete mode 100644 crates/socket-patch-cli/tests/setup_invariants.rs
 delete mode 100644 crates/socket-patch-cli/tests/setup_matrix_common/mod.rs
 delete mode 100644 crates/socket-patch-cli/tests/setup_matrix_composer.rs
 delete mode 100644 crates/socket-patch-cli/tests/setup_matrix_deno.rs
 delete mode 100644 crates/socket-patch-cli/tests/setup_matrix_env_guard.rs
 delete mode 100644 crates/socket-patch-cli/tests/setup_matrix_gem.rs
 delete mode 100644 crates/socket-patch-cli/tests/setup_matrix_maven.rs
 delete mode 100644 crates/socket-patch-cli/tests/setup_matrix_monorepo.rs
 delete mode 100644 crates/socket-patch-cli/tests/setup_matrix_npm.rs
 delete mode 100644 crates/socket-patch-cli/tests/setup_matrix_nuget.rs
 delete mode 100644 crates/socket-patch-cli/tests/setup_matrix_pypi.rs
 delete mode 100644 crates/socket-patch-cli/tests/setup_matrix_static.rs
 delete mode 100644 crates/socket-patch-cli/tests/setup_pth_invariants.rs
 delete mode 100644 crates/socket-patch-cli/tests/setup_terminal_output.rs
 delete mode 100644 crates/socket-patch-core/src/package_json/detect.rs
 delete mode 100644 crates/socket-patch-core/src/package_json/find.rs
 delete mode 100644 crates/socket-patch-core/src/package_json/mod.rs
 delete mode 100644 crates/socket-patch-core/src/package_json/update.rs
 delete mode 100644 crates/socket-patch-core/src/setup/composer/mod.rs
 delete mode 100644 crates/socket-patch-core/src/setup/gem/mod.rs
 delete mode 100644 crates/socket-patch-core/src/setup/gem/templates/gemspec.tmpl
 delete mode 100644 crates/socket-patch-core/src/setup/gem/templates/plugins.rb.tmpl
 delete mode 100644 crates/socket-patch-core/src/setup/gem/update.rs
 delete mode 100644 crates/socket-patch-core/src/setup/gem/version.rs
 delete mode 100644 crates/socket-patch-core/src/setup/mod.rs
 delete mode 100644 crates/socket-patch-core/src/setup/npm.rs
 delete mode 100644 crates/socket-patch-core/src/setup/pypi/detect.rs
 delete mode 100644 crates/socket-patch-core/src/setup/pypi/edit.rs
 delete mode 100644 crates/socket-patch-core/src/setup/pypi/mod.rs
 delete mode 100755 scripts/setup-matrix.sh
 delete mode 100644 tests/docker/Dockerfile.gem-b1
 delete mode 100644 tests/docker/Dockerfile.gem-b4
 delete mode 100644 tests/setup_matrix/README.md
 delete mode 100644 tests/setup_matrix/matrix.json
 delete mode 100644 tests/setup_matrix/results/.gitignore
 delete mode 100755 tests/setup_matrix/run-case.sh
 delete mode 100755 tests/setup_matrix/shims/npx
 delete mode 100755 tests/setup_matrix/shims/pnpm

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bba0540d..f11064b5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -55,24 +55,6 @@ jobs:
 
       - name: Run clippy
         run: cargo clippy --workspace --all-features -- -D warnings
-      # Moved-module aliases (patch::vendor → vendor, patch::go_mod_edit →
-      # vendor::go_mod_edit, patch::go_redirect → patch::redirect::golang_local)
-      # exist only for external consumers of the published core crate.
-      # #[deprecated] on a `pub use` re-export emits no warnings
-      # (rust-lang/rust#30827), so the compiler cannot pressure internal code
-      # off the old paths — this grep is the guard instead.
-      - name: Reject internal uses of moved-module alias paths
-        run: |
-          if grep -rn --include='*.rs' \
-              -e 'patch::vendor' -e 'patch::go_mod_edit' \
-              -e 'patch::go_redirect' -e 'patch::bun_lock_text' \
-              -e 'utils::telemetry' -e 'utils::cleanup_blobs' \
-              -e 'utils::date' -e 'utils::fuzzy_match' \
-              -e 'gem_setup::' -e 'composer_setup::' -e 'pth_hook::' \
-              crates; then
-            echo '::error::use the canonical module paths (crate::vendor, patch::redirect::golang_local, crate::telemetry, manifest::cleanup_blobs, api::date, crawlers::fuzzy_match); the old-path aliases exist only for external consumers'
-            exit 1
-          fi
 
   # The napi addon is only ever loaded by Node, so cargo's own tests never
   # exercise its JS loader or the engine/provider boundary.
@@ -107,7 +89,7 @@ jobs:
         run: node --test crates/socket-patch-node/npm/test/smoke.mjs
 
   # Lint the out-of-workspace packaging artifacts: the RubyGems CLI launcher
-  # gem + the Bundler plugin gem (Ruby), and the curl|sh installer. Ruby is
+  # gem (Ruby), and the curl|sh installer. Ruby is
   # pre-installed on the ubuntu-latest runner.
   lint-ecosystems:
     runs-on: ubuntu-latest
@@ -118,13 +100,9 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Ruby — syntax-check + build the launcher gem and Bundler plugin
+      - name: Ruby — syntax-check + build the launcher gem
         run: |
           ( cd gem/socket-patch && ruby -c lib/socket_patch/launcher.rb && ruby -c exe/socket-patch && gem build socket-patch.gemspec )
-          ( cd gem/socket-patch-bundler && ruby -c plugins.rb && gem build socket-patch-bundler.gemspec )
-          # The generated-plugin templates are pure Ruby — keep them parseable.
-          ruby -c crates/socket-patch-core/src/setup/gem/templates/plugins.rb.tmpl
-          ruby -c crates/socket-patch-core/src/setup/gem/templates/gemspec.tmpl
 
       - name: Python — test native installer harnesses
         run: python3 -B -m unittest discover -s scripts/tests -v
@@ -311,13 +289,13 @@ jobs:
           echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
 
       - name: Run tests
-        # `--all-features` would also RUN the docker-e2e / setup-e2e suites,
+        # `--all-features` would also RUN the docker-e2e suites,
         # which soft-skip as "ok" in this job (no images are built here, and
         # macOS/Windows have no Docker at all) — dozens of fake greens per OS
         # that would hide a broken skip-guard behind a passing checkmark.
         # Build them with --all-features (compile rot is real coverage), but
-        # run only the default-feature suites; the dedicated e2e-docker and
-        # setup-matrix jobs run the gated suites for real.
+        # run only the default-feature suites; the dedicated e2e-docker
+        # job runs the gated suites for real.
         #
         # `--no-fail-fast`: without it cargo stops at the first failing test
         # BINARY, so one bad file hides every later binary's result on that
@@ -368,7 +346,7 @@ jobs:
         # profile's comment in Cargo.toml). Same opt-level/debug-assertion
         # semantics this job exists to validate; ~23m of LTO relinking gone.
         # Build/run split for the same reason as the `test` job: the gated
-        # docker-e2e / setup-e2e suites only soft-skip here — compile them,
+        # docker-e2e suites only soft-skip here — compile them,
         # don't count their skips as passes.
         run: |
           set -euo pipefail
@@ -681,10 +659,10 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: ubuntu-latest
-            suite: e2e_cargo
-          - os: ubuntu-latest
-            suite: e2e_golang
+          # (No e2e_cargo / e2e_golang rows: neither suite has an
+          # `#[ignore]`-gated test or needs a real toolchain, so the
+          # unfiltered `test` job already runs all of them and the rows'
+          # `--ignored` legs selected zero tests.)
           - os: ubuntu-latest
             suite: e2e_maven
           - os: ubuntu-latest
@@ -717,9 +695,6 @@ jobs:
           - {os: ubuntu-latest, suite: e2e_redirect_composer_build, composer: '2'}
           - {os: ubuntu-latest, suite: e2e_redirect_composer_build, composer: '2.2'}
           - {os: ubuntu-latest, suite: e2e_redirect_composer_build, composer: '1'}
-          # setup-e2e host guards run in no other job (test job = default
-          # features; setup-matrix job = shell script).
-          - {os: ubuntu-latest, suite: setup_matrix_composer, test_filter: host_guard}
           # Real-bundler gem capstones, one leg per bundler era. Boundaries:
           # 1.17/2.1 merged GEM section, 2.2 separate sections, 2.5 last
           # pre-CHECKSUMS, 2.6 CHECKSUMS, 4.0.15/4.0.21 before/after the
@@ -741,8 +716,6 @@ jobs:
           - {os: ubuntu-latest, suite: e2e_vendor_gem_build, ruby: '3.3', bundler: '2.7.2'}
           - {os: ubuntu-latest, suite: e2e_vendor_gem_build, ruby: '3.4', bundler: '4.0.15'}
           - {os: ubuntu-latest, suite: e2e_vendor_gem_build, ruby: '3.4', bundler: '4.0.21'}
-          # not #[ignore]-gated -> --include-ignored is mandatory
-          - {os: ubuntu-latest, suite: setup_matrix_gem, ruby: '3.3', bundler: '2.7.2', test_filter: --include-ignored}
           # The live-API smoke suites (e2e_npm, e2e_pypi, e2e_gem,
           # e2e_scan) are intentionally NOT in the PR matrix — their
           # `#[ignore]`-gated tests hit the real public proxy at
@@ -1615,78 +1588,6 @@ jobs:
           set -euo pipefail
           cargo test -p socket-patch-cli --test e2e_vendor_cargo_build -- old_toolchain --nocapture
 
-  # ----------------------------------------------------------------------
-  # Experimental `setup`-flow matrix (NON-BLOCKING).
-  #
-  # For each ecosystem/package manager, drives the full intended flow —
-  # prepare deps + a committed patch set, run `socket-patch setup`, run
-  # the native install, check whether the patch was applied — plus the
-  # negative controls (no setup, empty/wrong/alt patch sets). See
-  # tests/setup_matrix/ and scripts/setup-matrix.sh.
-  #
-  # This is EXPERIMENTAL and intentionally not required to pass yet:
-  # `setup` configures install hooks for npm, PyPI, Bundler and Composer
-  # only, so the other ecosystems' `baseline_with_setup` cases are
-  # EXPECTED to fail (a baseline of what `setup` must eventually support). `continue-on-error: true`
-  # means this job never blocks a PR — it must ALSO be left OUT of the
-  # repo's required status checks (configured in the branch-protection
-  # UI, not in this file). The orchestrator exits non-zero only on a
-  # *regression* vs the recorded baseline; the full per-case result set
-  # is uploaded as a JSON artifact for inspection.
-  # ----------------------------------------------------------------------
-  setup-matrix:
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    continue-on-error: true
-    permissions:
-      contents: read
-    strategy:
-      fail-fast: false
-      matrix:
-        ecosystem: [npm, pypi, cargo, gem, golang, maven, composer, nuget, deno]
-    steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Set up Docker Buildx
-        # `driver: docker` — the per-ecosystem image's `FROM
-        # socket-patch-test-base:latest` only resolves when buildx talks
-        # directly to the host docker daemon (see e2e-docker above).
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
-        with:
-          driver: docker
-
-      - name: Install Rust
-        run: rustup show
-
-      - name: Build base image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
-        with:
-          context: .
-          file: tests/docker/Dockerfile.base
-          tags: socket-patch-test-base:latest
-          load: true
-
-      - name: Build ${{ matrix.ecosystem }} image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
-        with:
-          context: .
-          file: tests/docker/Dockerfile.${{ matrix.ecosystem }}
-          tags: socket-patch-test-${{ matrix.ecosystem }}:latest
-          load: true
-
-      - name: Run ${{ matrix.ecosystem }} setup-matrix
-        run: scripts/setup-matrix.sh run --ecosystem ${{ matrix.ecosystem }} --out "report-${{ matrix.ecosystem }}.json"
-
-      - name: Upload ${{ matrix.ecosystem }} setup-matrix report
-        if: always()
-        uses: ./.github/actions/upload-artifact
-        with:
-          name: setup-matrix-${{ matrix.ecosystem }}
-          path: report-${{ matrix.ecosystem }}.json
-
   # ----------------------------------------------------------------------
   # Hosted-mode production e2e — REQUIRED status check, with a kill switch.
   #
diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index 959305c0..1c97969f 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -1,8 +1,9 @@
 name: Publish PyPI
 run-name: "Publish PyPI ${{ inputs.version }}${{ inputs.distinct-id != '' && format(' [{0}]', inputs.distinct-id) || '' }}"
 
-# Publishes socket-patch (platform wheels) + socket-patch-hook (pure-python
-# .pth carrier) to PyPI for an existing v<version> release. Dispatched two
+# Publishes socket-patch (platform wheels) to PyPI for an existing
+# v<version> release. (The socket-patch-hook .pth wheel is no longer
+# published: `setup` was removed in v5.) Dispatched two
 # ways, both as a plain workflow_dispatch run:
 #   - by release.yml (scripts/dispatch-publish.sh), as one leg of the
 #     single-dispatch release fan-out — distinct-id carries the release
@@ -137,19 +138,10 @@ jobs:
       - name: Copy README for PyPI package
         run: cp README.md pypi/socket-patch/README.md
 
-      - name: Build wheels (platform socket-patch + pure-python socket-patch-hook)
+      - name: Build wheels (platform socket-patch)
         env:
           VERSION: ${{ inputs.version }}
-        run: |
-          # Builds the platform-tagged socket-patch wheels AND the pure-python
-          # socket-patch-hook wheel (the .pth carrier behind `socket-patch[hook]`).
-          python scripts/build-pypi-wheels.py --version "$VERSION" --artifacts artifacts --dist dist
-          # socket-patch and socket-patch-hook are two distinct PyPI projects.
-          # Publish each from its own dir so trusted publishing mints an OIDC
-          # token scoped to the right project (one upload spanning both projects
-          # can be rejected). Each needs its own trusted publisher on PyPI.
-          mkdir -p dist-hook
-          mv dist/socket_patch_hook-*.whl dist-hook/
+        run: python scripts/build-pypi-wheels.py --version "$VERSION" --artifacts artifacts --dist dist
 
       - name: Publish socket-patch to PyPI
         uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
@@ -157,9 +149,3 @@ jobs:
           packages-dir: dist/
           # Idempotent for re-runs: already-uploaded files skip.
           skip-existing: true
-
-      - name: Publish socket-patch-hook to PyPI
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
-        with:
-          packages-dir: dist-hook/
-          skip-existing: true
diff --git a/.github/workflows/publish-rubygems.yml b/.github/workflows/publish-rubygems.yml
index 01238d0f..c65f850a 100644
--- a/.github/workflows/publish-rubygems.yml
+++ b/.github/workflows/publish-rubygems.yml
@@ -1,12 +1,11 @@
 name: Publish RubyGems
 run-name: "Publish RubyGems ${{ inputs.version }}${{ inputs.distinct-id != '' && format(' [{0}]', inputs.distinct-id) || '' }}"
 
-# Publishes BOTH gems via one OIDC trusted-publishing exchange:
-#   - gem/socket-patch          — the CLI launcher gem (downloads the
-#     prebuilt binary from the GitHub release at its own version, so this
-#     workflow only needs the GitHub release + SHA256SUMS to exist).
-#   - gem/socket-patch-bundler  — Phase 2 scaffolding, non-blocking (see the
-#     step comment below).
+# Publishes the CLI launcher gem (gem/socket-patch) via OIDC trusted
+# publishing. The gem downloads the prebuilt binary from the GitHub release
+# at its own version, so this workflow only needs the GitHub release +
+# SHA256SUMS to exist. (The socket-patch-bundler plugin gem is no longer
+# published: `setup` was removed in v5.)
 #
 # Dispatched two ways, both as a plain workflow_dispatch run:
 #   - by release.yml (scripts/dispatch-publish.sh), as one leg of the
@@ -26,8 +25,7 @@ run-name: "Publish RubyGems ${{ inputs.version }}${{ inputs.distinct-id != '' &&
 # `rubygems`. Because this workflow only ever runs as its own top-level
 # workflow_dispatch run (never as a called reusable workflow), the OIDC
 # token's workflow_ref and job_workflow_ref claims both name this file — one
-# publisher registration per gem covers every path, and one exchange
-# satisfies both gems' publishers.
+# publisher registration covers every path.
 
 on:
   workflow_dispatch:
@@ -107,24 +105,7 @@ jobs:
             exit 1
           fi
 
-      - name: Lint + version-check the bundler-plugin gem
-        working-directory: gem/socket-patch-bundler
-        env:
-          EXPECTED_VERSION: ${{ inputs.version }}
-        run: |
-          ruby -c plugins.rb
-          # The gemspec version is baked at the tag by scripts/version-sync.sh.
-          gemver="$(ruby -e 'print Gem::Specification.load("socket-patch-bundler.gemspec").version')"
-          if [ "$gemver" != "$EXPECTED_VERSION" ]; then
-            echo "::error::gemspec version $gemver != release $EXPECTED_VERSION (run scripts/version-sync.sh before tagging)"
-            exit 1
-          fi
-
       - name: Configure RubyGems credentials (OIDC trusted publishing)
-        # One OIDC exchange covers both gems: a trusted publisher keyed on
-        # this repo + workflow (+ the `rubygems` environment) can be
-        # registered on multiple gems on rubygems.org, and the exchanged
-        # token pushes any gem whose publisher matches.
         uses: rubygems/configure-rubygems-credentials@dc5a8d8553e6ee01fc26761a49e99e733d17954a # v2.1.0
 
       - name: Publish socket-patch to RubyGems
@@ -141,25 +122,3 @@ jobs:
             exit 0
           fi
           gem push "socket-patch-${VERSION}.gem"
-
-      # Phase 2 scaffolding (CLI_CONTRACT "gem" support matrix): publish the
-      # `socket-patch-bundler` gem — the published form of the Bundler plugin
-      # that `socket-patch setup` currently wires through an in-tree
-      # `plugin ..., path:` directive. This gem is NOT yet the active mechanism (setup::gem still
-      # emits the in-tree plugin), so the push is **non-blocking**
-      # (`continue-on-error`). A follow-up switches the generated Gemfile
-      # directive to `plugin "socket-patch-bundler"` and drops
-      # continue-on-error.
-      - name: Publish socket-patch-bundler to RubyGems
-        continue-on-error: true
-        working-directory: gem/socket-patch-bundler
-        env:
-          VERSION: ${{ inputs.version }}
-        run: |
-          gem build socket-patch-bundler.gemspec
-          # Same precise-list-element match as the launcher gem above.
-          if gem list --remote --exact --all socket-patch-bundler 2>/dev/null | grep -qE "[ (]${VERSION}[,)]"; then
-            echo "socket-patch-bundler ${VERSION} already on RubyGems; skipping."
-            exit 0
-          fi
-          gem push "socket-patch-bundler-${VERSION}.gem"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3336c096..eaf6eda9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -41,9 +41,8 @@ name: Release
 #   - npm:           OIDC via `npm stage publish`; staged versions require
 #                    manual 2FA approval (see the npm run's step summary).
 #   - PyPI:          OIDC trusted publishing; environment `pypi`.
-#   - RubyGems:      OIDC trusted publishing; environment `rubygems`. One
-#                    repo+workflow publisher per gem (`socket-patch` and
-#                    `socket-patch-bundler`), both satisfied by one exchange.
+#   - RubyGems:      OIDC trusted publishing; environment `rubygems`
+#                    (the `socket-patch` launcher gem).
 # Every registry's trusted publisher is keyed on the repo + the publish
 # workflow's own filename (see each publish-*.yml header), NOT release.yml.
 
diff --git a/.github/workflows/vlt-compatibility.yml b/.github/workflows/vlt-compatibility.yml
index 284164b7..9a90e9ac 100644
--- a/.github/workflows/vlt-compatibility.yml
+++ b/.github/workflows/vlt-compatibility.yml
@@ -35,7 +35,6 @@ on:
       - 'crates/socket-patch-cli/src/commands/apply.rs'
       - 'crates/socket-patch-cli/src/commands/rollback.rs'
       - 'crates/socket-patch-cli/src/commands/remove.rs'
-      - 'crates/socket-patch-cli/src/commands/setup.rs'
       - 'crates/socket-patch-cli/src/commands/vendor.rs'
       - 'crates/socket-patch-cli/src/commands/vendored_backend/**'
       - 'crates/socket-patch-cli/src/commands/get.rs'
@@ -72,7 +71,6 @@ on:
       - 'crates/socket-patch-cli/src/commands/apply.rs'
       - 'crates/socket-patch-cli/src/commands/rollback.rs'
       - 'crates/socket-patch-cli/src/commands/remove.rs'
-      - 'crates/socket-patch-cli/src/commands/setup.rs'
       - 'crates/socket-patch-cli/src/commands/vendor.rs'
       - 'crates/socket-patch-cli/src/commands/vendored_backend/**'
       - 'crates/socket-patch-cli/src/commands/get.rs'
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0f92db53..f8eb6bb3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -25,9 +25,9 @@ into the new version's section — see docs/releasing.md.
 > `.socket/vendor/` for offline installs (it ejects a hosted project: no
 > manifest needed); `socket-patch list` shows them. Hosted mode keeps no
 > ledger — the lockfile edits are the whole change, and `rollback` restores
-> each hosted package to its upstream registry entry.
-> `get`, `apply`, `setup`, `rollback`, `remove` and `repair` (the agent-mode
-> commands) keep working and are listed after these.
+> each hosted package to its upstream registry entry. `get`, `remove` and
+> `rollback` work in every mode; `apply` and `repair` are the agent-mode
+> commands; `setup` is removed.
 
 > **Semver note:** this entry changes `rollback`'s default behavior, narrows
 > the meaning of its existing `vendored: []` JSON key, makes vendored mode
@@ -43,10 +43,77 @@ into the new version's section — see docs/releasing.md.
 > `ledgerKey`; `vendor_supersedes_redirect` and `hosted_revert_unsupported`
 > are gone), and
 > retries a throttled patch API (new error text, added waiting, a throttled
-> package failing its legacy-proxy batch) — all
+> package failing its legacy-proxy batch), and removes the `setup`
+> subcommand — all
 > MAJOR per CLI_CONTRACT.md's semver policy — so it ships as the next major
 > release (v5.0).
 
+### Removed (BREAKING)
+
+- **`setup` is removed, with every install hook it wired.** `socket-patch
+  setup` (and `--check` / `--remove` / `--exclude`, `SOCKET_SETUP_EXCLUDE`)
+  is now an unknown subcommand: a clap usage error, exit 2. The hooks it
+  wrote were npm `postinstall` / `dependencies` scripts, the
+  `socket-patch[hook]` Python dependency (a `.pth` startup hook), a Bundler
+  plugin under `.socket/bundler-plugin/` plus a managed `plugin
+  "socket-patch"` Gemfile block, and Composer `post-install-cmd` /
+  `post-update-cmd` entries. Hooks already committed keep working, since
+  they only call `socket-patch apply`, which stays; delete them by hand to
+  stop them. The README's "Upgrading from `setup`" section lists each hook
+  and the commands to move to hosted mode or keep agent mode. Agent mode is now `socket-patch scan --mode agent` once
+  (commit `.socket/`), then `socket-patch apply` in CI after every install.
+  Hosted and vendored mode never needed a hook.
+- **The `socket-patch-hook` PyPI wheel and the `socket-patch-bundler` gem
+  are no longer built or published**, and the `socket-patch[hook]` extra is
+  gone from the `socket-patch` wheel (pip warns about the unknown extra and
+  installs the CLI). Their sources stay in the tree, frozen, for reference.
+- **`vex` no longer drops agent-mode patches whose ecosystem has no
+  install hook** ("Property 7"). A manifest patch that verifies as applied
+  (or any manifest patch under `--no-verify`) is now attested whatever the
+  ecosystem. The `ecosystem_not_setup` `skipped` code, its stderr note and
+  its `no_applicable_patches` message are retired. A manifest's `setup`
+  object (`manual`, `exclude`) still parses and is kept on rewrite, but
+  nothing reads it.
+- **The `patch_setup` telemetry event** is gone with the command.
+- **Core crate:** the `setup` and `package_json` modules and the
+  `gem_setup` / `composer_setup` / `pth_hook` aliases are removed from
+  `socket-patch-core`, along with the setup-only `npm_family` table column
+  (`FileRow::detects_pnpm`) and `VLT_SETUP_MARKERS`.
+
+### Changed (BREAKING): patch UI streamlining
+
+- **`list` on an empty project exits 0.** A project with no manifest and
+  no ledger record (normal for hosted mode) used to exit 1 with
+  `manifest_not_found`; it now prints `No patches in this project. Run
+  \`socket-patch scan\`.` (human) or the success envelope with
+  `events: []` (`--json`). Only an unreadable or invalid manifest fails.
+- **Help is grouped by task**: patch (`scan`, `get`, `list`), undo
+  (`remove`, `rollback`), ship (`vex`, `vendor`), and agent mode
+  (`apply`, `repair`). `-h` keeps `--cwd`, `--ecosystems` and
+  `--offline`; `scan --prune` moves to `--help`.
+- **Hosted and vendored `get` never prompt.** Like `scan`, they take the
+  top-ranked accessible patch per package with no picker and no
+  confirmation, in `--json` too (no `selection_required` outside agent
+  mode). Agent-mode `get` keeps its picker and `Download and apply N
+  patches?` prompt.
+- **`get` and `rollback` usage errors exit 2** (were 1): `get`'s
+  `--id`/`--cve`/`--ghsa`/`--package` multi-select, `--one-off --save-only`,
+  `--mode hosted|vendored --save-only`, `--one-off`, a malformed forced
+  identifier, and `rollback --one-off`. Every usage error now exits 2.
+- **Human output:** warning lines no longer carry the `(code)` tag
+  (`Warning: …`, `GC: skipped: …`); the codes stay in the JSON envelope.
+  Error lines keep theirs (`Error (<code>): …`). Hosted mode is called "hosted", not "redirect", in human
+  text (`Switched 2 packages to hosted patches; rewrote 1 file.`). npm's
+  `allow-remote` notice is one line (full text under `--verbose` and in
+  `--json`). Hosted and vendored runs share one numbered `Next steps:`
+  block. Every declined prompt prints `Cancelled; no changes made.`, and
+  scan/get share one paid-plan upsell line.
+- **`-h` is short**: about eight options per command (`--json`,
+  `--dry-run`, `--cwd`, `--ecosystems`, `--offline`, `--yes` where the
+  command prompts, and the command's main flags); `--help` still lists everything. The deprecated
+  `scan --apply` / `--vendor` spellings are hidden from both (still
+  accepted).
+
 ### Changed (BREAKING)
 
 > **Ledger-free hosted mode.** The first entries below supersede every
@@ -500,8 +567,7 @@ into the new version's section — see docs/releasing.md.
   vanished-file retries into a spurious `lock_io`. Agent-mode `get`
   and `scan --apply`/`--sync` hold one lock window across download →
   manifest write → nested apply (the nested apply no longer re-acquires and
-  now inherits `--lock-timeout`/`--verbose`); `setup` takes the lock while
-  persisting `--exclude`; `scan --prune` acquires once for its vendored
+  now inherits `--lock-timeout`/`--verbose`); `scan --prune` acquires once for its vendored
   reconcile and manifest prune, and the GC legs of `scan --prune` and
   `vendor` honor `--lock-timeout` and report a lock I/O error instead of
   silently skipping on it.
@@ -709,22 +775,6 @@ into the new version's section — see docs/releasing.md.
   verified without its vendor ledger checks a devDependencies-stripped
   `package.json` against the patched blob in `.socket/blobs`, and is
   omitted as `vendor_manifest_unverifiable` when that blob is absent.
-  `setup.manual` accepts `vlt`.
-- **`setup` wires vlt projects.** A `vlt-lock.json`, `vlt.json`,
-  `node_modules/.vlt-lock.json` or `node_modules/.vlt/` directory in the
-  project root makes `setup` treat it as vlt, ahead of any pnpm marker. The
-  hook is npm's `npx @socketsecurity/socket-patch apply --silent --ecosystems
-  npm`, and a vlt workspace (vlt.json `workspaces`, or vlt <= 0.0.0-12's
-  `vlt-workspaces.json`) is wired at the root only, because vlt runs the
-  root hook once per install. The `setup --json` `packageManager` and the
-  `patch_setup` telemetry `manager` report `vlt`. vlt before 1.0.0-rc.13
-  never runs a root `postinstall`: `setup` still wires the project and
-  warns `vlt_root_scripts_not_run` — definitely when the `vlt` on `PATH`
-  reports such a version, and as a "may" when `vlt-lock.json` has
-  `lockfileVersion` 0 or none and no usable `vlt` is found, or the one
-  found would not write that lock (a v0 lock beside vlt 1.0.0-rc.15 or
-  later). `setup --remove` also clears the hooks earlier releases wrote
-  into vlt workspace members.
 - **vlt support is proven against real vlt releases.** Every supported vlt
   release (0.0.0-1 … 1.2.0, see `docs/testing/vlt-compatibility.md` for the
   excluded ones) ran the five real-vlt capstones locally; CI now runs 35 of
@@ -896,7 +946,7 @@ into the new version's section — see docs/releasing.md.
   command now also writes `record` into `.socket/vendor/state.json` (never
   `detached` — the manifest record stays authoritative while the manifest
   covers the package), so a project it wired whose manifest is gone still
-  verifies, lists and attests offline: `vex`, `list` and `setup --check` read
+  verifies, lists and attests offline: `vex` and `list` read
   the embedded copy whenever no manifest entry covers the package, and
   `repair` recovers the record without the API when there is no manifest at
   all. Entries written by older releases keep working.
@@ -1310,13 +1360,6 @@ into the new version's section — see docs/releasing.md.
   `vendor_yarn_berry_mixed_line_endings`). Both takeovers now run the new
   mode's berry gates first — wet and `--dry-run` alike — and a refused purl
   keeps the old mode's wiring byte-identical.
-- **`setup` keeps a CRLF `package.json` CRLF.** `setup` and `setup --remove`
-  re-serialized `package.json` with bare LF and dropped a leading BOM, so on
-  a Windows yarn berry project (yarn pretty-prints the manifest with CRLF) a
-  two-key script edit became a whole-file diff that yarn then kept, and
-  `setup --remove` could not land byte-identical on the pre-setup file.
-  `package.json` is now written in its own layout (BOM, indent, line ending,
-  trailing-newline shape), the same helper the vendored backends use.
 - **Two vendored versions of one cargo crate are documented — and now
   warned about — as needing cargo 1.45.** The docs said older cargo (1.41)
   only needed a populated crates.io index. It needs more than that: cargo
@@ -1383,7 +1426,7 @@ into the new version's section — see docs/releasing.md.
   Progress, prompts, color and truncation now share one implementation.
   - **Progress lines:** a status line clears itself on finish. It is never
     drawn off a TTY, under `TERM=dumb`, in debug mode, or under
-    `--json`/`--silent`. `fetch`, `vendor`, `setup`, lock waits and
+    `--json`/`--silent`. `fetch`, `vendor`, lock waits and
     `--update` checks now show progress instead of going quiet.
   - **Prompts:** Ctrl-D at a `[Y/n]` prompt now declines instead of
     accepting. Keys pressed while a command is working no longer answer
@@ -1409,10 +1452,7 @@ into the new version's section — see docs/releasing.md.
   stores are removed, and `.socket/` itself goes with the lock when nothing is
   left — so a fully unwound hosted or vendored project has no `.socket/` at
   all. Deliberately kept: the zero-patch `.socket/manifest.json`
-  (`{"patches": {}}` + its `setup` block — `list`/`apply`/`vex` exit codes
-  depend on it) and the `setup`-owned `.socket/.gitignore`,
-  `gem-plugin-stamp` and `bundler-plugin/` (rollback never undoes setup).
-  `setup --remove` now also removes an emptied `.socket/`.
+  (`{"patches": {}}` — `list`/`apply`/`vex` exit codes depend on it).
 - **`scan --prune` says what it skipped and what it could not finish.** The
   `gc` JSON sub-object gains `failedVendoredEntries` plus the additive
   `skipped: {code, message}` (`lock_held` | `lock_io`) and
@@ -1456,19 +1496,10 @@ into the new version's section — see docs/releasing.md.
   `(not installed)` line prints only when something was not installed.
   `rollback` prints `No patches found in manifest` only for an unscoped run
   with no work in any leg.
-- **`setup --exclude` persists after the prompt, under the lock.** The
-  exclusion list is written after discovery and confirmation (also on the
-  already-configured path when the flag is explicit) as a read-modify-write
-  under `apply.lock`; a held or unopenable lock, or a manifest that cannot
-  be read or written, is reported as `not persisting --exclude: …` instead
-  of being swallowed. `setup --check` reads the vendor ledger even without
-  a manifest and, on a corrupt one, warns `unreadable vendor state` and
-  reports a `vendor_ledger` error entry (verdict `error`, exit 1) — never
-  `configured`; `vex` refuses the same unreadable ledger outright
-  (`vendor_ledger_corrupt`, see Changed); `list`
-  degrades a corrupt vendor ledger to a `Warning: unreadable vendor ledger …`
-  line (muted by `--silent`) rather than an error; `patch_setup` telemetry
-  fires only for a successful, non-dry-run setup.
+- **A corrupt vendor ledger is reported, never swallowed.** `vex` refuses
+  it outright (`vendor_ledger_corrupt`, see Changed); `list` degrades it to
+  a `Warning: unreadable vendor ledger …` line (muted by `--silent`) rather
+  than an error.
 - **`repair`/`vendor` state hygiene.** `repair` resolves installed copies
   through qualified ledger keys (gem `?platform=`, pypi `?artifact_id=`,
   maven `?classifier=` no longer read as "not installed"), puts a crashed
@@ -1509,8 +1540,8 @@ into the new version's section — see docs/releasing.md.
 - **`apply --silent` on an all-unmatched manifest prints its error line** —
   errors are never muted by `--silent`; and the no-manifest early exits of
   `apply` and `vendor` name the missing `.socket/manifest.json` instead of
-  "No .socket folder found" (the folder may legitimately hold setup files or
-  vendored state).
+  "No .socket folder found" (the folder may legitimately hold vendored
+  state).
 - **Hosted redirect hygiene.** Missing project files no longer skip silently:
   `redirect_composer_no_lockfile`, `redirect_gem_no_gemfile` (neither manifest
   nor lock present) and `redirect_maven_no_pom` (no `pom.xml`, no Gradle
@@ -1538,7 +1569,7 @@ into the new version's section — see docs/releasing.md.
   symlinked targets (`pypi_{poetry,pipenv,requirements}_symlink_unsupported`)
   and every pypi flavor refuses a project file that changed between plan and
   write (`pypi_{poetry,pdm,pipenv,uv}_changed`) instead of clobbering it;
-  `pyproject.toml` edits made by `setup` preserve CRLF line endings; an
+  an
   unreadable (EACCES / squatting directory or FIFO) redirect ledger is
   reported as unreadable and left in place instead of being quarantined as
   "malformed"; a blob-cleanup pass keeps sweeping after one unremovable file
diff --git a/README.md b/README.md
index 645bf414..0f507b6c 100644
--- a/README.md
+++ b/README.md
@@ -226,7 +226,7 @@ it changes nothing for that package and tells you to restore the file from versi
 
 That's the whole loop: **scan → commit → reinstall → vex**, with `socket-patch vendor`
 when installs must be offline. The older *agent* mode, which patches installed files in
-place and re-applies them from an install hook, is still supported; the next section
+place and needs `socket-patch apply` after every install, is still supported; the next section
 compares the three.
 
 ## How Socket Patch works
@@ -280,7 +280,7 @@ and `vex` read it only for details, and `rollback` deletes it.
 > removes it. Nothing in the table is written until there is something to record: a
 > report-only `scan`, a `--dry-run`, or a run that changes nothing leaves no `.socket/` at
 > all, and a full [`rollback`](#rollback) removes everything it created (only the
-> zero-patch `manifest.json` and any [`setup`](#setup) files stay).
+> zero-patch `manifest.json` stays).
 
 ### Three patch modes
 
@@ -292,7 +292,7 @@ run; a bare `scan` is hosted.
 |------|----------------------|--------------------------|-----------|
 | **hosted** (default) — `scan` | Nowhere in your repo: the lockfile is rewritten so **only** the patched dependencies resolve to Socket-hosted, integrity-pinned packages on `patch.socket.dev`; nothing else is written | Installs must be able to reach `patch.socket.dev` (no CLI, no install hook) | Smallest possible diff (just the lockfile / registry-config edits); not for airgapped installs |
 | **vendored** — `scan --mode vendored` or [`vendor`](#vendor) (which ejects a hosted project) | Patched packages committed under `.socket/vendor/`, with the lockfile rewired to consume them | **None** — the package manager installs the committed bytes | Fully airgapped and hermetic, at the cost of repo size |
-| **agent** (older) — `scan --mode agent`, [`get`](#get), [`apply`](#apply) | `.socket/manifest.json` + blobs, committed; the CLI patches installed files in place | The `socket-patch` CLI must run after every install (an install hook via [`setup`](#setup), or an `apply` step in CI) | No lockfile edits and a small repo footprint, but the only mode that needs CI / install-hook changes |
+| **agent** (older) — `scan --mode agent`, [`get`](#get), [`apply`](#apply) | `.socket/manifest.json` + blobs, committed; the CLI patches installed files in place | The `socket-patch` CLI must run after every install (an `apply` step in CI after each install) | No lockfile edits and a small repo footprint, but the only mode that needs a CI change |
 
 Every mode pins the patched bytes: vendored and hosted modes lean on your package
 manager's own lockfile integrity checks (sha512 / sha256 / contentHash / CHECKSUMS) where
@@ -478,8 +478,6 @@ need the network and refuse to run with `--offline`.
 | [`scan --prune`](#scan) | Agent mode: **reconciles, doesn't reverse** — drops manifest entries for packages that have left the project and garbage-collects orphan blob/diff/archive files |
 | [`repair`](#repair) (alias `gc`) | **Restores health, not originals**: re-downloads missing blobs, re-vendors missing/corrupt vendored artifacts, and cleans up unused ones |
 
-And `setup --remove` reverts the install hooks that `setup` added.
-
 > Reverting a hosted edit by hand (e.g. `git checkout -- <lockfile>`) is always safe:
 > hosted mode keeps no other state, so there is nothing else to clean up.
 
@@ -491,12 +489,11 @@ And `setup --remove` reverts the install hooks that `setup` added.
 | [`vex`](#vex) | Generate an OpenVEX document for the vulnerabilities the project's patches fix |
 | [`vendor`](#vendor) | Eject patched dependencies into committable `.socket/vendor/` and rewire lockfiles to use them (`--revert` undoes it) |
 | [`list`](#list) | List the patches in this project: hosted and vendored records plus any agent-mode manifest entries |
-| **Agent mode (older commands)** | |
-| [`get`](#get) | Fetch and apply one patch by UUID / CVE / GHSA / PURL / name (alias: `download`) |
-| [`apply`](#apply) | Apply the patches in `.socket/manifest.json` in place |
-| [`setup`](#setup) | Wire install hooks (npm, Python, Bundler, Composer) that re-apply patches after install |
-| [`rollback`](#rollback) | Undo patches in every mode: restore original files, unwind vendored lockfile wiring, and restore hosted lockfile entries to upstream |
-| [`remove`](#remove) | Remove one patch by PURL or UUID (rolls back first) |
+| [`get`](#get) | Patch one package, CVE, GHSA or patch UUID (hosted by default; alias: `download`) |
+| [`remove`](#remove) | Unwind one patch by PURL or UUID, in any mode |
+| [`rollback`](#rollback) | Unwind every patch, in any mode: restore original files and hosted or vendored lockfile wiring |
+| **[Agent mode](#agent-mode)** | |
+| [`apply`](#apply) | Apply the patches in `.socket/manifest.json` in place (run it after every install) |
 | [`repair`](#repair) | Download missing patch artifacts, re-vendor broken vendored artifacts, clean up unused ones (alias: `gc`) |
 
 `socket-patch --update` updates the CLI itself (see [Updating](#updating)).
@@ -530,12 +527,12 @@ settings, described in [Configuration sources](#configuration-sources) below.
 | `--strict` | `SOCKET_STRICT` | Fail-closed on before-hash mismatches instead of the default warn-and-overwrite: a file whose current content matches neither `beforeHash` nor `afterHash` aborts that package's apply. Overridden by `--force`. |
 | `-g, --global` | `SOCKET_GLOBAL` | Operate on globally-installed packages. |
 | `--global-prefix <path>` | `SOCKET_GLOBAL_PREFIX` | Override the path used to discover globally-installed packages. |
-| `-j, --json` | `SOCKET_JSON` | Emit machine-readable JSON output. Every JSON response includes a `"status"` field — camelCase on the envelope commands (`"success"`, `"error"`, `"noManifest"`, `"partialFailure"`, `"paidRequired"`, `"notFound"`; apply/list/repair/remove/vendor), snake_case on the legacy shapes (`"partial_failure"`, `"not_found"`; get/scan/rollback/setup). See [CLI_CONTRACT.md](crates/socket-patch-cli/CLI_CONTRACT.md) for the exact shapes. |
+| `-j, --json` | `SOCKET_JSON` | Emit machine-readable JSON output. Every JSON response includes a `"status"` field — camelCase on the envelope commands (`"success"`, `"error"`, `"noManifest"`, `"partialFailure"`, `"paidRequired"`, `"notFound"`; apply/list/repair/remove/vendor), snake_case on the legacy shapes (`"partial_failure"`, `"not_found"`; get/scan/rollback). See [CLI_CONTRACT.md](crates/socket-patch-cli/CLI_CONTRACT.md) for the exact shapes. |
 | `-v, --verbose` | `SOCKET_VERBOSE` | Show extra detail in human-readable output. |
 | `-s, --silent` | `SOCKET_SILENT` | Suppress non-error output. |
 | `--dry-run` | `SOCKET_DRY_RUN` | Preview the operation without making any mutations. |
-| `-y, --yes` | `SOCKET_YES` | Skip confirmation prompts (`get`, `rollback`, `remove`, `setup`, `--update`). `scan` never prompts, so it ignores this flag. |
-| `--lock-timeout <secs>` | `SOCKET_LOCK_TIMEOUT` | Seconds to wait for `.socket/apply.lock` before giving up. `0`/unset = a single non-blocking try; a positive value retries with backoff. Only meaningful for the commands that take the lock — `apply`, `rollback`, `repair`, `remove`, `vendor`, `setup` (while persisting `--exclude`), and `scan`/`get` whenever they write (agent-mode download + apply, vendored, hosted). The lock file exists only while a command runs. |
+| `-y, --yes` | `SOCKET_YES` | Skip confirmation prompts (`get`, `rollback`, `remove`, `--update`). `scan` never prompts, so it ignores this flag. |
+| `--lock-timeout <secs>` | `SOCKET_LOCK_TIMEOUT` | Seconds to wait for `.socket/apply.lock` before giving up. `0`/unset = a single non-blocking try; a positive value retries with backoff. Only meaningful for the commands that take the lock — `apply`, `rollback`, `repair`, `remove`, `vendor`, and `scan`/`get` whenever they write (agent-mode download + apply, vendored, hosted). The lock file exists only while a command runs. |
 | `--debug` | `SOCKET_DEBUG` | Emit verbose debug logs to stderr. |
 | `--no-telemetry` | `SOCKET_TELEMETRY_DISABLED` | Disable anonymous usage telemetry. |
 | `--no-npm-allow-remote-config` | `SOCKET_NO_NPM_ALLOW_REMOTE_CONFIG` | Hosted mode: don't write `allow-remote=all` to the project `.npmrc` (see [npm compatibility](#npm-hosted-mode-and-npm-12)). |
@@ -654,8 +651,8 @@ socket-patch scan [PATHS]... [options]
 | `--vex <path>` | `SOCKET_VEX` | On a successful scan, also write an OpenVEX 0.2.0 document to this path. See [Inline VEX](#inline-vex-on-apply--scan--vendor). |
 | `--vex-product`, `--vex-no-verify`, `--vex-doc-id`, `--vex-compact` | `SOCKET_VEX_*` | Passthrough to the embedded VEX builder; mirror the standalone [`vex`](#vex) knobs. Inert unless `--vex` is set. |
 
-> Deprecated spellings: `--apply` (== `--mode agent`) and `--vendor` (== `--mode
-> vendored`). `--detached` is a hidden no-op kept for compatibility (vendored mode is
+> Deprecated, hidden spellings (still accepted): `--apply` (== `--mode agent`) and
+> `--vendor` (== `--mode vendored`). `--detached` is a hidden no-op kept for compatibility (vendored mode is
 > always manifest-free); it is still an error without vendored mode.
 
 **Examples:**
@@ -792,7 +789,7 @@ it:
   lockfile is reverted and dropped); newer patches show up in `updates[]` as the signal
   to re-run `scan --mode vendored`.
 - [`vex`](#vex) attests vendored patches by verifying the **committed artifact** (marked
-  `(vendored)` in the impact statement) — no `setup` install hook needed.
+  `(vendored)` in the impact statement) — no install step needed.
 - Re-running either form is idempotent. Patches dropped from `.socket/manifest.json`
   are auto-reverted on the next `vendor` run; on a project vendored by
   `scan --mode vendored`, use [`repair`](#repair) to verify or rebuild the committed
@@ -831,7 +828,9 @@ List the patches in this project: the hosted pins your lockfiles wire (labeled
 `details.lockfiles`), the vendor ledger's records (`Mode: vendored`), and any agent-mode
 entries in `.socket/manifest.json`. A hosted pin shows its UUID only (hosted mode keeps no
 local record; `vex` fetches it from the API), unless a pre-v5
-`.socket/vendor/redirect-state.json` still records it.
+`.socket/vendor/redirect-state.json` still records it. A project with none prints `No
+patches in this project. Run \`socket-patch scan\`.` and exits 0 (`--json`: the success
+envelope with no events).
 
 **Usage:**
 ```bash
@@ -870,12 +869,6 @@ Package: pkg:npm/flatted@3.3.1
     ...
 ```
 
-### Agent mode (older commands)
-
-Agent mode keeps patches in `.socket/manifest.json` + `.socket/blobs/` and edits the
-installed files in place, so the CLI has to run again after every install. These
-commands drive it. `rollback` also undoes hosted and vendored patches.
-
 ### `get`
 
 Get one security patch from the Socket API and apply it. Accepts a UUID, CVE ID, GHSA
@@ -884,8 +877,9 @@ flag. Like `scan`, `get` defaults to hosted mode; pass `--mode vendored`, or
 `--mode agent` for the manifest + in-place apply (implied by `--save-only` and
 `--global`). When a package has
 several patches, `get` picks the same one `scan` does (see
-[Which patch is picked](#which-patch-is-picked)). Unlike `scan`, `get` prompts before
-applying (`--yes` or a non-TTY stdin accepts).
+[Which patch is picked](#which-patch-is-picked)). Hosted and vendored `get` never
+prompt, like `scan`; agent-mode `get` asks before applying (`--yes` or a non-TTY stdin
+accepts).
 
 Alias: `download`. And as a shortcut, `socket-patch <uuid>` with a bare patch UUID is
 rewritten to `socket-patch get <uuid>`.
@@ -942,171 +936,44 @@ socket-patch get lodash -g
 socket-patch get CVE-2024-12345 --json -y
 ```
 
-### `apply`
+### `remove`
 
-Apply the patches in `.socket/manifest.json` to the installed files in place. Idempotent — safe to run from install
-hooks and CI on every build.
+Remove a patch from the manifest (rolls back files first by default). If the package is
+[vendored](#vendor), `remove` also **reverts the vendoring** — the lockfile is restored
+byte-for-byte and the `.socket/vendor/` artifact is deleted — so the patch is fully gone
+in one command. Patches vendored by `scan --mode vendored` have no manifest entry and are
+removable by PURL or UUID all the same (reverting the vendoring *is* the removal, so
+`--skip-rollback` is refused for them). A hosted patch is removed the same way: its
+lockfile entries are restored to their upstream registry entry, exactly as `rollback`
+does it (refused, with the manifest untouched, where that is impossible).
 
 **Usage:**
 ```bash
-socket-patch apply [options]
-```
-
-**Command-specific options** (plus all [Global options](#global-options)):
-| Flag | Env var | Description |
-|------|---------|-------------|
-| `-f, --force` | `SOCKET_FORCE` | Skip pre-application hash verification (apply even if package version differs). |
-| `--check` | — | Read-only audit that the committed **Go** `replace`-redirects match the manifest (for CI / GitHub-App auditing) — Go only, since cargo patches in place and has no redirect to audit. Lock-free, crawl-free, and offline-safe: exits 0 in sync, 1 on drift. Vendored modules are excluded from the audit. |
-| `--vex <path>` | `SOCKET_VEX` | On a successful apply, also write an OpenVEX 0.2.0 document to this path. See [Inline VEX generation](#inline-vex-on-apply--scan--vendor). |
-| `--vex-product`, `--vex-no-verify`, `--vex-doc-id`, `--vex-compact` | `SOCKET_VEX_*` | Passthrough to the embedded VEX builder; mirror the standalone [`vex`](#vex) knobs. Inert unless `--vex` is set. |
-
-**Examples:**
-```bash
-# Apply patches
-socket-patch apply
-
-# Dry run
-socket-patch apply --dry-run
-
-# Apply only npm patches
-socket-patch apply --ecosystems npm
-
-# Apply in offline mode
-socket-patch apply --offline
-
-# JSON output for CI/CD
-socket-patch apply --json
-
-# Apply and emit an OpenVEX attestation in one step
-socket-patch apply --vex socket.vex.json
+socket-patch remove <identifier> [options]
 ```
 
-> Packages managed by [`vendor`](#vendor) are skipped (`skipped`/`vendored` in JSON): the
-> committed vendored artifact is the patch, so there is nothing for `apply` to do — even
-> when the installed tree (e.g. `node_modules/`) is absent.
-
-### `setup`
-
-Agent mode only. Configure your project so in-place patches are **re-applied
-automatically after install** — no manual `socket-patch apply` step in CI. (Hosted and
-vendored projects need no hook: the lockfile already names the patched packages.) `setup` is a one-time operation: run it, commit
-the change together with your `.socket/` patches, and every later install handles the
-rest. It is strictly **opt-in** — nothing is hooked unless you run `setup` and commit the
-result.
-
-What gets wired, per ecosystem:
-
-- **npm / yarn / pnpm / bun / vlt** — writes `postinstall` and `dependencies` scripts into
-  `package.json` so any install — including `npm install <pkg>` — re-applies patches
-  (pnpm and vlt: root package only). vlt uses the same `npx` hook, runs it on every
-  install that changes the tree (never on a no-op install), and aborts the install when
-  it fails; vlt before 1.0.0-rc.13 never runs a root `postinstall`, which `setup` warns
-  about (`vlt_root_scripts_not_run`).
-- **Python (pip / uv / poetry / pdm / hatch)** — Python has no universal post-install
-  hook, so `setup` instead adds a **`socket-patch[hook]`** dependency to your manifest
-  (`pyproject.toml` / `requirements.txt`; for classic Poetry, the equivalent
-  `socket-patch = { extras = ["hook"] }`). Installing it lays down
-  a startup `.pth` (shipped by the small `socket-patch-hook` wheel) that re-applies your
-  committed `.socket/` patches the next time the interpreter runs. It is
-  package-manager-agnostic (it rides the interpreter, not any one installer) and
-  **fail-open** — a hook error can never break interpreter startup. Details below.
-- **RubyGems (Bundler)** — adds a managed `plugin "socket-patch"` block to the `Gemfile`
-  and generates an in-tree Bundler plugin under `.socket/bundler-plugin/`. It re-applies
-  patches on every `bundle install` (cached *and* fresh). (Requires the `socket-patch`
-  CLI on `PATH`, and **bundler >= 2.2**: bundler 1.x cannot load a `plugin ... path:`
-  directive — it resolves it as an ordinary gem and every later `bundle install` fails —
-  so `setup` refuses to wire a project whose lock or `bundle --version` reports an older
-  bundler, and `setup --check` red-flags a wired project that lands in that state.)
-- **Composer (PHP)** — appends `socket-patch apply` to `composer.json`'s
-  `post-install-cmd` / `post-update-cmd` script events, so patches re-apply on every
-  `composer install` / `composer update`. (Requires the `socket-patch` CLI on `PATH`.)
-- **Cargo & Go** — *apply-only, no `setup` hook.* A one-click auto-repatch-on-build isn't
-  possible for these, so `setup` skips them. Patch with `socket-patch apply` directly:
-  **cargo** patches the crate in place (in `vendor/` or the registry cache, rewriting
-  `.cargo-checksum.json` so `cargo build` accepts it) — note that a non-vendored crate
-  patches the **shared** `$CARGO_HOME/registry` cache, which affects every project on
-  the machine and is silently reset by `cargo clean` or a cache prune; vendor the
-  dependency (`--mode vendored`) for a project-local, committable patch. **go** writes a
-  project-local patched copy under `.socket/go-patches/` plus a `go.mod` `replace`
-  directive (the module cache is `go.sum`-verified, so in-place patching can't build);
-  commit `go.mod` + `.socket/go-patches/` so a clone builds the patched bytes. To have
-  [`vex`](#vex) still attest these hand-applied patches, add a `setup.manual` array to
-  `.socket/manifest.json` by hand (there is no CLI flag for it yet):
-  `"setup": { "manual": ["cargo", "golang"] }`.
-- **Maven / NuGet / Deno** — also apply-only: no native install hook exists to wire, so
-  `setup` reports `no_files`; patch them on demand with `socket-patch apply`, and declare
-  them in `setup.manual` (the same hand-edit as the Cargo & Go note above, e.g.
-  `"setup": { "manual": ["deno"] }`) so [`vex`](#vex) still attests the hand-applied
-  patches — this matters most for Deno, which has no vendored or hosted alternative.
-  For Maven
-  and NuGet, note that in-place patching leaves the caches' own checksum sidecars stale
-  (NuGet's fixup deletes `.nupkg.metadata` and raises an advisory for the signed-package
-  `.nupkg.sha512` marker; Maven's `.jar.sha1`/`.jar.md5` are left as-is) — the copy-out
-  modes, `scan --mode vendored` and `scan --mode hosted`, never touch the caches and
-  avoid the issue entirely. See
-  [ecosystems.md](docs/ecosystems.md#maven--nuget-caveats).
-
-**Usage:**
-```bash
-socket-patch setup            # configure (interactive)
-socket-patch setup --check    # verify configured; non-zero exit if not (CI gate)
-socket-patch setup --remove   # revert what setup added
-```
+**Arguments:**
+- `identifier` — package PURL (e.g. `pkg:npm/package@version`) or patch UUID.
 
-**Command-specific options** (plus all [Global options](#global-options) — `--dry-run`,
-`--yes`, `--json`, `--cwd` are the most relevant):
+**Command-specific options** (plus all [Global options](#global-options)):
 | Flag | Env var | Description |
 |------|---------|-------------|
-| `--check` | — | Read-only verification that every manifest is configured **and** every installed patch is still applied on disk (each file matches its recorded `afterHash`); exits non-zero if any manifest still needs setup or a patch has drifted. Never writes (safe in CI). Conflicts with `--remove`. |
-| `--remove` | — | Revert every install hook `setup` added (npm `package.json` scripts, the Python `socket-patch[hook]` dependency, the gem Bundler plugin wiring — including bundler's machine-local `.bundle/plugin` registration, so later `bundle install`s don't warn about the unwired plugin — and the Composer `post-install-cmd`/`post-update-cmd` script entries). If the registration can't be cleared automatically (unexpected index format), the error names the fallback: `bundler plugin uninstall socket-patch`. |
-| `--exclude <paths>` | `SOCKET_SETUP_EXCLUDE` | Workspace-member path(s) to exclude from setup (comma-separated, relative to the repo root). The exclusion is persisted in `.socket/manifest.json`, so `setup --check` and a fresh clone honor it without re-passing the flag. |
-
-#### Disabling / opting out (Python hook)
-
-The Python hook is designed to be easy to skip or remove:
-
-- **Per interpreter / CI step:** set `SOCKET_PATCH_HOOK=off` (or `SOCKET_NO_HOOK=1`).
-  This is checked *before any hook code runs*, so it fully bypasses the hook for that
-  process.
-- **Remove from a project:** `socket-patch setup --remove`, then
-  `pip uninstall socket-patch-hook`.
-- **Never opted in:** if you don't run `setup`, there is no hook — it is opt-in by
-  design.
-
-#### What the Python hook does, and its safety model
-
-On interpreter startup, *only when the set of installed packages changed*, the hook runs
-`socket-patch apply --offline --ecosystems pypi` for the project that owns the current
-virtualenv, re-applying only the patches committed in that project's `.socket/`.
-Specifically:
-
-- It is **anchored to the virtualenv** it is installed in (not the working directory), so
-  a `python` started from an unrelated directory cannot pull in a foreign
-  `.socket/manifest.json`.
-- It **verifies each file's hash before patching** and **never writes outside the
-  installed package directory** (path-escaping manifest keys are refused).
-- It **prefers the binary shipped in the installed `socket-patch` package** over `PATH`,
-  so a binary planted earlier on `PATH` cannot shadow it; `PATH` is consulted only as a
-  fallback when that package isn't installed.
-- It runs **offline** (no network at startup) and is **fail-open** (any error is
-  swallowed; it can never abort the interpreter).
+| `--preserve-state` | `SOCKET_PRESERVE_STATE` | Restore the files and lockfiles but keep the patch's local state (manifest entry, vendored artifact + ledger entry) for a later re-apply, and skip blob cleanup — the single-patch twin of `rollback --preserve-state`. Conflicts with `--skip-rollback`. |
+| `--skip-rollback` | `SOCKET_SKIP_ROLLBACK` | Only update the manifest, do not restore original files (for a vendored package that still has a manifest entry this also leaves the vendor wiring + artifact in place; refused for manifest-less vendored patches, where the revert *is* the removal). |
 
 **Examples:**
 ```bash
-# Interactive setup (all detected ecosystems, auto-detected)
-socket-patch setup
-
-# Non-interactive
-socket-patch setup -y
+# Remove by PURL
+socket-patch remove "pkg:npm/lodash@4.17.20"
 
-# Preview changes
-socket-patch setup --dry-run
+# Remove by UUID
+socket-patch remove 550e8400-e29b-41d4-a716-446655440000
 
-# Verify configuration in CI (exits non-zero if not set up or a patch has drifted)
-socket-patch setup --check
+# Remove without rolling back files
+socket-patch remove "pkg:npm/lodash@4.17.20" --skip-rollback
 
-# JSON output for scripting
-socket-patch setup --json -y
+# JSON output
+socket-patch remove "pkg:npm/lodash@4.17.20" --json
 ```
 
 ### `rollback`
@@ -1173,46 +1040,124 @@ socket-patch rollback --dry-run
 socket-patch rollback --json
 ```
 
-### `remove`
+### Agent mode
 
-Remove a patch from the manifest (rolls back files first by default). If the package is
-[vendored](#vendor), `remove` also **reverts the vendoring** — the lockfile is restored
-byte-for-byte and the `.socket/vendor/` artifact is deleted — so the patch is fully gone
-in one command. Patches vendored by `scan --mode vendored` have no manifest entry and are
-removable by PURL or UUID all the same (reverting the vendoring *is* the removal, so
-`--skip-rollback` is refused for them). A hosted patch is removed the same way: its
-lockfile entries are restored to their upstream registry entry, exactly as `rollback`
-does it (refused, with the manifest untouched, where that is impossible).
+Agent mode keeps patches in `.socket/manifest.json` + `.socket/blobs/` and edits the
+installed files in place, so the CLI has to run again after every install. `apply`
+and `repair` are agent-mode commands; `get`, `list`, `remove` and `rollback` work in
+every mode.
+
+### `apply`
+
+Apply the patches in `.socket/manifest.json` to the installed files in place. Idempotent — safe to run from install
+hooks and CI on every build.
 
 **Usage:**
 ```bash
-socket-patch remove <identifier> [options]
+socket-patch apply [options]
 ```
 
-**Arguments:**
-- `identifier` — package PURL (e.g. `pkg:npm/package@version`) or patch UUID.
-
 **Command-specific options** (plus all [Global options](#global-options)):
 | Flag | Env var | Description |
 |------|---------|-------------|
-| `--preserve-state` | `SOCKET_PRESERVE_STATE` | Restore the files and lockfiles but keep the patch's local state (manifest entry, vendored artifact + ledger entry) for a later re-apply, and skip blob cleanup — the single-patch twin of `rollback --preserve-state`. Conflicts with `--skip-rollback`. |
-| `--skip-rollback` | `SOCKET_SKIP_ROLLBACK` | Only update the manifest, do not restore original files (for a vendored package that still has a manifest entry this also leaves the vendor wiring + artifact in place; refused for manifest-less vendored patches, where the revert *is* the removal). |
+| `-f, --force` | `SOCKET_FORCE` | Skip pre-application hash verification (apply even if package version differs). |
+| `--check` | — | Read-only audit that the committed **Go** `replace`-redirects match the manifest (for CI / GitHub-App auditing) — Go only, since cargo patches in place and has no redirect to audit. Lock-free, crawl-free, and offline-safe: exits 0 in sync, 1 on drift. Vendored modules are excluded from the audit. |
+| `--vex <path>` | `SOCKET_VEX` | On a successful apply, also write an OpenVEX 0.2.0 document to this path. See [Inline VEX generation](#inline-vex-on-apply--scan--vendor). |
+| `--vex-product`, `--vex-no-verify`, `--vex-doc-id`, `--vex-compact` | `SOCKET_VEX_*` | Passthrough to the embedded VEX builder; mirror the standalone [`vex`](#vex) knobs. Inert unless `--vex` is set. |
 
 **Examples:**
 ```bash
-# Remove by PURL
-socket-patch remove "pkg:npm/lodash@4.17.20"
+# Apply patches
+socket-patch apply
 
-# Remove by UUID
-socket-patch remove 550e8400-e29b-41d4-a716-446655440000
+# Dry run
+socket-patch apply --dry-run
 
-# Remove without rolling back files
-socket-patch remove "pkg:npm/lodash@4.17.20" --skip-rollback
+# Apply only npm patches
+socket-patch apply --ecosystems npm
 
-# JSON output
-socket-patch remove "pkg:npm/lodash@4.17.20" --json
+# Apply in offline mode
+socket-patch apply --offline
+
+# JSON output for CI/CD
+socket-patch apply --json
+
+# Apply and emit an OpenVEX attestation in one step
+socket-patch apply --vex socket.vex.json
 ```
 
+> Packages managed by [`vendor`](#vendor) are skipped (`skipped`/`vendored` in JSON): the
+> committed vendored artifact is the patch, so there is nothing for `apply` to do — even
+> when the installed tree (e.g. `node_modules/`) is absent.
+
+### Agent mode in CI
+
+Agent mode patches the installed files in place, so every fresh dependency install
+reverts the patches until `socket-patch apply` runs again. (Hosted and vendored projects
+need no such step: the lockfile already names the patched packages.) Commit
+`.socket/manifest.json` and its blobs, then run `apply` in CI after every install:
+
+```bash
+# once, locally: record the patches (commit .socket/)
+socket-patch scan --mode agent
+
+# in CI, after `npm ci` / `pip install` / `bundle install` / ...
+socket-patch apply
+```
+
+> **v5.0: `setup` was removed.** See [Upgrading from `setup`](#upgrading-from-setup) to
+> retire the install hooks it wrote.
+
+Per-ecosystem notes for in-place patching:
+
+- **Cargo** patches the crate in place (in `vendor/` or the registry cache, rewriting
+  `.cargo-checksum.json` so `cargo build` accepts it) — note that a non-vendored crate
+  patches the **shared** `$CARGO_HOME/registry` cache, which affects every project on
+  the machine and is silently reset by `cargo clean` or a cache prune; vendor the
+  dependency (`--mode vendored`) for a project-local, committable patch.
+- **Go** writes a project-local patched copy under `.socket/go-patches/` plus a `go.mod`
+  `replace` directive (the module cache is `go.sum`-verified, so in-place patching can't
+  build); commit `go.mod` + `.socket/go-patches/` so a clone builds the patched bytes.
+- **Maven / NuGet**: in-place patching leaves the caches' own checksum sidecars stale
+  (NuGet's fixup deletes `.nupkg.metadata` and raises an advisory for the signed-package
+  `.nupkg.sha512` marker; Maven's `.jar.sha1`/`.jar.md5` are left as-is) — the copy-out
+  modes, `scan --mode vendored` and `scan --mode hosted`, never touch the caches and
+  avoid the issue entirely. See
+  [ecosystems.md](docs/ecosystems.md#maven--nuget-caveats).
+- **Deno** has no hosted or vendored mode, so agent mode is the only way to patch it.
+
+### Upgrading from `setup`
+
+v5 removes `socket-patch setup`. The hooks it wrote only ran `socket-patch apply`, so
+they keep working until you delete them, but nothing maintains them any more. For each
+project that ran `setup`:
+
+1. **Pick a mode.**
+   - *Move to hosted mode* (recommended; nothing runs after installs): run
+     `socket-patch rollback` (restores the patched files and empties the agent-mode
+     manifest), then `socket-patch scan`, and commit the lockfile changes and
+     `.socket/`.
+   - *Stay in agent mode*: keep `.socket/`, and add `socket-patch apply` to CI after
+     every install (see [Agent mode in CI](#agent-mode-in-ci)).
+2. **Delete the hook for each ecosystem `setup` wired:**
+   - **npm / pnpm / yarn / bun**: in `package.json`, remove the
+     `npx @socketsecurity/socket-patch apply --silent --ecosystems npm` command (or its
+     `pnpm dlx` twin) from `scripts.postinstall`, and from `scripts.dependencies` if it
+     is there. Drop the script key if nothing else is left in it.
+   - **Composer**: in `composer.json`, remove
+     `socket-patch apply --offline --silent --ecosystems composer` from
+     `scripts.post-install-cmd` and `scripts.post-update-cmd`.
+   - **Python**: remove `socket-patch[hook]` from `requirements.txt`, or from
+     `[project].dependencies` / `[tool.poetry.dependencies]` in `pyproject.toml`, then
+     `pip uninstall socket-patch-hook` in each environment that has it (the wheel is no
+     longer published, so a fresh install fails while the dependency is still listed).
+   - **Bundler**: delete the managed `plugin "socket-patch", path: ...` block from the
+     `Gemfile`, then `bundle plugin uninstall socket-patch`, and delete
+     `.socket/bundler-plugin/`, `.socket/gem-plugin-stamp` and the `/gem-plugin-stamp`
+     line in `.socket/.gitignore`.
+3. **Check:** `socket-patch list` shows what remains. In agent mode, run
+   `socket-patch apply` once to confirm the manifest still applies.
+
 ### `repair`
 
 Download missing blobs, re-vendor missing or corrupt vendored artifacts, and clean up unused
@@ -1277,8 +1222,7 @@ place — without bumping the package version.
    covers patches that are actually applied: agent patches against the installed tree,
    vendored patches against the **committed artifact** (marker `(vendored)`), and hosted
    patches against the installed copy the build consumes — or, before any install, against
-   the lockfile's integrity pin (marker `(redirected)`). Vendored and hosted patches need
-   no `setup` install hook to be attested. Whatever `--no-verify` says, a record the
+   the lockfile's integrity pin (marker `(redirected)`). Whatever `--no-verify` says, a record the
    lockfile no longer wires is never attested.
 3. Auto-detects the top-level **product** identifier (override with `--product`), probing
    in order:
@@ -1303,7 +1247,7 @@ Each statement's impact string records *how* the patch is persisted — one mark
 
 | Impact statement | Mode | What the evidence is | What a consumer should do |
 |---|---|---|---|
-| `Patched via Socket patch <uuid>` | agent | The installed tree: every patched file's hash was verified against the manifest's `afterHash` | Trust the statement as long as the agent install hook (or a CI `apply`) keeps re-applying; ecosystems without a hook must be declared in `setup.manual` |
+| `Patched via Socket patch <uuid>` | agent | The installed tree: every patched file's hash was verified against the manifest's `afterHash` | Trust the statement as long as a CI `apply` keeps re-applying after every install |
 | `Patched via Socket patch <uuid> (vendored)` | vendored | The **committed** `.socket/vendor/` artifact was hash-verified — no install hook needed; the lockfile wiring is the persistence mechanism | Trust it on any checkout; the committed bytes are the patch |
 | `Patched via Socket patch <uuid> (redirected)` | hosted | The lockfile's integrity pin points at the Socket-hosted patched package. A post-install `socket-patch vex` hash-verifies the installed copy; before any install it attests from the pin. When emitted in-run by a hosted `scan --vex`, the statement is attested **without hash verification** (the bytes are fetched at install time — the JSON `vex` summary carries `verified: false`) | Ensure installs still resolve from `patch.socket.dev` (the lockfile edit is intact), and run `socket-patch vex` **after installing** to have the redirected patches hash-verified against the installed tree |
 
@@ -1391,7 +1335,7 @@ Behavior worth knowing:
 | composer | `composer.lock` | `installed.json` and `COMPOSER=`-renamed locks are not read |
 | maven | `pom.xml` (+ `.mvn/` checksums) | Root pom only (no parents / submodules, no Gradle); legacy same-GAV hosted repositories cannot be attributed |
 | nuget | `nuget.config`, `packages.lock.json` | Hosted needs a `packages.lock.json` entry for the id: with no lock, the mapping names no version and is not attested — nor seen by `list` / `rollback` (only a pre-v5 redirect ledger record keeps it live); root config only |
-| deno | none | No hosted or vendored mode exists; Deno patches attest only through the manifest (agent mode + `setup.manual`) |
+| deno | none | No hosted or vendored mode exists; Deno patches attest only through the manifest (agent mode) |
 
 The full recognition rules are in
 [CLI_CONTRACT.md](crates/socket-patch-cli/CLI_CONTRACT.md) ("Manifest-less VEX").
@@ -1468,8 +1412,8 @@ socket-patch apply --json | jq '.status'
 # "success", "partialFailure", "noManifest", or "error"
 ```
 
-`scan` never prompts, so CI needs no `--yes` for it. The commands that do confirm
-(`get`, `rollback`, `remove`, `setup`) auto-proceed when stdin is not a TTY. Progress
+`scan` and hosted/vendored `get` never prompt, so CI needs no `--yes` for them. The
+commands that do confirm (agent-mode `get`, `rollback`, `remove`) auto-proceed when stdin is not a TTY. Progress
 indicators and ANSI colors are automatically suppressed when output is piped.
 
 The exact JSON shapes, exit codes, and stability guarantees are specified in
@@ -1510,11 +1454,9 @@ mode never write it):
 
 Patched file contents are in `.socket/blobs/` (named by git SHA256 hash).
 
-The manifest may also carry an optional top-level `"setup"` key persisting setup state —
-`"setup": { "manual": ["cargo"], "exclude": ["packages/legacy"] }` — where `manual`
-lists ecosystems you patch by hand so [`vex`](#vex) still attests them (see
-[`setup`](#setup)), and `exclude` lists workspace members excluded from setup (written
-by `setup --exclude`).
+A manifest written by an earlier release may also carry a top-level `"setup"` key
+(`manual`, `exclude`) from the removed `setup` command; v5 keeps it on rewrite but
+ignores it.
 
 ## Further reading
 
diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index 6cb0eb91..45db1b71 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -11,19 +11,20 @@ This document defines the **public surface** of the `socket-patch` binary. Anyth
 | `scan` | — | Find patches for installed packages and apply them. **v5.0 (MAJOR)**: a bare `scan` runs hosted mode (rewrites lockfiles so only the patched dependencies resolve to Socket-hosted, integrity-pinned packages); `--mode vendored` / `--mode agent` pick the other modes. Never prompts. See [scan modes](#scan-modes-v50) |
 | `vex` | — | Emit an OpenVEX 0.2.0 attestation derived from the local manifest, the vendor ledger, and the hosted / vendored patch references the project's lockfiles wire (no manifest required; hosted records come from the API) |
 | `vendor` | — | Eject patched dependencies into committable `.socket/vendor/` and rewire lockfiles |
-| `list` | — | Print patches in the local manifest, plus the vendor ledger's records (v5.0) and the hosted pins the lockfiles wire (labeled; see the `manifest_not_found` row and the action matrix) |
+| `list` | — | Print patches in the local manifest, plus the vendor ledger's records (v5.0) and the hosted pins the lockfiles wire (labeled; see the action matrix; an empty project exits 0) |
 | `get` | `download` | Agent mode by default (`--mode` selects hosted/vendored): fetch + apply a patch; requires positional `identifier` |
 | `apply` | — | Agent mode: apply patches from the local manifest |
-| `setup` | — | Agent mode: wire automatic-patching install hooks (npm/pypi/gem/composer) |
 | `rollback` | — | **Full-state rollback (v5.0, MAJOR)**: restore original files AND unwind vendored lockfile wiring / restore hosted pins to their upstream registry entries, remove the rolled-back entries from the manifest, and GC their blobs/archives; takes optional variadic positional `targets` (PURL \| UUID \| path glob). See [Rollback command contract](#rollback-command-contract-v50) |
 | `remove` | — | Agent mode: remove a patch from manifest (rolls back first); requires positional `identifier` |
 | `repair` | `gc` | Agent mode: download missing blobs, re-vendor missing/corrupt vendored artifacts (never re-synthesizing a lost ledger), and clean up unused ones (refuses with `lock_held` when a live process holds the lock; see "Lock lifecycle" below) |
 
 Rows are in `--help` order (v5.0): the hosted/vendored workflow (`scan` → `vex` → `vendor`, with `list` to inspect), then the agent-mode (in-place patching) commands.
 
+**Removed in v5.0:** the `setup` subcommand (see [Agent mode in CI](#agent-mode-in-ci-v50-setup-removed)).
+
 **Removed in v4.0:** the `unlock` subcommand (a leftover lock from a crashed run never blocks acquisition — the OS releases a dead holder's advisory lock — so there is no stale-lock state to inspect or clear before a mutating command; `repair` briefly owned lock-file cleanup in v4.x, and since v5.0 every lock-taking command removes its own lock file on exit).
 
-**Lock lifecycle (v5.0).** `<.socket>/apply.lock` never outlives the command that took it: acquisition creates `.socket/` when it is missing, the guard's drop unlinks the file WHILE the lock is still held (so a waiter can never lock an orphaned inode), releases it, and then removes `.socket/` itself if that left the directory empty — a run that had nothing to persist leaves no `.socket/` behind, and there is nothing to `.gitignore`. A leftover file from a crashed (SIGKILLed) run is reclaimed in place and removed by the next lock-taking command. The lock is taken by `apply`, `rollback`, `remove`, `repair`, `vendor`, `setup` while it persists `--exclude` (v5.0), agent-mode `get` and `scan --apply`/`--sync` (download → manifest write → nested apply is ONE lock window — the nested apply never re-acquires), and `scan`/`get` in vendored **and hosted** mode — hosted acquires it around its first wet write (the takeover pre-reverts), never on `--dry-run` and never when the run would write nothing, so hosted previews and no-op runs create no `.socket/`. Dry runs of the other commands may still take the lock; it is residue-free either way. A live holder is `lock_held` (exit 1); a directory or special file squatting on `.socket/` or on the lock path is a lock I/O error — `lock_io` (exit 1, `failed to open lock file at <path>: …`; a read-only project root surfaces the same code at the acquire, before any ledger or manifest write) — never `lock_held`.
+**Lock lifecycle (v5.0).** `<.socket>/apply.lock` never outlives the command that took it: acquisition creates `.socket/` when it is missing, the guard's drop unlinks the file WHILE the lock is still held (so a waiter can never lock an orphaned inode), releases it, and then removes `.socket/` itself if that left the directory empty — a run that had nothing to persist leaves no `.socket/` behind, and there is nothing to `.gitignore`. A leftover file from a crashed (SIGKILLed) run is reclaimed in place and removed by the next lock-taking command. The lock is taken by `apply`, `rollback`, `remove`, `repair`, `vendor`, agent-mode `get` and `scan --apply`/`--sync` (download → manifest write → nested apply is ONE lock window — the nested apply never re-acquires), and `scan`/`get` in vendored **and hosted** mode — hosted acquires it around its first wet write (the takeover pre-reverts), never on `--dry-run` and never when the run would write nothing, so hosted previews and no-op runs create no `.socket/`. Dry runs of the other commands may still take the lock; it is residue-free either way. A live holder is `lock_held` (exit 1); a directory or special file squatting on `.socket/` or on the lock path is a lock I/O error — `lock_io` (exit 1, `failed to open lock file at <path>: …`; a read-only project root surfaces the same code at the acquire, before any ledger or manifest write) — never `lock_held`.
 
 **Bare-UUID fallback.** `socket-patch <UUID>` is rewritten to `socket-patch get <UUID>`. The UUID shape checked is the standard 8-4-4-4-12 hex pattern (case-insensitive). See [`src/lib.rs::looks_like_uuid`](src/lib.rs).
 
@@ -57,7 +58,7 @@ In v3.0 every subcommand accepts the same set of "global" flags via a single sha
 | `--silent` | `-s` | `SOCKET_SILENT` | `false` | bool | Errors only |
 | `--dry-run` | — | `SOCKET_DRY_RUN` | `false` | bool | Preview, no mutations (a dry run may still take the transient `apply.lock`, removed again on exit — see "Lock lifecycle"; hosted and vendored previews never leave a `.socket/`) |
 | `--yes` | `-y` | `SOCKET_YES` | `false` | bool | Skip prompts (`scan` never prompts) |
-| `--lock-timeout` | — | `SOCKET_LOCK_TIMEOUT` | (none) | seconds (u64) | How long to wait for `<.socket>/apply.lock`. Unset and `0` both mean a single non-blocking try; a positive value retries with a 100 ms backoff. Only meaningful on the lock-taking subcommands — `apply`, `rollback`, `repair`, `remove`, `vendor`, `setup` (while persisting `--exclude`), and `scan`/`get` whenever they write (agent-mode download + apply, vendored, hosted) |
+| `--lock-timeout` | — | `SOCKET_LOCK_TIMEOUT` | (none) | seconds (u64) | How long to wait for `<.socket>/apply.lock`. Unset and `0` both mean a single non-blocking try; a positive value retries with a 100 ms backoff. Only meaningful on the lock-taking subcommands — `apply`, `rollback`, `repair`, `remove`, `vendor`, and `scan`/`get` whenever they write (agent-mode download + apply, vendored, hosted) |
 | `--debug` | — | `SOCKET_DEBUG` | `false` | bool | Verbose debug logs to stderr |
 | `--no-telemetry` | — | `SOCKET_TELEMETRY_DISABLED` | `false` | bool | Disable anonymous usage telemetry |
 | `--no-trust-lockfile-config` | — | `SOCKET_NO_TRUST_LOCKFILE_CONFIG` | `false` | bool | Opt out of hosted mode's automatic `trustLockfile: true` write to `pnpm-workspace.yaml` (see the pnpm trust-config note under the scan arguments) |
@@ -93,7 +94,6 @@ Beyond the globals above, each subcommand defines a small set of local arguments
 | `rollback` | optional variadic positional `targets` (PURL \| UUID \| path glob); `--one-off`; `--preserve-state` (v5.0) | `SOCKET_ONE_OFF`, `SOCKET_PRESERVE_STATE` | Rollback scope. Multiple targets union. A token becomes a path glob ONLY when it is path-SHAPED — contains a separator (`/` or `\`) or a glob metacharacter (`*?[`), or starts with `./`, or is absolute; a `pkg:` prefix is a PURL and every other bare word keeps identifier (PURL/UUID) semantics, so a mistyped identifier or truncated UUID stays a safe exit-1 "No patch found matching identifier: X" (with a hint suggesting `./X` or `X/**` for directory targeting) instead of silently becoming a path scope. An unparseable glob is a usage error (exit 2) |
 | `vex` | `--output` / `-O`, `--product`, `--no-verify`, `--doc-id`, `--compact` | `SOCKET_VEX_OUTPUT`, `SOCKET_VEX_PRODUCT`, `SOCKET_VEX_NO_VERIFY`, `SOCKET_VEX_DOC_ID`, `SOCKET_VEX_COMPACT` | OpenVEX 0.2.0 document generation; see "vex output channels" below |
 | `repair` | `--download-only` | `SOCKET_DOWNLOAD_ONLY` | Repair-specific cleanup mode (mutually exclusive with `--offline`; combining them is a usage error, exit 2) |
-| `setup` | `--check`, `--remove` (mutually exclusive); `--exclude` (CSV member paths); honors global `--ecosystems` | `SOCKET_SETUP_EXCLUDE`, `SOCKET_ECOSYSTEMS` | Wire / verify / revert the automatic-patching install hooks. `--exclude` skips + persists workspace members (property 9). See [Setup command contract](#setup-command-contract) |
 
 **pnpm hosted-mode contract**: `scan --mode hosted` handles block and flow resolutions in legacy `shrinkwrap.yaml` and lockfileVersion 5.x, 6.0, and 9.0. The [pinned compatibility matrix](../../docs/testing/pnpm-compatibility.md) samples pnpm majors 1–12. Early shrinkwrapVersion 3 without a positive minor version is refused with `redirect_pnpm_legacy_lockfile_unsupported`: pnpm 1.0.0 discards hosted URLs even on frozen installs. Upgrade to a tested release (1.43.1 or newer) and regenerate the lock, or use agent mode.
 
@@ -107,17 +107,17 @@ For a **9.0 root lock**, the CLI ensures `pnpm-workspace.yaml` carries `trustLoc
 
 **vlt hosted-mode contract**: `scan` / `get --mode hosted` rewrite, in `vlt-lock.json`, every default-registry node of a granted `name@version` (the `''` / `npm` segment or a URL segment equal to the lock's scalar `registry`, both DepID grammars, every peer and modifier variant): slot [2] becomes the granted sha512 and slot [3] the hosted URL (appended to a 3-tuple); the DepID, flags and trailing slots, the line ending and every other byte stay. `options` is never edited and `vlt.json` is only read. A lock with another `lockfileVersion` (decided on the raw JSON token), a BOM, a non-object body or a `nodes` section outside vlt's one-node-per-line layout refuses the whole lock (`redirect_vlt_lock_unsupported`). **Confirmation**: vlt drives when its install state (`node_modules/.vlt-lock.json` or `node_modules/.vlt/`) is present or no other npm-family lock is; then only `vlt-lock.json` confirms a uuid. Otherwise every lock is rewritten, `redirect_vlt_sibling_lockfiles` warns, and the other locks' rules confirm, including a dep `vlt-lock.json` merely does not wire (`redirect_vlt_entry_not_found`, `redirect_vlt_entry_vendored`). Whichever lock drives, a dep the vlt rewriter refuses (`redirect_vlt_missing_sha512`, `redirect_vlt_unsupported_lock_key`) is never confirmed by any lock, although a sibling lock may already carry its rewritten URL. **Artifact preflight**: before any takeover or write (dry runs included), each granted artifact with a default-registry instance is fetched once as vlt fetches it and must verify, else the dep is withheld (`redirect_vlt_artifact_unverifiable`, see the tag table). **Heal**: stale installed copies of Socket-owned nodes are removed so the next `vlt install` extracts the patched bytes, and `rollback` / `remove` do the same for the registry bytes (`--no-vlt-install-cleanup` keeps them; optional dependencies' copies are always kept); `redirect_vlt_reinstall_required` says what happened and what to run. The same-run `--vex` never attests a vlt package whose installed copy is stale or unchecked, whose lock a vlt release may ignore (`redirect_vlt_lockfile_version_missing`, `redirect_vlt_old_lockfile_ignored`, `redirect_vlt_scalar_registry_ignored`), or which also resolves from a non-default registry (`redirect_vlt_custom_registry_skipped`). `vlt.json` or vlt install state without `vlt-lock.json` warns `redirect_vlt_no_lockfile` instead of `redirect_npm_no_lockfile`. `rollback` / `remove` restore each hosted node's slots [2] and [3] from the npm registry, following the lock's own slot-[3] convention (see "Hosted unwind coverage"). Tested releases: `docs/testing/vlt-compatibility.md`.
 
-**Takeover reconciliation (every hosted ecosystem, v5.0)**: vendoring over a hosted pin (`vendor`, `scan --mode vendored`, `get --mode vendored`) first RESTORES that purl's lock entries to their default upstream registry entry — the same restore `rollback` runs (core `patch::redirect::upstream::restore_upstream`; see "Hosted unwind coverage"), over the hosted pins lockfile discovery finds (v5 keeps no hosted ledger) — and then vendors, so the vendor ledger records the PRISTINE registry entry as its wiring `original` and `vendor --revert` lands back on upstream registry state, never on hosted. The run that takes over records a `vendor_takeover_reverted_redirect` advisory event (`skipped` action beside the purl's genuine outcome; detail `<purl> was hosted; restored its upstream registry entry (<files>) before vendoring (mode takeover)`; the human path prints `Warning (vendor_takeover_reverted_redirect): …`), plus any advisory the restore raised (`npm_allow_remote_left`, …). `--dry-run` resolves the same restore without writing (registry lookups included): a pin that would restore reports `vendor_would_revert_redirect`, and one that would be refused surfaces in the preview with the wet run's `redirect_revert_failed` code and detail (for bun, whose hosted rewrite replaces the entry's `name@version` spec, the preview first runs the Bun vendored preflight described below and then stops at the advisory instead of reading the still-hosted lock — a lock the vendored backend would refuse is previewed as the wet run's `failed <code>`, never as `vendor_would_revert_redirect`). A purl whose upstream entry cannot be restored — `--offline`, a registry that does not answer, a lock the restore refuses (see "Hosted unwind coverage"; a hosted binary `bun.lockb` pin IS restored for the takeover — its npm registry record is rebuilt natively — while `rollback` / `remove` refuse it) — fails `redirect_revert_failed` with the detail `cannot vendor over the live hosted pin: cannot restore <purl> to its upstream registry entry: <why>; restore it from version control instead (`git checkout -- <files>`)` (exit 1 / `partial_failure`, nothing vendored for it, the hosted wiring left in place). The cargo backend's `hosted_redirect_live` refusal backstops a crate whose hosted residue is still in place when it is reached; its detail names `socket-patch rollback` and `git checkout -- Cargo.toml Cargo.lock`. **Bun vendored preflight before the takeover**: `vendor` — like `scan` / `get --mode vendored`, whose pre-download preflight runs earlier — checks `bun.lock` / `bun.lockb` with the shared Bun vendored preflight BEFORE the upstream restore, so a hosted purl on a lock the vendored backend refuses (a pre-version-2 `workspace:` lock → `vendor_bun_workspace_unsupported`; a malformed or unsupported binary lock → `vendor_bun_lockb_invalid`; an unsupported text-lock version → its code) is reported `failed <code>` with the hosted wiring and active Bun lock byte-untouched (exit 1 / `partial_failure`): the package stays hosted-patched instead of being un-hosted and then refused. `vendor --dry-run` previews that same `failed` code (exit-code parity with the wet run, nothing written) instead of promising `vendor_would_revert_redirect`. Pinned by `tests/in_process_vendor_bun_takeover.rs` and, against real Bun, `tests/mode_migration_bun.rs`. Hosted → vendored and vendored → hosted (`redirect_takeover_reverted_vendored` in `redirect.warnings[]`) both work in place on the locks the target mode accepts. **Removed in v5.0**: the run-level `vendor_supersedes_redirect` warning and its reconcile of the redirect ledger (a live lock that already proved vendored won over a stale hosted ledger record) — once the lock routes a package to `.socket/vendor/`, no hosted state is left to go stale. Which way the live lock points is decided by the same lockfile discovery rules `vex` gates attestations on (see "Manifest-less VEX (lockfile discovery)"), for `redirect_supersedes_vendored` and `hosted_wiring_retained` alike.
+**Takeover reconciliation (every hosted ecosystem, v5.0)**: vendoring over a hosted pin (`vendor`, `scan --mode vendored`, `get --mode vendored`) first RESTORES that purl's lock entries to their default upstream registry entry — the same restore `rollback` runs (core `patch::redirect::upstream::restore_upstream`; see "Hosted unwind coverage"), over the hosted pins lockfile discovery finds (v5 keeps no hosted ledger) — and then vendors, so the vendor ledger records the PRISTINE registry entry as its wiring `original` and `vendor --revert` lands back on upstream registry state, never on hosted. The run that takes over records a `vendor_takeover_reverted_redirect` advisory event (`skipped` action beside the purl's genuine outcome; detail `<purl> was hosted; restored its upstream registry entry (<files>) before vendoring (mode takeover)`; the human path prints `Warning: …`), plus any advisory the restore raised (`npm_allow_remote_left`, …). `--dry-run` resolves the same restore without writing (registry lookups included): a pin that would restore reports `vendor_would_revert_redirect`, and one that would be refused surfaces in the preview with the wet run's `redirect_revert_failed` code and detail (for bun, whose hosted rewrite replaces the entry's `name@version` spec, the preview first runs the Bun vendored preflight described below and then stops at the advisory instead of reading the still-hosted lock — a lock the vendored backend would refuse is previewed as the wet run's `failed <code>`, never as `vendor_would_revert_redirect`). A purl whose upstream entry cannot be restored — `--offline`, a registry that does not answer, a lock the restore refuses (see "Hosted unwind coverage"; a hosted binary `bun.lockb` pin IS restored for the takeover — its npm registry record is rebuilt natively — while `rollback` / `remove` refuse it) — fails `redirect_revert_failed` with the detail `cannot vendor over the live hosted pin: cannot restore <purl> to its upstream registry entry: <why>; restore it from version control instead (`git checkout -- <files>`)` (exit 1 / `partial_failure`, nothing vendored for it, the hosted wiring left in place). The cargo backend's `hosted_redirect_live` refusal backstops a crate whose hosted residue is still in place when it is reached; its detail names `socket-patch rollback` and `git checkout -- Cargo.toml Cargo.lock`. **Bun vendored preflight before the takeover**: `vendor` — like `scan` / `get --mode vendored`, whose pre-download preflight runs earlier — checks `bun.lock` / `bun.lockb` with the shared Bun vendored preflight BEFORE the upstream restore, so a hosted purl on a lock the vendored backend refuses (a pre-version-2 `workspace:` lock → `vendor_bun_workspace_unsupported`; a malformed or unsupported binary lock → `vendor_bun_lockb_invalid`; an unsupported text-lock version → its code) is reported `failed <code>` with the hosted wiring and active Bun lock byte-untouched (exit 1 / `partial_failure`): the package stays hosted-patched instead of being un-hosted and then refused. `vendor --dry-run` previews that same `failed` code (exit-code parity with the wet run, nothing written) instead of promising `vendor_would_revert_redirect`. Pinned by `tests/in_process_vendor_bun_takeover.rs` and, against real Bun, `tests/mode_migration_bun.rs`. Hosted → vendored and vendored → hosted (`redirect_takeover_reverted_vendored` in `redirect.warnings[]`) both work in place on the locks the target mode accepts. **Removed in v5.0**: the run-level `vendor_supersedes_redirect` warning and its reconcile of the redirect ledger (a live lock that already proved vendored won over a stale hosted ledger record) — once the lock routes a package to `.socket/vendor/`, no hosted state is left to go stale. Which way the live lock points is decided by the same lockfile discovery rules `vex` gates attestations on (see "Manifest-less VEX (lockfile discovery)"), for `redirect_supersedes_vendored` and `hosted_wiring_retained` alike.
 
 ### Scan modes (v5.0)
 
 **Mode resolution (`resolve_mode_flags`, MAJOR in v5.0).** `--mode`, or one of its legacy boolean spellings (`--redirect`, `--vendor`, `--apply`/`--sync`), picks the mode. With none of them, `scan` runs **hosted** mode — JSON and human alike; the result nests under the JSON `redirect` sub-object (see the hosted paragraph below). The one exception: a `--prune` or `--global`/`--global-prefix` scan with no mode has no project lockfile to rewire, so it is **report-only** — discovery, the table, the `updates` array and the `redirectState` block below, plus the `--prune` GC — and, in human mode, ends with the hint `To apply these patches in place, run:` / `  socket-patch scan --mode agent [PATHS]` / `  socket-patch get <package-name-or-purl-or-CVE-ID>`. An explicit `--mode hosted` (or `--redirect`) with `--global`/`--global-prefix` is a usage error (exit 2: global installs have no project lockfile to redirect).
 
-**scan never prompts, in any mode** (v5.0): no confirm, no free-tier patch menu (it always takes the top-ranked downloadable patch; see "Which patch gets selected"), and no `Non-interactive mode detected` note. `--yes` does not change a scan. `get`, `rollback`, `remove`, `setup` and `--update` keep their prompts.
+**scan never prompts, in any mode** (v5.0): no confirm, no free-tier patch menu (it always takes the top-ranked downloadable patch; see "Which patch gets selected"), and no `Non-interactive mode detected` note. `--yes` does not change a scan. `get` (agent mode only — hosted/vendored `get` never prompts either, v5.0), `rollback`, `remove` and `--update` keep their prompts.
 
 **Hosted-state visibility (`redirectState`, additive/MINOR).** Every non-hosted-mode, non-vendored-mode `scan --json` SUCCESS envelope (report-only, `--mode agent`/`--apply`/`--sync`, and the zero-discovery envelope) carries an additive top-level `redirectState` object whenever the project's lockfiles pin ≥ 1 hosted patch: `{ mode, records: [{purl, uuid}], wiringLive: [purl] }`. It is a descriptive STATE block, not a warning. `mode` is the constant `"hosted"`. **v5.0 (MAJOR shape change)**: hosted mode keeps no ledger, so `records` lists the hosted pins lockfile discovery finds (one per `(purl, uuid)`, the same discovery `vex` uses: a hosted URL counts only on `https://patch.socket.dev` or the `--patch-server-url` origin), and the v4 `ledger` and `records[].ledgerKey` keys are gone. Each record's `purl` is CANONICALIZED (qualifiers stripped, percent-decoded — e.g. `pkg:npm/@scope/pkg@1.0.0`, `pkg:gem/nokogiri@1.13.3`) to the same spelling `wiringLive` carries, so the join is a plain string compare. `wiringLive` is the subset of those pins among this run's *counted* purls (post-`--ecosystems`-filter) — computed once per run, the same set that feeds `hosted_wiring_retained`. A record missing from `wiringLive` is still wired; it just was not crawled/queried this run (an `--ecosystems` filter, a zero discovery). The key is omitted when no lockfile pins a hosted patch (and under `--global`), and error envelopes (the `--offline` refusal, all-batches-failed) are deliberately minimal and never carry it. A pre-v5 `.socket/vendor/redirect-state.json` is not read. Hosted-mode runs carry the `redirect` sub-object instead (the run's own result), and vendored-mode runs carry the takeover warnings (their takeovers may restore pins mid-run) — neither duplicates a pre-run snapshot that could go stale.
 
-**Agent-flow run-level warnings (additive).** An agent-mode apply (`--mode agent` / `--apply` / `--sync`, `--json`) may add a top-level `warnings[]` array of `{code, detail}` entries to the scan envelope (absent when none fired; each is also mirrored to stderr unless `--silent`). They surface cross-mode state the apply cannot change — never a status or exit-code change (hosted refusals set the precedent: exit 0 + warning). Codes (stable; new codes are additive/MINOR): `vendored_ownership_retained` — vendor-owned package(s) were skipped before download (the per-patch `skipped`/`vendored` records in `apply.patches[]` are unchanged); the detail names the purls and the migration path (`remove <purl>`, or `vendor --revert` which unwinds every vendored package, then re-run). `hosted_wiring_retained` — the lockfiles still pin scanned package(s) to a hosted patch (the agent run does not unwind hosted wiring — as of v5.0 that is `socket-patch rollback`'s job, which restores the upstream registry entries, or `remove <purl>` per package); the detail names the purls and the options (stay `--mode hosted`, migrate via `scan --mode vendored`, or `socket-patch rollback`). The warning keys on the hosted pins lockfile discovery finds at scan time, so a flow that restored the upstream entries retires it. The human path prints the same `hosted_wiring_retained` text to stderr after an apply; the vendored counterpart is already covered by its per-package `[skip] … (vendored …)` lines. `ownership_not_restored` (v5.0; `apply` and `rollback` `warnings[]` alike) — a file WAS patched (or restored) but its ownership could not be put back to the original uid/gid (the mode is still restored last); the detail is `<purl>: <path>: patched, but ownership could not be restored to uid N gid M: <error>` and the human line `Warning (ownership_not_restored): <detail>` (stderr, muted by `--silent`); never a status or exit change.
+**Agent-flow run-level warnings (additive).** An agent-mode apply (`--mode agent` / `--apply` / `--sync`, `--json`) may add a top-level `warnings[]` array of `{code, detail}` entries to the scan envelope (absent when none fired; each is also mirrored to stderr unless `--silent`). They surface cross-mode state the apply cannot change — never a status or exit-code change (hosted refusals set the precedent: exit 0 + warning). Codes (stable; new codes are additive/MINOR): `vendored_ownership_retained` — vendor-owned package(s) were skipped before download (the per-patch `skipped`/`vendored` records in `apply.patches[]` are unchanged); the detail names the purls and the migration path (`remove <purl>`, or `vendor --revert` which unwinds every vendored package, then re-run). `hosted_wiring_retained` — the lockfiles still pin scanned package(s) to a hosted patch (the agent run does not unwind hosted wiring — as of v5.0 that is `socket-patch rollback`'s job, which restores the upstream registry entries, or `remove <purl>` per package); the detail names the purls and the options (stay `--mode hosted`, migrate via `scan --mode vendored`, or `socket-patch rollback`). The warning keys on the hosted pins lockfile discovery finds at scan time, so a flow that restored the upstream entries retires it. The human path prints the same `hosted_wiring_retained` text to stderr after an apply; the vendored counterpart is already covered by its per-package `[skip] … (vendored …)` lines. `ownership_not_restored` (v5.0; `apply` and `rollback` `warnings[]` alike) — a file WAS patched (or restored) but its ownership could not be put back to the original uid/gid (the mode is still restored last); the detail is `<purl>: <path>: patched, but ownership could not be restored to uid N gid M: <error>` and the human line `Warning: <detail>` (stderr, muted by `--silent`); never a status or exit change.
 
 `scan --prune` opts into garbage collection. When set, `scan` removes manifest entries for packages no longer present in the crawl, then deletes orphan blob, diff, and package-archive files from `.socket/`. Off by default (v3.0) so a temporary uninstall doesn't silently destroy manifest state. Only entries whose ecosystem this run actually crawled are eligible: a `pkg:<type>/` with no crawler in this build (a newer CLI's ecosystem in the committed manifest) is exempt — the crawl never looked for them, so their absence is not evidence of removal (same fail-safe as the `--ecosystems` filter, which narrows the query but never the prune's installed set). The pass also reconciles vendored state (runs FIRST, under ONE apply-lock acquisition shared with the manifest prune — lock contention skips the whole pass without failing the scan; `--lock-timeout` is honored and a lock I/O error is reported rather than swallowed; the existence gate — a manifest file OR a vendor ledger file, both cheap stats; an emptied ledger is deleted on save, so its presence is its content proxy — runs BEFORE the lock, so a bare project never gets a `.socket/`; in the vendored scan arms the pass runs AFTER the vendor step): (a) ledger entries still tracked by a manifest record (manifest-mode entries written by standalone `vendor`) whose patch is gone from the manifest are reverted — `detached` entries (every `scan`/`get --mode vendored` entry, v5.0) have no manifest record to lose and are exempt from this leg; (b) EVERY ledger entry whose dependency is no longer in the lockfile graph is reverted and any manifest entry it still had dropped (v5.0: the check is about the lockfile, not the manifest, so embedded-record entries are no longer exempt; a missing or undeterminable lockfile keeps the entry, fail-safe); and (c) orphan `.socket/vendor/<eco>/<uuid>` dirs with no ledger entry are swept. The prune never deletes a zero-patch `.socket/manifest.json` (its `{"patches": {}}` + `setup` block stay). The JSON `gc` sub-object gains `revertedVendoredEntries` + `keptVendoredEntries` + `failedVendoredEntries` + `removedVendorOrphanDirs` (wet) / `revertableVendoredEntries` + `vendorOrphanDirs` (preview), plus two ADDITIVE wet-only keys: `skipped: {code, message}` — present exactly when the pass was skipped at the lock (`lock_held` | `lock_io`; every count is then zero) — and `warnings: [{code, detail}]` — `vendor_state_write_failed` / `manifest_write_failed` (entries were reverted but the ledger or manifest rewrite failed) and `cleanup_failed` (an orphan sweep failed mid-way). Human mode prints `GC: skipped (<code>): <message>.`, one `GC: <detail>.` line per warning, and `GC: failed to revert N vendored entries: …` (singular for one) for `failedVendoredEntries`. `keptVendoredEntries` lists drift-kept entries the revert deliberately preserved (`vendor_artifact_kept` — undo the drift and re-run `vendor --revert` to finish); the preview cannot see drift (backends return before the wiring replay on dry runs), so `revertableVendoredEntries` may over-promise what a wet run will actually reclaim.
 
@@ -125,7 +125,7 @@ For a **9.0 root lock**, the CLI ensures `pnpm-workspace.yaml` carries `trustLoc
 
 **Throttling: bounded retry, then a reported failure.** Every patch-API JSON call (the batch query, the per-package patch lists, patch views and VEX record fetches, hosted package references) retries an HTTP `429` or `503` answer up to 3 times (`SOCKET_API_MAX_RETRIES=<n>`, `0`-`10`; `0` = no retry). The wait honors `Retry-After` (delta-seconds or HTTP-date); a `Retry-After` over 30 s is not waited out — the answer is final at once — and one under the jittered first backoff step (`0`, a past date) waits that step instead. Without one it backs off 0.5 s / 1 s / 2 s (each step up to 8 s, with jitter in its upper half). All retries in one run share a 60 s wall-clock window that opens with the run's first retry: a retry whose wait would end after it closes is refused and the answer is final. Parallel requests wait in parallel, so each still gets its retries while the run adds at most about 60 s. Nothing else is retried (401/403 still drive the proxy fallback on the first answer; the public proxy's permanent `503 "Patch API is not configured"` is never retried on any path — the batch query still degrades to the per-package path at once, and a per-package lookup or patch view answering it is the same non-throttle failure it always was, so the legacy per-package path still skips that package), and a retried answer folds exactly where the first attempt's would have, so output is identical to an unthrottled run's. A request still throttled after that is a failure in the channel its siblings use: a failed batch is the human `Warning: API batch <n> of <total> failed: <error>` line and, under `--json`, a run-level `warnings[]` entry `{code: "api_batch_failed", detail: "API batch <n> of <total> failed: <error>"}` (additive; `status` stays `success`, exit 0 — the other batches' packages are reported); a failed per-package patch-list query in the agent / hosted / vendored flows is the human `Warning: could not fetch details for <purl>: <error>` line and, under `--json`, `{code: "patch_details_failed", detail: "could not fetch details for <purl>: <error>"}`. When every batch (or every patch-list query) fails, the existing all-failed error envelope and exit 1 apply. The error names the exhausted retry: `Rate limit exceeded (HTTP 429, gave up after 3 retries). Please try again later.` / `API request failed with status 503: <body> (gave up after 3 retries)` (or `(Retry-After <n> s exceeds the 30 s retry cap)` / `(the run's 60 s retry window has closed)`); with retries off it is the pre-retry text. On the token-less legacy per-package proxy path (a proxy without `POST /patch/batch`), a package still throttled (429 / over-capacity 503) after its retries fails its whole batch query, so every package in that batch goes unchecked and is reported through the batch-failure channel above (an unresolvable PURL, or a "not configured" 503, is still skipped individually). Pinned by `tests/scan_api_retry_e2e.rs` and the core crate's `tests/api_retry_e2e.rs`.
 
-**Lockfile supplement (v3.4)**: `scan` discovery is no longer limited to installed trees. The project's lockfiles (`package-lock.json`/`npm-shrinkwrap.json`, `pnpm-lock.yaml` v9, `yarn.lock` classic + berry, `bun.lock`, `vlt-lock.json` (registry nodes, Socket-hosted pins included; vendored `file` nodes are left to the vendor ledger), `Cargo.lock`, `go.sum`, `composer.lock`, `Gemfile.lock`, `uv.lock`/`poetry.lock`/pinned `requirements.txt`) are inventoried and dependencies with NO installed copy join discovery — counts, the API lookup, the table (flagged ` [NOT INSTALLED]`, plus a stderr note), and the prune "scanned" set (a wiped node_modules no longer prunes lockfile-listed entries). JSON gains a top-level `lockfileOnlyPackages` count and an additive `notInstalled: true` on matching `packages[]` entries. `--apply` partitions lockfile-only patches out BEFORE download (calm `skipped`/`package_not_installed` records — never an error exit, never a manifest write); `--vendor` passes them through to the vendor engine's auto-fetch. Vendored-ledger entries likewise stay discoverable on a fresh clone (the committed artifact is the dependency). Global scans (`--global`) get no supplement. **Rush monorepos** (no root lockfile, `rush.json` present): the npm-lock inventory falls back to the Rush source-of-truth locks — `common/config/rush/pnpm-lock.yaml` plus every `common/config/subspaces/*/pnpm-lock.yaml` (`read_dir`-sorted, repo-relative paths preserved) — so a Rush repo's dependencies still join discovery. **Plug'n'Play layouts are an explicit refusal, not an empty inventory**: a `.pnp.*` loader means the npm packages are structurally unreachable in EVERY mode (under yarn PnP the installed-tree crawl is empty too — no `node_modules/`), so `scan` surfaces an additive top-level `warnings[]` array (`{code, detail}` objects, omitted when empty) carrying `yarn_pnp_unsupported` (same code as apply's refusal; remedy `yarn patch <pkg>`) or `pnpm_pnp_unsupported` (pnpm's `node-linker=pnp` twin; pnpm remedies), plus a stderr `Warning (<code>): …` line on the human path. Exit code and `status` are deliberately unchanged (exit 0 / `success` — the same posture as hosted refusals, which exit 0 with `redirected: 0`); the warning is the machine-readable signal that nothing was checked. Pinned by `tests/e2e_safety_yarn_pnp.rs`.
+**Lockfile supplement (v3.4)**: `scan` discovery is no longer limited to installed trees. The project's lockfiles (`package-lock.json`/`npm-shrinkwrap.json`, `pnpm-lock.yaml` v9, `yarn.lock` classic + berry, `bun.lock`, `vlt-lock.json` (registry nodes, Socket-hosted pins included; vendored `file` nodes are left to the vendor ledger), `Cargo.lock`, `go.sum`, `composer.lock`, `Gemfile.lock`, `uv.lock`/`poetry.lock`/pinned `requirements.txt`) are inventoried and dependencies with NO installed copy join discovery — counts, the API lookup, the table (flagged ` [NOT INSTALLED]`, plus a stderr note), and the prune "scanned" set (a wiped node_modules no longer prunes lockfile-listed entries). JSON gains a top-level `lockfileOnlyPackages` count and an additive `notInstalled: true` on matching `packages[]` entries. `--apply` partitions lockfile-only patches out BEFORE download (calm `skipped`/`package_not_installed` records — never an error exit, never a manifest write); `--vendor` passes them through to the vendor engine's auto-fetch. Vendored-ledger entries likewise stay discoverable on a fresh clone (the committed artifact is the dependency). Global scans (`--global`) get no supplement. **Rush monorepos** (no root lockfile, `rush.json` present): the npm-lock inventory falls back to the Rush source-of-truth locks — `common/config/rush/pnpm-lock.yaml` plus every `common/config/subspaces/*/pnpm-lock.yaml` (`read_dir`-sorted, repo-relative paths preserved) — so a Rush repo's dependencies still join discovery. **Plug'n'Play layouts are an explicit refusal, not an empty inventory**: a `.pnp.*` loader means the npm packages are structurally unreachable in EVERY mode (under yarn PnP the installed-tree crawl is empty too — no `node_modules/`), so `scan` surfaces an additive top-level `warnings[]` array (`{code, detail}` objects, omitted when empty) carrying `yarn_pnp_unsupported` (same code as apply's refusal; remedy `yarn patch <pkg>`) or `pnpm_pnp_unsupported` (pnpm's `node-linker=pnp` twin; pnpm remedies), plus a stderr `Warning: …` line on the human path. Exit code and `status` are deliberately unchanged (exit 0 / `success` — the same posture as hosted refusals, which exit 0 with `redirected: 0`); the warning is the machine-readable signal that nothing was checked. Pinned by `tests/e2e_safety_yarn_pnp.rs`.
 
 **Vendor auto-fetch (v3.4)**: `vendor`/`scan --vendor` no longer fail on lockfile-resolved packages with no installed copy. Already-vendored purls stage from their committed artifact (sha256-verified against the vendor ledger — a vlt directory artifact against its file inventory, which leaves out the links vlt creates inside it; offline-safe) when the ledger entry is at the manifest record's patch uuid; a superseding uuid fetches the pristine package instead, since the older artifact holds the older patch's bytes. Otherwise the pristine artifact is fetched per the lockfile resolution and verified against the lock's recorded integrity FAIL-CLOSED before any write: npm SRI (or yarn classic's sha1 fragment; for vlt the registry node's slot [2]), yarn berry's cache-zip checksum (rebuilt from the fetched tarball; cacheKey 10c0 only), Cargo.lock sha256 over the .crate, go.sum `h1:` dirhash over the module zip, composer `dist.shasum` (sha1), Gemfile.lock `CHECKSUMS` sha256, uv.lock wheel sha256 (pure `py3-none-any` wheels only). Entries the lock cannot verify are NEVER fetched (`vendor_fetch_unverifiable` warning + the calm `package_not_installed` skip). Registry bases honor `SOCKET_NPM_REGISTRY`, `SOCKET_CRATES_REGISTRY`, `SOCKET_GOPROXY` (else `GOPROXY`, `GONOPROXY` and `GOPRIVATE` the way go reads them — see the env table); npm/yarn/composer/gem/uv lock-recorded URLs are used verbatim. `--offline` refuses the fetch with the calm skip (the detail names the lockfile resolution). The fetch stages into a private tempdir — the project tree is never touched. **Deferred fetch (v5.0):** a purl the vendor ledger already covers (its entry records the record's patch uuid and the committed artifact is on disk — a file artifact only while it hashes to the ledger's `sha256`; not under `--force`), and a lockfile-only cargo crate the registry could fetch and verify (a crates.io `Cargo.lock` entry with a checksum, or the pre-vendor resolution the ledger recovers) while the patch service is enabled, are NOT downloaded up front: the fetch runs only if the backend reaches a branch that reads the pristine tree (a drifted committed copy rebuilt locally, a service miss). An in-sync re-run therefore makes no registry request, reports no `vendor_fetched_missing`, and succeeds with no network or under `--offline`. A deferred fetch that does run records its `vendor_fetched_missing` just ahead of the package's own event; one that fails, is unverifiable, or is refused by `--offline` reports the same events the up-front fetch would have. A git, path or custom-registry cargo crate is never deferred, so it keeps `vendor_fetch_unverifiable` + `package_not_installed` and is never vendored from the service's crates.io build. **Gem, local build only** (`--vendor-source build`, or no service config): a not-installed gem the lock can verify (bundler >= 2.6 `CHECKSUMS`) and no ledger entry covers is refused `gem_spec_missing` (`failed`, the backend's own detail) BEFORE any download — a downloaded `.gem` carries no eval-able stub gemspec, so a local build can never vendor it; no `vendor_fetched_missing` precedes it, and a refusal the backend would have reached first on the fetched copy reports as `gem_spec_missing` too. Not under `--dry-run`, which still fetches and previews the gem (`vendor_fetched_missing` + `verified`).
 
@@ -144,7 +144,7 @@ For a **9.0 root lock**, the CLI ensures `pnpm-workspace.yaml` carries `trustLoc
 
 `scan --vendor` swaps the in-place apply for the vendor pipeline: discover → download the selected patch records **into memory** (no manifest write) → vendor every selected dependency via the same engine as the `vendor` command (under the same lock). Vendored mode is **manifest-free (v5.0)**: `.socket/manifest.json` is never written or read by a vendored run; each ledger entry carries `detached: true` plus an embedded copy of the patch record (`record`) as its verification source, and the run's footprint is `.socket/vendor/**` only. The vendor step's scope is what discovery selected — the former "whole manifest is vendored" re-vendor on an empty discovery is retired (`repair` verifies and rebuilds committed vendored state; `scan --prune` reconciles ledger entries whose dependency left the lockfile). A package the ledger holds at an older patch uuid is still **re-vendored automatically** when discovery selects the newer patch (its old uuid dir is removed — `vendor_stale_artifact_removed`); same-uuid re-runs reuse the embedded record, skip the patch-view fetch, and are `already_vendored` skips. **Legacy manifest-mode entries**: when a vendored run vendors a purl that also has a `.socket/manifest.json` record (a project vendored by a pre-5.0 binary, or by standalone `vendor` from an agent-mode manifest), that manifest record is dropped in the same run — the ledger becomes the owner (migration write); an emptied manifest is left as `{"patches": {}}`, never deleted. The migration is reported through the run-level `warnings[]` (stderr in human mode), never as a run error: `vendor_manifest_record_migrated` (`N manifest records moved to the vendor ledger (vendored mode is manifest-free): <purls>`) or `vendor_manifest_migration_failed` (the manifest or the ledger could not be read or rewritten; the legacy records were left in place) — so a corrupt `.socket/manifest.json` no longer fails a vendored run (standalone `vendor`, the one manifest-driven writer, still fails closed on it). With `--prune`, GC runs **after** the vendor step (the step never reads the manifest, and running the sweep last lets it reclaim what the run itself orphaned — a migrated legacy record's blobs, a superseded uuid dir). JSON output gains a `download` sub-object — the detached download envelope `{found, downloaded, skipped, failed, detached: true, patches: [{purl, uuid, action: "downloaded" | "skipped" | "failed", …}], warnings?}` (no `applied` field — nothing is applied in place; `detached: true` is pinned and always present; a `downloaded` record whose purl the ledger already holds at another uuid carries the additive `oldUuid` — the re-vendor the vendor step then performs — and its human `[fetch]` line reads `<purl> (replacing <short uuid>)`) — and a `vendor` sub-object (a full vendor Envelope). Patch blobs are held in memory (see "Patch sources stay in memory" under the vendor contract). `--dry-run` previews per-patch `would_vendor` | `would_revendor` (+`oldUuid`) | `already_vendored` — plus, additive, `would_refuse` (+`errorCode`, `error`) for npm purls the wet run's Bun preflight (see the `get --mode vendored` bullet below) would refuse — without network downloads or disk writes; the preview never flips status or exit (the human path — `scan` and `get` alike, through one shared printer — prints `[would-refuse] <purl> (<code>): <detail>` lines behind the `--silent` gate). Interactive mode prompts "Download and vendor N patches?" (singular for one).
 
-**Vendored entries and the rest of the CLI.** Because nothing is in the manifest, vendored patches are invisible to `apply` (nothing to apply in place) but fully visible to `list` (listed from the ledger, labeled `Mode: vendored (recorded in .socket/vendor/state.json)` in human mode, exit 0 on a vendored-only project), `vex` (attested from the embedded records while a lockfile still wires the artifact — see "Manifest-less VEX"), `repair` (health-checked and rebuilt from the ledger), `scan --prune` (lockfile-driven reconcile) and `setup --check`'s patch-consistency property (consulted from the embedded records). They are exempt from standalone `vendor`'s manifest reconcile (`reconcile_dropped` never touches `detached` entries) and exit via `remove <purl>` (which reverts them), `vendor --revert`, or `rollback`, whose vendored leg reverts every in-scope ledger entry (unscoped and identifier-scoped runs; path-scoped runs reach them only when an installed copy matches). The hidden `--detached` flag (`scan --vendor --detached`) names exactly this — the only — vendored posture and is accepted as a no-op for compatibility.
+**Vendored entries and the rest of the CLI.** Because nothing is in the manifest, vendored patches are invisible to `apply` (nothing to apply in place) but fully visible to `list` (listed from the ledger, labeled `Mode: vendored (recorded in .socket/vendor/state.json)` in human mode, exit 0 on a vendored-only project), `vex` (attested from the embedded records while a lockfile still wires the artifact — see "Manifest-less VEX"), `repair` (health-checked and rebuilt from the ledger), and `scan --prune` (lockfile-driven reconcile). They are exempt from standalone `vendor`'s manifest reconcile (`reconcile_dropped` never touches `detached` entries) and exit via `remove <purl>` (which reverts them), `vendor --revert`, or `rollback`, whose vendored leg reverts every in-scope ledger entry (unscoped and identifier-scoped runs; path-scoped runs reach them only when an installed copy matches). The hidden `--detached` flag (`scan --vendor --detached`) names exactly this — the only — vendored posture and is accepted as a no-op for compatibility.
 
 `scan --mode hosted` (== `--redirect`) swaps the in-place apply for the registry-redirect pipeline: discover → resolve hosted-patch references (grant token + integrity + per-dep registry override) → rewrite ONLY the patched dependencies' lockfile / registry-config entries to point at the hosted packages. A dep counts as **redirected** only when its hosted-artifact URL (or per-dep registry index URL) actually landed in a project file — a granted reference whose rewriter found nothing to edit is neither counted nor attested. **No ledger (v5.0)**: hosted mode writes ONLY the lockfile / registry-config edits — `.socket/vendor/redirect-state.json` is never written (on success or failure), and a pre-v5 one on disk is ignored (never read for planning, never quarantined, left byte-identical). The lockfiles are the only record of a hosted patch: `list`, `vex`, `rollback`, `remove`, `vendor` and `repair` all discover the hosted pins from them (a hosted URL counts only on `https://patch.socket.dev` or the `--patch-server-url` / `SOCKET_PATCH_SERVER_URL` origin), and commit-ready output is just the lockfile / config changes. Cargo and golang are confirmed only by their rewriter's own report (`confirmed_cargo_uuids` / `confirmed_golang_uuids`): a golang dep counts only when its go.mod `replace M V => patch.socket.dev/gopatch/<uuid> <sver>` and both go.sum lines are in place, never because the patch-server origin or leftover go.sum lines appear somewhere. A golang module that go.mod does not require and go.sum does not list at the patched version is outside the build graph and is refused with `redirect_golang_not_in_module_graph` (nothing written). Only the exact module `patch.socket.dev/gopatch/<canonical uuid>` is socket-owned; any other module path is refused with `redirect_golang_untrusted_module_path`. A vendored golang module is taken over like cargo and the npm family: its vendor wiring, committed copy and ledger entry are reverted first (`redirect_takeover_reverted_vendored`). Re-runs over already-rewritten output plan from the current lock text and are idempotent (exit 0, lock unchanged). **Lock (v5.0)**: the hosted engine acquires `<.socket>/apply.lock` around its first wet write (the takeover pre-reverts) — not on `--dry-run`, and not when the run would write nothing (zero redirects, all skipped) — so previews and no-op runs never create `.socket/`; contention is `lock_held` and a lock-file I/O fault (a read-only project root, a file squatting on `.socket/`) is `lock_io` — both exit 1, refused BEFORE any project file is written, and rendered like every other lock holder: human `Error (<code>): <message>` on stderr (+ the `--lock-timeout` hint for a live holder); JSON keeps the hosted shape — top-level `status: "error"`, `errorCode: "lock_held" | "lock_io"`, a string `error`, and `redirect: {mode: "hosted"}` retained (NOT the vendored `error: {code, message}` object). **Takeover symlink pre-check (v5.0)**: a vendored→hosted takeover whose recorded wiring file is a symlink is refused up front with `redirect_symlinked_file_unsupported` — wet and `--dry-run` alike, before any revert — so "nothing was written" holds. **Human mode (v5.0)**: hosted `scan` prints the results table and update detection like the other modes, then rewrites without a prompt (scan never prompts); `--dry-run` previews through the engine, and a detail fetch that leaves nothing to redirect enters the engine as a no-op (`Redirected 0 packages; rewrote 0 files.`, no lock, no `.socket/`). The detail fetch prints the same progress counter and per-package `Warning: could not fetch details for …` lines as the agent arm. An EMPTY hosted discovery prints `No patches available for installed packages.` and exits 0 without entering the engine; a discovery whose every offer is paid-tier for an org without paid access prints the table's paid nudge, then `No downloadable patches (paid subscription required).`, and exits 0 without entering the engine (parity with the agent/vendored arms). JSON output gains a `redirect` sub-object: `{ mode: "hosted", redirected, rewrittenFiles, skipped, warnings, dryRun }` (`mode` is additive so consumers can dispatch without inferring it). Rewriter warnings carry stable `redirect_*` codes (e.g. `redirect_npm_no_lockfile`, `redirect_gradle_manual_snippet`, `redirect_golang_unsupported`); new codes are additive (MINOR). v5.0 additive codes: `redirect_composer_no_lockfile` / `redirect_gem_no_gemfile` (composer / gem: neither manifest nor lock present — once per run, after the intake gates), `redirect_maven_no_pom` (no `pom.xml` and no Gradle build), `redirect_nuget_lock_unparseable` (a present-but-corrupt `packages.lock.json` — warned once, nothing mutated; an absent lock still proceeds), `redirect_cargo_lock_pkg_ambiguous` (several same-name+version `[[package]]` blocks and none carries the index `source` — transactional skip). Also v5.0: a registry override of the wrong kind (or none at all) warns the arm's missing-override code for nuget/gem/golang. Refusals stay fail-closed with a diagnosis that names the actual cause: a yarn-berry lock entry resolving through a non-`npm:` protocol keeps `redirect_yarn_berry_unsupported_protocol` with the entry's ACTUAL protocol in the detail — except socket-patch's OWN vendored wiring (a `file:` range into `.socket/vendor/`), which gets the distinct `redirect_yarn_berry_vendored_entry` code whose detail names the retirement path (`remove <purl>` per package, or `vendor --revert` which unwinds every vendored package, then re-run `scan --mode hosted`). Both leave the entry byte-identical; neither changes exit code or status. **yarn berry line endings (v5.0)**: yarn writes a NEW `yarn.lock` with the OS line ending (`os.EOL` — CRLF on Windows) and keeps an existing lock's majority ending on every later write, and a `core.autocrlf` checkout turns an LF lock CRLF on any OS — so a uniformly CRLF lock is rewritten in its own ending: every untouched byte (a leading BOM included) round-trips (and `rollback`'s upstream restore keeps the lock's own ending). A lock that MIXES CRLF and LF (or holds a bare CR) has no single ending to keep — yarn's own `--immutable` check rejects it too (YN0028) — so it is refused untouched with `redirect_yarn_berry_mixed_line_endings` (the detail names `yarn install`, which normalizes it). This replaces v4's `redirect_yarn_berry_crlf_unsupported`, which refused every CRLF lock and is no longer emitted. A vendored→hosted takeover runs these berry gates (mixed line endings, unsupported `cacheKey`, a non-zero `.yarnrc.yml` `compressionLevel`) BEFORE reverting a vendored berry purl — wet and `--dry-run` alike — so a refused purl keeps its vendored wiring, ledger entry and artifact byte-identical and is skipped with the gate's code (never announced as `redirect_takeover_reverted_vendored` and then left unpatched in both modes).
 
@@ -166,7 +166,7 @@ The rewriter reads a fixed set of candidate files from the project root: the npm
 
 **Lock-text refusals before the download (v5.0)** — shared by `get --mode vendored` on both its paths and `scan --mode vendored`, after the Bun preflight above and the ledger's `already vendored` skip: a `pkg:npm/` result in a **pnpm, yarn classic or yarn berry** project, or a `pkg:cargo/` result, that its vendor backend refuses on the project's lock and manifest text alone is refused BEFORE its patch view is fetched — the pnpm / classic / berry gates the backend runs before it reads the package (coordinates, the lock and manifest reads and their line-ending / version / `cacheKey` / `.yarnrc.yml` gates, override and `resolutions` conflicts, the lock entry present and rewritable) and cargo's `locked_version_mismatch` (only when it is the crate's FIRST refusal; an in-tree `cargo vendor` copy still refuses in the loop as `already_vendored_in_tree`). **Scope:** only a package the vendor loop would hand to its backend is refused early — one installed on disk (the loop's own qualified-aware resolver plus the npm identity lookup), or one the lockfile inventory resolves to a verifiable registry source (a lock entry with an integrity, or the ledger-recovered pre-vendor resolution — exactly the entry the pristine fetch would use). A package absent from the lock and not installed never reached its backend and is untouched: its view is fetched, it downloads, and the vendor loop skips it `skipped` / `package_not_installed` as in v4.x (so cargo's `locked_version_mismatch` is refused early only for a crate installed at the unlocked version). The result becomes `{action:"failed", errorCode:<code>, error:<detail>}` in `download.patches[]` / `patches[]` with the backend's exact code and detail, no view and no pristine fetch, no patch record, and therefore no vendor event: compared with v4.x, `download.downloaded` drops and `download.failed` rises by the number of such packages, `vendor.summary.failed` and `vendor.events` lose their `failed` events, and a lockfile-only package among them loses its `vendor_fetched_missing` event (it is never fetched). Exit code and top-level `status` are unchanged (`partial_failure`/1); the nested `vendor.status` becomes `success` when those refusals were the vendor step's only failures (observed on the depscan fixture: 3 refusals, `partialFailure` → `success`), and when every selected package is refused this way the human `scan --vendor` arm prints `Nothing was vendored: N patches failed (see above).`. **Precedence:** the lock-text refusal is decided before the view, so it wins over every view-derived outcome — a package that would also have been a paid-access 403 (`[PAID]`/no access), a failed view fetch, or a no-applicable-files skip reports the lock refusal instead (the Bun refusal and the ledger's `already vendored` skip still come first). The human `[error] <purl> (<code>): <detail>` line is printed during the download instead of the vendor step's failure line (the human (non-`--silent`) `scan --vendor` arm's baseline pre-check still fetches the views it verifies; only the download, the pristine fetch and the vendor step skip the package there). A purl the lockfiles pin hosted keeps the loop's refusal (its takeover restore rewrites the lock the gates read); other flavors (package-lock, pnpm-legacy, bun) and ecosystems are untouched, and `--dry-run` is unchanged. `vendor` (manifest-driven, no view fetch) keeps its per-package `failed` events but no longer fetches the pristine source of a lockfile-only package it refuses this way — the source is deferred to the backend, which refuses before reading it (no `vendor_fetched_missing` event and no registry request; a refused package whose registry is unreachable reports the gate's code instead of `vendor_fetch_failed`); only a package the lock resolves to a verifiable source is deferred, and one it does not resolve keeps its `package_not_installed` skip. Pinned by `tests/scan_vendor_e2e.rs` (`exact_download_plan`: scan and exact-purl get, pnpm and cargo scope), `tests/e2e_yarn_legacy_cachekey_refusal_build.rs` and `tests/vendor_rerun_no_network_e2e.rs`.
 * **Installed-version narrowing** (all modes, `get`'s search path): a CVE/GHSA fan-out returns one patch record per patched VERSION; get keeps only versions present here and emits calm `skipped` records (`errorCode: "package_not_installed"`) for the rest — never an error exit. Presence = installed on disk (qualified-aware resolver) ∪ already tracked in the manifest (record maintenance keeps working on hosts without an installed copy); hosted/vendored modes additionally count lockfile-resolved deps and vendor-ledger purls (mirroring scan's discovery supplements, including their `--global` gate). **Exempt** (no narrowing): UUID identifiers, exact-versioned PURL identifiers (explicit intent), `--save-only` runs (record-only has no installation precondition — the fresh-clone record→vendor flow keeps working), `--all-releases`, and the package-name path (already installed-derived). When EVERY found patch is filtered out, get exits 0 with the additive status **`not_installed`** (`{status:"not_installed", found:N, downloaded:0, applied:0, patches:[<skip records>], warnings?}`) — never `no_match`, which remains pinned to the fuzzy package-name path. PnP layouts are surfaced, not misreported: yarn-PnP npm results skip with `errorCode: "yarn_pnp_unsupported"` in every mode; pnpm-PnP skips carry `pnpm_pnp_unsupported` in agent/vendored modes; hosted mode — the refusal's own remedy — keeps ONLY the versions the raw `pnpm-lock.yaml` text actually resolves (boundary-anchored probe over the v5/v6/v9 key spellings, so a large fan-out never requests grants for every version ever patched), labels a JUDGED miss `package_not_installed` exactly like a non-PnP project (the layout blocked nothing — the lock was read and the version isn't resolved), and reserves the layout code for an unreadable lock (no judgment possible). When EVERY narrowed-out result is a PnP refusal, the human terminal names the layout instead of claiming "not installed" and never advises `--all-releases` (which cannot make PnP patchable); the JSON status stays `not_installed` — consumers dispatch on the per-record `errorCode`. Hosted mode also runs the per-release VARIANT filter (`filter_to_installed_releases`) on its search path before requesting grants — agent/vendored runs get it inside the download engines — with the same keep-all-plus-warning fallbacks (surfaced as `(release_narrowing)`-prefixed strings in `warnings[]`). An ecosystem this binary has no crawler for is likewise never judged: its results are KEPT (absence from a crawl that never looked carries no information — the same fail-safe as scan's prune GC). The human `Found N patches:` listing shows only the patches whose package version survived the narrowing (the narrowing is judged over every result, so an installed package's paid fix a free user cannot download still lists as `[PAID] (no access)`, while skip records and counts cover only accessible patches), sorted by PURL in natural version order (`4.17.2` before `4.17.10`); the narrowed-out ones are summarized on stderr in one line per reason (`Skipped N patches for M package versions not installed here (use --all-releases to include them).`), and `--verbose` adds one `[skip] <purl> (<reason>)` line per skipped version after that summary, in natural version order. When the candidates hold more patches than were selected and the pick was made without a menu (a paid user's auto-pick, `--yes`, a non-TTY run), a `Selected:` block names the patch (purl, tier, short uuid, advisories) that will be installed before the prompt. Machine output (the prompt count, the JSON envelope) uses the kept set, unchanged. The finer per-release variant narrowing (`filter_to_installed_releases`) is unchanged and still runs inside the download engines (and before an agent-mode `--dry-run` preview, so the preview names only the variants a wet run would fetch).
-* **Deliberate divergences from scan** (documented, not drift): get keeps its `selection_required` JSON posture for free multi-patch PURLs (scan auto-picks); get has no `--vex` (an ambient `SOCKET_VEX` is ignored by get's modes), no `--detached` (moot — `get --mode vendored` is manifest-free by construction), no `--prune`; get does not run scan's pre-vendor baseline annotation; and an all-narrowed-out run exits `not_installed` without entering the vendor step (heal-after-wipe re-vendoring stays `scan --mode vendored`'s job). Agent-mode `get` honors `--dry-run` too (v5.0): the search and uuid paths classify each selected patch against the manifest (read-only; an unreadable manifest fails closed like the wet run) and stop before the prompt, the download, any `.socket/` write and the apply — human `[would-add]` / `[would-update] … (replacing <short uuid>)` / `[skip] … (already in manifest)` lines then `[dry-run] Would download and apply N patches. No changes made.`; JSON `{status:"success", dryRun:true, found, downloaded:0, skipped, applied:0, patches:[{purl, uuid, action:"would_add"|"would_update"(+oldUuid)|"skipped"}, <narrowing skip records>], warnings?}`, exit 0.
+* **Deliberate divergences from scan** (documented, not drift): agent-mode get keeps its `selection_required` JSON posture for free multi-patch PURLs (scan and, v5.0, hosted/vendored get auto-pick); get has no `--vex` (an ambient `SOCKET_VEX` is ignored by get's modes), no `--detached` (moot — `get --mode vendored` is manifest-free by construction), no `--prune`; get does not run scan's pre-vendor baseline annotation; and an all-narrowed-out run exits `not_installed` without entering the vendor step (heal-after-wipe re-vendoring stays `scan --mode vendored`'s job). Agent-mode `get` honors `--dry-run` too (v5.0): the search and uuid paths classify each selected patch against the manifest (read-only; an unreadable manifest fails closed like the wet run) and stop before the prompt, the download, any `.socket/` write and the apply — human `[would-add]` / `[would-update] … (replacing <short uuid>)` / `[skip] … (already in manifest)` lines then `[dry-run] Would download and apply N patches. No changes made.`; JSON `{status:"success", dryRun:true, found, downloaded:0, skipped, applied:0, patches:[{purl, uuid, action:"would_add"|"would_update"(+oldUuid)|"skipped"}, <narrowing skip records>], warnings?}`, exit 0.
 
 `--dry-run` previews what `apply` / `rollback` / `scan --apply` / `repair` / `remove` — and `get` in every mode (hosted/vendored since v3.6, agent since v5.0) — would do without mutating disk. `get --mode hosted --dry-run` flows through the hosted engine's dry-run contract (no lock, no `.socket/`, no lockfile writes, `redirect.dryRun: true`); `get --mode vendored --dry-run` emits the same ledger-classification preview as scan's (`would_vendor` / `already_vendored` / `would_revendor`+`oldUuid` under the nested `vendor` key — plus, additive, `would_refuse` + `errorCode` + `error` for npm purls the wet run's Bun preflight would refuse: an in-sync `already_vendored` entry is exempt, as is a `would_revendor` entry whose `bun.lock` instances are all already local tuples; a purl the lock still resolves from the registry is refused like a fresh one, and the preview stays exit 0 / `status: "success"` with nothing written) before any download, and both skip the confirm prompt (nothing to confirm). In JSON mode, the envelope is populated with would-be actions and counts (`remove --dry-run` skips the confirmation prompt — there is nothing to confirm — and flips its would-be `Removed` events to `Verified` previews, so `summary.removed` stays "entries actually deleted"). `rollback --dry-run` (v5.0) previews every leg — the in-place restore verification, the vendored unwire (`Would revert/unwire vendoring for …`), the hosted upstream restore (every pin is resolved exactly like a wet run — registry lookups included, so a pin the wet run would refuse is previewed as that refusal — and nothing is flushed to disk), the manifest removals (simulated in memory), and the blob/archive GC — with no writes and no prompt.
 
@@ -186,7 +186,7 @@ Contract details:
 * **Fail-the-command**: if `--vex` was requested but generation fails (product PURL undetectable, nothing to attest in the manifest / vendor ledger / lockfiles, all patches omitted, a corrupt vendor ledger, unwritable path), the command exits non-zero **even when the apply/scan itself succeeded**. In `--json` mode the failure surfaces in the envelope's `error` (`apply`) / top-level `error` (`scan`), with a stable code (`product_undetected`, `no_applicable_patches`, `write_failed`, …).
 * **Built from the post-run state** — the manifest, the `.socket/vendor/state.json` ledger and the project's lockfile references, with hosted records fetched from the API (see "Manifest-less VEX" below) — and verified against on-disk state (unless `--vex-no-verify`; the wiring gates apply either way). Generated for real applies and read-only `scan` alike; `--dry-run` skips generation on every host command (nothing was changed, and a preview must not write an attestation — `scan --json` marks it `vex: {skipped: true, reason: "dry_run"}`).
 * **JSON success surface**: `apply` adds a top-level `vex` object to its envelope; `scan` adds a top-level `vex` key to its result. Both carry `{ path, statements, format: "openvex-0.2.0" }`.
-* `apply`'s no-manifest early exit (the `noManifest` success no-op; v5.0: its human line is `No patch manifest found; nothing to apply.` — it names the missing `.socket/manifest.json`, not the folder, since `.socket/` may legitimately hold setup files or vendored state) and `vendor`'s (`No manifest found, nothing to vendor.` — a project with hosted pins ejects instead, v5.0) still generate the document from the lockfiles and the vendor ledger (manifest-less VEX: hosted / vendored checkouts carry no manifest). Nothing referenced anywhere keeps the calm exit 0 (a stale document at the path is removed; `--json` carries any discovery diagnostics in `warnings[]`); any other VEX failure fails the command with exit 1 — including a run whose only candidates are omitted `record_unavailable` (an `--offline` run over a lockfile-wired checkout with no local records), so an ambient `SOCKET_VEX` there fails the install. `--dry-run` skips generation on both, and so does `apply --check` — it stays read-only and offline-safe, leaving the output path untouched. `scan` has no such early exit: with no manifest and nothing wired anywhere its `--vex` fails with `manifest_not_found`.
+* `apply`'s no-manifest early exit (the `noManifest` success no-op; v5.0: its human line is `No patch manifest found; nothing to apply.` — it names the missing `.socket/manifest.json`, not the folder, since `.socket/` may legitimately hold vendored state) and `vendor`'s (`No manifest found, nothing to vendor.` — a project with hosted pins ejects instead, v5.0) still generate the document from the lockfiles and the vendor ledger (manifest-less VEX: hosted / vendored checkouts carry no manifest). Nothing referenced anywhere keeps the calm exit 0 (a stale document at the path is removed; `--json` carries any discovery diagnostics in `warnings[]`); any other VEX failure fails the command with exit 1 — including a run whose only candidates are omitted `record_unavailable` (an `--offline` run over a lockfile-wired checkout with no local records), so an ambient `SOCKET_VEX` there fails the install. `--dry-run` skips generation on both, and so does `apply --check` — it stays read-only and offline-safe, leaving the output path untouched. `scan` has no such early exit: with no manifest and nothing wired anywhere its `--vex` fails with `manifest_not_found`.
 * **Stale-doc removal (v3.5)**: a run that ends in a VEX error removes a recognizably-OpenVEX file (JSON whose `@context` names openvex.dev) already sitting at the output path — a pipeline reusing one path can never ship yesterday's attestation for a now-unpatched tree. Unrelated files at the path are never touched; a mid-write partial that no longer parses as JSON is left for downstream parsers to reject loudly.
 * **Additive warnings (v3.5)**: `product_not_iri` (the `--product`/`--vex-product` override is neither a `pkg:` purl nor an absolute IRI; honored verbatim, warned) and `vendored_tree_out_of_sync` (a healthy vendored attestation stands on the committed artifact + lock wiring while the PRESENT installed tree hash-mismatches the patched bytes — run the package manager's install; the attestation itself is unchanged). Both ride stderr in human mode and `warnings[]` in the standalone `vex --json` envelope. Same channel for `product_multiple_manifests` (auto-detect found several project manifests and names the one it used), `vex_stale_doc_removed` (the stale-doc removal above happened), the manifest-less plan's advisories — `vex_wiring_conflict` (the lockfiles wire a package to different patches: which files, which uuids, how to fix it), `vex_record_superseded` (a recorded patch replaced by the lockfile-wired one), `vex_claim_unwired` (a ledger claim whose patch the lockfiles still mention, but not as wiring), `vex_record_offline` / `vex_record_not_found` / `vex_record_fetch_failed` (why a lockfile-wired patch has no record — the detail behind a `record_unavailable` skip) and `api_auth_fallback` (the authenticated API refused the credentials and the public proxy served free patches only; `get` / `scan`'s warning text) — and, standalone only, `org_looks_like_path` (`-o`/`--org` given a file-shaped value — `-O` is `--output`). The standalone error envelope carries `warnings[]` too. An embedded `--vex` that fails also folds each omitted patch into the host command's `warnings[]` as `vex_omitted` (`<purl>: <why> (<errorCode>)` — standalone `vex` lists them as `skipped` events), and `--silent` lists them as `omitted: <purl> (<errorCode>)` lines under the error. A corrupt `.socket/vendor/state.json` is no longer degraded with a warning: every form of vex fails with `vendor_ledger_corrupt` (see the error-code table). A malformed pre-v5 `redirect-state.json` is, as of v5.0, only the `redirect_ledger_corrupt` warning (hosted mode keeps no ledger; the file is an optional migration record source).
 
@@ -242,7 +242,7 @@ Recognition rules that hold for every ecosystem:
 
 **Record resolution.** A candidate's record must carry the patch uuid the lockfile actually **wires**. It is taken from the first source that has one: the manifest (matched qualifier-insensitively), the hosted records above (this run's, then a pre-v5 ledger's), then the vendor ledger's embedded records. If none has it and the run is online, `vex` fetches the patch view by uuid from the patch API — for a v5 hosted checkout this is the normal path. The fetch uses `get`'s API client: the public proxy when no token is configured, and a one-shot 401/403 fallback to the proxy (free patches only). At most 10 fetches run concurrently. Fetched records stay in memory: `vex` never writes the manifest. A candidate still has no record under `--offline`, after a transport error or a 404, or when the patch is refused (paid without an entitled token); it is then omitted as `record_unavailable`, and the run is not aborted. A record whose uuid or package disagrees with the wiring is omitted as `record_mismatch`. The informational `socket-patch.vendor.json` marker is never a record source. When the lockfile wires a package to patch U, a manifest or ledger record for that package under another uuid is superseded, and a human-mode `Note:` says so.
 
-**Verification basis.** `(vendored)` and `(redirected)` patches bypass the Property 7 ecosystem filter, because their wiring is the persistence. With no manifest there is no `setup.manual`, and none is needed.
+**Verification basis.**
 
 | Wiring | Evidence (verify mode) | Marker |
 |---|---|---|
@@ -272,136 +272,48 @@ Human mode also prints `Note:` lines: superseded records, fetch failures, `--off
 
 **Output.** A manifest-less run honors every `vex` output convention: `--output -` (or `-O -`) prints the document to stdout; `--dry-run` still discovers, fetches records and verifies, but writes nothing and leaves a previous document at the path alone (`[dry-run] Would write …`, `dryRun: true`); an embedded `--vex` under `--dry-run` skips generation with the shared `Skipping VEX generation (--dry-run: nothing was …).` line.
 
-## Setup command contract
-
-`setup` wires a repository for **automatic patching**: after the ecosystem's own install/build step
-runs, locally-installed dependencies are re-patched to match the Socket manifest (`.socket/manifest.json`)
-with no further human action. It does this by installing an ecosystem-native hook (see the support
-matrix below). `setup --check` verifies that state; `setup --remove` reverts it.
-
-The properties below are the public contract. Each is backed by a test under
-`crates/socket-patch-cli/tests/setup_*.rs` (`setup_contract_gaps.rs` holds the guards for the
-properties that shipped after the contract was written; a failure there is a regression). Changing
-any property below is governed by the [semver policy](#semver-policy).
-
-1. **Idempotent.** Re-running `setup` on an already-configured repo changes nothing: status
-   `already_configured`, `updated: 0`, every manifest byte-identical. *(Implemented.)*
-
-2. **Ecosystem-scoped.** `setup`, `setup --check`, and `setup --remove` honor the global
-   `--ecosystems` filter and act on only the named ecosystems; with no filter they act on every
-   detected ecosystem. *(Implemented — `eco_in_scope` gates the npm, Python, Bundler and Composer
-   legs on `--ecosystems`.)*
-
-3. **Consistency after install.** Once an ecosystem is set up, its locally-installed dependencies are
-   re-patched to match the manifest after **any** of: a dependency added, updated, or removed; **or** a
-   new patch added to the manifest. The re-patch is carried by the ecosystem's install hook (npm
-   `postinstall`/`dependencies`, the Python `.pth` startup hook, the gem Bundler plugin, the Composer
-   `post-install-cmd`/`post-update-cmd` scripts) which runs
-   `socket-patch apply` after the ecosystem's installer finishes, so patch state always reconverges with
-   the manifest. *(Implemented for npm/pypi/gem/composer via the support matrix. Cargo and Go have no `setup`
-   hook — see "Cargo and Go: apply-only, no setup" below.)*
-
-4. **`check` proves a correctly-patched state.** `setup --check` reports `configured` only when the
-   in-scope ecosystems are *actually in a correctly patched state* — install hooks present **and**
-   on-disk patch consistency verified (the `apply --check` invariant: every manifest file's hash matches
-   `afterHash`). *(Implemented — `run_check` appends a `patch` entry per installed-but-drifted PURL via
-   `append_patch_consistency_entries`; uninstalled packages and zero-file records are not drift.
-   v5.0: vendored patches are consulted from the vendor ledger's embedded `record`s and verified
-   against the committed artifact — a manifest-less vendored project is checked the same way.)*
-
-5. **In-repo and committable.** `setup` writes only inside the working tree: `package.json`,
-   `pyproject.toml`/`requirements.txt`, `composer.json` (the `post-install-cmd`/`post-update-cmd`
-   hooks), the `Gemfile` + the generated `.socket/bundler-plugin/{plugins.rb,socket-patch.gemspec}`
-   and `.socket/.gitignore` (one line ignoring the machine-local stamp), and `.socket/manifest.json`
-   only when `--exclude` persists an exclusion (property 9). Every artifact is git-committable.
-   `setup --check` writes nothing, and an already-configured `setup` writes nothing unless
-   `--exclude` is passed explicitly. The `--exclude` persistence (v5.0) runs AFTER discovery and
-   the confirm prompt, as a read-modify-write under `<.socket>/apply.lock` (`setup` joins the
-   `--lock-timeout` contenders): a held or unopenable lock, or a manifest that cannot be read or
-   written, is reported as a `not persisting --exclude: <reason> — <hint>` warning — never exit 1 —
-   and a byte-identical exclude list neither locks nor rewrites. `--check` (property 4) reads the
-   vendor ledger even without a manifest; a ledger it cannot read or parse is surfaced as a
-   `Warning: Unreadable vendor state (…)` line (muted by `--silent`) plus a `vendor_ledger` `files[]`
-   entry with `status: error` — verdict `error`, exit 1 — never as a `configured` verdict. It never writes outside
-   `--cwd` — no `$HOME`, no global `site-packages` (the Python `.pth` wheel is installed later by the
-   user's package manager, not by `setup`; the gem patch stamp is written by the plugin at
-   `bundle install` time, not by `setup`, at `.socket/gem-plugin-stamp` — machine-local, hence the
-   `.gitignore` line; the legacy stamp under `Bundler.bundle_path` is deleted by the plugin). These
-   files are **setup-owned residue**: `rollback`/`remove` never undo `setup`, so `.socket/.gitignore`,
-   `.socket/bundler-plugin/` and `gem-plugin-stamp` survive a full reversal (see the residue rule
-   under the rollback contract). *(Implemented — `crates/socket-patch-core/src/setup/gem/mod.rs`.)*
-
-6. **Clone-portable.** Because all setup state is committed files, a fresh checkout on another host —
-   CI, a deploy, a teammate's machine — inherits the setup state unchanged; `setup --check` passes on
-   the clone with no re-run required. *(Implemented; a consequence of properties 5 + 1.)*
-
-7. **Reflected in VEX.** A patch contributes a `not_affected` statement to the repo's OpenVEX document
-   only for ecosystems that are **actually set up** — or explicitly declared **manual** (below) — or
-   **vendored** (a `socket-patch vendor`ed package needs no install hook by construction: the package
-   manager itself installs the patched artifact, so its purls bypass this filter) — or **hosted** (a
-   live lockfile redirect is likewise its own persistence; manifest-less lockfile references are always
-   vendored or hosted, so they never need `setup.manual`). Patches for an
-   ecosystem that is neither set up, declared manual, vendored, nor hosted produce no VEX statement. *(Implemented —
-   `generate_vex` filters `applied` to ecosystems returned by `commands/setup::configured_ecosystems`
-   (on-disk hook presence) ∪ the manifest's `setup.manual`, in addition to the existing `--ecosystems`
-   filter and on-disk verification. Applies in both verify and `--no-verify` modes.)*
-   - **Manual declaration.** Users who run `socket-patch apply` by hand (e.g. in a CI step) declare an
-     ecosystem as `manual` so VEX still attests its patches even though the auto-install hook is
-     intentionally not wired. This is the normal path for **cargo** and **golang** (apply-only, no
-     `setup` hook). Home: the `setup.manual` array (a list of ecosystem `cli_name`s — `pypi`, `cargo`,
-     `golang`, …) in `.socket/manifest.json`. *(Implemented for the read/attest path; a `setup` flag to
-     populate it is a future nicety — today it's hand-authored in the manifest.)*
-
-8. **Graceful, exact remove.** `setup --remove` (optionally per-ecosystem via `--ecosystems`) restores
-   the repo to its exact pre-setup state: manifests byte-for-byte, sibling scripts/dependencies
-   preserved, keys that became empty dropped. Afterward `setup --check` reports needs-configuration
-   again. For gem projects it also removes the plugin dir, the stamp and its `.gitignore` line, and
-   (v5.0) prunes an emptied `.socket/` (non-recursive `remove_dir` — a `.socket/` still holding a
-   manifest, blobs, vendored state or a user-authored `.gitignore` is kept), so a project that never
-   ran `apply` is back to its pre-setup tree. *(Implemented for the manifest edits — npm
-   `package.json` and Python deps round-trip byte-for-byte. `package.json` is re-serialized in its
-   own layout — BOM, indent, line ending and trailing-newline shape (v5.0) — so a Windows manifest
-   (yarn berry pretty-prints it with CRLF) keeps CRLF through `setup` and `setup --remove`.)*
-
-9. **Nested workspaces, with exclude.** Setup applies to every subproject below the repo root: npm /
-   yarn / pnpm / bun workspace members are all discovered and configured (pnpm is root-package-only by
-   design, because workspace-member `postinstall` scripts fail under pnpm's strict module isolation).
-   Selected paths may be **excluded**, and the exclusion is **persisted in `.socket/manifest.json`** so
-   `check`, `apply`, and any clone all honor it. *(Implemented — nested-workspace discovery plus the
-   `--exclude` flag, persisted as the `setup.exclude` array in `.socket/manifest.json` and honored by
-   discovery + `check` (a fresh clone inherits it without re-passing the flag). Excludes apply to npm
-   workspace members; the repo root is never excludable.)*
-   - **Nested workspaces (implemented).** A workspace member that is itself a workspace root is recursed
-     into and has its own members configured. `collect_workspace_members`
-     (`socket-patch-core/src/package_json/find.rs`) re-reads each discovered member's own
-     `workspaces` field (bounded depth). Guarded by the nested-workspace pins in
-     `tests/setup_invariants.rs`.
-
-### Per-ecosystem setup support
-
-`setup` installs an automatic-repatch hook for the four ecosystems with a usable post-install /
-startup hook (npm, pypi, gem, composer — every ecosystem is built in unconditionally; there are no
-ecosystem feature gates). The remaining ecosystems are **apply-only**: `socket-patch apply` patches them on demand, but
-there is no hook for `setup` to install, so `setup` is a `no_files` no-op for them. These are exactly
-the ecosystems for which property 7's **manual** declaration is intended (so their hand-applied patches
-still show up in VEX).
-
-| Ecosystem | Hook `setup` installs | Repatch trigger | Notes |
-|---|---|---|---|
-| npm / yarn / pnpm / bun / vlt | `scripts.postinstall` + `scripts.dependencies` | `npm/pnpm install` (+ `install <pkg>`); vlt: every install that changes the graph (`vlt install`, `install <pkg>`, `vlt ci`), never a no-op install | pnpm and vlt: root package only. vlt gets npm's `npx` hook (never `vlx`) and is detected by `vlt-lock.json`, `vlt.json`, `node_modules/.vlt-lock.json` or a `node_modules/.vlt/` directory in `--cwd` (before the pnpm markers; an ancestor `vlt.json` is ignored). vlt < 1.0.0-rc.13 never runs a root `postinstall`: `setup` still wires it and warns `vlt_root_scripts_not_run`. A failing hook aborts and rolls back the whole `vlt install`, so `apply --silent` exits 0 when there is nothing to do (no manifest); a manifest whose only patch targets a package that is not installed exits 1 and aborts the install, as it fails `npm install` |
-| pypi | `socket-patch[hook]` dependency → `.pth` startup hook | Python interpreter startup after installed-set change | manifest = `pyproject.toml` (uv/poetry/pdm/hatch) or `requirements.txt` (pip) |
-| gem | managed `plugin "socket-patch"` block in the `Gemfile` → committed in-tree Bundler plugin under `.socket/bundler-plugin/` | every `bundle install` (cached + fresh: load-time digest gate + `after-install-all` hook) | the plugin is `path:`-sourced (a `git:` dir source is uncloneable — the generated dir is not a git repo — and fails `bundle install`); the dir must be committed so clones/CI have it; CLI must be on `PATH`. Phase 2 (follow-up) switches to a published `socket-patch-bundler` gem |
-| composer | `socket-patch apply` appended to `composer.json`'s `post-install-cmd` + `post-update-cmd` script events | every `composer install` / `composer update` | CLI must be on `PATH` |
-| cargo · golang | **none** (apply-only) | — | see "Cargo and Go: apply-only, no setup" below; candidates for the **manual** declaration |
-| nuget · maven · deno | **none** (apply-only) | — | `setup` reports `no_files`; candidates for the **manual** declaration |
+## Human output conventions (v5.0)
+
+Human (non-`--json`) output is not a stable interface, but these rules hold:
+
+* Warning lines carry no machine code: `Warning: <detail>` (and `GC: skipped: <message>.`); error lines keep theirs (`Error (<code>): …`) so a `--silent` run stays grep-able. The stable codes stay in the JSON envelope (`warnings[].code`, `error.code`, `errorCode`).
+* Hosted mode is called "hosted" in human text (`Switched N packages to hosted patches; rewrote M files.`); JSON keys and codes keep their `redirect*` names.
+* npm's `allow-remote` notice prints as one line (`Note: set \`allow-remote=all\` in .npmrc …` or `Warning: npm >=12 refuses the hosted patches until …`); the full `redirect_npm_allow_remote` detail is in `--json` and under `--verbose`.
+* Hosted and vendored runs that change the project end with one shared `Next steps:` block (commit, reinstall + `socket-patch vex`, then any extra step).
+* A declined prompt prints `Cancelled; no changes made.`; the paid-plan upsell is `Upgrade to a paid Socket plan to access all patches: https://socket.dev/pricing`.
+* `-h` lists about eight common options per command; `--help` lists all of them. `scan --apply` / `--vendor` are hidden (still accepted).
+
+## Agent mode in CI (v5.0: `setup` removed)
+
+**Removed in v5.0 (MAJOR):** the `setup` subcommand and every install hook it wired (npm
+`postinstall`/`dependencies` scripts, the `socket-patch[hook]` Python `.pth` wheel, the Bundler
+plugin under `.socket/bundler-plugin/`, the Composer script hook). `socket-patch setup` is now an
+unknown subcommand (clap usage error, exit `2`). Hooks a previous release committed keep calling
+`socket-patch apply`, which still exists, so they keep working until you delete them; remove them by
+hand (the `postinstall`/`dependencies` entries, the `socket-patch[hook]` dependency, the managed
+`plugin "socket-patch"` Gemfile block + `.socket/bundler-plugin/`, the composer
+`post-install-cmd`/`post-update-cmd` entries). The `socket-patch-hook` wheel and the
+`socket-patch-bundler` gem are no longer published.
+
+Prefer hosted or vendored mode: their lockfile (and `.socket/vendor/`) edits are the persistence, so
+no install step exists. Agent mode (`scan --mode agent`, `get`, `apply`) patches the installed tree
+in place, which the next package-manager install reverts; wire it into CI yourself:
+
+```sh
+socket-patch scan --mode agent     # once, locally: record patches in .socket/manifest.json (commit it)
+# in CI, after every dependency install:
+socket-patch apply                 # re-apply the committed manifest
+```
+
+`vex` attests an agent-mode patch whenever verification finds it applied (v5.0: the old "Property 7"
+filter, which dropped patches for ecosystems with no configured install hook unless declared in
+`setup.manual`, is gone together with `setup`; the `ecosystem_not_setup` omission code is retired). A
+manifest's legacy `setup` object (`manual`, `exclude`) still parses and round-trips but is ignored.
 
-#### Cargo and Go: apply-only, no setup
+### Cargo and Go in agent mode
 
-Cargo and Go have **no `setup` hook** — a one-click, auto-repatch-on-build setup isn't possible for
-them, so `setup` skips both (it makes no manifest edits for either as a *setup* action; the `go.mod`
-`replace` that local-mode `apply` writes is an *apply*-time redirect, not setup state). Patch them
-with `socket-patch apply` directly (manually or from a per-project install script), and declare them
-in `setup.manual` for VEX attestation.
+Hosted and vendored mode need no per-install step for any ecosystem. In agent mode, cargo and Go
+are patched by `socket-patch apply` like every other ecosystem:
 
 - **cargo** — `apply` patches the crate **in place** wherever the crawler finds it: the project
   `vendor/` directory or the shared registry cache (`$CARGO_HOME/registry/src/...`). The
@@ -412,26 +324,25 @@ in `setup.manual` for VEX attestation.
 - **golang** — `apply` writes a project-local **patched copy** under `.socket/go-patches/<module>@<ver>/`
   and a `go.mod` `replace` directive pointing at it; `go build` links the copy (the module cache is
   `go.sum`-verified, so in-place patching can't build). Commit `go.mod` + `.socket/go-patches/` + your
-  `.socket/` patches so a clone builds the patched bytes with no further setup. `socket-patch apply
+  `.socket/` patches so a clone builds the patched bytes with no further step. `socket-patch apply
   --check` is a read-only audit of the committed redirect.
 
 ### Monorepo / multi-project discovery model
 
-How `setup` (and the underlying `scan`/`apply` crawlers) find subprojects differs by ecosystem, and
+How the `scan`/`apply` crawlers find subprojects differs by ecosystem, and
 the model is **not uniform** today:
 
 - **Workspace-aware (walk members):** npm / yarn / pnpm / bun / vlt (`workspaces` / `pnpm-workspace.yaml` /
   vlt.json `workspaces` — a glob, a list, or named groups of either — or vlt <= 0.0.0-12's
   `vlt-workspaces.json`; vlt's declaration wins over the others and vlt never reads package.json
-  `workspaces`). One repo-root invocation discovers and configures every member (pnpm and vlt: the
-  root package only — vlt runs the root hook once per install, even one started from a member; `setup --remove` also clears a vlt member that still carries a hook, as releases before vlt workspace support wired every member). A member that is itself a workspace root is recursed into
-  (bounded depth; see property 9).
+  `workspaces`). One repo-root invocation discovers every member. A member that is itself a
+  workspace root is recursed into (bounded depth).
 - **cwd-only (single project):** gem, pypi, composer. The crawler inspects only the project
   rooted at `--cwd` (pypi looks at `$VIRTUAL_ENV`, `<cwd>/.venv` / `venv`, then a Poetry project's out-of-tree virtualenv(s) under Poetry's `virtualenvs.path`; composer at the vendor tree); it does **not**
   descend into sibling subprojects. A monorepo with several independent lockfiles in subdirectories
   (`backend/Gemfile.lock` + `frontend/Gemfile.lock`, multiple `.venv`, multiple `go.mod` /
   `composer.json`) is handled by invoking the tool **once per subproject** (`--cwd` each), as a
-  per-directory install hook would.
+  per-directory CI step would.
 
   *Gem install roots (a refinement of "cwd-only", not an exception to the one-project model):* the
   crawler probes the project's Bundler install roots in **bundler's own precedence order** — the app
@@ -445,14 +356,14 @@ the model is **not uniform** today:
   path, as bundler itself ignores it). The skip is surfaced per the run-warning conventions: a
   `gem_bundle_config_path_ignored` entry in the run-level `warnings[]` of `scan`/`apply` `--json`
   envelopes (detail names the config value and the env-`BUNDLE_PATH` remedy), and one stderr
-  `Warning (gem_bundle_config_path_ignored): …` line on the human path, gated on `!--silent`
+  `Warning: …` line on the human path, gated on `!--silent`
   (`--silent` = errors only). Explicit env/config roots only count when `--cwd` holds a Bundler
   manifest/lockfile. When the default `vendor/bundle` root holds no store, the gem homes `gem env`
   reports are appended (default gems like rexml/json only ever live there). When several roots hold
   **coexisting physical copies of one `gem@version`** (bundler-2's scoped store beside bundler-1's
   flat store), `apply`/`rollback` patch/restore **every copy** — one summary event per copy,
   mirroring npm's multi-copy fan-out — while single-representative consumers (`get`, `vendor`,
-  `setup`, `vex`) use the highest-precedence copy.
+  `vex`) use the highest-precedence copy.
 
   *Copy classes (additive to the multi-copy vocabulary):* a copy under a **bundle-path store**
   (config/env/default root) is PRIMARY — a variant mismatch or write failure there fails the run,
@@ -482,75 +393,6 @@ is patched identically to a direct one. Both halves are pinned in
 back breadth-first into nested `node_modules` for still-unresolved PURLs; a root-level install always
 wins, pinned by `find_by_purls_prefers_root_copy_over_nested_duplicate`).
 
-### JSON output shapes (`setup`, `setup --check`, `setup --remove`)
-
-`setup` predates the v3.0 unified envelope and emits its own three shapes. They are stable as of v3.0;
-consumers may rely on these keys. All three share a `files[*]` entry shape; `kind` is one of
-`package_json`, `pth`, `gemfile`, `gem_plugin`, `composer`, `patch` (`--check` property 4: a manifest
-or ledger patch not applied on disk, `needs_configuration`), `vendor_ledger` (`--check`: a
-`.socket/vendor/state.json` that cannot be read or parsed, `error`), `gem_plugin_registration` (the last is
-`setup --remove`-only: clearing bundler's machine-local `.bundle/plugin` registration of the wired
-plugin — emitted only when a registration existed; `status: error` carries the
-`bundler plugin uninstall socket-patch` remedy when it could not be cleared safely).
-
-**`setup`:**
-
-```jsonc
-{
-  "status": "success" | "already_configured" | "dry_run" | "partial_failure" | "error" | "no_files",
-  "updated":            0,
-  "alreadyConfigured":  0,
-  "errors":             0,
-  "packageManager":      "npm" | "pnpm" | "vlt",         // always emitted; defaults to "npm", only meaningful when npm files were found ("vlt" is additive)
-  "pythonPackageManager":"pip" | "uv" | "poetry" | "pdm" | "hatch",  // present only when Python detected
-  "dryRun":   true,                                      // only on status=dry_run
-  "wouldUpdate": 0,                                      // only on status=dry_run
-  "warnings": [ "..." ],                                 // only when non-empty (e.g. lockfile refresh; "vlt_root_scripts_not_run: <detail>")
-  "files": [
-    { "kind": "package_json", "path": "...", "status": "updated" | "already_configured" | "error",
-      "error": null | "..." }
-  ]
-}
-```
-
-**`setup --check`** (read-only; never writes — exit `0` only when all in-scope manifests are configured
-and none errored):
-
-```jsonc
-{
-  "status": "configured" | "needs_configuration" | "error" | "no_files",
-  "configured":          0,
-  "needsConfiguration":  0,
-  "errors":              0,
-  "files": [
-    { "kind": "...", "path": "...", "status": "configured" | "needs_configuration" | "error",
-      "error": null | "..." }
-  ]
-}
-```
-
-**`setup --remove`:**
-
-```jsonc
-{
-  "status": "success" | "not_configured" | "dry_run" | "partial_failure" | "error" | "no_files",
-  "removed":        0,
-  "notConfigured":  0,
-  "errors":         0,
-  "dryRun":   true,            // only on status=dry_run
-  "wouldRemove": 0,            // only on status=dry_run
-  "warnings": [ "..." ],       // only when non-empty
-  "files": [
-    { "kind": "...", "path": "...", "status": "removed" | "not_configured" | "error",
-      "error": null | "..." }
-  ]
-}
-```
-
-**Exit codes** (all three): `0` when nothing errored and the operation was satisfiable (including
-`no_files` and `not_configured`); `1` on any per-file error, partial failure, or — for `--check` — any
-manifest that needs configuration. `setup --check --remove` is a clap usage error (exit `2`).
-
 ## Vendor command contract
 
 `vendor` is `apply`'s committable sibling: instead of patching installed packages in place
@@ -821,8 +663,8 @@ worse, lets a warm cache silently serve unpatched bytes):
   same committed-file trust class as the manifest; artifact verification still re-hashes against
   its afterHashes and the uuid-in-path cross-checks); standalone `vendor` fed by an agent-mode
   manifest embeds `record` too, as a fallback copy, but never `detached` — the manifest record stays
-  authoritative while the manifest covers the entry (ledger key or base purl); `vex`, `list` and
-  `setup --check` read the fallback copy only when it does not, `repair` only with no manifest at all.
+  authoritative while the manifest covers the entry (ledger key or base purl); `vex` and `list`
+  read the fallback copy only when it does not, `repair` only with no manifest at all.
 * **Re-vendor carries originals forward**: re-vendoring under a newer patch uuid rewrites the
   previous run's own wiring (`original: None` from the backend — it must never record a dangling
   `.socket/vendor/` pointer as pre-vendor state); the engine merges the TRUE pre-vendor originals
@@ -1075,7 +917,7 @@ Empty string means unset at every layer: exported-but-empty flag-bound vars are
 | `SOCKET_VERBOSE` | `--verbose` / `-v` | `false` | — |
 | `SOCKET_SILENT` | `--silent` / `-s` | `false` | — |
 | `SOCKET_DRY_RUN` | `--dry-run` | `false` | — |
-| `SOCKET_YES` | `--yes` / `-y` | `false` | Skips the prompts of `get`, `rollback`, `remove`, `setup` and `--update`; `scan` never prompts, so it has no effect there. |
+| `SOCKET_YES` | `--yes` / `-y` | `false` | Skips the prompts of `get`, `rollback`, `remove` and `--update`; `scan` never prompts, so it has no effect there. |
 | `SOCKET_LOCK_TIMEOUT` | `--lock-timeout` | (none) | Seconds to wait for `apply.lock` on the lock-taking subcommands (incl. hosted/vendored `scan`/`get`); unset/`0` = single non-blocking try. |
 | `SOCKET_DEBUG` | `--debug` | `false` | **Renamed in v3.0** (was `SOCKET_PATCH_DEBUG`). |
 | `SOCKET_TELEMETRY_DISABLED` | `--no-telemetry` | `false` | **Renamed in v3.0** (was `SOCKET_PATCH_TELEMETRY_DISABLED`). |
@@ -1093,7 +935,6 @@ Empty string means unset at every layer: exported-but-empty flag-bound vars are
 | `SOCKET_PRESERVE_STATE` | `rollback --preserve-state` / `remove --preserve-state` | `false` | (v5.0) Shared by `rollback`/`remove` (boolish, empty-tolerant parse like the other bool flags): restore the system but keep the local patch state — manifest entries, vendored artifacts + ledger entries — and skip all GC. On `remove`, combining it with `--skip-rollback` is a usage error (exit 2) **whether either side is flag- or env-sourced** (`SOCKET_PRESERVE_STATE=true remove --skip-rollback` exits 2 too). |
 | `SOCKET_DOWNLOAD_ONLY` | `repair --download-only` | `false` | Local to `repair`. |
 | `SOCKET_VENDOR_REVERT` | `vendor --revert` | `false` | Local to `vendor`. |
-| `SOCKET_SETUP_EXCLUDE` | `setup --exclude` | (none) | Local to `setup`; comma-separated workspace-member paths, persisted to `setup.exclude`. |
 | `SOCKET_VEX` | `apply --vex` / `scan --vex` / `vendor --vex` | (none) | Embedded OpenVEX output path. The `SOCKET_VEX_*` knobs (`_PRODUCT`, `_NO_VERIFY`, `_DOC_ID`, `_COMPACT`) are shared with the standalone `vex` command; on the host commands they bind to `--vex-product` etc. |
 | `SOCKET_VEX_OUTPUT` | `vex --output` / `-O` | (none) | Local to the standalone `vex`: document output path (required with `--json`). |
 
@@ -1184,7 +1025,7 @@ Every `--json` invocation emits a single JSON object that follows the **unified
 
 ```jsonc
 {
-  "command":  "scan" | "apply" | "vex" | "vendor" | "setup" | "rollback" | "get" | "list" | "remove" | "repair",
+  "command":  "scan" | "apply" | "vex" | "vendor" | "rollback" | "get" | "list" | "remove" | "repair",
   "status":   "success" | "partialFailure" | "error" | "noManifest" | "paidRequired" | "notFound",
   "dryRun":   false,
   "events":   [ <PatchEvent>, ... ],
@@ -1284,7 +1125,6 @@ Every `--json` invocation emits a single JSON object that follows the **unified
 | `revert_failed`           | `failed`         | vendor --revert: a recorded entry could not be reverted. |
 | `vendor_ledger_missing` | `failed` (artifact-level: `uuid` + `details.{ecosystem,path}`, no purl) | repair (v5.0): a lockfile references `.socket/vendor/<eco>/<uuid>/` but the vendor ledger has no entry for it; repair no longer rebuilds ledger entries from lockfiles. Recovery: restore `.socket/vendor/state.json` from version control and re-run `repair`, or `git checkout -- <lockfile>` and re-vendor. |
 | `vendor_wiring_unknown_revert_blocked` | `skipped` (beside the `failed`/`revert_failed` event) | vendor --revert: the ledger entry was reconstructed by a pre-v5 `repair` without wiring records and the live lockfile still resolves through the artifact — the revert refuses (fail-closed) instead of deleting a tarball the lock points at. Recovery: `socket-patch repair`, then restore the pre-vendor lock (or re-lock without the override) and re-run the revert. repair: an npm ledger entry whose `flavor` this release does not know (written by a newer socket-patch) is skipped, never health-checked or rebuilt, and the artifact, wiring and ledger stay as found (a lone `skipped` event; the run's exit is unaffected). Recovery: upgrade socket-patch. |
-| `ecosystem_not_setup`     | `skipped`        | vex: the patch is applied and byte-verified but its ecosystem has no install hook configured and is not declared in the manifest's `setup.manual`, so it is omitted from the document (Property 7). |
 | `stale_install`           | `skipped`        | vex (in-run `scan --mode hosted --vex`): a hosted stale-install probe found positively unpatched installed bytes, so the purl is omitted even under `--vex-no-verify` (see the gem / Python stale-install guards). |
 | `record_unavailable`      | `skipped`        | vex (manifest-less): a lockfile-wired patch has no local record (manifest, this run's hosted records or a pre-v5 redirect ledger, vendor ledger) and none could be fetched — `--offline`, transport error, 404, or a refused (paid) patch. Omitted, never attested from the `socket-patch.vendor.json` marker. |
 | `record_mismatch`         | `skipped`        | vex (manifest-less): the record found for a wired patch names another package or another patch uuid than the wiring. |
@@ -1298,7 +1138,7 @@ Every `--json` invocation emits a single JSON object that follows the **unified
 | `vendor_bun_lockb_invalid` | `failed` | vendor / scan / get `--mode vendored`: the binary lock is malformed, unreadable, unsupported or cannot be rewritten safely. The detail names the parser, hash or filesystem error. Refused before patch downloads and before hosted takeover; `patches[]` / `download.patches[]` carry `errorCode` and `error`, while `get <uuid>` also carries top-level `error.code`. Dry-run predicts the same refusal. |
 | `vendor_bun_workspace_unsupported` | `failed` | vendor / scan / get `--mode vendored` (bun): the text lock holds `workspace:` packages and its `lockfileVersion` is below 2 — Bun 1.2–1.3 resolve a workspace member's local-tarball path relative to the member; a committed version-2 lock is the proof every consumer runs Bun ≥ 1.4 (deliberate over-approximation: root-only declared packages would install on version 1 too). Detail names the version integer and a version-specific remedy: delete `bun.lock` and re-lock with Bun ≥ 1.4 (an in-place `bun install` keeps the existing version) — then, for a version-1 lock, "or use `--mode hosted`, which accepts version-1 workspace locks"; for a version-0 lock, "or delete `bun.lock`, re-lock with Bun ≥ 1.2 (which writes lockfileVersion 1) and use `--mode hosted`" (hosted refuses version-0 workspace locks, so a bare hosted pointer would send the user into a second refusal). Refused before any write — in the pre-download preflight on `get`/`scan` (see `vendor_bun_lockb_invalid` for the placements); in the shared preflight that `vendor` and the vendor step run BEFORE a hosted → vendored takeover's revert (a hosted-redirected purl stays hosted-wired, ledger and lock untouched; `vendor --dry-run` previews the same `failed` code); and in the engine when the run would write a NEW local tuple. Exempt: purls the vendor ledger wires at the selected uuid, purls whose every `bun.lock` instance is already a `.socket/vendor/npm/` tuple (any uuid), in-sync re-runs and `repair` rebuilds. |
 | `vendor_lockfile_missing` / `vendor_lockfile_version_unsupported` (bun preflight placement) | `failed` | scan / get `--mode vendored` (bun): the pre-download preflight found `bun.lock` unreadable / at a `lockfileVersion` other than 0, 1 or 2 (a newer version: update socket-patch; no integer: re-lock with Bun ≥ 1.2 — the same text as hosted's `redirect_bun_lock_unsupported`) or outside bun's single-line `packages` grammar. Same placements as `vendor_bun_lockb_invalid`; nothing fetched, no patch record. An unreadable `.socket/vendor/state.json` met by the same preflight is `vendor_state_unreadable` (see that row), never one of these. |
-| `bun_lockb_invalid` | scan `warnings[]` (run-level) | scan (every mode): the native binary inventory could not parse or read `bun.lockb`; detail names the format or filesystem error. Also printed as `Warning (bun_lockb_invalid): …` on stderr. Exit and status remain unchanged. The warning is retained on empty and non-empty scans; valid binary locks are inventoried normally without a runtime or install. |
+| `bun_lockb_invalid` | scan `warnings[]` (run-level) | scan (every mode): the native binary inventory could not parse or read `bun.lockb`; detail names the format or filesystem error. Also printed as `Warning: …` on stderr. Exit and status remain unchanged. The warning is retained on empty and non-empty scans; valid binary locks are inventoried normally without a runtime or install. |
 | `would_refuse` | dry-run preview action (`vendor.patches[]`) | scan `--mode vendored --dry-run` / get `--mode vendored --dry-run`: the wet run's Bun preflight would refuse this npm purl; the record carries `errorCode` (one of the four Bun lock codes above, or `vendor_state_unreadable` for an unreadable vendor ledger) + `error`. Exit 0 / `status: "success"`, nothing written. |
 | `cargo_wiring_migrated` | `skipped` (advisory note) | vendor / scan / get `--mode vendored` / repair (v5.0): a pre-v5 `.cargo/config.toml` / `.cargo/config` vendored `[patch.crates-io]` entry was moved into the workspace-root `Cargo.toml` (dry run: "would move"); the ledger entry is rewritten to name `Cargo.toml` (lock originals kept). A vendor re-run that migrates reports the package `applied`, not `already_vendored`. |
 | `cargo_legacy_wiring_kept` | vendor: `failed`; repair: `skipped` (warning) | vendor / scan / get `--mode vendored` (v5.0): the pre-v5 config entry could not be removed after the manifest took the wiring — the run is unwound (manifest, lock and copy as before) and the package fails, since a kept entry would double-wire the crate and, on a uuid bump, point at a copy the stale sweep deletes; the code prefixes the error detail. repair: the move was refused (e.g. an unparseable `Cargo.toml`, a user entry for the crate, or an unremovable legacy entry — the manifest edit is unwound); left in place. |
@@ -1329,7 +1169,7 @@ Every `--json` invocation emits a single JSON object that follows the **unified
 | `vendor_vlt_lock_out_of_sync` | `failed` | vendor (vlt): an importer's `package.json` is missing, unparseable, or declares a spec for the dependency that differs from the lock's importer edge. Remedy: `vlt install` first. Refused before any write. |
 | `vendor_vlt_build_scripts_unsupported` | `failed` | vendor (vlt): the package declares a `preinstall`, `install`, `postinstall` or `prepare` script, or ships a `binding.gyp`. vlt builds a registry copy in the untracked store, but a vendored `file:` dependency in place, so `vlt build` would rewrite the committed artifact (a platform binary over a JS shim, say) and every later vendor, repair and `vex` would treat it as tampered. Remedy: `--mode hosted`. Refused before any write. |
 | `vendor_vlt_legacy_lockfile` | `skipped` (warning) | vendor (vlt): an era-A lock (vlt 0.0.0-19 … 1.0.0-rc.8): a `··` default-registry id, or default-registry ids that are URL segments equal to a scalar `options.registry` with no `·npm·` id (era B writes `·npm·` whatever the scalar). vlt 0.0.0-31 … 1.0.0-rc.5 install the vendored lock but fail to reinstall the vendored `file:` dependency if `vlt-lock.json` is deleted and re-created (the other era-A releases reinstall it; the lock does not say which release reads it). The package is still vendored; remedy: upgrade vlt. |
-| `vendor_vlt_reinstall_required` | `skipped` (advisory; human: `Warning (vendor_vlt_reinstall_required): …`) | vendor / scan / get `--mode vendored` (vlt), wet and dry runs, and in-sync reruns: (a) the run rewires an optional dependency, or an importer's `node_modules/<name>` of an optional dependency still resolves into `node_modules/.vlt/`: from vlt 0.0.0-30 a plain `vlt install` (1.2.0: also `--force`) keeps that installed upstream copy linked; the detail says to run `vlt ci` (or delete `node_modules` and run `vlt install`) to link the vendored copy, and that vlt 0.0.0-30 … 1.0.4 install no optional dependency from the lock of a project that declares only optional dependencies (upgrade to 1.0.5 or later first); (b) otherwise, an importer's link of the dependency still resolves into `node_modules/.vlt/`: the detail names the links (`node_modules/<name>`, `<member dir>/node_modules/<name>`) and says `vlt install` (or `vlt ci`) links the vendored copy — on a warm tree after a plain `vlt install` that is true of every vendored direct dependency; (c) an importer's link resolves into the vendored dir of the patch this run replaces (a new patch uuid), which the run removes: the detail names the links and says `vlt install` (or `vlt ci`) links the new vendored copy; (d) a rebuild of the payload (vendor, or `repair` after a corrupt or missing payload) could not keep vlt's links to the package's own dependencies (its old `node_modules/` held more than links): the detail says to run `vlt ci` (or delete `node_modules` and run `vlt install`), since a plain `vlt install` does not re-link them. `repair` moves those links back into the rebuilt payload when they are only links. The package is vendored either way; a run whose patch fails to apply emits neither. A wet `vendor --revert` (and the revert a vendored → hosted takeover runs, whose advisory joins `redirect.warnings[]`): (a) the revert moves an `optionalDependencies` spec back from the `file:` dir, or an optional importer's `node_modules/<name>` still resolves into the vendored uuid dir: from vlt 0.0.0-30 a plain `vlt install` keeps that link (dangling once the dir is removed), so the detail says to run `vlt ci` (or delete `node_modules` and run `vlt install`) to link the restored copy, with the same vlt 1.0.5 note; (b) otherwise, an importer's link still resolves into the vendored uuid dir: the detail names the links and says `vlt install` (or `vlt ci`) links the restored copy. A dry-run revert emits neither. |
+| `vendor_vlt_reinstall_required` | `skipped` (advisory; human: `Warning: …`) | vendor / scan / get `--mode vendored` (vlt), wet and dry runs, and in-sync reruns: (a) the run rewires an optional dependency, or an importer's `node_modules/<name>` of an optional dependency still resolves into `node_modules/.vlt/`: from vlt 0.0.0-30 a plain `vlt install` (1.2.0: also `--force`) keeps that installed upstream copy linked; the detail says to run `vlt ci` (or delete `node_modules` and run `vlt install`) to link the vendored copy, and that vlt 0.0.0-30 … 1.0.4 install no optional dependency from the lock of a project that declares only optional dependencies (upgrade to 1.0.5 or later first); (b) otherwise, an importer's link of the dependency still resolves into `node_modules/.vlt/`: the detail names the links (`node_modules/<name>`, `<member dir>/node_modules/<name>`) and says `vlt install` (or `vlt ci`) links the vendored copy — on a warm tree after a plain `vlt install` that is true of every vendored direct dependency; (c) an importer's link resolves into the vendored dir of the patch this run replaces (a new patch uuid), which the run removes: the detail names the links and says `vlt install` (or `vlt ci`) links the new vendored copy; (d) a rebuild of the payload (vendor, or `repair` after a corrupt or missing payload) could not keep vlt's links to the package's own dependencies (its old `node_modules/` held more than links): the detail says to run `vlt ci` (or delete `node_modules` and run `vlt install`), since a plain `vlt install` does not re-link them. `repair` moves those links back into the rebuilt payload when they are only links. The package is vendored either way; a run whose patch fails to apply emits neither. A wet `vendor --revert` (and the revert a vendored → hosted takeover runs, whose advisory joins `redirect.warnings[]`): (a) the revert moves an `optionalDependencies` spec back from the `file:` dir, or an optional importer's `node_modules/<name>` still resolves into the vendored uuid dir: from vlt 0.0.0-30 a plain `vlt install` keeps that link (dangling once the dir is removed), so the detail says to run `vlt ci` (or delete `node_modules` and run `vlt install`) to link the restored copy, with the same vlt 1.0.5 note; (b) otherwise, an importer's link still resolves into the vendored uuid dir: the detail names the links and says `vlt install` (or `vlt ci`) links the restored copy. A dry-run revert emits neither. |
 | `vendor_flavor_changed` | `failed` | vendor (npm): the purl's vendor ledger entry was written for another lockfile `flavor` than the one the router now detects (for example `npm` → `vlt` after switching package managers). Remedy: `socket-patch vendor --revert` it first, then re-vendor. Refused before any write. |
 | `vendor_artifact_gitignored` | `failed` | vendor (vlt): inside a git work tree, `git check-ignore --no-index` reports the new artifact's uuid directory as ignored by a rule its own `.gitignore` cannot override (such as a root `.socket/` rule; the detail names the rule). Remedy: drop that rule for `.socket/vendor/`. Refused before any write. |
 | `vendor_artifact_gitignore_unchecked` | warning | vendor (vlt): git is installed but could not answer the ignore check for the written vendored directory (it failed to start, ran past 30 s, or `rev-parse` / `check-ignore` exited with an error); the package is vendored and the detail names what failed. Remedy: make sure no ignore rule covers `.socket/` before committing. Git absent, or a project outside any work tree, raises nothing. |
@@ -1373,7 +1213,6 @@ Every `--json` invocation emits a single JSON object that follows the **unified
 | `redirect_vlt_no_lockfile` | `redirect.warnings[]` (warning) | scan/get `--mode hosted` (vlt): `vlt.json` or vlt's install state is present without `vlt-lock.json`; replaces `redirect_npm_no_lockfile` for vlt projects. |
 | `redirect_vlt_artifact_unverifiable` | `redirect.warnings[]` (warning), `redirect.skipped[].reason` | scan/get `--mode hosted` (vlt): before any takeover or rewrite (dry runs included), each granted artifact with a default-registry instance in `vlt-lock.json` (or, for a purl a `flavor: "vlt"` vendored entry claims, its vendored node, probed before the takeover reverts it) is fetched once as vlt fetches it (`accept-encoding: gzip;q=1.0, identity;q=0.5`, no `Authorization`, up to 10 redirects) and must return 200 with no content encoding (or `identity`) and the granted sha512. On failure (`content-encoding <v>`, `sha512 mismatch`, `http <status>`, `fetch error <e>`, `offline`) the dep is withheld from every rewriter when vlt drives or it is vlt-vendored (which also keeps it vendored), and from the vlt rewrite only otherwise (detail "…; vlt-lock.json was not changed for {purl}"; only the sibling lock this run rewrote can confirm it). A lock already pinned by an earlier run is left pinned, and neither confirmed nor attested. Projects without `vlt-lock.json` make no such request. The detail quotes the artifact URL (and any fetch error that echoes it) with its grant-token path level, the one just before the patch uuid, spelled `<redacted>`; host, uuid and leaf stay. The in-memory hosted engine (`hosted-bundle`, the Node addon) has no network for this fetch, so it judges every in-scope artifact as `--offline` does (withheld, never pinned; the vendored takeover it refuses anyway). Exit 0. |
 | `redirect_vlt_reinstall_required` | `redirect.warnings[]` (advisory); rollback/remove `warnings[]` (+ human stderr) | vlt: `vlt-lock.json` pins (or, after rollback/remove, no longer pins) Socket-patched packages, and vlt never refreshes an installed copy. The heal removes `node_modules/.vlt-lock.json` and each stale `node_modules/.vlt/<DepID>` of a Socket-owned node (never a link's target, never outside the project, never a copy it cannot judge) unless `--no-vlt-install-cleanup` or `--dry-run`. It never removes an optional node's copy (lock flags 1 or 3, or flags it cannot read): `vlt install` does not put a removed optional dependency back (its link dangles) unless the same install also reinstalls a non-optional node, so such a copy is left stale and the detail says to run `vlt ci` (or delete `node_modules` and run `vlt install`); vlt 0.0.0-30 … 1.0.4 install no optional dependency from the lock of a project that declares only optional dependencies, so there both commands remove the installed copy and the detail says to upgrade vlt to 1.0.5 or later first. The detail says whether copies were removed, left stale by a skipped cleanup, could not be checked, or none were stale, and adds how many optional copies were kept whenever there are any. The kept optional copies are named by what they are: `unpatched copies of optional dependencies` after `scan`/`get`, `patched copies of optional dependencies` after `rollback`/`remove`, and `installed copies of the vendored optional dependencies` after a hosted → vendored takeover (the copy the hosted pin left installed, which may still be the registry bytes). Stale or unchecked copies are not attested by the run's `--vex`, nor is a confirmed vlt pin the heal did not check (a URL on a host other than patch.socket.dev and the configured `--patch-server-url`/`--api-url`). A hidden lock that cannot be removed keeps every store entry. Invalidation failures only warn. |
-| `vlt_root_scripts_not_run` | setup `warnings[]` entry `vlt_root_scripts_not_run: <detail>` (advisory; human: `Warning (vlt_root_scripts_not_run): <detail>` on stderr, muted by `--silent`) | setup (vlt project, npm in scope, every non-`no_files` run incl. `--dry-run` and already-configured): vlt before 1.0.0-rc.13 never runs a root `postinstall`, so the wired hook would not fire. Definite when the `vlt` on `PATH` (absolute entries only; spawned with `VLT_TELEMETRY=0`, 5 s budget) reports a semver below 1.0.0-rc.13 (the detail ends in "(`vlt --version` reports <v>)"); an unparseable `--version` never warns. Otherwise it is a "may" when `vlt-lock.json` has `lockfileVersion` `0` or none, a lock the reported `vlt` would not write: always without a usable `vlt` (absent, non-zero exit, timeout); with one at or above 1.0.0-rc.13, for a lock with no `lockfileVersion`, and for a `0` lock when it reports 1.0.0-rc.15 or later (which refuses a v0 lock, so another vlt installs the project). Remedy: upgrade vlt or run `socket-patch apply` after `vlt ci`. The hook is still written. |
 | `vendor_prebuilt_stub_invalid` | `failed` / `skipped` (warning) | vendor (gem, `--vendor-source`): the served stub gemspec fails the rubygems `summary`/`authors` bar, so bundler would refuse the vendored path source at install time. `service`: refusal naming the missing attributes; `auto`: loud warning + local-build fallback — or, when the gem is also not installed locally (no stub to derive), a refusal naming the served defect and the install-the-gem remedy. |
 | `gem_spec_invalid` | `failed` | vendor (gem): the LOCAL `specifications/` stub gemspec fails the same rubygems `summary`/`authors` bar (a corrupted or hand-edited gem home); the refusal names the file — reinstall the gem (`gem pristine <name>` / fresh `bundle install`). |
 | `vendor_*` / `pypi_*` / `gemfile_*` / `lock_*` / `locked_version_mismatch` / `user_authored_*` / `native_extensions_unsupported` / `platform_gem_unsupported` | `failed`/`skipped` | vendor: per-ecosystem refusal + drift vocabulary; see the Vendor command contract section. New tags are additive (MINOR). |
@@ -1382,7 +1221,7 @@ Every `--json` invocation emits a single JSON object that follows the **unified
 
 | Code                  | Subcommands                      | Meaning |
 |-----------------------|----------------------------------|---------|
-| `manifest_not_found`  | list, remove, repair, rollback, vex | `.socket/manifest.json` doesn't exist. For `vex` (and `scan --vex`) it fires only when, in addition, NOTHING else names a patch — no vendor-ledger entry, no lockfile reference (hosted or vendored) — and the message says so (exit 2 standalone; `apply`/`vendor --vex` treat it as their calm no-op). v3.5: `repair` proceeds anyway (vendored phase only) when a vendor ledger or vendor-path lockfile references exist, and exits 0 with a `redirect_only_project` skip (not this error) when the project's only patch state is hosted pins in its lockfiles (v5.0; or a pre-v5 `redirect-state.json`). `list` likewise no longer fires this on a hosted-only project: v5.0 lists every hosted pin the lockfiles wire (exit 0, labeled `details.mode: "hosted"` + `details.lockfiles: [<files wiring it>]` — no `details.ledger`, since hosted mode keeps none; when the manifest exists too, both are shown, purl-sorted with the manifest entry first on a tie). A pin carries its uuid and empty details unless a pre-v5 redirect ledger records the same purl and uuid (read for migration only: its record supplies the vulnerabilities / tier / description); a pre-v5 ledger record whose pin is in no lockfile is not listed. v5.0: `list` reads the vendor ledger the same way — a vendored-only project (every `scan`/`get --mode vendored` project) lists its ledger entries' embedded records labeled `Mode: vendored (recorded in .socket/vendor/state.json)` in human mode — the twin of the hosted `Mode: hosted (wired in <lockfiles>)` line — (`details.mode: "vendored"` + `details.ledger: ".socket/vendor/state.json"` in JSON), exit 0. A standalone-`vendor` entry's fallback `record` lists the same way once no manifest entry covers it (by ledger key or base purl) — the copy manifest-less `vex` attests from, so `list` never reports `manifest_not_found` for a tree whose VEX document attests a patch; while the manifest covers it, only the manifest entry is listed. All sources always come from the SAME project: the vendor ledger and the lockfiles are resolved against the root the RESOLVED manifest path implies (its `.socket` parent's parent in the standard layout, else the manifest file's directory — exactly `--cwd` for the default path), so `--manifest-path` into another project reads that project's state, never the local one. The error still fires when NONE of the three sources has a patch, and a present-but-broken manifest still reports `manifest_invalid`/`manifest_unreadable` regardless (corruption is never masked). A malformed pre-v5 redirect ledger degrades to "nothing to consult" with a stderr warning, muted by `--silent` (the pins still list); `list --json` carries it in the run-level `warnings[]` as `redirect_ledger_corrupt` instead of on stderr. v5.0: `rollback` likewise proceeds manifest-less when the vendor ledger or the lockfiles' hosted pins hold work (its error is the legacy `{status: "error", error: "Manifest not found", path}` shape, not this envelope code); only the truly-empty project — no manifest, no vendor ledger, no hosted pin (a lone pre-v5 redirect ledger is deleted, exit 0) — keeps the exit-1 error, and a project whose lockfiles still reference `.socket/vendor/` artifacts with NO vendor ledger gets a distinct error naming `socket-patch repair`. `remove` (v5.0) proceeds manifest-less whenever a vendor ledger file exists or the lockfiles pin a hosted patch (an existence probe and the read-only hosted-pin discovery before the lock; the vendor ledger loads under it): ANY vendor-ledger entry matching the identifier — detached or not — is removed through the ledger path (`--preserve-state` and drift-keeps behave exactly as on the manifest path), a hosted-only match restores its upstream registry entry, and when that state exists but holds nothing for the identifier the error is `not_found` (exit 1), not this code — `manifest_not_found` fires from `remove` only when all three sources are empty. Manifest entries are removed in sorted purl order. |
+| `manifest_not_found`  | remove, repair, rollback, vex (not `list` since v5.0: a missing manifest is an empty list) | `.socket/manifest.json` doesn't exist. For `vex` (and `scan --vex`) it fires only when, in addition, NOTHING else names a patch — no vendor-ledger entry, no lockfile reference (hosted or vendored) — and the message says so (exit 2 standalone; `apply`/`vendor --vex` treat it as their calm no-op). v3.5: `repair` proceeds anyway (vendored phase only) when a vendor ledger or vendor-path lockfile references exist, and exits 0 with a `redirect_only_project` skip (not this error) when the project's only patch state is hosted pins in its lockfiles (v5.0; or a pre-v5 `redirect-state.json`). `list` likewise no longer fires this on a hosted-only project: v5.0 lists every hosted pin the lockfiles wire (exit 0, labeled `details.mode: "hosted"` + `details.lockfiles: [<files wiring it>]` — no `details.ledger`, since hosted mode keeps none; when the manifest exists too, both are shown, purl-sorted with the manifest entry first on a tie). A pin carries its uuid and empty details unless a pre-v5 redirect ledger records the same purl and uuid (read for migration only: its record supplies the vulnerabilities / tier / description); a pre-v5 ledger record whose pin is in no lockfile is not listed. v5.0: `list` reads the vendor ledger the same way — a vendored-only project (every `scan`/`get --mode vendored` project) lists its ledger entries' embedded records labeled `Mode: vendored (recorded in .socket/vendor/state.json)` in human mode — the twin of the hosted `Mode: hosted (wired in <lockfiles>)` line — (`details.mode: "vendored"` + `details.ledger: ".socket/vendor/state.json"` in JSON), exit 0. A standalone-`vendor` entry's fallback `record` lists the same way once no manifest entry covers it (by ledger key or base purl) — the copy manifest-less `vex` attests from, so `list` never reports `manifest_not_found` for a tree whose VEX document attests a patch; while the manifest covers it, only the manifest entry is listed. All sources always come from the SAME project: the vendor ledger and the lockfiles are resolved against the root the RESOLVED manifest path implies (its `.socket` parent's parent in the standard layout, else the manifest file's directory — exactly `--cwd` for the default path), so `--manifest-path` into another project reads that project's state, never the local one. The error still fires when NONE of the three sources has a patch, and a present-but-broken manifest still reports `manifest_invalid`/`manifest_unreadable` regardless (corruption is never masked). A malformed pre-v5 redirect ledger degrades to "nothing to consult" with a stderr warning, muted by `--silent` (the pins still list); `list --json` carries it in the run-level `warnings[]` as `redirect_ledger_corrupt` instead of on stderr. v5.0: `rollback` likewise proceeds manifest-less when the vendor ledger or the lockfiles' hosted pins hold work (its error is the legacy `{status: "error", error: "Manifest not found", path}` shape, not this envelope code); only the truly-empty project — no manifest, no vendor ledger, no hosted pin (a lone pre-v5 redirect ledger is deleted, exit 0) — keeps the exit-1 error, and a project whose lockfiles still reference `.socket/vendor/` artifacts with NO vendor ledger gets a distinct error naming `socket-patch repair`. `remove` (v5.0) proceeds manifest-less whenever a vendor ledger file exists or the lockfiles pin a hosted patch (an existence probe and the read-only hosted-pin discovery before the lock; the vendor ledger loads under it): ANY vendor-ledger entry matching the identifier — detached or not — is removed through the ledger path (`--preserve-state` and drift-keeps behave exactly as on the manifest path), a hosted-only match restores its upstream registry entry, and when that state exists but holds nothing for the identifier the error is `not_found` (exit 1), not this code — `manifest_not_found` fires from `remove` only when all three sources are empty. Manifest entries are removed in sorted purl order. |
 | `manifest_invalid`    | list, remove                     | Manifest exists but is unparseable. |
 | `manifest_unreadable` | list, remove, vex                | I/O error reading manifest (vex: also an unparseable manifest; exit 2). |
 | `no_patches`          | vex                              | The manifest file exists but is empty AND no vendor-ledger record or lockfile reference names a patch (exit 1). |
@@ -1419,7 +1258,6 @@ The remaining commands still emit their pre-v3.0 ad-hoc JSON shapes and will mig
 - ⏳ `scan` — still emits the discovery + `apply.patches[*]` + `gc.*` shape documented in earlier drafts of this file.
 - ⏳ `get` — still emits per-patch action arrays.
 - ⏳ `rollback` — still emits per-package result records. Additive (v3.5): a manifest entry with no matching installed package appears in `results[]` as a marker record `{ "purl", "path": null, "skipped": "package_not_installed" }` — no `success`/`error` keys, never counted in `rolledBack`/`failed`, never flips the status or exit code (rollback's job is "make the tree unpatched"; a not-installed package already satisfies that end state, deliberately asymmetric with apply's exit-1-on-unmatched). v5.0 keeps that legacy shape and adds the ALWAYS-PRESENT keys `warnings[]` (`{code, detail}` objects, now populated), `vendored` (meaning narrowed — MAJOR), `vendoredReverted`, `vendoredPreserved`, `vendoredKept` (`{purl, reason}`), `hosted` (`{reverted, failed: [{purl, error}], unsupported, editedFiles}`), `manifest` (`{removedEntries, preserved}`), `gc` (`{skipped: true}` \| `{removedBlobs, removedDiffArchives, removedPackageArchives, bytesFreed}`), and `paths` — full key semantics and exit rules in the [Rollback command contract](#rollback-command-contract-v50).
-- ⏳ `setup` — still emits its own `{ status, updated, alreadyConfigured, errors, files }` shape (and the `--check` / `--remove` variants), now documented in full under [Setup command contract](#setup-command-contract).
 
 One command is **intentionally not** plain-envelope and will stay that way (not migration debt):
 
@@ -1561,7 +1399,9 @@ patches:" listing, and the `selection_required` `options[]` array — so
 `updates[].newUuid` names that same patch.
 
 `scan` never shows a picker: it always takes the top-ranked downloadable
-patch. On `get`, free/unauthorized callers with more than one candidate
+patch. Neither does hosted or vendored `get` (v5.0): no picker, no
+confirmation, no `selection_required` — the top-ranked accessible patch per
+package, in `--json` too. On agent-mode `get`, free/unauthorized callers with more than one candidate
 for a PURL still get the interactive picker (or `selection_required` in
 `--json`); the ranking decides the presented order and hence the
 highlighted default, not the outcome. `--yes` answers the picker with
@@ -1628,7 +1468,7 @@ socket-patch apply --json | jq '
 Exit `0` when `status` is `success`, `noManifest`, or `notFound`-with-zero-failed.
 Exit `1` when `status` is `partialFailure` (any `events[*].action == "failed"`) or `error`.
 
-`apply` with no manifest at all is a clean exit-0 no-op (`status: "noManifest"`), and an **empty** manifest (zero patches) is a plain `success` exit 0 — this is load-bearing for the install hooks, which run `apply` on every install. A fully rolled-back agent project therefore keeps `.socket/manifest.json` at `{"patches": {}}` (+ its `setup` block): the v5.0 residue rule never deletes a zero-patch manifest, precisely so these hook exits (and `list`'s 0-vs-1 below) never flip. Pinned by `tests/in_process_edge_cases.rs` and `tests/cli_dry_run_paths_e2e.rs`. **One carve-out**: a yarn-berry Plug'n'Play layout (`.pnp.*` loader at `--cwd`) refuses with the loud `yarn_pnp_unsupported` error (exit 1) even when no manifest exists — `scan` cannot discover PnP packages (they live inside `.yarn/cache/*.zip`, no `node_modules/`) and therefore never writes a manifest, so without the carve-out the documented refusal was unreachable and a PnP project's only signal was the calm noManifest exit. Pinned by `tests/e2e_safety_yarn_pnp.rs`.
+`apply` with no manifest at all is a clean exit-0 no-op (`status: "noManifest"`), and an **empty** manifest (zero patches) is a plain `success` exit 0 — this is load-bearing for CI steps that run `apply` after every install. A fully rolled-back agent project therefore keeps `.socket/manifest.json` at `{"patches": {}}`: the v5.0 residue rule never deletes a zero-patch manifest, precisely so these CI exits (and `list`'s 0-vs-1 below) never flip. Pinned by `tests/in_process_edge_cases.rs` and `tests/cli_dry_run_paths_e2e.rs`. **One carve-out**: a yarn-berry Plug'n'Play layout (`.pnp.*` loader at `--cwd`) refuses with the loud `yarn_pnp_unsupported` error (exit 1) even when no manifest exists — `scan` cannot discover PnP packages (they live inside `.yarn/cache/*.zip`, no `node_modules/`) and therefore never writes a manifest, so without the carve-out the documented refusal was unreachable and a PnP project's only signal was the calm noManifest exit. Pinned by `tests/e2e_safety_yarn_pnp.rs`.
 
 ## Exit codes
 
@@ -1636,16 +1476,16 @@ Exit `1` when `status` is `partialFailure` (any `events[*].action == "failed"`)
 |---|---|
 | `0` | Success |
 | `1` | Error (missing/invalid manifest, fetch failed, apply failed, selection cancelled in non-JSON mode, etc.) |
-| `2` | Usage error: clap parse failures (unknown flag/value, missing required arg — including the clap-enforced `setup --check --remove` conflict) and the conflicts the commands enforce themselves — `scan`'s cross-mode conflicts (`--mode` combined with a DIFFERENT mode's boolean spelling, rejected in `resolve_mode_flags`), `--detached` without vendored mode and `--mode hosted` with `--global`/`--global-prefix` (same enforcement point); in hosted/vendored `scan` (bare `scan` included), a PATH that is not a directory, a PATH glob matching no directory, and `--json` with more than one project directory (`run_project_dirs`); `remove --preserve-state --skip-rollback` (the no-op quadrant; flag- or env-sourced alike), an unparseable path glob on `scan`/`rollback`, `repair --offline --download-only`. `vex` also exits `2` on hard errors before document generation (see its tri-state table below). **Carve-out**: `get`'s self-enforced conflicts have always exited `1` via its error envelope (`--id`/`--cve`/`--ghsa`/`--package` multi-select, `--one-off --save-only`) and the v3.6 `--mode hosted\|vendored --save-only` conflict deliberately follows that get-internal precedent — changing the existing ones to `2` would be a MAJOR exit-code change |
+| `2` | Usage error: clap parse failures (unknown flag/value, missing required arg, an unknown subcommand such as the removed `setup`) and the conflicts the commands enforce themselves — `scan`'s cross-mode conflicts (`--mode` combined with a DIFFERENT mode's boolean spelling, rejected in `resolve_mode_flags`), `--detached` without vendored mode and `--mode hosted` with `--global`/`--global-prefix` (same enforcement point); in hosted/vendored `scan` (bare `scan` included), a PATH that is not a directory, a PATH glob matching no directory, and `--json` with more than one project directory (`run_project_dirs`); `remove --preserve-state --skip-rollback` (the no-op quadrant; flag- or env-sourced alike), an unparseable path glob on `scan`/`rollback`, `repair --offline --download-only`. `vex` also exits `2` on hard errors before document generation (see its tri-state table below). v5.0: `get`'s self-enforced conflicts exit `2` too (`--id`/`--cve`/`--ghsa`/`--package` multi-select, `--one-off --save-only`, `--mode hosted\|vendored --save-only`, the unimplemented `--one-off`, a malformed identifier for a forced `--id`/`--cve`/`--ghsa`), as does `rollback --one-off` — previously `1` (MAJOR). |
 
-`list` returns **`0`** for an empty manifest and **`1`** for a missing manifest — these are distinct and load-bearing (a manifest-less project whose vendor ledger holds records or whose lockfiles pin hosted patches is NOT "missing": `list` reads all three sources and exits 0 — see the `manifest_not_found` row). Every lock-taking subcommand — including `scan`/`get --mode hosted` as of v5.0 — returns **`1`** with `errorCode: lock_held` when another live socket-patch process holds `<.socket>/apply.lock`.
+`list` returns **`0`** for every project it can read, empty or not (**v5.0, BREAKING**: a project with no manifest and no ledger record — normal for hosted mode, which writes no manifest — used to exit `1` with `manifest_not_found`; it is now an empty list: `No patches in this project. Run \`socket-patch scan\`.` on stdout, and under `--json` the success envelope with `events: []`). Only an unreadable or invalid manifest (`manifest_unreadable` / `manifest_invalid`) exits `1`. Every lock-taking subcommand — including `scan`/`get --mode hosted` as of v5.0 — returns **`1`** with `errorCode: lock_held` when another live socket-patch process holds `<.socket>/apply.lock`.
 
 `vex` exit codes are tri-state:
 
 | Code | Meaning |
 |---|---|
 | `0` | A non-empty OpenVEX document was produced |
-| `1` | Nothing attested: `no_applicable_patches` (every candidate was omitted — by verification, a wiring gate, a missing record, or Property 7; the omissions ride `skipped` events) or `no_patches` (an empty manifest file and nothing wired anywhere) |
+| `1` | Nothing attested: `no_applicable_patches` (every candidate was omitted — by verification, a wiring gate, or a missing record; the omissions ride `skipped` events) or `no_patches` (an empty manifest file and nothing wired anywhere) |
 | `2` | Hard error: `manifest_not_found` (no manifest AND no vendor-ledger record / lockfile reference anywhere), `manifest_unreadable`, `vendor_ledger_corrupt` (v5.0: `redirect_ledger_corrupt` is a warning), `json_requires_output`, `product_undetected`, `serialize_failed`, `write_failed` |
 
 A missing manifest alone is not an error: a hosted or vendored checkout attests from its lockfiles (see "Manifest-less VEX"). Embedded `--vex` maps every failure to the host command's exit `1`.
@@ -1701,8 +1541,7 @@ This syncs the workspace package version into:
 
 - `npm/socket-patch/package.json` (and its `optionalDependencies`)
 - every per-platform `npm/socket-patch-*/package.json`
-- `pypi/socket-patch/pyproject.toml` and `pypi/socket-patch-hook/pyproject.toml`
-- `gem/socket-patch-bundler/socket-patch-bundler.gemspec` (the Bundler plugin gem)
+- `pypi/socket-patch/pyproject.toml`
 - `gem/socket-patch/socket-patch.gemspec` + its launcher `VERSION` (the RubyGems CLI launcher)
 
 All ecosystem publishing fans out from the single
@@ -1721,6 +1560,6 @@ Every item in this document is locked in by at least one of:
 
 - **clap parser snapshots** in `crates/socket-patch-cli/tests/cli_parse_*.rs` — assert flag names, short forms, defaults, aliases, and CSV delimiters by calling `socket_patch_cli::Cli::try_parse_from(...)`.
 - **Helper unit tests** in `crates/socket-patch-cli/src/**` (`#[cfg(test)] mod tests` blocks) — cover `looks_like_uuid`, `parse_argv_with_shortcuts`, `detect_identifier_type`, `select_patches`, `find_patches_to_rollback`, `partition_purls`, the JSON serializers, and the terminal UI in `src/ui/` (`StatusLine` redraw/clear/`println` byte streams, `confirm_with` answers and non-interactive notes, `select_one`'s JSON/empty guards, `plural`, `truncate`, the `color_enabled` truth table, `paint`/`severity`, and `pad`/`strip_ansi` alignment).
-- **Async `run()` integration tests** in `tests/cli_parse_list.rs`, `tests/cli_parse_remove.rs`, `tests/cli_parse_setup.rs` — exercise the no-network error paths and assert JSON shape via `serde_json::from_str::<Value>` + per-key assertions.
+- **Async `run()` integration tests** in `tests/cli_parse_list.rs`, `tests/cli_parse_remove.rs` — exercise the no-network error paths and assert JSON shape via `serde_json::from_str::<Value>` + per-key assertions.
 
 If you add a new flag/subcommand/JSON key, add a test here that locks the new surface in the same PR.
diff --git a/crates/socket-patch-cli/Cargo.toml b/crates/socket-patch-cli/Cargo.toml
index 4858d339..bd7262d0 100644
--- a/crates/socket-patch-cli/Cargo.toml
+++ b/crates/socket-patch-cli/Cargo.toml
@@ -52,16 +52,6 @@ windows-sys = { workspace = true, features = ["Win32_Foundation", "Win32_System_
 # `tests/docker_e2e_*.rs`. Tests in this suite require either a running
 # Docker daemon OR `SOCKET_PATCH_TEST_HOST=1` (host-toolchain mode).
 docker-e2e = []
-# Enables the experimental `setup` end-to-end test matrix under
-# `tests/setup_matrix_*.rs`, which drives the `socket-patch setup` →
-# native-install → patch-applied flow across every ecosystem/package
-# manager via `tests/setup_matrix/run-case.sh`. Same runtime requirement
-# as docker-e2e (Docker daemon OR `SOCKET_PATCH_TEST_HOST=1`). These
-# tests are ASPIRATIONAL: they assert the ideal (install applies the
-# patch) and are EXPECTED to fail for ecosystems whose install hooks
-# `setup` does not yet configure. Kept off `--all-features`-required CI;
-# the dedicated `setup-matrix` CI job runs them non-blocking.
-setup-e2e = []
 
 [dev-dependencies]
 # vendor_crash_safety_e2e / vendor_group_commit_e2e crash the binary through
diff --git a/crates/socket-patch-cli/src/args.rs b/crates/socket-patch-cli/src/args.rs
index 14ea18e8..5aa13158 100644
--- a/crates/socket-patch-cli/src/args.rs
+++ b/crates/socket-patch-cli/src/args.rs
@@ -91,7 +91,7 @@ pub(crate) fn parse_bool_flag(s: &str) -> Result<bool, String> {
 /// flags (listed first, under "Options") are not buried among the ~24 shared
 /// ones. Set per-arg rather than as the struct's `next_help_heading`: that
 /// would leak onto the subcommand-local flags declared after the flatten.
-const GLOBAL_OPTIONS: &str = "Global options";
+pub(crate) const GLOBAL_OPTIONS: &str = "Global options";
 
 // Arguments inherited by every subcommand via `#[command(flatten)]`.
 //
@@ -303,7 +303,7 @@ pub struct GlobalArgs {
     /// backoff until the lock frees or the budget elapses. Only meaningful
     /// for the commands that take the lock (`apply`, `rollback`, `repair`,
     /// `remove`, `vendor`, `get` and `scan` when they record, apply,
-    /// vendor or redirect patches, and `setup --exclude`'s manifest write);
+    /// vendor or host patches);
     /// other commands accept it silently. Every holder removes the lock file on exit, so a leftover
     /// from a crashed run never contends.
     #[arg(help_heading = GLOBAL_OPTIONS, long = "lock-timeout", env = "SOCKET_LOCK_TIMEOUT")]
@@ -364,7 +364,7 @@ pub struct GlobalArgs {
     pub no_npm_allow_remote_config: bool,
 
     /// Hosted mode (`scan`/`get --mode hosted`, and `rollback`/`remove` of
-    /// hosted redirects): do NOT remove stale vlt installed copies
+    /// hosted patches): do NOT remove stale vlt installed copies
     /// (`node_modules/.vlt-lock.json` and the stale `node_modules/.vlt`
     /// entries) after `vlt-lock.json` is repointed or restored. vlt never
     /// refreshes an installed copy on its own, so opting out means running
@@ -483,7 +483,7 @@ impl GlobalArgs {
     /// The `(api_token, org_slug)` telemetry is attributed with, resolved
     /// through the API client's own credential chain (flag → the
     /// `SOCKET_NO_API_TOKEN` veto → env → `socket login` config) WITHOUT
-    /// building a client. For the purely local commands (`list`, `setup`,
+    /// building a client. For the purely local commands (`list`,
     /// `vex`): a client would add the org-slug auto-resolve round-trip and
     /// the "No SOCKET_API_TOKEN set" advisory to a command that needs
     /// neither, while anything less than the full chain reported a
@@ -619,7 +619,6 @@ pub const LOCAL_ARG_ENV_VARS: &[&str] = &[
     "SOCKET_SKIP_ROLLBACK",
     "SOCKET_PRESERVE_STATE",
     "SOCKET_DOWNLOAD_ONLY",
-    "SOCKET_SETUP_EXCLUDE",
     "SOCKET_VENDOR_REVERT",
     "SOCKET_BATCH_SIZE",
     "SOCKET_SCAN_PACKAGES",
@@ -1484,15 +1483,15 @@ mod tests {
     }
 
     /// The mirror only works if every subcommand's `run` actually calls
-    /// `apply_env_toggles`. `list` and `setup` fire telemetry
-    /// (`track_patch_listed` / `track_patch_setup`) whose kill-switch reads
+    /// `apply_env_toggles`. `list` fires telemetry
+    /// (`track_patch_listed`) whose kill-switch reads
     /// `SOCKET_TELEMETRY_DISABLED` / `SOCKET_OFFLINE` from the env only — a
     /// run entry point that skips the mirror silently ignores
     /// `--no-telemetry` and lets `--offline` (strict airgap: never contact
     /// the network) still fire the telemetry HTTP request.
     #[test]
     #[serial_test::serial]
-    fn list_and_setup_run_mirror_global_toggles_for_airgap() {
+    fn list_run_mirrors_global_toggles_for_airgap() {
         with_clean_socket_env(|| {
             with_clean_telemetry_env(|| {
                 let rt = tokio::runtime::Builder::new_current_thread()
@@ -1522,28 +1521,6 @@ mod tests {
                      env — its telemetry kill-switch reads only SOCKET_OFFLINE / \
                      SOCKET_TELEMETRY_DISABLED",
                 );
-
-                // Reset the mirrored vars so setup can't pass on list's leftovers.
-                std::env::remove_var("SOCKET_OFFLINE");
-                std::env::remove_var("SOCKET_TELEMETRY_DISABLED");
-
-                let tmp = tempfile::tempdir().unwrap();
-                rt.block_on(crate::commands::setup::run(
-                    crate::commands::setup::SetupArgs {
-                        check: false,
-                        remove: false,
-                        exclude: Vec::new(),
-                        common: GlobalArgs {
-                            // `setup` must not write anything from a unit test.
-                            dry_run: true,
-                            ..toggles_on(tmp.path())
-                        },
-                    },
-                ));
-                assert!(
-                    socket_patch_core::telemetry::is_telemetry_disabled(),
-                    "`setup --offline --no-telemetry` must mirror the toggles into the env",
-                );
             });
         });
     }
@@ -1607,7 +1584,7 @@ mod tests {
             ("SOCKET_VEX_NO_VERIFY", &["socket-patch", "vex"]),
             ("SOCKET_VEX_COMPACT", &["socket-patch", "vex"]),
             // The embedded `--vex-*` twins share the same env vars and must
-            // not abort host commands (e.g. apply from a postinstall hook).
+            // not abort host commands (e.g. apply from a CI step).
             ("SOCKET_VEX_NO_VERIFY", &["socket-patch", "apply"]),
             ("SOCKET_VEX_COMPACT", &["socket-patch", "scan"]),
         ];
@@ -1645,7 +1622,6 @@ mod tests {
             ("SOCKET_BATCH_SIZE", &["socket-patch", "scan"]),
             ("SOCKET_SCAN_PACKAGES", &["socket-patch", "scan"]),
             ("SOCKET_PATCH_VERSION", &["socket-patch", "self-update"]),
-            ("SOCKET_SETUP_EXCLUDE", &["socket-patch", "setup"]),
             ("SOCKET_VEX", &["socket-patch", "apply"]),
             ("SOCKET_VEX_OUTPUT", &["socket-patch", "vex"]),
             ("SOCKET_VEX_PRODUCT", &["socket-patch", "vex"]),
diff --git a/crates/socket-patch-cli/src/commands/apply.rs b/crates/socket-patch-cli/src/commands/apply.rs
index b1b932eb..a0dae200 100644
--- a/crates/socket-patch-cli/src/commands/apply.rs
+++ b/crates/socket-patch-cli/src/commands/apply.rs
@@ -69,7 +69,7 @@ fn warn_mismatch_overwrites(result: &ApplyResult, common: &GlobalArgs) {
 fn format_mismatch_warning(purl: &str, file: &str, dry_run: bool) -> String {
     let what = if dry_run { "would apply" } else { "applied" };
     format!(
-        "Warning (content_mismatch_overwritten): {purl} {file} did not match the patch's \
+        "Warning: {purl} {file} did not match the patch's \
          expected original content; {what} the full verified patched content instead \
          (pass --strict to fail on mismatches)"
     )
@@ -765,7 +765,8 @@ pub async fn run(args: ApplyArgs) -> i32 {
     let manifest_path = args.common.resolved_manifest_path();
 
     // No manifest → nothing to apply: a clean exit-0 no-op (load-bearing
-    // for the install hooks, which run `apply --silent` on every install).
+    // for CI steps and legacy install hooks that run `apply --silent` on
+    // every install).
     // Nothing below this gate is touched — no API client (its config read,
     // stderr advisory and org-slug round-trip), no lock, no `.socket/`.
     if tokio::fs::metadata(&manifest_path).await.is_err() {
@@ -1033,11 +1034,11 @@ pub(crate) async fn run_locked(
                     // own `Error:` diagnostic (already printed, even under
                     // --silent); they exist for the JSON envelope.
                     if !is_stage_failure_code(&w.code) {
-                        eprintln!("Warning ({}): {}", w.code, w.detail);
+                        eprintln!("Warning: {}", w.detail);
                     }
                 }
                 for skip in &fallback_skips {
-                    eprintln!("Warning (gem_fallback_home_skipped): {}", skip.detail());
+                    eprintln!("Warning: {}", skip.detail());
                 }
             }
 
@@ -3108,7 +3109,7 @@ mod tests {
     fn mismatch_messages_follow_dry_run_tense() {
         assert_eq!(
             format_mismatch_warning("pkg:npm/nuxt@4.5.0", "dist/index.mjs", false),
-            "Warning (content_mismatch_overwritten): pkg:npm/nuxt@4.5.0 dist/index.mjs did \
+            "Warning: pkg:npm/nuxt@4.5.0 dist/index.mjs did \
              not match the patch's expected original content; applied the full verified \
              patched content instead (pass --strict to fail on mismatches)"
         );
diff --git a/crates/socket-patch-cli/src/commands/get.rs b/crates/socket-patch-cli/src/commands/get.rs
index 2716181e..ed9200e8 100644
--- a/crates/socket-patch-cli/src/commands/get.rs
+++ b/crates/socket-patch-cli/src/commands/get.rs
@@ -943,17 +943,14 @@ fn format_all_narrowed(skips: &[serde_json::Value]) -> String {
     }
 }
 
-/// The confirmation question for `n` selected patches.
-fn format_confirm_prompt(mode: super::scan::ScanMode, n: usize, save_only: bool) -> String {
+/// The agent-mode confirmation question for `n` selected patches (hosted
+/// and vendored `get` never prompt).
+fn format_confirm_prompt(save_only: bool, n: usize) -> String {
     let patches = crate::ui::plural(n, "patch", "patches");
-    match mode {
-        super::scan::ScanMode::Agent if save_only => format!("Download {patches}?"),
-        super::scan::ScanMode::Agent => format!("Download and apply {patches}?"),
-        super::scan::ScanMode::Vendored => format!("Download and vendor {patches}?"),
-        super::scan::ScanMode::Hosted => format!(
-            "Redirect {} to the hosted patch server?",
-            crate::ui::plural(n, "package", "packages")
-        ),
+    if save_only {
+        format!("Download {patches}?")
+    } else {
+        format!("Download and apply {patches}?")
     }
 }
 
@@ -976,9 +973,8 @@ fn no_packages_message(global: bool) -> String {
 /// `patch` names it (a purl, or the uuid when the purl is unknown).
 fn format_paid_required(patch: &str) -> String {
     format!(
-        "This patch requires a paid subscription to download.\n  \
-         Patch: {patch}\n  \
-         Upgrade at: https://socket.dev/pricing"
+        "This patch requires a paid Socket plan.\n  Patch: {patch}\n{}",
+        crate::ui::PAID_UPGRADE
     )
 }
 
@@ -1177,7 +1173,7 @@ pub(crate) fn select_patches(
                     return Err(1);
                 }
                 Err(SelectError::Cancelled) => {
-                    eprintln!("Selection cancelled.");
+                    eprintln!("{}", crate::ui::CANCELLED);
                     return Err(0);
                 }
             }
@@ -2636,19 +2632,18 @@ pub async fn run(args: GetArgs) -> i32 {
             args.common.json,
             "Only one of --id, --cve, --ghsa, or --package can be specified",
         );
-        return 1;
+        return 2;
     }
     if args.one_off && args.save_only {
         report_error(
             args.common.json,
             "--one-off and --save-only cannot be used together",
         );
-        return 1;
+        return 2;
     }
     // v5: hosted by default, like scan. `--save-only` (records a manifest
     // entry) and global installs (no project lockfile) mean agent mode.
-    // Conflicts use get's exit-1 report_error style (scan's self-enforced
-    // conflicts exit 2 — documented carve-out in CLI_CONTRACT.md).
+    // Usage errors exit 2, like clap's and scan's (v5.0).
     let mode = args.mode.unwrap_or(if args.save_only || args.common.is_global() {
         super::scan::ScanMode::Agent
     } else {
@@ -2664,7 +2659,7 @@ pub async fn run(args: GetArgs) -> i32 {
                 mode.cli_name()
             ),
         );
-        return 1;
+        return 2;
     }
     if args.one_off {
         // The flag parses but is not implemented: fail loudly rather than
@@ -2672,7 +2667,7 @@ pub async fn run(args: GetArgs) -> i32 {
         // not-yet-implemented contract; rejected before any network or disk
         // activity.
         report_error(args.common.json, "One-off get mode is not yet implemented");
-        return 1;
+        return 2;
     }
     // Strict airgap (CLI_CONTRACT.md `--offline`: never contact the
     // network; operations that need remote data fail loudly). Every `get`
@@ -2706,7 +2701,7 @@ pub async fn run(args: GetArgs) -> i32 {
     if args.id || args.cve || args.ghsa {
         if let Some(err) = forced_identifier_error(&args.identifier, id_type) {
             report_error(args.common.json, err);
-            return 1;
+            return 2;
         }
     }
 
@@ -3018,8 +3013,8 @@ pub async fn run(args: GetArgs) -> i32 {
                 "{}",
                 format_search_results(&all, search_response.can_access_paid_patches, color)
             );
-            println!("All available patches require a paid subscription.");
-            println!("  Upgrade at: https://socket.dev/pricing");
+            println!("All available patches require a paid Socket plan.");
+            println!("{}", crate::ui::PAID_UPGRADE);
         }
         return 0;
     }
@@ -3066,8 +3061,8 @@ pub async fn run(args: GetArgs) -> i32 {
     // by --json (stderr; the envelope carries them too) — but --silent
     // mutes them like scan does.
     if !args.common.silent {
-        for (code, detail) in &narrow_warnings {
-            eprintln!("Warning ({code}): {detail}");
+        for (_, detail) in &narrow_warnings {
+            eprintln!("Warning: {detail}");
         }
     }
     if accessible.is_empty() {
@@ -3125,10 +3120,18 @@ pub async fn run(args: GetArgs) -> i32 {
     // Smart patch selection: pick one patch per PURL. `accessible` is
     // non-empty here and every entry passes the selector's tier filter, so
     // the selection is never empty (one patch per purl group, or `Err`).
+    // Hosted and vendored `get` never prompt (v5.0): like `scan`, they take
+    // the top-ranked accessible patch per package, in JSON mode too.
+    let auto_pick = mode != super::scan::ScanMode::Agent;
+    let select_common = if auto_pick {
+        super::scan::selection_args(&args.common)
+    } else {
+        args.common.clone()
+    };
     let selected = match select_patches(
         &accessible,
-        search_response.can_access_paid_patches,
-        &args.common,
+        auto_pick || search_response.can_access_paid_patches,
+        &select_common,
     ) {
         Ok(s) => s,
         Err(code) => return code,
@@ -3143,7 +3146,7 @@ pub async fn run(args: GetArgs) -> i32 {
         && !selection_prompted(
             &accessible,
             search_response.can_access_paid_patches,
-            &args.common,
+            &select_common,
         )
     {
         print!("{}", format_selected_patches(&selected, color));
@@ -3172,14 +3175,17 @@ pub async fn run(args: GetArgs) -> i32 {
         return agent_dry_run(&args, &selected, &narrow_skips, &narrow_warnings).await;
     }
 
-    // Confirm before acting (default YES), with mode-appropriate wording.
-    // Dry runs skip the prompt: nothing mutates, so nothing to confirm.
-    let prompt = format_confirm_prompt(mode, selected.len(), args.save_only);
-    if !args.common.dry_run && !crate::ui::confirm(&prompt, true, &args.common) {
-        if !quiet {
-            eprintln!("Cancelled; no changes made.");
+    // Agent mode confirms before acting (default YES). Dry runs skip the
+    // prompt: nothing mutates, so nothing to confirm. Hosted and vendored
+    // runs never prompt (v5.0), like `scan`.
+    if mode == super::scan::ScanMode::Agent && !args.common.dry_run {
+        let prompt = format_confirm_prompt(args.save_only, selected.len());
+        if !crate::ui::confirm(&prompt, true, &args.common) {
+            if !quiet {
+                eprintln!("{}", crate::ui::CANCELLED);
+            }
+            return 0;
         }
-        return 0;
     }
 
     match mode {
@@ -5402,32 +5408,10 @@ mod tests {
     }
 
     #[test]
-    fn confirm_prompts_per_mode() {
-        use super::super::scan::ScanMode;
-        assert_eq!(
-            format_confirm_prompt(ScanMode::Agent, 1, false),
-            "Download and apply 1 patch?"
-        );
-        assert_eq!(
-            format_confirm_prompt(ScanMode::Agent, 2, false),
-            "Download and apply 2 patches?"
-        );
-        assert_eq!(
-            format_confirm_prompt(ScanMode::Agent, 1, true),
-            "Download 1 patch?"
-        );
-        assert_eq!(
-            format_confirm_prompt(ScanMode::Vendored, 3, false),
-            "Download and vendor 3 patches?"
-        );
-        assert_eq!(
-            format_confirm_prompt(ScanMode::Hosted, 1, false),
-            "Redirect 1 package to the hosted patch server?"
-        );
-        assert_eq!(
-            format_confirm_prompt(ScanMode::Hosted, 0, false),
-            "Redirect 0 packages to the hosted patch server?"
-        );
+    fn confirm_prompts_agent_mode() {
+        assert_eq!(format_confirm_prompt(false, 1), "Download and apply 1 patch?");
+        assert_eq!(format_confirm_prompt(false, 2), "Download and apply 2 patches?");
+        assert_eq!(format_confirm_prompt(true, 1), "Download 1 patch?");
     }
 
     #[test]
@@ -5455,9 +5439,9 @@ mod tests {
     fn paid_required_text() {
         assert_eq!(
             format_paid_required("pkg:npm/a@1"),
-            "This patch requires a paid subscription to download.\n  \
-             Patch: pkg:npm/a@1\n  \
-             Upgrade at: https://socket.dev/pricing"
+            "This patch requires a paid Socket plan.\n  \
+             Patch: pkg:npm/a@1\n\
+             Upgrade to a paid Socket plan to access all patches: https://socket.dev/pricing"
         );
     }
 
diff --git a/crates/socket-patch-cli/src/commands/list.rs b/crates/socket-patch-cli/src/commands/list.rs
index 18956a83..c22dccbd 100644
--- a/crates/socket-patch-cli/src/commands/list.rs
+++ b/crates/socket-patch-cli/src/commands/list.rs
@@ -351,11 +351,15 @@ fn format_entry(entry: &ListEntry<'_>, color: bool) -> String {
     lines.join("\n")
 }
 
+/// The human line for a project with nothing to list (an empty manifest, or
+/// no manifest and no ledger records at all).
+const NO_PATCHES: &str = "No patches in this project. Run `socket-patch scan`.";
+
 /// The whole human listing for stdout: a count header, then the entries
 /// separated by one blank line (none after the last).
 fn format_listing(entries: &[ListEntry<'_>], color: bool) -> String {
     if entries.is_empty() {
-        return "No patches found in manifest.".to_string();
+        return NO_PATCHES.to_string();
     }
     let mut out = format!(
         "Found {}:\n\n",
@@ -437,7 +441,7 @@ pub async fn run(args: ListArgs) -> i32 {
                 detail: detail.clone(),
             });
         } else if !args.common.silent {
-            eprintln!("Warning (hosted_wiring_contested): {detail}");
+            eprintln!("Warning: {}", crate::commands::rollback::capitalize_first(detail));
         }
     }
     let vendor_state =
@@ -456,17 +460,12 @@ pub async fn run(args: ListArgs) -> i32 {
             emit_error(&args, "hosted_wiring_contested", detail, warnings);
             return 1;
         }
-        // No manifest AND no ledger records: nothing is listable anywhere.
-        emit_error(
-            &args,
-            "manifest_not_found",
-            format!("Manifest not found at {}", manifest_path.display()),
-            warnings,
-        );
-        return 1;
     }
 
-    // Records found (any store) ⇒ a successful list, exit 0.
+    // A successful list, exit 0, with or without records. No manifest
+    // and no ledger record is just an empty project (normal for hosted
+    // mode, which writes no manifest); only an unreadable or invalid
+    // manifest or contested hosted wiring fails.
     //
     // Telemetry: `patch_listed`'s `patches_count` means "manifest patches"
     // to its consumers, so it counts the manifest ONLY (0 on a ledger-only
@@ -1085,7 +1084,7 @@ mod tests {
 
     #[test]
     fn format_listing_counts_and_separates_entries() {
-        assert_eq!(format_listing(&[], false), "No patches found in manifest.");
+        assert_eq!(format_listing(&[], false), NO_PATCHES);
         let manifest = sample_manifest();
         let one = combined_entries(Some(&manifest), &[], None);
         let out = format_listing(&one, false);
diff --git a/crates/socket-patch-cli/src/commands/mod.rs b/crates/socket-patch-cli/src/commands/mod.rs
index 7b56b9d7..87f55213 100644
--- a/crates/socket-patch-cli/src/commands/mod.rs
+++ b/crates/socket-patch-cli/src/commands/mod.rs
@@ -10,7 +10,6 @@ pub mod repair;
 pub(crate) mod vendored_backend;
 pub mod rollback;
 pub mod scan;
-pub mod setup;
 pub mod update;
 pub mod vendor;
 pub mod vex;
@@ -137,8 +136,8 @@ pub(crate) async fn load_vendor_state_lenient(
 }
 
 /// Whether a vendor-ledger entry's embedded `record` stands on its own —
-/// the rule every reader of embedded records shares (`vex`'s record plan,
-/// `list`, and `setup --check` through [`fold_vendor_records`]), so one
+/// the rule every reader of embedded records shares (`vex`'s record plan
+/// and `list`), so one
 /// tree never lists "no patches" while its VEX document attests one.
 ///
 /// A `detached` entry (every `scan`/`get --mode vendored` entry) has no
@@ -162,124 +161,3 @@ pub(crate) fn vendor_record_is_unowned(
             !m.patches.contains_key(key) && !m.patches.contains_key(&entry.base_purl)
         })
 }
-
-/// Fold the vendor ledger's embedded records into a manifest view.
-/// Vendored mode is manifest-free (every `scan`/`get --mode vendored` entry
-/// carries `detached: true` plus its embedded patch `record`), so the
-/// ledger is the only copy of those records: verification (`setup --check`,
-/// property 4) must see them exactly like manifest entries (`vex` gathers
-/// them through its own gated plan, `commands::vex_sources`). A standalone
-/// `vendor` entry's fallback copy folds in under the same
-/// [`vendor_record_is_unowned`] rule `vex` and `list` apply — only when the
-/// manifest does not cover the entry. Keyed by the ledger key; an existing
-/// manifest entry wins a collision (that purl is manifest-owned and
-/// verifies against the manifest's record). Ownership is judged against
-/// the manifest as given, never against records folded earlier in the same
-/// pass (`HashMap` order must not decide which entries fold).
-pub(crate) fn fold_vendor_records(
-    manifest: &mut socket_patch_core::manifest::schema::PatchManifest,
-    entries: &std::collections::HashMap<String, socket_patch_core::vendor::VendorEntry>,
-) {
-    let folded: Vec<(String, socket_patch_core::manifest::schema::PatchRecord)> = entries
-        .iter()
-        .filter(|(key, entry)| {
-            vendor_record_is_unowned(key, entry, Some(&*manifest))
-                && !manifest.patches.contains_key(key.as_str())
-        })
-        .filter_map(|(key, entry)| Some((key.clone(), entry.record.clone()?)))
-        .collect();
-    manifest.patches.extend(folded);
-}
-
-#[cfg(test)]
-mod vendor_record_fold_tests {
-    use std::collections::HashMap;
-
-    use socket_patch_core::manifest::schema::{PatchManifest, PatchRecord};
-    use socket_patch_core::vendor::VendorEntry;
-
-    use super::fold_vendor_records;
-
-    fn record(uuid: &str) -> PatchRecord {
-        serde_json::from_value(serde_json::json!({
-            "uuid": uuid,
-            "exportedAt": "2026-01-01T00:00:00Z",
-            "files": { "package/index.js": { "beforeHash": "b", "afterHash": "a" } },
-            "vulnerabilities": {},
-            "description": "fixture",
-            "license": "MIT",
-            "tier": "free",
-        }))
-        .expect("record fixture deserializes")
-    }
-
-    fn entry(base_purl: &str, uuid: &str, detached: bool, embedded: bool) -> VendorEntry {
-        serde_json::from_value(serde_json::json!({
-            "ecosystem": "npm",
-            "basePurl": base_purl,
-            "uuid": uuid,
-            "artifact": { "path": format!(".socket/vendor/npm/{uuid}/pkg.tgz") },
-            "wiring": [],
-            "detached": detached,
-            "record": embedded.then(|| record(uuid)),
-        }))
-        .expect("vendor entry fixture deserializes")
-    }
-
-    /// `setup --check`'s fold follows the rule `vex` attests by: detached
-    /// records always fold (a manifest entry wins its own key), a standalone
-    /// `vendor` entry's fallback copy folds only when the manifest covers
-    /// neither its key nor its base purl, and a record-less legacy entry
-    /// never folds. Ownership is judged against the manifest as given.
-    #[test]
-    fn standalone_vendor_fallback_folds_only_when_uncovered() {
-        let mut entries = HashMap::new();
-        entries.insert(
-            "pkg:npm/owned@1.0.0".to_string(),
-            entry("pkg:npm/owned@1.0.0", "u-stale", false, true),
-        );
-        entries.insert(
-            "pkg:npm/owned@1.0.0?variant=x".to_string(),
-            entry("pkg:npm/owned@1.0.0", "u-variant", false, true),
-        );
-        entries.insert(
-            "pkg:npm/dropped@1.0.0".to_string(),
-            entry("pkg:npm/dropped@1.0.0", "u-dropped", false, true),
-        );
-        entries.insert(
-            "pkg:npm/detached@1.0.0".to_string(),
-            entry("pkg:npm/detached@1.0.0", "u-detached", true, true),
-        );
-        entries.insert(
-            "pkg:npm/legacy@1.0.0".to_string(),
-            entry("pkg:npm/legacy@1.0.0", "u-legacy", false, false),
-        );
-
-        let mut manifest = PatchManifest::default();
-        manifest
-            .patches
-            .insert("pkg:npm/owned@1.0.0".to_string(), record("u-manifest"));
-        fold_vendor_records(&mut manifest, &entries);
-        let mut folded: Vec<(&str, &str)> = manifest
-            .patches
-            .iter()
-            .map(|(k, r)| (k.as_str(), r.uuid.as_str()))
-            .collect();
-        folded.sort();
-        assert_eq!(
-            folded,
-            vec![
-                ("pkg:npm/detached@1.0.0", "u-detached"),
-                ("pkg:npm/dropped@1.0.0", "u-dropped"),
-                ("pkg:npm/owned@1.0.0", "u-manifest"),
-            ],
-            "a newer manifest uuid keeps winning; covered and record-less entries stay out"
-        );
-
-        // No manifest records at all: every embedded copy folds.
-        let mut empty = PatchManifest::default();
-        fold_vendor_records(&mut empty, &entries);
-        assert_eq!(empty.patches.len(), 4, "{:?}", empty.patches.keys());
-        assert_eq!(empty.patches["pkg:npm/owned@1.0.0"].uuid, "u-stale");
-    }
-}
diff --git a/crates/socket-patch-cli/src/commands/remove.rs b/crates/socket-patch-cli/src/commands/remove.rs
index 0033502d..2f7a09a4 100644
--- a/crates/socket-patch-cli/src/commands/remove.rs
+++ b/crates/socket-patch-cli/src/commands/remove.rs
@@ -96,7 +96,7 @@ async fn emit_not_found(
     }
 }
 
-/// Print the hosted leg's run-level advisories (`Warning (<code>): …`) on
+/// Print the hosted leg's run-level advisories (`Warning: …`) on
 /// stderr — never under `--silent` / `--json` (JSON carries them in the
 /// envelope's `warnings[]`). Printed as soon as the leg returns, so a
 /// human run that then fails still says what it did to the files.
@@ -104,8 +104,8 @@ fn print_hosted_leg_warnings(common: &GlobalArgs, warnings: &[(String, String)])
     if common.silent || common.json {
         return;
     }
-    for (code, detail) in warnings {
-        eprintln!("Warning ({code}): {detail}");
+    for (_, detail) in warnings {
+        eprintln!("Warning: {detail}");
     }
 }
 
@@ -183,7 +183,7 @@ fn remove_prompt(
     if hosted > 0 {
         clauses.push(format!(
             "unwind {}",
-            plural(hosted, "hosted redirect", "hosted redirects")
+            plural(hosted, "hosted patch", "hosted patches")
         ));
     }
     let question = super::rollback::as_question(&super::rollback::join_clauses(&clauses));
@@ -543,7 +543,7 @@ pub async fn run(args: RemoveArgs) -> i32 {
         );
         if !crate::ui::confirm(&prompt, true, &args.common) {
             if loud {
-                println!("Removal cancelled.");
+                println!("{}", crate::ui::CANCELLED);
             }
             return 0;
         }
@@ -816,7 +816,7 @@ pub async fn run(args: RemoveArgs) -> i32 {
     // the blob sweep below can still preview against the post-removal
     // reference set. `--preserve-state` deliberately touches neither the
     // manifest nor the blobs. An emptied manifest stays on disk as
-    // `{"patches": {}}` — it carries the setup block and the
+    // `{"patches": {}}` — it carries any legacy setup block and the
     // empty-vs-missing exit codes of `list`/`apply`/`repair`.
     let mut updated_manifest = manifest.clone();
     let removed = if args.preserve_state {
@@ -1168,7 +1168,7 @@ async fn revert_vendored_matches(
     {
         for w in &warnings {
             if loud {
-                eprintln!("Warning ({}): {}", w.code, w.detail);
+                eprintln!("Warning: {}", w.detail);
             }
             leg.skipped.push(
                 PatchEvent::new(PatchAction::Skipped, key.clone())
@@ -1360,9 +1360,9 @@ async fn remove_hosted_only(
         eprintln!(
             "The following {} {} unwound and removed:",
             if hosted_matches.len() == 1 {
-                "hosted redirect"
+                "hosted patch"
             } else {
-                "hosted redirects"
+                "hosted patches"
             },
             if args.common.dry_run {
                 "would be"
@@ -1378,7 +1378,7 @@ async fn remove_hosted_only(
     // `--dry-run` previews without mutating — nothing to confirm.
     let prompt = format!(
         "Remove {} and unwind {} lockfile wiring?",
-        plural(hosted_matches.len(), "hosted redirect", "hosted redirects"),
+        plural(hosted_matches.len(), "hosted patch", "hosted patches"),
         if hosted_matches.len() == 1 {
             "its"
         } else {
@@ -1387,7 +1387,7 @@ async fn remove_hosted_only(
     );
     if !args.common.dry_run && !crate::ui::confirm(&prompt, true, &args.common) {
         if loud {
-            println!("Removal cancelled.");
+            println!("{}", crate::ui::CANCELLED);
         }
         return 0;
     }
@@ -1504,7 +1504,7 @@ async fn remove_ledger_only(
     };
     if !args.common.dry_run && !crate::ui::confirm(&prompt, true, &args.common) {
         if loud {
-            println!("Removal cancelled.");
+            println!("{}", crate::ui::CANCELLED);
         }
         return 0;
     }
@@ -1785,12 +1785,12 @@ mod tests {
         );
         assert_eq!(
             remove_prompt(1, false, false, 0, 1),
-            "Remove 1 patch, roll back its files, and unwind 1 hosted redirect?"
+            "Remove 1 patch, roll back its files, and unwind 1 hosted patch?"
         );
         assert_eq!(
             remove_prompt(1, false, false, 2, 1),
             "Remove 1 patch, roll back its files, revert 2 vendored artifacts, and unwind 1 \
-             hosted redirect?"
+             hosted patch?"
         );
         assert_eq!(
             remove_prompt(1, true, false, 1, 0),
diff --git a/crates/socket-patch-cli/src/commands/repair.rs b/crates/socket-patch-cli/src/commands/repair.rs
index 039075cd..48fd4d0b 100644
--- a/crates/socket-patch-cli/src/commands/repair.rs
+++ b/crates/socket-patch-cli/src/commands/repair.rs
@@ -263,9 +263,9 @@ fn format_found_missing(n: usize, noun: ArtifactNoun) -> String {
 
 /// Why a hosted-only project has nothing to repair (the JSON skip
 /// reason; the human line adds the period).
-const HOSTED_ONLY_REASON: &str = "Hosted redirects need no local repair; re-run \
-    `scan --mode hosted` to refresh the lockfile redirects (it also re-checks for stale \
-    pre-redirect installs)";
+const HOSTED_ONLY_REASON: &str = "Hosted patches need no local repair; re-run \
+    `scan --mode hosted` to refresh the lockfile (it also re-checks for stale \
+    pre-hosted installs)";
 
 /// Step 1's line when no patch artifact is missing: why there is nothing
 /// to download (no manifest, as in a vendored-only project, or an empty
@@ -721,8 +721,8 @@ mod tests {
         );
         assert_eq!(
             HOSTED_ONLY_REASON,
-            "Hosted redirects need no local repair; re-run `scan --mode hosted` to refresh \
-             the lockfile redirects (it also re-checks for stale pre-redirect installs)"
+            "Hosted patches need no local repair; re-run `scan --mode hosted` to refresh \
+             the lockfile (it also re-checks for stale pre-hosted installs)"
         );
     }
 
diff --git a/crates/socket-patch-cli/src/commands/rollback.rs b/crates/socket-patch-cli/src/commands/rollback.rs
index e3306e16..e49a4051 100644
--- a/crates/socket-patch-cli/src/commands/rollback.rs
+++ b/crates/socket-patch-cli/src/commands/rollback.rs
@@ -894,7 +894,7 @@ async fn run_vendored_leg(
     {
         for w in &warnings {
             if loud {
-                eprintln!("Warning ({}): {}", w.code, w.detail);
+                eprintln!("Warning: {}", w.detail);
             }
             out.warnings.push((w.code.to_string(), w.detail.clone()));
         }
@@ -1110,7 +1110,8 @@ pub async fn run(args: RollbackArgs) -> i32 {
         } else {
             eprintln!("Error: {msg}");
         }
-        return 1;
+        // A usage error (v5.0: exit 2, like every other one).
+        return 2;
     }
 
     // An unparseable glob is a usage error — same exit-2 stderr shape as
@@ -1185,8 +1186,8 @@ pub async fn run(args: RollbackArgs) -> i32 {
                     }))
                     .expect("serializing an in-memory JSON value cannot fail")
                 );
-            } else if let Some((code, detail)) = &warning {
-                eprintln!("Warning ({code}): {}", capitalize_first(detail));
+            } else if let Some((_, detail)) = &warning {
+                eprintln!("Warning: {}", capitalize_first(detail));
             } else if !args.common.silent {
                 println!(
                     "{} the pre-v5 hosted ledger {}: no lockfile pins a hosted patch.",
@@ -1505,7 +1506,7 @@ pub async fn run(args: RollbackArgs) -> i32 {
         let prompt = rollback_prompt(manifest_scope.len(), vendor_scope.len(), hosted_scope.len());
         if !crate::ui::confirm(&prompt, true, &args.common) {
             if !args.common.json && !args.common.silent {
-                println!("Rollback cancelled.");
+                println!("{}", crate::ui::CANCELLED);
             }
             return 0;
         }
@@ -1638,7 +1639,7 @@ pub async fn run(args: RollbackArgs) -> i32 {
 
             // The manifest is rewritten only when an entry actually leaves
             // it; an emptied manifest stays on disk as `{"patches": {}}`
-            // (it carries the setup block and `list`/`apply`/`repair`'s
+            // (it carries any legacy setup block and `list`/`apply`/`repair`'s
             // empty-vs-missing exit codes) — never deleted.
             let mut removed: Vec<String> = Vec::new();
             let mut updated_manifest = manifest.clone();
@@ -2018,8 +2019,8 @@ pub async fn run(args: RollbackArgs) -> i32 {
             // failures, hosted replay notes, ...): the JSON envelope's
             // `warnings[]`, one stderr line each here.
             if !args.common.json && !args.common.silent {
-                for (code, detail) in &human_warnings {
-                    eprintln!("Warning ({code}): {detail}");
+                for (_, detail) in &human_warnings {
+                    eprintln!("Warning: {detail}");
                 }
             }
 
@@ -4597,8 +4598,8 @@ mod tests {
         assert_eq!(capitalize_first("can't, really"), "Can't, really");
         // Values the user may copy back are never altered.
         assert_eq!(
-            capitalize_first("pkg:npm/a@1 matches only hosted redirect records"),
-            "pkg:npm/a@1 matches only hosted redirect records"
+            capitalize_first("pkg:npm/a@1 matches only hosted records"),
+            "pkg:npm/a@1 matches only hosted records"
         );
         assert_eq!(
             capitalize_first("a1b2c3d4-0000-4000-8000-000000000000 matches nothing"),
diff --git a/crates/socket-patch-cli/src/commands/scan/gc.rs b/crates/socket-patch-cli/src/commands/scan/gc.rs
index 35b205a3..eb307099 100644
--- a/crates/socket-patch-cli/src/commands/scan/gc.rs
+++ b/crates/socket-patch-cli/src/commands/scan/gc.rs
@@ -330,13 +330,13 @@ pub(super) fn format_gc_line(gc: &GcSummary, preview: bool) -> Option<String> {
 /// Human-readable line(s) for the vendored-state half of a GC pass (and
 /// the lock-skip reason / failed rewrites, when the pass could not run or
 /// persist in full), in order; empty when there is nothing to report.
-/// Split out so the contract's human GC vocabulary (`GC: skipped (<code>):
+/// Split out so the contract's human GC vocabulary (`GC: skipped:
 /// <message>.`, one `GC: <detail>.` per warning, `GC: failed to revert N
 /// vendored entry/entries: …`) is unit-testable without capturing stdout.
 pub(super) fn format_gc_vendored_lines(gc: &GcSummary) -> Vec<String> {
     let mut lines = Vec::new();
-    if let Some((code, message)) = &gc.skipped {
-        lines.push(format!("GC: skipped ({code}): {message}."));
+    if let Some((_, message)) = &gc.skipped {
+        lines.push(format!("GC: skipped: {message}."));
     }
     for (_, detail) in &gc.warnings {
         lines.push(format!("GC: {detail}."));
@@ -1524,7 +1524,7 @@ mod tests {
         assert_eq!(
             format_gc_vendored_lines(&gc),
             vec![
-                "GC: skipped (lock_held): another socket-patch process is operating in this \
+                "GC: skipped: another socket-patch process is operating in this \
                  directory."
                     .to_string(),
                 "GC: could not update manifest.".to_string(),
diff --git a/crates/socket-patch-cli/src/commands/scan/hosted.rs b/crates/socket-patch-cli/src/commands/scan/hosted.rs
index a78063ff..445e0c52 100644
--- a/crates/socket-patch-cli/src/commands/scan/hosted.rs
+++ b/crates/socket-patch-cli/src/commands/scan/hosted.rs
@@ -91,7 +91,7 @@ pub(crate) const PNPM_TRUST_TRADEOFF_AND_CAUTION: &str =
      (minimumReleaseAge / trustPolicy re-checks) for ALL lockfile entries, \
      not just the patched ones — the per-entry sha512 integrity pins are \
      still enforced. Do NOT follow pnpm's advice to rebuild the lockfile \
-     (`pnpm clean --lockfile`): that silently discards the redirect and \
+     (`pnpm clean --lockfile`): that silently discards the hosted patches and \
      reinstalls the vulnerable upstream artifact. pnpm <=10 ignores the \
      setting and installs work unchanged";
 
@@ -114,7 +114,7 @@ pub(crate) fn pnpm_trust_manual_guidance(server: &str) -> String {
          `trustLockfile: true` in pnpm-workspace.yaml so every install \
          accepts the patched artifacts. Do NOT follow pnpm's advice to \
          rebuild the lockfile (`pnpm clean --lockfile`): that silently \
-         discards the redirect and reinstalls the vulnerable upstream \
+         discards the hosted patches and reinstalls the vulnerable upstream \
          artifact. pnpm <=10 installs work unchanged",
         pnpm_trust_policy_preamble(server),
     )
@@ -132,10 +132,10 @@ pub(crate) fn pnpm_trust_legacy_detail(server: &str) -> String {
          lock read by pnpm 1–8, which have no \
          lockfile trust policy: no trust step exists or is needed. Do NOT regenerate the lockfile \
          (deleting it, or re-resolving on a newer pnpm): that silently \
-         discards the redirect and reinstalls the vulnerable upstream \
+         discards the hosted patches and reinstalls the vulnerable upstream \
          artifact. If the project later moves to pnpm >=9, re-run \
          `socket-patch scan --mode hosted` so the regenerated lock is \
-         redirected (and trust-configured) again"
+         switched to hosted (and trust-configured) again"
     )
 }
 
@@ -152,7 +152,7 @@ pub(crate) fn pnpm_trust_workspace_unreadable_detail(server: &str, err: &std::io
          or add `trustLockfile: true` to it yourself so every install \
          accepts the patched artifacts. Do NOT follow pnpm's advice to \
          rebuild the lockfile (`pnpm clean --lockfile`): that silently \
-         discards the redirect and reinstalls the vulnerable upstream \
+         discards the hosted patches and reinstalls the vulnerable upstream \
          artifact. pnpm <=10 installs work unchanged",
         pnpm_trust_policy_preamble(server),
     )
@@ -316,6 +316,38 @@ const NPM_ALLOW_REMOTE_TRADEOFF: &str =
      dependencies. npm <=11 installs work unchanged (npm 11 already defaults to \
      `all`; npm <=10 has no such setting)";
 
+/// The default human form of a `redirect_npm_allow_remote` warning: one
+/// line saying whether the project `.npmrc` now carries `allow-remote=all`
+/// or the user must set it. `detail` is one of the `npm_allow_remote_*`
+/// texts below; `--verbose` and `--json` show it in full.
+pub(crate) fn npm_allow_remote_one_line(detail: &str) -> String {
+    const MORE: &str = "(details: --verbose)";
+    if detail.contains("`allow-remote=all` was written to a new")
+        || detail.contains("`allow-remote=all` was appended to the existing")
+    {
+        format!(
+            "Note: set `allow-remote=all` in .npmrc so npm >=12 installs the hosted \
+             patches; commit it with the lockfile {MORE}."
+        )
+    } else if detail.contains("`allow-remote=all` would be") {
+        format!(
+            "Note: would set `allow-remote=all` in .npmrc so npm >=12 installs the \
+             hosted patches {MORE}."
+        )
+    } else if detail.contains("already sets `allow-remote=all`") {
+        format!(
+            "Note: .npmrc already sets `allow-remote=all`, so npm >=12 installs the \
+             hosted patches; keep it committed {MORE}."
+        )
+    } else {
+        format!(
+            "Warning: npm >=12 refuses the hosted patches until `allow-remote=all` is \
+             set (in .npmrc, or `npm ci --allow-remote=all`); it was not set \
+             automatically {MORE}."
+        )
+    }
+}
+
 /// The policy preamble shared by every `allow-remote` warning variant: what
 /// was repointed, and how npm >= 12 fails without the setting.
 fn npm_allow_remote_preamble(hosts: &[&str]) -> String {
@@ -645,7 +677,7 @@ fn gem_stale_install_warning(
     let list = paths.join(", ");
     let detail = if gem_dir.starts_with(cwd) {
         format!(
-            "{purl} was redirected to the Socket patch registry, but a stale \
+            "{purl} was switched to its hosted patch, but a stale \
              UNPATCHED install is already materialized at {} — `bundle install` \
              reuses the installed gem (and its cached .gem) without refetching, \
              and `--force`/`--redownload` reinstall from the stale cache, so \
@@ -656,7 +688,7 @@ fn gem_stale_install_warning(
         )
     } else {
         format!(
-            "{purl} was redirected to the Socket patch registry, but a stale \
+            "{purl} was switched to its hosted patch, but a stale \
              UNPATCHED install is materialized in the shared gem home at {} — \
              `bundle install` reuses it without refetching, so the vulnerable \
              upstream code stays live. That gem home is shared by every \
@@ -679,7 +711,7 @@ fn gem_stale_cache_warning(purl: &str, cache_path: &Path) -> serde_json::Value {
     serde_json::json!({
         "code": "redirect_gem_stale_install",
         "detail": format!(
-            "{purl} was redirected to the Socket patch registry, but the \
+            "{purl} was switched to its hosted patch, but the \
              project's committed bundler cache still holds an UNPATCHED \
              archive at {} — bundler installs from vendor/cache in preference \
              to fetching, so installs (fresh checkouts included) keep \
@@ -995,7 +1027,7 @@ pub(super) async fn run_redirect(
             } else if code == 0 && !args.common.silent {
                 // Unreachable from scan (it never prompts, so selection
                 // cannot be cancelled); kept for a code-0 selection error.
-                eprintln!("Nothing was redirected.");
+                eprintln!("No changes made.");
             }
             return code;
         }
@@ -1584,7 +1616,7 @@ pub(crate) async fn run_redirect_selected(
                             "code": "redirect_vendored_revert_failed",
                             "detail": format!(
                                 "{purl} is vendored and its vendored state could not be \
-                                 reverted ({}); NOT redirected — run `socket-patch vendor \
+                                 reverted ({}); NOT switched to hosted — run `socket-patch vendor \
                                  --revert` to clean up, then re-run `scan --mode hosted`",
                                 outcome.error.as_deref().unwrap_or("unknown error")
                             ),
@@ -1594,9 +1626,9 @@ pub(crate) async fn run_redirect_selected(
                     takeover_pre_warnings.push(serde_json::json!({
                         "code": "redirect_would_revert_vendored",
                         "detail": format!(
-                            "{purl} is currently vendored; the hosted redirect will \
+                            "{purl} is currently vendored; the hosted wiring will \
                              revert its vendored wiring, ledger entry, and committed \
-                             artifact first, then redirect (mode takeover)"
+                             artifact first, then switch to hosted (mode takeover)"
                         ),
                     }));
                     dry_run_takeover.push((purl.clone(), uuid.clone()));
@@ -1616,7 +1648,7 @@ pub(crate) async fn run_redirect_selected(
                         "code": "redirect_vendored_revert_failed",
                         "detail": format!(
                             "{purl} is vendored and its vendored state could not be \
-                             reverted ({}); NOT redirected — run `socket-patch vendor \
+                             reverted ({}); NOT switched to hosted — run `socket-patch vendor \
                              --revert` to clean up, then re-run `scan --mode hosted`",
                             outcome.error.as_deref().unwrap_or("unknown error")
                         ),
@@ -1643,7 +1675,7 @@ pub(crate) async fn run_redirect_selected(
                         "code": "redirect_vendored_revert_failed",
                         "detail": format!(
                             "{purl}: vendored wiring reverted but the vendored ledger \
-                             could not be updated ({e}); NOT redirected — fix \
+                             could not be updated ({e}); NOT switched to hosted — fix \
                              .socket/vendor/state.json and re-run"
                         ),
                     }));
@@ -1653,7 +1685,7 @@ pub(crate) async fn run_redirect_selected(
                     "code": "redirect_takeover_reverted_vendored",
                     "detail": format!(
                         "{purl} was vendored; reverted its vendored wiring, ledger \
-                         entry, and committed artifact before redirecting (mode \
+                         entry, and committed artifact before switching to hosted (mode \
                          takeover: the project is now fully hosted for this package)"
                     ),
                 }));
@@ -2087,7 +2119,7 @@ pub(crate) async fn run_redirect_selected(
             "detail":
                 "pnpm-lock.yaml was edited outside `rush update`; if \
                  preventManualShrinkwrapChanges is enabled, `rush install` fails until \
-                 `rush update` refreshes repo-state.json (the redirect survives `rush \
+                 `rush update` refreshes repo-state.json (the hosted wiring survives `rush \
                  update`)",
         }));
     }
@@ -2680,8 +2712,8 @@ pub(crate) async fn run_redirect_selected(
                     record_warnings.push(serde_json::json!({
                         "code": "record_fetch_failed",
                         "detail": format!(
-                            "{purl} redirected, but its patch record could not be fetched; \
-                             this run's VEX attestation omits it (`socket-patch vex` \
+                            "{purl} was switched to hosted, but its patch record could not be \
+                             fetched; this run's VEX attestation omits it (`socket-patch vex` \
                              fetches it again once the API answers)"
                         ),
                     }));
@@ -3032,7 +3064,13 @@ pub(crate) async fn run_redirect_selected(
                 eprintln!("{line}");
             }
             for (code, detail) in &human_warnings {
-                let detail = if *code == "redirect_pnpm_trust_lockfile" && pnpm_rerun_only {
+                let detail = if *code == "redirect_npm_allow_remote" && !common.verbose {
+                    // One line by default; the full policy text (the
+                    // tradeoff, every manual recovery) is in `--json` and
+                    // `--verbose`.
+                    eprintln!("{}", npm_allow_remote_one_line(detail));
+                    continue;
+                } else if *code == "redirect_pnpm_trust_lockfile" && pnpm_rerun_only {
                     pnpm_trust_rerun_reminder()
                 } else {
                     detail
@@ -3041,7 +3079,7 @@ pub(crate) async fn run_redirect_selected(
             }
             if let Some(statements) = vex_statements {
                 eprintln!(
-                    "Wrote OpenVEX document with {} to {} (redirected patches are attested \
+                    "Wrote OpenVEX document with {} to {} (hosted patches are attested \
                      from their patch records, not hash-verified — their bytes are fetched at install \
                      time; run `socket-patch vex` after installing to verify against the \
                      installed tree).",
@@ -3054,7 +3092,7 @@ pub(crate) async fn run_redirect_selected(
             } else if vex.vex.is_some() && common.dry_run {
                 eprintln!(
                     "{}",
-                    crate::commands::vex::format_vex_dry_run_skip("redirected")
+                    crate::commands::vex::format_vex_dry_run_skip("rewritten")
                 );
             }
             if !common.dry_run {
@@ -3189,13 +3227,13 @@ fn split_sentences(text: &str) -> Vec<String> {
     out
 }
 
-/// One human warning: `Warning (<code>): <detail>`. The pnpm trustLockfile
-/// guidance is a paragraph of separate instructions, so it renders as a
+/// One human warning: `Warning: <detail>` (the code is JSON-only). The pnpm
+/// trustLockfile guidance is a paragraph of separate instructions, so it renders as a
 /// headline plus one `  - ` bullet per sentence. With `width` (stderr is a
 /// terminal) every line is word-wrapped; without it (a pipe or a CI log)
 /// each sentence stays on one line so the text remains greppable.
 fn format_warning(code: &str, detail: &str, width: Option<usize>) -> String {
-    let prefix = format!("Warning ({code}): ");
+    let prefix = "Warning: ";
     let detail = sentence_case(detail.trim());
     let (headline, bullets) = if code == "redirect_pnpm_trust_lockfile" {
         let mut sentences = split_sentences(&detail).into_iter();
@@ -3207,7 +3245,7 @@ fn format_warning(code: &str, detail: &str, width: Option<usize>) -> String {
     let mut lines: Vec<String> = Vec::new();
     match width {
         Some(w) => {
-            lines.extend(wrap_words(&headline, w, &prefix, "  "));
+            lines.extend(wrap_words(&headline, w, prefix, "  "));
             for b in &bullets {
                 lines.extend(wrap_words(b, w, "  - ", "    "));
             }
@@ -3225,9 +3263,9 @@ fn format_warning(code: &str, detail: &str, width: Option<usize>) -> String {
 /// lock was redirected and trust configured by an earlier run, whose
 /// output carried the full text; `--json` still carries it every time).
 fn pnpm_trust_rerun_reminder() -> &'static str {
-    "pnpm-lock.yaml is already redirected and pnpm-workspace.yaml already sets \
+    "pnpm-lock.yaml already uses hosted patches and pnpm-workspace.yaml already sets \
      `trustLockfile: true`; keep both committed, and never rebuild the lockfile \
-     (`pnpm clean --lockfile`), which discards the redirect"
+     (`pnpm clean --lockfile`), which discards the hosted patches"
 }
 
 /// The stdout summary line.
@@ -3240,16 +3278,16 @@ fn format_redirect_summary(redirected: usize, files: usize, dry_run: bool) -> St
     use crate::ui::plural;
     if redirected > 0 && files == 0 {
         return format!(
-            "{} already redirected; nothing to rewrite.",
+            "{} already on hosted patches; nothing to rewrite.",
             plural(redirected, "package is", "packages are")
         );
     }
     let pkgs = plural(redirected, "package", "packages");
     let files = plural(files, "file", "files");
     if dry_run {
-        format!("Would redirect {pkgs} and rewrite {files} (--dry-run: nothing was changed).")
+        format!("Would switch {pkgs} to hosted patches and rewrite {files} (--dry-run: nothing was changed).")
     } else {
-        format!("Redirected {pkgs}; rewrote {files}.")
+        format!("Switched {pkgs} to hosted patches; rewrote {files}.")
     }
 }
 
@@ -3307,11 +3345,11 @@ fn format_unredirected(
     let (skip_lead, unpinned_lead) = if nothing_redirected {
         ("  ", "  ")
     } else {
-        ("Skipped ", "Not redirected ")
+        ("Skipped ", "Not hosted ")
     };
     let mut lines = Vec::new();
     if nothing_redirected {
-        lines.push("No patches could be redirected:".to_string());
+        lines.push("No patches could be switched to hosted:".to_string());
     }
     for (purl, reason) in skipped {
         lines.push(format!(
@@ -3321,7 +3359,7 @@ fn format_unredirected(
     }
     for purl in unconfirmed {
         lines.push(format!(
-            "{unpinned_lead}{purl}: no lockfile entry pinning it could be redirected{see}"
+            "{unpinned_lead}{purl}: no lockfile entry pinning it could be rewritten{see}"
         ));
     }
     lines
@@ -3378,20 +3416,21 @@ fn format_next_steps(files: &[String], vendored_removed: bool) -> Vec<String> {
         .iter()
         .any(|f| f == "package-lock.json" || f == "npm-shrinkwrap.json");
     let hint = if npm { " (e.g. `npm ci`)" } else { "" };
-    let mut steps = vec![
-        format!("Commit {} to keep the redirect.", join_names(&commit, 6)),
-        format!(
-            "Reinstall from the updated lockfile{hint} so the installed packages pick up the \
-             patched artifacts, then run `socket-patch vex` to verify them."
-        ),
-    ];
+    let mut extra = Vec::new();
     if files
         .iter()
         .any(|f| f == socket_patch_core::constants::npm_family::VLT_LOCK)
     {
-        steps.push("vlt: commit vlt-lock.json; CI should run `vlt ci`".to_string());
+        extra.push("vlt: commit vlt-lock.json; CI should run `vlt ci`.".to_string());
     }
-    steps
+    crate::ui::next_steps(
+        &format!("{} to keep the hosted patches", join_names(&commit, 6)),
+        &format!(
+            "Reinstall from the updated lockfile{hint} so the installed packages pick up the \
+             patched artifacts"
+        ),
+        &extra,
+    )
 }
 
 /// Transient-frame boxed constructor for [`run_redirect_selected`] — the
@@ -4716,27 +4755,27 @@ mod tests {
     fn redirect_summary_singular_plural_and_dry_run() {
         assert_eq!(
             format_redirect_summary(1, 1, false),
-            "Redirected 1 package; rewrote 1 file."
+            "Switched 1 package to hosted patches; rewrote 1 file."
         );
         assert_eq!(
             format_redirect_summary(2, 3, false),
-            "Redirected 2 packages; rewrote 3 files."
+            "Switched 2 packages to hosted patches; rewrote 3 files."
         );
         assert_eq!(
             format_redirect_summary(0, 0, false),
-            "Redirected 0 packages; rewrote 0 files."
+            "Switched 0 packages to hosted patches; rewrote 0 files."
         );
         assert_eq!(
             format_redirect_summary(1, 1, true),
-            "Would redirect 1 package and rewrite 1 file (--dry-run: nothing was changed)."
+            "Would switch 1 package to hosted patches and rewrite 1 file (--dry-run: nothing was changed)."
         );
         assert_eq!(
             format_redirect_summary(0, 0, true),
-            "Would redirect 0 packages and rewrite 0 files (--dry-run: nothing was changed)."
+            "Would switch 0 packages to hosted patches and rewrite 0 files (--dry-run: nothing was changed)."
         );
         assert_eq!(
             format_redirect_summary(2, 5, true),
-            "Would redirect 2 packages and rewrite 5 files (--dry-run: nothing was changed)."
+            "Would switch 2 packages to hosted patches and rewrite 5 files (--dry-run: nothing was changed)."
         );
     }
 
@@ -4747,11 +4786,11 @@ mod tests {
         for dry in [false, true] {
             assert_eq!(
                 format_redirect_summary(1, 0, dry),
-                "1 package is already redirected; nothing to rewrite."
+                "1 package is already on hosted patches; nothing to rewrite."
             );
             assert_eq!(
                 format_redirect_summary(3, 0, dry),
-                "3 packages are already redirected; nothing to rewrite."
+                "3 packages are already on hosted patches; nothing to rewrite."
             );
         }
     }
@@ -4817,31 +4856,31 @@ mod tests {
                 "Skipped pkg:npm/lodash@4.17.20: not entitled to this patch (paid plan or no \
                  org access)"
                     .to_string(),
-                "Not redirected pkg:npm/minimist@1.2.5: no lockfile entry pinning it could be \
-                 redirected (see the warning below)"
+                "Not hosted pkg:npm/minimist@1.2.5: no lockfile entry pinning it could be \
+                 rewritten (see the warning below)"
                     .to_string(),
             ]
         );
         assert_eq!(
             format_unredirected(&[], &unconfirmed, false, 2),
             vec![
-                "Not redirected pkg:npm/minimist@1.2.5: no lockfile entry pinning it could be \
-                 redirected (see the warnings below)"
+                "Not hosted pkg:npm/minimist@1.2.5: no lockfile entry pinning it could be \
+                 rewritten (see the warnings below)"
                     .to_string(),
             ]
         );
         assert_eq!(
             format_unredirected(&[], &unconfirmed, true, 0),
             vec![
-                "No patches could be redirected:".to_string(),
-                "  pkg:npm/minimist@1.2.5: no lockfile entry pinning it could be redirected"
+                "No patches could be switched to hosted:".to_string(),
+                "  pkg:npm/minimist@1.2.5: no lockfile entry pinning it could be rewritten"
                     .to_string(),
             ]
         );
         assert_eq!(
             format_unredirected(&skipped, &[], true, 0),
             vec![
-                "No patches could be redirected:".to_string(),
+                "No patches could be switched to hosted:".to_string(),
                 "  pkg:npm/lodash@4.17.20: not entitled to this patch (paid plan or no org \
                  access)"
                     .to_string(),
@@ -4873,8 +4912,8 @@ mod tests {
             "Failed to write x: y"
         );
         assert_eq!(
-            sentence_case("the redirect ledger ./a is malformed"),
-            "The redirect ledger ./a is malformed"
+            sentence_case("the hosted ledger ./a is malformed"),
+            "The hosted ledger ./a is malformed"
         );
         assert_eq!(sentence_case("pnpm >=11 rejects"), "pnpm >=11 rejects");
         for tool in ["vlt", "vlx", "vlr"] {
@@ -4917,7 +4956,7 @@ mod tests {
         // Counts characters, not bytes.
         let lines = wrap_words("ééé ééé ééé", 8, "", "");
         assert_eq!(lines, vec!["ééé ééé", "ééé"]);
-        for line in wrap_words(&"word ".repeat(50), 30, "Warning (x): ", "  ") {
+        for line in wrap_words(&"word ".repeat(50), 30, "Warning: ", "  ") {
             assert!(line.chars().count() <= 30, "{line}");
         }
     }
@@ -4979,7 +5018,7 @@ mod tests {
                 "no package-lock.json present",
                 None
             ),
-            "Warning (redirect_npm_no_lockfile): No package-lock.json present"
+            "Warning: No package-lock.json present"
         );
         let long = "word ".repeat(40);
         let wrapped = format_warning("c", &long, Some(40));
@@ -4988,7 +5027,7 @@ mod tests {
             wrapped.lines().all(|l| l.chars().count() <= 40),
             "{wrapped}"
         );
-        assert!(wrapped.starts_with("Warning (c): Word word"), "{wrapped}");
+        assert!(wrapped.starts_with("Warning: Word word"), "{wrapped}");
         assert!(
             wrapped.lines().skip(1).all(|l| l.starts_with("  ")),
             "{wrapped}"
@@ -5001,7 +5040,7 @@ mod tests {
                       Do NOT rebuild the lockfile. Run `socket-patch vex` after installation.";
         assert_eq!(
             format_warning("redirect_pnpm_trust_lockfile", detail, None),
-            "Warning (redirect_pnpm_trust_lockfile): pnpm-lock.yaml was repointed at the \
+            "Warning: pnpm-lock.yaml was repointed at the \
              server; so it goes.\n  - Note: a tradeoff.\n  - Do NOT rebuild the lockfile.\n  \
              - Run `socket-patch vex` after installation."
         );
@@ -5011,15 +5050,15 @@ mod tests {
         }
         assert_eq!(
             wrapped,
-            "Warning (redirect_pnpm_trust_lockfile): pnpm-lock.yaml was\n  \
-             repointed at the server; so it goes.\n  - Note: a tradeoff.\n  - Do NOT \
+            "Warning: pnpm-lock.yaml was repointed at the server; so it\n  \
+             goes.\n  - Note: a tradeoff.\n  - Do NOT \
              rebuild the lockfile.\n  - Run `socket-patch vex` after installation."
         );
         // Continuation lines of a long bullet are indented under its text.
         let bullet = "Head. Do NOT follow the advice to rebuild the lockfile, which discards it.";
         assert_eq!(
             format_warning("redirect_pnpm_trust_lockfile", bullet, Some(40)),
-            "Warning (redirect_pnpm_trust_lockfile): Head.\n  - Do NOT follow the advice to \
+            "Warning: Head.\n  - Do NOT follow the advice to \
              rebuild\n    the lockfile, which discards it."
         );
     }
@@ -5060,9 +5099,11 @@ mod tests {
         assert_eq!(
             format_next_steps(&["package-lock.json".to_string()], false),
             vec![
-                "Commit package-lock.json to keep the redirect.".to_string(),
-                "Reinstall from the updated lockfile (e.g. `npm ci`) so the installed packages \
-                 pick up the patched artifacts, then run `socket-patch vex` to verify them."
+                "Next steps:".to_string(),
+                "  1. Commit package-lock.json to keep the hosted patches.".to_string(),
+                "  2. Reinstall from the updated lockfile (e.g. `npm ci`) so the installed \
+                 packages pick up the patched artifacts, then run `socket-patch vex` to verify \
+                 the installed patches."
                     .to_string(),
             ]
         );
@@ -5074,10 +5115,10 @@ mod tests {
             false,
         );
         assert_eq!(
-            steps[0],
-            "Commit pnpm-lock.yaml and pnpm-workspace.yaml to keep the redirect."
+            steps[1],
+            "  1. Commit pnpm-lock.yaml and pnpm-workspace.yaml to keep the hosted patches."
         );
-        assert!(!steps[1].contains("npm ci"), "{}", steps[1]);
+        assert!(!steps[2].contains("npm ci"), "{}", steps[2]);
     }
 
     #[test]
@@ -5085,21 +5126,21 @@ mod tests {
         let steps = format_next_steps(&["vlt-lock.json".to_string()], false);
         assert_eq!(
             steps.last().map(String::as_str),
-            Some("vlt: commit vlt-lock.json; CI should run `vlt ci`")
+            Some("  3. vlt: commit vlt-lock.json; CI should run `vlt ci`.")
         );
         assert!(
             !format_next_steps(&["package-lock.json".to_string()], false)
                 .iter()
-                .any(|s| s.starts_with("vlt:"))
+                .any(|s| s.contains("vlt:"))
         );
     }
 
     #[test]
     fn next_steps_after_a_takeover_name_the_removed_vendored_state() {
         assert_eq!(
-            format_next_steps(&["pnpm-lock.yaml".to_string()], true)[0],
-            "Commit .socket/vendor/ (the removed vendored ledger entries and artifacts) and \
-             pnpm-lock.yaml to keep the redirect."
+            format_next_steps(&["pnpm-lock.yaml".to_string()], true)[1],
+            "  1. Commit .socket/vendor/ (the removed vendored ledger entries and artifacts) and \
+             pnpm-lock.yaml to keep the hosted patches."
         );
     }
 
@@ -5238,10 +5279,29 @@ mod tests {
                 .contains("symbolic link"));
         }
     }
+
+    #[test]
+    fn npm_allow_remote_one_line_covers_every_variant() {
+        use super::npm_allow_remote_one_line;
+        let hosts = ["patch.socket.dev"];
+        let cases = [
+            (npm_allow_remote_configured_detail(&hosts, true, false), "Note: set"),
+            (npm_allow_remote_configured_detail(&hosts, false, false), "Note: set"),
+            (npm_allow_remote_configured_detail(&hosts, true, true), "Note: would set"),
+            (npm_allow_remote_already_detail(&hosts), "Note: .npmrc already"),
+            (npm_allow_remote_user_set_detail(&hosts, "none"), "Warning: npm >=12"),
+            (npm_allow_remote_env_set_detail(&hosts, "npm_config_allow_remote", "none"), "Warning: npm >=12"),
+            (npm_allow_remote_manual_detail(&hosts), "Warning: npm >=12"),
+            (npm_allow_remote_unreadable_detail(&hosts, "is a symlink"), "Warning: npm >=12"),
+        ];
+        for (detail, start) in cases {
+            let line = npm_allow_remote_one_line(&detail);
+            assert!(line.starts_with(start), "{line}");
+            assert!(!line.contains('\n') && line.ends_with("(details: --verbose)."), "{line}");
+        }
+    }
 }
 
-/// The one-pass multi-needle confirmation probe answers exactly what the
-/// per-candidate `any()` oracle answers.
 #[cfg(test)]
 mod probe_equivalence_tests {
     use super::{candidate_presence_needles, candidate_present_oracle, npm_lock_url_needles};
@@ -5406,4 +5466,5 @@ mod probe_equivalence_tests {
             }
         }
     }
+
 }
diff --git a/crates/socket-patch-cli/src/commands/scan/hosted/python.rs b/crates/socket-patch-cli/src/commands/scan/hosted/python.rs
index c43f7690..dd96fdce 100644
--- a/crates/socket-patch-cli/src/commands/scan/hosted/python.rs
+++ b/crates/socket-patch-cli/src/commands/scan/hosted/python.rs
@@ -132,7 +132,7 @@ pub(super) async fn stale_install_warnings(
             out.warnings.push(serde_json::json!({
                 "code": "redirect_pypi_stale_install",
                 "detail": format!(
-                    "{purl} was redirected to a hosted patch, but installed files in {} \
+                    "{purl} was switched to a hosted patch, but installed files in {} \
                      still differ from the patched hashes. {remedy} The installed files \
                      were left unchanged.",
                     site.display()
diff --git a/crates/socket-patch-cli/src/commands/scan/hosted/vlt.rs b/crates/socket-patch-cli/src/commands/scan/hosted/vlt.rs
index d819af6b..9766f156 100644
--- a/crates/socket-patch-cli/src/commands/scan/hosted/vlt.rs
+++ b/crates/socket-patch-cli/src/commands/scan/hosted/vlt.rs
@@ -325,7 +325,7 @@ fn with_optional_kept(mut detail: String, optional_left: usize, held: &str) -> S
 }
 
 const VLT_UPDATE_NOTE: &str =
-    " Note: `vlt update` re-resolves from the registry and drops these redirects.";
+    " Note: `vlt update` re-resolves from the registry and drops these hosted patches.";
 
 fn reinstall_detail(tally: &HealTally) -> String {
     let held = "unpatched copies of optional dependencies";
diff --git a/crates/socket-patch-cli/src/commands/scan/mod.rs b/crates/socket-patch-cli/src/commands/scan/mod.rs
index adaa869c..8a98c85d 100644
--- a/crates/socket-patch-cli/src/commands/scan/mod.rs
+++ b/crates/socket-patch-cli/src/commands/scan/mod.rs
@@ -286,9 +286,9 @@ pub struct ScanArgs {
     #[arg(long = "batch-size", env = "SOCKET_BATCH_SIZE")]
     pub batch_size: Option<usize>,
 
-    /// Deprecated spelling of `--mode agent`: download the selected patches
-    /// and apply them in place
-    #[arg(long, default_value_t = false)]
+    // Hidden, deprecated spelling of `--mode agent`: download the selected
+    // patches and apply them in place.
+    #[arg(long, default_value_t = false, hide = true)]
     pub apply: bool,
 
     /// Garbage-collect after the scan: prune manifest entries for
@@ -306,13 +306,10 @@ pub struct ScanArgs {
     #[arg(long, default_value_t = false)]
     pub sync: bool,
 
-    /// Deprecated spelling of `--mode vendored`: vendor every patched
-    /// dependency the scan selects into the committable `.socket/vendor/`
-    /// tree instead of applying patches in place. The patch records live in
-    /// the vendor ledger (`.socket/vendor/state.json`), never in
-    /// `.socket/manifest.json`; a package vendored at an older patch is
-    /// re-vendored. Combine with `--prune` to garbage-collect stale state
-    #[arg(long, default_value_t = false, conflicts_with_all = ["apply", "sync"])]
+    // Hidden, deprecated spelling of `--mode vendored`: vendor every
+    // patched dependency the scan selects into the committable
+    // `.socket/vendor/` tree instead of applying patches in place.
+    #[arg(long, default_value_t = false, hide = true, conflicts_with_all = ["apply", "sync"])]
     pub vendor: bool,
 
     /// Accepted for compatibility; has no effect
@@ -330,10 +327,10 @@ pub struct ScanArgs {
     pub redirect: bool,
 
     /// How discovered patches are consumed [default: hosted]. A `--prune`
-    /// or `--global` scan with no mode only reports. `--vendor` and
-    /// `--apply` are older spellings of `--mode vendored` and `--mode agent`
-    // Each mode is equivalent to one boolean flag (hosted == the hidden
-    // `--redirect`, vendored == `--vendor`, agent == `--apply`/`--sync`).
+    /// or `--global` scan with no mode only reports
+    // The hidden `--vendor` and `--apply` are older spellings of
+    // `--mode vendored` and `--mode agent`. Each mode is equivalent to one
+    // boolean flag (hosted == the hidden `--redirect`, vendored == `--vendor`, agent == `--apply`/`--sync`).
     // Combining `--mode` with a boolean from a DIFFERENT mode is rejected in
     // `resolve_mode_flags`; the same mode spelled both ways is accepted.
     #[arg(long = "mode", value_enum)]
@@ -612,7 +609,7 @@ async fn discover_selected(
 /// `common` for `select_patches`: scan never prompts, so it always takes
 /// the top-ranked patch, and with `json` off it never gets
 /// `selection_required` (scan has no "re-run with the chosen UUID" path).
-fn selection_args(common: &GlobalArgs) -> GlobalArgs {
+pub(crate) fn selection_args(common: &GlobalArgs) -> GlobalArgs {
     GlobalArgs {
         json: false,
         yes: true,
@@ -985,7 +982,7 @@ pub(super) fn mode_takeover_detail(superseded: &[String]) -> String {
     // package including the ones still live in the lockfile — `remove
     // <purl>` is the per-package equivalent.
     format!(
-        "hosted redirect superseded the vendored ledger for: {list}. \
+        "hosted wiring superseded the vendored ledger for: {list}. \
          `.socket/vendor/state.json` still claims these package(s) and their \
          committed artifacts under `.socket/vendor/` are now orphaned — the \
          lockfile points at the hosted patch server, not the vendored files. \
@@ -1015,7 +1012,7 @@ pub(super) fn push_run_warning(
     detail: String,
 ) {
     if !common.silent && !common.json {
-        eprintln!("Warning ({code}): {detail}");
+        eprintln!("Warning: {detail}");
     }
     env.warnings.push(crate::json_envelope::RunWarning {
         code: code.to_string(),
@@ -1138,7 +1135,7 @@ pub(super) async fn hosted_wiring_retained_purls(
 pub(super) fn hosted_wiring_retained_detail(retained: &[String]) -> String {
     let list = retained.join(", ");
     format!(
-        "agent-mode scan left the hosted redirect wiring live for: {list}. \
+        "agent-mode scan left the hosted wiring live for: {list}. \
          The lockfile still resolves these package(s) to the hosted patch \
          server — an agent run patches installed files in place but does \
          NOT unwind hosted lockfile wiring, so installs keep fetching \
@@ -1375,7 +1372,7 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
     // Hosted mode runs no GC: say so once up front on the human path. The
     // `--json` path carries it in `redirect.warnings[]`.
     if hosted && prune && !args.common.json && !args.common.silent {
-        eprintln!("Warning ({REDIRECT_PRUNE_IGNORED}): {REDIRECT_PRUNE_IGNORED_DETAIL}");
+        eprintln!("Warning: {REDIRECT_PRUNE_IGNORED_DETAIL}");
     }
 
     // Resolved up-front (rather than at the GC site) because the embedded
@@ -1555,8 +1552,8 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
     if package_count == 0 {
         status.finish();
         if human {
-            for (code, detail) in &layout_refusals {
-                eprintln!("Warning ({code}): {detail}");
+            for (_, detail) in &layout_refusals {
+                eprintln!("Warning: {detail}");
             }
             // Hosted mode already printed its own prune-ignored warning.
             if prune && !hosted {
@@ -1680,8 +1677,8 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         if !lockfile_only.purls.is_empty() {
             eprintln!("{}", render::lockfile_only_note(lockfile_only.purls.len()));
         }
-        for (code, detail) in &layout_refusals {
-            eprintln!("Warning ({code}): {detail}");
+        for (_, detail) in &layout_refusals {
+            eprintln!("Warning: {detail}");
         }
     }
 
@@ -2098,14 +2095,14 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
             if !vendored_skip_purls.is_empty() {
                 let detail = vendored_ownership_retained_detail(&vendored_skip_purls);
                 if !args.common.silent {
-                    eprintln!("Warning ({VENDORED_OWNERSHIP_RETAINED}): {detail}");
+                    eprintln!("Warning: {detail}");
                 }
                 push_scan_json_warning(&mut result, VENDORED_OWNERSHIP_RETAINED, &detail);
             }
             if !hosted_retained.is_empty() {
                 let detail = hosted_wiring_retained_detail(&hosted_retained);
                 if !args.common.silent {
-                    eprintln!("Warning ({HOSTED_WIRING_RETAINED}): {detail}");
+                    eprintln!("Warning: {detail}");
                 }
                 push_scan_json_warning(&mut result, HOSTED_WIRING_RETAINED, &detail);
             }
@@ -2308,9 +2305,7 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
                     "{}",
                     ui::paint(&render::paid_extra_line(paid_patches), "33", use_color),
                 );
-                println!(
-                    "\nUpgrade to Socket's paid plan to access all patches: https://socket.dev/pricing"
-                );
+                println!("\n{}", ui::PAID_UPGRADE);
             }
         }
 
@@ -2336,7 +2331,7 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
 
     if downloadable_count == 0 {
         if !silent {
-            println!("\nNo downloadable patches (paid subscription required).");
+            println!("\nNo downloadable patches: every patch found requires a paid Socket plan.");
         }
         return finish_human(0).await;
     }
@@ -2630,7 +2625,7 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
             hosted_wiring_retained_purls(&args.common, redirect_state.as_ref(), &all_purls).await;
         if !hosted_retained.is_empty() {
             eprintln!(
-                "Warning ({HOSTED_WIRING_RETAINED}): {}",
+                "Warning: {}",
                 hosted_wiring_retained_detail(&hosted_retained)
             );
         }
diff --git a/crates/socket-patch-cli/src/commands/scan/render.rs b/crates/socket-patch-cli/src/commands/scan/render.rs
index 34adcadc..12bfa5e8 100644
--- a/crates/socket-patch-cli/src/commands/scan/render.rs
+++ b/crates/socket-patch-cli/src/commands/scan/render.rs
@@ -150,7 +150,7 @@ pub(super) fn summary_line(packages: usize, patches: usize, all_accessible: bool
 pub(super) fn paid_extra_line(paid: usize) -> String {
     let verb = if paid == 1 { "is" } else { "are" };
     format!(
-        "         + {} {verb} available with a paid subscription",
+        "         + {} {verb} available with a paid Socket plan",
         plural(paid, "additional patch", "additional patches")
     )
 }
@@ -649,11 +649,11 @@ mod tests {
     fn paid_extra_line_agrees_in_number() {
         assert_eq!(
             paid_extra_line(1),
-            "         + 1 additional patch is available with a paid subscription"
+            "         + 1 additional patch is available with a paid Socket plan"
         );
         assert_eq!(
             paid_extra_line(3),
-            "         + 3 additional patches are available with a paid subscription"
+            "         + 3 additional patches are available with a paid Socket plan"
         );
     }
 
diff --git a/crates/socket-patch-cli/src/commands/setup.rs b/crates/socket-patch-cli/src/commands/setup.rs
deleted file mode 100644
index 63106bdc..00000000
--- a/crates/socket-patch-cli/src/commands/setup.rs
+++ /dev/null
@@ -1,3018 +0,0 @@
-use clap::Args;
-use socket_patch_core::crawlers::python_crawler::is_python_project;
-use socket_patch_core::crawlers::Ecosystem;
-use socket_patch_core::manifest::operations::{read_manifest, write_manifest};
-use socket_patch_core::manifest::schema::{PatchManifest, SetupConfig};
-use socket_patch_core::package_json::detect::{is_setup_configured_str, PackageManager};
-use socket_patch_core::package_json::find::{
-    detect_package_manager, find_package_json_files, legacy_vlt_lock, LegacyVltLock,
-    PackageJsonFindResult, PackageJsonLocation, WorkspaceType,
-};
-use socket_patch_core::package_json::update::{
-    remove_package_json, update_package_json, RemoveResult, RemoveStatus, UpdateResult,
-    UpdateStatus,
-};
-use socket_patch_core::setup::composer::{self, ComposerSetupStatus};
-use socket_patch_core::setup::gem::{self, GemSetupStatus};
-use socket_patch_core::setup::pypi::detect::{
-    deps_contain_hook, detect_python_pm, PythonPackageManager,
-};
-use socket_patch_core::setup::pypi::edit::{
-    add_hook_dependency, pyproject_contains_hook, remove_hook_dependency, ManifestKind,
-    PthEditResult, PthStatus,
-};
-use socket_patch_core::telemetry::track_patch_setup;
-use socket_patch_core::utils::process::{command_for, resolve_tool};
-use socket_patch_core::vex::applied_patches_with_vendor;
-use std::io;
-use std::path::{Path, PathBuf};
-use std::process::Stdio;
-use std::time::Duration;
-
-use crate::args::{apply_env_toggles, GlobalArgs};
-use crate::ecosystem_dispatch::find_manifest_package_paths;
-use crate::ui::plural;
-
-/// Stringify the detected npm-family manager for telemetry.
-fn manager_name(pm: PackageManager) -> &'static str {
-    match pm {
-        PackageManager::Npm => "npm",
-        PackageManager::Pnpm => "pnpm",
-        PackageManager::Vlt => "vlt",
-    }
-}
-
-const VLT_ROOT_SCRIPTS_NOT_RUN: &str = "vlt_root_scripts_not_run";
-const VLT_ROOT_SCRIPTS_REMEDY: &str = "vlt before 1.0.0-rc.13 does not run the root postinstall \
-                                       hook; upgrade vlt or run `socket-patch apply` after `vlt ci`";
-/// The first vlt release that runs a root `postinstall` without an
-/// `install` script.
-const VLT_ROOT_SCRIPTS_FLOOR: &str = "1.0.0-rc.13";
-/// The first vlt release that writes `lockfileVersion` 1 and refuses a v0
-/// lock.
-const VLT_LOCK_V1_FLOOR: &str = "1.0.0-rc.15";
-const VLT_VERSION_TIMEOUT: Duration = Duration::from_secs(5);
-
-/// What `vlt --version` said, when a `vlt` resolved on PATH and exited 0
-/// within [`VLT_VERSION_TIMEOUT`].
-#[derive(Debug, Clone, PartialEq)]
-enum VltVersionProbe {
-    Reported(String),
-    Unavailable,
-}
-
-async fn probe_vlt_version(cwd: &Path) -> VltVersionProbe {
-    let Some(program) = resolve_tool("vlt") else {
-        return VltVersionProbe::Unavailable;
-    };
-    let mut cmd = tokio::process::Command::from(command_for(&program));
-    cmd.arg("--version")
-        .env("VLT_TELEMETRY", "0")
-        .current_dir(cwd)
-        .stdin(Stdio::null())
-        .kill_on_drop(true);
-    match tokio::time::timeout(VLT_VERSION_TIMEOUT, cmd.output()).await {
-        Ok(Ok(out)) if out.status.success() => {
-            VltVersionProbe::Reported(String::from_utf8_lossy(&out.stdout).trim().to_string())
-        }
-        _ => VltVersionProbe::Unavailable,
-    }
-}
-
-/// The `vlt_root_scripts_not_run` detail, if any. A reported version
-/// below the floor is definite and an unparseable one never warns. Else a
-/// lock only an old vlt writes makes the warning a "may", unless the
-/// reported vlt writes that lock itself (rc.13 and rc.14 write v0).
-fn vlt_root_scripts_advisory(
-    probe: &VltVersionProbe,
-    lock: Option<LegacyVltLock>,
-) -> Option<String> {
-    if let VltVersionProbe::Reported(raw) = probe {
-        let floor = semver::Version::parse(VLT_ROOT_SCRIPTS_FLOOR).ok()?;
-        let lock_v1_floor = semver::Version::parse(VLT_LOCK_V1_FLOOR).ok()?;
-        let version = semver::Version::parse(raw).ok()?;
-        if version < floor {
-            return Some(format!(
-                "{VLT_ROOT_SCRIPTS_REMEDY} (`vlt --version` reports {raw})"
-            ));
-        }
-        if lock == Some(LegacyVltLock::VersionZero) && version < lock_v1_floor {
-            return None;
-        }
-    }
-    lock.map(|lock| {
-        let version = match lock {
-            LegacyVltLock::NoVersion => "has no lockfileVersion",
-            LegacyVltLock::VersionZero => "has lockfileVersion 0",
-        };
-        format!(
-            "{VLT_ROOT_SCRIPTS_REMEDY} (vlt-lock.json {version}, so this project may be \
-             installed by such a vlt)"
-        )
-    })
-}
-
-/// The run's `(code, detail)` advisories for a vlt project `setup` wires.
-async fn vlt_setup_advisories(cwd: &Path) -> Vec<(&'static str, String)> {
-    let probe = probe_vlt_version(cwd).await;
-    let lock = legacy_vlt_lock(cwd).await;
-    vlt_root_scripts_advisory(&probe, lock)
-        .map(|detail| (VLT_ROOT_SCRIPTS_NOT_RUN, detail))
-        .into_iter()
-        .collect()
-}
-
-/// `Warning (<code>): <detail>` on stderr in human mode; `--json` carries
-/// them in the envelope's `warnings` and `--silent` mutes them.
-fn print_advisories(common: &GlobalArgs, advisories: &[(&str, String)]) {
-    if common.json || common.silent {
-        return;
-    }
-    for (code, detail) in advisories {
-        eprintln!("Warning ({code}): {detail}");
-    }
-}
-
-/// Compose the `+`-joined telemetry manager tag across the ecosystems in scope
-/// (e.g. `npm+pypi+gem`), or `none`.
-fn telemetry_manager_str(
-    npm: bool,
-    py: bool,
-    gem: bool,
-    composer: bool,
-    npm_pm: PackageManager,
-) -> String {
-    let mut parts: Vec<&str> = Vec::new();
-    if npm {
-        parts.push(manager_name(npm_pm));
-    }
-    if py {
-        parts.push("pypi");
-    }
-    if gem {
-        parts.push("gem");
-    }
-    if composer {
-        parts.push("composer");
-    }
-    if parts.is_empty() {
-        "none".to_string()
-    } else {
-        parts.join("+")
-    }
-}
-
-#[derive(Args)]
-pub struct SetupArgs {
-    /// Verify the project is configured for socket-patch without changing
-    /// anything. Exits non-zero if any manifest still needs setup.
-    #[arg(
-        long = "check",
-        conflicts_with = "remove",
-        default_value_t = false,
-        value_parser = crate::args::parse_bool_flag,
-    )]
-    pub check: bool,
-
-    /// Revert the install hooks that `setup` added: npm `package.json` scripts,
-    /// the Python `socket-patch[hook]` dependency, the gem Bundler plugin
-    /// wiring, and the Composer `composer.json` script.
-    #[arg(
-        long = "remove",
-        default_value_t = false,
-        value_parser = crate::args::parse_bool_flag,
-    )]
-    pub remove: bool,
-
-    /// Workspace-member path(s) to exclude from setup (comma-separated, relative
-    /// to the repo root). The exclusion is persisted in `.socket/manifest.json`
-    /// so `setup --check` and a fresh clone honor it without re-passing the flag.
-    // CLI_CONTRACT property 9.
-    #[arg(long = "exclude", env = "SOCKET_SETUP_EXCLUDE", value_delimiter = ',')]
-    pub exclude: Vec<String>,
-
-    #[command(flatten)]
-    pub common: GlobalArgs,
-}
-
-pub async fn run(args: SetupArgs) -> i32 {
-    apply_env_toggles(&args.common);
-    if args.check {
-        run_check(&args).await
-    } else if args.remove {
-        run_remove(&args).await
-    } else {
-        run_setup(&args).await
-    }
-}
-
-/// Discover the package.json files `setup`/`check`/`remove` should act on,
-/// applying the pnpm "root-only" filtering. Returns an empty vec when none are
-/// found (callers also consider Python before reporting `no_files`).
-async fn discover(args: &SetupArgs, excludes: &[String]) -> Vec<PackageJsonLocation> {
-    discover_members(args, excludes, false).await
-}
-
-/// [`discover`] for `--remove`, which also visits the vlt workspace members
-/// that still carry a hook: releases before vlt workspace support wired
-/// every member.
-async fn discover_for_remove(args: &SetupArgs, excludes: &[String]) -> Vec<PackageJsonLocation> {
-    discover_members(args, excludes, true).await
-}
-
-async fn discover_members(
-    args: &SetupArgs,
-    excludes: &[String],
-    keep_hooked_vlt_members: bool,
-) -> Vec<PackageJsonLocation> {
-    let Some(found) = find_members(args).await else {
-        return Vec::new();
-    };
-    warn_unmatched_excludes(
-        &args.common,
-        &unmatched_excludes(&found, &args.common.cwd, excludes),
-    );
-    let keep = if keep_hooked_vlt_members {
-        hooked_vlt_members(&found).await
-    } else {
-        Vec::new()
-    };
-    select_members(found, &args.common.cwd, excludes, &keep)
-}
-
-/// The vlt workspace members whose package.json carries either hook.
-async fn hooked_vlt_members(found: &PackageJsonFindResult) -> Vec<PathBuf> {
-    if !matches!(found.workspace_type, WorkspaceType::Vlt) {
-        return Vec::new();
-    }
-    let mut hooked = Vec::new();
-    for loc in found.files.iter().filter(|loc| !loc.is_root) {
-        if let Ok(content) = socket_patch_core::utils::fs::read_regular_to_string(&loc.path).await
-        {
-            let status = is_setup_configured_str(&content);
-            if status.postinstall_configured || status.dependencies_configured {
-                hooked.push(loc.path.clone());
-            }
-        }
-    }
-    hooked
-}
-
-/// Walk for package.json files; `None` when npm is out of `--ecosystems` scope.
-async fn find_members(args: &SetupArgs) -> Option<PackageJsonFindResult> {
-    if !eco_in_scope(&args.common, Ecosystem::Npm) {
-        return None;
-    }
-    Some(find_package_json_files(&args.common.cwd).await)
-}
-
-/// The exclude values (normalized) that cover no discovered member. Such a
-/// value is almost always a typo. Checked against every member, before the
-/// pnpm root-only filter.
-fn unmatched_excludes(
-    found: &PackageJsonFindResult,
-    cwd: &Path,
-    excludes: &[String],
-) -> Vec<String> {
-    let mut out: Vec<String> = Vec::new();
-    for e in excludes {
-        let n = normalize_rel_path(e);
-        if n.is_empty() || out.contains(&n) {
-            continue;
-        }
-        let matched = found.files.iter().any(|loc| {
-            !loc.is_root && is_member_excluded(&loc.path, cwd, std::slice::from_ref(&n))
-        });
-        if !matched {
-            out.push(n);
-        }
-    }
-    out
-}
-
-/// Say so (human mode only) rather than silently doing nothing.
-fn warn_unmatched_excludes(common: &GlobalArgs, unmatched: &[String]) {
-    if common.json || common.silent {
-        return;
-    }
-    for e in unmatched {
-        eprintln!("Warning: {}", format_unmatched_exclude(e));
-    }
-}
-
-/// Apply the pnpm/vlt root-only rule (sparing the members in `keep`) and
-/// drop excluded members.
-fn select_members(
-    found: PackageJsonFindResult,
-    cwd: &Path,
-    excludes: &[String],
-    keep: &[PathBuf],
-) -> Vec<PackageJsonLocation> {
-    // For pnpm monorepos, only update root package.json. pnpm runs root
-    // postinstall on `pnpm install`, so workspace-level postinstall scripts are
-    // unnecessary and would fail under pnpm's strict module isolation. vlt
-    // has one root store and runs the root hook once per install, even one
-    // started from a member directory.
-    let files: Vec<PackageJsonLocation> = match found.workspace_type {
-        WorkspaceType::Pnpm | WorkspaceType::Vlt => found
-            .files
-            .into_iter()
-            .filter(|loc| loc.is_root || keep.contains(&loc.path))
-            .collect(),
-        _ => found.files,
-    };
-
-    // Property 9: drop excluded workspace members (the root is never excludable).
-    files
-        .into_iter()
-        .filter(|loc| loc.is_root || !is_member_excluded(&loc.path, cwd, excludes))
-        .collect()
-}
-
-/// Emit the shared `no_files` result and exit code. `counts` carries the
-/// per-command zero-valued summary fields (`setup` → updated/already/errors,
-/// `check` → configured/needs/errors, `remove` → removed/notConfigured/errors)
-/// so the `no_files` envelope keeps the documented shape (CLI_CONTRACT "Setup
-/// command contract") instead of dropping them.
-fn report_no_files(args: &SetupArgs, counts: &[(&str, i64)]) -> i32 {
-    if args.common.json {
-        // `serde_json::Map` preserves insertion order (the crate enables
-        // `preserve_order`), so status → counts → files comes out in that order.
-        let mut map = serde_json::Map::new();
-        map.insert("status".to_string(), serde_json::json!("no_files"));
-        for (key, value) in counts {
-            map.insert((*key).to_string(), serde_json::json!(value));
-        }
-        map.insert("files".to_string(), serde_json::json!([]));
-        println!(
-            "{}",
-            serde_json::to_string_pretty(&serde_json::Value::Object(map))
-                .expect("serializing an in-memory JSON value cannot fail")
-        );
-    } else if !args.common.silent {
-        println!("{}", no_files_message(&args.common));
-    }
-    0
-}
-
-/// The setup-capable ecosystems (their `--ecosystems` tokens) and the name
-/// of the project each one looks for, in discovery order.
-const SETUP_ECOSYSTEMS: &[(Ecosystem, &str)] = &[
-    (Ecosystem::Npm, "package.json"),
-    (Ecosystem::Pypi, "Python"),
-    (Ecosystem::Gem, "Bundler"),
-    (Ecosystem::Composer, "Composer"),
-];
-
-/// The human `no_files` line for this run's `--ecosystems` scope.
-fn no_files_message(common: &GlobalArgs) -> String {
-    let in_scope: Vec<&str> = SETUP_ECOSYSTEMS
-        .iter()
-        .filter(|(eco, _)| eco_in_scope(common, *eco))
-        .map(|(_, label)| *label)
-        .collect();
-    format_no_files(&in_scope, common.ecosystems.as_deref().unwrap_or(&[]))
-}
-
-/// `No package.json, Python, Bundler, or Composer project found`, narrowed
-/// to the in-scope ecosystems. When `--ecosystems` names none that `setup`
-/// can wire, "no project found" would be false (the project may well
-/// exist), so say that setup has no hook for them instead.
-fn format_no_files(in_scope: &[&str], requested: &[String]) -> String {
-    if in_scope.is_empty() {
-        return format!(
-            "Setup has no install hook for: {} (supported: npm, pypi, gem, composer)",
-            requested.join(", ")
-        );
-    }
-    format!("No {} project found", join_or(in_scope))
-}
-
-/// `a`, `a or b`, `a, b, or c`.
-fn join_or(items: &[&str]) -> String {
-    match items {
-        [] => String::new(),
-        [one] => (*one).to_string(),
-        [a, b] => format!("{a} or {b}"),
-        [init @ .., last] => format!("{}, or {last}", init.join(", ")),
-    }
-}
-
-/// The warning for an `--exclude` value that matches no workspace member.
-fn format_unmatched_exclude(value: &str) -> String {
-    format!("--exclude {:?} matched no workspace member", value.trim())
-}
-
-fn pathdiff(path: &str, base: &Path) -> String {
-    let p = Path::new(path);
-    p.strip_prefix(base)
-        .map(|r| r.display().to_string())
-        .unwrap_or_else(|_| path.to_string())
-}
-
-/// Whether an ecosystem is in scope for this run, honoring the global
-/// `--ecosystems` filter (`CLI_CONTRACT.md` → "Setup command contract",
-/// property 2). With no filter (or an empty one) every ecosystem is in scope.
-/// The exact `cli_name` match is the only one that can ever fire — clap's
-/// value parser admits no alias or case variant — and it is the same rule
-/// `partition_purls` applies, so setup's scope never diverges from apply's.
-fn eco_in_scope(common: &GlobalArgs, eco: Ecosystem) -> bool {
-    common.ecosystem_selected(eco)
-}
-
-/// Normalize a workspace-member / exclude path for comparison: trimmed,
-/// forward slashes, no leading `./`, no trailing slash.
-///
-/// The trim is load-bearing for the CSV spellings of `--exclude`: clap splits
-/// `--exclude "packages/a, packages/b"` (and `SOCKET_SETUP_EXCLUDE=a, b`, the
-/// idiomatic CI-YAML form) on the comma only, so the second value arrives with
-/// a leading space. Untrimmed it matches no member — the exclusion silently
-/// does nothing — and the unmatchable spelling is then persisted into
-/// `.socket/manifest.json`, where every later run and every clone inherits it.
-fn normalize_rel_path(p: &str) -> String {
-    let p = p.trim().replace('\\', "/");
-    let p = p.strip_prefix("./").unwrap_or(&p);
-    p.trim_end_matches('/').to_string()
-}
-
-/// Whether a discovered member manifest (`package.json` / `Cargo.toml`) lies in
-/// an excluded workspace-member directory (relative to `cwd`). The repo root
-/// (relative path `""`) is never excludable — `--exclude` targets members.
-/// (CLI_CONTRACT property 9.)
-fn is_member_excluded(manifest_path: &Path, cwd: &Path, excludes: &[String]) -> bool {
-    if excludes.is_empty() {
-        return false;
-    }
-    let dir = match manifest_path.parent() {
-        Some(d) => d,
-        None => return false,
-    };
-    let rel = match dir.strip_prefix(cwd) {
-        Ok(r) => normalize_rel_path(&r.to_string_lossy()),
-        Err(_) => return false, // outside cwd → not an excludable member
-    };
-    if rel.is_empty() {
-        return false;
-    }
-    excludes.iter().any(|e| {
-        let e = normalize_rel_path(e);
-        // An exclusion covers the named directory AND everything below it. The
-        // walk finds nested manifests (`tools/inner/package.json`, and members
-        // of a member that is itself a workspace root), and those lie *inside*
-        // the excluded member — an exact-match-only test wired install hooks
-        // into a subtree the user asked setup to keep out of.
-        !e.is_empty() && (rel == e || rel.starts_with(&format!("{e}/")))
-    })
-}
-
-/// This run's ONE read of `.socket/manifest.json`, shared by the exclude
-/// resolution, the `--exclude` persistence's already-persisted check and
-/// `--check`'s patch-consistency pass.
-async fn read_setup_manifest(common: &GlobalArgs) -> io::Result<Option<PatchManifest>> {
-    read_manifest(&common.resolved_manifest_path()).await
-}
-
-/// The manifest as the read-only consumers see it: absent OR unreadable
-/// contribute nothing (the persistence step is what reports an unreadable
-/// manifest).
-fn manifest_view(existing: &io::Result<Option<PatchManifest>>) -> Option<&PatchManifest> {
-    existing.as_ref().ok().and_then(Option::as_ref)
-}
-
-/// The exclude set in effect for this run: the persisted `setup.exclude` list
-/// from the manifest (empty if no manifest / no setup state) union the
-/// `--exclude` flag values (all normalized). This is what a clone inherits —
-/// a clone with no flag still reads the persisted set.
-fn effective_excludes(manifest: Option<&PatchManifest>, flag: &[String]) -> Vec<String> {
-    let mut set: Vec<String> = manifest
-        .and_then(|m| m.setup.as_ref())
-        .map(|s| s.exclude.iter().map(|e| normalize_rel_path(e)).collect())
-        .unwrap_or_default();
-    for e in flag {
-        let n = normalize_rel_path(e);
-        if !n.is_empty() && !set.contains(&n) {
-            set.push(n);
-        }
-    }
-    set
-}
-
-/// Persist the effective exclude set into `.socket/manifest.json` (creating a
-/// minimal manifest if none exists) so `--check` and a fresh clone honor it
-/// without re-passing `--exclude`. No-op when the set is empty or `existing`
-/// (this run's read) already carries it exactly — no lock, no rewrite, the
-/// manifest stays byte-stable. Called only past the run's mutation gate
-/// (discovery found work, the preview was confirmed or nothing needed
-/// confirming) and never under `--dry-run`, so a no-project directory or an
-/// aborted prompt leaves no `.socket/` behind.
-///
-/// The write is a read-modify-write of the file `apply`/`get`/`remove`/
-/// `rollback` rewrite under `apply.lock`, so it takes the same lock and
-/// re-reads under it; a missing `.socket/` is created by the acquire and
-/// pruned again by the guard's drop if nothing gets written.
-///
-/// Returns a warning string when persistence was SKIPPED (fail-closed: the
-/// lock is held elsewhere, the manifest cannot be read, or the write
-/// failed) — the caller folds it into the run's warnings so it reaches the
-/// human summary AND the `--json` envelope; a `--silent`/`--json`
-/// automation run must not see a fully-successful setup whose excludes
-/// silently evaporate on the next flag-less invocation.
-async fn persist_setup_excludes(
-    common: &GlobalArgs,
-    existing: &io::Result<Option<PatchManifest>>,
-    excludes: &[String],
-) -> Option<String> {
-    if excludes.is_empty() {
-        return None;
-    }
-    let mut merged: Vec<String> = excludes.to_vec();
-    merged.sort();
-    merged.dedup();
-    let persisted_exactly = |manifest: &Option<PatchManifest>| {
-        manifest
-            .as_ref()
-            .and_then(|m| m.setup.as_ref())
-            .map(|s| &s.exclude)
-            == Some(&merged)
-    };
-    if matches!(existing, Ok(manifest) if persisted_exactly(manifest)) {
-        return None; // already persisted exactly — don't lock, don't rewrite
-    }
-
-    let path = common.resolved_manifest_path();
-    let timeout = Duration::from_secs(common.lock_timeout.unwrap_or(0));
-    let _lock = match crate::commands::lock_cli::acquire_with_status(&common.socket_dir(), timeout)
-    {
-        Ok(guard) => guard,
-        Err(err) => {
-            let (code, message) = crate::commands::lock_cli::lock_failure(&err, timeout);
-            let hint = if code == "lock_held" {
-                "re-run `setup` (or pass --lock-timeout <secs>) to persist it"
-            } else {
-                "the exclude list will need re-passing"
-            };
-            return Some(format!("not persisting --exclude: {message} — {hint}"));
-        }
-    };
-    // Fail closed on a manifest that exists but cannot be read or parsed: it
-    // may still hold recoverable patch records, and flattening the error to
-    // "no manifest yet" would rewrite the file down to a bare setup block —
-    // destroying them for the sake of persisting an exclude list. Skip
-    // persistence loudly instead; nothing else in this run needs the file.
-    let existing = match read_manifest(&path).await {
-        Ok(existing) => existing,
-        Err(e) => {
-            return Some(format!(
-                "not persisting --exclude: cannot read {}: {e} — the exclude list will \
-                 need re-passing until the manifest is repaired",
-                path.display()
-            ));
-        }
-    };
-    if persisted_exactly(&existing) {
-        return None; // a concurrent run persisted it meanwhile
-    }
-    // Preserve any existing `manual` declarations (property 7) when rewriting.
-    let manual = existing
-        .as_ref()
-        .and_then(|m| m.setup.as_ref())
-        .map(|s| s.manual.clone())
-        .unwrap_or_default();
-    let mut manifest = existing.unwrap_or_else(PatchManifest::new);
-    manifest.setup = Some(SetupConfig {
-        exclude: merged,
-        manual,
-    });
-    // The acquire created the manifest's directory; a failed write is the
-    // same fail-closed skip as an unreadable manifest, never a silent
-    // "persisted".
-    if let Err(e) = write_manifest(&path, &manifest).await {
-        return Some(format!(
-            "not persisting --exclude: cannot write {}: {e} — the exclude list will \
-             need re-passing",
-            path.display()
-        ));
-    }
-    None
-}
-
-/// Which ecosystems are **actually set up** at `cwd` — i.e. their auto-repatch
-/// hook is present on disk (the same presence checks `setup --check` runs). VEX
-/// uses this (∪ the manifest's `manual` declarations) to attest patches only for
-/// set-up-or-manual ecosystems (CLI_CONTRACT property 7). Read-only; ignores the
-/// `--ecosystems` filter (it reports real on-disk state).
-pub(crate) async fn configured_ecosystems(
-    common: &GlobalArgs,
-) -> std::collections::HashSet<Ecosystem> {
-    let mut set = std::collections::HashSet::new();
-
-    // npm: any discovered package.json whose hook scripts are present.
-    let npm = find_package_json_files(&common.cwd).await;
-    for loc in &npm.files {
-        if let Ok(content) = tokio::fs::read_to_string(&loc.path).await {
-            if !is_setup_configured_str(&content).needs_update {
-                set.insert(Ecosystem::Npm);
-                break;
-            }
-        }
-    }
-
-    // pypi: a chosen python manifest carries the `socket-patch[hook]` dep.
-    // Detect on-disk state DIRECTLY — not via `plan_python`, which applies the
-    // `--ecosystems` filter; this probe must report real state regardless of it
-    // (e.g. `vex --ecosystems cargo` must still see a set-up python project).
-    if is_python_project(&common.cwd).await {
-        let pm = detect_python_pm(&common.cwd).await;
-        for (path, kind) in choose_python_manifests(&common.cwd, pm).await {
-            if let Ok(content) = tokio::fs::read_to_string(&path).await {
-                if manifest_contains_hook(kind, &content) {
-                    set.insert(Ecosystem::Pypi);
-                    break;
-                }
-            }
-        }
-    }
-
-    // gem: the managed plugin directive is present in the Gemfile.
-    if let Some(project) = gem::discover_bundler_project(&common.cwd).await {
-        if let Ok(content) = tokio::fs::read_to_string(&project.gemfile).await {
-            if gem::is_plugin_directive_present(&content) {
-                set.insert(Ecosystem::Gem);
-            }
-        }
-    }
-
-    if let Some(composer_json) = composer::discover_composer_project(&common.cwd).await {
-        if let Ok(content) = tokio::fs::read_to_string(&composer_json).await {
-            if composer::is_hook_present(&content) {
-                set.insert(Ecosystem::Composer);
-            }
-        }
-    }
-
-    set
-}
-
-// ─────────────────────────────────────────────────────────────────────────
-// Python (.pth hook) helpers
-// ─────────────────────────────────────────────────────────────────────────
-
-/// Is the hook dependency present in a Python manifest's content? Picks the
-/// right detector for the manifest kind: `pyproject.toml` needs the *structural*
-/// probe ([`pyproject_contains_hook`]) because the classic-Poetry form
-/// (`socket-patch = { extras = ["hook"] }`) has no literal `socket-patch[hook]`
-/// substring, so the textual probe would mis-report a configured project;
-/// `requirements.txt` uses the textual line probe.
-fn manifest_contains_hook(kind: ManifestKind, content: &str) -> bool {
-    match kind {
-        ManifestKind::Pyproject => pyproject_contains_hook(content),
-        ManifestKind::Requirements => deps_contain_hook(content),
-    }
-}
-
-/// A Python manifest `setup` will edit, plus the resolved package manager.
-struct PythonPlan {
-    pm: PythonPackageManager,
-    manifests: Vec<(PathBuf, ManifestKind)>,
-}
-
-/// Decide which Python manifest(s) to edit for the detected package manager.
-///
-/// pyproject-based managers (uv/poetry/pdm/hatch) edit `pyproject.toml`; pip
-/// prefers an existing `requirements.txt`, then a PEP 621 `pyproject.toml`, and
-/// otherwise creates `requirements.txt`.
-async fn choose_python_manifests(
-    cwd: &Path,
-    pm: PythonPackageManager,
-) -> Vec<(PathBuf, ManifestKind)> {
-    let pyproject = cwd.join("pyproject.toml");
-    let requirements = cwd.join("requirements.txt");
-    let pyproject_exists = tokio::fs::metadata(&pyproject).await.is_ok();
-    let requirements_exists = tokio::fs::metadata(&requirements).await.is_ok();
-
-    match pm {
-        PythonPackageManager::Uv
-        | PythonPackageManager::Poetry
-        | PythonPackageManager::Pdm
-        | PythonPackageManager::Hatch => {
-            if pyproject_exists {
-                vec![(pyproject, ManifestKind::Pyproject)]
-            } else {
-                vec![]
-            }
-        }
-        PythonPackageManager::Pip => {
-            if requirements_exists {
-                vec![(requirements, ManifestKind::Requirements)]
-            } else if pyproject_exists {
-                vec![(pyproject, ManifestKind::Pyproject)]
-            } else {
-                // Nothing to edit yet: create requirements.txt so a CI
-                // `pip install -r requirements.txt` installs the hook.
-                vec![(requirements, ManifestKind::Requirements)]
-            }
-        }
-    }
-}
-
-async fn plan_python(common: &GlobalArgs) -> Option<PythonPlan> {
-    if !eco_in_scope(common, Ecosystem::Pypi) {
-        return None;
-    }
-    if !is_python_project(&common.cwd).await {
-        return None;
-    }
-    let pm = detect_python_pm(&common.cwd).await;
-    let manifests = choose_python_manifests(&common.cwd, pm).await;
-    if manifests.is_empty() {
-        return None;
-    }
-    Some(PythonPlan { pm, manifests })
-}
-
-/// Run the hook-dependency edits for a plan (add or remove) at the given
-/// dry-run setting. Returns per-manifest results.
-async fn edit_python_manifests(
-    plan: &PythonPlan,
-    remove: bool,
-    dry_run: bool,
-) -> Vec<PthEditResult> {
-    let mut out = Vec::new();
-    for (path, kind) in &plan.manifests {
-        let res = if remove {
-            remove_hook_dependency(path, *kind, dry_run).await
-        } else {
-            add_hook_dependency(path, *kind, dry_run).await
-        };
-        out.push(res);
-    }
-    out
-}
-
-/// After a real (non-dry-run) edit that changed a manifest, refresh the
-/// lockfile. Returns any warnings to surface. (There is no separate marker /
-/// audit file: the committed dependency line is the source of truth.)
-async fn finalize_python(plan: &PythonPlan, edits: &[PthEditResult], cwd: &Path) -> Vec<String> {
-    let mut warnings = Vec::new();
-    let any_changed = edits.iter().any(|e| e.status == PthStatus::Updated);
-    if !any_changed {
-        return warnings;
-    }
-    // Lockfile refresh (broad auto-edit): only when the manager uses a lockfile
-    // that exists. Best-effort — never fatal. The spellings are tried in
-    // order: pin-preserving first (`poetry lock --no-update`,
-    // `pdm lock --update-reuse`), bare `lock` as the fallback for versions
-    // that dropped the flag (Poetry 2.x, where bare `lock` is already
-    // pin-preserving). A successful fallback is not a failure — only warn
-    // when every spelling failed.
-    if let Some((program, spellings)) = plan.pm.lock_commands() {
-        let lockfile = match plan.pm {
-            PythonPackageManager::Uv => Some("uv.lock"),
-            PythonPackageManager::Poetry => Some("poetry.lock"),
-            PythonPackageManager::Pdm => Some("pdm.lock"),
-            _ => None,
-        };
-        let lock_present = match lockfile {
-            Some(name) => tokio::fs::metadata(cwd.join(name)).await.is_ok(),
-            None => false,
-        };
-        if lock_present {
-            let mut failure: Option<String> = None;
-            for args in spellings {
-                match tokio::process::Command::new(program)
-                    .args(*args)
-                    .current_dir(cwd)
-                    .output()
-                    .await
-                {
-                    Ok(o) if o.status.success() => {
-                        failure = None;
-                        break;
-                    }
-                    Ok(o) => {
-                        failure = Some(format!(
-                            "`{program} {}` failed ({}); update the lockfile manually",
-                            args.join(" "),
-                            o.status
-                        ));
-                    }
-                    Err(e) => {
-                        // The program itself didn't spawn (not installed /
-                        // not on PATH): retrying another spelling of the
-                        // same program is pointless.
-                        failure = Some(format!(
-                            "could not run `{program} {}`: {e}; update the lockfile manually",
-                            args.join(" ")
-                        ));
-                        break;
-                    }
-                }
-            }
-            if let Some(w) = failure {
-                warnings.push(w);
-            }
-        }
-    }
-    warnings
-}
-
-// ─────────────────────────────────────────────────────────────────────────
-// Shared per-ecosystem setup outcome
-// ─────────────────────────────────────────────────────────────────────────
-
-/// Summary of one ecosystem branch's contribution to a
-/// setup/remove run. Each `build_*_outcome` returns one of these and the shared
-/// reporting code merges + renders them without naming ecosystem-specific types.
-#[derive(Default)]
-struct SetupOutcome {
-    /// A project for this ecosystem was discovered (gates the `no_files` decision).
-    present: bool,
-    /// Items changed (hook added/removed).
-    changed: usize,
-    already: usize,
-    errors: usize,
-    /// Envelope `files[]` entries (kind = `package_json` / `pth` / `gemfile` / …).
-    json_files: Vec<serde_json::Value>,
-    /// Human-readable preview lines (already formatted).
-    preview: Vec<String>,
-}
-
-// ─────────────────────────────────────────────────────────────────────────
-// Gem (Bundler plugin) helpers
-// ─────────────────────────────────────────────────────────────────────────
-
-/// The Bundler project this run acts on, discovered ONCE per run (honoring
-/// `--ecosystems`); `None` when gem is out of scope or no Gemfile is found.
-async fn discover_gem_project(common: &GlobalArgs) -> Option<gem::BundlerProject> {
-    if !eco_in_scope(common, Ecosystem::Gem) {
-        return None;
-    }
-    gem::discover_bundler_project(&common.cwd).await
-}
-
-/// The gem project a setup run wires, paired with the run's ONE bundler
-/// probe (a `Gemfile.lock` read, or a `bundle --version` spawn bounded by
-/// its timeout): the preview and the real edit share both, so the probe
-/// runs at most once per run.
-async fn discover_gem_target(
-    common: &GlobalArgs,
-) -> Option<(gem::BundlerProject, gem::BundlerProbe)> {
-    let project = discover_gem_project(common).await?;
-    let probe = gem::probe_bundler(&project).await;
-    Some((project, probe))
-}
-
-/// What the gem branch does to a project.
-enum GemEdit<'a> {
-    /// Wire the plugin; `add_plugin_directive_with` refuses below the
-    /// bundler floor, judged from the run's probe.
-    Add(&'a gem::BundlerProbe),
-    /// Unwire. Deliberately ungated and never probes: it is the recovery
-    /// path for an already-wired bundler-1.x project.
-    Remove,
-}
-
-/// Build the gem branch's contribution to a setup/remove run: add (or remove)
-/// the managed `plugin "socket-patch"` block in the Gemfile + the generated
-/// `.socket/bundler-plugin/` plugin files. `target` is the discovered project
-/// with the edit to make ([`discover_gem_target`] pairs the add path with the
-/// run's one probe); `None` when the project has no Gemfile.
-async fn build_gem_outcome(
-    common: &GlobalArgs,
-    target: Option<(&gem::BundlerProject, GemEdit<'_>)>,
-    dry_run: bool,
-) -> SetupOutcome {
-    let Some((project, edit)) = target else {
-        return SetupOutcome::default();
-    };
-
-    let mut out = SetupOutcome {
-        present: true,
-        ..Default::default()
-    };
-
-    let remove = matches!(edit, GemEdit::Remove);
-    let results = match edit {
-        GemEdit::Add(probe) => gem::add_plugin_directive_with(project, probe, dry_run).await,
-        GemEdit::Remove => gem::remove_plugin_directive(project, dry_run).await,
-    };
-
-    let mut added_paths: Vec<String> = Vec::new();
-    for r in &results {
-        match r.status {
-            GemSetupStatus::Updated => {
-                out.changed += 1;
-                added_paths.push(r.path.clone());
-            }
-            GemSetupStatus::AlreadyConfigured => out.already += 1,
-            GemSetupStatus::Error => out.errors += 1,
-        }
-        out.json_files.push(serde_json::json!({
-            "kind": r.kind,
-            "path": r.path,
-            "status": gem_status_str(&r.status, remove),
-            "error": r.error,
-        }));
-    }
-
-    if !added_paths.is_empty() {
-        let header = if remove {
-            "Gem: remove the socket-patch Bundler plugin wiring from:"
-        } else {
-            "Gem: add the socket-patch Bundler plugin wiring to:"
-        };
-        out.preview.push(header.to_string());
-        let marker = if remove { "-" } else { "+" };
-        for p in &added_paths {
-            out.preview
-                .push(format!("  {marker} {}", pathdiff(p, &common.cwd)));
-        }
-    }
-
-    out
-}
-
-fn gem_status_str(s: &GemSetupStatus, for_remove: bool) -> &'static str {
-    match (s, for_remove) {
-        (GemSetupStatus::Updated, false) => "updated",
-        (GemSetupStatus::Updated, true) => "removed",
-        (GemSetupStatus::AlreadyConfigured, false) => "already_configured",
-        (GemSetupStatus::AlreadyConfigured, true) => "not_configured",
-        (GemSetupStatus::Error, _) => "error",
-    }
-}
-
-// ─────────────────────────────────────────────────────────────────────────
-// Composer (composer.json scripts post-install/post-update hook) helpers
-// ─────────────────────────────────────────────────────────────────────────
-
-/// The `composer.json` this run acts on, discovered ONCE per run (honoring
-/// `--ecosystems`).
-async fn discover_composer_json(common: &GlobalArgs) -> Option<PathBuf> {
-    if !eco_in_scope(common, Ecosystem::Composer) {
-        return None;
-    }
-    composer::discover_composer_project(&common.cwd).await
-}
-
-/// Build the composer branch's contribution to a setup/remove run: add (or
-/// remove) the `socket-patch apply` command in `composer.json`'s
-/// `post-install-cmd` / `post-update-cmd` script events. `composer_json`
-/// comes from [`discover_composer_json`], shared by the preview and the
-/// real edit.
-async fn build_composer_outcome(
-    common: &GlobalArgs,
-    composer_json: Option<&Path>,
-    remove: bool,
-    dry_run: bool,
-) -> SetupOutcome {
-    let Some(composer_json) = composer_json else {
-        return SetupOutcome::default();
-    };
-
-    let mut out = SetupOutcome {
-        present: true,
-        ..Default::default()
-    };
-
-    let r = if remove {
-        composer::remove_hook(composer_json, dry_run).await
-    } else {
-        composer::add_hook(composer_json, dry_run).await
-    };
-
-    let mut added_paths: Vec<String> = Vec::new();
-    match r.status {
-        ComposerSetupStatus::Updated => {
-            out.changed += 1;
-            added_paths.push(r.path.clone());
-        }
-        ComposerSetupStatus::AlreadyConfigured => out.already += 1,
-        ComposerSetupStatus::Error => out.errors += 1,
-    }
-    out.json_files.push(serde_json::json!({
-        "kind": r.kind,
-        "path": r.path,
-        "status": composer_status_str(&r.status, remove),
-        "error": r.error,
-    }));
-
-    if !added_paths.is_empty() {
-        let header = if remove {
-            "Composer: remove the socket-patch re-apply hook from:"
-        } else {
-            "Composer: add the socket-patch re-apply hook to:"
-        };
-        out.preview.push(header.to_string());
-        let marker = if remove { "-" } else { "+" };
-        for p in &added_paths {
-            out.preview
-                .push(format!("  {marker} {}", pathdiff(p, &common.cwd)));
-        }
-    }
-
-    out
-}
-
-fn composer_status_str(s: &ComposerSetupStatus, for_remove: bool) -> &'static str {
-    match (s, for_remove) {
-        (ComposerSetupStatus::Updated, false) => "updated",
-        (ComposerSetupStatus::Updated, true) => "removed",
-        (ComposerSetupStatus::AlreadyConfigured, false) => "already_configured",
-        (ComposerSetupStatus::AlreadyConfigured, true) => "not_configured",
-        (ComposerSetupStatus::Error, _) => "error",
-    }
-}
-
-/// Append composer check entry (the `composer.json` hook presence) to the shared
-/// `run_check` entries list. Returns whether a composer project was found.
-/// Checks the SETUP wiring only — patch consistency is the shared
-/// `append_patch_consistency_entries` pass.
-async fn append_composer_check_entries(
-    common: &GlobalArgs,
-    entries: &mut Vec<(&'static str, String, CheckState, Option<String>)>,
-) -> bool {
-    if !eco_in_scope(common, Ecosystem::Composer) {
-        return false;
-    }
-    let composer_json = match composer::discover_composer_project(&common.cwd).await {
-        Some(p) => p,
-        None => return false,
-    };
-    let (state, err) = match tokio::fs::read_to_string(&composer_json).await {
-        Ok(content) => {
-            if composer::is_hook_present(&content) {
-                (CheckState::Configured, None)
-            } else {
-                (CheckState::NeedsConfiguration, None)
-            }
-        }
-        Err(e) => (CheckState::Error, Some(e.to_string())),
-    };
-    entries.push(("composer", composer_json.display().to_string(), state, err));
-    true
-}
-
-/// Materialise gem patches right after wiring the plugin (the "automatic" step)
-/// so the first `bundle install` finds them already applied. Best-effort and
-/// offline; a non-zero exit becomes a warning — the plugin heals on the next
-/// `bundle install`.
-async fn finalize_gem(common: &GlobalArgs) -> Vec<String> {
-    let exe = match std::env::current_exe() {
-        Ok(e) => e,
-        Err(e) => {
-            return vec![format!(
-                "could not locate socket-patch to materialize gem patches ({e}); \
-                 run `socket-patch apply --ecosystems gem`"
-            )]
-        }
-    };
-    let root = common.cwd.display().to_string();
-    // Forward the manifest location: the nested `apply` re-resolves a relative
-    // `--manifest-path` against ITS OWN `--cwd`, so hand it the absolutized,
-    // already-cwd-resolved path (the `get::run_nested_apply` rule). Dropping
-    // the flag made this run read the default `.socket/manifest.json`, so a
-    // project whose patches live anywhere else materialized nothing here —
-    // silently, since a missing manifest is a clean exit-0 no-op for `apply`.
-    let manifest = common.resolved_manifest_path();
-    let manifest = std::path::absolute(&manifest).unwrap_or(manifest);
-    let manifest = manifest.display().to_string();
-    match tokio::process::Command::new(&exe)
-        .args([
-            "apply",
-            "--offline",
-            "--ecosystems",
-            "gem",
-            "--cwd",
-            &root,
-            "--manifest-path",
-            &manifest,
-            "--silent",
-        ])
-        .output()
-        .await
-    {
-        Ok(o) if o.status.success() => Vec::new(),
-        Ok(o) => vec![format!(
-            "materializing gem patches exited with {}; the Bundler plugin will heal on next `bundle install`",
-            o.status
-                .code()
-                .map(|c| c.to_string())
-                .unwrap_or_else(|| "signal".into())
-        )],
-        Err(e) => vec![format!(
-            "could not run apply to materialize gem patches ({e}); the Bundler plugin will heal on next `bundle install`"
-        )],
-    }
-}
-
-/// Append gem check entries (the Gemfile `plugin` directive + the generated
-/// plugin dir) to the shared `run_check` entries list. Returns whether a
-/// Bundler project was found. Checks the SETUP wiring only — patch consistency
-/// is the shared `append_patch_consistency_entries` pass.
-async fn append_gem_check_entries(
-    common: &GlobalArgs,
-    entries: &mut Vec<(&'static str, String, CheckState, Option<String>)>,
-) -> bool {
-    if !eco_in_scope(common, Ecosystem::Gem) {
-        return false;
-    }
-    let project = match gem::discover_bundler_project(&common.cwd).await {
-        Some(p) => p,
-        None => return false,
-    };
-    // The bundler version floor (core `setup::gem::version`): bundler 1.x
-    // cannot load the `plugin ... path:` directive, so a WIRED project fails
-    // every `bundle install` (exit 7, an error that never names socket-patch)
-    // — the campaign-confirmed state where `--check` kept saying "configured"
-    // while the CI gate it exists to be went green over broken installs. Both
-    // wired and unwired unsupported projects are red-flagged as errors: setup
-    // itself refuses to wire below the floor, so "needs_configuration" (run
-    // `setup` to fix) would point at a command that cannot help.
-    let probe = gem::probe_bundler(&project).await;
-    let (state, err) = match tokio::fs::read_to_string(&project.gemfile).await {
-        Ok(content) => {
-            let wired = gem::is_plugin_directive_present(&content);
-            match (&probe, wired) {
-                (gem::BundlerProbe::Unsupported { version, source }, true) => (
-                    CheckState::Error,
-                    Some(format!(
-                        "the wired socket-patch plugin cannot load under bundler \
-                         {version} (from {source}; needs >= {}.{}): every `bundle \
-                         install` fails resolving 'socket-patch' as an ordinary gem \
-                         (exit 7) before the plugin registers. Run `socket-patch \
-                         setup --remove` to unwire, or upgrade bundler",
-                        gem::MIN_BUNDLER.0,
-                        gem::MIN_BUNDLER.1
-                    )),
-                ),
-                (gem::BundlerProbe::Unsupported { version, source }, false) => (
-                    CheckState::Error,
-                    Some(gem::unsupported_bundler_message(version, source)),
-                ),
-                (_, true) => (CheckState::Configured, None),
-                (_, false) => (CheckState::NeedsConfiguration, None),
-            }
-        }
-        Err(e) => (CheckState::Error, Some(e.to_string())),
-    };
-    entries.push(("gemfile", project.gemfile.display().to_string(), state, err));
-    let dir_state = if gem::plugin_files_present(&project.root).await {
-        CheckState::Configured
-    } else {
-        CheckState::NeedsConfiguration
-    };
-    entries.push((
-        "gem_plugin",
-        gem::plugin_dir(&project.root).display().to_string(),
-        dir_state,
-        None,
-    ));
-    true
-}
-
-/// Append a `needs_configuration` entry for every in-scope manifest patch that
-/// is installed but NOT correctly applied on disk (a file's hash != its
-/// `afterHash`). This is the `apply --check` invariant that property 4 requires
-/// `setup --check` to prove *in addition to* hook presence: a repo with hooks
-/// wired but patches drifted/un-applied is not in a correctly-patched state.
-///
-/// Reuses the same machinery `vex` uses — the qualified-aware rollback resolver
-/// (so release-variant PURLs resolve) honoring `--ecosystems`, the committed
-/// vendor ledger ([`crate::commands::vex::vendor_context_from`]: a vendored
-/// patch is judged by its `.socket/vendor/` artifact — the bytes the next
-/// install consumes — never the expectedly-unpatched installed tree), then
-/// [`applied_patches_with_vendor`]. An *uninstalled* package (`package_not_found`, also the
-/// bucket for out-of-scope PURLs absent from the map) cannot be patched yet, and
-/// a degenerate zero-file record (`no_files`) has nothing to hash — neither is
-/// drift, so both are skipped. A missing/empty/unreadable manifest contributes
-/// nothing of its own; the vendor ledger's embedded records (vendored mode is
-/// manifest-free; standalone `vendor`'s fallback copies where the manifest no
-/// longer covers them) are folded in by the rule `vex` applies, so a
-/// vendored-only project is judged too. Read-only: it crawls but never writes.
-async fn append_patch_consistency_entries(
-    common: &GlobalArgs,
-    manifest: Option<PatchManifest>,
-    entries: &mut Vec<(&'static str, String, CheckState, Option<String>)>,
-) {
-    // ONE ledger read serves both the record fold and the verifier's
-    // VendorContext below. Without the fold a project whose committed
-    // `.socket/vendor/**` artifact is missing or corrupt reported
-    // `configured` — the exact hooks-present-but-state-drifted case
-    // property 4 exists to catch. A ledger that cannot be read or parsed is
-    // that case too (contract: "never as a `configured` verdict"): it is
-    // surfaced BEFORE the emptiness return below — on a manifest-free
-    // vendored project the fold is the only source of purls, so returning
-    // early would report `configured` with no signal at all — as the shared
-    // `unreadable vendor state` warning plus a `vendor_ledger` error entry
-    // (verdict `error`, exit 1), and the verifier proceeds over an empty
-    // ledger (already reported, so not warned twice).
-    let mut manifest = manifest.unwrap_or_default();
-    let ledger = match socket_patch_core::vendor::load_state(&common.cwd).await {
-        Ok(state) => {
-            crate::commands::fold_vendor_records(&mut manifest, &state.entries);
-            Ok(state)
-        }
-        Err(e) => {
-            crate::commands::vex::warn_unreadable_vendor_state(common, &e);
-            entries.push((
-                "vendor_ledger",
-                common
-                    .cwd
-                    .join(socket_patch_core::vendor::VENDOR_STATE_REL)
-                    .display()
-                    .to_string(),
-                CheckState::Error,
-                Some(format!("unreadable vendor state ({e})")),
-            ));
-            Ok(socket_patch_core::vendor::VendorState::new())
-        }
-    };
-    if manifest.patches.is_empty() {
-        return;
-    }
-
-    let purls: Vec<String> = manifest.patches.keys().cloned().collect();
-    // `--json` reserves stdout for the check report: silence the dispatch's
-    // human chrome ("Using <X> at: ...") like apply/rollback do.
-    let package_paths =
-        find_manifest_package_paths(&purls, common, common.silent || common.json).await;
-
-    // The ledger passed here is always readable (an unreadable one was
-    // reported above and replaced by an empty one), so there is no
-    // degrade warning left to surface.
-    let (vendor, _) = crate::commands::vex::vendor_context_from(common, &manifest, ledger).await;
-    let outcome = applied_patches_with_vendor(&manifest, &package_paths, vendor.as_ref()).await;
-    for failed in &outcome.failed {
-        match failed.reason.as_str() {
-            // Not installed (or out of scope) / nothing to hash → not drift.
-            "package_not_found" | "no_files" => continue,
-            // Installed but the on-disk file is not at its afterHash → drift.
-            _ => entries.push((
-                "patch",
-                failed.purl.clone(),
-                CheckState::NeedsConfiguration,
-                Some(format!("patch not applied on disk ({})", failed.reason)),
-            )),
-        }
-    }
-}
-
-/// Combine two ecosystem outcomes into one for the shared preview/envelope
-/// printers, which take a single [`SetupOutcome`].
-fn merge_outcomes(mut a: SetupOutcome, b: SetupOutcome) -> SetupOutcome {
-    a.present |= b.present;
-    a.changed += b.changed;
-    a.already += b.already;
-    a.errors += b.errors;
-    a.json_files.extend(b.json_files);
-    a.preview.extend(b.preview);
-    a
-}
-
-// ─────────────────────────────────────────────────────────────────────────
-// check
-// ─────────────────────────────────────────────────────────────────────────
-
-#[derive(Clone, Copy, PartialEq, Debug)]
-enum CheckState {
-    Configured,
-    NeedsConfiguration,
-    Error,
-}
-
-/// One `setup --check` status line. A drifted patch (`kind == "patch"`)
-/// shows why it is not applied instead of "needs setup", which re-running
-/// `setup` would not fix.
-fn format_check_line(kind: &str, rel: &str, state: CheckState, err: Option<&str>) -> String {
-    match (state, err) {
-        (CheckState::Configured, _) => format!("  ✓ {rel} (configured)"),
-        (CheckState::NeedsConfiguration, _) if kind == "patch" => {
-            format!("  ✗ {rel}: {}", err.unwrap_or("patch not applied on disk"))
-        }
-        (CheckState::NeedsConfiguration, Some(e)) => format!("  ✗ {rel} (needs setup: {e})"),
-        (CheckState::NeedsConfiguration, None) => format!("  ✗ {rel} (needs setup)"),
-        (CheckState::Error, e) => format!("  ! {rel}: {}", e.unwrap_or("unknown error")),
-    }
-}
-
-/// The `setup --check` verdict: what is wrong, then the command that fixes
-/// each kind of problem (`setup` for missing hooks, `apply` for drifted
-/// patches; invalid files need a hand edit).
-fn format_check_footer(hooks: usize, drifted: usize, errors: usize) -> String {
-    if hooks + drifted + errors == 0 {
-        return "All manifests are configured with socket-patch.".to_string();
-    }
-    let mut problems = Vec::new();
-    let mut advice = Vec::new();
-    if hooks > 0 {
-        problems.push(format!(
-            "{} configuration",
-            plural(hooks, "manifest needs", "manifests need")
-        ));
-        advice.push("Run `socket-patch setup` to add the missing install hooks.");
-    }
-    if drifted > 0 {
-        problems.push(format!(
-            "{} not applied on disk",
-            plural(drifted, "patch is", "patches are")
-        ));
-        advice.push("Run `socket-patch apply` to re-apply the patches.");
-    }
-    if errors > 0 {
-        problems.push(plural(errors, "error", "errors"));
-        advice.push("Fix the errors above, then re-run `socket-patch setup --check`.");
-    }
-    format!("{}. {}", problems.join(", "), advice.join(" "))
-}
-
-/// The status line while `setup --check` / `--remove` discover manifests.
-const SEARCHING: &str = "Searching for package.json / Python / Bundler / Composer manifests...";
-
-/// Read-only verification that every discovered install hook (npm
-/// package.json, the Python dependency manifest, the Bundler plugin, the
-/// Composer script) is configured for socket-patch, plus the shared
-/// patch-consistency pass. Never writes (so `--dry-run` is a harmless no-op
-/// here). Exits 0 only when all are configured and none failed to parse.
-async fn run_check(args: &SetupArgs) -> i32 {
-    // `--silent` is "errors only" (CLI_CONTRACT.md): suppress the entire
-    // human-readable report, mirroring `list`/`repair`/`get`/`remove`/`scan`.
-    // The exit code still distinguishes the configuration states.
-    let mut status = crate::ui::StatusLine::stderr(args.common.json, args.common.silent);
-    status.set(SEARCHING);
-
-    // Excluded members (persisted in the manifest + any passed via `--exclude`)
-    // are skipped by discovery. Read-only: `--check` never persists.
-    let existing = read_setup_manifest(&args.common).await;
-    let excludes = effective_excludes(manifest_view(&existing), &args.exclude);
-    let npm_files = discover(args, &excludes).await;
-    let py_plan = plan_python(&args.common).await;
-
-    // (kind, path, state, error)
-    let mut entries: Vec<(&'static str, String, CheckState, Option<String>)> = Vec::new();
-
-    for loc in &npm_files {
-        let (state, err) = match tokio::fs::read_to_string(&loc.path).await {
-            Ok(content) => {
-                // npm and Node strip a leading UTF-8 BOM when reading
-                // package.json (and `setup` itself tolerates one via
-                // `is_setup_configured_str`); parse the same bytes they would,
-                // or a BOM'd configured file fails `--check` as "Invalid
-                // package.json" while `setup` calls it already_configured.
-                let json = content.strip_prefix('\u{feff}').unwrap_or(&content);
-                if let Err(e) = serde_json::from_str::<serde_json::Value>(json) {
-                    // Keep the parser's detail (line/column): "Invalid
-                    // package.json" alone leaves the user hunting.
-                    (
-                        CheckState::Error,
-                        Some(format!("Invalid package.json: {e}")),
-                    )
-                } else if is_setup_configured_str(&content).needs_update {
-                    (CheckState::NeedsConfiguration, None)
-                } else {
-                    (CheckState::Configured, None)
-                }
-            }
-            Err(e) => (CheckState::Error, Some(e.to_string())),
-        };
-        entries.push(("package_json", loc.path.display().to_string(), state, err));
-    }
-
-    if let Some(plan) = &py_plan {
-        for (path, kind) in &plan.manifests {
-            let (state, err) = match tokio::fs::read_to_string(path).await {
-                Ok(content) => {
-                    if manifest_contains_hook(*kind, &content) {
-                        (CheckState::Configured, None)
-                    } else {
-                        (CheckState::NeedsConfiguration, None)
-                    }
-                }
-                // A not-yet-created requirements.txt simply needs setup; a
-                // missing pyproject we'd have to edit is an error.
-                Err(e) if e.kind() == std::io::ErrorKind::NotFound => match kind {
-                    ManifestKind::Requirements => (CheckState::NeedsConfiguration, None),
-                    ManifestKind::Pyproject => (CheckState::Error, Some(e.to_string())),
-                },
-                Err(e) => (CheckState::Error, Some(e.to_string())),
-            };
-            entries.push(("pth", path.display().to_string(), state, err));
-        }
-    }
-
-    append_gem_check_entries(&args.common, &mut entries).await;
-    append_composer_check_entries(&args.common, &mut entries).await;
-
-    // Property 4: prove a correctly-patched state, not just hook presence —
-    // every in-scope manifest patch must be applied on disk (`apply --check`
-    // invariant). Drifted/un-applied patches add `needs_configuration` entries.
-    append_patch_consistency_entries(&args.common, existing.ok().flatten(), &mut entries).await;
-    status.finish();
-
-    if entries.is_empty() {
-        return report_no_files(
-            args,
-            &[("configured", 0), ("needsConfiguration", 0), ("errors", 0)],
-        );
-    }
-
-    let configured = entries
-        .iter()
-        .filter(|(_, _, s, _)| *s == CheckState::Configured)
-        .count();
-    let needs = entries
-        .iter()
-        .filter(|(_, _, s, _)| *s == CheckState::NeedsConfiguration)
-        .count();
-    // Drifted patches need `apply`, not `setup`: counted apart so the
-    // footer can say which command fixes what.
-    let drifted = entries
-        .iter()
-        .filter(|(k, _, s, _)| *k == "patch" && *s == CheckState::NeedsConfiguration)
-        .count();
-    let errs = entries
-        .iter()
-        .filter(|(_, _, s, _)| *s == CheckState::Error)
-        .count();
-
-    let all_ok = needs == 0 && errs == 0;
-    let status = if errs > 0 {
-        "error"
-    } else if all_ok {
-        "configured"
-    } else {
-        "needs_configuration"
-    };
-
-    if args.common.json {
-        println!(
-            "{}",
-            serde_json::to_string_pretty(&serde_json::json!({
-                "status": status,
-                "configured": configured,
-                "needsConfiguration": needs,
-                "errors": errs,
-                "files": entries.iter().map(|(kind, path, state, err)| {
-                    serde_json::json!({
-                        "kind": kind,
-                        "path": path,
-                        "status": match state {
-                            CheckState::Configured => "configured",
-                            CheckState::NeedsConfiguration => "needs_configuration",
-                            CheckState::Error => "error",
-                        },
-                        "error": err,
-                    })
-                }).collect::<Vec<_>>(),
-            }))
-            .expect("serializing an in-memory JSON value cannot fail")
-        );
-    } else if !args.common.silent {
-        println!("\nConfiguration status:\n");
-        for (kind, path, state, err) in &entries {
-            let rel = pathdiff(path, &args.common.cwd);
-            println!("{}", format_check_line(kind, &rel, *state, err.as_deref()));
-        }
-        println!();
-        println!("{}", format_check_footer(needs - drifted, drifted, errs));
-        if errs > 0 {
-            eprintln!("{}", format_items_failed(errs));
-        }
-    } else {
-        // `--silent` is "errors only": the status report is muted, but
-        // read/parse failures must still reach stderr. A plain
-        // needs-configuration state is not an error — the exit code alone
-        // carries it.
-        for (_, path, state, err) in &entries {
-            if *state == CheckState::Error {
-                eprintln!(
-                    "Error: {}: {}",
-                    pathdiff(path, &args.common.cwd),
-                    err.as_deref().unwrap_or("unknown error")
-                );
-            }
-        }
-    }
-
-    if all_ok {
-        0
-    } else {
-        1
-    }
-}
-
-// ─────────────────────────────────────────────────────────────────────────
-// remove
-// ─────────────────────────────────────────────────────────────────────────
-
-/// One script's before/after pair in the remove preview, the two values
-/// aligned in one column:
-///
-/// ```text
-///     postinstall:    "socket-patch apply && echo hi"
-///     -> postinstall: "echo hi"
-/// ```
-fn format_script_change(key: &str, old: &str, new: &str) -> String {
-    let label = format!("{key}:");
-    let width = label.len() + 3; // the width of "-> <key>:"
-    format!("    {label:<width$} \"{old}\"\n    -> {label} {new}\n")
-}
-
-/// Render a removed script value: `None` means the key is being deleted.
-fn render_removed(new: &Option<String>) -> String {
-    match new {
-        Some(s) if !s.is_empty() => format!("\"{s}\""),
-        _ => "(removed)".to_string(),
-    }
-}
-
-/// Revert the install hooks `setup` added (npm package.json scripts, the
-/// Python `socket-patch[hook]` dependency, the gem Bundler plugin wiring and
-/// the Composer script). Honors `--dry-run`, `--yes`, `--json`.
-async fn run_remove(args: &SetupArgs) -> i32 {
-    let common = &args.common;
-    // `--silent` is "errors only" (CLI_CONTRACT.md): mute the human-readable
-    // chatter just like `--json` does; the mutation and exit code are
-    // unaffected, and prompting follows the shared `confirm()` semantics.
-    let quiet = common.json || common.silent;
-    let mut status = crate::ui::StatusLine::stderr(common.json, common.silent);
-    status.set(SEARCHING);
-
-    // Honor the persisted/`--exclude` member set so we never touch a member that
-    // was deliberately excluded from setup. Remove does not change the set.
-    let existing = read_setup_manifest(common).await;
-    let excludes = effective_excludes(manifest_view(&existing), &args.exclude);
-    let npm_files = discover_for_remove(args, &excludes).await;
-    let py_plan = plan_python(common).await;
-    // Gem + Composer projects are discovered ONCE; the preview and the real
-    // removal below share them.
-    let gem_project = discover_gem_project(common).await;
-    let composer_json = discover_composer_json(common).await;
-    let gem_preview = build_gem_outcome(
-        common,
-        gem_project.as_ref().map(|p| (p, GemEdit::Remove)),
-        true,
-    )
-    .await;
-    let composer_preview =
-        build_composer_outcome(common, composer_json.as_deref(), true, true).await;
-    status.finish();
-    if npm_files.is_empty()
-        && py_plan.is_none()
-        && !gem_preview.present
-        && !composer_preview.present
-    {
-        return report_no_files(args, &[("removed", 0), ("notConfigured", 0), ("errors", 0)]);
-    }
-    let gem_present = gem_preview.present;
-    let extra_preview = merge_outcomes(gem_preview, composer_preview);
-
-    // Preview (dry_run=true never writes).
-    let mut npm_preview = Vec::new();
-    for loc in &npm_files {
-        npm_preview.push(remove_package_json(&loc.path, true).await);
-    }
-    let py_preview = match &py_plan {
-        Some(p) => edit_python_manifests(p, true, true).await,
-        None => Vec::new(),
-    };
-
-    if !quiet {
-        print!(
-            "{}",
-            format_remove_preview(&npm_preview, &py_preview, &extra_preview, &common.cwd)
-        );
-    }
-
-    let n_remove = npm_preview
-        .iter()
-        .filter(|r| r.status == RemoveStatus::Removed)
-        .count()
-        + py_preview
-            .iter()
-            .filter(|r| r.status == PthStatus::Updated)
-            .count()
-        + extra_preview.changed;
-    let preview_errs = npm_preview
-        .iter()
-        .filter(|r| r.status == RemoveStatus::Error)
-        .count()
-        + py_preview
-            .iter()
-            .filter(|r| r.status == PthStatus::Error)
-            .count()
-        + extra_preview.errors;
-
-    // Nothing to remove: clean (exit 0) or some file errored (exit 1).
-    if n_remove == 0 {
-        if common.json {
-            print_remove_envelope(
-                if preview_errs > 0 {
-                    "error"
-                } else {
-                    "not_configured"
-                },
-                &npm_preview,
-                &py_preview,
-                &extra_preview,
-                &[],
-            );
-        } else if !common.silent {
-            if preview_errs > 0 {
-                println!(
-                    "\nNothing removed; {} (see errors above).",
-                    plural(
-                        preview_errs,
-                        "item could not be processed",
-                        "items could not be processed"
-                    )
-                );
-            } else {
-                println!("No socket-patch install hooks found to remove.");
-            }
-        }
-        eprint_errors(
-            common,
-            &remove_error_messages(&npm_preview, &py_preview, &extra_preview, &common.cwd),
-        );
-        return if preview_errs > 0 { 1 } else { 0 };
-    }
-
-    // Dry-run: preview already shown; report and exit without writing.
-    if common.dry_run {
-        if common.json {
-            print_remove_envelope("dry_run", &npm_preview, &py_preview, &extra_preview, &[]);
-        } else if !common.silent {
-            println!("\nSummary (dry run):");
-            println!(
-                "  {}",
-                plural(
-                    n_remove,
-                    "item would have socket-patch removed",
-                    "items would have socket-patch removed"
-                )
-            );
-        }
-        eprint_errors(
-            common,
-            &remove_error_messages(&npm_preview, &py_preview, &extra_preview, &common.cwd),
-        );
-        return if preview_errs > 0 { 1 } else { 0 };
-    }
-
-    // Confirm before mutating.
-    // Default-no on a terminal; proceeds when stdin is not interactive.
-    // Keep the prompt (or its non-interactive note) off the last preview
-    // line. With --yes nothing is printed there, and the progress line below
-    // already opens with its own blank line.
-    if !quiet && !common.yes {
-        eprintln!();
-    }
-    if !crate::ui::confirm_or_proceed("Remove these install hooks?", common) {
-        if !common.silent {
-            eprintln!("{REMOVE_CANCELLED}");
-        }
-        return 0;
-    }
-
-    status.set("Removing install hooks...");
-    let mut npm_results = Vec::new();
-    for loc in &npm_files {
-        npm_results.push(remove_package_json(&loc.path, false).await);
-    }
-    let mut py_results = Vec::new();
-    let mut warnings = Vec::new();
-    if let Some(plan) = &py_plan {
-        py_results = edit_python_manifests(plan, true, false).await;
-        warnings = finalize_python(plan, &py_results, &common.cwd).await;
-    }
-    // Real gem + composer removal (gem Gemfile `plugin` block + generated plugin
-    // dir; composer.json script-event command).
-    let extra_results = merge_outcomes(
-        build_gem_outcome(
-            common,
-            gem_project.as_ref().map(|p| (p, GemEdit::Remove)),
-            false,
-        )
-        .await,
-        build_composer_outcome(common, composer_json.as_deref(), true, false).await,
-    );
-    status.finish();
-
-    let errs = npm_results
-        .iter()
-        .filter(|r| r.status == RemoveStatus::Error)
-        .count()
-        + py_results
-            .iter()
-            .filter(|r| r.status == PthStatus::Error)
-            .count()
-        + extra_results.errors;
-
-    if common.json {
-        print_remove_envelope(
-            if errs > 0 {
-                "partial_failure"
-            } else {
-                "success"
-            },
-            &npm_results,
-            &py_results,
-            &extra_results,
-            &warnings,
-        );
-    } else if !common.silent {
-        let removed = npm_results
-            .iter()
-            .filter(|r| r.status == RemoveStatus::Removed)
-            .count()
-            + py_results
-                .iter()
-                .filter(|r| r.status == PthStatus::Updated)
-                .count()
-            + extra_results.changed;
-        println!("\nSummary:");
-        println!(
-            "  {}",
-            plural(
-                removed,
-                "item had socket-patch removed",
-                "items had socket-patch removed"
-            )
-        );
-        if errs > 0 {
-            println!("  {}", plural(errs, "error", "errors"));
-        }
-        if py_plan.is_some() {
-            println!("\nAlso run `pip uninstall socket-patch-hook` to remove the installed .pth.");
-        }
-        if gem_present {
-            println!(
-                "\nNote: the Bundler plugin wiring was removed; already-patched gems on disk are \
-                 reverted by a fresh `bundle install` (or `socket-patch rollback`)."
-            );
-        }
-    }
-
-    print_warnings(common, &warnings);
-    eprint_errors(
-        common,
-        &remove_error_messages(&npm_results, &py_results, &extra_results, &common.cwd),
-    );
-
-    if errs > 0 {
-        1
-    } else {
-        0
-    }
-}
-
-/// Error messages from a gem/composer [`SetupOutcome`]'s rendered `files[]`
-/// entries — the only place per-edit errors for those ecosystems are retained.
-/// The setup/remove previews use this so their human-mode "Errors:" sections
-/// actually list gem/composer failures, honoring the "(see errors above)" line
-/// both flows print when `preview_errors > 0`. Each message is prefixed with
-/// the file's path (relative to `cwd`).
-fn outcome_error_messages(o: &SetupOutcome, cwd: &Path) -> Vec<String> {
-    o.json_files
-        .iter()
-        .filter(|f| f.get("status").and_then(|s| s.as_str()) == Some("error"))
-        .filter_map(|f| {
-            let err = f.get("error").and_then(|e| e.as_str())?;
-            let path = f.get("path").and_then(|p| p.as_str()).unwrap_or("");
-            Some(format_item_error(path, err, cwd))
-        })
-        .collect()
-}
-
-/// `packages/a/package.json: Invalid package.json: ...` — in a workspace
-/// there can be dozens of manifests, so an error must say which one.
-fn format_item_error(path: &str, err: &str, cwd: &Path) -> String {
-    if path.is_empty() {
-        err.to_string()
-    } else {
-        format!("{}: {err}", pathdiff(path, cwd))
-    }
-}
-
-/// Print run warnings to stderr (`Warning: ...`) in human mode; `--json`
-/// carries them in the envelope and `--silent` mutes them.
-fn print_warnings(common: &GlobalArgs, warnings: &[String]) {
-    if common.json || common.silent {
-        return;
-    }
-    for w in warnings {
-        eprintln!("{}", format_warning(w));
-    }
-}
-
-/// `Warning: <Message>` — the warning texts start lowercase because they
-/// double as JSON `warnings[]` strings; the human line capitalizes them.
-fn format_warning(w: &str) -> String {
-    let mut chars = w.chars();
-    match chars.next() {
-        Some(first) => format!("Warning: {}{}", first.to_uppercase(), chars.as_str()),
-        None => "Warning:".to_string(),
-    }
-}
-
-/// `--silent` is "errors only" (CLI_CONTRACT.md): the previews, summaries,
-/// and status report that normally carry per-item failures are muted, so
-/// before an error exit the failures themselves must still reach stderr —
-/// mirroring `remove`/`scan`, whose error paths keep their stderr output.
-/// JSON mode is exempt: its envelope already carries the errors.
-///
-/// Without `--silent` the per-item errors are in the stdout report
-/// already, so stderr gets one closing [`format_items_failed`] line: the
-/// run exits 1, and the error stream says so.
-fn eprint_errors(common: &GlobalArgs, errs: &[String]) {
-    if common.json || errs.is_empty() {
-        return;
-    }
-    if common.silent {
-        for e in errs {
-            eprintln!("Error: {e}");
-        }
-    } else {
-        eprintln!("{}", format_items_failed(errs.len()));
-    }
-}
-
-/// The closing stderr error of a human run whose report lists per-item
-/// errors.
-fn format_items_failed(n: usize) -> String {
-    format!(
-        "Error: {}.",
-        plural(
-            n,
-            "item could not be processed",
-            "items could not be processed"
-        )
-    )
-}
-
-/// Per-item error messages across the three remove result families (npm +
-/// Python + gem/composer) — the preview "Errors:" section and the
-/// silent-mode stderr reporting share this.
-fn remove_error_messages(
-    npm: &[RemoveResult],
-    py: &[PthEditResult],
-    extra: &SetupOutcome,
-    cwd: &Path,
-) -> Vec<String> {
-    let mut errs: Vec<String> = npm
-        .iter()
-        .filter(|r| r.status == RemoveStatus::Error)
-        .filter_map(|r| Some(format_item_error(&r.path, r.error.as_deref()?, cwd)))
-        .chain(
-            py.iter()
-                .filter(|r| r.status == PthStatus::Error)
-                .filter_map(|r| Some(format_item_error(&r.path, r.error.as_deref()?, cwd))),
-        )
-        .collect();
-    errs.extend(outcome_error_messages(extra, cwd));
-    errs
-}
-
-/// Per-item error messages across the three setup result families (npm +
-/// Python + gem/composer) — the preview "Errors:" section and the
-/// silent-mode stderr reporting share this.
-fn setup_error_messages(
-    npm: &[UpdateResult],
-    py: &[PthEditResult],
-    extra: &SetupOutcome,
-    cwd: &Path,
-) -> Vec<String> {
-    let mut errs: Vec<String> = npm
-        .iter()
-        .filter(|r| r.status == UpdateStatus::Error)
-        .filter_map(|r| Some(format_item_error(&r.path, r.error.as_deref()?, cwd)))
-        .chain(
-            py.iter()
-                .filter(|r| r.status == PthStatus::Error)
-                .filter_map(|r| Some(format_item_error(&r.path, r.error.as_deref()?, cwd))),
-        )
-        .collect();
-    errs.extend(outcome_error_messages(extra, cwd));
-    errs
-}
-
-/// The `setup --remove` preview. Every section starts with a blank line (so
-/// the block never ends in a stray one before the summary or prompt).
-fn format_remove_preview(
-    npm: &[RemoveResult],
-    py: &[PthEditResult],
-    extra: &SetupOutcome,
-    cwd: &Path,
-) -> String {
-    let mut out = String::new();
-    let to_remove: Vec<_> = npm
-        .iter()
-        .filter(|r| r.status == RemoveStatus::Removed)
-        .collect();
-    if !to_remove.is_empty() {
-        out.push_str("\nWill remove socket-patch from:\n");
-        for r in &to_remove {
-            out.push_str(&format!("  - {}\n", pathdiff(&r.path, cwd)));
-            // Only the scripts the file actually has: a missing hook has
-            // nothing to remove.
-            for (key, old, new) in [
-                ("postinstall", &r.old_script, &r.new_script),
-                (
-                    "dependencies",
-                    &r.old_dependencies_script,
-                    &r.new_dependencies_script,
-                ),
-            ] {
-                if !old.is_empty() {
-                    out.push_str(&format_script_change(key, old, &render_removed(new)));
-                }
-            }
-        }
-    }
-    let py_remove: Vec<_> = py
-        .iter()
-        .filter(|r| r.status == PthStatus::Updated)
-        .collect();
-    if !py_remove.is_empty() {
-        out.push_str("\nWill remove the socket-patch[hook] dependency from:\n");
-        for r in &py_remove {
-            out.push_str(&format!("  - {}\n", pathdiff(&r.path, cwd)));
-        }
-    }
-    push_extra_preview(&mut out, extra);
-    // Surface failures so the "(see errors above)" line `run_remove` prints when
-    // nothing could be removed actually points at something.
-    push_errors(&mut out, &remove_error_messages(npm, py, extra, cwd));
-    // No header over an empty preview: `run_remove` then says there is
-    // nothing to remove.
-    if out.is_empty() {
-        return out;
-    }
-    format!("\nProposed changes:\n{out}")
-}
-
-/// The gem/composer preview lines, as their own blank-line-led section.
-fn push_extra_preview(out: &mut String, extra: &SetupOutcome) {
-    if !extra.preview.is_empty() {
-        out.push('\n');
-        for line in &extra.preview {
-            out.push_str(line);
-            out.push('\n');
-        }
-    }
-}
-
-/// The preview's "Errors:" section (nothing when there are none).
-fn push_errors(out: &mut String, errs: &[String]) {
-    if !errs.is_empty() {
-        out.push_str("\nErrors:\n");
-        for e in errs {
-            out.push_str(&format!("  ! {e}\n"));
-        }
-    }
-}
-
-fn print_remove_envelope(
-    status: &str,
-    npm: &[RemoveResult],
-    py: &[PthEditResult],
-    extra: &SetupOutcome,
-    warnings: &[String],
-) {
-    let removed = npm
-        .iter()
-        .filter(|r| r.status == RemoveStatus::Removed)
-        .count()
-        + py.iter().filter(|r| r.status == PthStatus::Updated).count()
-        + extra.changed;
-    let not_cfg = npm
-        .iter()
-        .filter(|r| r.status == RemoveStatus::NotConfigured)
-        .count()
-        + py.iter()
-            .filter(|r| r.status == PthStatus::AlreadyConfigured)
-            .count()
-        + extra.already;
-    let errors = npm
-        .iter()
-        .filter(|r| r.status == RemoveStatus::Error)
-        .count()
-        + py.iter().filter(|r| r.status == PthStatus::Error).count()
-        + extra.errors;
-
-    let mut files: Vec<serde_json::Value> = npm
-        .iter()
-        .map(|r| {
-            serde_json::json!({
-                "kind": "package_json",
-                "path": r.path,
-                "status": match r.status {
-                    RemoveStatus::Removed => "removed",
-                    RemoveStatus::NotConfigured => "not_configured",
-                    RemoveStatus::Error => "error",
-                },
-                "error": r.error,
-            })
-        })
-        .collect();
-    files.extend(py.iter().map(|r| {
-        serde_json::json!({
-            "kind": "pth",
-            "path": r.path,
-            "status": match r.status {
-                PthStatus::Updated => "removed",
-                PthStatus::AlreadyConfigured => "not_configured",
-                PthStatus::Error => "error",
-            },
-            "error": r.error,
-        })
-    }));
-    // extra.json_files already use the remove vocabulary
-    // (removed/not_configured/error), built by the gem/composer outcomes.
-    files.extend(extra.json_files.iter().cloned());
-
-    let mut obj = serde_json::json!({
-        "status": status,
-        "removed": removed,
-        "notConfigured": not_cfg,
-        "errors": errors,
-        "files": files,
-    });
-    if status == "dry_run" {
-        obj["dryRun"] = serde_json::json!(true);
-        obj["wouldRemove"] = serde_json::json!(removed);
-    }
-    if !warnings.is_empty() {
-        obj["warnings"] = serde_json::json!(warnings);
-    }
-    println!(
-        "{}",
-        serde_json::to_string_pretty(&obj)
-            .expect("serializing an in-memory JSON value cannot fail")
-    );
-}
-
-// ─────────────────────────────────────────────────────────────────────────
-// setup (npm package.json + Python .pth hook, combined)
-// ─────────────────────────────────────────────────────────────────────────
-
-/// Declining the `setup` / `setup --remove` prompt (the "<Action>
-/// cancelled." wording every other command uses).
-const SETUP_CANCELLED: &str = "Setup cancelled.";
-const REMOVE_CANCELLED: &str = "Hook removal cancelled.";
-
-/// The status line while `setup` discovers what to configure.
-const CONFIGURING: &str = "Configuring socket-patch install hooks...";
-
-async fn run_setup(args: &SetupArgs) -> i32 {
-    let common = &args.common;
-    // `--silent` is "errors only" (CLI_CONTRACT.md): mute the human-readable
-    // chatter just like `--json` does; the mutation and exit code are
-    // unaffected, and prompting follows the shared `confirm()` semantics.
-    let quiet = common.json || common.silent;
-    let mut status = crate::ui::StatusLine::stderr(common.json, common.silent);
-    status.set(CONFIGURING);
-
-    // Resolve the effective exclude set (persisted + `--exclude`); excluded
-    // members are skipped by discovery. Persisting it waits for the mutation
-    // gate below (past discovery and the confirm prompt) so a no-project
-    // directory or an aborted run leaves no `.socket/` behind.
-    let existing = read_setup_manifest(common).await;
-    let excludes = effective_excludes(manifest_view(&existing), &args.exclude);
-    let found = find_members(args).await;
-    let unmatched = found
-        .as_ref()
-        .map(|f| unmatched_excludes(f, &common.cwd, &excludes))
-        .unwrap_or_default();
-    if !unmatched.is_empty() {
-        // A permanent line: take the status down, then put it back.
-        status.finish();
-        warn_unmatched_excludes(common, &unmatched);
-        status.set(CONFIGURING);
-    }
-    // A new `--exclude` value that matches no member is warned about above
-    // and not persisted, so a typo does not ride into every later run and
-    // clone. Values already persisted stay (they warn on every run instead
-    // of being silently dropped from the user's manifest).
-    let persisted = effective_excludes(manifest_view(&existing), &[]);
-    let to_persist: Vec<String> = excludes
-        .iter()
-        .filter(|e| !unmatched.contains(e) || persisted.contains(e))
-        .cloned()
-        .collect();
-    let npm_files = found
-        .map(|f| select_members(f, &common.cwd, &excludes, &[]))
-        .unwrap_or_default();
-    let py_plan = plan_python(common).await;
-    // Gem + Composer projects are discovered ONCE and bundler probed ONCE:
-    // the preview and the real edit below share both.
-    let gem = discover_gem_target(common).await;
-    let gem_add = || {
-        gem.as_ref()
-            .map(|(project, probe)| (project, GemEdit::Add(probe)))
-    };
-    let composer_json = discover_composer_json(common).await;
-    // Gem + Composer previews (dry-run); `.present` also tells us each project exists.
-    let gem_preview = build_gem_outcome(common, gem_add(), true).await;
-    let composer_preview =
-        build_composer_outcome(common, composer_json.as_deref(), false, true).await;
-    status.finish();
-
-    if npm_files.is_empty()
-        && py_plan.is_none()
-        && !gem_preview.present
-        && !composer_preview.present
-    {
-        return report_no_files(
-            args,
-            &[("updated", 0), ("alreadyConfigured", 0), ("errors", 0)],
-        );
-    }
-
-    let gem_present = gem_preview.present;
-    let composer_present = composer_preview.present;
-    let extra_preview = merge_outcomes(gem_preview, composer_preview);
-
-    let npm_pm = detect_package_manager(&common.cwd).await;
-    let advisories = if npm_pm == PackageManager::Vlt && !npm_files.is_empty() {
-        vlt_setup_advisories(&common.cwd).await
-    } else {
-        Vec::new()
-    };
-
-    // `patch_setup` telemetry ("a successful setup") fires only on the two
-    // exit-0, non-dry-run paths below — never for a dry run, an aborted
-    // prompt, a no-project directory or an errored run.
-    let track_setup = || {
-        track_setup_success(
-            common,
-            !npm_files.is_empty(),
-            py_plan.is_some(),
-            gem_present,
-            composer_present,
-            npm_pm,
-        )
-    };
-
-    // Preview (always dry-run first).
-    let mut npm_preview = Vec::new();
-    for loc in &npm_files {
-        npm_preview.push(update_package_json(&loc.path, true, npm_pm).await);
-    }
-    let py_preview = match &py_plan {
-        Some(plan) => edit_python_manifests(plan, false, true).await,
-        None => Vec::new(),
-    };
-
-    let n_changes = npm_preview
-        .iter()
-        .filter(|r| r.status == UpdateStatus::Updated)
-        .count()
-        + py_preview
-            .iter()
-            .filter(|r| r.status == PthStatus::Updated)
-            .count()
-        + extra_preview.changed;
-    if !quiet {
-        print!(
-            "{}",
-            format_setup_preview(
-                &npm_preview,
-                &py_preview,
-                &extra_preview,
-                &common.cwd,
-                n_changes
-            )
-        );
-    }
-    print_advisories(common, &advisories);
-
-    let preview_errors = npm_preview
-        .iter()
-        .filter(|r| r.status == UpdateStatus::Error)
-        .count()
-        + py_preview
-            .iter()
-            .filter(|r| r.status == PthStatus::Error)
-            .count()
-        + extra_preview.errors;
-
-    if n_changes == 0 {
-        // No hook needs editing, so there is no preview to confirm — but an
-        // EXPLICIT new `--exclude` is the user's stated intent and is still
-        // persisted (never under --dry-run, which returns below with the
-        // preview). A skipped (fail-closed) persistence rides the warnings
-        // channel exactly like on the mutating path.
-        let warnings: Vec<String> = if !common.dry_run && !args.exclude.is_empty() {
-            persist_setup_excludes(common, &existing, &to_persist)
-                .await
-                .into_iter()
-                .collect()
-        } else {
-            Vec::new()
-        };
-        if common.json {
-            print_setup_envelope(
-                if preview_errors > 0 {
-                    "error"
-                } else {
-                    "already_configured"
-                },
-                &npm_preview,
-                &py_preview,
-                &extra_preview,
-                npm_pm,
-                py_plan.as_ref(),
-                &warnings,
-                &advisories,
-            );
-        } else if !common.silent {
-            if preview_errors > 0 {
-                println!(
-                    "\nNo hooks were changed; {} (see errors above).",
-                    plural(
-                        preview_errors,
-                        "item could not be processed",
-                        "items could not be processed"
-                    )
-                );
-            } else {
-                println!("All install hooks are already configured with socket-patch!");
-            }
-        }
-        print_warnings(common, &warnings);
-        eprint_errors(
-            common,
-            &setup_error_messages(&npm_preview, &py_preview, &extra_preview, &common.cwd),
-        );
-        if preview_errors > 0 {
-            return 1;
-        }
-        if !common.dry_run {
-            track_setup().await;
-        }
-        return 0;
-    }
-
-    if common.dry_run {
-        if common.json {
-            print_setup_envelope(
-                "dry_run",
-                &npm_preview,
-                &py_preview,
-                &extra_preview,
-                npm_pm,
-                py_plan.as_ref(),
-                &[],
-                &advisories,
-            );
-        } else if !common.silent {
-            println!("\nSummary (dry run):");
-            println!(
-                "  {}",
-                plural(n_changes, "item would be updated", "items would be updated")
-            );
-        }
-        eprint_errors(
-            common,
-            &setup_error_messages(&npm_preview, &py_preview, &extra_preview, &common.cwd),
-        );
-        return if preview_errors > 0 { 1 } else { 0 };
-    }
-
-    // Default-no on a terminal; proceeds when stdin is not interactive.
-    // Keep the prompt (or its non-interactive note) off the last preview
-    // line. With --yes nothing is printed there, and the progress line below
-    // already opens with its own blank line.
-    if !quiet && !common.yes {
-        eprintln!();
-    }
-    if !crate::ui::confirm_or_proceed("Proceed with these changes?", common) {
-        if !common.silent {
-            eprintln!("{SETUP_CANCELLED}");
-        }
-        return 0;
-    }
-
-    // Past the mutation gate: persist the exclude set now (a dry run
-    // returned above; an aborted or no-project run never gets here).
-    let persist_warning = persist_setup_excludes(common, &existing, &to_persist).await;
-
-    status.set("Applying changes...");
-
-    let mut npm_results = Vec::new();
-    for loc in &npm_files {
-        npm_results.push(update_package_json(&loc.path, false, npm_pm).await);
-    }
-    let mut py_results = Vec::new();
-    let mut warnings = Vec::new();
-    if let Some(plan) = &py_plan {
-        py_results = edit_python_manifests(plan, false, false).await;
-        warnings = finalize_python(plan, &py_results, &common.cwd).await;
-    }
-    // A skipped (fail-closed) --exclude persistence rides the same warnings
-    // channel: human summary line + `--json` envelope `warnings` array.
-    warnings.extend(persist_warning);
-    // Real gem + composer edits (gem Gemfile `plugin` block + generated plugin
-    // dir; composer.json script-event command).
-    let extra_results = merge_outcomes(
-        build_gem_outcome(common, gem_add(), false).await,
-        build_composer_outcome(common, composer_json.as_deref(), false, false).await,
-    );
-
-    // Materialise gem patches now so the first `bundle install` finds them
-    // applied. Best-effort → warnings only.
-    if gem_present {
-        warnings.extend(finalize_gem(common).await);
-    }
-    status.finish();
-
-    let errors = npm_results
-        .iter()
-        .filter(|r| r.status == UpdateStatus::Error)
-        .count()
-        + py_results
-            .iter()
-            .filter(|r| r.status == PthStatus::Error)
-            .count()
-        + extra_results.errors;
-    if errors == 0 {
-        track_setup().await;
-    }
-
-    if common.json {
-        print_setup_envelope(
-            if errors > 0 {
-                "partial_failure"
-            } else {
-                "success"
-            },
-            &npm_results,
-            &py_results,
-            &extra_results,
-            npm_pm,
-            py_plan.as_ref(),
-            &warnings,
-            &advisories,
-        );
-    } else if !common.silent {
-        let updated = npm_results
-            .iter()
-            .filter(|r| r.status == UpdateStatus::Updated)
-            .count()
-            + py_results
-                .iter()
-                .filter(|r| r.status == PthStatus::Updated)
-                .count()
-            + extra_results.changed;
-        println!("\nSummary:");
-        println!("  {}", plural(updated, "item updated", "items updated"));
-        if errors > 0 {
-            println!("  {}", plural(errors, "error", "errors"));
-        }
-        if let Some(plan) = &py_plan {
-            println!(
-                "\nCommit the {} dependency change (and your .socket/ patches) so \
-                 the hook re-applies in CI after install.",
-                plan.pm.as_str()
-            );
-        }
-        if gem_present {
-            println!(
-                "\nCommit the Gemfile (the `plugin` block), .socket/bundler-plugin/, and your \
-                 .socket/ patches so the Bundler plugin re-applies gem patches on every \
-                 `bundle install` (including cached/no-op installs in CI). The socket-patch CLI \
-                 must be on PATH wherever `bundle install` runs."
-            );
-        }
-    }
-
-    print_warnings(common, &warnings);
-    eprint_errors(
-        common,
-        &setup_error_messages(&npm_results, &py_results, &extra_results, &common.cwd),
-    );
-
-    if errors > 0 {
-        1
-    } else {
-        0
-    }
-}
-
-/// Fire `patch_setup` — "a successful `setup`". Attributed through the same
-/// layered credential chain as every other command (flag / env / socket-cli
-/// `config.json`), not the raw flag values: `setup` builds no API client (it
-/// is a purely local edit), so the config layer is consulted explicitly,
-/// exactly as `list` does — otherwise a caller authenticated by `socket
-/// login` alone reports anonymously to the public patch proxy (and, with an
-/// on-prem `apiBaseUrl`, to a different host than the client would use).
-async fn track_setup_success(
-    common: &GlobalArgs,
-    npm: bool,
-    py: bool,
-    gem: bool,
-    composer: bool,
-    npm_pm: PackageManager,
-) {
-    let manager = telemetry_manager_str(npm, py, gem, composer, npm_pm);
-    let (token, org) = common.telemetry_credentials();
-    track_patch_setup(&manager, token.as_deref(), org.as_deref()).await;
-}
-
-/// The `setup` preview (same blank-line-led sections as
-/// [`format_remove_preview`]). `n_changes == 0` leaves out the "already
-/// configured" count: the caller then says everything is configured, and
-/// the count would only repeat it.
-fn format_setup_preview(
-    npm: &[UpdateResult],
-    py: &[PthEditResult],
-    extra: &SetupOutcome,
-    cwd: &Path,
-    n_changes: usize,
-) -> String {
-    let mut out = String::new();
-    let npm_changes: Vec<_> = npm
-        .iter()
-        .filter(|r| r.status == UpdateStatus::Updated)
-        .collect();
-    if !npm_changes.is_empty() {
-        out.push_str("\npackage.json files to update:\n");
-        for r in &npm_changes {
-            out.push_str(&format!("  + {}\n", pathdiff(&r.path, cwd)));
-            out.push_str(&format!("    -> postinstall: \"{}\"\n", r.new_script));
-            // The run writes the `dependencies` hook too; show it when it
-            // changes, so the preview matches what is written.
-            if r.new_dependencies_script != r.old_dependencies_script {
-                out.push_str(&format!(
-                    "    -> dependencies: \"{}\"\n",
-                    r.new_dependencies_script
-                ));
-            }
-        }
-    }
-    let py_changes: Vec<_> = py
-        .iter()
-        .filter(|r| r.status == PthStatus::Updated)
-        .collect();
-    if !py_changes.is_empty() {
-        out.push_str("\nPython manifests to update (socket-patch[hook]):\n");
-        for r in &py_changes {
-            out.push_str(&format!("  + {}\n", pathdiff(&r.path, cwd)));
-        }
-    }
-    push_extra_preview(&mut out, extra);
-
-    let already = npm
-        .iter()
-        .filter(|r| r.status == UpdateStatus::AlreadyConfigured)
-        .count()
-        + py.iter()
-            .filter(|r| r.status == PthStatus::AlreadyConfigured)
-            .count()
-        + extra.already;
-    if already > 0 && n_changes > 0 {
-        out.push_str(&format!("\nAlready configured (will skip): {already}\n"));
-    }
-
-    push_errors(&mut out, &setup_error_messages(npm, py, extra, cwd));
-    out
-}
-
-#[allow(clippy::too_many_arguments)]
-fn print_setup_envelope(
-    status: &str,
-    npm: &[UpdateResult],
-    py: &[PthEditResult],
-    extra: &SetupOutcome,
-    npm_pm: PackageManager,
-    py_plan: Option<&PythonPlan>,
-    warnings: &[String],
-    advisories: &[(&str, String)],
-) {
-    let updated = npm
-        .iter()
-        .filter(|r| r.status == UpdateStatus::Updated)
-        .count()
-        + py.iter().filter(|r| r.status == PthStatus::Updated).count()
-        + extra.changed;
-    let already = npm
-        .iter()
-        .filter(|r| r.status == UpdateStatus::AlreadyConfigured)
-        .count()
-        + py.iter()
-            .filter(|r| r.status == PthStatus::AlreadyConfigured)
-            .count()
-        + extra.already;
-    let errors = npm
-        .iter()
-        .filter(|r| r.status == UpdateStatus::Error)
-        .count()
-        + py.iter().filter(|r| r.status == PthStatus::Error).count()
-        + extra.errors;
-
-    let mut files: Vec<serde_json::Value> = npm
-        .iter()
-        .map(|r| {
-            serde_json::json!({
-                "kind": "package_json",
-                "path": r.path,
-                "status": match r.status {
-                    UpdateStatus::Updated => "updated",
-                    UpdateStatus::AlreadyConfigured => "already_configured",
-                    UpdateStatus::Error => "error",
-                },
-                "error": r.error,
-            })
-        })
-        .collect();
-    files.extend(py.iter().map(|r| {
-        serde_json::json!({
-            "kind": "pth",
-            "path": r.path,
-            "status": match r.status {
-                PthStatus::Updated => "updated",
-                PthStatus::AlreadyConfigured => "already_configured",
-                PthStatus::Error => "error",
-            },
-            "error": r.error,
-        })
-    }));
-    files.extend(extra.json_files.iter().cloned());
-
-    let mut obj = serde_json::json!({
-        "status": status,
-        "updated": updated,
-        "alreadyConfigured": already,
-        "errors": errors,
-        "packageManager": manager_name(npm_pm),
-        "files": files,
-    });
-    if status == "dry_run" {
-        obj["dryRun"] = serde_json::json!(true);
-        obj["wouldUpdate"] = serde_json::json!(updated);
-    }
-    if let Some(plan) = py_plan {
-        obj["pythonPackageManager"] = serde_json::json!(plan.pm.as_str());
-    }
-    let warnings: Vec<String> = warnings
-        .iter()
-        .cloned()
-        .chain(
-            advisories
-                .iter()
-                .map(|(code, detail)| format!("{code}: {detail}")),
-        )
-        .collect();
-    if !warnings.is_empty() {
-        obj["warnings"] = serde_json::json!(warnings);
-    }
-    println!(
-        "{}",
-        serde_json::to_string_pretty(&obj)
-            .expect("serializing an in-memory JSON value cannot fail")
-    );
-}
-
-#[cfg(test)]
-mod tests {
-    //! Exact-string tests for setup's human output builders.
-    use super::*;
-
-    fn cwd() -> PathBuf {
-        PathBuf::from("/proj")
-    }
-
-    fn update(path: &str, status: UpdateStatus, err: Option<&str>) -> UpdateResult {
-        UpdateResult {
-            path: path.to_string(),
-            status,
-            old_script: String::new(),
-            new_script: "npx @socketsecurity/socket-patch apply --silent".to_string(),
-            old_dependencies_script: "npx @socketsecurity/socket-patch apply --silent".to_string(),
-            new_dependencies_script: "npx @socketsecurity/socket-patch apply --silent".to_string(),
-            error: err.map(str::to_string),
-        }
-    }
-
-    fn remove(path: &str, status: RemoveStatus) -> RemoveResult {
-        RemoveResult {
-            path: path.to_string(),
-            status,
-            old_script: "socket-patch apply && echo hi".to_string(),
-            new_script: Some("echo hi".to_string()),
-            old_dependencies_script: "socket-patch apply".to_string(),
-            new_dependencies_script: None,
-            error: None,
-        }
-    }
-
-    #[test]
-    fn no_files_message_follows_scope() {
-        let all = ["package.json", "Python", "Bundler", "Composer"];
-        assert_eq!(
-            format_no_files(&all, &[]),
-            "No package.json, Python, Bundler, or Composer project found"
-        );
-        assert_eq!(
-            format_no_files(&["package.json"], &["npm".to_string()]),
-            "No package.json project found"
-        );
-        assert_eq!(
-            format_no_files(&["Python", "Bundler"], &[]),
-            "No Python or Bundler project found"
-        );
-        assert_eq!(
-            format_no_files(&[], &["cargo".to_string(), "maven".to_string()]),
-            "Setup has no install hook for: cargo, maven (supported: npm, pypi, gem, composer)"
-        );
-    }
-
-    #[test]
-    fn no_files_message_reads_the_ecosystems_filter() {
-        let mut common = GlobalArgs::default();
-        assert_eq!(
-            no_files_message(&common),
-            "No package.json, Python, Bundler, or Composer project found"
-        );
-        common.ecosystems = Some(vec!["cargo".to_string()]);
-        assert!(no_files_message(&common).starts_with("Setup has no install hook for: cargo"));
-        common.ecosystems = Some(vec!["cargo".to_string(), "pypi".to_string()]);
-        assert_eq!(no_files_message(&common), "No Python project found");
-    }
-
-    #[test]
-    fn warnings_are_capitalized_for_humans() {
-        assert_eq!(
-            format_warning("not persisting --exclude: x"),
-            "Warning: Not persisting --exclude: x"
-        );
-        assert_eq!(
-            format_warning("`uv lock` failed"),
-            "Warning: `uv lock` failed"
-        );
-        assert_eq!(format_warning("écrit"), "Warning: Écrit");
-        assert_eq!(format_warning(""), "Warning:");
-    }
-
-    #[test]
-    fn unmatched_exclude_message_is_trimmed() {
-        assert_eq!(
-            format_unmatched_exclude(" nope"),
-            "--exclude \"nope\" matched no workspace member"
-        );
-        assert_eq!(
-            format_unmatched_exclude("pkgs/ü"),
-            "--exclude \"pkgs/ü\" matched no workspace member"
-        );
-    }
-
-    #[test]
-    fn check_lines_render_each_state() {
-        use CheckState::*;
-        assert_eq!(
-            format_check_line("package_json", "package.json", Configured, None),
-            "  ✓ package.json (configured)"
-        );
-        assert_eq!(
-            format_check_line("package_json", "package.json", NeedsConfiguration, None),
-            "  ✗ package.json (needs setup)"
-        );
-        assert_eq!(
-            format_check_line(
-                "patch",
-                "pkg:npm/minimist@1.2.5",
-                NeedsConfiguration,
-                Some("patch not applied on disk (hash_mismatch)")
-            ),
-            "  ✗ pkg:npm/minimist@1.2.5: patch not applied on disk (hash_mismatch)"
-        );
-        assert_eq!(
-            format_check_line("gemfile", "Gemfile", NeedsConfiguration, Some("x")),
-            "  ✗ Gemfile (needs setup: x)"
-        );
-        assert_eq!(
-            format_check_line(
-                "package_json",
-                "a/package.json",
-                Error,
-                Some("Invalid package.json: EOF")
-            ),
-            "  ! a/package.json: Invalid package.json: EOF"
-        );
-        assert_eq!(
-            format_check_line("pth", "req.txt", Error, None),
-            "  ! req.txt: unknown error"
-        );
-    }
-
-    #[test]
-    fn check_footer_names_the_fixing_command() {
-        assert_eq!(
-            format_check_footer(0, 0, 0),
-            "All manifests are configured with socket-patch."
-        );
-        assert_eq!(
-            format_check_footer(1, 0, 0),
-            "1 manifest needs configuration. Run `socket-patch setup` to add the missing \
-             install hooks."
-        );
-        assert_eq!(
-            format_check_footer(0, 1, 0),
-            "1 patch is not applied on disk. Run `socket-patch apply` to re-apply the patches."
-        );
-        assert_eq!(
-            format_check_footer(0, 0, 2),
-            "2 errors. Fix the errors above, then re-run `socket-patch setup --check`."
-        );
-        assert_eq!(
-            format_check_footer(3, 2, 1),
-            "3 manifests need configuration, 2 patches are not applied on disk, 1 error. \
-             Run `socket-patch setup` to add the missing install hooks. Run `socket-patch \
-             apply` to re-apply the patches. Fix the errors above, then re-run `socket-patch \
-             setup --check`."
-        );
-        for f in [format_check_footer(1, 1, 1), format_check_footer(2, 2, 2)] {
-            assert!(!f.contains("(s)"), "{f}");
-        }
-    }
-
-    #[test]
-    fn item_errors_name_the_file() {
-        assert_eq!(
-            format_item_error(
-                "/proj/packages/a/package.json",
-                "Invalid package.json: x",
-                &cwd()
-            ),
-            "packages/a/package.json: Invalid package.json: x"
-        );
-        assert_eq!(format_item_error("", "boom", &cwd()), "boom");
-        assert_eq!(
-            format_item_error("/elsewhere/p.json", "boom", &cwd()),
-            "/elsewhere/p.json: boom"
-        );
-    }
-
-    #[test]
-    fn setup_preview_layout() {
-        let npm = vec![
-            update("/proj/package.json", UpdateStatus::Updated, None),
-            update(
-                "/proj/packages/b/package.json",
-                UpdateStatus::AlreadyConfigured,
-                None,
-            ),
-            update(
-                "/proj/packages/bad/package.json",
-                UpdateStatus::Error,
-                Some("Invalid package.json: EOF"),
-            ),
-        ];
-        let out = format_setup_preview(&npm, &[], &SetupOutcome::default(), &cwd(), 1);
-        assert_eq!(
-            out,
-            "\npackage.json files to update:\n  + package.json\n    -> postinstall: \"npx \
-             @socketsecurity/socket-patch apply --silent\"\n\nAlready configured (will skip): \
-             1\n\nErrors:\n  ! packages/bad/package.json: Invalid package.json: EOF\n"
-        );
-        assert!(!out.contains("\n\n\n"), "{out:?}");
-    }
-
-    #[test]
-    fn setup_preview_shows_a_changed_dependencies_script() {
-        let mut r = update("/proj/package.json", UpdateStatus::Updated, None);
-        r.old_dependencies_script = String::new();
-        r.new_dependencies_script = "socket-patch apply --silent".to_string();
-        assert_eq!(
-            format_setup_preview(&[r], &[], &SetupOutcome::default(), &cwd(), 1),
-            "\npackage.json files to update:\n  + package.json\n    -> postinstall: \"npx \
-             @socketsecurity/socket-patch apply --silent\"\n    -> dependencies: \
-             \"socket-patch apply --silent\"\n"
-        );
-    }
-
-    #[test]
-    fn setup_preview_skips_already_count_when_nothing_changes() {
-        let npm = vec![update(
-            "/proj/package.json",
-            UpdateStatus::AlreadyConfigured,
-            None,
-        )];
-        assert_eq!(
-            format_setup_preview(&npm, &[], &SetupOutcome::default(), &cwd(), 0),
-            ""
-        );
-    }
-
-    #[test]
-    fn setup_preview_lists_gem_and_composer_lines() {
-        let extra = SetupOutcome {
-            preview: vec![
-                "Gem: add the socket-patch Bundler plugin wiring to:".to_string(),
-                "  + Gemfile".to_string(),
-            ],
-            changed: 1,
-            ..Default::default()
-        };
-        assert_eq!(
-            format_setup_preview(&[], &[], &extra, &cwd(), 1),
-            "\nGem: add the socket-patch Bundler plugin wiring to:\n  + Gemfile\n"
-        );
-    }
-
-    #[test]
-    fn cancel_lines_name_the_action() {
-        assert_eq!(SETUP_CANCELLED, "Setup cancelled.");
-        assert_eq!(REMOVE_CANCELLED, "Hook removal cancelled.");
-        assert_eq!(
-            SEARCHING,
-            "Searching for package.json / Python / Bundler / Composer manifests..."
-        );
-        assert_eq!(CONFIGURING, "Configuring socket-patch install hooks...");
-    }
-
-    #[test]
-    fn remove_preview_is_empty_when_nothing_would_change() {
-        let npm = vec![remove("/proj/package.json", RemoveStatus::NotConfigured)];
-        assert_eq!(
-            format_remove_preview(&npm, &[], &SetupOutcome::default(), &cwd()),
-            ""
-        );
-        assert_eq!(
-            format_items_failed(1),
-            "Error: 1 item could not be processed."
-        );
-        assert_eq!(
-            format_items_failed(2),
-            "Error: 2 items could not be processed."
-        );
-    }
-
-    #[test]
-    fn remove_preview_lists_only_the_scripts_the_file_has() {
-        let mut only_postinstall = remove("/proj/package.json", RemoveStatus::Removed);
-        only_postinstall.old_script =
-            "npx @socketsecurity/socket-patch apply --silent --ecosystems npm".to_string();
-        only_postinstall.new_script = None;
-        only_postinstall.old_dependencies_script = String::new();
-        only_postinstall.new_dependencies_script = None;
-        let out = format_remove_preview(&[only_postinstall], &[], &SetupOutcome::default(), &cwd());
-        assert_eq!(
-            out,
-            "\nProposed changes:\n\nWill remove socket-patch from:\n  - package.json\n    \
-             postinstall:    \"npx @socketsecurity/socket-patch apply --silent --ecosystems \
-             npm\"\n    -> postinstall: (removed)\n"
-        );
-        assert_eq!(
-            format_script_change("dependencies", "socket-patch apply", "(removed)"),
-            "    dependencies:    \"socket-patch apply\"\n    -> dependencies: (removed)\n"
-        );
-    }
-
-    #[test]
-    fn remove_preview_layout_has_no_double_blank_lines() {
-        let npm = vec![remove("/proj/package.json", RemoveStatus::Removed)];
-        let py = vec![PthEditResult {
-            path: "/proj/requirements.txt".to_string(),
-            status: PthStatus::Updated,
-            error: None,
-        }];
-        let extra = SetupOutcome {
-            preview: vec![
-                "Gem: remove the socket-patch Bundler plugin wiring from:".to_string(),
-                "  - Gemfile".to_string(),
-            ],
-            ..Default::default()
-        };
-        let out = format_remove_preview(&npm, &py, &extra, &cwd());
-        assert_eq!(
-            out,
-            "\nProposed changes:\n\nWill remove socket-patch from:\n  - package.json\n    \
-             postinstall:    \"socket-patch apply && echo hi\"\n    -> postinstall: \"echo \
-             hi\"\n    dependencies:    \"socket-patch apply\"\n    -> dependencies: \
-             (removed)\n\nWill remove the socket-patch[hook] dependency from:\n  - \
-             requirements.txt\n\nGem: remove the socket-patch Bundler plugin wiring from:\n  \
-             - Gemfile\n"
-        );
-        assert!(!out.contains("\n\n\n"), "{out:?}");
-        assert!(
-            out.ends_with("Gemfile\n"),
-            "no trailing blank line: {out:?}"
-        );
-    }
-
-    #[test]
-    fn vlt_is_its_own_telemetry_and_envelope_manager() {
-        assert_eq!(manager_name(PackageManager::Vlt), "vlt");
-        assert_eq!(
-            telemetry_manager_str(true, true, false, false, PackageManager::Vlt),
-            "vlt+pypi"
-        );
-    }
-
-    #[test]
-    fn vlt_root_scripts_advisory_is_definite_only_below_rc13() {
-        let reported = |v: &str| VltVersionProbe::Reported(v.to_string());
-        for old in [
-            "0.0.0-1",
-            "0.0.0-0.1733957343934",
-            "0.0.0-32",
-            "1.0.0-rc.9",
-            "1.0.0-rc.12",
-        ] {
-            assert_eq!(
-                vlt_root_scripts_advisory(&reported(old), None).as_deref(),
-                Some(
-                    format!(
-                        "vlt before 1.0.0-rc.13 does not run the root postinstall hook; \
-                         upgrade vlt or run `socket-patch apply` after `vlt ci` (`vlt \
-                         --version` reports {old})"
-                    )
-                    .as_str()
-                ),
-                "{old}"
-            );
-        }
-        for new in ["1.0.0-rc.13", "1.0.0-rc.14", "1.0.0", "1.2.0"] {
-            assert_eq!(
-                vlt_root_scripts_advisory(&reported(new), None),
-                None,
-                "{new}"
-            );
-        }
-    }
-
-    #[test]
-    fn vlt_root_scripts_advisory_is_a_may_for_a_lock_the_reported_vlt_never_writes() {
-        let reported = |v: &str| VltVersionProbe::Reported(v.to_string());
-        let may = |version: &str| {
-            format!(
-                "vlt before 1.0.0-rc.13 does not run the root postinstall hook; upgrade vlt \
-                 or run `socket-patch apply` after `vlt ci` (vlt-lock.json {version}, so this \
-                 project may be installed by such a vlt)"
-            )
-        };
-        for writes_v0 in ["1.0.0-rc.13", "1.0.0-rc.14"] {
-            assert_eq!(
-                vlt_root_scripts_advisory(&reported(writes_v0), Some(LegacyVltLock::VersionZero)),
-                None,
-                "{writes_v0}"
-            );
-        }
-        for refuses_v0 in ["1.0.0-rc.15", "1.0.1", "1.2.0"] {
-            assert_eq!(
-                vlt_root_scripts_advisory(&reported(refuses_v0), Some(LegacyVltLock::VersionZero)),
-                Some(may("has lockfileVersion 0")),
-                "{refuses_v0}"
-            );
-        }
-        for new in ["1.0.0-rc.13", "1.0.0-rc.14", "1.2.0"] {
-            assert_eq!(
-                vlt_root_scripts_advisory(&reported(new), Some(LegacyVltLock::NoVersion)),
-                Some(may("has no lockfileVersion")),
-                "{new}"
-            );
-        }
-    }
-
-    #[test]
-    fn vlt_root_scripts_advisory_never_fires_on_an_unparseable_version() {
-        for raw in [
-            "",
-            "vlt 1.0.0-rc.12",
-            "v0.0.0-32",
-            "rc.12",
-            "1.0.0-rc.12\nextra",
-        ] {
-            assert_eq!(
-                vlt_root_scripts_advisory(
-                    &VltVersionProbe::Reported(raw.to_string()),
-                    Some(LegacyVltLock::NoVersion)
-                ),
-                None,
-                "{raw:?}"
-            );
-        }
-    }
-
-    #[test]
-    fn vlt_root_scripts_advisory_falls_back_to_a_may_from_the_lock() {
-        let probe = VltVersionProbe::Unavailable;
-        assert_eq!(vlt_root_scripts_advisory(&probe, None), None);
-        assert_eq!(
-            vlt_root_scripts_advisory(&probe, Some(LegacyVltLock::VersionZero)).as_deref(),
-            Some(
-                "vlt before 1.0.0-rc.13 does not run the root postinstall hook; upgrade vlt \
-                 or run `socket-patch apply` after `vlt ci` (vlt-lock.json has lockfileVersion \
-                 0, so this project may be installed by such a vlt)"
-            )
-        );
-        assert!(
-            vlt_root_scripts_advisory(&probe, Some(LegacyVltLock::NoVersion))
-                .unwrap()
-                .contains("(vlt-lock.json has no lockfileVersion, so this project may")
-        );
-    }
-}
diff --git a/crates/socket-patch-cli/src/commands/update.rs b/crates/socket-patch-cli/src/commands/update.rs
index dc8fe2be..d75138fd 100644
--- a/crates/socket-patch-cli/src/commands/update.rs
+++ b/crates/socket-patch-cli/src/commands/update.rs
@@ -144,16 +144,6 @@ fn confirm_prompt(current: &semver::Version, target: &semver::Version) -> String
     }
 }
 
-/// The line after a declined [`confirm_prompt`], naming the same action.
-fn cancelled_message(current: &semver::Version, target: &semver::Version) -> &'static str {
-    if target < current {
-        "Downgrade cancelled."
-    } else if target == current {
-        "Reinstall cancelled."
-    } else {
-        "Update cancelled."
-    }
-}
 
 /// The result line after a successful install, naming the same action as
 /// [`confirm_prompt`].
@@ -356,7 +346,7 @@ pub async fn run(args: UpdateArgs) -> i32 {
     let prompt = confirm_prompt(&current, &target_version);
     if !crate::ui::confirm(&prompt, true, &args.common) {
         if !quiet {
-            eprintln!("{}", cancelled_message(&current, &target_version));
+            eprintln!("{}", crate::ui::CANCELLED);
         }
         return 1;
     }
@@ -497,10 +487,7 @@ mod tests {
     }
 
     #[test]
-    fn cancel_and_result_lines_match_the_prompt() {
-        assert_eq!(cancelled_message(&v("4.0.0"), &v("9.9.9")), "Update cancelled.");
-        assert_eq!(cancelled_message(&v("4.0.0"), &v("3.0.0")), "Downgrade cancelled.");
-        assert_eq!(cancelled_message(&v("4.0.0"), &v("4.0.0")), "Reinstall cancelled.");
+    fn result_lines_match_the_prompt() {
         let p = std::path::Path::new("/opt/sp/socket-patch");
         assert_eq!(
             installed_message(&v("4.0.0"), &v("9.9.9"), p),
diff --git a/crates/socket-patch-cli/src/commands/vendor.rs b/crates/socket-patch-cli/src/commands/vendor.rs
index efc8f044..38ab3964 100644
--- a/crates/socket-patch-cli/src/commands/vendor.rs
+++ b/crates/socket-patch-cli/src/commands/vendor.rs
@@ -408,13 +408,12 @@ fn advisory_tier(code: &str) -> AdvisoryTier {
 }
 
 /// The human line for a vendor advisory, or `None` when it is hidden at
-/// this verbosity. The stable code is kept on real warnings (it is what
-/// a user searches for); notes carry only the detail.
+/// this verbosity. The stable code is JSON-only (`warnings[].code`).
 pub(crate) fn format_advisory(code: &str, detail: &str, verbose: bool) -> Option<String> {
     match advisory_tier(code) {
         AdvisoryTier::Verbose if !verbose => None,
         AdvisoryTier::Verbose | AdvisoryTier::Note => Some(format!("Note: {detail}")),
-        AdvisoryTier::Warning => Some(format!("Warning ({code}): {detail}")),
+        AdvisoryTier::Warning => Some(format!("Warning: {detail}")),
     }
 }
 
@@ -634,7 +633,7 @@ pub(crate) fn note_classic_migration_risk(
         return;
     };
     if !common.silent && !common.json {
-        eprintln!("Warning ({}): {}", w.code, w.detail);
+        eprintln!("Warning: {}", w.detail);
     }
     env.warnings.push(RunWarning {
         code: w.code.to_string(),
@@ -3394,45 +3393,54 @@ pub(crate) async fn vendor_records_reusing(
             // package.json `pnpm.overrides` mirror is ignored), so pnpm-wired
             // runs must name that file among the committables: a checkout
             // that loses it silently unvendors on the next install.
-            if wired_flavors.contains("pnpm") {
-                println!(
-                    "Commit .socket/vendor/, package.json, pnpm-lock.yaml, and \
-                     pnpm-workspace.yaml to make the patches portable (pnpm >=11 reads \
-                     the vendored override only from pnpm-workspace.yaml)."
-                );
+            let commit = if wired_flavors.contains("pnpm") {
+                ".socket/vendor/, package.json, pnpm-lock.yaml, and pnpm-workspace.yaml to \
+                 make the patches portable (pnpm >=11 reads the vendored override only from \
+                 pnpm-workspace.yaml)"
             } else if wired_flavors.contains("vlt") {
-                println!("{VLT_COMMIT_HINT}");
+                VLT_COMMIT_HINT
             } else {
-                println!(
-                    "Commit .socket/vendor/ and the updated lockfiles to make the patches \
-                     portable."
-                );
-            }
-            if wired_flavors.contains("bun") && common.cwd.join("bun.lockb").exists() {
-                println!("For binary Bun workspaces, also commit the workspace members' .socket/vendor/ tarballs recorded in the vendor ledger.");
-            }
+                ".socket/vendor/ and the updated lockfiles to make the patches portable"
+            };
             let mut installs: Vec<&str> = wired_flavors
                 .iter()
                 .filter_map(|f| flavor_install_command(f))
                 .collect();
             installs.sort_unstable();
-            for cmd in installs {
-                println!(
-                    "Run `{cmd}` to update the installed tree — vendoring rewires the \
-                     lockfile only, so the current node_modules keeps the unpatched bytes \
-                     until reinstalled."
+            installs.dedup();
+            let reinstall = if installs.is_empty() {
+                "Reinstall from the updated lockfile so the installed packages pick up the \
+                 vendored artifacts"
+                    .to_string()
+            } else {
+                let cmds: Vec<String> = installs.iter().map(|c| format!("`{c}`")).collect();
+                format!(
+                    "Run {} to update the installed tree (vendoring rewires the lockfile \
+                     only; the current install keeps the unpatched bytes until reinstalled)",
+                    cmds.join(" and ")
+                )
+            };
+            let mut extra = Vec::new();
+            if wired_flavors.contains("bun") && common.cwd.join("bun.lockb").exists() {
+                extra.push(
+                    "For binary Bun workspaces, also commit the workspace members' \
+                     .socket/vendor/ tarballs recorded in the vendor ledger."
+                        .to_string(),
                 );
             }
+            for line in crate::ui::next_steps(commit, &reinstall, &extra) {
+                println!("{line}");
+            }
         }
     }
 
     has_errors
 }
 
-/// The committable-files hint of a vlt-wired run.
-const VLT_COMMIT_HINT: &str = "Commit package.json (and workspace package.json files), \
+/// What a vlt-wired run commits (the "Commit …" next step).
+const VLT_COMMIT_HINT: &str = "package.json (and workspace package.json files), \
      vlt-lock.json and .socket/vendor/ (the .gitignore there re-includes the payload and keeps \
-     vlt's node_modules links out of git); CI: `vlt ci`.";
+     vlt's node_modules links out of git); CI: `vlt ci`";
 
 /// The install command that re-materializes the project tree from the wired
 /// lockfile, per npm-family flavor. Vendoring edits ONLY the lockfile/config
@@ -3998,9 +4006,9 @@ pub(crate) async fn run_vendor_gc(
 /// Human-mode stderr line for a pass-level GC problem (the GC has no
 /// envelope of its own; JSON consumers see it as `scan --prune --json`'s
 /// `gc.skipped` / `gc.warnings`). Muted under `--json` and `--silent`.
-fn gc_note(common: &GlobalArgs, code: &str, detail: &str) {
+fn gc_note(common: &GlobalArgs, _code: &str, detail: &str) {
     if !common.json && !common.silent {
-        eprintln!("Warning ({code}): {detail}");
+        eprintln!("Warning: {detail}");
     }
 }
 
@@ -5903,7 +5911,7 @@ mod ui_format_tests {
         );
         assert_eq!(
             format_advisory("vendor_lock_entry_drifted", "drifted", false),
-            Some("Warning (vendor_lock_entry_drifted): drifted".to_string())
+            Some("Warning: drifted".to_string())
         );
     }
 
diff --git a/crates/socket-patch-cli/src/commands/vex.rs b/crates/socket-patch-cli/src/commands/vex.rs
index cae0946d..e5501673 100644
--- a/crates/socket-patch-cli/src/commands/vex.rs
+++ b/crates/socket-patch-cli/src/commands/vex.rs
@@ -20,11 +20,9 @@ use std::collections::HashMap;
 use std::path::{Path, PathBuf};
 
 use clap::Args;
-use socket_patch_core::crawlers::Ecosystem;
 use socket_patch_core::manifest::operations::read_manifest;
 use socket_patch_core::manifest::schema::{PatchManifest, PatchRecord};
 use socket_patch_core::telemetry::{track_vex_failed, track_vex_generated};
-use socket_patch_core::vendor::state::VendorState;
 use socket_patch_core::vex::{
     build_document, detect_product, BuildOptions, Document, FailedPatch, VendorContext,
     VerifyOutcome,
@@ -39,15 +37,6 @@ use crate::ecosystem_dispatch::{collapse_to_first, find_manifest_package_copies_
 use crate::json_envelope::{Command, Envelope, EnvelopeError, PatchAction, PatchEvent, RunWarning};
 use crate::ui::plural;
 
-/// Routing tag for a patch omitted from VEX by the property-7 ecosystem
-/// filter alone: the patch IS applied (byte-verified, or trusted under
-/// `--no-verify`) and carries vulnerability metadata, but its ecosystem has
-/// no install hook set up and is not declared `manual`. Distinct from the
-/// verification tags (`hash_mismatch`, `package_not_found`, …) so a JSON
-/// consumer can tell "not patched" from "patched but not persisted by any
-/// hook".
-const ECOSYSTEM_NOT_SETUP: &str = "ecosystem_not_setup";
-
 #[derive(Args)]
 pub struct VexArgs {
     #[command(flatten)]
@@ -470,28 +459,6 @@ fn org_looks_like_path(org: Option<&str>) -> Option<String> {
     })
 }
 
-/// Map a `setup.manual` entry to an `Ecosystem`, case-insensitively.
-/// Accepts the canonical `cli_name`, the aliases `go`, `python`, `ruby`,
-/// `rust`, `php`, `java`, `dotnet` and `jsr`, and the npm-family package
-/// manager names (`yarn`/`pnpm`/`bun`/`vlt`). Unrecognized names yield
-/// `None` and are ignored.
-fn ecosystem_from_manual_name(name: &str) -> Option<Ecosystem> {
-    match name.to_ascii_lowercase().as_str() {
-        "npm" | "yarn" | "pnpm" | "bun" | "vlt" => Some(Ecosystem::Npm),
-        "pypi" | "python" => Some(Ecosystem::Pypi),
-        "gem" | "ruby" => Some(Ecosystem::Gem),
-        "cargo" | "rust" => Some(Ecosystem::Cargo),
-        "golang" | "go" => Some(Ecosystem::Golang),
-        "composer" | "php" => Some(Ecosystem::Composer),
-        // The apply-only ecosystems are the primary use of `manual` (hand-applied
-        // patches with no auto-install hook); they must map too.
-        "maven" | "java" => Some(Ecosystem::Maven),
-        "nuget" | "dotnet" => Some(Ecosystem::Nuget),
-        "deno" | "jsr" => Some(Ecosystem::Deno),
-        _ => None,
-    }
-}
-
 /// Core VEX pipeline shared by the standalone `vex` command and the
 /// embedded `apply`/`vendor`/`scan` `--vex` paths: resolve the product, verify the
 /// plan's record view against disk (unless `no_verify`), build the OpenVEX
@@ -723,72 +690,13 @@ async fn generate_vex(
         );
     }
 
-    // Property 7: attest a patch only for an ecosystem that is actually set up —
-    // or explicitly declared `manual` in the manifest. Patches for an ecosystem
-    // that is neither are dropped regardless of verification mode (so even
-    // `--no-verify` won't attest an un-set-up ecosystem's patches).
-    // Exemption: VENDORED patches bypass the filter — the committed
-    // `.socket/vendor/` artifact + lockfile wiring IS the persistence
-    // mechanism, so no install hook exists (or is needed) by construction.
-    let vendored_set: std::collections::HashSet<String> =
-        outcome.vendored.iter().cloned().collect();
-    // Redirected (hosted) patches bypass the filter for the same reason: the
-    // committed lockfile rewrite IS the persistence mechanism.
-    let redirected_set: std::collections::HashSet<&str> =
-        redirected.iter().map(|s| s.as_str()).collect();
-    let mut allowed = crate::commands::setup::configured_ecosystems(common).await;
-    if let Some(s) = &manifest.setup {
-        for name in &s.manual {
-            if let Some(e) = ecosystem_from_manual_name(name) {
-                allowed.insert(e);
-            }
-        }
-    }
-    let mut setup_filtered: Vec<String> = Vec::new();
-    outcome.applied.retain(|purl| {
-        let keep = vendored_set.contains(purl)
-            || redirected_set.contains(purl.as_str())
-            || Ecosystem::from_purl(purl)
-                .map(|e| allowed.contains(&e))
-                .unwrap_or(false);
-        if !keep {
-            setup_filtered.push(purl.clone());
-        }
-        keep
-    });
-    let any_setup_filtered = !setup_filtered.is_empty();
-    // The filter drops join the omission channel (`failed`) with their own
-    // routing tag so they surface as per-purl `skipped` events in the
-    // envelope — success and error paths alike.
-    outcome
-        .failed
-        .extend(setup_filtered.into_iter().map(|purl| FailedPatch {
-            purl,
-            reason: ECOSYSTEM_NOT_SETUP.to_string(),
-        }));
     // `failed` is built by iterating the record view's HashMap: without a
     // sort the omission order (stderr, the error list and the JSON
     // `skipped` events) changes run to run.
     outcome
         .failed
         .sort_by(|a, b| (&a.purl, &a.reason).cmp(&(&b.purl, &b.reason)));
-
-    // When nothing attests and EVERY omission was the property-7 filter,
-    // the run fails with a message that explains the setup cause itself
-    // (see below), so the generic note would only repeat it.
-    let all_setup_drops = outcome.applied.is_empty()
-        && !outcome.failed.is_empty()
-        && outcome
-            .failed
-            .iter()
-            .all(|f| f.reason == ECOSYSTEM_NOT_SETUP);
     if !common.silent && !common.json {
-        if any_setup_filtered && !all_setup_drops {
-            eprintln!(
-                "Note: patches for ecosystems that are not set up (and not declared `manual` \
-                 in .socket/manifest.json's `setup.manual`) are omitted from VEX."
-            );
-        }
         for f in &outcome.failed {
             eprintln!("{}", format_omission_warning(&f.purl, &f.reason));
         }
@@ -818,18 +726,7 @@ async fn generate_vex(
         None => {
             let (token, org) = common.telemetry_credentials();
             track_vex_failed("no_applicable_patches", token.as_deref(), org.as_deref()).await;
-            // When nothing attested and EVERY omission was the property-7
-            // filter, say so: those patches ARE applied with vulnerability
-            // metadata, and the generic message below would read as "not
-            // patched" to a human. The code stays `no_applicable_patches` —
-            // it is the documented exit-1 routing tag consumers already
-            // branch on; the per-event `ecosystem_not_setup` errorCode is
-            // the machine-readable discriminator.
-            let message = if all_setup_drops {
-                format_setup_drops_message(outcome.failed.len())
-            } else {
-                "No applied patches with vulnerability metadata to attest.".to_string()
-            };
+            let message = "No applied patches with vulnerability metadata to attest.".to_string();
             return Err(VexGenError {
                 code: "no_applicable_patches",
                 message,
@@ -1169,7 +1066,7 @@ async fn generate_vex_from_manifest_path_inner(
 /// Fire `vex_failed` telemetry and build the matching [`VexGenError`].
 /// Centralizes the "track then return error" pattern in [`generate_vex`].
 /// Attribution goes through the same layered credential chain as
-/// `list`/`setup` (flag / env / socket-cli `config.json`), not the raw
+/// `list` (flag / env / socket-cli `config.json`), not the raw
 /// flags — a `socket login`-only user must not report anonymously.
 async fn fail(common: &GlobalArgs, code: &'static str, message: String) -> VexGenError {
     let (token, org) = common.telemetry_credentials();
@@ -1251,78 +1148,7 @@ fn join_and(items: &[&str]) -> String {
     }
 }
 
-/// The one `unreadable vendor state` advisory (contract: `setup --check`
-/// surfaces a ledger it cannot read or parse as this line, muted by
-/// `--silent`): a read-only consumer degrades to "nothing vendored" and says
-/// so, on stderr, so the operator learns why nothing verifies. (`vex` itself
-/// refuses an unreadable ledger outright — `vendor_ledger_corrupt` — since
-/// the ledger's entries gate what attests.)
-pub(crate) fn warn_unreadable_vendor_state(common: &GlobalArgs, e: &std::io::Error) {
-    if !common.silent {
-        eprintln!(
-            "Warning: {}",
-            vendor_state_unreadable_message(&e.to_string())
-        );
-    }
-}
-
-/// Build the [`VendorContext`] for `setup --check`'s patch-consistency pass
-/// from `ledger` — the caller's ONE `load_state` of
-/// `.socket/vendor/state.json` (it also fed the vendor-record fold) — plus
-/// synthesized entries for the legacy `.socket/go-patches/` redirect
-/// backend: a vendored patch is judged by the committed artifact, never the
-/// installed tree. (`vex` itself builds its context from the gated plan
-/// instead, so a ledger entry no lockfile wires never routes its
-/// verification.)
-///
-/// Go-patches synthesis: an apply-redirected Go patch leaves the module
-/// cache pristine (the `replace` directive routes the build at the copy
-/// dir), so the copy dir is what verification must hash.
-///
-/// An unreadable/corrupt vendor ledger degrades to "no vendor entries":
-/// vendored PURLs then fall through to the installed tree, fail
-/// verification there, and are omitted — fail-closed, never falsely
-/// attested. The degrade is returned as a warning detail for the caller to
-/// report in its own channel. The context is `None` when there is nothing
-/// vendored and no redirect to synthesize (the common case).
-pub(crate) async fn vendor_context_from(
-    common: &GlobalArgs,
-    manifest: &PatchManifest,
-    ledger: std::io::Result<VendorState>,
-) -> (Option<VendorContext>, Option<String>) {
-    let (entries, warning) = match ledger {
-        Ok(state) => (state.entries, None),
-        Err(e) => (
-            HashMap::new(),
-            Some(vendor_state_unreadable_message(&e.to_string())),
-        ),
-    };
-
-    let go_patches = synthesize_go_patches(common, manifest, &entries).await;
-
-    if entries.is_empty() && go_patches.is_empty() {
-        return (None, warning);
-    }
-    let context = VendorContext {
-        project_root: common.cwd.clone(),
-        entries,
-        go_patches,
-        hosted: HashMap::new(),
-    };
-    (Some(context), warning)
-}
-
-/// The unreadable-`.socket/vendor/state.json` advisory (`cause` is
-/// `load_state`'s error, which names the file).
-pub(crate) fn vendor_state_unreadable_message(cause: &str) -> String {
-    format!(
-        "Unreadable vendor state ({cause}); vendored patches cannot be verified from the \
-         committed artifact"
-    )
-}
-
-/// Synthesize go-patches redirect targets for [`vendor_context_from`] and
-/// `vex`: for every socket-owned (`.socket/go-patches/`) `replace` in
+/// Synthesize go-patches redirect targets for `vex`: for every socket-owned (`.socket/go-patches/`) `replace` in
 /// `go.mod` whose module+version maps to a golang PURL of the record view
 /// (`manifest` — for `vex` the merged manifest + ledger + lockfile view, so
 /// a manifest-less project's ledger-recorded Go patch verifies too) with no
@@ -1413,10 +1239,6 @@ fn emit_envelope_error(
 /// machine-readable `errorCode`).
 fn omission_phrase(reason: &str) -> &'static str {
     match reason {
-        ECOSYSTEM_NOT_SETUP => {
-            "applied, but its ecosystem has no install hook set up and is not declared \
-             `manual` in setup.manual"
-        }
         "package_not_found" => "the package is not installed",
         "not_applied" => "the patched files still hold the original content",
         "hash_mismatch" => "a patched file matches neither the original nor the patched content",
@@ -1449,7 +1271,7 @@ fn omission_phrase(reason: &str) -> &'static str {
              package any more"
         }
         REDIRECT_UNWIRED => {
-            "the redirect ledger records it, but no lockfile wires its hosted patch to this \
+            "the hosted ledger records it, but no lockfile wires its hosted patch to this \
              package any more"
         }
         WIRING_CONFLICT => {
@@ -1472,29 +1294,7 @@ fn format_omission_warning(purl: &str, reason: &str) -> String {
 /// Human `reason` string for an omission event; the routing tag rides
 /// `errorCode`.
 fn omission_reason_message(reason: &str) -> String {
-    if reason == ECOSYSTEM_NOT_SETUP {
-        "applied patch omitted from VEX: its ecosystem has no install hook set up and is not \
-         declared `manual` in setup.manual"
-            .to_string()
-    } else {
-        format!("patch omitted from VEX: {}", omission_phrase(reason))
-    }
-}
-
-/// The `no_applicable_patches` message when every omission was the
-/// property-7 setup filter.
-fn format_setup_drops_message(n: usize) -> String {
-    let (subject, verb, their, ecosystems) = if n == 1 {
-        ("applied patch", "was", "its", "ecosystem is")
-    } else {
-        ("applied patches", "were", "their", "ecosystems are")
-    };
-    format!(
-        "{n} {subject} with vulnerability metadata {verb} omitted from VEX because {their} \
-         {ecosystems} not set up (no install hook) and not declared `manual` in \
-         .socket/manifest.json's `setup.manual`. Run `socket-patch setup`, or add the \
-         ecosystem to `setup.manual`, then re-run."
-    )
+    format!("patch omitted from VEX: {}", omission_phrase(reason))
 }
 
 fn emit_envelope_success(summary: &VexWriteSummary, dry_run: bool) {
@@ -1535,44 +1335,6 @@ mod tests {
     use super::*;
     use clap::Parser;
 
-    // Property 7: every ecosystem a PURL can classify to must also be
-    // declarable `manual` (apply-only maven/nuget/deno are its primary use).
-    #[test]
-    fn ecosystem_from_manual_name_maps_every_ecosystem() {
-        assert_eq!(ecosystem_from_manual_name("npm"), Some(Ecosystem::Npm));
-        assert_eq!(ecosystem_from_manual_name("vlt"), Some(Ecosystem::Npm));
-        assert_eq!(ecosystem_from_manual_name("PyPI"), Some(Ecosystem::Pypi)); // case-insensitive
-        assert_eq!(ecosystem_from_manual_name("python"), Some(Ecosystem::Pypi));
-        assert_eq!(ecosystem_from_manual_name("ruby"), Some(Ecosystem::Gem));
-        assert_eq!(ecosystem_from_manual_name("nonsense"), None);
-        assert_eq!(ecosystem_from_manual_name("cargo"), Some(Ecosystem::Cargo));
-        assert_eq!(ecosystem_from_manual_name("go"), Some(Ecosystem::Golang));
-        assert_eq!(
-            ecosystem_from_manual_name("composer"),
-            Some(Ecosystem::Composer)
-        );
-        assert_eq!(ecosystem_from_manual_name("maven"), Some(Ecosystem::Maven));
-        assert_eq!(ecosystem_from_manual_name("nuget"), Some(Ecosystem::Nuget));
-        assert_eq!(ecosystem_from_manual_name("deno"), Some(Ecosystem::Deno));
-    }
-
-    // Every `Ecosystem::all()` variant must round-trip through its `cli_name`
-    // via `ecosystem_from_manual_name`, or its `manual`-declared patches are
-    // silently dropped by the `retain` in `generate_vex`.
-    #[test]
-    fn every_compiled_ecosystem_is_declarable_manual_via_cli_name() {
-        for &e in Ecosystem::all() {
-            assert_eq!(
-                ecosystem_from_manual_name(e.cli_name()),
-                Some(e),
-                "ecosystem {:?} (cli_name {:?}) is not reachable via ecosystem_from_manual_name — \
-                 its `manual`-declared patches would be silently dropped from VEX",
-                e,
-                e.cli_name(),
-            );
-        }
-    }
-
     /// The go-patches synthesis guards its copy-dir keys with core's
     /// `are_safe_redirect_coords`; pin the accept/reject set from the CLI
     /// side — a regression here would let a tampered go.mod `replace` key
@@ -1660,30 +1422,6 @@ mod tests {
         assert_eq!(format_vex_emitted(12), "Emitted 12 VEX statements");
     }
 
-    #[test]
-    fn setup_drops_message_agrees_in_number() {
-        let one = format_setup_drops_message(1);
-        assert!(
-            one.starts_with(
-                "1 applied patch with vulnerability metadata was omitted from VEX because its \
-                 ecosystem is not set up (no install hook)"
-            ),
-            "{one}"
-        );
-        let two = format_setup_drops_message(2);
-        assert!(
-            two.starts_with(
-                "2 applied patches with vulnerability metadata were omitted from VEX because \
-                 their ecosystems are not set up (no install hook)"
-            ),
-            "{two}"
-        );
-        for m in [&one, &two] {
-            assert!(!m.contains("(s)"), "{m}");
-            assert!(m.ends_with("then re-run."), "{m}");
-        }
-    }
-
     #[test]
     fn omission_warning_names_phrase_and_tag() {
         assert_eq!(
@@ -1703,7 +1441,6 @@ mod tests {
              (brand_new_tag)"
         );
         for tag in [
-            ECOSYSTEM_NOT_SETUP,
             "package_not_found",
             "not_applied",
             "hash_mismatch",
@@ -1775,15 +1512,6 @@ mod tests {
         assert!(org_looks_like_path(Some("OUT.JSON")).is_some());
     }
 
-    #[test]
-    fn vendor_state_message_is_capitalized_and_keeps_cause() {
-        assert_eq!(
-            vendor_state_unreadable_message("corrupt x/state.json: eof"),
-            "Unreadable vendor state (corrupt x/state.json: eof); vendored patches cannot be \
-             verified from the committed artifact"
-        );
-    }
-
     #[derive(Parser)]
     struct Wrap {
         #[command(subcommand)]
diff --git a/crates/socket-patch-cli/src/commands/vex_consumed.rs b/crates/socket-patch-cli/src/commands/vex_consumed.rs
index d0bc39fe..22e5fd75 100644
--- a/crates/socket-patch-cli/src/commands/vex_consumed.rs
+++ b/crates/socket-patch-cli/src/commands/vex_consumed.rs
@@ -60,7 +60,7 @@ use crate::ecosystem_dispatch::{
 /// Resolve [`HostedCopies`] for every hosted-basis purl of `hosted` (see the
 /// module docs), under the same crawler options and `--ecosystems` scope as
 /// the installed-tree lookup. `installed` is that lookup's every-copy
-/// result ([`crate::ecosystem_dispatch::find_manifest_package_copies`] over
+/// result ([`crate::ecosystem_dispatch::find_manifest_package_copies_reusing`] over
 /// the record view, which holds every hosted purl): the shared-location
 /// ecosystems read it instead of crawling the tree a second time. `prior`
 /// (embedded hosted `scan --vex` only) is scan's npm crawl of the same
diff --git a/crates/socket-patch-cli/src/commands/vex_sources.rs b/crates/socket-patch-cli/src/commands/vex_sources.rs
index 0d6c08d5..4adec636 100644
--- a/crates/socket-patch-cli/src/commands/vex_sources.rs
+++ b/crates/socket-patch-cli/src/commands/vex_sources.rs
@@ -141,8 +141,8 @@ impl Sources {
 
 /// The resolved attestation inputs.
 pub(crate) struct Plan {
-    /// purl → record for every candidate that passed the gates (with the
-    /// manifest file's `setup` block, which property 7 reads).
+    /// purl → record for every candidate that passed the gates (carrying
+    /// the manifest file's legacy `setup` block through unchanged).
     pub view: PatchManifest,
     /// Vendored-basis entries, keyed by view purl — the verification
     /// routing for `applied_patches_with_vendor`.
@@ -364,7 +364,7 @@ pub(crate) async fn plan(common: &GlobalArgs, sources: Sources, assume_live: &[S
                         &cand.key,
                         &[
                             (&entry.uuid, WiringMode::Vendored, "vendor ledger"),
-                            (&hosted.uuid, WiringMode::Hosted, "redirect ledger"),
+                            (&hosted.uuid, WiringMode::Hosted, "hosted ledger"),
                         ],
                     ));
                     gated.push(failed(&cand.key, VENDOR_UNWIRED));
@@ -400,7 +400,7 @@ pub(crate) async fn plan(common: &GlobalArgs, sources: Sources, assume_live: &[S
                 notes.extend(dead_claim_notes(
                     &discovery,
                     &cand.key,
-                    &[(&cand.uuid, WiringMode::Hosted, "redirect ledger")],
+                    &[(&cand.uuid, WiringMode::Hosted, "hosted ledger")],
                 ));
                 gated.push(failed(&cand.key, REDIRECT_UNWIRED));
                 continue;
@@ -1497,7 +1497,7 @@ mod tests {
         );
         assert!(
             dead.notes.iter().any(|n| n.detail.contains("Cargo.lock")
-                && n.detail.contains("redirect ledger")
+                && n.detail.contains("hosted ledger")
                 && n.detail.contains(U2)),
             "{:?}",
             dead.notes
diff --git a/crates/socket-patch-cli/src/ecosystem_dispatch.rs b/crates/socket-patch-cli/src/ecosystem_dispatch.rs
index f5e3221c..89b9d3a7 100644
--- a/crates/socket-patch-cli/src/ecosystem_dispatch.rs
+++ b/crates/socket-patch-cli/src/ecosystem_dispatch.rs
@@ -395,7 +395,7 @@ async fn dispatch_find(
 /// Collapse a multi-copy map to one representative path per PURL (the
 /// first-discovered — root-copy-first for npm). Consumers that only need
 /// "is it installed / where is a representative copy" (`vendor`, `vex`,
-/// `setup`, `get`, `repair vendor`) use the collapsing wrappers below
+/// `get`, `repair vendor`) use the collapsing wrappers below
 /// (`HashMap<String, PathBuf>`). `apply` and
 /// `rollback` — which must touch EVERY copy — use the `_all` variants.
 pub(crate) fn collapse_to_first(multi: HashMap<String, Vec<PathBuf>>) -> HashMap<String, PathBuf> {
@@ -582,9 +582,9 @@ pub(crate) fn npm_paths_by_identity_in(
     out
 }
 
-/// Resolve manifest PURLs to their installed on-disk paths (partition,
-/// build crawler options from the global args, dispatch). Uses the
-/// rollback (qualified-aware) resolver, never a base-keyed collapse of
+/// Resolve manifest PURLs to every installed on-disk copy (crawl order;
+/// partition, build crawler options from the global args, dispatch). Uses
+/// the rollback (qualified-aware) resolver, never a base-keyed collapse of
 /// [`find_all_packages_for_purls`]: release-variant ecosystems (PyPI /
 /// RubyGems / Maven) key the manifest by *qualified* PURLs
 /// (`?artifact_id=`, `?platform=`, `?classifier=&ext=`), but the crawler
@@ -593,30 +593,11 @@ pub(crate) fn npm_paths_by_identity_in(
 /// patch would silently resolve as `package_not_found`. The rollback
 /// variant fans each base path back out to every qualified manifest PURL
 /// — the same mapping the manifest was written with (`get` uses the same
-/// resolver).
-pub async fn find_manifest_package_paths(
-    purls: &[String],
-    common: &GlobalArgs,
-    quiet: bool,
-) -> HashMap<String, PathBuf> {
-    collapse_to_first(find_manifest_package_copies(purls, common, quiet).await)
-}
-
-/// [`find_manifest_package_paths`] keeping EVERY installed copy of each
-/// purl (crawl order): one lookup a caller can take both the first-copy
-/// view and the every-copy view from (`vex` hashes the first copy of a
-/// manifest purl and every copy of a hosted one), so the tree is crawled —
-/// and a `--global` run's "Using … at:" banner printed — once.
-pub async fn find_manifest_package_copies(
-    purls: &[String],
-    common: &GlobalArgs,
-    quiet: bool,
-) -> HashMap<String, Vec<PathBuf>> {
-    find_manifest_package_copies_reusing(purls, common, quiet, None).await
-}
-
-/// [`find_manifest_package_copies`], taking the npm `node_modules` roots
-/// from `prior` (a crawl of the same options earlier in this process, over
+/// resolver). `vex` hashes the first copy of a manifest purl and every copy
+/// of a hosted one from this one lookup.
+///
+/// With `prior`, the npm `node_modules` roots come
+/// from it (a crawl of the same options earlier in this process, over
 /// a tree whose directories nothing has touched since) instead of walking
 /// the tree for them again — the every-copy twin of
 /// [`find_packages_for_rollback_reusing`]. Only the root discovery is
diff --git a/crates/socket-patch-cli/src/hosted_memory/mod.rs b/crates/socket-patch-cli/src/hosted_memory/mod.rs
index 7d2e9e2c..bd6b4a7d 100644
--- a/crates/socket-patch-cli/src/hosted_memory/mod.rs
+++ b/crates/socket-patch-cli/src/hosted_memory/mod.rs
@@ -730,8 +730,8 @@ fn finish_root(
                 _ => record_warnings.push(serde_json::json!({
                     "code": "record_fetch_failed",
                     "detail": format!(
-                        "{purl} redirected, but its patch record could not be fetched; \
-                         this run's VEX attestation omits it (`socket-patch vex` \
+                        "{purl} was switched to hosted, but its patch record could not be \
+                         fetched; this run's VEX attestation omits it (`socket-patch vex` \
                          fetches it again once the API answers)"
                     ),
                 })),
diff --git a/crates/socket-patch-cli/src/hosted_memory/redirect.rs b/crates/socket-patch-cli/src/hosted_memory/redirect.rs
index 06af3a67..99bd8e56 100644
--- a/crates/socket-patch-cli/src/hosted_memory/redirect.rs
+++ b/crates/socket-patch-cli/src/hosted_memory/redirect.rs
@@ -720,7 +720,7 @@ pub(crate) fn rewrite(
             "detail":
                 "pnpm-lock.yaml was edited outside `rush update`; if \
                  preventManualShrinkwrapChanges is enabled, `rush install` fails until \
-                 `rush update` refreshes repo-state.json (the redirect survives `rush \
+                 `rush update` refreshes repo-state.json (the hosted wiring survives `rush \
                  update`)",
         }));
     }
diff --git a/crates/socket-patch-cli/src/json_envelope.rs b/crates/socket-patch-cli/src/json_envelope.rs
index 42b0d950..a0eaabe5 100644
--- a/crates/socket-patch-cli/src/json_envelope.rs
+++ b/crates/socket-patch-cli/src/json_envelope.rs
@@ -3,7 +3,7 @@
 //! The `--json` output of `apply`, `list`, `remove`, `repair`/`gc`,
 //! `vendor`, `self-update` and `vex --json --output` (and every command's
 //! lock-contention error) uses this top-level shape; `scan`, `get`,
-//! `rollback` and `setup` still emit their legacy shapes (see
+//! and `rollback` still emit their legacy shapes (see
 //! CLI_CONTRACT.md's migration status):
 //!
 //! ```json
@@ -374,7 +374,6 @@ pub enum Command {
     Apply,
     Vex,
     Vendor,
-    Setup,
     Rollback,
     Get,
     List,
@@ -910,7 +909,6 @@ mod tests {
             (Command::Apply, "apply"),
             (Command::Vex, "vex"),
             (Command::Vendor, "vendor"),
-            (Command::Setup, "setup"),
             (Command::Rollback, "rollback"),
             (Command::Get, "get"),
             (Command::List, "list"),
diff --git a/crates/socket-patch-cli/src/lib.rs b/crates/socket-patch-cli/src/lib.rs
index cd18d33d..7bc0e4d1 100644
--- a/crates/socket-patch-cli/src/lib.rs
+++ b/crates/socket-patch-cli/src/lib.rs
@@ -26,12 +26,19 @@ use clap::{Parser, Subcommand};
     about = "Patch vulnerable dependencies with Socket's security patches",
     version,
     propagate_version = true,
-    after_help = "Typical workflow:\n  \
-        socket-patch scan      Patch dependencies (rewrites lockfiles to Socket-hosted patched packages)\n  \
-        socket-patch vex       Emit an OpenVEX document for your vulnerability scanner\n  \
-        socket-patch vendor    Eject the patches into .socket/vendor/ for offline installs\n  \
-        socket-patch list      Show the patches in this project\n\n\
-        get, apply, setup, rollback, remove and repair are the older agent-mode commands."
+    after_help = "Patch a project:\n  \
+        socket-patch scan       Patch every dependency with a patch (hosted: rewrites lockfiles)\n  \
+        socket-patch get        Patch one package, CVE, GHSA or patch UUID\n  \
+        socket-patch list       Show the patches in this project\n\n\
+        Undo:\n  \
+        socket-patch remove     Unwind one patch (by PURL or UUID)\n  \
+        socket-patch rollback   Unwind every patch\n\n\
+        Ship:\n  \
+        socket-patch vex        Emit an OpenVEX document for your vulnerability scanner\n  \
+        socket-patch vendor     Eject the patches into .socket/vendor/ for offline installs\n\n\
+        Agent mode (`scan --mode agent` edits installed files in place):\n  \
+        socket-patch apply      Re-apply .socket/manifest.json after each install (e.g. in CI)\n  \
+        socket-patch repair     Restore missing patch artifacts"
 )]
 pub struct Cli {
     #[command(subcommand)]
@@ -60,6 +67,23 @@ pub enum Commands {
     /// lockfiles to Socket-hosted patched packages
     Scan(commands::scan::ScanArgs),
 
+    /// Patch one package, CVE, GHSA or patch UUID (hosted mode by default)
+    #[command(visible_alias = "download")]
+    Get(commands::get::GetArgs),
+
+    /// List the patches in this project: hosted and vendored lockfile
+    /// references plus any agent-mode manifest entries
+    List(commands::list::ListArgs),
+
+    /// Remove one patch by PURL or UUID: unwind its hosted or vendored
+    /// wiring, or roll back its agent-mode files and drop it from the
+    /// manifest
+    Remove(commands::remove::RemoveArgs),
+
+    /// Undo patches: restore original files and unwind hosted or vendored
+    /// lockfile wiring
+    Rollback(commands::rollback::RollbackArgs),
+
     /// Generate an OpenVEX 0.2.0 document for the vulnerabilities the
     /// project's patches fix
     Vex(commands::vex::VexArgs),
@@ -71,29 +95,9 @@ pub enum Commands {
     /// Socket API needed.
     Vendor(commands::vendor::VendorArgs),
 
-    /// List the patches in this project: hosted and vendored lockfile
-    /// references plus any agent-mode manifest entries
-    List(commands::list::ListArgs),
-
-    /// Patch one package, CVE, GHSA or patch UUID (hosted mode by default)
-    #[command(visible_alias = "download")]
-    Get(commands::get::GetArgs),
-
     /// Agent mode: apply the patches in `.socket/manifest.json` in place
     Apply(commands::apply::ApplyArgs),
 
-    /// Agent mode: wire install hooks (npm, Python, Bundler, Composer) that
-    /// re-apply patches after install
-    Setup(commands::setup::SetupArgs),
-
-    /// Undo patches: restore original files and unwind hosted or vendored
-    /// lockfile wiring
-    Rollback(commands::rollback::RollbackArgs),
-
-    /// Agent mode: remove a patch from the manifest by PURL or UUID (rolls
-    /// back files first)
-    Remove(commands::remove::RemoveArgs),
-
     /// Agent mode: download missing patch artifacts and clean up unused ones
     ///
     /// Restores missing blobs and diff/package archives, rebuilds missing
@@ -136,7 +140,6 @@ impl Commands {
             Commands::Apply(a) => &a.common,
             Commands::Vex(a) => &a.common,
             Commands::Vendor(a) => &a.common,
-            Commands::Setup(a) => &a.common,
             Commands::Rollback(a) => &a.common,
             Commands::Get(a) => &a.common,
             Commands::List(a) => &a.common,
@@ -148,6 +151,87 @@ impl Commands {
     }
 }
 
+/// Global options every subcommand's short help (`-h`) still lists; the
+/// rest move to `--help` only.
+const SHORT_HELP_GLOBALS: &[&str] = &["json", "dry_run", "cwd", "ecosystems", "offline"];
+
+/// Per-subcommand arguments shown in `-h` on top of its own (non-global)
+/// ones: the commands that prompt keep `--yes`.
+fn short_help_extra_globals(sub: &str) -> &'static [&'static str] {
+    match sub {
+        "get" | "rollback" | "remove" | "self-update" => &["yes"],
+        _ => &[],
+    }
+}
+
+/// Command-specific arguments left out of a subcommand's `-h` (still in
+/// `--help`), so each short help stays at about eight options.
+fn short_help_hidden_own(sub: &str) -> &'static [&'static str] {
+    match sub {
+        "scan" => &[
+            "batch_size",
+            "prune",
+            "sync",
+            "all_releases",
+            "vex_product",
+            "vex_no_verify",
+            "vex_doc_id",
+            "vex_compact",
+        ],
+        "get" => &["id", "cve", "ghsa", "package", "save_only", "one_off", "all_releases"],
+        "vex" => &["doc_id", "compact"],
+        "apply" => &["vex_product", "vex_no_verify", "vex_doc_id", "vex_compact"],
+        "vendor" => &["vex_product", "vex_no_verify", "vex_doc_id", "vex_compact"],
+        _ => &[],
+    }
+}
+
+/// The `socket-patch` command as it parses and renders: [`Cli`]'s derived
+/// command with the short help (`-h`) trimmed to the common options. Every
+/// argument stays in `--help` and parses exactly as before.
+pub fn cli_command() -> clap::Command {
+    use clap::CommandFactory;
+    let mut cmd = Cli::command();
+    let subs: Vec<String> = cmd
+        .get_subcommands()
+        .map(|s| s.get_name().to_string())
+        .collect();
+    for name in subs {
+        cmd = cmd.mut_subcommand(&name, |mut sub| {
+            let hidden_own = short_help_hidden_own(&name);
+            let extra = short_help_extra_globals(&name);
+            let ids: Vec<(String, bool)> = sub
+                .get_arguments()
+                .map(|a| {
+                    (
+                        a.get_id().to_string(),
+                        a.get_help_heading() == Some(args::GLOBAL_OPTIONS),
+                    )
+                })
+                .collect();
+            for (id, global) in ids {
+                let keep = if global {
+                    SHORT_HELP_GLOBALS.contains(&id.as_str()) || extra.contains(&id.as_str())
+                } else {
+                    !hidden_own.contains(&id.as_str())
+                };
+                if !keep {
+                    sub = sub.mut_arg(&id, |a| a.hide_short_help(true));
+                }
+            }
+            sub
+        });
+    }
+    cmd
+}
+
+/// Parse `argv` against [`cli_command`].
+pub fn try_parse_cli(argv: &[String]) -> Result<Cli, clap::Error> {
+    use clap::FromArgMatches;
+    let mut matches = cli_command().try_get_matches_from(argv)?;
+    Cli::from_arg_matches_mut(&mut matches).map_err(|e| e.format(&mut cli_command()))
+}
+
 /// Check whether `s` looks like a UUID (8-4-4-4-12 hex pattern).
 ///
 /// Used by [`parse_argv_with_shortcuts`] to detect the convenience form
@@ -173,7 +257,7 @@ pub(crate) fn looks_like_uuid(s: &str) -> bool {
 ///
 /// Pulled out of `main.rs` so the fallback paths are unit-testable.
 pub fn parse_argv_with_shortcuts(argv: Vec<String>) -> Result<Cli, clap::Error> {
-    match Cli::try_parse_from(&argv) {
+    match try_parse_cli(&argv) {
         Ok(cli) => Ok(cli),
         Err(err) => {
             // Root `--update` never parses Ok on its own (the subcommand
@@ -220,7 +304,7 @@ pub fn parse_argv_with_shortcuts(argv: Vec<String>) -> Result<Cli, clap::Error>
                     new_args.push(version.to_string());
                 }
                 new_args.extend_from_slice(&argv[pos + 1..]);
-                return match Cli::try_parse_from(&new_args) {
+                return match try_parse_cli(&new_args) {
                     Ok(cli) => Ok(cli),
                     Err(rewrite_err) if pos == 1 || !rewrite_err.use_stderr() => Err(rewrite_err),
                     Err(_) => Err(err),
@@ -229,7 +313,7 @@ pub fn parse_argv_with_shortcuts(argv: Vec<String>) -> Result<Cli, clap::Error>
             if argv.len() >= 2 && looks_like_uuid(&argv[1]) {
                 let mut new_args = vec![argv[0].clone(), "get".into()];
                 new_args.extend_from_slice(&argv[1..]);
-                match Cli::try_parse_from(&new_args) {
+                match try_parse_cli(&new_args) {
                     Ok(cli) => Ok(cli),
                     // clap models `--help`/`--version` as `Err`, but they are
                     // display requests, not parse failures. For those the
diff --git a/crates/socket-patch-cli/src/main.rs b/crates/socket-patch-cli/src/main.rs
index b50bff6b..57947511 100644
--- a/crates/socket-patch-cli/src/main.rs
+++ b/crates/socket-patch-cli/src/main.rs
@@ -100,7 +100,6 @@ async fn main() {
         Commands::Apply(args) => commands::apply::run(args).await,
         Commands::Vex(args) => commands::vex::run(args).await,
         Commands::Vendor(args) => commands::vendor::run(args).await,
-        Commands::Setup(args) => commands::setup::run(args).await,
         Commands::Rollback(args) => commands::rollback::run(args).await,
         Commands::Get(args) => commands::get::run(args).await,
         Commands::List(args) => commands::list::run(args).await,
diff --git a/crates/socket-patch-cli/src/ui/mod.rs b/crates/socket-patch-cli/src/ui/mod.rs
index 3f0f651e..b66d9c0d 100644
--- a/crates/socket-patch-cli/src/ui/mod.rs
+++ b/crates/socket-patch-cli/src/ui/mod.rs
@@ -1,10 +1,10 @@
 //! Terminal UI: everything that decides *how* human output looks.
 //!
 //! - [`StatusLine`]: the one self-rewriting progress line.
-//! - [`confirm`], [`confirm_or_proceed`], [`select_one`]:
-//!   prompts.
+//! - [`confirm`], [`select_one`]: prompts.
 //! - [`print_json`]: the one `--json` document writer.
 //! - [`plural`], [`truncate`]: text shaping.
+//! - [`next_steps`]: the one "Next steps:" block (hosted and vendored).
 //! - [`color_enabled`], [`paint`], [`severity`], [`pad`]: color policy and
 //!   ANSI-aware column alignment.
 //! - [`init`] / [`quiet`]: the process-wide `--silent`/`--json` switch,
@@ -21,10 +21,18 @@ use std::io::IsTerminal;
 
 use crate::args::GlobalArgs;
 
-pub(crate) use prompt::{confirm, confirm_or_proceed};
+pub(crate) use prompt::confirm;
 pub use prompt::{select_one, SelectError};
 pub(crate) use status::StatusLine;
-pub(crate) use text::{plural, truncate};
+pub(crate) use text::{next_steps, plural, truncate};
+
+/// The one line every declined prompt prints (get, rollback, remove,
+/// `--update`).
+pub(crate) const CANCELLED: &str = "Cancelled; no changes made.";
+
+/// The one paid-plan upsell line (scan and get).
+pub(crate) const PAID_UPGRADE: &str =
+    "Upgrade to a paid Socket plan to access all patches: https://socket.dev/pricing";
 
 /// Call once after argument parsing. Core's informational advisories (and
 /// the prompts' non-interactive notes) go quiet under `--silent`/`--json`;
diff --git a/crates/socket-patch-cli/src/ui/prompt.rs b/crates/socket-patch-cli/src/ui/prompt.rs
index 1895f0e1..70f8cbd0 100644
--- a/crates/socket-patch-cli/src/ui/prompt.rs
+++ b/crates/socket-patch-cli/src/ui/prompt.rs
@@ -47,24 +47,6 @@ pub(crate) fn confirm_waits(common: &GlobalArgs) -> bool {
     !(common.yes || common.json) && io::stdin().is_terminal()
 }
 
-/// A default-**no** confirmation that still proceeds when nobody can be
-/// asked (stdin not a terminal): `setup`'s mutation gate. `--yes`/`--json`
-/// proceed without asking.
-pub(crate) fn confirm_or_proceed(prompt: &str, common: &GlobalArgs) -> bool {
-    if common.yes || common.json {
-        return true;
-    }
-    ask(
-        prompt,
-        Ask {
-            default_yes: false,
-            non_interactive_answer: true,
-            interactive: io::stdin().is_terminal(),
-            silent: common.silent,
-        },
-    )
-}
-
 /// How a yes/no question is answered (see [`confirm_with`]).
 #[derive(Clone, Copy, Debug)]
 pub(crate) struct Ask {
diff --git a/crates/socket-patch-cli/src/ui/text.rs b/crates/socket-patch-cli/src/ui/text.rs
index 78074958..11a05bb1 100644
--- a/crates/socket-patch-cli/src/ui/text.rs
+++ b/crates/socket-patch-cli/src/ui/text.rs
@@ -13,6 +13,25 @@ const ELLIPSIS: &str = "...";
 /// over a hard mid-word cut.
 const WORD_BOUNDARY_WINDOW: usize = 15;
 
+/// The "Next steps:" block printed after a hosted or vendored run that
+/// changed the project: commit `commit`, then `reinstall` and verify with
+/// `vex`, then any `extra` steps. Shared so the two modes read alike.
+pub(crate) fn next_steps(commit: &str, reinstall: &str, extra: &[String]) -> Vec<String> {
+    let mut steps = vec![
+        format!("Commit {commit}."),
+        format!("{reinstall}, then run `socket-patch vex` to verify the installed patches."),
+    ];
+    steps.extend(extra.iter().cloned());
+    let mut out = vec!["Next steps:".to_string()];
+    out.extend(
+        steps
+            .iter()
+            .enumerate()
+            .map(|(i, step)| format!("  {}. {step}", i + 1)),
+    );
+    out
+}
+
 /// Fit `s` on one line of at most `max` characters.
 ///
 /// - Every whitespace run (including embedded newlines and tabs from API
@@ -137,4 +156,17 @@ mod tests {
             assert!(truncate("some words here ok", max).chars().count() <= max);
         }
     }
+
+    #[test]
+    fn next_steps_numbers_commit_reinstall_then_extras() {
+        assert_eq!(
+            next_steps("a and b", "Run `npm ci`", &["vlt: x".to_string()]),
+            vec![
+                "Next steps:",
+                "  1. Commit a and b.",
+                "  2. Run `npm ci`, then run `socket-patch vex` to verify the installed patches.",
+                "  3. vlt: x",
+            ]
+        );
+    }
 }
diff --git a/crates/socket-patch-cli/tests/apply_invariants.rs b/crates/socket-patch-cli/tests/apply_invariants.rs
index 6c41a148..ba9861ed 100644
--- a/crates/socket-patch-cli/tests/apply_invariants.rs
+++ b/crates/socket-patch-cli/tests/apply_invariants.rs
@@ -548,7 +548,7 @@ fn apply_with_unreadable_socket_dir_fails_closed() {
     let v: serde_json::Value = serde_json::from_str(&stdout).expect("envelope must be valid JSON");
     assert_ne!(
         v["status"], "noManifest",
-        "\"cannot read\" is not \"not set up\"; envelope: {v}"
+        "\"cannot read\" is not \"no manifest\"; envelope: {v}"
     );
     assert_eq!(
         v["error"]["code"], "manifest_unreadable",
diff --git a/crates/socket-patch-cli/tests/apply_network.rs b/crates/socket-patch-cli/tests/apply_network.rs
index 2c01ebb8..431c8da9 100644
--- a/crates/socket-patch-cli/tests/apply_network.rs
+++ b/crates/socket-patch-cli/tests/apply_network.rs
@@ -518,7 +518,7 @@ async fn apply_hash_mismatch_default_warns_and_applies_strict_fails() {
     let stderr = String::from_utf8_lossy(&out.stderr);
     assert_eq!(out.status.code().unwrap_or(-1), 0, "stderr={stderr}");
     assert!(
-        stderr.contains("content_mismatch_overwritten"),
+        stderr.contains("did not match the patch's expected original content"),
         "stderr warning present: {stderr}"
     );
 
diff --git a/crates/socket-patch-cli/tests/cli_argv_non_utf8.rs b/crates/socket-patch-cli/tests/cli_argv_non_utf8.rs
index f669539a..08cecb3f 100644
--- a/crates/socket-patch-cli/tests/cli_argv_non_utf8.rs
+++ b/crates/socket-patch-cli/tests/cli_argv_non_utf8.rs
@@ -6,8 +6,8 @@
 //! non-Unicode argument: the binary died with a Rust panic message and exit
 //! code 101 ("please report this bug" territory) before clap ever saw the
 //! command line. The contract treats malformed invocations as clap usage
-//! errors (exit `2`, message on stderr) — see `setup --check --remove` in
-//! `CLI_CONTRACT.md` — so a bad byte in argv must take that path too.
+//! errors (exit `2`, message on stderr; see `CLI_CONTRACT.md`) — so a bad
+//! byte in argv must take that path too.
 //!
 //! These tests run the compiled binary as a subprocess because the bug lives
 //! in `main.rs` itself (the argv collection step), upstream of everything the
diff --git a/crates/socket-patch-cli/tests/cli_config_fallback.rs b/crates/socket-patch-cli/tests/cli_config_fallback.rs
index a919ab99..df19585d 100644
--- a/crates/socket-patch-cli/tests/cli_config_fallback.rs
+++ b/crates/socket-patch-cli/tests/cli_config_fallback.rs
@@ -562,94 +562,3 @@ async fn list_telemetry_honors_no_api_token_veto() {
          requests seen: {paths:?}"
     );
 }
-
-// ---------------------------------------------------------------------------
-// `setup` — the other command that only fires telemetry
-// ---------------------------------------------------------------------------
-
-/// `socket-patch setup --json --yes` against `project`, with the same hermetic
-/// env as [`list_cmd`]. `--json` also skips the confirmation prompt.
-fn setup_cmd(project: &Path, data_dir: &Path) -> Command {
-    let mut cmd = Command::new(BINARY);
-    cmd.args(["setup", "--json", "--yes", "--cwd"]).arg(project);
-    for (key, _) in std::env::vars_os() {
-        let name = key.to_string_lossy();
-        if name.starts_with("SOCKET_") {
-            cmd.env_remove(&key);
-        }
-    }
-    cmd.env(DATA_DIR_VAR, data_dir);
-    cmd.env("SOCKET_NO_CONFIG", "0");
-    cmd.env("SOCKET_TELEMETRY_DISABLED", "1");
-    cmd.env("SOCKET_NO_UPDATE_CHECK", "1");
-    cmd
-}
-
-/// `setup` fires `patch_setup`, and — like `list` — it builds no API client, so
-/// it has to consult the socket-cli config layer itself. A caller
-/// authenticated by `socket login` alone must have the event POSTed to
-/// `/v0/orgs/<slug>/telemetry` on the config `apiBaseUrl`, never anonymously
-/// to the public proxy.
-///
-/// Regression: `setup` handed the tracker its raw `--api-token` / `--org` flag
-/// values (both `None` here), so the event went out unauthenticated to
-/// `patches-api.socket.dev` — a different host than the one the caller's
-/// client talks to, which for an on-prem `apiBaseUrl` egresses the event
-/// entirely. Exact twin of `list_telemetry_follows_socket_cli_login`.
-#[tokio::test]
-async fn setup_telemetry_follows_socket_cli_login() {
-    let server = MockServer::start().await;
-    let data = tempfile::tempdir().unwrap();
-    let project = tempfile::tempdir().unwrap();
-    // A plain npm project: setup has real work to do, so telemetry fires.
-    write_empty_project(project.path());
-    write_config(
-        data.path(),
-        &serde_json::json!({
-            "apiToken": token('c'),
-            "apiBaseUrl": server.uri(),
-            "defaultOrg": "cfg-org"
-        }),
-    );
-
-    let mut cmd = setup_cmd(project.path(), data.path());
-    cmd.env("SOCKET_TELEMETRY_DISABLED", "0");
-    // Pin the anonymous fallback at the fixture too, so a run that skips the
-    // config layer is caught here instead of escaping to the real proxy.
-    cmd.env("SOCKET_PROXY_URL", server.uri());
-    let out = run(cmd);
-    assert_eq!(out.code, Some(0), "stderr:\n{}", out.stderr);
-    assert!(
-        std::fs::read_to_string(project.path().join("package.json"))
-            .unwrap()
-            .contains("socket-patch"),
-        "control: the run must actually have configured the project, or the \
-         telemetry event under test never fires"
-    );
-
-    let reqs = server.received_requests().await.unwrap_or_default();
-    let paths: Vec<&str> = reqs.iter().map(|r| r.url.path()).collect();
-    let telemetry = reqs
-        .iter()
-        .find(|r| r.url.path() == "/v0/orgs/cfg-org/telemetry")
-        .unwrap_or_else(|| {
-            panic!(
-                "`setup` telemetry must POST to the org endpoint resolved from \
-                 the socket-cli login; requests seen: {paths:?}"
-            )
-        });
-    assert_eq!(
-        telemetry
-            .headers
-            .get("authorization")
-            .map(|v| v.to_str().unwrap_or_default().to_string())
-            .as_deref(),
-        Some(format!("Bearer {}", token('c')).as_str()),
-        "setup telemetry must carry the config token"
-    );
-    assert!(
-        !paths.contains(&"/patch/telemetry"),
-        "setup must not report anonymously when a login is configured; \
-         requests seen: {paths:?}"
-    );
-}
diff --git a/crates/socket-patch-cli/tests/cli_env_deprecation.rs b/crates/socket-patch-cli/tests/cli_env_deprecation.rs
index d09daac2..5e4d9bc5 100644
--- a/crates/socket-patch-cli/tests/cli_env_deprecation.rs
+++ b/crates/socket-patch-cli/tests/cli_env_deprecation.rs
@@ -145,13 +145,13 @@ fn legacy_proxy_url_warns() {
         out.stdout
     );
     // The warning must fire on the *real* code path: `list` against an empty
-    // tempdir runs to its normal "manifest not found" error (exit 1). Pinning
-    // this rejects a child that crashed (signal → `None`) after emitting the
-    // line, and proves the shim ran inside an actual command invocation.
+    // tempdir runs to its normal empty-project result (exit 0). Pinning this
+    // rejects a child that crashed (signal → `None`) after emitting the line,
+    // and proves the shim ran inside an actual command invocation.
     assert_eq!(
         out.code,
-        Some(1),
-        "expected the manifest-not-found error exit; stderr was:\n{}",
+        Some(0),
+        "expected the empty-project list exit; stderr was:\n{}",
         out.stderr
     );
 }
@@ -167,8 +167,8 @@ fn legacy_debug_warns() {
     );
     assert_eq!(
         out.code,
-        Some(1),
-        "expected the manifest-not-found error exit; stderr was:\n{}",
+        Some(0),
+        "expected the empty-project list exit; stderr was:\n{}",
         out.stderr
     );
 }
@@ -188,8 +188,8 @@ fn legacy_telemetry_disabled_warns() {
     );
     assert_eq!(
         out.code,
-        Some(1),
-        "expected the manifest-not-found error exit; stderr was:\n{}",
+        Some(0),
+        "expected the empty-project list exit; stderr was:\n{}",
         out.stderr
     );
 }
@@ -209,11 +209,11 @@ fn legacy_warning_fires_under_silent() {
     // `--silent` it must be byte-for-byte the same line emitted without it.
     assert_deprecation_warning(&out.stderr, "SOCKET_PATCH_PROXY_URL", "SOCKET_PROXY_URL");
     // `--silent` is parsed and accepted (no clap usage error, which would be
-    // exit 2); the command still runs to its normal manifest-not-found error.
+    // exit 2); the command still runs to its normal empty-project result.
     assert_eq!(
         out.code,
-        Some(1),
-        "--silent should be accepted and the command reach its normal error exit; stderr was:\n{}",
+        Some(0),
+        "--silent should be accepted and the command reach its normal exit; stderr was:\n{}",
         out.stderr
     );
     // The warning is diagnostic output: it must stay on stderr and never bleed
@@ -263,19 +263,19 @@ fn legacy_warning_fires_under_json() {
         "JSON payload should be the structured `list` command result; got:\n{}",
         out.stdout
     );
-    // The run errors (no manifest in the fresh tempdir), so the structured
-    // result must say so — and exit non-zero — proving the JSON path itself
-    // ran rather than some short-circuited stub.
+    // An empty tempdir lists as an empty project, so the structured result
+    // must be a success with no events — proving the JSON path itself ran
+    // rather than some short-circuited stub.
     assert_eq!(
         parsed.get("status").and_then(|v| v.as_str()),
-        Some("error"),
-        "JSON payload should report the manifest-not-found error; got:\n{}",
+        Some("success"),
+        "JSON payload should report the empty-project success; got:\n{}",
         out.stdout
     );
     assert_eq!(
         out.code,
-        Some(1),
-        "expected the manifest-not-found error exit under --json; stderr was:\n{}",
+        Some(0),
+        "expected the empty-project list exit under --json; stderr was:\n{}",
         out.stderr
     );
 }
@@ -294,12 +294,12 @@ fn new_var_takes_precedence_and_silences_warning() {
     let stderr = String::from_utf8_lossy(&out.stderr);
     // Guard against a vacuous pass: if the binary never launched (or crashed
     // before promoting env vars) stderr would also lack "deprecated". Require
-    // the real manifest-not-found error exit so "no warning" means the shim
+    // the real empty-project list exit so "no warning" means the shim
     // ran and chose to stay quiet — not that nothing ran at all.
     assert_eq!(
         out.status.code(),
-        Some(1),
-        "expected the binary to run to its manifest-not-found error; stderr was:\n{stderr}"
+        Some(0),
+        "expected the binary to run to its empty-project list result; stderr was:\n{stderr}"
     );
     assert!(
         !stderr.to_lowercase().contains("deprecated"),
@@ -325,8 +325,8 @@ fn no_warning_when_no_legacy_var_set() {
     // result of the binary failing to start.
     assert_eq!(
         out.status.code(),
-        Some(1),
-        "expected the binary to run to its manifest-not-found error; stderr was:\n{stderr}"
+        Some(0),
+        "expected the binary to run to its empty-project list result; stderr was:\n{stderr}"
     );
     assert!(
         !stderr.to_lowercase().contains("deprecated"),
diff --git a/crates/socket-patch-cli/tests/cli_gem_variant_mismatch_policy.rs b/crates/socket-patch-cli/tests/cli_gem_variant_mismatch_policy.rs
index 94a4919d..39f9a92f 100644
--- a/crates/socket-patch-cli/tests/cli_gem_variant_mismatch_policy.rs
+++ b/crates/socket-patch-cli/tests/cli_gem_variant_mismatch_policy.rs
@@ -183,7 +183,7 @@ fn singleton_mismatch_default_warns_and_applies() {
         "the file must carry exactly the verified patched bytes"
     );
     assert!(
-        stderr.contains("content_mismatch_overwritten"),
+        stderr.contains("did not match the patch's expected original content"),
         "the overwrite must be surfaced as the npm-family mismatch warning; stderr={stderr}"
     );
     assert!(
@@ -246,7 +246,7 @@ fn singleton_mismatch_strict_refuses() {
          generic no-matching-variant miss; stderr={stderr}"
     );
     assert!(
-        !stderr.contains("content_mismatch_overwritten"),
+        !stderr.contains("did not match the patch's expected original content"),
         "--strict must not claim an overwrite happened; stderr={stderr}"
     );
 }
@@ -320,7 +320,7 @@ fn qualified_singleton_wrong_platform_fails_closed() {
         "the failure must stay the no-matching-variant error; stderr={stderr}"
     );
     assert!(
-        !stderr.contains("content_mismatch_overwritten"),
+        !stderr.contains("did not match the patch's expected original content"),
         "a wrong-distribution record must never be surfaced as a \
          local-modification overwrite; stderr={stderr}"
     );
@@ -395,7 +395,7 @@ fn multi_variant_mismatched_sibling_is_skipped_not_overwritten() {
         "the sibling distribution's bytes must never be written"
     );
     assert!(
-        !stderr.contains("content_mismatch_overwritten"),
+        !stderr.contains("did not match the patch's expected original content"),
         "a sibling-variant mismatch is a skip, not an overwrite warning; stderr={stderr}"
     );
 }
diff --git a/crates/socket-patch-cli/tests/cli_global_args.rs b/crates/socket-patch-cli/tests/cli_global_args.rs
index e3741e59..cb1bc8fd 100644
--- a/crates/socket-patch-cli/tests/cli_global_args.rs
+++ b/crates/socket-patch-cli/tests/cli_global_args.rs
@@ -34,7 +34,6 @@ const SUBCOMMANDS_NO_POSITIONAL: &[&str] = &[
     "apply",
     "list",
     "scan",
-    "setup",
     "repair",
     "rollback",
     "vendor",
@@ -137,7 +136,6 @@ fn common_of(cli: &Cli) -> &GlobalArgs {
         Scan(a) => &a.common,
         List(a) => &a.common,
         Remove(a) => &a.common,
-        Setup(a) => &a.common,
         Repair(a) => &a.common,
         Vendor(a) => &a.common,
         Vex(a) => &a.common,
@@ -760,16 +758,16 @@ fn empty_nonbool_env_vars_do_not_crash_the_binary() {
         "blank env vars must not abort the clap parse.\nstderr: {stderr}",
     );
     // The command must reach normal execution: with the blanks treated as
-    // unset, `list --json` in an empty temp dir resolves the default manifest
-    // path and emits the manifest_not_found envelope (exit 1).
+    // unset, `list --json` in an empty temp dir lists an empty project
+    // (success envelope, exit 0).
     let envelope: serde_json::Value = serde_json::from_str(stdout.trim()).unwrap_or_else(|e| {
         panic!("expected a JSON envelope on stdout, got {e}.\nstdout: {stdout}\nstderr: {stderr}")
     });
     assert_eq!(
-        envelope["error"]["code"], "manifest_not_found",
+        envelope["status"], "success",
         "blank env vars must fall back to defaults: {envelope}",
     );
-    assert_eq!(out.status.code(), Some(1), "manifest_not_found exits 1");
+    assert_eq!(out.status.code(), Some(0), "an empty project lists with exit 0");
 }
 
 /// `save_and_clear_global_env` must clear **every** env var `GlobalArgs`
diff --git a/crates/socket-patch-cli/tests/cli_parse_list.rs b/crates/socket-patch-cli/tests/cli_parse_list.rs
index a15c8724..8c997686 100644
--- a/crates/socket-patch-cli/tests/cli_parse_list.rs
+++ b/crates/socket-patch-cli/tests/cli_parse_list.rs
@@ -125,7 +125,7 @@ fn populated_manifest() -> PatchManifest {
 }
 
 #[tokio::test]
-async fn missing_manifest_returns_1_plain() {
+async fn missing_manifest_returns_0_plain() {
     let tmp = tempfile::tempdir().unwrap();
     let args = ListArgs {
         common: socket_patch_cli::args::GlobalArgs {
@@ -135,11 +135,11 @@ async fn missing_manifest_returns_1_plain() {
             ..socket_patch_cli::args::GlobalArgs::default()
         },
     };
-    assert_eq!(run(args).await, 1);
+    assert_eq!(run(args).await, 0);
 }
 
 #[tokio::test]
-async fn missing_manifest_returns_1_json() {
+async fn missing_manifest_returns_0_json() {
     let tmp = tempfile::tempdir().unwrap();
     let args = ListArgs {
         common: socket_patch_cli::args::GlobalArgs {
@@ -149,7 +149,7 @@ async fn missing_manifest_returns_1_json() {
             ..socket_patch_cli::args::GlobalArgs::default()
         },
     };
-    assert_eq!(run(args).await, 1);
+    assert_eq!(run(args).await, 0);
 }
 
 #[tokio::test]
@@ -269,10 +269,9 @@ async fn absolute_manifest_path_wins_over_cwd() {
 // ---------------------------------------------------------------------------
 
 #[test]
-fn missing_manifest_json_status_is_error_via_binary() {
-    // Pins the new unified envelope shape for `list --json` when the
-    // manifest doesn't exist. Top-level keys: command, status, error
-    // (object with code + message), plus the usual envelope fields.
+fn missing_manifest_json_is_an_empty_success_via_binary() {
+    // No manifest and no ledger is an empty project (normal for hosted
+    // mode): `list --json` emits the success envelope with no events.
     let tmp = tempfile::tempdir().unwrap();
     let out = Command::new(env!("CARGO_BIN_EXE_socket-patch"))
         .args(["list", "--cwd", tmp.path().to_str().unwrap(), "--json"])
@@ -281,8 +280,8 @@ fn missing_manifest_json_status_is_error_via_binary() {
 
     assert_eq!(
         out.status.code(),
-        Some(1),
-        "missing manifest must exit 1, stderr={}",
+        Some(0),
+        "an empty project must exit 0, stderr={}",
         String::from_utf8_lossy(&out.stderr)
     );
 
@@ -290,13 +289,10 @@ fn missing_manifest_json_status_is_error_via_binary() {
     let parsed: serde_json::Value =
         serde_json::from_str(stdout.trim()).expect("stdout must be valid JSON");
     assert_eq!(parsed["command"], "list");
-    assert_eq!(parsed["status"], "error");
-    assert_eq!(parsed["error"]["code"], "manifest_not_found");
-    let msg = parsed["error"]["message"].as_str().expect("error message");
-    assert!(
-        msg.contains("Manifest not found"),
-        "error.message must include 'Manifest not found', got: {msg}"
-    );
+    assert_eq!(parsed["status"], "success");
+    assert_eq!(parsed["summary"]["discovered"], 0);
+    assert_eq!(parsed["events"], serde_json::json!([]));
+    assert!(parsed.get("error").is_none(), "{parsed}");
 }
 
 // ---------------------------------------------------------------------------
@@ -365,26 +361,18 @@ fn empty_file_manifest_reports_manifest_invalid_via_binary() {
 }
 
 #[test]
-fn missing_manifest_under_valid_cwd_reports_manifest_not_found_via_binary() {
+fn missing_manifest_under_valid_cwd_is_not_an_error_via_binary() {
     // The common missing-manifest case: cwd exists, but `.socket/manifest.json`
-    // does not. `read_manifest` returns `Ok(None)` here, which must surface as
-    // `manifest_not_found` — NOT `manifest_invalid`, which would tell
-    // consumers a missing file was corrupt.
+    // does not. `read_manifest` returns `Ok(None)` here, which is an empty
+    // project — NOT `manifest_invalid`, which would tell consumers a missing
+    // file was corrupt.
     let tmp = tempfile::tempdir().unwrap();
     let out = run_list_binary(tmp.path(), &["--json"]);
     let v: serde_json::Value = serde_json::from_str(String::from_utf8_lossy(&out.stdout).trim())
         .expect("stdout must be valid JSON envelope");
-    assert_eq!(out.status.code(), Some(1), "missing manifest must exit 1");
-    assert_eq!(v["status"], "error");
-    assert_eq!(
-        v["error"]["code"], "manifest_not_found",
-        "missing manifest must be manifest_not_found, got envelope: {v}"
-    );
-    let msg = v["error"]["message"].as_str().expect("error message");
-    assert!(
-        msg.contains("Manifest not found"),
-        "message must name the missing manifest, got: {msg}"
-    );
+    assert_eq!(out.status.code(), Some(0), "missing manifest is an empty list");
+    assert_eq!(v["status"], "success", "envelope: {v}");
+    assert_eq!(v["summary"]["discovered"], 0, "envelope: {v}");
 }
 
 #[test]
@@ -561,7 +549,7 @@ fn empty_manifest_plain_says_no_patches_via_binary() {
     let stdout = String::from_utf8_lossy(&out.stdout);
     assert_eq!(out.status.code(), Some(0), "empty list must exit 0");
     assert!(
-        stdout.contains("No patches found in manifest."),
+        stdout.contains("No patches in this project. Run `socket-patch scan`."),
         "empty manifest must report no patches, got: {stdout}"
     );
     // Guard against a regression that prints a record anyway.
@@ -941,16 +929,14 @@ fn silent_does_not_mute_json_envelope_via_binary() {
 }
 
 #[test]
-fn silent_keeps_missing_manifest_error_on_stderr_via_binary() {
-    // "Errors only": the missing-manifest diagnostic must survive --silent.
+fn silent_empty_project_prints_nothing_via_binary() {
+    // "Errors only": an empty project is not an error, so --silent prints
+    // nothing and exits 0.
     let tmp = tempfile::tempdir().unwrap();
 
     let out = run_list_binary_scrubbed(tmp.path(), &["--silent"]);
-    assert_eq!(out.status.code(), Some(1), "missing manifest must exit 1");
-    assert!(
-        String::from_utf8_lossy(&out.stderr).contains("Manifest not found"),
-        "error output must NOT be muted by --silent"
-    );
+    assert_eq!(out.status.code(), Some(0), "an empty project exits 0");
+    assert!(out.stdout.is_empty() && out.stderr.is_empty(), "{out:?}");
 }
 
 // ---------------------------------------------------------------------------
@@ -1252,15 +1238,15 @@ fn manifest_and_hosted_pins_coexist_via_binary() {
 fn legacy_ledger_record_without_a_pin_is_not_listed_via_binary() {
     // A pre-v5 ledger whose record no lockfile wires any more (the lock was
     // re-resolved to the registry) asserts no live patch: with no manifest
-    // and no pin, `list` stays on the manifest_not_found path, and a
-    // manifest-backed listing does not pick the stale record up either.
+    // and no pin, `list` is an empty list, and a manifest-backed listing
+    // does not pick the stale record up either.
     let tmp = tempfile::tempdir().unwrap();
     common::write_redirect_ledger(tmp.path(), &[(HOSTED_PURL, hosted_record(HOSTED_UUID))]);
 
     let out = run_list_binary(tmp.path(), &["--json"]);
     let v = list_json(&out);
-    assert_eq!(out.status.code(), Some(1), "no pin anywhere: {v}");
-    assert_eq!(v["error"]["code"], "manifest_not_found", "envelope={v}");
+    assert_eq!(out.status.code(), Some(0), "no pin anywhere: {v}");
+    assert_eq!(v["summary"]["discovered"], 0, "envelope={v}");
 
     write_manifest_in(tmp.path(), &populated_manifest());
     let out = run_list_binary(tmp.path(), &["--json"]);
@@ -1276,10 +1262,9 @@ fn legacy_ledger_record_without_a_pin_is_not_listed_via_binary() {
 }
 
 #[test]
-fn edits_only_ledger_without_manifest_still_manifest_not_found_via_binary() {
+fn edits_only_ledger_without_manifest_lists_nothing_via_binary() {
     // A pre-v5 ledger with recorded edits but NO records asserts no
-    // patches, so a manifest-less project stays on the manifest_not_found
-    // path.
+    // patches, so a manifest-less project is an empty list.
     let tmp = tempfile::tempdir().unwrap();
     let vendor_dir = tmp.path().join(".socket/vendor");
     std::fs::create_dir_all(&vendor_dir).unwrap();
@@ -1304,18 +1289,19 @@ fn edits_only_ledger_without_manifest_still_manifest_not_found_via_binary() {
     let v = list_json(&out);
     assert_eq!(
         out.status.code(),
-        Some(1),
-        "no records anywhere must exit 1"
+        Some(0),
+        "no records anywhere is an empty list"
     );
-    assert_eq!(v["error"]["code"], "manifest_not_found", "envelope={v}");
+    assert_eq!(v["status"], "success", "envelope={v}");
+    assert_eq!(v["summary"]["discovered"], 0, "envelope={v}");
 }
 
 #[test]
-fn missing_manifest_with_corrupt_ledger_keeps_warning_in_error_envelope_via_binary() {
-    // No manifest and a corrupt pre-v5 ledger: the run takes the
-    // manifest_not_found exit, but the ledger corruption must still reach
-    // a JSON consumer via the error envelope's `warnings[]` (stderr is not
-    // the machine channel), and nothing may leak onto stderr.
+fn missing_manifest_with_corrupt_ledger_keeps_warning_in_the_envelope_via_binary() {
+    // No manifest and a corrupt pre-v5 ledger: the run lists nothing, but
+    // the ledger corruption must still reach a JSON consumer via the
+    // envelope's `warnings[]` (stderr is not the machine channel), and
+    // nothing may leak onto stderr.
     let tmp = tempfile::tempdir().unwrap();
     let vendor_dir = tmp.path().join(".socket/vendor");
     std::fs::create_dir_all(&vendor_dir).unwrap();
@@ -1323,8 +1309,8 @@ fn missing_manifest_with_corrupt_ledger_keeps_warning_in_error_envelope_via_bina
 
     let out = run_list_binary(tmp.path(), &["--json"]);
     let v = list_json(&out);
-    assert_eq!(out.status.code(), Some(1));
-    assert_eq!(v["error"]["code"], "manifest_not_found", "envelope={v}");
+    assert_eq!(out.status.code(), Some(0));
+    assert_eq!(v["status"], "success", "envelope={v}");
     let warnings = v["warnings"].as_array().expect("warnings[] present");
     assert_eq!(warnings.len(), 1, "envelope={v}");
     assert_eq!(warnings[0]["code"], "redirect_ledger_corrupt", "envelope={v}");
@@ -1334,12 +1320,16 @@ fn missing_manifest_with_corrupt_ledger_keeps_warning_in_error_envelope_via_bina
         String::from_utf8_lossy(&out.stderr)
     );
 
-    // Human mode: the warning still reaches stderr ahead of the error.
+    // Human mode: the warning still reaches stderr; the empty-project line
+    // is on stdout (v5.0).
     let out = run_list_binary(tmp.path(), &[]);
     let stderr = String::from_utf8_lossy(&out.stderr);
-    assert_eq!(out.status.code(), Some(1));
+    assert_eq!(out.status.code(), Some(0));
     assert!(stderr.contains("Warning: "), "stderr={stderr}");
-    assert!(stderr.contains("Error: Manifest not found at "), "stderr={stderr}");
+    assert!(
+        String::from_utf8_lossy(&out.stdout).contains("No patches in this project."),
+        "stderr={stderr}"
+    );
 }
 
 #[test]
@@ -1493,9 +1483,9 @@ fn manifest_path_scopes_hosted_pins_to_target_project_via_binary() {
 }
 
 #[test]
-fn local_hosted_pins_never_suppress_flagged_manifest_not_found_via_binary() {
+fn local_hosted_pins_never_leak_into_the_flagged_project_via_binary() {
     // --manifest-path points at a project with NO manifest and NO pins;
-    // the cwd's local hosted lockfile must not turn that into a success.
+    // the cwd's local hosted lockfile must not be listed for it.
     let cwd = tempfile::tempdir().unwrap();
     write_hosted_lock(cwd.path(), &[(HOSTED_PURL, HOSTED_UUID)]);
     let target = tempfile::tempdir().unwrap();
@@ -1508,10 +1498,11 @@ fn local_hosted_pins_never_suppress_flagged_manifest_not_found_via_binary() {
     let v = list_json(&out);
     assert_eq!(
         out.status.code(),
-        Some(1),
+        Some(0),
         "the flagged project has no stores at all; envelope={v}"
     );
-    assert_eq!(v["error"]["code"], "manifest_not_found", "envelope={v}");
+    assert_eq!(v["summary"]["discovered"], 0, "envelope={v}");
+    assert_eq!(v["events"], serde_json::json!([]), "envelope={v}");
 }
 
 // ---------------------------------------------------------------------------
@@ -1671,10 +1662,10 @@ fn manifest_hosted_pins_and_vendored_ledger_coexist_via_binary() {
 }
 
 #[test]
-fn record_less_vendor_entry_without_manifest_still_manifest_not_found_via_binary() {
+fn record_less_vendor_entry_without_manifest_lists_nothing_via_binary() {
     // A legacy manifest-tracked entry asserts no patch of its own: with no
-    // manifest and no other store, `list` stays on the manifest_not_found
-    // path (mirrors the edits-only pre-v5 redirect ledger).
+    // manifest and no other store, `list` is an empty list (mirrors the
+    // edits-only pre-v5 redirect ledger).
     let tmp = tempfile::tempdir().unwrap();
     write_vendor_ledger(tmp.path(), &[(VENDORED_PURL, None)]);
 
@@ -1683,10 +1674,11 @@ fn record_less_vendor_entry_without_manifest_still_manifest_not_found_via_binary
         .expect("stdout must be valid JSON");
     assert_eq!(
         out.status.code(),
-        Some(1),
-        "no records anywhere must exit 1"
+        Some(0),
+        "no records anywhere is an empty list"
     );
-    assert_eq!(v["error"]["code"], "manifest_not_found", "envelope={v}");
+    assert_eq!(v["status"], "success", "envelope={v}");
+    assert_eq!(v["summary"]["discovered"], 0, "envelope={v}");
 }
 
 #[test]
diff --git a/crates/socket-patch-cli/tests/cli_parse_main.rs b/crates/socket-patch-cli/tests/cli_parse_main.rs
index 239e59a0..905e6f18 100644
--- a/crates/socket-patch-cli/tests/cli_parse_main.rs
+++ b/crates/socket-patch-cli/tests/cli_parse_main.rs
@@ -76,7 +76,7 @@ fn help_flag_triggers_display_help() {
     // listed in the rendered help.
     let help = err.to_string();
     for name in [
-        "scan", "apply", "vex", "vendor", "setup", "rollback", "get", "list", "remove", "repair",
+        "scan", "apply", "vex", "vendor", "rollback", "get", "list", "remove", "repair",
     ] {
         assert!(
             help.contains(name),
@@ -155,9 +155,12 @@ fn remove_subcommand_parses_with_identifier() {
 }
 
 #[test]
-fn setup_subcommand_parses() {
-    let cli = parse(&["socket-patch", "setup"]).expect("setup must parse with no positional");
-    assert!(matches!(cli.command, Commands::Setup(_)));
+fn setup_subcommand_is_removed() {
+    // BREAKING (5.0): `setup` (the npm/Python/Bundler/Composer install
+    // hooks) was removed. Agent mode wires `socket-patch apply` into CI
+    // instead. Pin the removal so the name can't quietly come back.
+    let err = expect_err(parse(&["socket-patch", "setup"]));
+    assert_eq!(err.kind(), clap::error::ErrorKind::InvalidSubcommand);
 }
 
 #[test]
diff --git a/crates/socket-patch-cli/tests/cli_parse_setup.rs b/crates/socket-patch-cli/tests/cli_parse_setup.rs
deleted file mode 100644
index 085df8ce..00000000
--- a/crates/socket-patch-cli/tests/cli_parse_setup.rs
+++ /dev/null
@@ -1,558 +0,0 @@
-//! Parser-level contract tests for `socket-patch setup`.
-//!
-//! Locks in every flag in the `SetupArgs` table from
-//! `crates/socket-patch-cli/CLI_CONTRACT.md` (long + short forms, defaults)
-//! and exercises two no-network `run()` paths:
-//!
-//! 1. Calling `run()` directly against an empty tempdir → exit 0.
-//! 2. Spawning the binary against the same empty tempdir with `--json` and
-//!    asserting the documented `status: "no_files"` shape.
-//!
-//! These tests deliberately stay off the network so they run in the default
-//! `cargo test` set (no `--ignored` required).
-
-use clap::Parser;
-use socket_patch_cli::commands::setup::{run, SetupArgs};
-use socket_patch_cli::{Cli, Commands};
-use std::path::PathBuf;
-use std::process::Command;
-
-fn parse_setup(extra: &[&str]) -> SetupArgs {
-    let mut argv = vec!["socket-patch", "setup"];
-    argv.extend_from_slice(extra);
-    let cli = Cli::try_parse_from(&argv).expect("parse");
-    match cli.command {
-        Commands::Setup(a) => a,
-        _ => panic!("expected Setup"),
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Defaults
-// ---------------------------------------------------------------------------
-
-#[test]
-fn defaults_with_no_flags() {
-    let args = parse_setup(&[]);
-    assert_eq!(args.common.cwd, PathBuf::from("."));
-    assert!(!args.common.dry_run);
-    assert!(!args.common.yes);
-    assert!(!args.common.json);
-}
-
-// ---------------------------------------------------------------------------
-// Flag forms — each one in the contract table must have a test
-// ---------------------------------------------------------------------------
-
-#[test]
-fn dry_run_long_form() {
-    let args = parse_setup(&["--dry-run"]);
-    assert!(args.common.dry_run);
-}
-
-#[test]
-fn yes_short_form() {
-    let args = parse_setup(&["-y"]);
-    assert!(args.common.yes);
-}
-
-#[test]
-fn yes_long_form() {
-    let args = parse_setup(&["--yes"]);
-    assert!(args.common.yes);
-}
-
-#[test]
-fn cwd_long_form() {
-    let args = parse_setup(&["--cwd", "/tmp/x"]);
-    assert_eq!(args.common.cwd, PathBuf::from("/tmp/x"));
-}
-
-#[test]
-fn json_long_form() {
-    let args = parse_setup(&["--json"]);
-    assert!(args.common.json);
-}
-
-#[test]
-fn check_long_form() {
-    let args = parse_setup(&["--check"]);
-    assert!(args.check);
-    assert!(!args.remove);
-}
-
-#[test]
-fn remove_long_form() {
-    let args = parse_setup(&["--remove"]);
-    assert!(args.remove);
-    assert!(!args.check);
-}
-
-#[test]
-fn ecosystems_flag_parses_on_setup() {
-    // Setup command contract, property 2 ("ecosystem-scoped"): `setup` accepts
-    // the global `--ecosystems` filter (long form + the `-e` short form, CSV
-    // split). This pins the *parse* surface only; whether `setup` restricts
-    // its work to the named ecosystems at runtime is covered by
-    // setup_contract_gaps::setup_ecosystems_filter_scopes_work_to_named_ecosystem.
-    let long = parse_setup(&["--ecosystems", "npm,cargo"]);
-    assert_eq!(
-        long.common.ecosystems.as_deref(),
-        Some(&["npm".to_string(), "cargo".to_string()][..]),
-        "setup must parse the CSV --ecosystems filter (long form)"
-    );
-    let short = parse_setup(&["-e", "pypi"]);
-    assert_eq!(
-        short.common.ecosystems.as_deref(),
-        Some(&["pypi".to_string()][..]),
-        "setup must accept the -e short form"
-    );
-    // Default: no filter ⇒ act on every detected ecosystem.
-    assert!(
-        parse_setup(&[]).common.ecosystems.is_none(),
-        "no --ecosystems ⇒ None"
-    );
-}
-
-#[test]
-fn exclude_flag_parses_csv_on_setup() {
-    // Setup command contract, property 9 ("with exclude"): `setup` accepts
-    // `--exclude` as a comma-split list of workspace-member paths. Pins the
-    // parse surface (CSV delimiter); the persist + skip behavior is exercised in
-    // setup_contract_gaps::setup_honors_exclude_for_a_workspace_member.
-    let csv = parse_setup(&["--exclude", "packages/a,packages/b"]);
-    assert_eq!(
-        csv.exclude,
-        vec!["packages/a".to_string(), "packages/b".to_string()],
-        "setup must split --exclude on commas"
-    );
-    // Repeated flags accumulate too.
-    let repeated = parse_setup(&["--exclude", "packages/a", "--exclude", "packages/b"]);
-    assert_eq!(
-        repeated.exclude,
-        vec!["packages/a".to_string(), "packages/b".to_string()]
-    );
-    // Default: empty (no exclusions).
-    assert!(parse_setup(&[]).exclude.is_empty(), "no --exclude ⇒ empty");
-}
-
-#[test]
-fn check_and_remove_conflict() {
-    let result = Cli::try_parse_from(["socket-patch", "setup", "--check", "--remove"]);
-    let err = match result {
-        Ok(_) => panic!("--check + --remove must conflict"),
-        Err(e) => e,
-    };
-    assert_eq!(err.kind(), clap::error::ErrorKind::ArgumentConflict);
-}
-
-#[test]
-fn defaults_check_and_remove_false() {
-    let args = parse_setup(&[]);
-    assert!(!args.check);
-    assert!(!args.remove);
-}
-
-#[test]
-fn all_flags_combined() {
-    let args = parse_setup(&["--cwd", "/tmp/x", "--dry-run", "-y", "--json"]);
-    assert_eq!(args.common.cwd, PathBuf::from("/tmp/x"));
-    assert!(args.common.dry_run);
-    assert!(args.common.yes);
-    assert!(args.common.json);
-}
-
-// ---------------------------------------------------------------------------
-// Failure paths
-// ---------------------------------------------------------------------------
-
-#[test]
-fn unknown_flag_is_error() {
-    let result = Cli::try_parse_from(["socket-patch", "setup", "--not-a-real-flag"]);
-    let err = match result {
-        Ok(_) => panic!("unknown flag must fail"),
-        Err(e) => e,
-    };
-    assert_eq!(err.kind(), clap::error::ErrorKind::UnknownArgument);
-}
-
-// ---------------------------------------------------------------------------
-// Async run() — empty tempdir, no package.json files → exit 0
-// ---------------------------------------------------------------------------
-
-#[tokio::test]
-async fn run_empty_tempdir_exits_zero() {
-    let tempdir = tempfile::tempdir().expect("tempdir");
-    let args = SetupArgs {
-        check: false,
-        remove: false,
-        exclude: Vec::new(),
-        common: socket_patch_cli::args::GlobalArgs {
-            cwd: tempdir.path().to_path_buf(),
-            dry_run: false,
-            yes: true,
-            json: true,
-            ..socket_patch_cli::args::GlobalArgs::default()
-        },
-    };
-    let exit = run(args).await;
-    assert_eq!(
-        exit, 0,
-        "empty tempdir (no package.json) must exit 0 with status 'no_files'"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// Subprocess: lock the JSON contract shape for `status: no_files`.
-// ---------------------------------------------------------------------------
-
-#[test]
-fn subprocess_no_files_json_shape() {
-    let tempdir = tempfile::tempdir().expect("tempdir");
-    let exe = env!("CARGO_BIN_EXE_socket-patch");
-    let output = Command::new(exe)
-        .arg("setup")
-        .arg("--cwd")
-        .arg(tempdir.path())
-        .arg("--json")
-        .arg("--yes")
-        .output()
-        .expect("spawn socket-patch");
-    assert!(
-        output.status.success(),
-        "setup against empty tempdir must succeed, stderr: {}",
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let stdout = String::from_utf8(output.stdout).expect("utf8 stdout");
-    let v: serde_json::Value = serde_json::from_str(&stdout).unwrap_or_else(|e| {
-        panic!("stdout must be JSON, got {stdout:?}: {e}");
-    });
-    assert_eq!(
-        v["status"], "no_files",
-        "status must be 'no_files' for empty tempdir; full payload: {v}"
-    );
-    assert_eq!(v["updated"], 0);
-    assert_eq!(v["alreadyConfigured"], 0);
-    assert_eq!(v["errors"], 0);
-    assert!(v["files"].is_array(), "'files' must be an array");
-    assert_eq!(
-        v["files"].as_array().expect("array").len(),
-        0,
-        "'files' must be an empty array for status 'no_files'"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// Subprocess: the REAL setup path — a package.json present must actually be
-// configured (status "success", count incremented) AND the file on disk must
-// gain the postinstall hook. Without this, an impl that always short-circuits
-// to `no_files` (or reports success without writing) would pass every other
-// test in this file.
-// ---------------------------------------------------------------------------
-
-#[test]
-fn subprocess_configures_real_package_json() {
-    let tempdir = tempfile::tempdir().expect("tempdir");
-    let pkg_path = tempdir.path().join("package.json");
-    std::fs::write(&pkg_path, r#"{"name":"demo","version":"1.0.0"}"#).expect("write package.json");
-
-    let exe = env!("CARGO_BIN_EXE_socket-patch");
-    let output = Command::new(exe)
-        .arg("setup")
-        .arg("--cwd")
-        .arg(tempdir.path())
-        .arg("--json")
-        .arg("--yes")
-        // Keep this test off the network: a successful setup fires telemetry.
-        .env("SOCKET_TELEMETRY_DISABLED", "1")
-        .output()
-        .expect("spawn socket-patch");
-
-    assert!(
-        output.status.success(),
-        "setup on a real package.json must exit 0, stderr: {}",
-        String::from_utf8_lossy(&output.stderr)
-    );
-
-    let stdout = String::from_utf8(output.stdout).expect("utf8 stdout");
-    let v: serde_json::Value = serde_json::from_str(&stdout)
-        .unwrap_or_else(|e| panic!("stdout must be JSON, got {stdout:?}: {e}"));
-
-    // The envelope must reflect a real change, not a no-op / no_files.
-    assert_eq!(
-        v["status"], "success",
-        "a package.json that needed setup must report status 'success'; payload: {v}"
-    );
-    assert_eq!(
-        v["updated"], 1,
-        "exactly one manifest must be updated; payload: {v}"
-    );
-    assert_eq!(v["alreadyConfigured"], 0, "payload: {v}");
-    assert_eq!(v["errors"], 0, "payload: {v}");
-    assert_eq!(
-        v["packageManager"], "npm",
-        "default manager for a bare package.json is npm; payload: {v}"
-    );
-
-    let files = v["files"].as_array().expect("'files' must be an array");
-    let pkg_entries: Vec<&serde_json::Value> = files
-        .iter()
-        .filter(|f| f["kind"] == "package_json")
-        .collect();
-    assert_eq!(
-        pkg_entries.len(),
-        1,
-        "exactly one package_json file entry expected; payload: {v}"
-    );
-    let entry = pkg_entries[0];
-    assert_eq!(
-        entry["status"], "updated",
-        "the package.json entry must report status 'updated'; entry: {entry}"
-    );
-    assert!(
-        entry["error"].is_null(),
-        "a successful update must carry no error; entry: {entry}"
-    );
-    assert!(
-        entry["path"]
-            .as_str()
-            .map(|p| p.ends_with("package.json"))
-            .unwrap_or(false),
-        "the entry path must point at the package.json; entry: {entry}"
-    );
-
-    // The decisive check: the file on disk must actually carry the hook now.
-    let after = std::fs::read_to_string(&pkg_path).expect("read package.json back");
-    let parsed: serde_json::Value =
-        serde_json::from_str(&after).expect("package.json must stay valid JSON after setup");
-    let postinstall = parsed["scripts"]["postinstall"]
-        .as_str()
-        .unwrap_or_else(|| panic!("scripts.postinstall must be set after setup; file: {after}"));
-    assert!(
-        postinstall.contains("socket-patch apply"),
-        "postinstall must invoke `socket-patch apply`, got {postinstall:?}"
-    );
-    // Original metadata must be preserved, not clobbered.
-    assert_eq!(
-        parsed["name"], "demo",
-        "setup must preserve existing fields"
-    );
-    assert_eq!(
-        parsed["version"], "1.0.0",
-        "setup must preserve existing fields"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// Subprocess: --dry-run must PREVIEW only — report what it would do but leave
-// the package.json byte-for-byte unchanged. `dry_run_long_form` only proves the
-// flag parses; nothing here proved it is actually honoured at runtime. An impl
-// that ignored --dry-run and wrote the hook anyway would still emit a
-// "dry_run" envelope (that string comes from a separate branch) and pass every
-// other test — so the decisive guard is reading the file back and asserting it
-// did NOT gain the postinstall hook.
-// ---------------------------------------------------------------------------
-
-#[test]
-fn subprocess_dry_run_previews_without_writing() {
-    let tempdir = tempfile::tempdir().expect("tempdir");
-    let pkg_path = tempdir.path().join("package.json");
-    let original = r#"{"name":"demo","version":"1.0.0"}"#;
-    std::fs::write(&pkg_path, original).expect("write package.json");
-
-    let exe = env!("CARGO_BIN_EXE_socket-patch");
-    let output = Command::new(exe)
-        .arg("setup")
-        .arg("--cwd")
-        .arg(tempdir.path())
-        .arg("--dry-run")
-        .arg("--json")
-        .arg("--yes")
-        .env("SOCKET_TELEMETRY_DISABLED", "1")
-        .output()
-        .expect("spawn socket-patch");
-
-    assert!(
-        output.status.success(),
-        "dry-run setup must exit 0, stderr: {}",
-        String::from_utf8_lossy(&output.stderr)
-    );
-
-    let stdout = String::from_utf8(output.stdout).expect("utf8 stdout");
-    let v: serde_json::Value = serde_json::from_str(&stdout)
-        .unwrap_or_else(|e| panic!("stdout must be JSON, got {stdout:?}: {e}"));
-
-    // The envelope must announce a preview of a real change — not no_files,
-    // not already_configured, not success.
-    assert_eq!(
-        v["status"], "dry_run",
-        "dry-run on a configurable package.json must report status 'dry_run'; payload: {v}"
-    );
-    assert_eq!(v["dryRun"], true, "dryRun flag must be set; payload: {v}");
-    assert_eq!(
-        v["wouldUpdate"], 1,
-        "dry-run must report exactly one would-be update; payload: {v}"
-    );
-    assert_eq!(
-        v["updated"], 1,
-        "the preview counts the manifest it would touch; payload: {v}"
-    );
-    assert_eq!(v["errors"], 0, "payload: {v}");
-    let files = v["files"].as_array().expect("'files' must be an array");
-    let pkg_entries: Vec<&serde_json::Value> = files
-        .iter()
-        .filter(|f| f["kind"] == "package_json")
-        .collect();
-    assert_eq!(
-        pkg_entries.len(),
-        1,
-        "exactly one package_json preview entry expected; payload: {v}"
-    );
-    assert_eq!(
-        pkg_entries[0]["status"], "updated",
-        "the previewed entry must report it would be 'updated'; payload: {v}"
-    );
-
-    // The decisive check: dry-run must NOT have touched the file on disk.
-    let after = std::fs::read_to_string(&pkg_path).expect("read package.json back");
-    assert_eq!(
-        after, original,
-        "--dry-run must leave package.json byte-for-byte unchanged (no write)"
-    );
-    let parsed: serde_json::Value =
-        serde_json::from_str(&after).expect("package.json must stay valid JSON");
-    assert!(
-        parsed["scripts"]["postinstall"].is_null(),
-        "--dry-run must NOT add the postinstall hook to disk; file: {after}"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// Subprocess: idempotency — running setup against an already-configured
-// project must report `already_configured` (updated 0), not re-write or claim
-// a fresh success. Guards against an impl that can't tell configured from not.
-// ---------------------------------------------------------------------------
-
-#[test]
-fn subprocess_already_configured_is_idempotent() {
-    let tempdir = tempfile::tempdir().expect("tempdir");
-    let pkg_path = tempdir.path().join("package.json");
-    std::fs::write(&pkg_path, r#"{"name":"demo","version":"1.0.0"}"#).expect("write package.json");
-
-    let exe = env!("CARGO_BIN_EXE_socket-patch");
-    let run = || {
-        Command::new(exe)
-            .arg("setup")
-            .arg("--cwd")
-            .arg(tempdir.path())
-            .arg("--json")
-            .arg("--yes")
-            .env("SOCKET_TELEMETRY_DISABLED", "1")
-            .output()
-            .expect("spawn socket-patch")
-    };
-
-    // First run configures it.
-    let first = run();
-    assert!(first.status.success(), "first setup must succeed");
-    let v1: serde_json::Value =
-        serde_json::from_str(&String::from_utf8(first.stdout).expect("utf8")).expect("json");
-    assert_eq!(v1["status"], "success", "first run must configure: {v1}");
-
-    let before_second = std::fs::read_to_string(&pkg_path).expect("read");
-
-    // Second run must be a no-op.
-    let second = run();
-    assert!(second.status.success(), "second setup must succeed");
-    let v2: serde_json::Value =
-        serde_json::from_str(&String::from_utf8(second.stdout).expect("utf8")).expect("json");
-    assert_eq!(
-        v2["status"], "already_configured",
-        "re-running setup on a configured project must report 'already_configured'; payload: {v2}"
-    );
-    assert_eq!(
-        v2["updated"], 0,
-        "no further updates expected; payload: {v2}"
-    );
-
-    let after_second = std::fs::read_to_string(&pkg_path).expect("read");
-    assert_eq!(
-        before_second, after_second,
-        "an idempotent re-run must not rewrite package.json"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// vlt: `packageManager` gains the additive value "vlt", and the hook is the
-// same `npx` command npm projects get.
-// ---------------------------------------------------------------------------
-
-#[tokio::test]
-async fn run_vlt_project_dry_run_writes_nothing() {
-    let tempdir = tempfile::tempdir().expect("tempdir");
-    let original = "{\n  \"name\": \"demo\"\n}\n";
-    std::fs::write(tempdir.path().join("package.json"), original).unwrap();
-    std::fs::write(
-        tempdir.path().join("vlt-lock.json"),
-        "{\"lockfileVersion\":1}",
-    )
-    .unwrap();
-    let args = SetupArgs {
-        check: false,
-        remove: false,
-        exclude: Vec::new(),
-        common: socket_patch_cli::args::GlobalArgs {
-            cwd: tempdir.path().to_path_buf(),
-            dry_run: true,
-            yes: true,
-            json: true,
-            ..socket_patch_cli::args::GlobalArgs::default()
-        },
-    };
-    assert_eq!(run(args).await, 0);
-    assert_eq!(
-        std::fs::read_to_string(tempdir.path().join("package.json")).unwrap(),
-        original
-    );
-}
-
-#[test]
-fn subprocess_vlt_project_json_shape() {
-    let tempdir = tempfile::tempdir().expect("tempdir");
-    let empty_path = tempfile::tempdir().expect("PATH dir");
-    std::fs::write(
-        tempdir.path().join("package.json"),
-        r#"{"name":"demo","version":"1.0.0"}"#,
-    )
-    .unwrap();
-    std::fs::write(tempdir.path().join("vlt.json"), "{}").unwrap();
-
-    let output = Command::new(env!("CARGO_BIN_EXE_socket-patch"))
-        .arg("setup")
-        .arg("--cwd")
-        .arg(tempdir.path())
-        .arg("--json")
-        .arg("--yes")
-        .env("SOCKET_TELEMETRY_DISABLED", "1")
-        .env("PATH", empty_path.path())
-        .output()
-        .expect("spawn socket-patch");
-    assert!(
-        output.status.success(),
-        "stderr: {}",
-        String::from_utf8_lossy(&output.stderr)
-    );
-    let v: serde_json::Value = serde_json::from_slice(&output.stdout).expect("JSON stdout");
-    assert_eq!(v["status"], "success", "{v}");
-    assert_eq!(v["packageManager"], "vlt", "{v}");
-    assert_eq!(v["updated"], 1, "{v}");
-    assert!(v.get("warnings").is_none(), "{v}");
-    let pkg: serde_json::Value = serde_json::from_str(
-        &std::fs::read_to_string(tempdir.path().join("package.json")).unwrap(),
-    )
-    .unwrap();
-    assert_eq!(
-        pkg["scripts"]["postinstall"],
-        "npx @socketsecurity/socket-patch apply --silent --ecosystems npm"
-    );
-}
diff --git a/crates/socket-patch-cli/tests/cli_remove_silent.rs b/crates/socket-patch-cli/tests/cli_remove_silent.rs
index fb8acebe..bab3ee49 100644
--- a/crates/socket-patch-cli/tests/cli_remove_silent.rs
+++ b/crates/socket-patch-cli/tests/cli_remove_silent.rs
@@ -357,7 +357,7 @@ fn remove_silent_suppresses_detached_revert_output() {
 }
 
 /// Backend revert warnings are chatter, not errors: `vendor --revert`
-/// gates the identical "Warning (code): detail" stderr line on
+/// gates the identical "Warning: detail" stderr line on
 /// `!silent && !json` (`record_warning`), but remove's vendor block
 /// printed it under `--silent` (gated on `!json` alone).
 #[test]
@@ -384,7 +384,7 @@ fn remove_silent_suppresses_vendor_revert_warnings() {
         "the drift-kept error must print even under --silent; got {stderr:?}"
     );
     assert!(
-        !stderr.contains("Warning ("),
+        !stderr.contains("Warning:"),
         "--silent must suppress backend revert warnings; got {stderr:?}"
     );
 
@@ -395,7 +395,7 @@ fn remove_silent_suppresses_vendor_revert_warnings() {
     let (loud_code, _loud_stdout, loud_stderr) = run_remove(tmp2.path(), &[purl, "--yes"]);
     assert_eq!(loud_code, 1);
     assert!(
-        loud_stderr.contains("Warning (vendor_lock_entry_drifted)"),
+        loud_stderr.contains("Warning: "),
         "non-silent run must print the backend warning; got {loud_stderr:?}"
     );
     // The drift-keep must leave BOTH stores intact: ledger entry and
@@ -527,7 +527,7 @@ fn remove_silent_suppresses_detached_revert_warnings() {
         "an all-kept detached remove is a partial failure; stderr={stderr:?}"
     );
     assert!(
-        !stderr.contains("Warning ("),
+        !stderr.contains("Warning:"),
         "--silent must suppress detached revert warnings; got {stderr:?}"
     );
     assert!(
@@ -549,7 +549,7 @@ fn remove_silent_suppresses_detached_revert_warnings() {
     let (loud_code, _loud_stdout, loud_stderr) = run_remove(tmp2.path(), &[purl, "--yes"]);
     assert_eq!(loud_code, 1);
     assert!(
-        loud_stderr.contains("Warning (vendor_lock_entry_drifted)"),
+        loud_stderr.contains("Warning: "),
         "non-silent detached run must print the backend warning; got {loud_stderr:?}"
     );
     assert!(
diff --git a/crates/socket-patch-cli/tests/cli_setup_silent.rs b/crates/socket-patch-cli/tests/cli_setup_silent.rs
deleted file mode 100644
index e5d37ee7..00000000
--- a/crates/socket-patch-cli/tests/cli_setup_silent.rs
+++ /dev/null
@@ -1,308 +0,0 @@
-//! `setup --silent` contract tests.
-//!
-//! CLI_CONTRACT.md defines `--silent` as "Errors only": `setup` (and its
-//! `--check` / `--remove` modes) must mute the "Configuring..." /
-//! "Searching..." headers, the previews, the summaries, the
-//! configuration-status report, and the commit hints (not just gate them
-//! on `!json`).
-//!
-//! `--silent` suppresses informational output only: the mutation still
-//! happens, exit codes still distinguish states, and (matching the
-//! shared `confirm()` helper) prompting is unaffected — these tests
-//! pass `--yes` like the scan/remove silent suites. Runs fully offline:
-//! npm-only fixtures, no API calls.
-
-use std::path::{Path, PathBuf};
-use std::process::Command;
-
-use socket_patch_cli::args::GLOBAL_ARG_ENV_VARS;
-
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
-const UNCONFIGURED_PACKAGE_JSON: &str = r#"{
-  "name": "setup-silent-test",
-  "version": "0.0.0"
-}"#;
-
-fn write_root(root: &Path) {
-    std::fs::write(root.join("package.json"), UNCONFIGURED_PACKAGE_JSON).unwrap();
-}
-
-/// Run `socket-patch setup` in `cwd` with a scrubbed SOCKET_* environment
-/// so ambient developer/CI configuration (tokens, silent toggles) can't
-/// change the branch under test.
-fn run_setup(cwd: &Path, args: &[&str]) -> (i32, String, String) {
-    let mut cmd = Command::new(binary());
-    cmd.arg("setup").args(args).current_dir(cwd);
-    for var in GLOBAL_ARG_ENV_VARS {
-        cmd.env_remove(var);
-    }
-    cmd.env_remove("SOCKET_SETUP_EXCLUDE");
-    cmd.env("SOCKET_TELEMETRY_DISABLED", "1");
-    let out = cmd.output().expect("run socket-patch setup");
-    (
-        out.status.code().unwrap_or(-1),
-        String::from_utf8_lossy(&out.stdout).to_string(),
-        String::from_utf8_lossy(&out.stderr).to_string(),
-    )
-}
-
-/// Non-error stderr lines: drop the unconditional core API-token warning
-/// (printed by shared client/telemetry plumbing, out of scope for
-/// `setup`'s `--silent` gating) and blank lines, keep everything else.
-fn stderr_chatter(stderr: &str) -> Vec<String> {
-    stderr
-        .lines()
-        .filter(|l| {
-            !l.contains("SOCKET_API_TOKEN")
-                && !l.contains("Continuing anyway")
-                && !l.trim().is_empty()
-        })
-        .map(|l| l.to_string())
-        .collect()
-}
-
-/// `setup --silent --yes` must wire the postinstall hook without printing
-/// anything: no "Configuring socket-patch install hooks..." header, no
-/// preview, no summary, no commit hints.
-#[test]
-fn setup_silent_configures_but_prints_nothing() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write_root(tmp.path());
-
-    let (code, stdout, stderr) = run_setup(tmp.path(), &["--silent", "--yes"]);
-    assert_eq!(
-        code, 0,
-        "setup must succeed; stdout={stdout:?} stderr={stderr:?}"
-    );
-    assert!(
-        stdout.trim().is_empty(),
-        "--silent must produce no stdout; got {stdout:?}"
-    );
-    let chatter = stderr_chatter(&stderr);
-    assert!(
-        chatter.is_empty(),
-        "--silent must produce no stderr chatter on success; got {chatter:?}"
-    );
-
-    // Silent suppresses output, not the mutation: the hook must be wired.
-    let pkg = std::fs::read_to_string(tmp.path().join("package.json")).expect("read package.json");
-    assert!(
-        pkg.contains("socket-patch"),
-        "the postinstall hook must still be wired under --silent; got {pkg:?}"
-    );
-
-    // Control run: the same scenario WITHOUT --silent must print the
-    // header and summary — otherwise the assertions above pass vacuously.
-    let tmp2 = tempfile::tempdir().expect("tempdir");
-    write_root(tmp2.path());
-    let (loud_code, loud_stdout, loud_stderr) = run_setup(tmp2.path(), &["--yes"]);
-    assert_eq!(loud_code, 0);
-    // (Its progress is a transient status line, so a piped stderr stays
-    // empty even without --silent; the stdout summary is the control.)
-    assert!(
-        !loud_stderr.contains("Configuring socket-patch install hooks"),
-        "the progress line is transient; got {loud_stderr:?}"
-    );
-    assert!(
-        loud_stdout.contains("1 item updated"),
-        "non-silent setup must print the summary; got {loud_stdout:?}"
-    );
-}
-
-/// `setup --check --silent` must print nothing in both states; the exit
-/// code alone distinguishes configured (0) from needs-configuration (1),
-/// mirroring the `list --silent` fix.
-#[test]
-fn setup_check_silent_prints_nothing_in_both_states() {
-    // Unconfigured: exit 1, no output.
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write_root(tmp.path());
-    let (code, stdout, stderr) = run_setup(tmp.path(), &["--check", "--silent"]);
-    assert_eq!(
-        code, 1,
-        "unconfigured --check must exit 1; stdout={stdout:?}"
-    );
-    assert!(
-        stdout.trim().is_empty(),
-        "--check --silent must produce no stdout; got {stdout:?}"
-    );
-    let chatter = stderr_chatter(&stderr);
-    assert!(
-        chatter.is_empty(),
-        "--check --silent must produce no stderr chatter; got {chatter:?}"
-    );
-
-    // Configured (after a real setup): exit 0, no output.
-    let (setup_code, _, _) = run_setup(tmp.path(), &["--silent", "--yes"]);
-    assert_eq!(
-        setup_code, 0,
-        "setup must succeed before the configured check"
-    );
-    let (code2, stdout2, _) = run_setup(tmp.path(), &["--check", "--silent"]);
-    assert_eq!(
-        code2, 0,
-        "configured --check must exit 0; stdout={stdout2:?}"
-    );
-    assert!(
-        stdout2.trim().is_empty(),
-        "configured --check --silent must produce no stdout; got {stdout2:?}"
-    );
-
-    // Control run: without --silent the status report must print.
-    let (loud_code, loud_stdout, _) = run_setup(tmp.path(), &["--check"]);
-    assert_eq!(loud_code, 0);
-    assert!(
-        loud_stdout.contains("Configuration status"),
-        "non-silent --check must print the status report; got {loud_stdout:?}"
-    );
-}
-
-/// `setup --remove --silent --yes` must revert the hook without printing
-/// anything: no "Searching..." header, no proposed-changes preview, no
-/// summary, no pip-uninstall hint.
-#[test]
-fn setup_remove_silent_prints_nothing_but_removes() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write_root(tmp.path());
-    let (setup_code, _, _) = run_setup(tmp.path(), &["--silent", "--yes"]);
-    assert_eq!(setup_code, 0, "setup must succeed before remove");
-
-    let (code, stdout, stderr) = run_setup(tmp.path(), &["--remove", "--silent", "--yes"]);
-    assert_eq!(
-        code, 0,
-        "remove must succeed; stdout={stdout:?} stderr={stderr:?}"
-    );
-    assert!(
-        stdout.trim().is_empty(),
-        "--remove --silent must produce no stdout; got {stdout:?}"
-    );
-    let chatter = stderr_chatter(&stderr);
-    assert!(
-        chatter.is_empty(),
-        "--remove --silent must produce no stderr chatter on success; got {chatter:?}"
-    );
-
-    // Silent suppresses output, not the mutation: the hook must be gone.
-    let pkg = std::fs::read_to_string(tmp.path().join("package.json")).expect("read package.json");
-    assert!(
-        !pkg.contains("socket-patch"),
-        "the postinstall hook must still be removed under --silent; got {pkg:?}"
-    );
-
-    // Control run: a non-silent remove on a configured repo must print
-    // the preview and summary — otherwise the assertions above pass
-    // vacuously.
-    let tmp2 = tempfile::tempdir().expect("tempdir");
-    write_root(tmp2.path());
-    let (_, _, _) = run_setup(tmp2.path(), &["--silent", "--yes"]);
-    let (loud_code, loud_stdout, _) = run_setup(tmp2.path(), &["--remove", "--yes"]);
-    assert_eq!(loud_code, 0);
-    assert!(
-        loud_stdout.contains("Proposed changes"),
-        "non-silent remove must print the preview; got {loud_stdout:?}"
-    );
-    assert!(
-        loud_stdout.contains("1 item had socket-patch removed"),
-        "non-silent remove must print the summary; got {loud_stdout:?}"
-    );
-}
-
-/// Errors must still print under `--silent` ("errors only", not "nothing"),
-/// mirroring the remove/scan silent suites: an invalid package.json keeps
-/// its error message on stderr and exit 1 in all three modes, while the
-/// informational stdout stays suppressed.
-#[test]
-fn setup_silent_keeps_error_output() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    std::fs::write(tmp.path().join("package.json"), "{ not json").unwrap();
-
-    for mode in [&[][..], &["--check"][..], &["--remove"][..]] {
-        let mut args: Vec<&str> = mode.to_vec();
-        args.extend(["--silent", "--yes"]);
-        let (code, stdout, stderr) = run_setup(tmp.path(), &args);
-        assert_eq!(
-            code, 1,
-            "invalid package.json must exit 1 for {mode:?}; stdout={stdout:?} stderr={stderr:?}"
-        );
-        assert!(
-            stdout.trim().is_empty(),
-            "--silent must still suppress informational stdout for {mode:?}; got {stdout:?}"
-        );
-        assert!(
-            stderr.contains("Invalid package.json"),
-            "--silent must NOT suppress error output for {mode:?}; got {stderr:?}"
-        );
-    }
-}
-
-/// Same contract for the apply-phase (post-preview) failures: a package.json
-/// that previews fine but cannot be rewritten (read-only directory) must
-/// surface its write error on stderr under `--silent`, not just exit 1.
-#[cfg(unix)]
-#[test]
-fn setup_silent_keeps_apply_phase_error_output() {
-    use std::os::unix::fs::PermissionsExt;
-
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write_root(tmp.path());
-    std::fs::set_permissions(tmp.path(), std::fs::Permissions::from_mode(0o555)).unwrap();
-
-    let (code, stdout, stderr) = run_setup(tmp.path(), &["--silent", "--yes"]);
-
-    // Restore so the tempdir can clean up regardless of the assertions.
-    std::fs::set_permissions(tmp.path(), std::fs::Permissions::from_mode(0o755)).unwrap();
-
-    assert_eq!(
-        code, 1,
-        "unwritable package.json must exit 1; stdout={stdout:?} stderr={stderr:?}"
-    );
-    assert!(
-        stdout.trim().is_empty(),
-        "--silent must still suppress informational stdout; got {stdout:?}"
-    );
-    assert!(
-        stderr_chatter(&stderr)
-            .iter()
-            .any(|l| l.starts_with("Error:")),
-        "--silent must NOT suppress the apply-phase write error; got {stderr:?}"
-    );
-}
-
-/// The `no_files` path (no project found at all) is informational, not an
-/// error: under `--silent` it must print nothing and exit 0. Covers both
-/// the plain-setup inline branch and the shared `report_no_files` helper
-/// that `--check` / `--remove` use.
-#[test]
-fn setup_silent_no_files_prints_nothing() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-
-    for mode in [&[][..], &["--check"][..], &["--remove"][..]] {
-        let mut args: Vec<&str> = mode.to_vec();
-        args.push("--silent");
-        let (code, stdout, stderr) = run_setup(tmp.path(), &args);
-        assert_eq!(
-            code, 0,
-            "no_files must exit 0 for {mode:?}; stderr={stderr:?}"
-        );
-        assert!(
-            stdout.trim().is_empty(),
-            "--silent no_files must produce no stdout for {mode:?}; got {stdout:?}"
-        );
-        let chatter = stderr_chatter(&stderr);
-        assert!(
-            chatter.is_empty(),
-            "--silent no_files must produce no stderr chatter for {mode:?}; got {chatter:?}"
-        );
-    }
-
-    // Control run: without --silent the hint must print.
-    let (loud_code, loud_stdout, _) = run_setup(tmp.path(), &[]);
-    assert_eq!(loud_code, 0);
-    assert!(
-        loud_stdout.contains("No package.json, Python, Bundler, or Composer project found"),
-        "non-silent no_files must print the hint; got {loud_stdout:?}"
-    );
-}
diff --git a/crates/socket-patch-cli/tests/cli_sigpipe.rs b/crates/socket-patch-cli/tests/cli_sigpipe.rs
index caf99ee2..cba356cd 100644
--- a/crates/socket-patch-cli/tests/cli_sigpipe.rs
+++ b/crates/socket-patch-cli/tests/cli_sigpipe.rs
@@ -23,7 +23,7 @@ const BINARY: &str = env!("CARGO_BIN_EXE_socket-patch");
 const SIGPIPE: i32 = 13;
 
 /// `list` against an empty manifest is the cheapest command that writes
-/// to stdout: offline, lock-free — prints "No patches found in manifest."
+/// to stdout: offline, lock-free — prints "No patches in this project. Run `socket-patch scan`."
 /// and exits 0 when stdout is healthy.
 #[test]
 fn closed_stdout_pipe_is_not_a_panic() {
diff --git a/crates/socket-patch-cli/tests/coverage_fix_scan_hosted_dryrun_vendored.rs b/crates/socket-patch-cli/tests/coverage_fix_scan_hosted_dryrun_vendored.rs
index eb35348e..0cb61906 100644
--- a/crates/socket-patch-cli/tests/coverage_fix_scan_hosted_dryrun_vendored.rs
+++ b/crates/socket-patch-cli/tests/coverage_fix_scan_hosted_dryrun_vendored.rs
@@ -489,7 +489,7 @@ fn scan_hosted_human(cwd: &Path, api_url: &str, dry_run: bool) -> (i32, String,
 fn summary_line(stdout: &str) -> &str {
     stdout
         .lines()
-        .find(|l| l.starts_with("Would redirect ") || l.starts_with("Redirected "))
+        .find(|l| l.starts_with("Would switch ") || l.starts_with("Switched "))
         .unwrap_or_default()
 }
 
@@ -526,7 +526,7 @@ async fn human_takeover_prints_migration_lines_and_matching_file_counts() {
     );
     assert_eq!(
         summary_line(&dry_out),
-        "Would redirect 1 package and rewrite 3 files (--dry-run: nothing was changed).",
+        "Would switch 1 package to hosted patches and rewrite 3 files (--dry-run: nothing was changed).",
         "stdout=\n{dry_out}"
     );
 
@@ -542,13 +542,13 @@ async fn human_takeover_prints_migration_lines_and_matching_file_counts() {
     );
     assert_eq!(
         summary_line(&wet_out),
-        "Redirected 1 package; rewrote 3 files.",
+        "Switched 1 package to hosted patches; rewrote 3 files.",
         "the wet count must equal the dry-run preview; stdout=\n{wet_out}"
     );
     assert!(
         wet_out.contains(
-            "Commit .socket/vendor/ (the removed vendored ledger entries and artifacts), \
-             package.json, pnpm-lock.yaml, and pnpm-workspace.yaml to keep the redirect."
+            "  1. Commit .socket/vendor/ (the removed vendored ledger entries and artifacts), \
+             package.json, pnpm-lock.yaml, and pnpm-workspace.yaml to keep the hosted patches."
         ),
         "stdout=\n{wet_out}"
     );
diff --git a/crates/socket-patch-cli/tests/covgap_commands_apply.rs b/crates/socket-patch-cli/tests/covgap_commands_apply.rs
index edeb8f0a..28d0caa3 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_apply.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_apply.rs
@@ -479,7 +479,7 @@ async fn online_mismatch_prefetch_prints_download_line_in_human_mode() {
         "the human progress line must print before the prefetch; stderr={stderr}"
     );
     assert!(
-        stderr.contains("content_mismatch_overwritten"),
+        stderr.contains("did not match the patch's expected original content"),
         "the overwrite must be surfaced as the mismatch warning; stderr={stderr}"
     );
     assert_eq!(
@@ -988,7 +988,7 @@ mod gem_fallback_home_human {
             "a mismatched fallback-home copy must not fail the run; stderr={stderr}"
         );
         assert!(
-            stderr.contains("Warning (gem_fallback_home_skipped):"),
+            stderr.contains("Warning: ") && stderr.contains("was not patched"),
             "the best-effort skip must print its human warning; stderr={stderr}"
         );
         assert!(
diff --git a/crates/socket-patch-cli/tests/covgap_commands_get.rs b/crates/socket-patch-cli/tests/covgap_commands_get.rs
index da232d43..d923fc84 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_get.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_get.rs
@@ -488,7 +488,7 @@ async fn get_conflicting_type_flags_rejected_before_any_network() {
     args.cve = true;
 
     let code = run(args).await;
-    assert_eq!(code, 1, "conflicting --id/--cve must exit 1");
+    assert_eq!(code, 2, "conflicting --id/--cve is a usage error (exit 2)");
     assert_no_manifest(tmp.path());
     assert!(
         received_paths(&server).await.is_empty(),
@@ -1765,7 +1765,7 @@ async fn human_uuid_paid_via_proxy_prints_upgrade_message() {
         "paid_required is exit 0; stdout={stdout}\nstderr={stderr}"
     );
     assert!(
-        stdout.contains("requires a paid subscription"),
+        stdout.contains("requires a paid Socket plan"),
         "stdout={stdout}"
     );
     assert!(
@@ -1906,7 +1906,7 @@ async fn human_paid_only_search_prints_subscription_message() {
     let (code, stdout, stderr) = run_get_bin(tmp.path(), &server.uri(), &[cve, "--save-only"]);
     assert_eq!(code, 0, "stdout={stdout}\nstderr={stderr}");
     assert!(
-        stdout.contains("All available patches require a paid subscription."),
+        stdout.contains("All available patches require a paid Socket plan."),
         "stdout={stdout}"
     );
     assert!(
@@ -2814,7 +2814,7 @@ async fn nested_apply_block_starts_stdout_without_a_blank_line() {
 }
 
 /// A forced `--id` / `--cve` / `--ghsa` identifier is shape-checked before
-/// any network call: a readable error, exit 1, zero requests.
+/// any network call: a readable error, exit 2 (usage), zero requests.
 #[tokio::test]
 async fn forced_identifier_type_is_validated_locally() {
     let server = MockServer::start().await;
@@ -2825,13 +2825,13 @@ async fn forced_identifier_type_is_validated_locally() {
         ("--ghsa", "is not a valid GHSA ID"),
     ] {
         let (code, stdout, stderr) = run_get_bin(tmp.path(), &server.uri(), &["lodash", flag]);
-        assert_eq!(code, 1, "{flag}: stdout={stdout}\nstderr={stderr}");
+        assert_eq!(code, 2, "{flag}: stdout={stdout}\nstderr={stderr}");
         assert!(
             stderr.contains(&format!("Error: \"lodash\" {what} (expected ")),
             "{flag}: stderr={stderr}"
         );
         let (code, stdout, _) = run_get_bin(tmp.path(), &server.uri(), &["lodash", flag, "--json"]);
-        assert_eq!(code, 1);
+        assert_eq!(code, 2);
         let v = parse_single_json_doc(&stdout);
         assert_eq!(v["status"], "error", "{v}");
         assert!(v["error"].as_str().unwrap().contains(what), "{v}");
@@ -2879,8 +2879,8 @@ async fn proxy_403_on_uuid_is_paid_required() {
     assert_eq!(code, 0, "stdout={stdout}\nstderr={stderr}");
     assert!(
         stdout.contains(&format!(
-            "This patch requires a paid subscription to download.\n  Patch: {UUID}\n  \
-             Upgrade at: https://socket.dev/pricing"
+            "This patch requires a paid Socket plan.\n  Patch: {UUID}\n\
+             Upgrade to a paid Socket plan to access all patches: https://socket.dev/pricing"
         )),
         "stdout={stdout}"
     );
diff --git a/crates/socket-patch-cli/tests/covgap_commands_remove.rs b/crates/socket-patch-cli/tests/covgap_commands_remove.rs
index 49b300de..de10372f 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_remove.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_remove.rs
@@ -930,7 +930,7 @@ fn remove_hosted_only_human_lists_redirects_and_unwinds() {
     let (code, stdout, stderr) = run_remove_online(tmp.path(), &[NPM_PURL, "--yes"], &registry);
     assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
     assert!(
-        stderr.contains("The following hosted redirect will be unwound and removed:"),
+        stderr.contains("The following hosted patch will be unwound and removed:"),
         "the hosted-only listing must reach stderr; got:\n{stderr}"
     );
     assert!(
@@ -1835,7 +1835,7 @@ mod pty {
     }
 
     /// Declining the hosted-only confirm prompt must cancel cleanly (exit
-    /// 0, "Removal cancelled.") with the lock byte-identical and no
+    /// 0, "Cancelled; no changes made.") with the lock byte-identical and no
     /// `.socket/` state written.
     #[test]
     fn remove_hosted_only_interactive_n_cancels() {
@@ -1856,7 +1856,7 @@ mod pty {
         );
         // Vacuity guard: the hosted-only confirm prompt MUST have run.
         assert!(
-            output.contains("Remove 1 hosted redirect and unwind its lockfile wiring?"),
+            output.contains("Remove 1 hosted patch and unwind its lockfile wiring?"),
             "the hosted-only confirm prompt must have shown; got: {output}"
         );
         assert!(
@@ -1864,7 +1864,7 @@ mod pty {
             "must NOT have taken the non-interactive branch in a PTY; got: {output}"
         );
         assert!(
-            output.contains("Removal cancelled"),
+            output.contains("Cancelled; no changes made."),
             "'n' must report cancellation; got: {output}"
         );
         // Declined: nothing moved.
diff --git a/crates/socket-patch-cli/tests/covgap_commands_rollback.rs b/crates/socket-patch-cli/tests/covgap_commands_rollback.rs
index e5e8430a..496d0638 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_rollback.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_rollback.rs
@@ -2332,7 +2332,7 @@ mod interactive {
     }
 
     /// Declining the rollback confirm prompt cancels cleanly: the composed
-    /// manifest clause renders with the `[Y/n]` hint, "Rollback cancelled."
+    /// manifest clause renders with the `[Y/n]` hint, "Cancelled; no changes made."
     /// prints, the run exits 0, and nothing is mutated.
     #[test]
     fn rollback_interactive_decline_cancels() {
@@ -2367,7 +2367,7 @@ mod interactive {
             "the PTY run must take the interactive branch; got: {output}"
         );
         assert!(
-            output.contains("Rollback cancelled."),
+            output.contains("Cancelled; no changes made."),
             "the decline must be acknowledged; got: {output}"
         );
         assert_eq!(
@@ -3380,7 +3380,7 @@ fn vlt_hosted_rollback_dry_run_keeps_the_store_and_wet_human_run_heals() {
     );
     assert!(
         stderr.contains(
-            "Warning (redirect_vlt_reinstall_required): restored registry pins for 1 packages; \
+            "Warning: restored registry pins for 1 packages; \
              removed the patched installed copies"
         ),
         "{stderr}"
diff --git a/crates/socket-patch-cli/tests/covgap_commands_scan_hosted.rs b/crates/socket-patch-cli/tests/covgap_commands_scan_hosted.rs
index cea44d55..35577532 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_scan_hosted.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_scan_hosted.rs
@@ -517,7 +517,7 @@ async fn wet_takeover_refuses_unrevertable_vendored_flavor_fail_closed() {
     assert_eq!(code, 0, "a refused takeover still exits 0: {doc:#}");
     let detail = warning_detail(&doc, "redirect_vendored_revert_failed");
     assert!(
-        detail.contains("NOT redirected") && detail.contains("vendor --revert"),
+        detail.contains("NOT switched to hosted") && detail.contains("vendor --revert"),
         "the refusal must name the fail-closed outcome and the manual path: {detail}"
     );
     assert!(
@@ -555,18 +555,18 @@ async fn wet_takeover_refuses_unrevertable_vendored_flavor_fail_closed() {
     let (code, stdout, stderr) = scan_hosted(tmp.path(), &server.uri(), &[], &[]);
     assert_eq!(code, 0, "human refusal run exits 0; stderr=\n{stderr}");
     assert!(
-        stdout.contains("Redirected 0 packages; rewrote 0 files."),
+        stdout.contains("Switched 0 packages to hosted patches; rewrote 0 files."),
         "anchor: the human redirect branch ran; stdout=\n{stdout}"
     );
     assert!(
         stderr.contains(&format!(
-            "No patches could be redirected:\n  {PURL}: its vendored state could not be \
+            "No patches could be switched to hosted:\n  {PURL}: its vendored state could not be \
              reverted (see the warning)"
         )),
         "the human skipped line must name purl + reason; stderr=\n{stderr}"
     );
     assert!(
-        stderr.contains("Warning (redirect_vendored_revert_failed): ")
+        stderr.contains("Warning: ")
             && stderr.contains("could not be reverted"),
         "the takeover pre-warning must reach human stderr; stderr=\n{stderr}"
     );
@@ -958,7 +958,7 @@ async fn successful_wet_hosted_run_leaves_nothing_under_socket() {
     let (code, stdout, stderr) = scan_hosted(root, &server.uri(), &[], &[]);
     assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
     assert!(
-        stdout.contains("Redirected 1 package; rewrote"),
+        stdout.contains("Switched 1 package to hosted patches; rewrote"),
         "the run must have redirected (and therefore locked); stdout=\n{stdout}"
     );
     assert!(
@@ -1083,15 +1083,15 @@ async fn hosted_human_paid_only_discovery_stops_with_the_paid_hint() {
     let (code, stdout, stderr) = scan_hosted(root, &server.uri(), &[], &[]);
     assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
     assert!(
-        stdout.contains("No downloadable patches (paid subscription required)."),
+        stdout.contains("No downloadable patches: every patch found requires a paid Socket plan."),
         "stdout=\n{stdout}"
     );
     assert!(
-        stdout.contains("1 additional patch is available with a paid subscription"),
+        stdout.contains("1 additional patch is available with a paid Socket plan"),
         "the table's paid nudge still prints; stdout=\n{stdout}"
     );
     assert!(
-        !stdout.contains("Redirected"),
+        !stdout.contains("Switched"),
         "the engine is never entered; stdout=\n{stdout}"
     );
     assert_eq!(
@@ -1932,8 +1932,7 @@ async fn live_hosted_overlap_fires_redirect_supersedes_vendored() {
     assert_eq!(code, 0, "human overlap run exits 0; stderr=\n{stderr}");
     assert!(
         stderr.contains(
-            "Warning (redirect_supersedes_vendored): Hosted redirect superseded the vendored \
-             ledger for:"
+            "Warning: Hosted wiring superseded the vendored ledger for:"
         ) && stderr.contains(XPURL),
         "the supersedes warning must reach human stderr; stderr=\n{stderr}"
     );
@@ -1973,16 +1972,16 @@ async fn human_dry_run_prints_would_rewrite_pnpm_guidance_and_vex_skip() {
     );
     assert!(
         stdout.contains(
-            "Would redirect 1 package and rewrite 2 files (--dry-run: nothing was changed)."
+            "Would switch 1 package to hosted patches and rewrite 2 files (--dry-run: nothing was changed)."
         ),
         "the dry-run summary must use the preview verb; stdout=\n{stdout}"
     );
     assert!(
-        stderr.contains("Skipping VEX generation (--dry-run: nothing was redirected)."),
+        stderr.contains("Skipping VEX generation (--dry-run: nothing was rewritten)."),
         "the requested-but-skipped VEX must be announced; stderr=\n{stderr}"
     );
     assert!(
-        stderr.contains("Warning (redirect_pnpm_trust_lockfile): ")
+        stderr.contains("Warning: ")
             && stderr.contains("trustLockfile"),
         "the pnpm trust guidance must reach human stderr; stderr=\n{stderr}"
     );
@@ -2027,7 +2026,7 @@ async fn human_vex_success_summary_names_statements_path_and_ledger_caveat() {
         "scan --vex exits 0; stdout=\n{stdout}\nstderr=\n{stderr}"
     );
     assert!(
-        stdout.contains("Redirected 1 package; rewrote"),
+        stdout.contains("Switched 1 package to hosted patches; rewrote"),
         "anchor: the wet-run summary verb; stdout=\n{stdout}"
     );
     assert!(
@@ -2122,12 +2121,12 @@ async fn human_rush_run_prints_the_repo_state_stale_warning_line() {
         "rush run exits 0; stdout=\n{stdout}\nstderr=\n{stderr}"
     );
     assert!(
-        stdout.contains("Redirected 1 package; rewrote"),
+        stdout.contains("Switched 1 package to hosted patches; rewrote"),
         "anchor: the rush lock must be rewritten; stdout=\n{stdout}"
     );
     assert!(
         stderr.contains(
-            "Warning (redirect_rush_repo_state_stale): pnpm-lock.yaml was edited outside \
+            "Warning: pnpm-lock.yaml was edited outside \
              `rush update`"
         ),
         "the rush repo-state warning must reach human stderr; stderr=\n{stderr}"
@@ -2241,7 +2240,7 @@ async fn human_reference_failure_prints_an_error_line_and_exits_1() {
             && line.ends_with("(nothing was changed; re-run to retry)"),
         "{line}"
     );
-    assert!(!stdout.contains("Redirected"), "stdout=\n{stdout}");
+    assert!(!stdout.contains("Switched"), "stdout=\n{stdout}");
     assert_eq!(
         std::fs::read(tmp.path().join("package-lock.json")).unwrap(),
         lock_before
@@ -2276,7 +2275,7 @@ async fn human_malformed_pre_v5_ledger_does_not_abort_the_run() {
     let (code, stdout, stderr) = scan_hosted(tmp.path(), &server.uri(), &["--dry-run"], &[]);
     assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
     assert!(
-        stdout.contains("Would redirect 1 package"),
+        stdout.contains("Would switch 1 package to hosted patches"),
         "stdout=\n{stdout}"
     );
     assert!(
@@ -2338,10 +2337,12 @@ async fn human_rerun_says_already_redirected_and_first_run_prints_next_steps() {
     assert_eq!(code, 0, "stderr=\n{stderr}");
     assert_eq!(
         engine_stdout(&stdout),
-        "Redirected 1 package; rewrote 2 files.\n\
-         Commit .npmrc and package-lock.json to keep the redirect.\n\
-         Reinstall from the updated lockfile (e.g. `npm ci`) so the installed packages pick \
-         up the patched artifacts, then run `socket-patch vex` to verify them.\n",
+        "Switched 1 package to hosted patches; rewrote 2 files.\n\
+         Next steps:\n  \
+         1. Commit .npmrc and package-lock.json to keep the hosted patches.\n  \
+         2. Reinstall from the updated lockfile (e.g. `npm ci`) so the installed packages pick \
+         up the patched artifacts, then run `socket-patch vex` to verify the installed \
+         patches.\n",
         "stderr=\n{stderr}"
     );
 
@@ -2349,14 +2350,14 @@ async fn human_rerun_says_already_redirected_and_first_run_prints_next_steps() {
     assert_eq!(code, 0, "stderr=\n{stderr}");
     assert_eq!(
         engine_stdout(&stdout),
-        "1 package is already redirected; nothing to rewrite.\n",
+        "1 package is already on hosted patches; nothing to rewrite.\n",
         "stderr=\n{stderr}"
     );
     let (code, stdout, _) = scan_hosted(tmp.path(), &server.uri(), &["--dry-run"], &[]);
     assert_eq!(code, 0);
     assert_eq!(
         engine_stdout(&stdout),
-        "1 package is already redirected; nothing to rewrite.\n"
+        "1 package is already on hosted patches; nothing to rewrite.\n"
     );
 }
 
@@ -2383,13 +2384,13 @@ async fn human_unconfirmed_purl_is_listed_with_a_headline() {
     let (code, stdout, stderr) = scan_hosted(tmp.path(), &server.uri(), &["--dry-run"], &[]);
     assert_eq!(code, 0, "a no-op redirect still exits 0; stderr=\n{stderr}");
     assert!(
-        stdout.contains("Would redirect 0 packages and rewrite 0 files"),
+        stdout.contains("Would switch 0 packages to hosted patches and rewrite 0 files"),
         "stdout=\n{stdout}"
     );
     assert!(
         stderr.contains(&format!(
-            "No patches could be redirected:\n  {PURL}: no lockfile entry pinning it could \
-             be redirected"
+            "No patches could be switched to hosted:\n  {PURL}: no lockfile entry pinning it \
+             could be rewritten"
         )),
         "stderr=\n{stderr}"
     );
@@ -2411,22 +2412,22 @@ async fn human_pnpm_rerun_prints_only_the_reminder_and_heal_restores_guidance()
     let tmp = tempfile::tempdir().unwrap();
     let root = tmp.path();
     write_pnpm_project(root);
-    const REMINDER: &str = "Warning (redirect_pnpm_trust_lockfile): pnpm-lock.yaml is already \
-        redirected and pnpm-workspace.yaml already sets `trustLockfile: true`; keep both \
+    const REMINDER: &str = "Warning: pnpm-lock.yaml already uses \
+        hosted patches and pnpm-workspace.yaml already sets `trustLockfile: true`; keep both \
         committed, and never rebuild the lockfile (`pnpm clean --lockfile`), which discards \
-        the redirect\n";
+        the hosted patches\n";
 
     let (code, stdout, stderr) = scan_hosted(root, &server.uri(), &[], &[]);
     assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
     assert!(
-        engine_stdout(&stdout).starts_with("Redirected 1 package; rewrote 2 files.\n"),
+        engine_stdout(&stdout).starts_with("Switched 1 package to hosted patches; rewrote 2 files.\n"),
         "{stdout}"
     );
     // Everything from the pnpm warning on (the lines above it are the
     // token-format notice and discovery progress).
     let pnpm_part = |stderr: &str| -> String {
         stderr
-            .find("Warning (redirect_pnpm_trust_lockfile): ")
+            .find("Warning: pnpm-lock.yaml")
             .map(|i| stderr[i..].to_string())
             .unwrap_or_default()
     };
@@ -2440,7 +2441,7 @@ async fn human_pnpm_rerun_prints_only_the_reminder_and_heal_restores_guidance()
     assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
     assert_eq!(
         engine_stdout(&stdout),
-        "1 package is already redirected; nothing to rewrite.\n"
+        "1 package is already on hosted patches; nothing to rewrite.\n"
     );
     assert_eq!(
         pnpm_part(&stderr),
diff --git a/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs b/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs
index c5e57a55..c11d71b8 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs
@@ -444,7 +444,7 @@ fn scan_hosted_prune_human_warns_prune_is_ignored() {
         "hosted --prune stays accepted (never a usage error)"
     );
     assert!(
-        stderr.contains("Warning (redirect_prune_ignored):"),
+        stderr.contains("Warning: --prune has no effect with --mode hosted"),
         "the ignored-prune warning must reach stderr; got {stderr:?}"
     );
     assert!(
@@ -547,7 +547,7 @@ async fn scan_paid_patch_without_access_nudges_and_downloads_nothing() {
         "the no-access summary counts FREE patches only; got {stdout:?}"
     );
     assert!(
-        stdout.contains("+ 1 additional patch is available with a paid subscription"),
+        stdout.contains("+ 1 additional patch is available with a paid Socket plan"),
         "the paid nudge must print; got {stdout:?}"
     );
     assert!(
@@ -555,7 +555,7 @@ async fn scan_paid_patch_without_access_nudges_and_downloads_nothing() {
         "the pricing URL must print; got {stdout:?}"
     );
     assert!(
-        stdout.contains("No downloadable patches (paid subscription required)."),
+        stdout.contains("No downloadable patches: every patch found requires a paid Socket plan."),
         "the gated-catalog terminal must print; got {stdout:?}"
     );
 
@@ -1067,7 +1067,7 @@ async fn scan_human_apply_over_live_hosted_wiring_warns_retained() {
     let (code, stdout, stderr) = run_scan_agent(tmp.path(), &mock.uri(), &["--yes"]);
     assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
     assert!(
-        stderr.contains("Warning (hosted_wiring_retained):"),
+        stderr.contains("Warning: agent-mode scan left the hosted wiring live"),
         "the retained-wiring warning must reach stderr; got {stderr:?}"
     );
     assert!(
@@ -1098,9 +1098,6 @@ fn scan_human_vex_success_prints_wrote_line() {
     std::fs::write(
         socket.join("manifest.json"),
         serde_json::to_string_pretty(&serde_json::json!({
-            // npm declared `manual` so VEX generation does not omit the
-            // patch (ecosystem_not_setup) and fail the run.
-            "setup": { "exclude": [], "manual": ["npm"] },
             "patches": {
                 "pkg:npm/vuln-pkg@1.0.0": {
                     "uuid": UUID,
@@ -1196,7 +1193,7 @@ async fn scan_human_pnp_refusal_prints_alongside_other_ecosystems() {
         "the gem must be discovered (non-empty path); got {stderr:?}"
     );
     assert!(
-        stderr.contains("Warning (yarn_pnp_unsupported):"),
+        stderr.contains("Warning: ") && stderr.contains("Plug'n'Play"),
         "the PnP refusal must print on the non-empty path; got {stderr:?}"
     );
     assert!(
@@ -1489,7 +1486,7 @@ async fn scan_hosted_paths_run_once_per_project_directory() {
         let header = format!("== {} ==", Path::new("apps").join(app).display());
         assert!(stdout.contains(&header), "missing {header:?}: {stdout}");
     }
-    assert_eq!(stdout.matches("Redirected 0 packages").count(), 2, "{stdout}");
+    assert_eq!(stdout.matches("Switched 0 packages to hosted patches").count(), 2, "{stdout}");
     let reqs = recorded(&mock).await;
     assert_eq!(batch_bodies(&reqs).len(), 2, "one discovery per directory");
 }
@@ -1529,7 +1526,7 @@ async fn scan_hosted_human_prints_table_updates_and_redirects() {
         "scan never prompts; got {stderr:?}"
     );
     assert!(
-        stdout.contains("Redirected 0 packages"),
+        stdout.contains("Switched 0 packages to hosted patches"),
         "the engine must run; got {stdout:?}"
     );
     let reqs = recorded(&mock).await;
@@ -1980,19 +1977,19 @@ fn scan_invalid_bun_lockb_warns_instead_of_silent_success() {
             "mode={mode:?}: the binary format error must name its file: {detail}"
         );
         assert!(
-            !stdout.contains("Warning ("),
+            !stdout.contains("Warning:"),
             "mode={mode:?}: the human warning line must not leak into the JSON stream: {stdout}"
         );
     }
 
-    // Human path: the same diagnosis as a stderr `Warning (code): detail`
+    // Human path: the same diagnosis as a stderr `Warning: detail`
     // line, exit 0, and the generic "No packages found" hint still prints.
     let tmp = tempfile::tempdir().unwrap();
     write_invalid_bun_lockb_project(tmp.path());
     let (code, stdout, stderr) = run_scan(tmp.path(), &[]);
     assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
     assert!(
-        stderr.contains("Warning (bun_lockb_invalid): cannot inventory bun.lockb"),
+        stderr.contains("Warning: cannot inventory bun.lockb"),
         "the human path must name the layout and the code; got {stderr:?}"
     );
     assert!(
@@ -2058,7 +2055,7 @@ async fn scan_nonempty_keeps_the_bun_lockb_discovery_warning_in_every_mode() {
     let (code, stdout, stderr) = run_scan_human(tmp.path(), &mock.uri(), &["--mode", "hosted"]);
     assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
     assert!(
-        stderr.contains("Warning (bun_lockb_invalid):"),
+        stderr.contains("Warning: cannot inventory bun.lockb"),
         "the human hosted path must keep the warning; got {stderr:?}"
     );
 }
diff --git a/crates/socket-patch-cli/tests/covgap_commands_setup.rs b/crates/socket-patch-cli/tests/covgap_commands_setup.rs
deleted file mode 100644
index db0ce3f9..00000000
--- a/crates/socket-patch-cli/tests/covgap_commands_setup.rs
+++ /dev/null
@@ -1,1979 +0,0 @@
-//! Coverage-gap tests for `commands/setup.rs`. Each section's "Covers NNN"
-//! refs are setup.rs line numbers at the d5e1815 audit and have drifted
-//! since; use the named functions/messages to locate the code.
-//!
-//! Everything here runs on the host with no Docker and no ecosystem
-//! toolchain: `setup` edits package.json / requirements.txt / pyproject.toml /
-//! Gemfile / composer.json directly. The gem/composer round trips mirror the
-//! feature-gated `setup_matrix_{gem,composer}.rs` host guards, which the
-//! default (non-`setup-e2e`) test configuration never compiles — these
-//! always-on ports are what actually count for coverage.
-
-#[path = "common/pty_io.rs"]
-mod pty_io;
-use std::path::Path;
-
-#[path = "common/mod.rs"]
-mod common;
-
-// ---------------------------------------------------------------------------
-// Fixtures
-// ---------------------------------------------------------------------------
-
-const UNWIRED_PACKAGE_JSON: &str = "{ \"name\": \"covgap\", \"version\": \"1.0.0\" }\n";
-
-/// A package.json `setup` reports `already_configured` (the same wired form
-/// `setup_check_tolerates_bom_like_npm` pins, minus the BOM).
-const WIRED_SCRIPTS_FRAGMENT: &str = "\"scripts\":{\"postinstall\":\"npx @socketsecurity/socket-patch apply --silent --ecosystems npm\",\"dependencies\":\"npx @socketsecurity/socket-patch apply --silent --ecosystems npm\"}";
-
-const GEMFILE_FIXTURE: &str = "source 'https://rubygems.org'\ngem 'colorize', '1.1.0'\n";
-
-/// Same shape as the feature-gated composer matrix fixture: 4-space indented,
-/// so the byte-for-byte restore assertion has real formatting to preserve.
-const COMPOSER_JSON: &str =
-    "{\n    \"name\": \"acme/widget\",\n    \"require\": {\n        \"monolog/monolog\": \"3.5.0\"\n    }\n}\n";
-
-/// A Gemfile.lock as `bundle install` under bundler 1.17.3 writes it — the
-/// deterministic lock-probe input for the bundler version floor (the probe
-/// classifies from `BUNDLED WITH` before ever spawning `bundle`).
-const LOCK_1X: &str = "GEM\n  remote: https://rubygems.org/\n  specs:\n    \
-                       colorize (1.1.0)\n\nPLATFORMS\n  ruby\n\nDEPENDENCIES\n  \
-                       colorize (= 1.1.0)\n\nBUNDLED WITH\n   1.17.3\n";
-
-/// The supported-floor twin of [`LOCK_1X`]. Every fixture that wires (or
-/// checks) a Gemfile pins the probe through this lock: without one on disk
-/// the floor probe falls through to the host's real `bundle --version`, and
-/// a machine whose first-on-PATH bundler is below the 2.2 floor (stock macOS
-/// ships /usr/bin/bundle = 1.17.2) would make `setup` refuse to wire.
-const LOCK_2X: &str = "GEM\n  remote: https://rubygems.org/\n  specs:\n    \
-                       colorize (1.1.0)\n\nPLATFORMS\n  ruby\n\nDEPENDENCIES\n  \
-                       colorize (= 1.1.0)\n\nBUNDLED WITH\n   2.5.22\n";
-
-/// Classic-Poetry pyproject (no `[project]` table) — `detect_python_pm`
-/// classifies `[tool.poetry]` as Poetry with no poetry.lock on disk, and
-/// `add_hook_dependency` edits `[tool.poetry.dependencies]` (the same fixture
-/// `setup_pth_invariants.rs` wires through its shims).
-const POETRY_PYPROJECT: &str = "[tool.poetry]\nname = \"x\"\nversion = \"0.1.0\"\ndescription = \"\"\nauthors = []\n\n[tool.poetry.dependencies]\npython = \"^3.9\"\n";
-
-const REQUIREMENTS_NO_HOOK: &str = "requests==2.31.0\n";
-
-// ---------------------------------------------------------------------------
-// Helpers
-// ---------------------------------------------------------------------------
-
-fn write(path: &Path, content: &str) {
-    if let Some(parent) = path.parent() {
-        std::fs::create_dir_all(parent).expect("create parent");
-    }
-    std::fs::write(path, content).expect("write file");
-}
-
-fn read(path: &Path) -> String {
-    std::fs::read_to_string(path).expect("read file")
-}
-
-/// Run the binary through the shared hermetic runner (`SOCKET_*` scrubbed,
-/// telemetry disabled). Returns `(code, stdout, stderr)`.
-fn run(cwd: &Path, args: &[&str]) -> (i32, String, String) {
-    common::run_with_env(cwd, args, &[("SOCKET_TELEMETRY_DISABLED", "1")])
-}
-
-/// [`run`] + extra child-only env (e.g. a PATH override for the lockfile
-/// refresh spawn). The parent process env is never mutated, so no
-/// serialization is needed.
-fn run_env(cwd: &Path, args: &[&str], env: &[(&str, &str)]) -> (i32, String, String) {
-    let mut merged: Vec<(&str, &str)> = vec![("SOCKET_TELEMETRY_DISABLED", "1")];
-    merged.extend_from_slice(env);
-    common::run_with_env(cwd, args, &merged)
-}
-
-/// [`run`], asserting stdout is one JSON document.
-fn run_json(cwd: &Path, args: &[&str]) -> (i32, serde_json::Value) {
-    let (code, stdout, stderr) = run(cwd, args);
-    let v = serde_json::from_str(&stdout).unwrap_or_else(|e| {
-        panic!("stdout must be JSON ({e}); stdout=\n{stdout}\nstderr=\n{stderr}")
-    });
-    (code, v)
-}
-
-/// All `files[]` entries with the given `kind`.
-fn entries_of<'a>(v: &'a serde_json::Value, kind: &str) -> Vec<&'a serde_json::Value> {
-    v["files"]
-        .as_array()
-        .unwrap_or_else(|| panic!("files must be an array: {v}"))
-        .iter()
-        .filter(|f| f["kind"] == kind)
-        .collect()
-}
-
-/// The single `files[]` entry with the given `kind` (panics on 0 or >1).
-fn entry_of<'a>(v: &'a serde_json::Value, kind: &str) -> &'a serde_json::Value {
-    let matches = entries_of(v, kind);
-    assert_eq!(
-        matches.len(),
-        1,
-        "expected exactly one `{kind}` entry, got {}: {v}",
-        matches.len()
-    );
-    matches[0]
-}
-
-/// Wire a fixture with `setup --yes --json`, asserting it succeeded.
-fn wire(cwd: &Path) {
-    let (code, v) = run_json(cwd, &["setup", "--yes", "--json"]);
-    assert_eq!(code, 0, "fixture wiring must succeed: {v}");
-    assert_eq!(v["status"], "success", "fixture wiring must succeed: {v}");
-}
-
-#[cfg(unix)]
-fn running_as_root() -> bool {
-    std::process::Command::new("id")
-        .arg("-u")
-        .output()
-        .ok()
-        .and_then(|o| String::from_utf8(o.stdout).ok())
-        .map(|s| s.trim() == "0")
-        .unwrap_or(false)
-}
-
-#[cfg(unix)]
-fn chmod(path: &Path, mode: u32) {
-    use std::os::unix::fs::PermissionsExt;
-    std::fs::set_permissions(path, std::fs::Permissions::from_mode(mode)).expect("chmod");
-}
-
-// ---------------------------------------------------------------------------
-// Composer setup/check/remove round trip — always-on port of the
-// feature-gated setup_matrix_composer host guard.
-// Covers 59 (composer telemetry tag), 674, 678-702, 705-718, 721-729
-// (build_composer_outcome add+remove, status vocabulary), 743, 746-757
-// (append_composer_check_entries probe arms).
-// ---------------------------------------------------------------------------
-
-#[test]
-fn composer_setup_check_remove_round_trip() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(&cwd.join("composer.json"), COMPOSER_JSON);
-
-    // check (pristine): the composer entry needs configuration, exit 1.
-    let (code, v) = run_json(cwd, &["setup", "--check", "--json"]);
-    assert_eq!(code, 1, "pre-setup check must fail: {v}");
-    assert_eq!(v["status"], "needs_configuration", "{v}");
-    assert_eq!(entry_of(&v, "composer")["status"], "needs_configuration");
-
-    // setup: wires the hook into both script events.
-    let (code, v) = run_json(cwd, &["setup", "--yes", "--json"]);
-    assert_eq!(code, 0, "composer setup must succeed: {v}");
-    assert_eq!(v["status"], "success", "{v}");
-    assert_eq!(v["updated"], 1, "{v}");
-    assert_eq!(entry_of(&v, "composer")["status"], "updated");
-    let wired: serde_json::Value =
-        serde_json::from_str(&read(&cwd.join("composer.json"))).expect("valid composer.json");
-    for event in ["post-install-cmd", "post-update-cmd"] {
-        assert!(
-            wired["scripts"][event]
-                .as_array()
-                .unwrap_or_else(|| panic!("{event} missing: {wired}"))
-                .iter()
-                .any(|c| c.as_str().is_some_and(|s| s.contains("socket-patch apply"))),
-            "{event} must carry the re-apply command: {wired}"
-        );
-    }
-
-    // idempotent second setup: already_configured.
-    let (code, v) = run_json(cwd, &["setup", "--yes", "--json"]);
-    assert_eq!(code, 0);
-    assert_eq!(v["status"], "already_configured", "{v}");
-    assert_eq!(entry_of(&v, "composer")["status"], "already_configured");
-
-    // check (wired): configured, exit 0.
-    let (code, v) = run_json(cwd, &["setup", "--check", "--json"]);
-    assert_eq!(code, 0, "post-setup check must pass: {v}");
-    assert_eq!(entry_of(&v, "composer")["status"], "configured");
-
-    // remove: strips the hook and restores composer.json byte-for-byte.
-    let (code, v) = run_json(cwd, &["setup", "--remove", "--yes", "--json"]);
-    assert_eq!(code, 0, "composer remove must succeed: {v}");
-    assert_eq!(v["status"], "success", "{v}");
-    assert_eq!(v["removed"], 1, "{v}");
-    assert_eq!(entry_of(&v, "composer")["status"], "removed");
-    assert_eq!(
-        read(&cwd.join("composer.json")),
-        COMPOSER_JSON,
-        "remove must restore composer.json byte-for-byte"
-    );
-
-    // second remove: nothing left to unwire → not_configured.
-    let (code, v) = run_json(cwd, &["setup", "--remove", "--yes", "--json"]);
-    assert_eq!(code, 0, "{v}");
-    assert_eq!(v["status"], "not_configured", "{v}");
-    assert_eq!(entry_of(&v, "composer")["status"], "not_configured");
-
-    // check (post-remove): needs configuration again.
-    let (code, v) = run_json(cwd, &["setup", "--check", "--json"]);
-    assert_eq!(code, 1, "post-remove check must fail again: {v}");
-    assert_eq!(entry_of(&v, "composer")["status"], "needs_configuration");
-}
-
-// ---------------------------------------------------------------------------
-// `--ecosystems` scope-outs.
-// Covers 740 (composer scoped out of check), 822 (gem scoped out of check),
-// and 117 (npm scoped out of discover).
-// ---------------------------------------------------------------------------
-
-#[test]
-fn check_ecosystems_scopes_gem_and_composer_out() {
-    // A gem+composer project checked with npm-only scope: both branches
-    // return before probing, so no manifest at all is in scope → no_files.
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(&cwd.join("Gemfile"), GEMFILE_FIXTURE);
-    write(&cwd.join("composer.json"), COMPOSER_JSON);
-
-    let (code, v) = run_json(cwd, &["setup", "--check", "--json", "--ecosystems", "npm"]);
-    assert_eq!(code, 0, "nothing in scope must exit 0: {v}");
-    assert_eq!(v["status"], "no_files", "{v}");
-    assert!(
-        v["files"].as_array().is_some_and(|a| a.is_empty()),
-        "no entry may leak past the scope filter: {v}"
-    );
-}
-
-#[test]
-fn check_ecosystems_scopes_npm_out() {
-    // npm OUT of scope (the reverse of setup_contract_gaps'
-    // `setup_ecosystems_filter_scopes_work_to_named_ecosystem`): discover()
-    // must return empty without walking, leaving only the pth entry.
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(&cwd.join("package.json"), UNWIRED_PACKAGE_JSON);
-    write(&cwd.join("requirements.txt"), REQUIREMENTS_NO_HOOK);
-
-    let (code, v) = run_json(cwd, &["setup", "--check", "--json", "--ecosystems", "pypi"]);
-    assert_eq!(code, 1, "the unwired pth entry must fail the check: {v}");
-    let files = v["files"].as_array().expect("files[]");
-    assert_eq!(files.len(), 1, "only the pth entry may appear: {v}");
-    assert_eq!(files[0]["kind"], "pth", "{v}");
-
-    // And a real scoped run must leave the out-of-scope package.json alone.
-    let (code, v) = run_json(cwd, &["setup", "--yes", "--json", "--ecosystems", "pypi"]);
-    assert_eq!(code, 0, "{v}");
-    assert_eq!(
-        read(&cwd.join("package.json")),
-        UNWIRED_PACKAGE_JSON,
-        "`--ecosystems pypi` must not touch package.json"
-    );
-    assert!(
-        read(&cwd.join("requirements.txt")).contains("socket-patch[hook]"),
-        "the in-scope python manifest must be wired"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// Gem check + remove round trip and the bundler version floor — always-on
-// port of the feature-gated setup_matrix_gem host guards.
-// Covers 613, 625-626, 647, 655-658 (remove path + gem_status_str), 825,
-// 836-858 (probe arms incl. the Unsupported wired/unwired errors), 863-875
-// (gemfile + gem_plugin check entries).
-// ---------------------------------------------------------------------------
-
-#[test]
-fn gem_check_setup_remove_round_trip() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(&cwd.join("Gemfile"), GEMFILE_FIXTURE);
-    write(&cwd.join("Gemfile.lock"), LOCK_2X);
-
-    // check (pristine): Gemfile + plugin dir both need configuration.
-    let (code, v) = run_json(cwd, &["setup", "--check", "--json"]);
-    assert_eq!(code, 1, "pre-setup gem check must fail: {v}");
-    assert_eq!(entry_of(&v, "gemfile")["status"], "needs_configuration");
-    assert_eq!(entry_of(&v, "gem_plugin")["status"], "needs_configuration");
-    assert_eq!(v["needsConfiguration"], 2, "{v}");
-
-    wire(cwd);
-    assert!(
-        read(&cwd.join("Gemfile")).contains("plugin 'socket-patch'"),
-        "setup must wire the plugin directive"
-    );
-
-    // check (wired): both entries configured, exit 0.
-    let (code, v) = run_json(cwd, &["setup", "--check", "--json"]);
-    assert_eq!(code, 0, "post-setup gem check must pass: {v}");
-    assert_eq!(entry_of(&v, "gemfile")["status"], "configured");
-    assert_eq!(entry_of(&v, "gem_plugin")["status"], "configured");
-
-    // remove: Gemfile restored byte-for-byte, plugin dir deleted.
-    let (code, v) = run_json(cwd, &["setup", "--remove", "--yes", "--json"]);
-    assert_eq!(code, 0, "gem remove must succeed: {v}");
-    assert_eq!(v["status"], "success", "{v}");
-    assert_eq!(entry_of(&v, "gemfile")["status"], "removed");
-    assert_eq!(entry_of(&v, "gem_plugin")["status"], "removed");
-    assert_eq!(
-        read(&cwd.join("Gemfile")),
-        GEMFILE_FIXTURE,
-        "remove must restore the Gemfile byte-for-byte"
-    );
-    assert!(
-        !cwd.join(".socket/bundler-plugin").exists(),
-        "remove must delete the generated plugin dir"
-    );
-
-    // second remove: nothing wired → not_configured vocabulary.
-    let (code, v) = run_json(cwd, &["setup", "--remove", "--yes", "--json"]);
-    assert_eq!(code, 0, "{v}");
-    assert_eq!(v["status"], "not_configured", "{v}");
-    assert_eq!(entry_of(&v, "gemfile")["status"], "not_configured");
-    assert_eq!(entry_of(&v, "gem_plugin")["status"], "not_configured");
-}
-
-#[test]
-fn gem_check_bundler_1x_lock_unwired_reports_error() {
-    // The lock probe (`BUNDLED WITH 1.17.3`) classifies without spawning
-    // bundler, so this is deterministic on every host. An UNWIRED project
-    // below the floor is an error (running `setup` cannot help — it refuses
-    // to wire), not needs_configuration.
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(&cwd.join("Gemfile"), GEMFILE_FIXTURE);
-    write(&cwd.join("Gemfile.lock"), LOCK_1X);
-
-    let (code, v) = run_json(cwd, &["setup", "--check", "--json"]);
-    assert_eq!(code, 1, "an unsupported bundler must fail the check: {v}");
-    assert_eq!(v["status"], "error", "{v}");
-    let gemfile = entry_of(&v, "gemfile");
-    assert_eq!(gemfile["status"], "error", "{v}");
-    let err = gemfile["error"].as_str().expect("gemfile error message");
-    assert!(
-        err.contains("1.17.3") && err.contains(">= 2.2"),
-        "the error must name the detected bundler and the floor: {err}"
-    );
-    assert!(
-        err.contains("cannot load the socket-patch Bundler plugin"),
-        "the error must explain WHY the floor exists: {err}"
-    );
-}
-
-#[test]
-fn gem_check_bundler_1x_lock_wired_points_at_remove() {
-    // Wire under a supported 2.x lock, then downgrade the lock to bundler
-    // 1.x: `--check` must red-flag the WIRED project and point at
-    // `setup --remove` as the way out.
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(&cwd.join("Gemfile"), GEMFILE_FIXTURE);
-    write(&cwd.join("Gemfile.lock"), LOCK_2X);
-    wire(cwd);
-    write(&cwd.join("Gemfile.lock"), LOCK_1X);
-
-    let (code, v) = run_json(cwd, &["setup", "--check", "--json"]);
-    assert_eq!(code, 1, "wired-below-floor must fail the check: {v}");
-    let gemfile = entry_of(&v, "gemfile");
-    assert_eq!(gemfile["status"], "error", "{v}");
-    let err = gemfile["error"].as_str().expect("gemfile error message");
-    assert!(
-        err.contains("setup --remove") && err.contains("unwire"),
-        "the wired-project error must name the unwire recovery: {err}"
-    );
-    assert!(
-        err.contains("1.17.3"),
-        "must name the detected version: {err}"
-    );
-    // The plugin dir was still generated by the wiring; its entry stays
-    // independent of the version gate.
-    assert_eq!(entry_of(&v, "gem_plugin")["status"], "configured");
-}
-
-#[cfg(unix)]
-#[test]
-fn gem_check_unreadable_gemfile_reports_error() {
-    // Covers 861: the Gemfile read error arm of append_gem_check_entries.
-    if running_as_root() {
-        eprintln!("SKIP: root bypasses file permission checks");
-        return;
-    }
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(&cwd.join("Gemfile"), GEMFILE_FIXTURE);
-    write(&cwd.join("Gemfile.lock"), LOCK_2X);
-    wire(cwd);
-    chmod(&cwd.join("Gemfile"), 0o000);
-
-    let (code, v) = run_json(cwd, &["setup", "--check", "--json"]);
-    chmod(&cwd.join("Gemfile"), 0o644);
-
-    assert_eq!(code, 1, "an unreadable Gemfile must fail the check: {v}");
-    let gemfile = entry_of(&v, "gemfile");
-    assert_eq!(gemfile["status"], "error", "{v}");
-    assert!(
-        gemfile["error"].as_str().is_some_and(|e| !e.is_empty()),
-        "the io error must be carried on the entry: {v}"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// Property 7 — the on-disk hook probe (`configured_ecosystems`) positive
-// inserts. Every e2e_vex fixture opts in via `setup.manual`; here the
-// manifest declares NO manual ecosystems, so a statement can only exist
-// because the probe found the hook wired on disk.
-// Covers 359-362 (npm), 374-377 (pypi), 385-387 (gem), 391-395 (composer).
-// ---------------------------------------------------------------------------
-
-/// One patch record per ecosystem, mirroring e2e_vex's `make_record`.
-fn covgap_patch_manifest() -> socket_patch_core::manifest::schema::PatchManifest {
-    use socket_patch_core::manifest::schema::{
-        PatchFileInfo, PatchManifest, PatchRecord, VulnerabilityInfo,
-    };
-    use std::collections::HashMap;
-
-    let cases: &[(&str, &str, &str)] = &[
-        (
-            "pkg:npm/left-pad@1.3.0",
-            "GHSA-cov-npm",
-            "11111111-1111-4111-8111-111111111111",
-        ),
-        (
-            "pkg:pypi/six@1.16.0",
-            "GHSA-cov-pypi",
-            "22222222-2222-4222-8222-222222222222",
-        ),
-        (
-            "pkg:gem/rack@2.2.3",
-            "GHSA-cov-gem",
-            "33333333-3333-4333-8333-333333333333",
-        ),
-        (
-            "pkg:composer/monolog/monolog@2.0.0",
-            "GHSA-cov-composer",
-            "44444444-4444-4444-8444-444444444444",
-        ),
-    ];
-    let mut manifest = PatchManifest::new();
-    for (purl, ghsa, uuid) in cases {
-        let mut files = HashMap::new();
-        files.insert(
-            "package/index.js".to_string(),
-            PatchFileInfo {
-                before_hash: "a".repeat(64),
-                after_hash: "b".repeat(64),
-            },
-        );
-        let mut vulns = HashMap::new();
-        vulns.insert(
-            (*ghsa).to_string(),
-            VulnerabilityInfo {
-                cves: vec!["CVE-2024-1".to_string()],
-                summary: "s".to_string(),
-                severity: "high".to_string(),
-                description: "d".to_string(),
-            },
-        );
-        manifest.patches.insert(
-            (*purl).to_string(),
-            PatchRecord {
-                uuid: (*uuid).to_string(),
-                exported_at: "2024-01-01T00:00:00Z".to_string(),
-                files,
-                vulnerabilities: vulns,
-                description: format!("Patch {uuid}"),
-                license: "MIT".to_string(),
-                tier: "free".to_string(),
-            },
-        );
-    }
-    manifest
-}
-
-/// Write the 4-ecosystem patch manifest with NO `setup` block — i.e. zero
-/// `manual` declarations, so only the on-disk probe can admit a patch.
-fn write_covgap_manifest(cwd: &Path) {
-    let manifest = covgap_patch_manifest();
-    write(
-        &cwd.join(".socket/manifest.json"),
-        &serde_json::to_string_pretty(&manifest).expect("serialize manifest"),
-    );
-}
-
-#[test]
-fn vex_attests_ecosystems_wired_on_disk_without_manual() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(&cwd.join("package.json"), UNWIRED_PACKAGE_JSON);
-    write(&cwd.join("requirements.txt"), REQUIREMENTS_NO_HOOK);
-    write(&cwd.join("Gemfile"), GEMFILE_FIXTURE);
-    write(&cwd.join("Gemfile.lock"), LOCK_2X);
-    write(&cwd.join("composer.json"), COMPOSER_JSON);
-    // Wire all four hooks on disk with a real setup run.
-    wire(cwd);
-    write_covgap_manifest(cwd);
-
-    let (code, stdout, stderr) = run(
-        cwd,
-        &["vex", "--no-verify", "--product", "pkg:npm/app@1.0.0"],
-    );
-    assert_eq!(
-        code, 0,
-        "all four wired ecosystems must attest; stdout=\n{stdout}\nstderr=\n{stderr}"
-    );
-    let doc: serde_json::Value = serde_json::from_str(&stdout).expect("VEX JSON on stdout");
-    let stmts = doc["statements"].as_array().expect("statements[]");
-    assert_eq!(
-        stmts.len(),
-        4,
-        "one statement per wired ecosystem (npm/pypi/gem/composer): {doc}"
-    );
-    for purl in [
-        "pkg:npm/left-pad@1.3.0",
-        "pkg:pypi/six@1.16.0",
-        "pkg:gem/rack@2.2.3",
-        "pkg:composer/monolog/monolog@2.0.0",
-    ] {
-        assert!(
-            stmts
-                .iter()
-                .any(|s| s["products"][0]["subcomponents"][0]["@id"] == purl),
-            "missing statement for {purl}: {doc}"
-        );
-    }
-}
-
-#[test]
-fn vex_drops_all_patches_when_projects_present_but_unwired() {
-    // Negative control for the probe: the SAME four project manifests exist
-    // but no hook is wired and no `manual` is declared, so every patch must
-    // be filtered — proving the positive test's statements came from the
-    // probe, not from project presence.
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(&cwd.join("package.json"), UNWIRED_PACKAGE_JSON);
-    write(&cwd.join("requirements.txt"), REQUIREMENTS_NO_HOOK);
-    write(&cwd.join("Gemfile"), GEMFILE_FIXTURE);
-    write(&cwd.join("composer.json"), COMPOSER_JSON);
-    write_covgap_manifest(cwd);
-
-    let out = cwd.join("out.json");
-    let (code, stdout, _stderr) = run(
-        cwd,
-        &[
-            "vex",
-            "--no-verify",
-            "--product",
-            "pkg:npm/app@1.0.0",
-            "--output",
-            out.to_str().unwrap(),
-        ],
-    );
-    let statements = std::fs::read_to_string(&out)
-        .ok()
-        .and_then(|s| serde_json::from_str::<serde_json::Value>(&s).ok())
-        .and_then(|v| v["statements"].as_array().map(|a| a.len()))
-        .unwrap_or(0);
-    assert_eq!(
-        statements, 0,
-        "unwired ecosystems must not attest (property 7); stdout=\n{stdout}"
-    );
-    assert_eq!(
-        code, 1,
-        "with every patch filtered, vex must report no-applicable-patches; stdout=\n{stdout}"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// ui::confirm_or_proceed's non-TTY branch: piped stdin, no --yes, no
-// --json — the normal CI shape. Auto-proceeds with a stderr note.
-// ---------------------------------------------------------------------------
-
-#[test]
-fn setup_non_tty_auto_proceeds_without_yes() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(&cwd.join("package.json"), UNWIRED_PACKAGE_JSON);
-
-    // `Command::output()` (inside the shared runner) closes the child's
-    // stdin, so stdin is not a terminal.
-    let (code, stdout, stderr) = run(cwd, &["setup"]);
-    assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
-    assert!(
-        stderr.contains("Non-interactive mode detected, proceeding automatically."),
-        "the auto-proceed note must reach stderr; stderr=\n{stderr}"
-    );
-    assert!(
-        stdout.contains("Summary:"),
-        "the run must have proceeded to the summary; stdout=\n{stdout}"
-    );
-    assert!(
-        read(&cwd.join("package.json")).contains("socket-patch"),
-        "the non-TTY run must actually wire the hook"
-    );
-}
-
-#[test]
-fn setup_non_tty_auto_proceed_note_is_muted_under_silent() {
-    // `--silent` is errors-only: the non-TTY auto-proceed note is
-    // informational, so it is muted like the rest of the human report —
-    // while the run still proceeds and wires the hook.
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(&cwd.join("package.json"), UNWIRED_PACKAGE_JSON);
-
-    let (code, stdout, stderr) = run(cwd, &["setup", "--silent"]);
-    assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
-    assert!(
-        stdout.trim().is_empty(),
-        "--silent must mute stdout; got: {stdout:?}"
-    );
-    assert!(
-        !stderr.contains("Non-interactive mode detected"),
-        "--silent must mute the auto-proceed note; stderr=\n{stderr}"
-    );
-    assert!(
-        read(&cwd.join("package.json")).contains("socket-patch"),
-        "the silent non-TTY run must still wire the hook"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// `setup --remove` interactive decline (1237-1238) — the remove twin of
-// interactive_prompts_e2e's setup abort, driven through a PTY.
-// ---------------------------------------------------------------------------
-
-#[cfg(unix)]
-mod pty {
-    use std::path::Path;
-    use std::time::Duration;
-
-    use portable_pty::{native_pty_system, CommandBuilder, PtySize};
-
-    /// Trimmed copy of interactive_prompts_e2e's PTY runner (that file is a
-    /// separate test binary, so its helper cannot be imported): spawn the
-    /// binary in a PTY with the SOCKET_* env scrubbed, send `input`, collect
-    /// output until exit. A watchdog kills the child after `timeout`.
-    pub fn run_in_pty(args: &[&str], cwd: &Path, input: &str, timeout: Duration) -> (i32, String) {
-        let pty_system = native_pty_system();
-        let pair = pty_system
-            .openpty(PtySize {
-                rows: 24,
-                cols: 80,
-                pixel_width: 0,
-                pixel_height: 0,
-            })
-            .expect("openpty");
-
-        let mut cmd = CommandBuilder::new(env!("CARGO_BIN_EXE_socket-patch"));
-        for a in args {
-            cmd.arg(a);
-        }
-        cmd.cwd(cwd);
-        for (key, _) in std::env::vars_os() {
-            let name = key.to_string_lossy();
-            if name.starts_with("SOCKET_")
-                && !name.contains("TELEMETRY")
-                && name != "SOCKET_NO_CONFIG"
-                && name != "SOCKET_NO_UPDATE_CHECK"
-            {
-                cmd.env_remove(&key);
-            }
-        }
-        // PTY children have a real terminal on stderr; force the notifier
-        // kill-switch like the sibling suite does.
-        cmd.env("SOCKET_NO_UPDATE_CHECK", "1");
-
-        let mut child = pair.slave.spawn_command(cmd).expect("spawn in PTY");
-        drop(pair.slave);
-
-        let reader_handle =
-            crate::pty_io::PtyOutput::spawn(pair.master.try_clone_reader().expect("clone reader"));
-
-        let mut killer = child.clone_killer();
-        std::thread::spawn(move || {
-            std::thread::sleep(timeout);
-            let _ = killer.kill();
-        });
-
-        let mut writer = pair.master.take_writer().expect("take writer");
-        crate::pty_io::send_when_prompted(&reader_handle, &mut writer, input.as_bytes());
-        drop(writer);
-
-        let status = child.wait().expect("child.wait");
-        drop(pair.master);
-        let output = reader_handle.finish();
-        (
-            status.exit_code() as i32,
-            String::from_utf8_lossy(&output).to_string(),
-        )
-    }
-}
-
-#[cfg(unix)]
-#[test]
-fn remove_interactive_decline_aborts_without_change() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(&cwd.join("package.json"), UNWIRED_PACKAGE_JSON);
-    wire(cwd);
-    let wired = read(&cwd.join("package.json"));
-
-    let (code, output) = pty::run_in_pty(
-        &["setup", "--remove"],
-        cwd,
-        "n\n",
-        std::time::Duration::from_secs(15),
-    );
-    assert_eq!(
-        code, 0,
-        "declining the remove must exit cleanly; got: {output}"
-    );
-    assert!(
-        output.contains("Remove these install hooks? [y/N]"),
-        "the interactive remove confirm must have been shown; got: {output}"
-    );
-    assert!(
-        !output.contains("Non-interactive mode detected"),
-        "a PTY child must take the interactive branch; got: {output}"
-    );
-    assert!(
-        output.contains("Hook removal cancelled."),
-        "declining must print the cancel message; got: {output}"
-    );
-    assert!(
-        !output.contains("Removing changes..."),
-        "declining must abort before mutating; got: {output}"
-    );
-    assert_eq!(
-        read(&cwd.join("package.json")),
-        wired,
-        "the wired package.json must be untouched after the decline"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// persist_setup_excludes' already-persisted no-rewrite branch (323): a
-// flag-less rerun whose effective excludes equal the persisted set must not
-// rewrite .socket/manifest.json (the byte-stability the doc comment
-// promises). Detected via a cosmetic (JSON-equivalent) formatting marker
-// that any rewrite would normalize away.
-// ---------------------------------------------------------------------------
-
-#[test]
-fn exclude_already_persisted_skips_manifest_rewrite() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(
-        &cwd.join("package.json"),
-        r#"{ "name": "root", "workspaces": ["packages/*"] }"#,
-    );
-    write(&cwd.join("packages/a/package.json"), UNWIRED_PACKAGE_JSON);
-    write(&cwd.join("packages/b/package.json"), UNWIRED_PACKAGE_JSON);
-
-    let (code, v) = run_json(
-        cwd,
-        &["setup", "--yes", "--json", "--exclude", "packages/a"],
-    );
-    assert_eq!(code, 0, "{v}");
-    assert_eq!(v["status"], "success", "{v}");
-    let manifest_path = cwd.join(".socket/manifest.json");
-    let persisted = read(&manifest_path);
-    assert!(
-        persisted.contains("packages/a"),
-        "the exclude must be persisted: {persisted}"
-    );
-
-    // Cosmetic marker: trailing whitespace is JSON-equivalent, so a re-read
-    // still parses the same set — but a rewrite (serde pretty-print) would
-    // drop it. If the no-rewrite branch regresses, the marker vanishes.
-    let marked = format!("{persisted}\n \n");
-    write(&manifest_path, &marked);
-
-    let (code, v) = run_json(cwd, &["setup", "--yes", "--json"]);
-    assert_eq!(code, 0, "{v}");
-    assert_eq!(
-        read(&manifest_path),
-        marked,
-        "a rerun whose excludes are already persisted exactly must not \
-         rewrite the manifest"
-    );
-    // The persisted exclusion still holds without the flag. Entry paths render
-    // via Path::display() (`\` on Windows) — normalize the separator so this
-    // guard cannot pass vacuously there.
-    let files = v["files"].as_array().expect("files[]");
-    let names_packages_a = |f: &serde_json::Value| {
-        f["path"]
-            .as_str()
-            .is_some_and(|p| p.replace('\\', "/").contains("packages/a"))
-    };
-    assert!(
-        !files.iter().any(names_packages_a),
-        "the persisted exclude must keep packages/a out of the run: {v}"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// `--exclude` persistence waits for the mutation gate: a directory with no
-// project writes nothing, an already-configured project still persists an
-// explicit exclusion, a dry run persists nothing, and a failed write is
-// reported — never silently lost.
-// ---------------------------------------------------------------------------
-
-/// `setup --exclude` in a directory with no project files reports `no_files`
-/// and must NOT leave a `.socket/manifest.json` behind (the exclude list is
-/// persisted only after discovery).
-#[test]
-fn setup_exclude_in_empty_dir_writes_no_socket_dir() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-
-    let (code, v) = run_json(
-        cwd,
-        &["setup", "--yes", "--json", "--exclude", "packages/x"],
-    );
-    assert_eq!(code, 0, "{v}");
-    assert_eq!(v["status"], "no_files", "{v}");
-    assert!(
-        !cwd.join(".socket").exists(),
-        "no project → nothing to set up → nothing to persist, no .socket/"
-    );
-}
-
-/// An explicit `--exclude` on an already-configured project (nothing to
-/// preview or confirm) is still the user's stated intent: it is persisted,
-/// under the manifest lock, which is released and removed again.
-#[test]
-fn setup_exclude_persists_when_hooks_are_already_configured() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    // A real `packages/b` member: an `--exclude` that matches nothing is
-    // dropped before persistence (a typo must not be persisted).
-    write(
-        &cwd.join("package.json"),
-        &format!(
-            "{{ \"name\": \"root\", \"version\": \"1.0.0\", \"workspaces\": [\"packages/*\"], \
-             {WIRED_SCRIPTS_FRAGMENT} }}"
-        ),
-    );
-    write(&cwd.join("packages/b/package.json"), UNWIRED_PACKAGE_JSON);
-
-    let (code, v) = run_json(
-        cwd,
-        &["setup", "--yes", "--json", "--exclude", "packages/b"],
-    );
-    assert_eq!(code, 0, "{v}");
-    assert_eq!(v["status"], "already_configured", "{v}");
-    let manifest = read(&cwd.join(".socket/manifest.json"));
-    let mv: serde_json::Value = serde_json::from_str(&manifest).expect("manifest JSON");
-    assert_eq!(
-        mv["setup"]["exclude"],
-        serde_json::json!(["packages/b"]),
-        "the explicit exclusion must be persisted: {manifest}"
-    );
-    assert!(
-        !cwd.join(".socket/apply.lock").exists(),
-        "the persistence lock is released and its file removed"
-    );
-}
-
-/// `--dry-run` with `--exclude` previews and persists NOTHING.
-#[test]
-fn setup_dry_run_exclude_persists_nothing() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(&cwd.join("package.json"), UNWIRED_PACKAGE_JSON);
-
-    let (code, v) = run_json(
-        cwd,
-        &["setup", "--dry-run", "--json", "--exclude", "packages/b"],
-    );
-    assert_eq!(code, 0, "{v}");
-    assert_eq!(v["status"], "dry_run", "{v}");
-    assert!(
-        !cwd.join(".socket").exists(),
-        "a dry run must not persist the exclude list"
-    );
-}
-
-/// A persistence step that cannot write reports the skip instead of
-/// claiming success: a read-only `.socket/` refuses the manifest lock and
-/// write alike, the bytes on disk stay untouched, and the `--json`
-/// envelope carries the fail-closed warning (same channel as the corrupt-
-/// manifest skip).
-#[cfg(unix)]
-#[test]
-fn setup_exclude_write_failure_surfaces_persist_warning() {
-    use std::os::unix::fs::PermissionsExt;
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    // A real `packages/b` member: an `--exclude` that matches nothing is
-    // dropped before persistence and never reaches the write.
-    write(
-        &cwd.join("package.json"),
-        r#"{ "name": "root", "workspaces": ["packages/*"] }"#,
-    );
-    write(&cwd.join("packages/b/package.json"), UNWIRED_PACKAGE_JSON);
-    let manifest_path = cwd.join(".socket/manifest.json");
-    let original = r#"{"patches":{}}"#;
-    write(&manifest_path, original);
-    let socket = cwd.join(".socket");
-    std::fs::set_permissions(&socket, std::fs::Permissions::from_mode(0o555)).unwrap();
-
-    let (code, v) = run_json(
-        cwd,
-        &["setup", "--yes", "--json", "--exclude", "packages/b"],
-    );
-    std::fs::set_permissions(&socket, std::fs::Permissions::from_mode(0o755)).unwrap();
-
-    assert_eq!(
-        code, 0,
-        "the hooks were written; only persistence was skipped: {v}"
-    );
-    assert_eq!(v["status"], "success", "{v}");
-    assert!(
-        v["warnings"].as_array().is_some_and(|w| w.iter().any(|x| x
-            .as_str()
-            .is_some_and(|x| x.contains("not persisting --exclude")))),
-        "the skipped persistence must appear in the --json warnings: {v}"
-    );
-    assert_eq!(
-        read(&manifest_path),
-        original,
-        "the manifest must be untouched when it cannot be rewritten"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// Python edge matrix.
-// ---------------------------------------------------------------------------
-
-/// Covers 463: pip project with neither requirements.txt nor pyproject —
-/// setup creates requirements.txt carrying the hook.
-#[test]
-fn setup_pip_from_scratch_creates_requirements() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(
-        &cwd.join("setup.py"),
-        "from setuptools import setup\nsetup()\n",
-    );
-
-    let (code, v) = run_json(cwd, &["setup", "--yes", "--json"]);
-    assert_eq!(code, 0, "{v}");
-    assert_eq!(v["status"], "success", "{v}");
-    assert_eq!(v["pythonPackageManager"], "pip", "{v}");
-    let pth = entry_of(&v, "pth");
-    assert_eq!(pth["status"], "updated", "{v}");
-    assert!(
-        pth["path"]
-            .as_str()
-            .is_some_and(|p| p.ends_with("requirements.txt")),
-        "{v}"
-    );
-    let created = read(&cwd.join("requirements.txt"));
-    assert!(
-        created.contains("socket-patch[hook]"),
-        "the created requirements.txt must carry the hook dep; got:\n{created}"
-    );
-    // The user's own file is untouched.
-    assert!(
-        read(&cwd.join("setup.py")).starts_with("from setuptools"),
-        "setup.py must not be modified"
-    );
-}
-
-/// Covers 452 + 479: a pyproject-based manager (uv, detected from a bare
-/// uv.lock) with no pyproject.toml has nothing to edit → the whole run is
-/// `no_files` (the partial-checkout shape).
-#[test]
-fn setup_uv_lock_without_pyproject_reports_no_files() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(&cwd.join("uv.lock"), "version = 1\n");
-
-    let (code, v) = run_json(cwd, &["setup", "--yes", "--json"]);
-    assert_eq!(code, 0, "{v}");
-    assert_eq!(v["status"], "no_files", "{v}");
-    assert_eq!(v["updated"], 0, "{v}");
-    assert_eq!(v["alreadyConfigured"], 0, "{v}");
-    assert_eq!(v["errors"], 0, "{v}");
-    assert!(v["files"].as_array().is_some_and(|a| a.is_empty()), "{v}");
-    // Nothing conjured on disk either.
-    assert!(!cwd.join("pyproject.toml").exists());
-    assert!(!cwd.join("requirements.txt").exists());
-}
-
-/// Covers 510: when the python manifest is already configured and only
-/// ANOTHER ecosystem changed, finalize_python must return before the lock
-/// refresh. The empty PATH makes the guard sharp: a regression that reaches
-/// the refresh spawns `poetry`, fails to find it, and surfaces a warning.
-#[test]
-fn setup_python_already_configured_skips_lock_refresh() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(&cwd.join("pyproject.toml"), POETRY_PYPROJECT);
-    wire(cwd); // wires the poetry hook (no poetry.lock yet → no refresh)
-
-    // Now a lockfile exists and an npm manifest still needs wiring.
-    write(&cwd.join("poetry.lock"), "# stub lock\n");
-    write(&cwd.join("package.json"), UNWIRED_PACKAGE_JSON);
-    let empty = tempfile::tempdir().expect("empty PATH dir");
-    let (code, stdout, stderr) = run_env(
-        cwd,
-        &["setup", "--yes", "--json"],
-        &[("PATH", empty.path().to_str().unwrap())],
-    );
-    assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(v["status"], "success", "{v}");
-    assert_eq!(entry_of(&v, "package_json")["status"], "updated", "{v}");
-    assert_eq!(entry_of(&v, "pth")["status"], "already_configured", "{v}");
-    assert!(
-        v.get("warnings").is_none(),
-        "an unchanged python manifest must skip the lock refresh entirely \
-         (no `poetry` spawn, no warning): {v}"
-    );
-}
-
-/// Covers 565: a Poetry project (detected via [tool.poetry]) with NO
-/// poetry.lock — setup edits the manifest and must not attempt (or warn
-/// about) a lock refresh. Empty PATH again makes a regression observable.
-#[test]
-fn setup_poetry_without_lock_skips_refresh() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(&cwd.join("pyproject.toml"), POETRY_PYPROJECT);
-
-    let empty = tempfile::tempdir().expect("empty PATH dir");
-    let (code, stdout, stderr) = run_env(
-        cwd,
-        &["setup", "--yes", "--json"],
-        &[("PATH", empty.path().to_str().unwrap())],
-    );
-    assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(v["status"], "success", "{v}");
-    assert_eq!(v["pythonPackageManager"], "poetry", "{v}");
-    assert_eq!(entry_of(&v, "pth")["status"], "updated", "{v}");
-    assert!(
-        v.get("warnings").is_none(),
-        "no poetry.lock on disk → no refresh attempt, no warning: {v}"
-    );
-    assert!(
-        read(&cwd.join("pyproject.toml")).contains("socket-patch"),
-        "the manifest edit itself must still happen"
-    );
-}
-
-/// Covers 1000 (manifest present without the hook → needs_configuration) and
-/// 1005-1006 (pip with no requirements.txt yet → NotFound → needs_configuration).
-#[test]
-fn check_python_states_without_hook_and_missing_requirements() {
-    // (i) requirements.txt present, hook absent.
-    let a = tempfile::tempdir().expect("tempdir");
-    write(&a.path().join("requirements.txt"), REQUIREMENTS_NO_HOOK);
-    let (code, v) = run_json(a.path(), &["setup", "--check", "--json"]);
-    assert_eq!(code, 1, "{v}");
-    assert_eq!(v["status"], "needs_configuration", "{v}");
-    assert_eq!(entry_of(&v, "pth")["status"], "needs_configuration", "{v}");
-
-    // (ii) python project (setup.py) whose requirements.txt does not exist
-    // yet: the NotFound arm for Requirements is "simply needs setup".
-    let b = tempfile::tempdir().expect("tempdir");
-    write(
-        &b.path().join("setup.py"),
-        "from setuptools import setup\nsetup()\n",
-    );
-    let (code, v) = run_json(b.path(), &["setup", "--check", "--json"]);
-    assert_eq!(code, 1, "{v}");
-    let pth = entry_of(&v, "pth");
-    assert_eq!(pth["status"], "needs_configuration", "{v}");
-    assert!(
-        pth["path"]
-            .as_str()
-            .is_some_and(|p| p.ends_with("requirements.txt")),
-        "the not-yet-created requirements.txt is the manifest to create: {v}"
-    );
-    assert!(
-        pth["error"].is_null(),
-        "NotFound-for-Requirements is not an error: {v}"
-    );
-}
-
-/// Covers 1009: an unreadable python manifest is a check ERROR (distinct from
-/// the NotFound arm above).
-#[cfg(unix)]
-#[test]
-fn check_unreadable_python_manifest_reports_error() {
-    if running_as_root() {
-        eprintln!("SKIP: root bypasses file permission checks");
-        return;
-    }
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(&cwd.join("requirements.txt"), REQUIREMENTS_NO_HOOK);
-    chmod(&cwd.join("requirements.txt"), 0o000);
-
-    let (code, v) = run_json(cwd, &["setup", "--check", "--json"]);
-    chmod(&cwd.join("requirements.txt"), 0o644);
-
-    assert_eq!(code, 1, "{v}");
-    assert_eq!(v["status"], "error", "{v}");
-    let pth = entry_of(&v, "pth");
-    assert_eq!(pth["status"], "error", "{v}");
-    assert!(
-        pth["error"].as_str().is_some_and(|e| !e.is_empty()),
-        "the io error must be carried on the entry: {v}"
-    );
-}
-
-/// Covers 1903: setup --json on an unreadable python manifest — the pth
-/// files[] entry carries status "error" inside the error envelope.
-#[cfg(unix)]
-#[test]
-fn setup_json_unreadable_python_manifest_error_envelope() {
-    if running_as_root() {
-        eprintln!("SKIP: root bypasses file permission checks");
-        return;
-    }
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(&cwd.join("requirements.txt"), REQUIREMENTS_NO_HOOK);
-    chmod(&cwd.join("requirements.txt"), 0o000);
-
-    let (code, v) = run_json(cwd, &["setup", "--yes", "--json"]);
-    chmod(&cwd.join("requirements.txt"), 0o644);
-
-    assert_eq!(code, 1, "an unprocessable manifest must exit 1: {v}");
-    assert_eq!(v["status"], "error", "{v}");
-    assert_eq!(v["errors"], 1, "{v}");
-    let pth = entry_of(&v, "pth");
-    assert_eq!(pth["status"], "error", "{v}");
-    assert!(pth["error"].is_string(), "{v}");
-}
-
-// ---------------------------------------------------------------------------
-// `--check` needs/error rendering (1067, 1081, 1083, 1091-1094, 988).
-// ---------------------------------------------------------------------------
-
-fn mixed_needs_error_fixture() -> tempfile::TempDir {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write(
-        &tmp.path().join("package.json"),
-        r#"{ "name": "root", "workspaces": ["packages/*"] }"#,
-    );
-    write(&tmp.path().join("packages/bad/package.json"), "{");
-    tmp
-}
-
-#[test]
-fn check_human_report_renders_needs_and_error_lines() {
-    let tmp = mixed_needs_error_fixture();
-    let (code, stdout, _stderr) = run(tmp.path(), &["setup", "--check"]);
-    assert_eq!(code, 1, "stdout=\n{stdout}");
-    assert!(
-        stdout.contains("✗ package.json (needs setup)"),
-        "the unconfigured root must render as ✗ needs-setup; stdout=\n{stdout}"
-    );
-    // The relative path renders via Path::display(), which uses `\` on
-    // Windows — normalize so the assertion is separator-agnostic.
-    let stdout_norm = stdout.replace('\\', "/");
-    assert!(
-        stdout_norm.contains("! packages/bad/package.json: Invalid package.json"),
-        "the unparseable member must render its error; stdout=\n{stdout}"
-    );
-    assert!(
-        stdout.contains(
-            "1 manifest needs configuration, 1 error. Run `socket-patch setup` to add the \
-             missing install hooks. Fix the errors above, then re-run `socket-patch setup \
-             --check`."
-        ),
-        "the summary must count needs and errors; stdout=\n{stdout}"
-    );
-}
-
-#[test]
-fn check_json_mixed_needs_and_error_status() {
-    let tmp = mixed_needs_error_fixture();
-    let (code, v) = run_json(tmp.path(), &["setup", "--check", "--json"]);
-    assert_eq!(code, 1, "{v}");
-    assert_eq!(v["status"], "error", "errors dominate the status: {v}");
-    assert_eq!(v["needsConfiguration"], 1, "{v}");
-    assert_eq!(v["errors"], 1, "{v}");
-    let statuses: Vec<&str> = entries_of(&v, "package_json")
-        .iter()
-        .filter_map(|f| f["status"].as_str())
-        .collect();
-    assert!(
-        statuses.contains(&"needs_configuration") && statuses.contains(&"error"),
-        "both per-file states must be rendered: {v}"
-    );
-}
-
-/// Covers 988: an unreadable package.json in `--check` carries the io error
-/// (PermissionDenied — distinct from the invalid-JSON arm above).
-#[cfg(unix)]
-#[test]
-fn check_json_unreadable_package_json_reports_io_error() {
-    if running_as_root() {
-        eprintln!("SKIP: root bypasses file permission checks");
-        return;
-    }
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write(
-        &tmp.path().join("package.json"),
-        r#"{ "name": "root", "workspaces": ["packages/*"] }"#,
-    );
-    let locked = tmp.path().join("packages/locked/package.json");
-    write(&locked, UNWIRED_PACKAGE_JSON);
-    chmod(&locked, 0o000);
-
-    let (code, v) = run_json(tmp.path(), &["setup", "--check", "--json"]);
-    chmod(&locked, 0o644);
-
-    assert_eq!(code, 1, "{v}");
-    assert_eq!(v["status"], "error", "{v}");
-    let entry = entries_of(&v, "package_json")
-        .into_iter()
-        .find(|f| f["path"].as_str().is_some_and(|p| p.contains("locked")))
-        .unwrap_or_else(|| panic!("no entry for the locked member: {v}"));
-    assert_eq!(entry["status"], "error", "{v}");
-    assert!(
-        entry["error"]
-            .as_str()
-            .is_some_and(|e| e.contains("denied")),
-        "the entry must carry the read error, not the JSON-parse one: {v}"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// `setup --remove` human/json outcome matrix.
-// ---------------------------------------------------------------------------
-
-/// Covers 1210-1211: the most common interactive remove outcome — nothing
-/// wired, human mode.
-#[test]
-fn remove_human_nothing_wired_message() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write(&tmp.path().join("package.json"), UNWIRED_PACKAGE_JSON);
-
-    let (code, stdout, _stderr) = run(tmp.path(), &["setup", "--remove", "--yes"]);
-    assert_eq!(code, 0, "stdout=\n{stdout}");
-    assert!(
-        stdout.contains("No socket-patch install hooks found to remove."),
-        "human mode must say nothing was wired; stdout=\n{stdout}"
-    );
-}
-
-/// Covers 1225-1227 (human dry-run remove summary) and 1124-1125 (BOTH
-/// render_removed arms: a restored pre-existing script renders quoted, a
-/// deleted key renders `(removed)`).
-#[test]
-fn remove_human_dry_run_summary_renders_both_removed_forms() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    // A pre-existing postinstall so removal RESTORES it (Some arm); the
-    // dependencies script is setup's own, so removal DELETES it (None arm).
-    write(
-        &cwd.join("package.json"),
-        r#"{ "name": "x", "scripts": { "postinstall": "echo hi" } }"#,
-    );
-    wire(cwd);
-    let wired = read(&cwd.join("package.json"));
-
-    let (code, stdout, _stderr) = run(cwd, &["setup", "--remove", "--dry-run"]);
-    assert_eq!(code, 0, "stdout=\n{stdout}");
-    assert!(
-        stdout.contains("Will remove socket-patch from:"),
-        "the remove preview header must print; stdout=\n{stdout}"
-    );
-    assert!(
-        stdout.contains("-> postinstall: \"echo hi\""),
-        "a restored user script must render quoted; stdout=\n{stdout}"
-    );
-    assert!(
-        stdout.contains("-> dependencies: (removed)"),
-        "a deleted lifecycle key must render as (removed); stdout=\n{stdout}"
-    );
-    assert!(
-        stdout.contains("1 item would have socket-patch removed"),
-        "the human dry-run summary must count the pending removals; stdout=\n{stdout}"
-    );
-    assert_eq!(
-        read(&cwd.join("package.json")),
-        wired,
-        "--dry-run must not modify the file"
-    );
-}
-
-/// Covers the human remove preview sections for python (1426-1430) and
-/// gem/composer (1432-1436), the pip uninstall hint (1302), and the Bundler
-/// reversal note (1305-1308) — a real (non-dry-run) human remove across
-/// npm + python + gem + composer.
-#[test]
-fn remove_human_real_run_prints_python_gem_composer_sections() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(&cwd.join("package.json"), UNWIRED_PACKAGE_JSON);
-    write(&cwd.join("requirements.txt"), REQUIREMENTS_NO_HOOK);
-    write(&cwd.join("Gemfile"), GEMFILE_FIXTURE);
-    write(&cwd.join("Gemfile.lock"), LOCK_2X);
-    write(&cwd.join("composer.json"), COMPOSER_JSON);
-    wire(cwd);
-
-    let (code, stdout, stderr) = run(cwd, &["setup", "--remove", "--yes"]);
-    assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
-    assert!(
-        stdout.contains("Will remove the socket-patch[hook] dependency from:"),
-        "the python remove preview section must print; stdout=\n{stdout}"
-    );
-    assert!(
-        stdout.contains("Gem: remove the socket-patch Bundler plugin wiring from:"),
-        "the gem remove preview lines must print; stdout=\n{stdout}"
-    );
-    assert!(
-        stdout.contains("Composer: remove the socket-patch re-apply hook from:"),
-        "the composer remove preview lines must print; stdout=\n{stdout}"
-    );
-    assert!(
-        stdout.contains("Also run `pip uninstall socket-patch-hook`"),
-        "the post-remove pip hint must print; stdout=\n{stdout}"
-    );
-    assert!(
-        stdout.contains("the Bundler plugin wiring was removed"),
-        "the Bundler reversal note must print; stdout=\n{stdout}"
-    );
-    // The removal really happened on every manifest.
-    assert_eq!(read(&cwd.join("Gemfile")), GEMFILE_FIXTURE);
-    assert_eq!(read(&cwd.join("composer.json")), COMPOSER_JSON);
-    assert!(!read(&cwd.join("package.json")).contains("socket-patch"));
-    assert!(!read(&cwd.join("requirements.txt")).contains("socket-patch"));
-}
-
-/// Covers 1197: remove --json when nothing is removable AND the preview
-/// errored → status "error", exit 1.
-#[cfg(unix)]
-#[test]
-fn remove_json_preview_stage_unreadable_reports_error_status() {
-    if running_as_root() {
-        eprintln!("SKIP: root bypasses file permission checks");
-        return;
-    }
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(&cwd.join("package.json"), UNWIRED_PACKAGE_JSON);
-    chmod(&cwd.join("package.json"), 0o000);
-
-    let (code, v) = run_json(cwd, &["setup", "--remove", "--yes", "--json"]);
-    chmod(&cwd.join("package.json"), 0o644);
-
-    assert_eq!(code, 1, "{v}");
-    assert_eq!(v["status"], "error", "{v}");
-    assert_eq!(v["removed"], 0, "{v}");
-    assert_eq!(v["errors"], 1, "{v}");
-    assert_eq!(entry_of(&v, "package_json")["status"], "error", "{v}");
-}
-
-/// Covers 1296 + 1318: human remove whose write stage fails (clean preview,
-/// unwritable directory) → "N error(s)" and exit 1.
-#[cfg(unix)]
-#[test]
-fn remove_human_write_stage_error_counts_and_exits_nonzero() {
-    if running_as_root() {
-        eprintln!("SKIP: root bypasses directory permission checks");
-        return;
-    }
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(&cwd.join("package.json"), UNWIRED_PACKAGE_JSON);
-    wire(cwd);
-    chmod(cwd, 0o555);
-
-    let (code, stdout, _stderr) = run(cwd, &["setup", "--remove", "--yes"]);
-    chmod(cwd, 0o755);
-
-    assert_eq!(code, 1, "a failed write must exit 1; stdout=\n{stdout}");
-    assert!(
-        stdout.contains("  1 error\n"),
-        "the human summary must count the write failure; stdout=\n{stdout}"
-    );
-    assert!(
-        read(&cwd.join("package.json")).contains("socket-patch"),
-        "the hook must still be wired after the failed write"
-    );
-}
-
-/// Covers 1274 + 1488: the --json twin — status partial_failure with the
-/// npm files[] entry carrying status "error".
-#[cfg(unix)]
-#[test]
-fn remove_json_write_stage_error_reports_partial_failure() {
-    if running_as_root() {
-        eprintln!("SKIP: root bypasses directory permission checks");
-        return;
-    }
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(&cwd.join("package.json"), UNWIRED_PACKAGE_JSON);
-    wire(cwd);
-    chmod(cwd, 0o555);
-
-    let (code, v) = run_json(cwd, &["setup", "--remove", "--yes", "--json"]);
-    chmod(cwd, 0o755);
-
-    assert_eq!(code, 1, "{v}");
-    assert_eq!(v["status"], "partial_failure", "{v}");
-    assert_eq!(v["removed"], 0, "{v}");
-    assert_eq!(v["errors"], 1, "{v}");
-    let entry = entry_of(&v, "package_json");
-    assert_eq!(entry["status"], "error", "{v}");
-    assert!(entry["error"].is_string(), "{v}");
-}
-
-/// Covers 1500: remove --json python status "not_configured" (the hook was
-/// never in the python manifest while npm had something to remove).
-#[test]
-fn remove_json_python_not_configured_status() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(&cwd.join("package.json"), UNWIRED_PACKAGE_JSON);
-    wire(cwd);
-    // The python manifest appears AFTER wiring, so it never got the hook.
-    write(&cwd.join("requirements.txt"), REQUIREMENTS_NO_HOOK);
-
-    let (code, v) = run_json(cwd, &["setup", "--remove", "--yes", "--json"]);
-    assert_eq!(code, 0, "{v}");
-    assert_eq!(v["status"], "success", "{v}");
-    assert_eq!(entry_of(&v, "package_json")["status"], "removed", "{v}");
-    assert_eq!(entry_of(&v, "pth")["status"], "not_configured", "{v}");
-    assert_eq!(
-        read(&cwd.join("requirements.txt")),
-        REQUIREMENTS_NO_HOOK,
-        "a not-configured python manifest must be untouched"
-    );
-}
-
-/// Covers 1501: remove --json python status "error" (unreadable manifest)
-/// riding a partial_failure envelope next to a successful npm removal.
-#[cfg(unix)]
-#[test]
-fn remove_json_python_error_status() {
-    if running_as_root() {
-        eprintln!("SKIP: root bypasses file permission checks");
-        return;
-    }
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(&cwd.join("package.json"), UNWIRED_PACKAGE_JSON);
-    wire(cwd);
-    write(&cwd.join("requirements.txt"), REQUIREMENTS_NO_HOOK);
-    chmod(&cwd.join("requirements.txt"), 0o000);
-
-    let (code, v) = run_json(cwd, &["setup", "--remove", "--yes", "--json"]);
-    chmod(&cwd.join("requirements.txt"), 0o644);
-
-    assert_eq!(code, 1, "{v}");
-    assert_eq!(v["status"], "partial_failure", "{v}");
-    assert_eq!(entry_of(&v, "package_json")["status"], "removed", "{v}");
-    let pth = entry_of(&v, "pth");
-    assert_eq!(pth["status"], "error", "{v}");
-    assert!(pth["error"].is_string(), "{v}");
-}
-
-// ---------------------------------------------------------------------------
-// setup human-mode output: idempotent message, previews, commit notes,
-// warnings, error counts.
-// ---------------------------------------------------------------------------
-
-/// Covers 1653-1654: the idempotent second human run.
-#[test]
-fn setup_human_second_run_reports_all_configured() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write(&tmp.path().join("package.json"), UNWIRED_PACKAGE_JSON);
-    wire(tmp.path());
-
-    let (code, stdout, _stderr) = run(tmp.path(), &["setup", "--yes"]);
-    assert_eq!(code, 0, "stdout=\n{stdout}");
-    assert!(
-        stdout.contains("All install hooks are already configured with socket-patch!"),
-        "the idempotent second run must say so; stdout=\n{stdout}"
-    );
-}
-
-/// Covers 1814-1817 (python preview section), 1820-1823 (gem preview lines),
-/// 1763-1767 (python commit note naming the detected manager), and
-/// 1770-1775 (Gemfile commit note) in one real human setup run.
-#[test]
-fn setup_human_preview_and_commit_notes_for_python_and_gem() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(&cwd.join("package.json"), UNWIRED_PACKAGE_JSON);
-    write(&cwd.join("requirements.txt"), REQUIREMENTS_NO_HOOK);
-    write(&cwd.join("Gemfile"), GEMFILE_FIXTURE);
-    write(&cwd.join("Gemfile.lock"), LOCK_2X);
-
-    let (code, stdout, stderr) = run(cwd, &["setup", "--yes"]);
-    assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
-    assert!(
-        stdout.contains("Python manifests to update (socket-patch[hook]):"),
-        "the python preview section must print; stdout=\n{stdout}"
-    );
-    assert!(
-        stdout.contains("Gem: add the socket-patch Bundler plugin wiring to:"),
-        "the gem preview lines must print; stdout=\n{stdout}"
-    );
-    assert!(
-        stdout.contains("Commit the pip dependency change"),
-        "the python commit note must name the detected manager; stdout=\n{stdout}"
-    );
-    assert!(
-        stdout.contains("Commit the Gemfile"),
-        "the Gemfile commit note must print; stdout=\n{stdout}"
-    );
-}
-
-/// Covers 1835-1838: the "Already configured (will skip)" preview count —
-/// needs a mixed tree with one wired and one unwired manifest.
-#[test]
-fn setup_human_preview_counts_already_configured() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(
-        &cwd.join("package.json"),
-        &format!("{{\"name\":\"root\",\"workspaces\":[\"packages/*\"],{WIRED_SCRIPTS_FRAGMENT}}}"),
-    );
-    write(&cwd.join("packages/a/package.json"), UNWIRED_PACKAGE_JSON);
-
-    let (code, stdout, _stderr) = run(cwd, &["setup", "--yes"]);
-    assert_eq!(code, 0, "stdout=\n{stdout}");
-    assert!(
-        stdout.contains("Already configured (will skip): 1"),
-        "the wired root must be counted as a skip; stdout=\n{stdout}"
-    );
-    assert!(
-        stdout.contains("1 item updated"),
-        "the unwired member must still be updated; stdout=\n{stdout}"
-    );
-    assert!(
-        read(&cwd.join("packages/a/package.json")).contains("socket-patch"),
-        "the unwired member must gain the hook"
-    );
-}
-
-/// Covers 1760-1761: the human summary warning line, driven hermetically by
-/// the fail-closed --exclude persistence over a corrupt manifest (the JSON
-/// twin lives in setup_contract_gaps.rs).
-#[test]
-fn setup_human_summary_surfaces_persist_warning() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    // A real `packages/b` member: an `--exclude` that matches nothing is
-    // dropped before persistence and never reaches the fail-closed read.
-    write(
-        &cwd.join("package.json"),
-        r#"{ "name": "root", "workspaces": ["packages/*"] }"#,
-    );
-    write(&cwd.join("packages/b/package.json"), UNWIRED_PACKAGE_JSON);
-    let corrupt = "not json {{{";
-    write(&cwd.join(".socket/manifest.json"), corrupt);
-
-    let (code, stdout, stderr) = run(cwd, &["setup", "--yes", "--exclude", "packages/b"]);
-    assert_eq!(
-        code, 0,
-        "the skip is a warning, not an error; stdout=\n{stdout}"
-    );
-    assert!(
-        stderr.contains("Warning: Not persisting --exclude"),
-        "stderr must surface the fail-closed persistence skip; stderr=\n{stderr}"
-    );
-    assert_eq!(
-        stderr.matches("Not persisting --exclude").count(),
-        1,
-        "reported once, not again in the summary; stderr=\n{stderr}"
-    );
-    assert!(
-        !stdout.to_lowercase().contains("not persisting"),
-        "warnings stay off stdout; stdout=\n{stdout}"
-    );
-    assert_eq!(
-        read(&cwd.join(".socket/manifest.json")),
-        corrupt,
-        "the corrupt manifest must survive byte-identical"
-    );
-}
-
-/// Covers 1757: the human summary "N error(s)" line on a partial failure.
-#[cfg(unix)]
-#[test]
-fn setup_human_summary_counts_errors() {
-    if running_as_root() {
-        eprintln!("SKIP: root bypasses file permission checks");
-        return;
-    }
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(
-        &cwd.join("package.json"),
-        r#"{ "name": "root", "workspaces": ["packages/*"] }"#,
-    );
-    let locked = cwd.join("packages/locked/package.json");
-    write(&locked, UNWIRED_PACKAGE_JSON);
-    chmod(&locked, 0o000);
-
-    let (code, stdout, _stderr) = run(cwd, &["setup", "--yes"]);
-    chmod(&locked, 0o644);
-
-    assert_eq!(code, 1, "a partial failure must exit 1; stdout=\n{stdout}");
-    assert!(
-        stdout.contains("1 item updated"),
-        "the readable root must still be updated; stdout=\n{stdout}"
-    );
-    assert!(
-        stdout.contains("  1 error\n"),
-        "the human summary must count the unreadable member; stdout=\n{stdout}"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// Remove-mode lockfile-refresh warnings (1299-1300 human, 1522 --json):
-// a Poetry project whose lock refresh cannot spawn `poetry` (empty PATH).
-// ---------------------------------------------------------------------------
-
-/// Wire the poetry hook (no lock → no refresh during wiring), then plant an
-/// empty poetry.lock so the REMOVE run attempts the refresh.
-fn poetry_remove_warning_fixture() -> tempfile::TempDir {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write(&tmp.path().join("pyproject.toml"), POETRY_PYPROJECT);
-    wire(tmp.path());
-    assert!(
-        read(&tmp.path().join("pyproject.toml")).contains("socket-patch"),
-        "fixture: the hook must be wired before the remove run"
-    );
-    write(&tmp.path().join("poetry.lock"), "# stub lock\n");
-    tmp
-}
-
-#[test]
-fn remove_human_surfaces_poetry_lock_refresh_warning() {
-    let tmp = poetry_remove_warning_fixture();
-    let empty = tempfile::tempdir().expect("empty PATH dir");
-
-    let (code, stdout, stderr) = run_env(
-        tmp.path(),
-        &["setup", "--remove", "--yes"],
-        &[("PATH", empty.path().to_str().unwrap())],
-    );
-    assert_eq!(
-        code, 0,
-        "a failed lock refresh is a warning, not an error; stdout=\n{stdout}\nstderr=\n{stderr}"
-    );
-    assert!(
-        stderr.contains("Warning: Could not run `poetry"),
-        "stderr must warn that the refresh could not run; stderr=\n{stderr}"
-    );
-    // The edit itself must still have happened: the hook extra is gone. (For
-    // the classic-Poetry inline-table form, current remove semantics strip
-    // `extras = ["hook"]` but keep a bare `socket-patch = { version = "*" }`
-    // dependency line — asserting on the extra, not the whole line, pins the
-    // part that defines "hook removed".)
-    let pyproject = read(&tmp.path().join("pyproject.toml"));
-    assert!(
-        !pyproject.contains("hook"),
-        "the hook extra must be stripped by the remove; got:\n{pyproject}"
-    );
-}
-
-#[test]
-fn remove_json_surfaces_poetry_lock_refresh_warning() {
-    let tmp = poetry_remove_warning_fixture();
-    let empty = tempfile::tempdir().expect("empty PATH dir");
-
-    let (code, stdout, stderr) = run_env(
-        tmp.path(),
-        &["setup", "--remove", "--yes", "--json"],
-        &[("PATH", empty.path().to_str().unwrap())],
-    );
-    assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(v["status"], "success", "{v}");
-    assert_eq!(entry_of(&v, "pth")["status"], "removed", "{v}");
-    let warnings = v["warnings"]
-        .as_array()
-        .unwrap_or_else(|| panic!("the envelope must carry a warnings array: {v}"));
-    assert!(
-        warnings.iter().any(|w| w
-            .as_str()
-            .is_some_and(|w| w.contains("could not run `poetry"))),
-        "the refresh failure must ride the --json warnings: {v}"
-    );
-}
-
-/// `--yes` shows no prompt, so no prompt separator either: the progress
-/// ("Applying changes..." / "Removing install hooks...") is a transient
-/// status line, and a piped `--yes` run leaves stderr empty.
-#[test]
-fn setup_and_remove_with_yes_print_no_double_blank_line() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(&cwd.join("package.json"), UNWIRED_PACKAGE_JSON);
-
-    let (code, stdout, stderr) = run(cwd, &["setup", "--yes"]);
-    assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
-    assert_eq!(stderr, "", "stderr=\n{stderr:?}");
-    assert!(!stdout.contains("\n\n\n"), "stdout=\n{stdout:?}");
-
-    let (code, stdout, stderr) = run(cwd, &["setup", "--remove", "--yes"]);
-    assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
-    assert_eq!(stderr, "", "stderr=\n{stderr:?}");
-    assert!(!stdout.contains("\n\n\n"), "stdout=\n{stdout:?}");
-}
-
-/// A mistyped `--exclude` is warned about and NOT persisted, so later runs
-/// and clones do not inherit the typo; a matching value in the same run is.
-#[test]
-fn setup_does_not_persist_an_unmatched_exclude() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(
-        &cwd.join("package.json"),
-        r#"{ "name": "root", "workspaces": ["packages/*"] }"#,
-    );
-    write(&cwd.join("packages/a/package.json"), UNWIRED_PACKAGE_JSON);
-
-    let (code, stdout, stderr) = run(
-        cwd,
-        &[
-            "setup",
-            "--yes",
-            "--exclude",
-            "nope",
-            "--exclude",
-            "packages/a",
-        ],
-    );
-    assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
-    assert_eq!(
-        stderr
-            .matches("Warning: --exclude \"nope\" matched no workspace member")
-            .count(),
-        1,
-        "stderr=\n{stderr}"
-    );
-    let manifest: serde_json::Value =
-        serde_json::from_str(&read(&cwd.join(".socket/manifest.json"))).expect("manifest json");
-    assert_eq!(
-        manifest["setup"]["exclude"],
-        serde_json::json!(["packages/a"]),
-        "only the matching exclude is persisted"
-    );
-    assert!(
-        !read(&cwd.join("packages/a/package.json")).contains("socket-patch"),
-        "the excluded member stays unwired"
-    );
-}
-
-// ───────────── --check: unreadable vendor ledger on a manifest-free project ─────────────
-
-/// Contract §5: `--check` (property 4) reads the vendor ledger even without a
-/// manifest, and a ledger it cannot read or parse is surfaced as the
-/// `Warning: Unreadable vendor state (…)` line plus a `vendor_ledger` error
-/// entry — verdict `error`, exit 1 — never as a `configured` verdict. The
-/// manifest-free vendored project (the only `scan`/`get --mode vendored`
-/// posture) is exactly where a swallowed corrupt ledger would read as
-/// hooks wired, no manifest, garbage `state.json` → `configured`, exit 0.
-#[test]
-fn check_reports_an_unreadable_vendor_ledger_instead_of_configured() {
-    let tmp = tempfile::tempdir().unwrap();
-    let cwd = tmp.path();
-    write(&cwd.join("package.json"), UNWIRED_PACKAGE_JSON);
-    let (code, _stdout, stderr) = run(cwd, &["setup", "--json", "--yes"]);
-    assert_eq!(code, 0, "precondition: the hook wires; stderr=\n{stderr}");
-    assert!(!cwd.join(".socket/manifest.json").exists());
-    let vendor = cwd.join(".socket/vendor");
-    std::fs::create_dir_all(&vendor).unwrap();
-    std::fs::write(vendor.join("state.json"), b"not json").unwrap();
-
-    let (code, doc) = run_json(cwd, &["setup", "--check", "--json"]);
-    assert_eq!(
-        code, 1,
-        "an unreadable ledger is never a configured verdict: {doc}"
-    );
-    assert_eq!(doc["status"], "error", "{doc}");
-    let entry = doc["files"]
-        .as_array()
-        .unwrap()
-        .iter()
-        .find(|f| f["kind"] == "vendor_ledger")
-        .cloned()
-        .unwrap_or_else(|| panic!("a vendor_ledger entry must be reported: {doc}"));
-    assert_eq!(entry["status"], "error", "{doc}");
-    assert!(
-        entry["path"]
-            .as_str()
-            .unwrap_or_default()
-            .ends_with(".socket/vendor/state.json"),
-        "{doc}"
-    );
-    assert!(
-        entry["error"]
-            .as_str()
-            .unwrap_or_default()
-            .contains("corrupt"),
-        "the entry carries load_state's detail: {doc}"
-    );
-    let (_code, _stdout, stderr) = run(cwd, &["setup", "--check", "--json"]);
-    assert!(
-        stderr.contains("Warning: Unreadable vendor state") && stderr.contains("corrupt"),
-        "the contract's warning line reaches stderr; stderr=\n{stderr}"
-    );
-
-    // Human arm: same verdict, the `!` error row names the ledger.
-    let (code, stdout, stderr) = run(cwd, &["setup", "--check"]);
-    assert_eq!(code, 1, "stdout=\n{stdout}\nstderr=\n{stderr}");
-    assert!(
-        stdout.contains(".socket/vendor/state.json") && stdout.contains("1 error."),
-        "stdout=\n{stdout}"
-    );
-    assert!(
-        stderr.contains("Warning: Unreadable vendor state"),
-        "stderr=\n{stderr}"
-    );
-
-    // --silent: errors only — the warning is muted, the error row is not.
-    let (code, stdout, stderr) = run(cwd, &["setup", "--check", "--silent"]);
-    assert_eq!(code, 1);
-    assert!(
-        stdout.is_empty(),
-        "--silent mutes the report; stdout=\n{stdout}"
-    );
-    assert!(
-        !stderr.contains("Warning:"),
-        "--silent mutes the advisory; stderr=\n{stderr}"
-    );
-    assert!(
-        stderr.contains("Error:") && stderr.contains(".socket/vendor/state.json"),
-        "the error row survives --silent; stderr=\n{stderr}"
-    );
-    assert_eq!(
-        std::fs::read(vendor.join("state.json")).unwrap(),
-        b"not json",
-        "--check never rewrites or quarantines the ledger"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// vlt: the human advisory line, its muting, scope gating, and the byte-exact
-// remove round trip of the npx hook.
-// ---------------------------------------------------------------------------
-
-/// A PATH directory whose only tool is a `vlt` reporting `version`.
-fn old_vlt_path(version: &str) -> tempfile::TempDir {
-    let dir = tempfile::tempdir().expect("PATH dir");
-    if cfg!(windows) {
-        write(
-            &dir.path().join("vlt.cmd"),
-            &format!("@echo off\r\necho {version}\r\n"),
-        );
-    } else {
-        let shim = dir.path().join("vlt");
-        write(&shim, &format!("#!/bin/sh\necho {version}\n"));
-        #[cfg(unix)]
-        chmod(&shim, 0o755);
-    }
-    dir
-}
-
-const VLT_PACKAGE_JSON: &str = "{\n  \"name\": \"covgap\",\n  \"version\": \"1.0.0\"\n}\n";
-
-fn vlt_fixture(cwd: &Path) {
-    write(&cwd.join("package.json"), VLT_PACKAGE_JSON);
-    write(&cwd.join("vlt.json"), "{}\n");
-}
-
-const VLT_ADVISORY_LINE: &str = "Warning (vlt_root_scripts_not_run): vlt before 1.0.0-rc.13 does \
-                                 not run the root postinstall hook; upgrade vlt or run \
-                                 `socket-patch apply` after `vlt ci` (`vlt --version` reports \
-                                 0.0.0-32)";
-
-#[test]
-fn setup_vlt_advisory_prints_on_stderr_in_human_mode() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    vlt_fixture(tmp.path());
-    let path = old_vlt_path("0.0.0-32");
-    let path_env = [("PATH", path.path().to_str().unwrap())];
-    for args in [
-        &["setup", "--dry-run"][..],
-        &["setup", "--yes"],
-        &["setup", "--yes"],
-    ] {
-        let (code, stdout, stderr) = run_env(tmp.path(), args, &path_env);
-        assert_eq!(code, 0, "{args:?}: stdout=\n{stdout}\nstderr=\n{stderr}");
-        assert_eq!(
-            stderr.matches(VLT_ADVISORY_LINE).count(),
-            1,
-            "{args:?}: stderr=\n{stderr}"
-        );
-        assert!(!stdout.contains("vlt_root_scripts_not_run"), "{stdout}");
-    }
-
-    let (code, stdout, stderr) = run_env(tmp.path(), &["setup", "--yes", "--silent"], &path_env);
-    assert_eq!(code, 0);
-    assert!(stdout.is_empty() && stderr.is_empty(), "{stdout}{stderr}");
-
-    let (code, stdout, stderr) = run_env(tmp.path(), &["setup", "--yes", "--json"], &path_env);
-    assert_eq!(code, 0);
-    assert!(
-        stderr.is_empty(),
-        "--json keeps it in the envelope: {stderr}"
-    );
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(v["status"], "already_configured", "{v}");
-    assert_eq!(v["packageManager"], "vlt", "{v}");
-    assert_eq!(
-        v["warnings"][0].as_str().unwrap(),
-        VLT_ADVISORY_LINE
-            .strip_prefix("Warning (vlt_root_scripts_not_run): ")
-            .map(|d| format!("vlt_root_scripts_not_run: {d}"))
-            .unwrap()
-    );
-}
-
-#[test]
-fn setup_vlt_advisory_needs_npm_in_scope() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    vlt_fixture(tmp.path());
-    write(&tmp.path().join("requirements.txt"), REQUIREMENTS_NO_HOOK);
-    let path = old_vlt_path("0.0.0-32");
-    let (code, stdout, stderr) = run_env(
-        tmp.path(),
-        &["setup", "--yes", "--json", "-e", "pypi"],
-        &[("PATH", path.path().to_str().unwrap())],
-    );
-    assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert!(entries_of(&v, "package_json").is_empty(), "{v}");
-    assert!(v.get("warnings").is_none(), "{v}");
-    assert_eq!(read(&tmp.path().join("package.json")), VLT_PACKAGE_JSON);
-}
-
-#[test]
-fn setup_vlt_check_and_remove_round_trip_byte_exact() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    vlt_fixture(cwd);
-    let path = old_vlt_path("1.2.0");
-    let path_env = [("PATH", path.path().to_str().unwrap())];
-
-    let (code, ..) = run_env(cwd, &["setup", "--check"], &path_env);
-    assert_eq!(code, 1);
-    let (code, stdout, stderr) = run_env(cwd, &["setup", "--yes", "--json"], &path_env);
-    assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(v["packageManager"], "vlt", "{v}");
-    assert!(v.get("warnings").is_none(), "vlt 1.2.0 runs the hook: {v}");
-    assert!(read(&cwd.join("package.json")).contains(
-        "\"postinstall\": \"npx @socketsecurity/socket-patch apply --silent --ecosystems npm\""
-    ));
-    let (code, ..) = run_env(cwd, &["setup", "--check"], &path_env);
-    assert_eq!(code, 0);
-    let (code, stdout, stderr) = run_env(cwd, &["setup", "--remove", "--yes"], &path_env);
-    assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
-    assert_eq!(read(&cwd.join("package.json")), VLT_PACKAGE_JSON);
-    assert_eq!(read(&cwd.join("vlt.json")), "{}\n");
-}
diff --git a/crates/socket-patch-cli/tests/covgap_commands_update.rs b/crates/socket-patch-cli/tests/covgap_commands_update.rs
index 82aa57f2..809bb3c7 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_update.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_update.rs
@@ -296,7 +296,7 @@ mod pty {
     }
 
     /// Declining the reinstall confirm must cancel with exit 1 and
-    /// "Reinstall cancelled.", leaving the installed binary byte-identical.
+    /// "Cancelled; no changes made.", leaving the installed binary byte-identical.
     /// The pin-to-current + `--force` combination reaches the confirm with
     /// ZERO network before the prompt (pinned skips latest-resolution,
     /// --force skips the already-there return), and the dead endpoint
@@ -334,7 +334,7 @@ mod pty {
             "update must NOT have taken the non-TTY auto-proceed branch in a PTY; got: {output}"
         );
         assert!(
-            output.contains("Reinstall cancelled."),
+            output.contains("Cancelled; no changes made."),
             "'n' must report cancellation, naming the reinstall; got: {output}"
         );
         assert_eq!(
diff --git a/crates/socket-patch-cli/tests/covgap_commands_vendor.rs b/crates/socket-patch-cli/tests/covgap_commands_vendor.rs
index ca875494..c1065716 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_vendor.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_vendor.rs
@@ -1431,7 +1431,7 @@ fn human_classic_migration_risk_prints_stderr_warning() {
         "the revert itself is the calm no-op: {stdout}"
     );
     assert!(
-        stderr.contains("Warning (yarn_classic_berry_migration_risk)"),
+        stderr.contains("Warning: yarn.lock is yarn-classic"),
         "the run-level advisory prints for humans: {stderr}"
     );
 }
diff --git a/crates/socket-patch-cli/tests/covgap_commands_vex.rs b/crates/socket-patch-cli/tests/covgap_commands_vex.rs
index 6de4d960..d7ffdf27 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_vex.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_vex.rs
@@ -17,7 +17,7 @@ use std::process::Command;
 use serde_json::Value;
 use socket_patch_core::hash::git_sha256::compute_git_sha256_from_bytes;
 use socket_patch_core::manifest::schema::{
-    PatchFileInfo, PatchManifest, PatchRecord, SetupConfig, VulnerabilityInfo,
+    PatchFileInfo, PatchManifest, PatchRecord, VulnerabilityInfo,
 };
 use socket_patch_core::vendor::state::{
     VendorArtifact, VendorEntry, VendorState, WiringAction, WiringRecord,
@@ -27,10 +27,6 @@ use socket_patch_core::vendor::state::{
 /// the uuid path level, so fixtures must use the real shape).
 const UUID: &str = "9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f";
 
-/// Every setup-supported ecosystem, declared `manual` so the property-7
-/// setup-state filter doesn't interfere with tests that aren't about it.
-const ALL_MANUAL: &[&str] = &["npm", "pypi", "cargo", "golang", "gem", "composer"];
-
 /// A prior successful run's minimal-but-recognizable OpenVEX document (the
 /// `@context` names openvex.dev, which is what `remove_stale_vex_doc` keys
 /// its deletion guard on). Mirrors the stale-doc fixture in
@@ -57,19 +53,13 @@ fn cli() -> Command {
     cmd
 }
 
-/// Write `manifest` to `<cwd>/.socket/manifest.json`, declaring every
-/// setup-supported ecosystem `manual` so property 7 keeps the patches.
+/// Write `manifest` to `<cwd>/.socket/manifest.json`.
 fn write_manifest(cwd: &Path, manifest: &PatchManifest) {
     let dir = cwd.join(".socket");
     std::fs::create_dir_all(&dir).unwrap();
-    let mut m = manifest.clone();
-    m.setup = Some(SetupConfig {
-        exclude: Vec::new(),
-        manual: ALL_MANUAL.iter().map(|s| s.to_string()).collect(),
-    });
     std::fs::write(
         dir.join("manifest.json"),
-        serde_json::to_string_pretty(&m).unwrap(),
+        serde_json::to_string_pretty(manifest).unwrap(),
     )
     .unwrap();
 }
diff --git a/crates/socket-patch-cli/tests/covgap_output.rs b/crates/socket-patch-cli/tests/covgap_output.rs
index eb964cc2..b629bb8e 100644
--- a/crates/socket-patch-cli/tests/covgap_output.rs
+++ b/crates/socket-patch-cli/tests/covgap_output.rs
@@ -4,8 +4,7 @@
 //!   caller passes `default_yes = true`, so this IS the "Enter proceeds
 //!   with the destructive action" contract — the sibling pty suite drives
 //!   `y`, `n`, and non-UTF-8 answers through `ui::confirm` but never a
-//!   bare Enter (its bare-Enter test hits `setup`'s default-no
-//!   `confirm_or_proceed`).
+//!   bare Enter.
 //! * `select_one()`'s `dialoguer::Select` branch, whose
 //!   sole production caller is `get`'s free-user multi-patch selection:
 //!   the Enter-accepts-first-ranked-option happy path and the
@@ -529,7 +528,7 @@ fn get_yes_answers_the_menu_with_its_default_without_showing_it() {
 fn get_interactive_dialoguer_quit_cancels_with_exit_zero() {
     // Cancelling the dialoguer menu → `interact_opt()` returns `Ok(None)` →
     // `select_one` maps it to `SelectError::Cancelled` (ui/prompt.rs) →
-    // get prints "Selection cancelled." and exits 0 without downloading
+    // get prints "Cancelled; no changes made." and exits 0 without downloading
     // anything (get.rs, the SelectError::Cancelled arm after select_one).
     //
     // The keystroke is `q`, not ESC: dialoguer 0.11's Select treats
@@ -578,7 +577,7 @@ fn get_interactive_dialoguer_quit_cancels_with_exit_zero() {
         "get must NOT have taken the non-TTY auto-select branch in a PTY; got: {output}"
     );
     assert!(
-        output.contains("Selection cancelled."),
+        output.contains("Cancelled; no changes made."),
         "Esc must surface the Cancelled message; got: {output}"
     );
     // dialoguer shows the cursor again itself on a clean q/Esc cancel, so
@@ -706,7 +705,7 @@ fn get_interactive_dialoguer_ctrl_c_with_sigint_ignored_cancels_cleanly() {
         "an ignored SIGINT must not kill the process; got: {output:?}"
     );
     assert!(
-        output.contains("Selection cancelled."),
+        output.contains("Cancelled; no changes made."),
         "Ctrl-C with SIGINT ignored must cancel the menu; got: {output}"
     );
     assert_eq!(code, 0, "{output}");
diff --git a/crates/socket-patch-cli/tests/covgap_setup_composer_mod.rs b/crates/socket-patch-cli/tests/covgap_setup_composer_mod.rs
deleted file mode 100644
index 5b056b87..00000000
--- a/crates/socket-patch-cli/tests/covgap_setup_composer_mod.rs
+++ /dev/null
@@ -1,146 +0,0 @@
-//! Coverage-gap tests for `setup/composer/mod.rs` driven through the built
-//! binary: the malformed-composer.json contract.
-//!
-//! `is_hook_present` deliberately reads unparseable JSON as "not configured"
-//! (mod.rs line 75) while `composer_add` / `composer_remove` error loudly on
-//! the same bytes — so on one and the same broken file `setup --check` reports
-//! needs-configuration (run setup to fix) and `setup` / `setup --remove`
-//! refuse with an error instead of a silent success. That asymmetry is only
-//! observable end-to-end at the binary level; the healthy setup/check/remove
-//! round trip already lives in
-//! `covgap_commands_setup.rs::composer_setup_check_remove_round_trip`.
-
-use std::path::Path;
-
-#[path = "common/mod.rs"]
-mod common;
-
-/// A composer.json that does not parse. The check probe must classify it, the
-/// editing paths must refuse it — and nobody may crash, wedge, or rewrite it.
-const MALFORMED_COMPOSER_JSON: &str = "{ oops, this is not JSON\n";
-
-fn write(path: &Path, content: &str) {
-    std::fs::write(path, content).expect("write file");
-}
-
-fn read(path: &Path) -> String {
-    std::fs::read_to_string(path).expect("read file")
-}
-
-/// Run the binary through the shared hermetic runner (`SOCKET_*` scrubbed,
-/// telemetry disabled), asserting stdout is one JSON document.
-fn run_json(cwd: &Path, args: &[&str]) -> (i32, serde_json::Value) {
-    let (code, stdout, stderr) =
-        common::run_with_env(cwd, args, &[("SOCKET_TELEMETRY_DISABLED", "1")]);
-    let v = serde_json::from_str(&stdout).unwrap_or_else(|e| {
-        panic!("stdout must be JSON ({e}); stdout=\n{stdout}\nstderr=\n{stderr}")
-    });
-    (code, v)
-}
-
-/// The single `files[]` entry with kind `composer` (panics on 0 or >1).
-fn composer_entry(v: &serde_json::Value) -> &serde_json::Value {
-    let matches: Vec<&serde_json::Value> = v["files"]
-        .as_array()
-        .unwrap_or_else(|| panic!("files must be an array: {v}"))
-        .iter()
-        .filter(|f| f["kind"] == "composer")
-        .collect();
-    assert_eq!(
-        matches.len(),
-        1,
-        "expected exactly one composer entry, got {}: {v}",
-        matches.len()
-    );
-    matches[0]
-}
-
-/// `setup --check` on a malformed composer.json: the probe (is_hook_present)
-/// classifies the unparseable file as needs-configuration — no crash, no
-/// error entry (the read succeeded; only the parse failed), exit 1 so CI
-/// still flags the project as unwired.
-#[test]
-fn check_malformed_composer_json_reports_needs_configuration() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(&cwd.join("composer.json"), MALFORMED_COMPOSER_JSON);
-
-    let (code, v) = run_json(cwd, &["setup", "--check", "--json"]);
-    assert_eq!(code, 1, "an unwired project must fail the check: {v}");
-    assert_eq!(v["status"], "needs_configuration", "{v}");
-    let entry = composer_entry(&v);
-    assert_eq!(
-        entry["status"], "needs_configuration",
-        "malformed JSON must read as not-configured, not crash the probe: {v}"
-    );
-    assert!(
-        entry["error"].is_null(),
-        "the check probe carries no error for a readable-but-unparseable file \
-         (the parse failure surfaces when `setup` runs): {v}"
-    );
-    assert_eq!(
-        read(&cwd.join("composer.json")),
-        MALFORMED_COMPOSER_JSON,
-        "--check must never write"
-    );
-}
-
-/// `setup` on the very same malformed file: the edit path refuses loudly —
-/// entry status `error` naming the parse failure, envelope status `error`,
-/// exit 1 — and leaves the user's broken file byte-identical (no clobber,
-/// no "helpful" rewrite).
-#[test]
-fn setup_malformed_composer_json_errors_loudly_and_leaves_file_untouched() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(&cwd.join("composer.json"), MALFORMED_COMPOSER_JSON);
-
-    let (code, v) = run_json(cwd, &["setup", "--yes", "--json"]);
-    assert_eq!(code, 1, "setup on a malformed composer.json must fail: {v}");
-    assert_eq!(v["status"], "error", "{v}");
-    assert_eq!(v["updated"], 0, "{v}");
-    assert_eq!(v["errors"], 1, "{v}");
-    let entry = composer_entry(&v);
-    assert_eq!(entry["status"], "error", "{v}");
-    assert!(
-        entry["error"]
-            .as_str()
-            .is_some_and(|e| e.contains("Invalid composer.json")),
-        "the entry must carry the parse error, naming the file kind: {v}"
-    );
-    assert_eq!(
-        read(&cwd.join("composer.json")),
-        MALFORMED_COMPOSER_JSON,
-        "a refused setup must leave the malformed file byte-identical"
-    );
-}
-
-/// `setup --remove` on a malformed composer.json is the same loud refusal —
-/// NOT a silent "nothing to remove" no-op (which would report success while
-/// `--check` on the same file says needs-configuration). Mirrors the inline
-/// `test_remove_non_object_root_is_error` contract at the binary level.
-#[test]
-fn remove_malformed_composer_json_errors_not_silent_noop() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let cwd = tmp.path();
-    write(&cwd.join("composer.json"), MALFORMED_COMPOSER_JSON);
-
-    let (code, v) = run_json(cwd, &["setup", "--remove", "--yes", "--json"]);
-    assert_eq!(code, 1, "remove on a malformed composer.json must fail: {v}");
-    assert_eq!(v["status"], "error", "{v}");
-    assert_eq!(v["removed"], 0, "{v}");
-    assert_eq!(v["errors"], 1, "{v}");
-    let entry = composer_entry(&v);
-    assert_eq!(entry["status"], "error", "{v}");
-    assert!(
-        entry["error"]
-            .as_str()
-            .is_some_and(|e| e.contains("Invalid composer.json")),
-        "the entry must carry the parse error: {v}"
-    );
-    assert_eq!(
-        read(&cwd.join("composer.json")),
-        MALFORMED_COMPOSER_JSON,
-        "a refused remove must leave the malformed file byte-identical"
-    );
-}
diff --git a/crates/socket-patch-cli/tests/covgap_setup_gem_mod.rs b/crates/socket-patch-cli/tests/covgap_setup_gem_mod.rs
deleted file mode 100644
index 44eefd78..00000000
--- a/crates/socket-patch-cli/tests/covgap_setup_gem_mod.rs
+++ /dev/null
@@ -1,164 +0,0 @@
-//! Coverage-gap integration test for `setup/gem/mod.rs`:
-//! the binary-level gem `setup` → `setup --remove` round trip that clears
-//! bundler's machine-local plugin registration under `BUNDLE_APP_CONFIG`.
-//!
-//! The env var is read once at the pub entry point
-//! (`gem/update.rs::remove_plugin_directive`) and threaded into the inner
-//! `_at` functions — the inline tests all inject it explicitly, so the real
-//! process-env resolution (a relative value resolving against the PROJECT
-//! root, exactly like `Bundler.app_config_path`) only runs through the built
-//! binary. The feature-gated `setup_matrix_gem.rs` is the only other place
-//! this is driven end-to-end, and it never compiles in the default test
-//! configuration.
-
-use std::path::Path;
-
-#[path = "common/mod.rs"]
-mod common;
-
-const GEMFILE_FIXTURE: &str = "source 'https://rubygems.org'\ngem 'colorize', '1.1.0'\n";
-
-/// A Gemfile.lock whose `BUNDLED WITH` pins a supported bundler: the version
-/// probe classifies from the lock BEFORE ever spawning `bundle`, so no host
-/// `bundle --version` (a 1.x machine bundler, or none at all) can steer this
-/// test.
-const LOCK_2X: &str = "GEM\n  remote: https://rubygems.org/\n  specs:\n    \
-                       colorize (1.1.0)\n\nPLATFORMS\n  ruby\n\nDEPENDENCIES\n  \
-                       colorize (= 1.1.0)\n\nBUNDLED WITH\n   2.7.2\n";
-
-fn write(path: &Path, content: &str) {
-    if let Some(parent) = path.parent() {
-        std::fs::create_dir_all(parent).expect("create parent");
-    }
-    std::fs::write(path, content).expect("write file");
-}
-
-/// The single `files[]` entry with the given `kind` (panics on 0 or >1).
-fn entry_of<'a>(v: &'a serde_json::Value, kind: &str) -> &'a serde_json::Value {
-    let matches: Vec<&serde_json::Value> = v["files"]
-        .as_array()
-        .unwrap_or_else(|| panic!("files must be an array: {v}"))
-        .iter()
-        .filter(|f| f["kind"] == kind)
-        .collect();
-    assert_eq!(
-        matches.len(),
-        1,
-        "expected exactly one `{kind}` entry, got {}: {v}",
-        matches.len()
-    );
-    matches[0]
-}
-
-/// setup → plant bundler's machine-local registration at the
-/// `BUNDLE_APP_CONFIG` location → `setup --remove` with that env var set.
-/// The remove must resolve the relative value against the project root
-/// (`<root>/bundle-config/plugin/index`), clear the registration there,
-/// report it as a `gem_plugin_registration` envelope entry, and leave a
-/// decoy index at the DEFAULT `.bundle` location untouched.
-#[test]
-fn setup_remove_clears_bundler_registration_under_bundle_app_config() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let root = tmp.path();
-    write(&root.join("Gemfile"), GEMFILE_FIXTURE);
-    write(&root.join("Gemfile.lock"), LOCK_2X);
-
-    // Step 1: wire. (No manifest on disk: the nested materialization apply
-    // treats a missing manifest as a clean exit-0 no-op, so stdout stays one
-    // JSON document.)
-    let (code, stdout, stderr) = common::run_with_env(
-        root,
-        &["setup", "--yes", "--json", "--ecosystems", "gem"],
-        &[],
-    );
-    assert_eq!(code, 0, "gem setup must succeed.\nstdout:\n{stdout}\nstderr:\n{stderr}");
-    let v = common::parse_json_envelope(&stdout);
-    assert_eq!(v["status"], "success", "{v}");
-    assert!(
-        std::fs::read_to_string(root.join("Gemfile"))
-            .unwrap()
-            .contains("plugin 'socket-patch'"),
-        "setup must wire the plugin directive"
-    );
-    assert!(
-        root.join(".socket/bundler-plugin/plugins.rb").is_file(),
-        "setup must generate the plugin files"
-    );
-
-    // Step 2: plant the registration bundler would write on first install —
-    // at the BUNDLE_APP_CONFIG location (relative → resolves against the
-    // project root), with the recorded plugin path pointing at the generated
-    // plugin dir, exactly like a real `path:`-sourced install.
-    let plugin_dir = root.join(".socket/bundler-plugin").display().to_string();
-    let index = root.join("bundle-config/plugin/index");
-    write(
-        &index,
-        &format!(
-            "---\ncommands:\nhooks:\n  after-install:\n  - \"socket-patch\"\n  \
-             after-install-all:\n  - \"socket-patch\"\nload_paths:\n  socket-patch:\n  \
-             - \"{plugin_dir}/.\"\nplugin_paths:\n  socket-patch: \"{plugin_dir}\"\nsources:\n"
-        ),
-    );
-    // A decoy at the DEFAULT app-config location: with BUNDLE_APP_CONFIG
-    // pointing elsewhere it is out of scope and must survive byte-identical.
-    let decoy = root.join(".bundle/plugin/index");
-    let decoy_body = "---\ncommands:\nhooks:\n  after-install:\n  - \"socket-patch\"\n\
-         load_paths:\n  socket-patch:\n  - \"/elsewhere/.\"\nplugin_paths:\n  \
-         socket-patch: \"/elsewhere\"\nsources:\n";
-    write(&decoy, decoy_body);
-
-    // Step 3: unwire with BUNDLE_APP_CONFIG set (child-only env injection).
-    let (code, stdout, stderr) = common::run_with_env(
-        root,
-        &["setup", "--remove", "--yes", "--json", "--ecosystems", "gem"],
-        &[("BUNDLE_APP_CONFIG", "bundle-config")],
-    );
-    assert_eq!(
-        code, 0,
-        "gem remove must succeed.\nstdout:\n{stdout}\nstderr:\n{stderr}"
-    );
-    let v = common::parse_json_envelope(&stdout);
-    assert_eq!(v["status"], "success", "{v}");
-    assert_eq!(entry_of(&v, "gemfile")["status"], "removed", "{v}");
-    assert_eq!(entry_of(&v, "gem_plugin")["status"], "removed", "{v}");
-    let reg = entry_of(&v, "gem_plugin_registration");
-    assert_eq!(
-        reg["status"], "removed",
-        "the registration cleanup must be reported: {v}"
-    );
-    assert!(
-        reg["path"]
-            .as_str()
-            .expect("registration entry carries the index path")
-            .ends_with(&format!(
-                "bundle-config{0}plugin{0}index",
-                std::path::MAIN_SEPARATOR
-            )),
-        "the cleaned index must be the BUNDLE_APP_CONFIG one: {v}"
-    );
-
-    // On disk: the env-resolved index is cleared and its emptied dirs pruned;
-    // the default-location decoy is out of scope and untouched.
-    assert!(!index.exists(), "the app-config index must be deleted");
-    assert!(
-        !root.join("bundle-config").exists(),
-        "the emptied app-config dir must be pruned"
-    );
-    assert_eq!(
-        std::fs::read_to_string(&decoy).unwrap(),
-        decoy_body,
-        "the default-location index is out of scope when BUNDLE_APP_CONFIG points elsewhere"
-    );
-
-    // And the rest of the unwire held: Gemfile restored byte-for-byte,
-    // generated plugin dir gone.
-    assert_eq!(
-        std::fs::read_to_string(root.join("Gemfile")).unwrap(),
-        GEMFILE_FIXTURE,
-        "remove must restore the Gemfile byte-for-byte"
-    );
-    assert!(
-        !root.join(".socket/bundler-plugin").exists(),
-        "remove must delete the generated plugin dir"
-    );
-}
diff --git a/crates/socket-patch-cli/tests/covgap_setup_gem_version.rs b/crates/socket-patch-cli/tests/covgap_setup_gem_version.rs
deleted file mode 100644
index d4000795..00000000
--- a/crates/socket-patch-cli/tests/covgap_setup_gem_version.rs
+++ /dev/null
@@ -1,198 +0,0 @@
-//! Coverage-gap integration tests for the gem bundler-version MACHINE probe
-//! (`setup/gem/version.rs`): the `bundle --version` PATH fallback that runs
-//! when no lockfile pins a `BUNDLED WITH` version. The fallback cannot be
-//! exercised deterministically in-process (PATH cannot be injected into
-//! `probe_bundler`, and the parallel test runner forbids `set_var`), so these
-//! tests drive the built binary with a PATH-shimmed fake `bundle` — the
-//! `write_pm_shim` pattern from setup_pth_invariants.rs — pinning all three
-//! spawn outcomes on any host:
-//!   * parseable 1.x version on stdout → setup REFUSES to wire (a `gemfile`
-//!     files[] error naming the version and the `bundle --version` source);
-//!   * exit 0 but unparseable stdout → the probe fails OPEN, setup wires;
-//!   * nonzero exit → the probe fails OPEN, setup wires.
-//!
-//! Sibling host-run gem tests live in setup_invariants.rs. Shims are sh scripts, so
-//! the whole file is unix-only — matching every other PATH-shim suite.
-#![cfg(unix)]
-
-#[path = "common/mod.rs"]
-mod common;
-
-use std::path::Path;
-
-const GEMFILE_FIXTURE: &str = "source 'https://rubygems.org'\ngem 'colorize', '1.1.0'\n";
-
-fn write(path: &Path, content: &str) {
-    if let Some(parent) = path.parent() {
-        std::fs::create_dir_all(parent).expect("create parent");
-    }
-    std::fs::write(path, content).expect("write file");
-}
-
-/// Lay a fake `bundle` executable into `bin_dir` that appends its argv to
-/// `log` (so the test can prove the machine probe actually spawned it),
-/// optionally prints `stdout_line`, and exits with `exit_code`. Never reads
-/// stdin, so it can't block the probe.
-fn write_bundle_shim(bin_dir: &Path, log: &Path, stdout_line: Option<&str>, exit_code: i32) {
-    use std::os::unix::fs::PermissionsExt;
-    std::fs::create_dir_all(bin_dir).expect("create shim dir");
-    let echo = match stdout_line {
-        Some(line) => format!("printf '%s\\n' '{line}'\n"),
-        None => String::new(),
-    };
-    let body = format!(
-        "#!/bin/sh\nprintf '%s\\n' \"$*\" >> '{}'\n{echo}exit {exit_code}\n",
-        log.display()
-    );
-    let p = bin_dir.join("bundle");
-    std::fs::write(&p, body).expect("write bundle shim");
-    std::fs::set_permissions(&p, std::fs::Permissions::from_mode(0o755)).expect("chmod shim");
-}
-
-/// `setup --json --yes` with the shim dir prepended to PATH so the probe's
-/// `bundle --version` spawn resolves to the fake. The ambient `SOCKET_*`
-/// surface is scrubbed by `common::run_with_env` (load-bearing: an ambient
-/// SOCKET_DRY_RUN/SOCKET_ECOSYSTEMS would silently flip what these exercise).
-fn run_setup_with_bundle_shim(cwd: &Path, bin_dir: &Path) -> (i32, serde_json::Value) {
-    let path_env = format!(
-        "{}:{}",
-        bin_dir.display(),
-        std::env::var("PATH").unwrap_or_default()
-    );
-    let (code, stdout, _stderr) = common::run_with_env(
-        cwd,
-        &["setup", "--json", "--yes"],
-        &[("SOCKET_TELEMETRY_DISABLED", "1"), ("PATH", &path_env)],
-    );
-    let v = serde_json::from_str(&stdout)
-        .unwrap_or_else(|e| panic!("stdout must be JSON ({e}):\n{stdout}"));
-    (code, v)
-}
-
-/// Assert the shim's argv log shows the probe ran `bundle --version` exactly
-/// ONCE — proof the verdict under test came from the machine probe, not from
-/// some other source (or from the real host bundler further down PATH), and
-/// that setup probes once per run: the dry-run preview and the real edit
-/// share the one probe instead of each spawning their own.
-fn assert_probe_spawned_bundle_version(log: &Path) {
-    let argvs = std::fs::read_to_string(log)
-        .expect("the bundle shim must have been invoked (argv log missing)");
-    assert_eq!(
-        argvs.lines().filter(|l| *l == "--version").count(),
-        1,
-        "the machine probe must spawn `bundle --version` exactly once per run; argv log:\n{argvs}"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// Parseable 1.x version → refusal (the classify path off a real spawn).
-// ---------------------------------------------------------------------------
-
-#[test]
-fn machine_probe_bundler_1x_refuses_to_wire() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    // Gemfile only — NO Gemfile.lock, so the lock branch cannot answer and
-    // the machine probe is the sole version source.
-    write(&tmp.path().join("Gemfile"), GEMFILE_FIXTURE);
-    let log = tmp.path().join("bundle-argv.log");
-    write_bundle_shim(
-        &tmp.path().join("bin"),
-        &log,
-        Some("Bundler version 1.17.3"),
-        0,
-    );
-
-    let (code, v) = run_setup_with_bundle_shim(tmp.path(), &tmp.path().join("bin"));
-    assert_eq!(code, 1, "a detected 1.x bundler must fail setup: {v}");
-    assert_eq!(v["status"], "error", "envelope: {v}");
-
-    let files = v["files"].as_array().expect("files[]");
-    let gemfile = files
-        .iter()
-        .find(|f| f["kind"] == "gemfile")
-        .unwrap_or_else(|| panic!("gemfile entry missing from envelope: {v}"));
-    assert_eq!(gemfile["status"], "error", "envelope: {v}");
-    let msg = gemfile["error"]
-        .as_str()
-        .unwrap_or_else(|| panic!("gemfile error message missing: {v}"));
-    assert!(
-        msg.contains("1.17.3"),
-        "refusal must name the detected version: {msg}"
-    );
-    assert!(
-        msg.contains("`bundle --version`"),
-        "refusal must name the probe source: {msg}"
-    );
-
-    assert_probe_spawned_bundle_version(&log);
-
-    // Refusal means NOTHING was wired: Gemfile byte-identical, no plugin dir.
-    assert_eq!(
-        std::fs::read_to_string(tmp.path().join("Gemfile")).unwrap(),
-        GEMFILE_FIXTURE,
-        "a refused setup must not modify the Gemfile"
-    );
-    assert!(
-        !tmp.path().join(".socket/bundler-plugin").exists(),
-        "a refused setup must not generate the plugin dir"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// Fail-open regions: `bundle --version` succeeded with unparseable stdout,
-// or exited nonzero → Unknown → setup wires as if no probe ran.
-// ---------------------------------------------------------------------------
-
-/// Shared assertions for the two fail-open cases: exit 0, `success` status,
-/// both gem artifacts reported updated, and the wiring actually on disk.
-fn assert_failed_open_and_wired(tmp: &Path, code: i32, v: &serde_json::Value) {
-    assert_eq!(code, 0, "the probe must fail OPEN (wire as before): {v}");
-    assert_eq!(v["status"], "success", "envelope: {v}");
-
-    let files = v["files"].as_array().expect("files[]");
-    for kind in ["gemfile", "gem_plugin"] {
-        let entry = files
-            .iter()
-            .find(|f| f["kind"] == kind)
-            .unwrap_or_else(|| panic!("{kind} entry missing from envelope: {v}"));
-        assert_eq!(entry["status"], "updated", "{kind} entry: {v}");
-    }
-
-    let gemfile = std::fs::read_to_string(tmp.join("Gemfile")).unwrap();
-    assert!(
-        gemfile.contains("plugin 'socket-patch'"),
-        "fail-open setup must wire the Gemfile:\n{gemfile}"
-    );
-    assert!(
-        tmp.join(".socket/bundler-plugin").exists(),
-        "fail-open setup must generate the plugin dir"
-    );
-}
-
-#[test]
-fn machine_probe_unparseable_output_fails_open_and_wires() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write(&tmp.path().join("Gemfile"), GEMFILE_FIXTURE);
-    let log = tmp.path().join("bundle-argv.log");
-    // Exit 0 but no `digits.digits` token anywhere on stdout — the
-    // parse-of-real-spawn else-region.
-    write_bundle_shim(&tmp.path().join("bin"), &log, Some("no version here"), 0);
-
-    let (code, v) = run_setup_with_bundle_shim(tmp.path(), &tmp.path().join("bin"));
-    assert_probe_spawned_bundle_version(&log);
-    assert_failed_open_and_wired(tmp.path(), code, &v);
-}
-
-#[test]
-fn machine_probe_nonzero_exit_fails_open_and_wires() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write(&tmp.path().join("Gemfile"), GEMFILE_FIXTURE);
-    let log = tmp.path().join("bundle-argv.log");
-    // `bundle --version` exits 1 (broken RubyGems install, missing gemset):
-    // the status-success gate's else-region. No stdout at all.
-    write_bundle_shim(&tmp.path().join("bin"), &log, None, 1);
-
-    let (code, v) = run_setup_with_bundle_shim(tmp.path(), &tmp.path().join("bin"));
-    assert_probe_spawned_bundle_version(&log);
-    assert_failed_open_and_wired(tmp.path(), code, &v);
-}
diff --git a/crates/socket-patch-cli/tests/covgap_setup_pypi_detect.rs b/crates/socket-patch-cli/tests/covgap_setup_pypi_detect.rs
deleted file mode 100644
index 814a55ef..00000000
--- a/crates/socket-patch-cli/tests/covgap_setup_pypi_detect.rs
+++ /dev/null
@@ -1,230 +0,0 @@
-//! Coverage-gap integration tests for `setup`'s Hatch detection branch,
-//! driven end-to-end through the built binary.
-//!
-//! Hatch is the one pyproject-table manager with NO lockfile and NO lock
-//! refresh (`lock_commands()` is `None` — hatch resolves from the manifest at
-//! install time), so it was the only `PythonPackageManager` variant never
-//! produced by any host-run test: `detect_python_pm`'s `[tool.hatch]` branch
-//! and `as_str()`'s `"hatch"` arm were dead in coverage. These tests pin the
-//! full contract: detection from a realistic `[tool.hatch.envs.*]` SUB-table
-//! (namespace-prefix resolution), the PEP 621 dependency edit, the envelope's
-//! `pythonPackageManager` field, and — the Hatch-specific half — that no
-//! package manager is ever spawned for a lock refresh, proven with PATH shims
-//! for every manager that could have been.
-//!
-//! Shims are `sh` scripts, hence the file-wide unix gate.
-
-#![cfg(unix)]
-
-use std::collections::BTreeSet;
-use std::path::Path;
-
-#[path = "common/mod.rs"]
-mod common;
-
-/// A hatch project: PEP 621 `[project]` surface plus hatch config in a
-/// sub-table only (no bare `[tool.hatch]` header — real hatch projects keep
-/// config in `[tool.hatch.envs.*]` / `[tool.hatch.build.*]`), and no lockfile
-/// of any kind, so the `[tool.hatch]` namespace branch is the only signal.
-const HATCH_PYPROJECT: &str = "[project]\nname = \"x\"\nversion = \"0.1.0\"\ndependencies = [\n    \"requests\",\n]\n\n[tool.hatch.envs.default]\ntype = \"virtual\"\n";
-
-fn write(path: &Path, content: &str) {
-    if let Some(parent) = path.parent() {
-        std::fs::create_dir_all(parent).expect("create parent");
-    }
-    std::fs::write(path, content).expect("write file");
-}
-
-fn read(path: &Path) -> String {
-    std::fs::read_to_string(path).expect("read file")
-}
-
-/// Lay a fake `name` executable into `bin_dir` that appends its argv to `log`
-/// and exits 0. Same shape as `setup_pth_invariants::write_pm_shim` (that
-/// helper lives in a sibling test crate and cannot be imported).
-fn write_pm_shim(bin_dir: &Path, name: &str, log: &Path) {
-    use std::os::unix::fs::PermissionsExt;
-    std::fs::create_dir_all(bin_dir).expect("create shim dir");
-    let body = format!("#!/bin/sh\nprintf '%s\\n' \"$*\" >> '{}'\nexit 0\n", log.display());
-    let p = bin_dir.join(name);
-    std::fs::write(&p, body).expect("write shim");
-    std::fs::set_permissions(&p, std::fs::Permissions::from_mode(0o755)).expect("chmod shim");
-}
-
-/// Shim EVERY Python package manager `setup` can spawn for a lock refresh
-/// (uv / poetry / pdm — Hatch and pip have no lock command), each logging to
-/// `<project>/<name>-argv.log`. If detection mis-routes a hatch project to
-/// any lockfile-refreshing manager AND a refresh runs, the log appears.
-fn shim_all_pms(project: &Path) -> std::path::PathBuf {
-    let bin = project.join("bin");
-    for name in ["uv", "poetry", "pdm"] {
-        write_pm_shim(&bin, name, &project.join(format!("{name}-argv.log")));
-    }
-    bin
-}
-
-/// Assert none of the shims installed by [`shim_all_pms`] ever ran.
-fn assert_no_pm_spawned(project: &Path, context: &str) {
-    for name in ["uv", "poetry", "pdm"] {
-        let log = project.join(format!("{name}-argv.log"));
-        assert!(
-            !log.exists(),
-            "{context}: hatch has no lock refresh, so `{name}` must never be \
-             spawned; it ran with argv:\n{}",
-            read(&log)
-        );
-    }
-}
-
-/// Run `setup --json --yes [extra]` in `cwd` with `bin_dir` prepended to PATH
-/// through the shared hermetic runner (the seed-then-scrub of the ambient
-/// `SOCKET_*` surface is load-bearing: SOCKET_DRY_RUN=true would fake every
-/// edit, SOCKET_ECOSYSTEMS=npm would hide the Python branch entirely).
-fn run_setup_with_shims(
-    cwd: &Path,
-    bin_dir: &Path,
-    extra: &[&str],
-) -> (i32, serde_json::Value) {
-    let path_env = format!(
-        "{}:{}",
-        bin_dir.display(),
-        std::env::var("PATH").unwrap_or_default()
-    );
-    let mut args = vec!["setup", "--json", "--yes"];
-    args.extend_from_slice(extra);
-    let (code, stdout, _stderr) = common::run_with_env(
-        cwd,
-        &args,
-        &[("SOCKET_TELEMETRY_DISABLED", "1"), ("PATH", &path_env)],
-    );
-    let v = serde_json::from_str(&stdout)
-        .unwrap_or_else(|e| panic!("stdout must be JSON ({e}):\n{stdout}"));
-    (code, v)
-}
-
-/// The single `files[]` entry with `kind == kind` (panics unless exactly one).
-fn file_entry<'a>(v: &'a serde_json::Value, kind: &str) -> &'a serde_json::Value {
-    let arr = v["files"]
-        .as_array()
-        .unwrap_or_else(|| panic!("files must be an array: {v}"));
-    let matches: Vec<&serde_json::Value> = arr.iter().filter(|f| f["kind"] == kind).collect();
-    assert_eq!(
-        matches.len(),
-        1,
-        "expected exactly one `{kind}` file entry, got {}: {v}",
-        matches.len()
-    );
-    matches[0]
-}
-
-#[test]
-fn hatch_project_detected_edited_and_never_spawns_a_lock_refresh() {
-    let tmp = tempfile::tempdir().unwrap();
-    write(&tmp.path().join("pyproject.toml"), HATCH_PYPROJECT);
-    let bin = shim_all_pms(tmp.path());
-
-    let (code, v) = run_setup_with_shims(tmp.path(), &bin, &[]);
-    assert_eq!(code, 0, "setup must succeed: {v}");
-    assert_eq!(v["status"], "success", "payload={v}");
-    assert_eq!(v["updated"], 1);
-    assert_eq!(v["errors"], 0);
-    // The load-bearing detection assertion: the envelope surfaces the manager
-    // detect_python_pm resolved — the `[tool.hatch.envs.default]` sub-table
-    // must route to Hatch (as_str's "hatch" arm), not fall through to pip or
-    // mis-match a sibling table.
-    assert_eq!(
-        v["pythonPackageManager"], "hatch",
-        "a [tool.hatch.envs.*]-only project must be detected as hatch: {v}"
-    );
-
-    let entry = file_entry(&v, "pth");
-    assert_eq!(entry["status"], "updated");
-    assert!(
-        entry["path"].as_str().unwrap().ends_with("pyproject.toml"),
-        "hatch edits pyproject.toml: {entry}"
-    );
-
-    // The hook dep landed in the PEP 621 dependencies array; the existing dep
-    // (with its 4-space indentation) and the hatch table survive verbatim.
-    let py = read(&tmp.path().join("pyproject.toml"));
-    assert_eq!(
-        py.matches("socket-patch[hook]").count(),
-        1,
-        "hook dep must appear exactly once:\n{py}"
-    );
-    assert!(
-        py.contains("    \"requests\""),
-        "existing dep + indentation preserved:\n{py}"
-    );
-    assert!(
-        py.contains("[tool.hatch.envs.default]\ntype = \"virtual\"\n"),
-        "the hatch config table must survive the edit verbatim:\n{py}"
-    );
-
-    // Hatch resolves deps from the manifest at install time: lock_commands()
-    // is None, so NO package manager may be spawned after the edit.
-    assert_no_pm_spawned(tmp.path(), "after add");
-
-    // Idempotent re-run still detects hatch and does not re-edit.
-    let (code2, v2) = run_setup_with_shims(tmp.path(), &bin, &[]);
-    assert_eq!(code2, 0);
-    assert_eq!(
-        v2["status"], "already_configured",
-        "re-run must see the dep it just wrote: {v2}"
-    );
-    assert_eq!(v2["pythonPackageManager"], "hatch", "payload={v2}");
-    assert_eq!(
-        read(&tmp.path().join("pyproject.toml")),
-        py,
-        "already-configured re-run must not rewrite the manifest"
-    );
-    assert_no_pm_spawned(tmp.path(), "after already-configured re-run");
-}
-
-#[test]
-fn hatch_remove_restores_manifest_and_never_spawns_a_lock_refresh() {
-    let tmp = tempfile::tempdir().unwrap();
-    write(&tmp.path().join("pyproject.toml"), HATCH_PYPROJECT);
-    let bin = shim_all_pms(tmp.path());
-
-    // Configure first.
-    let (code, v) = run_setup_with_shims(tmp.path(), &bin, &[]);
-    assert_eq!(code, 0, "precondition setup must succeed: {v}");
-    assert_eq!(v["status"], "success", "payload={v}");
-    assert!(
-        read(&tmp.path().join("pyproject.toml")).contains("socket-patch[hook]"),
-        "precondition: setup added the hook dep"
-    );
-
-    let (code, v) = run_setup_with_shims(tmp.path(), &bin, &["--remove"]);
-    assert_eq!(code, 0, "payload={v}");
-    assert_eq!(v["status"], "success", "remove must report success: {v}");
-    assert_eq!(v["removed"], 1, "exactly one manifest reverted: {v}");
-    assert_eq!(v["errors"], 0);
-    let entry = file_entry(&v, "pth");
-    assert_eq!(entry["status"], "removed");
-
-    // Byte-preservation-sensitive subsystem: add → remove must restore the
-    // committed manifest byte-for-byte, hatch table included.
-    let py = read(&tmp.path().join("pyproject.toml"));
-    assert_eq!(
-        py, HATCH_PYPROJECT,
-        "remove must restore the pre-setup pyproject.toml byte-for-byte"
-    );
-
-    // Neither the remove edit nor the preceding add may spawn a lock refresh
-    // on a hatch project.
-    assert_no_pm_spawned(tmp.path(), "after add + remove");
-
-    // Only the fixture files remain in the project root — no lockfile, no
-    // marker file conjured beside the manifest.
-    let entries: BTreeSet<String> = std::fs::read_dir(tmp.path())
-        .expect("read_dir")
-        .map(|e| e.unwrap().file_name().to_string_lossy().to_string())
-        .collect();
-    assert_eq!(
-        entries,
-        BTreeSet::from(["pyproject.toml".to_string(), "bin".to_string()]),
-        "setup/remove on a hatch project must touch only pyproject.toml"
-    );
-}
diff --git a/crates/socket-patch-cli/tests/docker_e2e_cargo.rs b/crates/socket-patch-cli/tests/docker_e2e_cargo.rs
index ac6678b7..c5259a3c 100644
--- a/crates/socket-patch-cli/tests/docker_e2e_cargo.rs
+++ b/crates/socket-patch-cli/tests/docker_e2e_cargo.rs
@@ -187,13 +187,10 @@ fi
 # too in case anything else stomps on it.
 chmod u+w "$LIB_RS" || true
 
-# Pre-seed setup.manual so the agent-mode VEX leg keeps the cargo patch
-# through property 7 (cargo has no auto-install setup hook; agent patches are
-# applied by hand/CI — exactly what `manual` declares). scan --sync merges the
-# downloaded patch into this manifest and preserves the setup block.
+# Pre-seed an empty manifest; scan --sync merges the downloaded patch into it.
 mkdir -p .socket
 cat > .socket/manifest.json <<'MANIFEST'
-{{ "patches": {{}}, "setup": {{ "manual": ["cargo"] }} }}
+{{ "patches": {{}} }}
 MANIFEST
 
 # scan --sync writes manifest + blob; the cargo crawler with --global
diff --git a/crates/socket-patch-cli/tests/docker_e2e_composer.rs b/crates/socket-patch-cli/tests/docker_e2e_composer.rs
index d21f2074..c050905b 100644
--- a/crates/socket-patch-cli/tests/docker_e2e_composer.rs
+++ b/crates/socket-patch-cli/tests/docker_e2e_composer.rs
@@ -235,13 +235,10 @@ PHP_FILE="vendor/monolog/monolog/src/Monolog/Logger.php"
 [ -f "$PHP_FILE" ] || {{ echo "FAIL: $PHP_FILE missing" >&2; ls vendor/monolog/monolog/src/Monolog/ >&2 || true; exit 1; }}
 echo "Installed to: $PHP_FILE" >&2
 
-# Pre-seed setup.manual so the agent-mode VEX leg keeps the composer patch
-# through property 7 (this project isn't `socket-patch setup`-configured; agent
-# patches are applied by hand/CI — exactly what `manual` declares). scan --sync
-# merges the downloaded patch into this manifest and preserves the setup block.
+# Pre-seed an empty manifest; scan --sync merges the downloaded patch into it.
 mkdir -p .socket
 cat > .socket/manifest.json <<'MANIFEST'
-{{ "patches": {{}}, "setup": {{ "manual": ["composer"] }} }}
+{{ "patches": {{}} }}
 MANIFEST
 
 # pristine pre-check: the freshly-installed upstream file must NOT already
diff --git a/crates/socket-patch-cli/tests/docker_e2e_gem.rs b/crates/socket-patch-cli/tests/docker_e2e_gem.rs
index 830a4996..039183d8 100644
--- a/crates/socket-patch-cli/tests/docker_e2e_gem.rs
+++ b/crates/socket-patch-cli/tests/docker_e2e_gem.rs
@@ -273,13 +273,10 @@ echo "Installed to: $GEM_FILE" >&2
 # after scan --sync's own nested apply has already patched the live file.
 cp "$GEM_FILE" /tmp/pristine.rb
 
-# Pre-seed setup.manual so the agent-mode VEX leg keeps the gem patch through
-# property 7 (this project isn't `socket-patch setup`-configured; agent patches
-# are applied by hand/CI — exactly what `manual` declares). scan --sync merges
-# the downloaded patch into this manifest and preserves the setup block.
+# Pre-seed an empty manifest; scan --sync merges the downloaded patch into it.
 mkdir -p .socket
 cat > .socket/manifest.json <<'MANIFEST'
-{{ "patches": {{}}, "setup": {{ "manual": ["gem"] }} }}
+{{ "patches": {{}} }}
 MANIFEST
 
 # scan exit code is intentionally not gated (see verify_snippet); capture JSON.
diff --git a/crates/socket-patch-cli/tests/docker_e2e_golang.rs b/crates/socket-patch-cli/tests/docker_e2e_golang.rs
index 67cb3831..6f96d385 100644
--- a/crates/socket-patch-cli/tests/docker_e2e_golang.rs
+++ b/crates/socket-patch-cli/tests/docker_e2e_golang.rs
@@ -172,13 +172,10 @@ fi
 # handles it but we pre-chmod for robustness.
 chmod u+w "$GIN_GO" || true
 
-# Pre-seed setup.manual so the agent-mode VEX leg keeps the golang patch
-# through property 7 (golang has no auto-install setup hook; agent patches are
-# applied by hand/CI — exactly what `manual` declares). scan --sync merges the
-# downloaded patch into this manifest and preserves the setup block.
+# Pre-seed an empty manifest; scan --sync merges the downloaded patch into it.
 mkdir -p .socket
 cat > .socket/manifest.json <<'MANIFEST'
-{{ "patches": {{}}, "setup": {{ "manual": ["golang"] }} }}
+{{ "patches": {{}} }}
 MANIFEST
 
 # scan --sync writes manifest + blob; the go crawler with --global probes
diff --git a/crates/socket-patch-cli/tests/docker_e2e_maven.rs b/crates/socket-patch-cli/tests/docker_e2e_maven.rs
index 7baf52cc..c102a5b7 100644
--- a/crates/socket-patch-cli/tests/docker_e2e_maven.rs
+++ b/crates/socket-patch-cli/tests/docker_e2e_maven.rs
@@ -197,13 +197,10 @@ fi
 # Defensive: ensure the cached file is writable before apply.
 chmod u+w "$POM_FILE" || true
 
-# Pre-seed setup.manual so the agent-mode VEX leg keeps the maven patch
-# through property 7 (maven has no auto-install setup hook; agent patches are
-# applied by hand/CI — exactly what `manual` declares). scan --sync merges the
-# downloaded patch into this manifest and preserves the setup block.
+# Pre-seed an empty manifest; scan --sync merges the downloaded patch into it.
 mkdir -p .socket
 cat > .socket/manifest.json <<'MANIFEST'
-{{ "patches": {{}}, "setup": {{ "manual": ["maven"] }} }}
+{{ "patches": {{}} }}
 MANIFEST
 
 # scan --sync writes manifest + blob; the maven crawler with --global
diff --git a/crates/socket-patch-cli/tests/docker_e2e_npm.rs b/crates/socket-patch-cli/tests/docker_e2e_npm.rs
index ee3455a7..e9a13669 100644
--- a/crates/socket-patch-cli/tests/docker_e2e_npm.rs
+++ b/crates/socket-patch-cli/tests/docker_e2e_npm.rs
@@ -226,14 +226,10 @@ mkdir -p /workspace/proj && cd /workspace/proj
 echo '{{ "name": "e2e-proj", "version": "0.0.0" }}' > package.json
 npm install --silent --no-audit --no-fund minimist@1.2.2
 
-# Pre-seed setup.manual so the agent-mode VEX leg (step 5b) keeps the npm
-# patch through property 7: this project isn't `socket-patch setup`-configured,
-# and an agent patch is applied by hand/CI — exactly what `manual` declares.
-# scan --sync merges the downloaded patch into this manifest and preserves the
-# setup block, so the manifest the VEX leg reads carries both.
+# Pre-seed an empty manifest; scan --sync merges the downloaded patch into it.
 mkdir -p .socket
 cat > .socket/manifest.json <<'MANIFEST'
-{{ "patches": {{}}, "setup": {{ "manual": ["npm"] }} }}
+{{ "patches": {{}} }}
 MANIFEST
 
 # 2. scan --json: must discover the patch via the real batch API. A
@@ -835,10 +831,10 @@ yarn install >/tmp/yi.out 2>/tmp/yi.err || {{ echo "FAIL: yarn berry install"; c
 TARGET=node_modules/minimist/index.js
 [ -f "$TARGET" ] || {{ echo "FAIL: $TARGET missing after berry install (PnP layout?)" >&2; ls -la node_modules >&2; exit 1; }}
 
-# Pre-seed setup.manual so the patch survives property-7 filtering.
+# Pre-seed an empty manifest; scan --sync merges the downloaded patch into it.
 mkdir -p .socket
 cat > .socket/manifest.json <<'MANIFEST'
-{{ "patches": {{}}, "setup": {{ "manual": ["npm"] }} }}
+{{ "patches": {{}} }}
 MANIFEST
 
 # 2. scan --sync then forced offline apply (placeholder beforeHash fixture).
@@ -1038,9 +1034,8 @@ async fn npm_berry_vendor_frozen_install_chain() {
     assert!(stdout.contains("===E2E PASS==="), "stdout=\n{stdout}");
 }
 
-/// The npm image carries vlt 1.2.0 for the setup-matrix `pm: vlt` cases
-/// (a non-gating extra: the gating vlt assertions are the real-vlt
-/// capstones).
+/// The npm image carries vlt 1.2.0 (a non-gating extra: the gating vlt
+/// assertions are the real-vlt capstones).
 #[test]
 fn npm_image_vlt_smoke() {
     let out = if host_mode() {
diff --git a/crates/socket-patch-cli/tests/docker_e2e_nuget.rs b/crates/socket-patch-cli/tests/docker_e2e_nuget.rs
index cf9c48df..9ea858d1 100644
--- a/crates/socket-patch-cli/tests/docker_e2e_nuget.rs
+++ b/crates/socket-patch-cli/tests/docker_e2e_nuget.rs
@@ -174,13 +174,10 @@ LICENSE_FILE="$NUGET_PACKAGES/newtonsoft.json/13.0.3/LICENSE.md"
 [ -f "$LICENSE_FILE" ] || {{ echo "FAIL: $LICENSE_FILE missing" >&2; ls "$NUGET_PACKAGES/newtonsoft.json/13.0.3/" >&2 || true; exit 1; }}
 echo "Installed to: $LICENSE_FILE" >&2
 
-# Pre-seed setup.manual so the agent-mode VEX leg keeps the nuget patch through
-# property 7 (nuget has no auto-install setup hook; agent patches are applied
-# by hand/CI — exactly what `manual` declares). scan --sync merges the
-# downloaded patch into this manifest and preserves the setup block.
+# Pre-seed an empty manifest; scan --sync merges the downloaded patch into it.
 mkdir -p .socket
 cat > .socket/manifest.json <<'MANIFEST'
-{{ "patches": {{}}, "setup": {{ "manual": ["nuget"] }} }}
+{{ "patches": {{}} }}
 MANIFEST
 
 # The unpatched LICENSE must NOT already contain our synthetic marker —
diff --git a/crates/socket-patch-cli/tests/docker_e2e_pypi.rs b/crates/socket-patch-cli/tests/docker_e2e_pypi.rs
index edaee421..c80e045c 100644
--- a/crates/socket-patch-cli/tests/docker_e2e_pypi.rs
+++ b/crates/socket-patch-cli/tests/docker_e2e_pypi.rs
@@ -215,13 +215,10 @@ pip install --disable-pip-version-check --quiet --no-cache-dir six==1.16.0
 mkdir -p /workspace/proj && cd /workspace/proj
 ln -sf /workspace/venv .venv
 
-# Pre-seed setup.manual so the agent-mode VEX leg keeps the pypi patch through
-# property 7 (this venv project isn't `socket-patch setup`-configured; agent
-# patches are applied by hand/CI — exactly what `manual` declares). scan --sync
-# merges the downloaded patch into this manifest and preserves the setup block.
+# Pre-seed an empty manifest; scan --sync merges the downloaded patch into it.
 mkdir -p .socket
 cat > .socket/manifest.json <<'MANIFEST'
-{{ "patches": {{}}, "setup": {{ "manual": ["pypi"] }} }}
+{{ "patches": {{}} }}
 MANIFEST
 
 # Locate the installed six.py file.
diff --git a/crates/socket-patch-cli/tests/e2e_embedded_vex.rs b/crates/socket-patch-cli/tests/e2e_embedded_vex.rs
index 4d619aa1..4c145d33 100644
--- a/crates/socket-patch-cli/tests/e2e_embedded_vex.rs
+++ b/crates/socket-patch-cli/tests/e2e_embedded_vex.rs
@@ -17,14 +17,9 @@ use std::process::Command;
 use serde_json::Value;
 use socket_patch_core::hash::git_sha256::compute_git_sha256_from_bytes;
 use socket_patch_core::manifest::schema::{
-    PatchFileInfo, PatchManifest, PatchRecord, SetupConfig, VulnerabilityInfo,
+    PatchFileInfo, PatchManifest, PatchRecord, VulnerabilityInfo,
 };
 
-/// Declare every ecosystem `manual` in fixtures so the property-7 setup-state
-/// filter doesn't drop these patches — these tests exercise embedded-VEX
-/// generation, not setup state.
-const ALL_MANUAL: &[&str] = &["npm", "pypi", "cargo", "golang", "gem", "composer"];
-
 fn binary() -> &'static str {
     env!("CARGO_BIN_EXE_socket-patch")
 }
@@ -58,14 +53,9 @@ fn cli() -> Command {
 fn write_manifest(cwd: &Path, manifest: &PatchManifest) {
     let dir = cwd.join(".socket");
     std::fs::create_dir_all(&dir).unwrap();
-    let mut m = manifest.clone();
-    m.setup = Some(SetupConfig {
-        exclude: Vec::new(),
-        manual: ALL_MANUAL.iter().map(|s| s.to_string()).collect(),
-    });
     std::fs::write(
         dir.join("manifest.json"),
-        serde_json::to_string_pretty(&m).unwrap(),
+        serde_json::to_string_pretty(manifest).unwrap(),
     )
     .unwrap();
 }
@@ -274,10 +264,9 @@ fn apply_vex_writes_document_on_success() {
 }
 
 /// vlt: agent `apply --vex` patches every `.vlt` store copy (a peer
-/// variant included) and attests it, with the ecosystem declared manual
-/// under its package-manager name `vlt`.
+/// variant included) and attests it.
 #[test]
-fn apply_vex_attests_a_vlt_store_install_declared_manual_as_vlt() {
+fn apply_vex_attests_a_vlt_store_install() {
     let tmp = tempfile::tempdir().unwrap();
     let cwd = tmp.path();
     let before = b"before contents\n";
@@ -316,10 +305,6 @@ fn apply_vex_attests_a_vlt_store_install_declared_manual_as_vlt() {
             &["CVE-2024-0001"],
         ),
     );
-    manifest.setup = Some(SetupConfig {
-        exclude: Vec::new(),
-        manual: vec!["vlt".to_string()],
-    });
     let socket = cwd.join(".socket");
     std::fs::create_dir_all(socket.join("blobs")).unwrap();
     std::fs::write(
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_gem_stale_install.rs b/crates/socket-patch-cli/tests/e2e_redirect_gem_stale_install.rs
index 34e641ec..4c2aa532 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_gem_stale_install.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_gem_stale_install.rs
@@ -327,8 +327,8 @@ async fn gem_hosted_redirect_over_stale_install_warns_loudly() {
     );
     assert_eq!(code, 0, "human re-scan must succeed:\n{stderr}");
     assert!(
-        stderr.contains("redirect_gem_stale_install"),
-        "human mode must carry the greppable code tag on stderr:\n{stderr}"
+        stderr.contains("Warning: ") && stderr.contains("was switched to its hosted patch, but a stale"),
+        "human mode must print the stale-install warning on stderr:\n{stderr}"
     );
     assert!(
         stderr.contains(&gem_dir.display().to_string()),
@@ -458,7 +458,7 @@ async fn gem_hosted_rescan_with_failing_record_fetch_reports_it_and_keeps_the_wi
     assert_eq!(
         failed["detail"],
         format!(
-            "{PURL} redirected, but its patch record could not be fetched; this run's VEX \
+            "{PURL} was switched to hosted, but its patch record could not be fetched; this run's VEX \
              attestation omits it (`socket-patch vex` fetches it again once the API answers)"
         ),
         "{env}"
diff --git a/crates/socket-patch-cli/tests/e2e_safety_cargo_build.rs b/crates/socket-patch-cli/tests/e2e_safety_cargo_build.rs
index 328441d8..62e9ef05 100644
--- a/crates/socket-patch-cli/tests/e2e_safety_cargo_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_safety_cargo_build.rs
@@ -40,10 +40,9 @@
 //!    with `.socket/manifest.json` deleted, `vex` finds nothing to attest
 //!    (`manifest_not_found`, exit 2, zero API requests, no document),
 //!    offline or online, and `apply --vex` stays the calm `noManifest`
-//!    exit 0 without a document. (With the manifest the patch is still
-//!    omitted, `ecosystem_not_setup`: cargo has no install hook, so an
-//!    agent-mode cargo patch attests only when `setup.manual` declares it.)
-//!    The patched bytes on disk never attest by themselves.
+//!    exit 0 without a document. (With the manifest the applied, verified
+//!    agent-mode patch attests.) The patched bytes on disk never attest by
+//!    themselves.
 //!
 //! Network: no. Toolchain: cargo (already on every e2e CI runner); the
 //! `cargo_e2e_matrix` knobs (`SOCKET_PATCH_CARGO_E2E_TOOLCHAIN` /
@@ -399,18 +398,34 @@ fn apply_then_cargo_check_succeeds() {
 /// the user's own), so VEX has nothing to attest and makes no request.
 fn manifestless_agent_patch_is_not_attested(consumer: &Path, cargo_home: &Path) {
     use vex_e2e_common::{
-        assert_not_attested, run_vex, strip_ledgers, strip_manifest, PatchApi, VexRun, VexVia,
+        run_vex, statements_for, strip_ledgers, strip_manifest, PatchApi, VexRun, VexVia,
     };
 
     let bin = vex_e2e_common::binary();
     let api = PatchApi::empty();
     let run = VexRun::online(&api).env("CARGO_HOME", cargo_home);
 
-    // Baseline, manifest present: cargo has no install hook, so the
-    // agent-mode patch is omitted until `setup.manual` declares it.
+    // Baseline, manifest present: the applied, verified agent-mode patch
+    // attests. The staged manifest carries no vulnerabilities (which alone
+    // would end `no_applicable_patches`), so give the entry one first.
+    let manifest_path = consumer.join(".socket/manifest.json");
+    let mut manifest: serde_json::Value =
+        serde_json::from_slice(&std::fs::read(&manifest_path).unwrap()).unwrap();
+    manifest["patches"][FIXTURE_PURL]["vulnerabilities"] = serde_json::json!({
+        "GHSA-cccc-cccc-cccc": {
+            "cves": ["CVE-2099-0001"],
+            "summary": "cargo safety vex vuln",
+            "severity": "high",
+            "description": "d"
+        }
+    });
+    std::fs::write(&manifest_path, serde_json::to_vec_pretty(&manifest).unwrap()).unwrap();
     let out = run_vex(&bin, consumer, &run);
-    assert_eq!(out.code, Some(1), "manifest-backed vex:\n{out}");
-    assert_not_attested(&out.envelope, FIXTURE_PURL, "ecosystem_not_setup");
+    assert_eq!(out.code, Some(0), "manifest-backed vex:\n{out}");
+    assert!(
+        !statements_for(out.doc(), FIXTURE_PURL).is_empty(),
+        "manifest-backed vex attests the agent-mode patch:\n{out}"
+    );
 
     strip_manifest(consumer);
     strip_ledgers(consumer);
diff --git a/crates/socket-patch-cli/tests/e2e_safety_lock.rs b/crates/socket-patch-cli/tests/e2e_safety_lock.rs
index 653a5e40..e712a9b8 100644
--- a/crates/socket-patch-cli/tests/e2e_safety_lock.rs
+++ b/crates/socket-patch-cli/tests/e2e_safety_lock.rs
@@ -186,7 +186,7 @@ fn lock_held_human_mode_mentions_other_process() {
 /// `--silent` is "errors only" (CLI_CONTRACT.md), never "nothing":
 /// a lock_held contention under `apply --silent` must still put the
 /// error line on stderr. Exit 1 with zero output is undiagnosable —
-/// the same violation fixed for setup/scan/apply's other error exits.
+/// the same violation fixed for scan/apply's other error exits.
 #[test]
 fn lock_held_silent_mode_still_reports_error() {
     let dir = tempfile::tempdir().unwrap();
diff --git a/crates/socket-patch-cli/tests/e2e_safety_vlt.rs b/crates/socket-patch-cli/tests/e2e_safety_vlt.rs
index 595ce1d0..6ba8f60e 100644
--- a/crates/socket-patch-cli/tests/e2e_safety_vlt.rs
+++ b/crates/socket-patch-cli/tests/e2e_safety_vlt.rs
@@ -211,9 +211,8 @@ fn apply_in_p1(pair: &Pair) {
 // ── linker legs ───────────────────────────────────────────────────────────
 
 /// Linux `auto` (hardlink): the default-flip canary (nlink ≥ 2 after the
-/// second install), apply CoW, p2 reinstalls pristine, `vlt install <x>`
-/// keeps the patch, and `vlt ci` restores pristine bytes and re-applies
-/// through the setup hook.
+/// second install), apply CoW, p2 reinstalls pristine, and `vlt install <x>`
+/// keeps the patch.
 #[tokio::test(flavor = "multi_thread")]
 #[ignore = "real vlt: SOCKET_PATCH_VLT_E2E_JS"]
 async fn vlt_pinned_matrix_safety_linux_auto() {
@@ -309,21 +308,6 @@ async fn linker_sequence(leg: Leg) {
         State::Patched,
         "vlt install <x> keeps it"
     );
-    let out = agent(&fx.proj, "setup", &["--json"]);
-    assert_eq!(out.code, 0, "{out}");
-    let before = pair.witness();
-    let run = VltRun::default().with_shims();
-    fx.leg.vlt_ok_with(&fx.proj, &["ci"], &run);
-    assert!(
-        !fx.leg.npx_log().is_empty(),
-        "the postinstall hook ran through the npx shim"
-    );
-    assert_eq!(
-        state(&fx.proj, fx.t()),
-        State::Patched,
-        "vlt ci + the hook re-apply"
-    );
-    pair.assert_untouched(&before, "vlt ci + hook");
     pair.fx.leg.ran();
 }
 
diff --git a/crates/socket-patch-cli/tests/e2e_safety_yarn_pnp.rs b/crates/socket-patch-cli/tests/e2e_safety_yarn_pnp.rs
index d97ebfe8..63f2a3bb 100644
--- a/crates/socket-patch-cli/tests/e2e_safety_yarn_pnp.rs
+++ b/crates/socket-patch-cli/tests/e2e_safety_yarn_pnp.rs
@@ -272,7 +272,7 @@ fn yarn_pnp_refuses_in_human_mode() {
 /// the yarn-PnP refusal is an error exit, so it must still print the
 /// refusal to stderr under `--silent`. Without this, `apply --silent`
 /// on a PnP checkout exits 1 with zero output — undiagnosable in CI
-/// logs (the same contract violation class fixed in `setup`/`scan`).
+/// logs (the same contract violation class fixed in `scan`).
 #[test]
 fn yarn_pnp_refusal_still_prints_error_under_silent() {
     let dir = tempfile::tempdir().unwrap();
@@ -352,7 +352,7 @@ fn npm_layout_does_not_trigger_yarn_pnp_refusal() {
     // Belt-and-braces: the marker string must be absent from both
     // streams entirely.
     assert!(
-        !stdout.contains("yarn_pnp_unsupported") && !stderr.contains("yarn_pnp_unsupported"),
+        !stdout.contains("yarn_pnp_unsupported") && !stderr.contains("Plug'n'Play"),
         "npm layout should not mention yarn-pnp anywhere.\nstdout:\n{stdout}\nstderr:\n{stderr}"
     );
     // Far stronger than pinning a no-match `partialFailure`: with a
@@ -943,8 +943,8 @@ fn scan_human_mode_on_pnp_project_prints_refusal_to_stderr() {
         "human scan stays exit 0.\nstdout:\n{stdout}\nstderr:\n{stderr}"
     );
     assert!(
-        stderr.contains("yarn_pnp_unsupported"),
-        "human scan must print the stable refusal code to stderr, got:\n{stderr}"
+        stderr.contains("Warning: this project uses yarn Plug'n'Play"),
+        "human scan must print the refusal to stderr, got:\n{stderr}"
     );
     assert!(
         stderr.contains("Plug'n'Play") && stderr.contains("yarn patch"),
diff --git a/crates/socket-patch-cli/tests/e2e_vendored_production.rs b/crates/socket-patch-cli/tests/e2e_vendored_production.rs
index 8aa793cd..2afa3bd1 100644
--- a/crates/socket-patch-cli/tests/e2e_vendored_production.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendored_production.rs
@@ -193,6 +193,20 @@ const GEM_PATCHES: &[(&str, &str)] = &[
         "c1a1cd3c-b670-4e44-b4fa-1a63ecd42db6",
         "lib/active_storage/transformers/image_processing_transformer.rb",
     ),
+    // GHSA-xr9x-r78c-5hrm / CVE-2026-66066, published 2026-08-21T19:07Z
+    // (also adds lib/active_storage/vips.rb).
+    (
+        "9c2b4925-b413-4a3a-bb3a-9990440fb446",
+        "lib/active_storage/transformers/image_processing_transformer.rb",
+    ),
+    // MERGED patch (GHSA-w749-p3v6-hccq + GHSA-r4mg-4433-c7g3 +
+    // GHSA-xr9x-r78c-5hrm), published 2026-09-04T21:23Z; the merge rung in
+    // `api::ranking` selects it. Also touches engine.rb, active_storage.rb and
+    // adds vips.rb — every file carries the marker.
+    (
+        "01019627-b481-4bae-bc09-e93b5a5e4481",
+        "lib/active_storage/transformers/image_processing_transformer.rb",
+    ),
 ];
 
 /// Header the patch service injects into patched npm / PyPI source files.
diff --git a/crates/socket-patch-cli/tests/e2e_vex.rs b/crates/socket-patch-cli/tests/e2e_vex.rs
index be7c2583..90c3adc3 100644
--- a/crates/socket-patch-cli/tests/e2e_vex.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex.rs
@@ -21,27 +21,9 @@ use std::process::Command;
 use serde_json::Value;
 use socket_patch_core::hash::git_sha256::compute_git_sha256_from_bytes;
 use socket_patch_core::manifest::schema::{
-    PatchFileInfo, PatchManifest, PatchRecord, SetupConfig, VulnerabilityInfo,
+    PatchFileInfo, PatchManifest, PatchRecord, VulnerabilityInfo,
 };
 
-/// Ecosystems opted in via `setup.manual` in test fixtures so the
-/// property-7 setup-state filter (`commands/setup::configured_ecosystems`)
-/// keeps these patches — these tests exercise VEX document GENERATION, not
-/// setup state. Only npm/pypi/gem/composer are setup-capable; cargo, golang,
-/// maven and nuget have no setup hook and get in only through `manual`
-/// (maven/nuget are appended by [`all_manual`]).
-const ALL_MANUAL: &[&str] = &["npm", "pypi", "cargo", "golang", "gem", "composer"];
-
-/// [`ALL_MANUAL`] plus the apply-only ecosystems (maven/nuget), so the
-/// all-ecosystem agent matrix below can declare every non-Deno ecosystem
-/// (8 of the 9).
-fn all_manual() -> Vec<String> {
-    let mut names: Vec<String> = ALL_MANUAL.iter().map(|s| (*s).to_string()).collect();
-    names.push("maven".to_string());
-    names.push("nuget".to_string());
-    names
-}
-
 fn binary() -> &'static str {
     env!("CARGO_BIN_EXE_socket-patch")
 }
@@ -77,14 +59,9 @@ fn cli() -> Command {
 fn write_manifest(cwd: &Path, manifest: &PatchManifest) {
     let dir = cwd.join(".socket");
     std::fs::create_dir_all(&dir).unwrap();
-    let mut m = manifest.clone();
-    m.setup = Some(SetupConfig {
-        exclude: Vec::new(),
-        manual: all_manual(),
-    });
     std::fs::write(
         dir.join("manifest.json"),
-        serde_json::to_string_pretty(&m).unwrap(),
+        serde_json::to_string_pretty(manifest).unwrap(),
     )
     .unwrap();
 }
@@ -275,13 +252,12 @@ fn two_patches_sharing_ghsa_merge_subcomponents() {
 // `e2e_vex_redirect::no_verify_attests_redirected_patches_across_ecosystems`.
 // One manifest patch per non-Deno ecosystem (qualified PURLs for the
 // release-variant ones: pypi `?artifact_id=`, gem `?platform=`, maven
-// `?classifier=&ext=`), `setup.manual` declaring every ecosystem (via
-// `all_manual`) so property 7 keeps them all, and `--no-verify` attests
-// straight from the manifest with no installed tree.
+// `?classifier=&ext=`), and `--no-verify` attests straight from the
+// manifest with no installed tree.
 //
-// Unlike the redirect matrix — whose patches bypass BOTH property 7 and
-// `Ecosystem::from_purl` via the `redirected` set — an agent patch routes
-// through `Ecosystem::from_purl` + the `manual` allowlist. Each statement must
+// Unlike the redirect matrix — whose patches bypass `Ecosystem::from_purl`
+// via the `redirected` set — an agent patch routes through
+// `Ecosystem::from_purl`. Each statement must
 // carry a PLAIN impact statement (NO `(vendored)`/`(redirected)` marker — that
 // is what distinguishes agent provenance) and preserve the (possibly
 // qualified) PURL verbatim as the subcomponent id.
@@ -349,8 +325,6 @@ fn no_verify_attests_agent_patches_across_ecosystems() {
             ),
         );
     }
-    // write_manifest stamps setup.manual = all_manual(), which declares
-    // every non-Deno ecosystem (8 of the 9).
     write_manifest(cwd, &manifest);
 
     let out = cli()
diff --git a/crates/socket-patch-cli/tests/e2e_vex_build/deno.rs b/crates/socket-patch-cli/tests/e2e_vex_build/deno.rs
index e40287c2..9434b896 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_build/deno.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_build/deno.rs
@@ -483,9 +483,6 @@ fn deno_hosted_and_vendored_never_attest_manifest_mode_unchanged() {
                 } },
                 "description": "deno agent-mode patch", "license": "MIT", "tier": "free",
             } },
-            // Deno projects run no npm install hook: declare the ecosystem
-            // manual so agent-mode statements are emitted (property 7).
-            "setup": { "manual": ["npm"] },
         }))
         .unwrap(),
     )
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/deno.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/deno.rs
index a8681db1..620e311b 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/deno.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/deno.rs
@@ -346,10 +346,8 @@ fn deno_jsr_agent_patch_attests_only_with_the_manifest() {
     let (key, before, after) = files()[0];
     put(&pkg, key.strip_prefix("package/").unwrap(), before);
     let rec = record(UUID);
-    let mut manifest = serde_json::json!({
+    let manifest = serde_json::json!({
         "patches": { JSR_PURL: serde_json::to_value(&rec).unwrap() },
-        // Deno has no install hook: declare it manual (property 7).
-        "setup": { "manual": ["deno"] },
     });
     fx.put(".socket/manifest.json", manifest.to_string());
     fx.put(
@@ -404,13 +402,4 @@ fn deno_jsr_agent_patch_attests_only_with_the_manifest() {
         assert_nothing_to_attest(&out, &[JSR_PURL], &format!("no manifest {extra:?}"));
     }
     quiet.assert_no_requests();
-
-    // And a manifest WITHOUT the `setup.manual` declaration keeps the
-    // pre-existing property-7 omission (unchanged by manifest-less VEX:
-    // the Deno patch is not lockfile-persisted, so it does not bypass it).
-    manifest["setup"] = serde_json::json!({});
-    fx.put(".socket/manifest.json", manifest.to_string());
-    let out = fx.vex(&["--offline"]);
-    assert_eq!(out.code, Some(1), "undeclared deno ecosystem: {out}");
-    assert_absent(out.doc.as_ref(), JSR_PURL);
 }
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/maven.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/maven.rs
index 96947ce6..f22f7785 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/maven.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/maven.rs
@@ -1230,16 +1230,6 @@ impl Fx {
         }
     }
 
-    /// Declare `eco` in the manifest's `setup.manual` (CLI_CONTRACT property
-    /// 7): maven has no install hook, so agent-mode patches are attested
-    /// only for an ecosystem the user declares they `apply` by hand.
-    fn declare_manual(&self, eco: &str) {
-        let path = self.cwd.join(".socket/manifest.json");
-        let mut manifest: Value = serde_json::from_slice(&std::fs::read(&path).unwrap()).unwrap();
-        manifest["setup"] = serde_json::json!({ "manual": [eco] });
-        std::fs::write(&path, serde_json::to_string_pretty(&manifest).unwrap()).unwrap();
-    }
-
     fn embedded_doc(&self) -> Value {
         doc_at(&self.cwd.join("embedded.vex.json"))
     }
@@ -1558,7 +1548,6 @@ fn maven_apply_vex_attests_but_agent_mode_needs_the_manifest() {
     put(&base, "slf4j-api-1.7.36.pom", b"<project><groupId>org.slf4j</groupId><artifactId>slf4j-api</artifactId><version>1.7.36</version></project>");
     put(&base, MVN_JAR_KEY, MVN_PRISTINE);
     fx.stage_manifest(MVN_PURL, MVN_HOSTED_UUID, &mvn_files());
-    fx.declare_manual("maven");
     let embedded = fx.cwd.join("embedded.vex.json");
     let (code, env, stderr) = fx.run(&[
         "apply",
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/nuget.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/nuget.rs
index 3973a9e7..77ba9403 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/nuget.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/nuget.rs
@@ -1458,13 +1458,6 @@ fn nuget_apply_vex_attests_but_agent_mode_needs_the_manifest() {
     put(&pkg, "newtonsoft.json.nuspec", b"<package/>");
     put(&pkg, NUGET_FILE_KEY, NUGET_PRISTINE);
     fx.stage_manifest(NUGET_PURL, NUGET_HOSTED_UUID, &nuget_files());
-    // nuget has no install hook: agent-mode statements need the ecosystem
-    // declared `setup.manual` (property 7) — the hosted/vendored cells
-    // above never do, their wiring IS the persistence.
-    let manifest = fx.cwd.join(".socket/manifest.json");
-    let mut m: Value = serde_json::from_slice(&std::fs::read(&manifest).unwrap()).unwrap();
-    m["setup"] = serde_json::json!({ "manual": ["nuget"] });
-    fx.put(".socket/manifest.json", m.to_string());
     let embedded = fx.cwd.join("embedded.vex.json");
     let (code, env, stderr) = fx.run(&[
         "apply",
diff --git a/crates/socket-patch-cli/tests/e2e_vex_redirect.rs b/crates/socket-patch-cli/tests/e2e_vex_redirect.rs
index 785015c1..e9b1caf0 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_redirect.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_redirect.rs
@@ -9,9 +9,9 @@
 //!
 //!   1. redirected PURL attested against the installed tree, `(redirected)`
 //!      marker (the post-install verified path)
-//!   2. property-7 exemption: a redirected patch bypasses the configured/manual
-//!      ecosystem filter (the lockfile rewrite is the persistence), while a
-//!      plain unconfigured control is dropped
+//!   2. a redirected patch and a plain agent-mode control both attest with
+//!      no manifest `setup` section; only the redirected one is marked
+//!      `(redirected)`
 //!   3. tampered installed file → omitted with skip reason `hash_mismatch`
 //!      (fail-closed)
 //!   4. `--no-verify` attests from the ledger records with NO installed tree
@@ -230,15 +230,15 @@ fn redirected_purl_attested_against_installed_tree() {
 }
 
 // ──────────────────────────────────────────────────────────────────────
-// 2. property-7 exemption — a redirected patch bypasses the filter
+// 2. redirected + agent-mode patches attest together
 // ──────────────────────────────────────────────────────────────────────
 
 #[test]
-fn redirected_purl_bypasses_property7_filter() {
+fn redirected_and_agent_patches_attest_without_setup_config() {
     let tmp = tempfile::tempdir().unwrap();
     let cwd = tmp.path();
 
-    // Redirected npm patch: verifies + bypasses property 7.
+    // Redirected npm patch: verifies from the redirect state.
     let patched = b"redirected patched index\n";
     let after = compute_git_sha256_from_bytes(patched);
     let purl = scaffold_npm(cwd, "left-pad", "1.3.0", patched);
@@ -249,9 +249,8 @@ fn redirected_purl_bypasses_property7_filter() {
     );
     write_hosted_package_lock(cwd, &[("left-pad", "1.3.0", UUID)], true);
 
-    // Control: a plain manifest npm patch that VERIFIES against node_modules
-    // but is neither redirected nor set up / manual — property 7 must drop it,
-    // proving the filter ran while the redirected patch sailed through.
+    // Control: a plain manifest (agent-mode) npm patch that VERIFIES against
+    // node_modules, with no install hook — it attests too, unmarked.
     let ctrl_patched = b"control patched index\n";
     let ctrl_after = compute_git_sha256_from_bytes(ctrl_patched);
     let ctrl_pkg = cwd.join("node_modules/control-pkg");
@@ -273,7 +272,6 @@ fn redirected_purl_bypasses_property7_filter() {
             &["CVE-2024-3"],
         ),
     );
-    // NO setup section: nothing configured, nothing manual.
     let dir = cwd.join(".socket");
     std::fs::create_dir_all(&dir).unwrap();
     std::fs::write(
@@ -288,23 +286,29 @@ fn redirected_purl_bypasses_property7_filter() {
         .expect("invoke vex");
     assert!(
         out.status.success(),
-        "the redirected patch must be attested without setup/manual. stderr:\n{}",
+        "both patches must attest. stderr:\n{}",
         String::from_utf8_lossy(&out.stderr)
     );
 
     let stdout = String::from_utf8(out.stdout).unwrap();
     let doc: Value = serde_json::from_str(&stdout).unwrap();
     let stmts = doc["statements"].as_array().unwrap();
-    assert_eq!(
-        stmts.len(),
-        1,
-        "only the redirected patch bypasses property 7; the unconfigured npm \
-         control must be dropped. doc:\n{stdout}"
+    assert_eq!(stmts.len(), 2, "both patches attest. doc:\n{stdout}");
+    let impact = |vuln: &str| -> String {
+        let hit: Vec<&Value> = stmts
+            .iter()
+            .filter(|s| s["vulnerability"]["name"] == vuln)
+            .collect();
+        assert_eq!(hit.len(), 1, "one statement for {vuln}:\n{stdout}");
+        hit[0]["impact_statement"].as_str().unwrap().to_string()
+    };
+    assert!(
+        impact("GHSA-rdir-keep").contains("(redirected)"),
+        "the redirected patch carries its marker:\n{stdout}"
     );
-    assert_eq!(stmts[0]["vulnerability"]["name"], "GHSA-rdir-keep");
     assert!(
-        !stdout.contains("GHSA-npm-control"),
-        "the non-redirected, non-configured control must be filtered:\n{stdout}"
+        !impact("GHSA-npm-control").contains("(redirected)"),
+        "the agent-mode control is not redirected:\n{stdout}"
     );
 }
 
diff --git a/crates/socket-patch-cli/tests/e2e_vex_vendor.rs b/crates/socket-patch-cli/tests/e2e_vex_vendor.rs
index 5cbd7118..e944c38b 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_vendor.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_vendor.rs
@@ -10,8 +10,8 @@
 //!      carries the "(vendored)" marker
 //!   2. tampered vendored artifact → omitted, envelope skip reason
 //!      `vendor_hash_mismatch`
-//!   3. Property-7 exemption: a vendored patch needs no install hook by
-//!      construction, so it bypasses the configured/manual ecosystem filter
+//!   3. vendored and agent-mode patches attest side by side with no
+//!      manifest `setup` section, the vendored one marked "(vendored)"
 //!   4. legacy `.socket/go-patches/` redirect regression: an apply-redirected
 //!      Go patch verifies against the redirect copy dir, not the (pristine)
 //!      module cache
@@ -29,7 +29,7 @@ use std::process::Command;
 use serde_json::Value;
 use socket_patch_core::hash::git_sha256::compute_git_sha256_from_bytes;
 use socket_patch_core::manifest::schema::{
-    PatchFileInfo, PatchManifest, PatchRecord, SetupConfig, VulnerabilityInfo,
+    PatchFileInfo, PatchManifest, PatchRecord, VulnerabilityInfo,
 };
 use socket_patch_core::vendor::state::{
     VendorArtifact, VendorEntry, VendorState, WiringAction, WiringRecord,
@@ -39,10 +39,6 @@ use socket_patch_core::vendor::state::{
 /// the uuid path level, so fixtures must use the real shape.
 const UUID: &str = "9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f";
 
-/// Every setup-supported ecosystem, declared `manual` so the property-7
-/// filter doesn't interfere with the tests that aren't about it.
-const ALL_MANUAL: &[&str] = &["npm", "pypi", "cargo", "golang", "gem", "composer"];
-
 fn binary() -> &'static str {
     env!("CARGO_BIN_EXE_socket-patch")
 }
@@ -60,21 +56,13 @@ fn cli() -> Command {
     cmd
 }
 
-/// Write `manifest` to `<cwd>/.socket/manifest.json`, optionally declaring
-/// every ecosystem `manual` (tests of the property-7 exemption pass `false`).
-fn write_manifest(cwd: &Path, manifest: &PatchManifest, declare_manual: bool) {
+/// Write `manifest` to `<cwd>/.socket/manifest.json`.
+fn write_manifest(cwd: &Path, manifest: &PatchManifest) {
     let dir = cwd.join(".socket");
     std::fs::create_dir_all(&dir).unwrap();
-    let mut m = manifest.clone();
-    if declare_manual {
-        m.setup = Some(SetupConfig {
-            exclude: Vec::new(),
-            manual: ALL_MANUAL.iter().map(|s| s.to_string()).collect(),
-        });
-    }
     std::fs::write(
         dir.join("manifest.json"),
-        serde_json::to_string_pretty(&m).unwrap(),
+        serde_json::to_string_pretty(manifest).unwrap(),
     )
     .unwrap();
 }
@@ -232,7 +220,7 @@ fn vendored_purl_attested_with_no_installed_tree() {
             &["CVE-2024-1"],
         ),
     );
-    write_manifest(cwd, &manifest, true);
+    write_manifest(cwd, &manifest);
 
     let out = cli()
         .args([
@@ -291,7 +279,7 @@ fn tampered_vendored_artifact_omitted_with_vendor_hash_mismatch() {
             &["CVE-2024-2"],
         ),
     );
-    write_manifest(cwd, &manifest, true);
+    write_manifest(cwd, &manifest);
 
     let vex_path = cwd.join("out.vex.json");
     let out = cli()
@@ -336,11 +324,12 @@ fn tampered_vendored_artifact_omitted_with_vendor_hash_mismatch() {
 }
 
 // ──────────────────────────────────────────────────────────────────────
-// 3. Property-7 exemption — vendored patches need no install hook
+// 3. vendored + agent-mode patches attest together — no manifest `setup`
+// section is needed for either
 // ──────────────────────────────────────────────────────────────────────
 
 #[test]
-fn property7_vendored_purl_bypasses_setup_manual_filter() {
+fn vendored_and_agent_patches_attest_without_setup_config() {
     let tmp = tempfile::tempdir().unwrap();
     let cwd = tmp.path();
     let vendored_purl = "pkg:cargo/serde@1.0.0";
@@ -350,10 +339,8 @@ fn property7_vendored_purl_bypasses_setup_manual_filter() {
     let rel = write_vendored_dir(cwd, patched);
     write_vendor_state(cwd, vendored_purl, &rel);
 
-    // Control: an npm patch that VERIFIES against node_modules but whose
-    // ecosystem is neither set up (no postinstall hook anywhere) nor manual
-    // — property 7 must drop it, proving the filter ran while the vendored
-    // patch sailed through.
+    // An agent-mode npm patch that VERIFIES against node_modules, with no
+    // install hook and no manifest `setup` section: it attests too.
     let nm_pkg = cwd.join("node_modules/applied-pkg");
     std::fs::create_dir_all(&nm_pkg).unwrap();
     std::fs::write(
@@ -386,8 +373,7 @@ fn property7_vendored_purl_bypasses_setup_manual_filter() {
             &["CVE-2024-4"],
         ),
     );
-    // NO setup section: nothing configured, nothing manual.
-    write_manifest(cwd, &manifest, false);
+    write_manifest(cwd, &manifest);
 
     let out = cli()
         .args([
@@ -401,7 +387,7 @@ fn property7_vendored_purl_bypasses_setup_manual_filter() {
         .expect("invoke vex");
     assert!(
         out.status.success(),
-        "the vendored patch must be attested without any setup/manual config. stderr:\n{}",
+        "both patches must attest without any manifest setup section. stderr:\n{}",
         String::from_utf8_lossy(&out.stderr)
     );
 
@@ -410,26 +396,36 @@ fn property7_vendored_purl_bypasses_setup_manual_filter() {
     let stmts = doc["statements"].as_array().unwrap();
     assert_eq!(
         stmts.len(),
-        1,
-        "only the vendored patch bypasses property 7; the unconfigured npm \
-         control must be dropped. doc:\n{stdout}"
+        2,
+        "the vendored patch and the applied agent-mode npm patch both attest. doc:\n{stdout}"
+    );
+    assert_eq!(
+        impact_for(stmts, "GHSA-vend-cccc"),
+        format!("Patched via Socket patch {UUID} (vendored)")
     );
-    assert_eq!(stmts[0]["vulnerability"]["name"], "GHSA-vend-cccc");
     assert!(
-        !stdout.contains("GHSA-npm-control"),
-        "the non-vendored, non-configured npm patch must be filtered:\n{stdout}"
+        !impact_for(stmts, "GHSA-npm-control").contains("(vendored)"),
+        "the agent-mode npm patch is not vendored:\n{stdout}"
     );
 }
 
-/// The property-7 vendored exemption (and the "(vendored)" phrasing) must
-/// survive `--no-verify`: the exemption's rationale — the committed
-/// `.socket/vendor/` artifact + lockfile wiring IS the persistence
-/// mechanism — is about how the patch persists, not about whether this run
-/// hashed it. The vendored classification comes from the committed ledger,
+/// The impact statement of the one statement naming `vuln`.
+fn impact_for(stmts: &[Value], vuln: &str) -> String {
+    let hits: Vec<&Value> = stmts
+        .iter()
+        .filter(|s| s["vulnerability"]["name"] == vuln)
+        .collect();
+    assert_eq!(hits.len(), 1, "exactly one statement for {vuln}: {stmts:?}");
+    hits[0]["impact_statement"].as_str().unwrap().to_string()
+}
+
+/// The "(vendored)" phrasing must survive `--no-verify`: it is about how
+/// the patch persists — the committed `.socket/vendor/` artifact + lockfile
+/// wiring — not about whether this run hashed it. The vendored classification comes from the committed ledger,
 /// which `--no-verify` can read without hashing anything (the artifact dir
 /// is deliberately ABSENT here to pin that no hashing happens).
 #[test]
-fn property7_vendored_exemption_survives_no_verify() {
+fn vendored_marker_survives_no_verify() {
     let tmp = tempfile::tempdir().unwrap();
     let cwd = tmp.path();
     let vendored_purl = "pkg:cargo/serde@1.0.0";
@@ -451,9 +447,8 @@ fn property7_vendored_exemption_survives_no_verify() {
             &["CVE-2024-6"],
         ),
     );
-    // Control: an npm patch with no hook configured and no `manual`
-    // declaration — property 7 must still drop it under `--no-verify`
-    // (the filter runs regardless of verification mode).
+    // An agent-mode npm patch: `--no-verify` trusts the manifest, so it
+    // attests too — without the vendored marker.
     manifest.patches.insert(
         "pkg:npm/unconfigured-pkg@1.0.0".to_string(),
         make_record(
@@ -464,8 +459,7 @@ fn property7_vendored_exemption_survives_no_verify() {
             &["CVE-2024-7"],
         ),
     );
-    // NO setup section: nothing configured, nothing manual.
-    write_manifest(cwd, &manifest, false);
+    write_manifest(cwd, &manifest);
 
     let out = cli()
         .args([
@@ -480,7 +474,7 @@ fn property7_vendored_exemption_survives_no_verify() {
         .expect("invoke vex");
     assert!(
         out.status.success(),
-        "--no-verify must keep the vendored patch's property-7 exemption. stderr:\n{}",
+        "--no-verify must attest the vendored patch. stderr:\n{}",
         String::from_utf8_lossy(&out.stderr)
     );
 
@@ -489,21 +483,17 @@ fn property7_vendored_exemption_survives_no_verify() {
     let stmts = doc["statements"].as_array().unwrap();
     assert_eq!(
         stmts.len(),
-        1,
-        "only the vendored patch bypasses property 7 under --no-verify; the \
-         unconfigured npm control must still be dropped. doc:\n{stdout}"
+        2,
+        "--no-verify attests every manifest patch. doc:\n{stdout}"
     );
-    assert_eq!(stmts[0]["vulnerability"]["name"], "GHSA-vend-dddd");
-    let impact = stmts[0]["impact_statement"].as_str().unwrap();
     assert_eq!(
-        impact,
+        impact_for(stmts, "GHSA-vend-dddd"),
         format!("Patched via Socket patch {UUID} (vendored)"),
         "--no-verify must not lose the (vendored) provenance marker"
     );
     assert!(
-        !stdout.contains("GHSA-npm-control"),
-        "the non-vendored, non-configured npm patch must be filtered even \
-         under --no-verify:\n{stdout}"
+        !impact_for(stmts, "GHSA-npm-control").contains("(vendored)"),
+        "the agent-mode npm patch is not vendored:\n{stdout}"
     );
 }
 
@@ -561,7 +551,7 @@ fn golang_go_patches_redirect_attested_without_module_cache() {
             &["CVE-2024-5"],
         ),
     );
-    write_manifest(cwd, &manifest, true);
+    write_manifest(cwd, &manifest);
 
     // Hermetic, EMPTY module cache: the pristine module is nowhere on disk,
     // exactly like a fresh checkout that only ran the redirect apply.
@@ -649,8 +639,7 @@ fn write_detached_vendor_state(cwd: &Path, purl: &str, rel_path: &str, record: P
 
 /// A detached vendored patch has NO manifest record — `vex` must attest it
 /// from the ledger's embedded record + the committed artifact, even when
-/// `.socket/manifest.json` does not exist at all. The vendored property-7
-/// exemption applies (no setup/manual declaration anywhere).
+/// `.socket/manifest.json` does not exist at all.
 #[test]
 fn detached_entry_attested_without_manifest() {
     let tmp = tempfile::tempdir().unwrap();
@@ -1022,8 +1011,7 @@ fn detached_matrix_entry(
 /// maven (maven2-layout `.jar`) — laid down in each ecosystem's REAL
 /// artifact shape (dir / tarball / zip-family) with matching afterHashes,
 /// then ONE `vex` run must attest all of them `(vendored)` from the ledger
-/// alone: no manifest, no installed trees, no setup/manual declarations
-/// (the vendored property-7 exemption covers every row).
+/// alone: no manifest, no installed trees.
 #[test]
 fn detached_vendor_matrix_attests_every_vendor_ecosystem() {
     let tmp = tempfile::tempdir().unwrap();
@@ -1353,28 +1341,21 @@ fn vendored_live_tree_out_of_sync_warns_but_attests() {
 }
 
 // ──────────────────────────────────────────────────────────────────────
-// 8. property-7 filter drops are machine-visible — a byte-verified applied
-// patch omitted ONLY by the ecosystem-setup filter must surface as a
-// per-purl skipped event (errorCode `ecosystem_not_setup`), and an all-
-// drops failure must say so in the top-level error message instead of the
-// generic (and factually wrong) "No applied patches ... to attest."
-// Confirmed against real pnpm projects 2026-08-18.
+// 8. an applied, byte-verified agent-mode patch attests whether or not its
+// ecosystem has an install hook (there is no setup-state filter).
 // ──────────────────────────────────────────────────────────────────────
 
-/// All-drops case: the ONLY patch is applied + byte-verified but its
-/// ecosystem is neither set up nor `manual`. Exit stays 1 with code
-/// `no_applicable_patches`, but the envelope must carry the skipped event
-/// and the message must name the setup filter. A stale OpenVEX doc parked
-/// at `--output` from a previous run must also be removed — a failed run
-/// leaves no attestation behind.
+/// The ONLY patch is applied + byte-verified in a project with no install
+/// hook and no manifest `setup` section: it attests (exit 0, a `verified`
+/// event), and the fresh doc replaces a stale one parked at `--output`.
 #[test]
-fn setup_filter_drop_surfaces_skipped_event_and_removes_stale_doc() {
+fn agent_patch_without_install_hook_attests_and_replaces_stale_doc() {
     let tmp = tempfile::tempdir().expect("create tempdir");
     let cwd = tmp.path();
     let purl = "pkg:npm/applied-pkg@1.0.0";
 
-    // Applied + verifiable in node_modules; no root package.json → no npm
-    // hook configured; manifest carries NO setup section.
+    // Applied + verifiable in node_modules; no root package.json (so no
+    // install hook anywhere); the manifest carries no setup section.
     let nm = cwd.join("node_modules/applied-pkg");
     std::fs::create_dir_all(&nm).expect("create node_modules entry");
     std::fs::write(
@@ -1397,7 +1378,7 @@ fn setup_filter_drop_surfaces_skipped_event_and_removes_stale_doc() {
             &["CVE-2026-20"],
         ),
     );
-    write_manifest(cwd, &manifest, false);
+    write_manifest(cwd, &manifest);
 
     // A previous successful run's doc sits at --output.
     let vex_path = cwd.join("out.vex.json");
@@ -1420,49 +1401,42 @@ fn setup_filter_drop_surfaces_skipped_event_and_removes_stale_doc() {
         ])
         .output()
         .expect("invoke vex");
-    assert_eq!(
-        out.status.code(),
-        Some(1),
-        "all patches filtered ⇒ soft exit 1. stdout:\n{}",
+    assert!(
+        out.status.success(),
+        "an applied agent-mode patch attests. stdout:\n{}",
         String::from_utf8_lossy(&out.stdout)
     );
 
     let env: Value = serde_json::from_slice(&out.stdout).expect("envelope JSON on stdout");
-    assert_eq!(env["status"], "error", "{env}");
-    assert_eq!(env["error"]["code"], "no_applicable_patches", "{env}");
-    // The message must name the ACTUAL cause — the patch IS applied with
-    // vulnerability metadata; only the setup filter dropped it.
-    let msg = env["error"]["message"].as_str().unwrap();
-    assert!(
-        msg.contains("not set up") && msg.contains("setup.manual"),
-        "an all-drops failure must name the setup filter, got {msg:?}"
-    );
-    // Machine-visible per-purl drop.
+    assert_eq!(env["status"], "success", "{env}");
     let events = env["events"].as_array().unwrap();
-    let skipped = events
-        .iter()
-        .find(|e| e["action"] == "skipped" && e["purl"] == purl)
-        .unwrap_or_else(|| panic!("expected a skipped event for the filtered purl: {env}"));
-    assert_eq!(
-        skipped["errorCode"], "ecosystem_not_setup",
-        "the filter drop must carry its routing tag: {skipped}"
+    assert!(
+        events
+            .iter()
+            .any(|e| e["action"] == "verified" && e["purl"] == purl),
+        "expected a verified event for {purl}: {env}"
     );
-    // Failed-run hygiene: the stale prior doc must be gone.
     assert!(
-        !vex_path.exists(),
-        "a failed run must not leave a previous run's attestation at --output"
+        !events.iter().any(|e| e["action"] == "skipped"),
+        "nothing is omitted: {env}"
     );
+    let doc: Value =
+        serde_json::from_str(&std::fs::read_to_string(&vex_path).expect("read emitted VEX doc"))
+            .expect("parse emitted VEX doc");
+    assert_ne!(doc["@id"], "urn:uuid:stale", "the stale doc is replaced: {doc}");
+    let stmts = doc["statements"].as_array().unwrap();
+    assert_eq!(stmts.len(), 1, "{doc}");
+    assert_eq!(stmts[0]["vulnerability"]["name"], "GHSA-drop-aaaa", "{doc}");
 }
 
-/// Partial case: a vendored patch attests while an npm patch is filter-
-/// dropped. Exit 0 (a doc was produced), envelope `partialFailure`, and the
-/// drop is a skipped event alongside the vendored purl's verified event.
+/// A vendored patch and an applied agent-mode npm patch (no install hook)
+/// both attest: exit 0, envelope `success`, a verified event for each.
 #[test]
-fn setup_filter_drop_alongside_success_is_partial_failure_event() {
+fn agent_patch_alongside_vendored_patch_both_attest() {
     let tmp = tempfile::tempdir().expect("create tempdir");
     let cwd = tmp.path();
     let vendored_purl = "pkg:cargo/serde@1.0.0";
-    let dropped_purl = "pkg:npm/applied-pkg@1.0.0";
+    let agent_purl = "pkg:npm/applied-pkg@1.0.0";
 
     let patched = b"patched vendored source\n";
     let after_hash = compute_git_sha256_from_bytes(patched);
@@ -1492,7 +1466,7 @@ fn setup_filter_drop_alongside_success_is_partial_failure_event() {
         ),
     );
     manifest.patches.insert(
-        dropped_purl.to_string(),
+        agent_purl.to_string(),
         make_record(
             "11111111-1111-4111-8111-111111111111",
             "package/index.js",
@@ -1501,7 +1475,7 @@ fn setup_filter_drop_alongside_success_is_partial_failure_event() {
             &["CVE-2026-22"],
         ),
     );
-    write_manifest(cwd, &manifest, false);
+    write_manifest(cwd, &manifest);
 
     let vex_path = cwd.join("out.vex.json");
     let out = cli()
@@ -1519,33 +1493,26 @@ fn setup_filter_drop_alongside_success_is_partial_failure_event() {
         .expect("invoke vex");
     assert!(
         out.status.success(),
-        "a produced doc keeps exit 0 even with filter drops. stdout:\n{}",
+        "both patches attest. stdout:\n{}",
         String::from_utf8_lossy(&out.stdout)
     );
 
     let env: Value = serde_json::from_slice(&out.stdout).expect("envelope JSON on stdout");
-    assert_eq!(
-        env["status"], "partialFailure",
-        "an omission alongside a success is partialFailure: {env}"
-    );
+    assert_eq!(env["status"], "success", "{env}");
     let events = env["events"].as_array().unwrap();
-    assert!(
-        events
-            .iter()
-            .any(|e| e["action"] == "verified" && e["purl"] == vendored_purl),
-        "the vendored purl must attest: {env}"
-    );
-    let skipped = events
-        .iter()
-        .find(|e| e["action"] == "skipped" && e["purl"] == dropped_purl)
-        .unwrap_or_else(|| panic!("expected a skipped event for the filtered purl: {env}"));
-    assert_eq!(skipped["errorCode"], "ecosystem_not_setup", "{skipped}");
+    for purl in [vendored_purl, agent_purl] {
+        assert!(
+            events
+                .iter()
+                .any(|e| e["action"] == "verified" && e["purl"] == purl),
+            "{purl} must attest: {env}"
+        );
+    }
 
-    // The doc holds exactly the vendored statement.
     let doc: Value =
         serde_json::from_str(&std::fs::read_to_string(&vex_path).expect("read emitted VEX doc"))
             .expect("parse emitted VEX doc");
-    assert_eq!(doc["statements"].as_array().unwrap().len(), 1, "{doc}");
+    assert_eq!(doc["statements"].as_array().unwrap().len(), 2, "{doc}");
 }
 
 // ──────────────────────────────────────────────────────────────────────
@@ -1578,7 +1545,7 @@ fn product_override_non_iri_warns_in_envelope() {
             &["CVE-2026-30"],
         ),
     );
-    write_manifest(cwd, &manifest, true);
+    write_manifest(cwd, &manifest);
 
     let vex_path = cwd.join("out.vex.json");
     let out = cli()
@@ -1665,7 +1632,7 @@ fn standalone_output_write_failure_names_path_and_exits_2() {
             &["CVE-2026-31"],
         ),
     );
-    write_manifest(cwd, &manifest, true);
+    write_manifest(cwd, &manifest);
 
     let bad_path = cwd.join("no-such-dir/out.vex.json");
     let out = cli()
@@ -1769,7 +1736,7 @@ fn unwired_vendor_ledger_entry_is_not_attested() {
             &["CVE-2026-20"],
         ),
     );
-    write_manifest(cwd, &manifest, true);
+    write_manifest(cwd, &manifest);
     // The lockfile/config wiring is reverted by hand; the artifact and the
     // ledger entry stay behind.
     std::fs::write(cwd.join("Cargo.toml"), CARGO_MANIFEST_HEAD).unwrap();
diff --git a/crates/socket-patch-cli/tests/e2e_vlt.rs b/crates/socket-patch-cli/tests/e2e_vlt.rs
index 7d1dcb0e..0df73f80 100644
--- a/crates/socket-patch-cli/tests/e2e_vlt.rs
+++ b/crates/socket-patch-cli/tests/e2e_vlt.rs
@@ -1,11 +1,8 @@
-//! Real-vlt agent mode and setup (suites `agent` and `setup`, DESIGN §5,
-//! §8.3).
+//! Real-vlt agent mode (suite `agent`, DESIGN §5, §8.3).
 //!
 //! Agent legs patch a REAL vlt tree in place (importer links, the `.vlt`
 //! store, transitive, scoped, alias and peer copies) and pin how long the
-//! patch persists across vlt commands (T23). Setup legs wire the root
-//! `postinstall` hook and run vlt with a leg-private `npx` shim that execs
-//! the socket-patch under test, counting hook invocations (T17/T18/T22).
+//! patch persists across vlt commands (T23).
 //! Each leg is `vlt_pinned_matrix_<suite>_<leg>` and prints one `VLT-LEG`
 //! line.
 
@@ -23,16 +20,11 @@ const DEBUG: (&str, &str) = ("debug", "4.3.4");
 const MS2: (&str, &str) = ("ms", "2.1.2");
 const USX: (&str, &str) = ("use-sync-external-store", "1.2.0");
 const UUID_MS2: &str = "c9c9c9c9-9999-4999-8999-999999999999";
-const HOOK: &str = "npx @socketsecurity/socket-patch apply --silent --ecosystems npm";
 
 fn agent_leg(name: &'static str) -> Option<Leg> {
     Leg::start("agent", name)
 }
 
-fn setup_leg(name: &'static str) -> Option<Leg> {
-    Leg::start("setup", name)
-}
-
 fn cwd(dir: &Path) -> String {
     dir.to_str().unwrap().to_string()
 }
@@ -447,8 +439,8 @@ async fn vlt_pinned_matrix_agent_persistence_reverted_by_reinstall() {
 }
 
 /// `apply` rerun is idempotent, `rollback` rerun is a no-op, and `vex`
-/// (the setup hook wired) attests the agent-patched store copy but not
-/// after a `vlt ci` that ran without the hook.
+/// attests the agent-patched store copy but not after a `vlt ci` restored
+/// the pristine bytes.
 #[tokio::test(flavor = "multi_thread")]
 #[ignore = "real vlt: SOCKET_PATCH_VLT_E2E_JS"]
 async fn vlt_pinned_matrix_agent_reruns_and_vex() {
@@ -465,8 +457,6 @@ async fn vlt_pinned_matrix_agent_reruns_and_vex() {
         "apply rerun"
     );
     assert_eq!(state(&fx.proj, fx.t()), State::Patched);
-    let out = setup(&fx.proj, &fx, &[]);
-    assert_eq!(out.code, 0, "{out}");
     let vex = |fx: &Fixture| {
         let _ = std::fs::remove_file(fx.proj.join("out.vex.json"));
         let out = offline(
@@ -479,13 +469,9 @@ async fn vlt_pinned_matrix_agent_reruns_and_vex() {
     let (attested, out) = vex(&fx);
     assert!(attested, "{out}");
     if fx.leg.at_least(HAS_CI_FROM) {
-        let out = setup(&fx.proj, &fx, &["--remove"]);
-        assert_eq!(out.code, 0, "{out}");
         fx.vlt_ok(&fx.proj, &["ci"]);
-        let out = setup(&fx.proj, &fx, &[]);
-        assert_eq!(out.code, 0, "{out}");
         let (attested, out) = vex(&fx);
-        assert!(!attested, "pristine after vlt ci without the hook: {out}");
+        assert!(!attested, "pristine after vlt ci: {out}");
         let out = offline(&fx.proj, &["apply"], &[]);
         assert_eq!(out.code, 0, "{out}");
     }
@@ -503,266 +489,6 @@ async fn vlt_pinned_matrix_agent_reruns_and_vex() {
     fx.leg.ran();
 }
 
-// ── setup ─────────────────────────────────────────────────────────────────
-
-fn setup(dir: &Path, fx: &Fixture, extra: &[&str]) -> SocketOut {
-    let bin = fx.leg.shim_dir();
-    let path = std::env::var_os("PATH").unwrap_or_default();
-    let mut parts = vec![bin];
-    parts.extend(std::env::split_paths(&path));
-    let joined = std::env::join_paths(parts).unwrap();
-    let c = cwd(dir);
-    let mut args = vec!["setup", "--json", "--yes", "--cwd", &c];
-    args.extend_from_slice(extra);
-    socket(dir, &args, &[("PATH", joined.to_str().unwrap())])
-}
-
-fn with_hook_env(fx: &Fixture) -> VltRun {
-    let mut run = fx.run.clone().with_shims();
-    run.env.push(("SOCKET_NO_CONFIG".into(), "1".into()));
-    run.env.push(("SOCKET_NO_UPDATE_CHECK".into(), "1".into()));
-    run.env
-        .push(("SOCKET_TELEMETRY_DISABLED".into(), "1".into()));
-    run.env.push(("SOCKET_OFFLINE".into(), "1".into()));
-    run
-}
-
-fn hook_count(fx: &Fixture) -> usize {
-    fx.leg
-        .npx_log()
-        .iter()
-        .filter(|l| l.contains("apply"))
-        .count()
-}
-
-/// With the hook wired: every diff-bearing reify (fresh install, `install
-/// <x>`, `ci`) runs it exactly once from rc.13, and the patched bytes land
-/// in `.vlt/<DepID>/node_modules/<name>`; a no-op install runs nothing.
-#[tokio::test(flavor = "multi_thread")]
-#[ignore = "real vlt: SOCKET_PATCH_VLT_E2E_JS"]
-async fn vlt_pinned_matrix_setup_hook_fires_per_reify() {
-    let Some(leg) = setup_leg("hook_fires_per_reify") else {
-        return;
-    };
-    if !leg.at_least(ROOT_POSTINSTALL_FROM) {
-        return leg.skip("root-postinstall-not-run");
-    }
-    let mut shape = Shape::with_bystander();
-    shape.pins.push(SCOPED);
-    let fx = Fixture::build(leg, shape).await;
-    stage_manifest(&fx.proj, &[fx.t()]);
-    let out = setup(&fx.proj, &fx, &[]);
-    assert_eq!(out.code, 0, "{out}");
-    let pkg = std::fs::read_to_string(fx.proj.join("package.json")).unwrap();
-    assert!(pkg.contains(HOOK), "{pkg}");
-    let run = with_hook_env(&fx);
-    fx.leg.vlt_ok_with(&fx.proj, &["install"], &run);
-    assert_eq!(hook_count(&fx), 1, "fresh install: {:?}", fx.leg.npx_log());
-    assert_every_copy(&fx.proj, fx.t(), State::Patched);
-    fx.leg.vlt_ok_with(&fx.proj, &["install"], &run);
-    assert_eq!(hook_count(&fx), 1, "a no-op install runs no hook");
-    fx.leg.vlt_ok_with(
-        &fx.proj,
-        &["install", "@isaacs/string-locale-compare@1.1.0"],
-        &run,
-    );
-    assert_eq!(hook_count(&fx), 2, "install <x>");
-    fx.leg.vlt_ok_with(&fx.proj, &["ci"], &run);
-    assert_eq!(hook_count(&fx), 3, "ci");
-    assert_every_copy(&fx.proj, fx.t(), State::Patched);
-    fx.leg.ran();
-}
-
-/// `vlt_root_scripts_not_run`: definite through the `vlt` shim before
-/// rc.13, absent from rc.13.
-#[tokio::test(flavor = "multi_thread")]
-#[ignore = "real vlt: SOCKET_PATCH_VLT_E2E_JS"]
-async fn vlt_pinned_matrix_setup_root_scripts_advisory() {
-    let Some(leg) = setup_leg("root_scripts_advisory") else {
-        return;
-    };
-    let fx = Fixture::build(leg, Shape::left_pad()).await;
-    let out = setup(&fx.proj, &fx, &[]);
-    assert_eq!(out.code, 0, "{out}");
-    let warned = out.stdout.contains("vlt_root_scripts_not_run");
-    if fx.leg.at_least(ROOT_POSTINSTALL_FROM) {
-        assert!(!warned, "{out}");
-    } else {
-        assert!(warned, "{out}");
-        assert!(
-            out.stdout
-                .contains(&format!("(`vlt --version` reports {})", fx.leg.tc.raw)),
-            "the definite wording: {out}"
-        );
-    }
-    fx.leg.ran();
-}
-
-/// A workspace gets the hook at the root only, and a member-dir `vlt ci`
-/// runs the root hook once.
-#[tokio::test(flavor = "multi_thread")]
-#[ignore = "real vlt: SOCKET_PATCH_VLT_E2E_JS"]
-async fn vlt_pinned_matrix_setup_workspace_root_only() {
-    let Some(leg) = setup_leg("workspace_root_only") else {
-        return;
-    };
-    if !leg.at_least(ROOT_POSTINSTALL_FROM) {
-        return leg.skip("root-postinstall-not-run");
-    }
-    let mut shape = Shape::left_pad();
-    shape.deps = vec![];
-    shape.vlt_json.workspaces = Some(json!("packages/*"));
-    shape.files = vec![("packages/a/package.json".into(), package_json("a", &[LP]))];
-    let fx = Fixture::build(leg, shape).await;
-    stage_manifest(&fx.proj, &[fx.t()]);
-    let member = std::fs::read_to_string(fx.proj.join("packages/a/package.json")).unwrap();
-    let out = setup(&fx.proj, &fx, &[]);
-    assert_eq!(out.code, 0, "{out}");
-    assert!(std::fs::read_to_string(fx.proj.join("package.json"))
-        .unwrap()
-        .contains(HOOK));
-    assert_eq!(
-        std::fs::read_to_string(fx.proj.join("packages/a/package.json")).unwrap(),
-        member,
-        "the member is untouched"
-    );
-    let run = with_hook_env(&fx);
-    fx.leg
-        .vlt_ok_with(&fx.proj.join("packages/a"), &["ci"], &run);
-    assert_eq!(hook_count(&fx), 1, "{:?}", fx.leg.npx_log());
-    assert_eq!(
-        state_at(&importer_dir(&fx.proj, "packages/a", LP.0), fx.t()),
-        State::Patched
-    );
-    fx.leg.ran();
-}
-
-/// `setup` twice adds no duplicate hook.
-#[tokio::test(flavor = "multi_thread")]
-#[ignore = "real vlt: SOCKET_PATCH_VLT_E2E_JS"]
-async fn vlt_pinned_matrix_setup_twice_no_duplicate() {
-    let Some(leg) = setup_leg("twice_no_duplicate") else {
-        return;
-    };
-    let fx = Fixture::build(leg, Shape::left_pad()).await;
-    let out = setup(&fx.proj, &fx, &[]);
-    assert_eq!(out.code, 0, "{out}");
-    let once = std::fs::read(fx.proj.join("package.json")).unwrap();
-    let out = setup(&fx.proj, &fx, &[]);
-    assert_eq!(out.code, 0, "{out}");
-    assert_eq!(std::fs::read(fx.proj.join("package.json")).unwrap(), once);
-    let pkg: Value = serde_json::from_slice(&once).unwrap();
-    assert_eq!(pkg["scripts"]["postinstall"], HOOK, "{pkg:#}");
-    fx.leg.ran();
-}
-
-/// With the hook present: a project with no patches installs cleanly;
-/// with the patch API unreachable and the blobs not local, the hook's
-/// `apply --silent` exits with the contract's `sources_download_failed`
-/// code and vlt rolls the install back (a non-zero root script aborts it).
-#[tokio::test(flavor = "multi_thread")]
-#[ignore = "real vlt: SOCKET_PATCH_VLT_E2E_JS"]
-async fn vlt_pinned_matrix_setup_hook_failure() {
-    let Some(leg) = setup_leg("hook_failure") else {
-        return;
-    };
-    if !leg.at_least(ROOT_POSTINSTALL_FROM) {
-        return leg.skip("root-postinstall-not-run");
-    }
-    let fx = Fixture::build(leg, Shape::with_bystander()).await;
-    let out = setup(&fx.proj, &fx, &[]);
-    assert_eq!(out.code, 0, "{out}");
-    let run = with_hook_env(&fx);
-    fx.leg.vlt_ok_with(&fx.proj, &["install"], &run);
-    assert_eq!(hook_count(&fx), 1, "the empty hook ran");
-    stage_manifest(&fx.proj, &[fx.t()]);
-    std::fs::remove_dir_all(fx.proj.join(".socket/blobs")).unwrap();
-    let dead = "http://127.0.0.1:9";
-    let mut cmd = socket_cmd();
-    let c = cwd(&fx.proj);
-    cmd.args([
-        "apply",
-        "--silent",
-        "--json",
-        "--ecosystems",
-        "npm",
-        "--cwd",
-        &c,
-    ])
-    .env("SOCKET_PROXY_URL", dead)
-    .env("SOCKET_API_URL", dead);
-    let direct = cmd.output().unwrap();
-    let text = String::from_utf8_lossy(&direct.stdout).into_owned();
-    assert!(
-        text.contains("sources_download_failed") && text.contains("partialFailure"),
-        "the contract's warning: {text}"
-    );
-    assert_eq!(
-        direct.status.code(),
-        Some(1),
-        "partialFailure exits 1: {}",
-        out_text(&direct)
-    );
-    remove_tree(&fx.proj);
-    let mut run = with_hook_env(&fx);
-    run.env.retain(|(k, _)| k != "SOCKET_OFFLINE");
-    run.env.push(("SOCKET_PROXY_URL".into(), dead.into()));
-    run.env.push(("SOCKET_API_URL".into(), dead.into()));
-    let out = fx.leg.vlt_with(&fx.proj, &["install"], &run);
-    assert_eq!(hook_count(&fx), 2, "the failing hook ran");
-    assert!(
-        !out.status.success(),
-        "the failing hook aborts the install: {}",
-        out_text(&out)
-    );
-    fx.leg.ran();
-}
-
-/// Windows from 1.0.5 (the rollback EBUSY fix): a failing hook's abort
-/// leaves no `.VLT.DELETE.*` staging dir the next crawl could misread.
-#[tokio::test(flavor = "multi_thread")]
-#[ignore = "real vlt: SOCKET_PATCH_VLT_E2E_JS"]
-async fn vlt_pinned_matrix_setup_hook_abort_leaves_no_staging() {
-    let Some(leg) = setup_leg("hook_abort_leaves_no_staging") else {
-        return;
-    };
-    if !cfg!(windows) {
-        return leg.skip("windows-only");
-    }
-    if !leg.at_least(REGISTRIES_NPM_REQUIRED_FROM) {
-        return leg.skip("pre-ebusy-fix");
-    }
-    let fx = Fixture::build(leg, Shape::with_bystander()).await;
-    let out = setup(&fx.proj, &fx, &[]);
-    assert_eq!(out.code, 0, "{out}");
-    stage_manifest(&fx.proj, &[fx.t()]);
-    std::fs::remove_dir_all(fx.proj.join(".socket/blobs")).unwrap();
-    let dead = "http://127.0.0.1:9";
-    let mut run = with_hook_env(&fx);
-    run.env.retain(|(k, _)| k != "SOCKET_OFFLINE");
-    run.env.push(("SOCKET_PROXY_URL".into(), dead.into()));
-    run.env.push(("SOCKET_API_URL".into(), dead.into()));
-    let out = fx.leg.vlt_with(&fx.proj, &["install"], &run);
-    assert!(
-        !out.status.success(),
-        "the failing hook aborts: {}",
-        out_text(&out)
-    );
-    let store = fx.proj.join("node_modules/.vlt");
-    let staging: Vec<String> = std::fs::read_dir(&store)
-        .map(|rd| {
-            rd.flatten()
-                .map(|e| e.file_name().to_string_lossy().into_owned())
-                .filter(|n| n.starts_with(".VLT.DELETE"))
-                .collect()
-        })
-        .unwrap_or_default();
-    assert!(staging.is_empty(), "{staging:?}");
-    let out = socket_api(&fx.proj, &fx.svc, &["scan"], &[]);
-    assert!(!out.stdout.contains(".VLT.DELETE"), "{out}");
-    fx.leg.ran();
-}
-
 // ── harness ───────────────────────────────────────────────────────────────
 
 /// A stand-in `vlt.js` that spawns one detached child living `child_ms`
diff --git a/crates/socket-patch-cli/tests/ecosystem_dispatch_e2e.rs b/crates/socket-patch-cli/tests/ecosystem_dispatch_e2e.rs
index 35bf0a01..a10666ce 100644
--- a/crates/socket-patch-cli/tests/ecosystem_dispatch_e2e.rs
+++ b/crates/socket-patch-cli/tests/ecosystem_dispatch_e2e.rs
@@ -827,8 +827,7 @@ fn rollback_dispatch_branch_composer() {
 // The scan macro in `ecosystem_dispatch` prints "Using <X> at: <path>" on
 // global crawls (`--global` / `--global-prefix`); it goes to stderr so it
 // can never reach a `--json` envelope or a VEX document on stdout. These
-// tests pin that stdout stays pure at the `vex` and `setup --check` call
-// sites. `--global-prefix` makes the check deterministic: the npm crawler returns
+// tests pin that stdout stays pure at the `vex` call site. `--global-prefix` makes the check deterministic: the npm crawler returns
 // the prefix verbatim as a node_modules root, so `paths` is never empty.
 // ---------------------------------------------------------------------------
 
@@ -850,7 +849,6 @@ fn run_scrubbed(cwd: &Path, args: &[&str]) -> (i32, String, String) {
         "SOCKET_VEX_NO_VERIFY",
         "SOCKET_VEX_DOC_ID",
         "SOCKET_VEX_COMPACT",
-        "SOCKET_SETUP_EXCLUDE",
     ] {
         cmd.env_remove(var);
     }
@@ -949,39 +947,6 @@ fn vex_doc_to_stdout_global_prefix_emits_no_chrome_on_stdout() {
     );
 }
 
-/// `setup --check --json` prints its JSON report to stdout after the patch
-/// consistency pass, which crawls via the dispatch. The chrome line must
-/// not precede (and corrupt) the report.
-#[test]
-fn setup_check_json_global_prefix_stdout_is_pure_json() {
-    let tmp = tempfile::tempdir().unwrap();
-    write_root_package_json(tmp.path());
-    write_manifest(tmp.path(), "pkg:npm/__dispatch_test__@1.0.0");
-    let gp = tmp.path().join("gprefix");
-    std::fs::create_dir_all(&gp).unwrap();
-
-    let (_code, stdout, stderr) = run_scrubbed(
-        tmp.path(),
-        &[
-            "setup",
-            "--check",
-            "--json",
-            "--global-prefix",
-            gp.to_str().unwrap(),
-        ],
-    );
-
-    let report: Value = serde_json::from_str(stdout.trim()).unwrap_or_else(|e| {
-        panic!(
-            "setup --check --json stdout must be exactly the JSON report — the \
-             dispatch's 'Using <X> at:' chrome must not leak onto stdout ({e}); \
-             stdout={stdout:?} stderr={stderr:?}"
-        )
-    });
-    assert!(report["status"].is_string(), "stdout={stdout:?}");
-    assert!(report["files"].is_array(), "stdout={stdout:?}");
-}
-
 #[test]
 fn rollback_dispatch_branch_nuget() {
     let tmp = tempfile::tempdir().unwrap();
diff --git a/crates/socket-patch-cli/tests/get_edge_cases_e2e.rs b/crates/socket-patch-cli/tests/get_edge_cases_e2e.rs
index 86b754a2..b1e54018 100644
--- a/crates/socket-patch-cli/tests/get_edge_cases_e2e.rs
+++ b/crates/socket-patch-cli/tests/get_edge_cases_e2e.rs
@@ -77,7 +77,7 @@ fn get_one_off_and_save_only_together_errors() {
             ORG_SLUG,
         ],
     );
-    assert_eq!(code, 1);
+    assert_eq!(code, 2, "a usage error (v5.0)");
     let v: serde_json::Value = serde_json::from_str(stdout.trim()).expect("valid JSON");
     assert_eq!(v["status"], "error");
     let err = v["error"].as_str().expect("error message");
diff --git a/crates/socket-patch-cli/tests/get_modes_e2e.rs b/crates/socket-patch-cli/tests/get_modes_e2e.rs
index c815575a..0390330d 100644
--- a/crates/socket-patch-cli/tests/get_modes_e2e.rs
+++ b/crates/socket-patch-cli/tests/get_modes_e2e.rs
@@ -462,7 +462,7 @@ async fn get_ghsa_all_uninstalled_emits_not_installed_envelope() {
 /// any network contact. Human mode names the conflict on stderr; `--json`
 /// mode emits get's `{status:"error", error:<string>}` envelope on stdout.
 #[tokio::test]
-async fn save_only_with_mode_conflicts_exit_one() {
+async fn save_only_with_mode_conflicts_exit_two() {
     // No mocks mounted: the zero-received-requests assertion below is the
     // "before any network contact" oracle.
     let server = MockServer::start().await;
@@ -475,7 +475,7 @@ async fn save_only_with_mode_conflicts_exit_one() {
             &server.uri(),
             &[UUID1, "--mode", mode, "--save-only"],
         );
-        assert_eq!(code, 1, "--save-only + --mode {mode} must exit 1");
+        assert_eq!(code, 2, "--save-only + --mode {mode} must exit 2 (usage)");
         assert!(
             stdout.is_empty(),
             "conflict error is stderr-only in human mode; stdout: {stdout:?}"
@@ -485,15 +485,15 @@ async fn save_only_with_mode_conflicts_exit_one() {
             "stderr must name the conflicting flags; got:\n{stderr}"
         );
 
-        // JSON path: ONE {status:"error"} envelope on stdout, exit 1.
+        // JSON path: ONE {status:"error"} envelope on stdout, exit 2.
         let (code, stdout, stderr) = run_get(
             tmp.path(),
             &server.uri(),
             &[UUID1, "--mode", mode, "--save-only", "--json"],
         );
         assert_eq!(
-            code, 1,
-            "--save-only + --mode {mode} --json must exit 1; stderr:\n{stderr}"
+            code, 2,
+            "--save-only + --mode {mode} --json must exit 2; stderr:\n{stderr}"
         );
         let v = parse_single_json_doc(&stdout);
         assert_eq!(v["status"], "error", "envelope={v}");
@@ -570,7 +570,7 @@ async fn get_hosted_silent_prints_nothing_to_stdout() {
     // Two files: the lock, plus the project `.npmrc` the npm 12
     // `allow-remote=all` auto-config creates.
     assert!(
-        loud_stdout.contains("Redirected 1 package; rewrote 2 files."),
+        loud_stdout.contains("Switched 1 package to hosted patches; rewrote 2 files."),
         "non-silent hosted run must print the redirect summary; got {loud_stdout:?}"
     );
 }
@@ -902,7 +902,7 @@ async fn get_pnp_only_narrowing_message_names_the_layout() {
          stdout:\n{stdout}"
     );
     assert!(
-        stderr.contains("yarn_pnp_unsupported"),
+        stderr.contains("Warning: this project uses yarn Plug'n'Play"),
         "the layout refusal warning must be on stderr; stderr:\n{stderr}"
     );
 }
diff --git a/crates/socket-patch-cli/tests/help_text_hygiene.rs b/crates/socket-patch-cli/tests/help_text_hygiene.rs
index 9b2be79a..9b3280e8 100644
--- a/crates/socket-patch-cli/tests/help_text_hygiene.rs
+++ b/crates/socket-patch-cli/tests/help_text_hygiene.rs
@@ -151,8 +151,10 @@ fn root_command_list_uses_the_verb_form() {
         "{text}"
     );
     assert!(!text.contains("Rollback patches"), "{text}");
+    // v5 removed `setup`; its install-hook summary must not come back.
+    assert!(!text.contains("install hooks"), "{text}");
     assert!(
-        text.contains("Agent mode: wire install hooks (npm, Python, Bundler, Composer)"),
+        !text.lines().any(|l| l.trim_start().starts_with("setup ")),
         "{text}"
     );
 }
@@ -167,21 +169,21 @@ fn root_command_list_leads_with_the_v5_workflow() {
         .filter_map(|l| l.split_whitespace().next())
         .filter(|w| {
             [
-                "scan", "vex", "vendor", "list", "get", "apply", "setup", "rollback", "remove",
-                "repair",
+                "scan", "vex", "vendor", "list", "get", "apply", "rollback", "remove", "repair",
             ]
             .contains(w)
         })
         .collect();
     assert_eq!(
-        &order[..10],
-        [
-            "scan", "vex", "vendor", "list", "get", "apply", "setup", "rollback", "remove",
-            "repair"
-        ],
+        &order[..9],
+        ["scan", "get", "list", "remove", "rollback", "vex", "vendor", "apply", "repair"],
         "{text}"
     );
-    assert!(text.contains("Typical workflow:"), "{text}");
+    assert!(
+        text.contains("Patch a project:") && text.contains("Agent mode ("),
+        "{text}"
+    );
+    assert!(!text.contains("older agent-mode"), "{text}");
 }
 
 #[test]
@@ -230,7 +232,37 @@ fn lock_timeout_help_names_get_and_scan() {
     let text = long_help(&["list"]);
     let flat = text.split_whitespace().collect::<Vec<_>>().join(" ");
     assert!(
-        flat.contains("`get` and `scan` when they record, apply, vendor or redirect patches"),
+        flat.contains("`get` and `scan` when they record, apply, vendor or host patches"),
         "{flat}"
     );
 }
+
+/// `-h` stays short (about eight options per page); `--help` still lists
+/// every option, and the deprecated `scan --apply`/`--vendor` spellings
+/// are in neither.
+#[test]
+fn short_help_lists_about_eight_options_and_long_help_lists_all() {
+    let mut cmd = socket_patch_cli::cli_command();
+    cmd.build();
+    for sub in cmd.get_subcommands_mut() {
+        if sub.is_hide_set() || sub.get_name() == "help" {
+            continue;
+        }
+        let name = sub.get_name().to_string();
+        let short = sub.render_help().to_string();
+        let long = sub.render_long_help().to_string();
+        // Options only: `-h`/`-V` are on every command.
+        let count = |t: &str| {
+            t.lines()
+                .map(str::trim_start)
+                .filter(|l| l.starts_with('-') && !l.starts_with("-h,") && !l.starts_with("-V,"))
+                .count()
+        };
+        assert!(count(&short) <= 9, "{name} -h lists {} options:\n{short}", count(&short));
+        assert!(count(&long) > count(&short), "{name} --help must list more than -h");
+        assert!(short.contains("--json") && short.contains("--cwd"), "{name}");
+    }
+    let scan = cmd.find_subcommand_mut("scan").expect("scan");
+    let long = scan.render_long_help().to_string();
+    assert!(!long.contains("--apply") && !long.contains("--vendor "), "{long}");
+}
diff --git a/crates/socket-patch-cli/tests/in_process_gem_config_warning.rs b/crates/socket-patch-cli/tests/in_process_gem_config_warning.rs
index d8bcc5ae..6e849f90 100644
--- a/crates/socket-patch-cli/tests/in_process_gem_config_warning.rs
+++ b/crates/socket-patch-cli/tests/in_process_gem_config_warning.rs
@@ -197,11 +197,11 @@ fn apply_stderr_warning_gates_on_silent() {
     let (code, _stdout, stderr) = run(tmp.path(), &["apply", "--offline", "--ecosystems", "gem"]);
     assert_eq!(code, 0, "loud apply exits 0.\nstderr:\n{stderr}");
     assert!(
-        stderr.contains(CODE),
+        stderr.contains("Warning: bundler app config BUNDLE_PATH"),
         "non-silent stderr must carry the {CODE} warning; got:\n{stderr}"
     );
     assert_eq!(
-        stderr.matches(CODE).count(),
+        stderr.matches("Warning: bundler app config BUNDLE_PATH").count(),
         1,
         "exactly ONE warning line (not one per discovery call); got:\n{stderr}"
     );
diff --git a/crates/socket-patch-cli/tests/in_process_get.rs b/crates/socket-patch-cli/tests/in_process_get.rs
index 5e6915e9..9035e57f 100644
--- a/crates/socket-patch-cli/tests/in_process_get.rs
+++ b/crates/socket-patch-cli/tests/in_process_get.rs
@@ -572,7 +572,7 @@ async fn get_one_off_with_save_only_errors() {
     args.save_only = true;
 
     let code = run(args).await;
-    assert_eq!(code, 1, "conflicting flags must exit 1");
+    assert_eq!(code, 2, "conflicting flags are a usage error (exit 2)");
     // The conflict is rejected up front, before any fetch — nothing saved.
     assert_no_manifest(tmp.path());
     assert_no_api_requests(&server).await;
@@ -600,7 +600,7 @@ async fn get_one_off_is_an_honest_not_implemented_error() {
     args.save_only = false;
 
     let code = run(args).await;
-    assert_eq!(code, 1, "--one-off must fail as not-yet-implemented");
+    assert_eq!(code, 2, "--one-off must fail as not-yet-implemented (usage, exit 2)");
     assert_no_manifest(tmp.path());
     assert_no_api_requests(&server).await;
 }
diff --git a/crates/socket-patch-cli/tests/in_process_get_modes.rs b/crates/socket-patch-cli/tests/in_process_get_modes.rs
index b5d70fef..83cd74c7 100644
--- a/crates/socket-patch-cli/tests/in_process_get_modes.rs
+++ b/crates/socket-patch-cli/tests/in_process_get_modes.rs
@@ -653,7 +653,7 @@ async fn mode_with_save_only_conflicts_exit_one_before_network() {
         args.mode = Some(mode);
         args.save_only = true;
         let code = socket_patch_cli::commands::get::run(args).await;
-        assert_eq!(code, 1, "--save-only + --mode {mode:?} must be rejected");
+        assert_eq!(code, 2, "--save-only + --mode {mode:?} must be rejected (usage, exit 2)");
     }
     assert!(
         server
diff --git a/crates/socket-patch-cli/tests/in_process_redirect.rs b/crates/socket-patch-cli/tests/in_process_redirect.rs
index ef2c0309..8b830088 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect.rs
@@ -15,7 +15,7 @@ use serial_test::serial;
 use socket_patch_cli::commands::scan::{run, ScanArgs};
 use socket_patch_core::hash::git_sha256::compute_git_sha256_from_bytes;
 use socket_patch_core::manifest::schema::{
-    PatchFileInfo, PatchManifest, PatchRecord, SetupConfig, VulnerabilityInfo,
+    PatchFileInfo, PatchManifest, PatchRecord, VulnerabilityInfo,
 };
 use wiremock::matchers::{method, path, path_regex};
 use wiremock::{Mock, MockServer, ResponseTemplate};
@@ -446,12 +446,7 @@ async fn redirect_vex_verifies_manifest_patches_normally() {
             "GHSA-ctrl-bad",
         ),
     );
-    // npm declared `manual` so property-7 admits the controls — what drops
-    // GHSA-ctrl-bad must be VERIFICATION, not the ecosystem filter.
-    manifest.setup = Some(SetupConfig {
-        exclude: Vec::new(),
-        manual: vec!["npm".to_string()],
-    });
+    // What drops GHSA-ctrl-bad must be VERIFICATION.
     let socket_dir = tmp.path().join(".socket");
     std::fs::create_dir_all(&socket_dir).unwrap();
     std::fs::write(
@@ -2112,12 +2107,12 @@ async fn redirect_human_mode_prints_rewriter_warnings() {
         "a no-op redirect still exits 0; stdout=\n{stdout}\nstderr=\n{stderr}"
     );
     assert!(
-        stdout.contains("Redirected 0 packages; rewrote 0 files."),
+        stdout.contains("Switched 0 packages to hosted patches; rewrote 0 files."),
         "anchor: the run must have taken the human-mode redirect branch; \
          stdout=\n{stdout}"
     );
     assert!(
-        stderr.contains("Warning (redirect_npm_no_lockfile): No package-lock.json"),
+        stderr.contains("Warning: No package-lock.json"),
         "human mode must print the rewriter's no-lockfile warning (JSON mode \
          already carries it); stderr=\n{stderr}"
     );
@@ -2197,13 +2192,13 @@ async fn redirect_human_mode_warnings_are_not_json_quoted() {
     let stdout = String::from_utf8_lossy(&out.stdout);
     let stderr = String::from_utf8_lossy(&out.stderr);
     assert!(
-        stdout.contains("Redirected 1 package; rewrote"),
+        stdout.contains("Switched 1 package to hosted patches; rewrote"),
         "anchor: the dep must have been redirected so the record fetch runs; \
          stdout=\n{stdout}\nstderr=\n{stderr}"
     );
     assert!(
         stderr.contains(&format!(
-            "Warning (record_fetch_failed): {PURL} redirected, but its patch record could not \
+            "Warning: {PURL} was switched to hosted, but its patch record could not \
              be fetched"
         )),
         "the record-fetch warning must print the bare detail string, not a \
diff --git a/crates/socket-patch-cli/tests/in_process_redirect_poetry.rs b/crates/socket-patch-cli/tests/in_process_redirect_poetry.rs
index 9ba3c5a9..ef67e70a 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect_poetry.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect_poetry.rs
@@ -479,7 +479,10 @@ async fn stale_python_install_warns_and_cannot_attest_even_on_rescan() {
         let out = scan_output(tmp.path(), &server, &[]).await;
         let stderr = String::from_utf8_lossy(&out.stderr);
         assert!(out.status.success(), "{stderr}");
-        assert!(stderr.contains("record_fetch_failed"), "{stderr}");
+        assert!(
+            stderr.contains("was switched to hosted, but its patch record could not be fetched"),
+            "{stderr}"
+        );
         assert_eq!(
             std::fs::read(installed).unwrap(),
             bytes,
diff --git a/crates/socket-patch-cli/tests/in_process_scan.rs b/crates/socket-patch-cli/tests/in_process_scan.rs
index 859bb611..bfc0d72c 100644
--- a/crates/socket-patch-cli/tests/in_process_scan.rs
+++ b/crates/socket-patch-cli/tests/in_process_scan.rs
@@ -1485,8 +1485,7 @@ async fn scan_vendor_dry_run_with_vex_does_not_write_attestation_file() {
     write_npm_package(tmp.path(), "in-proc-scan", "1.0.0");
 
     // A manifest whose sole record WOULD attest successfully: vulnerability
-    // metadata for the statement, `setup.manual: ["npm"]` to pass the
-    // property-7 ecosystem filter, and `--vex-no-verify` below to skip the
+    // metadata for the statement and `--vex-no-verify` below to skip the
     // on-disk hash check, so only the dry-run gate keeps the document off
     // disk.
     let socket = tmp.path().join(".socket");
@@ -1504,7 +1503,7 @@ async fn scan_vendor_dry_run_with_vex_does_not_write_attestation_file() {
                 }},
                 "description": "x", "license": "MIT", "tier": "free"
             }
-        }, "setup": { "manual": ["npm"] } }"#,
+        } }"#,
     )
     .unwrap();
     let before = std::fs::read_to_string(socket.join("manifest.json")).unwrap();
@@ -1581,7 +1580,7 @@ async fn scan_apply_json_dry_run_with_vex_does_not_write_attestation() {
     write_npm_package(tmp.path(), "in-proc-scan", "1.0.0");
 
     // Attestable manifest (same fixture as the vendor twin above): metadata
-    // for the statement, `setup.manual: ["npm"]`, `--vex-no-verify` below.
+    // for the statement, `--vex-no-verify` below.
     let socket = tmp.path().join(".socket");
     std::fs::create_dir_all(&socket).unwrap();
     std::fs::write(
@@ -1597,7 +1596,7 @@ async fn scan_apply_json_dry_run_with_vex_does_not_write_attestation() {
                 }},
                 "description": "x", "license": "MIT", "tier": "free"
             }
-        }, "setup": { "manual": ["npm"] } }"#,
+        } }"#,
     )
     .unwrap();
 
diff --git a/crates/socket-patch-cli/tests/interactive_prompts_e2e.rs b/crates/socket-patch-cli/tests/interactive_prompts_e2e.rs
index ce1fae11..25da2f43 100644
--- a/crates/socket-patch-cli/tests/interactive_prompts_e2e.rs
+++ b/crates/socket-patch-cli/tests/interactive_prompts_e2e.rs
@@ -1,8 +1,7 @@
-//! End-to-end tests that drive interactive prompts (`ui::confirm`,
-//! `ui::confirm_or_proceed`) via a pseudo-terminal. These exercise the
-//! stdin-is-a-terminal-gated confirmation paths in `setup` and `remove`
-//! (plus `apply`'s no-manifest message) that subprocess-with-piped-stdin
-//! tests can't reach.
+//! End-to-end tests that drive interactive prompts (`ui::confirm`) via a
+//! pseudo-terminal. These exercise the stdin-is-a-terminal-gated
+//! confirmation paths in `remove` (plus `apply`'s no-manifest message)
+//! that subprocess-with-piped-stdin tests can't reach.
 //!
 //! PTY support: macOS + Linux. Skipped on Windows.
 
@@ -149,163 +148,6 @@ fn run_in_pty_bytes(args: &[&str], cwd: &Path, input: &[u8], timeout: Duration)
     (code, String::from_utf8_lossy(&output).to_string())
 }
 
-// ---------------------------------------------------------------------------
-// `setup` interactive confirmation
-// ---------------------------------------------------------------------------
-
-#[test]
-fn setup_interactive_y_proceeds_with_update() {
-    let tmp = tempfile::tempdir().unwrap();
-    std::fs::write(
-        tmp.path().join("package.json"),
-        r#"{ "name": "p", "version": "1.0.0" }"#,
-    )
-    .unwrap();
-
-    // Without --yes, setup prompts "Proceed with these changes? [y/N] ".
-    // Sending "y\n" should make it proceed with the update.
-    let (code, output) = run_in_pty(&["setup"], tmp.path(), "y\n", Duration::from_secs(15));
-    assert_eq!(code, 0, "setup with 'y' must succeed");
-
-    // The interactive prompt MUST have actually run — otherwise this test
-    // would pass against a regression that drops the TTY gate and
-    // auto-proceeds, never exercising the path this file is named for.
-    assert!(
-        output.contains("Proceed with these changes?"),
-        "setup must have shown the interactive confirm prompt; got: {output}"
-    );
-    // A regression that took the non-interactive auto-proceed branch would
-    // print this banner instead of prompting; it must NOT appear.
-    assert!(
-        !output.contains("Non-interactive mode detected"),
-        "setup must NOT have taken the non-interactive branch in a PTY; got: {output}"
-    );
-
-    // package.json should have been updated with a real postinstall hook
-    // that invokes socket-patch (not merely mention the string somewhere).
-    let pkg = std::fs::read_to_string(tmp.path().join("package.json")).unwrap();
-    let parsed: serde_json::Value = serde_json::from_str(&pkg)
-        .unwrap_or_else(|e| panic!("setup must leave valid JSON; err={e}; got: {pkg}"));
-    let postinstall = parsed["scripts"]["postinstall"]
-        .as_str()
-        .unwrap_or_else(|| panic!("setup must write scripts.postinstall; got: {pkg}"));
-    assert!(
-        postinstall.contains("socket-patch"),
-        "postinstall must invoke socket-patch; got: {postinstall}"
-    );
-}
-
-#[test]
-fn setup_interactive_n_aborts_without_update() {
-    let tmp = tempfile::tempdir().unwrap();
-    let original = r#"{ "name": "p", "version": "1.0.0" }
-"#;
-    std::fs::write(tmp.path().join("package.json"), original).unwrap();
-
-    let (code, output) = run_in_pty(&["setup"], tmp.path(), "n\n", Duration::from_secs(15));
-    assert_eq!(code, 0, "setup with 'n' must exit cleanly");
-    // The interactive prompt MUST have run, then aborted.
-    assert!(
-        output.contains("Proceed with these changes?"),
-        "setup must have shown the interactive confirm prompt; got: {output}"
-    );
-    assert!(
-        !output.contains("Non-interactive mode detected"),
-        "setup must NOT have taken the non-interactive branch in a PTY; got: {output}"
-    );
-    assert!(
-        output.contains("Setup cancelled."),
-        "setup must print abort message; got: {output}"
-    );
-    // It must NOT have started applying changes.
-    assert!(
-        !output.contains("Applying changes..."),
-        "setup 'n' must abort before applying; got: {output}"
-    );
-
-    // package.json must be unchanged.
-    let pkg = std::fs::read_to_string(tmp.path().join("package.json")).unwrap();
-    assert_eq!(pkg, original, "setup 'n' must not modify package.json");
-}
-
-#[test]
-fn setup_interactive_default_no_aborts() {
-    // Pressing just Enter at the prompt defaults to N (abort).
-    let tmp = tempfile::tempdir().unwrap();
-    let original = r#"{ "name": "p", "version": "1.0.0" }
-"#;
-    std::fs::write(tmp.path().join("package.json"), original).unwrap();
-
-    let (code, output) = run_in_pty(&["setup"], tmp.path(), "\n", Duration::from_secs(15));
-    assert_eq!(code, 0);
-    // The prompt MUST have run; bare Enter must hit the default-N abort.
-    // Without these, the test passes vacuously if setup never prompts and
-    // simply no-ops, never proving the default is "No".
-    assert!(
-        output.contains("Proceed with these changes?"),
-        "setup must have shown the interactive confirm prompt; got: {output}"
-    );
-    assert!(
-        !output.contains("Non-interactive mode detected"),
-        "setup must NOT have taken the non-interactive branch in a PTY; got: {output}"
-    );
-    assert!(
-        output.contains("Setup cancelled."),
-        "bare-Enter must default to N and print abort; got: {output}"
-    );
-    assert!(
-        !output.contains("Applying changes..."),
-        "default-N must abort before applying; got: {output}"
-    );
-    let pkg = std::fs::read_to_string(tmp.path().join("package.json")).unwrap();
-    assert_eq!(pkg, original, "default-N must not modify package.json");
-}
-
-#[test]
-fn setup_interactive_non_utf8_answer_aborts_without_panic() {
-    // Same regression class as remove_interactive_non_utf8_answer_
-    // declines_without_panic below, but for setup's default-no gate
-    // (`ui::confirm_or_proceed`): a Latin-1 paste (`é` = 0xE9) at
-    // "Proceed with these changes? [y/N] " makes `read_line` return
-    // InvalidData, and unwrapping it panics the CLI (exit 101) instead
-    // of treating the unreadable answer as "not yes" (abort).
-    let tmp = tempfile::tempdir().unwrap();
-    let original = r#"{ "name": "p", "version": "1.0.0" }
-"#;
-    std::fs::write(tmp.path().join("package.json"), original).unwrap();
-
-    let (code, output) =
-        run_in_pty_bytes(&["setup"], tmp.path(), b"\xE9\n", Duration::from_secs(15));
-    assert!(
-        !output.contains("panicked"),
-        "non-UTF-8 answer must not panic the CLI; got: {output}"
-    );
-    assert_eq!(
-        code, 0,
-        "non-UTF-8 answer must abort cleanly, not crash; got: {output}"
-    );
-    // The interactive prompt MUST have run (vacuity guard as above), and
-    // the unreadable answer must land on the default-N abort path.
-    assert!(
-        output.contains("Proceed with these changes?"),
-        "setup must have shown the interactive confirm prompt; got: {output}"
-    );
-    assert!(
-        !output.contains("Non-interactive mode detected"),
-        "setup must NOT have taken the non-interactive branch in a PTY; got: {output}"
-    );
-    assert!(
-        output.contains("Setup cancelled."),
-        "non-UTF-8 answer must be treated as 'no' and abort; got: {output}"
-    );
-    assert!(
-        !output.contains("Applying changes..."),
-        "non-UTF-8 answer must abort before applying; got: {output}"
-    );
-    let pkg = std::fs::read_to_string(tmp.path().join("package.json")).unwrap();
-    assert_eq!(pkg, original, "aborted setup must not modify package.json");
-}
-
 // ---------------------------------------------------------------------------
 // `remove` interactive confirmation
 // ---------------------------------------------------------------------------
@@ -407,7 +249,7 @@ fn remove_interactive_n_cancels() {
         "remove must NOT have taken the non-interactive branch in a PTY; got: {output}"
     );
     assert!(
-        output.contains("Removal cancelled"),
+        output.contains("Cancelled; no changes made."),
         "remove 'n' must report cancellation; got: {output}"
     );
     assert!(
@@ -473,7 +315,7 @@ fn remove_interactive_non_utf8_answer_declines_without_panic() {
         "remove must NOT have taken the non-interactive branch in a PTY; got: {output}"
     );
     assert!(
-        output.contains("Removal cancelled"),
+        output.contains("Cancelled; no changes made."),
         "non-UTF-8 answer must be treated as 'no'; got: {output}"
     );
     // Declined: the manifest entry must be intact.
@@ -548,7 +390,7 @@ fn remove_detached_interactive_n_cancel_message_respects_silent() {
         "remove must NOT have taken the non-interactive branch in a PTY; got: {output}"
     );
     assert!(
-        !output.contains("Removal cancelled"),
+        !output.contains("Cancelled; no changes made."),
         "--silent must suppress the cancellation chatter; got: {output}"
     );
     // Declined: the detached ledger entry must be intact.
@@ -573,7 +415,7 @@ fn remove_detached_interactive_n_cancel_message_respects_silent() {
         "declined detached remove must exit cleanly; got: {loud_output}"
     );
     assert!(
-        loud_output.contains("Removal cancelled"),
+        loud_output.contains("Cancelled; no changes made."),
         "non-silent declined detached remove must report cancellation; got: {loud_output}"
     );
     assert!(
diff --git a/crates/socket-patch-cli/tests/output_modes_e2e.rs b/crates/socket-patch-cli/tests/output_modes_e2e.rs
index 4d5bba66..aab9ef8b 100644
--- a/crates/socket-patch-cli/tests/output_modes_e2e.rs
+++ b/crates/socket-patch-cli/tests/output_modes_e2e.rs
@@ -267,19 +267,19 @@ fn list_empty_manifest_non_json() {
     let (code, stdout, _stderr) = common::run_with_env(tmp.path(), &["list"], &[]);
     assert_eq!(code, 0);
     assert!(
-        stdout.contains("No patches found"),
+        stdout.contains("No patches in this project."),
         "empty manifest non-JSON message; got: {stdout}"
     );
 }
 
 #[test]
-fn list_no_manifest_non_json_prints_error_to_stderr() {
+fn list_no_manifest_non_json_prints_the_empty_project_line() {
     let tmp = tempfile::tempdir().unwrap();
-    let (code, _stdout, stderr) = common::run_with_env(tmp.path(), &["list"], &[]);
-    assert_eq!(code, 1);
+    let (code, stdout, stderr) = common::run_with_env(tmp.path(), &["list"], &[]);
+    assert_eq!(code, 0, "an empty project is a successful empty list");
     assert!(
-        stderr.contains("Manifest not found") || stderr.contains("not found"),
-        "non-JSON list-without-manifest must print to stderr; got: {stderr}"
+        stdout.contains("No patches in this project. Run `socket-patch scan`."),
+        "non-JSON list-without-manifest names the next step; got: {stdout} / {stderr}"
     );
 }
 
@@ -647,49 +647,6 @@ fn get_with_explicit_package_flag_works() {
     assert_eq!(v["found"], 0, "got: {stdout}");
 }
 
-// ---------------------------------------------------------------------------
-// setup — non-JSON paths
-// ---------------------------------------------------------------------------
-
-#[test]
-fn setup_no_files_non_json_prints_friendly_message() {
-    let tmp = tempfile::tempdir().unwrap();
-    let (code, stdout, _stderr) = common::run_with_env(tmp.path(), &["setup"], &[]);
-    assert_eq!(code, 0);
-    assert!(
-        stdout.contains("No package.json"),
-        "non-JSON setup must report missing package.json; got: {stdout}"
-    );
-}
-
-#[test]
-fn setup_dry_run_non_json_prints_preview() {
-    let tmp = tempfile::tempdir().unwrap();
-    std::fs::write(
-        tmp.path().join("package.json"),
-        r#"{ "name": "p", "version": "1.0.0" }"#,
-    )
-    .unwrap();
-    let before = std::fs::read_to_string(tmp.path().join("package.json")).unwrap();
-    let (code, stdout, _stderr) =
-        common::run_with_env(tmp.path(), &["setup", "--dry-run", "--yes"], &[]);
-    assert_eq!(code, 0);
-    assert!(
-        stdout.contains("would be updated") && stdout.contains("postinstall"),
-        "non-JSON setup dry-run should preview the postinstall hook; got: {stdout}"
-    );
-    // Dry-run must NOT actually write the postinstall hook into the file.
-    let after = std::fs::read_to_string(tmp.path().join("package.json")).unwrap();
-    assert_eq!(
-        before, after,
-        "setup --dry-run must leave package.json untouched"
-    );
-    assert!(
-        !after.contains("postinstall"),
-        "setup --dry-run must not write a postinstall hook; got: {after}"
-    );
-}
-
 // ---------------------------------------------------------------------------
 // Bare-UUID fallback — `socket-patch <UUID>` rewrites to `get <UUID>`
 // ---------------------------------------------------------------------------
@@ -737,7 +694,7 @@ fn bare_uuid_fallback_treats_uuid_as_get_identifier() {
 fn each_subcommand_help_prints_usage() {
     let tmp = tempfile::tempdir().unwrap();
     let subcommands = [
-        "apply", "rollback", "get", "scan", "list", "remove", "setup", "repair", "gc",
+        "apply", "rollback", "get", "scan", "list", "remove", "repair", "gc",
     ];
     for sub in subcommands {
         let (code, stdout, _stderr) = common::run_with_env(tmp.path(), &[sub, "--help"], &[]);
@@ -755,7 +712,7 @@ fn top_level_help_prints_all_subcommands() {
     let (code, stdout, _stderr) = common::run_with_env(tmp.path(), &["--help"], &[]);
     assert_eq!(code, 0);
     for sub in [
-        "apply", "rollback", "get", "scan", "list", "remove", "setup", "repair",
+        "apply", "rollback", "get", "scan", "list", "remove", "repair",
     ] {
         assert!(
             stdout.contains(sub),
diff --git a/crates/socket-patch-cli/tests/redirect_npm_allow_remote.rs b/crates/socket-patch-cli/tests/redirect_npm_allow_remote.rs
index f8b7cfad..1c38ab3b 100644
--- a/crates/socket-patch-cli/tests/redirect_npm_allow_remote.rs
+++ b/crates/socket-patch-cli/tests/redirect_npm_allow_remote.rs
@@ -341,13 +341,21 @@ async fn package_lock_redirect_writes_npmrc_warns_and_rollback_removes_it() {
     );
     assert_no_ledger(tmp.path());
 
-    // Human output: the `Warning (<code>): …` line on stderr; --silent mutes it.
+    // Human output: one line by default, the full text under --verbose;
+    // --silent mutes it.
     let (code, _, stderr) = scan_hosted(tmp.path(), &server.uri(), &[]);
     assert_eq!(code, 0, "{stderr}");
     assert!(
-        stderr.contains(&format!("Warning ({CODE}): ")) && stderr.contains("EALLOWREMOTE"),
+        stderr.contains("Note: .npmrc already sets `allow-remote=all`")
+            && !stderr.contains("EALLOWREMOTE"),
         "human stderr: {stderr}"
     );
+    let (code, _, stderr) = scan_hosted(tmp.path(), &server.uri(), &["--verbose"]);
+    assert_eq!(code, 0, "{stderr}");
+    assert!(
+        stderr.contains("Warning: ") && stderr.contains("EALLOWREMOTE"),
+        "verbose human stderr: {stderr}"
+    );
     let (code, _, stderr) = scan_hosted(tmp.path(), &server.uri(), &["--silent"]);
     assert_eq!(code, 0, "{stderr}");
     assert!(!stderr.contains(CODE), "--silent is errors only: {stderr}");
@@ -744,7 +752,7 @@ async fn outer_npm_config_layers_are_respected() {
     let (code, _, stderr) = scan_hosted_env(
         tmp.path(),
         &server.uri(),
-        &[],
+        &["--verbose"],
         &[("npm_config_allow_remote", "none")],
     );
     assert_eq!(code, 0, "{stderr}");
@@ -753,7 +761,7 @@ async fn outer_npm_config_layers_are_respected() {
     // `NPM_CONFIG_ALLOW_REMOTE` makes the child see that spelling there, so
     // match the name case-insensitively.
     assert!(
-        stderr.contains(&format!("Warning ({CODE}): "))
+        stderr.contains("Warning: ")
             && stderr
                 .to_ascii_lowercase()
                 .contains("npm_config_allow_remote=none")
@@ -823,11 +831,11 @@ async fn remove_surfaces_the_npmrc_modified_warning() {
                 "{doc:#}"
             );
             assert!(
-                !stderr.contains("Warning ("),
+                !stderr.contains("Warning:"),
                 "--json keeps stderr quiet: {stderr}"
             );
         } else {
-            assert!(stderr.contains(&format!("Warning ({LEFT}): ")), "{stderr}");
+            assert!(stderr.contains("Warning: "), "{stderr}");
         }
         assert_eq!(
             std::fs::read_to_string(tmp.path().join(".npmrc")).unwrap(),
diff --git a/crates/socket-patch-cli/tests/repair_invariants.rs b/crates/socket-patch-cli/tests/repair_invariants.rs
index b92a0bbb..9467b068 100644
--- a/crates/socket-patch-cli/tests/repair_invariants.rs
+++ b/crates/socket-patch-cli/tests/repair_invariants.rs
@@ -251,7 +251,7 @@ fn repair_redirect_only_project_human_mode_prints_note() {
     assert_eq!(out.status.code(), Some(0));
     let stdout = String::from_utf8_lossy(&out.stdout);
     assert!(
-        stdout.contains("Hosted redirects need no local repair"),
+        stdout.contains("Hosted patches need no local repair"),
         "human mode must print the informational note; got stdout=\n{stdout}"
     );
 }
diff --git a/crates/socket-patch-cli/tests/rollback_invariants.rs b/crates/socket-patch-cli/tests/rollback_invariants.rs
index 1cba3538..a447e068 100644
--- a/crates/socket-patch-cli/tests/rollback_invariants.rs
+++ b/crates/socket-patch-cli/tests/rollback_invariants.rs
@@ -134,8 +134,8 @@ fn rollback_one_off_without_identifier_errors() {
     let tmp = tempfile::tempdir().expect("tempdir");
     let (code, stdout) = run(tmp.path(), &["--json", "--one-off"]);
     assert_eq!(
-        code, 1,
-        "--one-off w/o identifier must exit 1; stdout=\n{stdout}"
+        code, 2,
+        "--one-off w/o identifier is a usage error (exit 2); stdout=\n{stdout}"
     );
     let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
     assert_eq!(v["status"], "error");
@@ -160,7 +160,7 @@ fn rollback_one_off_with_identifier_reports_not_implemented() {
             "33333333-3333-4333-8333-333333333333",
         ],
     );
-    assert_eq!(code, 1, "one-off mode must exit 1 today; stdout=\n{stdout}");
+    assert_eq!(code, 2, "one-off mode is a usage error (exit 2); stdout=\n{stdout}");
     let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
     assert_eq!(v["status"], "error");
     let err = v["error"].as_str().expect("error message string");
@@ -187,8 +187,9 @@ fn truthy_one_off_env_var_sets_flag() {
         .expect("run socket-patch");
     assert_eq!(
         out.status.code(),
-        Some(1),
-        "SOCKET_ONE_OFF=1 must parse, not abort with a usage error; stderr=\n{}",
+        Some(2),
+        "SOCKET_ONE_OFF=1 must parse and reach the one-off stub (its JSON envelope \
+         below proves it was not a clap error); stderr=\n{}",
         String::from_utf8_lossy(&out.stderr)
     );
     let stdout = String::from_utf8_lossy(&out.stdout);
@@ -244,7 +245,7 @@ fn rollback_one_off_human_reports_not_implemented_error() {
         .args(["--one-off", "33333333-3333-4333-8333-333333333333"])
         .output()
         .expect("run socket-patch");
-    assert_eq!(out.status.code(), Some(1), "one-off mode must exit 1 today");
+    assert_eq!(out.status.code(), Some(2), "one-off mode is a usage error (exit 2)");
     let stderr = String::from_utf8_lossy(&out.stderr);
     assert!(
         stderr.contains("not yet implemented"),
diff --git a/crates/socket-patch-cli/tests/scan_invariants.rs b/crates/socket-patch-cli/tests/scan_invariants.rs
index ad5978b1..25616c2a 100644
--- a/crates/socket-patch-cli/tests/scan_invariants.rs
+++ b/crates/socket-patch-cli/tests/scan_invariants.rs
@@ -1478,7 +1478,7 @@ async fn scan_agent_over_vendored_purl_surfaces_run_level_warning() {
     );
     // Mirrored to stderr (not silent).
     assert!(
-        stderr.contains("vendored_ownership_retained"),
+        stderr.contains("Warning: ") && stderr.contains("vendor --revert"),
         "warning must be mirrored to stderr when not silent: {stderr}"
     );
 }
@@ -1595,7 +1595,7 @@ async fn scan_agent_over_live_hosted_wiring_surfaces_run_level_warning() {
         "v5 hosted state is the lockfile pin, not a ledger: {detail}"
     );
     assert!(
-        stderr.contains("hosted_wiring_retained"),
+        stderr.contains("Warning: agent-mode scan left the hosted wiring live"),
         "warning must be mirrored to stderr when not silent: {stderr}"
     );
 }
diff --git a/crates/socket-patch-cli/tests/scan_ordered_concurrency_e2e.rs b/crates/socket-patch-cli/tests/scan_ordered_concurrency_e2e.rs
index e57a7fef..8595a128 100644
--- a/crates/socket-patch-cli/tests/scan_ordered_concurrency_e2e.rs
+++ b/crates/socket-patch-cli/tests/scan_ordered_concurrency_e2e.rs
@@ -890,9 +890,9 @@ async fn hosted_record_fetch_failures_keep_order_and_lock_bytes() {
         assert_eq!(
             *warning,
             format!(
-                "{} redirected, but its patch record could not be fetched; this run's VEX \
-                 attestation omits it (`socket-patch vex` fetches it again once the API \
-                 answers)",
+                "{} was switched to hosted, but its patch record could not be fetched; this \
+                 run's VEX attestation omits it (`socket-patch vex` fetches it again once the \
+                 API answers)",
                 purl(NAMES[idx])
             )
         );
diff --git a/crates/socket-patch-cli/tests/scan_vendor_e2e.rs b/crates/socket-patch-cli/tests/scan_vendor_e2e.rs
index 2926892d..486b9657 100644
--- a/crates/socket-patch-cli/tests/scan_vendor_e2e.rs
+++ b/crates/socket-patch-cli/tests/scan_vendor_e2e.rs
@@ -1222,7 +1222,7 @@ async fn scan_vendor_annotates_mismatched_baseline_and_vendors_anyway() {
         "the annotation names the purl; stdout={stdout}"
     );
     assert!(
-        stderr.contains("vendor_content_mismatch_overwritten"),
+        stderr.contains("vendored the patched content anyway"),
         "overwrite warning surfaced; stderr={stderr}"
     );
     // Vendored despite the mismatch.
diff --git a/crates/socket-patch-cli/tests/setup_contract_gaps.rs b/crates/socket-patch-cli/tests/setup_contract_gaps.rs
deleted file mode 100644
index c314af77..00000000
--- a/crates/socket-patch-cli/tests/setup_contract_gaps.rs
+++ /dev/null
@@ -1,843 +0,0 @@
-//! **Executable spec for the once-unimplemented parts of the `setup` contract.**
-//!
-//! Every test in this file encodes a property from the "Setup command contract"
-//! section of `crates/socket-patch-cli/CLI_CONTRACT.md` that the binary did not
-//! originally satisfy. They began life intentionally RED (executable
-//! documentation of the open gaps); every property here has since SHIPPED —
-//! see the per-section comments — so today these are ordinary, active
-//! regression guards. A failure now IS a regression. Do not "fix" one by
-//! weakening the assertions.
-//!
-//! Each test names the property it guards.
-
-use sha2::{Digest, Sha256};
-use std::path::{Path, PathBuf};
-use std::process::Command;
-
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
-/// Run the binary with every ambient `SOCKET_*` var scrubbed (prefix scrub —
-/// a fixed list rots as flags grow: ambient `SOCKET_GLOBAL=true` alone sent
-/// the patch-consistency crawl to the global prefix, hiding the drifted
-/// package and turning the prop-4 test green-for-the-wrong-reason; ambient
-/// `SOCKET_ECOSYSTEMS` would likewise defeat the prop-2 scoping test),
-/// telemetry off, and HOME pointed at `home`. Returns (exit code, stdout).
-fn run(cwd: &Path, home: &Path, args: &[&str]) -> (i32, String) {
-    let mut cmd = Command::new(binary());
-    cmd.args(args).current_dir(cwd);
-    for (name, _) in std::env::vars() {
-        if name.starts_with("SOCKET_") && name != "SOCKET_NO_CONFIG" {
-            cmd.env_remove(name);
-        }
-    }
-    cmd.env("HOME", home);
-    cmd.env("SOCKET_TELEMETRY_DISABLED", "1");
-    let out = cmd.output().expect("run socket-patch");
-    (
-        out.status.code().unwrap_or(-1),
-        String::from_utf8_lossy(&out.stdout).to_string(),
-    )
-}
-
-fn write(path: &Path, content: &str) {
-    if let Some(parent) = path.parent() {
-        std::fs::create_dir_all(parent).expect("create parent");
-    }
-    std::fs::write(path, content).expect("write file");
-}
-
-/// git-style blob SHA-256 (matches the manifest's beforeHash/afterHash scheme).
-fn git_sha256(content: &[u8]) -> String {
-    let header = format!("blob {}\0", content.len());
-    let mut hasher = Sha256::new();
-    hasher.update(header.as_bytes());
-    hasher.update(content);
-    hex::encode(hasher.finalize())
-}
-
-// ===========================================================================
-// Property 2 — ecosystem-scoped. `setup --ecosystems npm` must act on ONLY the
-// npm manifest, leaving the python (and cargo) manifests untouched.
-//
-// SHIPPED: `setup` now honors `--ecosystems` via the `eco_in_scope` gating in
-// commands/setup.rs (discover / plan_python / build_*_outcome / append_*_check).
-// This pin is now an active (non-ignored) regression guard.
-// ===========================================================================
-
-#[test]
-fn setup_ecosystems_filter_scopes_work_to_named_ecosystem() {
-    let proj = tempfile::tempdir().unwrap();
-    let home = tempfile::tempdir().unwrap();
-    write(
-        &proj.path().join("package.json"),
-        r#"{ "name": "x", "version": "1.0.0" }"#,
-    );
-    let original_requirements = "requests==2.31.0\n";
-    write(&proj.path().join("requirements.txt"), original_requirements);
-
-    let (code, stdout) = run(
-        proj.path(),
-        home.path(),
-        &["setup", "--json", "--yes", "--ecosystems", "npm"],
-    );
-    assert_eq!(
-        code, 0,
-        "scoped setup should still succeed; stdout=\n{stdout}"
-    );
-
-    // The npm side IS in scope and must be configured (proves the run happened).
-    assert!(
-        std::fs::read_to_string(proj.path().join("package.json"))
-            .unwrap()
-            .contains("socket-patch"),
-        "the in-scope npm manifest must be configured"
-    );
-
-    // The python manifest is OUT of scope and must be left byte-for-byte.
-    let req = std::fs::read_to_string(proj.path().join("requirements.txt")).unwrap();
-    assert_eq!(
-        req, original_requirements,
-        "`--ecosystems npm` must NOT touch the python manifest (property 2); got:\n{req}"
-    );
-}
-
-// ===========================================================================
-// Property 4 — `check` proves a correctly-patched state. With the install hook
-// present but a manifest patch NOT applied on disk (file hash != afterHash),
-// `setup --check` must report needs-configuration / exit non-zero.
-//
-// SHIPPED: `run_check` now also verifies on-disk patch consistency via
-// `append_patch_consistency_entries` (reads `.socket/manifest.json`, resolves
-// installed package paths, and runs the `applied_patches` afterHash check), so a
-// hooked-but-unpatched repo reports `needs_configuration` / exit 1. This pin is
-// now an active (non-ignored) regression guard.
-// ===========================================================================
-
-#[test]
-fn setup_check_detects_unapplied_manifest_patch() {
-    let proj = tempfile::tempdir().unwrap();
-    let home = tempfile::tempdir().unwrap();
-
-    // Wire the npm install hook (so hook-presence alone would say "configured").
-    write(
-        &proj.path().join("package.json"),
-        r#"{ "name": "x", "version": "1.0.0" }"#,
-    );
-    let (c, _) = run(proj.path(), home.path(), &["setup", "--json", "--yes"]);
-    assert_eq!(c, 0, "precondition: initial setup wires the hook");
-
-    // An installed npm package whose on-disk file does NOT match the manifest's
-    // afterHash — i.e. the patch is present in the manifest but not applied.
-    let original = b"original\n";
-    let patched = b"patched\n";
-    let on_disk = b"DRIFTED-not-the-patched-content\n";
-    let pkg = proj.path().join("node_modules/badpkg");
-    write(
-        &pkg.join("package.json"),
-        r#"{ "name": "badpkg", "version": "1.0.0" }"#,
-    );
-    write(&pkg.join("index.js"), &String::from_utf8_lossy(on_disk));
-
-    write(
-        &proj.path().join(".socket/manifest.json"),
-        &format!(
-            r#"{{ "patches": {{
-  "pkg:npm/badpkg@1.0.0": {{
-    "uuid": "11111111-1111-4111-8111-111111111111",
-    "exportedAt": "2024-01-01T00:00:00Z",
-    "files": {{ "package/index.js": {{ "beforeHash": "{before}", "afterHash": "{after}" }} }},
-    "vulnerabilities": {{ "GHSA-aaaa-bbbb-cccc": {{ "cves": ["CVE-2024-0001"], "summary": "x", "severity": "high", "description": "d" }} }},
-    "description": "d", "license": "MIT", "tier": "free"
-  }}
-}} }}"#,
-            before = git_sha256(original),
-            after = git_sha256(patched),
-        ),
-    );
-
-    let (code, stdout) = run(proj.path(), home.path(), &["setup", "--check", "--json"]);
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    // A repo with the hook wired but the patch NOT applied on disk is NOT in a
-    // correctly-patched state, so --check must fail.
-    assert_eq!(
-        code, 1,
-        "check must fail when a manifest patch is unapplied on disk (property 4); stdout=\n{stdout}"
-    );
-    assert_ne!(
-        v["status"], "configured",
-        "check must NOT report `configured` for a hooked-but-unpatched repo; stdout=\n{stdout}"
-    );
-}
-
-// ===========================================================================
-// Property 4 (vendored) — the patch-consistency pass must judge a VENDORED
-// patch by its committed `.socket/vendor/` artifact, which core's
-// `applied_patches_with_vendor` contract makes the SOLE evidence: an
-// unpatched installed tree is EXPECTED after vendoring (the next install
-// re-materializes it from the artifact; go redirects leave the module cache
-// pristine forever), and a patched-looking installed tree must not launder a
-// tampered artifact. `vex` builds that vendor context
-// (commands/vex.rs::vendor_context_from); `setup --check` must too — without
-// it a healthy vendored repo false-fails `--check` with `not_applied`, and a
-// tampered artifact passes.
-// ===========================================================================
-
-/// Canonical-grammar patch UUID — the vendored-artifact verifier validates
-/// the uuid path level against the record, so fixtures must use the real
-/// shape (mirrors e2e_vex_vendor.rs).
-const VENDOR_UUID: &str = "9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f";
-
-/// Lay down the shared vendored fixture: hook wired, an installed
-/// `node_modules/vendpkg` at `installed` bytes, a committed dir-shaped
-/// vendored artifact at `vendored` bytes, the `.socket/vendor/state.json`
-/// ledger entry binding the purl to it, and the patch record whose
-/// afterHash is the hash of `patched` — in `.socket/manifest.json` for the
-/// legacy manifest-tracked shape, or (`detached`) embedded in the ledger
-/// entry with NO manifest at all: the manifest-free posture every
-/// `scan`/`get --mode vendored` run writes.
-fn setup_vendored_fixture(
-    proj: &Path,
-    home: &Path,
-    installed: &[u8],
-    vendored: &[u8],
-    detached: bool,
-) {
-    use socket_patch_core::manifest::schema::PatchRecord;
-    use socket_patch_core::vendor::state::{VendorArtifact, VendorEntry, VendorState};
-
-    write(
-        &proj.join("package.json"),
-        r#"{ "name": "x", "version": "1.0.0" }"#,
-    );
-    let (c, _) = run(proj, home, &["setup", "--json", "--yes"]);
-    assert_eq!(c, 0, "precondition: initial setup wires the hook");
-
-    let original = b"original\n";
-    let patched = b"patched\n";
-
-    let pkg = proj.join("node_modules/vendpkg");
-    write(
-        &pkg.join("package.json"),
-        r#"{ "name": "vendpkg", "version": "1.0.0" }"#,
-    );
-    write(&pkg.join("index.js"), &String::from_utf8_lossy(installed));
-
-    // The committed vendored artifact (dir-shaped copy).
-    let rel = format!(".socket/vendor/npm/{VENDOR_UUID}/vendpkg-1.0.0");
-    write(
-        &proj.join(&rel).join("index.js"),
-        &String::from_utf8_lossy(vendored),
-    );
-
-    let record_json = format!(
-        r#"{{
-    "uuid": "{VENDOR_UUID}",
-    "exportedAt": "2024-01-01T00:00:00Z",
-    "files": {{ "package/index.js": {{ "beforeHash": "{before}", "afterHash": "{after}" }} }},
-    "vulnerabilities": {{ "GHSA-aaaa-bbbb-cccc": {{ "cves": ["CVE-2024-0001"], "summary": "x", "severity": "high", "description": "d" }} }},
-    "description": "d", "license": "MIT", "tier": "free"
-  }}"#,
-        before = git_sha256(original),
-        after = git_sha256(patched),
-    );
-
-    let mut state = VendorState::new();
-    state.entries.insert(
-        "pkg:npm/vendpkg@1.0.0".to_string(),
-        VendorEntry {
-            ecosystem: "npm".to_string(),
-            base_purl: "pkg:npm/vendpkg@1.0.0".to_string(),
-            uuid: VENDOR_UUID.to_string(),
-            artifact: VendorArtifact {
-                path: rel,
-                sha256: String::new(),
-                size: None,
-                platform_locked: None,
-                file_inventory: None,
-            },
-            wiring: Vec::new(),
-            lock: None,
-            took_over_go_patches: false,
-            detached,
-            record: detached.then(|| {
-                serde_json::from_str::<PatchRecord>(&record_json).expect("record fixture")
-            }),
-            flavor: None,
-            uv: None,
-            pnpm: None,
-            poetry: None,
-            pdm: None,
-            pipenv: None,
-        },
-    );
-    write(
-        &proj.join(".socket/vendor/state.json"),
-        &serde_json::to_string_pretty(&state).unwrap(),
-    );
-
-    if detached {
-        assert!(
-            !proj.join(".socket/manifest.json").exists(),
-            "the detached fixture is manifest-free by construction"
-        );
-    } else {
-        write(
-            &proj.join(".socket/manifest.json"),
-            &format!(r#"{{ "patches": {{ "pkg:npm/vendpkg@1.0.0": {record_json} }} }}"#),
-        );
-    }
-}
-
-#[test]
-fn setup_check_judges_vendored_patch_by_committed_artifact() {
-    let proj = tempfile::tempdir().unwrap();
-    let home = tempfile::tempdir().unwrap();
-
-    // Healthy vendored state: the artifact carries the patch; the installed
-    // tree still holds the ORIGINAL bytes (expected until the next install).
-    setup_vendored_fixture(proj.path(), home.path(), b"original\n", b"patched\n", false);
-
-    let (code, stdout) = run(proj.path(), home.path(), &["setup", "--check", "--json"]);
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(
-        code, 0,
-        "check must trust the committed vendored artifact — an unpatched \
-         installed tree is EXPECTED after vendoring, not drift; stdout=\n{stdout}"
-    );
-    assert_eq!(
-        v["status"], "configured",
-        "a healthy vendored repo must report `configured`; stdout=\n{stdout}"
-    );
-}
-
-#[test]
-fn setup_check_flags_tampered_vendored_artifact_despite_patched_tree() {
-    let proj = tempfile::tempdir().unwrap();
-    let home = tempfile::tempdir().unwrap();
-
-    // Laundering attempt: the committed artifact was tampered with, but the
-    // installed tree LOOKS patched. The artifact is the sole evidence — the
-    // consumed bytes on the next install — so check must fail.
-    setup_vendored_fixture(proj.path(), home.path(), b"patched\n", b"TAMPERED\n", false);
-
-    let (code, stdout) = run(proj.path(), home.path(), &["setup", "--check", "--json"]);
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(
-        code, 1,
-        "a tampered vendored artifact must fail check even when the installed \
-         tree looks patched; stdout=\n{stdout}"
-    );
-    assert_ne!(
-        v["status"], "configured",
-        "a patched-looking installed tree must not launder a tampered vendor \
-         artifact; stdout=\n{stdout}"
-    );
-}
-
-// ===========================================================================
-// Property 4 (vendored, manifest-free) — vendored mode writes NO manifest:
-// the ledger entry is `detached` and carries the only copy of the patch
-// record. `setup --check` must judge those exactly like manifest-backed
-// vendored patches (it folds the ledger's embedded records in, as `vex`
-// does); without the fold a vendored-only project with a missing or
-// tampered committed artifact reported `configured`.
-// ===========================================================================
-
-#[test]
-fn setup_check_judges_detached_vendored_patch_without_manifest() {
-    let proj = tempfile::tempdir().unwrap();
-    let home = tempfile::tempdir().unwrap();
-    setup_vendored_fixture(proj.path(), home.path(), b"original\n", b"patched\n", true);
-
-    let (code, stdout) = run(proj.path(), home.path(), &["setup", "--check", "--json"]);
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(
-        code, 0,
-        "a healthy detached vendored patch (committed artifact carries the patch) \
-         is a correctly-patched state; stdout=\n{stdout}"
-    );
-    assert_eq!(v["status"], "configured", "stdout=\n{stdout}");
-}
-
-#[test]
-fn setup_check_flags_tampered_detached_vendored_artifact_without_manifest() {
-    let proj = tempfile::tempdir().unwrap();
-    let home = tempfile::tempdir().unwrap();
-    setup_vendored_fixture(proj.path(), home.path(), b"patched\n", b"TAMPERED\n", true);
-
-    let (code, stdout) = run(proj.path(), home.path(), &["setup", "--check", "--json"]);
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(
-        code, 1,
-        "a tampered detached vendored artifact must fail check even with no \
-         manifest and a patched-looking installed tree; stdout=\n{stdout}"
-    );
-    assert_eq!(v["status"], "needs_configuration", "stdout=\n{stdout}");
-    assert!(
-        v["files"]
-            .as_array()
-            .is_some_and(|files| files.iter().any(|f| {
-                f["kind"] == "patch"
-                    && f["path"] == "pkg:npm/vendpkg@1.0.0"
-                    && f["status"] == "needs_configuration"
-            })),
-        "the drifted vendored purl must be named as a `patch` entry; stdout=\n{stdout}"
-    );
-}
-
-// ===========================================================================
-// Property 7 — reflected in VEX. A patch contributes a VEX statement only for an
-// ecosystem that is actually set up (or declared `manual`). Here the manifest
-// has a pypi patch but pypi is NOT set up (no requirements.txt / pyproject hook),
-// so the document must contain zero statements (exit 1, no applicable patches).
-//
-// SHIPPED: VEX now filters by setup state — `generate_vex` drops patches whose
-// ecosystem is neither set up (`commands/setup::configured_ecosystems`) nor
-// declared `manual` in the manifest's `setup.manual`. With pypi un-set-up and
-// not manual, the only patch is dropped → no applicable patches → exit 1. This
-// pin is now an active (non-ignored) regression guard.
-//
-// (The converse — declaring pypi `manual` to re-include it — is exercised by the
-// `manual` escape hatch the e2e_vex / e2e_embedded_vex fixtures rely on.)
-// ===========================================================================
-
-#[test]
-fn vex_omits_patches_for_unconfigured_ecosystem() {
-    let proj = tempfile::tempdir().unwrap();
-    let home = tempfile::tempdir().unwrap();
-
-    // A pypi patch in the manifest, but NOTHING is set up in this repo (no
-    // package.json, no requirements.txt, no pyproject.toml).
-    write(
-        &proj.path().join(".socket/manifest.json"),
-        r#"{ "patches": {
-  "pkg:pypi/badpkg@1.0.0": {
-    "uuid": "11111111-1111-4111-8111-111111111111",
-    "exportedAt": "2024-01-01T00:00:00Z",
-    "files": { "badpkg/__init__.py": { "beforeHash": "aaaa", "afterHash": "bbbb" } },
-    "vulnerabilities": { "GHSA-xxxx-xxxx-xxxx": { "cves": ["CVE-2024-0001"], "summary": "x", "severity": "high", "description": "d" } },
-    "description": "d", "license": "MIT", "tier": "free"
-  }
-} }"#,
-    );
-
-    let out = proj.path().join("out.json");
-    let (code, stdout) = run(
-        proj.path(),
-        home.path(),
-        &[
-            "vex",
-            "--no-verify",
-            "--product",
-            "pkg:pypi/myapp@1.0.0",
-            "--output",
-            out.to_str().unwrap(),
-        ],
-    );
-
-    // pypi is not set up here, so its patch must not be attested. With no other
-    // patches that means no applicable patches at all → exit 1, no document.
-    let statements = std::fs::read_to_string(&out)
-        .ok()
-        .and_then(|s| serde_json::from_str::<serde_json::Value>(&s).ok())
-        .and_then(|v| v["statements"].as_array().map(|a| a.len()))
-        .unwrap_or(0);
-    assert_eq!(
-        statements, 0,
-        "VEX must omit patches for an un-set-up ecosystem (property 7); stdout=\n{stdout}"
-    );
-    assert_eq!(
-        code, 1,
-        "with the only patch belonging to an un-set-up ecosystem, vex must report \
-         no-applicable-patches (exit 1); stdout=\n{stdout}"
-    );
-}
-
-// ===========================================================================
-// Property 9 (exclude) — SHIPPED. `setup --exclude <member>` skips that member
-// and PERSISTS the exclusion under `.socket/manifest.json`'s `setup.exclude`, so
-// a later `--check` (and a fresh clone) honor it without re-passing the flag.
-// This pin is now an active (non-ignored) regression guard.
-// ===========================================================================
-
-#[test]
-fn setup_honors_exclude_for_a_workspace_member() {
-    let proj = tempfile::tempdir().unwrap();
-    let home = tempfile::tempdir().unwrap();
-    // npm workspace: root + two members.
-    write(
-        &proj.path().join("package.json"),
-        r#"{ "name": "root", "workspaces": ["packages/*"] }"#,
-    );
-    write(
-        &proj.path().join("packages/a/package.json"),
-        r#"{ "name": "a", "version": "1.0.0" }"#,
-    );
-    write(
-        &proj.path().join("packages/b/package.json"),
-        r#"{ "name": "b", "version": "1.0.0" }"#,
-    );
-
-    let read = |p: PathBuf| std::fs::read_to_string(p).unwrap();
-
-    // Setup, excluding packages/b.
-    let (code, stdout) = run(
-        proj.path(),
-        home.path(),
-        &["setup", "--json", "--yes", "--exclude", "packages/b"],
-    );
-    assert_eq!(code, 0, "scoped setup should succeed:\n{stdout}");
-
-    // Root + packages/a configured; packages/b left untouched.
-    assert!(
-        read(proj.path().join("package.json")).contains("socket-patch"),
-        "the root must be configured (never excludable)"
-    );
-    assert!(
-        read(proj.path().join("packages/a/package.json")).contains("socket-patch"),
-        "the included member packages/a must be configured"
-    );
-    assert!(
-        !read(proj.path().join("packages/b/package.json")).contains("socket-patch"),
-        "the EXCLUDED member packages/b must NOT be configured"
-    );
-
-    // The exclusion is persisted under `setup.exclude` in the manifest.
-    let manifest = read(proj.path().join(".socket/manifest.json"));
-    let mv: serde_json::Value = serde_json::from_str(&manifest).expect("manifest is JSON");
-    let excl = mv["setup"]["exclude"]
-        .as_array()
-        .unwrap_or_else(|| panic!("manifest must carry setup.exclude:\n{manifest}"));
-    assert!(
-        excl.iter().any(|v| v == "packages/b"),
-        "the exclusion must persist in the manifest:\n{manifest}"
-    );
-
-    // A fresh `--check` WITHOUT re-passing --exclude honors the persisted set:
-    // the excluded member must not count as needing configuration → `configured`.
-    let (code, stdout) = run(proj.path(), home.path(), &["setup", "--check", "--json"]);
-    assert_eq!(
-        code, 0,
-        "check must pass — the excluded member must not be flagged as needing setup:\n{stdout}"
-    );
-    let cv: serde_json::Value = serde_json::from_str(&stdout).expect("check JSON");
-    assert_eq!(
-        cv["status"], "configured",
-        "check must report `configured`, honoring the persisted exclude:\n{stdout}"
-    );
-    assert!(
-        !cv["files"]
-            .as_array()
-            .unwrap()
-            .iter()
-            .any(|f| f["path"].as_str().is_some_and(|p| p.contains("packages/b"))),
-        "the excluded member must not appear among the checked files:\n{stdout}"
-    );
-}
-
-/// `--exclude` persistence must fail closed on a manifest it cannot parse.
-///
-/// Regression pin: `persist_setup_excludes` flattened a read/parse error to
-/// `None` ("no manifest yet") and rewrote the file as a fresh manifest
-/// holding only the setup block — silently destroying every patch record a
-/// merely-corrupt (and possibly hand-recoverable) manifest still held. The
-/// load-bearing assertion is bytes-unchanged; setup itself still exits 0
-/// (the hooks were written), it just skips persisting and says so on stderr.
-#[test]
-fn exclude_persistence_fails_closed_on_corrupt_manifest() {
-    let proj = tempfile::tempdir().unwrap();
-    let home = tempfile::tempdir().unwrap();
-    // A real `packages/b` member: an `--exclude` that matches nothing is
-    // dropped before persistence, which would make this test vacuous.
-    write(
-        &proj.path().join("package.json"),
-        r#"{ "name": "root", "version": "1.0.0", "workspaces": ["packages/*"] }"#,
-    );
-    write(
-        &proj.path().join("packages/b/package.json"),
-        r#"{ "name": "b", "version": "1.0.0" }"#,
-    );
-    let manifest_path = proj.path().join(".socket/manifest.json");
-    let corrupt = r#"{ "patches": { "pkg:npm/left-pad@1.3.0": TRUNCATED-MID-WRITE"#;
-    write(&manifest_path, corrupt);
-
-    let mut cmd = Command::new(binary());
-    cmd.args(["setup", "--json", "--yes", "--exclude", "packages/b"])
-        .current_dir(proj.path());
-    for (name, _) in std::env::vars() {
-        if name.starts_with("SOCKET_") && name != "SOCKET_NO_CONFIG" {
-            cmd.env_remove(name);
-        }
-    }
-    cmd.env("HOME", home.path());
-    cmd.env("SOCKET_TELEMETRY_DISABLED", "1");
-    let out = cmd.output().expect("run socket-patch");
-    let stderr = String::from_utf8_lossy(&out.stderr);
-
-    assert_eq!(
-        out.status.code(),
-        Some(0),
-        "setup itself succeeds (hooks written); only the persistence step is \
-         skipped; stderr=\n{stderr}"
-    );
-    let after = std::fs::read_to_string(&manifest_path).expect("manifest still present");
-    assert_eq!(
-        after, corrupt,
-        "a corrupt manifest must survive `setup --exclude` byte-identical — \
-         rewriting it destroys every patch record it may still hold; \
-         stderr=\n{stderr}"
-    );
-    // Machine-visible marker: the skip rides the envelope's warnings array,
-    // so `--json` automation cannot mistake this for a fully-persisted run.
-    let stdout = String::from_utf8_lossy(&out.stdout);
-    let v: serde_json::Value = serde_json::from_str(stdout.trim())
-        .unwrap_or_else(|e| panic!("setup --json must emit valid JSON ({e}); stdout=\n{stdout}"));
-    assert!(
-        v["warnings"].as_array().is_some_and(|w| w.iter().any(|x| x
-            .as_str()
-            .is_some_and(|x| x.contains("not persisting --exclude")))),
-        "the skipped persistence must appear in the --json warnings; stdout=\n{stdout}"
-    );
-}
-
-/// The `--silent` contract ("errors only") suppresses the human warning —
-/// pinned here so the suppression is a decision, not an accident — while
-/// the fail-closed behavior itself must hold identically: exit 0, corrupt
-/// bytes untouched.
-#[test]
-fn exclude_persistence_fails_closed_silently_under_silent() {
-    let proj = tempfile::tempdir().unwrap();
-    let home = tempfile::tempdir().unwrap();
-    // A real `packages/b` member: an `--exclude` that matches nothing is
-    // dropped before persistence, which would make this test vacuous.
-    write(
-        &proj.path().join("package.json"),
-        r#"{ "name": "root", "version": "1.0.0", "workspaces": ["packages/*"] }"#,
-    );
-    write(
-        &proj.path().join("packages/b/package.json"),
-        r#"{ "name": "b", "version": "1.0.0" }"#,
-    );
-    let manifest_path = proj.path().join(".socket/manifest.json");
-    let corrupt = r#"{ "patches": { "pkg:npm/left-pad@1.3.0": TRUNCATED-MID-WRITE"#;
-    write(&manifest_path, corrupt);
-
-    let mut cmd = Command::new(binary());
-    cmd.args(["setup", "--silent", "--yes", "--exclude", "packages/b"])
-        .current_dir(proj.path());
-    for (name, _) in std::env::vars() {
-        if name.starts_with("SOCKET_") && name != "SOCKET_NO_CONFIG" {
-            cmd.env_remove(name);
-        }
-    }
-    cmd.env("HOME", home.path());
-    cmd.env("SOCKET_TELEMETRY_DISABLED", "1");
-    let out = cmd.output().expect("run socket-patch");
-    let stdout = String::from_utf8_lossy(&out.stdout);
-    let stderr = String::from_utf8_lossy(&out.stderr);
-
-    assert_eq!(out.status.code(), Some(0), "stderr=\n{stderr}");
-    let after = std::fs::read_to_string(&manifest_path).expect("manifest still present");
-    assert_eq!(
-        after, corrupt,
-        "fail-closed must hold under --silent too; stderr=\n{stderr}"
-    );
-    assert!(
-        !stdout.contains("not persisting") && !stderr.contains("not persisting"),
-        "--silent is errors-only: the skip warning stays quiet; \
-         stdout=\n{stdout}\nstderr=\n{stderr}"
-    );
-}
-
-/// Property 9, CSV spelling: `--exclude` is comma-delimited, so
-/// `--exclude "packages/a, packages/b"` (and the `SOCKET_SETUP_EXCLUDE=a, b`
-/// form CI YAML produces) must exclude BOTH members.
-///
-/// Regression: clap splits on the comma only, so the second value reached
-/// `normalize_rel_path` as `" packages/b"`. Untrimmed it equalled no member's
-/// relative path, so the member was configured anyway — silently, with no
-/// warning that an exclusion had missed — and the unmatchable spelling was
-/// then persisted under `setup.exclude`, where every later run and every clone
-/// inherited a dead entry.
-#[test]
-fn setup_exclude_tolerates_spaces_in_the_csv_list() {
-    let proj = tempfile::tempdir().unwrap();
-    let home = tempfile::tempdir().unwrap();
-    write(
-        &proj.path().join("package.json"),
-        r#"{ "name": "root", "workspaces": ["packages/*"] }"#,
-    );
-    for member in ["a", "b", "keep"] {
-        write(
-            &proj.path().join(format!("packages/{member}/package.json")),
-            &format!(r#"{{ "name": "{member}", "version": "1.0.0" }}"#),
-        );
-    }
-
-    let read = |p: PathBuf| std::fs::read_to_string(p).unwrap();
-
-    let (code, stdout) = run(
-        proj.path(),
-        home.path(),
-        &[
-            "setup",
-            "--json",
-            "--yes",
-            "--exclude",
-            "packages/a, packages/b",
-        ],
-    );
-    assert_eq!(code, 0, "scoped setup should succeed:\n{stdout}");
-
-    // Control: the run really did configure things (root + the member that was
-    // never excluded), so the assertions below cannot pass vacuously.
-    assert!(
-        read(proj.path().join("package.json")).contains("socket-patch"),
-        "the root must be configured (never excludable):\n{stdout}"
-    );
-    assert!(
-        read(proj.path().join("packages/keep/package.json")).contains("socket-patch"),
-        "the non-excluded member must be configured:\n{stdout}"
-    );
-
-    for member in ["a", "b"] {
-        let content = read(proj.path().join(format!("packages/{member}/package.json")));
-        assert!(
-            !content.contains("socket-patch"),
-            "packages/{member} was excluded on the CSV list and must NOT be \
-             configured; got:\n{content}\nstdout:\n{stdout}"
-        );
-    }
-
-    // Both spellings persist in normalized (matchable) form, so the next run
-    // and a fresh clone honor them without re-passing the flag.
-    let manifest = read(proj.path().join(".socket/manifest.json"));
-    let mv: serde_json::Value = serde_json::from_str(&manifest).expect("manifest is JSON");
-    let excl: Vec<&str> = mv["setup"]["exclude"]
-        .as_array()
-        .unwrap_or_else(|| panic!("manifest must carry setup.exclude:\n{manifest}"))
-        .iter()
-        .filter_map(|v| v.as_str())
-        .collect();
-    assert_eq!(
-        excl,
-        vec!["packages/a", "packages/b"],
-        "the persisted set must be normalized, not the raw CSV fragments:\n{manifest}"
-    );
-}
-
-/// Property 9, subtree semantics: excluding a member excludes everything
-/// *inside* it. Discovery reaches nested manifests — a member that is itself a
-/// workspace root has its own members configured (the nested-workspace
-/// sub-property) — so an exclusion that only matched the member's own
-/// `package.json` still wired install hooks into the subtree the user asked
-/// `setup` to keep out of.
-#[test]
-fn setup_exclude_covers_manifests_nested_below_the_excluded_member() {
-    let proj = tempfile::tempdir().unwrap();
-    let home = tempfile::tempdir().unwrap();
-    write(
-        &proj.path().join("package.json"),
-        r#"{ "name": "root", "workspaces": ["packages/*"] }"#,
-    );
-    // The excluded member is itself a workspace root with a nested member.
-    write(
-        &proj.path().join("packages/legacy/package.json"),
-        r#"{ "name": "legacy", "version": "1.0.0", "workspaces": ["sub/*"] }"#,
-    );
-    write(
-        &proj.path().join("packages/legacy/sub/deep/package.json"),
-        r#"{ "name": "deep", "version": "1.0.0" }"#,
-    );
-    write(
-        &proj.path().join("packages/keep/package.json"),
-        r#"{ "name": "keep", "version": "1.0.0" }"#,
-    );
-
-    let read = |p: PathBuf| std::fs::read_to_string(p).unwrap();
-
-    let (code, stdout) = run(
-        proj.path(),
-        home.path(),
-        &["setup", "--json", "--yes", "--exclude", "packages/legacy"],
-    );
-    assert_eq!(code, 0, "scoped setup should succeed:\n{stdout}");
-
-    // Control: the root and the sibling member ARE configured — proof the
-    // nested walk ran and the assertions below are not vacuous.
-    assert!(
-        read(proj.path().join("package.json")).contains("socket-patch"),
-        "the root must be configured (never excludable):\n{stdout}"
-    );
-    assert!(
-        read(proj.path().join("packages/keep/package.json")).contains("socket-patch"),
-        "the non-excluded member must be configured:\n{stdout}"
-    );
-
-    for member in ["packages/legacy", "packages/legacy/sub/deep"] {
-        let content = read(proj.path().join(member).join("package.json"));
-        assert!(
-            !content.contains("socket-patch"),
-            "{member} lies in the excluded member and must NOT be configured; \
-             got:\n{content}\nstdout:\n{stdout}"
-        );
-    }
-    assert!(
-        !stdout.contains("packages/legacy"),
-        "no manifest under the excluded member may appear in the envelope:\n{stdout}"
-    );
-}
-
-// ===========================================================================
-// Additive contract values for vlt: the setup envelope's `packageManager`
-// and the `patch_setup` telemetry `manager` both say "vlt" for a vlt project
-// (the hook itself is npm's `npx` form).
-// ===========================================================================
-
-#[tokio::test]
-async fn setup_reports_vlt_in_the_envelope_and_telemetry() {
-    use wiremock::MockServer;
-
-    let server = MockServer::start().await;
-    let tmp = tempfile::tempdir().unwrap();
-    let home = tempfile::tempdir().unwrap();
-    let path = tempfile::tempdir().unwrap();
-    write(
-        &tmp.path().join("package.json"),
-        "{\n  \"name\": \"vlt-proj\",\n  \"version\": \"1.0.0\"\n}\n",
-    );
-    write(&tmp.path().join("vlt.json"), "{}\n");
-
-    let mut cmd = Command::new(binary());
-    cmd.args(["setup", "--json", "--yes"])
-        .current_dir(tmp.path());
-    for (name, _) in std::env::vars() {
-        if name.starts_with("SOCKET_") || name == "VITEST" {
-            cmd.env_remove(name);
-        }
-    }
-    cmd.env("HOME", home.path())
-        .env("PATH", path.path())
-        .env("SOCKET_NO_CONFIG", "1")
-        .env("SOCKET_NO_UPDATE_CHECK", "1")
-        .env("SOCKET_TELEMETRY_DISABLED", "0")
-        .env("SOCKET_PROXY_URL", server.uri());
-    let out = cmd.output().expect("run socket-patch");
-    let stdout = String::from_utf8_lossy(&out.stdout);
-    assert_eq!(out.status.code(), Some(0), "stdout=\n{stdout}");
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(v["status"], "success", "{v}");
-    assert_eq!(v["packageManager"], "vlt", "{v}");
-
-    let reqs = server.received_requests().await.unwrap_or_default();
-    let events: Vec<serde_json::Value> = reqs
-        .iter()
-        .filter(|r| r.url.path() == "/patch/telemetry")
-        .map(|r| serde_json::from_slice(&r.body).expect("telemetry body is JSON"))
-        .collect();
-    assert_eq!(events.len(), 1, "one patch_setup event: {events:?}");
-    assert_eq!(events[0]["event_type"], "patch_setup", "{}", events[0]);
-    assert_eq!(events[0]["metadata"]["manager"], "vlt", "{}", events[0]);
-}
diff --git a/crates/socket-patch-cli/tests/setup_invariants.rs b/crates/socket-patch-cli/tests/setup_invariants.rs
deleted file mode 100644
index a69f945a..00000000
--- a/crates/socket-patch-cli/tests/setup_invariants.rs
+++ /dev/null
@@ -1,1427 +0,0 @@
-//! Integration tests for `setup` against handcrafted `package.json`
-//! fixtures. `setup` operates entirely on disk (lockfile detection +
-//! package.json mutation) so every path is runnable without network.
-
-use std::collections::BTreeSet;
-use std::path::{Path, PathBuf};
-use std::process::Command;
-
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
-/// Recursively collect every regular-file path under `dir`, relative to `dir`.
-/// Used to prove `setup` writes nothing outside the repo (property 5) and to
-/// snapshot a "clone" (property 6).
-fn files_under(dir: &Path) -> BTreeSet<String> {
-    fn walk(base: &Path, dir: &Path, out: &mut BTreeSet<String>) {
-        if let Ok(rd) = std::fs::read_dir(dir) {
-            for e in rd.flatten() {
-                let p = e.path();
-                if p.is_dir() {
-                    walk(base, &p, out);
-                } else {
-                    out.insert(p.strip_prefix(base).unwrap().to_string_lossy().to_string());
-                }
-            }
-        }
-    }
-    let mut out = BTreeSet::new();
-    walk(dir, dir, &mut out);
-    out
-}
-
-/// Copy every file under `src` into `dst` (recreating directories). Simulates a
-/// fresh `git clone` of the committed tree onto another host.
-fn copy_tree(src: &Path, dst: &Path) {
-    for rel in files_under(src) {
-        let from = src.join(&rel);
-        let to = dst.join(&rel);
-        if let Some(parent) = to.parent() {
-            std::fs::create_dir_all(parent).expect("create parent");
-        }
-        std::fs::copy(&from, &to).expect("copy file");
-    }
-}
-
-/// Build a `setup` invocation with every ambient `SOCKET_*` env var scrubbed
-/// by prefix. These tests drive `setup` purely through flags and on-disk
-/// fixtures, so ANY `SOCKET_*` fallback leaking in from the developer's shell
-/// or CI would let an assertion pass (or fail) for the wrong reason — e.g. an
-/// ambient `SOCKET_DRY_RUN=true` would keep a regressed `--check`/`--yes` path
-/// from writing (satisfying the "must not modify" checks vacuously), and an
-/// ambient `SOCKET_ECOSYSTEMS`/`SOCKET_YES`/`SOCKET_CWD` would silently change
-/// which manifest is touched and how the script is rendered. A fixed name
-/// list is the trap the sibling suites already fell into (remove_network.rs
-/// missed `SOCKET_SKIP_ROLLBACK`; this file's list missed
-/// `SOCKET_SETUP_EXCLUDE`, setup's own env-bound `--exclude` fallback, which
-/// silently dropped workspace members AND persisted the ambient exclude into
-/// `.socket/manifest.json`), so scrub by prefix like common::run_with_env.
-/// Telemetry opt-outs are deliberately kept: they only suppress phone-home
-/// and cannot steer the behaviour under test, and an opted-out dev should
-/// stay opted out.
-fn setup_command(cwd: &Path, args: &[&str]) -> Command {
-    let mut cmd = Command::new(binary());
-    cmd.args(args).current_dir(cwd);
-    for (key, _) in std::env::vars_os() {
-        let name = key.to_string_lossy();
-        if name.starts_with("SOCKET_") && !name.contains("TELEMETRY") && name != "SOCKET_NO_CONFIG"
-        {
-            cmd.env_remove(&key);
-        }
-    }
-    cmd
-}
-
-fn run_setup(cwd: &Path, extra: &[&str]) -> (i32, String) {
-    let mut args = vec!["setup", "--json"];
-    args.extend_from_slice(extra);
-    let out = setup_command(cwd, &args)
-        .output()
-        .expect("run socket-patch");
-    (
-        out.status.code().unwrap_or(-1),
-        String::from_utf8_lossy(&out.stdout).to_string(),
-    )
-}
-
-fn write(path: &Path, content: &str) {
-    if let Some(parent) = path.parent() {
-        std::fs::create_dir_all(parent).expect("create parent");
-    }
-    std::fs::write(path, content).expect("write file");
-}
-
-// ---------------------------------------------------------------------------
-// Empty project
-// ---------------------------------------------------------------------------
-
-#[test]
-fn setup_no_package_json_emits_no_files_status() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let (code, stdout) = run_setup(tmp.path(), &[]);
-    assert_eq!(code, 0, "no files should still exit 0; stdout=\n{stdout}");
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(v["status"], "no_files");
-    assert_eq!(v["updated"], 0);
-    assert_eq!(v["alreadyConfigured"], 0);
-    assert_eq!(v["errors"], 0);
-}
-
-// ---------------------------------------------------------------------------
-// Single package.json without socket-patch
-// ---------------------------------------------------------------------------
-
-#[test]
-fn setup_dry_run_does_not_modify_package_json() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let pkg = tmp.path().join("package.json");
-    let original = r#"{
-  "name": "test-proj",
-  "version": "1.0.0"
-}
-"#;
-    write(&pkg, original);
-
-    let (code, stdout) = run_setup(tmp.path(), &["--dry-run"]);
-    assert_eq!(code, 0, "dry-run should succeed; stdout=\n{stdout}");
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(v["status"], "dry_run");
-    assert_eq!(v["dryRun"], true);
-    assert_eq!(v["wouldUpdate"], 1);
-
-    // package.json must be byte-identical after dry-run.
-    let after = std::fs::read_to_string(&pkg).expect("read package.json");
-    assert_eq!(after, original, "dry-run must not modify package.json");
-}
-
-#[test]
-fn setup_yes_writes_postinstall_script() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let pkg = tmp.path().join("package.json");
-    write(
-        &pkg,
-        r#"{ "name": "test-proj", "version": "1.0.0" }
-"#,
-    );
-
-    let (code, stdout) = run_setup(tmp.path(), &["--yes"]);
-    assert_eq!(code, 0, "setup should succeed; stdout=\n{stdout}");
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(v["status"], "success");
-    assert_eq!(v["updated"], 1);
-
-    let after = std::fs::read_to_string(&pkg).expect("read package.json");
-    let parsed: serde_json::Value = serde_json::from_str(&after).expect("valid package.json");
-    let postinstall = parsed["scripts"]["postinstall"]
-        .as_str()
-        .expect("postinstall script must be set");
-    // No lockfile present → npm, which invokes the patch via `npx` and applies
-    // the npm ecosystem. Lock the actual command so a no-op/garbage script
-    // can't pass on a bare substring.
-    assert!(
-        postinstall.contains("npx @socketsecurity/socket-patch apply"),
-        "npm postinstall must invoke the patch via npx; got: {postinstall}"
-    );
-    assert!(
-        postinstall.contains("--ecosystems npm"),
-        "npm postinstall must scope to the npm ecosystem; got: {postinstall}"
-    );
-    // setup also wires the `dependencies` lifecycle script (covers `npm install
-    // <pkg>` which skips postinstall); it must be present and equal.
-    let deps = parsed["scripts"]["dependencies"]
-        .as_str()
-        .expect("dependencies lifecycle script must be set");
-    assert_eq!(
-        deps, postinstall,
-        "the dependencies hook must mirror the postinstall hook; got: {deps}"
-    );
-    // The original `name`/`version` must be preserved, not clobbered.
-    assert_eq!(parsed["name"], "test-proj");
-    assert_eq!(parsed["version"], "1.0.0");
-}
-
-#[test]
-fn setup_already_configured_returns_idempotent_status() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let pkg = tmp.path().join("package.json");
-
-    // First setup run wires up the scripts.
-    write(
-        &pkg,
-        r#"{ "name": "test-proj", "version": "1.0.0" }
-"#,
-    );
-    let (code1, _) = run_setup(tmp.path(), &["--yes"]);
-    assert_eq!(code1, 0);
-
-    // Second run should detect the config is already there.
-    let (code2, stdout2) = run_setup(tmp.path(), &["--yes"]);
-    assert_eq!(code2, 0, "second run should succeed; stdout=\n{stdout2}");
-    let v: serde_json::Value = serde_json::from_str(&stdout2).expect("valid JSON");
-    assert_eq!(v["status"], "already_configured");
-    assert_eq!(v["updated"], 0);
-    assert_eq!(v["alreadyConfigured"], 1);
-}
-
-// ---------------------------------------------------------------------------
-// Package manager detection
-// ---------------------------------------------------------------------------
-
-#[test]
-fn setup_detects_pnpm_from_lockfile() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write(
-        &tmp.path().join("package.json"),
-        r#"{ "name": "test-proj", "version": "1.0.0" }
-"#,
-    );
-    write(
-        &tmp.path().join("pnpm-lock.yaml"),
-        "lockfileVersion: '9.0'\n",
-    );
-
-    let (code, stdout) = run_setup(tmp.path(), &["--yes"]);
-    assert_eq!(code, 0, "setup should succeed; stdout=\n{stdout}");
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(v["packageManager"], "pnpm");
-
-    // pnpm dlx should appear in the generated postinstall.
-    let after = std::fs::read_to_string(tmp.path().join("package.json")).unwrap();
-    assert!(
-        after.contains("pnpm dlx"),
-        "pnpm projects should use `pnpm dlx`; got: {after}"
-    );
-}
-
-#[test]
-fn setup_defaults_to_npm_when_no_lockfile() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write(
-        &tmp.path().join("package.json"),
-        r#"{ "name": "test-proj", "version": "1.0.0" }
-"#,
-    );
-
-    let (code, stdout) = run_setup(tmp.path(), &["--yes"]);
-    assert_eq!(code, 0, "setup should succeed; stdout=\n{stdout}");
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(v["packageManager"], "npm");
-    assert_eq!(v["status"], "success");
-
-    // The written script must use npm's `npx`, never `pnpm dlx` — otherwise
-    // "detected npm" in the envelope wouldn't match what got written.
-    let after = std::fs::read_to_string(tmp.path().join("package.json")).unwrap();
-    assert!(
-        after.contains("npx @socketsecurity/socket-patch"),
-        "npm projects must use `npx`; got: {after}"
-    );
-    assert!(
-        !after.contains("pnpm dlx"),
-        "npm projects must NOT use `pnpm dlx`; got: {after}"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// Monorepo handling
-// ---------------------------------------------------------------------------
-
-#[test]
-fn setup_pnpm_monorepo_only_updates_root() {
-    // pnpm workspaces: setup intentionally skips workspace-level
-    // package.json files (their postinstall would fail because the
-    // workspace pkg doesn't depend on @socketsecurity/socket-patch).
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write(
-        &tmp.path().join("package.json"),
-        r#"{ "name": "monorepo-root", "version": "1.0.0" }
-"#,
-    );
-    write(
-        &tmp.path().join("pnpm-lock.yaml"),
-        "lockfileVersion: '9.0'\n",
-    );
-    write(
-        &tmp.path().join("pnpm-workspace.yaml"),
-        "packages:\n  - 'packages/*'\n",
-    );
-    write(
-        &tmp.path().join("packages/a/package.json"),
-        r#"{ "name": "a", "version": "1.0.0" }
-"#,
-    );
-    write(
-        &tmp.path().join("packages/b/package.json"),
-        r#"{ "name": "b", "version": "1.0.0" }
-"#,
-    );
-
-    let (code, stdout) = run_setup(tmp.path(), &["--yes"]);
-    assert_eq!(code, 0, "monorepo setup should succeed; stdout=\n{stdout}");
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(
-        v["updated"], 1,
-        "only the root package.json should be touched in a pnpm monorepo"
-    );
-
-    // The envelope must list exactly the root entry, not the workspace members.
-    let files = v["files"].as_array().expect("files array");
-    assert_eq!(
-        files.len(),
-        1,
-        "only the root package.json should appear in files[]; got: {files:?}"
-    );
-    let touched = files[0]["path"].as_str().unwrap();
-    assert!(
-        !touched.contains("packages/a") && !touched.contains("packages/b"),
-        "the touched file must be the root, not a workspace member; got: {touched}"
-    );
-
-    // Both workspace packages must NOT have been modified.
-    for member in ["packages/a/package.json", "packages/b/package.json"] {
-        let content = std::fs::read_to_string(tmp.path().join(member)).unwrap();
-        assert!(
-            !content.contains("socket-patch"),
-            "workspace package.json {member} must not be touched; got: {content}"
-        );
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Per-file JSON shape — locks the schema of `files[*]` entries
-// ---------------------------------------------------------------------------
-
-#[test]
-fn setup_yes_json_files_entry_has_expected_keys() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write(
-        &tmp.path().join("package.json"),
-        r#"{ "name": "test-proj", "version": "1.0.0" }
-"#,
-    );
-
-    let (code, stdout) = run_setup(tmp.path(), &["--yes"]);
-    assert_eq!(code, 0, "setup should succeed; stdout=\n{stdout}");
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    let files = v["files"].as_array().expect("files array");
-    assert_eq!(files.len(), 1);
-    let entry = &files[0];
-    // Lock the actual values, not just the types — an entry of
-    // {"path": "", "status": "error"} would satisfy `is_string()`.
-    assert_eq!(entry["kind"], "package_json", "entry: {entry}");
-    assert_eq!(
-        entry["status"], "updated",
-        "the single updated file must report status=updated; entry: {entry}"
-    );
-    let path = entry["path"].as_str().expect("path string");
-    assert!(
-        path.ends_with("package.json"),
-        "path must point at the package.json we wrote; got: {path}"
-    );
-    assert!(
-        entry["error"].is_null(),
-        "a successfully updated file must carry no error; entry: {entry}"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// Error handling — a malformed package.json must NOT be reported as success.
-//
-// When nothing was updatable but a file errored (e.g. invalid JSON), `setup`
-// must not emit `status: "already_configured"` with exit 0; a parse error
-// must surface as a non-zero exit.
-// ---------------------------------------------------------------------------
-
-#[test]
-fn setup_malformed_package_json_reports_error_and_exits_nonzero() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write(&tmp.path().join("package.json"), "not valid json!!!");
-
-    let (code, stdout) = run_setup(tmp.path(), &["--yes"]);
-    assert_eq!(
-        code, 1,
-        "a malformed package.json must exit non-zero; stdout=\n{stdout}"
-    );
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(
-        v["status"], "error",
-        "must not be reported as already_configured"
-    );
-    assert_eq!(v["updated"], 0);
-    assert_eq!(v["alreadyConfigured"], 0);
-    assert_eq!(v["errors"], 1);
-    let files = v["files"].as_array().expect("files array");
-    assert_eq!(files[0]["status"], "error");
-    assert!(files[0]["error"].is_string());
-}
-
-#[test]
-fn setup_malformed_does_not_claim_already_configured_in_human_mode() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write(&tmp.path().join("package.json"), "not valid json!!!");
-
-    // Human (non-JSON) mode: the misleading "All package.json files are
-    // already configured" line must not appear when a file errored.
-    let out = setup_command(tmp.path(), &["setup", "--yes"])
-        .output()
-        .expect("run socket-patch");
-    let stdout = String::from_utf8_lossy(&out.stdout);
-    assert_eq!(
-        out.status.code(),
-        Some(1),
-        "human mode must exit 1; stdout=\n{stdout}"
-    );
-    assert!(
-        !stdout.contains("already configured with socket-patch"),
-        "must not falsely claim everything is already configured; stdout=\n{stdout}"
-    );
-    // And it must positively surface that the file could not be processed —
-    // otherwise a silent (but still exit-1) run would slip past the negative
-    // check above.
-    assert!(
-        stdout.contains("could not be processed"),
-        "human mode must report the unprocessable file; stdout=\n{stdout}"
-    );
-}
-
-#[test]
-fn setup_dry_run_with_error_exits_nonzero() {
-    // A valid root (would-update) alongside a malformed workspace member:
-    // dry-run must still surface the parse error via a non-zero exit rather
-    // than masking it behind the `dry_run` status.
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write(
-        &tmp.path().join("package.json"),
-        r#"{ "name": "root", "workspaces": ["packages/*"] }
-"#,
-    );
-    write(&tmp.path().join("packages/a/package.json"), "{bad json");
-
-    let (code, stdout) = run_setup(tmp.path(), &["--dry-run"]);
-    assert_eq!(
-        code, 1,
-        "dry-run with an error must exit non-zero; stdout=\n{stdout}"
-    );
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(v["status"], "dry_run");
-    assert_eq!(v["errors"], 1);
-    assert_eq!(v["wouldUpdate"], 1);
-
-    // dry-run must not have written anything.
-    let root = std::fs::read_to_string(tmp.path().join("package.json")).unwrap();
-    assert!(
-        !root.contains("socket-patch"),
-        "dry-run must not modify files"
-    );
-}
-
-#[test]
-fn setup_partial_failure_exits_nonzero_when_applying() {
-    // One updatable file + one malformed file, applied for real (--yes):
-    // the run must report partial_failure and exit 1.
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write(
-        &tmp.path().join("package.json"),
-        r#"{ "name": "root", "workspaces": ["packages/*"] }
-"#,
-    );
-    write(&tmp.path().join("packages/a/package.json"), "{bad json");
-
-    let (code, stdout) = run_setup(tmp.path(), &["--yes"]);
-    assert_eq!(
-        code, 1,
-        "partial failure must exit non-zero; stdout=\n{stdout}"
-    );
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(v["status"], "partial_failure");
-    assert_eq!(v["updated"], 1);
-    assert_eq!(v["errors"], 1);
-
-    // The valid root file should have been written.
-    let root = std::fs::read_to_string(tmp.path().join("package.json")).unwrap();
-    assert!(
-        root.contains("socket-patch"),
-        "valid file should still be updated"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// `setup --check` — read-only verification
-// ---------------------------------------------------------------------------
-
-#[test]
-fn setup_check_configured_project_exits_zero() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let pkg = tmp.path().join("package.json");
-    write(&pkg, r#"{ "name": "x", "version": "1.0.0" }"#);
-    // Configure it first.
-    let (c, _) = run_setup(tmp.path(), &["--yes"]);
-    assert_eq!(c, 0);
-
-    let (code, stdout) = run_setup(tmp.path(), &["--check"]);
-    assert_eq!(
-        code, 0,
-        "configured project should pass --check; stdout=\n{stdout}"
-    );
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(v["status"], "configured");
-    assert_eq!(v["needsConfiguration"], 0);
-    assert_eq!(v["errors"], 0);
-    // The package.json must be counted as configured, not silently absent.
-    assert_eq!(
-        v["configured"], 1,
-        "the lone manifest must be counted; stdout=\n{stdout}"
-    );
-    let files = v["files"].as_array().expect("files array");
-    assert_eq!(files.len(), 1);
-    assert_eq!(files[0]["status"], "configured");
-}
-
-/// npm and Node strip a UTF-8 BOM in package.json — files saved by Windows
-/// editors commonly carry one — and every other setup surface already
-/// tolerates it: `setup` wires a BOM'd file (update.rs pins) and reports a
-/// BOM'd configured file `already_configured`. `--check` must agree: a BOM'd,
-/// fully-configured file is `configured` (exit 0), NOT `Error: Invalid
-/// package.json` (exit 1). Regression guard: `run_check` raw-parsed the file
-/// without stripping the BOM, so the same file `setup` calls configured
-/// failed `--check`.
-#[test]
-fn setup_check_tolerates_bom_like_npm() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write(
-        &tmp.path().join("package.json"),
-        "\u{feff}{\"scripts\":{\"postinstall\":\"npx @socketsecurity/socket-patch apply --silent --ecosystems npm\",\"dependencies\":\"npx @socketsecurity/socket-patch apply --silent --ecosystems npm\"}}",
-    );
-
-    // `setup` itself treats the file as valid and already configured (and
-    // therefore leaves it byte-identical, BOM included).
-    let (setup_code, setup_stdout) = run_setup(tmp.path(), &["--yes"]);
-    assert_eq!(
-        setup_code, 0,
-        "setup must accept a BOM'd configured package.json; stdout=\n{setup_stdout}"
-    );
-    let v: serde_json::Value = serde_json::from_str(&setup_stdout).expect("valid JSON");
-    assert_eq!(v["status"], "already_configured");
-
-    // `--check` must reach the same verdict npm (and `setup`) do.
-    let (code, stdout) = run_setup(tmp.path(), &["--check"]);
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(
-        code, 0,
-        "a BOM'd configured package.json must pass --check; stdout=\n{stdout}"
-    );
-    assert_eq!(v["status"], "configured", "stdout=\n{stdout}");
-    assert_eq!(v["errors"], 0, "stdout=\n{stdout}");
-    assert_eq!(v["files"][0]["status"], "configured", "stdout=\n{stdout}");
-}
-
-#[test]
-fn setup_check_unconfigured_project_exits_nonzero() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write(
-        &tmp.path().join("package.json"),
-        r#"{ "name": "x", "scripts": { "build": "tsc" } }"#,
-    );
-
-    let (code, stdout) = run_setup(tmp.path(), &["--check"]);
-    assert_eq!(
-        code, 1,
-        "unconfigured project must fail --check; stdout=\n{stdout}"
-    );
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(v["status"], "needs_configuration");
-    assert_eq!(v["needsConfiguration"], 1);
-}
-
-#[test]
-fn setup_check_no_files_exits_zero() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let (code, stdout) = run_setup(tmp.path(), &["--check"]);
-    assert_eq!(code, 0, "no files should still exit 0; stdout=\n{stdout}");
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(v["status"], "no_files");
-    // The `no_files` envelope must keep the documented `--check` shape
-    // (CLI_CONTRACT "Setup command contract") — the summary counts are
-    // always-present, zero-valued fields, NOT dropped. A consumer reading
-    // `.needsConfiguration` must see 0, not null.
-    assert_eq!(
-        v["configured"], 0,
-        "missing/`null` configured; stdout=\n{stdout}"
-    );
-    assert_eq!(
-        v["needsConfiguration"], 0,
-        "missing/`null` needsConfiguration; stdout=\n{stdout}"
-    );
-    assert_eq!(v["errors"], 0, "missing/`null` errors; stdout=\n{stdout}");
-    assert!(v["files"].as_array().is_some_and(|a| a.is_empty()));
-}
-
-#[test]
-fn setup_remove_no_files_exits_zero_with_full_envelope() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let (code, stdout) = run_setup(tmp.path(), &["--remove", "--yes"]);
-    assert_eq!(code, 0, "no files should still exit 0; stdout=\n{stdout}");
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(v["status"], "no_files");
-    // The `no_files` envelope must keep the documented `--remove` shape
-    // (removed/notConfigured/errors), present and zero — not dropped. This
-    // mirrors the plain-`setup` `no_files` envelope, which already carries its
-    // own counts; the `--remove`/`--check` variants must not diverge.
-    assert_eq!(v["removed"], 0, "missing/`null` removed; stdout=\n{stdout}");
-    assert_eq!(
-        v["notConfigured"], 0,
-        "missing/`null` notConfigured; stdout=\n{stdout}"
-    );
-    assert_eq!(v["errors"], 0, "missing/`null` errors; stdout=\n{stdout}");
-    assert!(v["files"].as_array().is_some_and(|a| a.is_empty()));
-}
-
-#[test]
-fn setup_check_does_not_modify_file() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let pkg = tmp.path().join("package.json");
-    let original = "{ \"name\": \"x\", \"scripts\": { \"build\": \"tsc\" } }";
-    write(&pkg, original);
-    // The check must actually run and report this unconfigured manifest (exit
-    // 1) — discarding the outcome would let a no-op binary pass the
-    // "didn't write" assertion vacuously.
-    let (code, stdout) = run_setup(tmp.path(), &["--check"]);
-    assert_eq!(
-        code, 1,
-        "unconfigured --check must exit 1; stdout=\n{stdout}"
-    );
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(v["status"], "needs_configuration");
-    assert_eq!(
-        std::fs::read_to_string(&pkg).unwrap(),
-        original,
-        "--check must never write"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// `setup --remove` — revert the install hooks
-// ---------------------------------------------------------------------------
-
-#[test]
-fn setup_remove_round_trips_and_preserves_other_scripts() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let pkg = tmp.path().join("package.json");
-    write(&pkg, r#"{ "name": "x", "scripts": { "build": "tsc" } }"#);
-
-    // Configure, then remove.
-    let (c1, _) = run_setup(tmp.path(), &["--yes"]);
-    assert_eq!(c1, 0);
-    let after_setup = std::fs::read_to_string(&pkg).unwrap();
-    assert!(after_setup.contains("socket-patch"));
-
-    let (code, stdout) = run_setup(tmp.path(), &["--remove", "--yes"]);
-    assert_eq!(code, 0, "remove should succeed; stdout=\n{stdout}");
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(v["status"], "success");
-    assert_eq!(v["removed"], 1);
-
-    let after = std::fs::read_to_string(&pkg).unwrap();
-    assert!(
-        !after.contains("socket-patch"),
-        "socket-patch must be gone; got:\n{after}"
-    );
-    let parsed: serde_json::Value = serde_json::from_str(&after).expect("valid JSON");
-    // Full revert: lifecycle keys gone, sibling script preserved.
-    assert_eq!(parsed["scripts"]["build"], "tsc");
-    assert!(parsed["scripts"].get("postinstall").is_none());
-    assert!(parsed["scripts"].get("dependencies").is_none());
-
-    // And --check now reports it needs configuration again.
-    let (c2, _) = run_setup(tmp.path(), &["--check"]);
-    assert_eq!(c2, 1, "after remove, --check must fail again");
-}
-
-#[test]
-fn setup_remove_dry_run_does_not_modify_file() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let pkg = tmp.path().join("package.json");
-    write(&pkg, r#"{ "name": "x", "version": "1.0.0" }"#);
-    let (c1, _) = run_setup(tmp.path(), &["--yes"]);
-    assert_eq!(c1, 0);
-    let configured = std::fs::read_to_string(&pkg).unwrap();
-
-    let (code, stdout) = run_setup(tmp.path(), &["--remove", "--dry-run"]);
-    assert_eq!(code, 0, "remove dry-run should succeed; stdout=\n{stdout}");
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(v["status"], "dry_run");
-    assert_eq!(v["dryRun"], true);
-    assert_eq!(v["wouldRemove"], 1);
-
-    assert_eq!(
-        std::fs::read_to_string(&pkg).unwrap(),
-        configured,
-        "remove --dry-run must not modify package.json"
-    );
-}
-
-#[test]
-fn setup_remove_nothing_to_remove_exits_zero() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write(
-        &tmp.path().join("package.json"),
-        r#"{ "name": "x", "scripts": { "build": "tsc" } }"#,
-    );
-
-    let (code, stdout) = run_setup(tmp.path(), &["--remove", "--yes"]);
-    assert_eq!(
-        code, 0,
-        "nothing to remove should exit 0; stdout=\n{stdout}"
-    );
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(v["status"], "not_configured");
-    assert_eq!(v["removed"], 0);
-}
-
-// In human (non-JSON) mode `setup --remove` ends with
-// "Nothing removed; N item(s) could not be processed (see errors above)."
-// when a manifest fails to parse, so `print_remove_preview` must surface the
-// per-file error for that message to be truthful. (The companion setup-path
-// check is `setup_malformed_does_not_claim_already_configured_in_human_mode`.)
-#[test]
-fn remove_human_mode_surfaces_unprocessable_file_error() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write(&tmp.path().join("package.json"), "not valid json!!!");
-
-    let out = setup_command(tmp.path(), &["setup", "--remove", "--yes"])
-        .output()
-        .expect("run socket-patch");
-    let stdout = String::from_utf8_lossy(&out.stdout);
-    assert_eq!(
-        out.status.code(),
-        Some(1),
-        "a malformed manifest must exit 1; stdout=\n{stdout}"
-    );
-
-    // The "(see errors above)" trailer is only honest if the error was actually
-    // printed above it.
-    assert!(
-        stdout.contains("could not be processed (see errors above)"),
-        "remove must report the unprocessable file; stdout=\n{stdout}"
-    );
-    assert!(
-        stdout.contains("Errors:"),
-        "the preview must include an Errors: section so '(see errors above)' is truthful; stdout=\n{stdout}"
-    );
-    // The concrete parse error (not just a header) must be shown — a bare
-    // "Errors:" header with no detail would still be a regression.
-    assert!(
-        stdout.contains("Invalid package.json"),
-        "the actual per-file error detail must be shown above the trailer; stdout=\n{stdout}"
-    );
-    // The Errors: section must precede the trailer it references.
-    let errors_at = stdout.find("Errors:").expect("Errors header present");
-    let trailer_at = stdout.find("see errors above").expect("trailer present");
-    assert!(
-        errors_at < trailer_at,
-        "the Errors: section must appear ABOVE the '(see errors above)' trailer; stdout=\n{stdout}"
-    );
-}
-
-#[test]
-fn setup_check_and_remove_are_mutually_exclusive() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write(&tmp.path().join("package.json"), r#"{ "name": "x" }"#);
-
-    // clap conflict → usage error (exit 2), not a normal run.
-    let out = setup_command(tmp.path(), &["setup", "--check", "--remove"])
-        .output()
-        .expect("run socket-patch");
-    let stdout = String::from_utf8_lossy(&out.stdout);
-    let stderr = String::from_utf8_lossy(&out.stderr);
-    // Must be a clap *usage* error (exit 2), not a normal run that happened to
-    // fail (exit 1) — `assert_ne!(.., 0)` would accept either and mask a
-    // dropped `conflicts_with` constraint.
-    assert_eq!(
-        out.status.code(),
-        Some(2),
-        "--check + --remove must be a clap usage error (exit 2); stdout=\n{stdout}\nstderr=\n{stderr}"
-    );
-    // clap reports the conflict on stderr and must not have run setup.
-    assert!(
-        stderr.contains("--check") && stderr.contains("--remove"),
-        "usage error must name the conflicting flags; stderr=\n{stderr}"
-    );
-    assert!(
-        stdout.trim().is_empty(),
-        "rejected invocation must not emit a normal result envelope; stdout=\n{stdout}"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// Property 5 — in-repo and committable. `setup` writes only inside the working
-// tree, never to `$HOME` or any global location.
-// (CLI_CONTRACT.md → "Setup command contract", property 5.)
-// ---------------------------------------------------------------------------
-
-#[test]
-fn setup_writes_only_inside_repo() {
-    let proj = tempfile::tempdir().expect("proj");
-    let home = tempfile::tempdir().expect("home");
-    let pkg = proj.path().join("package.json");
-    write(&pkg, r#"{ "name": "x", "version": "1.0.0" }"#);
-
-    // Sentinel HOME starts empty; setup must leave it empty.
-    assert!(
-        files_under(home.path()).is_empty(),
-        "sentinel HOME must start empty"
-    );
-
-    let mut cmd = setup_command(proj.path(), &["setup", "--json", "--yes"]);
-    // Redirect HOME at the sentinel and disable telemetry so the only writes we
-    // could observe are setup's own manifest edits. (Seed after the scrub —
-    // the helper keeps TELEMETRY vars anyway, but the write matters here.)
-    cmd.env("HOME", home.path());
-    cmd.env("SOCKET_TELEMETRY_DISABLED", "1");
-    let out = cmd.output().expect("run socket-patch");
-    let stderr = String::from_utf8_lossy(&out.stderr);
-    assert_eq!(
-        out.status.code(),
-        Some(0),
-        "setup should succeed; stderr=\n{stderr}"
-    );
-
-    // Nothing was written outside the repo.
-    assert!(
-        files_under(home.path()).is_empty(),
-        "setup must not write outside --cwd; HOME gained: {:?}",
-        files_under(home.path())
-    );
-    // The only file in the project is the package.json it edited — no marker or
-    // auxiliary files conjured beside it.
-    assert_eq!(
-        files_under(proj.path()),
-        BTreeSet::from(["package.json".to_string()]),
-        "setup must touch only in-repo manifests"
-    );
-    // Not vacuous: it really did wire the hook into that in-repo file.
-    assert!(
-        std::fs::read_to_string(&pkg)
-            .unwrap()
-            .contains("socket-patch"),
-        "setup must have edited the in-repo package.json"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// Property 6 — clone-portable. Setup state is committed files only, so a fresh
-// checkout on another host inherits it; `--check` passes on the clone with no
-// re-run and no writes. (CLI_CONTRACT.md → "Setup command contract", property 6.)
-// ---------------------------------------------------------------------------
-
-#[test]
-fn setup_state_is_clone_portable() {
-    let a = tempfile::tempdir().expect("a");
-    write(
-        &a.path().join("package.json"),
-        r#"{ "name": "x", "version": "1.0.0" }"#,
-    );
-    let (c, _) = run_setup(a.path(), &["--yes"]);
-    assert_eq!(c, 0, "initial setup must succeed");
-
-    // "Clone": copy the committed tree into a brand-new directory on a notional
-    // other host. (node_modules isn't committed, so only manifests travel.)
-    let b = tempfile::tempdir().expect("b");
-    copy_tree(a.path(), b.path());
-
-    let before = std::fs::read_to_string(b.path().join("package.json")).unwrap();
-    let (code, stdout) = run_setup(b.path(), &["--check"]);
-    assert_eq!(
-        code, 0,
-        "the clone must already be configured; stdout=\n{stdout}"
-    );
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(v["status"], "configured");
-    assert_eq!(v["needsConfiguration"], 0);
-    // `--check` on the clone is read-only.
-    assert_eq!(
-        std::fs::read_to_string(b.path().join("package.json")).unwrap(),
-        before,
-        "--check must not modify the clone"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// Property 9 (base case) — nested workspaces. For a non-pnpm npm workspace, the
-// root AND every member package.json are configured. (The pnpm root-only carve-
-// out is covered by `setup_pnpm_monorepo_only_updates_root`.)
-// (CLI_CONTRACT.md → "Setup command contract", property 9.)
-// ---------------------------------------------------------------------------
-
-#[test]
-fn setup_configures_npm_workspace_members() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write(
-        &tmp.path().join("package.json"),
-        r#"{ "name": "root", "workspaces": ["packages/*"] }"#,
-    );
-    write(
-        &tmp.path().join("packages/a/package.json"),
-        r#"{ "name": "a", "version": "1.0.0" }"#,
-    );
-    write(
-        &tmp.path().join("packages/b/package.json"),
-        r#"{ "name": "b", "version": "1.0.0" }"#,
-    );
-
-    let (code, stdout) = run_setup(tmp.path(), &["--yes"]);
-    assert_eq!(code, 0, "workspace setup should succeed; stdout=\n{stdout}");
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(v["status"], "success");
-    assert_eq!(
-        v["updated"], 3,
-        "root + both members must each be configured; stdout=\n{stdout}"
-    );
-    for member in [
-        "package.json",
-        "packages/a/package.json",
-        "packages/b/package.json",
-    ] {
-        let content = std::fs::read_to_string(tmp.path().join(member)).unwrap();
-        assert!(
-            content.contains("socket-patch"),
-            "workspace member {member} must gain the hook; got:\n{content}"
-        );
-    }
-}
-
-// ---------------------------------------------------------------------------
-// Gem (Bundler) — wires a committed plugin into the Gemfile (property 3).
-// The full check/remove round-trip + plugins.rb content lives in
-// setup_matrix_gem.rs; these pin the dry-run no-op and the mixed-ecosystem
-// dispatch alongside npm.
-// ---------------------------------------------------------------------------
-
-const GEMFILE_FIXTURE: &str = "source 'https://rubygems.org'\ngem 'colorize', '1.1.0'\n";
-
-fn write_supported_gem_project(root: &Path) {
-    write(&root.join("Gemfile"), GEMFILE_FIXTURE);
-    // These tests exercise setup, not discovery of the host's Bundler version.
-    write(&root.join("Gemfile.lock"), "BUNDLED WITH\n   2.7.2\n");
-}
-
-#[test]
-fn setup_gem_dry_run_does_not_modify_gemfile() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let gemfile = tmp.path().join("Gemfile");
-    write_supported_gem_project(tmp.path());
-
-    let (code, stdout) = run_setup(tmp.path(), &["--dry-run"]);
-    assert_eq!(code, 0, "dry-run should succeed; stdout=\n{stdout}");
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(v["status"], "dry_run");
-    assert_eq!(v["dryRun"], true);
-
-    // The Gemfile must be byte-identical and no plugin dir created.
-    assert_eq!(
-        std::fs::read_to_string(&gemfile).unwrap(),
-        GEMFILE_FIXTURE,
-        "dry-run must not modify the Gemfile"
-    );
-    assert!(
-        !tmp.path().join(".socket/bundler-plugin").exists(),
-        "dry-run must not generate the plugin dir"
-    );
-}
-
-#[test]
-fn setup_configures_gem_alongside_npm() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write_supported_gem_project(tmp.path());
-    write(
-        &tmp.path().join("package.json"),
-        r#"{ "name": "mixed", "version": "1.0.0" }
-"#,
-    );
-
-    let (code, stdout) = run_setup(tmp.path(), &["--yes"]);
-    assert_eq!(code, 0, "mixed setup should succeed; stdout=\n{stdout}");
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(v["status"], "success");
-
-    // The envelope must carry both an npm package_json entry and the gem
-    // entries (gemfile + gem_plugin) — proof gem dispatch runs next to npm.
-    let kinds: BTreeSet<&str> = v["files"]
-        .as_array()
-        .expect("files[]")
-        .iter()
-        .filter_map(|f| f["kind"].as_str())
-        .collect();
-    assert!(
-        kinds.contains("package_json"),
-        "npm entry missing; kinds={kinds:?}"
-    );
-    assert!(
-        kinds.contains("gemfile"),
-        "gem Gemfile entry missing; kinds={kinds:?}"
-    );
-    assert!(
-        kinds.contains("gem_plugin"),
-        "gem plugin entry missing; kinds={kinds:?}"
-    );
-
-    // On disk: both manifests are wired.
-    assert!(std::fs::read_to_string(tmp.path().join("Gemfile"))
-        .unwrap()
-        .contains("plugin 'socket-patch'"));
-    assert!(std::fs::read_to_string(tmp.path().join("package.json"))
-        .unwrap()
-        .contains("socket-patch"));
-}
-
-/// After wiring the Bundler plugin, `setup` materializes gem patches by
-/// spawning `apply` — and that nested run must read the manifest THIS run was
-/// pointed at, not the default `.socket/manifest.json`.
-///
-/// Regression: the spawned command passed `--cwd` but dropped
-/// `--manifest-path`, so a project keeping its patches anywhere else had the
-/// nested run open the wrong file. Both directions of that are silent (a
-/// missing manifest is a clean exit-0 no-op for `apply`), so the observable
-/// pin uses an unparseable manifest at the DEFAULT path: reading it fails the
-/// nested run and surfaces the "materializing gem patches" warning. With
-/// `--manifest-path` honored, the run reads the (valid, empty) manifest it was
-/// given and warns about nothing.
-#[test]
-fn setup_gem_materialization_honors_manifest_path() {
-    // Control first: with no `--manifest-path`, the poisoned default manifest
-    // IS what the nested apply reads, so the warning must appear. Without this
-    // the assertion below could pass for the wrong reason (e.g. the warning
-    // vanishing for some unrelated change).
-    let control = tempfile::tempdir().expect("tempdir");
-    write_supported_gem_project(control.path());
-    write(
-        &control.path().join(".socket/manifest.json"),
-        "not json {{{",
-    );
-    let (code, stdout) = run_setup(control.path(), &["--yes"]);
-    assert_eq!(code, 0, "gem setup should succeed; stdout=\n{stdout}");
-    assert!(
-        stdout.contains("materializing gem patches"),
-        "control: an unreadable default manifest must make the materialization \
-         step warn — otherwise this test proves nothing; stdout=\n{stdout}"
-    );
-
-    // Same fixture, but the run is pointed at a valid manifest elsewhere. The
-    // nested apply must use it, so no materialization warning is emitted.
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write_supported_gem_project(tmp.path());
-    write(&tmp.path().join(".socket/manifest.json"), "not json {{{");
-    write(&tmp.path().join("custom/patches.json"), r#"{"patches":{}}"#);
-
-    let (code, stdout) = run_setup(
-        tmp.path(),
-        &["--yes", "--manifest-path", "custom/patches.json"],
-    );
-    assert_eq!(code, 0, "gem setup should succeed; stdout=\n{stdout}");
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(v["status"], "success");
-    assert!(
-        // Every materialization-warning variant carries "gem patches", so this
-        // also catches the spawn-failed spellings rather than just the
-        // nonzero-exit one the control pins.
-        !stdout.contains("gem patches"),
-        "the nested apply must read the manifest `--manifest-path` names, not \
-         the default `.socket/manifest.json`; stdout=\n{stdout}"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// vlt: npm's npx hook, root-only workspaces, and the
-// `vlt_root_scripts_not_run` advisory. Every run pins PATH to a directory
-// holding at most a fake `vlt`, so the host's own vlt never decides.
-// ---------------------------------------------------------------------------
-
-const NPX_HOOK: &str = "npx @socketsecurity/socket-patch apply --silent --ecosystems npm";
-const VLT_ADVISORY_PREFIX: &str = "vlt_root_scripts_not_run: vlt before 1.0.0-rc.13 does not run \
-                                   the root postinstall hook; upgrade vlt or run `socket-patch \
-                                   apply` after `vlt ci`";
-
-/// A PATH directory with a `vlt` that runs `unix` (a `/bin/sh` body) or,
-/// on Windows, `windows` (a `vlt.cmd` body). `None` leaves it empty.
-fn vlt_path(bodies: Option<(&str, &str)>) -> tempfile::TempDir {
-    let dir = tempfile::tempdir().expect("tempdir");
-    if let Some((unix, windows)) = bodies {
-        if cfg!(windows) {
-            write(
-                &dir.path().join("vlt.cmd"),
-                &format!("@echo off\r\n{windows}\r\n"),
-            );
-        } else {
-            let shim = dir.path().join("vlt");
-            write(&shim, &format!("#!/bin/sh\n{unix}\n"));
-            #[cfg(unix)]
-            {
-                use std::os::unix::fs::PermissionsExt;
-                std::fs::set_permissions(&shim, std::fs::Permissions::from_mode(0o755))
-                    .expect("chmod shim");
-            }
-        }
-    }
-    dir
-}
-
-/// A `vlt --version` that reports `version`, but only when the probe
-/// disabled vlt's telemetry for the child.
-fn vlt_reporting(version: &str) -> tempfile::TempDir {
-    vlt_path(Some((
-        &format!("if [ \"$VLT_TELEMETRY\" = 0 ]; then echo {version}; else echo telemetry-on; fi"),
-        &format!("if \"%VLT_TELEMETRY%\"==\"0\" (echo {version}) else (echo telemetry-on)"),
-    )))
-}
-
-fn run_setup_with_path(cwd: &Path, path: &Path, extra: &[&str]) -> (i32, serde_json::Value) {
-    let mut args = vec!["setup", "--json"];
-    args.extend_from_slice(extra);
-    let out = setup_command(cwd, &args)
-        .env("PATH", path)
-        .output()
-        .expect("run socket-patch");
-    let stdout = String::from_utf8_lossy(&out.stdout).to_string();
-    let v = serde_json::from_str(&stdout).unwrap_or_else(|e| {
-        panic!(
-            "stdout must be JSON ({e}); stdout=\n{stdout}\nstderr=\n{}",
-            String::from_utf8_lossy(&out.stderr)
-        )
-    });
-    (out.status.code().unwrap_or(-1), v)
-}
-
-fn warnings(v: &serde_json::Value) -> Vec<String> {
-    v["warnings"]
-        .as_array()
-        .map(|w| {
-            w.iter()
-                .map(|s| s.as_str().expect("warning string").to_string())
-                .collect()
-        })
-        .unwrap_or_default()
-}
-
-fn vlt_project(lock: Option<&str>) -> tempfile::TempDir {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write(
-        &tmp.path().join("package.json"),
-        "{ \"name\": \"vlt-proj\", \"version\": \"1.0.0\" }\n",
-    );
-    match lock {
-        Some(lock) => write(&tmp.path().join("vlt-lock.json"), lock),
-        None => write(&tmp.path().join("vlt.json"), "{}\n"),
-    }
-    tmp
-}
-
-const VLT_LOCK_V1: &str =
-    "{\n  \"lockfileVersion\": 1,\n  \"options\": {},\n  \"nodes\": {},\n  \"edges\": {}\n}\n";
-const VLT_LOCK_V0: &str =
-    "{\n  \"lockfileVersion\": 0,\n  \"options\": {},\n  \"nodes\": {},\n  \"edges\": {}\n}\n";
-
-fn assert_npx_hooks(root: &Path) {
-    let pkg: serde_json::Value =
-        serde_json::from_str(&std::fs::read_to_string(root.join("package.json")).unwrap()).unwrap();
-    assert_eq!(pkg["scripts"]["postinstall"], NPX_HOOK, "{pkg}");
-    assert_eq!(pkg["scripts"]["dependencies"], NPX_HOOK, "{pkg}");
-}
-
-#[test]
-fn setup_detects_vlt_from_lockfile() {
-    let tmp = vlt_project(Some(VLT_LOCK_V1));
-    let path = vlt_path(None);
-    let (code, v) = run_setup_with_path(tmp.path(), path.path(), &["--yes"]);
-    assert_eq!(code, 0, "{v}");
-    assert_eq!(v["status"], "success", "{v}");
-    assert_eq!(v["packageManager"], "vlt", "{v}");
-    assert_npx_hooks(tmp.path());
-    assert!(
-        warnings(&v).is_empty(),
-        "no vlt on PATH and a v1 lock: no advisory; {v}"
-    );
-}
-
-#[test]
-fn setup_detects_vlt_from_vlt_json() {
-    let tmp = vlt_project(None);
-    // pnpm markers lose to vlt's.
-    write(
-        &tmp.path().join("pnpm-lock.yaml"),
-        "lockfileVersion: '9.0'\n",
-    );
-    let path = vlt_path(None);
-    let (code, v) = run_setup_with_path(tmp.path(), path.path(), &["--yes"]);
-    assert_eq!(code, 0, "{v}");
-    assert_eq!(v["packageManager"], "vlt", "{v}");
-    assert_npx_hooks(tmp.path());
-    assert!(warnings(&v).is_empty(), "{v}");
-}
-
-#[test]
-fn setup_detects_vlt_from_install_state() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write(
-        &tmp.path().join("package.json"),
-        "{ \"name\": \"vlt-proj\", \"version\": \"1.0.0\" }\n",
-    );
-    std::fs::create_dir_all(tmp.path().join("node_modules/.vlt")).unwrap();
-    let path = vlt_path(None);
-    let (code, v) = run_setup_with_path(tmp.path(), path.path(), &["--yes"]);
-    assert_eq!(code, 0, "{v}");
-    assert_eq!(v["packageManager"], "vlt", "{v}");
-    assert_npx_hooks(tmp.path());
-}
-
-#[test]
-fn setup_vlt_workspace_only_updates_root() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write(
-        &tmp.path().join("package.json"),
-        "{ \"name\": \"vlt-root\", \"version\": \"1.0.0\" }\n",
-    );
-    write(
-        &tmp.path().join("vlt.json"),
-        "{ \"workspaces\": { \"apps\": \"packages/*\" } }\n",
-    );
-    let members = ["packages/a/package.json", "packages/b/package.json"];
-    for member in members {
-        write(
-            &tmp.path().join(member),
-            "{ \"name\": \"m\", \"version\": \"1.0.0\" }\n",
-        );
-    }
-    let path = vlt_path(None);
-    let (code, v) = run_setup_with_path(tmp.path(), path.path(), &["--yes"]);
-    assert_eq!(code, 0, "{v}");
-    assert_eq!(v["packageManager"], "vlt", "{v}");
-    assert_eq!(v["updated"], 1, "{v}");
-    let files = v["files"].as_array().expect("files array");
-    assert_eq!(files.len(), 1, "{v}");
-    assert_npx_hooks(tmp.path());
-    for member in members {
-        let content = std::fs::read_to_string(tmp.path().join(member)).unwrap();
-        assert!(!content.contains("socket-patch"), "{member}: {content}");
-    }
-
-    let out = setup_command(tmp.path(), &["setup", "--check", "--json"])
-        .env("PATH", path.path())
-        .output()
-        .unwrap();
-    assert_eq!(out.status.code(), Some(0));
-    let check: serde_json::Value = serde_json::from_slice(&out.stdout).unwrap();
-    assert_eq!(check["status"], "configured", "{check}");
-    assert_eq!(check["configured"], 1, "root only: {check}");
-}
-
-#[test]
-fn setup_vlt_before_rc13_emits_the_definite_advisory() {
-    let tmp = vlt_project(Some(VLT_LOCK_V1));
-    let path = vlt_reporting("1.0.0-rc.12");
-    let definite = format!("{VLT_ADVISORY_PREFIX} (`vlt --version` reports 1.0.0-rc.12)");
-    for extra in [&["--dry-run"][..], &["--yes"], &["--yes"]] {
-        let (code, v) = run_setup_with_path(tmp.path(), path.path(), extra);
-        assert_eq!(code, 0, "{extra:?}: {v}");
-        assert_eq!(warnings(&v), vec![definite.clone()], "{extra:?}: {v}");
-    }
-    assert_npx_hooks(tmp.path());
-}
-
-#[test]
-fn setup_vlt_rc13_and_later_reads_the_lock_it_would_not_write() {
-    let may_v0 = format!(
-        "{VLT_ADVISORY_PREFIX} (vlt-lock.json has lockfileVersion 0, so this project may be \
-         installed by such a vlt)"
-    );
-    let may_a0 = format!(
-        "{VLT_ADVISORY_PREFIX} (vlt-lock.json has no lockfileVersion, so this project may be \
-         installed by such a vlt)"
-    );
-    let a0 = "{\"nodes\":{},\"edges\":{}}\n";
-    for (version, lock, want) in [
-        ("1.0.0-rc.13", VLT_LOCK_V0, None),
-        ("1.0.0-rc.14", VLT_LOCK_V0, None),
-        ("1.0.0-rc.15", VLT_LOCK_V0, Some(&may_v0)),
-        ("1.2.0", VLT_LOCK_V0, Some(&may_v0)),
-        ("1.0.0-rc.14", a0, Some(&may_a0)),
-        ("1.2.0", a0, Some(&may_a0)),
-        ("1.0.0-rc.13", VLT_LOCK_V1, None),
-        ("1.2.0", VLT_LOCK_V1, None),
-    ] {
-        let tmp = vlt_project(Some(lock));
-        let path = vlt_reporting(version);
-        let (code, v) = run_setup_with_path(tmp.path(), path.path(), &["--yes"]);
-        assert_eq!(code, 0, "{version} {lock}: {v}");
-        let want: Vec<String> = want.into_iter().cloned().collect();
-        assert_eq!(warnings(&v), want, "{version} {lock}: {v}");
-    }
-}
-
-#[test]
-fn setup_vlt_unparseable_version_emits_no_advisory() {
-    let tmp = vlt_project(Some(VLT_LOCK_V0));
-    let path = vlt_reporting("not-a-version");
-    let (code, v) = run_setup_with_path(tmp.path(), path.path(), &["--yes"]);
-    assert_eq!(code, 0, "{v}");
-    assert!(warnings(&v).is_empty(), "{v}");
-}
-
-#[test]
-fn setup_vlt_without_a_usable_vlt_reads_the_lock() {
-    let may_v0 = format!(
-        "{VLT_ADVISORY_PREFIX} (vlt-lock.json has lockfileVersion 0, so this project may be \
-         installed by such a vlt)"
-    );
-    let may_a0 = format!(
-        "{VLT_ADVISORY_PREFIX} (vlt-lock.json has no lockfileVersion, so this project may be \
-         installed by such a vlt)"
-    );
-    let failing = vlt_path(Some((
-        "echo 1.0.0-rc.12; exit 3",
-        "echo 1.0.0-rc.12\r\nexit /b 3",
-    )));
-    let missing = vlt_path(None);
-    for (path, lock, want) in [
-        (&missing, VLT_LOCK_V0, Some(&may_v0)),
-        (&missing, "{\"nodes\":{},\"edges\":{}}\n", Some(&may_a0)),
-        (&missing, VLT_LOCK_V1, None),
-        (&failing, VLT_LOCK_V0, Some(&may_v0)),
-        (&failing, VLT_LOCK_V1, None),
-    ] {
-        let tmp = vlt_project(Some(lock));
-        let (code, v) = run_setup_with_path(tmp.path(), path.path(), &["--yes"]);
-        assert_eq!(code, 0, "{lock}: {v}");
-        let want: Vec<String> = want.into_iter().cloned().collect();
-        assert_eq!(warnings(&v), want, "{lock}: {v}");
-    }
-}
-
-#[cfg(unix)]
-#[test]
-fn setup_vlt_version_probe_times_out_to_the_lock_sniff() {
-    let tmp = vlt_project(Some(VLT_LOCK_V0));
-    let path = vlt_path(Some(("exec /bin/sleep 60", "")));
-    let started = std::time::Instant::now();
-    let (code, v) = run_setup_with_path(tmp.path(), path.path(), &["--yes"]);
-    let elapsed = started.elapsed();
-    assert_eq!(code, 0, "{v}");
-    assert!(
-        elapsed >= std::time::Duration::from_secs(5)
-            && elapsed < std::time::Duration::from_secs(30),
-        "the probe must wait out its 5 s budget and no longer: {elapsed:?}"
-    );
-    assert_eq!(
-        warnings(&v),
-        vec![format!(
-            "{VLT_ADVISORY_PREFIX} (vlt-lock.json has lockfileVersion 0, so this project may \
-             be installed by such a vlt)"
-        )],
-        "{v}"
-    );
-}
-
-#[test]
-fn setup_npm_project_never_probes_vlt() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    write(
-        &tmp.path().join("package.json"),
-        "{ \"name\": \"npm-proj\", \"version\": \"1.0.0\" }\n",
-    );
-    let path = vlt_reporting("1.0.0-rc.12");
-    let (code, v) = run_setup_with_path(tmp.path(), path.path(), &["--yes"]);
-    assert_eq!(code, 0, "{v}");
-    assert_eq!(v["packageManager"], "npm", "{v}");
-    assert!(warnings(&v).is_empty(), "{v}");
-}
-
-#[test]
-fn setup_remove_clears_hooks_older_releases_wrote_into_vlt_members() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let wired = format!(
-        "{{ \"name\": \"m\", \"version\": \"1.0.0\", \"scripts\": {{ \"postinstall\": \
-         \"{NPX_HOOK}\", \"dependencies\": \"{NPX_HOOK}\" }} }}\n"
-    );
-    write(&tmp.path().join("package.json"), &wired);
-    write(
-        &tmp.path().join("vlt.json"),
-        "{ \"workspaces\": \"packages/*\" }\n",
-    );
-    write(&tmp.path().join("packages/a/package.json"), &wired);
-    write(&tmp.path().join("packages/excluded/package.json"), &wired);
-    let clean = "{ \"name\": \"c\", \"version\": \"1.0.0\" }\n";
-    write(&tmp.path().join("packages/clean/package.json"), clean);
-    let path = vlt_path(None);
-
-    let out = setup_command(
-        tmp.path(),
-        &[
-            "setup",
-            "--remove",
-            "--yes",
-            "--json",
-            "--exclude",
-            "packages/excluded",
-        ],
-    )
-    .env("PATH", path.path())
-    .output()
-    .expect("run socket-patch");
-    let v: serde_json::Value = serde_json::from_slice(&out.stdout).expect("remove JSON");
-    assert_eq!(out.status.code(), Some(0), "{v}");
-    assert_eq!(v["status"], "success", "{v}");
-    assert_eq!(v["removed"], 2, "root and the hooked member: {v}");
-    assert_eq!(v["notConfigured"], 0, "a clean member is not visited: {v}");
-    for rel in ["package.json", "packages/a/package.json"] {
-        let content = std::fs::read_to_string(tmp.path().join(rel)).unwrap();
-        assert!(!content.contains("socket-patch"), "{rel}: {content}");
-    }
-    assert_eq!(
-        std::fs::read_to_string(tmp.path().join("packages/excluded/package.json")).unwrap(),
-        wired,
-        "an excluded member is never touched"
-    );
-    assert_eq!(
-        std::fs::read_to_string(tmp.path().join("packages/clean/package.json")).unwrap(),
-        clean
-    );
-}
diff --git a/crates/socket-patch-cli/tests/setup_matrix_common/mod.rs b/crates/socket-patch-cli/tests/setup_matrix_common/mod.rs
deleted file mode 100644
index d12f572d..00000000
--- a/crates/socket-patch-cli/tests/setup_matrix_common/mod.rs
+++ /dev/null
@@ -1,715 +0,0 @@
-//! Shared harness for the experimental `socket-patch setup` end-to-end
-//! test matrix (`tests/setup_matrix_*.rs`, gated by the `setup-e2e`
-//! feature).
-//!
-//! Each `setup_matrix_<eco>.rs` wrapper pulls this in with
-//! `#[path = "setup_matrix_common/mod.rs"] mod smc;` and calls
-//! [`run_pm`] for each package manager it covers. The wrappers are
-//! thin; ALL the flow logic lives in the single bash driver
-//! `tests/setup_matrix/run-case.sh`, which this module invokes either
-//! inside a Docker container (default) or on the host
-//! (`SOCKET_PATCH_TEST_HOST=1`). The declarative case list comes from
-//! `tests/setup_matrix/matrix.json` — the same spec the
-//! `scripts/setup-matrix.sh` orchestrator consumes.
-//!
-//! ASPIRATIONAL assertion: each case asserts the *ideal* — that after
-//! `setup` + a native install, the patch is (or isn't) applied as the
-//! scenario expects. For ecosystems whose install hooks `setup` does
-//! not yet configure, the `baseline_with_setup` / `alt_content_patchset`
-//! cases are EXPECTED to fail; the failure message tags them
-//! `BASELINE GAP` so the red is understood as a TODO, not a surprise.
-//!
-//! `#![allow(dead_code)]` — wrappers use different subsets of this API.
-
-#![allow(dead_code)]
-
-use std::path::{Path, PathBuf};
-use std::process::Command;
-use std::sync::OnceLock;
-
-/// Path to the built binary under test (host mode passes this to the
-/// driver via `SOCKET_PATCH_BIN`).
-fn binary() -> PathBuf {
-    env!("CARGO_BIN_EXE_socket-patch").into()
-}
-
-/// Build the pure-python `socket-patch-hook` wheel once and cache the path.
-/// The pypi cases need it to exercise the `.pth` post-install hook; returns
-/// `None` if the build fails (those cases then degrade to a gap). Requires
-/// `python3` on PATH (always present in the pypi image / host pypi runs).
-fn hook_wheel() -> Option<PathBuf> {
-    static CELL: OnceLock<Option<PathBuf>> = OnceLock::new();
-    CELL.get_or_init(|| {
-        let root = workspace_root();
-        let dist = root.join("target/setup-matrix-hook");
-        std::fs::create_dir_all(&dist).ok()?;
-        let version = env!("CARGO_PKG_VERSION");
-        let ok = Command::new("python3")
-            .arg(root.join("scripts/build-pypi-wheels.py"))
-            .args(["--version", version, "--hook-only", "--dist"])
-            .arg(&dist)
-            .stdout(std::process::Stdio::null())
-            .status()
-            .map(|s| s.success())
-            .unwrap_or(false);
-        if !ok {
-            return None;
-        }
-        let wheel = dist.join(format!("socket_patch_hook-{version}-py3-none-any.whl"));
-        wheel.exists().then_some(wheel)
-    })
-    .clone()
-}
-
-/// Workspace root = two levels up from this crate's manifest dir.
-fn workspace_root() -> PathBuf {
-    Path::new(env!("CARGO_MANIFEST_DIR"))
-        .parent()
-        .and_then(|p| p.parent())
-        .expect("workspace root")
-        .to_path_buf()
-}
-
-fn driver_path() -> PathBuf {
-    workspace_root().join("tests/setup_matrix/run-case.sh")
-}
-
-fn matrix_path() -> PathBuf {
-    workspace_root().join("tests/setup_matrix/matrix.json")
-}
-
-/// Host mode runs the driver against host-installed toolchains instead
-/// of a container. Mirrors the `docker_e2e_*` convention.
-fn host_mode() -> bool {
-    std::env::var("SOCKET_PATCH_TEST_HOST")
-        .map(|v| v == "1")
-        .unwrap_or(false)
-}
-
-fn docker_on_path() -> bool {
-    Command::new("docker")
-        .arg("--version")
-        .stdout(std::process::Stdio::null())
-        .stderr(std::process::Stdio::null())
-        .status()
-        .map(|s| s.success())
-        .unwrap_or(false)
-}
-
-fn image_present(image: &str) -> bool {
-    Command::new("docker")
-        .args([
-            "image",
-            "inspect",
-            &format!("socket-patch-test-{image}:latest"),
-        ])
-        .stdout(std::process::Stdio::null())
-        .stderr(std::process::Stdio::null())
-        .status()
-        .map(|s| s.success())
-        .unwrap_or(false)
-}
-
-/// One concrete case = a (target, scenario) pair from matrix.json.
-/// `pub` (with private fields) so wrapper suites can obtain real cases via
-/// [`load_section`] and regression-test the validators without docker.
-#[derive(Clone)]
-pub struct Case {
-    id: String,
-    ecosystem: String,
-    pm: String,
-    image: String,
-    scenario: String,
-    patchset: String,
-    run_setup: bool,
-    expect_applied: bool,
-    baseline_supported: bool,
-    /// On the temporary `known_regressions` allowlist in matrix.json: a case the
-    /// baseline says should work but currently doesn't — tracked + tolerated
-    /// (non-blocking), not a hard failure, until the underlying hook is fixed.
-    known_regression: bool,
-    package: String,
-    version: String,
-    purl: String,
-    manifest_key: String,
-    apply_ecosystems: String,
-    marker: String,
-    alt_marker: String,
-    layout: String,
-}
-
-impl Case {
-    /// Baseline outcome: applied is expected only when the target
-    /// advertises `baseline_supported` (the PMs whose install hook `setup`
-    /// wires: npm family, pip/uv/hatch, bundler, composer) AND the scenario
-    /// aspires to apply.
-    fn baseline_applied(&self) -> bool {
-        self.expect_applied && self.baseline_supported
-    }
-
-    /// npm-family package managers (plus the polyglot monorepo's npm slice)
-    /// are the cases where the driver runs the check/remove round-trip;
-    /// other supported ecosystems (pypi, gem, composer) are round-tripped by
-    /// their host_guard tests instead.
-    fn is_npm_family(&self) -> bool {
-        matches!(self.pm.as_str(), "npm" | "yarn" | "pnpm" | "bun" | "vlt")
-            || self.layout == "monorepo"
-    }
-
-    fn sm_env(&self) -> Vec<(String, String)> {
-        vec![
-            ("SM_ID".into(), self.id.clone()),
-            ("SM_ECOSYSTEM".into(), self.ecosystem.clone()),
-            ("SM_PM".into(), self.pm.clone()),
-            ("SM_SCENARIO".into(), self.scenario.clone()),
-            ("SM_PATCHSET".into(), self.patchset.clone()),
-            (
-                "SM_RUN_SETUP".into(),
-                if self.run_setup { "1" } else { "0" }.into(),
-            ),
-            (
-                "SM_EXPECT_APPLIED".into(),
-                if self.expect_applied { "1" } else { "0" }.into(),
-            ),
-            ("SM_PACKAGE".into(), self.package.clone()),
-            ("SM_VERSION".into(), self.version.clone()),
-            ("SM_PURL".into(), self.purl.clone()),
-            ("SM_MANIFEST_KEY".into(), self.manifest_key.clone()),
-            ("SM_APPLY_ECOSYSTEMS".into(), self.apply_ecosystems.clone()),
-            ("SM_MARKER".into(), self.marker.clone()),
-            ("SM_ALT_MARKER".into(), self.alt_marker.clone()),
-            ("SM_LAYOUT".into(), self.layout.clone()),
-        ]
-    }
-}
-
-/// Load every case for a given (ecosystem, pm) by crossing the matching
-/// target in `targets_key` with every scenario in `scenarios_key`,
-/// tagging each with `layout`. `targets_key`/`scenarios_key` select the
-/// spec section: ("targets","scenarios") for single projects,
-/// ("workspace_targets","workspace_scenarios") for nested workspaces,
-/// ("monorepo_targets","monorepo_scenarios") for the polyglot monorepo.
-/// `pub` so wrapper suites can load real cases for validator regression tests.
-pub fn load_section(
-    targets_key: &str,
-    scenarios_key: &str,
-    layout: &str,
-    ecosystem: &str,
-    pm: &str,
-) -> Vec<Case> {
-    let text =
-        std::fs::read_to_string(matrix_path()).unwrap_or_else(|e| panic!("read matrix.json: {e}"));
-    let spec: serde_json::Value = serde_json::from_str(&text).expect("parse matrix.json");
-    let marker = spec["marker"].as_str().unwrap_or("").to_string();
-    let alt_marker = spec["alt_marker"].as_str().unwrap_or("").to_string();
-    let known_regressions: std::collections::HashSet<String> = spec["known_regressions"]
-        .as_array()
-        .map(|a| {
-            a.iter()
-                .filter_map(|v| v.as_str().map(String::from))
-                .collect()
-        })
-        .unwrap_or_default();
-
-    let target = spec[targets_key]
-        .as_array()
-        .unwrap_or_else(|| panic!("{targets_key} array missing"))
-        .iter()
-        .find(|t| t["ecosystem"] == ecosystem && t["pm"] == pm)
-        .unwrap_or_else(|| panic!("no {targets_key} entry for {ecosystem}/{pm}"));
-
-    let mut cases = Vec::new();
-    for s in spec[scenarios_key].as_array().expect("scenarios array") {
-        let scenario = s["id"].as_str().unwrap().to_string();
-        let case_id = format!("{ecosystem}/{pm}/{scenario}");
-        cases.push(Case {
-            id: case_id.clone(),
-            ecosystem: ecosystem.to_string(),
-            pm: pm.to_string(),
-            image: target["image"].as_str().unwrap().to_string(),
-            scenario,
-            patchset: s["patchset"].as_str().unwrap().to_string(),
-            run_setup: s["run_setup"].as_bool().unwrap(),
-            expect_applied: s["expect_applied"].as_bool().unwrap(),
-            baseline_supported: target["baseline_supported"].as_bool().unwrap(),
-            known_regression: known_regressions.contains(&case_id),
-            package: target["package"].as_str().unwrap().to_string(),
-            version: target["version"].as_str().unwrap().to_string(),
-            purl: target["purl"].as_str().unwrap().to_string(),
-            manifest_key: target["manifest_key"].as_str().unwrap().to_string(),
-            apply_ecosystems: target["apply_ecosystems"].as_str().unwrap().to_string(),
-            marker: marker.clone(),
-            alt_marker: alt_marker.clone(),
-            layout: layout.to_string(),
-        });
-    }
-    cases
-}
-
-/// `pub` (like [`host_driver_command`]) so wrapper suites can synthesize
-/// driver results and regression-test [`round_trip_failure`] without docker.
-pub struct RunResult {
-    pub actual_applied: bool,
-    pub raw: String,
-    pub parsed: Option<serde_json::Value>,
-}
-
-/// Build the host-mode driver invocation: `bash run-case.sh` with the
-/// case's `SM_*` env, the binary under test, and (for pypi) the hook
-/// wheel. `pub` so the `setup_matrix_env_guard` wrapper can inspect the
-/// exact `Command` `run_case` spawns.
-pub fn host_driver_command(env: &[(String, String)], wheel: Option<&Path>) -> Command {
-    let mut cmd = Command::new("bash");
-    cmd.arg(driver_path());
-    // Host mode inherits the parent process's environment, and the driver
-    // passes it straight through to the binary under test AND the native
-    // package-manager installs. Scrub the ambient surface that can flip a
-    // verdict for the wrong reason BEFORE seeding the case env (docker mode
-    // is naturally immune — only the explicit `-e` vars cross over):
-    //   * SOCKET_*     — global-flag fallbacks of the binary under test:
-    //     SOCKET_DRY_RUN=true no-ops the hook's apply, SOCKET_CWD recreates
-    //     the workspace-breaking mode run-case.sh documents it must avoid,
-    //     SOCKET_MANIFEST_PATH/SOCKET_GLOBAL retarget it. The driver
-    //     re-exports the ones it needs (OFFLINE/FORCE/API_TOKEN/...);
-    //     telemetry opt-outs are kept so an opted-out dev stays opted out.
-    //     Also covers a stale ambient SOCKET_PATCH_HOOK_WHEEL.
-    //   * SM_*         — the driver's own contract; an ambient SM_WORKDIR
-    //     would make every parallel case share one scratch dir (the races
-    //     the driver's blob_tmp comment warns about).
-    //   * npm_config_* / YARN_* — PM config that changes whether lifecycle
-    //     hooks even fire (npm_config_ignore_scripts, YARN_ENABLE_SCRIPTS)
-    //     or where installs resolve from.
-    //   * VIRTUAL_ENV / SETUP_MATRIX_SHIM_DIR — hijack the python crawler /
-    //     the shims' PATH-cleanup logic.
-    for (key, _) in std::env::vars_os() {
-        let name = key.to_string_lossy();
-        let hit = ["SOCKET_", "SM_", "YARN_"]
-            .iter()
-            .any(|p| name.starts_with(p))
-            || name.to_ascii_lowercase().starts_with("npm_config_")
-            || name == "VIRTUAL_ENV"
-            || name == "SETUP_MATRIX_SHIM_DIR";
-        if hit && !name.contains("TELEMETRY") {
-            cmd.env_remove(&key);
-        }
-    }
-    for (k, v) in env {
-        cmd.env(k, v);
-    }
-    cmd.env("SOCKET_PATCH_BIN", binary());
-    if let Some(w) = wheel {
-        cmd.env("SOCKET_PATCH_HOOK_WHEEL", w);
-    }
-    cmd
-}
-
-/// Execute one case via the bash driver (container or host) and parse
-/// its JSON result line.
-fn run_case(case: &Case) -> RunResult {
-    let driver = driver_path();
-    let env = case.sm_env();
-
-    // The pypi cases need the prebuilt hook wheel to exercise the `.pth`
-    // post-install hook; other ecosystems ignore it.
-    let wheel = if case.ecosystem == "pypi" {
-        hook_wheel()
-    } else {
-        None
-    };
-
-    let output = if host_mode() {
-        host_driver_command(&env, wheel.as_deref())
-            .output()
-            .expect("spawn bash driver")
-    } else {
-        let script =
-            std::fs::read_to_string(&driver).unwrap_or_else(|e| panic!("read driver: {e}"));
-        let mut cmd = Command::new("docker");
-        cmd.args(["run", "--rm"]);
-        for (k, v) in &env {
-            cmd.args(["-e", &format!("{k}={v}")]);
-        }
-        // Mount the hook wheel into the container, PRESERVING its PEP 427
-        // filename (pip/uv/pdm reject a wheel whose filename isn't a valid
-        // `{name}-{ver}-{tags}.whl`, so we must not rename it on mount).
-        if let Some(w) = &wheel {
-            let name = w
-                .file_name()
-                .and_then(|n| n.to_str())
-                .expect("hook wheel filename");
-            let dest = format!("/tmp/{name}");
-            cmd.args([
-                "-v",
-                &format!("{}:{}:ro", w.display(), dest),
-                "-e",
-                &format!("SOCKET_PATCH_HOOK_WHEEL={dest}"),
-            ]);
-        }
-        cmd.arg(format!("socket-patch-test-{}:latest", case.image));
-        cmd.args(["bash", "-c", &script]);
-        cmd.output().expect("spawn docker run")
-    };
-
-    let stdout = String::from_utf8_lossy(&output.stdout).to_string();
-    let stderr = String::from_utf8_lossy(&output.stderr).to_string();
-
-    // The driver prints its result JSON as the last matching stdout line.
-    let line = stdout
-        .lines()
-        .rev()
-        .find(|l| l.trim_start().starts_with('{') && l.contains("actual_applied"));
-
-    let parsed = line.and_then(|l| serde_json::from_str::<serde_json::Value>(l).ok());
-    let actual_applied = parsed
-        .as_ref()
-        .and_then(|v| v["actual_applied"].as_bool())
-        .unwrap_or(false);
-
-    RunResult {
-        actual_applied,
-        raw: format!("stdout:\n{stdout}\nstderr:\n{stderr}"),
-        parsed,
-    }
-}
-
-/// Run the single-project scenarios for one (ecosystem, pm).
-pub fn run_pm(ecosystem: &str, pm: &str) {
-    run_cases(
-        &format!("{ecosystem}/{pm}"),
-        load_section("targets", "scenarios", "single", ecosystem, pm),
-    );
-}
-
-/// Run the nested-workspace scenarios for one (ecosystem, pm).
-pub fn run_workspace_pm(ecosystem: &str, pm: &str) {
-    run_cases(
-        &format!("{ecosystem}/{pm} [workspace]"),
-        load_section(
-            "workspace_targets",
-            "workspace_scenarios",
-            "workspace",
-            ecosystem,
-            pm,
-        ),
-    );
-}
-
-/// Run the polyglot all-ecosystem monorepo scenarios.
-pub fn run_monorepo() {
-    run_cases(
-        "monorepo",
-        load_section(
-            "monorepo_targets",
-            "monorepo_scenarios",
-            "monorepo",
-            "monorepo",
-            "mono",
-        ),
-    );
-}
-
-/// Execute a set of cases and assert each meets the ASPIRATIONAL
-/// expectation. Soft-skips when Docker / the ecosystem image is
-/// unavailable (container mode) — matching the `docker_e2e_*` convention
-/// where Rust integration tests have no native "skipped".
-fn run_cases(label: &str, cases: Vec<Case>) {
-    // A section with zero cases would make the final `failures.is_empty()`
-    // assertion pass having exercised nothing ("0 of 0 cases") — a vacuous
-    // green if matrix.json's scenarios/targets list is ever emptied or a key
-    // is renamed. `load_section` emits one case per scenario, so an empty
-    // vector here means the spec degenerated; fail loudly. Checked before the
-    // docker/image soft-skip because the spec is read regardless of runner.
-    assert!(
-        !cases.is_empty(),
-        "{label}: no setup-matrix cases were loaded from matrix.json — the \
-         scenario/target list is empty (would make this suite pass vacuously)"
-    );
-
-    if !host_mode() && !docker_on_path() {
-        eprintln!("skip {label}: docker not on PATH (set SOCKET_PATCH_TEST_HOST=1 to run on host)");
-        return;
-    }
-    if !host_mode() {
-        if let Some(c) = cases.first() {
-            if !image_present(&c.image) {
-                eprintln!(
-                    "skip {label}: image socket-patch-test-{}:latest not present \
-                     (build it: scripts/setup-matrix.sh build --ecosystem {})",
-                    c.image, c.image
-                );
-                return;
-            }
-        }
-    }
-
-    let mut failures = Vec::new();
-    for case in &cases {
-        let res = run_case(case);
-
-        // The bash driver MUST emit exactly one parseable result line carrying
-        // a real boolean `actual_applied`. If it does not (binary crashed,
-        // docker error, script aborted before `emit_result`, malformed JSON),
-        // the case never actually exercised setup+install. Without this guard
-        // `run_case` falls back to `actual_applied = false`, which silently
-        // satisfies EVERY `expect_applied == false` case — and makes the
-        // round-trip `?` no-op — turning a broken harness fully green for the
-        // wrong reason. Treat a missing/garbled result as a hard failure
-        // regardless of the aspirational expectation (allowlist included).
-        let applied = match res
-            .parsed
-            .as_ref()
-            .and_then(|v| v.get("actual_applied"))
-            .and_then(|v| v.as_bool())
-        {
-            Some(b) => b,
-            None => {
-                failures.push(format!(
-                    "  - {}: driver emitted no parseable result line with a boolean \
-                     `actual_applied` — the case did not run to completion (this is a \
-                     harness/binary failure, NOT a baseline gap)\n{}",
-                    case.id,
-                    indent(&res.raw)
-                ));
-                continue;
-            }
-        };
-
-        if applied != case.expect_applied {
-            if case.known_regression {
-                // On the temporary allowlist (matrix.json `known_regressions`):
-                // a tracked, non-blocking regression — report it but don't fail.
-                eprintln!(
-                    "  - {}: expected applied={}, got {} [KNOWN REGRESSION (allowlisted in \
-                     matrix.json; non-blocking — fix the hook + remove from the list)]",
-                    case.id, case.expect_applied, applied
-                );
-            } else {
-                let tag = if case.baseline_applied() {
-                    // We recorded this as working; failing now is a real regression.
-                    "REGRESSION (baseline says this should apply)"
-                } else if case.expect_applied {
-                    "BASELINE GAP (setup does not yet wire this package manager)"
-                } else {
-                    "LEAK (patch applied without the hook configuring it)"
-                };
-                failures.push(format!(
-                    "  - {}: expected applied={}, got {} [{}]\n{}",
-                    case.id,
-                    case.expect_applied,
-                    applied,
-                    tag,
-                    indent(&res.raw)
-                ));
-            }
-        }
-
-        // check/remove round-trip — only asserted for npm-family cases that
-        // ran setup. Other ecosystems either have no setup hook (no-op) or
-        // are round-tripped by their own host_guard tests.
-        if case.run_setup && case.is_npm_family() && !case.known_regression {
-            if let Some(msg) = round_trip_failure(case, &res) {
-                failures.push(msg);
-            }
-        }
-    }
-
-    // In docker mode the binary under test is the one BAKED INTO the local
-    // socket-patch-test-* image, not the workspace build — a weeks-old
-    // image fails current expectations deterministically and looks like a
-    // mystery regression (both report the same crate version, so only the
-    // image age gives it away). Say so in the failure message instead of
-    // letting the next person rediscover it.
-    let mode_hint = if host_mode() {
-        String::new()
-    } else {
-        let image = cases
-            .first()
-            .map(|c| c.image.as_str())
-            .unwrap_or("<ecosystem>");
-        format!(
-            "\nNOTE: docker mode ran the socket-patch binary baked into the \
-             local image (check its age: `docker images socket-patch-test-*`). \
-             A stale image fails current expectations without any real \
-             regression — rebuild first:\n  \
-             docker build -f tests/docker/Dockerfile.base -t socket-patch-test-base:latest .\n  \
-             docker build -f tests/docker/Dockerfile.{image} -t socket-patch-test-{image}:latest ."
-        )
-    };
-    assert!(
-        failures.is_empty(),
-        "{}: {} of {} setup-matrix case(s) did not meet the aspirational \
-         expectation. BASELINE GAP entries are the experimental TODO list \
-         (this suite is non-blocking in CI); REGRESSION / LEAK entries are \
-         real problems:\n{}{}",
-        label,
-        failures.len(),
-        cases.len(),
-        failures.join("\n"),
-        mode_hint
-    );
-}
-
-/// Validate the behavioral `(setup)·(install)` round-trip emitted by the driver.
-/// Verifies — through real install cycles, not by reading package.json — that:
-///
-/// 1. `setup --check` fails before setup, passes after the post-setup install
-///    (hook present AND on-disk patch consistency, per contract property 4),
-///    fails after `setup --remove` (and setup + remove themselves succeed);
-/// 2. the patch is NOT applied before setup and NOT applied after remove
-///    (the after-setup application is covered separately by the main
-///    `actual_applied == expect_applied` assertion).
-///
-/// Returns a failure message describing any violation, or `None` on success.
-pub fn round_trip_failure(case: &Case, res: &RunResult) -> Option<String> {
-    // The main loop already turns a missing result line into a hard failure
-    // and `continue`s before reaching here, so this branch is defensive: never
-    // silently treat an absent result as a passing round-trip.
-    let parsed = match res.parsed.as_ref() {
-        Some(p) => p,
-        None => {
-            return Some(format!(
-                "  - {}: setup/install behavioral round-trip could not be evaluated \
-                 — driver produced no parseable result JSON\n{}",
-                case.id,
-                indent(&res.raw)
-            ))
-        }
-    };
-    let int = |k: &str| parsed.get(k).and_then(|v| v.as_i64());
-    let boolean = |k: &str| parsed.get(k).and_then(|v| v.as_bool());
-
-    let mut problems = Vec::new();
-
-    // This branch runs ONLY for npm-family cases that ran setup, i.e. exactly
-    // the driver's full (install)·(setup)·(install)·(remove)·(install) path,
-    // which records every field below as a real value (never null). So every
-    // probe must be PRESENT with the right value; a missing/null field means
-    // the stage never ran and must be flagged, not tolerated.
-
-    // (2) patch-application bookends must be present AND false: the patch must
-    // NOT apply before any hook exists, and must NOT apply once it is removed.
-    let applied_before = boolean("applied_before_setup");
-    if applied_before != Some(false) {
-        problems.push(format!(
-            "applied_before_setup={applied_before:?} (want false: patch must NOT apply \
-             before a hook is configured)"
-        ));
-    }
-    let applied_after_remove = boolean("applied_after_remove");
-    if applied_after_remove != Some(false) {
-        problems.push(format!(
-            "applied_after_remove={applied_after_remove:?} (want false: patch must NOT \
-             apply once the hook is removed)"
-        ));
-    }
-
-    // The native install of the patched package must itself have succeeded,
-    // and the canonical after-setup verification must have found a real
-    // on-disk copy to inspect (`primary_marker_present` is null only when NO
-    // candidate file was found — which would make every "not applied" verdict
-    // vacuous). Both guard against a green round-trip that inspected nothing.
-    let install = int("install_exit");
-    if install != Some(0) {
-        problems.push(format!(
-            "install_exit={install:?} (want 0: the native install must succeed for the \
-             before/after probes to mean anything)"
-        ));
-    }
-    if boolean("primary_marker_present").is_none() {
-        problems.push(
-            "primary_marker_present null/missing: no installed file was found to verify \
-             (vacuous round-trip)"
-                .to_string(),
-        );
-    }
-
-    // `setup --yes` itself must succeed. `check-after-setup == 0` alone cannot
-    // catch a partial failure: setup aggregates errors across every manifest
-    // kind it edits (npm + python + gem + composer) and exits 1 on
-    // `partial_failure`, so it can land the npm hook (check passes, the patch
-    // applies) and still choke on another manifest — for the polyglot
-    // monorepo that IS the headline regression this suite exists to catch.
-    let setup = int("setup_exit");
-    if setup != Some(0) {
-        problems.push(format!(
-            "setup exit={setup:?} (want 0: `setup --yes` must succeed; non-zero means setup \
-             choked even if the npm hook landed)"
-        ));
-    }
-
-    // (1) `setup --check` exit code must track the configured state:
-    // non-zero before setup → 0 after setup → non-zero after remove. Each
-    // must be present; a null exit means the check step never ran.
-    let check_before = int("check_before_setup_exit");
-    let check_setup = int("check_after_setup_exit");
-    let remove = int("remove_exit");
-    let check_remove = int("check_after_remove_exit");
-
-    if !matches!(check_before, Some(n) if n != 0) {
-        problems.push(format!(
-            "check-before-setup exit={check_before:?} (want present & non-zero; not configured yet)"
-        ));
-    }
-    if check_setup != Some(0) {
-        problems.push(format!(
-            "check-after-setup exit={check_setup:?} (want 0; configured)"
-        ));
-    }
-    if remove != Some(0) {
-        problems.push(format!(
-            "remove exit={remove:?} (want 0; remove must succeed)"
-        ));
-    }
-    if !matches!(check_remove, Some(n) if n != 0) {
-        problems.push(format!(
-            "check-after-remove exit={check_remove:?} (want present & non-zero; hook still present)"
-        ));
-    }
-
-    if problems.is_empty() {
-        return None;
-    }
-    Some(format!(
-        "  - {}: setup/install behavioral round-trip failed [{}]\n{}",
-        case.id,
-        problems.join("; "),
-        indent(&res.raw)
-    ))
-}
-
-fn indent(s: &str) -> String {
-    s.lines()
-        .map(|l| format!("      {l}"))
-        .collect::<Vec<_>>()
-        .join("\n")
-}
-
-/// RAII setter for hostile ambient env decoys: sets each pair process-wide
-/// and removes them ALL on drop, so a panicking assertion mid-test can never
-/// leave the process env poisoned for the tests that run after it.
-///
-/// Process env is per-process, shared state. Any test that constructs this
-/// guard — and every other test in the same binary that spawns the CLI —
-/// must be `#[serial_test::serial]`: the child-env scrubs in the `run`
-/// helpers snapshot `std::env::vars_os()` and then spawn, and a concurrent
-/// `set_var` can land between the snapshot and the spawn, reaching the child
-/// un-scrubbed (the 2026-07 `setup_matrix_pypi` CI flake — the decoys made
-/// the sibling test's child abort at arg parse with exit 2).
-pub struct DecoyGuard(&'static [(&'static str, &'static str)]);
-
-impl DecoyGuard {
-    pub fn set(pairs: &'static [(&'static str, &'static str)]) -> Self {
-        for (k, v) in pairs {
-            std::env::set_var(k, v);
-        }
-        Self(pairs)
-    }
-}
-
-impl Drop for DecoyGuard {
-    fn drop(&mut self) {
-        for (k, _) in self.0 {
-            std::env::remove_var(k);
-        }
-    }
-}
diff --git a/crates/socket-patch-cli/tests/setup_matrix_composer.rs b/crates/socket-patch-cli/tests/setup_matrix_composer.rs
deleted file mode 100644
index 74c0dd81..00000000
--- a/crates/socket-patch-cli/tests/setup_matrix_composer.rs
+++ /dev/null
@@ -1,363 +0,0 @@
-//! setup-matrix: composer ecosystem (PHP). `setup` wires `socket-patch
-//! apply` into composer's `post-install-cmd` / `post-update-cmd` script
-//! events.
-//!
-//! IMPORTANT — why this file carries a real assertion of its own:
-//! `smc::run_pm("composer", "composer")` routes composer through the
-//! shared Docker matrix harness, which *soft-skips and silently passes*
-//! whenever Docker or the `composer` image is absent (the common case
-//! locally and in this eval). composer is also NOT npm-family, so the
-//! harness's check/remove behavioral round-trip is skipped entirely for
-//! it. The net effect: the matrix call can never turn red for a genuine
-//! composer `setup` regression. On its own it protects nothing.
-//!
-//! To close that loophole WITHOUT touching the shared harness,
-//! [`host_guard::composer_setup_round_trips_host`] runs unconditionally
-//! (no Docker, no network, no PHP / composer toolchain — `setup` edits
-//! `composer.json` directly) and pins the full wiring contract:
-//! `--check` fails pre-setup, `setup` wires the hook, `--check` then
-//! passes, and `--remove` restores the manifest byte-for-byte.
-//!
-//! Run: `cargo test -p socket-patch-cli --features setup-e2e --test setup_matrix_composer`
-#![cfg(feature = "setup-e2e")]
-
-#[path = "setup_matrix_common/mod.rs"]
-mod smc;
-
-#[path = "common/mod.rs"]
-mod common;
-
-#[path = "vex_e2e_common/mod.rs"]
-mod vex_e2e_common;
-
-/// Documentation/negative-control pass through the shared Docker matrix.
-/// Kept for parity with the other ecosystems and to run the composer
-/// negative controls when Docker + the `composer` image are present.
-/// NOTE: this is the path that silently no-ops on skip — it is NOT a
-/// regression guard. The real teeth live in [`host_guard`] below.
-#[test]
-fn composer() {
-    smc::run_pm("composer", "composer");
-}
-
-// ─────────────────────────────────────────────────────────────────────────
-// Real, non-skippable regression guard for composer `setup`: the full
-// wire → check → remove round-trip against a composer-only project,
-// driven entirely on the host (no PHP toolchain — `setup` edits
-// `composer.json` directly).
-// ─────────────────────────────────────────────────────────────────────────
-mod host_guard {
-    use std::path::Path;
-
-    /// A realistic composer-only project: a PHP manifest requiring the
-    /// same package the matrix targets, and nothing the npm/Python/Cargo
-    /// detectors would recognise. Indented with 4 spaces, the way composer
-    /// itself writes the file (PHP `JSON_PRETTY_PRINT`) — so the
-    /// byte-for-byte restore below also pins that `setup` does not reformat
-    /// a composer-authored manifest to serde's 2-space default.
-    const COMPOSER_JSON: &str = "{\n    \"name\": \"acme/widget\",\n    \"require\": {\n        \"monolog/monolog\": \"3.5.0\"\n    }\n}\n";
-
-    /// Run the CLI with `args` in `cwd`; returns `(exit_code, stdout, stderr)`.
-    /// Delegates to the shared `common::run_with_env`, which seeds-then-scrubs
-    /// the binary's entire ambient `SOCKET_*` surface — stripping only
-    /// `SOCKET_API_TOKEN` (as this helper originally did) left the guard at
-    /// the mercy of the parent shell: an ambient `SOCKET_ECOSYSTEMS=cargo`
-    /// filtered composer out of scope (first `--check` exits 0 as `no_files`),
-    /// and `SOCKET_DRY_RUN=true` no-ops the very write under test.
-    /// `SOCKET_TELEMETRY_DISABLED=1` is injected because this file promises
-    /// "no network": each real `setup` run otherwise fire-and-forgets a live
-    /// `patch_setup` POST to the telemetry endpoint.
-    fn run(cwd: &Path, args: &[&str]) -> (i32, String, String) {
-        super::common::run_with_env(cwd, args, &[("SOCKET_TELEMETRY_DISABLED", "1")])
-    }
-
-    /// Parse the CLI's `--json` stdout into the single top-level object the
-    /// command promises. Panics (loudly) if stdout is not exactly that — a
-    /// non-JSON / multi-line dump means the command did not run the path we
-    /// think it did.
-    fn parse_obj(stdout: &str, who: &str) -> serde_json::Value {
-        serde_json::from_str(stdout.trim()).unwrap_or_else(|e| {
-            panic!("{who}: stdout was not a single JSON object ({e}):\n{stdout}")
-        })
-    }
-
-    /// Immediate entry names under `root`, sorted — for proving the directory
-    /// was not littered with foreign artifacts.
-    fn dir_entries(root: &Path) -> Vec<String> {
-        let mut names: Vec<String> = std::fs::read_dir(root)
-            .unwrap_or_else(|e| panic!("read_dir({}): {e}", root.display()))
-            .map(|e| e.unwrap().file_name().to_string_lossy().into_owned())
-            .collect();
-        names.sort();
-        names
-    }
-
-    /// Assert composer.json is byte-for-byte what we wrote, AND that the
-    /// project directory still contains *only* composer.json. The directory
-    /// check is the real teeth: after `--remove` the project must hold
-    /// NOTHING else — not an npm `package.json` hook, not a `.socket/`
-    /// dir, not a lockfile, not a `.pth`, nothing. Probing for one specific
-    /// filename (`package.json`) would let any other foreign artifact through.
-    fn assert_manifest_pristine(root: &Path, who: &str) {
-        assert_eq!(
-            std::fs::read_to_string(root.join("composer.json")).unwrap(),
-            COMPOSER_JSON,
-            "{who}: composer.json must be left byte-for-byte unchanged"
-        );
-        assert!(
-            !root.join("package.json").exists(),
-            "{who}: setup must NOT inject an npm package.json hook into a composer-only project"
-        );
-        assert_eq!(
-            dir_entries(root),
-            vec!["composer.json".to_string()],
-            "{who}: a clean no-op must leave the project dir containing ONLY composer.json; \
-             any extra entry means setup wrote a foreign artifact into a composer-only project"
-        );
-    }
-
-    /// Composer is a REAL setup
-    /// ecosystem: `setup` wires `socket-patch apply` into `composer.json`'s
-    /// post-install/post-update script events, `--check` reflects it, and
-    /// `--remove` restores the manifest byte-for-byte. Non-skippable (no Docker,
-    /// no PHP toolchain) — it edits composer.json directly.
-    #[test]
-    fn composer_setup_round_trips_host() {
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        std::fs::write(root.join("composer.json"), COMPOSER_JSON).unwrap();
-        let root_s = root.to_str().unwrap();
-
-        let status =
-            |v: &serde_json::Value| v.get("status").and_then(|s| s.as_str()).map(str::to_string);
-
-        // ── check (pristine): not wired yet → needs_configuration / exit 1 ──
-        let (code, out, _) = run(root, &["setup", "--check", "--cwd", root_s, "--json"]);
-        assert_eq!(code, 1, "pre-setup check must fail:\n{out}");
-        assert_eq!(
-            status(&parse_obj(&out, "check (pristine)")).as_deref(),
-            Some("needs_configuration")
-        );
-
-        // ── setup: wires the hook into composer.json → success / updated=1 ──
-        let (code, out, err) = run(root, &["setup", "--cwd", root_s, "--yes", "--json"]);
-        assert_eq!(
-            code, 0,
-            "composer setup must succeed.\nstdout:\n{out}\nstderr:\n{err}"
-        );
-        let v = parse_obj(&out, "setup");
-        assert_eq!(
-            status(&v).as_deref(),
-            Some("success"),
-            "setup must report success:\n{out}"
-        );
-        assert_eq!(
-            v.get("updated").and_then(|n| n.as_i64()),
-            Some(1),
-            "exactly the composer.json updated:\n{out}"
-        );
-        // Exactly one `composer`-kind file entry, status `updated`.
-        let files = v["files"].as_array().expect("files array");
-        assert_eq!(files.len(), 1, "one composer file entry:\n{out}");
-        assert_eq!(files[0]["kind"], "composer");
-        assert_eq!(files[0]["status"], "updated");
-        // The command landed in BOTH script events on disk.
-        let on_disk = std::fs::read_to_string(root.join("composer.json")).unwrap();
-        let cj: serde_json::Value = serde_json::from_str(&on_disk).unwrap();
-        for event in ["post-install-cmd", "post-update-cmd"] {
-            let arr = cj["scripts"][event]
-                .as_array()
-                .unwrap_or_else(|| panic!("{event} missing:\n{on_disk}"));
-            assert!(
-                arr.iter()
-                    .any(|c| c.as_str().is_some_and(|s| s.contains("socket-patch apply"))),
-                "{event} must carry the re-apply command:\n{on_disk}"
-            );
-        }
-        assert!(
-            cj["require"]["monolog/monolog"] == "3.5.0",
-            "user require preserved:\n{on_disk}"
-        );
-
-        // ── idempotent re-setup: already_configured, no change ──
-        let (code, out, _) = run(root, &["setup", "--cwd", root_s, "--yes", "--json"]);
-        assert_eq!(code, 0);
-        assert_eq!(
-            status(&parse_obj(&out, "re-setup")).as_deref(),
-            Some("already_configured"),
-            "{out}"
-        );
-
-        // ── check (post-setup): configured / exit 0 ──
-        let (code, out, _) = run(root, &["setup", "--check", "--cwd", root_s, "--json"]);
-        assert_eq!(code, 0, "post-setup check must pass:\n{out}");
-        assert_eq!(
-            status(&parse_obj(&out, "check (post-setup)")).as_deref(),
-            Some("configured")
-        );
-
-        // ── remove: strips the hook, restoring composer.json byte-for-byte ──
-        let (code, out, err) = run(
-            root,
-            &["setup", "--remove", "--cwd", root_s, "--yes", "--json"],
-        );
-        assert_eq!(
-            code, 0,
-            "composer remove must succeed.\nstdout:\n{out}\nstderr:\n{err}"
-        );
-        assert_eq!(
-            status(&parse_obj(&out, "remove")).as_deref(),
-            Some("success")
-        );
-        // The `scripts` object we created is gone and the dir holds only composer.json.
-        assert_manifest_pristine(root, "after remove");
-
-        // ── check (post-remove): back to needs_configuration / exit 1 ──
-        let (code, out, _) = run(root, &["setup", "--check", "--cwd", root_s, "--json"]);
-        assert_eq!(code, 1, "post-remove check must fail again:\n{out}");
-        assert_eq!(
-            status(&parse_obj(&out, "check (post-remove)")).as_deref(),
-            Some("needs_configuration")
-        );
-    }
-
-    /// The hook `setup` wires into a MANIFEST-LESS hosted / vendored
-    /// checkout (a depscan-opened PR, a `scan --mode vendored` or `scan
-    /// --mode hosted` project: the patches live in composer.lock, no
-    /// `.socket/manifest.json`, no ledger). composer runs the hook after
-    /// every install, so it must be a silent, write-free exit 0 there — and
-    /// the same `apply` with `--vex` must attest the lockfile-wired patch
-    /// from the patch API record (and, under the hook's own `--offline`,
-    /// report the record unavailable instead of attesting blind).
-    #[test]
-    fn composer_setup_hook_in_manifestless_hosted_and_vendored_checkouts() {
-        use super::vex_e2e_common::{
-            assert_absent, assert_attested, binary, git_sha256, patch_view, run_vex, Marker,
-            PatchApi, VexRun, VexVia,
-        };
-        const UUID: &str = "5e5e5e5e-1234-4abc-8def-5e5e5e5e5e5e";
-        const PURL: &str = "pkg:composer/monolog/monolog@3.5.0";
-        const PATCHED: &[u8] = b"<?php // patched Logger\n";
-        let vulns: &[(&str, &[&str])] = &[("GHSA-setp-cmps-0001", &["CVE-2026-1212"])];
-
-        for vendored in [false, true] {
-            let tag = if vendored { "vendored" } else { "hosted" };
-            let tmp = tempfile::tempdir().unwrap();
-            let root = tmp.path();
-            let root_s = root.to_str().unwrap();
-            std::fs::write(root.join("composer.json"), COMPOSER_JSON).unwrap();
-            let (code, out, err) = run(root, &["setup", "--cwd", root_s, "--yes", "--json"]);
-            assert_eq!(code, 0, "[{tag}] setup:\n{out}\n{err}");
-
-            // The lockfile wiring each backend writes (no manifest, no ledger).
-            let dist = if vendored {
-                let rel = format!(".socket/vendor/composer/{UUID}/monolog/monolog@3.5.0");
-                let file = root.join(&rel).join("src/Monolog/Logger.php");
-                std::fs::create_dir_all(file.parent().unwrap()).unwrap();
-                std::fs::write(&file, PATCHED).unwrap();
-                serde_json::json!({ "type": "path", "url": rel, "reference": UUID })
-            } else {
-                serde_json::json!({
-                    "type": "zip",
-                    "url": format!(
-                        "https://patch.socket.dev/patch/composer/monolog/monolog/3.5.0/\
-                         11111111-2222-4333-8444-555555555555/{UUID}/monolog-3.5.0.zip"
-                    ),
-                    "reference": "0123456789abcdef0123456789abcdef01234567",
-                    "shasum": "abcdef0123456789abcdef0123456789abcdef01",
-                })
-            };
-            let lock = serde_json::json!({
-                "content-hash": "abc123def456abc123def456abc123de",
-                "packages": [{ "name": "monolog/monolog", "version": "3.5.0", "dist": dist }],
-                "packages-dev": [],
-            });
-            let lock = serde_json::to_string_pretty(&lock).unwrap();
-            std::fs::write(root.join("composer.lock"), &lock).unwrap();
-
-            // Exactly the command composer runs on post-install-cmd.
-            let cj: serde_json::Value =
-                serde_json::from_str(&std::fs::read_to_string(root.join("composer.json")).unwrap())
-                    .unwrap();
-            let hook = cj["scripts"]["post-install-cmd"][0]
-                .as_str()
-                .expect("hook")
-                .to_string();
-            let mut argv: Vec<&str> = hook.split_whitespace().collect();
-            assert_eq!(argv.remove(0), "socket-patch", "[{tag}] hook: {hook}");
-            argv.extend(["--cwd", root_s]);
-            let (code, out, err) = run(root, &argv);
-            assert_eq!(
-                code, 0,
-                "[{tag}] the hook must not fail the install:\n{out}\n{err}"
-            );
-            assert!(
-                out.trim().is_empty(),
-                "[{tag}] --silent hook prints nothing: {out}"
-            );
-            assert!(
-                !root.join(".socket/manifest.json").exists(),
-                "[{tag}] no manifest written"
-            );
-            assert_eq!(
-                std::fs::read_to_string(root.join("composer.lock")).unwrap(),
-                lock
-            );
-
-            // The hook's apply + --vex, online: the lock-wired patch attests.
-            let api = PatchApi::start(vec![(
-                UUID.to_string(),
-                patch_view(
-                    UUID,
-                    PURL,
-                    &[("src/Monolog/Logger.php", &git_sha256(PATCHED))],
-                    vulns,
-                ),
-            )]);
-            let flags: Vec<String> = argv
-                .iter()
-                .filter(|a| !["apply", "--offline", "--silent", "--cwd", root_s].contains(*a))
-                .map(|a| a.to_string())
-                .collect();
-            assert_eq!(
-                flags,
-                ["--ecosystems", "composer"],
-                "[{tag}] hook flags: {hook}"
-            );
-            let base = VexRun {
-                product: Some("pkg:composer/acme/widget@1.0.0".to_string()),
-                extra_args: flags,
-                ..VexRun::online(&api)
-            }
-            .via(VexVia::Apply);
-            let out = run_vex(&binary(), root, &base);
-            assert_eq!(out.code, Some(0), "[{tag}] apply --vex:\n{out}");
-            assert_eq!(out.envelope["status"], "noManifest", "[{tag}]:\n{out}");
-            let marker = if vendored {
-                Marker::Vendored
-            } else {
-                Marker::Redirected
-            };
-            assert_attested(out.doc(), PURL, UUID, marker, vulns);
-
-            // Under the hook's own --offline there is no record to attest
-            // from: a VEX failure, never a blind attestation.
-            let seen = api.request_count();
-            let out = run_vex(
-                &binary(),
-                root,
-                &VexRun {
-                    offline: true,
-                    ..base.clone()
-                },
-            );
-            assert_eq!(out.code, Some(1), "[{tag}] offline apply --vex:\n{out}");
-            assert_eq!(
-                out.envelope["error"]["code"], "no_applicable_patches",
-                "{out}"
-            );
-            assert_absent(out.doc.as_ref(), PURL);
-            assert_eq!(api.request_count(), seen, "[{tag}] --offline made requests");
-        }
-    }
-}
diff --git a/crates/socket-patch-cli/tests/setup_matrix_deno.rs b/crates/socket-patch-cli/tests/setup_matrix_deno.rs
deleted file mode 100644
index 7c70beb7..00000000
--- a/crates/socket-patch-cli/tests/setup_matrix_deno.rs
+++ /dev/null
@@ -1,370 +0,0 @@
-//! setup-matrix: deno ecosystem (deno install against a package.json,
-//! npm-via-deno layout). `setup` DOES rewrite the package.json (deno
-//! projects have one), but whether `deno install` runs the root
-//! postinstall hook is uncertain — so the baseline records this as a
-//! GAP. If it applies, the orchestrator flags it `progress`.
-//!
-//! IMPORTANT — why this file carries a real assertion of its own:
-//! `smc::run_pm("deno", "deno")` routes deno through the shared Docker
-//! matrix harness, which *soft-skips and silently passes* whenever Docker
-//! or the `deno` image is absent (the common case locally and in this
-//! eval). deno is also NOT npm-family (see `is_npm_family` in the harness
-//! and `run-case.sh`), so the harness's check/remove behavioral
-//! round-trip is skipped entirely for it; and because deno's
-//! `baseline_supported` is false in matrix.json the only thing the matrix
-//! could ever assert is the coarse `actual_applied == expect_applied`
-//! verdict — which, on a crashed or never-run case, defaults to the same
-//! `false` that satisfies every negative-control scenario. The net
-//! effect: the matrix call can never turn red for a genuine deno `setup`
-//! regression. On its own it protects nothing.
-//!
-//! To close that loophole WITHOUT touching the shared harness or the bash
-//! driver, [`host_guard::deno_setup_roundtrip_host`] runs unconditionally
-//! (no Docker, no network, no deno toolchain) and pins deno `setup`'s
-//! *actual current contract*: a deno project HAS a package.json, so
-//! `setup` must configure the npm-style postinstall hook in it exactly as
-//! it does for npm — `setup --check` fails (exit 1) before, passes (exit
-//! 0) after, fails again after `setup --remove`; the injected
-//! `scripts.postinstall` must actually invoke `socket-patch apply`; remove
-//! must delete it; and the sibling `deno.json` must be left byte-for-byte
-//! untouched throughout. It verifies on-disk state with an *independent*
-//! `serde_json` probe (the documented expectation of what setup should
-//! write, not a copy of the writer's output) so the oracle can disagree
-//! with a broken implementation. It fails loudly if deno `setup` /
-//! `setup --check` / `setup --remove` ever regress, stop rewriting the
-//! package.json, mangle `deno.json`, or mis-report the configured state.
-//!
-//! Run: `cargo test -p socket-patch-cli --features setup-e2e --test setup_matrix_deno`
-#![cfg(feature = "setup-e2e")]
-
-#[path = "setup_matrix_common/mod.rs"]
-mod smc;
-#[path = "vex_e2e_common/mod.rs"]
-mod vex_e2e_common;
-
-/// Documentation/negative-control pass through the shared Docker matrix.
-/// Kept for parity with the other ecosystems and to run the deno negative
-/// controls when Docker + the `deno` image are present. NOTE: this is the
-/// path that silently no-ops on skip — it is NOT a regression guard. The
-/// real teeth live in [`host_guard`] below.
-#[test]
-#[serial_test::serial]
-// Experimental ecosystem (deno): the setup-matrix aspirational cases are a
-// BASELINE GAP (setup wires the package.json postinstall, but `deno install`
-// is not known to run it). This passes on CI
-// only because the runners lack the `deno` toolchain (the cases soft-skip); on
-// any host that HAS deno it fails. Ignore it so deno can never block the
-// blocking --all-features jobs. The non-skippable setup round-trip is still
-// guarded by `host_guard` below. Run with `--features setup-e2e -- --ignored`.
-#[ignore = "experimental ecosystem (deno): not gating CI until the deno backend is implemented; run with --ignored"]
-fn deno() {
-    smc::run_pm("deno", "deno");
-}
-
-// ─────────────────────────────────────────────────────────────────────────
-// Real, non-skippable regression guard for deno `setup`.
-//
-// A deno project carries a real package.json (the driver scaffolds one
-// alongside deno.json), so deno is on the npm-package.json-hook surface
-// that `setup` actually configures today: it must wire the postinstall
-// hook into package.json, report state correctly via `--check`, undo it on
-// `--remove`, and never touch the deno-native config.
-// ─────────────────────────────────────────────────────────────────────────
-mod host_guard {
-    use std::path::Path;
-    use std::process::Command;
-
-    /// A faithful deno project fixture: a package.json declaring the same
-    /// dependency the matrix targets, plus a deno-native `deno.json` with
-    /// `nodeModulesDir` (mirrors `scaffold_project`'s deno branch in
-    /// `tests/setup_matrix/run-case.sh`).
-    const PACKAGE_JSON: &str = "{ \"name\": \"sm-proj\", \"version\": \"0.0.0\", \"private\": true, \"dependencies\": { \"minimist\": \"1.2.2\" } }\n";
-    const DENO_JSON: &str =
-        "{ \"name\": \"sm-proj\", \"version\": \"0.0.0\", \"nodeModulesDir\": \"auto\" }\n";
-
-    /// Absolute path to the binary under test, via cargo's `CARGO_BIN_EXE_*`.
-    fn binary() -> std::path::PathBuf {
-        env!("CARGO_BIN_EXE_socket-patch").into()
-    }
-
-    /// Run the CLI with `args` in `cwd`; returns `(exit_code, stdout, stderr)`.
-    /// The entire `SOCKET_*` surface is stripped BY PREFIX — a fixed list rots
-    /// (this file's missed `SOCKET_STRICT` / `SOCKET_VENDOR_SOURCE`, both
-    /// parsed on every `setup` invocation; see [`HOSTILE_DECOYS`]) — so
-    /// behaviour reflects the explicit flags alone: nothing reaches authed
-    /// endpoints and no ambient var can stand in for a flag. Mirrors
-    /// `setup_matrix_pypi.rs`.
-    fn run(cwd: &Path, args: &[&str]) -> (i32, String, String) {
-        let mut cmd = Command::new(binary());
-        cmd.args(args).current_dir(cwd);
-        for (key, _) in std::env::vars_os() {
-            if key.to_string_lossy().starts_with("SOCKET_")
-                && key.to_string_lossy() != "SOCKET_NO_CONFIG"
-            {
-                cmd.env_remove(&key);
-            }
-        }
-        // This guard's contract is "no network" (module docs): `setup` fires a
-        // usage-telemetry POST when telemetry is enabled, and the scrub above
-        // would strip a developer's own opt-out. Force it off for the child —
-        // no assertion here concerns telemetry.
-        cmd.env("SOCKET_TELEMETRY_DISABLED", "1");
-        let out = cmd.output().expect("failed to execute socket-patch binary");
-        (
-            out.status.code().unwrap_or(-1),
-            String::from_utf8_lossy(&out.stdout).to_string(),
-            String::from_utf8_lossy(&out.stderr).to_string(),
-        )
-    }
-
-    /// Parse the CLI's `--json` stdout into a single JSON object. Panics
-    /// (loudly) if stdout is not the single JSON object the command
-    /// promises — a non-JSON / multi-line dump means the command did not
-    /// run the path we think it did.
-    fn parse_json(stdout: &str, who: &str) -> serde_json::Value {
-        serde_json::from_str(stdout.trim()).unwrap_or_else(|e| {
-            panic!("{who}: stdout was not a single JSON object ({e}):\n{stdout}")
-        })
-    }
-
-    fn json_str_field(v: &serde_json::Value, key: &str, who: &str) -> String {
-        v.get(key)
-            .and_then(|s| s.as_str())
-            .unwrap_or_else(|| panic!("{who}: JSON has no string `{key}` field:\n{v}"))
-            .to_string()
-    }
-
-    /// Independent oracle: read package.json with `serde_json` and return
-    /// `scripts.postinstall` if present. Deliberately does NOT reuse the
-    /// production detection helpers (`is_setup_configured_str`) so the
-    /// oracle can disagree with a broken writer.
-    fn postinstall_script(root: &Path) -> Option<String> {
-        let content = std::fs::read_to_string(root.join("package.json")).unwrap();
-        let v: serde_json::Value = serde_json::from_str(&content)
-            .unwrap_or_else(|e| panic!("package.json is not valid JSON ({e}):\n{content}"));
-        v.get("scripts")
-            .and_then(|s| s.get("postinstall"))
-            .and_then(|p| p.as_str())
-            .map(String::from)
-    }
-
-    /// `deno.json` (the deno-native config) must be byte-for-byte what we
-    /// wrote — `setup` operates on package.json and must never mutate it.
-    fn assert_deno_json_pristine(root: &Path, who: &str) {
-        assert_eq!(
-            std::fs::read_to_string(root.join("deno.json")).unwrap(),
-            DENO_JSON,
-            "{who}: deno.json must be left byte-for-byte unchanged by setup"
-        );
-    }
-
-    /// Ambient decoys `run()`'s scrub must strip. Two failure classes:
-    /// clap parses env-bound values on EVERY invocation whether or not the
-    /// command uses the flag, so an invalid ambient `SOCKET_STRICT` /
-    /// `SOCKET_VENDOR_SOURCE` aborts the parse (exit 2) before `setup` even
-    /// runs; and `SOCKET_SETUP_EXCLUDE` stands in for `setup --exclude` —
-    /// the exact surface under test. Planted by the roundtrip test itself so
-    /// the scrub is exercised on every run, not only in hostile shells.
-    /// (Safe to set process-wide: the only other test in this binary routes
-    /// through `smc::host_driver_command`, which prefix-scrubs `SOCKET_*`.)
-    const HOSTILE_DECOYS: &[(&str, &str)] = &[
-        ("SOCKET_STRICT", "banana"),
-        ("SOCKET_VENDOR_SOURCE", "bogus-decoy"),
-        ("SOCKET_VENDOR_URL", "http://127.0.0.1:9/decoy"),
-        ("SOCKET_PATCH_SERVER_URL", "http://127.0.0.1:9/decoy"),
-        ("SOCKET_SETUP_EXCLUDE", "decoy-member"),
-    ];
-
-    /// Manifest-less VEX over a setup-only Deno project: `setup` wires only
-    /// the agent-mode `postinstall` hook — Deno has no hosted rewriter and
-    /// no vendored backend — so there is nothing to attest (exit 2,
-    /// `manifest_not_found`), no document, no patch-API request, and
-    /// `deno.json` stays untouched.
-    fn assert_manifestless_vex_has_nothing(root: &Path, who: &str) {
-        use crate::vex_e2e_common::{run_vex, PatchApi, VexRun};
-        let out_dir = tempfile::tempdir().unwrap();
-        let api = PatchApi::empty();
-        for no_verify in [false, true] {
-            let mut r = VexRun::online(&api);
-            r.output = Some(out_dir.path().join("out.vex.json"));
-            r.product = Some("pkg:npm/deno-app@1.0.0".to_string());
-            r.no_verify = no_verify;
-            let out = run_vex(&binary(), root, &r);
-            assert_eq!(out.code, Some(2), "{who} (no_verify={no_verify}): {out}");
-            assert_eq!(
-                out.envelope["error"]["code"], "manifest_not_found",
-                "{who}: {out}"
-            );
-            assert!(
-                out.doc.is_none(),
-                "{who}: no document may be written: {out}"
-            );
-        }
-        api.assert_no_requests();
-        assert_deno_json_pristine(root, who);
-    }
-
-    #[test]
-    #[serial_test::serial]
-    fn deno_setup_roundtrip_host() {
-        let _decoys = crate::smc::DecoyGuard::set(HOSTILE_DECOYS);
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        std::fs::write(root.join("package.json"), PACKAGE_JSON).unwrap();
-        std::fs::write(root.join("deno.json"), DENO_JSON).unwrap();
-        let root_s = root.to_str().unwrap();
-
-        // ── check (before setup): unconfigured → must FAIL (exit 1) ─────────
-        // Proves `--check` reads real state instead of hardcoding success,
-        // and that a deno package.json is recognised as a configurable
-        // manifest (status needs_configuration, NOT no_files — a no_files
-        // here would mean setup silently ignores deno projects).
-        let (code, out, err) = run(root, &["setup", "--check", "--cwd", root_s, "--json"]);
-        assert_eq!(
-            code, 1,
-            "setup --check must FAIL (exit 1) on a pristine, unconfigured deno project.\nstdout:\n{out}\nstderr:\n{err}"
-        );
-        let v = parse_json(&out, "check (pristine)");
-        assert_eq!(
-            json_str_field(&v, "status", "check (pristine)"),
-            "needs_configuration",
-            "a deno project's package.json must report needs_configuration, not no_files/configured.\nstderr:\n{err}"
-        );
-        assert_eq!(
-            v.get("needsConfiguration").and_then(|n| n.as_i64()),
-            Some(1),
-            "exactly the package.json must be counted as needing configuration.\n{out}"
-        );
-        assert!(
-            postinstall_script(root).is_none(),
-            "no postinstall hook must exist before setup runs"
-        );
-        assert_deno_json_pristine(root, "after check (pristine)");
-
-        // ── setup: must rewrite package.json with a real apply hook ─────────
-        let (code, out, err) = run(root, &["setup", "--cwd", root_s, "--yes", "--json"]);
-        assert_eq!(
-            code, 0,
-            "setup must succeed (exit 0).\nstdout:\n{out}\nstderr:\n{err}"
-        );
-        let v = parse_json(&out, "setup");
-        assert_eq!(
-            json_str_field(&v, "status", "setup"),
-            "success",
-            "setup on a deno project must report status=success.\nstderr:\n{err}"
-        );
-        assert_eq!(
-            v.get("updated").and_then(|n| n.as_i64()),
-            Some(1),
-            "setup must report updating exactly one manifest (the package.json).\n{out}"
-        );
-        assert_eq!(
-            v.get("errors").and_then(|n| n.as_i64()),
-            Some(0),
-            "setup must report zero errors on a deno project.\n{out}"
-        );
-
-        // Independent on-disk verification: the postinstall hook must exist
-        // and must actually invoke `socket-patch apply` for the npm
-        // ecosystem — an empty/foreign/echo value would be a regression that
-        // a mere "key present" check would miss.
-        let hook = postinstall_script(root)
-            .unwrap_or_else(|| panic!("setup did not write scripts.postinstall into package.json"));
-        assert!(
-            hook.contains("socket-patch apply"),
-            "postinstall hook must invoke `socket-patch apply`, got: {hook:?}"
-        );
-        assert!(
-            hook.contains("--ecosystems npm"),
-            "postinstall hook must target the npm ecosystem (deno installs npm deps via package.json), got: {hook:?}"
-        );
-        // The committed `minimist` dependency must survive the rewrite.
-        let pkg = std::fs::read_to_string(root.join("package.json")).unwrap();
-        let pkg_v: serde_json::Value = serde_json::from_str(&pkg).unwrap();
-        assert_eq!(
-            pkg_v
-                .get("dependencies")
-                .and_then(|d| d.get("minimist"))
-                .and_then(|m| m.as_str()),
-            Some("1.2.2"),
-            "setup must preserve the project's existing dependencies.\n{pkg}"
-        );
-        assert_deno_json_pristine(root, "after setup");
-
-        // ── check (configured): must PASS (exit 0) ──────────────────────────
-        let (code, out, err) = run(root, &["setup", "--check", "--cwd", root_s, "--json"]);
-        assert_eq!(
-            code, 0,
-            "setup --check must PASS (exit 0) after setup configured the deno project.\nstdout:\n{out}\nstderr:\n{err}"
-        );
-        let v = parse_json(&out, "check (configured)");
-        assert_eq!(
-            json_str_field(&v, "status", "check (configured)"),
-            "configured",
-            "check must report the deno package.json as configured after setup.\nstderr:\n{err}"
-        );
-        assert_eq!(
-            v.get("configured").and_then(|n| n.as_i64()),
-            Some(1),
-            "exactly one manifest (the package.json) must be reported configured.\n{out}"
-        );
-        assert_eq!(
-            v.get("needsConfiguration").and_then(|n| n.as_i64()),
-            Some(0),
-            "no manifest may still need configuration after a successful setup.\n{out}"
-        );
-
-        // ── manifest-less VEX: the configured hook is not attestable ────────
-        assert_manifestless_vex_has_nothing(root, "vex (configured)");
-
-        // ── remove: must delete the hook and succeed ────────────────────────
-        let (code, out, err) = run(
-            root,
-            &["setup", "--remove", "--cwd", root_s, "--yes", "--json"],
-        );
-        assert_eq!(
-            code, 0,
-            "setup --remove must succeed (exit 0).\nstdout:\n{out}\nstderr:\n{err}"
-        );
-        let v = parse_json(&out, "remove");
-        assert_eq!(
-            json_str_field(&v, "status", "remove"),
-            "success",
-            "setup --remove must report status=success on a configured deno project.\nstderr:\n{err}"
-        );
-        assert_eq!(
-            v.get("removed").and_then(|n| n.as_i64()),
-            Some(1),
-            "remove must report removing exactly one hook.\n{out}"
-        );
-        assert!(
-            postinstall_script(root).is_none(),
-            "the postinstall hook must be gone from package.json after remove:\n{}",
-            std::fs::read_to_string(root.join("package.json")).unwrap()
-        );
-        assert_deno_json_pristine(root, "after remove");
-
-        // ── check (after remove): back to needs-configuration (exit 1) ──────
-        let (code, out, err) = run(root, &["setup", "--check", "--cwd", root_s, "--json"]);
-        assert_eq!(
-            code, 1,
-            "setup --check must FAIL (exit 1) again after remove.\nstdout:\n{out}\nstderr:\n{err}"
-        );
-        let v = parse_json(&out, "check (post-remove)");
-        assert_eq!(
-            json_str_field(&v, "status", "check (post-remove)"),
-            "needs_configuration",
-            "check must report needs_configuration again after the hook is removed.\nstderr:\n{err}"
-        );
-        assert_eq!(
-            v.get("needsConfiguration").and_then(|n| n.as_i64()),
-            Some(1),
-            "the package.json must count as needing configuration again after remove.\n{out}"
-        );
-        assert_eq!(
-            v.get("configured").and_then(|n| n.as_i64()),
-            Some(0),
-            "no manifest may report configured after the hook is removed.\n{out}"
-        );
-    }
-}
diff --git a/crates/socket-patch-cli/tests/setup_matrix_env_guard.rs b/crates/socket-patch-cli/tests/setup_matrix_env_guard.rs
deleted file mode 100644
index 0309aa6a..00000000
--- a/crates/socket-patch-cli/tests/setup_matrix_env_guard.rs
+++ /dev/null
@@ -1,114 +0,0 @@
-//! Env-hygiene guard for setup-matrix HOST mode (`SOCKET_PATCH_TEST_HOST=1`).
-//!
-//! `run_case`'s host branch spawns `bash run-case.sh` as a plain child
-//! process, so — unlike docker mode, where only the explicit `-e SM_*`
-//! vars cross into the container — the driver, the binary under test,
-//! and the native package-manager installs all inherit the parent
-//! shell's environment. An ambient `SOCKET_DRY_RUN=true` turns the
-//! install hook's apply into a no-op (every baseline case red for the
-//! wrong reason), an ambient `SOCKET_CWD` recreates exactly the
-//! workspace-breaking mode run-case.sh documents it must avoid, an
-//! ambient `SM_WORKDIR` makes every parallel case share one scratch
-//! dir (the blob/proj races the driver warns about), and an ambient
-//! `npm_config_ignore_scripts=true` stops lifecycle hooks from firing
-//! at all. This guard pins the scrub-then-seed contract of
-//! `smc::host_driver_command` — the same `Command` `run_case` spawns —
-//! by planting hostile decoys in the parent env and asserting each is
-//! explicitly removed while the case's own seeds survive.
-//!
-//! Deliberately its own test binary: it mutates the process env, and
-//! nothing else runs in this binary, so the decoys cannot race a live
-//! matrix case in another test thread.
-#![cfg(feature = "setup-e2e")]
-
-#[path = "setup_matrix_common/mod.rs"]
-mod smc;
-
-use std::collections::HashMap;
-use std::ffi::{OsStr, OsString};
-use std::path::Path;
-use std::process::Command;
-
-/// Hostile ambient vars: each one, if inherited by the driver, flips a
-/// real verdict for the wrong reason (dry-run apply, retargeted cwd or
-/// manifest, global mode, shared scratch dir, stale hook wheel, dead
-/// registry, disabled lifecycle scripts, hijacked venv, poisoned shim
-/// PATH cleanup).
-const DECOYS: &[(&str, &str)] = &[
-    ("SOCKET_DRY_RUN", "true"),
-    ("SOCKET_CWD", "/nonexistent/decoy"),
-    ("SOCKET_MANIFEST_PATH", "/nonexistent/decoy/manifest.json"),
-    ("SOCKET_GLOBAL", "true"),
-    ("SM_WORKDIR", "/nonexistent/decoy-shared-workdir"),
-    ("SOCKET_PATCH_HOOK_WHEEL", "/nonexistent/decoy.whl"),
-    ("npm_config_ignore_scripts", "true"),
-    ("NPM_CONFIG_REGISTRY", "http://127.0.0.1:9/decoy"),
-    ("YARN_ENABLE_SCRIPTS", "false"),
-    ("VIRTUAL_ENV", "/nonexistent/decoy-venv"),
-    ("SETUP_MATRIX_SHIM_DIR", "/nonexistent/decoy-shims"),
-];
-
-/// Snapshot the command's explicit env ops: `Some(value)` = seeded,
-/// `None` = removed, absent key = silently inherited from the parent.
-fn env_map(cmd: &Command) -> HashMap<OsString, Option<OsString>> {
-    cmd.get_envs()
-        .map(|(k, v)| (k.to_os_string(), v.map(OsStr::to_os_string)))
-        .collect()
-}
-
-#[test]
-fn host_driver_command_scrubs_ambient_env_and_keeps_case_seeds() {
-    for (k, v) in DECOYS {
-        std::env::set_var(k, v);
-    }
-
-    let case_env = vec![
-        ("SM_ID".to_string(), "guard/npm/decoy".to_string()),
-        ("SM_ECOSYSTEM".to_string(), "npm".to_string()),
-    ];
-
-    // No wheel: SOCKET_PATCH_HOOK_WHEEL must be scrubbed, not inherited
-    // stale from the shell.
-    let cmd = smc::host_driver_command(&case_env, None);
-    let envs = env_map(&cmd);
-
-    for (k, _) in DECOYS {
-        assert_eq!(
-            envs.get(OsStr::new(k)),
-            Some(&None),
-            "ambient decoy {k} must be explicitly removed (env_remove) from the \
-             host driver invocation; it currently leaks into run-case.sh, the \
-             binary under test, and the native package-manager installs"
-        );
-    }
-
-    // Scrub-then-seed ordering: the SM_* case env and the binary path are
-    // set AFTER the prefix scrub, so they must survive as real values (a
-    // scrub running last would wipe its own seeds — last env call wins).
-    assert_eq!(
-        envs.get(OsStr::new("SM_ID")).cloned().flatten().as_deref(),
-        Some(OsStr::new("guard/npm/decoy")),
-        "case SM_* env must survive the SM_ prefix scrub (scrub must run before seeding)"
-    );
-    assert!(
-        matches!(envs.get(OsStr::new("SOCKET_PATCH_BIN")), Some(Some(p)) if !p.is_empty()),
-        "SOCKET_PATCH_BIN must survive the SOCKET_ prefix scrub"
-    );
-
-    // With a wheel, the explicit seed must survive the scrub too.
-    let wheel = Path::new("/tmp/socket_patch_hook-0.0.0-py3-none-any.whl");
-    let cmd = smc::host_driver_command(&case_env, Some(wheel));
-    let envs = env_map(&cmd);
-    assert_eq!(
-        envs.get(OsStr::new("SOCKET_PATCH_HOOK_WHEEL"))
-            .cloned()
-            .flatten()
-            .as_deref(),
-        Some(wheel.as_os_str()),
-        "an explicitly provided hook wheel must survive the SOCKET_ prefix scrub"
-    );
-
-    for (k, _) in DECOYS {
-        std::env::remove_var(k);
-    }
-}
diff --git a/crates/socket-patch-cli/tests/setup_matrix_gem.rs b/crates/socket-patch-cli/tests/setup_matrix_gem.rs
deleted file mode 100644
index efef1fc6..00000000
--- a/crates/socket-patch-cli/tests/setup_matrix_gem.rs
+++ /dev/null
@@ -1,1874 +0,0 @@
-//! setup-matrix: gem ecosystem (bundler). `setup` now has REAL bundler support
-//! — it appends a managed `plugin "socket-patch"` block to the Gemfile and
-//! generates a committed in-tree Bundler plugin under `.socket/bundler-plugin/`
-//! whose `plugins.rb` re-runs `socket-patch apply --ecosystems gem` on every
-//! `bundle install` (digest-gated load-time + per-gem `after-install`
-//! triggers, forced `after-install-all` re-apply).
-//!
-//! The with-setup Docker cases (`baseline_with_setup`, `alt_content_patchset`)
-//! depend on two things: (a) installing the plugin evaluates `plugins.rb`
-//! BEFORE any project gems land, so the generated plugin warns-and-continues
-//! on apply failures (`SOCKET_PATCH_STRICT=1` restores the raise) instead of
-//! killing the FIRST `bundle install` of every fresh checkout — pinned by
-//! [`plugin_runtime`] below; (b) hash-gated gem apply has no npm-style
-//! mismatch-warn-and-apply path, so the fixture's beforeHash is the real
-//! git-blob hash probed from the published .gem (`resolve_before_hash` in
-//! `run-case.sh`, mirroring docker_e2e_gem). NOTE: in Docker mode the matrix
-//! runs the binary BAKED INTO the local image; a stale image generates a
-//! raising plugin and red-flags these cases — rebuild the image (or run with
-//! `SOCKET_PATCH_TEST_HOST=1`).
-//!
-//! IMPORTANT — why this file carries a real assertion of its own:
-//! `smc::run_pm("gem", "bundler")` routes gem through the shared Docker
-//! matrix harness, which *soft-skips and silently passes* whenever Docker
-//! or the `gem` image is absent (the common case locally and in this
-//! eval). gem is also NOT npm-family (see `is_npm_family` in the harness
-//! and `run-case.sh`), so the harness's check/remove behavioral
-//! round-trip is skipped entirely for it. When Docker + the image ARE
-//! present the matrix does assert the coarse
-//! `actual_applied == expect_applied` verdict against a real
-//! `bundle install` (it caught the uncloneable `git:` plugin source), but
-//! that protection is environment-conditional — a machine without the
-//! image gets silent green.
-//!
-//! To close that loophole WITHOUT touching the shared harness or the bash
-//! driver, [`host_guard::gem_setup_roundtrip_host`] runs unconditionally
-//! (no Docker, no network, no ruby/bundler toolchain) and pins gem
-//! `setup`'s contract with a full POSITIVE round-trip: `--check` fails on a
-//! pristine Gemfile → `setup` wires the plugin → `--check` passes → `--remove`
-//! restores the Gemfile *byte-for-byte* and deletes the generated plugin dir →
-//! `--check` fails again. It reads on-disk state with *independent* probes
-//! (hand-pinned constants + a marker scan, not a copy of any writer output) so
-//! the oracle can disagree with a broken implementation. It fails loudly if
-//! gem `setup` stops wiring the plugin, corrupts the Gemfile, mis-reports a
-//! status / exit code, or leaves residue after `--remove`.
-//!
-//! Run: `cargo test -p socket-patch-cli --features setup-e2e --test setup_matrix_gem`
-#![cfg(feature = "setup-e2e")]
-
-#[path = "setup_matrix_common/mod.rs"]
-mod smc;
-#[path = "vex_e2e_common/mod.rs"]
-mod vex_e2e_common;
-
-/// Documentation/negative-control pass through the shared Docker matrix.
-/// Kept for parity with the other ecosystems and to run the gem negative
-/// controls when Docker + the `gem` image are present. NOTE: this is the
-/// path that silently no-ops on skip — it is NOT a regression guard. The
-/// real teeth live in [`host_guard`] below.
-#[test]
-fn bundler() {
-    smc::run_pm("gem", "bundler");
-}
-
-// ─────────────────────────────────────────────────────────────────────────
-// Real, non-skippable regression guard for gem `setup`.
-//
-// A bundler project carries a Gemfile; `setup` wires a committed Bundler
-// plugin into it. The guard pins that round-trip precisely so a regression
-// (plugin no longer wired, Gemfile corrupted on add/remove, wrong exit code,
-// residue after remove) turns this suite red even with no Docker / ruby.
-// ─────────────────────────────────────────────────────────────────────────
-mod host_guard {
-    use std::path::Path;
-    use std::process::Command;
-
-    /// A faithful bundler project fixture, mirroring `scaffold_project`'s
-    /// `bundler` branch in `tests/setup_matrix/run-case.sh` and the gem
-    /// target's package/version in matrix.json (`colorize` @ `1.1.0`).
-    const GEMFILE: &str = "source 'https://rubygems.org'\ngem 'colorize', '1.1.0'\n";
-
-    /// The relative path of the generated in-tree plugin (independent of any
-    /// production constant — a hand-pinned oracle).
-    const PLUGIN_DIR: &str = ".socket/bundler-plugin";
-    /// The managed-block marker `setup` appends to the Gemfile. Pinned here so
-    /// the test disagrees with a renamed/removed marker rather than copying it.
-    const MANAGED_MARKER: &str = "# >>> socket-patch:managed";
-
-    /// Absolute path to the binary under test, via cargo's `CARGO_BIN_EXE_*`.
-    fn binary() -> std::path::PathBuf {
-        env!("CARGO_BIN_EXE_socket-patch").into()
-    }
-
-    /// Run the CLI with `args` in `cwd`; returns `(exit_code, stdout, stderr)`.
-    /// The entire `SOCKET_*` surface is stripped so behaviour reflects the
-    /// explicit flags alone — nothing reaches authed endpoints and no ambient
-    /// var can stand in for a flag.
-    fn run(cwd: &Path, args: &[&str]) -> (i32, String, String) {
-        run_env(cwd, args, &[])
-    }
-
-    /// [`run`] with extra environment variables for the child (e.g. bundler's
-    /// `BUNDLE_APP_CONFIG`, which relocates the machine-local registration
-    /// `--remove` must clean).
-    fn run_env(cwd: &Path, args: &[&str], envs: &[(&str, &str)]) -> (i32, String, String) {
-        let mut cmd = Command::new(binary());
-        cmd.args(args).current_dir(cwd);
-        // Prefix-scrub the whole ambient `SOCKET_*` surface (mirrors
-        // `tests/common::run_with_env`). clap binds ~30 `SOCKET_*` vars across
-        // the global + per-command flags and the set keeps growing, so an
-        // itemized list rots: `SOCKET_STRICT`, `SOCKET_VENDOR_SOURCE`, and
-        // setup's own `SOCKET_SETUP_EXCLUDE` were all missing from the list
-        // this replaced — an ambient `SOCKET_VENDOR_SOURCE=bogus` aborted
-        // every invocation with a clap parse error (exit 2) and turned this
-        // guard red for an environmental reason.
-        for (key, _) in std::env::vars_os() {
-            if key.to_string_lossy().starts_with("SOCKET_")
-                && key.to_string_lossy() != "SOCKET_NO_CONFIG"
-            {
-                cmd.env_remove(&key);
-            }
-        }
-        // This guard's contract is "no network" (module docs): `setup` fires a
-        // usage-telemetry POST when telemetry is enabled, and the scrub above
-        // would strip a developer's own opt-out. Force it off for the child —
-        // no assertion here concerns telemetry.
-        cmd.env("SOCKET_TELEMETRY_DISABLED", "1");
-        // An ambient BUNDLE_APP_CONFIG would relocate where `--remove` looks
-        // for bundler's plugin registration — strip it so only the explicit
-        // per-test env below can steer that resolution.
-        cmd.env_remove("BUNDLE_APP_CONFIG");
-        for (k, v) in envs {
-            cmd.env(k, v);
-        }
-        let out = cmd.output().expect("failed to execute socket-patch binary");
-        (
-            out.status.code().unwrap_or(-1),
-            String::from_utf8_lossy(&out.stdout).to_string(),
-            String::from_utf8_lossy(&out.stderr).to_string(),
-        )
-    }
-
-    /// Parse the CLI's `--json` stdout into a single JSON object. Panics
-    /// (loudly) if stdout is not the single JSON object the command
-    /// promises — a non-JSON / multi-line dump means the command did not
-    /// run the path we think it did.
-    fn parse_json(stdout: &str, who: &str) -> serde_json::Value {
-        serde_json::from_str(stdout.trim()).unwrap_or_else(|e| {
-            panic!("{who}: stdout was not a single JSON object ({e}):\n{stdout}")
-        })
-    }
-
-    fn json_str(v: &serde_json::Value, key: &str, who: &str) -> String {
-        v.get(key)
-            .and_then(|s| s.as_str())
-            .unwrap_or_else(|| panic!("{who}: JSON has no string `{key}` field:\n{v}"))
-            .to_string()
-    }
-
-    fn json_i64(v: &serde_json::Value, key: &str, who: &str) -> i64 {
-        v.get(key)
-            .and_then(|n| n.as_i64())
-            .unwrap_or_else(|| panic!("{who}: JSON has no integer `{key}` field:\n{v}"))
-    }
-
-    fn gemfile_body(root: &Path) -> String {
-        std::fs::read_to_string(root.join("Gemfile")).unwrap()
-    }
-
-    /// setup / setup --check / setup --remove against a real bundler project,
-    /// asserting REAL on-disk + JSON state at every stage. This is the
-    /// assertion the Docker matrix can never make for gem.
-    #[test]
-    fn gem_setup_roundtrip_host() {
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        std::fs::write(root.join("Gemfile"), GEMFILE).unwrap();
-        let root_s = root.to_str().unwrap();
-        let plugins_rb = root.join(PLUGIN_DIR).join("plugins.rb");
-        let gemspec = root.join(PLUGIN_DIR).join("socket-patch.gemspec");
-
-        // ── pristine precondition ──────────────────────────────────────────
-        assert_eq!(gemfile_body(root), GEMFILE, "fixture Gemfile");
-        assert!(
-            !root.join(PLUGIN_DIR).exists(),
-            "fixture must not already contain the generated plugin dir"
-        );
-        assert!(
-            !root.join("package.json").exists(),
-            "fixture must not contain a package.json (would change the path under test)"
-        );
-
-        // ── check (pristine): plugin not wired → needs_configuration, exit 1 ─
-        let (code, out, err) = run(root, &["setup", "--check", "--cwd", root_s, "--json"]);
-        assert_eq!(
-            code, 1,
-            "check on an unconfigured bundler project must exit 1.\n{out}\n{err}"
-        );
-        let v = parse_json(&out, "check (pristine)");
-        assert_eq!(
-            json_str(&v, "status", "check (pristine)"),
-            "needs_configuration"
-        );
-        // The Gemfile must be among the manifests reported as needing setup.
-        let files = v.get("files").and_then(|f| f.as_array()).expect("files[]");
-        assert!(
-            files.iter().any(
-                |f| f.get("kind").and_then(|k| k.as_str()) == Some("gemfile")
-                    && f.get("status").and_then(|s| s.as_str()) == Some("needs_configuration")
-            ),
-            "check must report the Gemfile as needs_configuration:\n{v}"
-        );
-
-        // ── setup: wire the plugin (Gemfile block + generated dir) ──────────
-        let (code, out, err) = run(root, &["setup", "--cwd", root_s, "--yes", "--json"]);
-        assert_eq!(code, 0, "setup must exit 0.\n{out}\n{err}");
-        let v = parse_json(&out, "setup");
-        assert_eq!(json_str(&v, "status", "setup"), "success");
-        assert!(
-            json_i64(&v, "updated", "setup") >= 2,
-            "Gemfile + plugin dir updated:\n{v}"
-        );
-        assert_eq!(json_i64(&v, "errors", "setup"), 0, "setup errors:\n{v}");
-
-        // On-disk, via independent probes (NOT a copy of the writer output):
-        // the managed block is appended (original bytes preserved as a prefix),
-        let body = gemfile_body(root);
-        assert!(
-            body.starts_with(GEMFILE),
-            "setup must only APPEND to the Gemfile:\n{body}"
-        );
-        assert!(
-            body.contains(MANAGED_MARKER),
-            "managed block marker missing:\n{body}"
-        );
-        assert!(
-            body.contains("plugin 'socket-patch'"),
-            "Gemfile must reference the socket-patch plugin:\n{body}"
-        );
-        // The directive must use a `path:` source. A `git:` source makes
-        // Bundler `git clone` the directory, and `.socket/bundler-plugin/` is
-        // a plain generated dir (committing it to the PARENT repo does not
-        // give it a `.git`), so every `bundle install` on a wired project
-        // fails with "repository ... does not exist" (exit 11) and the plugin
-        // never loads. Verified against real Bundler in the gem Docker image.
-        assert!(
-            body.contains("plugin 'socket-patch', path:"),
-            "the plugin directive must be `path:`-sourced (a `git:` dir source \
-             is uncloneable and breaks every `bundle install`):\n{body}"
-        );
-        // and the generated plugin carries the two triggers + fail-loud applier.
-        assert!(plugins_rb.exists(), "plugins.rb must be generated");
-        assert!(gemspec.exists(), "the plugin gemspec must be generated");
-        // Bundler refuses to LOAD a plugin whose gemspec require paths are
-        // missing on disk ("The following plugin paths don't exist: .../lib.
-        // ... Continuing without installing plugin"). The plugin dir is flat
-        // (no lib/), so the gemspec must pin `require_paths = ["."]` or the
-        // plugin is silently skipped on every install.
-        let spec = std::fs::read_to_string(&gemspec).unwrap();
-        assert!(
-            spec.contains("s.require_paths = [\".\"]"),
-            "gemspec must set require_paths to the flat plugin dir, or Bundler \
-             silently skips loading the plugin:\n{spec}"
-        );
-        let rb = std::fs::read_to_string(&plugins_rb).unwrap();
-        assert!(
-            rb.contains("Bundler::Plugin.add_hook(\"after-install-all\")"),
-            "plugins.rb must register the after-install-all hook (fresh-install trigger):\n{rb}"
-        );
-        assert!(
-            rb.contains("SocketPatch.apply!"),
-            "plugins.rb must call the applier at load time (cached/no-op-install trigger):\n{rb}"
-        );
-        assert!(
-            rb.contains("\"--ecosystems\", \"gem\", \"--offline\""),
-            "plugins.rb must shell the gem-scoped offline apply:\n{rb}"
-        );
-        // Tolerant by default (a raise at plugin registration deadlocks a
-        // fresh checkout's first `bundle install`), with the strict escape
-        // hatch still raising Bundler::BundlerError.
-        assert!(
-            rb.contains("SOCKET_PATCH_STRICT"),
-            "plugins.rb must carry the strict-mode escape hatch:\n{rb}"
-        );
-        assert!(
-            rb.contains("BundlerError"),
-            "plugins.rb must still raise Bundler::BundlerError in strict mode:\n{rb}"
-        );
-        // The plugin's digest stamp is machine-local, but it lives in the
-        // otherwise-committed .socket/ — setup must gitignore it, or every
-        // install litters `git status` and a blanket `git add .socket`
-        // commits one machine's stamp to every clone.
-        let gitignore = std::fs::read_to_string(root.join(".socket/.gitignore")).unwrap();
-        assert!(
-            gitignore.lines().any(|l| l == "/gem-plugin-stamp"),
-            ".socket/.gitignore must carry the stamp entry:\n{gitignore}"
-        );
-
-        // ── check (after setup): configured, exit 0 ─────────────────────────
-        let (code, out, err) = run(root, &["setup", "--check", "--cwd", root_s, "--json"]);
-        assert_eq!(
-            code, 0,
-            "check on a configured project must exit 0.\n{out}\n{err}"
-        );
-        assert_eq!(
-            json_str(
-                &parse_json(&out, "check (configured)"),
-                "status",
-                "check (configured)"
-            ),
-            "configured"
-        );
-
-        // ── idempotent re-setup: nothing changes ────────────────────────────
-        let (code, out, _) = run(root, &["setup", "--cwd", root_s, "--yes", "--json"]);
-        assert_eq!(code, 0, "idempotent re-setup must exit 0");
-        let v = parse_json(&out, "re-setup");
-        assert_eq!(json_str(&v, "status", "re-setup"), "already_configured");
-        assert_eq!(
-            json_i64(&v, "updated", "re-setup"),
-            0,
-            "re-setup must update nothing:\n{v}"
-        );
-
-        // ── remove: byte-for-byte restore + plugin dir gone ─────────────────
-        // A stamp left behind by a previous apply: `--remove`'s no-residue
-        // contract covers it (it sits in the committed .socket/ dir).
-        std::fs::write(root.join(".socket/gem-plugin-stamp"), "e".repeat(64)).unwrap();
-        // Bundler's machine-local plugin registration, exactly as the first
-        // `bundle install` after `setup` writes it (bundler's YAMLSerializer
-        // dialect, verified against bundler 2.7.2 / 4.0.18): the hook
-        // subscriptions + load/plugin paths in `.bundle/plugin/index`.
-        // `--remove` must clear it too — a dangling registration makes every
-        // later `bundle install` print bundler's "The following plugin paths
-        // don't exist ... Continuing without installing plugin socket-patch"
-        // block (with a misleading reinstall suggestion) forever.
-        let plugin_reg_dir = root.join(".bundle").join("plugin");
-        std::fs::create_dir_all(&plugin_reg_dir)
-            .expect("create the bundler plugin registration dir");
-        let index_path = plugin_reg_dir.join("index");
-        std::fs::write(
-            &index_path,
-            format!(
-                "---\ncommands:\nhooks:\n  after-install:\n  - \"socket-patch\"\n  \
-                 after-install-all:\n  - \"socket-patch\"\nload_paths:\n  socket-patch:\n  \
-                 - \"{root_s}/.socket/bundler-plugin/.\"\nplugin_paths:\n  \
-                 socket-patch: \"{root_s}/.socket/bundler-plugin\"\nsources:\n"
-            ),
-        )
-        .expect("write the bundler plugin index fixture");
-        let (code, out, err) = run(
-            root,
-            &["setup", "--remove", "--cwd", root_s, "--yes", "--json"],
-        );
-        assert_eq!(code, 0, "remove must exit 0.\n{out}\n{err}");
-        let v = parse_json(&out, "remove");
-        assert_eq!(json_str(&v, "status", "remove"), "success");
-        assert!(
-            json_i64(&v, "removed", "remove") >= 2,
-            "Gemfile + plugin dir removed:\n{v}"
-        );
-        assert_eq!(
-            gemfile_body(root),
-            GEMFILE,
-            "remove must restore the Gemfile byte-for-byte to its pre-setup state"
-        );
-        assert!(
-            !root.join(PLUGIN_DIR).exists(),
-            "remove must delete the generated plugin dir"
-        );
-        assert!(
-            !root.join(".socket/gem-plugin-stamp").exists(),
-            "remove must delete the plugin's digest stamp — unwiring must not \
-             orphan it in the committed .socket/"
-        );
-        assert!(
-            !root.join(".socket/.gitignore").exists(),
-            "remove must delete the .gitignore setup created (it held only our line)"
-        );
-        // The machine-local registration must be gone too. socket-patch was
-        // the ONLY registered plugin, so nothing in the index is left worth
-        // keeping — the index (and thereby every socket-patch entry) must not
-        // survive.
-        let residue = std::fs::read_to_string(&index_path).unwrap_or_default();
-        assert!(
-            !residue.contains("socket-patch"),
-            "remove must clear bundler's machine-local plugin registration \
-             (.bundle/plugin/index) — a dangling entry makes every later \
-             `bundle install` warn \"plugin paths don't exist ... Continuing \
-             without installing plugin socket-patch\":\n{residue}"
-        );
-        assert!(
-            !index_path.exists(),
-            "socket-patch was the only registered plugin: the emptied index \
-             must be deleted, not left as an all-empty husk"
-        );
-        assert!(
-            !root.join(".socket").exists(),
-            "remove must prune the emptied .socket/ (nothing else lived there): \
-             --remove restores the pre-setup tree"
-        );
-
-        // ── check (after remove): needs_configuration again, exit 1 ─────────
-        let (code, out, _) = run(root, &["setup", "--check", "--cwd", root_s, "--json"]);
-        assert_eq!(code, 1, "check after remove must exit 1 again");
-        assert_eq!(
-            json_str(
-                &parse_json(&out, "check (removed)"),
-                "status",
-                "check (removed)"
-            ),
-            "needs_configuration"
-        );
-    }
-
-    /// A Gemfile.lock pinning bundler 1.x, exactly as `bundle install` under
-    /// bundler 1.17.3 writes it (independent oracle for the version gate —
-    /// the lock probe works even where no `bundle` is on PATH).
-    const LOCK_1X: &str = "GEM\n  remote: https://rubygems.org/\n  specs:\n    \
-                           colorize (1.1.0)\n\nPLATFORMS\n  ruby\n\nDEPENDENCIES\n  \
-                           colorize (= 1.1.0)\n\nBUNDLED WITH\n   1.17.3\n";
-
-    /// [P1 bundler floor — refuse side] Bundler 1.x cannot load the
-    /// `plugin ... path:` directive `setup` writes (Plugin::DSL undef's
-    /// `:path`; the 1.x plugin installer knows only git/rubygems sources), so
-    /// a wired project dies on EVERY later `bundle install` with exit 7
-    /// ("Could not find gem 'socket-patch' ...") before plugin registration —
-    /// an error that never names socket-patch (campaign-confirmed on
-    /// 1.17.3). `setup` must refuse to wire such a project, loudly, and leave
-    /// the Gemfile untouched so `bundle install` keeps working.
-    #[test]
-    fn gem_setup_refuses_bundler_1x_locked_project() {
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        std::fs::write(root.join("Gemfile"), GEMFILE).unwrap();
-        std::fs::write(root.join("Gemfile.lock"), LOCK_1X).unwrap();
-        let root_s = root.to_str().unwrap();
-
-        let (code, out, err) = run(root, &["setup", "--cwd", root_s, "--yes", "--json"]);
-        assert_eq!(
-            code, 1,
-            "setup on a bundler-1.x-locked project must refuse (exit 1), not \
-             wire an install-breaking directive.\n{out}\n{err}"
-        );
-        let v = parse_json(&out, "setup (bundler 1.x)");
-        assert_eq!(
-            json_str(&v, "status", "setup (bundler 1.x)"),
-            "error",
-            "the refusal must be an error status:\n{v}"
-        );
-        // The refusal names the problem: the detected bundler and the floor.
-        let files = v.get("files").and_then(|f| f.as_array()).expect("files[]");
-        let gem_err = files
-            .iter()
-            .filter(|f| f.get("kind").and_then(|k| k.as_str()) == Some("gemfile"))
-            .find_map(|f| f.get("error").and_then(|e| e.as_str()))
-            .unwrap_or_else(|| panic!("no gemfile error entry in files[]:\n{v}"));
-        assert!(
-            gem_err.contains("1.17.3") && gem_err.contains("2.2"),
-            "the error must name the detected bundler and the >= 2.2 floor:\n{gem_err}"
-        );
-        // On disk: nothing was wired.
-        assert_eq!(
-            gemfile_body(root),
-            GEMFILE,
-            "the Gemfile must be byte-untouched after the refusal"
-        );
-        assert!(
-            !root.join(PLUGIN_DIR).exists(),
-            "no plugin dir may be generated for a refused project"
-        );
-    }
-
-    /// [P1 bundler floor — check side] The campaign's worst variant: a
-    /// project wired elsewhere (older CLI, or a machine with bundler >= 2.2)
-    /// whose lock pins bundler 1.x. Every `bundle install` fails with exit 7,
-    /// yet `setup --check` said "configured" — the CI gate the check exists
-    /// to be went green while installs were broken. `--check` must red-flag
-    /// the wired-but-unloadable state and name the remedy.
-    #[test]
-    fn gem_check_red_flags_wired_but_unloadable_bundler_1x() {
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        std::fs::write(root.join("Gemfile"), GEMFILE).unwrap();
-        let root_s = root.to_str().unwrap();
-
-        // Wire for real with the actual CLI (no 1.x lock yet, so the host —
-        // bundler >= 2.2 or none — lets setup proceed) ...
-        let (code, out, err) = run(root, &["setup", "--cwd", root_s, "--yes", "--json"]);
-        assert_eq!(code, 0, "precondition: wiring must succeed.\n{out}\n{err}");
-        assert!(gemfile_body(root).contains(MANAGED_MARKER));
-
-        // ... then the 1.x lock arrives (clone of a legacy project / CI image
-        // downgrade). This is the state the campaign reproduced.
-        std::fs::write(root.join("Gemfile.lock"), LOCK_1X).unwrap();
-
-        let (code, out, err) = run(root, &["setup", "--check", "--cwd", root_s, "--json"]);
-        assert_eq!(
-            code, 1,
-            "check must FAIL on a wired project whose bundler cannot load the \
-             plugin — this exact state broke every `bundle install` while \
-             check reported configured.\n{out}\n{err}"
-        );
-        let v = parse_json(&out, "check (wired, bundler 1.x)");
-        assert_eq!(
-            json_str(&v, "status", "check (wired, bundler 1.x)"),
-            "error",
-            "the unloadable wiring is an error, not a plain needs_configuration:\n{v}"
-        );
-        let files = v.get("files").and_then(|f| f.as_array()).expect("files[]");
-        let gem_err = files
-            .iter()
-            .filter(|f| f.get("kind").and_then(|k| k.as_str()) == Some("gemfile"))
-            .find_map(|f| f.get("error").and_then(|e| e.as_str()))
-            .unwrap_or_else(|| panic!("no gemfile error entry in files[]:\n{v}"));
-        assert!(
-            gem_err.contains("1.17.3") && gem_err.contains("2.2") && gem_err.contains("--remove"),
-            "the check error must name the detected bundler, the floor, and \
-             the `setup --remove` recovery:\n{gem_err}"
-        );
-
-        // Recovery: `setup --remove` still un-wires (the gate must never
-        // block it), restoring the Gemfile byte-for-byte.
-        let (code, out, err) = run(
-            root,
-            &["setup", "--remove", "--cwd", root_s, "--yes", "--json"],
-        );
-        assert_eq!(code, 0, "recovery remove must work.\n{out}\n{err}");
-        assert_eq!(gemfile_body(root), GEMFILE, "Gemfile restored");
-        assert!(!root.join(PLUGIN_DIR).exists(), "plugin dir removed");
-    }
-
-    /// `setup --remove` must clear bundler's machine-local plugin
-    /// registration SURGICALLY: only the socket-patch entries leave the
-    /// index; another plugin's registration (its hook subscriptions and
-    /// paths) survives byte-intact. And the index location must follow
-    /// bundler's own `BUNDLE_APP_CONFIG` resolution — a relative value
-    /// resolves against the project root (`Bundler.app_config_path`), not
-    /// the process cwd or a hardcoded `.bundle`.
-    #[test]
-    fn gem_setup_remove_strips_registration_surgically_under_bundle_app_config() {
-        let tmp = tempfile::tempdir().expect("create tempdir for the test project");
-        let root = tmp.path();
-        std::fs::write(root.join("Gemfile"), GEMFILE).expect("write the fixture Gemfile");
-        let root_s = root.to_str().expect("tempdir path is UTF-8");
-
-        // Wire the project (the registration below is what bundler would
-        // write on the first `bundle install` after this).
-        let (code, out, err) = run_env(
-            root,
-            &["setup", "--cwd", root_s, "--yes", "--json"],
-            &[("BUNDLE_APP_CONFIG", "bundle-config")],
-        );
-        assert_eq!(code, 0, "setup must exit 0.\n{out}\n{err}");
-
-        // The registration lives under the RELATIVE app-config dir, resolved
-        // against the project root — bundler's own resolution rule.
-        let plugin_reg_dir = root.join("bundle-config").join("plugin");
-        std::fs::create_dir_all(&plugin_reg_dir)
-            .expect("create the bundler plugin registration dir");
-        let index_path = plugin_reg_dir.join("index");
-        std::fs::write(
-            &index_path,
-            format!(
-                "---\ncommands:\nhooks:\n  after-install:\n  - \"other-plugin\"\n  \
-                 - \"socket-patch\"\n  after-install-all:\n  - \"socket-patch\"\n  \
-                 before-install-all:\n  - \"other-plugin\"\nload_paths:\n  other-plugin:\n  \
-                 - \"{root_s}/plugins/other-plugin/.\"\n  socket-patch:\n  \
-                 - \"{root_s}/.socket/bundler-plugin/.\"\nplugin_paths:\n  \
-                 other-plugin: \"{root_s}/plugins/other-plugin\"\n  \
-                 socket-patch: \"{root_s}/.socket/bundler-plugin\"\nsources:\n"
-            ),
-        )
-        .expect("write the bundler plugin index fixture");
-
-        let (code, out, err) = run_env(
-            root,
-            &["setup", "--remove", "--cwd", root_s, "--yes", "--json"],
-            &[("BUNDLE_APP_CONFIG", "bundle-config")],
-        );
-        assert_eq!(code, 0, "remove must exit 0.\n{out}\n{err}");
-        assert_eq!(
-            json_str(&parse_json(&out, "remove"), "status", "remove"),
-            "success"
-        );
-
-        let index = std::fs::read_to_string(&index_path).unwrap_or_else(|e| {
-            panic!(
-                "the index must SURVIVE (another plugin is still registered), \
-                 not be deleted wholesale: {e}"
-            )
-        });
-        assert!(
-            !index.contains("socket-patch"),
-            "every socket-patch registration entry must be stripped:\n{index}"
-        );
-        for kept in [
-            "  after-install:\n  - \"other-plugin\"",
-            "  before-install-all:\n  - \"other-plugin\"",
-            &format!("  other-plugin:\n  - \"{root_s}/plugins/other-plugin/.\"") as &str,
-            &format!("  other-plugin: \"{root_s}/plugins/other-plugin\"") as &str,
-        ] {
-            assert!(
-                index.contains(kept),
-                "the OTHER plugin's registration must survive verbatim — \
-                 missing {kept:?} in:\n{index}"
-            );
-        }
-        assert!(
-            !index.contains("after-install-all:"),
-            "a hook event left with NO subscribers must be dropped, not left \
-             as an empty key bundler chokes on:\n{index}"
-        );
-    }
-
-    /// `bundle` resolves the Gemfile by walking UP from the invocation dir,
-    /// and `discover_bundler_project` documents the same contract. Run from a
-    /// subdirectory with NO `--cwd` flag the CLI defaults to the RELATIVE
-    /// `--cwd .` — whose lexical `Path::parent()` chain is `Some("")` → `None`
-    /// without ever reaching the real parent directories — so the walk-up must
-    /// re-root itself on the process cwd to find the ancestor Gemfile, and the
-    /// wiring must land at the Gemfile's dir, never the invocation subdir.
-    #[test]
-    fn gem_setup_discovers_root_project_from_subdirectory() {
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        std::fs::write(root.join("Gemfile"), GEMFILE).unwrap();
-        let sub = root.join("lib").join("widgets");
-        std::fs::create_dir_all(&sub).unwrap();
-
-        // check from the subdir: the (unconfigured) root project must be found.
-        let (code, out, err) = run(&sub, &["setup", "--check", "--json"]);
-        assert_eq!(
-            code, 1,
-            "check from a subdirectory must find the unconfigured ancestor \
-             Gemfile (exit 1), not report no_files (exit 0).\n{out}\n{err}"
-        );
-        assert_eq!(
-            json_str(
-                &parse_json(&out, "check (subdir)"),
-                "status",
-                "check (subdir)"
-            ),
-            "needs_configuration"
-        );
-
-        // setup from the subdir: wires the ROOT project.
-        let (code, out, err) = run(&sub, &["setup", "--yes", "--json"]);
-        assert_eq!(
-            code, 0,
-            "setup from a subdirectory must exit 0.\n{out}\n{err}"
-        );
-        assert_eq!(
-            json_str(
-                &parse_json(&out, "setup (subdir)"),
-                "status",
-                "setup (subdir)"
-            ),
-            "success"
-        );
-        let body = gemfile_body(root);
-        assert!(
-            body.contains(MANAGED_MARKER),
-            "managed block lands in the ROOT Gemfile:\n{body}"
-        );
-        assert!(
-            root.join(PLUGIN_DIR).join("plugins.rb").exists(),
-            "plugin dir lands at the Gemfile's dir (the project root)"
-        );
-        assert!(
-            !sub.join(PLUGIN_DIR).exists(),
-            "no plugin dir may be generated in the invocation subdir"
-        );
-        assert!(
-            !sub.join("Gemfile").exists(),
-            "no Gemfile may be synthesized in the invocation subdir"
-        );
-    }
-}
-
-// ─────────────────────────────────────────────────────────────────────────
-// Bundler-1.17 docker leg for the >= 2.2 plugin floor.
-//
-// The host guards above pin the LOCK-probe path (`BUNDLED WITH 1.17.3`)
-// against the workspace binary; this leg drives a real bundler 1.17.3
-// toolchain (image: tests/docker/Dockerfile.gem-b1) end to end, covering the
-// `bundle --version` fallback path too, and proves the property the floor
-// exists for: after `setup` refuses, `bundle install` KEEPS WORKING. Before
-// the floor, setup wired `plugin 'socket-patch', path: ...` and bundler 1.17
-// (whose Plugin::DSL undef's `:path`) resolved it as an ordinary gem —
-// every later install exited 7 with an error that never named socket-patch
-// (campaign-confirmed).
-//
-// Soft-skips loudly when Docker / the image is absent, mirroring the
-// docker_e2e_* convention. NOTE: the leg runs the socket-patch binary BAKED
-// INTO the image — an image built before this fix still wires the project
-// and fails this leg deterministically; rebuild it (see the Dockerfile
-// header), or point SOCKET_PATCH_GEM_B1_IMAGE at a fresh uniquely-tagged
-// build.
-// ─────────────────────────────────────────────────────────────────────────
-mod bundler_floor_docker {
-    use std::process::Command;
-
-    fn image() -> String {
-        std::env::var("SOCKET_PATCH_GEM_B1_IMAGE")
-            .unwrap_or_else(|_| "socket-patch-test-gem-b1:latest".to_string())
-    }
-
-    /// Returns `true` when the leg should skip (docker or the image missing).
-    /// Prints a skip notice — Rust tests have no native "skipped" outcome.
-    /// Build locally with
-    /// `docker build -f tests/docker/Dockerfile.gem-b1 -t socket-patch-test-gem-b1:latest .`
-    #[must_use]
-    fn skip_if_no_image(image: &str) -> bool {
-        let Ok(out) = Command::new("docker")
-            .args(["image", "inspect", image])
-            .output()
-        else {
-            eprintln!("skipping: `docker` not on PATH");
-            return true;
-        };
-        if !out.status.success() {
-            eprintln!("skipping: docker image `{image}` not present");
-            return true;
-        }
-        false
-    }
-
-    /// The whole flow runs INSIDE the container (no bind mounts, no network):
-    /// scaffold → setup refuses (version fallback path, no lock yet) →
-    /// `bundle install` still works and writes the 1.17 lock → setup refuses
-    /// again (lock path) → `setup --check` red-flags. Host-side assertions
-    /// read the markers + JSON the script echoes.
-    #[test]
-    fn bundler_1x_setup_refuses_and_installs_keep_working() {
-        let image = image();
-        if skip_if_no_image(&image) {
-            return;
-        }
-        let script = r#"
-set -eu
-export SOCKET_NO_CONFIG=1 SOCKET_TELEMETRY_DISABLED=1
-mkdir -p /workspace/proj && cd /workspace/proj
-printf '# no dependencies\n' > Gemfile
-cp Gemfile /tmp/gemfile-pre
-
-# 1) No lock yet: the probe falls back to `bundle --version` (1.17.3).
-set +e
-socket-patch setup --yes --json --ecosystems gem > setup.json 2> setup.err
-rc=$?
-set -e
-echo "SETUP-RC=$rc"
-cat setup.json
-if grep -q 'socket-patch:managed' Gemfile; then echo 'WIRED-BUT-MUST-NOT'; exit 1; fi
-if [ -e .socket/bundler-plugin ]; then echo 'PLUGIN-DIR-BUT-MUST-NOT'; exit 1; fi
-cmp -s Gemfile /tmp/gemfile-pre && echo 'GEMFILE-UNTOUCHED'
-
-# 2) The refused project still installs (writes the 1.17 lock).
-bundle install > install.log 2>&1 || { echo 'INSTALL-BROKE'; cat install.log; exit 1; }
-echo 'INSTALL-OK'
-grep -q '1\.17\.3' Gemfile.lock && echo 'LOCK-1X'
-
-# 3) Lock present: the deterministic BUNDLED WITH path refuses too.
-set +e
-socket-patch setup --yes --json --ecosystems gem > setup2.json 2>&1
-rc2=$?
-set -e
-echo "SETUP2-RC=$rc2"
-
-# 4) check red-flags the unsupported state.
-set +e
-socket-patch setup --check --json --ecosystems gem > check.json 2>&1
-rc3=$?
-set -e
-echo "CHECK-RC=$rc3"
-cat check.json
-echo 'ALL-DONE'
-"#;
-        let out = Command::new("docker")
-            .args([
-                "run",
-                "--rm",
-                "--network",
-                "none",
-                &image,
-                "bash",
-                "-c",
-                script,
-            ])
-            .output()
-            .expect("docker run");
-        let stdout = String::from_utf8_lossy(&out.stdout).to_string();
-        let stderr = String::from_utf8_lossy(&out.stderr).to_string();
-        let ctx = format!("stdout:\n{stdout}\nstderr:\n{stderr}");
-        assert!(
-            stdout.contains("ALL-DONE"),
-            "the in-container flow aborted early (a refused project whose \
-             `bundle install` breaks is the campaign defect).\n{ctx}"
-        );
-        assert!(
-            stdout.contains("SETUP-RC=1"),
-            "setup must refuse (exit 1) under bundler 1.17.3.\n{ctx}"
-        );
-        // The refusal names the detected bundler and the floor (setup.json is
-        // echoed into stdout).
-        assert!(
-            stdout.contains("1.17.3") && stdout.contains("2.2"),
-            "the refusal must name bundler 1.17.3 and the >= 2.2 floor.\n{ctx}"
-        );
-        assert!(
-            stdout.contains("GEMFILE-UNTOUCHED"),
-            "the Gemfile must be byte-untouched after the refusal.\n{ctx}"
-        );
-        assert!(
-            stdout.contains("INSTALL-OK") && stdout.contains("LOCK-1X"),
-            "`bundle install` must keep working after the refusal.\n{ctx}"
-        );
-        assert!(
-            stdout.contains("SETUP2-RC=1"),
-            "the lock-probe path must refuse as well.\n{ctx}"
-        );
-        assert!(
-            stdout.contains("CHECK-RC=1") && stdout.contains("\"status\": \"error\""),
-            "`setup --check` must red-flag the unsupported bundler.\n{ctx}"
-        );
-    }
-}
-
-// ─────────────────────────────────────────────────────────────────────────
-// Runtime guards for the GENERATED plugin, driven through a REAL `bundle
-// install` (host bundler; validated against 4.0.15, and the same flows
-// against bundler 2.7 in the gem Docker image during development). Each test
-// wires a scratch project with the actual CLI binary (`setup --yes`), points
-// SOCKET_PATCH_BIN at a fake apply whose exit code and invocation log we
-// control, and asserts on bundler's real exit status + the on-disk state.
-//
-// Soft-skips (loudly, mirroring the docker_e2e_* convention) when no
-// `bundle`/`ruby` toolchain is on PATH — the CI setup-matrix job and any dev
-// machine with ruby run them for real.
-// ─────────────────────────────────────────────────────────────────────────
-#[cfg(unix)]
-mod plugin_runtime {
-    use std::os::unix::fs::PermissionsExt;
-    use std::path::{Path, PathBuf};
-    use std::process::Command;
-
-    /// Manifest fixture: one committed gem patch record (hashes are dummies —
-    /// the fake apply never checks them; what matters is that the manifest
-    /// EXISTS so the plugin's applier engages).
-    const MANIFEST: &str = r#"{
-  "patches": {
-    "pkg:gem/colorize@1.1.0": {
-      "uuid": "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
-      "exportedAt": "2026-01-01T00:00:00Z",
-      "files": { "package/lib/colorize.rb": { "beforeHash": "0000000000000000000000000000000000000000000000000000000000000000", "afterHash": "1111111111111111111111111111111111111111111111111111111111111111" } },
-      "vulnerabilities": {},
-      "description": "plugin-runtime fixture",
-      "license": "MIT",
-      "tier": "free"
-    }
-  }
-}
-"#;
-
-    /// Hand-pinned stamp locations (independent oracles, not copies of the
-    /// template constants): the project-scoped stamp the plugin must write,
-    /// and the legacy fixed-name file it must never write again.
-    const STAMP_REL: &str = ".socket/gem-plugin-stamp";
-    const LEGACY_STAMP_NAME: &str = ".socket-patch-gem-stamp";
-
-    fn binary() -> PathBuf {
-        env!("CARGO_BIN_EXE_socket-patch").into()
-    }
-
-    fn have(cmd: &str) -> bool {
-        Command::new(cmd)
-            .arg("--version")
-            .stdout(std::process::Stdio::null())
-            .stderr(std::process::Stdio::null())
-            .status()
-            .map(|s| s.success())
-            .unwrap_or(false)
-    }
-
-    /// Strip every ambient var that could flip a verdict: the CLI's SOCKET_*
-    /// surface (a dev's SOCKET_PATCH_STRICT or SOCKET_DRY_RUN must not leak
-    /// into the child), and bundler/rubygems config that could retarget the
-    /// install (BUNDLE_GEMFILE, GEM_HOME, RUBYOPT).
-    fn scrub(cmd: &mut Command) {
-        for (key, _) in std::env::vars_os() {
-            let name = key.to_string_lossy().into_owned();
-            let hit = (name.starts_with("SOCKET_") && name != "SOCKET_NO_CONFIG")
-                || name.starts_with("BUNDLE_")
-                || name.starts_with("GEM_")
-                || name == "RUBYOPT";
-            if hit {
-                cmd.env_remove(&name);
-            }
-        }
-        cmd.env("SOCKET_TELEMETRY_DISABLED", "1");
-    }
-
-    fn run(mut cmd: Command) -> (i32, String, String) {
-        let out = cmd.output().expect("spawn child process");
-        (
-            out.status.code().unwrap_or(-1),
-            String::from_utf8_lossy(&out.stdout).to_string(),
-            String::from_utf8_lossy(&out.stderr).to_string(),
-        )
-    }
-
-    /// `bundle install` in `root` with the fake apply bin + extra env.
-    fn bundle_install(root: &Path, fake: &Path, extra: &[(&str, &str)]) -> (i32, String, String) {
-        let mut cmd = Command::new("bundle");
-        cmd.arg("install").current_dir(root);
-        scrub(&mut cmd);
-        cmd.env("BUNDLE_PATH", "vendor/bundle");
-        cmd.env("SOCKET_PATCH_BIN", fake);
-        for (k, v) in extra {
-            cmd.env(k, v);
-        }
-        run(cmd)
-    }
-
-    /// A fake `socket-patch` that logs each invocation and exits `code`.
-    /// Returns (bin path, log path).
-    fn write_fake_apply(dir: &Path, code: i32) -> (PathBuf, PathBuf) {
-        let log = dir.join("apply.log");
-        std::fs::write(&log, "").unwrap();
-        let bin = dir.join("fake-socket-patch");
-        std::fs::write(
-            &bin,
-            format!(
-                "#!/bin/sh\nprintf 'APPLY-CALLED %s\\n' \"$*\" >> '{}'\nexit {code}\n",
-                log.display()
-            ),
-        )
-        .unwrap();
-        std::fs::set_permissions(&bin, std::fs::Permissions::from_mode(0o755)).unwrap();
-        (bin, log)
-    }
-
-    fn apply_calls(log: &Path) -> Vec<String> {
-        std::fs::read_to_string(log)
-            .unwrap_or_default()
-            .lines()
-            .map(str::to_string)
-            .collect()
-    }
-
-    /// Scaffold a setup-wired project the way a fresh clone sees it: a
-    /// Gemfile, a committed manifest, and the plugin generated by the REAL
-    /// binary. A zero-dependency Gemfile keeps the install offline — bundler
-    /// still registers the plugin and fires `after-install-all` (verified on
-    /// bundler 2.7 and 4.0.15), which is all these guards need.
-    fn scaffold(root: &Path) {
-        std::fs::write(root.join("Gemfile"), "# no dependencies\n").unwrap();
-        std::fs::create_dir_all(root.join(".socket")).unwrap();
-        std::fs::write(root.join(".socket/manifest.json"), MANIFEST).unwrap();
-
-        let mut cmd = Command::new(binary());
-        cmd.args(["setup", "--yes", "--json"]).current_dir(root);
-        scrub(&mut cmd);
-        let (code, out, err) = run(cmd);
-        assert_eq!(code, 0, "setup --yes must wire the plugin.\n{out}\n{err}");
-        assert!(
-            root.join(".socket/bundler-plugin/plugins.rb").exists(),
-            "setup must generate plugins.rb"
-        );
-    }
-
-    /// [P0 bootstrap deadlock] On a fresh clone of a setup-wired project the
-    /// FIRST `bundle install` evaluates plugins.rb at plugin REGISTRATION,
-    /// before any project gem lands; apply legitimately finds nothing and
-    /// exits 1. The old plugin raised Bundler::BundlerError there, so that
-    /// first install (and every retry) died with "Failed to install plugin"
-    /// — reproduced at exit 29 under bundler 4.0.15 / exit 1 under 2.7. The
-    /// generated plugin must instead warn (with the manual remediation) and
-    /// let the install succeed.
-    #[test]
-    fn first_bundle_install_survives_failing_apply() {
-        if !have("bundle") {
-            eprintln!("skip plugin_runtime: bundler not on PATH");
-            return;
-        }
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        scaffold(root);
-        let (fake, log) = write_fake_apply(root, 1);
-
-        let (code, out, err) = bundle_install(root, &fake, &[]);
-        assert_eq!(
-            code, 0,
-            "the FIRST bundle install of a setup-wired fresh checkout must \
-             succeed even when apply fails (bootstrap deadlock).\n{out}\n{err}"
-        );
-        // Anti-vacuity: the failure was real — the plugin DID shell apply.
-        let calls = apply_calls(&log);
-        assert!(
-            calls
-                .iter()
-                .any(|c| c.contains("apply --ecosystems gem --offline --silent")),
-            "the plugin must have invoked the (failing) gem-scoped apply:\n{calls:?}"
-        );
-        // The warning names what failed and how to remediate.
-        assert!(
-            err.contains("socket-patch:"),
-            "a failing apply must be surfaced on stderr:\n{err}"
-        );
-        assert!(
-            err.contains("socket-patch apply --ecosystems gem"),
-            "the warning must name the manual remediation command:\n{err}"
-        );
-        assert!(
-            err.contains("SOCKET_PATCH_STRICT"),
-            "the warning must mention the strict escape hatch:\n{err}"
-        );
-
-        // A retry is not poisoned either (plugin registration completed).
-        let (code, out, err) = bundle_install(root, &fake, &[]);
-        assert_eq!(
-            code, 0,
-            "retried bundle install must also succeed.\n{out}\n{err}"
-        );
-    }
-
-    /// SOCKET_PATCH_STRICT=1 restores raise-on-failure for builds that must
-    /// not proceed with unpatched gems: the same failing-apply install must
-    /// break the build again.
-    #[test]
-    fn strict_mode_fails_bundle_install_on_apply_failure() {
-        if !have("bundle") {
-            eprintln!("skip plugin_runtime: bundler not on PATH");
-            return;
-        }
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        scaffold(root);
-        let (fake, log) = write_fake_apply(root, 1);
-
-        let (code, out, err) = bundle_install(root, &fake, &[("SOCKET_PATCH_STRICT", "1")]);
-        assert_ne!(
-            code, 0,
-            "strict mode must fail the build on a patch failure.\n{out}\n{err}"
-        );
-        assert!(
-            !apply_calls(&log).is_empty(),
-            "the strict failure must come from a real apply invocation"
-        );
-        assert!(
-            err.contains("socket-patch"),
-            "the strict failure must carry the socket-patch message:\n{err}"
-        );
-        // The strict raise must tell the truth about the active mode: the
-        // tolerant trailer ("`bundle install` continues; set
-        // SOCKET_PATCH_STRICT=1 ...") is false on both counts while the
-        // install is failing and the var is already set.
-        assert!(
-            err.contains("because SOCKET_PATCH_STRICT is set"),
-            "the strict failure must say WHY the install is failing:\n{err}"
-        );
-        assert!(
-            !err.contains("`bundle install` continues"),
-            "the strict failure must not claim the install continues:\n{err}"
-        );
-    }
-
-    /// [P0 regression: committed stale stamp] `.socket/` is a committed
-    /// directory, so a stamp that reaches version control (a blanket
-    /// `git add .socket`) arrives on every fresh clone BEFORE the first
-    /// `bundle install`. If the bootstrap gate keyed on the stamp's
-    /// existence, plugin REGISTRATION would shell the applier (targets
-    /// absent -> apply fails) and a strict-mode raise there resurrects the
-    /// exact deadlock this plugin exists to avoid — exit 29, "Failed to
-    /// install plugin", every retry identical (reproduced on bundler
-    /// 4.0.15). The gate must key on the patch targets existing on disk:
-    /// registration completes, strict enforcement waits for the
-    /// post-install hooks.
-    #[test]
-    fn committed_stale_stamp_does_not_deadlock_strict_fresh_clone() {
-        if !have("bundle") {
-            eprintln!("skip plugin_runtime: bundler not on PATH");
-            return;
-        }
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        scaffold(root);
-        // The stale stamp a teammate committed, exactly as a fresh clone sees it.
-        std::fs::write(root.join(STAMP_REL), "a".repeat(64)).unwrap();
-        let (fake, log) = write_fake_apply(root, 1);
-
-        let (code, out, err) = bundle_install(root, &fake, &[("SOCKET_PATCH_STRICT", "1")]);
-        // Registration must complete — the strict failure may only come from
-        // the post-install hooks, never from plugin registration.
-        assert!(
-            !err.contains("Failed to install plugin"),
-            "a committed stale stamp must not fail plugin REGISTRATION.\n{out}\n{err}"
-        );
-        assert!(
-            root.join(".bundle/plugin/index").is_file(),
-            "registration must be recorded despite the strict failure.\n{out}\n{err}"
-        );
-        assert_ne!(
-            code, 0,
-            "strict mode still fails the install — from the hook.\n{out}\n{err}"
-        );
-        assert!(
-            !apply_calls(&log).is_empty(),
-            "anti-vacuity: the forced post-install apply ran (and failed)"
-        );
-
-        // The deadlock is gone: with apply working, the SAME checkout (stale
-        // stamp still in place) converges on retry.
-        let (fake, _log) = write_fake_apply(root, 0);
-        let (code, out, err) = bundle_install(root, &fake, &[("SOCKET_PATCH_STRICT", "1")]);
-        assert_eq!(
-            code, 0,
-            "retry with a working apply must succeed — registration was never \
-             poisoned.\n{out}\n{err}"
-        );
-    }
-
-    /// The bootstrap gate reads the LIVE gem tree, never the stamp. Both
-    /// directions matter: with no patch target on disk the gated triggers
-    /// must not shell out no matter what a (stale, possibly committed) stamp
-    /// says; with the target present they must re-apply even when the stamp
-    /// is missing — a `bundle pristine` run after deleting the stamp used to
-    /// leave the patches silently reverted until the next `bundle install`
-    /// (reproduced on bundler 4.0.15).
-    #[test]
-    fn bootstrap_gate_keys_on_target_presence_not_stamp() {
-        if !have("ruby") {
-            eprintln!("skip plugin_runtime: ruby not on PATH");
-            return;
-        }
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        scaffold(root);
-        let (fake, log) = write_fake_apply(root, 0);
-
-        // Drive the gated path exactly as the load-time / per-gem hooks do.
-        let drive = |label: &str| {
-            let mut cmd = Command::new("ruby");
-            cmd.args([
-                "-e",
-                "require \"bundler\"; load ARGV[0]; SocketPatch.apply!(bootstrap_gate: true)",
-                "--",
-            ])
-            .arg(root.join(".socket/bundler-plugin/plugins.rb"))
-            .current_dir(root);
-            scrub(&mut cmd);
-            cmd.env("BUNDLE_PATH", "vendor/bundle");
-            cmd.env("SOCKET_PATCH_BIN", &fake);
-            let (code, out, err) = run(cmd);
-            assert_eq!(code, 0, "{label}: gated drive failed.\n{out}\n{err}");
-        };
-
-        // Fresh clone: no target on disk, stale stamp committed.
-        std::fs::write(root.join(STAMP_REL), "b".repeat(64)).unwrap();
-        drive("no target, stale stamp");
-        assert_eq!(
-            apply_calls(&log).len(),
-            0,
-            "no target on disk -> the gated trigger must not shell out, \
-             whatever the stamp says"
-        );
-
-        // Target installed, stamp deleted: the pristine-heal case.
-        let mut cmd = Command::new("ruby");
-        cmd.args(["-e", "require \"bundler\"; print Bundler.bundle_path"])
-            .current_dir(root);
-        scrub(&mut cmd);
-        cmd.env("BUNDLE_PATH", "vendor/bundle");
-        let (code, bundle_path, err) = run(cmd);
-        assert_eq!(code, 0, "Bundler.bundle_path probe failed: {err}");
-        let target = PathBuf::from(bundle_path.trim()).join("gems/colorize-1.1.0/lib/colorize.rb");
-        std::fs::create_dir_all(target.parent().unwrap()).unwrap();
-        std::fs::write(&target, "REVERTED BY PRISTINE\n").unwrap();
-        std::fs::remove_file(root.join(STAMP_REL)).unwrap();
-
-        drive("target present, no stamp");
-        assert_eq!(
-            apply_calls(&log).len(),
-            1,
-            "with the target on disk and nothing validly stamped, the gated \
-             trigger must re-apply — deleting the stamp defers nothing"
-        );
-        drive("digest-gated no-op");
-        assert_eq!(
-            apply_calls(&log).len(),
-            1,
-            "the re-apply stamped the state; the next gated probe is a no-op"
-        );
-    }
-
-    /// [P2 stamp location] A successful apply stamps the PROJECT
-    /// (.socket/gem-plugin-stamp), not a fixed-name file under the bundle
-    /// path (machine-global when no path is configured — shared and clobbered
-    /// across every socket-patch project on the host). And the digest gate
-    /// holds: a second, fully-cached install runs exactly one more (forced
-    /// after-install-all) apply — the gated triggers stay quiet.
-    #[test]
-    fn successful_apply_stamps_project_scoped() {
-        if !have("bundle") {
-            eprintln!("skip plugin_runtime: bundler not on PATH");
-            return;
-        }
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        scaffold(root);
-        let (fake, log) = write_fake_apply(root, 0);
-
-        let (code, out, err) = bundle_install(root, &fake, &[]);
-        assert_eq!(code, 0, "install must succeed.\n{out}\n{err}");
-        assert!(
-            !err.contains("socket-patch:"),
-            "a successful apply must not warn:\n{err}"
-        );
-
-        let stamp = root.join(STAMP_REL);
-        assert!(
-            stamp.is_file(),
-            "the digest stamp must land at the project-scoped {STAMP_REL}"
-        );
-        let content = std::fs::read_to_string(&stamp).unwrap();
-        let content = content.trim();
-        assert!(
-            content.len() == 64 && content.bytes().all(|b| b.is_ascii_hexdigit()),
-            "the stamp must hold one sha256 hex digest, got: {content:?}"
-        );
-        // No legacy fixed-name stamp anywhere under the bundle path.
-        let legacy_hits: Vec<_> = walk(&root.join("vendor"))
-            .into_iter()
-            .filter(|p| p.file_name().is_some_and(|n| n == LEGACY_STAMP_NAME))
-            .collect();
-        assert!(
-            legacy_hits.is_empty(),
-            "no legacy bundle-path stamp may be written: {legacy_hits:?}"
-        );
-
-        let after_first = apply_calls(&log).len();
-        let (code, out, err) = bundle_install(root, &fake, &[]);
-        assert_eq!(code, 0, "cached install must succeed.\n{out}\n{err}");
-        assert_eq!(
-            apply_calls(&log).len(),
-            after_first + 1,
-            "a fully-cached install runs exactly the one forced \
-             after-install-all apply; the digest-gated triggers must not \
-             shell out again"
-        );
-    }
-
-    /// [P2 remove leaves registration dangling] Bundler records the plugin
-    /// machine-locally at first install (`.bundle/plugin/index`: hook
-    /// subscriptions + plugin/load paths). `setup --remove` unwires the
-    /// Gemfile and deletes the generated plugin dir — if it leaves that
-    /// registration behind, EVERY later `bundle install` prints bundler's
-    /// 5-line "The following plugin paths don't exist ... Continuing without
-    /// installing plugin socket-patch" block with a misleading reinstall
-    /// suggestion (install still exits 0, so nothing ever heals it).
-    /// Reproduced against real bundler 2.7.2 and 4.0.18 in the 2026-08 e2e
-    /// campaign; this drives the same flow with the host bundler.
-    #[test]
-    fn setup_remove_clears_bundler_plugin_registration() {
-        if !have("bundle") {
-            eprintln!("skip plugin_runtime: bundler not on PATH");
-            return;
-        }
-        let tmp = tempfile::tempdir().expect("create tempdir for the test project");
-        let root = tmp.path();
-        scaffold(root);
-        let (fake, _log) = write_fake_apply(root, 0);
-
-        // First install: bundler registers the plugin machine-locally.
-        let (code, out, err) = bundle_install(root, &fake, &[]);
-        assert_eq!(code, 0, "wired install must succeed.\n{out}\n{err}");
-        let index_path = root.join(".bundle/plugin/index");
-        assert!(
-            std::fs::read_to_string(&index_path)
-                .unwrap_or_default()
-                .contains("socket-patch"),
-            "precondition: bundler must have registered the plugin at {}",
-            index_path.display()
-        );
-
-        // Unwire.
-        let mut cmd = Command::new(binary());
-        cmd.args(["setup", "--remove", "--yes", "--json"])
-            .current_dir(root);
-        scrub(&mut cmd);
-        let (code, out, err) = run(cmd);
-        assert_eq!(code, 0, "setup --remove must exit 0.\n{out}\n{err}");
-        assert!(
-            out.contains("\"status\": \"success\""),
-            "setup --remove must report success:\n{out}"
-        );
-
-        // No socket-patch registration may survive under .bundle/plugin.
-        let residue = std::fs::read_to_string(&index_path).unwrap_or_default();
-        assert!(
-            !residue.contains("socket-patch"),
-            ".bundle/plugin must hold no socket-patch entry after remove:\n{residue}"
-        );
-
-        // And the REAL oracle: the next bundle install is silent about the
-        // unwired plugin — no "plugin paths don't exist", no "Continuing
-        // without installing plugin", on either stream.
-        let (code, out, err) = bundle_install(root, &fake, &[]);
-        assert_eq!(
-            code, 0,
-            "post-remove install must still succeed.\n{out}\n{err}"
-        );
-        let combined = format!("{out}\n{err}");
-        assert!(
-            !combined.contains("plugin paths don't exist"),
-            "post-remove `bundle install` must not warn about the unwired \
-             plugin's missing paths:\n{combined}"
-        );
-        assert!(
-            !combined.contains("Continuing without installing plugin"),
-            "post-remove `bundle install` must not print bundler's \
-             skipped-plugin block:\n{combined}"
-        );
-    }
-
-    /// [P1 digest honesty + migration] Drive the applier directly with plain
-    /// ruby (no bundler process, no network): the digest stamp must reflect
-    /// the ACTUAL on-disk gem-file state, so an out-of-band reversion
-    /// (`bundle pristine`, `gem pristine`, a manual edit) flips the digest
-    /// and the next trigger re-applies; and the legacy machine-global stamp
-    /// must be cleaned up, never read.
-    #[test]
-    fn digest_tracks_gem_file_content_and_legacy_stamp_is_removed() {
-        if !have("ruby") {
-            eprintln!("skip plugin_runtime: ruby not on PATH");
-            return;
-        }
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        scaffold(root);
-        let (fake, log) = write_fake_apply(root, 0);
-
-        // Where bundler would install this project's gems (BUNDLE_PATH set,
-        // so <root>/vendor/bundle/ruby/<ver>).
-        let mut cmd = Command::new("ruby");
-        cmd.args(["-e", "require \"bundler\"; print Bundler.bundle_path"])
-            .current_dir(root);
-        scrub(&mut cmd);
-        cmd.env("BUNDLE_PATH", "vendor/bundle");
-        let (code, bundle_path, err) = run(cmd);
-        assert_eq!(code, 0, "Bundler.bundle_path probe failed: {err}");
-        let bundle_path = PathBuf::from(bundle_path.trim());
-
-        // The installed file the manifest's patch record targets.
-        let target = bundle_path.join("gems/colorize-1.1.0/lib/colorize.rb");
-        std::fs::create_dir_all(target.parent().unwrap()).unwrap();
-        std::fs::write(&target, "UPSTREAM CONTENT\n").unwrap();
-        // A stale stamp from the old plugin version in the shared location.
-        let legacy = bundle_path.join(LEGACY_STAMP_NAME);
-        std::fs::write(&legacy, "stale digest from another project\n").unwrap();
-
-        let drive = |label: &str| {
-            let mut cmd = Command::new("ruby");
-            cmd.args([
-                "-e",
-                "require \"bundler\"; load ARGV[0]; SocketPatch.apply!",
-                "--",
-            ])
-            .arg(root.join(".socket/bundler-plugin/plugins.rb"))
-            .current_dir(root);
-            scrub(&mut cmd);
-            cmd.env("BUNDLE_PATH", "vendor/bundle");
-            cmd.env("SOCKET_PATCH_BIN", &fake);
-            let (code, out, err) = run(cmd);
-            assert_eq!(
-                code, 0,
-                "{label}: driving the applier failed.\n{out}\n{err}"
-            );
-        };
-
-        drive("initial apply");
-        assert_eq!(
-            apply_calls(&log).len(),
-            1,
-            "first drive must shell apply (nothing stamped yet)"
-        );
-        assert!(root.join(STAMP_REL).is_file(), "stamp written");
-        assert!(
-            !legacy.exists(),
-            "the legacy bundle-path stamp must be deleted on the first run"
-        );
-
-        drive("stamped no-op");
-        assert_eq!(
-            apply_calls(&log).len(),
-            1,
-            "unchanged state must be digest-gated to a no-op"
-        );
-
-        // Out-of-band reversion: the committed inputs (manifest, blobs, lock)
-        // are untouched — only the installed gem file changed back.
-        std::fs::write(&target, "REVERTED BY PRISTINE\n").unwrap();
-        drive("after reversion");
-        assert_eq!(
-            apply_calls(&log).len(),
-            2,
-            "reverting the installed gem file must flip the digest and \
-             re-run apply — a manifest-only digest misses this"
-        );
-    }
-
-    /// [P2 Windows platform-gem glob] `Bundler.bundle_path` carries
-    /// backslash separators through verbatim (Windows spelling), and
-    /// `Dir.glob` treats `\` as an escape on EVERY platform — so the
-    /// platform-install wildcard (`<gems>/<name>-<version>-*/<rel>`) built
-    /// from that base escape-eats the separator, matches nothing, and
-    /// platform installs (colorize-1.1.0-x64-mingw-ucrt) silently drop out
-    /// of the digest: a `bundle pristine` reversion of them leaves the stamp
-    /// matching and the re-apply skipped. Simulated on this host by feeding
-    /// bundler a backslash-bearing BUNDLE_PATH while the real tree lives at
-    /// the forward-slash spelling — exactly the two-spellings-one-directory
-    /// situation Windows creates (glob escape semantics are identical
-    /// everywhere). The plugin must glob a slash-normalized base; forward
-    /// slashes are valid separators on Windows.
-    #[test]
-    fn backslash_bundle_path_still_digests_platform_gem_files() {
-        if !have("ruby") {
-            eprintln!("skip plugin_runtime: ruby not on PATH");
-            return;
-        }
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        scaffold(root);
-        let (fake, log) = write_fake_apply(root, 0);
-
-        // Where bundler puts this project's gems under the backslash spelling.
-        let mut cmd = Command::new("ruby");
-        cmd.args(["-e", "require \"bundler\"; print Bundler.bundle_path"])
-            .current_dir(root);
-        scrub(&mut cmd);
-        cmd.env("BUNDLE_PATH", "vendor\\bundle");
-        let (code, bundle_path, err) = run(cmd);
-        assert_eq!(code, 0, "Bundler.bundle_path probe failed: {err}");
-        let bundle_path = bundle_path.trim().to_string();
-        assert!(
-            bundle_path.contains('\\'),
-            "precondition: bundler must carry the backslash spelling through \
-             verbatim (the Windows behavior this test simulates), got: \
-             {bundle_path:?}"
-        );
-
-        // On Windows both spellings denote the SAME directory; materialize
-        // the real tree at the slash spelling — the one the normalized glob
-        // must reach from the backslash-bearing base. Only a PLATFORM install
-        // exists: the plain `colorize-1.1.0` direct join never globs and is
-        // not at issue.
-        let target = PathBuf::from(bundle_path.replace('\\', "/"))
-            .join("gems/colorize-1.1.0-x64-mingw-ucrt/lib/colorize.rb");
-        std::fs::create_dir_all(target.parent().unwrap()).unwrap();
-        std::fs::write(&target, "PATCHED PLATFORM CONTENT\n").unwrap();
-
-        let drive = |label: &str| {
-            let mut cmd = Command::new("ruby");
-            cmd.args([
-                "-e",
-                "require \"bundler\"; load ARGV[0]; SocketPatch.apply!",
-                "--",
-            ])
-            .arg(root.join(".socket/bundler-plugin/plugins.rb"))
-            .current_dir(root);
-            scrub(&mut cmd);
-            cmd.env("BUNDLE_PATH", "vendor\\bundle");
-            cmd.env("SOCKET_PATCH_BIN", &fake);
-            let (code, out, err) = run(cmd);
-            assert_eq!(
-                code, 0,
-                "{label}: driving the applier failed.\n{out}\n{err}"
-            );
-        };
-
-        drive("initial apply");
-        assert_eq!(
-            apply_calls(&log).len(),
-            1,
-            "first drive must shell apply (nothing stamped yet)"
-        );
-        assert!(root.join(STAMP_REL).is_file(), "stamp written");
-        drive("stamped no-op");
-        assert_eq!(
-            apply_calls(&log).len(),
-            1,
-            "unchanged state must be digest-gated to a no-op"
-        );
-
-        // The pristine reversion the digest exists to catch — of the
-        // PLATFORM install this time.
-        std::fs::write(&target, "REVERTED BY PRISTINE\n").unwrap();
-        drive("after platform-install reversion");
-        assert_eq!(
-            apply_calls(&log).len(),
-            2,
-            "reverting the platform gem install must flip the digest and \
-             re-run apply — an escape-eaten glob omits platform installs \
-             from the digest and skips this re-apply"
-        );
-
-        // And directly: the platform install is enumerated as a patch target.
-        let mut cmd = Command::new("ruby");
-        cmd.args([
-            "-e",
-            "require \"bundler\"; load ARGV[0]; puts SocketPatch.patch_target_files",
-            "--",
-        ])
-        .arg(root.join(".socket/bundler-plugin/plugins.rb"))
-        .current_dir(root);
-        scrub(&mut cmd);
-        cmd.env("BUNDLE_PATH", "vendor\\bundle");
-        cmd.env("SOCKET_PATCH_BIN", &fake);
-        let (code, out, err) = run(cmd);
-        assert_eq!(code, 0, "patch_target_files probe failed.\n{out}\n{err}");
-        assert!(
-            out.contains("colorize-1.1.0-x64-mingw-ucrt"),
-            "patch_target_files must enumerate the platform install under a \
-             backslash-bearing bundle path:\n{out}"
-        );
-    }
-
-    fn walk(dir: &Path) -> Vec<PathBuf> {
-        let mut out = Vec::new();
-        let Ok(entries) = std::fs::read_dir(dir) else {
-            return out;
-        };
-        for entry in entries.flatten() {
-            let p = entry.path();
-            if p.is_dir() {
-                out.extend(walk(&p));
-            } else {
-                out.push(p);
-            }
-        }
-        out
-    }
-
-    /// MANIFEST-LESS vendored checkout (the depscan / `scan --mode vendored`
-    /// shape: a committed `.socket/vendor/gem/<uuid>/` artifact wired by a
-    /// Gemfile `path:`, NO `.socket/manifest.json`) with the setup plugin
-    /// wired, driven with the REAL binary as the plugin's apply under
-    /// `SOCKET_PATCH_STRICT=1`: the plugin's `apply` finds no manifest and
-    /// must exit 0, so a strict `bundle install` still succeeds (and the
-    /// real bundler locks the PATH section); the embedded `apply --vex` of
-    /// the installed checkout then attests the vendored patch from the lock
-    /// and the patch API. Offline, with no ledger, the patch is
-    /// `record_unavailable` — never attested from the `path:` alone.
-    #[test]
-    fn manifest_less_vendored_checkout_installs_strict_and_apply_vex_attests() {
-        use crate::vex_e2e_common::{
-            assert_attested, assert_not_attested, patch_view, run_vex, Marker, PatchApi, VexRun,
-            VexVia,
-        };
-        if !have("bundle") {
-            eprintln!("skip plugin_runtime: bundler not on PATH");
-            return;
-        }
-        const UUID: &str = "6a7b8c9d-0e1f-4a2b-8c3d-4e5f6a7b8c9d";
-        const PURL: &str = "pkg:gem/vexgem@1.0.0";
-        const PATCHED: &[u8] = b"module Vexgem\n  STATUS = \"PATCHED\"\nend\n";
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        let rel = format!(".socket/vendor/gem/{UUID}/vexgem-1.0.0");
-        let art = root.join(&rel);
-        std::fs::create_dir_all(art.join("lib")).unwrap();
-        std::fs::write(art.join("lib/vexgem.rb"), PATCHED).unwrap();
-        std::fs::write(
-            art.join("vexgem.gemspec"),
-            "Gem::Specification.new do |s|\n  s.name = \"vexgem\"\n  s.version = \"1.0.0\"\n  \
-             s.summary = \"vex fixture\"\n  s.authors = [\"socket-patch e2e\"]\n  \
-             s.files = [\"lib/vexgem.rb\"]\nend\n",
-        )
-        .unwrap();
-        std::fs::write(
-            root.join("Gemfile"),
-            format!("gem \"vexgem\", \"1.0.0\", path: \"{rel}\"\n"),
-        )
-        .unwrap();
-        let mut cmd = Command::new(binary());
-        cmd.args(["setup", "--yes", "--json"]).current_dir(root);
-        scrub(&mut cmd);
-        let (code, out, err) = run(cmd);
-        assert_eq!(code, 0, "setup --yes must wire the plugin.\n{out}\n{err}");
-        assert!(
-            !root.join(".socket/manifest.json").exists(),
-            "setup wrote a manifest"
-        );
-
-        let (code, out, err) = bundle_install(root, &binary(), &[("SOCKET_PATCH_STRICT", "1")]);
-        assert_eq!(
-            code, 0,
-            "a STRICT install of a manifest-less vendored checkout must succeed: the \
-             plugin's apply has nothing to apply.\n{out}\n{err}"
-        );
-        let lock = std::fs::read_to_string(root.join("Gemfile.lock")).unwrap();
-        assert!(
-            lock.contains(&format!(
-                "PATH\n  remote: {rel}\n  specs:\n    vexgem (1.0.0)"
-            )),
-            "bundler must lock the vendored PATH source:\n{lock}"
-        );
-        assert!(
-            !root.join(".socket/manifest.json").exists(),
-            "the plugin wrote a manifest"
-        );
-
-        let api = PatchApi::start(vec![(
-            UUID.into(),
-            patch_view(
-                UUID,
-                PURL,
-                &[("lib/vexgem.rb", &crate::vex_e2e_common::git_sha256(PATCHED))],
-                &[("GHSA-vexg-setu-0001", &["CVE-2026-9191"])],
-            ),
-        )]);
-        let base = VexRun {
-            product: Some("pkg:gem/app@1.0.0".into()),
-            ..VexRun::online(&api)
-        };
-        let out = run_vex(&binary(), root, &base.clone().via(VexVia::Apply));
-        assert_eq!(out.code, Some(0), "apply --vex: {out}\n{lock}");
-        assert_eq!(out.envelope["status"], "noManifest", "{out}");
-        assert_attested(
-            out.doc(),
-            PURL,
-            UUID,
-            Marker::Vendored,
-            &[("GHSA-vexg-setu-0001", &["CVE-2026-9191"])],
-        );
-        let offline = VexRun {
-            offline: true,
-            ..base
-        };
-        let before = api.request_count();
-        let out = run_vex(&binary(), root, &offline);
-        assert_eq!(out.code, Some(1), "offline, no ledger: {out}");
-        assert_not_attested(&out.envelope, PURL, "record_unavailable");
-        assert_eq!(api.request_count(), before, "--offline made requests");
-    }
-}
-
-// ─────────────────────────────────────────────────────────────────────────
-// Guards for the RubyGems CLI launcher (gem/socket-patch), driven with the
-// host ruby. Ruby-gated with a loud skip, like `plugin_runtime` above.
-// ─────────────────────────────────────────────────────────────────────────
-#[cfg(unix)]
-mod launcher_guard {
-    use std::os::unix::fs::PermissionsExt;
-    use std::path::{Path, PathBuf};
-    use std::process::Command;
-
-    fn have_ruby() -> bool {
-        Command::new("ruby")
-            .arg("--version")
-            .stdout(std::process::Stdio::null())
-            .stderr(std::process::Stdio::null())
-            .status()
-            .map(|s| s.success())
-            .unwrap_or(false)
-    }
-
-    /// The launcher under test, resolved from the workspace checkout.
-    fn launcher_path() -> PathBuf {
-        Path::new(env!("CARGO_MANIFEST_DIR"))
-            .join("../../gem/socket-patch/lib/socket_patch/launcher.rb")
-            .canonicalize()
-            .expect("launcher.rb must exist in the workspace")
-    }
-
-    /// Strip the ambient vars that could flip a verdict, mirroring
-    /// `plugin_runtime::scrub`: the CLI's SOCKET_* surface, and the
-    /// bundler/rubygems config a `bundle exec cargo test` run injects
-    /// (RUBYOPT=-rbundler/setup, BUNDLE_*, GEM_*) — which would activate a
-    /// foreign bundle inside the child ruby under test.
-    fn scrub(cmd: &mut Command) {
-        for (key, _) in std::env::vars_os() {
-            let name = key.to_string_lossy().into_owned();
-            let hit = (name.starts_with("SOCKET_") && name != "SOCKET_NO_CONFIG")
-                || name.starts_with("BUNDLE_")
-                || name.starts_with("GEM_")
-                || name == "RUBYOPT";
-            if hit {
-                cmd.env_remove(&name);
-            }
-        }
-    }
-
-    /// Run `script` (which `load`s the launcher via the SP_LAUNCHER env) with
-    /// a scratch HOME/cache so no real launcher cache is consulted.
-    fn run_ruby(script: &Path, cache: &Path, envs: &[(&str, &str)]) -> (i32, String, String) {
-        let mut cmd = Command::new("ruby");
-        cmd.arg(script);
-        scrub(&mut cmd);
-        cmd.env("SP_LAUNCHER", launcher_path());
-        cmd.env("XDG_CACHE_HOME", cache);
-        for (k, v) in envs {
-            cmd.env(k, v);
-        }
-        let out = cmd.output().expect("spawn ruby");
-        (
-            out.status.code().unwrap_or(-1),
-            String::from_utf8_lossy(&out.stdout).to_string(),
-            String::from_utf8_lossy(&out.stderr).to_string(),
-        )
-    }
-
-    fn write_executable(path: &Path, body: &str) {
-        std::fs::write(path, body).unwrap();
-        std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o755)).unwrap();
-    }
-
-    /// [P2a] The Windows arm must propagate the child's REAL exit code — the
-    /// old `system(...) ? $?.exitstatus : 1` collapsed every non-zero exit to
-    /// 1, erasing meaningful codes like `setup --check`'s needs-configuration
-    /// signal. Forced onto the Windows branch by stubbing `Gem.win_platform?`.
-    #[test]
-    fn windows_branch_propagates_child_exit_code() {
-        if !have_ruby() {
-            eprintln!("skip launcher_guard: ruby not on PATH");
-            return;
-        }
-        let tmp = tempfile::tempdir().unwrap();
-        let child = tmp.path().join("exit7");
-        write_executable(&child, "#!/bin/sh\nexit 7\n");
-        let script = tmp.path().join("drive.rb");
-        std::fs::write(
-            &script,
-            "require \"rubygems\"\n\
-             def Gem.win_platform?; true; end\n\
-             load ENV.fetch(\"SP_LAUNCHER\")\n\
-             SocketPatch::Launcher.run([\"anything\"])\n",
-        )
-        .unwrap();
-
-        let (code, out, err) = run_ruby(
-            &script,
-            &tmp.path().join("cache"),
-            &[("SOCKET_PATCH_BIN", child.to_str().unwrap())],
-        );
-        assert_eq!(
-            code, 7,
-            "the child's exit 7 must survive the spawn+wait arm, not \
-             collapse to 1.\nstdout:\n{out}\nstderr:\n{err}"
-        );
-    }
-
-    /// [nit] First-run failures outside LauncherError (DNS outages, TLS
-    /// errors, ...) must exit with a clean one-line message, not a raw ruby
-    /// backtrace.
-    #[test]
-    fn unexpected_download_errors_exit_cleanly() {
-        if !have_ruby() {
-            eprintln!("skip launcher_guard: ruby not on PATH");
-            return;
-        }
-        let tmp = tempfile::tempdir().unwrap();
-        let script = tmp.path().join("drive.rb");
-        std::fs::write(
-            &script,
-            "require \"net/http\"\n\
-             def (Net::HTTP).start(*args, &block)\n\
-               raise SocketError, \"simulated dns failure\"\n\
-             end\n\
-             load ENV.fetch(\"SP_LAUNCHER\")\n\
-             SocketPatch::Launcher.run([\"--version\"])\n",
-        )
-        .unwrap();
-
-        let (code, out, err) = run_ruby(&script, &tmp.path().join("cache"), &[]);
-        assert_eq!(code, 1, "a download failure exits 1.\n{out}\n{err}");
-        assert!(
-            err.contains("socket-patch:") && err.contains("SocketError"),
-            "the failure must be reported as a clean launcher message:\n{err}"
-        );
-        assert!(
-            !err.contains("launcher.rb:"),
-            "no raw backtrace frames may escape to the user:\n{err}"
-        );
-    }
-
-    /// [nit] PowerShell quoting: a path containing a single quote must be
-    /// escaped by doubling it, or the Expand-Archive fallback command breaks.
-    #[test]
-    fn powershell_quote_doubles_single_quotes() {
-        if !have_ruby() {
-            eprintln!("skip launcher_guard: ruby not on PATH");
-            return;
-        }
-        let tmp = tempfile::tempdir().unwrap();
-        let script = tmp.path().join("drive.rb");
-        std::fs::write(
-            &script,
-            "load ENV.fetch(\"SP_LAUNCHER\")\n\
-             print SocketPatch::Launcher.powershell_quote(\"C:/it's a dir/x.zip\")\n",
-        )
-        .unwrap();
-
-        let (code, out, err) = run_ruby(&script, &tmp.path().join("cache"), &[]);
-        assert_eq!(code, 0, "quoting helper must exist and run.\n{err}");
-        assert_eq!(
-            out, "'C:/it''s a dir/x.zip'",
-            "single quotes must be doubled inside the single-quoted literal"
-        );
-        // And the Expand-Archive fallback actually routes through it.
-        let launcher = std::fs::read_to_string(launcher_path()).unwrap();
-        assert!(
-            launcher.contains("-LiteralPath #{powershell_quote(archive_path)}")
-                && launcher.contains("-DestinationPath #{powershell_quote(dir)}"),
-            "extract's PowerShell fallback must quote both paths via the helper"
-        );
-    }
-
-    /// [P2b] The binary-cache install must be atomic: staged in the
-    /// destination dir and renamed into place, leaving no temp litter — a
-    /// concurrent first run can then never exec a torn or not-yet-chmodded
-    /// binary. (The rename mechanism itself is pinned by inspection since a
-    /// mid-write race cannot be scheduled deterministically from a test.)
-    #[test]
-    fn install_executable_is_atomic_into_place() {
-        if !have_ruby() {
-            eprintln!("skip launcher_guard: ruby not on PATH");
-            return;
-        }
-        let tmp = tempfile::tempdir().unwrap();
-        let src = tmp.path().join("extracted-binary");
-        std::fs::write(&src, "BINARY CONTENT\n").unwrap();
-        let dest = tmp.path().join("cache/1.0.0/target/socket-patch");
-        let script = tmp.path().join("drive.rb");
-        std::fs::write(
-            &script,
-            "load ENV.fetch(\"SP_LAUNCHER\")\n\
-             SocketPatch::Launcher.install_executable(ARGV[0], ARGV[1])\n",
-        )
-        .unwrap();
-
-        let mut cmd = Command::new("ruby");
-        cmd.arg(&script).arg(&src).arg(&dest);
-        scrub(&mut cmd);
-        cmd.env("SP_LAUNCHER", launcher_path());
-        let out = cmd.output().expect("spawn ruby");
-        assert!(
-            out.status.success(),
-            "install_executable must exist and succeed:\n{}",
-            String::from_utf8_lossy(&out.stderr)
-        );
-        assert_eq!(
-            std::fs::read_to_string(&dest).unwrap(),
-            "BINARY CONTENT\n",
-            "the cached binary must be byte-identical to the extracted one"
-        );
-        let mode = std::fs::metadata(&dest).unwrap().permissions().mode();
-        assert_ne!(mode & 0o111, 0, "the cached binary must be executable");
-        let litter: Vec<_> = std::fs::read_dir(dest.parent().unwrap())
-            .unwrap()
-            .flatten()
-            .map(|e| e.file_name().to_string_lossy().into_owned())
-            .filter(|n| n != "socket-patch")
-            .collect();
-        assert!(
-            litter.is_empty(),
-            "no staging temp files may be left behind: {litter:?}"
-        );
-        let launcher = std::fs::read_to_string(launcher_path()).unwrap();
-        assert!(
-            launcher.contains("File.rename(tmp, dest)"),
-            "the cache publish must go through a same-dir rename"
-        );
-    }
-}
diff --git a/crates/socket-patch-cli/tests/setup_matrix_maven.rs b/crates/socket-patch-cli/tests/setup_matrix_maven.rs
deleted file mode 100644
index 55105441..00000000
--- a/crates/socket-patch-cli/tests/setup_matrix_maven.rs
+++ /dev/null
@@ -1,460 +0,0 @@
-//! setup-matrix: maven ecosystem (mvn). No native post-install hook and
-//! `setup` is a no-op. The with-setup cases are an EXPECTED BASELINE GAP.
-//!
-//! IMPORTANT — why this file carries a real assertion of its own:
-//! `smc::run_pm("maven", "mvn")` routes maven through the shared Docker
-//! matrix harness, which *soft-skips and silently passes* whenever Docker
-//! or the `maven` image is absent (the common case locally and in this
-//! eval). maven is also NOT npm-family (see `is_npm_family` in the
-//! harness), so the harness's check/remove behavioral round-trip is
-//! skipped entirely for it; and because maven's `baseline_supported` is
-//! false in matrix.json the only thing the matrix could ever assert is the
-//! coarse `actual_applied == expect_applied` verdict — which, on a crashed
-//! or never-run case, defaults to the same `false` that satisfies every
-//! negative-control scenario. The net effect: the matrix call can never
-//! turn red for a genuine maven `setup` regression. On its own it protects
-//! nothing.
-//!
-//! To close that loophole WITHOUT touching the shared harness or the bash
-//! driver, [`host_guard::maven_setup_is_a_clean_noop_host`] runs
-//! unconditionally (no Docker, no network, no maven toolchain) and pins
-//! maven `setup`'s *actual current contract*: a maven project's `pom.xml`
-//! is NOT a manifest `setup` knows how to configure, so every `setup`
-//! sub-command must (a) recognise the project as having no configurable
-//! files (`status == "no_files"`, never `error`/`configured`/
-//! `needs_configuration`), (b) exit 0 with zero errors, and (c) leave the
-//! `pom.xml` byte-for-byte untouched while creating no new files. A
-//! positive-control run with a real `package.json` in a sibling dir proves
-//! the `no_files` verdict is a discriminating decision and not a stuck
-//! constant — so a regression that makes `setup` blind to *everything*
-//! cannot hide behind maven's gap. It fails loudly if maven `setup`
-//! ever starts crashing, erroring, misclassifying a pom.xml as
-//! configurable, or mutating the project on disk.
-//!
-//! Run: `cargo test -p socket-patch-cli --features setup-e2e --test setup_matrix_maven`
-#![cfg(feature = "setup-e2e")]
-
-#[path = "setup_matrix_common/mod.rs"]
-mod smc;
-#[path = "vex_e2e_common/mod.rs"]
-mod vex_e2e_common;
-
-/// Documentation/negative-control pass through the shared Docker matrix.
-/// Kept for parity with the other ecosystems and to run the maven negative
-/// controls when Docker + the `maven` image are present. NOTE: this is the
-/// path that silently no-ops on skip — it is NOT a regression guard. The
-/// real teeth live in [`host_guard`] below.
-#[test]
-#[serial_test::serial]
-// maven's aspirational setup-matrix cases are a BASELINE GAP (no install
-// hook for setup to wire); this passes on CI only because the runners lack
-// `mvn` (cases soft-skip) and fails on any host that has it. Ignore so maven
-// can never block the blocking --all-features jobs; `host_guard` below still
-// pins the real no-op contract. Run with `--features setup-e2e -- --ignored`.
-#[ignore = "BASELINE GAP (maven): no install hook for setup to wire; not gating CI; run with --ignored"]
-fn mvn() {
-    smc::run_pm("maven", "mvn");
-}
-
-// ─────────────────────────────────────────────────────────────────────────
-// Real, non-skippable regression guard for maven `setup`.
-//
-// maven has no post-install hook and no manifest `setup` configures, so the
-// only honest contract to pin is the *negative* one: setup is a clean no-op
-// on a maven project — it recognises there is nothing to configure, never
-// errors, and never touches the project on disk. A positive control proves
-// that verdict is discriminating, not a stuck `no_files` constant.
-// ─────────────────────────────────────────────────────────────────────────
-mod host_guard {
-    use std::path::Path;
-    use std::process::Command;
-
-    /// A minimal but valid Maven `pom.xml`. `setup` must treat the directory
-    /// as having nothing to configure and leave this file byte-for-byte.
-    const POM_XML: &str = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\
-<project xmlns=\"http://maven.apache.org/POM/4.0.0\">\n\
-  <modelVersion>4.0.0</modelVersion>\n\
-  <groupId>dev.socket</groupId>\n\
-  <artifactId>sm-maven-proj</artifactId>\n\
-  <version>1.0.0</version>\n\
-  <dependencies>\n\
-    <dependency>\n\
-      <groupId>com.google.guava</groupId>\n\
-      <artifactId>guava</artifactId>\n\
-      <version>32.1.2-jre</version>\n\
-    </dependency>\n\
-  </dependencies>\n\
-</project>\n";
-
-    /// Faithful npm fixture for the positive control — proves `setup`
-    /// detection actually discriminates (so maven's `no_files` is a real
-    /// decision, not a stuck constant).
-    const PACKAGE_JSON: &str =
-        "{ \"name\": \"sm-proj\", \"version\": \"0.0.0\", \"private\": true, \"dependencies\": { \"minimist\": \"1.2.2\" } }\n";
-
-    /// Ambient decoys [`run`]'s prefix scrub must strip, planted by the test
-    /// itself so the scrub is exercised on every run, not only in hostile
-    /// shells. Three demonstrated failure classes on the old fixed-list scrub:
-    /// clap parses env-bound `GlobalArgs` values on EVERY invocation whether
-    /// or not the command uses the flag, so an invalid ambient `SOCKET_STRICT`
-    /// / `SOCKET_VENDOR_SOURCE` aborts the parse (exit 2) before `setup` even
-    /// runs; a (perfectly valid!) ambient `SOCKET_SETUP_EXCLUDE` stands in for
-    /// `setup --exclude`, which a real `setup` run PERSISTS — creating
-    /// `.socket/manifest.json` inside the maven fixture and failing
-    /// `assert_pristine`. (Safe to set process-wide: every other test in this
-    /// binary is `#[serial]` and spawns through this module's
-    /// prefix-scrubbing `run` / `run_vex` or `smc::host_driver_command`.)
-    const HOSTILE_DECOYS: &[(&str, &str)] = &[
-        ("SOCKET_STRICT", "banana"),
-        ("SOCKET_VENDOR_SOURCE", "bogus-decoy"),
-        ("SOCKET_SETUP_EXCLUDE", "decoy-member"),
-    ];
-
-    /// Absolute path to the binary under test, via cargo's `CARGO_BIN_EXE_*`.
-    fn binary() -> std::path::PathBuf {
-        env!("CARGO_BIN_EXE_socket-patch").into()
-    }
-
-    /// Run the CLI with `args` in `cwd`; returns `(exit_code, stdout, stderr)`.
-    /// The entire `SOCKET_*` surface is stripped BY PREFIX — a fixed list rots
-    /// (it missed `SOCKET_SETUP_EXCLUDE` / `SOCKET_VENDOR_SOURCE` /
-    /// `SOCKET_STRICT`, all parsed on every `setup` invocation; see
-    /// [`HOSTILE_DECOYS`]) — so behaviour reflects the explicit flags alone:
-    /// nothing reaches authed endpoints and no ambient var can stand in for a
-    /// flag.
-    fn run(cwd: &Path, args: &[&str]) -> (i32, String, String) {
-        let mut cmd = Command::new(binary());
-        cmd.args(args).current_dir(cwd);
-        for (key, _) in std::env::vars_os() {
-            if key.to_string_lossy().starts_with("SOCKET_")
-                && key.to_string_lossy() != "SOCKET_NO_CONFIG"
-            {
-                cmd.env_remove(&key);
-            }
-        }
-        let out = cmd.output().expect("failed to execute socket-patch binary");
-        (
-            out.status.code().unwrap_or(-1),
-            String::from_utf8_lossy(&out.stdout).to_string(),
-            String::from_utf8_lossy(&out.stderr).to_string(),
-        )
-    }
-
-    /// Parse the CLI's `--json` stdout into a single JSON object. Panics
-    /// (loudly) if stdout is not the single JSON object the command
-    /// promises — a non-JSON / multi-line dump means the command did not
-    /// run the path we think it did.
-    fn parse_json(stdout: &str, who: &str) -> serde_json::Value {
-        serde_json::from_str(stdout.trim()).unwrap_or_else(|e| {
-            panic!("{who}: stdout was not a single JSON object ({e}):\n{stdout}")
-        })
-    }
-
-    fn json_str_field(v: &serde_json::Value, key: &str, who: &str) -> String {
-        v.get(key)
-            .and_then(|s| s.as_str())
-            .unwrap_or_else(|| panic!("{who}: JSON has no string `{key}` field:\n{v}"))
-            .to_string()
-    }
-
-    /// The set of directory entries (names) present at `root`, sorted.
-    /// Used to prove `setup` created nothing.
-    fn dir_entries(root: &Path) -> Vec<String> {
-        let mut names: Vec<String> = std::fs::read_dir(root)
-            .unwrap()
-            .map(|e| e.unwrap().file_name().to_string_lossy().to_string())
-            .collect();
-        names.sort();
-        names
-    }
-
-    /// Assert maven `setup` was a clean no-op for the `who` stage: the
-    /// pom.xml is byte-for-byte unchanged and the directory still contains
-    /// ONLY the pom.xml (no package.json, no `.cargo/`, no scripts, nothing).
-    fn assert_pristine(root: &Path, who: &str) {
-        assert_eq!(
-            std::fs::read_to_string(root.join("pom.xml")).unwrap(),
-            POM_XML,
-            "{who}: setup must leave pom.xml byte-for-byte unchanged"
-        );
-        assert_eq!(
-            dir_entries(root),
-            vec!["pom.xml".to_string()],
-            "{who}: setup must create no files in a maven project (dir must hold only pom.xml)"
-        );
-    }
-
-    /// Assert a `no_files` envelope: status is exactly `no_files`, no
-    /// manifests were touched, and (when present) every count field is zero.
-    /// Crucially rejects `error`, `configured`, `needs_configuration`,
-    /// `success`, etc. — anything other than the documented maven no-op.
-    fn assert_no_files_envelope(v: &serde_json::Value, who: &str) {
-        assert_eq!(
-            json_str_field(v, "status", who),
-            "no_files",
-            "{who}: maven pom.xml is not a configurable manifest — status must be `no_files`, \
-             not error/configured/needs_configuration/success:\n{v}"
-        );
-        let files = v
-            .get("files")
-            .and_then(|f| f.as_array())
-            .unwrap_or_else(|| panic!("{who}: envelope has no `files` array:\n{v}"));
-        assert!(
-            files.is_empty(),
-            "{who}: no files may be reported for a maven project, got:\n{v}"
-        );
-        // Count fields are optional in the `no_files` envelope, but any that
-        // ARE emitted must be zero — a non-zero count would mean setup thought
-        // it had work to do on a project it does not support.
-        for key in [
-            "updated",
-            "alreadyConfigured",
-            "errors",
-            "configured",
-            "needsConfiguration",
-        ] {
-            if let Some(n) = v.get(key) {
-                assert_eq!(
-                    n.as_i64(),
-                    Some(0),
-                    "{who}: `{key}` must be 0 in a maven no_files envelope, got {n}:\n{v}"
-                );
-            }
-        }
-    }
-
-    #[test]
-    #[serial_test::serial]
-    fn maven_setup_is_a_clean_noop_host() {
-        // Committed regression guard for the env scrub itself: with the old
-        // fixed-list scrub these leaked into the child — SOCKET_STRICT /
-        // SOCKET_VENDOR_SOURCE aborted every parse (exit 2) and
-        // SOCKET_SETUP_EXCLUDE made the real `setup` run write
-        // `.socket/manifest.json` into the fixture (assert_pristine RED).
-        let _decoys = crate::smc::DecoyGuard::set(HOSTILE_DECOYS);
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        std::fs::write(root.join("pom.xml"), POM_XML).unwrap();
-        let root_s = root.to_str().unwrap();
-
-        // Precondition: the fixture is genuinely maven-only. If the temp dir
-        // somehow carried an npm/cargo/python manifest the no_files asserts
-        // below would be meaningless, so pin the starting state.
-        assert_eq!(
-            dir_entries(root),
-            vec!["pom.xml".to_string()],
-            "fixture must start as a maven-only project (pom.xml and nothing else)"
-        );
-
-        // ── setup --check: a maven project has nothing to configure ─────────
-        // Must exit 0 (not an error / needs-configuration) AND report
-        // no_files. A regression that crashes, errors, or misclassifies the
-        // pom.xml as a configurable manifest fails here.
-        let (code, out, err) = run(root, &["setup", "--check", "--cwd", root_s, "--json"]);
-        assert_eq!(
-            code, 0,
-            "setup --check on a maven project must exit 0 (no_files), not error/needs-config.\nstdout:\n{out}\nstderr:\n{err}"
-        );
-        assert_no_files_envelope(&parse_json(&out, "check (maven)"), "check (maven)");
-        assert_pristine(root, "after check");
-
-        // ── setup (no flag): still a no-op, zero updates, zero errors ───────
-        let (code, out, err) = run(root, &["setup", "--cwd", root_s, "--yes", "--json"]);
-        assert_eq!(
-            code, 0,
-            "setup on a maven project must exit 0 and do nothing.\nstdout:\n{out}\nstderr:\n{err}"
-        );
-        assert_no_files_envelope(&parse_json(&out, "setup (maven)"), "setup (maven)");
-        assert_pristine(root, "after setup");
-
-        // ── setup --remove: nothing was configured, so nothing to remove ────
-        let (code, out, err) = run(
-            root,
-            &["setup", "--remove", "--cwd", root_s, "--yes", "--json"],
-        );
-        assert_eq!(
-            code, 0,
-            "setup --remove on a maven project must exit 0 and do nothing.\nstdout:\n{out}\nstderr:\n{err}"
-        );
-        assert_no_files_envelope(&parse_json(&out, "remove (maven)"), "remove (maven)");
-        assert_pristine(root, "after remove");
-
-        // ── positive control: prove `no_files` is a discriminating verdict ──
-        // The same binary, given a real package.json in a fresh dir, MUST
-        // reach a different, non-no_files conclusion (needs_configuration,
-        // exit 1). Without this, a regression that makes `setup` blind to
-        // everything — always emitting `no_files` — would sail through the
-        // maven asserts above. The contrast is the whole point.
-        let ctrl = tempfile::tempdir().unwrap();
-        let ctrl_root = ctrl.path();
-        std::fs::write(ctrl_root.join("package.json"), PACKAGE_JSON).unwrap();
-        let (code, out, err) = run(
-            ctrl_root,
-            &[
-                "setup",
-                "--check",
-                "--cwd",
-                ctrl_root.to_str().unwrap(),
-                "--json",
-            ],
-        );
-        assert_eq!(
-            code, 1,
-            "positive control: setup --check on an npm project must exit 1 (needs_configuration), \
-             proving the maven no_files verdict above is discriminating.\nstdout:\n{out}\nstderr:\n{err}"
-        );
-        let v = parse_json(&out, "control (npm)");
-        assert_eq!(
-            json_str_field(&v, "status", "control (npm)"),
-            "needs_configuration",
-            "positive control: an npm project must report needs_configuration, not no_files — \
-             otherwise `setup` is blind to all manifests and maven's no_files proves nothing.\nstderr:\n{err}"
-        );
-        assert_eq!(
-            v.get("needsConfiguration").and_then(|n| n.as_i64()),
-            Some(1),
-            "positive control: exactly the package.json must count as needing configuration.\n{out}"
-        );
-    }
-
-    /// `setup` is a no-op for maven, and it must STAY one for a checkout
-    /// whose patches live in the pom: the hosted (`scan --mode hosted`) and
-    /// vendored (`vendor`) wirings survive `setup --check` / `setup` /
-    /// `setup --remove` byte-for-byte, no manifest appears, and the
-    /// manifest-less `vex` attests both before and after — `(redirected)`
-    /// from the fail-closed pom pin, `(vendored)` from the committed maven2
-    /// tree (online record, no ledgers).
-    #[test]
-    #[serial_test::serial]
-    fn maven_setup_keeps_hosted_and_vendored_wiring_attestable_without_manifest() {
-        use crate::vex_e2e_common::*;
-        use sha1::{Digest as _, Sha1};
-        use std::io::Write as _;
-
-        const HOSTED_UUID: &str = "77777777-7777-7777-7777-777777777777";
-        const HOSTED_PURL: &str = "pkg:maven/org.slf4j/slf4j-api@1.7.36";
-        const VENDOR_UUID: &str = "7b7b7b7b-2222-4222-8222-7b7b7b7b7b7b";
-        const VENDOR_PURL: &str = "pkg:maven/org.apache.commons/commons-text@1.10.0";
-        const MEMBER: &str = "META-INF/NOTICE.txt";
-        let vulns: [(&str, &[&str]); 1] = [("GHSA-setup-mvn-0001", &["CVE-2026-7300"])];
-
-        // Hosted: the committed rewriter golden (pom + `.mvn/`).
-        let hosted = tempfile::tempdir().unwrap();
-        let golden = Path::new(env!("CARGO_MANIFEST_DIR"))
-            .join("../socket-patch-core/tests/fixtures/redirect/maven/pom/basic/expected");
-        let pom = std::fs::read(golden.join("pom.xml")).unwrap();
-        std::fs::write(hosted.path().join("pom.xml"), &pom).unwrap();
-        for rel in [".mvn/maven.config", ".mvn/checksums/checksums.sha256"] {
-            let dst = hosted.path().join(rel);
-            std::fs::create_dir_all(dst.parent().unwrap()).unwrap();
-            std::fs::copy(golden.join(rel), dst).unwrap();
-        }
-
-        // Vendored: `vendor_maven`'s repository + the committed jar/sidecar.
-        let vendored = tempfile::tempdir().unwrap();
-        let patched = b"upstream NOTICE\nSOCKET-PATCHED\n";
-        let mut jar = std::io::Cursor::new(Vec::new());
-        {
-            let mut w = zip::ZipWriter::new(&mut jar);
-            w.start_file(MEMBER, zip::write::SimpleFileOptions::default())
-                .unwrap();
-            w.write_all(patched).unwrap();
-            w.finish().unwrap();
-        }
-        let jar = jar.into_inner();
-        let leaf = vendored.path().join(format!(
-            ".socket/vendor/maven/{VENDOR_UUID}/org/apache/commons/commons-text/1.10.0"
-        ));
-        std::fs::create_dir_all(&leaf).unwrap();
-        std::fs::write(leaf.join("commons-text-1.10.0.jar"), &jar).unwrap();
-        std::fs::write(
-            leaf.join("commons-text-1.10.0.jar.sha1"),
-            hex::encode(Sha1::digest(&jar)),
-        )
-        .unwrap();
-        std::fs::write(leaf.join("commons-text-1.10.0.pom"), "<project/>").unwrap();
-        std::fs::write(
-            vendored.path().join("pom.xml"),
-            format!(
-                "<project xmlns=\"http://maven.apache.org/POM/4.0.0\">\n  \
-                 <modelVersion>4.0.0</modelVersion>\n  <groupId>dev.socket</groupId>\n  \
-                 <artifactId>sm-maven-proj</artifactId>\n  <version>1.0.0</version>\n  \
-                 <dependencies>\n    <dependency>\n      \
-                 <groupId>org.apache.commons</groupId>\n      \
-                 <artifactId>commons-text</artifactId>\n      <version>1.10.0</version>\n    \
-                 </dependency>\n  </dependencies>\n  <repositories>\n    <repository>\n      \
-                 <id>socket-patch-vendor-{VENDOR_UUID}</id>\n      \
-                 <url>file://${{project.basedir}}/.socket/vendor/maven/{VENDOR_UUID}</url>\n      \
-                 <releases>\n        <checksumPolicy>fail</checksumPolicy>\n      </releases>\n    \
-                 </repository>\n  </repositories>\n</project>\n"
-            ),
-        )
-        .unwrap();
-
-        let api = PatchApi::start(vec![
-            (
-                HOSTED_UUID.to_string(),
-                patch_view(
-                    HOSTED_UUID,
-                    HOSTED_PURL,
-                    &[("slf4j-api-1.7.36.jar", &git_sha256(b"patched jar"))],
-                    &vulns,
-                ),
-            ),
-            (
-                VENDOR_UUID.to_string(),
-                patch_view(
-                    VENDOR_UUID,
-                    VENDOR_PURL,
-                    &[(MEMBER, &git_sha256(patched))],
-                    &vulns,
-                ),
-            ),
-        ]);
-        let m2 = tempfile::tempdir().unwrap();
-        let cases = [
-            (hosted.path(), HOSTED_PURL, HOSTED_UUID, Marker::Redirected),
-            (vendored.path(), VENDOR_PURL, VENDOR_UUID, Marker::Vendored),
-        ];
-        let attest = |stage: &str| {
-            for (root, purl, uuid, marker) in cases {
-                let out = run_vex(
-                    &binary(),
-                    root,
-                    &VexRun {
-                        product: Some("pkg:maven/dev.socket/sm-maven-proj@1.0.0".to_string()),
-                        ..VexRun::online(&api)
-                    }
-                    .env("MAVEN_REPO_LOCAL", m2.path().as_os_str()),
-                );
-                assert_eq!(out.code, Some(0), "{stage} {purl}: {out}");
-                assert_attested(out.doc(), purl, uuid, marker, &vulns);
-                std::fs::remove_file(&out.output).unwrap();
-            }
-        };
-        attest("before setup");
-        for (root, _, _, _) in cases {
-            let snapshot = std::fs::read(root.join("pom.xml")).unwrap();
-            let root_s = root.to_str().unwrap();
-            for args in [
-                &["setup", "--check", "--cwd", root_s, "--json"][..],
-                &["setup", "--cwd", root_s, "--yes", "--json"][..],
-                &["setup", "--remove", "--cwd", root_s, "--yes", "--json"][..],
-            ] {
-                let (code, out, err) = run(root, args);
-                assert_eq!(code, 0, "{args:?}\nstdout:\n{out}\nstderr:\n{err}");
-                assert_no_files_envelope(&parse_json(&out, "setup (wired)"), "setup (wired)");
-                assert_eq!(
-                    std::fs::read(root.join("pom.xml")).unwrap(),
-                    snapshot,
-                    "{args:?} must leave the wired pom.xml byte-for-byte"
-                );
-                assert!(
-                    !root.join(".socket/manifest.json").exists(),
-                    "{args:?} must not create a manifest"
-                );
-            }
-        }
-        attest("after setup");
-    }
-}
diff --git a/crates/socket-patch-cli/tests/setup_matrix_monorepo.rs b/crates/socket-patch-cli/tests/setup_matrix_monorepo.rs
deleted file mode 100644
index e19a8aa6..00000000
--- a/crates/socket-patch-cli/tests/setup_matrix_monorepo.rs
+++ /dev/null
@@ -1,329 +0,0 @@
-//! setup-matrix: polyglot all-ecosystem monorepo.
-//!
-//! A single repo containing an npm workspace alongside
-//! python/rust/go/php/ruby/nuget/deno manifests. Confirms `socket-patch
-//! setup` works in this mixed environment — it must configure the npm
-//! hooks and NOT choke on the foreign manifests; a root `npm install`
-//! then applies the patch to the npm slice. Runs in the npm image (the
-//! only one with the npm toolchain); the foreign manifests are present
-//! to test setup's robustness, not installed.
-//!
-//! Run: `cargo test -p socket-patch-cli --features setup-e2e --test setup_matrix_monorepo`
-#![cfg(feature = "setup-e2e")]
-
-#[path = "setup_matrix_common/mod.rs"]
-mod smc;
-
-use std::path::{Path, PathBuf};
-
-/// The behavioral driver: scaffold the polyglot monorepo, run
-/// `setup`/install/remove inside the npm image (or host), and assert each
-/// matrix case meets its aspirational expectation plus the npm-family
-/// check/remove round-trip. Soft-skips when docker/the image is absent.
-#[test]
-fn monorepo() {
-    smc::run_monorepo();
-}
-
-// ---------------------------------------------------------------------------
-// Static guards for the monorepo's DISTINCTIVE invariants.
-//
-// `run_monorepo()` reuses the generic harness, which treats `layout==monorepo`
-// like any npm case and (a) soft-skips entirely when docker/the image is
-// unavailable and (b) never inspects the polyglot fixture or the matrix spec.
-// That makes the headline guarantee of THIS suite — "setup works in a mixed
-// polyglot repo and does NOT choke on the foreign manifests" — completely
-// unverified by the behavioral path whenever docker is missing, and even when
-// present it would happily pass if the fixture were silently reduced to a plain
-// npm project. These guards run with NO docker dependency and fail loudly if
-// the polyglot scaffold, the matrix scenarios (incl. the negative controls), or
-// the monorepo target wiring are ever hollowed out — i.e. they keep the
-// behavioral test honestly *polyglot* rather than an npm test in disguise.
-// ---------------------------------------------------------------------------
-
-/// Workspace root = two levels up from this crate's manifest dir.
-fn workspace_root() -> PathBuf {
-    Path::new(env!("CARGO_MANIFEST_DIR"))
-        .parent()
-        .and_then(|p| p.parent())
-        .expect("workspace root")
-        .to_path_buf()
-}
-
-fn read(rel: &str) -> String {
-    let p = workspace_root().join(rel);
-    std::fs::read_to_string(&p).unwrap_or_else(|e| panic!("read {}: {e}", p.display()))
-}
-
-/// Extract the body of a `name() { ... }` bash function from the driver,
-/// matched brace-for-brace so a refactor that moves/renames it is caught.
-fn bash_fn_body<'a>(script: &'a str, name: &str) -> &'a str {
-    let header = format!("{name}() {{");
-    let start = script
-        .find(&header)
-        .unwrap_or_else(|| panic!("run-case.sh: function `{name}` not found"));
-    let after = start + header.len();
-    let rest = &script[after..];
-    let mut depth = 1usize;
-    for (i, c) in rest.char_indices() {
-        match c {
-            '{' => depth += 1,
-            '}' => {
-                depth -= 1;
-                if depth == 0 {
-                    return &rest[..i];
-                }
-            }
-            _ => {}
-        }
-    }
-    panic!("run-case.sh: unbalanced braces in `{name}`");
-}
-
-/// The whole point of the monorepo case is exercising `setup` against a repo
-/// that ALSO carries non-npm manifests. If the scaffold ever drops them, the
-/// behavioral test silently becomes a plain npm test while still passing — so
-/// pin that every foreign ecosystem manifest is created, plus the npm slice
-/// `setup` is meant to patch.
-#[test]
-fn monorepo_scaffold_is_genuinely_polyglot() {
-    let script = read("tests/setup_matrix/run-case.sh");
-    let body = bash_fn_body(&script, "scaffold_monorepo");
-
-    // The npm workspace slice — the surface `setup` actually patches.
-    assert!(
-        body.contains("package.json") && body.contains("workspaces"),
-        "scaffold_monorepo no longer creates the npm workspace root — the patched \
-         slice would not exist:\n{body}"
-    );
-
-    // One representative manifest per FOREIGN ecosystem named in the suite's
-    // contract (python, rust, go, php, ruby, deno, nuget). `setup` must tolerate
-    // each of these sitting next to the npm project; dropping any one quietly
-    // narrows what "does not choke on foreign manifests" actually tests.
-    let foreign: &[(&str, &str)] = &[
-        ("python", "pyproject.toml"),
-        ("rust", "Cargo.toml"),
-        ("go", "go.mod"),
-        ("php", "composer.json"),
-        ("ruby", "Gemfile"),
-        ("deno", "deno.json"),
-        ("nuget", ".csproj"),
-    ];
-    let missing: Vec<&str> = foreign
-        .iter()
-        .filter(|(_, manifest)| !body.contains(manifest))
-        .map(|(eco, _)| *eco)
-        .collect();
-    assert!(
-        missing.is_empty(),
-        "scaffold_monorepo is no longer polyglot — missing foreign manifest(s) for: {missing:?}. \
-         The monorepo suite would degrade to a plain npm test and stop proving setup tolerates \
-         foreign manifests.\n{body}"
-    );
-
-    // Foreign manifests must be REAL (non-npm) ecosystems, not more npm. Require
-    // at least the distinctive non-JSON manifests so the fixture can't be faked
-    // with a pile of package.json files.
-    for distinctive in ["Cargo.toml", "go.mod", "Gemfile"] {
-        assert!(
-            body.contains(distinctive),
-            "scaffold_monorepo dropped the `{distinctive}` manifest"
-        );
-    }
-}
-
-/// The harness only runs the check/remove round-trip + LEAK detection when
-/// `is_npm_family()` is true, which for the monorepo hinges on
-/// `layout == "monorepo"`. Pin that the wiring still routes monorepo through
-/// that branch (npm image, baseline_supported) so the case can't silently fall
-/// into the untested "foreign ecosystem, no round-trip" bucket.
-#[test]
-fn monorepo_target_routes_through_npm_round_trip() {
-    let spec: serde_json::Value =
-        serde_json::from_str(&read("tests/setup_matrix/matrix.json")).expect("parse matrix.json");
-
-    let targets = spec["monorepo_targets"]
-        .as_array()
-        .expect("monorepo_targets array");
-    assert_eq!(
-        targets.len(),
-        1,
-        "expected exactly one monorepo target; got {}",
-        targets.len()
-    );
-    let t = &targets[0];
-    assert_eq!(
-        t["ecosystem"], "monorepo",
-        "monorepo target ecosystem changed"
-    );
-    assert_eq!(t["pm"], "mono", "monorepo target pm changed");
-    assert_eq!(
-        t["image"], "npm",
-        "monorepo must run in the npm image (only toolchain that can install it)"
-    );
-    assert_eq!(
-        t["baseline_supported"], true,
-        "monorepo baseline_supported flipped to false — the npm slice IS supported today, so a \
-         non-applying install must classify as a REGRESSION, not a tolerated BASELINE GAP"
-    );
-    // The patched slice must be the npm package (minimist), proving the npm
-    // slice — not a foreign one — is what the round-trip exercises.
-    assert_eq!(
-        t["purl"], "pkg:npm/minimist@1.2.2",
-        "monorepo target purl changed — the patched slice is no longer the npm dependency"
-    );
-    assert!(
-        t["manifest_key"]
-            .as_str()
-            .unwrap_or("")
-            .contains("index.js"),
-        "monorepo manifest_key no longer points at the npm package file"
-    );
-    assert_eq!(
-        t["apply_ecosystems"], "npm",
-        "monorepo apply_ecosystems changed — should patch only the npm slice"
-    );
-}
-
-/// The matrix's negative controls are what keep a "patch always applies" bug
-/// honest: a no-setup ablation (hook absent ⇒ must NOT apply) and a
-/// patch-missing ablation (hook present but no committed patchset ⇒ must NOT
-/// apply). Pin that all three monorepo scenarios — the positive plus both
-/// controls — are present with the expected `run_setup`/`expect_applied`
-/// polarity, so dropping a control can't quietly remove the guard.
-#[test]
-fn monorepo_scenarios_keep_their_negative_controls() {
-    let spec: serde_json::Value =
-        serde_json::from_str(&read("tests/setup_matrix/matrix.json")).expect("parse matrix.json");
-
-    let scenarios = spec["monorepo_scenarios"]
-        .as_array()
-        .expect("monorepo_scenarios array");
-
-    // id -> (run_setup, expect_applied)
-    let find = |id: &str| -> (bool, bool) {
-        let s = scenarios
-            .iter()
-            .find(|s| s["id"] == id)
-            .unwrap_or_else(|| panic!("monorepo scenario `{id}` missing from matrix.json"));
-        (
-            s["run_setup"]
-                .as_bool()
-                .unwrap_or_else(|| panic!("`{id}`.run_setup not a bool")),
-            s["expect_applied"]
-                .as_bool()
-                .unwrap_or_else(|| panic!("`{id}`.expect_applied not a bool")),
-        )
-    };
-
-    // Positive: setup runs, primary patchset, must apply.
-    assert_eq!(
-        find("monorepo_with_setup"),
-        (true, true),
-        "positive monorepo scenario must run setup AND expect the patch applied"
-    );
-    // Negative control #1: no setup ⇒ no hook ⇒ must NOT apply.
-    assert_eq!(
-        find("monorepo_no_setup"),
-        (false, false),
-        "no-setup ablation must NOT run setup and must expect NOT applied (proves the hook, not \
-         install alone, is what applies the patch)"
-    );
-    // Negative control #2: setup runs but no committed patchset ⇒ must NOT apply.
-    assert_eq!(
-        find("monorepo_patch_missing"),
-        (true, false),
-        "patch-missing ablation must run setup yet expect NOT applied (proves the committed \
-         patchset, not setup/install alone, is what changes the code)"
-    );
-
-    // Guard against a fourth scenario being added that quietly expects-applied
-    // without a matching control; at minimum the two negative controls must
-    // outnumber-or-equal the positives so the suite can't become all-positive.
-    let positives = scenarios
-        .iter()
-        .filter(|s| s["expect_applied"].as_bool().unwrap_or(false))
-        .count();
-    let negatives = scenarios.len() - positives;
-    assert!(
-        negatives >= positives && negatives >= 2,
-        "monorepo scenarios lost their negative controls (positives={positives}, \
-         negatives={negatives}); a 'patch always applies' regression could pass"
-    );
-}
-
-/// The headline guarantee — `setup` must NOT choke on the foreign manifests —
-/// is the driver's `setup_exit` field. `setup --yes` aggregates errors across
-/// ALL manifest kinds it edits (npm + python + gem + composer; see
-/// `run_setup` in commands/setup.rs) and exits 1 on `partial_failure`, so in
-/// the polyglot monorepo it can land the npm hook (⇒ `check` passes, the
-/// patch applies, every other round-trip probe looks healthy) and STILL choke
-/// on a foreign slice. The round-trip validator must flag that; if it only
-/// watches the check/install/remove exits, the exact regression this suite
-/// exists to catch passes green. Hermetic: feeds the validator a synthetic
-/// driver result, no docker.
-#[test]
-fn round_trip_flags_setup_choke_even_when_hook_lands() {
-    let case = smc::load_section(
-        "monorepo_targets",
-        "monorepo_scenarios",
-        "monorepo",
-        "monorepo",
-        "mono",
-    )
-    .into_iter()
-    .next()
-    .expect("at least one monorepo case");
-
-    // A driver result where every probe EXCEPT setup_exit is healthy —
-    // exactly what a hook-landed-then-choked setup produces.
-    let result = |setup_exit: i64| smc::RunResult {
-        actual_applied: true,
-        raw: String::new(),
-        parsed: Some(serde_json::json!({
-            "actual_applied": true,
-            "applied_before_setup": false,
-            "applied_after_remove": false,
-            "primary_marker_present": true,
-            "setup_exit": setup_exit,
-            "install_exit": 0,
-            "check_before_setup_exit": 2,
-            "check_after_setup_exit": 0,
-            "remove_exit": 0,
-            "check_after_remove_exit": 2,
-        })),
-    };
-
-    // Sanity: a fully healthy round trip must not be flagged.
-    assert_eq!(
-        smc::round_trip_failure(&case, &result(0)),
-        None,
-        "healthy synthetic round-trip result must pass"
-    );
-
-    let failure = smc::round_trip_failure(&case, &result(1)).expect(
-        "round_trip_failure must flag setup_exit=1: a `setup` that chokes on a foreign \
-         manifest after landing the npm hook currently passes the whole suite",
-    );
-    assert!(
-        failure.contains("setup exit"),
-        "failure message should name the setup exit problem, got: {failure}"
-    );
-}
-
-/// Defensive cross-check on the harness routing: `layout == "monorepo"` is the
-/// ONLY thing that makes a non-npm-family `pm` (here `mono`) take the
-/// round-trip + LEAK-detection path. If the driver's `is_npm_family` gate ever
-/// stops honoring the monorepo layout, the behavioral guarantees silently
-/// vanish. Pin the driver still gates on the monorepo layout.
-#[test]
-fn driver_round_trip_still_gated_on_monorepo_layout() {
-    let script = read("tests/setup_matrix/run-case.sh");
-    let body = bash_fn_body(&script, "is_npm_family");
-    assert!(
-        body.contains("SM_LAYOUT") && body.contains("monorepo"),
-        "run-case.sh is_npm_family no longer treats the monorepo layout as round-trip-eligible — \
-         the monorepo would skip the check/remove + LEAK assertions:\n{body}"
-    );
-}
diff --git a/crates/socket-patch-cli/tests/setup_matrix_npm.rs b/crates/socket-patch-cli/tests/setup_matrix_npm.rs
deleted file mode 100644
index 66d72679..00000000
--- a/crates/socket-patch-cli/tests/setup_matrix_npm.rs
+++ /dev/null
@@ -1,300 +0,0 @@
-//! setup-matrix: npm ecosystem (npm / yarn / pnpm / bun / vlt).
-//!
-//! `socket-patch setup` supports these package managers (it writes a
-//! package.json postinstall hook), so the
-//! `baseline_with_setup` / `alt_content_patchset` cases are expected to
-//! PASS here. See `setup_matrix_common/mod.rs` for the harness and
-//! `tests/setup_matrix/matrix.json` for the case list.
-//!
-//! Run: `cargo test -p socket-patch-cli --features setup-e2e --test setup_matrix_npm`
-#![cfg(feature = "setup-e2e")]
-
-#[path = "setup_matrix_common/mod.rs"]
-mod smc;
-
-#[test]
-#[serial_test::serial]
-fn npm() {
-    smc::run_pm("npm", "npm");
-}
-
-#[test]
-#[serial_test::serial]
-fn yarn() {
-    smc::run_pm("npm", "yarn");
-}
-
-#[test]
-#[serial_test::serial]
-fn pnpm() {
-    smc::run_pm("npm", "pnpm");
-}
-
-#[test]
-#[serial_test::serial]
-fn bun() {
-    smc::run_pm("npm", "bun");
-}
-
-#[test]
-#[serial_test::serial]
-fn vlt() {
-    smc::run_pm("npm", "vlt");
-}
-
-// ── Nested-workspace layouts ──────────────────────────────────────────
-// A root + several members (incl. a deeply-nested one and a member with
-// no dependency on the patched package). Exercises `setup`'s workspace
-// handling (npm/yarn write the hook to every member; pnpm and vlt only to
-// the root) plus the cross-workspace apply on the root install. These should
-// PASS — they're real regression guards, not gap documentation.
-
-#[test]
-#[serial_test::serial]
-fn npm_workspace() {
-    smc::run_workspace_pm("npm", "npm");
-}
-
-#[test]
-#[serial_test::serial]
-fn pnpm_workspace() {
-    smc::run_workspace_pm("npm", "pnpm");
-}
-
-#[test]
-#[serial_test::serial]
-fn yarn_workspace() {
-    smc::run_workspace_pm("npm", "yarn");
-}
-
-#[test]
-#[serial_test::serial]
-fn vlt_workspace() {
-    smc::run_workspace_pm("npm", "vlt");
-}
-
-// ─────────────────────────────────────────────────────────────────────────
-// Real, non-skippable regression guard for npm `setup`.
-//
-// IMPORTANT — why this file needs an assertion of its own:
-// every `smc::run_pm` / `smc::run_workspace_pm` call above routes through the
-// shared Docker matrix harness, which *soft-skips and silently passes* whenever
-// Docker or the `npm` image is absent (the common case locally and in this
-// eval). So for npm, the ecosystem family whose `setup` hook the matrix round-trips, the matrix
-// calls can be entirely green having exercised NOTHING — a broken
-// package.json-hook writer would never turn this file red.
-//
-// To close that loophole WITHOUT touching the shared harness, the module below
-// adds a self-contained, host-only (no Docker, no network, no real npm
-// toolchain) exercise of the actual `socket-patch` binary against a real
-// package.json. It runs unconditionally and fails loudly if npm
-// `setup` / `setup --check` / `setup --remove` regress. State is verified with
-// an *independent* JSON read + raw substring probes (NOT the production
-// `is_setup_configured` / `update_package_json` detectors), so the oracle can
-// disagree with a broken writer.
-// ─────────────────────────────────────────────────────────────────────────
-mod host_guard {
-    use std::path::Path;
-    use std::process::Command;
-
-    /// The apply command `setup` is supposed to inject into the npm lifecycle
-    /// scripts. Hardcoded HERE (not imported from production) so a regression
-    /// that drops/garbles the command is caught by an independent oracle. The
-    /// detector accepts several variants; we pin the canonical npm one the
-    /// writer emits for a lockfile-less project.
-    const NPM_APPLY_CMD: &str = "@socketsecurity/socket-patch apply";
-    const NPM_ECOSYSTEM_FLAG: &str = "--ecosystems npm";
-    /// A pre-existing, user-authored postinstall step `setup` must PRESERVE
-    /// (prepend the patch command before it, never clobber it).
-    const USER_POSTINSTALL: &str = "echo user-build-step";
-
-    /// Ambient decoys [`run`]'s prefix scrub must strip, planted by the test
-    /// itself so the scrub is exercised on every run, not only in hostile
-    /// shells. Two demonstrated failure classes on the old fixed-list scrub
-    /// (same as the maven twin): clap parses env-bound `GlobalArgs` values on
-    /// EVERY invocation whether or not the command uses the flag, so an
-    /// invalid ambient `SOCKET_STRICT` / `SOCKET_VENDOR_SOURCE` aborts the
-    /// parse (exit 2) before `setup` even runs — turning the whole roundtrip
-    /// red; and a (perfectly valid!) ambient `SOCKET_SETUP_EXCLUDE` stands in
-    /// for `setup --exclude`, silently altering the run under test. (Safe to
-    /// set process-wide: every other test in this binary routes its children
-    /// through `smc::host_driver_command`'s own `SOCKET_*` prefix scrub, and
-    /// the harness's only ambient `SOCKET_*` read is `SOCKET_PATCH_TEST_HOST`,
-    /// which the decoys don't touch.)
-    const HOSTILE_DECOYS: &[(&str, &str)] = &[
-        ("SOCKET_STRICT", "banana"),
-        ("SOCKET_VENDOR_SOURCE", "bogus-decoy"),
-        ("SOCKET_SETUP_EXCLUDE", "decoy-member"),
-    ];
-
-    fn binary() -> std::path::PathBuf {
-        env!("CARGO_BIN_EXE_socket-patch").into()
-    }
-
-    /// Run the CLI with `args` in `cwd`; returns `(exit_code, stdout, stderr)`.
-    /// The entire `SOCKET_*` surface is stripped BY PREFIX — a fixed list rots
-    /// (it missed `SOCKET_SETUP_EXCLUDE` / `SOCKET_VENDOR_SOURCE` /
-    /// `SOCKET_STRICT`, all parsed on every `setup` invocation; see
-    /// [`HOSTILE_DECOYS`]) — so behaviour reflects the explicit flags alone:
-    /// no ambient var can stand in for a flag or abort the parse.
-    fn run(cwd: &Path, args: &[&str]) -> (i32, String, String) {
-        let mut cmd = Command::new(binary());
-        cmd.args(args).current_dir(cwd);
-        for (key, _) in std::env::vars_os() {
-            if key.to_string_lossy().starts_with("SOCKET_")
-                && key.to_string_lossy() != "SOCKET_NO_CONFIG"
-            {
-                cmd.env_remove(&key);
-            }
-        }
-        let out = cmd.output().expect("failed to execute socket-patch binary");
-        (
-            out.status.code().unwrap_or(-1),
-            String::from_utf8_lossy(&out.stdout).to_string(),
-            String::from_utf8_lossy(&out.stderr).to_string(),
-        )
-    }
-
-    /// Independent oracle: parse package.json with serde_json (a plain JSON
-    /// read, NOT the production setup detector) and return a named lifecycle
-    /// script, if present and a string.
-    fn lifecycle_script(root: &Path, key: &str) -> Option<String> {
-        let text = std::fs::read_to_string(root.join("package.json")).unwrap();
-        let val: serde_json::Value = serde_json::from_str(&text).unwrap_or_else(|e| {
-            panic!("package.json is not valid JSON after CLI ran: {e}\n{text}")
-        });
-        val.get("scripts")
-            .and_then(|s| s.get(key))
-            .and_then(|v| v.as_str())
-            .map(str::to_string)
-    }
-
-    fn stage_project(root: &Path) {
-        // A package.json with a pre-existing postinstall step. No lockfile, so
-        // the npm-family detector resolves to plain npm. No Cargo.toml /
-        // pyproject, so only the npm branch of `setup` fires.
-        std::fs::write(
-            root.join("package.json"),
-            format!(
-                r#"{{
-  "name": "sm-npm-host-guard",
-  "version": "1.0.0",
-  "private": true,
-  "scripts": {{
-    "postinstall": "{USER_POSTINSTALL}"
-  }},
-  "dependencies": {{}}
-}}
-"#
-            ),
-        )
-        .unwrap();
-    }
-
-    /// setup → check → remove → check, asserting REAL on-disk package.json
-    /// state at every stage. This is the assertion the soft-skipping Docker
-    /// matrix can never make.
-    #[test]
-    #[serial_test::serial]
-    fn npm_setup_roundtrip_host() {
-        // Committed regression guard for the env scrub itself: with the old
-        // fixed-list scrub these leaked into the child — SOCKET_STRICT /
-        // SOCKET_VENDOR_SOURCE aborted every parse (exit 2, so the very first
-        // `--check` assertion went red) and SOCKET_SETUP_EXCLUDE stood in for
-        // `setup --exclude` on the real run.
-        let _decoys = crate::smc::DecoyGuard::set(HOSTILE_DECOYS);
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        stage_project(root);
-        let root_s = root.to_str().unwrap();
-
-        // ── pristine precondition ──────────────────────────────────────────
-        // Pin the BEFORE state so post-setup assertions prove `setup` CREATED
-        // the hook, not that a leftover fixture already contained it.
-        let pristine = std::fs::read_to_string(root.join("package.json")).unwrap();
-        assert!(
-            !pristine.contains(NPM_APPLY_CMD),
-            "fixture must start WITHOUT the socket-patch hook:\n{pristine}"
-        );
-        assert_eq!(
-            lifecycle_script(root, "postinstall").as_deref(),
-            Some(USER_POSTINSTALL),
-            "fixture must start with only the user's postinstall step"
-        );
-
-        // ── check (before setup): unconfigured → must report non-zero ──────
-        // Proves `--check` reads real state instead of hardcoding success.
-        let (code, out, err) = run(root, &["setup", "--check", "--cwd", root_s]);
-        assert_eq!(
-            code, 1,
-            "setup --check must FAIL (exit 1) on an unconfigured project.\nstdout:\n{out}\nstderr:\n{err}"
-        );
-
-        // ── setup ──────────────────────────────────────────────────────────
-        let (code, out, err) = run(root, &["setup", "--cwd", root_s, "--yes"]);
-        assert_eq!(
-            code, 0,
-            "setup must succeed.\nstdout:\n{out}\nstderr:\n{err}"
-        );
-
-        // The postinstall hook must now carry the apply command AND the npm
-        // ecosystem filter, run FIRST, and PRESERVE the user's original step.
-        let post = lifecycle_script(root, "postinstall")
-            .unwrap_or_else(|| panic!("postinstall script missing after setup"));
-        assert!(
-            post.contains(NPM_APPLY_CMD) && post.contains(NPM_ECOSYSTEM_FLAG),
-            "postinstall must contain the npm apply command after setup, got: {post:?}"
-        );
-        assert!(
-            post.contains(USER_POSTINSTALL),
-            "setup must PRESERVE the user's existing postinstall step, got: {post:?}"
-        );
-        assert!(
-            post.trim_start().starts_with("npx ")
-                && post.find(NPM_APPLY_CMD) < post.find(USER_POSTINSTALL),
-            "the patch apply command must be prepended to run BEFORE the user's step, got: {post:?}"
-        );
-        // setup also wires the `dependencies` lifecycle script (created fresh,
-        // since the fixture had none).
-        let deps = lifecycle_script(root, "dependencies")
-            .unwrap_or_else(|| panic!("dependencies script missing after setup"));
-        assert!(
-            deps.contains(NPM_APPLY_CMD) && deps.contains(NPM_ECOSYSTEM_FLAG),
-            "the `dependencies` lifecycle script must also be configured, got: {deps:?}"
-        );
-
-        // ── check (configured): must report zero ───────────────────────────
-        let (code, out, err) = run(root, &["setup", "--check", "--cwd", root_s]);
-        assert_eq!(
-            code, 0,
-            "setup --check must PASS (exit 0) after setup.\nstdout:\n{out}\nstderr:\n{err}"
-        );
-
-        // ── remove ──────────────────────────────────────────────────────────
-        let (code, out, err) = run(root, &["setup", "--remove", "--cwd", root_s, "--yes"]);
-        assert_eq!(
-            code, 0,
-            "setup --remove must succeed.\nstdout:\n{out}\nstderr:\n{err}"
-        );
-
-        // The apply command must be gone everywhere, and the user's original
-        // postinstall step restored intact (not left mangled by the removal).
-        let after = std::fs::read_to_string(root.join("package.json")).unwrap();
-        assert!(
-            !after.contains(NPM_APPLY_CMD),
-            "the socket-patch apply command must be removed from package.json:\n{after}"
-        );
-        assert_eq!(
-            lifecycle_script(root, "postinstall").as_deref(),
-            Some(USER_POSTINSTALL),
-            "remove must restore the user's original postinstall step verbatim:\n{after}"
-        );
-
-        // ── check (after remove): back to needs-configuration ───────────────
-        let (code, out, err) = run(root, &["setup", "--check", "--cwd", root_s]);
-        assert_eq!(
-            code, 1,
-            "setup --check must FAIL (exit 1) again after remove.\nstdout:\n{out}\nstderr:\n{err}"
-        );
-    }
-}
diff --git a/crates/socket-patch-cli/tests/setup_matrix_nuget.rs b/crates/socket-patch-cli/tests/setup_matrix_nuget.rs
deleted file mode 100644
index a7fc11dc..00000000
--- a/crates/socket-patch-cli/tests/setup_matrix_nuget.rs
+++ /dev/null
@@ -1,321 +0,0 @@
-//! setup-matrix: nuget ecosystem (dotnet). No native post-install hook and
-//! `setup` is a no-op. The with-setup cases are an EXPECTED BASELINE GAP.
-//!
-//! IMPORTANT — why this file carries a real assertion of its own:
-//! `smc::run_pm("nuget", "dotnet")` routes nuget through the shared Docker
-//! matrix harness, which *soft-skips and silently passes* whenever Docker
-//! or the `nuget` image is absent (the common case locally and in this
-//! eval). nuget is also NOT npm-family (see `is_npm_family` in the harness
-//! and `run-case.sh`), so the harness's check/remove behavioral
-//! round-trip is skipped entirely for it; and because nuget's
-//! `baseline_supported` is false in matrix.json the only thing the matrix
-//! could ever assert is the coarse `actual_applied == expect_applied`
-//! verdict — which, on a crashed or never-run case, defaults to the same
-//! `false` that satisfies every negative-control scenario. The net
-//! effect: the matrix call can never turn red for a genuine nuget `setup`
-//! regression. On its own it protects nothing.
-//!
-//! To close that loophole WITHOUT touching the shared harness or the bash
-//! driver, [`host_guard::nuget_setup_roundtrip_host`] runs unconditionally
-//! (no Docker, no network, no dotnet toolchain) and pins nuget `setup`'s
-//! *actual current contract*: a dotnet project carries only a `.csproj` —
-//! a manifest `setup` does NOT support — so every `setup` subcommand must
-//! report `no_files` (exit 0 for setup/remove; exit 0 for `--check`, since
-//! "nothing to configure" is success not failure) and must leave the
-//! `.csproj` byte-for-byte untouched. It reads on-disk state with an
-//! *independent* probe (a hand-pinned constant, not a copy of any writer
-//! output) so the oracle can disagree with a broken implementation. It
-//! fails loudly if nuget `setup` ever starts mutating a `.csproj`, crashes
-//! on a dotnet project, mis-classifies the `.csproj` as a configurable
-//! manifest, or returns the wrong exit code / status.
-//!
-//! If `setup` ever GROWS real dotnet support, this guard's expectations
-//! become wrong-by-design and must be upgraded to the deno-style positive
-//! round-trip (check fails → setup configures → check passes → remove).
-//! That is the intended signal: the test going red here means the baseline
-//! gap closed, not that something broke.
-//!
-//! Run: `cargo test -p socket-patch-cli --features setup-e2e --test setup_matrix_nuget`
-#![cfg(feature = "setup-e2e")]
-
-#[path = "setup_matrix_common/mod.rs"]
-mod smc;
-#[path = "vex_e2e_common/mod.rs"]
-mod vex_e2e_common;
-
-/// Documentation/negative-control pass through the shared Docker matrix.
-/// Kept for parity with the other ecosystems and to run the nuget negative
-/// controls when Docker + the `nuget` image are present. NOTE: this is the
-/// path that silently no-ops on skip — it is NOT a regression guard. The
-/// real teeth live in [`host_guard`] below.
-#[test]
-#[serial_test::serial]
-// nuget's aspirational setup-matrix cases are a BASELINE GAP (no install
-// hook for setup to wire); this passes on CI only because the runners lack
-// `dotnet` (cases soft-skip) and fails on any host that has it. Ignore so
-// nuget can never block the blocking --all-features jobs; `host_guard` below
-// still pins the real no-op contract. Run with `--features setup-e2e -- --ignored`.
-#[ignore = "BASELINE GAP (nuget): no install hook for setup to wire; not gating CI; run with --ignored"]
-fn dotnet() {
-    smc::run_pm("nuget", "dotnet");
-}
-
-// ─────────────────────────────────────────────────────────────────────────
-// Real, non-skippable regression guard for nuget `setup`.
-//
-// A dotnet project carries only a `.csproj` (no package.json / Python /
-// Cargo manifest), which `setup` does not support. The guard pins that
-// no-op contract precisely so a regression (`.csproj` mutation, crash,
-// mis-detection, wrong exit code) turns this suite red even with no Docker.
-// ─────────────────────────────────────────────────────────────────────────
-mod host_guard {
-    use std::path::Path;
-    use std::process::Command;
-
-    /// Name of the project file written into the fixture.
-    const CSPROJ_NAME: &str = "app.csproj";
-
-    /// A faithful dotnet project fixture, mirroring the polyglot monorepo's
-    /// `nuget-app/app.csproj` in `tests/setup_matrix/run-case.sh` and the
-    /// nuget target's package/version in matrix.json
-    /// (`Newtonsoft.Json` @ `13.0.3`).
-    const CSPROJ: &str = "<Project Sdk=\"Microsoft.NET.Sdk\">\n  \
-        <ItemGroup>\n    \
-        <PackageReference Include=\"Newtonsoft.Json\" Version=\"13.0.3\" />\n  \
-        </ItemGroup>\n</Project>\n";
-
-    /// Ambient decoys [`run`]'s prefix scrub must strip, planted by the test
-    /// itself so the scrub is exercised on every run, not only in hostile
-    /// shells. Three demonstrated failure classes on the old fixed-list scrub
-    /// (same trio as `setup_matrix_maven`): clap parses env-bound
-    /// `GlobalArgs` values on EVERY invocation whether or not the command
-    /// uses the flag, so an invalid ambient `SOCKET_STRICT` /
-    /// `SOCKET_VENDOR_SOURCE` aborts the parse (exit 2) before `setup` even
-    /// runs; and a (perfectly valid!) ambient `SOCKET_SETUP_EXCLUDE` stands
-    /// in for `setup --exclude`, which a real `setup` run PERSISTS —
-    /// creating `.socket/manifest.json` inside the dotnet fixture and
-    /// failing the final only-the-csproj assertion. (Safe to set
-    /// process-wide: the only other test in this binary is the `#[ignore]`d
-    /// matrix pass, which routes through `smc::host_driver_command`'s own
-    /// `SOCKET_*` prefix scrub.)
-    const HOSTILE_DECOYS: &[(&str, &str)] = &[
-        ("SOCKET_STRICT", "banana"),
-        ("SOCKET_VENDOR_SOURCE", "bogus-decoy"),
-        ("SOCKET_SETUP_EXCLUDE", "decoy-member"),
-    ];
-
-    /// Absolute path to the binary under test, via cargo's `CARGO_BIN_EXE_*`.
-    fn binary() -> std::path::PathBuf {
-        env!("CARGO_BIN_EXE_socket-patch").into()
-    }
-
-    /// Run the CLI with `args` in `cwd`; returns `(exit_code, stdout, stderr)`.
-    /// The entire `SOCKET_*` surface is stripped BY PREFIX — a fixed list rots
-    /// (it missed `SOCKET_SETUP_EXCLUDE` / `SOCKET_VENDOR_SOURCE` /
-    /// `SOCKET_STRICT`, all parsed on every `setup` invocation; see
-    /// [`HOSTILE_DECOYS`]) — so behaviour reflects the explicit flags alone:
-    /// nothing reaches authed endpoints and no ambient var can stand in for a
-    /// flag.
-    fn run(cwd: &Path, args: &[&str]) -> (i32, String, String) {
-        let mut cmd = Command::new(binary());
-        cmd.args(args).current_dir(cwd);
-        for (key, _) in std::env::vars_os() {
-            if key.to_string_lossy().starts_with("SOCKET_")
-                && key.to_string_lossy() != "SOCKET_NO_CONFIG"
-            {
-                cmd.env_remove(&key);
-            }
-        }
-        let out = cmd.output().expect("failed to execute socket-patch binary");
-        (
-            out.status.code().unwrap_or(-1),
-            String::from_utf8_lossy(&out.stdout).to_string(),
-            String::from_utf8_lossy(&out.stderr).to_string(),
-        )
-    }
-
-    /// Parse the CLI's `--json` stdout into a single JSON object. Panics
-    /// (loudly) if stdout is not the JSON object the command promises — a
-    /// non-JSON / non-object dump means the command did not run the path we
-    /// think it did.
-    fn parse_json(stdout: &str, who: &str) -> serde_json::Value {
-        let v: serde_json::Value = serde_json::from_str(stdout.trim())
-            .unwrap_or_else(|e| panic!("{who}: stdout was not valid JSON ({e}):\n{stdout}"));
-        assert!(
-            v.is_object(),
-            "{who}: stdout JSON must be a single object, got:\n{stdout}"
-        );
-        v
-    }
-
-    fn json_str(v: &serde_json::Value, key: &str, who: &str) -> String {
-        v.get(key)
-            .and_then(|s| s.as_str())
-            .unwrap_or_else(|| panic!("{who}: JSON has no string `{key}` field:\n{v}"))
-            .to_string()
-    }
-
-    /// The `.csproj` must be byte-for-byte what we wrote — `setup` (in any
-    /// mode) operates on package.json / Python / Gemfile / composer.json manifests and must
-    /// NEVER touch a dotnet project file.
-    fn assert_csproj_pristine(root: &Path, who: &str) {
-        assert_eq!(
-            std::fs::read_to_string(root.join(CSPROJ_NAME)).unwrap(),
-            CSPROJ,
-            "{who}: {CSPROJ_NAME} must be left byte-for-byte unchanged by setup"
-        );
-    }
-
-    /// `setup`'s contract on a manifest it does not support is `no_files`
-    /// with a clean exit (0) and zero side effects. This single helper pins
-    /// every subcommand to that contract: a `no_files` status, exit 0, the
-    /// `files` list empty, and the `.csproj` untouched.
-    fn assert_no_files(root: &Path, args: &[&str], who: &str) -> serde_json::Value {
-        let (code, out, err) = run(root, args);
-        assert_eq!(
-            code, 0,
-            "{who}: must exit 0 on an unsupported (.csproj-only) project.\nstdout:\n{out}\nstderr:\n{err}"
-        );
-        let v = parse_json(&out, who);
-        assert_eq!(
-            json_str(&v, "status", who),
-            "no_files",
-            "{who}: a dotnet project must report status=no_files (.csproj is not a configurable manifest).\nstderr:\n{err}"
-        );
-        let files = v
-            .get("files")
-            .and_then(|f| f.as_array())
-            .unwrap_or_else(|| panic!("{who}: JSON has no `files` array:\n{v}"));
-        assert!(
-            files.is_empty(),
-            "{who}: no_files result must carry an EMPTY files list (the .csproj must not be picked up as a manifest):\n{v}"
-        );
-        assert_csproj_pristine(root, who);
-        v
-    }
-
-    /// Manifest-less VEX over a setup-only project: `setup` wires only the
-    /// agent-mode install hook (or nothing) — never a hosted/vendored
-    /// lockfile reference — so there is nothing to attest (exit 2,
-    /// `manifest_not_found`), no document, no patch-API request, and nothing
-    /// written into the project (the document path is outside it).
-    fn assert_manifestless_vex_has_nothing(root: &Path, product: &str, who: &str) {
-        use crate::vex_e2e_common::{run_vex, PatchApi, VexRun};
-        let out_dir = tempfile::tempdir().unwrap();
-        let api = PatchApi::empty();
-        for no_verify in [false, true] {
-            let mut r = VexRun::online(&api);
-            r.output = Some(out_dir.path().join("out.vex.json"));
-            r.product = Some(product.to_string());
-            r.no_verify = no_verify;
-            let out = run_vex(&binary(), root, &r);
-            assert_eq!(out.code, Some(2), "{who} (no_verify={no_verify}): {out}");
-            assert_eq!(
-                out.envelope["error"]["code"], "manifest_not_found",
-                "{who}: {out}"
-            );
-            assert!(
-                out.doc.is_none(),
-                "{who}: no document may be written: {out}"
-            );
-        }
-        api.assert_no_requests();
-    }
-
-    /// setup / setup --check / setup --remove against a real dotnet project,
-    /// asserting REAL on-disk + JSON state at every stage. This is the
-    /// assertion the Docker matrix can never make for nuget.
-    #[test]
-    #[serial_test::serial]
-    fn nuget_setup_roundtrip_host() {
-        // Committed regression guard for the env scrub itself: with the old
-        // fixed-list scrub these leaked into the child — SOCKET_STRICT /
-        // SOCKET_VENDOR_SOURCE aborted every parse (exit 2) and
-        // SOCKET_SETUP_EXCLUDE made the real `setup` run write
-        // `.socket/manifest.json` into the fixture (final entries check RED).
-        let _decoys = crate::smc::DecoyGuard::set(HOSTILE_DECOYS);
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        std::fs::write(root.join(CSPROJ_NAME), CSPROJ).unwrap();
-        let root_s = root.to_str().unwrap();
-
-        // ── pristine precondition ──────────────────────────────────────────
-        // Pin the BEFORE state so the assertions prove the *binary* left the
-        // .csproj alone, not that the fixture happened to match afterwards.
-        assert_csproj_pristine(root, "fixture");
-        assert!(
-            !root.join("package.json").exists(),
-            "fixture must not contain a package.json (would change the path under test)"
-        );
-
-        // ── check (before): no supported manifest → no_files, exit 0 ────────
-        // `--check` returning exit 1 here would be wrong (there is nothing to
-        // configure); returning `needs_configuration`/`configured` would mean
-        // the .csproj was mis-detected as an npm/python/cargo manifest.
-        assert_no_files(
-            root,
-            &["setup", "--check", "--cwd", root_s, "--json"],
-            "check (pristine)",
-        );
-
-        // ── setup: must be a true no-op (no .csproj mutation, nothing wired) ─
-        let v = assert_no_files(
-            root,
-            &["setup", "--cwd", root_s, "--yes", "--json"],
-            "setup",
-        );
-        assert_eq!(
-            v.get("updated").and_then(|n| n.as_i64()),
-            Some(0),
-            "setup on a dotnet project must update zero manifests:\n{v}"
-        );
-        assert_eq!(
-            v.get("errors").and_then(|n| n.as_i64()),
-            Some(0),
-            "setup on a dotnet project must report zero errors:\n{v}"
-        );
-        assert_eq!(
-            v.get("alreadyConfigured").and_then(|n| n.as_i64()),
-            Some(0),
-            "setup on a dotnet project must configure nothing (alreadyConfigured=0):\n{v}"
-        );
-        // Defensively confirm setup created no stray hook artifacts.
-        assert!(
-            !root.join("package.json").exists(),
-            "setup must NOT synthesize a package.json for a dotnet project"
-        );
-
-        // ── check (after setup): still nothing to configure → no_files ──────
-        // Proves `setup` did not silently configure something a later check
-        // would then report as `configured` (which would flip exit to 0 for a
-        // different, wrong reason).
-        assert_no_files(
-            root,
-            &["setup", "--check", "--cwd", root_s, "--json"],
-            "check (after setup)",
-        );
-
-        // ── remove: also a no-op on an unsupported project ──────────────────
-        assert_no_files(
-            root,
-            &["setup", "--remove", "--cwd", root_s, "--yes", "--json"],
-            "remove",
-        );
-
-        // ── manifest-less VEX: nothing setup did is attestable ─────────────
-        assert_manifestless_vex_has_nothing(root, "pkg:nuget/app@1.0.0", "vex (after remove)");
-
-        // ── final: directory still holds exactly the one file we created ────
-        // A stray sidecar/hook artifact left behind by any stage would betray
-        // a non-no-op that the per-stage `files: []` check could miss.
-        let entries: Vec<String> = std::fs::read_dir(root)
-            .unwrap()
-            .map(|e| e.unwrap().file_name().to_string_lossy().to_string())
-            .collect();
-        assert_eq!(
-            entries,
-            vec![CSPROJ_NAME.to_string()],
-            "setup round-trip must leave ONLY the original {CSPROJ_NAME}; stray entries: {entries:?}"
-        );
-    }
-}
diff --git a/crates/socket-patch-cli/tests/setup_matrix_pypi.rs b/crates/socket-patch-cli/tests/setup_matrix_pypi.rs
deleted file mode 100644
index 4bc19021..00000000
--- a/crates/socket-patch-cli/tests/setup_matrix_pypi.rs
+++ /dev/null
@@ -1,535 +0,0 @@
-//! setup-matrix: pypi ecosystem (pip / uv / poetry / pdm / hatch).
-//!
-//! Python installers have no native post-install hook, so `socket-patch
-//! setup` instead commits a `socket-patch-hook` dependency whose wheel ships
-//! a startup `.pth` that re-applies patches after install
-//! (package-manager-agnostic). pip, uv and hatch are wired + verified in
-//! Docker: their `baseline_with_setup` / `alt_content_patchset` cases APPLY
-//! (the harness builds the hook wheel and the driver installs it + fires an
-//! interpreter). poetry / pdm are resolver-based — their `add`/`install`/`run`
-//! re-resolve the whole manifest (now incl. the committed `socket-patch-hook`)
-//! against a package index, which the hermetic test can't provide, so they
-//! remain BASELINE GAPs (the mechanism is PM-agnostic and proven by the
-//! others). Nested-workspace layouts are also still gaps. The negative-control
-//! / empty / wrong-target cases must NOT apply for any of them.
-//!
-//! IMPORTANT — why this file carries a real assertion of its own:
-//! every `smc::run_pm("pypi", …)` below routes through the shared Docker
-//! matrix harness, which *soft-skips and silently passes* whenever Docker
-//! or the `pypi` image is absent (the common case locally and in this
-//! eval). On a skip the harness `return`s before running a single case, so
-//! none of the `pip`/`uv`/… tests can ever turn red for a genuine pypi
-//! `setup` regression. And even when Docker IS present, pypi is NOT
-//! npm-family (see `is_npm_family` in the harness), so the harness's
-//! behavioral check/remove round-trip is skipped for it entirely — the
-//! only thing it asserts is the coarse `actual_applied == expect_applied`
-//! verdict, whose missing-result fallback is the same `false` that
-//! satisfies every negative-control scenario. On its own this file
-//! protects nothing.
-//!
-//! To close that loophole WITHOUT touching the shared harness or the bash
-//! driver, [`host_guard::pypi_setup_roundtrip_host`] runs unconditionally
-//! (no Docker, no network, no Python toolchain — pip's `requirements.txt`
-//! manifest needs no lockfile refresh, so the path is fully hermetic) and
-//! exercises the REAL `socket-patch` binary against a real pip project:
-//! `setup --check` (fails) → `setup` (adds `socket-patch[hook]`) →
-//! `--check` (passes) → idempotent re-`setup` → `--remove` → `--check`
-//! (fails again). It verifies on-disk `requirements.txt` bytes against a
-//! hand-pinned golden (NOT a copy of any writer output) so the oracle can
-//! disagree with a broken implementation, and pins the JSON envelope
-//! (`status`, counts, `pythonPackageManager`, per-file `pth` entry) at
-//! every stage. It fails loudly if pypi `setup` ever stops wiring the hook
-//! dependency, mutates the wrong line, mis-reports its status/exit code,
-//! or fails to round-trip cleanly back to the original manifest.
-//!
-//! Run: `cargo test -p socket-patch-cli --features setup-e2e --test setup_matrix_pypi`
-#![cfg(feature = "setup-e2e")]
-
-#[path = "setup_matrix_common/mod.rs"]
-mod smc;
-
-#[test]
-#[serial_test::serial]
-fn pip() {
-    smc::run_pm("pypi", "pip");
-}
-
-#[test]
-#[serial_test::serial]
-fn uv() {
-    smc::run_pm("pypi", "uv");
-}
-
-#[test]
-#[serial_test::serial]
-fn poetry() {
-    smc::run_pm("pypi", "poetry");
-}
-
-#[test]
-#[serial_test::serial]
-fn pdm() {
-    smc::run_pm("pypi", "pdm");
-}
-
-#[test]
-#[serial_test::serial]
-fn hatch() {
-    smc::run_pm("pypi", "hatch");
-}
-
-// ─────────────────────────────────────────────────────────────────────────
-// Real, non-skippable regression guard for pypi `setup`.
-//
-// A pip project carries a `requirements.txt`, which `setup` DOES support:
-// it commits the `socket-patch[hook]` dependency (the `.pth` post-install
-// carrier). Unlike the no-op `no_files` ecosystems (go, maven, nuget,
-// cargo), pypi has a
-// positive contract, so this guard asserts the full configure round-trip
-// rather than a no-op. It runs with no Docker, no network, and (for pip,
-// whose `lock_commands()` is `None`) no external toolchain.
-// ─────────────────────────────────────────────────────────────────────────
-mod host_guard {
-    use std::path::Path;
-    use std::process::Command;
-
-    /// Initial pip manifest. A single ordinary requirement so the assertions
-    /// can prove `setup` appended the hook line WITHOUT disturbing the
-    /// user's existing entries (order + content preserved).
-    const REQ_INITIAL: &str = "requests==2.31.0\n";
-
-    /// The exact bytes `setup` must produce for pip's `requirements.txt`:
-    /// the original line, untouched, followed by the canonical
-    /// `socket-patch[hook]` requirement on its own line. This golden is
-    /// hand-derived from the documented contract (append `socket-patch[hook]`),
-    /// NOT copied from a run of the writer — so it can disagree with a broken
-    /// implementation that reorders, rewrites, or mangles the manifest.
-    const REQ_WITH_HOOK: &str = "requests==2.31.0\nsocket-patch[hook]\n";
-
-    /// Ambient decoys [`run`]'s prefix scrub must strip, planted by
-    /// [`pypi_setup_roundtrip_host`] itself so the scrub is exercised on every
-    /// run, not only in hostile shells. Three demonstrated failure classes on
-    /// the old fixed-list scrub: clap parses env-bound `GlobalArgs` values on
-    /// EVERY invocation whether or not the command uses the flag, so an
-    /// invalid ambient `SOCKET_STRICT` / `SOCKET_VENDOR_SOURCE` aborts the
-    /// parse (exit 2) before `setup` even runs; and a (perfectly valid!)
-    /// ambient `SOCKET_SETUP_EXCLUDE` stands in for `setup --exclude`, which
-    /// a real `setup` run PERSISTS into `.socket/manifest.json` inside the
-    /// fixture. (Safe to set process-wide: every other test in this binary
-    /// routes through either this module's [`run`] or
-    /// `smc::host_driver_command`, both of which prefix-scrub `SOCKET_*`.)
-    const HOSTILE_DECOYS: &[(&str, &str)] = &[
-        ("SOCKET_STRICT", "banana"),
-        ("SOCKET_VENDOR_SOURCE", "bogus-decoy"),
-        ("SOCKET_SETUP_EXCLUDE", "decoy-member"),
-    ];
-
-    /// Absolute path to the binary under test, via cargo's `CARGO_BIN_EXE_*`.
-    fn binary() -> std::path::PathBuf {
-        env!("CARGO_BIN_EXE_socket-patch").into()
-    }
-
-    /// Run the CLI with `args` in `cwd`; returns `(exit_code, stdout, stderr)`.
-    /// The entire `SOCKET_*` surface is stripped BY PREFIX — a fixed list rots
-    /// (it missed `SOCKET_SETUP_EXCLUDE` / `SOCKET_VENDOR_SOURCE` /
-    /// `SOCKET_STRICT`, all parsed on every `setup` invocation; see
-    /// [`HOSTILE_DECOYS`]) — so behaviour reflects the explicit flags alone:
-    /// nothing reaches authed endpoints and no ambient var can stand in for a
-    /// flag.
-    fn run(cwd: &Path, args: &[&str]) -> (i32, String, String) {
-        let mut cmd = Command::new(binary());
-        cmd.args(args).current_dir(cwd);
-        for (key, _) in std::env::vars_os() {
-            if key.to_string_lossy().starts_with("SOCKET_")
-                && key.to_string_lossy() != "SOCKET_NO_CONFIG"
-            {
-                cmd.env_remove(&key);
-            }
-        }
-        // This guard's contract is "no network" (module docs): `setup` fires a
-        // usage-telemetry POST when telemetry is enabled, and the scrub above
-        // would strip a developer's own opt-out. Force it off for the child —
-        // no assertion here concerns telemetry.
-        cmd.env("SOCKET_TELEMETRY_DISABLED", "1");
-        let out = cmd.output().expect("failed to execute socket-patch binary");
-        (
-            out.status.code().unwrap_or(-1),
-            String::from_utf8_lossy(&out.stdout).to_string(),
-            String::from_utf8_lossy(&out.stderr).to_string(),
-        )
-    }
-
-    /// Parse the CLI's `--json` stdout into a single JSON object. Panics
-    /// (loudly) if stdout is not the single JSON object the command
-    /// promises — a non-JSON / multi-line dump means the command did not
-    /// run the path we think it did.
-    fn parse_json(stdout: &str, who: &str) -> serde_json::Value {
-        serde_json::from_str(stdout.trim()).unwrap_or_else(|e| {
-            panic!("{who}: stdout was not a single JSON object ({e}):\n{stdout}")
-        })
-    }
-
-    fn json_str(v: &serde_json::Value, key: &str, who: &str) -> String {
-        v.get(key)
-            .and_then(|s| s.as_str())
-            .unwrap_or_else(|| panic!("{who}: JSON has no string `{key}` field:\n{v}"))
-            .to_string()
-    }
-
-    fn json_i64(v: &serde_json::Value, key: &str, who: &str) -> i64 {
-        v.get(key)
-            .and_then(|n| n.as_i64())
-            .unwrap_or_else(|| panic!("{who}: JSON has no integer `{key}` field:\n{v}"))
-    }
-
-    /// Read `requirements.txt` and assert it is byte-for-byte `expected`. The
-    /// independent on-disk oracle: it never calls production parsing code, so
-    /// a writer that produces a "looks-configured" but wrong manifest fails.
-    fn assert_requirements(root: &Path, expected: &str, who: &str) {
-        let got = std::fs::read_to_string(root.join("requirements.txt"))
-            .unwrap_or_else(|e| panic!("{who}: requirements.txt unreadable: {e}"));
-        assert_eq!(got, expected, "{who}: requirements.txt bytes mismatch");
-    }
-
-    /// Find the single `files[]` entry whose `kind == "pth"` (the Python
-    /// manifest). Fails if absent — a setup/check that reports no `pth` entry
-    /// never touched the Python manifest the test is about.
-    fn pth_entry(v: &serde_json::Value, who: &str) -> serde_json::Value {
-        v.get("files")
-            .and_then(|f| f.as_array())
-            .unwrap_or_else(|| panic!("{who}: JSON has no `files` array:\n{v}"))
-            .iter()
-            .find(|e| e.get("kind").and_then(|k| k.as_str()) == Some("pth"))
-            .unwrap_or_else(|| panic!("{who}: no files[] entry with kind=\"pth\":\n{v}"))
-            .clone()
-    }
-
-    /// Independent textual probe: is the exact `socket-patch[hook]`
-    /// requirement present as its own line (comment-stripped)? Deliberately
-    /// does NOT use `deps_contain_hook` (the production detector) so the
-    /// oracle can disagree with a broken writer.
-    fn has_hook_line(content: &str) -> bool {
-        content.lines().any(|l| {
-            let spec = l.split('#').next().unwrap_or("").trim();
-            spec == "socket-patch[hook]"
-        })
-    }
-
-    /// setup --check → setup → --check → re-setup → --remove → --check against
-    /// a real pip project, asserting REAL on-disk + JSON state at every stage.
-    /// This is the assertion the Docker matrix can never make for pypi.
-    #[test]
-    #[serial_test::serial]
-    fn pypi_setup_roundtrip_host() {
-        // Committed regression guard for the env scrub itself: with the old
-        // fixed-list scrub these leaked into the child — SOCKET_STRICT /
-        // SOCKET_VENDOR_SOURCE aborted every parse (exit 2) and
-        // SOCKET_SETUP_EXCLUDE made the real `setup` run write
-        // `.socket/manifest.json` into the fixture.
-        let _decoys = crate::smc::DecoyGuard::set(HOSTILE_DECOYS);
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        std::fs::write(root.join("requirements.txt"), REQ_INITIAL).unwrap();
-        let root_s = root.to_str().unwrap();
-
-        // ── pristine precondition ──────────────────────────────────────────
-        // Pin the BEFORE state so the post-setup assertions prove `setup`
-        // *added* the hook line, not that a leftover fixture already had it.
-        assert_requirements(root, REQ_INITIAL, "fixture");
-        assert!(
-            !has_hook_line(REQ_INITIAL),
-            "fixture must start WITHOUT the hook dependency"
-        );
-        assert!(
-            !root.join("package.json").exists(),
-            "fixture must not contain a package.json (would change the path under test)"
-        );
-
-        // ── check (before setup): unconfigured → exit 1, needs_configuration ─
-        let (code, out, err) = run(root, &["setup", "--check", "--cwd", root_s, "--json"]);
-        assert_eq!(
-            code, 1,
-            "setup --check must FAIL (exit 1) on a pristine pip project.\nstdout:\n{out}\nstderr:\n{err}"
-        );
-        let v = parse_json(&out, "check (pristine)");
-        assert_eq!(
-            json_str(&v, "status", "check (pristine)"),
-            "needs_configuration",
-            "pristine pip project must report needs_configuration:\n{v}"
-        );
-        assert_eq!(
-            json_str(
-                &pth_entry(&v, "check (pristine)"),
-                "status",
-                "check (pristine) pth"
-            ),
-            "needs_configuration",
-            "the requirements.txt pth entry must read needs_configuration before setup:\n{v}"
-        );
-        // --check must NEVER write — manifest still pristine.
-        assert_requirements(root, REQ_INITIAL, "after check (pristine)");
-
-        // ── setup: must append the hook dep and report success ──────────────
-        let (code, out, err) = run(root, &["setup", "--cwd", root_s, "--yes", "--json"]);
-        assert_eq!(
-            code, 0,
-            "setup must succeed.\nstdout:\n{out}\nstderr:\n{err}"
-        );
-        let v = parse_json(&out, "setup");
-        assert_eq!(
-            json_str(&v, "status", "setup"),
-            "success",
-            "setup on a pip project must report status=success:\n{v}"
-        );
-        assert_eq!(
-            json_i64(&v, "updated", "setup"),
-            1,
-            "setup must update exactly one manifest (requirements.txt):\n{v}"
-        );
-        assert_eq!(
-            json_i64(&v, "errors", "setup"),
-            0,
-            "setup must report zero errors:\n{v}"
-        );
-        assert_eq!(
-            json_str(&v, "pythonPackageManager", "setup"),
-            "pip",
-            "a requirements.txt-only project must be detected as pip:\n{v}"
-        );
-        let e = pth_entry(&v, "setup");
-        assert_eq!(
-            json_str(&e, "status", "setup pth"),
-            "updated",
-            "the requirements.txt pth entry must report updated:\n{v}"
-        );
-        assert!(
-            json_str(&e, "path", "setup pth").ends_with("requirements.txt"),
-            "the pth entry must point at requirements.txt:\n{v}"
-        );
-        // The decisive on-disk check: exact golden bytes (line preserved + hook
-        // appended), verified WITHOUT the production parser.
-        assert_requirements(root, REQ_WITH_HOOK, "after setup");
-        assert!(
-            !root.join("package.json").exists(),
-            "setup must NOT synthesize a package.json for a pip project"
-        );
-
-        // ── check (after setup): configured → exit 0 ────────────────────────
-        let (code, out, err) = run(root, &["setup", "--check", "--cwd", root_s, "--json"]);
-        assert_eq!(
-            code, 0,
-            "setup --check must PASS (exit 0) after setup.\nstdout:\n{out}\nstderr:\n{err}"
-        );
-        let v = parse_json(&out, "check (configured)");
-        assert_eq!(
-            json_str(&v, "status", "check (configured)"),
-            "configured",
-            "after setup the project must report configured:\n{v}"
-        );
-        assert_eq!(
-            json_str(
-                &pth_entry(&v, "check (configured)"),
-                "status",
-                "check (configured) pth"
-            ),
-            "configured",
-            "the requirements.txt pth entry must read configured after setup:\n{v}"
-        );
-
-        // ── idempotent re-setup: no further change ──────────────────────────
-        let (code, out, err) = run(root, &["setup", "--cwd", root_s, "--yes", "--json"]);
-        assert_eq!(
-            code, 0,
-            "re-setup must succeed.\nstdout:\n{out}\nstderr:\n{err}"
-        );
-        let v = parse_json(&out, "re-setup");
-        assert_eq!(
-            json_str(&v, "status", "re-setup"),
-            "already_configured",
-            "a second setup must be a no-op (already_configured), not re-append:\n{v}"
-        );
-        assert_eq!(
-            json_i64(&v, "updated", "re-setup"),
-            0,
-            "re-setup must update zero manifests:\n{v}"
-        );
-        // No duplicate hook line written.
-        assert_requirements(root, REQ_WITH_HOOK, "after re-setup");
-
-        // ── remove: strip the hook dep, restore the original manifest ───────
-        let (code, out, err) = run(
-            root,
-            &["setup", "--remove", "--cwd", root_s, "--yes", "--json"],
-        );
-        assert_eq!(
-            code, 0,
-            "setup --remove must succeed.\nstdout:\n{out}\nstderr:\n{err}"
-        );
-        let v = parse_json(&out, "remove");
-        assert_eq!(
-            json_str(&v, "status", "remove"),
-            "success",
-            "remove must report status=success:\n{v}"
-        );
-        assert_eq!(
-            json_i64(&v, "removed", "remove"),
-            1,
-            "remove must strip exactly one hook dependency:\n{v}"
-        );
-        assert_eq!(
-            json_str(&pth_entry(&v, "remove"), "status", "remove pth"),
-            "removed",
-            "the requirements.txt pth entry must report removed:\n{v}"
-        );
-        // Manifest must be byte-for-byte back to the original (no orphaned
-        // blank line, no mangled user requirement).
-        assert_requirements(root, REQ_INITIAL, "after remove");
-
-        // ── check (after remove): back to needs-configuration → exit 1 ──────
-        let (code, out, err) = run(root, &["setup", "--check", "--cwd", root_s, "--json"]);
-        assert_eq!(
-            code, 1,
-            "setup --check must FAIL (exit 1) again after remove.\nstdout:\n{out}\nstderr:\n{err}"
-        );
-        let v = parse_json(&out, "check (after remove)");
-        assert_eq!(
-            json_str(&v, "status", "check (after remove)"),
-            "needs_configuration",
-            "after remove the project must report needs_configuration again:\n{v}"
-        );
-    }
-
-    /// Regression: a commented-out hook line is NOT a configured project.
-    ///
-    /// pip never installs a `# socket-patch[hook]` comment, and plain `setup`
-    /// (whose `requirements_add` strips comments before probing) would still
-    /// append the hook — but the `--check` probe read the raw file and saw the
-    /// marker inside the comment, reporting `configured` (exit 0) for a
-    /// project with no hook at all. Check and setup must agree on the same
-    /// bytes.
-    #[test]
-    #[serial_test::serial]
-    fn pypi_check_ignores_commented_out_hook_host() {
-        const REQ_COMMENTED: &str = "requests==2.31.0\n# socket-patch[hook]\n";
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        let root_s = root.to_str().unwrap();
-        std::fs::write(root.join("requirements.txt"), REQ_COMMENTED).unwrap();
-        assert!(
-            !has_hook_line(REQ_COMMENTED),
-            "fixture: the commented-out line must not count as a hook line"
-        );
-
-        let (code, out, err) = run(root, &["setup", "--check", "--cwd", root_s, "--json"]);
-        assert_eq!(
-            code, 1,
-            "setup --check must FAIL (exit 1): a commented-out hook dep is not \
-             configured.\nstdout:\n{out}\nstderr:\n{err}"
-        );
-        let v = parse_json(&out, "check (commented-out)");
-        assert_eq!(
-            json_str(&v, "status", "check (commented-out)"),
-            "needs_configuration",
-            "a commented-out hook line must report needs_configuration:\n{v}"
-        );
-        assert_eq!(
-            json_str(
-                &pth_entry(&v, "check (commented-out)"),
-                "status",
-                "check (commented-out) pth"
-            ),
-            "needs_configuration",
-            "the requirements.txt pth entry must read needs_configuration:\n{v}"
-        );
-        // --check must NEVER write.
-        assert_requirements(root, REQ_COMMENTED, "after check (commented-out)");
-    }
-
-    /// Regression: classic-Poetry projects.
-    ///
-    /// `setup` writes the hook into a Poetry manifest as the *structural*
-    /// `socket-patch = { version = "*", extras = ["hook"] }` — which has NO
-    /// literal `socket-patch[hook]` substring. A `setup --check` that probes
-    /// the manifest *textually* would therefore report a freshly-and-correctly
-    /// configured Poetry project as `needs_configuration` (exit 1), breaking
-    /// the setup→check round-trip. This guard pins the structural detection by
-    /// running the real binary against a hand-authored Poetry manifest in each
-    /// state. Fully hermetic: `--check` neither writes nor refreshes a lockfile.
-    #[test]
-    #[serial_test::serial]
-    fn poetry_check_recognizes_structural_hook_host() {
-        // ── configured: the exact structural form `setup` emits ─────────────
-        let tmp = tempfile::tempdir().unwrap();
-        let root = tmp.path();
-        let root_s = root.to_str().unwrap();
-        std::fs::write(
-            root.join("pyproject.toml"),
-            "[tool.poetry]\nname = \"x\"\nversion = \"0.1.0\"\n\n\
-             [tool.poetry.dependencies]\npython = \"^3.9\"\n\
-             socket-patch = {version = \"*\", extras = [\"hook\"]}\n",
-        )
-        .unwrap();
-
-        let (code, out, err) = run(root, &["setup", "--check", "--cwd", root_s, "--json"]);
-        assert_eq!(
-            code, 0,
-            "setup --check must PASS (exit 0) for a Poetry project carrying the \
-             structural hook extra.\nstdout:\n{out}\nstderr:\n{err}"
-        );
-        let v = parse_json(&out, "poetry check (configured)");
-        assert_eq!(
-            json_str(&v, "status", "poetry check (configured)"),
-            "configured",
-            "structurally-configured Poetry project must report configured:\n{v}"
-        );
-        assert_eq!(
-            json_str(
-                &pth_entry(&v, "poetry check (configured)"),
-                "status",
-                "poetry check (configured) pth"
-            ),
-            "configured",
-            "the pyproject pth entry must read configured:\n{v}"
-        );
-
-        // ── unconfigured: a plain socket-patch dep (no hook) is NOT enough ──
-        let tmp2 = tempfile::tempdir().unwrap();
-        let root2 = tmp2.path();
-        let root2_s = root2.to_str().unwrap();
-        std::fs::write(
-            root2.join("pyproject.toml"),
-            "[tool.poetry]\nname = \"x\"\nversion = \"0.1.0\"\n\n\
-             [tool.poetry.dependencies]\npython = \"^3.9\"\nsocket-patch = \"^3.3.0\"\n",
-        )
-        .unwrap();
-        let (code, out, err) = run(root2, &["setup", "--check", "--cwd", root2_s, "--json"]);
-        assert_eq!(
-            code, 1,
-            "setup --check must FAIL (exit 1) for a Poetry project whose \
-             socket-patch dep carries no hook extra.\nstdout:\n{out}\nstderr:\n{err}"
-        );
-        let v = parse_json(&out, "poetry check (unconfigured)");
-        assert_eq!(
-            json_str(&v, "status", "poetry check (unconfigured)"),
-            "needs_configuration",
-            "a hook-less Poetry project must report needs_configuration:\n{v}"
-        );
-    }
-}
-
-// ── Nested-workspace layouts (EXPECTED BASELINE GAP) ──────────────────
-// uv workspace (root + members, one shared .venv) and a pip
-// nested-requirements monorepo. Python has no post-install hook, so
-// these don't apply today — but the install itself must succeed.
-
-#[test]
-#[serial_test::serial]
-fn pip_workspace() {
-    smc::run_workspace_pm("pypi", "pip");
-}
-
-#[test]
-#[serial_test::serial]
-fn uv_workspace() {
-    smc::run_workspace_pm("pypi", "uv");
-}
diff --git a/crates/socket-patch-cli/tests/setup_matrix_static.rs b/crates/socket-patch-cli/tests/setup_matrix_static.rs
deleted file mode 100644
index 60c424e8..00000000
--- a/crates/socket-patch-cli/tests/setup_matrix_static.rs
+++ /dev/null
@@ -1,91 +0,0 @@
-//! Static setup-matrix wiring guards that need neither docker nor the
-//! `setup-e2e` feature, so the default test run keeps them honest.
-
-use std::path::{Path, PathBuf};
-
-fn workspace_root() -> PathBuf {
-    Path::new(env!("CARGO_MANIFEST_DIR"))
-        .parent()
-        .and_then(|p| p.parent())
-        .expect("workspace root")
-        .to_path_buf()
-}
-
-fn read(rel: &str) -> String {
-    let p = workspace_root().join(rel);
-    std::fs::read_to_string(&p).unwrap_or_else(|e| panic!("read {}: {e}", p.display()))
-}
-
-/// The body of a `name() { ... }` bash function, matched brace for brace.
-fn bash_fn_body<'a>(script: &'a str, name: &str) -> &'a str {
-    let header = format!("{name}() {{");
-    let start = script
-        .find(&header)
-        .unwrap_or_else(|| panic!("run-case.sh: function `{name}` not found"));
-    let rest = &script[start + header.len()..];
-    let mut depth = 1usize;
-    for (i, c) in rest.char_indices() {
-        match c {
-            '{' => depth += 1,
-            '}' => {
-                depth -= 1;
-                if depth == 0 {
-                    return &rest[..i];
-                }
-            }
-            _ => {}
-        }
-    }
-    panic!("run-case.sh: unbalanced braces in `{name}`");
-}
-
-/// vlt is an npm-family row of the matrix: it runs in the npm image, gets
-/// npm's `npx` hook, takes the round-trip path, and its scaffolds carry the
-/// vlt.json marker (with registry config) that `setup` detects vlt by.
-/// The docker legs soft-skip, so this pins the wiring they would exercise.
-#[test]
-fn vlt_targets_route_through_the_npm_round_trip() {
-    let spec: serde_json::Value =
-        serde_json::from_str(&read("tests/setup_matrix/matrix.json")).expect("parse matrix.json");
-    for section in ["targets", "workspace_targets"] {
-        let vlt: Vec<&serde_json::Value> = spec[section]
-            .as_array()
-            .unwrap_or_else(|| panic!("{section} array"))
-            .iter()
-            .filter(|t| t["pm"] == "vlt")
-            .collect();
-        assert_eq!(vlt.len(), 1, "{section}: one vlt target");
-        let t = vlt[0];
-        assert_eq!(t["ecosystem"], "npm", "{section}");
-        assert_eq!(t["image"], "npm", "{section}");
-        assert_eq!(t["hook_family"], "npm", "{section}: vlt uses the npx hook");
-        assert_eq!(t["baseline_supported"], true, "{section}");
-    }
-
-    let script = read("tests/setup_matrix/run-case.sh");
-    assert!(
-        bash_fn_body(&script, "is_npm_family").contains("vlt"),
-        "vlt must take the check/remove round trip"
-    );
-    for scaffold in ["scaffold_project", "scaffold_workspace"] {
-        let body = bash_fn_body(&script, scaffold);
-        let arm = body
-            .split("\n    vlt)")
-            .nth(1)
-            .unwrap_or_else(|| panic!("{scaffold} has no vlt arm"));
-        let arm = &arm[..arm.find(";;").expect("vlt arm ends")];
-        assert!(
-            arm.contains("vlt_json"),
-            "{scaffold}: vlt.json marker:\n{arm}"
-        );
-    }
-    assert!(
-        bash_fn_body(&script, "scaffold_workspace").contains("\"workspaces\""),
-        "the vlt workspace is declared in vlt.json"
-    );
-    let vlt_json = bash_fn_body(&script, "vlt_json");
-    assert!(
-        vlt_json.contains("\"registries\"") && vlt_json.contains("\"registry\""),
-        "vlt >= 1.0.0-rc.33 installs need a registry config:\n{vlt_json}"
-    );
-}
diff --git a/crates/socket-patch-cli/tests/setup_pth_invariants.rs b/crates/socket-patch-cli/tests/setup_pth_invariants.rs
deleted file mode 100644
index a2fdeb25..00000000
--- a/crates/socket-patch-cli/tests/setup_pth_invariants.rs
+++ /dev/null
@@ -1,624 +0,0 @@
-//! Integration tests for `setup`'s Python `.pth`-hook branch. Like the npm
-//! `setup_invariants`, these operate entirely on disk (manifest detection +
-//! editing + audit record) and need no network.
-
-use std::collections::BTreeSet;
-use std::path::Path;
-
-#[path = "common/mod.rs"]
-mod common;
-
-/// Run `setup --json --yes [extra]` in `cwd` through the shared hermetic
-/// runner. The binary binds a wide `SOCKET_*` env surface (SOCKET_DRY_RUN,
-/// SOCKET_ECOSYSTEMS, SOCKET_CWD, SOCKET_SETUP_EXCLUDE, ...); an ambient
-/// value silently flips what every test here exercises (SOCKET_DRY_RUN=true
-/// turns each real run into a dry run, SOCKET_ECOSYSTEMS=npm hides the
-/// Python branch entirely), so `common::run_with_env`'s seed-then-scrub is
-/// load-bearing, not hygiene.
-fn run_setup(cwd: &Path, extra: &[&str]) -> (i32, serde_json::Value) {
-    let mut args = vec!["setup", "--json", "--yes"];
-    args.extend_from_slice(extra);
-    let (code, stdout, _stderr) =
-        common::run_with_env(cwd, &args, &[("SOCKET_TELEMETRY_DISABLED", "1")]);
-    let v = serde_json::from_str(&stdout)
-        .unwrap_or_else(|e| panic!("stdout must be JSON ({e}):\n{stdout}"));
-    (code, v)
-}
-
-fn write(path: &Path, content: &str) {
-    if let Some(parent) = path.parent() {
-        std::fs::create_dir_all(parent).expect("create parent");
-    }
-    std::fs::write(path, content).expect("write file");
-}
-
-fn read(path: &Path) -> String {
-    std::fs::read_to_string(path).expect("read file")
-}
-
-/// The set of directory-entry names directly under `dir` (non-recursive).
-fn dir_entries(dir: &Path) -> BTreeSet<String> {
-    std::fs::read_dir(dir)
-        .expect("read_dir")
-        .map(|e| e.unwrap().file_name().to_string_lossy().to_string())
-        .collect()
-}
-
-/// Every regular-file path under `dir`, relative to `dir` (recursive). Proves
-/// `setup` writes nothing outside the repo (property 5) and snapshots a
-/// "clone" (property 6).
-fn files_under(dir: &Path) -> BTreeSet<String> {
-    fn walk(base: &Path, dir: &Path, out: &mut BTreeSet<String>) {
-        if let Ok(rd) = std::fs::read_dir(dir) {
-            for e in rd.flatten() {
-                let p = e.path();
-                if p.is_dir() {
-                    walk(base, &p, out);
-                } else {
-                    out.insert(p.strip_prefix(base).unwrap().to_string_lossy().to_string());
-                }
-            }
-        }
-    }
-    let mut out = BTreeSet::new();
-    walk(dir, dir, &mut out);
-    out
-}
-
-/// Copy every file under `src` into `dst`. Simulates a fresh checkout of the
-/// committed tree on another host.
-fn copy_tree(src: &Path, dst: &Path) {
-    for rel in files_under(src) {
-        let to = dst.join(&rel);
-        if let Some(parent) = to.parent() {
-            std::fs::create_dir_all(parent).expect("create parent");
-        }
-        std::fs::copy(src.join(&rel), &to).expect("copy file");
-    }
-}
-
-/// Return the single `files[]` entry whose `kind == kind`, panicking if there
-/// is not exactly one. Stops a regression from hiding a wrong/extra entry
-/// behind a positional `files[0]`.
-fn file_entry<'a>(v: &'a serde_json::Value, kind: &str) -> &'a serde_json::Value {
-    let arr = v["files"]
-        .as_array()
-        .unwrap_or_else(|| panic!("files must be an array: {v}"));
-    let matches: Vec<&serde_json::Value> = arr.iter().filter(|f| f["kind"] == kind).collect();
-    assert_eq!(
-        matches.len(),
-        1,
-        "expected exactly one `{kind}` file entry, got {}: {v}",
-        matches.len()
-    );
-    matches[0]
-}
-
-/// Extract the literal text inside the first top-level `dependencies = [ ... ]`
-/// array in a pyproject.toml, so we can assert membership *within the array*
-/// rather than merely "the string appears somewhere in the file". Deliberately
-/// independent of the production toml_edit code path.
-fn dependencies_array_body(toml: &str) -> String {
-    let start = toml
-        .find("dependencies = [")
-        .unwrap_or_else(|| panic!("no `dependencies = [` in:\n{toml}"));
-    // Scan from just inside the opening `[` (depth 1) and find the matching
-    // close, accounting for nested brackets like the `[hook]` extra in
-    // `socket-patch[hook]` — a naive `.find(']')` would stop there.
-    let after = &toml[start + "dependencies = [".len()..];
-    let mut depth = 1usize;
-    let mut end = None;
-    for (i, c) in after.char_indices() {
-        match c {
-            '[' => depth += 1,
-            ']' => {
-                depth -= 1;
-                if depth == 0 {
-                    end = Some(i);
-                    break;
-                }
-            }
-            _ => {}
-        }
-    }
-    let end = end.unwrap_or_else(|| panic!("unterminated dependencies array in:\n{toml}"));
-    after[..end].to_string()
-}
-
-#[test]
-fn pip_requirements_gets_hook_dep() {
-    let tmp = tempfile::tempdir().unwrap();
-    write(&tmp.path().join("requirements.txt"), "requests==2.31.0\n");
-
-    let (code, v) = run_setup(tmp.path(), &[]);
-    assert_eq!(code, 0, "setup should succeed; payload={v}");
-    assert_eq!(v["status"], "success");
-    assert_eq!(v["updated"], 1);
-    assert_eq!(
-        v["alreadyConfigured"], 0,
-        "fresh file is not already-configured"
-    );
-    assert_eq!(v["errors"], 0);
-    assert_eq!(v["pythonPackageManager"], "pip");
-
-    let entry = file_entry(&v, "pth");
-    assert_eq!(entry["status"], "updated");
-    assert!(
-        entry["path"]
-            .as_str()
-            .unwrap()
-            .ends_with("requirements.txt"),
-        "pth entry must point at requirements.txt: {entry}"
-    );
-    assert!(entry["error"].is_null(), "no error expected: {entry}");
-
-    // Exact on-disk result: the hook dep is appended on its own trailing line,
-    // the existing pinned dep is preserved verbatim, nothing else is rewritten.
-    let req = read(&tmp.path().join("requirements.txt"));
-    assert_eq!(
-        req, "requests==2.31.0\nsocket-patch[hook]\n",
-        "requirements.txt must gain exactly the hook line; got:\n{req}"
-    );
-
-    // The committed dependency is the source of truth — no separate marker file
-    // and no other files conjured into the project dir.
-    assert_eq!(
-        dir_entries(tmp.path()),
-        BTreeSet::from(["requirements.txt".to_string()]),
-        "setup must touch only requirements.txt"
-    );
-}
-
-#[test]
-fn uv_pyproject_array_edited_and_format_preserved() {
-    let tmp = tempfile::tempdir().unwrap();
-    let original = "[project]\nname = \"x\"\nversion = \"0.0.0\"\ndependencies = [\n    \"requests\",\n]\n\n[tool.uv]\n";
-    write(&tmp.path().join("pyproject.toml"), original);
-    write(&tmp.path().join("uv.lock"), ""); // detected as uv
-
-    let (code, v) = run_setup(tmp.path(), &[]);
-    assert_eq!(code, 0, "payload={v}");
-    assert_eq!(v["status"], "success", "payload={v}");
-    assert_eq!(v["updated"], 1);
-    assert_eq!(v["errors"], 0);
-    assert_eq!(v["pythonPackageManager"], "uv");
-
-    let entry = file_entry(&v, "pth");
-    assert_eq!(entry["status"], "updated");
-    assert!(entry["path"].as_str().unwrap().ends_with("pyproject.toml"));
-
-    let py = read(&tmp.path().join("pyproject.toml"));
-
-    // The hook dep must land *inside* the PEP 621 dependencies array, alongside
-    // the pre-existing `requests` — not appended as a stray top-level line.
-    let body = dependencies_array_body(&py);
-    assert!(
-        body.contains("socket-patch[hook]"),
-        "hook dep must be inside the dependencies array; array body:\n{body}\nfull:\n{py}"
-    );
-    assert!(
-        body.contains("\"requests\""),
-        "existing dep must remain in the array; array body:\n{body}"
-    );
-    // Exactly one occurrence in the whole file (no duplication / stray copy).
-    assert_eq!(
-        py.matches("socket-patch[hook]").count(),
-        1,
-        "hook dep must appear exactly once; got:\n{py}"
-    );
-
-    // Format / unrelated content preserved: the [tool.uv] table survives, the
-    // user's 4-space array indentation is kept, and the file is still parseable
-    // by the same edit path (idempotent re-run reports already-configured, which
-    // proves the array is well-formed enough to be re-detected).
-    assert!(
-        py.contains("[tool.uv]"),
-        "unrelated tables preserved:\n{py}"
-    );
-    assert!(py.contains("name = \"x\""), "scalar keys preserved:\n{py}");
-    assert!(
-        py.contains("    \"requests\""),
-        "original 4-space array indentation must be preserved:\n{py}"
-    );
-
-    let (code2, v2) = run_setup(tmp.path(), &[]);
-    assert_eq!(code2, 0);
-    assert_eq!(
-        v2["status"], "already_configured",
-        "re-run must detect the array entry it just wrote: {v2}"
-    );
-}
-
-#[test]
-fn idempotent_second_run_reports_already_configured() {
-    let tmp = tempfile::tempdir().unwrap();
-    write(&tmp.path().join("requirements.txt"), "requests\n");
-
-    let (code1, v1) = run_setup(tmp.path(), &[]);
-    assert_eq!(code1, 0, "first run must succeed: {v1}");
-    assert_eq!(v1["status"], "success", "first run must configure: {v1}");
-    assert_eq!(
-        v1["updated"], 1,
-        "first run updates exactly one manifest: {v1}"
-    );
-
-    let (code, v) = run_setup(tmp.path(), &[]);
-    assert_eq!(code, 0);
-    assert_eq!(v["status"], "already_configured");
-    assert_eq!(v["updated"], 0, "second run must not re-edit: {v}");
-    assert_eq!(
-        v["alreadyConfigured"], 1,
-        "second run sees it configured: {v}"
-    );
-    let req = read(&tmp.path().join("requirements.txt"));
-    assert_eq!(
-        req.matches("socket-patch[hook]").count(),
-        1,
-        "must not duplicate the hook dependency"
-    );
-}
-
-#[test]
-fn pep503_equivalent_hook_spellings_are_already_configured() {
-    // pip installs the hook from `socket_patch[hook]` exactly as from the
-    // canonical spelling (PEP 503: `-`/`_`/`.` are interchangeable in names)
-    // and from a combined-extras spec like `socket-patch[cli,hook]` (PEP 508).
-    // Setup must recognize both as configured: appending a second spelling of
-    // the same requirement is non-idempotent, `--check` would fail a CI gate
-    // on a correctly configured repo, and `--remove` would report nothing to
-    // remove while the hook stays wired.
-    for spec in ["socket_patch[hook]\n", "socket-patch[cli,hook]>=1.0\n"] {
-        let tmp = tempfile::tempdir().unwrap();
-        write(&tmp.path().join("requirements.txt"), spec);
-
-        let (code, v) = run_setup(tmp.path(), &[]);
-        assert_eq!(code, 0, "spec {spec:?}: payload={v}");
-        assert_eq!(
-            v["status"], "already_configured",
-            "spec {spec:?} already declares the hook; setup must not re-add it: {v}"
-        );
-        assert_eq!(
-            read(&tmp.path().join("requirements.txt")),
-            spec,
-            "spec {spec:?}: requirements.txt must be untouched"
-        );
-
-        let (code, v) = run_setup(tmp.path(), &["--check"]);
-        assert_eq!(
-            code, 0,
-            "spec {spec:?}: --check must pass on a configured project: {v}"
-        );
-        assert_eq!(v["status"], "configured", "spec {spec:?}: {v}");
-    }
-}
-
-#[test]
-fn dry_run_does_not_modify_or_create_files() {
-    let tmp = tempfile::tempdir().unwrap();
-    let original = "requests\n";
-    write(&tmp.path().join("requirements.txt"), original);
-    let before = dir_entries(tmp.path());
-
-    let (code, v) = run_setup(tmp.path(), &["--dry-run"]);
-    assert_eq!(code, 0);
-    assert_eq!(v["status"], "dry_run");
-    assert_eq!(v["dryRun"], true);
-    assert_eq!(v["wouldUpdate"], 1);
-    assert_eq!(v["errors"], 0);
-
-    // No write: byte-identical content AND no new files created anywhere in the
-    // project dir (the failure mode the test name warns about).
-    assert_eq!(read(&tmp.path().join("requirements.txt")), original);
-    assert_eq!(
-        dir_entries(tmp.path()),
-        before,
-        "dry-run must not create or remove any files"
-    );
-}
-
-#[test]
-fn remove_reverses_dep() {
-    let tmp = tempfile::tempdir().unwrap();
-    write(&tmp.path().join("requirements.txt"), "requests\n");
-    // Configure first.
-    let (_, v) = run_setup(tmp.path(), &[]);
-    assert_eq!(v["status"], "success");
-    assert_eq!(
-        read(&tmp.path().join("requirements.txt")),
-        "requests\nsocket-patch[hook]\n",
-        "precondition: setup added the hook line"
-    );
-
-    let (code, v) = run_setup(tmp.path(), &["--remove"]);
-    assert_eq!(code, 0, "payload={v}");
-    assert_eq!(v["status"], "success", "remove must report success: {v}");
-    assert_eq!(v["removed"], 1, "exactly one manifest reverted: {v}");
-    assert_eq!(v["errors"], 0);
-    let entry = file_entry(&v, "pth");
-    assert_eq!(entry["status"], "removed");
-
-    // Exact restoration to the pre-setup content — not merely "hook absent".
-    let req = read(&tmp.path().join("requirements.txt"));
-    assert_eq!(
-        req, "requests\n",
-        "remove must restore the original file byte-for-byte; got:\n{req}"
-    );
-}
-
-#[test]
-fn polyglot_configures_both_npm_and_python() {
-    let tmp = tempfile::tempdir().unwrap();
-    write(
-        &tmp.path().join("package.json"),
-        "{ \"name\": \"x\", \"version\": \"0.0.0\" }\n",
-    );
-    write(
-        &tmp.path().join("pyproject.toml"),
-        "[project]\nname = \"x\"\nversion = \"0.0.0\"\ndependencies = []\n",
-    );
-
-    let (code, v) = run_setup(tmp.path(), &[]);
-    assert_eq!(code, 0, "payload={v}");
-    assert_eq!(v["status"], "success", "payload={v}");
-    assert_eq!(v["updated"], 2);
-    assert_eq!(
-        v["alreadyConfigured"], 0,
-        "both manifests start unconfigured: {v}"
-    );
-    assert_eq!(v["errors"], 0);
-
-    let files = v["files"].as_array().unwrap();
-    // Exactly the two expected kinds, each updated.
-    let pj = file_entry(&v, "package_json");
-    assert_eq!(pj["status"], "updated");
-    let pth = file_entry(&v, "pth");
-    assert_eq!(pth["status"], "updated");
-    assert_eq!(files.len(), 2, "no spurious extra file entries: {v}");
-
-    // The npm side injects the postinstall hook into package.json.
-    let pkg = read(&tmp.path().join("package.json"));
-    assert!(
-        pkg.contains("socket-patch"),
-        "package.json must gain the hook:\n{pkg}"
-    );
-    assert!(
-        pkg.contains("postinstall"),
-        "npm hook is a postinstall script:\n{pkg}"
-    );
-
-    // The python side adds the dep inside the dependencies array.
-    let py = read(&tmp.path().join("pyproject.toml"));
-    assert!(
-        dependencies_array_body(&py).contains("socket-patch[hook]"),
-        "hook dep must be inside the pyproject dependencies array:\n{py}"
-    );
-}
-
-#[test]
-fn pure_python_with_no_manifest_files_is_no_op() {
-    // `setup.py`-only project (no pyproject/requirements): pip path would
-    // create requirements.txt. But an EMPTY dir with neither markers nor
-    // package.json must report no_files.
-    let tmp = tempfile::tempdir().unwrap();
-    let (code, v) = run_setup(tmp.path(), &[]);
-    assert_eq!(code, 0);
-    assert_eq!(v["status"], "no_files");
-    assert_eq!(v["updated"], 0, "no_files must touch nothing: {v}");
-    assert_eq!(v["errors"], 0);
-    assert!(
-        v["files"].as_array().map(|a| a.is_empty()).unwrap_or(false),
-        "no_files must report an empty files list: {v}"
-    );
-
-    // Crucially: setup must NOT conjure a requirements.txt (or any file) into an
-    // empty, non-python directory.
-    assert!(
-        dir_entries(tmp.path()).is_empty(),
-        "no files may be created on a no_files run; found: {:?}",
-        dir_entries(tmp.path())
-    );
-}
-
-// ---------------------------------------------------------------------------
-// Property 5 — the Python branch writes only inside the repo. The `.pth` wheel
-// is installed later by the user's package manager into site-packages; `setup`
-// itself only edits the committed requirements.txt / pyproject.toml and must
-// never write to `$HOME` or global site-packages.
-// (CLI_CONTRACT.md → "Setup command contract", property 5.)
-// ---------------------------------------------------------------------------
-
-#[test]
-fn setup_python_writes_only_inside_repo() {
-    let proj = tempfile::tempdir().unwrap();
-    let home = tempfile::tempdir().unwrap();
-    write(&proj.path().join("requirements.txt"), "requests\n");
-    assert!(
-        files_under(home.path()).is_empty(),
-        "sentinel HOME must start empty"
-    );
-
-    let (code, _stdout, stderr) = common::run_with_env(
-        proj.path(),
-        &["setup", "--json", "--yes"],
-        &[
-            ("HOME", home.path().to_str().unwrap()),
-            ("SOCKET_TELEMETRY_DISABLED", "1"),
-        ],
-    );
-    assert_eq!(code, 0, "setup should succeed; stderr=\n{stderr}");
-
-    assert!(
-        files_under(home.path()).is_empty(),
-        "Python setup must not write outside --cwd; HOME gained: {:?}",
-        files_under(home.path())
-    );
-    // Only the committed manifest was touched — no site-packages, no .pth, no
-    // marker file beside it.
-    assert_eq!(
-        files_under(proj.path()),
-        BTreeSet::from(["requirements.txt".to_string()]),
-        "setup must touch only the in-repo requirements.txt"
-    );
-    assert_eq!(
-        read(&proj.path().join("requirements.txt")),
-        "requests\nsocket-patch[hook]\n",
-        "the in-repo manifest must have gained exactly the hook line"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// Property 6 — Python setup state is clone-portable: the committed dependency
-// line is the whole story, so `--check` passes on a copied tree.
-// (CLI_CONTRACT.md → "Setup command contract", property 6.)
-// ---------------------------------------------------------------------------
-
-#[test]
-fn setup_python_state_is_clone_portable() {
-    let a = tempfile::tempdir().unwrap();
-    write(&a.path().join("requirements.txt"), "requests\n");
-    let (c, v) = run_setup(a.path(), &[]);
-    assert_eq!(c, 0, "initial setup must succeed: {v}");
-    assert_eq!(v["status"], "success");
-
-    let b = tempfile::tempdir().unwrap();
-    copy_tree(a.path(), b.path());
-
-    let before = read(&b.path().join("requirements.txt"));
-    let (code, v) = run_setup(b.path(), &["--check"]);
-    assert_eq!(code, 0, "clone must already be configured: {v}");
-    assert_eq!(v["status"], "configured");
-    assert_eq!(
-        read(&b.path().join("requirements.txt")),
-        before,
-        "--check must not modify the clone"
-    );
-}
-
-// ---------------------------------------------------------------------------
-// Property 7 — the post-edit lockfile refresh must not rewrite the user's
-// pinned dependency set. Poetry 1.x's bare `poetry lock` re-resolves EVERY
-// dependency to the newest compatible version (the pin-preserving spelling is
-// `lock --no-update`); Poetry 2.x makes pin-preserving the default and
-// REMOVES `--no-update`, so setup must try the 1.x spelling first and fall
-// back to the bare form when the flag is unknown. Same shape for PDM
-// (`--update-reuse`). A fake package manager on PATH records the argv setup
-// actually invokes.
-// ---------------------------------------------------------------------------
-
-/// Lay a fake `name` executable into `bin_dir` that appends its argv to `log`
-/// and exits 0 — unless the argv contains `reject_arg`, in which case it prints
-/// an unknown-option error and exits 1 without logging (a tool that does not
-/// know the flag, e.g. Poetry 2.x and `--no-update`).
-#[cfg(unix)]
-fn write_pm_shim(bin_dir: &Path, name: &str, log: &Path, reject_arg: Option<&str>) {
-    use std::os::unix::fs::PermissionsExt;
-    std::fs::create_dir_all(bin_dir).expect("create shim dir");
-    let reject = match reject_arg {
-        Some(flag) => format!(
-            "case \"$*\" in *{flag}*) echo 'The \"{flag}\" option does not exist.' >&2; exit 1;; esac\n"
-        ),
-        None => String::new(),
-    };
-    let body = format!(
-        "#!/bin/sh\n{reject}printf '%s\\n' \"$*\" >> '{}'\nexit 0\n",
-        log.display()
-    );
-    let p = bin_dir.join(name);
-    std::fs::write(&p, body).expect("write shim");
-    std::fs::set_permissions(&p, std::fs::Permissions::from_mode(0o755)).expect("chmod shim");
-}
-
-/// `run_setup` with the shim dir prepended to PATH so the spawned lockfile
-/// refresh resolves to the fake package manager.
-#[cfg(unix)]
-fn run_setup_with_shims(cwd: &Path, bin_dir: &Path) -> (i32, serde_json::Value) {
-    let path_env = format!(
-        "{}:{}",
-        bin_dir.display(),
-        std::env::var("PATH").unwrap_or_default()
-    );
-    let (code, stdout, _stderr) = common::run_with_env(
-        cwd,
-        &["setup", "--json", "--yes"],
-        &[("SOCKET_TELEMETRY_DISABLED", "1"), ("PATH", &path_env)],
-    );
-    let v = serde_json::from_str(&stdout)
-        .unwrap_or_else(|e| panic!("stdout must be JSON ({e}):\n{stdout}"));
-    (code, v)
-}
-
-const POETRY_PYPROJECT: &str = "[tool.poetry]\nname = \"x\"\nversion = \"0.1.0\"\ndescription = \"\"\nauthors = []\n\n[tool.poetry.dependencies]\npython = \"^3.9\"\n";
-
-#[cfg(unix)]
-#[test]
-fn poetry_lock_refresh_asks_for_pin_preserving_lock_first() {
-    let tmp = tempfile::tempdir().unwrap();
-    write(&tmp.path().join("pyproject.toml"), POETRY_PYPROJECT);
-    write(&tmp.path().join("poetry.lock"), "# stub lock\n");
-    let log = tmp.path().join("poetry-argv.log");
-    // Poetry 1.x: knows both `lock` and `lock --no-update`.
-    write_pm_shim(&tmp.path().join("bin"), "poetry", &log, None);
-
-    let (code, v) = run_setup_with_shims(tmp.path(), &tmp.path().join("bin"));
-    assert_eq!(code, 0, "setup must succeed: {v}");
-    let argvs = read(&log);
-    let first = argvs.lines().next().unwrap_or_default();
-    assert_eq!(
-        first, "lock --no-update",
-        "on a tool that accepts it, the FIRST lock invocation must be the \
-         pin-preserving `poetry lock --no-update` — the bare `poetry lock` \
-         re-resolves the user's entire pinned set on Poetry 1.x; got argv log:\n{argvs}"
-    );
-    assert!(
-        v.get("warnings").is_none(),
-        "successful pin-preserving refresh must not warn: {v}"
-    );
-}
-
-#[cfg(unix)]
-#[test]
-fn poetry_2x_without_no_update_falls_back_to_bare_lock() {
-    let tmp = tempfile::tempdir().unwrap();
-    write(&tmp.path().join("pyproject.toml"), POETRY_PYPROJECT);
-    write(&tmp.path().join("poetry.lock"), "# stub lock\n");
-    let log = tmp.path().join("poetry-argv.log");
-    // Poetry 2.x: `--no-update` was removed (pin-preserving became the
-    // default), so that spelling exits non-zero.
-    write_pm_shim(&tmp.path().join("bin"), "poetry", &log, Some("--no-update"));
-
-    let (code, v) = run_setup_with_shims(tmp.path(), &tmp.path().join("bin"));
-    assert_eq!(code, 0, "setup must succeed: {v}");
-    let argvs = read(&log);
-    assert_eq!(
-        argvs.lines().last().unwrap_or_default(),
-        "lock",
-        "when `--no-update` is unknown the bare `poetry lock` must still run \
-         (it is pin-preserving on 2.x); got argv log:\n{argvs}"
-    );
-    assert!(
-        v.get("warnings").is_none(),
-        "a successful fallback is not a failure — no lockfile warning: {v}"
-    );
-}
-
-#[cfg(unix)]
-#[test]
-fn pdm_lock_refresh_asks_for_pin_preserving_lock_first() {
-    let tmp = tempfile::tempdir().unwrap();
-    write(
-        &tmp.path().join("pyproject.toml"),
-        "[project]\nname = \"x\"\nversion = \"0.1.0\"\ndependencies = [\"requests\"]\n\n[tool.pdm]\n",
-    );
-    write(&tmp.path().join("pdm.lock"), "# stub lock\n");
-    let log = tmp.path().join("pdm-argv.log");
-    write_pm_shim(&tmp.path().join("bin"), "pdm", &log, None);
-
-    let (code, v) = run_setup_with_shims(tmp.path(), &tmp.path().join("bin"));
-    assert_eq!(code, 0, "setup must succeed: {v}");
-    let argvs = read(&log);
-    assert_eq!(
-        argvs.lines().next().unwrap_or_default(),
-        "lock --update-reuse",
-        "the first PDM lock invocation must reuse the user's pins; got argv log:\n{argvs}"
-    );
-}
diff --git a/crates/socket-patch-cli/tests/setup_terminal_output.rs b/crates/socket-patch-cli/tests/setup_terminal_output.rs
deleted file mode 100644
index a1c31ad2..00000000
--- a/crates/socket-patch-cli/tests/setup_terminal_output.rs
+++ /dev/null
@@ -1,273 +0,0 @@
-//! Terminal-output contract for `setup` / `setup --check` / `setup --remove`:
-//! the advice a human gets, which stream it lands on, and the preview
-//! layout. Host-only fixtures (no toolchains), hermetic runner.
-
-#[path = "common/mod.rs"]
-mod common;
-
-use std::collections::HashMap;
-use std::path::Path;
-
-use socket_patch_core::manifest::schema::{
-    PatchFileInfo, PatchManifest, PatchRecord, VulnerabilityInfo,
-};
-
-const WIRED_PACKAGE_JSON: &str = "{\"name\":\"root\",\"version\":\"1.0.0\",\"scripts\":{\"postinstall\":\"npx @socketsecurity/socket-patch apply --silent --ecosystems npm\",\"dependencies\":\"npx @socketsecurity/socket-patch apply --silent --ecosystems npm\"}}";
-
-fn write(path: &Path, content: &str) {
-    if let Some(parent) = path.parent() {
-        std::fs::create_dir_all(parent).unwrap();
-    }
-    std::fs::write(path, content).unwrap();
-}
-
-fn run(cwd: &Path, args: &[&str]) -> (i32, String, String) {
-    common::run_with_env(cwd, args, &[("SOCKET_TELEMETRY_DISABLED", "1")])
-}
-
-/// Hooks wired, but the installed minimist file matches neither hash.
-fn drifted_patch_fixture(cwd: &Path) {
-    write(&cwd.join("package.json"), WIRED_PACKAGE_JSON);
-    let pkg = cwd.join("node_modules/minimist");
-    write(
-        &pkg.join("package.json"),
-        r#"{"name":"minimist","version":"1.2.5"}"#,
-    );
-    write(&pkg.join("index.js"), "locally edited\n");
-    let mut files = HashMap::new();
-    files.insert(
-        "package/index.js".to_string(),
-        PatchFileInfo {
-            before_hash: "a".repeat(64),
-            after_hash: "b".repeat(64),
-        },
-    );
-    let mut vulns = HashMap::new();
-    vulns.insert(
-        "GHSA-xvch-5gv4-984h".to_string(),
-        VulnerabilityInfo {
-            cves: vec!["CVE-2021-44906".to_string()],
-            summary: "s".to_string(),
-            severity: "critical".to_string(),
-            description: "d".to_string(),
-        },
-    );
-    let mut m = PatchManifest::new();
-    m.patches.insert(
-        "pkg:npm/minimist@1.2.5".to_string(),
-        PatchRecord {
-            uuid: "11111111-1111-4111-8111-111111111111".to_string(),
-            exported_at: "2024-01-01T00:00:00Z".to_string(),
-            files,
-            vulnerabilities: vulns,
-            description: "p".to_string(),
-            license: "MIT".to_string(),
-            tier: "free".to_string(),
-        },
-    );
-    write(
-        &cwd.join(".socket/manifest.json"),
-        &serde_json::to_string_pretty(&m).unwrap(),
-    );
-}
-
-#[test]
-fn check_drifted_patch_points_at_apply_not_setup() {
-    let tmp = tempfile::tempdir().unwrap();
-    drifted_patch_fixture(tmp.path());
-
-    let (code, stdout, stderr) = run(tmp.path(), &["setup", "--check"]);
-    assert_eq!(code, 1, "stdout=\n{stdout}\nstderr=\n{stderr}");
-    assert!(
-        stdout.contains("  ✓ package.json (configured)"),
-        "stdout=\n{stdout}"
-    );
-    assert!(
-        stdout.contains("  ✗ pkg:npm/minimist@1.2.5: patch not applied on disk (hash_mismatch)"),
-        "stdout=\n{stdout}"
-    );
-    assert!(
-        stdout.trim_end().ends_with(
-            "1 patch is not applied on disk. Run `socket-patch apply` to re-apply the patches."
-        ),
-        "stdout=\n{stdout}"
-    );
-    assert!(
-        !stdout.contains("socket-patch setup` to"),
-        "setup cannot fix drift; stdout=\n{stdout}"
-    );
-    assert!(!stdout.contains("(s)"), "stdout=\n{stdout}");
-    // The progress line is a transient status line: nothing on a
-    // non-terminal stderr, never on stdout.
-    assert!(!stderr.contains("Searching for"), "stderr=\n{stderr}");
-    assert!(!stdout.contains("Searching for"), "stdout=\n{stdout}");
-}
-
-#[test]
-fn check_invalid_json_keeps_parser_detail_and_advice() {
-    let tmp = tempfile::tempdir().unwrap();
-    write(&tmp.path().join("package.json"), "{");
-    let (code, stdout, _) = run(tmp.path(), &["setup", "--check"]);
-    assert_eq!(code, 1, "stdout=\n{stdout}");
-    assert!(
-        stdout.contains("  ! package.json: Invalid package.json: EOF while parsing"),
-        "stdout=\n{stdout}"
-    );
-    assert!(
-        stdout
-            .trim_end()
-            .ends_with("1 error. Fix the errors above, then re-run `socket-patch setup --check`."),
-        "stdout=\n{stdout}"
-    );
-}
-
-#[test]
-fn setup_preview_errors_name_the_file() {
-    let tmp = tempfile::tempdir().unwrap();
-    write(
-        &tmp.path().join("package.json"),
-        r#"{ "name": "root", "workspaces": ["packages/*"] }"#,
-    );
-    write(&tmp.path().join("packages/bad/package.json"), "{");
-    let (code, stdout, _) = run(tmp.path(), &["setup", "--dry-run"]);
-    assert_eq!(code, 1, "stdout=\n{stdout}");
-    let norm = stdout.replace('\\', "/");
-    assert!(
-        norm.contains("\nErrors:\n  ! packages/bad/package.json: Invalid package.json: "),
-        "stdout=\n{stdout}"
-    );
-    assert!(
-        !stdout.contains("\n\n\n"),
-        "no double blank lines: {stdout:?}"
-    );
-
-    let (_, _, stderr) = run(tmp.path(), &["setup", "--dry-run", "--silent"]);
-    let norm = stderr.replace('\\', "/");
-    assert!(
-        norm.contains("Error: packages/bad/package.json: Invalid package.json: "),
-        "stderr=\n{stderr}"
-    );
-}
-
-#[test]
-fn unsupported_ecosystem_filter_says_so() {
-    let tmp = tempfile::tempdir().unwrap();
-    write(&tmp.path().join("package.json"), WIRED_PACKAGE_JSON);
-    for args in [
-        &["setup", "-e", "cargo"][..],
-        &["setup", "--check", "-e", "cargo"],
-    ] {
-        let (code, stdout, _) = run(tmp.path(), args);
-        assert_eq!(code, 0, "{args:?}: stdout=\n{stdout}");
-        assert_eq!(
-            stdout.trim_end(),
-            "Setup has no install hook for: cargo (supported: npm, pypi, gem, composer)",
-            "{args:?}"
-        );
-    }
-    let empty = tempfile::tempdir().unwrap();
-    let (_, stdout, _) = run(empty.path(), &["setup", "-e", "npm"]);
-    assert_eq!(stdout.trim_end(), "No package.json project found");
-}
-
-#[test]
-fn unmatched_exclude_warns() {
-    let tmp = tempfile::tempdir().unwrap();
-    write(
-        &tmp.path().join("package.json"),
-        r#"{ "name": "root", "version": "1.0.0", "workspaces": ["packages/*"] }"#,
-    );
-    write(
-        &tmp.path().join("packages/b/package.json"),
-        r#"{ "name": "b", "version": "1.0.0" }"#,
-    );
-    let (code, _, stderr) = run(
-        tmp.path(),
-        &["setup", "--dry-run", "--exclude", "packages/b, nope"],
-    );
-    assert_eq!(code, 0, "stderr=\n{stderr}");
-    assert!(
-        stderr.contains("Warning: --exclude \"nope\" matched no workspace member"),
-        "stderr=\n{stderr}"
-    );
-    assert!(
-        !stderr.contains("\"packages/b\" matched"),
-        "stderr=\n{stderr}"
-    );
-
-    let (_, _, stderr) = run(
-        tmp.path(),
-        &["setup", "--dry-run", "--silent", "--exclude", "nope"],
-    );
-    assert!(stderr.is_empty(), "--silent mutes warnings: {stderr}");
-}
-
-#[test]
-fn already_configured_run_prints_one_verdict() {
-    let tmp = tempfile::tempdir().unwrap();
-    write(&tmp.path().join("package.json"), WIRED_PACKAGE_JSON);
-    let (code, stdout, stderr) = run(tmp.path(), &["setup", "--yes"]);
-    assert_eq!(code, 0);
-    assert_eq!(
-        stdout.trim(),
-        "All install hooks are already configured with socket-patch!"
-    );
-    // The progress line is transient: nothing on a non-terminal stderr.
-    assert_eq!(stderr, "");
-}
-
-#[test]
-fn remove_dry_run_layout() {
-    let tmp = tempfile::tempdir().unwrap();
-    write(&tmp.path().join("package.json"), WIRED_PACKAGE_JSON);
-    let (code, stdout, _) = run(tmp.path(), &["setup", "--remove", "--dry-run"]);
-    assert_eq!(code, 0, "stdout=\n{stdout}");
-    assert!(
-        !stdout.contains("\n\n\n"),
-        "no double blank lines: {stdout:?}"
-    );
-    assert!(
-        stdout.ends_with(
-            "    -> dependencies: (removed)\n\nSummary (dry run):\n  1 item would have \
-             socket-patch removed\n"
-        ),
-        "{stdout:?}"
-    );
-}
-
-#[test]
-fn vlt_preview_shows_the_npx_hook_and_the_advisory_on_stderr() {
-    let tmp = tempfile::tempdir().unwrap();
-    write(
-        &tmp.path().join("package.json"),
-        "{\n  \"name\": \"root\"\n}\n",
-    );
-    write(
-        &tmp.path().join("vlt-lock.json"),
-        "{\"lockfileVersion\":0,\"nodes\":{},\"edges\":{}}\n",
-    );
-    let empty_path = tempfile::tempdir().unwrap();
-    let (code, stdout, stderr) = common::run_with_env(
-        tmp.path(),
-        &["setup", "--dry-run"],
-        &[
-            ("SOCKET_TELEMETRY_DISABLED", "1"),
-            ("PATH", empty_path.path().to_str().unwrap()),
-        ],
-    );
-    assert_eq!(code, 0, "stdout=\n{stdout}\nstderr=\n{stderr}");
-    assert!(
-        stdout.contains(
-            "  + package.json\n    -> postinstall: \"npx @socketsecurity/socket-patch apply \
-             --silent --ecosystems npm\"\n"
-        ),
-        "{stdout:?}"
-    );
-    assert_eq!(
-        stderr,
-        "Warning (vlt_root_scripts_not_run): vlt before 1.0.0-rc.13 does not run the root \
-         postinstall hook; upgrade vlt or run `socket-patch apply` after `vlt ci` \
-         (vlt-lock.json has lockfileVersion 0, so this project may be installed by such a \
-         vlt)\n"
-    );
-}
diff --git a/crates/socket-patch-cli/tests/vex_terminal_output.rs b/crates/socket-patch-cli/tests/vex_terminal_output.rs
index 5e772f91..f9a6a020 100644
--- a/crates/socket-patch-cli/tests/vex_terminal_output.rs
+++ b/crates/socket-patch-cli/tests/vex_terminal_output.rs
@@ -10,7 +10,7 @@ use std::process::{Command, Output};
 
 use serde_json::Value;
 use socket_patch_core::manifest::schema::{
-    PatchFileInfo, PatchManifest, PatchRecord, SetupConfig, VulnerabilityInfo,
+    PatchFileInfo, PatchManifest, PatchRecord, VulnerabilityInfo,
 };
 
 const STALE_OPENVEX_DOC: &str = r#"{"@context":"https://openvex.dev/ns/v0.2.0","@id":"urn:uuid:stale","author":"Socket","timestamp":"2020-01-01T00:00:00Z","version":1,"statements":[]}"#;
@@ -56,10 +56,8 @@ fn record(uuid: &str, ghsa: &str) -> PatchRecord {
     }
 }
 
-/// A manifest with `purls` (each with a distinct GHSA). `manual` declares
-/// npm so the property-7 setup filter keeps the patches; `None` leaves the
-/// ecosystem un-set-up.
-fn write_manifest(cwd: &Path, purls: &[&str], manual: bool) {
+/// A manifest with `purls` (each with a distinct GHSA).
+fn write_manifest(cwd: &Path, purls: &[&str]) {
     let mut m = PatchManifest::new();
     for (i, purl) in purls.iter().enumerate() {
         m.patches.insert(
@@ -70,12 +68,6 @@ fn write_manifest(cwd: &Path, purls: &[&str], manual: bool) {
             ),
         );
     }
-    if manual {
-        m.setup = Some(SetupConfig {
-            exclude: Vec::new(),
-            manual: vec!["npm".to_string()],
-        });
-    }
     let dir = cwd.join(".socket");
     std::fs::create_dir_all(&dir).unwrap();
     std::fs::write(
@@ -112,7 +104,7 @@ fn stdout(o: &Output) -> String {
 fn dry_run_with_output_writes_nothing_and_says_so() {
     let tmp = tempfile::tempdir().unwrap();
     let cwd = tmp.path();
-    write_manifest(cwd, &["pkg:npm/a@1.0.0"], true);
+    write_manifest(cwd, &["pkg:npm/a@1.0.0"]);
     let out_path = cwd.join("d.json");
 
     let o = vex(
@@ -150,7 +142,7 @@ fn dry_run_failure_keeps_previous_document() {
     let tmp = tempfile::tempdir().unwrap();
     let cwd = tmp.path();
     // Verify mode with nothing installed: nothing attests.
-    write_manifest(cwd, &["pkg:npm/a@1.0.0"], true);
+    write_manifest(cwd, &["pkg:npm/a@1.0.0"]);
     let out_path = cwd.join("keep.json");
     std::fs::write(&out_path, STALE_OPENVEX_DOC).unwrap();
 
@@ -164,7 +156,7 @@ fn dry_run_failure_keeps_previous_document() {
 fn output_dash_means_stdout() {
     let tmp = tempfile::tempdir().unwrap();
     let cwd = tmp.path();
-    write_manifest(cwd, &["pkg:npm/a@1.0.0"], true);
+    write_manifest(cwd, &["pkg:npm/a@1.0.0"]);
 
     let o = vex(cwd, &["--no-verify", "-O", "-"]);
     assert_eq!(o.status.code(), Some(0), "{}", stderr(&o));
@@ -184,7 +176,7 @@ fn output_dash_means_stdout() {
 fn written_document_ends_with_newline_and_summary_is_singular() {
     let tmp = tempfile::tempdir().unwrap();
     let cwd = tmp.path();
-    write_manifest(cwd, &["pkg:npm/a@1.0.0"], true);
+    write_manifest(cwd, &["pkg:npm/a@1.0.0"]);
     let out_path = cwd.join("out.json");
 
     let o = vex(cwd, &["--no-verify", "-O", out_path.to_str().unwrap()]);
@@ -208,7 +200,7 @@ fn written_document_ends_with_newline_and_summary_is_singular() {
 fn failed_run_reports_stale_document_removal() {
     let tmp = tempfile::tempdir().unwrap();
     let cwd = tmp.path();
-    write_manifest(cwd, &["pkg:npm/a@1.0.0"], true);
+    write_manifest(cwd, &["pkg:npm/a@1.0.0"]);
     let out_path = cwd.join("keep.json");
     std::fs::write(&out_path, STALE_OPENVEX_DOC).unwrap();
 
@@ -254,7 +246,7 @@ fn omissions_are_sorted_and_listed_once() {
         "pkg:npm/alpha@1.0.0",
         "pkg:npm/mid@1.0.0",
     ];
-    write_manifest(cwd, &purls, true);
+    write_manifest(cwd, &purls);
 
     let o = vex(cwd, &[]);
     assert_eq!(o.status.code(), Some(1), "{}", stderr(&o));
@@ -308,34 +300,26 @@ fn omissions_are_sorted_and_listed_once() {
 }
 
 #[test]
-fn all_setup_drops_skip_the_generic_note() {
+fn trusted_patch_attests_without_setup_config() {
     let tmp = tempfile::tempdir().unwrap();
     let cwd = tmp.path();
-    // No `manual`, no hook: property 7 drops the (trusted) patch.
-    write_manifest(cwd, &["pkg:npm/a@1.0.0"], false);
+    // No manifest `setup` section and no install hook: the trusted patch
+    // still attests, with no omission warning.
+    write_manifest(cwd, &["pkg:npm/a@1.0.0"]);
 
     let o = vex(cwd, &["--no-verify"]);
-    assert_eq!(o.status.code(), Some(1), "{}", stderr(&o));
     let err = stderr(&o);
-    assert!(!err.contains("Note:"), "{err}");
-    let lines: Vec<&str> = err.lines().collect();
-    assert_eq!(lines.len(), 2, "{err}");
-    assert!(lines[0].starts_with("Warning: omitting pkg:npm/a@1.0.0 from VEX: applied, but"));
-    assert!(lines[0].ends_with("(ecosystem_not_setup)"), "{err}");
-    assert!(
-        lines[1].starts_with(
-            "Error: 1 applied patch with vulnerability metadata was omitted from VEX because \
-             its ecosystem is not set up"
-        ),
-        "{err}"
-    );
+    assert_eq!(o.status.code(), Some(0), "{err}");
+    assert!(!err.contains("omitting"), "{err}");
+    let doc: Value = serde_json::from_slice(&o.stdout).expect("OpenVEX doc on stdout");
+    assert_eq!(doc["statements"].as_array().unwrap().len(), 1, "{doc}");
 }
 
 #[test]
 fn org_that_looks_like_a_file_warns() {
     let tmp = tempfile::tempdir().unwrap();
     let cwd = tmp.path();
-    write_manifest(cwd, &["pkg:npm/a@1.0.0"], true);
+    write_manifest(cwd, &["pkg:npm/a@1.0.0"]);
 
     let o = vex(cwd, &["--no-verify", "-o", "out.json"]);
     assert_eq!(o.status.code(), Some(0), "{}", stderr(&o));
@@ -401,7 +385,7 @@ fn corrupt_manifest_error_names_the_file() {
 fn product_undetected_names_the_unusable_manifest() {
     let tmp = tempfile::tempdir().unwrap();
     let cwd = tmp.path();
-    write_manifest(cwd, &["pkg:npm/a@1.0.0"], true);
+    write_manifest(cwd, &["pkg:npm/a@1.0.0"]);
     std::fs::write(cwd.join("package.json"), r#"{"name":"app"}"#).unwrap();
     let o = cli()
         .args(["vex", "--no-verify", "--cwd", cwd.to_str().unwrap()])
diff --git a/crates/socket-patch-cli/tests/vlt-leg-manifest.json b/crates/socket-patch-cli/tests/vlt-leg-manifest.json
index 2248dd1e..6b46a002 100644
--- a/crates/socket-patch-cli/tests/vlt-leg-manifest.json
+++ b/crates/socket-patch-cli/tests/vlt-leg-manifest.json
@@ -122,14 +122,6 @@
         "persistence_survives",
         "persistence_reverted_by_reinstall",
         "reruns_and_vex"
-      ],
-      "setup": [
-        "hook_fires_per_reify",
-        "root_scripts_advisory",
-        "workspace_root_only",
-        "twice_no_duplicate",
-        "hook_failure",
-        "hook_abort_leaves_no_staging"
       ]
     },
     "e2e_hosted_production": {
@@ -257,14 +249,6 @@
       "persistence_reverted_by_reinstall",
       "reruns_and_vex"
     ],
-    "setup": [
-      "hook_fires_per_reify",
-      "root_scripts_advisory",
-      "workspace_root_only",
-      "twice_no_duplicate",
-      "hook_failure",
-      "hook_abort_leaves_no_staging"
-    ],
     "production": [
       "hosted_install_proof",
       "vendored_install_proof"
@@ -891,55 +875,6 @@
       },
       "conditions": [],
       "reason": "non-hermetic-registry"
-    },
-    {
-      "boundary": "root `pre*`/`post*` scripts run without an `install` script",
-      "suite": "setup",
-      "legs": [
-        "hook_fires_per_reify",
-        "workspace_root_only",
-        "hook_failure"
-      ],
-      "except": [],
-      "versions": {
-        "op": "<",
-        "a": "1.0.0-rc.13"
-      },
-      "conditions": [],
-      "reason": "root-postinstall-not-run"
-    },
-    {
-      "boundary": "a failing hook's abort on Windows (rollback EBUSY fix from 1.0.5)",
-      "suite": "setup",
-      "legs": [
-        "hook_abort_leaves_no_staging"
-      ],
-      "except": [],
-      "versions": {
-        "op": "all"
-      },
-      "conditions": [
-        {
-          "key": "os",
-          "op": "!=",
-          "value": "windows"
-        }
-      ],
-      "reason": "windows-only"
-    },
-    {
-      "boundary": "as above",
-      "suite": "setup",
-      "legs": [
-        "hook_abort_leaves_no_staging"
-      ],
-      "except": [],
-      "versions": {
-        "op": "<",
-        "a": "1.0.5"
-      },
-      "conditions": [],
-      "reason": "pre-ebusy-fix"
     }
   ],
   "supported": [
diff --git a/crates/socket-patch-cli/tests/vlt_e2e_common/fixture.rs b/crates/socket-patch-cli/tests/vlt_e2e_common/fixture.rs
index df11effa..48e79a88 100644
--- a/crates/socket-patch-cli/tests/vlt_e2e_common/fixture.rs
+++ b/crates/socket-patch-cli/tests/vlt_e2e_common/fixture.rs
@@ -29,7 +29,7 @@ pub const OPTIONAL_KEPT: &str = "socket-patch does not remove them because `vlt
      project that declares only optional dependencies, so there both commands remove the \
      installed copy: upgrade vlt to 1.0.5 or later first.";
 pub const VLT_UPDATE_NOTE: &str =
-    " Note: `vlt update` re-resolves from the registry and drops these redirects.";
+    " Note: `vlt update` re-resolves from the registry and drops these hosted patches.";
 
 pub fn invalidated_head(n: usize) -> String {
     format!(
diff --git a/crates/socket-patch-cli/tests/vlt_hosted_common/mod.rs b/crates/socket-patch-cli/tests/vlt_hosted_common/mod.rs
index b41fbd77..d4bae046 100644
--- a/crates/socket-patch-cli/tests/vlt_hosted_common/mod.rs
+++ b/crates/socket-patch-cli/tests/vlt_hosted_common/mod.rs
@@ -39,14 +39,14 @@ pub const UNVERIFIABLE: &str = "redirect_vlt_artifact_unverifiable";
 
 pub const ADVISORY_NOTHING_STALE: &str = "vlt-lock.json pins Socket-patched packages; fresh \
      checkouts install them with `vlt ci` or `vlt install --frozen-lockfile`. Note: `vlt update` \
-     re-resolves from the registry and drops these redirects.";
+     re-resolves from the registry and drops these hosted patches.";
 
 pub fn advisory_invalidated(n: usize) -> String {
     format!(
         "vlt-lock.json pins Socket-patched packages; socket-patch removed {n} stale installed \
          copies (node_modules/.vlt-lock.json and node_modules/.vlt entries), so node_modules is \
          incomplete until you run `vlt install` (or `vlt ci`), which installs the patched \
-         packages. Note: `vlt update` re-resolves from the registry and drops these redirects."
+         packages. Note: `vlt update` re-resolves from the registry and drops these hosted patches."
     )
 }
 
diff --git a/crates/socket-patch-core/src/constants.rs b/crates/socket-patch-core/src/constants.rs
index 18287b85..69a31ecf 100644
--- a/crates/socket-patch-core/src/constants.rs
+++ b/crates/socket-patch-core/src/constants.rs
@@ -105,8 +105,4 @@ pub mod npm_family {
     pub const VLT_STORE_DIR: &str = "node_modules/.vlt";
     /// Workspace globs of vlt <= 0.0.0-12 (`{"packages": ...}`).
     pub const VLT_LEGACY_WORKSPACES: &str = "vlt-workspaces.json";
-    /// Any one in the cwd makes setup treat the project as vlt's
-    /// (`VLT_STORE_DIR` only as a directory).
-    pub const VLT_SETUP_MARKERS: [&str; 4] =
-        [VLT_LOCK, VLT_CONFIG, VLT_HIDDEN_LOCK_REL, VLT_STORE_DIR];
 }
diff --git a/crates/socket-patch-core/src/crawlers/npm_crawler.rs b/crates/socket-patch-core/src/crawlers/npm_crawler.rs
index 348c6377..146e53a9 100644
--- a/crates/socket-patch-core/src/crawlers/npm_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/npm_crawler.rs
@@ -65,7 +65,7 @@ fn parse_package_json_identity(content: &str) -> Option<(String, String)> {
     // (Windows-authored packages ship them), but serde_json rejects it —
     // a BOM'd install would be invisible to scan and unpatchable.
     let pkg: PackageJsonPartial =
-        serde_json::from_str(crate::package_json::detect::strip_bom(content)).ok()?;
+        serde_json::from_str(crate::utils::serde::strip_bom(content)).ok()?;
     let name = pkg.name?;
     let version = pkg.version?;
     if name.is_empty() || version.is_empty() {
@@ -760,7 +760,7 @@ impl NpmCrawler {
     /// later restore) all of them: patching only one leaves a live,
     /// vulnerable copy while reporting success (a silent partial). The
     /// per-PURL `Vec` is ordered root-copy-first (breadth-first), so callers
-    /// that only need one representative (`vendor`, `vex`, `setup`) can take
+    /// that only need one representative (`vendor`, `vex`) can take
     /// the first and get the root copy.
     ///
     /// pnpm's and vlt's store peer-variant copies are deliberately NOT
diff --git a/crates/socket-patch-core/src/crawlers/ruby_crawler.rs b/crates/socket-patch-core/src/crawlers/ruby_crawler.rs
index 383018e3..8c2a1744 100644
--- a/crates/socket-patch-core/src/crawlers/ruby_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/ruby_crawler.rs
@@ -211,13 +211,9 @@ impl RubyCrawler {
     ///
     /// Bundler accepts two spellings of the pair — the usual
     /// `Gemfile`/`Gemfile.lock` and the alternate `gems.rb`/`gems.locked`
-    /// (`Bundler::SharedHelpers.default_gemfile`). Both count: the project
-    /// gate must recognize every project `setup` can wire, and
-    /// `setup::gem::discover_bundler_project` already walks up for `gems.rb`.
-    /// Gating on `Gemfile` alone left a `gems.rb` project with a
-    /// non-deployment `bundle install` undiscoverable — the bundler plugin
-    /// `setup` installs would run `apply` on every `bundle install` and
-    /// silently find zero gems.
+    /// (`Bundler::SharedHelpers.default_gemfile`). Both count: gating on
+    /// `Gemfile` alone left a `gems.rb` project with a non-deployment
+    /// `bundle install` undiscoverable, so `apply` silently found zero gems.
     async fn has_bundler_manifest(cwd: &Path) -> bool {
         for name in ["Gemfile", "Gemfile.lock", "gems.rb", "gems.locked"] {
             if tokio::fs::metadata(cwd.join(name)).await.is_ok() {
@@ -447,9 +443,9 @@ impl RubyCrawler {
     /// The `BUNDLE_PATH` recorded in bundler's app config file — the value
     /// `bundle config set --local path <dir>` writes. The file lives at
     /// `$BUNDLE_APP_CONFIG/config`, else `<cwd>/.bundle/config`, resolved by
-    /// the shared [`crate::setup::gem::bundler_app_config_dir`] rule.
+    /// the shared [`bundler_app_config_dir`] rule.
     async fn app_config_bundle_path(cwd: &Path, app_config_env: Option<&OsStr>) -> Option<String> {
-        let config = crate::setup::gem::bundler_app_config_dir(cwd, app_config_env).join("config");
+        let config = bundler_app_config_dir(cwd, app_config_env).join("config");
         // The config lives inside the (untrusted) project tree: a planted
         // FIFO would make a plain `read_to_string` open block forever
         // waiting for a writer, wedging scan (crawl_all) and apply/get
@@ -948,11 +944,29 @@ fn expand_tilde(value: &Path, home: Option<&Path>) -> PathBuf {
     value.to_path_buf()
 }
 
+/// Bundler's app-config dir for `root`, following `Bundler.app_config_path`
+/// exactly: `$BUNDLE_APP_CONFIG` when set (a relative value resolves against
+/// the project root, NOT the process cwd), else `<root>/.bundle` — e.g. the
+/// official ruby Docker images export `BUNDLE_APP_CONFIG=/usr/local/bundle`.
+fn bundler_app_config_dir(root: &Path, env_value: Option<&OsStr>) -> PathBuf {
+    match env_value {
+        Some(v) if !v.is_empty() => {
+            let p = PathBuf::from(v);
+            if p.is_absolute() {
+                p
+            } else {
+                root.join(p)
+            }
+        }
+        _ => root.join(".bundle"),
+    }
+}
+
 /// Resolve a trusted (ENV-sourced) `BUNDLE_PATH` value against the project
 /// root. Bundler `File.expand_path`s the value: a leading `~` expands to
 /// the user's home, and a relative path resolves against the directory of
 /// the Gemfile (`Bundler.root`), not the process cwd — the same rule
-/// [`crate::setup::gem::bundler_app_config_dir`] follows for
+/// [`bundler_app_config_dir`] follows for
 /// `BUNDLE_APP_CONFIG`. `.`/`..` segments are folded lexically so the same
 /// physical root spelled two ways dedups to one probe; a value that pops
 /// above its own root keeps its unnormalized spelling (it is only ever
@@ -980,8 +994,7 @@ fn resolve_bundle_path(root: &Path, value: &Path, home: Option<&Path>) -> PathBu
 /// writes outside the project. Policy: after `~` expansion and lexical
 /// `.`/`..` normalization, the root must stay contained in the project
 /// root — the same containment posture as the composer crawler's
-/// `install-path` guard and the gem plugin-index cleanup in
-/// `setup/gem/mod.rs`. Out-of-tree bundle paths stay reachable via the
+/// `install-path` guard. Out-of-tree bundle paths stay reachable via the
 /// trusted env `BUNDLE_PATH`.
 fn resolve_config_bundle_path(
     project_root: &Path,
diff --git a/crates/socket-patch-core/src/lib.rs b/crates/socket-patch-core/src/lib.rs
index 01ed5652..bb42fcfc 100644
--- a/crates/socket-patch-core/src/lib.rs
+++ b/crates/socket-patch-core/src/lib.rs
@@ -4,19 +4,10 @@ pub mod crawlers;
 pub mod formats;
 pub mod hash;
 pub mod manifest;
-pub mod package_json;
 pub mod patch;
-pub mod setup;
 pub mod telemetry;
 pub mod update;
 pub mod utils;
 pub mod vendor;
 pub mod vex;
 
-// Moved modules — these aliases keep the old top-level paths compiling for
-// external consumers of the published crate. Internal code must import the
-// canonical `setup::*` paths; CI greps reject new uses of the old ones.
-// Drop these aliases at 5.0.
-pub use setup::composer as composer_setup;
-pub use setup::gem as gem_setup;
-pub use setup::pypi as pth_hook;
diff --git a/crates/socket-patch-core/src/manifest/schema.rs b/crates/socket-patch-core/src/manifest/schema.rs
index 9dd8f04e..7fd487e0 100644
--- a/crates/socket-patch-core/src/manifest/schema.rs
+++ b/crates/socket-patch-core/src/manifest/schema.rs
@@ -36,20 +36,18 @@ pub struct PatchRecord {
     pub tier: String,
 }
 
-/// Persisted `setup` configuration (CLI_CONTRACT property 9). Lives under the
-/// manifest's `setup` key so a fresh clone's `setup` / `setup --check` honors it
-/// without re-passing flags.
+/// Legacy `setup` configuration, written by the `setup` command that v5
+/// removed. Still parsed and kept on rewrite (so a v4 manifest round-trips
+/// byte-stably) but read by nothing.
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq, Default)]
 #[serde(rename_all = "camelCase")]
 pub struct SetupConfig {
     /// Workspace-member paths (relative to the repo root, forward-slashed) that
-    /// `setup` must NOT configure — and `setup --check` must not flag as
-    /// needing configuration.
+    /// the removed `setup` skipped.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub exclude: Vec<String>,
-    /// Ecosystems (by `Ecosystem::cli_name`, e.g. `"pypi"`) the user runs
-    /// `socket-patch apply` for by hand, so their patches are still attested in
-    /// VEX even though no auto-install hook is wired (CLI_CONTRACT property 7).
+    /// Ecosystems (by `Ecosystem::cli_name`, e.g. `"pypi"`) the pre-v5 `vex`
+    /// attested with no install hook wired.
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
     pub manual: Vec<String>,
 }
@@ -78,7 +76,7 @@ pub struct PatchManifest {
     /// Maps package PURL (e.g., "pkg:npm/lodash@4.17.21") -> patch record.
     #[serde(serialize_with = "serialize_sorted")]
     pub patches: HashMap<String, PatchRecord>,
-    /// Optional persisted `setup` state (e.g. excluded workspace members).
+    /// Optional legacy `setup` state (see [`SetupConfig`]).
     /// Absent on manifests that predate / don't use it (serde default), and
     /// omitted from the serialized form when empty so existing manifests are
     /// byte-stable.
diff --git a/crates/socket-patch-core/src/package_json/detect.rs b/crates/socket-patch-core/src/package_json/detect.rs
deleted file mode 100644
index 782d01e6..00000000
--- a/crates/socket-patch-core/src/package_json/detect.rs
+++ /dev/null
@@ -1,1266 +0,0 @@
-use crate::vendor::common::JsonLayout;
-
-/// Package manager type for selecting the correct command prefix.
-#[derive(Debug, Clone, Copy, PartialEq)]
-pub enum PackageManager {
-    Npm,
-    Pnpm,
-    Vlt,
-}
-
-/// Get the socket-patch apply command for the given package manager.
-/// vlt gets npm's `npx` hook: npx ships with every vlt install (vlt is
-/// distributed through npm), while `vlx`'s argument parsing changed at
-/// 1.0.0-rc.28 in a way that breaks either spelling on one side.
-fn socket_patch_command(pm: PackageManager) -> &'static str {
-    match pm {
-        PackageManager::Npm | PackageManager::Vlt => {
-            "npx @socketsecurity/socket-patch apply --silent --ecosystems npm"
-        }
-        PackageManager::Pnpm => {
-            "pnpm dlx @socketsecurity/socket-patch apply --silent --ecosystems npm"
-        }
-    }
-}
-
-/// Legacy command patterns to detect existing configurations.
-const LEGACY_PATCH_PATTERNS: &[&str] = &[
-    "socket-patch apply",
-    "npx @socketsecurity/socket-patch apply",
-    "socket patch apply",
-];
-
-/// Check if a script string contains any known socket-patch apply pattern.
-fn script_is_configured(script: &str) -> bool {
-    LEGACY_PATCH_PATTERNS
-        .iter()
-        .any(|pattern| script.contains(pattern))
-}
-
-/// Status of setup script configuration (both postinstall and dependencies).
-#[derive(Debug, Clone)]
-pub struct ScriptSetupStatus {
-    pub postinstall_configured: bool,
-    pub postinstall_script: String,
-    pub dependencies_configured: bool,
-    pub dependencies_script: String,
-    pub needs_update: bool,
-}
-
-/// Read `scripts.<key>` as a string, treating absent or non-string as empty.
-fn read_script(package_json: &serde_json::Value, key: &str) -> String {
-    package_json
-        .get("scripts")
-        .and_then(|s| s.get(key))
-        .and_then(|v| v.as_str())
-        .unwrap_or("")
-        .to_string()
-}
-
-/// Check if package.json scripts are properly configured for socket-patch.
-/// Checks both the postinstall and dependencies lifecycle scripts.
-fn is_setup_configured(package_json: &serde_json::Value) -> ScriptSetupStatus {
-    let postinstall_script = read_script(package_json, "postinstall");
-    let postinstall_configured = script_is_configured(&postinstall_script);
-
-    let dependencies_script = read_script(package_json, "dependencies");
-    let dependencies_configured = script_is_configured(&dependencies_script);
-
-    ScriptSetupStatus {
-        postinstall_configured,
-        postinstall_script,
-        dependencies_configured,
-        dependencies_script,
-        needs_update: !postinstall_configured || !dependencies_configured,
-    }
-}
-
-/// Strip a leading UTF-8 BOM. npm and Node tolerate (and strip) a BOM in
-/// package.json, and cargo accepts one in Cargo.toml — files saved by Windows
-/// editors commonly carry one — but serde_json (and vex's TOML line scanner)
-/// reject it, so every parse of user-supplied manifest content must go through
-/// this first or toolchain-valid manifests error out. Also used by
-/// `vex::product`.
-pub(crate) fn strip_bom(content: &str) -> &str {
-    content.strip_prefix('\u{feff}').unwrap_or(content)
-}
-
-/// Check if a package.json content string is properly configured.
-pub fn is_setup_configured_str(content: &str) -> ScriptSetupStatus {
-    match serde_json::from_str::<serde_json::Value>(strip_bom(content)) {
-        Ok(val) => is_setup_configured(&val),
-        Err(_) => ScriptSetupStatus {
-            postinstall_configured: false,
-            postinstall_script: String::new(),
-            dependencies_configured: false,
-            dependencies_script: String::new(),
-            needs_update: true,
-        },
-    }
-}
-
-/// Generate an updated script that includes the socket-patch apply command.
-/// If already configured, returns unchanged. Otherwise prepends the command.
-fn generate_updated_script(current_script: &str, pm: PackageManager) -> String {
-    let command = socket_patch_command(pm);
-    let trimmed = current_script.trim();
-
-    // If empty, just add the socket-patch command.
-    if trimmed.is_empty() {
-        return command.to_string();
-    }
-
-    // If any socket-patch variant is already present, return unchanged.
-    if script_is_configured(trimmed) {
-        return trimmed.to_string();
-    }
-
-    // Prepend socket-patch command so it runs first.
-    format!("{command} && {trimmed}")
-}
-
-/// Update a package.json Value with socket-patch in both postinstall and
-/// dependencies scripts.
-/// Returns (modified, new_postinstall, new_dependencies).
-fn update_package_json_object(
-    package_json: &mut serde_json::Value,
-    pm: PackageManager,
-) -> (bool, String, String) {
-    let status = is_setup_configured(package_json);
-
-    if !status.needs_update {
-        return (false, status.postinstall_script, status.dependencies_script);
-    }
-
-    // We can only attach scripts to an object root. Anything else (array,
-    // string, number, bool, null) cannot hold a "scripts" key, so indexing it
-    // below would panic. Bail out as a no-op instead.
-    if !package_json.is_object() {
-        return (false, status.postinstall_script, status.dependencies_script);
-    }
-
-    // Ensure `scripts` exists *and* is an object. A present-but-non-object
-    // `scripts` (e.g. a string or array) would otherwise panic when indexed.
-    if !package_json
-        .get("scripts")
-        .map(serde_json::Value::is_object)
-        .unwrap_or(false)
-    {
-        package_json["scripts"] = serde_json::json!({});
-    }
-
-    let mut modified = false;
-
-    let new_postinstall = if !status.postinstall_configured {
-        modified = true;
-        let s = generate_updated_script(&status.postinstall_script, pm);
-        package_json["scripts"]["postinstall"] = serde_json::Value::String(s.clone());
-        s
-    } else {
-        status.postinstall_script
-    };
-
-    let new_dependencies = if !status.dependencies_configured {
-        modified = true;
-        let s = generate_updated_script(&status.dependencies_script, pm);
-        package_json["scripts"]["dependencies"] = serde_json::Value::String(s.clone());
-        s
-    } else {
-        status.dependencies_script
-    };
-
-    (modified, new_postinstall, new_dependencies)
-}
-
-/// Strip every socket-patch segment out of a single lifecycle script.
-///
-/// Commands are chained with `&&` (that is exactly how
-/// [`generate_updated_script`] prepends the patch command), so splitting on
-/// that operator and dropping any segment that is a socket-patch invocation
-/// reverses the setup edit, whether the command was added to an empty script
-/// (`"<cmd>"`) or prepended to an existing one (`"<cmd> && build"`).
-///
-/// The split ignores the whitespace around `&&`: a hand-wired
-/// `"socket-patch apply&&npm run build"` is two commands, and treating it as
-/// one patch-containing segment would delete the user's `npm run build` along
-/// with the patch invocation. Surviving segments are kept VERBATIM and
-/// re-joined with the bare `&&` separator they were split on: a `&&` inside
-/// a quoted argument of a surviving user command also splits here, and
-/// canonically respacing it would rewrite the user's bytes
-/// (`grep "a&&b"` → `grep "a && b"` greps a different pattern — not
-/// cosmetic). Only the seams adjacent to REMOVED segments collapse, and the
-/// result's outer edges are trimmed.
-///
-/// Returns `(changed, new_value)`:
-/// - `(false, Some(original))` — no socket-patch segment found; leave as-is.
-/// - `(true, Some(rest))` — patch segment(s) removed, other commands survive.
-/// - `(true, None)` — the script was *only* socket-patch; the key should be
-///   deleted entirely.
-fn remove_socket_patch_from_script(script: &str) -> (bool, Option<String>) {
-    let trimmed = script.trim();
-    if trimmed.is_empty() {
-        return (false, None);
-    }
-
-    let segments: Vec<&str> = trimmed.split("&&").collect();
-
-    // `changed` must reflect whether a *socket-patch* segment was removed — not
-    // whether `kept` is merely shorter than `segments`. Filtering also drops
-    // empty segments, so keying `changed` off `kept.len() != segments.len()`
-    // would falsely report a removal for a patch-free script that merely
-    // contained a stray empty segment (e.g. a double `" && "` separator),
-    // violating this function's documented `(false, ..)`/`(true, ..)` contract.
-    let had_patch = segments.iter().any(|s| script_is_configured(s.trim()));
-
-    if !had_patch {
-        // No socket-patch pattern present — leave the script as-is.
-        return (false, Some(trimmed.to_string()));
-    }
-
-    // Keep surviving segments verbatim (inner spacing, quoted `&&` halves
-    // and all) so the reconstruction reproduces the user's original bytes;
-    // only removed segments and stray empty segments (double separators)
-    // drop out.
-    let kept: Vec<&str> = segments
-        .iter()
-        .copied()
-        .filter(|s| {
-            let t = s.trim();
-            !t.is_empty() && !script_is_configured(t)
-        })
-        .collect();
-
-    if kept.is_empty() {
-        (true, None)
-    } else {
-        (true, Some(kept.join("&&").trim().to_string()))
-    }
-}
-
-/// Status of a remove operation on a single package.json object.
-#[derive(Debug, Clone)]
-pub(crate) struct ScriptRemoveStatus {
-    pub modified: bool,
-    pub old_postinstall: String,
-    pub new_postinstall: Option<String>,
-    pub old_dependencies: String,
-    pub new_dependencies: Option<String>,
-}
-
-/// Remove socket-patch from both lifecycle scripts in a package.json object.
-///
-/// Full revert: an emptied `postinstall`/`dependencies` key is deleted, and if
-/// `scripts` ends up empty the whole `scripts` key is dropped too — undoing
-/// exactly what [`update_package_json_object`] added. Returns a
-/// [`ScriptRemoveStatus`] describing what changed.
-fn remove_package_json_object(package_json: &mut serde_json::Value) -> ScriptRemoveStatus {
-    let old_postinstall = read_script(package_json, "postinstall");
-    let old_dependencies = read_script(package_json, "dependencies");
-
-    // `remove_socket_patch_from_script` reports `changed` only when a
-    // socket-patch segment was actually present and removed.
-    let (pi_changed, new_postinstall) = remove_socket_patch_from_script(&old_postinstall);
-    let (dep_changed, new_dependencies) = remove_socket_patch_from_script(&old_dependencies);
-    let modified = pi_changed || dep_changed;
-
-    if !modified {
-        return ScriptRemoveStatus {
-            modified: false,
-            new_postinstall: Some(old_postinstall.clone()),
-            old_postinstall,
-            new_dependencies: Some(old_dependencies.clone()),
-            old_dependencies,
-        };
-    }
-
-    // We can only mutate scripts on an object root with an object `scripts`.
-    // Anything else has nothing to remove and is handled by the no-op path
-    // above (its scripts read as empty).
-    if let Some(scripts) = package_json
-        .get_mut("scripts")
-        .and_then(|s| s.as_object_mut())
-    {
-        if pi_changed {
-            match &new_postinstall {
-                Some(s) => {
-                    scripts.insert(
-                        "postinstall".to_string(),
-                        serde_json::Value::String(s.clone()),
-                    );
-                }
-                None => {
-                    scripts.remove("postinstall");
-                }
-            }
-        }
-        if dep_changed {
-            match &new_dependencies {
-                Some(s) => {
-                    scripts.insert(
-                        "dependencies".to_string(),
-                        serde_json::Value::String(s.clone()),
-                    );
-                }
-                None => {
-                    scripts.remove("dependencies");
-                }
-            }
-        }
-
-        // If `scripts` is now empty, drop the key entirely for a clean revert.
-        if scripts.is_empty() {
-            if let Some(obj) = package_json.as_object_mut() {
-                obj.remove("scripts");
-            }
-        }
-    }
-
-    ScriptRemoveStatus {
-        modified,
-        old_postinstall,
-        new_postinstall,
-        old_dependencies,
-        new_dependencies,
-    }
-}
-
-/// Re-serialize a package.json in the layout the file already uses.
-///
-/// serde's `to_string_pretty` is hard-wired to 2 spaces and bare `\n`, so a
-/// 4-space or tab-indented manifest came back reformatted top to bottom, and
-/// a Windows one (yarn berry's persistManifest pretty-prints with `os.EOL`)
-/// flipped every CRLF to LF and lost its BOM — turning a two-key edit into a
-/// whole-file diff that `setup --remove` could never undo byte-exactly. The
-/// vendor backends render through [`JsonLayout`] (BOM, indent, line ending,
-/// trailing-newline shape); reuse it so `setup` touches only the lines it
-/// means to.
-fn serialize_preserving_indent(value: &serde_json::Value, original: &str) -> String {
-    match JsonLayout::of(original).render(value) {
-        // Always valid UTF-8: the original was a &str and serde_json emits
-        // escaped ASCII/UTF-8 only.
-        Ok(bytes) => String::from_utf8_lossy(&bytes).into_owned(),
-        // Serializing a `Value` cannot fail; fall back to the 2-space form.
-        Err(_) => serde_json::to_string_pretty(value).unwrap_or_default() + "\n",
-    }
-}
-
-/// Reject a present-but-non-string lifecycle script value (`null` counts as
-/// absent, exactly like `"scripts": null`). Overwriting an array/object/number
-/// would silently discard whatever the user had there — the same reason a
-/// non-object `scripts` is refused rather than clobbered.
-fn check_script_values(package_json: &serde_json::Value) -> Result<(), String> {
-    let Some(scripts) = package_json.get("scripts").and_then(|s| s.as_object()) else {
-        return Ok(());
-    };
-    for key in ["postinstall", "dependencies"] {
-        if let Some(v) = scripts.get(key) {
-            if !v.is_null() && !v.is_string() {
-                return Err(format!(
-                    "Invalid package.json: \"scripts.{key}\" is not a string"
-                ));
-            }
-        }
-    }
-    Ok(())
-}
-
-/// Parse package.json content and remove socket-patch lifecycle scripts.
-/// Returns `(modified, new_content, status)`.
-pub(crate) fn remove_package_json_content(
-    content: &str,
-) -> Result<(bool, String, ScriptRemoveStatus), String> {
-    let mut package_json: serde_json::Value = serde_json::from_str(strip_bom(content))
-        .map_err(|e| format!("Invalid package.json: {e}"))?;
-
-    if !package_json.is_object() {
-        return Err("Invalid package.json: root is not a JSON object".to_string());
-    }
-
-    // Refuse to touch a malformed (present but non-object) `scripts` value.
-    if let Some(scripts) = package_json.get("scripts") {
-        if !scripts.is_null() && !scripts.is_object() {
-            return Err("Invalid package.json: \"scripts\" is not a JSON object".to_string());
-        }
-    }
-
-    let status = remove_package_json_object(&mut package_json);
-
-    if !status.modified {
-        return Ok((false, content.to_string(), status));
-    }
-
-    let new_content = serialize_preserving_indent(&package_json, content);
-    Ok((true, new_content, status))
-}
-
-/// Parse package.json content and update it with socket-patch scripts.
-/// Returns (modified, new_content, old_postinstall, new_postinstall,
-/// old_dependencies, new_dependencies).
-pub(crate) fn update_package_json_content(
-    content: &str,
-    pm: PackageManager,
-) -> Result<(bool, String, String, String, String, String), String> {
-    let mut package_json: serde_json::Value = serde_json::from_str(strip_bom(content))
-        .map_err(|e| format!("Invalid package.json: {e}"))?;
-
-    // A package.json must be a JSON object; otherwise there is nowhere to add
-    // lifecycle scripts.
-    if !package_json.is_object() {
-        return Err("Invalid package.json: root is not a JSON object".to_string());
-    }
-
-    // Refuse to clobber a malformed (present but non-object) `scripts` value.
-    // `null` is treated as absent and replaced with a fresh object downstream.
-    if let Some(scripts) = package_json.get("scripts") {
-        if !scripts.is_null() && !scripts.is_object() {
-            return Err("Invalid package.json: \"scripts\" is not a JSON object".to_string());
-        }
-    }
-    check_script_values(&package_json)?;
-
-    let status = is_setup_configured(&package_json);
-
-    if !status.needs_update {
-        return Ok((
-            false,
-            content.to_string(),
-            status.postinstall_script.clone(),
-            status.postinstall_script,
-            status.dependencies_script.clone(),
-            status.dependencies_script,
-        ));
-    }
-
-    let old_postinstall = status.postinstall_script.clone();
-    let old_dependencies = status.dependencies_script.clone();
-
-    let (_, new_postinstall, new_dependencies) = update_package_json_object(&mut package_json, pm);
-    let new_content = serialize_preserving_indent(&package_json, content);
-
-    Ok((
-        true,
-        new_content,
-        old_postinstall,
-        new_postinstall,
-        old_dependencies,
-        new_dependencies,
-    ))
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    // ── is_setup_configured ─────────────────────────────────────────
-
-    #[test]
-    fn test_not_configured() {
-        let pkg: serde_json::Value = serde_json::json!({
-            "name": "test",
-            "scripts": {
-                "build": "tsc"
-            }
-        });
-        let status = is_setup_configured(&pkg);
-        assert!(!status.postinstall_configured);
-        assert!(!status.dependencies_configured);
-        assert!(status.needs_update);
-    }
-
-    #[test]
-    fn test_postinstall_configured_dependencies_not() {
-        let pkg: serde_json::Value = serde_json::json!({
-            "name": "test",
-            "scripts": {
-                "postinstall": "npx @socketsecurity/socket-patch apply --silent --ecosystems npm"
-            }
-        });
-        let status = is_setup_configured(&pkg);
-        assert!(status.postinstall_configured);
-        assert!(!status.dependencies_configured);
-        assert!(status.needs_update);
-    }
-
-    #[test]
-    fn test_both_configured() {
-        let pkg: serde_json::Value = serde_json::json!({
-            "name": "test",
-            "scripts": {
-                "postinstall": "npx @socketsecurity/socket-patch apply --silent --ecosystems npm",
-                "dependencies": "npx @socketsecurity/socket-patch apply --silent --ecosystems npm"
-            }
-        });
-        let status = is_setup_configured(&pkg);
-        assert!(status.postinstall_configured);
-        assert!(status.dependencies_configured);
-        assert!(!status.needs_update);
-    }
-
-    #[test]
-    fn test_legacy_socket_patch_apply_recognized() {
-        let pkg: serde_json::Value = serde_json::json!({
-            "scripts": {
-                "postinstall": "socket patch apply --silent --ecosystems npm",
-                "dependencies": "socket-patch apply"
-            }
-        });
-        let status = is_setup_configured(&pkg);
-        assert!(status.postinstall_configured);
-        assert!(status.dependencies_configured);
-        assert!(!status.needs_update);
-    }
-
-    #[test]
-    fn test_no_scripts() {
-        let pkg: serde_json::Value = serde_json::json!({"name": "test"});
-        let status = is_setup_configured(&pkg);
-        assert!(!status.postinstall_configured);
-        assert!(status.postinstall_script.is_empty());
-        assert!(!status.dependencies_configured);
-        assert!(status.dependencies_script.is_empty());
-    }
-
-    #[test]
-    fn test_no_postinstall() {
-        let pkg: serde_json::Value = serde_json::json!({
-            "scripts": {"build": "tsc"}
-        });
-        let status = is_setup_configured(&pkg);
-        assert!(!status.postinstall_configured);
-        assert!(status.postinstall_script.is_empty());
-    }
-
-    // ── is_setup_configured_str ─────────────────────────────────────
-
-    #[test]
-    fn test_configured_str_invalid_json() {
-        let status = is_setup_configured_str("not json");
-        assert!(!status.postinstall_configured);
-        assert!(status.needs_update);
-    }
-
-    #[test]
-    fn test_configured_str_utf8_bom() {
-        // npm strips a leading BOM when reading package.json; a BOM'd,
-        // configured manifest must read as configured, not as unparseable
-        // (which would mis-report it as needing setup).
-        let content = "\u{feff}{\"scripts\":{\"postinstall\":\"npx @socketsecurity/socket-patch apply --silent --ecosystems npm\",\"dependencies\":\"npx @socketsecurity/socket-patch apply --silent --ecosystems npm\"}}";
-        let status = is_setup_configured_str(content);
-        assert!(status.postinstall_configured);
-        assert!(status.dependencies_configured);
-        assert!(!status.needs_update);
-    }
-
-    #[test]
-    fn test_configured_str_legacy_npx_pattern() {
-        let content =
-            r#"{"scripts":{"postinstall":"npx @socketsecurity/socket-patch apply --silent"}}"#;
-        let status = is_setup_configured_str(content);
-        assert!(status.postinstall_configured);
-    }
-
-    #[test]
-    fn test_configured_str_socket_dash_patch() {
-        let content =
-            r#"{"scripts":{"postinstall":"socket-patch apply --silent --ecosystems npm"}}"#;
-        let status = is_setup_configured_str(content);
-        assert!(status.postinstall_configured);
-    }
-
-    #[test]
-    fn test_configured_str_pnpm_dlx_pattern() {
-        let content = r#"{"scripts":{"postinstall":"pnpm dlx @socketsecurity/socket-patch apply --silent --ecosystems npm"}}"#;
-        let status = is_setup_configured_str(content);
-        // "pnpm dlx @socketsecurity/socket-patch apply" contains "socket-patch apply"
-        assert!(status.postinstall_configured);
-    }
-
-    // ── generate_updated_script ─────────────────────────────────────
-
-    #[test]
-    fn test_generate_empty_npm() {
-        assert_eq!(
-            generate_updated_script("", PackageManager::Npm),
-            "npx @socketsecurity/socket-patch apply --silent --ecosystems npm"
-        );
-    }
-
-    #[test]
-    fn test_generate_empty_pnpm() {
-        assert_eq!(
-            generate_updated_script("", PackageManager::Pnpm),
-            "pnpm dlx @socketsecurity/socket-patch apply --silent --ecosystems npm"
-        );
-    }
-
-    #[test]
-    fn test_generate_empty_vlt() {
-        assert_eq!(
-            generate_updated_script("", PackageManager::Vlt),
-            generate_updated_script("", PackageManager::Npm),
-        );
-        assert_eq!(
-            generate_updated_script("echo done", PackageManager::Vlt),
-            "npx @socketsecurity/socket-patch apply --silent --ecosystems npm && echo done"
-        );
-    }
-
-    #[test]
-    fn test_generate_prepend_npm() {
-        assert_eq!(
-            generate_updated_script("echo done", PackageManager::Npm),
-            "npx @socketsecurity/socket-patch apply --silent --ecosystems npm && echo done"
-        );
-    }
-
-    #[test]
-    fn test_generate_prepend_pnpm() {
-        assert_eq!(
-            generate_updated_script("echo done", PackageManager::Pnpm),
-            "pnpm dlx @socketsecurity/socket-patch apply --silent --ecosystems npm && echo done"
-        );
-    }
-
-    #[test]
-    fn test_generate_already_configured() {
-        let current = "socket-patch apply && echo done";
-        assert_eq!(
-            generate_updated_script(current, PackageManager::Npm),
-            current
-        );
-    }
-
-    #[test]
-    fn test_generate_whitespace_only() {
-        let result = generate_updated_script("  \t  ", PackageManager::Npm);
-        assert_eq!(
-            result,
-            "npx @socketsecurity/socket-patch apply --silent --ecosystems npm"
-        );
-    }
-
-    // ── update_package_json_object ──────────────────────────────────
-
-    #[test]
-    fn test_update_object_creates_scripts() {
-        let mut pkg: serde_json::Value = serde_json::json!({"name": "test"});
-        let (modified, new_postinstall, new_dependencies) =
-            update_package_json_object(&mut pkg, PackageManager::Npm);
-        assert!(modified);
-        assert!(new_postinstall.contains("npx @socketsecurity/socket-patch apply"));
-        assert!(new_dependencies.contains("npx @socketsecurity/socket-patch apply"));
-        assert!(pkg.get("scripts").is_some());
-        assert!(pkg["scripts"]["postinstall"].is_string());
-        assert!(pkg["scripts"]["dependencies"].is_string());
-    }
-
-    #[test]
-    fn test_update_object_creates_scripts_pnpm() {
-        let mut pkg: serde_json::Value = serde_json::json!({"name": "test"});
-        let (modified, new_postinstall, new_dependencies) =
-            update_package_json_object(&mut pkg, PackageManager::Pnpm);
-        assert!(modified);
-        assert!(new_postinstall.contains("pnpm dlx @socketsecurity/socket-patch apply"));
-        assert!(new_dependencies.contains("pnpm dlx @socketsecurity/socket-patch apply"));
-    }
-
-    #[test]
-    fn test_update_object_noop_when_both_configured() {
-        let mut pkg: serde_json::Value = serde_json::json!({
-            "scripts": {
-                "postinstall": "npx @socketsecurity/socket-patch apply --silent --ecosystems npm",
-                "dependencies": "npx @socketsecurity/socket-patch apply --silent --ecosystems npm"
-            }
-        });
-        let (modified, _, _) = update_package_json_object(&mut pkg, PackageManager::Npm);
-        assert!(!modified);
-    }
-
-    #[test]
-    fn test_update_object_adds_dependencies_when_postinstall_exists() {
-        let mut pkg: serde_json::Value = serde_json::json!({
-            "scripts": {
-                "postinstall": "npx @socketsecurity/socket-patch apply --silent --ecosystems npm"
-            }
-        });
-        let (modified, _, new_dependencies) =
-            update_package_json_object(&mut pkg, PackageManager::Npm);
-        assert!(modified);
-        assert!(new_dependencies.contains("npx @socketsecurity/socket-patch apply"));
-        // postinstall should remain unchanged
-        assert_eq!(
-            pkg["scripts"]["postinstall"].as_str().unwrap(),
-            "npx @socketsecurity/socket-patch apply --silent --ecosystems npm"
-        );
-    }
-
-    // ── update_package_json_content ─────────────────────────────────
-
-    #[test]
-    fn test_update_content_roundtrip_no_scripts() {
-        let content = r#"{"name": "test"}"#;
-        let (modified, new_content, old_pi, new_pi, old_dep, new_dep) =
-            update_package_json_content(content, PackageManager::Npm).unwrap();
-        assert!(modified);
-        assert!(old_pi.is_empty());
-        assert!(new_pi.contains("npx @socketsecurity/socket-patch apply"));
-        assert!(old_dep.is_empty());
-        assert!(new_dep.contains("npx @socketsecurity/socket-patch apply"));
-        let parsed: serde_json::Value = serde_json::from_str(&new_content).unwrap();
-        assert!(parsed["scripts"]["postinstall"].is_string());
-        assert!(parsed["scripts"]["dependencies"].is_string());
-    }
-
-    #[test]
-    fn test_update_content_already_configured() {
-        let content = r#"{"scripts":{"postinstall":"socket patch apply --silent --ecosystems npm","dependencies":"socket patch apply --silent --ecosystems npm"}}"#;
-        let (modified, _, _, _, _, _) =
-            update_package_json_content(content, PackageManager::Npm).unwrap();
-        assert!(!modified);
-    }
-
-    #[test]
-    fn test_update_content_invalid_json() {
-        let result = update_package_json_content("not json", PackageManager::Npm);
-        assert!(result.is_err());
-        assert!(result.unwrap_err().contains("Invalid package.json"));
-    }
-
-    /// Mirror of test_update_object_adds_dependencies_when_postinstall_exists:
-    /// `dependencies` is already configured but `postinstall` is not. The
-    /// already-configured script must come back byte-for-byte unchanged (the
-    /// keep-arm of `update_package_json_object`), with only `postinstall`
-    /// added — and no second patch command prepended to `dependencies`.
-    #[test]
-    fn test_update_content_dependencies_preconfigured_adds_postinstall() {
-        let configured = "npx @socketsecurity/socket-patch apply --silent --ecosystems npm";
-        let content = format!(r#"{{"scripts":{{"dependencies":"{configured}"}}}}"#);
-        let (modified, new_content, old_pi, new_pi, old_dep, new_dep) =
-            update_package_json_content(&content, PackageManager::Npm).unwrap();
-        assert!(modified);
-        assert!(old_pi.is_empty());
-        assert!(new_pi.contains("npx @socketsecurity/socket-patch apply"));
-        // The pre-configured dependencies script is untouched.
-        assert_eq!(old_dep, configured);
-        assert_eq!(new_dep, configured);
-        let parsed: serde_json::Value = serde_json::from_str(&new_content).unwrap();
-        assert_eq!(
-            parsed["scripts"]["dependencies"].as_str().unwrap(),
-            configured
-        );
-        assert_eq!(
-            parsed["scripts"]["dependencies"]
-                .as_str()
-                .unwrap()
-                .matches("socket-patch apply")
-                .count(),
-            1,
-            "must not double-prepend the patch command:\n{new_content}"
-        );
-        assert!(parsed["scripts"]["postinstall"]
-            .as_str()
-            .unwrap()
-            .contains("npx @socketsecurity/socket-patch apply"));
-    }
-
-    #[test]
-    fn test_update_object_scripts_is_string_does_not_panic() {
-        // A present-but-non-object `scripts` must not panic when indexed
-        // (`cannot access key "postinstall" in JSON string`).
-        let mut pkg: serde_json::Value = serde_json::json!({
-            "name": "test",
-            "scripts": "build"
-        });
-        let (modified, _, _) = update_package_json_object(&mut pkg, PackageManager::Npm);
-        // Root is an object but `scripts` is malformed; the object-level helper
-        // replaces it rather than panicking.
-        assert!(modified);
-        assert!(pkg["scripts"]["postinstall"].is_string());
-        assert!(pkg["scripts"]["dependencies"].is_string());
-    }
-
-    #[test]
-    fn test_update_object_scripts_is_array_does_not_panic() {
-        let mut pkg: serde_json::Value = serde_json::json!({
-            "name": "test",
-            "scripts": ["build"]
-        });
-        let (modified, _, _) = update_package_json_object(&mut pkg, PackageManager::Npm);
-        assert!(modified);
-        assert!(pkg["scripts"].is_object());
-    }
-
-    #[test]
-    fn test_update_object_scripts_is_null() {
-        // `null` scripts is treated as absent and replaced with an object.
-        let mut pkg: serde_json::Value = serde_json::json!({
-            "name": "test",
-            "scripts": null
-        });
-        let (modified, _, _) = update_package_json_object(&mut pkg, PackageManager::Npm);
-        assert!(modified);
-        assert!(pkg["scripts"]["postinstall"].is_string());
-    }
-
-    #[test]
-    fn test_update_object_non_object_root_is_noop() {
-        // A non-object root must not panic on `["scripts"] = ...`.
-        let mut arr: serde_json::Value = serde_json::json!([1, 2, 3]);
-        let (modified, _, _) = update_package_json_object(&mut arr, PackageManager::Npm);
-        assert!(!modified);
-        assert_eq!(arr, serde_json::json!([1, 2, 3]));
-    }
-
-    #[test]
-    fn test_update_content_non_object_root_errors() {
-        // Regression: valid JSON that is not an object must error, not panic.
-        for content in ["[1,2,3]", "42", "\"hello\"", "true", "null"] {
-            let result = update_package_json_content(content, PackageManager::Npm);
-            assert!(result.is_err(), "expected error for content {content:?}");
-            assert!(result.unwrap_err().contains("root is not a JSON object"));
-        }
-    }
-
-    #[test]
-    fn test_update_content_non_object_scripts_errors() {
-        // Regression: a present-but-non-object `scripts` must error rather than
-        // silently clobbering the user's value or panicking.
-        let content = r#"{"name":"test","scripts":"build"}"#;
-        let result = update_package_json_content(content, PackageManager::Npm);
-        assert!(result.is_err());
-        assert!(result
-            .unwrap_err()
-            .contains("\"scripts\" is not a JSON object"));
-    }
-
-    #[test]
-    fn test_update_content_null_scripts_creates_object() {
-        // `null` scripts is benign: treated as absent and populated.
-        let content = r#"{"name":"test","scripts":null}"#;
-        let (modified, new_content, _, new_pi, _, new_dep) =
-            update_package_json_content(content, PackageManager::Npm).unwrap();
-        assert!(modified);
-        assert!(new_pi.contains("npx @socketsecurity/socket-patch apply"));
-        assert!(new_dep.contains("npx @socketsecurity/socket-patch apply"));
-        let parsed: serde_json::Value = serde_json::from_str(&new_content).unwrap();
-        assert!(parsed["scripts"]["postinstall"].is_string());
-        assert!(parsed["scripts"]["dependencies"].is_string());
-    }
-
-    // ── remove_socket_patch_from_script ─────────────────────────────
-
-    #[test]
-    fn test_remove_script_only_socket_patch_deletes_key() {
-        let (changed, new) = remove_socket_patch_from_script(
-            "npx @socketsecurity/socket-patch apply --silent --ecosystems npm",
-        );
-        assert!(changed);
-        assert_eq!(new, None);
-    }
-
-    #[test]
-    fn test_remove_script_strips_prefix_keeps_rest() {
-        let (changed, new) = remove_socket_patch_from_script(
-            "npx @socketsecurity/socket-patch apply --silent --ecosystems npm && echo done",
-        );
-        assert!(changed);
-        assert_eq!(new.as_deref(), Some("echo done"));
-    }
-
-    #[test]
-    fn test_remove_script_no_socket_patch_unchanged() {
-        let (changed, new) = remove_socket_patch_from_script("echo done && tsc");
-        assert!(!changed);
-        assert_eq!(new.as_deref(), Some("echo done && tsc"));
-    }
-
-    #[test]
-    fn test_remove_script_legacy_pattern() {
-        let (changed, new) = remove_socket_patch_from_script("socket-patch apply && echo done");
-        assert!(changed);
-        assert_eq!(new.as_deref(), Some("echo done"));
-    }
-
-    #[test]
-    fn test_remove_script_empty() {
-        let (changed, new) = remove_socket_patch_from_script("");
-        assert!(!changed);
-        assert_eq!(new, None);
-    }
-
-    #[test]
-    fn test_remove_script_empty_segment_no_patch_is_unchanged() {
-        // Regression: a patch-free script with a stray empty segment (double
-        // `" && "`) must report `changed == false` — `(true, ..)` means a
-        // socket-patch segment was removed, which did not happen, so
-        // `changed` must not be keyed off `kept.len() != segments.len()`.
-        let (changed, new) = remove_socket_patch_from_script("echo a &&  && echo b");
-        assert!(
-            !changed,
-            "no socket-patch present, must not report a removal"
-        );
-        assert_eq!(new.as_deref(), Some("echo a &&  && echo b"));
-    }
-
-    #[test]
-    fn test_remove_script_patch_in_middle_keeps_siblings() {
-        let (changed, new) =
-            remove_socket_patch_from_script("echo a && socket-patch apply && echo b");
-        assert!(changed);
-        assert_eq!(new.as_deref(), Some("echo a && echo b"));
-    }
-
-    #[test]
-    fn test_remove_script_multiple_patch_segments() {
-        // Defensive: more than one socket-patch invocation, all removed.
-        let (changed, new) = remove_socket_patch_from_script(
-            "socket-patch apply && build && npx @socketsecurity/socket-patch apply",
-        );
-        assert!(changed);
-        assert_eq!(new.as_deref(), Some("build"));
-    }
-
-    /// `&&` is a shell operator regardless of the whitespace around it, and
-    /// hand-wired scripts routinely omit the spaces. Splitting only on
-    /// `" && "` made `"socket-patch apply&&npm run build"` a single segment
-    /// that merely *contained* a patch pattern, so remove treated the whole
-    /// script as patch-only and deleted the key — silently taking the user's
-    /// `npm run build` with it.
-    #[test]
-    fn test_remove_script_ampersand_no_spaces_keeps_siblings() {
-        let (changed, new) = remove_socket_patch_from_script("socket-patch apply&&npm run build");
-        assert!(changed);
-        assert_eq!(new.as_deref(), Some("npm run build"));
-
-        let (changed, new) = remove_socket_patch_from_script("npm run build&& socket-patch apply");
-        assert!(changed);
-        assert_eq!(new.as_deref(), Some("npm run build"));
-
-        let (changed, new) =
-            remove_socket_patch_from_script("echo a &&socket-patch apply&& echo b && echo c");
-        assert!(changed);
-        assert_eq!(new.as_deref(), Some("echo a && echo b && echo c"));
-    }
-
-    /// A `&&` inside a QUOTED argument of a surviving user command also
-    /// splits at the operator scan, and a canonical `" && "` rejoin would
-    /// rewrite the user's bytes — `grep "a&&b"` becoming `grep "a && b"`,
-    /// which greps a different pattern. Survivors must come back verbatim.
-    #[test]
-    fn test_remove_script_preserves_quoted_ampersands_in_survivors() {
-        let (changed, new) = remove_socket_patch_from_script(
-            r#"socket-patch apply --silent && grep "a&&b" app.log"#,
-        );
-        assert!(changed);
-        assert_eq!(new.as_deref(), Some(r#"grep "a&&b" app.log"#));
-
-        // Same with the patch segment in the middle: the seam next to the
-        // removed segment collapses to a single `&&`, everything else is
-        // byte-identical.
-        let (changed, new) = remove_socket_patch_from_script(
-            r#"echo start && socket-patch apply && grep "x&&y" out.txt &&  tail -1"#,
-        );
-        assert!(changed);
-        assert_eq!(
-            new.as_deref(),
-            Some(r#"echo start && grep "x&&y" out.txt &&  tail -1"#),
-            "surviving segments keep their original inner spacing too"
-        );
-    }
-
-    #[test]
-    fn test_remove_script_pnpm_command() {
-        // The pnpm canonical command must be recognized and stripped (it
-        // contains the "socket-patch apply" pattern).
-        let (changed, new) = remove_socket_patch_from_script(
-            "pnpm dlx @socketsecurity/socket-patch apply --silent --ecosystems npm && echo hi",
-        );
-        assert!(changed);
-        assert_eq!(new.as_deref(), Some("echo hi"));
-    }
-
-    // ── remove_package_json_object ──────────────────────────────────
-
-    #[test]
-    fn test_remove_object_deletes_lifecycle_keys() {
-        let mut pkg: serde_json::Value = serde_json::json!({
-            "name": "test",
-            "scripts": {
-                "postinstall": "npx @socketsecurity/socket-patch apply --silent --ecosystems npm",
-                "dependencies": "npx @socketsecurity/socket-patch apply --silent --ecosystems npm"
-            }
-        });
-        let status = remove_package_json_object(&mut pkg);
-        assert!(status.modified);
-        // Both keys were only socket-patch, so they (and the now-empty
-        // `scripts` object) are removed entirely.
-        assert!(pkg.get("scripts").is_none());
-    }
-
-    #[test]
-    fn test_remove_object_keeps_sibling_scripts() {
-        let mut pkg: serde_json::Value = serde_json::json!({
-            "name": "test",
-            "scripts": {
-                "build": "tsc",
-                "postinstall": "npx @socketsecurity/socket-patch apply --silent --ecosystems npm && echo hi"
-            }
-        });
-        let status = remove_package_json_object(&mut pkg);
-        assert!(status.modified);
-        assert_eq!(pkg["scripts"]["build"], "tsc");
-        assert_eq!(pkg["scripts"]["postinstall"], "echo hi");
-    }
-
-    #[test]
-    fn test_remove_object_noop_when_empty_segment_no_patch() {
-        // Regression: a patch-free script whose only oddity is a stray empty
-        // segment must be a no-op — neither reported modified nor rewritten.
-        let mut pkg: serde_json::Value = serde_json::json!({
-            "name": "test",
-            "scripts": { "postinstall": "echo a &&  && echo b" }
-        });
-        let status = remove_package_json_object(&mut pkg);
-        assert!(!status.modified);
-        // The original (untouched) value must be preserved, empty segment and all.
-        assert_eq!(pkg["scripts"]["postinstall"], "echo a &&  && echo b");
-    }
-
-    #[test]
-    fn test_remove_object_noop_when_not_configured() {
-        let mut pkg: serde_json::Value = serde_json::json!({
-            "name": "test",
-            "scripts": { "build": "tsc" }
-        });
-        let status = remove_package_json_object(&mut pkg);
-        assert!(!status.modified);
-        assert_eq!(pkg["scripts"]["build"], "tsc");
-    }
-
-    // ── remove_package_json_content ─────────────────────────────────
-
-    #[test]
-    fn test_remove_content_roundtrip_with_update() {
-        // update then remove must return to a no-socket-patch state.
-        let original = r#"{"name":"x","scripts":{"build":"tsc"}}"#;
-        let (_, updated, ..) = update_package_json_content(original, PackageManager::Npm).unwrap();
-        assert!(updated.contains("socket-patch"));
-
-        let (modified, removed, _) = remove_package_json_content(&updated).unwrap();
-        assert!(modified);
-        assert!(!removed.contains("socket-patch"));
-        let parsed: serde_json::Value = serde_json::from_str(&removed).unwrap();
-        assert_eq!(parsed["scripts"]["build"], "tsc");
-        assert!(parsed["scripts"].get("postinstall").is_none());
-        assert!(parsed["scripts"].get("dependencies").is_none());
-    }
-
-    #[test]
-    fn test_remove_content_idempotent() {
-        let configured =
-            r#"{"name":"x","scripts":{"postinstall":"npx @socketsecurity/socket-patch apply"}}"#;
-        let (modified1, removed, _) = remove_package_json_content(configured).unwrap();
-        assert!(modified1);
-        let (modified2, _, _) = remove_package_json_content(&removed).unwrap();
-        assert!(!modified2);
-    }
-
-    #[test]
-    fn test_remove_content_roundtrip_pnpm() {
-        // update (pnpm) then remove must fully revert to a no-socket-patch state.
-        let original = r#"{"name":"x","scripts":{"build":"tsc"}}"#;
-        let (_, updated, ..) = update_package_json_content(original, PackageManager::Pnpm).unwrap();
-        assert!(updated.contains("pnpm dlx @socketsecurity/socket-patch apply"));
-
-        let (modified, removed, _) = remove_package_json_content(&updated).unwrap();
-        assert!(modified);
-        assert!(!removed.contains("socket-patch"));
-        let parsed: serde_json::Value = serde_json::from_str(&removed).unwrap();
-        assert_eq!(parsed["scripts"]["build"], "tsc");
-        assert!(parsed["scripts"].get("postinstall").is_none());
-        assert!(parsed["scripts"].get("dependencies").is_none());
-    }
-
-    #[test]
-    fn test_remove_content_invalid_json_errors() {
-        assert!(remove_package_json_content("not json").is_err());
-    }
-
-    #[test]
-    fn test_remove_content_non_object_root_errors() {
-        // Twin of test_update_content_non_object_root_errors: valid JSON whose
-        // root is not an object must error, not panic or no-op.
-        for content in ["[1,2,3]", "42", "\"hello\"", "true", "null"] {
-            let result = remove_package_json_content(content);
-            assert!(result.is_err(), "expected error for content {content:?}");
-            assert!(result.unwrap_err().contains("root is not a JSON object"));
-        }
-    }
-
-    /// Partial removal from the `dependencies` script (the Some-arm of the
-    /// dep_changed branch): the patch is present ONLY in `dependencies`,
-    /// chained with a user command that must survive. Also pins the
-    /// pi_changed=false && dep_changed=true status shape: `new_postinstall`
-    /// is `None` here because the postinstall script was already empty/absent
-    /// (not because a postinstall key was deleted).
-    #[test]
-    fn test_remove_content_dependencies_only_keeps_user_command() {
-        let content = r#"{"name":"x","scripts":{"dependencies":"npx @socketsecurity/socket-patch apply --silent --ecosystems npm && npm run prep"}}"#;
-        let (modified, new_content, status) = remove_package_json_content(content).unwrap();
-        assert!(modified);
-        assert_eq!(status.new_dependencies.as_deref(), Some("npm run prep"));
-        assert_eq!(
-            status.old_dependencies,
-            "npx @socketsecurity/socket-patch apply --silent --ecosystems npm && npm run prep"
-        );
-        assert!(status.old_postinstall.is_empty());
-        assert!(
-            status.new_postinstall.is_none(),
-            "absent postinstall reads as empty and unchanged reports None"
-        );
-        let parsed: serde_json::Value = serde_json::from_str(&new_content).unwrap();
-        assert_eq!(
-            parsed["scripts"]["dependencies"], "npm run prep",
-            "the user's command must survive:\n{new_content}"
-        );
-        assert!(parsed["scripts"].get("postinstall").is_none());
-        assert!(!new_content.contains("socket-patch"));
-    }
-
-    #[test]
-    fn test_remove_content_non_object_scripts_errors() {
-        let result = remove_package_json_content(r#"{"name":"x","scripts":"build"}"#);
-        assert!(result.is_err());
-    }
-
-    /// End-to-end shape of the `&&`-without-spaces data loss: the user's
-    /// `npm run build` must survive `remove`, not be deleted along with the
-    /// patch command it was chained to.
-    #[test]
-    fn test_remove_content_ampersand_no_spaces_keeps_user_script() {
-        let content = r#"{"name":"x","scripts":{"postinstall":"npx @socketsecurity/socket-patch apply --silent --ecosystems npm&&npm run build"}}"#;
-        let (modified, new_content, status) = remove_package_json_content(content).unwrap();
-        assert!(modified);
-        assert_eq!(status.new_postinstall.as_deref(), Some("npm run build"));
-        let parsed: serde_json::Value = serde_json::from_str(&new_content).unwrap();
-        assert_eq!(
-            parsed["scripts"]["postinstall"], "npm run build",
-            "the user's command must survive:\n{new_content}"
-        );
-    }
-
-    /// A present-but-non-string lifecycle script is malformed. Overwriting it
-    /// silently discards the user's value; refuse it the same way a non-object
-    /// `scripts` is refused.
-    #[test]
-    fn test_update_content_non_string_script_errors() {
-        for body in [
-            r#"{"scripts":{"postinstall":["a","b"]}}"#,
-            r#"{"scripts":{"postinstall":42}}"#,
-            r#"{"scripts":{"dependencies":{"a":"b"}}}"#,
-            r#"{"scripts":{"dependencies":true}}"#,
-        ] {
-            let result = update_package_json_content(body, PackageManager::Npm);
-            assert!(result.is_err(), "expected error for {body}");
-            assert!(
-                result.as_ref().unwrap_err().contains("is not a string"),
-                "unexpected error for {body}: {:?}",
-                result.unwrap_err()
-            );
-        }
-    }
-
-    /// `null` stays benign: like `"scripts": null`, a null script value is
-    /// treated as absent and populated rather than rejected.
-    #[test]
-    fn test_update_content_null_script_is_populated() {
-        let content = r#"{"scripts":{"postinstall":null,"build":"tsc"}}"#;
-        let (modified, new_content, ..) =
-            update_package_json_content(content, PackageManager::Npm).unwrap();
-        assert!(modified);
-        let parsed: serde_json::Value = serde_json::from_str(&new_content).unwrap();
-        assert!(parsed["scripts"]["postinstall"]
-            .as_str()
-            .unwrap()
-            .contains("socket-patch apply"));
-        assert_eq!(parsed["scripts"]["build"], "tsc");
-    }
-
-    /// Rewriting the manifest must not reformat it: a 4-space or tab-indented
-    /// package.json re-serialized at serde's fixed 2-space indent turns a
-    /// two-line edit into a whole-file diff. The vendor backends already
-    /// respect the project's indent when they rewrite package.json
-    /// (`detect_indent` + `serialize_json`); `setup` must too.
-    #[test]
-    fn test_update_content_preserves_indent() {
-        for indent in ["    ", "\t"] {
-            let content = format!(
-                "{{\n{indent}\"name\": \"x\",\n{indent}\"scripts\": {{\n{indent}{indent}\"build\": \"tsc\"\n{indent}}}\n}}\n"
-            );
-            let (modified, new_content, ..) =
-                update_package_json_content(&content, PackageManager::Npm).unwrap();
-            assert!(modified);
-            assert!(
-                new_content.contains(&format!("\n{indent}\"name\": \"x\",")),
-                "indent {indent:?} not preserved at depth 1:\n{new_content}"
-            );
-            assert!(
-                new_content.contains(&format!("\n{indent}{indent}\"build\": \"tsc\",")),
-                "indent {indent:?} not preserved at depth 2:\n{new_content}"
-            );
-            // Still valid JSON with the scripts wired.
-            let parsed: serde_json::Value = serde_json::from_str(&new_content).unwrap();
-            assert!(parsed["scripts"]["postinstall"].is_string());
-            assert!(parsed["scripts"]["dependencies"].is_string());
-        }
-    }
-
-    #[test]
-    fn test_remove_content_preserves_indent() {
-        let content = "{\n    \"name\": \"x\",\n    \"scripts\": {\n        \"build\": \"tsc\",\n        \"postinstall\": \"npx @socketsecurity/socket-patch apply --silent --ecosystems npm\"\n    }\n}\n";
-        let (modified, new_content, _) = remove_package_json_content(content).unwrap();
-        assert!(modified);
-        assert!(
-            new_content.contains("\n    \"scripts\": {"),
-            "indent not preserved:\n{new_content}"
-        );
-        assert!(
-            new_content.contains("\n        \"build\": \"tsc\""),
-            "indent not preserved:\n{new_content}"
-        );
-    }
-
-    #[test]
-    fn test_update_content_pnpm() {
-        let content = r#"{"name": "test"}"#;
-        let (modified, new_content, _, new_pi, _, new_dep) =
-            update_package_json_content(content, PackageManager::Pnpm).unwrap();
-        assert!(modified);
-        assert!(new_pi.contains("pnpm dlx @socketsecurity/socket-patch apply"));
-        assert!(new_dep.contains("pnpm dlx @socketsecurity/socket-patch apply"));
-        let parsed: serde_json::Value = serde_json::from_str(&new_content).unwrap();
-        assert!(parsed["scripts"]["postinstall"]
-            .as_str()
-            .unwrap()
-            .contains("pnpm dlx"));
-        assert!(parsed["scripts"]["dependencies"]
-            .as_str()
-            .unwrap()
-            .contains("pnpm dlx"));
-    }
-
-    #[test]
-    fn test_update_content_vlt_round_trips_through_remove() {
-        let content = "{\n  \"name\": \"test\"\n}\n";
-        let (modified, updated, _, new_pi, _, new_dep) =
-            update_package_json_content(content, PackageManager::Vlt).unwrap();
-        assert!(modified);
-        let npx = "npx @socketsecurity/socket-patch apply --silent --ecosystems npm";
-        assert_eq!(new_pi, npx);
-        assert_eq!(new_dep, npx);
-        assert!(!is_setup_configured_str(&updated).needs_update);
-        let (removed, restored, _) = remove_package_json_content(&updated).unwrap();
-        assert!(removed);
-        assert_eq!(restored, content);
-    }
-}
diff --git a/crates/socket-patch-core/src/package_json/find.rs b/crates/socket-patch-core/src/package_json/find.rs
deleted file mode 100644
index 34c648ad..00000000
--- a/crates/socket-patch-core/src/package_json/find.rs
+++ /dev/null
@@ -1,2095 +0,0 @@
-use std::path::{Path, PathBuf};
-use tokio::fs;
-
-use super::detect::{strip_bom, PackageManager};
-use crate::constants::npm_family;
-use crate::formats::registry;
-use crate::utils::fs::{entry_file_type, is_dir, list_dir_entries, read_regular_to_string};
-use crate::vendor::vlt_lock_text::{sniff_lock, LockSniff};
-
-/// Detect the package manager based on lockfiles in the project root.
-/// vlt's markers ([`VLT_SETUP_MARKERS`](npm_family::VLT_SETUP_MARKERS)) win
-/// over pnpm's, and only the start directory is consulted: an ancestor
-/// `vlt.json` does not make a nested package a vlt project. The accepted
-/// pnpm marker spellings (including the `pnpm-lock.yml` variant no other
-/// subsystem accepts) are the format registry's
-/// [`PNPM_MARKER`](registry::PNPM_MARKER) rows.
-pub async fn detect_package_manager(start_path: &Path) -> PackageManager {
-    for name in npm_family::VLT_SETUP_MARKERS {
-        let path = start_path.join(name);
-        let present = if name == npm_family::VLT_STORE_DIR {
-            is_dir(&path).await
-        } else {
-            fs::metadata(&path).await.is_ok()
-        };
-        if present {
-            return PackageManager::Vlt;
-        }
-    }
-    for name in registry::paths_with(registry::PNPM_MARKER) {
-        if fs::metadata(start_path.join(name)).await.is_ok() {
-            return PackageManager::Pnpm;
-        }
-    }
-    PackageManager::Npm
-}
-
-/// A `vlt-lock.json` written by a vlt that may predate 1.0.0-rc.13, the
-/// first release that runs a root `postinstall` without an `install`
-/// script.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum LegacyVltLock {
-    /// No `lockfileVersion` key (vlt <= 0.0.0-18).
-    NoVersion,
-    /// `lockfileVersion: 0` (vlt < 1.0.0-rc.15; rc.13 and rc.14 included).
-    VersionZero,
-}
-
-/// The start directory's `vlt-lock.json`, when its `lockfileVersion` is
-/// absent or `0`. Any other lock, an unreadable one or none yields `None`.
-pub async fn legacy_vlt_lock(start_path: &Path) -> Option<LegacyVltLock> {
-    let text = read_regular_to_string(&start_path.join(npm_family::VLT_LOCK))
-        .await
-        .ok()?;
-    match sniff_lock(&text) {
-        LockSniff::Readable(lock) => match lock.version {
-            None => Some(LegacyVltLock::NoVersion),
-            Some(0) => Some(LegacyVltLock::VersionZero),
-            Some(_) => None,
-        },
-        _ => None,
-    }
-}
-
-/// Workspace configuration type.
-#[derive(Debug, Clone)]
-pub enum WorkspaceType {
-    Npm,
-    Pnpm,
-    /// vlt.json `workspaces` (or vlt <= 0.0.0-12's `vlt-workspaces.json`).
-    Vlt,
-    None,
-}
-
-/// Workspace configuration.
-#[derive(Debug, Clone)]
-struct WorkspaceConfig {
-    ws_type: WorkspaceType,
-    patterns: Vec<String>,
-}
-
-/// Location of a discovered package.json file.
-#[derive(Debug, Clone)]
-pub struct PackageJsonLocation {
-    pub path: PathBuf,
-    pub is_root: bool,
-    pub is_workspace: bool,
-}
-
-/// Result of finding package.json files.
-#[derive(Debug)]
-pub struct PackageJsonFindResult {
-    pub files: Vec<PackageJsonLocation>,
-    pub workspace_type: WorkspaceType,
-}
-
-/// Find all package.json files, respecting workspace configurations.
-pub async fn find_package_json_files(start_path: &Path) -> PackageJsonFindResult {
-    let mut results = Vec::new();
-    let root_package_json = start_path.join("package.json");
-
-    let mut root_exists = false;
-    let mut workspace_config = WorkspaceConfig {
-        ws_type: WorkspaceType::None,
-        patterns: Vec::new(),
-    };
-
-    if fs::metadata(&root_package_json).await.is_ok() {
-        root_exists = true;
-        workspace_config = detect_workspaces(&root_package_json).await;
-        results.push(PackageJsonLocation {
-            path: root_package_json.clone(),
-            is_root: true,
-            is_workspace: false,
-        });
-    }
-
-    match workspace_config.ws_type {
-        WorkspaceType::None => {
-            // No workspace config: pick up nested manifests with a bounded
-            // walk (the root entry is already in `results`).
-            if root_exists {
-                let mut nested = Vec::new();
-                search_recursive(start_path, 0, 5, &mut nested).await;
-                results.extend(nested.into_iter().filter(|p| *p != root_package_json).map(
-                    |path| PackageJsonLocation {
-                        path,
-                        is_root: false,
-                        is_workspace: false,
-                    },
-                ));
-            }
-        }
-        _ => {
-            // Members are collected into their own vec so a `!`-negation
-            // pattern can only remove members, never the root entry.
-            let mut members = Vec::new();
-            collect_workspace_members(start_path, &workspace_config, 0, &mut members).await;
-            results.extend(members);
-        }
-    }
-
-    // Workspace patterns can overlap (e.g. "packages/*" and "packages/a", or a
-    // glob plus an exact path), which would otherwise yield the same
-    // package.json more than once. De-duplicate by path, preserving discovery
-    // order so the root entry stays first.
-    let mut seen = std::collections::HashSet::new();
-    results.retain(|loc| seen.insert(loc.path.clone()));
-
-    PackageJsonFindResult {
-        files: results,
-        workspace_type: workspace_config.ws_type,
-    }
-}
-
-/// Detect workspace configuration from package.json.
-async fn detect_workspaces(package_json_path: &Path) -> WorkspaceConfig {
-    let default = WorkspaceConfig {
-        ws_type: WorkspaceType::None,
-        patterns: Vec::new(),
-    };
-
-    // Check vlt's workspace config (vlt.json / vlt-workspaces.json) and then
-    // pnpm-workspace.yaml first — pnpm projects may also have "workspaces" in
-    // package.json for compatibility, but these files are the definitive
-    // signal. They live next to package.json and do not depend on it being
-    // present or even valid JSON, so they must be checked *before* parsing
-    // package.json — otherwise a malformed (e.g.
-    // JSONC, or simply broken) root manifest would wrongly demote a real pnpm
-    // workspace to "no workspace".
-    let dir = package_json_path.parent().unwrap_or(Path::new("."));
-    if let Some(patterns) = vlt_workspace_patterns(dir).await {
-        return WorkspaceConfig {
-            ws_type: WorkspaceType::Vlt,
-            patterns,
-        };
-    }
-    let pnpm_workspace = dir.join("pnpm-workspace.yaml");
-    // Every manifest/config read here lives inside the (untrusted) project
-    // tree — and the workspace walk reads the package.json of *every*
-    // glob-discovered member — so reads go through the FIFO-safe
-    // `read_regular_to_string` (non-blocking open, regular-file check): a
-    // planted FIFO fails fast instead of wedging `setup`'s discovery.
-    if let Ok(yaml_content) = read_regular_to_string(&pnpm_workspace).await {
-        let patterns = parse_pnpm_workspace_patterns(&yaml_content);
-        return WorkspaceConfig {
-            ws_type: WorkspaceType::Pnpm,
-            patterns,
-        };
-    }
-
-    let content = match read_regular_to_string(package_json_path).await {
-        Ok(c) => c,
-        Err(_) => return default,
-    };
-
-    let pkg: serde_json::Value = match serde_json::from_str(strip_bom(&content)) {
-        Ok(v) => v,
-        Err(_) => return default,
-    };
-
-    // Check for npm/yarn workspaces
-    if let Some(workspaces) = pkg.get("workspaces") {
-        let patterns = if let Some(arr) = workspaces.as_array() {
-            arr.iter()
-                .filter_map(|v| v.as_str().map(String::from))
-                .collect()
-        } else if let Some(obj) = workspaces.as_object() {
-            obj.get("packages")
-                .and_then(|v| v.as_array())
-                .map(|arr| {
-                    arr.iter()
-                        .filter_map(|v| v.as_str().map(String::from))
-                        .collect()
-                })
-                .unwrap_or_default()
-        } else {
-            Vec::new()
-        };
-
-        return WorkspaceConfig {
-            ws_type: WorkspaceType::Npm,
-            patterns,
-        };
-    }
-
-    default
-}
-
-/// vlt's workspace globs for `dir`: vlt.json `workspaces` (vlt >= 0.0.0-13)
-/// or, without one, the legacy `vlt-workspaces.json` (vlt <= 0.0.0-12; the
-/// two eras never read each other's file). vlt never reads package.json
-/// `workspaces`. `None` when neither file declares workspaces.
-async fn vlt_workspace_patterns(dir: &Path) -> Option<Vec<String>> {
-    if let Some(workspaces) = read_json_config(&dir.join(npm_family::VLT_CONFIG))
-        .await
-        .and_then(|mut config| config.get_mut("workspaces").map(serde_json::Value::take))
-        .filter(|workspaces| !workspaces.is_null())
-    {
-        return Some(parse_vlt_workspaces(&workspaces));
-    }
-    read_json_config(&dir.join(npm_family::VLT_LEGACY_WORKSPACES))
-        .await
-        .filter(|legacy| !legacy.is_null())
-        .map(|legacy| parse_vlt_workspaces(&legacy))
-}
-
-/// A JSON config file inside the project (FIFO-safe read, BOM stripped), or
-/// `None` when it is missing, unreadable or not JSON.
-async fn read_json_config(path: &Path) -> Option<serde_json::Value> {
-    let text = read_regular_to_string(path).await.ok()?;
-    serde_json::from_str(strip_bom(&text)).ok()
-}
-
-/// vlt's workspace declaration: a glob, a list of globs, or an object of
-/// named groups whose values are either. Non-string entries are ignored.
-fn parse_vlt_workspaces(value: &serde_json::Value) -> Vec<String> {
-    fn globs(value: &serde_json::Value, out: &mut Vec<String>) {
-        match value {
-            serde_json::Value::String(glob) => out.push(glob.clone()),
-            serde_json::Value::Array(items) => {
-                out.extend(items.iter().filter_map(|v| v.as_str().map(String::from)))
-            }
-            _ => {}
-        }
-    }
-    let mut patterns = Vec::new();
-    match value {
-        serde_json::Value::Object(groups) => {
-            for group in groups.values() {
-                globs(group, &mut patterns);
-            }
-        }
-        other => globs(other, &mut patterns),
-    }
-    patterns
-}
-
-/// Simple parser for pnpm-workspace.yaml packages field.
-fn parse_pnpm_workspace_patterns(yaml_content: &str) -> Vec<String> {
-    let mut patterns = Vec::new();
-    let mut in_packages = false;
-
-    // A BOM is not Unicode whitespace, so `trim` would leave it glued to a
-    // first-line `packages:` header and the whole section would be missed.
-    // Lines are collected up front so a flow sequence can hand the scanner
-    // its continuation lines — a `[` need not close on the line it opens on.
-    let lines: Vec<&str> = strip_bom(yaml_content).lines().collect();
-    for (idx, line) in lines.iter().enumerate() {
-        let trimmed = line.trim();
-
-        // The header may carry an inline comment (`packages: # globs`); a `#`
-        // opens a comment only when preceded by whitespace.
-        let after_key = trimmed.strip_prefix("packages:");
-        let is_packages_header = match after_key {
-            Some("") => true,
-            Some(rest) => {
-                rest.starts_with(|c: char| c.is_whitespace()) && rest.trim_start().starts_with('#')
-            }
-            None => false,
-        };
-        if is_packages_header {
-            in_packages = true;
-            continue;
-        }
-
-        // The value may instead be a YAML flow sequence on the header line
-        // (`packages: ['a/*', "b/*"]`) — pnpm's real YAML parser accepts it
-        // exactly like the block list. The sequence need not close on that
-        // line; the scanner consumes continuation lines up to the unquoted
-        // closing `]`.
-        if let Some(rest) = after_key {
-            if rest.starts_with(|c: char| c.is_whitespace()) && rest.trim_start().starts_with('[') {
-                return parse_yaml_flow_sequence(rest.trim_start(), &lines[idx + 1..]);
-            }
-        }
-
-        if in_packages {
-            // The flow sequence may equally sit on its own line below the
-            // header (`packages:` then `  ['a/*']`); the next-section check
-            // below would otherwise break on the `[` and silently drop every
-            // pattern. Only the section's first item line can open one —
-            // after a real block item, a `[` line means the section ended.
-            if patterns.is_empty() && trimmed.starts_with('[') {
-                return parse_yaml_flow_sequence(trimmed, &lines[idx + 1..]);
-            }
-
-            if !trimmed.is_empty() && !trimmed.starts_with('-') && !trimmed.starts_with('#') {
-                break;
-            }
-
-            if let Some(rest) = trimmed.strip_prefix('-') {
-                let item = parse_yaml_list_value(rest);
-                if !item.is_empty() {
-                    patterns.push(item);
-                }
-            }
-        }
-    }
-
-    patterns
-}
-
-/// Parse a YAML flow sequence (`['a', "b", c]`) into its scalar items.
-/// `first` starts at the `[`; when the sequence does not close on that line,
-/// scanning continues through `continuation` — pnpm's real parser accepts
-/// the multi-line spelling (`packages: [` with items on following lines) —
-/// until the unquoted closing `]`. Anything after the `]` (e.g. an inline
-/// comment) is ignored, and an unquoted whitespace-preceded `#` opens a
-/// comment running to end of line, so a `,` or `]` inside one neither splits
-/// nor closes the sequence. A `,` inside a quoted scalar is part of the
-/// value — a brace pattern carries one — not an item separator.
-fn parse_yaml_flow_sequence(first: &str, continuation: &[&str]) -> Vec<String> {
-    let mut items = Vec::new();
-    let mut current = String::new();
-    let mut quote: Option<char> = None;
-    // Skip the opening `[` (one ASCII byte).
-    let lines = std::iter::once(&first[1..]).chain(continuation.iter().copied());
-    'sequence: for line in lines {
-        // Start-of-line counts as whitespace: a leading `#` opens a comment.
-        let mut prev_is_whitespace = true;
-        'chars: for c in line.chars() {
-            match quote {
-                Some(q) => {
-                    current.push(c);
-                    if c == q {
-                        quote = None;
-                    }
-                }
-                None => match c {
-                    '\'' | '"' => {
-                        quote = Some(c);
-                        current.push(c);
-                    }
-                    ',' => items.push(std::mem::take(&mut current)),
-                    ']' => break 'sequence,
-                    // Comment through end of line.
-                    '#' if prev_is_whitespace => break 'chars,
-                    _ => current.push(c),
-                },
-            }
-            prev_is_whitespace = c.is_whitespace();
-        }
-        // A line break separates tokens like any other whitespace; it is
-        // never part of a scalar.
-        current.push(' ');
-    }
-    items.push(current);
-
-    items
-        .iter()
-        .map(|item| parse_yaml_list_value(item))
-        .filter(|item| !item.is_empty())
-        .collect()
-}
-
-/// Extract the scalar value of a YAML list item, handling surrounding quotes
-/// and trailing inline comments (`# ...`).
-fn parse_yaml_list_value(raw: &str) -> String {
-    let s = raw.trim();
-
-    // Quoted scalar: take the content between the first matching pair of
-    // quotes. Anything after the closing quote (e.g. an inline comment) is
-    // ignored, and a `#` inside the quotes stays part of the value.
-    for q in ['\'', '"'] {
-        if let Some(rest) = s.strip_prefix(q) {
-            if let Some(end) = rest.find(q) {
-                return rest[..end].to_string();
-            }
-        }
-    }
-
-    // A list item that is *only* a comment (`- # foo`) has no scalar value.
-    // The inline-comment scan below starts at index 1 (a `#` is a comment only
-    // when preceded by whitespace), so a leading `#` would otherwise survive as
-    // a bogus `"# foo"` pattern. Skip it here.
-    if s.starts_with('#') {
-        return String::new();
-    }
-
-    // Unquoted scalar: a `#` preceded by whitespace begins an inline comment.
-    let bytes = s.as_bytes();
-    let comment_start =
-        (1..bytes.len()).find(|&i| bytes[i] == b'#' && bytes[i - 1].is_ascii_whitespace());
-    let value = match comment_start {
-        Some(idx) => &s[..idx],
-        None => s,
-    };
-    value.trim().to_string()
-}
-
-/// Bounded-depth recursion limit for nested workspaces — deep enough for any
-/// real monorepo, a hard stop against a pattern that loops back on itself.
-const MAX_WORKSPACE_DEPTH: usize = 10;
-
-/// Collect workspace members matching the config's patterns, recursing into
-/// any member that is **itself** a workspace root (property 9's
-/// nested-workspace rule). A member's own `workspaces` patterns are resolved
-/// relative to that member's directory.
-async fn collect_workspace_members(
-    root_path: &Path,
-    config: &WorkspaceConfig,
-    depth: usize,
-    results: &mut Vec<PackageJsonLocation>,
-) {
-    if depth > MAX_WORKSPACE_DEPTH {
-        return;
-    }
-    for pattern in &config.patterns {
-        // npm (`@npmcli/map-workspaces`), yarn, and pnpm all support
-        // `!`-prefixed exclusion patterns, processed in order: a negation
-        // removes whatever earlier patterns matched. Resolve the negated
-        // pattern with the same matcher and drop those members.
-        if let Some(negated) = pattern.strip_prefix('!') {
-            let excluded = find_packages_matching_pattern(root_path, negated).await;
-            results.retain(|loc| !excluded.contains(&loc.path));
-            continue;
-        }
-        let packages = find_packages_matching_pattern(root_path, pattern).await;
-        for p in packages {
-            let member_dir = p.parent().map(Path::to_path_buf);
-            results.push(PackageJsonLocation {
-                path: p,
-                is_root: false,
-                is_workspace: true,
-            });
-            // If this member declares its own workspaces, configure ITS members
-            // too (one repo-root `setup` covers the whole nested tree). The
-            // final de-dup in `find_package_json_files` collapses any overlap.
-            if let Some(dir) = member_dir {
-                let member_pkg = dir.join("package.json");
-                let member_config = detect_workspaces(&member_pkg).await;
-                if !matches!(member_config.ws_type, WorkspaceType::None) {
-                    Box::pin(collect_workspace_members(
-                        &dir,
-                        &member_config,
-                        depth + 1,
-                        results,
-                    ))
-                    .await;
-                }
-            }
-        }
-    }
-}
-
-/// Find packages matching a workspace pattern.
-async fn find_packages_matching_pattern(root_path: &Path, pattern: &str) -> Vec<PathBuf> {
-    let mut results = Vec::new();
-
-    // A trailing `*`/`**` segment is a glob; everything before the final `/`
-    // is a (possibly empty, possibly multi-segment) directory prefix. Split on
-    // the *last* `/` so bare globs (`*`, `**`) and deeper prefixes (`a/b/*`)
-    // are handled, not just the two-segment `prefix/*` form.
-    let (prefix, last) = pattern.rsplit_once('/').unwrap_or(("", pattern));
-
-    match last {
-        "*" | "**" => {
-            let search_path = if prefix.is_empty() {
-                root_path.to_path_buf()
-            } else {
-                root_path.join(prefix)
-            };
-            if last == "*" {
-                search_one_level(&search_path, &mut results).await;
-            } else {
-                // Globstar matches zero segments too — npm/pnpm glob
-                // `<prefix>/**/package.json`, which matches the prefix dir's
-                // own `package.json` — so the prefix directory itself is a
-                // candidate member, not just its descendants. (For a bare
-                // `**` this re-finds the root manifest; the caller's de-dup
-                // keeps the root entry.)
-                let own_pkg = search_path.join("package.json");
-                if fs::metadata(&own_pkg).await.is_ok() {
-                    results.push(own_pkg);
-                }
-                search_recursive(&search_path, 0, usize::MAX, &mut results).await;
-            }
-        }
-        _ => {
-            let pkg_json = root_path.join(pattern).join("package.json");
-            if fs::metadata(&pkg_json).await.is_ok() {
-                results.push(pkg_json);
-            }
-        }
-    }
-
-    results
-}
-
-/// Directories that are never workspace members and must be skipped while
-/// walking the tree (hidden dirs plus dependency/output directories).
-fn is_ignored_dir(name: &str) -> bool {
-    name.starts_with('.') || name == "node_modules" || name == "dist" || name == "build"
-}
-
-/// Search one level deep for package.json files.
-async fn search_one_level(dir: &Path, results: &mut Vec<PathBuf>) {
-    for entry in list_dir_entries(dir).await {
-        let path = entry.path();
-        // A single-level `dir/*` glob follows a symlinked direct member, the
-        // way npm/pnpm resolve a workspace member
-        // that is itself a symlink. `entry.file_type()` reports the *link's*
-        // own type — `is_dir() == false` — so it would silently drop such a
-        // member; stat the path instead so the link is followed. (The
-        // recursive searcher below deliberately does NOT follow symlinks,
-        // to avoid loops/escapes — there a symlink's `is_dir() == false` is the
-        // desired skip.)
-        if !is_dir(&path).await {
-            continue;
-        }
-        // A `dir/*` pattern must not pick up node_modules/hidden/output dirs as
-        // workspace members, matching the recursive searchers below.
-        if is_ignored_dir(&entry.file_name().to_string_lossy()) {
-            continue;
-        }
-        let pkg_json = path.join("package.json");
-        if fs::metadata(&pkg_json).await.is_ok() {
-            results.push(pkg_json);
-        }
-    }
-}
-
-/// Search recursively for package.json files, descending at most `max_depth`
-/// directory levels below `dir` (pass `usize::MAX` for an unbounded walk).
-/// Symlinks are deliberately not followed — see `search_one_level`.
-async fn search_recursive(dir: &Path, depth: usize, max_depth: usize, results: &mut Vec<PathBuf>) {
-    if depth > max_depth {
-        return;
-    }
-
-    for entry in list_dir_entries(dir).await {
-        let Some(ft) = entry_file_type(&entry).await else {
-            continue;
-        };
-        if !ft.is_dir() {
-            continue;
-        }
-
-        // Skip hidden directories, node_modules, dist, build
-        if is_ignored_dir(&entry.file_name().to_string_lossy()) {
-            continue;
-        }
-
-        let full_path = entry.path();
-        let pkg_json = full_path.join("package.json");
-        if fs::metadata(&pkg_json).await.is_ok() {
-            results.push(pkg_json);
-        }
-
-        Box::pin(search_recursive(&full_path, depth + 1, max_depth, results)).await;
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    // ── Group 1: parse_pnpm_workspace_patterns ───────────────────────
-
-    #[test]
-    fn test_parse_pnpm_basic() {
-        let yaml = "packages:\n  - packages/*";
-        assert_eq!(parse_pnpm_workspace_patterns(yaml), vec!["packages/*"]);
-    }
-
-    #[test]
-    fn test_parse_pnpm_multiple_patterns() {
-        let yaml = "packages:\n  - packages/*\n  - apps/*\n  - tools/*";
-        assert_eq!(
-            parse_pnpm_workspace_patterns(yaml),
-            vec!["packages/*", "apps/*", "tools/*"]
-        );
-    }
-
-    #[test]
-    fn test_parse_pnpm_quoted_patterns() {
-        let yaml = "packages:\n  - 'packages/*'\n  - \"apps/*\"";
-        assert_eq!(
-            parse_pnpm_workspace_patterns(yaml),
-            vec!["packages/*", "apps/*"]
-        );
-    }
-
-    #[test]
-    fn test_parse_pnpm_comments_interspersed() {
-        let yaml = "packages:\n  # workspace packages\n  - packages/*\n  # apps\n  - apps/*";
-        assert_eq!(
-            parse_pnpm_workspace_patterns(yaml),
-            vec!["packages/*", "apps/*"]
-        );
-    }
-
-    #[test]
-    fn test_parse_pnpm_empty_content() {
-        assert!(parse_pnpm_workspace_patterns("").is_empty());
-    }
-
-    #[test]
-    fn test_parse_pnpm_no_packages_key() {
-        let yaml = "name: my-project\nversion: 1.0.0";
-        assert!(parse_pnpm_workspace_patterns(yaml).is_empty());
-    }
-
-    #[test]
-    fn test_parse_pnpm_stops_at_next_section() {
-        let yaml = "packages:\n  - packages/*\ncatalog:\n  lodash: 4.17.21";
-        assert_eq!(parse_pnpm_workspace_patterns(yaml), vec!["packages/*"]);
-    }
-
-    #[test]
-    fn test_parse_pnpm_indented_key() {
-        // The header is matched on the trimmed line, so leading spaces still match
-        let yaml = "  packages:\n  - packages/*";
-        assert_eq!(parse_pnpm_workspace_patterns(yaml), vec!["packages/*"]);
-    }
-
-    #[test]
-    fn test_parse_pnpm_dash_only_line() {
-        let yaml = "packages:\n  -\n  - packages/*";
-        // A bare "-" with no value should be skipped (empty after trim)
-        assert_eq!(parse_pnpm_workspace_patterns(yaml), vec!["packages/*"]);
-    }
-
-    #[test]
-    fn test_parse_pnpm_glob_star_star() {
-        let yaml = "packages:\n  - packages/**";
-        assert_eq!(parse_pnpm_workspace_patterns(yaml), vec!["packages/**"]);
-    }
-
-    #[test]
-    fn test_parse_pnpm_bom_first_line() {
-        // A UTF-8 BOM (Windows editors commonly write one) is NOT Unicode
-        // whitespace, so `trim` leaves it in place and a `packages:` header on
-        // the first line never matches — every pattern is silently lost, and
-        // because pnpm-workspace.yaml still marks the project as a pnpm
-        // workspace, no fallback walk runs: zero members discovered.
-        let yaml = "\u{feff}packages:\n  - packages/*";
-        assert_eq!(parse_pnpm_workspace_patterns(yaml), vec!["packages/*"]);
-    }
-
-    #[test]
-    fn test_parse_pnpm_flow_sequence() {
-        // pnpm parses pnpm-workspace.yaml with a real YAML parser, which accepts
-        // a flow sequence (`packages: ['a/*', "b/*"]`) exactly like the block
-        // list. The line-based header check only accepted a bare `packages:`
-        // (optionally plus a comment), so an inline sequence matched no header
-        // and every pattern was silently dropped — and because
-        // pnpm-workspace.yaml still marks the project as a pnpm workspace, no
-        // fallback walk runs: zero members discovered.
-        assert_eq!(
-            parse_pnpm_workspace_patterns("packages: ['packages/*', \"apps/*\"]"),
-            vec!["packages/*", "apps/*"]
-        );
-        // Unquoted items, an empty sequence, and a trailing inline comment.
-        assert_eq!(
-            parse_pnpm_workspace_patterns("packages: [packages/*] # globs"),
-            vec!["packages/*"]
-        );
-        assert!(parse_pnpm_workspace_patterns("packages: []").is_empty());
-    }
-
-    #[test]
-    fn test_parse_pnpm_flow_sequence_keeps_quoted_comma() {
-        // A `,` inside a quoted scalar is part of the value (a brace pattern
-        // carries one), so it must not split the sequence.
-        assert_eq!(
-            parse_pnpm_workspace_patterns("packages: ['{apps,libs}/*', '!**/test/**']"),
-            vec!["{apps,libs}/*", "!**/test/**"]
-        );
-    }
-
-    #[test]
-    fn test_parse_pnpm_flow_sequence_multiline() {
-        // A flow sequence need not close on the line it opens on: `packages: [`
-        // with items on the following lines is valid YAML, accepted by pnpm's
-        // real parser. The single-line scanner saw only the bare `[`, returned
-        // zero patterns, and — pnpm-workspace.yaml still marking the project
-        // as a pnpm workspace — every member was silently skipped.
-        assert_eq!(
-            parse_pnpm_workspace_patterns("packages: [\n  'packages/*',\n  \"apps/*\"\n]\n"),
-            vec!["packages/*", "apps/*"]
-        );
-        // Comments inside the sequence run to end of line; a `,` or `]` in
-        // one must not split or close the sequence. A quoted `,` stays part
-        // of its value across the line-by-line scan.
-        assert_eq!(
-            parse_pnpm_workspace_patterns(
-                "packages: [ # globs, right]\n  '{apps,libs}/*', # brace, glob\n  tools/*\n]"
-            ),
-            vec!["{apps,libs}/*", "tools/*"]
-        );
-    }
-
-    #[test]
-    fn test_parse_pnpm_flow_sequence_on_line_after_header() {
-        // The flow sequence may equally sit indented on its own line below the
-        // header (`packages:` then `  ['a']`); the next-section check must not
-        // break on the `[` line and drop every pattern.
-        assert_eq!(
-            parse_pnpm_workspace_patterns("packages:\n  ['packages/*', apps/*]"),
-            vec!["packages/*", "apps/*"]
-        );
-        // ...preceded by comment/blank lines, and itself spanning lines.
-        assert_eq!(
-            parse_pnpm_workspace_patterns("packages:\n  # globs\n\n  [\n    'packages/*'\n  ]"),
-            vec!["packages/*"]
-        );
-        // After a real block item a `[` line is NOT a flow sequence — the
-        // section simply ended (same next-section break as any other line).
-        assert_eq!(
-            parse_pnpm_workspace_patterns("packages:\n  - real/*\n['other']"),
-            vec!["real/*"]
-        );
-    }
-
-    #[tokio::test]
-    async fn detect_package_manager_accepts_every_table_flagged_pnpm_marker() {
-        // Behavioral pin on the format registry wiring: every row
-        // flagged PNPM_MARKER (including the `pnpm-lock.yml` spelling no
-        // other subsystem accepts) flips detection to Pnpm; an empty root
-        // stays Npm.
-        for name in registry::paths_with(registry::PNPM_MARKER) {
-            let dir = tempfile::tempdir().unwrap();
-            fs::write(dir.path().join(name), "").await.unwrap();
-            assert!(
-                matches!(
-                    detect_package_manager(dir.path()).await,
-                    PackageManager::Pnpm
-                ),
-                "{name} must flip detection to pnpm"
-            );
-        }
-        let dir = tempfile::tempdir().unwrap();
-        assert!(matches!(
-            detect_package_manager(dir.path()).await,
-            PackageManager::Npm
-        ));
-    }
-
-    #[test]
-    fn pnpm_marker_spellings_are_pinned_by_value() {
-        // Hardcoded on purpose, breaking the self-reference: production code
-        // iterates the same registry PNPM_MARKER expression the guard
-        // test above does, so a row deleted from the table would shrink code
-        // and guard together while `.yml` detection silently vanished. This
-        // list cannot shrink with them.
-        let mut spellings = registry::paths_with(registry::PNPM_MARKER);
-        spellings.sort_unstable();
-        assert_eq!(
-            spellings,
-            ["pnpm-lock.yaml", "pnpm-lock.yml", "pnpm-workspace.yaml"]
-        );
-    }
-
-    // ── Group 2: workspace detection + file discovery ────────────────
-
-    #[tokio::test]
-    async fn test_detect_workspaces_npm_array() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        fs::write(&pkg, r#"{"workspaces": ["packages/*"]}"#)
-            .await
-            .unwrap();
-        let config = detect_workspaces(&pkg).await;
-        assert!(matches!(config.ws_type, WorkspaceType::Npm));
-        assert_eq!(config.patterns, vec!["packages/*"]);
-    }
-
-    #[tokio::test]
-    async fn test_detect_workspaces_npm_object() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        fs::write(
-            &pkg,
-            r#"{"workspaces": {"packages": ["packages/*", "apps/*"]}}"#,
-        )
-        .await
-        .unwrap();
-        let config = detect_workspaces(&pkg).await;
-        assert!(matches!(config.ws_type, WorkspaceType::Npm));
-        assert_eq!(config.patterns, vec!["packages/*", "apps/*"]);
-    }
-
-    #[tokio::test]
-    async fn test_detect_workspaces_pnpm() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        fs::write(&pkg, r#"{"name": "root"}"#).await.unwrap();
-        let pnpm = dir.path().join("pnpm-workspace.yaml");
-        fs::write(&pnpm, "packages:\n  - packages/*").await.unwrap();
-        let config = detect_workspaces(&pkg).await;
-        assert!(matches!(config.ws_type, WorkspaceType::Pnpm));
-        assert_eq!(config.patterns, vec!["packages/*"]);
-    }
-
-    #[tokio::test]
-    async fn test_detect_workspaces_pnpm_with_workspaces_field() {
-        // When both pnpm-workspace.yaml AND "workspaces" in package.json
-        // exist, pnpm should take priority
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        fs::write(&pkg, r#"{"name": "root", "workspaces": ["packages/*"]}"#)
-            .await
-            .unwrap();
-        let pnpm = dir.path().join("pnpm-workspace.yaml");
-        fs::write(&pnpm, "packages:\n  - workspaces/*")
-            .await
-            .unwrap();
-        let config = detect_workspaces(&pkg).await;
-        assert!(matches!(config.ws_type, WorkspaceType::Pnpm));
-        // Should use pnpm-workspace.yaml patterns, not package.json workspaces
-        assert_eq!(config.patterns, vec!["workspaces/*"]);
-    }
-
-    #[tokio::test]
-    async fn test_detect_workspaces_pnpm_with_malformed_package_json() {
-        // Regression: pnpm-workspace.yaml is the definitive signal and must be
-        // honored even when the root package.json is not valid JSON.
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        // JSONC-style comment — valid for some tooling, invalid for serde_json.
-        fs::write(&pkg, "{\n  // a comment\n  \"name\": \"root\"\n}")
-            .await
-            .unwrap();
-        let pnpm = dir.path().join("pnpm-workspace.yaml");
-        fs::write(&pnpm, "packages:\n  - packages/*").await.unwrap();
-        let config = detect_workspaces(&pkg).await;
-        assert!(matches!(config.ws_type, WorkspaceType::Pnpm));
-        assert_eq!(config.patterns, vec!["packages/*"]);
-    }
-
-    #[tokio::test]
-    async fn test_detect_workspaces_npm_with_bom() {
-        // npm strips a leading UTF-8 BOM before parsing package.json, so a
-        // BOM'd manifest is npm-valid; its workspaces must not be silently
-        // dropped (which would demote the project to "no workspace").
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        fs::write(&pkg, "\u{feff}{\"workspaces\": [\"packages/*\"]}")
-            .await
-            .unwrap();
-        let config = detect_workspaces(&pkg).await;
-        assert!(matches!(config.ws_type, WorkspaceType::Npm));
-        assert_eq!(config.patterns, vec!["packages/*"]);
-    }
-
-    #[tokio::test]
-    async fn test_find_bom_root_workspace_negation_honored() {
-        // End-to-end symptom of the BOM gap: with a BOM'd root manifest the
-        // workspace config silently degraded to None, so members were found
-        // only by the fallback walk — mislabeled as non-workspace and with
-        // `!`-negations ignored, letting setup edit an excluded package.
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(
-            dir.path().join("package.json"),
-            "\u{feff}{\"workspaces\": [\"packages/*\", \"!packages/private\"]}",
-        )
-        .await
-        .unwrap();
-        for member in ["a", "private"] {
-            let m = dir.path().join("packages").join(member);
-            fs::create_dir_all(&m).await.unwrap();
-            fs::write(m.join("package.json"), r#"{"name":"m"}"#)
-                .await
-                .unwrap();
-        }
-        let result = find_package_json_files(dir.path()).await;
-        assert!(matches!(result.workspace_type, WorkspaceType::Npm));
-        let members: Vec<_> = result.files.iter().filter(|f| f.is_workspace).collect();
-        assert_eq!(
-            members.len(),
-            1,
-            "negated member must stay excluded under a BOM'd root: {:?}",
-            result.files.iter().map(|f| &f.path).collect::<Vec<_>>()
-        );
-        assert!(members[0].path.ends_with("packages/a/package.json"));
-    }
-
-    #[tokio::test]
-    async fn test_detect_workspaces_none() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        fs::write(&pkg, r#"{"name": "root"}"#).await.unwrap();
-        let config = detect_workspaces(&pkg).await;
-        assert!(matches!(config.ws_type, WorkspaceType::None));
-        assert!(config.patterns.is_empty());
-    }
-
-    #[tokio::test]
-    async fn test_detect_workspaces_non_array_workspaces_field() {
-        // "workspaces" present but neither array nor object (a bare string,
-        // null, ...) hits the else-arm: WorkspaceType::Npm with zero
-        // patterns. Characterizes the current contract — note this also
-        // suppresses the no-workspace fallback walk (pinned end-to-end
-        // below); if the team decides such values should degrade to
-        // WorkspaceType::None (npm semantics), update detect_workspaces and
-        // flip these assertions together.
-        for spelling in [r#"{"workspaces": "packages/*"}"#, r#"{"workspaces": null}"#] {
-            let dir = tempfile::tempdir().unwrap();
-            let pkg = dir.path().join("package.json");
-            fs::write(&pkg, spelling).await.unwrap();
-            let config = detect_workspaces(&pkg).await;
-            assert!(
-                matches!(config.ws_type, WorkspaceType::Npm),
-                "non-array workspaces must still read as npm: {spelling}"
-            );
-            assert!(
-                config.patterns.is_empty(),
-                "no patterns can be extracted from: {spelling}"
-            );
-        }
-    }
-
-    #[tokio::test]
-    async fn test_find_non_array_workspaces_suppresses_fallback_walk() {
-        // End-to-end consequence of the else-arm above: a non-array
-        // "workspaces" value marks the project as an (empty) npm workspace,
-        // so the no-workspace fallback walk never runs and a nested manifest
-        // is NOT discovered — only the root comes back.
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(
-            dir.path().join("package.json"),
-            r#"{"workspaces": "packages/*"}"#,
-        )
-        .await
-        .unwrap();
-        let sub = dir.path().join("packages").join("a");
-        fs::create_dir_all(&sub).await.unwrap();
-        fs::write(sub.join("package.json"), r#"{"name":"a"}"#)
-            .await
-            .unwrap();
-        let result = find_package_json_files(dir.path()).await;
-        assert!(matches!(result.workspace_type, WorkspaceType::Npm));
-        assert_eq!(
-            result.files.len(),
-            1,
-            "only the root must be found: {:?}",
-            result.files.iter().map(|f| &f.path).collect::<Vec<_>>()
-        );
-        assert!(result.files[0].is_root);
-    }
-
-    #[tokio::test]
-    async fn test_detect_workspaces_invalid_json() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        fs::write(&pkg, "not valid json!!!").await.unwrap();
-        let config = detect_workspaces(&pkg).await;
-        assert!(matches!(config.ws_type, WorkspaceType::None));
-    }
-
-    #[tokio::test]
-    async fn test_detect_workspaces_file_not_found() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("nonexistent.json");
-        let config = detect_workspaces(&pkg).await;
-        assert!(matches!(config.ws_type, WorkspaceType::None));
-    }
-
-    #[tokio::test]
-    async fn test_find_no_root_package_json() {
-        let dir = tempfile::tempdir().unwrap();
-        let result = find_package_json_files(dir.path()).await;
-        assert!(result.files.is_empty());
-    }
-
-    #[tokio::test]
-    async fn test_find_root_only() {
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(dir.path().join("package.json"), r#"{"name":"root"}"#)
-            .await
-            .unwrap();
-        let result = find_package_json_files(dir.path()).await;
-        assert_eq!(result.files.len(), 1);
-        assert!(result.files[0].is_root);
-    }
-
-    #[tokio::test]
-    async fn test_find_npm_workspaces() {
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(
-            dir.path().join("package.json"),
-            r#"{"workspaces": ["packages/*"]}"#,
-        )
-        .await
-        .unwrap();
-        let pkg_a = dir.path().join("packages").join("a");
-        fs::create_dir_all(&pkg_a).await.unwrap();
-        fs::write(pkg_a.join("package.json"), r#"{"name":"a"}"#)
-            .await
-            .unwrap();
-        let result = find_package_json_files(dir.path()).await;
-        assert!(matches!(result.workspace_type, WorkspaceType::Npm));
-        // root + workspace member
-        assert_eq!(result.files.len(), 2);
-        assert!(result.files[0].is_root);
-        assert!(result.files[1].is_workspace);
-    }
-
-    #[tokio::test]
-    async fn test_find_pnpm_workspaces() {
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(dir.path().join("package.json"), r#"{"name":"root"}"#)
-            .await
-            .unwrap();
-        fs::write(
-            dir.path().join("pnpm-workspace.yaml"),
-            "packages:\n  - packages/*",
-        )
-        .await
-        .unwrap();
-        let pkg_a = dir.path().join("packages").join("a");
-        fs::create_dir_all(&pkg_a).await.unwrap();
-        fs::write(pkg_a.join("package.json"), r#"{"name":"a"}"#)
-            .await
-            .unwrap();
-        let result = find_package_json_files(dir.path()).await;
-        assert!(matches!(result.workspace_type, WorkspaceType::Pnpm));
-        // find_package_json_files still returns all files;
-        // filtering for pnpm is done by the caller (setup command)
-        assert_eq!(result.files.len(), 2);
-        assert!(result.files[0].is_root);
-        assert!(result.files[1].is_workspace);
-    }
-
-    #[tokio::test]
-    async fn test_find_pnpm_flow_sequence_members_discovered() {
-        // End-to-end symptom of the flow-sequence gap: the inline
-        // `packages: [...]` spelling yielded no patterns, so a real pnpm
-        // workspace reported zero members — and the fallback walk that would
-        // otherwise have found them is skipped for a pnpm workspace.
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(dir.path().join("package.json"), r#"{"name":"root"}"#)
-            .await
-            .unwrap();
-        fs::write(
-            dir.path().join("pnpm-workspace.yaml"),
-            "packages: ['packages/*']\n",
-        )
-        .await
-        .unwrap();
-        let pkg_a = dir.path().join("packages").join("a");
-        fs::create_dir_all(&pkg_a).await.unwrap();
-        fs::write(pkg_a.join("package.json"), r#"{"name":"a"}"#)
-            .await
-            .unwrap();
-        let result = find_package_json_files(dir.path()).await;
-        assert!(matches!(result.workspace_type, WorkspaceType::Pnpm));
-        assert!(
-            result
-                .files
-                .iter()
-                .any(|f| f.is_workspace && f.path.ends_with("packages/a/package.json")),
-            "flow-sequence member must be discovered: {:?}",
-            result.files.iter().map(|f| &f.path).collect::<Vec<_>>()
-        );
-    }
-
-    #[tokio::test]
-    async fn test_find_pnpm_multiline_flow_sequence_members_discovered() {
-        // The multi-line spelling of the same gap: `packages: [` with items on
-        // the following lines parsed to zero patterns (the scanner saw only
-        // the bare `[`), so a real pnpm workspace reported zero members — and
-        // the fallback walk that would otherwise have found them is skipped
-        // for a pnpm workspace.
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(dir.path().join("package.json"), r#"{"name":"root"}"#)
-            .await
-            .unwrap();
-        fs::write(
-            dir.path().join("pnpm-workspace.yaml"),
-            "packages: [\n  'packages/*'\n]\n",
-        )
-        .await
-        .unwrap();
-        let pkg_a = dir.path().join("packages").join("a");
-        fs::create_dir_all(&pkg_a).await.unwrap();
-        fs::write(pkg_a.join("package.json"), r#"{"name":"a"}"#)
-            .await
-            .unwrap();
-        let result = find_package_json_files(dir.path()).await;
-        assert!(matches!(result.workspace_type, WorkspaceType::Pnpm));
-        assert!(
-            result
-                .files
-                .iter()
-                .any(|f| f.is_workspace && f.path.ends_with("packages/a/package.json")),
-            "multi-line flow-sequence member must be discovered: {:?}",
-            result.files.iter().map(|f| &f.path).collect::<Vec<_>>()
-        );
-    }
-
-    #[tokio::test]
-    async fn test_find_nested_skips_node_modules() {
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(dir.path().join("package.json"), r#"{"name":"root"}"#)
-            .await
-            .unwrap();
-        let nm = dir.path().join("node_modules").join("lodash");
-        fs::create_dir_all(&nm).await.unwrap();
-        fs::write(nm.join("package.json"), r#"{"name":"lodash"}"#)
-            .await
-            .unwrap();
-        let result = find_package_json_files(dir.path()).await;
-        // Only root, node_modules should be skipped
-        assert_eq!(result.files.len(), 1);
-        assert!(result.files[0].is_root);
-    }
-
-    #[tokio::test]
-    async fn test_find_nested_depth_limit() {
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(dir.path().join("package.json"), r#"{"name":"root"}"#)
-            .await
-            .unwrap();
-        // Create deeply nested package.json at depth 7 (> limit of 5)
-        let mut deep = dir.path().to_path_buf();
-        for i in 0..7 {
-            deep = deep.join(format!("level{}", i));
-        }
-        fs::create_dir_all(&deep).await.unwrap();
-        fs::write(deep.join("package.json"), r#"{"name":"deep"}"#)
-            .await
-            .unwrap();
-        let result = find_package_json_files(dir.path()).await;
-        // Only root (the deep one exceeds depth limit)
-        assert_eq!(result.files.len(), 1);
-    }
-
-    #[tokio::test]
-    async fn test_find_nested_manifest_without_workspaces() {
-        // No workspace config at all: the bounded fallback walk picks up a
-        // plain nested manifest and labels it {is_root: false,
-        // is_workspace: false} — the location contract `setup` relies on to
-        // tell fallback-walk hits apart from real workspace members.
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(dir.path().join("package.json"), r#"{"name":"root"}"#)
-            .await
-            .unwrap();
-        let sub = dir.path().join("sub");
-        fs::create_dir_all(&sub).await.unwrap();
-        fs::write(sub.join("package.json"), r#"{"name":"sub"}"#)
-            .await
-            .unwrap();
-        let result = find_package_json_files(dir.path()).await;
-        assert!(matches!(result.workspace_type, WorkspaceType::None));
-        assert_eq!(
-            result.files.len(),
-            2,
-            "root + nested manifest: {:?}",
-            result.files.iter().map(|f| &f.path).collect::<Vec<_>>()
-        );
-        assert!(result.files[0].is_root);
-        let nested = &result.files[1];
-        assert!(nested.path.ends_with("sub/package.json"));
-        assert!(!nested.is_root, "fallback-walk hit is not the root");
-        assert!(
-            !nested.is_workspace,
-            "fallback-walk hit is not a workspace member"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_find_nested_depth_boundary_included() {
-        // The fallback walk's guard is `depth > 5`, and a call at depth d
-        // discovers manifests one directory level below it — so a manifest
-        // exactly 6 levels down is the LAST included tier. The sibling test
-        // above pins exclusion at 7 levels; this pins the boundary from the
-        // inside so a future off-by-one can't silently shrink the walk.
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(dir.path().join("package.json"), r#"{"name":"root"}"#)
-            .await
-            .unwrap();
-        let mut deep = dir.path().to_path_buf();
-        for i in 0..6 {
-            deep = deep.join(format!("level{}", i));
-        }
-        fs::create_dir_all(&deep).await.unwrap();
-        fs::write(deep.join("package.json"), r#"{"name":"deep"}"#)
-            .await
-            .unwrap();
-        let result = find_package_json_files(dir.path()).await;
-        assert_eq!(
-            result.files.len(),
-            2,
-            "manifest 6 levels down must still be found: {:?}",
-            result.files.iter().map(|f| &f.path).collect::<Vec<_>>()
-        );
-        let nested = &result.files[1];
-        assert!(nested
-            .path
-            .ends_with("level0/level1/level2/level3/level4/level5/package.json"));
-        assert!(!nested.is_root && !nested.is_workspace);
-    }
-
-    #[tokio::test]
-    async fn test_find_workspace_double_glob() {
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(
-            dir.path().join("package.json"),
-            r#"{"workspaces": ["apps/**"]}"#,
-        )
-        .await
-        .unwrap();
-        let nested = dir.path().join("apps").join("web").join("client");
-        fs::create_dir_all(&nested).await.unwrap();
-        fs::write(nested.join("package.json"), r#"{"name":"client"}"#)
-            .await
-            .unwrap();
-        let result = find_package_json_files(dir.path()).await;
-        // root + recursively found workspace member
-        assert!(result.files.len() >= 2);
-    }
-
-    #[tokio::test]
-    async fn test_find_recurses_into_nested_workspace() {
-        // Property 9: a workspace member that is itself a workspace root has ITS
-        // members discovered too. root → packages/inner → sub/leaf.
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(
-            dir.path().join("package.json"),
-            r#"{"name":"root","workspaces":["packages/*"]}"#,
-        )
-        .await
-        .unwrap();
-        let inner = dir.path().join("packages").join("inner");
-        fs::create_dir_all(&inner).await.unwrap();
-        fs::write(
-            inner.join("package.json"),
-            r#"{"name":"inner","workspaces":["sub/*"]}"#,
-        )
-        .await
-        .unwrap();
-        let leaf = inner.join("sub").join("leaf");
-        fs::create_dir_all(&leaf).await.unwrap();
-        fs::write(leaf.join("package.json"), r#"{"name":"leaf"}"#)
-            .await
-            .unwrap();
-
-        let result = find_package_json_files(dir.path()).await;
-        let paths: Vec<String> = result
-            .files
-            .iter()
-            .map(|f| f.path.to_string_lossy().into_owned())
-            .collect();
-        // `Path::ends_with` matches whole path components and treats `/` in the
-        // pattern as a separator on every platform (Windows accepts both `/`
-        // and `\`), so this is correct regardless of the OS path separator —
-        // unlike a byte-wise `str::ends_with` on a forward-slash literal, which
-        // fails on Windows' `\`-separated paths.
-        assert!(
-            result
-                .files
-                .iter()
-                .any(|f| f.path.ends_with("packages/inner/package.json")),
-            "first-level member must be found: {paths:?}"
-        );
-        assert!(
-            result
-                .files
-                .iter()
-                .any(|f| f.path.ends_with("packages/inner/sub/leaf/package.json")),
-            "nested-workspace leaf must be found via recursion: {paths:?}"
-        );
-        // root + inner + leaf, no duplicates.
-        assert_eq!(
-            result.files.len(),
-            3,
-            "exactly root + inner + leaf: {paths:?}"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_find_workspace_exact_path() {
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(
-            dir.path().join("package.json"),
-            r#"{"workspaces": ["packages/core"]}"#,
-        )
-        .await
-        .unwrap();
-        let core = dir.path().join("packages").join("core");
-        fs::create_dir_all(&core).await.unwrap();
-        fs::write(core.join("package.json"), r#"{"name":"core"}"#)
-            .await
-            .unwrap();
-        let result = find_package_json_files(dir.path()).await;
-        assert_eq!(result.files.len(), 2);
-    }
-
-    #[test]
-    fn test_parse_pnpm_inline_comment_stripped() {
-        // A `# ...` inline comment after a pattern must not become part of it.
-        let yaml = "packages:\n  - packages/*  # workspace packages\n  - apps/*\t# trailing tab";
-        assert_eq!(
-            parse_pnpm_workspace_patterns(yaml),
-            vec!["packages/*", "apps/*"]
-        );
-    }
-
-    #[test]
-    fn test_parse_pnpm_comment_only_list_item_skipped() {
-        // A `- # comment` item is a YAML null (the value is just a comment) and
-        // must NOT become a literal `"# comment"` workspace pattern (the
-        // inline-comment scan must consider index 0).
-        let yaml = "packages:\n  - # only a comment\n  - real/*";
-        assert_eq!(parse_pnpm_workspace_patterns(yaml), vec!["real/*"]);
-    }
-
-    #[test]
-    fn test_parse_pnpm_quoted_value_keeps_hash() {
-        // A `#` inside quotes is part of the value, not a comment.
-        let yaml = "packages:\n  - 'packages/#weird'  # but this is a comment";
-        assert_eq!(parse_pnpm_workspace_patterns(yaml), vec!["packages/#weird"]);
-    }
-
-    #[test]
-    fn test_parse_pnpm_unterminated_quote_kept_verbatim() {
-        // Malformed YAML: a quoted scalar with no closing quote. The quote
-        // scan in `parse_yaml_list_value` finds no matching pair and falls
-        // through to the unquoted-scalar path, so the item is neither
-        // dropped nor panicking — the raw text survives, leading quote
-        // included. Characterizes the fallthrough; if malformed quotes
-        // should instead be rejected, change parse_yaml_list_value and
-        // assert emptiness here.
-        assert_eq!(
-            parse_pnpm_workspace_patterns("packages:\n  - 'packages/*"),
-            vec!["'packages/*"]
-        );
-        assert_eq!(
-            parse_pnpm_workspace_patterns("packages:\n  - \"packages/*"),
-            vec!["\"packages/*"]
-        );
-    }
-
-    #[tokio::test]
-    async fn test_find_overlapping_patterns_no_duplicates() {
-        // "packages/*" and the exact "packages/a" both match the same member;
-        // the result must contain it only once.
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(
-            dir.path().join("package.json"),
-            r#"{"workspaces": ["packages/*", "packages/a"]}"#,
-        )
-        .await
-        .unwrap();
-        let a = dir.path().join("packages").join("a");
-        fs::create_dir_all(&a).await.unwrap();
-        fs::write(a.join("package.json"), r#"{"name":"a"}"#)
-            .await
-            .unwrap();
-        let result = find_package_json_files(dir.path()).await;
-        // root + exactly one workspace member (no duplicate for packages/a)
-        assert_eq!(result.files.len(), 2);
-        assert!(result.files[0].is_root);
-        let workspace_count = result.files.iter().filter(|f| f.is_workspace).count();
-        assert_eq!(workspace_count, 1);
-    }
-
-    #[tokio::test]
-    async fn test_find_star_pattern_skips_node_modules() {
-        // A `packages/*` glob must not treat node_modules (or hidden/output
-        // dirs) as a workspace member, even if they contain a package.json.
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(
-            dir.path().join("package.json"),
-            r#"{"workspaces": ["packages/*"]}"#,
-        )
-        .await
-        .unwrap();
-        let real = dir.path().join("packages").join("real");
-        fs::create_dir_all(&real).await.unwrap();
-        fs::write(real.join("package.json"), r#"{"name":"real"}"#)
-            .await
-            .unwrap();
-        for ignored in ["node_modules", ".cache", "dist", "build"] {
-            let d = dir.path().join("packages").join(ignored);
-            fs::create_dir_all(&d).await.unwrap();
-            fs::write(d.join("package.json"), r#"{"name":"x"}"#)
-                .await
-                .unwrap();
-        }
-        let result = find_package_json_files(dir.path()).await;
-        // root + only the "real" member
-        assert_eq!(result.files.len(), 2);
-        let workspace_count = result.files.iter().filter(|f| f.is_workspace).count();
-        assert_eq!(workspace_count, 1);
-    }
-
-    #[tokio::test]
-    async fn test_find_workspace_bare_star() {
-        // A bare `*` glob means "every immediate subdirectory" and must be
-        // expanded, not treated as a literal directory named `*`.
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(dir.path().join("package.json"), r#"{"workspaces": ["*"]}"#)
-            .await
-            .unwrap();
-        for member in ["a", "b"] {
-            let m = dir.path().join(member);
-            fs::create_dir_all(&m).await.unwrap();
-            fs::write(m.join("package.json"), r#"{"name":"m"}"#)
-                .await
-                .unwrap();
-        }
-        // node_modules must still be ignored even for a root-level `*`.
-        let nm = dir.path().join("node_modules").join("dep");
-        fs::create_dir_all(&nm).await.unwrap();
-        fs::write(nm.join("package.json"), r#"{"name":"dep"}"#)
-            .await
-            .unwrap();
-        let result = find_package_json_files(dir.path()).await;
-        let workspace_count = result.files.iter().filter(|f| f.is_workspace).count();
-        // root + members a and b (node_modules excluded)
-        assert_eq!(workspace_count, 2);
-        assert!(result.files[0].is_root);
-    }
-
-    #[tokio::test]
-    async fn test_find_workspace_bare_double_glob() {
-        // A bare `**` glob recurses from the root.
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(dir.path().join("package.json"), r#"{"workspaces": ["**"]}"#)
-            .await
-            .unwrap();
-        let nested = dir.path().join("a").join("b");
-        fs::create_dir_all(&nested).await.unwrap();
-        fs::write(nested.join("package.json"), r#"{"name":"b"}"#)
-            .await
-            .unwrap();
-        let result = find_package_json_files(dir.path()).await;
-        let workspace_count = result.files.iter().filter(|f| f.is_workspace).count();
-        assert!(workspace_count >= 1);
-    }
-
-    #[tokio::test]
-    async fn test_find_workspace_deep_prefix_glob() {
-        // A glob with a multi-segment prefix (`group/sub/*`) must expand the
-        // directory under that prefix, not be treated as a literal path.
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(
-            dir.path().join("package.json"),
-            r#"{"workspaces": ["group/sub/*"]}"#,
-        )
-        .await
-        .unwrap();
-        let member = dir.path().join("group").join("sub").join("pkg");
-        fs::create_dir_all(&member).await.unwrap();
-        fs::write(member.join("package.json"), r#"{"name":"pkg"}"#)
-            .await
-            .unwrap();
-        let result = find_package_json_files(dir.path()).await;
-        let workspace_count = result.files.iter().filter(|f| f.is_workspace).count();
-        assert_eq!(workspace_count, 1);
-    }
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_find_star_glob_follows_symlinked_member() {
-        // A single-level `packages/*` glob must follow a workspace member that
-        // is itself a symlink (npm/pnpm resolve such members).
-        // `entry.file_type()` reports the link as a non-directory, so gating on
-        // it would drop the member and `setup` would never patch the package.
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(
-            dir.path().join("package.json"),
-            r#"{"workspaces": ["packages/*"]}"#,
-        )
-        .await
-        .unwrap();
-        // The real member lives outside `packages/`; `packages/a` links to it.
-        let real = dir.path().join("real");
-        fs::create_dir_all(&real).await.unwrap();
-        fs::write(real.join("package.json"), r#"{"name":"a"}"#)
-            .await
-            .unwrap();
-        fs::create_dir_all(dir.path().join("packages"))
-            .await
-            .unwrap();
-        std::os::unix::fs::symlink(&real, dir.path().join("packages").join("a")).unwrap();
-
-        let result = find_package_json_files(dir.path()).await;
-        let workspace_count = result.files.iter().filter(|f| f.is_workspace).count();
-        assert_eq!(
-            workspace_count,
-            1,
-            "symlinked workspace member must be discovered: {:?}",
-            result.files.iter().map(|f| &f.path).collect::<Vec<_>>()
-        );
-    }
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_find_double_glob_does_not_follow_symlinks() {
-        // The asymmetric counterpart: a recursive `apps/**` glob must NOT follow
-        // symlinks — a loop back to an ancestor would recurse forever and an
-        // escaping link would let `setup` edit an out-of-tree manifest. Only the
-        // real on-disk member is discovered.
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(
-            dir.path().join("package.json"),
-            r#"{"workspaces": ["apps/**"]}"#,
-        )
-        .await
-        .unwrap();
-        let real = dir.path().join("apps").join("web");
-        fs::create_dir_all(&real).await.unwrap();
-        fs::write(real.join("package.json"), r#"{"name":"web"}"#)
-            .await
-            .unwrap();
-        // A loop symlink back to the repo root and an escape symlink to an
-        // out-of-tree package — neither must be traversed.
-        std::os::unix::fs::symlink(dir.path(), dir.path().join("apps").join("loop")).unwrap();
-        let outside = tempfile::tempdir().unwrap();
-        fs::write(outside.path().join("package.json"), r#"{"name":"escape"}"#)
-            .await
-            .unwrap();
-        std::os::unix::fs::symlink(outside.path(), dir.path().join("apps").join("escape")).unwrap();
-
-        let result = find_package_json_files(dir.path()).await;
-        let workspace_count = result.files.iter().filter(|f| f.is_workspace).count();
-        assert_eq!(
-            workspace_count,
-            1,
-            "only the real member must be found; symlinks not followed: {:?}",
-            result.files.iter().map(|f| &f.path).collect::<Vec<_>>()
-        );
-    }
-
-    /// mkfifo(2) directly, not the /usr/bin/mkfifo binary: spawning a child
-    /// flakes under heavy parallel load (fork/exec starvation) and the
-    /// syscall needs no process at all.
-    #[cfg(unix)]
-    fn mkfifo(path: &Path) {
-        use std::os::unix::ffi::OsStrExt;
-        let c_path =
-            std::ffi::CString::new(path.as_os_str().as_bytes()).expect("fifo path has no NUL");
-        let rc = unsafe { libc::mkfifo(c_path.as_ptr(), 0o644) };
-        assert_eq!(
-            rc,
-            0,
-            "mkfifo(2) failed: {}",
-            std::io::Error::last_os_error()
-        );
-    }
-
-    /// A FIFO planted as `pnpm-workspace.yaml` must not wedge discovery. The
-    /// workspace probe used a plain `tokio::fs::read_to_string`, whose
-    /// `open(2)` on a FIFO waits for a writer that never comes — so one
-    /// special file in the project root wedged `setup` indefinitely, with no
-    /// error and no timeout. Same class as the `open_regular_file` guards in
-    /// the npm/composer/python/ruby crawlers. An unreadable
-    /// pnpm-workspace.yaml falls through to the package.json `workspaces`
-    /// field, like a directory of that name already does.
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn pnpm_workspace_fifo_does_not_wedge_discovery() {
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(
-            dir.path().join("package.json"),
-            r#"{"workspaces": ["packages/*"]}"#,
-        )
-        .await
-        .unwrap();
-        let fifo = dir.path().join("pnpm-workspace.yaml");
-        mkfifo(&fifo);
-        let a = dir.path().join("packages").join("a");
-        fs::create_dir_all(&a).await.unwrap();
-        fs::write(a.join("package.json"), r#"{"name":"a"}"#)
-            .await
-            .unwrap();
-
-        // On timeout the open is wedged in a `spawn_blocking` thread that
-        // the runtime waits for on shutdown; connect a writer to release
-        // it so the test can FAIL instead of hanging the whole suite.
-        let deadline = std::time::Duration::from_secs(5);
-        let Ok(result) = tokio::time::timeout(deadline, find_package_json_files(dir.path())).await
-        else {
-            let _ = std::fs::OpenOptions::new().write(true).open(&fifo);
-            panic!("discovery must complete promptly with a FIFO pnpm-workspace.yaml");
-        };
-        assert!(matches!(result.workspace_type, WorkspaceType::Npm));
-        assert!(
-            result
-                .files
-                .iter()
-                .any(|f| f.is_workspace && f.path.ends_with("packages/a/package.json")),
-            "member must still be found via the package.json fallback: {:?}",
-            result.files.iter().map(|f| &f.path).collect::<Vec<_>>()
-        );
-    }
-
-    /// The member-manifest twin: every glob-discovered workspace member has
-    /// its package.json read (nested-workspace probe), so a FIFO planted as
-    /// any member's package.json wedged discovery the same way.
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn member_package_json_fifo_does_not_wedge_discovery() {
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(
-            dir.path().join("package.json"),
-            r#"{"workspaces": ["packages/*"]}"#,
-        )
-        .await
-        .unwrap();
-        let a = dir.path().join("packages").join("a");
-        fs::create_dir_all(&a).await.unwrap();
-        let fifo = a.join("package.json");
-        mkfifo(&fifo);
-        let b = dir.path().join("packages").join("b");
-        fs::create_dir_all(&b).await.unwrap();
-        fs::write(b.join("package.json"), r#"{"name":"b"}"#)
-            .await
-            .unwrap();
-
-        let deadline = std::time::Duration::from_secs(5);
-        let Ok(result) = tokio::time::timeout(deadline, find_package_json_files(dir.path())).await
-        else {
-            let _ = std::fs::OpenOptions::new().write(true).open(&fifo);
-            panic!("discovery must complete promptly with a FIFO member package.json");
-        };
-        assert!(
-            result
-                .files
-                .iter()
-                .any(|f| f.is_workspace && f.path.ends_with("packages/b/package.json")),
-            "the real member must still be found: {:?}",
-            result.files.iter().map(|f| &f.path).collect::<Vec<_>>()
-        );
-    }
-
-    #[tokio::test]
-    async fn test_find_workspace_negation_excludes_member() {
-        // npm (`@npmcli/map-workspaces`), yarn, and pnpm all support
-        // `!`-prefixed exclusion patterns: a member matched by an earlier
-        // pattern and then negated is NOT a workspace member. `!pattern` must
-        // not be treated as a literal directory named `!packages`, or `setup`
-        // edits a package.json the user explicitly excluded.
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(
-            dir.path().join("package.json"),
-            r#"{"workspaces": ["packages/*", "!packages/private"]}"#,
-        )
-        .await
-        .unwrap();
-        for member in ["a", "private"] {
-            let m = dir.path().join("packages").join(member);
-            fs::create_dir_all(&m).await.unwrap();
-            fs::write(m.join("package.json"), r#"{"name":"m"}"#)
-                .await
-                .unwrap();
-        }
-        let result = find_package_json_files(dir.path()).await;
-        let members: Vec<_> = result.files.iter().filter(|f| f.is_workspace).collect();
-        assert_eq!(
-            members.len(),
-            1,
-            "negated member must be excluded: {:?}",
-            result.files.iter().map(|f| &f.path).collect::<Vec<_>>()
-        );
-        assert!(members[0].path.ends_with("packages/a/package.json"));
-    }
-
-    #[tokio::test]
-    async fn test_find_workspace_glob_negation_excludes_subtree() {
-        // A negation can itself be a glob (pnpm's docs show `!**/test/**`);
-        // `!legacy/**` must remove every member an earlier positive pattern
-        // picked up under legacy/.
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(
-            dir.path().join("package.json"),
-            r#"{"workspaces": ["**", "!legacy/**"]}"#,
-        )
-        .await
-        .unwrap();
-        let app = dir.path().join("app");
-        fs::create_dir_all(&app).await.unwrap();
-        fs::write(app.join("package.json"), r#"{"name":"app"}"#)
-            .await
-            .unwrap();
-        let old = dir.path().join("legacy").join("old");
-        fs::create_dir_all(&old).await.unwrap();
-        fs::write(old.join("package.json"), r#"{"name":"old"}"#)
-            .await
-            .unwrap();
-        let result = find_package_json_files(dir.path()).await;
-        let members: Vec<_> = result.files.iter().filter(|f| f.is_workspace).collect();
-        assert_eq!(
-            members.len(),
-            1,
-            "legacy subtree must be excluded: {:?}",
-            result.files.iter().map(|f| &f.path).collect::<Vec<_>>()
-        );
-        assert!(members[0].path.ends_with("app/package.json"));
-    }
-
-    #[tokio::test]
-    async fn test_find_double_glob_matches_prefix_dir_itself() {
-        // Globstar matches zero segments: npm/pnpm resolve members by globbing
-        // `apps/**/package.json`, which matches `apps/package.json` itself. A
-        // package living at the pattern's prefix directory is a workspace
-        // member too, not just its descendants.
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(
-            dir.path().join("package.json"),
-            r#"{"workspaces": ["apps/**"]}"#,
-        )
-        .await
-        .unwrap();
-        let apps = dir.path().join("apps");
-        fs::create_dir_all(&apps).await.unwrap();
-        fs::write(apps.join("package.json"), r#"{"name":"apps"}"#)
-            .await
-            .unwrap();
-        let web = apps.join("web");
-        fs::create_dir_all(&web).await.unwrap();
-        fs::write(web.join("package.json"), r#"{"name":"web"}"#)
-            .await
-            .unwrap();
-        let result = find_package_json_files(dir.path()).await;
-        assert!(
-            result
-                .files
-                .iter()
-                .any(|f| f.is_workspace && f.path.ends_with("apps/package.json")),
-            "prefix dir's own package.json must be a member: {:?}",
-            result.files.iter().map(|f| &f.path).collect::<Vec<_>>()
-        );
-        assert!(
-            result
-                .files
-                .iter()
-                .any(|f| f.is_workspace && f.path.ends_with("apps/web/package.json")),
-            "descendant member must still be found"
-        );
-    }
-
-    #[test]
-    fn test_parse_pnpm_packages_key_inline_comment() {
-        // The section header itself may carry an inline comment
-        // (`packages: # workspace globs`); the exact-equality compare missed
-        // it and silently dropped the whole section.
-        let yaml = "packages: # workspace globs\n  - packages/*";
-        assert_eq!(parse_pnpm_workspace_patterns(yaml), vec!["packages/*"]);
-    }
-
-    // ── detect_package_manager ──────────────────────────────────────
-
-    #[tokio::test]
-    async fn test_detect_npm_by_default() {
-        let dir = tempfile::tempdir().unwrap();
-        let pm = detect_package_manager(dir.path()).await;
-        assert_eq!(pm, PackageManager::Npm);
-    }
-
-    #[tokio::test]
-    async fn test_detect_pnpm_lock_yaml() {
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(dir.path().join("pnpm-lock.yaml"), "lockfileVersion: 9.0\n")
-            .await
-            .unwrap();
-        let pm = detect_package_manager(dir.path()).await;
-        assert_eq!(pm, PackageManager::Pnpm);
-    }
-
-    #[tokio::test]
-    async fn test_detect_pnpm_workspace_yaml() {
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(
-            dir.path().join("pnpm-workspace.yaml"),
-            "packages:\n  - packages/*",
-        )
-        .await
-        .unwrap();
-        let pm = detect_package_manager(dir.path()).await;
-        assert_eq!(pm, PackageManager::Pnpm);
-    }
-
-    // ── vlt ─────────────────────────────────────────────────────────
-
-    #[tokio::test]
-    async fn test_detect_vlt_from_each_setup_marker() {
-        for marker in npm_family::VLT_SETUP_MARKERS {
-            let dir = tempfile::tempdir().unwrap();
-            let path = dir.path().join(marker);
-            if marker == npm_family::VLT_STORE_DIR {
-                fs::create_dir_all(&path).await.unwrap();
-            } else {
-                fs::create_dir_all(path.parent().unwrap()).await.unwrap();
-                fs::write(&path, "{}").await.unwrap();
-            }
-            assert_eq!(
-                detect_package_manager(dir.path()).await,
-                PackageManager::Vlt,
-                "{marker}"
-            );
-        }
-    }
-
-    #[tokio::test]
-    async fn test_detect_vlt_store_marker_must_be_a_directory() {
-        let dir = tempfile::tempdir().unwrap();
-        fs::create_dir_all(dir.path().join("node_modules"))
-            .await
-            .unwrap();
-        fs::write(dir.path().join(npm_family::VLT_STORE_DIR), "")
-            .await
-            .unwrap();
-        assert_eq!(
-            detect_package_manager(dir.path()).await,
-            PackageManager::Npm
-        );
-    }
-
-    #[tokio::test]
-    async fn test_detect_vlt_wins_over_pnpm_markers() {
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(dir.path().join("pnpm-lock.yaml"), "lockfileVersion: 9.0\n")
-            .await
-            .unwrap();
-        fs::write(dir.path().join("pnpm-workspace.yaml"), "packages:\n")
-            .await
-            .unwrap();
-        fs::write(dir.path().join("vlt-lock.json"), "{}")
-            .await
-            .unwrap();
-        assert_eq!(
-            detect_package_manager(dir.path()).await,
-            PackageManager::Vlt
-        );
-    }
-
-    #[tokio::test]
-    async fn test_detect_vlt_ignores_an_ancestor_vlt_json() {
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(dir.path().join("vlt.json"), "{}").await.unwrap();
-        let nested = dir.path().join("packages").join("a");
-        fs::create_dir_all(&nested).await.unwrap();
-        assert_eq!(detect_package_manager(&nested).await, PackageManager::Npm);
-    }
-
-    async fn vlt_workspace_root(vlt_json: &str) -> tempfile::TempDir {
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(dir.path().join("package.json"), r#"{"name":"root"}"#)
-            .await
-            .unwrap();
-        fs::write(dir.path().join("vlt.json"), vlt_json)
-            .await
-            .unwrap();
-        dir
-    }
-
-    #[tokio::test]
-    async fn test_detect_workspaces_vlt_shapes() {
-        for (vlt_json, want) in [
-            (r#"{"workspaces":"packages/*"}"#, vec!["packages/*"]),
-            (
-                r#"{"workspaces":["packages/*","apps/*",7]}"#,
-                vec!["packages/*", "apps/*"],
-            ),
-            (
-                r#"{"workspaces":{"libs":"libs/*","apps":["apps/*","tools/x"],"bad":1}}"#,
-                vec!["libs/*", "apps/*", "tools/x"],
-            ),
-            (
-                "\u{feff}{\"workspaces\":[\"packages/*\"]}",
-                vec!["packages/*"],
-            ),
-            (r#"{"workspaces":[]}"#, vec![]),
-        ] {
-            let dir = vlt_workspace_root(vlt_json).await;
-            let config = detect_workspaces(&dir.path().join("package.json")).await;
-            assert!(
-                matches!(config.ws_type, WorkspaceType::Vlt),
-                "{vlt_json}: {config:?}"
-            );
-            assert_eq!(config.patterns, want, "{vlt_json}");
-        }
-    }
-
-    #[tokio::test]
-    async fn test_detect_workspaces_vlt_json_without_workspaces_falls_through() {
-        for vlt_json in [
-            r#"{"config":{"registry":"https://registry.npmjs.org/"}}"#,
-            r#"{"workspaces":null}"#,
-            "not json",
-        ] {
-            let dir = tempfile::tempdir().unwrap();
-            fs::write(
-                dir.path().join("package.json"),
-                r#"{"workspaces":["packages/*"]}"#,
-            )
-            .await
-            .unwrap();
-            fs::write(dir.path().join("vlt.json"), vlt_json)
-                .await
-                .unwrap();
-            let config = detect_workspaces(&dir.path().join("package.json")).await;
-            assert!(
-                matches!(config.ws_type, WorkspaceType::Npm),
-                "{vlt_json}: {config:?}"
-            );
-        }
-    }
-
-    #[tokio::test]
-    async fn test_detect_workspaces_vlt_wins_over_pnpm_and_bad_package_json() {
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(dir.path().join("package.json"), "{ // jsonc\n}")
-            .await
-            .unwrap();
-        fs::write(
-            dir.path().join("pnpm-workspace.yaml"),
-            "packages:\n  - pnpm/*",
-        )
-        .await
-        .unwrap();
-        fs::write(dir.path().join("vlt.json"), r#"{"workspaces":"vlt/*"}"#)
-            .await
-            .unwrap();
-        let config = detect_workspaces(&dir.path().join("package.json")).await;
-        assert!(matches!(config.ws_type, WorkspaceType::Vlt), "{config:?}");
-        assert_eq!(config.patterns, vec!["vlt/*"]);
-    }
-
-    #[tokio::test]
-    async fn test_detect_workspaces_legacy_vlt_workspaces_json() {
-        for (legacy, want) in [
-            (r#"{"packages":"packages/*"}"#, vec!["packages/*"]),
-            (
-                r#"{"packages":["packages/*","apps/*"]}"#,
-                vec!["packages/*", "apps/*"],
-            ),
-        ] {
-            let dir = tempfile::tempdir().unwrap();
-            fs::write(dir.path().join("package.json"), r#"{"name":"root"}"#)
-                .await
-                .unwrap();
-            fs::write(dir.path().join("vlt-workspaces.json"), legacy)
-                .await
-                .unwrap();
-            let config = detect_workspaces(&dir.path().join("package.json")).await;
-            assert!(matches!(config.ws_type, WorkspaceType::Vlt), "{legacy}");
-            assert_eq!(config.patterns, want, "{legacy}");
-        }
-
-        let dir = vlt_workspace_root(r#"{"workspaces":"current/*"}"#).await;
-        fs::write(
-            dir.path().join("vlt-workspaces.json"),
-            r#"{"packages":"legacy/*"}"#,
-        )
-        .await
-        .unwrap();
-        let config = detect_workspaces(&dir.path().join("package.json")).await;
-        assert_eq!(config.patterns, vec!["current/*"]);
-    }
-
-    #[tokio::test]
-    async fn test_find_vlt_workspaces_discovers_members_with_the_shared_matcher() {
-        let dir =
-            vlt_workspace_root(r#"{"workspaces":{"a":"packages/*","b":["!packages/skip"]}}"#).await;
-        for member in ["packages/a", "packages/b", "packages/skip"] {
-            let path = dir.path().join(member);
-            fs::create_dir_all(&path).await.unwrap();
-            fs::write(path.join("package.json"), "{}").await.unwrap();
-        }
-        let result = find_package_json_files(dir.path()).await;
-        assert!(matches!(result.workspace_type, WorkspaceType::Vlt));
-        let mut members: Vec<String> = result
-            .files
-            .iter()
-            .filter(|f| f.is_workspace)
-            .map(|f| {
-                f.path
-                    .parent()
-                    .unwrap()
-                    .strip_prefix(dir.path())
-                    .unwrap()
-                    .to_string_lossy()
-                    .replace('\\', "/")
-            })
-            .collect();
-        members.sort();
-        assert_eq!(members, vec!["packages/a", "packages/b"]);
-        assert!(result.files[0].is_root);
-    }
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn vlt_json_fifo_does_not_wedge_discovery() {
-        for name in ["vlt.json", "vlt-workspaces.json"] {
-            let dir = tempfile::tempdir().unwrap();
-            fs::write(
-                dir.path().join("package.json"),
-                r#"{"workspaces": ["packages/*"]}"#,
-            )
-            .await
-            .unwrap();
-            let fifo = dir.path().join(name);
-            mkfifo(&fifo);
-            let deadline = std::time::Duration::from_secs(5);
-            let Ok(result) =
-                tokio::time::timeout(deadline, find_package_json_files(dir.path())).await
-            else {
-                let _ = std::fs::OpenOptions::new().write(true).open(&fifo);
-                panic!("discovery must complete promptly with a FIFO {name}");
-            };
-            assert!(
-                matches!(result.workspace_type, WorkspaceType::Npm),
-                "{name}"
-            );
-        }
-    }
-
-    #[tokio::test]
-    async fn test_legacy_vlt_lock_reads_only_version_zero_or_absent() {
-        for (lock, want) in [
-            (None, None),
-            (
-                Some(r#"{"nodes":{},"edges":{}}"#),
-                Some(LegacyVltLock::NoVersion),
-            ),
-            (
-                Some(r#"{"lockfileVersion":0,"nodes":{}}"#),
-                Some(LegacyVltLock::VersionZero),
-            ),
-            (Some(r#"{"lockfileVersion":1,"nodes":{}}"#), None),
-            (Some(r#"{"lockfileVersion":"0"}"#), None),
-            (Some("\u{feff}{\"lockfileVersion\":0}"), None),
-            (Some("[]"), None),
-            (Some("not json"), None),
-        ] {
-            let dir = tempfile::tempdir().unwrap();
-            if let Some(lock) = lock {
-                fs::write(dir.path().join("vlt-lock.json"), lock)
-                    .await
-                    .unwrap();
-            }
-            assert_eq!(legacy_vlt_lock(dir.path()).await, want, "{lock:?}");
-        }
-    }
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_legacy_vlt_lock_fifo_does_not_wedge() {
-        let dir = tempfile::tempdir().unwrap();
-        let fifo = dir.path().join("vlt-lock.json");
-        mkfifo(&fifo);
-        let deadline = std::time::Duration::from_secs(5);
-        let Ok(result) = tokio::time::timeout(deadline, legacy_vlt_lock(dir.path())).await else {
-            let _ = std::fs::OpenOptions::new().write(true).open(&fifo);
-            panic!("the lock sniff must not wedge on a FIFO vlt-lock.json");
-        };
-        assert_eq!(result, None);
-    }
-}
diff --git a/crates/socket-patch-core/src/package_json/mod.rs b/crates/socket-patch-core/src/package_json/mod.rs
deleted file mode 100644
index 7e1546ac..00000000
--- a/crates/socket-patch-core/src/package_json/mod.rs
+++ /dev/null
@@ -1,3 +0,0 @@
-pub mod detect;
-pub mod find;
-pub mod update;
diff --git a/crates/socket-patch-core/src/package_json/update.rs b/crates/socket-patch-core/src/package_json/update.rs
deleted file mode 100644
index 4eea2515..00000000
--- a/crates/socket-patch-core/src/package_json/update.rs
+++ /dev/null
@@ -1,903 +0,0 @@
-use std::path::Path;
-
-use super::detect::{remove_package_json_content, update_package_json_content, PackageManager};
-use crate::utils::fs::{atomic_write_bytes_preserving_mode, read_regular_to_string};
-
-/// Result of updating a single package.json.
-#[derive(Debug, Clone)]
-pub struct UpdateResult {
-    pub path: String,
-    pub status: UpdateStatus,
-    /// Previous `postinstall` script (empty if absent).
-    pub old_script: String,
-    /// New `postinstall` script.
-    pub new_script: String,
-    /// Previous `dependencies` script (empty if absent).
-    pub old_dependencies_script: String,
-    /// New `dependencies` script (equal to the old one when unchanged).
-    pub new_dependencies_script: String,
-    pub error: Option<String>,
-}
-
-#[derive(Debug, Clone, PartialEq)]
-pub enum UpdateStatus {
-    Updated,
-    AlreadyConfigured,
-    Error,
-}
-
-/// Update a single package.json file with socket-patch lifecycle scripts.
-pub async fn update_package_json(
-    package_json_path: &Path,
-    dry_run: bool,
-    pm: PackageManager,
-) -> UpdateResult {
-    let path_str = package_json_path.display().to_string();
-
-    // Guarded read: a FIFO planted as package.json would make a plain
-    // `read_to_string` open block forever waiting for a writer — discovery
-    // lists any path whose metadata stats, so it reaches here unopened.
-    let content = match read_regular_to_string(package_json_path).await {
-        Ok(c) => c,
-        Err(e) => {
-            return UpdateResult {
-                path: path_str,
-                status: UpdateStatus::Error,
-                old_script: String::new(),
-                new_script: String::new(),
-                old_dependencies_script: String::new(),
-                new_dependencies_script: String::new(),
-                error: Some(e.to_string()),
-            };
-        }
-    };
-
-    match update_package_json_content(&content, pm) {
-        Ok((modified, new_content, old_pi, new_pi, old_deps, new_deps)) => {
-            if modified && !dry_run {
-                if let Err(e) =
-                    atomic_write_bytes_preserving_mode(package_json_path, new_content.as_bytes())
-                        .await
-                {
-                    return UpdateResult {
-                        path: path_str,
-                        status: UpdateStatus::Error,
-                        old_script: old_pi,
-                        new_script: new_pi,
-                        old_dependencies_script: old_deps,
-                        new_dependencies_script: new_deps,
-                        error: Some(e.to_string()),
-                    };
-                }
-            }
-
-            UpdateResult {
-                path: path_str,
-                status: if modified {
-                    UpdateStatus::Updated
-                } else {
-                    UpdateStatus::AlreadyConfigured
-                },
-                old_script: old_pi,
-                new_script: new_pi,
-                old_dependencies_script: old_deps,
-                new_dependencies_script: new_deps,
-                error: None,
-            }
-        }
-        Err(e) => UpdateResult {
-            path: path_str,
-            status: UpdateStatus::Error,
-            old_script: String::new(),
-            new_script: String::new(),
-            old_dependencies_script: String::new(),
-            new_dependencies_script: String::new(),
-            error: Some(e),
-        },
-    }
-}
-
-/// Result of removing socket-patch from a single package.json.
-#[derive(Debug, Clone)]
-pub struct RemoveResult {
-    pub path: String,
-    pub status: RemoveStatus,
-    /// Previous `postinstall` script (empty if absent).
-    pub old_script: String,
-    /// New `postinstall` value: `None` means the key was deleted.
-    pub new_script: Option<String>,
-    pub old_dependencies_script: String,
-    pub new_dependencies_script: Option<String>,
-    pub error: Option<String>,
-}
-
-#[derive(Debug, Clone, PartialEq)]
-pub enum RemoveStatus {
-    /// socket-patch was present and has been (or would be) removed.
-    Removed,
-    /// Nothing to remove — the file is not configured for socket-patch.
-    NotConfigured,
-    Error,
-}
-
-/// Remove socket-patch lifecycle scripts from a single package.json file.
-///
-/// Mirrors [`update_package_json`] but in reverse. Needs no [`PackageManager`]:
-/// it strips any known socket-patch pattern regardless of how it was written.
-pub async fn remove_package_json(package_json_path: &Path, dry_run: bool) -> RemoveResult {
-    let path_str = package_json_path.display().to_string();
-
-    // Guarded read — see the matching note in `update_package_json`.
-    let content = match read_regular_to_string(package_json_path).await {
-        Ok(c) => c,
-        Err(e) => {
-            return RemoveResult {
-                path: path_str,
-                status: RemoveStatus::Error,
-                old_script: String::new(),
-                new_script: None,
-                old_dependencies_script: String::new(),
-                new_dependencies_script: None,
-                error: Some(e.to_string()),
-            };
-        }
-    };
-
-    match remove_package_json_content(&content) {
-        Ok((modified, new_content, status)) => {
-            if modified && !dry_run {
-                if let Err(e) =
-                    atomic_write_bytes_preserving_mode(package_json_path, new_content.as_bytes())
-                        .await
-                {
-                    return RemoveResult {
-                        path: path_str,
-                        status: RemoveStatus::Error,
-                        old_script: status.old_postinstall,
-                        new_script: status.new_postinstall,
-                        old_dependencies_script: status.old_dependencies,
-                        new_dependencies_script: status.new_dependencies,
-                        error: Some(e.to_string()),
-                    };
-                }
-            }
-
-            RemoveResult {
-                path: path_str,
-                status: if modified {
-                    RemoveStatus::Removed
-                } else {
-                    RemoveStatus::NotConfigured
-                },
-                old_script: status.old_postinstall,
-                new_script: status.new_postinstall,
-                old_dependencies_script: status.old_dependencies,
-                new_dependencies_script: status.new_dependencies,
-                error: None,
-            }
-        }
-        Err(e) => RemoveResult {
-            path: path_str,
-            status: RemoveStatus::Error,
-            old_script: String::new(),
-            new_script: None,
-            old_dependencies_script: String::new(),
-            new_dependencies_script: None,
-            error: Some(e),
-        },
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use tokio::fs;
-
-    #[tokio::test]
-    async fn test_update_file_not_found() {
-        let dir = tempfile::tempdir().unwrap();
-        let missing = dir.path().join("nonexistent.json");
-        let result = update_package_json(&missing, false, PackageManager::Npm).await;
-        assert_eq!(result.status, UpdateStatus::Error);
-        assert!(result.error.is_some());
-    }
-
-    #[tokio::test]
-    async fn test_update_already_configured() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        fs::write(
-            &pkg,
-            r#"{"name":"test","scripts":{"postinstall":"npx @socketsecurity/socket-patch apply --silent --ecosystems npm","dependencies":"npx @socketsecurity/socket-patch apply --silent --ecosystems npm"}}"#,
-        )
-        .await
-        .unwrap();
-        let result = update_package_json(&pkg, false, PackageManager::Npm).await;
-        assert_eq!(result.status, UpdateStatus::AlreadyConfigured);
-    }
-
-    #[tokio::test]
-    async fn test_update_dry_run_does_not_write() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        let original = r#"{"name":"test","scripts":{"build":"tsc"}}"#;
-        fs::write(&pkg, original).await.unwrap();
-        let result = update_package_json(&pkg, true, PackageManager::Npm).await;
-        assert_eq!(result.status, UpdateStatus::Updated);
-        // File should remain unchanged
-        let content = fs::read_to_string(&pkg).await.unwrap();
-        assert_eq!(content, original);
-    }
-
-    #[tokio::test]
-    async fn test_update_writes_file() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        fs::write(&pkg, r#"{"name":"test","scripts":{"build":"tsc"}}"#)
-            .await
-            .unwrap();
-        let result = update_package_json(&pkg, false, PackageManager::Npm).await;
-        assert_eq!(result.status, UpdateStatus::Updated);
-        let content = fs::read_to_string(&pkg).await.unwrap();
-        assert!(content.contains("npx @socketsecurity/socket-patch apply"));
-        assert!(content.contains("postinstall"));
-        assert!(content.contains("dependencies"));
-    }
-
-    #[tokio::test]
-    async fn test_update_invalid_json() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        fs::write(&pkg, "not json!!!").await.unwrap();
-        let result = update_package_json(&pkg, false, PackageManager::Npm).await;
-        assert_eq!(result.status, UpdateStatus::Error);
-        assert!(result.error.is_some());
-    }
-
-    #[tokio::test]
-    async fn test_update_no_scripts_key() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        fs::write(&pkg, r#"{"name":"x"}"#).await.unwrap();
-        let result = update_package_json(&pkg, false, PackageManager::Npm).await;
-        assert_eq!(result.status, UpdateStatus::Updated);
-        let content = fs::read_to_string(&pkg).await.unwrap();
-        assert!(content.contains("postinstall"));
-        assert!(content.contains("dependencies"));
-        assert!(content.contains("npx @socketsecurity/socket-patch apply"));
-    }
-
-    #[tokio::test]
-    async fn test_update_pnpm() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        fs::write(&pkg, r#"{"name":"x"}"#).await.unwrap();
-        let result = update_package_json(&pkg, false, PackageManager::Pnpm).await;
-        assert_eq!(result.status, UpdateStatus::Updated);
-        let content = fs::read_to_string(&pkg).await.unwrap();
-        assert!(content.contains("pnpm dlx @socketsecurity/socket-patch apply"));
-    }
-
-    #[tokio::test]
-    async fn test_update_vlt() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        fs::write(&pkg, r#"{"name":"x"}"#).await.unwrap();
-        let result = update_package_json(&pkg, false, PackageManager::Vlt).await;
-        assert_eq!(result.status, UpdateStatus::Updated);
-        let npx = "npx @socketsecurity/socket-patch apply --silent --ecosystems npm";
-        assert_eq!(result.new_script, npx);
-        assert_eq!(result.new_dependencies_script, npx);
-        let content: serde_json::Value =
-            serde_json::from_str(&fs::read_to_string(&pkg).await.unwrap()).unwrap();
-        assert_eq!(content["scripts"]["postinstall"], npx);
-        assert_eq!(content["scripts"]["dependencies"], npx);
-    }
-
-    #[tokio::test]
-    async fn test_update_adds_dependencies_when_postinstall_exists() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        fs::write(
-            &pkg,
-            r#"{"name":"test","scripts":{"postinstall":"npx @socketsecurity/socket-patch apply --silent --ecosystems npm"}}"#,
-        )
-        .await
-        .unwrap();
-        let result = update_package_json(&pkg, false, PackageManager::Npm).await;
-        assert_eq!(result.status, UpdateStatus::Updated);
-        let content = fs::read_to_string(&pkg).await.unwrap();
-        assert!(content.contains("dependencies"));
-    }
-
-    /// Writing back the user's package.json must not reorder their existing
-    /// keys. Without `serde_json/preserve_order` the value map is sorted
-    /// alphabetically, so a file like `{"version":..,"name":..}` would be
-    /// rewritten as `{"name":..,"version":..}` — a destructive, noisy diff
-    /// over something the tool only meant to append two scripts to.
-    #[tokio::test]
-    async fn test_update_preserves_top_level_key_order() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        // Deliberately non-alphabetical key order.
-        fs::write(
-            &pkg,
-            r#"{"version":"1.0.0","name":"x","private":true,"scripts":{"build":"tsc"}}"#,
-        )
-        .await
-        .unwrap();
-        let result = update_package_json(&pkg, false, PackageManager::Npm).await;
-        assert_eq!(result.status, UpdateStatus::Updated);
-
-        let content = fs::read_to_string(&pkg).await.unwrap();
-        let pos_version = content.find("\"version\"").unwrap();
-        let pos_name = content.find("\"name\"").unwrap();
-        let pos_private = content.find("\"private\"").unwrap();
-        let pos_scripts = content.find("\"scripts\"").unwrap();
-        assert!(
-            pos_version < pos_name && pos_name < pos_private && pos_private < pos_scripts,
-            "original top-level key order must be preserved, got:\n{content}"
-        );
-    }
-
-    /// The pre-existing `build` script (and its position) must survive an
-    /// update that only appends the lifecycle scripts.
-    #[tokio::test]
-    async fn test_update_preserves_existing_scripts() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        fs::write(
-            &pkg,
-            r#"{"name":"x","scripts":{"build":"tsc","test":"jest"}}"#,
-        )
-        .await
-        .unwrap();
-        let result = update_package_json(&pkg, false, PackageManager::Npm).await;
-        assert_eq!(result.status, UpdateStatus::Updated);
-
-        let parsed: serde_json::Value =
-            serde_json::from_str(&fs::read_to_string(&pkg).await.unwrap()).unwrap();
-        assert_eq!(parsed["scripts"]["build"], "tsc");
-        assert_eq!(parsed["scripts"]["test"], "jest");
-        assert!(parsed["scripts"]["postinstall"].is_string());
-        assert!(parsed["scripts"]["dependencies"].is_string());
-    }
-
-    /// Running setup twice must be idempotent: the second run reports
-    /// `AlreadyConfigured` and leaves the file byte-for-byte unchanged (no
-    /// duplicated `socket-patch apply` commands).
-    #[tokio::test]
-    async fn test_update_is_idempotent() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        fs::write(&pkg, r#"{"name":"x","scripts":{"build":"tsc"}}"#)
-            .await
-            .unwrap();
-
-        let r1 = update_package_json(&pkg, false, PackageManager::Npm).await;
-        assert_eq!(r1.status, UpdateStatus::Updated);
-        let after_first = fs::read_to_string(&pkg).await.unwrap();
-
-        let r2 = update_package_json(&pkg, false, PackageManager::Npm).await;
-        assert_eq!(r2.status, UpdateStatus::AlreadyConfigured);
-        let after_second = fs::read_to_string(&pkg).await.unwrap();
-
-        assert_eq!(after_first, after_second);
-        assert_eq!(after_first.matches("socket-patch apply").count(), 2);
-    }
-
-    /// Valid JSON whose root is not an object cannot hold lifecycle scripts;
-    /// it must surface an error rather than panicking or silently succeeding.
-    #[tokio::test]
-    async fn test_update_non_object_root_errors() {
-        let dir = tempfile::tempdir().unwrap();
-        for (i, body) in ["[1,2,3]", "42", "\"hi\"", "true", "null"]
-            .iter()
-            .enumerate()
-        {
-            let pkg = dir.path().join(format!("pkg{i}.json"));
-            fs::write(&pkg, body).await.unwrap();
-            let result = update_package_json(&pkg, false, PackageManager::Npm).await;
-            assert_eq!(result.status, UpdateStatus::Error, "body={body}");
-            assert!(result.error.is_some(), "body={body}");
-        }
-    }
-
-    /// A present-but-non-object `scripts` is malformed; refuse to clobber it.
-    #[tokio::test]
-    async fn test_update_non_object_scripts_errors_and_leaves_file() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        let original = r#"{"name":"x","scripts":"build"}"#;
-        fs::write(&pkg, original).await.unwrap();
-        let result = update_package_json(&pkg, false, PackageManager::Npm).await;
-        assert_eq!(result.status, UpdateStatus::Error);
-        // File must be left untouched.
-        assert_eq!(fs::read_to_string(&pkg).await.unwrap(), original);
-    }
-
-    /// npm and Node tolerate (and strip) a UTF-8 BOM in package.json — files
-    /// saved by Windows editors commonly carry one. serde_json does not, so
-    /// without stripping it a perfectly npm-valid manifest errors out with
-    /// "Invalid package.json" instead of being configured.
-    #[tokio::test]
-    async fn test_update_tolerates_utf8_bom() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        fs::write(
-            &pkg,
-            "\u{feff}{\"name\":\"x\",\"scripts\":{\"build\":\"tsc\"}}",
-        )
-        .await
-        .unwrap();
-        let result = update_package_json(&pkg, false, PackageManager::Npm).await;
-        assert_eq!(
-            result.status,
-            UpdateStatus::Updated,
-            "BOM'd package.json is valid for npm and must be updatable, got error: {:?}",
-            result.error
-        );
-        let content = fs::read_to_string(&pkg).await.unwrap();
-        // The BOM survives the rewrite (the editor that added it keeps it).
-        let body = content
-            .strip_prefix('\u{feff}')
-            .expect("setup must keep the manifest's BOM");
-        let parsed: serde_json::Value = serde_json::from_str(body).unwrap();
-        assert!(parsed["scripts"]["postinstall"].is_string());
-        assert!(parsed["scripts"]["dependencies"].is_string());
-        assert_eq!(parsed["scripts"]["build"], "tsc");
-    }
-
-    /// A BOM'd file that is already fully configured must report
-    /// `AlreadyConfigured` (and stay untouched), not `Error`.
-    #[tokio::test]
-    async fn test_update_bom_already_configured() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        let original = "\u{feff}{\"scripts\":{\"postinstall\":\"npx @socketsecurity/socket-patch apply --silent --ecosystems npm\",\"dependencies\":\"npx @socketsecurity/socket-patch apply --silent --ecosystems npm\"}}";
-        fs::write(&pkg, original).await.unwrap();
-        let result = update_package_json(&pkg, false, PackageManager::Npm).await;
-        assert_eq!(result.status, UpdateStatus::AlreadyConfigured);
-        assert_eq!(fs::read_to_string(&pkg).await.unwrap(), original);
-    }
-
-    /// An empty file is invalid JSON and must error without writing.
-    #[tokio::test]
-    async fn test_update_empty_file_errors() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        fs::write(&pkg, "").await.unwrap();
-        let result = update_package_json(&pkg, false, PackageManager::Npm).await;
-        assert_eq!(result.status, UpdateStatus::Error);
-        assert!(result.error.is_some());
-    }
-
-    /// Dry-run on a file that needs updating reports `Updated` but must not
-    /// touch the bytes on disk — the consumer relies on this for its preview.
-    #[tokio::test]
-    async fn test_update_dry_run_reports_updated_without_writing_scripts() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        let original = r#"{"name":"x","scripts":{"postinstall":"echo hi"}}"#;
-        fs::write(&pkg, original).await.unwrap();
-        let result = update_package_json(&pkg, true, PackageManager::Npm).await;
-        assert_eq!(result.status, UpdateStatus::Updated);
-        // old_script reflects the existing script; new_script the prepended one.
-        assert_eq!(result.old_script, "echo hi");
-        assert!(result.new_script.contains("socket-patch apply"));
-        assert!(result.new_script.contains("echo hi"));
-        assert_eq!(fs::read_to_string(&pkg).await.unwrap(), original);
-    }
-
-    /// After a successful (non-dry-run) write the staged temp file must be
-    /// renamed into place, never left behind. A leaked `.socket-stage-*`
-    /// sibling would signal the atomic write didn't complete its rename.
-    async fn count_stage_litter(dir: &Path) -> usize {
-        let mut rd = fs::read_dir(dir).await.unwrap();
-        let mut n = 0;
-        while let Some(entry) = rd.next_entry().await.unwrap() {
-            if entry
-                .file_name()
-                .to_string_lossy()
-                .starts_with(".socket-stage-")
-            {
-                n += 1;
-            }
-        }
-        n
-    }
-
-    #[tokio::test]
-    async fn test_update_atomic_write_leaves_no_stage_litter() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        fs::write(&pkg, r#"{"name":"x","scripts":{"build":"tsc"}}"#)
-            .await
-            .unwrap();
-        let result = update_package_json(&pkg, false, PackageManager::Npm).await;
-        assert_eq!(result.status, UpdateStatus::Updated);
-        // The write must have gone through stage+rename and cleaned up.
-        assert_eq!(count_stage_litter(dir.path()).await, 0);
-        // And produced valid, fully-written JSON (not a truncated stage).
-        let content = fs::read_to_string(&pkg).await.unwrap();
-        let parsed: serde_json::Value = serde_json::from_str(&content).unwrap();
-        assert!(parsed["scripts"]["postinstall"].is_string());
-        assert!(parsed["scripts"]["dependencies"].is_string());
-    }
-
-    #[tokio::test]
-    async fn test_remove_atomic_write_leaves_no_stage_litter() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        fs::write(&pkg, r#"{"name":"x","scripts":{"build":"tsc"}}"#)
-            .await
-            .unwrap();
-        update_package_json(&pkg, false, PackageManager::Npm).await;
-
-        let result = remove_package_json(&pkg, false).await;
-        assert_eq!(result.status, RemoveStatus::Removed);
-        assert_eq!(count_stage_litter(dir.path()).await, 0);
-        let content = fs::read_to_string(&pkg).await.unwrap();
-        let parsed: serde_json::Value = serde_json::from_str(&content).unwrap();
-        assert_eq!(parsed["scripts"]["build"], "tsc");
-        assert!(!content.contains("socket-patch"));
-    }
-
-    /// The stage+rename write swaps in a fresh inode, so unless the writer
-    /// re-applies the destination's permission bits, an edit resets the
-    /// user's package.json mode to umask defaults (typically 0644): a 0600
-    /// user-private manifest silently becomes world-readable, and a 0664
-    /// group-writable one locks the group out. npm's own write-file-atomic
-    /// preserves mode on package.json edits; so must we. (The 0744 file
-    /// makes this red under any umask — a 0666-based create can never
-    /// produce an exec bit.)
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_update_preserves_file_mode() {
-        use std::os::unix::fs::PermissionsExt;
-        let dir = tempfile::tempdir().unwrap();
-        for mode in [0o600u32, 0o744] {
-            let pkg = dir.path().join(format!("pkg-{mode:o}.json"));
-            fs::write(&pkg, r#"{"name":"x","scripts":{"build":"tsc"}}"#)
-                .await
-                .unwrap();
-            std::fs::set_permissions(&pkg, std::fs::Permissions::from_mode(mode)).unwrap();
-
-            let result = update_package_json(&pkg, false, PackageManager::Npm).await;
-            assert_eq!(result.status, UpdateStatus::Updated, "mode {mode:o}");
-            let got = std::fs::metadata(&pkg).unwrap().permissions().mode() & 0o777;
-            assert_eq!(
-                got, mode,
-                "update must preserve the package.json mode, got {got:o} for {mode:o}"
-            );
-        }
-    }
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_remove_preserves_file_mode() {
-        use std::os::unix::fs::PermissionsExt;
-        let dir = tempfile::tempdir().unwrap();
-        for mode in [0o600u32, 0o744] {
-            let pkg = dir.path().join(format!("pkg-{mode:o}.json"));
-            fs::write(&pkg, r#"{"name":"x","scripts":{"build":"tsc"}}"#)
-                .await
-                .unwrap();
-            update_package_json(&pkg, false, PackageManager::Npm).await;
-            std::fs::set_permissions(&pkg, std::fs::Permissions::from_mode(mode)).unwrap();
-
-            let result = remove_package_json(&pkg, false).await;
-            assert_eq!(result.status, RemoveStatus::Removed, "mode {mode:o}");
-            let got = std::fs::metadata(&pkg).unwrap().permissions().mode() & 0o777;
-            assert_eq!(
-                got, mode,
-                "remove must preserve the package.json mode, got {got:o} for {mode:o}"
-            );
-        }
-    }
-
-    /// A dry-run must never create a stage file either — it does no I/O at all.
-    #[tokio::test]
-    async fn test_update_dry_run_leaves_no_stage_litter() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        fs::write(&pkg, r#"{"name":"x","scripts":{"build":"tsc"}}"#)
-            .await
-            .unwrap();
-        update_package_json(&pkg, true, PackageManager::Npm).await;
-        assert_eq!(count_stage_litter(dir.path()).await, 0);
-    }
-
-    // ── remove_package_json ─────────────────────────────────────────
-
-    #[tokio::test]
-    async fn test_remove_file_not_found() {
-        let dir = tempfile::tempdir().unwrap();
-        let missing = dir.path().join("nonexistent.json");
-        let result = remove_package_json(&missing, false).await;
-        assert_eq!(result.status, RemoveStatus::Error);
-        assert!(result.error.is_some());
-    }
-
-    #[tokio::test]
-    async fn test_remove_not_configured() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        fs::write(&pkg, r#"{"name":"x","scripts":{"build":"tsc"}}"#)
-            .await
-            .unwrap();
-        let result = remove_package_json(&pkg, false).await;
-        assert_eq!(result.status, RemoveStatus::NotConfigured);
-    }
-
-    #[tokio::test]
-    async fn test_remove_writes_and_strips_socket_patch() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        // Configure first, then remove.
-        fs::write(&pkg, r#"{"name":"x","scripts":{"build":"tsc"}}"#)
-            .await
-            .unwrap();
-        update_package_json(&pkg, false, PackageManager::Npm).await;
-
-        let result = remove_package_json(&pkg, false).await;
-        assert_eq!(result.status, RemoveStatus::Removed);
-        let content = fs::read_to_string(&pkg).await.unwrap();
-        assert!(!content.contains("socket-patch"));
-        let parsed: serde_json::Value = serde_json::from_str(&content).unwrap();
-        assert_eq!(parsed["scripts"]["build"], "tsc");
-    }
-
-    #[tokio::test]
-    async fn test_remove_dry_run_does_not_write() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        let original =
-            r#"{"name":"x","scripts":{"postinstall":"npx @socketsecurity/socket-patch apply"}}"#;
-        fs::write(&pkg, original).await.unwrap();
-        let result = remove_package_json(&pkg, true).await;
-        assert_eq!(result.status, RemoveStatus::Removed);
-        // File must be byte-identical after a dry-run.
-        assert_eq!(fs::read_to_string(&pkg).await.unwrap(), original);
-    }
-
-    #[tokio::test]
-    async fn test_remove_idempotent() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        fs::write(&pkg, r#"{"name":"x","scripts":{"build":"tsc"}}"#)
-            .await
-            .unwrap();
-        update_package_json(&pkg, false, PackageManager::Npm).await;
-
-        let r1 = remove_package_json(&pkg, false).await;
-        assert_eq!(r1.status, RemoveStatus::Removed);
-        let r2 = remove_package_json(&pkg, false).await;
-        assert_eq!(r2.status, RemoveStatus::NotConfigured);
-    }
-
-    /// Remove must tolerate a UTF-8 BOM the same way npm does: a BOM'd,
-    /// configured package.json must be cleanly reverted, not rejected as
-    /// invalid JSON.
-    #[tokio::test]
-    async fn test_remove_tolerates_utf8_bom() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        fs::write(
-            &pkg,
-            "\u{feff}{\"name\":\"x\",\"scripts\":{\"build\":\"tsc\",\"postinstall\":\"npx @socketsecurity/socket-patch apply --silent --ecosystems npm\"}}",
-        )
-        .await
-        .unwrap();
-        let result = remove_package_json(&pkg, false).await;
-        assert_eq!(
-            result.status,
-            RemoveStatus::Removed,
-            "BOM'd package.json is valid for npm and must be removable, got error: {:?}",
-            result.error
-        );
-        let content = fs::read_to_string(&pkg).await.unwrap();
-        assert!(!content.contains("socket-patch"));
-        let body = content
-            .strip_prefix('\u{feff}')
-            .expect("setup --remove must keep the manifest's BOM");
-        let parsed: serde_json::Value = serde_json::from_str(body).unwrap();
-        assert_eq!(parsed["scripts"]["build"], "tsc");
-    }
-
-    /// A Windows yarn-berry manifest (persistManifest pretty-prints with
-    /// `os.EOL`, so CRLF; an editor may add a BOM; some tools drop the final
-    /// newline) must keep its layout through `setup`, and `setup --remove`
-    /// must land byte-identical on the pre-setup file. serde's serializer
-    /// emits bare `\n` and no BOM, which would flip every line to LF — a
-    /// whole-file diff yarn then keeps (it follows the majority ending).
-    #[tokio::test]
-    async fn test_setup_then_remove_round_trips_crlf_bom_and_final_newline_shape() {
-        let lf = "{\n  \"name\": \"x\",\n  \"version\": \"1.0.0\",\n  \"scripts\": {\n    \"build\": \"tsc\"\n  },\n  \"packageManager\": \"yarn@4.12.0\"\n}";
-        let crlf = lf.replace('\n', "\r\n");
-        let cases = [
-            ("lf", format!("{lf}\n")),
-            ("lf-no-final-newline", lf.to_string()),
-            ("crlf", format!("{crlf}\r\n")),
-            ("bom-crlf", format!("\u{feff}{crlf}\r\n")),
-            ("crlf-no-final-newline", crlf.clone()),
-            ("bom-lf", format!("\u{feff}{lf}\n")),
-            ("crlf-two-final-newlines", format!("{crlf}\r\n\r\n")),
-        ];
-        for (label, original) in cases {
-            let dir = tempfile::tempdir().unwrap();
-            let pkg = dir.path().join("package.json");
-            fs::write(&pkg, &original).await.unwrap();
-
-            let up = update_package_json(&pkg, false, PackageManager::Npm).await;
-            assert_eq!(up.status, UpdateStatus::Updated, "{label}: {:?}", up.error);
-            let wired = fs::read_to_string(&pkg).await.unwrap();
-            assert_eq!(
-                wired.starts_with('\u{feff}'),
-                original.starts_with('\u{feff}'),
-                "{label}: BOM presence must survive setup:\n{wired:?}"
-            );
-            if original.contains("\r\n") {
-                assert!(
-                    !wired.replace("\r\n", "").contains('\n'),
-                    "{label}: setup left a bare LF in a CRLF manifest:\n{wired:?}"
-                );
-            } else {
-                assert!(
-                    !wired.contains('\r'),
-                    "{label}: setup added CR to an LF manifest"
-                );
-            }
-            let trailer = |t: &str| t.len() - t.trim_end_matches(['\r', '\n']).len();
-            assert_eq!(
-                trailer(&wired),
-                trailer(&original),
-                "{label}: trailing-newline shape must survive setup:\n{wired:?}"
-            );
-            let parsed: serde_json::Value =
-                serde_json::from_str(wired.trim_start_matches('\u{feff}')).unwrap();
-            assert!(parsed["scripts"]["postinstall"].is_string(), "{label}");
-
-            let down = remove_package_json(&pkg, false).await;
-            assert_eq!(
-                down.status,
-                RemoveStatus::Removed,
-                "{label}: {:?}",
-                down.error
-            );
-            assert_eq!(
-                fs::read_to_string(&pkg).await.unwrap(),
-                original,
-                "{label}: setup --remove must restore the pre-setup bytes"
-            );
-        }
-    }
-
-    /// mkfifo(2) directly rather than shelling out to the `mkfifo` binary —
-    /// same helper as the find.rs FIFO tests: fork/exec flakes under heavy
-    /// parallel load and the syscall needs no process at all.
-    #[cfg(unix)]
-    fn mkfifo(path: &Path) {
-        use std::os::unix::ffi::OsStrExt;
-        let c_path =
-            std::ffi::CString::new(path.as_os_str().as_bytes()).expect("fifo path has no NUL");
-        let rc = unsafe { libc::mkfifo(c_path.as_ptr(), 0o644) };
-        assert_eq!(
-            rc,
-            0,
-            "mkfifo(2) failed: {}",
-            std::io::Error::last_os_error()
-        );
-    }
-
-    /// A FIFO planted as `package.json` must not wedge setup. Discovery lists
-    /// any `package.json` whose metadata stats (a FIFO does), then setup calls
-    /// `update_package_json` on it; a plain `read_to_string` open(2) on a FIFO
-    /// waits for a writer that never comes, wedging `socket-patch setup`
-    /// indefinitely with no error and no timeout. Same class as the
-    /// `open_regular_file` guards in find.rs and the npm/composer/python/ruby
-    /// crawlers.
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_update_fifo_package_json_does_not_wedge() {
-        let dir = tempfile::tempdir().unwrap();
-        let fifo = dir.path().join("package.json");
-        mkfifo(&fifo);
-
-        // On timeout the open is wedged in a `spawn_blocking` thread that
-        // the runtime waits for on shutdown; connect a writer to release
-        // it so the test can FAIL instead of hanging the whole suite.
-        let deadline = std::time::Duration::from_secs(5);
-        let Ok(result) = tokio::time::timeout(
-            deadline,
-            update_package_json(&fifo, false, PackageManager::Npm),
-        )
-        .await
-        else {
-            let _ = std::fs::OpenOptions::new().write(true).open(&fifo);
-            panic!("update must complete promptly with a FIFO package.json");
-        };
-        assert_eq!(result.status, UpdateStatus::Error);
-        assert!(result.error.is_some());
-    }
-
-    /// The removal twin: `setup --remove` reads every discovered package.json
-    /// through `remove_package_json`, so a FIFO wedged it the same way.
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_remove_fifo_package_json_does_not_wedge() {
-        let dir = tempfile::tempdir().unwrap();
-        let fifo = dir.path().join("package.json");
-        mkfifo(&fifo);
-
-        let deadline = std::time::Duration::from_secs(5);
-        let Ok(result) = tokio::time::timeout(deadline, remove_package_json(&fifo, false)).await
-        else {
-            let _ = std::fs::OpenOptions::new().write(true).open(&fifo);
-            panic!("remove must complete promptly with a FIFO package.json");
-        };
-        assert_eq!(result.status, RemoveStatus::Error);
-        assert!(result.error.is_some());
-    }
-
-    #[tokio::test]
-    async fn test_remove_invalid_json_errors_and_leaves_file() {
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        fs::write(&pkg, "not json!!!").await.unwrap();
-        let result = remove_package_json(&pkg, false).await;
-        assert_eq!(result.status, RemoveStatus::Error);
-        assert_eq!(fs::read_to_string(&pkg).await.unwrap(), "not json!!!");
-    }
-
-    /// When the stripped package.json cannot be written back (the atomic
-    /// writer's stage file cannot be created in a read-only parent), remove
-    /// must report `RemoveStatus::Error` carrying the parsed script fields —
-    /// not the empty-string invalid-JSON arm — and leave the configured file
-    /// byte-identical on disk. (0o555 on the parent makes the stage-file
-    /// `create_new` fail EACCES; like the repo's other read-only-dir tests
-    /// this assumes a non-root test run.)
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_remove_write_failure_reports_error_and_leaves_file() {
-        use std::os::unix::fs::PermissionsExt;
-        let dir = tempfile::tempdir().unwrap();
-        let pkg = dir.path().join("package.json");
-        fs::write(&pkg, r#"{"name":"x","scripts":{"build":"tsc"}}"#)
-            .await
-            .unwrap();
-        update_package_json(&pkg, false, PackageManager::Npm).await;
-        let before = fs::read_to_string(&pkg).await.unwrap();
-
-        std::fs::set_permissions(dir.path(), std::fs::Permissions::from_mode(0o555)).unwrap();
-
-        let result = remove_package_json(&pkg, false).await;
-
-        // Restore before any assertion can unwind, so the tempdir cleans up.
-        std::fs::set_permissions(dir.path(), std::fs::Permissions::from_mode(0o755)).unwrap();
-
-        assert_eq!(result.status, RemoveStatus::Error);
-        assert!(result.error.is_some(), "write failure must be surfaced");
-        // The error branch must carry the parsed status fields (proving it is
-        // the write-failure arm, not the invalid-JSON arm whose fields are
-        // empty): update added postinstall/dependencies purely for
-        // socket-patch, so the strip deletes both keys.
-        assert!(
-            result.old_script.contains("socket-patch apply"),
-            "old_script must reflect the configured postinstall, got {:?}",
-            result.old_script
-        );
-        assert!(result.new_script.is_none());
-        assert!(
-            result
-                .old_dependencies_script
-                .contains("socket-patch apply"),
-            "old_dependencies_script must reflect the configured script, got {:?}",
-            result.old_dependencies_script
-        );
-        assert!(result.new_dependencies_script.is_none());
-        // The write never landed: file byte-identical, no stage litter.
-        assert_eq!(fs::read_to_string(&pkg).await.unwrap(), before);
-        assert_eq!(count_stage_litter(dir.path()).await, 0);
-    }
-}
diff --git a/crates/socket-patch-core/src/patch/apply.rs b/crates/socket-patch-core/src/patch/apply.rs
index 14788d3e..699ed494 100644
--- a/crates/socket-patch-core/src/patch/apply.rs
+++ b/crates/socket-patch-core/src/patch/apply.rs
@@ -170,7 +170,7 @@ pub(crate) fn normalize_file_path(file_name: &str) -> &str {
 /// that stays inside the package directory when joined to it.
 ///
 /// SECURITY: manifest file keys come from a committed `.socket/manifest.json`,
-/// which the auto-running install hook applies without explicit user action. An
+/// which a CI `apply` step applies without explicit user action. An
 /// unvalidated key like `../../home/u/.bashrc` or `/etc/cron.d/x` would let a
 /// poisoned manifest write OUTSIDE site-packages (arbitrary-file write → code
 /// execution) via `pkg_path.join(key)` — `Path::join` discards the base on an
@@ -1083,7 +1083,7 @@ async fn resolve_from_diff(
 /// Strategy 3 (on-disk half) — read `blobs_path/<hash>` fail-closed.
 ///
 /// SECURITY: `hash` comes from a committed `.socket/manifest.json` that the
-/// install hook applies without user action, so it is validated as a blob
+/// CI `apply` step applies without user action, so it is validated as a blob
 /// hash before it is joined (no traversal, no absolute path), and the
 /// directory ENTRY must be a regular file ([`read_blob_entry`]): a symlink
 /// planted at `blobs/<hash>` must not carry the read out of the blobs
diff --git a/crates/socket-patch-core/src/patch/mod.rs b/crates/socket-patch-core/src/patch/mod.rs
index 9d73089a..ba709c6b 100644
--- a/crates/socket-patch-core/src/patch/mod.rs
+++ b/crates/socket-patch-core/src/patch/mod.rs
@@ -9,11 +9,3 @@ pub(crate) mod path_safety;
 pub mod redirect;
 pub mod rollback;
 pub mod sidecars;
-
-// Moved modules — these re-exports keep the old `patch::*` paths compiling
-// for external consumers of the published crate. Internal code must import
-// the new canonical paths (`crate::vendor::*`, `redirect::golang_local`);
-// CI greps reject new uses of the old ones. Drop these aliases in the next major.
-pub use crate::vendor;
-pub use crate::vendor::go_mod_edit;
-pub use redirect::golang_local as go_redirect;
diff --git a/crates/socket-patch-core/src/patch/redirect/mod.rs b/crates/socket-patch-core/src/patch/redirect/mod.rs
index 95a18343..4163755d 100644
--- a/crates/socket-patch-core/src/patch/redirect/mod.rs
+++ b/crates/socket-patch-core/src/patch/redirect/mod.rs
@@ -4705,7 +4705,7 @@ fn rewrite_gem(
     // `default_gemfile` tries gems.rb first — verified on bundler 4.0.15,
     // which warns "Multiple gemfiles (gems.rb and Gemfile) detected ...
     // bundler is ignoring them in favor of gems.rb and gems.locked"; same
-    // order as `setup::gem::discover_bundler_project`). DIVERGING spellings
+    // order as the ruby crawler's manifest probe). DIVERGING spellings
     // are ambiguous — the redirect would land in the file bundler reads while
     // tooling pinned to the other keeps resolving upstream — so fail closed
     // on the whole gem set. Divergence is judged on the redirect-footprint
diff --git a/crates/socket-patch-core/src/setup/composer/mod.rs b/crates/socket-patch-core/src/setup/composer/mod.rs
deleted file mode 100644
index 1783f8dd..00000000
--- a/crates/socket-patch-core/src/setup/composer/mod.rs
+++ /dev/null
@@ -1,935 +0,0 @@
-//! Composer (PHP) `setup` backend: wire the socket-patch re-apply hook into a
-//! project's `composer.json` `scripts`.
-//!
-//! Composer has a native post-install hook — the `post-install-cmd` and
-//! `post-update-cmd` script events fire after `composer install` /
-//! `composer update` finish populating `vendor/`. `setup` appends
-//! `socket-patch apply --offline --silent --ecosystems composer` to both so the
-//! committed `.socket/` patches are re-applied on every install/update (the
-//! socket-patch CLI must be on `PATH`, the same requirement as the gem Bundler
-//! plugin).
-//!
-//! `composer.json` is JSON, so — like the npm `package_json` backend — edits go
-//! through `serde_json` (with the workspace's `preserve_order` feature, so the
-//! user's key order survives) and are written back in the file's own
-//! formatting (see [`serialize_like_input`]). The contract mirrors the other
-//! backends: idempotent, `dry_run`-aware, `Updated`/`AlreadyConfigured`/
-//! `Error`, and a `--remove` that strips exactly what `setup` added.
-
-use std::path::{Path, PathBuf};
-
-use serde_json::{Map, Value};
-use tokio::fs;
-
-use crate::vendor::common::{detect_indent, serialize_json};
-
-/// The command `setup` appends to each composer script event. The socket-patch
-/// CLI is invoked from `PATH` (composer has no `npx`-style fetch), offline (the
-/// patches are committed under `.socket/`) and silent (so it doesn't clutter
-/// composer's own output).
-const APPLY_COMMAND: &str = "socket-patch apply --offline --silent --ecosystems composer";
-
-/// Composer script events `setup` wires: post-install-cmd fires after
-/// `composer install`, post-update-cmd after `composer update`. Covering both
-/// re-applies patches whenever the installed set could have changed.
-const HOOK_EVENTS: &[&str] = &["post-install-cmd", "post-update-cmd"];
-
-/// Loose marker for "this script line is ours" — used by `--check` detection so
-/// a slightly different flag set still reads as configured.
-const HOOK_MARKER: &str = "socket-patch apply";
-
-/// Outcome of one setup edit. Mirrors `setup::gem::GemSetupStatus`.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum ComposerSetupStatus {
-    Updated,
-    AlreadyConfigured,
-    Error,
-}
-
-#[derive(Debug)]
-pub struct ComposerEditResult {
-    /// Envelope `files[].kind` — always `composer`.
-    pub kind: &'static str,
-    pub path: String,
-    pub status: ComposerSetupStatus,
-    pub error: Option<String>,
-}
-
-/// Find the composer project rooted at `cwd`: the path to a `composer.json`
-/// directly in `cwd`. cwd-only, like the pypi backend (gem discovery walks up
-/// to the nearest Gemfile/gems.rb).
-pub async fn discover_composer_project(cwd: &Path) -> Option<PathBuf> {
-    let composer_json = cwd.join("composer.json");
-    fs::metadata(&composer_json)
-        .await
-        .is_ok()
-        .then_some(composer_json)
-}
-
-/// Static check: does this `composer.json` already wire our re-apply hook into
-/// any of the covered script events? Pure parse + scan — what a repo auditor
-/// reads. A user's own unrelated script does not match.
-pub fn is_hook_present(content: &str) -> bool {
-    let doc: Value = match serde_json::from_str(content) {
-        Ok(v) => v,
-        Err(_) => return false,
-    };
-    let scripts = match doc.get("scripts").and_then(Value::as_object) {
-        Some(s) => s,
-        None => return false,
-    };
-    HOOK_EVENTS
-        .iter()
-        .any(|event| event_contains_marker(scripts.get(*event)))
-}
-
-/// Whether a script-event value (string | array-of-strings) holds a command
-/// carrying our marker.
-fn event_contains_marker(value: Option<&Value>) -> bool {
-    match value {
-        Some(Value::String(s)) => s.contains(HOOK_MARKER),
-        Some(Value::Array(arr)) => arr
-            .iter()
-            .any(|v| v.as_str().is_some_and(|s| s.contains(HOOK_MARKER))),
-        _ => false,
-    }
-}
-
-// ── pure transforms ──────────────────────────────────────────────────────────
-
-/// Parse `composer.json` for editing, rejecting malformed input: the root must
-/// be a JSON object, and a present `scripts` must be an object (or `null`) —
-/// add refuses to clobber it, remove refuses to silently swallow it as a
-/// "nothing to remove" no-op.
-fn parse_checked(content: &str) -> Result<Value, String> {
-    let doc: Value =
-        serde_json::from_str(content).map_err(|e| format!("Invalid composer.json: {e}"))?;
-    if !doc.is_object() {
-        return Err("Invalid composer.json: root is not a JSON object".to_string());
-    }
-    if let Some(scripts) = doc.get("scripts") {
-        if !scripts.is_null() && !scripts.is_object() {
-            return Err("Invalid composer.json: \"scripts\" is not a JSON object".to_string());
-        }
-    }
-    Ok(doc)
-}
-
-/// Re-serialize the edited document in the formatting the file already used.
-///
-/// Composer writes `composer.json` through PHP's `JSON_PRETTY_PRINT`, which
-/// indents with 4 spaces, while serde's `to_string_pretty` is hard-wired to 2 —
-/// so re-serializing turned a two-key edit into a whole-file diff and left
-/// `--remove` unable to restore the original bytes. `detect_indent` /
-/// `serialize_json` are the same helpers the vendor backends use when they
-/// rewrite composer.json and the lockfiles. A file saved without a trailing
-/// newline keeps that too, since `serialize_json` always appends one.
-fn serialize_like_input(doc: &Value, original: &str) -> String {
-    let indent = detect_indent(original);
-    let mut text = match serialize_json(doc, &indent) {
-        // Always valid UTF-8: serde_json emits escaped ASCII/UTF-8 only.
-        Ok(bytes) => String::from_utf8_lossy(&bytes).into_owned(),
-        // Serializing a `Value` cannot fail; fall back to the 2-space form.
-        Err(_) => serde_json::to_string_pretty(doc).unwrap_or_default() + "\n",
-    };
-    if !original.ends_with('\n') {
-        text.pop();
-    }
-    text
-}
-
-/// Append [`APPLY_COMMAND`] to both hook events, normalising each to an array.
-/// `None` if already present in every event (idempotent no-op).
-fn composer_add(content: &str) -> Result<Option<String>, String> {
-    let mut doc = parse_checked(content)?;
-    let root = doc
-        .as_object_mut()
-        .expect("parse_checked guarantees an object root");
-
-    // Get-or-create the `scripts` object (replacing a `null`).
-    if !root.get("scripts").map(Value::is_object).unwrap_or(false) {
-        root.insert("scripts".to_string(), Value::Object(Map::new()));
-    }
-    let scripts = root
-        .get_mut("scripts")
-        .expect("the guard above inserts `scripts` when absent")
-        .as_object_mut()
-        .expect("the guard above replaces a non-object `scripts`");
-
-    let mut changed = false;
-    for event in HOOK_EVENTS {
-        changed |= add_command_to_event(scripts, event)?;
-    }
-    if !changed {
-        // We created an empty `scripts` object above only if it was absent;
-        // drop it again so a no-op truly changes nothing.
-        if root
-            .get("scripts")
-            .and_then(Value::as_object)
-            .is_some_and(Map::is_empty)
-        {
-            root.remove("scripts");
-        }
-        return Ok(None);
-    }
-    Ok(Some(serialize_like_input(&doc, content)))
-}
-
-/// Strip [`APPLY_COMMAND`] from both hook events, pruning emptied events and an
-/// emptied `scripts` object. `None` if our command is absent everywhere.
-fn composer_remove(content: &str) -> Result<Option<String>, String> {
-    let mut doc = parse_checked(content)?;
-    let root = doc
-        .as_object_mut()
-        .expect("parse_checked guarantees an object root");
-    // An absent (or `null`) `scripts` is a legitimate no-op: nothing of ours.
-    let scripts = match root.get_mut("scripts").and_then(Value::as_object_mut) {
-        Some(s) => s,
-        None => return Ok(None),
-    };
-
-    let mut changed = false;
-    for event in HOOK_EVENTS {
-        changed |= remove_command_from_event(scripts, event);
-    }
-    if !changed {
-        return Ok(None);
-    }
-    if scripts.is_empty() {
-        // shift_remove: with preserve_order, plain `remove` is swap_remove and
-        // would teleport the last root key into this slot.
-        root.shift_remove("scripts");
-    }
-    Ok(Some(serialize_like_input(&doc, content)))
-}
-
-/// Add [`APPLY_COMMAND`] to one event, normalising string → array. Returns
-/// whether the event changed; errors on a non-string/array event value it
-/// refuses to clobber. Any command already carrying [`HOOK_MARKER`]
-/// counts as present — the same predicate as [`is_hook_present`] / `--check`,
-/// so a user-customized flag set is left alone rather than duplicated.
-fn add_command_to_event(scripts: &mut Map<String, Value>, event: &str) -> Result<bool, String> {
-    if event_contains_marker(scripts.get(event)) {
-        return Ok(false);
-    }
-    let cmd = Value::String(APPLY_COMMAND.to_string());
-    match scripts.get_mut(event) {
-        None => {
-            scripts.insert(event.to_string(), Value::Array(vec![cmd]));
-            Ok(true)
-        }
-        Some(Value::String(s)) => {
-            let existing = Value::String(s.clone());
-            scripts.insert(event.to_string(), Value::Array(vec![existing, cmd]));
-            Ok(true)
-        }
-        Some(Value::Array(arr)) => {
-            arr.push(cmd);
-            Ok(true)
-        }
-        // A non-string/array script value is user data we won't clobber — and
-        // can't wire into, so treating it as "no change" would surface as
-        // AlreadyConfigured while `--check` says not configured. Refuse loudly,
-        // like the non-object-`scripts` guard.
-        Some(_) => Err(format!(
-            "Invalid composer.json: \"{event}\" script is not a string or array"
-        )),
-    }
-}
-
-/// Remove [`APPLY_COMMAND`] from one event, pruning an emptied event key.
-/// Returns whether the event changed.
-fn remove_command_from_event(scripts: &mut Map<String, Value>, event: &str) -> bool {
-    // shift_remove throughout: with preserve_order, plain `remove` is
-    // swap_remove and would shuffle the user's other scripts.
-    match scripts.get_mut(event) {
-        Some(Value::String(s)) if s == APPLY_COMMAND => {
-            scripts.shift_remove(event);
-            true
-        }
-        Some(Value::Array(arr)) => {
-            let before = arr.len();
-            arr.retain(|v| v.as_str() != Some(APPLY_COMMAND));
-            if arr.len() == before {
-                return false;
-            }
-            if arr.is_empty() {
-                scripts.shift_remove(event);
-            }
-            true
-        }
-        _ => false,
-    }
-}
-
-// ── async wrappers ───────────────────────────────────────────────────────────
-
-/// Wire the project: append our command to the composer script events.
-pub async fn add_hook(composer_json: &Path, dry_run: bool) -> ComposerEditResult {
-    edit(composer_json, dry_run, composer_add).await
-}
-
-/// Unwire the project: strip our command, pruning emptied keys.
-pub async fn remove_hook(composer_json: &Path, dry_run: bool) -> ComposerEditResult {
-    edit(composer_json, dry_run, composer_remove).await
-}
-
-async fn edit(
-    composer_json: &Path,
-    dry_run: bool,
-    transform: impl FnOnce(&str) -> Result<Option<String>, String>,
-) -> ComposerEditResult {
-    let result = async {
-        // Guarded read: a FIFO planted as `composer.json` would make a plain
-        // `read_to_string` open block forever waiting for a writer —
-        // discovery accepts any path whose metadata stats, so it reaches
-        // here unopened. The shared reader rejects non-regular files.
-        let content = match crate::utils::fs::read_regular_to_string(composer_json).await {
-            Ok(c) => c,
-            // A missing composer.json on remove is a no-op, not an error.
-            Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(false),
-            Err(e) => return Err(e.to_string()),
-        };
-        match transform(&content)? {
-            None => Ok(false),
-            Some(new) => {
-                if !dry_run {
-                    // Atomic (stage+fsync+rename), so the user's committed
-                    // composer.json is never left torn by a crash mid-write,
-                    // and mode-preserving, because the rename swaps in a fresh
-                    // inode that would otherwise take umask defaults — the
-                    // same writer every sibling manifest editor uses.
-                    crate::utils::fs::atomic_write_bytes_preserving_mode(
-                        composer_json,
-                        new.as_bytes(),
-                    )
-                    .await
-                    .map_err(|e| e.to_string())?;
-                }
-                Ok(true)
-            }
-        }
-    }
-    .await;
-    let (status, error) = match result {
-        Ok(true) => (ComposerSetupStatus::Updated, None),
-        Ok(false) => (ComposerSetupStatus::AlreadyConfigured, None),
-        Err(e) => (ComposerSetupStatus::Error, Some(e)),
-    };
-    ComposerEditResult {
-        kind: "composer",
-        path: composer_json.display().to_string(),
-        status,
-        error,
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    const BASIC: &str =
-        "{\n  \"name\": \"acme/app\",\n  \"require\": {\n    \"php\": \">=8.1\"\n  }\n}\n";
-
-    fn parse(s: &str) -> Value {
-        serde_json::from_str(s).unwrap()
-    }
-
-    #[test]
-    fn test_add_wires_both_events_and_is_idempotent() {
-        let out = composer_add(BASIC).unwrap().unwrap();
-        let doc = parse(&out);
-        for event in HOOK_EVENTS {
-            let arr = doc["scripts"][event].as_array().unwrap();
-            assert!(
-                arr.iter().any(|v| v == APPLY_COMMAND),
-                "{event} must carry our command"
-            );
-        }
-        assert!(is_hook_present(&out));
-        // Idempotent: second add is a no-op.
-        assert!(composer_add(&out).unwrap().is_none());
-    }
-
-    #[test]
-    fn test_add_preserves_key_order_and_require() {
-        let out = composer_add(BASIC).unwrap().unwrap();
-        // `name` and `require` must precede the appended `scripts`.
-        let pos_name = out.find("\"name\"").unwrap();
-        let pos_require = out.find("\"require\"").unwrap();
-        let pos_scripts = out.find("\"scripts\"").unwrap();
-        assert!(
-            pos_name < pos_require && pos_require < pos_scripts,
-            "key order preserved:\n{out}"
-        );
-        assert_eq!(parse(&out)["require"]["php"], ">=8.1");
-    }
-
-    #[test]
-    fn test_add_preserves_user_script_as_array_member() {
-        let with_user = "{\n  \"scripts\": {\n    \"post-install-cmd\": \"@php artisan\"\n  }\n}\n";
-        let out = composer_add(with_user).unwrap().unwrap();
-        let arr = parse(&out)["scripts"]["post-install-cmd"]
-            .as_array()
-            .unwrap()
-            .clone();
-        assert!(arr.iter().any(|v| v == "@php artisan"), "user command kept");
-        assert!(arr.iter().any(|v| v == APPLY_COMMAND), "ours appended");
-        // post-update-cmd is freshly created.
-        assert!(parse(&out)["scripts"]["post-update-cmd"]
-            .as_array()
-            .unwrap()
-            .iter()
-            .any(|v| v == APPLY_COMMAND));
-    }
-
-    #[test]
-    fn test_remove_restores_user_only_state() {
-        let with_user = "{\n  \"scripts\": {\n    \"post-install-cmd\": \"@php artisan\"\n  }\n}\n";
-        let added = composer_add(with_user).unwrap().unwrap();
-        let removed = composer_remove(&added).unwrap().unwrap();
-        let doc = parse(&removed);
-        // Our command is gone everywhere.
-        assert!(!is_hook_present(&removed));
-        // The user's command survives (still present in post-install-cmd).
-        let pi = doc["scripts"]["post-install-cmd"].as_array().unwrap();
-        assert!(pi.iter().any(|v| v == "@php artisan"));
-        // The event we created solely for our command is pruned.
-        assert!(doc["scripts"].get("post-update-cmd").is_none());
-    }
-
-    #[test]
-    fn test_remove_prunes_scripts_object_when_only_ours() {
-        let added = composer_add(BASIC).unwrap().unwrap();
-        let removed = composer_remove(&added).unwrap().unwrap();
-        // We created `scripts` solely for our two events; removing both prunes it.
-        assert!(
-            parse(&removed).get("scripts").is_none(),
-            "emptied scripts pruned:\n{removed}"
-        );
-        assert!(!is_hook_present(&removed));
-    }
-
-    #[test]
-    fn test_remove_absent_is_noop() {
-        assert!(composer_remove(BASIC).unwrap().is_none());
-    }
-
-    #[test]
-    fn test_round_trip_restores_basic_byte_for_byte() {
-        // A composer.json already in 2-space `to_string_pretty` form round-trips
-        // byte-for-byte: add then remove yields the input exactly.
-        let added = composer_add(BASIC).unwrap().unwrap();
-        let removed = composer_remove(&added).unwrap().unwrap();
-        assert_eq!(removed, BASIC, "add→remove restores the original bytes");
-    }
-
-    /// Composer writes `composer.json` with PHP's `JSON_PRETTY_PRINT`, i.e.
-    /// 4-space indent — the shape virtually every real-world manifest has.
-    const COMPOSER_AUTHORED: &str =
-        "{\n    \"name\": \"acme/app\",\n    \"require\": {\n        \"php\": \">=8.1\"\n    }\n}\n";
-
-    #[test]
-    fn test_add_preserves_composer_four_space_indent() {
-        // Regression: re-serializing at serde's fixed 2-space indent reformatted
-        // a composer-authored manifest top to bottom, turning a one-key edit
-        // into a whole-file diff.
-        let out = composer_add(COMPOSER_AUTHORED).unwrap().unwrap();
-        assert!(
-            out.contains("\n    \"name\": \"acme/app\","),
-            "depth-1 indent not preserved:\n{out}"
-        );
-        assert!(
-            out.contains("\n        \"php\": \">=8.1\""),
-            "depth-2 indent not preserved:\n{out}"
-        );
-        assert!(
-            out.contains("\n    \"scripts\": {"),
-            "our own added key must use the file's indent:\n{out}"
-        );
-        assert!(is_hook_present(&out));
-    }
-
-    #[test]
-    fn test_round_trip_restores_composer_authored_manifest() {
-        // The whole point of preserving the indent: `--remove` must give the
-        // user back the exact bytes composer wrote, not a reformatted file.
-        let added = composer_add(COMPOSER_AUTHORED).unwrap().unwrap();
-        let removed = composer_remove(&added).unwrap().unwrap();
-        assert_eq!(
-            removed, COMPOSER_AUTHORED,
-            "add→remove must restore composer's own formatting"
-        );
-    }
-
-    #[test]
-    fn test_round_trip_preserves_tab_indent() {
-        let inp =
-            "{\n\t\"name\": \"acme/app\",\n\t\"require\": {\n\t\t\"php\": \">=8.1\"\n\t}\n}\n";
-        let added = composer_add(inp).unwrap().unwrap();
-        assert!(
-            added.contains("\n\t\"scripts\": {"),
-            "tab indent not preserved:\n{added}"
-        );
-        assert_eq!(composer_remove(&added).unwrap().unwrap(), inp);
-    }
-
-    #[test]
-    fn test_round_trip_preserves_absent_trailing_newline() {
-        // `serialize_json` always appends a trailing newline, so a manifest
-        // saved without one would gain a phantom last-line diff that `--remove`
-        // could never take back.
-        let inp = COMPOSER_AUTHORED.trim_end_matches('\n');
-        let added = composer_add(inp).unwrap().unwrap();
-        assert!(
-            !added.ends_with('\n'),
-            "must not add a trailing newline the file did not have:\n{added:?}"
-        );
-        assert_eq!(composer_remove(&added).unwrap().unwrap(), inp);
-    }
-
-    #[test]
-    fn test_user_string_event_already_ours_is_noop() {
-        // An event whose string value is exactly our command counts as present.
-        let already = format!(
-            "{{\n  \"scripts\": {{\n    \"post-install-cmd\": \"{APPLY_COMMAND}\",\n    \"post-update-cmd\": \"{APPLY_COMMAND}\"\n  }}\n}}\n"
-        );
-        assert!(is_hook_present(&already));
-        assert!(
-            composer_add(&already).unwrap().is_none(),
-            "exact-string command is idempotent"
-        );
-    }
-
-    #[test]
-    fn test_invalid_json_is_error() {
-        assert!(composer_add("not json!!!").is_err());
-    }
-
-    #[test]
-    fn test_non_object_scripts_is_error() {
-        assert!(composer_add("{\"scripts\": \"oops\"}").is_err());
-    }
-
-    #[test]
-    fn test_is_hook_present_false_without_scripts() {
-        assert!(!is_hook_present(BASIC));
-        assert!(!is_hook_present("{}"));
-    }
-
-    #[test]
-    fn test_is_hook_present_false_on_malformed_json() {
-        // An unparseable composer.json reads as "not configured" — the
-        // `--check` probe is a pure scan that must never crash or wedge on
-        // malformed input.
-        assert!(!is_hook_present("{ not json"));
-        assert!(!is_hook_present(""));
-        // The asymmetry is intentional and must stay so: on the very same
-        // bytes `setup` (composer_add) errors loudly instead of quietly
-        // reporting AlreadyConfigured — so `--check` says needs-configuration
-        // and `setup` refuses with an error, never a silent success.
-        assert!(composer_add("{ not json").is_err());
-        assert!(composer_add("").is_err());
-    }
-
-    #[tokio::test]
-    async fn test_async_add_remove_round_trip() {
-        let dir = tempfile::tempdir().unwrap();
-        let cj = dir.path().join("composer.json");
-        fs::write(&cj, BASIC).await.unwrap();
-        let found = discover_composer_project(dir.path()).await.unwrap();
-
-        let added = add_hook(&found, false).await;
-        assert_eq!(added.status, ComposerSetupStatus::Updated);
-        assert!(is_hook_present(&fs::read_to_string(&cj).await.unwrap()));
-
-        // Idempotent.
-        assert_eq!(
-            add_hook(&found, false).await.status,
-            ComposerSetupStatus::AlreadyConfigured
-        );
-
-        let removed = remove_hook(&found, false).await;
-        assert_eq!(removed.status, ComposerSetupStatus::Updated);
-        assert_eq!(
-            fs::read_to_string(&cj).await.unwrap(),
-            BASIC,
-            "byte-for-byte restore"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_async_dry_run_does_not_write() {
-        let dir = tempfile::tempdir().unwrap();
-        let cj = dir.path().join("composer.json");
-        fs::write(&cj, BASIC).await.unwrap();
-        let found = discover_composer_project(dir.path()).await.unwrap();
-        let res = add_hook(&found, true).await;
-        assert_eq!(res.status, ComposerSetupStatus::Updated);
-        assert_eq!(
-            fs::read_to_string(&cj).await.unwrap(),
-            BASIC,
-            "dry-run must not write"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_discover_none_without_composer_json() {
-        let dir = tempfile::tempdir().unwrap();
-        assert!(discover_composer_project(dir.path()).await.is_none());
-    }
-
-    #[test]
-    fn test_remove_round_trip_with_other_user_scripts() {
-        // add then remove restores a composer.json that already had unrelated
-        // scripts, byte-for-byte (our two events are added and then pruned).
-        let inp = "{\n  \"name\": \"x\",\n  \"scripts\": {\n    \"test\": \"phpunit\"\n  }\n}\n";
-        let added = composer_add(inp).unwrap().unwrap();
-        let removed = composer_remove(&added).unwrap().unwrap();
-        assert_eq!(removed, inp, "round-trip with user scripts");
-    }
-
-    #[test]
-    fn test_remove_non_object_root_is_error() {
-        // Regression: composer_remove must reject a malformed (non-object) root
-        // with an error, not silently report "nothing to remove" — matching
-        // composer_add and the npm `remove_package_json_content` contract.
-        let err = composer_remove("[1, 2, 3]").unwrap_err();
-        assert!(err.contains("root is not a JSON object"), "got: {err}");
-        assert!(composer_remove("\"just a string\"").is_err());
-        assert!(composer_remove("42").is_err());
-    }
-
-    #[test]
-    fn test_remove_non_object_scripts_is_error() {
-        // Regression: a present-but-non-object `scripts` is malformed. `setup`
-        // (composer_add) errors on it; `setup --remove` must too, rather than
-        // silently swallowing it as a no-op success.
-        let err = composer_remove("{\"scripts\": \"oops\"}").unwrap_err();
-        assert!(
-            err.contains("\"scripts\" is not a JSON object"),
-            "got: {err}"
-        );
-        assert!(composer_remove("{\"scripts\": 7}").is_err());
-        assert!(composer_remove("{\"scripts\": [\"a\"]}").is_err());
-        // add and remove agree on what counts as malformed.
-        assert!(composer_add("{\"scripts\": \"oops\"}").is_err());
-    }
-
-    #[test]
-    fn test_remove_absent_or_null_scripts_is_noop_not_error() {
-        // A genuinely absent or null `scripts` has nothing of ours: no-op, not
-        // an error (the malformed-input guard must not over-trigger).
-        assert!(composer_remove("{\"name\": \"x\"}").unwrap().is_none());
-        assert!(composer_remove("{\"scripts\": null}").unwrap().is_none());
-    }
-
-    #[test]
-    fn test_exhaustive_invariants() {
-        let event_values = [
-            None,
-            Some(format!("\"{APPLY_COMMAND}\"")),
-            Some("\"@php artisan\"".to_string()),
-            Some(format!("[\"{APPLY_COMMAND}\"]")),
-            Some("[\"@php artisan\"]".to_string()),
-            Some(format!("[\"@php artisan\",\"{APPLY_COMMAND}\"]")),
-            Some("[]".to_string()),
-        ];
-        for a in &event_values {
-            for b in &event_values {
-                let mut parts = vec![];
-                if let Some(v) = a {
-                    parts.push(format!("\"post-install-cmd\":{v}"));
-                }
-                if let Some(v) = b {
-                    parts.push(format!("\"post-update-cmd\":{v}"));
-                }
-                let json = format!("{{\"scripts\":{{{}}}}}", parts.join(","));
-
-                // add is idempotent
-                let after_add = match composer_add(&json).unwrap() {
-                    Some(out) => {
-                        assert!(
-                            is_hook_present(&out),
-                            "add changed but not present:\n{json}\n{out}"
-                        );
-                        assert!(
-                            composer_add(&out).unwrap().is_none(),
-                            "add NOT idempotent:\n{json}\n{out}"
-                        );
-                        out
-                    }
-                    None => json.clone(),
-                };
-
-                // after a full add, both events must carry our command
-                if composer_add(&json).unwrap().is_some() {
-                    assert!(is_hook_present(&after_add));
-                }
-
-                // remove undoes add, and remove is idempotent
-                if let Some(rem) = composer_remove(&after_add).unwrap() {
-                    assert!(
-                        composer_remove(&rem).unwrap().is_none(),
-                        "remove NOT idempotent:\n{after_add}\n{rem}"
-                    );
-                }
-            }
-        }
-    }
-
-    #[test]
-    fn test_add_noops_on_flag_variant_hook() {
-        // Regression: `setup --check` (is_hook_present) treats any
-        // `socket-patch apply` variant as configured, and `setup` must agree —
-        // appending the stock command next to a user-customized flag set would
-        // run the hook twice on every install. Mirrors the npm backend's
-        // `script_is_configured` contract (loose marker on both sides).
-        let customized = "{\"scripts\":{\
-            \"post-install-cmd\":[\"socket-patch apply --offline --ecosystems composer\"],\
-            \"post-update-cmd\":\"socket-patch apply --offline --ecosystems composer\"}}";
-        assert!(is_hook_present(customized), "variant reads as configured");
-        assert!(
-            composer_add(customized).unwrap().is_none(),
-            "add must not duplicate a hook --check already reports as configured"
-        );
-    }
-
-    // ── atomic-write contract (no truncation / no stage litter) ──────
-    //
-    // The edit must go through stage+fsync+rename, never a bare truncating
-    // write, so a crash can't leave the user's committed composer.json empty.
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_add_replaces_readonly_manifest_atomically() {
-        use std::os::unix::fs::PermissionsExt;
-        // Oracle for the truncating-write bug: rename needs only directory
-        // write permission, while a bare `fs::write` must open the target
-        // itself for writing — so a read-only composer.json distinguishes the
-        // two (EACCES under truncate, clean replace under stage+rename, same
-        // as the npm/pypi/cargo/go manifest writers).
-        let dir = tempfile::tempdir().unwrap();
-        let cj = dir.path().join("composer.json");
-        fs::write(&cj, BASIC).await.unwrap();
-        std::fs::set_permissions(&cj, std::fs::Permissions::from_mode(0o444)).unwrap();
-
-        let found = discover_composer_project(dir.path()).await.unwrap();
-        let res = add_hook(&found, false).await;
-        assert_eq!(
-            res.status,
-            ComposerSetupStatus::Updated,
-            "err: {:?}",
-            res.error
-        );
-        assert!(is_hook_present(&fs::read_to_string(&cj).await.unwrap()));
-    }
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_edit_preserves_manifest_permissions() {
-        use std::os::unix::fs::PermissionsExt;
-        // Regression: `composer.json` is a file the *user* owns and we merely
-        // edit, so the stage+rename must carry the destination's mode onto the
-        // new inode. The plain writer creates the stage with umask defaults, so
-        // the rename silently reset the user's mode — a 0600 private manifest
-        // becomes world-readable, a 0664 group-writable one locks the group
-        // out. Same contract as the npm sibling (`package_json::update`).
-        //
-        // The owner-exec bit is the umask-proof oracle: no umask can *add* a
-        // bit, so 0o744 can never come from a 0o666-based create.
-        let dir = tempfile::tempdir().unwrap();
-        let cj = dir.path().join("composer.json");
-        fs::write(&cj, BASIC).await.unwrap();
-        std::fs::set_permissions(&cj, std::fs::Permissions::from_mode(0o744)).unwrap();
-        let found = discover_composer_project(dir.path()).await.unwrap();
-
-        let added = add_hook(&found, false).await;
-        assert_eq!(
-            added.status,
-            ComposerSetupStatus::Updated,
-            "{:?}",
-            added.error
-        );
-        let mode = std::fs::metadata(&cj).unwrap().permissions().mode() & 0o777;
-        assert_eq!(mode, 0o744, "add must not reset the manifest's mode");
-
-        let removed = remove_hook(&found, false).await;
-        assert_eq!(removed.status, ComposerSetupStatus::Updated);
-        let mode = std::fs::metadata(&cj).unwrap().permissions().mode() & 0o777;
-        assert_eq!(mode, 0o744, "remove must not reset the manifest's mode");
-    }
-
-    #[tokio::test]
-    async fn test_edit_leaves_no_stage_litter() {
-        let dir = tempfile::tempdir().unwrap();
-        let cj = dir.path().join("composer.json");
-        fs::write(&cj, BASIC).await.unwrap();
-        let found = discover_composer_project(dir.path()).await.unwrap();
-
-        assert_eq!(
-            add_hook(&found, false).await.status,
-            ComposerSetupStatus::Updated
-        );
-        assert_eq!(
-            remove_hook(&found, false).await.status,
-            ComposerSetupStatus::Updated
-        );
-        assert_eq!(fs::read_to_string(&cj).await.unwrap(), BASIC);
-
-        // No half-written `.socket-stage-*` sibling left behind.
-        let mut rd = fs::read_dir(dir.path()).await.unwrap();
-        while let Some(entry) = rd.next_entry().await.unwrap() {
-            let name = entry.file_name().to_string_lossy().into_owned();
-            assert!(!name.starts_with(".socket-stage-"), "stage litter: {name}");
-        }
-    }
-
-    #[test]
-    fn test_remove_event_prune_preserves_sibling_script_order() {
-        // Regression: with preserve_order, serde_json's `Map::remove` is
-        // swap_remove — pruning an emptied event key teleported the *last*
-        // script into its slot, shuffling the user's own scripts. Scenario:
-        // setup wired the events first, the user appended scripts later.
-        let inp = format!(
-            "{{\"scripts\":{{\"post-install-cmd\":[\"{APPLY_COMMAND}\"],\"post-update-cmd\":[\"{APPLY_COMMAND}\"],\"test\":\"phpunit\",\"lint\":\"phpcs\"}}}}"
-        );
-        let removed = composer_remove(&inp).unwrap().unwrap();
-        assert!(!is_hook_present(&removed));
-        let pos_test = removed.find("\"test\"").unwrap();
-        let pos_lint = removed.find("\"lint\"").unwrap();
-        assert!(
-            pos_test < pos_lint,
-            "sibling script order must survive event pruning:\n{removed}"
-        );
-    }
-
-    #[test]
-    fn test_remove_scripts_prune_preserves_root_key_order() {
-        // Regression: same swap_remove hazard at the root — pruning an emptied
-        // `scripts` object teleported the last root key into its slot.
-        let inp = format!(
-            "{{\"name\":\"acme/app\",\"scripts\":{{\"post-install-cmd\":[\"{APPLY_COMMAND}\"]}},\"require\":{{\"php\":\">=8.1\"}},\"autoload\":{{}}}}"
-        );
-        let removed = composer_remove(&inp).unwrap().unwrap();
-        assert!(parse(&removed).get("scripts").is_none(), "scripts pruned");
-        let pos_name = removed.find("\"name\"").unwrap();
-        let pos_require = removed.find("\"require\"").unwrap();
-        let pos_autoload = removed.find("\"autoload\"").unwrap();
-        assert!(
-            pos_name < pos_require && pos_require < pos_autoload,
-            "root key order must survive scripts pruning:\n{removed}"
-        );
-    }
-
-    #[test]
-    fn test_add_malformed_event_value_is_error_not_silent_success() {
-        // Regression: an event value that is neither string nor array can't be
-        // wired (we won't clobber it), but reporting "no change" surfaced as
-        // AlreadyConfigured — exit-0 success — while `--check`
-        // (is_hook_present) says not configured on the very same file. Refusal
-        // must be a loud error, matching the non-object-`scripts` guard.
-        let malformed = "{\"scripts\":{\"post-install-cmd\":42,\"post-update-cmd\":{\"a\":\"b\"}}}";
-        assert!(!is_hook_present(malformed), "nothing configured here");
-        let err = composer_add(malformed).unwrap_err();
-        assert!(
-            err.contains("not a string or array"),
-            "refusal must be an error, got: {err}"
-        );
-        // remove stays a no-op: a non-string/array value can't hold our
-        // command, so there is honestly nothing to strip.
-        assert!(composer_remove(malformed).unwrap().is_none());
-    }
-
-    /// Plant a FIFO with a direct `mkfifo(2)` syscall — same helper as the
-    /// find.rs / package_json FIFO tests: fork/exec flakes under heavy
-    /// parallel load and the syscall needs no process at all.
-    #[cfg(unix)]
-    fn mkfifo(path: &Path) {
-        use std::os::unix::ffi::OsStrExt;
-        let c_path =
-            std::ffi::CString::new(path.as_os_str().as_bytes()).expect("fifo path has no NUL");
-        let rc = unsafe { libc::mkfifo(c_path.as_ptr(), 0o644) };
-        assert_eq!(
-            rc,
-            0,
-            "mkfifo(2) failed: {}",
-            std::io::Error::last_os_error()
-        );
-    }
-
-    /// A FIFO planted as `composer.json` must not wedge setup. Discovery
-    /// accepts any path whose metadata stats (a FIFO does), then setup calls
-    /// `add_hook` on it; a plain `read_to_string` open(2) on a FIFO waits for
-    /// a writer that never comes, wedging `socket-patch setup` indefinitely
-    /// with no error and no timeout. Same class as the `open_regular_file`
-    /// guards in package_json/update.rs, find.rs and the crawlers.
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_add_fifo_composer_json_does_not_wedge() {
-        let dir = tempfile::tempdir().unwrap();
-        let fifo = dir.path().join("composer.json");
-        mkfifo(&fifo);
-        // Discovery lists it (metadata-only gate), so the production path
-        // reaches the edit's read unopened.
-        assert!(discover_composer_project(dir.path()).await.is_some());
-
-        // On timeout the open is wedged in a `spawn_blocking` thread that
-        // the runtime waits for on shutdown; connect a writer to release
-        // it so the test can FAIL instead of hanging the whole suite.
-        let deadline = std::time::Duration::from_secs(5);
-        let Ok(result) = tokio::time::timeout(deadline, add_hook(&fifo, false)).await else {
-            let _ = std::fs::OpenOptions::new().write(true).open(&fifo);
-            panic!("add_hook must complete promptly with a FIFO composer.json");
-        };
-        assert_eq!(result.status, ComposerSetupStatus::Error);
-        assert!(result.error.is_some());
-    }
-
-    /// The removal twin: `setup --remove` reads the discovered composer.json
-    /// through `remove_hook`, so a FIFO wedged it the same way.
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_remove_fifo_composer_json_does_not_wedge() {
-        let dir = tempfile::tempdir().unwrap();
-        let fifo = dir.path().join("composer.json");
-        mkfifo(&fifo);
-
-        let deadline = std::time::Duration::from_secs(5);
-        let Ok(result) = tokio::time::timeout(deadline, remove_hook(&fifo, false)).await else {
-            let _ = std::fs::OpenOptions::new().write(true).open(&fifo);
-            panic!("remove_hook must complete promptly with a FIFO composer.json");
-        };
-        assert_eq!(result.status, ComposerSetupStatus::Error);
-        assert!(result.error.is_some());
-    }
-
-    #[test]
-    fn test_add_then_check_consistency() {
-        // For every input where add reports a change, is_hook_present must be true.
-        let inputs = [
-            BASIC,
-            "{\"scripts\":{\"post-install-cmd\":\"@php artisan\"}}",
-            "{\"scripts\":{\"post-install-cmd\":[\"a\",\"b\"]}}",
-            "{\"scripts\":{}}",
-            "{\"scripts\":null}",
-            "{}",
-        ];
-        for inp in inputs {
-            if let Some(out) = composer_add(inp).unwrap() {
-                assert!(
-                    is_hook_present(&out),
-                    "add changed but check false for {inp}\n{out}"
-                );
-                // second add is a no-op
-                assert!(
-                    composer_add(&out).unwrap().is_none(),
-                    "not idempotent for {inp}"
-                );
-                // remove undoes
-                let rem = composer_remove(&out).unwrap().unwrap();
-                assert!(!is_hook_present(&rem), "remove left hook for {inp}\n{rem}");
-            }
-        }
-    }
-}
diff --git a/crates/socket-patch-core/src/setup/gem/mod.rs b/crates/socket-patch-core/src/setup/gem/mod.rs
deleted file mode 100644
index e592dc7b..00000000
--- a/crates/socket-patch-core/src/setup/gem/mod.rs
+++ /dev/null
@@ -1,2157 +0,0 @@
-//! Gem (Bundler) `setup` support: wire a Ruby project for automatic patching.
-//!
-//! Bundler loads a declared **plugin** whenever one of its subscribed hook
-//! events fires — on every `bundle install`, fresh AND fully cached (verified
-//! against bundler 2.7 and 4.0). So setup delivers the gate as a generated,
-//! git-committed Bundler plugin plus a `plugin` directive in the Gemfile:
-//!
-//!   * `.socket/bundler-plugin/{plugins.rb, socket-patch.gemspec}` — a generated
-//!     plugin whose `plugins.rb` re-runs `socket-patch apply --ecosystems gem`
-//!     on every `bundle install` (digest-gated load-time + per-gem
-//!     `after-install` triggers, forced `after-install-all` re-apply). A patch
-//!     failure warns with a remediation and lets the install continue —
-//!     bundler evaluates `plugins.rb` at plugin REGISTRATION, before any
-//!     project gem is installed, so raising there would deadlock a fresh
-//!     clone on its own first `bundle install` (plugin registration fails and
-//!     every retry fails identically). `SOCKET_PATCH_STRICT=1` restores
-//!     raise-on-failure (`Bundler::BundlerError`);
-//!   * a managed block appended to the `Gemfile` that references the plugin via
-//!     `plugin "socket-patch", path: File.expand_path(".socket/bundler-plugin",
-//!     __dir__)`. The source must be `path:` — Bundler fetches `git:` plugin
-//!     sources with `git clone`, and the generated dir is a plain directory
-//!     (committing it to the parent repo does not give it a `.git`), so `git:`
-//!     fails every `bundle install`. The directory still must be committed so
-//!     clones and CI have the plugin on disk;
-//!   * a `.socket/.gitignore` entry for the plugin's digest stamp
-//!     (`gem-plugin-stamp`) — everything else under `.socket/` is meant to be
-//!     committed, and an untracked stamp in every wired repo's `git status`
-//!     invites a `git add .socket` that ships one machine's digest to every
-//!     clone.
-//!
-//! The actual gem patching is done by `apply` (unchanged); this module only
-//! manages the setup wiring. Phase 2 (follow-up) replaces the in-tree plugin
-//! with a published `socket-patch-bundler` gem.
-
-mod update;
-mod version;
-
-use std::path::{Path, PathBuf};
-
-use tokio::fs;
-
-// Guarded read for every raw read in this module tree: a FIFO planted at any
-// path setup reads (`plugins.rb`, the gemspec, `.socket/.gitignore`,
-// bundler's plugin index, `Gemfile.lock`) fails fast with `InvalidInput`
-// instead of wedging `setup`/`--check`/`--remove` forever in an `open(2)`
-// that waits for a writer.
-use crate::utils::fs::read_regular_to_string;
-
-pub use update::{
-    add_plugin_directive, add_plugin_directive_with, is_plugin_directive_present,
-    remove_plugin_directive, GemEditResult, GemSetupStatus,
-};
-pub use version::{probe_bundler, unsupported_bundler_message, BundlerProbe, MIN_BUNDLER};
-
-/// The in-tree plugin directory, relative to the project root.
-const PLUGIN_DIR: &str = ".socket/bundler-plugin";
-/// First line of every generated plugin file — the ownership signal for removal
-/// (we never delete a file that lacks it).
-const GENERATED_MARKER: &str = "# Code generated by `socket-patch setup`. DO NOT EDIT.";
-/// The generated plugin's digest stamp, relative to the project root
-/// (machine-local state; the plugin owns its content, setup owns its lifecycle).
-const STAMP_REL: &str = ".socket/gem-plugin-stamp";
-/// The `.socket/.gitignore` line that keeps the stamp out of version control.
-/// Everything else under `.socket/` is meant to be committed, so without this
-/// line every install drops an untracked stamp into `git status` — and a stamp
-/// committed by a blanket `git add .socket` ships one machine's digest to
-/// every clone.
-const STAMP_IGNORE_LINE: &str = "/gem-plugin-stamp";
-
-/// The generated `plugins.rb` body (the three-trigger idempotent applier).
-const PLUGINS_RB: &str = include_str!("templates/plugins.rb.tmpl");
-/// The generated plugin gemspec.
-const GEMSPEC: &str = include_str!("templates/gemspec.tmpl");
-
-/// A discovered Bundler project.
-#[derive(Debug, Clone)]
-pub struct BundlerProject {
-    /// Directory containing the Gemfile (the project root). The plugin dir and
-    /// `.socket/manifest.json` live here.
-    pub root: PathBuf,
-    /// The Bundler manifest to edit (`Gemfile` or `gems.rb`).
-    pub gemfile: PathBuf,
-}
-
-/// Find the Bundler project that `cwd` belongs to by walking up to the nearest
-/// directory holding Bundler's alternate `gems.rb` or a `Gemfile` — exactly
-/// how `bundle` itself resolves the manifest. The discovered
-/// directory (not `cwd`) becomes the project `root`, so `.socket/` and the
-/// plugin dir land next to the manifest even when `setup` is run from a
-/// subdirectory. Returns `None` when no ancestor has one — a `Gemfile.lock`
-/// alone is not editable, so it does not count.
-///
-/// The name order is Bundler's own: `Bundler::SharedHelpers.gemfile_names` is
-/// `["gems.rb", "Gemfile"]`, and both names are tried in each directory before
-/// ascending (`search_up`), so `gems.rb` only wins within a single directory —
-/// a nearer `Gemfile` still beats a farther `gems.rb`. Getting this backwards
-/// wires the `plugin` directive into the file `bundle` *ignores* (it even warns
-/// "Multiple gemfiles (gems.rb and Gemfile) detected ... bundler is ignoring
-/// them in favor of gems.rb and gems.locked"), so the plugin never loads and
-/// every `bundle install` silently reverts the gem patches.
-pub async fn discover_bundler_project(cwd: &Path) -> Option<BundlerProject> {
-    let mut dir = cwd.to_path_buf();
-    loop {
-        for name in ["gems.rb", "Gemfile"] {
-            let candidate = dir.join(name);
-            // Regular files only, like bundler's own gate
-            // (`SharedHelpers.find_file` accepts a candidate with
-            // `File.file?`): a directory or FIFO named `Gemfile` is skipped
-            // and the walk continues to the manifest `bundle` actually
-            // loads. Bare `metadata` would select it — handing the Gemfile
-            // editor a directory (setup errors in a project where `bundle
-            // install` works fine) or a FIFO (whose plain `open(2)` blocks
-            // forever waiting for a writer).
-            if fs::metadata(&candidate).await.is_ok_and(|m| m.is_file()) {
-                return Some(BundlerProject {
-                    root: dir,
-                    gemfile: candidate,
-                });
-            }
-        }
-        dir = if matches!(
-            dir.components().next_back(),
-            Some(std::path::Component::ParentDir)
-        ) {
-            // `Path::parent` is lexical: it strips a trailing `..`, stepping
-            // the walk back DOWN into the directory the `..` just escaped
-            // (parent of `a/b/..` is `a/b`) and probing descendants outside
-            // the real ancestry. Resolve the position against the filesystem —
-            // the same way the kernel resolved this iteration's metadata
-            // probes — and continue from its real parent.
-            fs::canonicalize(&dir).await.ok()?.parent()?.to_path_buf()
-        } else {
-            match dir.parent() {
-                Some(parent) if !parent.as_os_str().is_empty() => parent.to_path_buf(),
-                // A relative `cwd` (e.g. the CLI's default `--cwd .`) exhausts its
-                // lexical components here (`Path::parent` of `.` is `Some("")`,
-                // then `None`) without ever reaching the real parent directories.
-                // Re-root the walk on the process cwd so the true ancestry is
-                // still probed — `bundle` resolves the Gemfile from the invocation
-                // dir's real ancestors, wherever it is run from.
-                _ if dir.is_relative() => std::env::current_dir()
-                    .ok()?
-                    .join(&dir)
-                    .parent()?
-                    .to_path_buf(),
-                _ => return None,
-            }
-        };
-    }
-}
-
-/// Absolute path to the generated plugin directory for a project root.
-pub fn plugin_dir(root: &Path) -> PathBuf {
-    root.join(PLUGIN_DIR)
-}
-
-fn plugins_rb_path(root: &Path) -> PathBuf {
-    plugin_dir(root).join("plugins.rb")
-}
-
-fn gemspec_path(root: &Path) -> PathBuf {
-    plugin_dir(root).join("socket-patch.gemspec")
-}
-
-fn stamp_path(root: &Path) -> PathBuf {
-    root.join(STAMP_REL)
-}
-
-fn stamp_gitignore_path(root: &Path) -> PathBuf {
-    root.join(".socket").join(".gitignore")
-}
-
-/// Whether `.socket/.gitignore` is missing the stamp entry (so `setup` still
-/// has a write to make). Shared by [`add_plugin_files`] and
-/// [`plugin_files_present`] to keep `setup` and `--check` in agreement.
-async fn stamp_ignore_missing(root: &Path) -> bool {
-    match read_regular_to_string(&stamp_gitignore_path(root)).await {
-        Ok(c) => !c.lines().any(|l| l.trim() == STAMP_IGNORE_LINE),
-        Err(_) => true,
-    }
-}
-
-/// Append the stamp entry to `.socket/.gitignore`, preserving any existing
-/// (user or other-tool) lines. Creates the file when absent.
-async fn add_stamp_gitignore(root: &Path) -> Result<(), String> {
-    let path = stamp_gitignore_path(root);
-    let existing = match read_regular_to_string(&path).await {
-        Ok(c) => c,
-        Err(e) if e.kind() == std::io::ErrorKind::NotFound => String::new(),
-        // An existing-but-unreadable file (non-UTF-8 bytes — gitignore
-        // entries are byte strings — a FIFO, EACCES) must fail the setup:
-        // treating it as empty and rewriting would destroy every user line.
-        Err(e) => return Err(format!("read {}: {e}", path.display())),
-    };
-    let mut body = existing;
-    if !body.is_empty() && !body.ends_with('\n') {
-        body.push('\n');
-    }
-    body.push_str(STAMP_IGNORE_LINE);
-    body.push('\n');
-    write_file(&path, &body).await
-}
-
-/// Best-effort cleanup of the stamp artifacts on `--remove`: delete the stamp
-/// itself and strip our line from `.socket/.gitignore` (deleting the file when
-/// nothing else is left, sparing any other lines). Best-effort by design — a
-/// leftover stamp is inert machine-local state, not worth failing an
-/// otherwise-successful unwire over.
-async fn remove_stamp_artifacts(root: &Path) {
-    let _ = fs::remove_file(stamp_path(root)).await;
-    let path = stamp_gitignore_path(root);
-    let Ok(content) = read_regular_to_string(&path).await else {
-        return;
-    };
-    let kept: Vec<&str> = content
-        .lines()
-        .filter(|l| l.trim() != STAMP_IGNORE_LINE)
-        .collect();
-    if kept.len() == content.lines().count() {
-        return;
-    }
-    if kept.iter().all(|l| l.trim().is_empty()) {
-        let _ = fs::remove_file(&path).await;
-    } else {
-        let _ = fs::write(&path, format!("{}\n", kept.join("\n"))).await;
-    }
-}
-
-// ─────────────────────────────────────────────────────────────────────────
-// Bundler's machine-local plugin registration (`.bundle/plugin/index`)
-// ─────────────────────────────────────────────────────────────────────────
-
-/// The plugin name our Gemfile directive registers — the key/value bundler
-/// records in its machine-local plugin index at first install.
-const PLUGIN_NAME: &str = "socket-patch";
-
-/// Outcome of clearing bundler's machine-local plugin registration on
-/// `setup --remove`.
-#[derive(Debug)]
-pub enum GemRegistrationCleanup {
-    /// socket-patch entries were found and removed (or would be, on dry-run).
-    Cleaned {
-        /// The registration index that held (or holds, on dry-run) them.
-        index: PathBuf,
-    },
-    /// No socket-patch registration exists — nothing to clean.
-    NotRegistered,
-    /// A socket-patch registration is (probably) present but could not be
-    /// cleared safely; the human remedy must be surfaced.
-    Residue {
-        /// The registration index carrying the leftover entries.
-        index: PathBuf,
-        /// Why the surgical cleanup refused/failed.
-        reason: String,
-    },
-}
-
-/// Bundler's app-config dir for `root`, following `Bundler.app_config_path`
-/// exactly: `$BUNDLE_APP_CONFIG` when set (a relative value resolves against
-/// the project root, NOT the process cwd), else `<root>/.bundle`. The
-/// machine-local plugin registration lives at `<app config>/plugin/index`, so
-/// getting this resolution wrong means `--remove` cleans (or misses) the
-/// wrong directory — e.g. under the official ruby Docker images, which export
-/// `BUNDLE_APP_CONFIG=/usr/local/bundle`.
-///
-/// `pub(crate)`: the ruby crawler resolves the same dir to honor the app
-/// config's `BUNDLE_PATH:` entry when discovering bundler install roots.
-pub(crate) fn bundler_app_config_dir(root: &Path, env_value: Option<&std::ffi::OsStr>) -> PathBuf {
-    match env_value {
-        Some(v) if !v.is_empty() => {
-            let p = PathBuf::from(v);
-            if p.is_absolute() {
-                p
-            } else {
-                root.join(p)
-            }
-        }
-        _ => root.join(".bundle"),
-    }
-}
-
-/// One `key:` entry of a section in bundler's plugin index, carrying the raw
-/// lines it spans so kept entries are rebuilt byte-verbatim.
-struct IndexEntry {
-    /// The entry key (unquoted): a plugin name, or a hook event name.
-    key: String,
-    key_line: String,
-    /// Inline scalar value (`plugin_paths`-style `key: "value"`), unquoted.
-    value: Option<String>,
-    /// `- "item"` lines under the key, with their unquoted values.
-    items: Vec<(String, String)>,
-}
-
-/// One top-level section (`commands` / `hooks` / `load_paths` /
-/// `plugin_paths` / `sources`) of the index.
-struct IndexSection {
-    name: String,
-    header_line: String,
-    entries: Vec<IndexEntry>,
-}
-
-/// Strip a matching pair of quotes, mirroring bundler's `YAMLSerializer`
-/// loader (its regexes accept an optional `'`/`"` wrapper around values).
-fn unquote(s: &str) -> &str {
-    let s = s.trim();
-    let b = s.as_bytes();
-    if s.len() >= 2
-        && ((b[0] == b'"' && b[s.len() - 1] == b'"') || (b[0] == b'\'' && b[s.len() - 1] == b'\''))
-    {
-        &s[1..s.len() - 1]
-    } else {
-        s
-    }
-}
-
-/// Parse bundler's plugin index into sections/entries, refusing anything
-/// outside the exact dialect bundler's `YAMLSerializer` writes (`---`, then
-/// two-level `key:` maps with 2-space indents and `- "item"` array lines).
-/// The refusal matters more than the acceptance: a hand-edited or
-/// future-format index must fall through to the "residue remains" remedy
-/// path, never be rewritten on a guess and corrupted.
-fn parse_plugin_index(content: &str) -> Result<Vec<IndexSection>, String> {
-    let mut sections: Vec<IndexSection> = Vec::new();
-    for (n, line) in content.lines().enumerate() {
-        let lineno = n + 1;
-        if n == 0 && line.trim_end() == "---" {
-            continue;
-        }
-        if let Some(body) = line.strip_prefix("  ") {
-            // Second level: an array item or an entry key.
-            if body.starts_with(' ') || body.starts_with('\t') {
-                return Err(format!("line {lineno}: unexpected indentation"));
-            }
-            let section = sections
-                .last_mut()
-                .ok_or_else(|| format!("line {lineno}: entry before any section"))?;
-            if let Some(item) = body.strip_prefix("- ") {
-                let entry = section
-                    .entries
-                    .last_mut()
-                    .ok_or_else(|| format!("line {lineno}: array item before any key"))?;
-                entry
-                    .items
-                    .push((line.to_string(), unquote(item).to_string()));
-            } else if let Some((key, value)) = body.split_once(": ") {
-                section.entries.push(IndexEntry {
-                    key: unquote(key).to_string(),
-                    key_line: line.to_string(),
-                    value: Some(unquote(value).to_string()),
-                    items: Vec::new(),
-                });
-            } else if let Some(key) = body.strip_suffix(':') {
-                section.entries.push(IndexEntry {
-                    key: unquote(key).to_string(),
-                    key_line: line.to_string(),
-                    value: None,
-                    items: Vec::new(),
-                });
-            } else {
-                return Err(format!("line {lineno}: unrecognized entry line"));
-            }
-        } else if let Some(name) = line.strip_suffix(':') {
-            if name.is_empty() || name.contains(' ') || line.starts_with(' ') {
-                return Err(format!("line {lineno}: unrecognized section line"));
-            }
-            sections.push(IndexSection {
-                name: name.to_string(),
-                header_line: line.to_string(),
-                entries: Vec::new(),
-            });
-        } else {
-            return Err(format!("line {lineno}: unrecognized line"));
-        }
-    }
-    Ok(sections)
-}
-
-/// The result of surgically removing socket-patch from a parsed index.
-struct StrippedIndex {
-    /// The index content with every socket-patch entry removed; kept lines
-    /// are byte-verbatim.
-    content: String,
-    /// Whether any OTHER plugin's registration remains (the index must then
-    /// survive; an all-empty index is deleted instead).
-    plugins_remain: bool,
-    /// The dir bundler recorded as the plugin's install location
-    /// (`plugin_paths`), if present.
-    installed_dir: Option<PathBuf>,
-}
-
-/// Pure transform: drop every socket-patch entry from the index — its
-/// `plugin_paths`/`load_paths` keys, its `hooks` subscriptions (removing an
-/// event key left with no subscribers), and any `commands`/`sources` mapping
-/// to it — while preserving every other plugin's lines byte-verbatim.
-/// `Ok(None)` when nothing of ours is registered; `Err` when the file is not
-/// in bundler's dialect (the caller must warn, never write).
-fn strip_plugin_registration(content: &str) -> Result<Option<StrippedIndex>, String> {
-    let mut sections = parse_plugin_index(content)?;
-    let mut changed = false;
-    let mut installed_dir = None;
-    for section in &mut sections {
-        match section.name.as_str() {
-            "plugin_paths" | "load_paths" => {
-                let is_plugin_paths = section.name == "plugin_paths";
-                section.entries.retain(|e| {
-                    if e.key != PLUGIN_NAME {
-                        return true;
-                    }
-                    if is_plugin_paths {
-                        if let Some(v) = &e.value {
-                            installed_dir = Some(PathBuf::from(v));
-                        }
-                    }
-                    changed = true;
-                    false
-                });
-            }
-            "hooks" => {
-                section.entries.retain_mut(|e| {
-                    let before = e.items.len();
-                    e.items.retain(|(_, v)| v != PLUGIN_NAME);
-                    let lost = e.items.len() != before;
-                    changed |= lost;
-                    // Drop an event key we just emptied — bundler never
-                    // writes a subscriber-less event, so leaving one behind
-                    // is not round-trippable. Entries empty on arrival are
-                    // not ours to judge and stay.
-                    !(lost && e.items.is_empty() && e.value.is_none())
-                });
-            }
-            "commands" | "sources" => {
-                section.entries.retain(|e| {
-                    if e.value.as_deref() == Some(PLUGIN_NAME) {
-                        changed = true;
-                        false
-                    } else {
-                        true
-                    }
-                });
-            }
-            // Unknown section (a future bundler's addition): keep verbatim.
-            _ => {}
-        }
-    }
-    if !changed {
-        return Ok(None);
-    }
-    let plugins_remain = sections.iter().any(|s| !s.entries.is_empty());
-    let mut out = String::from("---\n");
-    for section in &sections {
-        out.push_str(&section.header_line);
-        out.push('\n');
-        for entry in &section.entries {
-            out.push_str(&entry.key_line);
-            out.push('\n');
-            for (line, _) in &entry.items {
-                out.push_str(line);
-                out.push('\n');
-            }
-        }
-    }
-    Ok(Some(StrippedIndex {
-        content: out,
-        plugins_remain,
-        installed_dir,
-    }))
-}
-
-/// Clear bundler's machine-local plugin registration for socket-patch on
-/// `setup --remove` — the `.bundle/plugin/index` entries (hook subscriptions
-/// and plugin/load paths) bundler wrote when the wired plugin first installed.
-/// `remove_plugin_files` deletes the plugin *source*; without this step the
-/// registration dangles and every later `bundle install` prints bundler's
-/// "The following plugin paths don't exist ... Continuing without installing
-/// plugin socket-patch" block (with a misleading reinstall suggestion)
-/// forever. Surgical: only socket-patch entries leave the index; another
-/// plugin's registration survives byte-verbatim, and an index in an
-/// unexpected format is never rewritten on a guess — that reports
-/// [`GemRegistrationCleanup::Residue`] so the caller surfaces the
-/// `bundler plugin uninstall socket-patch` remedy instead.
-pub async fn remove_plugin_registration(root: &Path, dry_run: bool) -> GemRegistrationCleanup {
-    let env = std::env::var_os("BUNDLE_APP_CONFIG");
-    remove_plugin_registration_at(root, env.as_deref(), dry_run).await
-}
-
-/// [`remove_plugin_registration`] with the `BUNDLE_APP_CONFIG` resolution
-/// input made explicit (tests inject it; the public entry reads the process
-/// env, exactly like bundler itself).
-async fn remove_plugin_registration_at(
-    root: &Path,
-    app_config_env: Option<&std::ffi::OsStr>,
-    dry_run: bool,
-) -> GemRegistrationCleanup {
-    let plugin_root = bundler_app_config_dir(root, app_config_env).join("plugin");
-    let index = plugin_root.join("index");
-    let content = match read_regular_to_string(&index).await {
-        Ok(c) => c,
-        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
-            return GemRegistrationCleanup::NotRegistered;
-        }
-        Err(e) => {
-            return GemRegistrationCleanup::Residue {
-                index,
-                reason: format!("could not read it: {e}"),
-            };
-        }
-    };
-    if !content.contains(PLUGIN_NAME) {
-        return GemRegistrationCleanup::NotRegistered;
-    }
-    let stripped = match strip_plugin_registration(&content) {
-        Ok(Some(s)) => s,
-        // Mentioned only incidentally (e.g. inside another plugin's path):
-        // nothing registered under our name.
-        Ok(None) => return GemRegistrationCleanup::NotRegistered,
-        Err(reason) => {
-            return GemRegistrationCleanup::Residue {
-                index,
-                reason: format!("unexpected index format ({reason})"),
-            };
-        }
-    };
-    if dry_run {
-        return GemRegistrationCleanup::Cleaned { index };
-    }
-    // The dir bundler recorded as the plugin's install location. For our
-    // `path:`-sourced wiring that is the project's `.socket/bundler-plugin`
-    // (already deleted by `remove_plugin_files`); a `bundler plugin install`ed
-    // copy lives under the plugin root itself. Delete it only inside that
-    // root — never a recorded path elsewhere on the machine. The recorded
-    // path is attacker-authored input (the index can be committed), and
-    // `starts_with` compares components lexically, so a `..` traversal like
-    // `<plugin_root>/../../victim` would pass the prefix check while pointing
-    // anywhere on the machine: reject any `..` component outright (bundler
-    // never records traversal paths, so nothing legitimate is lost).
-    if let Some(dir) = &stripped.installed_dir {
-        let traversal_free = dir
-            .components()
-            .all(|c| !matches!(c, std::path::Component::ParentDir));
-        if traversal_free && dir.starts_with(&plugin_root) && dir != &plugin_root {
-            let _ = fs::remove_dir_all(dir).await;
-        }
-    }
-    let write_result = if stripped.plugins_remain {
-        // Another plugin is still registered: rewrite the index without our
-        // entries (staged + renamed — a torn index would break EVERY plugin).
-        crate::utils::fs::atomic_write_bytes_preserving_mode(&index, stripped.content.as_bytes())
-            .await
-            .map_err(|e| format!("could not rewrite it: {e}"))
-    } else {
-        // Nothing registered anymore: delete the index outright (bundler
-        // treats a missing index as empty and regenerates it on demand).
-        match fs::remove_file(&index).await {
-            Ok(()) => Ok(()),
-            Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(()),
-            Err(e) => Err(format!("could not delete it: {e}")),
-        }
-    };
-    if let Err(reason) = write_result {
-        return GemRegistrationCleanup::Residue { index, reason };
-    }
-    if !stripped.plugins_remain {
-        // Prune the now-empty machine-local plugin dir (and an app-config dir
-        // that held nothing else). `remove_dir` refuses non-empty dirs, so a
-        // `.bundle/config` or another plugin's `gems/` cache keeps its parent.
-        let _ = fs::remove_dir(&plugin_root).await;
-        if let Some(parent) = plugin_root.parent() {
-            let _ = fs::remove_dir(parent).await;
-        }
-    }
-    GemRegistrationCleanup::Cleaned { index }
-}
-
-/// Whether the generated plugin files are present *and* match the templates the
-/// current CLI generates (the `setup --check` "configured" signal, paired with
-/// the Gemfile directive check).
-///
-/// Mere presence is not enough. A plugin dir generated by an older CLI is on
-/// disk but stale, and stale content is not cosmetic: a gemspec predating
-/// `s.require_paths = ["."]` makes Bundler refuse to load the plugin ("The
-/// following plugin paths don't exist: .../lib ... Continuing without installing
-/// plugin"), so `bundle install` silently reverts the gem patches while
-/// `--check` reported "configured" and the CI gate went green. Keying on the
-/// same [`needs_write`] predicate [`add_plugin_files`] uses keeps the two in
-/// agreement: whenever `setup` would rewrite a file, `--check` says
-/// needs-configuration.
-pub async fn plugin_files_present(root: &Path) -> bool {
-    !needs_write(&plugins_rb_path(root), PLUGINS_RB).await
-        && !needs_write(&gemspec_path(root), GEMSPEC).await
-        && !stamp_ignore_missing(root).await
-}
-
-/// True if the file is absent or its content differs from `desired`.
-async fn needs_write(path: &Path, desired: &str) -> bool {
-    match read_regular_to_string(path).await {
-        Ok(c) => c != desired,
-        Err(_) => true,
-    }
-}
-
-async fn write_file(path: &Path, body: &str) -> Result<(), String> {
-    if let Some(p) = path.parent() {
-        fs::create_dir_all(p)
-            .await
-            .map_err(|e| format!("create {}: {e}", p.display()))?;
-    }
-    // Stage + rename (mode-preserving): never opens the destination, so a
-    // FIFO squatting on a generated path is replaced, not opened (a plain
-    // `fs::write` would block in `open(2)` waiting for a FIFO reader that
-    // never comes), and a crash mid-write cannot leave a torn half-template
-    // in the committed `.socket/` dir.
-    crate::utils::fs::atomic_write_bytes_preserving_mode(path, body.as_bytes())
-        .await
-        .map_err(|e| format!("write {}: {e}", path.display()))
-}
-
-/// Generate `.socket/bundler-plugin/{plugins.rb, socket-patch.gemspec}` and
-/// make sure `.socket/.gitignore` keeps the plugin's digest stamp untracked.
-/// Idempotent: `AlreadyConfigured` when everything already matches. `kind =
-/// "gem_plugin"`.
-async fn add_plugin_files(root: &Path, dry_run: bool) -> GemEditResult {
-    let dir = plugin_dir(root);
-    let result = async {
-        let rb_changed = needs_write(&plugins_rb_path(root), PLUGINS_RB).await;
-        let spec_changed = needs_write(&gemspec_path(root), GEMSPEC).await;
-        let ignore_missing = stamp_ignore_missing(root).await;
-        if !rb_changed && !spec_changed && !ignore_missing {
-            return Ok(false);
-        }
-        if !dry_run {
-            if rb_changed {
-                write_file(&plugins_rb_path(root), PLUGINS_RB).await?;
-            }
-            if spec_changed {
-                write_file(&gemspec_path(root), GEMSPEC).await?;
-            }
-            if ignore_missing {
-                add_stamp_gitignore(root).await?;
-            }
-        }
-        Ok(true)
-    }
-    .await;
-    GemEditResult::from_result("gem_plugin", dir.display().to_string(), result)
-}
-
-/// Whether the file at `path` carries our [`GENERATED_MARKER`] as its first
-/// line — the per-file ownership test for removal.
-async fn is_generated(path: &Path) -> bool {
-    match read_regular_to_string(path).await {
-        Ok(content) => content.starts_with(GENERATED_MARKER),
-        Err(_) => false,
-    }
-}
-
-/// Delete a generated file, tolerating it already being gone but surfacing
-/// any other failure (a swallowed error here would report a false "removed").
-async fn remove_generated(path: &Path) -> Result<(), String> {
-    match fs::remove_file(path).await {
-        Ok(()) => Ok(()),
-        Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(()),
-        Err(e) => Err(format!("remove {}: {e}", path.display())),
-    }
-}
-
-/// Remove the generated plugin files — each only when it carries our
-/// [`GENERATED_MARKER`], so a user-authored file at either path is never
-/// deleted (and an orphaned generated file is still cleaned up) — plus the
-/// plugin's digest stamp and its `.socket/.gitignore` entry (the plugin that
-/// maintained them is being unwired; leaving the stamp behind would orphan it
-/// in the otherwise-committed `.socket/`). Idempotent: `AlreadyConfigured`
-/// when nothing of ours is there.
-async fn remove_plugin_files(root: &Path, dry_run: bool) -> GemEditResult {
-    let dir = plugin_dir(root);
-    let result = async {
-        let rb_ours = is_generated(&plugins_rb_path(root)).await;
-        let spec_ours = is_generated(&gemspec_path(root)).await;
-        if !rb_ours && !spec_ours {
-            return Ok(false);
-        }
-        if !dry_run {
-            if rb_ours {
-                remove_generated(&plugins_rb_path(root)).await?;
-            }
-            if spec_ours {
-                remove_generated(&gemspec_path(root)).await?;
-            }
-            remove_stamp_artifacts(root).await;
-            // Prune the now-empty plugin dir, then `.socket/` itself when
-            // nothing else — manifest, blobs, vendor tree, a user
-            // `.gitignore` — is left in it: `remove_dir` refuses a non-empty
-            // dir, and every writer recreates `.socket/` on demand. Never
-            // `remove_dir_all`.
-            let _ = fs::remove_dir(&dir).await;
-            let _ = fs::remove_dir(root.join(".socket")).await;
-        }
-        Ok(true)
-    }
-    .await;
-    GemEditResult::from_result("gem_plugin", dir.display().to_string(), result)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    async fn write(path: &Path, body: &str) {
-        if let Some(p) = path.parent() {
-            fs::create_dir_all(p).await.unwrap();
-        }
-        fs::write(path, body).await.unwrap();
-    }
-
-    #[tokio::test]
-    async fn test_discover_finds_gemfile() {
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        write(&root.join("Gemfile"), "source 'https://rubygems.org'\n").await;
-        let proj = discover_bundler_project(root).await.unwrap();
-        assert_eq!(proj.root, root);
-        assert_eq!(proj.gemfile, root.join("Gemfile"));
-    }
-
-    #[tokio::test]
-    async fn test_discover_finds_gems_rb() {
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        write(&root.join("gems.rb"), "source 'https://rubygems.org'\n").await;
-        let proj = discover_bundler_project(root).await.unwrap();
-        assert_eq!(proj.gemfile, root.join("gems.rb"));
-    }
-
-    #[tokio::test]
-    async fn test_discover_none_for_lock_only() {
-        let dir = tempfile::tempdir().unwrap();
-        write(&dir.path().join("Gemfile.lock"), "GEM\n").await;
-        assert!(discover_bundler_project(dir.path()).await.is_none());
-    }
-
-    #[tokio::test]
-    async fn test_discover_none_without_gemfile() {
-        let dir = tempfile::tempdir().unwrap();
-        assert!(discover_bundler_project(dir.path()).await.is_none());
-    }
-
-    #[tokio::test]
-    async fn test_discover_walks_up_from_subdirectory() {
-        // A Gemfile at the project root, `setup` invoked from a nested subdir —
-        // `bundle` resolves the Gemfile by walking up, so discovery must too,
-        // and the project root must be the Gemfile's dir (where `.socket/` and
-        // the plugin dir live), NOT the invocation cwd.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        write(&root.join("Gemfile"), "source 'https://rubygems.org'\n").await;
-        let nested = root.join("lib").join("widgets");
-        fs::create_dir_all(&nested).await.unwrap();
-
-        let proj = discover_bundler_project(&nested)
-            .await
-            .expect("Bundler project must be found from a subdirectory");
-        assert_eq!(proj.root, root, "root is the Gemfile's dir, not the cwd");
-        assert_eq!(proj.gemfile, root.join("Gemfile"));
-        // The plugin dir resolves under the real root, not the subdir.
-        assert_eq!(plugin_dir(&proj.root), root.join(PLUGIN_DIR));
-    }
-
-    #[tokio::test]
-    async fn test_discover_walks_up_finds_gems_rb() {
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        write(&root.join("gems.rb"), "source 'https://rubygems.org'\n").await;
-        let nested = root.join("app");
-        fs::create_dir_all(&nested).await.unwrap();
-        let proj = discover_bundler_project(&nested).await.unwrap();
-        assert_eq!(proj.root, root);
-        assert_eq!(proj.gemfile, root.join("gems.rb"));
-    }
-
-    #[tokio::test]
-    async fn test_discover_prefers_gems_rb_over_gemfile_in_same_dir() {
-        // When both names sit in one directory, `gems.rb` wins — that is
-        // Bundler's own precedence (`Bundler::SharedHelpers.gemfile_names ==
-        // ["gems.rb", "Gemfile"]`, verified on bundler 4.0.15, which also warns
-        // "Multiple gemfiles (gems.rb and Gemfile) detected ... bundler is
-        // ignoring them in favor of gems.rb and gems.locked").
-        //
-        // Wiring the `plugin` directive into the file bundler ignores means the
-        // plugin never loads: every `bundle install` silently reverts the gem
-        // patches while `setup` and `setup --check` both report success.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        write(&root.join("Gemfile"), "gemfile\n").await;
-        write(&root.join("gems.rb"), "gemsrb\n").await;
-        let proj = discover_bundler_project(root).await.unwrap();
-        assert_eq!(
-            proj.gemfile,
-            root.join("gems.rb"),
-            "the wired manifest must be the one `bundle` actually loads"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_discover_nearest_dir_gemfile_beats_ancestor_gems_rb() {
-        // Bundler's `search_up` tries BOTH names in each directory before
-        // ascending, so the name precedence is per-directory only: a child's
-        // `Gemfile` beats an ancestor's `gems.rb` (verified with
-        // `Bundler.default_gemfile` on bundler 4.0.15). Guards the gems.rb-first
-        // ordering against degrading into "gems.rb anywhere in the ancestry
-        // wins".
-        let dir = tempfile::tempdir().unwrap();
-        let outer = dir.path();
-        write(&outer.join("gems.rb"), "outer gems.rb\n").await;
-        let inner = outer.join("child");
-        fs::create_dir_all(&inner).await.unwrap();
-        write(&inner.join("Gemfile"), "inner Gemfile\n").await;
-
-        let proj = discover_bundler_project(&inner).await.unwrap();
-        assert_eq!(proj.root, inner, "nearest directory still wins");
-        assert_eq!(proj.gemfile, inner.join("Gemfile"));
-    }
-
-    #[tokio::test]
-    async fn test_discover_returns_nearest_ancestor_gemfile() {
-        // Two Gemfiles in the ancestry: the NEAREST one (the inner project)
-        // must win, never a far-up parent.
-        let dir = tempfile::tempdir().unwrap();
-        let outer = dir.path();
-        write(&outer.join("Gemfile"), "outer\n").await;
-        let inner = outer.join("subproject");
-        fs::create_dir_all(&inner).await.unwrap();
-        write(&inner.join("Gemfile"), "inner\n").await;
-        let nested = inner.join("lib");
-        fs::create_dir_all(&nested).await.unwrap();
-
-        let proj = discover_bundler_project(&nested).await.unwrap();
-        assert_eq!(proj.root, inner, "nearest ancestor Gemfile wins");
-        assert_eq!(fs::read_to_string(&proj.gemfile).await.unwrap(), "inner\n");
-    }
-
-    #[tokio::test]
-    async fn test_discover_dot_dot_cwd_walks_real_ancestry_not_back_down() {
-        // `--cwd`/SOCKET_CWD may carry `..` components (`--cwd ..`, `$PWD/..`).
-        // The metadata probes resolve them against the real filesystem, but
-        // `Path::parent` strips components lexically — the parent of
-        // `up/mid/b/..` is `up/mid/b`, the very directory the `..` just
-        // escaped. The walk must continue UP the real ancestry
-        // (`up/mid` → `up`), never back down into a descendant that `bundle`
-        // itself would not consult.
-        let dir = tempfile::tempdir().unwrap();
-        // Canonicalize so the expected root compares path-exactly (macOS
-        // tempdirs live behind the /var → /private/var symlink).
-        let base = std::fs::canonicalize(dir.path()).unwrap();
-        let up = base.join("up");
-        let b = up.join("mid").join("b");
-        fs::create_dir_all(&b).await.unwrap();
-        write(&up.join("Gemfile"), "real ancestor\n").await;
-        write(&b.join("Gemfile"), "descendant, not in the ancestry\n").await;
-
-        let proj = discover_bundler_project(&b.join("..")).await.unwrap();
-        assert_eq!(
-            proj.root, up,
-            "walk from up/mid (= up/mid/b/..) must reach the ancestor `up`, \
-             not fall back down into up/mid/b"
-        );
-        assert_eq!(
-            fs::read_to_string(&proj.gemfile).await.unwrap(),
-            "real ancestor\n"
-        );
-    }
-
-    #[test]
-    fn test_templates_are_well_formed() {
-        // The plugin must carry the ownership marker and all three triggers.
-        assert!(PLUGINS_RB.starts_with(GENERATED_MARKER));
-        assert!(PLUGINS_RB.contains("def apply!"));
-        // Load-time trigger + the per-gem after-install hook (the only event
-        // bundler fires during `bundle pristine`) + after-install-all hook.
-        assert!(PLUGINS_RB.contains("SocketPatch.apply!"));
-        assert!(PLUGINS_RB.contains("Bundler::Plugin.add_hook(\"after-install\")"));
-        assert!(PLUGINS_RB.contains("Bundler::Plugin.add_hook(\"after-install-all\")"));
-        // The applier shells the gem-scoped offline apply.
-        assert!(PLUGINS_RB.contains("\"apply\""));
-        assert!(PLUGINS_RB.contains("\"--ecosystems\", \"gem\", \"--offline\""));
-        // Digest folds in Gemfile.lock + the manifest + the on-disk state of
-        // the patch target files (so an out-of-band reversion is detected).
-        assert!(PLUGINS_RB.contains("Gemfile.lock"));
-        assert!(PLUGINS_RB.contains("manifest.json"));
-        assert!(PLUGINS_RB.contains("def patch_target_files"));
-        // The platform-gem wildcard must glob a forward-slash base: Dir.glob
-        // treats `\` as an escape on every platform, so a Windows bundle path
-        // (backslash separators) would otherwise never match platform installs
-        // and they would silently drop out of the digest.
-        assert!(PLUGINS_RB.contains(r#"glob_gems_dir = gems_dir.tr("\\", "/")"#));
-        // The gemspec names the plugin the Gemfile directive references.
-        assert!(GEMSPEC.starts_with(GENERATED_MARKER));
-        assert!(GEMSPEC.contains("\"socket-patch\""));
-        assert!(GEMSPEC.contains("plugins.rb"));
-        // The flat plugin dir has no lib/; without this override Bundler
-        // refuses to load the plugin ("plugin paths don't exist: .../lib")
-        // and silently continues without it.
-        assert!(GEMSPEC.contains("s.require_paths = [\".\"]"));
-    }
-
-    #[test]
-    fn test_plugin_template_failure_policy_and_stamp_location() {
-        // Failure policy: tolerant by default — a patch failure WARNS (with
-        // the manual-apply remediation) and lets `bundle install` continue.
-        // Bundler evaluates plugins.rb at plugin REGISTRATION, before any
-        // project gem is installed; a raise there deadlocks a fresh clone on
-        // its own first `bundle install` (plugin registration fails, every
-        // retry fails identically — reproduced against bundler 2.7 and 4.0).
-        assert!(
-            PLUGINS_RB.contains("def report_failure"),
-            "the applier must route failures through the tolerant reporter"
-        );
-        assert!(
-            !PLUGINS_RB.contains("def fail!"),
-            "the unconditional raise helper must be gone — it is what \
-             deadlocked bootstrap installs"
-        );
-        assert!(
-            PLUGINS_RB.contains("warn(message)"),
-            "tolerant mode must surface the failure as a stderr warning"
-        );
-        assert!(
-            PLUGINS_RB.contains("socket-patch apply --ecosystems gem"),
-            "the warning must name the manual remediation command"
-        );
-        // Strict escape hatch: SOCKET_PATCH_STRICT=1 restores raise-on-failure.
-        assert!(PLUGINS_RB.contains("SOCKET_PATCH_STRICT"));
-        assert!(
-            PLUGINS_RB.contains("BundlerError"),
-            "strict mode must still raise Bundler::BundlerError"
-        );
-        // The strict raise must carry a strict trailer, not the tolerant
-        // "`bundle install` continues" text (which is false mid-raise).
-        assert!(PLUGINS_RB.contains("def failure_trailer"));
-        // Stamp location: project-scoped under .socket/, NOT a fixed-name file
-        // in Bundler.bundle_path (machine-global with no bundle path
-        // configured, shared and clobbered across every project on the host).
-        assert!(PLUGINS_RB.contains("STAMP_NAME = \"gem-plugin-stamp\""));
-        assert!(PLUGINS_RB.contains("File.join(socket_dir, STAMP_NAME)"));
-        // The legacy global stamp is cleaned up, never read.
-        assert!(PLUGINS_RB.contains("LEGACY_STAMP_NAME = \".socket-patch-gem-stamp\""));
-        assert!(PLUGINS_RB.contains("def remove_legacy_stamp"));
-        // The stamp must be excluded from its own digest inputs, or every
-        // write would invalidate the digest it records.
-        assert!(PLUGINS_RB.contains("p != stamp_path"));
-        // The bootstrap gate keys on the patch targets existing on disk, NEVER
-        // on the stamp: `.socket/` is a committed directory, so a stale stamp
-        // that reaches version control would otherwise pass the gate at plugin
-        // REGISTRATION on a fresh clone and resurrect the strict-mode
-        // bootstrap deadlock this plugin exists to avoid.
-        assert!(PLUGINS_RB.contains("bootstrap_gate && patch_target_files.none?"));
-        assert!(
-            !PLUGINS_RB.contains("require_stamp"),
-            "the stamp-existence gate must be gone — a committed stamp made it \
-             a remote-controlled registration deadlock"
-        );
-
-        // The published-gem twin must carry the same applier contract.
-        let published = include_str!("../../../../../gem/socket-patch-bundler/plugins.rb");
-        for needle in [
-            "def report_failure",
-            "def failure_trailer",
-            "SOCKET_PATCH_STRICT",
-            "STAMP_NAME = \"gem-plugin-stamp\"",
-            "def remove_legacy_stamp",
-            "def patch_target_files",
-            r#"glob_gems_dir = gems_dir.tr("\\", "/")"#,
-            "bootstrap_gate && patch_target_files.none?",
-            "Bundler::Plugin.add_hook(\"after-install\")",
-            "Bundler::Plugin.add_hook(\"after-install-all\")",
-        ] {
-            assert!(
-                published.contains(needle),
-                "published plugins.rb drifted from the template: missing {needle:?}"
-            );
-        }
-        assert!(!published.contains("def fail!"));
-        assert!(!published.contains("require_stamp"));
-    }
-
-    #[tokio::test]
-    async fn test_add_then_remove_plugin_files_roundtrip() {
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        let r = add_plugin_files(root, false).await;
-        assert_eq!(r.status, GemSetupStatus::Updated);
-        assert!(plugin_files_present(root).await);
-        assert_eq!(
-            fs::read_to_string(plugins_rb_path(root)).await.unwrap(),
-            PLUGINS_RB
-        );
-        // The stamp is gitignored: everything else under .socket/ is committed,
-        // so without this line every install litters `git status` and a blanket
-        // `git add .socket` commits one machine's stamp to every clone.
-        assert_eq!(
-            fs::read_to_string(stamp_gitignore_path(root))
-                .await
-                .unwrap(),
-            "/gem-plugin-stamp\n"
-        );
-        // Idempotent.
-        assert_eq!(
-            add_plugin_files(root, false).await.status,
-            GemSetupStatus::AlreadyConfigured
-        );
-        // Remove — including the stamp a previous apply left behind, which
-        // would otherwise be orphaned in the committed .socket/ dir.
-        fs::write(stamp_path(root), "f".repeat(64)).await.unwrap();
-        let rr = remove_plugin_files(root, false).await;
-        assert_eq!(rr.status, GemSetupStatus::Updated);
-        assert!(!plugin_files_present(root).await);
-        assert!(!plugin_dir(root).exists(), "empty plugin dir pruned");
-        assert!(!stamp_path(root).exists(), "stamp removed with the plugin");
-        assert!(
-            !stamp_gitignore_path(root).exists(),
-            "the .gitignore we created (nothing but our line) is removed too"
-        );
-        assert!(
-            !root.join(".socket").exists(),
-            "an emptied .socket/ is pruned: --remove restores the pre-setup tree"
-        );
-        // Remove again → already gone.
-        assert_eq!(
-            remove_plugin_files(root, false).await.status,
-            GemSetupStatus::AlreadyConfigured
-        );
-    }
-
-    #[tokio::test]
-    async fn test_add_plugin_files_dry_run_writes_nothing() {
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        let r = add_plugin_files(root, true).await;
-        assert_eq!(
-            r.status,
-            GemSetupStatus::Updated,
-            "dry-run reports the change"
-        );
-        assert!(!plugin_files_present(root).await, "dry-run wrote nothing");
-    }
-
-    #[tokio::test]
-    async fn test_remove_spares_user_authored_dir() {
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        // A user file at the generated path WITHOUT our marker.
-        write(&plugins_rb_path(root), "# my own plugin\n").await;
-        let r = remove_plugin_files(root, false).await;
-        assert_eq!(r.status, GemSetupStatus::AlreadyConfigured);
-        assert!(
-            plugins_rb_path(root).exists(),
-            "user file must be left alone"
-        );
-    }
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_remove_surfaces_removal_failure_as_error() {
-        // Deleting a file requires write permission on its directory. With the
-        // plugin dir read-only, the removes fail — that failure must surface as
-        // `Error`, not be swallowed into a false "removed" success while the
-        // files are in fact still there.
-        use std::os::unix::fs::PermissionsExt;
-
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        add_plugin_files(root, false).await;
-        fs::set_permissions(&plugin_dir(root), std::fs::Permissions::from_mode(0o555))
-            .await
-            .unwrap();
-
-        let r = remove_plugin_files(root, false).await;
-
-        // Restore so the tempdir can be cleaned up regardless of the outcome.
-        fs::set_permissions(&plugin_dir(root), std::fs::Permissions::from_mode(0o755))
-            .await
-            .unwrap();
-
-        assert!(
-            plugin_files_present(root).await,
-            "the read-only dir means nothing was actually removed"
-        );
-        assert_eq!(
-            r.status,
-            GemSetupStatus::Error,
-            "a failed removal must report Error, not a false success"
-        );
-        assert!(
-            r.error.is_some(),
-            "the failure carries the io error message"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_remove_cleans_orphaned_gemspec() {
-        // plugins.rb gone (crash between the two removes, or a manual delete)
-        // but our generated gemspec is still there. Remove must clean the
-        // orphan — not report not_configured forever while a generated file
-        // lingers in the repo.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        write(&gemspec_path(root), GEMSPEC).await;
-
-        let r = remove_plugin_files(root, false).await;
-        assert_eq!(
-            r.status,
-            GemSetupStatus::Updated,
-            "an orphaned generated gemspec is ours to remove"
-        );
-        assert!(!gemspec_path(root).exists(), "orphan gemspec removed");
-        assert!(!plugin_dir(root).exists(), "emptied plugin dir pruned");
-    }
-
-    #[tokio::test]
-    async fn test_remove_spares_user_authored_gemspec() {
-        // Ownership is per file: our plugins.rb is removed, but a user-authored
-        // (marker-less) file at the gemspec path must never be deleted on the
-        // strength of plugins.rb's marker alone.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        write(&plugins_rb_path(root), PLUGINS_RB).await;
-        write(&gemspec_path(root), "# my own gemspec\n").await;
-
-        let r = remove_plugin_files(root, false).await;
-        assert_eq!(r.status, GemSetupStatus::Updated);
-        assert!(!plugins_rb_path(root).exists(), "our plugins.rb removed");
-        assert!(
-            gemspec_path(root).exists(),
-            "marker-less user file at the gemspec path must be left alone"
-        );
-        assert_eq!(
-            fs::read_to_string(gemspec_path(root)).await.unwrap(),
-            "# my own gemspec\n"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_add_plugin_files_writes_each_template_to_its_own_path() {
-        // Guards the path↔content mapping: plugins.rb must get PLUGINS_RB and the
-        // gemspec must get GEMSPEC (not swapped). A swap would leave each file
-        // failing its own `starts_with(GENERATED_MARKER)` content expectations.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        add_plugin_files(root, false).await;
-        assert_eq!(
-            fs::read_to_string(plugins_rb_path(root)).await.unwrap(),
-            PLUGINS_RB,
-            "plugins.rb must receive the plugins.rb template"
-        );
-        assert_eq!(
-            fs::read_to_string(gemspec_path(root)).await.unwrap(),
-            GEMSPEC,
-            "gemspec must receive the gemspec template"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_add_plugin_files_rewrites_stale_content() {
-        // A drifted (hand-edited or older-version) plugins.rb must be re-synced to
-        // the current template, and the call must report `Updated` — not silently
-        // accept the stale bytes as already-configured.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        write(
-            &plugins_rb_path(root),
-            "# Code generated by stale\nold body\n",
-        )
-        .await;
-        write(&gemspec_path(root), GEMSPEC).await;
-        let r = add_plugin_files(root, false).await;
-        assert_eq!(
-            r.status,
-            GemSetupStatus::Updated,
-            "stale plugins.rb is re-synced"
-        );
-        assert_eq!(
-            fs::read_to_string(plugins_rb_path(root)).await.unwrap(),
-            PLUGINS_RB
-        );
-    }
-
-    #[tokio::test]
-    async fn test_add_plugin_files_syncs_only_the_drifted_file() {
-        // plugins.rb already matches; only the gemspec drifted. The call rewrites
-        // the gemspec, reports Updated, and leaves the matching plugins.rb intact.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        write(&plugins_rb_path(root), PLUGINS_RB).await;
-        write(&gemspec_path(root), "# drifted gemspec\n").await;
-        let r = add_plugin_files(root, false).await;
-        assert_eq!(r.status, GemSetupStatus::Updated);
-        assert_eq!(
-            fs::read_to_string(gemspec_path(root)).await.unwrap(),
-            GEMSPEC
-        );
-        assert_eq!(
-            fs::read_to_string(plugins_rb_path(root)).await.unwrap(),
-            PLUGINS_RB
-        );
-    }
-
-    #[tokio::test]
-    async fn test_remove_plugin_files_dry_run_keeps_files() {
-        // Dry-run remove reports the change but must not delete anything.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        add_plugin_files(root, false).await;
-        let r = remove_plugin_files(root, true).await;
-        assert_eq!(
-            r.status,
-            GemSetupStatus::Updated,
-            "dry-run reports the removal"
-        );
-        assert!(
-            plugin_files_present(root).await,
-            "dry-run remove must not delete the plugin files"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_stale_plugin_files_are_not_reported_as_configured() {
-        // `setup --check`'s gem_plugin verdict must agree with what `setup`
-        // itself would do. A plugin dir generated by an OLDER CLI is present but
-        // stale, and a stale gemspec is not cosmetic: without the current
-        // template's `s.require_paths = ["."]` Bundler refuses to load the
-        // plugin ("The following plugin paths don't exist: .../lib ...
-        // Continuing without installing plugin") and every `bundle install`
-        // silently reverts the gem patches — while `--check` reported
-        // "configured" and the CI gate went green.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        write(&plugins_rb_path(root), PLUGINS_RB).await;
-        // An older generated gemspec: carries our marker, but predates the
-        // require_paths override.
-        write(
-            &gemspec_path(root),
-            &format!(
-                "{GENERATED_MARKER}\nGem::Specification.new do |s|\n  \
-                 s.name = \"socket-patch\"\nend\n"
-            ),
-        )
-        .await;
-
-        assert!(
-            !plugin_files_present(root).await,
-            "a stale generated gemspec is not 'configured' — Bundler would not \
-             load the plugin"
-        );
-        assert_eq!(
-            add_plugin_files(root, true).await.status,
-            GemSetupStatus::Updated,
-            "check and setup must agree: setup would rewrite the stale file"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_plugin_files_present_requires_all_three() {
-        // The "configured" signal must demand BOTH generated files AND the
-        // stamp's .gitignore entry, not any subset.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        write(&plugins_rb_path(root), PLUGINS_RB).await;
-        assert!(
-            !plugin_files_present(root).await,
-            "plugins.rb alone is not 'configured' — the gemspec is required too"
-        );
-        write(&gemspec_path(root), GEMSPEC).await;
-        assert!(
-            !plugin_files_present(root).await,
-            "check and setup must agree: setup would still write the stamp's \
-             .gitignore entry, so this is not 'configured' yet"
-        );
-        assert_eq!(
-            add_plugin_files(root, true).await.status,
-            GemSetupStatus::Updated,
-            "setup agrees it still has the .gitignore write to make"
-        );
-        write(&stamp_gitignore_path(root), "/gem-plugin-stamp\n").await;
-        assert!(plugin_files_present(root).await);
-    }
-
-    #[tokio::test]
-    async fn test_stamp_gitignore_add_and_remove_spare_user_lines() {
-        // A user's own .socket/.gitignore entries must survive both the add
-        // (line appended, not the file clobbered) and the remove (only our
-        // line stripped, file kept).
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        write(&stamp_gitignore_path(root), "my-scratch-dir/\n").await;
-
-        add_plugin_files(root, false).await;
-        assert_eq!(
-            fs::read_to_string(stamp_gitignore_path(root))
-                .await
-                .unwrap(),
-            "my-scratch-dir/\n/gem-plugin-stamp\n",
-            "our line is appended after the user's"
-        );
-
-        remove_plugin_files(root, false).await;
-        assert_eq!(
-            fs::read_to_string(stamp_gitignore_path(root))
-                .await
-                .unwrap(),
-            "my-scratch-dir/\n",
-            "only our line is stripped; the user's file survives"
-        );
-    }
-
-    // ── bundler machine-local plugin registration cleanup ────────────
-
-    /// The exact index bundler 4.0.18 wrote in the 2026-08 e2e campaign
-    /// repro (agent-b4/eject-setup-remove), path root substituted.
-    fn solo_index(root: &str) -> String {
-        format!(
-            "---\ncommands:\nhooks:\n  after-install:\n  - \"socket-patch\"\n  \
-             after-install-all:\n  - \"socket-patch\"\nload_paths:\n  socket-patch:\n  \
-             - \"{root}/.socket/bundler-plugin/.\"\nplugin_paths:\n  \
-             socket-patch: \"{root}/.socket/bundler-plugin\"\nsources:\n"
-        )
-    }
-
-    #[test]
-    fn test_strip_registration_solo_plugin_empties_index() {
-        let stripped = strip_plugin_registration(&solo_index("/proj"))
-            .expect("bundler's own dump must parse")
-            .expect("socket-patch entries must be found");
-        assert!(
-            !stripped.plugins_remain,
-            "socket-patch was the only plugin — nothing may remain"
-        );
-        assert!(
-            !stripped.content.contains(PLUGIN_NAME),
-            "no socket-patch line may survive:\n{}",
-            stripped.content
-        );
-        assert_eq!(
-            stripped.installed_dir.as_deref(),
-            Some(Path::new("/proj/.socket/bundler-plugin")),
-            "the recorded install dir is surfaced for containment-gated deletion"
-        );
-        // The emptied hook events are dropped with their subscribers.
-        assert!(!stripped.content.contains("after-install"));
-    }
-
-    #[test]
-    fn test_strip_registration_preserves_other_plugins_verbatim() {
-        let index = "---\ncommands:\n  mycmd: \"other-plugin\"\nhooks:\n  after-install:\n  \
-             - \"other-plugin\"\n  - \"socket-patch\"\n  after-install-all:\n  \
-             - \"socket-patch\"\nload_paths:\n  other-plugin:\n  - \"/x/other/.\"\n  \
-             socket-patch:\n  - \"/proj/.socket/bundler-plugin/.\"\nplugin_paths:\n  \
-             other-plugin: \"/x/other\"\n  socket-patch: \"/proj/.socket/bundler-plugin\"\nsources:\n";
-        let stripped = strip_plugin_registration(index)
-            .expect("parses")
-            .expect("has our entries");
-        assert!(stripped.plugins_remain, "other-plugin is still registered");
-        assert_eq!(
-            stripped.content,
-            "---\ncommands:\n  mycmd: \"other-plugin\"\nhooks:\n  after-install:\n  \
-             - \"other-plugin\"\nload_paths:\n  other-plugin:\n  - \"/x/other/.\"\n\
-             plugin_paths:\n  other-plugin: \"/x/other\"\nsources:\n",
-            "only socket-patch lines leave; every kept line is byte-verbatim, \
-             and the after-install-all event we emptied is dropped"
-        );
-    }
-
-    #[test]
-    fn test_strip_registration_none_when_not_ours() {
-        // Another plugin whose PATH merely mentions socket-patch: nothing
-        // registered under our name — nothing to strip, nothing to write.
-        let index = "---\ncommands:\nhooks:\n  after-install:\n  - \"other\"\nload_paths:\n  \
-             other:\n  - \"/mono/socket-patch-fork/other/.\"\nplugin_paths:\n  \
-             other: \"/mono/socket-patch-fork/other\"\nsources:\n";
-        assert!(strip_plugin_registration(index).expect("parses").is_none());
-    }
-
-    #[test]
-    fn test_strip_registration_refuses_unknown_shape() {
-        // Psych-style deeper nesting is NOT bundler's dialect: refuse rather
-        // than rewrite on a guess (the caller warns with the remedy).
-        let psych = "---\nhooks:\n  after-install:\n    - socket-patch\n";
-        assert!(strip_plugin_registration(psych).is_err());
-        let garbage = "socket-patch says hi\n";
-        assert!(strip_plugin_registration(garbage).is_err());
-    }
-
-    #[test]
-    fn test_bundler_app_config_dir_resolution() {
-        use std::ffi::OsStr;
-        let root = Path::new("/proj");
-        // Unset / empty → <root>/.bundle.
-        assert_eq!(
-            bundler_app_config_dir(root, None),
-            Path::new("/proj/.bundle")
-        );
-        assert_eq!(
-            bundler_app_config_dir(root, Some(OsStr::new(""))),
-            Path::new("/proj/.bundle")
-        );
-        // Relative → resolved against the PROJECT ROOT (Bundler.app_config_path).
-        assert_eq!(
-            bundler_app_config_dir(root, Some(OsStr::new("bundle-config"))),
-            Path::new("/proj/bundle-config")
-        );
-        // Absolute → taken as-is (the official ruby images' /usr/local/bundle).
-        assert_eq!(
-            bundler_app_config_dir(root, Some(OsStr::new("/usr/local/bundle"))),
-            Path::new("/usr/local/bundle")
-        );
-    }
-
-    #[tokio::test]
-    async fn test_remove_registration_missing_index_is_not_registered() {
-        let dir = tempfile::tempdir().unwrap();
-        assert!(matches!(
-            remove_plugin_registration_at(dir.path(), None, false).await,
-            GemRegistrationCleanup::NotRegistered
-        ));
-    }
-
-    #[tokio::test]
-    async fn test_remove_registration_solo_deletes_index_and_prunes_dirs() {
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        let index = root.join(".bundle/plugin/index");
-        write(&index, &solo_index(&root.display().to_string())).await;
-
-        let r = remove_plugin_registration_at(root, None, false).await;
-        assert!(matches!(r, GemRegistrationCleanup::Cleaned { .. }), "{r:?}");
-        assert!(!index.exists(), "emptied index deleted");
-        assert!(
-            !root.join(".bundle").exists(),
-            "the plugin dir and an app-config dir holding nothing else are pruned"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_remove_registration_keeps_nonempty_app_config_dir() {
-        // A real project's .bundle/ holds a config file too: the index (and
-        // the emptied plugin dir) go, the user's config survives.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        write(
-            &root.join(".bundle/config"),
-            "---\nBUNDLE_PATH: \"vendor/bundle\"\n",
-        )
-        .await;
-        let index = root.join(".bundle/plugin/index");
-        write(&index, &solo_index(&root.display().to_string())).await;
-
-        let r = remove_plugin_registration_at(root, None, false).await;
-        assert!(matches!(r, GemRegistrationCleanup::Cleaned { .. }), "{r:?}");
-        assert!(!root.join(".bundle/plugin").exists(), "plugin dir pruned");
-        assert!(
-            root.join(".bundle/config").is_file(),
-            "the user's bundler config must survive"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_remove_registration_rewrites_index_when_others_remain() {
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        let index = root.join(".bundle/plugin/index");
-        write(
-            &index,
-            "---\ncommands:\nhooks:\n  after-install:\n  - \"other\"\n  - \"socket-patch\"\n\
-             load_paths:\n  other:\n  - \"/x/other/.\"\n  socket-patch:\n  - \"/proj/p/.\"\n\
-             plugin_paths:\n  other: \"/x/other\"\n  socket-patch: \"/proj/p\"\nsources:\n",
-        )
-        .await;
-
-        let r = remove_plugin_registration_at(root, None, false).await;
-        assert!(matches!(r, GemRegistrationCleanup::Cleaned { .. }), "{r:?}");
-        let body = fs::read_to_string(&index).await.unwrap();
-        assert!(!body.contains("socket-patch"), "ours gone:\n{body}");
-        assert!(body.contains("- \"other\""), "theirs kept:\n{body}");
-    }
-
-    #[tokio::test]
-    async fn test_remove_registration_dry_run_writes_nothing() {
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        let index = root.join(".bundle/plugin/index");
-        let body = solo_index(&root.display().to_string());
-        write(&index, &body).await;
-
-        let r = remove_plugin_registration_at(root, None, true).await;
-        assert!(matches!(r, GemRegistrationCleanup::Cleaned { .. }), "{r:?}");
-        assert_eq!(
-            fs::read_to_string(&index).await.unwrap(),
-            body,
-            "dry-run must not touch the index"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_remove_registration_honors_bundle_app_config() {
-        // Relative BUNDLE_APP_CONFIG resolves against the project root —
-        // the same rule bundler applies (`Bundler.app_config_path`).
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        let index = root.join("bundle-config/plugin/index");
-        write(&index, &solo_index(&root.display().to_string())).await;
-        // A decoy at the default location must NOT be the one cleaned.
-        let decoy = root.join(".bundle/plugin/index");
-        write(&decoy, &solo_index("/elsewhere")).await;
-
-        let r =
-            remove_plugin_registration_at(root, Some(std::ffi::OsStr::new("bundle-config")), false)
-                .await;
-        assert!(matches!(r, GemRegistrationCleanup::Cleaned { .. }), "{r:?}");
-        assert!(!index.exists(), "the app-config index is the one cleared");
-        assert!(
-            decoy.is_file(),
-            "the default-location index is out of scope when BUNDLE_APP_CONFIG points elsewhere"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_remove_registration_unparseable_reports_residue() {
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        let index = root.join(".bundle/plugin/index");
-        // Mentions socket-patch but is not bundler's dialect: never rewrite
-        // on a guess — report residue so the caller surfaces the remedy.
-        let body = "%TAG !u! tag:example\n---\nplugins: [socket-patch]\n";
-        write(&index, body).await;
-
-        let r = remove_plugin_registration_at(root, None, false).await;
-        assert!(matches!(r, GemRegistrationCleanup::Residue { .. }), "{r:?}");
-        assert_eq!(
-            fs::read_to_string(&index).await.unwrap(),
-            body,
-            "an unrecognized index must survive byte-identical"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_remove_registration_deletes_installed_dir_only_inside_plugin_root() {
-        // A `bundler plugin install`ed copy lives under .bundle/plugin — that
-        // dir goes. A recorded path OUTSIDE the plugin root (our path-sourced
-        // project dir, or anything else on the machine) is never touched here.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        let inside = root.join(".bundle/plugin/gems/socket-patch-0.1.0");
-        fs::create_dir_all(&inside).await.unwrap();
-        write(&inside.join("plugins.rb"), "# installed copy\n").await;
-        let index = root.join(".bundle/plugin/index");
-        write(
-            &index,
-            &format!(
-                "---\ncommands:\nhooks:\n  after-install:\n  - \"socket-patch\"\n\
-                 load_paths:\n  socket-patch:\n  - \"{0}/.\"\nplugin_paths:\n  \
-                 socket-patch: \"{0}\"\nsources:\n",
-                inside.display()
-            ),
-        )
-        .await;
-        let r = remove_plugin_registration_at(root, None, false).await;
-        assert!(matches!(r, GemRegistrationCleanup::Cleaned { .. }), "{r:?}");
-        assert!(!inside.exists(), "the in-root installed copy is deleted");
-
-        // Outside the plugin root: left alone.
-        let outside = root.join("elsewhere/socket-patch");
-        fs::create_dir_all(&outside).await.unwrap();
-        let index2 = root.join(".bundle/plugin/index");
-        write(
-            &index2,
-            &format!(
-                "---\ncommands:\nhooks:\nload_paths:\n  socket-patch:\n  - \"{0}/.\"\n\
-                 plugin_paths:\n  socket-patch: \"{0}\"\nsources:\n",
-                outside.display()
-            ),
-        )
-        .await;
-        let r = remove_plugin_registration_at(root, None, false).await;
-        assert!(matches!(r, GemRegistrationCleanup::Cleaned { .. }), "{r:?}");
-        assert!(
-            outside.is_dir(),
-            "a recorded dir outside the plugin root must never be deleted"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_remove_registration_rejects_traversal_in_recorded_dir() {
-        // A committed `.bundle/plugin/index` is attacker-authored input: it
-        // can record ANY path as the plugin's install dir. `..` components
-        // let `<plugin_root>/../../victim` pass a purely lexical
-        // `starts_with(plugin_root)` check while pointing outside the plugin
-        // root — such a dir must never be deleted. Bundler itself never
-        // records traversal paths, so rejecting them loses nothing.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        let victim = root.join("victim");
-        fs::create_dir_all(&victim).await.unwrap();
-        write(&victim.join("precious.txt"), "do not delete\n").await;
-        // Lexically under the plugin root, physically the victim dir.
-        let evil = root.join(".bundle/plugin/../../victim");
-        assert!(
-            evil.starts_with(root.join(".bundle/plugin")),
-            "precondition: the traversal path passes the lexical prefix check"
-        );
-        write(
-            &root.join(".bundle/plugin/index"),
-            &format!(
-                "---\ncommands:\nhooks:\nload_paths:\n  socket-patch:\n  - \"{0}/.\"\n\
-                 plugin_paths:\n  socket-patch: \"{0}\"\nsources:\n",
-                evil.display()
-            ),
-        )
-        .await;
-        let r = remove_plugin_registration_at(root, None, false).await;
-        assert!(matches!(r, GemRegistrationCleanup::Cleaned { .. }), "{r:?}");
-        assert!(
-            victim.join("precious.txt").is_file(),
-            "a recorded dir with `..` traversal must never be deleted"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_discover_skips_directory_named_gemfile() {
-        // Bundler's own resolution (`SharedHelpers.find_file`) gates every
-        // candidate on `File.file?`, so a DIRECTORY named `Gemfile` is
-        // skipped and the walk continues to the real ancestor manifest.
-        // Gating on bare `metadata` (which any directory satisfies) selects
-        // the directory instead: `setup` then hands the Gemfile editor a
-        // directory and errors out, in a project where `bundle install`
-        // works fine off the ancestor.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        write(&root.join("Gemfile"), "real manifest\n").await;
-        let sub = root.join("sub");
-        fs::create_dir_all(sub.join("Gemfile")).await.unwrap();
-
-        let proj = discover_bundler_project(&sub).await.unwrap();
-        assert_eq!(proj.root, root, "a dir named Gemfile is not a manifest");
-        assert_eq!(proj.gemfile, root.join("Gemfile"));
-    }
-
-    /// Plant a FIFO with a direct `mkfifo(2)` syscall — same helper as the
-    /// composer/find.rs/package_json FIFO tests: fork/exec flakes under
-    /// heavy parallel load and the syscall needs no process at all.
-    #[cfg(unix)]
-    fn mkfifo(path: &Path) {
-        use std::os::unix::ffi::OsStrExt;
-        let c_path =
-            std::ffi::CString::new(path.as_os_str().as_bytes()).expect("fifo path has no NUL");
-        let rc = unsafe { libc::mkfifo(c_path.as_ptr(), 0o644) };
-        assert_eq!(
-            rc,
-            0,
-            "mkfifo(2) failed: {}",
-            std::io::Error::last_os_error()
-        );
-    }
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_discover_skips_fifo_named_gemfile() {
-        // A FIFO named Gemfile stats fine but `bundle` ignores it
-        // (`File.file?` is false); selecting it hands the Gemfile editor a
-        // path whose plain `open(2)` blocks forever waiting for a writer.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        write(&root.join("Gemfile"), "real manifest\n").await;
-        let sub = root.join("sub");
-        fs::create_dir_all(&sub).await.unwrap();
-        mkfifo(&sub.join("Gemfile"));
-
-        let proj = discover_bundler_project(&sub).await.unwrap();
-        assert_eq!(proj.gemfile, root.join("Gemfile"));
-    }
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_check_fifo_plugins_rb_does_not_wedge() {
-        // A FIFO squatting on the generated plugins.rb path: a plain
-        // `read_to_string` open(2) waits for a writer that never comes,
-        // wedging `setup --check` indefinitely with no error and no timeout.
-        // Same class as the composer/find.rs `open_regular_file` guards.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        fs::create_dir_all(plugin_dir(root)).await.unwrap();
-        mkfifo(&plugins_rb_path(root));
-
-        // On timeout the open is wedged in a `spawn_blocking` thread that
-        // the runtime waits for on shutdown; connect a writer to release
-        // it so the test can FAIL instead of hanging the whole suite.
-        let deadline = std::time::Duration::from_secs(5);
-        let Ok(present) = tokio::time::timeout(deadline, plugin_files_present(root)).await else {
-            let _ = std::fs::OpenOptions::new()
-                .write(true)
-                .open(plugins_rb_path(root));
-            panic!("plugin_files_present must complete promptly with a FIFO plugins.rb");
-        };
-        assert!(!present, "a FIFO is not the generated plugin");
-    }
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_add_fifo_plugins_rb_does_not_wedge_and_replaces_it() {
-        // `setup` on the same layout: the read must not wedge, and the write
-        // must replace the FIFO via rename (a plain `fs::write` would block
-        // in open(2) waiting for a FIFO reader) — the path is generated
-        // territory, so anything squatting there is stale content to sync.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        fs::create_dir_all(plugin_dir(root)).await.unwrap();
-        mkfifo(&plugins_rb_path(root));
-
-        let deadline = std::time::Duration::from_secs(5);
-        let Ok(r) = tokio::time::timeout(deadline, add_plugin_files(root, false)).await else {
-            let _ = std::fs::OpenOptions::new()
-                .write(true)
-                .open(plugins_rb_path(root));
-            panic!("add_plugin_files must complete promptly with a FIFO plugins.rb");
-        };
-        assert_eq!(r.status, GemSetupStatus::Updated);
-        assert_eq!(
-            fs::read_to_string(plugins_rb_path(root)).await.unwrap(),
-            PLUGINS_RB,
-            "the FIFO is replaced by the generated file"
-        );
-    }
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_remove_fifo_plugins_rb_does_not_wedge() {
-        // `setup --remove` reads the ownership marker; a FIFO must read as
-        // not-ours (spared) — never wedge the remove.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        fs::create_dir_all(plugin_dir(root)).await.unwrap();
-        mkfifo(&plugins_rb_path(root));
-
-        let deadline = std::time::Duration::from_secs(5);
-        let Ok(r) = tokio::time::timeout(deadline, remove_plugin_files(root, false)).await else {
-            let _ = std::fs::OpenOptions::new()
-                .write(true)
-                .open(plugins_rb_path(root));
-            panic!("remove_plugin_files must complete promptly with a FIFO plugins.rb");
-        };
-        assert_eq!(
-            r.status,
-            GemSetupStatus::AlreadyConfigured,
-            "an unreadable non-regular file is not ours to remove"
-        );
-        assert!(
-            std::fs::symlink_metadata(plugins_rb_path(root)).is_ok(),
-            "the FIFO is spared, like any marker-less file"
-        );
-    }
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_remove_registration_fifo_index_reports_residue_not_wedge() {
-        // A FIFO at bundler's plugin index must surface as Residue (with the
-        // read failure as the reason), never wedge `setup --remove`.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        fs::create_dir_all(root.join(".bundle/plugin"))
-            .await
-            .unwrap();
-        let index = root.join(".bundle/plugin/index");
-        mkfifo(&index);
-
-        let deadline = std::time::Duration::from_secs(5);
-        let Ok(r) =
-            tokio::time::timeout(deadline, remove_plugin_registration_at(root, None, false)).await
-        else {
-            let _ = std::fs::OpenOptions::new().write(true).open(&index);
-            panic!("remove_plugin_registration must complete promptly with a FIFO index");
-        };
-        assert!(matches!(r, GemRegistrationCleanup::Residue { .. }), "{r:?}");
-        assert!(
-            std::fs::symlink_metadata(&index).is_ok(),
-            "the unreadable index must survive untouched"
-        );
-    }
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_add_fifo_stamp_gitignore_errors_not_wedges() {
-        // A FIFO at .socket/.gitignore: `setup` reads it twice (the
-        // needs-write probe and the append). Neither read may wedge, and the
-        // append must surface an Error rather than clobber the non-regular
-        // file with a fresh one.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        fs::create_dir_all(root.join(".socket")).await.unwrap();
-        let path = stamp_gitignore_path(root);
-        mkfifo(&path);
-
-        let deadline = std::time::Duration::from_secs(5);
-        let Ok(r) = tokio::time::timeout(deadline, add_plugin_files(root, false)).await else {
-            let _ = std::fs::OpenOptions::new().write(true).open(&path);
-            panic!("add_plugin_files must complete promptly with a FIFO .gitignore");
-        };
-        assert_eq!(r.status, GemSetupStatus::Error);
-        assert!(
-            !std::fs::metadata(&path).unwrap().is_file(),
-            "the FIFO must not be replaced by a regular file"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_add_never_clobbers_unreadable_stamp_gitignore() {
-        // gitignore entries are byte strings — a `.socket/.gitignore` with
-        // non-UTF-8 path bytes is legal, and `read_to_string` fails on it.
-        // Treating that failure as "empty file" and rewriting would destroy
-        // every user line: the add must surface an Error and leave the file
-        // byte-identical.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        let path = stamp_gitignore_path(root);
-        fs::create_dir_all(path.parent().unwrap()).await.unwrap();
-        let user_bytes: &[u8] = b"caf\xe9-scratch/\n";
-        fs::write(&path, user_bytes).await.unwrap();
-
-        let r = add_plugin_files(root, false).await;
-        assert_eq!(
-            fs::read(&path).await.unwrap(),
-            user_bytes,
-            "the user's unreadable .gitignore must survive byte-identical"
-        );
-        assert_eq!(
-            r.status,
-            GemSetupStatus::Error,
-            "an unreadable existing .gitignore is an error, not a silent clobber"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_add_appends_gitignore_line_to_unterminated_file() {
-        // A .gitignore whose last line has no trailing newline must not have
-        // our entry glued onto it ("vendor//gem-plugin-stamp" ignores nothing).
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        write(&stamp_gitignore_path(root), "vendor/").await;
-        add_plugin_files(root, false).await;
-        assert_eq!(
-            fs::read_to_string(stamp_gitignore_path(root))
-                .await
-                .unwrap(),
-            "vendor/\n/gem-plugin-stamp\n"
-        );
-        assert!(plugin_files_present(root).await);
-    }
-
-    #[test]
-    fn test_strip_registration_removes_commands_and_sources_entries_keeps_unknown_section() {
-        // Bundler records command-declaring plugins under `commands` and
-        // source-declaring ones under `sources` — both map ENTRY VALUE →
-        // plugin name, so ours must be dropped by value while a foreign
-        // command survives byte-verbatim. A section this CLI has never heard
-        // of (a future bundler's addition) must also survive byte-verbatim
-        // and count toward plugins_remain, so the index is rewritten, never
-        // deleted out from under it.
-        let index = "---\ncommands:\n  patch: \"socket-patch\"\n  mycmd: \"other-plugin\"\n\
-             hooks:\n  after-install:\n  - \"socket-patch\"\nload_paths:\n  socket-patch:\n  \
-             - \"/proj/p/.\"\nplugin_paths:\n  socket-patch: \"/proj/p\"\nsources:\n  \
-             https://example.test: \"socket-patch\"\nfrobs:\n  future: \"thing\"\n";
-        let stripped = strip_plugin_registration(index)
-            .expect("parses")
-            .expect("has our entries");
-        assert!(
-            stripped.plugins_remain,
-            "the foreign command and the unknown section still hold entries"
-        );
-        assert_eq!(
-            stripped.installed_dir.as_deref(),
-            Some(Path::new("/proj/p"))
-        );
-        assert_eq!(
-            stripped.content,
-            "---\ncommands:\n  mycmd: \"other-plugin\"\nhooks:\nload_paths:\n\
-             plugin_paths:\nsources:\nfrobs:\n  future: \"thing\"\n",
-            "our commands/sources entries leave by value; the foreign command \
-             and the unknown `frobs` section survive byte-verbatim"
-        );
-        assert!(
-            !stripped.content.contains("https://example.test"),
-            "the source mapping to socket-patch must be gone:\n{}",
-            stripped.content
-        );
-    }
-
-    #[test]
-    fn test_strip_registration_refuses_unrecognized_entry_and_section_lines() {
-        // A 2-space-indented line that is neither `- item`, `key: value`,
-        // nor `key:` is outside bundler's dialect: refuse with the line
-        // number (the caller surfaces the Residue remedy, never rewrites).
-        let err = strip_plugin_registration("---\nhooks:\n  garbage entry\n")
-            .err()
-            .expect("an unrecognized entry line must refuse");
-        assert!(
-            err.contains("line 3") && err.contains("unrecognized entry line"),
-            "refusal must name the line and the entry-line shape: {err}"
-        );
-        // A single-space-indented header is not a top-level section.
-        let err = strip_plugin_registration("---\n hooks:\n")
-            .err()
-            .expect("a space-indented section line must refuse");
-        assert!(
-            err.contains("line 2") && err.contains("unrecognized section line"),
-            "refusal must name the line and the section-line shape: {err}"
-        );
-        // An embedded space in a section name is not bundler's dialect either.
-        let err = strip_plugin_registration("---\nbad section:\n")
-            .err()
-            .expect("a section name with a space must refuse");
-        assert!(
-            err.contains("line 2") && err.contains("unrecognized section line"),
-            "refusal must name the line and the section-line shape: {err}"
-        );
-        // An empty section name (a bare `:` line) is refused too.
-        let err = strip_plugin_registration("---\n:\n")
-            .err()
-            .expect("an empty section name must refuse");
-        assert!(
-            err.contains("line 2") && err.contains("unrecognized section line"),
-            "refusal must name the line and the section-line shape: {err}"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_remove_registration_foreign_index_is_not_registered_and_untouched() {
-        // The common real-world `--remove` state: bundler's index exists but
-        // registers only OTHER plugins (no "socket-patch" substring anywhere).
-        // The fast path must report NotRegistered and leave the foreign index
-        // byte-identical — never parse-and-rewrite it.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        let index = root.join(".bundle/plugin/index");
-        let body = "---\ncommands:\nhooks:\n  after-install:\n  - \"other-plugin\"\n\
-             load_paths:\n  other-plugin:\n  - \"/x/other/.\"\nplugin_paths:\n  \
-             other-plugin: \"/x/other\"\nsources:\n";
-        write(&index, body).await;
-
-        let r = remove_plugin_registration_at(root, None, false).await;
-        assert!(matches!(r, GemRegistrationCleanup::NotRegistered), "{r:?}");
-        assert_eq!(
-            fs::read_to_string(&index).await.unwrap(),
-            body,
-            "a foreign index must survive byte-identical"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_remove_registration_substring_mention_is_not_registered_and_untouched() {
-        // A plugin NAMED with our name as a substring (socket-patch-extras):
-        // the coarse `contains(PLUGIN_NAME)` gate passes, but the strip
-        // compares full keys/values, finds nothing of ours, and returns
-        // Ok(None) → NotRegistered. Guards against false-positive stripping
-        // of a similarly-named plugin's registration.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        let index = root.join(".bundle/plugin/index");
-        let body = "---\ncommands:\nhooks:\n  after-install:\n  - \"socket-patch-extras\"\n\
-             load_paths:\n  socket-patch-extras:\n  - \"/x/extras/.\"\nplugin_paths:\n  \
-             socket-patch-extras: \"/x/extras\"\nsources:\n";
-        write(&index, body).await;
-
-        let r = remove_plugin_registration_at(root, None, false).await;
-        assert!(matches!(r, GemRegistrationCleanup::NotRegistered), "{r:?}");
-        assert_eq!(
-            fs::read_to_string(&index).await.unwrap(),
-            body,
-            "a similarly-named plugin's registration must survive byte-identical"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_remove_registration_cleans_index_lacking_plugin_paths_entry() {
-        // A partially hand-cleaned index: our hooks/load_paths entries remain
-        // but the `plugin_paths` section is empty, so the strip surfaces NO
-        // installed dir. The cleanup must take the installed_dir-None
-        // fall-through (nothing to delete under the plugin root) and still
-        // finish: emptied index deleted, dirs pruned.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        let index = root.join(".bundle/plugin/index");
-        write(
-            &index,
-            "---\ncommands:\nhooks:\n  after-install:\n  - \"socket-patch\"\n\
-             load_paths:\n  socket-patch:\n  - \"/proj/p/.\"\nplugin_paths:\nsources:\n",
-        )
-        .await;
-
-        let r = remove_plugin_registration_at(root, None, false).await;
-        assert!(matches!(r, GemRegistrationCleanup::Cleaned { .. }), "{r:?}");
-        assert!(!index.exists(), "emptied index deleted");
-        assert!(
-            !root.join(".bundle").exists(),
-            "plugin dir and empty app-config dir pruned even with no recorded install dir"
-        );
-    }
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_remove_registration_readonly_parent_delete_failure_is_residue() {
-        // Deleting the index requires write permission on `.bundle/plugin`.
-        // With that dir read-only the solo-plugin delete arm fails (EACCES),
-        // and the failure must surface as Residue carrying the delete reason
-        // (the caller turns it into the `bundler plugin uninstall` remedy) —
-        // never a false Cleaned while the index is in fact still there.
-        use std::os::unix::fs::PermissionsExt;
-
-        if unsafe { libc::geteuid() } == 0 {
-            return; // root ignores mode bits — the delete cannot fail
-        }
-
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        let plugin_root = root.join(".bundle/plugin");
-        let index = plugin_root.join("index");
-        let body = solo_index(&root.display().to_string());
-        write(&index, &body).await;
-        fs::set_permissions(&plugin_root, std::fs::Permissions::from_mode(0o555))
-            .await
-            .unwrap();
-
-        let r = remove_plugin_registration_at(root, None, false).await;
-
-        // Restore so the tempdir can be cleaned up regardless of the outcome.
-        fs::set_permissions(&plugin_root, std::fs::Permissions::from_mode(0o755))
-            .await
-            .unwrap();
-
-        match r {
-            GemRegistrationCleanup::Residue { reason, .. } => assert!(
-                reason.contains("could not delete it"),
-                "the delete failure must be the surfaced reason: {reason}"
-            ),
-            other => panic!("a failed index delete must report Residue, got {other:?}"),
-        }
-        assert_eq!(
-            fs::read_to_string(&index).await.unwrap(),
-            body,
-            "the index the delete could not remove must survive byte-identical"
-        );
-    }
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_remove_registration_readonly_parent_rewrite_failure_is_residue() {
-        // Same read-only parent, but another plugin remains registered: the
-        // rewrite arm stages a temp file next to the index, which the
-        // read-only dir refuses — Residue with the rewrite reason, and the
-        // multi-plugin index survives byte-identical (a torn or half-cleaned
-        // index would break EVERY plugin).
-        use std::os::unix::fs::PermissionsExt;
-
-        if unsafe { libc::geteuid() } == 0 {
-            return; // root ignores mode bits — the rewrite cannot fail
-        }
-
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        let plugin_root = root.join(".bundle/plugin");
-        let index = plugin_root.join("index");
-        let body =
-            "---\ncommands:\nhooks:\n  after-install:\n  - \"other\"\n  - \"socket-patch\"\n\
-             load_paths:\n  other:\n  - \"/x/other/.\"\n  socket-patch:\n  - \"/proj/p/.\"\n\
-             plugin_paths:\n  other: \"/x/other\"\n  socket-patch: \"/proj/p\"\nsources:\n";
-        write(&index, body).await;
-        fs::set_permissions(&plugin_root, std::fs::Permissions::from_mode(0o555))
-            .await
-            .unwrap();
-
-        let r = remove_plugin_registration_at(root, None, false).await;
-
-        fs::set_permissions(&plugin_root, std::fs::Permissions::from_mode(0o755))
-            .await
-            .unwrap();
-
-        match r {
-            GemRegistrationCleanup::Residue { reason, .. } => assert!(
-                reason.contains("could not rewrite it"),
-                "the rewrite failure must be the surfaced reason: {reason}"
-            ),
-            other => panic!("a failed index rewrite must report Residue, got {other:?}"),
-        }
-        assert_eq!(
-            fs::read_to_string(&index).await.unwrap(),
-            body,
-            "the index the rewrite could not replace must survive byte-identical"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_remove_leaves_stamp_free_user_gitignore_byte_identical() {
-        // `--remove` after our stamp line was hand-deleted (or the file was
-        // rewritten by another tool): nothing of ours is in the .gitignore,
-        // so the early return must leave it BYTE-identical — the CRLF ending
-        // proves the lines-split-and-rejoin reconstruction never ran (a
-        // rewrite would emit "my-scratch-dir/\n" and churn the user's file).
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        add_plugin_files(root, false).await;
-        let user_bytes = b"my-scratch-dir/\r\n";
-        fs::write(stamp_gitignore_path(root), user_bytes)
-            .await
-            .unwrap();
-
-        let r = remove_plugin_files(root, false).await;
-        assert_eq!(r.status, GemSetupStatus::Updated, "plugin files were ours");
-        assert!(!plugins_rb_path(root).exists(), "plugin files removed");
-        assert_eq!(
-            fs::read(stamp_gitignore_path(root)).await.unwrap(),
-            user_bytes,
-            "a stamp-free user .gitignore must survive byte-identical (CRLF kept)"
-        );
-        assert!(
-            root.join(".socket").is_dir(),
-            "a .socket/ that still holds user content is kept (prune is remove_dir, not _all)"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_resync_with_intact_stamp_gitignore_appends_no_duplicate() {
-        // A template resync (stale plugins.rb, everything else intact) must
-        // NOT touch `.socket/.gitignore`: `add_stamp_gitignore` is an
-        // unconditional append, and the ignore_missing gate is the only thing
-        // keeping every resync from duplicating the stamp line.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        add_plugin_files(root, false).await;
-        write(
-            &plugins_rb_path(root),
-            "# Code generated by stale\nold body\n",
-        )
-        .await;
-
-        let r = add_plugin_files(root, false).await;
-        assert_eq!(
-            r.status,
-            GemSetupStatus::Updated,
-            "stale plugins.rb resynced"
-        );
-        assert_eq!(
-            fs::read_to_string(plugins_rb_path(root)).await.unwrap(),
-            PLUGINS_RB
-        );
-        assert_eq!(
-            fs::read_to_string(stamp_gitignore_path(root))
-                .await
-                .unwrap(),
-            "/gem-plugin-stamp\n",
-            "the intact .gitignore must keep exactly one stamp line — no duplicate append"
-        );
-    }
-}
diff --git a/crates/socket-patch-core/src/setup/gem/templates/gemspec.tmpl b/crates/socket-patch-core/src/setup/gem/templates/gemspec.tmpl
deleted file mode 100644
index cd3b054f..00000000
--- a/crates/socket-patch-core/src/setup/gem/templates/gemspec.tmpl
+++ /dev/null
@@ -1,22 +0,0 @@
-# Code generated by `socket-patch setup`. DO NOT EDIT.
-#
-# Minimal gemspec for the in-tree socket-patch Bundler plugin. `setup` references
-# it from the Gemfile via `plugin "socket-patch", path: File.expand_path(...)`;
-# the directory must be committed so clones and CI have the plugin on disk.
-# (Phase 2 replaces this in-tree plugin with a published `socket-patch-bundler`
-# gem.)
-Gem::Specification.new do |s|
-  s.name        = "socket-patch"
-  s.version     = "0.0.0"
-  s.summary     = "Bundler plugin that keeps socket-patch gem patches applied on every bundle install."
-  s.description = s.summary
-  s.authors     = ["Socket"]
-  s.license     = "MIT"
-  s.files       = ["plugins.rb"]
-  # The plugin dir is flat (plugins.rb at the root, no lib/). Bundler refuses
-  # to load a plugin whose require paths are missing on disk ("The following
-  # plugin paths don't exist: .../lib ... Continuing without installing
-  # plugin"), so the default `lib` must be overridden.
-  s.require_paths = ["."]
-  s.required_ruby_version = ">= 2.6.0"
-end
diff --git a/crates/socket-patch-core/src/setup/gem/templates/plugins.rb.tmpl b/crates/socket-patch-core/src/setup/gem/templates/plugins.rb.tmpl
deleted file mode 100644
index 4c5fc5b9..00000000
--- a/crates/socket-patch-core/src/setup/gem/templates/plugins.rb.tmpl
+++ /dev/null
@@ -1,306 +0,0 @@
-# Code generated by `socket-patch setup`. DO NOT EDIT.
-#
-# socket-patch Bundler plugin. Keeps the gem patches recorded in
-# .socket/manifest.json applied by re-running the socket-patch CLI whenever
-# Bundler touches the gem set. Without it, `bundle install` reinstalls a gem
-# from its cached .gem and silently reverts any applied patch.
-#
-# When each trigger actually runs (verified against bundler 2.7 and 4.0; hook
-# subscriptions are recorded in .bundle/plugin/index at plugin REGISTRATION,
-# and bundler evaluates this file whenever a subscribed event first fires in a
-# bundle process):
-#
-#   * plugin registration — the FIRST `bundle install` after `setup` (or on a
-#     fresh clone) evaluates this file BEFORE any project gem is installed, so
-#     the load-time trigger is bootstrap-gated (no patch target exists yet)
-#     and quietly no-ops there; the install hooks below re-apply once the
-#     gems land.
-#   * every `bundle install` — fresh AND fully cached — fires the per-gem
-#     `after-install` events and then `after-install-all`; the forced
-#     `after-install-all` re-apply is the actual patch point.
-#   * `bundle pristine` fires ONLY the per-gem `after-install` events, so that
-#     digest-gated hook is what catches pristine's patch reversion in the same
-#     run. (A checkout registered by an older plugin version keeps its old
-#     subscription set until it re-registers — fresh clones and CI always
-#     re-register, a dev checkout can `rm -rf .bundle/plugin`.)
-#   * nothing fires on `bundle exec` / `bundle check` / plain `ruby`, and
-#     `gem pristine` bypasses bundler entirely — a reversion via those is only
-#     healed at the NEXT `bundle install`.
-#
-# A digest of (manifest + every committed file under .socket/ + Gemfile.lock +
-# the on-disk content of every gem-patch target file) gates the non-forced
-# triggers: identical to the last applied state -> fast exit; otherwise shell
-# out and re-stamp. Folding the targets' actual content in means an
-# out-of-band reversion (pristine, manual edit, wiped bundle path) flips the
-# digest even when every committed input is byte-identical. The stamp is a
-# pure digest cache at .socket/gem-plugin-stamp — machine-local state that
-# `setup` keeps out of version control via .socket/.gitignore. Deleting it
-# only forces one re-probe, and a stale copy that reaches version control
-# anyway is harmless on a fresh clone: the bootstrap gate below keys on the
-# patch targets existing on disk, never on the stamp. Older plugin versions
-# stamped a fixed-name file under Bundler.bundle_path — the machine-global
-# gem dir when no bundle path is configured, shared and clobbered across
-# every project on the host — so that legacy stamp is deleted best-effort
-# when seen.
-#
-# A patch failure NEVER breaks `bundle install`: it prints a warning naming
-# what failed and the remediation (run `socket-patch apply --ecosystems gem`
-# manually). Set SOCKET_PATCH_STRICT=1 to restore raise-on-failure
-# (Bundler::BundlerError) for builds that must not proceed with unpatched
-# gems. The socket-patch CLI must be on PATH (or pointed at by
-# SOCKET_PATCH_BIN) wherever `bundle install` runs.
-
-require "digest"
-require "fileutils"
-require "json"
-
-module SocketPatch
-  # Bundler evaluates this file twice in a bootstrap install (registration +
-  # first hook load), so constant assignments are guarded against re-runs.
-  BIN_ENV = "SOCKET_PATCH_BIN".freeze unless defined?(BIN_ENV)
-  STRICT_ENV = "SOCKET_PATCH_STRICT".freeze unless defined?(STRICT_ENV)
-  STAMP_NAME = "gem-plugin-stamp".freeze unless defined?(STAMP_NAME)
-  LEGACY_STAMP_NAME = ".socket-patch-gem-stamp".freeze unless defined?(LEGACY_STAMP_NAME)
-  # Bundler's parallel installer can fire per-gem hooks from worker threads;
-  # one applier runs at a time so a single bundle process never races
-  # concurrent `socket-patch apply` children against each other.
-  APPLY_LOCK = Mutex.new unless defined?(APPLY_LOCK)
-
-  module_function
-
-  # plugins.rb lives at <root>/.socket/bundler-plugin/plugins.rb, so the project
-  # root (where the Gemfile / .socket/manifest.json live) is two levels up.
-  def project_root
-    File.expand_path("../..", __dir__)
-  end
-
-  def socket_dir
-    File.join(project_root, ".socket")
-  end
-
-  def manifest_path
-    File.join(socket_dir, "manifest.json")
-  end
-
-  def socket_bin
-    env = ENV[BIN_ENV]
-    env && !env.empty? ? env : "socket-patch"
-  end
-
-  def strict?
-    %w[1 true].include?(ENV[STRICT_ENV].to_s)
-  end
-
-  def bundle_path
-    Bundler.bundle_path.to_s
-  rescue StandardError
-    File.join(project_root, "vendor", "bundle")
-  end
-
-  def stamp_path
-    File.join(socket_dir, STAMP_NAME)
-  end
-
-  # The on-disk files the manifest's gem patches target:
-  # <bundle_path>/gems/<name>-<version>[-<platform>]/<file key sans package/>.
-  # Paths are collected whether or not the file exists — `current_digest`
-  # folds an absence marker, so a gem appearing or vanishing flips the digest.
-  def patch_target_files
-    records = begin
-      JSON.parse(File.read(manifest_path)).fetch("patches", {})
-    rescue StandardError
-      return []
-    end
-    return [] unless records.is_a?(Hash)
-    gems_dir = File.join(bundle_path, "gems")
-    # Dir.glob treats `\` as an escape on EVERY platform, so a Windows-style
-    # bundle path (Bundler.bundle_path carries backslash separators through
-    # verbatim) would never match the platform-gem wildcard below: platform
-    # installs (nokogiri-1.15.0-x64-mingw-ucrt) drop out of the digest and a
-    # `bundle pristine` reversion of them leaves the stamp matching. Forward
-    # slashes are valid separators on Windows, so normalize the GLOB BASE
-    # only — the direct join below is not a pattern and stays byte-faithful.
-    glob_gems_dir = gems_dir.tr("\\", "/")
-    targets = []
-    records.each do |purl, record|
-      next unless purl.is_a?(String) && purl.start_with?("pkg:gem/")
-      coordinate = purl.split("pkg:gem/", 2).last.split("?", 2).first
-      name, at, version = coordinate.rpartition("@")
-      next if at.empty? || name.empty? || version.empty?
-      files = record.is_a?(Hash) ? record["files"] : nil
-      next unless files.is_a?(Hash)
-      files.each_key do |key|
-        rel = key.to_s.sub(%r{\Apackage/}, "")
-        targets << File.join(gems_dir, "#{name}-#{version}", rel)
-        targets.concat(Dir.glob(File.join(glob_gems_dir, "#{name}-#{version}-*", rel)))
-      end
-    end
-    targets.uniq.sort
-  end
-
-  # Files whose change must force a reapply: the manifest, every committed file
-  # under .socket/ (patch blobs etc. — the stamp itself excluded, or each write
-  # would invalidate the digest it records), Gemfile.lock, and the current
-  # on-disk state of every patch target.
-  def digest_inputs
-    inputs = [manifest_path]
-    lock = File.join(project_root, "Gemfile.lock")
-    inputs << lock if File.file?(lock)
-    if File.directory?(socket_dir)
-      Dir.glob(File.join(socket_dir, "**", "*")).sort.each do |p|
-        inputs << p if File.file?(p) && p != stamp_path
-      end
-    end
-    inputs.concat(patch_target_files)
-    inputs.uniq
-  end
-
-  def current_digest
-    d = Digest::SHA256.new
-    digest_inputs.each do |path|
-      d.update(path)
-      d.update("\0")
-      d.update(File.file?(path) ? "+" : "-")
-      begin
-        d.update(File.binread(path))
-      rescue StandardError
-        # Unreadable now -> contributes only its path + absence marker; a later
-        # readable state changes the digest and forces a reapply.
-      end
-      d.update("\0")
-    end
-    d.hexdigest
-  end
-
-  def stamped?(digest)
-    File.file?(stamp_path) && File.read(stamp_path).strip == digest
-  rescue StandardError
-    false
-  end
-
-  def write_stamp(digest)
-    FileUtils.mkdir_p(File.dirname(stamp_path))
-    File.write(stamp_path, digest)
-  rescue StandardError
-    # Best-effort: a missing/unwritable stamp just means we re-probe next time.
-  end
-
-  # Older plugin versions stamped under Bundler.bundle_path. It is never read
-  # anymore; delete it (best-effort, once per process) so it does not linger
-  # as an orphan in a shared gem dir.
-  def remove_legacy_stamp
-    return if @legacy_stamp_checked
-    @legacy_stamp_checked = true
-    legacy = File.join(bundle_path, LEGACY_STAMP_NAME)
-    File.delete(legacy) if File.file?(legacy)
-  rescue StandardError
-    # Best-effort cleanup only.
-  end
-
-  # Tolerant by default: a patch failure must never break `bundle install` —
-  # the first install of a fresh checkout runs the applier before any project
-  # gem exists, and raising there deadlocks the project on its own bootstrap
-  # (plugin registration fails, so every retry fails identically). Warn once
-  # per process with the remediation; SOCKET_PATCH_STRICT=1 restores the raise
-  # for builds that must not proceed unpatched. The trailer states what the
-  # ACTIVE mode does — the strict raise must not claim the install continues.
-  def failure_trailer
-    if strict?
-      "Failing `bundle install` because #{STRICT_ENV} is set; unset it to " \
-        "warn and continue instead."
-    else
-      "`bundle install` continues; set #{STRICT_ENV}=1 to make patch " \
-        "failures fatal."
-    end
-  end
-
-  def report_failure(message)
-    message = "#{message} #{failure_trailer}"
-    if strict?
-      raise(defined?(Bundler::BundlerError) ? Bundler::BundlerError.new(message) : message)
-    end
-    return if @warned
-    @warned = true
-    warn(message)
-  end
-
-  # Idempotent applier behind every trigger. No manifest -> the project does
-  # not use socket-patch, nothing to do.
-  # force: skip the digest gate (the installer just changed the gem set).
-  # bootstrap_gate: bail while NONE of the manifest's gem-patch targets exist
-  # on disk. The load-time trigger and the per-gem after-install hook use it
-  # so a bootstrap install's early evaluations (plugin REGISTRATION runs
-  # before any project gem lands) never shell out, warn, or — in strict mode —
-  # raise while there is nothing to patch; the forced after-install-all pass
-  # does the first real apply once the gems exist. The gate reads only the
-  # live gem tree, never the stamp: a stale stamp committed by mistake cannot
-  # re-open the bootstrap deadlock on a fresh clone, and deleting the stamp
-  # costs one re-probe instead of disabling these triggers.
-  def apply!(force: false, bootstrap_gate: false)
-    APPLY_LOCK.synchronize do
-      return unless File.file?(manifest_path)
-      remove_legacy_stamp
-      return if bootstrap_gate && patch_target_files.none? { |t| File.file?(t) }
-      return if !force && stamped?(current_digest)
-
-      ok = system(
-        socket_bin, "apply",
-        "--ecosystems", "gem", "--offline", "--silent",
-        "--cwd", project_root
-      )
-
-      if ok.nil?
-        report_failure(
-          "socket-patch: could not run `#{socket_bin} apply` — the gem patches in " \
-          ".socket/manifest.json are NOT applied. Install the socket-patch CLI (or set " \
-          "#{BIN_ENV} to its path), then run `socket-patch apply --ecosystems gem` " \
-          "manually."
-        )
-        return
-      elsif !ok
-        report_failure(
-          "socket-patch: `#{socket_bin} apply --ecosystems gem` failed — the gem patches " \
-          "in .socket/manifest.json may NOT be applied. Run `socket-patch apply " \
-          "--ecosystems gem` in #{project_root} to apply them manually."
-        )
-        return
-      end
-
-      if @warned
-        @warned = false
-        warn("socket-patch: gem patches applied; the earlier warning is resolved.")
-      end
-      # Recompute: the apply just rewrote the target files the digest folds in.
-      write_stamp(current_digest)
-    end
-  end
-end
-
-# Trigger 1 — load time. Runs at plugin registration and whenever a subscribed
-# hook event first loads the plugin in a bundle process. Bootstrap-gated on
-# the patch targets existing on disk (never on the stamp — a committed stale
-# stamp must not re-open the registration deadlock): on the bootstrap install
-# no gems exist to patch, so this quietly defers to Trigger 3. In strict mode
-# a genuine patch failure (Bundler::BundlerError) still propagates.
-begin
-  SocketPatch.apply!(bootstrap_gate: true)
-rescue StandardError => e
-  raise if defined?(Bundler::BundlerError) && e.is_a?(Bundler::BundlerError)
-end
-
-# Trigger 2 — after each individual gem (re)install. The only event bundler
-# fires during `bundle pristine`, so this is what catches pristine's patch
-# reversion in the same run — even when the stamp was deleted, since the gate
-# reads the gem tree, not the stamp. Digest- and bootstrap-gated: on a fresh
-# install's per-gem events the targets are only just landing and Trigger 3 is
-# about to do the real work.
-Bundler::Plugin.add_hook("after-install") do |_spec_install|
-  SocketPatch.apply!(bootstrap_gate: true)
-end
-
-# Trigger 3 — after the installer finishes (fresh AND fully-cached installs).
-# Forced, because the install just changed the gem set; the applier is
-# idempotent so a redundant run on an already-patched tree is a cheap no-op.
-Bundler::Plugin.add_hook("after-install-all") do |_install|
-  SocketPatch.apply!(force: true)
-end
diff --git a/crates/socket-patch-core/src/setup/gem/update.rs b/crates/socket-patch-core/src/setup/gem/update.rs
deleted file mode 100644
index 6d6c34c1..00000000
--- a/crates/socket-patch-core/src/setup/gem/update.rs
+++ /dev/null
@@ -1,1253 +0,0 @@
-//! Add / remove the managed `plugin "socket-patch"` block in a Bundler
-//! `Gemfile`, and statically check whether it is present.
-//!
-//! A Gemfile is Ruby, not a structured config, so this appends/strips a
-//! clearly-marked, byte-exact block under a reversibility contract: idempotent,
-//! `dry_run`-aware, `Updated`/`AlreadyConfigured`/`Error`, and a `--remove` that
-//! restores the file byte-for-byte.
-
-use std::path::Path;
-
-use tokio::fs;
-
-use super::version::{probe_bundler, unsupported_bundler_message, BundlerProbe};
-use super::{
-    add_plugin_files, remove_plugin_files, remove_plugin_registration_at, BundlerProject,
-    GemRegistrationCleanup,
-};
-use crate::utils::fs::atomic_write_bytes_preserving_mode;
-
-/// Outcome of one setup edit.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum GemSetupStatus {
-    Updated,
-    AlreadyConfigured,
-    Error,
-}
-
-#[derive(Debug)]
-pub struct GemEditResult {
-    /// Envelope `files[].kind` (`gemfile` | `gem_plugin` |
-    /// `gem_plugin_registration`).
-    pub kind: &'static str,
-    pub path: String,
-    pub status: GemSetupStatus,
-    pub error: Option<String>,
-}
-
-impl GemEditResult {
-    /// Build a result from an `Ok(changed)` / `Err(message)` outcome.
-    pub(super) fn from_result(
-        kind: &'static str,
-        path: String,
-        result: Result<bool, String>,
-    ) -> Self {
-        match result {
-            Ok(true) => Self {
-                kind,
-                path,
-                status: GemSetupStatus::Updated,
-                error: None,
-            },
-            Ok(false) => Self {
-                kind,
-                path,
-                status: GemSetupStatus::AlreadyConfigured,
-                error: None,
-            },
-            Err(e) => Self {
-                kind,
-                path,
-                status: GemSetupStatus::Error,
-                error: Some(e),
-            },
-        }
-    }
-}
-
-/// Stable substring identifying our managed block — `setup --check` and the
-/// add/remove edits all key on it, so a user-authored `plugin` line is never
-/// mistaken for ours.
-const MANAGED_MARKER: &str = "# >>> socket-patch:managed";
-
-/// The exact block `setup` appends to the Gemfile (trailing newline included).
-/// `File.expand_path(..., __dir__)` resolves relative to the Gemfile's own dir,
-/// so the reference is correct regardless of where `bundle` is invoked from.
-/// The source MUST be `path:`, not `git:`: Bundler fetches a `git:` plugin via
-/// `git clone <dir>`, and the generated dir is a plain directory (committing it
-/// to the parent repo does not give it a `.git`), so a `git:` source fails
-/// every `bundle install` with "repository ... does not exist". A `path:`
-/// source loads the directory in place.
-const MANAGED_BLOCK: &str = "\
-# >>> socket-patch:managed (added by `socket-patch setup`; do not edit) >>>\n\
-plugin 'socket-patch', path: File.expand_path('.socket/bundler-plugin', __dir__)\n\
-# <<< socket-patch:managed <<<\n";
-
-/// What we append after the user's content: a blank-line separator + the block.
-/// Removing this exact string restores the Gemfile byte-for-byte.
-fn appended() -> String {
-    format!("\n{MANAGED_BLOCK}")
-}
-
-/// Static check: does this Gemfile contain our managed plugin block? Pure
-/// substring scan — exactly what a repo auditor reads. A user's own
-/// `plugin "foo"` line does not match (the marker comment does).
-pub fn is_plugin_directive_present(content: &str) -> bool {
-    content.contains(MANAGED_MARKER)
-}
-
-/// Pure transform: append the managed block, or `None` if already present.
-fn gemfile_add(content: &str) -> Option<String> {
-    if is_plugin_directive_present(content) {
-        return None;
-    }
-    Some(format!("{content}{}", appended()))
-}
-
-/// Every on-disk form of the managed block, paired with the separator that
-/// precedes it: the LF bytes `setup` writes, and the CRLF rewrite handed back by
-/// a `core.autocrlf` checkout (Git for Windows' default) or an editor that saves
-/// the whole Gemfile CRLF. Both are ours, so `--remove` must match both — the
-/// marker survives such a rewrite, so a CRLF block otherwise reads as
-/// "configured" forever while `remove` reports nothing to do.
-fn block_variants() -> [(&'static str, String); 2] {
-    [
-        ("\n", MANAGED_BLOCK.to_string()),
-        ("\r\n", MANAGED_BLOCK.replace('\n', "\r\n")),
-    ]
-}
-
-/// Pure transform: strip the managed block (and the separator we added),
-/// restoring the pre-setup bytes. `None` if our block is absent.
-fn gemfile_remove(content: &str) -> Option<String> {
-    if !is_plugin_directive_present(content) {
-        return None;
-    }
-    let mut out = content.to_string();
-    let mut changed = false;
-    for (separator, block) in block_variants() {
-        // Remove every "<separator><block>" we appended — a Gemfile can carry
-        // more than one copy (a merge that kept both sides, a hand-copied
-        // Gemfile), and leaving one behind reports "removed" while a `plugin`
-        // line pointing at the just-deleted plugin dir fails every later
-        // `bundle install`.
-        let appended = format!("{separator}{block}");
-        while let Some(idx) = out.find(&appended) {
-            let end = idx + appended.len();
-            // The separator doubles as the terminator of a final unterminated
-            // pre-setup line. Stripping it is only safe when the block sits at
-            // EOF (the byte-exact restore) or the separator is a pure blank
-            // line (preceded by a newline, or at the start of the file);
-            // otherwise the user's lines on either side of the block would glue
-            // into one.
-            let start = if end == out.len() || idx == 0 || out[..idx].ends_with('\n') {
-                idx
-            } else {
-                idx + separator.len()
-            };
-            out.replace_range(start..end, "");
-            changed = true;
-        }
-        // Separator edited away: strip the bare block.
-        if out.contains(&block) {
-            out = out.replace(&block, "");
-            changed = true;
-        }
-    }
-    // If the block body itself was hand-edited (so nothing above matched),
-    // report nothing-removed rather than a false "Updated" on an unchanged,
-    // still-marked file.
-    changed.then_some(out)
-}
-
-/// Append the managed `plugin` block to the Gemfile. Idempotent
-/// (`AlreadyConfigured` when already present). A missing Gemfile is an error
-/// (we don't synthesize one — `discover_bundler_project` guarantees it exists).
-/// `kind = "gemfile"`.
-async fn edit_gemfile_add(gemfile: &Path, dry_run: bool) -> GemEditResult {
-    let result = async {
-        let content = fs::read_to_string(gemfile)
-            .await
-            .map_err(|e| e.to_string())?;
-        match gemfile_add(&content) {
-            None => Ok(false),
-            Some(new) => {
-                if !dry_run {
-                    // Stage+fsync+rename via the crate-wide hardened writer:
-                    // the user's committed Gemfile must never be left torn by
-                    // a crash mid-write. Mode-preserving, because the Gemfile
-                    // is the user's file and we only edit it — the rename swaps
-                    // in a fresh inode, so the plain writer would reset a 0600
-                    // private or 0664 group-writable Gemfile to umask defaults.
-                    atomic_write_bytes_preserving_mode(gemfile, new.as_bytes())
-                        .await
-                        .map_err(|e| e.to_string())?;
-                }
-                Ok(true)
-            }
-        }
-    }
-    .await;
-    GemEditResult::from_result("gemfile", gemfile.display().to_string(), result)
-}
-
-/// Strip the managed block from the Gemfile. Idempotent (already-absent →
-/// `AlreadyConfigured`); a missing Gemfile is a no-op.
-async fn edit_gemfile_remove(gemfile: &Path, dry_run: bool) -> GemEditResult {
-    let result = async {
-        let content = match fs::read_to_string(gemfile).await {
-            Ok(c) => c,
-            Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(false),
-            Err(e) => return Err(e.to_string()),
-        };
-        match gemfile_remove(&content) {
-            // Marker present but no removable form matched: the managed block
-            // was mutated (an edit inside it, a stripped final newline). The
-            // `plugin` directive may still be live, so this must be an Error —
-            // `remove_plugin_directive_at` early-returns on it, keeping the
-            // plugin dir the directive references. Reporting "not configured"
-            // instead lets the dir be deleted and every later `bundle install`
-            // exits 13 on the dangling `path:` source.
-            None if is_plugin_directive_present(&content) => Err(format!(
-                "the socket-patch managed block in {} has been edited and cannot \
-                 be removed automatically; delete the lines from \
-                 `{MANAGED_MARKER}` through `# <<< socket-patch:managed <<<` by \
-                 hand, then re-run `socket-patch setup --remove`",
-                gemfile.display()
-            )),
-            None => Ok(false),
-            Some(new) => {
-                if !dry_run {
-                    atomic_write_bytes_preserving_mode(gemfile, new.as_bytes())
-                        .await
-                        .map_err(|e| e.to_string())?;
-                }
-                Ok(true)
-            }
-        }
-    }
-    .await;
-    GemEditResult::from_result("gemfile", gemfile.display().to_string(), result)
-}
-
-/// Wire the project: generate the in-tree plugin directory, then append the
-/// Gemfile `plugin` block. Returns one result per artifact (`gemfile`,
-/// `gem_plugin`).
-///
-/// The plugin dir is generated FIRST and the Gemfile wired only if that
-/// succeeded, because Bundler hard-fails `bundle install` on a `plugin ... path:`
-/// directive whose source is missing ("The path ... does not exist", exit 13).
-/// Wiring first and then failing to write the files would leave the project
-/// unable to install at all — strictly worse than never having run `setup`.
-/// Wiring last keeps a failure's blast radius at "not configured".
-///
-/// Refused outright — dry-run included, so the preview never promises a wire
-/// the real run would reject — when the project's bundler is below the
-/// [`super::MIN_BUNDLER`] floor: bundler 1.x resolves the `plugin ... path:`
-/// directive as an ordinary gem and every later `bundle install` exits 7
-/// before the plugin registers (see `version.rs`). The probe fails OPEN on
-/// an undetectable version; `remove_plugin_directive` is never gated (it is
-/// the recovery path for an already-wired 1.x project).
-pub async fn add_plugin_directive(project: &BundlerProject, dry_run: bool) -> Vec<GemEditResult> {
-    let probe = probe_bundler(project).await;
-    add_plugin_directive_with(project, &probe, dry_run).await
-}
-
-/// [`add_plugin_directive`] with the bundler probe supplied by the caller.
-/// `probe_bundler` may spawn `bundle --version` (10 s cap) when the lock has
-/// no `BUNDLED WITH`, so a caller that runs a dry-run preview and then the
-/// real edit (the CLI's `setup`) probes once and passes the result to both.
-pub async fn add_plugin_directive_with(
-    project: &BundlerProject,
-    probe: &BundlerProbe,
-    dry_run: bool,
-) -> Vec<GemEditResult> {
-    if let BundlerProbe::Unsupported { version, source } = probe {
-        let mut message = unsupported_bundler_message(version, source);
-        // An ALREADY-wired project (wired before the floor existed, or on
-        // another machine) gets the recovery path by name — "Not wiring this
-        // project" alone would be misleading when the wiring is the problem.
-        if let Ok(content) = fs::read_to_string(&project.gemfile).await {
-            if is_plugin_directive_present(&content) {
-                message.push_str(
-                    ". This project is already wired: run `socket-patch setup --remove` \
-                     to unwire it so `bundle install` works again",
-                );
-            }
-        }
-        return vec![GemEditResult {
-            kind: "gemfile",
-            path: project.gemfile.display().to_string(),
-            status: GemSetupStatus::Error,
-            error: Some(message),
-        }];
-    }
-    let files = add_plugin_files(&project.root, dry_run).await;
-    if files.status == GemSetupStatus::Error {
-        return vec![files];
-    }
-    // Envelope order stays gemfile-then-gem_plugin; only execution order moved.
-    let gemfile = edit_gemfile_add(&project.gemfile, dry_run).await;
-    vec![gemfile, files]
-}
-
-/// Unwire the project: strip the Gemfile block (byte-for-byte restore), then
-/// delete the generated plugin directory, then clear bundler's machine-local
-/// `.bundle/plugin` registration of the plugin.
-///
-/// Mirror of [`add_plugin_directive`]'s ordering contract, from the other end:
-/// the files are deleted only once the directive referencing them is gone. A
-/// failed un-wire that still deleted the plugin dir would leave the Gemfile
-/// pointing at a path that no longer exists, breaking every later
-/// `bundle install` (exit 13) on a project that installed fine before.
-///
-/// The registration comes last (and only after the Gemfile un-wire held):
-/// while the `plugin` directive is still in the Gemfile the registration is
-/// live state bundler needs, not residue. Left behind after a successful
-/// unwire, it makes every later `bundle install` print bundler's "plugin
-/// paths don't exist ... Continuing without installing plugin socket-patch"
-/// block forever, so the cleanup failure/refusal path surfaces the
-/// `bundler plugin uninstall socket-patch` remedy as a `files[]` error.
-pub async fn remove_plugin_directive(
-    project: &BundlerProject,
-    dry_run: bool,
-) -> Vec<GemEditResult> {
-    let env = std::env::var_os("BUNDLE_APP_CONFIG");
-    remove_plugin_directive_at(project, env.as_deref(), dry_run).await
-}
-
-/// [`remove_plugin_directive`] with the `BUNDLE_APP_CONFIG` resolution input
-/// made explicit (tests inject it so a machine's exported value — e.g. the
-/// official ruby images' `/usr/local/bundle` — can neither fail them
-/// spuriously nor point the cleanup at a real machine-local index; the public
-/// entry reads the process env, exactly like bundler itself).
-async fn remove_plugin_directive_at(
-    project: &BundlerProject,
-    app_config_env: Option<&std::ffi::OsStr>,
-    dry_run: bool,
-) -> Vec<GemEditResult> {
-    let gemfile = edit_gemfile_remove(&project.gemfile, dry_run).await;
-    if gemfile.status == GemSetupStatus::Error {
-        return vec![gemfile];
-    }
-    let mut results = vec![gemfile, remove_plugin_files(&project.root, dry_run).await];
-    match remove_plugin_registration_at(&project.root, app_config_env, dry_run).await {
-        GemRegistrationCleanup::Cleaned { index } => results.push(GemEditResult {
-            kind: "gem_plugin_registration",
-            path: index.display().to_string(),
-            status: GemSetupStatus::Updated,
-            error: None,
-        }),
-        // The common pre-first-install case (bundler never registered the
-        // plugin): no entry — there was nothing machine-local to remove.
-        GemRegistrationCleanup::NotRegistered => {}
-        GemRegistrationCleanup::Residue { index, reason } => results.push(GemEditResult {
-            kind: "gem_plugin_registration",
-            path: index.display().to_string(),
-            status: GemSetupStatus::Error,
-            error: Some(format!(
-                "could not clear bundler's machine-local plugin registration at {} \
-                 ({reason}); run `bundler plugin uninstall socket-patch` to remove it, \
-                 or every later `bundle install` will warn about the unwired plugin",
-                index.display()
-            )),
-        }),
-    }
-    results
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    const GEMFILE: &str = "source 'https://rubygems.org'\ngem 'colorize', '1.1.0'\n";
-
-    async fn supported_project(root: &Path) -> BundlerProject {
-        // File-edit tests must reach the edit being exercised independently
-        // of whether the host has Bundler installed or which version it has.
-        fs::write(root.join("Gemfile"), GEMFILE).await.unwrap();
-        fs::write(root.join("Gemfile.lock"), "BUNDLED WITH\n   2.7.2\n")
-            .await
-            .unwrap();
-        super::super::discover_bundler_project(root).await.unwrap()
-    }
-
-    #[test]
-    fn test_add_appends_block_and_is_idempotent() {
-        let out = gemfile_add(GEMFILE).unwrap();
-        assert!(
-            out.starts_with(GEMFILE),
-            "original bytes preserved as a prefix"
-        );
-        assert!(is_plugin_directive_present(&out));
-        // `path:`-sourced, never `git:`: Bundler git-clones a `git:` plugin
-        // source, and the plain generated dir is uncloneable, breaking every
-        // `bundle install` on the wired project.
-        assert!(out.contains("plugin 'socket-patch', path:"));
-        assert!(out.contains("File.expand_path('.socket/bundler-plugin', __dir__)"));
-        // Idempotent.
-        assert!(gemfile_add(&out).is_none());
-    }
-
-    #[test]
-    fn test_add_then_remove_round_trips_byte_for_byte() {
-        let added = gemfile_add(GEMFILE).unwrap();
-        let removed = gemfile_remove(&added).unwrap();
-        assert_eq!(
-            removed, GEMFILE,
-            "remove must restore the original bytes exactly"
-        );
-    }
-
-    #[test]
-    fn test_remove_absent_is_noop() {
-        assert!(gemfile_remove(GEMFILE).is_none());
-    }
-
-    #[test]
-    fn test_user_plugin_line_is_not_detected_as_ours() {
-        let user = "source 'https://rubygems.org'\nplugin 'some-other-plugin'\n";
-        assert!(!is_plugin_directive_present(user));
-        // Adding ours leaves the user's line intact.
-        let out = gemfile_add(user).unwrap();
-        assert!(out.contains("plugin 'some-other-plugin'"));
-        assert!(out.contains("plugin 'socket-patch'"));
-    }
-
-    #[test]
-    fn test_round_trips_without_trailing_newline() {
-        // A Gemfile whose last line has no trailing newline must still restore
-        // byte-for-byte (add appends "\n<block>"; remove strips exactly that).
-        let no_nl = "source 'https://rubygems.org'\ngem 'colorize', '1.1.0'";
-        let added = gemfile_add(no_nl).unwrap();
-        assert!(is_plugin_directive_present(&added));
-        assert_eq!(gemfile_remove(&added).unwrap(), no_nl);
-    }
-
-    #[test]
-    fn test_round_trips_empty_gemfile() {
-        let added = gemfile_add("").unwrap();
-        assert!(is_plugin_directive_present(&added));
-        assert_eq!(gemfile_remove(&added).unwrap(), "");
-    }
-
-    #[test]
-    fn test_remove_via_block_fallback_when_separator_edited_away() {
-        // User deleted the blank-line separator, leaving the block glued to a
-        // no-newline final line. find(&appended) misses; the block-only
-        // fallback still strips it.
-        let glued = format!("gem 'x'{MANAGED_BLOCK}");
-        assert!(is_plugin_directive_present(&glued));
-        assert_eq!(gemfile_remove(&glued).unwrap(), "gem 'x'");
-    }
-
-    #[test]
-    fn test_remove_reports_nothing_removed_when_block_body_edited() {
-        // Marker present but the block body was hand-edited so neither the
-        // "\n<block>" nor the bare-block match fires. Removing nothing must NOT
-        // masquerade as a successful edit — the file is still configured.
-        let edited = format!(
-            "gem 'x'\n{MANAGED_MARKER} (added by `socket-patch setup`) >>>\nplugin 'socket-patch' # USER EDIT\n# <<< socket-patch:managed <<<\n"
-        );
-        assert!(is_plugin_directive_present(&edited));
-        assert!(
-            gemfile_remove(&edited).is_none(),
-            "an un-matchable edited block reports nothing-removed, not a no-op Updated"
-        );
-    }
-
-    #[test]
-    fn test_remove_preserves_user_gems_added_below_the_block() {
-        // Real-world flow: setup appends the block, then the user adds more
-        // gems AFTER it. `remove` must excise exactly our "\n<block>" and leave
-        // the user's later additions intact with clean formatting — never strip
-        // a user line or glue two lines together.
-        let added = gemfile_add(GEMFILE).unwrap();
-        let user_edited = format!("{added}gem 'extra', '2.0'\n");
-        assert!(is_plugin_directive_present(&user_edited));
-        assert_eq!(
-            gemfile_remove(&user_edited).unwrap(),
-            format!("{GEMFILE}gem 'extra', '2.0'\n"),
-            "only our block is removed; the user's later gems survive verbatim"
-        );
-    }
-
-    #[test]
-    fn test_remove_does_not_glue_lines_when_original_lacked_trailing_newline() {
-        // Original Gemfile has no final newline; setup's "\n" separator becomes
-        // the terminator of that last line. The user then adds gems AFTER our
-        // block. remove must not strip that separator along with the block —
-        // doing so glues `gem 'colorize', '1.1.0'` onto `gem 'extra', '2.0'`
-        // (one invalid Ruby line).
-        let no_nl = "source 'https://rubygems.org'\ngem 'colorize', '1.1.0'";
-        let added = gemfile_add(no_nl).unwrap();
-        let user_edited = format!("{added}gem 'extra', '2.0'\n");
-        assert_eq!(
-            gemfile_remove(&user_edited).unwrap(),
-            format!("{no_nl}\ngem 'extra', '2.0'\n"),
-            "the separator newline must survive as the last line's terminator"
-        );
-    }
-
-    #[test]
-    fn test_round_trips_crlf_content_byte_for_byte() {
-        // A Windows-authored Gemfile uses CRLF line endings. add appends an
-        // LF-delimited block; remove must still restore the original CRLF bytes
-        // exactly (the separator/block we strip is our own LF, not the user's).
-        let crlf = "source 'https://rubygems.org'\r\ngem 'colorize', '1.1.0'\r\n";
-        let added = gemfile_add(crlf).unwrap();
-        assert!(is_plugin_directive_present(&added));
-        assert_eq!(
-            gemfile_remove(&added).unwrap(),
-            crlf,
-            "CRLF user content restored byte-for-byte"
-        );
-    }
-
-    #[test]
-    fn test_remove_strips_a_crlf_rewritten_block() {
-        // Git for Windows' default `core.autocrlf` ("checkout Windows-style,
-        // commit Unix-style") rewrites the LF block we wrote into CRLF on
-        // checkout — as does a Windows editor that saves the whole Gemfile
-        // CRLF. `--remove` must still strip it. Otherwise it reports
-        // "not_configured" and leaves the `plugin` line behind while
-        // `remove_plugin_files` DOES delete the generated plugin dir (its
-        // marker survives the rewrite), so every later `bundle install` dies
-        // on a plugin path that no longer exists.
-        let crlf_block = MANAGED_BLOCK.replace('\n', "\r\n");
-        let user = "source 'https://rubygems.org'\r\ngem 'colorize', '1.1.0'\r\n";
-        let configured = format!("{user}\r\n{crlf_block}");
-        assert!(is_plugin_directive_present(&configured));
-        let out =
-            gemfile_remove(&configured).expect("a CRLF-rewritten block is still ours to strip");
-        assert_eq!(
-            out, user,
-            "the CRLF checkout's pre-setup bytes are restored"
-        );
-        assert!(!is_plugin_directive_present(&out));
-    }
-
-    #[test]
-    fn test_remove_strips_a_crlf_block_without_gluing_later_user_lines() {
-        // Same CRLF rewrite, but the user added gems AFTER our block and the
-        // pre-setup file had no final newline (so the separator terminates that
-        // last line). Stripping the CRLF separator too would glue two `gem`
-        // lines into one invalid Ruby line.
-        let crlf_block = MANAGED_BLOCK.replace('\n', "\r\n");
-        let configured = format!("gem 'colorize'\r\n{crlf_block}gem 'extra', '2.0'\r\n");
-        assert_eq!(
-            gemfile_remove(&configured).unwrap(),
-            "gem 'colorize'\r\ngem 'extra', '2.0'\r\n",
-            "the CRLF separator survives as the previous line's terminator"
-        );
-    }
-
-    #[test]
-    fn test_remove_strips_every_managed_block() {
-        // A Gemfile can end up carrying two copies of the block — a merge that
-        // kept both sides, or a hand-copied Gemfile. `--remove` must strip all
-        // of them: leaving one behind reports "removed" while a `plugin` line
-        // pointing at the just-deleted plugin dir survives and fails every
-        // later `bundle install`.
-        let added = gemfile_add(GEMFILE).unwrap();
-        let doubled = format!("{added}\n{MANAGED_BLOCK}");
-        assert!(is_plugin_directive_present(&doubled));
-        let out = gemfile_remove(&doubled).unwrap();
-        assert!(
-            !is_plugin_directive_present(&out),
-            "no managed block may survive `--remove`"
-        );
-        assert_eq!(out, GEMFILE, "both blocks stripped, user bytes restored");
-    }
-
-    #[test]
-    fn test_closing_marker_alone_is_not_detected_as_present() {
-        // The "<<<" closing line must not satisfy the ">>>" opening marker.
-        let closing_only = "gem 'x'\n# <<< socket-patch:managed <<<\n";
-        assert!(!is_plugin_directive_present(closing_only));
-    }
-
-    #[tokio::test]
-    async fn test_full_roundtrip_via_gems_rb() {
-        // Exercise Bundler's alternate manifest name end to end.
-        let dir = tempfile::tempdir().unwrap();
-        let gems_rb = dir.path().join("gems.rb");
-        fs::write(&gems_rb, GEMFILE).await.unwrap();
-        assert_eq!(
-            edit_gemfile_add(&gems_rb, false).await.status,
-            GemSetupStatus::Updated
-        );
-        assert!(is_plugin_directive_present(
-            &fs::read_to_string(&gems_rb).await.unwrap()
-        ));
-        assert_eq!(
-            edit_gemfile_remove(&gems_rb, false).await.status,
-            GemSetupStatus::Updated
-        );
-        assert_eq!(fs::read_to_string(&gems_rb).await.unwrap(), GEMFILE);
-    }
-
-    #[tokio::test]
-    async fn test_remove_dry_run_does_not_write() {
-        let dir = tempfile::tempdir().unwrap();
-        let gemfile = dir.path().join("Gemfile");
-        let configured = gemfile_add(GEMFILE).unwrap();
-        fs::write(&gemfile, &configured).await.unwrap();
-        let res = edit_gemfile_remove(&gemfile, true).await;
-        assert_eq!(res.status, GemSetupStatus::Updated);
-        assert_eq!(
-            fs::read_to_string(&gemfile).await.unwrap(),
-            configured,
-            "dry-run remove must not write"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_edit_gemfile_missing_is_error() {
-        let dir = tempfile::tempdir().unwrap();
-        let res = edit_gemfile_add(&dir.path().join("Gemfile"), false).await;
-        assert_eq!(res.status, GemSetupStatus::Error);
-    }
-
-    #[tokio::test]
-    async fn test_edit_gemfile_remove_missing_is_noop() {
-        let dir = tempfile::tempdir().unwrap();
-        let res = edit_gemfile_remove(&dir.path().join("Gemfile"), false).await;
-        assert_eq!(res.status, GemSetupStatus::AlreadyConfigured);
-    }
-
-    #[tokio::test]
-    async fn test_add_dry_run_does_not_write() {
-        let dir = tempfile::tempdir().unwrap();
-        let gemfile = dir.path().join("Gemfile");
-        fs::write(&gemfile, GEMFILE).await.unwrap();
-        let res = edit_gemfile_add(&gemfile, true).await;
-        assert_eq!(res.status, GemSetupStatus::Updated);
-        assert_eq!(
-            fs::read_to_string(&gemfile).await.unwrap(),
-            GEMFILE,
-            "dry-run must not write"
-        );
-    }
-
-    // ── atomic-write contract (no truncation / no stage litter) ──────
-    //
-    // The Gemfile edit must go through stage+fsync+rename, never a bare
-    // truncating write, so a crash can't leave the user's committed Gemfile
-    // truncated or empty.
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_add_replaces_readonly_gemfile_atomically() {
-        use std::os::unix::fs::PermissionsExt;
-        // Oracle for the truncating-write bug: rename needs only directory
-        // write permission, while a bare `fs::write` must open the target
-        // itself for writing — so a read-only Gemfile distinguishes the two
-        // (EACCES under truncate, clean replace under stage+rename, same as
-        // the composer/npm/pypi/cargo/go manifest writers).
-        let dir = tempfile::tempdir().unwrap();
-        let gemfile = dir.path().join("Gemfile");
-        fs::write(&gemfile, GEMFILE).await.unwrap();
-        std::fs::set_permissions(&gemfile, std::fs::Permissions::from_mode(0o444)).unwrap();
-
-        let res = edit_gemfile_add(&gemfile, false).await;
-        assert_eq!(res.status, GemSetupStatus::Updated, "err: {:?}", res.error);
-        assert!(is_plugin_directive_present(
-            &fs::read_to_string(&gemfile).await.unwrap()
-        ));
-    }
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_remove_replaces_readonly_gemfile_atomically() {
-        use std::os::unix::fs::PermissionsExt;
-        let dir = tempfile::tempdir().unwrap();
-        let gemfile = dir.path().join("Gemfile");
-        fs::write(&gemfile, gemfile_add(GEMFILE).unwrap())
-            .await
-            .unwrap();
-        std::fs::set_permissions(&gemfile, std::fs::Permissions::from_mode(0o444)).unwrap();
-
-        let res = edit_gemfile_remove(&gemfile, false).await;
-        assert_eq!(res.status, GemSetupStatus::Updated, "err: {:?}", res.error);
-        assert_eq!(
-            fs::read_to_string(&gemfile).await.unwrap(),
-            GEMFILE,
-            "read-only Gemfile restored byte-for-byte via stage+rename"
-        );
-    }
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_add_preserves_gemfile_permissions() {
-        use std::os::unix::fs::PermissionsExt;
-        // The rename swaps in a fresh stage inode created with umask defaults,
-        // so the plain writer resets the mode of a file the USER owns and we
-        // merely edit: a 0600 private Gemfile silently becomes world-readable.
-        let dir = tempfile::tempdir().unwrap();
-        let gemfile = dir.path().join("Gemfile");
-        fs::write(&gemfile, GEMFILE).await.unwrap();
-        std::fs::set_permissions(&gemfile, std::fs::Permissions::from_mode(0o600)).unwrap();
-
-        let res = edit_gemfile_add(&gemfile, false).await;
-        assert_eq!(res.status, GemSetupStatus::Updated, "err: {:?}", res.error);
-        let mode = std::fs::metadata(&gemfile).unwrap().permissions().mode() & 0o777;
-        assert_eq!(
-            mode, 0o600,
-            "the user's Gemfile mode must survive the edit (got {mode:o})"
-        );
-    }
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_remove_preserves_gemfile_permissions() {
-        use std::os::unix::fs::PermissionsExt;
-        // Inverse of the 0600 case: a group-writable Gemfile (shared checkout)
-        // must not come back 0644, locking the group out.
-        let dir = tempfile::tempdir().unwrap();
-        let gemfile = dir.path().join("Gemfile");
-        fs::write(&gemfile, gemfile_add(GEMFILE).unwrap())
-            .await
-            .unwrap();
-        std::fs::set_permissions(&gemfile, std::fs::Permissions::from_mode(0o664)).unwrap();
-
-        let res = edit_gemfile_remove(&gemfile, false).await;
-        assert_eq!(res.status, GemSetupStatus::Updated, "err: {:?}", res.error);
-        let mode = std::fs::metadata(&gemfile).unwrap().permissions().mode() & 0o777;
-        assert_eq!(
-            mode, 0o664,
-            "group-writable Gemfile stays group-writable (got {mode:o})"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_edit_leaves_no_stage_litter() {
-        let dir = tempfile::tempdir().unwrap();
-        let gemfile = dir.path().join("Gemfile");
-        fs::write(&gemfile, GEMFILE).await.unwrap();
-
-        assert_eq!(
-            edit_gemfile_add(&gemfile, false).await.status,
-            GemSetupStatus::Updated
-        );
-        assert_eq!(
-            edit_gemfile_remove(&gemfile, false).await.status,
-            GemSetupStatus::Updated
-        );
-        assert_eq!(fs::read_to_string(&gemfile).await.unwrap(), GEMFILE);
-
-        // No half-written `.socket-stage-*` sibling left behind.
-        let mut rd = fs::read_dir(dir.path()).await.unwrap();
-        while let Some(entry) = rd.next_entry().await.unwrap() {
-            let name = entry.file_name().to_string_lossy().into_owned();
-            assert!(!name.starts_with(".socket-stage-"), "stage litter: {name}");
-        }
-    }
-
-    // ── the Gemfile directive must never point at a missing plugin dir ──
-    //
-    // Bundler HARD-FAILS `bundle install` on a `plugin ... path:` directive
-    // whose source directory does not exist:
-    //
-    //     $ bundle install
-    //     The path `/tmp/x/.socket/bundler-plugin` does not exist.
-    //     $ echo $?
-    //     13
-    //
-    // (verified on bundler 4.0.15). So a half-applied add — Gemfile wired, files
-    // not written — is strictly WORSE than never running setup: the project can
-    // no longer install at all. Same for a half-applied remove: files deleted,
-    // directive left behind. Both orderings must keep the directive's lifetime
-    // inside the plugin dir's.
-
-    #[tokio::test]
-    async fn test_add_leaves_gemfile_unwired_when_plugin_dir_cannot_be_generated() {
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        let project = supported_project(root).await;
-        // `.socket` as a regular FILE makes `create_dir_all(".socket/bundler-
-        // plugin")` fail on every platform — the portable stand-in for a
-        // read-only checkout / ENOSPC / a clobbered `.socket`.
-        fs::write(root.join(".socket"), "not a directory\n")
-            .await
-            .unwrap();
-        let results = add_plugin_directive(&project, false).await;
-
-        assert!(
-            results
-                .iter()
-                .any(|r| r.kind == "gem_plugin" && r.status == GemSetupStatus::Error),
-            "the failed plugin-dir generation must surface as an error: {results:?}"
-        );
-        assert_eq!(
-            fs::read_to_string(root.join("Gemfile")).await.unwrap(),
-            GEMFILE,
-            "the Gemfile must NOT be wired to a plugin dir that does not exist — \
-             that breaks every `bundle install` (exit 13)"
-        );
-    }
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_remove_keeps_plugin_files_when_gemfile_cannot_be_unwired() {
-        use std::os::unix::fs::PermissionsExt;
-
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        let project = supported_project(root).await;
-        assert!(add_plugin_directive(&project, false)
-            .await
-            .iter()
-            .all(|r| r.status == GemSetupStatus::Updated));
-
-        // A read-only project root blocks the Gemfile's stage+rename (the stage
-        // sibling cannot be created) while leaving `.socket/bundler-plugin/`
-        // itself writable — so the un-wire fails but the deletes would succeed.
-        fs::set_permissions(root, std::fs::Permissions::from_mode(0o555))
-            .await
-            .unwrap();
-
-        let results = remove_plugin_directive_at(&project, None, false).await;
-
-        // Restore before any assertion can unwind, so the tempdir cleans up.
-        fs::set_permissions(root, std::fs::Permissions::from_mode(0o755))
-            .await
-            .unwrap();
-
-        assert!(
-            results.iter().any(|r| r.status == GemSetupStatus::Error),
-            "the failed Gemfile un-wire must surface as an error: {results:?}"
-        );
-        assert!(
-            is_plugin_directive_present(&fs::read_to_string(root.join("Gemfile")).await.unwrap()),
-            "precondition: the directive is still in the Gemfile"
-        );
-        assert!(
-            super::super::plugin_files_present(root).await,
-            "the plugin files must SURVIVE a failed un-wire — deleting them while \
-             the directive remains breaks every `bundle install` (exit 13)"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_remove_keeps_plugin_files_when_managed_block_is_unmatchable() {
-        // A benign mutation — the Gemfile lost its final newline (an editor
-        // without insert-final-newline, a trailing-whitespace trimmer) — leaves
-        // the marker present but every removable block form unmatchable, so the
-        // Gemfile edit removes nothing. The live `plugin ... path:` directive
-        // is still in the Gemfile, so the plugin dir must SURVIVE: deleting it
-        // breaks every later `bundle install` (exit 13), and the user must get
-        // an error naming the manual remedy, not a "not_configured" no-op.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        let project = supported_project(root).await;
-        assert!(add_plugin_directive(&project, false)
-            .await
-            .iter()
-            .all(|r| r.status == GemSetupStatus::Updated));
-        let content = fs::read_to_string(root.join("Gemfile")).await.unwrap();
-        fs::write(root.join("Gemfile"), content.strip_suffix('\n').unwrap())
-            .await
-            .unwrap();
-
-        let results = remove_plugin_directive_at(&project, None, false).await;
-
-        assert!(
-            is_plugin_directive_present(&fs::read_to_string(root.join("Gemfile")).await.unwrap()),
-            "precondition: the directive is still in the Gemfile"
-        );
-        assert!(
-            results
-                .iter()
-                .any(|r| r.kind == "gemfile" && r.status == GemSetupStatus::Error),
-            "an unmatchable managed block must surface as a gemfile error: {results:?}"
-        );
-        assert!(
-            super::super::plugin_files_present(root).await,
-            "the plugin files must SURVIVE while the directive remains in the \
-             Gemfile — deleting them breaks every `bundle install` (exit 13)"
-        );
-    }
-
-    // ── bundler version floor ─────────────────────────────────────────
-    //
-    // Bundler 1.x cannot load a `plugin ... path:` directive: `Plugin::DSL`
-    // undef_methods `:path` and the 1.x plugin installer supports only
-    // git/rubygems sources, so the directive is resolved as an ORDINARY GEM
-    // and every later `bundle install` dies with exit 7 ("Could not find gem
-    // 'socket-patch' ...") BEFORE plugin registration — an error that never
-    // names socket-patch. Wiring such a project is strictly worse than
-    // refusing (reproduced on bundler 1.17.3). The project's bundler is read
-    // from the lock's `BUNDLED WITH` section — deterministic, and present
-    // even where `bundle` is not on PATH.
-
-    const LOCK_1X: &str = "GEM\n  remote: https://rubygems.org/\n  specs:\n    \
-                           colorize (1.1.0)\n\nPLATFORMS\n  ruby\n\nDEPENDENCIES\n  \
-                           colorize (= 1.1.0)\n\nBUNDLED WITH\n   1.17.3\n";
-
-    #[tokio::test]
-    async fn test_add_refuses_bundler_1x_locked_project() {
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        fs::write(root.join("Gemfile"), GEMFILE).await.unwrap();
-        fs::write(root.join("Gemfile.lock"), LOCK_1X).await.unwrap();
-        let project = super::super::discover_bundler_project(root).await.unwrap();
-
-        let results = add_plugin_directive(&project, false).await;
-
-        assert!(
-            results.iter().any(|r| r.status == GemSetupStatus::Error),
-            "wiring a bundler-1.x project must be refused as an error: {results:?}"
-        );
-        let msg = results
-            .iter()
-            .find_map(|r| r.error.as_deref())
-            .unwrap_or_default();
-        assert!(
-            msg.contains("1.17.3") && msg.contains("2.2"),
-            "the refusal must name the detected bundler and the floor: {msg:?}"
-        );
-        assert_eq!(
-            fs::read_to_string(root.join("Gemfile")).await.unwrap(),
-            GEMFILE,
-            "the Gemfile must NOT be wired — bundler 1.x resolves the plugin \
-             directive as an ordinary gem and every later `bundle install` \
-             exits 7"
-        );
-        assert!(
-            !super::super::plugin_files_present(root).await,
-            "no plugin files may be generated for a refused project"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_add_dry_run_also_refuses_bundler_1x() {
-        // The preview must refuse identically — a dry-run that previews the
-        // wiring while the real run errors would lie to the user.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        fs::write(root.join("Gemfile"), GEMFILE).await.unwrap();
-        fs::write(root.join("Gemfile.lock"), LOCK_1X).await.unwrap();
-        let project = super::super::discover_bundler_project(root).await.unwrap();
-
-        let results = add_plugin_directive(&project, true).await;
-        assert!(
-            results.iter().any(|r| r.status == GemSetupStatus::Error),
-            "dry-run must surface the same refusal: {results:?}"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_add_proceeds_on_bundler_2x_lock() {
-        // A supported lock must not trip the gate.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        fs::write(root.join("Gemfile"), GEMFILE).await.unwrap();
-        fs::write(
-            root.join("Gemfile.lock"),
-            LOCK_1X.replace("1.17.3", "2.7.2"),
-        )
-        .await
-        .unwrap();
-        let project = super::super::discover_bundler_project(root).await.unwrap();
-
-        let results = add_plugin_directive(&project, false).await;
-        assert!(
-            results.iter().all(|r| r.status == GemSetupStatus::Updated),
-            "a bundler-2.x lock must wire normally: {results:?}"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_add_refusal_on_wired_1x_project_names_remove_recovery() {
-        // Re-running `setup` on an ALREADY-wired 1.x project must not stop at
-        // "Not wiring this project" — the wiring IS the problem there, and the
-        // refusal must hand the user the `setup --remove` recovery path.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        fs::write(root.join("Gemfile"), gemfile_add(GEMFILE).unwrap())
-            .await
-            .unwrap();
-        fs::write(root.join("Gemfile.lock"), LOCK_1X).await.unwrap();
-        let project = super::super::discover_bundler_project(root).await.unwrap();
-
-        let results = add_plugin_directive(&project, false).await;
-        let msg = results
-            .iter()
-            .find_map(|r| r.error.as_deref())
-            .unwrap_or_default();
-        assert!(
-            msg.contains("setup --remove"),
-            "the refusal on a wired project must name the recovery path: {msg:?}"
-        );
-
-        // And the UNWIRED refusal must NOT claim the project is wired.
-        fs::write(root.join("Gemfile"), GEMFILE).await.unwrap();
-        let results = add_plugin_directive(&project, false).await;
-        let msg = results
-            .iter()
-            .find_map(|r| r.error.as_deref())
-            .unwrap_or_default();
-        assert!(
-            !msg.contains("already wired"),
-            "an unwired project's refusal must not mention un-wiring: {msg:?}"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_remove_still_unwires_bundler_1x_project() {
-        // `setup --remove` is the RECOVERY path for a project wired before
-        // the floor existed (or wired on another machine) — the gate must
-        // never block the un-wire.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        fs::write(root.join("Gemfile"), gemfile_add(GEMFILE).unwrap())
-            .await
-            .unwrap();
-        fs::write(root.join("Gemfile.lock"), LOCK_1X).await.unwrap();
-        let project = super::super::discover_bundler_project(root).await.unwrap();
-
-        let results = remove_plugin_directive(&project, false).await;
-        assert!(
-            results.iter().all(|r| r.status != GemSetupStatus::Error),
-            "remove must not be blocked by the version gate: {results:?}"
-        );
-        assert_eq!(
-            fs::read_to_string(root.join("Gemfile")).await.unwrap(),
-            GEMFILE,
-            "the recovery un-wire restores the Gemfile byte-for-byte"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_remove_clears_bundler_plugin_registration_entry() {
-        // A project bundler has already installed once: the machine-local
-        // `.bundle/plugin/index` registration exists. `remove` must clear it
-        // and report the cleanup as its own `gem_plugin_registration` entry.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        let project = supported_project(root).await;
-        assert!(add_plugin_directive(&project, false)
-            .await
-            .iter()
-            .all(|r| r.status == GemSetupStatus::Updated));
-        let index = root.join(".bundle").join("plugin").join("index");
-        fs::create_dir_all(index.parent().unwrap()).await.unwrap();
-        fs::write(
-            &index,
-            format!(
-                "---\ncommands:\nhooks:\n  after-install:\n  - \"socket-patch\"\n  \
-                 after-install-all:\n  - \"socket-patch\"\nload_paths:\n  socket-patch:\n  \
-                 - \"{0}/.socket/bundler-plugin/.\"\nplugin_paths:\n  \
-                 socket-patch: \"{0}/.socket/bundler-plugin\"\nsources:\n",
-                root.display()
-            ),
-        )
-        .await
-        .unwrap();
-
-        let removed = remove_plugin_directive_at(&project, None, false).await;
-        assert!(
-            removed
-                .iter()
-                .any(|r| r.kind == "gem_plugin_registration"
-                    && r.status == GemSetupStatus::Updated),
-            "the registration cleanup must be reported: {removed:?}"
-        );
-        assert!(
-            !index.exists(),
-            "the socket-patch-only registration index must be gone"
-        );
-        // Absent registration (the pre-first-install case): no entry at all.
-        fs::write(root.join("Gemfile"), gemfile_add(GEMFILE).unwrap())
-            .await
-            .unwrap();
-        assert!(add_plugin_directive(&project, false)
-            .await
-            .iter()
-            .all(|r| r.status != GemSetupStatus::Error));
-        let removed = remove_plugin_directive_at(&project, None, false).await;
-        assert!(
-            removed.iter().all(|r| r.kind != "gem_plugin_registration"),
-            "no machine-local registration -> no registration entry: {removed:?}"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_edit_gemfile_remove_read_error_is_error() {
-        // A non-NotFound read failure (here: a directory squatting on the
-        // Gemfile path, EISDIR on unix / access-denied on Windows) must
-        // surface as an Error result — NOT the missing-file no-op, which
-        // would let the remove flow proceed to delete the plugin dir while
-        // an unreadable Gemfile may still carry the live directive.
-        let dir = tempfile::tempdir().unwrap();
-        let gemfile = dir.path().join("Gemfile");
-        fs::create_dir(&gemfile).await.unwrap();
-
-        let res = edit_gemfile_remove(&gemfile, false).await;
-        assert_eq!(res.kind, "gemfile");
-        assert_eq!(
-            res.status,
-            GemSetupStatus::Error,
-            "an unreadable Gemfile is an error, not a no-op: {res:?}"
-        );
-        assert!(
-            res.error.as_deref().is_some_and(|e| !e.is_empty()),
-            "the read failure must be reported: {res:?}"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_remove_on_unwired_gemfile_is_already_configured() {
-        // `setup --remove` on a project whose Gemfile exists but was never
-        // wired — a completely ordinary user flow. The Gemfile edit reports
-        // AlreadyConfigured (nothing to strip, no error), the bytes survive
-        // untouched, and the rest of the cleanup still runs without errors.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        let gemfile = root.join("Gemfile");
-        fs::write(&gemfile, GEMFILE).await.unwrap();
-
-        let res = edit_gemfile_remove(&gemfile, false).await;
-        assert_eq!(res.status, GemSetupStatus::AlreadyConfigured, "{res:?}");
-        assert!(res.error.is_none(), "no error on a never-wired Gemfile");
-        assert_eq!(
-            fs::read_to_string(&gemfile).await.unwrap(),
-            GEMFILE,
-            "an unwired Gemfile survives byte-for-byte"
-        );
-
-        // The full remove flow on the same fixture: the AlreadyConfigured
-        // gemfile result must NOT early-return — the file/registration
-        // cleanup steps still run, and nothing errors.
-        let project = super::super::discover_bundler_project(root).await.unwrap();
-        let results = remove_plugin_directive_at(&project, None, false).await;
-        assert!(
-            results
-                .iter()
-                .any(|r| r.kind == "gemfile" && r.status == GemSetupStatus::AlreadyConfigured),
-            "the gemfile entry reports already-configured: {results:?}"
-        );
-        assert!(
-            results.iter().all(|r| r.status != GemSetupStatus::Error),
-            "remove on a never-wired project is error-free: {results:?}"
-        );
-        assert_eq!(
-            fs::read_to_string(&gemfile).await.unwrap(),
-            GEMFILE,
-            "the full remove flow leaves the unwired Gemfile untouched"
-        );
-    }
-
-    /// Plant a FIFO with a direct `mkfifo(2)` syscall — same helper as the
-    /// gem/mod.rs / composer / find.rs FIFO tests: fork/exec flakes under
-    /// heavy parallel load and the syscall needs no process at all.
-    #[cfg(unix)]
-    fn mkfifo(path: &Path) {
-        use std::os::unix::ffi::OsStrExt;
-        let c_path =
-            std::ffi::CString::new(path.as_os_str().as_bytes()).expect("fifo path has no NUL");
-        let rc = unsafe { libc::mkfifo(c_path.as_ptr(), 0o644) };
-        assert_eq!(
-            rc,
-            0,
-            "mkfifo(2) failed: {}",
-            std::io::Error::last_os_error()
-        );
-    }
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_remove_reports_registration_residue_with_uninstall_remedy() {
-        // A wired project whose machine-local `.bundle/plugin/index` cannot
-        // be read (a FIFO squatting there — the deterministic stand-in for
-        // any unreadable index). The unwire itself succeeds, and the
-        // registration residue must surface as a `gem_plugin_registration`
-        // files[] Error naming the index path and the
-        // `bundler plugin uninstall socket-patch` remedy — the user-facing
-        // recovery messaging for the "bundle install warns forever" trap.
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        let gemfile = root.join("Gemfile");
-        // Write the wired Gemfile directly (remove is never version-gated,
-        // so no lockfile pin is needed and no `bundle` probe ever runs).
-        fs::write(&gemfile, gemfile_add(GEMFILE).unwrap())
-            .await
-            .unwrap();
-        let project = super::super::discover_bundler_project(root).await.unwrap();
-        let index = root.join(".bundle").join("plugin").join("index");
-        fs::create_dir_all(index.parent().unwrap()).await.unwrap();
-        mkfifo(&index);
-
-        // On timeout the open is wedged in a `spawn_blocking` thread that the
-        // runtime waits for on shutdown; connect a writer to release it so
-        // the test can FAIL instead of hanging the whole suite.
-        let deadline = std::time::Duration::from_secs(5);
-        let Ok(results) =
-            tokio::time::timeout(deadline, remove_plugin_directive_at(&project, None, false)).await
-        else {
-            let _ = std::fs::OpenOptions::new().write(true).open(&index);
-            panic!("remove must complete promptly with a FIFO index");
-        };
-
-        assert!(
-            results
-                .iter()
-                .any(|r| r.kind == "gemfile" && r.status == GemSetupStatus::Updated),
-            "the unwire itself succeeded: {results:?}"
-        );
-        assert_eq!(
-            fs::read_to_string(&gemfile).await.unwrap(),
-            GEMFILE,
-            "the Gemfile is restored despite the registration residue"
-        );
-        let residue = results
-            .iter()
-            .find(|r| r.kind == "gem_plugin_registration")
-            .expect("the registration residue must be reported as its own entry");
-        assert_eq!(residue.status, GemSetupStatus::Error, "{residue:?}");
-        assert_eq!(residue.path, index.display().to_string());
-        let msg = residue.error.as_deref().unwrap_or_default();
-        assert!(
-            msg.contains("bundler plugin uninstall socket-patch"),
-            "the error must hand the user the uninstall remedy: {msg:?}"
-        );
-        assert!(
-            msg.contains(&index.display().to_string()),
-            "the error must name the index it could not clear: {msg:?}"
-        );
-        assert!(
-            std::fs::symlink_metadata(&index).is_ok(),
-            "the unreadable index must survive untouched"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_full_roundtrip_via_project() {
-        let dir = tempfile::tempdir().unwrap();
-        let root = dir.path();
-        let project = supported_project(root).await;
-
-        let added = add_plugin_directive(&project, false).await;
-        assert!(added.iter().all(|r| r.status == GemSetupStatus::Updated));
-        assert!(is_plugin_directive_present(
-            &fs::read_to_string(root.join("Gemfile")).await.unwrap()
-        ));
-        assert!(super::super::plugin_files_present(root).await);
-
-        // Idempotent re-run.
-        let again = add_plugin_directive(&project, false).await;
-        assert!(again
-            .iter()
-            .all(|r| r.status == GemSetupStatus::AlreadyConfigured));
-
-        let removed = remove_plugin_directive_at(&project, None, false).await;
-        assert!(removed.iter().all(|r| r.status == GemSetupStatus::Updated));
-        assert_eq!(
-            fs::read_to_string(root.join("Gemfile")).await.unwrap(),
-            GEMFILE,
-            "Gemfile restored byte-for-byte"
-        );
-        assert!(!super::super::plugin_files_present(root).await);
-    }
-}
diff --git a/crates/socket-patch-core/src/setup/gem/version.rs b/crates/socket-patch-core/src/setup/gem/version.rs
deleted file mode 100644
index 61b196cd..00000000
--- a/crates/socket-patch-core/src/setup/gem/version.rs
+++ /dev/null
@@ -1,427 +0,0 @@
-//! Bundler version floor for the generated plugin wiring.
-//!
-//! The `plugin "socket-patch", path: ...` directive `setup` writes needs
-//! bundler >= 2.2. Bundler 1.x cannot load it: `Plugin::DSL` undef_methods
-//! `:path` and the 1.x plugin installer supports only git/rubygems sources,
-//! so the directive is resolved as an ORDINARY GEM and every later
-//! `bundle install` dies with exit 7 ("Could not find gem 'socket-patch'
-//! ...") BEFORE plugin registration — an error that never names
-//! socket-patch, and in deployment mode adds a misleading "Perhaps the
-//! lockfile is corrupted?" line (reproduced on bundler 1.17.3). Wiring such
-//! a project is strictly worse than refusing.
-//!
-//! The probe reads, in order:
-//!   1. the lock's `BUNDLED WITH` section (`Gemfile.lock`, or `gems.locked`
-//!      for a `gems.rb` project) — deterministic, present even where
-//!      `bundle` is not on PATH, and the best predictor of the bundler that
-//!      will actually run installs (RubyGems' version switching selects the
-//!      locked bundler when installed; bundler >= 2.3 auto-installs it);
-//!   2. `bundle --version` in the project root — the machine's bundler,
-//!      for lock-less projects. Bundler 4 dropped the "Bundler version "
-//!      prefix and prints the bare version, so both spellings parse.
-//!
-//! When NEITHER source yields a version the probe reports [`BundlerProbe::
-//! Unknown`] and callers fail OPEN (wire as before): a machine without
-//! bundler may be preparing a repo whose CI has a modern bundler, and
-//! refusing there would block every such setup on a guess.
-
-use std::path::PathBuf;
-use std::time::Duration;
-
-use super::BundlerProject;
-
-/// Upper bound on the `bundle --version` fallback probe. A wedged bundler
-/// (broken RubyGems install, hung shim) must degrade to [`BundlerProbe::
-/// Unknown`] — fail open — rather than hang `setup`/`setup --check` forever.
-const BUNDLE_VERSION_TIMEOUT: Duration = Duration::from_secs(10);
-
-/// Minimum bundler `(major, minor)` able to load a `plugin ... path:`
-/// directive.
-pub const MIN_BUNDLER: (u64, u64) = (2, 2);
-
-/// Outcome of probing the project's bundler version.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum BundlerProbe {
-    /// A version at or above [`MIN_BUNDLER`] was detected.
-    Supported,
-    /// A version below [`MIN_BUNDLER`] was detected. `version` is the
-    /// detected version string; `source` names where it was read from
-    /// (for the refusal message).
-    Unsupported { version: String, source: String },
-    /// No version could be determined (no lock, no `bundle` on PATH, or
-    /// unparseable output). Callers fail open.
-    Unknown,
-}
-
-/// The lockfile paired with the project's manifest name: `gems.rb` locks to
-/// `gems.locked`, `Gemfile` to `Gemfile.lock` (Bundler's own pairing).
-fn lockfile_path(project: &BundlerProject) -> PathBuf {
-    let lock_name = match project.gemfile.file_name().and_then(|n| n.to_str()) {
-        Some("gems.rb") => "gems.locked",
-        _ => "Gemfile.lock",
-    };
-    project.root.join(lock_name)
-}
-
-/// Extract the version under a lock's `BUNDLED WITH` section: the first
-/// non-empty line after the header, trimmed.
-fn parse_bundled_with(lock: &str) -> Option<String> {
-    let mut lines = lock.lines();
-    while let Some(line) = lines.next() {
-        if line.trim() != "BUNDLED WITH" {
-            continue;
-        }
-        for candidate in lines.by_ref() {
-            let candidate = candidate.trim();
-            if !candidate.is_empty() {
-                return looks_like_version(candidate).then(|| candidate.to_string());
-            }
-        }
-        return None;
-    }
-    None
-}
-
-/// Extract a version from `bundle --version` output. Bundler <= 3 prints
-/// "Bundler version 2.7.2"; bundler 4 prints the bare "4.0.18". Take the
-/// first whitespace token that parses as a dotted version.
-fn parse_bundle_version_output(out: &str) -> Option<String> {
-    out.split_whitespace()
-        .find(|tok| looks_like_version(tok))
-        .map(str::to_string)
-}
-
-/// A token counts as a version when it is `digits.digits[...]` — enough to
-/// reject prose without a full semver parser.
-fn looks_like_version(tok: &str) -> bool {
-    let mut parts = tok.split('.');
-    let (Some(major), Some(minor)) = (parts.next(), parts.next()) else {
-        return false;
-    };
-    !major.is_empty()
-        && major.bytes().all(|b| b.is_ascii_digit())
-        && !minor.is_empty()
-        && minor.bytes().all(|b| b.is_ascii_digit())
-}
-
-/// Whether `version` (a `major.minor[...]` string) meets [`MIN_BUNDLER`].
-/// `None` when the leading components don't parse.
-fn meets_floor(version: &str) -> Option<bool> {
-    let mut parts = version.split('.');
-    let major: u64 = parts.next()?.parse().ok()?;
-    let minor: u64 = parts.next()?.parse().ok()?;
-    Some((major, minor) >= MIN_BUNDLER)
-}
-
-/// Classify one detected `(version, source)` pair.
-fn classify(version: String, source: String) -> BundlerProbe {
-    match meets_floor(&version) {
-        Some(true) => BundlerProbe::Supported,
-        Some(false) => BundlerProbe::Unsupported { version, source },
-        // Unparseable leading components: treat as unknown, fail open.
-        None => BundlerProbe::Unknown,
-    }
-}
-
-/// Probe the bundler version that will run this project's installs. See the
-/// module docs for the source order and the fail-open contract.
-pub async fn probe_bundler(project: &BundlerProject) -> BundlerProbe {
-    probe_bundler_with(project, probe_machine_bundler(project)).await
-}
-
-/// Keep the machine fallback lazy and injectable without changing process-wide
-/// PATH. The lockfile always wins, even when the fallback would disagree.
-async fn probe_bundler_with(
-    project: &BundlerProject,
-    machine_version: impl std::future::Future<Output = Option<String>>,
-) -> BundlerProbe {
-    let lock_path = lockfile_path(project);
-    // Guarded read: a FIFO/device squatting on the lock path must fail fast
-    // to the `bundle --version` fallback, not wedge `setup`/`--check`
-    // forever in `open(2)` — same guard as every other raw read in this
-    // module tree.
-    if let Ok(lock) = crate::utils::fs::read_regular_to_string(&lock_path).await {
-        if let Some(version) = parse_bundled_with(&lock) {
-            let lock_name = lock_path
-                .file_name()
-                .map(|n| n.to_string_lossy().into_owned())
-                .unwrap_or_else(|| "Gemfile.lock".to_string());
-            return classify(version, format!("{lock_name} BUNDLED WITH"));
-        }
-    }
-    match machine_version.await {
-        Some(version) => classify(version, "`bundle --version`".to_string()),
-        None => BundlerProbe::Unknown,
-    }
-}
-
-async fn probe_machine_bundler(project: &BundlerProject) -> Option<String> {
-    // No lock (or no BUNDLED WITH): ask the machine's bundler. stdin nulled
-    // so the child can never block waiting for input; bounded by
-    // [`BUNDLE_VERSION_TIMEOUT`] (with `kill_on_drop` so a timed-out child is
-    // reaped, not leaked) so a wedged bundler degrades to `Unknown`.
-    let output = tokio::time::timeout(
-        BUNDLE_VERSION_TIMEOUT,
-        tokio::process::Command::new("bundle")
-            .arg("--version")
-            .current_dir(&project.root)
-            .stdin(std::process::Stdio::null())
-            .kill_on_drop(true)
-            .output(),
-    )
-    .await;
-    if let Ok(Ok(out)) = output {
-        if out.status.success() {
-            return parse_bundle_version_output(&String::from_utf8_lossy(&out.stdout));
-        }
-    }
-    None
-}
-
-/// The refusal message for an [`BundlerProbe::Unsupported`] project — shared
-/// by `setup` (which refuses to wire) so the wording stays consistent.
-pub fn unsupported_bundler_message(version: &str, source: &str) -> String {
-    format!(
-        "bundler {version} (from {source}) cannot load the socket-patch Bundler \
-         plugin: the `plugin ... path:` directive needs bundler >= {}.{}, and on \
-         1.x every later `bundle install` fails resolving 'socket-patch' as an \
-         ordinary gem (exit 7) before the plugin registers. Not wiring this \
-         project. Upgrade bundler (`gem install bundler`, then `bundle update \
-         --bundler`) and re-run `socket-patch setup`",
-        MIN_BUNDLER.0, MIN_BUNDLER.1
-    )
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use tokio::fs;
-
-    #[cfg(unix)]
-    fn mkfifo(path: &std::path::Path) {
-        use std::os::unix::ffi::OsStrExt;
-        let c_path =
-            std::ffi::CString::new(path.as_os_str().as_bytes()).expect("fifo path has no NUL");
-        let rc = unsafe { libc::mkfifo(c_path.as_ptr(), 0o644) };
-        assert_eq!(
-            rc,
-            0,
-            "mkfifo(2) failed: {}",
-            std::io::Error::last_os_error()
-        );
-    }
-
-    const LOCK_1X: &str = "GEM\n  remote: https://rubygems.org/\n  specs:\n    \
-                           colorize (1.1.0)\n\nPLATFORMS\n  ruby\n\nDEPENDENCIES\n  \
-                           colorize (= 1.1.0)\n\nBUNDLED WITH\n   1.17.3\n";
-
-    async fn project_with(files: &[(&str, &str)]) -> (tempfile::TempDir, BundlerProject) {
-        let dir = tempfile::tempdir().unwrap();
-        for (name, body) in files {
-            fs::write(dir.path().join(name), body).await.unwrap();
-        }
-        let project = super::super::discover_bundler_project(dir.path())
-            .await
-            .expect("fixture project must be discoverable");
-        (dir, project)
-    }
-
-    #[test]
-    fn test_parse_bundled_with() {
-        assert_eq!(parse_bundled_with(LOCK_1X).as_deref(), Some("1.17.3"));
-        assert_eq!(
-            parse_bundled_with("BUNDLED WITH\n   2.7.2\n").as_deref(),
-            Some("2.7.2")
-        );
-        // Blank line(s) between the header and the version are skipped: the
-        // section yields the first NON-EMPTY line, not the first line.
-        assert_eq!(
-            parse_bundled_with("BUNDLED WITH\n\n   2.7.2\n").as_deref(),
-            Some("2.7.2")
-        );
-        // No section, or a section followed by garbage → None.
-        assert_eq!(parse_bundled_with("GEM\n  specs:\n"), None);
-        assert_eq!(parse_bundled_with("BUNDLED WITH\n   not-a-version\n"), None);
-        assert_eq!(parse_bundled_with("BUNDLED WITH\n"), None);
-    }
-
-    #[test]
-    fn test_parse_bundle_version_output_both_spellings() {
-        // bundler <= 3 prefix form and bundler 4's bare form.
-        assert_eq!(
-            parse_bundle_version_output("Bundler version 2.7.2\n").as_deref(),
-            Some("2.7.2")
-        );
-        assert_eq!(
-            parse_bundle_version_output("4.0.18\n").as_deref(),
-            Some("4.0.18")
-        );
-        assert_eq!(parse_bundle_version_output("command not found\n"), None);
-    }
-
-    #[test]
-    fn test_meets_floor_boundaries() {
-        assert_eq!(meets_floor("1.17.3"), Some(false));
-        assert_eq!(meets_floor("2.1.4"), Some(false));
-        assert_eq!(meets_floor("2.2.0"), Some(true));
-        assert_eq!(meets_floor("2.7.2"), Some(true));
-        assert_eq!(meets_floor("4.0.18"), Some(true));
-        // Bare major (no minor) or garbage: unknown, never a refusal.
-        assert_eq!(meets_floor("2"), None);
-        assert_eq!(meets_floor("abc"), None);
-        // Digits-only components that overflow u64 also fail to parse —
-        // the only way a `looks_like_version` token reaches `classify`'s
-        // fail-open arm.
-        assert_eq!(meets_floor("99999999999999999999.1"), None);
-    }
-
-    #[tokio::test]
-    async fn test_probe_reads_gemfile_lock_bundled_with() {
-        let (_dir, project) =
-            project_with(&[("Gemfile", "source 'x'\n"), ("Gemfile.lock", LOCK_1X)]).await;
-        assert_eq!(
-            probe_bundler(&project).await,
-            BundlerProbe::Unsupported {
-                version: "1.17.3".to_string(),
-                source: "Gemfile.lock BUNDLED WITH".to_string(),
-            }
-        );
-    }
-
-    #[tokio::test]
-    async fn test_probe_supported_lock() {
-        let (_dir, project) = project_with(&[
-            ("Gemfile", "source 'x'\n"),
-            ("Gemfile.lock", "BUNDLED WITH\n   2.7.2\n"),
-        ])
-        .await;
-        assert_eq!(probe_bundler(&project).await, BundlerProbe::Supported);
-    }
-
-    #[tokio::test]
-    async fn test_probe_gems_rb_pairs_with_gems_locked() {
-        // A gems.rb project locks to gems.locked — a stray Gemfile.lock (from
-        // before a rename) must NOT be consulted for it.
-        let (_dir, project) = project_with(&[
-            ("gems.rb", "source 'x'\n"),
-            ("gems.locked", LOCK_1X),
-            ("Gemfile.lock", "BUNDLED WITH\n   2.7.2\n"),
-        ])
-        .await;
-        assert_eq!(
-            probe_bundler(&project).await,
-            BundlerProbe::Unsupported {
-                version: "1.17.3".to_string(),
-                source: "gems.locked BUNDLED WITH".to_string(),
-            }
-        );
-    }
-
-    #[tokio::test]
-    async fn test_probe_lock_beats_machine_bundler() {
-        // With a lock present the machine's `bundle --version` is never
-        // consulted: RubyGems' version switching makes the LOCKED bundler the
-        // one that runs installs. (This also keeps the probe deterministic on
-        // hosts whose bundler differs from the project's.)
-        let (_dir, project) = project_with(&[
-            ("Gemfile", "source 'x'\n"),
-            ("Gemfile.lock", "BUNDLED WITH\n   1.17.3\n"),
-        ])
-        .await;
-        // The fallback must not even be polled when the lock has a version.
-        assert!(matches!(
-            probe_bundler_with(&project, async { panic!("lock must bypass machine probe") }).await,
-            BundlerProbe::Unsupported { .. }
-        ));
-    }
-
-    #[tokio::test]
-    async fn test_probe_lock_overflow_version_is_unknown_fail_open() {
-        // A digits-only version whose major component overflows u64 gets past
-        // `looks_like_version` but not `meets_floor`: `classify` must fail
-        // OPEN (Unknown), never refuse. The lock branch answers directly —
-        // the machine's `bundle --version` is not consulted — so the verdict
-        // is deterministic on any host.
-        let (_dir, project) = project_with(&[
-            ("Gemfile", "source 'x'\n"),
-            ("Gemfile.lock", "BUNDLED WITH\n   99999999999999999999.1\n"),
-        ])
-        .await;
-        assert_eq!(probe_bundler(&project).await, BundlerProbe::Unknown);
-    }
-
-    #[tokio::test]
-    async fn test_probe_lock_without_bundled_with_falls_through_to_machine() {
-        // A readable lock with no BUNDLED WITH section (pre-1.10 bundler
-        // locks, hand-trimmed locks) must fall through to the machine's
-        // `bundle --version` probe — not classify the sectionless lock.
-        let (_dir, project) = project_with(&[
-            ("Gemfile", "source 'x'\n"),
-            ("Gemfile.lock", "GEM\n  specs:\n"),
-        ])
-        .await;
-        // Every fallback outcome is valid, including old system Bundler.
-        // Inject it so this exercises the decision instead of the test host.
-        for (version, expected) in [
-            (Some("2.7.2"), BundlerProbe::Supported),
-            (
-                Some("1.17.2"),
-                BundlerProbe::Unsupported {
-                    version: "1.17.2".into(),
-                    source: "`bundle --version`".into(),
-                },
-            ),
-            (None, BundlerProbe::Unknown),
-        ] {
-            assert_eq!(
-                probe_bundler_with(&project, async { version.map(str::to_owned) }).await,
-                expected
-            );
-        }
-    }
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_probe_fifo_lockfile_does_not_wedge() {
-        // A FIFO squatting on Gemfile.lock: a plain `read_to_string`
-        // open(2) waits for a writer that never comes, wedging `setup`/
-        // `--check` (and every Gemfile-block update, which probes first)
-        // forever inside `probe_bundler`. Same class as the mod.rs
-        // `read_regular_to_string` guards; the probe must skip the
-        // non-regular lock and fall through to the `bundle --version`
-        // probe (itself bounded by [`BUNDLE_VERSION_TIMEOUT`]).
-        let dir = tempfile::tempdir().unwrap();
-        fs::write(dir.path().join("Gemfile"), "source 'x'\n")
-            .await
-            .unwrap();
-        mkfifo(&dir.path().join("Gemfile.lock"));
-        let project = super::super::discover_bundler_project(dir.path())
-            .await
-            .expect("fixture project must be discoverable");
-
-        // Inject a prompt machine reply so this tests only the guarded
-        // lockfile read. On timeout the open is wedged in
-        // a `spawn_blocking` thread the runtime waits for on shutdown;
-        // connect a writer to release it so the test can FAIL instead of
-        // hanging the whole suite.
-        let deadline = Duration::from_secs(5);
-        let probe = probe_bundler_with(&project, async { Some("2.7.2".to_string()) });
-        let Ok(probe) = tokio::time::timeout(deadline, probe).await else {
-            let _ = std::fs::OpenOptions::new()
-                .write(true)
-                .open(dir.path().join("Gemfile.lock"));
-            panic!("probe_bundler must complete promptly with a FIFO lockfile");
-        };
-        // The FIFO has no bytes to parse; the supplied machine reply wins.
-        assert_eq!(probe, BundlerProbe::Supported);
-    }
-
-    #[test]
-    fn test_unsupported_message_names_version_floor_and_remedy() {
-        let msg = unsupported_bundler_message("1.17.3", "Gemfile.lock BUNDLED WITH");
-        assert!(msg.contains("1.17.3"));
-        assert!(msg.contains(">= 2.2"));
-        assert!(msg.contains("gem install bundler"));
-        assert!(msg.contains("socket-patch setup"));
-    }
-}
diff --git a/crates/socket-patch-core/src/setup/mod.rs b/crates/socket-patch-core/src/setup/mod.rs
deleted file mode 100644
index 96f9787a..00000000
--- a/crates/socket-patch-core/src/setup/mod.rs
+++ /dev/null
@@ -1,20 +0,0 @@
-//! Per-ecosystem `setup` backends: the code that wires (and unwires) each
-//! ecosystem's auto-re-apply hook into a user's project, consumed by the
-//! CLI's `setup` command.
-//!
-//! The backends:
-//!
-//! * [`gem`] — Bundler plugin directive in the Gemfile + generated plugin
-//!   gem, re-applying gem patches on `bundle install`.
-//! * [`composer`] — post-install hook in `composer.json`.
-//! * [`pypi`] — the `socket-patch[hook]` dependency whose `.pth` wheel
-//!   re-applies pypi patches at interpreter startup.
-//! * [`npm`] — a thin alias: the npm backend's real home is
-//!   [`crate::package_json`], which stays top-level because it doubles as
-//!   the crate-wide shared npm-manifest library (crawlers and vendor read
-//!   package.json through it too).
-
-pub mod composer;
-pub mod gem;
-pub mod npm;
-pub mod pypi;
diff --git a/crates/socket-patch-core/src/setup/npm.rs b/crates/socket-patch-core/src/setup/npm.rs
deleted file mode 100644
index 7ba4dd16..00000000
--- a/crates/socket-patch-core/src/setup/npm.rs
+++ /dev/null
@@ -1,10 +0,0 @@
-//! The npm setup backend, by alias.
-//!
-//! npm's hook wiring lives in [`crate::package_json`] — that module stays
-//! top-level because it is also the crate-wide shared npm-manifest library
-//! (crawlers and vendor parse package.json through it). This alias exists so
-//! `setup::*` enumerates every ecosystem backend in one place.
-
-pub use crate::package_json::detect::{is_setup_configured_str, PackageManager};
-pub use crate::package_json::find::{detect_package_manager, find_package_json_files};
-pub use crate::package_json::update::{remove_package_json, update_package_json};
diff --git a/crates/socket-patch-core/src/setup/pypi/detect.rs b/crates/socket-patch-core/src/setup/pypi/detect.rs
deleted file mode 100644
index f756b898..00000000
--- a/crates/socket-patch-core/src/setup/pypi/detect.rs
+++ /dev/null
@@ -1,429 +0,0 @@
-//! Detect a Python project's dependency manager and probe for the hook dep.
-
-use std::path::Path;
-
-use crate::utils::fs::read_regular_to_string;
-use crate::utils::toml_edit_ext::has_table;
-
-/// The dependency `setup` adds (PEP 508 form, used for `requirements.txt` and
-/// PEP 621 `[project].dependencies`): the `socket-patch[hook]` extra, which
-/// pulls both the socket-patch CLI and the socket-patch-hook wheel (the `.pth`
-/// carrier). A single, familiar line. Classic Poetry can't express an extra as
-/// a bare key, so [`super::edit`] emits the equivalent
-/// `socket-patch = { extras = ["hook"] }` there instead.
-pub(crate) const HOOK_DEP: &str = "socket-patch[hook]";
-
-/// Substrings (space-insensitive, lower-cased) that mean the hook is already
-/// declared — the `socket-patch[hook]` extra, the standalone wheel, or the
-/// underscore spelling. (The Poetry `extras = ["hook"]` form is detected
-/// structurally by [`super::edit`], not by this textual check.)
-const HOOK_MARKERS: &[&str] = &[
-    "socket-patch[hook]",
-    "socket-patch-hook",
-    "socket_patch_hook",
-];
-
-/// Which Python dependency-management style a project uses. Drives both which
-/// manifest/table `setup` edits and which lockfile (if any) to refresh.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum PythonPackageManager {
-    Uv,
-    Poetry,
-    Pdm,
-    Hatch,
-    Pip,
-}
-
-impl PythonPackageManager {
-    pub fn as_str(&self) -> &'static str {
-        match self {
-            Self::Uv => "uv",
-            Self::Poetry => "poetry",
-            Self::Pdm => "pdm",
-            Self::Hatch => "hatch",
-            Self::Pip => "pip",
-        }
-    }
-
-    /// The lockfile-refresh invocations `(program, spellings)` for managers
-    /// whose frozen CI install reads a lockfile that must be regenerated
-    /// after editing the dependency list. Each arg-list is tried in order
-    /// until one succeeds: the first is the pin-preserving spelling where
-    /// the tool has a distinct one (`poetry lock --no-update` on Poetry 1.x —
-    /// bare `poetry lock` re-resolves the user's whole pinned set there;
-    /// `pdm lock --update-reuse`), the last is the bare `lock` accepted
-    /// everywhere (already pin-preserving on Poetry 2.x, where `--no-update`
-    /// was removed, and on uv). `None` for managers that resolve dependencies
-    /// directly from the manifest at install time (pip, hatch).
-    pub fn lock_commands(&self) -> Option<(&'static str, &'static [&'static [&'static str]])> {
-        match self {
-            Self::Uv => Some(("uv", &[&["lock"]])),
-            Self::Poetry => Some(("poetry", &[&["lock", "--no-update"], &["lock"]])),
-            Self::Pdm => Some(("pdm", &[&["lock", "--update-reuse"], &["lock"]])),
-            Self::Hatch | Self::Pip => None,
-        }
-    }
-}
-
-/// Detect the dependency manager from lockfiles and `pyproject.toml` tables.
-///
-/// Lockfiles are the strongest signal; `[tool.*]` tables come next; a project
-/// with only `requirements.txt` / a PEP 621 `pyproject.toml` falls through to
-/// `Pip`.
-pub async fn detect_python_pm(cwd: &Path) -> PythonPackageManager {
-    if tokio::fs::metadata(cwd.join("uv.lock")).await.is_ok() {
-        return PythonPackageManager::Uv;
-    }
-    if tokio::fs::metadata(cwd.join("pdm.lock")).await.is_ok() {
-        return PythonPackageManager::Pdm;
-    }
-    if tokio::fs::metadata(cwd.join("poetry.lock")).await.is_ok() {
-        return PythonPackageManager::Poetry;
-    }
-    // Guarded read (shared with the gem/composer/npm setup twins): a FIFO
-    // planted at `pyproject.toml` fails fast to the `Pip` fallback instead of
-    // wedging `setup`/`--check` forever in an `open(2)` that waits for a
-    // writer — the `is_python_project` gate ahead of detection is
-    // metadata-only and does not filter these.
-    if let Ok(content) = read_regular_to_string(&cwd.join("pyproject.toml")).await {
-        // Header-anchored checks so a stray substring in a value/comment does
-        // not misclassify.
-        if has_table(&content, "tool.uv") {
-            return PythonPackageManager::Uv;
-        }
-        if has_table(&content, "tool.poetry") {
-            return PythonPackageManager::Poetry;
-        }
-        if has_table(&content, "tool.pdm") {
-            return PythonPackageManager::Pdm;
-        }
-        if has_table(&content, "tool.hatch") {
-            return PythonPackageManager::Hatch;
-        }
-    }
-    PythonPackageManager::Pip
-}
-
-/// True if the given manifest text already declares the hook dependency, in any
-/// form. Space- and case-insensitive so `socket-patch [hook]` / `Socket-Patch`
-/// are recognised.
-pub fn deps_contain_hook(text: &str) -> bool {
-    // Normalize per line: drop intra-line whitespace so `socket-patch [hook]`
-    // matches, but keep line boundaries intact. Stripping newlines too would
-    // glue adjacent specs together (this is called on whole-file content by
-    // `setup`'s state probe), turning a trailing `socket-patch` plus a following
-    // `[hook]` into a phantom marker — a false positive.
-    text.lines().any(|line| {
-        // Drop a `#` comment first (requirements.txt and TOML both comment
-        // with `#`): a commented-out `# socket-patch[hook]` declares nothing —
-        // pip never installs it — and a marker mentioned inside a trailing
-        // comment must not read as configured.
-        let spec = match line.find('#') {
-            Some(i) => &line[..i],
-            None => line,
-        };
-        let normalized: String = spec
-            .to_lowercase()
-            .chars()
-            .filter(|c| !c.is_whitespace())
-            .collect();
-        if HOOK_MARKERS.iter().any(|m| normalized.contains(*m)) {
-            return true;
-        }
-        // PEP 503 makes `-`/`_`/`.` interchangeable in package names and PEP
-        // 508 lets the hook extra ride with others (`socket-patch[cli,hook]`),
-        // so pip installs the hook from spellings the markers above miss
-        // (`socket_patch[hook]`). Canonicalize and probe for the wheel name or
-        // a `socket-patch[...]` extras list containing `hook`.
-        let canon: String = normalized
-            .chars()
-            .map(|c| if c == '_' || c == '.' { '-' } else { c })
-            .collect();
-        if canon.contains("socket-patch-hook") {
-            return true;
-        }
-        canon.match_indices("socket-patch[").any(|(i, m)| {
-            let rest = &canon[i + m.len()..];
-            match rest.find(']') {
-                Some(end) => rest[..end].split(',').any(|e| e == "hook"),
-                None => false,
-            }
-        })
-    })
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn test_deps_contain_hook_positive_forms() {
-        assert!(deps_contain_hook("socket-patch[hook]"));
-        assert!(deps_contain_hook("socket-patch [hook]"));
-        assert!(deps_contain_hook("Socket-Patch[hook]>=3.3.0"));
-        assert!(deps_contain_hook("socket-patch-hook==3.3.0"));
-        assert!(deps_contain_hook("socket_patch_hook"));
-    }
-
-    #[test]
-    fn test_deps_contain_hook_pep503_and_combined_extras() {
-        // PEP 503: `-`, `_`, `.` are interchangeable in the name — pip
-        // installs the hook from all of these.
-        assert!(deps_contain_hook("socket_patch[hook]"));
-        assert!(deps_contain_hook("socket.patch[hook]==3.3.0"));
-        assert!(deps_contain_hook("Socket_Patch [hook]"));
-        assert!(deps_contain_hook("socket.patch_hook"));
-        // PEP 508: the hook extra combined with others still declares it.
-        assert!(deps_contain_hook("socket-patch[cli,hook]>=3.3.0"));
-        assert!(deps_contain_hook("socket-patch[ hook , cli ]"));
-        assert!(deps_contain_hook("socket_patch[cli,hook]"));
-        // Some other extra alone is NOT the hook, `hooky` is a different
-        // extra, and an unterminated bracket is not a spec.
-        assert!(!deps_contain_hook("socket_patch[cli]"));
-        assert!(!deps_contain_hook("socket-patch[hooky]"));
-        assert!(!deps_contain_hook("socket-patch[hook"));
-    }
-
-    #[test]
-    fn test_deps_contain_hook_negative() {
-        // A plain socket-patch dependency is NOT the hook.
-        assert!(!deps_contain_hook("socket-patch>=3.3.0"));
-        assert!(!deps_contain_hook("requests==2.31.0"));
-        assert!(!deps_contain_hook(""));
-    }
-
-    #[test]
-    fn test_deps_contain_hook_no_cross_line_glue() {
-        // `deps_contain_hook` is run on whole-file content by the setup state
-        // probe. Two unrelated specs on adjacent lines must NOT be glued into
-        // a phantom `socket-patch[hook]` marker.
-        let requirements = "socket-patch\n[hook]\nrequests\n";
-        assert!(!deps_contain_hook(requirements));
-
-        // A wrapped TOML dependency array around a plain socket-patch dep also
-        // must not synthesize the marker across line breaks.
-        let pyproject = "dependencies = [\n  \"socket-patch\",\n]\nextras = [\"hook\"]\n";
-        assert!(!deps_contain_hook(pyproject));
-    }
-
-    #[test]
-    fn test_deps_contain_hook_real_marker_in_multiline() {
-        // The genuine hook spec on its own line within whole-file content is
-        // still detected (intra-line spaces tolerated).
-        let requirements = "requests==2.31.0\nsocket-patch [hook]\nflask\n";
-        assert!(deps_contain_hook(requirements));
-        let pyproject = "dependencies = [\n  \"requests\",\n  \"socket-patch[hook]>=3.3.0\",\n]\n";
-        assert!(deps_contain_hook(pyproject));
-    }
-
-    #[test]
-    fn test_deps_contain_hook_commented_out_is_not_declared() {
-        // A commented-out spec declares nothing: pip never installs it, and
-        // the edit path (`requirements_add` strips comments before probing)
-        // would still add the hook — so the state probe / `setup --check`
-        // must not read it as configured.
-        assert!(!deps_contain_hook(
-            "# socket-patch[hook]\nrequests==2.31.0\n"
-        ));
-        // A marker mentioned inside another dep's trailing comment is not a
-        // declaration either.
-        assert!(!deps_contain_hook(
-            "requests==2.31.0  # TODO: add socket-patch[hook]\n"
-        ));
-        // But a real spec WITH a trailing comment is still declared.
-        assert!(deps_contain_hook(
-            "socket-patch[hook]  # the .pth carrier\n"
-        ));
-    }
-
-    #[test]
-    fn test_has_table() {
-        let toml = "[tool.poetry]\nname='x'\n[tool.poetry.dependencies]\n";
-        assert!(has_table(toml, "tool.poetry"));
-        assert!(!has_table(toml, "tool.pdm"));
-        assert!(has_table("[project]\n", "project"));
-        // not fooled by a value that contains the text
-        assert!(!has_table("name = \"tool.poetry helper\"\n", "tool.poetry"));
-    }
-
-    #[test]
-    fn test_has_table_trailing_comment_and_padding() {
-        // A trailing inline comment after the header is valid TOML and must
-        // not defeat detection (`trim_end_matches(']')` alone would leave the
-        // comment glued to the header).
-        assert!(has_table("[tool.uv] # the uv table\n", "tool.uv"));
-        assert!(has_table("[tool.uv.sources]  # comment\n", "tool.uv"));
-        // Interior padding inside the brackets is also valid TOML.
-        assert!(has_table("[ tool.pdm ]\n", "tool.pdm"));
-        // Array-of-tables form, with a comment, still resolves the namespace.
-        assert!(has_table("[[tool.poetry.source]] # extra\n", "tool.poetry"));
-        // A sibling prefix must still not match (no spurious widening).
-        assert!(!has_table("[tool.uvicorn] # web\n", "tool.uv"));
-    }
-
-    #[tokio::test]
-    async fn test_detect_uv_by_lock() {
-        let dir = tempfile::tempdir().unwrap();
-        tokio::fs::write(dir.path().join("uv.lock"), "")
-            .await
-            .unwrap();
-        assert_eq!(detect_python_pm(dir.path()).await, PythonPackageManager::Uv);
-    }
-
-    #[tokio::test]
-    async fn test_detect_poetry_by_table() {
-        let dir = tempfile::tempdir().unwrap();
-        tokio::fs::write(
-            dir.path().join("pyproject.toml"),
-            "[tool.poetry]\nname = \"x\"\n",
-        )
-        .await
-        .unwrap();
-        assert_eq!(
-            detect_python_pm(dir.path()).await,
-            PythonPackageManager::Poetry
-        );
-    }
-
-    /// mkfifo(2) directly rather than shelling out to the `mkfifo` binary —
-    /// same helper as the find.rs FIFO tests: fork/exec flakes under heavy
-    /// parallel load and the syscall needs no process at all.
-    #[cfg(unix)]
-    fn mkfifo(path: &Path) {
-        use std::os::unix::ffi::OsStrExt;
-        let c_path =
-            std::ffi::CString::new(path.as_os_str().as_bytes()).expect("fifo path has no NUL");
-        let rc = unsafe { libc::mkfifo(c_path.as_ptr(), 0o644) };
-        assert_eq!(
-            rc,
-            0,
-            "mkfifo(2) failed: {}",
-            std::io::Error::last_os_error()
-        );
-    }
-
-    /// A FIFO planted as `pyproject.toml` must not wedge detection. The
-    /// `is_python_project` gate ahead of `detect_python_pm` is metadata-only
-    /// (a FIFO stats fine), so a plain `read_to_string` open(2) here waits
-    /// for a writer that never comes, wedging `setup`/`--check` and the
-    /// configured-ecosystems probe indefinitely with no error and no
-    /// timeout. Same class as the `open_regular_file` guards in the
-    /// npm/composer/gem setup twins and the crawlers. The non-regular file
-    /// must instead fail fast to the `Pip` fallback.
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_detect_fifo_pyproject_does_not_wedge() {
-        let dir = tempfile::tempdir().unwrap();
-        let fifo = dir.path().join("pyproject.toml");
-        mkfifo(&fifo);
-
-        // On timeout the open is wedged in a `spawn_blocking` thread that
-        // the runtime waits for on shutdown; connect a writer to release
-        // it so the test can FAIL instead of hanging the whole suite.
-        let deadline = std::time::Duration::from_secs(5);
-        let Ok(pm) = tokio::time::timeout(deadline, detect_python_pm(dir.path())).await else {
-            let _ = std::fs::OpenOptions::new().write(true).open(&fifo);
-            panic!("detect_python_pm must complete promptly with a FIFO pyproject.toml");
-        };
-        assert_eq!(pm, PythonPackageManager::Pip);
-    }
-
-    #[tokio::test]
-    async fn test_detect_uv_by_tool_table() {
-        // A uv-configured project before its first `uv lock`: no uv.lock yet,
-        // only the `[tool.uv]` config table in pyproject.toml.
-        let dir = tempfile::tempdir().unwrap();
-        tokio::fs::write(
-            dir.path().join("pyproject.toml"),
-            "[project]\nname = \"x\"\n\n[tool.uv]\ndev-dependencies = []\n",
-        )
-        .await
-        .unwrap();
-        assert_eq!(detect_python_pm(dir.path()).await, PythonPackageManager::Uv);
-    }
-
-    #[tokio::test]
-    async fn test_detect_pdm_by_tool_table() {
-        // A PDM project pre-first-lock: `[tool.pdm]` table, no pdm.lock.
-        let dir = tempfile::tempdir().unwrap();
-        tokio::fs::write(
-            dir.path().join("pyproject.toml"),
-            "[project]\nname = \"x\"\n\n[tool.pdm]\ndistribution = true\n",
-        )
-        .await
-        .unwrap();
-        assert_eq!(
-            detect_python_pm(dir.path()).await,
-            PythonPackageManager::Pdm
-        );
-    }
-
-    #[tokio::test]
-    async fn test_detect_hatch_by_tool_subtable() {
-        // Real Hatch projects rarely declare a bare `[tool.hatch]` — config
-        // lives in sub-tables like `[tool.hatch.envs.default]`. Detection
-        // must resolve the namespace prefix (has_table), and Hatch never has
-        // a lockfile, so the table branch is the ONLY signal.
-        let dir = tempfile::tempdir().unwrap();
-        tokio::fs::write(
-            dir.path().join("pyproject.toml"),
-            "[project]\nname = \"x\"\n\n[tool.hatch.envs.default]\ndependencies = []\n",
-        )
-        .await
-        .unwrap();
-        let pm = detect_python_pm(dir.path()).await;
-        assert_eq!(pm, PythonPackageManager::Hatch);
-        // The detected manager is surfaced in the JSON envelope via as_str.
-        assert_eq!(pm.as_str(), "hatch");
-    }
-
-    #[tokio::test]
-    async fn test_detect_table_precedence_pdm_before_hatch() {
-        // Documents the uv > poetry > pdm > hatch table ordering: a project
-        // carrying BOTH `[tool.pdm]` and `[tool.hatch.*]` (e.g. hatchling as
-        // build backend, pdm as the workflow tool) resolves to Pdm.
-        let dir = tempfile::tempdir().unwrap();
-        tokio::fs::write(
-            dir.path().join("pyproject.toml"),
-            "[tool.pdm]\n\n[tool.hatch.envs.default]\ndependencies = []\n",
-        )
-        .await
-        .unwrap();
-        assert_eq!(
-            detect_python_pm(dir.path()).await,
-            PythonPackageManager::Pdm
-        );
-    }
-
-    #[tokio::test]
-    async fn test_detect_pip_fallback() {
-        let dir = tempfile::tempdir().unwrap();
-        tokio::fs::write(dir.path().join("requirements.txt"), "requests\n")
-            .await
-            .unwrap();
-        assert_eq!(
-            detect_python_pm(dir.path()).await,
-            PythonPackageManager::Pip
-        );
-    }
-
-    #[test]
-    fn test_lock_commands() {
-        assert_eq!(
-            PythonPackageManager::Uv.lock_commands(),
-            Some(("uv", &[&["lock"][..]][..]))
-        );
-        // Pin-preserving spelling first, bare `lock` fallback for versions
-        // that dropped the flag (Poetry 2.x).
-        assert_eq!(
-            PythonPackageManager::Poetry.lock_commands(),
-            Some(("poetry", &[&["lock", "--no-update"][..], &["lock"][..]][..]))
-        );
-        assert_eq!(
-            PythonPackageManager::Pdm.lock_commands(),
-            Some(("pdm", &[&["lock", "--update-reuse"][..], &["lock"][..]][..]))
-        );
-        assert_eq!(PythonPackageManager::Pip.lock_commands(), None);
-        assert_eq!(PythonPackageManager::Hatch.lock_commands(), None);
-    }
-}
diff --git a/crates/socket-patch-core/src/setup/pypi/edit.rs b/crates/socket-patch-core/src/setup/pypi/edit.rs
deleted file mode 100644
index 926dbc54..00000000
--- a/crates/socket-patch-core/src/setup/pypi/edit.rs
+++ /dev/null
@@ -1,1297 +0,0 @@
-//! Add / remove the `socket-patch[hook]` dependency in a project's manifest.
-//!
-//! Two manifest kinds are supported:
-//!   * **pyproject.toml** — edited with `toml_edit` so the user's existing
-//!     formatting and comments are preserved. Targets the PEP 621
-//!     `[project].dependencies` array, or a classic Poetry
-//!     `[tool.poetry.dependencies]` table when that is the only dependency
-//!     surface present.
-//!   * **requirements.txt** — a plain line append / removal.
-//!
-//! All operations are idempotent and honour `dry_run` (compute the result and
-//! report status without writing). This mirrors the contracts of
-//! [`crate::package_json::update`] for the npm side.
-
-use std::path::Path;
-use toml_edit::{Array, DocumentMut, InlineTable, Item, Table, Value};
-
-use super::detect::{deps_contain_hook, HOOK_DEP};
-// Guarded read shared with the detect.rs/gem/composer/npm setup twins: a
-// FIFO planted at `requirements.txt` / `pyproject.toml` fails fast to `Error`
-// instead of wedging `setup` / `setup --remove` forever in an `open(2)` that
-// waits for a writer — detection never opens the manifest it hands the edit
-// path (a lockfile routes here without a read, and the Pip fallback targets
-// `requirements.txt` sight-unseen).
-use crate::utils::fs::{atomic_write_bytes_preserving_mode, read_regular_to_string};
-use crate::utils::python_lock::preserve_line_endings;
-use crate::utils::toml_edit_ext::ensure_table;
-use crate::vendor::common::detect_eol;
-
-/// Which manifest format a path is.
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum ManifestKind {
-    Pyproject,
-    Requirements,
-}
-
-/// Outcome of editing one manifest. Mirrors `package_json::update::UpdateStatus`.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum PthStatus {
-    Updated,
-    AlreadyConfigured,
-    Error,
-}
-
-#[derive(Debug, Clone)]
-pub struct PthEditResult {
-    pub path: String,
-    pub status: PthStatus,
-    pub error: Option<String>,
-}
-
-impl PthEditResult {
-    fn ok(path: &Path, status: PthStatus) -> Self {
-        Self {
-            path: path.display().to_string(),
-            status,
-            error: None,
-        }
-    }
-    fn err(path: &Path, msg: impl Into<String>) -> Self {
-        Self {
-            path: path.display().to_string(),
-            status: PthStatus::Error,
-            error: Some(msg.into()),
-        }
-    }
-}
-
-/// Shared tail of add/remove: `None` means already in the desired state,
-/// `Some(new_content)` is written atomically (unless `dry_run`).
-async fn finish(
-    path: &Path,
-    dry_run: bool,
-    outcome: Result<Option<String>, String>,
-) -> PthEditResult {
-    match outcome {
-        Ok(None) => PthEditResult::ok(path, PthStatus::AlreadyConfigured),
-        Ok(Some(new_content)) => {
-            if !dry_run {
-                // Mode-preserving: these are user-owned manifests we merely
-                // edit; the plain writer's fresh stage inode would reset a
-                // 0600 pyproject.toml / requirements.txt to umask defaults.
-                if let Err(e) =
-                    atomic_write_bytes_preserving_mode(path, new_content.as_bytes()).await
-                {
-                    return PthEditResult::err(path, e.to_string());
-                }
-            }
-            PthEditResult::ok(path, PthStatus::Updated)
-        }
-        Err(e) => PthEditResult::err(path, e),
-    }
-}
-
-/// Add the hook dependency to a manifest. Idempotent.
-pub async fn add_hook_dependency(path: &Path, kind: ManifestKind, dry_run: bool) -> PthEditResult {
-    let content = match read_regular_to_string(path).await {
-        Ok(c) => c,
-        // A missing requirements.txt is created (the pip-from-scratch path);
-        // a missing pyproject.toml is an error (we don't synthesize one).
-        Err(e)
-            if e.kind() == std::io::ErrorKind::NotFound && kind == ManifestKind::Requirements =>
-        {
-            String::new()
-        }
-        Err(e) => return PthEditResult::err(path, e.to_string()),
-    };
-
-    let outcome = match kind {
-        ManifestKind::Pyproject => pyproject_add(&content),
-        ManifestKind::Requirements => Ok(requirements_add(&content)),
-    };
-    finish(path, dry_run, outcome).await
-}
-
-/// Remove the hook dependency from a manifest. Idempotent (already-absent ->
-/// `AlreadyConfigured`, i.e. nothing to do).
-pub async fn remove_hook_dependency(
-    path: &Path,
-    kind: ManifestKind,
-    dry_run: bool,
-) -> PthEditResult {
-    let content = match read_regular_to_string(path).await {
-        Ok(c) => c,
-        // Nothing on disk → nothing to remove (idempotent no-op).
-        Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
-            return PthEditResult::ok(path, PthStatus::AlreadyConfigured)
-        }
-        Err(e) => return PthEditResult::err(path, e.to_string()),
-    };
-
-    let outcome = match kind {
-        ManifestKind::Pyproject => pyproject_remove(&content),
-        ManifestKind::Requirements => Ok(requirements_remove(&content)),
-    };
-    finish(path, dry_run, outcome).await
-}
-
-// ── requirements.txt ────────────────────────────────────────────────────────
-// The dominant-newline probe (`detect_eol`) keeps CRLF files CRLF.
-
-/// Returns `Some(new_content)` if a line was appended, `None` if already there.
-fn requirements_add(content: &str) -> Option<String> {
-    if deps_contain_hook(content) {
-        return None;
-    }
-    let nl = detect_eol(content);
-    let mut new = content.to_string();
-    if !new.is_empty() && !new.ends_with('\n') {
-        new.push_str(nl);
-    }
-    new.push_str(HOOK_DEP);
-    new.push_str(nl);
-    Some(new)
-}
-
-/// Returns `Some(new_content)` if any hook line was removed, `None` otherwise.
-fn requirements_remove(content: &str) -> Option<String> {
-    let kept: Vec<&str> = content.lines().filter(|l| !deps_contain_hook(l)).collect();
-    if kept.len() == content.lines().count() {
-        return None;
-    }
-    let nl = detect_eol(content);
-    let mut new = kept.join(nl);
-    if !new.is_empty() {
-        new.push_str(nl);
-    }
-    Some(new)
-}
-
-// ── pyproject.toml ───────────────────────────────────────────────────────────
-
-/// Returns `Some(new_content)` if the doc was modified, `None` if the hook dep
-/// was already present, or `Err` on malformed TOML / wrong-typed tables.
-fn pyproject_add(content: &str) -> Result<Option<String>, String> {
-    let mut doc = content
-        .parse::<DocumentMut>()
-        .map_err(|e| format!("Invalid pyproject.toml: {e}"))?;
-
-    // Prefer PEP 621 `[project].dependencies` when there is a *real* PEP 621
-    // surface; otherwise fall back to a classic Poetry `[tool.poetry]` table.
-    // A `[project]` table that exists only implicitly (e.g. conjured by a
-    // `[project.urls]` sub-table in a Poetry-1.x project) is NOT a real PEP 621
-    // surface — routing such a project to PEP 621 would add a
-    // `[project].dependencies` that Poetry ignores at install time. The inner
-    // helpers detect an already-present hook dependency structurally (which the
-    // textual marker check can't, e.g. a Poetry `extras = ["hook"]` table).
-    let real_pep621 = doc
-        .get("project")
-        .and_then(Item::as_table)
-        .map(|t| !t.is_implicit() || t.contains_key("dependencies"))
-        .unwrap_or(false);
-    let has_poetry = doc
-        .get("tool")
-        .and_then(Item::as_table)
-        .and_then(|t| t.get("poetry"))
-        .and_then(Item::as_table)
-        .is_some();
-    // PEP 621 forbids a field that is both listed in `dynamic` and set
-    // statically, so a project with `dynamic = ["dependencies"]` (setuptools/
-    // hatch dynamic metadata, or Poetry 2.x keeping its dependency surface in
-    // `[tool.poetry.dependencies]`) must not gain a static array — every
-    // backend would refuse to build the manifest.
-    let dynamic_deps = doc
-        .get("project")
-        .and_then(Item::as_table)
-        .and_then(|t| t.get("dynamic"))
-        .and_then(Item::as_array)
-        .map(|a| a.iter().any(|v| v.as_str() == Some("dependencies")))
-        .unwrap_or(false);
-
-    let changed = if has_poetry && (!real_pep621 || dynamic_deps) {
-        poetry_add(&mut doc)?
-    } else if real_pep621 && !dynamic_deps {
-        pep621_add(&mut doc)?
-    } else if dynamic_deps {
-        return Err(
-            "pyproject.toml declares `[project].dependencies` as dynamic; adding a static \
-             dependencies array would make the manifest invalid — declare the hook in the \
-             source the dynamic metadata is resolved from (or use requirements.txt) instead"
-                .to_string(),
-        );
-    } else {
-        // Neither surface exists (e.g. a `[build-system]`-only or tool-config-only
-        // pyproject.toml of a setup.py/setup.cfg project). Synthesizing a
-        // `[project]` table with only `dependencies` would make the manifest
-        // invalid — PEP 621 requires `name` and forbids declaring it dynamic — so
-        // pip/setuptools/uv would refuse to build. Fail closed instead.
-        return Err(
-            "pyproject.toml has no `[project]` or `[tool.poetry]` table to host the hook \
-             dependency; declare project dependencies (or use requirements.txt) first"
-                .to_string(),
-        );
-    };
-    Ok(changed.then(|| render_pyproject(content, &doc)))
-}
-
-fn pyproject_remove(content: &str) -> Result<Option<String>, String> {
-    let mut doc = content
-        .parse::<DocumentMut>()
-        .map_err(|e| format!("Invalid pyproject.toml: {e}"))?;
-
-    let mut changed = false;
-    changed |= pep621_remove(&mut doc);
-    changed |= poetry_remove(&mut doc);
-
-    Ok(changed.then(|| render_pyproject(content, &doc)))
-}
-
-/// Render an edited pyproject document in the original's newline convention.
-/// toml_edit (0.25.x) re-emits every line terminator as `\n`, untouched
-/// lines included, so without this a CRLF checkout is rewritten wholesale
-/// and `--remove` could never hand back the pre-setup bytes.
-fn render_pyproject(original: &str, doc: &DocumentMut) -> String {
-    preserve_line_endings(original, doc.to_string())
-}
-
-fn pep621_add(doc: &mut DocumentMut) -> Result<bool, String> {
-    let root = doc.as_table_mut();
-    let project = ensure_table(root, "project", false)?;
-    if !project.contains_key("dependencies") {
-        project.insert("dependencies", Item::Value(Value::Array(Array::new())));
-    }
-    let deps = project
-        .get_mut("dependencies")
-        .and_then(Item::as_array_mut)
-        .ok_or("`project.dependencies` is not an array")?;
-    if deps
-        .iter()
-        .any(|v| v.as_str().map(deps_contain_hook).unwrap_or(false))
-    {
-        return Ok(false);
-    }
-    deps.push(HOOK_DEP);
-    Ok(true)
-}
-
-fn pep621_remove(doc: &mut DocumentMut) -> bool {
-    let deps = match doc
-        .get_mut("project")
-        .and_then(Item::as_table_mut)
-        .and_then(|p| p.get_mut("dependencies"))
-        .and_then(Item::as_array_mut)
-    {
-        Some(d) => d,
-        None => return false,
-    };
-    let before = deps.len();
-    deps.retain(|v| !v.as_str().map(deps_contain_hook).unwrap_or(false));
-    deps.len() != before
-}
-
-fn poetry_add(doc: &mut DocumentMut) -> Result<bool, String> {
-    let root = doc.as_table_mut();
-    let tool = ensure_table(root, "tool", true)?;
-    let poetry = ensure_table(tool, "poetry", true)?;
-    let deps = ensure_table(poetry, "dependencies", false)?;
-
-    // Classic Poetry can't express `socket-patch[hook]` as a key, so declare
-    // the equivalent: `socket-patch` carrying the `hook` extra. Already wired
-    // if a bare `socket-patch-hook` key exists or the extra is already present
-    // — matched canonically, since Poetry accepts any PEP 503 spelling.
-    if poetry_dep_key(deps, "socket-patch-hook").is_some() {
-        return Ok(false);
-    }
-    if let Some(key) = poetry_dep_key(deps, "socket-patch") {
-        let item = deps.get_mut(&key).expect("key came from this table");
-        if item_has_hook_extra(item) {
-            return Ok(false);
-        }
-        // An existing `socket-patch` dep (bare string or a table): merge the
-        // `hook` extra in place, preserving its version / source / markers.
-        if let Some(tbl) = item.as_table_like_mut() {
-            let mut extras = tbl
-                .get("extras")
-                .and_then(Item::as_array)
-                .cloned()
-                .unwrap_or_default();
-            extras.push("hook");
-            tbl.insert("extras", Item::Value(Value::Array(extras)));
-        } else if let Some(version) = item.as_str().map(str::to_string) {
-            deps.insert(&key, Item::Value(hook_inline_table(&version)));
-        } else {
-            // Any other shape (e.g. Poetry's multiple-constraints array of
-            // tables) carries spec data a blanket replacement would destroy.
-            return Err(
-                "`tool.poetry.dependencies.socket-patch` has an unsupported shape; \
-                 add the `hook` extra to it manually"
-                    .to_string(),
-            );
-        }
-        return Ok(true);
-    }
-    deps.insert("socket-patch", Item::Value(hook_inline_table("*")));
-    Ok(true)
-}
-
-fn poetry_remove(doc: &mut DocumentMut) -> bool {
-    let deps = match doc
-        .get_mut("tool")
-        .and_then(Item::as_table_mut)
-        .and_then(|t| t.get_mut("poetry"))
-        .and_then(Item::as_table_mut)
-        .and_then(|p| p.get_mut("dependencies"))
-        .and_then(Item::as_table_mut)
-    {
-        Some(d) => d,
-        None => return false,
-    };
-
-    let mut changed = false;
-    // Drop a legacy bare `socket-patch-hook` key (any PEP 503 spelling).
-    if let Some(key) = poetry_dep_key(deps, "socket-patch-hook") {
-        deps.remove(&key);
-        changed = true;
-    }
-    // Strip the `hook` extra from a `socket-patch` dep table, leaving the rest
-    // of the spec intact.
-    if let Some(tbl) = poetry_dep_key(deps, "socket-patch")
-        .and_then(|key| deps.get_mut(&key))
-        .and_then(Item::as_table_like_mut)
-    {
-        if let Some(extras) = tbl.get_mut("extras").and_then(Item::as_array_mut) {
-            let before = extras.len();
-            extras.retain(|v| !v.as_str().is_some_and(|s| s.eq_ignore_ascii_case("hook")));
-            if extras.len() != before {
-                changed = true;
-            }
-            if extras.is_empty() {
-                tbl.remove("extras");
-            }
-        }
-    }
-    changed
-}
-
-/// PEP 503 canonical form of a package name: `-`/`_`/`.` are interchangeable
-/// and comparison is case-insensitive. Poetry accepts any spelling as a
-/// dependency key, so the structural helpers must match keys canonically —
-/// the textual probe ([`super::detect::deps_contain_hook`]) already does.
-fn canonical_pypi_name(name: &str) -> String {
-    name.to_lowercase()
-        .chars()
-        .map(|c| if c == '_' || c == '.' { '-' } else { c })
-        .collect()
-}
-
-/// Find the key in a Poetry dependencies table whose canonical form is
-/// `canonical`, returning the user's spelling so edits land on it in place
-/// (inserting under the canonical name next to a variant-spelled key would
-/// declare the dependency twice — Poetry rejects that).
-fn poetry_dep_key(deps: &Table, canonical: &str) -> Option<String> {
-    deps.iter()
-        .map(|(k, _)| k)
-        .find(|k| canonical_pypi_name(k) == canonical)
-        .map(str::to_string)
-}
-
-/// Build `{ version = "<v>", extras = ["hook"] }`.
-fn hook_inline_table(version: &str) -> Value {
-    let mut it = InlineTable::new();
-    it.insert("version", Value::from(version));
-    let mut extras = Array::new();
-    extras.push("hook");
-    it.insert("extras", Value::Array(extras));
-    Value::InlineTable(it)
-}
-
-/// True if a dependency item (inline table or sub-table) already carries the
-/// `hook` extra (case-insensitively — PEP 685 normalizes extras names).
-fn item_has_hook_extra(item: &Item) -> bool {
-    item.as_table_like()
-        .and_then(|t| t.get("extras"))
-        .and_then(Item::as_array)
-        .map(|a| {
-            a.iter()
-                .any(|v| v.as_str().is_some_and(|s| s.eq_ignore_ascii_case("hook")))
-        })
-        .unwrap_or(false)
-}
-
-/// True if a parsed `pyproject.toml` already declares the hook dependency in any
-/// form `setup` could have written: a PEP 621 `[project].dependencies` entry, a
-/// classic-Poetry `socket-patch` dep carrying the `hook` extra, or a legacy bare
-/// `socket-patch-hook` key.
-///
-/// This is the structural counterpart to the textual
-/// [`super::detect::deps_contain_hook`]. It exists because `poetry_add` writes
-/// the hook as `socket-patch = { version = "*", extras = ["hook"] }`, which has
-/// no literal `socket-patch[hook]` substring — so the textual probe reports a
-/// freshly-and-correctly-configured classic-Poetry project as *unconfigured*.
-/// The `setup --check` / state probes must use this for `pyproject.toml` so a
-/// round-trip (setup → check) is consistent. Falls back to the textual check on
-/// unparseable TOML (best effort rather than a hard failure).
-pub fn pyproject_contains_hook(content: &str) -> bool {
-    let doc = match content.parse::<DocumentMut>() {
-        Ok(d) => d,
-        Err(_) => return deps_contain_hook(content),
-    };
-
-    // PEP 621 `[project].dependencies` (the textual `socket-patch[hook]` spec,
-    // or the bare `socket-patch-hook` wheel).
-    let in_pep621 = doc
-        .get("project")
-        .and_then(Item::as_table)
-        .and_then(|p| p.get("dependencies"))
-        .and_then(Item::as_array)
-        .map(|deps| {
-            deps.iter()
-                .any(|v| v.as_str().map(deps_contain_hook).unwrap_or(false))
-        })
-        .unwrap_or(false);
-    if in_pep621 {
-        return true;
-    }
-
-    // Classic Poetry `[tool.poetry.dependencies]`: a bare `socket-patch-hook`
-    // key, or a `socket-patch` dep carrying the `hook` extra.
-    if let Some(deps) = doc
-        .get("tool")
-        .and_then(Item::as_table)
-        .and_then(|t| t.get("poetry"))
-        .and_then(Item::as_table)
-        .and_then(|p| p.get("dependencies"))
-        .and_then(Item::as_table)
-    {
-        if poetry_dep_key(deps, "socket-patch-hook").is_some() {
-            return true;
-        }
-        if let Some(item) = poetry_dep_key(deps, "socket-patch").and_then(|key| deps.get(&key)) {
-            if item_has_hook_extra(item) {
-                return true;
-            }
-        }
-    }
-
-    false
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    // ── requirements.txt ─────────────────────────────────────────────
-
-    #[test]
-    fn test_requirements_add() {
-        let out = requirements_add("requests==2.31.0\n").unwrap();
-        assert!(out.contains("requests==2.31.0"));
-        assert!(out.contains("socket-patch[hook]"));
-        assert!(out.ends_with('\n'));
-    }
-
-    #[test]
-    fn test_requirements_add_no_trailing_newline() {
-        let out = requirements_add("requests").unwrap();
-        assert_eq!(out, "requests\nsocket-patch[hook]\n");
-    }
-
-    #[test]
-    fn test_requirements_add_idempotent() {
-        // The extra, the standalone wheel, and a pinned variant are all recognized.
-        assert!(requirements_add("socket-patch[hook]\n").is_none());
-        assert!(requirements_add("socket-patch-hook\n").is_none());
-        assert!(requirements_add("socket-patch-hook==3.3.0\n").is_none());
-    }
-
-    #[test]
-    fn test_requirements_remove() {
-        let out = requirements_remove("requests\nsocket-patch[hook]\n").unwrap();
-        assert_eq!(out, "requests\n");
-    }
-
-    #[test]
-    fn test_requirements_remove_absent() {
-        assert!(requirements_remove("requests\n").is_none());
-    }
-
-    // ── pyproject PEP 621 ────────────────────────────────────────────
-
-    #[test]
-    fn test_pep621_add_to_existing_array() {
-        let toml = "[project]\nname = \"x\"\ndependencies = [\"requests\"]\n";
-        let out = pyproject_add(toml).unwrap().unwrap();
-        assert!(out.contains("socket-patch[hook]"));
-        assert!(out.contains("requests"));
-        // Re-parse to confirm validity + idempotency.
-        assert!(pyproject_add(&out).unwrap().is_none());
-    }
-
-    #[test]
-    fn test_pep621_add_creates_dependencies() {
-        let toml = "[project]\nname = \"x\"\n";
-        let out = pyproject_add(toml).unwrap().unwrap();
-        let doc = out.parse::<DocumentMut>().unwrap();
-        let deps = doc["project"]["dependencies"].as_array().unwrap();
-        assert!(deps
-            .iter()
-            .any(|v| v.as_str() == Some("socket-patch[hook]")));
-    }
-
-    #[test]
-    fn test_pep621_preserves_other_content() {
-        let toml = "[build-system]\nrequires = [\"setuptools\"]\n\n[project]\nname = \"x\"\nversion = \"1.0\"\ndependencies = [\n    \"requests\",\n]\n";
-        let out = pyproject_add(toml).unwrap().unwrap();
-        assert!(out.contains("[build-system]"));
-        assert!(out.contains("version = \"1.0\""));
-        assert!(out.contains("requests"));
-        assert!(out.contains("socket-patch[hook]"));
-    }
-
-    #[test]
-    fn test_pep621_remove() {
-        let toml = "[project]\ndependencies = [\"requests\", \"socket-patch[hook]\"]\n";
-        let out = pyproject_remove(toml).unwrap().unwrap();
-        assert!(!out.contains("socket-patch[hook]"));
-        assert!(out.contains("requests"));
-    }
-
-    // ── pyproject Poetry (the `socket-patch[hook]` equivalent: the
-    //    `socket-patch` dep carrying the `hook` extra) ─────────────────
-
-    #[test]
-    fn test_poetry_add_new_dep() {
-        let toml = "[tool.poetry]\nname = \"x\"\n\n[tool.poetry.dependencies]\npython = \"^3.9\"\n";
-        let out = pyproject_add(toml).unwrap().unwrap();
-        let doc = out.parse::<DocumentMut>().unwrap();
-        assert!(
-            item_has_hook_extra(&doc["tool"]["poetry"]["dependencies"]["socket-patch"]),
-            "poetry dep must carry the hook extra; got:\n{out}"
-        );
-        // Idempotent.
-        assert!(pyproject_add(&out).unwrap().is_none());
-    }
-
-    #[test]
-    fn test_poetry_merges_extra_into_existing_dep() {
-        // An existing `socket-patch = "^3.3.0"` gains the hook extra, version kept.
-        let toml =
-            "[tool.poetry]\nname = \"x\"\n[tool.poetry.dependencies]\nsocket-patch = \"^3.3.0\"\n";
-        let out = pyproject_add(toml).unwrap().unwrap();
-        let doc = out.parse::<DocumentMut>().unwrap();
-        let item = &doc["tool"]["poetry"]["dependencies"]["socket-patch"];
-        assert!(item_has_hook_extra(item), "hook extra must be added");
-        assert_eq!(
-            item.as_table_like()
-                .and_then(|t| t.get("version"))
-                .and_then(Item::as_str),
-            Some("^3.3.0"),
-            "existing version must be preserved"
-        );
-    }
-
-    #[test]
-    fn test_poetry_subtable_dependency_preserved() {
-        // A `[tool.poetry.dependencies.socket-patch]` sub-table gains the hook
-        // extra while keeping its version / source.
-        let toml = "[tool.poetry.dependencies.socket-patch]\nversion = \"^3.3.0\"\ngit = \"https://example.com/x.git\"\n";
-        let out = pyproject_add(toml).unwrap().unwrap();
-        let doc = out.parse::<DocumentMut>().unwrap();
-        let sp = &doc["tool"]["poetry"]["dependencies"]["socket-patch"];
-        assert!(item_has_hook_extra(sp), "hook extra must be added");
-        assert_eq!(
-            sp.as_table_like()
-                .and_then(|t| t.get("git"))
-                .and_then(Item::as_str),
-            Some("https://example.com/x.git"),
-            "sub-table keys must survive"
-        );
-        // Idempotent.
-        assert!(pyproject_add(&out).unwrap().is_none());
-    }
-
-    #[test]
-    fn test_poetry_remove_strips_extra() {
-        let toml = "[tool.poetry.dependencies]\nsocket-patch = {version = \"*\", extras = [\"hook\"]}\npython = \"^3.9\"\n";
-        let out = pyproject_remove(toml).unwrap().unwrap();
-        let doc = out.parse::<DocumentMut>().unwrap();
-        assert!(!item_has_hook_extra(
-            &doc["tool"]["poetry"]["dependencies"]["socket-patch"]
-        ));
-        assert!(doc["tool"]["poetry"]["dependencies"]
-            .get("python")
-            .is_some());
-    }
-
-    #[test]
-    fn test_pep621_preferred_when_both_present() {
-        // poetry 2.x: both [project] and [tool.poetry] — edit the PEP 621 array.
-        let toml = "[project]\nname = \"x\"\ndependencies = []\n\n[tool.poetry]\nname = \"x\"\n";
-        let out = pyproject_add(toml).unwrap().unwrap();
-        let doc = out.parse::<DocumentMut>().unwrap();
-        assert!(doc["project"]["dependencies"]
-            .as_array()
-            .unwrap()
-            .iter()
-            .any(|v| v.as_str() == Some("socket-patch[hook]")));
-    }
-
-    #[test]
-    fn test_invalid_toml_errors() {
-        assert!(pyproject_add("this is = = not toml [[[").is_err());
-    }
-
-    #[test]
-    fn test_pyproject_add_without_dep_surface_refuses() {
-        // A pyproject.toml with neither `[project]` nor `[tool.poetry]` (the
-        // classic setup.py/setup.cfg project that only carries `[build-system]`
-        // or tool config) has no dependency surface to host the hook.
-        // Synthesizing a `[project]` table with only `dependencies` makes the
-        // manifest invalid — PEP 621 requires `name` and forbids making it
-        // dynamic — so pip/setuptools/uv would refuse to build afterwards.
-        // The edit must error, not break the user's build.
-        let build_only =
-            "[build-system]\nrequires = [\"setuptools\"]\nbuild-backend = \"setuptools.build_meta\"\n";
-        assert!(
-            pyproject_add(build_only).is_err(),
-            "must not synthesize a name-less [project] table"
-        );
-        let tool_only = "[tool.black]\nline-length = 100\n";
-        assert!(pyproject_add(tool_only).is_err());
-    }
-
-    #[test]
-    fn test_pep621_dynamic_dependencies_refused() {
-        // setuptools/hatch dynamic-metadata pattern: `dependencies` is declared
-        // dynamic and resolved from an external source at build time. PEP 621
-        // forbids a field that is both listed in `dynamic` and set statically,
-        // so inserting a static `dependencies` array makes every backend refuse
-        // to build. The edit must fail closed instead of bricking the build.
-        let toml = "[project]\nname = \"x\"\ndynamic = [\"dependencies\"]\n\n\
-                    [tool.setuptools.dynamic]\ndependencies = {file = [\"requirements.txt\"]}\n";
-        assert!(
-            pyproject_add(toml).is_err(),
-            "must not add a static dependencies array next to dynamic = [\"dependencies\"]"
-        );
-    }
-
-    #[test]
-    fn test_poetry2_dynamic_dependencies_routes_to_poetry() {
-        // Poetry 2.x documented pattern: a PEP 621 `[project]` table with
-        // `dynamic = ["dependencies"]` while the real dependency surface stays
-        // in `[tool.poetry.dependencies]`. The hook must land in the poetry
-        // table — a static `[project].dependencies` array is both ignored by
-        // Poetry at install time and invalid per PEP 621.
-        let toml = "[project]\nname = \"x\"\ndynamic = [\"dependencies\"]\n\n\
-                    [tool.poetry.dependencies]\npython = \"^3.9\"\n";
-        let out = pyproject_add(toml).unwrap().unwrap();
-        let doc = out.parse::<DocumentMut>().unwrap();
-        assert!(
-            item_has_hook_extra(&doc["tool"]["poetry"]["dependencies"]["socket-patch"]),
-            "hook must be wired via the poetry table:\n{out}"
-        );
-        assert!(
-            doc.get("project")
-                .and_then(|p| p.get("dependencies"))
-                .is_none(),
-            "must not synthesize a static [project].dependencies:\n{out}"
-        );
-        // Idempotent through the same route.
-        assert!(pyproject_add(&out).unwrap().is_none());
-    }
-
-    #[test]
-    fn test_pep621_other_dynamic_fields_still_edited_statically() {
-        // Only `dependencies` being dynamic blocks the static edit; dynamic
-        // version (the common setuptools-scm case) keeps the PEP 621 path.
-        let toml =
-            "[project]\nname = \"x\"\ndynamic = [\"version\"]\ndependencies = [\"requests\"]\n";
-        let out = pyproject_add(toml).unwrap().unwrap();
-        assert!(out.contains("socket-patch[hook]"));
-    }
-
-    #[test]
-    fn test_poetry_add_multiconstraint_dep_not_clobbered() {
-        // Poetry's multiple-constraints form declares one dep as an ARRAY of
-        // constraint tables. That item is neither table-like nor a string, so
-        // the replace-fallback would silently overwrite the user's whole
-        // constraint set with `{version = "*", extras = ["hook"]}` — destroying
-        // their version pins and python markers. Refuse instead.
-        let toml = "[tool.poetry]\nname = \"x\"\n\n[tool.poetry.dependencies]\n\
-                    socket-patch = [{version = \"^1.0\", python = \"^2.7\"}, {version = \"^2.0\", python = \"^3.7\"}]\n";
-        assert!(
-            pyproject_add(toml).is_err(),
-            "a multi-constraint socket-patch dep must not be silently replaced"
-        );
-    }
-
-    #[test]
-    fn test_classic_poetry_with_project_urls_routes_to_poetry() {
-        // `[project.urls]` conjures an implicit `[project]` table; a Poetry 1.x
-        // project must still be edited in the Poetry table, not given a
-        // `[project].dependencies` Poetry ignores.
-        let toml = "[tool.poetry]\nname = \"x\"\n\n[tool.poetry.dependencies]\npython = \"^3.9\"\n\n[project.urls]\nHome = \"https://example.com\"\n";
-        let out = pyproject_add(toml).unwrap().unwrap();
-        let doc = out.parse::<DocumentMut>().unwrap();
-        assert!(
-            item_has_hook_extra(&doc["tool"]["poetry"]["dependencies"]["socket-patch"]),
-            "must edit the poetry table, not create [project].dependencies; got:\n{out}"
-        );
-        assert!(doc
-            .get("project")
-            .and_then(|p| p.get("dependencies"))
-            .is_none());
-    }
-
-    #[test]
-    fn test_requirements_preserves_crlf() {
-        let out = requirements_add("requests\r\n").unwrap();
-        assert_eq!(out, "requests\r\nsocket-patch[hook]\r\n");
-        let removed = requirements_remove(&out).unwrap();
-        assert_eq!(removed, "requests\r\n");
-    }
-
-    /// A Windows (`core.autocrlf`) checkout's pyproject.toml is CRLF. toml_edit
-    /// renders every newline as LF, so `setup` must re-apply CRLF (or every
-    /// line of the manifest diffs) and `--remove` must hand back the exact
-    /// pre-setup bytes (CLI_CONTRACT property 8).
-    #[test]
-    fn test_pyproject_preserves_crlf() {
-        let original =
-            "[project]\r\nname = \"demo\"\r\ndependencies = [\r\n  \"requests\",\r\n]\r\n";
-        let added = pyproject_add(original).unwrap().expect("hook dep added");
-        assert!(added.contains(HOOK_DEP), "hook added: {added:?}");
-        assert!(
-            !added.replace("\r\n", "").contains('\n'),
-            "every newline must stay CRLF: {added:?}"
-        );
-        // Idempotent on the CRLF output.
-        assert_eq!(pyproject_add(&added).unwrap(), None);
-        let removed = pyproject_remove(&added).unwrap().expect("hook dep removed");
-        assert_eq!(
-            removed, original,
-            "--remove restores the CRLF bytes exactly"
-        );
-    }
-
-    // ── file-level NotFound handling (the create / no-op paths) ──────
-
-    #[tokio::test]
-    async fn test_add_creates_missing_requirements() {
-        let dir = tempfile::tempdir().unwrap();
-        let req = dir.path().join("requirements.txt"); // does not exist
-        let res = add_hook_dependency(&req, ManifestKind::Requirements, false).await;
-        assert_eq!(res.status, PthStatus::Updated);
-        let body = tokio::fs::read_to_string(&req).await.unwrap();
-        assert_eq!(body, "socket-patch[hook]\n");
-    }
-
-    #[tokio::test]
-    async fn test_add_missing_pyproject_is_error() {
-        let dir = tempfile::tempdir().unwrap();
-        let py = dir.path().join("pyproject.toml"); // does not exist
-        let res = add_hook_dependency(&py, ManifestKind::Pyproject, false).await;
-        assert_eq!(res.status, PthStatus::Error);
-    }
-
-    #[tokio::test]
-    async fn test_remove_missing_file_is_noop() {
-        let dir = tempfile::tempdir().unwrap();
-        let req = dir.path().join("requirements.txt"); // does not exist
-        let res = remove_hook_dependency(&req, ManifestKind::Requirements, false).await;
-        assert_eq!(res.status, PthStatus::AlreadyConfigured);
-    }
-
-    #[tokio::test]
-    async fn test_add_dry_run_does_not_create() {
-        let dir = tempfile::tempdir().unwrap();
-        let req = dir.path().join("requirements.txt");
-        let res = add_hook_dependency(&req, ManifestKind::Requirements, true).await;
-        assert_eq!(res.status, PthStatus::Updated);
-        assert!(!req.exists(), "dry-run must not create the file");
-    }
-
-    // ── atomic-write contract (no truncation / no stage litter) ──────
-    //
-    // The edit must go through stage+fsync+rename, never a bare truncating
-    // write, so a crash can't leave the user's hand-authored manifest empty.
-    // A leaked `.socket-stage-*` sibling would mean the rename didn't complete.
-
-    async fn count_stage_litter(dir: &Path) -> usize {
-        let mut rd = tokio::fs::read_dir(dir).await.unwrap();
-        let mut n = 0;
-        while let Some(entry) = rd.next_entry().await.unwrap() {
-            if entry
-                .file_name()
-                .to_string_lossy()
-                .starts_with(".socket-stage-")
-            {
-                n += 1;
-            }
-        }
-        n
-    }
-
-    #[tokio::test]
-    async fn test_add_pyproject_atomic_no_litter_and_intact() {
-        let dir = tempfile::tempdir().unwrap();
-        let py = dir.path().join("pyproject.toml");
-        let original = "[build-system]\nrequires = [\"setuptools\"]\n\n[project]\nname = \"x\"\ndependencies = [\"requests\"]\n";
-        tokio::fs::write(&py, original).await.unwrap();
-
-        let res = add_hook_dependency(&py, ManifestKind::Pyproject, false).await;
-        assert_eq!(res.status, PthStatus::Updated);
-
-        // No half-written stage file left behind.
-        assert_eq!(count_stage_litter(dir.path()).await, 0);
-        // The file is fully written, valid TOML, and preserved prior content.
-        let body = tokio::fs::read_to_string(&py).await.unwrap();
-        let doc = body.parse::<DocumentMut>().unwrap();
-        assert!(body.contains("[build-system]"));
-        let deps = doc["project"]["dependencies"].as_array().unwrap();
-        assert!(deps.iter().any(|v| v.as_str() == Some("requests")));
-        assert!(deps
-            .iter()
-            .any(|v| v.as_str() == Some("socket-patch[hook]")));
-    }
-
-    #[tokio::test]
-    async fn test_remove_requirements_atomic_no_litter() {
-        let dir = tempfile::tempdir().unwrap();
-        let req = dir.path().join("requirements.txt");
-        tokio::fs::write(&req, "requests\nsocket-patch[hook]\n")
-            .await
-            .unwrap();
-
-        let res = remove_hook_dependency(&req, ManifestKind::Requirements, false).await;
-        assert_eq!(res.status, PthStatus::Updated);
-        assert_eq!(count_stage_litter(dir.path()).await, 0);
-        assert_eq!(tokio::fs::read_to_string(&req).await.unwrap(), "requests\n");
-    }
-
-    // ── structural hook detection (pyproject_contains_hook) ──────────
-    //
-    // The `setup --check` probe must agree with what `setup` wrote. The classic
-    // Poetry form has no `socket-patch[hook]` substring, so the textual probe
-    // alone mis-reports a configured project as needing configuration.
-
-    #[test]
-    fn test_pyproject_contains_hook_poetry_form_roundtrips() {
-        // Regression: poetry_add writes the structural `extras = ["hook"]` form;
-        // the textual probe can't see it, but the structural one must.
-        let toml = "[tool.poetry]\nname = \"x\"\n\n[tool.poetry.dependencies]\npython = \"^3.9\"\n";
-        let out = pyproject_add(toml).unwrap().unwrap();
-        assert!(
-            pyproject_contains_hook(&out),
-            "structural probe must see the poetry extras form:\n{out}"
-        );
-        // This is precisely why the structural probe is needed: the textual one
-        // (used for requirements.txt) cannot detect the poetry form.
-        assert!(
-            !deps_contain_hook(&out),
-            "textual probe is (by design) blind to the poetry form; if this \
-             ever becomes true the structural probe may be redundant:\n{out}"
-        );
-    }
-
-    #[test]
-    fn test_pyproject_contains_hook_pep621_and_wheel() {
-        // PEP 621 array, extra spelling.
-        assert!(pyproject_contains_hook(
-            "[project]\ndependencies = [\"requests\", \"socket-patch[hook]>=3.3.0\"]\n"
-        ));
-        // PEP 621 array, bare wheel spelling.
-        assert!(pyproject_contains_hook(
-            "[project]\ndependencies = [\"socket-patch-hook\"]\n"
-        ));
-        // Poetry bare-wheel key.
-        assert!(pyproject_contains_hook(
-            "[tool.poetry.dependencies]\nsocket-patch-hook = \"*\"\n"
-        ));
-    }
-
-    #[test]
-    fn test_pyproject_contains_hook_negative() {
-        // A plain socket-patch dep (CLI only, no hook) is NOT the hook — in
-        // either surface.
-        assert!(!pyproject_contains_hook(
-            "[project]\ndependencies = [\"socket-patch>=3.3.0\"]\n"
-        ));
-        assert!(!pyproject_contains_hook(
-            "[tool.poetry.dependencies]\nsocket-patch = \"^3.3.0\"\n"
-        ));
-        // A socket-patch dep carrying some *other* extra is not the hook.
-        assert!(!pyproject_contains_hook(
-            "[tool.poetry.dependencies]\nsocket-patch = {version = \"*\", extras = [\"cli\"]}\n"
-        ));
-        // Empty / unrelated.
-        assert!(!pyproject_contains_hook("[project]\nname = \"x\"\n"));
-    }
-
-    #[test]
-    fn test_pyproject_contains_hook_malformed_falls_back_to_textual() {
-        // Unparseable TOML: fall back to the textual probe rather than hard-fail.
-        assert!(pyproject_contains_hook(
-            "this = = not toml [[[ socket-patch[hook]"
-        ));
-        assert!(!pyproject_contains_hook("this = = not toml [[[ requests"));
-    }
-
-    #[test]
-    fn test_pyproject_contains_hook_after_remove_is_false() {
-        // Round-trip: add then remove → structural probe reports not-configured.
-        let toml = "[tool.poetry]\nname = \"x\"\n\n[tool.poetry.dependencies]\nsocket-patch = \"^3.3.0\"\n";
-        let added = pyproject_add(toml).unwrap().unwrap();
-        assert!(pyproject_contains_hook(&added));
-        let removed = pyproject_remove(&added).unwrap().unwrap();
-        assert!(
-            !pyproject_contains_hook(&removed),
-            "after remove the hook must be gone:\n{removed}"
-        );
-    }
-
-    // ── mode preservation (user-owned manifests keep their permission bits) ──
-    //
-    // The rename-based atomic write swaps in a fresh stage inode; without the
-    // mode-preserving variant a 0600 private manifest silently becomes 0644.
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_edit_preserves_file_mode() {
-        use std::os::unix::fs::PermissionsExt;
-        let dir = tempfile::tempdir().unwrap();
-
-        // A 0600 private pyproject.toml must stay private after add.
-        let py = dir.path().join("pyproject.toml");
-        tokio::fs::write(&py, "[project]\nname = \"x\"\ndependencies = []\n")
-            .await
-            .unwrap();
-        tokio::fs::set_permissions(&py, std::fs::Permissions::from_mode(0o600))
-            .await
-            .unwrap();
-        let res = add_hook_dependency(&py, ManifestKind::Pyproject, false).await;
-        assert_eq!(res.status, PthStatus::Updated);
-        let mode = tokio::fs::metadata(&py).await.unwrap().permissions().mode() & 0o777;
-        assert_eq!(mode, 0o600, "add must not reset pyproject.toml mode");
-
-        // A 0744 requirements.txt keeps its exec bit after remove (red under
-        // ANY umask: a 0666-created stage inode can never carry exec bits).
-        let req = dir.path().join("requirements.txt");
-        tokio::fs::write(&req, "requests\nsocket-patch[hook]\n")
-            .await
-            .unwrap();
-        tokio::fs::set_permissions(&req, std::fs::Permissions::from_mode(0o744))
-            .await
-            .unwrap();
-        let res = remove_hook_dependency(&req, ManifestKind::Requirements, false).await;
-        assert_eq!(res.status, PthStatus::Updated);
-        let mode = tokio::fs::metadata(&req)
-            .await
-            .unwrap()
-            .permissions()
-            .mode()
-            & 0o777;
-        assert_eq!(mode, 0o744, "remove must not reset requirements.txt mode");
-    }
-
-    // ── PEP 503/685 spellings in the Poetry TABLE forms ──────────────
-    //
-    // `-`/`_`/`.` are interchangeable in package names and names/extras are
-    // case-insensitive; Poetry installs the hook from any spelling, so the
-    // structural helpers must recognize them the way the textual probe
-    // (`deps_contain_hook`) already does.
-
-    #[test]
-    fn test_poetry_add_pep503_variant_keys_idempotent() {
-        // A hook already declared under a variant spelling must be recognized,
-        // not shadowed by a second entry for the same canonical package.
-        let wheel =
-            "[tool.poetry]\nname = \"x\"\n\n[tool.poetry.dependencies]\nsocket_patch_hook = \"*\"\n";
-        assert!(pyproject_add(wheel).unwrap().is_none());
-        let extra = "[tool.poetry]\nname = \"x\"\n\n[tool.poetry.dependencies]\n\
-                     socket_patch = {version = \"^3.3.0\", extras = [\"hook\"]}\n";
-        assert!(pyproject_add(extra).unwrap().is_none());
-        // PEP 685: extras names are case-insensitive too.
-        let cased = "[tool.poetry]\nname = \"x\"\n\n[tool.poetry.dependencies]\n\
-                     socket-patch = {version = \"*\", extras = [\"Hook\"]}\n";
-        assert!(pyproject_add(cased).unwrap().is_none());
-    }
-
-    #[test]
-    fn test_poetry_add_merges_into_pep503_variant_key() {
-        // An existing dep under a variant spelling gains the extra in place —
-        // not a duplicate `socket-patch` key canonicalizing to the same
-        // package, which Poetry rejects as a twice-declared dependency.
-        let toml =
-            "[tool.poetry]\nname = \"x\"\n\n[tool.poetry.dependencies]\nSocket_Patch = \"^3.3.0\"\n";
-        let out = pyproject_add(toml).unwrap().unwrap();
-        let doc = out.parse::<DocumentMut>().unwrap();
-        let deps = doc["tool"]["poetry"]["dependencies"].as_table().unwrap();
-        assert!(
-            deps.get("socket-patch").is_none(),
-            "must not add a duplicate key:\n{out}"
-        );
-        let item = deps.get("Socket_Patch").expect("user's spelling kept");
-        assert!(
-            item_has_hook_extra(item),
-            "extra merged under the user's spelling:\n{out}"
-        );
-        assert_eq!(
-            item.as_table_like()
-                .and_then(|t| t.get("version"))
-                .and_then(Item::as_str),
-            Some("^3.3.0"),
-            "existing version must be preserved"
-        );
-    }
-
-    #[test]
-    fn test_poetry_remove_pep503_variant_keys() {
-        // remove must unwire the hook regardless of spelling — leaving it
-        // declared means the .pth carrier keeps installing after `remove`.
-        let wheel = "[tool.poetry.dependencies]\nsocket_patch_hook = \"*\"\n";
-        let out = pyproject_remove(wheel)
-            .unwrap()
-            .expect("variant wheel key must be removed");
-        assert!(!pyproject_contains_hook(&out));
-
-        let extra =
-            "[tool.poetry.dependencies]\n\"socket.patch\" = {version = \"*\", extras = [\"Hook\"]}\n";
-        let out = pyproject_remove(extra)
-            .unwrap()
-            .expect("variant extras form must be stripped");
-        assert!(!pyproject_contains_hook(&out));
-    }
-
-    #[test]
-    fn test_pyproject_contains_hook_pep503_poetry_forms() {
-        assert!(pyproject_contains_hook(
-            "[tool.poetry.dependencies]\nsocket_patch_hook = \"*\"\n"
-        ));
-        assert!(pyproject_contains_hook(
-            "[tool.poetry.dependencies]\nSocket_Patch = {version = \"*\", extras = [\"hook\"]}\n"
-        ));
-        assert!(pyproject_contains_hook(
-            "[tool.poetry.dependencies]\nsocket-patch = {version = \"*\", extras = [\"Hook\"]}\n"
-        ));
-        // A different package that merely shares the prefix is not the hook.
-        assert!(!pyproject_contains_hook(
-            "[tool.poetry.dependencies]\nsocket-patchwork = \"*\"\n"
-        ));
-    }
-
-    /// mkfifo(2) directly rather than shelling out to the `mkfifo` binary —
-    /// same helper as the detect.rs / find.rs FIFO tests: fork/exec flakes
-    /// under heavy parallel load and the syscall needs no process at all.
-    #[cfg(unix)]
-    fn mkfifo(path: &Path) {
-        use std::os::unix::ffi::OsStrExt;
-        let c_path =
-            std::ffi::CString::new(path.as_os_str().as_bytes()).expect("fifo path has no NUL");
-        let rc = unsafe { libc::mkfifo(c_path.as_ptr(), 0o644) };
-        assert_eq!(
-            rc,
-            0,
-            "mkfifo(2) failed: {}",
-            std::io::Error::last_os_error()
-        );
-    }
-
-    /// A FIFO planted as the manifest must not wedge the edit path. The
-    /// manifest paths handed to add/remove come from detection, which never
-    /// opens the file it targets for editing (a poetry.lock next to a FIFO
-    /// pyproject.toml routes here without a read; the Pip fallback targets
-    /// requirements.txt sight-unseen), so a plain `read_to_string` open(2)
-    /// waits for a writer that never comes, wedging `setup` / `setup
-    /// --remove` indefinitely with no error and no timeout. Same class as
-    /// the `open_regular_file` guards in the detect.rs/gem/composer/npm
-    /// twins. The non-regular file must instead fail fast to `Error`.
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_edit_fifo_manifest_does_not_wedge() {
-        let dir = tempfile::tempdir().unwrap();
-        let req = dir.path().join("requirements.txt");
-        let py = dir.path().join("pyproject.toml");
-        mkfifo(&req);
-        mkfifo(&py);
-
-        // On timeout the open is wedged in a `spawn_blocking` thread that
-        // the runtime waits for on shutdown; connect a writer to release
-        // it so the test can FAIL instead of hanging the whole suite.
-        let deadline = std::time::Duration::from_secs(5);
-        let Ok(res) = tokio::time::timeout(
-            deadline,
-            add_hook_dependency(&req, ManifestKind::Requirements, false),
-        )
-        .await
-        else {
-            let _ = std::fs::OpenOptions::new().write(true).open(&req);
-            panic!("add_hook_dependency must complete promptly with a FIFO manifest");
-        };
-        assert_eq!(res.status, PthStatus::Error);
-
-        let Ok(res) = tokio::time::timeout(
-            deadline,
-            remove_hook_dependency(&py, ManifestKind::Pyproject, false),
-        )
-        .await
-        else {
-            let _ = std::fs::OpenOptions::new().write(true).open(&py);
-            panic!("remove_hook_dependency must complete promptly with a FIFO manifest");
-        };
-        assert_eq!(res.status, PthStatus::Error);
-
-        // The failed add must not have replaced the user's FIFO with a
-        // regular requirements.txt via the missing-file create path.
-        use std::os::unix::fs::FileTypeExt;
-        let ft = std::fs::symlink_metadata(&req).unwrap().file_type();
-        assert!(ft.is_fifo(), "the squatting FIFO must be left untouched");
-    }
-
-    #[tokio::test]
-    async fn test_dry_run_does_no_io_for_pyproject() {
-        let dir = tempfile::tempdir().unwrap();
-        let py = dir.path().join("pyproject.toml");
-        let original = "[project]\nname = \"x\"\ndependencies = [\"requests\"]\n";
-        tokio::fs::write(&py, original).await.unwrap();
-
-        let res = add_hook_dependency(&py, ManifestKind::Pyproject, true).await;
-        assert_eq!(res.status, PthStatus::Updated);
-        // Dry-run must neither stage nor mutate the original.
-        assert_eq!(count_stage_litter(dir.path()).await, 0);
-        assert_eq!(tokio::fs::read_to_string(&py).await.unwrap(), original);
-    }
-
-    // ── finish()'s failure arms through the async wrappers ───────────
-    //
-    // Every error-shape test above calls the pure transforms directly; these
-    // pin the wrapper glue: the atomic-write Err arm and the transform Err arm
-    // must both surface as `PthStatus::Error` with the message attached, and
-    // must leave the user's file untouched.
-
-    #[cfg(unix)]
-    #[tokio::test]
-    async fn test_add_write_failure_readonly_parent_is_error() {
-        use std::os::unix::fs::PermissionsExt;
-        // A read-only PARENT directory blocks the stage-sibling creation while
-        // the manifest itself stays readable — so the read and transform
-        // succeed and the failure lands exactly in finish()'s write arm.
-        let dir = tempfile::tempdir().unwrap();
-        let req = dir.path().join("requirements.txt");
-        let original = "requests\n";
-        tokio::fs::write(&req, original).await.unwrap();
-        tokio::fs::set_permissions(dir.path(), std::fs::Permissions::from_mode(0o555))
-            .await
-            .unwrap();
-
-        let res = add_hook_dependency(&req, ManifestKind::Requirements, false).await;
-
-        // Restore before any assertion can unwind, so the tempdir cleans up.
-        tokio::fs::set_permissions(dir.path(), std::fs::Permissions::from_mode(0o755))
-            .await
-            .unwrap();
-
-        assert_eq!(res.status, PthStatus::Error);
-        assert!(
-            res.error.is_some(),
-            "the write failure must carry a message: {res:?}"
-        );
-        assert_eq!(
-            tokio::fs::read_to_string(&req).await.unwrap(),
-            original,
-            "a failed write must leave the manifest byte-for-byte untouched"
-        );
-        assert_eq!(
-            count_stage_litter(dir.path()).await,
-            0,
-            "the failed stage creation must not leave litter behind"
-        );
-    }
-
-    #[tokio::test]
-    async fn test_add_malformed_pyproject_via_wrapper_is_error() {
-        // The path `setup` actually takes on a real broken manifest: the
-        // transform's Err must route through finish() to `Error`, not panic
-        // and not touch the file.
-        let dir = tempfile::tempdir().unwrap();
-        let py = dir.path().join("pyproject.toml");
-        let original = "this is = = not toml [[[\n";
-        tokio::fs::write(&py, original).await.unwrap();
-
-        let res = add_hook_dependency(&py, ManifestKind::Pyproject, false).await;
-        assert_eq!(res.status, PthStatus::Error);
-        assert!(
-            res.error
-                .as_deref()
-                .is_some_and(|e| e.contains("Invalid pyproject.toml")),
-            "the parse failure must be attributed to pyproject.toml: {res:?}"
-        );
-        assert_eq!(
-            tokio::fs::read_to_string(&py).await.unwrap(),
-            original,
-            "a failed transform must leave the manifest untouched"
-        );
-        assert_eq!(
-            count_stage_litter(dir.path()).await,
-            0,
-            "no stage may be created for a failed transform"
-        );
-    }
-
-    // ── remove_hook_dependency's Pyproject routing ────────────────────
-
-    #[tokio::test]
-    async fn test_remove_pyproject_via_wrapper_round_trip() {
-        let dir = tempfile::tempdir().unwrap();
-        let py = dir.path().join("pyproject.toml");
-        let original =
-            "[project]\nname = \"x\"\ndependencies = [\"requests\", \"socket-patch[hook]\"]\n";
-        tokio::fs::write(&py, original).await.unwrap();
-
-        let res = remove_hook_dependency(&py, ManifestKind::Pyproject, false).await;
-        assert_eq!(res.status, PthStatus::Updated, "err: {:?}", res.error);
-
-        let body = tokio::fs::read_to_string(&py).await.unwrap();
-        assert!(
-            !pyproject_contains_hook(&body),
-            "the hook must be gone after remove:\n{body}"
-        );
-        assert!(body.contains("\"requests\""), "other deps survive:\n{body}");
-        // Byte-preservation-sensitive subsystem: the wrapper must write
-        // exactly what the pure transform produced — untouched lines verbatim.
-        assert_eq!(
-            body,
-            pyproject_remove(original).unwrap().unwrap(),
-            "the wrapper must persist the pure transform's output byte-for-byte"
-        );
-        assert!(
-            body.contains("[project]\nname = \"x\"\n"),
-            "untouched header and name line survive verbatim:\n{body}"
-        );
-        assert_eq!(count_stage_litter(dir.path()).await, 0);
-
-        // Second remove: nothing left to strip → idempotent no-op.
-        let res = remove_hook_dependency(&py, ManifestKind::Pyproject, false).await;
-        assert_eq!(res.status, PthStatus::AlreadyConfigured);
-        assert_eq!(
-            tokio::fs::read_to_string(&py).await.unwrap(),
-            body,
-            "the no-op remove must not rewrite the file"
-        );
-    }
-
-    // ── poetry_remove: socket-patch table without extras ─────────────
-
-    #[test]
-    fn test_poetry_remove_table_without_extras_is_noop() {
-        // A table-shaped `socket-patch` dep with no `extras` array has nothing
-        // of ours to strip: `changed` must stay false (Ok(None)) and the
-        // user's version spec must be left alone.
-        let toml = "[tool.poetry.dependencies]\nsocket-patch = {version = \"^3.3.0\"}\n";
-        assert!(
-            pyproject_remove(toml).unwrap().is_none(),
-            "a socket-patch dep without extras is not ours to touch"
-        );
-    }
-}
diff --git a/crates/socket-patch-core/src/setup/pypi/mod.rs b/crates/socket-patch-core/src/setup/pypi/mod.rs
deleted file mode 100644
index 998d6235..00000000
--- a/crates/socket-patch-core/src/setup/pypi/mod.rs
+++ /dev/null
@@ -1,20 +0,0 @@
-//! Python `.pth` post-install hook setup.
-//!
-//! Where npm-family ecosystems get an automatic post-install patch hook via a
-//! `package.json` `postinstall` script ([`crate::package_json`]), Python has no
-//! universal installer hook. Instead, `socket-patch setup` declares a committed
-//! dependency on the `socket-patch-hook` wheel (via the `socket-patch[hook]`
-//! extra); installing that wheel lays a startup `.pth` into site-packages that
-//! re-applies patches after any install — package-manager-agnostic, because it
-//! rides on the interpreter's startup hook rather than any one installer.
-//!
-//! This module is the Rust side: detecting the project's dependency manager
-//! ([`detect`]) and editing its manifest(s) to add/remove the hook dependency
-//! ([`edit`]). All actual patching stays in `socket-patch apply`.
-//!
-//! The committed dependency line is the single source of truth that the hook is
-//! active — there is no separate marker/audit file (git history is the audit
-//! trail), so nothing can drift out of sync with the manifest.
-
-pub mod detect;
-pub mod edit;
diff --git a/crates/socket-patch-core/src/telemetry.rs b/crates/socket-patch-core/src/telemetry.rs
index 3a1dd4bb..752a83eb 100644
--- a/crates/socket-patch-core/src/telemetry.rs
+++ b/crates/socket-patch-core/src/telemetry.rs
@@ -50,7 +50,6 @@ enum PatchTelemetryEventType {
     PatchListed,
     PatchRepaired,
     PatchRepairFailed,
-    PatchSetup,
     // OpenVEX attestation (added in #81)
     VexGenerated,
     VexFailed,
@@ -75,7 +74,6 @@ impl PatchTelemetryEventType {
             Self::PatchListed => "patch_listed",
             Self::PatchRepaired => "patch_repaired",
             Self::PatchRepairFailed => "patch_repair_failed",
-            Self::PatchSetup => "patch_setup",
             Self::VexGenerated => "vex_generated",
             Self::VexFailed => "vex_failed",
         }
@@ -790,7 +788,7 @@ pub async fn track_patch_fetch_failed(
 }
 
 // ---------------------------------------------------------------------------
-// Inspection / housekeeping trackers: list / repair / setup
+// Inspection / housekeeping trackers: list / repair
 // ---------------------------------------------------------------------------
 
 /// Track a successful `list`. Reports the number of patches surfaced.
@@ -850,22 +848,6 @@ pub async fn track_patch_repair_failed(
     .await;
 }
 
-/// Track a successful `setup`. Reports the detected package manager so
-/// we can tell which install hooks are exercised in the wild: the
-/// `+`-joined in-scope tags, where the npm-family tag is `npm`, `pnpm` or
-/// `vlt` (e.g. `vlt+pypi`), or `none`.
-pub async fn track_patch_setup(manager: &str, api_token: Option<&str>, org_slug: Option<&str>) {
-    fire(
-        PatchTelemetryEventType::PatchSetup,
-        "setup",
-        serde_json::json!({ "manager": manager }),
-        None::<&str>,
-        api_token,
-        org_slug,
-    )
-    .await;
-}
-
 // ---------------------------------------------------------------------------
 // OpenVEX trackers
 // ---------------------------------------------------------------------------
@@ -1252,7 +1234,6 @@ mod tests {
             PatchTelemetryEventType::PatchRepairFailed.as_str(),
             "patch_repair_failed"
         );
-        assert_eq!(PatchTelemetryEventType::PatchSetup.as_str(), "patch_setup");
         // OpenVEX
         assert_eq!(
             PatchTelemetryEventType::VexGenerated.as_str(),
diff --git a/crates/socket-patch-core/src/update/channel.rs b/crates/socket-patch-core/src/update/channel.rs
index 18f768dc..32a8c788 100644
--- a/crates/socket-patch-core/src/update/channel.rs
+++ b/crates/socket-patch-core/src/update/channel.rs
@@ -142,7 +142,7 @@ fn is_vlx_cache_dir(dir: &Path) -> bool {
     crate::utils::fs::read_regular_to_string_sync(&dir.join("package.json"))
         .ok()
         .and_then(|text| {
-            serde_json::from_str::<serde_json::Value>(crate::package_json::detect::strip_bom(&text))
+            serde_json::from_str::<serde_json::Value>(crate::utils::serde::strip_bom(&text))
                 .ok()
         })
         .is_some_and(|pkg| pkg.get("name").and_then(|n| n.as_str()) == Some("vlx"))
diff --git a/crates/socket-patch-core/src/utils/fs.rs b/crates/socket-patch-core/src/utils/fs.rs
index b03dc302..a9e2b2e2 100644
--- a/crates/socket-patch-core/src/utils/fs.rs
+++ b/crates/socket-patch-core/src/utils/fs.rs
@@ -31,7 +31,6 @@
 
 use std::path::{Path, PathBuf};
 
-use std::fs::FileType;
 use tokio::fs::DirEntry;
 
 /// List the immediate children of `path`.
@@ -370,7 +369,8 @@ pub async fn remove_link(path: &Path) -> std::io::Result<()> {
 /// be treated as scannable-but-non-recurseable). The returned
 /// `FileType` is the symlink-aware kind from `entry.file_type()`,
 /// not the resolved-target kind from `metadata()`.
-pub(crate) async fn entry_file_type(entry: &DirEntry) -> Option<FileType> {
+#[cfg(test)]
+pub(crate) async fn entry_file_type(entry: &DirEntry) -> Option<std::fs::FileType> {
     entry.file_type().await.ok()
 }
 
diff --git a/crates/socket-patch-core/src/utils/hatch.rs b/crates/socket-patch-core/src/utils/hatch.rs
index 8ec5ad07..a08d79a9 100644
--- a/crates/socket-patch-core/src/utils/hatch.rs
+++ b/crates/socket-patch-core/src/utils/hatch.rs
@@ -201,7 +201,7 @@ fn rewrite_project(
                     .any(|v| matches!(v.as_str(), Some("dependencies" | "optional-dependencies")))
             })
         {
-            return Err("dynamic project dependencies require the install hook".into());
+            return Err("dynamic project dependencies require agent mode".into());
         }
         if let Some(dependencies) = project
             .as_table_like_mut()
@@ -230,7 +230,7 @@ fn rewrite_project(
         {
             let group_matches = rewrite_array(dependencies, name, version, url)?;
             if group_matches > 0 && url.starts_with("{root:uri}") {
-                return Err("Hatch does not expand root placeholders in dependency groups; use environment dependencies or the install hook".into());
+                return Err("Hatch does not expand root placeholders in dependency groups; use environment dependencies or agent mode".into());
             }
             matched += group_matches;
         }
@@ -245,7 +245,7 @@ fn rewrite_environments(
     url: &str,
 ) -> Result<usize, String> {
     if hatch.get("sources").is_some() || hatch.get("env").is_some() {
-        return Err("Hatch sources and environment plugins require the install hook".into());
+        return Err("Hatch sources and environment plugins require agent mode".into());
     }
     let mut matched = 0;
     if let Some(environments) = hatch
@@ -265,7 +265,7 @@ fn rewrite_environments(
                     .is_some_and(|kind| kind != "virtual")
             {
                 return Err(
-                    "Hatch sources, overrides and custom environments require the install hook"
+                    "Hatch sources, overrides and custom environments require agent mode"
                         .into(),
                 );
             }
@@ -420,7 +420,7 @@ pub fn plan(
             .clone();
     }
     if matched == 0 {
-        return Err(format!("{name}=={version} has no explicit Hatch declaration; transitive-only dependencies require the install hook"));
+        return Err(format!("{name}=={version} has no explicit Hatch declaration; transitive-only dependencies require agent mode"));
     }
     let permission = if project_matched > 0 {
         let external = external_keys.iter().any(|key| key == "metadata");
diff --git a/crates/socket-patch-core/src/utils/mod.rs b/crates/socket-patch-core/src/utils/mod.rs
index 80a6dda9..d9b40398 100644
--- a/crates/socket-patch-core/src/utils/mod.rs
+++ b/crates/socket-patch-core/src/utils/mod.rs
@@ -23,13 +23,4 @@ pub mod socket_dir;
 pub(crate) mod toml_edit_ext;
 pub mod uri;
 
-// Moved modules — these re-exports keep the old `utils::*` paths compiling
-// for external consumers of the published crate. Internal code must import
-// the new canonical paths; CI greps reject new uses of the old ones. Drop
-// these aliases at 5.0.
-pub use crate::api::date;
-pub use crate::crawlers::fuzzy_match;
-pub use crate::manifest::cleanup_blobs;
-pub use crate::telemetry;
-
 pub mod hatch;
diff --git a/crates/socket-patch-core/src/utils/process.rs b/crates/socket-patch-core/src/utils/process.rs
index 81bb2a22..2c9a074b 100644
--- a/crates/socket-patch-core/src/utils/process.rs
+++ b/crates/socket-patch-core/src/utils/process.rs
@@ -113,13 +113,6 @@ pub fn command_for(program: &Path) -> Command {
     Command::new(program)
 }
 
-/// [`resolve_tool`] + [`command_for`]: the command for the tool `name` found
-/// on an absolute PATH entry, or `None` when there is none — the caller
-/// decides how "not installed" degrades (a warning, a refusal).
-pub fn tool_command(name: &str) -> Option<Command> {
-    resolve_tool(name).map(|program| command_for(&program))
-}
-
 /// Run an external binary with the given args and return its
 /// stdout, trimmed, when the spawn succeeded AND the process exited
 /// with a success status AND stdout is non-empty after trimming.
@@ -253,7 +246,7 @@ mod tests {
         assert_eq!(out.as_deref(), Some("forwarded"));
     }
 
-    // ───────────────────────── resolve_tool / tool_command ─────────────────────────
+    // ───────────────────────── resolve_tool / command_for ─────────────────────────
 
     /// Mark an existing file executable (no-op off Unix: PATHEXT rules there).
     fn set_executable(path: &Path) {
@@ -448,11 +441,4 @@ mod tests {
         let exe = resolve_tool_with("bun", &exe_only).expect("bun.exe resolves");
         assert_eq!(command_for(&exe).get_program(), exe.as_os_str());
     }
-
-    /// `tool_command` reads the REAL environment: a name that cannot be on
-    /// any PATH yields None (the caller's "not installed" arm).
-    #[test]
-    fn tool_command_is_none_for_an_absent_tool() {
-        assert!(tool_command("definitely-not-a-real-binary-1234567").is_none());
-    }
 }
diff --git a/crates/socket-patch-core/src/utils/serde.rs b/crates/socket-patch-core/src/utils/serde.rs
index 7f5f288c..666563d2 100644
--- a/crates/socket-patch-core/src/utils/serde.rs
+++ b/crates/socket-patch-core/src/utils/serde.rs
@@ -19,3 +19,12 @@ where
 {
     map.iter().collect::<BTreeMap<_, _>>().serialize(serializer)
 }
+
+/// Strip a leading UTF-8 BOM. npm and Node tolerate (and strip) a BOM in
+/// package.json, and cargo accepts one in Cargo.toml — files saved by Windows
+/// editors commonly carry one — but serde_json (and vex's TOML line scanner)
+/// reject it, so every parse of user-supplied manifest content must go through
+/// this first or toolchain-valid manifests error out.
+pub(crate) fn strip_bom(content: &str) -> &str {
+    content.strip_prefix('\u{feff}').unwrap_or(content)
+}
diff --git a/crates/socket-patch-core/src/utils/toml_edit_ext.rs b/crates/socket-patch-core/src/utils/toml_edit_ext.rs
index 5259a4e8..fcd85f7d 100644
--- a/crates/socket-patch-core/src/utils/toml_edit_ext.rs
+++ b/crates/socket-patch-core/src/utils/toml_edit_ext.rs
@@ -1,7 +1,5 @@
 //! Small structured-TOML helpers shared by every module that edits or sniffs
-//! TOML (`setup::pypi`, `vendor::cargo_config`, `vendor::pypi`,
-//! `vendor::pypi_uv`). Extracted from the pypi setup backend (now `setup::pypi`) so it no
-//! longer owns the crate's generic TOML seam.
+//! TOML (`vendor::cargo_config`, `vendor::pypi`, `vendor::pypi_uv`).
 
 use toml_edit::{Item, Table};
 
diff --git a/crates/socket-patch-core/src/vendor/npm_common.rs b/crates/socket-patch-core/src/vendor/npm_common.rs
index 88cf6331..0c6e89f3 100644
--- a/crates/socket-patch-core/src/vendor/npm_common.rs
+++ b/crates/socket-patch-core/src/vendor/npm_common.rs
@@ -287,7 +287,7 @@ pub(super) async fn stage_patch_pack(
         // bundled-deps refusal below.
         let text = String::from_utf8_lossy(&bytes);
         if let Ok(pkg) =
-            serde_json::from_str::<Value>(crate::package_json::detect::strip_bom(&text))
+            serde_json::from_str::<Value>(crate::utils::serde::strip_bom(&text))
         {
             if declares_bundled_deps(&pkg) {
                 return Err(Box::new(refused(
diff --git a/crates/socket-patch-core/src/vendor/npm_dir.rs b/crates/socket-patch-core/src/vendor/npm_dir.rs
index 82cfd580..1887f0ff 100644
--- a/crates/socket-patch-core/src/vendor/npm_dir.rs
+++ b/crates/socket-patch-core/src/vendor/npm_dir.rs
@@ -801,7 +801,7 @@ async fn read_manifest(dir: &Path) -> Result<Value, String> {
     let text = crate::utils::fs::read_regular_to_string(&dir.join("package.json"))
         .await
         .map_err(|e| format!("package.json unreadable: {e}"))?;
-    serde_json::from_str(crate::package_json::detect::strip_bom(&text))
+    serde_json::from_str(crate::utils::serde::strip_bom(&text))
         .map_err(|e| format!("package.json is not parseable JSON: {e}"))
 }
 
diff --git a/crates/socket-patch-core/src/vendor/pypi.rs b/crates/socket-patch-core/src/vendor/pypi.rs
index b3d9c0b6..2492d1e2 100644
--- a/crates/socket-patch-core/src/vendor/pypi.rs
+++ b/crates/socket-patch-core/src/vendor/pypi.rs
@@ -224,8 +224,8 @@ pub async fn finish_hosted_wheel_metadata(
 }
 
 const SETUP_ALTERNATIVE: &str =
-    "use the `socket-patch setup` .pth install hook instead, which patches installed \
-     site-packages without lockfile edits";
+    "use agent mode instead (`scan --mode agent`, then `socket-patch apply` after each \
+     install), which patches installed site-packages without lockfile edits";
 
 /// Route the project to a wiring flavor, first match wins. Lockfiles are the
 /// authoritative "this tool manages installs" signal, so locks are compared
@@ -2148,7 +2148,7 @@ mod tests {
         let err = detect_pypi_flavor(tmp.path(), None).await.unwrap_err();
         assert_eq!(err.0, "pypi_uv_no_lockfile");
         assert!(err.1.contains("uv lock"));
-        assert!(err.1.contains("socket-patch setup"));
+        assert!(err.1.contains("scan --mode agent"));
 
         let tmp = tempfile::tempdir().unwrap();
         touch(
@@ -2210,7 +2210,7 @@ mod tests {
         let tmp = tempfile::tempdir().unwrap();
         let err = detect_pypi_flavor(tmp.path(), None).await.unwrap_err();
         assert_eq!(err.0, "pypi_no_requirements");
-        assert!(err.1.contains("socket-patch setup"));
+        assert!(err.1.contains("scan --mode agent"));
     }
 
     /// mkfifo(2) directly rather than shelling out to the `mkfifo` binary —
diff --git a/crates/socket-patch-core/src/vendor/pypi_hatch.rs b/crates/socket-patch-core/src/vendor/pypi_hatch.rs
index a00b4daf..c82d73e0 100644
--- a/crates/socket-patch-core/src/vendor/pypi_hatch.rs
+++ b/crates/socket-patch-core/src/vendor/pypi_hatch.rs
@@ -133,7 +133,7 @@ async fn require_environment_context_support(root: &Path) -> Result<(), Failure>
             return Ok(());
         }
     }
-    Err(("pypi_hatch_unsupported", "vendored environment dependencies require Hatch >=1.2 on PATH for root URI expansion; upgrade Hatch or use the install hook".into()))
+    Err(("pypi_hatch_unsupported", "vendored environment dependencies require Hatch >=1.2 on PATH for root URI expansion; upgrade Hatch or use agent mode".into()))
 }
 
 async fn write_files(
diff --git a/crates/socket-patch-core/src/vendor/pypi_requirements.rs b/crates/socket-patch-core/src/vendor/pypi_requirements.rs
index 942e6c67..00f4e113 100644
--- a/crates/socket-patch-core/src/vendor/pypi_requirements.rs
+++ b/crates/socket-patch-core/src/vendor/pypi_requirements.rs
@@ -450,8 +450,8 @@ async fn plan_requirements(
                     "pypi_extras_unsupported",
                     format!(
                         "{}: the {canon_name} pin declares extras, which a vendored wheel path \
-                         line cannot express; remove the extras or use the `socket-patch setup` \
-                         .pth install hook instead",
+                         line cannot express; remove the extras or use agent mode \
+                         (`scan --mode agent` + `socket-patch apply`) instead",
                         file.rel
                     ),
                 ));
@@ -461,7 +461,7 @@ async fn plan_requirements(
                     "pypi_requirement_not_pinned",
                     format!(
                         "{}: {canon_name} is not pinned to =={version}; pin it exactly or use \
-                         the `socket-patch setup` .pth install hook instead",
+                         agent mode (`scan --mode agent` + `socket-patch apply`) instead",
                         file.rel
                     ),
                 ));
@@ -477,8 +477,8 @@ async fn plan_requirements(
                 "pypi_requirements_outside_root",
                 format!(
                     "{}: {canon_name} is pinned in a requirements include outside the project \
-                     root, which vendor cannot edit; inline it or use the `socket-patch setup` \
-                     .pth install hook instead",
+                     root, which vendor cannot edit; inline it or use agent mode \
+                     (`scan --mode agent` + `socket-patch apply`) instead",
                     file.rel
                 ),
             ));
diff --git a/crates/socket-patch-core/src/vendor/vlt_lock.rs b/crates/socket-patch-core/src/vendor/vlt_lock.rs
index fe434149..49c708f5 100644
--- a/crates/socket-patch-core/src/vendor/vlt_lock.rs
+++ b/crates/socket-patch-core/src/vendor/vlt_lock.rs
@@ -599,7 +599,7 @@ fn check_declarations(
                 format!("{pkg_rel} is missing; run `vlt install` first"),
             )
         })?;
-        let value: Value = serde_json::from_str(crate::package_json::detect::strip_bom(text))
+        let value: Value = serde_json::from_str(crate::utils::serde::strip_bom(text))
             .map_err(|_| (OUT_OF_SYNC, format!("{pkg_rel} is not valid JSON")))?;
         let declared = ["dependencies", "devDependencies", "optionalDependencies"]
             .iter()
@@ -732,7 +732,7 @@ pub async fn vlt_vendor_preflight(
         .join(PACKAGE_JSON);
     if let Ok(text) = read_regular_to_string(&store).await {
         if let Ok(pkg) =
-            serde_json::from_str::<Value>(crate::package_json::detect::strip_bom(&text))
+            serde_json::from_str::<Value>(crate::utils::serde::strip_bom(&text))
         {
             if super::npm_common::declares_bundled_deps(&pkg) {
                 return Err((
diff --git a/crates/socket-patch-core/src/vendor/vlt_lock_text.rs b/crates/socket-patch-core/src/vendor/vlt_lock_text.rs
index c7c54822..214a47d0 100644
--- a/crates/socket-patch-core/src/vendor/vlt_lock_text.rs
+++ b/crates/socket-patch-core/src/vendor/vlt_lock_text.rs
@@ -1015,8 +1015,7 @@ mod tests {
     use super::*;
 
     use crate::constants::npm_family::{
-        VLT_CONFIG, VLT_HIDDEN_LOCK_REL, VLT_LEGACY_WORKSPACES, VLT_LOCK, VLT_SETUP_MARKERS,
-        VLT_STORE_DIR,
+        VLT_CONFIG, VLT_HIDDEN_LOCK_REL, VLT_LEGACY_WORKSPACES, VLT_LOCK, VLT_STORE_DIR,
     };
 
     const UUID: &str = "0b1f6e2a-3c4d-4e5f-8a9b-0c1d2e3f4a5b";
@@ -2523,15 +2522,6 @@ mod tests {
         assert_eq!(VLT_HIDDEN_LOCK_REL, "node_modules/.vlt-lock.json");
         assert_eq!(VLT_STORE_DIR, "node_modules/.vlt");
         assert_eq!(VLT_LEGACY_WORKSPACES, "vlt-workspaces.json");
-        assert_eq!(
-            VLT_SETUP_MARKERS,
-            [
-                "vlt-lock.json",
-                "vlt.json",
-                "node_modules/.vlt-lock.json",
-                "node_modules/.vlt"
-            ]
-        );
     }
 
     #[test]
diff --git a/crates/socket-patch-core/src/vex/product.rs b/crates/socket-patch-core/src/vex/product.rs
index 618a1ebf..13a58f2e 100644
--- a/crates/socket-patch-core/src/vex/product.rs
+++ b/crates/socket-patch-core/src/vex/product.rs
@@ -37,7 +37,7 @@ use std::path::Path;
 // git reads a BOM'd `.git/config`, but serde_json and the line scanners all
 // reject it — without this, files the user's own toolchain accepts yield no
 // PURL.
-use crate::package_json::detect::strip_bom;
+use crate::utils::serde::strip_bom;
 
 /// Version-extracting parser for one manifest flavor, keyed by file name in
 /// the priority table inside [`detect_product`].
diff --git a/crates/socket-patch-core/tests/crawler_monorepo_gaps.rs b/crates/socket-patch-core/tests/crawler_monorepo_gaps.rs
index e7fe1eb2..9f516cbc 100644
--- a/crates/socket-patch-core/tests/crawler_monorepo_gaps.rs
+++ b/crates/socket-patch-core/tests/crawler_monorepo_gaps.rs
@@ -17,8 +17,7 @@
 //! discoverable. The second is a GAP pin (`#[ignore]`): crawling from the repo
 //! root should aggregate every subproject's gems. It is the executable spec for
 //! the intended multi-lockfile discovery; un-ignore it when that ships. See
-//! CLI_CONTRACT.md "Setup command contract" → "Monorepo / multi-project
-//! discovery model".
+//! CLI_CONTRACT.md "Monorepo / multi-project discovery model".
 
 use std::path::Path;
 
@@ -83,7 +82,7 @@ async fn gem_crawl_from_subproject_cwd_finds_its_own_gems() {
 // ── GAP: aggregate crawl from the repo root (multi-lockfile) ──────────────
 
 #[tokio::test]
-#[ignore = "gap: non-npm crawlers (gem/python/go/composer) are cwd-only and do not discover per-subproject lockfiles from the repo root; see CLI_CONTRACT 'Setup command contract' → Monorepo / multi-project discovery model"]
+#[ignore = "gap: non-npm crawlers (gem/python/go/composer) are cwd-only and do not discover per-subproject lockfiles from the repo root; see CLI_CONTRACT 'Monorepo / multi-project discovery model'"]
 async fn gem_crawl_from_repo_root_discovers_all_subproject_lockfiles() {
     let tmp = tempfile::tempdir().unwrap();
     let backend = tmp.path().join("backend");
diff --git a/crates/socket-patch-core/tests/crawler_npm_e2e.rs b/crates/socket-patch-core/tests/crawler_npm_e2e.rs
index 6aa419da..d3fbc903 100644
--- a/crates/socket-patch-core/tests/crawler_npm_e2e.rs
+++ b/crates/socket-patch-core/tests/crawler_npm_e2e.rs
@@ -951,8 +951,8 @@ async fn crawl_all_discovers_deeply_nested_transitive_deps() {
     // patchable — exactly like a direct dependency (apply is path-agnostic). The
     // other nested tests stage only 2 levels; this pins 4, so a regression that
     // capped recursion depth (or stopped descending after the first nested
-    // node_modules) would surface here. See CLI_CONTRACT "Setup command contract"
-    // → "Monorepo / multi-project discovery model".
+    // node_modules) would surface here. See CLI_CONTRACT "Monorepo /
+    // multi-project discovery model".
     let tmp = tempfile::tempdir().unwrap();
     let nm = tmp.path().join("node_modules");
 
diff --git a/crates/socket-patch-core/tests/crawler_ruby_e2e.rs b/crates/socket-patch-core/tests/crawler_ruby_e2e.rs
index dd91d398..cca7f92b 100644
--- a/crates/socket-patch-core/tests/crawler_ruby_e2e.rs
+++ b/crates/socket-patch-core/tests/crawler_ruby_e2e.rs
@@ -433,13 +433,10 @@ async fn get_gem_paths_with_gemfile_lock_only_returns_gemdir() {
 }
 
 /// Bundler accepts `gems.rb` as the alternate spelling of `Gemfile`
-/// (`Bundler::SharedHelpers.default_gemfile`), and
-/// `setup::gem::discover_bundler_project` already walks up for it — so
-/// `setup` will wire a `gems.rb` project with the bundler plugin that runs
-/// `apply` on every `bundle install`. The crawler's project gate must
-/// recognize the same spelling; otherwise that project's non-deployment
-/// install (no vendor/bundle) yields zero gem paths and every scan/apply
-/// there is a silent no-op.
+/// (`Bundler::SharedHelpers.default_gemfile`). The crawler's project gate
+/// must recognize the same spelling; otherwise a `gems.rb` project's
+/// non-deployment install (no vendor/bundle) yields zero gem paths and
+/// every scan/apply there is a silent no-op.
 #[cfg(unix)]
 #[tokio::test]
 #[serial]
diff --git a/docs/design/v5-plan.md b/docs/design/v5-plan.md
index 03126805..7d3612f2 100644
--- a/docs/design/v5-plan.md
+++ b/docs/design/v5-plan.md
@@ -173,6 +173,18 @@ patch-UI review.
   `socket-patch-hook` wheel publishing (or mark them deprecated/unpublished;
   confirm with owner before deleting release workflows). Keep `apply`.
   Docs: agent mode = `scan --mode agent` + `socket-patch apply` in CI.
+- **Status (branch `v5/remove-setup-and-ui`):** subcommand, core `setup/` +
+  `package_json/`, setup tests, `setup-e2e` feature, setup-matrix CI job,
+  `tests/setup_matrix/`, `scripts/setup-matrix.sh` and the setup-only
+  `Dockerfile.gem-b1`/`gem-b4` are deleted. vex's "Property 7" filter went
+  with it (agent patches attest on verification; `setup.manual` is parsed
+  but ignored). The `socket-patch-hook` wheel and `socket-patch-bundler` gem
+  are out of `publish-pypi.yml` / `publish-rubygems.yml`,
+  `build-pypi-wheels.py` and `version-sync.sh`, and the `socket-patch[hook]`
+  extra is dropped. **Owner decision pending:** `pypi/socket-patch-hook/`
+  and `gem/socket-patch-bundler/` sources are kept (frozen, README marked
+  deprecated) — delete them, and optionally yank/deprecate the published
+  packages and remove their PyPI/RubyGems trusted publishers, once confirmed.
 
 ### WS8 — Patch UI streamlining  *(branch `v5/ui`)*
 - `-h` shows ~8 options (hide_short_help for the rest); hide deprecated
@@ -182,6 +194,18 @@ patch-UI review.
   manifest says "No patches in this project"; unify cancel/upsell strings;
   exit 2 for all usage errors; scan/get JSON onto `json_envelope`.
 - Full item list: 22 findings from the UI review (sizes S/M/L, contract flags).
+- **Status (branch `v5/remove-setup-and-ui`):** done — short `-h`
+  (`cli_command()` hides the rest; `--help` unchanged), hidden
+  `scan --apply/--vendor`, one-line npm allow-remote note (`--verbose`/JSON
+  keep the detail), code-free `Warning:`/`GC: skipped:` lines (error lines keep their code),
+  "hosted" wording in human text, `ui::next_steps` shared by hosted and
+  vendored, prompt-free hosted/vendored `get` (JSON too), `list`'s
+  `No patches in this project.` line (exit 0, empty success envelope in JSON; was 1 missing,
+  0 empty), `ui::CANCELLED` / `ui::PAID_UPGRADE`, exit 2 for `get` and
+  `rollback --one-off` usage errors. **Not done:** scan/get JSON onto
+  `json_envelope` (larger contract change; deferred). Per-row
+  `[error] <purl> (<code>)` / `[would-refuse]` lines keep their codes
+  (grep-able under `--silent`).
 
 ### WS9 — Staged patch rollout  *(branches `v5/rollout-policy` (A), `v5/rollout-limit` (B))*
 - Added 2026-09-28 at the owner's request. `socket.yml` `patches:` policy
@@ -191,6 +215,10 @@ patch-UI review.
   `docs/design/staged-rollout.md`. Merge order A then B.
 
 ## Remaining small follow-ups
+*(All done on `v5/remove-setup-and-ui`: the vacuous rows are dropped,
+GEM_PATCHES has both patches, `tool_command` and the deprecated aliases —
+plus the CI grep that guarded them — are removed, and the backtest label is
+retired.)*
 - ci.yml `e2e_cargo`/`e2e_golang` rows select `--ignored` but have no ignored
   tests (vacuous legs) → give them `--include-ignored` or drop the rows.
 - `e2e_vendored_production` GEM_PATCHES lacks merged `01019627` (v5 ranking
diff --git a/docs/ecosystems.md b/docs/ecosystems.md
index 53e19101..48a09c60 100644
--- a/docs/ecosystems.md
+++ b/docs/ecosystems.md
@@ -14,15 +14,15 @@ The backticked slug in each row is the value `-e`/`--ecosystems` accepts (e.g.
 
 | Ecosystem | agent (`--mode agent`) | vendored (`--mode vendored`) | hosted (`--mode hosted`) |
 |-----------|------------------------|------------------------------|--------------------------|
-| npm (`npm`) — pnpm / yarn / berry / bun / vlt | ✅ any install layout, vlt's `node_modules/.vlt` store included (every store copy, copy-on-write); `setup` postinstall hook | ✅ seven lockfile flavors: package-lock, yarn classic, yarn berry (node-modules linker; PnP refused), pnpm v9, pnpm legacy v5.4/v6.0 (`pnpm 7/8` — frozen installs are path-bound because those majors absolutize `file:` override specifiers; moved checkouts run one `pnpm install --offline --no-frozen-lockfile`, surfaced as `vendor_pnpm_legacy_absolute_specifier`), bun text `bun.lock` lockfileVersion 0/1/2 and native binary `bun.lockb` revisions 1/2/3 (binary locks stay binary; text workspace vendoring requires lockfileVersion 2 — see [Bun compatibility](testing/bun-compatibility.md)), vlt `vlt-lock.json` lockfileVersion 0/1 (patched package directories for direct dependencies of the root or a workspace member; transitive targets refused — see [vlt notes](#npm-vlt-notes)). Rush monorepos refused (`vendor_rush_unsupported`) — see [Rush notes](#npm-rush-monorepos) | ✅ package-lock / npm-shrinkwrap, pnpm-lock.yaml and legacy shrinkwrap.yaml (pnpm majors 1–12; block and flow resolutions), yarn classic, yarn berry, bun, vlt (`vlt-lock.json` without `lockfileVersion`, 0 or 1) — pnpm, berry, bun and vlt carry constraints, see [npm hosted-mode notes](#npm-hosted-mode-notes) and [vlt notes](#npm-vlt-notes) |
-| PyPI (`pypi`) — uv / poetry / pdm / pipenv / pip | ✅ `.pth` startup hook via `setup` | ✅ uv project/script locks, PEP 751 `pylock.toml` / `pylock.<name>.toml`, poetry, pdm, pipenv (Pipenv 2018 or later — every `Pipfile.lock` category is rewired, lock-only checkouts included; Pipenv 2023+ does not hash-check local wheels — `vendor_integrity_unverified`; a venv still holding the upstream release is reported as `pypi_pipenv_stale_install`; see [Pipenv compatibility](testing/pipenv-compatibility.md)), and requirements.txt. Native uv vendoring requires uv ≥ 0.2.35 (the `[[package]]` lock grammar); hosted mode covers native `uv.lock` from uv 0.1.45 (the first release whose `uv lock` writes one) and requirements from uv 0.0.5; see [uv compatibility](testing/uv-compatibility.md). | ✅ requirements.txt including hash continuations, uv project/script locks, and PEP 751 locks. Version/source ambiguity is refused; see [uv compatibility](testing/uv-compatibility.md). Poetry 1.x and 2.x locks are supported; Poetry 0.x ignores URL sources and is refused. See [Poetry compatibility](testing/poetry-compatibility.md). Pipenv `Pipfile.lock` (pipfile-spec 6 — Pipenv 7 and later; `path` references for 7–11, `file` from 2018; lock-only checkouts and Pipenv's out-of-tree venv are discovered; a warm venv that Pipenv will not reinstall over warns `redirect_pypi_stale_install`; see [Pipenv compatibility](testing/pipenv-compatibility.md)). `pdm.lock` is supported for the lock formats PDM 0.12–1.4 and 2.8.1+ write (`lock_version` 2 / 4.3–4.5.1); the identity-losing 3.1 / 4.0–4.2 formats (PDM 1.8–2.7) are refused. PDM 2.8.0 writes an indistinguishable `4.3` lock but shares that identity-loss bug, so a rewritten 2.8.0 lock crashes `pdm sync` — upgrade to ≥ 2.8.1. See [PDM compatibility](testing/pdm-compatibility.md). |
+| npm (`npm`) — pnpm / yarn / berry / bun / vlt | ✅ any install layout, vlt's `node_modules/.vlt` store included (every store copy, copy-on-write) | ✅ seven lockfile flavors: package-lock, yarn classic, yarn berry (node-modules linker; PnP refused), pnpm v9, pnpm legacy v5.4/v6.0 (`pnpm 7/8` — frozen installs are path-bound because those majors absolutize `file:` override specifiers; moved checkouts run one `pnpm install --offline --no-frozen-lockfile`, surfaced as `vendor_pnpm_legacy_absolute_specifier`), bun text `bun.lock` lockfileVersion 0/1/2 and native binary `bun.lockb` revisions 1/2/3 (binary locks stay binary; text workspace vendoring requires lockfileVersion 2 — see [Bun compatibility](testing/bun-compatibility.md)), vlt `vlt-lock.json` lockfileVersion 0/1 (patched package directories for direct dependencies of the root or a workspace member; transitive targets refused — see [vlt notes](#npm-vlt-notes)). Rush monorepos refused (`vendor_rush_unsupported`) — see [Rush notes](#npm-rush-monorepos) | ✅ package-lock / npm-shrinkwrap, pnpm-lock.yaml and legacy shrinkwrap.yaml (pnpm majors 1–12; block and flow resolutions), yarn classic, yarn berry, bun, vlt (`vlt-lock.json` without `lockfileVersion`, 0 or 1) — pnpm, berry, bun and vlt carry constraints, see [npm hosted-mode notes](#npm-hosted-mode-notes) and [vlt notes](#npm-vlt-notes) |
+| PyPI (`pypi`) — uv / poetry / pdm / pipenv / pip | ✅ in place | ✅ uv project/script locks, PEP 751 `pylock.toml` / `pylock.<name>.toml`, poetry, pdm, pipenv (Pipenv 2018 or later — every `Pipfile.lock` category is rewired, lock-only checkouts included; Pipenv 2023+ does not hash-check local wheels — `vendor_integrity_unverified`; a venv still holding the upstream release is reported as `pypi_pipenv_stale_install`; see [Pipenv compatibility](testing/pipenv-compatibility.md)), and requirements.txt. Native uv vendoring requires uv ≥ 0.2.35 (the `[[package]]` lock grammar); hosted mode covers native `uv.lock` from uv 0.1.45 (the first release whose `uv lock` writes one) and requirements from uv 0.0.5; see [uv compatibility](testing/uv-compatibility.md). | ✅ requirements.txt including hash continuations, uv project/script locks, and PEP 751 locks. Version/source ambiguity is refused; see [uv compatibility](testing/uv-compatibility.md). Poetry 1.x and 2.x locks are supported; Poetry 0.x ignores URL sources and is refused. See [Poetry compatibility](testing/poetry-compatibility.md). Pipenv `Pipfile.lock` (pipfile-spec 6 — Pipenv 7 and later; `path` references for 7–11, `file` from 2018; lock-only checkouts and Pipenv's out-of-tree venv are discovered; a warm venv that Pipenv will not reinstall over warns `redirect_pypi_stale_install`; see [Pipenv compatibility](testing/pipenv-compatibility.md)). `pdm.lock` is supported for the lock formats PDM 0.12–1.4 and 2.8.1+ write (`lock_version` 2 / 4.3–4.5.1); the identity-losing 3.1 / 4.0–4.2 formats (PDM 1.8–2.7) are refused. PDM 2.8.0 writes an indistinguishable `4.3` lock but shares that identity-loss bug, so a rewritten 2.8.0 lock crashes `pdm sync` — upgrade to ≥ 2.8.1. See [PDM compatibility](testing/pdm-compatibility.md). |
 | Cargo (`cargo`) | ✅ in-place + `.cargo-checksum.json` rewrite (shared registry-cache caveat — see [Cargo: shared registry cache](#cargo-shared-registry-cache)) | ✅ `[patch.crates-io]` path entry in the root `Cargo.toml` (v5; per-version Socket keys; pre-v5 `.cargo/config*` wiring migrates on re-run) | ✅ per-patch sparse registry (`[registries.socket-patch-<uuid>]` + Cargo.lock source/checksum); direct dependencies only — a crate another dependency also pulls in is refused, use `--mode vendored`; with no `Cargo.lock` the graph is unknown, so only a project whose sole dependency is the patched crate is redirected |
-| RubyGems (`gem`) | ✅ Bundler plugin via `setup` — needs bundler ≥ 2.2 (1.x cannot load `plugin ... path:` directives; `setup` refuses below the floor and `setup --check` red-flags a wired 1.x project) | ✅ Gemfile + Gemfile.lock path pair (`Gemfile` spelling only — a `gems.rb` project cannot vendor yet) | ✅ per-dep `source` block — edits `gems.rb` + `gems.locked` when present (bundler prefers them over `Gemfile`; spellings that diverge beyond Socket's own edits fail closed with `redirect_gem_gemfile_spellings_diverge`); the `CHECKSUMS` pin needs bundler ≥ 2.6 (older locks get a `redirect_gem_no_checksums_section` warning); a stale pre-redirect materialization that `bundle install` would reuse instead of refetching is flagged `redirect_gem_stale_install` with a prescriptive remedy (see CLI_CONTRACT.md's "Gem stale-install guard") |
+| RubyGems (`gem`) | ✅ in place | ✅ Gemfile + Gemfile.lock path pair (`Gemfile` spelling only — a `gems.rb` project cannot vendor yet) | ✅ per-dep `source` block — edits `gems.rb` + `gems.locked` when present (bundler prefers them over `Gemfile`; spellings that diverge beyond Socket's own edits fail closed with `redirect_gem_gemfile_spellings_diverge`); the `CHECKSUMS` pin needs bundler ≥ 2.6 (older locks get a `redirect_gem_no_checksums_section` warning); a stale pre-redirect materialization that `bundle install` would reuse instead of refetching is flagged `redirect_gem_stale_install` with a prescriptive remedy (see CLI_CONTRACT.md's "Gem stale-install guard") |
 | Go (`golang`) | ✅ `go.mod` `replace` → `.socket/go-patches/` — see [Go: directory replaces and go.sum](#go-directory-replaces-and-gosum) | ✅ `replace` → the committed vendor tree | ✅ (free tier) fork-style `replace` → `patch.socket.dev/gopatch/<uuid>` + committed `go.sum` pin; see [golang-hosted.md](design/golang-hosted.md). Paid tier stays ❌ ([golang-hosted-no-go.md](design/golang-hosted-no-go.md)); `redirect_golang_unsupported` names the vendored remedy |
-| Maven (`maven`) | ✅ apply-only (no `setup` hook — reports `no_files`); in-place jar patching leaves the `~/.m2` checksum sidecars stale — prefer vendored / hosted, see [Maven & NuGet caveats](#maven--nuget-caveats) | ✅ committed maven2 `file://` repository. A root pom declaring `<modules>` (multi-module aggregator) is refused (`vendor_maven_multimodule_unsupported`), and a gradle-only project is refused (`vendor_gradle_unsupported`) | ✅ **pom projects only, fail-closed** — the patched jar is pinned at a Socket-only `<version>-socket.<hex8>` suffix; `${property}` versions are refused; Gradle gets a manual `exclusiveContent` snippet — see [Maven & NuGet caveats](#maven--nuget-caveats) |
-| NuGet (`nuget`) | ✅ apply-only (no `setup` hook — reports `no_files`); in-place patching deletes `.nupkg.metadata` and advises on the `.nupkg.sha512` tamper-evidence sidecar — prefer vendored / hosted, see [Maven & NuGet caveats](#maven--nuget-caveats) | ✅ committed folder feed + `packageSourceMapping` + `packages.lock.json` contentHash pin | ✅ `nuget.config` source + source-mapping, `packages.lock.json` contentHash rewrite. See the locked-mode note in [Maven & NuGet caveats](#maven--nuget-caveats) |
-| Composer (`composer`) | ✅ post-install script events | ✅ `composer.lock` `dist: path` rewrite | ✅ `composer.lock` dist url + shasum rewrite |
-| Deno (`deno`) | ✅ apply-only — no install hook (`setup` reports `no_files`); declare in `setup.manual` for VEX coverage | ❌ refused (`vendor_unsupported_ecosystem`) | ❌ not supported |
+| Maven (`maven`) | ✅ in-place jar patching leaves the `~/.m2` checksum sidecars stale — prefer vendored / hosted, see [Maven & NuGet caveats](#maven--nuget-caveats) | ✅ committed maven2 `file://` repository. A root pom declaring `<modules>` (multi-module aggregator) is refused (`vendor_maven_multimodule_unsupported`), and a gradle-only project is refused (`vendor_gradle_unsupported`) | ✅ **pom projects only, fail-closed** — the patched jar is pinned at a Socket-only `<version>-socket.<hex8>` suffix; `${property}` versions are refused; Gradle gets a manual `exclusiveContent` snippet — see [Maven & NuGet caveats](#maven--nuget-caveats) |
+| NuGet (`nuget`) | ✅ in-place patching deletes `.nupkg.metadata` and advises on the `.nupkg.sha512` tamper-evidence sidecar — prefer vendored / hosted, see [Maven & NuGet caveats](#maven--nuget-caveats) | ✅ committed folder feed + `packageSourceMapping` + `packages.lock.json` contentHash pin | ✅ `nuget.config` source + source-mapping, `packages.lock.json` contentHash rewrite. See the locked-mode note in [Maven & NuGet caveats](#maven--nuget-caveats) |
+| Composer (`composer`) | ✅ in place (`vendor/`) | ✅ `composer.lock` `dist: path` rewrite | ✅ `composer.lock` dist url + shasum rewrite |
+| Deno (`deno`) | ✅ in place (the only mode for Deno) | ❌ refused (`vendor_unsupported_ecosystem`) | ❌ not supported |
 
 > **Maven / NuGet sidecar caveat**: Maven and NuGet are fully enabled in every mode.
 > In-place (agent-mode) patching leaves the caches' own checksum sidecars stale: NuGet's
@@ -293,13 +293,7 @@ directory) or a link still into the vendored directory.
 replace each file instead of writing through it, so vlt 1.2's shared store (hardlinked on
 Linux) and every other project linked to it keep their bytes. A patch survives `vlt
 install`, `install <new>`, `uninstall` and frozen installs; `vlt ci` and deleting
-`node_modules` restore the upstream bytes, which is what the setup hook is for.
-
-**Setup.** vlt gets npm's `npx @socketsecurity/socket-patch apply --silent --ecosystems
-npm` postinstall hook, wired at the workspace root only (vlt runs the root hook once per
-install that changes the graph, never on a no-op install). vlt before 1.0.0-rc.13 never
-runs a root `postinstall` without an `install` script: `setup` still wires it and warns
-`vlt_root_scripts_not_run`. A failing hook aborts and rolls back the whole `vlt install`.
+`node_modules` restore the upstream bytes; run `socket-patch apply` after them.
 
 **Locale.** vlt sorts its lock with the process locale for one key, so byte-stability is
 claimed only for `en`-equivalent locales (`LANG` unset, `C`, `POSIX` or `en_US`); every vlt
diff --git a/docs/testing/hatch.md b/docs/testing/hatch.md
index 2d730358..fa174297 100644
--- a/docs/testing/hatch.md
+++ b/docs/testing/hatch.md
@@ -19,7 +19,7 @@ A build backend alone does not change which existing pip inputs are wired.
 
 A range, transitive-only declaration, dynamic dependency metadata, custom
 environment plugin, source table or conditional override is refused before
-writing. Use the install hook for these shapes. Hosted PEP 735 groups are
+writing. Use agent mode (`scan --mode agent` + `socket-patch apply` in CI) for these shapes. Hosted PEP 735 groups are
 supported; vendored groups are refused because Hatch does not expand
 `{root:uri}` within dependency groups. Unknown direct sources require an
 explicit revert before patching.
diff --git a/docs/testing/poetry-compatibility.md b/docs/testing/poetry-compatibility.md
index 381c9419..28848071 100644
--- a/docs/testing/poetry-compatibility.md
+++ b/docs/testing/poetry-compatibility.md
@@ -145,7 +145,7 @@ python3 scripts/backtest-poetry.py \
   --cli /tmp/socket-patch-under-test \
   --cli-revision "$(git rev-parse --short HEAD)" \
   --output /tmp/socket-patch-poetry-backtest \
-  --modes hosted vendored agent agent-oot setup \
+  --modes hosted vendored agent agent-oot \
   --shapes direct populated crlf pep621
 python3 scripts/backtest-poetry.py --render-doc-table /tmp/socket-patch-poetry-backtest/summary.json
 ```
@@ -162,9 +162,8 @@ verifies, Poetry's own relock keeps the source, and `rollback` restores every
 byte and clears the ledgers. Shapes: `direct` (the committed native fixture),
 `populated` (legacy locks with real upstream hashes filled in — today's PyPI
 JSON API leaves old Poetry's `[metadata.files]` empty), `crlf`, and `pep621`
-(2.x `[project]` tables with `package-mode = false`). Modes `agent-oot`
-(Poetry's default out-of-tree virtualenv via `poetry run`) and `setup`
-(`socket-patch setup` on a Poetry project, then `poetry lock`) are
+(2.x `[project]` tables with `package-mode = false`). Mode `agent-oot`
+(Poetry's default out-of-tree virtualenv via `poetry run`) is
 informational.
 
 Rust coverage of the rewriters: `cargo test -p socket-patch-core --lib
diff --git a/docs/testing/vendored-production-e2e.md b/docs/testing/vendored-production-e2e.md
index 0d694500..e7d81330 100644
--- a/docs/testing/vendored-production-e2e.md
+++ b/docs/testing/vendored-production-e2e.md
@@ -49,7 +49,7 @@ three every run and fails first with the offending PURL named.
 |-----------|------|------------|-----------------------------|
 | npm | `pkg:npm/minimist@1.2.2` | `80630680-4da6-45f9-bba8-b888e0ffd58c` | `Socket Community Patch` header |
 | PyPI | `pkg:pypi/urllib3@1.26.18` | one of three (picked by the CLI's `api::ranking`; the suite accepts any) | `Socket Community Patch` header |
-| RubyGems | `pkg:gem/activestorage@6.0.3` | any of the `GEM_PATCHES` table (each patch marks a different file). The hosted doc lists 6 live UUIDs; `GEM_PATCHES` carries only the first 4 and lacks `9c2b4925` and the merged `01019627`, which v5 ranking now prefers | `Socket Community Patch` header |
+| RubyGems | `pkg:gem/activestorage@6.0.3` | any of the `GEM_PATCHES` table (each patch marks a different file): the same 6 live UUIDs as the hosted doc, including `9c2b4925` and the merged `01019627` that v5 ranking prefers | `Socket Community Patch` header |
 
 If a required patch is withdrawn, update the catalog constants at the top of
 `e2e_vendored_production.rs` **and** the table above (same procedure as the
diff --git a/docs/testing/vlt-compatibility.md b/docs/testing/vlt-compatibility.md
index 3129c0d3..9778689b 100644
--- a/docs/testing/vlt-compatibility.md
+++ b/docs/testing/vlt-compatibility.md
@@ -40,8 +40,8 @@ socket-patch alike.
 | Layer | Where | What it proves |
 |---|---|---|
 | Unit and golden | `socket-patch-core` lib tests; `tests/redirect_golden.rs` (`npm/vlt/*`, shared with depscan's TS rewriter), `tests/redirect_golden_reverse_replay.rs`, `tests/vlt_locks.rs` (captured locks of every era, and vendored wiring byte for byte against what real `vlt ci`, `vlt install --frozen-lockfile` and `vlt install <new>` keep on 1.2.0, 1.0.10, 1.0.4, 1.0.0-rc.32 and 1.0.0-rc.14) | DepID codec, collation (`tests/fixtures/vlt/collation-golden.json`), the node-line grammar, the hosted slot rewrite and its slot revert, vendored lock surgery and its inverse, lock inventory, VEX discovery |
-| Hermetic suites | `in_process_redirect`, `in_process_vendor`, `in_process_rollback_hosted`, `in_process_vendor_bun_takeover`, `repair_vendor_flavors_e2e`, `e2e_vex_lockfile`, `setup_invariants`, … (the 3-OS `test` job) | every code of the vlt support, the artifact preflight against a wiremock server, the heal, takeovers, repair, the CLI surface |
-| Real-vlt capstones | the five binaries below plus the vlt legs of `e2e_hosted_production` / `e2e_vendored_production` | real installs: `vlt ci` and frozen installs of patched locks, byte-stable locks, integrity enforcement, the heal on a warm tree, re-saves, upgrades, the hardlinked global store, the setup hook |
+| Hermetic suites | `in_process_redirect`, `in_process_vendor`, `in_process_rollback_hosted`, `in_process_vendor_bun_takeover`, `repair_vendor_flavors_e2e`, `e2e_vex_lockfile`, … (the 3-OS `test` job) | every code of the vlt support, the artifact preflight against a wiremock server, the heal, takeovers, repair, the CLI surface |
+| Real-vlt capstones | the five binaries below plus the vlt legs of `e2e_hosted_production` / `e2e_vendored_production` | real installs: `vlt ci` and frozen installs of patched locks, byte-stable locks, integrity enforcement, the heal on a warm tree, re-saves, upgrades, the hardlinked global store |
 | Native backtest | `scripts/backtest-vlt.py` | the production service end to end, per release, mode and project shape, against an oracle of the documented boundaries |
 
 `docs/testing/vlt-coverage.json` maps every vlt code and advisory variant,
@@ -211,7 +211,6 @@ them per OS).
 | `mode_migration_vlt` | `migration` | `vendored_then_hosted`, `hosted_then_vendored`, `dry_run_parity`, `scoped_unwind_one_of_two`, `rollback_from_mixed`, `agent_apply_yields_to_vendored`, `agent_apply_after_hosted`, `hosted_scan_keeps_agent_patched_tree`, `agent_rollback_after_takeovers`, `pm_switch_npm_to_vlt`, `pm_switch_vlt_to_npm`, `flavor_changed`, `upgrade_hosted`, `upgrade_vendored` |
 | `e2e_safety_vlt` | `safety` | `linux_auto`, `explicit_hardlink`, `private_copies`, `cross_device_cache`, `agent_rollback`, `peer_fanout`, `hosted_heal`, `vendored_build`, `vendor_revert_and_repair`, `layout_note` |
 | `e2e_vlt` | `agent` | `scan_apply_rollback_list`, `get_and_remove`, `install_then_apply_patches_file`, `transitive_only_dep_apply_patches_store`, `lockfile_supplement`, `launcher`, `persistence_survives`, `persistence_reverted_by_reinstall`, `reruns_and_vex` |
-| `e2e_vlt` | `setup` | `hook_fires_per_reify`, `root_scripts_advisory`, `workspace_root_only`, `twice_no_duplicate`, `hook_failure`, `hook_abort_leaves_no_staging` |
 | `e2e_hosted_production` | `production` | `hosted_install_proof` |
 | `e2e_vendored_production` | `production` | `vendored_install_proof` |
 
@@ -272,9 +271,6 @@ store-linker knob, `unset` when not given), `cache_root` and `upgrade`
 | as above | `all` | `cache_root=unset` | safety | `cross_device_cache` | `no-cache-root` |
 | a scalar `registry` makes lock-driven installs re-resolve from public npm | `1.0.0-rc.7 … 1.0.0-rc.29` | — | agent | `scan_apply_rollback_list`, `launcher` | `non-hermetic-registry` |
 | `npm:` alias specs resolve against public npm even with `registries.npm` | `1.0.0-rc.30 … 1.0.0-rc.32` | — | agent | `scan_apply_rollback_list` | `non-hermetic-registry` |
-| root `pre*`/`post*` scripts run without an `install` script | `< 1.0.0-rc.13` | — | setup | `hook_fires_per_reify`, `workspace_root_only`, `hook_failure` | `root-postinstall-not-run` |
-| a failing hook's abort on Windows (rollback EBUSY fix from 1.0.5) | `all` | `os!=windows` | setup | `hook_abort_leaves_no_staging` | `windows-only` |
-| as above | `< 1.0.5` | — | setup | `hook_abort_leaves_no_staging` | `pre-ebusy-fix` |
 | `lockfileVersion` 0 with legacy (`·`/`§`) DepIDs | `0.0.0-19 … 1.0.0-rc.14` | — | — | — | — |
 | `lockfileVersion` 1, tilde DepIDs | `>= 1.0.0-rc.15` | — | — | — | — |
 | a plain `vlt install` re-extracts a stale installed copy (`no_cleanup_stays_stale` expects the patch there) | `== 0.0.0-14` | — | — | — | — |
@@ -299,6 +295,5 @@ The legs run on Linux, macOS and Windows. The Linux-default `auto` store
 linker (hardlinks, `safety/linux_auto`) cannot run on macOS or Windows; it is
 covered on Linux by the CI `e2e` row `e2e_safety_vlt` on ubuntu with vlt
 1.2.0 and by `vlt-compatibility.yml`'s store-linker rows, and was also run
-locally in `node:24-slim` under Docker. Windows-only legs
-(`setup/hook_abort_leaves_no_staging`, the junction and dir-symlink store
-cases) run on the Windows rows.
+locally in `node:24-slim` under Docker. Windows-only cases
+(the junction and dir-symlink store cases) run on the Windows rows.
diff --git a/docs/testing/vlt-coverage.json b/docs/testing/vlt-coverage.json
index 3321a66e..2d8adfd4 100644
--- a/docs/testing/vlt-coverage.json
+++ b/docs/testing/vlt-coverage.json
@@ -112,12 +112,6 @@
       "vendor_vlt_refuses_gitignored_payload",
       "a_gitignored_payload_refuses_and_unwinds",
       "a_root_socket_ignore_refuses_before_any_write"
-    ],
-    "vlt_root_scripts_not_run": [
-      "setup_vlt_before_rc13_emits_the_definite_advisory",
-      "setup_vlt_without_a_usable_vlt_reads_the_lock",
-      "setup_vlt_advisory_prints_on_stderr_in_human_mode",
-      "vlt_pinned_matrix_setup_root_scripts_advisory"
     ]
   },
   "advisoryVariants": {
@@ -206,18 +200,6 @@
     ],
     "redirect_vlt_artifact_unverifiable: left pinned by an earlier run": [
       "scan_redirect_vlt_artifact_already_pinned_failure_left_pinned"
-    ],
-    "vlt_root_scripts_not_run: definite (vlt --version below rc.13)": [
-      "setup_vlt_before_rc13_emits_the_definite_advisory",
-      "vlt_pinned_matrix_setup_root_scripts_advisory"
-    ],
-    "vlt_root_scripts_not_run: may (lock sniff)": [
-      "setup_vlt_without_a_usable_vlt_reads_the_lock",
-      "setup_vlt_rc13_and_later_reads_the_lock_it_would_not_write",
-      "setup_vlt_version_probe_times_out_to_the_lock_sniff"
-    ],
-    "vlt_root_scripts_not_run: none (unparseable --version)": [
-      "setup_vlt_unparseable_version_emits_no_advisory"
     ]
   },
   "modeCommand": {
@@ -322,13 +304,6 @@
       "find_by_purls_resolves_vlt_store_transitives",
       "crawl_all_inventories_vlt_store_exactly_once",
       "test_decode_vlt_dep_id_table"
-    ],
-    "setup": [
-      "setup_detects_vlt_from_lockfile",
-      "setup_detects_vlt_from_vlt_json",
-      "setup_vlt_workspace_only_updates_root",
-      "vlt_pinned_matrix_setup_hook_fires_per_reify",
-      "vlt_pinned_matrix_setup_hook_failure"
     ]
   },
   "eraOs": {
diff --git a/docs/testing/yarn-berry-compatibility.md b/docs/testing/yarn-berry-compatibility.md
index 4ea50420..a968f430 100644
--- a/docs/testing/yarn-berry-compatibility.md
+++ b/docs/testing/yarn-berry-compatibility.md
@@ -79,10 +79,6 @@ What socket-patch does with those files:
 | revert (`rollback`, `remove`, takeovers) | byte-exact; a ledger recorded before a uniform LF ↔ CRLF checkout flip is replayed respelled; a mixed lock refuses as drift | byte-exact; a lock mixed after vendoring gets the restored entry in the terminator of the entry it replaces |
 | mode takeover into this mode | the berry gates (line endings, `cacheKey`, `compressionLevel`) run BEFORE the vendored wiring is reverted; a refused purl stays vendored, byte-identical | the backend's project gates (both files' line endings, `cacheKey`, `compressionLevel`) run BEFORE the hosted redirect is reverted; a refused purl stays hosted, byte-identical |
 
-`setup` / `setup --remove` write `package.json` in the same layout-keeping
-way (BOM, indent, ending, trailing newline), so the pair round-trips
-byte-exactly on a CRLF manifest too.
-
 Every reader — manifest-less `vex`, the lockfile inventory, the npm flavor
 sniff, `repair` — splits CRLF lines like LF ones and skips a leading BOM.
 The shared hosted golden fixtures stay LF: their TypeScript twin in the
diff --git a/gem/socket-patch-bundler/README.md b/gem/socket-patch-bundler/README.md
index e30f56fc..5e49e857 100644
--- a/gem/socket-patch-bundler/README.md
+++ b/gem/socket-patch-bundler/README.md
@@ -1,5 +1,12 @@
 # socket-patch-bundler
 
+> **Deprecated — no longer published.** `socket-patch setup` (which wired this
+> plugin) was removed in socket-patch v5, and this gem is no longer built or
+> published. In agent mode, run `socket-patch apply` in CI after
+> `bundle install` instead. The source is kept for reference only.
+> To remove the hook from a project, see
+> [Upgrading from `setup`](https://github.com/SocketDev/socket-patch#upgrading-from-setup).
+
 A [Bundler plugin](https://bundler.io/guides/bundler_plugins.html) that keeps the
 gem patches recorded in your project's `.socket/manifest.json` applied on every
 `bundle install` — cached **and** fresh — by re-running the
diff --git a/gem/socket-patch/lib/socket_patch/launcher.rb b/gem/socket-patch/lib/socket_patch/launcher.rb
index 531f4351..557c772c 100644
--- a/gem/socket-patch/lib/socket_patch/launcher.rb
+++ b/gem/socket-patch/lib/socket_patch/launcher.rb
@@ -33,7 +33,7 @@ def run(argv)
         # Windows has no exec() that replaces the process cleanly for console
         # apps; spawn + wait and propagate the child's real exit status (a
         # blanket 1 would erase the CLI's meaningful non-zero codes, e.g.
-        # `setup --check`'s needs-configuration signal).
+        # `vex`'s usage-error 2 vs nothing-attested 1).
         ok = system(bin, *argv)
         raise LauncherError, "could not run #{bin}" if ok.nil?
         exit($?.exitstatus || 1)
diff --git a/gem/socket-patch/socket-patch.gemspec b/gem/socket-patch/socket-patch.gemspec
index 46724695..81545bf2 100644
--- a/gem/socket-patch/socket-patch.gemspec
+++ b/gem/socket-patch/socket-patch.gemspec
@@ -4,8 +4,8 @@
 # run it downloads the prebuilt binary for the host platform from the matching
 # GitHub release (`v<version>`), verifies it against SHA256SUMS, caches it, and
 # execs it. `gem install socket-patch` therefore puts `socket-patch` on PATH —
-# useful in Bundler/Ruby environments where the gem ecosystem's setup hook needs
-# the CLI present. Set `SOCKET_PATCH_BIN` to an existing binary to skip the
+# useful in Bundler/Ruby environments (e.g. a CI `socket-patch apply` step after
+# `bundle install`). Set `SOCKET_PATCH_BIN` to an existing binary to skip the
 # download (airgapped CI). The version is synced with the workspace by
 # `scripts/version-sync.sh`.
 Gem::Specification.new do |s|
diff --git a/pypi/socket-patch-hook/README.md b/pypi/socket-patch-hook/README.md
index 3058d030..88517036 100644
--- a/pypi/socket-patch-hook/README.md
+++ b/pypi/socket-patch-hook/README.md
@@ -1,5 +1,13 @@
 # socket-patch-hook
 
+> **Deprecated — no longer published.** `socket-patch setup` (which added the
+> `socket-patch[hook]` dependency) was removed in socket-patch v5, and this
+> wheel is no longer built or published; the `socket-patch[hook]` extra is
+> gone too. In agent mode, run `socket-patch apply` in CI after install
+> instead. The source is kept for reference only.
+> To remove the hook from a project, see
+> [Upgrading from `setup`](https://github.com/SocketDev/socket-patch#upgrading-from-setup).
+
 A tiny, package-manager-agnostic **post-install hook** for
 [`socket-patch`](https://pypi.org/project/socket-patch/).
 
diff --git a/pypi/socket-patch/pyproject.toml b/pypi/socket-patch/pyproject.toml
index 0f505912..adc2bc40 100644
--- a/pypi/socket-patch/pyproject.toml
+++ b/pypi/socket-patch/pyproject.toml
@@ -21,15 +21,6 @@ classifiers = [
     "Topic :: Software Development :: Build Tools",
 ]
 
-[project.optional-dependencies]
-# `pip install socket-patch[hook]` additionally installs the
-# package-manager-agnostic .pth startup hook that re-applies patches after
-# install. Unpinned so the hook updates independently of the CLI. `setup`
-# commits `socket-patch[hook]` (this extra), which pulls in both the CLI and the
-# hook wheel. The hook runs the binary bundled in the installed `socket_patch`
-# package and falls back to PATH only when that package is absent.
-hook = ["socket-patch-hook"]
-
 [project.urls]
 Homepage = "https://github.com/SocketDev/socket-patch"
 Repository = "https://github.com/SocketDev/socket-patch"
diff --git a/pypi/socket-patch/socket_patch/__init__.py b/pypi/socket-patch/socket_patch/__init__.py
index b4cf04ec..f754d553 100644
--- a/pypi/socket-patch/socket_patch/__init__.py
+++ b/pypi/socket-patch/socket_patch/__init__.py
@@ -7,7 +7,8 @@ def _resolve_binary():
     """Locate the bundled socket-patch binary, or return ``None``.
 
     Single source of truth for binary discovery, reused by both ``main()`` (the
-    console-script entry point) and the ``socket_patch_hook`` startup hook. Never
+    console-script entry point) and the legacy ``socket_patch_hook`` startup hook
+    (no longer published since v5, but older installs still import this). Never
     raises: returns ``None`` if the binary can't be found, so callers that run at
     interpreter startup stay safe.
     """
diff --git a/scripts/backtest-poetry.py b/scripts/backtest-poetry.py
index f10d4fcf..1e0879b0 100755
--- a/scripts/backtest-poetry.py
+++ b/scripts/backtest-poetry.py
@@ -17,8 +17,8 @@
 over the installed fresh clone: `.socket/manifest.json` deleted (online, and
 offline from the ledger), the ledgers deleted too (lockfile discovery + the
 public patch API), `--offline` without ledgers (`record_unavailable`) and the
-lock reverted with the ledgers kept (never attested, `--no-verify` too).  Extra modes: `agent-oot` (Poetry's default out-of-tree
-venv) and `setup`.  Shapes: `direct` (native lock), `populated` (legacy locks
+lock reverted with the ledgers kept (never attested, `--no-verify` too).  Extra mode: `agent-oot` (Poetry's default out-of-tree
+venv).  Shapes: `direct` (native lock), `populated` (legacy locks
 with real hashes filled in, as 2020-era locks have), `crlf`, `pep621` (2.x).
 
 Needs network (PyPI + patch.socket.dev), uv, and no Socket token.
@@ -57,7 +57,7 @@
     "2.3.4",
     "2.4.3",
 ]
-MODES = ["hosted", "vendored", "agent", "agent-oot", "setup"]
+MODES = ["hosted", "vendored", "agent", "agent-oot"]
 SHAPES = ["direct", "populated", "crlf", "pep621"]
 
 PROJECT = """[tool.poetry]
@@ -477,31 +477,6 @@ def check(name, value, note=None):
         venv = project / ".venv"
         python = venv / "bin/python"
 
-        # ------------------------------------------------------------ setup
-        if mode == "setup":
-            senv = dict(env)
-            senv["PATH"] = str(tool / "bin") + os.pathsep + senv.get("PATH", "")
-            # `setup` shells out to that Poetry; give it the case's isolated
-            # HOME too (Poetry <= 1.1's shared HTTP-cache lock, see poetry_env).
-            senv["HOME"] = poetry_env(project)["HOME"]
-            r = Run(cli_cmd(project, "setup"), project, senv, case / "setup.log")
-            info["setupExit"] = r.rc
-            try:
-                info["setupEnvelope"] = r.json()
-            except Exception:
-                info["setupOutput"] = (r.out + r.err)[-1500:]
-            info["pyprojectChanged"] = (project / "pyproject.toml").read_bytes() != pristine_pyproject
-            info["pyprojectDiff"] = (project / "pyproject.toml").read_text()
-            info["lockChanged"] = (project / "poetry.lock").read_bytes() != pristine_lock
-            # Can Poetry itself resolve the committed hook dependency?
-            rl = Run([poetry, "lock", "-n"] + (["--no-update"] if (1, 1) <= v < (2, 0) else []), project, poetry_env(project), case / "setup-relock.log")
-            info["poetryLockAfterSetup"] = {"exit": rl.rc, "tail": (rl.out + rl.err)[-600:]}
-            chk = Run(cli_cmd(project, "setup", "--check"), project, senv, case / "setup-check.log")
-            info["setupCheckExit"] = chk.rc
-            row["passed"] = r.rc == 0 and info["pyprojectChanged"] and rl.rc == 0
-            row["expected"] = "informational: setup edits pyproject; poetry must resolve socket-patch[hook]"
-            return row
-
         # -------------------------------------------------------- agent-oot
         if mode == "agent-oot":
             penv = dict(env)
@@ -571,8 +546,10 @@ def check(name, value, note=None):
             res = oracle(oot_venv / "bin/python", list(after), project, case / "oracle-4.log")
             check("rollbackRestoresUpstream", rb.ok() and bool(before) and all(res.get(n) == h for n, h in before.items()), {"exit": rb.rc, "oracle": res})
             check("rollbackClearsManifest", not (project / ".socket/manifest.json").exists() or json.loads((project / ".socket/manifest.json").read_text()).get("patches") == {})
-            row["passed"] = all(checks[k] for k in checks if k != "bareScanSeesPoetryVenv")
-            row["expected"] = "bareScanSeesPoetryVenv is informational (known crawler gap); the rest must pass"
+            # The crawler finds Poetry's out-of-tree venv (virtualenvs.path), so
+            # the bare scan seeing it is required like every other check.
+            row["passed"] = all(checks.values())
+            row["expected"] = "every check must pass, bareScanSeesPoetryVenv included"
             return row
 
         # ------------------------------------------------- hosted / vendored / agent
@@ -772,14 +749,12 @@ def wanted(version, shape, mode):
             return False
         if shape == "pep621" and v < (2, 0):
             return False
-        if shape in ("crlf", "pep621") and mode in ("agent", "agent-oot", "setup"):
+        if shape in ("crlf", "pep621") and mode in ("agent", "agent-oot"):
             return False
-        if shape == "populated" and mode in ("agent", "agent-oot", "setup"):
+        if shape == "populated" and mode in ("agent", "agent-oot"):
             return False
         if mode == "agent-oot" and version.startswith("0."):
             return False
-        if mode == "setup" and version not in ("1.1.15", "1.8.5", "2.4.3"):
-            return False
         return True
 
     jobs = [(v, s, m) for v in args.versions for s in args.shapes for m in args.modes if wanted(v, s, m)]
@@ -893,8 +868,6 @@ def render_table(summary):
         if "manifestlessVex" in info:
             ml = [k for k in ("vexManifestDeleted", "vexLedgerOffline", "vexLedgersDeleted", "vexOfflineRecordUnavailable", "vexRevertedUnwired") if r["checks"].get(k)]
             notes.append(f"manifest-less vex {len(ml)}/5")
-        if "poetryLockAfterSetup" in info:
-            notes.append(f"poetry lock after setup exit {info['poetryLockAfterSetup']['exit']}")
         lines.append(f"| {r['poetry']} | {r['shape']} | {r['mode']} | {'PASS' if r['passed'] else 'FAIL'} | {failed} | {'; '.join(notes)} |")
     for e in summary.get("errors", []):
         lines.append(f"| {e.get('poetry')} | {e.get('shape')} | {e.get('mode')} | ERROR | {e['error'][-160:].replace(chr(10), ' ')} | |")
diff --git a/scripts/build-pypi-wheels.py b/scripts/build-pypi-wheels.py
index e1fcd392..47718e87 100755
--- a/scripts/build-pypi-wheels.py
+++ b/scripts/build-pypi-wheels.py
@@ -190,11 +190,6 @@ def build_wheel(
         f"Summary: {metadata['description']}\n"
         f"License: {metadata['license']}\n"
         f"Requires-Python: {metadata['requires_python']}\n"
-        # `pip install socket-patch[hook]` additionally installs the
-        # package-manager-agnostic .pth post-install hook (a separate
-        # pure-python wheel). Unpinned so the hook can update independently.
-        f"Provides-Extra: hook\n"
-        f'Requires-Dist: socket-patch-hook; extra == "hook"\n'
     )
     if metadata.get("readme"):
         metadata_header += "Description-Content-Type: text/markdown\n"
@@ -242,79 +237,6 @@ def build_wheel(
     return wheel_path
 
 
-DIST_NAME_HOOK = "socket_patch_hook"
-PKG_NAME_HOOK = "socket-patch-hook"
-
-
-def build_hook_wheel(version: str, hook_dir: Path, dist_dir: Path) -> Path:
-    """Build the pure-python ``socket-patch-hook`` wheel (``py3-none-any``).
-
-    Unlike the platform wheels, this ships no binary. It contains the
-    ``socket_patch_hook`` package and — crucially — a top-level
-    ``socket_patch_hook.pth`` that pip installs into the site-packages root, so
-    Python executes it at interpreter startup. It depends on ``socket-patch``
-    (the binary wheel) for the actual ``apply``.
-    """
-    init_path = hook_dir / "socket_patch_hook" / "__init__.py"
-    pth_path = hook_dir / "socket_patch_hook.pth"
-    readme_path = hook_dir / "README.md"
-    init_py = init_path.read_bytes()
-    pth = pth_path.read_bytes()
-    readme = readme_path.read_text() if readme_path.exists() else ""
-
-    wheel_name = f"{DIST_NAME_HOOK}-{version}-py3-none-any.whl"
-    wheel_path = dist_dir / wheel_name
-    dist_info = f"{DIST_NAME_HOOK}-{version}.dist-info"
-
-    files = []
-    # The package module.
-    files.append((f"{DIST_NAME_HOOK}/__init__.py", init_py, False))
-    # The startup hook — at the wheel root so it installs to site-packages.
-    files.append(("socket_patch_hook.pth", pth, False))
-
-    # No Requires-Dist on socket-patch: the hook is version-agnostic and finds
-    # whatever `socket-patch` CLI is on PATH at runtime (provisioned separately).
-    metadata_content = (
-        f"Metadata-Version: 2.1\n"
-        f"Name: {PKG_NAME_HOOK}\n"
-        f"Version: {version}\n"
-        f"Summary: Package-manager-agnostic post-install patch hook for socket-patch\n"
-        f"License: MIT\n"
-        f"Requires-Python: >=3.8\n"
-    )
-    if readme:
-        metadata_content += "Description-Content-Type: text/markdown\n"
-        metadata_content += f"\n{readme}"
-    files.append((f"{dist_info}/METADATA", metadata_content.encode(), False))
-
-    # Pure-python: Root-Is-Purelib true so the .pth lands in site-packages.
-    wheel_content = (
-        "Wheel-Version: 1.0\n"
-        "Generator: build-pypi-wheels.py\n"
-        "Root-Is-Purelib: true\n"
-        "Tag: py3-none-any\n"
-    ).encode()
-    files.append((f"{dist_info}/WHEEL", wheel_content, False))
-
-    record_lines = []
-    for name, data, _ in files:
-        record_lines.append(f"{name},{sha256_digest(data)},{len(data)}")
-    record_name = f"{dist_info}/RECORD"
-    record_lines.append(f"{record_name},,")
-    files.append((record_name, "\n".join(record_lines).encode(), False))
-
-    with zipfile.ZipFile(wheel_path, "w", zipfile.ZIP_DEFLATED) as zf:
-        for name, data, _ in files:
-            info_obj = zipfile.ZipInfo(name)
-            info_obj.external_attr = (
-                stat.S_IRUSR | stat.S_IWUSR | stat.S_IRGRP | stat.S_IROTH
-            ) << 16
-            info_obj.compress_type = zipfile.ZIP_DEFLATED
-            zf.writestr(info_obj, data)
-
-    return wheel_path
-
-
 def main():
     parser = argparse.ArgumentParser(
         description="Build platform-tagged PyPI wheels for socket-patch"
@@ -326,8 +248,8 @@ def main():
     )
     parser.add_argument(
         "--artifacts",
-        default=None,
-        help="Directory containing build artifacts (required unless --hook-only)",
+        required=True,
+        help="Directory containing build artifacts",
     )
     parser.add_argument(
         "--dist",
@@ -339,42 +261,16 @@ def main():
         default=None,
         help="Directory containing pyproject.toml (default: pypi/socket-patch relative to script)",
     )
-    parser.add_argument(
-        "--hook-dir",
-        default=None,
-        help="Directory of the socket-patch-hook package (default: pypi/socket-patch-hook)",
-    )
-    parser.add_argument(
-        "--hook-only",
-        action="store_true",
-        help="Build only the pure-python socket-patch-hook wheel (no binary artifacts needed)",
-    )
-    parser.add_argument(
-        "--skip-hook",
-        action="store_true",
-        help="Skip building the socket-patch-hook wheel",
-    )
     args = parser.parse_args()
 
     dist_dir = Path(args.dist)
     dist_dir.mkdir(parents=True, exist_ok=True)
 
     repo_root = Path(__file__).resolve().parent.parent
-    hook_dir = Path(args.hook_dir) if args.hook_dir else repo_root / "pypi" / "socket-patch-hook"
 
     built = []
     skipped = []
 
-    # The pure-python hook wheel needs no platform artifacts.
-    if args.hook_only:
-        wheel_path = build_hook_wheel(args.version, hook_dir, dist_dir)
-        size_kb = wheel_path.stat().st_size / 1024
-        print(f"Built hook wheel: {wheel_path.name} ({size_kb:.1f} KB)")
-        return
-
-    if not args.artifacts:
-        parser.error("--artifacts is required unless --hook-only is given")
-
     artifacts_dir = Path(args.artifacts)
 
     if args.pyproject_dir:
@@ -407,12 +303,6 @@ def main():
         print(f"  -> {wheel_path.name} ({size_mb:.1f} MB)")
         built.append(wheel_path)
 
-    if not args.skip_hook:
-        hook_wheel = build_hook_wheel(args.version, hook_dir, dist_dir)
-        size_kb = hook_wheel.stat().st_size / 1024
-        print(f"  -> {hook_wheel.name} ({size_kb:.1f} KB)  [pure-python hook]")
-        built.append(hook_wheel)
-
     print(f"\nBuilt {len(built)} wheel(s) in {dist_dir}/")
     if skipped:
         print(f"Skipped {len(skipped)} target(s) (artifact not found): {', '.join(skipped)}")
diff --git a/scripts/burn-down-tests.ts b/scripts/burn-down-tests.ts
index 3a9535eb..c54d402a 100644
--- a/scripts/burn-down-tests.ts
+++ b/scripts/burn-down-tests.ts
@@ -33,7 +33,7 @@
  *   --features <csv>          cargo features for the suite + single-test runs
  *                             (default: none — every ecosystem is unconditional;
  *                             intentionally NOT --all-features, which would pull
- *                             in the infra-gated docker-e2e / setup-e2e suites).
+ *                             in the infra-gated docker-e2e suites).
  *   --test-cmd <cmd>          Override the full-suite enumeration command
  *                             (default: cargo test --workspace --features <csv>
  *                             --no-fail-fast).
diff --git a/scripts/harden-tests.config.ts b/scripts/harden-tests.config.ts
index fe24dfaf..99540638 100644
--- a/scripts/harden-tests.config.ts
+++ b/scripts/harden-tests.config.ts
@@ -44,7 +44,7 @@ export default function render(ctx: FileCtx): string {
   // often hides here: a helper that swallows errors, a fake fixture that never
   // exercises the real path, an assertion shim that always passes.
   const isHarness =
-    /(^|\/)(common|setup_matrix_common|helpers?|support|fixtures?)(\/|$)/.test(
+    /(^|\/)(common|helpers?|support|fixtures?)(\/|$)/.test(
       ctx.relInCrate,
     ) || ctx.name === "mod.rs";
 
diff --git a/scripts/optimize-test-perf.config.ts b/scripts/optimize-test-perf.config.ts
index 548ec6fb..38a03352 100644
--- a/scripts/optimize-test-perf.config.ts
+++ b/scripts/optimize-test-perf.config.ts
@@ -49,14 +49,14 @@ export const model = "claude-opus-5";
 // feature gates, and naming one (`cargo`, `golang`, `maven`, …) makes cargo
 // abort with "none of the selected packages contains these features". The
 // default feature set is already exactly what we want here: all nine
-// ecosystems, minus the cfg-gated `docker-e2e`/`setup-e2e` suites
+// ecosystems, minus the cfg-gated `docker-e2e` suites
 // that `--all-features` would drag in.
 const FEATURES = "";
 
 export default function render(ctx: FileCtx): string {
   const featureFlag = FEATURES ? ` --features ${FEATURES}` : "";
   const isHarness =
-    /(^|\/)(common|setup_matrix_common|helpers?|support|fixtures?)(\/|$)/.test(
+    /(^|\/)(common|helpers?|support|fixtures?)(\/|$)/.test(
       ctx.relInCrate,
     ) || ctx.name === "mod.rs";
 
diff --git a/scripts/setup-matrix.sh b/scripts/setup-matrix.sh
deleted file mode 100755
index 9c962a55..00000000
--- a/scripts/setup-matrix.sh
+++ /dev/null
@@ -1,299 +0,0 @@
-#!/usr/bin/env bash
-# =====================================================================
-# setup-matrix.sh — orchestrate and query the `socket-patch setup`
-# end-to-end test matrix.
-#
-# The matrix asks, for every supported ecosystem/package-manager:
-# "does `socket-patch setup` configure things so that a normal install
-# applies the project's patches?" Each case runs the flow driver
-# (tests/setup_matrix/run-case.sh) which prepares a project + committed
-# patch set, optionally runs `socket-patch setup`, runs the native
-# install, and checks whether the patch landed on disk.
-#
-# Results are classified against the recorded baseline in matrix.json:
-#   pass        meets the ideal AND matches the recorded baseline
-#   known_gap   fails the ideal but exactly as recorded (expected today)
-#   progress    better than the recorded baseline (update baseline!)
-#   known_regression  would be a regression, but is on the temporary
-#               `known_regressions` allowlist in matrix.json (a tracked,
-#               non-blocking bug; auto-recovers to pass/progress when fixed)
-#   regression  diverged from the baseline the wrong way (this is the
-#               only thing that makes `run` exit non-zero)
-#   error       the driver could not produce a result
-#
-# Subcommands:
-#   build  [--ecosystem E]...                 build base + per-ecosystem images
-#   run    [--ecosystem E] [--pm P] [--scenario S] [--host] [--out FILE] [--verbose]
-#   list   [--json]                           enumerate every matrix case
-#   query  [--status S] [--ecosystem E] [--pm P] [--scenario S]   filter latest results
-#   results                                   print the latest aggregate
-#
-# CLI/agent-friendly: `list`/`query`/`results` emit JSON; `run` writes a
-# machine-readable report to tests/setup_matrix/results/latest.json.
-# =====================================================================
-set -uo pipefail
-
-REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-SM_DIR="$REPO_ROOT/tests/setup_matrix"
-MATRIX="$SM_DIR/matrix.json"
-DRIVER="$SM_DIR/run-case.sh"
-RESULTS_DIR="$SM_DIR/results"
-LATEST="$RESULTS_DIR/latest.json"
-
-ALL_ECOSYSTEMS=(npm pypi cargo gem golang maven composer nuget deno)
-
-die() { echo "error: $*" >&2; exit 1; }
-need() { command -v "$1" >/dev/null 2>&1 || die "'$1' is required but not on PATH"; }
-
-usage() { sed -n '2,40p' "$0" | sed 's/^# \{0,1\}//'; }
-
-need jq
-[ -f "$MATRIX" ] || die "matrix spec not found: $MATRIX"
-
-# Emit one TSV row per case, honoring filters. Covers all three layouts:
-# single (targets x scenarios), workspace (workspace_targets x
-# workspace_scenarios) and monorepo (monorepo_targets x monorepo_scenarios).
-# Columns: id eco pm image hook_family baseline_supported package version
-#          purl manifest_key apply_ecosystems scenario patchset run_setup
-#          expect_applied layout
-cases_tsv() { # $1=eco-filter ("" = all)  $2=pm-filter  $3=scenario-filter
-  jq -r --arg eco "${1:-}" --arg pm "${2:-}" --arg scn "${3:-}" '
-    def rows($targets; $scenarios; $layout):
-      $targets[] as $t | $scenarios[] as $s
-      | select($eco == "" or $t.ecosystem == $eco)
-      | select($pm  == "" or $t.pm        == $pm)
-      | select($scn == "" or $s.id        == $scn)
-      | [ ($t.ecosystem + "/" + $t.pm + "/" + $s.id),
-          $t.ecosystem, $t.pm, $t.image, ($t.hook_family // ""),
-          ($t.baseline_supported|tostring),
-          $t.package, $t.version, $t.purl, $t.manifest_key, $t.apply_ecosystems,
-          $s.id, $s.patchset, ($s.run_setup|tostring), ($s.expect_applied|tostring),
-          $layout ]
-      | @tsv;
-    rows(.targets; .scenarios; "single"),
-    rows((.workspace_targets // []); (.workspace_scenarios // []); "workspace"),
-    rows((.monorepo_targets // []);  (.monorepo_scenarios // []);  "monorepo")
-  ' "$MATRIX"
-}
-
-marker()     { jq -r '.marker' "$MATRIX"; }
-alt_marker() { jq -r '.alt_marker' "$MATRIX"; }
-
-# --------------------------------------------------------------------- build
-cmd_build() {
-  local ecos=();
-  while [ $# -gt 0 ]; do case "$1" in
-    --ecosystem) ecos+=("$2"); shift 2;;
-    *) die "build: unknown arg '$1'";;
-  esac; done
-  [ ${#ecos[@]} -eq 0 ] && ecos=("${ALL_ECOSYSTEMS[@]}")
-  need docker
-  echo ">> building base image" >&2
-  docker build -f "$REPO_ROOT/tests/docker/Dockerfile.base" -t socket-patch-test-base:latest "$REPO_ROOT" \
-    || die "base image build failed"
-  local e
-  for e in "${ecos[@]}"; do
-    echo ">> building $e image" >&2
-    docker build -f "$REPO_ROOT/tests/docker/Dockerfile.$e" -t "socket-patch-test-$e:latest" "$REPO_ROOT" \
-      || die "$e image build failed"
-  done
-  echo ">> done" >&2
-}
-
-# --------------------------------------------------------------------- list
-cmd_list() {
-  local as_json=0
-  while [ $# -gt 0 ]; do case "$1" in --json) as_json=1; shift;; *) die "list: unknown arg '$1'";; esac; done
-  if [ "$as_json" = 1 ]; then
-    jq '[ .targets[] as $t | .scenarios[] as $s |
-          { id: ($t.ecosystem+"/"+$t.pm+"/"+$s.id), ecosystem:$t.ecosystem, pm:$t.pm,
-            scenario:$s.id, image:$t.image, hook_family:$t.hook_family,
-            baseline_supported:$t.baseline_supported, expect_applied:$s.expect_applied } ]' "$MATRIX"
-  else
-    printf '%-46s %-9s %-8s %-11s %-22s %s\n' ID ECO PM LAYOUT SCENARIO EXPECT
-    cases_tsv "" "" "" | while IFS=$'\t' read -r id eco pm image hook bsup pkg ver purl key aeco scn pset rsetup expect layout; do
-      printf '%-46s %-9s %-8s %-11s %-22s %s\n' "$id" "$eco" "$pm" "$layout" "$scn" "$expect"
-    done
-  fi
-}
-
-# --------------------------------------------------------------------- run
-resolve_host_bin() {
-  if [ -n "${SOCKET_PATCH_BIN:-}" ]; then echo "$SOCKET_PATCH_BIN"; return; fi
-  for c in "$REPO_ROOT/target/release/socket-patch" "$REPO_ROOT/target/debug/socket-patch"; do
-    [ -x "$c" ] && { echo "$c"; return; }
-  done
-  command -v socket-patch 2>/dev/null || echo ""
-}
-
-cmd_run() {
-  local eco="" pm="" scn="" host=0 out="$LATEST" verbose=0
-  while [ $# -gt 0 ]; do case "$1" in
-    --ecosystem) eco="$2"; shift 2;;
-    --pm)        pm="$2"; shift 2;;
-    --scenario)  scn="$2"; shift 2;;
-    --host)      host=1; shift;;
-    --out)       out="$2"; shift 2;;
-    --verbose)   verbose=1; shift;;
-    *) die "run: unknown arg '$1'";;
-  esac; done
-
-  local MARK ALT; MARK="$(marker)"; ALT="$(alt_marker)"
-  mkdir -p "$RESULTS_DIR"
-  local jsonl; jsonl="$(mktemp)"
-
-  if [ "$host" = 0 ]; then need docker; fi
-  local host_bin=""
-  if [ "$host" = 1 ]; then
-    host_bin="$(resolve_host_bin)"
-    [ -n "$host_bin" ] || die "host mode: no socket-patch binary found (build it or set SOCKET_PATCH_BIN)"
-    echo ">> host mode, binary: $host_bin" >&2
-  fi
-
-  # Allowlist of cases that are a tracked, non-blocking `known_regression`
-  # (see matrix.json `known_regressions`): they should work per the baseline but
-  # currently don't, and must not fail the job while the bug is fixed.
-  local known_regressions; known_regressions="$(jq -c '.known_regressions // []' "$MATRIX")"
-
-  local total=0
-  while IFS=$'\t' read -r id eco_ pm_ image hook bsup pkg ver purl key aeco scn_ pset rsetup expect layout; do
-    [ -z "$id" ] && continue
-    total=$((total+1))
-    echo ">> [$total] $id (layout=$layout)" >&2
-
-    # Common SM_* env for the driver.
-    local -a base_env=(
-      "SM_ID=$id" "SM_ECOSYSTEM=$eco_" "SM_PM=$pm_" "SM_SCENARIO=$scn_"
-      "SM_LAYOUT=$layout"
-      "SM_PATCHSET=$pset" "SM_RUN_SETUP=$([ "$rsetup" = true ] && echo 1 || echo 0)"
-      "SM_EXPECT_APPLIED=$([ "$expect" = true ] && echo 1 || echo 0)"
-      "SM_PACKAGE=$pkg" "SM_VERSION=$ver" "SM_PURL=$purl"
-      "SM_MANIFEST_KEY=$key" "SM_APPLY_ECOSYSTEMS=$aeco"
-      "SM_MARKER=$MARK" "SM_ALT_MARKER=$ALT"
-    )
-
-    local raw="" rc=0
-    if [ "$host" = 1 ]; then
-      if [ "$verbose" = 1 ]; then
-        raw="$(env "${base_env[@]}" "SOCKET_PATCH_BIN=$host_bin" bash "$DRIVER")"; rc=$?
-      else
-        raw="$(env "${base_env[@]}" "SOCKET_PATCH_BIN=$host_bin" bash "$DRIVER" 2>/dev/null)"; rc=$?
-      fi
-    else
-      local -a docker_env=()
-      local kv; for kv in "${base_env[@]}"; do docker_env+=(-e "$kv"); done
-      if [ "$verbose" = 1 ]; then
-        raw="$(docker run --rm "${docker_env[@]}" "socket-patch-test-$image:latest" bash -c "$(cat "$DRIVER")")"; rc=$?
-      else
-        raw="$(docker run --rm "${docker_env[@]}" "socket-patch-test-$image:latest" bash -c "$(cat "$DRIVER")" 2>/dev/null)"; rc=$?
-      fi
-    fi
-
-    # The driver prints the result JSON as the last line of stdout.
-    local result; result="$(printf '%s\n' "$raw" | grep -E '^\{.*"actual_applied"' | tail -n1)"
-
-    # baseline_applied = expect_applied AND baseline_supported.
-    local bl=false
-    if [ "$expect" = true ] && [ "$bsup" = true ]; then bl=true; fi
-
-    if [ -n "$result" ] && printf '%s' "$result" | jq -e . >/dev/null 2>&1; then
-      printf '%s\n' "$result" | jq -c --argjson bl "$bl" --arg img "$image" --arg hk "$hook" --arg lay "$layout" \
-                                       --arg cid "$id" --argjson kr "$known_regressions" '
-        . as $r |
-        ($r.actual_applied == $r.expect_applied) as $ideal |
-        ($r.actual_applied == $bl) as $base |
-        (if $ideal and $base then "pass"
-         elif $ideal and ($base|not) then "progress"
-         elif ($ideal|not) and $base then "known_gap"
-         else "regression" end) as $cls0 |
-        # A regression that is on the temporary allowlist is downgraded to the
-        # non-blocking `known_regression` (still tracked; auto-recovers to a
-        # `pass`/`progress` when fixed — then remove it from matrix.json).
-        (if $cls0 == "regression" and ($kr | index($cid)) then "known_regression" else $cls0 end) as $cls |
-        $r + {baseline_applied:$bl, classification:$cls, layout:$lay, image:$img, hook_family:$hk, driver_rc:'"$rc"'}
-      ' >> "$jsonl"
-    else
-      # No parseable result — surface as an error case.
-      jq -nc --arg id "$id" --arg eco "$eco_" --arg pm "$pm_" --arg scn "$scn_" \
-             --arg pset "$pset" --arg img "$image" --arg hk "$hook" --arg lay "$layout" --argjson bl "$bl" '
-        { id:$id, ecosystem:$eco, pm:$pm, scenario:$scn, patchset:$pset,
-          expect_applied:null, actual_applied:null, baseline_applied:$bl,
-          classification:"error", layout:$lay, image:$img, hook_family:$hk, driver_rc:'"$rc"',
-          notes:"driver produced no parseable result" }' >> "$jsonl"
-    fi
-  done < <(cases_tsv "$eco" "$pm" "$scn")
-
-  # Aggregate + summarize.
-  jq -s --arg generated "$(date -u +%FT%TZ)" '
-    { generated:$generated,
-      summary: ( reduce .[] as $c (
-                   {total:0,pass:0,known_gap:0,progress:0,known_regression:0,regression:0,error:0};
-                   .total += 1 | .[$c.classification] += 1 ) ),
-      cases: . }' "$jsonl" > "$out"
-  rm -f "$jsonl"
-  [ "$out" != "$LATEST" ] && cp "$out" "$LATEST"
-
-  print_summary "$out"
-  local regressions; regressions="$(jq -r '.summary.regression' "$out")"
-  if [ "$regressions" -gt 0 ]; then
-    echo "!! $regressions regression(s) — a case that should work no longer does" >&2
-    return 1
-  fi
-  return 0
-}
-
-print_summary() { # $1 = results file
-  local f="$1"
-  echo "" >&2
-  printf '%-44s %-8s %-6s %-6s %s\n' CASE PM APPLIED EXPECT STATUS >&2
-  jq -r '.cases[] | [ .id, .pm, (.actual_applied|tostring), (.expect_applied|tostring), .classification ] | @tsv' "$f" \
-    | while IFS=$'\t' read -r id pm act exp cls; do
-        printf '%-44s %-8s %-6s %-6s %s\n' "$id" "$pm" "$act" "$exp" "$cls" >&2
-      done
-  echo "" >&2
-  jq -r '.summary | "total=\(.total) pass=\(.pass) known_gap=\(.known_gap) progress=\(.progress) known_regression=\(.known_regression) regression=\(.regression) error=\(.error)"' "$f" >&2
-  local prog; prog="$(jq -r '.summary.progress' "$f")"
-  [ "$prog" -gt 0 ] && echo ">> $prog case(s) now BETTER than baseline — consider updating baseline_supported in matrix.json" >&2
-  local kr; kr="$(jq -r '.summary.known_regression' "$f")"
-  [ "$kr" -gt 0 ] && echo ">> $kr case(s) are a tracked known_regression (allowlisted in matrix.json, non-blocking) — fix the hook + remove from the list" >&2
-  echo ">> full report: $f" >&2
-}
-
-# --------------------------------------------------------------------- query / results
-cmd_query() {
-  local status="" eco="" pm="" scn="" lay=""
-  while [ $# -gt 0 ]; do case "$1" in
-    --status) status="$2"; shift 2;;
-    --ecosystem) eco="$2"; shift 2;;
-    --pm) pm="$2"; shift 2;;
-    --scenario) scn="$2"; shift 2;;
-    --layout) lay="$2"; shift 2;;
-    *) die "query: unknown arg '$1'";;
-  esac; done
-  [ -f "$LATEST" ] || die "no results yet — run '$0 run' first"
-  jq --arg st "$status" --arg eco "$eco" --arg pm "$pm" --arg scn "$scn" --arg lay "$lay" '
-    [ .cases[]
-      | select($st  == "" or .classification == $st)
-      | select($eco == "" or .ecosystem == $eco)
-      | select($pm  == "" or .pm == $pm)
-      | select($scn == "" or .scenario == $scn)
-      | select($lay == "" or .layout == $lay) ]' "$LATEST"
-}
-
-cmd_results() {
-  [ -f "$LATEST" ] || die "no results yet — run '$0 run' first"
-  cat "$LATEST"
-}
-
-# --------------------------------------------------------------------- dispatch
-[ $# -ge 1 ] || { usage; exit 1; }
-sub="$1"; shift || true
-case "$sub" in
-  build)   cmd_build "$@";;
-  run)     cmd_run "$@";;
-  list)    cmd_list "$@";;
-  query)   cmd_query "$@";;
-  results) cmd_results "$@";;
-  -h|--help|help) usage;;
-  *) die "unknown subcommand '$sub' (try: build run list query results)";;
-esac
diff --git a/scripts/tests/test_check_vlt_legs.py b/scripts/tests/test_check_vlt_legs.py
index 4d40783a..1ede0191 100644
--- a/scripts/tests/test_check_vlt_legs.py
+++ b/scripts/tests/test_check_vlt_legs.py
@@ -165,8 +165,6 @@ def test_era_skips_follow_the_boundaries(self):
         self.assertEqual(es("vendored", "absent_version_refused", "0.0.0-16"), "ran")
         self.assertEqual(es("vendored", "absent_version_refused", "1.2.0"), "skip:lockfile-version-present")
         self.assertEqual(es("safety", "agent_rollback", "1.1.1"), "skip:no-global-store")
-        self.assertEqual(es("setup", "hook_fires_per_reify", "1.0.0-rc.12"), "skip:root-postinstall-not-run")
-        self.assertEqual(es("setup", "hook_fires_per_reify", "1.0.0-rc.13"), "ran")
 
     def test_knobs_select_the_safety_legs(self):
         m = self.manifest
diff --git a/scripts/tests/test_vlt_coverage.py b/scripts/tests/test_vlt_coverage.py
index 25de75f1..e7262432 100644
--- a/scripts/tests/test_vlt_coverage.py
+++ b/scripts/tests/test_vlt_coverage.py
@@ -22,7 +22,7 @@
     "redirect_vlt_sibling_lockfiles", "redirect_vlt_no_lockfile", "redirect_vlt_artifact_unverifiable",
     "redirect_vlt_reinstall_required", "vendor_vlt_transitive_unsupported",
     "vendor_vlt_lock_out_of_sync", "vendor_vlt_legacy_lockfile", "vendor_vlt_reinstall_required",
-    "vendor_flavor_changed", "vendor_artifact_gitignored", "vlt_root_scripts_not_run",
+    "vendor_flavor_changed", "vendor_artifact_gitignored",
 ]
 MODE_COMMANDS = [
     "hosted/scan", "hosted/get", "hosted/rollback", "hosted/remove", "hosted/vex",
@@ -30,7 +30,6 @@
     "vendored/revert", "vendored/repair", "vendored/remove", "vendored/list", "vendored/vex",
     "vendored/takeover (hosted to vendored)", "vendored/scan --prune", "agent/scan", "agent/get",
     "agent/apply", "agent/rollback", "agent/remove", "agent/list", "agent/vex", "agent/crawl",
-    "setup",
 ]
 FN = re.compile(r"^(?P<indent>\s*)(?:pub(?:\([a-z]+\))?\s+)?(?:async\s+)?fn\s+(?P<name>[A-Za-z0-9_]+)")
 ASSERTS = re.compile(r"assert|expect|\.contains\(|matches!")
@@ -155,8 +154,7 @@ def test_every_advisory_variant_maps_to_existing_tests(self):
             self.assertIn(key.split(":", 1)[0], CODES, key)
             self.assertTrue(names, key)
             self.check_names(names)
-        for code in ("redirect_vlt_reinstall_required", "redirect_vlt_artifact_unverifiable",
-                     "vlt_root_scripts_not_run"):
+        for code in ("redirect_vlt_reinstall_required", "redirect_vlt_artifact_unverifiable"):
             self.assertTrue(any(k.startswith(code + ":") for k in variants), code)
 
     def test_every_mode_command_cell_maps_to_existing_tests(self):
diff --git a/scripts/version-sync.sh b/scripts/version-sync.sh
index 48fde5f7..7b06e4ef 100755
--- a/scripts/version-sync.sh
+++ b/scripts/version-sync.sh
@@ -3,8 +3,7 @@
 #   - Cargo.toml (workspace version + socket-patch-core exact pin)
 #   - npm/socket-patch/package.json (+ optionalDependencies, package-lock.json)
 #   - npm/socket-patch-*/package.json (per-platform packages)
-#   - pypi/socket-patch/pyproject.toml + pypi/socket-patch-hook/pyproject.toml
-#   - gem/socket-patch-bundler/socket-patch-bundler.gemspec
+#   - pypi/socket-patch/pyproject.toml
 #   - gem/socket-patch/socket-patch.gemspec + lib/socket_patch/launcher.rb
 set -euo pipefail
 
@@ -69,21 +68,8 @@ pyproject="$REPO_ROOT/pypi/socket-patch/pyproject.toml"
 sed -i.bak "s/^version = \".*\"/version = \"$VERSION\"/" "$pyproject"
 rm -f "$pyproject.bak"
 
-# Update the PyPI hook package version. The release build (build-pypi-wheels.py)
-# injects --version at wheel-build time, so this keeps the source-of-truth
-# pyproject.toml in sync for local builds and avoids a stale version field.
-hook_pyproject="$REPO_ROOT/pypi/socket-patch-hook/pyproject.toml"
-sed -i.bak "s/^version = \".*\"/version = \"$VERSION\"/" "$hook_pyproject"
-rm -f "$hook_pyproject.bak"
-
-# Update the Ruby Bundler-plugin gem version (Phase 2 scaffolding). The in-tree
-# plugin is the active mechanism today; keep the published gem's version in sync
-# so a release publishes a version matching the CLI.
-gemspec="$REPO_ROOT/gem/socket-patch-bundler/socket-patch-bundler.gemspec"
-if [ -f "$gemspec" ]; then
-  sed -i.bak "s/s\.version *= *\".*\"/s.version     = \"$VERSION\"/" "$gemspec"
-  rm -f "$gemspec.bak"
-fi
+# pypi/socket-patch-hook and gem/socket-patch-bundler are frozen: `setup`
+# was removed in v5 and neither is built or published any more.
 
 # Update the RubyGems CLI launcher gem (gemspec version + the VERSION constant
 # the launcher uses to pick the matching GitHub release binary).
diff --git a/tests/docker/Dockerfile.gem-b1 b/tests/docker/Dockerfile.gem-b1
deleted file mode 100644
index 748070cf..00000000
--- a/tests/docker/Dockerfile.gem-b1
+++ /dev/null
@@ -1,46 +0,0 @@
-# gem (Ruby) bundler-1 matrix image: Ruby 3.1 + bundler 1.17.3 + socket-patch.
-#
-# Bundler 1.17.3 is the last 1.x release. It calls `untaint`, which Ruby 3.2
-# removed, so this image pins ruby:3.1 (the newest Ruby that still carries the
-# method as a no-op) on bookworm so the socket-patch binary compiled against
-# the base image's glibc still runs. Ruby 3.1 ships a default bundler 2.3.x;
-# BUNDLER_VERSION forces the binstub to select 1.17.3 in every process.
-#
-# webrick is baked in (removed from Ruby stdlib in 3.0) so matrix probe
-# scripts can run an in-container loopback mock server under `--network none`.
-#
-# Used by the bundler-version legs in setup_matrix_gem.rs (the >= 2.2 plugin
-# floor: bundler 1.x cannot load `plugin ... path:` directives). These legs
-# do NOT run in CI (the CI setup-matrix job drives scripts/setup-matrix.sh
-# against the plain `gem` image only) — build locally:
-#
-#   docker build -f tests/docker/Dockerfile.base -t socket-patch-test-base:latest .
-#   docker build -f tests/docker/Dockerfile.gem-b1 -t socket-patch-test-gem-b1:latest .
-#
-# BASE_IMAGE is overridable so a fix under test can be verified without
-# touching the shared :latest tags:
-#   docker build --build-arg BASE_IMAGE=socket-patch-test-base:mytag \
-#     -f tests/docker/Dockerfile.gem-b1 -t socket-patch-test-gem-b1:mytag .
-ARG BASE_IMAGE=socket-patch-test-base:latest
-FROM ${BASE_IMAGE} AS sptool
-
-FROM ruby:3.1-slim-bookworm
-
-RUN apt-get update \
- && apt-get install -y --no-install-recommends \
-      build-essential \
-      ca-certificates \
-      curl \
-      git \
- && rm -rf /var/lib/apt/lists/* \
- && gem install bundler -v 1.17.3 --no-document \
- && gem install webrick --no-document
-
-ENV BUNDLER_VERSION=1.17.3
-
-COPY --from=sptool /usr/local/bin/socket-patch /usr/local/bin/socket-patch
-RUN ruby --version && gem --version && bundle --version \
- && bundle --version | grep -q 'Bundler version 1\.17\.3' \
- && socket-patch --version
-
-WORKDIR /workspace
diff --git a/tests/docker/Dockerfile.gem-b4 b/tests/docker/Dockerfile.gem-b4
deleted file mode 100644
index 033c27e2..00000000
--- a/tests/docker/Dockerfile.gem-b4
+++ /dev/null
@@ -1,45 +0,0 @@
-# gem (Ruby) bundler-4 matrix image: Ruby 3.4 + bundler ~> 4.0 + socket-patch.
-#
-# Bundler 4 is the current major (3 was skipped). Ruby 3.4's default bundler
-# is 2.6.x; the binstub selects the newest installed version, so installing
-# any 4.x makes `bundle` resolve to it without extra pinning. Bundler 4 writes
-# a CHECKSUMS section into fresh locks by default — the flavor the hosted-mode
-# rewrite canary in e2e_redirect_gem_build.rs pins.
-#
-# webrick is baked in (removed from Ruby stdlib in 3.0) so matrix probe
-# scripts can run an in-container loopback mock server under `--network none`.
-#
-# Companion to Dockerfile.gem-b1 for bundler-version matrix runs (the plain
-# `gem` image pins bundler ~> 2.7; this one covers the current major). Not
-# built in CI — build locally:
-#
-#   docker build -f tests/docker/Dockerfile.base -t socket-patch-test-base:latest .
-#   docker build -f tests/docker/Dockerfile.gem-b4 -t socket-patch-test-gem-b4:latest .
-#
-# BASE_IMAGE is overridable so a fix under test can be verified without
-# touching the shared :latest tags:
-#   docker build --build-arg BASE_IMAGE=socket-patch-test-base:mytag \
-#     -f tests/docker/Dockerfile.gem-b4 -t socket-patch-test-gem-b4:mytag .
-ARG BASE_IMAGE=socket-patch-test-base:latest
-FROM ${BASE_IMAGE} AS sptool
-
-FROM ruby:3.4-slim-bookworm
-
-RUN apt-get update \
- && apt-get install -y --no-install-recommends \
-      build-essential \
-      ca-certificates \
-      curl \
-      git \
- && rm -rf /var/lib/apt/lists/* \
- && gem install bundler -v '~> 4.0' --no-document \
- && gem install webrick --no-document
-
-COPY --from=sptool /usr/local/bin/socket-patch /usr/local/bin/socket-patch
-# bundler 4 dropped the "Bundler version " prefix from `bundle --version`
-# (it prints the bare version), so the sanity grep matches the bare form.
-RUN ruby --version && gem --version && bundle --version \
- && bundle --version | grep -qE '^(Bundler version )?4\.' \
- && socket-patch --version
-
-WORKDIR /workspace
diff --git a/tests/docker/Dockerfile.npm b/tests/docker/Dockerfile.npm
index 2eba0343..5d80e5b1 100644
--- a/tests/docker/Dockerfile.npm
+++ b/tests/docker/Dockerfile.npm
@@ -30,10 +30,9 @@ RUN for i in 1 2 3; do \
     done \
  && ln -s /root/.bun/bin/bun /usr/local/bin/bun
 
-# Enable pnpm and yarn via corepack (bundled with Node 22). The
-# setup-matrix suite (tests/setup_matrix/) drives the npm-family
-# package managers — npm, yarn, pnpm, bun and (installed below) vlt —
-# through the `socket-patch setup` install-hook flow. `corepack prepare … --activate` pins and
+# Enable pnpm and yarn via corepack (bundled with Node 22) so the image
+# carries every npm-family package manager — npm, yarn, pnpm, bun and
+# (installed below) vlt. `corepack prepare … --activate` pins and
 # activates a known version so the binaries resolve without a network
 # round-trip at test time. Additive: the existing docker_e2e_npm tests
 # are unaffected.
@@ -49,8 +48,8 @@ RUN corepack enable \
 # the activated versions.
 ENV COREPACK_DEFAULT_TO_LATEST=0
 
-# vlt, for the setup-matrix `pm: vlt` cases (non-gating extras: the
-# gating vlt setup assertions live in the real-vlt capstones). Retried like
+# vlt (a non-gating extra: the gating vlt assertions live in the real-vlt
+# capstones). Retried like
 # bun: one registry blip must not fail the image build. Its telemetry is
 # off for every test run.
 RUN for i in 1 2 3; do \
diff --git a/tests/docker/Dockerfile.pypi b/tests/docker/Dockerfile.pypi
index ac962dbc..01e5c178 100644
--- a/tests/docker/Dockerfile.pypi
+++ b/tests/docker/Dockerfile.pypi
@@ -6,8 +6,8 @@
 # user flow.
 #
 # uv/poetry/pdm/hatch/pipenv are installed from PyPI so the one image can
-# drive every Python package manager the setup-matrix suite exercises
-# (tests/setup_matrix/) plus the pypi package-manager vendor suite (pipenv).
+# drive every Python package manager (the pypi package-manager vendor suite
+# uses pipenv).
 # The `--break-system-packages` flag is what Debian-packaged pip3 requires
 # to install into the system site-packages; it's safe inside the disposable
 # test container. Additive: the existing docker_e2e_pypi tests (pip + uv)
diff --git a/tests/docker/README.md b/tests/docker/README.md
index 67611479..fbf06684 100644
--- a/tests/docker/README.md
+++ b/tests/docker/README.md
@@ -92,107 +92,8 @@ spike-validated against; bundler >= 2.7 needs ruby >= 3.2, newer than
 Debian 12's apt ruby). The gem suite covers both the default no-CHECKSUMS
 lock and a `lockfile_checksums` twin (`bundle lock --add-checksums`).
 
-## Bundler-version matrix images (`Dockerfile.gem-b1`, `Dockerfile.gem-b4`)
-
-The plain `Dockerfile.gem` pins bundler `~> 2.7`. Two sibling images cover
-the ends of the bundler spectrum. Only `gem-b1` feeds a gated leg (in
-`crates/socket-patch-cli/tests/setup_matrix_gem.rs`); `gem-b4` is a manual
-bundler-4 image with no gated leg:
-
-- `Dockerfile.gem-b1` — ruby 3.1 + **bundler 1.17.3** (last 1.x). Drives the
-  bundler `>= 2.2` plugin floor: gem `setup` must refuse to wire a 1.x
-  project (bundler 1.x cannot load `plugin ... path:` directives) and
-  `bundle install` must keep working after the refusal.
-- `Dockerfile.gem-b4` — ruby 3.4 + **bundler ~> 4.0** (current major, bare
-  `bundle --version` output, CHECKSUMS locks by default).
-
-These images are NOT built in CI (the CI `setup-matrix` job drives
-`scripts/setup-matrix.sh` against the plain `gem` image only). Build them
-locally before running the gated legs:
-
-```sh
-docker build -f tests/docker/Dockerfile.base -t socket-patch-test-base:latest .
-docker build -f tests/docker/Dockerfile.gem-b1 -t socket-patch-test-gem-b1:latest .
-docker build -f tests/docker/Dockerfile.gem-b4 -t socket-patch-test-gem-b4:latest .
-cargo test -p socket-patch-cli --features setup-e2e --test setup_matrix_gem
-```
-
-The legs soft-skip (loudly) when Docker or the image is absent. Both
-Dockerfiles take a `BASE_IMAGE` build-arg so a binary under test can be baked
-in without overwriting the shared `:latest` tags; the test honors a
-`SOCKET_PATCH_GEM_B1_IMAGE` env var to point at such a uniquely-tagged image.
-NOTE: the legs run the binary BAKED INTO the image — rebuild base + image
-after changing setup code or they test a stale binary.
-
-## Host mode (no Docker)
-
-Set `SOCKET_PATCH_TEST_HOST=1` to run the tests against host-installed
-toolchains instead of containers. Tests assume the relevant package
-manager (`npm`, `pip`, `gem`, `cargo`, `go`, `mvn`, `composer`,
-`dotnet`) is on `$PATH`. Useful for iterating on a single ecosystem's
-test logic without paying the docker-spin-up cost on every edit.
-
-```sh
-SOCKET_PATCH_TEST_HOST=1 cargo test -p socket-patch-cli \
-  --features docker-e2e --test docker_e2e_npm
-```
-
-## CI
-
-`.github/workflows/ci.yml` runs an `e2e-docker` matrix across all 9
-ecosystems on every PR. Each matrix slot:
-1. Builds the base image (no GitHub Actions cache — left out on purpose
-   because of zizmor's cache-poisoning audit).
-2. Builds the per-ecosystem image.
-3. Runs the matching `docker_e2e_<eco>` test, plus that ecosystem's vendor
-   capstone where it has one in this job (composer, nuget, pypi_pm).
-
-The separate `e2e` job is the per-PR real-toolchain host matrix. The
-live-API smoke suites (`e2e_npm`, `e2e_pypi`, `e2e_gem`, `e2e_scan`) are
-not in CI; run them by hand with `--ignored`.
-
-## Adding a new ecosystem
-
-1. Add `tests/docker/Dockerfile.<eco>` — `FROM socket-patch-test-base:latest`
-   plus the toolchain install.
-2. Add `tests/docker_e2e_<eco>.rs` — copy any existing test, swap the
-   PURL/UUID, install command, and `--ecosystems <eco>` flag.
-3. Add `<eco>` to the matrix in `.github/workflows/ci.yml`'s
-   `e2e-docker` job.
-
-## How fixtures are served
-
-Each test starts a `wiremock::MockServer` bound to `0.0.0.0` on a random
-port. The container runs with
-`--add-host=host.docker.internal:host-gateway`, then the test passes
-`http://host.docker.internal:<port>` as `SOCKET_API_URL`. The
-wiremock returns canned responses for the 3 endpoints scan/get/apply
-exercise:
-- `POST /v0/orgs/<org>/patches/batch` — discovery
-- `GET /v0/orgs/<org>/patches/by-package/<encoded>` — per-package
-- `GET /v0/orgs/<org>/patches/view/<uuid>` — full patch with inline
-  base64 `blobContent` (consumed by the apply path)
-
 Fixtures are synthetic. Real Socket patches are not required to exist
 for the tested PURLs — what's validated is that the crawler discovers
 real installed packages and the CLI dispatches correctly through the
 ecosystem.
 
-## Related: the `setup`-flow matrix
-
-A separate, **experimental** suite lives under `tests/setup_matrix/` and
-reuses these same per-ecosystem images. Where `docker_e2e_*` drives
-`scan → apply` explicitly, the setup-matrix instead runs `socket-patch
-setup` and then a *native install* to check whether the configured
-install hook applies the patch on its own — the thing `setup` is meant
-to enable. It also adds the npm-family package managers (pnpm/yarn via
-corepack, and vlt 1.2.0 via `npm install -g`) and the Python ones
-(uv/poetry/pdm/hatch), which is why `Dockerfile.npm` and `Dockerfile.pypi`
-install those tools. `Dockerfile.npm` is on Node 22 (>= 22.22, vlt 1.2.0's
-engine floor) and sets `VLT_TELEMETRY=0`. The vlt cases are non-gating
-extras: the gating vlt `setup` assertions run against real vlt releases in
-`crates/socket-patch-cli/tests/e2e_vlt.rs`. See
-`tests/setup_matrix/README.md` for details and the
-`scripts/setup-matrix.sh` runner. That suite's CI job (`setup-matrix`)
-is **non-blocking** (`continue-on-error: true`) and is expected to fail
-for ecosystems whose hooks `setup` does not yet configure.
diff --git a/tests/setup_matrix/README.md b/tests/setup_matrix/README.md
deleted file mode 100644
index adf8b8a1..00000000
--- a/tests/setup_matrix/README.md
+++ /dev/null
@@ -1,194 +0,0 @@
-# `setup`-flow test matrix (experimental)
-
-This suite verifies the **intended** end-to-end behavior of
-`socket-patch setup`: that after `setup` configures a project, a normal
-package-manager install applies the project's patches *on its own*, with
-no explicit `scan`/`apply` step.
-
-It is **experimental and non-blocking**. `setup` configures npm-family,
-pip/uv/hatch (the `.pth` hook), Bundler (plugin) and Composer hooks; the
-remaining ecosystems are the *expected-to-fail* `known_gap` cases. The suite encodes the **aspirational** end state and records a
-per-case **baseline** of what works now — the failing cases are a TODO
-list for `setup`, not a broken test.
-
-## The flow (per case)
-
-Every case runs the same four steps via the bash driver `run-case.sh`:
-
-0. **prepare** a throwaway project: declare the dependency and commit a
-   patch set (`.socket/manifest.json` + `.socket/blobs/<hash>`).
-1. **`socket-patch setup`** — configure install hooks (skipped in the
-   `no_setup_control` scenario).
-2. **native install** — `npm install` / `pip install` / `cargo fetch` /
-   … for the package manager under test.
-3. **check** — is the patch's marker now on disk in the installed file?
-
-The apply step is fully offline (`SOCKET_OFFLINE=1 SOCKET_FORCE=1`,
-inherited by the hook), so the only network use is the real package
-install. No Socket API is contacted.
-
-## Dimensions
-
-`ecosystem × package-manager × scenario` — see `matrix.json` (the single
-source of truth, consumed by both the runner script and the Rust
-wrappers).
-
-- **Package managers:** npm, yarn, pnpm, bun, vlt · pip, uv, poetry, pdm,
-  hatch · cargo · bundler · go · mvn · composer · dotnet · deno.
-- **Scenarios (single-project):**
-  - `baseline_with_setup` — setup + install ⇒ patch applied *(ideal)*.
-  - `no_setup_control` — **ablation (setup not run)**: install only ⇒ NOT applied *(the hook is the cause)*.
-  - `patch_missing` — **ablation (patch missing)**: setup runs and the hook fires, but no `.socket/` patch set is committed ⇒ runs UNPATCHED *(the committed patch is the cause)*.
-  - `empty_patchset` — manifest present but with zero patches ⇒ NOT applied.
-  - `wrong_target_patchset` — manifest targets a different package ⇒ NOT applied.
-  - `alt_content_patchset` — a second patch set ⇒ its marker applied *(content tracks the manifest)*.
-
-  The two **ablations** are the controls that confirm `setup` is correct:
-  each is identical to `baseline_with_setup` except for the single removed
-  factor (the setup step, or the committed patch), and each must run
-  unpatched. The workspace and monorepo layouts carry the same pair
-  (`*_no_setup`, `*_patch_missing`).
-
-## Layouts
-
-The driver's `SM_LAYOUT` selects the project shape (each layout has its
-own `*_targets` / `*_scenarios` sections in `matrix.json`):
-
-- **`single`** *(default)* — one project, one dependency. The 17-PM grid above.
-- **`workspace`** — a **nested workspace/monorepo**: a root + several
-  members (incl. a deeply-nested one and a member that does *not* use the
-  patched package). Models real-world monorepo deployments and exercises
-  `setup`'s workspace handling — npm/yarn write the hook to **every**
-  member, pnpm and vlt only to the **root** — plus the cross-workspace apply
-  on a single root install. Covered PMs: **npm, pnpm, yarn, vlt** (apply;
-  the dependency hoists / lands in the pnpm or vlt store and is patched
-  once) and
-  **pip** (nested `requirements.txt` files) + **uv** (uv workspace, one
-  shared `.venv`) as Python gaps. Scenarios: `workspace_with_setup`,
-  `workspace_no_setup`, `workspace_patch_missing`.
-- **`monorepo`** — a **polyglot all-ecosystem repo**: an npm workspace
-  alongside python/rust/go/php/ruby/nuget/deno manifests. Confirms `setup`
-  works in a mixed environment — it must configure the npm hooks and
-  **not choke** on the foreign manifests; a root `npm install` then
-  patches the npm slice. Runs in the npm image (the only one with the npm
-  toolchain), so the foreign manifests are present to test setup's
-  robustness, not installed. Scenarios: `monorepo_with_setup`,
-  `monorepo_no_setup`, `monorepo_patch_missing`.
-
-> Real-world wiring note surfaced by the workspace layout: the install
-> hook's `apply` must run with the package manager's per-script cwd (root
-> for the project, the member dir for each member) — so member
-> postinstalls find no manifest and no-op while the root applies. Forcing
-> a single cwd makes every member target the root manifest and fail
-> mid-install with "no packages found on disk". The driver therefore does
-> **not** pin `SOCKET_CWD`.
-
-## vlt cases
-
-The `pm: vlt` rows (single and workspace) are **non-gating extras**: every
-vlt `setup` assertion that gates a release lives in the real-vlt capstone
-`crates/socket-patch-cli/tests/e2e_vlt.rs` (suite `setup`). They run vlt
-1.2.0 from the npm image (`npm install -g vlt@1.2.0`, Node >= 22.22) and
-follow the npm-family round trip:
-
-- the scaffold declares the dependency up front and writes a `vlt.json`,
-  which is both the marker `setup` detects vlt by and the registry config
-  (`config.registry` + `config.registries.npm`) vlt >= 1.0.0-rc.33 needs to
-  install at all; the workspace scaffold declares its members in vlt.json
-  `workspaces`, the only place vlt reads them;
-- `setup` writes npm's `npx` hook (vlt ships through npm, so `npx` is
-  always there; `vlx` is never used), root package only for a workspace;
-- the native install is `vlt install`, whose root `postinstall` fires on
-  every install that changes the graph (vlt >= 1.0.0-rc.13), with
-  `VLT_TELEMETRY=0`.
-
-A failing hook aborts and rolls back the whole `vlt install`, exactly as it
-fails `npm install`, so `wrong_target_patchset` (a manifest whose only
-patch targets an absent package makes `apply` exit 1) reports a failed
-install for vlt as it does for npm.
-
-## Result classification
-
-Each case's `actual` is compared against both the aspirational `expect`
-and the recorded `baseline`:
-
-| classification | meaning |
-|---|---|
-| `pass`       | meets the ideal and matches the baseline |
-| `known_gap`  | fails the ideal, exactly as recorded — expected today, non-blocking |
-| `progress`   | better than the recorded baseline — update `baseline_supported` in `matrix.json`! |
-| `regression` | diverged from the baseline the wrong way — the only thing that fails the runner |
-| `known_regression` | would be a regression, but is on the matrix.json `known_regressions` allowlist (tracked, non-blocking) |
-| `error`      | the driver produced no parseable result |
-
-The Rust wrappers (`tests/setup_matrix_<eco>.rs`) assert the **ideal**
-(`actual == expect`), so they are red for `known_gap` cases — that is the
-intended "TODO list" view. The `scripts/setup-matrix.sh` runner uses the
-**baseline** view and only exits non-zero on a `regression`.
-
-## Running it
-
-Requires a Docker daemon (default) or host-installed toolchains
-(`SOCKET_PATCH_TEST_HOST=1`).
-
-```sh
-# Build the shared base + a per-ecosystem image.
-scripts/setup-matrix.sh build --ecosystem npm
-
-# Run all npm-family cases and write a JSON report.
-scripts/setup-matrix.sh run --ecosystem npm
-
-# Filter to a single package manager / scenario.
-scripts/setup-matrix.sh run --ecosystem pypi --pm uv
-scripts/setup-matrix.sh run --scenario no_setup_control
-
-# Run the nested-workspace and polyglot-monorepo cases.
-scripts/setup-matrix.sh run --scenario workspace_with_setup
-scripts/setup-matrix.sh run --scenario monorepo_with_setup
-
-# Query the last results (agent-friendly JSON).
-scripts/setup-matrix.sh query --status known_gap
-scripts/setup-matrix.sh query --status regression
-scripts/setup-matrix.sh query --layout workspace
-scripts/setup-matrix.sh list --json
-
-# Host mode (no Docker; needs the toolchains + a built binary on PATH).
-SOCKET_PATCH_TEST_HOST=1 scripts/setup-matrix.sh run --ecosystem npm --host
-```
-
-Or via `cargo test` (the aspirational view; gated by the `setup-e2e`
-feature; soft-skips when the image isn't built):
-
-```sh
-cargo test -p socket-patch-cli --features setup-e2e --test setup_matrix_npm
-SOCKET_PATCH_TEST_HOST=1 cargo test -p socket-patch-cli --features setup-e2e --test setup_matrix_npm
-```
-
-## Files
-
-- `matrix.json` — declarative case list: `targets`×`scenarios` (single),
-  `workspace_targets`×`workspace_scenarios`, `monorepo_targets`×`monorepo_scenarios`, + markers.
-- `run-case.sh` — self-contained flow driver (one case → JSON result),
-  layout-aware (`SM_LAYOUT=single|workspace|monorepo`); generates the
-  runner shims inline so it can be piped into a container.
-- `shims/{npx,pnpm}` — reference copies of the PATH shims that route
-  `npx`/`pnpm dlx @socketsecurity/socket-patch` to the locally-built
-  binary (so the hook runs the binary under test, not a registry fetch).
-- `results/latest.json` — most recent aggregate report (git-ignored).
-- `../docker/Dockerfile.{npm,pypi,…}` — the per-ecosystem images
-  (npm/pypi extended with the extra package managers).
-- `../../crates/socket-patch-cli/tests/setup_matrix_<eco>.rs` — thin Rust
-  wrappers around the same driver (incl. `setup_matrix_monorepo.rs`; the
-  npm/pypi wrappers add `*_workspace` tests).
-
-## Adding a package manager / ecosystem
-
-1. Add a `targets[]` entry to `matrix.json` (image, package, purl,
-   manifest key, whether `setup` supports it today via
-   `baseline_supported`).
-2. Teach `run-case.sh` how to scaffold + install + resolve the target
-   file for the new `pm` (the `scaffold_project` / `run_install` /
-   `resolve_target` case statements).
-3. If a new toolchain is needed, add it to the relevant
-   `tests/docker/Dockerfile.<eco>`.
-4. Add a `#[test]` for the `pm` in the matching `setup_matrix_<eco>.rs`.
diff --git a/tests/setup_matrix/matrix.json b/tests/setup_matrix/matrix.json
deleted file mode 100644
index 2e19fbdf..00000000
--- a/tests/setup_matrix/matrix.json
+++ /dev/null
@@ -1,318 +0,0 @@
-{
-  "_comment": [
-    "Declarative source of truth for the `socket-patch setup` end-to-end test matrix.",
-    "Consumed by BOTH scripts/setup-matrix.sh (jq) and the Rust wrappers",
-    "crates/socket-patch-cli/tests/setup_matrix_<eco>.rs (serde_json).",
-    "",
-    "A 'case' is the cross-product (target x scenario). expect_applied comes from",
-    "the scenario (the ASPIRATIONAL ideal); baseline_supported on the target says",
-    "whether `setup` ACTUALLY wires a working install hook today. The classifier in",
-    "the orchestrator compares actual vs both: meeting the ideal => pass; failing the",
-    "ideal but matching the recorded baseline => known_gap (non-blocking); diverging",
-    "from the baseline in the wrong direction => regression (blocking the optional job).",
-    "",
-    "Packages, PURLs, manifest keys and install layouts are reused verbatim from the",
-    "existing tests/docker_e2e_<eco>.rs so the fixtures are known-valid.",
-    "NOTE: pypi uses NO `package/` prefix in the manifest key (the python crawler",
-    "reports the site-packages root); every other ecosystem uses `package/<rel>`."
-  ],
-
-  "marker": "SOCKET-PATCH-SETUP-MATRIX-MARKER",
-  "alt_marker": "SOCKET-PATCH-SETUP-MATRIX-ALT-MARKER",
-
-  "_known_regressions_comment": [
-    "TEMPORARY allowlist of cases (by `<eco>/<pm>/<scenario>` id) that the",
-    "baseline records as supported (baseline_supported=true — they SHOULD work,",
-    "and DID) but currently do NOT apply the patch after `setup` + install.",
-    "Listing a case here downgrades its `regression` classification to the",
-    "non-blocking `known_regression` so the experimental matrix job stays green",
-    "while the underlying bug is tracked, WITHOUT pretending the case is an",
-    "unimplemented gap (baseline_supported stays true, so when the hook is fixed",
-    "the case auto-recovers to `pass` and should simply be removed from this",
-    "list). These are pre-existing (present on main): the pnpm root-postinstall",
-    "hook and the pip/uv/hatch `.pth` hook are not re-applying the patch on a",
-    "fresh install (npm/yarn/bun work). Remove an entry once its hook is fixed."
-  ],
-  "known_regressions": [
-    "npm/pnpm/baseline_with_setup",
-    "npm/pnpm/alt_content_patchset",
-    "npm/pnpm/workspace_with_setup",
-    "pypi/pip/baseline_with_setup",
-    "pypi/pip/alt_content_patchset",
-    "pypi/uv/baseline_with_setup",
-    "pypi/uv/alt_content_patchset",
-    "pypi/hatch/baseline_with_setup",
-    "pypi/hatch/alt_content_patchset"
-  ],
-
-  "scenarios": [
-    {
-      "id": "baseline_with_setup",
-      "run_setup": true,
-      "patchset": "primary",
-      "expect_applied": true,
-      "description": "Prepare deps + committed patch set, run `socket-patch setup`, run the native install. The install hook should apply the patch (the ideal)."
-    },
-    {
-      "id": "no_setup_control",
-      "run_setup": false,
-      "patchset": "primary",
-      "expect_applied": false,
-      "description": "Negative control: identical fixture but setup is NOT run. With no hook configured, the install must NOT apply the patch."
-    },
-    {
-      "id": "empty_patchset",
-      "run_setup": true,
-      "patchset": "empty",
-      "expect_applied": false,
-      "description": "Different patch set: an empty manifest. Even with setup, nothing should be applied."
-    },
-    {
-      "id": "wrong_target_patchset",
-      "run_setup": true,
-      "patchset": "wrong",
-      "expect_applied": false,
-      "description": "Different patch set: a manifest that patches a different, non-installed package. The installed package must be left untouched."
-    },
-    {
-      "id": "alt_content_patchset",
-      "run_setup": true,
-      "patchset": "alt",
-      "expect_applied": true,
-      "description": "Different patch set: a second fixture whose blob carries the ALT marker. Proves the applied bytes track the active manifest (alt marker present, primary marker absent)."
-    },
-    {
-      "id": "patch_missing",
-      "run_setup": true,
-      "patchset": "none",
-      "expect_applied": false,
-      "description": "Ablation: setup runs and the install hook fires, but NO patch set is committed (no .socket/). The install must run UNPATCHED — proving the committed patch is what changes the code, not setup/install alone."
-    }
-  ],
-
-  "targets": [
-    {
-      "ecosystem": "npm", "pm": "npm", "image": "npm", "hook_family": "npm",
-      "baseline_supported": true,
-      "package": "minimist", "version": "1.2.2", "purl": "pkg:npm/minimist@1.2.2",
-      "manifest_key": "package/index.js", "apply_ecosystems": "npm"
-    },
-    {
-      "ecosystem": "npm", "pm": "yarn", "image": "npm", "hook_family": "npm",
-      "baseline_supported": true,
-      "package": "minimist", "version": "1.2.2", "purl": "pkg:npm/minimist@1.2.2",
-      "manifest_key": "package/index.js", "apply_ecosystems": "npm"
-    },
-    {
-      "ecosystem": "npm", "pm": "pnpm", "image": "npm", "hook_family": "pnpm",
-      "baseline_supported": true,
-      "package": "minimist", "version": "1.2.2", "purl": "pkg:npm/minimist@1.2.2",
-      "manifest_key": "package/index.js", "apply_ecosystems": "npm"
-    },
-    {
-      "ecosystem": "npm", "pm": "bun", "image": "npm", "hook_family": "npm",
-      "baseline_supported": true,
-      "package": "minimist", "version": "1.2.2", "purl": "pkg:npm/minimist@1.2.2",
-      "manifest_key": "package/index.js", "apply_ecosystems": "npm"
-    },
-    {
-      "ecosystem": "npm", "pm": "vlt", "image": "npm", "hook_family": "npm",
-      "baseline_supported": true,
-      "package": "minimist", "version": "1.2.2", "purl": "pkg:npm/minimist@1.2.2",
-      "manifest_key": "package/index.js", "apply_ecosystems": "npm"
-    },
-
-    {
-      "ecosystem": "pypi", "pm": "pip", "image": "pypi", "hook_family": "pth",
-      "baseline_supported": true,
-      "package": "six", "version": "1.16.0", "purl": "pkg:pypi/six@1.16.0",
-      "manifest_key": "six.py", "apply_ecosystems": "pypi"
-    },
-    {
-      "ecosystem": "pypi", "pm": "uv", "image": "pypi", "hook_family": "pth",
-      "baseline_supported": true,
-      "package": "six", "version": "1.16.0", "purl": "pkg:pypi/six@1.16.0",
-      "manifest_key": "six.py", "apply_ecosystems": "pypi"
-    },
-    {
-      "ecosystem": "pypi", "pm": "poetry", "image": "pypi", "hook_family": "none",
-      "baseline_supported": false,
-      "package": "six", "version": "1.16.0", "purl": "pkg:pypi/six@1.16.0",
-      "manifest_key": "six.py", "apply_ecosystems": "pypi"
-    },
-    {
-      "ecosystem": "pypi", "pm": "pdm", "image": "pypi", "hook_family": "none",
-      "baseline_supported": false,
-      "package": "six", "version": "1.16.0", "purl": "pkg:pypi/six@1.16.0",
-      "manifest_key": "six.py", "apply_ecosystems": "pypi"
-    },
-    {
-      "ecosystem": "pypi", "pm": "hatch", "image": "pypi", "hook_family": "pth",
-      "baseline_supported": true,
-      "package": "six", "version": "1.16.0", "purl": "pkg:pypi/six@1.16.0",
-      "manifest_key": "six.py", "apply_ecosystems": "pypi"
-    },
-
-    {
-      "ecosystem": "cargo", "pm": "cargo", "image": "cargo", "hook_family": "none",
-      "baseline_supported": false,
-      "package": "cfg-if", "version": "1.0.0", "purl": "pkg:cargo/cfg-if@1.0.0",
-      "manifest_key": "package/src/lib.rs", "apply_ecosystems": "cargo"
-    },
-
-    {
-      "ecosystem": "gem", "pm": "bundler", "image": "gem", "hook_family": "bundler-plugin",
-      "baseline_supported": true,
-      "package": "colorize", "version": "1.1.0", "purl": "pkg:gem/colorize@1.1.0",
-      "manifest_key": "package/lib/colorize.rb", "apply_ecosystems": "gem"
-    },
-
-    {
-      "ecosystem": "golang", "pm": "go", "image": "golang", "hook_family": "none",
-      "baseline_supported": false,
-      "package": "github.com/gin-gonic/gin", "version": "v1.9.1",
-      "purl": "pkg:golang/github.com/gin-gonic/gin@v1.9.1",
-      "manifest_key": "package/gin.go", "apply_ecosystems": "golang"
-    },
-
-    {
-      "ecosystem": "maven", "pm": "mvn", "image": "maven", "hook_family": "none",
-      "baseline_supported": false,
-      "package": "org.apache.commons:commons-lang3", "version": "3.12.0",
-      "purl": "pkg:maven/org.apache.commons/commons-lang3@3.12.0",
-      "manifest_key": "package/commons-lang3-3.12.0.pom", "apply_ecosystems": "maven"
-    },
-
-    {
-      "ecosystem": "composer", "pm": "composer", "image": "composer", "hook_family": "composer-event",
-      "baseline_supported": true,
-      "package": "monolog/monolog", "version": "3.5.0", "purl": "pkg:composer/monolog/monolog@3.5.0",
-      "manifest_key": "package/src/Monolog/Logger.php", "apply_ecosystems": "composer"
-    },
-
-    {
-      "ecosystem": "nuget", "pm": "dotnet", "image": "nuget", "hook_family": "none",
-      "baseline_supported": false,
-      "package": "Newtonsoft.Json", "version": "13.0.3", "purl": "pkg:nuget/newtonsoft.json@13.0.3",
-      "manifest_key": "package/LICENSE.md", "apply_ecosystems": "nuget"
-    },
-
-    {
-      "ecosystem": "deno", "pm": "deno", "image": "deno", "hook_family": "npm-via-deno",
-      "baseline_supported": false,
-      "package": "minimist", "version": "1.2.2", "purl": "pkg:npm/minimist@1.2.2",
-      "manifest_key": "package/index.js", "apply_ecosystems": "npm"
-    }
-  ],
-
-  "_workspace_comment": [
-    "Nested-workspace layouts (run-case.sh SM_LAYOUT=workspace): a root +",
-    "several workspace members (incl. a deeply-nested one and a member that",
-    "does NOT use the patched package). Models real monorepos and exercises",
-    "`setup`'s workspace handling — npm/yarn write the hook to every member,",
-    "pnpm and vlt only to the root — plus the cross-workspace apply on the root",
-    "install. npm/yarn/pnpm/vlt should apply (baseline_supported true); Python",
-    "workspaces (uv workspace, pip nested-requirements) are gaps."
-  ],
-  "workspace_scenarios": [
-    {
-      "id": "workspace_with_setup",
-      "run_setup": true,
-      "patchset": "primary",
-      "expect_applied": true,
-      "description": "Nested workspace: setup at root, then a root-level install must apply the patch to the (hoisted/store-linked) dependency used across members."
-    },
-    {
-      "id": "workspace_no_setup",
-      "run_setup": false,
-      "patchset": "primary",
-      "expect_applied": false,
-      "description": "Ablation (setup not run): workspace install without setup must NOT apply — the hook is the cause."
-    },
-    {
-      "id": "workspace_patch_missing",
-      "run_setup": true,
-      "patchset": "none",
-      "expect_applied": false,
-      "description": "Ablation (patch missing): workspace setup + install with NO committed patch set must run unpatched across the workspace."
-    }
-  ],
-  "workspace_targets": [
-    {
-      "ecosystem": "npm", "pm": "npm", "image": "npm", "hook_family": "npm",
-      "baseline_supported": true,
-      "package": "minimist", "version": "1.2.2", "purl": "pkg:npm/minimist@1.2.2",
-      "manifest_key": "package/index.js", "apply_ecosystems": "npm"
-    },
-    {
-      "ecosystem": "npm", "pm": "pnpm", "image": "npm", "hook_family": "pnpm",
-      "baseline_supported": true,
-      "package": "minimist", "version": "1.2.2", "purl": "pkg:npm/minimist@1.2.2",
-      "manifest_key": "package/index.js", "apply_ecosystems": "npm"
-    },
-    {
-      "ecosystem": "npm", "pm": "yarn", "image": "npm", "hook_family": "npm",
-      "baseline_supported": true,
-      "package": "minimist", "version": "1.2.2", "purl": "pkg:npm/minimist@1.2.2",
-      "manifest_key": "package/index.js", "apply_ecosystems": "npm"
-    },
-    {
-      "ecosystem": "npm", "pm": "vlt", "image": "npm", "hook_family": "npm",
-      "baseline_supported": true,
-      "package": "minimist", "version": "1.2.2", "purl": "pkg:npm/minimist@1.2.2",
-      "manifest_key": "package/index.js", "apply_ecosystems": "npm"
-    },
-    {
-      "ecosystem": "pypi", "pm": "pip", "image": "pypi", "hook_family": "none",
-      "baseline_supported": false,
-      "package": "six", "version": "1.16.0", "purl": "pkg:pypi/six@1.16.0",
-      "manifest_key": "six.py", "apply_ecosystems": "pypi"
-    },
-    {
-      "ecosystem": "pypi", "pm": "uv", "image": "pypi", "hook_family": "none",
-      "baseline_supported": false,
-      "package": "six", "version": "1.16.0", "purl": "pkg:pypi/six@1.16.0",
-      "manifest_key": "six.py", "apply_ecosystems": "pypi"
-    }
-  ],
-
-  "_monorepo_comment": [
-    "Polyglot monorepo (SM_LAYOUT=monorepo): an npm workspace alongside",
-    "python/rust/go/php/ruby/nuget/deno manifests. Confirms `setup` works in",
-    "a mixed environment — it must configure the npm hooks and NOT choke on",
-    "the foreign manifests; a root `npm install` then patches the npm slice.",
-    "Runs in the npm image (the only one with the npm toolchain); the foreign",
-    "manifests are present to test setup's robustness, not installed."
-  ],
-  "monorepo_scenarios": [
-    {
-      "id": "monorepo_with_setup",
-      "run_setup": true,
-      "patchset": "primary",
-      "expect_applied": true,
-      "description": "All ecosystems present: setup at root, then npm install applies the patch to the npm workspace dependency; setup must not error on the foreign manifests."
-    },
-    {
-      "id": "monorepo_no_setup",
-      "run_setup": false,
-      "patchset": "primary",
-      "expect_applied": false,
-      "description": "Ablation (setup not run): polyglot monorepo install without setup must NOT apply."
-    },
-    {
-      "id": "monorepo_patch_missing",
-      "run_setup": true,
-      "patchset": "none",
-      "expect_applied": false,
-      "description": "Ablation (patch missing): polyglot monorepo setup + install with NO committed patch set must run unpatched."
-    }
-  ],
-  "monorepo_targets": [
-    {
-      "ecosystem": "monorepo", "pm": "mono", "image": "npm", "hook_family": "npm",
-      "baseline_supported": true,
-      "package": "minimist", "version": "1.2.2", "purl": "pkg:npm/minimist@1.2.2",
-      "manifest_key": "package/index.js", "apply_ecosystems": "npm"
-    }
-  ]
-}
diff --git a/tests/setup_matrix/results/.gitignore b/tests/setup_matrix/results/.gitignore
deleted file mode 100644
index d5ae1810..00000000
--- a/tests/setup_matrix/results/.gitignore
+++ /dev/null
@@ -1,3 +0,0 @@
-# Generated setup-matrix run reports; keep the directory, ignore contents.
-*
-!.gitignore
diff --git a/tests/setup_matrix/run-case.sh b/tests/setup_matrix/run-case.sh
deleted file mode 100755
index 11618d88..00000000
--- a/tests/setup_matrix/run-case.sh
+++ /dev/null
@@ -1,883 +0,0 @@
-#!/usr/bin/env bash
-# =====================================================================
-# setup-matrix flow driver — runs ONE (ecosystem, pm, scenario) case of
-# the `socket-patch setup` end-to-end matrix and emits a JSON result.
-#
-# This script is the single source of truth for the flow:
-#   0. prepare a project with the dependency + a committed patch set
-#   1. (optionally) run `socket-patch setup` to configure install hooks
-#   2. run the native install command for the package manager
-#   3. check whether the patch was applied (marker present on disk)
-#
-# It is invoked by BOTH scripts/setup-matrix.sh (orchestrator) and the
-# Rust wrappers (crates/socket-patch-cli/tests/setup_matrix_<eco>.rs),
-# either inside a Docker container (script piped to `bash -c`) or on the
-# host. It is fully self-contained: it generates the npx/pnpm shims
-# inline so no extra files need to be copied into the container.
-#
-# The driver only REPORTS (expected vs actual). Pass/fail/known-gap/
-# regression classification is done by the caller against the recorded
-# baseline in matrix.json.
-#
-# Inputs (environment, all SM_*-prefixed):
-#   SM_ID                stable case id (for the JSON result)
-#   SM_ECOSYSTEM         npm|pypi|cargo|gem|golang|maven|composer|nuget|deno
-#   SM_PM                npm|yarn|pnpm|bun|vlt|pip|uv|poetry|pdm|hatch|cargo|
-#                        bundler|go|mvn|composer|dotnet|deno
-#   SM_SCENARIO          scenario id (echoed back)
-#   SM_PATCHSET          primary|alt|empty|wrong|none
-#   SM_LAYOUT            single|workspace|monorepo
-#   SM_RUN_SETUP         1|0  — run `socket-patch setup` before install
-#   SM_EXPECT_APPLIED    1|0  — the aspirational expectation
-#   SM_PACKAGE           dependency name (e.g. minimist, six, cfg-if)
-#   SM_VERSION           dependency version (e.g. 1.2.2)
-#   SM_PURL              manifest key PURL (e.g. pkg:npm/minimist@1.2.2)
-#   SM_MANIFEST_KEY      file key in the patch record (e.g. package/index.js,
-#                        or `six.py` for pypi — NO package/ prefix)
-#   SM_APPLY_ECOSYSTEMS  ecosystem token used to build the "wrong" PURL
-#   SM_MARKER            primary marker string spliced into the patched blob
-#   SM_ALT_MARKER        alternate marker (alt_content_patchset)
-#   SOCKET_PATCH_BIN     path to the binary under test (default: socket-patch on PATH)
-#   SM_WORKDIR           scratch dir (default: a fresh mktemp -d)
-# =====================================================================
-
-set -uo pipefail
-
-# Route all ordinary output to stderr; the final JSON goes to the saved
-# stdout (fd 3) so the result line is the ONLY thing on real stdout.
-exec 3>&1 1>&2
-
-SM_ID="${SM_ID:-unknown}"
-SM_ECOSYSTEM="${SM_ECOSYSTEM:-}"
-SM_PM="${SM_PM:-}"
-SM_SCENARIO="${SM_SCENARIO:-}"
-SM_PATCHSET="${SM_PATCHSET:-primary}"
-SM_RUN_SETUP="${SM_RUN_SETUP:-1}"
-SM_EXPECT_APPLIED="${SM_EXPECT_APPLIED:-0}"
-SM_PACKAGE="${SM_PACKAGE:-}"
-SM_VERSION="${SM_VERSION:-}"
-SM_PURL="${SM_PURL:-}"
-SM_MANIFEST_KEY="${SM_MANIFEST_KEY:-package/index.js}"
-SM_APPLY_ECOSYSTEMS="${SM_APPLY_ECOSYSTEMS:-npm}"
-SM_MARKER="${SM_MARKER:-SOCKET-PATCH-SETUP-MATRIX-MARKER}"
-SM_ALT_MARKER="${SM_ALT_MARKER:-SOCKET-PATCH-SETUP-MATRIX-ALT-MARKER}"
-SM_LAYOUT="${SM_LAYOUT:-single}"
-
-ZEROHASH="0000000000000000000000000000000000000000000000000000000000000000"
-UUID="aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa"
-WRONG_PURL="pkg:${SM_APPLY_ECOSYSTEMS}/sm-setup-matrix-absent@9.9.9"
-
-SP_BIN="${SOCKET_PATCH_BIN:-$(command -v socket-patch 2>/dev/null || echo socket-patch)}"
-export SOCKET_PATCH_BIN="$SP_BIN"
-
-NOTES=""
-note() { NOTES="${NOTES}${NOTES:+; }$*"; }
-log()  { printf '[setup-matrix:%s] %s\n' "$SM_ID" "$*"; }
-
-# --- JSON emit (hand-rolled; values are simple, sanitized) ------------
-json_str() { printf '%s' "$1" | tr -d '\r' | tr '\n' ' ' | sed 's/\\/\\\\/g; s/"/\\"/g'; }
-emit_result() {
-  local actual="$1" primary_present="$2" setup_exit="$3" install_exit="$4" target="$5" status="$6"
-  printf '{"id":"%s","ecosystem":"%s","pm":"%s","scenario":"%s","patchset":"%s","run_setup":%s,"expect_applied":%s,"actual_applied":%s,"applied_before_setup":%s,"applied_after_remove":%s,"primary_marker_present":%s,"setup_exit":%s,"install_exit":%s,"check_before_setup_exit":%s,"check_after_setup_exit":%s,"remove_exit":%s,"check_after_remove_exit":%s,"target":"%s","status":"%s","notes":"%s"}\n' \
-    "$(json_str "$SM_ID")" "$(json_str "$SM_ECOSYSTEM")" "$(json_str "$SM_PM")" \
-    "$(json_str "$SM_SCENARIO")" "$(json_str "$SM_PATCHSET")" \
-    "$([ "$SM_RUN_SETUP" = 1 ] && echo true || echo false)" \
-    "$([ "$SM_EXPECT_APPLIED" = 1 ] && echo true || echo false)" \
-    "$actual" "${APPLIED_BEFORE_SETUP:-null}" "${APPLIED_AFTER_REMOVE:-null}" "$primary_present" \
-    "$setup_exit" "$install_exit" \
-    "${CHECK_BEFORE_SETUP_EXIT:-null}" "${CHECK_AFTER_SETUP_EXIT:-null}" "${REMOVE_EXIT:-null}" "${CHECK_AFTER_REMOVE_EXIT:-null}" \
-    "$(json_str "$target")" "$(json_str "$status")" "$(json_str "$NOTES")" >&3
-}
-
-# --- git-sha256 (blob <len>\0 + content) ------------------------------
-git_sha256() { # $1 = file
-  local len; len="$(wc -c < "$1")"
-  { printf 'blob %d\0' "$len"; cat "$1"; } | sha256sum | cut -d' ' -f1
-}
-
-# --- inline npx/pnpm shims (kept in sync with tests/setup_matrix/shims/) --
-write_shims() { # $1 = shim dir
-  local d="$1"; mkdir -p "$d"
-  cat > "$d/npx" <<'SHIM'
-#!/usr/bin/env bash
-set -uo pipefail
-sp_bin="${SOCKET_PATCH_BIN:-socket-patch}"
-shim_dir="${SETUP_MATRIX_SHIM_DIR:-}"
-clean_path="$PATH"
-[ -n "$shim_dir" ] && clean_path="$(printf '%s' "$PATH" | tr ':' '\n' | grep -vxF "$shim_dir" | paste -sd: -)"
-real_npx="$(PATH="$clean_path" command -v npx 2>/dev/null || true)"
-i=0
-for arg in "$@"; do
-  case "$arg" in
-    @socketsecurity/socket-patch|@socketsecurity/socket-patch@*|@socketsecurity/socket-patch/*)
-      shift "$((i + 1))"; exec "$sp_bin" "$@" ;;
-  esac
-  i=$((i + 1))
-done
-[ -n "$real_npx" ] && exec "$real_npx" "$@"
-echo "setup-matrix npx shim: real npx not found: $*" >&2; exit 127
-SHIM
-  cat > "$d/pnpm" <<'SHIM'
-#!/usr/bin/env bash
-set -uo pipefail
-sp_bin="${SOCKET_PATCH_BIN:-socket-patch}"
-shim_dir="${SETUP_MATRIX_SHIM_DIR:-}"
-clean_path="$PATH"
-[ -n "$shim_dir" ] && clean_path="$(printf '%s' "$PATH" | tr ':' '\n' | grep -vxF "$shim_dir" | paste -sd: -)"
-real_pnpm="$(PATH="$clean_path" command -v pnpm 2>/dev/null || true)"
-if [ "${1:-}" = "dlx" ] || [ "${1:-}" = "exec" ]; then
-  case "${2:-}" in
-    @socketsecurity/socket-patch|@socketsecurity/socket-patch@*) shift 2; exec "$sp_bin" "$@" ;;
-  esac
-fi
-[ -n "$real_pnpm" ] && exec "$real_pnpm" "$@"
-echo "setup-matrix pnpm shim: real pnpm not found: $*" >&2; exit 127
-SHIM
-  chmod +x "$d/npx" "$d/pnpm"
-}
-
-# --- committed patch fixture ------------------------------------------
-# The patched blob is RUNNABLE code that emits the marker on stdout when the
-# file is executed, so verification can RUN the patched module with the
-# ecosystem's standard runner (node/bun/python) and observe the marker at
-# runtime — not merely scan the file for the string. Compiled/loaded
-# ecosystems we can't execute keep an inert comment (verified by reading the
-# file; see `run_file`).
-marker_blob() { # $1 = marker  -> runnable payload on stdout
-  case "$SM_ECOSYSTEM" in
-    npm|deno|monorepo) printf 'console.log("%s");\n' "$1" ;;
-    pypi)              printf 'print("%s")\n' "$1" ;;
-    *)                 printf '/* %s */\n' "$1" ;;
-  esac
-}
-
-write_manifest() { # $1=purl $2=key $3=afterHash $4=beforeHash (default: zero)
-  local before="${4:-$ZEROHASH}"
-  cat > .socket/manifest.json <<EOF
-{
-  "patches": {
-    "$1": {
-      "uuid": "$UUID",
-      "exportedAt": "2026-01-01T00:00:00Z",
-      "files": { "$2": { "beforeHash": "$before", "afterHash": "$3" } },
-      "vulnerabilities": {},
-      "description": "setup-matrix synthetic patch",
-      "license": "MIT",
-      "tier": "free"
-    }
-  }
-}
-EOF
-}
-
-# gem only: the real git-blob sha256 of the target file inside the published
-# .gem, probed via `gem fetch` + `gem unpack` (mirrors docker_e2e_gem's
-# beforeHash probe). gem apply is hash-gated with no npm-style
-# mismatch-warn-and-apply fallback, so the all-zeros placeholder makes the
-# variant gate drop the package and the install hook's apply no-ops. Every
-# other ecosystem keeps the zero hash — their fixtures are byte-identical to
-# before this helper existed.
-resolve_before_hash() {
-  if [ "$SM_ECOSYSTEM" != gem ]; then
-    printf '%s' "$ZEROHASH"
-    return
-  fi
-  local dir rel target
-  dir="$(mktemp -d)"
-  rel="${SM_MANIFEST_KEY#package/}"
-  target="$dir/${SM_PACKAGE}-${SM_VERSION}/$rel"
-  if (cd "$dir" \
-        && gem fetch "$SM_PACKAGE" -v "$SM_VERSION" >/dev/null 2>&1 \
-        && gem unpack "${SM_PACKAGE}-${SM_VERSION}.gem" >/dev/null 2>&1) \
-      && [ -f "$target" ]; then
-    git_sha256 "$target"
-  else
-    # The function runs inside $(...): route the log PAST the capture pipe.
-    log "gem beforeHash probe failed; falling back to the zero placeholder" >&2
-    printf '%s' "$ZEROHASH"
-  fi
-  rm -rf "$dir"
-}
-
-build_fixture() {
-  # Ablation: no patch set committed at all (no .socket/). Even with a
-  # working install hook, apply finds no manifest and no-ops, so the
-  # install must run unpatched. Distinct from `empty` (manifest present
-  # but with zero patches).
-  if [ "$SM_PATCHSET" = none ]; then
-    note "no patch fixture committed (ablation: patch missing)"
-    return
-  fi
-  mkdir -p .socket/blobs
-  # Per-case scratch file for the blob. MUST NOT be a fixed path like
-  # /tmp/sm_blob: the Rust matrix wrappers run the package-manager test fns in
-  # parallel, so a shared path races (one case hashes a blob another just
-  # overwrote → afterHash mismatch → apply no-ops).
-  local blob_tmp; blob_tmp="$(mktemp)"
-  case "$SM_PATCHSET" in
-    empty)
-      printf '{"patches":{}}\n' > .socket/manifest.json
-      note "empty manifest" ;;
-    wrong)
-      # A patch for a package that is NOT installed: nothing should match.
-      marker_blob "$SM_MARKER" > "$blob_tmp"
-      local h; h="$(git_sha256 "$blob_tmp")"; cp "$blob_tmp" ".socket/blobs/$h"
-      write_manifest "$WRONG_PURL" "$SM_MANIFEST_KEY" "$h"
-      note "manifest targets absent purl $WRONG_PURL" ;;
-    alt)
-      marker_blob "$SM_ALT_MARKER" > "$blob_tmp"
-      local h; h="$(git_sha256 "$blob_tmp")"; cp "$blob_tmp" ".socket/blobs/$h"
-      write_manifest "$SM_PURL" "$SM_MANIFEST_KEY" "$h" "$(resolve_before_hash)" ;;
-    *) # primary
-      marker_blob "$SM_MARKER" > "$blob_tmp"
-      local h; h="$(git_sha256 "$blob_tmp")"; cp "$blob_tmp" ".socket/blobs/$h"
-      write_manifest "$SM_PURL" "$SM_MANIFEST_KEY" "$h" "$(resolve_before_hash)" ;;
-  esac
-  rm -f "$blob_tmp"
-}
-
-# --- per-PM project scaffold (must exist before setup runs) -----------
-scaffold_project() {
-  case "$SM_PM" in
-    npm|yarn|bun)
-      printf '{"name":"sm-proj","version":"0.0.0","private":true}\n' > package.json ;;
-    pnpm)
-      # pnpm only runs the ROOT postinstall on `pnpm install` (not on
-      # `pnpm add`), so the dependency is declared up front and installed
-      # via a bare `pnpm install`. The stub lockfile is the pnpm marker
-      # that makes `setup` detect pnpm and write the `pnpm dlx` hook.
-      cat > package.json <<EOF
-{ "name": "sm-proj", "version": "0.0.0", "private": true, "dependencies": { "$SM_PACKAGE": "$SM_VERSION" } }
-EOF
-      printf "lockfileVersion: '9.0'\n" > pnpm-lock.yaml ;;
-    vlt)
-      # vlt runs the root postinstall on every install that changes the
-      # graph (vlt >= 1.0.0-rc.13), so the dependency is declared up front
-      # like pnpm's. vlt.json is the vlt marker `setup` detects, and it
-      # carries the registry config vlt >= 1.0.0-rc.33 needs to install.
-      cat > package.json <<EOF
-{ "name": "sm-proj", "version": "0.0.0", "private": true, "dependencies": { "$SM_PACKAGE": "$SM_VERSION" } }
-EOF
-      vlt_json > vlt.json ;;
-    deno)
-      cat > package.json <<EOF
-{ "name": "sm-proj", "version": "0.0.0", "private": true, "dependencies": { "$SM_PACKAGE": "$SM_VERSION" } }
-EOF
-      cat > deno.json <<EOF
-{ "name": "sm-proj", "version": "0.0.0", "nodeModulesDir": "auto" }
-EOF
-      ;;
-    pip)
-      # A requirements.txt makes `setup` detect a pip project and add the
-      # `socket-patch[hook]` dependency to it.
-      printf '%s==%s\n' "$SM_PACKAGE" "$SM_VERSION" > requirements.txt ;;
-    uv)
-      # A PEP 621 pyproject + uv.lock makes `setup` detect a uv project.
-      cat > pyproject.toml <<EOF
-[project]
-name = "sm-proj"
-version = "0.0.0"
-requires-python = ">=3.9"
-dependencies = ["$SM_PACKAGE==$SM_VERSION"]
-
-[tool.uv]
-EOF
-      : > uv.lock ;;
-    poetry)
-      cat > pyproject.toml <<EOF
-[tool.poetry]
-name = "sm-proj"
-version = "0.0.0"
-description = ""
-authors = ["t <t@example.com>"]
-package-mode = false
-
-[build-system]
-requires = ["poetry-core"]
-build-backend = "poetry.core.masonry.api"
-EOF
-      ;;
-    pdm)
-      cat > pyproject.toml <<EOF
-[project]
-name = "sm-proj"
-version = "0.0.0"
-requires-python = ">=3.9"
-dependencies = []
-
-[tool.pdm]
-distribution = false
-EOF
-      ;;
-    hatch)
-      # `skip-install = true` so hatch does NOT try to build the (empty)
-      # project; the dependency is installed as an env dependency instead.
-      cat > pyproject.toml <<EOF
-[build-system]
-requires = ["hatchling"]
-build-backend = "hatchling.build"
-
-[project]
-name = "sm-proj"
-version = "0.0.0"
-requires-python = ">=3.9"
-
-[tool.hatch.envs.default]
-skip-install = true
-dependencies = ["$SM_PACKAGE==$SM_VERSION"]
-EOF
-      ;;
-    cargo)
-      cat > Cargo.toml <<EOF
-[package]
-name = "sm-proj"
-version = "0.0.0"
-edition = "2021"
-
-[dependencies]
-$SM_PACKAGE = "=$SM_VERSION"
-EOF
-      mkdir -p src; printf 'fn main() {}\n' > src/main.rs ;;
-    bundler)
-      cat > Gemfile <<EOF
-source 'https://rubygems.org'
-gem '$SM_PACKAGE', '$SM_VERSION'
-EOF
-      ;;
-    go)
-      printf 'module sm-proj\n\ngo 1.21\n' > go.mod ;;
-    composer)
-      # `setup` wires its hook into composer.json's script events, so the
-      # manifest must exist BEFORE setup runs — without it setup reports
-      # `no_files`, the hook is never written, and `composer require` below
-      # can't re-apply the patch. The dependency is left to `composer require`
-      # (same division of labour as npm/yarn/bun above). 4-space indent is
-      # what composer itself writes, so a reformat by setup would show up as
-      # a diff here too.
-      cat > composer.json <<EOF
-{
-    "name": "socket/sm-proj",
-    "description": "setup-matrix fixture",
-    "require": {}
-}
-EOF
-      ;;
-    mvn|dotnet) : ;;
-  esac
-}
-
-# --- pypi .pth hook helpers -------------------------------------------
-# When `setup` configured the hook (SM_RUN_SETUP=1) and a prebuilt hook
-# wheel is available, install it into the venv so its startup `.pth`
-# lands in site-packages, and point the binary the hook spawns at $SP_BIN.
-# This is the hermetic stand-in for `pip install -r requirements.txt`
-# resolving the committed `socket-patch[hook]` dependency from PyPI.
-pth_install_into_venv() { # $1=venv dir  $2=pip|uv
-  local venv="$1" flavor="$2"
-  [ "$SM_RUN_SETUP" = 1 ] || return 0
-  [ -n "${SOCKET_PATCH_HOOK_WHEEL:-}" ] && [ -f "${SOCKET_PATCH_HOOK_WHEEL:-}" ] || {
-    note "no SOCKET_PATCH_HOOK_WHEEL; pth hook not installed (gap)"; return 0; }
-  case "$flavor" in
-    uv)  uv pip install --python "$venv/bin/python" --quiet --no-deps "$SOCKET_PATCH_HOOK_WHEEL" || note "hook wheel install failed" ;;
-    *)   # pip-compatible venv (pip / poetry / pdm). Use the venv's own
-         # python so it targets that interpreter's site-packages; ensurepip
-         # if the venv was created without pip.
-         "$venv/bin/python" -m pip --version >/dev/null 2>&1 \
-           || "$venv/bin/python" -m ensurepip --upgrade >/dev/null 2>&1 || true
-         "$venv/bin/python" -m pip install --quiet --no-deps "$SOCKET_PATCH_HOOK_WHEEL" \
-           || note "hook wheel install failed" ;;
-  esac
-  # The hook resolves `socket-patch` off PATH (it isn't pip-installed here).
-  ln -sf "$SP_BIN" "$venv/bin/socket-patch" 2>/dev/null || true
-}
-
-# Start an interpreter so the `.pth` hook fires (models a CI app start /
-# the next python invocation after install). No-op if there is no venv.
-pth_trigger() { # $1=venv dir
-  local venv="$1"
-  [ -x "$venv/bin/python" ] || return 0
-  PATH="$PWD/$venv/bin:$PATH" "$venv/bin/python" -c "pass" >/dev/null 2>&1 || true
-}
-
-# vlt.json with the public registry configured every way vlt eras read it;
-# $1 = an optional `"workspaces": ...,` member to prepend.
-vlt_json() {
-  printf '{ %s"config": { "registry": "https://registry.npmjs.org/", "registries": { "npm": "https://registry.npmjs.org/" } } }\n' "${1:-}"
-}
-
-# --- per-PM native install (the hook, if configured, fires here) ------
-run_install() {
-  case "$SM_PM" in
-    npm)   npm install --silent --no-audit --no-fund "$SM_PACKAGE@$SM_VERSION" ;;
-    yarn)  yarn add --silent "$SM_PACKAGE@$SM_VERSION" ;;
-    pnpm)  pnpm install --no-frozen-lockfile ;;
-    bun)   bun add "$SM_PACKAGE@$SM_VERSION" ;;
-    vlt)   vlt install ;;
-    deno)  deno install --allow-scripts ;;
-    pip)
-      python3 -m venv venv
-      pth_install_into_venv venv pip
-      ./venv/bin/pip install --disable-pip-version-check --quiet --no-cache-dir "$SM_PACKAGE==$SM_VERSION"
-      pth_trigger venv ;;
-    uv)
-      uv venv venv
-      pth_install_into_venv venv uv
-      uv pip install --python venv/bin/python --quiet "$SM_PACKAGE==$SM_VERSION"
-      pth_trigger venv ;;
-    # poetry / pdm are resolver-based: `add` re-resolves the whole manifest
-    # (which setup edited to add `socket-patch[hook]`, whose `hook` extra pulls
-    # the unpublished socket-patch-hook wheel) against a package index.
-    # In this hermetic test the hook wheel isn't published, so resolution
-    # fails — these PMs can't be exercised without a local index, so they stay
-    # documented gaps (baseline_supported:false). The .pth mechanism itself is
-    # package-manager-agnostic (proven by pip/uv/hatch).
-    poetry) poetry config virtualenvs.in-project true --local && poetry add --no-interaction "$SM_PACKAGE@$SM_VERSION" ;;
-    pdm)   pdm config python.use_venv true >/dev/null 2>&1; pdm add "$SM_PACKAGE==$SM_VERSION" ;;
-    hatch)
-      HATCH_DATA_DIR="$PWD/.hatch" hatch env create
-      HATCH_DATA_DIR="$PWD/.hatch" hatch run python -c "import ${SM_PACKAGE//-/_}"
-      # hatch manages its env outside .venv; install the hook + fire an
-      # interpreter through `hatch run`.
-      if [ "$SM_RUN_SETUP" = 1 ] && [ -n "${SOCKET_PATCH_HOOK_WHEEL:-}" ] && [ -f "${SOCKET_PATCH_HOOK_WHEEL:-}" ]; then
-        HATCH_DATA_DIR="$PWD/.hatch" hatch run pip install --no-deps "$SOCKET_PATCH_HOOK_WHEEL" \
-          || note "hatch hook wheel install failed"
-      fi
-      HATCH_DATA_DIR="$PWD/.hatch" hatch run python -c "pass" || true ;;
-    cargo) cargo fetch ;;
-    bundler) bundle config set --local path vendor/bundle && bundle install ;;
-    go)    GOFLAGS=-mod=mod go mod download "$SM_PACKAGE@$SM_VERSION" ;;
-    mvn)   mvn -q -B dependency:get -Dartifact="$SM_PACKAGE:$SM_VERSION" ;;
-    composer) composer require --quiet --no-interaction "$SM_PACKAGE:$SM_VERSION" ;;
-    dotnet) dotnet new classlib -o . --force >/dev/null 2>&1 && dotnet add package "$SM_PACKAGE" --version "$SM_VERSION" ;;
-    *) echo "unknown pm: $SM_PM"; return 2 ;;
-  esac
-}
-
-# --- resolve the on-disk file the patch would land in -----------------
-resolve_target() {
-  local rel="${SM_MANIFEST_KEY#package/}"
-  local base; base="$(basename "$rel")"
-  case "$SM_ECOSYSTEM" in
-    npm|deno)  printf '%s\n' "$PWD/node_modules/$SM_PACKAGE/$rel" ;;
-    # Exclude vendored copies (pip/setuptools bundle their own six.py under
-    # */_vendor/*); the patch lands in the installed package at the
-    # site-packages root.
-    pypi)      find "$PWD" -name "$base" -not -path '*/_vendor/*' 2>/dev/null | head -1 ;;
-    cargo)     find "${CARGO_HOME:-$HOME/.cargo}/registry/src" -path "*/${SM_PACKAGE}-${SM_VERSION}/${rel}" 2>/dev/null | head -1 ;;
-    gem)       find "$PWD/vendor" -path "*/${SM_PACKAGE}-${SM_VERSION}/${rel}" 2>/dev/null | head -1 ;;
-    golang)    local gmc; gmc="$(go env GOMODCACHE 2>/dev/null || echo "${GOPATH:-$HOME/go}/pkg/mod")"; find "$gmc" -path "*/$(basename "$SM_PACKAGE")@${SM_VERSION}/${rel}" 2>/dev/null | head -1 ;;
-    maven)     find "$HOME/.m2/repository" -name "$base" 2>/dev/null | head -1 ;;
-    composer)  printf '%s\n' "$PWD/vendor/${SM_PACKAGE}/${rel}" ;;
-    nuget)     local lc; lc="$(printf '%s' "$SM_PACKAGE" | tr '[:upper:]' '[:lower:]')"; find "${NUGET_PACKAGES:-$HOME/.nuget/packages}" -path "*/${lc}/${SM_VERSION}/${rel}" 2>/dev/null | head -1 ;;
-  esac
-}
-
-# --- workspace scaffold (root + nested members) ----------------------
-# Models a real monorepo where multiple (incl. deeply-nested) workspace
-# members depend on the package being patched, plus a member that does
-# NOT — so `setup`'s workspace handling (npm: every member; pnpm: root
-# only) and the root install's cross-workspace apply are both exercised.
-ws_member_js() { # $1=dir $2=name (declares the dep)
-  mkdir -p "$1"
-  cat > "$1/package.json" <<EOF
-{ "name": "$2", "version": "0.0.0", "dependencies": { "$SM_PACKAGE": "$SM_VERSION" } }
-EOF
-}
-
-scaffold_workspace() {
-  case "$SM_PM" in
-    npm|yarn)
-      cat > package.json <<'EOF'
-{ "name": "sm-root", "version": "0.0.0", "private": true,
-  "workspaces": ["packages/*", "packages/group/*"] }
-EOF
-      ws_member_js packages/app "@sm/app"
-      ws_member_js packages/lib "@sm/lib"
-      ws_member_js packages/group/nested "@sm/nested"
-      mkdir -p packages/util   # member with NO dependency on the patched pkg
-      printf '{ "name": "@sm/util", "version": "0.0.0", "private": true }\n' > packages/util/package.json ;;
-    pnpm)
-      printf '{ "name": "sm-root", "version": "0.0.0", "private": true }\n' > package.json
-      cat > pnpm-workspace.yaml <<'EOF'
-packages:
-  - 'packages/*'
-  - 'packages/group/*'
-EOF
-      ws_member_js packages/app "@sm/app"
-      ws_member_js packages/lib "@sm/lib"
-      ws_member_js packages/group/nested "@sm/nested"
-      mkdir -p packages/util
-      printf '{ "name": "@sm/util", "version": "0.0.0", "private": true }\n' > packages/util/package.json ;;
-    vlt)
-      # vlt reads workspaces only from vlt.json; `setup` wires the root alone.
-      printf '{ "name": "sm-root", "version": "0.0.0", "private": true }\n' > package.json
-      vlt_json '"workspaces": ["packages/*", "packages/group/*"], ' > vlt.json
-      ws_member_js packages/app "@sm/app"
-      ws_member_js packages/lib "@sm/lib"
-      ws_member_js packages/group/nested "@sm/nested"
-      mkdir -p packages/util
-      printf '{ "name": "@sm/util", "version": "0.0.0", "private": true }\n' > packages/util/package.json ;;
-    uv)
-      # uv workspace: virtual root + members; the shared dep is installed
-      # into one root .venv by `uv sync`.
-      cat > pyproject.toml <<EOF
-[project]
-name = "sm-root"
-version = "0.0.0"
-requires-python = ">=3.9"
-dependencies = ["$SM_PACKAGE==$SM_VERSION"]
-
-[tool.uv.workspace]
-members = ["packages/*"]
-
-[tool.uv]
-package = false
-EOF
-      for m in app lib; do
-        mkdir -p "packages/$m"
-        cat > "packages/$m/pyproject.toml" <<EOF
-[project]
-name = "sm-$m"
-version = "0.0.0"
-requires-python = ">=3.9"
-dependencies = []
-
-[tool.uv]
-package = false
-EOF
-      done ;;
-    pip)
-      # pip "workspace" = nested requirements files installed into one venv.
-      mkdir -p packages/app packages/lib
-      echo "$SM_PACKAGE==$SM_VERSION" > packages/app/requirements.txt
-      echo "$SM_PACKAGE==$SM_VERSION" > packages/lib/requirements.txt
-      printf -- '-r packages/app/requirements.txt\n-r packages/lib/requirements.txt\n' > requirements.txt ;;
-  esac
-}
-
-run_install_workspace() {
-  case "$SM_PM" in
-    npm)  npm install --silent --no-audit --no-fund ;;
-    yarn) yarn install --silent ;;
-    pnpm) pnpm install --no-frozen-lockfile ;;
-    vlt)  vlt install ;;
-    uv)   uv sync ;;
-    pip)  python3 -m venv venv && ./venv/bin/pip install --disable-pip-version-check --quiet --no-cache-dir -r requirements.txt ;;
-  esac
-}
-
-# --- all-ecosystem monorepo scaffold ---------------------------------
-# A polyglot repo: an npm workspace (the slice `setup` supports AND the
-# npm image can install) alongside python/rust/go/php/ruby/nuget/deno
-# manifests. The point is to confirm `setup` works in this environment —
-# it must configure the npm hooks and NOT choke on the foreign manifests.
-scaffold_monorepo() {
-  cat > package.json <<'EOF'
-{ "name": "sm-monorepo", "version": "0.0.0", "private": true,
-  "workspaces": ["packages/js-*"] }
-EOF
-  ws_member_js packages/js-app "@mono/js-app"
-  ws_member_js packages/js-nested "@mono/js-nested"
-  mkdir -p packages/py-svc
-  cat > packages/py-svc/pyproject.toml <<'EOF'
-[project]
-name = "py-svc"
-version = "0.0.0"
-requires-python = ">=3.9"
-dependencies = ["six==1.16.0"]
-EOF
-  printf 'six==1.16.0\n' > packages/py-svc/requirements.txt
-  mkdir -p packages/rust-lib/src
-  printf '[package]\nname = "rust-lib"\nversion = "0.0.0"\nedition = "2021"\n\n[dependencies]\ncfg-if = "=1.0.0"\n' > packages/rust-lib/Cargo.toml
-  printf '// lib\n' > packages/rust-lib/src/lib.rs
-  mkdir -p packages/go-mod && printf 'module mono/go\n\ngo 1.21\n' > packages/go-mod/go.mod
-  mkdir -p packages/php-web && printf '{ "name": "mono/php", "require": { "monolog/monolog": "3.5.0" } }\n' > packages/php-web/composer.json
-  mkdir -p packages/ruby-gem && printf "source 'https://rubygems.org'\ngem 'colorize', '1.1.0'\n" > packages/ruby-gem/Gemfile
-  mkdir -p packages/deno-app && printf '{ "name": "mono/deno", "version": "0.0.0" }\n' > packages/deno-app/deno.json
-  mkdir -p packages/nuget-app && printf '<Project Sdk="Microsoft.NET.Sdk"></Project>\n' > packages/nuget-app/app.csproj
-}
-
-run_install_monorepo() {
-  npm install --silent --no-audit --no-fund
-}
-
-# --- resolve candidate on-disk file(s) for verification --------------
-# For single layout: one path. For workspace/monorepo: search the tree
-# (hoisted root node_modules, pnpm store, member dirs, shared venv).
-resolve_targets() {
-  local rel="${SM_MANIFEST_KEY#package/}"
-  local base; base="$(basename "$rel")"
-  if [ "$SM_LAYOUT" = single ]; then
-    resolve_target
-    return
-  fi
-  case "$SM_ECOSYSTEM" in
-    npm|deno|monorepo) find "$PWD" -path "*/node_modules/$SM_PACKAGE/$rel" 2>/dev/null ;;
-    pypi)              find "$PWD" -name "$base" -not -path '*/_vendor/*' 2>/dev/null ;;
-    *)                 resolve_target ;;
-  esac
-}
-
-# --- native install dispatch (layout-aware) --------------------------
-do_install() {
-  case "$SM_LAYOUT" in
-    workspace) run_install_workspace ;;
-    monorepo)  run_install_monorepo ;;
-    *)         run_install ;;
-  esac
-}
-
-# Wipe installed modules so the NEXT install re-fetches a pristine copy and
-# re-fires the lifecycle hook. This is what lets us observe the patch-apply
-# BEHAVIOR (marker present/absent on a freshly installed file) at each stage
-# of the (setup)·(install) sequence, rather than inspecting package.json.
-reset_modules() {
-  rm -rf node_modules packages/*/node_modules 2>/dev/null || true
-}
-
-# Execute a single patched file with the ecosystem's STANDARD runner so the
-# patched code actually runs; its stdout/stderr (where the marker would be
-# printed) is emitted for the caller to inspect. npm→node, bun→bun, deno→deno,
-# pip→the venv's python3, uv→uv run, poetry/pdm/hatch→their `run`. For
-# compiled/loaded ecosystems we cannot execute (cargo/go/maven/nuget/gem/
-# composer) we `cat` the file so its inert marker comment is still observed —
-# matching the previous file-based behavior for those gaps.
-run_file() { # $1 = absolute path to the resolved package file
-  case "$SM_ECOSYSTEM" in
-    npm|monorepo)
-      case "$SM_PM" in
-        bun) bun "$1" ;;
-        *)   node "$1" ;;
-      esac ;;
-    deno) deno run -A "$1" ;;
-    pypi)
-      # Run the patched module with the in-project venv interpreter directly.
-      # Going through `<pm> run` re-resolves the project, which (after setup)
-      # includes the committed `socket-patch[hook]` dependency, whose hook wheel
-      # is unpublished in this hermetic test, so the resolve would fail for a
-      # reason unrelated to whether six.py is patched. Direct execution faithfully runs the on-disk
-      # patched file and observes its marker. (hatch manages its env outside
-      # an in-project .venv, and its skip-install env doesn't re-resolve, so it
-      # keeps using `hatch run`.)
-      case "$SM_PM" in
-        uv)     ./venv/bin/python "$1" ;;
-        poetry) ./.venv/bin/python "$1" ;;
-        pdm)    ./.venv/bin/python "$1" ;;
-        hatch)  HATCH_DATA_DIR="$PWD/.hatch" hatch run python "$1" ;;
-        pip)    ./venv/bin/python "$1" ;;
-        *)      python3 "$1" ;;
-      esac ;;
-    *) cat "$1" ;;
-  esac
-}
-
-# Decide whether the patch was applied by RUNNING every on-disk copy of the
-# patched file and checking whether the marker appears in its runtime output.
-# Sets APPLIED / PRIMARY_PRESENT / TARGET.
-verify_applied() {
-  local check_marker="$SM_MARKER"
-  [ "$SM_PATCHSET" = alt ] && check_marker="$SM_ALT_MARKER"
-  APPLIED=false
-  PRIMARY_PRESENT=null
-  TARGET=""
-  local n_found=0 cand out
-  while IFS= read -r cand; do
-    [ -n "$cand" ] && [ -f "$cand" ] || continue
-    n_found=$((n_found + 1))
-    [ -z "$TARGET" ] && TARGET="$cand"
-    out="$(run_file "$cand" 2>&1)"
-    if printf '%s' "$out" | grep -q "$check_marker"; then APPLIED=true; TARGET="$cand"; fi
-    if printf '%s' "$out" | grep -q "$SM_MARKER"; then PRIMARY_PRESENT=true; fi
-  done < <(resolve_targets)
-  [ "$PRIMARY_PRESENT" = null ] && [ "$n_found" -gt 0 ] && PRIMARY_PRESENT=false
-  log "verify(run): marker '$check_marker' in runtime output=$APPLIED (candidates=$n_found, target=${TARGET:-<none>})"
-}
-
-# The full check/remove round trip runs only for npm-family cases; the other
-# supported hooks use the simple single-install flow.
-is_npm_family() {
-  [[ "$SM_PM" =~ ^(npm|yarn|pnpm|bun|vlt)$ ]] || [ "$SM_LAYOUT" = monorepo ]
-}
-
-# ============================ main ====================================
-log "binary: $SP_BIN ($("$SP_BIN" --version 2>/dev/null || echo '??'))  layout=$SM_LAYOUT"
-
-WORKDIR="${SM_WORKDIR:-$(mktemp -d)}"
-PROJ="$WORKDIR/proj"
-mkdir -p "$PROJ"
-cd "$PROJ" || { emit_result false null null null "" fail; exit 0; }
-note "proj=$PROJ"
-
-# 0. dependencies + committed patch set
-case "$SM_LAYOUT" in
-  workspace) scaffold_workspace ;;
-  monorepo)  scaffold_monorepo ;;
-  *)         scaffold_project ;;
-esac
-build_fixture
-
-# npm-family (incl. deno-via-npm and the monorepo's npm slice) need the
-# runner shim so the hook's `npx`/`pnpm dlx @socketsecurity/socket-patch`
-# resolves to $SP_BIN instead of the npm registry.
-if [[ "$SM_PM" =~ ^(npm|yarn|pnpm|bun|vlt|deno)$ ]] || [ "$SM_LAYOUT" = monorepo ]; then
-  SHIM_DIR="$PROJ/.sp-shims"
-  write_shims "$SHIM_DIR"
-  export SETUP_MATRIX_SHIM_DIR="$SHIM_DIR"
-  export PATH="$SHIM_DIR:$PATH"
-  log "shims installed at $SHIM_DIR (PATH prepended)"
-fi
-
-# Hermetic apply env inherited by the install hook's `socket-patch apply`.
-export SOCKET_OFFLINE=true SOCKET_FORCE=true SOCKET_API_TOKEN=fake SOCKET_ORG_SLUG=test-org
-export SOCKET_TELEMETRY_DISABLED=1 VLT_TELEMETRY=0
-# Isolate the pypi `.pth` hook's change-detection stamp per case so runs
-# don't bleed into each other (the stamp lives under XDG_CACHE_HOME).
-export XDG_CACHE_HOME="$WORKDIR/.cache"
-# Give the case its own home so every package manager's cache, store and
-# credentials stay inside WORKDIR. Under `--host` these run on the
-# developer's machine, where the default is their real home. The vars
-# below outrank HOME for their tools, so they are pointed inside it
-# rather than left to leak.
-#
-# RUSTUP_HOME is the exception: rustup's toolchains live under the real
-# home (defaulting to $HOME/.rustup when unset) and are shared, not
-# per-case. Pin it to that location BEFORE HOME is redirected, or rustup
-# resolves toolchains under the empty fake home and `cargo fetch` fails
-# even though CARGO_HOME is set. An already-exported RUSTUP_HOME (e.g. the
-# cargo Docker image) is preserved.
-export RUSTUP_HOME="${RUSTUP_HOME:-$HOME/.rustup}"
-# Version-manager roots get the same treatment: rbenv/pyenv/nvm/fnm/volta/
-# asdf/sdkman/mise shims resolve their root from $HOME (or the XDG dirs,
-# which are also redirected below) by default, so a redirected HOME with no
-# root pinned makes ruby/python/node fail to launch at all under --host.
-# Seed each root from the real home first — only when the variable is not
-# already exported and the default directory actually exists, so this is a
-# no-op on machines (and containers) without that manager. Same list as
-# cache_env.rs TOOLCHAIN_ROOTS.
-for _vm in RBENV_ROOT:.rbenv PYENV_ROOT:.pyenv NVM_DIR:.nvm \
-    FNM_DIR:.fnm VOLTA_HOME:.volta ASDF_DIR:.asdf ASDF_DATA_DIR:.asdf \
-    SDKMAN_DIR:.sdkman MISE_DATA_DIR:.local/share/mise \
-    MISE_CONFIG_DIR:.config/mise; do
-  _vm_var="${_vm%%:*}"
-  _vm_dir="$HOME/${_vm#*:}"
-  if [ -z "${!_vm_var:-}" ] && [ -d "$_vm_dir" ]; then
-    export "$_vm_var=$_vm_dir"
-  fi
-done
-unset _vm _vm_var _vm_dir
-mkdir -p "$WORKDIR/home"
-# asdf/mise read the global tool selection from ~/.tool-versions and accept
-# no absolute path to it from the environment — carry the file itself over.
-if [ -f "$HOME/.tool-versions" ]; then
-  cp "$HOME/.tool-versions" "$WORKDIR/home/.tool-versions"
-fi
-export HOME="$WORKDIR/home"
-export XDG_DATA_HOME="$WORKDIR/home/.local/share" XDG_CONFIG_HOME="$WORKDIR/home/.config" XDG_STATE_HOME="$WORKDIR/home/.local/state"
-export CARGO_HOME="$WORKDIR/home/.cargo" GOPATH="$WORKDIR/home/go" GOMODCACHE="$WORKDIR/home/go/pkg/mod" GOCACHE="$WORKDIR/home/.cache/go-build"
-export PNPM_HOME="$WORKDIR/home/.pnpm" COREPACK_HOME="$WORKDIR/home/.corepack" NUGET_PACKAGES="$WORKDIR/home/.nuget/packages"
-# Maven ignores $HOME entirely: the JVM computes `user.home` from the
-# passwd entry (getpwuid / NSHomeDirectory), so without this mvn keeps
-# writing its ~/.m2 into the REAL home while the resolve_target maven arm
-# (and the socket binary, which is $HOME-based) look in the case home.
-# -Duser.home moves the whole ~/.m2 (repository + settings) with the case.
-export MAVEN_OPTS="${MAVEN_OPTS:+$MAVEN_OPTS }-Duser.home=$WORKDIR/home"
-# NOTE: deliberately do NOT export SOCKET_CWD. The install hook's apply
-# must run with whatever cwd the package manager sets for the lifecycle
-# script — the project root for a single project, and the *member* dir
-# for each workspace member. In a workspace, member postinstalls thus
-# find no manifest in their own dir and no-op (exit 0), while the root
-# postinstall (manifest present) applies. Forcing SOCKET_CWD=root would
-# make every member apply target the root manifest and fail with "no
-# packages found on disk" mid-install, breaking `npm install`.
-
-# 1-3. Configure + install + verify.
-#
-# For npm-family cases that run setup we exercise the FULL behavioral sequence
-# — (install)·(setup)·(install)·(remove)·(install) — observing both the patch
-# marker and `setup --check` at each stage. A clean reinstall precedes every
-# observation so the lifecycle hook acts on a pristine package. This verifies
-# behavior end-to-end rather than reading package.json:
-#   * patch: NOT applied before setup → applied after setup → NOT applied after remove
-#   * check: fails before setup → passes after the post-setup install (hook
-#     present AND patches applied on disk) → fails after remove
-#
-# Every other case (run_setup=0, or non-npm-family ecosystems) keeps the simple
-# single-install flow, preserving the existing aspirational expect_applied
-# classification untouched.
-SETUP_EXIT="null"
-CHECK_BEFORE_SETUP_EXIT="null"
-CHECK_AFTER_SETUP_EXIT="null"
-REMOVE_EXIT="null"
-CHECK_AFTER_REMOVE_EXIT="null"
-APPLIED_BEFORE_SETUP=null
-APPLIED_AFTER_REMOVE=null
-INSTALL_EXIT="null"
-
-if is_npm_family && [ "$SM_RUN_SETUP" = 1 ]; then
-  # (1) BEFORE setup: no hook configured → install must NOT apply the patch.
-  log "[before-setup] install for pm=$SM_PM (layout=$SM_LAYOUT)"
-  do_install; log "[before-setup] install exit=$?"
-  verify_applied; APPLIED_BEFORE_SETUP="$APPLIED"
-
-  # (2) check must report "needs configuration" (non-zero) before setup.
-  "$SP_BIN" setup --check --json; CHECK_BEFORE_SETUP_EXIT=$?
-  log "check-before-setup exit=$CHECK_BEFORE_SETUP_EXIT"
-
-  # (3) setup must succeed. (Its `--check` is probed AFTER the next install:
-  # since contract property 4 shipped, check also verifies on-disk patch
-  # consistency, and right after `setup` the pre-hook install from (1) is
-  # legitimately still unpatched — check would fail there by design.)
-  log "running: socket-patch setup --yes"
-  "$SP_BIN" setup --yes --json; SETUP_EXIT=$?
-  log "setup exit=$SETUP_EXIT"
-  [ -f package.json ] && { log "package.json scripts after setup:"; grep -A6 '"scripts"' package.json || true; }
-
-  # (4) AFTER setup: clean reinstall → the hook fires → MAIN applied result;
-  # NOW check must report "configured" (zero): hooks present AND patches
-  # applied on disk — the contract's correctly-patched state.
-  reset_modules
-  log "[after-setup] install for pm=$SM_PM (layout=$SM_LAYOUT)"
-  do_install; INSTALL_EXIT=$?
-  log "[after-setup] install exit=$INSTALL_EXIT"
-  verify_applied   # sets the canonical APPLIED / PRIMARY_PRESENT / TARGET
-  "$SP_BIN" setup --check --json; CHECK_AFTER_SETUP_EXIT=$?
-  log "check-after-setup exit=$CHECK_AFTER_SETUP_EXIT"
-
-  # (5) remove, then check must report "needs configuration" (non-zero) again.
-  log "running: socket-patch setup --remove --yes"
-  "$SP_BIN" setup --remove --yes --json; REMOVE_EXIT=$?
-  log "remove exit=$REMOVE_EXIT"
-  [ -f package.json ] && { log "package.json scripts after remove:"; grep -A6 '"scripts"' package.json || true; }
-  "$SP_BIN" setup --check --json; CHECK_AFTER_REMOVE_EXIT=$?
-  log "check-after-remove exit=$CHECK_AFTER_REMOVE_EXIT"
-
-  # (6) AFTER remove: clean reinstall → no hook → must NOT apply the patch.
-  # Preserve the main (after-setup) result while re-probing the disk.
-  _MAIN_APPLIED="$APPLIED"; _MAIN_PRIMARY="$PRIMARY_PRESENT"; _MAIN_TARGET="$TARGET"
-  reset_modules
-  log "[after-remove] install for pm=$SM_PM (layout=$SM_LAYOUT)"
-  do_install; log "[after-remove] install exit=$?"
-  verify_applied; APPLIED_AFTER_REMOVE="$APPLIED"
-  APPLIED="$_MAIN_APPLIED"; PRIMARY_PRESENT="$_MAIN_PRIMARY"; TARGET="$_MAIN_TARGET"
-else
-  # Simple flow: optional setup (no-op where there is no package.json), one
-  # install, one verify.
-  if [ "$SM_RUN_SETUP" = 1 ]; then
-    log "running: socket-patch setup --yes"
-    "$SP_BIN" setup --yes --json; SETUP_EXIT=$?
-    log "setup exit=$SETUP_EXIT"
-    [ -f package.json ] && { log "package.json scripts after setup:"; grep -A6 '"scripts"' package.json || true; }
-  fi
-  log "running install for pm=$SM_PM (layout=$SM_LAYOUT)"
-  do_install; INSTALL_EXIT=$?
-  log "install exit=$INSTALL_EXIT"
-  verify_applied
-fi
-
-# Driver-level status: did actual match the aspirational expectation?
-want=$([ "$SM_EXPECT_APPLIED" = 1 ] && echo true || echo false)
-STATUS=fail
-[ "$APPLIED" = "$want" ] && STATUS=pass
-
-emit_result "$APPLIED" "$PRIMARY_PRESENT" "$SETUP_EXIT" "$INSTALL_EXIT" "${TARGET:-}" "$STATUS"
-exit 0
diff --git a/tests/setup_matrix/shims/npx b/tests/setup_matrix/shims/npx
deleted file mode 100755
index d64dd9e1..00000000
--- a/tests/setup_matrix/shims/npx
+++ /dev/null
@@ -1,45 +0,0 @@
-#!/usr/bin/env bash
-# setup-matrix test shim for `npx`.
-#
-# The hook that `socket-patch setup` writes into package.json is
-#   npx @socketsecurity/socket-patch apply --silent --ecosystems npm
-# In a hermetic test we do NOT want `npx` to fetch the published wrapper
-# package from the npm registry — we want it to run the locally-built
-# binary under test. This shim, prepended to PATH, intercepts exactly that
-# invocation and execs the local binary; every other `npx` call is
-# delegated to the real `npx`.
-#
-# This is a TEST FIXTURE, not a change to socket-patch behavior. It is the
-# standalone/reference copy; tests/setup_matrix/run-case.sh embeds a
-# functionally equivalent, condensed copy inline so the driver is
-# self-contained when piped into a container. Keep the two in sync.
-set -uo pipefail
-
-sp_bin="${SOCKET_PATCH_BIN:-socket-patch}"
-shim_dir="${SETUP_MATRIX_SHIM_DIR:-}"
-
-# Resolve the real npx by searching PATH with our own shim dir removed.
-clean_path="$PATH"
-if [ -n "$shim_dir" ]; then
-  clean_path="$(printf '%s' "$PATH" | tr ':' '\n' | grep -vxF "$shim_dir" | paste -sd: -)"
-fi
-real_npx="$(PATH="$clean_path" command -v npx 2>/dev/null || true)"
-
-# If any argument names our package, drop everything up to and including it
-# and exec the local binary with the remaining apply args.
-i=0
-for arg in "$@"; do
-  case "$arg" in
-    @socketsecurity/socket-patch|@socketsecurity/socket-patch@*|@socketsecurity/socket-patch/*)
-      shift "$((i + 1))"
-      exec "$sp_bin" "$@"
-      ;;
-  esac
-  i=$((i + 1))
-done
-
-if [ -n "$real_npx" ]; then
-  exec "$real_npx" "$@"
-fi
-echo "setup-matrix npx shim: real npx not found and args are not our package: $*" >&2
-exit 127
diff --git a/tests/setup_matrix/shims/pnpm b/tests/setup_matrix/shims/pnpm
deleted file mode 100755
index e497e398..00000000
--- a/tests/setup_matrix/shims/pnpm
+++ /dev/null
@@ -1,38 +0,0 @@
-#!/usr/bin/env bash
-# setup-matrix test shim for `pnpm`.
-#
-# For pnpm projects `socket-patch setup` writes the hook
-#   pnpm dlx @socketsecurity/socket-patch apply --silent --ecosystems npm
-# `pnpm dlx` always downloads from the registry, so it cannot be satisfied
-# from a local file: dependency. This shim, prepended to PATH, intercepts
-# `pnpm dlx @socketsecurity/socket-patch …` (and `pnpm exec …`) and execs
-# the locally-built binary; every other `pnpm` invocation — crucially the
-# real `pnpm install` / `pnpm add` — is delegated unchanged to the real
-# pnpm.
-#
-# TEST FIXTURE only. Reference copy; run-case.sh embeds an equivalent copy.
-set -uo pipefail
-
-sp_bin="${SOCKET_PATCH_BIN:-socket-patch}"
-shim_dir="${SETUP_MATRIX_SHIM_DIR:-}"
-
-clean_path="$PATH"
-if [ -n "$shim_dir" ]; then
-  clean_path="$(printf '%s' "$PATH" | tr ':' '\n' | grep -vxF "$shim_dir" | paste -sd: -)"
-fi
-real_pnpm="$(PATH="$clean_path" command -v pnpm 2>/dev/null || true)"
-
-if [ "${1:-}" = "dlx" ] || [ "${1:-}" = "exec" ]; then
-  case "${2:-}" in
-    @socketsecurity/socket-patch|@socketsecurity/socket-patch@*)
-      shift 2
-      exec "$sp_bin" "$@"
-      ;;
-  esac
-fi
-
-if [ -n "$real_pnpm" ]; then
-  exec "$real_pnpm" "$@"
-fi
-echo "setup-matrix pnpm shim: real pnpm not found: $*" >&2
-exit 127

From 14a9cb0754f258f1b66cec3919becdc23c3a2ac2 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Mon, 28 Sep 2026 23:18:04 +0200
Subject: [PATCH 22/32] v5 WS4/WS6: one hosted engine for disk + memory;
 unified Ledgers view (#282)

* Share one hosted engine between disk and memory

Extract the plan -> rewrite -> edits stages of `run_redirect_selected`
into `socket_patch_core::hosted::engine`, a set of pure functions over a
`ProjectView` (build_candidates, bun_lockb_symlinked, withhold_everywhere,
read_candidate_files, wheel_targets, rewrite, guard). The disk flow
(`scan`/`get --mode hosted`) keeps only the apply lock, the host probes
(pipenv version, gem/python/vlt stale installs), the vendored takeover,
the symlink refusal and the commit of the rewritten files.

The in-memory engine moves to `socket_patch_core::hosted::memory` and
runs the same stages over `ProjectView::Memory`; its duplicated
redirect.rs / ledger.rs orchestration is deleted. The pnpm trust / npm
allow-remote planners move to `hosted::guidance`, the vlt preflight to
`hosted::vlt`, and the redirect-ledger delta to `hosted::ledger`, which
the engine never calls, so removing the hosted ledger only touches the
two callers. `socket-patch-node` now depends on socket-patch-core only;
the CLI re-exports `hosted_memory` for `hosted-bundle` and the tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KHZ8uzdXfkG2zH8ZYDG8ju

* Split the vendored takeover out of run_redirect_selected

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KHZ8uzdXfkG2zH8ZYDG8ju

* Undo unrelated rustfmt churn from the takeover split

The previous commit ran `cargo fmt --all` over a tree that is not
rustfmt-clean, reformatting ~30 files it does not otherwise touch.
Restore those files; no code changes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KHZ8uzdXfkG2zH8ZYDG8ju

* Read the patch stores through one Ledgers view and ProjectContext

`socket_patch_core::ledgers` holds the one owner-precedence rule for the
manifest, the vendor ledger and the hosted redirect ledger (manifest >
vendored > hosted by ledger key; a manifest key claims every vendor entry
filed under it or naming it as base purl) and the views every reader
derives from it: `owned` (one group per owner key, losers as alternates),
`listed` (every copy worth showing), `matching` (remove/rollback
identifiers) and `hosted_vendored_overlap`. It replaces list's
combined_entries, fold_vendor_records / vendor_record_is_unowned, scan's
merge_ledger_records_for_updates, vex_sources' build_candidates and
overlap_from_states, and rollback/remove's per-store matching loops.
`LoadedLedgers::load` loads the three stores once, each with its own
outcome so every caller keeps its error posture.

`commands::context::ProjectContext` lazily loads the stores, the
lockfile inventory and the wiring discovery at most once per run; scan's
discovery phase, list and get read through it. `get`'s installed-version
narrowing now reuses scan's lockfile and vendored-ledger supplements
instead of its own inventory and ledger reads.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KHZ8uzdXfkG2zH8ZYDG8ju

* Index vendor-ledger claims once per view

`Ledgers::owned` re-sorted and scanned every vendor key for each
manifest key. Group the vendor entries under their claiming manifest key
in one pass over the sorted ledger (`claims`), so each view is
O(V log V + M) instead of O(M * V log V). Same ordering and alternates.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KHZ8uzdXfkG2zH8ZYDG8ju

* Return typed warnings from the hosted engine; JSON in hosted::render

The engine's own warnings (rush repo-state, pnpm trustLockfile, npm
allow-remote, vlt artifact-unverifiable, record_fetch_failed, the
in-memory takeover refusal) were built as serde_json values inside
orchestration. They are now RewriteWarning values; the new
hosted::render module holds the only JSON spelling (warnings, skipped
entries, the nested redirect block), consumed by the disk adapter and
the in-memory engine. No output change.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KHZ8uzdXfkG2zH8ZYDG8ju

* Read the lock set and discovery through one per-run snapshot

ProjectView gains a Snapshot variant: the disk under a read-through
cache (DiskSnapshot), so each lock or config file is read at most once
per run and every reader sees the same bytes; probes that are not
content reads still go to the disk. Lockfile discovery's guarded reads
now go through a ProjectView (discover_patched_refs_in), and
ProjectContext backs both locks() and discovery() with one snapshot of
--cwd.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KHZ8uzdXfkG2zH8ZYDG8ju

---------

Co-authored-by: Claude <noreply@anthropic.com>
---
 CHANGELOG.md                                  |   13 +
 Cargo.lock                                    |    2 +-
 crates/socket-patch-cli/CLI_CONTRACT.md       |    2 +-
 .../socket-patch-cli/src/commands/context.rs  |  100 +
 crates/socket-patch-cli/src/commands/get.rs   |  109 +-
 crates/socket-patch-cli/src/commands/list.rs  |  175 +-
 crates/socket-patch-cli/src/commands/mod.rs   |   54 +-
 .../socket-patch-cli/src/commands/remove.rs   |   20 +-
 .../socket-patch-cli/src/commands/rollback.rs |   23 +-
 .../src/commands/scan/discovery.rs            |  119 +-
 .../src/commands/scan/hosted.rs               | 2717 ++++-------------
 .../src/commands/scan/hosted/vlt.rs           |  190 +-
 .../socket-patch-cli/src/commands/scan/mod.rs |   70 +-
 crates/socket-patch-cli/src/commands/vex.rs   |   14 +-
 .../src/commands/vex_sources.rs               |   93 +-
 .../src/hosted_memory/redirect.rs             | 1234 --------
 crates/socket-patch-cli/src/lib.rs            |    5 +-
 crates/socket-patch-core/Cargo.toml           |    2 +
 crates/socket-patch-core/src/hosted/engine.rs | 1757 +++++++++++
 .../socket-patch-core/src/hosted/guidance.rs  |  404 +++
 .../src/hosted/memory}/discover.rs            |   14 +-
 .../src/hosted/memory}/limits.rs              |    2 +-
 .../src/hosted/memory}/mod.rs                 |  121 +-
 .../src/hosted/memory}/roots.rs               |    4 +-
 .../src/hosted/memory}/select.rs              |   12 +-
 .../src/hosted/memory/stages.rs               |  347 +++
 .../src/hosted/memory}/types.rs               |   19 +-
 crates/socket-patch-core/src/hosted/mod.rs    |   19 +
 crates/socket-patch-core/src/hosted/render.rs |   43 +
 crates/socket-patch-core/src/hosted/vlt.rs    |  217 ++
 crates/socket-patch-core/src/ledgers.rs       |  525 ++++
 crates/socket-patch-core/src/lib.rs           |    2 +
 crates/socket-patch-core/src/manifest/mod.rs  |    1 +
 .../socket-patch-core/src/manifest/records.rs |   84 +
 .../src/utils/cargo_workspace.rs              |    5 +-
 .../src/vendor/lock_inventory/cargo.rs        |    6 +-
 .../src/vendor/lock_inventory/mod.rs          |   37 +-
 .../src/vendor/lock_inventory/pnpm.rs         |    6 +-
 .../src/vendor/lock_inventory/pypi.rs         |    5 +-
 .../src/vendor/lock_inventory/view.rs         |  150 +-
 .../socket-patch-core/src/vex/discover/mod.rs |   36 +-
 crates/socket-patch-core/src/vex/mod.rs       |    5 +-
 crates/socket-patch-node/Cargo.toml           |    4 +-
 crates/socket-patch-node/src/lib.rs           |    6 +-
 44 files changed, 4716 insertions(+), 4057 deletions(-)
 create mode 100644 crates/socket-patch-cli/src/commands/context.rs
 delete mode 100644 crates/socket-patch-cli/src/hosted_memory/redirect.rs
 create mode 100644 crates/socket-patch-core/src/hosted/engine.rs
 create mode 100644 crates/socket-patch-core/src/hosted/guidance.rs
 rename crates/{socket-patch-cli/src/hosted_memory => socket-patch-core/src/hosted/memory}/discover.rs (97%)
 rename crates/{socket-patch-cli/src/hosted_memory => socket-patch-core/src/hosted/memory}/limits.rs (99%)
 rename crates/{socket-patch-cli/src/hosted_memory => socket-patch-core/src/hosted/memory}/mod.rs (92%)
 rename crates/{socket-patch-cli/src/hosted_memory => socket-patch-core/src/hosted/memory}/roots.rs (98%)
 rename crates/{socket-patch-cli/src/hosted_memory => socket-patch-core/src/hosted/memory}/select.rs (97%)
 create mode 100644 crates/socket-patch-core/src/hosted/memory/stages.rs
 rename crates/{socket-patch-cli/src/hosted_memory => socket-patch-core/src/hosted/memory}/types.rs (97%)
 create mode 100644 crates/socket-patch-core/src/hosted/mod.rs
 create mode 100644 crates/socket-patch-core/src/hosted/render.rs
 create mode 100644 crates/socket-patch-core/src/hosted/vlt.rs
 create mode 100644 crates/socket-patch-core/src/ledgers.rs
 create mode 100644 crates/socket-patch-core/src/manifest/records.rs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f8eb6bb3..4a0e6718 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1817,6 +1817,19 @@ into the new version's section — see docs/releasing.md.
 
 ### Changed
 
+- **One owner rule for the patch stores.** `list`, `vex`, `scan`'s
+  `updates[]`, `rollback` and `remove` now read the
+  manifest and the vendor ledger (plus, in `vex`, the hosted records)
+  through one view (`socket_patch_core::ledgers`) with one precedence:
+  manifest, then vendor ledger, then hosted records, by ledger key; a
+  manifest key claims every vendor entry filed under it or naming it as
+  base purl. Visible differences: `scan`'s `updates[]` no longer folds a
+  vendor entry the manifest claims by base purl; `vex` treats every vendor
+  entry a manifest key claims as a fallback copy of that key's record (a
+  second variant of the same base purl used to become its own candidate).
+  `get`'s installed-version narrowing now uses
+  `scan`'s lockfile and vendored-ledger discovery, so a corrupt vendor
+  ledger falls back to the committed artifacts there too.
 - **The npm crawl skips tagged cache directories.** The walk that finds
   workspace `node_modules` trees no longer descends into a directory that
   carries a [Cache Directory Tagging](https://bford.info/cachedir/)
diff --git a/Cargo.lock b/Cargo.lock
index 7b687168..4475ec20 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1816,6 +1816,7 @@ dependencies = [
  "tempfile",
  "thiserror 2.0.18",
  "tokio",
+ "tokio-util",
  "toml_edit",
  "uuid",
  "walkdir",
@@ -1832,7 +1833,6 @@ dependencies = [
  "napi-derive",
  "serde",
  "serde_json",
- "socket-patch-cli",
  "socket-patch-core",
  "tokio",
  "tokio-util",
diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index 45db1b71..4ce5cb3a 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -30,7 +30,7 @@ Rows are in `--help` order (v5.0): the hosted/vendored workflow (`scan` → `vex
 
 **Root `--update` flag.** `socket-patch --update [VERSION]` updates the binary itself from GitHub Releases. It is a root flag, not a subcommand: argv is rewritten (the same mechanism as the bare-UUID fallback) onto an internal hidden subcommand whose name carries no stability guarantee — script the flag, never the internal name. Combining the flag with a subcommand (`socket-patch --update scan`) is a usage error (exit 2). Full contract: [Self-update contract](#self-update-contract-socket-patch---update).
 
-**Internal `hosted-bundle` subcommand.** `socket-patch hosted-bundle` is a hidden, INTERNAL parity/debug harness for the in-memory hosted engine (`src/hosted_memory/`, the engine the Node addon embeds): it reads a JSON bundle `{"files": {path: text}, "binaryFiles"?: {path: base64}, "presentOnly"?: [path], "symlinks"?: [path], "projectRoots"?: [dir], "pipenvMajor"?: n, "batchSize"?: n}` on stdin, queries the authenticated org API built from `--api-url` / `--api-token` / `--org` only (both of the latter are required; no public-proxy fallback), and prints the engine result — or `{"status":"error","error":{"code","message"}}` with exit 1 (exit 2 for unusable input or missing credentials). It never touches the filesystem. Its name, input and output carry NO stability guarantee; do not script it.
+**Internal `hosted-bundle` subcommand.** `socket-patch hosted-bundle` is a hidden, INTERNAL parity/debug harness for the in-memory hosted engine (`socket-patch-core` `src/hosted/memory/`, the engine the Node addon embeds): it reads a JSON bundle `{"files": {path: text}, "binaryFiles"?: {path: base64}, "presentOnly"?: [path], "symlinks"?: [path], "projectRoots"?: [dir], "pipenvMajor"?: n, "batchSize"?: n}` on stdin, queries the authenticated org API built from `--api-url` / `--api-token` / `--org` only (both of the latter are required; no public-proxy fallback), and prints the engine result — or `{"status":"error","error":{"code","message"}}` with exit 1 (exit 2 for unusable input or missing credentials). It never touches the filesystem. Its name, input and output carry NO stability guarantee; do not script it.
 
 ## Global arguments
 
diff --git a/crates/socket-patch-cli/src/commands/context.rs b/crates/socket-patch-cli/src/commands/context.rs
new file mode 100644
index 00000000..3ae3b005
--- /dev/null
+++ b/crates/socket-patch-cli/src/commands/context.rs
@@ -0,0 +1,100 @@
+//! The project a command reads, loaded lazily and at most once per run:
+//! the patch stores ([`LoadedLedgers`]: manifest + both ledgers), the lock
+//! set (the lockfile inventory and its refused npm layouts) and the
+//! lockfile wiring discovery. `scan`, `vendor`, `vex`, `list` and `get`
+//! read these through one [`ProjectContext`] instead of each re-loading
+//! and re-merging them its own way.
+//!
+//! The lock set and the discovery read `--cwd` through one
+//! [`DiskSnapshot`], so each lock and config file is read once and both see
+//! the same bytes.
+//!
+//! Everything here is a read-only snapshot. A command that writes a store
+//! under the apply lock (the hosted engine, rollback, remove) re-loads it
+//! under that lock instead of trusting a pre-lock snapshot, and an embedded
+//! `--vex` after the writes loads its own inputs.
+
+use std::path::PathBuf;
+
+use socket_patch_core::ledgers::{Ledgers, LoadedLedgers};
+use socket_patch_core::vendor::lock_inventory::{
+    DiskSnapshot, LockfileEntry, ProjectView, UnsupportedNpmLayout,
+};
+use socket_patch_core::vex::discover::Discovery;
+use tokio::sync::OnceCell;
+
+use crate::args::GlobalArgs;
+
+/// The project's lockfile inventory and the npm layouts it refused.
+pub(crate) struct LockSet {
+    pub(crate) entries: Vec<LockfileEntry>,
+    pub(crate) unsupported: Vec<UnsupportedNpmLayout>,
+}
+
+pub(crate) struct ProjectContext<'a> {
+    pub(crate) common: &'a GlobalArgs,
+    /// Where the ledgers live: the manifest's project (see
+    /// [`GlobalArgs::project_root`]).
+    pub(crate) root: PathBuf,
+    snapshot: DiskSnapshot<'a>,
+    ledgers: OnceCell<LoadedLedgers>,
+    locks: OnceCell<LockSet>,
+    discovery: OnceCell<Discovery>,
+}
+
+impl<'a> ProjectContext<'a> {
+    pub(crate) fn new(common: &'a GlobalArgs) -> Self {
+        Self::rooted(common, common.project_root())
+    }
+
+    /// A context whose ledgers load from `root` (commands that read the
+    /// ledgers of `--cwd` rather than of the manifest's project).
+    pub(crate) fn rooted(common: &'a GlobalArgs, root: PathBuf) -> Self {
+        Self {
+            common,
+            root,
+            snapshot: DiskSnapshot::new(&common.cwd),
+            ledgers: OnceCell::new(),
+            locks: OnceCell::new(),
+            discovery: OnceCell::new(),
+        }
+    }
+
+    /// The three stores, each with its own load outcome.
+    pub(crate) async fn loaded(&self) -> &LoadedLedgers {
+        self.ledgers
+            .get_or_init(|| async {
+                LoadedLedgers::load(&self.root, &self.common.resolved_manifest_path()).await
+            })
+            .await
+    }
+
+    /// The readable stores as one view (a failed store reads as absent).
+    pub(crate) async fn ledgers(&self) -> Ledgers<'_> {
+        self.loaded().await.view()
+    }
+
+    /// The lockfile inventory of `--cwd`.
+    pub(crate) async fn locks(&self) -> &LockSet {
+        self.locks
+            .get_or_init(|| async {
+                let (entries, unsupported) =
+                    socket_patch_core::vendor::lock_inventory::inventory_project_diagnosed_in(
+                        &ProjectView::Snapshot(&self.snapshot),
+                    )
+                    .await;
+                LockSet {
+                    entries,
+                    unsupported,
+                }
+            })
+            .await
+    }
+
+    /// The lockfile wiring discovery of `--cwd` ([`super::discover_wiring`]).
+    pub(crate) async fn discovery(&self) -> &Discovery {
+        self.discovery
+            .get_or_init(|| super::discover_wiring_in(self.common, &self.snapshot))
+            .await
+    }
+}
diff --git a/crates/socket-patch-cli/src/commands/get.rs b/crates/socket-patch-cli/src/commands/get.rs
index ed9200e8..55d9fef7 100644
--- a/crates/socket-patch-cli/src/commands/get.rs
+++ b/crates/socket-patch-cli/src/commands/get.rs
@@ -13,8 +13,10 @@ use socket_patch_core::crawlers::fuzzy_match::fuzzy_match_packages;
 use socket_patch_core::crawlers::{CrawlerOptions, Ecosystem};
 use socket_patch_core::formats::pnpm::PnpmLock;
 use socket_patch_core::manifest::operations::{read_manifest, write_manifest};
+pub(crate) use socket_patch_core::manifest::records::record_from_patch_response;
+use socket_patch_core::manifest::records::{build_patch_record, files_for_manifest};
 use socket_patch_core::manifest::schema::{
-    PatchFileInfo, PatchManifest, PatchRecord, VulnerabilityInfo,
+    PatchFileInfo, PatchManifest, PatchRecord,
 };
 use socket_patch_core::patch::apply::{is_valid_blob_hash, select_installed_variants};
 use socket_patch_core::patch::apply_lock::{LockError, LockGuard};
@@ -366,43 +368,6 @@ async fn unwind_new_blobs(blobs_dir: &Path, hashes: &[String]) {
     }
 }
 
-/// Convert the API-shaped vulnerability map on `PatchResponse` into the
-/// serialization-shaped map stored in the manifest.
-fn vulnerabilities_for_manifest(
-    vulns: &HashMap<String, VulnerabilityResponse>,
-) -> HashMap<String, VulnerabilityInfo> {
-    vulns
-        .iter()
-        .map(|(id, v)| {
-            (
-                id.clone(),
-                VulnerabilityInfo {
-                    cves: v.cves.clone(),
-                    summary: v.summary.clone(),
-                    severity: v.severity.clone(),
-                    description: v.description.clone(),
-                },
-            )
-        })
-        .collect()
-}
-
-/// Build the `PatchRecord` that will be inserted into the manifest for
-/// `patch`. `files` is the (purl-keyed) before/after-hash map the
-/// caller built — semantics for what counts as a "patchable file" differ
-/// between the get and download flows, so the caller owns that decision.
-fn build_patch_record(patch: &PatchResponse, files: HashMap<String, PatchFileInfo>) -> PatchRecord {
-    PatchRecord {
-        uuid: patch.uuid.clone(),
-        exported_at: patch.published_at.clone(),
-        files,
-        vulnerabilities: vulnerabilities_for_manifest(&patch.vulnerabilities),
-        description: patch.description.clone(),
-        license: patch.license.clone(),
-        tier: patch.tier.clone(),
-    }
-}
-
 /// Build a file map keyed by path, keeping only files that carry BOTH
 /// hashes — the rule used ONLY for installed-distribution matching in
 /// [`filter_to_installed_releases`]. New files (no `beforeHash`) can
@@ -426,44 +391,6 @@ fn files_with_both_hashes(patch: &PatchResponse) -> HashMap<String, PatchFileInf
     files
 }
 
-/// Build the manifest-shaped `files` map from a fetched patch view,
-/// keeping EVERY file the patch touches — including net-new files the
-/// patch ADDS, which carry an `afterHash` but no `beforeHash`. A new
-/// file is recorded with an empty-string `beforeHash` sentinel, the same
-/// convention `save_and_apply_patch`'s by-uuid path relies on: apply
-/// treats an empty `beforeHash` as "create this file" and
-/// [`select_installed_variants`] treats it as non-discriminating.
-///
-/// This is the shared record-building rule for the scan/download/vendor
-/// flows AND the single-uuid apply path, so `get <uuid>` and
-/// `scan`/`apply`/`vendor` all record and write the same set of files.
-/// A both-hashes rule here would drop every added file (e.g. a whole-crate
-/// cargo export where ALL files lack a `beforeHash`, recorded as `files:{}`
-/// while reporting `applied:1`).
-fn files_for_manifest(patch: &PatchResponse) -> HashMap<String, PatchFileInfo> {
-    let mut files = HashMap::new();
-    for (file_path, file_info) in &patch.files {
-        if let Some(after) = &file_info.after_hash {
-            files.insert(
-                file_path.clone(),
-                PatchFileInfo {
-                    before_hash: file_info.before_hash.clone().unwrap_or_default(),
-                    after_hash: after.clone(),
-                },
-            );
-        }
-    }
-    files
-}
-
-/// `(purl, manifest record)` from a fetched patch view — retains
-/// patch-added new files via [`files_for_manifest`].
-pub(crate) fn record_from_patch_response(patch: &PatchResponse) -> (String, PatchRecord) {
-    (
-        patch.purl.clone(),
-        build_patch_record(patch, files_for_manifest(patch)),
-    )
-}
 
 #[derive(Args)]
 pub struct GetArgs {
@@ -1523,9 +1450,10 @@ struct InstalledNarrowing {
 ///   installed copy (CI manifest-maintenance);
 /// * hosted/vendored modes only: resolved in the project lockfile(s)
 ///   (hosted rewrites the lock; vendored auto-fetches pristine) or claimed
-///   by the vendor ledger (fresh-clone re-vendor) — mirroring scan's
-///   lockfile/vendored-ledger discovery supplements, including their
-///   global-scan gate.
+///   by the vendor ledger (fresh-clone re-vendor) — scan's own
+///   lockfile/vendored-ledger discovery supplements (a corrupt vendor
+///   ledger falls back to the committed artifacts, as in scan), including
+///   their global-scan gate.
 ///
 /// PnP layouts are surfaced, never silently misreported: yarn PnP packages
 /// are structurally unpatchable in every mode (skip records carry
@@ -1564,24 +1492,27 @@ async fn filter_to_installed_purls(
     let found = find_packages_for_rollback(&partitioned, &common.crawler_options(), true).await;
     let mut present: HashSet<String> = found.keys().map(|k| canon(k)).collect();
 
+    let ctx = super::context::ProjectContext::rooted(common, common.cwd.clone());
     // Manifest membership counts as presence (read-only probe: a corrupt
     // manifest degrades to "no extension" here — the download path's
     // fail-closed read still guards every write).
-    if let Ok(Some(manifest)) = read_manifest(&common.resolved_manifest_path()).await {
+    if let Some(manifest) = ctx.ledgers().await.manifest {
         present.extend(manifest.patches.keys().map(|k| canon(k)));
     }
 
-    // Lockfile + vendor-ledger supplements (scan's discovery gate: never on
-    // global scans, which target the machine tree, not this project).
+    // scan's lockfile + vendored-ledger discovery supplements (and their
+    // gate: never on global scans, which target the machine tree, not this
+    // project).
     let mut pnp_diags: Vec<lock_inventory::UnsupportedNpmLayout> = Vec::new();
-    if !common.global && common.global_prefix.is_none() {
-        let (entries, unsupported) = lock_inventory::inventory_project_diagnosed(&common.cwd).await;
-        pnp_diags = unsupported;
+    if !common.is_global() {
+        let supplement = super::scan::project_lockfile_supplement(&ctx, &[], None).await;
+        pnp_diags = supplement.unsupported;
         if mode != super::scan::ScanMode::Agent {
-            present.extend(entries.iter().map(|e| canon(&e.purl)));
-            if let Ok(state) = socket_patch_core::vendor::load_state(&common.cwd).await {
-                present.extend(state.entries.values().map(|e| canon(&e.base_purl)));
-            }
+            present.extend(supplement.entries.iter().map(|e| canon(&e.purl)));
+            let vendored =
+                super::scan::project_vendored_supplement(common, &[], &ctx.loaded().await.vendor)
+                    .await;
+            present.extend(vendored.iter().map(|p| canon(&p.purl)));
         }
     }
 
diff --git a/crates/socket-patch-cli/src/commands/list.rs b/crates/socket-patch-cli/src/commands/list.rs
index c22dccbd..8fc77fab 100644
--- a/crates/socket-patch-cli/src/commands/list.rs
+++ b/crates/socket-patch-cli/src/commands/list.rs
@@ -1,12 +1,11 @@
 use std::path::Path;
 
 use clap::Args;
-use socket_patch_core::manifest::operations::read_manifest;
 use socket_patch_core::manifest::schema::{PatchManifest, PatchRecord};
 use socket_patch_core::patch::redirect::upstream::HostedPin;
 use socket_patch_core::patch::redirect::RedirectState;
 use socket_patch_core::telemetry::track_patch_listed;
-use socket_patch_core::vendor::state::{VendorEntry, VENDOR_STATE_REL};
+use socket_patch_core::vendor::state::{VendorState, VENDOR_STATE_REL};
 
 use crate::args::{apply_env_toggles, GlobalArgs};
 use crate::json_envelope::{
@@ -19,25 +18,21 @@ pub struct ListArgs {
     pub common: GlobalArgs,
 }
 
-/// Where a listed record lives. Declaration order is the tie-break order
-/// when one purl appears in several stores: coexistence is real state (e.g.
-/// an agent-applied patch alongside live hosted wiring), so every copy is
-/// shown, labeled apart.
-#[derive(Clone, Copy, PartialEq, Eq, PartialOrd, Ord)]
-enum Source {
-    /// A `.socket/manifest.json` entry (agent mode).
-    Manifest,
-    /// A hosted pin the lockfiles wire: `scan --mode hosted` keeps no
-    /// ledger and never writes the manifest, so the lockfiles are the only
-    /// record of a hosted patch.
-    Hosted,
-    /// A vendor-ledger record: vendored mode is manifest-free, so every
-    /// `scan`/`get --mode vendored` patch lives ONLY in
-    /// `.socket/vendor/state.json`, as a `detached` entry's embedded record
-    /// (the hosted rule again — a vendored-only project lists and exits 0).
-    /// A standalone `vendor` entry's fallback copy lists here too once no
-    /// manifest entry covers it — the checkout `vex` attests from it.
-    Vendored,
+// Where a listed record lives (see `socket_patch_core::ledgers`): the
+// manifest (agent mode); the hosted redirect ledger, where `scan --mode
+// hosted` recorded its patches; or the vendor ledger, where vendored mode
+// keeps every `scan`/`get --mode vendored` patch as a `detached` entry's
+// embedded record (a standalone `vendor` entry's fallback copy lists too
+// once no manifest entry covers it — the checkout `vex` attests from it).
+use socket_patch_core::ledgers::Store as Source;
+
+/// The display order of one purl's copies: manifest, hosted, vendored.
+fn display_rank(source: Source) -> u8 {
+    match source {
+        Source::Manifest => 0,
+        Source::Hosted => 1,
+        Source::Vendored => 2,
+    }
 }
 
 /// The `(mode, ledger)` label pair for a vendor-ledger record — the shared
@@ -109,53 +104,46 @@ impl HostedListing {
     }
 }
 
-/// Every listable record from all three stores, in a stable order: by
-/// PURL, then manifest < hosted < vendored when one purl appears in more
-/// than one. The record maps (`HashMap` manifest and vendor ledger /
-/// hosted pins) never impose an order shared consumers could
-/// diff, so the sort here is the contract. Only vendor entries whose
-/// embedded record stands on its own fold in
-/// ([`crate::commands::vendor_record_is_unowned`], the rule `vex` attests
-/// by): a `detached` entry always (coexisting with a manifest entry is real
-/// state, shown labeled apart), a standalone `vendor` entry's fallback copy
-/// only when the manifest does not cover it — while it does, the manifest's
-/// record IS that entry's record and listing the copy would double-list the
-/// purl. A legacy entry with no embedded record never folds in.
+/// Every listable record, in a stable order: by PURL, then
+/// [`display_rank`] when one purl appears in more than one store. The
+/// manifest and the vendor ledger go through the shared owner rule
+/// ([`socket_patch_core::ledgers::Ledgers::listed`]: coexisting copies are
+/// real state, shown labeled apart; a claimed fallback copy and a legacy
+/// entry with no embedded record never list); every hosted pin lists as
+/// its own copy (the lockfiles are the only hosted record). The record
+/// maps never impose an order shared consumers could diff, so the sort
+/// here is the contract.
 fn combined_entries<'a>(
     manifest: Option<&'a PatchManifest>,
     hosted: &'a [HostedListing],
-    vendor: Option<&'a std::collections::HashMap<String, VendorEntry>>,
+    vendor: Option<&'a VendorState>,
 ) -> Vec<ListEntry<'a>> {
-    let mut entries: Vec<ListEntry<'a>> = Vec::new();
-    if let Some(manifest) = manifest {
-        entries.extend(manifest.patches.iter().map(|(purl, record)| ListEntry {
-            purl,
-            record,
-            source: Source::Manifest,
+    let ledgers = socket_patch_core::ledgers::Ledgers {
+        manifest,
+        vendor,
+        redirect: None,
+    };
+    let mut entries: Vec<ListEntry<'a>> = ledgers
+        .listed()
+        .into_iter()
+        .map(|l| ListEntry {
+            purl: l.key,
+            record: l.record,
+            source: l.store,
             lockfiles: &[],
-        }));
-    }
+        })
+        .collect();
     entries.extend(hosted.iter().map(|h| ListEntry {
         purl: &h.purl,
         record: &h.record,
         source: Source::Hosted,
         lockfiles: &h.lockfiles,
     }));
-    if let Some(vendor) = vendor {
-        entries.extend(vendor.iter().filter_map(|(purl, entry)| {
-            let record = entry
-                .record
-                .as_ref()
-                .filter(|_| crate::commands::vendor_record_is_unowned(purl, entry, manifest))?;
-            Some(ListEntry {
-                purl,
-                record,
-                source: Source::Vendored,
-                lockfiles: &[],
-            })
-        }));
-    }
-    entries.sort_by(|a, b| a.purl.cmp(b.purl).then(a.source.cmp(&b.source)));
+    entries.sort_by(|a, b| {
+        a.purl
+            .cmp(b.purl)
+            .then(display_rank(a.source).cmp(&display_rank(b.source)))
+    });
     entries
 }
 
@@ -379,8 +367,12 @@ pub async fn run(args: ListArgs) -> i32 {
     // unparseable), and any other `Err` (genuine I/O failure). No stat
     // pre-check: it would report any stat failure as `manifest_not_found`
     // and open a TOCTOU window.
-    let manifest = match read_manifest(&manifest_path).await {
-        Ok(manifest) => manifest,
+    // One load of the three stores, all from the SAME project as the
+    // manifest (see below); each keeps list's own posture.
+    let ctx = crate::commands::context::ProjectContext::new(&args.common);
+    let loaded = ctx.loaded().await;
+    let manifest = match &loaded.manifest {
+        Ok(manifest) => manifest.as_ref(),
         Err(e) => {
             // `InvalidData` (bad JSON or schema) is the contract's
             // `manifest_invalid`; everything else is `manifest_unreadable`
@@ -394,7 +386,7 @@ pub async fn run(args: ListArgs) -> i32 {
             emit_error(
                 &args,
                 code,
-                manifest_error_message(&manifest_path, &e),
+                manifest_error_message(&manifest_path, e),
                 Vec::new(),
             );
             return 1;
@@ -412,25 +404,23 @@ pub async fn run(args: ListArgs) -> i32 {
     // hosted pins it still describes; a malformed one degrades to "nothing
     // to consult", surfaced on stderr unless --silent, or in the envelope's
     // `warnings[]` under --json.
-    let project_root = args.common.project_root();
     let mut warnings: Vec<RunWarning> = Vec::new();
-    let legacy_redirect =
-        match socket_patch_core::patch::redirect::load_redirect_state(&project_root).await {
-            Ok(state) => state,
-            Err(corrupt) => {
-                if args.common.json {
-                    warnings.push(RunWarning {
-                        code: "redirect_ledger_corrupt".to_string(),
-                        detail: corrupt.to_string(),
-                    });
-                } else if !args.common.silent {
-                    eprintln!("Warning: {corrupt}");
-                }
-                None
+    let legacy_redirect = match &loaded.redirect {
+        Ok(state) => state.as_ref(),
+        Err(corrupt) => {
+            if args.common.json {
+                warnings.push(RunWarning {
+                    code: "redirect_ledger_corrupt".to_string(),
+                    detail: corrupt.to_string(),
+                });
+            } else if !args.common.silent {
+                eprintln!("Warning: {corrupt}");
             }
-        };
-    let inventory = crate::commands::hosted_inventory(&args.common, &project_root).await;
-    let hosted = HostedListing::from_pins(&inventory.pins, legacy_redirect.as_ref());
+            None
+        }
+    };
+    let inventory = crate::commands::hosted_inventory(&args.common, &ctx.root).await;
+    let hosted = HostedListing::from_pins(&inventory.pins, legacy_redirect);
     // Contested hosted wiring cannot be listed as patches, but it is hosted
     // state: surface it (stderr / `warnings[]`), never hide it.
     let contested = inventory.contested_refusal();
@@ -444,17 +434,12 @@ pub async fn run(args: ListArgs) -> i32 {
             eprintln!("Warning: {}", crate::commands::rollback::capitalize_first(detail));
         }
     }
-    let vendor_state =
-        crate::commands::load_vendor_state_lenient(&project_root, args.common.silent).await;
+    let vendor_state = crate::commands::vendor_state_lenient(&loaded.vendor, args.common.silent);
 
     // `combined_entries` folds only real records in (a record-less legacy
     // vendor entry asserts no patch), so entry emptiness is the whole exit
     // predicate.
-    let entries = combined_entries(
-        manifest.as_ref(),
-        &hosted,
-        vendor_state.as_ref().map(|s| &s.entries),
-    );
+    let entries = combined_entries(manifest, &hosted, vendor_state);
     if manifest.is_none() && entries.is_empty() {
         if let Some(detail) = contested {
             emit_error(&args, "hosted_wiring_contested", detail, warnings);
@@ -470,7 +455,7 @@ pub async fn run(args: ListArgs) -> i32 {
     // Telemetry: `patch_listed`'s `patches_count` means "manifest patches"
     // to its consumers, so it counts the manifest ONLY (0 on a ledger-only
     // project) rather than the listed entries.
-    let manifest_patch_count = manifest.as_ref().map_or(0, |m| m.patches.len());
+    let manifest_patch_count = manifest.map_or(0, |m| m.patches.len());
     let (api_token, org_slug) = args.common.telemetry_credentials();
     track_patch_listed(
         manifest_patch_count,
@@ -498,6 +483,7 @@ mod tests {
     //! consumers (PR bots, dashboards) can rely on it.
     use super::*;
     use socket_patch_core::manifest::schema::{PatchFileInfo, PatchRecord, VulnerabilityInfo};
+    use socket_patch_core::vendor::state::VendorEntry;
     use std::collections::HashMap;
 
     /// Envelope for a manifest-only listing (no hosted pins, no vendor
@@ -817,6 +803,13 @@ mod tests {
     /// `record` is given (the manifest-free vendored posture), a legacy
     /// manifest-tracked entry (no record of its own) otherwise. Built from
     /// the on-disk JSON shape so the fixture follows the ledger schema.
+    fn as_state(entries: &HashMap<String, VendorEntry>) -> VendorState {
+        VendorState {
+            entries: entries.clone(),
+            ..VendorState::new()
+        }
+    }
+
     fn vendor_entry(purl: &str, record: Option<PatchRecord>) -> VendorEntry {
         serde_json::from_value(serde_json::json!({
             "ecosystem": "npm",
@@ -862,7 +855,7 @@ mod tests {
         let env = build_list_envelope(&combined_entries(
             Some(&manifest),
             &pins,
-            Some(&vendor),
+            Some(&as_state(&vendor)),
         ));
         let v: serde_json::Value = serde_json::from_str(&env.to_pretty_json()).unwrap();
         let listed: Vec<(&str, &str)> = v["events"]
@@ -896,7 +889,7 @@ mod tests {
             "the ledger's embedded record is the one listed: {v}"
         );
 
-        let only = build_list_envelope(&combined_entries(None, &[], Some(&vendor)));
+        let only = build_list_envelope(&combined_entries(None, &[], Some(&as_state(&vendor))));
         let v: serde_json::Value = serde_json::from_str(&only.to_pretty_json()).unwrap();
         assert_eq!(v["status"], "success", "{v}");
         assert_eq!(v["summary"]["discovered"], 2, "{v}");
@@ -960,7 +953,11 @@ mod tests {
         };
 
         assert_eq!(
-            listed(&combined_entries(Some(&manifest), &[], Some(&vendor))),
+            listed(&combined_entries(
+                Some(&manifest),
+                &[],
+                Some(&as_state(&vendor))
+            )),
             vec![
                 (
                     "pkg:npm/left-pad@1.3.0".to_string(),
@@ -977,7 +974,7 @@ mod tests {
         );
 
         // No manifest at all: every fallback copy stands on its own.
-        let only = listed(&combined_entries(None, &[], Some(&vendor)));
+        let only = listed(&combined_entries(None, &[], Some(&as_state(&vendor))));
         assert_eq!(only.len(), 3, "{only:?}");
         assert!(
             only.iter().all(|(_, mode, _)| mode == "vendored"),
diff --git a/crates/socket-patch-cli/src/commands/mod.rs b/crates/socket-patch-cli/src/commands/mod.rs
index 87f55213..5e11c94b 100644
--- a/crates/socket-patch-cli/src/commands/mod.rs
+++ b/crates/socket-patch-cli/src/commands/mod.rs
@@ -1,5 +1,6 @@
 pub mod apply;
 pub(crate) mod bun_preflight;
+pub(crate) mod context;
 pub(crate) mod fetch_stage;
 pub mod get;
 pub mod hosted_bundle;
@@ -47,15 +48,26 @@ pub(crate) async fn discover_wiring(
     common: &crate::args::GlobalArgs,
     root: &Path,
 ) -> socket_patch_core::vex::discover::Discovery {
-    let opts = socket_patch_core::vex::DiscoverOptions {
+    socket_patch_core::vex::discover_patched_refs_with(root, &discover_options(common)).await
+}
+
+/// [`discover_wiring`] of the snapshot's root, reading through `snapshot`.
+pub(crate) async fn discover_wiring_in(
+    common: &crate::args::GlobalArgs,
+    snapshot: &socket_patch_core::vendor::lock_inventory::DiskSnapshot<'_>,
+) -> socket_patch_core::vex::discover::Discovery {
+    socket_patch_core::vex::discover_patched_refs_in(snapshot, &discover_options(common)).await
+}
+
+fn discover_options(common: &crate::args::GlobalArgs) -> socket_patch_core::vex::DiscoverOptions {
+    socket_patch_core::vex::DiscoverOptions {
         patch_server_origins: common
             .patch_server_url
             .iter()
             .filter(|url| !url.trim().is_empty())
             .cloned()
             .collect(),
-    };
-    socket_patch_core::vex::discover_patched_refs_with(root, &opts).await
+    }
 }
 
 /// The project's hosted wiring as raw inventory (core
@@ -112,17 +124,17 @@ pub(crate) fn hosted_state_from_pins(
     state
 }
 
-/// Read-only lenient load of the vendor ledger (`.socket/vendor/state.json`):
+/// Read-only lenient view of a loaded vendor ledger (`.socket/vendor/state.json`):
 /// missing → an empty ledger; malformed/unreadable → `None` with the
 /// problem surfaced on stderr unless `silent`. A read-only
 /// consumer (`list`) degrades a broken ledger to nothing-to-consult but
 /// must say so, while every path that writes or attests from it fails
 /// closed instead.
-pub(crate) async fn load_vendor_state_lenient(
-    root: &Path,
+pub(crate) fn vendor_state_lenient(
+    loaded: &std::io::Result<socket_patch_core::vendor::state::VendorState>,
     silent: bool,
-) -> Option<socket_patch_core::vendor::state::VendorState> {
-    match socket_patch_core::vendor::load_state(root).await {
+) -> Option<&socket_patch_core::vendor::state::VendorState> {
+    match loaded {
         Ok(state) => Some(state),
         Err(e) => {
             if !silent {
@@ -135,29 +147,3 @@ pub(crate) async fn load_vendor_state_lenient(
     }
 }
 
-/// Whether a vendor-ledger entry's embedded `record` stands on its own —
-/// the rule every reader of embedded records shares (`vex`'s record plan
-/// and `list`), so one
-/// tree never lists "no patches" while its VEX document attests one.
-///
-/// A `detached` entry (every `scan`/`get --mode vendored` entry) has no
-/// manifest owner: its record is the only copy. A non-detached entry was
-/// written by the manifest-driven standalone `vendor`, which embeds the
-/// record as a fallback copy: the manifest record stays authoritative while
-/// the manifest covers the entry — its ledger key, or its base purl (the
-/// claim `vex_sources`' candidate builder applies) — and the embedded copy
-/// stands in only when it does not (a checkout that never committed its
-/// manifest, or one that dropped the purl while the lockfile still wires
-/// the artifact). `repair` deliberately stays narrower (the copy is used
-/// only with no manifest at all): it rebuilds artifacts, and a purl dropped
-/// from a live manifest is the reconcile's to revert, not repair's to heal.
-pub(crate) fn vendor_record_is_unowned(
-    key: &str,
-    entry: &socket_patch_core::vendor::VendorEntry,
-    manifest: Option<&socket_patch_core::manifest::schema::PatchManifest>,
-) -> bool {
-    entry.detached
-        || manifest.is_none_or(|m| {
-            !m.patches.contains_key(key) && !m.patches.contains_key(&entry.base_purl)
-        })
-}
diff --git a/crates/socket-patch-cli/src/commands/remove.rs b/crates/socket-patch-cli/src/commands/remove.rs
index 2f7a09a4..3d72b58c 100644
--- a/crates/socket-patch-cli/src/commands/remove.rs
+++ b/crates/socket-patch-cli/src/commands/remove.rs
@@ -23,18 +23,16 @@ use crate::commands::lock_cli::acquire_or_emit;
 use crate::json_envelope::{Command, Envelope, EnvelopeError, PatchAction, PatchEvent, Status};
 use crate::ui::plural;
 
-/// Vendor-ledger entries matching a remove identifier (by ledger key,
-/// base purl or uuid — `VendorEntry::matches_identifier`), sorted by key
-/// for deterministic event order.
+/// Vendor-ledger entries matching a remove identifier
+/// ([`socket_patch_core::ledgers::Ledgers::matching`]), sorted by key for
+/// deterministic event order.
 fn vendor_entries_matching(state: &VendorState, identifier: &str) -> Vec<(String, VendorEntry)> {
-    let mut matches: Vec<(String, VendorEntry)> = state
-        .entries
-        .iter()
-        .filter(|(key, entry)| entry.matches_identifier(key, identifier))
-        .map(|(k, e)| (k.clone(), e.clone()))
-        .collect();
-    matches.sort_by(|a, b| a.0.cmp(&b.0));
-    matches
+    socket_patch_core::ledgers::Ledgers {
+        vendor: Some(state),
+        ..Default::default()
+    }
+    .matching(identifier)
+    .vendor
 }
 
 /// The lockfiles' hosted pins matching a remove identifier (by purl or
diff --git a/crates/socket-patch-cli/src/commands/rollback.rs b/crates/socket-patch-cli/src/commands/rollback.rs
index e49a4051..a84a1b3f 100644
--- a/crates/socket-patch-cli/src/commands/rollback.rs
+++ b/crates/socket-patch-cli/src/commands/rollback.rs
@@ -1310,20 +1310,17 @@ pub async fn run(args: RollbackArgs) -> i32 {
         vendor_scope.extend(vendor_entries.iter().map(|(k, _)| k.clone()));
         hosted_scope.extend(redirect_records.iter().map(|(p, _)| p.clone()));
     }
+    let ledgers = socket_patch_core::ledgers::Ledgers {
+        manifest: Some(&manifest),
+        vendor: vendor_state_result.as_ref().ok(),
+        redirect: None,
+    };
     for id in &identifiers {
-        let mut matched = false;
-        for (purl, patch) in &manifest.patches {
-            if patch_matches(purl, &patch.uuid, id) {
-                manifest_scope.insert(purl.clone());
-                matched = true;
-            }
-        }
-        for (key, entry) in &vendor_entries {
-            if entry.matches_identifier(key, id) {
-                vendor_scope.insert(key.clone());
-                matched = true;
-            }
-        }
+        let found = ledgers.matching(id);
+        let mut matched = !found.is_empty();
+        manifest_scope.extend(found.manifest);
+        vendor_scope.extend(found.vendor.into_iter().map(|(k, _)| k));
+        // Hosted pins live in the lockfiles, not in a store.
         for (purl, uuid) in &redirect_records {
             if patch_matches(purl, uuid, id) {
                 hosted_scope.insert(purl.clone());
diff --git a/crates/socket-patch-cli/src/commands/scan/discovery.rs b/crates/socket-patch-cli/src/commands/scan/discovery.rs
index 642547aa..ce5425e9 100644
--- a/crates/socket-patch-cli/src/commands/scan/discovery.rs
+++ b/crates/socket-patch-cli/src/commands/scan/discovery.rs
@@ -31,54 +31,21 @@ pub(super) struct UpdateInfo {
 /// Lockfile-only packages: dependencies the project's lockfile resolves
 /// that have no crawled (installed) counterpart.
 #[derive(Default)]
-pub(super) struct LockfileSupplement {
-    pub(super) packages: Vec<socket_patch_core::crawlers::types::CrawledPackage>,
+pub(crate) struct LockfileSupplement {
+    pub(crate) packages: Vec<socket_patch_core::crawlers::types::CrawledPackage>,
     /// Literal crawler-form purls, for fast membership tests.
-    pub(super) purls: HashSet<String>,
+    pub(crate) purls: HashSet<String>,
     /// The FULL lockfile inventory the supplement was derived from (installed
     /// packages included), kept so the hosted-wiring probes reuse it instead
     /// of re-parsing every project lockfile. Empty for global scans.
-    pub(super) entries: Vec<LockfileEntry>,
+    pub(crate) entries: Vec<LockfileEntry>,
     /// npm layouts the lockfile inventory REFUSED (Plug'n'Play loaders).
     /// Scan surfaces these as refusal warnings: under PnP the installed-tree
     /// crawl is empty too, so otherwise the project scans as a silent no-op.
-    pub(super) unsupported: Vec<socket_patch_core::vendor::lock_inventory::UnsupportedNpmLayout>,
+    pub(crate) unsupported: Vec<socket_patch_core::vendor::lock_inventory::UnsupportedNpmLayout>,
 }
 
-/// Map a core npm-layout refusal onto scan's warning channel as
-/// `(code, detail)`. The yarn code matches apply's refusal errorCode
-/// (`yarn_pnp_unsupported`) so consumers key on ONE name across commands;
-/// the pnpm twin gets the parallel spelling. Details are scan-phrased (what
-/// was NOT scanned + remedy) rather than the probe's vendor-phrased text.
-pub(crate) fn unsupported_layout_warnings(
-    unsupported: &[socket_patch_core::vendor::lock_inventory::UnsupportedNpmLayout],
-) -> Vec<(String, String)> {
-    unsupported
-        .iter()
-        .map(|diag| match diag.code {
-            "vendor_yarn_berry_unsupported" => (
-                "yarn_pnp_unsupported".to_string(),
-                "this project uses yarn Plug'n'Play (a `.pnp.*` loader is present): its npm \
-                 packages live inside `.yarn/cache/*.zip`, not `node_modules/`, so socket-patch \
-                 cannot discover or patch them in ANY mode (agent, hosted, or vendored) — npm \
-                 dependencies were NOT scanned. Use `yarn patch <pkg>` to patch them instead."
-                    .to_string(),
-            ),
-            "vendor_pnpm_pnp_unsupported" => (
-                "pnpm_pnp_unsupported".to_string(),
-                "this project uses pnpm's Plug'n'Play linker (`node-linker=pnp` in .npmrc): \
-                 lockfile discovery is skipped under this layout, so lockfile-only npm \
-                 dependencies were NOT scanned. Switch .npmrc to `node-linker=isolated`, run \
-                 `pnpm install`, and re-run — or use `socket-patch scan --mode hosted`, which \
-                 edits pnpm-lock.yaml in place."
-                    .to_string(),
-            ),
-            // Forward-compat: a new refusal code surfaces verbatim rather
-            // than being swallowed back into silence.
-            other => (other.to_string(), diag.detail.clone()),
-        })
-        .collect()
-}
+pub(crate) use socket_patch_core::vendor::lock_inventory::unsupported_layout_warnings;
 
 /// Inventory the project's lockfile(s) and fabricate crawl entries for
 /// dependencies that are not installed. The fabricated `path` is the
@@ -91,19 +58,19 @@ pub(crate) fn unsupported_layout_warnings(
 /// crawled): an entry of an ecosystem the crawl skipped is never counted
 /// lockfile-only, since there is no crawl to tell whether it is installed.
 /// `entries` still holds the full inventory.
-pub(super) async fn lockfile_supplement(
-    common: &GlobalArgs,
+pub(crate) async fn lockfile_supplement(
+    ctx: &crate::commands::context::ProjectContext<'_>,
     crawled: &[socket_patch_core::crawlers::types::CrawledPackage],
     only: Option<&[String]>,
 ) -> LockfileSupplement {
-    use socket_patch_core::vendor::lock_inventory;
-
+    let common = ctx.common;
     let mut out = LockfileSupplement::default();
     if common.is_global() {
         return out;
     }
-    let (entries, unsupported) = lock_inventory::inventory_project_diagnosed(&common.cwd).await;
-    out.unsupported = unsupported;
+    let locks = ctx.locks().await;
+    out.unsupported = locks.unsupported.clone();
+    let entries = &locks.entries;
     if entries.is_empty() {
         return out;
     }
@@ -114,7 +81,7 @@ pub(super) async fn lockfile_supplement(
                 .is_some_and(|eco| list.iter().any(|name| name == eco.cli_name()))
         })
     };
-    for entry in &entries {
+    for entry in entries {
         if crawled_purls.contains(entry.purl.as_str()) || !in_scope(&entry.purl) {
             continue;
         }
@@ -124,7 +91,7 @@ pub(super) async fn lockfile_supplement(
         out.purls.insert(entry.purl.clone());
         out.packages.push(pkg);
     }
-    out.entries = entries;
+    out.entries = entries.clone();
     out
 }
 
@@ -167,7 +134,7 @@ fn crawled_from_purl(
 /// runs all keep working before any install). They are NOT "lockfile-only"
 /// — nothing needs installing; the artifact satisfies the lock. `state` is
 /// the ledger `run` already loaded (`vendor::load_state`).
-pub(super) async fn vendored_ledger_supplement(
+pub(crate) async fn vendored_ledger_supplement(
     common: &GlobalArgs,
     crawled: &[socket_patch_core::crawlers::types::CrawledPackage],
     state: &std::io::Result<VendorState>,
@@ -404,43 +371,49 @@ pub(super) async fn preverify_vendor_baselines<W: std::io::Write>(
 /// ledger) and vendored mode ONLY in `.socket/vendor/state.json`, so without
 /// this fold a pure hosted or vendored project's `updates[]` would always
 /// be empty. Precedence on a collision: manifest > hosted pins > vendor
-/// ledger (the live lock over a possibly superseded vendored entry). Vendor
-/// entries are keyed by their manifest-form ledger key (`detect_updates`
-/// bridges the spellings); a legacy entry without an embedded record
-/// contributes its uuid alone. Borrows the manifest untouched when nothing
-/// else contributes.
+/// ledger (the live lock over a possibly superseded vendored entry); the
+/// vendor entries fold under the shared owner rule
+/// ([`socket_patch_core::ledgers::Ledgers::owned`]), so one the manifest
+/// claims (its key or base purl) stays behind the manifest's record.
+/// Vendor entries are keyed by their ledger key (`detect_updates` bridges
+/// the spellings); a legacy entry without an embedded record contributes
+/// its uuid alone. Borrows the manifest untouched when nothing else
+/// contributes.
 pub(super) fn merge_ledger_records_for_updates<'a>(
     manifest: Option<&'a PatchManifest>,
     vendor: Option<&VendorState>,
     hosted_pins: &[(String, String)],
 ) -> Option<Cow<'a, PatchManifest>> {
-    let vendor_entries = vendor.map(|s| &s.entries).filter(|e| !e.is_empty());
-    if vendor_entries.is_none() && hosted_pins.is_empty() {
+    use socket_patch_core::ledgers::{uuid_only_record, Ledgers, Store};
+    let vendor = vendor.filter(|s| !s.entries.is_empty());
+    if vendor.is_none() && hosted_pins.is_empty() {
         return manifest.map(Cow::Borrowed);
     }
-    let uuid_only = |uuid: &str| PatchRecord {
-        uuid: uuid.to_string(),
-        exported_at: String::new(),
-        files: HashMap::new(),
-        vulnerabilities: HashMap::new(),
-        description: String::new(),
-        license: String::new(),
-        tier: String::new(),
-    };
     let mut merged = manifest.cloned().unwrap_or_default();
     for (purl, uuid) in hosted_pins {
         merged
             .patches
             .entry(purl.clone())
-            .or_insert_with(|| uuid_only(uuid));
-    }
-    for (purl, entry) in vendor_entries.into_iter().flatten() {
-        merged.patches.entry(purl.clone()).or_insert_with(|| {
-            entry
-                .record
-                .clone()
-                .unwrap_or_else(|| uuid_only(&entry.uuid))
-        });
+            .or_insert_with(|| uuid_only_record(uuid));
+    }
+    let ledgers = Ledgers {
+        manifest,
+        vendor,
+        redirect: None,
+    };
+    for owned in ledgers.owned() {
+        if owned.store == Store::Manifest {
+            continue;
+        }
+        merged
+            .patches
+            .entry(owned.key.to_string())
+            .or_insert_with(|| {
+                owned
+                    .record
+                    .cloned()
+                    .unwrap_or_else(|| uuid_only_record(owned.uuid))
+            });
     }
     Some(Cow::Owned(merged))
 }
diff --git a/crates/socket-patch-cli/src/commands/scan/hosted.rs b/crates/socket-patch-cli/src/commands/scan/hosted.rs
index 445e0c52..b0afa29c 100644
--- a/crates/socket-patch-cli/src/commands/scan/hosted.rs
+++ b/crates/socket-patch-cli/src/commands/scan/hosted.rs
@@ -9,7 +9,6 @@ use std::time::Duration;
 use futures_util::StreamExt;
 use socket_patch_core::api::client::hold_back_debug;
 use socket_patch_core::api::types::BatchPackagePatches;
-use socket_patch_core::formats::registry;
 use socket_patch_core::patch::apply_lock::LockGuard;
 use socket_patch_core::patch::redirect::DepOverride;
 use socket_patch_core::utils::concurrent::{
@@ -27,12 +26,18 @@ pub(crate) mod vlt;
 pub(crate) use vlt::rollback_heal as vlt_rollback_heal;
 pub(crate) use vlt::takeover_heal as vlt_takeover_heal;
 
-/// Candidate lockfiles / registry configs the redirect rewriters may touch —
-/// read from the project when present and handed to
-/// `rewrite_registry_redirect`: the [`registry::HOSTED`] rows of the format
-/// registry, in its read order.
-pub(crate) static REDIRECT_CANDIDATE_FILES: std::sync::LazyLock<Vec<&'static str>> =
-    std::sync::LazyLock::new(|| registry::paths_with(registry::HOSTED));
+#[cfg(test)]
+pub(crate) use socket_patch_core::hosted::guidance::{
+    npm_allow_remote_already_detail, npm_allow_remote_configured_detail,
+    npm_allow_remote_env_set_detail, npm_allow_remote_manual_detail,
+    npm_allow_remote_outer_set_detail, npm_allow_remote_unreadable_detail,
+    npm_allow_remote_user_set_detail, plan_workspace_trust, pnpm_heal_root,
+    pnpm_lock_carries_hosted_redirect, pnpm_lock_may_need_store_flag, pnpm_lock_version_major,
+    pnpm_trust_configured_detail, pnpm_trust_legacy_detail, pnpm_trust_manual_guidance,
+    pnpm_trust_workspace_unreadable_detail, read_npmrc_for_allow_remote, read_workspace_for_trust,
+    TrustPlan,
+};
+pub(crate) use socket_patch_core::hosted::render::redirect_json_block;
 
 /// Most hosted wheel-metadata downloads in flight at once, below the patch
 /// API's own in-flight cap: each one buffers a whole wheel (up to
@@ -50,439 +55,6 @@ fn wheel_metadata_concurrency(use_public_proxy: bool) -> usize {
     api_concurrency(use_public_proxy).min(WHEEL_METADATA_CONCURRENCY)
 }
 
-/// `scheme://[user[:pass]@]host[:port]/…` → `host[:port]`, NEVER userinfo.
-/// For user-facing messages that name where a lockfile now points — the
-/// hosted artifact host follows `--api-url`, so hardcoding `patch.socket.dev`
-/// would misname it in custom-server environments. The port is kept (it is
-/// part of the authority the lock records); credentials are stripped: a
-/// credentialed artifact URL (`https://user:secret@host/…`) must never leak
-/// `user:secret` into the warning text or the persisted `--json` envelope —
-/// both land in CI logs. Split by hand because this crate has no URL-parser
-/// dependency (reqwest is dev-only here); per RFC 3986 a raw `@` in the
-/// authority can ONLY be the userinfo terminator (it is percent-encoded
-/// everywhere else), so the tail after the LAST `@` is exactly host[:port].
-pub(crate) fn url_host(url: &str) -> Option<&str> {
-    let rest = url.split_once("://").map_or(url, |(_, r)| r);
-    let authority = rest.split(['/', '?', '#']).next().unwrap_or(rest);
-    let host = authority.rsplit_once('@').map_or(authority, |(_, h)| h);
-    (!host.is_empty()).then_some(host)
-}
-
-/// Repo-relative path of the pnpm workspace manifest the trustLockfile
-/// auto-config edits (the same file the vendor backend's override surface
-/// uses).
-pub(crate) const PNPM_WORKSPACE_REL: &str = "pnpm-workspace.yaml";
-
-/// `FileEdit.kind` recorded when the hosted flow ensures `trustLockfile:
-/// true` in pnpm-workspace.yaml. `action: "created"` — the workspace file
-/// itself was created (a revert deletes it); `action: "added"` — the single
-/// `trustLockfile: true` line was appended to an existing file (a revert
-/// removes exactly that line). Additive ledger vocabulary: older ledgers
-/// without it load unchanged (kind is an opaque string to the loader).
-pub(crate) const REDIRECT_PNPM_WORKSPACE_TRUST_EDIT_KIND: &str = "redirect_pnpm_workspace_trust";
-
-/// The honest-tradeoff + don't-rebuild tail shared by every trustLockfile
-/// warning variant. The tradeoff sentence is a security disclosure, not
-/// prose garnish: `trustLockfile: true` disables pnpm's lockfile
-/// re-verification for the WHOLE lock, so it must be stated wherever the
-/// setting is written or recommended.
-pub(crate) const PNPM_TRUST_TRADEOFF_AND_CAUTION: &str =
-    "Note: trustLockfile makes pnpm skip its lockfile re-verification \
-     (minimumReleaseAge / trustPolicy re-checks) for ALL lockfile entries, \
-     not just the patched ones — the per-entry sha512 integrity pins are \
-     still enforced. Do NOT follow pnpm's advice to rebuild the lockfile \
-     (`pnpm clean --lockfile`): that silently discards the hosted patches and \
-     reinstalls the vulnerable upstream artifact. pnpm <=10 ignores the \
-     setting and installs work unchanged";
-
-/// The policy preamble shared by every trustLockfile warning variant:
-/// what was repointed, and how pnpm >=11 fails without trust.
-pub(crate) fn pnpm_trust_policy_preamble(server: &str) -> String {
-    format!(
-        "pnpm-lock.yaml was repointed at {server}; pnpm >=11 rejects the \
-         rewritten lock (pnpm 11: ERR_PNPM_TARBALL_URL_MISMATCH, pnpm 12: \
-         ERR_PNPM_LOCKFILE_RESOLUTION_VERIFICATION)"
-    )
-}
-
-/// The pre-auto-config guidance, kept verbatim for the runs where the
-/// auto-config does not apply (legacy 5.x/6.0 locks, Rush nested locks,
-/// `--no-trust-lockfile-config`): both verified recoveries, spelled exactly.
-pub(crate) fn pnpm_trust_manual_guidance(server: &str) -> String {
-    format!(
-        "{}. Install with `pnpm install --trust-lockfile`, or commit \
-         `trustLockfile: true` in pnpm-workspace.yaml so every install \
-         accepts the patched artifacts. Do NOT follow pnpm's advice to \
-         rebuild the lockfile (`pnpm clean --lockfile`): that silently \
-         discards the hosted patches and reinstalls the vulnerable upstream \
-         artifact. pnpm <=10 installs work unchanged",
-        pnpm_trust_policy_preamble(server),
-    )
-}
-
-/// The LEGACY-lock variant (lockfileVersion 5.x/6.0 — pnpm 7/8): those
-/// majors have neither the pnpm >=11 lockfile trust policy nor any trust
-/// flag or setting, so installs consume the redirected lock unchanged and
-/// no trust step exists or is needed. Deliberately NEVER mentions
-/// `pnpm install --trust-lockfile`: pnpm 7/8 reject the flag as an unknown
-/// option, so headlining it here would hand users a command that errors.
-pub(crate) fn pnpm_trust_legacy_detail(server: &str) -> String {
-    format!(
-        "The pnpm lockfile was repointed at {server}. This is a legacy \
-         lock read by pnpm 1–8, which have no \
-         lockfile trust policy: no trust step exists or is needed. Do NOT regenerate the lockfile \
-         (deleting it, or re-resolving on a newer pnpm): that silently \
-         discards the hosted patches and reinstalls the vulnerable upstream \
-         artifact. If the project later moves to pnpm >=9, re-run \
-         `socket-patch scan --mode hosted` so the regenerated lock is \
-         switched to hosted (and trust-configured) again"
-    )
-}
-
-/// The unreadable-workspace fallback: pnpm-workspace.yaml EXISTS but could
-/// not be read (permissions, invalid UTF-8, I/O error). Planning a Create
-/// here would OVERWRITE the user's file with the root-only scaffold —
-/// destroying their `packages:` globs — so the auto-config stands down and
-/// the warning names the file, the error, and both manual recoveries.
-pub(crate) fn pnpm_trust_workspace_unreadable_detail(server: &str, err: &std::io::Error) -> String {
-    format!(
-        "{}. {PNPM_WORKSPACE_REL} exists but could not be read ({err}); it \
-         was left untouched — auto-configuring trust would risk overwriting \
-         it. Fix the file, then install with `pnpm install --trust-lockfile` \
-         or add `trustLockfile: true` to it yourself so every install \
-         accepts the patched artifacts. Do NOT follow pnpm's advice to \
-         rebuild the lockfile (`pnpm clean --lockfile`): that silently \
-         discards the hosted patches and reinstalls the vulnerable upstream \
-         artifact. pnpm <=10 installs work unchanged",
-        pnpm_trust_policy_preamble(server),
-    )
-}
-
-/// The pnpm-workspace.yaml read, classified for the trust auto-config:
-/// `Ok(Some(text))` — read fine; `Ok(None)` — ABSENT (`ErrorKind::NotFound`,
-/// the only state where planning a Create is safe); `Err(e)` — present but
-/// unreadable, so the caller must fall back to warning-only guidance
-/// (planning a Create would overwrite the user's `packages:` globs).
-///
-/// FIFO-safe (`read_regular_to_string_sync`: non-blocking open + fstat): a
-/// FIFO planted at the path classifies as unreadable (`InvalidInput`) instead
-/// of wedging the run in `open(2)`.
-fn read_workspace_for_trust(path: &std::path::Path) -> std::io::Result<Option<String>> {
-    match socket_patch_core::utils::fs::read_regular_to_string_sync(path) {
-        Ok(text) => Ok(Some(text)),
-        Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(None),
-        Err(e) => Err(e),
-    }
-}
-
-/// HEAL-ON-RERUN probe: does this (unspliced) root pnpm-lock.yaml already
-/// carry a granted hosted artifact URL from an EARLIER run? Same spelling
-/// set as the confirmation probe (raw / `\/`-escaped via
-/// `artifact_url_present`, plus the percent-encoded form) so a writer's
-/// spelling can never be one this probe misses. Lets an idempotent re-scan
-/// plan the trust config for a project that missed it once (opted-out first
-/// run, or a crash between the lock write and the workspace write).
-fn pnpm_lock_carries_hosted_redirect(
-    lock_text: &str,
-    overrides: &[socket_patch_core::patch::redirect::DepOverride],
-) -> bool {
-    let groups: Vec<Vec<String>> = overrides
-        .iter()
-        .filter(|o| o.ecosystem == "npm")
-        .map(|o| npm_lock_url_needles(&o.artifact_url))
-        .collect();
-    socket_patch_core::patch::redirect::presence::groups_present(&[lock_text], &groups)
-        .into_iter()
-        .any(|present| present)
-}
-
-/// The spellings of an npm artifact URL a pnpm lock may carry — raw or
-/// `\/`-escaped ([`artifact_url_spellings`](socket_patch_core::patch::redirect::artifact_url_spellings),
-/// the `artifact_url_present` pair) plus the percent-encoded form — searched
-/// in one multi-needle pass ([`groups_present`](socket_patch_core::patch::redirect::presence::groups_present)).
-fn npm_lock_url_needles(artifact_url: &str) -> Vec<String> {
-    let mut needles: Vec<String> =
-        socket_patch_core::patch::redirect::artifact_url_spellings(artifact_url).into();
-    needles.push(socket_patch_core::utils::uri::encode_uri_component(
-        artifact_url,
-    ));
-    needles
-}
-
-/// The HEAL-ON-RERUN gate: when this run spliced no root pnpm-lock.yaml
-/// (`root_spliced` false) but the on-disk root lock is v9 and already
-/// carries a granted hosted artifact URL, return its text so the trust
-/// block engages anyway. Legacy (<9) and unparseable-version locks stay
-/// `None` (fail closed: never write config for a lock era we can't read),
-/// as does a root lock this run DID splice (the splice path covers it).
-pub(crate) fn pnpm_heal_root<'a>(
-    root_spliced: bool,
-    disk_root: Option<&'a String>,
-    overrides: &[socket_patch_core::patch::redirect::DepOverride],
-) -> Option<&'a String> {
-    if root_spliced {
-        return None;
-    }
-    disk_root.filter(|text| {
-        pnpm_lock_version_major(text).is_some_and(|major| major >= 9)
-            && pnpm_lock_carries_hosted_redirect(text, overrides)
-    })
-}
-
-/// The auto-config variant: trust was (or, on `--dry-run`, would be)
-/// configured in pnpm-workspace.yaml, so installs need no flags.
-pub(crate) fn pnpm_trust_configured_detail(server: &str, created: bool, dry_run: bool) -> String {
-    let how = match (created, dry_run) {
-        (true, false) => "`trustLockfile: true` was written to a new",
-        (false, false) => "`trustLockfile: true` was merged into the existing",
-        (true, true) => "`trustLockfile: true` would be written to a new",
-        (false, true) => "`trustLockfile: true` would be merged into the existing",
-    };
-    format!(
-        "{}, so {how} {PNPM_WORKSPACE_REL} — commit it alongside the lock; \
-         installs need no extra flags. {PNPM_TRUST_TRADEOFF_AND_CAUTION}",
-        pnpm_trust_policy_preamble(server),
-    )
-}
-
-// The pnpm lock-version sniffs live with the format's model.
-pub(crate) use socket_patch_core::formats::pnpm::{
-    lock_version_major as pnpm_lock_version_major,
-    may_need_store_flag as pnpm_lock_may_need_store_flag,
-};
-
-/// The planned pnpm-workspace.yaml `trustLockfile: true` edit.
-pub(crate) enum TrustPlan {
-    /// No workspace file: create it (root-only `packages` scaffold — pnpm 9
-    /// refuses a workspace file with no `packages` field — plus the trust
-    /// key; the same scaffold shape the vendor backend creates).
-    Create(String),
-    /// Workspace file exists without a `trustLockfile:` key: append exactly
-    /// one line after the last non-empty line, every other byte preserved.
-    Append(String),
-    /// Already `trustLockfile: true` — nothing to write.
-    AlreadyTrue,
-    /// The user explicitly set `trustLockfile: <value>` (non-true). Their
-    /// call is respected — flipping an explicit security setting behind the
-    /// user's back is worse than a failing install with a clear warning.
-    UserSet(String),
-}
-
-/// Decide how to ensure `trustLockfile: true` in pnpm-workspace.yaml.
-/// Line splices only (never a YAML library), mirroring the vendor backend's
-/// workspace surgery: untouched lines stay byte-identical, so a revert can
-/// remove exactly what was added.
-pub(crate) fn plan_workspace_trust(existing: Option<&str>) -> TrustPlan {
-    let Some(text) = existing else {
-        return TrustPlan::Create("packages:\n  - '.'\ntrustLockfile: true\n".to_string());
-    };
-    // Top-level key only: an indented `trustLockfile:` under some other
-    // mapping is not the setting pnpm reads.
-    for line in text.split('\n') {
-        if let Some(rest) = line.strip_prefix("trustLockfile:") {
-            let value = rest.trim().trim_matches(|c| c == '\'' || c == '"');
-            if value == "true" {
-                return TrustPlan::AlreadyTrue;
-            }
-            return TrustPlan::UserSet(value.to_string());
-        }
-    }
-    let mut lines: Vec<String> = text.split('\n').map(str::to_string).collect();
-    // After the last non-empty line (no blank separator): a revert removes
-    // exactly one line and the file's trailing bytes stay put.
-    let anchor = lines
-        .iter()
-        .rposition(|l| !l.trim().is_empty())
-        .map(|i| i + 1)
-        .unwrap_or(lines.len());
-    lines.insert(anchor, "trustLockfile: true".to_string());
-    TrustPlan::Append(lines.join("\n"))
-}
-
-/// The root npm locks the hosted rewriter edits (`rewrite_npm_lock` rewrites
-/// every one present — npm 12 installs from package-lock.json beside a
-/// committed shrinkwrap).
-pub(crate) const NPM_LOCKS: [&str; 2] = ["npm-shrinkwrap.json", "package-lock.json"];
-
-/// The honest-tradeoff + opt-out tail shared by every `allow-remote`
-/// warning variant. The tradeoff sentence is a security disclosure, not
-/// prose garnish: `allow-remote=all` lifts npm 12's remote-tarball refusal
-/// for the WHOLE dependency tree, so it must be stated wherever the setting
-/// is written or recommended (the pnpm `trustLockfile` precedent).
-const NPM_ALLOW_REMOTE_TRADEOFF: &str =
-    "Note: allow-remote=all lets npm install ANY url-resolved (remote tarball) \
-     dependency, not just the patched ones Socket serves — the per-entry sha512 \
-     integrity pins are still enforced. `allow-remote=root` only admits direct \
-     dependencies. npm <=11 installs work unchanged (npm 11 already defaults to \
-     `all`; npm <=10 has no such setting)";
-
-/// The default human form of a `redirect_npm_allow_remote` warning: one
-/// line saying whether the project `.npmrc` now carries `allow-remote=all`
-/// or the user must set it. `detail` is one of the `npm_allow_remote_*`
-/// texts below; `--verbose` and `--json` show it in full.
-pub(crate) fn npm_allow_remote_one_line(detail: &str) -> String {
-    const MORE: &str = "(details: --verbose)";
-    if detail.contains("`allow-remote=all` was written to a new")
-        || detail.contains("`allow-remote=all` was appended to the existing")
-    {
-        format!(
-            "Note: set `allow-remote=all` in .npmrc so npm >=12 installs the hosted \
-             patches; commit it with the lockfile {MORE}."
-        )
-    } else if detail.contains("`allow-remote=all` would be") {
-        format!(
-            "Note: would set `allow-remote=all` in .npmrc so npm >=12 installs the \
-             hosted patches {MORE}."
-        )
-    } else if detail.contains("already sets `allow-remote=all`") {
-        format!(
-            "Note: .npmrc already sets `allow-remote=all`, so npm >=12 installs the \
-             hosted patches; keep it committed {MORE}."
-        )
-    } else {
-        format!(
-            "Warning: npm >=12 refuses the hosted patches until `allow-remote=all` is \
-             set (in .npmrc, or `npm ci --allow-remote=all`); it was not set \
-             automatically {MORE}."
-        )
-    }
-}
-
-/// The policy preamble shared by every `allow-remote` warning variant: what
-/// was repointed, and how npm >= 12 fails without the setting.
-fn npm_allow_remote_preamble(hosts: &[&str]) -> String {
-    format!(
-        "the npm lockfile now resolves patched dependencies from the hosted patch server ({}); \
-         npm >=12 refuses tarballs from any host other than the configured registry by \
-         default (`allow-remote=none`, error EALLOWREMOTE)",
-        hosts.join(", ")
-    )
-}
-
-/// The auto-config variant: `allow-remote=all` was (or, on `--dry-run`,
-/// would be) written to the project `.npmrc`, so installs need no flags.
-pub(crate) fn npm_allow_remote_configured_detail(
-    hosts: &[&str],
-    created: bool,
-    dry_run: bool,
-) -> String {
-    let how = match (created, dry_run) {
-        (true, false) => "`allow-remote=all` was written to a new",
-        (false, false) => "`allow-remote=all` was appended to the existing",
-        (true, true) => "`allow-remote=all` would be written to a new",
-        (false, true) => "`allow-remote=all` would be appended to the existing",
-    };
-    format!(
-        "{}, so {how} project .npmrc — commit it alongside the lock; `npm ci` needs no \
-         extra flags. {NPM_ALLOW_REMOTE_TRADEOFF}. To keep npm's default instead, re-run \
-         with --no-npm-allow-remote-config (SOCKET_NO_NPM_ALLOW_REMOTE_CONFIG) and install \
-         with `npm ci --allow-remote=all`",
-        npm_allow_remote_preamble(hosts),
-    )
-}
-
-/// The project `.npmrc` already resolves to `allow-remote=all`.
-pub(crate) fn npm_allow_remote_already_detail(hosts: &[&str]) -> String {
-    format!(
-        "{}, and the project .npmrc already sets `allow-remote=all` — keep it committed \
-         alongside the lock; `npm ci` needs no extra flags. {NPM_ALLOW_REMOTE_TRADEOFF}",
-        npm_allow_remote_preamble(hosts),
-    )
-}
-
-/// The user explicitly set another value: respected, never flipped (the
-/// pnpm `trustLockfile: false` precedent) — the warning names the manual
-/// recoveries instead.
-pub(crate) fn npm_allow_remote_user_set_detail(hosts: &[&str], value: &str) -> String {
-    format!(
-        "{}. The project .npmrc explicitly sets `allow-remote={value}`, which was respected \
-         and left untouched — set `allow-remote=all` there yourself (or install with \
-         `npm ci --allow-remote=all`) so npm >=12 installs the patched artifacts. \
-         {NPM_ALLOW_REMOTE_TRADEOFF}",
-        npm_allow_remote_preamble(hosts),
-    )
-}
-
-/// An `npm_config_allow_remote` environment variable sets another value.
-/// npm's env layer beats every `.npmrc`, so a project write could not take
-/// effect in this environment — and an explicit setting is respected.
-pub(crate) fn npm_allow_remote_env_set_detail(hosts: &[&str], var: &str, value: &str) -> String {
-    format!(
-        "{}. The environment variable {var}={value} explicitly sets `allow-remote`, which \
-         was respected: npm's environment layer overrides every .npmrc, so a project \
-         `allow-remote=all` would not take effect here and the project .npmrc was left \
-         untouched — unset {var} (or install with `npm ci --allow-remote=all`) so npm >=12 \
-         installs the patched artifacts. {NPM_ALLOW_REMOTE_TRADEOFF}",
-        npm_allow_remote_preamble(hosts),
-    )
-}
-
-/// A lower npm config layer (user / global / builtin file) explicitly sets
-/// another value. A committed project `allow-remote=all` would silently
-/// override that machine / org policy on every checkout, so it is
-/// respected like a project value and the override is left to the user.
-pub(crate) fn npm_allow_remote_outer_set_detail(
-    hosts: &[&str],
-    layer: &str,
-    path: &std::path::Path,
-    value: &str,
-) -> String {
-    format!(
-        "{}. The {layer} npm config ({}) explicitly sets `allow-remote={value}`, which was \
-         respected: socket-patch does not commit a project .npmrc that overrides it, and \
-         the project .npmrc was left untouched — to accept the patched artifacts in this \
-         project anyway, set `allow-remote=all` in the project .npmrc yourself (it outranks \
-         the {layer} config) or install with `npm ci --allow-remote=all`. \
-         {NPM_ALLOW_REMOTE_TRADEOFF}",
-        npm_allow_remote_preamble(hosts),
-        path.display(),
-    )
-}
-
-/// The opt-out (`--no-npm-allow-remote-config`) variant: nothing written,
-/// both manual recoveries spelled out.
-pub(crate) fn npm_allow_remote_manual_detail(hosts: &[&str]) -> String {
-    format!(
-        "{}. Commit `allow-remote=all` in the project .npmrc (or install with \
-         `npm ci --allow-remote=all`) so npm >=12 installs the patched artifacts. \
-         {NPM_ALLOW_REMOTE_TRADEOFF}",
-        npm_allow_remote_preamble(hosts),
-    )
-}
-
-/// The unreadable/unsafe `.npmrc` fallback: the file exists but could not
-/// be read, or is a symlink / non-regular file the atomic writer would
-/// replace. Planning a Create here would OVERWRITE the user's registry /
-/// auth config, so the auto-config stands down and names the problem.
-pub(crate) fn npm_allow_remote_unreadable_detail(hosts: &[&str], why: &str) -> String {
-    format!(
-        "{}. The project .npmrc exists but {why}; it was left untouched. Add \
-         `allow-remote=all` to it yourself (or install with `npm ci --allow-remote=all`) \
-         so npm >=12 installs the patched artifacts. {NPM_ALLOW_REMOTE_TRADEOFF}",
-        npm_allow_remote_preamble(hosts),
-    )
-}
-
-/// The project `.npmrc` read, classified for the allow-remote auto-config:
-/// `Ok(Some(text))` — a regular file read fine; `Ok(None)` — ABSENT (the
-/// only state where planning a Create is safe); `Err(why)` — present but
-/// unreadable, a symlink (the atomic stage+rename writer would replace the
-/// link with a detached copy — and the whole-run symlink guard would refuse
-/// the redirect), or not a regular file (FIFO-safe: never opened blocking).
-fn read_npmrc_for_allow_remote(path: &std::path::Path) -> Result<Option<String>, String> {
-    match std::fs::symlink_metadata(path) {
-        Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(None),
-        Err(e) => return Err(format!("could not be inspected ({e})")),
-        Ok(meta) if meta.file_type().is_symlink() => {
-            return Err("is a symbolic link (socket-patch never writes through one)".into())
-        }
-        Ok(_) => {}
-    }
-    socket_patch_core::utils::fs::read_regular_to_string_sync(path)
-        .map(Some)
-        .map_err(|e| format!("could not be read ({e})"))
-}
-
 /// The hosted-mode JSON error envelope, for bail-outs that return before the
 /// success envelope at the bottom of [`run_redirect`] is built. When the
 /// classic scan object (`scan_result`, threaded in from `run`) is present it
@@ -537,29 +109,6 @@ fn build_redirect_json_envelope(
     result
 }
 
-/// The nested `redirect` block of every hosted `--json` envelope — the ONE
-/// spelling of its key set (`mode`, `redirected`, `rewrittenFiles`,
-/// `skipped`, `warnings`, `dryRun`), shared by the ≥1-package path here and
-/// the zero-discovery arm in `run`, so the two cannot drift by convention.
-/// `mode` is `"hosted"`: an additive key so consumers dispatch on the mode without inferring it from which
-/// sub-object is present.
-pub(crate) fn redirect_json_block(
-    redirected: usize,
-    rewritten: Vec<String>,
-    skipped: Vec<serde_json::Value>,
-    warnings: Vec<serde_json::Value>,
-    dry_run: bool,
-) -> serde_json::Value {
-    serde_json::json!({
-        "mode": "hosted",
-        "redirected": redirected,
-        "rewrittenFiles": rewritten,
-        "skipped": skipped,
-        "warnings": warnings,
-        "dryRun": dry_run,
-    })
-}
-
 /// The `redirect_prune_ignored` warning object (`--prune` is a no-op in
 /// hosted mode; see the constants' doc in `run`'s module).
 pub(super) fn prune_ignored_warning() -> serde_json::Value {
@@ -569,29 +118,16 @@ pub(super) fn prune_ignored_warning() -> serde_json::Value {
     })
 }
 
-/// The fail-closed refusal for a symlinked rewrite target (both the general
-/// SYMLINK GUARD and the takeover pre-check in [`run_redirect_selected`]):
-/// stderr line + `--json` envelope, exit 1. The writers stage next to the
-/// path and rename over it, which REPLACES a symbolic link with a detached
-/// regular copy — the link target goes stale and a revert restores bytes but
-/// never the link — so nothing may be written.
-fn refuse_symlinked_file(
+/// An engine refusal (nothing was written): `Error (<code>): <message>` on
+/// stderr plus the `--json` error envelope carrying the code, exit 1.
+fn refuse(
     common: &crate::args::GlobalArgs,
     scan_result: Option<serde_json::Value>,
-    linked: &str,
+    refusal: &socket_patch_core::hosted::engine::Refusal,
 ) -> i32 {
-    let message = format!(
-        "{linked} is a symbolic link; socket-patch rewrites files in place with an atomic \
-         rename, which would replace the link — replace the link with a regular file (or \
-         run socket-patch in the directory it points to) and re-run; nothing was written"
-    );
-    eprintln!("Error (redirect_symlinked_file_unsupported): {message}");
+    eprintln!("Error ({}): {}", refusal.code, refusal.message);
     if common.json {
-        emit_json_error_with_code(
-            scan_result,
-            Some("redirect_symlinked_file_unsupported"),
-            &message,
-        );
+        emit_json_error_with_code(scan_result, Some(&refusal.code), &refusal.message);
     }
     1
 }
@@ -1052,85 +588,25 @@ pub(super) async fn run_redirect(
     .await
 }
 
-/// How the confirmation probe in [`run_redirect_selected`] settles one
-/// candidate: a non-substring rule (a transactional rewriter's own report, a
-/// refusal) decides it outright, otherwise it is confirmed iff any of its
-/// needles occurs in a final text.
-enum ProbeStep {
-    Decided(bool),
-    Needles(Vec<String>),
-    /// [`Self::Needles`], searched in every final text but `vlt-lock.json`
-    /// (a dep withheld from the vlt rewrite).
-    NeedlesOutsideVlt(Vec<String>),
-}
-
-/// The substrings whose presence in a final text confirms `dep`'s redirect —
-/// the override's own targets: artifact URL; per-dependency registry index
-/// URL; fail-closed maven's globally-unique `-socket.<hex8>` suffixed version
-/// (never the `.pom` URL).
-///
-/// - The artifact URL in the rewriters' own spellings
-///   ([`artifact_url_spellings`](socket_patch_core::patch::redirect::artifact_url_spellings),
-///   raw or the `\/`-escaped slashes an old composer.lock spells them with),
-///   so a writer's spelling can never be one this probe misses.
-/// - The percent-encoded URL: the berry rewriter writes it into the lock's
-///   `::__archiveUrl=` binding, so the raw form is absent.
-/// - The registry index URL and the maven suffixed version, when present.
-fn candidate_presence_needles(
-    dep: &socket_patch_core::patch::redirect::DepOverride,
-) -> Vec<String> {
-    let artifact_url = dep.artifact_url.as_str();
-    let registry = dep.registry_override.as_ref();
-    let mut needles: Vec<String> =
-        socket_patch_core::patch::redirect::artifact_url_spellings(artifact_url).into();
-    needles.push(socket_patch_core::utils::uri::encode_uri_component(
-        artifact_url,
-    ));
-    if let Some(o) = registry {
-        needles.push(o.index_url.clone());
-        if let Some(sv) = o.identifiers.maven_suffixed_version.as_deref() {
-            needles.push(sv.to_string());
-        }
-    }
-    needles
-}
-
-/// The per-candidate probe [`candidate_presence_needles`] +
-/// `groups_present` replaced, kept as the equivalence oracle.
-#[cfg(test)]
-fn candidate_present_oracle(
-    final_texts: &[&String],
-    dep: &socket_patch_core::patch::redirect::DepOverride,
-) -> bool {
-    let artifact_url = dep.artifact_url.as_str();
-    let registry = dep.registry_override.as_ref();
-    let index_url = registry.map(|o| o.index_url.as_str());
-    let suffixed_version = registry.and_then(|o| o.identifiers.maven_suffixed_version.as_deref());
-    let encoded = socket_patch_core::utils::uri::encode_uri_component(artifact_url);
-    final_texts.iter().any(|text| {
-        socket_patch_core::patch::redirect::artifact_url_present(text, artifact_url)
-            || text.contains(encoded.as_str())
-            || index_url.is_some_and(|iu| text.contains(iu))
-            || suffixed_version.is_some_and(|sv| text.contains(sv))
-    })
-}
-
-/// The hosted-redirect engine over an ALREADY-SELECTED `(purl, uuid)` set:
-/// reference grants → DepOverride build → apply lock (wet runs with a grant)
-/// → ledger load → vendored→hosted takeover pre-revert (symlink-checked
-/// first) → candidate-file read → rewrite → pnpm trust config → npm `.npmrc`
-/// allow-remote config →
-/// confirmation probe → ledger merge-then-persist → file writes → gem stale
-/// probe → warnings → optional VEX. Shared VERBATIM by `scan --mode hosted`
-/// (its `--json` arm through the `run_redirect` wrapper, its human arm
-/// through [`boxed_run_redirect_selected`] in `scan/mod.rs`; both select via
-/// `discover_selected`, with no prompt) and by `get --mode hosted` (which
-/// pins the advisory-resolved uuid), so all produce identical on-disk
-/// results for the same selection. The redirect ledger is loaded HERE, under the apply
-/// lock whenever this run holds one (never handed in pre-loaded: a copy
-/// read before the lock could merge over a concurrent writer's edits); a
-/// dry run or a zero-grant run reads it strictly but writes nothing,
-/// quarantine included.
+/// The hosted-redirect flow over an ALREADY-SELECTED `(purl, uuid)` set,
+/// on disk. The plan → rewrite → edits core is the shared hosted engine
+/// ([`socket_patch_core::hosted::engine`], over a
+/// [`ProjectView::Disk`](socket_patch_core::vendor::lock_inventory::ProjectView));
+/// what stays here is what needs the host: reference grants and the other
+/// network fetches, the apply lock (wet runs with a grant), the redirect
+/// ledger load, the vendored→hosted takeover pre-revert (symlink-checked
+/// first), the `pipenv --version` probe, the symlink guard, the ledger
+/// merge-then-persist and the file writes, the gem / Python / vlt
+/// stale-install probes, and the optional VEX. Shared VERBATIM by `scan
+/// --mode hosted` (its `--json` arm through the `run_redirect` wrapper, its
+/// human arm through [`boxed_run_redirect_selected`] in `scan/mod.rs`; both
+/// select via `discover_selected`, with no prompt) and by `get --mode
+/// hosted` (which pins the advisory-resolved uuid), so all produce
+/// identical on-disk results for the same selection. The redirect ledger
+/// is loaded HERE, under the apply lock whenever this run holds one (never
+/// handed in pre-loaded: a copy read before the lock could merge over a
+/// concurrent writer's edits); a dry run or a zero-grant run reads it
+/// strictly but writes nothing, quarantine included.
 ///
 /// `scan_result` must be `Some` exactly when `common.json` is set (the
 /// human/JSON split keys on `common.json`; a `--json` caller passing `None`
@@ -1145,24 +621,14 @@ pub(crate) async fn run_redirect_selected(
     mut scan_result: Option<serde_json::Value>,
     npm_prior: Option<&crate::ecosystem_dispatch::NpmCrawlSnapshot>,
 ) -> i32 {
-    use socket_patch_core::manifest::schema::PatchRecord;
-    use socket_patch_core::patch::redirect::{
-        rewrite_registry_redirect_withholding_vlt,
+    use socket_patch_core::hosted::engine::{
+        self, Candidate, CandidateFiles, RewriteOptions, SkippedPatch,
     };
+    use socket_patch_core::manifest::schema::PatchRecord;
+    use socket_patch_core::vendor::lock_inventory::ProjectView;
 
-    let mut skipped: Vec<serde_json::Value> = Vec::new();
-    /// One granted reference: the purl it was granted for plus the rewriter
-    /// override built from it. The purl is what the takeover, the skip
-    /// records and the confirmation probe key on; everything the probe
-    /// needs AFTER the rewrite to decide whether the dep was actually
-    /// redirected (artifact URL, registry index URL, fail-closed maven's
-    /// suffixed version) already rides the override. The single vector is
-    /// filtered in place by every withhold/refusal step, and the rewriters'
-    /// `overrides` slice is materialized from it once, after the last filter.
-    struct Candidate {
-        purl: String,
-        dep: DepOverride,
-    }
+    let view = ProjectView::Disk(&common.cwd);
+    let mut skipped: Vec<SkippedPatch> = Vec::new();
     let mut candidates: Vec<Candidate> = Vec::new();
     // The network phases below (reference grants, wheel metadata, patch
     // records) would otherwise be silent gaps on a terminal. Inert under
@@ -1191,128 +657,18 @@ pub(crate) async fn run_redirect_selected(
                 return 1;
             }
         };
-        for (sel_purl, sel_uuid) in selected {
-            let Some(reference) = references.get(sel_uuid) else {
-                skipped.push(serde_json::json!({ "purl": sel_purl, "uuid": sel_uuid, "reason": "not_found" }));
-                continue;
-            };
-            if reference.status != "granted" && reference.status != "reused" {
-                skipped.push(serde_json::json!({ "purl": sel_purl, "uuid": sel_uuid, "reason": reference.status }));
-                continue;
-            }
-            let purl = reference.purl.as_deref().unwrap_or(sel_purl);
-            let Some((ecosystem, name, version)) = purl_parts(purl) else {
-                skipped.push(
-                    serde_json::json!({ "purl": purl, "uuid": sel_uuid, "reason": "bad_purl" }),
-                );
-                continue;
-            };
-            let Some(url) = reference.url.clone() else {
-                skipped.push(
-                    serde_json::json!({ "purl": purl, "uuid": sel_uuid, "reason": "no_url" }),
-                );
-                continue;
-            };
-            let mut integrity = reference
-                .artifacts
-                .iter()
-                .flatten()
-                .find(|a| a.kind == "tarball")
-                .map(|a| a.integrity.clone())
-                .unwrap_or_default();
-            // The yarn-berry cache zip carries the `yarnBerry10c0` checksum the
-            // berry rewriter pins (berry verifies the zip, not the tarball).
-            // Merge it in and carry the zip URL (None when not stored yet).
-            let berry_zip = reference
-                .artifacts
-                .iter()
-                .flatten()
-                .find(|a| a.kind == "yarn-berry-zip");
-            if let Some(c) = berry_zip.and_then(|a| a.integrity.yarn_berry10c0.clone()) {
-                integrity.yarn_berry10c0 = Some(c);
-            }
-            // goproxy: the hosted-Go hash pair rides the override's
-            // identifiers (the tarball's dirhashH1 is the original-path
-            // flavor, kept for vendor-mode verification); the golang
-            // rewriter reads the normalized integrity, so merge — the
-            // gopatch-flavor zip h1 REPLACES dirhashH1 here. Only both
-            // together: a half-merged pair would trip the rewriter's
-            // fail-closed integrity check by design.
-            if let Some(ov) = reference
-                .registry_override
-                .as_ref()
-                .filter(|o| o.kind == "goproxy")
-            {
-                if let (Some(zip_h1), Some(gomod_h1)) = (
-                    ov.identifiers.go_zip_dirhash_h1.clone(),
-                    ov.identifiers.go_mod_h1.clone(),
-                ) {
-                    integrity.dirhash_h1 = Some(zip_h1);
-                    integrity.go_mod_h1 = Some(gomod_h1);
-                }
-            }
-            // The grant token is never a top-level reference field — it only
-            // rides the URLs the reference endpoint hands back, as the path
-            // level before the patch uuid. Recover it so the rewriters'
-            // rotation-idempotency guards (which wildcard the token path
-            // level of a previously-written URL) don't depend on it being
-            // derivable from the URL alone (an empty token makes the gem
-            // guard nest a new source block on every re-scan).
-            let token = reference
-                .registry_override
-                .as_ref()
-                .and_then(|o| {
-                    socket_patch_core::patch::redirect::grant_token_path_segment(
-                        &o.index_url,
-                        sel_uuid,
-                    )
-                })
-                .or_else(|| {
-                    socket_patch_core::patch::redirect::grant_token_path_segment(&url, sel_uuid)
-                })
-                .unwrap_or_default();
-            candidates.push(Candidate {
-                purl: purl.to_string(),
-                dep: DepOverride {
-                    ecosystem,
-                    name,
-                    namespace: None,
-                    version,
-                    token,
-                    patch_uuid: sel_uuid.clone(),
-                    artifact_url: url,
-                    berry_zip_url: berry_zip.and_then(|a| a.url.clone()),
-                    registry_override: reference.registry_override.clone(),
-                    integrity,
-                },
-            });
-        }
+        candidates = engine::build_candidates(selected, &references, &mut skipped);
     }
 
-    // Text retains Bun's precedence when both lock spellings are present;
-    // the takeover reverts rewrite locks in place (never create or remove
-    // one), so the probe holds for the binary-lock decision below too.
-    let bun_lock_present = common.cwd.join("bun.lock").exists();
-    // Check binary lock symlinks before a mode takeover changes any wiring.
-    if candidates.iter().any(|c| c.dep.ecosystem == "npm")
-        && !bun_lock_present
-        && socket_patch_core::utils::fs::first_symlink(&common.cwd, ["bun.lockb"])
-            .await
-            .is_some()
-    {
-        // Atomic replacement cannot preserve a link; previews refuse too.
-        let message = "bun.lockb is a symbolic link; replace it with a regular file (or run \
-                       socket-patch in the directory it points to) before patching; nothing \
-                       was written";
-        eprintln!("Error (redirect_symlinked_file_unsupported): {message}");
-        if common.json {
-            emit_json_error_with_code(
-                scan_result.take(),
-                Some("redirect_symlinked_file_unsupported"),
-                message,
-            );
-        }
-        return 1;
+    // Check binary lock symlinks before a mode takeover changes any wiring
+    // (the takeover reverts rewrite locks in place, never create or remove
+    // one, so the lock-presence probe holds for the rewrite below too).
+    if engine::bun_lockb_symlinked(&view, &candidates) {
+        return refuse(
+            common,
+            scan_result.take(),
+            &engine::bun_lockb_symlink_refusal(),
+        );
     }
 
     // vlt artifact preflight: before any takeover or rewrite (dry runs
@@ -1327,18 +683,11 @@ pub(crate) async fn run_redirect_selected(
             .collect();
         vlt::artifact_preflight(common, api_client, &deps).await
     };
-    if !vlt_preflight.withheld_everywhere.is_empty() {
-        for (uuid, purl) in &vlt_preflight.withheld_everywhere {
-            skipped.push(serde_json::json!({
-                "purl": purl, "uuid": uuid, "reason": vlt::WITHHELD_REASON,
-            }));
-        }
-        candidates.retain(|c| {
-            !vlt_preflight
-                .withheld_everywhere
-                .contains_key(&c.dep.patch_uuid)
-        });
-    }
+    engine::withhold_everywhere(
+        &mut candidates,
+        &vlt_preflight.withheld_everywhere,
+        &mut skipped,
+    );
 
     // The apply lock (see `acquire_hosted_lock`), taken only by a WET run
     // that holds at least one granted reference — the only runs that can
@@ -1371,500 +720,28 @@ pub(crate) async fn run_redirect_selected(
     // ownership known" for both consumers.
     let mut vendor_state = socket_patch_core::vendor::load_state(&common.cwd).await;
 
-    // Cross-mode takeover: a purl this run is about to redirect may still be
-    // VENDORED — for cargo a committed `[patch.crates-io]` path entry, a
-    // detached Cargo.lock entry, a committed copy, and a vendored ledger
-    // entry; for the npm family a `file:./.socket/vendor/…` lock resolution
-    // (plus a berry `resolutions` pin) and its committed tarball; for golang
-    // the vendor-owned go.mod `replace`, its committed module copy, and its
-    // ledger entry. The hosted rewriters know nothing about that wiring
-    // (cargo would refuse `--locked` builds over the unused `[patch]` entry;
-    // yarn classic would hijack a resolution the vendored ledger still
-    // claims; yarn berry refuses `file:` outright). A takeover must leave the
-    // project FULLY hosted: revert each such purl's vendored state first (the
-    // per-purl machinery `vendor --revert` runs), and only then redirect —
-    // which also hands the redirect the PRISTINE registry lock fragment to
-    // record as its own revert original. A purl
-    // whose vendored state cannot be cleanly reverted (revert failure, or
-    // vendored wiring with a missing/corrupt ledger) is REFUSED — skipped
-    // with an actionable error — never half-migrated.
-    let takeover_capable = |p: &str| {
-        p.starts_with("pkg:cargo/") || p.starts_with("pkg:npm/") || p.starts_with("pkg:golang/")
+    // Cross-mode takeover of still-vendored purls (see `vendored_takeover`).
+    let Takeover {
+        pre_warnings: takeover_pre_warnings,
+        dry_run: dry_run_takeover,
+        migrated: takeover_migrated,
+        files: takeover_files,
+        previews: dry_run_takeover_urls,
+    } = match vendored_takeover(common, &mut candidates, &mut vendor_state, &mut skipped).await {
+        Ok(t) => t,
+        Err(refusal) => return refuse(common, scan_result.take(), &refusal),
     };
-    let mut takeover_pre_warnings: Vec<serde_json::Value> = Vec::new();
-    // Dry-run takeover previews: `(purl, uuid)` pairs whose vendored state
-    // the wet run would revert and then redirect. Withheld from the
-    // rewriters (their lock fragments still carry the vendored wiring the
-    // wet run reverts FIRST) and counted as redirected below, so the
-    // preview's envelope matches the wet run's outcome.
-    let mut dry_run_takeover: Vec<(String, String)> = Vec::new();
-    // Human output: the purls migrated (or, on --dry-run, to be migrated)
-    // from vendored to hosted, and the files their revert touches (or would
-    // touch). Both modes count `rewritten ∪ takeover_files`, so the
-    // preview's file count matches the wet run's even for wiring files the
-    // hosted rewriter does not also rewrite (a Gemfile line, a uv source).
-    let mut takeover_migrated: Vec<String> = Vec::new();
-    let mut takeover_files: std::collections::BTreeSet<String> = std::collections::BTreeSet::new();
-    // Which root locks each dry-run takeover purl is vendored into (from
-    // its vendor ledger wiring): the wet run reverts that wiring and then
-    // splices the hosted URL there, so the install-policy auto-configs
-    // (npm `.npmrc` allow-remote, pnpm `trustLockfile`) must be PREVIEWED
-    // for those locks even though the rewriters never see these purls.
-    let mut dry_run_takeover_locks: std::collections::HashMap<String, Vec<String>> =
-        std::collections::HashMap::new();
-    // `(artifact_url, wired root locks)` of the withheld dry-run takeover
-    // candidates — filled when they leave the rewrite set below.
-    let mut dry_run_takeover_urls: Vec<(String, Vec<String>)> = Vec::new();
-    if !candidates.iter().any(|c| takeover_capable(&c.purl)) {
-        // No takeover-capable candidates — nothing to reconcile.
-    } else {
-        use socket_patch_core::utils::purl::{canonical_purl as canon, strip_purl_qualifiers};
-        // Each takeover-capable candidate with its vendored ledger entry, if
-        // any (cloned out so the loop can mutate the state).
-        let takeover: Vec<(&Candidate, Option<socket_patch_core::vendor::VendorEntry>)> =
-            candidates
-                .iter()
-                .filter(|c| takeover_capable(&c.purl))
-                .map(|c| {
-                    let entry = vendor_state
-                        .as_ref()
-                        .ok()
-                        .and_then(|s| {
-                            socket_patch_core::vendor::lookup_entry(
-                                &s.entries,
-                                strip_purl_qualifiers(&c.purl),
-                            )
-                        })
-                        .cloned();
-                    (c, entry)
-                })
-                .collect();
-        // Compatibility must be known before the takeover removes a live
-        // patch. In particular, a v0 workspace can keep an existing local
-        // tuple even though hosted mode cannot replace it with a URL. Only
-        // an npm purl WITH a vendored entry can be taken over, so the bun
-        // locks are read here only when one exists — the candidate-file
-        // read below covers every other run.
-        let bun_takeover_refusal = if takeover
-            .iter()
-            .any(|(c, entry)| entry.is_some() && c.purl.starts_with("pkg:npm/"))
-        {
-            match socket_patch_core::utils::fs::read_regular_to_string(&common.cwd.join("bun.lock"))
-                .await
-            {
-                Ok(content) => {
-                    socket_patch_core::patch::redirect::preflight_bun_hosted(&content).err()
-                }
-                Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
-                    match socket_patch_core::utils::fs::read_regular_to_bytes_sync(
-                        &common.cwd.join("bun.lockb"),
-                    ) {
-                        Ok(bytes) => {
-                            socket_patch_core::patch::redirect::preflight_bun_binary(&bytes).err()
-                        }
-                        Err(e) if e.kind() == std::io::ErrorKind::NotFound => None,
-                        Err(e) => Some(socket_patch_core::patch::redirect::RewriteWarning {
-                            code: "redirect_bun_lockb_invalid".into(),
-                            detail: format!("cannot read bun.lockb: {e}"),
-                        }),
-                    }
-                }
-                Err(e) => Some(socket_patch_core::patch::redirect::RewriteWarning {
-                    code: "redirect_bun_lock_unsupported".into(),
-                    detail: format!("cannot read bun.lock before mode takeover: {e}"),
-                }),
-            }
-        } else {
-            None
-        };
-        // Yarn berry twin of the bun gate: the berry rewriter's project-level
-        // refusals (mixed line endings, cacheKey, `.yarnrc.yml`
-        // compressionLevel) must be known before the takeover reverts a
-        // vendored berry purl, or the revert strips the live vendored patch
-        // and the rewriter then refuses the lock. Only entries the
-        // vendor ledger wired through the yarn-berry backend are gated (the
-        // lock is read only when one exists); an unreadable lock is left to
-        // the revert's own diagnostics.
-        let berry_entry = |entry: &socket_patch_core::vendor::VendorEntry| {
-            entry.ecosystem == "npm" && entry.flavor.as_deref() == Some("yarn-berry")
-        };
-        let berry_takeover_refusal = if takeover
-            .iter()
-            .any(|(_, entry)| entry.as_ref().is_some_and(berry_entry))
-        {
-            match socket_patch_core::utils::fs::read_regular_to_string(
-                &common.cwd.join("yarn.lock"),
-            )
-            .await
-            {
-                Ok(lock) => {
-                    let yarnrc = socket_patch_core::utils::fs::read_regular_to_string(
-                        &common.cwd.join(".yarnrc.yml"),
-                    )
-                    .await
-                    .ok();
-                    socket_patch_core::patch::redirect::preflight_yarn_berry_hosted(
-                        &lock,
-                        yarnrc.as_deref(),
-                    )
-                    .err()
-                }
-                Err(_) => None,
-            }
-        } else {
-            None
-        };
-        // vlt twin: the hosted rewriter's lock-level refusal must be known
-        // before a vendored vlt entry is reverted, or the revert strips the
-        // live vendored patch and the rewrite then refuses the lock.
-        let vlt_entry = |entry: &socket_patch_core::vendor::VendorEntry| {
-            entry.ecosystem == "npm" && entry.flavor.as_deref() == Some("vlt")
-        };
-        let vlt_takeover_refusal = if takeover
-            .iter()
-            .any(|(_, entry)| entry.as_ref().is_some_and(vlt_entry))
-        {
-            match socket_patch_core::utils::fs::read_regular_to_string(
-                &common
-                    .cwd
-                    .join(socket_patch_core::constants::npm_family::VLT_LOCK),
-            )
-            .await
-            {
-                Ok(lock) => {
-                    let files = std::collections::BTreeMap::from([(
-                        socket_patch_core::constants::npm_family::VLT_LOCK.to_string(),
-                        lock,
-                    )]);
-                    socket_patch_core::patch::redirect::vlt::preflight_vlt_hosted(&files).err()
-                }
-                Err(_) => None,
-            }
-        } else {
-            None
-        };
-        // The takeover refusal (if any) for one candidate: bun gates every
-        // npm purl, berry and vlt only their own vendored entries. A refused
-        // purl is never dispatched (see the loop), so its wiring is not a
-        // write target here.
-        let takeover_refusal =
-            |c: &Candidate,
-             entry: Option<&socket_patch_core::vendor::VendorEntry>|
-             -> Option<&socket_patch_core::patch::redirect::RewriteWarning> {
-                if !c.purl.starts_with("pkg:npm/") {
-                    return None;
-                }
-                bun_takeover_refusal
-                    .as_ref()
-                    .or_else(|| {
-                        berry_takeover_refusal
-                            .as_ref()
-                            .filter(|_| entry.is_some_and(berry_entry))
-                    })
-                    .or_else(|| {
-                        vlt_takeover_refusal
-                            .as_ref()
-                            .filter(|_| entry.is_some_and(vlt_entry))
-                    })
-            };
-        // SYMLINK PRE-CHECK for the takeover reverts — the same rule as the
-        // SYMLINK GUARD below, applied to each ledger entry's recorded wiring
-        // (the revert backends also stage and rename over the file). Checked
-        // BEFORE any revert dispatches (and under --dry-run too) so "nothing
-        // was written" stays true.
-        let revert_targets = takeover
-            .iter()
-            .filter_map(|(c, entry)| {
-                entry
-                    .as_ref()
-                    .filter(|e| takeover_refusal(c, Some(e)).is_none())
-            })
-            .flat_map(|entry| entry.wiring.iter().map(|w| w.file.as_str()));
-        if let Some(linked) =
-            socket_patch_core::utils::fs::first_symlink(&common.cwd, revert_targets).await
-        {
-            return refuse_symlinked_file(common, scan_result.take(), linked);
-        }
-        let mut refused: Vec<String> = Vec::new();
-        for (candidate, ledger_entry) in &takeover {
-            let purl = &candidate.purl;
-            let uuid = &candidate.dep.patch_uuid;
-            if let Some(entry) = ledger_entry {
-                if let Some(warning) = takeover_refusal(candidate, Some(entry)) {
-                    refused.push(purl.clone());
-                    if !takeover_pre_warnings
-                        .iter()
-                        .any(|w| w["code"] == warning.code)
-                    {
-                        takeover_pre_warnings.push(serde_json::json!(warning));
-                    }
-                    continue;
-                }
-                if common.dry_run {
-                    // Preview through the same per-purl revert machinery the
-                    // wet run dispatches (write-free under dry_run): a
-                    // vendored state the wet run would refuse to revert is
-                    // refused here too, and one it would revert is announced
-                    // as a takeover — never handed to the rewriters, which
-                    // would refuse the still-vendored wiring.
-                    let outcome =
-                        crate::commands::vendor::dispatch_revert_one(entry, &common.cwd, true)
-                            .await;
-                    if !outcome.success {
-                        refused.push(purl.clone());
-                        takeover_pre_warnings.push(serde_json::json!({
-                            "code": "redirect_vendored_revert_failed",
-                            "detail": format!(
-                                "{purl} is vendored and its vendored state could not be \
-                                 reverted ({}); NOT switched to hosted — run `socket-patch vendor \
-                                 --revert` to clean up, then re-run `scan --mode hosted`",
-                                outcome.error.as_deref().unwrap_or("unknown error")
-                            ),
-                        }));
-                        continue;
-                    }
-                    takeover_pre_warnings.push(serde_json::json!({
-                        "code": "redirect_would_revert_vendored",
-                        "detail": format!(
-                            "{purl} is currently vendored; the hosted wiring will \
-                             revert its vendored wiring, ledger entry, and committed \
-                             artifact first, then switch to hosted (mode takeover)"
-                        ),
-                    }));
-                    dry_run_takeover.push((purl.clone(), uuid.clone()));
-                    takeover_migrated.push(purl.clone());
-                    takeover_files.extend(entry.wiring.iter().map(|w| w.file.clone()));
-                    dry_run_takeover_locks.insert(
-                        purl.clone(),
-                        entry.wiring.iter().map(|w| w.file.clone()).collect(),
-                    );
-                    continue;
-                }
-                let outcome =
-                    crate::commands::vendor::dispatch_revert_one(entry, &common.cwd, false).await;
-                if !outcome.success {
-                    refused.push(purl.clone());
-                    takeover_pre_warnings.push(serde_json::json!({
-                        "code": "redirect_vendored_revert_failed",
-                        "detail": format!(
-                            "{purl} is vendored and its vendored state could not be \
-                             reverted ({}); NOT switched to hosted — run `socket-patch vendor \
-                             --revert` to clean up, then re-run `scan --mode hosted`",
-                            outcome.error.as_deref().unwrap_or("unknown error")
-                        ),
-                    }));
-                    continue;
-                }
-                // Drop the reverted entry from the in-memory ledger and
-                // persist per purl so a crash mid-run leaves a ledger
-                // matching the on-disk wiring. The entry stays dropped even
-                // when the save fails: its wiring and artifact ARE gone, so
-                // a later successful save in this loop writes the truth.
-                let state = vendor_state
-                    .as_mut()
-                    .expect("a vendored ledger entry was looked up in this state, so it loaded");
-                state
-                    .entries
-                    .retain(|k, e| canon(k) != canon(purl) && canon(&e.base_purl) != canon(purl));
-                if let Err(e) = socket_patch_core::vendor::save_state(&common.cwd, state).await {
-                    // The wiring is reverted but the ledger still claims it;
-                    // redirecting now would leave a ledger asserting wiring
-                    // that is gone. Fail closed for this purl.
-                    refused.push(purl.clone());
-                    takeover_pre_warnings.push(serde_json::json!({
-                        "code": "redirect_vendored_revert_failed",
-                        "detail": format!(
-                            "{purl}: vendored wiring reverted but the vendored ledger \
-                             could not be updated ({e}); NOT switched to hosted — fix \
-                             .socket/vendor/state.json and re-run"
-                        ),
-                    }));
-                    continue;
-                }
-                takeover_pre_warnings.push(serde_json::json!({
-                    "code": "redirect_takeover_reverted_vendored",
-                    "detail": format!(
-                        "{purl} was vendored; reverted its vendored wiring, ledger \
-                         entry, and committed artifact before switching to hosted (mode \
-                         takeover: the project is now fully hosted for this package)"
-                    ),
-                }));
-                takeover_pre_warnings.extend(
-                    outcome
-                        .warnings
-                        .iter()
-                        .filter(|w| {
-                            w.code == socket_patch_core::vendor::vlt_lock::REINSTALL_REQUIRED
-                        })
-                        .map(|w| serde_json::json!({ "code": w.code, "detail": w.detail })),
-                );
-                takeover_migrated.push(purl.clone());
-                takeover_files.extend(entry.wiring.iter().map(|w| w.file.clone()));
-            } else {
-                // No usable ledger entry. If socket-owned vendored wiring for
-                // this crate is nevertheless present, the ledger is missing or
-                // corrupt — the originals needed to revert are unrecoverable,
-                // so redirecting on top would wedge the project. Refuse.
-                // (Cargo-only probe: Socket-owned `[patch.crates-io]` entries
-                // for exactly this name@version in the root Cargo.toml or a
-                // legacy `.cargo/config*` — another vendored version of the
-                // crate has its own ledger entry. An npm purl in this state
-                // falls through to the rewriters' own per-flavor
-                // diagnostics.)
-                let coords = purl
-                    .starts_with("pkg:cargo/")
-                    .then(|| purl_parts(purl).map(|(_, name, version)| (name, version)))
-                    .flatten();
-                let wired = match &coords {
-                    Some((n, v)) => {
-                        socket_patch_core::vendor::cargo::socket_wiring_present(&common.cwd, n, v)
-                            .await
-                    }
-                    None => false,
-                };
-                if wired {
-                    refused.push(purl.clone());
-                    takeover_pre_warnings.push(serde_json::json!({
-                        "code": "redirect_vendored_revert_failed",
-                        "detail": format!(
-                            "{purl} has socket-owned vendored `[patch.crates-io]` \
-                             wiring but no usable vendored ledger entry \
-                             (.socket/vendor/state.json is missing or corrupt); NOT \
-                             redirected — restore the ledger or remove the vendored \
-                             wiring manually, then re-run"
-                        ),
-                    }));
-                }
-            }
-        }
-        for purl in &refused {
-            if let Some((c, entry)) = takeover.iter().find(|(c, _)| &c.purl == purl) {
-                let reason = takeover_refusal(c, entry.as_ref())
-                    .map_or("vendored_revert_failed", |w| w.code.as_str());
-                skipped.push(serde_json::json!({
-                    "purl": purl, "uuid": c.dep.patch_uuid, "reason": reason,
-                }));
-            }
-        }
-        // Purls leaving the rewrite set: refused takeovers, plus the dry-run
-        // takeover previews (still vendored on disk — the wet run reverts
-        // them before the rewriters ever see their files).
-        let withheld: std::collections::HashSet<&str> = refused
-            .iter()
-            .map(String::as_str)
-            .chain(dry_run_takeover.iter().map(|(p, _)| p.as_str()))
-            .collect();
-        if !withheld.is_empty() {
-            // Keep the dry-run takeover candidates' URLs (and the root locks
-            // their purl is vendored into) for the install-policy previews.
-            for (purl, _) in &dry_run_takeover {
-                let locks = dry_run_takeover_locks
-                    .get(purl)
-                    .cloned()
-                    .unwrap_or_default();
-                for c in candidates.iter().filter(|c| &c.purl == purl) {
-                    dry_run_takeover_urls.push((c.dep.artifact_url.clone(), locks.clone()));
-                }
-            }
-            candidates.retain(|c| !withheld.contains(c.purl.as_str()));
-        }
-    }
 
-    // The binary lock is read and rewritten directly.
-    let binary_bun = !bun_lock_present && common.cwd.join("bun.lockb").exists();
-    // Read the project's candidate files, run the rewriters. Every read goes
-    // through the FIFO-safe reader (non-blocking open + fstat regular-file
-    // check), so a FIFO under a candidate name is skipped like a missing file
-    // instead of wedging the run in open(2).
-    //
-    // Skipped when no candidate survived and no dry-run takeover preview is
-    // pending (the rewriters do nothing without a dep); everything after the
-    // rewrite still runs. A dry-run takeover preview still needs the root
-    // locks for the install-policy previews below.
-    use socket_patch_core::utils::fs::read_regular_to_string;
-    let mut files: std::collections::BTreeMap<String, String> = std::collections::BTreeMap::new();
-    // Rush monorepos have no root package.json/lock pair: the single pnpm
-    // source-of-truth lock lives at common/config/rush/pnpm-lock.yaml, and
-    // (when subspaces are enabled) one lock per subspace under
-    // common/config/subspaces/<name>/. Add them under their repo-relative
-    // keys — the pnpm rewriter is basename-generalized, so nested keys are
-    // rewritten in place, and the write-back below is already path-generic.
-    let mut rush_warnings: Vec<serde_json::Value> = Vec::new();
-    let mut rush_lock_keys: Vec<String> = Vec::new();
-    if !candidates.is_empty() || !dry_run_takeover_urls.is_empty() {
-        for name in REDIRECT_CANDIDATE_FILES.iter() {
-            if *name == "bun.lockb" {
-                continue;
-            }
-            if *name == socket_patch_core::constants::npm_family::VLT_HIDDEN_LOCK_REL {
-                if vlt::install_state_present(&common.cwd) {
-                    files.insert((*name).to_string(), String::new());
-                }
-                continue;
-            }
-            if let Ok(content) = read_regular_to_string(&common.cwd.join(name)).await {
-                files.insert((*name).to_string(), content);
-            }
-        }
-
-        // Cargo workspace members (and in-root path dependencies) declare
-        // dependencies of their own: a member's direct `cfg-if = "1"` must
-        // be pinned alongside the root's, or the redirected lock entry is
-        // unsatisfiable. Keyed `<dir>/Cargo.toml` for the cargo rewriter.
-        if files.contains_key("Cargo.toml") && candidates.iter().any(|c| c.dep.ecosystem == "cargo")
-        {
-            for rel in socket_patch_core::utils::cargo_workspace::member_manifests(&common.cwd) {
-                if let Ok(content) = read_regular_to_string(&common.cwd.join(&rel)).await {
-                    files.insert(rel, content);
-                }
-            }
-        }
-
-        if let Ok(paths) = socket_patch_core::utils::python_lock::python_lock_paths(&common.cwd) {
-            for path in paths {
-                if let Some(script_path) =
-                    socket_patch_core::utils::python_lock::script_of_lock(&path).map(str::to_string)
-                {
-                    if let Ok(content) =
-                        read_regular_to_string(&common.cwd.join(&script_path)).await
-                    {
-                        files.insert(script_path, content);
-                    }
-                }
-                if let Ok(content) = read_regular_to_string(&common.cwd.join(&path)).await {
-                    files.insert(path, content);
-                }
-            }
-        }
-
-        if common.cwd.join("rush.json").is_file() {
-            let common_lock = socket_patch_core::constants::npm_family::RUSH_COMMON_LOCK_REL;
-            if let Ok(content) = read_regular_to_string(&common.cwd.join(common_lock)).await {
-                files.insert(common_lock.to_string(), content);
-                rush_lock_keys.push(common_lock.to_string());
-            }
-            let subspaces_dir = common.cwd.join("common/config/subspaces");
-            if let Ok(read_dir) = std::fs::read_dir(&subspaces_dir) {
-                // read_dir order is unspecified — sort for deterministic output.
-                let mut subspace_dirs: Vec<std::path::PathBuf> = read_dir
-                    .filter_map(|e| e.ok())
-                    .filter(|e| e.file_type().map(|t| t.is_dir()).unwrap_or(false))
-                    .map(|e| e.path())
-                    .collect();
-                subspace_dirs.sort();
-                for dir in subspace_dirs {
-                    let Some(name) = dir.file_name().and_then(|n| n.to_str()) else {
-                        continue;
-                    };
-                    let key = format!("common/config/subspaces/{name}/pnpm-lock.yaml");
-                    if let Ok(content) = read_regular_to_string(&dir.join("pnpm-lock.yaml")).await {
-                        files.insert(key.clone(), content);
-                        rush_lock_keys.push(key);
-                    }
-                }
-            }
-        }
-    }
+    // Read the project's candidate files. Skipped when no candidate
+    // survived and no dry-run takeover preview is pending (the rewriters do
+    // nothing without a dep); everything after the rewrite still runs. A
+    // dry-run takeover preview still needs the root locks for the
+    // install-policy previews below.
+    let read = if !candidates.is_empty() || !dry_run_takeover_urls.is_empty() {
+        engine::read_candidate_files(&view, &std::collections::BTreeSet::new(), &candidates).await
+    } else {
+        CandidateFiles::default()
+    };
 
     let mut python_metadata = std::collections::BTreeMap::new();
     let mut unavailable_python_artifacts = std::collections::BTreeSet::new();
@@ -1872,57 +749,13 @@ pub(crate) async fn run_redirect_selected(
     // wheel metadata fetch when that probe is certain to be needed.
     let mut pipenv_probe: Option<tokio::task::JoinHandle<Option<u32>>> = None;
     {
-        use socket_patch_core::utils::python_lock::{ArtifactSource, PythonLockProbe};
-        // Each native Python lock is parsed once, on the first dep that
-        // needs the probe, rather than rewritten per dep just to learn
-        // whether it would be.
-        let mut probes: Option<Vec<PythonLockProbe>> = None;
-        let mut wheel_deps: Vec<(&DepOverride, &str)> = Vec::new();
-        for dep in candidates
-            .iter()
-            .map(|c| &c.dep)
-            .filter(|dep| dep.ecosystem == "pypi")
-        {
-            let Some(sha256) = dep.integrity.sha256.as_deref() else {
-                continue;
-            };
-            if !dep
-                .artifact_url
-                .split(['?', '#'])
-                .next()
-                .is_some_and(|path| path.ends_with(".whl"))
-            {
-                continue;
-            }
-            let native_target = probes
-                .get_or_insert_with(|| {
-                    files
-                        .iter()
-                        .filter(|(path, _)| {
-                            *path == "uv.lock"
-                                || socket_patch_core::utils::python_lock::is_script_lock_name(path)
-                        })
-                        .map(|(_, text)| PythonLockProbe::new(text))
-                        .collect()
-                })
-                .iter()
-                .any(|probe| {
-                    probe.rewrites(
-                        &dep.name,
-                        &dep.version,
-                        ArtifactSource::Url(&dep.artifact_url),
-                    )
-                });
-            if native_target {
-                wheel_deps.push((dep, sha256));
-            }
-        }
+        let wheel_deps = engine::wheel_targets(&candidates, &read.files);
         // The only candidates the metadata fetch can still drop are those
         // sharing a fetched wheel's artifact URL. If the rest already
         // target an entry of Pipfile.lock, the Pipenv probe below is certain
         // to run: start it now so it overlaps the fetch.
         if pipenv_probe_certain(
-            &files,
+            &read.files,
             candidates.iter().map(|c| &c.dep),
             wheel_deps.iter().map(|(dep, _)| dep.artifact_url.as_str()),
         ) {
@@ -1990,664 +823,73 @@ pub(crate) async fn run_redirect_selected(
                 Ok(None) => {}
                 Err(detail) => {
                     unavailable_python_artifacts.insert(dep.artifact_url.clone());
-                    skipped.push(serde_json::json!({
-                        "purl": format!("pkg:pypi/{}@{}", dep.name, dep.version),
-                        "uuid": dep.patch_uuid,
-                        "reason": "python_metadata_unavailable",
-                        "detail": detail.replace(&dep.artifact_url, "<hosted artifact>"),
-                    }));
+                    skipped.push(engine::wheel_metadata_unavailable(dep, &detail));
                 }
             }
         }
     }
     status.finish();
     candidates.retain(|c| !unavailable_python_artifacts.contains(&c.dep.artifact_url));
-    // The rewriters' override slice — materialized ONCE, after the last
-    // candidate filter, so it can never disagree with `candidates`.
-    let overrides: Vec<DepOverride> = candidates.iter().map(|c| c.dep.clone()).collect();
     // The Pipfile.lock reference shape depends on the installing Pipenv
     // (`path` for 7–11, `file` from 2018 on), so the installed release is
     // probed (`pipenv --version`, up to 10 s) — but only when a pypi patch
     // actually targets an entry of THIS lock: a stray Pipfile.lock in a uv /
     // Poetry project, a re-scan with nothing left to do and any non-Python
     // run must neither spawn Pipenv nor warn about its absence.
-    let targets_pipenv_lock =
-        socket_patch_core::patch::redirect::pipenv_lock_targets(&files, &overrides);
+    let targets_pipenv_lock = engine::pipenv_lock_targets(&read.files, &candidates);
     let pipenv_major = match (targets_pipenv_lock, pipenv_probe) {
         (true, Some(probe)) => match probe.await {
             Ok(major) => major,
-            Err(err) => std::panic::resume_unwind(err.into_panic()),
-        },
-        (true, None) => socket_patch_core::utils::pipenv::installed_major(&common.cwd).await,
-        // Unreachable (the early start implies the target), but never leave
-        // a probe running: aborting drops it, which reaps the child.
-        (false, Some(probe)) => {
-            probe.abort();
-            None
-        }
-        (false, None) => None,
-    };
-    let binary_content = if binary_bun && overrides.iter().any(|o| o.ecosystem == "npm") {
-        Some(
-            socket_patch_core::utils::fs::read_regular_to_bytes(&common.cwd.join("bun.lockb"))
-                .await
-                .map_err(|e| socket_patch_core::patch::redirect::RewriteWarning {
-                    code: "redirect_bun_lockb_invalid".into(),
-                    detail: format!("cannot read bun.lockb: {e}"),
-                })
-                .and_then(|bytes| {
-                    socket_patch_core::patch::redirect::preflight_bun_binary(&bytes)?;
-                    Ok(bytes)
-                }),
-        )
-    } else {
-        None
-    };
-    // A malformed primary lock must not cause edits to stale npm siblings.
-    let rewrite_overrides: Vec<_> = overrides
-        .iter()
-        .filter(|o| !(binary_content.as_ref().is_some_and(Result::is_err) && o.ecosystem == "npm"))
-        .cloned()
-        .collect();
-    // Pure CPU over every lock text (the independent rewriter groups run
-    // concurrently inside), so it runs on the blocking pool rather than on a
-    // runtime worker; `files` comes back for the confirmation probe below.
-    let bun_lockb_present = common.cwd.join("bun.lockb").exists();
-    let withheld_from_vlt = vlt_preflight.withheld_from_vlt.clone();
-    // `mut`: the pnpm trustLockfile auto-config below may fold a
-    // pnpm-workspace.yaml write (plus its ledger edit) into the rewrite set so
-    // it rides the same atomic-write / ledger-first machinery as the locks.
-    let (files, mut rewrite) = tokio::task::spawn_blocking(move || {
-        let rewrite = rewrite_registry_redirect_withholding_vlt(
-            &files,
-            &rewrite_overrides,
-            &python_metadata,
-            pipenv_major,
-            bun_lockb_present,
-            &withheld_from_vlt,
-        );
-        (files, rewrite)
-    })
-    .await
-    .unwrap_or_else(|e| match e.try_into_panic() {
-        Ok(payload) => std::panic::resume_unwind(payload),
-        Err(e) => panic!("hosted rewrite task failed: {e}"),
-    });
-    if let Some(content) = binary_content {
-        rewrite
-            .warnings
-            .retain(|w| w.code != "redirect_npm_no_lockfile");
-        match content {
-            Ok(bytes) => socket_patch_core::patch::redirect::rewrite_bun_binary(
-                &bytes,
-                &overrides,
-                &mut rewrite,
-            ),
-            Err(warning) => rewrite.warnings.push(warning),
-        }
-    }
-
-    // Unknown installer → the modern `file` shape was chosen; say so only
-    // when the lock was (or, on --dry-run, would be) rewritten.
-    if targets_pipenv_lock && pipenv_major.is_none() && rewrite.files.contains_key("Pipfile.lock") {
-        rewrite.warnings.push(socket_patch_core::patch::redirect::RewriteWarning {
-            code: "redirect_pipenv_installer_unknown".into(),
-            detail: format!(
-                "Pipenv was not found on PATH, so the Pipfile.lock references use the modern `file` form (Pipenv 2018 and later). A project installed with Pipenv 7–11 needs `path` references instead: put that pipenv on PATH or set {}=<major> and re-run `scan --mode hosted`.",
-                socket_patch_core::utils::pipenv::MAJOR_OVERRIDE_ENV
-            ),
-        });
-    }
-
-    // Editing a Rush lock outside `rush update` desyncs the
-    // pnpmShrinkwrapHash recorded in repo-state.json. When
-    // preventManualShrinkwrapChanges is enabled, `rush install` then
-    // refuses until `rush update` refreshes that hash — but the redirect
-    // survives `rush update` (pnpm preserves locked resolutions for
-    // unchanged specifiers). Warn only when the rewrite actually landed in a
-    // Rush lock and the repo-state file that carries the hash is present.
-    if rush_lock_keys
-        .iter()
-        .any(|key| rewrite.files.contains_key(key))
-        && common
-            .cwd
-            .join("common/config/rush/repo-state.json")
-            .is_file()
-    {
-        rush_warnings.push(serde_json::json!({
-            "code": "redirect_rush_repo_state_stale",
-            "detail":
-                "pnpm-lock.yaml was edited outside `rush update`; if \
-                 preventManualShrinkwrapChanges is enabled, `rush install` fails until \
-                 `rush update` refreshes repo-state.json (the hosted wiring survives `rush \
-                 update`)",
-        }));
-    }
-
-    // pnpm >=11 enforces a lockfile supply-chain policy: it compares each
-    // resolution's tarball URL against the registry's published metadata and
-    // REFUSES a lock whose URLs differ: pnpm 11 with
-    // ERR_PNPM_TARBALL_URL_MISMATCH (ERR_PNPM_META_FETCH_FAIL when the
-    // registry is unreachable), pnpm 12 with
-    // ERR_PNPM_LOCKFILE_RESOLUTION_VERIFICATION, whose own text tells users
-    // to rebuild the lock — which silently discards the redirect, so the
-    // warning must pre-empt that advice. The working recoveries are
-    // `pnpm install --trust-lockfile` and the pnpm-workspace.yaml
-    // `trustLockfile: true` key; the `.npmrc` `trust-lockfile=true` spelling
-    // is IGNORED by pnpm and must never be recommended.
-    //
-    // ZERO-TOUCH DEFAULT: when this run rewrote the ROOT pnpm-lock.yaml and
-    // its lockfileVersion is >= 9 (5.x/6.0 locks mean pnpm 7/8, which have
-    // neither the policy nor the flag and get their own guidance), the run
-    // auto-ensures `trustLockfile: true` in pnpm-workspace.yaml. The same
-    // auto-config re-engages on a run that spliced NOTHING when the root v9
-    // lock already carries a granted hosted artifact URL (HEAL-ON-RERUN
-    // below). pnpm <=10 ignores the key; the per-entry sha512 pin still fails
-    // closed on tampered bytes. An explicit user `trustLockfile: <non-true>`
-    // is RESPECTED (never flipped), and `--no-trust-lockfile-config` opts out.
-    // Rush nested/subspace locks are excluded: rush runs pnpm in common/temp,
-    // which never reads the repo-root pnpm-workspace.yaml. The warning names
-    // the host(s) the lock now points at (they follow --api-url).
-    let mut pnpm_warnings: Vec<serde_json::Value> = Vec::new();
-    // The pnpm-workspace.yaml content + ledger edit this run will fold into
-    // the rewrite set (decided inside the borrow scope, applied after it).
-    let mut trust_config_write: Option<(String, socket_patch_core::patch::redirect::FileEdit)> =
-        None;
-    // Human mode only: this run touched nothing pnpm-related (no lock
-    // spliced, trust already configured), so the full guidance, printed by
-    // the run that made the change, shrinks to a one-line reminder.
-    let mut pnpm_rerun_only = false;
-    {
-        // pnpm locks spliced THIS run (any depth — the rewriter is
-        // basename-generalized).
-        let mut pnpm_lock_texts: Vec<&String> = rewrite
-            .files
-            .iter()
-            .filter(|(key, _)| {
-                std::path::Path::new(key)
-                    .file_name()
-                    .and_then(|n| n.to_str())
-                    .is_some_and(|name| matches!(name, "pnpm-lock.yaml" | "shrinkwrap.yaml"))
-            })
-            .map(|(_, content)| content)
-            .collect();
-        // HEAL-ON-RERUN: a root v9 lock that ALREADY carries a granted hosted
-        // artifact URL (spliced by an earlier run) still plans the trust
-        // config even though this run spliced nothing — so a project that
-        // missed the config once (opted-out first run, or a crash between the
-        // lock write and the workspace write) is healed by simply re-running
-        // the scan. An AlreadyTrue workspace keeps the re-run a byte-stable
-        // no-op.
-        let heal_root: Option<&String> = pnpm_heal_root(
-            rewrite.files.contains_key("pnpm-lock.yaml"),
-            files.get("pnpm-lock.yaml"),
-            &overrides,
-        );
-        let spliced_pnpm_locks = pnpm_lock_texts.len();
-        if let Some(text) = heal_root {
-            pnpm_lock_texts.push(text);
-        }
-        // A dry-run vendored→hosted takeover of a purl vendored into the
-        // root pnpm lock: the wet run reverts that wiring and splices the
-        // hosted URL into it, so the trust config is previewed against the
-        // root lock (the vendored text carries the same lockfileVersion).
-        let takeover_pnpm_urls: Vec<&str> = dry_run_takeover_urls
-            .iter()
-            .filter(|(_, locks)| locks.iter().any(|l| l == "pnpm-lock.yaml"))
-            .map(|(url, _)| url.as_str())
-            .collect();
-        let takeover_root: Option<&String> = if takeover_pnpm_urls.is_empty()
-            || heal_root.is_some()
-            || rewrite.files.contains_key("pnpm-lock.yaml")
-        {
-            None
-        } else {
-            files.get("pnpm-lock.yaml")
-        };
-        if let Some(text) = takeover_root {
-            pnpm_lock_texts.push(text);
-        }
-        if !pnpm_lock_texts.is_empty() {
-            // Name only the hosts whose artifact URL actually landed in a
-            // touched pnpm lock's final text (spliced this run, or the
-            // already-redirected heal root): an npm override may have matched
-            // only a sibling lock (e.g. package-lock.json), and naming its host
-            // here would point users at a server the pnpm lock never references.
-            // Same needles as the confirmation probe below.
-            let npm_overrides: Vec<_> = overrides.iter().filter(|o| o.ecosystem == "npm").collect();
-            let groups: Vec<Vec<String>> = npm_overrides
-                .iter()
-                .map(|o| npm_lock_url_needles(&o.artifact_url))
-                .collect();
-            let present = socket_patch_core::patch::redirect::presence::groups_present(
-                &pnpm_lock_texts,
-                &groups,
-            );
-            let mut hosts: Vec<&str> = npm_overrides
-                .iter()
-                .zip(present)
-                .filter(|(_, present)| *present)
-                .filter_map(|(o, _)| url_host(&o.artifact_url))
-                // Dry-run takeover purls land in the root lock on the wet run.
-                .chain(takeover_pnpm_urls.iter().filter_map(|url| url_host(url)))
-                .collect();
-            hosts.sort_unstable();
-            hosts.dedup();
-            let server = if hosts.is_empty() {
-                "the hosted patch server".to_string()
-            } else {
-                format!("the hosted patch server ({})", hosts.join(", "))
-            };
-            // Root-lock gate (see the block comment above): only the plain
-            // project lock at lockfileVersion >= 9 gets the auto-config —
-            // spliced this run, or detected already-redirected (heal path).
-            let root_lock_v9 = heal_root
-                .or(takeover_root)
-                .and_then(|text| pnpm_lock_version_major(text))
-                .is_some_and(|major| major >= 9)
-                || rewrite
-                    .files
-                    .get("pnpm-lock.yaml")
-                    .and_then(|text| pnpm_lock_version_major(text))
-                    .is_some_and(|major| major >= 9);
-            // Every touched pnpm lock is a KNOWN legacy (5.x/6.0) format,
-            // where `--trust-lockfile` is rejected as an unknown option. An
-            // unparseable version stays on the manual guidance: never claim
-            // "no trust step needed" for a lock whose era is unknown.
-            let all_locks_legacy = pnpm_lock_texts.iter().all(|text| {
-                pnpm_lock_version_major(text).is_some_and(|major| major < 9)
-                    || text
-                        .lines()
-                        .any(|line| line.starts_with("shrinkwrapVersion:"))
-            });
-            let detail = if all_locks_legacy {
-                pnpm_trust_legacy_detail(&server)
-            } else if !root_lock_v9 || common.no_trust_lockfile_config {
-                pnpm_trust_manual_guidance(&server)
-            } else {
-                match read_workspace_for_trust(&common.cwd.join(PNPM_WORKSPACE_REL)) {
-                    // Present but UNREADABLE: never plan a Create (it would
-                    // overwrite the user's workspace file) — fall back to
-                    // warning-only guidance naming the file and the error.
-                    Err(e) => pnpm_trust_workspace_unreadable_detail(&server, &e),
-                    Ok(ws_existing) => match plan_workspace_trust(ws_existing.as_deref()) {
-                        TrustPlan::Create(text) => {
-                            trust_config_write = Some((
-                                text,
-                                socket_patch_core::patch::redirect::FileEdit {
-                                    path: PNPM_WORKSPACE_REL.into(),
-                                    kind: REDIRECT_PNPM_WORKSPACE_TRUST_EDIT_KIND.into(),
-                                    action: "created".into(),
-                                    key: Some("trustLockfile".into()),
-                                    original: None,
-                                    new: Some(serde_json::json!("true")),
-                                },
-                            ));
-                            pnpm_trust_configured_detail(&server, true, common.dry_run)
-                        }
-                        TrustPlan::Append(text) => {
-                            trust_config_write = Some((
-                                text,
-                                socket_patch_core::patch::redirect::FileEdit {
-                                    path: PNPM_WORKSPACE_REL.into(),
-                                    kind: REDIRECT_PNPM_WORKSPACE_TRUST_EDIT_KIND.into(),
-                                    action: "added".into(),
-                                    key: Some("trustLockfile".into()),
-                                    original: None,
-                                    new: Some(serde_json::json!("true")),
-                                },
-                            ));
-                            pnpm_trust_configured_detail(&server, false, common.dry_run)
-                        }
-                        TrustPlan::AlreadyTrue => {
-                            pnpm_rerun_only = spliced_pnpm_locks == 0;
-                            format!(
-                                "{}, and {PNPM_WORKSPACE_REL} already carries `trustLockfile: \
-                                 true` — keep it committed alongside the lock; installs need \
-                                 no extra flags. {PNPM_TRUST_TRADEOFF_AND_CAUTION}",
-                                pnpm_trust_policy_preamble(&server),
-                            )
-                        }
-                        TrustPlan::UserSet(value) => format!(
-                            "{}. {PNPM_WORKSPACE_REL} explicitly sets `trustLockfile: \
-                         {value}`, which was respected and left untouched — install \
-                         with `pnpm install --trust-lockfile`, or set `trustLockfile: \
-                         true` yourself so every install accepts the patched \
-                         artifacts. {PNPM_TRUST_TRADEOFF_AND_CAUTION}",
-                            pnpm_trust_policy_preamble(&server),
-                        ),
-                    },
-                }
-            };
-            // The `--store` spelling only matters to pnpm 1–4, so it is
-            // named only when a touched lock may be that old.
-            let store_note = if pnpm_lock_texts
-                .iter()
-                .any(|text| pnpm_lock_may_need_store_flag(text))
-            {
-                " (pnpm 1–4 spell the option `--store`)"
-            } else {
-                ""
-            };
-            pnpm_warnings.push(serde_json::json!({
-                "code": "redirect_pnpm_trust_lockfile",
-                "detail": format!(
-                    "{}. After a lock-only change, existing node_modules or a warm pnpm store \
-                     can still contain upstream files. For a reliable reinstall, use a clean \
-                     node_modules tree and an empty store with \
-                     `pnpm install --frozen-lockfile --store-dir <new-empty-directory>`\
-                     {store_note}. Do not rely on `--force`: some versions re-resolve the \
-                     upstream artifact. Run `socket-patch vex` after installation to verify \
-                     the patched files.",
-                    detail.trim_end_matches('.')
-                ),
-            }));
-        }
-    }
-    // npm >= 12 ships `allow-remote=none`: it refuses (EALLOWREMOTE) every
-    // tarball whose `resolved` origin is not the configured registry — which
-    // is exactly what a hosted redirect writes. npm <= 11 installs it
-    // unchanged; `allow-remote=all` in the project `.npmrc` makes npm 12
-    // install the patched bytes with the sha512 pins still enforced (`root`
-    // only admits DIRECT dependencies, so it is not enough).
-    //
-    // ZERO-TOUCH DEFAULT (the npm twin of the pnpm trustLockfile auto-config
-    // above): whenever a root npm lock ends this run carrying a granted
-    // hosted artifact URL (spliced now, or already redirected by an earlier
-    // run — so a missed config heals on re-run), the run ensures
-    // `allow-remote=all` in the project `.npmrc` — created when absent
-    // (`action: "created"`), one line appended otherwise (`"added"`), every
-    // other byte preserved — and records it in the ledger
-    // (`redirect_npmrc_allow_remote`) so rollback / remove / the vendored
-    // takeover remove exactly that once no package-lock entry needs it. An
-    // explicit user `allow-remote=<other>` is RESPECTED (never flipped), an
-    // unreadable / symlinked `.npmrc` is left alone, and
-    // `--no-npm-allow-remote-config` opts out entirely; every variant still
-    // WARNS (`redirect_npm_allow_remote`) with the whole-tree tradeoff.
-    // Vendored mode is unaffected: its `file:.socket/vendor/…` specs are npm
-    // `file` specs, gated by `allow-file` (default `all`), not
-    // `allow-remote`.
-    let mut npm_warnings: Vec<serde_json::Value> = Vec::new();
-    let mut npmrc_config_write: Option<(String, socket_patch_core::patch::redirect::FileEdit)> =
-        None;
-    {
-        let npm_hosts: Vec<&str> = {
-            let npm_lock_texts: Vec<&String> = NPM_LOCKS
-                .iter()
-                .filter_map(|lock| rewrite.files.get(*lock).or_else(|| files.get(*lock)))
-                .collect();
-            let npm_overrides: Vec<_> = overrides.iter().filter(|o| o.ecosystem == "npm").collect();
-            let groups: Vec<[String; 2]> = npm_overrides
-                .iter()
-                .map(|o| {
-                    socket_patch_core::patch::redirect::artifact_url_spellings(&o.artifact_url)
-                })
-                .collect();
-            let present = socket_patch_core::patch::redirect::presence::groups_present(
-                &npm_lock_texts,
-                &groups,
-            );
-            let mut hosts: Vec<&str> = npm_overrides
-                .iter()
-                .zip(present)
-                .filter(|(_, present)| *present)
-                .filter_map(|(o, _)| url_host(&o.artifact_url))
-                // A dry-run vendored→hosted takeover: the wet run reverts
-                // the vendored wiring in a root npm lock and splices the
-                // hosted URL there, so preview the `.npmrc` write too.
-                .chain(
-                    dry_run_takeover_urls
-                        .iter()
-                        .filter(|(_, locks)| locks.iter().any(|l| NPM_LOCKS.contains(&l.as_str())))
-                        .filter_map(|(url, _)| url_host(url)),
-                )
-                .collect();
-            hosts.sort_unstable();
-            hosts.dedup();
-            hosts
-        };
-        if !npm_hosts.is_empty() {
-            use socket_patch_core::patch::redirect::npmrc::{
-                plan_npmrc_allow_remote_with, resolve_outer_allow_remote, NpmConfigEnv, NpmrcPlan,
-                NPMRC_ALLOW_REMOTE_EDIT_KIND, NPMRC_REL,
-            };
-            let edit = |action: &str| socket_patch_core::patch::redirect::FileEdit {
-                path: NPMRC_REL.into(),
-                kind: NPMRC_ALLOW_REMOTE_EDIT_KIND.into(),
-                action: action.into(),
-                key: Some("allow-remote".into()),
-                original: None,
-                new: Some(serde_json::json!("all")),
-            };
-            let npmrc = read_npmrc_for_allow_remote(&common.cwd.join(NPMRC_REL));
-            // The npm config layers OUTSIDE the project file, located the
-            // way npm does: an env `npm_config_allow_remote` beats the
-            // project file, and an explicit user / global / builtin value is
-            // a machine / org policy a committed project line would silently
-            // override — both are respected like a project value.
-            let outer = resolve_outer_allow_remote(&NpmConfigEnv::from_process(), |path| {
-                socket_patch_core::utils::fs::read_regular_to_string_sync(path).ok()
-            });
-            let detail = match npmrc {
-                // Opt-out still reports an explicit / already-set value
-                // truthfully; only the WRITE is suppressed.
-                Ok(existing) => match plan_npmrc_allow_remote_with(existing.as_deref(), &outer) {
-                    NpmrcPlan::AlreadyAll => npm_allow_remote_already_detail(&npm_hosts),
-                    NpmrcPlan::UserSet(value) => {
-                        npm_allow_remote_user_set_detail(&npm_hosts, &value)
-                    }
-                    NpmrcPlan::EnvSet { var, value } => {
-                        npm_allow_remote_env_set_detail(&npm_hosts, &var, &value)
-                    }
-                    NpmrcPlan::OuterSet { layer, path, value } => {
-                        npm_allow_remote_outer_set_detail(&npm_hosts, layer, &path, &value)
-                    }
-                    NpmrcPlan::Unsupported(why) => {
-                        npm_allow_remote_unreadable_detail(&npm_hosts, &why)
-                    }
-                    _ if common.no_npm_allow_remote_config => {
-                        npm_allow_remote_manual_detail(&npm_hosts)
-                    }
-                    NpmrcPlan::Create(text) => {
-                        npmrc_config_write = Some((text, edit("created")));
-                        npm_allow_remote_configured_detail(&npm_hosts, true, common.dry_run)
-                    }
-                    NpmrcPlan::Append(text) => {
-                        npmrc_config_write = Some((text, edit("added")));
-                        npm_allow_remote_configured_detail(&npm_hosts, false, common.dry_run)
-                    }
-                },
-                Err(why) => npm_allow_remote_unreadable_detail(&npm_hosts, &why),
-            };
-            npm_warnings.push(serde_json::json!({
-                "code": "redirect_npm_allow_remote",
-                "detail": detail,
-            }));
-        }
-    }
-    if let Some((text, edit)) = trust_config_write {
-        rewrite.files.insert(PNPM_WORKSPACE_REL.to_string(), text);
-        // Appended last: `--revert` walks edits in reverse, so the trust key
-        // is unwound before the lock originals are restored.
-        rewrite.edits.push(edit);
-    }
-    if let Some((text, edit)) = npmrc_config_write {
-        rewrite.files.insert(
-            socket_patch_core::patch::redirect::npmrc::NPMRC_REL.to_string(),
-            text,
-        );
-        // Appended after the lock edits for the same reason: a whole-ledger
-        // replay unwinds the setting before the lock originals it served.
-        rewrite.edits.push(edit);
-    }
-    let rewritten: Vec<String> = rewrite
-        .files
-        .keys()
-        .chain(rewrite.binary_files.keys())
-        .cloned()
-        .collect();
-
-    // A dep counts as REDIRECTED only if its hosted-artifact URL (or its
-    // per-dependency registry index URL) actually landed in the project's
-    // files — either written by this run or already present from an earlier
-    // one. A granted reference whose rewriter found nothing to edit (e.g. no
-    // lockfile) must NOT be recorded or attested: nothing pins the patch.
-    // A `pdm.lock` that is NOT the PyPI install driver (a `uv.lock` or
-    // `poetry.lock` sits beside it) is never rewritten, yet can still carry a
-    // Socket artifact URL from an earlier run. That stale text pins nothing,
-    // so it must not feed the substring probe below. When pdm DOES drive,
-    // pypi confirmation keys off `confirmed_pdm_uuids`, so dropping the file
-    // is always safe.
-    let pdm_inactive =
-        files.contains_key("pdm.lock") && !socket_patch_core::patch::redirect::pdm_drives(&files);
-    // Likewise a `vlt-lock.json` the vlt rewrite was withheld from (its
-    // artifact failed the preflight beside another npm-family lock) may
-    // still hold an earlier run's pin: only the sibling lock this run
-    // rewrote can confirm that dep.
-    let final_texts: Vec<(&str, &String)> = files
-        .iter()
-        .filter(|(name, _)| !(pdm_inactive && name.as_str() == "pdm.lock"))
-        .map(|(name, content)| (name.as_str(), rewrite.files.get(name).unwrap_or(content)))
-        .chain(
-            rewrite
-                .files
-                .iter()
-                .filter(|(name, _)| !files.contains_key(*name))
-                .map(|(name, content)| (name.as_str(), content)),
-        )
-        .collect();
-    // Every non-substring rule decides a candidate outright; the rest are
-    // confirmed by substring presence of their needles in the final texts.
-    // All needle groups are answered in ONE multi-needle pass per text
-    // (`groups_present`), which is the per-candidate `any()` exactly —
-    // presence does not depend on search order, and `confirmed` keeps
-    // candidate order. `candidate_present_oracle` is the reference form.
-    let steps: Vec<ProbeStep> = candidates
-        .iter()
-        .map(|c| {
-            let purl = c.purl.as_str();
-            let uuid = c.dep.patch_uuid.as_str();
-            // vlt decides before the binary-bun rule, so `bun.lockb` beside
-            // a vlt-driven `vlt-lock.json` never confirms an npm purl.
-            if rewrite.refused_vlt_uuids.contains(uuid) {
-                return ProbeStep::Decided(false);
-            }
-            if rewrite.vlt_drives && purl.starts_with("pkg:npm/") {
-                return ProbeStep::Decided(rewrite.confirmed_vlt_uuids.contains(uuid));
-            }
-            if binary_bun && purl.starts_with("pkg:npm/") {
-                return ProbeStep::Decided(rewrite.confirmed_bun_binary_uuids.contains(uuid));
-            }
-            if rewrite.refused_pipenv_uuids.contains(uuid) {
-                return ProbeStep::Decided(false);
-            }
-            // pdm is transactional like cargo: a refused uuid is never
-            // confirmed, and when `pdm.lock` is the PyPI install driver
-            // (no `uv.lock` / `poetry.lock`) a pypi dep is confirmed ONLY
-            // by the pdm rewriter's own report — the URL landing in a
-            // sibling `requirements.txt` the project does not install from
-            // pins nothing. When uv/poetry drive, their own lock proof
-            // below still confirms them. This check precedes the hatch
-            // gate: a PDM project may declare `hatchling` as its build
-            // backend, which registers every pypi uuid as hatch-owned while
-            // the lock's presence keeps hatch from confirming any of them.
-            if rewrite.refused_pdm_uuids.contains(uuid) {
-                return ProbeStep::Decided(false);
-            }
-            if purl.starts_with("pkg:pypi/")
-                && socket_patch_core::patch::redirect::pdm_drives(&files)
-            {
-                return ProbeStep::Decided(rewrite.confirmed_pdm_uuids.contains(uuid));
-            }
-            if rewrite.python_lock_uuids.contains(uuid) {
-                return ProbeStep::Decided(
-                    rewrite.confirmed_python_lock_uuids.contains(uuid)
-                        && !rewrite.refused_python_lock_uuids.contains(uuid),
-                );
-            }
-            if rewrite.hatch_uuids.contains(uuid) {
-                return ProbeStep::Decided(rewrite.confirmed_hatch_uuids.contains(uuid));
-            }
-            // A Pipfile.lock rewrite confirms its own uuids (the sibling
-            // requirements.txt rewriter may have had nothing to do).
-            if purl.starts_with("pkg:pypi/") {
-                return ProbeStep::Decided(
-                    rewrite.confirmed_pipenv_uuids.contains(uuid)
-                        || rewrite.confirmed_requirements_uuids.contains(uuid),
-                );
-            }
-            if rewrite.refused_pnpm_uuids.contains(uuid) {
-                return ProbeStep::Decided(false);
-            }
-            // Cargo is transactional: the rewriter reports exactly which
-            // patch uuids FULLY landed (manifest pin + lock + registry
-            // block). Substring presence must never confirm a cargo dep —
-            // the `[registries.…]` config block contains the index URL while
-            // pinning nothing, so a config-block-only rewrite would be
-            // attested with zero enforcement in any build.
-            if purl.starts_with("pkg:cargo/") {
-                return ProbeStep::Decided(rewrite.confirmed_cargo_uuids.contains(uuid));
-            }
-            // Golang likewise: the goproxy `indexUrl` is the bare
-            // patch-server origin (present in any other hosted lock), and
-            // the socket module's go.sum lines outlive a removed replace.
-            if purl.starts_with("pkg:golang/") {
-                return ProbeStep::Decided(rewrite.confirmed_golang_uuids.contains(uuid));
-            }
-            let needles = candidate_presence_needles(&c.dep);
-            if vlt_preflight.withheld_from_vlt.contains(uuid) {
-                ProbeStep::NeedlesOutsideVlt(needles)
-            } else {
-                ProbeStep::Needles(needles)
-            }
-        })
-        .collect();
-    let groups = |outside_vlt: bool| -> Vec<&[String]> {
-        steps
-            .iter()
-            .filter_map(|step| match step {
-                ProbeStep::Needles(needles) if !outside_vlt => Some(needles.as_slice()),
-                ProbeStep::NeedlesOutsideVlt(needles) if outside_vlt => Some(needles.as_slice()),
-                _ => None,
-            })
-            .collect()
+            Err(err) => std::panic::resume_unwind(err.into_panic()),
+        },
+        (true, None) => socket_patch_core::utils::pipenv::installed_major(&common.cwd).await,
+        // Unreachable (the early start implies the target), but never leave
+        // a probe running: aborting drops it, which reaps the child.
+        (false, Some(probe)) => {
+            probe.abort();
+            None
+        }
+        (false, None) => None,
     };
-    let all_texts: Vec<&String> = final_texts.iter().map(|(_, text)| *text).collect();
-    let mut present =
-        socket_patch_core::patch::redirect::presence::groups_present(&all_texts, &groups(false))
-            .into_iter();
-    let outside_vlt_groups = groups(true);
-    let mut present_outside_vlt = if outside_vlt_groups.is_empty() {
-        Vec::new()
-    } else {
-        let texts: Vec<&String> = final_texts
-            .iter()
-            .filter(|(name, _)| *name != socket_patch_core::constants::npm_family::VLT_LOCK)
-            .map(|(_, text)| *text)
-            .collect();
-        socket_patch_core::patch::redirect::presence::groups_present(&texts, &outside_vlt_groups)
-    }
-    .into_iter();
-    let confirmed: Vec<(String, String)> = candidates
-        .iter()
-        .zip(&steps)
-        .filter(|(_, step)| match step {
-            ProbeStep::Decided(keep) => *keep,
-            ProbeStep::Needles(_) => present
-                .next()
-                .expect("one presence answer per needle group"),
-            ProbeStep::NeedlesOutsideVlt(_) => present_outside_vlt
-                .next()
-                .expect("one presence answer per needle group"),
+    // The npm config layers OUTSIDE the project file, located the way npm
+    // does: an env `npm_config_allow_remote` beats the project file, and an
+    // explicit user / global / builtin value is a machine / org policy a
+    // committed project line would silently override — both are respected
+    // like a project value.
+    let npm_outer = || {
+        use socket_patch_core::patch::redirect::npmrc::{resolve_outer_allow_remote, NpmConfigEnv};
+        resolve_outer_allow_remote(&NpmConfigEnv::from_process(), |path| {
+            socket_patch_core::utils::fs::read_regular_to_string_sync(path).ok()
         })
-        .map(|(c, _)| (c.purl.clone(), c.dep.patch_uuid.clone()))
-        .collect();
+    };
+    let done = engine::rewrite(
+        &view,
+        read,
+        &candidates,
+        python_metadata,
+        &vlt_preflight.withheld_from_vlt,
+        &dry_run_takeover_urls,
+        RewriteOptions {
+            dry_run: common.dry_run,
+            targets_pipenv_lock,
+            pipenv_major,
+            pipenv_unknown_detail: format!(
+                "Pipenv was not found on PATH, so the Pipfile.lock references use the modern `file` form (Pipenv 2018 and later). A project installed with Pipenv 7–11 needs `path` references instead: put that pipenv on PATH or set {}=<major> and re-run `scan --mode hosted`.",
+                socket_patch_core::utils::pipenv::MAJOR_OVERRIDE_ENV
+            ),
+            trust_lockfile_config: !common.no_trust_lockfile_config,
+            npm_allow_remote_config: !common.no_npm_allow_remote_config,
+            npm_outer: &npm_outer,
+            blocking: true,
+        },
+    )
+    .await;
     // Dry-run mode-takeover previews were withheld from the rewriters (their
     // lock fragments still carry the vendored wiring the wet run reverts
-    // first), so the presence probe above cannot see them: the wet run
-    // reverts then redirects each one, and the preview's `redirected` count
-    // must report that outcome. Populated only under --dry-run.
-    let mut confirmed = confirmed;
+    // first), so the presence probe cannot see them: the wet run reverts
+    // then redirects each one, and the preview's `redirected` count must
+    // report that outcome. Populated only under --dry-run.
+    let mut confirmed = done.confirmed.clone();
     confirmed.extend(dry_run_takeover);
 
     // Fetch the full patch view (file hashes + vulnerabilities) for each
@@ -2657,27 +899,14 @@ pub(crate) async fn run_redirect_selected(
     // stderr) so CI can detect the attestation gap and re-run.
     let mut records: std::collections::BTreeMap<String, PatchRecord> =
         std::collections::BTreeMap::new();
-    let mut record_warnings: Vec<serde_json::Value> = Vec::new();
-
-    // SYMLINK GUARD — fail-closed, whole rewrite, before the ledger and before
-    // any write (hosted rewrites are transactional). The writer below stages
-    // next to the path and renames over it, which REPLACES a symbolic link
-    // with a detached regular copy: the link target goes stale and
-    // `--revert` restores bytes but never the link. The revert side
-    // (replay.rs) already refuses linked files, so the write side must too.
-    // Applies to every ecosystem's files and to dry runs, so a dry run
-    // predicts the refusal.
-    if let Some(linked) = socket_patch_core::utils::fs::first_symlink(
-        &common.cwd,
-        rewrite
-            .files
-            .keys()
-            .chain(rewrite.binary_files.keys())
-            .map(String::as_str),
-    )
-    .await
-    {
-        return refuse_symlinked_file(common, scan_result.take(), linked);
+    let mut record_warnings: Vec<socket_patch_core::patch::redirect::RewriteWarning> = Vec::new();
+
+    // SYMLINK GUARD (see `engine::guard`) — before the ledger and before any
+    // write, dry runs included, so a dry run predicts the refusal. The
+    // revert side (replay.rs) already refuses linked files, so the write
+    // side must too.
+    if let Some(refusal) = engine::guard(&view, &done, &candidates) {
+        return refuse(common, scan_result.take(), &refusal);
     }
 
     if !common.dry_run {
@@ -2694,7 +923,9 @@ pub(crate) async fn run_redirect_selected(
             |(_, uuid)| {
                 hold_back_debug(async move {
                     api_client.fetch_patch(uuid).await.map(|resp| {
-                        resp.map(|resp| crate::commands::get::record_from_patch_response(&resp))
+                        resp.map(|resp| {
+                            socket_patch_core::manifest::records::record_from_patch_response(&resp)
+                        })
                     })
                 })
             },
@@ -2709,20 +940,14 @@ pub(crate) async fn run_redirect_selected(
                     records.insert(rec_purl, record);
                 }
                 Ok(None) | Err(_) => {
-                    record_warnings.push(serde_json::json!({
-                        "code": "record_fetch_failed",
-                        "detail": format!(
-                            "{purl} was switched to hosted, but its patch record could not be \
-                             fetched; this run's VEX attestation omits it (`socket-patch vex` \
-                             fetches it again once the API answers)"
-                        ),
-                    }));
+                    record_warnings.push(engine::record_fetch_failed_warning(purl));
                 }
             }
         }
         status.finish();
     }
 
+    let rewrite = &done.rewrite;
     if !common.dry_run {
         for (rel, content) in rewrite
             .files
@@ -2763,7 +988,8 @@ pub(crate) async fn run_redirect_selected(
         // purl-coordinate → the PATCHED .gem artifact's sha256 (registry
         // override identifier, tarball integrity fallback) — judges a
         // committed vendor/cache archive.
-        let gem_artifact_shas: std::collections::BTreeMap<(String, String), String> = overrides
+        let gem_artifact_shas: std::collections::BTreeMap<(String, String), String> = done
+            .overrides
             .iter()
             .filter(|o| o.ecosystem == "gem")
             .filter_map(|o| {
@@ -2811,7 +1037,7 @@ pub(crate) async fn run_redirect_selected(
                 final_lock: rewrite
                     .files
                     .get(lock_key)
-                    .or_else(|| files.get(lock_key))
+                    .or_else(|| done.files.get(lock_key))
                     .map(String::as_str),
                 preflight: &vlt_preflight,
                 records: &records,
@@ -2929,20 +1155,14 @@ pub(crate) async fn run_redirect_selected(
     // One merged warning list, in one order, for both channels: the
     // rewriter's own warnings first (e.g. `no package-lock.json`), then the
     // record, package-manager, stale-install, takeover and prune warnings.
-    let mut warnings: Vec<serde_json::Value> = rewrite
-        .warnings
-        .iter()
-        .map(|w| {
-            serde_json::json!({
-                "code": w.code, "detail": w.detail,
-            })
-        })
-        .collect();
-    warnings.extend(vlt_preflight.warnings.iter().cloned());
-    warnings.extend(record_warnings.iter().cloned());
-    warnings.extend(rush_warnings.iter().cloned());
-    warnings.extend(pnpm_warnings.iter().cloned());
-    warnings.extend(npm_warnings.iter().cloned());
+    let mut engine_warnings = rewrite.warnings.clone();
+    engine_warnings.extend(vlt_preflight.warnings.iter().cloned());
+    engine_warnings.extend(record_warnings);
+    engine_warnings.extend(done.rush_warnings.iter().cloned());
+    engine_warnings.extend(done.pnpm_warnings.iter().cloned());
+    engine_warnings.extend(done.npm_warnings.iter().cloned());
+    let mut warnings: Vec<serde_json::Value> =
+        socket_patch_core::hosted::render::rewrite_warnings_json(&engine_warnings);
     warnings.extend(gem_stale.warnings.iter().cloned());
     warnings.extend(python_stale.warnings.iter().cloned());
     warnings.extend(vlt_stale.warnings.iter().cloned());
@@ -2957,8 +1177,11 @@ pub(crate) async fn run_redirect_selected(
         // envelope keeps the same top-level scan keys as every other scan.
         let redirect = redirect_json_block(
             confirmed.len(),
-            rewritten,
-            skipped,
+            done.rewritten.clone(),
+            skipped
+                .iter()
+                .map(socket_patch_core::hosted::render::skipped_json)
+                .collect(),
             warnings,
             common.dry_run,
         );
@@ -2999,7 +1222,7 @@ pub(crate) async fn run_redirect_selected(
             // takeover is withheld from the rewriters, and a wet revert can
             // touch a wiring file the hosted rewriter never rewrites. The
             // same union in both modes keeps preview and wet counts equal.
-            let mut human_files = rewritten.clone();
+            let mut human_files = done.rewritten.clone();
             human_files.extend(takeover_files.iter().cloned());
             human_files.sort();
             human_files.dedup();
@@ -3027,12 +1250,7 @@ pub(crate) async fn run_redirect_selected(
             // would JSON-quote them.
             let skipped_pairs: Vec<(String, String)> = skipped
                 .iter()
-                .map(|s| {
-                    (
-                        s["purl"].as_str().unwrap_or_default().to_string(),
-                        s["reason"].as_str().unwrap_or_default().to_string(),
-                    )
-                })
+                .map(|s| (s.purl.clone(), s.reason.clone()))
                 .collect();
             // Granted, but nothing in the project pins it (no lock entry,
             // unreadable lock, ...): listed so it never vanishes silently.
@@ -3045,11 +1263,7 @@ pub(crate) async fn run_redirect_selected(
                         .iter()
                         .any(|(cp, cu)| *cp == c.purl && *cu == c.dep.patch_uuid)
                 })
-                .filter(|c| {
-                    !skipped
-                        .iter()
-                        .any(|s| s["uuid"].as_str() == Some(c.dep.patch_uuid.as_str()))
-                })
+                .filter(|c| !skipped.iter().any(|s| s.uuid == c.dep.patch_uuid))
                 .map(|c| c.purl.clone())
                 .collect();
             for line in format_unredirected(
@@ -3070,7 +1284,7 @@ pub(crate) async fn run_redirect_selected(
                     // `--verbose`.
                     eprintln!("{}", npm_allow_remote_one_line(detail));
                     continue;
-                } else if *code == "redirect_pnpm_trust_lockfile" && pnpm_rerun_only {
+                } else if *code == "redirect_pnpm_trust_lockfile" && done.pnpm_rerun_only {
                     pnpm_trust_rerun_reminder()
                 } else {
                     detail
@@ -3112,6 +1326,413 @@ pub(crate) async fn run_redirect_selected(
     vex_code
 }
 
+/// Cross-mode takeover: a purl this run is about to redirect may still be
+/// VENDORED — for cargo a committed `[patch.crates-io]` path entry, a
+/// detached Cargo.lock entry, a committed copy, and a vendored ledger
+/// entry; for the npm family a `file:./.socket/vendor/…` lock resolution
+/// (plus a berry `resolutions` pin) and its committed tarball; for golang
+/// the vendor-owned go.mod `replace`, its committed module copy, and its
+/// ledger entry. The hosted rewriters know nothing about that wiring
+/// (cargo would refuse `--locked` builds over the unused `[patch]` entry;
+/// yarn classic would hijack a resolution the vendored ledger still
+/// claims; yarn berry refuses `file:` outright). A takeover must leave the
+/// project FULLY hosted: revert each such purl's vendored state first (the
+/// per-purl machinery `vendor --revert` runs), and only then redirect —
+/// which also hands the redirect the PRISTINE registry lock fragment to
+/// record as its own revert original. A purl
+/// whose vendored state cannot be cleanly reverted (revert failure, or
+/// vendored wiring with a missing/corrupt ledger) is REFUSED — skipped
+/// with an actionable error — never half-migrated.
+///
+/// Refused purls are moved from `candidates` into `skipped`; dry-run
+/// takeover previews leave `candidates` too (see [`Takeover::dry_run`]).
+/// `Err` is the symlinked-wiring refusal (nothing was written).
+async fn vendored_takeover(
+    common: &crate::args::GlobalArgs,
+    candidates: &mut Vec<socket_patch_core::hosted::engine::Candidate>,
+    vendor_state: &mut std::io::Result<socket_patch_core::vendor::VendorState>,
+    skipped: &mut Vec<socket_patch_core::hosted::engine::SkippedPatch>,
+) -> Result<Takeover, socket_patch_core::hosted::engine::Refusal> {
+    use socket_patch_core::hosted::engine::{Candidate, SkippedPatch, TakeoverPreview};
+    let mut out = Takeover::default();
+    // Which root locks each dry-run takeover purl is vendored into (from
+    // its vendor ledger wiring): the wet run reverts that wiring and then
+    // splices the hosted URL there, so the install-policy auto-configs
+    // (npm `.npmrc` allow-remote, pnpm `trustLockfile`) must be PREVIEWED
+    // for those locks even though the rewriters never see these purls.
+    let mut dry_run_locks: std::collections::HashMap<String, Vec<String>> =
+        std::collections::HashMap::new();
+    let takeover_capable = |p: &str| {
+        p.starts_with("pkg:cargo/") || p.starts_with("pkg:npm/") || p.starts_with("pkg:golang/")
+    };
+    if !candidates.iter().any(|c| takeover_capable(&c.purl)) {
+        // No takeover-capable candidates — nothing to reconcile.
+        return Ok(out);
+    }
+    use socket_patch_core::utils::purl::{canonical_purl as canon, strip_purl_qualifiers};
+    // Each takeover-capable candidate with its vendored ledger entry, if
+    // any (cloned out so the loop can mutate the state).
+    let takeover: Vec<(&Candidate, Option<socket_patch_core::vendor::VendorEntry>)> = candidates
+        .iter()
+        .filter(|c| takeover_capable(&c.purl))
+        .map(|c| {
+            let entry = vendor_state
+                .as_ref()
+                .ok()
+                .and_then(|s| {
+                    socket_patch_core::vendor::lookup_entry(
+                        &s.entries,
+                        strip_purl_qualifiers(&c.purl),
+                    )
+                })
+                .cloned();
+            (c, entry)
+        })
+        .collect();
+    // Compatibility must be known before the takeover removes a live
+    // patch. In particular, a v0 workspace can keep an existing local
+    // tuple even though hosted mode cannot replace it with a URL. Only
+    // an npm purl WITH a vendored entry can be taken over, so the bun
+    // locks are read here only when one exists — the candidate-file
+    // read below covers every other run.
+    let bun_takeover_refusal = if takeover
+        .iter()
+        .any(|(c, entry)| entry.is_some() && c.purl.starts_with("pkg:npm/"))
+    {
+        match socket_patch_core::utils::fs::read_regular_to_string(&common.cwd.join("bun.lock"))
+            .await
+        {
+            Ok(content) => socket_patch_core::patch::redirect::preflight_bun_hosted(&content).err(),
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
+                match socket_patch_core::utils::fs::read_regular_to_bytes_sync(
+                    &common.cwd.join("bun.lockb"),
+                ) {
+                    Ok(bytes) => {
+                        socket_patch_core::patch::redirect::preflight_bun_binary(&bytes).err()
+                    }
+                    Err(e) if e.kind() == std::io::ErrorKind::NotFound => None,
+                    Err(e) => Some(socket_patch_core::patch::redirect::RewriteWarning {
+                        code: "redirect_bun_lockb_invalid".into(),
+                        detail: format!("cannot read bun.lockb: {e}"),
+                    }),
+                }
+            }
+            Err(e) => Some(socket_patch_core::patch::redirect::RewriteWarning {
+                code: "redirect_bun_lock_unsupported".into(),
+                detail: format!("cannot read bun.lock before mode takeover: {e}"),
+            }),
+        }
+    } else {
+        None
+    };
+    // Yarn berry twin of the bun gate: the berry rewriter's project-level
+    // refusals (mixed line endings, cacheKey, `.yarnrc.yml`
+    // compressionLevel) must be known before the takeover reverts a
+    // vendored berry purl, or the revert strips the live vendored patch
+    // and the rewriter then refuses the lock. Only entries the
+    // vendor ledger wired through the yarn-berry backend are gated (the
+    // lock is read only when one exists); an unreadable lock is left to
+    // the revert's own diagnostics.
+    let berry_entry = |entry: &socket_patch_core::vendor::VendorEntry| {
+        entry.ecosystem == "npm" && entry.flavor.as_deref() == Some("yarn-berry")
+    };
+    let berry_takeover_refusal = if takeover
+        .iter()
+        .any(|(_, entry)| entry.as_ref().is_some_and(berry_entry))
+    {
+        match socket_patch_core::utils::fs::read_regular_to_string(&common.cwd.join("yarn.lock"))
+            .await
+        {
+            Ok(lock) => {
+                let yarnrc = socket_patch_core::utils::fs::read_regular_to_string(
+                    &common.cwd.join(".yarnrc.yml"),
+                )
+                .await
+                .ok();
+                socket_patch_core::patch::redirect::preflight_yarn_berry_hosted(
+                    &lock,
+                    yarnrc.as_deref(),
+                )
+                .err()
+            }
+            Err(_) => None,
+        }
+    } else {
+        None
+    };
+    // vlt twin: the hosted rewriter's lock-level refusal must be known
+    // before a vendored vlt entry is reverted, or the revert strips the
+    // live vendored patch and the rewrite then refuses the lock.
+    let vlt_entry = |entry: &socket_patch_core::vendor::VendorEntry| {
+        entry.ecosystem == "npm" && entry.flavor.as_deref() == Some("vlt")
+    };
+    let vlt_takeover_refusal = if takeover
+        .iter()
+        .any(|(_, entry)| entry.as_ref().is_some_and(vlt_entry))
+    {
+        match socket_patch_core::utils::fs::read_regular_to_string(
+            &common
+                .cwd
+                .join(socket_patch_core::constants::npm_family::VLT_LOCK),
+        )
+        .await
+        {
+            Ok(lock) => {
+                let files = std::collections::BTreeMap::from([(
+                    socket_patch_core::constants::npm_family::VLT_LOCK.to_string(),
+                    lock,
+                )]);
+                socket_patch_core::patch::redirect::vlt::preflight_vlt_hosted(&files).err()
+            }
+            Err(_) => None,
+        }
+    } else {
+        None
+    };
+    // The takeover refusal (if any) for one candidate: bun gates every
+    // npm purl, berry and vlt only their own vendored entries. A refused
+    // purl is never dispatched (see the loop), so its wiring is not a
+    // write target here.
+    let takeover_refusal = |c: &Candidate,
+                            entry: Option<&socket_patch_core::vendor::VendorEntry>|
+     -> Option<&socket_patch_core::patch::redirect::RewriteWarning> {
+        if !c.purl.starts_with("pkg:npm/") {
+            return None;
+        }
+        bun_takeover_refusal
+            .as_ref()
+            .or_else(|| {
+                berry_takeover_refusal
+                    .as_ref()
+                    .filter(|_| entry.is_some_and(berry_entry))
+            })
+            .or_else(|| {
+                vlt_takeover_refusal
+                    .as_ref()
+                    .filter(|_| entry.is_some_and(vlt_entry))
+            })
+    };
+    // SYMLINK PRE-CHECK for the takeover reverts — the same rule as the
+    // SYMLINK GUARD below, applied to each ledger entry's recorded wiring
+    // (the revert backends also stage and rename over the file). Checked
+    // BEFORE any revert dispatches (and under --dry-run too) so "nothing
+    // was written" stays true.
+    let revert_targets = takeover
+        .iter()
+        .filter_map(|(c, entry)| {
+            entry
+                .as_ref()
+                .filter(|e| takeover_refusal(c, Some(e)).is_none())
+        })
+        .flat_map(|entry| entry.wiring.iter().map(|w| w.file.as_str()));
+    if let Some(linked) =
+        socket_patch_core::utils::fs::first_symlink(&common.cwd, revert_targets).await
+    {
+        return Err(socket_patch_core::hosted::engine::symlink_refusal(linked));
+    }
+    let mut refused: Vec<String> = Vec::new();
+    for (candidate, ledger_entry) in &takeover {
+        let purl = &candidate.purl;
+        let uuid = &candidate.dep.patch_uuid;
+        if let Some(entry) = ledger_entry {
+            if let Some(warning) = takeover_refusal(candidate, Some(entry)) {
+                refused.push(purl.clone());
+                if !out.pre_warnings.iter().any(|w| w["code"] == warning.code) {
+                    out.pre_warnings.push(serde_json::json!(warning));
+                }
+                continue;
+            }
+            if common.dry_run {
+                // Preview through the same per-purl revert machinery the
+                // wet run dispatches (write-free under dry_run): a
+                // vendored state the wet run would refuse to revert is
+                // refused here too, and one it would revert is announced
+                // as a takeover — never handed to the rewriters, which
+                // would refuse the still-vendored wiring.
+                let outcome =
+                    crate::commands::vendor::dispatch_revert_one(entry, &common.cwd, true).await;
+                if !outcome.success {
+                    refused.push(purl.clone());
+                    out.pre_warnings.push(serde_json::json!({
+                        "code": "redirect_vendored_revert_failed",
+                        "detail": format!(
+                            "{purl} is vendored and its vendored state could not be \
+                             reverted ({}); NOT switched to hosted — run `socket-patch vendor \
+                             --revert` to clean up, then re-run `scan --mode hosted`",
+                            outcome.error.as_deref().unwrap_or("unknown error")
+                        ),
+                    }));
+                    continue;
+                }
+                out.pre_warnings.push(serde_json::json!({
+                    "code": "redirect_would_revert_vendored",
+                    "detail": format!(
+                        "{purl} is currently vendored; the hosted wiring will \
+                         revert its vendored wiring, ledger entry, and committed \
+                         artifact first, then switch to hosted (mode takeover)"
+                    ),
+                }));
+                out.dry_run.push((purl.clone(), uuid.clone()));
+                out.migrated.push(purl.clone());
+                out.files
+                    .extend(entry.wiring.iter().map(|w| w.file.clone()));
+                dry_run_locks.insert(
+                    purl.clone(),
+                    entry.wiring.iter().map(|w| w.file.clone()).collect(),
+                );
+                continue;
+            }
+            let outcome =
+                crate::commands::vendor::dispatch_revert_one(entry, &common.cwd, false).await;
+            if !outcome.success {
+                refused.push(purl.clone());
+                out.pre_warnings.push(serde_json::json!({
+                    "code": "redirect_vendored_revert_failed",
+                    "detail": format!(
+                        "{purl} is vendored and its vendored state could not be \
+                         reverted ({}); NOT switched to hosted — run `socket-patch vendor \
+                         --revert` to clean up, then re-run `scan --mode hosted`",
+                        outcome.error.as_deref().unwrap_or("unknown error")
+                    ),
+                }));
+                continue;
+            }
+            // Drop the reverted entry from the in-memory ledger and
+            // persist per purl so a crash mid-run leaves a ledger
+            // matching the on-disk wiring. The entry stays dropped even
+            // when the save fails: its wiring and artifact ARE gone, so
+            // a later successful save in this loop writes the truth.
+            let state = vendor_state
+                .as_mut()
+                .expect("a vendored ledger entry was looked up in this state, so it loaded");
+            state
+                .entries
+                .retain(|k, e| canon(k) != canon(purl) && canon(&e.base_purl) != canon(purl));
+            if let Err(e) = socket_patch_core::vendor::save_state(&common.cwd, state).await {
+                // The wiring is reverted but the ledger still claims it;
+                // redirecting now would leave a ledger asserting wiring
+                // that is gone. Fail closed for this purl.
+                refused.push(purl.clone());
+                out.pre_warnings.push(serde_json::json!({
+                    "code": "redirect_vendored_revert_failed",
+                    "detail": format!(
+                        "{purl}: vendored wiring reverted but the vendored ledger \
+                         could not be updated ({e}); NOT switched to hosted — fix \
+                         .socket/vendor/state.json and re-run"
+                    ),
+                }));
+                continue;
+            }
+            out.pre_warnings.push(serde_json::json!({
+                "code": "redirect_takeover_reverted_vendored",
+                "detail": format!(
+                    "{purl} was vendored; reverted its vendored wiring, ledger \
+                     entry, and committed artifact before switching to hosted (mode \
+                     takeover: the project is now fully hosted for this package)"
+                ),
+            }));
+            out.pre_warnings.extend(
+                outcome
+                    .warnings
+                    .iter()
+                    .filter(|w| w.code == socket_patch_core::vendor::vlt_lock::REINSTALL_REQUIRED)
+                    .map(|w| serde_json::json!({ "code": w.code, "detail": w.detail })),
+            );
+            out.migrated.push(purl.clone());
+            out.files
+                .extend(entry.wiring.iter().map(|w| w.file.clone()));
+        } else {
+            // No usable ledger entry. If socket-owned vendored wiring for
+            // this crate is nevertheless present, the ledger is missing or
+            // corrupt — the originals needed to revert are unrecoverable,
+            // so redirecting on top would wedge the project. Refuse.
+            // (Cargo-only probe: Socket-owned `[patch.crates-io]` entries
+            // for exactly this name@version in the root Cargo.toml or a
+            // legacy `.cargo/config*` — another vendored version of the
+            // crate has its own ledger entry. An npm purl in this state
+            // falls through to the rewriters' own per-flavor
+            // diagnostics.)
+            let coords = purl
+                .starts_with("pkg:cargo/")
+                .then(|| purl_parts(purl).map(|(_, name, version)| (name, version)))
+                .flatten();
+            let wired = match &coords {
+                Some((n, v)) => {
+                    socket_patch_core::vendor::cargo::socket_wiring_present(&common.cwd, n, v).await
+                }
+                None => false,
+            };
+            if wired {
+                refused.push(purl.clone());
+                out.pre_warnings.push(serde_json::json!({
+                    "code": "redirect_vendored_revert_failed",
+                    "detail": format!(
+                        "{purl} has socket-owned vendored `[patch.crates-io]` \
+                         wiring but no usable vendored ledger entry \
+                         (.socket/vendor/state.json is missing or corrupt); NOT \
+                         redirected — restore the ledger or remove the vendored \
+                         wiring manually, then re-run"
+                    ),
+                }));
+            }
+        }
+    }
+    for purl in &refused {
+        if let Some((c, entry)) = takeover.iter().find(|(c, _)| &c.purl == purl) {
+            let reason = takeover_refusal(c, entry.as_ref())
+                .map_or("vendored_revert_failed", |w| w.code.as_str());
+            skipped.push(SkippedPatch::new(purl, &c.dep.patch_uuid, reason));
+        }
+    }
+    // Purls leaving the rewrite set: refused takeovers, plus the dry-run
+    // takeover previews (still vendored on disk — the wet run reverts
+    // them before the rewriters ever see their files).
+    let withheld: std::collections::HashSet<&str> = refused
+        .iter()
+        .map(String::as_str)
+        .chain(out.dry_run.iter().map(|(p, _)| p.as_str()))
+        .collect();
+    if !withheld.is_empty() {
+        // Keep the dry-run takeover candidates' URLs (and the root locks
+        // their purl is vendored into) for the install-policy previews.
+        for (purl, _) in &out.dry_run {
+            let locks = dry_run_locks.get(purl).cloned().unwrap_or_default();
+            for c in candidates.iter().filter(|c| &c.purl == purl) {
+                out.previews.push(TakeoverPreview {
+                    artifact_url: c.dep.artifact_url.clone(),
+                    locks: locks.clone(),
+                });
+            }
+        }
+        candidates.retain(|c| !withheld.contains(c.purl.as_str()));
+    }
+    Ok(out)
+}
+
+/// What [`vendored_takeover`] did (or, on `--dry-run`, would do).
+#[derive(Default)]
+struct Takeover {
+    /// Its warnings, reported after the rewriters' own.
+    pre_warnings: Vec<serde_json::Value>,
+    /// Dry-run takeover previews: `(purl, uuid)` pairs whose vendored state
+    /// the wet run would revert and then redirect. Withheld from the
+    /// rewriters (their lock fragments still carry the vendored wiring the
+    /// wet run reverts FIRST) and counted as redirected, so the preview's
+    /// envelope matches the wet run's outcome.
+    dry_run: Vec<(String, String)>,
+    /// Human output: the purls migrated (or, on --dry-run, to be migrated)
+    /// from vendored to hosted.
+    migrated: Vec<String>,
+    /// The files their revert touches (or would touch). Both modes count
+    /// `rewritten ∪ files`, so the preview's file count matches the wet
+    /// run's even for wiring files the hosted rewriter does not also
+    /// rewrite (a Gemfile line, a uv source).
+    files: std::collections::BTreeSet<String>,
+    /// The withheld dry-run takeover candidates' artifact URLs and wired
+    /// root locks, for the install-policy previews.
+    previews: Vec<socket_patch_core::hosted::engine::TakeoverPreview>,
+}
+
 // ── Human-output formatting ────────────────────────────────────────────────
 //
 // Pure `String` builders for everything the hosted flow prints in human
@@ -3457,6 +2078,38 @@ pub(crate) fn boxed_run_redirect_selected<'a>(
     ))
 }
 
+/// The default human form of a `redirect_npm_allow_remote` warning: one
+/// line saying whether the project `.npmrc` now carries `allow-remote=all`
+/// or the user must set it. `detail` is one of the `npm_allow_remote_*`
+/// texts below; `--verbose` and `--json` show it in full.
+pub(crate) fn npm_allow_remote_one_line(detail: &str) -> String {
+    const MORE: &str = "(details: --verbose)";
+    if detail.contains("`allow-remote=all` was written to a new")
+        || detail.contains("`allow-remote=all` was appended to the existing")
+    {
+        format!(
+            "Note: set `allow-remote=all` in .npmrc so npm >=12 installs the hosted \
+             patches; commit it with the lockfile {MORE}."
+        )
+    } else if detail.contains("`allow-remote=all` would be") {
+        format!(
+            "Note: would set `allow-remote=all` in .npmrc so npm >=12 installs the \
+             hosted patches {MORE}."
+        )
+    } else if detail.contains("already sets `allow-remote=all`") {
+        format!(
+            "Note: .npmrc already sets `allow-remote=all`, so npm >=12 installs the \
+             hosted patches; keep it committed {MORE}."
+        )
+    } else {
+        format!(
+            "Warning: npm >=12 refuses the hosted patches until `allow-remote=all` is \
+             set (in .npmrc, or `npm ci --allow-remote=all`); it was not set \
+             automatically {MORE}."
+        )
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::{
@@ -3469,7 +2122,7 @@ mod tests {
         pnpm_lock_carries_hosted_redirect, pnpm_lock_version_major, pnpm_trust_configured_detail,
         pnpm_trust_legacy_detail, pnpm_trust_manual_guidance,
         pnpm_trust_workspace_unreadable_detail, prune_ignored_warning, read_npmrc_for_allow_remote,
-        read_workspace_for_trust, redirect_json_block, TrustPlan, REDIRECT_CANDIDATE_FILES,
+        read_workspace_for_trust, redirect_json_block, TrustPlan,
     };
     use super::{
         describe_skip_reason, format_error_line, format_next_steps, format_redirect_summary,
@@ -3478,6 +2131,7 @@ mod tests {
         wrap_tokens, wrap_words, TAKEOVER_INFO_CODES,
     };
     use super::{wheel_metadata_concurrency, WHEEL_METADATA_CONCURRENCY};
+    use socket_patch_core::hosted::engine::REDIRECT_CANDIDATE_FILES;
     use socket_patch_core::patch::redirect::DepOverride;
     use socket_patch_core::utils::concurrent::API_CONCURRENCY_ENV;
 
@@ -5301,170 +3955,3 @@ mod tests {
         }
     }
 }
-
-#[cfg(test)]
-mod probe_equivalence_tests {
-    use super::{candidate_presence_needles, candidate_present_oracle, npm_lock_url_needles};
-    use socket_patch_core::patch::redirect::presence::groups_present;
-    use socket_patch_core::patch::redirect::{
-        artifact_url_present, artifact_url_spellings, rewrite_registry_redirect, DepOverride,
-    };
-    use socket_patch_core::utils::uri::encode_uri_component;
-    use std::collections::BTreeMap;
-    use std::path::{Path, PathBuf};
-
-    fn golden_root() -> PathBuf {
-        Path::new(env!("CARGO_MANIFEST_DIR")).join("../socket-patch-core/tests/fixtures/redirect")
-    }
-
-    fn cases(dir: &Path, out: &mut Vec<PathBuf>) {
-        if dir.join("input").is_dir() && dir.join("overrides.json").is_file() {
-            out.push(dir.to_path_buf());
-            return;
-        }
-        for entry in std::fs::read_dir(dir).unwrap() {
-            let p = entry.unwrap().path();
-            if p.is_dir() {
-                cases(&p, out);
-            }
-        }
-    }
-
-    fn read_tree(base: &Path) -> BTreeMap<String, String> {
-        fn walk(base: &Path, dir: &Path, out: &mut BTreeMap<String, String>) {
-            for entry in std::fs::read_dir(dir).unwrap() {
-                let p = entry.unwrap().path();
-                if p.is_dir() {
-                    walk(base, &p, out);
-                } else if let Ok(text) = std::fs::read_to_string(&p) {
-                    let rel = p.strip_prefix(base).unwrap().to_string_lossy();
-                    out.insert(rel.replace('\\', "/"), text);
-                }
-            }
-        }
-        let mut out = BTreeMap::new();
-        if base.is_dir() {
-            walk(base, base, &mut out);
-        }
-        out
-    }
-
-    /// Every golden fixture (composer `\/`, berry percent-encoded, maven
-    /// suffixed version, go module path, cargo index url, …): each case's
-    /// final texts — input overlaid with this CLI's own rewrite, as the probe
-    /// sees them — plus its authored `expected/` files, probed with EVERY
-    /// fixture's overrides so hits and misses are both well exercised.
-    #[test]
-    fn multi_needle_probe_matches_per_candidate_any_on_golden_fixtures() {
-        let mut dirs = Vec::new();
-        cases(&golden_root(), &mut dirs);
-        dirs.sort();
-        assert!(dirs.len() > 50, "golden fixtures not found: {}", dirs.len());
-
-        let mut all_overrides: Vec<DepOverride> = Vec::new();
-        let mut text_sets: Vec<Vec<String>> = Vec::new();
-        for case in &dirs {
-            let overrides: Vec<DepOverride> = match serde_json::from_str(
-                &std::fs::read_to_string(case.join("overrides.json")).unwrap(),
-            ) {
-                Ok(o) => o,
-                Err(_) => continue,
-            };
-            let input = read_tree(&case.join("input"));
-            let rewrite = rewrite_registry_redirect(&input, &overrides);
-            let finals: Vec<String> = input
-                .iter()
-                .map(|(name, text)| rewrite.files.get(name).unwrap_or(text).clone())
-                .chain(
-                    rewrite
-                        .files
-                        .iter()
-                        .filter(|(name, _)| !input.contains_key(*name))
-                        .map(|(_, t)| t.clone()),
-                )
-                .collect();
-            text_sets.push(finals);
-            text_sets.push(read_tree(&case.join("expected")).into_values().collect());
-            text_sets.push(input.into_values().collect());
-            all_overrides.extend(overrides);
-        }
-        text_sets.push(Vec::new());
-        // Texts that carry ONE needle kind and nothing else — no golden
-        // fixture has the maven suffixed version or the registry index URL
-        // without the artifact URL beside it, so a needle dropped from
-        // `candidate_presence_needles` would otherwise go unnoticed.
-        let mut lone_suffixed: Vec<usize> = Vec::new();
-        for o in all_overrides
-            .iter()
-            .filter_map(|d| d.registry_override.as_ref())
-        {
-            text_sets.push(vec![format!("<url>{}</url>\n", o.index_url)]);
-            if let Some(sv) = o.identifiers.maven_suffixed_version.as_deref() {
-                lone_suffixed.push(text_sets.len());
-                text_sets.push(vec![format!("<version>{sv}</version>\n")]);
-            }
-        }
-        assert!(
-            !lone_suffixed.is_empty(),
-            "no maven suffixed-version override"
-        );
-
-        let groups: Vec<Vec<String>> = all_overrides
-            .iter()
-            .map(candidate_presence_needles)
-            .collect();
-        let (mut hits, mut misses) = (0usize, 0usize);
-        for (set, texts) in text_sets.iter().enumerate() {
-            let refs: Vec<&String> = texts.iter().collect();
-            let fast = groups_present(&refs, &groups);
-            if lone_suffixed.contains(&set) {
-                assert!(
-                    fast.iter().any(|hit| *hit),
-                    "a lone suffixed version confirms its maven override"
-                );
-            }
-            for (dep, got) in all_overrides.iter().zip(&fast) {
-                let want = candidate_present_oracle(&refs, dep);
-                assert_eq!(
-                    *got, want,
-                    "{}/{} / {}",
-                    dep.ecosystem, dep.name, dep.artifact_url
-                );
-                if want {
-                    hits += 1;
-                } else {
-                    misses += 1;
-                }
-            }
-        }
-        assert!(hits > 100 && misses > 100, "hits={hits} misses={misses}");
-
-        // The pnpm / npm host filters and the heal probe: the npm lock
-        // spellings, and the bare `artifact_url_present` pair.
-        let npm: Vec<&DepOverride> = all_overrides.iter().collect();
-        let lock_groups: Vec<Vec<String>> = npm
-            .iter()
-            .map(|o| npm_lock_url_needles(&o.artifact_url))
-            .collect();
-        let pair_groups: Vec<[String; 2]> = npm
-            .iter()
-            .map(|o| artifact_url_spellings(&o.artifact_url))
-            .collect();
-        for texts in &text_sets {
-            let lock_fast = groups_present(texts, &lock_groups);
-            let pair_fast = groups_present(texts, &pair_groups);
-            for (i, o) in npm.iter().enumerate() {
-                let encoded = encode_uri_component(&o.artifact_url);
-                let pair = texts
-                    .iter()
-                    .any(|t| artifact_url_present(t, &o.artifact_url));
-                let lock = texts.iter().any(|t| {
-                    artifact_url_present(t, &o.artifact_url) || t.contains(encoded.as_str())
-                });
-                assert_eq!(pair_fast[i], pair, "{}", o.artifact_url);
-                assert_eq!(lock_fast[i], lock, "{}", o.artifact_url);
-            }
-        }
-    }
-
-}
diff --git a/crates/socket-patch-cli/src/commands/scan/hosted/vlt.rs b/crates/socket-patch-cli/src/commands/scan/hosted/vlt.rs
index 9766f156..376526ab 100644
--- a/crates/socket-patch-cli/src/commands/scan/hosted/vlt.rs
+++ b/crates/socket-patch-cli/src/commands/scan/hosted/vlt.rs
@@ -6,93 +6,19 @@
 use std::collections::{BTreeMap, BTreeSet};
 use std::path::Path;
 
-use socket_patch_core::constants::npm_family::{
-    BUN_LOCK, BUN_LOCKB, NPM_LOCKS, PNPM_LOCK, VLT_HIDDEN_LOCK_REL, VLT_LOCK, VLT_STORE_DIR,
-};
+use socket_patch_core::constants::npm_family::{VLT_HIDDEN_LOCK_REL, VLT_LOCK};
+use socket_patch_core::hosted::vlt::{self as hosted_vlt, Preflight};
 use socket_patch_core::manifest::schema::PatchRecord;
 use socket_patch_core::patch::redirect::vlt_heal::{
     self, classify_target, read_install_state, Expected, LedgerTarget, Target, TargetState,
 };
-use socket_patch_core::patch::redirect::vlt_preflight::{self, OFFLINE_REASON};
-use socket_patch_core::patch::redirect::{redact_grant_token, vlt, DepOverride};
+use socket_patch_core::patch::redirect::vlt_preflight;
+use socket_patch_core::patch::redirect::{vlt, DepOverride};
+use socket_patch_core::vendor::lock_inventory::ProjectView;
 
 use super::StaleInstallOutcome;
 
 pub(super) const REINSTALL_REQUIRED: &str = "redirect_vlt_reinstall_required";
-const ARTIFACT_UNVERIFIABLE: &str = "redirect_vlt_artifact_unverifiable";
-
-/// Whether vlt's install state exists: the hidden lock as a regular file,
-/// or the store as a real directory. Stat only; the hidden lock can be
-/// megabytes and is never read into the rewriter's input.
-pub(super) fn install_state_present(cwd: &Path) -> bool {
-    let is = |rel: &str, dir: bool| {
-        std::fs::symlink_metadata(cwd.join(rel)).is_ok_and(|m| {
-            if dir {
-                m.file_type().is_dir()
-            } else {
-                m.file_type().is_file()
-            }
-        })
-    };
-    is(VLT_HIDDEN_LOCK_REL, false) || is(VLT_STORE_DIR, true)
-}
-
-/// What the artifact preflight decided for this run's npm candidates.
-#[derive(Debug, Default)]
-pub(crate) struct Preflight {
-    /// Failed while vlt drives, or for a vlt-vendored takeover: withheld
-    /// from every rewriter.
-    pub(crate) withheld_everywhere: BTreeMap<String, String>,
-    /// Failed while another npm-family lock may drive: kept out of the vlt
-    /// rewrite only.
-    pub(crate) withheld_from_vlt: BTreeSet<String>,
-    pub(crate) passed: BTreeSet<String>,
-    /// Artifact bytes by URL, for the heal's no-record comparison.
-    pub(crate) artifacts: BTreeMap<String, Vec<u8>>,
-    pub(crate) warnings: Vec<serde_json::Value>,
-}
-
-/// The files `vlt_drives` and the preflight scope read: `vlt-lock.json`
-/// itself, and presence-only entries for the sibling locks and vlt's
-/// install state. Empty without a readable `vlt-lock.json`.
-async fn vlt_inputs(cwd: &Path) -> BTreeMap<String, String> {
-    let mut files = BTreeMap::new();
-    let Ok(lock) = socket_patch_core::utils::fs::read_regular_to_string(&cwd.join(VLT_LOCK)).await
-    else {
-        return files;
-    };
-    files.insert(VLT_LOCK.to_string(), lock);
-    for sibling in [NPM_LOCKS[0], NPM_LOCKS[1], "yarn.lock", PNPM_LOCK, BUN_LOCK] {
-        if std::fs::metadata(cwd.join(sibling)).is_ok_and(|m| m.is_file()) {
-            files.insert(sibling.to_string(), String::new());
-        }
-    }
-    if install_state_present(cwd) {
-        files.insert(VLT_HIDDEN_LOCK_REL.to_string(), String::new());
-    }
-    files
-}
-
-fn unverifiable_detail(
-    url: &str,
-    reason: &str,
-    purl: &str,
-    already_pinned: bool,
-    everywhere: bool,
-) -> String {
-    if already_pinned {
-        format!(
-            "vlt would fail to verify {url}: {reason}; {purl} was left pinned by an earlier run \
-             and `vlt ci` will fail until the artifact verifies"
-        )
-    } else if everywhere {
-        format!("vlt would fail to verify {url}: {reason}; nothing was written for {purl}")
-    } else {
-        format!(
-            "vlt would fail to verify {url}: {reason}; vlt-lock.json was not changed for {purl}"
-        )
-    }
-}
 
 /// The uuids of `deps` whose purl a vlt vendored ledger entry claims: a
 /// hosted takeover reverts them to a registry node before the rewrite.
@@ -114,114 +40,32 @@ async fn vlt_vendored_uuids(cwd: &Path, deps: &[(&str, &DepOverride)]) -> BTreeS
 
 /// Fetch each in-scope artifact the way vlt does (once per distinct URL,
 /// `offline` making no request) and decide which deps may be pinned in
-/// `vlt-lock.json`. Projects without `vlt-lock.json` make no request. A
-/// vlt-vendored dep is probed through its vendored node, before the
-/// takeover reverts it, and a failure keeps it vendored.
+/// `vlt-lock.json` ([`socket_patch_core::hosted::vlt`]). Projects without
+/// `vlt-lock.json` make no request. A vlt-vendored dep is probed through
+/// its vendored node, before the takeover reverts it, and a failure keeps
+/// it vendored.
 pub(super) async fn artifact_preflight(
     common: &crate::args::GlobalArgs,
     api_client: &socket_patch_core::api::client::ApiClient,
     deps: &[(&str, &DepOverride)],
 ) -> Preflight {
-    let files = vlt_inputs(&common.cwd).await;
+    let view = ProjectView::Disk(&common.cwd);
+    let files = hosted_vlt::inputs(&view).await;
     if files.is_empty() {
         return Preflight::default();
     }
-    let overrides: Vec<DepOverride> = deps.iter().map(|(_, dep)| (*dep).clone()).collect();
     let vendored = vlt_vendored_uuids(&common.cwd, deps).await;
-    let scope = vlt_preflight::preflight_scope(&files, &overrides, &vendored);
-    if scope.is_empty() {
+    let Some(plan) = hosted_vlt::plan(&view, &files, deps, &vendored) else {
         return Preflight::default();
-    }
-    let drives = vlt::vlt_drives(&files, common.cwd.join(BUN_LOCKB).exists());
-    let urls: BTreeSet<String> = scope.iter().map(|d| d.artifact_url.clone()).collect();
+    };
     let probes = if common.offline {
         BTreeMap::new()
     } else {
-        vlt_preflight::probe_artifacts(api_client, &urls).await
+        vlt_preflight::probe_artifacts(api_client, &plan.urls()).await
     };
-    judge_preflight(&scope, deps, drives, probes)
-}
-
-/// [`artifact_preflight`] for a host with no network (the in-memory hosted
-/// engine): every in-scope artifact is judged as `--offline` judges it, so
-/// the dep is withheld (`redirect_vlt_artifact_unverifiable`, "offline")
-/// rather than pinned in a lock vlt may not be able to install. `files`
-/// are the [`vlt_inputs`] entries built from the host's file set.
-pub(crate) fn offline_preflight(
-    files: &BTreeMap<String, String>,
-    deps: &[(&str, &DepOverride)],
-    bun_lockb_present: bool,
-) -> Preflight {
-    if files.is_empty() {
-        return Preflight::default();
-    }
-    let overrides: Vec<DepOverride> = deps.iter().map(|(_, dep)| (*dep).clone()).collect();
-    let scope = vlt_preflight::preflight_scope(files, &overrides, &BTreeSet::new());
-    if scope.is_empty() {
-        return Preflight::default();
-    }
-    let drives = vlt::vlt_drives(files, bun_lockb_present);
-    judge_preflight(&scope, deps, drives, BTreeMap::new())
-}
-
-/// The preflight's verdicts for `scope` given the `probes` fetched for it
-/// (none for a URL that was not fetched: judged offline).
-fn judge_preflight(
-    scope: &[vlt_preflight::PreflightDep],
-    deps: &[(&str, &DepOverride)],
-    drives: bool,
-    probes: BTreeMap<String, vlt_preflight::ArtifactProbe>,
-) -> Preflight {
-    let mut out = Preflight::default();
-    let mut passed_urls: BTreeSet<&str> = BTreeSet::new();
-    for dep in scope {
-        let reason = match probes.get(&dep.artifact_url) {
-            None => Some(OFFLINE_REASON.to_string()),
-            Some(probe) => probe.failure(&dep.sha512),
-        };
-        let Some(reason) = reason else {
-            out.passed.insert(dep.patch_uuid.clone());
-            passed_urls.insert(&dep.artifact_url);
-            continue;
-        };
-        let purl = deps
-            .iter()
-            .find(|(_, d)| d.patch_uuid == dep.patch_uuid)
-            .map_or("", |(purl, _)| *purl);
-        let everywhere = drives || dep.vendored;
-        let detail = unverifiable_detail(
-            &dep.artifact_url,
-            &reason,
-            purl,
-            dep.already_pinned,
-            everywhere,
-        );
-        out.warnings.push(serde_json::json!({
-            "code": ARTIFACT_UNVERIFIABLE,
-            "detail": redact_grant_token(&detail, &dep.artifact_url, &dep.patch_uuid),
-        }));
-        if everywhere {
-            out.withheld_everywhere
-                .insert(dep.patch_uuid.clone(), purl.to_string());
-        } else {
-            out.withheld_from_vlt.insert(dep.patch_uuid.clone());
-        }
-    }
-    // Moved, not copied: every dep has been judged, and the probes are not
-    // read again, so a verified body is held once.
-    for (url, probe) in probes {
-        if passed_urls.contains(url.as_str()) {
-            if let Some(body) = probe.body {
-                out.artifacts.insert(url, body);
-            }
-        }
-    }
-    out
+    hosted_vlt::judge(&plan, deps, probes)
 }
 
-/// The skip `reason` of a dep the preflight withheld from every rewriter.
-pub(crate) const WITHHELD_REASON: &str = ARTIFACT_UNVERIFIABLE;
-
 fn patch_server_origins(common: &crate::args::GlobalArgs) -> Vec<String> {
     common
         .patch_server_url
@@ -771,7 +615,7 @@ mod tests {
             Some("pkg:npm/left-pad@1.3.0")
         );
         assert_eq!(
-            pre.warnings[0]["detail"],
+            pre.warnings[0].detail,
             format!(
                 "vlt would fail to verify {url}: offline; nothing was written for \
                  pkg:npm/left-pad@1.3.0"
@@ -852,7 +696,7 @@ mod tests {
         assert!(claimed.withheld_from_vlt.is_empty());
         assert!(claimed.withheld_everywhere.contains_key(&dep.patch_uuid));
         assert_eq!(
-            claimed.warnings[0]["detail"],
+            claimed.warnings[0].detail,
             format!("vlt would fail to verify {url}: http 404; nothing was written for pkg:npm/left-pad@1.3.0")
         );
     }
diff --git a/crates/socket-patch-cli/src/commands/scan/mod.rs b/crates/socket-patch-cli/src/commands/scan/mod.rs
index 8a98c85d..cf1bb5c8 100644
--- a/crates/socket-patch-cli/src/commands/scan/mod.rs
+++ b/crates/socket-patch-cli/src/commands/scan/mod.rs
@@ -15,7 +15,6 @@ use socket_patch_core::api::client::{
 use socket_patch_core::api::types::{BatchPackagePatches, BatchSearchResponse, PatchSearchResult};
 use socket_patch_core::crawlers::ruby_crawler::config_path_ignored_warning;
 use socket_patch_core::crawlers::Ecosystem;
-use socket_patch_core::manifest::operations::read_manifest;
 use socket_patch_core::manifest::schema::PatchManifest;
 use socket_patch_core::telemetry::{
     spawn_patch_scan_failed, spawn_patch_scanned, PendingTelemetry,
@@ -50,7 +49,10 @@ use self::discovery::{
 // pinned entry into the hosted engine, the vendor step + its dry-run
 // preview, and the PnP layout-refusal warning mapping. `pub(crate)`
 // re-exports because the submodules themselves stay private to scan.
-pub(crate) use self::discovery::unsupported_layout_warnings;
+pub(crate) use self::discovery::{
+    lockfile_supplement as project_lockfile_supplement, unsupported_layout_warnings,
+    vendored_ledger_supplement as project_vendored_supplement,
+};
 use self::gc::gc_json;
 pub(crate) use self::hosted::boxed_run_redirect_selected;
 use self::hosted::run_redirect;
@@ -845,27 +847,12 @@ fn overlap_from_states(
     redirect: Option<&socket_patch_core::patch::redirect::RedirectState>,
     vendor: &VendorState,
 ) -> Vec<String> {
-    let Some(redirect) = redirect else {
-        return Vec::new();
-    };
-    if vendor.entries.is_empty() || redirect.records.is_empty() {
-        return Vec::new();
+    socket_patch_core::ledgers::Ledgers {
+        manifest: None,
+        vendor: Some(vendor),
+        redirect,
     }
-    // Canonicalize both sides (drop qualifiers, percent-decode) so the
-    // hosted pin's purl matches the vendor entry's base purl — mirrors
-    // `vendored_ledger_supplement`.
-    let canon = |p: &str| normalize_purl(strip_purl_qualifiers(p)).into_owned();
-    let mut vendor_purls: std::collections::BTreeSet<String> = std::collections::BTreeSet::new();
-    for (key, entry) in &vendor.entries {
-        vendor_purls.insert(canon(key));
-        vendor_purls.insert(canon(&entry.base_purl));
-    }
-    let redirect_purls: std::collections::BTreeSet<String> =
-        redirect.records.keys().map(|p| canon(p)).collect();
-    redirect_purls
-        .intersection(&vendor_purls)
-        .cloned()
-        .collect()
+    .hosted_vendored_overlap()
 }
 
 /// The overlapping PURLs split by which mode the LIVE lockfile actually wires
@@ -1379,6 +1366,10 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
     // `--vex` side-effect reads the manifest at several terminal returns,
     // including the early "no packages" exit before the GC block.
     let manifest_path = args.common.resolved_manifest_path();
+    // The stores, lock set and wiring discovery this run reads before it
+    // writes anything, each loaded at most once (see `ProjectContext`).
+    let ctx =
+        crate::commands::context::ProjectContext::rooted(&args.common, args.common.cwd.clone());
     let socket_dir = args.common.socket_dir();
 
     let overrides = args.common.api_client_overrides();
@@ -1427,7 +1418,7 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
     // that have NO installed copy (fresh clone, partial install). They join
     // discovery and are flagged "not yet installed". Scoped to the crawled
     // ecosystems.
-    let lockfile_only = lockfile_supplement(&args.common, &all_crawled, crawl_scope).await;
+    let lockfile_only = lockfile_supplement(&ctx, &all_crawled, crawl_scope).await;
     // Unsupported layouts and malformed binary Bun locks, kept on empty
     // scans too: an unreadable graph is not evidence of no dependencies.
     let mut layout_refusals = unsupported_layout_warnings(&lockfile_only.unsupported);
@@ -1458,9 +1449,9 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
     // and update detection. Failure policies differ on purpose: the
     // supplement falls back to the committed artifacts (fail-closed for the
     // prune), the key set degrades to empty (fail-open).
-    let vendor_state = socket_patch_core::vendor::load_state(&args.common.cwd).await;
+    let vendor_state = &ctx.loaded().await.vendor;
     let ledger_supplement =
-        vendored_ledger_supplement(&args.common, &all_crawled, &vendor_state).await;
+        vendored_ledger_supplement(&args.common, &all_crawled, vendor_state).await;
     for pkg in &ledger_supplement {
         if let Some(eco) = Ecosystem::from_purl(&pkg.purl) {
             *eco_counts.entry(eco).or_insert(0) += 1;
@@ -1620,11 +1611,11 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
                 // (same rule as the ≥1-package path). `wiringLive` is empty
                 // by construction: this run covered zero packages.
                 let redirect_state = (!args.common.is_global()).then_some(
-                    crate::commands::hosted_state_from_lockfiles(
-                        &args.common,
-                        &args.common.cwd,
-                    )
-                    .await,
+                    crate::commands::hosted_state_from_pins(
+                        &socket_patch_core::patch::redirect::upstream::HostedPin::all(
+                            ctx.discovery().await,
+                        ),
+                    ),
                 );
                 if let Some(state) = redirect_state_json(redirect_state.as_ref(), &[]) {
                     result["redirectState"] = state;
@@ -1882,7 +1873,7 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
     );
 
     // Read existing manifest once for update detection.
-    let existing_manifest = read_manifest(&manifest_path).await.ok().flatten();
+    let existing_manifest = ctx.ledgers().await.manifest;
     // Hosted mode records its patches ONLY in the lockfiles (v5 keeps no
     // hosted ledger) and vendored mode ONLY in its ledger, so the hosted
     // pins and the vendor ledger's purl→uuid records are folded into update
@@ -1891,18 +1882,17 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         if args.common.is_global() {
             Vec::new()
         } else {
-            socket_patch_core::patch::redirect::upstream::HostedPin::all(
-                &crate::commands::discover_wiring(&args.common, &args.common.cwd).await,
-            )
+            socket_patch_core::patch::redirect::upstream::HostedPin::all(ctx.discovery().await)
         };
-    let redirect_state = (!args.common.is_global())
+    let hosted_state = (!args.common.is_global())
         .then(|| crate::commands::hosted_state_from_pins(&hosted_pin_list));
+    let redirect_state = hosted_state.as_ref();
     let hosted_pins: Vec<(String, String)> = hosted_pin_list
         .iter()
         .map(|pin| (pin.purl.clone(), pin.uuid.clone()))
         .collect();
     let update_manifest = merge_ledger_records_for_updates(
-        existing_manifest.as_ref(),
+        existing_manifest,
         vendor_state.as_ref().ok(),
         &hosted_pins,
     );
@@ -1980,10 +1970,10 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         let hosted_retained = if vendor {
             Vec::new()
         } else {
-            hosted_wiring_retained_purls(&args.common, redirect_state.as_ref(), &all_purls).await
+            hosted_wiring_retained_purls(&args.common, redirect_state, &all_purls).await
         };
         if !vendor {
-            if let Some(state) = redirect_state_json(redirect_state.as_ref(), &hosted_retained) {
+            if let Some(state) = redirect_state_json(redirect_state, &hosted_retained) {
                 result["redirectState"] = state;
             }
         }
@@ -2024,7 +2014,7 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
             if dry {
                 // Synthesize the per-patch outcome without touching disk.
                 let empty_manifest = PatchManifest::new();
-                let manifest_for_preview = existing_manifest.as_ref().unwrap_or(&empty_manifest);
+                let manifest_for_preview = existing_manifest.unwrap_or(&empty_manifest);
                 let mut patches: Vec<serde_json::Value> = selected
                     .iter()
                     .map(|p| {
@@ -2622,7 +2612,7 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
     // vendored-ownership counterpart is the `[skip]` lines above.)
     if !vendor && !silent {
         let hosted_retained =
-            hosted_wiring_retained_purls(&args.common, redirect_state.as_ref(), &all_purls).await;
+            hosted_wiring_retained_purls(&args.common, redirect_state, &all_purls).await;
         if !hosted_retained.is_empty() {
             eprintln!(
                 "Warning: {}",
diff --git a/crates/socket-patch-cli/src/commands/vex.rs b/crates/socket-patch-cli/src/commands/vex.rs
index e5501673..7eed23e6 100644
--- a/crates/socket-patch-cli/src/commands/vex.rs
+++ b/crates/socket-patch-cli/src/commands/vex.rs
@@ -20,7 +20,6 @@ use std::collections::HashMap;
 use std::path::{Path, PathBuf};
 
 use clap::Args;
-use socket_patch_core::manifest::operations::read_manifest;
 use socket_patch_core::manifest::schema::{PatchManifest, PatchRecord};
 use socket_patch_core::telemetry::{track_vex_failed, track_vex_generated};
 use socket_patch_core::vex::{
@@ -959,7 +958,13 @@ async fn generate_vex_from_manifest_path_inner(
     calm_when_nothing: bool,
     warnings: &mut Vec<RunWarning>,
 ) -> Result<VexWriteSummary, VexGenError> {
-    let manifest_file = match read_manifest(manifest_path).await {
+    // One load of the three stores; each keeps vex's strict posture below.
+    let socket_patch_core::ledgers::LoadedLedgers {
+        manifest,
+        vendor,
+        redirect,
+    } = socket_patch_core::ledgers::LoadedLedgers::load(&common.cwd, manifest_path).await;
+    let manifest_file = match manifest {
         Ok(m) => m,
         Err(e) => {
             // Core's text ("Failed to parse manifest JSON: ...") does not
@@ -976,8 +981,7 @@ async fn generate_vex_from_manifest_path_inner(
     // is read (never written) only as an extra local record source for the
     // pins it still describes, so a malformed one is an advisory: its
     // records are simply not consulted.
-    let redirect = match socket_patch_core::patch::redirect::load_redirect_state(&common.cwd).await
-    {
+    let redirect = match redirect {
         Ok(state) => state,
         Err(corrupt) => {
             note_warning(
@@ -995,7 +999,7 @@ async fn generate_vex_from_manifest_path_inner(
             None
         }
     };
-    let vendor = match socket_patch_core::vendor::load_state(&common.cwd).await {
+    let vendor = match vendor {
         Ok(state) => state,
         Err(e) => {
             let message = format!(
diff --git a/crates/socket-patch-cli/src/commands/vex_sources.rs b/crates/socket-patch-cli/src/commands/vex_sources.rs
index 4adec636..7904fe33 100644
--- a/crates/socket-patch-cli/src/commands/vex_sources.rs
+++ b/crates/socket-patch-cli/src/commands/vex_sources.rs
@@ -79,7 +79,7 @@ use socket_patch_core::manifest::schema::{PatchManifest, PatchRecord};
 use socket_patch_core::patch::redirect::RedirectState;
 use socket_patch_core::utils::concurrent::{api_concurrency, ordered_concurrent};
 use socket_patch_core::utils::purl::strip_purl_qualifiers;
-use socket_patch_core::vendor::state::{lookup_entry_kv, VendorArtifact, VendorEntry, VendorState};
+use socket_patch_core::vendor::state::{VendorArtifact, VendorEntry, VendorState};
 use socket_patch_core::vex::discover::{
     canonical_base_purl, vendor_ref, Discovery, LedgerLiveness, PatchedRef, WiringMode,
 };
@@ -281,7 +281,7 @@ pub(crate) async fn plan(common: &GlobalArgs, sources: Sources, assume_live: &[S
 
     let mut notes = Vec::new();
     let mut gated: Vec<FailedPatch> = Vec::new();
-    let mut cands = build_candidates(&manifest, &vendor, &redirect_records);
+    let mut cands = build_candidates(&manifest, &vendor, redirect.as_ref());
     let conflicts = wiring_conflicts(&discovery);
     if !conflicts.is_empty() {
         // Gate every candidate for a conflicting package BEFORE anything can
@@ -550,76 +550,35 @@ fn expected_package(cand: &Cand) -> String {
     }
 }
 
-/// One candidate per manifest key, then per unclaimed vendor-ledger key,
-/// then per unclaimed redirect-ledger key — the collision rule
-/// (the manifest owns a key it records; ledgers fill the rest), in sorted
-/// order so the output is deterministic.
+/// One candidate per owner key under the shared owner rule
+/// ([`socket_patch_core::ledgers::Ledgers::owned`]): the manifest keys, then
+/// the unclaimed vendor-ledger keys, then the redirect-ledger keys neither
+/// owns, each sorted, with the losing copies' records as `alts`.
 fn build_candidates(
     manifest: &PatchManifest,
     vendor: &VendorState,
-    redirect_records: &BTreeMap<String, PatchRecord>,
+    redirect: Option<&RedirectState>,
 ) -> Vec<Cand> {
-    let mut cands = Vec::new();
-    let mut claimed_entries: HashSet<&str> = HashSet::new();
-    let mut manifest_keys: Vec<&String> = manifest.patches.keys().collect();
-    manifest_keys.sort();
-    for key in manifest_keys {
-        let record = &manifest.patches[key];
-        let entry = lookup_entry_kv(&vendor.entries, key);
-        let mut alts = Vec::new();
-        if let Some((entry_key, e)) = entry {
-            claimed_entries.insert(entry_key.as_str());
-            alts.extend(e.record.clone());
-        }
-        alts.extend(redirect_records.get(key).cloned());
-        cands.push(Cand {
-            key: key.clone(),
-            uuid: record.uuid.clone(),
-            record: Some(record.clone()),
-            alts,
-            manifest_owned: true,
-            redirected: redirect_records.contains_key(key),
-            vendor_entry: entry.map(|(_, e)| e.clone()),
-            discovered: Vec::new(),
-            lockfile_only: false,
-        });
-    }
-    let mut vendor_keys: Vec<&String> = vendor.entries.keys().collect();
-    vendor_keys.sort();
-    for key in vendor_keys {
-        if claimed_entries.contains(key.as_str()) || manifest.patches.contains_key(key) {
-            continue;
-        }
-        let entry = &vendor.entries[key];
-        cands.push(Cand {
-            key: key.clone(),
-            uuid: entry.uuid.clone(),
-            record: entry.record.clone(),
-            alts: redirect_records.get(key).cloned().into_iter().collect(),
-            manifest_owned: false,
-            redirected: redirect_records.contains_key(key),
-            vendor_entry: Some(entry.clone()),
-            discovered: Vec::new(),
-            lockfile_only: false,
-        });
-    }
-    for (purl, record) in redirect_records {
-        if cands.iter().any(|c| c.key == *purl) {
-            continue;
-        }
-        cands.push(Cand {
-            key: purl.clone(),
-            uuid: record.uuid.clone(),
-            record: Some(record.clone()),
-            alts: Vec::new(),
-            manifest_owned: false,
-            redirected: true,
-            vendor_entry: None,
-            discovered: Vec::new(),
-            lockfile_only: false,
-        });
+    use socket_patch_core::ledgers::{Ledgers, Store};
+    Ledgers {
+        manifest: Some(manifest),
+        vendor: Some(vendor),
+        redirect,
     }
-    cands
+    .owned()
+    .into_iter()
+    .map(|o| Cand {
+        key: o.key.to_string(),
+        uuid: o.uuid.to_string(),
+        record: o.record.cloned(),
+        alts: o.alts.into_iter().cloned().collect(),
+        manifest_owned: o.store == Store::Manifest,
+        redirected: o.hosted,
+        vendor_entry: o.vendor.map(|(_, e)| e.clone()),
+        discovered: Vec::new(),
+        lockfile_only: false,
+    })
+    .collect()
 }
 
 /// Packages the discovered references wire to MORE than one patch uuid
diff --git a/crates/socket-patch-cli/src/hosted_memory/redirect.rs b/crates/socket-patch-cli/src/hosted_memory/redirect.rs
deleted file mode 100644
index 99bd8e56..00000000
--- a/crates/socket-patch-cli/src/hosted_memory/redirect.rs
+++ /dev/null
@@ -1,1234 +0,0 @@
-//! One project root's hosted redirect over an in-memory file set: the
-//! disk flow's `run_redirect_selected` stages as pure functions
-//! (reference → `DepOverride` candidates, candidate-file reads, the
-//! rewrite, the pnpm `trustLockfile` and npm `allow-remote` auto-configs,
-//! per-ecosystem confirmation, the symlink guard). Everything that needs
-//! the host machine (the apply lock, vendored takeover reverts, stale
-//! install probes, VEX, telemetry, subprocesses) is left out; a vendored
-//! takeover is refused instead of performed.
-
-use std::collections::{BTreeMap, BTreeSet, HashMap};
-
-use socket_patch_core::api::types::PackageVendorResult;
-use socket_patch_core::constants::npm_family::{
-    BUN_LOCK, NPM_LOCKS as NPM_LOCK_NAMES, PNPM_LOCK, RUSH_COMMON_LOCK_REL, RUSH_SUBSPACES_DIR,
-    VLT_HIDDEN_LOCK_REL, VLT_LOCK, VLT_STORE_DIR,
-};
-use socket_patch_core::patch::redirect::npmrc::{
-    plan_npmrc_allow_remote_with, NpmrcPlan, OuterAllowRemote, NPMRC_ALLOW_REMOTE_EDIT_KIND,
-    NPMRC_REL,
-};
-use socket_patch_core::patch::redirect::{
-    rewrite_registry_redirect_withholding_vlt, DepOverride, FileEdit, RewriteResult,
-    RewriteWarning,
-};
-use socket_patch_core::utils::purl::{purl_parts, strip_purl_qualifiers};
-use socket_patch_core::vendor::lock_inventory::{MemoryEntry, MemoryProject};
-use socket_patch_core::vendor::VendorState;
-
-use super::select::{RUSH_REPO_STATE_REL, VENDOR_STATE_REL};
-use super::types::{ProjectError, SkippedPatch};
-use crate::commands::scan::hosted::{
-    npm_allow_remote_already_detail, npm_allow_remote_configured_detail,
-    npm_allow_remote_env_set_detail, npm_allow_remote_manual_detail,
-    npm_allow_remote_outer_set_detail, npm_allow_remote_unreadable_detail,
-    npm_allow_remote_user_set_detail, plan_workspace_trust, pnpm_heal_root,
-    pnpm_lock_may_need_store_flag, pnpm_lock_version_major, pnpm_trust_configured_detail,
-    pnpm_trust_legacy_detail, pnpm_trust_manual_guidance, pnpm_trust_policy_preamble,
-    pnpm_trust_workspace_unreadable_detail, url_host, TrustPlan, NPM_LOCKS,
-    PNPM_TRUST_TRADEOFF_AND_CAUTION, PNPM_WORKSPACE_REL, REDIRECT_CANDIDATE_FILES,
-    REDIRECT_PNPM_WORKSPACE_TRUST_EDIT_KIND,
-};
-
-/// Skip reason / warning code for a candidate the disk flow would migrate
-/// from vendored to hosted (the migration reverts committed wiring, which
-/// the in-memory engine does not do).
-pub(crate) const VENDORED_TAKEOVER_UNSUPPORTED: &str = "vendored_takeover_unsupported_in_memory";
-
-/// The disk flow's symlink refusal code.
-pub(crate) const SYMLINK_REFUSAL: &str = "redirect_symlinked_file_unsupported";
-
-/// A candidate file exists but its content was not provided (oversize, an
-/// LFS pointer, presence-only); disk would read and rewrite it.
-pub(crate) const UNREADABLE_REFUSAL: &str = "candidate_file_unreadable";
-
-/// One granted reference: the purl it was granted for plus its override.
-#[derive(Debug, Clone)]
-pub(crate) struct Candidate {
-    pub(crate) purl: String,
-    pub(crate) dep: DepOverride,
-}
-
-/// The engine-level options the per-root stages read.
-#[derive(Debug, Clone, Copy)]
-pub(crate) struct StageOptions {
-    pub(crate) dry_run: bool,
-    pub(crate) pipenv_major: Option<u32>,
-    pub(crate) trust_lockfile_config: bool,
-    pub(crate) npm_allow_remote_config: bool,
-}
-
-/// Reference grants → candidates (disk: the loop over `selected` after
-/// `fetch_registry_references`).
-pub(crate) fn build_candidates(
-    selected: &[(String, String)],
-    references: &HashMap<String, PackageVendorResult>,
-    skipped: &mut Vec<SkippedPatch>,
-) -> Vec<Candidate> {
-    let skip = |purl: &str, uuid: &str, reason: &str| SkippedPatch {
-        purl: purl.to_string(),
-        uuid: uuid.to_string(),
-        reason: reason.to_string(),
-        detail: None,
-    };
-    let mut candidates = Vec::new();
-    for (sel_purl, sel_uuid) in selected {
-        let Some(reference) = references.get(sel_uuid) else {
-            skipped.push(skip(sel_purl, sel_uuid, "not_found"));
-            continue;
-        };
-        if reference.status != "granted" && reference.status != "reused" {
-            skipped.push(skip(sel_purl, sel_uuid, &reference.status));
-            continue;
-        }
-        let purl = reference.purl.as_deref().unwrap_or(sel_purl);
-        let Some((ecosystem, name, version)) = purl_parts(purl) else {
-            skipped.push(skip(purl, sel_uuid, "bad_purl"));
-            continue;
-        };
-        let Some(url) = reference.url.clone() else {
-            skipped.push(skip(purl, sel_uuid, "no_url"));
-            continue;
-        };
-        let mut integrity = reference
-            .artifacts
-            .iter()
-            .flatten()
-            .find(|a| a.kind == "tarball")
-            .map(|a| a.integrity.clone())
-            .unwrap_or_default();
-        let berry_zip = reference
-            .artifacts
-            .iter()
-            .flatten()
-            .find(|a| a.kind == "yarn-berry-zip");
-        if let Some(c) = berry_zip.and_then(|a| a.integrity.yarn_berry10c0.clone()) {
-            integrity.yarn_berry10c0 = Some(c);
-        }
-        if let Some(ov) = reference
-            .registry_override
-            .as_ref()
-            .filter(|o| o.kind == "goproxy")
-        {
-            if let (Some(zip_h1), Some(gomod_h1)) = (
-                ov.identifiers.go_zip_dirhash_h1.clone(),
-                ov.identifiers.go_mod_h1.clone(),
-            ) {
-                integrity.dirhash_h1 = Some(zip_h1);
-                integrity.go_mod_h1 = Some(gomod_h1);
-            }
-        }
-        let token = reference
-            .registry_override
-            .as_ref()
-            .and_then(|o| {
-                socket_patch_core::patch::redirect::grant_token_path_segment(&o.index_url, sel_uuid)
-            })
-            .or_else(|| {
-                socket_patch_core::patch::redirect::grant_token_path_segment(&url, sel_uuid)
-            })
-            .unwrap_or_default();
-        candidates.push(Candidate {
-            purl: purl.to_string(),
-            dep: DepOverride {
-                ecosystem,
-                name,
-                namespace: None,
-                version,
-                token,
-                patch_uuid: sel_uuid.clone(),
-                artifact_url: url,
-                berry_zip_url: berry_zip.and_then(|a| a.url.clone()),
-                registry_override: reference.registry_override.clone(),
-                integrity,
-            },
-        });
-    }
-    candidates
-}
-
-/// The ecosystem a candidate file's rewriter belongs to (`None` for files
-/// no rewriter edits), for the symlinked-read refusal.
-fn file_ecosystem(rel: &str) -> Option<&'static str> {
-    if let Some(eco) = socket_patch_core::formats::registry::hosted_file_ecosystem(rel) {
-        return Some(eco);
-    }
-    let base = rel.rsplit('/').next().unwrap_or(rel);
-    (socket_patch_core::utils::python_lock::is_python_lock_name(base) || base.ends_with(".py"))
-        .then_some("pypi")
-}
-
-/// A project's state between the reference grants and the wheel-metadata
-/// fetch.
-#[derive(Debug)]
-pub(crate) struct Planned {
-    pub(crate) project: MemoryProject,
-    pub(crate) candidates: Vec<Candidate>,
-    pub(crate) skipped: Vec<SkippedPatch>,
-    pub(crate) pre_warnings: Vec<serde_json::Value>,
-    pub(crate) files: BTreeMap<String, String>,
-    pub(crate) rush_lock_keys: Vec<String>,
-    pub(crate) bun_lock_present: bool,
-    /// Candidate files the disk flow reads through a symbolic link: their
-    /// bytes are unknown here, so a project whose candidates could rewrite
-    /// one is refused like the disk symlink guard refuses the write.
-    pub(crate) symlinked_reads: Vec<String>,
-    /// Candidate files that exist without content: a project whose
-    /// candidates could rewrite (or whose rewrite depends on) one is
-    /// refused, since the rewriters would treat it as absent.
-    pub(crate) unreadable_reads: Vec<String>,
-    /// `(artifact url, sha256)` of every pypi wheel whose metadata a
-    /// native lock rewrite needs.
-    pub(crate) wheels: Vec<(String, String)>,
-    /// The vlt artifact preflight, judged offline (see
-    /// [`crate::commands::scan::hosted::vlt::offline_preflight`]).
-    pub(crate) vlt_preflight: crate::commands::scan::hosted::vlt::Preflight,
-}
-
-/// A refused project: its error and whatever was skipped before it.
-#[derive(Debug)]
-pub(crate) struct Refused {
-    pub(crate) error: ProjectError,
-}
-
-fn refusal(code: &str, message: String) -> Refused {
-    Refused {
-        error: ProjectError {
-            code: code.to_string(),
-            message,
-        },
-    }
-}
-
-fn unreadable_refusal(rel: &str) -> Refused {
-    refusal(
-        UNREADABLE_REFUSAL,
-        format!(
-            "{rel} exists but its content was not provided (too large, an LFS pointer, or \
-             not fetched), so it cannot be rewritten alongside the other lockfiles; nothing \
-             was written"
-        ),
-    )
-}
-
-fn symlink_refusal(linked: &str) -> Refused {
-    refusal(
-        SYMLINK_REFUSAL,
-        format!(
-            "{linked} is a symbolic link; socket-patch rewrites files in place with an atomic \
-             rename, which would replace the link — replace the link with a regular file (or \
-             run socket-patch in the directory it points to) and re-run; nothing was written"
-        ),
-    )
-}
-
-/// The vendored ledger's entries (the disk `vendor::load_state` parse,
-/// including its legacy `{mode}`-only shape); `None` when absent or
-/// unreadable.
-fn vendored_entries(project: &MemoryProject) -> Option<VendorState> {
-    let bytes: Vec<u8> = match project.get(VENDOR_STATE_REL)? {
-        MemoryEntry::Text(text) => text.as_bytes().to_vec(),
-        MemoryEntry::Binary(bytes) => bytes.to_vec(),
-        _ => return None,
-    };
-    match serde_json::from_slice::<VendorState>(&bytes) {
-        Ok(state) => Some(state),
-        Err(_) => {
-            let value: serde_json::Value = serde_json::from_slice(&bytes).ok()?;
-            (value.get("mode").is_some() && value.get("entries").is_none()).then(VendorState::new)
-        }
-    }
-}
-
-/// Whether Socket-owned vendored `[patch.crates-io]` wiring for exactly
-/// `name@version` is committed in the root manifest or (legacy) the
-/// project's cargo config — the disk `socket_wiring_present` probe over
-/// the in-memory files. The config cargo reads is `.cargo/config` when it
-/// exists, else `.cargo/config.toml`.
-fn cargo_vendored_wiring(files: &MemoryProject, name: &str, version: &str) -> bool {
-    use socket_patch_core::vendor::cargo_manifest::{
-        crates_io_patch_entries, entry_wires, parse_manifest,
-    };
-    let manifest_wired = files
-        .text("Cargo.toml")
-        .and_then(|text| parse_manifest(text).ok())
-        .is_some_and(|doc| {
-            crates_io_patch_entries(&doc)
-                .iter()
-                .any(|e| entry_wires(e, name, version))
-        });
-    let config_rel = if files.contains(".cargo/config") {
-        ".cargo/config"
-    } else {
-        ".cargo/config.toml"
-    };
-    let config_wired = files
-        .text(config_rel)
-        .and_then(|text| parse_manifest(text).ok())
-        .is_some_and(|doc| {
-            crates_io_patch_entries(&doc)
-                .iter()
-                .any(|e| e.source == "crates-io" && entry_wires(e, name, version))
-        });
-    manifest_wired || config_wired
-}
-
-/// Whether vlt's install state is in the file set: the hidden lock as a
-/// file, or the store as a directory (the disk `install_state_present`).
-fn vlt_install_state_present(project: &MemoryProject) -> bool {
-    matches!(
-        project.get(VLT_HIDDEN_LOCK_REL),
-        Some(MemoryEntry::Text(_) | MemoryEntry::Binary(_) | MemoryEntry::Present)
-    ) || project.is_dir(VLT_STORE_DIR)
-}
-
-/// The disk `vlt_inputs` over the file set: `vlt-lock.json` itself, and
-/// presence-only entries for the sibling locks and vlt's install state.
-/// Empty without a readable `vlt-lock.json`.
-fn vlt_inputs(project: &MemoryProject) -> BTreeMap<String, String> {
-    let mut files = BTreeMap::new();
-    let lock = match project.get(VLT_LOCK) {
-        Some(MemoryEntry::Text(text)) => text.to_string(),
-        Some(MemoryEntry::Binary(bytes)) => match std::str::from_utf8(bytes) {
-            Ok(text) => text.to_string(),
-            Err(_) => return files,
-        },
-        _ => return files,
-    };
-    files.insert(VLT_LOCK.to_string(), lock);
-    for sibling in [
-        NPM_LOCK_NAMES[0],
-        NPM_LOCK_NAMES[1],
-        "yarn.lock",
-        PNPM_LOCK,
-        BUN_LOCK,
-    ] {
-        if matches!(
-            project.get(sibling),
-            Some(MemoryEntry::Text(_) | MemoryEntry::Binary(_) | MemoryEntry::Present)
-        ) {
-            files.insert(sibling.to_string(), String::new());
-        }
-    }
-    if vlt_install_state_present(project) {
-        files.insert(VLT_HIDDEN_LOCK_REL.to_string(), String::new());
-    }
-    files
-}
-
-/// Everything up to the wheel-metadata fetch.
-pub(crate) fn plan(
-    project: MemoryProject,
-    unreadable: BTreeSet<String>,
-    selected: &[(String, String)],
-    references: &HashMap<String, PackageVendorResult>,
-) -> Result<Planned, Refused> {
-    let mut skipped: Vec<SkippedPatch> = Vec::new();
-    let mut candidates = if selected.is_empty() {
-        Vec::new()
-    } else {
-        build_candidates(selected, references, &mut skipped)
-    };
-
-    // The disk flow fetches each in-scope artifact the way vlt does before
-    // anything else; with no network here every one is judged offline, so
-    // the dep is withheld instead of pinned (`--offline` parity).
-    let vlt_preflight = {
-        let deps: Vec<(&str, &DepOverride)> = candidates
-            .iter()
-            .filter(|c| c.dep.ecosystem == "npm")
-            .map(|c| (c.purl.as_str(), &c.dep))
-            .collect();
-        crate::commands::scan::hosted::vlt::offline_preflight(
-            &vlt_inputs(&project),
-            &deps,
-            project.contains("bun.lockb"),
-        )
-    };
-    if !vlt_preflight.withheld_everywhere.is_empty() {
-        for (uuid, purl) in &vlt_preflight.withheld_everywhere {
-            skipped.push(SkippedPatch {
-                purl: purl.clone(),
-                uuid: uuid.clone(),
-                reason: crate::commands::scan::hosted::vlt::WITHHELD_REASON.to_string(),
-                detail: None,
-            });
-        }
-        candidates.retain(|c| {
-            !vlt_preflight
-                .withheld_everywhere
-                .contains_key(&c.dep.patch_uuid)
-        });
-    }
-
-    let bun_lock_present = project.contains("bun.lock");
-    if candidates.iter().any(|c| c.dep.ecosystem == "npm")
-        && !bun_lock_present
-        && project.is_symlink("bun.lockb")
-    {
-        return Err(refusal(
-            SYMLINK_REFUSAL,
-            "bun.lockb is a symbolic link; replace it with a regular file (or run \
-             socket-patch in the directory it points to) before patching; nothing was written"
-                .to_string(),
-        ));
-    }
-
-    let mut pre_warnings: Vec<serde_json::Value> = vlt_preflight.warnings.clone();
-    let takeover_capable = |p: &str| {
-        p.starts_with("pkg:cargo/") || p.starts_with("pkg:npm/") || p.starts_with("pkg:golang/")
-    };
-    if candidates.iter().any(|c| takeover_capable(&c.purl)) {
-        let vendored = vendored_entries(&project);
-        let mut refused: BTreeSet<String> = BTreeSet::new();
-        for candidate in candidates.iter().filter(|c| takeover_capable(&c.purl)) {
-            let has_entry = vendored.as_ref().is_some_and(|s| {
-                socket_patch_core::vendor::lookup_entry(
-                    &s.entries,
-                    strip_purl_qualifiers(&candidate.purl),
-                )
-                .is_some()
-            });
-            let cargo_wired = !has_entry
-                && candidate.purl.starts_with("pkg:cargo/")
-                && cargo_vendored_wiring(&project, &candidate.dep.name, &candidate.dep.version);
-            if has_entry || cargo_wired {
-                refused.insert(candidate.purl.clone());
-            }
-        }
-        if !refused.is_empty() {
-            pre_warnings.push(serde_json::json!({
-                "code": VENDORED_TAKEOVER_UNSUPPORTED,
-                "detail": format!(
-                    "{} currently vendored ({}); migrating a vendored package to hosted \
-                     reverts its committed vendored wiring, which the in-memory hosted scan \
-                     does not do — run `socket-patch scan --mode hosted` in a checkout to \
-                     migrate, then re-run",
-                    if refused.len() == 1 { "1 package is" } else { "packages are" },
-                    refused.iter().cloned().collect::<Vec<_>>().join(", ")
-                ),
-            }));
-            for c in candidates.iter().filter(|c| refused.contains(&c.purl)) {
-                skipped.push(SkippedPatch {
-                    purl: c.purl.clone(),
-                    uuid: c.dep.patch_uuid.clone(),
-                    reason: VENDORED_TAKEOVER_UNSUPPORTED.to_string(),
-                    detail: None,
-                });
-            }
-            candidates.retain(|c| !refused.contains(&c.purl));
-        }
-    }
-
-    let mut files: BTreeMap<String, String> = BTreeMap::new();
-    let mut rush_lock_keys: Vec<String> = Vec::new();
-    let mut symlinked_reads: Vec<String> = Vec::new();
-    let mut unreadable_reads: Vec<String> = Vec::new();
-    if !candidates.is_empty() {
-        let mut read = |rel: &str, files: &mut BTreeMap<String, String>| -> bool {
-            if project.is_symlink(rel) {
-                symlinked_reads.push(rel.to_string());
-                return false;
-            }
-            if unreadable.contains(rel) {
-                unreadable_reads.push(rel.to_string());
-                return false;
-            }
-            // Disk reads any UTF-8 regular file; a non-UTF-8 one is absent
-            // to it as well.
-            let text = match project.get(rel) {
-                Some(MemoryEntry::Text(text)) => Some(text.to_string()),
-                Some(MemoryEntry::Binary(bytes)) => {
-                    std::str::from_utf8(bytes).ok().map(str::to_string)
-                }
-                _ => None,
-            };
-            match text {
-                Some(text) => {
-                    files.insert(rel.to_string(), text);
-                    true
-                }
-                None => false,
-            }
-        };
-        for name in REDIRECT_CANDIDATE_FILES.iter() {
-            if *name == "bun.lockb" {
-                continue;
-            }
-            // The hidden lock is only the install-state sentinel, never read.
-            if *name == VLT_HIDDEN_LOCK_REL {
-                if vlt_install_state_present(&project) {
-                    files.insert((*name).to_string(), String::new());
-                }
-                continue;
-            }
-            read(name, &mut files);
-        }
-        if files.contains_key("Cargo.toml") && candidates.iter().any(|c| c.dep.ecosystem == "cargo")
-        {
-            let view = socket_patch_core::vendor::lock_inventory::ProjectView::Memory(&project);
-            for rel in socket_patch_core::utils::cargo_workspace::member_manifests_in(&view) {
-                read(&rel, &mut files);
-            }
-        }
-        let python_locks: Vec<String> = project
-            .children("")
-            .into_iter()
-            .filter(|(name, is_dir)| {
-                !is_dir && socket_patch_core::utils::python_lock::is_python_lock_name(name)
-            })
-            .map(|(name, _)| name)
-            .collect();
-        for path in python_locks {
-            if let Some(script) = socket_patch_core::utils::python_lock::script_of_lock(&path) {
-                read(script, &mut files);
-            }
-            read(&path, &mut files);
-        }
-        if project.contains("rush.json") {
-            if read(RUSH_COMMON_LOCK_REL, &mut files) {
-                rush_lock_keys.push(RUSH_COMMON_LOCK_REL.to_string());
-            }
-            for (name, is_dir) in project.children(RUSH_SUBSPACES_DIR) {
-                if !is_dir {
-                    continue;
-                }
-                let key = format!("{RUSH_SUBSPACES_DIR}/{name}/pnpm-lock.yaml");
-                if read(&key, &mut files) {
-                    rush_lock_keys.push(key);
-                }
-            }
-        }
-    }
-    symlinked_reads.sort();
-    symlinked_reads.dedup();
-    unreadable_reads.sort();
-    unreadable_reads.dedup();
-
-    let mut wheels: Vec<(String, String)> = Vec::new();
-    for dep in candidates
-        .iter()
-        .map(|c| &c.dep)
-        .filter(|dep| dep.ecosystem == "pypi")
-    {
-        let Some(sha256) = dep.integrity.sha256.as_deref() else {
-            continue;
-        };
-        if !dep
-            .artifact_url
-            .split(['?', '#'])
-            .next()
-            .is_some_and(|path| path.ends_with(".whl"))
-        {
-            continue;
-        }
-        let native_target = files
-            .iter()
-            .filter(|(path, _)| {
-                *path == "uv.lock"
-                    || socket_patch_core::utils::python_lock::is_script_lock_name(path)
-            })
-            .any(|(_, text)| {
-                socket_patch_core::utils::python_lock::rewrite_python_lock(
-                    text,
-                    &dep.name,
-                    &dep.version,
-                    socket_patch_core::utils::python_lock::ArtifactSource::Url(&dep.artifact_url),
-                    sha256,
-                )
-                .ok()
-                .flatten()
-                .is_some()
-            });
-        if native_target {
-            wheels.push((dep.artifact_url.clone(), sha256.to_string()));
-        }
-    }
-
-    Ok(Planned {
-        project,
-        candidates,
-        skipped,
-        pre_warnings,
-        files,
-        rush_lock_keys,
-        bun_lock_present,
-        symlinked_reads,
-        unreadable_reads,
-        wheels,
-        vlt_preflight,
-    })
-}
-
-/// A project's rewrite, ready for the record fetch and the ledger merge.
-#[derive(Debug)]
-pub(crate) struct Rewritten {
-    pub(crate) planned: Planned,
-    pub(crate) rewrite: RewriteResult,
-    pub(crate) rewritten: Vec<String>,
-    pub(crate) confirmed: Vec<(String, String)>,
-    pub(crate) rush_warnings: Vec<serde_json::Value>,
-    pub(crate) pnpm_warnings: Vec<serde_json::Value>,
-    pub(crate) npm_warnings: Vec<serde_json::Value>,
-}
-
-/// The `.npmrc` read the allow-remote planner classifies (disk:
-/// `read_npmrc_for_allow_remote`).
-fn read_npmrc(project: &MemoryProject) -> Result<Option<String>, String> {
-    match project.get(NPMRC_REL) {
-        None => Ok(None),
-        Some(MemoryEntry::Symlink) => {
-            Err("is a symbolic link (socket-patch never writes through one)".into())
-        }
-        Some(MemoryEntry::Text(text)) => Ok(Some(text.to_string())),
-        Some(MemoryEntry::Binary(_)) => {
-            Err("could not be read (stream did not contain valid UTF-8)".into())
-        }
-        Some(MemoryEntry::Present) => {
-            Err("could not be read (file content was not provided)".into())
-        }
-    }
-}
-
-/// Wheel metadata → rewrite → install-policy configs → confirmation →
-/// symlink guard.
-pub(crate) fn rewrite(
-    mut planned: Planned,
-    wheel_metadata: &BTreeMap<String, Result<Option<String>, String>>,
-    options: StageOptions,
-) -> Result<Rewritten, Refused> {
-    let project = &planned.project;
-    let files = &planned.files;
-
-    let mut python_metadata: BTreeMap<String, String> = BTreeMap::new();
-    let mut unavailable: BTreeSet<String> = BTreeSet::new();
-    for (url, _) in &planned.wheels {
-        match wheel_metadata.get(url) {
-            Some(Ok(Some(metadata))) => {
-                python_metadata.insert(url.clone(), metadata.clone());
-            }
-            Some(Ok(None)) => {}
-            Some(Err(detail)) => {
-                if unavailable.insert(url.clone()) {
-                    for dep in planned
-                        .candidates
-                        .iter()
-                        .map(|c| &c.dep)
-                        .filter(|d| &d.artifact_url == url)
-                    {
-                        planned.skipped.push(SkippedPatch {
-                            purl: format!("pkg:pypi/{}@{}", dep.name, dep.version),
-                            uuid: dep.patch_uuid.clone(),
-                            reason: "python_metadata_unavailable".to_string(),
-                            detail: Some(detail.replace(&dep.artifact_url, "<hosted artifact>")),
-                        });
-                    }
-                }
-            }
-            None => {
-                unavailable.insert(url.clone());
-            }
-        }
-    }
-    planned
-        .candidates
-        .retain(|c| !unavailable.contains(&c.dep.artifact_url));
-    let candidates = &planned.candidates;
-    let overrides: Vec<DepOverride> = candidates.iter().map(|c| c.dep.clone()).collect();
-
-    let targets_pipenv_lock =
-        socket_patch_core::patch::redirect::pipenv_lock_targets(files, &overrides);
-    let pipenv_major = if targets_pipenv_lock {
-        options.pipenv_major
-    } else {
-        None
-    };
-    let binary_bun = !planned.bun_lock_present && project.contains("bun.lockb");
-    let binary_content: Option<Result<Vec<u8>, RewriteWarning>> =
-        if binary_bun && overrides.iter().any(|o| o.ecosystem == "npm") {
-            let read = match project.get("bun.lockb") {
-                Some(MemoryEntry::Binary(bytes)) => Ok(bytes.to_vec()),
-                Some(MemoryEntry::Text(text)) => Ok(text.as_bytes().to_vec()),
-                _ => Err("file content was not provided".to_string()),
-            };
-            Some(
-                read.map_err(|e| RewriteWarning {
-                    code: "redirect_bun_lockb_invalid".into(),
-                    detail: format!("cannot read bun.lockb: {e}"),
-                })
-                .and_then(|bytes| {
-                    socket_patch_core::patch::redirect::preflight_bun_binary(&bytes)?;
-                    Ok(bytes)
-                }),
-            )
-        } else {
-            None
-        };
-    let rewrite_overrides: Vec<DepOverride> = overrides
-        .iter()
-        .filter(|o| !(binary_content.as_ref().is_some_and(Result::is_err) && o.ecosystem == "npm"))
-        .cloned()
-        .collect();
-    let mut rewrite = rewrite_registry_redirect_withholding_vlt(
-        files,
-        &rewrite_overrides,
-        &python_metadata,
-        pipenv_major,
-        project.contains("bun.lockb"),
-        &planned.vlt_preflight.withheld_from_vlt,
-    );
-    if let Some(content) = binary_content {
-        rewrite
-            .warnings
-            .retain(|w| w.code != "redirect_npm_no_lockfile");
-        match content {
-            Ok(bytes) => socket_patch_core::patch::redirect::rewrite_bun_binary(
-                &bytes,
-                &overrides,
-                &mut rewrite,
-            ),
-            Err(warning) => rewrite.warnings.push(warning),
-        }
-    }
-
-    if targets_pipenv_lock && pipenv_major.is_none() && rewrite.files.contains_key("Pipfile.lock") {
-        rewrite.warnings.push(RewriteWarning {
-            code: "redirect_pipenv_installer_unknown".into(),
-            detail: "The scan did not set `pipenvMajor`, so the Pipfile.lock references use the modern `file` form (Pipenv 2018 and later). A project installed with Pipenv 7–11 needs `path` references instead: re-run the scan with `pipenvMajor` set to that Pipenv major version.".into(),
-        });
-    }
-
-    let mut rush_warnings: Vec<serde_json::Value> = Vec::new();
-    if planned
-        .rush_lock_keys
-        .iter()
-        .any(|key| rewrite.files.contains_key(key))
-        && (project.contains(RUSH_REPO_STATE_REL))
-    {
-        rush_warnings.push(serde_json::json!({
-            "code": "redirect_rush_repo_state_stale",
-            "detail":
-                "pnpm-lock.yaml was edited outside `rush update`; if \
-                 preventManualShrinkwrapChanges is enabled, `rush install` fails until \
-                 `rush update` refreshes repo-state.json (the hosted wiring survives `rush \
-                 update`)",
-        }));
-    }
-
-    let mut pnpm_warnings: Vec<serde_json::Value> = Vec::new();
-    let mut trust_config_write: Option<(String, FileEdit)> = None;
-    let mut workspace_symlink_write = false;
-    {
-        let mut pnpm_lock_texts: Vec<&String> = rewrite
-            .files
-            .iter()
-            .filter(|(key, _)| {
-                std::path::Path::new(key)
-                    .file_name()
-                    .and_then(|n| n.to_str())
-                    .is_some_and(|name| matches!(name, "pnpm-lock.yaml" | "shrinkwrap.yaml"))
-            })
-            .map(|(_, content)| content)
-            .collect();
-        let heal_root: Option<&String> = pnpm_heal_root(
-            rewrite.files.contains_key("pnpm-lock.yaml"),
-            files.get("pnpm-lock.yaml"),
-            &overrides,
-        );
-        if let Some(text) = heal_root {
-            pnpm_lock_texts.push(text);
-        }
-        if !pnpm_lock_texts.is_empty() {
-            let mut hosts: Vec<&str> = overrides
-                .iter()
-                .filter(|o| o.ecosystem == "npm")
-                .filter(|o| {
-                    let encoded =
-                        socket_patch_core::utils::uri::encode_uri_component(&o.artifact_url);
-                    pnpm_lock_texts.iter().any(|text| {
-                        socket_patch_core::patch::redirect::artifact_url_present(
-                            text,
-                            &o.artifact_url,
-                        ) || text.contains(encoded.as_str())
-                    })
-                })
-                .filter_map(|o| url_host(&o.artifact_url))
-                .collect();
-            hosts.sort_unstable();
-            hosts.dedup();
-            let server = if hosts.is_empty() {
-                "the hosted patch server".to_string()
-            } else {
-                format!("the hosted patch server ({})", hosts.join(", "))
-            };
-            let root_lock_v9 = heal_root
-                .and_then(|text| pnpm_lock_version_major(text))
-                .is_some_and(|major| major >= 9)
-                || rewrite
-                    .files
-                    .get("pnpm-lock.yaml")
-                    .and_then(|text| pnpm_lock_version_major(text))
-                    .is_some_and(|major| major >= 9);
-            let all_locks_legacy = pnpm_lock_texts.iter().all(|text| {
-                pnpm_lock_version_major(text).is_some_and(|major| major < 9)
-                    || text
-                        .lines()
-                        .any(|line| line.starts_with("shrinkwrapVersion:"))
-            });
-            let workspace: Result<Option<String>, std::io::Error> =
-                match project.get(PNPM_WORKSPACE_REL) {
-                    None => Ok(None),
-                    Some(MemoryEntry::Text(text)) => Ok(Some(text.to_string())),
-                    Some(MemoryEntry::Symlink) => {
-                        workspace_symlink_write = true;
-                        Ok(None)
-                    }
-                    Some(MemoryEntry::Binary(_)) => Err(std::io::Error::new(
-                        std::io::ErrorKind::InvalidData,
-                        "stream did not contain valid UTF-8",
-                    )),
-                    Some(MemoryEntry::Present) => Err(std::io::Error::new(
-                        std::io::ErrorKind::InvalidData,
-                        "file content was not provided",
-                    )),
-                };
-            let detail = if all_locks_legacy {
-                workspace_symlink_write = false;
-                pnpm_trust_legacy_detail(&server)
-            } else if !root_lock_v9 || !options.trust_lockfile_config {
-                workspace_symlink_write = false;
-                pnpm_trust_manual_guidance(&server)
-            } else {
-                match workspace {
-                    Err(e) => pnpm_trust_workspace_unreadable_detail(&server, &e),
-                    Ok(ws_existing) => match plan_workspace_trust(ws_existing.as_deref()) {
-                        TrustPlan::Create(text) => {
-                            trust_config_write = Some((
-                                text,
-                                FileEdit {
-                                    path: PNPM_WORKSPACE_REL.into(),
-                                    kind: REDIRECT_PNPM_WORKSPACE_TRUST_EDIT_KIND.into(),
-                                    action: "created".into(),
-                                    key: Some("trustLockfile".into()),
-                                    original: None,
-                                    new: Some(serde_json::json!("true")),
-                                },
-                            ));
-                            pnpm_trust_configured_detail(&server, true, options.dry_run)
-                        }
-                        TrustPlan::Append(text) => {
-                            trust_config_write = Some((
-                                text,
-                                FileEdit {
-                                    path: PNPM_WORKSPACE_REL.into(),
-                                    kind: REDIRECT_PNPM_WORKSPACE_TRUST_EDIT_KIND.into(),
-                                    action: "added".into(),
-                                    key: Some("trustLockfile".into()),
-                                    original: None,
-                                    new: Some(serde_json::json!("true")),
-                                },
-                            ));
-                            pnpm_trust_configured_detail(&server, false, options.dry_run)
-                        }
-                        TrustPlan::AlreadyTrue => format!(
-                            "{}, and {PNPM_WORKSPACE_REL} already carries `trustLockfile: \
-                             true` — keep it committed alongside the lock; installs need \
-                             no extra flags. {PNPM_TRUST_TRADEOFF_AND_CAUTION}",
-                            pnpm_trust_policy_preamble(&server),
-                        ),
-                        TrustPlan::UserSet(value) => format!(
-                            "{}. {PNPM_WORKSPACE_REL} explicitly sets `trustLockfile: \
-                         {value}`, which was respected and left untouched — install \
-                         with `pnpm install --trust-lockfile`, or set `trustLockfile: \
-                         true` yourself so every install accepts the patched \
-                         artifacts. {PNPM_TRUST_TRADEOFF_AND_CAUTION}",
-                            pnpm_trust_policy_preamble(&server),
-                        ),
-                    },
-                }
-            };
-            let store_note = if pnpm_lock_texts
-                .iter()
-                .any(|text| pnpm_lock_may_need_store_flag(text))
-            {
-                " (pnpm 1–4 spell the option `--store`)"
-            } else {
-                ""
-            };
-            pnpm_warnings.push(serde_json::json!({
-                "code": "redirect_pnpm_trust_lockfile",
-                "detail": format!(
-                    "{}. After a lock-only change, existing node_modules or a warm pnpm store \
-                     can still contain upstream files. For a reliable reinstall, use a clean \
-                     node_modules tree and an empty store with \
-                     `pnpm install --frozen-lockfile --store-dir <new-empty-directory>`\
-                     {store_note}. Do not rely on `--force`: some versions re-resolve the \
-                     upstream artifact. Run `socket-patch vex` after installation to verify \
-                     the patched files.",
-                    detail.trim_end_matches('.')
-                ),
-            }));
-        }
-    }
-    if workspace_symlink_write {
-        return Err(symlink_refusal(PNPM_WORKSPACE_REL));
-    }
-
-    let mut npm_warnings: Vec<serde_json::Value> = Vec::new();
-    let mut npmrc_config_write: Option<(String, FileEdit)> = None;
-    {
-        let npm_hosts: Vec<&str> = {
-            let mut hosts: Vec<&str> = overrides
-                .iter()
-                .filter(|o| o.ecosystem == "npm")
-                .filter(|o| {
-                    NPM_LOCKS.iter().any(|lock| {
-                        rewrite
-                            .files
-                            .get(*lock)
-                            .or_else(|| files.get(*lock))
-                            .is_some_and(|text| {
-                                socket_patch_core::patch::redirect::artifact_url_present(
-                                    text,
-                                    &o.artifact_url,
-                                )
-                            })
-                    })
-                })
-                .filter_map(|o| url_host(&o.artifact_url))
-                .collect();
-            hosts.sort_unstable();
-            hosts.dedup();
-            hosts
-        };
-        if !npm_hosts.is_empty() {
-            let edit = |action: &str| FileEdit {
-                path: NPMRC_REL.into(),
-                kind: NPMRC_ALLOW_REMOTE_EDIT_KIND.into(),
-                action: action.into(),
-                key: Some("allow-remote".into()),
-                original: None,
-                new: Some(serde_json::json!("all")),
-            };
-            let outer = OuterAllowRemote::default();
-            let detail = match read_npmrc(project) {
-                Ok(existing) => match plan_npmrc_allow_remote_with(existing.as_deref(), &outer) {
-                    NpmrcPlan::AlreadyAll => npm_allow_remote_already_detail(&npm_hosts),
-                    NpmrcPlan::UserSet(value) => {
-                        npm_allow_remote_user_set_detail(&npm_hosts, &value)
-                    }
-                    NpmrcPlan::EnvSet { var, value } => {
-                        npm_allow_remote_env_set_detail(&npm_hosts, &var, &value)
-                    }
-                    NpmrcPlan::OuterSet { layer, path, value } => {
-                        npm_allow_remote_outer_set_detail(&npm_hosts, layer, &path, &value)
-                    }
-                    NpmrcPlan::Unsupported(why) => {
-                        npm_allow_remote_unreadable_detail(&npm_hosts, &why)
-                    }
-                    _ if !options.npm_allow_remote_config => {
-                        npm_allow_remote_manual_detail(&npm_hosts)
-                    }
-                    NpmrcPlan::Create(text) => {
-                        npmrc_config_write = Some((text, edit("created")));
-                        npm_allow_remote_configured_detail(&npm_hosts, true, options.dry_run)
-                    }
-                    NpmrcPlan::Append(text) => {
-                        npmrc_config_write = Some((text, edit("added")));
-                        npm_allow_remote_configured_detail(&npm_hosts, false, options.dry_run)
-                    }
-                },
-                Err(why) => npm_allow_remote_unreadable_detail(&npm_hosts, &why),
-            };
-            npm_warnings.push(serde_json::json!({
-                "code": "redirect_npm_allow_remote",
-                "detail": detail,
-            }));
-        }
-    }
-    if let Some((text, edit)) = trust_config_write {
-        rewrite.files.insert(PNPM_WORKSPACE_REL.to_string(), text);
-        rewrite.edits.push(edit);
-    }
-    if let Some((text, edit)) = npmrc_config_write {
-        rewrite.files.insert(NPMRC_REL.to_string(), text);
-        rewrite.edits.push(edit);
-    }
-    let rewritten: Vec<String> = rewrite
-        .files
-        .keys()
-        .chain(rewrite.binary_files.keys())
-        .cloned()
-        .collect();
-
-    let pdm_inactive =
-        files.contains_key("pdm.lock") && !socket_patch_core::patch::redirect::pdm_drives(files);
-    // A `vlt-lock.json` the vlt rewrite was withheld from may still hold an
-    // earlier run's pin: only the sibling lock this run rewrote confirms it.
-    let final_texts: Vec<(&str, &String)> = files
-        .iter()
-        .filter(|(name, _)| !(pdm_inactive && name.as_str() == "pdm.lock"))
-        .map(|(name, content)| (name.as_str(), rewrite.files.get(name).unwrap_or(content)))
-        .chain(
-            rewrite
-                .files
-                .iter()
-                .filter(|(name, _)| !files.contains_key(*name))
-                .map(|(name, content)| (name.as_str(), content)),
-        )
-        .collect();
-    let confirmed: Vec<(String, String)> = candidates
-        .iter()
-        .filter(|c| {
-            let purl = c.purl.as_str();
-            let uuid = c.dep.patch_uuid.as_str();
-            // vlt decides before the binary-bun rule, as on disk.
-            if rewrite.refused_vlt_uuids.contains(uuid) {
-                return false;
-            }
-            if rewrite.vlt_drives && purl.starts_with("pkg:npm/") {
-                return rewrite.confirmed_vlt_uuids.contains(uuid);
-            }
-            if binary_bun && purl.starts_with("pkg:npm/") {
-                return rewrite.confirmed_bun_binary_uuids.contains(uuid);
-            }
-            if rewrite.refused_pipenv_uuids.contains(uuid) {
-                return false;
-            }
-            if rewrite.refused_pdm_uuids.contains(uuid) {
-                return false;
-            }
-            if purl.starts_with("pkg:pypi/")
-                && socket_patch_core::patch::redirect::pdm_drives(files)
-            {
-                return rewrite.confirmed_pdm_uuids.contains(uuid);
-            }
-            if rewrite.python_lock_uuids.contains(uuid) {
-                return rewrite.confirmed_python_lock_uuids.contains(uuid)
-                    && !rewrite.refused_python_lock_uuids.contains(uuid);
-            }
-            if rewrite.hatch_uuids.contains(uuid) {
-                return rewrite.confirmed_hatch_uuids.contains(uuid);
-            }
-            if purl.starts_with("pkg:pypi/") {
-                return rewrite.confirmed_pipenv_uuids.contains(uuid)
-                    || rewrite.confirmed_requirements_uuids.contains(uuid);
-            }
-            if rewrite.refused_pnpm_uuids.contains(uuid) {
-                return false;
-            }
-            if purl.starts_with("pkg:cargo/") {
-                return rewrite.confirmed_cargo_uuids.contains(uuid);
-            }
-            if purl.starts_with("pkg:golang/") {
-                return rewrite.confirmed_golang_uuids.contains(uuid);
-            }
-            let artifact_url = c.dep.artifact_url.as_str();
-            let registry = c.dep.registry_override.as_ref();
-            let index_url = registry.map(|o| o.index_url.as_str());
-            let suffixed_version =
-                registry.and_then(|o| o.identifiers.maven_suffixed_version.as_deref());
-            let encoded = socket_patch_core::utils::uri::encode_uri_component(artifact_url);
-            let vlt_withheld = planned.vlt_preflight.withheld_from_vlt.contains(uuid);
-            final_texts.iter().any(|(name, text)| {
-                if vlt_withheld && *name == VLT_LOCK {
-                    return false;
-                }
-                socket_patch_core::patch::redirect::artifact_url_present(text, artifact_url)
-                    || text.contains(encoded.as_str())
-                    || index_url.is_some_and(|iu| text.contains(iu))
-                    || suffixed_version.is_some_and(|sv| text.contains(sv))
-            })
-        })
-        .map(|c| (c.purl.clone(), c.dep.patch_uuid.clone()))
-        .collect();
-
-    if let Some(linked) = rewrite
-        .files
-        .keys()
-        .chain(rewrite.binary_files.keys())
-        .find(|k| project.is_symlink(k))
-    {
-        return Err(symlink_refusal(linked));
-    }
-    let candidate_ecosystems: BTreeSet<&str> = candidates
-        .iter()
-        .map(|c| c.dep.ecosystem.as_str())
-        .collect();
-    if let Some(linked) = planned
-        .symlinked_reads
-        .iter()
-        .find(|rel| file_ecosystem(rel).is_some_and(|eco| candidate_ecosystems.contains(eco)))
-    {
-        return Err(symlink_refusal(linked));
-    }
-    if let Some(rel) = planned
-        .unreadable_reads
-        .iter()
-        .find(|rel| {
-            rewrite.files.contains_key(rel.as_str())
-                || file_ecosystem(rel).is_some_and(|eco| candidate_ecosystems.contains(eco))
-        })
-        .or_else(|| {
-            rewrite
-                .files
-                .keys()
-                .find(|k| matches!(project.get(k), Some(MemoryEntry::Present)))
-        })
-    {
-        return Err(unreadable_refusal(rel));
-    }
-
-    Ok(Rewritten {
-        planned,
-        rewrite,
-        rewritten,
-        confirmed,
-        rush_warnings,
-        pnpm_warnings,
-        npm_warnings,
-    })
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    fn reference(value: serde_json::Value) -> PackageVendorResult {
-        serde_json::from_value(value).unwrap()
-    }
-
-    #[test]
-    fn candidates_skip_every_unusable_reference() {
-        let mut refs: HashMap<String, PackageVendorResult> = HashMap::new();
-        refs.insert(
-            "u-pending".into(),
-            reference(serde_json::json!({"status": "pending_build"})),
-        );
-        refs.insert(
-            "u-nourl".into(),
-            reference(serde_json::json!({"status": "granted", "purl": "pkg:npm/b@1"})),
-        );
-        refs.insert(
-            "u-ok".into(),
-            reference(serde_json::json!({
-                "status": "reused",
-                "url": "https://patch.example/patch/npm/c/1/tok/u-ok/c-1.tgz",
-                "purl": "pkg:npm/c@1",
-                "artifacts": [{"kind": "tarball", "url": null, "integrity": {"sha512": "sha512-x"}}],
-                "registryOverride": null
-            })),
-        );
-        let selected = vec![
-            ("pkg:npm/a@1".to_string(), "u-missing".to_string()),
-            ("pkg:npm/p@1".to_string(), "u-pending".to_string()),
-            ("pkg:npm/b@1".to_string(), "u-nourl".to_string()),
-            ("pkg:npm/c@1".to_string(), "u-ok".to_string()),
-        ];
-        let mut skipped = Vec::new();
-        let candidates = build_candidates(&selected, &refs, &mut skipped);
-        let reasons: Vec<&str> = skipped.iter().map(|s| s.reason.as_str()).collect();
-        assert_eq!(reasons, vec!["not_found", "pending_build", "no_url"]);
-        assert_eq!(candidates.len(), 1);
-        assert_eq!(candidates[0].dep.token, "tok");
-        assert_eq!(
-            candidates[0].dep.integrity.sha512.as_deref(),
-            Some("sha512-x")
-        );
-    }
-
-    #[test]
-    fn cargo_wiring_probe_is_scoped_to_the_crate_and_version() {
-        let mut p = MemoryProject::new();
-        p.insert_text(
-            "Cargo.toml",
-            "[package]\nname = \"app\"\n\n[dependencies]\nlog = \"0.4\"\ncc = \"1\"\n\n\
-             [patch.crates-io]\nopenssl-socket-0123abcd = { package = \"openssl\", path = \
-             \".socket/vendor/cargo/0123abcd-0000-4000-8000-000000000000/openssl-0.10.66\" }\n",
-        );
-        assert!(cargo_vendored_wiring(&p, "openssl", "0.10.66"));
-        assert!(!cargo_vendored_wiring(&p, "openssl", "0.10.65"));
-        assert!(!cargo_vendored_wiring(&p, "log", "0.4.22"));
-        assert!(!cargo_vendored_wiring(&p, "cc", "1.1.0"));
-
-        let mut legacy = MemoryProject::new();
-        legacy.insert_text("Cargo.toml", "[package]\nname = \"app\"\n");
-        let config = "[patch.crates-io]\ncc = { path = \
-                      \".socket/vendor/cargo/0123abcd-0000-4000-8000-000000000000/cc-1.1.0\" }\n";
-        legacy.insert_text(".cargo/config.toml", config);
-        assert!(cargo_vendored_wiring(&legacy, "cc", "1.1.0"));
-        // cargo reads the legacy spelling when it exists.
-        legacy.insert_text(".cargo/config", "");
-        assert!(!cargo_vendored_wiring(&legacy, "cc", "1.1.0"));
-    }
-
-    fn cargo_reference(
-        uuid: &str,
-    ) -> (Vec<(String, String)>, HashMap<String, PackageVendorResult>) {
-        let purl = "pkg:cargo/serde@1.0.190";
-        let mut refs = HashMap::new();
-        refs.insert(
-            uuid.to_string(),
-            reference(serde_json::json!({
-                "status": "granted",
-                "url": format!("https://patch.example/patch/cargo/serde/1.0.190/tok/{uuid}/serde-1.0.190.crate"),
-                "purl": purl,
-                "artifacts": [{"kind": "tarball", "url": null, "integrity": {"sha256": "ab"}}],
-                "registryOverride": null
-            })),
-        );
-        (vec![(purl.to_string(), uuid.to_string())], refs)
-    }
-
-    #[test]
-    fn an_unreadable_candidate_file_refuses_its_ecosystem() {
-        let (selected, refs) = cargo_reference("u-1");
-        let mut p = MemoryProject::new();
-        p.insert_text("Cargo.toml", "[dependencies]\nserde = \"1\"\n");
-        p.insert_text(
-            "Cargo.lock",
-            "version = 3\n\n[[package]]\nname = \"serde\"\nversion = \"1.0.190\"\n\
-             source = \"registry+https://github.com/rust-lang/crates.io-index\"\n",
-        );
-        p.insert_present(".cargo/config");
-        let options = StageOptions {
-            dry_run: false,
-            pipenv_major: None,
-            trust_lockfile_config: true,
-            npm_allow_remote_config: true,
-        };
-        let unreadable = BTreeSet::from([".cargo/config".to_string()]);
-        let planned = plan(p.clone(), unreadable, &selected, &refs)
-            .unwrap_or_else(|r| panic!("{:?}", r.error));
-        assert_eq!(planned.unreadable_reads, vec![".cargo/config"]);
-        let err = rewrite(planned, &BTreeMap::new(), options).unwrap_err();
-        assert_eq!(err.error.code, UNREADABLE_REFUSAL);
-
-        // A non-UTF-8 file is absent to disk too: not a refusal.
-        let planned =
-            plan(p, BTreeSet::new(), &selected, &refs).unwrap_or_else(|r| panic!("{:?}", r.error));
-        assert!(planned.unreadable_reads.is_empty());
-    }
-
-    #[test]
-    fn file_ecosystems_cover_the_rewrite_targets() {
-        assert_eq!(file_ecosystem("package-lock.json"), Some("npm"));
-        assert_eq!(
-            file_ecosystem("common/config/rush/pnpm-lock.yaml"),
-            Some("npm")
-        );
-        assert_eq!(file_ecosystem("tool.py.lock"), Some("pypi"));
-        assert_eq!(file_ecosystem("crates/a/Cargo.toml"), Some("cargo"));
-        assert_eq!(file_ecosystem("build.gradle"), None);
-    }
-}
diff --git a/crates/socket-patch-cli/src/lib.rs b/crates/socket-patch-cli/src/lib.rs
index 7bc0e4d1..38ad79dd 100644
--- a/crates/socket-patch-cli/src/lib.rs
+++ b/crates/socket-patch-cli/src/lib.rs
@@ -8,7 +8,10 @@
 pub mod args;
 pub mod commands;
 pub(crate) mod ecosystem_dispatch;
-pub mod hosted_memory;
+/// The in-memory hosted engine, which lives in core
+/// ([`socket_patch_core::hosted::memory`]); re-exported under its old path
+/// for the `hosted-bundle` harness and the integration tests.
+pub use socket_patch_core::hosted::memory as hosted_memory;
 pub mod json_envelope;
 pub mod path_scope;
 pub mod ui;
diff --git a/crates/socket-patch-core/Cargo.toml b/crates/socket-patch-core/Cargo.toml
index 3add95f0..7bbbb82e 100644
--- a/crates/socket-patch-core/Cargo.toml
+++ b/crates/socket-patch-core/Cargo.toml
@@ -24,6 +24,8 @@ sha1 = { workspace = true }
 hex = { workspace = true }
 reqwest = { workspace = true }
 tokio = { workspace = true }
+# CancellationToken for the in-memory hosted engine (`hosted::memory`).
+tokio-util = { workspace = true }
 futures-util = { workspace = true }
 thiserror = { workspace = true }
 walkdir = { workspace = true }
diff --git a/crates/socket-patch-core/src/hosted/engine.rs b/crates/socket-patch-core/src/hosted/engine.rs
new file mode 100644
index 00000000..f6e53cd4
--- /dev/null
+++ b/crates/socket-patch-core/src/hosted/engine.rs
@@ -0,0 +1,1757 @@
+//! The hosted redirect engine: plan → rewrite → edits over a
+//! [`ProjectView`], shared verbatim by `scan`/`get --mode hosted` (a
+//! [`ProjectView::Disk`] over the checkout) and the in-memory engine
+//! ([`super::memory`], a [`ProjectView::Memory`] over the host's file set).
+//!
+//! The stages, in the order both callers run them:
+//!
+//! 1. [`build_candidates`] — reference grants → rewriter overrides.
+//! 2. [`bun_lockb_symlinked`] — the binary-lock symlink refusal.
+//! 3. vlt artifact preflight ([`super::vlt`]) + [`withhold_everywhere`].
+//! 4. (caller) the apply lock, the ledger, the vendored→hosted takeover.
+//! 5. [`read_candidate_files`] → [`wheel_targets`] → (caller) wheel metadata.
+//! 6. [`rewrite`] — the rewriters, the pnpm `trustLockfile` and npm
+//!    `allow-remote` auto-configs, and the per-ecosystem confirmation.
+//! 7. [`guard`] — the symlink / unreadable-file refusal before any write.
+//!
+//! Nothing here writes, spawns, reads the environment or touches the
+//! network: every host effect (locking, probes, record fetches, the commit
+//! of the rewritten files, the redirect ledger in [`super::ledger`]) stays
+//! with the caller.
+
+use std::collections::{BTreeMap, BTreeSet, HashMap};
+
+use serde::{Deserialize, Serialize};
+
+use crate::api::types::PackageVendorResult;
+use crate::constants::npm_family::{
+    RUSH_COMMON_LOCK_REL, RUSH_SUBSPACES_DIR, VLT_HIDDEN_LOCK_REL, VLT_LOCK,
+};
+use crate::patch::redirect::npmrc::{
+    plan_npmrc_allow_remote_with, NpmrcPlan, OuterAllowRemote, NPMRC_ALLOW_REMOTE_EDIT_KIND,
+    NPMRC_REL,
+};
+use crate::patch::redirect::presence::groups_present;
+use crate::patch::redirect::{
+    artifact_url_spellings, rewrite_registry_redirect_withholding_vlt, DepOverride, FileEdit,
+    RewriteResult, RewriteWarning,
+};
+use crate::utils::purl::purl_parts;
+use crate::vendor::lock_inventory::{MemoryEntry, ProjectView};
+
+use super::guidance::{
+    npm_allow_remote_already_detail, npm_allow_remote_configured_detail,
+    npm_allow_remote_env_set_detail, npm_allow_remote_manual_detail,
+    npm_allow_remote_outer_set_detail, npm_allow_remote_unreadable_detail,
+    npm_allow_remote_user_set_detail, npm_lock_url_needles, plan_workspace_trust, pnpm_heal_root,
+    pnpm_lock_may_need_store_flag, pnpm_lock_version_major, pnpm_trust_configured_detail,
+    pnpm_trust_legacy_detail, pnpm_trust_manual_guidance, pnpm_trust_policy_preamble,
+    pnpm_trust_workspace_unreadable_detail, read_npmrc_for_allow_remote, read_workspace_for_trust,
+    url_host, TrustPlan, NPM_LOCKS, PNPM_TRUST_TRADEOFF_AND_CAUTION, PNPM_WORKSPACE_REL,
+    REDIRECT_PNPM_WORKSPACE_TRUST_EDIT_KIND,
+};
+use super::vlt::bun_lockb_present;
+
+/// Candidate lockfiles / registry configs the redirect rewriters may touch —
+/// read from the project when present and handed to
+/// `rewrite_registry_redirect`: the [`crate::formats::registry::HOSTED`]
+/// rows of the format registry, in its read order.
+pub static REDIRECT_CANDIDATE_FILES: std::sync::LazyLock<Vec<&'static str>> =
+    std::sync::LazyLock::new(|| {
+        crate::formats::registry::paths_with(crate::formats::registry::HOSTED)
+    });
+
+/// Refusal code for a rewrite target (or a file the rewrite reads) that is
+/// a symbolic link: the writers stage next to the path and rename over it,
+/// which would replace the link with a detached copy.
+pub const SYMLINK_REFUSAL: &str = "redirect_symlinked_file_unsupported";
+
+/// Refusal code for a candidate file that exists but whose content the
+/// in-memory host did not provide (oversize, an LFS pointer,
+/// presence-only); disk would read and rewrite it.
+pub const UNREADABLE_REFUSAL: &str = "candidate_file_unreadable";
+
+/// Rush's repo-state file, whose `pnpmShrinkwrapHash` a lock edit
+/// outside `rush update` desyncs.
+pub const RUSH_REPO_STATE_REL: &str = "common/config/rush/repo-state.json";
+
+/// One granted reference: the purl it was granted for plus the rewriter
+/// override built from it. The purl is what the takeover, the skip records
+/// and the confirmation probe key on; everything the probe needs AFTER the
+/// rewrite to decide whether the dep was actually redirected (artifact
+/// URL, registry index URL, fail-closed maven's suffixed version) already
+/// rides the override. The single vector is filtered in place by every
+/// withhold/refusal step, and the rewriters' `overrides` slice is
+/// materialized from it once, after the last filter.
+#[derive(Debug, Clone)]
+pub struct Candidate {
+    pub purl: String,
+    pub dep: DepOverride,
+}
+
+/// A selected patch that was not redirected, and why (the `skipped[]`
+/// entries of the `redirect` block).
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SkippedPatch {
+    pub purl: String,
+    pub uuid: String,
+    pub reason: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub detail: Option<String>,
+}
+
+impl SkippedPatch {
+    pub fn new(purl: &str, uuid: &str, reason: &str) -> Self {
+        SkippedPatch {
+            purl: purl.to_string(),
+            uuid: uuid.to_string(),
+            reason: reason.to_string(),
+            detail: None,
+        }
+    }
+}
+
+/// A whole-project refusal: nothing is written.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Refusal {
+    pub code: String,
+    pub message: String,
+}
+
+/// The refusal for a symlinked rewrite target.
+pub fn symlink_refusal(linked: &str) -> Refusal {
+    Refusal {
+        code: SYMLINK_REFUSAL.to_string(),
+        message: format!(
+            "{linked} is a symbolic link; socket-patch rewrites files in place with an atomic \
+             rename, which would replace the link — replace the link with a regular file (or \
+             run socket-patch in the directory it points to) and re-run; nothing was written"
+        ),
+    }
+}
+
+/// The refusal for a symlinked `bun.lockb` (checked before any takeover
+/// changes wiring).
+pub fn bun_lockb_symlink_refusal() -> Refusal {
+    Refusal {
+        code: SYMLINK_REFUSAL.to_string(),
+        message: "bun.lockb is a symbolic link; replace it with a regular file (or run \
+                  socket-patch in the directory it points to) before patching; nothing was \
+                  written"
+            .to_string(),
+    }
+}
+
+fn unreadable_refusal(rel: &str) -> Refusal {
+    Refusal {
+        code: UNREADABLE_REFUSAL.to_string(),
+        message: format!(
+            "{rel} exists but its content was not provided (too large, an LFS pointer, or \
+             not fetched), so it cannot be rewritten alongside the other lockfiles; nothing \
+             was written"
+        ),
+    }
+}
+
+/// Reference grants → candidates. A selection without a usable grant is
+/// recorded in `skipped` (`not_found`, the reference status, `bad_purl`,
+/// `no_url`).
+pub fn build_candidates(
+    selected: &[(String, String)],
+    references: &HashMap<String, PackageVendorResult>,
+    skipped: &mut Vec<SkippedPatch>,
+) -> Vec<Candidate> {
+    let mut candidates = Vec::new();
+    for (sel_purl, sel_uuid) in selected {
+        let Some(reference) = references.get(sel_uuid) else {
+            skipped.push(SkippedPatch::new(sel_purl, sel_uuid, "not_found"));
+            continue;
+        };
+        if reference.status != "granted" && reference.status != "reused" {
+            skipped.push(SkippedPatch::new(sel_purl, sel_uuid, &reference.status));
+            continue;
+        }
+        let purl = reference.purl.as_deref().unwrap_or(sel_purl);
+        let Some((ecosystem, name, version)) = purl_parts(purl) else {
+            skipped.push(SkippedPatch::new(purl, sel_uuid, "bad_purl"));
+            continue;
+        };
+        let Some(url) = reference.url.clone() else {
+            skipped.push(SkippedPatch::new(purl, sel_uuid, "no_url"));
+            continue;
+        };
+        let mut integrity = reference
+            .artifacts
+            .iter()
+            .flatten()
+            .find(|a| a.kind == "tarball")
+            .map(|a| a.integrity.clone())
+            .unwrap_or_default();
+        // The yarn-berry cache zip carries the `yarnBerry10c0` checksum the
+        // berry rewriter pins (berry verifies the zip, not the tarball).
+        // Merge it in and carry the zip URL (None when not stored yet).
+        let berry_zip = reference
+            .artifacts
+            .iter()
+            .flatten()
+            .find(|a| a.kind == "yarn-berry-zip");
+        if let Some(c) = berry_zip.and_then(|a| a.integrity.yarn_berry10c0.clone()) {
+            integrity.yarn_berry10c0 = Some(c);
+        }
+        // goproxy: the hosted-Go hash pair rides the override's
+        // identifiers (the tarball's dirhashH1 is the original-path
+        // flavor, kept for vendor-mode verification); the golang rewriter
+        // reads the normalized integrity, so merge — the gopatch-flavor zip
+        // h1 REPLACES dirhashH1 here. Only both together: a half-merged
+        // pair would trip the rewriter's fail-closed integrity check by
+        // design.
+        if let Some(ov) = reference
+            .registry_override
+            .as_ref()
+            .filter(|o| o.kind == "goproxy")
+        {
+            if let (Some(zip_h1), Some(gomod_h1)) = (
+                ov.identifiers.go_zip_dirhash_h1.clone(),
+                ov.identifiers.go_mod_h1.clone(),
+            ) {
+                integrity.dirhash_h1 = Some(zip_h1);
+                integrity.go_mod_h1 = Some(gomod_h1);
+            }
+        }
+        // The grant token is never a top-level reference field — it only
+        // rides the URLs the reference endpoint hands back, as the path
+        // level before the patch uuid. Recover it so the rewriters'
+        // rotation-idempotency guards (which wildcard the token path level
+        // of a previously-written URL) don't depend on it being derivable
+        // from the URL alone (an empty token makes the gem guard nest a new
+        // source block on every re-scan).
+        let token = reference
+            .registry_override
+            .as_ref()
+            .and_then(|o| crate::patch::redirect::grant_token_path_segment(&o.index_url, sel_uuid))
+            .or_else(|| crate::patch::redirect::grant_token_path_segment(&url, sel_uuid))
+            .unwrap_or_default();
+        candidates.push(Candidate {
+            purl: purl.to_string(),
+            dep: DepOverride {
+                ecosystem,
+                name,
+                namespace: None,
+                version,
+                token,
+                patch_uuid: sel_uuid.clone(),
+                artifact_url: url,
+                berry_zip_url: berry_zip.and_then(|a| a.url.clone()),
+                registry_override: reference.registry_override.clone(),
+                integrity,
+            },
+        });
+    }
+    candidates
+}
+
+/// Whether the text `bun.lock` is present (disk: `exists`). Text retains
+/// Bun's precedence when both lock spellings are present.
+pub fn bun_lock_present(view: &ProjectView<'_>) -> bool {
+    match view {
+        ProjectView::Disk(cwd)
+        | ProjectView::Snapshot(crate::vendor::lock_inventory::DiskSnapshot {
+            root: cwd, ..
+        }) => cwd.join("bun.lock").exists(),
+        ProjectView::Memory(project) => project.contains("bun.lock"),
+    }
+}
+
+/// Whether an npm candidate would rewrite a `bun.lockb` that is a symbolic
+/// link (atomic replacement cannot preserve a link; previews refuse too).
+pub fn bun_lockb_symlinked(view: &ProjectView<'_>, candidates: &[Candidate]) -> bool {
+    candidates.iter().any(|c| c.dep.ecosystem == "npm")
+        && !bun_lock_present(view)
+        && view.is_symlink("bun.lockb")
+}
+
+/// Drop the deps the vlt preflight withheld from every rewriter, recording
+/// each as skipped.
+pub fn withhold_everywhere(
+    candidates: &mut Vec<Candidate>,
+    withheld_everywhere: &BTreeMap<String, String>,
+    skipped: &mut Vec<SkippedPatch>,
+) {
+    if withheld_everywhere.is_empty() {
+        return;
+    }
+    for (uuid, purl) in withheld_everywhere {
+        skipped.push(SkippedPatch::new(purl, uuid, super::vlt::WITHHELD_REASON));
+    }
+    candidates.retain(|c| !withheld_everywhere.contains_key(&c.dep.patch_uuid));
+}
+
+/// The project's candidate files as the rewriters read them.
+#[derive(Debug, Default)]
+pub struct CandidateFiles {
+    /// Readable candidate texts, keyed by project-relative path.
+    pub files: BTreeMap<String, String>,
+    /// The Rush locks among `files` (the repo-state warning keys on them).
+    pub rush_lock_keys: Vec<String>,
+    /// In memory only: candidate files the disk flow reads through a
+    /// symbolic link. Their bytes are unknown here, so a project whose
+    /// candidates could rewrite one is refused like the disk symlink guard
+    /// refuses the write.
+    pub symlinked_reads: Vec<String>,
+    /// In memory only: candidate files that exist without content; a
+    /// project whose candidates could rewrite (or whose rewrite depends on)
+    /// one is refused, since the rewriters would treat it as absent.
+    pub unreadable_reads: Vec<String>,
+}
+
+impl CandidateFiles {
+    /// Read `rel` into `files`: `true` when it was read.
+    async fn read(
+        &mut self,
+        view: &ProjectView<'_>,
+        unreadable: &BTreeSet<String>,
+        rel: &str,
+    ) -> bool {
+        let text = match view {
+            // Every disk read goes through the FIFO-safe reader
+            // (non-blocking open + fstat regular-file check), so a FIFO
+            // under a candidate name is skipped like a missing file instead
+            // of wedging the run in open(2).
+            ProjectView::Disk(_) | ProjectView::Snapshot(_) => view.read_text(rel).await.ok(),
+            ProjectView::Memory(project) => {
+                if project.is_symlink(rel) {
+                    self.symlinked_reads.push(rel.to_string());
+                    return false;
+                }
+                if unreadable.contains(rel) {
+                    self.unreadable_reads.push(rel.to_string());
+                    return false;
+                }
+                // Disk reads any UTF-8 regular file; a non-UTF-8 one is
+                // absent to it as well.
+                match project.get(rel) {
+                    Some(MemoryEntry::Text(text)) => Some(text.to_string()),
+                    Some(MemoryEntry::Binary(bytes)) => {
+                        std::str::from_utf8(bytes).ok().map(str::to_string)
+                    }
+                    _ => None,
+                }
+            }
+        };
+        match text {
+            Some(text) => {
+                self.files.insert(rel.to_string(), text);
+                true
+            }
+            None => false,
+        }
+    }
+}
+
+/// The root-level Python lock names (sorted).
+async fn python_lock_paths(view: &ProjectView<'_>) -> Vec<String> {
+    match view {
+        ProjectView::Disk(cwd)
+        | ProjectView::Snapshot(crate::vendor::lock_inventory::DiskSnapshot {
+            root: cwd, ..
+        }) => crate::utils::python_lock::python_lock_paths(cwd).unwrap_or_default(),
+        ProjectView::Memory(project) => project
+            .children("")
+            .into_iter()
+            .filter(|(name, is_dir)| {
+                !is_dir && crate::utils::python_lock::is_python_lock_name(name)
+            })
+            .map(|(name, _)| name)
+            .collect(),
+    }
+}
+
+/// Whether the project is a Rush monorepo (disk: `rush.json` is a file).
+fn rush_repo(view: &ProjectView<'_>) -> bool {
+    match view {
+        ProjectView::Disk(cwd)
+        | ProjectView::Snapshot(crate::vendor::lock_inventory::DiskSnapshot {
+            root: cwd, ..
+        }) => cwd.join("rush.json").is_file(),
+        ProjectView::Memory(project) => project.contains("rush.json"),
+    }
+}
+
+/// Read the project's candidate files: [`REDIRECT_CANDIDATE_FILES`], the
+/// Cargo workspace members (when a cargo candidate meets a root
+/// `Cargo.toml`), the Python locks and their scripts, and the Rush locks.
+/// `unreadable` are the in-memory paths that exist without content.
+pub async fn read_candidate_files(
+    view: &ProjectView<'_>,
+    unreadable: &BTreeSet<String>,
+    candidates: &[Candidate],
+) -> CandidateFiles {
+    let mut out = CandidateFiles::default();
+    for name in REDIRECT_CANDIDATE_FILES.iter() {
+        // The binary lock is read and rewritten directly.
+        if *name == "bun.lockb" {
+            continue;
+        }
+        // The hidden lock is only the install-state sentinel, never read.
+        if *name == VLT_HIDDEN_LOCK_REL {
+            if super::vlt::install_state_present(view) {
+                out.files.insert((*name).to_string(), String::new());
+            }
+            continue;
+        }
+        out.read(view, unreadable, name).await;
+    }
+
+    // Cargo workspace members (and in-root path dependencies) declare
+    // dependencies of their own: a member's direct `cfg-if = "1"` must be
+    // pinned alongside the root's, or the redirected lock entry is
+    // unsatisfiable. Keyed `<dir>/Cargo.toml` for the cargo rewriter.
+    if out.files.contains_key("Cargo.toml") && candidates.iter().any(|c| c.dep.ecosystem == "cargo")
+    {
+        for rel in crate::utils::cargo_workspace::member_manifests_in(view) {
+            out.read(view, unreadable, &rel).await;
+        }
+    }
+
+    for path in python_lock_paths(view).await {
+        if let Some(script) = crate::utils::python_lock::script_of_lock(&path) {
+            out.read(view, unreadable, script).await;
+        }
+        out.read(view, unreadable, &path).await;
+    }
+
+    // Rush monorepos have no root package.json/lock pair: the single pnpm
+    // source-of-truth lock lives at common/config/rush/pnpm-lock.yaml, and
+    // (when subspaces are enabled) one lock per subspace under
+    // common/config/subspaces/<name>/. Added under their repo-relative
+    // keys — the pnpm rewriter is basename-generalized, so nested keys are
+    // rewritten in place, and the write-back is path-generic.
+    if rush_repo(view) {
+        if out.read(view, unreadable, RUSH_COMMON_LOCK_REL).await {
+            out.rush_lock_keys.push(RUSH_COMMON_LOCK_REL.to_string());
+        }
+        // Sorted by name: deterministic output.
+        if let Ok(entries) = view.list_dir(RUSH_SUBSPACES_DIR).await {
+            for entry in entries.into_iter().filter(|e| e.is_dir) {
+                let key = format!("{RUSH_SUBSPACES_DIR}/{}/pnpm-lock.yaml", entry.name);
+                if out.read(view, unreadable, &key).await {
+                    out.rush_lock_keys.push(key);
+                }
+            }
+        }
+    }
+    out.symlinked_reads.sort();
+    out.symlinked_reads.dedup();
+    out.unreadable_reads.sort();
+    out.unreadable_reads.dedup();
+    out
+}
+
+/// The pypi wheels whose metadata a native lock rewrite needs, in
+/// candidate order: `(override, sha256)` of every `.whl` artifact some
+/// `uv.lock` / PEP 723 script lock would rewrite. Each native lock is
+/// parsed once, on the first dep that needs the probe.
+pub fn wheel_targets<'a>(
+    candidates: &'a [Candidate],
+    files: &BTreeMap<String, String>,
+) -> Vec<(&'a DepOverride, &'a str)> {
+    use crate::utils::python_lock::{ArtifactSource, PythonLockProbe};
+    let mut probes: Option<Vec<PythonLockProbe>> = None;
+    let mut out = Vec::new();
+    for dep in candidates
+        .iter()
+        .map(|c| &c.dep)
+        .filter(|dep| dep.ecosystem == "pypi")
+    {
+        let Some(sha256) = dep.integrity.sha256.as_deref() else {
+            continue;
+        };
+        if !dep
+            .artifact_url
+            .split(['?', '#'])
+            .next()
+            .is_some_and(|path| path.ends_with(".whl"))
+        {
+            continue;
+        }
+        let native_target = probes
+            .get_or_insert_with(|| {
+                files
+                    .iter()
+                    .filter(|(path, _)| {
+                        *path == "uv.lock" || crate::utils::python_lock::is_script_lock_name(path)
+                    })
+                    .map(|(_, text)| PythonLockProbe::new(text))
+                    .collect()
+            })
+            .iter()
+            .any(|probe| {
+                probe.rewrites(
+                    &dep.name,
+                    &dep.version,
+                    ArtifactSource::Url(&dep.artifact_url),
+                )
+            });
+        if native_target {
+            out.push((dep, sha256));
+        }
+    }
+    out
+}
+
+/// The skip recorded for a pypi dep whose wheel metadata could not be
+/// fetched (the grant token in `detail` is redacted to `<hosted artifact>`).
+pub fn wheel_metadata_unavailable(dep: &DepOverride, detail: &str) -> SkippedPatch {
+    SkippedPatch {
+        purl: format!("pkg:pypi/{}@{}", dep.name, dep.version),
+        uuid: dep.patch_uuid.clone(),
+        reason: "python_metadata_unavailable".to_string(),
+        detail: Some(detail.replace(&dep.artifact_url, "<hosted artifact>")),
+    }
+}
+
+/// Whether a pypi candidate targets an entry of the project's
+/// `Pipfile.lock` (only then does the installing Pipenv's major matter).
+pub fn pipenv_lock_targets(files: &BTreeMap<String, String>, candidates: &[Candidate]) -> bool {
+    if !files.contains_key("Pipfile.lock") {
+        return false;
+    }
+    let overrides: Vec<DepOverride> = candidates.iter().map(|c| c.dep.clone()).collect();
+    crate::patch::redirect::pipenv_lock_targets(files, &overrides)
+}
+
+/// A dry-run vendored→hosted takeover the disk caller withheld from the
+/// rewriters: its artifact URL and the root locks its vendored wiring
+/// lives in (the wet run splices the hosted URL there, so the
+/// install-policy auto-configs are previewed for those locks).
+#[derive(Debug, Clone)]
+pub struct TakeoverPreview {
+    pub artifact_url: String,
+    pub locks: Vec<String>,
+}
+
+/// The host-dependent inputs of [`rewrite`].
+pub struct RewriteOptions<'a> {
+    pub dry_run: bool,
+    /// Whether a pypi candidate targets `Pipfile.lock`
+    /// ([`pipenv_lock_targets`]) and the installing Pipenv's major (`None`
+    /// when unknown or not targeted).
+    pub targets_pipenv_lock: bool,
+    pub pipenv_major: Option<u32>,
+    /// The `redirect_pipenv_installer_unknown` detail (the remedy names the
+    /// host's own knob).
+    pub pipenv_unknown_detail: String,
+    /// `false` under `--no-trust-lockfile-config`.
+    pub trust_lockfile_config: bool,
+    /// `false` under `--no-npm-allow-remote-config`.
+    pub npm_allow_remote_config: bool,
+    /// The npm config layers outside the project `.npmrc`, resolved only
+    /// when an npm lock carries a hosted URL.
+    pub npm_outer: &'a (dyn Fn() -> OuterAllowRemote + Send + Sync),
+    /// Run the rewriters on the blocking pool (the disk flow: pure CPU over
+    /// every lock text).
+    pub blocking: bool,
+}
+
+/// One project's rewrite, ready for the guard, the record fetch and the
+/// commit.
+#[derive(Debug)]
+pub struct Rewritten {
+    /// The pre-rewrite candidate texts.
+    pub files: BTreeMap<String, String>,
+    pub symlinked_reads: Vec<String>,
+    pub unreadable_reads: Vec<String>,
+    /// The rewriters' override slice (the candidates' deps).
+    pub overrides: Vec<DepOverride>,
+    pub rewrite: RewriteResult,
+    /// Every file this run writes (text and binary), sorted.
+    pub rewritten: Vec<String>,
+    /// `(purl, uuid)` of each candidate whose redirect is pinned by the
+    /// project's final files, in candidate order.
+    pub confirmed: Vec<(String, String)>,
+    /// A `bun.lockb` without a text `bun.lock` drives npm.
+    pub binary_bun: bool,
+    pub rush_warnings: Vec<RewriteWarning>,
+    pub pnpm_warnings: Vec<RewriteWarning>,
+    pub npm_warnings: Vec<RewriteWarning>,
+    /// Human mode: this run touched nothing pnpm-related (no lock spliced,
+    /// trust already configured), so the full guidance shrinks to a
+    /// one-line reminder.
+    pub pnpm_rerun_only: bool,
+    /// In memory only: the trust auto-config would write through a
+    /// symlinked `pnpm-workspace.yaml`.
+    pub(crate) workspace_symlinked: bool,
+}
+
+/// The pnpm-workspace.yaml read, classified for the trust auto-config
+/// (see [`read_workspace_for_trust`]), plus whether it is an in-memory
+/// symbolic link (absent to the planner, refused by [`guard`]).
+fn read_workspace(view: &ProjectView<'_>) -> (std::io::Result<Option<String>>, bool) {
+    match view {
+        ProjectView::Disk(cwd)
+        | ProjectView::Snapshot(crate::vendor::lock_inventory::DiskSnapshot {
+            root: cwd, ..
+        }) => (
+            read_workspace_for_trust(&cwd.join(PNPM_WORKSPACE_REL)),
+            false,
+        ),
+        ProjectView::Memory(project) => match project.get(PNPM_WORKSPACE_REL) {
+            None => (Ok(None), false),
+            Some(MemoryEntry::Text(text)) => (Ok(Some(text.to_string())), false),
+            Some(MemoryEntry::Symlink) => (Ok(None), true),
+            Some(MemoryEntry::Binary(_)) => (
+                Err(std::io::Error::new(
+                    std::io::ErrorKind::InvalidData,
+                    "stream did not contain valid UTF-8",
+                )),
+                false,
+            ),
+            Some(MemoryEntry::Present) => (
+                Err(std::io::Error::new(
+                    std::io::ErrorKind::InvalidData,
+                    "file content was not provided",
+                )),
+                false,
+            ),
+        },
+    }
+}
+
+/// The project `.npmrc` read, classified for the allow-remote planner (see
+/// [`read_npmrc_for_allow_remote`]).
+fn read_npmrc(view: &ProjectView<'_>) -> Result<Option<String>, String> {
+    match view {
+        ProjectView::Disk(cwd)
+        | ProjectView::Snapshot(crate::vendor::lock_inventory::DiskSnapshot {
+            root: cwd, ..
+        }) => read_npmrc_for_allow_remote(&cwd.join(NPMRC_REL)),
+        ProjectView::Memory(project) => match project.get(NPMRC_REL) {
+            None => Ok(None),
+            Some(MemoryEntry::Symlink) => {
+                Err("is a symbolic link (socket-patch never writes through one)".into())
+            }
+            Some(MemoryEntry::Text(text)) => Ok(Some(text.to_string())),
+            Some(MemoryEntry::Binary(_)) => {
+                Err("could not be read (stream did not contain valid UTF-8)".into())
+            }
+            Some(MemoryEntry::Present) => {
+                Err("could not be read (file content was not provided)".into())
+            }
+        },
+    }
+}
+
+/// Whether Rush's repo-state file is present (disk: a regular file).
+fn rush_repo_state_present(view: &ProjectView<'_>) -> bool {
+    match view {
+        ProjectView::Disk(cwd)
+        | ProjectView::Snapshot(crate::vendor::lock_inventory::DiskSnapshot {
+            root: cwd, ..
+        }) => cwd.join(RUSH_REPO_STATE_REL).is_file(),
+        ProjectView::Memory(project) => project.contains(RUSH_REPO_STATE_REL),
+    }
+}
+
+/// How the confirmation probe settles one candidate: a non-substring rule
+/// (a transactional rewriter's own report, a refusal) decides it outright,
+/// otherwise it is confirmed iff any of its needles occurs in a final text.
+enum ProbeStep {
+    Decided(bool),
+    Needles(Vec<String>),
+    /// [`Self::Needles`], searched in every final text but `vlt-lock.json`
+    /// (a dep withheld from the vlt rewrite).
+    NeedlesOutsideVlt(Vec<String>),
+}
+
+/// The substrings whose presence in a final text confirms `dep`'s redirect —
+/// the override's own targets: artifact URL; per-dependency registry index
+/// URL; fail-closed maven's globally-unique `-socket.<hex8>` suffixed version
+/// (never the `.pom` URL).
+///
+/// - The artifact URL in the rewriters' own spellings
+///   ([`artifact_url_spellings`], raw or the `\/`-escaped slashes an old
+///   composer.lock spells them with), so a writer's spelling can never be
+///   one this probe misses.
+/// - The percent-encoded URL: the berry rewriter writes it into the lock's
+///   `::__archiveUrl=` binding, so the raw form is absent.
+/// - The registry index URL and the maven suffixed version, when present.
+pub fn candidate_presence_needles(dep: &DepOverride) -> Vec<String> {
+    let artifact_url = dep.artifact_url.as_str();
+    let registry = dep.registry_override.as_ref();
+    let mut needles: Vec<String> = artifact_url_spellings(artifact_url).into();
+    needles.push(crate::utils::uri::encode_uri_component(artifact_url));
+    if let Some(o) = registry {
+        needles.push(o.index_url.clone());
+        if let Some(sv) = o.identifiers.maven_suffixed_version.as_deref() {
+            needles.push(sv.to_string());
+        }
+    }
+    needles
+}
+
+/// Rewrite the candidate files for `candidates`, plan the install-policy
+/// auto-configs, and confirm which redirects the final files pin.
+///
+/// `python_metadata` maps a wheel's artifact URL to its fetched METADATA;
+/// `withheld_from_vlt` are the uuids the vlt preflight kept out of the vlt
+/// rewrite; `takeover_previews` are the disk dry run's withheld takeovers.
+pub async fn rewrite(
+    view: &ProjectView<'_>,
+    read: CandidateFiles,
+    candidates: &[Candidate],
+    python_metadata: BTreeMap<String, String>,
+    withheld_from_vlt: &BTreeSet<String>,
+    takeover_previews: &[TakeoverPreview],
+    options: RewriteOptions<'_>,
+) -> Rewritten {
+    let CandidateFiles {
+        files,
+        rush_lock_keys,
+        symlinked_reads,
+        unreadable_reads,
+    } = read;
+    // The rewriters' override slice — materialized ONCE, after the last
+    // candidate filter, so it can never disagree with `candidates`.
+    let overrides: Vec<DepOverride> = candidates.iter().map(|c| c.dep.clone()).collect();
+    let bun_lockb = bun_lockb_present(view);
+    let binary_bun = !bun_lock_present(view) && bun_lockb;
+    let binary_content = if binary_bun && overrides.iter().any(|o| o.ecosystem == "npm") {
+        Some(
+            view.read_bytes("bun.lockb")
+                .await
+                .map_err(|e| RewriteWarning {
+                    code: "redirect_bun_lockb_invalid".into(),
+                    detail: format!("cannot read bun.lockb: {e}"),
+                })
+                .and_then(|bytes| {
+                    crate::patch::redirect::preflight_bun_binary(&bytes)?;
+                    Ok(bytes)
+                }),
+        )
+    } else {
+        None
+    };
+    // A malformed primary lock must not cause edits to stale npm siblings.
+    let rewrite_overrides: Vec<DepOverride> = overrides
+        .iter()
+        .filter(|o| !(binary_content.as_ref().is_some_and(Result::is_err) && o.ecosystem == "npm"))
+        .cloned()
+        .collect();
+    let pipenv_major = options.pipenv_major;
+    let (files, mut rewrite) = if options.blocking {
+        // Pure CPU over every lock text (the independent rewriter groups
+        // run concurrently inside), so it runs on the blocking pool rather
+        // than on a runtime worker; `files` comes back for the probe below.
+        let withheld = withheld_from_vlt.clone();
+        tokio::task::spawn_blocking(move || {
+            let rewrite = rewrite_registry_redirect_withholding_vlt(
+                &files,
+                &rewrite_overrides,
+                &python_metadata,
+                pipenv_major,
+                bun_lockb,
+                &withheld,
+            );
+            (files, rewrite)
+        })
+        .await
+        .unwrap_or_else(|e| match e.try_into_panic() {
+            Ok(payload) => std::panic::resume_unwind(payload),
+            Err(e) => panic!("hosted rewrite task failed: {e}"),
+        })
+    } else {
+        let rewrite = rewrite_registry_redirect_withholding_vlt(
+            &files,
+            &rewrite_overrides,
+            &python_metadata,
+            pipenv_major,
+            bun_lockb,
+            withheld_from_vlt,
+        );
+        (files, rewrite)
+    };
+    if let Some(content) = binary_content {
+        rewrite
+            .warnings
+            .retain(|w| w.code != "redirect_npm_no_lockfile");
+        match content {
+            Ok(bytes) => {
+                crate::patch::redirect::rewrite_bun_binary(&bytes, &overrides, &mut rewrite)
+            }
+            Err(warning) => rewrite.warnings.push(warning),
+        }
+    }
+
+    // Unknown installer → the modern `file` shape was chosen; say so only
+    // when the lock was (or, on --dry-run, would be) rewritten.
+    if options.targets_pipenv_lock
+        && pipenv_major.is_none()
+        && rewrite.files.contains_key("Pipfile.lock")
+    {
+        rewrite.warnings.push(RewriteWarning {
+            code: "redirect_pipenv_installer_unknown".into(),
+            detail: options.pipenv_unknown_detail.clone(),
+        });
+    }
+
+    // Editing a Rush lock outside `rush update` desyncs the
+    // pnpmShrinkwrapHash recorded in repo-state.json. When
+    // preventManualShrinkwrapChanges is enabled, `rush install` then
+    // refuses until `rush update` refreshes that hash — but the redirect
+    // survives `rush update` (pnpm preserves locked resolutions for
+    // unchanged specifiers). Warn only when the rewrite actually landed in
+    // a Rush lock and the repo-state file that carries the hash is present.
+    let mut rush_warnings: Vec<RewriteWarning> = Vec::new();
+    if rush_lock_keys
+        .iter()
+        .any(|key| rewrite.files.contains_key(key))
+        && rush_repo_state_present(view)
+    {
+        rush_warnings.push(warning(
+            "redirect_rush_repo_state_stale",
+            "pnpm-lock.yaml was edited outside `rush update`; if \
+                 preventManualShrinkwrapChanges is enabled, `rush install` fails until \
+                 `rush update` refreshes repo-state.json (the hosted wiring survives `rush \
+                 update`)",
+        ));
+    }
+
+    let (pnpm_warnings, trust_config_write, pnpm_rerun_only, workspace_symlinked) = pnpm_trust(
+        view,
+        &files,
+        &rewrite,
+        &overrides,
+        takeover_previews,
+        &options,
+    );
+    let (npm_warnings, npmrc_config_write) = npm_allow_remote(
+        view,
+        &files,
+        &rewrite,
+        &overrides,
+        takeover_previews,
+        &options,
+    );
+    if let Some((text, edit)) = trust_config_write {
+        rewrite.files.insert(PNPM_WORKSPACE_REL.to_string(), text);
+        // Appended last: `--revert` walks edits in reverse, so the trust key
+        // is unwound before the lock originals are restored.
+        rewrite.edits.push(edit);
+    }
+    if let Some((text, edit)) = npmrc_config_write {
+        rewrite.files.insert(NPMRC_REL.to_string(), text);
+        // Appended after the lock edits for the same reason: a whole-ledger
+        // replay unwinds the setting before the lock originals it served.
+        rewrite.edits.push(edit);
+    }
+    let rewritten: Vec<String> = rewrite
+        .files
+        .keys()
+        .chain(rewrite.binary_files.keys())
+        .cloned()
+        .collect();
+    let confirmed = confirm(&files, &rewrite, candidates, binary_bun, withheld_from_vlt);
+    Rewritten {
+        files,
+        symlinked_reads,
+        unreadable_reads,
+        overrides,
+        rewrite,
+        rewritten,
+        confirmed,
+        binary_bun,
+        rush_warnings,
+        pnpm_warnings,
+        npm_warnings,
+        pnpm_rerun_only,
+        workspace_symlinked,
+    }
+}
+
+type ConfigWrite = Option<(String, FileEdit)>;
+
+/// pnpm >=11 enforces a lockfile supply-chain policy: it compares each
+/// resolution's tarball URL against the registry's published metadata and
+/// REFUSES a lock whose URLs differ: pnpm 11 with
+/// ERR_PNPM_TARBALL_URL_MISMATCH (ERR_PNPM_META_FETCH_FAIL when the
+/// registry is unreachable), pnpm 12 with
+/// ERR_PNPM_LOCKFILE_RESOLUTION_VERIFICATION, whose own text tells users
+/// to rebuild the lock — which silently discards the redirect, so the
+/// warning must pre-empt that advice. The working recoveries are
+/// `pnpm install --trust-lockfile` and the pnpm-workspace.yaml
+/// `trustLockfile: true` key; the `.npmrc` `trust-lockfile=true` spelling
+/// is IGNORED by pnpm and must never be recommended.
+///
+/// ZERO-TOUCH DEFAULT: when this run rewrote the ROOT pnpm-lock.yaml and
+/// its lockfileVersion is >= 9 (5.x/6.0 locks mean pnpm 7/8, which have
+/// neither the policy nor the flag and get their own guidance), the run
+/// auto-ensures `trustLockfile: true` in pnpm-workspace.yaml. The same
+/// auto-config re-engages on a run that spliced NOTHING when the root v9
+/// lock already carries a granted hosted artifact URL (HEAL-ON-RERUN).
+/// pnpm <=10 ignores the key; the per-entry sha512 pin still fails closed
+/// on tampered bytes. An explicit user `trustLockfile: <non-true>` is
+/// RESPECTED (never flipped), and `--no-trust-lockfile-config` opts out.
+/// Rush nested/subspace locks are excluded: rush runs pnpm in common/temp,
+/// which never reads the repo-root pnpm-workspace.yaml. The warning names
+/// the host(s) the lock now points at (they follow --api-url).
+fn pnpm_trust(
+    view: &ProjectView<'_>,
+    files: &BTreeMap<String, String>,
+    rewrite: &RewriteResult,
+    overrides: &[DepOverride],
+    takeover_previews: &[TakeoverPreview],
+    options: &RewriteOptions<'_>,
+) -> (Vec<RewriteWarning>, ConfigWrite, bool, bool) {
+    let mut pnpm_warnings: Vec<RewriteWarning> = Vec::new();
+    let mut trust_config_write: ConfigWrite = None;
+    let mut pnpm_rerun_only = false;
+    let mut workspace_symlinked = false;
+    // pnpm locks spliced THIS run (any depth — the rewriter is
+    // basename-generalized).
+    let mut pnpm_lock_texts: Vec<&String> = rewrite
+        .files
+        .iter()
+        .filter(|(key, _)| {
+            std::path::Path::new(key)
+                .file_name()
+                .and_then(|n| n.to_str())
+                .is_some_and(|name| matches!(name, "pnpm-lock.yaml" | "shrinkwrap.yaml"))
+        })
+        .map(|(_, content)| content)
+        .collect();
+    // HEAL-ON-RERUN: a root v9 lock that ALREADY carries a granted hosted
+    // artifact URL (spliced by an earlier run) still plans the trust config
+    // even though this run spliced nothing — so a project that missed the
+    // config once (opted-out first run, or a crash between the lock write
+    // and the workspace write) is healed by simply re-running the scan. An
+    // AlreadyTrue workspace keeps the re-run a byte-stable no-op.
+    let heal_root: Option<&String> = pnpm_heal_root(
+        rewrite.files.contains_key("pnpm-lock.yaml"),
+        files.get("pnpm-lock.yaml"),
+        overrides,
+    );
+    let spliced_pnpm_locks = pnpm_lock_texts.len();
+    if let Some(text) = heal_root {
+        pnpm_lock_texts.push(text);
+    }
+    // A dry-run vendored→hosted takeover of a purl vendored into the root
+    // pnpm lock: the wet run reverts that wiring and splices the hosted URL
+    // into it, so the trust config is previewed against the root lock (the
+    // vendored text carries the same lockfileVersion).
+    let takeover_pnpm_urls: Vec<&str> = takeover_previews
+        .iter()
+        .filter(|t| t.locks.iter().any(|l| l == "pnpm-lock.yaml"))
+        .map(|t| t.artifact_url.as_str())
+        .collect();
+    let takeover_root: Option<&String> = if takeover_pnpm_urls.is_empty()
+        || heal_root.is_some()
+        || rewrite.files.contains_key("pnpm-lock.yaml")
+    {
+        None
+    } else {
+        files.get("pnpm-lock.yaml")
+    };
+    if let Some(text) = takeover_root {
+        pnpm_lock_texts.push(text);
+    }
+    if pnpm_lock_texts.is_empty() {
+        return (
+            pnpm_warnings,
+            trust_config_write,
+            pnpm_rerun_only,
+            workspace_symlinked,
+        );
+    }
+    // Name only the hosts whose artifact URL actually landed in a touched
+    // pnpm lock's final text (spliced this run, or the already-redirected
+    // heal root): an npm override may have matched only a sibling lock
+    // (e.g. package-lock.json), and naming its host here would point users
+    // at a server the pnpm lock never references. Same needles as the
+    // confirmation probe.
+    let npm_overrides: Vec<_> = overrides.iter().filter(|o| o.ecosystem == "npm").collect();
+    let groups: Vec<Vec<String>> = npm_overrides
+        .iter()
+        .map(|o| npm_lock_url_needles(&o.artifact_url))
+        .collect();
+    let present = groups_present(&pnpm_lock_texts, &groups);
+    let mut hosts: Vec<&str> = npm_overrides
+        .iter()
+        .zip(present)
+        .filter(|(_, present)| *present)
+        .filter_map(|(o, _)| url_host(&o.artifact_url))
+        // Dry-run takeover purls land in the root lock on the wet run.
+        .chain(takeover_pnpm_urls.iter().filter_map(|url| url_host(url)))
+        .collect();
+    hosts.sort_unstable();
+    hosts.dedup();
+    let server = if hosts.is_empty() {
+        "the hosted patch server".to_string()
+    } else {
+        format!("the hosted patch server ({})", hosts.join(", "))
+    };
+    // Root-lock gate: only the plain project lock at lockfileVersion >= 9
+    // gets the auto-config — spliced this run, or detected
+    // already-redirected (heal path).
+    let root_lock_v9 = heal_root
+        .or(takeover_root)
+        .and_then(|text| pnpm_lock_version_major(text))
+        .is_some_and(|major| major >= 9)
+        || rewrite
+            .files
+            .get("pnpm-lock.yaml")
+            .and_then(|text| pnpm_lock_version_major(text))
+            .is_some_and(|major| major >= 9);
+    // Every touched pnpm lock is a KNOWN legacy (5.x/6.0) format, where
+    // `--trust-lockfile` is rejected as an unknown option. An unparseable
+    // version stays on the manual guidance: never claim "no trust step
+    // needed" for a lock whose era is unknown.
+    let all_locks_legacy = pnpm_lock_texts.iter().all(|text| {
+        pnpm_lock_version_major(text).is_some_and(|major| major < 9)
+            || text
+                .lines()
+                .any(|line| line.starts_with("shrinkwrapVersion:"))
+    });
+    let detail = if all_locks_legacy {
+        pnpm_trust_legacy_detail(&server)
+    } else if !root_lock_v9 || !options.trust_lockfile_config {
+        pnpm_trust_manual_guidance(&server)
+    } else {
+        let (workspace, symlinked) = read_workspace(view);
+        workspace_symlinked = symlinked;
+        let trust_edit = |action: &str| FileEdit {
+            path: PNPM_WORKSPACE_REL.into(),
+            kind: REDIRECT_PNPM_WORKSPACE_TRUST_EDIT_KIND.into(),
+            action: action.into(),
+            key: Some("trustLockfile".into()),
+            original: None,
+            new: Some(serde_json::json!("true")),
+        };
+        match workspace {
+            // Present but UNREADABLE: never plan a Create (it would
+            // overwrite the user's workspace file) — fall back to
+            // warning-only guidance naming the file and the error.
+            Err(e) => pnpm_trust_workspace_unreadable_detail(&server, &e),
+            Ok(ws_existing) => match plan_workspace_trust(ws_existing.as_deref()) {
+                TrustPlan::Create(text) => {
+                    trust_config_write = Some((text, trust_edit("created")));
+                    pnpm_trust_configured_detail(&server, true, options.dry_run)
+                }
+                TrustPlan::Append(text) => {
+                    trust_config_write = Some((text, trust_edit("added")));
+                    pnpm_trust_configured_detail(&server, false, options.dry_run)
+                }
+                TrustPlan::AlreadyTrue => {
+                    pnpm_rerun_only = spliced_pnpm_locks == 0;
+                    format!(
+                        "{}, and {PNPM_WORKSPACE_REL} already carries `trustLockfile: \
+                         true` — keep it committed alongside the lock; installs need \
+                         no extra flags. {PNPM_TRUST_TRADEOFF_AND_CAUTION}",
+                        pnpm_trust_policy_preamble(&server),
+                    )
+                }
+                TrustPlan::UserSet(value) => format!(
+                    "{}. {PNPM_WORKSPACE_REL} explicitly sets `trustLockfile: \
+                 {value}`, which was respected and left untouched — install \
+                 with `pnpm install --trust-lockfile`, or set `trustLockfile: \
+                 true` yourself so every install accepts the patched \
+                 artifacts. {PNPM_TRUST_TRADEOFF_AND_CAUTION}",
+                    pnpm_trust_policy_preamble(&server),
+                ),
+            },
+        }
+    };
+    // The `--store` spelling only matters to pnpm 1–4, so it is named only
+    // when a touched lock may be that old.
+    let store_note = if pnpm_lock_texts
+        .iter()
+        .any(|text| pnpm_lock_may_need_store_flag(text))
+    {
+        " (pnpm 1–4 spell the option `--store`)"
+    } else {
+        ""
+    };
+    pnpm_warnings.push(warning(
+        "redirect_pnpm_trust_lockfile",
+        format!(
+            "{}. After a lock-only change, existing node_modules or a warm pnpm store \
+             can still contain upstream files. For a reliable reinstall, use a clean \
+             node_modules tree and an empty store with \
+             `pnpm install --frozen-lockfile --store-dir <new-empty-directory>`\
+             {store_note}. Do not rely on `--force`: some versions re-resolve the \
+             upstream artifact. Run `socket-patch vex` after installation to verify \
+             the patched files.",
+            detail.trim_end_matches('.')
+        ),
+    ));
+    (
+        pnpm_warnings,
+        trust_config_write,
+        pnpm_rerun_only,
+        workspace_symlinked,
+    )
+}
+
+/// npm >= 12 ships `allow-remote=none`: it refuses (EALLOWREMOTE) every
+/// tarball whose `resolved` origin is not the configured registry — which
+/// is exactly what a hosted redirect writes. npm <= 11 installs it
+/// unchanged; `allow-remote=all` in the project `.npmrc` makes npm 12
+/// install the patched bytes with the sha512 pins still enforced (`root`
+/// only admits DIRECT dependencies, so it is not enough).
+///
+/// ZERO-TOUCH DEFAULT (the npm twin of the pnpm trustLockfile
+/// auto-config): whenever a root npm lock ends this run carrying a granted
+/// hosted artifact URL (spliced now, or already redirected by an earlier
+/// run — so a missed config heals on re-run), the run ensures
+/// `allow-remote=all` in the project `.npmrc` — created when absent
+/// (`action: "created"`), one line appended otherwise (`"added"`), every
+/// other byte preserved — and records the edit
+/// (`redirect_npmrc_allow_remote`). An explicit user
+/// `allow-remote=<other>` is RESPECTED (never flipped), an unreadable /
+/// symlinked `.npmrc` is left alone, and `--no-npm-allow-remote-config`
+/// opts out entirely; every variant still WARNS
+/// (`redirect_npm_allow_remote`) with the whole-tree tradeoff. Vendored
+/// mode is unaffected: its `file:.socket/vendor/…` specs are npm `file`
+/// specs, gated by `allow-file` (default `all`), not `allow-remote`.
+fn npm_allow_remote(
+    view: &ProjectView<'_>,
+    files: &BTreeMap<String, String>,
+    rewrite: &RewriteResult,
+    overrides: &[DepOverride],
+    takeover_previews: &[TakeoverPreview],
+    options: &RewriteOptions<'_>,
+) -> (Vec<RewriteWarning>, ConfigWrite) {
+    let mut npm_warnings: Vec<RewriteWarning> = Vec::new();
+    let mut npmrc_config_write: ConfigWrite = None;
+    let npm_hosts: Vec<&str> = {
+        let npm_lock_texts: Vec<&String> = NPM_LOCKS
+            .iter()
+            .filter_map(|lock| rewrite.files.get(*lock).or_else(|| files.get(*lock)))
+            .collect();
+        let npm_overrides: Vec<_> = overrides.iter().filter(|o| o.ecosystem == "npm").collect();
+        let groups: Vec<[String; 2]> = npm_overrides
+            .iter()
+            .map(|o| artifact_url_spellings(&o.artifact_url))
+            .collect();
+        let present = groups_present(&npm_lock_texts, &groups);
+        let mut hosts: Vec<&str> = npm_overrides
+            .iter()
+            .zip(present)
+            .filter(|(_, present)| *present)
+            .filter_map(|(o, _)| url_host(&o.artifact_url))
+            // A dry-run vendored→hosted takeover: the wet run reverts the
+            // vendored wiring in a root npm lock and splices the hosted URL
+            // there, so preview the `.npmrc` write too.
+            .chain(
+                takeover_previews
+                    .iter()
+                    .filter(|t| t.locks.iter().any(|l| NPM_LOCKS.contains(&l.as_str())))
+                    .filter_map(|t| url_host(&t.artifact_url)),
+            )
+            .collect();
+        hosts.sort_unstable();
+        hosts.dedup();
+        hosts
+    };
+    if npm_hosts.is_empty() {
+        return (npm_warnings, npmrc_config_write);
+    }
+    let edit = |action: &str| FileEdit {
+        path: NPMRC_REL.into(),
+        kind: NPMRC_ALLOW_REMOTE_EDIT_KIND.into(),
+        action: action.into(),
+        key: Some("allow-remote".into()),
+        original: None,
+        new: Some(serde_json::json!("all")),
+    };
+    let detail = match read_npmrc(view) {
+        // Opt-out still reports an explicit / already-set value truthfully;
+        // only the WRITE is suppressed.
+        Ok(existing) => {
+            match plan_npmrc_allow_remote_with(existing.as_deref(), &(options.npm_outer)()) {
+                NpmrcPlan::AlreadyAll => npm_allow_remote_already_detail(&npm_hosts),
+                NpmrcPlan::UserSet(value) => npm_allow_remote_user_set_detail(&npm_hosts, &value),
+                NpmrcPlan::EnvSet { var, value } => {
+                    npm_allow_remote_env_set_detail(&npm_hosts, &var, &value)
+                }
+                NpmrcPlan::OuterSet { layer, path, value } => {
+                    npm_allow_remote_outer_set_detail(&npm_hosts, layer, &path, &value)
+                }
+                NpmrcPlan::Unsupported(why) => npm_allow_remote_unreadable_detail(&npm_hosts, &why),
+                _ if !options.npm_allow_remote_config => npm_allow_remote_manual_detail(&npm_hosts),
+                NpmrcPlan::Create(text) => {
+                    npmrc_config_write = Some((text, edit("created")));
+                    npm_allow_remote_configured_detail(&npm_hosts, true, options.dry_run)
+                }
+                NpmrcPlan::Append(text) => {
+                    npmrc_config_write = Some((text, edit("added")));
+                    npm_allow_remote_configured_detail(&npm_hosts, false, options.dry_run)
+                }
+            }
+        }
+        Err(why) => npm_allow_remote_unreadable_detail(&npm_hosts, &why),
+    };
+    npm_warnings.push(warning("redirect_npm_allow_remote", detail));
+    (npm_warnings, npmrc_config_write)
+}
+
+/// A dep counts as REDIRECTED only if its hosted-artifact URL (or its
+/// per-dependency registry index URL) actually landed in the project's
+/// files — either written by this run or already present from an earlier
+/// one. A granted reference whose rewriter found nothing to edit (e.g. no
+/// lockfile) must NOT be recorded or attested: nothing pins the patch.
+fn confirm(
+    files: &BTreeMap<String, String>,
+    rewrite: &RewriteResult,
+    candidates: &[Candidate],
+    binary_bun: bool,
+    withheld_from_vlt: &BTreeSet<String>,
+) -> Vec<(String, String)> {
+    use crate::patch::redirect::pdm_drives;
+    // A `pdm.lock` that is NOT the PyPI install driver (a `uv.lock` or
+    // `poetry.lock` sits beside it) is never rewritten, yet can still carry
+    // a Socket artifact URL from an earlier run. That stale text pins
+    // nothing, so it must not feed the substring probe below. When pdm DOES
+    // drive, pypi confirmation keys off `confirmed_pdm_uuids`, so dropping
+    // the file is always safe.
+    let pdm_inactive = files.contains_key("pdm.lock") && !pdm_drives(files);
+    // Likewise a `vlt-lock.json` the vlt rewrite was withheld from (its
+    // artifact failed the preflight beside another npm-family lock) may
+    // still hold an earlier run's pin: only the sibling lock this run
+    // rewrote can confirm that dep.
+    let final_texts: Vec<(&str, &String)> = files
+        .iter()
+        .filter(|(name, _)| !(pdm_inactive && name.as_str() == "pdm.lock"))
+        .map(|(name, content)| (name.as_str(), rewrite.files.get(name).unwrap_or(content)))
+        .chain(
+            rewrite
+                .files
+                .iter()
+                .filter(|(name, _)| !files.contains_key(*name))
+                .map(|(name, content)| (name.as_str(), content)),
+        )
+        .collect();
+    // Every non-substring rule decides a candidate outright; the rest are
+    // confirmed by substring presence of their needles in the final texts.
+    // All needle groups are answered in ONE multi-needle pass per text
+    // (`groups_present`), which is the per-candidate `any()` exactly —
+    // presence does not depend on search order, and `confirmed` keeps
+    // candidate order.
+    let steps: Vec<ProbeStep> = candidates
+        .iter()
+        .map(|c| {
+            let purl = c.purl.as_str();
+            let uuid = c.dep.patch_uuid.as_str();
+            // vlt decides before the binary-bun rule, so `bun.lockb` beside
+            // a vlt-driven `vlt-lock.json` never confirms an npm purl.
+            if rewrite.refused_vlt_uuids.contains(uuid) {
+                return ProbeStep::Decided(false);
+            }
+            if rewrite.vlt_drives && purl.starts_with("pkg:npm/") {
+                return ProbeStep::Decided(rewrite.confirmed_vlt_uuids.contains(uuid));
+            }
+            if binary_bun && purl.starts_with("pkg:npm/") {
+                return ProbeStep::Decided(rewrite.confirmed_bun_binary_uuids.contains(uuid));
+            }
+            if rewrite.refused_pipenv_uuids.contains(uuid) {
+                return ProbeStep::Decided(false);
+            }
+            // pdm is transactional like cargo: a refused uuid is never
+            // confirmed, and when `pdm.lock` is the PyPI install driver (no
+            // `uv.lock` / `poetry.lock`) a pypi dep is confirmed ONLY by the
+            // pdm rewriter's own report — the URL landing in a sibling
+            // `requirements.txt` the project does not install from pins
+            // nothing. When uv/poetry drive, their own lock proof below
+            // still confirms them. This check precedes the hatch gate: a
+            // PDM project may declare `hatchling` as its build backend,
+            // which registers every pypi uuid as hatch-owned while the
+            // lock's presence keeps hatch from confirming any of them.
+            if rewrite.refused_pdm_uuids.contains(uuid) {
+                return ProbeStep::Decided(false);
+            }
+            if purl.starts_with("pkg:pypi/") && pdm_drives(files) {
+                return ProbeStep::Decided(rewrite.confirmed_pdm_uuids.contains(uuid));
+            }
+            if rewrite.python_lock_uuids.contains(uuid) {
+                return ProbeStep::Decided(
+                    rewrite.confirmed_python_lock_uuids.contains(uuid)
+                        && !rewrite.refused_python_lock_uuids.contains(uuid),
+                );
+            }
+            if rewrite.hatch_uuids.contains(uuid) {
+                return ProbeStep::Decided(rewrite.confirmed_hatch_uuids.contains(uuid));
+            }
+            // A Pipfile.lock rewrite confirms its own uuids (the sibling
+            // requirements.txt rewriter may have had nothing to do).
+            if purl.starts_with("pkg:pypi/") {
+                return ProbeStep::Decided(
+                    rewrite.confirmed_pipenv_uuids.contains(uuid)
+                        || rewrite.confirmed_requirements_uuids.contains(uuid),
+                );
+            }
+            if rewrite.refused_pnpm_uuids.contains(uuid) {
+                return ProbeStep::Decided(false);
+            }
+            // Cargo is transactional: the rewriter reports exactly which
+            // patch uuids FULLY landed (manifest pin + lock + registry
+            // block). Substring presence must never confirm a cargo dep —
+            // the `[registries.…]` config block contains the index URL
+            // while pinning nothing, so a config-block-only rewrite would be
+            // attested with zero enforcement in any build.
+            if purl.starts_with("pkg:cargo/") {
+                return ProbeStep::Decided(rewrite.confirmed_cargo_uuids.contains(uuid));
+            }
+            // Golang likewise: the goproxy `indexUrl` is the bare
+            // patch-server origin (present in any other hosted lock), and
+            // the socket module's go.sum lines outlive a removed replace.
+            if purl.starts_with("pkg:golang/") {
+                return ProbeStep::Decided(rewrite.confirmed_golang_uuids.contains(uuid));
+            }
+            let needles = candidate_presence_needles(&c.dep);
+            if withheld_from_vlt.contains(uuid) {
+                ProbeStep::NeedlesOutsideVlt(needles)
+            } else {
+                ProbeStep::Needles(needles)
+            }
+        })
+        .collect();
+    let groups = |outside_vlt: bool| -> Vec<&[String]> {
+        steps
+            .iter()
+            .filter_map(|step| match step {
+                ProbeStep::Needles(needles) if !outside_vlt => Some(needles.as_slice()),
+                ProbeStep::NeedlesOutsideVlt(needles) if outside_vlt => Some(needles.as_slice()),
+                _ => None,
+            })
+            .collect()
+    };
+    let all_texts: Vec<&String> = final_texts.iter().map(|(_, text)| *text).collect();
+    let mut present = groups_present(&all_texts, &groups(false)).into_iter();
+    let outside_vlt_groups = groups(true);
+    let mut present_outside_vlt = if outside_vlt_groups.is_empty() {
+        Vec::new()
+    } else {
+        let texts: Vec<&String> = final_texts
+            .iter()
+            .filter(|(name, _)| *name != VLT_LOCK)
+            .map(|(_, text)| *text)
+            .collect();
+        groups_present(&texts, &outside_vlt_groups)
+    }
+    .into_iter();
+    candidates
+        .iter()
+        .zip(&steps)
+        .filter(|(_, step)| match step {
+            ProbeStep::Decided(keep) => *keep,
+            ProbeStep::Needles(_) => present
+                .next()
+                .expect("one presence answer per needle group"),
+            ProbeStep::NeedlesOutsideVlt(_) => present_outside_vlt
+                .next()
+                .expect("one presence answer per needle group"),
+        })
+        .map(|(c, _)| (c.purl.clone(), c.dep.patch_uuid.clone()))
+        .collect()
+}
+
+/// The ecosystem a candidate file's rewriter belongs to (`None` for files
+/// no rewriter edits), for the in-memory symlinked/unreadable-read refusal.
+fn file_ecosystem(rel: &str) -> Option<&'static str> {
+    if let Some(eco) = crate::formats::registry::hosted_file_ecosystem(rel) {
+        return Some(eco);
+    }
+    let base = rel.rsplit('/').next().unwrap_or(rel);
+    (crate::utils::python_lock::is_python_lock_name(base) || base.ends_with(".py"))
+        .then_some("pypi")
+}
+
+/// SYMLINK GUARD — fail-closed, whole rewrite, before the ledger and before
+/// any write (hosted rewrites are transactional). The writer stages next to
+/// the path and renames over it, which REPLACES a symbolic link with a
+/// detached regular copy: the link target goes stale and a revert restores
+/// bytes but never the link. Applies to every ecosystem's files and to dry
+/// runs, so a dry run predicts the refusal.
+///
+/// In memory, additionally: a candidate file read through a link (its bytes
+/// are unknown) or present without content, when a candidate of its
+/// ecosystem could rewrite it.
+pub fn guard(
+    view: &ProjectView<'_>,
+    done: &Rewritten,
+    candidates: &[Candidate],
+) -> Option<Refusal> {
+    if done.workspace_symlinked {
+        return Some(symlink_refusal(PNPM_WORKSPACE_REL));
+    }
+    let written = || {
+        done.rewrite
+            .files
+            .keys()
+            .chain(done.rewrite.binary_files.keys())
+    };
+    if let Some(linked) = written().find(|k| view.is_symlink(k)) {
+        return Some(symlink_refusal(linked));
+    }
+    let ProjectView::Memory(project) = view else {
+        return None;
+    };
+    let candidate_ecosystems: BTreeSet<&str> = candidates
+        .iter()
+        .map(|c| c.dep.ecosystem.as_str())
+        .collect();
+    if let Some(linked) = done
+        .symlinked_reads
+        .iter()
+        .find(|rel| file_ecosystem(rel).is_some_and(|eco| candidate_ecosystems.contains(eco)))
+    {
+        return Some(symlink_refusal(linked));
+    }
+    done.unreadable_reads
+        .iter()
+        .find(|rel| {
+            done.rewrite.files.contains_key(rel.as_str())
+                || file_ecosystem(rel).is_some_and(|eco| candidate_ecosystems.contains(eco))
+        })
+        .or_else(|| {
+            done.rewrite
+                .files
+                .keys()
+                .find(|k| matches!(project.get(k), Some(MemoryEntry::Present)))
+        })
+        .map(|rel| unreadable_refusal(rel))
+}
+
+/// The `record_fetch_failed` warning for a confirmed redirect whose patch
+/// record could not be fetched.
+pub fn record_fetch_failed_warning(purl: &str) -> RewriteWarning {
+    warning(
+        "record_fetch_failed",
+        format!(
+            "{purl} was switched to hosted, but its patch record could not be \
+             fetched; this run's VEX attestation omits it (`socket-patch vex` \
+             fetches it again once the API answers)"
+        ),
+    )
+}
+
+/// A `{code, detail}` warning.
+pub fn warning(code: &str, detail: impl Into<String>) -> RewriteWarning {
+    RewriteWarning {
+        code: code.to_string(),
+        detail: detail.into(),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::vendor::lock_inventory::MemoryProject;
+
+    fn reference(value: serde_json::Value) -> PackageVendorResult {
+        serde_json::from_value(value).unwrap()
+    }
+
+    #[test]
+    fn candidates_skip_every_unusable_reference() {
+        let mut refs: HashMap<String, PackageVendorResult> = HashMap::new();
+        refs.insert(
+            "u-pending".into(),
+            reference(serde_json::json!({"status": "pending_build"})),
+        );
+        refs.insert(
+            "u-nourl".into(),
+            reference(serde_json::json!({"status": "granted", "purl": "pkg:npm/b@1"})),
+        );
+        refs.insert(
+            "u-ok".into(),
+            reference(serde_json::json!({
+                "status": "reused",
+                "url": "https://patch.example/patch/npm/c/1/tok/u-ok/c-1.tgz",
+                "purl": "pkg:npm/c@1",
+                "artifacts": [{"kind": "tarball", "url": null, "integrity": {"sha512": "sha512-x"}}],
+                "registryOverride": null
+            })),
+        );
+        let selected = vec![
+            ("pkg:npm/a@1".to_string(), "u-missing".to_string()),
+            ("pkg:npm/p@1".to_string(), "u-pending".to_string()),
+            ("pkg:npm/b@1".to_string(), "u-nourl".to_string()),
+            ("pkg:npm/c@1".to_string(), "u-ok".to_string()),
+        ];
+        let mut skipped = Vec::new();
+        let candidates = build_candidates(&selected, &refs, &mut skipped);
+        let reasons: Vec<&str> = skipped.iter().map(|s| s.reason.as_str()).collect();
+        assert_eq!(reasons, vec!["not_found", "pending_build", "no_url"]);
+        assert_eq!(candidates.len(), 1);
+        assert_eq!(candidates[0].dep.token, "tok");
+        assert_eq!(
+            candidates[0].dep.integrity.sha512.as_deref(),
+            Some("sha512-x")
+        );
+    }
+
+    fn cargo_reference(
+        uuid: &str,
+    ) -> (Vec<(String, String)>, HashMap<String, PackageVendorResult>) {
+        let purl = "pkg:cargo/serde@1.0.190";
+        let mut refs = HashMap::new();
+        refs.insert(
+            uuid.to_string(),
+            reference(serde_json::json!({
+                "status": "granted",
+                "url": format!("https://patch.example/patch/cargo/serde/1.0.190/tok/{uuid}/serde-1.0.190.crate"),
+                "purl": purl,
+                "artifacts": [{"kind": "tarball", "url": null, "integrity": {"sha256": "ab"}}],
+                "registryOverride": null
+            })),
+        );
+        (vec![(purl.to_string(), uuid.to_string())], refs)
+    }
+
+    #[tokio::test]
+    async fn an_unreadable_candidate_file_refuses_its_ecosystem() {
+        let (selected, refs) = cargo_reference("u-1");
+        let mut p = MemoryProject::new();
+        p.insert_text("Cargo.toml", "[dependencies]\nserde = \"1\"\n");
+        p.insert_text(
+            "Cargo.lock",
+            "version = 3\n\n[[package]]\nname = \"serde\"\nversion = \"1.0.190\"\n\
+             source = \"registry+https://github.com/rust-lang/crates.io-index\"\n",
+        );
+        p.insert_present(".cargo/config");
+        let outer = OuterAllowRemote::default;
+        let options = RewriteOptions {
+            dry_run: false,
+            targets_pipenv_lock: false,
+            pipenv_major: None,
+            pipenv_unknown_detail: String::new(),
+            trust_lockfile_config: true,
+            npm_allow_remote_config: true,
+            npm_outer: &outer,
+            blocking: false,
+        };
+        let mut skipped = Vec::new();
+        let candidates = build_candidates(&selected, &refs, &mut skipped);
+        let view = ProjectView::Memory(&p);
+        let unreadable = BTreeSet::from([".cargo/config".to_string()]);
+        let read = read_candidate_files(&view, &unreadable, &candidates).await;
+        assert_eq!(read.unreadable_reads, vec![".cargo/config"]);
+        let done = rewrite(
+            &view,
+            read,
+            &candidates,
+            BTreeMap::new(),
+            &BTreeSet::new(),
+            &[],
+            options,
+        )
+        .await;
+        assert_eq!(
+            guard(&view, &done, &candidates).unwrap().code,
+            UNREADABLE_REFUSAL
+        );
+
+        // A non-UTF-8 file is absent to disk too: not a refusal.
+        let read = read_candidate_files(&view, &BTreeSet::new(), &candidates).await;
+        assert!(read.unreadable_reads.is_empty());
+    }
+
+    #[test]
+    fn file_ecosystems_cover_the_rewrite_targets() {
+        assert_eq!(file_ecosystem("package-lock.json"), Some("npm"));
+        assert_eq!(
+            file_ecosystem("common/config/rush/pnpm-lock.yaml"),
+            Some("npm")
+        );
+        assert_eq!(file_ecosystem("tool.py.lock"), Some("pypi"));
+        assert_eq!(file_ecosystem("crates/a/Cargo.toml"), Some("cargo"));
+        assert_eq!(file_ecosystem("build.gradle"), None);
+    }
+}
+
+/// The one-pass multi-needle confirmation probe answers exactly what the
+/// per-candidate `any()` oracle answers.
+#[cfg(test)]
+mod probe_equivalence_tests {
+    use super::candidate_presence_needles;
+    use crate::hosted::guidance::npm_lock_url_needles;
+    use crate::patch::redirect::presence::groups_present;
+    use crate::patch::redirect::{
+        artifact_url_present, artifact_url_spellings, rewrite_registry_redirect, DepOverride,
+    };
+    use crate::utils::uri::encode_uri_component;
+    use std::collections::BTreeMap;
+    use std::path::{Path, PathBuf};
+
+    /// The per-candidate probe [`candidate_presence_needles`] +
+    /// `groups_present` replaced, kept as the equivalence oracle.
+    fn candidate_present_oracle(final_texts: &[&String], dep: &DepOverride) -> bool {
+        let artifact_url = dep.artifact_url.as_str();
+        let registry = dep.registry_override.as_ref();
+        let index_url = registry.map(|o| o.index_url.as_str());
+        let suffixed_version =
+            registry.and_then(|o| o.identifiers.maven_suffixed_version.as_deref());
+        let encoded = encode_uri_component(artifact_url);
+        final_texts.iter().any(|text| {
+            artifact_url_present(text, artifact_url)
+                || text.contains(encoded.as_str())
+                || index_url.is_some_and(|iu| text.contains(iu))
+                || suffixed_version.is_some_and(|sv| text.contains(sv))
+        })
+    }
+
+    fn golden_root() -> PathBuf {
+        Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/redirect")
+    }
+
+    fn cases(dir: &Path, out: &mut Vec<PathBuf>) {
+        if dir.join("input").is_dir() && dir.join("overrides.json").is_file() {
+            out.push(dir.to_path_buf());
+            return;
+        }
+        for entry in std::fs::read_dir(dir).unwrap() {
+            let p = entry.unwrap().path();
+            if p.is_dir() {
+                cases(&p, out);
+            }
+        }
+    }
+
+    fn read_tree(base: &Path) -> BTreeMap<String, String> {
+        fn walk(base: &Path, dir: &Path, out: &mut BTreeMap<String, String>) {
+            for entry in std::fs::read_dir(dir).unwrap() {
+                let p = entry.unwrap().path();
+                if p.is_dir() {
+                    walk(base, &p, out);
+                } else if let Ok(text) = std::fs::read_to_string(&p) {
+                    let rel = p.strip_prefix(base).unwrap().to_string_lossy();
+                    out.insert(rel.replace('\\', "/"), text);
+                }
+            }
+        }
+        let mut out = BTreeMap::new();
+        if base.is_dir() {
+            walk(base, base, &mut out);
+        }
+        out
+    }
+
+    /// Every golden fixture (composer `\/`, berry percent-encoded, maven
+    /// suffixed version, go module path, cargo index url, …): each case's
+    /// final texts — input overlaid with the rewriters' own output, as the probe
+    /// sees them — plus its authored `expected/` files, probed with EVERY
+    /// fixture's overrides so hits and misses are both well exercised.
+    #[test]
+    fn multi_needle_probe_matches_per_candidate_any_on_golden_fixtures() {
+        let mut dirs = Vec::new();
+        cases(&golden_root(), &mut dirs);
+        dirs.sort();
+        assert!(dirs.len() > 50, "golden fixtures not found: {}", dirs.len());
+
+        let mut all_overrides: Vec<DepOverride> = Vec::new();
+        let mut text_sets: Vec<Vec<String>> = Vec::new();
+        for case in &dirs {
+            let overrides: Vec<DepOverride> = match serde_json::from_str(
+                &std::fs::read_to_string(case.join("overrides.json")).unwrap(),
+            ) {
+                Ok(o) => o,
+                Err(_) => continue,
+            };
+            let input = read_tree(&case.join("input"));
+            let rewrite = rewrite_registry_redirect(&input, &overrides);
+            let finals: Vec<String> = input
+                .iter()
+                .map(|(name, text)| rewrite.files.get(name).unwrap_or(text).clone())
+                .chain(
+                    rewrite
+                        .files
+                        .iter()
+                        .filter(|(name, _)| !input.contains_key(*name))
+                        .map(|(_, t)| t.clone()),
+                )
+                .collect();
+            text_sets.push(finals);
+            text_sets.push(read_tree(&case.join("expected")).into_values().collect());
+            text_sets.push(input.into_values().collect());
+            all_overrides.extend(overrides);
+        }
+        text_sets.push(Vec::new());
+        // Texts that carry ONE needle kind and nothing else — no golden
+        // fixture has the maven suffixed version or the registry index URL
+        // without the artifact URL beside it, so a needle dropped from
+        // `candidate_presence_needles` would otherwise go unnoticed.
+        let mut lone_suffixed: Vec<usize> = Vec::new();
+        for o in all_overrides
+            .iter()
+            .filter_map(|d| d.registry_override.as_ref())
+        {
+            text_sets.push(vec![format!("<url>{}</url>\n", o.index_url)]);
+            if let Some(sv) = o.identifiers.maven_suffixed_version.as_deref() {
+                lone_suffixed.push(text_sets.len());
+                text_sets.push(vec![format!("<version>{sv}</version>\n")]);
+            }
+        }
+        assert!(
+            !lone_suffixed.is_empty(),
+            "no maven suffixed-version override"
+        );
+
+        let groups: Vec<Vec<String>> = all_overrides
+            .iter()
+            .map(candidate_presence_needles)
+            .collect();
+        let (mut hits, mut misses) = (0usize, 0usize);
+        for (set, texts) in text_sets.iter().enumerate() {
+            let refs: Vec<&String> = texts.iter().collect();
+            let fast = groups_present(&refs, &groups);
+            if lone_suffixed.contains(&set) {
+                assert!(
+                    fast.iter().any(|hit| *hit),
+                    "a lone suffixed version confirms its maven override"
+                );
+            }
+            for (dep, got) in all_overrides.iter().zip(&fast) {
+                let want = candidate_present_oracle(&refs, dep);
+                assert_eq!(
+                    *got, want,
+                    "{}/{} / {}",
+                    dep.ecosystem, dep.name, dep.artifact_url
+                );
+                if want {
+                    hits += 1;
+                } else {
+                    misses += 1;
+                }
+            }
+        }
+        assert!(hits > 100 && misses > 100, "hits={hits} misses={misses}");
+
+        // The pnpm / npm host filters and the heal probe: the npm lock
+        // spellings, and the bare `artifact_url_present` pair.
+        let npm: Vec<&DepOverride> = all_overrides.iter().collect();
+        let lock_groups: Vec<Vec<String>> = npm
+            .iter()
+            .map(|o| npm_lock_url_needles(&o.artifact_url))
+            .collect();
+        let pair_groups: Vec<[String; 2]> = npm
+            .iter()
+            .map(|o| artifact_url_spellings(&o.artifact_url))
+            .collect();
+        for texts in &text_sets {
+            let lock_fast = groups_present(texts, &lock_groups);
+            let pair_fast = groups_present(texts, &pair_groups);
+            for (i, o) in npm.iter().enumerate() {
+                let encoded = encode_uri_component(&o.artifact_url);
+                let pair = texts
+                    .iter()
+                    .any(|t| artifact_url_present(t, &o.artifact_url));
+                let lock = texts.iter().any(|t| {
+                    artifact_url_present(t, &o.artifact_url) || t.contains(encoded.as_str())
+                });
+                assert_eq!(pair_fast[i], pair, "{}", o.artifact_url);
+                assert_eq!(lock_fast[i], lock, "{}", o.artifact_url);
+            }
+        }
+    }
+}
diff --git a/crates/socket-patch-core/src/hosted/guidance.rs b/crates/socket-patch-core/src/hosted/guidance.rs
new file mode 100644
index 00000000..8473ff64
--- /dev/null
+++ b/crates/socket-patch-core/src/hosted/guidance.rs
@@ -0,0 +1,404 @@
+//! The install-policy guidance of the hosted flow: the pnpm `trustLockfile`
+//! and npm `allow-remote` auto-config planners and every warning text they
+//! emit, shared verbatim by the disk and in-memory engines.
+
+/// `scheme://[user[:pass]@]host[:port]/…` → `host[:port]`, NEVER userinfo.
+/// For user-facing messages that name where a lockfile now points — the
+/// hosted artifact host follows `--api-url`, so hardcoding `patch.socket.dev`
+/// would misname it in custom-server environments. The port is kept (it is
+/// part of the authority the lock records); credentials are stripped: a
+/// credentialed artifact URL (`https://user:secret@host/…`) must never leak
+/// `user:secret` into the warning text or the persisted `--json` envelope —
+/// both land in CI logs. Split by hand because this crate has no URL-parser
+/// dependency (reqwest is dev-only here); per RFC 3986 a raw `@` in the
+/// authority can ONLY be the userinfo terminator (it is percent-encoded
+/// everywhere else), so the tail after the LAST `@` is exactly host[:port].
+pub fn url_host(url: &str) -> Option<&str> {
+    let rest = url.split_once("://").map_or(url, |(_, r)| r);
+    let authority = rest.split(['/', '?', '#']).next().unwrap_or(rest);
+    let host = authority.rsplit_once('@').map_or(authority, |(_, h)| h);
+    (!host.is_empty()).then_some(host)
+}
+
+/// Repo-relative path of the pnpm workspace manifest the trustLockfile
+/// auto-config edits (the same file the vendor backend's override surface
+/// uses).
+pub const PNPM_WORKSPACE_REL: &str = "pnpm-workspace.yaml";
+
+/// `FileEdit.kind` recorded when the hosted flow ensures `trustLockfile:
+/// true` in pnpm-workspace.yaml. `action: "created"` — the workspace file
+/// itself was created (a revert deletes it); `action: "added"` — the single
+/// `trustLockfile: true` line was appended to an existing file (a revert
+/// removes exactly that line). Additive ledger vocabulary: older ledgers
+/// without it load unchanged (kind is an opaque string to the loader).
+pub const REDIRECT_PNPM_WORKSPACE_TRUST_EDIT_KIND: &str = "redirect_pnpm_workspace_trust";
+
+/// The honest-tradeoff + don't-rebuild tail shared by every trustLockfile
+/// warning variant. The tradeoff sentence is a security disclosure, not
+/// prose garnish: `trustLockfile: true` disables pnpm's lockfile
+/// re-verification for the WHOLE lock, so it must be stated wherever the
+/// setting is written or recommended.
+pub const PNPM_TRUST_TRADEOFF_AND_CAUTION: &str =
+    "Note: trustLockfile makes pnpm skip its lockfile re-verification \
+     (minimumReleaseAge / trustPolicy re-checks) for ALL lockfile entries, \
+     not just the patched ones — the per-entry sha512 integrity pins are \
+     still enforced. Do NOT follow pnpm's advice to rebuild the lockfile \
+     (`pnpm clean --lockfile`): that silently discards the hosted patches and \
+     reinstalls the vulnerable upstream artifact. pnpm <=10 ignores the \
+     setting and installs work unchanged";
+
+/// The policy preamble shared by every trustLockfile warning variant:
+/// what was repointed, and how pnpm >=11 fails without trust.
+pub fn pnpm_trust_policy_preamble(server: &str) -> String {
+    format!(
+        "pnpm-lock.yaml was repointed at {server}; pnpm >=11 rejects the \
+         rewritten lock (pnpm 11: ERR_PNPM_TARBALL_URL_MISMATCH, pnpm 12: \
+         ERR_PNPM_LOCKFILE_RESOLUTION_VERIFICATION)"
+    )
+}
+
+/// The pre-auto-config guidance, kept verbatim for the runs where the
+/// auto-config does not apply (legacy 5.x/6.0 locks, Rush nested locks,
+/// `--no-trust-lockfile-config`): both verified recoveries, spelled exactly.
+pub fn pnpm_trust_manual_guidance(server: &str) -> String {
+    format!(
+        "{}. Install with `pnpm install --trust-lockfile`, or commit \
+         `trustLockfile: true` in pnpm-workspace.yaml so every install \
+         accepts the patched artifacts. Do NOT follow pnpm's advice to \
+         rebuild the lockfile (`pnpm clean --lockfile`): that silently \
+         discards the hosted patches and reinstalls the vulnerable upstream \
+         artifact. pnpm <=10 installs work unchanged",
+        pnpm_trust_policy_preamble(server),
+    )
+}
+
+/// The LEGACY-lock variant (lockfileVersion 5.x/6.0 — pnpm 7/8): those
+/// majors have neither the pnpm >=11 lockfile trust policy nor any trust
+/// flag or setting, so installs consume the redirected lock unchanged and
+/// no trust step exists or is needed. Deliberately NEVER mentions
+/// `pnpm install --trust-lockfile`: pnpm 7/8 reject the flag as an unknown
+/// option, so headlining it here would hand users a command that errors.
+pub fn pnpm_trust_legacy_detail(server: &str) -> String {
+    format!(
+        "The pnpm lockfile was repointed at {server}. This is a legacy \
+         lock read by pnpm 1–8, which have no \
+         lockfile trust policy: no trust step exists or is needed. Do NOT regenerate the lockfile \
+         (deleting it, or re-resolving on a newer pnpm): that silently \
+         discards the hosted patches and reinstalls the vulnerable upstream \
+         artifact. If the project later moves to pnpm >=9, re-run \
+         `socket-patch scan --mode hosted` so the regenerated lock is \
+         switched to hosted (and trust-configured) again"
+    )
+}
+
+/// The unreadable-workspace fallback: pnpm-workspace.yaml EXISTS but could
+/// not be read (permissions, invalid UTF-8, I/O error). Planning a Create
+/// here would OVERWRITE the user's file with the root-only scaffold —
+/// destroying their `packages:` globs — so the auto-config stands down and
+/// the warning names the file, the error, and both manual recoveries.
+pub fn pnpm_trust_workspace_unreadable_detail(server: &str, err: &std::io::Error) -> String {
+    format!(
+        "{}. {PNPM_WORKSPACE_REL} exists but could not be read ({err}); it \
+         was left untouched — auto-configuring trust would risk overwriting \
+         it. Fix the file, then install with `pnpm install --trust-lockfile` \
+         or add `trustLockfile: true` to it yourself so every install \
+         accepts the patched artifacts. Do NOT follow pnpm's advice to \
+         rebuild the lockfile (`pnpm clean --lockfile`): that silently \
+         discards the hosted patches and reinstalls the vulnerable upstream \
+         artifact. pnpm <=10 installs work unchanged",
+        pnpm_trust_policy_preamble(server),
+    )
+}
+
+/// The pnpm-workspace.yaml read, classified for the trust auto-config:
+/// `Ok(Some(text))` — read fine; `Ok(None)` — ABSENT (`ErrorKind::NotFound`,
+/// the only state where planning a Create is safe); `Err(e)` — present but
+/// unreadable, so the caller must fall back to warning-only guidance
+/// (planning a Create would overwrite the user's `packages:` globs).
+///
+/// FIFO-safe (`read_regular_to_string_sync`: non-blocking open + fstat): a
+/// FIFO planted at the path classifies as unreadable (`InvalidInput`) instead
+/// of wedging the run in `open(2)`.
+pub fn read_workspace_for_trust(path: &std::path::Path) -> std::io::Result<Option<String>> {
+    match crate::utils::fs::read_regular_to_string_sync(path) {
+        Ok(text) => Ok(Some(text)),
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(None),
+        Err(e) => Err(e),
+    }
+}
+
+/// HEAL-ON-RERUN probe: does this (unspliced) root pnpm-lock.yaml already
+/// carry a granted hosted artifact URL from an EARLIER run? Same spelling
+/// set as the confirmation probe (raw / `\/`-escaped via
+/// `artifact_url_present`, plus the percent-encoded form) so a writer's
+/// spelling can never be one this probe misses. Lets an idempotent re-scan
+/// plan the trust config for a project that missed it once (opted-out first
+/// run, or a crash between the lock write and the workspace write).
+pub fn pnpm_lock_carries_hosted_redirect(
+    lock_text: &str,
+    overrides: &[crate::patch::redirect::DepOverride],
+) -> bool {
+    let groups: Vec<Vec<String>> = overrides
+        .iter()
+        .filter(|o| o.ecosystem == "npm")
+        .map(|o| npm_lock_url_needles(&o.artifact_url))
+        .collect();
+    crate::patch::redirect::presence::groups_present(&[lock_text], &groups)
+        .into_iter()
+        .any(|present| present)
+}
+
+/// The spellings of an npm artifact URL a pnpm lock may carry — raw or
+/// `\/`-escaped ([`artifact_url_spellings`](crate::patch::redirect::artifact_url_spellings),
+/// the `artifact_url_present` pair) plus the percent-encoded form — searched
+/// in one multi-needle pass ([`groups_present`](crate::patch::redirect::presence::groups_present)).
+pub fn npm_lock_url_needles(artifact_url: &str) -> Vec<String> {
+    let mut needles: Vec<String> =
+        crate::patch::redirect::artifact_url_spellings(artifact_url).into();
+    needles.push(crate::utils::uri::encode_uri_component(
+        artifact_url,
+    ));
+    needles
+}
+
+/// The HEAL-ON-RERUN gate: when this run spliced no root pnpm-lock.yaml
+/// (`root_spliced` false) but the on-disk root lock is v9 and already
+/// carries a granted hosted artifact URL, return its text so the trust
+/// block engages anyway. Legacy (<9) and unparseable-version locks stay
+/// `None` (fail closed: never write config for a lock era we can't read),
+/// as does a root lock this run DID splice (the splice path covers it).
+pub fn pnpm_heal_root<'a>(
+    root_spliced: bool,
+    disk_root: Option<&'a String>,
+    overrides: &[crate::patch::redirect::DepOverride],
+) -> Option<&'a String> {
+    if root_spliced {
+        return None;
+    }
+    disk_root.filter(|text| {
+        pnpm_lock_version_major(text).is_some_and(|major| major >= 9)
+            && pnpm_lock_carries_hosted_redirect(text, overrides)
+    })
+}
+
+/// The auto-config variant: trust was (or, on `--dry-run`, would be)
+/// configured in pnpm-workspace.yaml, so installs need no flags.
+pub fn pnpm_trust_configured_detail(server: &str, created: bool, dry_run: bool) -> String {
+    let how = match (created, dry_run) {
+        (true, false) => "`trustLockfile: true` was written to a new",
+        (false, false) => "`trustLockfile: true` was merged into the existing",
+        (true, true) => "`trustLockfile: true` would be written to a new",
+        (false, true) => "`trustLockfile: true` would be merged into the existing",
+    };
+    format!(
+        "{}, so {how} {PNPM_WORKSPACE_REL} — commit it alongside the lock; \
+         installs need no extra flags. {PNPM_TRUST_TRADEOFF_AND_CAUTION}",
+        pnpm_trust_policy_preamble(server),
+    )
+}
+
+// The pnpm lock-version sniffs live with the format's model.
+pub use crate::formats::pnpm::{
+    lock_version_major as pnpm_lock_version_major,
+    may_need_store_flag as pnpm_lock_may_need_store_flag,
+};
+
+/// The planned pnpm-workspace.yaml `trustLockfile: true` edit.
+pub enum TrustPlan {
+    /// No workspace file: create it (root-only `packages` scaffold — pnpm 9
+    /// refuses a workspace file with no `packages` field — plus the trust
+    /// key; the same scaffold shape the vendor backend creates).
+    Create(String),
+    /// Workspace file exists without a `trustLockfile:` key: append exactly
+    /// one line after the last non-empty line, every other byte preserved.
+    Append(String),
+    /// Already `trustLockfile: true` — nothing to write.
+    AlreadyTrue,
+    /// The user explicitly set `trustLockfile: <value>` (non-true). Their
+    /// call is respected — flipping an explicit security setting behind the
+    /// user's back is worse than a failing install with a clear warning.
+    UserSet(String),
+}
+
+/// Decide how to ensure `trustLockfile: true` in pnpm-workspace.yaml.
+/// Line splices only (never a YAML library), mirroring the vendor backend's
+/// workspace surgery: untouched lines stay byte-identical, so a revert can
+/// remove exactly what was added.
+pub fn plan_workspace_trust(existing: Option<&str>) -> TrustPlan {
+    let Some(text) = existing else {
+        return TrustPlan::Create("packages:\n  - '.'\ntrustLockfile: true\n".to_string());
+    };
+    // Top-level key only: an indented `trustLockfile:` under some other
+    // mapping is not the setting pnpm reads.
+    for line in text.split('\n') {
+        if let Some(rest) = line.strip_prefix("trustLockfile:") {
+            let value = rest.trim().trim_matches(|c| c == '\'' || c == '"');
+            if value == "true" {
+                return TrustPlan::AlreadyTrue;
+            }
+            return TrustPlan::UserSet(value.to_string());
+        }
+    }
+    let mut lines: Vec<String> = text.split('\n').map(str::to_string).collect();
+    // After the last non-empty line (no blank separator): a revert removes
+    // exactly one line and the file's trailing bytes stay put.
+    let anchor = lines
+        .iter()
+        .rposition(|l| !l.trim().is_empty())
+        .map(|i| i + 1)
+        .unwrap_or(lines.len());
+    lines.insert(anchor, "trustLockfile: true".to_string());
+    TrustPlan::Append(lines.join("\n"))
+}
+
+/// The root npm locks the hosted rewriter edits (`rewrite_npm_lock` rewrites
+/// every one present — npm 12 installs from package-lock.json beside a
+/// committed shrinkwrap).
+pub const NPM_LOCKS: [&str; 2] = ["npm-shrinkwrap.json", "package-lock.json"];
+
+/// The honest-tradeoff + opt-out tail shared by every `allow-remote`
+/// warning variant. The tradeoff sentence is a security disclosure, not
+/// prose garnish: `allow-remote=all` lifts npm 12's remote-tarball refusal
+/// for the WHOLE dependency tree, so it must be stated wherever the setting
+/// is written or recommended (the pnpm `trustLockfile` precedent).
+const NPM_ALLOW_REMOTE_TRADEOFF: &str =
+    "Note: allow-remote=all lets npm install ANY url-resolved (remote tarball) \
+     dependency, not just the patched ones Socket serves — the per-entry sha512 \
+     integrity pins are still enforced. `allow-remote=root` only admits direct \
+     dependencies. npm <=11 installs work unchanged (npm 11 already defaults to \
+     `all`; npm <=10 has no such setting)";
+
+/// The policy preamble shared by every `allow-remote` warning variant: what
+/// was repointed, and how npm >= 12 fails without the setting.
+fn npm_allow_remote_preamble(hosts: &[&str]) -> String {
+    format!(
+        "the npm lockfile now resolves patched dependencies from the hosted patch server ({}); \
+         npm >=12 refuses tarballs from any host other than the configured registry by \
+         default (`allow-remote=none`, error EALLOWREMOTE)",
+        hosts.join(", ")
+    )
+}
+
+/// The auto-config variant: `allow-remote=all` was (or, on `--dry-run`,
+/// would be) written to the project `.npmrc`, so installs need no flags.
+pub fn npm_allow_remote_configured_detail(
+    hosts: &[&str],
+    created: bool,
+    dry_run: bool,
+) -> String {
+    let how = match (created, dry_run) {
+        (true, false) => "`allow-remote=all` was written to a new",
+        (false, false) => "`allow-remote=all` was appended to the existing",
+        (true, true) => "`allow-remote=all` would be written to a new",
+        (false, true) => "`allow-remote=all` would be appended to the existing",
+    };
+    format!(
+        "{}, so {how} project .npmrc — commit it alongside the lock; `npm ci` needs no \
+         extra flags. {NPM_ALLOW_REMOTE_TRADEOFF}. To keep npm's default instead, re-run \
+         with --no-npm-allow-remote-config (SOCKET_NO_NPM_ALLOW_REMOTE_CONFIG) and install \
+         with `npm ci --allow-remote=all`",
+        npm_allow_remote_preamble(hosts),
+    )
+}
+
+/// The project `.npmrc` already resolves to `allow-remote=all`.
+pub fn npm_allow_remote_already_detail(hosts: &[&str]) -> String {
+    format!(
+        "{}, and the project .npmrc already sets `allow-remote=all` — keep it committed \
+         alongside the lock; `npm ci` needs no extra flags. {NPM_ALLOW_REMOTE_TRADEOFF}",
+        npm_allow_remote_preamble(hosts),
+    )
+}
+
+/// The user explicitly set another value: respected, never flipped (the
+/// pnpm `trustLockfile: false` precedent) — the warning names the manual
+/// recoveries instead.
+pub fn npm_allow_remote_user_set_detail(hosts: &[&str], value: &str) -> String {
+    format!(
+        "{}. The project .npmrc explicitly sets `allow-remote={value}`, which was respected \
+         and left untouched — set `allow-remote=all` there yourself (or install with \
+         `npm ci --allow-remote=all`) so npm >=12 installs the patched artifacts. \
+         {NPM_ALLOW_REMOTE_TRADEOFF}",
+        npm_allow_remote_preamble(hosts),
+    )
+}
+
+/// An `npm_config_allow_remote` environment variable sets another value.
+/// npm's env layer beats every `.npmrc`, so a project write could not take
+/// effect in this environment — and an explicit setting is respected.
+pub fn npm_allow_remote_env_set_detail(hosts: &[&str], var: &str, value: &str) -> String {
+    format!(
+        "{}. The environment variable {var}={value} explicitly sets `allow-remote`, which \
+         was respected: npm's environment layer overrides every .npmrc, so a project \
+         `allow-remote=all` would not take effect here and the project .npmrc was left \
+         untouched — unset {var} (or install with `npm ci --allow-remote=all`) so npm >=12 \
+         installs the patched artifacts. {NPM_ALLOW_REMOTE_TRADEOFF}",
+        npm_allow_remote_preamble(hosts),
+    )
+}
+
+/// A lower npm config layer (user / global / builtin file) explicitly sets
+/// another value. A committed project `allow-remote=all` would silently
+/// override that machine / org policy on every checkout, so it is
+/// respected like a project value and the override is left to the user.
+pub fn npm_allow_remote_outer_set_detail(
+    hosts: &[&str],
+    layer: &str,
+    path: &std::path::Path,
+    value: &str,
+) -> String {
+    format!(
+        "{}. The {layer} npm config ({}) explicitly sets `allow-remote={value}`, which was \
+         respected: socket-patch does not commit a project .npmrc that overrides it, and \
+         the project .npmrc was left untouched — to accept the patched artifacts in this \
+         project anyway, set `allow-remote=all` in the project .npmrc yourself (it outranks \
+         the {layer} config) or install with `npm ci --allow-remote=all`. \
+         {NPM_ALLOW_REMOTE_TRADEOFF}",
+        npm_allow_remote_preamble(hosts),
+        path.display(),
+    )
+}
+
+/// The opt-out (`--no-npm-allow-remote-config`) variant: nothing written,
+/// both manual recoveries spelled out.
+pub fn npm_allow_remote_manual_detail(hosts: &[&str]) -> String {
+    format!(
+        "{}. Commit `allow-remote=all` in the project .npmrc (or install with \
+         `npm ci --allow-remote=all`) so npm >=12 installs the patched artifacts. \
+         {NPM_ALLOW_REMOTE_TRADEOFF}",
+        npm_allow_remote_preamble(hosts),
+    )
+}
+
+/// The unreadable/unsafe `.npmrc` fallback: the file exists but could not
+/// be read, or is a symlink / non-regular file the atomic writer would
+/// replace. Planning a Create here would OVERWRITE the user's registry /
+/// auth config, so the auto-config stands down and names the problem.
+pub fn npm_allow_remote_unreadable_detail(hosts: &[&str], why: &str) -> String {
+    format!(
+        "{}. The project .npmrc exists but {why}; it was left untouched. Add \
+         `allow-remote=all` to it yourself (or install with `npm ci --allow-remote=all`) \
+         so npm >=12 installs the patched artifacts. {NPM_ALLOW_REMOTE_TRADEOFF}",
+        npm_allow_remote_preamble(hosts),
+    )
+}
+
+/// The project `.npmrc` read, classified for the allow-remote auto-config:
+/// `Ok(Some(text))` — a regular file read fine; `Ok(None)` — ABSENT (the
+/// only state where planning a Create is safe); `Err(why)` — present but
+/// unreadable, a symlink (the atomic stage+rename writer would replace the
+/// link with a detached copy — and the whole-run symlink guard would refuse
+/// the redirect), or not a regular file (FIFO-safe: never opened blocking).
+pub fn read_npmrc_for_allow_remote(path: &std::path::Path) -> Result<Option<String>, String> {
+    match std::fs::symlink_metadata(path) {
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(None),
+        Err(e) => return Err(format!("could not be inspected ({e})")),
+        Ok(meta) if meta.file_type().is_symlink() => {
+            return Err("is a symbolic link (socket-patch never writes through one)".into())
+        }
+        Ok(_) => {}
+    }
+    crate::utils::fs::read_regular_to_string_sync(path)
+        .map(Some)
+        .map_err(|e| format!("could not be read ({e})"))
+}
diff --git a/crates/socket-patch-cli/src/hosted_memory/discover.rs b/crates/socket-patch-core/src/hosted/memory/discover.rs
similarity index 97%
rename from crates/socket-patch-cli/src/hosted_memory/discover.rs
rename to crates/socket-patch-core/src/hosted/memory/discover.rs
index 43572ece..1a7758c8 100644
--- a/crates/socket-patch-cli/src/hosted_memory/discover.rs
+++ b/crates/socket-patch-core/src/hosted/memory/discover.rs
@@ -12,12 +12,12 @@ use std::sync::{Arc, Mutex};
 use std::task::Poll;
 use std::time::Duration;
 
-use socket_patch_core::api::client::{ApiError, ApiFuture, PatchApi};
-use socket_patch_core::api::ranking::cmp_search_results;
-use socket_patch_core::api::types::{
+use crate::api::client::{ApiError, ApiFuture, PatchApi};
+use crate::api::ranking::cmp_search_results;
+use crate::api::types::{
     BatchPackagePatches, PackageVendorResult, PatchResponse, PatchSearchResult, SearchResponse,
 };
-use socket_patch_core::utils::purl::{normalize_purl, strip_purl_qualifiers};
+use crate::utils::purl::{normalize_purl, strip_purl_qualifiers};
 
 use super::types::MAX_REFERENCE_BATCH;
 
@@ -102,11 +102,11 @@ impl Provider {
     pub(crate) async fn search_patches_batch(
         &self,
         purls: &[String],
-    ) -> Result<socket_patch_core::api::types::BatchSearchResponse, ApiError> {
+    ) -> Result<crate::api::types::BatchSearchResponse, ApiError> {
         let mut response = self
             .call("searchPatchesBatch", self.api.search_patches_batch(purls))
             .await?;
-        socket_patch_core::api::client::sort_batch_response(&mut response);
+        crate::api::client::sort_batch_response(&mut response);
         Ok(response)
     }
 
@@ -355,7 +355,7 @@ pub(crate) async fn fetch_wheel_metadata(
                         .download_artifact(url, max_bytes)
                         .await
                         .map_err(|error| format!("cannot fetch hosted wheel metadata: {error}"))?;
-                    socket_patch_core::vendor::pypi::decode_hosted_wheel_metadata(&bytes, sha256)
+                    crate::vendor::pypi::decode_hosted_wheel_metadata(&bytes, sha256)
                 })
             },
         )
diff --git a/crates/socket-patch-cli/src/hosted_memory/limits.rs b/crates/socket-patch-core/src/hosted/memory/limits.rs
similarity index 99%
rename from crates/socket-patch-cli/src/hosted_memory/limits.rs
rename to crates/socket-patch-core/src/hosted/memory/limits.rs
index 4bcdb635..f84dbbed 100644
--- a/crates/socket-patch-cli/src/hosted_memory/limits.rs
+++ b/crates/socket-patch-core/src/hosted/memory/limits.rs
@@ -295,7 +295,7 @@ impl SessionBuilder {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::hosted_memory::types::HostedScanLimits;
+    use crate::hosted::memory::types::HostedScanLimits;
 
     fn options(limits: HostedScanLimits) -> HostedScanOptions {
         HostedScanOptions {
diff --git a/crates/socket-patch-cli/src/hosted_memory/mod.rs b/crates/socket-patch-core/src/hosted/memory/mod.rs
similarity index 92%
rename from crates/socket-patch-cli/src/hosted_memory/mod.rs
rename to crates/socket-patch-core/src/hosted/memory/mod.rs
index bd6b4a7d..cc760463 100644
--- a/crates/socket-patch-cli/src/hosted_memory/mod.rs
+++ b/crates/socket-patch-core/src/hosted/memory/mod.rs
@@ -38,20 +38,20 @@ use std::collections::{BTreeMap, BTreeSet, HashMap};
 use std::sync::Arc;
 use std::time::Instant;
 
-use socket_patch_core::api::client::PatchApi;
-use socket_patch_core::api::types::{PatchResponse, PatchSearchResult};
-use socket_patch_core::crawlers::Ecosystem;
-use socket_patch_core::utils::cargo_workspace::member_manifests_in;
-use socket_patch_core::vendor::lock_inventory::{
+use crate::api::client::PatchApi;
+use crate::api::types::{PatchResponse, PatchSearchResult};
+use crate::crawlers::Ecosystem;
+use crate::utils::cargo_workspace::member_manifests_in;
+use crate::vendor::lock_inventory::{
     inventory_project_diagnosed_in, MemoryEntry, MemoryProject, ProjectView,
 };
 use tokio_util::sync::CancellationToken;
 
 pub(crate) mod discover;
 pub mod limits;
-pub(crate) mod redirect;
 pub(crate) mod roots;
 pub mod select;
+pub(crate) mod stages;
 pub mod types;
 
 pub use limits::SessionBuilder;
@@ -59,7 +59,7 @@ pub use select::{candidate_files, safe_repo_path, select_paths};
 pub use types::*;
 
 use discover::Provider;
-use redirect::{Planned, Refused, Rewritten, StageOptions};
+use stages::{Planned, RewriteRefused, Rewritten, StageOptions};
 
 /// `"<crate version>+<git sha or 'unknown'>"`; the sha comes from the
 /// `SOCKET_PATCH_GIT_SHA` build-time variable.
@@ -110,7 +110,7 @@ struct RootState {
     unreadable: BTreeSet<String>,
     purls: Vec<String>,
     summary: ProjectSummary,
-    packages: Vec<socket_patch_core::api::types::BatchPackagePatches>,
+    packages: Vec<crate::api::types::BatchPackagePatches>,
     selected: Vec<(String, String)>,
     skipped: Vec<SkippedPatch>,
     error: Option<ProjectError>,
@@ -421,7 +421,9 @@ async fn engine(
         };
         let (entries, unsupported) =
             inventory_project_diagnosed_in(&ProjectView::Memory(project)).await;
-        for (code, detail) in crate::commands::scan::unsupported_layout_warnings(&unsupported) {
+        for (code, detail) in
+            crate::vendor::lock_inventory::unsupported_layout_warnings(&unsupported)
+        {
             warnings.push(EngineWarning::new(code, detail, Some(&state.root)));
         }
         unsupported_ecosystem_warnings(&state.root, project, ecosystems, &mut warnings);
@@ -572,9 +574,9 @@ async fn engine(
             continue;
         };
         let unreadable = std::mem::take(&mut state.unreadable);
-        match redirect::plan(project, unreadable, &state.selected, &references) {
+        match stages::plan(project, unreadable, &state.selected, &references).await {
             Ok(plan) => planned.push((index, plan)),
-            Err(Refused { error }) => state.error = Some(error),
+            Err(refusal) => state.error = Some(ProjectError::from(refusal)),
         }
     }
     let wheels: BTreeSet<(String, String)> = planned
@@ -597,12 +599,11 @@ async fn engine(
     let mut rewritten: Vec<(usize, Rewritten)> = Vec::new();
     for (index, plan) in planned {
         checkpoint(&cancel).await?;
-        let skipped_before = plan.skipped.clone();
-        match redirect::rewrite(plan, &wheel_metadata, stage) {
+        match stages::rewrite(plan, &wheel_metadata, stage).await {
             Ok(done) => rewritten.push((index, done)),
-            Err(Refused { error }) => {
-                states[index].skipped = skipped_before;
-                states[index].error = Some(error);
+            Err(RewriteRefused { refusal, skipped }) => {
+                states[index].skipped = skipped;
+                states[index].error = Some(ProjectError::from(refusal));
             }
         }
     }
@@ -613,7 +614,7 @@ async fn engine(
     } else {
         rewritten
             .iter()
-            .flat_map(|(_, r)| r.confirmed.iter().map(|(_, u)| u.clone()))
+            .flat_map(|(_, r)| r.done.confirmed.iter().map(|(_, u)| u.clone()))
             .collect()
     };
     let records: BTreeMap<String, Option<PatchResponse>> = if record_uuids.is_empty() {
@@ -647,7 +648,7 @@ async fn engine(
         }
         let redirect = match &state.error {
             Some(_) => serde_json::json!({ "mode": "hosted" }),
-            None => crate::commands::scan::hosted::redirect_json_block(
+            None => crate::hosted::render::redirect_json_block(
                 0,
                 Vec::new(),
                 Vec::new(),
@@ -711,37 +712,36 @@ fn finish_root(
     warnings: &mut Vec<EngineWarning>,
 ) -> ProjectResult {
     let Rewritten {
-        planned,
+        project,
+        skipped,
+        pre_warnings,
+        done,
+    } = done;
+    let crate::hosted::engine::Rewritten {
         rewrite,
         rewritten,
         confirmed,
         rush_warnings,
         pnpm_warnings,
         npm_warnings,
+        ..
     } = done;
     let root = state.root.clone();
     // No ledger keeps the records; the fetch mirrors the disk flow's, so a
     // record the API cannot serve warns the same way.
-    let mut record_warnings: Vec<serde_json::Value> = Vec::new();
+    let mut record_warnings: Vec<crate::patch::redirect::RewriteWarning> = Vec::new();
     if !dry_run {
         for (purl, uuid) in &confirmed {
             match records.get(uuid) {
                 Some(Some(_)) => {}
-                _ => record_warnings.push(serde_json::json!({
-                    "code": "record_fetch_failed",
-                    "detail": format!(
-                        "{purl} was switched to hosted, but its patch record could not be \
-                         fetched; this run's VEX attestation omits it (`socket-patch vex` \
-                         fetches it again once the API answers)"
-                    ),
-                })),
+                _ => record_warnings.push(crate::hosted::engine::record_fetch_failed_warning(purl)),
             }
         }
     }
 
     let mut project_changes: Vec<(String, String)> = Vec::new();
     for (rel, content) in &rewrite.files {
-        if planned.project.text(rel) != Some(content.as_str()) {
+        if project.text(rel) != Some(content.as_str()) {
             project_changes.push((rel.clone(), content.clone()));
         }
     }
@@ -754,7 +754,7 @@ fn finish_root(
         .iter()
         .filter(|(rel, bytes)| {
             !matches!(
-                planned.project.get(rel.as_str()),
+                project.get(rel.as_str()),
                 Some(MemoryEntry::Binary(existing)) if existing.as_ref() == bytes.as_slice()
             )
         })
@@ -789,7 +789,7 @@ fn finish_root(
             redirect: serde_json::json!({ "mode": "hosted" }),
             summary: state.summary.clone(),
             redirected: Vec::new(),
-            skipped: planned.skipped,
+            skipped,
             error: Some(ProjectError {
                 code: "conflicting_write".into(),
                 message,
@@ -807,22 +807,19 @@ fn finish_root(
             .or_insert_with(|| (root.clone(), bytes));
     }
 
-    let mut redirect_warnings: Vec<serde_json::Value> = rewrite
-        .warnings
+    // One typed list in the envelope's order; JSON only at the boundary.
+    let mut warnings = rewrite.warnings.clone();
+    warnings.extend(record_warnings);
+    warnings.extend(rush_warnings);
+    warnings.extend(pnpm_warnings);
+    warnings.extend(npm_warnings);
+    warnings.extend(pre_warnings);
+    let redirect_warnings = crate::hosted::render::rewrite_warnings_json(&warnings);
+    let skipped_values: Vec<serde_json::Value> = skipped
         .iter()
-        .map(|w| serde_json::json!({ "code": w.code, "detail": w.detail }))
+        .map(crate::hosted::render::skipped_json)
         .collect();
-    redirect_warnings.extend(record_warnings);
-    redirect_warnings.extend(rush_warnings);
-    redirect_warnings.extend(pnpm_warnings);
-    redirect_warnings.extend(npm_warnings);
-    redirect_warnings.extend(planned.pre_warnings.iter().cloned());
-    let skipped_values: Vec<serde_json::Value> = planned
-        .skipped
-        .iter()
-        .map(|s| serde_json::to_value(s).unwrap_or(serde_json::Value::Null))
-        .collect();
-    let redirect = crate::commands::scan::hosted::redirect_json_block(
+    let redirect = crate::hosted::render::redirect_json_block(
         confirmed.len(),
         rewritten,
         skipped_values,
@@ -837,7 +834,7 @@ fn finish_root(
             .into_iter()
             .map(|(purl, uuid)| RedirectedPatch { purl, uuid })
             .collect(),
-        skipped: planned.skipped,
+        skipped,
         error: None,
     }
 }
@@ -845,7 +842,7 @@ fn finish_root(
 #[cfg(test)]
 mod tests {
     use super::*;
-    use socket_patch_core::patch::redirect::{FileEdit, RewriteResult};
+    use crate::patch::redirect::{FileEdit, RewriteResult};
 
     fn state(root: &str, project: MemoryProject) -> RootState {
         RootState {
@@ -862,8 +859,6 @@ mod tests {
     }
 
     fn rewritten(files: &[(&str, &str)]) -> Rewritten {
-        let planned = redirect::plan(MemoryProject::new(), BTreeSet::new(), &[], &HashMap::new())
-            .unwrap_or_else(|r| panic!("{:?}", r.error));
         let mut rewrite = RewriteResult::default();
         for (rel, content) in files {
             rewrite
@@ -879,13 +874,24 @@ mod tests {
             });
         }
         Rewritten {
-            planned,
-            rewrite,
-            rewritten: files.iter().map(|(rel, _)| (*rel).to_string()).collect(),
-            confirmed: vec![("pkg:cargo/serde@1.0.190".into(), "u".into())],
-            rush_warnings: Vec::new(),
-            pnpm_warnings: Vec::new(),
-            npm_warnings: Vec::new(),
+            project: MemoryProject::new(),
+            skipped: Vec::new(),
+            pre_warnings: Vec::new(),
+            done: crate::hosted::engine::Rewritten {
+                files: BTreeMap::new(),
+                symlinked_reads: Vec::new(),
+                unreadable_reads: Vec::new(),
+                overrides: Vec::new(),
+                rewrite,
+                rewritten: files.iter().map(|(rel, _)| (*rel).to_string()).collect(),
+                confirmed: vec![("pkg:cargo/serde@1.0.190".into(), "u".into())],
+                binary_bun: false,
+                rush_warnings: Vec::new(),
+                pnpm_warnings: Vec::new(),
+                npm_warnings: Vec::new(),
+                pnpm_rerun_only: false,
+                workspace_symlinked: false,
+            },
         }
     }
 
@@ -943,7 +949,8 @@ mod tests {
         changed_binary.insert("web/bun.lockb".to_string(), ("".to_string(), vec![1u8]));
         let mut warnings = Vec::new();
         let mut done = rewritten(&[]);
-        done.rewrite
+        done.done
+            .rewrite
             .binary_files
             .insert("bun.lockb".to_string(), vec![2u8]);
         let result = finish_root(
diff --git a/crates/socket-patch-cli/src/hosted_memory/roots.rs b/crates/socket-patch-core/src/hosted/memory/roots.rs
similarity index 98%
rename from crates/socket-patch-cli/src/hosted_memory/roots.rs
rename to crates/socket-patch-core/src/hosted/memory/roots.rs
index 053cf801..c715f85a 100644
--- a/crates/socket-patch-cli/src/hosted_memory/roots.rs
+++ b/crates/socket-patch-core/src/hosted/memory/roots.rs
@@ -7,8 +7,8 @@
 
 use std::collections::{BTreeMap, BTreeSet};
 
-use socket_patch_core::formats::registry;
-use socket_patch_core::utils::python_lock::is_python_lock_name;
+use crate::formats::registry;
+use crate::utils::python_lock::is_python_lock_name;
 
 use super::types::IgnoredPath;
 
diff --git a/crates/socket-patch-cli/src/hosted_memory/select.rs b/crates/socket-patch-core/src/hosted/memory/select.rs
similarity index 97%
rename from crates/socket-patch-cli/src/hosted_memory/select.rs
rename to crates/socket-patch-core/src/hosted/memory/select.rs
index b7d939af..76750320 100644
--- a/crates/socket-patch-cli/src/hosted_memory/select.rs
+++ b/crates/socket-patch-core/src/hosted/memory/select.rs
@@ -8,17 +8,18 @@
 
 use std::collections::{BTreeMap, BTreeSet};
 
-use socket_patch_core::constants::npm_family::{
+use crate::constants::npm_family::{
     BUN_LOCKB, PNP_MARKERS, RUSH_COMMON_LOCK_REL, RUSH_SUBSPACES_DIR,
 };
-use socket_patch_core::patch::redirect::npmrc::NPMRC_REL;
-use socket_patch_core::utils::python_lock::is_python_lock_name;
+use crate::patch::redirect::npmrc::NPMRC_REL;
+use crate::utils::python_lock::is_python_lock_name;
 
 use super::roots::{
     detect_roots, split_path, strip_root, EXCLUDED_ROOT_SEGMENTS, UNSUPPORTED_MARKERS,
 };
 use super::types::{IgnoredPath, PathSelection, SelectOptions, TreeEntryInput};
-use crate::commands::scan::hosted::{PNPM_WORKSPACE_REL, REDIRECT_CANDIDATE_FILES};
+use crate::hosted::engine::{REDIRECT_CANDIDATE_FILES, RUSH_REPO_STATE_REL};
+use crate::hosted::guidance::PNPM_WORKSPACE_REL;
 
 /// Most entries [`PathSelection::ignored_sample`] carries.
 pub const IGNORED_SAMPLE_MAX: usize = 100;
@@ -32,9 +33,6 @@ const MAX_PATH_DEPTH: usize = 64;
 /// The vendored-mode ledger (its presence refuses a vendored takeover).
 pub(crate) const VENDOR_STATE_REL: &str = ".socket/vendor/state.json";
 
-/// Rush's repo-state file (presence feeds the stale-hash warning).
-pub(crate) const RUSH_REPO_STATE_REL: &str = "common/config/rush/repo-state.json";
-
 /// Root-relative text files read beyond `REDIRECT_CANDIDATE_FILES`.
 const EXTRA_TEXT_FILES: [&str; 3] = [PNPM_WORKSPACE_REL, NPMRC_REL, VENDOR_STATE_REL];
 
diff --git a/crates/socket-patch-core/src/hosted/memory/stages.rs b/crates/socket-patch-core/src/hosted/memory/stages.rs
new file mode 100644
index 00000000..a2b8d403
--- /dev/null
+++ b/crates/socket-patch-core/src/hosted/memory/stages.rs
@@ -0,0 +1,347 @@
+//! One project root's hosted redirect over an in-memory file set: the
+//! shared engine ([`crate::hosted::engine`]) over a
+//! [`ProjectView::Memory`], split at the two provider round-trips the
+//! engine batches across roots (wheel metadata, then patch records).
+//! Everything that needs the host machine (the apply lock, vendored
+//! takeover reverts, stale install probes, VEX, telemetry, subprocesses) is
+//! left out; a vendored takeover is refused instead of performed.
+
+use std::collections::{BTreeMap, BTreeSet, HashMap};
+
+use crate::api::types::PackageVendorResult;
+use crate::hosted::engine::{
+    self, Candidate, CandidateFiles, Refusal, RewriteOptions, SkippedPatch,
+};
+use crate::hosted::vlt::Preflight;
+use crate::patch::redirect::npmrc::OuterAllowRemote;
+use crate::patch::redirect::DepOverride;
+use crate::utils::purl::strip_purl_qualifiers;
+use crate::vendor::lock_inventory::{MemoryEntry, MemoryProject, ProjectView};
+use crate::vendor::VendorState;
+
+use super::select::VENDOR_STATE_REL;
+
+/// Skip reason / warning code for a candidate the disk flow would migrate
+/// from vendored to hosted (the migration reverts committed wiring, which
+/// the in-memory engine does not do).
+pub(crate) const VENDORED_TAKEOVER_UNSUPPORTED: &str = "vendored_takeover_unsupported_in_memory";
+
+/// The engine-level options the per-root stages read.
+#[derive(Debug, Clone, Copy)]
+pub(crate) struct StageOptions {
+    pub(crate) dry_run: bool,
+    pub(crate) pipenv_major: Option<u32>,
+    pub(crate) trust_lockfile_config: bool,
+    pub(crate) npm_allow_remote_config: bool,
+}
+
+/// The vendored ledger's entries (the disk `vendor::load_state` parse,
+/// including its legacy `{mode}`-only shape); `None` when absent or
+/// unreadable.
+fn vendored_entries(project: &MemoryProject) -> Option<VendorState> {
+    let bytes: Vec<u8> = match project.get(VENDOR_STATE_REL)? {
+        MemoryEntry::Text(text) => text.as_bytes().to_vec(),
+        MemoryEntry::Binary(bytes) => bytes.to_vec(),
+        _ => return None,
+    };
+    match serde_json::from_slice::<VendorState>(&bytes) {
+        Ok(state) => Some(state),
+        Err(_) => {
+            let value: serde_json::Value = serde_json::from_slice(&bytes).ok()?;
+            (value.get("mode").is_some() && value.get("entries").is_none()).then(VendorState::new)
+        }
+    }
+}
+
+/// Whether Socket-owned vendored `[patch.crates-io]` wiring for exactly
+/// `name@version` is committed in the root manifest or (legacy) the
+/// project's cargo config — the disk `socket_wiring_present` probe over
+/// the in-memory files. The config cargo reads is `.cargo/config` when it
+/// exists, else `.cargo/config.toml`.
+fn cargo_vendored_wiring(files: &MemoryProject, name: &str, version: &str) -> bool {
+    use crate::vendor::cargo_manifest::{crates_io_patch_entries, entry_wires, parse_manifest};
+    let manifest_wired = files
+        .text("Cargo.toml")
+        .and_then(|text| parse_manifest(text).ok())
+        .is_some_and(|doc| {
+            crates_io_patch_entries(&doc)
+                .iter()
+                .any(|e| entry_wires(e, name, version))
+        });
+    let config_rel = if files.contains(".cargo/config") {
+        ".cargo/config"
+    } else {
+        ".cargo/config.toml"
+    };
+    let config_wired = files
+        .text(config_rel)
+        .and_then(|text| parse_manifest(text).ok())
+        .is_some_and(|doc| {
+            crates_io_patch_entries(&doc)
+                .iter()
+                .any(|e| e.source == "crates-io" && entry_wires(e, name, version))
+        });
+    manifest_wired || config_wired
+}
+
+/// Refuse (skip, with one warning) every candidate the disk flow would
+/// take over from vendored mode.
+fn refuse_takeovers(
+    project: &MemoryProject,
+    candidates: &mut Vec<Candidate>,
+    skipped: &mut Vec<SkippedPatch>,
+    pre_warnings: &mut Vec<crate::patch::redirect::RewriteWarning>,
+) {
+    let takeover_capable = |p: &str| {
+        p.starts_with("pkg:cargo/") || p.starts_with("pkg:npm/") || p.starts_with("pkg:golang/")
+    };
+    if !candidates.iter().any(|c| takeover_capable(&c.purl)) {
+        return;
+    }
+    let vendored = vendored_entries(project);
+    let mut refused: BTreeSet<String> = BTreeSet::new();
+    for candidate in candidates.iter().filter(|c| takeover_capable(&c.purl)) {
+        let has_entry = vendored.as_ref().is_some_and(|s| {
+            crate::vendor::lookup_entry(&s.entries, strip_purl_qualifiers(&candidate.purl))
+                .is_some()
+        });
+        let cargo_wired = !has_entry
+            && candidate.purl.starts_with("pkg:cargo/")
+            && cargo_vendored_wiring(project, &candidate.dep.name, &candidate.dep.version);
+        if has_entry || cargo_wired {
+            refused.insert(candidate.purl.clone());
+        }
+    }
+    if refused.is_empty() {
+        return;
+    }
+    pre_warnings.push(engine::warning(
+        VENDORED_TAKEOVER_UNSUPPORTED,
+        format!(
+            "{} currently vendored ({}); migrating a vendored package to hosted \
+             reverts its committed vendored wiring, which the in-memory hosted scan \
+             does not do — run `socket-patch scan --mode hosted` in a checkout to \
+             migrate, then re-run",
+            if refused.len() == 1 {
+                "1 package is"
+            } else {
+                "packages are"
+            },
+            refused.iter().cloned().collect::<Vec<_>>().join(", ")
+        ),
+    ));
+    for c in candidates.iter().filter(|c| refused.contains(&c.purl)) {
+        skipped.push(SkippedPatch::new(
+            &c.purl,
+            &c.dep.patch_uuid,
+            VENDORED_TAKEOVER_UNSUPPORTED,
+        ));
+    }
+    candidates.retain(|c| !refused.contains(&c.purl));
+}
+
+/// A project's state between the reference grants and the wheel-metadata
+/// fetch.
+#[derive(Debug)]
+pub(crate) struct Planned {
+    pub(crate) project: MemoryProject,
+    pub(crate) candidates: Vec<Candidate>,
+    pub(crate) skipped: Vec<SkippedPatch>,
+    pub(crate) pre_warnings: Vec<crate::patch::redirect::RewriteWarning>,
+    pub(crate) read: CandidateFiles,
+    /// `(artifact url, sha256)` of every pypi wheel whose metadata a
+    /// native lock rewrite needs.
+    pub(crate) wheels: Vec<(String, String)>,
+    /// The vlt artifact preflight, judged offline (no network here, so
+    /// every in-scope dep is withheld instead of pinned: `--offline`
+    /// parity).
+    pub(crate) vlt_preflight: Preflight,
+}
+
+/// Everything up to the wheel-metadata fetch. `unreadable` are the paths
+/// that exist without content.
+pub(crate) async fn plan(
+    project: MemoryProject,
+    unreadable: BTreeSet<String>,
+    selected: &[(String, String)],
+    references: &HashMap<String, PackageVendorResult>,
+) -> Result<Planned, Refusal> {
+    let mut skipped: Vec<SkippedPatch> = Vec::new();
+    let mut candidates = if selected.is_empty() {
+        Vec::new()
+    } else {
+        engine::build_candidates(selected, references, &mut skipped)
+    };
+    let view = ProjectView::Memory(&project);
+    if engine::bun_lockb_symlinked(&view, &candidates) {
+        return Err(engine::bun_lockb_symlink_refusal());
+    }
+    let vlt_preflight = {
+        let deps: Vec<(&str, &DepOverride)> = candidates
+            .iter()
+            .filter(|c| c.dep.ecosystem == "npm")
+            .map(|c| (c.purl.as_str(), &c.dep))
+            .collect();
+        crate::hosted::vlt::offline(&view, &deps).await
+    };
+    engine::withhold_everywhere(
+        &mut candidates,
+        &vlt_preflight.withheld_everywhere,
+        &mut skipped,
+    );
+    let mut pre_warnings = vlt_preflight.warnings.clone();
+    refuse_takeovers(&project, &mut candidates, &mut skipped, &mut pre_warnings);
+
+    let read = if candidates.is_empty() {
+        CandidateFiles::default()
+    } else {
+        engine::read_candidate_files(&view, &unreadable, &candidates).await
+    };
+    let wheels = engine::wheel_targets(&candidates, &read.files)
+        .into_iter()
+        .map(|(dep, sha256)| (dep.artifact_url.clone(), sha256.to_string()))
+        .collect();
+    Ok(Planned {
+        project,
+        candidates,
+        skipped,
+        pre_warnings,
+        read,
+        wheels,
+        vlt_preflight,
+    })
+}
+
+/// A project's rewrite, ready for the record fetch and the ledger merge.
+#[derive(Debug)]
+pub(crate) struct Rewritten {
+    pub(crate) project: MemoryProject,
+    pub(crate) skipped: Vec<SkippedPatch>,
+    pub(crate) pre_warnings: Vec<crate::patch::redirect::RewriteWarning>,
+    pub(crate) done: engine::Rewritten,
+}
+
+/// A refused rewrite: its refusal and the skips recorded before the
+/// wheel-metadata step.
+#[derive(Debug)]
+pub(crate) struct RewriteRefused {
+    pub(crate) refusal: Refusal,
+    pub(crate) skipped: Vec<SkippedPatch>,
+}
+
+/// Wheel metadata → the engine's rewrite → the guard.
+pub(crate) async fn rewrite(
+    planned: Planned,
+    wheel_metadata: &BTreeMap<String, Result<Option<String>, String>>,
+    options: StageOptions,
+) -> Result<Rewritten, RewriteRefused> {
+    let Planned {
+        project,
+        mut candidates,
+        mut skipped,
+        pre_warnings,
+        read,
+        wheels,
+        vlt_preflight,
+    } = planned;
+    let skipped_before = skipped.clone();
+    let mut python_metadata: BTreeMap<String, String> = BTreeMap::new();
+    let mut unavailable: BTreeSet<String> = BTreeSet::new();
+    for (url, _) in &wheels {
+        match wheel_metadata.get(url) {
+            Some(Ok(Some(metadata))) => {
+                python_metadata.insert(url.clone(), metadata.clone());
+            }
+            Some(Ok(None)) => {}
+            Some(Err(detail)) => {
+                if unavailable.insert(url.clone()) {
+                    for dep in candidates
+                        .iter()
+                        .map(|c| &c.dep)
+                        .filter(|d| &d.artifact_url == url)
+                    {
+                        skipped.push(engine::wheel_metadata_unavailable(dep, detail));
+                    }
+                }
+            }
+            None => {
+                unavailable.insert(url.clone());
+            }
+        }
+    }
+    candidates.retain(|c| !unavailable.contains(&c.dep.artifact_url));
+
+    let view = ProjectView::Memory(&project);
+    let targets_pipenv_lock = engine::pipenv_lock_targets(&read.files, &candidates);
+    // The in-memory host sees no user / global npm config.
+    let npm_outer = OuterAllowRemote::default;
+    let done = engine::rewrite(
+        &view,
+        read,
+        &candidates,
+        python_metadata,
+        &vlt_preflight.withheld_from_vlt,
+        &[],
+        RewriteOptions {
+            dry_run: options.dry_run,
+            targets_pipenv_lock,
+            pipenv_major: if targets_pipenv_lock {
+                options.pipenv_major
+            } else {
+                None
+            },
+            pipenv_unknown_detail: "The scan did not set `pipenvMajor`, so the Pipfile.lock \
+                references use the modern `file` form (Pipenv 2018 and later). A project \
+                installed with Pipenv 7–11 needs `path` references instead: re-run the scan \
+                with `pipenvMajor` set to that Pipenv major version."
+                .to_string(),
+            trust_lockfile_config: options.trust_lockfile_config,
+            npm_allow_remote_config: options.npm_allow_remote_config,
+            npm_outer: &npm_outer,
+            blocking: false,
+        },
+    )
+    .await;
+    if let Some(refusal) = engine::guard(&view, &done, &candidates) {
+        return Err(RewriteRefused {
+            refusal,
+            skipped: skipped_before,
+        });
+    }
+    Ok(Rewritten {
+        project,
+        skipped,
+        pre_warnings,
+        done,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn cargo_wiring_probe_is_scoped_to_the_crate_and_version() {
+        let mut p = MemoryProject::new();
+        p.insert_text(
+            "Cargo.toml",
+            "[package]\nname = \"app\"\n\n[dependencies]\nlog = \"0.4\"\ncc = \"1\"\n\n\
+             [patch.crates-io]\nopenssl-socket-0123abcd = { package = \"openssl\", path = \
+             \".socket/vendor/cargo/0123abcd-0000-4000-8000-000000000000/openssl-0.10.66\" }\n",
+        );
+        assert!(cargo_vendored_wiring(&p, "openssl", "0.10.66"));
+        assert!(!cargo_vendored_wiring(&p, "openssl", "0.10.65"));
+        assert!(!cargo_vendored_wiring(&p, "log", "0.4.22"));
+        assert!(!cargo_vendored_wiring(&p, "cc", "1.1.0"));
+
+        let mut legacy = MemoryProject::new();
+        legacy.insert_text("Cargo.toml", "[package]\nname = \"app\"\n");
+        let config = "[patch.crates-io]\ncc = { path = \
+                      \".socket/vendor/cargo/0123abcd-0000-4000-8000-000000000000/cc-1.1.0\" }\n";
+        legacy.insert_text(".cargo/config.toml", config);
+        assert!(cargo_vendored_wiring(&legacy, "cc", "1.1.0"));
+        // cargo reads the legacy spelling when it exists.
+        legacy.insert_text(".cargo/config", "");
+        assert!(!cargo_vendored_wiring(&legacy, "cc", "1.1.0"));
+    }
+}
diff --git a/crates/socket-patch-cli/src/hosted_memory/types.rs b/crates/socket-patch-core/src/hosted/memory/types.rs
similarity index 97%
rename from crates/socket-patch-cli/src/hosted_memory/types.rs
rename to crates/socket-patch-core/src/hosted/memory/types.rs
index ed8e3a84..f29c5777 100644
--- a/crates/socket-patch-cli/src/hosted_memory/types.rs
+++ b/crates/socket-patch-core/src/hosted/memory/types.rs
@@ -200,15 +200,7 @@ pub struct RedirectedPatch {
     pub uuid: String,
 }
 
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-#[serde(rename_all = "camelCase")]
-pub struct SkippedPatch {
-    pub purl: String,
-    pub uuid: String,
-    pub reason: String,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub detail: Option<String>,
-}
+pub use crate::hosted::engine::SkippedPatch;
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
@@ -217,6 +209,15 @@ pub struct ProjectError {
     pub message: String,
 }
 
+impl From<crate::hosted::engine::Refusal> for ProjectError {
+    fn from(refusal: crate::hosted::engine::Refusal) -> Self {
+        ProjectError {
+            code: refusal.code,
+            message: refusal.message,
+        }
+    }
+}
+
 /// `ProjectResult`.
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
diff --git a/crates/socket-patch-core/src/hosted/mod.rs b/crates/socket-patch-core/src/hosted/mod.rs
new file mode 100644
index 00000000..1a195bb9
--- /dev/null
+++ b/crates/socket-patch-core/src/hosted/mod.rs
@@ -0,0 +1,19 @@
+//! Hosted mode: rewrite ONLY the patched dependencies' lockfile /
+//! registry-config entries to point at Socket's hosted patched artifacts.
+//!
+//! - [`engine`] — the one plan → rewrite → edits engine, over a
+//!   [`ProjectView`](crate::vendor::lock_inventory::ProjectView), shared by
+//!   the disk flow (`scan`/`get --mode hosted` in the CLI) and the
+//!   in-memory engine.
+//! - [`guidance`] — the pnpm `trustLockfile` / npm `allow-remote`
+//!   auto-config planners and their warning texts.
+//! - [`vlt`] — the vlt artifact preflight.
+//! - [`memory`] — the engine over an in-memory repository (no filesystem,
+//!   subprocesses, environment or telemetry), embedded by the Node addon
+//!   (`socket-patch-node`) and the CLI's hidden `hosted-bundle` harness.
+
+pub mod engine;
+pub mod guidance;
+pub mod memory;
+pub mod render;
+pub mod vlt;
diff --git a/crates/socket-patch-core/src/hosted/render.rs b/crates/socket-patch-core/src/hosted/render.rs
new file mode 100644
index 00000000..51ccd080
--- /dev/null
+++ b/crates/socket-patch-core/src/hosted/render.rs
@@ -0,0 +1,43 @@
+//! The hosted engine's results as the JSON the CLI envelope and the
+//! in-memory engine return. The engine itself produces typed values
+//! ([`RewriteWarning`], [`SkippedPatch`]); only this adapter spells them as
+//! JSON, so the disk and memory paths cannot drift in key names.
+
+use super::engine::SkippedPatch;
+use crate::patch::redirect::RewriteWarning;
+
+/// A `skipped[]` entry (`{purl, uuid, reason[, detail]}`).
+pub fn skipped_json(skipped: &SkippedPatch) -> serde_json::Value {
+    serde_json::to_value(skipped).expect("SkippedPatch is plain strings: serialization cannot fail")
+}
+
+/// Warnings as `{code, detail}` JSON.
+pub fn rewrite_warnings_json(warnings: &[RewriteWarning]) -> Vec<serde_json::Value> {
+    warnings
+        .iter()
+        .map(|w| serde_json::json!({ "code": w.code, "detail": w.detail }))
+        .collect()
+}
+
+/// The nested `redirect` block of every hosted `--json` envelope — the ONE
+/// spelling of its key set (`mode`, `redirected`, `rewrittenFiles`,
+/// `skipped`, `warnings`, `dryRun`), shared by every hosted path (disk
+/// scan, its zero-discovery arm, and the in-memory engine), so the two cannot drift by convention.
+/// `mode` is `"hosted"`: an additive key so consumers dispatch on the mode without inferring it from which
+/// sub-object is present.
+pub fn redirect_json_block(
+    redirected: usize,
+    rewritten: Vec<String>,
+    skipped: Vec<serde_json::Value>,
+    warnings: Vec<serde_json::Value>,
+    dry_run: bool,
+) -> serde_json::Value {
+    serde_json::json!({
+        "mode": "hosted",
+        "redirected": redirected,
+        "rewrittenFiles": rewritten,
+        "skipped": skipped,
+        "warnings": warnings,
+        "dryRun": dry_run,
+    })
+}
diff --git a/crates/socket-patch-core/src/hosted/vlt.rs b/crates/socket-patch-core/src/hosted/vlt.rs
new file mode 100644
index 00000000..e2e83aaf
--- /dev/null
+++ b/crates/socket-patch-core/src/hosted/vlt.rs
@@ -0,0 +1,217 @@
+//! The vlt artifact preflight of the hosted flow, over a [`ProjectView`]:
+//! before any takeover or rewrite, each in-scope artifact is judged the way
+//! vlt fetches it. The disk flow probes the artifacts over the network (or
+//! judges them offline under `--offline`); the in-memory engine has no
+//! network and judges every one offline.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use crate::constants::npm_family::{
+    BUN_LOCK, BUN_LOCKB, NPM_LOCKS, PNPM_LOCK, VLT_HIDDEN_LOCK_REL, VLT_LOCK, VLT_STORE_DIR,
+};
+use crate::patch::redirect::vlt_preflight::{self, ArtifactProbe, OFFLINE_REASON};
+use crate::patch::redirect::{redact_grant_token, vlt, DepOverride};
+use crate::vendor::lock_inventory::{MemoryEntry, ProjectView};
+
+/// The warning code (and skip reason) of a dep whose artifact vlt would
+/// fail to verify.
+pub const ARTIFACT_UNVERIFIABLE: &str = "redirect_vlt_artifact_unverifiable";
+
+/// The skip `reason` of a dep the preflight withheld from every rewriter.
+pub const WITHHELD_REASON: &str = ARTIFACT_UNVERIFIABLE;
+
+/// Whether vlt's install state exists: the hidden lock as a regular file,
+/// or the store as a real directory. Stat only; the hidden lock can be
+/// megabytes and is never read into the rewriter's input.
+pub fn install_state_present(view: &ProjectView<'_>) -> bool {
+    match view {
+        ProjectView::Disk(cwd)
+        | ProjectView::Snapshot(crate::vendor::lock_inventory::DiskSnapshot {
+            root: cwd, ..
+        }) => {
+            let is = |rel: &str, dir: bool| {
+                std::fs::symlink_metadata(cwd.join(rel)).is_ok_and(|m| {
+                    if dir {
+                        m.file_type().is_dir()
+                    } else {
+                        m.file_type().is_file()
+                    }
+                })
+            };
+            is(VLT_HIDDEN_LOCK_REL, false) || is(VLT_STORE_DIR, true)
+        }
+        ProjectView::Memory(project) => {
+            matches!(
+                project.get(VLT_HIDDEN_LOCK_REL),
+                Some(MemoryEntry::Text(_) | MemoryEntry::Binary(_) | MemoryEntry::Present)
+            ) || project.is_dir(VLT_STORE_DIR)
+        }
+    }
+}
+
+/// Whether `bun.lockb` is present (disk: `exists`, which follows links).
+pub(crate) fn bun_lockb_present(view: &ProjectView<'_>) -> bool {
+    match view {
+        ProjectView::Disk(cwd)
+        | ProjectView::Snapshot(crate::vendor::lock_inventory::DiskSnapshot {
+            root: cwd, ..
+        }) => cwd.join(BUN_LOCKB).exists(),
+        ProjectView::Memory(project) => project.contains(BUN_LOCKB),
+    }
+}
+
+/// What the artifact preflight decided for this run's npm candidates.
+#[derive(Debug, Default)]
+pub struct Preflight {
+    /// Failed while vlt drives, or for a vlt-vendored takeover: withheld
+    /// from every rewriter.
+    pub withheld_everywhere: BTreeMap<String, String>,
+    /// Failed while another npm-family lock may drive: kept out of the vlt
+    /// rewrite only.
+    pub withheld_from_vlt: BTreeSet<String>,
+    pub passed: BTreeSet<String>,
+    /// Artifact bytes by URL, for the heal's no-record comparison.
+    pub artifacts: BTreeMap<String, Vec<u8>>,
+    pub warnings: Vec<crate::patch::redirect::RewriteWarning>,
+}
+
+/// The files `vlt_drives` and the preflight scope read: `vlt-lock.json`
+/// itself, and presence-only entries for the sibling locks and vlt's
+/// install state. Empty without a readable `vlt-lock.json`.
+pub async fn inputs(view: &ProjectView<'_>) -> BTreeMap<String, String> {
+    let mut files = BTreeMap::new();
+    let Ok(lock) = view.read_text(VLT_LOCK).await else {
+        return files;
+    };
+    files.insert(VLT_LOCK.to_string(), lock);
+    for sibling in [NPM_LOCKS[0], NPM_LOCKS[1], "yarn.lock", PNPM_LOCK, BUN_LOCK] {
+        if view.is_file(sibling) {
+            files.insert(sibling.to_string(), String::new());
+        }
+    }
+    if install_state_present(view) {
+        files.insert(VLT_HIDDEN_LOCK_REL.to_string(), String::new());
+    }
+    files
+}
+
+/// The deps a preflight must judge, and whether vlt drives the install.
+pub struct PreflightPlan {
+    pub scope: Vec<vlt_preflight::PreflightDep>,
+    pub drives: bool,
+}
+
+impl PreflightPlan {
+    /// The distinct artifact URLs to probe.
+    pub fn urls(&self) -> BTreeSet<String> {
+        self.scope.iter().map(|d| d.artifact_url.clone()).collect()
+    }
+}
+
+/// The preflight's scope over the project's [`inputs`] (`files`, never
+/// empty): `None` when no dep is in scope. `vendored` are the uuids whose
+/// purl a vlt vendored ledger entry claims.
+pub fn plan(
+    view: &ProjectView<'_>,
+    files: &BTreeMap<String, String>,
+    deps: &[(&str, &DepOverride)],
+    vendored: &BTreeSet<String>,
+) -> Option<PreflightPlan> {
+    let overrides: Vec<DepOverride> = deps.iter().map(|(_, dep)| (*dep).clone()).collect();
+    let scope = vlt_preflight::preflight_scope(files, &overrides, vendored);
+    if scope.is_empty() {
+        return None;
+    }
+    let drives = vlt::vlt_drives(files, bun_lockb_present(view));
+    Some(PreflightPlan { scope, drives })
+}
+
+fn unverifiable_detail(
+    url: &str,
+    reason: &str,
+    purl: &str,
+    already_pinned: bool,
+    everywhere: bool,
+) -> String {
+    if already_pinned {
+        format!(
+            "vlt would fail to verify {url}: {reason}; {purl} was left pinned by an earlier run \
+             and `vlt ci` will fail until the artifact verifies"
+        )
+    } else if everywhere {
+        format!("vlt would fail to verify {url}: {reason}; nothing was written for {purl}")
+    } else {
+        format!(
+            "vlt would fail to verify {url}: {reason}; vlt-lock.json was not changed for {purl}"
+        )
+    }
+}
+
+/// The preflight's verdicts for `plan` given the `probes` fetched for it
+/// (none for a URL that was not fetched: judged offline).
+pub fn judge(
+    plan: &PreflightPlan,
+    deps: &[(&str, &DepOverride)],
+    probes: BTreeMap<String, ArtifactProbe>,
+) -> Preflight {
+    let mut out = Preflight::default();
+    let mut passed_urls: BTreeSet<&str> = BTreeSet::new();
+    for dep in &plan.scope {
+        let reason = match probes.get(&dep.artifact_url) {
+            None => Some(OFFLINE_REASON.to_string()),
+            Some(probe) => probe.failure(&dep.sha512),
+        };
+        let Some(reason) = reason else {
+            out.passed.insert(dep.patch_uuid.clone());
+            passed_urls.insert(&dep.artifact_url);
+            continue;
+        };
+        let purl = deps
+            .iter()
+            .find(|(_, d)| d.patch_uuid == dep.patch_uuid)
+            .map_or("", |(purl, _)| *purl);
+        let everywhere = plan.drives || dep.vendored;
+        let detail = unverifiable_detail(
+            &dep.artifact_url,
+            &reason,
+            purl,
+            dep.already_pinned,
+            everywhere,
+        );
+        out.warnings.push(crate::hosted::engine::warning(
+            ARTIFACT_UNVERIFIABLE,
+            redact_grant_token(&detail, &dep.artifact_url, &dep.patch_uuid),
+        ));
+        if everywhere {
+            out.withheld_everywhere
+                .insert(dep.patch_uuid.clone(), purl.to_string());
+        } else {
+            out.withheld_from_vlt.insert(dep.patch_uuid.clone());
+        }
+    }
+    // Moved, not copied: every dep has been judged, and the probes are not
+    // read again, so a verified body is held once.
+    for (url, probe) in probes {
+        if passed_urls.contains(url.as_str()) {
+            if let Some(body) = probe.body {
+                out.artifacts.insert(url, body);
+            }
+        }
+    }
+    out
+}
+
+/// The preflight for a host with no network: every in-scope artifact is
+/// judged as `--offline` judges it, so the dep is withheld
+/// (`redirect_vlt_artifact_unverifiable`, "offline") rather than pinned in
+/// a lock vlt may not be able to install.
+pub async fn offline(view: &ProjectView<'_>, deps: &[(&str, &DepOverride)]) -> Preflight {
+    let files = inputs(view).await;
+    if files.is_empty() {
+        return Preflight::default();
+    }
+    match plan(view, &files, deps, &BTreeSet::new()) {
+        Some(plan) => judge(&plan, deps, BTreeMap::new()),
+        None => Preflight::default(),
+    }
+}
diff --git a/crates/socket-patch-core/src/ledgers.rs b/crates/socket-patch-core/src/ledgers.rs
new file mode 100644
index 00000000..5ad5e73d
--- /dev/null
+++ b/crates/socket-patch-core/src/ledgers.rs
@@ -0,0 +1,525 @@
+//! The project's patch stores read as one view: the agent manifest
+//! (`.socket/manifest.json`), the vendored ledger
+//! (`.socket/vendor/state.json`) and the hosted records. v5 hosted mode
+//! keeps no ledger, so the hosted records are the lockfiles' hosted pins
+//! (shaped as uuid-only records) or a run's fetched records, plus a pre-v5
+//! redirect ledger (`.socket/vendor/redirect-state.json`) read, never
+//! written, for migration.
+//!
+//! One owner-precedence rule decides which store owns a purl every reader
+//! merges ([`Ledgers::owned`], [`Ledgers::listed`], [`Ledgers::matching`]):
+//!
+//! 1. A manifest key is owned by the manifest. It claims every vendored
+//!    entry filed under that key or whose `base_purl` it names; a claimed
+//!    entry's embedded record is a fallback copy. The group's vendored
+//!    entry is the one filed under the key, else the lowest-keyed entry
+//!    naming it as `base_purl` (so `HashMap` order never decides).
+//! 2. Every unclaimed vendored entry owns its ledger key.
+//! 3. A hosted record owns its key when neither of the above does.
+//!
+//! So: manifest > vendored > hosted, by ledger key. The losing copies stay
+//! reachable as alternates ([`Owned::alts`]) for readers that decide by
+//! lockfile evidence (`vex`). The hosted records only ever join as the
+//! last store.
+
+use std::collections::{HashMap, HashSet};
+use std::path::Path;
+
+use crate::manifest::schema::{PatchManifest, PatchRecord};
+use crate::patch::redirect::{CorruptRedirectState, RedirectState};
+use crate::utils::purl::{normalize_purl, patch_matches, strip_purl_qualifiers};
+use crate::vendor::{VendorEntry, VendorState};
+
+/// A patch store, in owner-precedence order (a lower store wins a key).
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub enum Store {
+    /// `.socket/manifest.json` (agent mode).
+    Manifest,
+    /// `.socket/vendor/state.json` (vendored mode).
+    Vendored,
+    /// The hosted records (lockfile pins, a run's fetched records, or a
+    /// pre-v5 redirect ledger read for migration).
+    Hosted,
+}
+
+/// The three stores as loaded, each with its own outcome so every caller
+/// keeps its error posture (strict, lenient, per-leg).
+pub struct LoadedLedgers {
+    /// `Ok(None)`: absent; `Err(InvalidData)`: unparseable; other `Err`: I/O.
+    pub manifest: std::io::Result<Option<PatchManifest>>,
+    /// Absent is `Ok(empty)`; `Err` is unreadable or malformed.
+    pub vendor: std::io::Result<VendorState>,
+    /// The pre-v5 redirect ledger, read only (absent is `Ok(None)`).
+    pub redirect: Result<Option<RedirectState>, CorruptRedirectState>,
+}
+
+impl LoadedLedgers {
+    /// Load the manifest at `manifest_path`, the vendored ledger and any
+    /// pre-v5 redirect ledger of `project_root`, concurrently.
+    pub async fn load(project_root: &Path, manifest_path: &Path) -> Self {
+        let (manifest, vendor, redirect) = tokio::join!(
+            crate::manifest::operations::read_manifest(manifest_path),
+            crate::vendor::load_state(project_root),
+            crate::patch::redirect::load_redirect_state(project_root),
+        );
+        Self {
+            manifest,
+            vendor,
+            redirect,
+        }
+    }
+
+    /// The readable stores (a failed store reads as absent).
+    pub fn view(&self) -> Ledgers<'_> {
+        Ledgers {
+            manifest: self.manifest.as_ref().ok().and_then(Option::as_ref),
+            vendor: self.vendor.as_ref().ok(),
+            redirect: self.redirect.as_ref().ok().and_then(Option::as_ref),
+        }
+    }
+}
+
+/// A borrowed view over whichever stores a caller has.
+#[derive(Clone, Copy, Default)]
+pub struct Ledgers<'a> {
+    pub manifest: Option<&'a PatchManifest>,
+    pub vendor: Option<&'a VendorState>,
+    pub redirect: Option<&'a RedirectState>,
+}
+
+/// One owner key with the store that owns it and every copy under it.
+#[derive(Debug, Clone)]
+pub struct Owned<'a> {
+    pub key: &'a str,
+    pub store: Store,
+    pub uuid: &'a str,
+    /// The owner's record; `None` for a legacy vendored entry that embeds
+    /// none.
+    pub record: Option<&'a PatchRecord>,
+    /// The vendored entry in this group (the owner itself, or the one the
+    /// manifest key claimed), with its ledger key.
+    pub vendor: Option<(&'a str, &'a VendorEntry)>,
+    /// Whether the hosted records hold one under this key.
+    pub hosted: bool,
+    /// The losing copies' records, in precedence order.
+    pub alts: Vec<&'a PatchRecord>,
+}
+
+/// One copy [`Ledgers::listed`] shows.
+#[derive(Debug, Clone, Copy)]
+pub struct Listed<'a> {
+    pub key: &'a str,
+    pub record: &'a PatchRecord,
+    pub store: Store,
+}
+
+/// Every store's entries a remove/rollback identifier matches, each sorted
+/// by key.
+#[derive(Debug, Clone, Default)]
+pub struct Matches {
+    pub manifest: Vec<String>,
+    pub vendor: Vec<(String, VendorEntry)>,
+    pub hosted: Vec<String>,
+}
+
+impl Matches {
+    pub fn is_empty(&self) -> bool {
+        self.manifest.is_empty() && self.vendor.is_empty() && self.hosted.is_empty()
+    }
+}
+
+fn sorted_keys<V>(map: &HashMap<String, V>) -> Vec<&String> {
+    let mut keys: Vec<&String> = map.keys().collect();
+    keys.sort();
+    keys
+}
+
+impl<'a> Ledgers<'a> {
+    /// Every vendored entry grouped under the manifest key that claims it
+    /// (rule 1 of the module docs), each group sorted by ledger key. Built
+    /// in one pass over the sorted ledger, so the views stay O(V log V + M).
+    fn claims(&self) -> HashMap<&'a str, Vec<(&'a String, &'a VendorEntry)>> {
+        let mut claims: HashMap<&'a str, Vec<(&'a String, &'a VendorEntry)>> = HashMap::new();
+        if let Some(vendor) = self.vendor {
+            for key in sorted_keys(&vendor.entries) {
+                let entry = &vendor.entries[key];
+                if let Some(owner) = self.claimant(key, entry) {
+                    claims.entry(owner).or_default().push((key, entry));
+                }
+            }
+        }
+        claims
+    }
+
+    /// A claim group's representative entry: the one filed under the
+    /// manifest key itself, else the lowest-keyed.
+    fn primary<'c>(
+        key: &str,
+        group: &'c [(&'a String, &'a VendorEntry)],
+    ) -> Option<&'c (&'a String, &'a VendorEntry)> {
+        group
+            .iter()
+            .find(|(k, _)| k.as_str() == key)
+            .or_else(|| group.first())
+    }
+
+    /// The manifest key that claims the vendored entry filed under `key`
+    /// (rule 1 of the module docs): `key` itself, else its `base_purl`.
+    fn claimant(&self, key: &str, entry: &VendorEntry) -> Option<&'a str> {
+        let manifest = self.manifest?;
+        manifest
+            .patches
+            .get_key_value(key)
+            .or_else(|| manifest.patches.get_key_value(&entry.base_purl))
+            .map(|(k, _)| k.as_str())
+    }
+
+    /// Whether the vendored entry filed under `key` has a manifest owner.
+    pub fn vendor_claimed(&self, key: &str) -> bool {
+        self.vendor
+            .and_then(|v| v.entries.get(key))
+            .is_some_and(|entry| self.claimant(key, entry).is_some())
+    }
+
+    /// One group per owner key: the manifest's keys (sorted), then the
+    /// unclaimed vendored keys (sorted), then the hosted keys neither owns
+    /// (sorted).
+    pub fn owned(&self) -> Vec<Owned<'a>> {
+        let hosted_records = self.redirect.map(|r| &r.records);
+        let hosted_record = |key: &str| hosted_records.and_then(|r| r.get(key));
+        let mut out: Vec<Owned<'a>> = Vec::new();
+        let claims = self.claims();
+        if let Some(manifest) = self.manifest {
+            for key in sorted_keys(&manifest.patches) {
+                let record = &manifest.patches[key];
+                let group = claims
+                    .get(key.as_str())
+                    .map(Vec::as_slice)
+                    .unwrap_or_default();
+                let vendor = Self::primary(key, group).copied();
+                let mut alts: Vec<&'a PatchRecord> = Vec::new();
+                alts.extend(vendor.and_then(|(_, e)| e.record.as_ref()));
+                // Any further entry this key claims (another variant of
+                // the same base purl) is a fallback copy too.
+                alts.extend(
+                    group
+                        .iter()
+                        .filter(|(k, _)| vendor.is_none_or(|(vk, _)| vk != *k))
+                        .filter_map(|(_, e)| e.record.as_ref()),
+                );
+                alts.extend(hosted_record(key));
+                out.push(Owned {
+                    key,
+                    store: Store::Manifest,
+                    uuid: &record.uuid,
+                    record: Some(record),
+                    vendor: vendor.map(|(k, e)| (k.as_str(), e)),
+                    hosted: hosted_record(key).is_some(),
+                    alts,
+                });
+            }
+        }
+        if let Some(vendor) = self.vendor {
+            for key in sorted_keys(&vendor.entries) {
+                let entry = &vendor.entries[key];
+                if self.claimant(key, entry).is_some() {
+                    continue;
+                }
+                out.push(Owned {
+                    key,
+                    store: Store::Vendored,
+                    uuid: &entry.uuid,
+                    record: entry.record.as_ref(),
+                    vendor: Some((key.as_str(), entry)),
+                    hosted: hosted_record(key).is_some(),
+                    alts: hosted_record(key).into_iter().collect(),
+                });
+            }
+        }
+        if let Some(records) = hosted_records {
+            let taken: HashSet<&str> = out.iter().map(|o| o.key).collect();
+            for (key, record) in records {
+                if taken.contains(key.as_str()) {
+                    continue;
+                }
+                out.push(Owned {
+                    key,
+                    store: Store::Hosted,
+                    uuid: &record.uuid,
+                    record: Some(record),
+                    vendor: None,
+                    hosted: true,
+                    alts: Vec::new(),
+                });
+            }
+        }
+        out
+    }
+
+    /// Every record copy worth showing, sorted by key then store: all
+    /// manifest and hosted records, and every vendored record except a
+    /// claimed non-`detached` entry's (a standalone `vendor` entry's
+    /// fallback copy of the manifest record it is claimed by). A `detached`
+    /// entry is the only copy of its record, so it shows even beside a
+    /// manifest entry — coexistence is real state, labeled apart.
+    pub fn listed(&self) -> Vec<Listed<'a>> {
+        let mut out: Vec<Listed<'a>> = Vec::new();
+        if let Some(manifest) = self.manifest {
+            out.extend(manifest.patches.iter().map(|(key, record)| Listed {
+                key,
+                record,
+                store: Store::Manifest,
+            }));
+        }
+        if let Some(vendor) = self.vendor {
+            out.extend(vendor.entries.iter().filter_map(|(key, entry)| {
+                let record = entry.record.as_ref()?;
+                (entry.detached || self.claimant(key, entry).is_none()).then_some(Listed {
+                    key,
+                    record,
+                    store: Store::Vendored,
+                })
+            }));
+        }
+        if let Some(redirect) = self.redirect {
+            out.extend(redirect.records.iter().map(|(key, record)| Listed {
+                key,
+                record,
+                store: Store::Hosted,
+            }));
+        }
+        out.sort_by(|a, b| a.key.cmp(b.key).then(a.store.cmp(&b.store)));
+        out
+    }
+
+    /// Every entry a remove/rollback `identifier` (purl or uuid) matches:
+    /// manifest and hosted records by [`patch_matches`] on their key,
+    /// vendored entries by [`VendorEntry::matches_identifier`] (key or base
+    /// purl).
+    pub fn matching(&self, identifier: &str) -> Matches {
+        let mut manifest: Vec<String> = self
+            .manifest
+            .into_iter()
+            .flat_map(|m| m.patches.iter())
+            .filter(|(key, rec)| patch_matches(key, &rec.uuid, identifier))
+            .map(|(key, _)| key.clone())
+            .collect();
+        manifest.sort();
+        let mut vendor: Vec<(String, VendorEntry)> = self
+            .vendor
+            .into_iter()
+            .flat_map(|s| s.entries.iter())
+            .filter(|(key, entry)| entry.matches_identifier(key, identifier))
+            .map(|(k, e)| (k.clone(), e.clone()))
+            .collect();
+        vendor.sort_by(|a, b| a.0.cmp(&b.0));
+        let hosted: Vec<String> = self
+            .redirect
+            .into_iter()
+            .flat_map(|r| r.records.iter())
+            .filter(|(key, rec)| patch_matches(key, &rec.uuid, identifier))
+            .map(|(key, _)| key.clone())
+            .collect();
+        Matches {
+            manifest,
+            vendor,
+            hosted,
+        }
+    }
+
+    /// The purls both the hosted records and the vendored ledger claim,
+    /// canonical (qualifiers dropped, percent-decoded), sorted: each is
+    /// stale in exactly one store, which only the live lockfile can tell.
+    pub fn hosted_vendored_overlap(&self) -> Vec<String> {
+        let (Some(redirect), Some(vendor)) = (self.redirect, self.vendor) else {
+            return Vec::new();
+        };
+        if vendor.entries.is_empty() {
+            return Vec::new();
+        }
+        // Canonicalize both sides (drop qualifiers, percent-decode) so the API
+        // purl form the redirect records carry matches the vendor entry's base
+        // purl — mirrors `vendored_ledger_supplement`.
+        let canon = |p: &str| normalize_purl(strip_purl_qualifiers(p)).into_owned();
+        let mut vendor_purls: std::collections::BTreeSet<String> =
+            std::collections::BTreeSet::new();
+        for (key, entry) in &vendor.entries {
+            vendor_purls.insert(canon(key));
+            vendor_purls.insert(canon(&entry.base_purl));
+        }
+        let redirect_purls: std::collections::BTreeSet<String> =
+            redirect.records.keys().map(|p| canon(p)).collect();
+        redirect_purls
+            .intersection(&vendor_purls)
+            .cloned()
+            .collect()
+    }
+}
+
+/// A uuid-only stand-in record (a legacy vendored entry that embeds no
+/// record, or a lockfile pin with no store record).
+pub fn uuid_only_record(uuid: &str) -> PatchRecord {
+    PatchRecord {
+        uuid: uuid.to_string(),
+        exported_at: String::new(),
+        files: HashMap::new(),
+        vulnerabilities: HashMap::new(),
+        description: String::new(),
+        license: String::new(),
+        tier: String::new(),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn record(uuid: &str) -> PatchRecord {
+        uuid_only_record(uuid)
+    }
+
+    fn entry(uuid: &str, base: &str, detached: bool, rec: Option<&str>) -> VendorEntry {
+        let mut value = serde_json::json!({
+            "uuid": uuid,
+            "basePurl": base,
+            "ecosystem": "npm",
+            "artifact": { "path": "", "sha256": "" },
+            "wiring": [],
+            "detached": detached,
+        });
+        if let Some(r) = rec {
+            value["record"] = serde_json::to_value(record(r)).unwrap();
+        }
+        serde_json::from_value(value).expect("vendor entry fixture")
+    }
+
+    fn manifest(pairs: &[(&str, &str)]) -> PatchManifest {
+        let mut m = PatchManifest::new();
+        for (k, u) in pairs {
+            m.patches.insert(k.to_string(), record(u));
+        }
+        m
+    }
+
+    fn vendor(pairs: Vec<(&str, VendorEntry)>) -> VendorState {
+        let mut s = VendorState::new();
+        for (k, e) in pairs {
+            s.entries.insert(k.to_string(), e);
+        }
+        s
+    }
+
+    fn redirect(pairs: &[(&str, &str)]) -> RedirectState {
+        let mut r = RedirectState::new();
+        for (k, u) in pairs {
+            r.records.insert(k.to_string(), record(u));
+        }
+        r
+    }
+
+    #[test]
+    fn manifest_beats_vendored_beats_hosted() {
+        let m = manifest(&[("pkg:npm/a@1", "m")]);
+        let v = vendor(vec![
+            ("pkg:npm/a@1", entry("v", "pkg:npm/a@1", true, Some("v"))),
+            ("pkg:npm/b@1", entry("vb", "pkg:npm/b@1", true, Some("vb"))),
+        ]);
+        let r = redirect(&[
+            ("pkg:npm/a@1", "h"),
+            ("pkg:npm/b@1", "hb"),
+            ("pkg:npm/c@1", "hc"),
+        ]);
+        let l = Ledgers {
+            manifest: Some(&m),
+            vendor: Some(&v),
+            redirect: Some(&r),
+        };
+        let owned = l.owned();
+        let got: Vec<(&str, Store, &str, Vec<&str>)> = owned
+            .iter()
+            .map(|o| {
+                (
+                    o.key,
+                    o.store,
+                    o.uuid,
+                    o.alts.iter().map(|a| a.uuid.as_str()).collect(),
+                )
+            })
+            .collect();
+        assert_eq!(
+            got,
+            vec![
+                ("pkg:npm/a@1", Store::Manifest, "m", vec!["v", "h"]),
+                ("pkg:npm/b@1", Store::Vendored, "vb", vec!["hb"]),
+                ("pkg:npm/c@1", Store::Hosted, "hc", vec![]),
+            ]
+        );
+    }
+
+    #[test]
+    fn a_manifest_key_claims_the_entry_naming_it_as_base_purl() {
+        let m = manifest(&[("pkg:npm/a@1", "m")]);
+        let v = vendor(vec![
+            (
+                "pkg:npm/a@1?x=2",
+                entry("v2", "pkg:npm/a@1", false, Some("v2")),
+            ),
+            (
+                "pkg:npm/a@1?x=1",
+                entry("v1", "pkg:npm/a@1", false, Some("v1")),
+            ),
+        ]);
+        let l = Ledgers {
+            manifest: Some(&m),
+            vendor: Some(&v),
+            redirect: None,
+        };
+        let owned = l.owned();
+        assert_eq!(owned.len(), 1);
+        assert_eq!(owned[0].vendor.map(|(k, _)| k), Some("pkg:npm/a@1?x=1"));
+        let alts: Vec<&str> = owned[0].alts.iter().map(|a| a.uuid.as_str()).collect();
+        assert_eq!(alts, vec!["v1", "v2"]);
+        assert!(l.vendor_claimed("pkg:npm/a@1?x=1"));
+        assert!(l.vendor_claimed("pkg:npm/a@1?x=2"));
+        // Claimed fallback copies are not listed.
+        let listed: Vec<(&str, Store)> = l.listed().iter().map(|e| (e.key, e.store)).collect();
+        assert_eq!(listed, vec![("pkg:npm/a@1", Store::Manifest)]);
+    }
+
+    #[test]
+    fn a_detached_claimed_entry_still_lists() {
+        let m = manifest(&[("pkg:npm/a@1", "m")]);
+        let v = vendor(vec![(
+            "pkg:npm/a@1",
+            entry("v", "pkg:npm/a@1", true, Some("v")),
+        )]);
+        let l = Ledgers {
+            manifest: Some(&m),
+            vendor: Some(&v),
+            redirect: None,
+        };
+        assert_eq!(l.listed().len(), 2);
+        assert_eq!(l.owned().len(), 1);
+    }
+
+    #[test]
+    fn matching_spans_every_store() {
+        let m = manifest(&[("pkg:npm/a@1", "m")]);
+        let v = vendor(vec![(
+            "pkg:npm/a@1?q=1",
+            entry("v", "pkg:npm/a@1", true, None),
+        )]);
+        let r = redirect(&[("pkg:npm/a@1", "h"), ("pkg:npm/b@1", "hb")]);
+        let l = Ledgers {
+            manifest: Some(&m),
+            vendor: Some(&v),
+            redirect: Some(&r),
+        };
+        let found = l.matching("pkg:npm/a@1");
+        assert_eq!(found.manifest, vec!["pkg:npm/a@1"]);
+        assert_eq!(found.vendor.len(), 1);
+        assert_eq!(found.hosted, vec!["pkg:npm/a@1"]);
+        assert!(l.matching("nope").is_empty());
+        assert_eq!(l.matching("hb").hosted, vec!["pkg:npm/b@1"]);
+    }
+}
diff --git a/crates/socket-patch-core/src/lib.rs b/crates/socket-patch-core/src/lib.rs
index bb42fcfc..196beafe 100644
--- a/crates/socket-patch-core/src/lib.rs
+++ b/crates/socket-patch-core/src/lib.rs
@@ -3,6 +3,8 @@ pub mod constants;
 pub mod crawlers;
 pub mod formats;
 pub mod hash;
+pub mod hosted;
+pub mod ledgers;
 pub mod manifest;
 pub mod patch;
 pub mod telemetry;
diff --git a/crates/socket-patch-core/src/manifest/mod.rs b/crates/socket-patch-core/src/manifest/mod.rs
index 06c3ccf4..0d408845 100644
--- a/crates/socket-patch-core/src/manifest/mod.rs
+++ b/crates/socket-patch-core/src/manifest/mod.rs
@@ -1,3 +1,4 @@
 pub mod cleanup_blobs;
 pub mod operations;
+pub mod records;
 pub mod schema;
diff --git a/crates/socket-patch-core/src/manifest/records.rs b/crates/socket-patch-core/src/manifest/records.rs
new file mode 100644
index 00000000..453e0ab2
--- /dev/null
+++ b/crates/socket-patch-core/src/manifest/records.rs
@@ -0,0 +1,84 @@
+//! Manifest records built from fetched patch views: the ONE rule every
+//! flow (get, scan, vendor, repair, hosted) uses to turn a `PatchResponse`
+//! into the `PatchRecord` it persists.
+
+use std::collections::HashMap;
+
+use crate::api::types::{PatchResponse, VulnerabilityResponse};
+use crate::manifest::schema::{PatchFileInfo, PatchRecord, VulnerabilityInfo};
+
+/// Convert the API-shaped vulnerability map on `PatchResponse` into the
+/// serialization-shaped map stored in the manifest.
+pub fn vulnerabilities_for_manifest(
+    vulns: &HashMap<String, VulnerabilityResponse>,
+) -> HashMap<String, VulnerabilityInfo> {
+    vulns
+        .iter()
+        .map(|(id, v)| {
+            (
+                id.clone(),
+                VulnerabilityInfo {
+                    cves: v.cves.clone(),
+                    summary: v.summary.clone(),
+                    severity: v.severity.clone(),
+                    description: v.description.clone(),
+                },
+            )
+        })
+        .collect()
+}
+
+/// Build the `PatchRecord` that will be inserted into the manifest for
+/// `patch`. `files` is the (purl-keyed) before/after-hash map the
+/// caller built — semantics for what counts as a "patchable file" differ
+/// between the get and download flows, so the caller owns that decision.
+pub fn build_patch_record(patch: &PatchResponse, files: HashMap<String, PatchFileInfo>) -> PatchRecord {
+    PatchRecord {
+        uuid: patch.uuid.clone(),
+        exported_at: patch.published_at.clone(),
+        files,
+        vulnerabilities: vulnerabilities_for_manifest(&patch.vulnerabilities),
+        description: patch.description.clone(),
+        license: patch.license.clone(),
+        tier: patch.tier.clone(),
+    }
+}
+
+/// Build the manifest-shaped `files` map from a fetched patch view,
+/// keeping EVERY file the patch touches — including net-new files the
+/// patch ADDS, which carry an `afterHash` but no `beforeHash`. A new
+/// file is recorded with an empty-string `beforeHash` sentinel, the same
+/// convention `save_and_apply_patch`'s by-uuid path relies on: apply
+/// treats an empty `beforeHash` as "create this file" and
+/// [`select_installed_variants`](crate::patch::apply::select_installed_variants) treats it as non-discriminating.
+///
+/// This is the shared record-building rule for the scan/download/vendor
+/// flows AND the single-uuid apply path, so `get <uuid>` and
+/// `scan`/`apply`/`vendor` all record and write the same set of files.
+/// A both-hashes rule here would drop every added file (e.g. a whole-crate
+/// cargo export where ALL files lack a `beforeHash`, recorded as `files:{}`
+/// while reporting `applied:1`).
+pub fn files_for_manifest(patch: &PatchResponse) -> HashMap<String, PatchFileInfo> {
+    let mut files = HashMap::new();
+    for (file_path, file_info) in &patch.files {
+        if let Some(after) = &file_info.after_hash {
+            files.insert(
+                file_path.clone(),
+                PatchFileInfo {
+                    before_hash: file_info.before_hash.clone().unwrap_or_default(),
+                    after_hash: after.clone(),
+                },
+            );
+        }
+    }
+    files
+}
+
+/// `(purl, manifest record)` from a fetched patch view — retains
+/// patch-added new files via [`files_for_manifest`].
+pub fn record_from_patch_response(patch: &PatchResponse) -> (String, PatchRecord) {
+    (
+        patch.purl.clone(),
+        build_patch_record(patch, files_for_manifest(patch)),
+    )
+}
diff --git a/crates/socket-patch-core/src/utils/cargo_workspace.rs b/crates/socket-patch-core/src/utils/cargo_workspace.rs
index 3721f0de..38749c36 100644
--- a/crates/socket-patch-core/src/utils/cargo_workspace.rs
+++ b/crates/socket-patch-core/src/utils/cargo_workspace.rs
@@ -37,7 +37,10 @@ pub fn member_manifests(root: &Path) -> Vec<String> {
 /// under it; symbolic links are never directories).
 pub fn member_manifests_in(view: &ProjectView<'_>) -> Vec<String> {
     match view {
-        ProjectView::Disk(root) => member_manifests(root),
+        ProjectView::Disk(root)
+        | ProjectView::Snapshot(crate::vendor::lock_inventory::DiskSnapshot { root, .. }) => {
+            member_manifests(root)
+        }
         ProjectView::Memory(project) => member_manifests_with(&MemoryTree(project)),
     }
 }
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/cargo.rs b/crates/socket-patch-core/src/vendor/lock_inventory/cargo.rs
index 37caa503..4f4095b5 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/cargo.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/cargo.rs
@@ -41,7 +41,11 @@ pub(super) async fn inventory_cargo_lock_raw_in(
     view: &ProjectView<'_>,
 ) -> Option<Vec<LockfileEntry>> {
     let doc: std::sync::Arc<toml_edit::DocumentMut> = match view {
-        ProjectView::Disk(project_root) => {
+        ProjectView::Disk(project_root)
+        | ProjectView::Snapshot(crate::vendor::lock_inventory::DiskSnapshot {
+            root: project_root,
+            ..
+        }) => {
             crate::vendor::cargo_lock::read_lock(project_root)
                 .await
                 .ok()?
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/mod.rs b/crates/socket-patch-core/src/vendor/lock_inventory/mod.rs
index 1cacfe2e..78c68fb5 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/mod.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/mod.rs
@@ -65,8 +65,8 @@ pub(crate) mod npm_family;
 pub(crate) mod pnpm;
 pub(crate) mod pypi;
 pub(crate) mod recover;
-pub(crate) mod vlt;
 pub mod view;
+pub(crate) mod vlt;
 pub(crate) mod wired;
 pub(crate) mod yarn;
 
@@ -75,7 +75,7 @@ pub(crate) use self::npm::{npm_lock_nodes, NpmLockNode};
 pub(crate) use self::npm_family::inventory_npm_lock;
 pub(crate) use self::pypi::pipfile_lock_entries;
 pub use self::recover::recover_lock_entry;
-pub use self::view::{MemoryEntry, MemoryProject, ProjectView};
+pub use self::view::{DiskSnapshot, MemoryEntry, MemoryProject, ProjectView};
 pub use self::wired::wired_vendor_integrity;
 
 // The per-format views `inventory_project_diagnosed` unions (and the test
@@ -203,6 +203,39 @@ pub struct UnsupportedNpmLayout {
     pub detail: String,
 }
 
+/// Map a core npm-layout refusal onto scan's warning channel as
+/// `(code, detail)`. The yarn code matches apply's refusal errorCode
+/// (`yarn_pnp_unsupported`) so consumers key on ONE name across commands;
+/// the pnpm twin gets the parallel spelling. Details are scan-phrased (what
+/// was NOT scanned + remedy) rather than the probe's vendor-phrased text.
+pub fn unsupported_layout_warnings(unsupported: &[UnsupportedNpmLayout]) -> Vec<(String, String)> {
+    unsupported
+        .iter()
+        .map(|diag| match diag.code {
+            "vendor_yarn_berry_unsupported" => (
+                "yarn_pnp_unsupported".to_string(),
+                "this project uses yarn Plug'n'Play (a `.pnp.*` loader is present): its npm \
+                 packages live inside `.yarn/cache/*.zip`, not `node_modules/`, so socket-patch \
+                 cannot discover or patch them in ANY mode (agent, hosted, or vendored) — npm \
+                 dependencies were NOT scanned. Use `yarn patch <pkg>` to patch them instead."
+                    .to_string(),
+            ),
+            "vendor_pnpm_pnp_unsupported" => (
+                "pnpm_pnp_unsupported".to_string(),
+                "this project uses pnpm's Plug'n'Play linker (`node-linker=pnp` in .npmrc): \
+                 lockfile discovery is skipped under this layout, so lockfile-only npm \
+                 dependencies were NOT scanned. Switch .npmrc to `node-linker=isolated`, run \
+                 `pnpm install`, and re-run — or use `socket-patch scan --mode hosted`, which \
+                 edits pnpm-lock.yaml in place."
+                    .to_string(),
+            ),
+            // Forward-compat: a new refusal code surfaces verbatim rather
+            // than being swallowed back into silence.
+            other => (other.to_string(), diag.detail.clone()),
+        })
+        .collect()
+}
+
 /// Match a manifest/API purl (possibly percent-encoded, possibly carrying
 /// qualifiers) against the inventory: components decode via
 /// [`crate::utils::purl::normalize_purl`], so `pkg:npm/%40scope/x@1`
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/pnpm.rs b/crates/socket-patch-core/src/vendor/lock_inventory/pnpm.rs
index 27aefcef..f477d9cb 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/pnpm.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/pnpm.rs
@@ -90,7 +90,11 @@ fn pnpm_lock_text_inventory(text: &str) -> Option<Vec<LockfileEntry>> {
 /// it comes back empty.
 pub(super) async fn inventory_rush_pnpm_locks_in(view: &ProjectView<'_>) -> Vec<LockfileEntry> {
     let project = match view {
-        ProjectView::Disk(project_root) => return inventory_rush_pnpm_locks(project_root).await,
+        ProjectView::Disk(project_root)
+        | ProjectView::Snapshot(crate::vendor::lock_inventory::DiskSnapshot {
+            root: project_root,
+            ..
+        }) => return inventory_rush_pnpm_locks(project_root).await,
         ProjectView::Memory(project) => *project,
     };
     if !project.contains("rush.json") {
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/pypi.rs b/crates/socket-patch-core/src/vendor/lock_inventory/pypi.rs
index 6bd242b5..4960652e 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/pypi.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/pypi.rs
@@ -188,7 +188,10 @@ pub(super) async fn inventory_pypi_locks_in(view: &ProjectView<'_>) -> Option<Ve
 /// on disk; the in-memory project's root-level names otherwise), sorted.
 pub(crate) fn python_lock_paths_in(view: &ProjectView<'_>) -> std::io::Result<Vec<String>> {
     match view {
-        ProjectView::Disk(root) => crate::utils::python_lock::python_lock_paths(root),
+        ProjectView::Disk(root)
+        | ProjectView::Snapshot(crate::vendor::lock_inventory::DiskSnapshot { root, .. }) => {
+            crate::utils::python_lock::python_lock_paths(root)
+        }
         ProjectView::Memory(project) => Ok(project
             .children("")
             .into_iter()
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/view.rs b/crates/socket-patch-core/src/vendor/lock_inventory/view.rs
index 7161b358..db5105bf 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/view.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/view.rs
@@ -2,7 +2,10 @@
 //! ([`ProjectView::Disk`]) or an in-memory file map
 //! ([`ProjectView::Memory`]) handed in by a host that never materializes
 //! the repository (the hosted in-memory engine). The disk variant calls the
-//! plain FIFO-safe filesystem readers.
+//! plain FIFO-safe filesystem readers; the snapshot variant
+//! ([`ProjectView::Snapshot`]) is the disk variant with each file's
+//! content read at most once, so every reader of one run (the lock
+//! inventory, lockfile discovery) sees the same bytes.
 
 use std::collections::{BTreeMap, BTreeSet};
 use std::io;
@@ -191,19 +194,118 @@ pub struct DirEntryInfo {
     pub is_dir: bool,
 }
 
+/// Cached reads by root-relative path: the content, or the error kind and
+/// message of the failed read.
+type ReadCache = std::collections::HashMap<String, Result<Arc<[u8]>, (io::ErrorKind, String)>>;
+
+/// A read-through cache over the files under `root`: the first read of a
+/// path hits the disk, later ones return the same content (or the same
+/// error). Everything that is not a content read (existence, file type,
+/// directory listings, the disk-only probes) goes to the disk directly.
+/// [`DiskSnapshot::invalidate`] drops what a write may have changed.
+#[derive(Debug)]
+pub struct DiskSnapshot<'a> {
+    pub root: &'a Path,
+    reads: std::sync::Mutex<ReadCache>,
+}
+
+impl<'a> DiskSnapshot<'a> {
+    pub fn new(root: &'a Path) -> Self {
+        Self {
+            root,
+            reads: std::sync::Mutex::new(std::collections::HashMap::new()),
+        }
+    }
+
+    /// Forget every cached read (after a write under `root`).
+    pub fn invalidate(&self) {
+        self.lock().clear();
+    }
+
+    fn lock(&self) -> std::sync::MutexGuard<'_, ReadCache> {
+        self.reads
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+    }
+
+    fn cached(&self, rel: &str) -> Option<io::Result<Arc<[u8]>>> {
+        self.lock().get(rel).map(|r| match r {
+            Ok(bytes) => Ok(Arc::clone(bytes)),
+            Err((kind, msg)) => Err(io::Error::new(*kind, msg.clone())),
+        })
+    }
+
+    fn remember(&self, rel: &str, read: &io::Result<Vec<u8>>) {
+        let entry = match read {
+            Ok(bytes) => Ok(Arc::<[u8]>::from(bytes.as_slice())),
+            Err(e) => Err((e.kind(), e.to_string())),
+        };
+        self.lock().insert(rel.to_string(), entry);
+    }
+
+    async fn read_bytes(&self, rel: &str) -> io::Result<Vec<u8>> {
+        if let Some(hit) = self.cached(rel) {
+            return hit.map(|b| b.to_vec());
+        }
+        let read = read_regular_to_bytes(&self.root.join(rel)).await;
+        self.remember(rel, &read);
+        read
+    }
+
+    fn read_bytes_sync(&self, rel: &str) -> io::Result<Vec<u8>> {
+        if let Some(hit) = self.cached(rel) {
+            return hit.map(|b| b.to_vec());
+        }
+        let read = crate::utils::fs::read_regular_to_bytes_sync(&self.root.join(rel));
+        self.remember(rel, &read);
+        read
+    }
+}
+
+fn utf8(bytes: Vec<u8>) -> io::Result<String> {
+    String::from_utf8(bytes).map_err(|e| io::Error::new(io::ErrorKind::InvalidData, e))
+}
+
 /// Where the registry views read the project from.
 #[derive(Debug, Clone, Copy)]
 pub enum ProjectView<'a> {
     Disk(&'a Path),
     Memory(&'a MemoryProject),
+    /// The disk under a per-run read cache.
+    Snapshot(&'a DiskSnapshot<'a>),
 }
 
 impl ProjectView<'_> {
+    /// The checkout root when the view reads a real filesystem (the disk
+    /// and snapshot variants), for the probes that only exist on disk.
+    pub fn disk_root(&self) -> Option<&Path> {
+        match self {
+            ProjectView::Disk(root) | ProjectView::Snapshot(DiskSnapshot { root, .. }) => {
+                Some(root)
+            }
+            ProjectView::Memory(_) => None,
+        }
+    }
+
     /// FIFO-safe regular-file text read.
     pub async fn read_text(&self, rel: &str) -> io::Result<String> {
         match self {
             ProjectView::Disk(root) => read_regular_to_string(&root.join(rel)).await,
             ProjectView::Memory(project) => project.read_text(rel),
+            ProjectView::Snapshot(snap) => match snap.cached(rel) {
+                Some(hit) => hit.and_then(|b| utf8(b.to_vec())),
+                None => {
+                    let read = read_regular_to_string(&snap.root.join(rel)).await;
+                    snap.remember(
+                        rel,
+                        &read
+                            .as_ref()
+                            .map(|t| t.as_bytes().to_vec())
+                            .map_err(|e| io::Error::new(e.kind(), e.to_string())),
+                    );
+                    read
+                }
+            },
         }
     }
 
@@ -212,6 +314,7 @@ impl ProjectView<'_> {
         match self {
             ProjectView::Disk(root) => read_regular_to_bytes(&root.join(rel)).await,
             ProjectView::Memory(project) => project.read_bytes(rel),
+            ProjectView::Snapshot(snap) => snap.read_bytes(rel).await,
         }
     }
 
@@ -220,13 +323,16 @@ impl ProjectView<'_> {
         match self {
             ProjectView::Disk(root) => read_regular_to_string_sync(&root.join(rel)),
             ProjectView::Memory(project) => project.read_text(rel),
+            ProjectView::Snapshot(snap) => snap.read_bytes_sync(rel).and_then(utf8),
         }
     }
 
     /// `metadata` (follows links) succeeds.
     pub async fn exists(&self, rel: &str) -> bool {
         match self {
-            ProjectView::Disk(root) => tokio::fs::metadata(root.join(rel)).await.is_ok(),
+            ProjectView::Disk(root) | ProjectView::Snapshot(DiskSnapshot { root, .. }) => {
+                tokio::fs::metadata(root.join(rel)).await.is_ok()
+            }
             ProjectView::Memory(project) => project.contains(rel) || project.is_dir(rel),
         }
     }
@@ -234,7 +340,9 @@ impl ProjectView<'_> {
     /// `symlink_metadata` (does not follow links) succeeds.
     pub async fn exists_no_follow(&self, rel: &str) -> bool {
         match self {
-            ProjectView::Disk(root) => tokio::fs::symlink_metadata(root.join(rel)).await.is_ok(),
+            ProjectView::Disk(root) | ProjectView::Snapshot(DiskSnapshot { root, .. }) => {
+                tokio::fs::symlink_metadata(root.join(rel)).await.is_ok()
+            }
             ProjectView::Memory(project) => project.contains(rel) || project.is_dir(rel),
         }
     }
@@ -242,7 +350,9 @@ impl ProjectView<'_> {
     /// A regular file (following links on disk).
     pub fn is_file(&self, rel: &str) -> bool {
         match self {
-            ProjectView::Disk(root) => root.join(rel).is_file(),
+            ProjectView::Disk(root) | ProjectView::Snapshot(DiskSnapshot { root, .. }) => {
+                root.join(rel).is_file()
+            }
             ProjectView::Memory(project) => matches!(
                 project.get(rel),
                 Some(MemoryEntry::Text(_) | MemoryEntry::Binary(_) | MemoryEntry::Present)
@@ -253,7 +363,7 @@ impl ProjectView<'_> {
     /// The path itself is a symbolic link.
     pub fn is_symlink(&self, rel: &str) -> bool {
         match self {
-            ProjectView::Disk(root) => {
+            ProjectView::Disk(root) | ProjectView::Snapshot(DiskSnapshot { root, .. }) => {
                 std::fs::symlink_metadata(root.join(rel)).is_ok_and(|m| m.file_type().is_symlink())
             }
             ProjectView::Memory(project) => project.is_symlink(rel),
@@ -263,7 +373,7 @@ impl ProjectView<'_> {
     /// The UTF-8-named entries of directory `rel`, sorted by name.
     pub async fn list_dir(&self, rel: &str) -> io::Result<Vec<DirEntryInfo>> {
         match self {
-            ProjectView::Disk(root) => {
+            ProjectView::Disk(root) | ProjectView::Snapshot(DiskSnapshot { root, .. }) => {
                 let mut dir = tokio::fs::read_dir(root.join(rel)).await?;
                 let mut out = Vec::new();
                 while let Ok(Some(entry)) = dir.next_entry().await {
@@ -298,7 +408,7 @@ pub(crate) async fn detect_npm_lock_flavor_in(
     view: &ProjectView<'_>,
 ) -> Result<(NpmLockFlavor, Vec<VendorWarning>), (&'static str, String)> {
     let project = match view {
-        ProjectView::Disk(root) => {
+        ProjectView::Disk(root) | ProjectView::Snapshot(DiskSnapshot { root, .. }) => {
             return crate::vendor::npm_flavor::detect_npm_lock_flavor(root).await
         }
         ProjectView::Memory(project) => *project,
@@ -507,4 +617,30 @@ mod tests {
             "vendor_lockfile_missing"
         );
     }
+
+    #[tokio::test]
+    async fn a_snapshot_reads_each_file_once_until_invalidated() {
+        let tmp = tempfile::tempdir().unwrap();
+        std::fs::write(tmp.path().join("a.lock"), "one").unwrap();
+        let snap = DiskSnapshot::new(tmp.path());
+        let view = ProjectView::Snapshot(&snap);
+        assert_eq!(view.read_text("a.lock").await.unwrap(), "one");
+        std::fs::write(tmp.path().join("a.lock"), "two").unwrap();
+        assert_eq!(view.read_text("a.lock").await.unwrap(), "one", "cached");
+        assert_eq!(view.read_bytes("a.lock").await.unwrap(), b"one");
+        assert_eq!(view.read_text_sync("a.lock").unwrap(), "one");
+        let missing = view.read_text("b.lock").await.unwrap_err();
+        assert_eq!(missing.kind(), io::ErrorKind::NotFound);
+        std::fs::write(tmp.path().join("b.lock"), "late").unwrap();
+        assert_eq!(
+            view.read_text("b.lock").await.unwrap_err().kind(),
+            io::ErrorKind::NotFound,
+            "a cached miss stays a miss"
+        );
+        assert!(view.exists("b.lock").await, "non-read probes go to disk");
+        snap.invalidate();
+        assert_eq!(view.read_text("a.lock").await.unwrap(), "two");
+        assert_eq!(view.read_text("b.lock").await.unwrap(), "late");
+        assert_eq!(view.disk_root(), Some(tmp.path()));
+    }
 }
diff --git a/crates/socket-patch-core/src/vex/discover/mod.rs b/crates/socket-patch-core/src/vex/discover/mod.rs
index 9a923263..be657f84 100644
--- a/crates/socket-patch-core/src/vex/discover/mod.rs
+++ b/crates/socket-patch-core/src/vex/discover/mod.rs
@@ -707,7 +707,22 @@ pub async fn discover_patched_refs(root: &Path) -> Discovery {
 /// See the module docs for the contract; the extractor order below is fixed
 /// only for deterministic diagnostics — refs are sorted afterwards.
 pub async fn discover_patched_refs_with(root: &Path, opts: &DiscoverOptions) -> Discovery {
-    let ctx = DiscoverCtx::with_origins(root, &opts.patch_server_origins);
+    discover_with_ctx(DiscoverCtx::with_origins(root, &opts.patch_server_origins)).await
+}
+
+/// [`discover_patched_refs_with`] reading the lock and config files through
+/// `snapshot`, so a run that also inventories the lockfiles reads each file
+/// once.
+pub async fn discover_patched_refs_in(
+    snapshot: &crate::vendor::lock_inventory::DiskSnapshot<'_>,
+    opts: &DiscoverOptions,
+) -> Discovery {
+    let mut ctx = DiscoverCtx::with_origins(snapshot.root, &opts.patch_server_origins);
+    ctx.view = crate::vendor::lock_inventory::ProjectView::Snapshot(snapshot);
+    discover_with_ctx(ctx).await
+}
+
+async fn discover_with_ctx(ctx: DiscoverCtx<'_>) -> Discovery {
     let mut out = Discovery::default();
     npm::extract(&ctx, &mut out).await;
     yarn::extract(&ctx, &mut out).await;
@@ -737,6 +752,9 @@ fn is_script_lock(file: &Path) -> bool {
 /// allowlist, with the guarded-read and identity helpers bolted on.
 pub(crate) struct DiscoverCtx<'a> {
     pub(crate) root: &'a Path,
+    /// Where the guarded reads read from: `root` on disk, or a per-run
+    /// snapshot of it.
+    view: crate::vendor::lock_inventory::ProjectView<'a>,
     patch_server_origins: &'a [String],
     /// What the guarded reads have recognized so far (rule 11) — collected
     /// here, not in the extractor's `&mut Discovery`, so a read into a
@@ -749,6 +767,7 @@ impl<'a> DiscoverCtx<'a> {
     pub(crate) fn with_origins(root: &'a Path, patch_server_origins: &'a [String]) -> Self {
         DiscoverCtx {
             root,
+            view: crate::vendor::lock_inventory::ProjectView::Disk(root),
             patch_server_origins,
             recognized: Mutex::new(BTreeSet::new()),
         }
@@ -813,7 +832,7 @@ impl<'a> DiscoverCtx<'a> {
     /// ledger claim it alone keeps textually "alive" must be dead (rule 11).
     /// Quiet — a missing or unreadable ignored file is not a finding.
     pub(crate) async fn recognize_ignored(&self, rel: &str) {
-        if let Ok(bytes) = crate::utils::fs::read_regular_to_bytes(&self.root.join(rel)).await {
+        if let Ok(bytes) = self.view.read_bytes(rel).await {
             self.recognize_text(rel, &String::from_utf8_lossy(&bytes));
         }
     }
@@ -828,9 +847,7 @@ impl<'a> DiscoverCtx<'a> {
     /// Whether `rel` exists (lstat — a dangling symlink still "exists", the
     /// read then fails and diagnoses).
     pub(crate) async fn exists(&self, rel: &str) -> bool {
-        tokio::fs::symlink_metadata(self.root.join(rel))
-            .await
-            .is_ok()
+        self.view.exists_no_follow(rel).await
     }
 
     /// Guarded UTF-8 read of root-relative `rel`: `None` when missing
@@ -839,7 +856,7 @@ impl<'a> DiscoverCtx<'a> {
     /// parsing (rule 11) — so a file that then fails to parse, or an entry
     /// the extractor rejects or skips, is still recognized.
     pub(crate) async fn read_text(&self, rel: &str, out: &mut Discovery) -> Option<String> {
-        match crate::utils::fs::read_regular_to_string(&self.root.join(rel)).await {
+        match self.view.read_text(rel).await {
             Ok(text) => {
                 self.recognize_text(rel, &text);
                 Some(text)
@@ -862,7 +879,7 @@ impl<'a> DiscoverCtx<'a> {
     /// left in `bun.lockb`'s append-only pool names a DEAD patch, which is
     /// exactly what recognition should say about it.
     pub(crate) async fn read_bytes(&self, rel: &str, out: &mut Discovery) -> Option<Vec<u8>> {
-        match crate::utils::fs::read_regular_to_bytes(&self.root.join(rel)).await {
+        match self.view.read_bytes(rel).await {
             Ok(bytes) => {
                 self.recognize_text(rel, &String::from_utf8_lossy(&bytes));
                 Some(bytes)
@@ -2948,7 +2965,10 @@ mod tests {
                     "uv.lock",
                 ],
             ),
-            ("cargo", &[".cargo/config", ".cargo/config.toml", "Cargo.toml"]),
+            (
+                "cargo",
+                &[".cargo/config", ".cargo/config.toml", "Cargo.toml"],
+            ),
             ("golang", &["go.mod"]),
             ("gem", &["Gemfile.lock"]),
             ("composer", &["composer.lock"]),
diff --git a/crates/socket-patch-core/src/vex/mod.rs b/crates/socket-patch-core/src/vex/mod.rs
index 3e82c73c..561263f3 100644
--- a/crates/socket-patch-core/src/vex/mod.rs
+++ b/crates/socket-patch-core/src/vex/mod.rs
@@ -26,8 +26,9 @@ pub mod verify;
 
 pub use build::{build_document, BuildOptions};
 pub use discover::{
-    canonical_base_purl, discover_patched_refs, discover_patched_refs_with, Diag, DiscoverOptions,
-    Discovery, PatchedRef, Recognized, UnlockedPin, WiringMode,
+    canonical_base_purl, discover_patched_refs, discover_patched_refs_in,
+    discover_patched_refs_with, Diag, DiscoverOptions, Discovery, PatchedRef, Recognized,
+    UnlockedPin, WiringMode,
 };
 pub use product::{detect_product, DetectResult};
 pub use schema::{
diff --git a/crates/socket-patch-node/Cargo.toml b/crates/socket-patch-node/Cargo.toml
index d95cb71a..797ee2cc 100644
--- a/crates/socket-patch-node/Cargo.toml
+++ b/crates/socket-patch-node/Cargo.toml
@@ -12,13 +12,13 @@ name = "socket_patch_node"
 path = "src/lib.rs"
 crate-type = ["cdylib"]
 # A cdylib that links against the host's `napi_*` symbols has nothing to
-# test outside Node; the engine's tests live in socket-patch-cli and the
+# test outside Node; the engine's tests live in socket-patch-core (unit) and
+# socket-patch-cli (disk parity), and the
 # addon's in npm/test/smoke.mjs.
 test = false
 doctest = false
 
 [dependencies]
-socket-patch-cli = { path = "../socket-patch-cli" }
 socket-patch-core = { workspace = true }
 napi = { workspace = true }
 napi-derive = { workspace = true }
diff --git a/crates/socket-patch-node/src/lib.rs b/crates/socket-patch-node/src/lib.rs
index 5f1c8ed7..d83403b8 100644
--- a/crates/socket-patch-node/src/lib.rs
+++ b/crates/socket-patch-node/src/lib.rs
@@ -1,5 +1,5 @@
 //! Node addon for the in-memory hosted redirect engine
-//! (`socket_patch_cli::hosted_memory`).
+//! (`socket_patch_core::hosted::memory`).
 //!
 //! This is the private native half of `@socketsecurity/socket-patch-node`;
 //! npm/index.js is the public surface (npm/index.d.ts). Options, tree
@@ -15,8 +15,8 @@ use std::sync::Arc;
 use napi::bindgen_prelude::{Buffer, External, Function, JsObjectValue, Object, PromiseRaw};
 use napi::{Env, Status};
 use napi_derive::napi;
-use socket_patch_cli::hosted_memory::{
-    self, EngineError, HostedScanOptions, HostedScanOutput, PresentKind, SelectOptions,
+use socket_patch_core::hosted::memory::{
+    self as hosted_memory, EngineError, HostedScanOptions, HostedScanOutput, PresentKind, SelectOptions,
     SessionBuilder, TreeEntryInput,
 };
 use socket_patch_core::api::client::PatchApi;

From f9cb7e1370771eccd88ab379428d45499cfe623f Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Tue, 29 Sep 2026 01:18:03 +0200
Subject: [PATCH 23/32] v5 CI: build e2e binaries once and tier the PM matrix
 (#291)

* Build e2e test binaries once and tier PM legs

The e2e matrix recompiled the CLI and its test binary in each of its
176 legs. e2e-build now compiles every CLI test target once per OS and
the legs run the downloaded binaries from the same checkout path. That
compile also replaces the --all-features --no-run pass in test and
test-release, so each of those compiles one feature set.

PR runs keep every named version boundary, the oldest and newest
release of each tool and every vlt era. The 31 middle e2e rows, 2
yarn-berry releases and 10 cargo toolchain x lock cells move to *-full
jobs that run on main pushes, a new nightly schedule and dispatch.

- e2e-docker (a subset of coverage-docker) runs nightly only.
- Dockerfile.base is built once per run and loaded by each docker leg.
- The hermetic maven/nuget crawl tests run in `test`; their rows and
  e2e_composer's are gone. e2e_safety_cargo_build rides cargo-vex.
- pdm-compat builds the capstone once, skips the 7 cells ci.yml runs,
  drops the Windows native rows (they never ran), and fails a cell
  whose bootstrap fails or whose rows all skip.
- vlt-compat install-proof leaves ci.yml's identical cells to it.
- npm/pnpm compatibility are path-filtered on PRs; the disarmed vlt
  serve watchdog runs daily instead of every 6 hours.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HK6zFsizxHRUtyxPvdhM4c

* Address review: env parity, filters, PR cells

- The legs that run test binaries directly set SOCKET_NO_CONFIG and
  SOCKET_NO_UPDATE_CHECK, which cargo's [env] gave `cargo test`.
- cargo 1.93.1 with its own lock (the pinned toolchain the removed
  e2e_safety_cargo_build rows ran) stays on PRs; 1.82.0 own-lock moves
  to the full tier.
- Poetry 2.0.1, the first lock 2.1 writer, stays on PRs.
- e2e-build gets 60 minutes on Windows.
- npm/pnpm filters also watch .cargo/config.toml and cache_env.rs.
- vlt install-proof notes a cell left entirely to ci.yml.
- pdm-compat saves its build cache from main only.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HK6zFsizxHRUtyxPvdhM4c

* Run the full tier on v5 pushes; review fixes

- ci.yml also runs on pushes to release/v5-prerelease, whose PRs skip
  the full tier and which has no nightly; e2e-docker runs there too.
- cargo 1.93.1 with its own lock runs on macOS and Windows on PRs,
  the cell the old e2e_safety_cargo_build rows ran there.
- e2e-build and pdm-compat print rendered compile errors
  (json-render-diagnostics).
- vlt-compat and pdm-compat also trigger on ci.yml changes, and the
  vlt dedupe only counts ci rows with the same test filter.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HK6zFsizxHRUtyxPvdhM4c

* Run the vlt agent get test in agent mode

get now defaults to hosted mode (5e5f5ed), so the real-vlt
get_and_remove leg ran a hosted get and found the installed copy
unpatched. It now passes --mode agent, like the other agent-mode
fixtures that commit updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R11RZRvYFL3fzmEnkFAU4A
(cherry picked from commit cc5f1b6cc7f98d861283c136565faa002ab84cb1)

* Give the nightly CI run its own concurrency group

A concurrency group holds one pending run. Sharing main's group let a
queued main push and the nightly cancel each other, and the nightly is
the only automatic run of e2e-docker.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HK6zFsizxHRUtyxPvdhM4c

---------

Co-authored-by: Claude <noreply@anthropic.com>
---
 .github/workflows/ci.yml                   | 496 +++++++++++++++------
 .github/workflows/npm-compatibility.yml    |  21 +
 .github/workflows/pdm-compatibility.yml    |  75 +++-
 .github/workflows/pnpm-compatibility.yml   |  19 +
 .github/workflows/vlt-compatibility.yml    |  19 +
 .github/workflows/vlt-serve-watchdog.yml   |   5 +-
 crates/socket-patch-cli/tests/e2e_maven.rs |   4 +-
 crates/socket-patch-cli/tests/e2e_nuget.rs |   4 +-
 docs/testing/pdm-compatibility.md          |   7 +-
 docs/testing/vlt-compatibility.md          |   3 +-
 docs/testing/yarn-berry-compatibility.md   |   3 +
 scripts/backtest-pdm.py                    |   6 +-
 scripts/ci-e2e-bundle.py                   |  83 ++++
 scripts/ci-vlt-proof-suites.py             |  81 ++++
 scripts/tests/test_ci_e2e_tiers.py         | 178 ++++++++
 scripts/tests/test_ci_vlt_rows.py          |  11 +-
 tests/docker/README.md                     |   5 +-
 17 files changed, 838 insertions(+), 182 deletions(-)
 create mode 100644 scripts/ci-e2e-bundle.py
 create mode 100644 scripts/ci-vlt-proof-suites.py
 create mode 100644 scripts/tests/test_ci_e2e_tiers.py

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f11064b5..cea21be2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,8 +2,14 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    # The v5 integration branch too: PRs into it skip the full tier, and
+    # `schedule` only fires on main, so each landing runs the full tier.
+    branches: [main, release/v5-prerelease]
   pull_request:
+  schedule:
+    # Nightly on main: the `full` tier (e2e-full, cargo-vex-matrix-full,
+    # yarn-berry-full) and e2e-docker, which pull_request runs skip.
+    - cron: '41 5 * * *'
   workflow_dispatch:
     inputs:
       hosted_e2e:
@@ -20,9 +26,11 @@ permissions:
 # A newer push to the same PR supersedes its older run; nothing else is
 # cancelled. Push, dispatch and schedule runs always finish: main runs are
 # the ONLY rust-cache writers (save-if) and must not die mid-save, and a
-# dispatched base-branch run is the base's only CI verdict.
+# dispatched base-branch run is the base's only CI verdict. The nightly
+# gets its own group: a group holds one pending run, so sharing main's would
+# let a queued push and the nightly cancel each other.
 concurrency:
-  group: ci-${{ github.event.pull_request.number || github.ref }}
+  group: ci-${{ github.event.pull_request.number || github.ref }}${{ github.event_name == 'schedule' && '-nightly' || '' }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
@@ -240,7 +248,7 @@ jobs:
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
       - name: Build
-        run: cargo build --workspace --all-features
+        run: cargo build --workspace
 
       - name: Install Go (for vexctl)
         # The `vex` subcommand emits OpenVEX documents; tests/e2e_vex.rs
@@ -289,13 +297,12 @@ jobs:
           echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
 
       - name: Run tests
-        # `--all-features` would also RUN the docker-e2e suites,
-        # which soft-skip as "ok" in this job (no images are built here, and
-        # macOS/Windows have no Docker at all) — dozens of fake greens per OS
-        # that would hide a broken skip-guard behind a passing checkmark.
-        # Build them with --all-features (compile rot is real coverage), but
-        # run only the default-feature suites; the dedicated e2e-docker
-        # job runs the gated suites for real.
+        # Default features only: `--all-features` would also RUN the
+        # docker-e2e suites, which soft-skip as "ok" here (no images, and
+        # macOS/Windows have no Docker) — fake greens hiding a broken
+        # skip-guard. Their compile rot is caught on every OS by e2e-build,
+        # which compiles every CLI test target with --all-features; one
+        # feature set here means one compile.
         #
         # `--no-fail-fast`: without it cargo stops at the first failing test
         # BINARY, so one bad file hides every later binary's result on that
@@ -308,18 +315,13 @@ jobs:
           SOCKET_PATCH_GO_E2E_REQUIRED: '1'
           SOCKET_PATCH_GO_E2E_VERSION: '1.24'
         run: |
-          set -euo pipefail
-          cargo test --workspace --all-features --no-run
           cargo test --workspace --no-fail-fast
 
   test-release:
     runs-on: ubuntu-latest
-    # Every tests/ target is its own optimized link, and the two cargo
-    # invocations below build the graph twice (--all-features, then the
-    # default features): ~25m on main with ~240 test binaries, so 30m left
-    # no headroom as suites grow. The manifest-less VEX suites share two
-    # multi-module binaries (tests/e2e_vex_lockfile/, tests/e2e_vex_build/)
-    # to keep the count down; the extra 10m covers the rest.
+    # Every tests/ target is its own optimized link (~240 test binaries).
+    # The manifest-less VEX suites share two multi-module binaries
+    # (tests/e2e_vex_lockfile/, tests/e2e_vex_build/) to keep the count down.
     timeout-minutes: 40
     steps:
       - name: Checkout
@@ -345,13 +347,9 @@ jobs:
         # `ci-release` = [profile.release] minus the full-LTO link (see the
         # profile's comment in Cargo.toml). Same opt-level/debug-assertion
         # semantics this job exists to validate; ~23m of LTO relinking gone.
-        # Build/run split for the same reason as the `test` job: the gated
-        # docker-e2e suites only soft-skip here — compile them,
-        # don't count their skips as passes.
-        run: |
-          set -euo pipefail
-          cargo test --workspace --all-features --profile ci-release --no-run
-          cargo test --workspace --profile ci-release
+        # Default features for the same reason as the `test` job; the
+        # feature-gated suites' compile rot is e2e-build's.
+        run: cargo test --workspace --profile ci-release
 
   coverage:
     # Code coverage via cargo-llvm-cov (LLVM source-based instrumentation).
@@ -433,6 +431,45 @@ jobs:
           if-no-files-found: error
           retention-days: 30
 
+  # Dockerfile.base compiles the full-LTO release binary inside Docker, with
+  # no cache. Build it once per run and hand the image to every docker leg.
+  docker-base:
+    runs-on: ubuntu-22.04
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Set up Docker Buildx
+        # `driver: docker`: see coverage-docker's matching step.
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        with:
+          driver: docker
+
+      - name: Build base image
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+        with:
+          context: .
+          file: tests/docker/Dockerfile.base
+          tags: socket-patch-test-base:latest
+          load: true
+
+      - name: Save base image
+        run: |
+          mkdir -p docker-base
+          docker save --output docker-base/socket-patch-test-base.tar socket-patch-test-base:latest
+
+      - uses: ./.github/actions/upload-artifact
+        with:
+          name: docker-base-image
+          path: docker-base/socket-patch-test-base.tar
+          if-no-files-found: error
+          retention-days: 3
+
   coverage-docker:
     # Per-ecosystem coverage for the Docker-driven e2e suite. Mirrors
     # the e2e-docker matrix but builds an instrumented socket-patch
@@ -442,7 +479,9 @@ jobs:
     #
     # Hooks: docker_e2e_<eco>.rs reads SOCKET_PATCH_COV_BIN +
     # SOCKET_PATCH_COV_PROFRAW_DIR. Both unset is the no-op default
-    # (used by the e2e-docker matrix below).
+    # (used by the e2e-docker matrix below). Every per-push docker_e2e
+    # suite runs here; e2e-docker is the nightly run of the same suites
+    # against the base image's full-LTO release binary.
     #
     # Pin to ubuntu-22.04 (glibc 2.35) instead of ubuntu-latest
     # (currently 24.04, glibc 2.39). The instrumented binary built
@@ -450,6 +489,7 @@ jobs:
     # (glibc 2.36); a binary linked against a newer glibc than the
     # container ships fails to load. ubuntu-22.04's older glibc is
     # the highest base that's forward-compatible with debian:12.
+    needs: docker-base
     runs-on: ubuntu-22.04
     timeout-minutes: 30
     permissions:
@@ -495,13 +535,15 @@ jobs:
       # (a PR-poisoned cargo cache could compromise the instrumented
       # binary we mount into the container).
 
-      - name: Build base image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+      - name: Download base image
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
-          context: .
-          file: tests/docker/Dockerfile.base
-          tags: socket-patch-test-base:latest
-          load: true
+          pattern: docker-base-image*
+          merge-multiple: true
+          path: docker-base
+
+      - name: Load base image
+        run: docker load --input docker-base/socket-patch-test-base.tar
 
       - name: Build ${{ matrix.ecosystem }} image
         uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
@@ -653,28 +695,67 @@ jobs:
       - name: Run pypi dispatch tests
         run: python pypi/socket-patch/test_dispatch.py
 
+  # Compiles the CLI and every CLI test target once per OS (--all-features,
+  # so this is also the feature-gated suites' compile-rot check) and uploads
+  # the binaries the e2e, e2e-full and cargo-vex legs run. The legs run the
+  # test binaries directly from the same checkout path, so `CARGO_BIN_EXE_*`
+  # and `CARGO_MANIFEST_DIR` resolve as they did under `cargo test`.
+  e2e-build:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    # Windows compiles the same ~240 targets ~1.6x slower (see `test`).
+    timeout-minutes: ${{ matrix.os == 'windows-latest' && 60 || 45 }}
+    env:
+      CARGO_PROFILE_DEV_DEBUG: '0'
+      CARGO_INCREMENTAL: '0'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Install Rust
+        run: rustup show
+
+      - name: Cache cargo
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+        with:
+          key: e2e-build
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+
+      - name: Compile the CLI and every CLI test target
+        shell: bash
+        run: |
+          set -euo pipefail
+          cargo test --locked -p socket-patch-cli --all-features --tests --no-run --message-format=json-render-diagnostics > target-build.json
+
+      - name: Bundle the binaries the legs run
+        shell: bash
+        env:
+          BUNDLE_OS: ${{ matrix.os }}
+        run: python3 scripts/ci-e2e-bundle.py --os "$BUNDLE_OS" --cargo-json target-build.json --dest target/e2e-bin
+
+      - uses: ./.github/actions/upload-artifact
+        with:
+          name: e2e-bin-${{ matrix.os }}
+          path: target/e2e-bin/
+          if-no-files-found: error
+          retention-days: 3
+
   e2e:
-    needs: test
+    needs: [test, e2e-build]
     strategy:
       fail-fast: false
       matrix:
         include:
           # (No e2e_cargo / e2e_golang rows: neither suite has an
-          # `#[ignore]`-gated test or needs a real toolchain, so the
-          # unfiltered `test` job already runs all of them and the rows'
-          # `--ignored` legs selected zero tests.)
-          - os: ubuntu-latest
-            suite: e2e_maven
-          - os: ubuntu-latest
-            suite: e2e_composer
-            # composer is a shipped ecosystem, so e2e_composer's tests are
-            # NOT `#[ignore]`-gated the way the live-registry maven/nuget
-            # suites are — the matrix default `--ignored` filter
-            # selected zero tests here and the leg passed vacuously.
-            # `--include-ignored` runs them, plus any capstone added later.
-            test_filter: --include-ignored
-          - os: ubuntu-latest
-            suite: e2e_nuget
+          # `#[ignore]`-gated test or needs a real toolchain, so the `test`
+          # job already runs all of them. No e2e_maven / e2e_nuget /
+          # e2e_composer rows either: their tests are hermetic and not
+          # `#[ignore]`d, so `test` runs them on every OS.)
           # Host build-proof capstones: fresh-checkout install + revert
           # against the REAL composer/bundler toolchains, each ending in the
           # manifest-less VEX matrix. `#[ignore]`-gated (the unpinned `test`
@@ -699,13 +780,13 @@ jobs:
           # 1.17/2.1 merged GEM section, 2.2 separate sections, 2.5 last
           # pre-CHECKSUMS, 2.6 CHECKSUMS, 4.0.15/4.0.21 before/after the
           # strict frozen check (rubygems#9750). bundler <= 2.2 needs
-          # Ruby <= 3.3 and 1.17-2.1 need Ruby <= 3.1 (`untaint`).
+          # Ruby <= 3.3 and 1.17-2.1 need Ruby <= 3.1 (`untaint`). 2.7.2
+          # (no boundary of its own) is in e2e-full.
           - {os: ubuntu-latest, suite: e2e_redirect_gem_build, ruby: '3.1', bundler: '1.17.3'}
           - {os: ubuntu-latest, suite: e2e_redirect_gem_build, ruby: '3.1', bundler: '2.1.4'}
           - {os: ubuntu-latest, suite: e2e_redirect_gem_build, ruby: '3.1', bundler: '2.2.33'}
           - {os: ubuntu-latest, suite: e2e_redirect_gem_build, ruby: '3.3', bundler: '2.5.23'}
           - {os: ubuntu-latest, suite: e2e_redirect_gem_build, ruby: '3.3', bundler: '2.6.9'}
-          - {os: ubuntu-latest, suite: e2e_redirect_gem_build, ruby: '3.3', bundler: '2.7.2'}
           - {os: ubuntu-latest, suite: e2e_redirect_gem_build, ruby: '3.4', bundler: '4.0.15'}
           - {os: ubuntu-latest, suite: e2e_redirect_gem_build, ruby: '3.4', bundler: '4.0.21'}
           - {os: ubuntu-latest, suite: e2e_vendor_gem_build, ruby: '3.1', bundler: '1.17.3'}
@@ -713,7 +794,6 @@ jobs:
           - {os: ubuntu-latest, suite: e2e_vendor_gem_build, ruby: '3.1', bundler: '2.2.33'}
           - {os: ubuntu-latest, suite: e2e_vendor_gem_build, ruby: '3.3', bundler: '2.5.23'}
           - {os: ubuntu-latest, suite: e2e_vendor_gem_build, ruby: '3.3', bundler: '2.6.9'}
-          - {os: ubuntu-latest, suite: e2e_vendor_gem_build, ruby: '3.3', bundler: '2.7.2'}
           - {os: ubuntu-latest, suite: e2e_vendor_gem_build, ruby: '3.4', bundler: '4.0.15'}
           - {os: ubuntu-latest, suite: e2e_vendor_gem_build, ruby: '3.4', bundler: '4.0.21'}
           # The live-API smoke suites (e2e_npm, e2e_pypi, e2e_gem,
@@ -741,14 +821,9 @@ jobs:
           # Safety-hardening e2e suites. The fast non-ignored ones
           # (e2e_safety_lock, e2e_safety_yarn_pnp) run via the
           # standard `test` job above on all three platforms, so no
-          # matrix entry is needed for them. The two below need real
-          # toolchains and are #[ignore]-gated.
-          - os: ubuntu-latest
-            suite: e2e_safety_cargo_build
-          - os: macos-latest
-            suite: e2e_safety_cargo_build
-          - os: windows-latest
-            suite: e2e_safety_cargo_build
+          # matrix entry is needed for them. e2e_safety_pnpm below needs a
+          # real pnpm and is #[ignore]-gated; e2e_safety_cargo_build runs in
+          # every cargo-vex-matrix leg (ubuntu, macOS and Windows).
           - os: ubuntu-latest
             suite: e2e_safety_pnpm
           - os: macos-latest
@@ -938,39 +1013,18 @@ jobs:
           - {os: macos-latest, suite: e2e_redirect_pnpm_build, test_filter: '--ignored --skip pnpm_pinned_matrix'}
           - {os: windows-latest, suite: e2e_redirect_pnpm_build, test_filter: '--ignored --skip pnpm_pinned_matrix'}
           # Real-uv hosted/vendored capstones ending in manifest-less VEX:
-          # one leg per uv 0.N line + the 0.5.x boundary (0.5.4 still
+          # the oldest and newest line + the 0.5.x boundary (0.5.4 still
           # re-resolves a transitive override / rejects a repointed
-          # constraint under --locked; 0.5.5 keeps both).
+          # constraint under --locked; 0.5.5 keeps both). The other 0.N
+          # lines and 0.5.3/0.5.6 are in e2e-full.
           - {os: ubuntu-latest, suite: e2e_redirect_uv_build, uv: '0.1.45'}
-          - {os: ubuntu-latest, suite: e2e_redirect_uv_build, uv: '0.2.37'}
-          - {os: ubuntu-latest, suite: e2e_redirect_uv_build, uv: '0.3.5'}
-          - {os: ubuntu-latest, suite: e2e_redirect_uv_build, uv: '0.4.30'}
-          - {os: ubuntu-latest, suite: e2e_redirect_uv_build, uv: '0.5.3'}
           - {os: ubuntu-latest, suite: e2e_redirect_uv_build, uv: '0.5.4'}
           - {os: ubuntu-latest, suite: e2e_redirect_uv_build, uv: '0.5.5'}
-          - {os: ubuntu-latest, suite: e2e_redirect_uv_build, uv: '0.5.6'}
-          - {os: ubuntu-latest, suite: e2e_redirect_uv_build, uv: '0.6.17'}
-          - {os: ubuntu-latest, suite: e2e_redirect_uv_build, uv: '0.7.22'}
-          - {os: ubuntu-latest, suite: e2e_redirect_uv_build, uv: '0.8.24'}
-          - {os: ubuntu-latest, suite: e2e_redirect_uv_build, uv: '0.9.30'}
-          - {os: ubuntu-latest, suite: e2e_redirect_uv_build, uv: '0.10.12'}
-          - {os: ubuntu-latest, suite: e2e_redirect_uv_build, uv: '0.11.33'}
           - {os: ubuntu-latest, suite: e2e_redirect_uv_build, uv: '0.12.17'}
           - {os: macos-latest, suite: e2e_redirect_uv_build, uv: '0.12.17'}
           - {os: ubuntu-latest, suite: e2e_vendor_pypi_build, uv: '0.1.45', test_filter: --include-ignored}
-          - {os: ubuntu-latest, suite: e2e_vendor_pypi_build, uv: '0.2.37', test_filter: --include-ignored}
-          - {os: ubuntu-latest, suite: e2e_vendor_pypi_build, uv: '0.3.5', test_filter: --include-ignored}
-          - {os: ubuntu-latest, suite: e2e_vendor_pypi_build, uv: '0.4.30', test_filter: --include-ignored}
-          - {os: ubuntu-latest, suite: e2e_vendor_pypi_build, uv: '0.5.3', test_filter: --include-ignored}
           - {os: ubuntu-latest, suite: e2e_vendor_pypi_build, uv: '0.5.4', test_filter: --include-ignored}
           - {os: ubuntu-latest, suite: e2e_vendor_pypi_build, uv: '0.5.5', test_filter: --include-ignored}
-          - {os: ubuntu-latest, suite: e2e_vendor_pypi_build, uv: '0.5.6', test_filter: --include-ignored}
-          - {os: ubuntu-latest, suite: e2e_vendor_pypi_build, uv: '0.6.17', test_filter: --include-ignored}
-          - {os: ubuntu-latest, suite: e2e_vendor_pypi_build, uv: '0.7.22', test_filter: --include-ignored}
-          - {os: ubuntu-latest, suite: e2e_vendor_pypi_build, uv: '0.8.24', test_filter: --include-ignored}
-          - {os: ubuntu-latest, suite: e2e_vendor_pypi_build, uv: '0.9.30', test_filter: --include-ignored}
-          - {os: ubuntu-latest, suite: e2e_vendor_pypi_build, uv: '0.10.12', test_filter: --include-ignored}
-          - {os: ubuntu-latest, suite: e2e_vendor_pypi_build, uv: '0.11.33', test_filter: --include-ignored}
           - {os: ubuntu-latest, suite: e2e_vendor_pypi_build, uv: '0.12.17', test_filter: --include-ignored}
           - {os: macos-latest, suite: e2e_vendor_pypi_build, uv: '0.12.17', test_filter: --include-ignored}
           # The Poetry / PDM / Hatch / Pipenv / pip / deno manifest-less VEX
@@ -980,7 +1034,8 @@ jobs:
           # `--ignored`.
           # Real-Poetry hosted + vendored capstones (#[ignore]-gated,
           # unix-only). One leg per major / lock format: 1.0 (lock 1.0),
-          # 1.1 (lock 1.1), 1.8 (lock 2.0), 2.x (lock 2.1).
+          # 1.1 (lock 1.1), 1.8 (lock 2.0), 2.0 (first lock 2.1 writer),
+          # current.
           - {os: ubuntu-latest, suite: e2e_vex_build, test_filter: 'poetry:: --ignored', poetry: '1.0.10'}
           - {os: ubuntu-latest, suite: e2e_vex_build, test_filter: 'poetry:: --ignored', poetry: '1.1.15'}
           - {os: ubuntu-latest, suite: e2e_vex_build, test_filter: 'poetry:: --ignored', poetry: '1.8.5'}
@@ -1008,11 +1063,9 @@ jobs:
           - {os: macos-latest, suite: e2e_vex_build, test_filter: 'hatch:: --ignored', hatch: '1.18.1'}
           # Real Pipenv / pip capstones (mock patch server; the tools are
           # bootstrapped from PyPI). `pipenv:` / `pip:` hold one or more
-          # space-separated releases the suite loops over.
+          # space-separated releases the suite loops over. The middle
+          # Pipenv releases are in e2e-full.
           - {os: ubuntu-latest, suite: e2e_vex_build, test_filter: 'pipenv:: --ignored', pipenv: '2022.12.19'}
-          - {os: ubuntu-latest, suite: e2e_vex_build, test_filter: 'pipenv:: --ignored', pipenv: '2023.12.1'}
-          - {os: ubuntu-latest, suite: e2e_vex_build, test_filter: 'pipenv:: --ignored', pipenv: '2024.4.1'}
-          - {os: ubuntu-latest, suite: e2e_vex_build, test_filter: 'pipenv:: --ignored', pipenv: '2025.1.3'}
           - {os: ubuntu-latest, suite: e2e_vex_build, test_filter: 'pipenv:: --ignored', pipenv: '2026.8.0'}
           - {os: macos-latest, suite: e2e_vex_build, test_filter: 'pipenv:: --ignored', pipenv: '2022.12.19 2026.8.0'}
           - {os: ubuntu-latest, suite: e2e_vex_build, test_filter: 'pip:: --ignored', pip: '22 23 24 25 26'}
@@ -1031,11 +1084,9 @@ jobs:
           - {os: ubuntu-latest, suite: e2e_vendor_maven_build, maven: '4.0.0-rc-6'}
           - {os: macos-latest, suite: e2e_vendor_maven_build, maven: '3.9.16'}
           # Real .NET SDK capstones: hosted + vendored nuget, one leg per SDK
-          # major (the suite pins the major through a sandbox global.json).
+          # major (the suite pins the major through a sandbox global.json):
+          # the oldest and newest here, 7-9 on ubuntu in e2e-full.
           - {os: ubuntu-latest, suite: e2e_nuget_dotnet_build, dotnet: '6'}
-          - {os: ubuntu-latest, suite: e2e_nuget_dotnet_build, dotnet: '7'}
-          - {os: ubuntu-latest, suite: e2e_nuget_dotnet_build, dotnet: '8'}
-          - {os: ubuntu-latest, suite: e2e_nuget_dotnet_build, dotnet: '9'}
           - {os: ubuntu-latest, suite: e2e_nuget_dotnet_build, dotnet: '10'}
           - {os: macos-latest, suite: e2e_nuget_dotnet_build, dotnet: '8'}
           # Real deno negative capstone (no hosted/vendored wiring exists for
@@ -1047,32 +1098,36 @@ jobs:
     # pipenv) or bootstrap a tool from PyPI before the suite (poetry, pdm,
     # hatch), hence more than the 25 minutes the older legs needed.
     timeout-minutes: 40
-    steps:
+    # What .cargo/config.toml's [env] gives processes cargo launches; these
+    # legs launch the test binaries themselves.
+    env:
+      SOCKET_NO_CONFIG: '1'
+      SOCKET_NO_UPDATE_CHECK: '1'
+    # e2e-full runs these same steps over its rows.
+    steps: &e2e-steps
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
-      - name: Install Rust
-        # rustup is pre-installed on GitHub-hosted runners. `rustup show`
-        # reads rust-toolchain.toml in the repo root, then installs the
-        # pinned channel + listed components if missing. No third-party
-        # action dependency needed for toolchain setup.
-        run: rustup show
-
-      - name: Cache cargo
-        # Swatinem/rust-cache, main-only saves: see the first `Cache cargo`
-        # step in this file.
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      - name: Download the e2e binaries
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
-          # Matrix suites otherwise collide on one key: only one of the ~9
-          # same-OS legs wins the cache reserve and the rest fail to save.
-          # Several suites run one leg per pinned toolchain release (bun, uv,
-          # poetry, pdm, hatch, pipenv, pip, bundler, composer, maven, dotnet,
-          # deno, vlt), so the release is part of the key too, plus the vlt
-          # store linker of the two ubuntu e2e_safety_vlt legs.
-          key: ${{ matrix.suite }}-${{ matrix.vlt || matrix.bun || matrix.uv || matrix.poetry || matrix.pdm || matrix.hatch || matrix.pipenv || matrix.pip || matrix.bundler || matrix.composer || matrix.maven || matrix.dotnet || matrix.deno || 'default' }}${{ matrix.vlt_store_linker && format('-{0}', matrix.vlt_store_linker) || '' }}
-          save-if: ${{ github.ref == 'refs/heads/main' }}
+          pattern: e2e-bin-${{ matrix.os }}*
+          merge-multiple: true
+          path: target/e2e-bin
+
+      - name: Stage the CLI where the test binaries expect it
+        # `CARGO_BIN_EXE_socket-patch` was baked in at compile time as
+        # <checkout>/target/debug/socket-patch; CARGO_TARGET_TMPDIR likewise.
+        shell: bash
+        run: |
+          set -euo pipefail
+          exe=''
+          if [ "$RUNNER_OS" = Windows ]; then exe=.exe; fi
+          chmod +x target/e2e-bin/* || true
+          mkdir -p target/debug target/tmp
+          cp "target/e2e-bin/socket-patch$exe" "target/debug/socket-patch$exe"
 
       - name: Setup Node.js
         if: matrix.suite == 'e2e_npm' || matrix.suite == 'e2e_scan' || matrix.suite == 'e2e_safety_pnpm'
@@ -1328,7 +1383,18 @@ jobs:
           SOCKET_PATCH_DOTNET_E2E_VERSION: ${{ matrix.dotnet }}
           SOCKET_PATCH_DENO_E2E_REQUIRED: ${{ matrix.deno != '' && '1' || '' }}
           SOCKET_PATCH_DENO_E2E_VERSION: ${{ matrix.deno }}
-        run: cargo test -p socket-patch-cli --all-features --test ${{ matrix.suite }} -- ${{ matrix.test_filter || '--ignored' }}
+          E2E_SUITE: ${{ matrix.suite }}
+          E2E_TEST_FILTER: ${{ matrix.test_filter || '--ignored' }}
+        shell: bash
+        # Runs from the package root with CARGO_MANIFEST_DIR set, as
+        # `cargo test` would.
+        run: |
+          exe=''
+          if [ "$RUNNER_OS" = Windows ]; then exe=.exe; fi
+          cd crates/socket-patch-cli
+          export CARGO_MANIFEST_DIR="$PWD"
+          # shellcheck disable=SC2086 # the filter is several libtest arguments
+          "../../target/e2e-bin/$E2E_SUITE$exe" $E2E_TEST_FILTER
 
       - name: Run vlt e2e tests
         if: matrix.vlt != ''
@@ -1343,12 +1409,70 @@ jobs:
         run: |
           set -uo pipefail
           status=0
-          # shellcheck disable=SC2086 # the filter is several libtest arguments
-          cargo test -p socket-patch-cli --all-features --test "$VLT_SUITE" -- $VLT_TEST_FILTER 2>&1 | tee vlt-leg.log || status=1
+          exe=''
+          if [ "$RUNNER_OS" = Windows ]; then exe=.exe; fi
+          (
+            cd crates/socket-patch-cli
+            export CARGO_MANIFEST_DIR="$PWD"
+            # shellcheck disable=SC2086 # the filter is several libtest arguments
+            "../../target/e2e-bin/$VLT_SUITE$exe" $VLT_TEST_FILTER
+          ) 2>&1 | tee vlt-leg.log || status=1
           py=$(command -v python3 || command -v python)
-          "$py" scripts/check-vlt-legs.py --manifest crates/socket-patch-cli/tests/vlt-leg-manifest.json vlt-leg.log || status=1
+          # No cargo `Running` line when the binary runs directly: name it.
+          "$py" scripts/check-vlt-legs.py --binary "$VLT_SUITE" --manifest crates/socket-patch-cli/tests/vlt-leg-manifest.json vlt-leg.log || status=1
           exit "$status"
 
+  # The PM-version legs with no boundary of their own: the middle uv lines,
+  # Pipenv releases and .NET SDK majors, and bundler 2.7. Skipped
+  # on pull_request (the `e2e` rows keep every named boundary, the oldest
+  # and newest release of each tool and every vlt era there); main pushes,
+  # the nightly schedule and dispatch run them with the `e2e` steps.
+  e2e-full:
+    if: github.event_name != 'pull_request'
+    needs: [test, e2e-build]
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - {os: ubuntu-latest, suite: e2e_redirect_gem_build, ruby: '3.3', bundler: '2.7.2'}
+          - {os: ubuntu-latest, suite: e2e_vendor_gem_build, ruby: '3.3', bundler: '2.7.2'}
+          - {os: ubuntu-latest, suite: e2e_redirect_uv_build, uv: '0.2.37'}
+          - {os: ubuntu-latest, suite: e2e_redirect_uv_build, uv: '0.3.5'}
+          - {os: ubuntu-latest, suite: e2e_redirect_uv_build, uv: '0.4.30'}
+          - {os: ubuntu-latest, suite: e2e_redirect_uv_build, uv: '0.5.3'}
+          - {os: ubuntu-latest, suite: e2e_redirect_uv_build, uv: '0.5.6'}
+          - {os: ubuntu-latest, suite: e2e_redirect_uv_build, uv: '0.6.17'}
+          - {os: ubuntu-latest, suite: e2e_redirect_uv_build, uv: '0.7.22'}
+          - {os: ubuntu-latest, suite: e2e_redirect_uv_build, uv: '0.8.24'}
+          - {os: ubuntu-latest, suite: e2e_redirect_uv_build, uv: '0.9.30'}
+          - {os: ubuntu-latest, suite: e2e_redirect_uv_build, uv: '0.10.12'}
+          - {os: ubuntu-latest, suite: e2e_redirect_uv_build, uv: '0.11.33'}
+          - {os: ubuntu-latest, suite: e2e_vendor_pypi_build, uv: '0.2.37', test_filter: --include-ignored}
+          - {os: ubuntu-latest, suite: e2e_vendor_pypi_build, uv: '0.3.5', test_filter: --include-ignored}
+          - {os: ubuntu-latest, suite: e2e_vendor_pypi_build, uv: '0.4.30', test_filter: --include-ignored}
+          - {os: ubuntu-latest, suite: e2e_vendor_pypi_build, uv: '0.5.3', test_filter: --include-ignored}
+          - {os: ubuntu-latest, suite: e2e_vendor_pypi_build, uv: '0.5.6', test_filter: --include-ignored}
+          - {os: ubuntu-latest, suite: e2e_vendor_pypi_build, uv: '0.6.17', test_filter: --include-ignored}
+          - {os: ubuntu-latest, suite: e2e_vendor_pypi_build, uv: '0.7.22', test_filter: --include-ignored}
+          - {os: ubuntu-latest, suite: e2e_vendor_pypi_build, uv: '0.8.24', test_filter: --include-ignored}
+          - {os: ubuntu-latest, suite: e2e_vendor_pypi_build, uv: '0.9.30', test_filter: --include-ignored}
+          - {os: ubuntu-latest, suite: e2e_vendor_pypi_build, uv: '0.10.12', test_filter: --include-ignored}
+          - {os: ubuntu-latest, suite: e2e_vendor_pypi_build, uv: '0.11.33', test_filter: --include-ignored}
+          - {os: ubuntu-latest, suite: e2e_vex_build, test_filter: 'pipenv:: --ignored', pipenv: '2023.12.1'}
+          - {os: ubuntu-latest, suite: e2e_vex_build, test_filter: 'pipenv:: --ignored', pipenv: '2024.4.1'}
+          - {os: ubuntu-latest, suite: e2e_vex_build, test_filter: 'pipenv:: --ignored', pipenv: '2025.1.3'}
+          - {os: ubuntu-latest, suite: e2e_nuget_dotnet_build, dotnet: '7'}
+          - {os: ubuntu-latest, suite: e2e_nuget_dotnet_build, dotnet: '8'}
+          - {os: ubuntu-latest, suite: e2e_nuget_dotnet_build, dotnet: '9'}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 40
+    # What .cargo/config.toml's [env] gives processes cargo launches; these
+    # legs launch the test binaries themselves.
+    env:
+      SOCKET_NO_CONFIG: '1'
+      SOCKET_NO_UPDATE_CHECK: '1'
+    steps: *e2e-steps
+
   # ----------------------------------------------------------------------
   # Docker-driven real-package e2e suite.
   #
@@ -1359,11 +1483,17 @@ jobs:
   # managers and run socket-patch against a wiremock-served fixture —
   # no real Socket API contact. Hermetic, reproducible.
   #
-  # Triggered on every PR. The `e2e` job above runs the
-  # `#[ignore]`-gated real-toolchain capstones; the live-API smoke suites
-  # are run by hand (see the note in its matrix).
+  # Nightly, on dispatch and on v5 pushes only: coverage-docker runs these
+  # suites on each push (with an instrumented binary mounted in); this job
+  # is the one run of them against the base image's full-LTO release
+  # binary. The `e2e` job above runs the `#[ignore]`-gated real-toolchain
+  # capstones; the live-API smoke suites are run by hand (see the note in
+  # its matrix).
   # ----------------------------------------------------------------------
   e2e-docker:
+    # The v5 branch has no nightly of its own, so its pushes run it too.
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/release/v5-prerelease'
+    needs: docker-base
     runs-on: ubuntu-latest
     timeout-minutes: 35
     permissions:
@@ -1393,13 +1523,15 @@ jobs:
       # No `actions/cache` here intentionally. This job builds Docker
       # images and would be flagged by zizmor's cache-poisoning audit.
 
-      - name: Build base image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
+      - name: Download base image
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
-          context: .
-          file: tests/docker/Dockerfile.base
-          tags: socket-patch-test-base:latest
-          load: true
+          pattern: docker-base-image*
+          merge-multiple: true
+          path: docker-base
+
+      - name: Load base image
+        run: docker load --input docker-base/socket-patch-test-base.tar
 
       - name: Build ${{ matrix.ecosystem }} image
         uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
@@ -1474,15 +1606,17 @@ jobs:
       fail-fast: false
       matrix:
         # 4.0.2 bare-hex checksum writer (4.0.0-4.0.2), 4.1.0 first
-        # `10c0/` writer, then a spread up to current.
-        os: [ubuntu-latest]
-        yarn: ['4.0.2', '4.1.0', '4.6.0', '4.12.0', '4.18.0']
+        # `10c0/` writer, current, and 4.12.0 on macOS / Windows. The rest
+        # of the spread (4.6.0, 4.12.0 on ubuntu) is yarn-berry-full.
         include:
+          - {os: ubuntu-latest, yarn: '4.0.2'}
+          - {os: ubuntu-latest, yarn: '4.1.0'}
+          - {os: ubuntu-latest, yarn: '4.18.0'}
           - {os: macos-latest, yarn: '4.12.0'}
           - {os: windows-latest, yarn: '4.12.0'}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 30
-    steps:
+    steps: &yarn-berry-steps
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
@@ -1504,28 +1638,63 @@ jobs:
           YARN_BERRY_RELEASE: ${{ matrix.yarn }}
         run: scripts/yarn-berry-vex-matrix.sh "$YARN_BERRY_RELEASE"
 
+  # Skipped on pull_request, like e2e-full.
+  yarn-berry-full:
+    name: yarn-berry ${{ matrix.yarn }} (${{ matrix.os }})
+    if: github.event_name != 'pull_request'
+    needs: test
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - {os: ubuntu-latest, yarn: '4.6.0'}
+          - {os: ubuntu-latest, yarn: '4.12.0'}
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+    steps: *yarn-berry-steps
+
+  # Every toolchain and every lock re-encoding at least once on PRs (the
+  # toolchain's own lock is re-encoded as v1-v4 before socket-patch touches
+  # it, the committed-lockfile case; '' keeps the toolchain's own format),
+  # plus macOS and Windows; 1.93.1 with its own lock (on every OS) is the
+  # pinned rust-toolchain.toml cell `cargo test` used to give
+  # e2e_safety_cargo_build. cargo-vex-matrix-full runs the rest of the
+  # toolchain x lock cross off pull_request. Each leg also runs
+  # e2e_safety_cargo_build (its headline test honours the knobs).
   cargo-vex-matrix:
     name: cargo ${{ matrix.toolchain }} lock-v${{ matrix.lock || 'own' }} (${{ matrix.os }})
-    needs: test
+    needs: [test, e2e-build]
     runs-on: ${{ matrix.os }}
     timeout-minutes: 40
+    # What .cargo/config.toml's [env] gives processes cargo launches; these
+    # legs launch the test binaries themselves.
+    env:
+      SOCKET_NO_CONFIG: '1'
+      SOCKET_NO_UPDATE_CHECK: '1'
     strategy:
       fail-fast: false
       matrix:
-        # The toolchain's own lock is re-encoded as v1-v4 before
-        # socket-patch touches it (the committed-lockfile case); '' keeps the
-        # toolchain's own format.
-        os: [ubuntu-latest]
-        toolchain: ['1.82.0', '1.93.1', 'stable']
-        lock: ['', '1', '2', '3', '4']
         include:
+          - {os: ubuntu-latest, toolchain: '1.93.1', lock: ''}
+          - {os: ubuntu-latest, toolchain: '1.93.1', lock: '1'}
+          - {os: ubuntu-latest, toolchain: stable, lock: '2'}
+          - {os: ubuntu-latest, toolchain: '1.82.0', lock: '3'}
+          - {os: ubuntu-latest, toolchain: '1.93.1', lock: '4'}
           - {os: macos-latest, toolchain: stable, lock: '1'}
           - {os: windows-latest, toolchain: stable, lock: '1'}
-    steps:
+          - {os: macos-latest, toolchain: '1.93.1', lock: ''}
+          - {os: windows-latest, toolchain: '1.93.1', lock: ''}
+    steps: &cargo-vex-steps
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
+      - name: Download the e2e binaries
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          pattern: e2e-bin-${{ matrix.os }}*
+          merge-multiple: true
+          path: target/e2e-bin
       - name: Install Rust
         run: rustup show
       - name: Install the cargo under test
@@ -1536,12 +1705,9 @@ jobs:
         env:
           CARGO_TEST_TOOLCHAIN: ${{ matrix.toolchain }}
         run: rustup toolchain install "$CARGO_TEST_TOOLCHAIN" --profile minimal
-      - name: Cache cargo
-        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
-        with:
-          key: cargo-vex-${{ matrix.toolchain }}
-          save-if: ${{ github.ref == 'refs/heads/main' }}
       - name: Real-cargo hosted/vendored + manifest-less VEX
+        # The e2e-build binaries, run from the package root as `cargo test`
+        # would (see the e2e job's staging step).
         shell: bash
         env:
           SOCKET_PATCH_CARGO_E2E_REQUIRED: '1'
@@ -1549,8 +1715,48 @@ jobs:
           SOCKET_PATCH_CARGO_E2E_LOCK_VERSION: ${{ matrix.lock }}
         run: |
           set -euo pipefail
-          cargo test -p socket-patch-cli --test e2e_redirect_cargo_build --test e2e_redirect_cargo_shapes --test e2e_vendor_cargo_build --test mode_migration_cargo
-          cargo test -p socket-patch-cli --test e2e_safety_cargo_build -- --ignored
+          exe=''
+          if [ "$RUNNER_OS" = Windows ]; then exe=.exe; fi
+          chmod +x target/e2e-bin/* || true
+          mkdir -p target/debug target/tmp
+          cp "target/e2e-bin/socket-patch$exe" "target/debug/socket-patch$exe"
+          cd crates/socket-patch-cli
+          export CARGO_MANIFEST_DIR="$PWD"
+          status=0
+          for suite in e2e_redirect_cargo_build e2e_redirect_cargo_shapes e2e_vendor_cargo_build mode_migration_cargo; do
+            echo "::group::$suite"
+            "../../target/e2e-bin/$suite$exe" || status=1
+            echo "::endgroup::"
+          done
+          "../../target/e2e-bin/e2e_safety_cargo_build$exe" --ignored || status=1
+          exit "$status"
+
+  cargo-vex-matrix-full:
+    name: cargo ${{ matrix.toolchain }} lock-v${{ matrix.lock || 'own' }} (${{ matrix.os }})
+    if: github.event_name != 'pull_request'
+    needs: [test, e2e-build]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 40
+    # What .cargo/config.toml's [env] gives processes cargo launches; these
+    # legs launch the test binaries themselves.
+    env:
+      SOCKET_NO_CONFIG: '1'
+      SOCKET_NO_UPDATE_CHECK: '1'
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - {os: ubuntu-latest, toolchain: '1.82.0', lock: '1'}
+          - {os: ubuntu-latest, toolchain: '1.82.0', lock: '2'}
+          - {os: ubuntu-latest, toolchain: '1.82.0', lock: '4'}
+          - {os: ubuntu-latest, toolchain: '1.82.0', lock: ''}
+          - {os: ubuntu-latest, toolchain: '1.93.1', lock: '2'}
+          - {os: ubuntu-latest, toolchain: '1.93.1', lock: '3'}
+          - {os: ubuntu-latest, toolchain: stable, lock: ''}
+          - {os: ubuntu-latest, toolchain: stable, lock: '1'}
+          - {os: ubuntu-latest, toolchain: stable, lock: '3'}
+          - {os: ubuntu-latest, toolchain: stable, lock: '4'}
+    steps: *cargo-vex-steps
 
   # Manifest `[patch]` + the tagged detached lock (the v5 vendored cargo
   # wiring) on cargo 1.41 and 1.56 — below / at the 1.56 floor of
diff --git a/.github/workflows/npm-compatibility.yml b/.github/workflows/npm-compatibility.yml
index 45ad4759..4aa62e0f 100644
--- a/.github/workflows/npm-compatibility.yml
+++ b/.github/workflows/npm-compatibility.yml
@@ -7,7 +7,28 @@ name: npm hosted/vendored compatibility
 # installs one pinned npm and runs them. See docs/testing/npm-compatibility.md.
 
 on:
+  # PRs: any crate source, but only the test files these capstones
+  # compile (a later `!` pattern excludes, a later plain one re-includes).
+  # Main pushes stay unfiltered.
   pull_request:
+    paths:
+      - '.github/actions/upload-artifact/**'
+      - 'Cargo.lock'
+      - 'Cargo.toml'
+      - 'rust-toolchain.toml'
+      - '.cargo/config.toml'
+      - '.github/workflows/npm-compatibility.yml'
+      - 'docs/testing/npm-compatibility.md'
+      - 'crates/**'
+      - '!crates/**/*.md'
+      - '!crates/socket-patch-node/**'
+      - '!crates/socket-patch-core/tests/**'
+      - '!crates/socket-patch-cli/tests/**'
+      - 'crates/socket-patch-cli/tests/vex_e2e_common/**'
+      - 'crates/socket-patch-cli/tests/e2e_redirect_npm_build.rs'
+      - 'crates/socket-patch-cli/tests/e2e_vendor_npm_build.rs'
+      - 'crates/socket-patch-cli/tests/npm_e2e_common/**'
+      - 'crates/socket-patch-cli/tests/common/cache_env.rs'
   push:
     branches: [main]
   workflow_dispatch:
diff --git a/.github/workflows/pdm-compatibility.yml b/.github/workflows/pdm-compatibility.yml
index b417cb72..6af960ce 100644
--- a/.github/workflows/pdm-compatibility.yml
+++ b/.github/workflows/pdm-compatibility.yml
@@ -1,10 +1,11 @@
 name: PDM patch compatibility
 
-# Native PDM installer matrix: builds the CLI once per OS, bootstraps pinned
-# PDM releases with uv, and runs `scripts/backtest-pdm.py` — hosted, vendored
-# and agent mode against the public urllib3 free patch, verifying the
-# INSTALLED bytes, lock/manifest stability, hash rejection and rollback. No
-# Socket API token is needed. See docs/testing/pdm-compatibility.md.
+# Native PDM installer matrix: builds the CLI and the capstone test binary
+# once per OS, bootstraps pinned PDM releases with uv, and runs
+# `scripts/backtest-pdm.py` — hosted, vendored and agent mode against the
+# public urllib3 free patch, verifying the INSTALLED bytes, lock/manifest
+# stability, hash rejection and rollback. No Socket API token is needed. See
+# docs/testing/pdm-compatibility.md.
 
 on:
   pull_request:
@@ -25,6 +26,8 @@ on:
       - 'crates/socket-patch-cli/tests/e2e_vex_build/main.rs'
       - 'crates/socket-patch-cli/tests/e2e_vex_build/pdm.rs'
       - 'crates/socket-patch-cli/tests/vex_pypi_real_common/**'
+      # The capstone skips the cells ci.yml's e2e rows run.
+      - '.github/workflows/ci.yml'
   push:
     branches: [main]
     paths:
@@ -60,7 +63,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
+        os: [ubuntu-latest, macos-latest]
     runs-on: ${{ matrix.os }}
     timeout-minutes: 30
     steps:
@@ -70,13 +73,26 @@ jobs:
       - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           key: pdm-compat
-      - run: cargo build --locked -p socket-patch-cli
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+      - name: Compile the CLI and the capstone once
+        run: |
+          set -euo pipefail
+          cargo test --locked -p socket-patch-cli --test e2e_vex_build --no-run --message-format=json-render-diagnostics > target-build.json
+          python3 - <<'PY'
+          import json, pathlib, shutil
+          dest = pathlib.Path('target/pdm-e2e')
+          dest.mkdir(parents=True, exist_ok=True)
+          shutil.copy2('target/debug/socket-patch', dest / 'socket-patch')
+          for line in pathlib.Path('target-build.json').read_text().splitlines():
+              item = json.loads(line)
+              if item.get('target', {}).get('name') == 'e2e_vex_build' and item.get('executable'):
+                  shutil.copy2(item['executable'], dest / 'e2e_vex_build')
+          assert (dest / 'e2e_vex_build').is_file()
+          PY
       - uses: ./.github/actions/upload-artifact
         with:
           name: pdm-cli-${{ matrix.os }}
-          path: |
-            target/debug/socket-patch
-            target/debug/socket-patch.exe
+          path: target/pdm-e2e/
           if-no-files-found: error
           retention-days: 7
 
@@ -86,8 +102,10 @@ jobs:
       fail-fast: false
       matrix:
         # Every stable PDM major family (0.x, 1.x, 2.x) and each 2.x lock-format
-        # boundary, on Linux and Windows; macOS samples the ends of the range.
-        os: [ubuntu-latest, windows-latest]
+        # boundary on Linux; macOS samples the ends of the range. No Windows:
+        # the harness bootstraps PDM through a POSIX venv layout (bin/pdm), so
+        # every Windows cell skipped; backtest-pdm.py now fails such a cell.
+        os: [ubuntu-latest]
         pdm: ['0.12.3', '1.15.5', '2.0.3', '2.1.5', '2.3.4', '2.6.1', '2.7.4', '2.8.2', '2.9.3', '2.10.4', '2.11.2', '2.17.3', '2.20.1', '2.22.4', '2.25.9', '2.29.2']
         include:
           - { os: macos-latest, pdm: '0.12.3' }
@@ -152,25 +170,37 @@ jobs:
   # The hermetic Rust capstone (wiremock Socket API that also serves the
   # hosted wheel) over every PDM release the backtest covers: real hosted +
   # vendored flows ending in the manifest-less VEX matrix; refused lock
-  # formats (3.1, 4.0-4.2) must attest nothing.
+  # formats (3.1, 4.0-4.2) must attest nothing. The cells ci.yml's `e2e`
+  # job runs on every PR and main push are excluded here
+  # (scripts/tests/test_ci_e2e_tiers.py keeps the two lists in step).
   capstone:
+    needs: build
     strategy:
       fail-fast: false
       matrix:
         os: [ubuntu-latest, macos-latest]
         pdm: ['0.12.3', '1.0.0', '1.4.5', '1.8.5', '1.15.5', '2.0.3', '2.7.4', '2.8.2', '2.10.4', '2.11.2', '2.17.3', '2.20.1', '2.22.4', '2.25.9', '2.29.2']
+        exclude:
+          - {os: ubuntu-latest, pdm: '1.4.5'}
+          - {os: ubuntu-latest, pdm: '1.15.5'}
+          - {os: ubuntu-latest, pdm: '2.7.4'}
+          - {os: ubuntu-latest, pdm: '2.8.2'}
+          - {os: ubuntu-latest, pdm: '2.25.9'}
+          - {os: ubuntu-latest, pdm: '2.29.2'}
+          - {os: macos-latest, pdm: '2.29.2'}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 30
     steps:
+      # The binaries resolve fixtures through the build job's checkout path,
+      # which is the same on every runner of one OS.
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
-          key: pdm-vex-capstone
-          # Only main writes the cache: 30 PR matrix cells saving would churn
-          # the repo's 10 GiB budget (ci.yml's rust-cache note).
-          save-if: ${{ github.ref == 'refs/heads/main' }}
+          pattern: pdm-cli-${{ matrix.os }}*
+          merge-multiple: true
+          path: target/pdm-e2e
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.12'
@@ -179,4 +209,11 @@ jobs:
         env:
           SOCKET_PATCH_PDM_E2E_REQUIRED: '1'
           SOCKET_PATCH_PDM_E2E_VERSION: ${{ matrix.pdm }}
-        run: cargo test --locked -p socket-patch-cli --test e2e_vex_build -- 'pdm::' --ignored
+        run: |
+          set -euo pipefail
+          chmod +x target/pdm-e2e/*
+          mkdir -p target/debug target/tmp
+          cp target/pdm-e2e/socket-patch target/debug/socket-patch
+          cd crates/socket-patch-cli
+          export CARGO_MANIFEST_DIR="$PWD"
+          ../../target/pdm-e2e/e2e_vex_build 'pdm::' --ignored
diff --git a/.github/workflows/pnpm-compatibility.yml b/.github/workflows/pnpm-compatibility.yml
index 2aaa8dd9..11f06172 100644
--- a/.github/workflows/pnpm-compatibility.yml
+++ b/.github/workflows/pnpm-compatibility.yml
@@ -1,7 +1,26 @@
 name: pnpm hosted compatibility
 
 on:
+  # PRs: any crate source, but only the test files these capstones
+  # compile (a later `!` pattern excludes, a later plain one re-includes).
+  # Main pushes stay unfiltered.
   pull_request:
+    paths:
+      - '.github/actions/upload-artifact/**'
+      - 'Cargo.lock'
+      - 'Cargo.toml'
+      - 'rust-toolchain.toml'
+      - '.cargo/config.toml'
+      - '.github/workflows/pnpm-compatibility.yml'
+      - 'crates/**'
+      - '!crates/**/*.md'
+      - '!crates/socket-patch-node/**'
+      - '!crates/socket-patch-core/tests/**'
+      - '!crates/socket-patch-cli/tests/**'
+      - 'crates/socket-patch-cli/tests/vex_e2e_common/**'
+      - 'crates/socket-patch-cli/tests/e2e_redirect_pnpm_build.rs'
+      - 'crates/socket-patch-cli/tests/e2e_vendor_pnpm_build.rs'
+      - 'crates/socket-patch-cli/tests/common/cache_env.rs'
   push:
     branches: [main]
   workflow_dispatch:
diff --git a/.github/workflows/vlt-compatibility.yml b/.github/workflows/vlt-compatibility.yml
index 9a90e9ac..738a2f54 100644
--- a/.github/workflows/vlt-compatibility.yml
+++ b/.github/workflows/vlt-compatibility.yml
@@ -53,6 +53,9 @@ on:
       - 'scripts/install-vlt.sh'
       - 'scripts/vlt-historical-integrity.json'
       - 'scripts/gen-vlt-collation-golden.mjs'
+      - 'scripts/ci-vlt-proof-suites.py'
+      - '.github/workflows/ci.yml'
+      - 'scripts/tests/test_ci_vlt_rows.py'
   push:
     branches: [main]
     paths:
@@ -89,6 +92,9 @@ on:
       - 'scripts/install-vlt.sh'
       - 'scripts/vlt-historical-integrity.json'
       - 'scripts/gen-vlt-collation-golden.mjs'
+      - 'scripts/ci-vlt-proof-suites.py'
+      - '.github/workflows/ci.yml'
+      - 'scripts/tests/test_ci_vlt_rows.py'
   schedule:
     # Nightly: vlt releases and the production service drift with no PR open.
     - cron: '17 4 * * *'
@@ -311,6 +317,8 @@ jobs:
           SOCKET_PATCH_VLT_E2E_STORE_LINKER: ${{ matrix.linker }}
           SOCKET_PATCH_VLT_E2E_CACHE_ROOT: ${{ matrix.cache_root }}
           VLT_SUITES: ${{ matrix.suites || 'e2e_redirect_vlt_build e2e_vendor_vlt_build mode_migration_vlt e2e_safety_vlt e2e_vlt' }}
+          MATRIX_OS: ${{ matrix.os }}
+          NODE_PIN: ${{ matrix.node }}
         run: |
           set -uo pipefail
           exe=''
@@ -326,6 +334,17 @@ jobs:
             mkdir -p "$SOCKET_PATCH_VLT_E2E_CACHE_ROOT"
           fi
           py=$(command -v python3 || command -v python)
+          # Cells ci.yml's e2e rows run identically (every PR, main push and
+          # nightly) are left to them; a dispatch runs every cell.
+          if [ "$GITHUB_EVENT_NAME" != workflow_dispatch ]; then
+            # shellcheck disable=SC2086 # VLT_SUITES is a word list
+            VLT_SUITES=$("$py" scripts/ci-vlt-proof-suites.py --os "$MATRIX_OS" --vlt "$SOCKET_PATCH_VLT_E2E_VERSION" \
+              --node "$NODE_PIN" --linker "${SOCKET_PATCH_VLT_E2E_STORE_LINKER:-}" \
+              --cache-root "${SOCKET_PATCH_VLT_E2E_CACHE_ROOT:-}" $VLT_SUITES | tr -d '\r') || exit 1
+          fi
+          if [ -z "$VLT_SUITES" ]; then
+            echo "::notice::every capstone of this cell runs in ci.yml's e2e rows; nothing left to run here"
+          fi
           status=0
           for suite in $VLT_SUITES; do
             echo "::group::$suite"
diff --git a/.github/workflows/vlt-serve-watchdog.yml b/.github/workflows/vlt-serve-watchdog.yml
index 28f4af5c..2bb63e4d 100644
--- a/.github/workflows/vlt-serve-watchdog.yml
+++ b/.github/workflows/vlt-serve-watchdog.yml
@@ -12,10 +12,11 @@ name: vlt serve watchdog
 # Like installer-drift.yml it checks a deployed service, not the diff. It is
 # `continue-on-error` until the serve fix (`Cache-Control: no-transform`) is
 # verified in production; removing that line arms it (DESIGN §8.4, the depscan
-# rollout's last step).
+# rollout's last step). Until then it cannot alert, so it runs once a day to
+# record the probe; go back to every 6 hours when arming it.
 on:
   schedule:
-    - cron: '23 */6 * * *'
+    - cron: '23 4 * * *'
   workflow_dispatch:
 
 permissions:
diff --git a/crates/socket-patch-cli/tests/e2e_maven.rs b/crates/socket-patch-cli/tests/e2e_maven.rs
index 63f53e27..006c8a1f 100644
--- a/crates/socket-patch-cli/tests/e2e_maven.rs
+++ b/crates/socket-patch-cli/tests/e2e_maven.rs
@@ -10,7 +10,7 @@
 //!
 //! # Running
 //! ```sh
-//! cargo test -p socket-patch-cli --test e2e_maven -- --ignored
+//! cargo test -p socket-patch-cli --test e2e_maven
 //! ```
 
 use std::path::{Path, PathBuf};
@@ -99,7 +99,6 @@ async fn assert_proxy_served_scans(server: &MockServer, scans: usize) {
 
 /// Verify that `socket-patch scan` discovers artifacts in a fake Maven local repo.
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[ignore = "opt-in maven crawl e2e; run with --ignored"]
 async fn scan_discovers_maven_artifacts() {
     let server = start_proxy().await;
     let proxy_url = server.uri();
@@ -226,7 +225,6 @@ async fn scan_discovers_maven_artifacts() {
 
 /// Verify that `socket-patch scan` discovers Gradle project artifacts.
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[ignore = "opt-in maven crawl e2e; run with --ignored"]
 async fn scan_discovers_gradle_project_artifacts() {
     let server = start_proxy().await;
     let proxy_url = server.uri();
diff --git a/crates/socket-patch-cli/tests/e2e_nuget.rs b/crates/socket-patch-cli/tests/e2e_nuget.rs
index 93fc84b7..e9bd1551 100644
--- a/crates/socket-patch-cli/tests/e2e_nuget.rs
+++ b/crates/socket-patch-cli/tests/e2e_nuget.rs
@@ -10,7 +10,7 @@
 //!
 //! # Running
 //! ```sh
-//! cargo test -p socket-patch-cli --test e2e_nuget -- --ignored
+//! cargo test -p socket-patch-cli --test e2e_nuget
 //! ```
 
 use std::path::{Path, PathBuf};
@@ -179,7 +179,6 @@ async fn assert_proxy_served_scans(server: &MockServer, scans: usize) {
 
 /// Verify that `socket-patch scan` discovers packages in a fake global cache layout.
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[ignore = "opt-in nuget crawl e2e; run with --ignored"]
 async fn scan_discovers_global_cache_packages() {
     let server = start_proxy().await;
     let proxy_url = server.uri();
@@ -247,7 +246,6 @@ async fn scan_discovers_global_cache_packages() {
 
 /// Verify that `socket-patch scan` discovers packages in a fake legacy packages/ layout.
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[ignore = "opt-in nuget crawl e2e; run with --ignored"]
 async fn scan_discovers_legacy_packages() {
     let server = start_proxy().await;
     let proxy_url = server.uri();
diff --git a/docs/testing/pdm-compatibility.md b/docs/testing/pdm-compatibility.md
index 78a5a8c9..8090e4bb 100644
--- a/docs/testing/pdm-compatibility.md
+++ b/docs/testing/pdm-compatibility.md
@@ -105,8 +105,11 @@ the patched `urllib3/response.py` (git-blob SHA-256 matches the ledger
 `afterHash`), ordinary `pdm install` keeps the lock stable, a tampered hash is
 rejected, a relock-then-rescan keeps rollback invertible, and rollback restores
 the lock and `pyproject.toml` byte for byte. `.github/workflows/pdm-compatibility.yml`
-runs it on Linux, Windows and macOS across every PDM major family. The matrix
-needs no Socket API token (the `urllib3@1.26.18` patch is a free tier).
+runs it on Linux and macOS across every PDM major family. It does not run on
+Windows: the harness bootstraps PDM through a POSIX venv layout (`bin/pdm`), so
+every Windows cell used to skip, and a run whose cells all skip or whose PDM
+bootstrap fails is now an error. The matrix needs no Socket API token (the
+`urllib3@1.26.18` patch is a free tier).
 
 > **Note (v5.0):** the "refused vendored scan still writes a `.socket/manifest.json`
 > record" observation in the notes column below describes the 4.0.0 binary the run
diff --git a/docs/testing/vlt-compatibility.md b/docs/testing/vlt-compatibility.md
index 9778689b..c5b46d97 100644
--- a/docs/testing/vlt-compatibility.md
+++ b/docs/testing/vlt-compatibility.md
@@ -73,7 +73,8 @@ asserted and each named test or row exists.
   `install-proof` (every capstone on 31 Linux, 11 macOS and 15 Windows
   releases, the Node floors 22.22.0 / 22.13.0 / 22.7.0 / 22.0.0 with the
   collation golden, and the store linkers auto / hardlink / copy / unpack / a `/dev/shm`
-  cache root); `native` (the backtest against production, artifacts
+  cache root; a cell `ci.yml`'s `e2e` rows run identically is left to them,
+  see `scripts/ci-vlt-proof-suites.py`, except on dispatch); `native` (the backtest against production, artifacts
   `vlt-results-<os>-<vlt>` in depscan's capture `result.json` shape);
   `lock-diff` (the same cell's `vlt-lock.json` must be byte-identical on Linux,
   macOS and Windows); `matrix-coverage` (every era × suite × OS).
diff --git a/docs/testing/yarn-berry-compatibility.md b/docs/testing/yarn-berry-compatibility.md
index a968f430..7c36cb69 100644
--- a/docs/testing/yarn-berry-compatibility.md
+++ b/docs/testing/yarn-berry-compatibility.md
@@ -23,6 +23,9 @@ The `yarn-berry-e2e` job in `.github/workflows/ci.yml` runs
 | macos-latest | 4.12.0 |
 | windows-latest | 4.12.0 |
 
+Pull requests skip ubuntu 4.6.0 and 4.12.0 (the `yarn-berry-full` job, which
+runs on main pushes, nightly and dispatch).
+
 Each release drives four real-yarn suites — `e2e_redirect_yarn_berry_build`,
 `e2e_vendor_yarn_berry_build`, `e2e_yarn4_pnpm_linker_build` and
 `e2e_yarn4_workspaces_build` — each ending in the manifest-less VEX matrix of
diff --git a/scripts/backtest-pdm.py b/scripts/backtest-pdm.py
index c2fda379..c952e6cb 100644
--- a/scripts/backtest-pdm.py
+++ b/scripts/backtest-pdm.py
@@ -1362,7 +1362,7 @@ def uninstall(log):
             for s in args.shapes:
                 for m in args.modes:
                     if wanted(v, s, m):
-                        results.append({"pdm": v, "python": python_for(v), "shape": s, "mode": m, "outcome": "SKIP", "passed": None, "checks": {}, "info": {"skip": "tool bootstrap failed: " + tool_environments.get(v, {}).get("error", "?")[-300:]}})
+                        results.append({"pdm": v, "python": python_for(v), "shape": s, "mode": m, "outcome": "ERROR", "passed": False, "checks": {}, "info": {"error": "tool bootstrap failed: " + tool_environments.get(v, {}).get("error", "?")[-300:]}})
     jobs = [j for j in jobs if tool_environments.get(j[0], {}).get("ok")]
 
     def persist():
@@ -1394,6 +1394,10 @@ def persist():
     say(render_matrix(summary))
     bad = [r for r in summary["results"] if r["outcome"] in ("FAIL", "ERROR")]
     say(f"{len(summary['results'])} rows: " + ", ".join(f"{o} {sum(1 for r in summary['results'] if r['outcome'] == o)}" for o in ("PASS", "REFUSED-EXPECTED", "UNSUPPORTED", "SKIP", "FAIL", "ERROR")))
+    # A cell whose every row skipped exercised nothing; it must not read as green.
+    if summary["results"] and all(r["outcome"] == "SKIP" for r in summary["results"]):
+        say("every row SKIPPED: this cell exercised nothing")
+        sys.exit(1)
     if bad or errors:
         sys.exit(1)
 
diff --git a/scripts/ci-e2e-bundle.py b/scripts/ci-e2e-bundle.py
new file mode 100644
index 00000000..8212429a
--- /dev/null
+++ b/scripts/ci-e2e-bundle.py
@@ -0,0 +1,83 @@
+#!/usr/bin/env python3
+"""Copy the CLI and the test binaries one OS's CI legs run into one directory.
+
+ci.yml's e2e-build job compiles every CLI test target once per OS
+(`cargo test --no-run --message-format=json`); this picks out the binaries
+the `e2e` and `e2e-full` rows name for that OS, plus the suites every
+cargo-vex-matrix leg runs, so the legs download them instead of compiling.
+"""
+
+import argparse
+import importlib.util
+import json
+import shutil
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+CI = ROOT / ".github" / "workflows" / "ci.yml"
+MATRIX_JOBS = ("e2e", "e2e-full")
+# The binaries cargo-vex-matrix and cargo-vex-matrix-full run on every OS.
+CARGO_VEX_SUITES = (
+    "e2e_redirect_cargo_build",
+    "e2e_redirect_cargo_shapes",
+    "e2e_vendor_cargo_build",
+    "mode_migration_cargo",
+    "e2e_safety_cargo_build",
+)
+
+
+def load_reader():
+    path = ROOT / "scripts" / "tests" / "test_ci_vlt_rows.py"
+    spec = importlib.util.spec_from_file_location("ci_rows", path)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def suites_for(os_name, text=None):
+    reader = load_reader()
+    jobs = reader.jobs(text if text is not None else CI.read_text(encoding="utf-8"))
+    suites = set(CARGO_VEX_SUITES)
+    for job in MATRIX_JOBS:
+        for row in reader.matrix_include(jobs[job]):
+            if row["os"] == os_name:
+                suites.add(row["suite"])
+    return sorted(suites)
+
+
+def executables(cargo_json):
+    found = {}
+    for line in cargo_json.splitlines():
+        if not line.startswith("{"):
+            continue
+        item = json.loads(line)
+        target = item.get("target", {})
+        if item.get("executable") and item.get("profile", {}).get("test") and "test" in target.get("kind", []):
+            found[target["name"]] = Path(item["executable"])
+    return found
+
+
+def main(argv=None):
+    ap = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    ap.add_argument("--os", required=True, help="the runner label the rows use, e.g. ubuntu-latest")
+    ap.add_argument("--cargo-json", required=True, type=Path)
+    ap.add_argument("--dest", required=True, type=Path)
+    args = ap.parse_args(argv)
+    exe = ".exe" if sys.platform == "win32" else ""
+    built = executables(args.cargo_json.read_text(encoding="utf-8"))
+    wanted = suites_for(args.os)
+    missing = [s for s in wanted if s not in built]
+    if missing:
+        print(f"ci-e2e-bundle: no test binary for {missing}", file=sys.stderr)
+        return 1
+    args.dest.mkdir(parents=True, exist_ok=True)
+    shutil.copy2(ROOT / "target" / "debug" / f"socket-patch{exe}", args.dest / f"socket-patch{exe}")
+    for suite in wanted:
+        shutil.copy2(built[suite], args.dest / f"{suite}{exe}")
+    print(f"ci-e2e-bundle: {len(wanted)} test binaries for {args.os}: {' '.join(wanted)}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/scripts/ci-vlt-proof-suites.py b/scripts/ci-vlt-proof-suites.py
new file mode 100644
index 00000000..8a119d68
--- /dev/null
+++ b/scripts/ci-vlt-proof-suites.py
@@ -0,0 +1,81 @@
+#!/usr/bin/env python3
+"""Print the capstones one vlt-compatibility install-proof row still runs.
+
+A suite is left out when ci.yml's `e2e` job (which runs on every pull
+request, main push and the nightly schedule) has a row for the identical
+cell: same suite, OS and vlt release, the default Node, the same store
+linker, no cache root and, for mode_migration_vlt (the one suite that reads
+it), the same upgrade vlt. Everything else runs here.
+"""
+
+import argparse
+import importlib.util
+import re
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+CI = ROOT / ".github" / "workflows" / "ci.yml"
+UPGRADE_SUITE = "mode_migration_vlt"
+
+
+def load_reader():
+    path = ROOT / "scripts" / "tests" / "test_ci_vlt_rows.py"
+    spec = importlib.util.spec_from_file_location("ci_rows", path)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def proof_upgrade(vlt, node):
+    """The upgrade vlt install-proof gives a row (its `Install vlt` step)."""
+    if node:
+        return ""
+    m = re.fullmatch(r"0\.0\.0-(\d+)|1\.0\.0-rc\.(\d+)", vlt)
+    if m and (int(m.group(1)) >= 19 if m.group(1) else int(m.group(2)) <= 14):
+        return "1.2.0"
+    return ""
+
+
+def ci_cells(text=None):
+    reader = load_reader()
+    rows = reader.matrix_include(reader.jobs(text if text is not None else CI.read_text(encoding="utf-8"))["e2e"])
+    return {(r["suite"], r["os"], r["vlt"], r.get("vlt_store_linker", ""), r.get("vlt_upgrade", ""))
+            for r in rows if r.get("vlt") and r.get("test_filter") == "--include-ignored vlt_pinned_matrix"}
+
+
+def remaining(suites, os_name, vlt, node="", linker="", cache_root="", text=None):
+    if node or cache_root:
+        return list(suites)
+    cells = ci_cells(text)
+    upgrade = proof_upgrade(vlt, node)
+    keep = []
+    for suite in suites:
+        want_upgrade = upgrade if suite == UPGRADE_SUITE else None
+        covered = any(s == suite and o == os_name and v == vlt and lk == linker
+                      and (want_upgrade is None or up == want_upgrade)
+                      for s, o, v, lk, up in cells)
+        if not covered:
+            keep.append(suite)
+    return keep
+
+
+def main(argv=None):
+    ap = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+    ap.add_argument("--os", required=True)
+    ap.add_argument("--vlt", required=True)
+    ap.add_argument("--node", default="")
+    ap.add_argument("--linker", default="")
+    ap.add_argument("--cache-root", default="")
+    ap.add_argument("suites", nargs="+")
+    args = ap.parse_args(argv)
+    keep = remaining(args.suites, args.os, args.vlt, args.node, args.linker, args.cache_root)
+    for suite in args.suites:
+        if suite not in keep:
+            print(f"{suite}: run by ci.yml's e2e row for this cell", file=sys.stderr)
+    print(" ".join(keep))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/scripts/tests/test_ci_e2e_tiers.py b/scripts/tests/test_ci_e2e_tiers.py
new file mode 100644
index 00000000..360dc2ba
--- /dev/null
+++ b/scripts/tests/test_ci_e2e_tiers.py
@@ -0,0 +1,178 @@
+"""ci.yml's build-once e2e fan-out and its PR / full tiers: every row names a
+real test target that e2e-build bundles, the off-PR tiers only add releases
+to suites the PR tier already runs on that OS, and the cargo toolchain x
+lock cross is exactly split between the two cargo-vex jobs."""
+
+import importlib.util
+import itertools
+import re
+import unittest
+from pathlib import Path
+
+ROOT = Path(__file__).parents[2]
+CI = ROOT / ".github" / "workflows" / "ci.yml"
+PDM = ROOT / ".github" / "workflows" / "pdm-compatibility.yml"
+TESTS = ROOT / "crates" / "socket-patch-cli" / "tests"
+
+
+def load(name, path):
+    spec = importlib.util.spec_from_file_location(name, path)
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+rows_mod = load("ci_rows", Path(__file__).parent / "test_ci_vlt_rows.py")
+bundle = load("ci_e2e_bundle", ROOT / "scripts" / "ci-e2e-bundle.py")
+proof = load("ci_vlt_proof_suites", ROOT / "scripts" / "ci-vlt-proof-suites.py")
+COMPAT = ROOT / ".github" / "workflows" / "vlt-compatibility.yml"
+TEXT = CI.read_text(encoding="utf-8")
+JOBS = rows_mod.jobs(TEXT)
+
+
+def rows(job):
+    return rows_mod.matrix_include(JOBS[job])
+
+
+def job_text(job):
+    return "\n".join(JOBS[job])
+
+
+class Tiers(unittest.TestCase):
+    def test_every_row_is_a_test_target(self):
+        for job in ("e2e", "e2e-full"):
+            for row in rows(job):
+                with self.subTest(job=job, row=row):
+                    suite = row["suite"]
+                    self.assertTrue((TESTS / f"{suite}.rs").is_file() or (TESTS / suite / "main.rs").is_file(),
+                                    f"no test target {suite}")
+
+    def test_full_rows_only_add_releases_to_pr_suites(self):
+        pr = {(r["suite"], r["os"], r.get("test_filter", "")) for r in rows("e2e")}
+        for row in rows("e2e-full"):
+            with self.subTest(row=row):
+                self.assertIn((row["suite"], row["os"], row.get("test_filter", "")), pr)
+        pr_rows = [tuple(sorted(r.items())) for r in rows("e2e")]
+        full_rows = [tuple(sorted(r.items())) for r in rows("e2e-full")]
+        self.assertFalse(set(pr_rows) & set(full_rows), "a row in both tiers runs twice")
+        self.assertEqual(len(pr_rows + full_rows), len(set(pr_rows + full_rows)), "duplicate rows")
+
+    def test_full_jobs_skip_pull_requests_and_share_steps(self):
+        for job, anchor in (("e2e-full", "e2e-steps"), ("yarn-berry-full", "yarn-berry-steps"),
+                            ("cargo-vex-matrix-full", "cargo-vex-steps")):
+            with self.subTest(job=job):
+                text = job_text(job)
+                self.assertIn("if: github.event_name != 'pull_request'", text)
+                self.assertIn(f"steps: *{anchor}", text)
+                self.assertIn(f"steps: &{anchor}", TEXT)
+
+    def test_nightly_schedule_runs_the_full_tier(self):
+        self.assertRegex(TEXT, r"(?m)^  schedule:\n(?:    #.*\n)*    - cron: '[^']+'$")
+        self.assertIn("if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' ||",
+                      job_text("e2e-docker"))
+
+    def test_cargo_cross_is_split_exactly(self):
+        pr = [(r["os"], r["toolchain"], r.get("lock", "")) for r in rows("cargo-vex-matrix")]
+        full = [(r["os"], r["toolchain"], r.get("lock", "")) for r in rows("cargo-vex-matrix-full")]
+        want = {("ubuntu-latest", t, l) for t, l in itertools.product(("1.82.0", "1.93.1", "stable"),
+                                                                    ("", "1", "2", "3", "4"))}
+        want |= {("macos-latest", "stable", "1"), ("windows-latest", "stable", "1"),
+                 ("macos-latest", "1.93.1", ""), ("windows-latest", "1.93.1", "")}
+        self.assertEqual(len(pr + full), len(want))
+        self.assertEqual(set(pr) | set(full), want)
+        for os_name in ("ubuntu-latest", "macos-latest", "windows-latest"):
+            self.assertIn((os_name, "1.93.1", ""), pr, "the pinned toolchain's own lock on every OS")
+        ubuntu = [c for c in pr if c[0] == "ubuntu-latest"]
+        self.assertEqual({c[1] for c in ubuntu}, {"1.82.0", "1.93.1", "stable"}, "every toolchain on PRs")
+        self.assertEqual({c[2] for c in ubuntu}, {"", "1", "2", "3", "4"}, "every lock on PRs")
+
+    def test_cargo_vex_runs_the_bundled_suites(self):
+        text = job_text("cargo-vex-matrix")
+        ran = set(re.findall(r"\b(e2e_[a-z_]+|mode_migration_[a-z_]+)\b", text.split("Real-cargo hosted")[1]))
+        self.assertEqual(ran, set(bundle.CARGO_VEX_SUITES))
+
+    def test_bundle_covers_every_os(self):
+        for os_name in ("ubuntu-latest", "macos-latest", "windows-latest"):
+            with self.subTest(os=os_name):
+                suites = bundle.suites_for(os_name, TEXT)
+                for job in ("e2e", "e2e-full"):
+                    for row in rows(job):
+                        if row["os"] == os_name:
+                            self.assertIn(row["suite"], suites)
+
+    def test_bundle_reads_cargo_json(self):
+        json_lines = "\n".join([
+            '{"reason":"compiler-artifact","target":{"name":"e2e_vlt","kind":["test"]},'
+            '"profile":{"test":true},"executable":"/t/deps/e2e_vlt-abc"}',
+            '{"reason":"compiler-artifact","target":{"name":"socket_patch_cli","kind":["lib"]},'
+            '"profile":{"test":true},"executable":"/t/deps/socket_patch_cli-abc"}',
+            '{"reason":"compiler-artifact","target":{"name":"socket-patch","kind":["bin"]},'
+            '"profile":{"test":false},"executable":"/t/debug/socket-patch"}',
+            "not json",
+        ])
+        self.assertEqual({k: str(v) for k, v in bundle.executables(json_lines).items()},
+                         {"e2e_vlt": "/t/deps/e2e_vlt-abc"})
+
+
+class PdmCapstone(unittest.TestCase):
+    job = rows_mod.jobs(PDM.read_text(encoding="utf-8"))["capstone"]
+
+    def test_excludes_exactly_the_cells_ci_runs_on_every_pr(self):
+        excluded = rows_mod.matrix_include([l.replace("exclude:", "include:") for l in self.job])
+        ci = {(r["os"], r["pdm"]) for r in rows("e2e") if "pdm" in r}
+        self.assertEqual({(r["os"], r["pdm"]) for r in excluded}, ci)
+        self.assertEqual(len(excluded), len(ci))
+        for row in rows("e2e"):
+            if "pdm" in row:
+                self.assertEqual(row.get("test_filter"), "pdm:: --ignored")
+        self.assertFalse(any("pdm" in r for r in rows("e2e-full")),
+                         "a pdm row off the PR tier would leave its cell unrun on PRs")
+        versions = re.search(r"pdm: \[([^\]]*)\]", "\n".join(self.job)).group(1)
+        for _, version in ci:
+            self.assertIn(f"'{version}'", versions)
+
+
+class VltProofDedupe(unittest.TestCase):
+    suites = ["e2e_redirect_vlt_build", "e2e_vendor_vlt_build", "mode_migration_vlt", "e2e_safety_vlt",
+              "e2e_vlt"]
+
+    def test_only_identical_ci_cells_are_left_out(self):
+        cells = proof.ci_cells(TEXT)
+        compat = rows_mod.jobs(COMPAT.read_text(encoding="utf-8"))
+        for row in rows_mod.matrix_include(compat["install-proof"]):
+            suites = row.get("suites", " ".join(self.suites)).split()
+            keep = proof.remaining(suites, row["os"], row["vlt"], row.get("node", ""), row.get("linker", ""),
+                                   row.get("cache_root", ""), TEXT)
+            for suite in set(suites) - set(keep):
+                with self.subTest(row=row, suite=suite):
+                    self.assertFalse(row.get("node") or row.get("cache_root"))
+                    upgrade = proof.proof_upgrade(row["vlt"], "") if suite == proof.UPGRADE_SUITE else None
+                    self.assertTrue(any(c[:4] == (suite, row["os"], row["vlt"], row.get("linker", ""))
+                                        and (upgrade is None or c[4] == upgrade) for c in cells))
+
+    def test_ci_vlt_rows_match_the_proof_invocation(self):
+        for row in rows("e2e"):
+            if row.get("vlt"):
+                self.assertEqual(row["test_filter"], "--include-ignored vlt_pinned_matrix", row)
+        ci_node = rows_mod.step(JOBS["e2e"], "Setup Node.js 24 (vlt legs)")
+        proof_text = "\n".join(rows_mod.jobs(COMPAT.read_text(encoding="utf-8"))["install-proof"])
+        node = re.search(r"node-version: '([^']+)'", ci_node).group(1)
+        self.assertIn(f"node-version: ${{{{ matrix.node || '{node}' }}}}", proof_text)
+
+    def test_upgrade_rule_matches_the_install_step(self):
+        text = "\n".join(rows_mod.jobs(COMPAT.read_text(encoding="utf-8"))["install-proof"])
+        self.assertIn("Number(m[1]) >= 19 : Number(m[2]) <= 14", text)
+        self.assertIn("scripts/install-vlt.sh 1.2.0", text)
+        self.assertEqual(proof.proof_upgrade("0.0.0-19", ""), "1.2.0")
+        self.assertEqual(proof.proof_upgrade("0.0.0-18", ""), "")
+        self.assertEqual(proof.proof_upgrade("1.0.0-rc.14", ""), "1.2.0")
+        self.assertEqual(proof.proof_upgrade("1.0.0-rc.15", ""), "")
+        self.assertEqual(proof.proof_upgrade("1.0.0-rc.14", "22.13.0"), "")
+
+    def test_lv0_mode_migration_without_ci_upgrade_stays(self):
+        self.assertIn("mode_migration_vlt", proof.remaining(self.suites, "windows-latest", "1.0.0-rc.14", text=TEXT))
+        self.assertNotIn("mode_migration_vlt", proof.remaining(self.suites, "ubuntu-latest", "1.0.0-rc.14", text=TEXT))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/scripts/tests/test_ci_vlt_rows.py b/scripts/tests/test_ci_vlt_rows.py
index 94ddb8fc..567900f5 100644
--- a/scripts/tests/test_ci_vlt_rows.py
+++ b/scripts/tests/test_ci_vlt_rows.py
@@ -200,8 +200,8 @@ def test_rows_pin_supported_releases(self):
 
     def test_the_steps_install_vlt_and_check_the_legs(self):
         e2e = "\n".join(self.ci["e2e"])
-        self.assertIn("key: ${{ matrix.suite }}-${{ matrix.vlt || ", e2e,
-                      "vlt releases share a suite, so the release is part of the cache key")
+        self.assertIn("pattern: e2e-bin-${{ matrix.os }}*", e2e,
+                      "the legs run the binaries e2e-build compiled once per OS")
         setup = step(self.ci["e2e"], "Setup vlt")
         self.assertIn("if: matrix.vlt != ''", setup)
         self.assertIn("scripts/install-vlt.sh", setup)
@@ -215,6 +215,8 @@ def test_the_steps_install_vlt_and_check_the_legs(self):
         self.assertIn("if: matrix.vlt != ''", run)
         self.assertIn("SOCKET_PATCH_VLT_E2E_REQUIRED: ${{ matrix.vlt != '' && '1' || '' }}", run)
         self.assertIn("scripts/check-vlt-legs.py", run)
+        self.assertIn('--binary "$VLT_SUITE"', run,
+                      "a directly run binary prints no cargo `Running` line to name it")
         self.assertIn("vlt-leg-manifest.json", run)
         other = step(self.ci["e2e"], "Run e2e tests")
         self.assertIn("if: matrix.vlt == ''", other)
@@ -304,8 +306,9 @@ def test_jobs_and_triggers(self):
 
     def test_watchdog(self):
         text = WATCHDOG.read_text(encoding="utf-8")
-        self.assertIn("cron: '23 */6 * * *'", text)
-        self.assertIn("continue-on-error: true", text)
+        # Daily while disarmed; every 6 hours once continue-on-error goes.
+        armed = "continue-on-error: true" not in text
+        self.assertIn("cron: '23 */6 * * *'" if armed else "cron: '23 4 * * *'", text)
         self.assertIn("scripts/backtest-vlt.py --serve-probe", text)
 
 
diff --git a/tests/docker/README.md b/tests/docker/README.md
index fbf06684..dc2b4c8d 100644
--- a/tests/docker/README.md
+++ b/tests/docker/README.md
@@ -67,8 +67,9 @@ the real package managers, each in its ecosystem's image:
 | `docker_e2e_vendor_nuget` | `nuget` | .NET SDK 8.0, Newtonsoft.Json 13.0.3 |
 | `docker_e2e_vendor_pypi_pm` | `pypi` | poetry, pdm, pipenv on six 1.16.0 |
 
-CI's `e2e-docker` job runs the composer, nuget and pypi_pm capstones;
-`coverage-docker` runs all five. Unlike the scan→apply suites they are MULTI-STAGE: a host
+CI's `coverage-docker` job runs all five on every push; the nightly
+`e2e-docker` job runs the composer, nuget and pypi_pm capstones against
+the release binary. Unlike the scan→apply suites they are MULTI-STAGE: a host
 tempdir is bind-mounted at `/workspace` and shared across three `docker run`s
 (networked fixture install + offline `socket-patch vendor`; then a
 fresh-checkout install under `--network none` with cold caches; then

From a7b0d00e7fc925d7b45bfcae15bc409ca29e213f Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Tue, 29 Sep 2026 07:18:29 +0200
Subject: [PATCH 24/32] v5: fix partial-stage repair bug, cut redundant
 downloads (#292)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Fix apply of created files from diff caches

A diff archive has no delta for a file the patch creates, yet the
disk stager counted a cached diff archive as covering the whole
patch. With only diffs on disk, `apply --offline` passed the gate,
patched the modified files, then failed on the created file's
missing blob and left the package half-patched; online `apply`
never fetched that blob at all.

Coverage is now per file: a diff covers only files with a
before-hash, and created files need their blob. Online, a cached
diff archive no longer suppresses the download, and the top-up
fetches just the created files' blobs.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WzdTEhubve9yWfqBE7vAsB

* Batch vendor package-reference requests

A vendor run asked the patch service for each package's download
reference in its own request, though the endpoint takes 500 uuids
at once: N round trips and N quota units for N packages.

The run's download plan now resolves every planned uuid in one
request, sent by the first planned call in place of its own and
with the same retries, so an outage costs what it did before.
Each package takes its answer from that batch at its turn; one
still building is asked again then, as before. Hosted scan's
reference lookup is chunked at the endpoint's 500-uuid cap,
which it used to exceed with a 400.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WzdTEhubve9yWfqBE7vAsB

* Skip downloading pypi sdists vendoring rejects

pypi vendoring is wheel-based, yet a pypi patch the service serves
as an sdist (every patch without a file qualifier) was downloaded
in full, then rejected because it is not a .whl.

The service's reference already names the artifact, so a pypi
reference whose artifact is not a wheel is now refused before the
download, in the vendor loop and in its download plan alike. The
outcome is unchanged: `auto` warns and builds the wheel locally,
and `service` refuses.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WzdTEhubve9yWfqBE7vAsB

* Repair downloads created files' blobs

A default (diff-mode) `repair` downloaded only diff archives, but a
diff has no delta for a file the patch creates. After such a repair
`apply --offline` still could not apply a patch that creates files.

In diff mode, repair now also downloads the blobs of created files
(and lists them under `--offline` and `--dry-run`), reported as
their own blob download.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WzdTEhubve9yWfqBE7vAsB

* Defer pristine fetches the service makes moot

With the patch service on, `vendor` deferred the registry download
of a not-installed package only for cargo; npm, golang and composer
packages were downloaded and verified up front even when the
service's prebuilt artifact made the pristine copy unnecessary.

Those backends also ask the service first and read the pristine
tree only on a local-build fallback, so their download is now
deferred the same way. A package is deferred only when its fetch
would really download: the fetchers' pre-download refusals (a
foreign yarn berry cacheKey, a go module go fetches without a
proxy, a composer entry with no dist URL) are now one shared check
that both the fetch and the deferral use. pypi and gem keep the
up-front fetch, which their installed-variant probe reads.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WzdTEhubve9yWfqBE7vAsB

* Run the vlt get e2e leg in agent mode

A bare `get` defaults to hosted mode since v5, so the real-vlt
get_and_remove leg found the installed copy unpatched. Pass
`--mode agent` as #283 does, which this ports.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WzdTEhubve9yWfqBE7vAsB

* Address review of the waste-review fixes

- repair --json no longer counts created-file blobs twice (once
  under the diff-mode event); the closing line names both failure
  counts when both passes fail.
- The vendor reference batch names the plan from the first call's
  position on, so a package the loop passed over is never granted.
- The npm and yarn classic registry views no longer take a non-http
  resolution's integrity (a local tarball's hash, a git commit id)
  as a registry integrity, so such a package is never deferred
  behind, or vendored from, the service's registry build.
- CHANGELOG entries for the new behavior, and the repair event row
  in CLI_CONTRACT.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WzdTEhubve9yWfqBE7vAsB

* Keep yarn git deps out of the registry view

A yarn classic block resolved to a git repository over plain https
(`https://…/repo.git#<commit>`, or a codeload tarball) passed as a
registry tarball: its commit id became a sha1 integrity, and an
`integrity` field on any git block was kept. With npm now deferring
behind the patch service, such a lockfile-only git dependency could
be vendored from the service's registry build instead of refusing
`vendor_fetch_unverifiable`.

A git resolution, over any protocol, now carries no URL and no
integrity in the registry view, like npm's non-registry entries.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WzdTEhubve9yWfqBE7vAsB

---------

Co-authored-by: Claude <noreply@anthropic.com>
---
 CHANGELOG.md                                  |  53 +++-
 Cargo.lock                                    |   1 +
 crates/socket-patch-cli/CLI_CONTRACT.md       |   6 +-
 crates/socket-patch-cli/Cargo.toml            |   2 +
 .../src/commands/fetch_stage.rs               | 130 +++++++-
 .../socket-patch-cli/src/commands/repair.rs   | 248 ++++++++++-----
 .../socket-patch-cli/src/commands/vendor.rs   |  58 +++-
 .../tests/diff_created_file_e2e.rs            | 282 +++++++++++++++++
 .../socket-patch-cli/tests/scan_vendor_e2e.rs | 137 ++++++++
 crates/socket-patch-core/src/api/client.rs    | 148 +++++++--
 .../src/api/vendor_prefetch.rs                | 292 +++++++++++++++++-
 .../src/vendor/lock_inventory/npm.rs          |  22 +-
 .../src/vendor/lock_inventory/tests.rs        |  73 +++++
 .../src/vendor/lock_inventory/yarn.rs         |  28 +-
 crates/socket-patch-core/src/vendor/pypi.rs   |  32 +-
 .../src/vendor/registry_fetch.rs              | 109 ++++++-
 16 files changed, 1450 insertions(+), 171 deletions(-)
 create mode 100644 crates/socket-patch-cli/tests/diff_created_file_e2e.rs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4a0e6718..919bbd19 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1183,8 +1183,10 @@ into the new version's section — see docs/releasing.md.
     a server-side archive build and count against quota, are exactly the
     one-at-a-time loop's (71 on a fresh depscan run, where an earlier
     draft of the look-ahead issued 74). What changes is only their timing:
-    up to four are in flight at once. `SOCKET_API_CONCURRENCY=1` turns the
-    look-ahead off entirely.
+    they are requested in one batch at the first planned package (see
+    "Fewer downloads in vendored runs"), and up to four archives are in
+    flight at once. `SOCKET_API_CONCURRENCY=1` turns the look-ahead off
+    entirely.
   - A token revoked *mid-run* now costs the authenticated batch endpoint
     the requests already in flight — up to the in-flight cap instead of
     one — before the run downgrades to the public proxy. Their answers are
@@ -1194,6 +1196,21 @@ into the new version's section — see docs/releasing.md.
 
 ### Fixed
 
+- **`apply` no longer half-applies a patch that creates a file from a
+  diff-only cache.** A diff archive has no delta for a file the patch
+  creates, but the source check counted a cached diff archive as covering
+  the whole patch: `apply --offline` passed it, patched the modified files,
+  then failed on the created file's missing blob; online `apply` never
+  fetched that blob. Coverage is now per file (a diff covers only files
+  with a `beforeHash`), so `apply --offline` reports the patch as having no
+  local source up front and changes nothing, online `apply` fetches just
+  the created files' blobs, and a default (diff-mode) `repair` downloads
+  them too. Such a repair's `--json` envelope carries a second
+  `downloaded` (dry-run `verified`) artifact event with `mode: "file"` for
+  those blobs.
+- **Hosted `scan` resolves more than 500 patches.** The package-reference
+  request is sent in chunks of 500 uuids, the endpoint's limit; a larger
+  scan used to fail with a 400.
 - **`rollback` fetches a before-blob that only a store peer variant
   needs.** The before-blob gate now probes every pnpm and vlt store variant
   copy the rollback restores, so an online rollback no longer fails
@@ -1817,6 +1834,15 @@ into the new version's section — see docs/releasing.md.
 
 ### Changed
 
+- **Fewer downloads in vendored runs.** A vendored run now asks the patch
+  service for all of its planned packages' download references in one
+  request (in chunks of 500) from the first package it reaches, in place
+  of one request per package; an outage costs the same retries as before,
+  and a package the service reports still building is asked again at its
+  turn. A pypi patch the service serves as an sdist (every patch without a
+  file qualifier) is refused from its reference, before its bytes are
+  downloaded: `auto` still warns `vendor_prebuilt_unavailable` and builds
+  the wheel locally, `service` still refuses.
 - **One owner rule for the patch stores.** `list`, `vex`, `scan`'s
   `updates[]`, `rollback` and `remove` now read the
   manifest and the vendor ledger (plus, in `vex`, the hosted records)
@@ -1927,22 +1953,25 @@ into the new version's section — see docs/releasing.md.
   covers the purl (its entry records the record's patch uuid and the
   committed artifact is on disk — a file artifact such as a wheel or
   tarball only while it still hashes to the ledger's `sha256`; `--force`
-  keeps the eager fetch), and for every lockfile-only cargo crate the
-  registry could fetch and verify (a crates.io `Cargo.lock` entry with a
-  checksum, or the pre-vendor resolution the ledger recovers) while the
-  patch service is enabled (the cargo backend reads the pristine source
-  only once `cargo_service_copy` falls back to the local build). A git,
-  path or custom-registry crate is never deferred: it keeps the eager
-  ladder's `vendor_fetch_unverifiable` + `package_not_installed` refusal
-  and is not vendored from the service's crates.io build, and a committed
+  keeps the eager fetch), and for every lockfile-only npm, cargo, golang
+  or composer package the registry would fetch and verify (a lock entry
+  with an integrity, or the pre-vendor resolution the ledger recovers,
+  that none of its fetcher's pre-download refusals applies to) while the
+  patch service is enabled (those backends read the pristine source only
+  once the service falls back to the local build; pypi and gem keep the
+  eager fetch, which their installed-variant probe reads). A git, path,
+  local-tarball or custom-registry package is never deferred: it keeps the
+  eager ladder's `vendor_fetch_unverifiable` + `package_not_installed`
+  refusal and is not vendored from the service's registry build, and a committed
   file artifact that no longer matches its pin keeps the eager ladder's
   outcome too. Visible effects: an idempotent re-run
   makes no registry requests and no longer reports `vendor_fetched_missing`
   for fetches it never needed; with no network (or under `--offline`) the
   re-run of an already-vendored pypi, cargo, go or lockfile-only gem
   project now SUCCEEDS (`already_vendored`, exit 0) instead of failing
-  `vendor_fetch_failed` / `package_not_installed`; a cargo crate the service
-  serves is never downloaded from the registry. When a deferred fetch does
+  `vendor_fetch_failed` / `package_not_installed`; an npm, cargo, golang or
+  composer package the service serves is never downloaded from the
+  registry. When a deferred fetch does
   happen (a drifted committed copy being rebuilt locally, a service miss),
   its `vendor_fetched_missing` warning is recorded just ahead of that
   package's own event instead of in the up-front fetch pass, and a failed,
diff --git a/Cargo.lock b/Cargo.lock
index 4475ec20..4a1aa3b4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1769,6 +1769,7 @@ dependencies = [
  "hex",
  "libc",
  "portable-pty",
+ "qbsdiff",
  "regex",
  "reqwest",
  "semver",
diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index 4ce5cb3a..b3a58ab1 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -127,7 +127,7 @@ For a **9.0 root lock**, the CLI ensures `pnpm-workspace.yaml` carries `trustLoc
 
 **Lockfile supplement (v3.4)**: `scan` discovery is no longer limited to installed trees. The project's lockfiles (`package-lock.json`/`npm-shrinkwrap.json`, `pnpm-lock.yaml` v9, `yarn.lock` classic + berry, `bun.lock`, `vlt-lock.json` (registry nodes, Socket-hosted pins included; vendored `file` nodes are left to the vendor ledger), `Cargo.lock`, `go.sum`, `composer.lock`, `Gemfile.lock`, `uv.lock`/`poetry.lock`/pinned `requirements.txt`) are inventoried and dependencies with NO installed copy join discovery — counts, the API lookup, the table (flagged ` [NOT INSTALLED]`, plus a stderr note), and the prune "scanned" set (a wiped node_modules no longer prunes lockfile-listed entries). JSON gains a top-level `lockfileOnlyPackages` count and an additive `notInstalled: true` on matching `packages[]` entries. `--apply` partitions lockfile-only patches out BEFORE download (calm `skipped`/`package_not_installed` records — never an error exit, never a manifest write); `--vendor` passes them through to the vendor engine's auto-fetch. Vendored-ledger entries likewise stay discoverable on a fresh clone (the committed artifact is the dependency). Global scans (`--global`) get no supplement. **Rush monorepos** (no root lockfile, `rush.json` present): the npm-lock inventory falls back to the Rush source-of-truth locks — `common/config/rush/pnpm-lock.yaml` plus every `common/config/subspaces/*/pnpm-lock.yaml` (`read_dir`-sorted, repo-relative paths preserved) — so a Rush repo's dependencies still join discovery. **Plug'n'Play layouts are an explicit refusal, not an empty inventory**: a `.pnp.*` loader means the npm packages are structurally unreachable in EVERY mode (under yarn PnP the installed-tree crawl is empty too — no `node_modules/`), so `scan` surfaces an additive top-level `warnings[]` array (`{code, detail}` objects, omitted when empty) carrying `yarn_pnp_unsupported` (same code as apply's refusal; remedy `yarn patch <pkg>`) or `pnpm_pnp_unsupported` (pnpm's `node-linker=pnp` twin; pnpm remedies), plus a stderr `Warning: …` line on the human path. Exit code and `status` are deliberately unchanged (exit 0 / `success` — the same posture as hosted refusals, which exit 0 with `redirected: 0`); the warning is the machine-readable signal that nothing was checked. Pinned by `tests/e2e_safety_yarn_pnp.rs`.
 
-**Vendor auto-fetch (v3.4)**: `vendor`/`scan --vendor` no longer fail on lockfile-resolved packages with no installed copy. Already-vendored purls stage from their committed artifact (sha256-verified against the vendor ledger — a vlt directory artifact against its file inventory, which leaves out the links vlt creates inside it; offline-safe) when the ledger entry is at the manifest record's patch uuid; a superseding uuid fetches the pristine package instead, since the older artifact holds the older patch's bytes. Otherwise the pristine artifact is fetched per the lockfile resolution and verified against the lock's recorded integrity FAIL-CLOSED before any write: npm SRI (or yarn classic's sha1 fragment; for vlt the registry node's slot [2]), yarn berry's cache-zip checksum (rebuilt from the fetched tarball; cacheKey 10c0 only), Cargo.lock sha256 over the .crate, go.sum `h1:` dirhash over the module zip, composer `dist.shasum` (sha1), Gemfile.lock `CHECKSUMS` sha256, uv.lock wheel sha256 (pure `py3-none-any` wheels only). Entries the lock cannot verify are NEVER fetched (`vendor_fetch_unverifiable` warning + the calm `package_not_installed` skip). Registry bases honor `SOCKET_NPM_REGISTRY`, `SOCKET_CRATES_REGISTRY`, `SOCKET_GOPROXY` (else `GOPROXY`, `GONOPROXY` and `GOPRIVATE` the way go reads them — see the env table); npm/yarn/composer/gem/uv lock-recorded URLs are used verbatim. `--offline` refuses the fetch with the calm skip (the detail names the lockfile resolution). The fetch stages into a private tempdir — the project tree is never touched. **Deferred fetch (v5.0):** a purl the vendor ledger already covers (its entry records the record's patch uuid and the committed artifact is on disk — a file artifact only while it hashes to the ledger's `sha256`; not under `--force`), and a lockfile-only cargo crate the registry could fetch and verify (a crates.io `Cargo.lock` entry with a checksum, or the pre-vendor resolution the ledger recovers) while the patch service is enabled, are NOT downloaded up front: the fetch runs only if the backend reaches a branch that reads the pristine tree (a drifted committed copy rebuilt locally, a service miss). An in-sync re-run therefore makes no registry request, reports no `vendor_fetched_missing`, and succeeds with no network or under `--offline`. A deferred fetch that does run records its `vendor_fetched_missing` just ahead of the package's own event; one that fails, is unverifiable, or is refused by `--offline` reports the same events the up-front fetch would have. A git, path or custom-registry cargo crate is never deferred, so it keeps `vendor_fetch_unverifiable` + `package_not_installed` and is never vendored from the service's crates.io build. **Gem, local build only** (`--vendor-source build`, or no service config): a not-installed gem the lock can verify (bundler >= 2.6 `CHECKSUMS`) and no ledger entry covers is refused `gem_spec_missing` (`failed`, the backend's own detail) BEFORE any download — a downloaded `.gem` carries no eval-able stub gemspec, so a local build can never vendor it; no `vendor_fetched_missing` precedes it, and a refusal the backend would have reached first on the fetched copy reports as `gem_spec_missing` too. Not under `--dry-run`, which still fetches and previews the gem (`vendor_fetched_missing` + `verified`).
+**Vendor auto-fetch (v3.4)**: `vendor`/`scan --vendor` no longer fail on lockfile-resolved packages with no installed copy. Already-vendored purls stage from their committed artifact (sha256-verified against the vendor ledger — a vlt directory artifact against its file inventory, which leaves out the links vlt creates inside it; offline-safe) when the ledger entry is at the manifest record's patch uuid; a superseding uuid fetches the pristine package instead, since the older artifact holds the older patch's bytes. Otherwise the pristine artifact is fetched per the lockfile resolution and verified against the lock's recorded integrity FAIL-CLOSED before any write: npm SRI (or yarn classic's sha1 fragment; for vlt the registry node's slot [2]), yarn berry's cache-zip checksum (rebuilt from the fetched tarball; cacheKey 10c0 only), Cargo.lock sha256 over the .crate, go.sum `h1:` dirhash over the module zip, composer `dist.shasum` (sha1), Gemfile.lock `CHECKSUMS` sha256, uv.lock wheel sha256 (pure `py3-none-any` wheels only). Entries the lock cannot verify are NEVER fetched (`vendor_fetch_unverifiable` warning + the calm `package_not_installed` skip). Registry bases honor `SOCKET_NPM_REGISTRY`, `SOCKET_CRATES_REGISTRY`, `SOCKET_GOPROXY` (else `GOPROXY`, `GONOPROXY` and `GOPRIVATE` the way go reads them — see the env table); npm/yarn/composer/gem/uv lock-recorded URLs are used verbatim. `--offline` refuses the fetch with the calm skip (the detail names the lockfile resolution). The fetch stages into a private tempdir — the project tree is never touched. **Deferred fetch (v5.0):** a purl the vendor ledger already covers (its entry records the record's patch uuid and the committed artifact is on disk — a file artifact only while it hashes to the ledger's `sha256`; not under `--force`), and a lockfile-only npm, cargo, golang or composer package the registry would fetch and verify (a lock entry with an integrity, or the pre-vendor resolution the ledger recovers, that none of its fetcher's pre-download refusals applies to: a yarn berry cacheKey other than 10c0, a go module go fetches without a proxy, a composer entry with no dist URL) while the patch service is enabled, are NOT downloaded up front (those backends ask the service first and read the pristine tree only on a local-build fallback; pypi and gem keep the up-front fetch, which their installed-variant probe reads): the fetch runs only if the backend reaches a branch that reads the pristine tree (a drifted committed copy rebuilt locally, a service miss). An in-sync re-run therefore makes no registry request, reports no `vendor_fetched_missing`, and succeeds with no network or under `--offline`. A deferred fetch that does run records its `vendor_fetched_missing` just ahead of the package's own event; one that fails, is unverifiable, or is refused by `--offline` reports the same events the up-front fetch would have. A package whose fetch would be refused is never deferred (a git, path or custom-registry cargo crate, say), so it keeps `vendor_fetch_unverifiable` + `package_not_installed` and is never vendored from the service's registry build. **Gem, local build only** (`--vendor-source build`, or no service config): a not-installed gem the lock can verify (bundler >= 2.6 `CHECKSUMS`) and no ledger entry covers is refused `gem_spec_missing` (`failed`, the backend's own detail) BEFORE any download — a downloaded `.gem` carries no eval-able stub gemspec, so a local build can never vendor it; no `vendor_fetched_missing` precedes it, and a refusal the backend would have reached first on the fetched copy reports as `gem_spec_missing` too. Not under `--dry-run`, which still fetches and previews the gem (`vendor_fetched_missing` + `verified`).
 
 **Vendored write durability (v5.0)**: every write is atomic (stage + rename), but only the durable commit points — lockfiles, `go.mod`/`go.sum`, `pom.xml`, `nuget.config`, `package.json`, `pnpm-workspace.yaml`, `.cargo/config.toml`, the Python/Ruby manifests, `.socket/vendor/state.json` and `redirect-state.json` — are fsynced on write. The content-verified artifacts under `.socket/vendor/<eco>/<uuid>/` (patched copies, packed/rebuilt archives and sidecars, markers) are written without an fsync and made durable by one barrier (file + directory fsync, one `F_FULLFSYNC` per device on macOS) ahead of the next commit point — and, for an artifact rebuilt in place that no commit point follows, at the end of the vendored run's commit and when the command releases the apply lock — so a crash can only lose an artifact that no durable commit point names yet, which the next run rebuilds.
 
@@ -1162,7 +1162,7 @@ Every `--json` invocation emits a single JSON object that follows the **unified
 | `vendor_override_conflict` | `failed`        | vendor (pnpm/yarn-berry): a user-authored override/resolution for the package already exists. |
 | `vendor_integrity_unverified` | `skipped` (warning) | vendor (pipenv): the lockfile format does not hash-check file entries; the committed wheel bytes are the protection. |
 | `vendor_content_mismatch_overwritten` | `skipped` (warning) | vendor: a staged file matched NEITHER beforeHash nor afterHash (patch built against different bytes, or local edits); the stage was overwritten with the verified patched content and the vendor succeeded. |
-| `vendor_fetched_missing` | `skipped` (warning) | vendor: the package was not installed; its pristine artifact was fetched per the lockfile resolution (or staged from the committed vendor artifact), integrity-verified, and vendored — the project tree was not touched. Not emitted when no fetch happened: an in-sync re-run of a ledger-covered purl, or a cargo crate the patch service served (see Vendor auto-fetch § Deferred fetch). For `poetry.lock` (which records hashes but no URLs) the pure-Python wheel's sha256 selects the file through PyPI's JSON API (`SOCKET_PYPI_JSON_API` overrides the endpoint); Poetry 0.12's bare `[metadata.hashes]` names no wheel, so those locks still need an installed copy (`vendor_fetch_unverifiable`). |
+| `vendor_fetched_missing` | `skipped` (warning) | vendor: the package was not installed; its pristine artifact was fetched per the lockfile resolution (or staged from the committed vendor artifact), integrity-verified, and vendored — the project tree was not touched. Not emitted when no fetch happened: an in-sync re-run of a ledger-covered purl, or an npm, cargo, golang or composer package the patch service served (see Vendor auto-fetch § Deferred fetch). For `poetry.lock` (which records hashes but no URLs) the pure-Python wheel's sha256 selects the file through PyPI's JSON API (`SOCKET_PYPI_JSON_API` overrides the endpoint); Poetry 0.12's bare `[metadata.hashes]` names no wheel, so those locks still need an installed copy (`vendor_fetch_unverifiable`). |
 | `vendor_fetch_failed` | `failed` | vendor: the lockfile-resolved fetch was attempted and failed (HTTP error, size cap, integrity mismatch, or a PRESENT-but-corrupt committed artifact — pointed at `socket-patch repair`). A MISSING committed artifact no longer lands here: it falls through to the ledger-recovered registry fetch. Suppresses the duplicate `package_not_installed` skip. |
 | `vendor_fetch_unverifiable` | `skipped` (warning) | vendor: the lockfile records no usable integrity for the missing package; nothing was fetched (fail-closed) and the `package_not_installed` skip follows. Unchanged for gems by the build-mode `gem_spec_missing` refusal below, which fires only where a fetch WOULD have run. |
 | `vendor_vlt_transitive_unsupported` | `failed` | vendor (vlt): the target has an inbound edge from another package in `vlt-lock.json` (the detail names it); vendored mode rewires only direct dependencies of the root or a workspace member, because vlt silently reverts transitive lock surgery. Remedy: `--mode hosted`. Refused before any download or write, dry runs included (`would_refuse`). |
@@ -1239,7 +1239,7 @@ Every `--json` invocation emits a single JSON object that follows the **unified
 | `apply`      | `Applied` · `Updated` · `Skipped` (already_patched / package_not_installed / vendored) · `Failed` · `Verified` (dry-run) |
 | `vendor`     | `Applied` (= vendored; `command` routes) · `Skipped` (refusals, warnings, unsupported ecosystems) · `Failed` · `Removed` (reconcile + `--revert`) · `Verified` (dry-run) |
 | `list`       | `Discovered` (with `details.vulnerabilities`, `details.tier`, `details.license`, `details.description`, `details.exportedAt`; hosted pins (v5.0: one per `(purl, uuid)` the lockfiles wire) additionally carry `details.mode: "hosted"` and `details.lockfiles: [<root-relative files wiring it>]` (no `details.ledger` — hosted mode keeps no ledger; the human listing labels them `Mode: hosted (wired in <files>)`), both additive and absent on manifest entries; v5.0: vendor-ledger records carry `details.mode: "vendored"` + `details.ledger: ".socket/vendor/state.json"` the same way, and the human listing labels them `Mode: vendored (recorded in .socket/vendor/state.json)`; a `state.json` that cannot be read or parsed degrades to nothing-to-consult with the stderr line `Warning: unreadable vendor ledger (<error>); its vendored patches are not listed` — muted by `--silent`, exit unchanged) |
-| `repair`/`gc`| `Downloaded` (or `Verified` on dry-run) · `Rebuilt` (vendored artifacts; `Verified` previews on dry-run) · `Skipped` (vendor_uuid_mismatch) · `Removed` (or `Verified`) · `Failed` events |
+| `repair`/`gc`| `Downloaded` (or `Verified` on dry-run; a diff-mode repair adds a second one, `mode: "file"`, for the blobs of files the patches create) · `Rebuilt` (vendored artifacts; `Verified` previews on dry-run) · `Skipped` (vendor_uuid_mismatch) · `Removed` (or `Verified`) · `Failed` events |
 | `remove`     | `Removed` (per purl; `Verified` on dry-run) · artifact-level `Removed`/`Verified` event (with `details.blobsRemoved`, `details.rolledBack`) |
 | `--update`   | `Downloaded` → `Updated` (success) · `Skipped` (already_latest) · `Verified` (dry-run check, reason update_check) — see the Self-update contract section for details fields and top-level error codes |
 
diff --git a/crates/socket-patch-cli/Cargo.toml b/crates/socket-patch-cli/Cargo.toml
index bd7262d0..ab434d5e 100644
--- a/crates/socket-patch-cli/Cargo.toml
+++ b/crates/socket-patch-cli/Cargo.toml
@@ -64,6 +64,8 @@ sha1 = { workspace = true }
 # scan_vendor_e2e builds pristine registry tarballs for the auto-fetch tests.
 tar = { workspace = true }
 flate2 = { workspace = true }
+# diff_created_file_e2e builds a real diff archive.
+qbsdiff = { workspace = true }
 # update_fixture builds the Windows-shaped release archive for self-update e2e.
 zip = { workspace = true }
 hex = { workspace = true }
diff --git a/crates/socket-patch-cli/src/commands/fetch_stage.rs b/crates/socket-patch-cli/src/commands/fetch_stage.rs
index e60bddb9..c3e11faa 100644
--- a/crates/socket-patch-cli/src/commands/fetch_stage.rs
+++ b/crates/socket-patch-cli/src/commands/fetch_stage.rs
@@ -201,10 +201,11 @@ fn format_blob_fallback(diff_failed: usize, blobs: usize) -> String {
 }
 
 /// The manifest PURLs with no usable local source. A patch is "locally
-/// applicable" iff at least one of:
-///   - every `after_hash` blob it references is on disk, OR
-///   - its diff archive is on disk, OR
-///   - its package archive is on disk.
+/// applicable" iff its package archive is on disk, or every file it
+/// touches has its `after_hash` blob on disk or is covered by the patch's
+/// diff archive. A diff covers only files that exist before the patch: a
+/// created file (empty `before_hash`) has nothing to diff against, so it
+/// always needs its blob.
 ///
 /// The patch pipeline picks whichever is present per file. Shared by the
 /// offline gate (probed against `.socket/`) and the post-download gate
@@ -219,13 +220,13 @@ fn patches_without_source<'m>(
         .patches
         .iter()
         .filter_map(|(purl, record)| {
-            let all_blobs_present = record
-                .files
-                .values()
-                .all(|f| !missing_blobs.contains(&f.after_hash));
             let diff_present = !missing_diff_archives.contains(&record.uuid);
             let pkg_present = !missing_package_archives.contains(&record.uuid);
-            if all_blobs_present || diff_present || pkg_present {
+            let files_covered = record.files.values().all(|f| {
+                !missing_blobs.contains(&f.after_hash)
+                    || (diff_present && !f.before_hash.is_empty())
+            });
+            if pkg_present || files_covered {
                 None
             } else {
                 Some(purl.as_str())
@@ -234,6 +235,33 @@ fn patches_without_source<'m>(
         .collect()
 }
 
+/// `manifest` cut down to the files a diff archive cannot patch (created
+/// files, whose `before_hash` is empty): the blobs a diff-mode fetch still
+/// needs even when every diff archive is present.
+pub(crate) fn files_diffs_cannot_cover(manifest: &PatchManifest) -> PatchManifest {
+    let patches = manifest
+        .patches
+        .iter()
+        .filter_map(|(purl, record)| {
+            let files: HashMap<_, _> = record
+                .files
+                .iter()
+                .filter(|(_, f)| f.before_hash.is_empty())
+                .map(|(k, v)| (k.clone(), v.clone()))
+                .collect();
+            (!files.is_empty()).then(|| {
+                let mut record = record.clone();
+                record.files = files;
+                (purl.clone(), record)
+            })
+        })
+        .collect();
+    PatchManifest {
+        patches,
+        setup: manifest.setup.clone(),
+    }
+}
+
 /// Mirror `src`'s files into `dst` by hardlink (copy fallback). Pre-seeds the
 /// overlay tempdir with everything already cached so only the gap downloads.
 async fn overlay_dir(src: &Path, dst: &Path) {
@@ -311,12 +339,14 @@ pub(crate) async fn stage_patch_sources(
     // locally. We honor `--download-mode` for the primary fetch when there's
     // actually a gap to close. Skip the archive fetch entirely when all file
     // blobs are already present locally — the pipeline will succeed via the
-    // blob path, so an archive fetch would be wasted round-trips.
+    // blob path, so an archive fetch would be wasted round-trips. Cached
+    // diff archives can still leave a patch uncovered (a created file), and
+    // the blob top-up below closes that gap.
     let download_needed = !common.offline
         && match download_mode {
             DownloadMode::File => !missing_blobs.is_empty(),
             DownloadMode::Diff if missing_blobs.is_empty() => false,
-            DownloadMode::Diff => !missing_diff_archives.is_empty(),
+            DownloadMode::Diff => !missing_diff_archives.is_empty() || !no_source_purls.is_empty(),
         };
 
     if !download_needed {
@@ -374,15 +404,25 @@ pub(crate) async fn stage_patch_sources(
     // For non-file modes, automatically fetch any still-missing file blobs as
     // a fallback. Patches that lack the requested mode on the server will
     // still apply via the legacy blob path.
+    //
+    // With every diff archive already cached, only the files no diff can
+    // patch are fetched: that is the gap that triggered this download.
     let mut blob_fetch_failed = false;
     if download_mode != DownloadMode::File {
-        let still_missing_blobs = get_missing_blobs(manifest, &staged.blobs).await;
+        let created_only;
+        let blob_scope = if missing_diff_archives.is_empty() {
+            created_only = files_diffs_cannot_cover(manifest);
+            &created_only
+        } else {
+            manifest
+        };
+        let still_missing_blobs = get_missing_blobs(blob_scope, &staged.blobs).await;
         if !still_missing_blobs.is_empty() {
             status.set(format_blob_fallback(
                 fetch_result.failed,
                 still_missing_blobs.len(),
             ));
-            let blob_result = fetch_missing_blobs(manifest, &staged.blobs, client, None).await;
+            let blob_result = fetch_missing_blobs(blob_scope, &staged.blobs, client, None).await;
             status.finish();
             if !quiet {
                 for line in format_fetch_summary(&blob_result, BLOB, true) {
@@ -972,6 +1012,70 @@ mod tests {
         );
     }
 
+    /// A diff archive cannot patch a file the patch creates (nothing to diff
+    /// against), so it covers such a patch only together with the created
+    /// file's blob: without it, offline staging is Unavailable up front
+    /// instead of passing the gate and failing mid-apply.
+    #[tokio::test]
+    async fn stage_offline_diff_archive_does_not_cover_a_created_file() {
+        let tmp = tempfile::tempdir().unwrap();
+        let socket_dir = tmp.path().join(".socket");
+        std::fs::create_dir_all(socket_dir.join("diffs")).unwrap();
+        std::fs::write(
+            socket_dir.join("diffs").join(format!("{UUID}.tar.gz")),
+            b"x",
+        )
+        .unwrap();
+        let created = "c".repeat(64);
+        let mut manifest = manifest_with_one_patch();
+        manifest
+            .patches
+            .get_mut("pkg:npm/left-pad@1.3.0")
+            .unwrap()
+            .files
+            .insert(
+                "new.js".to_string(),
+                PatchFileInfo {
+                    before_hash: String::new(),
+                    after_hash: created.clone(),
+                },
+            );
+
+        let outcome =
+            stage_patch_sources(&offline_args(), &manifest, &socket_dir, &offline_client())
+                .await
+                .expect("no hard failure");
+        assert!(matches!(outcome, StageOutcome::Unavailable));
+
+        std::fs::create_dir_all(socket_dir.join("blobs")).unwrap();
+        std::fs::write(socket_dir.join("blobs").join(&created), b"new").unwrap();
+        let outcome =
+            stage_patch_sources(&offline_args(), &manifest, &socket_dir, &offline_client())
+                .await
+                .expect("no hard failure");
+        assert!(
+            matches!(outcome, StageOutcome::Ready(_)),
+            "diff for the modified file + blob for the created one covers the patch"
+        );
+    }
+
+    #[test]
+    fn files_diffs_cannot_cover_keeps_only_created_files() {
+        let mut manifest = manifest_with_one_patch();
+        assert!(files_diffs_cannot_cover(&manifest).patches.is_empty());
+        let record = manifest.patches.get_mut("pkg:npm/left-pad@1.3.0").unwrap();
+        record.files.insert(
+            "new.js".to_string(),
+            PatchFileInfo {
+                before_hash: String::new(),
+                after_hash: "c".repeat(64),
+            },
+        );
+        let cut = files_diffs_cannot_cover(&manifest);
+        let files: Vec<&String> = cut.patches["pkg:npm/left-pad@1.3.0"].files.keys().collect();
+        assert_eq!(files, ["new.js"]);
+    }
+
     /// The vendor (in-memory) stager documents the opposite policy: a diff
     /// archive is NOT sufficient (auto-force can need the full after-blob),
     /// so the same fixture that satisfies the disk stager is Unavailable
diff --git a/crates/socket-patch-cli/src/commands/repair.rs b/crates/socket-patch-cli/src/commands/repair.rs
index 48fd4d0b..9444b0ac 100644
--- a/crates/socket-patch-cli/src/commands/repair.rs
+++ b/crates/socket-patch-cli/src/commands/repair.rs
@@ -14,6 +14,7 @@ use std::path::Path;
 use std::time::Duration;
 
 use crate::args::{apply_env_toggles, parse_bool_flag, GlobalArgs};
+use crate::commands::fetch_stage::files_diffs_cannot_cover;
 use crate::commands::lock_cli::{acquire_or_emit, error_envelope};
 use crate::commands::rollback::{sweep_failure, sweep_unused_artifacts};
 use crate::json_envelope::{Command, Envelope, PatchAction, PatchEvent, Status};
@@ -341,6 +342,100 @@ fn format_final_line(
     }
 }
 
+/// The `.socket/` source directories a download pass writes into.
+struct SourcePaths<'a> {
+    blobs: &'a Path,
+    packages: &'a Path,
+    diffs: &'a Path,
+}
+
+/// What one download pass did: how many artifacts were missing, and how
+/// many of them it downloaded or failed to.
+#[derive(Default)]
+struct DownloadPass {
+    missing: usize,
+    downloaded: usize,
+    failed: usize,
+}
+
+/// Step 1's pass over `missing` (non-empty), the `mode` artifacts `m`
+/// references: the `--offline` warning, the `--dry-run` preview, or the
+/// download and its result lines.
+async fn download_pass(
+    args: &RepairArgs,
+    client: &mut Option<ApiClient>,
+    m: &socket_patch_core::manifest::schema::PatchManifest,
+    missing: &[String],
+    mode: DownloadMode,
+    paths: &SourcePaths<'_>,
+) -> DownloadPass {
+    let quiet = args.common.json || args.common.silent;
+    let noun = mode.noun();
+    let mut pass = DownloadPass {
+        missing: missing.len(),
+        ..DownloadPass::default()
+    };
+    if args.common.offline {
+        if !quiet {
+            eprintln!("{}", format_offline_warning(missing, noun));
+        }
+        return pass;
+    }
+    if !quiet {
+        println!("{}", format_found_missing(missing.len(), noun));
+    }
+    if args.common.dry_run {
+        if !quiet {
+            println!();
+            println!("Would download:");
+            for line in format_id_list(missing, noun, DRY_RUN_LIST_CAP) {
+                println!("{line}");
+            }
+        }
+        return pass;
+    }
+    let mut status = crate::ui::StatusLine::stderr(args.common.json, args.common.silent);
+    status.set(format!("Downloading {}...", noun.count(missing.len())));
+    if client.is_none() {
+        *client = Some(
+            get_api_client_with_overrides(args.common.api_client_overrides())
+                .await
+                .0,
+        );
+    }
+    let client = client.as_ref().expect("client built just above");
+    let sources = PatchSources {
+        blobs_path: paths.blobs,
+        packages_path: Some(paths.packages),
+        diffs_path: Some(paths.diffs),
+        mem_blobs: None,
+    };
+    let fetch_result = fetch_missing_sources(m, &sources, mode, client, None).await;
+    status.finish();
+    pass.downloaded = fetch_result.downloaded;
+    pass.failed = fetch_result.failed;
+    if !quiet {
+        for line in format_fetch_successes(&fetch_result, noun) {
+            println!("{line}");
+        }
+    }
+    // Failures are error output: stderr, and not muted by `--silent`
+    // (`--json` runs carry them in the envelope).
+    if !args.common.json {
+        for (i, line) in format_fetch_failures(&fetch_result, noun)
+            .iter()
+            .enumerate()
+        {
+            if i == 0 {
+                eprintln!("Error: {line}");
+            } else {
+                eprintln!("{line}");
+            }
+        }
+    }
+    pass
+}
+
 /// Whether an API token will be found, mirroring the client's chain: the
 /// `--api-token` flag (clap also maps SOCKET_API_TOKEN into it), then —
 /// unless `SOCKET_NO_API_TOKEN` vetoes ambient tokens — the env var and the
@@ -455,86 +550,48 @@ async fn repair_inner(
             .into_iter()
             .collect(),
     };
-    let missing_count = missing_artifacts.len();
     let noun = download_mode.noun();
+    let paths = SourcePaths {
+        blobs: &blobs_path,
+        packages: &packages_path,
+        diffs: &diffs_path,
+    };
     // Whether stdout already carries a line, so the blank separators
     // between sections never open the output (the offline warning goes
     // to stderr).
-    let mut stdout_started = true;
-
-    if missing_artifacts.is_empty() {
-        if !quiet {
-            println!("{}", format_nothing_missing(manifest.as_ref(), noun));
+    let mut stdout_started = !args.common.offline || missing_artifacts.is_empty();
+    let primary = match scoped_manifest.as_ref() {
+        Some(m) if !missing_artifacts.is_empty() => {
+            download_pass(args, client, m, &missing_artifacts, download_mode, &paths).await
         }
-    } else if args.common.offline {
-        if !quiet {
-            eprintln!("{}", format_offline_warning(&missing_artifacts, noun));
-        }
-        stdout_started = false;
-    } else {
-        if !quiet {
-            println!("{}", format_found_missing(missing_artifacts.len(), noun));
-        }
-
-        if args.common.dry_run {
+        _ => {
             if !quiet {
-                println!();
-                println!("Would download:");
-                for line in format_id_list(&missing_artifacts, noun, DRY_RUN_LIST_CAP) {
-                    println!("{line}");
-                }
-            }
-        } else {
-            let mut status = crate::ui::StatusLine::stderr(args.common.json, args.common.silent);
-            status.set(format!(
-                "Downloading {}...",
-                noun.count(missing_artifacts.len())
-            ));
-            if client.is_none() {
-                *client = Some(
-                    get_api_client_with_overrides(args.common.api_client_overrides())
-                        .await
-                        .0,
-                );
+                println!("{}", format_nothing_missing(manifest.as_ref(), noun));
             }
-            let client = client.as_ref().expect("client built just above");
-            let sources = PatchSources {
-                blobs_path: &blobs_path,
-                packages_path: Some(&packages_path),
-                diffs_path: Some(&diffs_path),
-                mem_blobs: None,
-            };
-            // Step 1 only runs with a manifest (missing_artifacts is
-            // empty otherwise), so the expect is unreachable.
-            let m = scoped_manifest
-                .as_ref()
-                .expect("step 1 requires a manifest");
-            let fetch_result =
-                fetch_missing_sources(m, &sources, download_mode, client, None).await;
-            status.finish();
-            downloaded_count = fetch_result.downloaded;
-            download_failed_count = fetch_result.failed;
-            if !quiet {
-                for line in format_fetch_successes(&fetch_result, noun) {
-                    println!("{line}");
-                }
-            }
-            // Failures are error output: stderr, and not muted by
-            // `--silent` (`--json` runs carry them in the envelope).
-            if !args.common.json {
-                for (i, line) in format_fetch_failures(&fetch_result, noun)
-                    .iter()
-                    .enumerate()
-                {
-                    if i == 0 {
-                        eprintln!("Error: {line}");
-                    } else {
-                        eprintln!("{line}");
-                    }
-                }
+            DownloadPass::default()
+        }
+    };
+    // A diff archive has no delta for a file the patch creates, so in diff
+    // mode that file's blob is downloaded too: without it, a later
+    // `apply --offline` cannot apply the patch.
+    let created = match (&scoped_manifest, download_mode) {
+        (Some(m), DownloadMode::Diff) => {
+            let created = files_diffs_cannot_cover(m);
+            let missing: Vec<String> = get_missing_blobs(&created, &blobs_path)
+                .await
+                .into_iter()
+                .collect();
+            if missing.is_empty() {
+                DownloadPass::default()
+            } else {
+                download_pass(args, client, &created, &missing, DownloadMode::File, &paths).await
             }
         }
-    }
+        _ => DownloadPass::default(),
+    };
+    let missing_count = primary.missing;
+    downloaded_count += primary.downloaded;
+    download_failed_count += primary.failed;
 
     // Step 1.5: vendored artifacts — health-check the ledger and re-vendor
     // missing/corrupt artifacts through the vendored backend (the patch
@@ -620,13 +677,24 @@ async fn repair_inner(
         // so a piped stdout never ends in a stray blank line when the
         // line itself goes to stderr.
         let other_failure = matches!(env.status, Status::PartialFailure | Status::Error);
-        let line = format_final_line(
-            download_failed_count,
-            other_failure,
-            noun,
-            args.common.dry_run,
-        );
-        if download_failed_count > 0 || other_failure {
+        let failed = download_failed_count + created.failed;
+        let line = if download_failed_count > 0 && created.failed > 0 {
+            format!(
+                "Repair finished with errors: {} and {} were not downloaded.",
+                noun.count(download_failed_count),
+                BLOB.count(created.failed)
+            )
+        } else if download_failed_count > 0 {
+            format_final_line(
+                download_failed_count,
+                other_failure,
+                noun,
+                args.common.dry_run,
+            )
+        } else {
+            format_final_line(created.failed, other_failure, BLOB, args.common.dry_run)
+        };
+        if failed > 0 || other_failure {
             if stdout_started {
                 eprintln!();
             }
@@ -667,6 +735,28 @@ async fn repair_inner(
         ));
         env.mark_partial_failure();
     }
+    if created.downloaded > 0
+        || (!args.common.offline && args.common.dry_run && created.missing > 0)
+    {
+        let (action, count) = if args.common.dry_run {
+            (PatchAction::Verified, created.missing)
+        } else {
+            (PatchAction::Downloaded, created.downloaded)
+        };
+        env.record(
+            PatchEvent::artifact(action).with_details(serde_json::json!({
+                "count": count,
+                "mode": DownloadMode::File.as_tag(),
+            })),
+        );
+    }
+    if created.failed > 0 {
+        env.record(PatchEvent::artifact(PatchAction::Failed).with_error(
+            "download_failed",
+            format!("{} failed to download", BLOB.count(created.failed)),
+        ));
+        env.mark_partial_failure();
+    }
     if blobs_cleaned > 0 {
         let cleanup_action = if args.common.dry_run {
             PatchAction::Verified
@@ -683,7 +773,7 @@ async fn repair_inner(
     Ok((
         env,
         RepairCounts {
-            downloaded: downloaded_count,
+            downloaded: downloaded_count + created.downloaded,
             cleaned: blobs_cleaned,
             bytes_freed,
         },
diff --git a/crates/socket-patch-cli/src/commands/vendor.rs b/crates/socket-patch-cli/src/commands/vendor.rs
index 38ab3964..093de219 100644
--- a/crates/socket-patch-cli/src/commands/vendor.rs
+++ b/crates/socket-patch-cli/src/commands/vendor.rs
@@ -1686,6 +1686,45 @@ pub(crate) async fn pristine_fetch_is_verifiable(
     }
 }
 
+/// Whether [`fetch_pristine_package`] would reach the download for this
+/// purl: the same entry choice (see [`pristine_fetch_is_verifiable`]), and
+/// none of the refusals its fetcher raises before the first request (a
+/// foreign yarn berry cacheKey, a go module go would not fetch through a
+/// proxy, a composer entry with no dist URL). Deferring a fetch that would
+/// refuse `vendor_fetch_unverifiable` behind the patch service would
+/// instead vendor the patch over a package it does not describe.
+async fn pristine_fetch_reaches_download(
+    project_root: &Path,
+    inventory: &[lock_inventory::LockfileEntry],
+    purl: &str,
+    ledger_entry: Option<&VendorEntry>,
+) -> bool {
+    let entry = match lock_inventory::lookup(inventory, purl)
+        .filter(|e| e.integrity != lock_inventory::LockIntegrity::None)
+    {
+        Some(e) => e.clone(),
+        None => match ledger_entry {
+            Some(le) => match lock_inventory::recover_lock_entry(project_root, le).await {
+                Ok(e) => e,
+                Err(_) => return false,
+            },
+            None => return false,
+        },
+    };
+    registry_fetch::refusal_before_download(&entry).is_none()
+}
+
+/// The ecosystems whose backend asks the patch service before it reads the
+/// pristine tree, and reads it only on a local-build fallback. pypi and gem
+/// read it earlier, in the loop's installed-variant probe; nuget and maven
+/// have no registry fetch.
+fn backend_reads_pristine_only_on_fallback(purl: &str) -> bool {
+    matches!(
+        Ecosystem::from_purl(purl),
+        Some(Ecosystem::Npm | Ecosystem::Cargo | Ecosystem::Golang | Ecosystem::Composer)
+    )
+}
+
 /// The purls among `purls` with an installed copy, found exactly as the
 /// vendor loop finds them: the qualified-aware resolver
 /// ([`find_packages_for_rollback_reusing`]), then the npm `package.json`
@@ -2365,11 +2404,12 @@ pub(crate) async fn vendor_records_reusing(
             //    backend's in-sync hot path answers it from the committed
             //    bytes alone, so a re-run needs no network. `--force` may
             //    rebuild anyway, so it keeps the eager fetch.
-            //  * a cargo crate the patch service can serve: the backend reads
-            //    the pristine tree only if it falls back to the local build.
-            //    Only a crate the registry ladder COULD fetch (see
-            //    `pristine_fetch_is_verifiable`) — a git, path or
-            //    custom-registry crate keeps the eager rung, whose
+            //  * a package the patch service can serve, in an ecosystem whose
+            //    backend reads the pristine tree only if it falls back to the
+            //    local build (`backend_reads_pristine_only_on_fallback`).
+            //    Only one the registry ladder would really download (see
+            //    `pristine_fetch_reaches_download`) — a git, path or
+            //    custom-registry crate, say, keeps the eager rung, whose
             //    `vendor_fetch_unverifiable` refusal keeps a crates.io patch
             //    off it.
             //
@@ -2389,10 +2429,10 @@ pub(crate) async fn vendor_records_reusing(
                         }
                         None => false,
                     };
-                let cargo_via_service = service_enabled
+                let via_service = service_enabled
                     && matches!(rung, MissingRung::Fetch)
-                    && Ecosystem::from_purl(purl) == Some(Ecosystem::Cargo)
-                    && pristine_fetch_is_verifiable(
+                    && backend_reads_pristine_only_on_fallback(purl)
+                    && pristine_fetch_reaches_download(
                         &common.cwd,
                         inventory
                             .get_or_init(|| lock_inventory::inventory_project(&common.cwd))
@@ -2401,7 +2441,7 @@ pub(crate) async fn vendor_records_reusing(
                         lookup_entry(&state.entries, purl),
                     )
                     .await;
-                if covered || cargo_via_service {
+                if covered || via_service {
                     *rung = MissingRung::Deferred;
                 }
             }
diff --git a/crates/socket-patch-cli/tests/diff_created_file_e2e.rs b/crates/socket-patch-cli/tests/diff_created_file_e2e.rs
new file mode 100644
index 00000000..50b7b879
--- /dev/null
+++ b/crates/socket-patch-cli/tests/diff_created_file_e2e.rs
@@ -0,0 +1,282 @@
+//! A diff archive only carries deltas for files that exist before the
+//! patch: a file the patch CREATES (empty `beforeHash`) has nothing to
+//! diff against, so the patch service leaves it out and the pipeline can
+//! only apply it from its after-blob (or a package archive). These tests
+//! pin that the disk stager and `repair` both treat a diff archive as
+//! covering only the files it can actually patch:
+//!
+//!   - `apply --offline` with just the diff archive on disk fails closed
+//!     with the "no local source" report and leaves every file untouched,
+//!     instead of passing the gate and failing mid-apply;
+//!   - online `apply` with the diff archive cached still fetches the
+//!     created file's blob;
+//!   - a default (diff-mode) `repair` also downloads the created file's
+//!     blob, so a later `apply --offline` succeeds.
+
+use std::path::{Path, PathBuf};
+use std::process::Command;
+
+use flate2::write::GzEncoder;
+use flate2::Compression;
+use qbsdiff::Bsdiff;
+use sha2::{Digest, Sha256};
+use wiremock::matchers::{method, path};
+use wiremock::{Mock, MockServer, ResponseTemplate};
+
+const ORG_SLUG: &str = "test-org";
+const UUID: &str = "67676767-6767-4767-8767-676767676767";
+const PURL: &str = "pkg:npm/created-file-test@1.0.0";
+const BEFORE: &[u8] = b"module.exports = 'before, and long enough to diff';\n";
+const AFTER: &[u8] = b"module.exports = 'after!, and long enough to diff';\n";
+const CREATED: &[u8] = b"module.exports = 'a brand new file';\n";
+
+fn binary() -> PathBuf {
+    env!("CARGO_BIN_EXE_socket-patch").into()
+}
+
+fn git_sha256(content: &[u8]) -> String {
+    let header = format!("blob {}\0", content.len());
+    let mut hasher = Sha256::new();
+    hasher.update(header.as_bytes());
+    hasher.update(content);
+    hex::encode(hasher.finalize())
+}
+
+fn run_cli(root: &Path, argv: &[&str], mock_uri: Option<&str>) -> (i32, String, String) {
+    let mut cmd = Command::new(binary());
+    cmd.args(argv).current_dir(root);
+    for (key, _) in std::env::vars_os() {
+        if key.to_string_lossy().starts_with("SOCKET_")
+            && key.to_string_lossy() != "SOCKET_NO_CONFIG"
+        {
+            cmd.env_remove(&key);
+        }
+    }
+    cmd.env("SOCKET_TELEMETRY_DISABLED", "1");
+    // Offline runs get a dead endpoint: any request they make fails.
+    let api_url = mock_uri.unwrap_or("http://127.0.0.1:1");
+    cmd.env("SOCKET_API_URL", api_url)
+        .env("SOCKET_API_TOKEN", "fake-token-for-test")
+        .env("SOCKET_ORG_SLUG", ORG_SLUG);
+    let out = cmd.output().expect("run socket-patch");
+    (
+        out.status.code().unwrap_or(-1),
+        String::from_utf8_lossy(&out.stdout).into_owned(),
+        String::from_utf8_lossy(&out.stderr).into_owned(),
+    )
+}
+
+/// The diff archive the service serves for this patch: a bsdiff delta for
+/// the modified file and nothing for the created one.
+fn diff_archive() -> Vec<u8> {
+    let mut delta = Vec::new();
+    Bsdiff::new(BEFORE, AFTER)
+        .compare(std::io::Cursor::new(&mut delta))
+        .unwrap();
+    let mut builder = tar::Builder::new(GzEncoder::new(Vec::new(), Compression::default()));
+    let mut header = tar::Header::new_gnu();
+    header.set_size(delta.len() as u64);
+    header.set_mode(0o644);
+    header.set_cksum();
+    builder
+        .append_data(&mut header, "index.js", delta.as_slice())
+        .unwrap();
+    builder.into_inner().unwrap().finish().unwrap()
+}
+
+/// An npm project with the unpatched package installed and a manifest
+/// whose patch modifies `index.js` and creates `new.js` (sorted after
+/// `index.js`, so a mid-apply failure would leave `index.js` patched). Returns the
+/// installed package dir.
+fn seed_project(root: &Path) -> PathBuf {
+    std::fs::write(
+        root.join("package.json"),
+        r#"{"name":"created-file-root","version":"0.0.0"}"#,
+    )
+    .unwrap();
+    let pkg = root.join("node_modules").join("created-file-test");
+    std::fs::create_dir_all(&pkg).unwrap();
+    std::fs::write(
+        pkg.join("package.json"),
+        r#"{"name":"created-file-test","version":"1.0.0"}"#,
+    )
+    .unwrap();
+    std::fs::write(pkg.join("index.js"), BEFORE).unwrap();
+
+    let socket = root.join(".socket");
+    std::fs::create_dir_all(&socket).unwrap();
+    std::fs::write(
+        socket.join("manifest.json"),
+        serde_json::to_vec_pretty(&serde_json::json!({
+            "patches": {
+                PURL: {
+                    "uuid": UUID,
+                    "exportedAt": "2026-01-01T00:00:00Z",
+                    "files": {
+                        "package/index.js": {
+                            "beforeHash": git_sha256(BEFORE),
+                            "afterHash": git_sha256(AFTER),
+                        },
+                        "package/new.js": {
+                            "beforeHash": "",
+                            "afterHash": git_sha256(CREATED),
+                        }
+                    },
+                    "vulnerabilities": {},
+                    "description": "creates a file",
+                    "license": "MIT",
+                    "tier": "free",
+                }
+            }
+        }))
+        .unwrap(),
+    )
+    .unwrap();
+    pkg
+}
+
+fn seed_cached_diff_archive(root: &Path) {
+    let diffs = root.join(".socket").join("diffs");
+    std::fs::create_dir_all(&diffs).unwrap();
+    std::fs::write(diffs.join(format!("{UUID}.tar.gz")), diff_archive()).unwrap();
+}
+
+async fn mount_blob(mock: &MockServer, content: &'static [u8]) {
+    Mock::given(method("GET"))
+        .and(path(format!(
+            "/v0/orgs/{ORG_SLUG}/patches/blob/{}",
+            git_sha256(content)
+        )))
+        .respond_with(ResponseTemplate::new(200).set_body_bytes(content.to_vec()))
+        .mount(mock)
+        .await;
+}
+
+fn assert_fully_patched(pkg: &Path) {
+    assert_eq!(std::fs::read(pkg.join("index.js")).unwrap(), AFTER);
+    assert_eq!(std::fs::read(pkg.join("new.js")).unwrap(), CREATED);
+}
+
+#[test]
+fn offline_apply_with_only_a_diff_archive_reports_the_created_file_gap() {
+    let tmp = tempfile::tempdir().unwrap();
+    let pkg = seed_project(tmp.path());
+    seed_cached_diff_archive(tmp.path());
+
+    let (code, stdout, stderr) = run_cli(tmp.path(), &["apply", "--offline"], None);
+
+    assert_eq!(code, 1, "stdout={stdout}\nstderr={stderr}");
+    assert_eq!(
+        std::fs::read(pkg.join("index.js")).unwrap(),
+        BEFORE,
+        "a patch that cannot fully apply must not be applied partway"
+    );
+    assert!(!pkg.join("new.js").exists());
+    assert!(
+        stderr.contains("1 patch has no local source and --offline is set:")
+            && stderr.contains(PURL)
+            && stderr.contains("socket-patch repair"),
+        "the offline gate names the patch and the remedy; stderr={stderr}"
+    );
+}
+
+#[tokio::test]
+async fn online_apply_with_a_cached_diff_archive_fetches_the_created_files_blob() {
+    let mock = MockServer::start().await;
+    mount_blob(&mock, CREATED).await;
+
+    let tmp = tempfile::tempdir().unwrap();
+    let pkg = seed_project(tmp.path());
+    seed_cached_diff_archive(tmp.path());
+
+    let (code, stdout, stderr) = run_cli(tmp.path(), &["apply"], Some(&mock.uri()));
+
+    assert_eq!(code, 0, "stdout={stdout}\nstderr={stderr}");
+    assert_fully_patched(&pkg);
+    let requested: Vec<String> = mock
+        .received_requests()
+        .await
+        .unwrap_or_default()
+        .iter()
+        .map(|r| r.url.path().to_string())
+        .collect();
+    assert!(
+        !requested
+            .iter()
+            .any(|p| p.contains("/patches/blob/") && p.ends_with(&git_sha256(AFTER))),
+        "the modified file's blob is not needed: its delta applies; requested={requested:?}"
+    );
+}
+
+#[tokio::test]
+async fn default_repair_downloads_the_created_files_blob_for_offline_apply() {
+    let mock = MockServer::start().await;
+    Mock::given(method("GET"))
+        .and(path(format!("/v0/orgs/{ORG_SLUG}/patches/diff/{UUID}")))
+        .respond_with(ResponseTemplate::new(200).set_body_bytes(diff_archive()))
+        .mount(&mock)
+        .await;
+    mount_blob(&mock, CREATED).await;
+
+    let tmp = tempfile::tempdir().unwrap();
+    let pkg = seed_project(tmp.path());
+
+    let (code, stdout, stderr) = run_cli(tmp.path(), &["repair"], Some(&mock.uri()));
+    assert_eq!(code, 0, "repair: stdout={stdout}\nstderr={stderr}");
+    let blobs = tmp.path().join(".socket").join("blobs");
+    assert!(
+        blobs.join(git_sha256(CREATED)).exists(),
+        "repair must cache the created file's blob; stdout={stdout}\nstderr={stderr}"
+    );
+    assert!(
+        !blobs.join(git_sha256(AFTER)).exists(),
+        "the modified file's delta covers it; its blob is not downloaded"
+    );
+
+    let (code, stdout, stderr) = run_cli(tmp.path(), &["apply", "--offline"], None);
+    assert_eq!(code, 0, "apply: stdout={stdout}\nstderr={stderr}");
+    assert_fully_patched(&pkg);
+}
+
+#[test]
+fn offline_repair_names_the_created_files_missing_blob() {
+    let tmp = tempfile::tempdir().unwrap();
+    seed_project(tmp.path());
+    seed_cached_diff_archive(tmp.path());
+
+    let (code, stdout, stderr) = run_cli(tmp.path(), &["repair", "--offline"], None);
+
+    assert_eq!(code, 0, "stdout={stdout}\nstderr={stderr}");
+    assert!(
+        stdout.contains("All diff archives are present locally."),
+        "stdout={stdout}"
+    );
+    let short: String = git_sha256(CREATED).chars().take(12).collect();
+    assert!(
+        stderr.contains("Warning: 1 blob is missing (offline mode - not downloading):")
+            && stderr.contains(&short),
+        "the created file's blob is still missing; stderr={stderr}"
+    );
+}
+
+#[tokio::test]
+async fn repair_json_reports_the_created_blob_download_once_as_file_mode() {
+    let mock = MockServer::start().await;
+    mount_blob(&mock, CREATED).await;
+    let tmp = tempfile::tempdir().unwrap();
+    seed_project(tmp.path());
+    seed_cached_diff_archive(tmp.path());
+
+    let (code, stdout, stderr) = run_cli(tmp.path(), &["repair", "--json"], Some(&mock.uri()));
+    assert_eq!(code, 0, "stdout={stdout}\nstderr={stderr}");
+    let v: serde_json::Value = serde_json::from_str(stdout.trim()).unwrap();
+    let downloads: Vec<&serde_json::Value> = v["events"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .filter(|e| e["action"] == "downloaded")
+        .collect();
+    assert_eq!(downloads.len(), 1, "{v:#}");
+    assert_eq!(downloads[0]["details"]["mode"], "file", "{v:#}");
+    assert_eq!(downloads[0]["details"]["count"], 1, "{v:#}");
+}
diff --git a/crates/socket-patch-cli/tests/scan_vendor_e2e.rs b/crates/socket-patch-cli/tests/scan_vendor_e2e.rs
index 486b9657..53bc0949 100644
--- a/crates/socket-patch-cli/tests/scan_vendor_e2e.rs
+++ b/crates/socket-patch-cli/tests/scan_vendor_e2e.rs
@@ -1408,6 +1408,143 @@ async fn vendor_auto_fetches_missing_package_from_lockfile() {
     );
 }
 
+/// A lockfile-only npm package the patch service serves prebuilt: the
+/// backend reads the pristine tarball only if the service falls back to a
+/// local build, so the registry download is deferred until then — here,
+/// never — and no `vendor_fetched_missing` is reported for it.
+#[tokio::test]
+async fn vendor_auto_takes_a_missing_package_from_the_service_without_the_registry() {
+    let registry = MockServer::start().await;
+    let tgz = pristine_tgz();
+    let integrity = sri_of(&tgz);
+    mount_registry_tarball(&registry, tgz).await;
+
+    let prebuilt = {
+        let mut builder = tar::Builder::new(flate2::write::GzEncoder::new(
+            Vec::new(),
+            flate2::Compression::default(),
+        ));
+        for (path, bytes) in [
+            (
+                "package/package.json",
+                br#"{"name":"left-pad","version":"1.3.0"}"#.as_slice(),
+            ),
+            ("package/index.js", AFTER),
+        ] {
+            let mut header = tar::Header::new_gnu();
+            header.set_size(bytes.len() as u64);
+            header.set_mode(0o644);
+            header.set_cksum();
+            builder.append_data(&mut header, path, bytes).unwrap();
+        }
+        builder.into_inner().unwrap().finish().unwrap()
+    };
+    let api = MockServer::start().await;
+    let serve_path = format!("/patch/npm/left-pad/1.3.0/tok/{UUID}/left-pad-1.3.0.tgz");
+    let serve_url = format!("{}{serve_path}", api.uri());
+    Mock::given(method("POST"))
+        .and(path("/v0/orgs/acme/patches/package"))
+        .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
+            "results": { UUID: {
+                "status": "granted", "url": serve_url, "purl": PURL,
+                "artifacts": [{ "kind": "tarball", "url": serve_url,
+                                "integrity": { "sha512": sri_of(&prebuilt) } }]
+            }}
+        })))
+        .mount(&api)
+        .await;
+    Mock::given(method("GET"))
+        .and(path(serve_path))
+        .respond_with(ResponseTemplate::new(200).set_body_bytes(prebuilt))
+        .mount(&api)
+        .await;
+
+    let tmp = tempfile::tempdir().unwrap();
+    write_lockfile_only_fixture(
+        tmp.path(),
+        &format!("{}/left-pad/-/left-pad-1.3.0.tgz", registry.uri()),
+        &integrity,
+    );
+    seed_manifest_and_blob(tmp.path());
+    let vendor = |extra: &[&str]| {
+        let mut cmd = Command::new(binary());
+        cmd.args([
+            "vendor",
+            "--json",
+            "--vendor-source",
+            "auto",
+            "--api-url",
+            &api.uri(),
+            "--api-token",
+            "sktsec_placeholder_value_for_tests_api",
+            "--org",
+            "acme",
+        ])
+        .args(extra)
+        .current_dir(tmp.path());
+        for (key, _) in std::env::vars() {
+            if key.starts_with("SOCKET_") && key != "SOCKET_NO_CONFIG" {
+                cmd.env_remove(key);
+            }
+        }
+        let out = cmd.env("SOCKET_TELEMETRY_DISABLED", "1").output().unwrap();
+        let stdout = String::from_utf8_lossy(&out.stdout);
+        let v: serde_json::Value = serde_json::from_str(stdout.trim())
+            .unwrap_or_else(|e| panic!("{e}: {stdout}\n{}", String::from_utf8_lossy(&out.stderr)));
+        (out.status.code(), v)
+    };
+
+    // Offline, nothing is deferred to a service it cannot reach: the
+    // not-installed skip (exit 1, as before), and no request to either
+    // server.
+    let (code, v) = vendor(&["--offline"]);
+    assert_eq!(code, Some(1), "{v:#}");
+    assert!(
+        v["events"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .any(|e| e["purl"] == PURL
+                && e["action"] == "skipped"
+                && e["errorCode"] == "package_not_installed"),
+        "{v:#}"
+    );
+    assert!(registry
+        .received_requests()
+        .await
+        .unwrap_or_default()
+        .is_empty());
+    assert!(api.received_requests().await.unwrap_or_default().is_empty());
+
+    let (code, v) = vendor(&[]);
+    assert_eq!(code, Some(0), "{v:#}");
+    let events = v["events"].as_array().unwrap();
+    assert!(
+        events
+            .iter()
+            .any(|e| e["action"] == "applied" && e["purl"] == PURL),
+        "{v:#}"
+    );
+    assert!(
+        !events
+            .iter()
+            .any(|e| e["errorCode"] == "vendor_fetched_missing"),
+        "no pristine fetch happened, so none is reported: {v:#}"
+    );
+    assert!(
+        registry
+            .received_requests()
+            .await
+            .unwrap_or_default()
+            .is_empty(),
+        "the pristine tarball is never downloaded"
+    );
+    assert!(tmp
+        .path()
+        .join(format!(".socket/vendor/npm/{UUID}/left-pad-1.3.0.tgz"))
+        .is_file());
+}
+
 /// Integrity mismatch between the lock and the served bytes is a distinct
 /// vendor_fetch_failed failure — and nothing is written.
 #[tokio::test]
diff --git a/crates/socket-patch-core/src/api/client.rs b/crates/socket-patch-core/src/api/client.rs
index 5f716c02..cf2677fc 100644
--- a/crates/socket-patch-core/src/api/client.rs
+++ b/crates/socket-patch-core/src/api/client.rs
@@ -332,6 +332,21 @@ fn retry_after_secs(headers: &HeaderMap) -> Option<Duration> {
 /// without a hint).
 type VendorAttemptError = (ApiError, Option<Option<Duration>>);
 
+/// Most UUIDs the package-reference endpoint takes in one request.
+pub(crate) const MAX_REFERENCE_BATCH: usize = 500;
+
+/// Why a pypi reference is refused before its download: the served
+/// artifact is not a wheel.
+pub(crate) const PYPI_NOT_A_WHEEL: &str =
+    "the prebuilt artifact is not a .whl (pypi vendoring is wheel-based)";
+
+/// The last path segment of a serve URL, when it names a `.whl`.
+pub(crate) fn wheel_filename_from_url(url: &str) -> Option<String> {
+    let path = url.split(['?', '#']).next().unwrap_or(url);
+    let name = path.rsplit('/').next().unwrap_or("");
+    name.ends_with(".whl").then(|| name.to_string())
+}
+
 /// Body payload for the batch search POST endpoint.
 #[derive(Serialize)]
 struct BatchSearchBody {
@@ -740,8 +755,9 @@ impl ApiClient {
     /// Resolve hosted-patch references for a set of published-patch UUIDs
     /// (hosted-mode `scan`, the default for a bare `scan`). Uses the authenticated
     /// `POST /v0/orgs/{org}/patches/package` when a token+org are set, else the
-    /// public proxy `POST /patch/package` (free patches only). Returns a
-    /// UUID → reference map (missing/404 → empty).
+    /// public proxy `POST /patch/package` (free patches only), in requests
+    /// of at most [`MAX_REFERENCE_BATCH`] UUIDs (the endpoint rejects more).
+    /// Returns a UUID → reference map (missing/404 → empty).
     ///
     /// Uses the client's configured org slug; see
     /// [`Self::fetch_registry_references_for_org`] for a per-call override.
@@ -765,14 +781,18 @@ impl ApiClient {
             return Ok(std::collections::HashMap::new());
         }
         let path = self.patches_path(org_slug, "package");
-        let body = PackageVendorRequest {
-            uuids: uuids.to_vec(),
-            free_only: None,
-        };
-        let resp = self
-            .post_json::<PackageVendorResponse, _>(&path, &body)
-            .await?;
-        Ok(resp.map(|r| r.results).unwrap_or_default())
+        let mut results = std::collections::HashMap::new();
+        for chunk in uuids.chunks(MAX_REFERENCE_BATCH) {
+            let body = PackageVendorRequest {
+                uuids: chunk.to_vec(),
+                free_only: None,
+            };
+            let resp = self
+                .post_json::<PackageVendorResponse, _>(&path, &body)
+                .await?;
+            results.extend(resp.map(|r| r.results).unwrap_or_default());
+        }
+        Ok(results)
     }
 
     /// Internal: POST the batch search to the public proxy's
@@ -1306,6 +1326,16 @@ impl ApiClient {
             },
             None => download_url.to_string(),
         };
+        // pypi vendoring is wheel-based, so the sdist a qualifier-less pypi
+        // patch is served can never be used: refuse it before downloading.
+        if result
+            .purl
+            .as_deref()
+            .is_some_and(|purl| purl.starts_with("pkg:pypi/"))
+            && wheel_filename_from_url(&download_url).is_none()
+        {
+            return done(VendorServiceOutcome::Unavailable(PYPI_NOT_A_WHEEL.into()));
+        }
 
         // Surface the OTHER served artifacts (e.g. the gem path-source stub
         // gemspec) — their host-rewritten URL + normalized sha512 — so a
@@ -1398,21 +1428,54 @@ impl ApiClient {
 
     /// Step 1 of [`Self::fetch_vendor_package`], retried per the client's
     /// [`VendorRetryPolicy`]. `Err` carries whether the final failure was a
-    /// retryable (availability) one.
+    /// retryable (availability) one. A uuid the attached plan names is
+    /// answered from the plan's one reference batch (see
+    /// [`VendorPrefetch::reference`]).
     async fn request_vendor_package(
         &self,
         uuid: &str,
         free_only: bool,
         vendor_url: Option<&str>,
     ) -> Result<PackageVendorResult, (ApiError, bool)> {
+        let plan = self
+            .vendor_prefetch
+            .lock()
+            .ok()
+            .and_then(|slot| slot.clone());
+        if let Some(plan) = plan {
+            if let Some(result) = plan.reference(self, uuid, free_only, vendor_url).await {
+                return result;
+            }
+        }
+        let mut results = self
+            .request_vendor_references(&[uuid.to_string()], free_only, vendor_url)
+            .await?;
+        results.remove(uuid).ok_or_else(|| {
+            (
+                ApiError::Other(format!("package response missing a result for {uuid}")),
+                false,
+            )
+        })
+    }
+
+    /// One package-reference request for `uuids` (at most
+    /// [`MAX_REFERENCE_BATCH`]), retried per the client's
+    /// [`VendorRetryPolicy`]: the per-uuid results. `Err` carries whether
+    /// the final failure was a retryable (availability) one.
+    pub(crate) async fn request_vendor_references(
+        &self,
+        uuids: &[String],
+        free_only: bool,
+        vendor_url: Option<&str>,
+    ) -> Result<std::collections::HashMap<String, PackageVendorResult>, (ApiError, bool)> {
         let attempts = self.vendor_retry.attempts.max(1);
         let mut attempt = 1;
         loop {
             match self
-                .request_vendor_package_once(uuid, free_only, vendor_url)
+                .request_vendor_references_once(uuids, free_only, vendor_url)
                 .await
             {
-                Ok(result) => return Ok(result),
+                Ok(results) => return Ok(results),
                 Err((e, Some(retry_after))) if attempt < attempts => {
                     debug_log(&format!(
                         "vendor package request attempt {attempt} failed: {e}"
@@ -1425,15 +1488,15 @@ impl ApiClient {
         }
     }
 
-    /// One package-reference POST: the single requested UUID's result.
-    async fn request_vendor_package_once(
+    /// One package-reference POST: the requested UUIDs' results.
+    async fn request_vendor_references_once(
         &self,
-        uuid: &str,
+        uuids: &[String],
         free_only: bool,
         vendor_url: Option<&str>,
-    ) -> Result<PackageVendorResult, VendorAttemptError> {
+    ) -> Result<std::collections::HashMap<String, PackageVendorResult>, VendorAttemptError> {
         let body = PackageVendorRequest {
-            uuids: vec![uuid.to_string()],
+            uuids: uuids.to_vec(),
             // Only send freeOnly when forcing it (the public-proxy contract);
             // the authenticated endpoint defaults to false.
             free_only: free_only.then_some(true),
@@ -1481,12 +1544,7 @@ impl ApiClient {
                     hint,
                 )
             })?;
-            return parsed.results.get(uuid).cloned().ok_or_else(|| {
-                (
-                    ApiError::Other(format!("package response missing a result for {uuid}")),
-                    None,
-                )
-            });
+            return Ok(parsed.results);
         }
         // 429 classifies as RateLimited but is still retried (the hint);
         // 401/403 carry no hint.
@@ -4583,6 +4641,48 @@ mod vendor_package_tests {
         assert_eq!(map[UUID].status, "granted");
     }
 
+    /// The endpoint rejects more than [`MAX_REFERENCE_BATCH`] uuids per
+    /// request (400), so a larger scan goes out in capped chunks whose
+    /// results are merged.
+    #[tokio::test]
+    async fn fetch_registry_references_chunks_at_the_endpoint_cap() {
+        struct EchoGranted;
+        impl wiremock::Respond for EchoGranted {
+            fn respond(&self, request: &Request) -> ResponseTemplate {
+                let body: serde_json::Value = serde_json::from_slice(&request.body).unwrap();
+                let uuids = body["uuids"].as_array().unwrap();
+                if uuids.len() > MAX_REFERENCE_BATCH {
+                    return ResponseTemplate::new(400);
+                }
+                let results: serde_json::Map<String, serde_json::Value> = uuids
+                    .iter()
+                    .map(|u| {
+                        (
+                            u.as_str().unwrap().to_string(),
+                            json!({ "status": "granted", "url": null, "artifacts": [] }),
+                        )
+                    })
+                    .collect();
+                ResponseTemplate::new(200).set_body_json(json!({ "results": results }))
+            }
+        }
+        let server = MockServer::start().await;
+        Mock::given(method("POST"))
+            .and(path("/patch/package"))
+            .respond_with(EchoGranted)
+            .expect(2)
+            .mount(&server)
+            .await;
+        let uuids: Vec<String> = (0..=MAX_REFERENCE_BATCH)
+            .map(|i| format!("{i:08x}-0000-4000-8000-{i:012x}"))
+            .collect();
+        let map = proxy_client(server.uri())
+            .fetch_registry_references(&uuids)
+            .await
+            .expect("chunked resolution succeeds");
+        assert_eq!(map.len(), uuids.len());
+    }
+
     /// The package-reference route honors a per-call org override:
     /// `Some(slug)` beats the client's configured `acme`, and the one-arg
     /// wrapper keeps using `acme`.
diff --git a/crates/socket-patch-core/src/api/vendor_prefetch.rs b/crates/socket-patch-core/src/api/vendor_prefetch.rs
index ff57163c..212fdd29 100644
--- a/crates/socket-patch-core/src/api/vendor_prefetch.rs
+++ b/crates/socket-patch-core/src/api/vendor_prefetch.rs
@@ -86,6 +86,17 @@
 //! download, removed as soon as their package is passed over or the loop
 //! ends) and by the [`crate::vendor::prestage`] pool, not by size.
 //!
+//! The package-reference half is batched: the plan's first call sends
+//! one request naming the planned uuids from its own position on (see
+//! [`VendorPrefetch::reference`]) in place of its own, and later calls
+//! take their granted reference from it. That request grants the rest of
+//! the plan up front, which the plan's exactness makes safe: a position
+//! the loop passes over is granted only if the loop passes it after the
+//! batch was sent. The bounds
+//! above then limit the archive downloads. A package the batch reports
+//! still building, or leaves out, makes its own request at its turn, as
+//! before.
+//!
 //! A planned download may name a secondary artifact (the gem stub
 //! gemspec) its backend fetches right after a verified archive; the task
 //! fetches it along with the archive, under the backend's own conditions,
@@ -107,8 +118,10 @@ use futures_util::StreamExt;
 
 use super::client::{
     hold_back_debug, ApiClient, HeldBack, PlannedDownload, PrefetchedSecondary,
-    VendorServiceOutcome, VENDOR_BREAKER_THRESHOLD,
+    VendorServiceOutcome, MAX_REFERENCE_BATCH, VENDOR_BREAKER_THRESHOLD,
 };
+use super::types::PackageVendorResult;
+use crate::api::client::ApiError;
 use crate::vendor::lock_inventory::LockIntegrity;
 use crate::vendor::prestage::PrestageRecipe;
 use crate::vendor::registry_fetch::{artifact_matches_integrity, verify_go_h1};
@@ -153,6 +166,9 @@ pub(crate) struct VendorPrefetch {
     /// What the task is allowed to request, shared with it.
     look: Arc<Lookahead>,
     state: tokio::sync::Mutex<PrefetchState>,
+    /// The plan's package references, resolved in one batch by the first
+    /// planned call (see [`Self::reference`]) and taken uuid by uuid.
+    references: tokio::sync::OnceCell<std::sync::Mutex<HashMap<String, PackageVendorResult>>>,
 }
 
 /// The window of plan positions the task may request: `[at, at + reach)`,
@@ -354,9 +370,86 @@ impl VendorPrefetch {
             window: window.max(1),
             look: Arc::new(Lookahead::new(byte_budget)),
             state: tokio::sync::Mutex::new(PrefetchState::default()),
+            references: tokio::sync::OnceCell::new(),
         }
     }
 
+    /// Step 1 (the package-reference request) for a planned `uuid`, or
+    /// `None` to make the live request (not planned, other parameters, or
+    /// the batch did not answer it).
+    ///
+    /// The first planned call sends ONE request naming the plan from its
+    /// own position on, its own uuid first, in place of its single-uuid request and with the
+    /// same retry ladder: the endpoint takes up to [`MAX_REFERENCE_BATCH`]
+    /// uuids, and one request per package paid a round trip and a quota
+    /// unit each. Its failure is that call's own failure, so an outage
+    /// costs what the serial loop paid, and every later call makes its
+    /// live request. A package still building (`pending_build`) is asked
+    /// again at its own turn, as the serial loop did, since it may be
+    /// ready by then; every other answer is final and is reused.
+    pub(crate) async fn reference(
+        &self,
+        client: &ApiClient,
+        uuid: &str,
+        free_only: bool,
+        vendor_url: Option<&str>,
+    ) -> Option<Result<PackageVendorResult, (ApiError, bool)>> {
+        if free_only != self.free_only || vendor_url != self.vendor_url.as_deref() {
+            return None;
+        }
+        let at = self.planned.iter().position(|planned| planned == uuid)?;
+        let mut own = None;
+        let cache = self
+            .references
+            .get_or_init(|| async {
+                // Positions before this call's were passed over: the loop
+                // never asks for them, so they are never granted.
+                let mut order = vec![uuid.to_string()];
+                for planned in &self.planned[at..] {
+                    if !order.contains(planned) {
+                        order.push(planned.clone());
+                    }
+                }
+                let mut kept = HashMap::new();
+                for (i, chunk) in order.chunks(MAX_REFERENCE_BATCH).enumerate() {
+                    match client
+                        .request_vendor_references(chunk, free_only, vendor_url)
+                        .await
+                    {
+                        Ok(mut results) => {
+                            if i == 0 {
+                                own = Some(results.remove(uuid).ok_or_else(|| {
+                                    (
+                                        ApiError::Other(format!(
+                                            "package response missing a result for {uuid}"
+                                        )),
+                                        false,
+                                    )
+                                }));
+                            }
+                            kept.extend(
+                                results
+                                    .into_iter()
+                                    .filter(|(_, r)| r.status != "pending_build"),
+                            );
+                        }
+                        Err(e) if i == 0 => {
+                            own = Some(Err(e));
+                            break;
+                        }
+                        // The chunk's uuids make their live requests.
+                        Err(_) => break,
+                    }
+                }
+                std::sync::Mutex::new(kept)
+            })
+            .await;
+        if own.is_some() {
+            return own;
+        }
+        cache.lock().ok()?.remove(uuid).map(Ok)
+    }
+
     /// The prefetched outcome of the loop's call for `uuid`, or `None` to
     /// make the live requests. Plan positions before `uuid`'s are passed
     /// over (their outcomes discarded unreleased).
@@ -1353,4 +1446,201 @@ mod tests {
         planned_requests.sort();
         assert_eq!(planned_requests, serial_requests);
     }
+
+    /// A service that answers every uuid a package-reference request names,
+    /// as the real endpoint does: the request's first uuid decides a
+    /// whole-request failure (503 / 403), and the others it cannot grant
+    /// are left out of the results.
+    struct BatchService {
+        base: String,
+        scripts: HashMap<String, Script>,
+    }
+
+    impl wiremock::Respond for BatchService {
+        fn respond(&self, request: &wiremock::Request) -> ResponseTemplate {
+            let body: serde_json::Value = serde_json::from_slice(&request.body).unwrap();
+            let uuids: Vec<String> = body["uuids"]
+                .as_array()
+                .unwrap()
+                .iter()
+                .map(|u| u.as_str().unwrap().to_string())
+                .collect();
+            match self.scripts.get(&uuids[0]) {
+                Some(Script::Down) => return ResponseTemplate::new(503),
+                Some(Script::Forbidden) => return ResponseTemplate::new(403),
+                _ => {}
+            }
+            let mut results = serde_json::Map::new();
+            for u in uuids {
+                let status = match self.scripts.get(&u) {
+                    Some(Script::Granted(_)) => "granted",
+                    Some(Script::Pending) => "pending_build",
+                    Some(Script::NotFound) => "not_found",
+                    _ => continue,
+                };
+                let url = format!("{}/serve/{u}.tgz", self.base);
+                let sri = format!(
+                    "sha512-{}",
+                    base64::engine::general_purpose::STANDARD.encode(Sha512::digest(u.as_bytes()))
+                );
+                let artifacts = if status == "granted" {
+                    serde_json::json!([{ "kind": "tarball", "url": url,
+                                         "integrity": { "sha512": sri } }])
+                } else {
+                    serde_json::json!([])
+                };
+                results.insert(
+                    u.clone(),
+                    serde_json::json!({ "status": status, "url": url, "artifacts": artifacts }),
+                );
+            }
+            ResponseTemplate::new(200).set_body_json(serde_json::json!({ "results": results }))
+        }
+    }
+
+    async fn serve_batches(scripts: &[Script]) -> MockServer {
+        let server = MockServer::start().await;
+        Mock::given(method("POST"))
+            .and(path(POST_PATH))
+            .respond_with(BatchService {
+                base: server.uri(),
+                scripts: scripts
+                    .iter()
+                    .enumerate()
+                    .map(|(i, s)| (uuid(i), *s))
+                    .collect(),
+            })
+            .mount(&server)
+            .await;
+        for i in 0..scripts.len() {
+            let u = uuid(i);
+            Mock::given(method("GET"))
+                .and(path(format!("/serve/{u}.tgz")))
+                .respond_with(ResponseTemplate::new(200).set_body_bytes(u.into_bytes()))
+                .mount(&server)
+                .await;
+        }
+        server
+    }
+
+    /// The `(POSTs, GETs)` the server has seen.
+    async fn request_counts(server: &MockServer) -> (usize, usize) {
+        let log = request_log(server).await;
+        let posts = log.iter().filter(|r| r.starts_with("POST")).count();
+        (posts, log.len() - posts)
+    }
+
+    /// One package-reference request resolves the whole plan: the serial
+    /// loop's outcomes, one POST instead of one per package, and the same
+    /// downloads.
+    #[tokio::test]
+    async fn one_reference_request_serves_the_whole_plan() {
+        let scripts: Vec<Script> = (0..6).map(|_| Script::Granted(0)).collect();
+        let all: Vec<usize> = (0..scripts.len()).collect();
+        let server = serve_batches(&scripts).await;
+        let serial = run(&server, None, &all).await;
+        assert_eq!(request_counts(&server).await, (6, 6));
+        assert_eq!(run(&server, Some(&all), &all).await, serial);
+        assert_eq!(request_counts(&server).await, (6 + 1, 6 + 6));
+    }
+
+    /// The batch replaces the first package's own request, so a service
+    /// that is down costs the same ladders, outcomes and breaker count as
+    /// the serial loop.
+    #[tokio::test]
+    async fn a_failed_reference_batch_costs_what_the_serial_loop_paid() {
+        let scripts: Vec<Script> = (0..8).map(|_| Script::Down).collect();
+        let all: Vec<usize> = (0..scripts.len()).collect();
+        let server = serve_batches(&scripts).await;
+        let serial = run(&server, None, &all).await;
+        let (serial_posts, serial_gets) = request_counts(&server).await;
+        assert_eq!(run(&server, Some(&all), &all).await, serial);
+        assert_eq!(
+            request_counts(&server).await,
+            (2 * serial_posts, 2 * serial_gets)
+        );
+    }
+
+    /// Final answers are reused: a package still building is asked again
+    /// at its own turn, as the serial loop did, and one the batch left out
+    /// makes its live request.
+    #[tokio::test]
+    async fn a_building_package_is_asked_again_at_its_turn() {
+        use Script::*;
+        let scripts = [Granted(0), Pending, Granted(0), NotFound, Down, Granted(0)];
+        let all: Vec<usize> = (0..scripts.len()).collect();
+        let server = serve_batches(&scripts).await;
+        let serial = run(&server, None, &all).await;
+        let (serial_posts, _) = request_counts(&server).await;
+        assert_eq!(run(&server, Some(&all), &all).await, serial);
+        let (posts, _) = request_counts(&server).await;
+        // The down package's three attempts, one retry-policy ladder.
+        let down_ladder = 3;
+        assert_eq!(serial_posts, 5 + down_ladder);
+        assert_eq!(
+            posts - serial_posts,
+            1 + 1 + down_ladder,
+            "the batch, then the pending and the down package live"
+        );
+    }
+
+    /// Plans past the endpoint's cap go out in requests of at most
+    /// [`MAX_REFERENCE_BATCH`] uuids.
+    #[tokio::test]
+    async fn a_plan_past_the_cap_is_resolved_in_capped_requests() {
+        let n = MAX_REFERENCE_BATCH + 1;
+        let scripts: Vec<Script> = (0..n).map(|_| Script::Granted(0)).collect();
+        let server = serve_batches(&scripts).await;
+        let c = client(&server.uri());
+        let _guard = c.prefetch_vendor_packages((0..n).map(uuid).collect(), false, None, None, 1);
+        for i in [0, n - 1] {
+            assert!(
+                summary(&c.fetch_vendor_package(&uuid(i), false, None, None).await)
+                    .starts_with("ready")
+            );
+        }
+        let sizes: Vec<usize> = server
+            .received_requests()
+            .await
+            .unwrap()
+            .iter()
+            .filter(|r| r.method == wiremock::http::Method::POST)
+            .map(|r| {
+                let body: serde_json::Value = serde_json::from_slice(&r.body).unwrap();
+                body["uuids"].as_array().unwrap().len()
+            })
+            .collect();
+        assert_eq!(sizes, [MAX_REFERENCE_BATCH, 1]);
+    }
+
+    /// The batch names the plan from the first call's position on: a
+    /// position the loop passed over before it is never granted.
+    #[tokio::test]
+    async fn the_reference_batch_starts_at_the_first_call() {
+        let scripts: Vec<Script> = (0..4).map(|_| Script::Granted(0)).collect();
+        let server = serve_batches(&scripts).await;
+        let c = client(&server.uri());
+        let _guard = c.prefetch_vendor_packages((0..4).map(uuid).collect(), false, None, None, 1);
+        assert!(
+            summary(&c.fetch_vendor_package(&uuid(2), false, None, None).await)
+                .starts_with("ready")
+        );
+        let bodies: Vec<Vec<String>> = server
+            .received_requests()
+            .await
+            .unwrap()
+            .iter()
+            .filter(|r| r.method == wiremock::http::Method::POST)
+            .map(|r| {
+                let body: serde_json::Value = serde_json::from_slice(&r.body).unwrap();
+                body["uuids"]
+                    .as_array()
+                    .unwrap()
+                    .iter()
+                    .map(|u| u.as_str().unwrap().to_string())
+                    .collect()
+            })
+            .collect();
+        assert_eq!(bodies, [vec![uuid(2), uuid(3)]]);
+    }
 }
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/npm.rs b/crates/socket-patch-core/src/vendor/lock_inventory/npm.rs
index 0353ec3c..af514bd5 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/npm.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/npm.rs
@@ -138,16 +138,18 @@ pub(super) async fn inventory_package_lock_in(
         {
             continue;
         }
-        let integrity = node
-            .integrity
-            .map(|i| LockIntegrity::Sri(i.to_string()))
-            .unwrap_or(LockIntegrity::None);
-        out.push(LockfileEntry::npm(
-            node.name,
-            version,
-            node.resolved.and_then(http_url),
-            integrity,
-        ));
+        // A non-registry resolution (`file:`, `git+…`) records the integrity
+        // of an artifact no registry serves: nothing a registry fetch could
+        // verify against.
+        let resolved = node.resolved.and_then(http_url);
+        let integrity = match (&resolved, node.resolved) {
+            (None, Some(_)) => LockIntegrity::None,
+            _ => node
+                .integrity
+                .map(|i| LockIntegrity::Sri(i.to_string()))
+                .unwrap_or(LockIntegrity::None),
+        };
+        out.push(LockfileEntry::npm(node.name, version, resolved, integrity));
     }
     Some(out)
 }
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/tests.rs b/crates/socket-patch-core/src/vendor/lock_inventory/tests.rs
index 5d0a45f5..b7dc6040 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/tests.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/tests.rs
@@ -39,6 +39,11 @@ const PACKAGE_LOCK: &str = r#"{
       "version": "0.5.0",
       "resolved": "git+ssh://git@github.com/x/git-dep.git#abc"
     },
+    "node_modules/local-tarball": {
+      "version": "1.0.0",
+      "resolved": "file:vendor/local-tarball-1.0.0.tgz",
+      "integrity": "sha512-local=="
+    },
     "node_modules/vendored": {
       "version": "3.0.0",
       "resolved": "file:.socket/vendor/npm/9f6b2c4e-1d3a-4f6b-8c2d-7e5a9b1c3d5f/vendored-3.0.0.tgz",
@@ -80,6 +85,11 @@ async fn package_lock_inventories_registry_entries() {
     let git = entry(&entries, "git-dep");
     assert_eq!(git.resolved, None);
     assert_eq!(git.integrity, LockIntegrity::None);
+    // Nor does a local tarball: its integrity is of bytes no registry
+    // serves, so no registry fetch may be verified against it.
+    let local = entry(&entries, "local-tarball");
+    assert_eq!(local.resolved, None);
+    assert_eq!(local.integrity, LockIntegrity::None);
 
     // Workspace members, links, bundled deps, our vendored spec, the
     // unsafe-version entry, and the version-less node are all absent.
@@ -876,6 +886,69 @@ async fn yarn_classic_blocks_yield_resolved_sha1_and_integrity() {
     assert_eq!(entry(&entries, "@scope/pkg").version, "2.0.0");
 }
 
+/// A git resolution's `#<commit>` fragment is not a tarball sha1: the
+/// entry carries no integrity, so no registry fetch (or fetch deferred
+/// behind the patch service) treats it as a verifiable registry package.
+#[tokio::test]
+async fn yarn_classic_git_resolution_fragment_is_not_an_integrity() {
+    let tmp = tempfile::tempdir().unwrap();
+    write(
+        tmp.path(),
+        "yarn.lock",
+        "# yarn lockfile v1\n\n\
+         \"from-git@git+https://github.com/o/from-git.git\":\n\
+         \x20 version \"1.0.0\"\n\
+         \x20 resolved \"git+https://github.com/o/from-git.git#0123456789abcdef0123456789abcdef01234567\"\n",
+    )
+    .await;
+    let (_, entries) = inventory_npm_lock(tmp.path()).await.unwrap().unwrap();
+    let e = entry(&entries, "from-git");
+    assert_eq!(e.resolved, None);
+    assert_eq!(e.integrity, LockIntegrity::None);
+}
+
+/// The same holds for a git repository reached over plain https (a
+/// `.git` URL or a codeload tarball), and an `integrity` field on such a
+/// block is not a registry integrity either; a registry tarball keeps
+/// both.
+#[tokio::test]
+async fn yarn_classic_https_git_resolutions_carry_no_integrity() {
+    let tmp = tempfile::tempdir().unwrap();
+    write(
+        tmp.path(),
+        "yarn.lock",
+        "# yarn lockfile v1\n\n\
+         \"https-git@https://github.com/o/https-git.git\":\n\
+         \x20 version \"1.0.0\"\n\
+         \x20 resolved \"https://github.com/o/https-git.git#0123456789abcdef0123456789abcdef01234567\"\n\
+         \x20 integrity sha512-fromgit==\n\n\
+         \"codeload@o/codeload\":\n\
+         \x20 version \"2.0.0\"\n\
+         \x20 resolved \"https://codeload.github.com/o/codeload/tar.gz/0123456789abcdef0123456789abcdef01234567\"\n\
+         \x20 integrity sha512-codeload==\n\n\
+         registry-pkg@^3.0.0:\n\
+         \x20 version \"3.0.0\"\n\
+         \x20 resolved \"https://registry.yarnpkg.com/registry-pkg/-/registry-pkg-3.0.0.tgz#dddddddddddddddddddddddddddddddddddddddd\"\n\
+         \x20 integrity sha512-registry==\n",
+    )
+    .await;
+    let (_, entries) = inventory_npm_lock(tmp.path()).await.unwrap().unwrap();
+    for name in ["https-git", "codeload"] {
+        let e = entry(&entries, name);
+        assert_eq!(e.resolved, None, "{name}");
+        assert_eq!(e.integrity, LockIntegrity::None, "{name}");
+    }
+    let registry = entry(&entries, "registry-pkg");
+    assert_eq!(
+        registry.resolved.as_deref(),
+        Some("https://registry.yarnpkg.com/registry-pkg/-/registry-pkg-3.0.0.tgz")
+    );
+    assert_eq!(
+        registry.integrity,
+        LockIntegrity::Sri("sha512-registry==".into())
+    );
+}
+
 // ── yarn berry ────────────────────────────────────────────────────────
 
 const YARN_BERRY: &str = "# This file is generated by running \"yarn install\" inside your project.
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/yarn.rs b/crates/socket-patch-core/src/vendor/lock_inventory/yarn.rs
index 91b48921..7f2ccc2b 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/yarn.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/yarn.rs
@@ -138,15 +138,23 @@ fn classic_registry_view(text: &str) -> Vec<LockfileEntry> {
         let Some(version) = classic_field(&block.lines, "version") else {
             continue;
         };
-        // `resolved "url#sha1hex"` — the fragment is the legacy verifier.
-        let (resolved, sha1_hex) = match classic_field(&block.lines, "resolved") {
+        // `resolved "url#sha1hex"` — the fragment is the legacy verifier of
+        // a registry tarball. A non-registry resolution (a git repository,
+        // over any protocol, or a local file) records hashes of an artifact
+        // no registry serves — a git fragment is a commit id — so neither it
+        // nor an `integrity` field verifies a registry fetch.
+        let (resolved, sha1_hex, registry) = match classic_field(&block.lines, "resolved") {
             Some(raw) => {
                 let (url, sha1) = split_resolved_sha1(raw);
-                (http_url(url), sha1)
+                match http_url(url).filter(|u| !is_git_resolution(raw, u)) {
+                    Some(url) => (Some(url), sha1, true),
+                    None => (None, None, false),
+                }
             }
-            None => (None, None),
+            None => (None, None, true),
         };
         let integrity = classic_field(&block.lines, "integrity")
+            .filter(|_| registry)
             .map(|i| LockIntegrity::Sri(i.to_string()))
             .or(sha1_hex.map(LockIntegrity::Sha1Hex))
             .unwrap_or(LockIntegrity::None);
@@ -155,6 +163,18 @@ fn classic_registry_view(text: &str) -> Vec<LockfileEntry> {
     out
 }
 
+/// Whether a classic `resolved` value names a git repository rather than a
+/// registry tarball: a `git+`/`git:`/`github:`/`ssh:` spec, an http(s) URL
+/// of a `.git` repository, or a GitHub codeload tarball of a commit.
+fn is_git_resolution(raw: &str, url: &str) -> bool {
+    let path = url.split(['?', '#']).next().unwrap_or(url);
+    ["git+", "git:", "github:", "ssh:"]
+        .iter()
+        .any(|p| raw.starts_with(p))
+        || path.ends_with(".git")
+        || path.contains("://codeload.github.com/")
+}
+
 #[cfg(test)]
 pub(super) async fn inventory_yarn_berry(root: &Path) -> Option<Vec<LockfileEntry>> {
     inventory_yarn_berry_in(&ProjectView::Disk(root)).await
diff --git a/crates/socket-patch-core/src/vendor/pypi.rs b/crates/socket-patch-core/src/vendor/pypi.rs
index 2492d1e2..f95d46ee 100644
--- a/crates/socket-patch-core/src/vendor/pypi.rs
+++ b/crates/socket-patch-core/src/vendor/pypi.rs
@@ -11,7 +11,7 @@ use std::sync::Arc;
 
 use sha2::{Digest as _, Sha256};
 
-use crate::api::client::{ApiClient, DeferredAttempt};
+use crate::api::client::{wheel_filename_from_url, ApiClient, DeferredAttempt, PYPI_NOT_A_WHEEL};
 use crate::constants::SOCKET_DIR;
 use crate::crawlers::python_crawler::canonicalize_pypi_name;
 use crate::manifest::schema::PatchRecord;
@@ -1921,8 +1921,7 @@ async fn try_pypi_service_wheel(
                 return miss(
                     warnings,
                     "vendor_prebuilt_unavailable",
-                    "the prebuilt artifact is not a .whl (pypi vendoring is wheel-based)"
-                        .to_string(),
+                    PYPI_NOT_A_WHEEL.to_string(),
                 );
             };
             // The SRI proves only that the transfer is intact. A wheel's
@@ -2017,6 +2016,10 @@ async fn try_pypi_service_wheel(
             "vendor_prebuilt_pending",
             "prebuilt wheel is still building".to_string(),
         ),
+        // The client refused a non-wheel before downloading it.
+        ServiceArtifact::Unavailable(reason) if reason == PYPI_NOT_A_WHEEL => {
+            miss(warnings, "vendor_prebuilt_unavailable", reason)
+        }
         // Quiet under `auto` (the common "not built / free-only" case).
         ServiceArtifact::Unavailable(reason) => {
             if cfg.source.requires_service() {
@@ -2036,13 +2039,6 @@ async fn try_pypi_service_wheel(
     }
 }
 
-/// The last path segment of a serve URL, when it names a `.whl`.
-fn wheel_filename_from_url(url: &str) -> Option<String> {
-    let path = url.split(['?', '#']).next().unwrap_or(url);
-    let name = path.rsplit('/').next().unwrap_or("");
-    name.ends_with(".whl").then(|| name.to_string())
-}
-
 /// Derive `(platform_locked, display)` from a wheel filename's trailing tag
 /// triple (`{name}-{ver}(-{build})?-{py}-{abi}-{plat}.whl`). Advisory only —
 /// the local-build path reads the same from the dist's WHEEL metadata.
@@ -3232,6 +3228,21 @@ wheels = [
         let wheel_rel = format!(".socket/vendor/pypi/{UUID}/{WHEEL_NAME}");
         assert_eq!(entry.artifact.path, wheel_rel);
         assert!(fx.root.join(&wheel_rel).exists());
+        assert_sdist_never_downloaded(&server).await;
+    }
+
+    /// The served sdist is refused from its reference alone: its bytes are
+    /// never requested.
+    async fn assert_sdist_never_downloaded(server: &wiremock::MockServer) {
+        let requests = server.received_requests().await.unwrap();
+        assert!(
+            requests.iter().all(|r| r.method != wiremock::http::Method::GET),
+            "the sdist must not be downloaded: {:?}",
+            requests
+                .iter()
+                .map(|r| format!("{} {}", r.method, r.url.path()))
+                .collect::<Vec<_>>()
+        );
     }
 
     /// `service` mode + an sdist (non-wheel) artifact hard-fails.
@@ -3264,6 +3275,7 @@ wheels = [
             matches!(outcome, VendorOutcome::Refused { .. }),
             "service mode must refuse a non-wheel artifact, got {outcome:?}"
         );
+        assert_sdist_never_downloaded(&server).await;
     }
 
     /// `service` mode + an integrity mismatch hard-fails (nothing written).
diff --git a/crates/socket-patch-core/src/vendor/registry_fetch.rs b/crates/socket-patch-core/src/vendor/registry_fetch.rs
index ddf5de82..f7d833c0 100644
--- a/crates/socket-patch-core/src/vendor/registry_fetch.rs
+++ b/crates/socket-patch-core/src/vendor/registry_fetch.rs
@@ -279,6 +279,42 @@ pub fn staged_leaf_for_purl(purl: &str) -> String {
     }
 }
 
+/// Why [`fetch_and_stage`] refuses `entry` as unverifiable before any
+/// request, decided from the entry (and go's proxy settings) alone. Covers
+/// the npm, cargo, golang and composer fetchers completely; the gem and
+/// pypi fetchers raise further refusals only their downloads can decide.
+pub fn refusal_before_download(entry: &LockfileEntry) -> Option<String> {
+    if entry.integrity == LockIntegrity::None {
+        return Some(format!(
+            "the lockfile records no integrity hash for {}@{}; refusing to fetch \
+             unverifiable content",
+            entry.name, entry.version
+        ));
+    }
+    match entry.ecosystem {
+        "npm" => match &entry.integrity {
+            LockIntegrity::BerryChecksum(expected) if !expected.starts_with("10c0/") => {
+                Some(format!(
+                    "yarn berry checksum `{expected}` uses a cacheKey other than 10c0; \
+                     the cache-zip recipe is not reproducible for it"
+                ))
+            }
+            _ => None,
+        },
+        "golang" => match (&entry.integrity, &entry.resolved) {
+            (LockIntegrity::GoH1(_), Some(_)) => None,
+            (LockIntegrity::GoH1(_), None) => goproxy_base(&entry.name).err(),
+            _ => Some("go module entries verify via the go.sum h1 dirhash only".to_string()),
+        },
+        "composer" if entry.resolved.is_none() => Some(format!(
+            "composer.lock records no dist URL for {}@{}",
+            entry.name, entry.version
+        )),
+        "cargo" | "composer" | "gem" | "pypi" => None,
+        other => Some(format!("no registry fetcher for ecosystem `{other}`")),
+    }
+}
+
 /// Fetch + verify + extract one lockfile entry. Ecosystems without a
 /// fetcher yet return [`FetchError::Unverifiable`] (callers keep their
 /// not-installed outcome).
@@ -286,12 +322,8 @@ pub async fn fetch_and_stage(
     entry: &LockfileEntry,
     client: &reqwest::Client,
 ) -> Result<FetchedPackage, FetchError> {
-    if entry.integrity == LockIntegrity::None {
-        return Err(FetchError::Unverifiable(format!(
-            "the lockfile records no integrity hash for {}@{}; refusing to fetch \
-             unverifiable content",
-            entry.name, entry.version
-        )));
+    if let Some(reason) = refusal_before_download(entry) {
+        return Err(FetchError::Unverifiable(reason));
     }
     match entry.ecosystem {
         "npm" => fetch_npm(entry, client).await,
@@ -3749,6 +3781,71 @@ mod tests {
         assert!(fetched.dir().await.unwrap().join("go.mod").is_file());
     }
 
+    /// The pre-download refusals the vendor loop's service deferral mirrors
+    /// are exactly the ones `fetch_and_stage` raises before any request.
+    #[tokio::test]
+    #[serial_test::serial]
+    async fn refusal_before_download_matches_the_fetchers_first_refusals() {
+        let entry = |ecosystem: &'static str, resolved: Option<&str>, integrity: LockIntegrity| {
+            LockfileEntry {
+                ecosystem,
+                name: "example.com/mod".into(),
+                version: "1.0.0".into(),
+                purl: format!("pkg:{ecosystem}/example.com/mod@1.0.0"),
+                resolved: resolved.map(str::to_string),
+                integrity,
+                source_kind: SourceKind::Unspecified,
+            }
+        };
+        let saved = std::env::var("GOPROXY").ok();
+        std::env::set_var("GOPROXY", "off");
+        let refused = [
+            entry("npm", None, LockIntegrity::None),
+            entry(
+                "npm",
+                Some("http://127.0.0.1:1/x.tgz"),
+                LockIntegrity::BerryChecksum("8/abc".into()),
+            ),
+            entry("golang", None, LockIntegrity::GoH1("h1:AAAA".into())),
+            entry("golang", None, LockIntegrity::Sri("sha512-AAAA".into())),
+            entry("composer", None, LockIntegrity::Sha1Hex("aa".into())),
+            entry("nuget", Some("http://127.0.0.1:1/x"), LockIntegrity::Sri("x".into())),
+        ];
+        for e in &refused {
+            let reason = refusal_before_download(e).expect("refused");
+            match fetch_and_stage(e, &build_registry_client()).await {
+                Err(FetchError::Unverifiable(d)) => assert_eq!(d, reason),
+                other => panic!("{e:?}: {:?}", other.err()),
+            }
+        }
+        match saved {
+            Some(v) => std::env::set_var("GOPROXY", v),
+            None => std::env::remove_var("GOPROXY"),
+        }
+        let fetchable = [
+            entry("npm", Some("http://127.0.0.1:1/x.tgz"), LockIntegrity::Sri("x".into())),
+            entry(
+                "npm",
+                Some("http://127.0.0.1:1/x.tgz"),
+                LockIntegrity::BerryChecksum("10c0/abc".into()),
+            ),
+            entry("cargo", None, LockIntegrity::Sha256Hex("aa".into())),
+            entry(
+                "golang",
+                Some("http://127.0.0.1:1/x.zip"),
+                LockIntegrity::GoH1("h1:AAAA".into()),
+            ),
+            entry(
+                "composer",
+                Some("http://127.0.0.1:1/x.zip"),
+                LockIntegrity::Sha1Hex("aa".into()),
+            ),
+        ];
+        for e in &fetchable {
+            assert_eq!(refusal_before_download(e), None, "{e:?}");
+        }
+    }
+
     /// go never sends a module path to a proxy when GOPROXY starts with
     /// `off` / `direct`, or when the module matches GONOPROXY (defaulting to
     /// GOPRIVATE). The pristine fetch must not either: it refuses before any

From 1e3ace6580af6c0477222cb4b4b67bd2741c3556 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Tue, 29 Sep 2026 09:19:10 +0200
Subject: [PATCH 25/32] v5: remove dead code and v3 compatibility shims (#296)

* Share one hosted-URL check for pdm and poetry

The pdm and poetry lockfile rewriters each carried an identical copy of
the rule that decides whether an existing pin is an earlier hosted
redirect of the same artifact. They now use one copy in python_lock, so
the two rewriters cannot drift apart. No behavior change.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018JsczaHn8e6YrCpxs1NznQ

* Remove the never-implemented --one-off flag

`get --one-off` and `rollback --one-off` (and SOCKET_ONE_OFF) never
did anything: they only failed with a "not yet implemented" usage
error. v5.0 drops them. Passing `--one-off` is now an ordinary
unknown-flag error (still exit 2), and SOCKET_ONE_OFF is ignored.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Drop blanket dead-code allow on vlt lock parser

The whole vlt lockfile text module was exempt from dead-code checks,
which hid an unused edge-rendering method. The exemption is gone, the
unused method is deleted, and the macOS-only global node_modules
helper now opts out of the lint only on builds where it is truly
unused. No behavior change for vlt users.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Stop reading never-written package archives

Nothing has written `.socket/packages/<uuid>.tar.gz` for several
releases, yet apply, vendor and repair still probed and overlaid that
directory and the patch pipeline tried it before the diff archive.
v5.0 drops the read path and the `appliedVia: "package"` JSON value.
The GC sweeps (scan --prune, rollback, remove, repair) now remove
any leftover `.socket/packages/` files whole, so old projects are
cleaned up; the `removedPackageArchives` counter keeps reporting them.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Drop v3 env names and legacy scan spellings

v5.0 removes compatibility surface kept since v3/v4:
- The legacy env names SOCKET_PATCH_PROXY_URL, SOCKET_PATCH_DEBUG and
  SOCKET_PATCH_TELEMETRY_DISABLED are no longer read (use SOCKET_*).
- The hidden `scan --redirect` flag (use `--mode hosted`) and the
  hidden no-op `scan --detached` flag are gone; both are now unknown
  flags (exit 2).
- The hidden `--mode` values `host`, `redirect` and `vendor` (scan
  and get) are rejected; only hosted, vendored and agent remain.
The hidden `scan --apply` and `scan --vendor` spellings stay.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Delete uncalled public helpers in core vendor code

Several public functions in the core crate had no callers anywhere in
the workspace: the bun workspace artifact snapshot, the vlt lock sniff
wrapper, the in-memory project's binary/symlink/path helpers, and the
disk snapshot's invalidate, sync text read and disk-root accessors.
They are removed. The in-memory project's text/present/entries helpers
that only tests use are now test-only. No user-visible behavior change.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Drop the never-read berry zip URL from hosted

The hosted engine copied the yarn-berry cache-zip URL into every
redirect entry, but no rewriter ever read it: berry pins only the
zip's checksum, which is still taken from the patch reference. The
field is gone from DepOverride; references that still send it parse
as before.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Note the v5 dead-code removals in the changelog

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Share one service fallback policy across backends

Every service-backed vendor backend (npm tarball and directory, pypi,
cargo, composer, golang, gem, and the frozen maven/nuget path) decided
on its own when a patch-service miss falls back to a local build, when
`--vendor-source=service` refuses, and when tampered bytes are fatal.
Seven hand-copied versions of that policy could drift apart.

The policy now lives once in service_fetch.rs: ServicePolicy maps the
Pending, Unavailable, Failed and IntegrityMismatch outcomes, and each
backend keeps only its own handling of a ready artifact. Warnings,
refusal codes, messages and check order are unchanged, including the
npm tarball backend's wording for a failed request in service mode.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Align tests and docs with package-archive removal

Three integration tests still expected a leftover package archive to
be a patch source or to survive GC; they now pin the v5.0 rule (not a
source, always swept). Also: a rollback --one-off rejection test, test
names that no longer mention the removed --detached flag, a dead
berryZipUrl branch in the hosted memory harness, and contract rows
that still listed `--download-mode package`.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>
---
 CHANGELOG.md                                  |  40 +-
 README.md                                     |   7 +-
 crates/socket-patch-cli/CLI_CONTRACT.md       |  48 ++-
 crates/socket-patch-cli/src/args.rs           |  18 +-
 crates/socket-patch-cli/src/commands/apply.rs |   4 +-
 .../src/commands/bun_preflight.rs             |   4 +-
 .../src/commands/fetch_stage.rs               |  75 ++--
 crates/socket-patch-cli/src/commands/get.rs   |  66 +---
 .../socket-patch-cli/src/commands/remove.rs   |   5 +-
 .../socket-patch-cli/src/commands/repair.rs   |  35 +-
 .../socket-patch-cli/src/commands/rollback.rs |  56 +--
 .../src/commands/scan/hosted.rs               |   3 +-
 .../src/commands/scan/hosted/vlt.rs           |   1 -
 .../socket-patch-cli/src/commands/scan/mod.rs |  61 +---
 .../src/commands/scan/vendor_flow.rs          |   3 +-
 .../socket-patch-cli/src/commands/vendor.rs   |   3 -
 .../src/commands/vendored_backend/repair.rs   |   1 -
 crates/socket-patch-cli/src/json_envelope.rs  |   2 -
 crates/socket-patch-cli/src/lib.rs            |   2 +-
 crates/socket-patch-cli/src/main.rs           |  16 +-
 .../socket-patch-cli/tests/apply_network.rs   |  46 +--
 .../tests/cli_env_deprecation.rs              | 343 ------------------
 .../socket-patch-cli/tests/cli_get_silent.rs  |   4 -
 .../socket-patch-cli/tests/cli_parse_get.rs   |  79 ++--
 .../tests/cli_parse_rollback.rs               |  37 +-
 .../socket-patch-cli/tests/cli_parse_scan.rs  | 210 +++--------
 .../socket-patch-cli/tests/cli_scan_silent.rs |   4 +-
 ...ge_fix_rollback_ecosystem_scoped_hosted.rs |   1 -
 .../tests/covgap_commands_get.rs              |   7 +-
 .../tests/covgap_commands_repair.rs           |  17 +-
 .../tests/covgap_commands_scan_mod.rs         |  28 +-
 .../tests/docker_e2e_vendor_gem.rs            |   2 +-
 .../socket-patch-cli/tests/e2e_bun_lockb.rs   |  55 ++-
 crates/socket-patch-cli/tests/e2e_cargo.rs    |   1 -
 crates/socket-patch-cli/tests/e2e_composer.rs |   1 -
 crates/socket-patch-cli/tests/e2e_golang.rs   |   1 -
 .../tests/e2e_golang_hosted_build.rs          |   1 -
 .../tests/e2e_hosted_production.rs            |  15 +-
 crates/socket-patch-cli/tests/e2e_maven.rs    |   1 -
 crates/socket-patch-cli/tests/e2e_nuget.rs    |   1 -
 crates/socket-patch-cli/tests/e2e_pypi.rs     |  20 +-
 .../tests/e2e_redirect_cargo_build.rs         |   3 +-
 .../tests/e2e_redirect_composer_build.rs      |   8 +-
 .../tests/e2e_redirect_npm_build.rs           |  10 +-
 .../tests/e2e_redirect_uv_build.rs            |   6 +-
 .../tests/e2e_vendor_composer_build.rs        |   9 +-
 .../tests/e2e_vendor_gem_build.rs             |   3 +-
 .../tests/e2e_vendor_yarn_classic_build.rs    |  14 +-
 .../tests/e2e_vendored_production.rs          |   5 +-
 .../tests/e2e_vex_build/hatch.rs              |   4 +-
 .../tests/e2e_vex_build/pdm.rs                |   6 +-
 .../tests/e2e_vex_build/pip.rs                |   4 +-
 .../tests/e2e_vex_build/pipenv.rs             |   4 +-
 .../tests/e2e_vex_build/poetry.rs             |   6 +-
 .../tests/e2e_vex_lockfile/bun.rs             | 140 ++++---
 .../tests/e2e_vex_lockfile/composer.rs        |   2 +-
 .../tests/e2e_vex_lockfile/pdm.rs             |   4 +-
 .../tests/e2e_vex_lockfile/pipenv.rs          |   4 +-
 .../tests/e2e_vex_lockfile/poetry.rs          | 262 +++++++------
 .../tests/e2e_vex_lockfile/uv.rs              | 256 +++++++------
 .../tests/e2e_vex_lockfile/yarn.rs            |   6 +-
 .../tests/e2e_vex_redirect.rs                 |  16 +-
 .../tests/get_edge_cases_e2e.rs               |  47 +--
 .../socket-patch-cli/tests/get_invariants.rs  |  16 +-
 .../tests/hosted_memory_common/mod.rs         |   9 +-
 .../tests/in_process_cargo_apply.rs           |   6 -
 .../tests/in_process_edge_cases.rs            |   1 -
 .../tests/in_process_gem_apply.rs             |   4 -
 .../tests/in_process_gem_multi_platform.rs    |   4 -
 .../socket-patch-cli/tests/in_process_get.rs  |  71 ----
 .../tests/in_process_get_corrupt_manifest.rs  |   1 -
 .../tests/in_process_get_hosted_ecosystems.rs |   1 -
 .../tests/in_process_get_manifest_path.rs     |   1 -
 .../tests/in_process_get_modes.rs             |   1 -
 .../tests/in_process_get_uuid_fallback.rs     |   1 -
 .../tests/in_process_pypi_apply.rs            |   8 -
 .../tests/in_process_pypi_multi_release.rs    |   3 -
 .../tests/in_process_python_envs.rs           |   2 -
 .../tests/in_process_redirect.rs              |  70 ++--
 .../tests/in_process_redirect_pdm.rs          |   5 +-
 .../tests/in_process_redirect_pipenv.rs       |   5 +-
 .../tests/in_process_redirect_pnpm.rs         |   6 +-
 .../tests/in_process_redirect_poetry.rs       |   5 +-
 .../in_process_remote_ecosystems_apply.rs     |   2 -
 .../in_process_remove_repair_lifecycle.rs     |   1 -
 .../in_process_rollback_all_ecosystems.rs     |   1 -
 .../tests/in_process_rollback_hosted.rs       |   6 -
 .../tests/in_process_rollback_vendored.rs     |   1 -
 .../socket-patch-cli/tests/in_process_scan.rs |   2 -
 .../tests/in_process_vendor.rs                |  14 +-
 .../tests/in_process_vendor_bun.rs            |  33 +-
 .../tests/remove_duality_invariants.rs        |  41 ++-
 .../tests/remove_rollback_api_overrides.rs    |   1 -
 .../tests/rollback_invariants.rs              | 132 +------
 .../socket-patch-cli/tests/scan_vendor_e2e.rs |  73 +---
 .../socket-patch-cli/tests/telemetry_e2e.rs   |   1 -
 .../tests/vex_e2e_common/uv.rs                |  24 +-
 .../tests/vex_pdm_hatch_common/mod.rs         |  16 +-
 .../tests/vex_pipenv_pip_common/mod.rs        |  14 +-
 .../tests/vex_pipenv_pip_real/mod.rs          |   2 +-
 .../socket-patch-core/src/api/blob_fetcher.rs |   6 +-
 crates/socket-patch-core/src/api/client.rs    |  13 +-
 .../src/crawlers/npm_crawler.rs               |   5 +-
 crates/socket-patch-core/src/hosted/engine.rs |   3 +-
 crates/socket-patch-core/src/patch/apply.rs   | 206 ++---------
 crates/socket-patch-core/src/patch/package.rs |  18 +-
 .../src/patch/redirect/bun_binary.rs          |   1 -
 .../redirect/composer_equivalence_tests.rs    |   2 -
 .../redirect/golang_equivalence_tests.rs      |   2 -
 .../patch/redirect/group_equivalence_tests.rs |   1 -
 .../redirect/lock_index_equivalence_tests.rs  |   1 -
 .../src/patch/redirect/mod.rs                 |  13 -
 .../src/patch/redirect/pdm.rs                 |   4 +-
 .../patch/redirect/pnpm_equivalence_tests.rs  |   1 -
 .../src/patch/redirect/poetry.rs              |   1 -
 .../redirect/python_lock_equivalence_tests.rs |   2 -
 .../src/patch/redirect/requirements.rs        |   1 -
 .../src/patch/redirect/upstream/bun_lockb.rs  |   1 -
 .../src/patch/redirect/vlt_preflight.rs       |   1 -
 crates/socket-patch-core/src/telemetry.rs     |  28 +-
 .../socket-patch-core/src/utils/env_compat.rs | 288 +--------------
 .../socket-patch-core/src/utils/pdm_lock.rs   |  28 +-
 .../src/utils/poetry_lock.rs                  |  28 +-
 .../src/utils/python_lock.rs                  |  26 ++
 .../socket-patch-core/src/vendor/bun_lock.rs  |  12 -
 .../src/vendor/bun_workspace.rs               |  19 -
 crates/socket-patch-core/src/vendor/cargo.rs  | 206 +++++------
 .../src/vendor/composer_lock.rs               | 198 ++++------
 crates/socket-patch-core/src/vendor/gem.rs    |  48 +--
 crates/socket-patch-core/src/vendor/golang.rs | 286 ++++++---------
 .../src/vendor/lock_inventory/tests.rs        |   1 -
 .../src/vendor/lock_inventory/view.rs         |  67 +---
 crates/socket-patch-core/src/vendor/mod.rs    |   1 -
 .../src/vendor/npm_common.rs                  | 157 +++-----
 .../socket-patch-core/src/vendor/npm_dir.rs   | 115 +++---
 .../src/vendor/npm_flavor.rs                  |   2 -
 crates/socket-patch-core/src/vendor/pypi.rs   | 236 +++++-------
 .../src/vendor/service_fetch.rs               | 213 +++++++----
 .../socket-patch-core/src/vendor/vlt_lock.rs  |   6 -
 .../src/vendor/vlt_lock_text.rs               |   6 +-
 .../src/vendor/yarn_layering_tests.rs         |   3 -
 .../socket-patch-core/src/vex/discover/bun.rs |   1 -
 .../socket-patch-core/src/vex/discover/npm.rs |   1 -
 .../tests/blob_fetcher_edges_e2e.rs           |   4 -
 .../tests/covgap_api_blob_fetcher.rs          |   2 -
 .../tests/covgap_patch_apply.rs               |   1 -
 .../tests/covgap_vendor_nuget_feed.rs         |   1 -
 .../tests/crawler_npm_e2e.rs                  |   3 -
 crates/socket-patch-core/tests/pnpm_hosted.rs |   1 -
 .../socket-patch-core/tests/poetry_hosted.rs  |   1 -
 .../tests/telemetry_helpers_e2e.rs            |  29 +-
 crates/socket-patch-core/tests/uv_hosted.rs   |   1 -
 crates/socket-patch-core/tests/vlt_locks.rs   |   1 -
 153 files changed, 1510 insertions(+), 3519 deletions(-)
 delete mode 100644 crates/socket-patch-cli/tests/cli_env_deprecation.rs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 919bbd19..635838ec 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -79,6 +79,33 @@ into the new version's section — see docs/releasing.md.
   `gem_setup` / `composer_setup` / `pth_hook` aliases are removed from
   `socket-patch-core`, along with the setup-only `npm_family` table column
   (`FileRow::detects_pnpm`) and `VLT_SETUP_MARKERS`.
+- **v3/v4 compatibility spellings are gone.**
+  - The v3.0 legacy env names `SOCKET_PATCH_PROXY_URL`, `SOCKET_PATCH_DEBUG`
+    and `SOCKET_PATCH_TELEMETRY_DISABLED` are no longer read and no longer
+    print a deprecation warning. Use `SOCKET_PROXY_URL`, `SOCKET_DEBUG` and
+    `SOCKET_TELEMETRY_DISABLED`.
+  - The hidden `scan --redirect` flag (use `--mode hosted`) and the hidden
+    no-op `scan --detached` flag (vendored mode is always manifest-free) are
+    removed. Both are now unknown-flag usage errors (exit 2).
+  - The hidden `--mode` values `host`, `redirect` and `vendor` on `scan` and
+    `get` are rejected; only `hosted`, `vendored` and `agent` are accepted.
+    The hidden `scan --apply` and `scan --vendor` spellings stay.
+- **`get --one-off` and `rollback --one-off`** (and `SOCKET_ONE_OFF`) are
+  removed. They were never implemented and only failed with a usage error;
+  `--one-off` is now an unknown-flag error (still exit 2) and
+  `SOCKET_ONE_OFF` is ignored.
+- **`.socket/packages/` package archives are no longer read.** Nothing has
+  written them for several releases. `apply`, `vendor` and `repair` stop
+  probing and staging the directory, and `apply`'s JSON `appliedVia` loses
+  its `"package"` value (`"diff"` or `"blob"` remain). The GC sweeps
+  (`scan --prune`, `rollback`, `remove`, `repair`) delete any leftover
+  `.socket/packages/` files whole (`rollback` and `scan --prune` still
+  report them as `removedPackageArchives`).
+- **Core crate:** removed uncalled public helpers
+  (`bun_lock::snapshot_binary_workspace_artifacts`, `vlt_lock_sniff_ok`,
+  and several `lock_inventory::view` accessors) and the never-read
+  `DepOverride::berry_zip_url` field (a `berryZipUrl` key in a patch
+  reference still parses).
 
 ### Changed (BREAKING): patch UI streamlining
 
@@ -96,10 +123,10 @@ into the new version's section — see docs/releasing.md.
   confirmation, in `--json` too (no `selection_required` outside agent
   mode). Agent-mode `get` keeps its picker and `Download and apply N
   patches?` prompt.
-- **`get` and `rollback` usage errors exit 2** (were 1): `get`'s
-  `--id`/`--cve`/`--ghsa`/`--package` multi-select, `--one-off --save-only`,
-  `--mode hosted|vendored --save-only`, `--one-off`, a malformed forced
-  identifier, and `rollback --one-off`. Every usage error now exits 2.
+- **`get` usage errors exit 2** (were 1): `get`'s
+  `--id`/`--cve`/`--ghsa`/`--package` multi-select,
+  `--mode hosted|vendored --save-only` and a malformed forced identifier.
+  Every usage error now exits 2.
 - **Human output:** warning lines no longer carry the `(code)` tag
   (`Warning: …`, `GC: skipped: …`); the codes stay in the JSON envelope.
   Error lines keep theirs (`Error (<code>): …`). Hosted mode is called "hosted", not "redirect", in human
@@ -502,9 +529,8 @@ into the new version's section — see docs/releasing.md.
   selected patch records are fetched into memory and every vendor-ledger entry
   carries `detached: true` plus the embedded `record` as its verification
   source, so a vendored project's footprint is `.socket/vendor/**` only. The
-  former `--detached` opt-in is now the only vendored posture — the flag is
-  hidden, accepted as a no-op for compatibility, and still a usage error
-  without vendored mode. JSON uses the detached download vocabulary for both
+  former `--detached` opt-in is now the only vendored posture, and the flag
+  itself is removed (see "Removed"). JSON uses the detached download vocabulary for both
   commands (`downloaded: N`, `detached: true`, `patches[].action` =
   `downloaded` | `skipped` | `failed`). The vendor step vendors exactly what
   discovery selected — the "whole manifest is vendored" re-vendor from a
diff --git a/README.md b/README.md
index 0f507b6c..6045f81d 100644
--- a/README.md
+++ b/README.md
@@ -644,7 +644,7 @@ socket-patch scan [PATHS]... [options]
 |------|---------|-------------|
 | `--mode <hosted\|vendored\|agent>` | — | Selects one of the three [patch modes](#three-patch-modes) (default: `hosted`). Combining `--mode` with a legacy boolean flag of a *different* mode is an error (exit 2); the same mode spelled both ways is accepted. |
 | `--package <name\|purl>` | `SOCKET_SCAN_PACKAGES` | Only scan these packages: a name (`lodash`, `@scope/pkg`, `requests`; case-insensitive) or a purl with or without its version (`pkg:npm/lodash`, `pkg:pypi/requests@2.31.0`). Repeat the flag or separate with commas. |
-| `--prune` | — | Agent-mode garbage collection after the scan: remove manifest entries for packages no longer present in the crawl (installed trees + lockfiles — a wiped `node_modules` alone doesn't prune lockfile-listed entries) and delete orphan blob/diff/package-archive files. [Vendored](#vendor) packages are exempt from the crawl-based prune, but a vendored entry whose dependency has left the lockfile is reverted. Ignored, with a `redirect_prune_ignored` warning, in hosted mode; without a mode the scan is report-only. |
+| `--prune` | — | Agent-mode garbage collection after the scan: remove manifest entries for packages no longer present in the crawl (installed trees + lockfiles — a wiped `node_modules` alone doesn't prune lockfile-listed entries) and delete orphan blob/diff-archive files (plus any legacy package archives). [Vendored](#vendor) packages are exempt from the crawl-based prune, but a vendored entry whose dependency has left the lockfile is reverted. Ignored, with a `redirect_prune_ignored` warning, in hosted mode; without a mode the scan is report-only. |
 | `--sync` | — | Shorthand for `--mode agent --prune`: the one-flag agent-mode auto-update run. |
 | `--batch-size <n>` | `SOCKET_BATCH_SIZE` | Packages per API request (default: `500` on the authenticated API, `100` on the public proxy). A request whose body would exceed 256 KiB is split into smaller ones. |
 | `--all-releases` | `SOCKET_ALL_RELEASES` | Store patches for every release/distribution variant, not just the installed one — PyPI wheel/sdist, RubyGems platform, Maven classifier. Makes the manifest portable across environments (e.g. cross-platform CI caches). |
@@ -652,8 +652,7 @@ socket-patch scan [PATHS]... [options]
 | `--vex-product`, `--vex-no-verify`, `--vex-doc-id`, `--vex-compact` | `SOCKET_VEX_*` | Passthrough to the embedded VEX builder; mirror the standalone [`vex`](#vex) knobs. Inert unless `--vex` is set. |
 
 > Deprecated, hidden spellings (still accepted): `--apply` (== `--mode agent`) and
-> `--vendor` (== `--mode vendored`). `--detached` is a hidden no-op kept for compatibility (vendored mode is
-> always manifest-free); it is still an error without vendored mode.
+> `--vendor` (== `--mode vendored`).
 
 **Examples:**
 ```bash
@@ -901,7 +900,6 @@ socket-patch get <identifier> [options]
 | `--ghsa` | — | Force identifier to be treated as a GHSA ID. |
 | `-p, --package` | — | Force identifier to be treated as a package name. |
 | `--save-only` | `SOCKET_SAVE_ONLY` | Download the patch without applying it (alias: `--no-apply`). |
-| `--one-off` | `SOCKET_ONE_OFF` | Reserved (hidden from `--help`): apply the patch immediately without saving to the `.socket` folder. **Not yet implemented** — the command currently errors up front. |
 | `--all-releases` | `SOCKET_ALL_RELEASES` | Download patches for every release/distribution variant of a matched package (PyPI wheel/sdist, RubyGems platform, Maven classifier), not just the installed one. |
 | `--mode <hosted\|vendored\|agent>` | — | How to consume the patch; the same modes as `scan --mode` (default: `agent`). |
 
@@ -1020,7 +1018,6 @@ socket-patch rollback [targets]... [options]
 | Flag | Env var | Description |
 |------|---------|-------------|
 | `--preserve-state` | `SOCKET_PRESERVE_STATE` | Unpatch the system but keep the local patch state — manifest entries, vendored artifacts + ledger entries — for a later re-apply, and skip GC. Hosted patches have no preservable state (the lockfile is their only record) and are restored to upstream either way. |
-| `--one-off` | `SOCKET_ONE_OFF` | Reserved: rollback by fetching original (`beforeHash`) files from the API, no manifest required. **Not yet implemented** — the command currently errors up front. |
 
 **Examples:**
 ```bash
diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index b3a58ab1..9eb0c4af 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -45,7 +45,7 @@ In v3.0 every subcommand accepts the same set of "global" flags via a single sha
 | `--org` | `-o` | `SOCKET_ORG_SLUG` | (auto-resolve) | string | Org slug |
 | `--proxy-url` | — | `SOCKET_PROXY_URL` | `https://patches-api.socket.dev` | string | Public proxy when no token |
 | `--ecosystems` | `-e` | `SOCKET_ECOSYSTEMS` | (all) | CSV → `Vec<String>` | Restrict to these ecosystems |
-| `--download-mode` | — | `SOCKET_DOWNLOAD_MODE` | **`diff`** | enum: `diff` \| `package` \| `file` | Patch artifact format |
+| `--download-mode` | — | `SOCKET_DOWNLOAD_MODE` | **`diff`** | enum: `diff` \| `file` (`package` was removed and is rejected) | Patch artifact format |
 | `--vendor-source` | — | `SOCKET_VENDOR_SOURCE` | **`auto`** | enum: `auto` \| `service` \| `build` | How `vendor` acquires the installable artifact (see "Prebuilt vendor artifacts") |
 | `--vendor-url` | — | `SOCKET_VENDOR_URL` | (active API/proxy base) | string | Base host for the vendoring-service package-reference request |
 | `--patch-server-url` | — | `SOCKET_PATCH_SERVER_URL` | (server-returned) | string | Override the host of the prebuilt-archive download URL (local-dev / testing) |
@@ -82,16 +82,15 @@ Beyond the globals above, each subcommand defines a small set of local arguments
 | `apply`, `scan`, `vendor` | `--vex` | `SOCKET_VEX` | Generate an OpenVEX 0.2.0 document at this path on a successful run; see "embedded VEX" below |
 | `apply`, `scan`, `vendor` | `--vex-product`, `--vex-no-verify`, `--vex-doc-id`, `--vex-compact` | `SOCKET_VEX_PRODUCT`, `SOCKET_VEX_NO_VERIFY`, `SOCKET_VEX_DOC_ID`, `SOCKET_VEX_COMPACT` | Passthrough to the embedded VEX builder; mirror the standalone `vex` knobs. Inert unless `--vex` is set |
 | `scan` | positional `[PATHS]...` | — | (v5.0) Meaning depends on the mode. **Hosted / vendored** (bare `scan` included): each PATH, or directory glob (`apps/*`), is a project directory scanned on its own as if it were `--cwd`. **Agent** (and a mode-less `--prune`/`--global` report): path globs scoping DISCOVERY to packages installed under matching paths (`packages/foo`, `apps/**`). See "Path-scoped scans" below |
-| `scan` | `--mode <hosted\|vendored\|agent>` | — | The documented selector for the three patch-application modes (v5.0 default: `hosted`, except that a `--prune` or `--global`/`--global-prefix` scan with no mode is report-only). Hidden value aliases: `host`/`redirect` (hosted), `vendor` (vendored). Each value is equivalent to one legacy boolean spelling: `hosted` == `--redirect`, `vendored` == `--vendor`, `agent` == `--apply` (`--sync` counts as an agent spelling). Combining `--mode` with a boolean of a DIFFERENT mode is a usage error (exit 2, enforced in `resolve_mode_flags` — clap's `conflicts_with` is value-independent); the same mode spelled both ways is accepted. `--prune` is an orthogonal GC knob and never conflicts — but hosted mode runs no GC, so `--mode hosted --prune` emits an explicit `redirect_prune_ignored` warning (JSON `redirect.warnings[]` + stderr) instead of silently dropping the flag |
-| `scan` | `--redirect` | — | Hosted mode's legacy boolean spelling (**hidden from `--help`** and **deprecated** — `--mode hosted` is the documented spelling): rewrite lockfiles / registry configs so ONLY the patched dependencies resolve to Socket's hosted patch server; no artifact bytes land in the repo. Conflicts with `--apply`/`--sync`/`--vendor` |
+| `scan` | `--mode <hosted\|vendored\|agent>` | — | The documented selector for the three patch-application modes (v5.0 default: `hosted`, except that a `--prune` or `--global`/`--global-prefix` scan with no mode is report-only). v5.0 removes the hidden value aliases `host`/`redirect`/`vendor` (now an invalid-value usage error). `vendored` and `agent` each keep one hidden, deprecated boolean spelling: `vendored` == `--vendor`, `agent` == `--apply` (`--sync` counts as an agent spelling); hosted has none (v5.0 removes `--redirect`). Combining `--mode` with a boolean of a DIFFERENT mode is a usage error (exit 2, enforced in `resolve_mode_flags` — clap's `conflicts_with` is value-independent); the same mode spelled both ways is accepted. `--prune` is an orthogonal GC knob and never conflicts — but hosted mode runs no GC, so `--mode hosted --prune` emits an explicit `redirect_prune_ignored` warning (JSON `redirect.warnings[]` + stderr) instead of silently dropping the flag |
 | `scan` | `--apply` / `--prune` / `--sync` | — | `--apply` == `--mode agent` (deprecated spelling); `--prune` = GC after the scan (ignored with a `redirect_prune_ignored` warning in hosted mode); `--sync` = `--mode agent --prune` |
 | `scan` | `--package <name\|purl>` (repeatable or comma-separated) | `SOCKET_SCAN_PACKAGES` | (v5.0) Only scan these packages: a name (`lodash`, `@scope/pkg`, `requests`, `group:artifact`; matched against the full name or its last segment, case-insensitively) or a purl with or without a version (`pkg:npm/lodash` matches every version, `pkg:pypi/requests@2.31.0` only that one). Qualifiers are ignored. Filters the crawl like `--ecosystems`, after the prune universe is captured, so `--prune` still judges the full crawl |
-| `scan` | `--vendor` / `--detached` | — | Vendor every patched dependency instead of applying in place (`--vendor` == `--mode vendored`; conflicts with `--apply`/`--sync`, combines with `--prune`). Vendored mode is manifest-free (v5.0): the vendor ledger embeds the patch records and `.socket/manifest.json` is never written. `--detached` — the former opt-in for exactly that — is **hidden** and retained for compatibility as a no-op; it is still a usage error (exit 2) without vendored mode in either spelling |
+| `scan` | `--vendor` | — | Vendor every patched dependency instead of applying in place (`--vendor` == `--mode vendored`; conflicts with `--apply`/`--sync`, combines with `--prune`). Vendored mode is manifest-free (v5.0): the vendor ledger embeds the patch records and `.socket/manifest.json` is never written. The former opt-in for exactly that, `--detached`, is removed in v5.0 (unknown-flag usage error) |
 | `scan` | `--batch-size` | `SOCKET_BATCH_SIZE` | API batch chunk size. Unset (v5.0): `500` on the authenticated API (the server's per-request maximum), `100` on the public proxy; a given value applies on either endpoint (`0` is floored to `1`). A chunk whose request body would exceed 256 KiB (the public proxy's body cap) is split into consecutive smaller chunks, deterministically (greedy, in crawl order). A mid-run downgrade to the proxy keeps the chunks already formed |
 | `get`, `scan` | `--all-releases` | `SOCKET_ALL_RELEASES` | Download patches for every release/distribution variant of a matched package — PyPI wheel/sdist (`artifact_id`), RubyGems (`platform`), Maven (`classifier`) — not just the one(s) matching the locally-installed distribution. On `scan` this makes the stored manifest portable across environments (e.g. cross-platform CI caches). On `get` (v3.6) it ALSO disables the coarse installed-**version** narrowing of CVE/GHSA fan-outs (see "get --mode and installed narrowing"): every found version's patch is fetched, installed or not |
-| `get` | positional `identifier`; `--id` / `--cve` / `--ghsa` / `--package` (`-p`); `--save-only` (alias `--no-apply`); `--one-off` (hidden from `--help`: always fails "not yet implemented"); `--mode <hosted\|vendored\|agent>` | `SOCKET_SAVE_ONLY`, `SOCKET_ONE_OFF` | Patch lookup + consumption mode (v3.6). `--mode` reuses scan's value enum (same hidden value aliases `host`/`redirect`/`vendor`; deliberately no env binding, matching scan). Default (v5.0): `hosted`, like scan; `agent` (save + apply in place) when `--save-only` or `--global`/`--global-prefix` is given. An explicit `--save-only` conflicts with `--mode hosted\|vendored` — rejected with **exit 1** via get's established self-enforced-conflict style (unlike scan's exit-2 mode conflicts; see the exit-code table) |
+| `get` | positional `identifier`; `--id` / `--cve` / `--ghsa` / `--package` (`-p`); `--save-only` (alias `--no-apply`); `--mode <hosted\|vendored\|agent>` | `SOCKET_SAVE_ONLY` | Patch lookup + consumption mode (v3.6). `--mode` reuses scan's value enum (same hidden value aliases `host`/`redirect`/`vendor`; deliberately no env binding, matching scan). Default (v5.0): `hosted`, like scan; `agent` (save + apply in place) when `--save-only` or `--global`/`--global-prefix` is given. An explicit `--save-only` conflicts with `--mode hosted\|vendored` — rejected with **exit 1** via get's established self-enforced-conflict style (unlike scan's exit-2 mode conflicts; see the exit-code table) |
 | `remove` | positional `identifier`; `--skip-rollback`; `--preserve-state` (v5.0) | `SOCKET_SKIP_ROLLBACK`, `SOCKET_PRESERVE_STATE` | Manifest entry removal. `--preserve-state` is the single-patch twin of `rollback --preserve-state`: restore the tree and unwind the identifier's vendored/hosted wiring, but keep the manifest entry, the vendored artifact + ledger entry, and skip all GC. Combining it with `--skip-rollback` is a self-enforced usage error (exit 2): one flag keeps the tree and drops the state, the other restores the tree and keeps the state — together they select the do-nothing quadrant ("the combination would be a no-op: nothing would change"). The conflict fires whether either flag is spelled on the command line or sourced from its env var |
-| `rollback` | optional variadic positional `targets` (PURL \| UUID \| path glob); `--one-off`; `--preserve-state` (v5.0) | `SOCKET_ONE_OFF`, `SOCKET_PRESERVE_STATE` | Rollback scope. Multiple targets union. A token becomes a path glob ONLY when it is path-SHAPED — contains a separator (`/` or `\`) or a glob metacharacter (`*?[`), or starts with `./`, or is absolute; a `pkg:` prefix is a PURL and every other bare word keeps identifier (PURL/UUID) semantics, so a mistyped identifier or truncated UUID stays a safe exit-1 "No patch found matching identifier: X" (with a hint suggesting `./X` or `X/**` for directory targeting) instead of silently becoming a path scope. An unparseable glob is a usage error (exit 2) |
+| `rollback` | optional variadic positional `targets` (PURL \| UUID \| path glob); `--preserve-state` (v5.0) | `SOCKET_PRESERVE_STATE` | Rollback scope. Multiple targets union. A token becomes a path glob ONLY when it is path-SHAPED — contains a separator (`/` or `\`) or a glob metacharacter (`*?[`), or starts with `./`, or is absolute; a `pkg:` prefix is a PURL and every other bare word keeps identifier (PURL/UUID) semantics, so a mistyped identifier or truncated UUID stays a safe exit-1 "No patch found matching identifier: X" (with a hint suggesting `./X` or `X/**` for directory targeting) instead of silently becoming a path scope. An unparseable glob is a usage error (exit 2) |
 | `vex` | `--output` / `-O`, `--product`, `--no-verify`, `--doc-id`, `--compact` | `SOCKET_VEX_OUTPUT`, `SOCKET_VEX_PRODUCT`, `SOCKET_VEX_NO_VERIFY`, `SOCKET_VEX_DOC_ID`, `SOCKET_VEX_COMPACT` | OpenVEX 0.2.0 document generation; see "vex output channels" below |
 | `repair` | `--download-only` | `SOCKET_DOWNLOAD_ONLY` | Repair-specific cleanup mode (mutually exclusive with `--offline`; combining them is a usage error, exit 2) |
 
@@ -111,7 +110,7 @@ For a **9.0 root lock**, the CLI ensures `pnpm-workspace.yaml` carries `trustLoc
 
 ### Scan modes (v5.0)
 
-**Mode resolution (`resolve_mode_flags`, MAJOR in v5.0).** `--mode`, or one of its legacy boolean spellings (`--redirect`, `--vendor`, `--apply`/`--sync`), picks the mode. With none of them, `scan` runs **hosted** mode — JSON and human alike; the result nests under the JSON `redirect` sub-object (see the hosted paragraph below). The one exception: a `--prune` or `--global`/`--global-prefix` scan with no mode has no project lockfile to rewire, so it is **report-only** — discovery, the table, the `updates` array and the `redirectState` block below, plus the `--prune` GC — and, in human mode, ends with the hint `To apply these patches in place, run:` / `  socket-patch scan --mode agent [PATHS]` / `  socket-patch get <package-name-or-purl-or-CVE-ID>`. An explicit `--mode hosted` (or `--redirect`) with `--global`/`--global-prefix` is a usage error (exit 2: global installs have no project lockfile to redirect).
+**Mode resolution (`resolve_mode_flags`, MAJOR in v5.0).** `--mode`, or one of its legacy boolean spellings (`--vendor`, `--apply`/`--sync`), picks the mode. With none of them, `scan` runs **hosted** mode — JSON and human alike; the result nests under the JSON `redirect` sub-object (see the hosted paragraph below). The one exception: a `--prune` or `--global`/`--global-prefix` scan with no mode has no project lockfile to rewire, so it is **report-only** — discovery, the table, the `updates` array and the `redirectState` block below, plus the `--prune` GC — and, in human mode, ends with the hint `To apply these patches in place, run:` / `  socket-patch scan --mode agent [PATHS]` / `  socket-patch get <package-name-or-purl-or-CVE-ID>`. An explicit `--mode hosted` with `--global`/`--global-prefix` is a usage error (exit 2: global installs have no project lockfile to redirect).
 
 **scan never prompts, in any mode** (v5.0): no confirm, no free-tier patch menu (it always takes the top-ranked downloadable patch; see "Which patch gets selected"), and no `Non-interactive mode detected` note. `--yes` does not change a scan. `get` (agent mode only — hosted/vendored `get` never prompts either, v5.0), `rollback`, `remove` and `--update` keep their prompts.
 
@@ -119,7 +118,7 @@ For a **9.0 root lock**, the CLI ensures `pnpm-workspace.yaml` carries `trustLoc
 
 **Agent-flow run-level warnings (additive).** An agent-mode apply (`--mode agent` / `--apply` / `--sync`, `--json`) may add a top-level `warnings[]` array of `{code, detail}` entries to the scan envelope (absent when none fired; each is also mirrored to stderr unless `--silent`). They surface cross-mode state the apply cannot change — never a status or exit-code change (hosted refusals set the precedent: exit 0 + warning). Codes (stable; new codes are additive/MINOR): `vendored_ownership_retained` — vendor-owned package(s) were skipped before download (the per-patch `skipped`/`vendored` records in `apply.patches[]` are unchanged); the detail names the purls and the migration path (`remove <purl>`, or `vendor --revert` which unwinds every vendored package, then re-run). `hosted_wiring_retained` — the lockfiles still pin scanned package(s) to a hosted patch (the agent run does not unwind hosted wiring — as of v5.0 that is `socket-patch rollback`'s job, which restores the upstream registry entries, or `remove <purl>` per package); the detail names the purls and the options (stay `--mode hosted`, migrate via `scan --mode vendored`, or `socket-patch rollback`). The warning keys on the hosted pins lockfile discovery finds at scan time, so a flow that restored the upstream entries retires it. The human path prints the same `hosted_wiring_retained` text to stderr after an apply; the vendored counterpart is already covered by its per-package `[skip] … (vendored …)` lines. `ownership_not_restored` (v5.0; `apply` and `rollback` `warnings[]` alike) — a file WAS patched (or restored) but its ownership could not be put back to the original uid/gid (the mode is still restored last); the detail is `<purl>: <path>: patched, but ownership could not be restored to uid N gid M: <error>` and the human line `Warning: <detail>` (stderr, muted by `--silent`); never a status or exit change.
 
-`scan --prune` opts into garbage collection. When set, `scan` removes manifest entries for packages no longer present in the crawl, then deletes orphan blob, diff, and package-archive files from `.socket/`. Off by default (v3.0) so a temporary uninstall doesn't silently destroy manifest state. Only entries whose ecosystem this run actually crawled are eligible: a `pkg:<type>/` with no crawler in this build (a newer CLI's ecosystem in the committed manifest) is exempt — the crawl never looked for them, so their absence is not evidence of removal (same fail-safe as the `--ecosystems` filter, which narrows the query but never the prune's installed set). The pass also reconciles vendored state (runs FIRST, under ONE apply-lock acquisition shared with the manifest prune — lock contention skips the whole pass without failing the scan; `--lock-timeout` is honored and a lock I/O error is reported rather than swallowed; the existence gate — a manifest file OR a vendor ledger file, both cheap stats; an emptied ledger is deleted on save, so its presence is its content proxy — runs BEFORE the lock, so a bare project never gets a `.socket/`; in the vendored scan arms the pass runs AFTER the vendor step): (a) ledger entries still tracked by a manifest record (manifest-mode entries written by standalone `vendor`) whose patch is gone from the manifest are reverted — `detached` entries (every `scan`/`get --mode vendored` entry, v5.0) have no manifest record to lose and are exempt from this leg; (b) EVERY ledger entry whose dependency is no longer in the lockfile graph is reverted and any manifest entry it still had dropped (v5.0: the check is about the lockfile, not the manifest, so embedded-record entries are no longer exempt; a missing or undeterminable lockfile keeps the entry, fail-safe); and (c) orphan `.socket/vendor/<eco>/<uuid>` dirs with no ledger entry are swept. The prune never deletes a zero-patch `.socket/manifest.json` (its `{"patches": {}}` + `setup` block stay). The JSON `gc` sub-object gains `revertedVendoredEntries` + `keptVendoredEntries` + `failedVendoredEntries` + `removedVendorOrphanDirs` (wet) / `revertableVendoredEntries` + `vendorOrphanDirs` (preview), plus two ADDITIVE wet-only keys: `skipped: {code, message}` — present exactly when the pass was skipped at the lock (`lock_held` | `lock_io`; every count is then zero) — and `warnings: [{code, detail}]` — `vendor_state_write_failed` / `manifest_write_failed` (entries were reverted but the ledger or manifest rewrite failed) and `cleanup_failed` (an orphan sweep failed mid-way). Human mode prints `GC: skipped (<code>): <message>.`, one `GC: <detail>.` line per warning, and `GC: failed to revert N vendored entries: …` (singular for one) for `failedVendoredEntries`. `keptVendoredEntries` lists drift-kept entries the revert deliberately preserved (`vendor_artifact_kept` — undo the drift and re-run `vendor --revert` to finish); the preview cannot see drift (backends return before the wiring replay on dry runs), so `revertableVendoredEntries` may over-promise what a wet run will actually reclaim.
+`scan --prune` opts into garbage collection. When set, `scan` removes manifest entries for packages no longer present in the crawl, then deletes orphan blob and diff-archive files, and every legacy package archive, from `.socket/`. Off by default (v3.0) so a temporary uninstall doesn't silently destroy manifest state. Only entries whose ecosystem this run actually crawled are eligible: a `pkg:<type>/` with no crawler in this build (a newer CLI's ecosystem in the committed manifest) is exempt — the crawl never looked for them, so their absence is not evidence of removal (same fail-safe as the `--ecosystems` filter, which narrows the query but never the prune's installed set). The pass also reconciles vendored state (runs FIRST, under ONE apply-lock acquisition shared with the manifest prune — lock contention skips the whole pass without failing the scan; `--lock-timeout` is honored and a lock I/O error is reported rather than swallowed; the existence gate — a manifest file OR a vendor ledger file, both cheap stats; an emptied ledger is deleted on save, so its presence is its content proxy — runs BEFORE the lock, so a bare project never gets a `.socket/`; in the vendored scan arms the pass runs AFTER the vendor step): (a) ledger entries still tracked by a manifest record (manifest-mode entries written by standalone `vendor`) whose patch is gone from the manifest are reverted — `detached` entries (every `scan`/`get --mode vendored` entry, v5.0) have no manifest record to lose and are exempt from this leg; (b) EVERY ledger entry whose dependency is no longer in the lockfile graph is reverted and any manifest entry it still had dropped (v5.0: the check is about the lockfile, not the manifest, so embedded-record entries are no longer exempt; a missing or undeterminable lockfile keeps the entry, fail-safe); and (c) orphan `.socket/vendor/<eco>/<uuid>` dirs with no ledger entry are swept. The prune never deletes a zero-patch `.socket/manifest.json` (its `{"patches": {}}` + `setup` block stay). The JSON `gc` sub-object gains `revertedVendoredEntries` + `keptVendoredEntries` + `failedVendoredEntries` + `removedVendorOrphanDirs` (wet) / `revertableVendoredEntries` + `vendorOrphanDirs` (preview), plus two ADDITIVE wet-only keys: `skipped: {code, message}` — present exactly when the pass was skipped at the lock (`lock_held` | `lock_io`; every count is then zero) — and `warnings: [{code, detail}]` — `vendor_state_write_failed` / `manifest_write_failed` (entries were reverted but the ledger or manifest rewrite failed) and `cleanup_failed` (an orphan sweep failed mid-way). Human mode prints `GC: skipped (<code>): <message>.`, one `GC: <detail>.` line per warning, and `GC: failed to revert N vendored entries: …` (singular for one) for `failedVendoredEntries`. `keptVendoredEntries` lists drift-kept entries the revert deliberately preserved (`vendor_artifact_kept` — undo the drift and re-run `vendor --revert` to finish); the preview cannot see drift (backends return before the wiring replay on dry runs), so `revertableVendoredEntries` may over-promise what a wet run will actually reclaim.
 
 `scan` queries the patch API in `--batch-size` chunks. Authenticated runs POST `/v0/orgs/{slug}/patches/batch`; token-less runs POST `{proxy}/patch/batch` on the public proxy and degrade to per-package `GET /patch/by-package/:purl` requests in two cases: the deployed proxy predates the batch endpoint (legacy proxies answer the POST with their `400 "Unsupported endpoint"` catch-all), or the all-or-nothing batch validation rejects the chunk (e.g. a crawled PURL type the server doesn't recognize, such as `pkg:jsr/…` — the per-package path tolerates those individually, preserving the pre-batch scan semantics). Rate limits and over-capacity 503s surface instead of silently degrading.
 
@@ -144,9 +143,9 @@ For a **9.0 root lock**, the CLI ensures `pnpm-workspace.yaml` carries `trustLoc
 
 `scan --vendor` swaps the in-place apply for the vendor pipeline: discover → download the selected patch records **into memory** (no manifest write) → vendor every selected dependency via the same engine as the `vendor` command (under the same lock). Vendored mode is **manifest-free (v5.0)**: `.socket/manifest.json` is never written or read by a vendored run; each ledger entry carries `detached: true` plus an embedded copy of the patch record (`record`) as its verification source, and the run's footprint is `.socket/vendor/**` only. The vendor step's scope is what discovery selected — the former "whole manifest is vendored" re-vendor on an empty discovery is retired (`repair` verifies and rebuilds committed vendored state; `scan --prune` reconciles ledger entries whose dependency left the lockfile). A package the ledger holds at an older patch uuid is still **re-vendored automatically** when discovery selects the newer patch (its old uuid dir is removed — `vendor_stale_artifact_removed`); same-uuid re-runs reuse the embedded record, skip the patch-view fetch, and are `already_vendored` skips. **Legacy manifest-mode entries**: when a vendored run vendors a purl that also has a `.socket/manifest.json` record (a project vendored by a pre-5.0 binary, or by standalone `vendor` from an agent-mode manifest), that manifest record is dropped in the same run — the ledger becomes the owner (migration write); an emptied manifest is left as `{"patches": {}}`, never deleted. The migration is reported through the run-level `warnings[]` (stderr in human mode), never as a run error: `vendor_manifest_record_migrated` (`N manifest records moved to the vendor ledger (vendored mode is manifest-free): <purls>`) or `vendor_manifest_migration_failed` (the manifest or the ledger could not be read or rewritten; the legacy records were left in place) — so a corrupt `.socket/manifest.json` no longer fails a vendored run (standalone `vendor`, the one manifest-driven writer, still fails closed on it). With `--prune`, GC runs **after** the vendor step (the step never reads the manifest, and running the sweep last lets it reclaim what the run itself orphaned — a migrated legacy record's blobs, a superseded uuid dir). JSON output gains a `download` sub-object — the detached download envelope `{found, downloaded, skipped, failed, detached: true, patches: [{purl, uuid, action: "downloaded" | "skipped" | "failed", …}], warnings?}` (no `applied` field — nothing is applied in place; `detached: true` is pinned and always present; a `downloaded` record whose purl the ledger already holds at another uuid carries the additive `oldUuid` — the re-vendor the vendor step then performs — and its human `[fetch]` line reads `<purl> (replacing <short uuid>)`) — and a `vendor` sub-object (a full vendor Envelope). Patch blobs are held in memory (see "Patch sources stay in memory" under the vendor contract). `--dry-run` previews per-patch `would_vendor` | `would_revendor` (+`oldUuid`) | `already_vendored` — plus, additive, `would_refuse` (+`errorCode`, `error`) for npm purls the wet run's Bun preflight (see the `get --mode vendored` bullet below) would refuse — without network downloads or disk writes; the preview never flips status or exit (the human path — `scan` and `get` alike, through one shared printer — prints `[would-refuse] <purl> (<code>): <detail>` lines behind the `--silent` gate). Interactive mode prompts "Download and vendor N patches?" (singular for one).
 
-**Vendored entries and the rest of the CLI.** Because nothing is in the manifest, vendored patches are invisible to `apply` (nothing to apply in place) but fully visible to `list` (listed from the ledger, labeled `Mode: vendored (recorded in .socket/vendor/state.json)` in human mode, exit 0 on a vendored-only project), `vex` (attested from the embedded records while a lockfile still wires the artifact — see "Manifest-less VEX"), `repair` (health-checked and rebuilt from the ledger), and `scan --prune` (lockfile-driven reconcile). They are exempt from standalone `vendor`'s manifest reconcile (`reconcile_dropped` never touches `detached` entries) and exit via `remove <purl>` (which reverts them), `vendor --revert`, or `rollback`, whose vendored leg reverts every in-scope ledger entry (unscoped and identifier-scoped runs; path-scoped runs reach them only when an installed copy matches). The hidden `--detached` flag (`scan --vendor --detached`) names exactly this — the only — vendored posture and is accepted as a no-op for compatibility.
+**Vendored entries and the rest of the CLI.** Because nothing is in the manifest, vendored patches are invisible to `apply` (nothing to apply in place) but fully visible to `list` (listed from the ledger, labeled `Mode: vendored (recorded in .socket/vendor/state.json)` in human mode, exit 0 on a vendored-only project), `vex` (attested from the embedded records while a lockfile still wires the artifact — see "Manifest-less VEX"), `repair` (health-checked and rebuilt from the ledger), and `scan --prune` (lockfile-driven reconcile). They are exempt from standalone `vendor`'s manifest reconcile (`reconcile_dropped` never touches `detached` entries) and exit via `remove <purl>` (which reverts them), `vendor --revert`, or `rollback`, whose vendored leg reverts every in-scope ledger entry (unscoped and identifier-scoped runs; path-scoped runs reach them only when an installed copy matches).
 
-`scan --mode hosted` (== `--redirect`) swaps the in-place apply for the registry-redirect pipeline: discover → resolve hosted-patch references (grant token + integrity + per-dep registry override) → rewrite ONLY the patched dependencies' lockfile / registry-config entries to point at the hosted packages. A dep counts as **redirected** only when its hosted-artifact URL (or per-dep registry index URL) actually landed in a project file — a granted reference whose rewriter found nothing to edit is neither counted nor attested. **No ledger (v5.0)**: hosted mode writes ONLY the lockfile / registry-config edits — `.socket/vendor/redirect-state.json` is never written (on success or failure), and a pre-v5 one on disk is ignored (never read for planning, never quarantined, left byte-identical). The lockfiles are the only record of a hosted patch: `list`, `vex`, `rollback`, `remove`, `vendor` and `repair` all discover the hosted pins from them (a hosted URL counts only on `https://patch.socket.dev` or the `--patch-server-url` / `SOCKET_PATCH_SERVER_URL` origin), and commit-ready output is just the lockfile / config changes. Cargo and golang are confirmed only by their rewriter's own report (`confirmed_cargo_uuids` / `confirmed_golang_uuids`): a golang dep counts only when its go.mod `replace M V => patch.socket.dev/gopatch/<uuid> <sver>` and both go.sum lines are in place, never because the patch-server origin or leftover go.sum lines appear somewhere. A golang module that go.mod does not require and go.sum does not list at the patched version is outside the build graph and is refused with `redirect_golang_not_in_module_graph` (nothing written). Only the exact module `patch.socket.dev/gopatch/<canonical uuid>` is socket-owned; any other module path is refused with `redirect_golang_untrusted_module_path`. A vendored golang module is taken over like cargo and the npm family: its vendor wiring, committed copy and ledger entry are reverted first (`redirect_takeover_reverted_vendored`). Re-runs over already-rewritten output plan from the current lock text and are idempotent (exit 0, lock unchanged). **Lock (v5.0)**: the hosted engine acquires `<.socket>/apply.lock` around its first wet write (the takeover pre-reverts) — not on `--dry-run`, and not when the run would write nothing (zero redirects, all skipped) — so previews and no-op runs never create `.socket/`; contention is `lock_held` and a lock-file I/O fault (a read-only project root, a file squatting on `.socket/`) is `lock_io` — both exit 1, refused BEFORE any project file is written, and rendered like every other lock holder: human `Error (<code>): <message>` on stderr (+ the `--lock-timeout` hint for a live holder); JSON keeps the hosted shape — top-level `status: "error"`, `errorCode: "lock_held" | "lock_io"`, a string `error`, and `redirect: {mode: "hosted"}` retained (NOT the vendored `error: {code, message}` object). **Takeover symlink pre-check (v5.0)**: a vendored→hosted takeover whose recorded wiring file is a symlink is refused up front with `redirect_symlinked_file_unsupported` — wet and `--dry-run` alike, before any revert — so "nothing was written" holds. **Human mode (v5.0)**: hosted `scan` prints the results table and update detection like the other modes, then rewrites without a prompt (scan never prompts); `--dry-run` previews through the engine, and a detail fetch that leaves nothing to redirect enters the engine as a no-op (`Redirected 0 packages; rewrote 0 files.`, no lock, no `.socket/`). The detail fetch prints the same progress counter and per-package `Warning: could not fetch details for …` lines as the agent arm. An EMPTY hosted discovery prints `No patches available for installed packages.` and exits 0 without entering the engine; a discovery whose every offer is paid-tier for an org without paid access prints the table's paid nudge, then `No downloadable patches (paid subscription required).`, and exits 0 without entering the engine (parity with the agent/vendored arms). JSON output gains a `redirect` sub-object: `{ mode: "hosted", redirected, rewrittenFiles, skipped, warnings, dryRun }` (`mode` is additive so consumers can dispatch without inferring it). Rewriter warnings carry stable `redirect_*` codes (e.g. `redirect_npm_no_lockfile`, `redirect_gradle_manual_snippet`, `redirect_golang_unsupported`); new codes are additive (MINOR). v5.0 additive codes: `redirect_composer_no_lockfile` / `redirect_gem_no_gemfile` (composer / gem: neither manifest nor lock present — once per run, after the intake gates), `redirect_maven_no_pom` (no `pom.xml` and no Gradle build), `redirect_nuget_lock_unparseable` (a present-but-corrupt `packages.lock.json` — warned once, nothing mutated; an absent lock still proceeds), `redirect_cargo_lock_pkg_ambiguous` (several same-name+version `[[package]]` blocks and none carries the index `source` — transactional skip). Also v5.0: a registry override of the wrong kind (or none at all) warns the arm's missing-override code for nuget/gem/golang. Refusals stay fail-closed with a diagnosis that names the actual cause: a yarn-berry lock entry resolving through a non-`npm:` protocol keeps `redirect_yarn_berry_unsupported_protocol` with the entry's ACTUAL protocol in the detail — except socket-patch's OWN vendored wiring (a `file:` range into `.socket/vendor/`), which gets the distinct `redirect_yarn_berry_vendored_entry` code whose detail names the retirement path (`remove <purl>` per package, or `vendor --revert` which unwinds every vendored package, then re-run `scan --mode hosted`). Both leave the entry byte-identical; neither changes exit code or status. **yarn berry line endings (v5.0)**: yarn writes a NEW `yarn.lock` with the OS line ending (`os.EOL` — CRLF on Windows) and keeps an existing lock's majority ending on every later write, and a `core.autocrlf` checkout turns an LF lock CRLF on any OS — so a uniformly CRLF lock is rewritten in its own ending: every untouched byte (a leading BOM included) round-trips (and `rollback`'s upstream restore keeps the lock's own ending). A lock that MIXES CRLF and LF (or holds a bare CR) has no single ending to keep — yarn's own `--immutable` check rejects it too (YN0028) — so it is refused untouched with `redirect_yarn_berry_mixed_line_endings` (the detail names `yarn install`, which normalizes it). This replaces v4's `redirect_yarn_berry_crlf_unsupported`, which refused every CRLF lock and is no longer emitted. A vendored→hosted takeover runs these berry gates (mixed line endings, unsupported `cacheKey`, a non-zero `.yarnrc.yml` `compressionLevel`) BEFORE reverting a vendored berry purl — wet and `--dry-run` alike — so a refused purl keeps its vendored wiring, ledger entry and artifact byte-identical and is skipped with the gate's code (never announced as `redirect_takeover_reverted_vendored` and then left unpatched in both modes).
+`scan --mode hosted` swaps the in-place apply for the registry-redirect pipeline: discover → resolve hosted-patch references (grant token + integrity + per-dep registry override) → rewrite ONLY the patched dependencies' lockfile / registry-config entries to point at the hosted packages. A dep counts as **redirected** only when its hosted-artifact URL (or per-dep registry index URL) actually landed in a project file — a granted reference whose rewriter found nothing to edit is neither counted nor attested. **No ledger (v5.0)**: hosted mode writes ONLY the lockfile / registry-config edits — `.socket/vendor/redirect-state.json` is never written (on success or failure), and a pre-v5 one on disk is ignored (never read for planning, never quarantined, left byte-identical). The lockfiles are the only record of a hosted patch: `list`, `vex`, `rollback`, `remove`, `vendor` and `repair` all discover the hosted pins from them (a hosted URL counts only on `https://patch.socket.dev` or the `--patch-server-url` / `SOCKET_PATCH_SERVER_URL` origin), and commit-ready output is just the lockfile / config changes. Cargo and golang are confirmed only by their rewriter's own report (`confirmed_cargo_uuids` / `confirmed_golang_uuids`): a golang dep counts only when its go.mod `replace M V => patch.socket.dev/gopatch/<uuid> <sver>` and both go.sum lines are in place, never because the patch-server origin or leftover go.sum lines appear somewhere. A golang module that go.mod does not require and go.sum does not list at the patched version is outside the build graph and is refused with `redirect_golang_not_in_module_graph` (nothing written). Only the exact module `patch.socket.dev/gopatch/<canonical uuid>` is socket-owned; any other module path is refused with `redirect_golang_untrusted_module_path`. A vendored golang module is taken over like cargo and the npm family: its vendor wiring, committed copy and ledger entry are reverted first (`redirect_takeover_reverted_vendored`). Re-runs over already-rewritten output plan from the current lock text and are idempotent (exit 0, lock unchanged). **Lock (v5.0)**: the hosted engine acquires `<.socket>/apply.lock` around its first wet write (the takeover pre-reverts) — not on `--dry-run`, and not when the run would write nothing (zero redirects, all skipped) — so previews and no-op runs never create `.socket/`; contention is `lock_held` and a lock-file I/O fault (a read-only project root, a file squatting on `.socket/`) is `lock_io` — both exit 1, refused BEFORE any project file is written, and rendered like every other lock holder: human `Error (<code>): <message>` on stderr (+ the `--lock-timeout` hint for a live holder); JSON keeps the hosted shape — top-level `status: "error"`, `errorCode: "lock_held" | "lock_io"`, a string `error`, and `redirect: {mode: "hosted"}` retained (NOT the vendored `error: {code, message}` object). **Takeover symlink pre-check (v5.0)**: a vendored→hosted takeover whose recorded wiring file is a symlink is refused up front with `redirect_symlinked_file_unsupported` — wet and `--dry-run` alike, before any revert — so "nothing was written" holds. **Human mode (v5.0)**: hosted `scan` prints the results table and update detection like the other modes, then rewrites without a prompt (scan never prompts); `--dry-run` previews through the engine, and a detail fetch that leaves nothing to redirect enters the engine as a no-op (`Redirected 0 packages; rewrote 0 files.`, no lock, no `.socket/`). The detail fetch prints the same progress counter and per-package `Warning: could not fetch details for …` lines as the agent arm. An EMPTY hosted discovery prints `No patches available for installed packages.` and exits 0 without entering the engine; a discovery whose every offer is paid-tier for an org without paid access prints the table's paid nudge, then `No downloadable patches (paid subscription required).`, and exits 0 without entering the engine (parity with the agent/vendored arms). JSON output gains a `redirect` sub-object: `{ mode: "hosted", redirected, rewrittenFiles, skipped, warnings, dryRun }` (`mode` is additive so consumers can dispatch without inferring it). Rewriter warnings carry stable `redirect_*` codes (e.g. `redirect_npm_no_lockfile`, `redirect_gradle_manual_snippet`, `redirect_golang_unsupported`); new codes are additive (MINOR). v5.0 additive codes: `redirect_composer_no_lockfile` / `redirect_gem_no_gemfile` (composer / gem: neither manifest nor lock present — once per run, after the intake gates), `redirect_maven_no_pom` (no `pom.xml` and no Gradle build), `redirect_nuget_lock_unparseable` (a present-but-corrupt `packages.lock.json` — warned once, nothing mutated; an absent lock still proceeds), `redirect_cargo_lock_pkg_ambiguous` (several same-name+version `[[package]]` blocks and none carries the index `source` — transactional skip). Also v5.0: a registry override of the wrong kind (or none at all) warns the arm's missing-override code for nuget/gem/golang. Refusals stay fail-closed with a diagnosis that names the actual cause: a yarn-berry lock entry resolving through a non-`npm:` protocol keeps `redirect_yarn_berry_unsupported_protocol` with the entry's ACTUAL protocol in the detail — except socket-patch's OWN vendored wiring (a `file:` range into `.socket/vendor/`), which gets the distinct `redirect_yarn_berry_vendored_entry` code whose detail names the retirement path (`remove <purl>` per package, or `vendor --revert` which unwinds every vendored package, then re-run `scan --mode hosted`). Both leave the entry byte-identical; neither changes exit code or status. **yarn berry line endings (v5.0)**: yarn writes a NEW `yarn.lock` with the OS line ending (`os.EOL` — CRLF on Windows) and keeps an existing lock's majority ending on every later write, and a `core.autocrlf` checkout turns an LF lock CRLF on any OS — so a uniformly CRLF lock is rewritten in its own ending: every untouched byte (a leading BOM included) round-trips (and `rollback`'s upstream restore keeps the lock's own ending). A lock that MIXES CRLF and LF (or holds a bare CR) has no single ending to keep — yarn's own `--immutable` check rejects it too (YN0028) — so it is refused untouched with `redirect_yarn_berry_mixed_line_endings` (the detail names `yarn install`, which normalizes it). This replaces v4's `redirect_yarn_berry_crlf_unsupported`, which refused every CRLF lock and is no longer emitted. A vendored→hosted takeover runs these berry gates (mixed line endings, unsupported `cacheKey`, a non-zero `.yarnrc.yml` `compressionLevel`) BEFORE reverting a vendored berry purl — wet and `--dry-run` alike — so a refused purl keeps its vendored wiring, ledger entry and artifact byte-identical and is skipped with the gate's code (never announced as `redirect_takeover_reverted_vendored` and then left unpatched in both modes).
 
 The rewriter reads a fixed set of candidate files from the project root: the npm-family locks (`package-lock.json`, `npm-shrinkwrap.json`, `pnpm-lock.yaml`, `shrinkwrap.yaml`, `yarn.lock`, plus `.yarnrc.yml` for the berry cache-config gate, `bun.lock` / `bun.lockb`, and `vlt-lock.json` with `vlt.json` and `node_modules/.vlt-lock.json` read only), `requirements.txt` / `uv.lock` / `Pipfile.lock` (pipfile-spec 6; see the Pipenv section below) / `poetry.lock` (every Poetry lock generation from 1.0 on — the 0.12 `[metadata.hashes]` layout is refused because that installer ignores URL sources; a Poetry < 1.4 writer additionally gets `redirect_poetry_stale_install_risk`, see `docs/testing/poetry-compatibility.md`) / `pdm.lock` (PDM lock formats `2` and `4.3`–`4.5.1`; the identity-losing `3.1` / `4.0`–`4.2` formats and unknown future formats are refused with `redirect_pdm_refused`, and a lock-format-`2` writer additionally gets `redirect_pdm_legacy_sync_required`, see `docs/testing/pdm-compatibility.md`; when `uv.lock` or `poetry.lock` sits beside it they drive and `pdm.lock` is left alone), `Cargo.toml` / `Cargo.lock` / `.cargo/config.toml` (plus the legacy extensionless `.cargo/config` — cargo reads that spelling in preference when both exist, so the managed `[registries.…]` block is written into whichever one is present; **cargo also reads every workspace-member manifest** — the `[workspace] members` globs minus `exclude` — and every in-root path-dependency manifest, recursively, reached without crossing a symbolic link and never under `.socket/`, and pins the crate in each one that declares it, so those `<dir>/Cargo.toml` files can appear in `rewrittenFiles`. A crate is redirected only when every declaration pins and every other `Cargo.lock` package depending on it is a planned member: one a registry or git crate — or a path package outside the root or behind a link — also depends on is refused `redirect_cargo_transitive_dependents` (a pin reaches only the declarations it sits on), a crate no manifest declares keeps `redirect_cargo_toml_dep_not_found` with a transitive-only detail naming `--mode vendored`, a crate every declaration of which requires another version (no requirement accepts the patched version) is refused `redirect_cargo_toml_dep_unrewritable`, and so is a requirement that also matches another locked version of the crate — each a transactional skip, never recorded or attested. With NO `Cargo.lock` there is no resolved graph to ask, so the dependents question is answered from the manifests instead: a crate declared beside any other dependency — anything but a path dependency on a manifest this run also pins, or a `workspace = true` inheritor of a table it scans — or beside a workspace member this run did not read (a `members` glob, or a member outside the project or behind a symbolic link, which member discovery drops) is refused `redirect_cargo_lockless_dependents`, whose detail names the remedies (commit a lockfile, or `--mode vendored`); a project whose only dependency is the patched crate has nothing that could pull it in and still redirects. All-CRLF manifests, locks and configs are rewritten with CRLF kept (mixed endings keep refusing where the grammar does not match), and `remove` / rollback match the recorded fragments across a later CRLF↔LF checkout conversion), `composer.lock`, `nuget.config` / `packages.lock.json`, `Gemfile` / `Gemfile.lock`, `pom.xml` (+ `.mvn/maven.config` / `.mvn/checksums/checksums.sha256` for maven Trusted Checksums merge, and the Gradle build scripts read only to trigger the manual-snippet warning). **npm-family flavor coverage**: package-lock / npm-shrinkwrap, pnpm (root OR any nested `*/pnpm-lock.yaml`), yarn classic, **yarn berry** (`yarn.lock` entry only — `resolution: ::__archiveUrl=` + `yarnBerry10c0` checksum; cacheKey `10c0` and `.yarnrc.yml compressionLevel 0` gated by `redirect_yarn_berry_cache_unsupported`), and **bun** (text `bun.lock` lockfileVersion 0, 1 or 2 — 0 is the `--save-text-lockfile` opt-in lock of Bun 1.1.39–1.1.45, 1 the 1.2–1.3 default, 2 the 1.4+ default; all three emit one `packages` grammar, so the registry 4-tuple → URL 3-tuple rewrite is version-independent and the lock's own version line is kept. Any other or missing version, or a `packages` section outside bun's single-line grammar, is refused `redirect_bun_lock_unsupported` — the detail is the shared version gate's text (a newer version: update socket-patch, re-locking would reproduce it; no integer: re-lock with Bun ≥ 1.2), identical to the vendored refusal. A version-0 lock holding `workspace:` packages is refused `redirect_bun_workspace_unsupported` (its 2-tuple workspace grammar cannot keep the hosted tuple through a frozen install); the remedy is to delete `bun.lock` and re-run `bun install` with Bun ≥ 1.2, which writes lockfileVersion 1 (accepted). A plain in-place `bun install` bumps the version only when a workspace depends on another workspace (e.g. root → member — the shape the matrix measured); otherwise Bun 1.2.0 keeps version 0 and Bun 1.2.23+ fail to resolve, so the in-place bump is not the documented remedy. Bun lock version, grammar and workspace compatibility are checked before a vendored takeover, including during dry-run: these refusals preserve the existing lock, artifact and vendor ledger. Version-1 and version-2 workspace locks are rewritten, nested versions included. A granted dep with no rewritable entry warns `redirect_bun_entry_not_found`, a grant without a sha512 `redirect_bun_missing_sha512`; a CRLF lock keeps `\r\n` on the rewritten line, and a hosted URL left by an earlier grant of the same `name@version` is re-pinned in place. **Digest-less re-saves (Bun 1.1.39–1.3.9)**: every text-lock Bun below 1.3.10 re-saves a URL tuple WITHOUT its `sha512` whenever the lock is re-saved for another reason (`bun add`, `bun install` after a package.json or workspace change), leaving the 2-tuple `["name@<url>", {meta}]` — the spec Bun installs from is intact. The CLI treats that spelling as its own wiring: a repeat hosted run counts the dep as redirected (no `redirect_bun_entry_not_found`) and HEALS the line back to the 3-tuple with the current `sha512`, recording the heal as a further `redirect_bun_lock_package` edit whose `original` is the 2-tuple (a stale URL is re-pinned from either spelling); `rollback`, scoped `rollback <purl>` / `remove <purl>` and the vendored takeover accept the digest-less spelling of a recorded `new` line (same key, spec and meta, only the trailing `"sha512-…"` missing) and restore the recorded original over it, so the chain always unwinds to the pristine registry line. Anything else — another uuid/token, another version, a re-laid meta object — is still drift. **Native `bun.lockb`**: when no text `bun.lock` exists, binary format versions 1, 2 and 3 are read and rewritten directly. Socket Patch does not invoke Bun or convert the project to a text lockfile. Exact matching package records are rewritten to hosted tarballs with the granted integrity, preserving dependency resolution IDs, workspace/dependency topology and unrelated package metadata; binary pointers and the package metadata hash are updated. Per-package `redirect_bun_lockb_package` snapshots support scoped rollback, repeat runs, superseding grants and hosted ↔ vendored takeover. A regular binary lock is discoverable even with no Bun runtime or `node_modules`; a dry run previews the same binary edits without writing them. A malformed, unreadable, unsupported or unverified binary structure is `redirect_bun_lockb_invalid` (exit 0, `redirected: 0`), and it refuses the npm rewrite before any takeover or sibling npm-family lock mutation. A symlinked binary write target is `redirect_symlinked_file_unsupported` (exit 1, including dry-run). `bun.lock` wins when both spellings exist. Binary-only projects do not receive `redirect_npm_no_lockfile`. Measured boundaries and the real-Bun matrix: `docs/testing/bun-compatibility.md`), and **vlt** (`vlt-lock.json` without `lockfileVersion`, `0` or `1`; see the vlt hosted-mode contract below). **Rush monorepos**: when `rush.json` is present the rewriter also reads `common/config/rush/pnpm-lock.yaml` and each `common/config/subspaces/<name>/pnpm-lock.yaml` (sorted for determinism) under their repo-relative keys and repoints them in place; editing them emits `redirect_rush_repo_state_stale` when `common/config/rush/repo-state.json` exists (the `pnpmShrinkwrapHash` desync is refreshed by `rush update`, which the redirect survives). **maven** is fail-closed via version suffixing: a `mavenSuffixedVersion` + `mavenPomSha256` override pins the Socket-only `<version>-socket.<hex8>` by rewriting the literal `<version>` (`redirect_maven_dep_version`) or adding a `<dependencyManagement>` entry (`redirect_maven_dep_management_added`), plus optional Trusted Checksums (`redirect_maven_trusted_checksums`, conflicts as `redirect_maven_trusted_checksums_conflict`); a `${property}` version is refused (`redirect_maven_dep_unpinned`), a non-matching literal skipped (`redirect_maven_dep_version_mismatch`), and an override without a suffixed version falls back to same-GAV repository injection (`redirect_maven_same_gav_fallback`, NOT fail-closed).
 
@@ -166,7 +165,7 @@ The rewriter reads a fixed set of candidate files from the project root: the npm
 
 **Lock-text refusals before the download (v5.0)** — shared by `get --mode vendored` on both its paths and `scan --mode vendored`, after the Bun preflight above and the ledger's `already vendored` skip: a `pkg:npm/` result in a **pnpm, yarn classic or yarn berry** project, or a `pkg:cargo/` result, that its vendor backend refuses on the project's lock and manifest text alone is refused BEFORE its patch view is fetched — the pnpm / classic / berry gates the backend runs before it reads the package (coordinates, the lock and manifest reads and their line-ending / version / `cacheKey` / `.yarnrc.yml` gates, override and `resolutions` conflicts, the lock entry present and rewritable) and cargo's `locked_version_mismatch` (only when it is the crate's FIRST refusal; an in-tree `cargo vendor` copy still refuses in the loop as `already_vendored_in_tree`). **Scope:** only a package the vendor loop would hand to its backend is refused early — one installed on disk (the loop's own qualified-aware resolver plus the npm identity lookup), or one the lockfile inventory resolves to a verifiable registry source (a lock entry with an integrity, or the ledger-recovered pre-vendor resolution — exactly the entry the pristine fetch would use). A package absent from the lock and not installed never reached its backend and is untouched: its view is fetched, it downloads, and the vendor loop skips it `skipped` / `package_not_installed` as in v4.x (so cargo's `locked_version_mismatch` is refused early only for a crate installed at the unlocked version). The result becomes `{action:"failed", errorCode:<code>, error:<detail>}` in `download.patches[]` / `patches[]` with the backend's exact code and detail, no view and no pristine fetch, no patch record, and therefore no vendor event: compared with v4.x, `download.downloaded` drops and `download.failed` rises by the number of such packages, `vendor.summary.failed` and `vendor.events` lose their `failed` events, and a lockfile-only package among them loses its `vendor_fetched_missing` event (it is never fetched). Exit code and top-level `status` are unchanged (`partial_failure`/1); the nested `vendor.status` becomes `success` when those refusals were the vendor step's only failures (observed on the depscan fixture: 3 refusals, `partialFailure` → `success`), and when every selected package is refused this way the human `scan --vendor` arm prints `Nothing was vendored: N patches failed (see above).`. **Precedence:** the lock-text refusal is decided before the view, so it wins over every view-derived outcome — a package that would also have been a paid-access 403 (`[PAID]`/no access), a failed view fetch, or a no-applicable-files skip reports the lock refusal instead (the Bun refusal and the ledger's `already vendored` skip still come first). The human `[error] <purl> (<code>): <detail>` line is printed during the download instead of the vendor step's failure line (the human (non-`--silent`) `scan --vendor` arm's baseline pre-check still fetches the views it verifies; only the download, the pristine fetch and the vendor step skip the package there). A purl the lockfiles pin hosted keeps the loop's refusal (its takeover restore rewrites the lock the gates read); other flavors (package-lock, pnpm-legacy, bun) and ecosystems are untouched, and `--dry-run` is unchanged. `vendor` (manifest-driven, no view fetch) keeps its per-package `failed` events but no longer fetches the pristine source of a lockfile-only package it refuses this way — the source is deferred to the backend, which refuses before reading it (no `vendor_fetched_missing` event and no registry request; a refused package whose registry is unreachable reports the gate's code instead of `vendor_fetch_failed`); only a package the lock resolves to a verifiable source is deferred, and one it does not resolve keeps its `package_not_installed` skip. Pinned by `tests/scan_vendor_e2e.rs` (`exact_download_plan`: scan and exact-purl get, pnpm and cargo scope), `tests/e2e_yarn_legacy_cachekey_refusal_build.rs` and `tests/vendor_rerun_no_network_e2e.rs`.
 * **Installed-version narrowing** (all modes, `get`'s search path): a CVE/GHSA fan-out returns one patch record per patched VERSION; get keeps only versions present here and emits calm `skipped` records (`errorCode: "package_not_installed"`) for the rest — never an error exit. Presence = installed on disk (qualified-aware resolver) ∪ already tracked in the manifest (record maintenance keeps working on hosts without an installed copy); hosted/vendored modes additionally count lockfile-resolved deps and vendor-ledger purls (mirroring scan's discovery supplements, including their `--global` gate). **Exempt** (no narrowing): UUID identifiers, exact-versioned PURL identifiers (explicit intent), `--save-only` runs (record-only has no installation precondition — the fresh-clone record→vendor flow keeps working), `--all-releases`, and the package-name path (already installed-derived). When EVERY found patch is filtered out, get exits 0 with the additive status **`not_installed`** (`{status:"not_installed", found:N, downloaded:0, applied:0, patches:[<skip records>], warnings?}`) — never `no_match`, which remains pinned to the fuzzy package-name path. PnP layouts are surfaced, not misreported: yarn-PnP npm results skip with `errorCode: "yarn_pnp_unsupported"` in every mode; pnpm-PnP skips carry `pnpm_pnp_unsupported` in agent/vendored modes; hosted mode — the refusal's own remedy — keeps ONLY the versions the raw `pnpm-lock.yaml` text actually resolves (boundary-anchored probe over the v5/v6/v9 key spellings, so a large fan-out never requests grants for every version ever patched), labels a JUDGED miss `package_not_installed` exactly like a non-PnP project (the layout blocked nothing — the lock was read and the version isn't resolved), and reserves the layout code for an unreadable lock (no judgment possible). When EVERY narrowed-out result is a PnP refusal, the human terminal names the layout instead of claiming "not installed" and never advises `--all-releases` (which cannot make PnP patchable); the JSON status stays `not_installed` — consumers dispatch on the per-record `errorCode`. Hosted mode also runs the per-release VARIANT filter (`filter_to_installed_releases`) on its search path before requesting grants — agent/vendored runs get it inside the download engines — with the same keep-all-plus-warning fallbacks (surfaced as `(release_narrowing)`-prefixed strings in `warnings[]`). An ecosystem this binary has no crawler for is likewise never judged: its results are KEPT (absence from a crawl that never looked carries no information — the same fail-safe as scan's prune GC). The human `Found N patches:` listing shows only the patches whose package version survived the narrowing (the narrowing is judged over every result, so an installed package's paid fix a free user cannot download still lists as `[PAID] (no access)`, while skip records and counts cover only accessible patches), sorted by PURL in natural version order (`4.17.2` before `4.17.10`); the narrowed-out ones are summarized on stderr in one line per reason (`Skipped N patches for M package versions not installed here (use --all-releases to include them).`), and `--verbose` adds one `[skip] <purl> (<reason>)` line per skipped version after that summary, in natural version order. When the candidates hold more patches than were selected and the pick was made without a menu (a paid user's auto-pick, `--yes`, a non-TTY run), a `Selected:` block names the patch (purl, tier, short uuid, advisories) that will be installed before the prompt. Machine output (the prompt count, the JSON envelope) uses the kept set, unchanged. The finer per-release variant narrowing (`filter_to_installed_releases`) is unchanged and still runs inside the download engines (and before an agent-mode `--dry-run` preview, so the preview names only the variants a wet run would fetch).
-* **Deliberate divergences from scan** (documented, not drift): agent-mode get keeps its `selection_required` JSON posture for free multi-patch PURLs (scan and, v5.0, hosted/vendored get auto-pick); get has no `--vex` (an ambient `SOCKET_VEX` is ignored by get's modes), no `--detached` (moot — `get --mode vendored` is manifest-free by construction), no `--prune`; get does not run scan's pre-vendor baseline annotation; and an all-narrowed-out run exits `not_installed` without entering the vendor step (heal-after-wipe re-vendoring stays `scan --mode vendored`'s job). Agent-mode `get` honors `--dry-run` too (v5.0): the search and uuid paths classify each selected patch against the manifest (read-only; an unreadable manifest fails closed like the wet run) and stop before the prompt, the download, any `.socket/` write and the apply — human `[would-add]` / `[would-update] … (replacing <short uuid>)` / `[skip] … (already in manifest)` lines then `[dry-run] Would download and apply N patches. No changes made.`; JSON `{status:"success", dryRun:true, found, downloaded:0, skipped, applied:0, patches:[{purl, uuid, action:"would_add"|"would_update"(+oldUuid)|"skipped"}, <narrowing skip records>], warnings?}`, exit 0.
+* **Deliberate divergences from scan** (documented, not drift): agent-mode get keeps its `selection_required` JSON posture for free multi-patch PURLs (scan and, v5.0, hosted/vendored get auto-pick); get has no `--vex` (an ambient `SOCKET_VEX` is ignored by get's modes), no `--prune`; get does not run scan's pre-vendor baseline annotation; and an all-narrowed-out run exits `not_installed` without entering the vendor step (heal-after-wipe re-vendoring stays `scan --mode vendored`'s job). Agent-mode `get` honors `--dry-run` too (v5.0): the search and uuid paths classify each selected patch against the manifest (read-only; an unreadable manifest fails closed like the wet run) and stop before the prompt, the download, any `.socket/` write and the apply — human `[would-add]` / `[would-update] … (replacing <short uuid>)` / `[skip] … (already in manifest)` lines then `[dry-run] Would download and apply N patches. No changes made.`; JSON `{status:"success", dryRun:true, found, downloaded:0, skipped, applied:0, patches:[{purl, uuid, action:"would_add"|"would_update"(+oldUuid)|"skipped"}, <narrowing skip records>], warnings?}`, exit 0.
 
 `--dry-run` previews what `apply` / `rollback` / `scan --apply` / `repair` / `remove` — and `get` in every mode (hosted/vendored since v3.6, agent since v5.0) — would do without mutating disk. `get --mode hosted --dry-run` flows through the hosted engine's dry-run contract (no lock, no `.socket/`, no lockfile writes, `redirect.dryRun: true`); `get --mode vendored --dry-run` emits the same ledger-classification preview as scan's (`would_vendor` / `already_vendored` / `would_revendor`+`oldUuid` under the nested `vendor` key — plus, additive, `would_refuse` + `errorCode` + `error` for npm purls the wet run's Bun preflight would refuse: an in-sync `already_vendored` entry is exempt, as is a `would_revendor` entry whose `bun.lock` instances are all already local tuples; a purl the lock still resolves from the registry is refused like a fresh one, and the preview stays exit 0 / `status: "success"` with nothing written) before any download, and both skip the confirm prompt (nothing to confirm). In JSON mode, the envelope is populated with would-be actions and counts (`remove --dry-run` skips the confirmation prompt — there is nothing to confirm — and flips its would-be `Removed` events to `Verified` previews, so `summary.removed` stays "entries actually deleted"). `rollback --dry-run` (v5.0) previews every leg — the in-place restore verification, the vendored unwire (`Would revert/unwire vendoring for …`), the hosted upstream restore (every pin is resolved exactly like a wet run — registry lookups included, so a pin the wet run would refuse is previewed as that refusal — and nothing is flushed to disk), the manifest removals (simulated in memory), and the blob/archive GC — with no writes and no prompt.
 
@@ -713,6 +712,8 @@ worse, lets a warm cache silently serve unpatched bytes):
   0) — NOT `not_found`, which stays reserved for identifier-matches-nothing. `remove`'s default
   GC also extends (v5.0, additive) from blobs-only to blobs + diff archives + package archives
   (parity with rollback/repair/`scan --prune`; GC errors warn and continue, repair's posture).
+  Package archives (`.socket/packages/`) are legacy in v5.0: nothing writes or reads them, so
+  every GC sweep removes the whole directory.
 * **remove restores hosted pins (v5.0)**: an identifier matching hosted pins in the lockfiles
   (purl or patch uuid; v5 keeps no hosted ledger) restores each matched pin to its default
   upstream registry entry — the same restore as `rollback` (see "Hosted unwind coverage"), for every
@@ -778,7 +779,7 @@ worse, lets a warm cache silently serve unpatched bytes):
 * **Path targets select installed copies; entries with no installed copy are reachable only by identifier or unscoped runs.**
 * **Rollback restores every installed copy of a selected patch** — patches are tracked per-package, not per-path; copies restored outside the given patterns are surfaced as an `out_of_scope_copies_restored` warning, never skipped.
 
-`--ecosystems` narrows every leg. `--one-off` still requires ≥ 1 identifier-shaped target and still fails "not yet implemented" before any network or disk activity.
+`--ecosystems` narrows every leg.
 
 ### Default behavior: full-state rollback (MAJOR)
 
@@ -903,9 +904,9 @@ Empty string means unset at every layer: exported-but-empty flag-bound vars are
 | `SOCKET_API_URL` | `--api-url` | `https://api.socket.dev` | — |
 | `SOCKET_API_TOKEN` | `--api-token` | (none) | Absence selects the public proxy. |
 | `SOCKET_ORG_SLUG` | `--org` / `-o` | (auto-resolve) | — |
-| `SOCKET_PROXY_URL` | `--proxy-url` | `https://patches-api.socket.dev` | **Renamed in v3.0** (was `SOCKET_PATCH_PROXY_URL`). |
+| `SOCKET_PROXY_URL` | `--proxy-url` | `https://patches-api.socket.dev` | — |
 | `SOCKET_ECOSYSTEMS` | `--ecosystems` / `-e` | (all) | Comma-separated list. |
-| `SOCKET_DOWNLOAD_MODE` | `--download-mode` | `diff` | One of `diff` / `package` / `file`. |
+| `SOCKET_DOWNLOAD_MODE` | `--download-mode` | `diff` | One of `diff` / `file`. |
 | `SOCKET_VENDOR_SOURCE` | `--vendor-source` | `auto` | One of `auto` / `service` / `build`. |
 | `SOCKET_VENDOR_URL` | `--vendor-url` | (active API/proxy base) | Vendoring-service package-reference host. |
 | `SOCKET_PATCH_SERVER_URL` | `--patch-server-url` | (server-returned) | Rewrites the prebuilt-archive download host. |
@@ -919,17 +920,16 @@ Empty string means unset at every layer: exported-but-empty flag-bound vars are
 | `SOCKET_DRY_RUN` | `--dry-run` | `false` | — |
 | `SOCKET_YES` | `--yes` / `-y` | `false` | Skips the prompts of `get`, `rollback`, `remove` and `--update`; `scan` never prompts, so it has no effect there. |
 | `SOCKET_LOCK_TIMEOUT` | `--lock-timeout` | (none) | Seconds to wait for `apply.lock` on the lock-taking subcommands (incl. hosted/vendored `scan`/`get`); unset/`0` = single non-blocking try. |
-| `SOCKET_DEBUG` | `--debug` | `false` | **Renamed in v3.0** (was `SOCKET_PATCH_DEBUG`). |
-| `SOCKET_TELEMETRY_DISABLED` | `--no-telemetry` | `false` | **Renamed in v3.0** (was `SOCKET_PATCH_TELEMETRY_DISABLED`). |
+| `SOCKET_DEBUG` | `--debug` | `false` | — |
+| `SOCKET_TELEMETRY_DISABLED` | `--no-telemetry` | `false` | — |
 | `SOCKET_NO_TRUST_LOCKFILE_CONFIG` | `--no-trust-lockfile-config` | `false` | Hosted mode: skip the `trustLockfile: true` write to `pnpm-workspace.yaml`. |
 | `SOCKET_NO_NPM_ALLOW_REMOTE_CONFIG` | `--no-npm-allow-remote-config` | `false` | Hosted mode: skip the `allow-remote=all` write to the project `.npmrc`. |
 | `SOCKET_NO_VLT_INSTALL_CLEANUP` | `--no-vlt-install-cleanup` | `false` | Hosted mode, `rollback`, `remove`: keep stale vlt installed copies. |
 | `SOCKET_FORCE` | `apply --force` / `-f`, `vendor --force` / `-f`, `--update --force` | `false` | Local to `apply`, `vendor` and `--update`. |
-| `SOCKET_PATCH_VERSION` | `--update <VERSION>` | (latest) | Local to `--update`; the same pin `install.sh` and the gem launcher honor. Not one of the deprecated legacy `SOCKET_PATCH_*` trio. |
+| `SOCKET_PATCH_VERSION` | `--update <VERSION>` | (latest) | Local to `--update`; the same pin `install.sh` and the gem launcher honor. |
 | `SOCKET_BATCH_SIZE` | `scan --batch-size` | `500` authenticated / `100` proxy | Local to `scan`. |
 | `SOCKET_SCAN_PACKAGES` | `scan --package` | (none) | Local to `scan` (v5.0); comma-separated names or purls. |
 | `SOCKET_SAVE_ONLY` | `get --save-only` | `false` | Local to `get`. |
-| `SOCKET_ONE_OFF` | `get --one-off` / `rollback --one-off` | `false` | Local to `get`/`rollback`. Both are **not yet implemented**: the flag parses (boolishly, empty-tolerant) and the command fails up front with a "not yet implemented" error, before any network or disk activity (on `rollback`, with no identifier-shaped target it instead fails "requires an identifier", equally up front). |
 | `SOCKET_ALL_RELEASES` | `get --all-releases` / `scan --all-releases` | `false` | Local to `get`/`scan`. Download patches for every release/distribution variant, not just the installed one. |
 | `SOCKET_SKIP_ROLLBACK` | `remove --skip-rollback` | `false` | Local to `remove`. Conflicts with `--preserve-state`/`SOCKET_PRESERVE_STATE` (exit 2 — see below). |
 | `SOCKET_PRESERVE_STATE` | `rollback --preserve-state` / `remove --preserve-state` | `false` | (v5.0) Shared by `rollback`/`remove` (boolish, empty-tolerant parse like the other bool flags): restore the system but keep the local patch state — manifest entries, vendored artifacts + ledger entries — and skip all GC. On `remove`, combining it with `--skip-rollback` is a usage error (exit 2) **whether either side is flag- or env-sourced** (`SOCKET_PRESERVE_STATE=true remove --skip-rollback` exits 2 too). |
@@ -1005,13 +1005,9 @@ These exist for staged rollouts and the launcher wrappers. They are **internal**
 | `SOCKET_UPDATE_NOTIFIER_FORCE` | Test hook: bypasses the update notice's stderr-TTY guard — and nothing else (opt-out, offline, `--silent`, `--json`, CI all still win). |
 | `SOCKET_UPDATE_GRACE_MS` | Test hook: overrides the notice's post-command join grace (default 500 ms — how long the run waits for the background check before abandoning it and exiting). Lets the e2e suite await the loopback fetch to completion so its observable effect is deterministic; production keeps the tight 500 ms ceiling. |
 
-### Deprecated env vars
+### Removed env vars
 
-| Legacy | Renamed to | Status |
-|---|---|---|
-| `SOCKET_PATCH_PROXY_URL` | `SOCKET_PROXY_URL` | Honored with warning; to be removed in a future major release. |
-| `SOCKET_PATCH_DEBUG` | `SOCKET_DEBUG` | Honored with warning; to be removed in a future major release. |
-| `SOCKET_PATCH_TELEMETRY_DISABLED` | `SOCKET_TELEMETRY_DISABLED` | Honored with warning; to be removed in a future major release. |
+The v3.0 legacy names `SOCKET_PATCH_PROXY_URL`, `SOCKET_PATCH_DEBUG` and `SOCKET_PATCH_TELEMETRY_DISABLED` were removed in v5.0 and are ignored; use `SOCKET_PROXY_URL`, `SOCKET_DEBUG` and `SOCKET_TELEMETRY_DISABLED`.
 
 ## CSV value parsing
 
@@ -1059,7 +1055,7 @@ Every `--json` invocation emits a single JSON object that follows the **unified
     {
       "path":        "package/index.js",
       "verified":    true,
-      "appliedVia":  "package" | "diff" | "blob"   // only on action=applied
+      "appliedVia":  "diff" | "blob"   // only on action=applied; v5.0 drops "package"
     }
   ],
   "bytes":      1234,                       // optional (downloaded/removed)
@@ -1476,7 +1472,7 @@ Exit `1` when `status` is `partialFailure` (any `events[*].action == "failed"`)
 |---|---|
 | `0` | Success |
 | `1` | Error (missing/invalid manifest, fetch failed, apply failed, selection cancelled in non-JSON mode, etc.) |
-| `2` | Usage error: clap parse failures (unknown flag/value, missing required arg, an unknown subcommand such as the removed `setup`) and the conflicts the commands enforce themselves — `scan`'s cross-mode conflicts (`--mode` combined with a DIFFERENT mode's boolean spelling, rejected in `resolve_mode_flags`), `--detached` without vendored mode and `--mode hosted` with `--global`/`--global-prefix` (same enforcement point); in hosted/vendored `scan` (bare `scan` included), a PATH that is not a directory, a PATH glob matching no directory, and `--json` with more than one project directory (`run_project_dirs`); `remove --preserve-state --skip-rollback` (the no-op quadrant; flag- or env-sourced alike), an unparseable path glob on `scan`/`rollback`, `repair --offline --download-only`. `vex` also exits `2` on hard errors before document generation (see its tri-state table below). v5.0: `get`'s self-enforced conflicts exit `2` too (`--id`/`--cve`/`--ghsa`/`--package` multi-select, `--one-off --save-only`, `--mode hosted\|vendored --save-only`, the unimplemented `--one-off`, a malformed identifier for a forced `--id`/`--cve`/`--ghsa`), as does `rollback --one-off` — previously `1` (MAJOR). |
+| `2` | Usage error: clap parse failures (unknown flag/value, missing required arg, an unknown subcommand such as the removed `setup`) and the conflicts the commands enforce themselves — `scan`'s cross-mode conflicts (`--mode` combined with a DIFFERENT mode's boolean spelling, rejected in `resolve_mode_flags`) and `--mode hosted` with `--global`/`--global-prefix` (same enforcement point); in hosted/vendored `scan` (bare `scan` included), a PATH that is not a directory, a PATH glob matching no directory, and `--json` with more than one project directory (`run_project_dirs`); `remove --preserve-state --skip-rollback` (the no-op quadrant; flag- or env-sourced alike), an unparseable path glob on `scan`/`rollback`, `repair --offline --download-only`. `vex` also exits `2` on hard errors before document generation (see its tri-state table below). v5.0: `get`'s self-enforced conflicts exit `2` too (`--id`/`--cve`/`--ghsa`/`--package` multi-select, `--mode hosted\|vendored --save-only`, a malformed identifier for a forced `--id`/`--cve`/`--ghsa`) — previously `1` (MAJOR). The never-implemented `get --one-off` / `rollback --one-off` (and `SOCKET_ONE_OFF`) are removed in v5.0; `--one-off` is now an ordinary unknown-flag clap error. |
 
 `list` returns **`0`** for every project it can read, empty or not (**v5.0, BREAKING**: a project with no manifest and no ledger record — normal for hosted mode, which writes no manifest — used to exit `1` with `manifest_not_found`; it is now an empty list: `No patches in this project. Run \`socket-patch scan\`.` on stdout, and under `--json` the success envelope with `events: []`). Only an unreadable or invalid manifest (`manifest_unreadable` / `manifest_invalid`) exits `1`. Every lock-taking subcommand — including `scan`/`get --mode hosted` as of v5.0 — returns **`1`** with `errorCode: lock_held` when another live socket-patch process holds `<.socket>/apply.lock`.
 
diff --git a/crates/socket-patch-cli/src/args.rs b/crates/socket-patch-cli/src/args.rs
index 5aa13158..412ed9d7 100644
--- a/crates/socket-patch-cli/src/args.rs
+++ b/crates/socket-patch-cli/src/args.rs
@@ -9,9 +9,7 @@
 //!
 //! Precedence for every flag: CLI arg > env var > default.
 //!
-//! All env-var names use the `SOCKET_*` prefix. Three legacy `SOCKET_PATCH_*`
-//! names are still read at runtime (via `socket_patch_core::env_compat`) with
-//! a one-shot deprecation warning; they will be removed in the next major.
+//! All env-var names use the `SOCKET_*` prefix.
 
 use std::path::{Path, PathBuf};
 
@@ -614,7 +612,6 @@ pub const LOCAL_ARG_ENV_VARS: &[&str] = &[
     "SOCKET_FORCE",
     "SOCKET_PATCH_VERSION",
     "SOCKET_SAVE_ONLY",
-    "SOCKET_ONE_OFF",
     "SOCKET_ALL_RELEASES",
     "SOCKET_SKIP_ROLLBACK",
     "SOCKET_PRESERVE_STATE",
@@ -641,7 +638,7 @@ pub const LOCAL_ARG_ENV_VARS: &[&str] = &[
 /// per-token validator) outright — a single stray blank var crashed every
 /// subcommand — and an empty `SOCKET_DOWNLOAD_MODE` / `SOCKET_MANIFEST_PATH`
 /// (or `SOCKET_VEX_OUTPUT`, which would silently target `""`) leaked `""`
-/// past the documented defaults. Called from `main` after legacy-name
+/// past the documented defaults. Called from `main` after peer-alias
 /// promotion and before clap runs. Only exactly-empty values are scrubbed;
 /// whitespace is significant in paths, so it is left for the parsers to
 /// judge.
@@ -763,11 +760,10 @@ mod tests {
 
     /// Clear the extra env the core telemetry gate reads beyond the
     /// `SOCKET_*` set (`is_telemetry_disabled` also consults `VITEST` — the
-    /// kill-switch socket-cli's vitest suite relies on — and the legacy
-    /// `SOCKET_PATCH_TELEMETRY_DISABLED` name), so the airgap tests below
-    /// can't pass or fail vacuously. Restores afterwards.
+    /// kill-switch socket-cli's vitest suite relies on), so the airgap tests
+    /// below can't pass or fail vacuously. Restores afterwards.
     fn with_clean_telemetry_env(f: impl FnOnce()) {
-        with_env_cleared(&["VITEST", "SOCKET_PATCH_TELEMETRY_DISABLED"], f);
+        with_env_cleared(&["VITEST"], f);
     }
 
     /// `--offline` promises "never contact the network", but the telemetry
@@ -1571,12 +1567,10 @@ mod tests {
             ("SOCKET_FORCE", &["socket-patch", "vendor"]),
             ("SOCKET_FORCE", &["socket-patch", "self-update"]),
             ("SOCKET_SAVE_ONLY", &["socket-patch", "get", "x"]),
-            ("SOCKET_ONE_OFF", &["socket-patch", "get", "x"]),
-            ("SOCKET_ONE_OFF", &["socket-patch", "rollback"]),
             ("SOCKET_ALL_RELEASES", &["socket-patch", "get", "x"]),
             ("SOCKET_ALL_RELEASES", &["socket-patch", "scan"]),
             ("SOCKET_SKIP_ROLLBACK", &["socket-patch", "remove", "x"]),
-            // Shared by rollback and remove, like SOCKET_ONE_OFF above.
+            // Shared by rollback and remove.
             ("SOCKET_PRESERVE_STATE", &["socket-patch", "rollback"]),
             ("SOCKET_PRESERVE_STATE", &["socket-patch", "remove", "x"]),
             ("SOCKET_DOWNLOAD_ONLY", &["socket-patch", "repair"]),
diff --git a/crates/socket-patch-cli/src/commands/apply.rs b/crates/socket-patch-cli/src/commands/apply.rs
index a0dae200..327f93e0 100644
--- a/crates/socket-patch-cli/src/commands/apply.rs
+++ b/crates/socket-patch-cli/src/commands/apply.rs
@@ -2332,7 +2332,7 @@ mod tests {
     fn applied_event_emits_one_file_entry_per_patched_file() {
         let mut applied_via = HashMap::new();
         applied_via.insert("package/a.js".to_string(), CoreAppliedVia::Diff);
-        applied_via.insert("package/b.js".to_string(), CoreAppliedVia::Package);
+        applied_via.insert("package/b.js".to_string(), CoreAppliedVia::Diff);
         applied_via.insert("package/c.js".to_string(), CoreAppliedVia::Blob);
         let result = ApplyResult {
             package_key: "pkg:npm/foo@1.0.0".to_string(),
@@ -2359,7 +2359,7 @@ mod tests {
             .map(|f| (f["path"].as_str().unwrap().to_string(), f))
             .collect();
         assert_eq!(by_path["package/a.js"]["appliedVia"], "diff");
-        assert_eq!(by_path["package/b.js"]["appliedVia"], "package");
+        assert_eq!(by_path["package/b.js"]["appliedVia"], "diff");
         assert_eq!(by_path["package/c.js"]["appliedVia"], "blob");
     }
 
diff --git a/crates/socket-patch-cli/src/commands/bun_preflight.rs b/crates/socket-patch-cli/src/commands/bun_preflight.rs
index f972b7e6..3655295e 100644
--- a/crates/socket-patch-cli/src/commands/bun_preflight.rs
+++ b/crates/socket-patch-cli/src/commands/bun_preflight.rs
@@ -1,6 +1,6 @@
 //! The Bun vendored-mode preflight shared by EVERY path that feeds the
-//! vendor engine: `scan --mode vendored` (its in-memory download phase;
-//! the hidden `--detached` flag is a no-op), `get … --mode vendored`
+//! vendor engine: `scan --mode vendored` (its in-memory download phase),
+//! `get … --mode vendored`
 //! (search and uuid paths), their `--dry-run` previews, and the `vendor` command's engine
 //! loop itself ([`crate::commands::vendor::vendor_records`], where it runs
 //! BEFORE the hosted→vendored takeover reverts anything).
diff --git a/crates/socket-patch-cli/src/commands/fetch_stage.rs b/crates/socket-patch-cli/src/commands/fetch_stage.rs
index c3e11faa..dbde61fc 100644
--- a/crates/socket-patch-cli/src/commands/fetch_stage.rs
+++ b/crates/socket-patch-cli/src/commands/fetch_stage.rs
@@ -1,8 +1,8 @@
 //! Shared patch-source staging for the mutating commands (`apply`, `vendor`).
 //!
-//! Resolves where the patch pipeline should read blob/diff/package artifacts
-//! from, downloading what's missing into a transient overlay tempdir. The
-//! persistent `.socket/{blobs,diffs,packages}` cache is only ever *read* —
+//! Resolves where the patch pipeline should read blob/diff artifacts from,
+//! downloading what's missing into a transient overlay tempdir. The
+//! persistent `.socket/{blobs,diffs}` cache is only ever *read* —
 //! downloads land in the tempdir and are discarded when it drops (filling the
 //! cache is `repair`'s job, keeping these commands read-only against
 //! `.socket/`).
@@ -33,7 +33,6 @@ use crate::ui::{plural, StatusLine};
 pub(crate) struct StagedSources {
     pub(crate) blobs: PathBuf,
     diffs: PathBuf,
-    packages: PathBuf,
     _stage: Option<TempDir>,
 }
 
@@ -42,7 +41,6 @@ impl StagedSources {
     pub(crate) fn as_patch_sources(&self) -> PatchSources<'_> {
         PatchSources {
             blobs_path: &self.blobs,
-            packages_path: Some(&self.packages),
             diffs_path: Some(&self.diffs),
             mem_blobs: None,
         }
@@ -201,11 +199,10 @@ fn format_blob_fallback(diff_failed: usize, blobs: usize) -> String {
 }
 
 /// The manifest PURLs with no usable local source. A patch is "locally
-/// applicable" iff its package archive is on disk, or every file it
-/// touches has its `after_hash` blob on disk or is covered by the patch's
-/// diff archive. A diff covers only files that exist before the patch: a
-/// created file (empty `before_hash`) has nothing to diff against, so it
-/// always needs its blob.
+/// applicable" iff every file it touches has its `after_hash` blob on
+/// disk or is covered by the patch's diff archive. A diff covers only files
+/// that exist before the patch: a created file (empty `before_hash`) has
+/// nothing to diff against, so it always needs its blob.
 ///
 /// The patch pipeline picks whichever is present per file. Shared by the
 /// offline gate (probed against `.socket/`) and the post-download gate
@@ -214,19 +211,17 @@ fn patches_without_source<'m>(
     manifest: &'m PatchManifest,
     missing_blobs: &HashSet<String>,
     missing_diff_archives: &HashSet<String>,
-    missing_package_archives: &HashSet<String>,
 ) -> Vec<&'m str> {
     manifest
         .patches
         .iter()
         .filter_map(|(purl, record)| {
             let diff_present = !missing_diff_archives.contains(&record.uuid);
-            let pkg_present = !missing_package_archives.contains(&record.uuid);
             let files_covered = record.files.values().all(|f| {
                 !missing_blobs.contains(&f.after_hash)
                     || (diff_present && !f.before_hash.is_empty())
             });
-            if pkg_present || files_covered {
+            if files_covered {
                 None
             } else {
                 Some(purl.as_str())
@@ -304,7 +299,6 @@ pub(crate) async fn stage_patch_sources(
     let quiet = common.silent || common.json;
     let socket_blobs_path = socket_dir.join("blobs");
     let socket_diffs_path = socket_dir.join("diffs");
-    let socket_packages_path = socket_dir.join("packages");
 
     let download_mode = DownloadMode::parse(&common.download_mode).map_err(|e| e.to_string())?;
 
@@ -313,14 +307,9 @@ pub(crate) async fn stage_patch_sources(
     // on disk. These probes are read-only.
     let missing_blobs = get_missing_blobs(manifest, &socket_blobs_path).await;
     let missing_diff_archives = get_missing_archives(manifest, &socket_diffs_path).await;
-    let missing_package_archives = get_missing_archives(manifest, &socket_packages_path).await;
 
-    let no_source_purls = patches_without_source(
-        manifest,
-        &missing_blobs,
-        &missing_diff_archives,
-        &missing_package_archives,
-    );
+    let no_source_purls =
+        patches_without_source(manifest, &missing_blobs, &missing_diff_archives);
 
     if common.offline {
         // Offline: bail only if some patch has no usable local source.
@@ -335,7 +324,7 @@ pub(crate) async fn stage_patch_sources(
 
     // Decide what (if anything) needs downloading.
     //
-    // The patch pipeline tries sources in the order package → diff → blob
+    // The patch pipeline tries sources in the order diff → blob
     // locally. We honor `--download-mode` for the primary fetch when there's
     // actually a gap to close. Skip the archive fetch entirely when all file
     // blobs are already present locally — the pipeline will succeed via the
@@ -353,7 +342,6 @@ pub(crate) async fn stage_patch_sources(
         return Ok(StageOutcome::Ready(StagedSources {
             blobs: socket_blobs_path,
             diffs: socket_diffs_path,
-            packages: socket_packages_path,
             _stage: None,
         }));
     }
@@ -366,17 +354,15 @@ pub(crate) async fn stage_patch_sources(
     let staged = StagedSources {
         blobs: stage.path().join("blobs"),
         diffs: stage.path().join("diffs"),
-        packages: stage.path().join("packages"),
         _stage: Some(stage),
     };
-    for dir in [&staged.blobs, &staged.diffs, &staged.packages] {
+    for dir in [&staged.blobs, &staged.diffs] {
         tokio::fs::create_dir_all(dir)
             .await
             .map_err(|e| e.to_string())?;
     }
     overlay_dir(&socket_blobs_path, &staged.blobs).await;
     overlay_dir(&socket_diffs_path, &staged.diffs).await;
-    overlay_dir(&socket_packages_path, &staged.packages).await;
 
     // Progress: a transient status line on stderr (stdout is data); the
     // result lines below are what stays on screen.
@@ -436,19 +422,11 @@ pub(crate) async fn stage_patch_sources(
     // Download failures only matter per patch: bail iff some patch is left
     // with no usable source at the staged paths — the same coverage rule as
     // the offline gate. Aggregate counters can't decide this (a patch whose
-    // diff failed may be covered by its blobs and vice versa, and a local
-    // package archive covers its patch even though packages are never
-    // downloaded).
+    // diff failed may be covered by its blobs and vice versa).
     if fetch_result.failed > 0 || blob_fetch_failed {
         let missing_blobs = get_missing_blobs(manifest, &staged.blobs).await;
         let missing_diff_archives = get_missing_archives(manifest, &staged.diffs).await;
-        let missing_package_archives = get_missing_archives(manifest, &staged.packages).await;
-        let uncovered = patches_without_source(
-            manifest,
-            &missing_blobs,
-            &missing_diff_archives,
-            &missing_package_archives,
-        );
+        let uncovered = patches_without_source(manifest, &missing_blobs, &missing_diff_archives);
         if !uncovered.is_empty() {
             // An error, not progress chatter: prints even under --silent
             // (same rule as report_offline_missing above).
@@ -480,7 +458,6 @@ pub(crate) async fn stage_patch_sources(
 pub(crate) struct MemStagedSources {
     blobs: PathBuf,
     diffs: PathBuf,
-    packages: PathBuf,
     mem: HashMap<String, Vec<u8>>,
     /// The purls this staging could NOT obtain patch content for, each with
     /// the reason, while at least one other patch staged fine. Each is an
@@ -497,7 +474,6 @@ impl MemStagedSources {
     pub(crate) fn as_patch_sources(&self) -> PatchSources<'_> {
         PatchSources {
             blobs_path: &self.blobs,
-            packages_path: Some(&self.packages),
             diffs_path: Some(&self.diffs),
             mem_blobs: Some(&self.mem),
         }
@@ -528,8 +504,8 @@ fn needs_blob(file: &PatchFileInfo) -> bool {
 }
 
 /// Stage patch sources for a VENDOR run without writing anything:
-/// a record is locally satisfied when all its after-blobs are on disk or
-/// a package archive is (a diff archive is NOT sufficient — vendor's
+/// a record is locally satisfied when all its after-blobs are on disk (a
+/// diff archive is NOT sufficient — vendor's
 /// auto-force policy can need the full after-blob for files a diff cannot
 /// reproduce); anything else has its full per-file content fetched into
 /// memory from the patch view endpoint (`blobContent`), preceded by the
@@ -570,10 +546,8 @@ pub(crate) async fn stage_vendor_sources_in_memory(
 ) -> MemStageOutcome {
     let blobs = socket_dir.join("blobs");
     let diffs = socket_dir.join("diffs");
-    let packages = socket_dir.join("packages");
 
     let missing_blobs = get_missing_blobs(manifest, &blobs).await;
-    let missing_package_archives = get_missing_archives(manifest, &packages).await;
     let mut mem = seed;
     let mut unavailable: Vec<(String, String)> = Vec::new();
 
@@ -581,7 +555,7 @@ pub(crate) async fn stage_vendor_sources_in_memory(
     // stager: vendoring runs the auto-force policy, where a beforeHash
     // mismatch (already-applied tree, patch built against different bytes)
     // is overwritten with the FULL after-blob — which a diff cannot
-    // produce. On-disk diffs still serve Strategy 2 for clean files; the
+    // produce. On-disk diffs still serve Strategy 1 for clean files; the
     // after-blob content must additionally exist (disk, seed/harvest, or
     // fetch).
     //
@@ -599,7 +573,7 @@ pub(crate) async fn stage_vendor_sources_in_memory(
             !needs_blob(f)
                 || !missing_blobs.contains(&f.after_hash)
                 || mem.contains_key(&f.after_hash)
-        }) || !missing_package_archives.contains(&record.uuid)
+        })
     };
     let mut to_fetch: Vec<(&str, &str)> = manifest
         .patches
@@ -795,7 +769,6 @@ pub(crate) async fn stage_vendor_sources_in_memory(
     MemStageOutcome::Ready(MemStagedSources {
         blobs,
         diffs,
-        packages,
         mem,
         unavailable,
     })
@@ -1227,12 +1200,10 @@ mod tests {
         }
     }
 
-    /// A local package archive is a usable source (the pipeline's Strategy 1,
-    /// and exactly what the offline gate rules), so an online run whose
-    /// downloads all fail must still be Ready when the package archive covers
-    /// every patch, exactly as it succeeds with --offline.
+    /// A leftover legacy `.socket/packages/<uuid>.tar.gz` is not a source:
+    /// nothing reads it, so it must not mask failed downloads.
     #[tokio::test]
-    async fn stage_online_fetch_failure_accepts_local_package_archive() {
+    async fn stage_online_fetch_failure_ignores_legacy_package_archive() {
         let tmp = tempfile::tempdir().unwrap();
         let socket_dir = tmp.path().join(".socket");
         std::fs::create_dir_all(socket_dir.join("packages")).unwrap();
@@ -1252,8 +1223,8 @@ mod tests {
         .await
         .expect("no hard failure");
         assert!(
-            matches!(outcome, StageOutcome::Ready(_)),
-            "a local package archive covers the patch even when every download fails"
+            matches!(outcome, StageOutcome::Unavailable),
+            "a legacy package archive must not cover the patch"
         );
     }
 
diff --git a/crates/socket-patch-cli/src/commands/get.rs b/crates/socket-patch-cli/src/commands/get.rs
index 55d9fef7..16a34a65 100644
--- a/crates/socket-patch-cli/src/commands/get.rs
+++ b/crates/socket-patch-cli/src/commands/get.rs
@@ -430,23 +430,6 @@ pub struct GetArgs {
     )]
     pub save_only: bool,
 
-    /// Apply the patch without saving it to the .socket folder (not yet
-    /// implemented).
-    // Hidden: it always fails with "not yet implemented" (see `run`), but
-    // stays parseable so scripts and `SOCKET_ONE_OFF` keep getting that
-    // explicit error instead of a clap parse failure.
-    // `value_parser = parse_bool_flag`: same reason as `--save-only` above —
-    // and `SOCKET_ONE_OFF` is shared with `rollback --one-off`, which parses
-    // boolishly too; the two must not diverge.
-    #[arg(
-        long = "one-off",
-        env = "SOCKET_ONE_OFF",
-        default_value_t = false,
-        value_parser = crate::args::parse_bool_flag,
-        hide = true,
-    )]
-    pub one_off: bool,
-
     /// Download patches for every release variant of a matched package,
     /// not just the one matching the locally-installed distribution.
     ///
@@ -2565,13 +2548,6 @@ pub async fn run(args: GetArgs) -> i32 {
         );
         return 2;
     }
-    if args.one_off && args.save_only {
-        report_error(
-            args.common.json,
-            "--one-off and --save-only cannot be used together",
-        );
-        return 2;
-    }
     // v5: hosted by default, like scan. `--save-only` (records a manifest
     // entry) and global installs (no project lockfile) mean agent mode.
     // Usage errors exit 2, like clap's and scan's (v5.0).
@@ -2592,14 +2568,6 @@ pub async fn run(args: GetArgs) -> i32 {
         );
         return 2;
     }
-    if args.one_off {
-        // The flag parses but is not implemented: fail loudly rather than
-        // save to the manifest anyway. Mirrors `rollback --one-off`'s
-        // not-yet-implemented contract; rejected before any network or disk
-        // activity.
-        report_error(args.common.json, "One-off get mode is not yet implemented");
-        return 2;
-    }
     // Strict airgap (CLI_CONTRACT.md `--offline`: never contact the
     // network; operations that need remote data fail loudly). Every `get`
     // mode fetches remote patch data — proceeding would hit the API (and
@@ -5609,8 +5577,6 @@ mod tests {
             "parse_bool_flag",
             "No env binding",
             "locally- installed",
-            "SOCKET_ONE_OFF",
-            "--one-off",
         ] {
             assert!(!help.contains(leak), "get --help leaks {leak:?}:\n{help}");
         }
@@ -5705,7 +5671,7 @@ mod tests {
         use wiremock::matchers::{method, path as wm_path};
         use wiremock::{Mock, MockServer, ResponseTemplate};
 
-        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL", "SOCKET_PATCH_PROXY_URL"]);
+        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL"]);
         let server = MockServer::start().await;
         let uuid = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
         let purl = "pkg:npm/covgap-no-after@1.0.0";
@@ -5749,7 +5715,7 @@ mod tests {
     async fn download_patch_records_view_404_is_fetch_miss() {
         use wiremock::MockServer;
 
-        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL", "SOCKET_PATCH_PROXY_URL"]);
+        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL"]);
         // No view mock mounted: wiremock answers 404, which the API client
         // maps to Ok(None) — the "could not fetch details" fetch-miss arm.
         let server = MockServer::start().await;
@@ -5776,7 +5742,7 @@ mod tests {
     async fn download_patch_records_uninstalled_variant_base_warns_and_keeps_all() {
         use wiremock::MockServer;
 
-        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL", "SOCKET_PATCH_PROXY_URL"]);
+        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL"]);
         // Two qualified PyPI variants sharing an UNINSTALLED base: release
         // narrowing must keep both (with the not-installed warning), and the
         // warnings key must ride the detached envelope. Views stay unmounted
@@ -6063,7 +6029,7 @@ mod tests {
         use wiremock::matchers::{method, path as wm_path};
         use wiremock::{Mock, MockServer, ResponseTemplate};
 
-        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL", "SOCKET_PATCH_PROXY_URL"]);
+        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL"]);
         let server = MockServer::start().await;
         let uuid = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
         let purl = "pkg:npm/covgap-blobfail@1.0.0";
@@ -6114,7 +6080,7 @@ mod tests {
         use wiremock::matchers::{method, path as wm_path};
         use wiremock::{Mock, MockServer, ResponseTemplate};
 
-        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL", "SOCKET_PATCH_PROXY_URL"]);
+        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL"]);
         let server = MockServer::start().await;
         let uuid = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
         let purl = "pkg:npm/covgap-badblob@1.0.0";
@@ -6168,7 +6134,7 @@ mod tests {
         use wiremock::matchers::{method, path as wm_path};
         use wiremock::{Mock, MockServer, ResponseTemplate};
 
-        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL", "SOCKET_PATCH_PROXY_URL"]);
+        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL"]);
         let server = MockServer::start().await;
         let good_uuid = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
         let good_purl = "pkg:npm/covgap-good@1.0.0";
@@ -6248,7 +6214,7 @@ mod tests {
     async fn download_patch_records_already_vendored_detached_skips_offline() {
         use wiremock::MockServer;
 
-        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL", "SOCKET_PATCH_PROXY_URL"]);
+        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL"]);
         let server = MockServer::start().await; // trap: no mounts
         let tmp = tempfile::tempdir().unwrap();
         let uuid = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
@@ -6354,7 +6320,7 @@ mod tests {
         use wiremock::matchers::{method, path as wm_path};
         use wiremock::{Mock, MockServer, ResponseTemplate};
 
-        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL", "SOCKET_PATCH_PROXY_URL"]);
+        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL"]);
         let server = MockServer::start().await;
         let uuid = "cccccccc-cccc-4ccc-8ccc-cccccccccccc";
         let purl = "pkg:npm/covgap-bun@1.0.0";
@@ -6411,7 +6377,7 @@ mod tests {
     async fn download_patch_records_bun_v1_workspace_refuses_before_fetch() {
         use wiremock::MockServer;
 
-        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL", "SOCKET_PATCH_PROXY_URL"]);
+        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL"]);
         let server = MockServer::start().await; // trap: no mounts
         let tmp = tempfile::tempdir().unwrap();
         std::fs::write(tmp.path().join("bun.lock"), BUN_V1_WORKSPACE_LOCK).unwrap();
@@ -6452,7 +6418,7 @@ mod tests {
     async fn download_patch_records_bun_refusal_skips_non_npm_purls() {
         use wiremock::MockServer;
 
-        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL", "SOCKET_PATCH_PROXY_URL"]);
+        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL"]);
         let server = MockServer::start().await;
         let tmp = tempfile::tempdir().unwrap();
         std::fs::write(tmp.path().join("bun.lockb"), b"\x00binary").unwrap();
@@ -6483,7 +6449,7 @@ mod tests {
     async fn download_patch_records_bun_refusal_rejects_unwired_ledger_entries() {
         use wiremock::MockServer;
 
-        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL", "SOCKET_PATCH_PROXY_URL"]);
+        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL"]);
         let server = MockServer::start().await;
         let tmp = tempfile::tempdir().unwrap();
         std::fs::write(tmp.path().join("bun.lock"), BUN_V1_WORKSPACE_LOCK).unwrap();
@@ -6706,7 +6672,7 @@ mod tests {
     async fn download_patch_records_with_prefetched_view_never_fetches() {
         use wiremock::MockServer;
 
-        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL", "SOCKET_PATCH_PROXY_URL"]);
+        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL"]);
         let server = MockServer::start().await; // trap: no mounts
         let tmp = tempfile::tempdir().unwrap();
         // Two files: one with served `blobContent` (→ the blob seed), one
@@ -6774,7 +6740,7 @@ mod tests {
         use wiremock::matchers::{method, path as wm_path};
         use wiremock::{Mock, MockServer, ResponseTemplate};
 
-        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL", "SOCKET_PATCH_PROXY_URL"]);
+        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL"]);
         let server = MockServer::start().await;
         let purl = "pkg:npm/covgap-supersede@1.0.0";
         let old_uuid = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
@@ -6844,7 +6810,7 @@ mod tests {
         use wiremock::matchers::{method, path as wm_path};
         use wiremock::{Mock, MockServer, ResponseTemplate};
 
-        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL", "SOCKET_PATCH_PROXY_URL"]);
+        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL"]);
         let server = MockServer::start().await;
         let uuid = |c: char| {
             format!("{0}{0}{0}{0}{0}{0}{0}{0}-{0}{0}{0}{0}-4{0}{0}{0}-8{0}{0}{0}-{0}{0}{0}{0}{0}{0}{0}{0}{0}{0}{0}{0}", c)
@@ -7019,7 +6985,7 @@ mod tests {
         use wiremock::matchers::{method, path as wm_path};
         use wiremock::{Mock, MockServer, ResponseTemplate};
 
-        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL", "SOCKET_PATCH_PROXY_URL"]);
+        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL"]);
         let site = tempfile::tempdir().unwrap();
         // Two installed pypi distributions, each with its own bytes.
         let installed = |name: &str, body: &[u8]| {
@@ -7235,7 +7201,7 @@ mod tests {
     async fn download_patches_json_is_purl_ordered() {
         use wiremock::MockServer;
 
-        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL", "SOCKET_PATCH_PROXY_URL"]);
+        let _env = EnvVarGuard::scrub(&["SOCKET_PROXY_URL"]);
         let server = MockServer::start().await;
         let tmp = tempfile::tempdir().unwrap();
         let names = [
diff --git a/crates/socket-patch-cli/src/commands/remove.rs b/crates/socket-patch-cli/src/commands/remove.rs
index 3d72b58c..3287aa81 100644
--- a/crates/socket-patch-cli/src/commands/remove.rs
+++ b/crates/socket-patch-cli/src/commands/remove.rs
@@ -960,8 +960,9 @@ pub async fn run(args: RemoveArgs) -> i32 {
                 );
             }
         }
-        // Diff/package archives use the same manifest-uuid keep rule
-        // (parity with repair and scan --prune).
+        // Diff archives use the same manifest-uuid keep rule; legacy
+        // package archives are swept whole (parity with repair and scan
+        // --prune).
         for (dir, result) in [("diffs", sweep.diffs), ("packages", sweep.packages)] {
             if let Some(detail) = sweep_failure(dir, &result) {
                 if loud {
diff --git a/crates/socket-patch-cli/src/commands/repair.rs b/crates/socket-patch-cli/src/commands/repair.rs
index 9444b0ac..69cdecb8 100644
--- a/crates/socket-patch-cli/src/commands/repair.rs
+++ b/crates/socket-patch-cli/src/commands/repair.rs
@@ -345,7 +345,6 @@ fn format_final_line(
 /// The `.socket/` source directories a download pass writes into.
 struct SourcePaths<'a> {
     blobs: &'a Path,
-    packages: &'a Path,
     diffs: &'a Path,
 }
 
@@ -406,7 +405,6 @@ async fn download_pass(
     let client = client.as_ref().expect("client built just above");
     let sources = PatchSources {
         blobs_path: paths.blobs,
-        packages_path: Some(paths.packages),
         diffs_path: Some(paths.diffs),
         mem_blobs: None,
     };
@@ -473,7 +471,6 @@ async fn repair_inner(
     let socket_dir = crate::args::socket_dir_of(manifest_path, &args.common.cwd);
     let blobs_path = socket_dir.join("blobs");
     let diffs_path = socket_dir.join("diffs");
-    let packages_path = socket_dir.join("packages");
 
     let download_mode =
         DownloadMode::parse(&args.common.download_mode).map_err(|e| e.to_string())?;
@@ -553,7 +550,6 @@ async fn repair_inner(
     let noun = download_mode.noun();
     let paths = SourcePaths {
         blobs: &blobs_path,
-        packages: &packages_path,
         diffs: &diffs_path,
     };
     // Whether stdout already carries a line, so the blank separators
@@ -994,18 +990,22 @@ mod tests {
         );
     }
 
-    /// Cleanup must sweep orphaned diff *and* package archives in addition to
-    /// blobs, and the reclaimed counts/bytes from all three directories must
-    /// aggregate into a single `RepairCounts`. Guards against a regression
-    /// where a cleanup pass uses the wrong directory or drops its tallies.
+    /// Cleanup must sweep orphaned diff archives and every legacy
+    /// `.socket/packages/` archive (nothing reads them, so even one named
+    /// after a manifest UUID goes) in addition to blobs, and the reclaimed
+    /// counts/bytes from all three directories must aggregate into a single
+    /// `RepairCounts`. Guards against a regression where a cleanup pass uses
+    /// the wrong directory or drops its tallies.
     #[tokio::test]
     async fn cleanup_sweeps_diff_and_package_archives() {
         let tmp = tempfile::tempdir().unwrap();
         let socket = make_socket(tmp.path());
 
-        // Referenced archives (named after the manifest UUID) must survive.
+        // A referenced diff archive (named after the manifest UUID) must
+        // survive; a legacy package archive under the same name must not.
         write_archive(&socket, "diffs", REFERENCED_UUID, b"kept-diff");
-        write_archive(&socket, "packages", REFERENCED_UUID, b"kept-package");
+        let legacy_pkg = b"legacy package"; // 14 bytes
+        write_archive(&socket, "packages", REFERENCED_UUID, legacy_pkg);
 
         // Orphan archives (unknown UUIDs) must be swept.
         let orphan_diff = b"orphan diff archive bytes"; // 25 bytes
@@ -1029,16 +1029,17 @@ mod tests {
                 .await
                 .expect("repair_inner");
 
-        // Two orphans removed (one diff, one package); the referenced ones stay.
-        assert_eq!(counts.cleaned, 2, "both orphan archives should be swept");
+        // Both orphans and the legacy package archive go; the referenced
+        // diff archive stays.
+        assert_eq!(counts.cleaned, 3, "orphans and legacy archives should be swept");
         assert_eq!(
             counts.bytes_freed,
-            (orphan_diff.len() + orphan_pkg.len()) as u64,
+            (orphan_diff.len() + orphan_pkg.len() + legacy_pkg.len()) as u64,
             "bytes_freed must aggregate diff + package reclaim"
         );
         // Cleanup is reported as a SINGLE batched `removed` artifact event whose
         // `details.count` carries the tally — so the event-count summary is 1
-        // (`Summary::bump` increments once per event), and the 2-artifact count
+        // (`Summary::bump` increments once per event), and the 3-artifact count
         // is asserted via `counts.cleaned` above and the event details here.
         assert_eq!(env.summary.removed, 1, "one batched removal event");
         let removed = env
@@ -1052,15 +1053,15 @@ mod tests {
                 .as_ref()
                 .and_then(|d| d.get("count"))
                 .and_then(serde_json::Value::as_u64),
-            Some(2),
-            "the batched removal event must report 2 swept artifacts"
+            Some(3),
+            "the batched removal event must report 3 swept artifacts"
         );
 
         assert!(socket
             .join("diffs")
             .join(format!("{REFERENCED_UUID}.tar.gz"))
             .exists());
-        assert!(socket
+        assert!(!socket
             .join("packages")
             .join(format!("{REFERENCED_UUID}.tar.gz"))
             .exists());
diff --git a/crates/socket-patch-cli/src/commands/rollback.rs b/crates/socket-patch-cli/src/commands/rollback.rs
index a84a1b3f..79c9a239 100644
--- a/crates/socket-patch-cli/src/commands/rollback.rs
+++ b/crates/socket-patch-cli/src/commands/rollback.rs
@@ -100,21 +100,6 @@ pub struct RollbackArgs {
     #[command(flatten)]
     pub common: GlobalArgs,
 
-    // `value_parser = parse_bool_flag` matches the `GlobalArgs` bool flags:
-    // clap's default bool parser accepts only the literal strings
-    // `true`/`false` from the env binding, so `SOCKET_ONE_OFF=1` (or an
-    // exported-but-empty `SOCKET_ONE_OFF=`) aborted every `rollback`
-    // invocation. This flag is also outside `GLOBAL_ARG_ENV_VARS`, so
-    // `main`'s empty-var scrub never rescues it.
-    /// Roll back a patch by fetching beforeHash blobs from the API (no manifest required).
-    #[arg(
-        long = "one-off",
-        env = "SOCKET_ONE_OFF",
-        default_value_t = false,
-        value_parser = parse_bool_flag,
-    )]
-    pub one_off: bool,
-
     /// Restore the system (files and lockfiles) but PRESERVE the local
     /// patch state for a later re-apply: manifest entries are kept,
     /// vendored artifacts and their ledger entries are kept (only the
@@ -848,7 +833,14 @@ pub(crate) async fn sweep_unused_artifacts(
     ArtifactSweep {
         blobs: cleanup_unused_blobs(reference, &socket_dir.join("blobs"), dry_run).await,
         diffs: cleanup_unused_archives(reference, &socket_dir.join("diffs"), dry_run).await,
-        packages: cleanup_unused_archives(reference, &socket_dir.join("packages"), dry_run).await,
+        // Nothing writes or reads `.socket/packages/` any more; sweep the
+        // leftover directory whole.
+        packages: cleanup_unused_archives(
+            &PatchManifest::default(),
+            &socket_dir.join("packages"),
+            dry_run,
+        )
+        .await,
     }
 }
 
@@ -1077,8 +1069,8 @@ pub(crate) async fn retire_legacy_redirect_ledger(common: &GlobalArgs) -> Option
 pub async fn run(args: RollbackArgs) -> i32 {
     apply_env_toggles(&args.common);
 
-    // Classify targets up front: the one-off stub and the glob validation
-    // are pre-network usage checks.
+    // Classify targets up front: the glob validation is a pre-network
+    // usage check.
     let mut identifiers: Vec<String> = Vec::new();
     let mut path_patterns: Vec<String> = Vec::new();
     for token in &args.targets {
@@ -1088,32 +1080,6 @@ pub async fn run(args: RollbackArgs) -> i32 {
         }
     }
 
-    // Bail on the unimplemented flag BEFORE constructing the API client:
-    // client construction can auto-resolve the org slug over the network,
-    // and the contract promises the one-off stub fails before any network
-    // or disk activity.
-    if args.one_off {
-        let msg = if identifiers.is_empty() {
-            "--one-off requires an identifier (UUID or PURL)"
-        } else {
-            "One-off rollback mode is not yet implemented"
-        };
-        if args.common.json {
-            println!(
-                "{}",
-                serde_json::to_string_pretty(&serde_json::json!({
-                    "status": "error",
-                    "error": msg,
-                }))
-                .expect("serializing an in-memory JSON value cannot fail")
-            );
-        } else {
-            eprintln!("Error: {msg}");
-        }
-        // A usage error (v5.0: exit 2, like every other one).
-        return 2;
-    }
-
     // An unparseable glob is a usage error — same exit-2 stderr shape as
     // scan's self-enforced mode conflicts.
     let path_scope = match crate::path_scope::PathScope::parse(&path_patterns) {
@@ -4590,7 +4556,7 @@ mod tests {
         assert_eq!(capitalize_first("path pattern x"), "Path pattern x");
         assert_eq!(capitalize_first("Already"), "Already");
         assert_eq!(capitalize_first("ülk"), "Ülk");
-        assert_eq!(capitalize_first("--one-off"), "--one-off");
+        assert_eq!(capitalize_first("--preserve-state"), "--preserve-state");
         assert_eq!(capitalize_first("cannot read x: y"), "Cannot read x: y");
         assert_eq!(capitalize_first("can't, really"), "Can't, really");
         // Values the user may copy back are never altered.
diff --git a/crates/socket-patch-cli/src/commands/scan/hosted.rs b/crates/socket-patch-cli/src/commands/scan/hosted.rs
index b0afa29c..6c999e80 100644
--- a/crates/socket-patch-cli/src/commands/scan/hosted.rs
+++ b/crates/socket-patch-cli/src/commands/scan/hosted.rs
@@ -1,4 +1,4 @@
-//! The hosted-mode (`--mode hosted` / `--redirect`) flow: rewrite ONLY the
+//! The hosted-mode (`--mode hosted`) flow: rewrite ONLY the
 //! patched dependencies' lockfile / registry-config entries to point at
 //! Socket's hosted vendored patches. Self-contained — reuses `run`'s
 //! discovery, then returns without touching the apply/vendor branches.
@@ -2523,7 +2523,6 @@ mod tests {
             token: "tok".to_string(),
             patch_uuid: "11111111-1111-4111-8111-111111111111".to_string(),
             artifact_url: artifact_url.to_string(),
-            berry_zip_url: None,
             registry_override: None,
             integrity: Default::default(),
         }
diff --git a/crates/socket-patch-cli/src/commands/scan/hosted/vlt.rs b/crates/socket-patch-cli/src/commands/scan/hosted/vlt.rs
index 376526ab..c53b32dd 100644
--- a/crates/socket-patch-cli/src/commands/scan/hosted/vlt.rs
+++ b/crates/socket-patch-cli/src/commands/scan/hosted/vlt.rs
@@ -579,7 +579,6 @@ mod tests {
             token: String::new(),
             patch_uuid: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa".into(),
             artifact_url: url.to_string(),
-            berry_zip_url: None,
             registry_override: None,
             integrity: socket_patch_core::patch::redirect::Integrity {
                 sha512: Some("sha512-new".into()),
diff --git a/crates/socket-patch-cli/src/commands/scan/mod.rs b/crates/socket-patch-cli/src/commands/scan/mod.rs
index cf1bb5c8..aa7b2ead 100644
--- a/crates/socket-patch-cli/src/commands/scan/mod.rs
+++ b/crates/socket-patch-cli/src/commands/scan/mod.rs
@@ -139,8 +139,8 @@ fn batch_chunks(purls: &[String], batch_size: usize, max_body_bytes: usize) -> V
 }
 
 /// The three patch-application modes `scan` can drive, selectable via
-/// `--mode` (the documented spelling). Each variant is equivalent to one
-/// legacy boolean flag, which remains supported as an alias.
+/// `--mode`. Vendored and agent also keep a hidden deprecated boolean
+/// spelling (`--vendor`, `--apply`/`--sync`).
 //
 // The `///` docs on the variants are user-facing `--help` text (shared
 // with `get --mode`); keep implementation notes in `//` comments.
@@ -149,15 +149,10 @@ pub enum ScanMode {
     /// Rewrite lockfiles so only patched dependencies resolve to Socket's
     /// hosted patch server: no artifact bytes land in the repo, but
     /// installs must reach the patch server
-    // Equivalent to the hidden `--redirect` boolean. The hidden value
-    // aliases mirror legacy spellings (`apply` is deliberately NOT an alias
-    // of agent).
-    #[value(alias = "host", alias = "redirect")]
     Hosted,
     /// Commit patched artifacts to `.socket/vendor/`: hermetic,
     /// offline-safe installs at the cost of repo size
     // Equivalent to `--vendor`.
-    #[value(alias = "vendor")]
     Vendored,
     /// Record patches in `.socket/manifest.json` plus blobs and re-apply
     /// them in place (e.g. from CI): smallest repo footprint, but every
@@ -178,8 +173,8 @@ impl ScanMode {
     }
 }
 
-/// Fold the legacy boolean spellings (`--redirect` / `--vendor` /
-/// `--apply` / `--sync`) into `args.mode`, so `ScanMode` is the single
+/// Fold the boolean spellings (`--vendor` / `--apply` / `--sync`) into
+/// `args.mode`, so `ScanMode` is the single
 /// source of truth everything downstream reads (the booleans are input
 /// spellings only, never consulted after this returns), and enforce the
 /// cross-flag rules clap cannot express:
@@ -196,8 +191,6 @@ impl ScanMode {
 ///   Hosted mode runs no GC, so `--mode hosted --prune` stays accepted but
 ///   emits an explicit `redirect_prune_ignored` warning in `run` rather
 ///   than silently dropping the flag.
-/// * `--detached` requires vendored mode in either spelling (clap's
-///   `requires = "vendor"` cannot see `--mode vendored`).
 ///
 /// Public (not `pub(crate)`) so the CLI-contract tests can exercise the
 /// fold without driving a full `run()`.
@@ -205,9 +198,6 @@ pub fn resolve_mode_flags(args: &mut ScanArgs) -> Result<(), String> {
     if let Some(mode) = args.mode {
         // First boolean that selects a mode OTHER than the requested one.
         let mut conflicting: Option<&'static str> = None;
-        if args.redirect && mode != ScanMode::Hosted {
-            conflicting = Some("--redirect");
-        }
         if args.vendor && mode != ScanMode::Vendored {
             conflicting = Some("--vendor");
         }
@@ -220,20 +210,13 @@ pub fn resolve_mode_flags(args: &mut ScanArgs) -> Result<(), String> {
         if let Some(flag) = conflicting {
             // "cannot be used with" phrasing matches clap's conflict errors —
             // the scan_vendor_e2e contract test accepts exactly that shape.
-            // The hidden --redirect is only explained when it was typed.
-            let meaning = if flag == "--redirect" {
-                "--redirect means --mode hosted"
-            } else {
-                "--vendor means --mode vendored; --apply and --sync mean --mode agent"
-            };
             return Err(format!(
                 "--mode {} cannot be used with {flag}: the flags select different \
-                 modes ({meaning})",
+                 modes (--vendor means --mode vendored; --apply and --sync mean \
+                 --mode agent)",
                 mode.cli_name(),
             ));
         }
-    } else if args.redirect {
-        args.mode = Some(ScanMode::Hosted);
     } else if args.vendor {
         args.mode = Some(ScanMode::Vendored);
     } else if args.apply || args.sync {
@@ -258,14 +241,6 @@ pub fn resolve_mode_flags(args: &mut ScanArgs) -> Result<(), String> {
             },
         ));
     }
-    if args.detached && args.mode != Some(ScanMode::Vendored) {
-        // "required" phrasing matches clap's requires errors — the
-        // scan_vendor_e2e contract test accepts exactly that shape.
-        return Err(
-            "--detached requires vendored mode: --mode vendored or --vendor is required"
-                .to_string(),
-        );
-    }
     Ok(())
 }
 
@@ -314,27 +289,13 @@ pub struct ScanArgs {
     #[arg(long, default_value_t = false, hide = true, conflicts_with_all = ["apply", "sync"])]
     pub vendor: bool,
 
-    /// Accepted for compatibility; has no effect
-    // Hidden: vendored mode is always manifest-free (the vendor ledger
-    // embeds each patch record and `.socket/manifest.json` is never
-    // written), so the flag is a no-op. It still requires vendored mode in
-    // either spelling (`--mode vendored` / `--vendor`), enforced in
-    // `resolve_mode_flags` rather than clap `requires` so `--mode vendored`
-    // satisfies it too.
-    #[arg(long, default_value_t = false, hide = true)]
-    pub detached: bool,
-
-    // Hidden legacy spelling of `--mode hosted`.
-    #[arg(long, default_value_t = false, hide = true, conflicts_with_all = ["apply", "sync", "vendor"])]
-    pub redirect: bool,
-
     /// How discovered patches are consumed [default: hosted]. A `--prune`
     /// or `--global` scan with no mode only reports
-    // The hidden `--vendor` and `--apply` are older spellings of
-    // `--mode vendored` and `--mode agent`. Each mode is equivalent to one
-    // boolean flag (hosted == the hidden `--redirect`, vendored == `--vendor`, agent == `--apply`/`--sync`).
-    // Combining `--mode` with a boolean from a DIFFERENT mode is rejected in
-    // `resolve_mode_flags`; the same mode spelled both ways is accepted.
+    // The hidden `--vendor` and `--apply` are deprecated spellings of
+    // `--mode vendored` and `--mode agent` (`--sync` also selects agent);
+    // hosted has no boolean spelling. Combining `--mode` with a boolean
+    // from a DIFFERENT mode is rejected in `resolve_mode_flags`; the same
+    // mode spelled both ways is accepted.
     #[arg(long = "mode", value_enum)]
     pub mode: Option<ScanMode>,
 
diff --git a/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs b/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs
index db4aa9bb..eb38a147 100644
--- a/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs
+++ b/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs
@@ -9,8 +9,7 @@
 //! embeds each record in its ledger entry (`detached: true`), and
 //! `.socket/manifest.json` is never written — a project vendored by an
 //! older, manifest-mode CLI is migrated on its next vendored run (see
-//! [`migrate_legacy_manifest_records`]). `--detached` is accepted as a
-//! no-op for compatibility.
+//! [`migrate_legacy_manifest_records`]).
 //!
 //! One API client per run: `scan`/`get` build it once (proxy fallback
 //! included) and thread it through the download phase and into the vendor
diff --git a/crates/socket-patch-cli/src/commands/vendor.rs b/crates/socket-patch-cli/src/commands/vendor.rs
index 093de219..ef05f992 100644
--- a/crates/socket-patch-cli/src/commands/vendor.rs
+++ b/crates/socket-patch-cli/src/commands/vendor.rs
@@ -4075,7 +4075,6 @@ mod dispatch_tests {
         };
         let sources = PatchSources {
             blobs_path: tmp.path(),
-            packages_path: None,
             diffs_path: None,
             mem_blobs: None,
         };
@@ -4387,7 +4386,6 @@ mod variant_probe_tests {
         };
         let sources = PatchSources {
             blobs_path: tmp.path(),
-            packages_path: None,
             diffs_path: None,
             mem_blobs: None,
         };
@@ -4471,7 +4469,6 @@ mod variant_probe_tests {
         };
         let sources = PatchSources {
             blobs_path: tmp.path(),
-            packages_path: None,
             diffs_path: None,
             mem_blobs: None,
         };
diff --git a/crates/socket-patch-cli/src/commands/vendored_backend/repair.rs b/crates/socket-patch-cli/src/commands/vendored_backend/repair.rs
index 2744cd6a..a12e8f8d 100644
--- a/crates/socket-patch-cli/src/commands/vendored_backend/repair.rs
+++ b/crates/socket-patch-cli/src/commands/vendored_backend/repair.rs
@@ -1303,7 +1303,6 @@ mod tests {
                 token: String::new(),
                 patch_uuid: uuid.into(),
                 artifact_url: format!("./.socket/vendor/npm/{uuid}/minimist-1.2.2.tgz"),
-                berry_zip_url: None,
                 registry_override: None,
                 integrity: Integrity {
                     sha512: Some(format!("sha512-{}", "A".repeat(86) + "==")),
diff --git a/crates/socket-patch-cli/src/json_envelope.rs b/crates/socket-patch-cli/src/json_envelope.rs
index a0eaabe5..22f752f5 100644
--- a/crates/socket-patch-cli/src/json_envelope.rs
+++ b/crates/socket-patch-cli/src/json_envelope.rs
@@ -350,7 +350,6 @@ pub enum PatchAction {
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub enum AppliedVia {
-    Package,
     Diff,
     Blob,
 }
@@ -359,7 +358,6 @@ impl AppliedVia {
     pub fn from_core(via: socket_patch_core::patch::apply::AppliedVia) -> Self {
         use socket_patch_core::patch::apply::AppliedVia as Core;
         match via {
-            Core::Package => AppliedVia::Package,
             Core::Diff => AppliedVia::Diff,
             Core::Blob => AppliedVia::Blob,
         }
diff --git a/crates/socket-patch-cli/src/lib.rs b/crates/socket-patch-cli/src/lib.rs
index 38ad79dd..371a8c88 100644
--- a/crates/socket-patch-cli/src/lib.rs
+++ b/crates/socket-patch-cli/src/lib.rs
@@ -181,7 +181,7 @@ fn short_help_hidden_own(sub: &str) -> &'static [&'static str] {
             "vex_doc_id",
             "vex_compact",
         ],
-        "get" => &["id", "cve", "ghsa", "package", "save_only", "one_off", "all_releases"],
+        "get" => &["id", "cve", "ghsa", "package", "save_only", "all_releases"],
         "vex" => &["doc_id", "compact"],
         "apply" => &["vex_product", "vex_no_verify", "vex_doc_id", "vex_compact"],
         "vendor" => &["vex_product", "vex_no_verify", "vex_doc_id", "vex_compact"],
diff --git a/crates/socket-patch-cli/src/main.rs b/crates/socket-patch-cli/src/main.rs
index 57947511..418403a1 100644
--- a/crates/socket-patch-cli/src/main.rs
+++ b/crates/socket-patch-cli/src/main.rs
@@ -1,5 +1,5 @@
 use socket_patch_cli::{commands, parse_argv_with_shortcuts, Commands};
-use socket_patch_core::utils::env_compat::{promote_legacy_env_vars, promote_peer_env_vars};
+use socket_patch_core::utils::env_compat::promote_peer_env_vars;
 use socket_patch_core::utils::socket_cli_config;
 
 /// Restore the default SIGPIPE disposition. The Rust runtime starts every
@@ -23,16 +23,11 @@ fn restore_default_sigpipe() {}
 
 #[tokio::main]
 async fn main() {
-    // Must precede any output: the deprecation warnings and clap help both
-    // write to possibly-already-closed pipes.
+    // Must precede any output: clap help writes to a possibly-already-closed
+    // pipe.
     restore_default_sigpipe();
 
-    // Migrate legacy SOCKET_PATCH_* env vars into the new SOCKET_* names
-    // before clap parses, so downstream code only needs to know the new
-    // names. A one-shot deprecation warning fires per legacy name set.
-    promote_legacy_env_vars();
-
-    // Then accept the JS socket-cli's SOCKET_CLI_* peer names (silently —
+    // Accept the JS socket-cli's SOCKET_CLI_* peer names (silently —
     // they are aliases, not deprecations) so `socket login` / socket-cli
     // env setups work for socket-patch unchanged. Canonical names win.
     promote_peer_env_vars();
@@ -47,8 +42,7 @@ async fn main() {
 
     // Then drop exported-but-empty SOCKET_* flag vars — global and
     // subcommand-local (`SOCKET_CWD=` means "unset", not "crash the
-    // parse"). Must run after the promotion so a blanked legacy name is
-    // scrubbed too.
+    // parse").
     socket_patch_cli::args::scrub_empty_env_vars();
 
     // The parser surface is `String`-typed, but argv is raw bytes on Unix —
diff --git a/crates/socket-patch-cli/tests/apply_network.rs b/crates/socket-patch-cli/tests/apply_network.rs
index 431c8da9..837057e1 100644
--- a/crates/socket-patch-cli/tests/apply_network.rs
+++ b/crates/socket-patch-cli/tests/apply_network.rs
@@ -901,22 +901,20 @@ fn write_package_archive(packages: &Path, uuid: &str, entries: &[(&str, &[u8])])
         .unwrap();
 }
 
-/// A cached `.socket/packages/<uuid>.tar.gz` is a complete source for the
-/// patch: the same tree applies fine under `--offline`. Going online must
-/// not make it FAIL: when the (default) diff fetch and the blob fallback
-/// both fail (no archives served, blob GC'd, entitlement change, dead
-/// network), the stage step must only bail if some patch is actually left
-/// without a source.
+/// A leftover `.socket/packages/<uuid>.tar.gz` (v5.0 no longer reads package
+/// archives) is not a patch source: when the diff fetch and the blob
+/// fallback both fail, apply must report the patch as unavailable instead of
+/// silently patching from the stale archive.
 #[tokio::test]
-async fn apply_online_uses_cached_package_archive_when_downloads_fail() {
+async fn apply_online_ignores_legacy_package_archive_when_downloads_fail() {
     let before = b"pkgcache before\n";
     let after = b"pkgcache after\n";
     let before_hash = git_sha256(before);
     let after_hash = git_sha256(after);
     let uuid = "44444444-4444-4444-8444-444444444444";
 
-    // Nothing is served: diff, package and blob endpoints all 404 (wiremock
-    // default for unmounted routes), i.e. every download attempt fails.
+    // Nothing is served: diff and blob endpoints 404 (wiremock default for
+    // unmounted routes), i.e. every download attempt fails.
     let mock = MockServer::start().await;
 
     let tmp = tempfile::tempdir().expect("tempdir");
@@ -930,8 +928,6 @@ async fn apply_online_uses_cached_package_archive_when_downloads_fail() {
         &before_hash,
         &after_hash,
     );
-    // The only local source: a package archive holding the patched bytes
-    // (what `repair --download-mode package` leaves behind). No blobs.
     write_package_archive(
         &socket.join("packages"),
         uuid,
@@ -939,25 +935,13 @@ async fn apply_online_uses_cached_package_archive_when_downloads_fail() {
     );
 
     let (code, stdout, stderr) = run_apply(tmp.path(), &mock.uri(), &[]);
-    assert_eq!(
+    assert_ne!(
         code, 0,
-        "a cached package archive is a usable source; failed downloads for \
-         artifacts we don't need must not abort the run; \
-         stdout={stdout}\nstderr={stderr}"
-    );
-    let v: serde_json::Value = serde_json::from_str(stdout.trim()).expect("valid JSON");
-    assert_eq!(
-        v["summary"]["applied"], 1,
-        "the patch must apply from the cached package archive; stdout={stdout}"
+        "a legacy package archive must not cover the patch; stdout={stdout}\nstderr={stderr}"
     );
-    assert_eq!(v["summary"]["failed"], 0, "stdout={stdout}");
-
-    // The patched bytes came from the archive.
     let content = std::fs::read(tmp.path().join("node_modules/pkgcache/index.js")).unwrap();
-    assert_eq!(content, after, "file must carry the patched content");
+    assert_eq!(content, before, "the file must not be patched from the legacy archive");
 
-    // Keep the test honest: the downloads really were attempted and really
-    // did fail (otherwise this would pass for the wrong reason).
     let requests = mock.received_requests().await.unwrap_or_default();
     let blob_path = format!("/v0/orgs/{ORG_SLUG}/patches/blob/{after_hash}");
     assert!(
@@ -968,16 +952,6 @@ async fn apply_online_uses_cached_package_archive_when_downloads_fail() {
             .map(|r| r.url.path().to_string())
             .collect::<Vec<_>>()
     );
-
-    // Apply stays read-only against the persistent cache.
-    let blobs_dir = socket.join("blobs");
-    if blobs_dir.exists() {
-        let entries: Vec<_> = std::fs::read_dir(&blobs_dir).unwrap().collect();
-        assert!(
-            entries.is_empty(),
-            "apply must not write to .socket/blobs/; found {entries:?}"
-        );
-    }
 }
 
 // ---------------------------------------------------------------------------
diff --git a/crates/socket-patch-cli/tests/cli_env_deprecation.rs b/crates/socket-patch-cli/tests/cli_env_deprecation.rs
deleted file mode 100644
index 5e4d9bc5..00000000
--- a/crates/socket-patch-cli/tests/cli_env_deprecation.rs
+++ /dev/null
@@ -1,343 +0,0 @@
-//! Tests for the legacy → new env-var compatibility shim.
-//!
-//! v3.0 renamed three env vars from the `SOCKET_PATCH_*` prefix to the
-//! unified `SOCKET_*` prefix. The shim in `socket_patch_core::utils::env_compat`
-//! reads the legacy name when the new name is unset and emits a one-shot
-//! deprecation warning to stderr — even under `--silent` / `--json`.
-//!
-//! These tests run the compiled binary as a subprocess so we can observe
-//! the actual stderr output. In-process testing would race with parallel
-//! tests that also touch env vars.
-
-use std::process::Command;
-
-const BINARY: &str = env!("CARGO_BIN_EXE_socket-patch");
-
-/// Every legacy/new env-var name the shim knows about. We wipe ALL of these
-/// from the child env so the parent process's environment can never leak a
-/// stray var that fires (or suppresses) a deprecation warning and makes a
-/// test falsely pass or falsely fail.
-const ALL_RENAME_VARS: &[&str] = &[
-    "SOCKET_PROXY_URL",
-    "SOCKET_PATCH_PROXY_URL",
-    "SOCKET_DEBUG",
-    "SOCKET_PATCH_DEBUG",
-    "SOCKET_TELEMETRY_DISABLED",
-    "SOCKET_PATCH_TELEMETRY_DISABLED",
-];
-
-/// Other env vars that perturb the run; wiped for hermeticity.
-const OTHER_VARS: &[&str] = &["SOCKET_API_TOKEN", "SOCKET_API_URL", "SOCKET_ORG_SLUG"];
-
-/// Captured output of a child invocation.
-struct Output {
-    stdout: String,
-    stderr: String,
-    /// Process exit code. `None` only if the child was killed by a signal —
-    /// which we treat as a hard failure (a crash that happened to print the
-    /// warning before dying must not count as a pass).
-    code: Option<i32>,
-}
-
-/// Count non-overlapping occurrences of `needle` in `haystack`.
-fn count_occurrences(haystack: &str, needle: &str) -> usize {
-    haystack.matches(needle).count()
-}
-
-/// Build a `socket-patch list` command in a hermetic env (every rename var
-/// and friend removed) pointed at a fresh empty tempdir.
-fn base_cmd(tmp: &std::path::Path, extra_args: &[&str]) -> Command {
-    let mut cmd = Command::new(BINARY);
-    cmd.arg("list").arg("--cwd").arg(tmp);
-    for a in extra_args {
-        cmd.arg(a);
-    }
-    for k in ALL_RENAME_VARS.iter().chain(OTHER_VARS.iter()) {
-        cmd.env_remove(k);
-    }
-    cmd
-}
-
-/// Helper: invoke `socket-patch list` (the cheapest read-only subcommand)
-/// in a clean env, set the given legacy env var, and capture stdout+stderr.
-fn run_with_legacy_env(legacy: &str, value: &str, extra_args: &[&str]) -> Output {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let mut cmd = base_cmd(tmp.path(), extra_args);
-    cmd.env(legacy, value);
-    let out = cmd.output().expect("run socket-patch list");
-    Output {
-        stdout: String::from_utf8_lossy(&out.stdout).into_owned(),
-        stderr: String::from_utf8_lossy(&out.stderr).into_owned(),
-        code: out.status.code(),
-    }
-}
-
-/// Assert that `stderr` carries a *well-formed* deprecation warning for the
-/// `legacy` → `new` rename: it must name the legacy var, name the new var,
-/// call the legacy var "deprecated", phrase it as a "use <new> instead"
-/// directive, and fire exactly once (the warning is documented as one-shot).
-fn assert_deprecation_warning(stderr: &str, legacy: &str, new: &str) {
-    assert!(
-        stderr.contains(legacy),
-        "stderr should mention the legacy var name `{legacy}`; stderr was:\n{stderr}"
-    );
-    assert!(
-        stderr.contains(new),
-        "stderr should mention the new var name `{new}`; stderr was:\n{stderr}"
-    );
-    assert!(
-        stderr.to_lowercase().contains("deprecated"),
-        "stderr should call the legacy var deprecated; stderr was:\n{stderr}"
-    );
-    // The message must steer the user to the *correct* replacement, not just
-    // happen to contain both strings somewhere. Guard the "use `<new>` instead"
-    // directive so a regression that prints the wrong replacement is caught.
-    assert!(
-        stderr.contains(&format!("use `{new}`")),
-        "warning should direct users to `use `{new}``; stderr was:\n{stderr}"
-    );
-    // One-shot: exactly one deprecation line, not a duplicated/looping warn.
-    assert_eq!(
-        count_occurrences(&stderr.to_lowercase(), "deprecated"),
-        1,
-        "deprecation warning should fire exactly once; stderr was:\n{stderr}"
-    );
-    // The warning belongs on stderr only — never let it appear more than once
-    // for a single legacy var name either.
-    assert_eq!(
-        count_occurrences(stderr, legacy),
-        1,
-        "legacy var name should appear exactly once in the warning; stderr was:\n{stderr}"
-    );
-    // Strongest guard, and the one that defeats reward-hacking: the warning
-    // line must match the full documented contract *verbatim*, not merely
-    // contain a scatter of the right substrings. The expected text is spelled
-    // out here independently of the implementation (it is not read back from
-    // the binary), so a regression that mangles the `[socket-patch] warning:`
-    // prefix, drops the "removed in a future major release" notice, reorders
-    // clauses, or alters punctuation will fail this test rather than slip past
-    // the looser `contains` checks above.
-    let expected_line = format!(
-        "[socket-patch] warning: env var `{legacy}` is deprecated; \
-         use `{new}` instead. The legacy name will be removed in a \
-         future major release."
-    );
-    assert!(
-        stderr.contains(&expected_line),
-        "stderr must contain the exact deprecation line:\n  {expected_line}\nstderr was:\n{stderr}"
-    );
-    // And it must appear as a standalone line on stderr (not embedded in some
-    // other message), terminated by a newline — i.e. emitted via `eprintln!`.
-    assert!(
-        stderr.lines().any(|l| l == expected_line),
-        "the deprecation warning must be its own stderr line; stderr was:\n{stderr}"
-    );
-}
-
-#[test]
-fn legacy_proxy_url_warns() {
-    let out = run_with_legacy_env("SOCKET_PATCH_PROXY_URL", "https://legacy.example", &[]);
-    assert_deprecation_warning(&out.stderr, "SOCKET_PATCH_PROXY_URL", "SOCKET_PROXY_URL");
-    // The warning is diagnostic output and must not contaminate stdout.
-    assert!(
-        !out.stdout.to_lowercase().contains("deprecated"),
-        "deprecation warning must not leak onto stdout; stdout was:\n{}",
-        out.stdout
-    );
-    // The warning must fire on the *real* code path: `list` against an empty
-    // tempdir runs to its normal empty-project result (exit 0). Pinning this
-    // rejects a child that crashed (signal → `None`) after emitting the line,
-    // and proves the shim ran inside an actual command invocation.
-    assert_eq!(
-        out.code,
-        Some(0),
-        "expected the empty-project list exit; stderr was:\n{}",
-        out.stderr
-    );
-}
-
-#[test]
-fn legacy_debug_warns() {
-    let out = run_with_legacy_env("SOCKET_PATCH_DEBUG", "1", &[]);
-    assert_deprecation_warning(&out.stderr, "SOCKET_PATCH_DEBUG", "SOCKET_DEBUG");
-    assert!(
-        !out.stdout.to_lowercase().contains("deprecated"),
-        "deprecation warning must not leak onto stdout; stdout was:\n{}",
-        out.stdout
-    );
-    assert_eq!(
-        out.code,
-        Some(0),
-        "expected the empty-project list exit; stderr was:\n{}",
-        out.stderr
-    );
-}
-
-#[test]
-fn legacy_telemetry_disabled_warns() {
-    let out = run_with_legacy_env("SOCKET_PATCH_TELEMETRY_DISABLED", "1", &[]);
-    assert_deprecation_warning(
-        &out.stderr,
-        "SOCKET_PATCH_TELEMETRY_DISABLED",
-        "SOCKET_TELEMETRY_DISABLED",
-    );
-    assert!(
-        !out.stdout.to_lowercase().contains("deprecated"),
-        "deprecation warning must not leak onto stdout; stdout was:\n{}",
-        out.stdout
-    );
-    assert_eq!(
-        out.code,
-        Some(0),
-        "expected the empty-project list exit; stderr was:\n{}",
-        out.stderr
-    );
-}
-
-/// `--silent` suppresses informational output but the deprecation warning
-/// is a transition signal users need to see, so it must still fire — and it
-/// must still be a complete, correct warning, not a degraded one.
-#[test]
-fn legacy_warning_fires_under_silent() {
-    let out = run_with_legacy_env(
-        "SOCKET_PATCH_PROXY_URL",
-        "https://legacy.example",
-        &["--silent"],
-    );
-    // The exact-line check inside this helper is the real guard: passing
-    // `--silent` must not degrade, truncate, or suppress the warning — under
-    // `--silent` it must be byte-for-byte the same line emitted without it.
-    assert_deprecation_warning(&out.stderr, "SOCKET_PATCH_PROXY_URL", "SOCKET_PROXY_URL");
-    // `--silent` is parsed and accepted (no clap usage error, which would be
-    // exit 2); the command still runs to its normal empty-project result.
-    assert_eq!(
-        out.code,
-        Some(0),
-        "--silent should be accepted and the command reach its normal exit; stderr was:\n{}",
-        out.stderr
-    );
-    // The warning is diagnostic output: it must stay on stderr and never bleed
-    // onto stdout, regardless of verbosity flags.
-    assert!(
-        !out.stdout.to_lowercase().contains("deprecated")
-            && !out.stdout.contains("SOCKET_PATCH_PROXY_URL"),
-        "deprecation warning must not leak onto stdout under --silent; stdout was:\n{}",
-        out.stdout
-    );
-}
-
-/// Same precedence as `--silent`: `--json` is for machine output but the
-/// deprecation belongs on stderr, separate from the JSON payload on stdout.
-#[test]
-fn legacy_warning_fires_under_json() {
-    let out = run_with_legacy_env(
-        "SOCKET_PATCH_PROXY_URL",
-        "https://legacy.example",
-        &["--json"],
-    );
-    assert_deprecation_warning(&out.stderr, "SOCKET_PATCH_PROXY_URL", "SOCKET_PROXY_URL");
-    // The whole point of routing the warning to stderr under --json is that
-    // stdout stays parseable. Prove stdout is untouched JSON, free of the
-    // human-facing warning.
-    assert!(
-        !out.stdout.to_lowercase().contains("deprecated")
-            && !out.stdout.contains("SOCKET_PATCH_PROXY_URL"),
-        "warning must not leak into the --json stdout payload; stdout was:\n{}",
-        out.stdout
-    );
-    let trimmed = out.stdout.trim();
-    assert!(
-        !trimmed.is_empty(),
-        "--json should still emit a JSON document on stdout; stdout was:\n{}",
-        out.stdout
-    );
-    let parsed: serde_json::Value = serde_json::from_str(trimmed).unwrap_or_else(|e| {
-        panic!(
-            "stdout must be valid JSON ({e}); stdout was:\n{}",
-            out.stdout
-        )
-    });
-    assert_eq!(
-        parsed.get("command").and_then(|v| v.as_str()),
-        Some("list"),
-        "JSON payload should be the structured `list` command result; got:\n{}",
-        out.stdout
-    );
-    // An empty tempdir lists as an empty project, so the structured result
-    // must be a success with no events — proving the JSON path itself ran
-    // rather than some short-circuited stub.
-    assert_eq!(
-        parsed.get("status").and_then(|v| v.as_str()),
-        Some("success"),
-        "JSON payload should report the empty-project success; got:\n{}",
-        out.stdout
-    );
-    assert_eq!(
-        out.code,
-        Some(0),
-        "expected the empty-project list exit under --json; stderr was:\n{}",
-        out.stderr
-    );
-}
-
-/// When the new var is set, the legacy var must be ignored — no warning, and
-/// the legacy name must not even be mentioned on stderr.
-#[test]
-fn new_var_takes_precedence_and_silences_warning() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let mut cmd = base_cmd(tmp.path(), &[]);
-    // New var set, legacy var also set: the new one must win, the legacy one
-    // must be silently ignored.
-    cmd.env("SOCKET_PROXY_URL", "https://new.example");
-    cmd.env("SOCKET_PATCH_PROXY_URL", "https://legacy.example");
-    let out = cmd.output().expect("run socket-patch list");
-    let stderr = String::from_utf8_lossy(&out.stderr);
-    // Guard against a vacuous pass: if the binary never launched (or crashed
-    // before promoting env vars) stderr would also lack "deprecated". Require
-    // the real empty-project list exit so "no warning" means the shim
-    // ran and chose to stay quiet — not that nothing ran at all.
-    assert_eq!(
-        out.status.code(),
-        Some(0),
-        "expected the binary to run to its empty-project list result; stderr was:\n{stderr}"
-    );
-    assert!(
-        !stderr.to_lowercase().contains("deprecated"),
-        "no deprecation warning expected when new var is set; stderr was:\n{stderr}"
-    );
-    assert!(
-        !stderr.contains("SOCKET_PATCH_PROXY_URL"),
-        "legacy var name must not appear when the new var takes precedence; stderr was:\n{stderr}"
-    );
-}
-
-/// Sanity guard against a false-positive in the "warns" tests: with NO legacy
-/// var set at all, the binary must emit zero deprecation noise. This proves
-/// the warnings above are caused by the legacy var, not by ambient output the
-/// substring checks would otherwise rubber-stamp.
-#[test]
-fn no_warning_when_no_legacy_var_set() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let mut cmd = base_cmd(tmp.path(), &[]);
-    let out = cmd.output().expect("run socket-patch list");
-    let stderr = String::from_utf8_lossy(&out.stderr);
-    // As above: require the real error exit so a "clean" stderr can't be the
-    // result of the binary failing to start.
-    assert_eq!(
-        out.status.code(),
-        Some(0),
-        "expected the binary to run to its empty-project list result; stderr was:\n{stderr}"
-    );
-    assert!(
-        !stderr.to_lowercase().contains("deprecated"),
-        "no deprecation warning expected with no legacy var set; stderr was:\n{stderr}"
-    );
-    // Cross-check the positive tests are not rubber-stamping ambient output:
-    // with no legacy var set, none of the legacy names may appear on stderr.
-    for legacy in ALL_RENAME_VARS {
-        assert!(
-            !stderr.contains(legacy),
-            "no legacy var name should appear with none set; saw `{legacy}` in stderr:\n{stderr}"
-        );
-    }
-}
diff --git a/crates/socket-patch-cli/tests/cli_get_silent.rs b/crates/socket-patch-cli/tests/cli_get_silent.rs
index 4552d78e..4e43c353 100644
--- a/crates/socket-patch-cli/tests/cli_get_silent.rs
+++ b/crates/socket-patch-cli/tests/cli_get_silent.rs
@@ -27,11 +27,7 @@ fn run_get(cwd: &Path, args: &[&str]) -> (i32, String) {
     }
     for var in [
         "SOCKET_SAVE_ONLY",
-        "SOCKET_ONE_OFF",
         "SOCKET_ALL_RELEASES",
-        "SOCKET_PATCH_API_URL",
-        "SOCKET_PATCH_API_TOKEN",
-        "SOCKET_PATCH_PROXY_URL",
     ] {
         cmd.env_remove(var);
     }
diff --git a/crates/socket-patch-cli/tests/cli_parse_get.rs b/crates/socket-patch-cli/tests/cli_parse_get.rs
index 9d50c0e2..164c9c02 100644
--- a/crates/socket-patch-cli/tests/cli_parse_get.rs
+++ b/crates/socket-patch-cli/tests/cli_parse_get.rs
@@ -59,7 +59,6 @@ const SOCKET_ENV_VARS: &[&str] = &[
     "SOCKET_NO_VLT_INSTALL_CLEANUP",
     // GetArgs-specific
     "SOCKET_SAVE_ONLY",
-    "SOCKET_ONE_OFF",
     "SOCKET_ALL_RELEASES",
 ];
 
@@ -119,7 +118,7 @@ fn parse_get(extra: &[&str]) -> GetArgs {
 /// This is what makes the per-flag tests honest. A field-at-a-time assertion
 /// (`assert!(a.package)`) only proves the flag set *its* field; it says nothing
 /// about whether the same flag also flipped an unrelated one. A clap-derive
-/// copy/paste regression (e.g. `--package` accidentally wired to `one_off`)
+/// copy/paste regression (e.g. `--package` accidentally wired to `save_only`)
 /// would set both and still pass a single-field check. Comparing the whole
 /// snapshot against the independently-declared defaults — with only the field
 /// under test mutated — fails loudly the instant any other field moves.
@@ -154,7 +153,6 @@ struct Snap {
     ghsa: bool,
     package: bool,
     save_only: bool,
-    one_off: bool,
     all_releases: bool,
     mode: Option<socket_patch_cli::commands::scan::ScanMode>,
 }
@@ -190,7 +188,6 @@ fn snapshot(a: &GetArgs) -> Snap {
         ghsa: a.ghsa,
         package: a.package,
         save_only: a.save_only,
-        one_off: a.one_off,
         all_releases: a.all_releases,
         mode: a.mode,
     }
@@ -234,7 +231,6 @@ fn expected_defaults(identifier: &str) -> Snap {
         ghsa: false,
         package: false,
         save_only: false,
-        one_off: false,
         all_releases: false,
         mode: None,
     }
@@ -414,17 +410,6 @@ fn global_prefix_flag_sets_global_prefix() {
     assert_eq!(snapshot(&a), want);
 }
 
-#[test]
-#[serial_test::serial]
-fn one_off_flag_sets_one_off() {
-    let a = parse_get(&["some-id", "--one-off"]);
-    let mut want = expected_defaults("some-id");
-    want.one_off = true;
-    // `--one-off` and `--save-only` are semantic opposites; this guards that
-    // setting one does not also flip the other.
-    assert_eq!(snapshot(&a), want);
-}
-
 #[test]
 #[serial_test::serial]
 fn json_flag_sets_json() {
@@ -521,7 +506,7 @@ fn mode_hosted_parses() {
     let mut want = expected_defaults("some-id");
     want.mode = Some(socket_patch_cli::commands::scan::ScanMode::Hosted);
     // Full-snapshot equality: `--mode hosted` sets `mode` and nothing else
-    // (in particular it must NOT flip save_only/one_off or any GlobalArgs
+    // (in particular it must NOT flip save_only or any GlobalArgs
     // field — the runtime conflicts are run()'s job, not the parser's).
     assert_eq!(snapshot(&a), want);
 }
@@ -546,43 +531,32 @@ fn mode_agent_parses() {
 
 #[test]
 #[serial_test::serial]
-fn mode_hidden_value_aliases_parse() {
-    // The hidden value aliases mirror the legacy scan flag spellings:
-    // `host` (old mode name) and `redirect` (the `--redirect` boolean)
-    // for hosted; `vendor` (the `--vendor` boolean) for vendored. Each
-    // must parse byte-identically to its canonical spelling across the
-    // ENTIRE surface, not merely land on the right variant.
-    for (alias, canonical) in [
-        ("host", "hosted"),
-        ("redirect", "hosted"),
-        ("vendor", "vendored"),
-    ] {
-        let via_alias = parse_get(&["some-id", "--mode", alias]);
-        let via_canonical = parse_get(&["some-id", "--mode", canonical]);
-        assert_eq!(
-            snapshot(&via_alias),
-            snapshot(&via_canonical),
-            "--mode {alias} must parse identically to --mode {canonical}"
+fn removed_mode_value_aliases_are_rejected() {
+    // v5.0 dropped the hidden `host` / `redirect` / `vendor` value aliases
+    // (shared with `scan --mode`); only the canonical names parse.
+    let _scrub = EnvScrub::new();
+    for alias in ["host", "redirect", "vendor"] {
+        let err = match Cli::try_parse_from(["socket-patch", "get", "some-id", "--mode", alias]) {
+            Ok(_) => panic!("--mode {alias} should fail to parse"),
+            Err(e) => e,
+        };
+        assert!(
+            matches!(
+                err.kind(),
+                clap::error::ErrorKind::ValueValidation | clap::error::ErrorKind::InvalidValue
+            ),
+            "--mode {alias}: expected ValueValidation or InvalidValue, got {:?}",
+            err.kind()
         );
-        // ...and the canonical parse itself is default-everything + mode,
-        // so the alias equality above can't be satisfied by two equally
-        // wrong parses.
-        let mut want = expected_defaults("some-id");
-        want.mode = Some(match canonical {
-            "hosted" => socket_patch_cli::commands::scan::ScanMode::Hosted,
-            _ => socket_patch_cli::commands::scan::ScanMode::Vendored,
-        });
-        assert_eq!(snapshot(&via_canonical), want);
     }
 }
 
 #[test]
 #[serial_test::serial]
 fn mode_rejects_unknown_value() {
-    // The shared value_enum restricts `--mode` to the three known names
-    // (+ hidden aliases). `apply` is deliberately NOT an alias of agent —
-    // applying is not a scan-mode name anywhere else (see ScanMode's doc)
-    // — so it must be rejected exactly like a bogus value.
+    // The shared value_enum restricts `--mode` to the three known names.
+    // `apply` is not a scan-mode name anywhere, so it must be rejected
+    // exactly like a bogus value.
     let _scrub = EnvScrub::new();
     for bad in ["bogus", "apply"] {
         let err = match Cli::try_parse_from(["socket-patch", "get", "some-id", "--mode", bad]) {
@@ -642,6 +616,17 @@ fn unknown_flag_errors() {
     assert_eq!(err.kind(), clap::error::ErrorKind::UnknownArgument);
 }
 
+#[test]
+#[serial_test::serial]
+fn removed_one_off_flag_is_unknown() {
+    let _scrub = EnvScrub::new();
+    let err = match Cli::try_parse_from(["socket-patch", "get", "some-id", "--one-off"]) {
+        Err(e) => e,
+        Ok(_) => panic!("expected parse error for the v5-removed --one-off"),
+    };
+    assert_eq!(err.kind(), clap::error::ErrorKind::UnknownArgument);
+}
+
 // --- Hermeticity of the scrub itself -------------------------------------------
 
 #[test]
diff --git a/crates/socket-patch-cli/tests/cli_parse_rollback.rs b/crates/socket-patch-cli/tests/cli_parse_rollback.rs
index 79787517..c8b77af5 100644
--- a/crates/socket-patch-cli/tests/cli_parse_rollback.rs
+++ b/crates/socket-patch-cli/tests/cli_parse_rollback.rs
@@ -25,7 +25,7 @@ fn parse_rollback(extra: &[&str]) -> RollbackArgs {
 /// Every boolean toggle on `rollback`, as `(contract name, current value)`.
 /// Used to prove that a single flag flips *only* its own field — without this,
 /// each positive test ignores all other fields, so a parser bug that
-/// cross-wired e.g. `--one-off` into `--global`, `--silent` into `--yes`
+/// cross-wired e.g. `--preserve-state` into `--global`, `--silent` into `--yes`
 /// (auto-approving prompts), or any flag into another would still stay green.
 /// Keep this in sync with the boolean flags in the contract.
 fn bool_flags(a: &RollbackArgs) -> Vec<(&'static str, bool)> {
@@ -39,7 +39,6 @@ fn bool_flags(a: &RollbackArgs) -> Vec<(&'static str, bool)> {
         ("yes", a.common.yes),
         ("debug", a.common.debug),
         ("no_telemetry", a.common.no_telemetry),
-        ("one_off", a.one_off),
         ("preserve_state", a.preserve_state),
     ]
 }
@@ -71,7 +70,6 @@ fn defaults_no_positional() {
     assert!(!args.common.offline);
     assert!(!args.common.global);
     assert_eq!(args.common.global_prefix, None);
-    assert!(!args.one_off);
     assert_eq!(args.common.org, None);
     assert_eq!(args.common.api_url, None); // default applied in core resolver
     assert_eq!(args.common.api_token, None);
@@ -185,15 +183,6 @@ fn global_prefix_long() {
     assert_eq!(args.common.global_prefix, Some(PathBuf::from("/foo")));
 }
 
-#[test]
-fn one_off_long() {
-    let args = parse_rollback(&["--one-off"]);
-    assert!(args.one_off);
-    // `--one-off` is rollback-specific (fetch beforeHash blobs from API). It
-    // must NOT silently imply `--offline`, `--global`, or any other toggle.
-    assert_only_true(&args, &["one_off"]);
-}
-
 #[test]
 fn org_long() {
     let args = parse_rollback(&["--org", "myorg"]);
@@ -317,7 +306,6 @@ fn all_bools_settable_together() {
         "--yes",
         "--debug",
         "--no-telemetry",
-        "--one-off",
         "--preserve-state",
     ]);
     assert_only_true(
@@ -332,7 +320,6 @@ fn all_bools_settable_together() {
             "yes",
             "debug",
             "no_telemetry",
-            "one_off",
             "preserve_state",
         ],
     );
@@ -360,16 +347,17 @@ fn all_short_flags_map_to_distinct_fields() {
 }
 
 /// Bare boolean flags are `SetTrue` (num_args = 0): they must NOT swallow the
-/// following token as a value. If `--one-off` silently became value-taking, a
-/// wrapper invoking `rollback --one-off <purl>` would change meaning (the purl
+/// following token as a value. If `--preserve-state` silently became
+/// value-taking, a wrapper invoking `rollback --preserve-state <purl>` would
+/// change meaning (the purl
 /// would be consumed as the flag's value, not the `targets` positional).
 #[test]
 fn bare_bool_does_not_consume_next_token() {
-    let args = parse_rollback(&["--one-off", "pkg:npm/foo@1"]);
-    assert!(args.one_off);
-    // The trailing token landed in `targets`, not as a value for `--one-off`.
+    let args = parse_rollback(&["--preserve-state", "pkg:npm/foo@1"]);
+    assert!(args.preserve_state);
+    // The trailing token landed in `targets`, not as a value for the flag.
     assert_eq!(args.targets, vec!["pkg:npm/foo@1".to_string()]);
-    assert_only_true(&args, &["one_off"]);
+    assert_only_true(&args, &["preserve_state"]);
 }
 
 /// Variadic targets (v4 duality rework): multiple positionals parse in
@@ -416,3 +404,12 @@ fn unknown_flag_fails() {
     };
     assert_eq!(err.kind(), clap::error::ErrorKind::UnknownArgument);
 }
+
+#[test]
+fn removed_one_off_flag_is_unknown() {
+    let err = match Cli::try_parse_from(["socket-patch", "rollback", "--one-off"]) {
+        Ok(_) => panic!("expected parse error for the v5-removed --one-off"),
+        Err(e) => e,
+    };
+    assert_eq!(err.kind(), clap::error::ErrorKind::UnknownArgument);
+}
diff --git a/crates/socket-patch-cli/tests/cli_parse_scan.rs b/crates/socket-patch-cli/tests/cli_parse_scan.rs
index 1ed6a66d..64bb72a1 100644
--- a/crates/socket-patch-cli/tests/cli_parse_scan.rs
+++ b/crates/socket-patch-cli/tests/cli_parse_scan.rs
@@ -143,7 +143,6 @@ fn defaults_match_contract() {
     );
     assert!(!args.sync, "--sync default is false");
     assert!(!args.vendor, "--vendor default is false");
-    assert!(!args.detached, "--detached default is false");
     assert_eq!(args.mode, None, "--mode default is None (no mode selector)");
     assert!(!args.common.dry_run, "--dry-run default is false");
     assert!(
@@ -558,10 +557,9 @@ fn scan_json_empty_cwd_emits_updates_key() {
 // `--mode <hosted|vendored|agent>` is the RELEASED spelling of the three
 // mode flags. `resolve_mode_flags` (run at the top of `scan::run`,
 // exercised directly here) makes `args.mode` the single source of truth:
-// the legacy `--redirect`/`--vendor`/`--apply`/`--sync` booleans fold INTO
-// the enum (they are input spellings, never read downstream), and the
-// cross-mode rules clap can't express (a value-dependent conflict) are
-// enforced. These tests lock both the fold and the legacy aliases.
+// the `--vendor`/`--apply`/`--sync` booleans fold INTO the enum (they are
+// input spellings, never read downstream), and the cross-mode rules clap
+// can't express (a value-dependent conflict) are enforced.
 
 /// Parse `extra` (must parse cleanly at the clap level), then run the mode
 /// fold — mirroring exactly what `scan::run` does before it reads the
@@ -579,13 +577,6 @@ fn mode_hosted_is_the_source_of_truth() {
     // single source of truth (the booleans are inputs, not outputs).
     let folded = parse_and_resolve(&["--mode", "hosted"]).expect("fold ok");
     assert_eq!(folded.mode, Some(ScanMode::Hosted));
-    // ...and the legacy boolean spelling folds INTO the enum.
-    let folded = parse_and_resolve(&["--redirect"]).expect("fold ok");
-    assert_eq!(
-        folded.mode,
-        Some(ScanMode::Hosted),
-        "--redirect == --mode hosted"
-    );
 }
 
 #[test]
@@ -681,39 +672,15 @@ fn mode_agent_with_sync_boolean_is_allowed() {
     assert!(folded.sync);
 }
 
-#[test]
-#[serial_test::serial]
-fn mode_vendored_with_detached_ok() {
-    // --detached is legal under vendored mode selected via --mode.
-    let folded = parse_and_resolve(&["--mode", "vendored", "--detached"]).expect("fold ok");
-    assert_eq!(folded.mode, Some(ScanMode::Vendored));
-    assert!(folded.detached);
-}
-
-#[test]
-#[serial_test::serial]
-fn detached_without_vendored_mode_errors() {
-    // --detached now requires vendored mode via resolve_mode_flags (the
-    // former clap `requires = "vendor"` could not see `--mode vendored`, so
-    // the requirement moved into the fold). Parsing alone succeeds.
-    let mut args = parse_scan(&["--detached"]);
-    assert!(
-        resolve_mode_flags(&mut args).is_err(),
-        "--detached without vendored mode must error"
-    );
-}
-
 #[test]
 #[serial_test::serial]
 fn legacy_mode_spellings_still_parse() {
     // The boolean aliases keep working with no `--mode` given; the fold
     // derives the mode enum from them (the inverse of the historical
     // direction — `args.mode` is now the single source of truth).
-    assert!(parse_scan(&["--redirect"]).redirect);
     assert!(parse_scan(&["--vendor"]).vendor);
     assert!(parse_scan(&["--apply"]).apply);
-    let folded = parse_and_resolve(&["--vendor", "--detached"]).expect("legacy fold ok");
-    assert!(folded.detached);
+    let folded = parse_and_resolve(&["--vendor"]).expect("legacy fold ok");
     assert_eq!(
         folded.mode,
         Some(ScanMode::Vendored),
@@ -730,8 +697,8 @@ fn legacy_mode_spellings_still_parse() {
 /// `Debug` derive) are formatted individually.
 fn snap(a: &ScanArgs) -> String {
     format!(
-        "{:?} paths={:?} batch_size={:?} apply={} prune={} sync={} vendor={} detached={} \
-         redirect={} mode={:?} all_releases={} vex={:?} vex_product={:?} \
+        "{:?} paths={:?} batch_size={:?} apply={} prune={} sync={} vendor={} \
+         mode={:?} all_releases={} vex={:?} vex_product={:?} \
          vex_no_verify={} vex_doc_id={:?} vex_compact={}",
         a.common,
         a.paths,
@@ -740,8 +707,6 @@ fn snap(a: &ScanArgs) -> String {
         a.prune,
         a.sync,
         a.vendor,
-        a.detached,
-        a.redirect,
         a.mode,
         a.all_releases,
         a.vex.vex,
@@ -793,107 +758,50 @@ fn scrub_covers_every_scan_env_var_clap_consults() {
     }
 }
 
-// --- hidden `--mode` value aliases ("vendor" / "host" / "redirect") ---------
-//
-// `--mode vendor`, `--mode host`, and `--mode redirect` are UNDOCUMENTED
-// spellings accepted for muscle-memory reasons (they match the legacy
-// boolean flag names / the old mode name). They are clap value aliases on
-// the `ScanMode` variants, which clap keeps out of help output — the tests
-// below lock in both the acceptance and the hiding. `--mode apply` is
-// deliberately NOT an alias: applying is not a scan mode name anywhere
-// (the canonical name is `agent`), so it must stay rejected.
-
 #[test]
 #[serial_test::serial]
-fn mode_alias_vendor_folds_to_vendor() {
-    // The parser resolves the hidden alias to the canonical variant...
-    assert_eq!(
-        parse_scan(&["--mode", "vendor"]).mode,
-        Some(ScanMode::Vendored)
-    );
-    // ...and the fold keeps it as the single source of truth, exactly as if
-    // `--mode vendored` were given.
-    let folded = parse_and_resolve(&["--mode", "vendor"]).expect("fold ok");
-    assert_eq!(
-        folded.mode,
-        Some(ScanMode::Vendored),
-        "--mode vendor (hidden alias) == --mode vendored"
-    );
-}
-
-#[test]
-#[serial_test::serial]
-fn mode_alias_host_folds_to_redirect() {
-    assert_eq!(parse_scan(&["--mode", "host"]).mode, Some(ScanMode::Hosted));
-    let folded = parse_and_resolve(&["--mode", "host"]).expect("fold ok");
-    assert_eq!(
-        folded.mode,
-        Some(ScanMode::Hosted),
-        "--mode host (hidden alias) == --mode hosted"
-    );
-}
-
-#[test]
-#[serial_test::serial]
-fn mode_alias_redirect_folds_to_hosted() {
-    // `redirect` is the legacy FLAG spelling (`--redirect`); the value
-    // aliases stay symmetric with `--mode vendor`/`--mode host`.
-    assert_eq!(
-        parse_scan(&["--mode", "redirect"]).mode,
-        Some(ScanMode::Hosted)
-    );
-    let folded = parse_and_resolve(&["--mode", "redirect"]).expect("fold ok");
-    assert_eq!(
-        folded.mode,
-        Some(ScanMode::Hosted),
-        "--mode redirect (hidden alias) == --mode hosted"
-    );
-    // The alias agrees with its own boolean: redundant, not contradictory.
-    let folded = parse_and_resolve(&["--mode", "redirect", "--redirect"]).expect("fold ok");
-    assert_eq!(folded.mode, Some(ScanMode::Hosted));
-}
-
-#[test]
-#[serial_test::serial]
-fn mode_apply_stays_rejected() {
-    // `apply` is NOT a scan mode name (canonical: `agent`); accepting it
-    // would mint a fourth spelling nothing else recognizes. Clap must
-    // reject it at parse time like any unknown value.
-    let parsed =
-        with_clean_env(|| Cli::try_parse_from(["socket-patch", "scan", "--mode", "apply"]));
-    let Err(err) = parsed else {
-        panic!("--mode apply must be rejected");
-    };
-    let rendered = err.to_string();
-    assert!(
-        rendered.contains("apply"),
-        "the error must echo the rejected value: {rendered}"
-    );
+fn non_canonical_mode_values_are_rejected() {
+    // Only the three canonical names parse: `apply` was never a mode name,
+    // and the v3/v4 value aliases `host` / `redirect` / `vendor` were
+    // removed in v5.0.
+    for value in ["apply", "host", "redirect", "vendor"] {
+        let parsed =
+            with_clean_env(|| Cli::try_parse_from(["socket-patch", "scan", "--mode", value]));
+        let Err(err) = parsed else {
+            panic!("--mode {value} must be rejected");
+        };
+        let rendered = err.to_string();
+        assert!(
+            rendered.contains(value),
+            "the error must echo the rejected value: {rendered}"
+        );
+    }
 }
 
+/// The v3/v4 hidden `--redirect` and no-op `--detached` flags were removed
+/// in v5.0: clap rejects them like any unknown argument.
 #[test]
 #[serial_test::serial]
-fn mode_alias_host_with_vendor_boolean_errors_with_canonical_name() {
-    // The alias resolves to `ScanMode::Hosted` at parse time, so the
-    // cross-mode contradiction fires exactly as with the canonical
-    // spelling — and the error message names the canonical mode
-    // (`cli_name()`), never echoing the alias the user typed.
-    let mut args = parse_scan(&["--mode", "host", "--vendor"]);
-    let err = resolve_mode_flags(&mut args).expect_err("cross-mode contradiction");
-    assert!(
-        err.contains("--mode hosted cannot be used with --vendor"),
-        "error must name the canonical mode (\"hosted\"), got: {err}"
-    );
+fn removed_legacy_scan_flags_are_rejected() {
+    for flag in ["--redirect", "--detached"] {
+        let parsed = with_clean_env(|| Cli::try_parse_from(["socket-patch", "scan", flag]));
+        let Err(err) = parsed else {
+            panic!("{flag} must be rejected");
+        };
+        assert_eq!(
+            err.kind(),
+            clap::error::ErrorKind::UnknownArgument,
+            "{flag}: {err}"
+        );
+    }
 }
 
 #[test]
 #[serial_test::serial]
-fn mode_aliases_hidden_from_help() {
+fn mode_help_lists_only_canonical_names() {
     use clap::CommandFactory;
     // clap embeds live env values into help as `[env: VAR=value]` at
-    // command-build/render time; an ambient value containing "host:" or
-    // "vendor:" (e.g. SOCKET_PROXY_URL=http://localhost:8080) would trip
-    // the alias-leak asserts below, so the whole build+render runs clean.
+    // command-build/render time, so the whole build+render runs clean.
     let (short, long) = with_clean_env(|| {
         let mut cmd = Cli::command();
         let scan = cmd.find_subcommand_mut("scan").expect("scan subcommand");
@@ -904,57 +812,21 @@ fn mode_aliases_hidden_from_help() {
     });
 
     // Short help (`scan -h`) renders the compact bracketed list. Assert on
-    // the exact rendered segment — NOT on substring absence, because
-    // "vendored" contains "vendor" as a substring — so any extra value
-    // inside the brackets (a leaked alias) breaks the match.
+    // the exact rendered segment so any extra value inside the brackets
+    // breaks the match.
     assert!(
         short.contains("[possible values: hosted, vendored, agent]"),
         "scan -h must list exactly the canonical mode names; help was:\n{short}"
     );
 
     // Long help (`scan --help`) itemizes each possible value with its doc
-    // comment. The canonical items render as "hosted:" / "vendored:" /
-    // "agent:"; an alias leaking into the itemized list would render as
-    // "host:" or "vendor:" (name immediately followed by the colon).
+    // comment.
     for canonical in ["hosted:", "vendored:", "agent:"] {
         assert!(
             long.contains(canonical),
             "scan --help must itemize `{canonical}`; help was:\n{long}"
         );
     }
-    for alias in ["host:", "vendor:", "redirect:"] {
-        // "host:" is NOT a substring of "hosted:" (the canonical item has
-        // 'e' after "host"), so any literal hit is a genuine leak.
-        assert!(
-            !long.contains(alias),
-            "hidden alias `{alias}` leaked into scan --help; help was:\n{long}"
-        );
-    }
-}
-
-/// `--detached` is a compatibility no-op (vendored mode is always
-/// manifest-free): still parsed, still requiring vendored mode, but hidden
-/// from help like the legacy `--redirect` spelling.
-#[test]
-#[serial_test::serial]
-fn detached_flag_is_hidden_from_help() {
-    use clap::CommandFactory;
-    let long = with_clean_env(|| {
-        let mut cmd = Cli::command();
-        let scan = cmd.find_subcommand_mut("scan").expect("scan subcommand");
-        scan.render_long_help().to_string()
-    });
-    assert!(
-        !long.contains("--detached"),
-        "--detached must be hidden from scan --help; help was:\n{long}"
-    );
-    assert!(
-        long.contains("--prune"),
-        "control: a documented flag renders; help was:\n{long}"
-    );
-    // Still parsed (compatibility), still folded under vendored mode.
-    let folded = parse_and_resolve(&["--mode", "vendored", "--detached"]).expect("fold ok");
-    assert!(folded.detached);
 }
 
 #[test]
diff --git a/crates/socket-patch-cli/tests/cli_scan_silent.rs b/crates/socket-patch-cli/tests/cli_scan_silent.rs
index fe3b4456..3a12211a 100644
--- a/crates/socket-patch-cli/tests/cli_scan_silent.rs
+++ b/crates/socket-patch-cli/tests/cli_scan_silent.rs
@@ -514,7 +514,7 @@ fn scan_silent_vex_failure_keeps_error_output() {
 }
 
 /// The redirect flow's embedded-VEX failure path must keep its error
-/// under `--silent` too ("errors only", not "nothing"): `scan --redirect
+/// under `--silent` too ("errors only", not "nothing"): `scan --mode hosted
 /// --vex out.json --silent` with nothing to attest (the reference is
 /// forbidden, no manifest exists) exits 1, and the failure message must
 /// still reach stderr: `run_redirect`'s `vex_error` must not sit inside the
@@ -544,7 +544,7 @@ async fn scan_redirect_silent_vex_failure_keeps_error_output() {
     let vex_arg = vex_path.to_str().unwrap().to_string();
 
     let args = |silent: bool| {
-        let mut v = vec!["--redirect", "--yes"];
+        let mut v = vec!["--mode=hosted", "--yes"];
         if silent {
             v.push("--silent");
         }
diff --git a/crates/socket-patch-cli/tests/coverage_fix_rollback_ecosystem_scoped_hosted.rs b/crates/socket-patch-cli/tests/coverage_fix_rollback_ecosystem_scoped_hosted.rs
index e0b8d253..c0f7616a 100644
--- a/crates/socket-patch-cli/tests/coverage_fix_rollback_ecosystem_scoped_hosted.rs
+++ b/crates/socket-patch-cli/tests/coverage_fix_rollback_ecosystem_scoped_hosted.rs
@@ -83,7 +83,6 @@ async fn rollback_in_process(cwd: &Path, ecosystems: Option<Vec<String>>) -> i32
             patch_server_url: Some("http://patch.test".to_string()),
             ..socket_patch_cli::args::GlobalArgs::default()
         },
-        one_off: false,
         preserve_state: false,
     };
     let code = rollback_run(args).await;
diff --git a/crates/socket-patch-cli/tests/covgap_commands_get.rs b/crates/socket-patch-cli/tests/covgap_commands_get.rs
index d923fc84..a67f2fe7 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_get.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_get.rs
@@ -103,7 +103,6 @@ fn default_args(identifier: &str, cwd: &Path) -> GetArgs {
         ghsa: false,
         package: false,
         save_only: true,
-        one_off: false,
         all_releases: false,
         mode: Some(socket_patch_cli::commands::scan::ScanMode::Agent),
     }
@@ -1751,12 +1750,12 @@ async fn human_uuid_paid_via_proxy_prints_upgrade_message() {
     let tmp = tempfile::tempdir().unwrap();
     let uri = mock.uri();
     // No --api-token / --org: the scrubbed child env falls back to the
-    // public proxy seeded via the legacy env var (get_invariants' recipe).
+    // public proxy seeded via `SOCKET_PROXY_URL` (get_invariants' recipe).
     let (code, stdout, stderr) = common::run_with_env(
         tmp.path(),
         &["get", UUID, "--save-only", "--yes", "--api-url", &uri],
         &[
-            ("SOCKET_PATCH_PROXY_URL", uri.as_str()),
+            ("SOCKET_PROXY_URL", uri.as_str()),
             ("SOCKET_TELEMETRY_DISABLED", "1"),
         ],
     );
@@ -2862,7 +2861,7 @@ async fn proxy_403_on_uuid_is_paid_required() {
             tmp.path(),
             &args,
             &[
-                ("SOCKET_PATCH_PROXY_URL", uri.as_str()),
+                ("SOCKET_PROXY_URL", uri.as_str()),
                 ("SOCKET_TELEMETRY_DISABLED", "1"),
             ],
         )
diff --git a/crates/socket-patch-cli/tests/covgap_commands_repair.rs b/crates/socket-patch-cli/tests/covgap_commands_repair.rs
index 4282dd9b..b960ce6f 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_repair.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_repair.rs
@@ -353,15 +353,17 @@ fn repair_dry_run_preview_truncates_missing_list_after_ten() {
 }
 
 /// The loud orphan-archive removal print — each directory's summary names
-/// its own artifact kind (`format_cleanup_result_for` takes the noun). One orphan in `diffs/` and one in `packages/`, each next
-/// to the referenced `<uuid>.tar.gz` that must survive.
+/// its own artifact kind (`format_cleanup_result_for` takes the noun). One orphan in `diffs/` next to the
+/// referenced `<uuid>.tar.gz` that must survive, and two legacy archives in
+/// `packages/` (one under the referenced uuid) that both go: v5.0 reads no
+/// package archives, so the sweep keeps none.
 #[test]
 fn repair_removes_orphan_archives_human_mode_prints_relabeled_summary() {
     let tmp = tempfile::tempdir().expect("tempdir");
     let socket = make_socket_dir(tmp.path());
     write_blob(&socket, REFERENCED_HASH, b"kept");
-    // Referenced archives keep the default diff mode's missing-check happy
-    // AND must survive the sweep.
+    // The referenced diff archive keeps the default diff mode's
+    // missing-check happy AND must survive the sweep.
     write_archive(&socket, "diffs", REFERENCED_UUID, b"kept-diff");
     write_archive(&socket, "packages", REFERENCED_UUID, b"kept-package");
     const ORPHAN_DIFF: &str = "99999999-9999-4999-8999-999999999999";
@@ -387,7 +389,7 @@ fn repair_removes_orphan_archives_human_mode_prints_relabeled_summary() {
         "the diffs sweep must print its own summary; stdout=\n{stdout}"
     );
     assert!(
-        stdout.contains("Removed 1 unused package archive (16 B freed)"),
+        stdout.contains("Removed 2 unused package archives (28 B freed)"),
         "the packages sweep must print its own summary; stdout=\n{stdout}"
     );
     assert!(
@@ -400,7 +402,8 @@ fn repair_removes_orphan_archives_human_mode_prints_relabeled_summary() {
         stdout.contains("All diff archives are present locally."),
         "diff mode with the referenced archive present is all-present; stdout=\n{stdout}"
     );
-    // Disk effects: orphans gone, referenced archives intact.
+    // Disk effects: orphans and legacy archives gone, the referenced diff
+    // archive intact.
     assert!(
         !socket
             .join("diffs")
@@ -419,7 +422,7 @@ fn repair_removes_orphan_archives_human_mode_prints_relabeled_summary() {
         .join("diffs")
         .join(format!("{REFERENCED_UUID}.tar.gz"))
         .exists());
-    assert!(socket
+    assert!(!socket
         .join("packages")
         .join(format!("{REFERENCED_UUID}.tar.gz"))
         .exists());
diff --git a/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs b/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs
index c11d71b8..47fa7166 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_scan_mod.rs
@@ -319,7 +319,7 @@ fn seed_manifest(root: &Path, entries: &[(&str, &str)]) {
 // resolve_mode_flags — the remaining cross-mode conflict arms
 // ---------------------------------------------------------------------------
 // Only the `--mode hosted --vendor` arm is pinned in cli_parse_scan.rs;
-// these cover the --redirect / --apply / --sync booleans against a
+// these cover the --apply / --sync / --vendor booleans against a
 // different --mode, plus ScanMode::Agent.cli_name() rendering into the
 // message. Clap parses each combination fine (no value-dependent conflict
 // is expressible); the fold is what rejects them.
@@ -367,16 +367,6 @@ mod mode_fold {
         resolve_mode_flags(&mut args).expect_err("cross-mode contradiction must error")
     }
 
-    #[test]
-    #[serial_test::serial]
-    fn mode_vendored_with_redirect_boolean_errors() {
-        let err = fold_err(&["--mode", "vendored", "--redirect"]);
-        assert!(
-            err.contains("--mode vendored cannot be used with --redirect"),
-            "clap-style 'cannot be used with' phrasing naming both spellings: {err}"
-        );
-    }
-
     #[test]
     #[serial_test::serial]
     fn mode_vendored_with_apply_boolean_errors() {
@@ -2270,22 +2260,6 @@ fn scan_mode_conflict_error_is_capitalized_and_names_no_hidden_flag() {
         "{stderr:?}"
     );
     assert!(!stderr.contains("--redirect"), "{stderr:?}");
-    // Typing the hidden --redirect gets it explained.
-    let (code, _, stderr) = run_scan(tmp.path(), &["--mode", "agent", "--redirect"]);
-    assert_eq!(code, 2);
-    assert!(
-        stderr.starts_with(
-            "Error: --mode agent cannot be used with --redirect: the flags select \
-             different modes (--redirect means --mode hosted)"
-        ),
-        "{stderr:?}"
-    );
-    let (code, _, stderr) = run_scan(tmp.path(), &["--detached"]);
-    assert_eq!(code, 2);
-    assert!(
-        stderr.starts_with("Error: --detached requires vendored mode"),
-        "{stderr:?}"
-    );
 }
 
 /// A selection the manifest already records at the same uuid is not
diff --git a/crates/socket-patch-cli/tests/docker_e2e_vendor_gem.rs b/crates/socket-patch-cli/tests/docker_e2e_vendor_gem.rs
index 763b870c..d2c5a377 100644
--- a/crates/socket-patch-cli/tests/docker_e2e_vendor_gem.rs
+++ b/crates/socket-patch-cli/tests/docker_e2e_vendor_gem.rs
@@ -252,7 +252,7 @@ exit 0
 "#;
 
 /// Stage 2b (`--network none`, the fresh checkout stage 2 just installed):
-/// MANIFEST-LESS VEX, the depscan / `vendor --detached` shape. Shared by
+/// MANIFEST-LESS VEX, the depscan shape. Shared by
 /// both flavors.
 ///
 ///   1. `.socket/manifest.json` deleted → `vex --offline` attests from the
diff --git a/crates/socket-patch-cli/tests/e2e_bun_lockb.rs b/crates/socket-patch-cli/tests/e2e_bun_lockb.rs
index ae24a544..ea0386e3 100644
--- a/crates/socket-patch-cli/tests/e2e_bun_lockb.rs
+++ b/crates/socket-patch-cli/tests/e2e_bun_lockb.rs
@@ -960,40 +960,27 @@ async fn native_binary_hosted_vendored_takeover_roundtrip() {
 
 #[tokio::test(flavor = "multi_thread")]
 #[serial_test::serial]
-async fn native_binary_scan_vendored_and_detached() {
-    for detached in [false, true] {
-        let Some(fixture) = Fixture::new("direct") else {
-            return;
-        };
-        let server = MockServer::start().await;
-        mock_api(&server, &fixture, "minimist").await;
-        let flags: &[&str] = if detached { &["--detached"] } else { &[] };
-        let result = scan(&fixture.project, &server, "vendored", flags);
-        assert_eq!(
-            result["vendor"]["summary"]["applied"], 1,
-            "scan vendored detached={detached}: {result}"
-        );
-        // Vendored mode is manifest-free either way: `--detached` is an
-        // accepted no-op.
-        assert!(
-            !fixture.project.join(".socket/manifest.json").exists(),
-            "vendored scan must not write a manifest (detached={detached})"
-        );
-        fixture.frozen("scan-vendored", &fixture.patched, "minimist");
-        fixture.manifestless_vex(
-            if detached {
-                "scan-vendored-detached"
-            } else {
-                "scan-vendored"
-            },
-            bun_vex::BunMode::Vendored,
-            &server.uri(),
-        );
-        let result = cli(&fixture.project, &["vendor", "--revert"]);
-        assert_eq!(result["summary"]["removed"], 1, "vendor revert: {result}");
-        fixture.pristine();
-        fixture.frozen("reverted", &fixture.original, "minimist");
-    }
+async fn native_binary_scan_vendored() {
+    let Some(fixture) = Fixture::new("direct") else {
+        return;
+    };
+    let server = MockServer::start().await;
+    mock_api(&server, &fixture, "minimist").await;
+    let result = scan(&fixture.project, &server, "vendored", &[]);
+    assert_eq!(
+        result["vendor"]["summary"]["applied"], 1,
+        "scan vendored: {result}"
+    );
+    assert!(
+        !fixture.project.join(".socket/manifest.json").exists(),
+        "vendored scan must not write a manifest"
+    );
+    fixture.frozen("scan-vendored", &fixture.patched, "minimist");
+    fixture.manifestless_vex("scan-vendored", bun_vex::BunMode::Vendored, &server.uri());
+    let result = cli(&fixture.project, &["vendor", "--revert"]);
+    assert_eq!(result["summary"]["removed"], 1, "vendor revert: {result}");
+    fixture.pristine();
+    fixture.frozen("reverted", &fixture.original, "minimist");
 }
 
 #[tokio::test(flavor = "multi_thread")]
diff --git a/crates/socket-patch-cli/tests/e2e_cargo.rs b/crates/socket-patch-cli/tests/e2e_cargo.rs
index 65581526..3978aff9 100644
--- a/crates/socket-patch-cli/tests/e2e_cargo.rs
+++ b/crates/socket-patch-cli/tests/e2e_cargo.rs
@@ -66,7 +66,6 @@ async fn run(args: &[&str], cwd: &Path, proxy_url: &str) -> Output {
             .env_remove("SOCKET_API_URL")
             .env_remove("SOCKET_OFFLINE")
             .env_remove("SOCKET_PROXY_URL")
-            .env_remove("SOCKET_PATCH_PROXY_URL")
             .env_remove("SOCKET_BATCH_SIZE")
             .output()
             .expect("Failed to run socket-patch binary")
diff --git a/crates/socket-patch-cli/tests/e2e_composer.rs b/crates/socket-patch-cli/tests/e2e_composer.rs
index 92810ff8..8f8081df 100644
--- a/crates/socket-patch-cli/tests/e2e_composer.rs
+++ b/crates/socket-patch-cli/tests/e2e_composer.rs
@@ -61,7 +61,6 @@ async fn run(args: &[&str], cwd: &std::path::Path, proxy_url: &str) -> Output {
             .env_remove("SOCKET_API_URL")
             .env_remove("SOCKET_OFFLINE")
             .env_remove("SOCKET_PROXY_URL")
-            .env_remove("SOCKET_PATCH_PROXY_URL")
             .env_remove("SOCKET_BATCH_SIZE")
             .output()
             .expect("Failed to run socket-patch binary")
diff --git a/crates/socket-patch-cli/tests/e2e_golang.rs b/crates/socket-patch-cli/tests/e2e_golang.rs
index 165c33c3..6a560ae2 100644
--- a/crates/socket-patch-cli/tests/e2e_golang.rs
+++ b/crates/socket-patch-cli/tests/e2e_golang.rs
@@ -96,7 +96,6 @@ async fn run(args: &[&str], cwd: &Path, gomodcache: &Path, api_url: &str) -> Out
             .env_remove("GOPATH")
             .env_remove("SOCKET_OFFLINE")
             .env_remove("SOCKET_PROXY_URL")
-            .env_remove("SOCKET_PATCH_PROXY_URL")
             .env_remove("SOCKET_BATCH_SIZE")
             .output()
             .expect("Failed to run socket-patch binary")
diff --git a/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs b/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
index 225bba3c..59a96a70 100644
--- a/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
@@ -394,7 +394,6 @@ fn day2_machine_builds_patched_module_from_committed_files_alone() {
         token: String::new(),
         patch_uuid: UUID.into(),
         artifact_url: format!("{proxy_url}/{smod}/@v/{SVER}.zip"),
-        berry_zip_url: None,
         registry_override: Some(RegistryOverride {
             kind: "goproxy".into(),
             index_url: proxy_url.clone(),
diff --git a/crates/socket-patch-cli/tests/e2e_hosted_production.rs b/crates/socket-patch-cli/tests/e2e_hosted_production.rs
index ddab397e..be8b9b90 100644
--- a/crates/socket-patch-cli/tests/e2e_hosted_production.rs
+++ b/crates/socket-patch-cli/tests/e2e_hosted_production.rs
@@ -293,15 +293,6 @@ fn has_command(cmd: &str) -> bool {
     probe_cmd.status().map(|s| s.success()).unwrap_or(false)
 }
 
-/// The three legacy `SOCKET_PATCH_*` names still honored at runtime via
-/// `socket_patch_core::utils::env_compat` — not in the clap-bound lists, so they need
-/// scrubbing separately.
-const LEGACY_ENV_VARS: &[&str] = &[
-    "SOCKET_PATCH_PROXY_URL",
-    "SOCKET_PATCH_DEBUG",
-    "SOCKET_PATCH_TELEMETRY_DISABLED",
-];
-
 /// Run the CLI with a hermetically pinned environment.
 ///
 /// The scrub matters more here than in any offline suite. An ambient
@@ -324,11 +315,7 @@ fn run(cwd: &Path, args: &[&str]) -> (i32, String, String) {
         .env("SOCKET_API_TOKEN", "hostile-seed-must-be-scrubbed")
         .env("SOCKET_PROXY_URL", "http://127.0.0.1:1/hostile")
         .env("SOCKET_MANIFEST_PATH", "/nonexistent/manifest.json");
-    for var in GLOBAL_ARG_ENV_VARS
-        .iter()
-        .chain(LOCAL_ARG_ENV_VARS)
-        .chain(LEGACY_ENV_VARS)
-    {
+    for var in GLOBAL_ARG_ENV_VARS.iter().chain(LOCAL_ARG_ENV_VARS) {
         cmd.env_remove(var);
     }
     let out: Output = cmd.output().expect("failed to execute socket-patch binary");
diff --git a/crates/socket-patch-cli/tests/e2e_maven.rs b/crates/socket-patch-cli/tests/e2e_maven.rs
index 006c8a1f..6f447440 100644
--- a/crates/socket-patch-cli/tests/e2e_maven.rs
+++ b/crates/socket-patch-cli/tests/e2e_maven.rs
@@ -70,7 +70,6 @@ async fn run(args: &[&str], cwd: &Path, m2_repo: &Path, proxy_url: &str) -> Outp
             .env_remove("SOCKET_API_URL")
             .env_remove("SOCKET_OFFLINE")
             .env_remove("SOCKET_PROXY_URL")
-            .env_remove("SOCKET_PATCH_PROXY_URL")
             .env_remove("SOCKET_BATCH_SIZE")
             .output()
             .expect("Failed to run socket-patch binary")
diff --git a/crates/socket-patch-cli/tests/e2e_nuget.rs b/crates/socket-patch-cli/tests/e2e_nuget.rs
index e9bd1551..ce4cc499 100644
--- a/crates/socket-patch-cli/tests/e2e_nuget.rs
+++ b/crates/socket-patch-cli/tests/e2e_nuget.rs
@@ -67,7 +67,6 @@ async fn run(args: &[&str], cwd: &Path, nuget_packages: &Path, proxy_url: &str)
             .env_remove("SOCKET_API_URL")
             .env_remove("SOCKET_OFFLINE")
             .env_remove("SOCKET_PROXY_URL")
-            .env_remove("SOCKET_PATCH_PROXY_URL")
             .env_remove("SOCKET_BATCH_SIZE")
             .output()
             .expect("Failed to run socket-patch binary")
diff --git a/crates/socket-patch-cli/tests/e2e_pypi.rs b/crates/socket-patch-cli/tests/e2e_pypi.rs
index ffa19f60..4531d117 100644
--- a/crates/socket-patch-cli/tests/e2e_pypi.rs
+++ b/crates/socket-patch-cli/tests/e2e_pypi.rs
@@ -61,21 +61,11 @@ fn git_sha256_file(path: &Path) -> String {
     git_sha256(&content)
 }
 
-/// The three legacy `SOCKET_PATCH_*` names still honored at runtime via
-/// `socket_patch_core::utils::env_compat` — not in the clap-bound lists, so they
-/// need scrubbing separately.
-const LEGACY_ENV_VARS: &[&str] = &[
-    "SOCKET_PATCH_PROXY_URL",
-    "SOCKET_PATCH_DEBUG",
-    "SOCKET_PATCH_TELEMETRY_DISABLED",
-];
-
 /// Run the CLI binary with the given args, setting `cwd` as the working dir.
 ///
 /// The environment is pinned hard: every env var the CLI binds (the canonical
-/// `GLOBAL_ARG_ENV_VARS` / `LOCAL_ARG_ENV_VARS` lists plus [`LEGACY_ENV_VARS`])
-/// is scrubbed so ambient developer/CI configuration can't change the
-/// lifecycle under test. Scrubbing `SOCKET_API_TOKEN` also forces the
+/// `GLOBAL_ARG_ENV_VARS` / `LOCAL_ARG_ENV_VARS` lists) is scrubbed so ambient
+/// developer/CI configuration can't change the lifecycle under test. Scrubbing `SOCKET_API_TOKEN` also forces the
 /// public-proxy (free-tier) path this suite relies on. The stakes are higher
 /// here than in the offline suites: an inherited `SOCKET_GLOBAL=true` takes
 /// `get`/`apply` out of the temp venv and patches the host's real
@@ -94,11 +84,7 @@ fn run(cwd: &Path, args: &[&str]) -> (i32, String, String) {
         .env("SOCKET_DRY_RUN", "true")
         .env("SOCKET_SAVE_ONLY", "true")
         .env("SOCKET_MANIFEST_PATH", "/nonexistent/manifest.json");
-    for var in GLOBAL_ARG_ENV_VARS
-        .iter()
-        .chain(LOCAL_ARG_ENV_VARS)
-        .chain(LEGACY_ENV_VARS)
-    {
+    for var in GLOBAL_ARG_ENV_VARS.iter().chain(LOCAL_ARG_ENV_VARS) {
         cmd.env_remove(var);
     }
     let out: Output = cmd.output().expect("failed to execute socket-patch binary");
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_cargo_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_cargo_build.rs
index 3df2d5bb..62345cce 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_cargo_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_cargo_build.rs
@@ -512,8 +512,7 @@ async fn redirect_scanned_project(
         .await;
 
     // The driver invocation. Scan: `--mode hosted --vex` — the three-file
-    // rewrite + the in-run (unverified) attestation (`--mode hosted` is the
-    // documented spelling of `--redirect`). Get: `get <uuid> --mode hosted`
+    // rewrite + the in-run (unverified) attestation. Get: `get <uuid> --mode hosted`
     // — same engine, get's confirm gate auto-accepted by --json/--yes, no
     // --vex (get has none).
     let server_uri = server.uri();
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_composer_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_composer_build.rs
index c96762a2..273d7d58 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_composer_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_composer_build.rs
@@ -1,7 +1,7 @@
 //! Real-composer HOSTED (redirect) capstone — the composer twin of
 //! `e2e_redirect_npm_build.rs`, ending in the manifest-less VEX legs.
 //!
-//! `scan --redirect` never lands patched bytes in the repo: it rewrites
+//! `scan --mode hosted` never lands patched bytes in the repo: it rewrites
 //! composer.lock so the patched package's `dist` RESOLVES from Socket's
 //! hosted patch archive (here: a wiremock standing in for patch.socket.dev)
 //! and pins the archive's sha1 in `dist.shasum`. This proves every link of
@@ -15,7 +15,7 @@
 //!      marker comment appended to `src/LoggerInterface.php`, wrapped in a
 //!      GitHub-zipball-style top-level dir) and serve it from wiremock with
 //!      the discovery / reference / view API mocks.
-//!   3. `scan --redirect --json --vex …` (or its `get <uuid> --mode hosted`
+//!   3. `scan --mode hosted --json --vex …` (or its `get <uuid> --mode hosted`
 //!      twin): composer.lock's psr/log `dist` now points at the wiremock
 //!      archive with its sha1, NO redirect ledger and no manifest is written
 //!      (v5: the lock is the hosted state), and the in-run VEX is
@@ -89,7 +89,7 @@ const FILE_KEY: &str = "src/LoggerInterface.php";
 /// Which CLI front door performs the redirect (step 3).
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 enum RedirectCli {
-    /// `scan --redirect --json --yes --vex …` (embedded VEX asserted).
+    /// `scan --mode hosted --json --yes --vex …` (embedded VEX asserted).
     ScanRedirectVex,
     /// `get <UUID> --mode hosted --json --yes` (get has no `--vex`).
     GetUuidHosted,
@@ -331,7 +331,7 @@ async fn redirected_project(
     let mut argv: Vec<&str> = match cli {
         RedirectCli::ScanRedirectVex => vec![
             "scan",
-            "--redirect",
+            "--mode=hosted",
             "--vex",
             "out.vex.json",
             "--vex-product",
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_npm_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_npm_build.rs
index dce12a6c..fb7a7332 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_npm_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_npm_build.rs
@@ -1,6 +1,6 @@
 //! Real-install redirect→VEX capstone e2e for npm — the full-chain proof.
 //!
-//! `scan --redirect` never lands patched bytes in the repo: it rewrites the
+//! `scan --mode hosted` never lands patched bytes in the repo: it rewrites the
 //! lockfile so the patched dependency RESOLVES from Socket's hosted vendored
 //! patch (here: a wiremock standing in for patch.socket.dev). v5 keeps no
 //! redirect ledger: the lockfile pin IS the hosted state. This test proves
@@ -11,7 +11,7 @@
 //!   2. Build a PATCHED tarball from the actually-installed bytes (marker
 //!      comment prepended to `index.js`) and serve it from wiremock, alongside
 //!      the discovery / reference / view API mocks.
-//!   3. `scan --redirect --json --vex …` (the real binary): the lockfile now
+//!   3. `scan --mode hosted --json --vex …` (the real binary): the lockfile now
 //!      pins the wiremock tarball URL + the patched tarball's sha512, NO
 //!      `.socket/vendor/redirect-state.json` is written, and the in-run VEX
 //!      is the unverified `(redirected)` attestation (`verified: false`).
@@ -158,7 +158,7 @@ struct RedirectFixture {
 /// selection must produce the identical on-disk redirect.
 #[derive(Clone, Copy, PartialEq, Debug)]
 enum RedirectCli {
-    /// `scan --redirect --json --yes --vex …` (embedded VEX asserted).
+    /// `scan --mode hosted --json --yes --vex …` (embedded VEX asserted).
     ScanRedirectVex,
     /// `get <UUID> --mode hosted --json --yes` — get has no `--vex`.
     GetUuidHosted,
@@ -365,7 +365,7 @@ async fn redirect_scanned_project(
             .await;
     }
 
-    // The redirect invocation itself: `scan --redirect --vex` (the original
+    // The redirect invocation itself: `scan --mode hosted --vex` (the original
     // capstone, in-run unverified attestation included) or one of the
     // `get … --mode hosted` twins (get has no --vex).
     let uri = server.uri();
@@ -373,7 +373,7 @@ async fn redirect_scanned_project(
     let argv: Vec<&str> = match cli {
         RedirectCli::ScanRedirectVex => vec![
             "scan",
-            "--redirect",
+            "--mode=hosted",
             "--json",
             "--yes",
             "--cwd",
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_uv_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_uv_build.rs
index 3979b4d4..0d691203 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_uv_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_uv_build.rs
@@ -1,5 +1,5 @@
 #![cfg(unix)]
-//! Real-uv capstones for HOSTED mode (`scan --redirect`), ending in
+//! Real-uv capstones for HOSTED mode (`scan --mode hosted`), ending in
 //! manifest-less VEX — the hermetic twin of the production
 //! `e2e_hosted_production::pypi_uv_lock_hosted_install_proof` leg, for every
 //! uv lock shape:
@@ -19,12 +19,12 @@
 //!   pylock.toml` and `pip lock`, installed by `uv pip sync`.
 //!
 //! Each lane: real uv builds and installs the pristine project from PyPI →
-//! `scan --redirect --vex` against a wiremock patch API (which also serves
+//! `scan --mode hosted --vex` against a wiremock patch API (which also serves
 //! the patched wheel at its hosted url) → a fresh checkout of ONLY the
 //! committable files installs with uv from an EMPTY cache, fetching the
 //! wheel from the mock and checking its pin, and imports the patched bytes →
 //! manifest-less VEX: attested with/without ledgers, `record_unavailable`
-//! offline with zero requests, embedded `apply --vex` / `scan --redirect
+//! offline with zero requests, embedded `apply --vex` / `scan --mode hosted
 //! --vex`, NOT attested once the wiring is reverted (ledgers left behind,
 //! `--no-verify` too) → `rollback` restores the files byte for byte. The
 //! driver is `vex_e2e_common/uv.rs`.
diff --git a/crates/socket-patch-cli/tests/e2e_vendor_composer_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_composer_build.rs
index 6119c3c5..2904084c 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_composer_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_composer_build.rs
@@ -38,7 +38,7 @@
 //!   7. **Revert proof**: `vendor --revert` restores composer.lock
 //!      byte-for-byte and removes `.socket/vendor/` entirely.
 //!
-//! A third twin drives `scan --vendor --detached --vex` (the depscan-style
+//! A third twin drives `scan --vendor --vex` (the depscan-style
 //! front door: batch discovery → vendored copy + lock wiring, NO manifest,
 //! embedded VEX in the same run) against the same mocked API, then the same
 //! fresh-checkout install and manifest-less VEX legs.
@@ -935,7 +935,7 @@ async fn composer_get_uuid_vendored_fresh_checkout_install() {
     });
 }
 
-/// `scan --vendor --detached --vex` twin: batch discovery over the REAL
+/// `scan --vendor --vex` twin: batch discovery over the REAL
 /// install → the vendored copy + composer.lock wiring with NO manifest
 /// (detached), the in-run embedded VEX attesting `(vendored)`, then the same
 /// fresh-checkout install and manifest-less VEX legs.
@@ -972,7 +972,6 @@ async fn composer_scan_vendor_detached_vex_fresh_checkout_install() {
         &[
             "scan",
             "--vendor",
-            "--detached",
             "--vendor-source",
             "build",
             "--vex",
@@ -993,7 +992,7 @@ async fn composer_scan_vendor_detached_vex_fresh_checkout_install() {
     );
     assert_eq!(
         code, 0,
-        "scan --vendor --detached --vex failed.\nstdout:\n{stdout}\nstderr:\n{stderr}"
+        "scan --vendor --vex failed.\nstdout:\n{stdout}\nstderr:\n{stderr}"
     );
     let env = parse_envelope(&stdout);
     assert_eq!(env["vex"]["statements"], 1, "in-run vex block: {env}");
@@ -1002,7 +1001,7 @@ async fn composer_scan_vendor_detached_vex_fresh_checkout_install() {
     assert_attested(&doc, &purl, UUID, Marker::Vendored, &[(GHSA, &[VEX_CVE])]);
     assert!(
         !proj.join(".socket/manifest.json").exists(),
-        "--detached must not write a manifest: {env}"
+        "scan --vendor must not write a manifest: {env}"
     );
     let copy_rel = format!(".socket/vendor/composer/{UUID}/{DEP}@{version}");
     let entry = lock_entry(&lock_path, DEP);
diff --git a/crates/socket-patch-cli/tests/e2e_vendor_gem_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_gem_build.rs
index 74b86664..0a2e550d 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_gem_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_gem_build.rs
@@ -252,8 +252,7 @@ struct Vendored<'a> {
     pristine_lock: &'a [u8],
 }
 
-/// Manifest-less VEX over a vendored checkout, the depscan / `vendor
-/// --detached` shape:
+/// Manifest-less VEX over a vendored checkout, the depscan shape:
 ///
 ///   1. `.socket/manifest.json` deleted: `vex --offline` attests
 ///      `(vendored)` from the lock's `PATH` wiring + the vendor ledger's
diff --git a/crates/socket-patch-cli/tests/e2e_vendor_yarn_classic_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_yarn_classic_build.rs
index 157a8df2..753bbcb2 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_yarn_classic_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_yarn_classic_build.rs
@@ -31,8 +31,8 @@
 //!      `vendor --vex`.
 //!
 //! The detached twin (`yarn_classic_detached_scan_vendored_…`) produces the
-//! state with `scan --mode vendored` (plus the kept-for-compat no-op
-//! `--detached`) against a wiremock Socket API instead — the manifest-free
+//! state with `scan --mode vendored` against a wiremock Socket API
+//! instead — the manifest-free
 //! shape every vendored run has — and runs the
 //! same fresh-checkout install + manifest-less VEX matrix (plus the embedded
 //! re-scan).
@@ -622,7 +622,7 @@ fn sha512_sri_b64(bytes: &[u8]) -> String {
 
 // ── detached vendoring from the patch API (the manifest-less shape) ────
 
-/// `scan --mode vendored` (with the legacy no-op `--detached`) against a
+/// `scan --mode vendored` against a
 /// wiremock Socket API: vendored mode NEVER writes `.socket/manifest.json` (the vendor
 /// ledger embeds the record) — the shape a depscan-opened PR commits. The
 /// scan discovers the dep (batch search), the record (with `blobContent`)
@@ -732,7 +732,6 @@ fn yarn_classic_detached_scan_vendored_fresh_checkout_manifestless_vex() {
             "scan",
             "--mode",
             "vendored",
-            "--detached",
             "--json",
             "--yes",
             "--cwd",
@@ -749,7 +748,7 @@ fn yarn_classic_detached_scan_vendored_fresh_checkout_manifestless_vex() {
     );
     assert_eq!(
         code, 0,
-        "scan --mode vendored --detached failed.\nstdout:\n{stdout}\nstderr:\n{stderr}"
+        "scan --mode vendored failed.\nstdout:\n{stdout}\nstderr:\n{stderr}"
     );
     let env = parse_envelope(&stdout);
     assert_eq!(env["status"], "success", "envelope: {env}");
@@ -759,7 +758,7 @@ fn yarn_classic_detached_scan_vendored_fresh_checkout_manifestless_vex() {
     );
     assert!(
         !proj.join(".socket/manifest.json").exists(),
-        "--detached must never write the manifest"
+        "vendored mode must never write the manifest"
     );
     let tgz_rel = format!(".socket/vendor/npm/{UUID}/{DEP}-{DEP_VERSION}.tgz");
     assert!(proj.join(&tgz_rel).is_file(), "vendored tarball missing");
@@ -833,13 +832,12 @@ fn yarn_classic_detached_scan_vendored_fresh_checkout_manifestless_vex() {
             ("vendor --vex", via_vendor()),
             // The command that produced the state, re-run manifest-less.
             (
-                "scan --mode vendored --detached --vex",
+                "scan --mode vendored --vex",
                 Box::new(|run: vex_e2e_common::VexRun| {
                     let mut run = run
                         .via(vex_e2e_common::VexVia::Scan)
                         .arg("--mode")
                         .arg("vendored")
-                        .arg("--detached")
                         .arg("--vendor-source")
                         .arg("build")
                         .arg("--yes");
diff --git a/crates/socket-patch-cli/tests/e2e_vendored_production.rs b/crates/socket-patch-cli/tests/e2e_vendored_production.rs
index 2afa3bd1..46cdb71c 100644
--- a/crates/socket-patch-cli/tests/e2e_vendored_production.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendored_production.rs
@@ -1259,14 +1259,13 @@ fn yarn_classic_vendored_install_proof() {
             ("apply --vex", yarn_classic_vex::via_apply()),
             ("vendor --vex", yarn_classic_vex::via_vendor()),
             // The command the leg itself ran, re-run manifest-less
-            // (`--detached`: no manifest writes — the shape under test).
+            // (vendored mode writes no manifest — the shape under test).
             (
-                "scan --mode vendored --detached --vex",
+                "scan --mode vendored --vex",
                 Box::new(|run: vex_e2e_common::VexRun| {
                     run.via(vex_e2e_common::VexVia::Scan)
                         .arg("--mode")
                         .arg("vendored")
-                        .arg("--detached")
                         .arg("--yes")
                 }),
             ),
diff --git a/crates/socket-patch-cli/tests/e2e_vex_build/hatch.rs b/crates/socket-patch-cli/tests/e2e_vex_build/hatch.rs
index 278cae19..3e6e3eff 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_build/hatch.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_build/hatch.rs
@@ -14,7 +14,7 @@
 //!    hosted rewriter reads the exact pin from the declaration);
 //! 2. the synthetic patch appends a marker to `six.py`; a wiremock Socket
 //!    API serves discovery, the grant, the view and the patched wheel;
-//! 3. hosted: `scan --redirect --vex`; vendored: `scan --vendor
+//! 3. hosted: `scan --mode hosted --vex`; vendored: `scan --vendor
 //!    --vendor-source build --vex` — the same-run VEX attests, and the
 //!    declaration becomes `six @ <url>#sha256=…` /
 //!    `six @ {root:uri}/.socket/vendor/pypi/<uuid>/<wheel>#sha256=…`;
@@ -200,7 +200,7 @@ fn hatch() -> Option<Hatch> {
 
 fn scan_mode_args(mode: Mode) -> Vec<&'static str> {
     match mode {
-        Mode::Hosted => vec!["--redirect"],
+        Mode::Hosted => vec!["--mode=hosted"],
         Mode::Vendored => vec!["--vendor", "--vendor-source", "build"],
     }
 }
diff --git a/crates/socket-patch-cli/tests/e2e_vex_build/pdm.rs b/crates/socket-patch-cli/tests/e2e_vex_build/pdm.rs
index 4e79d00c..cea8568a 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_build/pdm.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_build/pdm.rs
@@ -11,7 +11,7 @@
 //! 2. the synthetic patch appends a marker to the INSTALLED `six.py`; a
 //!    wiremock Socket API serves discovery, the grant, the view and the
 //!    patched wheel itself;
-//! 3. hosted: `scan --redirect --vex` (same-run VEX attests); vendored:
+//! 3. hosted: `scan --mode hosted --vex` (same-run VEX attests); vendored:
 //!    `scan --vendor --vendor-source build --vex`;
 //! 4. a FRESH checkout of only the committable files (pyproject, pdm.lock,
 //!    `.socket/` minus the manifest) is installed by the real `pdm sync` —
@@ -25,7 +25,7 @@
 //!    `record_unavailable` with zero requests, and the lock reverted to the
 //!    registry (vendor ledger + artifacts kept) → `vendor_unwired` /
 //!    hosted: nothing names the patch, `--no-verify` included; plus a
-//!    manifest-less `scan --redirect|--vendor --vex` re-run.
+//!    manifest-less `scan --mode hosted|--vendor --vex` re-run.
 //!
 //! Releases whose lock format loses url/path identity (PDM 1.8 – 1.15 =
 //! 3.1, 2.0 – 2.7 = 4.0 – 4.2) must REFUSE both scans with the lock
@@ -310,7 +310,7 @@ fn patched_of(pristine: &[u8]) -> Vec<u8> {
 
 fn scan_mode_args(mode: Mode) -> Vec<&'static str> {
     match mode {
-        Mode::Hosted => vec!["--redirect"],
+        Mode::Hosted => vec!["--mode=hosted"],
         Mode::Vendored => vec!["--vendor", "--vendor-source", "build"],
     }
 }
diff --git a/crates/socket-patch-cli/tests/e2e_vex_build/pip.rs b/crates/socket-patch-cli/tests/e2e_vex_build/pip.rs
index 0b60020c..5a6d336c 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_build/pip.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_build/pip.rs
@@ -12,7 +12,7 @@
 //!
 //! 1. `python -m pip install -r requirements.txt` with the real pip major
 //!    from PyPI (the pristine install);
-//! 2. `socket-patch scan --redirect --vex` (hosted, on the lock-only
+//! 2. `socket-patch scan --mode hosted --vex` (hosted, on the lock-only
 //!    checkout) / `scan --vendor --vendor-source build --vex` (vendored,
 //!    from the pristine install) against a wiremock Socket API that also
 //!    serves the patched wheel — the same-run document attests;
@@ -24,7 +24,7 @@
 //! 4. the manifest-less VEX matrix (`vex_pipenv_pip_real`): manifest
 //!    deleted, ledgers deleted, `--offline` (zero requests), requirements
 //!    reverted to the registry pin (also `--no-verify`), `apply --vex`;
-//!    plus the embedded `scan --redirect --vex` / `scan --vendor --vex`
+//!    plus the embedded `scan --mode hosted --vex` / `scan --vendor --vex`
 //!    re-run on the manifest-less checkout.
 //!
 //! `#[ignore]`d (network: PyPI) — run with `--ignored`; CI sets
diff --git a/crates/socket-patch-cli/tests/e2e_vex_build/pipenv.rs b/crates/socket-patch-cli/tests/e2e_vex_build/pipenv.rs
index f4e4d57d..d32bb582 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_build/pipenv.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_build/pipenv.rs
@@ -5,7 +5,7 @@
 //!
 //! 1. `pipenv install six==1.16.0` from PyPI (in-project venv) — the native
 //!    Pipfile.lock that release writes;
-//! 2. `socket-patch scan --redirect --vex` (hosted, on the lock-only
+//! 2. `socket-patch scan --mode hosted --vex` (hosted, on the lock-only
 //!    checkout: the CI shape) / `scan --vendor --vendor-source build --vex`
 //!    (vendored, from the pristine install) against a wiremock Socket API
 //!    that also serves the patched wheel — the same-run document attests;
@@ -17,7 +17,7 @@
 //! 4. the manifest-less VEX matrix (`vex_pipenv_pip_real`): manifest
 //!    deleted, ledgers deleted, `--offline` (zero requests), lock reverted
 //!    to the registry (also `--no-verify`), `apply --vex`; plus the
-//!    embedded `scan --redirect --vex` / `scan --vendor --vex` re-run on the
+//!    embedded `scan --mode hosted --vex` / `scan --vendor --vex` re-run on the
 //!    manifest-less checkout.
 //!
 //! Versions: `SOCKET_PATCH_PIPENV_E2E_VERSIONS` (space / comma separated),
diff --git a/crates/socket-patch-cli/tests/e2e_vex_build/poetry.rs b/crates/socket-patch-cli/tests/e2e_vex_build/poetry.rs
index bd6d2b4a..e3834829 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_build/poetry.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_build/poetry.rs
@@ -4,7 +4,7 @@
 //! 1. a real project on `six==1.16.0`, locked by the real `poetry lock`
 //!    (PyPI is used for fixture setup only);
 //! 2. OUR CLI produces the committed state against a wiremock patch service:
-//!    hosted = `scan --redirect --vex` on the lock-only checkout (the lock is
+//!    hosted = `scan --mode hosted --vex` on the lock-only checkout (the lock is
 //!    repointed at a patched wheel the mock serves — v5 writes NO redirect
 //!    ledger — the same-run VEX attests from the lock's sha256 pin); vendored
 //!    = `scan --vendor --vendor-source build --vex` over the pristine
@@ -765,14 +765,14 @@ fn poetry_hosted_fresh_install_then_manifestless_vex() {
         &service,
         &[
             "scan",
-            "--redirect",
+            "--mode=hosted",
             "--vex",
             embedded.to_str().unwrap(),
             "--vex-product",
             PRODUCT,
         ],
     );
-    assert_eq!(code, Some(0), "scan --redirect: {env}");
+    assert_eq!(code, Some(0), "scan --mode hosted: {env}");
     assert_eq!(env["redirect"]["redirected"], 1, "{env}");
     let lock = std::fs::read_to_string(project.join("poetry.lock")).unwrap();
     let sha = hex::encode(Sha256::digest(&wheel));
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/bun.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/bun.rs
index 67ffce61..8b7d6d6b 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/bun.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/bun.rs
@@ -221,7 +221,6 @@ fn binary_lock(release: &str, wiring: &Wiring) -> Vec<u8> {
         token: TOKEN.into(),
         patch_uuid: uuid,
         artifact_url,
-        berry_zip_url: None,
         registry_override: None,
         integrity: Integrity {
             sha512: Some(sri),
@@ -779,14 +778,14 @@ fn scan_hosted(cwd: &Path, flavor: Flavor, api: &Api) -> Vec<u8> {
 /// `scan --mode vendored --vendor-source build --vex` against an installed
 /// pristine minimist: the real engine builds + commits the tarball, rewires
 /// the lock, and the in-run VEX attests `(vendored)`. Vendored mode is
-/// manifest-free, so neither spelling writes a manifest (`--detached` is a
-/// hidden compatibility no-op). Returns the pre-scan lock bytes.
-fn scan_vendored(cwd: &Path, flavor: Flavor, api: &Api, detached: bool) -> Vec<u8> {
+/// manifest-free, so no manifest is written. Returns the pre-scan lock
+/// bytes.
+fn scan_vendored(cwd: &Path, flavor: Flavor, api: &Api) -> Vec<u8> {
     write_lock(cwd, flavor, &Wiring::Registry);
     install(cwd, PRISTINE);
     let registry_lock = std::fs::read(cwd.join(flavor.lock_file())).unwrap();
     api.serve_scan(tgz(PATCHED));
-    let mut args = vec![
+    let args = vec![
         "scan",
         "--mode",
         "vendored",
@@ -798,11 +797,8 @@ fn scan_vendored(cwd: &Path, flavor: Flavor, api: &Api, detached: bool) -> Vec<u
         "--vex-product",
         PRODUCT,
     ];
-    if detached {
-        args.push("--detached");
-    }
     let (code, env) = socket_json(cwd, api, &args);
-    let what = format!("{flavor:?} scan --mode vendored detached={detached} --vex");
+    let what = format!("{flavor:?} scan --mode vendored --vex");
     assert_eq!(code, Some(0), "{what}: {env}");
     assert_eq!(env["vendor"]["summary"]["applied"], 1, "{what}: {env}");
     assert_eq!(env["vex"]["statements"], 1, "{what}: {env}");
@@ -895,77 +891,75 @@ fn c_d_hosted_real_scan_attests_online_only_and_dies_with_the_lock() {
 #[test]
 fn c_d_e_vendored_ledger_from_real_scan() {
     for flavor in FLAVORS {
-        for detached in [false, true] {
-            let what = format!("{flavor:?} vendored detached={detached}");
-            let tmp = project();
-            let cwd = tmp.path();
-            let api = Api::start();
-            let registry_lock = scan_vendored(cwd, flavor, &api, detached);
-            drop_manifest_and_install(cwd);
+        let what = format!("{flavor:?} vendored");
+        let tmp = project();
+        let cwd = tmp.path();
+        let api = Api::start();
+        let registry_lock = scan_vendored(cwd, flavor, &api);
+        drop_manifest_and_install(cwd);
 
-            // c) ledger + artifact, no manifest: offline.
-            let (code, env) = vex(cwd, &["--offline"]);
-            assert_attested(cwd, code, &env, UUID, "vendored", &format!("{what} ledger"));
+        // c) ledger + artifact, no manifest: offline.
+        let (code, env) = vex(cwd, &["--offline"]);
+        assert_attested(cwd, code, &env, UUID, "vendored", &format!("{what} ledger"));
 
-            // a) no ledger either: online from the API.
-            let saved = std::fs::read(cwd.join(".socket/vendor/state.json")).unwrap();
-            drop_ledgers(cwd);
-            let (code, env) = vex_online(cwd, &api, &[]);
-            assert_attested(
-                cwd,
-                code,
-                &env,
-                UUID,
-                "vendored",
-                &format!("{what} lock only"),
-            );
-            let (code, env) = vex(cwd, &["--offline"]);
-            assert_omitted(
-                cwd,
-                code,
-                &env,
-                "record_unavailable",
-                &format!("{what} offline"),
-            );
-            std::fs::write(cwd.join(".socket/vendor/state.json"), &saved).unwrap();
-
-            // e) a tampered member of the committed artifact: omitted with
-            // the ledger and without it.
-            let artifact = cwd.join(vendored_rel(UUID));
-            let honest = std::fs::read(&artifact).unwrap();
-            std::fs::write(&artifact, tgz(TAMPERED)).unwrap();
-            let (code, env) = vex(cwd, &["--offline"]);
-            assert_omitted(
-                cwd,
-                code,
-                &env,
-                "vendor_hash_mismatch",
-                &format!("{what} tamper"),
-            );
-            drop_ledgers(cwd);
-            let (code, env) = vex_online(cwd, &api, &[]);
+        // a) no ledger either: online from the API.
+        let saved = std::fs::read(cwd.join(".socket/vendor/state.json")).unwrap();
+        drop_ledgers(cwd);
+        let (code, env) = vex_online(cwd, &api, &[]);
+        assert_attested(
+            cwd,
+            code,
+            &env,
+            UUID,
+            "vendored",
+            &format!("{what} lock only"),
+        );
+        let (code, env) = vex(cwd, &["--offline"]);
+        assert_omitted(
+            cwd,
+            code,
+            &env,
+            "record_unavailable",
+            &format!("{what} offline"),
+        );
+        std::fs::write(cwd.join(".socket/vendor/state.json"), &saved).unwrap();
+
+        // e) a tampered member of the committed artifact: omitted with
+        // the ledger and without it.
+        let artifact = cwd.join(vendored_rel(UUID));
+        let honest = std::fs::read(&artifact).unwrap();
+        std::fs::write(&artifact, tgz(TAMPERED)).unwrap();
+        let (code, env) = vex(cwd, &["--offline"]);
+        assert_omitted(
+            cwd,
+            code,
+            &env,
+            "vendor_hash_mismatch",
+            &format!("{what} tamper"),
+        );
+        drop_ledgers(cwd);
+        let (code, env) = vex_online(cwd, &api, &[]);
+        assert_omitted(
+            cwd,
+            code,
+            &env,
+            "vendor_hash_mismatch",
+            &format!("{what} tamper lock only"),
+        );
+        std::fs::write(&artifact, honest).unwrap();
+        std::fs::write(cwd.join(".socket/vendor/state.json"), &saved).unwrap();
+
+        // d) lock reverted, ledger + artifact left behind.
+        std::fs::write(cwd.join(flavor.lock_file()), &registry_lock).unwrap();
+        for extra in [&[][..], &["--no-verify"][..]] {
+            let (code, env) = vex(cwd, &[&["--offline"][..], extra].concat());
             assert_omitted(
                 cwd,
                 code,
                 &env,
-                "vendor_hash_mismatch",
-                &format!("{what} tamper lock only"),
+                "vendor_unwired",
+                &format!("{what} reverted {extra:?}"),
             );
-            std::fs::write(&artifact, honest).unwrap();
-            std::fs::write(cwd.join(".socket/vendor/state.json"), &saved).unwrap();
-
-            // d) lock reverted, ledger + artifact left behind.
-            std::fs::write(cwd.join(flavor.lock_file()), &registry_lock).unwrap();
-            for extra in [&[][..], &["--no-verify"][..]] {
-                let (code, env) = vex(cwd, &[&["--offline"][..], extra].concat());
-                assert_omitted(
-                    cwd,
-                    code,
-                    &env,
-                    "vendor_unwired",
-                    &format!("{what} reverted {extra:?}"),
-                );
-            }
         }
     }
 }
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/composer.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/composer.rs
index e0d31b63..3f4121bb 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/composer.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/composer.rs
@@ -377,7 +377,7 @@ fn honest_api() -> PatchApi {
     PatchApi::start(vec![(UUID.into(), view(UUID, PURL))])
 }
 
-/// `.socket/vendor/redirect-state.json` as `scan --redirect` writes it for a
+/// `.socket/vendor/redirect-state.json` as `scan --mode hosted` writes it for a
 /// composer redirect: the record plus the lock edit.
 fn write_redirect_ledger(cwd: &Path, key: &str, rec: PatchRecord) {
     let mut state = RedirectState::new();
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/pdm.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/pdm.rs
index f2678626..7de78ae5 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/pdm.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/pdm.rs
@@ -27,8 +27,8 @@
 //! root-escaping path and mismatched records never attest; g) hosted
 //! installed-tree states (not installed → pin, patched → hashed, pristine →
 //! `not_applied`), pinless hosted needs an install, vendored over a pristine
-//! venv warns; plus the embedded `scan --redirect|--vendor --vex`,
-//! `scan --vendor --detached --vex`, `apply --vex` and `vendor --vex`.
+//! venv warns; plus the embedded `scan --mode hosted|--vendor --vex`,
+//! `apply --vex` and `vendor --vex`.
 //!
 //! The real-PDM counterpart (real `pdm lock` / `pdm sync`, per PDM release)
 //! is `e2e_vex_build/pdm.rs`.
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/pipenv.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/pipenv.rs
index f076a160..dc943805 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/pipenv.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/pipenv.rs
@@ -21,8 +21,8 @@
 //! record-mismatched references never attest; hosted not-installed attests
 //! from the pin, a pristine install is `not_applied`, pinless needs an
 //! install; a vendored wheel over a pristine venv warns; and the embedded
-//! forms (`scan --redirect --vex` / `scan --vendor --vex` re-runs,
-//! `scan --vendor --detached --vex`, `apply --vex`, `vendor --vex`).
+//! forms (`scan --mode hosted --vex` / `scan --vendor --vex` re-runs,
+//! `apply --vex`, `vendor --vex`).
 //!
 //! Pipenv-specific cells below: a relock that re-serializes AROUND our
 //! reference (Pipenv 2023+ restores `version` / `index` / registry
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/poetry.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/poetry.rs
index 8601113e..7142c84f 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/poetry.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/poetry.rs
@@ -11,7 +11,7 @@
 //! fixture cells run the core `rewrite_poetry_lock` over the committed native
 //! locks of every Poetry release (`socket-patch-core/tests/fixtures/poetry/
 //! <0.12.17..2.4.3>/`: lock formats "0" / "1.0" / "1.1" / "2.0" / "2.1"), and
-//! the writer-driven cells run the real `scan --redirect --vex` / `scan
+//! the writer-driven cells run the real `scan --mode hosted --vex` / `scan
 //! --vendor --vex` / `apply --vex` / `vendor --vex` binaries against a
 //! wiremock patch API. The package is renamed to a made-up `vexfixture`, so
 //! no interpreter's global site-packages on the test host can hold a copy.
@@ -1240,7 +1240,7 @@ fn strip_pin(lock: &str, pin: &str) -> String {
 }
 
 // ════════════════════════════════════════════════════════════════════════
-// Writer-driven: the REAL `scan --redirect --vex` / `scan --vendor --vex`
+// Writer-driven: the REAL `scan --mode hosted --vex` / `scan --vendor --vex`
 // write the wiring and the ledgers; then the manifest (and the ledgers) are
 // deleted and standalone + embedded VEX must still attest — and stop
 // attesting once the real revert unwinds the wiring with the ledger left
@@ -1428,7 +1428,7 @@ fn embedded(p: &Proj, api: &PatchApi, via: VexVia, offline: bool, extra: &[&str]
     run_vex(&binary(), &p.root, &run)
 }
 
-/// `scan --redirect --vex` on a lock-only checkout (nothing installed)
+/// `scan --mode hosted --vex` on a lock-only checkout (nothing installed)
 /// writes the hosted wiring — and NO ledger (v5) — and attests in-run from
 /// this run's records; then, with no manifest:
 ///   b. offline is `record_unavailable` with no request (standalone and
@@ -1444,7 +1444,7 @@ fn embedded(p: &Proj, api: &PatchApi, via: VexVia, offline: bool, extra: &[&str]
 fn scan_redirect_wiring_attests_without_manifest_or_ledger() {
     for release in WRITER_RELEASES {
         for self_hosted in [false, true] {
-            let what = format!("poetry {release} scan --redirect self_hosted={self_hosted}");
+            let what = format!("poetry {release} scan --mode hosted self_hosted={self_hosted}");
             let p = Proj::new();
             p.write_files(&native_files(release));
             p.empty_venv();
@@ -1466,7 +1466,7 @@ fn scan_redirect_wiring_attests_without_manifest_or_ledger() {
                 &scan,
                 &[
                     "scan",
-                    "--redirect",
+                    "--mode=hosted",
                     "--vex",
                     embedded_doc.to_str().unwrap(),
                     "--vex-product",
@@ -1561,104 +1561,69 @@ fn scan_redirect_wiring_attests_without_manifest_or_ledger() {
 ///   a. without the ledger, online attests (the committed wheel is hashed);
 ///   d. `vendor --revert` unwinds the wiring; with the ledger put back (and
 ///      the artifact re-committed) it is `vendor_unwired`, `--no-verify` too.
-/// The `--detached` twin (a hidden compatibility no-op) behaves the same.
 #[test]
 fn scan_vendor_wiring_attests_without_manifest_or_ledger() {
-    for detached in [false, true] {
-        for release in WRITER_RELEASES {
-            let what = format!("poetry {release} scan --vendor detached={detached}");
-            let p = Proj::new();
-            p.write_files(&native_files(release));
-            p.install(PRISTINE);
-            let scan = ScanApi::start(
-                VENDORED_UUID,
-                Some(&hosted_url(VENDORED_UUID)),
-                &build_wheel(PATCHED),
-            );
-            let embedded_doc = p.root.join("embedded.vex.json");
-            let mut args = vec![
-                "scan",
-                "--vendor",
-                "--vendor-source",
-                "build",
-                "--vex",
-                embedded_doc.to_str().unwrap(),
-                "--vex-product",
-                PRODUCT,
-            ];
-            if detached {
-                args.push("--detached");
-            }
-            let (code, env) = run_authed(&p, &scan, &args);
-            assert_eq!(code, Some(0), "{what}: {env}");
-            assert_embedded_doc(&what, &embedded_doc, Mode::Vendored);
-            let lock = p.read("poetry.lock");
-            assert!(
-                lock.contains(&format!("url = \"{}\"", vendored_rel(VENDORED_UUID))),
-                "{what}: lock not wired:\n{lock}"
-            );
-            assert!(lock.contains("type = \"file\""), "{what}:\n{lock}");
-            assert!(
-                !p.exists(".socket/manifest.json"),
-                "{what}: vendored mode is manifest-free (--detached is a no-op)"
-            );
-            // Vendoring never patches the installed tree.
-            assert_eq!(std::fs::read(p.site().join(MODULE)).unwrap(), PRISTINE);
-
-            let api = api_for(Mode::Vendored);
-            // A legacy (pre-5.0) checkout also carries the manifest record
-            // beside the ledger: same uuid, so it attests the same way.
-            assert!(vex_e2e_common::seed_legacy_manifest(&p.root) > 0, "{what}");
-            let out = vex(&p, &api, true, &[]);
-            assert_attested(
-                &format!("{what} legacy manifest"),
-                &out,
-                Mode::Vendored,
-                VENDORED_UUID,
-            );
-            vex_e2e_common::strip_manifest(&p.root);
-            // c. the ledger alone — standalone and both embedded commands.
-            let out = vex(&p, &api, true, &[]);
-            assert_attested(
-                &format!("{what} ledger"),
-                &out,
-                Mode::Vendored,
-                VENDORED_UUID,
-            );
-            for via in [VexVia::Vendor, VexVia::Apply] {
-                let out = embedded(&p, &api, via, true, &[]);
-                assert_eq!(out.code, Some(0), "{what} {via:?} --vex ledger: {out}");
-                assert_eq!(out.envelope["status"], "noManifest", "{what}: {out}");
-                vex_e2e_common::assert_attested(
-                    out.doc(),
-                    &purl(),
-                    VENDORED_UUID,
-                    Marker::Vendored,
-                    &[(GHSA, &[CVE])],
-                );
-            }
-            api.assert_no_requests();
+    for release in WRITER_RELEASES {
+        let what = format!("poetry {release} scan --vendor");
+        let p = Proj::new();
+        p.write_files(&native_files(release));
+        p.install(PRISTINE);
+        let scan = ScanApi::start(
+            VENDORED_UUID,
+            Some(&hosted_url(VENDORED_UUID)),
+            &build_wheel(PATCHED),
+        );
+        let embedded_doc = p.root.join("embedded.vex.json");
+        let args = vec![
+            "scan",
+            "--vendor",
+            "--vendor-source",
+            "build",
+            "--vex",
+            embedded_doc.to_str().unwrap(),
+            "--vex-product",
+            PRODUCT,
+        ];
+        let (code, env) = run_authed(&p, &scan, &args);
+        assert_eq!(code, Some(0), "{what}: {env}");
+        assert_embedded_doc(&what, &embedded_doc, Mode::Vendored);
+        let lock = p.read("poetry.lock");
+        assert!(
+            lock.contains(&format!("url = \"{}\"", vendored_rel(VENDORED_UUID))),
+            "{what}: lock not wired:\n{lock}"
+        );
+        assert!(lock.contains("type = \"file\""), "{what}:\n{lock}");
+        assert!(
+            !p.exists(".socket/manifest.json"),
+            "{what}: vendored mode is manifest-free"
+        );
+        // Vendoring never patches the installed tree.
+        assert_eq!(std::fs::read(p.site().join(MODULE)).unwrap(), PRISTINE);
 
-            // b / a. no ledger.
-            let ledger_path = p.root.join(".socket/vendor/state.json");
-            let ledger = std::fs::read(&ledger_path).unwrap();
-            strip_ledgers(&p);
-            let out = vex(&p, &api, true, &[]);
-            assert_omitted(
-                &format!("{what} no ledger offline"),
-                &out,
-                "record_unavailable",
-            );
-            api.assert_no_requests();
-            let out = vex(&p, &api, false, &[]);
-            assert_attested(
-                &format!("{what} no ledger online"),
-                &out,
-                Mode::Vendored,
-                VENDORED_UUID,
-            );
-            let out = embedded(&p, &api, VexVia::Vendor, false, &[]);
-            assert_eq!(out.code, Some(0), "{what} vendor --vex online: {out}");
+        let api = api_for(Mode::Vendored);
+        // A legacy (pre-5.0) checkout also carries the manifest record
+        // beside the ledger: same uuid, so it attests the same way.
+        assert!(vex_e2e_common::seed_legacy_manifest(&p.root) > 0, "{what}");
+        let out = vex(&p, &api, true, &[]);
+        assert_attested(
+            &format!("{what} legacy manifest"),
+            &out,
+            Mode::Vendored,
+            VENDORED_UUID,
+        );
+        vex_e2e_common::strip_manifest(&p.root);
+        // c. the ledger alone — standalone and both embedded commands.
+        let out = vex(&p, &api, true, &[]);
+        assert_attested(
+            &format!("{what} ledger"),
+            &out,
+            Mode::Vendored,
+            VENDORED_UUID,
+        );
+        for via in [VexVia::Vendor, VexVia::Apply] {
+            let out = embedded(&p, &api, via, true, &[]);
+            assert_eq!(out.code, Some(0), "{what} {via:?} --vex ledger: {out}");
+            assert_eq!(out.envelope["status"], "noManifest", "{what}: {out}");
             vex_e2e_common::assert_attested(
                 out.doc(),
                 &purl(),
@@ -1666,41 +1631,70 @@ fn scan_vendor_wiring_attests_without_manifest_or_ledger() {
                 Marker::Vendored,
                 &[(GHSA, &[CVE])],
             );
-            assert_no_manifest_written(&p, &what);
+        }
+        api.assert_no_requests();
 
-            // d. the real revert, then the ledger + artifact put back.
-            std::fs::write(&ledger_path, &ledger).unwrap();
-            let artifact_dir = p.root.join(format!(".socket/vendor/pypi/{VENDORED_UUID}"));
-            let artifacts: Vec<(PathBuf, Vec<u8>)> = std::fs::read_dir(&artifact_dir)
-                .unwrap()
-                .flatten()
-                .map(|e| (e.path(), std::fs::read(e.path()).unwrap()))
-                .collect();
-            let (code, env) = run_authed(&p, &scan, &["vendor", "--revert"]);
-            assert_eq!(code, Some(0), "{what} revert: {env}");
-            for (name, text) in native_files(release) {
-                assert_eq!(p.read(name), text, "{what}: revert restores {name}");
-            }
-            std::fs::create_dir_all(&artifact_dir).unwrap();
-            for (path, bytes) in &artifacts {
-                std::fs::write(path, bytes).unwrap();
-            }
-            std::fs::write(&ledger_path, &ledger).unwrap();
-            for extra in [&[][..], &["--no-verify"][..]] {
-                let out = vex(&p, &api, true, extra);
-                assert_omitted(
-                    &format!("{what} reverted {extra:?}"),
-                    &out,
-                    "vendor_unwired",
-                );
-                let out = vex(&p, &api, false, extra);
-                assert_omitted(
-                    &format!("{what} reverted online {extra:?}"),
-                    &out,
-                    "vendor_unwired",
-                );
-            }
-            let _ = scan.requests();
+        // b / a. no ledger.
+        let ledger_path = p.root.join(".socket/vendor/state.json");
+        let ledger = std::fs::read(&ledger_path).unwrap();
+        strip_ledgers(&p);
+        let out = vex(&p, &api, true, &[]);
+        assert_omitted(
+            &format!("{what} no ledger offline"),
+            &out,
+            "record_unavailable",
+        );
+        api.assert_no_requests();
+        let out = vex(&p, &api, false, &[]);
+        assert_attested(
+            &format!("{what} no ledger online"),
+            &out,
+            Mode::Vendored,
+            VENDORED_UUID,
+        );
+        let out = embedded(&p, &api, VexVia::Vendor, false, &[]);
+        assert_eq!(out.code, Some(0), "{what} vendor --vex online: {out}");
+        vex_e2e_common::assert_attested(
+            out.doc(),
+            &purl(),
+            VENDORED_UUID,
+            Marker::Vendored,
+            &[(GHSA, &[CVE])],
+        );
+        assert_no_manifest_written(&p, &what);
+
+        // d. the real revert, then the ledger + artifact put back.
+        std::fs::write(&ledger_path, &ledger).unwrap();
+        let artifact_dir = p.root.join(format!(".socket/vendor/pypi/{VENDORED_UUID}"));
+        let artifacts: Vec<(PathBuf, Vec<u8>)> = std::fs::read_dir(&artifact_dir)
+            .unwrap()
+            .flatten()
+            .map(|e| (e.path(), std::fs::read(e.path()).unwrap()))
+            .collect();
+        let (code, env) = run_authed(&p, &scan, &["vendor", "--revert"]);
+        assert_eq!(code, Some(0), "{what} revert: {env}");
+        for (name, text) in native_files(release) {
+            assert_eq!(p.read(name), text, "{what}: revert restores {name}");
+        }
+        std::fs::create_dir_all(&artifact_dir).unwrap();
+        for (path, bytes) in &artifacts {
+            std::fs::write(path, bytes).unwrap();
+        }
+        std::fs::write(&ledger_path, &ledger).unwrap();
+        for extra in [&[][..], &["--no-verify"][..]] {
+            let out = vex(&p, &api, true, extra);
+            assert_omitted(
+                &format!("{what} reverted {extra:?}"),
+                &out,
+                "vendor_unwired",
+            );
+            let out = vex(&p, &api, false, extra);
+            assert_omitted(
+                &format!("{what} reverted online {extra:?}"),
+                &out,
+                "vendor_unwired",
+            );
         }
+        let _ = scan.requests();
     }
 }
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/uv.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/uv.rs
index 5a9f7960..af798ff7 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/uv.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/uv.rs
@@ -10,7 +10,7 @@
 //! rewriters (`rewrite_python_lock`, `rewrite_project_metadata`,
 //! `rewrite_script_metadata`) over real uv output (uv 0.11 `uv lock` /
 //! `uv lock --script` / `uv export --format pylock.toml` grammar), and the
-//! writer-driven cells run the real `scan --redirect --vex` / `scan --vendor
+//! writer-driven cells run the real `scan --mode hosted --vex` / `scan --vendor
 //! --vex` binaries against a wiremock patch API. The package is a made-up
 //! `vexfixture`, so no interpreter's global site-packages on the test host
 //! can hold a copy (a no-venv python project falls back to the global
@@ -36,7 +36,7 @@
 //!      installed + patched → attests after hashing; installed pristine →
 //!      `not_applied`; a pin-less hosted entry needs an installed tree.
 //!
-//! Plus the embedded entry points (`scan --redirect --vex`, `scan --vendor
+//! Plus the embedded entry points (`scan --mode hosted --vex`, `scan --vendor
 //! --vex`, `apply --vex`).
 
 use crate::vex_e2e_common;
@@ -1367,7 +1367,7 @@ fn pinless_hosted_entry_needs_an_installed_tree() {
 }
 
 // ════════════════════════════════════════════════════════════════════════
-// Writer-driven: the REAL `scan --redirect --vex` / `scan --vendor --vex`
+// Writer-driven: the REAL `scan --mode hosted --vex` / `scan --vendor --vex`
 // write the wiring and the ledgers; then the manifest (and the ledgers) are
 // deleted and standalone `vex` must still attest — and stop attesting once
 // the real revert unwinds the wiring with the ledger left behind.
@@ -1379,7 +1379,7 @@ impl Api {
     /// per-package search, the hosted grant (`artifact_url` pinned to
     /// `sha256`), the authenticated view with inline blob content, plus the
     /// public-proxy view `vex` falls back to and the hosted wheel itself
-    /// (`scan --redirect` reads a uv lock's wheel METADATA from it).
+    /// (`scan --mode hosted` reads a uv lock's wheel METADATA from it).
     fn serve_scan_routes(
         &self,
         flavor: Flavor,
@@ -1515,7 +1515,7 @@ fn writer_flavors() -> Vec<Flavor> {
     flavors(Mode::Hosted)
 }
 
-/// `scan --redirect --vex` on a lock-only checkout (nothing installed; an
+/// `scan --mode hosted --vex` on a lock-only checkout (nothing installed; an
 /// empty in-project venv keeps the crawl off the host interpreters) writes
 /// the hosted wiring — and NO ledger (v5) — and attests in-run from this
 /// run's records; afterwards, with no manifest:
@@ -1531,7 +1531,7 @@ fn writer_flavors() -> Vec<Flavor> {
 #[test]
 fn scan_redirect_wiring_attests_without_manifest_or_ledger() {
     for flavor in writer_flavors() {
-        let what = format!("{} scan --redirect", flavor.label());
+        let what = format!("{} scan --mode hosted", flavor.label());
         let p = Proj::new();
         p.write_files(&flavor.native_files());
         std::fs::create_dir_all(p.site()).unwrap();
@@ -1555,7 +1555,7 @@ fn scan_redirect_wiring_attests_without_manifest_or_ledger() {
             &api,
             &[
                 "scan",
-                "--redirect",
+                "--mode=hosted",
                 "--vex",
                 embedded.to_str().unwrap(),
                 "--vex-product",
@@ -1634,142 +1634,132 @@ fn scan_redirect_wiring_attests_without_manifest_or_ledger() {
 ///   a. without the ledger, online attests (the committed wheel is hashed);
 ///   d. `vendor --revert` unwinds the wiring; with the ledger put back (and
 ///      the artifact re-committed) it is `vendor_unwired`.
-/// The `--detached` twin (a hidden compatibility no-op) behaves the same.
 #[test]
 fn scan_vendor_wiring_attests_without_manifest_or_ledger() {
-    for detached in [false, true] {
-        for flavor in writer_flavors() {
-            if matches!(flavor, Flavor::UvLockOnly) {
-                // uv vendoring always edits the pyproject/lock pair.
-                continue;
-            }
-            let what = format!(
-                "{} scan --vendor{}",
-                flavor.label(),
-                if detached { " --detached" } else { "" }
-            );
-            let p = Proj::new();
-            p.write_files(&flavor.native_files());
-            p.install(flavor.version(), PRISTINE);
-            let api = Api::start();
-            api.serve_scan_routes(
-                flavor,
-                VENDORED_UUID,
-                &flavor.hosted_url(VENDORED_UUID),
-                build_wheel(flavor.version(), PATCHED),
-            );
-            let embedded = p.root.join("embedded.vex.json");
-            let mut args = vec![
-                "scan",
-                "--vendor",
-                "--vendor-source",
-                "build",
-                "--vex",
-                embedded.to_str().unwrap(),
-                "--vex-product",
-                PRODUCT,
-            ];
-            if detached {
-                args.push("--detached");
-            }
-            let (code, env) = run_authed(&p, &api, &args);
-            assert_eq!(code, Some(0), "{what}: {env}");
-            assert_embedded_doc(&what, &embedded, VENDORED_UUID, Mode::Vendored);
-            let lock = p.read(flavor.lock_file());
-            assert!(
-                lock.contains(&format!(".socket/vendor/pypi/{VENDORED_UUID}/")),
-                "{what}: lock not wired:\n{lock}"
-            );
-            assert!(
-                !p.exists(".socket/manifest.json"),
-                "{what}: vendored mode is manifest-free (--detached is a no-op)"
-            );
-            // The installed tree stays pristine: vendoring never patches it.
-            assert_eq!(std::fs::read(p.site().join(MODULE)).unwrap(), PRISTINE);
-            // A legacy (pre-5.0) checkout also carries the manifest record
-            // beside the ledger: same uuid, so it attests the same way.
-            assert!(vex_e2e_common::seed_legacy_manifest(&p.root) > 0, "{what}");
-            let (code, env, doc) = vex_offline(&p, &api, &[]);
-            assert_attested(
-                &format!("{what} legacy manifest"),
-                code,
-                &env,
-                &doc,
-                &flavor.api_purl(),
-                VENDORED_UUID,
-                Mode::Vendored,
-            );
-            vex_e2e_common::strip_manifest(&p.root);
+    for flavor in writer_flavors() {
+        if matches!(flavor, Flavor::UvLockOnly) {
+            // uv vendoring always edits the pyproject/lock pair.
+            continue;
+        }
+        let what = format!("{} scan --vendor", flavor.label());
+        let p = Proj::new();
+        p.write_files(&flavor.native_files());
+        p.install(flavor.version(), PRISTINE);
+        let api = Api::start();
+        api.serve_scan_routes(
+            flavor,
+            VENDORED_UUID,
+            &flavor.hosted_url(VENDORED_UUID),
+            build_wheel(flavor.version(), PATCHED),
+        );
+        let embedded = p.root.join("embedded.vex.json");
+        let args = vec![
+            "scan",
+            "--vendor",
+            "--vendor-source",
+            "build",
+            "--vex",
+            embedded.to_str().unwrap(),
+            "--vex-product",
+            PRODUCT,
+        ];
+        let (code, env) = run_authed(&p, &api, &args);
+        assert_eq!(code, Some(0), "{what}: {env}");
+        assert_embedded_doc(&what, &embedded, VENDORED_UUID, Mode::Vendored);
+        let lock = p.read(flavor.lock_file());
+        assert!(
+            lock.contains(&format!(".socket/vendor/pypi/{VENDORED_UUID}/")),
+            "{what}: lock not wired:\n{lock}"
+        );
+        assert!(
+            !p.exists(".socket/manifest.json"),
+            "{what}: vendored mode is manifest-free"
+        );
+        // The installed tree stays pristine: vendoring never patches it.
+        assert_eq!(std::fs::read(p.site().join(MODULE)).unwrap(), PRISTINE);
+        // A legacy (pre-5.0) checkout also carries the manifest record
+        // beside the ledger: same uuid, so it attests the same way.
+        assert!(vex_e2e_common::seed_legacy_manifest(&p.root) > 0, "{what}");
+        let (code, env, doc) = vex_offline(&p, &api, &[]);
+        assert_attested(
+            &format!("{what} legacy manifest"),
+            code,
+            &env,
+            &doc,
+            &flavor.api_purl(),
+            VENDORED_UUID,
+            Mode::Vendored,
+        );
+        vex_e2e_common::strip_manifest(&p.root);
 
-            // c. the ledger alone.
-            let before = api.requests();
-            let (code, env, doc) = vex_offline(&p, &api, &[]);
-            assert_attested(
-                &format!("{what} ledger"),
-                code,
-                &env,
-                &doc,
-                &flavor.api_purl(),
-                VENDORED_UUID,
-                Mode::Vendored,
-            );
-            assert_eq!(api.requests(), before, "{what}: offline made a request");
+        // c. the ledger alone.
+        let before = api.requests();
+        let (code, env, doc) = vex_offline(&p, &api, &[]);
+        assert_attested(
+            &format!("{what} ledger"),
+            code,
+            &env,
+            &doc,
+            &flavor.api_purl(),
+            VENDORED_UUID,
+            Mode::Vendored,
+        );
+        assert_eq!(api.requests(), before, "{what}: offline made a request");
 
-            // b / a. no ledger.
-            let ledger_path = p.root.join(".socket/vendor/state.json");
-            let ledger = std::fs::read(&ledger_path).unwrap();
-            std::fs::remove_file(&ledger_path).unwrap();
-            let (code, env, doc) = vex_offline(&p, &api, &[]);
+        // b / a. no ledger.
+        let ledger_path = p.root.join(".socket/vendor/state.json");
+        let ledger = std::fs::read(&ledger_path).unwrap();
+        std::fs::remove_file(&ledger_path).unwrap();
+        let (code, env, doc) = vex_offline(&p, &api, &[]);
+        assert_omitted(
+            &format!("{what} no ledger offline"),
+            code,
+            &env,
+            &doc,
+            &flavor.purl(),
+            "record_unavailable",
+        );
+        assert_eq!(api.requests(), before, "{what}: offline made a request");
+        let (code, env, doc) = vex_online(&p, &api, &[]);
+        assert_attested(
+            &format!("{what} no ledger online"),
+            code,
+            &env,
+            &doc,
+            &flavor.api_purl(),
+            VENDORED_UUID,
+            Mode::Vendored,
+        );
+        assert_no_manifest_written(&p, &what);
+
+        // d. the real revert, then the ledger + artifact put back.
+        std::fs::write(&ledger_path, &ledger).unwrap();
+        let artifact_dir = p.root.join(format!(".socket/vendor/pypi/{VENDORED_UUID}"));
+        let artifacts: Vec<(PathBuf, Vec<u8>)> = std::fs::read_dir(&artifact_dir)
+            .unwrap()
+            .flatten()
+            .map(|e| (e.path(), std::fs::read(e.path()).unwrap()))
+            .collect();
+        let (code, env) = run_authed(&p, &api, &["vendor", "--revert"]);
+        assert_eq!(code, Some(0), "{what} revert: {env}");
+        for (name, text) in flavor.native_files() {
+            assert_eq!(p.read(name), text, "{what}: revert restores {name}");
+        }
+        std::fs::create_dir_all(&artifact_dir).unwrap();
+        for (path, bytes) in &artifacts {
+            std::fs::write(path, bytes).unwrap();
+        }
+        std::fs::write(&ledger_path, &ledger).unwrap();
+        for extra in [&[][..], &["--no-verify"][..]] {
+            let (code, env, doc) = vex_offline(&p, &api, extra);
             assert_omitted(
-                &format!("{what} no ledger offline"),
+                &format!("{what} reverted {extra:?}"),
                 code,
                 &env,
                 &doc,
                 &flavor.purl(),
-                "record_unavailable",
-            );
-            assert_eq!(api.requests(), before, "{what}: offline made a request");
-            let (code, env, doc) = vex_online(&p, &api, &[]);
-            assert_attested(
-                &format!("{what} no ledger online"),
-                code,
-                &env,
-                &doc,
-                &flavor.api_purl(),
-                VENDORED_UUID,
-                Mode::Vendored,
+                "vendor_unwired",
             );
-            assert_no_manifest_written(&p, &what);
-
-            // d. the real revert, then the ledger + artifact put back.
-            std::fs::write(&ledger_path, &ledger).unwrap();
-            let artifact_dir = p.root.join(format!(".socket/vendor/pypi/{VENDORED_UUID}"));
-            let artifacts: Vec<(PathBuf, Vec<u8>)> = std::fs::read_dir(&artifact_dir)
-                .unwrap()
-                .flatten()
-                .map(|e| (e.path(), std::fs::read(e.path()).unwrap()))
-                .collect();
-            let (code, env) = run_authed(&p, &api, &["vendor", "--revert"]);
-            assert_eq!(code, Some(0), "{what} revert: {env}");
-            for (name, text) in flavor.native_files() {
-                assert_eq!(p.read(name), text, "{what}: revert restores {name}");
-            }
-            std::fs::create_dir_all(&artifact_dir).unwrap();
-            for (path, bytes) in &artifacts {
-                std::fs::write(path, bytes).unwrap();
-            }
-            std::fs::write(&ledger_path, &ledger).unwrap();
-            for extra in [&[][..], &["--no-verify"][..]] {
-                let (code, env, doc) = vex_offline(&p, &api, extra);
-                assert_omitted(
-                    &format!("{what} reverted {extra:?}"),
-                    code,
-                    &env,
-                    &doc,
-                    &flavor.purl(),
-                    "vendor_unwired",
-                );
-            }
         }
     }
 }
diff --git a/crates/socket-patch-cli/tests/e2e_vex_lockfile/yarn.rs b/crates/socket-patch-cli/tests/e2e_vex_lockfile/yarn.rs
index f504682f..2951081d 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_lockfile/yarn.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_lockfile/yarn.rs
@@ -1204,7 +1204,7 @@ fn pnp_layout_contract() {
 }
 
 // ──────────────────────────────────────────────────────────────────────
-// EMBEDDED — scan --vex / scan --redirect --vex / scan --vendor --vex /
+// EMBEDDED — scan --vex / scan --mode hosted --vex / scan --vendor --vex /
 // apply --vex, manifest-less
 // ──────────────────────────────────────────────────────────────────────
 
@@ -1250,7 +1250,7 @@ fn assert_embedded_attested(doc: Option<Value>, env: &Value, marker: &str, cell:
 }
 
 /// The in-run VEX of `scan` (a bare scan, which runs hosted mode; the legacy
-/// `--redirect`; `--vendor`) on an
+/// `--mode hosted`; `--vendor`) on an
 /// already-wired, manifest-less checkout attests the lock's patch like the
 /// standalone command, never rewrites the wiring, never writes a manifest,
 /// and still refuses a tampered installed tree.
@@ -1258,7 +1258,7 @@ fn assert_embedded_attested(doc: Option<Value>, env: &Value, marker: &str, cell:
 fn embedded_scan_vex_attests_manifest_less_wiring() {
     for flavor in [Flavor::Classic, Flavor::Berry4] {
         for mode in ["hosted", "vendored"] {
-            for scan_mode in [None, Some("--redirect"), Some("--vendor")] {
+            for scan_mode in [None, Some("--mode=hosted"), Some("--vendor")] {
                 let tmp = tempfile::tempdir().unwrap();
                 let cwd = tmp.path();
                 if mode == "hosted" {
diff --git a/crates/socket-patch-cli/tests/e2e_vex_redirect.rs b/crates/socket-patch-cli/tests/e2e_vex_redirect.rs
index e9b1caf0..45b2ae4b 100644
--- a/crates/socket-patch-cli/tests/e2e_vex_redirect.rs
+++ b/crates/socket-patch-cli/tests/e2e_vex_redirect.rs
@@ -1,6 +1,6 @@
 //! End-to-end tests for redirect-patch awareness in `socket-patch vex`.
 //!
-//! `socket-patch scan --redirect` rewrites lockfiles so a patched dependency
+//! `socket-patch scan --mode hosted` rewrites lockfiles so a patched dependency
 //! resolves from Socket's HOSTED vendored patch, and records the patch (file
 //! hashes + vulnerabilities) in `.socket/vendor/redirect-state.json`. After the
 //! package manager installs, the patched bytes land in the installed tree, so
@@ -15,7 +15,7 @@
 //!   3. tampered installed file → omitted with skip reason `hash_mismatch`
 //!      (fail-closed)
 //!   4. `--no-verify` attests from the ledger records with NO installed tree
-//!      (the same shape as the in-run `scan --redirect --vex` attestation) —
+//!      (the same shape as the in-run `scan --mode hosted --vex` attestation) —
 //!      but only while the lockfile still wires the hosted patch: a stale
 //!      ledger is `redirect_unwired` even under `--no-verify`
 //!   5. every ecosystem attests through the ledger with its real hosted
@@ -25,7 +25,7 @@
 //!      evidence until install, an installed tree that does not verify wins,
 //!      foreign hosts and pin-less entries are refused
 //!
-//! Every ledger fixture carries the lockfile wiring `scan --redirect` wrote
+//! Every ledger fixture carries the lockfile wiring `scan --mode hosted` wrote
 //! next to it: `vex` only attests a redirect-ledger record while some
 //! lockfile still resolves the dependency from its hosted patch (a reverted
 //! lockfile with the ledger left behind must not keep attesting).
@@ -141,7 +141,7 @@ fn make_record(uuid: &str, after_hash: &str, vuln_id: &str, cves: &[&str]) -> Pa
 }
 
 /// Write a `.socket/vendor/redirect-state.json` ledger embedding `record` for
-/// `purl` (the shape `scan --redirect` persists for VEX).
+/// `purl` (the shape `scan --mode hosted` persists for VEX).
 fn write_redirect_state(cwd: &Path, purl: &str, record: PatchRecord) {
     let mut state = RedirectState::new();
     state.records.insert(purl.to_string(), record);
@@ -377,7 +377,7 @@ fn tampered_installed_file_omits_redirected_patch() {
 
 // ──────────────────────────────────────────────────────────────────────
 // 4. --no-verify attests from the ledger with NO installed tree — the same
-// shape as the in-run `scan --redirect --vex` attestation (bytes are remote,
+// shape as the in-run `scan --mode hosted --vex` attestation (bytes are remote,
 // fetched at install time, so there is nothing to hash yet).
 // ──────────────────────────────────────────────────────────────────────
 
@@ -389,7 +389,7 @@ fn redirected_no_verify_attests_without_installed_tree() {
 
     // No node_modules, no manifest — the redirect ledger is the only record
     // source. The ledger alone does not attest; the lockfile must still wire the hosted patch (see the gated twin below),
-    // so the fixture carries the rewrite `scan --redirect` recorded.
+    // so the fixture carries the rewrite `scan --mode hosted` recorded.
     write_redirect_state(
         cwd,
         purl,
@@ -637,7 +637,7 @@ fn no_verify_attests_redirected_patches_across_ecosystems() {
         ),
     ];
 
-    // The ledger records both halves `scan --redirect` persists: the
+    // The ledger records both halves `scan --mode hosted` persists: the
     // records AND the file edits (whose files still carry each patch's
     // hosted wiring — the liveness proof the ledger record needs).
     let mut state = RedirectState::new();
@@ -852,7 +852,7 @@ fn lockfile_hosted_ref_attests_without_manifest_or_ledger() {
     assert_eq!(skipped_reason(&env, purl), "record_unavailable");
 
     // Online: the record is fetched, and the PINNED hosted wiring attests
-    // until install (the in-run `scan --redirect --vex` evidence).
+    // until install (the in-run `scan --mode hosted --vex` evidence).
     let (_rt, server) = serve_patch_views(vec![(UUID.to_string(), left_pad_view(&"b".repeat(64)))]);
     let (code, env) = vex_json(cwd, &["--proxy-url", &server.uri()]);
     assert_eq!(code, Some(0), "{env}");
diff --git a/crates/socket-patch-cli/tests/get_edge_cases_e2e.rs b/crates/socket-patch-cli/tests/get_edge_cases_e2e.rs
index b1e54018..71e7433d 100644
--- a/crates/socket-patch-cli/tests/get_edge_cases_e2e.rs
+++ b/crates/socket-patch-cli/tests/get_edge_cases_e2e.rs
@@ -1,5 +1,5 @@
 //! Additional e2e tests for `get` edge cases — exercises the
-//! validation branches (--one-off + --save-only conflict, --id flag,
+//! validation branches (--id flag,
 //! multi-patch selection via --id, auto-select for single free patch
 //! match) and a few error paths the main get_invariants suite doesn't
 //! reach.
@@ -9,9 +9,8 @@ use wiremock::{Mock, MockServer, ResponseTemplate};
 
 // Every invocation must go through `common::run`/`run_with_env`: the binary
 // binds a wide `SOCKET_*` env surface, and a raw `Command::new(binary())`
-// inherits the developer's shell — an exported `SOCKET_ONE_OFF=true` aborts
-// every `get` here, `SOCKET_PROXY_URL` outranks the proxy these tests pin,
-// and `SOCKET_MANIFEST_PATH` makes a *passing* test write its manifest and
+// inherits the developer's shell — `SOCKET_PROXY_URL` outranks the proxy
+// these tests pin, and `SOCKET_MANIFEST_PATH` makes a *passing* test write its manifest and
 // blobs into whatever real project the variable points at.
 #[path = "common/mod.rs"]
 mod common;
@@ -56,37 +55,6 @@ fn single_file_view() -> serde_json::Value {
     })
 }
 
-#[test]
-fn get_one_off_and_save_only_together_errors() {
-    // The two flags are mutually exclusive — using both must fail.
-    let tmp = tempfile::tempdir().unwrap();
-    let (code, stdout, _stderr) = common::run(
-        tmp.path(),
-        &[
-            "get",
-            UUID_A,
-            "--one-off",
-            "--save-only",
-            "--yes",
-            "--json",
-            "--api-url",
-            "http://127.0.0.1:1",
-            "--api-token",
-            "fake",
-            "--org",
-            ORG_SLUG,
-        ],
-    );
-    assert_eq!(code, 2, "a usage error (v5.0)");
-    let v: serde_json::Value = serde_json::from_str(stdout.trim()).expect("valid JSON");
-    assert_eq!(v["status"], "error");
-    let err = v["error"].as_str().expect("error message");
-    assert!(
-        err.contains("one-off") && err.contains("save-only"),
-        "error must mention both flags: {err}"
-    );
-}
-
 #[tokio::test]
 async fn get_with_id_flag_selects_specific_patch() {
     // Multiple patches available for a PURL; `get <UUID> --id` fetches exactly that one.
@@ -293,10 +261,8 @@ async fn get_by_package_with_single_paid_patch_emits_paid_required() {
 
     let tmp = tempfile::tempdir().unwrap();
     let uri = mock.uri();
-    // Seed the proxy under its MODERN name: `SOCKET_PROXY_URL` outranks the
-    // legacy `SOCKET_PATCH_PROXY_URL` in `proxy_url_from_env`, so pinning the
-    // legacy name alone loses to an ambient modern one. The scrub in
-    // `run_with_env` also strips any ambient `SOCKET_API_TOKEN`, forcing the
+    // Seed the proxy via `SOCKET_PROXY_URL`. The scrub in `run_with_env`
+    // also strips any ambient `SOCKET_API_TOKEN`, forcing the
     // public-proxy (free-tier) client this test is about.
     let (code, stdout, _stderr) = common::run_with_env(
         tmp.path(),
@@ -503,9 +469,6 @@ fn get_help_lists_all_identifier_flags() {
             "get --help missing flag {flag}; got: {stdout}"
         );
     }
-    // `--one-off` always fails with "not yet implemented": it stays
-    // parseable (scripts get that explicit error) but is not advertised.
-    assert!(!stdout.contains("--one-off"), "{stdout}");
     // Help text is for users: no implementation notes from the source.
     for leak in ["value_parser", "parse_bool_flag", "No env binding", "locally- installed"] {
         assert!(!stdout.contains(leak), "get --help leaks {leak:?}: {stdout}");
diff --git a/crates/socket-patch-cli/tests/get_invariants.rs b/crates/socket-patch-cli/tests/get_invariants.rs
index a96531b0..2e5b9b7e 100644
--- a/crates/socket-patch-cli/tests/get_invariants.rs
+++ b/crates/socket-patch-cli/tests/get_invariants.rs
@@ -20,10 +20,9 @@ const BLOB_BYTES: &[u8] = b"patched\n";
 
 /// Run `get` via `common::run_with_env`, which scrubs the ambient
 /// `SOCKET_*` environment before spawning. The binary binds a wide env
-/// surface (`SOCKET_ONE_OFF`, `SOCKET_MANIFEST_PATH`, `SOCKET_CWD`,
-/// `SOCKET_OFFLINE`, ...); an ambient value silently changes what these
-/// tests exercise — `SOCKET_ONE_OFF=true` alone fails every invocation
-/// here ("--one-off and --save-only cannot be used together"), and
+/// surface (`SOCKET_MANIFEST_PATH`, `SOCKET_CWD`, `SOCKET_OFFLINE`, ...);
+/// an ambient value silently changes what these tests exercise —
+/// `SOCKET_OFFLINE=1` alone fails every invocation here, and
 /// `SOCKET_MANIFEST_PATH` aims the manifest write OUTSIDE the tempdir.
 fn run_get(cwd: &Path, api_url: &str, identifier: &str, extra: &[&str]) -> (i32, String, String) {
     let mut args = vec![
@@ -474,7 +473,7 @@ async fn get_uuid_paid_patch_via_public_proxy_emits_paid_required_envelope() {
             "--api-url",
             &uri,
         ],
-        &[("SOCKET_PATCH_PROXY_URL", uri.as_str())],
+        &[("SOCKET_PROXY_URL", uri.as_str())],
     );
 
     let v: serde_json::Value = serde_json::from_str(stdout.trim()).unwrap_or_else(|e| {
@@ -510,9 +509,8 @@ async fn get_paid_patch_via_public_proxy_returns_paid_required() {
     // returns a `paid_required` status. To simulate this we DON'T pass
     // --api-token / --org so the binary falls back to the public proxy
     // (the scrubbed env guarantees no ambient SOCKET_API_TOKEN /
-    // SOCKET_PROXY_URL interferes). We also have to point
-    // SOCKET_PATCH_PROXY_URL (the legacy alias, injected post-scrub) at
-    // the mock.
+    // SOCKET_PROXY_URL interferes). We then point SOCKET_PROXY_URL
+    // (injected post-scrub) at the mock.
     let mock = MockServer::start().await;
     let purl = "pkg:npm/paidpkg@1.0.0";
     let encoded = "pkg%3Anpm%2Fpaidpkg%401.0.0";
@@ -548,7 +546,7 @@ async fn get_paid_patch_via_public_proxy_returns_paid_required() {
             "--api-url",
             &uri,
         ],
-        &[("SOCKET_PATCH_PROXY_URL", uri.as_str())],
+        &[("SOCKET_PROXY_URL", uri.as_str())],
     );
 
     let v: serde_json::Value = serde_json::from_str(stdout.trim()).expect("valid JSON");
diff --git a/crates/socket-patch-cli/tests/hosted_memory_common/mod.rs b/crates/socket-patch-cli/tests/hosted_memory_common/mod.rs
index c0e60e47..9ff12449 100644
--- a/crates/socket-patch-cli/tests/hosted_memory_common/mod.rs
+++ b/crates/socket-patch-cli/tests/hosted_memory_common/mod.rs
@@ -74,18 +74,11 @@ pub fn patches_from_overrides(overrides: &Path, rewrite_host: Option<&str>) -> V
                 }
             };
             let url = fix(&o["artifactUrl"]);
-            let mut artifacts = vec![serde_json::json!({
+            let artifacts = vec![serde_json::json!({
                 "kind": "tarball",
                 "url": url,
                 "integrity": o["integrity"].clone(),
             })];
-            if let Some(zip) = o["berryZipUrl"].as_str() {
-                artifacts.push(serde_json::json!({
-                    "kind": "yarn-berry-zip",
-                    "url": fix(&Value::String(zip.to_string())),
-                    "integrity": {"yarnBerry10c0": o["integrity"]["yarnBerry10c0"].clone()},
-                }));
-            }
             let mut registry_override = o.get("registryOverride").cloned().unwrap_or(Value::Null);
             if let Some(index) = registry_override.get("indexUrl").cloned() {
                 registry_override["indexUrl"] = fix(&index);
diff --git a/crates/socket-patch-cli/tests/in_process_cargo_apply.rs b/crates/socket-patch-cli/tests/in_process_cargo_apply.rs
index fce505b3..9502d312 100644
--- a/crates/socket-patch-cli/tests/in_process_cargo_apply.rs
+++ b/crates/socket-patch-cli/tests/in_process_cargo_apply.rs
@@ -242,8 +242,6 @@ async fn cargo_fetch_scan_sync_patches_real_file() {
         prune: false,
         sync: true,
         vendor: false,
-        detached: false,
-        redirect: false,
         mode: None,
         all_releases: false,
         vex: Default::default(),
@@ -362,8 +360,6 @@ async fn cargo_apply_refuses_on_before_hash_mismatch() {
         prune: false,
         sync: true,
         vendor: false,
-        detached: false,
-        redirect: false,
         mode: None,
         all_releases: false,
         vex: Default::default(),
@@ -461,8 +457,6 @@ async fn cargo_crawler_finds_real_fetched_crate() {
         prune: false,
         sync: false,
         vendor: false,
-        detached: false,
-        redirect: false,
         mode: None,
         all_releases: false,
         vex: Default::default(),
diff --git a/crates/socket-patch-cli/tests/in_process_edge_cases.rs b/crates/socket-patch-cli/tests/in_process_edge_cases.rs
index 238d747d..d5f92ac8 100644
--- a/crates/socket-patch-cli/tests/in_process_edge_cases.rs
+++ b/crates/socket-patch-cli/tests/in_process_edge_cases.rs
@@ -557,7 +557,6 @@ async fn rollback_already_original_short_circuits() {
         },
         targets: Vec::new(),
         preserve_state: false,
-        one_off: false,
     };
     let target = tmp.path().join("node_modules/already-orig/index.js");
     #[cfg(unix)]
diff --git a/crates/socket-patch-cli/tests/in_process_gem_apply.rs b/crates/socket-patch-cli/tests/in_process_gem_apply.rs
index ae9f45c4..af56d13a 100644
--- a/crates/socket-patch-cli/tests/in_process_gem_apply.rs
+++ b/crates/socket-patch-cli/tests/in_process_gem_apply.rs
@@ -220,8 +220,6 @@ async fn gem_install_scan_sync_patches_real_file() {
         prune: false,
         sync: true,
         vendor: false,
-        detached: false,
-        redirect: false,
         mode: None,
         all_releases: false,
         vex: Default::default(),
@@ -333,8 +331,6 @@ async fn gem_crawler_finds_real_installed_gem() {
         prune: false,
         sync: false,
         vendor: false,
-        detached: false,
-        redirect: false,
         mode: None,
         all_releases: false,
         vex: Default::default(),
diff --git a/crates/socket-patch-cli/tests/in_process_gem_multi_platform.rs b/crates/socket-patch-cli/tests/in_process_gem_multi_platform.rs
index ecf70b37..fba7f6c2 100644
--- a/crates/socket-patch-cli/tests/in_process_gem_multi_platform.rs
+++ b/crates/socket-patch-cli/tests/in_process_gem_multi_platform.rs
@@ -240,8 +240,6 @@ fn scan_args(cwd: &Path, api_url: String, all_releases: bool) -> ScanArgs {
         prune: false,
         sync: false,
         vendor: false,
-        detached: false,
-        redirect: false,
         mode: None,
         all_releases,
         vex: Default::default(),
@@ -537,7 +535,6 @@ fn rollback_args(cwd: &Path, api_url: String, offline: bool) -> RollbackArgs {
             ecosystems: Some(vec!["gem".to_string()]),
             ..socket_patch_cli::args::GlobalArgs::default()
         },
-        one_off: false,
     }
 }
 
@@ -742,7 +739,6 @@ async fn rollback_all_over_broad_manifest_succeeds() {
             ecosystems: Some(vec!["gem".to_string()]),
             ..socket_patch_cli::args::GlobalArgs::default()
         },
-        one_off: false,
     };
     let code = rollback_run(rollback_args).await;
     assert_eq!(code, 0, "rollback-all over broad manifest should exit 0");
diff --git a/crates/socket-patch-cli/tests/in_process_get.rs b/crates/socket-patch-cli/tests/in_process_get.rs
index 9035e57f..96a6d3fb 100644
--- a/crates/socket-patch-cli/tests/in_process_get.rs
+++ b/crates/socket-patch-cli/tests/in_process_get.rs
@@ -39,7 +39,6 @@ fn default_args(identifier: &str, cwd: &Path) -> GetArgs {
         ghsa: false,
         package: false,
         save_only: true,
-        one_off: false,
         all_releases: false,
         mode: None,
     }
@@ -535,76 +534,6 @@ async fn get_with_explicit_package_flag_resolves_installed_and_saves() {
     );
 }
 
-// ---------------------------------------------------------------------------
-// Conflict flags (--one-off + --save-only)
-// ---------------------------------------------------------------------------
-
-/// Assert the mounted mock saw zero requests — the up-front-rejection
-/// oracle for the flag-validation tests below. A dead (unreachable) API
-/// cannot prove "rejected before any fetch": a run that ignored the flag,
-/// fetched, and failed on the dead socket produces the same exit 1 and
-/// the same absent manifest. Against a LIVE mock the regressed flow
-/// instead fetches successfully and saves, so all three oracles trip.
-async fn assert_no_api_requests(server: &MockServer) {
-    let requests = server.received_requests().await.unwrap();
-    assert!(
-        requests.is_empty(),
-        "flag must be rejected before any API call, saw: {:?}",
-        requests
-            .iter()
-            .map(|r| r.url.path().to_string())
-            .collect::<Vec<_>>()
-    );
-}
-
-#[tokio::test]
-#[serial]
-async fn get_one_off_with_save_only_errors() {
-    // Live mock (not a dead socket) so the zero-request oracle below can
-    // distinguish up-front rejection from fetch-and-fail.
-    let (server, url) = start_wiremock().await;
-    make_view_mock(&server, UUID, PURL, "free").await;
-
-    let tmp = tempfile::tempdir().unwrap();
-    let mut args = default_args(UUID, tmp.path());
-    args.common.api_url = Some(url);
-    args.one_off = true;
-    args.save_only = true;
-
-    let code = run(args).await;
-    assert_eq!(code, 2, "conflicting flags are a usage error (exit 2)");
-    // The conflict is rejected up front, before any fetch — nothing saved.
-    assert_no_manifest(tmp.path());
-    assert_no_api_requests(&server).await;
-}
-
-#[tokio::test]
-#[serial]
-async fn get_one_off_is_an_honest_not_implemented_error() {
-    // `--one-off` was a silent no-op for three majors: the flag parsed but
-    // was never read past the `--save-only` conflict check, so the patch
-    // was saved to the manifest anyway — lying about persistence. It now
-    // fails honestly, BEFORE any network or disk activity. The previous
-    // version of this test used an unreachable API, which proved nothing:
-    // the regressed flow's fetch failed on the dead socket with the same
-    // exit 1 and no manifest, so the exact historical regression passed.
-    // With a live view mock the regressed flow fetches and saves, so it
-    // now trips all three oracles (exit 0, manifest written, request seen).
-    let (server, url) = start_wiremock().await;
-    make_view_mock(&server, UUID, PURL, "free").await;
-
-    let tmp = tempfile::tempdir().unwrap();
-    let mut args = default_args(UUID, tmp.path());
-    args.common.api_url = Some(url);
-    args.one_off = true;
-    args.save_only = false;
-
-    let code = run(args).await;
-    assert_eq!(code, 2, "--one-off must fail as not-yet-implemented (usage, exit 2)");
-    assert_no_manifest(tmp.path());
-    assert_no_api_requests(&server).await;
-}
-
 // ---------------------------------------------------------------------------
 // Network failure
 // ---------------------------------------------------------------------------
diff --git a/crates/socket-patch-cli/tests/in_process_get_corrupt_manifest.rs b/crates/socket-patch-cli/tests/in_process_get_corrupt_manifest.rs
index 8f18e6e7..63a4af6a 100644
--- a/crates/socket-patch-cli/tests/in_process_get_corrupt_manifest.rs
+++ b/crates/socket-patch-cli/tests/in_process_get_corrupt_manifest.rs
@@ -67,7 +67,6 @@ async fn uuid_get_with_corrupt_manifest_fails_without_clobbering() {
         package: false,
         // save_only isolates the save path from the apply step.
         save_only: true,
-        one_off: false,
         all_releases: false,
         mode: None,
     };
diff --git a/crates/socket-patch-cli/tests/in_process_get_hosted_ecosystems.rs b/crates/socket-patch-cli/tests/in_process_get_hosted_ecosystems.rs
index f6ab3f7a..9958b2be 100644
--- a/crates/socket-patch-cli/tests/in_process_get_hosted_ecosystems.rs
+++ b/crates/socket-patch-cli/tests/in_process_get_hosted_ecosystems.rs
@@ -66,7 +66,6 @@ fn get_hosted_args(identifier: &str, cwd: &Path, api_url: String) -> GetArgs {
         ghsa: false,
         package: false,
         save_only: false,
-        one_off: false,
         all_releases: false,
         mode: Some(ScanMode::Hosted),
     }
diff --git a/crates/socket-patch-cli/tests/in_process_get_manifest_path.rs b/crates/socket-patch-cli/tests/in_process_get_manifest_path.rs
index 152819af..40e5b5c2 100644
--- a/crates/socket-patch-cli/tests/in_process_get_manifest_path.rs
+++ b/crates/socket-patch-cli/tests/in_process_get_manifest_path.rs
@@ -103,7 +103,6 @@ fn get_args(identifier: &str, cwd: &Path, api_url: String) -> GetArgs {
         ghsa: false,
         package: false,
         save_only: true,
-        one_off: false,
         all_releases: false,
         mode: Some(socket_patch_cli::commands::scan::ScanMode::Agent),
     }
diff --git a/crates/socket-patch-cli/tests/in_process_get_modes.rs b/crates/socket-patch-cli/tests/in_process_get_modes.rs
index 83cd74c7..949921f3 100644
--- a/crates/socket-patch-cli/tests/in_process_get_modes.rs
+++ b/crates/socket-patch-cli/tests/in_process_get_modes.rs
@@ -68,7 +68,6 @@ fn get_args(identifier: &str, cwd: &Path, api_url: String) -> GetArgs {
         ghsa: false,
         package: false,
         save_only: false,
-        one_off: false,
         all_releases: false,
         mode: Some(socket_patch_cli::commands::scan::ScanMode::Agent),
     }
diff --git a/crates/socket-patch-cli/tests/in_process_get_uuid_fallback.rs b/crates/socket-patch-cli/tests/in_process_get_uuid_fallback.rs
index 07d61017..dd131656 100644
--- a/crates/socket-patch-cli/tests/in_process_get_uuid_fallback.rs
+++ b/crates/socket-patch-cli/tests/in_process_get_uuid_fallback.rs
@@ -71,7 +71,6 @@ async fn stale_token_uuid_get_falls_back_to_proxy_end_to_end() {
         package: false,
         // save_only isolates the fallback/save path from the apply step.
         save_only: true,
-        one_off: false,
         all_releases: false,
         mode: None,
     };
diff --git a/crates/socket-patch-cli/tests/in_process_pypi_apply.rs b/crates/socket-patch-cli/tests/in_process_pypi_apply.rs
index c5bafe10..fa520987 100644
--- a/crates/socket-patch-cli/tests/in_process_pypi_apply.rs
+++ b/crates/socket-patch-cli/tests/in_process_pypi_apply.rs
@@ -269,8 +269,6 @@ async fn pypi_install_scan_sync_patches_real_file() {
         prune: false,
         sync: true,
         vendor: false,
-        detached: false,
-        redirect: false,
         mode: None,
         all_releases: false,
         vex: Default::default(),
@@ -346,8 +344,6 @@ async fn pypi_scan_then_apply_force_patches_real_file() {
         prune: false,
         sync: true,
         vendor: false,
-        detached: false,
-        redirect: false,
         mode: None,
         all_releases: false,
         vex: Default::default(),
@@ -456,8 +452,6 @@ async fn pypi_apply_dry_run_does_not_modify_file() {
         prune: false,
         sync: false,
         vendor: false,
-        detached: false,
-        redirect: false,
         mode: None,
         all_releases: false,
         vex: Default::default(),
@@ -586,8 +580,6 @@ async fn pypi_crawler_finds_real_installed_six() {
         prune: false,
         sync: false,
         vendor: false,
-        detached: false,
-        redirect: false,
         mode: None,
         all_releases: false,
         vex: Default::default(),
diff --git a/crates/socket-patch-cli/tests/in_process_pypi_multi_release.rs b/crates/socket-patch-cli/tests/in_process_pypi_multi_release.rs
index 18b866a9..3e4b098e 100644
--- a/crates/socket-patch-cli/tests/in_process_pypi_multi_release.rs
+++ b/crates/socket-patch-cli/tests/in_process_pypi_multi_release.rs
@@ -318,8 +318,6 @@ fn scan_args(tmp: &Path, api_url: String, all_releases: bool) -> ScanArgs {
         prune: false,
         sync: false,
         vendor: false,
-        detached: false,
-        redirect: false,
         mode: None,
         all_releases,
         vex: Default::default(),
@@ -578,7 +576,6 @@ async fn rollback_all_over_broad_manifest_succeeds() {
             ecosystems: Some(vec!["pypi".to_string()]),
             ..socket_patch_cli::args::GlobalArgs::default()
         },
-        one_off: false,
     };
     let code = rollback_run(rollback_args).await;
     assert_eq!(code, 0, "rollback-all over broad manifest should exit 0");
diff --git a/crates/socket-patch-cli/tests/in_process_python_envs.rs b/crates/socket-patch-cli/tests/in_process_python_envs.rs
index 95325a01..5d759c5c 100644
--- a/crates/socket-patch-cli/tests/in_process_python_envs.rs
+++ b/crates/socket-patch-cli/tests/in_process_python_envs.rs
@@ -135,8 +135,6 @@ fn default_args(cwd: &Path, api_url: String) -> ScanArgs {
         prune: false,
         sync: false,
         vendor: false,
-        detached: false,
-        redirect: false,
         mode: None,
         all_releases: false,
         vex: Default::default(),
diff --git a/crates/socket-patch-cli/tests/in_process_redirect.rs b/crates/socket-patch-cli/tests/in_process_redirect.rs
index 8b830088..5eb700f1 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect.rs
@@ -1,6 +1,6 @@
-//! In-process test for `socket-patch scan --redirect`: mocks the API
+//! In-process test for `socket-patch scan --mode hosted`: mocks the API
 //! (discovery + the `patches/package` reference endpoint) via wiremock, lays
-//! down an npm project with a lockfile, runs `scan --redirect`, and asserts the
+//! down an npm project with a lockfile, runs `scan --mode hosted`, and asserts the
 //! lockfile's patched-dependency entry was repointed at the hosted vendored
 //! patch (resolved URL + sha512 integrity) — and (v5) that NO redirect
 //! ledger was written: the lockfile pin is the whole hosted state, and
@@ -61,9 +61,7 @@ fn redirect_args(cwd: &Path, api_url: String) -> ScanArgs {
         prune: false,
         sync: false,
         vendor: false,
-        detached: false,
-        redirect: true,
-        mode: None,
+        mode: Some(socket_patch_cli::commands::scan::ScanMode::Hosted),
         all_releases: false,
         vex: Default::default(),
     }
@@ -206,7 +204,7 @@ async fn scan_redirect_rewrites_lockfile_to_hosted_patch() {
     write_project(tmp.path());
 
     let code = run(redirect_args(tmp.path(), server.uri())).await;
-    assert_eq!(code, 0, "scan --redirect should succeed");
+    assert_eq!(code, 0, "scan --mode hosted should succeed");
 
     let lock = std::fs::read_to_string(tmp.path().join("package-lock.json")).unwrap();
     assert!(
@@ -225,7 +223,7 @@ async fn scan_redirect_rewrites_lockfile_to_hosted_patch() {
     vlt_hosted_common::assert_no_ledger(tmp.path());
 }
 
-/// `scan --redirect --vex` must emit a valid OpenVEX doc for the redirected
+/// `scan --mode hosted --vex` must emit a valid OpenVEX doc for the redirected
 /// patch. The redirected bytes aren't installed in-run, so this is a NO-VERIFY
 /// attestation built from the patch records this run fetched (held in memory
 /// — v5 writes no ledger); the statement carries the `(redirected)`
@@ -250,7 +248,7 @@ async fn scan_redirect_vex_emits_redirected_attestation() {
     };
 
     let code = run(args).await;
-    assert_eq!(code, 0, "scan --redirect --vex should succeed");
+    assert_eq!(code, 0, "scan --mode hosted --vex should succeed");
 
     // The record reached the attestation in memory: nothing persisted.
     vlt_hosted_common::assert_no_ledger(tmp.path());
@@ -318,7 +316,7 @@ fn write_installed(root: &Path, name: &str, version: &str, bytes: &[u8]) {
     std::fs::write(pkg.join("index.js"), bytes).unwrap();
 }
 
-/// Idempotency: a second `scan --redirect` run over the already-redirected
+/// Idempotency: a second `scan --mode hosted` run over the already-redirected
 /// lock plans from the current lock text (v5 keeps no ledger chain), so it
 /// succeeds, leaves the lock byte-identical and still writes no ledger.
 #[tokio::test]
@@ -333,12 +331,12 @@ async fn second_redirect_run_is_idempotent() {
     write_project(tmp.path());
 
     let code = run(redirect_args(tmp.path(), server.uri())).await;
-    assert_eq!(code, 0, "first scan --redirect should succeed");
+    assert_eq!(code, 0, "first scan --mode hosted should succeed");
     let first = std::fs::read_to_string(tmp.path().join("package-lock.json")).unwrap();
     assert!(first.contains(HOSTED_URL), "{first}");
 
     let code = run(redirect_args(tmp.path(), server.uri())).await;
-    assert_eq!(code, 0, "second scan --redirect should succeed");
+    assert_eq!(code, 0, "second scan --mode hosted should succeed");
     assert_eq!(
         std::fs::read_to_string(tmp.path().join("package-lock.json")).unwrap(),
         first,
@@ -405,7 +403,7 @@ async fn no_lockfile_redirect_is_not_attested() {
 /// In-run `--vex` semantics: redirected PURLs are exempt from verification
 /// (their bytes are remote until install), but OTHER manifest patches still
 /// verify normally — an applied one attests plain, a not-applied one is
-/// omitted. This pins that `scan --redirect --vex` does NOT silently attest
+/// omitted. This pins that `scan --mode hosted --vex` does NOT silently attest
 /// the whole manifest unverified.
 #[tokio::test]
 #[serial]
@@ -463,7 +461,7 @@ async fn redirect_vex_verifies_manifest_patches_normally() {
         ..Default::default()
     };
     let code = run(args).await;
-    assert_eq!(code, 0, "scan --redirect --vex should succeed");
+    assert_eq!(code, 0, "scan --mode hosted --vex should succeed");
 
     let doc: serde_json::Value =
         serde_json::from_str(&std::fs::read_to_string(&vex_path).unwrap()).unwrap();
@@ -570,7 +568,7 @@ async fn redirect_vex_doc_id_and_compact_flags() {
         ..Default::default()
     };
     let code = run(args).await;
-    assert_eq!(code, 0, "scan --redirect --vex should succeed");
+    assert_eq!(code, 0, "scan --mode hosted --vex should succeed");
 
     let raw = std::fs::read_to_string(&vex_path).unwrap();
     assert_eq!(
@@ -708,7 +706,7 @@ async fn scan_redirect_rewrites_yarn_berry_lock() {
     write_berry_project(tmp.path());
 
     let code = run(redirect_args(tmp.path(), server.uri())).await;
-    assert_eq!(code, 0, "scan --redirect (berry) should succeed");
+    assert_eq!(code, 0, "scan --mode hosted (berry) should succeed");
 
     let lock = std::fs::read_to_string(tmp.path().join("yarn.lock")).unwrap();
     // yarn writes `__archiveUrl=<encodeURIComponent(url)>`; assert both the
@@ -898,7 +896,7 @@ async fn scan_redirect_rewrites_correct_entry_in_crlf_classic_lock() {
     std::fs::write(tmp.path().join("yarn.lock"), lock_lf.replace('\n', "\r\n")).unwrap();
 
     let code = run(redirect_args(tmp.path(), server.uri())).await;
-    assert_eq!(code, 0, "scan --redirect (classic CRLF) should succeed");
+    assert_eq!(code, 0, "scan --mode hosted (classic CRLF) should succeed");
 
     let lock = std::fs::read_to_string(tmp.path().join("yarn.lock")).unwrap();
     assert!(
@@ -988,7 +986,7 @@ async fn scan_redirect_rewrites_bun_lock() {
     let lock_before = std::fs::read(tmp.path().join("bun.lock")).unwrap();
 
     let code = run(redirect_args(tmp.path(), server.uri())).await;
-    assert_eq!(code, 0, "scan --redirect (bun) should succeed");
+    assert_eq!(code, 0, "scan --mode hosted (bun) should succeed");
 
     let lock = std::fs::read_to_string(tmp.path().join("bun.lock")).unwrap();
     assert!(
@@ -1024,7 +1022,7 @@ async fn scan_redirect_rewrites_bun_lock_v2() {
     let lock_before = std::fs::read(tmp.path().join("bun.lock")).unwrap();
 
     let code = run(redirect_args(tmp.path(), server.uri())).await;
-    assert_eq!(code, 0, "scan --redirect (bun, lock v2) should succeed");
+    assert_eq!(code, 0, "scan --mode hosted (bun, lock v2) should succeed");
 
     let lock = std::fs::read_to_string(tmp.path().join("bun.lock")).unwrap();
     assert!(
@@ -1293,7 +1291,7 @@ fn path_with_first(bin_dir: &Path) -> std::ffi::OsString {
     std::env::join_paths(entries).expect("PATH entries join")
 }
 
-/// `scan --redirect --json --yes` as a subprocess with the given child PATH;
+/// `scan --mode hosted --json --yes` as a subprocess with the given child PATH;
 /// returns (exit code, parsed envelope, stderr). Asserts stdout IS JSON so a
 /// leaking shim (bun chatter on stdout) fails loudly.
 fn scan_redirect_json_with_path(
@@ -1304,7 +1302,7 @@ fn scan_redirect_json_with_path(
     let out = scrubbed_cli()
         .args([
             "scan",
-            "--redirect",
+            "--mode=hosted",
             "--json",
             "--yes",
             "--cwd",
@@ -1785,7 +1783,7 @@ fn write_rush_project(root: &Path, with_repo_state: bool) {
     }
 }
 
-/// `scan --redirect` in a Rush monorepo rewrites BOTH the common
+/// `scan --mode hosted` in a Rush monorepo rewrites BOTH the common
 /// source-of-truth lock and every subspace lock in place (nested FileEdit
 /// paths), even though there is no root package.json/lock pair — the package
 /// is discovered from the Rush locks (lockfile supplement) and the pnpm
@@ -1803,7 +1801,7 @@ async fn scan_redirect_rewrites_rush_common_and_subspace_locks() {
     write_rush_project(tmp.path(), true);
 
     let code = run(redirect_args(tmp.path(), server.uri())).await;
-    assert_eq!(code, 0, "scan --redirect should succeed in a Rush repo");
+    assert_eq!(code, 0, "scan --mode hosted should succeed in a Rush repo");
 
     // Both nested locks are rewritten in place (not a new root lock).
     for rel in [
@@ -1853,7 +1851,7 @@ fn run_redirect_subprocess_with(cwd: &Path, api_url: &str, extra: &[&str]) -> se
     let out = scrubbed_cli()
         .args([
             "scan",
-            "--redirect",
+            "--mode=hosted",
             "--json",
             "--yes",
             "--cwd",
@@ -1871,13 +1869,13 @@ fn run_redirect_subprocess_with(cwd: &Path, api_url: &str, extra: &[&str]) -> se
     assert_eq!(
         out.status.code(),
         Some(0),
-        "scan --redirect must succeed; stdout=\n{}\nstderr=\n{}",
+        "scan --mode hosted must succeed; stdout=\n{}\nstderr=\n{}",
         String::from_utf8_lossy(&out.stdout),
         String::from_utf8_lossy(&out.stderr),
     );
     serde_json::from_slice(&out.stdout).unwrap_or_else(|e| {
         panic!(
-            "scan --redirect --json output is not JSON: {e}\nstdout:\n{}",
+            "scan --mode hosted --json output is not JSON: {e}\nstdout:\n{}",
             String::from_utf8_lossy(&out.stdout)
         )
     })
@@ -2055,7 +2053,7 @@ packages:
 /// `redirect_gradle_manual_snippet`, the missing-integrity family).
 /// Regression guard: the human branch printed skipped/record/rush warnings
 /// but dropped `rewrite.warnings` entirely, so a default-mode
-/// `scan --redirect` in a lockfile-less project reported "Redirected 0
+/// `scan --mode hosted` in a lockfile-less project reported "Redirected 0
 /// package(s)" with no explanation at all. Subprocess (not in-process) so
 /// stderr can be read back.
 #[tokio::test]
@@ -2086,7 +2084,7 @@ async fn redirect_human_mode_prints_rewriter_warnings() {
     let out = scrubbed_cli()
         .args([
             "scan",
-            "--redirect",
+            "--mode=hosted",
             "--yes",
             "--cwd",
             tmp.path().to_str().unwrap(),
@@ -2143,7 +2141,7 @@ async fn redirect_human_mode_warnings_are_not_json_quoted() {
     let out = scrubbed_cli()
         .args([
             "scan",
-            "--redirect",
+            "--mode=hosted",
             "--yes",
             "--cwd",
             tmp.path().to_str().unwrap(),
@@ -2176,7 +2174,7 @@ async fn redirect_human_mode_warnings_are_not_json_quoted() {
     let out = scrubbed_cli()
         .args([
             "scan",
-            "--redirect",
+            "--mode=hosted",
             "--yes",
             "--cwd",
             tmp.path().to_str().unwrap(),
@@ -2960,7 +2958,7 @@ async fn cargo_redirect_writes_the_legacy_dot_cargo_config() {
     std::fs::write(tmp.path().join(".cargo/config"), "[net]\nretry = 3\n").unwrap();
 
     let code = run(redirect_args(tmp.path(), server.uri())).await;
-    assert_eq!(code, 0, "scan --redirect should succeed");
+    assert_eq!(code, 0, "scan --mode hosted should succeed");
 
     let legacy = std::fs::read_to_string(tmp.path().join(".cargo/config")).unwrap();
     assert!(
@@ -2983,7 +2981,7 @@ async fn cargo_redirect_writes_the_legacy_dot_cargo_config() {
     );
 }
 
-/// `scan --redirect --json` must emit a machine-readable error envelope on
+/// `scan --mode hosted --json` must emit a machine-readable error envelope on
 /// stdout for EVERY failure exit, never empty stdout plus an exit code.
 ///
 /// Regression pin for the long-open hosted-mode JSON gap: the early
@@ -3048,7 +3046,7 @@ async fn redirect_json_mode_failures_emit_error_envelope() {
     let out = scrubbed_cli()
         .args([
             "scan",
-            "--redirect",
+            "--mode=hosted",
             "--yes",
             "--json",
             "--cwd",
@@ -3077,7 +3075,7 @@ async fn redirect_json_mode_failures_emit_error_envelope() {
     let out = scrubbed_cli()
         .args([
             "scan",
-            "--redirect",
+            "--mode=hosted",
             "--yes",
             "--json",
             "--cwd",
@@ -3122,13 +3120,13 @@ fn assert_write_failure_envelope(out: &std::process::Output, leg: &str) {
     );
 }
 
-/// Shared driver for the write-failure legs: a hosted `scan --redirect --json`
+/// Shared driver for the write-failure legs: a hosted `scan --mode hosted --json`
 /// subprocess against the obstructed project in `tmp`.
 async fn run_hosted_json_scan(tmp: &std::path::Path, server: &MockServer) -> std::process::Output {
     scrubbed_cli()
         .args([
             "scan",
-            "--redirect",
+            "--mode=hosted",
             "--yes",
             "--json",
             "--cwd",
@@ -3277,7 +3275,7 @@ async fn corrupt_pre_v5_ledger_dry_run_succeeds_without_touching_it() {
     let out = scrubbed_cli()
         .args([
             "scan",
-            "--redirect",
+            "--mode=hosted",
             "--yes",
             "--json",
             "--dry-run",
diff --git a/crates/socket-patch-cli/tests/in_process_redirect_pdm.rs b/crates/socket-patch-cli/tests/in_process_redirect_pdm.rs
index 7eb92abf..ea99779f 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect_pdm.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect_pdm.rs
@@ -119,7 +119,6 @@ async fn rollback_hosted(cwd: &Path, server: &MockServer) -> i32 {
             patch_server_url: Some(PATCH_SERVER.to_string()),
             ..global(cwd, server.uri())
         },
-        one_off: false,
         preserve_state: false,
     })
     .await;
@@ -160,9 +159,7 @@ fn hosted_args(cwd: &Path, api_url: String, vex: Option<&Path>) -> ScanArgs {
         prune: false,
         sync: false,
         vendor: false,
-        detached: false,
-        redirect: true,
-        mode: None,
+        mode: Some(socket_patch_cli::commands::scan::ScanMode::Hosted),
         all_releases: false,
         vex: VexEmbedArgs {
             vex: vex.map(Path::to_path_buf),
diff --git a/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs b/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs
index b176e9a6..2c80118b 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs
@@ -88,9 +88,7 @@ fn hosted_args(cwd: &Path, api_url: String, vex: Option<&Path>) -> ScanArgs {
         prune: false,
         sync: false,
         vendor: false,
-        detached: false,
-        redirect: true,
-        mode: None,
+        mode: Some(socket_patch_cli::commands::scan::ScanMode::Hosted),
         all_releases: false,
         vex: VexEmbedArgs {
             vex: vex.map(Path::to_path_buf),
@@ -315,7 +313,6 @@ async fn roll_back(cwd: &Path, server: &MockServer) {
     let code = rollback::run(RollbackArgs {
         targets: Vec::new(),
         common: global(cwd, server.uri()),
-        one_off: false,
         preserve_state: false,
     })
     .await;
diff --git a/crates/socket-patch-cli/tests/in_process_redirect_pnpm.rs b/crates/socket-patch-cli/tests/in_process_redirect_pnpm.rs
index 03da8fcd..ddc76a93 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect_pnpm.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect_pnpm.rs
@@ -67,7 +67,6 @@ async fn rollback_hosted(cwd: &Path, server: &MockServer) -> i32 {
             patch_server_url: Some("http://patch.test".to_string()),
             ..socket_patch_cli::args::GlobalArgs::default()
         },
-        one_off: false,
         preserve_state: false,
     })
     .await;
@@ -75,8 +74,7 @@ async fn rollback_hosted(cwd: &Path, server: &MockServer) -> i32 {
     code
 }
 
-/// `--mode hosted` (the documented spelling; the hidden `--redirect` boolean
-/// folds into it).
+/// `--mode hosted`.
 fn hosted_args(cwd: &Path, api_url: String) -> ScanArgs {
     ScanArgs {
         paths: Vec::new(),
@@ -95,8 +93,6 @@ fn hosted_args(cwd: &Path, api_url: String) -> ScanArgs {
         prune: false,
         sync: false,
         vendor: false,
-        detached: false,
-        redirect: false,
         mode: Some(ScanMode::Hosted),
         all_releases: false,
         vex: Default::default(),
diff --git a/crates/socket-patch-cli/tests/in_process_redirect_poetry.rs b/crates/socket-patch-cli/tests/in_process_redirect_poetry.rs
index ef67e70a..5b1bb834 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect_poetry.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect_poetry.rs
@@ -104,7 +104,6 @@ async fn rollback_hosted(cwd: &Path, server: &MockServer) -> i32 {
             patch_server_url: Some("http://patch.test".to_string()),
             ..global(cwd, server.uri())
         },
-        one_off: false,
         preserve_state: false,
     })
     .await;
@@ -129,9 +128,7 @@ fn hosted_args(cwd: &Path, api_url: String, vex: Option<&Path>) -> ScanArgs {
         prune: false,
         sync: false,
         vendor: false,
-        detached: false,
-        redirect: true,
-        mode: None,
+        mode: Some(socket_patch_cli::commands::scan::ScanMode::Hosted),
         all_releases: false,
         vex: VexEmbedArgs {
             vex: vex.map(Path::to_path_buf),
diff --git a/crates/socket-patch-cli/tests/in_process_remote_ecosystems_apply.rs b/crates/socket-patch-cli/tests/in_process_remote_ecosystems_apply.rs
index 094454bc..1ff92dcc 100644
--- a/crates/socket-patch-cli/tests/in_process_remote_ecosystems_apply.rs
+++ b/crates/socket-patch-cli/tests/in_process_remote_ecosystems_apply.rs
@@ -93,8 +93,6 @@ fn default_scan_args(cwd: &Path, eco: &str, api_url: String) -> ScanArgs {
         prune: false,
         sync: true,
         vendor: false,
-        detached: false,
-        redirect: false,
         mode: None,
         all_releases: false,
         vex: Default::default(),
diff --git a/crates/socket-patch-cli/tests/in_process_remove_repair_lifecycle.rs b/crates/socket-patch-cli/tests/in_process_remove_repair_lifecycle.rs
index 575d6339..2f795be6 100644
--- a/crates/socket-patch-cli/tests/in_process_remove_repair_lifecycle.rs
+++ b/crates/socket-patch-cli/tests/in_process_remove_repair_lifecycle.rs
@@ -848,7 +848,6 @@ async fn repair_telemetry_attributed_to_env_credentials() {
     // below would fail for the wrong reason (`is_telemetry_disabled`
     // reads these at runtime — `VITEST=true` included).
     std::env::remove_var("SOCKET_TELEMETRY_DISABLED");
-    std::env::remove_var("SOCKET_PATCH_TELEMETRY_DISABLED");
     std::env::remove_var("SOCKET_OFFLINE");
     std::env::remove_var("VITEST");
     let code = repair_run(make_repair_args(tmp.path(), "file")).await;
diff --git a/crates/socket-patch-cli/tests/in_process_rollback_all_ecosystems.rs b/crates/socket-patch-cli/tests/in_process_rollback_all_ecosystems.rs
index cdaf734d..b3487362 100644
--- a/crates/socket-patch-cli/tests/in_process_rollback_all_ecosystems.rs
+++ b/crates/socket-patch-cli/tests/in_process_rollback_all_ecosystems.rs
@@ -110,7 +110,6 @@ fn default_rollback_args(cwd: &Path, eco: &str) -> RollbackArgs {
         },
         targets: Vec::new(),
         preserve_state: false,
-        one_off: false,
     }
 }
 
diff --git a/crates/socket-patch-cli/tests/in_process_rollback_hosted.rs b/crates/socket-patch-cli/tests/in_process_rollback_hosted.rs
index 5f6072e0..19ff8dae 100644
--- a/crates/socket-patch-cli/tests/in_process_rollback_hosted.rs
+++ b/crates/socket-patch-cli/tests/in_process_rollback_hosted.rs
@@ -86,8 +86,6 @@ fn hosted_scan_args(cwd: &Path, api_url: String) -> ScanArgs {
         prune: false,
         sync: false,
         vendor: false,
-        detached: false,
-        redirect: false,
         mode: Some(ScanMode::Hosted),
         all_releases: false,
         vex: Default::default(),
@@ -109,7 +107,6 @@ async fn rollback_in_process(cwd: &Path, targets: Vec<String>, preserve_state: b
             patch_server_url: Some("http://patch.test".to_string()),
             ..socket_patch_cli::args::GlobalArgs::default()
         },
-        one_off: false,
         preserve_state,
     };
     let code = rollback_run(args).await;
@@ -155,7 +152,6 @@ async fn rollback_online(cwd: &Path, server: &MockServer) -> i32 {
             patch_server_url: Some("http://patch.test".to_string()),
             ..socket_patch_cli::args::GlobalArgs::default()
         },
-        one_off: false,
         preserve_state: false,
     };
     let code = rollback_run(args).await;
@@ -669,7 +665,6 @@ async fn npm_hosted_dry_run_previews_cleanly() {
             patch_server_url: Some("http://patch.test".to_string()),
             ..socket_patch_cli::args::GlobalArgs::default()
         },
-        one_off: false,
         preserve_state: false,
     };
     let code = rollback_run(args).await;
@@ -833,7 +828,6 @@ async fn pypi_requirements_hosted_round_trip() {
         ghsa: false,
         package: false,
         save_only: false,
-        one_off: false,
         all_releases: false,
         mode: Some(ScanMode::Hosted),
     };
diff --git a/crates/socket-patch-cli/tests/in_process_rollback_vendored.rs b/crates/socket-patch-cli/tests/in_process_rollback_vendored.rs
index 58774101..34430eaa 100644
--- a/crates/socket-patch-cli/tests/in_process_rollback_vendored.rs
+++ b/crates/socket-patch-cli/tests/in_process_rollback_vendored.rs
@@ -211,7 +211,6 @@ fn rollback_args(cwd: &Path, preserve_state: bool) -> RollbackArgs {
             lock_timeout: Some(5),
             ..GlobalArgs::default()
         },
-        one_off: false,
         preserve_state,
     }
 }
diff --git a/crates/socket-patch-cli/tests/in_process_scan.rs b/crates/socket-patch-cli/tests/in_process_scan.rs
index bfc0d72c..e9d816d8 100644
--- a/crates/socket-patch-cli/tests/in_process_scan.rs
+++ b/crates/socket-patch-cli/tests/in_process_scan.rs
@@ -39,8 +39,6 @@ fn default_args(cwd: &Path) -> ScanArgs {
         prune: false,
         sync: false,
         vendor: false,
-        detached: false,
-        redirect: false,
         mode: None,
         all_releases: false,
         vex: Default::default(),
diff --git a/crates/socket-patch-cli/tests/in_process_vendor.rs b/crates/socket-patch-cli/tests/in_process_vendor.rs
index 15c8aaf8..122d3d03 100644
--- a/crates/socket-patch-cli/tests/in_process_vendor.rs
+++ b/crates/socket-patch-cli/tests/in_process_vendor.rs
@@ -2860,7 +2860,7 @@ async fn scan_vendor_gem_qualified_platform_ruby_purl_vendors() {
     );
 }
 
-/// The QUALIFIED purl through `--detached` + `vendor --revert`: a detached
+/// The QUALIFIED purl through `scan --vendor` + `vendor --revert`: a detached
 /// ledger entry has NO manifest fallback, so the revert must find it via its
 /// own key/`basePurl` alone. The bare-purl detached shape is covered by
 /// [`scan_vendor_gem_detached_writes_no_manifest_and_reverts`]; this pins
@@ -2871,10 +2871,10 @@ async fn scan_vendor_gem_detached_qualified_purl_reverts() {
     mount_gem_patch_api(&mock, GEM_PURL_QUALIFIED).await;
     let fx = gem_fixture();
 
-    let (code, env) = run_scan_vendor(fx.root(), &mock.uri(), &["--detached"]);
+    let (code, env) = run_scan_vendor(fx.root(), &mock.uri(), &[]);
     assert_eq!(
         code, 0,
-        "scan --vendor --detached must succeed on the qualified purl: {env:#}"
+        "scan --vendor must succeed on the qualified purl: {env:#}"
     );
     assert_eq!(env["vendor"]["summary"]["applied"], 1, "envelope: {env:#}");
 
@@ -2911,7 +2911,7 @@ async fn scan_vendor_gem_detached_qualified_purl_reverts() {
     assert!(!fx.root().join(".socket/vendor").exists());
 }
 
-/// `scan --vendor --detached` on the gem project: no manifest is written,
+/// `scan --vendor` on the gem project: no manifest is written,
 /// the ledger entry is detached with the patch record embedded, the pair
 /// edit still lands — and `vendor --revert` (the detached entry's only exit
 /// path) byte-restores both files.
@@ -2921,8 +2921,8 @@ async fn scan_vendor_gem_detached_writes_no_manifest_and_reverts() {
     mount_gem_patch_api(&mock, GEM_PURL).await;
     let fx = gem_fixture();
 
-    let (code, env) = run_scan_vendor(fx.root(), &mock.uri(), &["--detached"]);
-    assert_eq!(code, 0, "scan --vendor --detached must succeed: {env:#}");
+    let (code, env) = run_scan_vendor(fx.root(), &mock.uri(), &[]);
+    assert_eq!(code, 0, "scan --vendor must succeed: {env:#}");
     assert_eq!(env["vendor"]["summary"]["applied"], 1, "envelope: {env:#}");
 
     assert!(
@@ -3262,8 +3262,6 @@ snapshots:
             prune: false,
             sync: false,
             vendor: false,
-            detached: false,
-            redirect: false,
             mode: Some(ScanMode::Hosted),
             all_releases: false,
             vex: Default::default(),
diff --git a/crates/socket-patch-cli/tests/in_process_vendor_bun.rs b/crates/socket-patch-cli/tests/in_process_vendor_bun.rs
index 33cf99de..38f15e78 100644
--- a/crates/socket-patch-cli/tests/in_process_vendor_bun.rs
+++ b/crates/socket-patch-cli/tests/in_process_vendor_bun.rs
@@ -1,6 +1,5 @@
 //! Hermetic subprocess tests for the Bun VENDORED-mode refusals and their
-//! positive twins: `scan --mode vendored` (with and without the no-op
-//! `--detached`), `get <uuid> --mode vendored`, `get <purl> --mode
+//! positive twins: `scan --mode vendored`, `get <uuid> --mode vendored`, `get <purl> --mode
 //! vendored`, their `--dry-run` previews, `--silent`, and the agent
 //! `--save-only` exemption — driven through the built binary against a
 //! wiremock patch API, on lockfiles written in the grammar REAL bun
@@ -569,22 +568,21 @@ async fn scan_vendored_refusal_preserves_seeded_manifest_record() {
 }
 
 // ---------------------------------------------------------------------------
-// scan --mode vendored --detached: the same refusal, BEFORE any fetch
+// scan --mode vendored: the same refusal, BEFORE any fetch
 // ---------------------------------------------------------------------------
 
-/// Every vendored download phase (with or without the no-op `--detached`)
-/// refuses pre-fetch with the vendor code — never fetching the view and
+/// Every vendored download phase refuses pre-fetch with the vendor code — never fetching the view and
 /// deferring the refusal to the vendor engine (which degrades to
 /// `package_not_installed` for alias installs) — and writes no manifest.
 #[tokio::test]
-async fn scan_vendored_detached_refuses_v1_workspace_before_fetch() {
+async fn scan_vendored_refuses_v1_workspace_before_fetch() {
     let mock = MockServer::start().await;
     mount_patch_api(&mock).await;
     let tmp = tempfile::tempdir().unwrap();
     write_bun_project(tmp.path(), LockShape::V1Workspace);
     let lock_before = lock_bytes(tmp.path());
 
-    let (exit, stdout, stderr) = scan_vendored(tmp.path(), &mock.uri(), &["--detached", "--json"]);
+    let (exit, stdout, stderr) = scan_vendored(tmp.path(), &mock.uri(), &["--json"]);
     assert_eq!(exit, 1, "stdout={stdout}\nstderr={stderr}");
     let v = parse_single_json_doc(&stdout);
     assert_eq!(v["status"], "partial_failure", "{v}");
@@ -604,16 +602,16 @@ async fn scan_vendored_detached_refuses_v1_workspace_before_fetch() {
     assert_refusal_left_tree_alone(tmp.path(), &lock_before);
 }
 
-/// The lockb twin of the detached refusal: the shape that used to
+/// The lockb twin of the pre-fetch refusal: the shape that used to
 /// misreport `package_not_installed` after a needless fetch.
 #[tokio::test]
-async fn scan_vendored_detached_refuses_bun_lockb_before_fetch() {
+async fn scan_vendored_refuses_bun_lockb_before_fetch() {
     let mock = MockServer::start().await;
     mount_patch_api(&mock).await;
     let tmp = tempfile::tempdir().unwrap();
     write_bun_project(tmp.path(), LockShape::MalformedLockb);
 
-    let (exit, stdout, stderr) = scan_vendored(tmp.path(), &mock.uri(), &["--detached", "--json"]);
+    let (exit, stdout, stderr) = scan_vendored(tmp.path(), &mock.uri(), &["--json"]);
     assert_eq!(exit, 1, "stdout={stdout}\nstderr={stderr}");
     let v = parse_single_json_doc(&stdout);
     assert_eq!(v["download"]["downloaded"], 0, "{v}");
@@ -818,17 +816,6 @@ async fn dry_run_previews_report_would_refuse_on_refused_bun_project() {
             "scan",
             vec!["scan", "--mode", "vendored", "--dry-run", "--json"],
         ),
-        (
-            "scan --detached",
-            vec![
-                "scan",
-                "--mode",
-                "vendored",
-                "--detached",
-                "--dry-run",
-                "--json",
-            ],
-        ),
         (
             "get <uuid>",
             vec!["get", UUID, "--mode", "vendored", "--dry-run", "--json"],
@@ -1069,7 +1056,7 @@ async fn preserved_ledger_does_not_bypass_bun_refusal_after_rollback() {
     let tmp = tempfile::tempdir().unwrap();
     let root = tmp.path();
     write_bun_project(root, LockShape::V1Direct);
-    let (exit, stdout, stderr) = scan_vendored(root, &mock.uri(), &["--json", "--detached"]);
+    let (exit, stdout, stderr) = scan_vendored(root, &mock.uri(), &["--json"]);
     assert_eq!(exit, 0, "{stdout}\n{stderr}");
     assert!(!root.join(".socket/manifest.json").exists());
     let (exit, stdout, stderr) = run(root, &["rollback", "--preserve-state", "--yes", "--json"]);
@@ -1381,7 +1368,7 @@ async fn corrupt_vendor_ledger_on_refused_bun_lock_reports_vendor_state_unreadab
     assert_eq!(rec["errorCode"], LEDGER_CODE, "{v}");
 
     // Detached download phase: the same code before any fetch.
-    let (exit, stdout, stderr) = scan_vendored(tmp.path(), &mock.uri(), &["--detached", "--json"]);
+    let (exit, stdout, stderr) = scan_vendored(tmp.path(), &mock.uri(), &["--json"]);
     assert_eq!(exit, 1, "stdout={stdout}\nstderr={stderr}");
     let v = parse_single_json_doc(&stdout);
     let rec = &v["download"]["patches"][0];
diff --git a/crates/socket-patch-cli/tests/remove_duality_invariants.rs b/crates/socket-patch-cli/tests/remove_duality_invariants.rs
index 8cb2efb1..5939d0dc 100644
--- a/crates/socket-patch-cli/tests/remove_duality_invariants.rs
+++ b/crates/socket-patch-cli/tests/remove_duality_invariants.rs
@@ -401,11 +401,12 @@ fn make_two_entry_socket_dir(root: &Path) -> PathBuf {
     socket
 }
 
-/// The default cleanup now covers `.socket/diffs` and `.socket/packages`
-/// (`<uuid>.tar.gz`, kept iff the uuid is still referenced by the
-/// post-removal manifest) in addition to blobs. Removing A must sweep A's
-/// archives from BOTH dirs while B's — still referenced by the second
-/// manifest entry — survive; the artifact carrier reports the count.
+/// The default cleanup now covers `.socket/diffs` (`<uuid>.tar.gz`, kept iff
+/// the uuid is still referenced by the post-removal manifest) and the legacy
+/// `.socket/packages` (swept whole: v5.0 reads no package archives) in
+/// addition to blobs. Removing A must sweep A's diff archive while B's —
+/// still referenced by the second manifest entry — survives, and both
+/// package archives go; the artifact carrier reports the count.
 #[test]
 fn default_remove_sweeps_archives_too() {
     let tmp = tempfile::tempdir().expect("tempdir");
@@ -437,7 +438,8 @@ fn default_remove_sweeps_archives_too() {
         "exactly A's manifest entry is removed"
     );
 
-    // A's archives are gone from BOTH archive dirs; B's survive in both.
+    // A's archives are gone from BOTH archive dirs; B's diff archive
+    // survives, its legacy package archive does not.
     for dir in ["diffs", "packages"] {
         assert!(
             !socket
@@ -446,24 +448,31 @@ fn default_remove_sweeps_archives_too() {
                 .exists(),
             "the removed entry's {dir} archive must be swept"
         );
-        assert!(
-            socket
-                .join(dir)
-                .join(format!("{ARCH_UUID_B}.tar.gz"))
-                .exists(),
-            "the kept entry's {dir} archive must survive"
-        );
     }
+    assert!(
+        socket
+            .join("diffs")
+            .join(format!("{ARCH_UUID_B}.tar.gz"))
+            .exists(),
+        "the kept entry's diff archive must survive"
+    );
+    assert!(
+        !socket
+            .join("packages")
+            .join(format!("{ARCH_UUID_B}.tar.gz"))
+            .exists(),
+        "a legacy package archive is swept even for a kept entry"
+    );
 
-    // The purl-less artifact carrier reports the two swept archives.
+    // The purl-less artifact carrier reports the three swept archives.
     let events = v["events"].as_array().expect("events array");
     let carrier = events
         .iter()
         .find(|e| e["action"] == "removed" && e["purl"].is_null())
         .unwrap_or_else(|| panic!("expected the artifact carrier event: {events:?}"));
     assert_eq!(
-        carrier["details"]["archivesRemoved"], 2,
-        "one diff + one package archive swept; carrier={carrier}"
+        carrier["details"]["archivesRemoved"], 3,
+        "one diff + two package archives swept; carrier={carrier}"
     );
 
     // The keep-rule really is manifest-anchored: B's entry survives.
diff --git a/crates/socket-patch-cli/tests/remove_rollback_api_overrides.rs b/crates/socket-patch-cli/tests/remove_rollback_api_overrides.rs
index bee81cc8..168a59cf 100644
--- a/crates/socket-patch-cli/tests/remove_rollback_api_overrides.rs
+++ b/crates/socket-patch-cli/tests/remove_rollback_api_overrides.rs
@@ -55,7 +55,6 @@ const SOCKET_ENV_VARS: &[&str] = &[
     "SOCKET_LOCK_TIMEOUT",
     "SOCKET_DEBUG",
     "SOCKET_TELEMETRY_DISABLED",
-    "SOCKET_ONE_OFF",
     "SOCKET_SKIP_ROLLBACK",
     "SOCKET_NO_TRUST_LOCKFILE_CONFIG",
     "SOCKET_NO_NPM_ALLOW_REMOTE_CONFIG",
diff --git a/crates/socket-patch-cli/tests/rollback_invariants.rs b/crates/socket-patch-cli/tests/rollback_invariants.rs
index a447e068..4ae177ca 100644
--- a/crates/socket-patch-cli/tests/rollback_invariants.rs
+++ b/crates/socket-patch-cli/tests/rollback_invariants.rs
@@ -119,7 +119,7 @@ fn rollback_with_no_manifest_emits_error() {
     let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
     assert_eq!(v["status"], "error");
     // Pin the *specific* error so a regression that exits 1 for some other
-    // reason (e.g. ambient env steering it into one-off mode) can't pass.
+    // reason (e.g. ambient env steering it elsewhere) can't pass.
     let err = v["error"].as_str().expect("error message string");
     assert!(
         err.contains("Manifest not found"),
@@ -127,136 +127,6 @@ fn rollback_with_no_manifest_emits_error() {
     );
 }
 
-#[test]
-fn rollback_one_off_without_identifier_errors() {
-    // `--one-off` is documented as requiring a UUID/PURL positional.
-    // Without one, rollback bails with an error envelope.
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let (code, stdout) = run(tmp.path(), &["--json", "--one-off"]);
-    assert_eq!(
-        code, 2,
-        "--one-off w/o identifier is a usage error (exit 2); stdout=\n{stdout}"
-    );
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(v["status"], "error");
-    let err = v["error"].as_str().expect("error message string");
-    assert!(
-        err.contains("--one-off requires an identifier"),
-        "unexpected error message: {err}"
-    );
-}
-
-#[test]
-fn rollback_one_off_with_identifier_reports_not_implemented() {
-    // The one-off mode is a stub that always returns "not yet
-    // implemented". We pin it here so a real implementation can't land
-    // silently without updating the contract.
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let (code, stdout) = run(
-        tmp.path(),
-        &[
-            "--json",
-            "--one-off",
-            "33333333-3333-4333-8333-333333333333",
-        ],
-    );
-    assert_eq!(code, 2, "one-off mode is a usage error (exit 2); stdout=\n{stdout}");
-    let v: serde_json::Value = serde_json::from_str(&stdout).expect("valid JSON");
-    assert_eq!(v["status"], "error");
-    let err = v["error"].as_str().expect("error message string");
-    assert!(
-        err.contains("not yet implemented"),
-        "unexpected error message: {err}"
-    );
-}
-
-/// Regression: `SOCKET_ONE_OFF=1` must set `--one-off` exactly like the flag.
-/// clap's default bool parser accepts only the literal strings `true`/`false`
-/// from an env binding, so any other truthy spelling aborted every `rollback`
-/// invocation with a clap usage error (exit 2) before it could do any work.
-/// `value_parser = parse_bool_flag` gives the flag the same env vocabulary as
-/// the `GlobalArgs` bools. Reaching the one-off stub's "not yet implemented"
-/// envelope proves the env var landed as `true`.
-#[test]
-fn truthy_one_off_env_var_sets_flag() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let out = rollback_cmd(tmp.path())
-        .env("SOCKET_ONE_OFF", "1")
-        .args(["--json", "33333333-3333-4333-8333-333333333333"])
-        .output()
-        .expect("run socket-patch");
-    assert_eq!(
-        out.status.code(),
-        Some(2),
-        "SOCKET_ONE_OFF=1 must parse and reach the one-off stub (its JSON envelope \
-         below proves it was not a clap error); stderr=\n{}",
-        String::from_utf8_lossy(&out.stderr)
-    );
-    let stdout = String::from_utf8_lossy(&out.stdout);
-    let v: serde_json::Value = serde_json::from_str(&stdout)
-        .expect("JSON envelope (a clap usage error means the env var aborted the parse)");
-    assert_eq!(v["status"], "error");
-    let err = v["error"].as_str().expect("error message string");
-    assert!(
-        err.contains("not yet implemented"),
-        "expected the one-off stub (proving one_off=true), got: {err}"
-    );
-}
-
-/// An exported-but-empty `SOCKET_ONE_OFF=` — the shell/CI idiom for
-/// blanking a variable without unsetting it — must mean "unset, fall back to
-/// false", not abort the run. (`SOCKET_ONE_OFF` is in `LOCAL_ARG_ENV_VARS`,
-/// so `main`'s empty-var scrub removes it before clap parses;
-/// `parse_bool_flag` also treats an empty string as false.) With one-off correctly off, a manifest-less
-/// rollback reaches the normal "Manifest not found" error.
-#[test]
-fn empty_one_off_env_var_parses_as_false_not_crash() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let out = rollback_cmd(tmp.path())
-        .env("SOCKET_ONE_OFF", "")
-        .args(["--json"])
-        .output()
-        .expect("run socket-patch");
-    assert_eq!(
-        out.status.code(),
-        Some(1),
-        "empty SOCKET_ONE_OFF must parse, not abort with a usage error; stderr=\n{}",
-        String::from_utf8_lossy(&out.stderr)
-    );
-    let stdout = String::from_utf8_lossy(&out.stdout);
-    let v: serde_json::Value = serde_json::from_str(&stdout)
-        .expect("JSON envelope (a clap usage error means the env var aborted the parse)");
-    assert_eq!(v["status"], "error");
-    let err = v["error"].as_str().expect("error message string");
-    assert!(
-        err.contains("Manifest not found"),
-        "empty SOCKET_ONE_OFF must resolve to false (normal rollback path), got: {err}"
-    );
-}
-
-/// Human (non-JSON) one-off must surface the same not-implemented error the
-/// JSON envelope carries. Before the fix the human branch printed a
-/// misleading "One-off rollback mode: fetching patch data..." progress line
-/// — for work that never happens — and exited 1 with no error at all.
-#[test]
-fn rollback_one_off_human_reports_not_implemented_error() {
-    let tmp = tempfile::tempdir().expect("tempdir");
-    let out = rollback_cmd(tmp.path())
-        .args(["--one-off", "33333333-3333-4333-8333-333333333333"])
-        .output()
-        .expect("run socket-patch");
-    assert_eq!(out.status.code(), Some(2), "one-off mode is a usage error (exit 2)");
-    let stderr = String::from_utf8_lossy(&out.stderr);
-    assert!(
-        stderr.contains("not yet implemented"),
-        "human one-off must state the not-implemented error; stderr=\n{stderr}"
-    );
-    assert!(
-        !stderr.contains("fetching patch data"),
-        "must not print a progress line for work that never happens; stderr=\n{stderr}"
-    );
-}
-
 #[test]
 fn rollback_unknown_identifier_emits_error() {
     let tmp = tempfile::tempdir().expect("tempdir");
diff --git a/crates/socket-patch-cli/tests/scan_vendor_e2e.rs b/crates/socket-patch-cli/tests/scan_vendor_e2e.rs
index 53bc0949..280c9feb 100644
--- a/crates/socket-patch-cli/tests/scan_vendor_e2e.rs
+++ b/crates/socket-patch-cli/tests/scan_vendor_e2e.rs
@@ -2,8 +2,7 @@
 //! patches, fetches their records in memory, and vendors each patched
 //! package into the committable `.socket/vendor/` tree instead of
 //! applying in place. Vendored mode is manifest-free: the ledger's
-//! embedded records are the only state written (`--detached` is an
-//! accepted no-op). Mock API + a real npm lockfile fixture, driven
+//! embedded records are the only state written. Mock API + a real npm lockfile fixture, driven
 //! through the built binary.
 
 use std::path::{Path, PathBuf};
@@ -518,9 +517,8 @@ async fn scan_vendor_migrates_legacy_manifest_mode_project() {
 }
 
 #[tokio::test]
-async fn scan_vendor_detached_mode_writes_no_manifest() {
-    // scan --vendor --detached: the flag is a compatibility no-op — the run
-    // is the same manifest-free flow, embedded-record ledger and all.
+async fn scan_vendor_writes_no_manifest() {
+    // scan --vendor: the manifest-free flow, embedded-record ledger and all.
     let mock = MockServer::start().await;
     mount_patch_api(&mock, UUID).await;
     let tmp = tempfile::tempdir().unwrap();
@@ -529,7 +527,7 @@ async fn scan_vendor_detached_mode_writes_no_manifest() {
     let (code, stdout, stderr) = run_scan_vendor(
         tmp.path(),
         &mock.uri(),
-        &["--detached", "--vex", "out.vex.json"],
+        &["--vex", "out.vex.json"],
     );
     assert_eq!(code, 0, "stdout={stdout}; stderr={stderr}");
     let v: serde_json::Value = serde_json::from_str(stdout.trim()).expect("valid JSON");
@@ -587,7 +585,7 @@ async fn scan_vendor_detached_mode_writes_no_manifest() {
     // Idempotent re-run: the ledger's embedded record short-circuits the
     // view fetch entirely (request-log proof) and the backend skips.
     let before_reqs = mock.received_requests().await.unwrap().len();
-    let (code, stdout, _) = run_scan_vendor(tmp.path(), &mock.uri(), &["--detached"]);
+    let (code, stdout, _) = run_scan_vendor(tmp.path(), &mock.uri(), &[]);
     assert_eq!(code, 0, "stdout={stdout}");
     let v2: serde_json::Value = serde_json::from_str(stdout.trim()).unwrap();
     assert_eq!(v2["download"]["skipped"], 1, "envelope={v2}");
@@ -661,14 +659,14 @@ async fn scan_vendor_dry_run_previews_without_touching_disk() {
     );
 }
 
-/// Interactive (non-JSON) `scan --vendor --detached` with a failing patch
+/// Interactive (non-JSON) `scan --vendor` with a failing patch
 /// view fetch must SAY what failed: exit 1 with a `[fail]` line naming the
 /// purl on stderr. Regression guard: `download_patch_records`' failure arms
 /// recorded the error only in their JSON report, so the human path exited
 /// non-zero with no error output at all (the JSON report is discarded and
 /// the vendor engine just says "No vendorable patches in scope").
 #[tokio::test]
-async fn scan_vendor_detached_fetch_failure_reports_error() {
+async fn scan_vendor_fetch_failure_reports_error() {
     let mock = MockServer::start().await;
     // Discovery succeeds (batch + per-package search, same shapes as
     // `mount_patch_api`), but the view fetch fails.
@@ -722,7 +720,6 @@ async fn scan_vendor_detached_fetch_failure_reports_error() {
         .args([
             "scan",
             "--vendor",
-            "--detached",
             "--yes",
             "--api-url",
             &mock.uri(),
@@ -764,11 +761,10 @@ async fn scan_vendor_detached_fetch_failure_reports_error() {
 
 #[tokio::test]
 async fn scan_vendor_flag_conflicts_are_clap_errors() {
-    // --vendor conflicts with --apply/--sync; --detached requires --vendor.
+    // --vendor conflicts with --apply/--sync.
     for argv in [
         &["scan", "--vendor", "--apply"][..],
         &["scan", "--vendor", "--sync"][..],
-        &["scan", "--detached"][..],
     ] {
         let out = Command::new(binary())
             .args(argv)
@@ -782,7 +778,7 @@ async fn scan_vendor_flag_conflicts_are_clap_errors() {
             "argv={argv:?} must be a clap usage error: {stderr}"
         );
         assert!(
-            stderr.contains("cannot be used with") || stderr.contains("required"),
+            stderr.contains("cannot be used with"),
             "argv={argv:?}: {stderr}"
         );
     }
@@ -1943,8 +1939,7 @@ async fn scan_apply_skips_lockfile_only_without_error() {
 }
 
 // ---------------------------------------------------------------------------
-// Bun vendored-mode preflight through `scan`: download phase, --detached,
-// --silent
+// Bun vendored-mode preflight through `scan`: download phase, --silent
 // ---------------------------------------------------------------------------
 
 const BUN_WS_CODE: &str = "vendor_bun_workspace_unsupported";
@@ -2024,51 +2019,6 @@ async fn scan_vendored_bun_v1_workspace_refuses_in_download_phase() {
     );
 }
 
-/// The `--detached` (no-op) twin refuses BEFORE any fetch too: same record,
-/// zero downloads, and no manifest at all.
-#[tokio::test]
-async fn scan_vendored_bun_detached_refuses_before_fetch() {
-    let mock = MockServer::start().await;
-    mount_patch_api(&mock, UUID).await;
-    let tmp = tempfile::tempdir().unwrap();
-    write_bun_v1_workspace_fixture(tmp.path());
-    let lock_before = std::fs::read(tmp.path().join("bun.lock")).unwrap();
-
-    let (code, stdout, stderr) = run_scan_vendor(
-        tmp.path(),
-        &mock.uri(),
-        &["--mode", "vendored", "--detached"],
-    );
-    assert_eq!(code, 1, "stdout={stdout}; stderr={stderr}");
-    let v: serde_json::Value = serde_json::from_str(stdout.trim()).expect("valid JSON");
-    assert_eq!(v["status"], "partial_failure", "envelope={v}");
-    assert_eq!(v["download"]["detached"], true, "envelope={v}");
-    assert_eq!(v["download"]["downloaded"], 0, "envelope={v}");
-    assert_eq!(v["download"]["failed"], 1, "envelope={v}");
-    assert_eq!(
-        v["download"]["patches"][0]["action"], "failed",
-        "envelope={v}"
-    );
-    assert_eq!(
-        v["download"]["patches"][0]["errorCode"], BUN_WS_CODE,
-        "envelope={v}"
-    );
-    let reqs = mock.received_requests().await.unwrap();
-    assert!(
-        !reqs.iter().any(|r| r.url.path().contains("/patches/view/")),
-        "detached must refuse before fetching"
-    );
-    assert!(
-        !tmp.path().join(".socket/manifest.json").exists(),
-        "detached mode never writes a manifest"
-    );
-    assert!(!tmp.path().join(".socket/vendor").exists());
-    assert_eq!(
-        std::fs::read(tmp.path().join("bun.lock")).unwrap(),
-        lock_before
-    );
-}
-
 /// The interactive (`--silent`, non-JSON) arm: "errors only" means the
 /// refusal line — code-tagged, naming the purl — stays on stderr while
 /// stdout is empty, exit 1. Regression guard: the line was gated on
@@ -2228,8 +2178,7 @@ async fn scan_vendored_vlt_direct_dependency_vendors() {
 
 /// Manifest-less VEX over the committed state `scan --vendor` leaves
 /// (manifest-free since 5.0 — the ledger's `detached` entries embed the
-/// records, and the hidden `--detached` flag is a no-op, so there is one
-/// shape to cover): the checkout attests `(vendored)` from the ledger's
+/// records, so there is one shape to cover): the checkout attests `(vendored)` from the ledger's
 /// embedded record, then from lockfile discovery + the patch API once the
 /// ledgers are gone too, never `--offline` (`record_unavailable`, zero
 /// requests), and not once the lock is reverted (`vendor_unwired`,
diff --git a/crates/socket-patch-cli/tests/telemetry_e2e.rs b/crates/socket-patch-cli/tests/telemetry_e2e.rs
index fc4c5a38..7301b3ff 100644
--- a/crates/socket-patch-cli/tests/telemetry_e2e.rs
+++ b/crates/socket-patch-cli/tests/telemetry_e2e.rs
@@ -137,7 +137,6 @@ fn build_cmd_with_token(
     // (`is_telemetry_disabled()` flips on `VITEST=true`).
     cmd.env_remove("VITEST");
     cmd.env_remove("SOCKET_TELEMETRY_DISABLED");
-    cmd.env_remove("SOCKET_PATCH_TELEMETRY_DISABLED");
     cmd.env_remove("SOCKET_OFFLINE");
     // An ambient VIRTUAL_ENV hijacks the python crawler (its site-packages
     // get crawled as project packages), breaking the exact
diff --git a/crates/socket-patch-cli/tests/vex_e2e_common/uv.rs b/crates/socket-patch-cli/tests/vex_e2e_common/uv.rs
index df5ff53a..415dea70 100644
--- a/crates/socket-patch-cli/tests/vex_e2e_common/uv.rs
+++ b/crates/socket-patch-cli/tests/vex_e2e_common/uv.rs
@@ -39,7 +39,7 @@
 //! 1. build the project with uv from PyPI (`uv lock` + `uv sync`, `uv lock
 //!    --script`, `uv export --format pylock.toml`, `uv pip compile -o
 //!    pylock.toml` or `pip lock`) and install the PRISTINE package;
-//! 2. produce the committed state with our CLI — hosted: `scan --redirect
+//! 2. produce the committed state with our CLI — hosted: `scan --mode hosted
 //!    --vex` against a wiremock patch API that also serves the patched
 //!    wheel; vendored: `vendor --offline --vex` over a staged manifest +
 //!    blob — asserting the in-run document;
@@ -53,7 +53,7 @@
 //!    deleted (a hosted flow writes none in v5 — asserted) it still attests
 //!    from lockfile discovery + the API record; (c) `--offline` without
 //!    ledgers is `record_unavailable` with ZERO requests; (d) the embedded
-//!    `apply --vex` (+ `vendor --vex` / `scan --redirect --vex`) attest too
+//!    `apply --vex` (+ `vendor --vex` / `scan --mode hosted --vex`) attest too
 //!    (hosted: online, there is no local record); (e) the wiring reverted to
 //!    the registry files with the ledgers and artifacts left behind,
 //!    reinstalled pristine by uv, is NOT attested — verified or
@@ -557,7 +557,7 @@ fn wheel_from_installed(site: &Path, version: &str, module: &[u8]) -> (String, V
 
 // ── the scan-side mock (hosted) ────────────────────────────────────────
 
-/// The authenticated routes `scan --redirect` uses for one pypi patch, plus
+/// The authenticated routes `scan --mode hosted` uses for one pypi patch, plus
 /// the patched wheel itself at its hosted url.
 pub struct ScanApi {
     server: wiremock::MockServer,
@@ -1209,7 +1209,7 @@ pub fn run_lane(suite: &str, uv: &Uv, mode: Mode, lane: Lane) {
                 &proj,
                 &[
                     "scan",
-                    "--redirect",
+                    "--mode=hosted",
                     "--json",
                     "--yes",
                     "--cwd",
@@ -1226,34 +1226,34 @@ pub fn run_lane(suite: &str, uv: &Uv, mode: Mode, lane: Lane) {
                     PRODUCT,
                 ],
             );
-            let env = envelope(&out, &report.what("scan --redirect"));
+            let env = envelope(&out, &report.what("scan --mode hosted"));
             assert!(
                 env["redirect"]["redirected"].as_u64().unwrap_or(0) >= 1,
                 "{}: nothing redirected: {env:#}",
-                report.what("scan --redirect")
+                report.what("scan --mode hosted")
             );
             // The in-run `--vex` judges the INSTALLED tree, which is still
             // the pristine wheel until uv reinstalls from the rewritten lock
             // ("installed evidence wins"): the redirect lands, the stale
             // install is reported, and nothing is attested (exit 1, no
             // document). The manifest-less matrix below re-runs `scan
-            // --redirect --vex` over the reinstalled fresh checkout.
+            // --mode hosted --vex` over the reinstalled fresh checkout.
             assert_eq!(
                 out.status.code(),
                 Some(1),
                 "{}: {env:#}",
-                report.what("scan --redirect")
+                report.what("scan --mode hosted")
             );
             assert_eq!(
                 env["error"]["code"],
                 "no_applicable_patches",
                 "{}: {env:#}",
-                report.what("scan --redirect")
+                report.what("scan --mode hosted")
             );
             assert!(
                 env.to_string().contains("redirect_pypi_stale_install"),
                 "{}: the stale pristine install is not reported: {env:#}",
-                report.what("scan --redirect")
+                report.what("scan --mode hosted")
             );
             assert!(
                 !embedded_doc.exists(),
@@ -1525,7 +1525,7 @@ pub fn run_lane(suite: &str, uv: &Uv, mode: Mode, lane: Lane) {
     match mode {
         Mode::Vendored => embedded.push(("vendor --vex", VexRun::offline().via(VexVia::Vendor))),
         Mode::Hosted => embedded.push((
-            "scan --redirect --vex",
+            "scan --mode hosted --vex",
             VexRun {
                 api_url: patch_server.clone(),
                 api_token: Some("fake-token".into()),
@@ -1533,7 +1533,7 @@ pub fn run_lane(suite: &str, uv: &Uv, mode: Mode, lane: Lane) {
                 ..VexRun::default()
             }
             .via(VexVia::Scan)
-            .arg("--redirect")
+            .arg("--mode=hosted")
             .arg("--yes"),
         )),
     }
diff --git a/crates/socket-patch-cli/tests/vex_pdm_hatch_common/mod.rs b/crates/socket-patch-cli/tests/vex_pdm_hatch_common/mod.rs
index eb2ee9a0..cdb642e2 100644
--- a/crates/socket-patch-cli/tests/vex_pdm_hatch_common/mod.rs
+++ b/crates/socket-patch-cli/tests/vex_pdm_hatch_common/mod.rs
@@ -16,7 +16,7 @@
 //! mod vex_pdm_hatch_common;
 //! ```
 //!
-//! Every project is wired by the REAL CLI, not by hand: `scan --redirect`
+//! Every project is wired by the REAL CLI, not by hand: `scan --mode hosted`
 //! (hosted) or `scan --vendor --vendor-source build` (vendored) runs against
 //! a wiremock stand-in for the Socket API, with the package's pristine
 //! install in a fabricated `.venv` for the vendored build. The wired tree is
@@ -416,7 +416,7 @@ pub fn path_with_fake_hatch(scratch: &Path) -> std::ffi::OsString {
     std::env::join_paths(paths).unwrap()
 }
 
-/// `scan --json` (hosted: `--redirect`; vendored: `--vendor --vendor-source
+/// `scan --json` (hosted: `--mode hosted`; vendored: `--vendor --vendor-source
 /// build`) in `cwd` against `api`.
 pub fn run_scan(
     cwd: &Path,
@@ -441,7 +441,7 @@ pub fn run_scan(
     .map(|s| s.to_string())
     .collect();
     match mode {
-        Mode::Hosted => args.push("--redirect".into()),
+        Mode::Hosted => args.push("--mode=hosted".into()),
         Mode::Vendored => args.extend(["--vendor", "--vendor-source", "build"].map(String::from)),
     }
     args.extend(extra.iter().map(|s| s.to_string()));
@@ -1165,16 +1165,16 @@ pub fn g_vendored_attests_over_a_pristine_venv_with_a_warning(flavors: &[Flavor]
     }
 }
 
-/// `scan --vendor --detached --vex` never writes a manifest; its own VEX
+/// `scan --vendor --vex` never writes a manifest; its own VEX
 /// and a later standalone `vex` both attest (ledger present, then gone).
 pub fn embedded_detached_vendor_scan_attests_without_a_manifest(flavors: &[Flavor]) {
     for flavor in flavors.iter().filter(|f| f.vendored) {
         let (_tmp, cwd) = fresh();
-        wire_into(&cwd, flavor, Mode::Vendored, &["--detached"]);
-        let what = format!("{} detached", flavor.label);
+        wire_into(&cwd, flavor, Mode::Vendored, &[]);
+        let what = format!("{} vendored", flavor.label);
         assert!(
             !cwd.join(".socket/manifest.json").exists(),
-            "{what}: detached writes no manifest"
+            "{what}: vendored mode writes no manifest"
         );
         let run = VexRun {
             offline: true,
@@ -1191,7 +1191,7 @@ pub fn embedded_detached_vendor_scan_attests_without_a_manifest(flavors: &[Flavo
     }
 }
 
-/// A CI re-run of `scan --redirect --vex` / `scan --vendor --vex` on a
+/// A CI re-run of `scan --mode hosted --vex` / `scan --vendor --vex` on a
 /// checkout whose `.socket/` was never committed (the wiring is already
 /// there): the embedded document still attests. `expect_refusal` names the
 /// flavors whose vendored backend documents a refusal for a ledgerless
diff --git a/crates/socket-patch-cli/tests/vex_pipenv_pip_common/mod.rs b/crates/socket-patch-cli/tests/vex_pipenv_pip_common/mod.rs
index 0dadda5d..654e445f 100644
--- a/crates/socket-patch-cli/tests/vex_pipenv_pip_common/mod.rs
+++ b/crates/socket-patch-cli/tests/vex_pipenv_pip_common/mod.rs
@@ -16,7 +16,7 @@
 //! mod vex_pipenv_pip_common;
 //! ```
 //!
-//! Every project is wired by the REAL CLI, not by hand: `scan --redirect`
+//! Every project is wired by the REAL CLI, not by hand: `scan --mode hosted`
 //! (hosted) or `scan --vendor --vendor-source build` (vendored) runs against
 //! a wiremock stand-in for the Socket API, with the package's pristine
 //! install in a fabricated `.venv` for the vendored build. The wired tree is
@@ -456,7 +456,7 @@ pub fn run_scan(
         cwd.to_str().unwrap(),
     ];
     match mode {
-        Mode::Hosted => args.push("--redirect"),
+        Mode::Hosted => args.push("--mode=hosted"),
         Mode::Vendored => args.extend(["--vendor", "--vendor-source", "build"]),
     }
     args.extend_from_slice(extra);
@@ -1227,16 +1227,16 @@ pub fn g_vendored_attests_over_a_pristine_venv_with_a_warning(flavors: &[Flavor]
     }
 }
 
-/// `scan --vendor --detached --vex` never writes a manifest; its own VEX
+/// `scan --vendor --vex` never writes a manifest; its own VEX
 /// and a later standalone `vex` both attest (ledger present, then gone).
 pub fn embedded_detached_vendor_scan_attests_without_a_manifest(flavors: &[Flavor]) {
     for flavor in flavors.iter().filter(|f| f.vendored) {
         let (_tmp, cwd) = fresh();
-        wire_into(&cwd, flavor, Mode::Vendored, &["--detached"]);
-        let what = format!("{} detached", flavor.label);
+        wire_into(&cwd, flavor, Mode::Vendored, &[]);
+        let what = format!("{} vendored", flavor.label);
         assert!(
             !cwd.join(".socket/manifest.json").exists(),
-            "{what}: detached writes no manifest"
+            "{what}: vendored mode writes no manifest"
         );
         let run = VexRun {
             offline: true,
@@ -1253,7 +1253,7 @@ pub fn embedded_detached_vendor_scan_attests_without_a_manifest(flavors: &[Flavo
     }
 }
 
-/// A CI re-run of `scan --redirect --vex` / `scan --vendor --vex` on a
+/// A CI re-run of `scan --mode hosted --vex` / `scan --vendor --vex` on a
 /// checkout whose `.socket/` was never committed (the wiring is already
 /// there): the embedded document still attests, and the re-scan leaves the
 /// wired lockfile byte-identical.
diff --git a/crates/socket-patch-cli/tests/vex_pipenv_pip_real/mod.rs b/crates/socket-patch-cli/tests/vex_pipenv_pip_real/mod.rs
index 9c2b5940..9d0135d3 100644
--- a/crates/socket-patch-cli/tests/vex_pipenv_pip_real/mod.rs
+++ b/crates/socket-patch-cli/tests/vex_pipenv_pip_real/mod.rs
@@ -94,7 +94,7 @@ impl Mode {
     /// The `scan` flags that produce this mode's wiring.
     pub fn scan_flags(self) -> &'static [&'static str] {
         match self {
-            Mode::Hosted => &["--redirect"],
+            Mode::Hosted => &["--mode=hosted"],
             Mode::Vendored => &["--vendor", "--vendor-source", "build"],
         }
     }
diff --git a/crates/socket-patch-core/src/api/blob_fetcher.rs b/crates/socket-patch-core/src/api/blob_fetcher.rs
index 5125ab3f..e1afdcf4 100644
--- a/crates/socket-patch-core/src/api/blob_fetcher.rs
+++ b/crates/socket-patch-core/src/api/blob_fetcher.rs
@@ -180,8 +180,7 @@ pub async fn fetch_blobs_by_hash(
 
 /// Return the set of patch UUIDs whose archive at
 /// `<archives_dir>/<uuid>.tar.gz` is missing from disk. Used as the
-/// "what do I need to download" query for diff mode, and as a presence
-/// check for locally staged package archives (`.socket/packages/`).
+/// "what do I need to download" query for diff mode.
 pub async fn get_missing_archives(
     manifest: &PatchManifest,
     archives_dir: &Path,
@@ -347,7 +346,8 @@ pub const DIFF_ARCHIVE: ArtifactNoun = ArtifactNoun {
     abbreviate_ids: false,
 };
 
-/// Per-patch package archives (`.socket/packages/<uuid>.tar.gz`).
+/// Legacy per-patch package archives (`.socket/packages/<uuid>.tar.gz`),
+/// which nothing writes or reads any more; only the cleanup sweeps name them.
 pub const PACKAGE_ARCHIVE: ArtifactNoun = ArtifactNoun {
     one: "package archive",
     many: "package archives",
diff --git a/crates/socket-patch-core/src/api/client.rs b/crates/socket-patch-core/src/api/client.rs
index cf2677fc..4729e5d0 100644
--- a/crates/socket-patch-core/src/api/client.rs
+++ b/crates/socket-patch-core/src/api/client.rs
@@ -1948,8 +1948,7 @@ fn rewrite_url_host(original: &str, new_base: &str) -> Result<String, ApiError>
 /// Explicit overrides for environment-based API client construction.
 ///
 /// Each `Some(value)` wins over the corresponding env var; `None` falls
-/// back to env-var lookup (with the legacy `SOCKET_PATCH_*` shim where
-/// applicable).
+/// back to env-var lookup.
 #[derive(Debug, Clone, Default)]
 pub struct ApiClientEnvOverrides {
     pub api_url: Option<String>,
@@ -1977,7 +1976,7 @@ pub struct ApiClientEnvOverrides {
 /// |---|---|
 /// | `SOCKET_API_URL` | Override the API URL (default `https://api.socket.dev`; socket-cli config `apiBaseUrl` sits between) |
 /// | `SOCKET_API_TOKEN` | API token for authenticated access (socket-cli config `apiToken` is the fallback) |
-/// | `SOCKET_PROXY_URL` | Override the public proxy URL (default `https://patches-api.socket.dev`). Legacy: `SOCKET_PATCH_PROXY_URL`. |
+/// | `SOCKET_PROXY_URL` | Override the public proxy URL (default `https://patches-api.socket.dev`) |
 /// | `SOCKET_ORG_SLUG` | Organization slug (socket-cli config `defaultOrg` is the fallback) |
 /// | `SOCKET_NO_API_TOKEN` | Truthy: ignore ambient tokens (env + config); only an explicit override authenticates |
 /// | `SOCKET_NO_CONFIG` | Truthy: disable the socket-cli config fallback layer entirely |
@@ -3176,9 +3175,7 @@ mod tests {
     fn binary_url_rederives_proxy_from_env_when_org_slug_missing() {
         const HASH: &str = "abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789";
         let saved_proxy = std::env::var("SOCKET_PROXY_URL").ok();
-        let saved_legacy = std::env::var("SOCKET_PATCH_PROXY_URL").ok();
         std::env::set_var("SOCKET_PROXY_URL", "http://env-proxy.test:9999/");
-        std::env::remove_var("SOCKET_PATCH_PROXY_URL");
 
         let client = ApiClient::new(ApiClientOptions {
             api_url: "https://api.socket.dev".into(),
@@ -3188,7 +3185,7 @@ mod tests {
         });
         let (env_url, env_use_auth) = client.binary_url("blob", HASH);
 
-        // With the vars unset the base falls back to the built-in default.
+        // With the var unset the base falls back to the built-in default.
         std::env::remove_var("SOCKET_PROXY_URL");
         let (default_url, default_use_auth) = client.binary_url("blob", HASH);
 
@@ -3196,10 +3193,6 @@ mod tests {
             Some(v) => std::env::set_var("SOCKET_PROXY_URL", v),
             None => std::env::remove_var("SOCKET_PROXY_URL"),
         }
-        match saved_legacy {
-            Some(v) => std::env::set_var("SOCKET_PATCH_PROXY_URL", v),
-            None => std::env::remove_var("SOCKET_PATCH_PROXY_URL"),
-        }
 
         assert_eq!(
             env_url,
diff --git a/crates/socket-patch-core/src/crawlers/npm_crawler.rs b/crates/socket-patch-core/src/crawlers/npm_crawler.rs
index 146e53a9..92257849 100644
--- a/crates/socket-patch-core/src/crawlers/npm_crawler.rs
+++ b/crates/socket-patch-core/src/crawlers/npm_crawler.rs
@@ -609,10 +609,7 @@ pub fn parse_bun_bin_output(stdout: &str) -> Option<String> {
 ///
 /// Production callers live inside `#[cfg(target_os = "macos")]` blocks of
 /// `get_global_node_modules_paths` (Homebrew/nvm/volta/fnm fallbacks).
-/// `#[allow(dead_code)]` keeps the function visible to the inline
-/// `#[cfg(test)] mod tests` callers on every target without tripping
-/// `-D dead_code` on non-macOS clippy runs.
-#[allow(dead_code)]
+#[cfg_attr(not(any(test, target_os = "macos")), allow(dead_code))]
 fn find_node_dirs_sync(base: &Path, segments: &[&str]) -> Vec<PathBuf> {
     if !base.is_dir() {
         return Vec::new();
diff --git a/crates/socket-patch-core/src/hosted/engine.rs b/crates/socket-patch-core/src/hosted/engine.rs
index f6e53cd4..bc0afe8a 100644
--- a/crates/socket-patch-core/src/hosted/engine.rs
+++ b/crates/socket-patch-core/src/hosted/engine.rs
@@ -190,7 +190,7 @@ pub fn build_candidates(
             .unwrap_or_default();
         // The yarn-berry cache zip carries the `yarnBerry10c0` checksum the
         // berry rewriter pins (berry verifies the zip, not the tarball).
-        // Merge it in and carry the zip URL (None when not stored yet).
+        // Merge it in; the zip URL itself is never read.
         let berry_zip = reference
             .artifacts
             .iter()
@@ -242,7 +242,6 @@ pub fn build_candidates(
                 token,
                 patch_uuid: sel_uuid.clone(),
                 artifact_url: url,
-                berry_zip_url: berry_zip.and_then(|a| a.url.clone()),
                 registry_override: reference.registry_override.clone(),
                 integrity,
             },
diff --git a/crates/socket-patch-core/src/patch/apply.rs b/crates/socket-patch-core/src/patch/apply.rs
index 699ed494..5b99fc2a 100644
--- a/crates/socket-patch-core/src/patch/apply.rs
+++ b/crates/socket-patch-core/src/patch/apply.rs
@@ -64,8 +64,6 @@ pub enum MismatchPolicy {
 /// Which patch source actually wrote the patched bytes for a file.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum AppliedVia {
-    /// Bytes came from a per-package archive in `.socket/packages/`.
-    Package,
     /// Bytes were produced by applying a bsdiff delta from
     /// `.socket/diffs/<uuid>.tar.gz`.
     Diff,
@@ -77,7 +75,6 @@ impl AppliedVia {
     /// Short lowercase tag, suitable for JSON and human output.
     pub fn as_tag(&self) -> &'static str {
         match self {
-            AppliedVia::Package => "package",
             AppliedVia::Diff => "diff",
             AppliedVia::Blob => "blob",
         }
@@ -87,11 +84,10 @@ impl AppliedVia {
 /// Patch sources the apply pipeline may use to obtain patched bytes.
 ///
 /// `blobs_path` is always required and serves as the universal fallback.
-/// `packages_path` and `diffs_path` are optional opt-ins.
+/// `diffs_path` is an optional opt-in.
 #[derive(Debug, Clone, Copy)]
 pub struct PatchSources<'a> {
     pub blobs_path: &'a Path,
-    pub packages_path: Option<&'a Path>,
     pub diffs_path: Option<&'a Path>,
     /// In-memory blob overlay (`afterHash` → patched bytes), consulted
     /// BEFORE the on-disk blob dir. The vendor flows stage their patch
@@ -108,7 +104,6 @@ impl<'a> PatchSources<'a> {
     pub(crate) fn blobs_only(blobs_path: &'a Path) -> Self {
         Self {
             blobs_path,
-            packages_path: None,
             diffs_path: None,
             mem_blobs: None,
         }
@@ -718,13 +713,12 @@ async fn chown_blocking(
 ///
 /// For each file in `files`, this function:
 /// 1. Verifies the file is ready to be patched (or already patched).
-/// 2. If not dry_run, tries patch sources in order: package archive → diff
-///    archive → per-file blob. Each strategy is opt-in via `sources`.
+/// 2. If not dry_run, tries patch sources in order: diff archive →
+///    per-file blob. The diff strategy is opt-in via `sources`.
 /// 3. Returns a summary of what happened.
 ///
-/// `uuid` is the patch UUID. Pass `Some` to enable package- and
-/// diff-archive lookup (the corresponding `sources.packages_path` /
-/// `sources.diffs_path` must also be set). Pass `None` to restrict the
+/// `uuid` is the patch UUID. Pass `Some` to enable diff-archive lookup
+/// (`sources.diffs_path` must also be set). Pass `None` to restrict the
 /// pipeline to per-file blobs only.
 ///
 /// For npm packages, one on-disk `pkg_path` is not necessarily the only
@@ -912,12 +906,8 @@ async fn apply_package_patch_at(
         return result;
     }
 
-    // Eagerly load the package and diff archives (if any) into memory so
-    // we don't reparse the tar.gz once per file. Both are small archives.
-    let package_entries = match (uuid, sources.packages_path) {
-        (Some(uuid), Some(dir)) => load_archive_if_present(dir, uuid, files).await,
-        _ => None,
-    };
+    // Eagerly load the diff archive (if any) into memory so we don't
+    // reparse the tar.gz once per file.
     let diff_entries = match (uuid, sources.diffs_path) {
         (Some(uuid), Some(dir)) => load_archive_if_present(dir, uuid, files).await,
         _ => None,
@@ -940,10 +930,10 @@ async fn apply_package_patch_at(
         let normalized = normalize_file_path(file_name);
 
         // Resolve the patched bytes from the first applicable source, in
-        // order: package archive → per-file diff → in-memory blob overlay
+        // order: per-file diff → in-memory blob overlay
         // (the vendor flows stage there, so vendoring writes no
-        // `.socket/blobs` entries) → on-disk blob. An archive or diff
-        // candidate is applicable only when it hashes to `afterHash`; a
+        // `.socket/blobs` entries) → on-disk blob. A diff candidate is
+        // applicable only when its product hashes to `afterHash`; a
         // stale or corrupt entry falls through, it is not an error. The
         // blob is the universal fallback: failing to read it fails the
         // file. The diff needs the pre-apply on-disk hash that
@@ -952,10 +942,7 @@ async fn apply_package_patch_at(
         // the diff still bails instead of producing garbage.
         let current_hash = verify_result.and_then(|v| v.current_hash.as_deref());
         let (patched_content, via): (Cow<'_, [u8]>, AppliedVia) = if let Some(bytes) =
-            resolve_from_archive(package_entries.as_ref(), normalized, file_info)
-        {
-            (Cow::Borrowed(bytes), AppliedVia::Package)
-        } else if let Some(bytes) = resolve_from_diff(
+            resolve_from_diff(
             diff_entries.as_ref(),
             normalized,
             pkg_path,
@@ -1043,19 +1030,7 @@ async fn apply_package_patch_at(
     result
 }
 
-/// Strategy 1 — package archive: the entry for `normalized_path`, when it
-/// is present and hashes to `afterHash`. Anything else is "not
-/// applicable" and the caller falls through to the next source.
-fn resolve_from_archive<'e>(
-    package_entries: Option<&'e HashMap<String, Vec<u8>>>,
-    normalized_path: &str,
-    file_info: &PatchFileInfo,
-) -> Option<&'e [u8]> {
-    let bytes = package_entries?.get(normalized_path)?;
-    (compute_git_sha256_from_bytes(bytes) == file_info.after_hash).then_some(bytes.as_slice())
-}
-
-/// Strategy 2 — per-file diff: apply the bsdiff delta for
+/// Strategy 1 — per-file diff: apply the bsdiff delta for
 /// `normalized_path` to the on-disk file and return the product. Not
 /// applicable (`None`) when there is no delta, the entry is a new file
 /// (nothing to diff against), `current_hash` is missing or is not the
@@ -1080,7 +1055,7 @@ async fn resolve_from_diff(
     (compute_git_sha256_from_bytes(&patched) == file_info.after_hash).then_some(patched)
 }
 
-/// Strategy 3 (on-disk half) — read `blobs_path/<hash>` fail-closed.
+/// Strategy 2 (on-disk half) — read `blobs_path/<hash>` fail-closed.
 ///
 /// SECURITY: `hash` comes from a committed `.socket/manifest.json` that the
 /// CI `apply` step applies without user action, so it is validated as a blob
@@ -2134,10 +2109,8 @@ mod tests {
 
     // ── Fallback-chain tests ─────────────────────────────────────────
     //
-    // Tests below exercise the archive strategies:
-    // package archive (.socket/packages/<uuid>.tar.gz) and per-file diff
-    // archive (.socket/diffs/<uuid>.tar.gz), plus the priority order
-    // package → diff → blob.
+    // Tests below exercise the per-file diff archive
+    // (.socket/diffs/<uuid>.tar.gz) and the priority order diff → blob.
 
     use flate2::write::GzEncoder;
     use flate2::Compression as GzCompression;
@@ -2170,14 +2143,13 @@ mod tests {
         delta
     }
 
-    /// Returns a fully-populated three-source fixture: original file on
-    /// disk, all of (package, diff, blob) available with valid patched
-    /// content. Caller can then delete sources to test fallback.
+    /// Returns a fully-populated two-source fixture: original file on
+    /// disk, both (diff, blob) available with valid patched content.
+    /// Caller can then delete sources to test fallback.
     async fn make_fixture() -> (
-        tempfile::TempDir,  // root holding pkg/, blobs/, packages/, diffs/
+        tempfile::TempDir,  // root holding pkg/, blobs/, diffs/
         std::path::PathBuf, // pkg dir
         std::path::PathBuf, // blobs dir
-        std::path::PathBuf, // packages dir
         std::path::PathBuf, // diffs dir
         HashMap<String, PatchFileInfo>,
         Vec<u8>, // original bytes
@@ -2186,11 +2158,9 @@ mod tests {
         let root = tempfile::tempdir().unwrap();
         let pkg_dir = root.path().join("pkg");
         let blobs_dir = root.path().join("blobs");
-        let packages_dir = root.path().join("packages");
         let diffs_dir = root.path().join("diffs");
         tokio::fs::create_dir_all(&pkg_dir).await.unwrap();
         tokio::fs::create_dir_all(&blobs_dir).await.unwrap();
-        tokio::fs::create_dir_all(&packages_dir).await.unwrap();
         tokio::fs::create_dir_all(&diffs_dir).await.unwrap();
 
         let original: Vec<u8> = b"the original content of the file".to_vec();
@@ -2208,9 +2178,6 @@ mod tests {
             .await
             .unwrap();
 
-        // Package archive containing the patched bytes
-        write_uuid_archive(&packages_dir, TEST_UUID, &[("index.js", &patched)]);
-
         // Diff archive containing bsdiff(original -> patched)
         let delta = make_delta(&original, &patched);
         write_uuid_archive(&diffs_dir, TEST_UUID, &[("index.js", &delta)]);
@@ -2228,7 +2195,6 @@ mod tests {
             root,
             pkg_dir,
             blobs_dir,
-            packages_dir,
             diffs_dir,
             files,
             original,
@@ -2237,49 +2203,12 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn test_apply_via_package_when_archive_present() {
-        let (_root, pkg_dir, blobs_dir, packages_dir, diffs_dir, files, _orig, patched) =
-            make_fixture().await;
-
-        let sources = PatchSources {
-            blobs_path: &blobs_dir,
-            packages_path: Some(&packages_dir),
-            diffs_path: Some(&diffs_dir),
-            mem_blobs: None,
-        };
-        let result = apply_package_patch(
-            "pkg:npm/x@1.0.0",
-            &pkg_dir,
-            &files,
-            &sources,
-            Some(TEST_UUID),
-            false,
-            MismatchPolicy::Warn,
-        )
-        .await;
-
-        assert!(result.success, "expected success: {:?}", result.error);
-        assert_eq!(result.files_patched, vec!["index.js".to_string()]);
-        assert_eq!(
-            result.applied_via.get("index.js"),
-            Some(&AppliedVia::Package)
-        );
-        let written = tokio::fs::read(pkg_dir.join("index.js")).await.unwrap();
-        assert_eq!(written, patched);
-    }
-
-    #[tokio::test]
-    async fn test_apply_falls_back_to_diff_when_no_package() {
-        let (_root, pkg_dir, blobs_dir, packages_dir, diffs_dir, files, _orig, patched) =
+    async fn test_apply_via_diff_when_archive_present() {
+        let (_root, pkg_dir, blobs_dir, diffs_dir, files, _orig, patched) =
             make_fixture().await;
-        // Delete the package archive.
-        tokio::fs::remove_file(packages_dir.join(format!("{TEST_UUID}.tar.gz")))
-            .await
-            .unwrap();
 
         let sources = PatchSources {
             blobs_path: &blobs_dir,
-            packages_path: Some(&packages_dir),
             diffs_path: Some(&diffs_dir),
             mem_blobs: None,
         };
@@ -2302,19 +2231,15 @@ mod tests {
 
     #[tokio::test]
     async fn test_apply_falls_back_to_blob_when_no_archives() {
-        let (_root, pkg_dir, blobs_dir, packages_dir, diffs_dir, files, _orig, patched) =
+        let (_root, pkg_dir, blobs_dir, diffs_dir, files, _orig, patched) =
             make_fixture().await;
-        // Delete both archives.
-        tokio::fs::remove_file(packages_dir.join(format!("{TEST_UUID}.tar.gz")))
-            .await
-            .unwrap();
+        // Delete the diff archive.
         tokio::fs::remove_file(diffs_dir.join(format!("{TEST_UUID}.tar.gz")))
             .await
             .unwrap();
 
         let sources = PatchSources {
             blobs_path: &blobs_dir,
-            packages_path: Some(&packages_dir),
             diffs_path: Some(&diffs_dir),
             mem_blobs: None,
         };
@@ -2339,12 +2264,11 @@ mod tests {
     async fn test_apply_uuid_none_disables_alt_sources() {
         // Even if archives exist, passing `uuid = None` must restrict the
         // pipeline to the blob path.
-        let (_root, pkg_dir, blobs_dir, packages_dir, diffs_dir, files, _orig, _patched) =
+        let (_root, pkg_dir, blobs_dir, diffs_dir, files, _orig, _patched) =
             make_fixture().await;
 
         let sources = PatchSources {
             blobs_path: &blobs_dir,
-            packages_path: Some(&packages_dir),
             diffs_path: Some(&diffs_dir),
             mem_blobs: None,
         };
@@ -2368,11 +2292,8 @@ mod tests {
         // Corrupt the on-disk file so its hash no longer matches
         // before_hash. Diff strategy must NOT run (its output would never
         // match after_hash), so we fall through to the blob.
-        let (_root, pkg_dir, blobs_dir, packages_dir, diffs_dir, files, _orig, patched) =
+        let (_root, pkg_dir, blobs_dir, diffs_dir, files, _orig, patched) =
             make_fixture().await;
-        tokio::fs::remove_file(packages_dir.join(format!("{TEST_UUID}.tar.gz")))
-            .await
-            .unwrap();
         // Overwrite on-disk content with garbage; use --force so verify
         // promotes the HashMismatch to Ready and the pipeline still tries
         // to apply.
@@ -2382,7 +2303,6 @@ mod tests {
 
         let sources = PatchSources {
             blobs_path: &blobs_dir,
-            packages_path: Some(&packages_dir),
             diffs_path: Some(&diffs_dir),
             mem_blobs: None,
         };
@@ -2404,57 +2324,15 @@ mod tests {
         assert_eq!(written, patched);
     }
 
-    #[tokio::test]
-    async fn test_apply_via_package_skips_when_hash_mismatches() {
-        // Package archive contains the WRONG bytes (would not hash to
-        // after_hash). The package strategy must refuse the entry and
-        // fall back to diff or blob.
-        let (_root, pkg_dir, blobs_dir, packages_dir, diffs_dir, files, _orig, patched) =
-            make_fixture().await;
-        // Replace the package archive with one whose entry is corrupt.
-        tokio::fs::remove_file(packages_dir.join(format!("{TEST_UUID}.tar.gz")))
-            .await
-            .unwrap();
-        write_uuid_archive(
-            &packages_dir,
-            TEST_UUID,
-            &[("index.js", b"corrupt package payload")],
-        );
-
-        let sources = PatchSources {
-            blobs_path: &blobs_dir,
-            packages_path: Some(&packages_dir),
-            diffs_path: Some(&diffs_dir),
-            mem_blobs: None,
-        };
-        let result = apply_package_patch(
-            "pkg:npm/x@1.0.0",
-            &pkg_dir,
-            &files,
-            &sources,
-            Some(TEST_UUID),
-            false,
-            MismatchPolicy::Warn,
-        )
-        .await;
-
-        assert!(result.success);
-        // Package refused → diff succeeded next.
-        assert_eq!(result.applied_via.get("index.js"), Some(&AppliedVia::Diff));
-        let written = tokio::fs::read(pkg_dir.join("index.js")).await.unwrap();
-        assert_eq!(written, patched);
-    }
-
     #[tokio::test]
     async fn test_apply_dry_run_does_not_touch_alternative_sources() {
-        // Even with package/diff archives present, dry-run must not modify
+        // Even with a diff archive present, dry-run must not modify
         // files on disk.
-        let (_root, pkg_dir, blobs_dir, packages_dir, diffs_dir, files, original, _patched) =
+        let (_root, pkg_dir, blobs_dir, diffs_dir, files, original, _patched) =
             make_fixture().await;
 
         let sources = PatchSources {
             blobs_path: &blobs_dir,
-            packages_path: Some(&packages_dir),
             diffs_path: Some(&diffs_dir),
             mem_blobs: None,
         };
@@ -2666,7 +2544,6 @@ mod tests {
 
     #[test]
     fn test_applied_via_as_tag() {
-        assert_eq!(AppliedVia::Package.as_tag(), "package");
         assert_eq!(AppliedVia::Diff.as_tag(), "diff");
         assert_eq!(AppliedVia::Blob.as_tag(), "blob");
     }
@@ -2675,7 +2552,6 @@ mod tests {
     fn test_patch_sources_blobs_only_disables_other_strategies() {
         let dir = tempfile::tempdir().unwrap();
         let sources = PatchSources::blobs_only(dir.path());
-        assert!(sources.packages_path.is_none());
         assert!(sources.diffs_path.is_none());
     }
 
@@ -3244,17 +3120,13 @@ mod tests {
     /// to the blob strategy and still patch successfully.
     #[tokio::test]
     async fn test_apply_corrupt_diff_falls_through_to_blob() {
-        let (_root, pkg_dir, blobs_dir, packages_dir, diffs_dir, files, _orig, patched) =
+        let (_root, pkg_dir, blobs_dir, diffs_dir, files, _orig, patched) =
             make_fixture().await;
-        // No package archive; diff archive holds garbage delta bytes.
-        tokio::fs::remove_file(packages_dir.join(format!("{TEST_UUID}.tar.gz")))
-            .await
-            .unwrap();
+        // Diff archive holds garbage delta bytes.
         write_uuid_archive(&diffs_dir, TEST_UUID, &[("index.js", b"garbage delta")]);
 
         let sources = PatchSources {
             blobs_path: &blobs_dir,
-            packages_path: Some(&packages_dir),
             diffs_path: Some(&diffs_dir),
             mem_blobs: None,
         };
@@ -3425,18 +3297,21 @@ mod tests {
 
     /// SECURITY: the patch `uuid` is joined as `<dir>/<uuid>.tar.gz`. A
     /// traversal uuid that would resolve to a real archive elsewhere is
-    /// treated as "no archive" (both strategies skipped, blob applies) —
+    /// treated as "no archive" (diff strategy skipped, blob applies) —
     /// never joined.
     #[tokio::test]
     async fn test_apply_unsafe_uuid_skips_archives() {
-        let (_root, pkg_dir, blobs_dir, _packages_dir, diffs_dir, files, _orig, patched) =
+        let (root, pkg_dir, blobs_dir, diffs_dir, files, original, patched) =
             make_fixture().await;
-        // `diffs/../packages/<TEST_UUID>.tar.gz` IS the real package archive.
-        let escaping_uuid = format!("../packages/{TEST_UUID}");
+        // `diffs/../escape/<TEST_UUID>.tar.gz` IS a valid diff archive.
+        let escape_dir = root.path().join("escape");
+        tokio::fs::create_dir_all(&escape_dir).await.unwrap();
+        let delta = make_delta(&original, &patched);
+        write_uuid_archive(&escape_dir, TEST_UUID, &[("index.js", &delta)]);
+        let escaping_uuid = format!("../escape/{TEST_UUID}");
         let sources = PatchSources {
             blobs_path: &blobs_dir,
-            packages_path: Some(&diffs_dir),
-            diffs_path: None,
+            diffs_path: Some(&diffs_dir),
             mem_blobs: None,
         };
         let result = apply_package_patch(
@@ -3454,7 +3329,7 @@ mod tests {
         assert_eq!(
             result.applied_via.get("index.js"),
             Some(&AppliedVia::Blob),
-            "an escaping uuid must not reach the package archive"
+            "an escaping uuid must not reach the escaped diff archive"
         );
         let written = tokio::fs::read(pkg_dir.join("index.js")).await.unwrap();
         assert_eq!(written, patched);
@@ -3468,7 +3343,7 @@ mod tests {
     #[cfg(target_os = "macos")]
     #[tokio::test]
     async fn test_apply_write_failure_is_reported_not_masked_as_missing_blob() {
-        let (_root, pkg_dir, blobs_dir, packages_dir, diffs_dir, files, original, _patched) =
+        let (_root, pkg_dir, blobs_dir, diffs_dir, files, original, _patched) =
             make_fixture().await;
         // Only the archives are staged — no blob to fall back on.
         let after_hash = &files["index.js"].after_hash;
@@ -3485,7 +3360,6 @@ mod tests {
 
         let sources = PatchSources {
             blobs_path: &blobs_dir,
-            packages_path: Some(&packages_dir),
             diffs_path: Some(&diffs_dir),
             mem_blobs: None,
         };
diff --git a/crates/socket-patch-core/src/patch/package.rs b/crates/socket-patch-core/src/patch/package.rs
index fe41c446..68919b08 100644
--- a/crates/socket-patch-core/src/patch/package.rs
+++ b/crates/socket-patch-core/src/patch/package.rs
@@ -1,14 +1,10 @@
-//! Package- and diff-archive tarball helpers.
+//! Patch-archive tarball helpers.
 //!
-//! Both package archives (`.socket/packages/<uuid>.tar.gz`) and diff
-//! archives (`.socket/diffs/<uuid>.tar.gz`) use the same on-disk format:
-//! a gzipped tar containing one entry per patched file. The entry's path
-//! matches the **normalized** relative file path (i.e. without the
-//! `package/` prefix used by the API).
-//!
-//! For package archives, each entry holds the patched file's full bytes.
-//! For diff archives, each entry holds a bsdiff delta that transforms the
-//! corresponding `beforeHash` content into the `afterHash` content.
+//! Diff archives (`.socket/diffs/<uuid>.tar.gz`) are a gzipped tar
+//! containing one entry per patched file. The entry's path matches the
+//! **normalized** relative file path (i.e. without the `package/` prefix
+//! used by the API), and each entry holds a bsdiff delta that transforms
+//! the corresponding `beforeHash` content into the `afterHash` content.
 
 use std::collections::HashMap;
 use std::io::Read;
@@ -35,7 +31,7 @@ const MAX_ENTRY_BYTES: u64 = 16 * 1024 * 1024;
 /// the in-memory `HashMap`.
 const MAX_ENTRIES: usize = 10_000;
 
-/// Errors produced while reading a package/diff archive.
+/// Errors produced while reading a patch archive.
 #[derive(Debug, thiserror::Error)]
 pub enum ArchiveError {
     #[error("archive I/O error: {0}")]
diff --git a/crates/socket-patch-core/src/patch/redirect/bun_binary.rs b/crates/socket-patch-core/src/patch/redirect/bun_binary.rs
index 7f7b1820..7658c547 100644
--- a/crates/socket-patch-core/src/patch/redirect/bun_binary.rs
+++ b/crates/socket-patch-core/src/patch/redirect/bun_binary.rs
@@ -123,7 +123,6 @@ mod tests {
             token: String::new(),
             patch_uuid: version.into(),
             artifact_url: format!("https://patch.example.test/{version}/minimist-{version}.tgz"),
-            berry_zip_url: None,
             registry_override: None,
             integrity: Integrity {
                 sha512: Some(format!(
diff --git a/crates/socket-patch-core/src/patch/redirect/composer_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/composer_equivalence_tests.rs
index 187c3c25..6a326239 100644
--- a/crates/socket-patch-core/src/patch/redirect/composer_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/composer_equivalence_tests.rs
@@ -421,7 +421,6 @@ fn dep(rng: &mut Rng, pool: usize, n: usize) -> DepOverride {
         token: String::new(),
         patch_uuid: format!("00000000-0000-4000-8000-{n:012}"),
         artifact_url: url,
-        berry_zip_url: None,
         registry_override: None,
         integrity: Integrity {
             sha1: (!rng.chance(8)).then(|| {
@@ -522,7 +521,6 @@ fn in_place_composer_rewrite_matches_oracle_on_fixture() {
             token: String::new(),
             patch_uuid: format!("00000000-0000-4000-8000-{n:012}"),
             artifact_url: format!("https://patch.socket.dev/composer/{n}.zip"),
-            berry_zip_url: None,
             registry_override: None,
             integrity: Integrity {
                 sha1: Some("0123456789abcdef0123456789abcdef01234567".into()),
diff --git a/crates/socket-patch-core/src/patch/redirect/golang_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/golang_equivalence_tests.rs
index 7ac73360..d3fe18cf 100644
--- a/crates/socket-patch-core/src/patch/redirect/golang_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/golang_equivalence_tests.rs
@@ -544,7 +544,6 @@ fn dep(rng: &mut Rng, pool: usize, n: usize) -> DepOverride {
         token: String::new(),
         patch_uuid: uuid(n),
         artifact_url: String::new(),
-        berry_zip_url: None,
         registry_override,
         integrity: Integrity {
             dirhash_h1: h1(rng),
@@ -642,7 +641,6 @@ fn single_walk_golang_rewrite_matches_oracle_on_fixtures() {
                 token: String::new(),
                 patch_uuid: uuid(n),
                 artifact_url: String::new(),
-                berry_zip_url: None,
                 registry_override: Some(RegistryOverride {
                     kind: "goproxy".into(),
                     index_url: "https://patch.socket.dev/patch-registry/golang".into(),
diff --git a/crates/socket-patch-core/src/patch/redirect/group_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/group_equivalence_tests.rs
index 65bfdeb8..10fe9d51 100644
--- a/crates/socket-patch-core/src/patch/redirect/group_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/group_equivalence_tests.rs
@@ -297,7 +297,6 @@ fn pypi_dep(name: &str, uuid: &str) -> DepOverride {
         token: String::new(),
         patch_uuid: uuid.into(),
         artifact_url: format!("https://patch.test/{name}-1.0.0-py3-none-any.whl"),
-        berry_zip_url: None,
         registry_override: None,
         integrity: Integrity {
             sha256: Some("a".repeat(64)),
diff --git a/crates/socket-patch-core/src/patch/redirect/lock_index_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/lock_index_equivalence_tests.rs
index e343e9d5..6f6004fc 100644
--- a/crates/socket-patch-core/src/patch/redirect/lock_index_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/lock_index_equivalence_tests.rs
@@ -32,7 +32,6 @@ fn dep(name: &str, version: &str, uuid: usize, rng: &mut Rng) -> DepOverride {
         token: String::new(),
         patch_uuid: format!("00000000-0000-4000-8000-{uuid:012}"),
         artifact_url: format!("https://patch.socket.dev/{tag}/{name}-{version}.tgz"),
-        berry_zip_url: None,
         registry_override: None,
         integrity: Integrity {
             sha512: (!rng.chance(5)).then(|| format!("sha512-P{}==", rng.below(3))),
diff --git a/crates/socket-patch-core/src/patch/redirect/mod.rs b/crates/socket-patch-core/src/patch/redirect/mod.rs
index 4163755d..0738302e 100644
--- a/crates/socket-patch-core/src/patch/redirect/mod.rs
+++ b/crates/socket-patch-core/src/patch/redirect/mod.rs
@@ -167,8 +167,6 @@ pub struct DepOverride {
     pub patch_uuid: String,
     pub artifact_url: String,
     #[serde(default)]
-    pub berry_zip_url: Option<String>,
-    #[serde(default)]
     pub registry_override: Option<RegistryOverride>,
     pub integrity: Integrity,
 }
@@ -6123,7 +6121,6 @@ mod tests {
             token: String::new(),
             patch_uuid: "11111111-1111-4111-8111-111111111111".into(),
             artifact_url: url.into(),
-            berry_zip_url: None,
             registry_override: None,
             integrity: Integrity {
                 sha512: Some(sha512.into()),
@@ -6141,7 +6138,6 @@ mod tests {
             token: String::new(),
             patch_uuid: "11111111-1111-4111-8111-111111111111".into(),
             artifact_url: url.into(),
-            berry_zip_url: None,
             registry_override: None,
             integrity: Integrity {
                 sha256: Some(sha256.into()),
@@ -6292,7 +6288,6 @@ mod tests {
             artifact_url:
                 "https://patch.socket.dev/patch/maven/org.slf4j/slf4j-api/1.7.36/tok/uuid/slf4j-api-1.7.36.jar"
                     .into(),
-            berry_zip_url: None,
             registry_override: Some(RegistryOverride {
                 kind: "maven2".into(),
                 index_url: "https://patch.socket.dev/patch-registry/maven/tok/uuid/maven2".into(),
@@ -6596,7 +6591,6 @@ mod tests {
             token: "tok".into(),
             patch_uuid: "uuid".into(),
             artifact_url: "https://patch.test/newtonsoft.json.13.0.3.nupkg".into(),
-            berry_zip_url: None,
             registry_override: Some(RegistryOverride {
                 kind: "nuget-v3".into(),
                 index_url: "https://patch.test/nuget/index.json".into(),
@@ -8091,7 +8085,6 @@ mod tests {
             token: "tok".into(),
             patch_uuid: CARGO_UUID.into(),
             artifact_url: "https://patch.test/serde-1.0.190.crate".into(),
-            berry_zip_url: None,
             registry_override: Some(RegistryOverride {
                 kind: "cargo-sparse".into(),
                 index_url: cargo_index_url(),
@@ -9839,7 +9832,6 @@ mod tests {
             token: "tok".into(),
             patch_uuid: "uuid".into(),
             artifact_url: format!("https://patch.test/{name}-{version}.gem"),
-            berry_zip_url: None,
             registry_override: Some(RegistryOverride {
                 kind: "rubygems-compact-index".into(),
                 index_url: "https://patch.test/gem/tok/uuid/".into(),
@@ -12073,7 +12065,6 @@ snapshots:
             token: String::new(),
             patch_uuid: "44444444-4444-4444-4444-444444444444".into(),
             artifact_url: COMPOSER_ARTIFACT_URL.into(),
-            berry_zip_url: None,
             registry_override: None,
             integrity: Integrity {
                 sha1: Some(COMPOSER_SHA1.into()),
@@ -13749,7 +13740,6 @@ packages:
                 "https://patch.socket.dev/patch-registry/golang/{}/@v/v1.4.2-socketpatch.1.zip",
                 golang_socket_module()
             ),
-            berry_zip_url: None,
             registry_override: Some(RegistryOverride {
                 kind: "goproxy".into(),
                 index_url: "https://patch.socket.dev/patch-registry/golang".into(),
@@ -16891,7 +16881,6 @@ mod python_lock_warning_tests {
             token: "11111111-1111-4111-8111-111111111111".into(),
             patch_uuid: "22222222-2222-4222-8222-222222222222".into(),
             artifact_url: "https://patch.socket.dev/requests-2.28.1-py3-none-any.whl".into(),
-            berry_zip_url: None,
             registry_override: None,
             integrity: Integrity::default(),
         };
@@ -16933,7 +16922,6 @@ mod python_metadata_pairing_tests {
             token: "11111111-1111-4111-8111-111111111111".into(),
             patch_uuid: "22222222-2222-4222-8222-222222222222".into(),
             artifact_url: "https://patch.socket.dev/click-8.1.7-py3-none-any.whl".into(),
-            berry_zip_url: None,
             registry_override: None,
             integrity: Integrity::default(),
         }
@@ -17035,7 +17023,6 @@ mod hatch_tests {
             token: String::new(),
             patch_uuid: "test-uuid".into(),
             artifact_url: "https://patch.test/urllib3-1.26.18-py2.py3-none-any.whl".into(),
-            berry_zip_url: None,
             registry_override: None,
             integrity: Integrity {
                 sha256: Some("a".repeat(64)),
diff --git a/crates/socket-patch-core/src/patch/redirect/pdm.rs b/crates/socket-patch-core/src/patch/redirect/pdm.rs
index 51cab65d..987a362d 100644
--- a/crates/socket-patch-core/src/patch/redirect/pdm.rs
+++ b/crates/socket-patch-core/src/patch/redirect/pdm.rs
@@ -211,7 +211,7 @@ mod tests {
             patch_uuid: "e828efa5-5c6d-43f3-9909-03f5ac232b98".into(),
             artifact_url: "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl".into(),
             integrity: Integrity { sha256: Some("a".repeat(64)), ..Default::default() },
-            namespace: None, token: "token".into(), berry_zip_url: None, registry_override: None,
+            namespace: None, token: "token".into(), registry_override: None,
         }
     }
 
@@ -330,7 +330,6 @@ mod equivalence_tests {
             token: String::new(),
             patch_uuid: "e828efa5-5c6d-43f3-9909-03f5ac232b98".into(),
             artifact_url: format!("https://patch.socket.dev/patch/pypi/{name}/{url_tail}"),
-            berry_zip_url: None,
             registry_override: None,
             integrity: Integrity {
                 sha256: Some(sha256.into()),
@@ -536,7 +535,6 @@ mod parse_reuse_equivalence_tests {
                             token: String::new(),
                             patch_uuid: format!("00000000-0000-4000-8000-{n:012}"),
                             artifact_url: url,
-                            berry_zip_url: None,
                             registry_override: None,
                             integrity: Integrity {
                                 sha256: Some(sha),
diff --git a/crates/socket-patch-core/src/patch/redirect/pnpm_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/pnpm_equivalence_tests.rs
index 906427f0..d3f54db5 100644
--- a/crates/socket-patch-core/src/patch/redirect/pnpm_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/pnpm_equivalence_tests.rs
@@ -193,7 +193,6 @@ fn dep(p: &Pkg, uuid: usize, url_tag: &str, sha512: Option<&str>) -> DepOverride
             "https://patch.socket.dev/{url_tag}/{}-{}.tgz",
             p.name, p.version
         ),
-        berry_zip_url: None,
         registry_override: None,
         integrity: Integrity {
             sha512: sha512.map(str::to_string),
diff --git a/crates/socket-patch-core/src/patch/redirect/poetry.rs b/crates/socket-patch-core/src/patch/redirect/poetry.rs
index a2798cd6..3bd20f47 100644
--- a/crates/socket-patch-core/src/patch/redirect/poetry.rs
+++ b/crates/socket-patch-core/src/patch/redirect/poetry.rs
@@ -326,7 +326,6 @@ mod equivalence_tests {
             token: String::new(),
             patch_uuid: format!("00000000-0000-4000-8000-{uuid:012}"),
             artifact_url: format!("https://patch.socket.dev/patch/pypi/{name}/{uuid}/{wheel}"),
-            berry_zip_url: None,
             registry_override: None,
             integrity: Integrity {
                 sha256: sha256.map(str::to_string),
diff --git a/crates/socket-patch-core/src/patch/redirect/python_lock_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/python_lock_equivalence_tests.rs
index f783a6a8..d1691c02 100644
--- a/crates/socket-patch-core/src/patch/redirect/python_lock_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/python_lock_equivalence_tests.rs
@@ -490,7 +490,6 @@ fn dep(i: usize, v: &str, uuid: usize, rng: &mut Rng) -> DepOverride {
             "https://patch.socket.dev/patch/{uuid}/pkg-{i}-{v}{ext}{}",
             if rng.chance(10) { "?token=x#frag" } else { "" }
         ),
-        berry_zip_url: None,
         registry_override: None,
         integrity: Integrity {
             sha256: (!rng.chance(5)).then(|| HEX.to_string()),
@@ -625,7 +624,6 @@ fn refusal_in_the_middle_leaves_the_prior_rewrite_intact() {
         token: String::new(),
         patch_uuid: format!("00000000-0000-4000-8000-{n:012}"),
         artifact_url: format!("https://patch.socket.dev/{name}-1.0.0-py3-none-any.whl"),
-        berry_zip_url: None,
         registry_override: None,
         integrity: Integrity {
             sha256: Some(HEX.into()),
diff --git a/crates/socket-patch-core/src/patch/redirect/requirements.rs b/crates/socket-patch-core/src/patch/redirect/requirements.rs
index d6d64c3c..cdbd9eb6 100644
--- a/crates/socket-patch-core/src/patch/redirect/requirements.rs
+++ b/crates/socket-patch-core/src/patch/redirect/requirements.rs
@@ -351,7 +351,6 @@ mod tests {
                 sha256: Some(HASH.into()),
                 ..Default::default()
             },
-            berry_zip_url: None,
             registry_override: None,
         }
     }
diff --git a/crates/socket-patch-core/src/patch/redirect/upstream/bun_lockb.rs b/crates/socket-patch-core/src/patch/redirect/upstream/bun_lockb.rs
index aaf71292..f51142f6 100644
--- a/crates/socket-patch-core/src/patch/redirect/upstream/bun_lockb.rs
+++ b/crates/socket-patch-core/src/patch/redirect/upstream/bun_lockb.rs
@@ -186,7 +186,6 @@ mod tests {
             artifact_url: format!(
                 "https://patch.socket.dev/patch/npm/{TOKEN}/{UUID}/minimist-1.2.2.tgz"
             ),
-            berry_zip_url: None,
             registry_override: None,
             integrity: Integrity {
                 sha512: Some(format!(
diff --git a/crates/socket-patch-core/src/patch/redirect/vlt_preflight.rs b/crates/socket-patch-core/src/patch/redirect/vlt_preflight.rs
index f848197c..1ef1ba1b 100644
--- a/crates/socket-patch-core/src/patch/redirect/vlt_preflight.rs
+++ b/crates/socket-patch-core/src/patch/redirect/vlt_preflight.rs
@@ -461,7 +461,6 @@ mod tests {
             token: String::new(),
             patch_uuid: format!("uuid-{name}"),
             artifact_url: format!("https://patch.socket.dev/patch/npm/t/u/{name}-1.0.0.tgz"),
-            berry_zip_url: None,
             registry_override: None,
             integrity: Integrity {
                 sha512: sha512.map(str::to_string),
diff --git a/crates/socket-patch-core/src/telemetry.rs b/crates/socket-patch-core/src/telemetry.rs
index 752a83eb..d49aaa5c 100644
--- a/crates/socket-patch-core/src/telemetry.rs
+++ b/crates/socket-patch-core/src/telemetry.rs
@@ -5,7 +5,7 @@ use uuid::Uuid;
 
 use crate::constants::USER_AGENT;
 use crate::utils::env_compat::{
-    is_debug_enabled, is_offline_env, proxy_url_from_env, read_env_with_legacy,
+    is_debug_enabled, is_offline_env, proxy_url_from_env,
 };
 use crate::utils::fs::home_dir;
 use crate::vex::time::unix_to_ymdhms;
@@ -118,7 +118,6 @@ struct PatchTelemetryEvent {
 ///
 /// Telemetry is disabled when:
 /// - `SOCKET_TELEMETRY_DISABLED` is `"1"` or `"true"`
-///   (legacy `SOCKET_PATCH_TELEMETRY_DISABLED` still honored with warning)
 /// - `VITEST` is `"true"`. Load-bearing downstream dependency, not a relic:
 ///   socket-cli's vitest integration suite
 ///   (`packages/cli/test/integration/cli/cmd-patch*.test.mts`) spawns this
@@ -133,11 +132,7 @@ struct PatchTelemetryEvent {
 /// is set the CLI dispatcher sets `SOCKET_TELEMETRY_DISABLED=1` for the
 /// duration of the process so this check stays the single source of truth.
 pub fn is_telemetry_disabled() -> bool {
-    let env_value = read_env_with_legacy(
-        "SOCKET_TELEMETRY_DISABLED",
-        "SOCKET_PATCH_TELEMETRY_DISABLED",
-    )
-    .unwrap_or_default();
+    let env_value = std::env::var("SOCKET_TELEMETRY_DISABLED").unwrap_or_default();
     let disabled_via_env = matches!(env_value.as_str(), "1" | "true");
     let vitest = std::env::var("VITEST").unwrap_or_default() == "true";
     disabled_via_env || vitest || is_offline_env()
@@ -1039,7 +1034,6 @@ mod tests {
         let saved: Vec<(&str, Option<String>)> = [
             "SOCKET_PROXY_URL",
             "SOCKET_TELEMETRY_DISABLED",
-            "SOCKET_PATCH_TELEMETRY_DISABLED",
             "SOCKET_OFFLINE",
             "VITEST",
         ]
@@ -1090,22 +1084,19 @@ mod tests {
     }
 
     /// Combined into a single test to avoid env-var races across parallel tests.
-    /// Exercises the `SOCKET_TELEMETRY_DISABLED` name, the legacy
-    /// `SOCKET_PATCH_TELEMETRY_DISABLED` shim, and the airgap gate via
-    /// `SOCKET_OFFLINE`. Serialized: SOCKET_* env is process-global and the
+    /// Exercises the `SOCKET_TELEMETRY_DISABLED` name and the airgap gate
+    /// via `SOCKET_OFFLINE`. Serialized: SOCKET_* env is process-global and the
     /// api/client.rs suite reads `SOCKET_OFFLINE` mid-test.
     #[test]
     #[serial_test::serial]
     fn test_is_telemetry_disabled() {
         // Save originals
         let orig_new = std::env::var("SOCKET_TELEMETRY_DISABLED").ok();
-        let orig_legacy = std::env::var("SOCKET_PATCH_TELEMETRY_DISABLED").ok();
         let orig_vitest = std::env::var("VITEST").ok();
         let orig_offline = std::env::var("SOCKET_OFFLINE").ok();
 
         // Default: not disabled
         std::env::remove_var("SOCKET_TELEMETRY_DISABLED");
-        std::env::remove_var("SOCKET_PATCH_TELEMETRY_DISABLED");
         std::env::remove_var("VITEST");
         std::env::remove_var("SOCKET_OFFLINE");
         assert!(!is_telemetry_disabled());
@@ -1115,13 +1106,6 @@ mod tests {
         assert!(is_telemetry_disabled());
         std::env::remove_var("SOCKET_TELEMETRY_DISABLED");
 
-        // Disabled via legacy var (with deprecation warning)
-        std::env::set_var("SOCKET_PATCH_TELEMETRY_DISABLED", "1");
-        assert!(is_telemetry_disabled());
-        std::env::set_var("SOCKET_PATCH_TELEMETRY_DISABLED", "true");
-        assert!(is_telemetry_disabled());
-        std::env::remove_var("SOCKET_PATCH_TELEMETRY_DISABLED");
-
         // Disabled via airgap: SOCKET_OFFLINE=1 implies "no network",
         // which includes the telemetry endpoint.
         std::env::set_var("SOCKET_OFFLINE", "1");
@@ -1146,10 +1130,6 @@ mod tests {
             Some(v) => std::env::set_var("SOCKET_TELEMETRY_DISABLED", v),
             None => std::env::remove_var("SOCKET_TELEMETRY_DISABLED"),
         }
-        match orig_legacy {
-            Some(v) => std::env::set_var("SOCKET_PATCH_TELEMETRY_DISABLED", v),
-            None => std::env::remove_var("SOCKET_PATCH_TELEMETRY_DISABLED"),
-        }
         match orig_vitest {
             Some(v) => std::env::set_var("VITEST", v),
             None => std::env::remove_var("VITEST"),
diff --git a/crates/socket-patch-core/src/utils/env_compat.rs b/crates/socket-patch-core/src/utils/env_compat.rs
index 3acaae86..56c7879a 100644
--- a/crates/socket-patch-core/src/utils/env_compat.rs
+++ b/crates/socket-patch-core/src/utils/env_compat.rs
@@ -1,83 +1,18 @@
-//! Legacy → new env-var compatibility shim.
-//!
-//! The v3.0 CLI surface migrated three env vars from the `SOCKET_PATCH_*`
-//! prefix to the unified `SOCKET_*` prefix:
-//!
-//! | New                          | Legacy                              |
-//! |------------------------------|-------------------------------------|
-//! | `SOCKET_PROXY_URL`           | `SOCKET_PATCH_PROXY_URL`            |
-//! | `SOCKET_DEBUG`               | `SOCKET_PATCH_DEBUG`                |
-//! | `SOCKET_TELEMETRY_DISABLED`  | `SOCKET_PATCH_TELEMETRY_DISABLED`   |
-//!
-//! `read_env_with_legacy` reads the new name; if absent, it falls back to the
-//! legacy name and prints a one-shot deprecation warning to stderr. The
-//! warning fires **unconditionally** — even under `--silent` / `--json` — so
-//! users see the transition signal in scripts and CI logs. The legacy names
-//! will be removed in a future major release.
+//! Environment-variable readers shared by the CLI and core, plus the
+//! accepted `SOCKET_CLI_*` peer aliases.
 
-use std::collections::HashSet;
-use std::sync::Mutex;
-
-use once_cell::sync::Lazy;
-
-/// Names of legacy env vars that have already warned in this process. Used
-/// so each legacy var warns at most once per invocation, even when read
-/// from multiple call sites.
-static WARNED: Lazy<Mutex<HashSet<&'static str>>> = Lazy::new(|| Mutex::new(HashSet::new()));
-
-/// Read the new-style env var `new_name`. If absent, fall back to
-/// `legacy_name` and print a one-shot deprecation warning to stderr (the
-/// warning fires regardless of CLI verbosity flags so users notice the
-/// transition).
-///
-/// Returns `None` when neither name is set (or both are set to an empty
-/// string, matching the prior call sites' filtering).
-pub(crate) fn read_env_with_legacy(
-    new_name: &'static str,
-    legacy_name: &'static str,
-) -> Option<String> {
-    if let Ok(v) = std::env::var(new_name) {
-        if !v.is_empty() {
-            return Some(v);
-        }
-    }
-    match std::env::var(legacy_name) {
-        Ok(v) if !v.is_empty() => {
-            warn_legacy_once(legacy_name, new_name);
-            Some(v)
-        }
-        _ => None,
-    }
-}
-
-/// Print a one-shot deprecation warning for a legacy name.
-fn warn_legacy_once(legacy_name: &'static str, new_name: &'static str) {
-    let mut warned = match WARNED.lock() {
-        Ok(g) => g,
-        Err(poisoned) => poisoned.into_inner(),
-    };
-    if warned.insert(legacy_name) {
-        eprintln!(
-            "[socket-patch] warning: env var `{legacy_name}` is deprecated; \
-             use `{new_name}` instead. The legacy name will be removed in a \
-             future major release."
-        );
-    }
-}
-
-/// Check if debug mode is enabled via `SOCKET_DEBUG` (with the legacy
-/// `SOCKET_PATCH_DEBUG` shim).
+/// Check if debug mode is enabled via `SOCKET_DEBUG`.
 pub fn is_debug_enabled() -> bool {
     matches!(
-        read_env_with_legacy("SOCKET_DEBUG", "SOCKET_PATCH_DEBUG").as_deref(),
-        Some("1" | "true")
+        std::env::var("SOCKET_DEBUG").unwrap_or_default().as_str(),
+        "1" | "true"
     )
 }
 
-/// Strict-airgap gate: `SOCKET_OFFLINE` is `"1"` or `"true"`. No legacy
-/// name — it lives here as the single definition of the vocabulary shared
-/// by every offline gate (telemetry kill-switch, API-client advisory and
-/// org-slug auto-resolution). The CLI mirrors `--offline` (whose clap-side
+/// Strict-airgap gate: `SOCKET_OFFLINE` is `"1"` or `"true"`. It lives
+/// here as the single definition of the vocabulary shared by every offline
+/// gate (telemetry kill-switch, API-client advisory and org-slug
+/// auto-resolution). The CLI mirrors `--offline` (whose clap-side
 /// bool parse accepts a wider vocabulary) into `SOCKET_OFFLINE=1` before
 /// any of those gates run, so the env read alone is authoritative.
 pub(crate) fn is_offline_env() -> bool {
@@ -87,44 +22,23 @@ pub(crate) fn is_offline_env() -> bool {
     )
 }
 
-/// The public patch-API proxy base URL: `SOCKET_PROXY_URL` (with the legacy
-/// `SOCKET_PATCH_PROXY_URL` shim), defaulting to
+/// The public patch-API proxy base URL: `SOCKET_PROXY_URL`, defaulting to
 /// [`DEFAULT_PATCH_API_PROXY_URL`](crate::constants::DEFAULT_PATCH_API_PROXY_URL).
 pub(crate) fn proxy_url_from_env() -> String {
-    read_env_with_legacy("SOCKET_PROXY_URL", "SOCKET_PATCH_PROXY_URL")
+    std::env::var("SOCKET_PROXY_URL")
+        .ok()
+        .filter(|v| !v.is_empty())
         .unwrap_or_else(|| crate::constants::DEFAULT_PATCH_API_PROXY_URL.to_string())
 }
 
-/// Promote legacy `SOCKET_PATCH_*` env vars to their new `SOCKET_*` names
-/// in-process. When the new name is unset and the legacy name is set, copy
-/// the value over and emit a one-shot deprecation warning to stderr.
-///
-/// Call this *once*, very early in `main`, before clap parses. After
-/// promotion every downstream reader (clap `env =`, core code) only needs
-/// to know the new name.
-///
-/// The warning fires unconditionally — even under `--silent` / `--json`
-/// — so the transition signal isn't swallowed in CI logs.
-pub fn promote_legacy_env_vars() {
-    promote_renames(&[
-        ("SOCKET_PROXY_URL", "SOCKET_PATCH_PROXY_URL"),
-        ("SOCKET_DEBUG", "SOCKET_PATCH_DEBUG"),
-        (
-            "SOCKET_TELEMETRY_DISABLED",
-            "SOCKET_PATCH_TELEMETRY_DISABLED",
-        ),
-    ]);
-}
-
 /// Peer env-var aliases accepted from the sibling JS Socket CLI, so an
 /// environment configured for `socket` (e.g. a CI job exporting
 /// `SOCKET_CLI_API_TOKEN`) works for `socket-patch` unchanged.
 ///
 /// First entry is the canonical `SOCKET_*` name (what clap and core read);
-/// second is the accepted `SOCKET_CLI_*` peer name. Unlike
-/// [`promote_legacy_env_vars`] these are **not** deprecated — promotion is
-/// silent and the canonical name simply wins when both are set. The list is
-/// deliberately tight: `SOCKET_CLI_CONFIG` (ephemeral JSON override),
+/// second is the accepted `SOCKET_CLI_*` peer name. These are **not**
+/// deprecated — promotion is silent and the canonical name simply wins
+/// when both are set. The list is deliberately tight: `SOCKET_CLI_CONFIG` (ephemeral JSON override),
 /// `SOCKET_CLI_API_PROXY` (an HTTP forward proxy — reqwest already honors
 /// `HTTP_PROXY`/`HTTPS_PROXY`), and `SOCKET_CLI_DEBUG` are intentionally
 /// not mirrored.
@@ -137,8 +51,7 @@ pub const PEER_ENV_ALIASES: &[(&str, &str)] = &[
 
 /// Silently copy each set-and-non-empty [`PEER_ENV_ALIASES`] value onto its
 /// canonical `SOCKET_*` name when the canonical name is unset or empty.
-/// Call once, early in `main`, right after [`promote_legacy_env_vars`] and
-/// before the empty-var scrub / clap parse.
+/// Call once, early in `main`, before the empty-var scrub / clap parse.
 pub fn promote_peer_env_vars() {
     promote_aliases(PEER_ENV_ALIASES);
 }
@@ -159,173 +72,12 @@ fn promote_aliases(aliases: &[(&str, &str)]) {
     }
 }
 
-/// Core of [`promote_legacy_env_vars`], parameterized over the rename table so
-/// it can be exercised in tests with isolated env-var names (the real names are
-/// read concurrently by other tests in this binary).
-fn promote_renames(renames: &[(&'static str, &'static str)]) {
-    for &(new_name, legacy_name) in renames {
-        let new_already_set = matches!(std::env::var(new_name).as_deref(), Ok(v) if !v.is_empty());
-        if new_already_set {
-            continue;
-        }
-        // New name is unset/empty, so any value returned here came from the
-        // legacy name (with the one-shot warning already emitted).
-        if let Some(value) = read_env_with_legacy(new_name, legacy_name) {
-            std::env::set_var(new_name, value);
-        }
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
 
-    /// The warning bookkeeping is process-global, so tests must use env-var
-    /// names that no other test touches. `std::env` serializes access behind
-    /// an internal lock, so distinct names never race for memory safety; the
-    /// only hazard is two tests fighting over the *same* name, which unique
-    /// names avoid.
-    #[test]
-    fn warn_legacy_once_fires_only_once_per_name() {
-        let name = "SOCKET_TEST_LEGACY_ONCE_PATCH";
-        let new = "SOCKET_TEST_LEGACY_ONCE";
-        warn_legacy_once(name, new);
-        warn_legacy_once(name, new);
-        // The dedup is driven by `HashSet::insert` returning `false` once the
-        // name has been recorded. Prove that directly: after `warn_legacy_once`
-        // ran, re-inserting the same name must report "already present", which
-        // is exactly what suppresses any second eprintln.
-        let mut warned = WARNED.lock().unwrap();
-        assert!(warned.contains(name));
-        assert!(
-            !warned.insert(name),
-            "name should already be recorded, so a second warning is suppressed"
-        );
-    }
-
-    #[test]
-    fn read_env_prefers_new_var_over_legacy() {
-        const NEW: &str = "SOCKET_TEST_READ_PREFERS_NEW";
-        const LEGACY: &str = "SOCKET_TEST_READ_PREFERS_NEW_PATCH";
-        std::env::set_var(NEW, "new-value");
-        std::env::set_var(LEGACY, "legacy-value");
-        assert_eq!(
-            read_env_with_legacy(NEW, LEGACY),
-            Some("new-value".to_string())
-        );
-        std::env::remove_var(NEW);
-        std::env::remove_var(LEGACY);
-    }
-
-    #[test]
-    fn read_env_falls_back_to_legacy_when_new_unset() {
-        const NEW: &str = "SOCKET_TEST_READ_FALLBACK_NEW";
-        const LEGACY: &str = "SOCKET_TEST_READ_FALLBACK_NEW_PATCH";
-        std::env::remove_var(NEW);
-        std::env::set_var(LEGACY, "legacy-value");
-        assert_eq!(
-            read_env_with_legacy(NEW, LEGACY),
-            Some("legacy-value".to_string())
-        );
-        std::env::remove_var(LEGACY);
-    }
-
-    /// Regression: an empty new var must be treated as "unset" and fall back to
-    /// the legacy name, matching the prior call sites' `!is_empty()` filtering.
-    #[test]
-    fn read_env_empty_new_falls_back_to_legacy() {
-        const NEW: &str = "SOCKET_TEST_READ_EMPTY_NEW";
-        const LEGACY: &str = "SOCKET_TEST_READ_EMPTY_NEW_PATCH";
-        std::env::set_var(NEW, "");
-        std::env::set_var(LEGACY, "legacy-value");
-        assert_eq!(
-            read_env_with_legacy(NEW, LEGACY),
-            Some("legacy-value".to_string())
-        );
-        std::env::remove_var(NEW);
-        std::env::remove_var(LEGACY);
-    }
-
-    #[test]
-    fn read_env_none_when_neither_set() {
-        const NEW: &str = "SOCKET_TEST_READ_NONE_NEW";
-        const LEGACY: &str = "SOCKET_TEST_READ_NONE_NEW_PATCH";
-        std::env::remove_var(NEW);
-        std::env::remove_var(LEGACY);
-        assert_eq!(read_env_with_legacy(NEW, LEGACY), None);
-    }
-
-    /// Regression: both names set but empty → `None` (empty == unset on both
-    /// sides), per the documented contract.
-    #[test]
-    fn read_env_none_when_both_empty() {
-        const NEW: &str = "SOCKET_TEST_READ_BOTH_EMPTY_NEW";
-        const LEGACY: &str = "SOCKET_TEST_READ_BOTH_EMPTY_NEW_PATCH";
-        std::env::set_var(NEW, "");
-        std::env::set_var(LEGACY, "");
-        assert_eq!(read_env_with_legacy(NEW, LEGACY), None);
-        std::env::remove_var(NEW);
-        std::env::remove_var(LEGACY);
-    }
-
-    /// `promote_renames` copies a set legacy value over to the unset new name,
-    /// so downstream readers (clap `env =`, core code) only need the new name.
-    #[test]
-    fn promote_copies_legacy_to_new_when_new_unset() {
-        const NEW: &str = "SOCKET_TEST_PROMOTE_COPY_NEW";
-        const LEGACY: &str = "SOCKET_TEST_PROMOTE_COPY_NEW_PATCH";
-        std::env::remove_var(NEW);
-        std::env::set_var(LEGACY, "legacy-value");
-        promote_renames(&[(NEW, LEGACY)]);
-        assert_eq!(std::env::var(NEW).ok().as_deref(), Some("legacy-value"));
-        std::env::remove_var(NEW);
-        std::env::remove_var(LEGACY);
-    }
-
-    /// A non-empty new value must win: promote must not clobber it with the
-    /// legacy value.
-    #[test]
-    fn promote_does_not_clobber_existing_new() {
-        const NEW: &str = "SOCKET_TEST_PROMOTE_KEEP_NEW";
-        const LEGACY: &str = "SOCKET_TEST_PROMOTE_KEEP_NEW_PATCH";
-        std::env::set_var(NEW, "new-value");
-        std::env::set_var(LEGACY, "legacy-value");
-        promote_renames(&[(NEW, LEGACY)]);
-        assert_eq!(std::env::var(NEW).ok().as_deref(), Some("new-value"));
-        std::env::remove_var(NEW);
-        std::env::remove_var(LEGACY);
-    }
-
-    /// An empty new value counts as unset, so the legacy value is promoted in
-    /// over it — mirroring `read_env_with_legacy`'s empty-is-unset rule.
-    #[test]
-    fn promote_treats_empty_new_as_unset() {
-        const NEW: &str = "SOCKET_TEST_PROMOTE_EMPTY_NEW";
-        const LEGACY: &str = "SOCKET_TEST_PROMOTE_EMPTY_NEW_PATCH";
-        std::env::set_var(NEW, "");
-        std::env::set_var(LEGACY, "legacy-value");
-        promote_renames(&[(NEW, LEGACY)]);
-        assert_eq!(std::env::var(NEW).ok().as_deref(), Some("legacy-value"));
-        std::env::remove_var(NEW);
-        std::env::remove_var(LEGACY);
-    }
-
-    /// An empty legacy value is not promoted (empty == unset on the legacy
-    /// side too), leaving the new name untouched.
-    #[test]
-    fn promote_ignores_empty_legacy() {
-        const NEW: &str = "SOCKET_TEST_PROMOTE_EMPTY_LEGACY_NEW";
-        const LEGACY: &str = "SOCKET_TEST_PROMOTE_EMPTY_LEGACY_NEW_PATCH";
-        std::env::remove_var(NEW);
-        std::env::set_var(LEGACY, "");
-        promote_renames(&[(NEW, LEGACY)]);
-        assert_eq!(std::env::var(NEW).ok(), None);
-        std::env::remove_var(LEGACY);
-    }
-
     /// Peer-alias promotion copies a set alias onto the unset canonical
-    /// name — and, unlike the legacy shim, records **no** deprecation
-    /// warning (peer names are supported, not deprecated).
+    /// name.
     #[test]
     fn peer_alias_promotes_silently_when_canonical_unset() {
         const CANONICAL: &str = "SOCKET_TEST_PEER_PROMOTE";
@@ -334,10 +86,6 @@ mod tests {
         std::env::set_var(ALIAS, "from-alias");
         promote_aliases(&[(CANONICAL, ALIAS)]);
         assert_eq!(std::env::var(CANONICAL).ok().as_deref(), Some("from-alias"));
-        assert!(
-            !WARNED.lock().unwrap().contains(ALIAS),
-            "peer promotion must not register a deprecation warning"
-        );
         std::env::remove_var(CANONICAL);
         std::env::remove_var(ALIAS);
     }
diff --git a/crates/socket-patch-core/src/utils/pdm_lock.rs b/crates/socket-patch-core/src/utils/pdm_lock.rs
index 4dbd1816..dab934e0 100644
--- a/crates/socket-patch-core/src/utils/pdm_lock.rs
+++ b/crates/socket-patch-core/src/utils/pdm_lock.rs
@@ -3,7 +3,7 @@ use toml_edit::DocumentMut;
 use toml_edit::{value, Array, InlineTable, Item, Table, Value};
 
 use crate::crawlers::python_crawler::canonicalize_pypi_name;
-use crate::utils::python_lock::preserve_line_endings;
+use crate::utils::python_lock::{is_prior_hosted_url, preserve_line_endings};
 
 pub fn lock_version(lock: &Table) -> Result<&str, String> {
     let version = lock
@@ -120,32 +120,6 @@ pub fn wheel_matches(filename: &str, name: &str, version: &str) -> bool {
         && parts[1] == version
 }
 
-/// Whether `existing` is an earlier hosted redirect of the SAME artifact:
-/// same origin (`scheme://host[:port]`) and same trailing wheel filename as the
-/// current artifact URL, fragments ignored. Grant tokens and patch uuids live
-/// in the path between them, so a rotated token or a superseded patch (new
-/// uuid) takes over the stale pin in place instead of being refused as a
-/// foreign source (the poetry / bun rewriters make the same call).
-fn is_prior_hosted_url(existing: &str, current: &str) -> bool {
-    fn origin_and_leaf(url: &str) -> Option<(&str, &str)> {
-        if !url.starts_with("https://") && !url.starts_with("http://") {
-            return None;
-        }
-        let url = url.split('#').next()?;
-        let scheme_end = url.find("://")? + 3;
-        let path_start = url[scheme_end..].find('/')? + scheme_end;
-        let leaf = url[path_start..]
-            .rsplit('/')
-            .next()
-            .filter(|leaf| !leaf.is_empty())?;
-        Some((&url[..path_start], leaf))
-    }
-    match (origin_and_leaf(existing), origin_and_leaf(current)) {
-        (Some(old), Some(new)) => old == new,
-        _ => false,
-    }
-}
-
 pub fn rewrite_pdm_lock(
     text: &str,
     name: &str,
diff --git a/crates/socket-patch-core/src/utils/poetry_lock.rs b/crates/socket-patch-core/src/utils/poetry_lock.rs
index a59f79a6..6d1b76d1 100644
--- a/crates/socket-patch-core/src/utils/poetry_lock.rs
+++ b/crates/socket-patch-core/src/utils/poetry_lock.rs
@@ -15,7 +15,7 @@
 use toml_edit::{value, Array, DocumentMut, InlineTable, Item, Table, TableLike, Value};
 
 use crate::crawlers::python_crawler::canonicalize_pypi_name;
-use crate::utils::python_lock::table_likes;
+use crate::utils::python_lock::{is_prior_hosted_url, table_likes};
 
 /// The `{file, hash}` tables Poetry records in `package`'s own
 /// `files = [...]` (lock 2.x; also written into 1.0/1.1 locks). Read by the
@@ -162,32 +162,6 @@ pub fn generated_by_version(lock_text: &str) -> Option<(u64, u64)> {
     Some((major, minor))
 }
 
-/// Whether `existing` is an earlier hosted redirect of the SAME artifact:
-/// same origin (`scheme://host[:port]`) and same trailing filename as the
-/// current artifact URL, fragments ignored. Grant tokens and patch uuids live
-/// in the path between them, so a rotated token or a republished patch is
-/// superseded in place instead of stranding the pin on a URL that no longer
-/// serves (the bun / requirements / cargo rewriters make the same call).
-fn is_prior_hosted_url(existing: &str, current: &str) -> bool {
-    fn origin_and_leaf(url: &str) -> Option<(&str, &str)> {
-        if !url.starts_with("https://") && !url.starts_with("http://") {
-            return None;
-        }
-        let url = url.split('#').next()?;
-        let scheme_end = url.find("://")? + 3;
-        let path_start = url[scheme_end..].find('/')? + scheme_end;
-        let leaf = url[path_start..]
-            .rsplit('/')
-            .next()
-            .filter(|leaf| !leaf.is_empty())?;
-        Some((&url[..path_start], leaf))
-    }
-    match (origin_and_leaf(existing), origin_and_leaf(current)) {
-        (Some(old), Some(new)) => old == new,
-        _ => false,
-    }
-}
-
 /// Rewrite the `[[package]]` for `name`@`version` to install the wheel at
 /// `source_url` (`source_type` `"url"` for hosted, `"file"` for vendored),
 /// pinning `sha256`. Returns `Ok(None)` when the lock has no such entry (or
diff --git a/crates/socket-patch-core/src/utils/python_lock.rs b/crates/socket-patch-core/src/utils/python_lock.rs
index 37ff911d..feebdd25 100644
--- a/crates/socket-patch-core/src/utils/python_lock.rs
+++ b/crates/socket-patch-core/src/utils/python_lock.rs
@@ -243,6 +243,32 @@ pub fn preserve_line_endings(original: &str, rendered: String) -> String {
     output
 }
 
+/// Whether `existing` is an earlier hosted redirect of the SAME artifact:
+/// same origin (`scheme://host[:port]`) and same trailing filename as the
+/// current artifact URL, fragments ignored. Grant tokens and patch uuids live
+/// in the path between them, so a rotated token or a superseded patch (new
+/// uuid) takes over the stale pin in place instead of being refused as a
+/// foreign source or stranding it on a URL that no longer serves.
+pub(crate) fn is_prior_hosted_url(existing: &str, current: &str) -> bool {
+    fn origin_and_leaf(url: &str) -> Option<(&str, &str)> {
+        if !url.starts_with("https://") && !url.starts_with("http://") {
+            return None;
+        }
+        let url = url.split('#').next()?;
+        let scheme_end = url.find("://")? + 3;
+        let path_start = url[scheme_end..].find('/')? + scheme_end;
+        let leaf = url[path_start..]
+            .rsplit('/')
+            .next()
+            .filter(|leaf| !leaf.is_empty())?;
+        Some((&url[..path_start], leaf))
+    }
+    match (origin_and_leaf(existing), origin_and_leaf(current)) {
+        (Some(old), Some(new)) => old == new,
+        _ => false,
+    }
+}
+
 fn inline(entries: &[(&str, Value)]) -> Value {
     let mut table = InlineTable::new();
     for (key, value) in entries {
diff --git a/crates/socket-patch-core/src/vendor/bun_lock.rs b/crates/socket-patch-core/src/vendor/bun_lock.rs
index 161d7b22..20fb60dc 100644
--- a/crates/socket-patch-core/src/vendor/bun_lock.rs
+++ b/crates/socket-patch-core/src/vendor/bun_lock.rs
@@ -81,18 +81,6 @@ pub async fn cleanup_binary_workspace_artifacts(
     super::bun_workspace::cleanup(project_root, entry, dry_run).await
 }
 
-/// Snapshot member copies before a repair whose rebuilt bytes need checking
-/// against the original lockfile integrity. `None` records a missing file.
-pub type BinaryWorkspaceArtifactSnapshot = Vec<(std::path::PathBuf, Option<Vec<u8>>)>;
-
-/// Read the validated workspace artifacts, recording missing copies as well.
-pub fn snapshot_binary_workspace_artifacts(
-    project_root: &Path,
-    entry: &VendorEntry,
-) -> Result<BinaryWorkspaceArtifactSnapshot, String> {
-    super::bun_workspace::snapshot(project_root, entry)
-}
-
 /// The `WiringRecord.kind` this backend owns: key = the `packages` map key,
 /// original/new = the verbatim entry LINE.
 const KIND_LOCK_PACKAGE: &str = "bun_lock_package";
diff --git a/crates/socket-patch-core/src/vendor/bun_workspace.rs b/crates/socket-patch-core/src/vendor/bun_workspace.rs
index c8f66bf2..79f5a06f 100644
--- a/crates/socket-patch-core/src/vendor/bun_workspace.rs
+++ b/crates/socket-patch-core/src/vendor/bun_workspace.rs
@@ -139,25 +139,6 @@ pub(super) async fn repair(
     Ok((wiring, !updates.is_empty()))
 }
 
-/// Preserve both existing and missing member copies before a rebuild whose
-/// source still has to be checked against the lockfile's trust anchor.
-pub(super) fn snapshot(
-    root: &Path,
-    entry: &VendorEntry,
-) -> Result<super::bun_lock::BinaryWorkspaceArtifactSnapshot, String> {
-    required_mirrors(root, entry)?
-        .into_iter()
-        .map(|(_, rel, path)| {
-            let before = match read_regular_to_bytes_sync(&path) {
-                Ok(bytes) => Some(bytes),
-                Err(e) if e.kind() == std::io::ErrorKind::NotFound => None,
-                Err(e) => return Err(format!("cannot snapshot workspace tarball {rel}: {e}")),
-            };
-            Ok((path, before))
-        })
-        .collect()
-}
-
 /// Remove superseded mirrors only when every recorded artifact remains ours.
 /// Validate the entire set before removing any file.
 pub(super) async fn cleanup(root: &Path, entry: &VendorEntry, dry_run: bool) -> Result<(), String> {
diff --git a/crates/socket-patch-core/src/vendor/cargo.rs b/crates/socket-patch-core/src/vendor/cargo.rs
index 78308656..2e728264 100644
--- a/crates/socket-patch-core/src/vendor/cargo.rs
+++ b/crates/socket-patch-core/src/vendor/cargo.rs
@@ -46,7 +46,9 @@ use super::common::{
 use super::parse_memo::ParseMemo;
 use super::path::vendor_uuid_dir_rel;
 use super::registry_fetch::{extract_on_blocking_pool, extract_tgz};
-use super::service_fetch::{claim_prestaged, fetch_verified_archive, ServiceArtifact};
+use super::service_fetch::{
+    claim_prestaged, fetch_verified_archive, ServiceAttempt, ServicePolicy, ServiceTerminal,
+};
 use super::source::PackageSource;
 use super::state::{
     write_marker_or_warn, CargoLockOriginal, VendorArtifact, VendorEntry, VendorMarker,
@@ -319,15 +321,9 @@ async fn cleanup_failed_stage(stage: &Path, uuid_dir: &Path, unwind_uuid_dir: bo
     prune_empty_vendor_levels(uuid_dir).await;
 }
 
-/// Outcome of attempting to materialise the cargo copy from the patch service.
-enum CargoServiceCopy {
-    /// The prebuilt crate was extracted into `copy_dir`.
-    Used,
-    /// Bubble this terminal outcome (boxed — `VendorOutcome` is large).
-    HardFail(Box<VendorOutcome>),
-    /// Fall back to copying + patching the pristine source.
-    FallBack,
-}
+/// Outcome of attempting to materialise the cargo copy from the patch service
+/// (`Used`: the prebuilt crate was extracted into `copy_dir`).
+type CargoServiceCopy = ServiceAttempt<()>;
 
 /// Download the prebuilt `.crate`, integrity-verify it, and extract it into
 /// `copy_dir` (a path-dep copy must carry no `.cargo-checksum.json`). Maps each
@@ -349,125 +345,83 @@ async fn cargo_service_copy(
     if !cfg.service_enabled() {
         return CargoServiceCopy::FallBack;
     }
-    fn hard(code: &'static str, detail: String) -> CargoServiceCopy {
-        CargoServiceCopy::HardFail(Box::new(refused(code, detail)))
-    }
-    let miss = |warnings: &mut Vec<VendorWarning>, code: &'static str, reason: String| {
-        if cfg.source.requires_service() {
-            hard("vendor_prebuilt_required", reason)
-        } else {
-            warnings.push(VendorWarning::new(
-                code,
-                format!("{reason}; building locally instead"),
-            ));
-            CargoServiceCopy::FallBack
-        }
+    let policy = ServicePolicy::new(cfg, ServiceTerminal::Refused);
+    let fetched = fetch_verified_archive(cfg, &record.uuid).await;
+    let subject = format!("crate for {name}");
+    let mut archive = match policy.settle(fetched, "crate", &subject, warnings) {
+        Ok(archive) => archive,
+        Err(attempt) => return attempt,
     };
-    match fetch_verified_archive(cfg, &record.uuid).await {
-        ServiceArtifact::Ready(mut archive) => {
-            // Extract the `.crate` (tar.gz; strip its single
-            // `{name}-{version}/` top-level dir) into a STAGE sibling and
-            // swap it into the copy dir only once fully verified — a failure
-            // then leaves any pre-existing copy untouched and no husk behind.
-            let stage = stage_dir_for(copy_dir);
-            // A tree the download plan already extracted from these bytes
-            // (see `prestage`) is moved into the stage instead; otherwise —
-            // or should the move fail — extract here, as always.
-            if !claim_prestaged(&mut archive, &stage, copy_dir).await {
-                let _ = remove_tree(&stage).await;
-                if let Err(e) = tokio::fs::create_dir_all(&stage).await {
-                    cleanup_failed_stage(&stage, uuid_dir, false).await;
-                    return hard(
-                        "vendor_prebuilt_write_failed",
-                        format!("cannot create {}: {e}", stage.display()),
-                    );
-                }
-                let crate_bytes = std::mem::take(&mut archive.bytes);
-                if let Err(e) = extract_on_blocking_pool(crate_bytes, &stage, extract_tgz).await {
-                    cleanup_failed_stage(&stage, uuid_dir, false).await;
-                    return hard(
-                        "vendor_prebuilt_extract_failed",
-                        format!("cannot extract the prebuilt crate: {e}"),
-                    );
-                }
-            }
-            let _ = tokio::fs::remove_file(stage.join(".cargo-checksum.json")).await;
-            // Verify the EXTRACTED TREE, not just the archive bytes: the SRI
-            // proves the download is intact, but an unexpected internal
-            // layout (the single `{name}-{version}/` strip leaving an extra
-            // wrapper, or an over-strip) lands the patched files at the wrong
-            // paths and the caller would synthesize success from
-            // `record.files` while the copy is wrong. Fail closed → `auto`
-            // falls back to the local build. (Mirrors composer_lock.rs.)
-            if !copy_matches_after_hashes(&stage, &record.files).await {
-                cleanup_failed_stage(&stage, uuid_dir, false).await;
-                return miss(
-                    warnings,
-                    "vendor_prebuilt_layout_mismatch",
-                    format!(
-                        "prebuilt crate for {name} extracted to an unexpected \
-                         layout (patched files absent at their recorded paths)"
-                    ),
-                );
-            }
-            // The copy's version carries the patch uuid tag, written in the
-            // stage so a swapped-in copy is never untagged.
-            if let Err(e) = cargo_tag::tag_copy_manifest(&stage, version, &record.uuid).await {
-                cleanup_failed_stage(&stage, uuid_dir, false).await;
-                return miss(
-                    warnings,
-                    "vendor_prebuilt_layout_mismatch",
-                    format!("prebuilt crate for {name}: cannot tag its version ({e})"),
-                );
-            }
-            if let Err(e) = swap_stage_into_place(&stage, copy_dir).await {
-                cleanup_failed_stage(&stage, uuid_dir, false).await;
-                return hard(
-                    "vendor_prebuilt_write_failed",
-                    format!("cannot move the extracted crate into place: {e}"),
-                );
-            }
-            warnings.push(VendorWarning::new(
-                "vendor_prebuilt_downloaded",
-                format!(
-                    "vendored {name} from the patch service ({})",
-                    archive.source_url
-                ),
-            ));
-            CargoServiceCopy::Used
+    // Extract the `.crate` (tar.gz; strip its single `{name}-{version}/`
+    // top-level dir) into a STAGE sibling and swap it into the copy dir only
+    // once fully verified — a failure then leaves any pre-existing copy
+    // untouched and no husk behind.
+    let stage = stage_dir_for(copy_dir);
+    // A tree the download plan already extracted from these bytes (see
+    // `prestage`) is moved into the stage instead; otherwise — or should the
+    // move fail — extract here, as always.
+    if !claim_prestaged(&mut archive, &stage, copy_dir).await {
+        let _ = remove_tree(&stage).await;
+        if let Err(e) = tokio::fs::create_dir_all(&stage).await {
+            cleanup_failed_stage(&stage, uuid_dir, false).await;
+            return policy.hard(
+                "vendor_prebuilt_write_failed",
+                format!("cannot create {}: {e}", stage.display()),
+            );
         }
-        // Bytes that fail integrity verification are an active tamper signal:
-        // ALWAYS a hard error, in `auto` exactly as in `service` — never a
-        // quiet local-build fallback (`ServiceArtifact`'s documented
-        // contract; nothing was extracted, so there is nothing to clean up).
-        ServiceArtifact::IntegrityMismatch(reason) => hard(
-            "vendor_prebuilt_integrity_mismatch",
+        let crate_bytes = std::mem::take(&mut archive.bytes);
+        if let Err(e) = extract_on_blocking_pool(crate_bytes, &stage, extract_tgz).await {
+            cleanup_failed_stage(&stage, uuid_dir, false).await;
+            return policy.hard(
+                "vendor_prebuilt_extract_failed",
+                format!("cannot extract the prebuilt crate: {e}"),
+            );
+        }
+    }
+    let _ = tokio::fs::remove_file(stage.join(".cargo-checksum.json")).await;
+    // Verify the EXTRACTED TREE, not just the archive bytes: the SRI proves
+    // the download is intact, but an unexpected internal layout (the single
+    // `{name}-{version}/` strip leaving an extra wrapper, or an over-strip)
+    // lands the patched files at the wrong paths and the caller would
+    // synthesize success from `record.files` while the copy is wrong. Fail
+    // closed → `auto` falls back to the local build. (Mirrors
+    // composer_lock.rs.)
+    if !copy_matches_after_hashes(&stage, &record.files).await {
+        cleanup_failed_stage(&stage, uuid_dir, false).await;
+        return policy.miss(
+            warnings,
+            "vendor_prebuilt_layout_mismatch",
             format!(
-                "prebuilt crate for {name} failed integrity verification ({reason}); \
-                 refusing to fall back to a local build on tampered bytes"
+                "prebuilt crate for {name} extracted to an unexpected \
+                 layout (patched files absent at their recorded paths)"
             ),
-        ),
-        ServiceArtifact::Pending => miss(
-            warnings,
-            "vendor_prebuilt_pending",
-            "prebuilt crate is still building".to_string(),
-        ),
-        ServiceArtifact::Unavailable(reason) => {
-            if cfg.source.requires_service() {
-                hard(
-                    "vendor_prebuilt_required",
-                    format!("prebuilt crate unavailable: {reason}"),
-                )
-            } else {
-                CargoServiceCopy::FallBack
-            }
-        }
-        ServiceArtifact::Failed(reason) => miss(
+        );
+    }
+    // The copy's version carries the patch uuid tag, written in the stage so
+    // a swapped-in copy is never untagged.
+    if let Err(e) = cargo_tag::tag_copy_manifest(&stage, version, &record.uuid).await {
+        cleanup_failed_stage(&stage, uuid_dir, false).await;
+        return policy.miss(
             warnings,
-            "vendor_prebuilt_unavailable",
-            format!("patch service request failed ({reason})"),
-        ),
+            "vendor_prebuilt_layout_mismatch",
+            format!("prebuilt crate for {name}: cannot tag its version ({e})"),
+        );
     }
+    if let Err(e) = swap_stage_into_place(&stage, copy_dir).await {
+        cleanup_failed_stage(&stage, uuid_dir, false).await;
+        return policy.hard(
+            "vendor_prebuilt_write_failed",
+            format!("cannot move the extracted crate into place: {e}"),
+        );
+    }
+    warnings.push(VendorWarning::new(
+        "vendor_prebuilt_downloaded",
+        format!(
+            "vendored {name} from the patch service ({})",
+            archive.source_url
+        ),
+    ));
+    CargoServiceCopy::Used(())
 }
 
 /// Copy the pristine source into a STAGE sibling of `copy_dir`, run the
@@ -1049,7 +1003,9 @@ pub async fn vendor_cargo_crate<'a>(
             )
             .await
             {
-                CargoServiceCopy::Used => already_patched_result(purl, &copy_dir, &record.files),
+                CargoServiceCopy::Used(()) => {
+                    already_patched_result(purl, &copy_dir, &record.files)
+                }
                 CargoServiceCopy::HardFail(outcome) => return *outcome,
                 CargoServiceCopy::FallBack => {
                     match copy_and_patch(
@@ -1195,7 +1151,7 @@ pub async fn vendor_cargo_crate<'a>(
     )
     .await
     {
-        CargoServiceCopy::Used => {
+        CargoServiceCopy::Used(()) => {
             // The service crate is the patched package; trust its verified
             // integrity (every file reads as AlreadyPatched).
             already_patched_result(purl, &copy_dir, &record.files)
diff --git a/crates/socket-patch-core/src/vendor/composer_lock.rs b/crates/socket-patch-core/src/vendor/composer_lock.rs
index 58a575dd..7a1cd1e2 100644
--- a/crates/socket-patch-core/src/vendor/composer_lock.rs
+++ b/crates/socket-patch-core/src/vendor/composer_lock.rs
@@ -54,7 +54,9 @@ use crate::formats::composer::{composer_lock_packages, ComposerLockPackage};
 use super::parse_memo::ParseMemo;
 use super::path::{parse_vendor_path, vendor_uuid_dir_rel};
 use super::registry_fetch::{extract_on_blocking_pool, extract_zip};
-use super::service_fetch::{claim_prestaged, fetch_verified_archive, ServiceArtifact};
+use super::service_fetch::{
+    claim_prestaged, fetch_verified_archive, ServiceAttempt, ServicePolicy, ServiceTerminal,
+};
 use super::source::PackageSource;
 use super::state::{
     write_marker_or_warn, VendorArtifact, VendorEntry, VendorMarker, WiringAction, WiringRecord,
@@ -306,7 +308,9 @@ pub async fn vendor_composer<'a>(
             )
             .await
             {
-                ComposerServiceCopy::Used => already_patched_result(purl, &copy_dir, &record.files),
+                ComposerServiceCopy::Used(()) => {
+                    already_patched_result(purl, &copy_dir, &record.files)
+                }
                 ComposerServiceCopy::HardFail(outcome) => return *outcome,
                 ComposerServiceCopy::FallBack => {
                     match copy_and_patch(
@@ -390,7 +394,7 @@ pub async fn vendor_composer<'a>(
         match composer_service_copy(service, record, &pkg, &copy_dir, &uuid_dir, &mut warnings)
             .await
         {
-            ComposerServiceCopy::Used => already_patched_result(purl, &copy_dir, &record.files),
+            ComposerServiceCopy::Used(()) => already_patched_result(purl, &copy_dir, &record.files),
             ComposerServiceCopy::HardFail(outcome) => return *outcome,
             ComposerServiceCopy::FallBack => {
                 match copy_and_patch(
@@ -746,15 +750,9 @@ async fn copy_and_patch(
     Ok(result)
 }
 
-/// Outcome of attempting to materialise the composer copy from the patch service.
-enum ComposerServiceCopy {
-    /// The prebuilt dist zip was extracted into `copy_dir`.
-    Used,
-    /// Bubble this terminal outcome (boxed — `VendorOutcome` is large).
-    HardFail(Box<VendorOutcome>),
-    /// Fall back to copying + patching the installed package.
-    FallBack,
-}
+/// Outcome of attempting to materialise the composer copy from the patch
+/// service (`Used`: the prebuilt dist zip was extracted into `copy_dir`).
+type ComposerServiceCopy = ServiceAttempt<()>;
 
 /// Download the prebuilt dist zip, integrity-verify it, and extract it into
 /// `copy_dir` (dropping the zip's variable top-level dir). Maps each service
@@ -774,120 +772,78 @@ async fn composer_service_copy(
     if !cfg.service_enabled() {
         return ComposerServiceCopy::FallBack;
     }
-    fn hard(code: &'static str, detail: String) -> ComposerServiceCopy {
-        ComposerServiceCopy::HardFail(Box::new(refused(code, detail)))
-    }
-    let miss = |warnings: &mut Vec<VendorWarning>, code: &'static str, reason: String| {
-        if cfg.source.requires_service() {
-            hard("vendor_prebuilt_required", reason)
-        } else {
-            warnings.push(VendorWarning::new(
-                code,
-                format!("{reason}; building locally instead"),
-            ));
-            ComposerServiceCopy::FallBack
-        }
+    let policy = ServicePolicy::new(cfg, ServiceTerminal::Refused);
+    let fetched = fetch_verified_archive(cfg, &record.uuid).await;
+    let subject = format!("dist zip for {pkg}");
+    let mut archive = match policy.settle(fetched, "dist zip", &subject, warnings) {
+        Ok(archive) => archive,
+        Err(attempt) => return attempt,
     };
-    match fetch_verified_archive(cfg, &record.uuid).await {
-        ServiceArtifact::Ready(mut archive) => {
-            // Extract into a STAGE sibling and swap it into the copy dir only
-            // once fully verified — a failure then leaves any pre-existing
-            // (possibly live-wired) copy and its marker untouched and no husk
-            // behind.
-            let stage = stage_dir_for(copy_dir);
-            // A tree the download plan already extracted from these bytes
-            // (see `prestage`) is moved into the stage instead; otherwise —
-            // or should the move fail — extract here.
-            if !claim_prestaged(&mut archive, &stage, copy_dir).await {
-                let _ = remove_tree(&stage).await;
-                if let Err(e) = tokio::fs::create_dir_all(&stage).await {
-                    cleanup_failed_stage(&stage, uuid_dir, false).await;
-                    return hard(
-                        "vendor_prebuilt_write_failed",
-                        format!("cannot create {}: {e}", stage.display()),
-                    );
-                }
-                // composer dist zips carry a single variable top-level dir.
-                let zip_bytes = std::mem::take(&mut archive.bytes);
-                if let Err(e) = extract_on_blocking_pool(zip_bytes, &stage, extract_dist_zip).await
-                {
-                    cleanup_failed_stage(&stage, uuid_dir, false).await;
-                    return hard(
-                        "vendor_prebuilt_extract_failed",
-                        format!("cannot extract the prebuilt dist zip: {e}"),
-                    );
-                }
-            }
-            // Verify the EXTRACTED TREE, not just the archive bytes. The
-            // archive-bytes SRI (checked in fetch_verified_archive) proves
-            // the download is intact, but says nothing about whether the
-            // internal layout lands the patched files at the paths the
-            // record names: a zip with an unexpected wrapper dir (the
-            // single-level `strip_first` leaves an extra `pkg-<sha>/`
-            // segment) or a root-level `src/…` (over-stripped) extracts
-            // "successfully" with every file at the WRONG path, and the
-            // caller would ship a copy missing its patched files. Fail
-            // closed here and let the `auto` source fall back to the local
-            // build.
-            if !copy_matches_after_hashes(&stage, &record.files).await {
-                cleanup_failed_stage(&stage, uuid_dir, false).await;
-                return miss(
-                    warnings,
-                    "vendor_prebuilt_layout_mismatch",
-                    format!(
-                        "prebuilt dist zip for {pkg} extracted to an \
-                         unexpected layout (patched files absent at their \
-                         recorded paths)"
-                    ),
-                );
-            }
-            if let Err(e) = swap_stage_into_place(&stage, copy_dir).await {
-                cleanup_failed_stage(&stage, uuid_dir, false).await;
-                return hard(
-                    "vendor_prebuilt_write_failed",
-                    format!("cannot move the extracted dist into place: {e}"),
-                );
-            }
-            warnings.push(VendorWarning::new(
-                "vendor_prebuilt_downloaded",
-                format!(
-                    "vendored {pkg} from the patch service ({})",
-                    archive.source_url
-                ),
-            ));
-            ComposerServiceCopy::Used
+    // Extract into a STAGE sibling and swap it into the copy dir only
+    // once fully verified — a failure then leaves any pre-existing
+    // (possibly live-wired) copy and its marker untouched and no husk
+    // behind.
+    let stage = stage_dir_for(copy_dir);
+    // A tree the download plan already extracted from these bytes
+    // (see `prestage`) is moved into the stage instead; otherwise —
+    // or should the move fail — extract here.
+    if !claim_prestaged(&mut archive, &stage, copy_dir).await {
+        let _ = remove_tree(&stage).await;
+        if let Err(e) = tokio::fs::create_dir_all(&stage).await {
+            cleanup_failed_stage(&stage, uuid_dir, false).await;
+            return policy.hard(
+                "vendor_prebuilt_write_failed",
+                format!("cannot create {}: {e}", stage.display()),
+            );
         }
-        // Bytes that fail integrity verification are an active tamper signal:
-        // ALWAYS a hard error, in `auto` exactly as in `service` — never a
-        // quiet local-build fallback (`ServiceArtifact`'s documented contract).
-        ServiceArtifact::IntegrityMismatch(reason) => hard(
-            "vendor_prebuilt_integrity_mismatch",
-            format!(
-                "prebuilt dist zip for {pkg} failed integrity verification ({reason}); \
-                 refusing to fall back to a local build on tampered bytes"
-            ),
-        ),
-        ServiceArtifact::Pending => miss(
-            warnings,
-            "vendor_prebuilt_pending",
-            "prebuilt dist zip is still building".to_string(),
-        ),
-        ServiceArtifact::Unavailable(reason) => {
-            if cfg.source.requires_service() {
-                hard(
-                    "vendor_prebuilt_required",
-                    format!("prebuilt dist zip unavailable: {reason}"),
-                )
-            } else {
-                ComposerServiceCopy::FallBack
-            }
+        // composer dist zips carry a single variable top-level dir.
+        let zip_bytes = std::mem::take(&mut archive.bytes);
+        if let Err(e) = extract_on_blocking_pool(zip_bytes, &stage, extract_dist_zip).await {
+            cleanup_failed_stage(&stage, uuid_dir, false).await;
+            return policy.hard(
+                "vendor_prebuilt_extract_failed",
+                format!("cannot extract the prebuilt dist zip: {e}"),
+            );
         }
-        ServiceArtifact::Failed(reason) => miss(
+    }
+    // Verify the EXTRACTED TREE, not just the archive bytes. The
+    // archive-bytes SRI (checked in fetch_verified_archive) proves
+    // the download is intact, but says nothing about whether the
+    // internal layout lands the patched files at the paths the
+    // record names: a zip with an unexpected wrapper dir (the
+    // single-level `strip_first` leaves an extra `pkg-<sha>/`
+    // segment) or a root-level `src/…` (over-stripped) extracts
+    // "successfully" with every file at the WRONG path, and the
+    // caller would ship a copy missing its patched files. Fail
+    // closed here and let the `auto` source fall back to the local
+    // build.
+    if !copy_matches_after_hashes(&stage, &record.files).await {
+        cleanup_failed_stage(&stage, uuid_dir, false).await;
+        return policy.miss(
             warnings,
-            "vendor_prebuilt_unavailable",
-            format!("patch service request failed ({reason})"),
-        ),
+            "vendor_prebuilt_layout_mismatch",
+            format!(
+                "prebuilt dist zip for {pkg} extracted to an \
+                 unexpected layout (patched files absent at their \
+                 recorded paths)"
+            ),
+        );
     }
+    if let Err(e) = swap_stage_into_place(&stage, copy_dir).await {
+        cleanup_failed_stage(&stage, uuid_dir, false).await;
+        return policy.hard(
+            "vendor_prebuilt_write_failed",
+            format!("cannot move the extracted dist into place: {e}"),
+        );
+    }
+    warnings.push(VendorWarning::new(
+        "vendor_prebuilt_downloaded",
+        format!(
+            "vendored {pkg} from the patch service ({})",
+            archive.source_url
+        ),
+    ));
+    ComposerServiceCopy::Used(())
 }
 
 /// Locate the package's entry: `packages[]` first, then `packages-dev[]`.
diff --git a/crates/socket-patch-core/src/vendor/gem.rs b/crates/socket-patch-core/src/vendor/gem.rs
index 2d5dd4ef..078f452d 100644
--- a/crates/socket-patch-core/src/vendor/gem.rs
+++ b/crates/socket-patch-core/src/vendor/gem.rs
@@ -75,7 +75,7 @@ use super::path::{parse_vendor_path, vendor_uuid_dir_rel};
 use super::registry_fetch::{extract_gem_data, extract_on_blocking_pool};
 use super::service_fetch::{
     claim_prestaged, fetch_verified_archive, fetch_verified_secondary, SecondaryArtifactResult,
-    ServiceArtifact,
+    ServiceAttempt, ServicePolicy, ServiceTerminal,
 };
 use super::source::PackageSource;
 use super::state::{
@@ -976,47 +976,15 @@ async fn gem_service_copy(
     };
 
     // Step 1: the prebuilt `.gem` (sha512-verified against the reference).
-    let mut archive = match fetch_verified_archive(cfg, &record.uuid).await {
-        ServiceArtifact::Ready(archive) => archive,
-        // Bytes that fail integrity verification are an active tamper signal:
-        // ALWAYS a hard error, in `auto` exactly as in `service` — never a
-        // quiet local-build fallback (`ServiceArtifact`'s documented contract).
-        ServiceArtifact::IntegrityMismatch(reason) => {
-            return hard(
-                "vendor_prebuilt_integrity_mismatch",
-                format!(
-                    "prebuilt .gem for {name} failed integrity verification ({reason}); \
-                     refusing to fall back to a local build on tampered bytes"
-                ),
-            );
-        }
-        ServiceArtifact::Pending => {
-            return miss(
-                warnings,
-                "vendor_prebuilt_pending",
-                ("vendor_prebuilt_required", ""),
-                "prebuilt .gem is still building".to_string(),
-                false,
-            );
-        }
-        ServiceArtifact::Unavailable(reason) => {
-            if cfg.source.requires_service() {
-                return hard(
-                    "vendor_prebuilt_required",
-                    format!("prebuilt .gem unavailable: {reason}"),
-                );
-            }
+    let fetched = fetch_verified_archive(cfg, &record.uuid).await;
+    let subject = format!(".gem for {name}");
+    let policy = ServicePolicy::new(cfg, ServiceTerminal::Refused);
+    let mut archive = match policy.settle::<()>(fetched, ".gem", &subject, warnings) {
+        Ok(archive) => archive,
+        Err(ServiceAttempt::HardFail(outcome)) => return GemServiceCopy::HardFail(outcome),
+        Err(ServiceAttempt::Used(()) | ServiceAttempt::FallBack) => {
             return GemServiceCopy::FallBack(None);
         }
-        ServiceArtifact::Failed(reason) => {
-            return miss(
-                warnings,
-                "vendor_prebuilt_unavailable",
-                ("vendor_prebuilt_required", ""),
-                format!("patch service request failed ({reason})"),
-                false,
-            );
-        }
     };
 
     // Step 2: the stub gemspec the converter generated alongside the `.gem`.
diff --git a/crates/socket-patch-core/src/vendor/golang.rs b/crates/socket-patch-core/src/vendor/golang.rs
index 541b12fb..c54d16b8 100644
--- a/crates/socket-patch-core/src/vendor/golang.rs
+++ b/crates/socket-patch-core/src/vendor/golang.rs
@@ -36,7 +36,9 @@ use super::common::{
 };
 use super::path::vendor_uuid_dir_rel;
 use super::registry_fetch::{extract_on_blocking_pool, extract_zip_with_prefix};
-use super::service_fetch::{claim_prestaged, fetch_verified_archive, ServiceArtifact};
+use super::service_fetch::{
+    claim_prestaged, fetch_verified_archive, ServiceAttempt, ServicePolicy, ServiceTerminal,
+};
 use super::source::PackageSource;
 use super::state::{
     write_marker_or_warn, VendorArtifact, VendorEntry, VendorMarker, WiringAction, WiringRecord,
@@ -281,7 +283,7 @@ pub async fn vendor_go_module<'a>(
     )
     .await
     {
-        GoServiceRedirect::Used => {
+        GoServiceRedirect::Used(()) => {
             // No local apply to verify (the downloaded zip IS the patched
             // module), so every patched file reads as `AlreadyPatched` — trust
             // is the verified service integrity (sha512 + the `h1:` dirhash).
@@ -496,15 +498,9 @@ pub async fn vendor_go_module<'a>(
     done(result, Some(entry), warnings)
 }
 
-/// Outcome of attempting to materialise the go copy from the patch service.
-enum GoServiceRedirect {
-    /// The prebuilt module zip was extracted and the `replace` wired.
-    Used,
-    /// Bubble this terminal outcome (boxed — `VendorOutcome` is large).
-    HardFail(Box<VendorOutcome>),
-    /// Fall back to copying + patching the pristine module source.
-    FallBack,
-}
+/// Outcome of attempting to materialise the go copy from the patch service
+/// (`Used`: the prebuilt module zip was extracted and the `replace` wired).
+type GoServiceRedirect = ServiceAttempt<()>;
 
 /// Download the prebuilt module zip, verify it (sha512 + the `h1:` dirhash,
 /// done by `fetch_verified_archive`), extract it into `copy_dir` (stripping its
@@ -547,188 +543,108 @@ async fn go_service_redirect(
     if !cfg.service_enabled() || record.files.is_empty() {
         return GoServiceRedirect::FallBack;
     }
-    fn hard(code: &'static str, detail: String) -> GoServiceRedirect {
-        GoServiceRedirect::HardFail(Box::new(refused(code, detail)))
-    }
-    let miss = |warnings: &mut Vec<VendorWarning>, code: &'static str, reason: String| {
-        if cfg.source.requires_service() {
-            hard("vendor_prebuilt_required", reason)
-        } else {
-            warnings.push(VendorWarning::new(
-                code,
-                format!("{reason}; building locally instead"),
-            ));
-            GoServiceRedirect::FallBack
-        }
+    let policy = ServicePolicy::new(cfg, ServiceTerminal::Refused);
+    let fetched = fetch_verified_archive(cfg, &record.uuid).await;
+    let subject = format!("module zip for {module}");
+    let mut archive = match policy.settle(fetched, "module zip", &subject, warnings) {
+        Ok(archive) => archive,
+        Err(attempt) => return attempt,
     };
-    match fetch_verified_archive(cfg, &record.uuid).await {
-        ServiceArtifact::Ready(mut archive) => {
-            // Extract the module zip (strip its literal `{module}@{version}/`
-            // prefix) into a STAGE sibling of the copy dir and swap it into
-            // place only once verified — the cargo / composer / gem shape: a
-            // failed re-download never destroys a pre-existing copy the
-            // vendor `replace` still points at.
-            let stage = stage_dir_for(copy_dir);
-            let prefix = format!("{module}@{version}/");
-            // A tree the download plan already extracted from these bytes
-            // (see `prestage`) is moved into the stage instead; otherwise —
-            // or should the move fail — extract here, as always.
-            if !claim_prestaged(&mut archive, &stage, copy_dir).await {
-                let _ = remove_tree(&stage).await; // a crashed earlier run's litter
-                if let Err(e) = tokio::fs::create_dir_all(&stage).await {
-                    cleanup_failed_service_stage(
-                        &stage,
-                        project_root,
-                        base_rel,
-                        copy_dir,
-                        module,
-                        wired,
-                    )
-                    .await;
-                    return hard(
-                        "vendor_prebuilt_write_failed",
-                        format!("cannot create {}: {e}", stage.display()),
-                    );
-                }
-                let zip_bytes = std::mem::take(&mut archive.bytes);
-                let prefix_owned = prefix.clone();
-                if let Err(e) = extract_on_blocking_pool(zip_bytes, &stage, move |b, d| {
-                    extract_zip_with_prefix(b, d, &prefix_owned)
-                })
-                .await
-                {
-                    cleanup_failed_service_stage(
-                        &stage,
-                        project_root,
-                        base_rel,
-                        copy_dir,
-                        module,
-                        wired,
-                    )
-                    .await;
-                    return hard(
-                        "vendor_prebuilt_extract_failed",
-                        format!("cannot extract the prebuilt module zip: {e}"),
-                    );
-                }
-            }
-            // A `replace` target needs a go.mod declaring the module path;
-            // pre-modules zips may lack one — synthesize the minimal form.
-            if let Err(e) = ensure_module_go_mod(&stage, module).await {
-                cleanup_failed_service_stage(
-                    &stage,
-                    project_root,
-                    base_rel,
-                    copy_dir,
-                    module,
-                    wired,
-                )
-                .await;
-                return hard(
-                    "vendor_prebuilt_write_failed",
-                    format!("cannot synthesize go.mod for the copy: {e}"),
-                );
-            }
-            // Verify the EXTRACTED TREE before it replaces the copy or the
-            // consumer's go.mod is wired: the SRI proves the zip bytes are
-            // intact, but an unexpected internal layout (the
-            // `{module}@{version}/` prefix strip mismatching) lands the
-            // patched files at the wrong paths, and the caller would
-            // synthesize success from `record.files` while the copy is
-            // wrong. Fail closed → `auto` falls back to the local build;
-            // nothing points at the bad stage. (Mirrors composer_lock.rs.)
-            if !copy_matches_after_hashes(&stage, &record.files).await {
-                cleanup_failed_service_stage(
-                    &stage,
-                    project_root,
-                    base_rel,
-                    copy_dir,
-                    module,
-                    wired,
-                )
+    // Extract the module zip (strip its literal `{module}@{version}/`
+    // prefix) into a STAGE sibling of the copy dir and swap it into
+    // place only once verified — the cargo / composer / gem shape: a
+    // failed re-download never destroys a pre-existing copy the
+    // vendor `replace` still points at.
+    let stage = stage_dir_for(copy_dir);
+    let prefix = format!("{module}@{version}/");
+    // A tree the download plan already extracted from these bytes
+    // (see `prestage`) is moved into the stage instead; otherwise —
+    // or should the move fail — extract here, as always.
+    if !claim_prestaged(&mut archive, &stage, copy_dir).await {
+        let _ = remove_tree(&stage).await; // a crashed earlier run's litter
+        if let Err(e) = tokio::fs::create_dir_all(&stage).await {
+            cleanup_failed_service_stage(&stage, project_root, base_rel, copy_dir, module, wired)
                 .await;
-                return miss(
-                    warnings,
-                    "vendor_prebuilt_layout_mismatch",
-                    format!(
-                        "prebuilt module zip for {module} extracted to an \
-                         unexpected layout (patched files absent at their \
-                         recorded paths)"
-                    ),
-                );
-            }
-            if let Err(e) = swap_stage_into_place(&stage, copy_dir).await {
-                cleanup_failed_service_stage(
-                    &stage,
-                    project_root,
-                    base_rel,
-                    copy_dir,
-                    module,
-                    wired,
-                )
+            return policy.hard(
+                "vendor_prebuilt_write_failed",
+                format!("cannot create {}: {e}", stage.display()),
+            );
+        }
+        let zip_bytes = std::mem::take(&mut archive.bytes);
+        let prefix_owned = prefix.clone();
+        if let Err(e) = extract_on_blocking_pool(zip_bytes, &stage, move |b, d| {
+            extract_zip_with_prefix(b, d, &prefix_owned)
+        })
+        .await
+        {
+            cleanup_failed_service_stage(&stage, project_root, base_rel, copy_dir, module, wired)
                 .await;
-                return hard(
-                    "vendor_prebuilt_write_failed",
-                    format!("cannot move the extracted module into place: {e}"),
-                );
-            }
-            if let Err(e) =
-                go_mod_edit::ensure_replace_entry(project_root, module, version, base_rel, false)
-                    .await
-            {
-                // The verified copy is in place. A wired run's directive
-                // already targets this uuid's (now refreshed) copy, so both
-                // stay consistent as they are; a first run has nothing
-                // pointing at the copy — tear the uuid dir down so no orphan
-                // survives the wire failure.
-                if !wired {
-                    teardown_failed_service_copy(project_root, base_rel, module, false).await;
-                }
-                return hard(
-                    "vendor_prebuilt_wire_failed",
-                    format!("failed to update go.mod: {e}"),
-                );
-            }
-            warnings.push(VendorWarning::new(
-                "vendor_prebuilt_downloaded",
-                format!(
-                    "vendored {module} from the patch service ({})",
-                    archive.source_url
-                ),
-            ));
-            GoServiceRedirect::Used
+            return policy.hard(
+                "vendor_prebuilt_extract_failed",
+                format!("cannot extract the prebuilt module zip: {e}"),
+            );
         }
-        // Bytes that fail integrity verification are an active tamper signal:
-        // ALWAYS a hard error, in `auto` exactly as in `service` — never a
-        // quiet local-build fallback (`ServiceArtifact`'s documented contract).
-        ServiceArtifact::IntegrityMismatch(reason) => hard(
-            "vendor_prebuilt_integrity_mismatch",
+    }
+    // A `replace` target needs a go.mod declaring the module path;
+    // pre-modules zips may lack one — synthesize the minimal form.
+    if let Err(e) = ensure_module_go_mod(&stage, module).await {
+        cleanup_failed_service_stage(&stage, project_root, base_rel, copy_dir, module, wired).await;
+        return policy.hard(
+            "vendor_prebuilt_write_failed",
+            format!("cannot synthesize go.mod for the copy: {e}"),
+        );
+    }
+    // Verify the EXTRACTED TREE before it replaces the copy or the
+    // consumer's go.mod is wired: the SRI proves the zip bytes are
+    // intact, but an unexpected internal layout (the
+    // `{module}@{version}/` prefix strip mismatching) lands the
+    // patched files at the wrong paths, and the caller would
+    // synthesize success from `record.files` while the copy is
+    // wrong. Fail closed → `auto` falls back to the local build;
+    // nothing points at the bad stage. (Mirrors composer_lock.rs.)
+    if !copy_matches_after_hashes(&stage, &record.files).await {
+        cleanup_failed_service_stage(&stage, project_root, base_rel, copy_dir, module, wired).await;
+        return policy.miss(
+            warnings,
+            "vendor_prebuilt_layout_mismatch",
             format!(
-                "prebuilt module zip for {module} failed integrity verification ({reason}); \
-                 refusing to fall back to a local build on tampered bytes"
+                "prebuilt module zip for {module} extracted to an \
+                 unexpected layout (patched files absent at their \
+                 recorded paths)"
             ),
-        ),
-        ServiceArtifact::Pending => miss(
-            warnings,
-            "vendor_prebuilt_pending",
-            "prebuilt module zip is still building".to_string(),
-        ),
-        ServiceArtifact::Unavailable(reason) => {
-            if cfg.source.requires_service() {
-                hard(
-                    "vendor_prebuilt_required",
-                    format!("prebuilt module zip unavailable: {reason}"),
-                )
-            } else {
-                GoServiceRedirect::FallBack
-            }
+        );
+    }
+    if let Err(e) = swap_stage_into_place(&stage, copy_dir).await {
+        cleanup_failed_service_stage(&stage, project_root, base_rel, copy_dir, module, wired).await;
+        return policy.hard(
+            "vendor_prebuilt_write_failed",
+            format!("cannot move the extracted module into place: {e}"),
+        );
+    }
+    if let Err(e) =
+        go_mod_edit::ensure_replace_entry(project_root, module, version, base_rel, false).await
+    {
+        // The verified copy is in place. A wired run's directive
+        // already targets this uuid's (now refreshed) copy, so both
+        // stay consistent as they are; a first run has nothing
+        // pointing at the copy — tear the uuid dir down so no orphan
+        // survives the wire failure.
+        if !wired {
+            teardown_failed_service_copy(project_root, base_rel, module, false).await;
         }
-        ServiceArtifact::Failed(reason) => miss(
-            warnings,
-            "vendor_prebuilt_unavailable",
-            format!("patch service request failed ({reason})"),
-        ),
+        return policy.hard(
+            "vendor_prebuilt_wire_failed",
+            format!("failed to update go.mod: {e}"),
+        );
     }
+    warnings.push(VendorWarning::new(
+        "vendor_prebuilt_downloaded",
+        format!(
+            "vendored {module} from the patch service ({})",
+            archive.source_url
+        ),
+    ));
+    GoServiceRedirect::Used(())
 }
 
 /// Failure cleanup for the service legs (the vendor-side sibling of the
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/tests.rs b/crates/socket-patch-core/src/vendor/lock_inventory/tests.rs
index b7dc6040..3f98fb7d 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/tests.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/tests.rs
@@ -2807,7 +2807,6 @@ async fn the_hosted_rewriters_own_output_reinventories() {
             sha256: Some("c".repeat(64)),
             ..Default::default()
         },
-        berry_zip_url: None,
         registry_override: None,
     };
     let rewritten = rewrite_registry_redirect(
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/view.rs b/crates/socket-patch-core/src/vendor/lock_inventory/view.rs
index db5105bf..02e55b99 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/view.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/view.rs
@@ -15,9 +15,7 @@ use std::sync::Arc;
 use crate::constants::npm_family::{
     BUN_LOCK, BUN_LOCKB, NPM_LOCKS, PNPM_LOCK, PNP_MARKERS, VLT_LOCK,
 };
-use crate::utils::fs::{
-    read_regular_to_bytes, read_regular_to_string, read_regular_to_string_sync,
-};
+use crate::utils::fs::{read_regular_to_bytes, read_regular_to_string};
 use crate::vendor::npm_flavor::NpmLockFlavor;
 use crate::formats::pnpm::{sniff_lock_grammar, PnpmLockGrammar};
 use crate::formats::yarn::{sniff_grammar, YarnLockGrammar, UNIDENTIFIED_DETAIL};
@@ -53,22 +51,16 @@ impl MemoryProject {
         self.entries.insert(rel.into(), entry);
     }
 
-    pub fn insert_text(&mut self, rel: impl Into<String>, text: impl Into<Arc<str>>) {
+    #[cfg(test)]
+    pub(crate) fn insert_text(&mut self, rel: impl Into<String>, text: impl Into<Arc<str>>) {
         self.insert(rel, MemoryEntry::Text(text.into()));
     }
 
-    pub fn insert_binary(&mut self, rel: impl Into<String>, bytes: impl Into<Arc<[u8]>>) {
-        self.insert(rel, MemoryEntry::Binary(bytes.into()));
-    }
-
-    pub fn insert_present(&mut self, rel: impl Into<String>) {
+    #[cfg(test)]
+    pub(crate) fn insert_present(&mut self, rel: impl Into<String>) {
         self.insert(rel, MemoryEntry::Present);
     }
 
-    pub fn insert_symlink(&mut self, rel: impl Into<String>) {
-        self.insert(rel, MemoryEntry::Symlink);
-    }
-
     pub fn remove(&mut self, rel: &str) -> Option<MemoryEntry> {
         self.entries.remove(rel)
     }
@@ -92,11 +84,8 @@ impl MemoryProject {
         matches!(self.entries.get(rel), Some(MemoryEntry::Symlink))
     }
 
-    pub fn paths(&self) -> impl Iterator<Item = &str> {
-        self.entries.keys().map(String::as_str)
-    }
-
-    pub fn entries(&self) -> impl Iterator<Item = (&str, &MemoryEntry)> {
+    #[cfg(test)]
+    pub(crate) fn entries(&self) -> impl Iterator<Item = (&str, &MemoryEntry)> {
         self.entries.iter().map(|(k, v)| (k.as_str(), v))
     }
 
@@ -202,7 +191,6 @@ type ReadCache = std::collections::HashMap<String, Result<Arc<[u8]>, (io::ErrorK
 /// path hits the disk, later ones return the same content (or the same
 /// error). Everything that is not a content read (existence, file type,
 /// directory listings, the disk-only probes) goes to the disk directly.
-/// [`DiskSnapshot::invalidate`] drops what a write may have changed.
 #[derive(Debug)]
 pub struct DiskSnapshot<'a> {
     pub root: &'a Path,
@@ -217,11 +205,6 @@ impl<'a> DiskSnapshot<'a> {
         }
     }
 
-    /// Forget every cached read (after a write under `root`).
-    pub fn invalidate(&self) {
-        self.lock().clear();
-    }
-
     fn lock(&self) -> std::sync::MutexGuard<'_, ReadCache> {
         self.reads
             .lock()
@@ -251,15 +234,6 @@ impl<'a> DiskSnapshot<'a> {
         self.remember(rel, &read);
         read
     }
-
-    fn read_bytes_sync(&self, rel: &str) -> io::Result<Vec<u8>> {
-        if let Some(hit) = self.cached(rel) {
-            return hit.map(|b| b.to_vec());
-        }
-        let read = crate::utils::fs::read_regular_to_bytes_sync(&self.root.join(rel));
-        self.remember(rel, &read);
-        read
-    }
 }
 
 fn utf8(bytes: Vec<u8>) -> io::Result<String> {
@@ -276,17 +250,6 @@ pub enum ProjectView<'a> {
 }
 
 impl ProjectView<'_> {
-    /// The checkout root when the view reads a real filesystem (the disk
-    /// and snapshot variants), for the probes that only exist on disk.
-    pub fn disk_root(&self) -> Option<&Path> {
-        match self {
-            ProjectView::Disk(root) | ProjectView::Snapshot(DiskSnapshot { root, .. }) => {
-                Some(root)
-            }
-            ProjectView::Memory(_) => None,
-        }
-    }
-
     /// FIFO-safe regular-file text read.
     pub async fn read_text(&self, rel: &str) -> io::Result<String> {
         match self {
@@ -318,15 +281,6 @@ impl ProjectView<'_> {
         }
     }
 
-    /// Synchronous twin of [`Self::read_text`].
-    pub fn read_text_sync(&self, rel: &str) -> io::Result<String> {
-        match self {
-            ProjectView::Disk(root) => read_regular_to_string_sync(&root.join(rel)),
-            ProjectView::Memory(project) => project.read_text(rel),
-            ProjectView::Snapshot(snap) => snap.read_bytes_sync(rel).and_then(utf8),
-        }
-    }
-
     /// `metadata` (follows links) succeeds.
     pub async fn exists(&self, rel: &str) -> bool {
         match self {
@@ -619,7 +573,7 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn a_snapshot_reads_each_file_once_until_invalidated() {
+    async fn a_snapshot_reads_each_file_once() {
         let tmp = tempfile::tempdir().unwrap();
         std::fs::write(tmp.path().join("a.lock"), "one").unwrap();
         let snap = DiskSnapshot::new(tmp.path());
@@ -628,7 +582,6 @@ mod tests {
         std::fs::write(tmp.path().join("a.lock"), "two").unwrap();
         assert_eq!(view.read_text("a.lock").await.unwrap(), "one", "cached");
         assert_eq!(view.read_bytes("a.lock").await.unwrap(), b"one");
-        assert_eq!(view.read_text_sync("a.lock").unwrap(), "one");
         let missing = view.read_text("b.lock").await.unwrap_err();
         assert_eq!(missing.kind(), io::ErrorKind::NotFound);
         std::fs::write(tmp.path().join("b.lock"), "late").unwrap();
@@ -638,9 +591,5 @@ mod tests {
             "a cached miss stays a miss"
         );
         assert!(view.exists("b.lock").await, "non-read probes go to disk");
-        snap.invalidate();
-        assert_eq!(view.read_text("a.lock").await.unwrap(), "two");
-        assert_eq!(view.read_text("b.lock").await.unwrap(), "late");
-        assert_eq!(view.disk_root(), Some(tmp.path()));
     }
 }
diff --git a/crates/socket-patch-core/src/vendor/mod.rs b/crates/socket-patch-core/src/vendor/mod.rs
index 5d6fc529..38cfa6b6 100644
--- a/crates/socket-patch-core/src/vendor/mod.rs
+++ b/crates/socket-patch-core/src/vendor/mod.rs
@@ -97,7 +97,6 @@ pub(crate) mod test_support;
 mod toml_surgery;
 pub(crate) mod verify;
 pub mod vlt_lock;
-#[allow(dead_code)]
 pub(crate) mod vlt_lock_text;
 pub(crate) mod yarn_berry_lock;
 pub(crate) mod yarn_classic_lock;
diff --git a/crates/socket-patch-core/src/vendor/npm_common.rs b/crates/socket-patch-core/src/vendor/npm_common.rs
index 0c6e89f3..0fd4315e 100644
--- a/crates/socket-patch-core/src/vendor/npm_common.rs
+++ b/crates/socket-patch-core/src/vendor/npm_common.rs
@@ -31,7 +31,9 @@ use super::common::{
 use super::npm_pack::{pack_deterministic, PackedTarball};
 use super::path::vendor_uuid_dir_rel;
 use super::reuse;
-use super::service_fetch::{fetch_verified_archive, ServiceArtifact};
+use super::service_fetch::{
+    fetch_verified_archive, ServiceArtifact, ServiceAttempt, ServicePolicy, ServiceTerminal,
+};
 use super::source::PackageSource;
 use super::{RevertOutcome, VendorOutcome, VendorServiceConfig, VendorWarning};
 
@@ -452,17 +454,9 @@ async fn reuse_committed_pack(
 
 // ───────────────────────── service-download path ─────────────────────────
 
-/// Outcome of attempting the service-download fast path in [`stage_patch_pack`].
-enum ServicePackDecision {
-    /// Use the service artifact — the staged pack + a synthesized success.
-    /// Boxed: the pair is large relative to the other (small) variants.
-    Used(Box<(Option<NpmStagedPack>, ApplyResult)>),
-    /// Abort vendoring this package (a `service`-mode miss, or a downloaded
-    /// artifact we could not turn into a staged pack).
-    HardFail(Box<VendorOutcome>),
-    /// Fall back to the local stage→patch→pack build.
-    FallBack,
-}
+/// Outcome of attempting the service-download fast path in [`stage_patch_pack`]
+/// (`Used`: the staged pack + a synthesized success, boxed — the pair is large).
+type ServicePackDecision = ServiceAttempt<Box<(Option<NpmStagedPack>, ApplyResult)>>;
 
 /// Download + verify the prebuilt tarball and turn it into an [`NpmStagedPack`],
 /// mapping each service outcome onto the `auto` / `service` fallback policy.
@@ -474,99 +468,60 @@ async fn try_service_pack(
     cfg: &VendorServiceConfig,
     warnings: &mut Vec<VendorWarning>,
 ) -> ServicePackDecision {
-    let hard_fail =
-        |detail: String| ServicePackDecision::HardFail(Box::new(done_failure(purl, detail)));
-    match fetch_verified_archive(cfg, &record.uuid).await {
-        // The SRI proves only that the transfer is intact: require the
-        // tarball to carry every patched file at its afterHash before
-        // reporting the package patched and wiring the lock to it.
-        ServiceArtifact::Ready(archive)
-            if !tgz_bytes_match_after_hashes(&archive.bytes, record) =>
-        {
-            let reason = format!(
+    let policy = ServicePolicy::new(cfg, ServiceTerminal::Failure(purl));
+    let archive = match fetch_verified_archive(cfg, &record.uuid).await {
+        // This backend's `service` refusal words a request failure differently.
+        ServiceArtifact::Failed(reason) if cfg.source.requires_service() => {
+            return policy.hard(
+                "vendor_prebuilt_required",
+                format!("patch service request failed: {reason}"),
+            );
+        }
+        fetched => match policy.settle(fetched, "artifact", "artifact", warnings) {
+            Ok(archive) => archive,
+            Err(attempt) => return attempt,
+        },
+    };
+    // The SRI proves only that the transfer is intact: require the tarball to
+    // carry every patched file at its afterHash before reporting the package
+    // patched and wiring the lock to it.
+    if !tgz_bytes_match_after_hashes(&archive.bytes, record) {
+        return policy.miss(
+            warnings,
+            "vendor_prebuilt_layout_mismatch",
+            format!(
                 "prebuilt tarball for {}@{} does not carry the patched files at their \
                  recorded paths",
                 coords.name, coords.version
-            );
-            if cfg.source.requires_service() {
-                hard_fail(reason)
-            } else {
-                warnings.push(VendorWarning::new(
-                    "vendor_prebuilt_layout_mismatch",
-                    format!("{reason}; building locally instead"),
-                ));
-                ServicePackDecision::FallBack
-            }
-        }
-        ServiceArtifact::Ready(archive) => {
-            match staged_pack_from_service_bytes(
-                purl,
-                project_root,
-                coords,
-                record,
-                &archive.bytes,
-                &archive.integrity_sri,
-            )
-            .await
-            {
-                Ok(staged) => {
-                    warnings.push(VendorWarning::new(
-                        "vendor_prebuilt_downloaded",
-                        format!(
-                            "vendored {}@{} from the patch service ({})",
-                            coords.name, coords.version, archive.source_url
-                        ),
-                    ));
-                    // No local apply to verify — every patched file reads as
-                    // `AlreadyPatched` (the tarball's members were checked
-                    // against their afterHashes above).
-                    let result = already_patched_result(
-                        purl,
-                        &project_root.join(&staged.rel_tgz),
-                        &record.files,
-                    );
-                    ServicePackDecision::Used(Box::new((Some(staged), result)))
-                }
-                Err(outcome) => ServicePackDecision::HardFail(outcome),
-            }
-        }
-        // Bytes that fail integrity verification are an active tamper signal:
-        // ALWAYS a hard error, in `auto` exactly as in `service` — never a
-        // quiet local-build fallback (`ServiceArtifact`'s documented contract).
-        ServiceArtifact::IntegrityMismatch(reason) => hard_fail(format!(
-            "prebuilt artifact failed integrity verification ({reason}); \
-             refusing to fall back to a local build on tampered bytes"
-        )),
-        ServiceArtifact::Pending => {
-            if cfg.source.requires_service() {
-                hard_fail("prebuilt artifact is still building".to_string())
-            } else {
-                warnings.push(VendorWarning::new(
-                    "vendor_prebuilt_pending",
-                    "prebuilt artifact is still building; building locally instead".to_string(),
-                ));
-                ServicePackDecision::FallBack
-            }
-        }
-        // The common, quiet miss: not built / free-only / not found.
-        ServiceArtifact::Unavailable(reason) => {
-            if cfg.source.requires_service() {
-                hard_fail(format!("prebuilt artifact unavailable: {reason}"))
-            } else {
-                ServicePackDecision::FallBack
-            }
-        }
-        ServiceArtifact::Failed(reason) => {
-            if cfg.source.requires_service() {
-                hard_fail(format!("patch service request failed: {reason}"))
-            } else {
-                warnings.push(VendorWarning::new(
-                    "vendor_prebuilt_unavailable",
-                    format!("patch service request failed ({reason}); building locally instead"),
-                ));
-                ServicePackDecision::FallBack
-            }
+            ),
+        );
+    }
+    match staged_pack_from_service_bytes(
+        purl,
+        project_root,
+        coords,
+        record,
+        &archive.bytes,
+        &archive.integrity_sri,
+    )
+    .await
+    {
+        Ok(staged) => {
+            warnings.push(VendorWarning::new(
+                "vendor_prebuilt_downloaded",
+                format!(
+                    "vendored {}@{} from the patch service ({})",
+                    coords.name, coords.version, archive.source_url
+                ),
+            ));
+            // No local apply to verify — every patched file reads as
+            // `AlreadyPatched` (the tarball's members were checked against
+            // their afterHashes above).
+            let result =
+                already_patched_result(purl, &project_root.join(&staged.rel_tgz), &record.files);
+            ServicePackDecision::Used(Box::new((Some(staged), result)))
         }
+        Err(outcome) => ServicePackDecision::HardFail(outcome),
     }
 }
 
diff --git a/crates/socket-patch-core/src/vendor/npm_dir.rs b/crates/socket-patch-core/src/vendor/npm_dir.rs
index 1887f0ff..d8440495 100644
--- a/crates/socket-patch-core/src/vendor/npm_dir.rs
+++ b/crates/socket-patch-core/src/vendor/npm_dir.rs
@@ -34,7 +34,9 @@ use super::common::{already_patched_result, refused, service_offline_conflict};
 use super::npm_common::{
     declares_bundled_deps, done_failure, done_failure_unstage, guard_coordinates,
 };
-use super::service_fetch::{fetch_verified_archive, ServiceArtifact};
+use super::service_fetch::{
+    fetch_verified_archive, ServiceAttempt, ServicePolicy, ServiceTerminal,
+};
 use super::source::PackageSource;
 use super::state::VENDOR_MARKER_FILE;
 use super::vlt_lock_text::vendored_dir_rel;
@@ -611,7 +613,7 @@ pub(super) async fn stage_patch_dir(
         )
         .await
         {
-            ServiceDir::Used => {
+            ServiceDir::Used(()) => {
                 result = Some(already_patched_result(purl, &rel_abs, &record.files));
             }
             ServiceDir::HardFail(outcome) => return Err(outcome),
@@ -877,11 +879,7 @@ async fn tree_matches_after_hashes(stage: &Path, record: &PatchRecord) -> bool {
     true
 }
 
-enum ServiceDir {
-    Used,
-    HardFail(Box<VendorOutcome>),
-    FallBack,
-}
+type ServiceDir = ServiceAttempt<()>;
 
 /// The service fast path: the prebuilt tarball, integrity- and
 /// afterHash-verified, extracted into `stage` with its first path component
@@ -896,75 +894,44 @@ async fn try_service_dir(
     version: &str,
     warnings: &mut Vec<VendorWarning>,
 ) -> ServiceDir {
-    let hard_fail = |detail: String| ServiceDir::HardFail(Box::new(done_failure(purl, detail)));
-    let fallback_or_fail =
-        |reason: String, code: &'static str, warnings: &mut Vec<VendorWarning>| {
-            if cfg.source.requires_service() {
-                hard_fail(reason)
-            } else {
-                warnings.push(VendorWarning::new(
-                    code,
-                    format!("{reason}; building locally instead"),
-                ));
-                ServiceDir::FallBack
-            }
-        };
-    match fetch_verified_archive(cfg, &record.uuid).await {
-        ServiceArtifact::Ready(archive) => {
-            let (bytes, dest) = (archive.bytes, stage.to_path_buf());
-            let extracted = tokio::task::spawn_blocking(move || {
-                super::registry_fetch::extract_tgz_strict(&bytes, &dest)
-            })
-            .await
-            .map_err(|e| e.to_string())
-            .and_then(|r| r);
-            if let Err(e) = extracted {
-                return hard_fail(format!(
-                    "prebuilt tarball for {name}@{version} is unsafe: {e}"
-                ));
-            }
-            if !tree_matches_after_hashes(stage, record).await {
-                let _ = remove_tree(stage).await;
-                return fallback_or_fail(
-                    format!(
-                        "prebuilt tarball for {name}@{version} does not carry the patched files \
-                         at their recorded paths"
-                    ),
-                    "vendor_prebuilt_layout_mismatch",
-                    warnings,
-                );
-            }
-            warnings.push(VendorWarning::new(
-                "vendor_prebuilt_downloaded",
-                format!(
-                    "vendored {name}@{version} from the patch service ({})",
-                    archive.source_url
-                ),
-            ));
-            ServiceDir::Used
-        }
-        ServiceArtifact::IntegrityMismatch(reason) => hard_fail(format!(
-            "prebuilt artifact failed integrity verification ({reason}); refusing to fall back \
-             to a local build on tampered bytes"
-        )),
-        ServiceArtifact::Pending => fallback_or_fail(
-            "prebuilt artifact is still building".to_string(),
-            "vendor_prebuilt_pending",
-            warnings,
-        ),
-        ServiceArtifact::Unavailable(reason) => {
-            if cfg.source.requires_service() {
-                hard_fail(format!("prebuilt artifact unavailable: {reason}"))
-            } else {
-                ServiceDir::FallBack
-            }
-        }
-        ServiceArtifact::Failed(reason) => fallback_or_fail(
-            format!("patch service request failed ({reason})"),
-            "vendor_prebuilt_unavailable",
+    let policy = ServicePolicy::new(cfg, ServiceTerminal::Failure(purl));
+    let fetched = fetch_verified_archive(cfg, &record.uuid).await;
+    let archive = match policy.settle(fetched, "artifact", "artifact", warnings) {
+        Ok(archive) => archive,
+        Err(attempt) => return attempt,
+    };
+    let (bytes, dest) = (archive.bytes, stage.to_path_buf());
+    let extracted = tokio::task::spawn_blocking(move || {
+        super::registry_fetch::extract_tgz_strict(&bytes, &dest)
+    })
+    .await
+    .map_err(|e| e.to_string())
+    .and_then(|r| r);
+    if let Err(e) = extracted {
+        return policy.hard(
+            "vendor_prebuilt_extract_failed",
+            format!("prebuilt tarball for {name}@{version} is unsafe: {e}"),
+        );
+    }
+    if !tree_matches_after_hashes(stage, record).await {
+        let _ = remove_tree(stage).await;
+        return policy.miss(
             warnings,
-        ),
+            "vendor_prebuilt_layout_mismatch",
+            format!(
+                "prebuilt tarball for {name}@{version} does not carry the patched files \
+                 at their recorded paths"
+            ),
+        );
     }
+    warnings.push(VendorWarning::new(
+        "vendor_prebuilt_downloaded",
+        format!(
+            "vendored {name}@{version} from the patch service ({})",
+            archive.source_url
+        ),
+    ));
+    ServiceDir::Used(())
 }
 
 #[cfg(test)]
diff --git a/crates/socket-patch-core/src/vendor/npm_flavor.rs b/crates/socket-patch-core/src/vendor/npm_flavor.rs
index a0ffe424..e1e284f3 100644
--- a/crates/socket-patch-core/src/vendor/npm_flavor.rs
+++ b/crates/socket-patch-core/src/vendor/npm_flavor.rs
@@ -565,7 +565,6 @@ pub async fn lock_text_refusals(
     let nowhere = nowhere_buf.as_path();
     let no_sources = PatchSources {
         blobs_path: nowhere,
-        packages_path: None,
         diffs_path: None,
         mem_blobs: None,
     };
@@ -783,7 +782,6 @@ mod lock_text_refusal_tests {
         let nowhere = root.join("not-installed");
         let sources = PatchSources {
             blobs_path: &nowhere,
-            packages_path: None,
             diffs_path: None,
             mem_blobs: None,
         };
diff --git a/crates/socket-patch-core/src/vendor/pypi.rs b/crates/socket-patch-core/src/vendor/pypi.rs
index f95d46ee..5b3cb18f 100644
--- a/crates/socket-patch-core/src/vendor/pypi.rs
+++ b/crates/socket-patch-core/src/vendor/pypi.rs
@@ -40,7 +40,9 @@ use super::pypi_wheel::{
     WheelArtifact,
 };
 use super::reuse;
-use super::service_fetch::{fetch_verified_archive, ServiceArtifact};
+use super::service_fetch::{
+    fetch_verified_archive, ServiceArtifact, ServiceAttempt, ServicePolicy, ServiceTerminal,
+};
 use super::source::PackageSource;
 use super::state::{
     write_marker_or_warn, PdmMeta, PipenvMeta, PoetryMeta, UvMeta, VendorArtifact, VendorEntry,
@@ -1874,15 +1876,9 @@ async fn acquire_patched_wheel(
     })
 }
 
-/// Outcome of attempting a pypi service download.
-enum PypiServiceWheel {
-    /// Boxed: the wheel facts are large relative to the other variants.
-    Used(Box<AcquiredWheel>),
-    /// Bubble this terminal outcome (a `service`-mode miss, or a write failure).
-    HardFail(Box<VendorOutcome>),
-    /// Fall back to the local build.
-    FallBack,
-}
+/// Outcome of attempting a pypi service download (the wheel facts boxed —
+/// they are large).
+type PypiServiceWheel = ServiceAttempt<Box<AcquiredWheel>>;
 
 /// Download + verify the prebuilt wheel for `record.uuid`, mapping each service
 /// outcome onto the `auto` / `service` policy. Only `.whl` artifacts are usable
@@ -1897,146 +1893,100 @@ async fn try_pypi_service_wheel(
     expected_pin: Option<&(String, String)>,
     warnings: &mut Vec<VendorWarning>,
 ) -> PypiServiceWheel {
-    // A terminal `service`-mode refusal (boxed — the enum's other variants are
-    // small). A nested fn so both `miss` and the write-failure sites can use it.
-    fn hard_fail(code: &'static str, detail: String) -> PypiServiceWheel {
-        PypiServiceWheel::HardFail(Box::new(refused(code, detail)))
-    }
-    // service-required → hard fail; `auto` → warn + fall back to the local build.
-    let miss = |warnings: &mut Vec<VendorWarning>, code: &'static str, reason: String| {
-        if cfg.source.requires_service() {
-            hard_fail("vendor_prebuilt_required", reason)
-        } else {
-            warnings.push(VendorWarning::new(
-                code,
-                format!("{reason}; building locally instead"),
-            ));
-            PypiServiceWheel::FallBack
+    let policy = ServicePolicy::new(cfg, ServiceTerminal::Refused);
+    let fetched = fetch_verified_archive(cfg, &record.uuid).await;
+    // The client refused a non-wheel before downloading it.
+    if let ServiceArtifact::Unavailable(reason) = &fetched {
+        if reason == PYPI_NOT_A_WHEEL {
+            return policy.miss(warnings, "vendor_prebuilt_unavailable", reason.clone());
         }
+    }
+    let archive = match policy.settle(fetched, "wheel", "wheel", warnings) {
+        Ok(archive) => archive,
+        Err(attempt) => return attempt,
     };
-
-    match fetch_verified_archive(cfg, &record.uuid).await {
-        ServiceArtifact::Ready(archive) => {
-            let Some(wheel_name) = wheel_filename_from_url(&archive.source_url) else {
-                return miss(
-                    warnings,
-                    "vendor_prebuilt_unavailable",
-                    PYPI_NOT_A_WHEEL.to_string(),
-                );
-            };
-            // The SRI proves only that the transfer is intact. A wheel's
-            // members are site-packages-relative (the `record.files` keys),
-            // so require each patched file to carry its afterHash before
-            // reporting the package patched and pinning the lockfile to it.
-            if !archive
-                .prestaged
-                .zip_verdict(&record.files)
-                .unwrap_or_else(|| zip_bytes_match_after_hashes(&archive.bytes, &record.files))
-            {
-                return miss(
-                    warnings,
-                    "vendor_prebuilt_layout_mismatch",
-                    format!(
-                        "prebuilt wheel for {base} does not carry the patched files at \
-                         their recorded paths"
-                    ),
-                );
-            }
-            let rel_wheel = format!("{uuid_dir_rel}/{wheel_name}");
-            // Digested on first ask: pypi is the only backend that pins it.
-            let sha256_hex = archive.sha256_hex().to_string();
-            // In-sync rebuild: the lockfile still pins the first vendor's
-            // wheel path + sha256, and a prebuilt wheel that differs would
-            // break every subsequent hash-checked install the moment vendor
-            // reports success. Checked BEFORE writing, so a mismatch leaves
-            // no poisoned artifact behind (`auto` falls back to the
-            // deterministic local build, which reproduces a local pin).
-            if let Some((pin_path, pin_sha)) = expected_pin {
-                if *pin_path != rel_wheel || *pin_sha != sha256_hex {
-                    return miss(
-                        warnings,
-                        "vendor_prebuilt_pin_mismatch",
-                        format!(
-                            "the prebuilt wheel ({rel_wheel}, sha256 {sha256_hex}) does not \
-                             match the wheel the lockfile still pins ({pin_path}, sha256 \
-                             {pin_sha})"
-                        ),
-                    );
-                }
-            }
-            let dest = project_root.join(uuid_dir_rel).join(&wheel_name);
-            if let Some(parent) = dest.parent() {
-                if let Err(e) = tokio::fs::create_dir_all(parent).await {
-                    return hard_fail(
-                        "vendor_prebuilt_write_failed",
-                        format!("cannot create {}: {e}", parent.display()),
-                    );
-                }
-            }
-            if let Err(e) = atomic_write_artifact(&dest, &archive.bytes).await {
-                return hard_fail(
-                    "vendor_prebuilt_write_failed",
-                    format!("cannot write the vendored wheel: {e}"),
-                );
-            }
-            let (platform_locked, platform_tags_display) =
-                wheel_platform_from_filename(&wheel_name);
-            warnings.push(VendorWarning::new(
-                "vendor_prebuilt_downloaded",
-                format!(
-                    "vendored the wheel for {base} from the patch service ({})",
-                    archive.source_url
-                ),
-            ));
-            PypiServiceWheel::Used(Box::new(AcquiredWheel {
-                rel_wheel,
-                result: already_patched_result(base, &dest, &record.files),
-                artifact: Some(WheelArtifact {
-                    file_name: wheel_name.clone(),
-                    sha256_hex,
-                    size: archive.bytes.len() as u64,
-                }),
-                wheel_name,
-                platform_locked,
-                platform_tags_display,
-            }))
-        }
-        // Bytes that fail integrity verification are an active tamper signal:
-        // ALWAYS a hard error, in `auto` exactly as in `service` — never a
-        // quiet local-build fallback (`ServiceArtifact`'s documented contract).
-        ServiceArtifact::IntegrityMismatch(reason) => hard_fail(
-            "vendor_prebuilt_integrity_mismatch",
+    let Some(wheel_name) = wheel_filename_from_url(&archive.source_url) else {
+        return policy.miss(
+            warnings,
+            "vendor_prebuilt_unavailable",
+            PYPI_NOT_A_WHEEL.to_string(),
+        );
+    };
+    // The SRI proves only that the transfer is intact. A wheel's
+    // members are site-packages-relative (the `record.files` keys),
+    // so require each patched file to carry its afterHash before
+    // reporting the package patched and pinning the lockfile to it.
+    if !archive
+        .prestaged
+        .zip_verdict(&record.files)
+        .unwrap_or_else(|| zip_bytes_match_after_hashes(&archive.bytes, &record.files))
+    {
+        return policy.miss(
+            warnings,
+            "vendor_prebuilt_layout_mismatch",
             format!(
-                "prebuilt wheel failed integrity verification ({reason}); \
-                 refusing to fall back to a local build on tampered bytes"
+                "prebuilt wheel for {base} does not carry the patched files at \
+                 their recorded paths"
             ),
-        ),
-        ServiceArtifact::Pending => miss(
-            warnings,
-            "vendor_prebuilt_pending",
-            "prebuilt wheel is still building".to_string(),
-        ),
-        // The client refused a non-wheel before downloading it.
-        ServiceArtifact::Unavailable(reason) if reason == PYPI_NOT_A_WHEEL => {
-            miss(warnings, "vendor_prebuilt_unavailable", reason)
+        );
+    }
+    let rel_wheel = format!("{uuid_dir_rel}/{wheel_name}");
+    // Digested on first ask: pypi is the only backend that pins it.
+    let sha256_hex = archive.sha256_hex().to_string();
+    // In-sync rebuild: the lockfile still pins the first vendor's
+    // wheel path + sha256, and a prebuilt wheel that differs would
+    // break every subsequent hash-checked install the moment vendor
+    // reports success. Checked BEFORE writing, so a mismatch leaves
+    // no poisoned artifact behind (`auto` falls back to the
+    // deterministic local build, which reproduces a local pin).
+    if let Some((pin_path, pin_sha)) = expected_pin {
+        if *pin_path != rel_wheel || *pin_sha != sha256_hex {
+            return policy.miss(
+                warnings,
+                "vendor_prebuilt_pin_mismatch",
+                format!(
+                    "the prebuilt wheel ({rel_wheel}, sha256 {sha256_hex}) does not \
+                     match the wheel the lockfile still pins ({pin_path}, sha256 \
+                     {pin_sha})"
+                ),
+            );
         }
-        // Quiet under `auto` (the common "not built / free-only" case).
-        ServiceArtifact::Unavailable(reason) => {
-            if cfg.source.requires_service() {
-                hard_fail(
-                    "vendor_prebuilt_required",
-                    format!("prebuilt wheel unavailable: {reason}"),
-                )
-            } else {
-                PypiServiceWheel::FallBack
-            }
+    }
+    let dest = project_root.join(uuid_dir_rel).join(&wheel_name);
+    if let Some(parent) = dest.parent() {
+        if let Err(e) = tokio::fs::create_dir_all(parent).await {
+            return policy.hard(
+                "vendor_prebuilt_write_failed",
+                format!("cannot create {}: {e}", parent.display()),
+            );
         }
-        ServiceArtifact::Failed(reason) => miss(
-            warnings,
-            "vendor_prebuilt_unavailable",
-            format!("patch service request failed ({reason})"),
-        ),
     }
+    if let Err(e) = atomic_write_artifact(&dest, &archive.bytes).await {
+        return policy.hard(
+            "vendor_prebuilt_write_failed",
+            format!("cannot write the vendored wheel: {e}"),
+        );
+    }
+    let (platform_locked, platform_tags_display) = wheel_platform_from_filename(&wheel_name);
+    warnings.push(VendorWarning::new(
+        "vendor_prebuilt_downloaded",
+        format!(
+            "vendored the wheel for {base} from the patch service ({})",
+            archive.source_url
+        ),
+    ));
+    PypiServiceWheel::Used(Box::new(AcquiredWheel {
+        rel_wheel,
+        result: already_patched_result(base, &dest, &record.files),
+        artifact: Some(WheelArtifact {
+            file_name: wheel_name.clone(),
+            sha256_hex,
+            size: archive.bytes.len() as u64,
+        }),
+        wheel_name,
+        platform_locked,
+        platform_tags_display,
+    }))
 }
 
 /// Derive `(platform_locked, display)` from a wheel filename's trailing tag
diff --git a/crates/socket-patch-core/src/vendor/service_fetch.rs b/crates/socket-patch-core/src/vendor/service_fetch.rs
index 1639aee0..cbde546a 100644
--- a/crates/socket-patch-core/src/vendor/service_fetch.rs
+++ b/crates/socket-patch-core/src/vendor/service_fetch.rs
@@ -152,18 +152,117 @@ pub(crate) async fn claim_prestaged(
     }
 }
 
-/// Outcome of attempting to materialise a single-file artifact from the patch
-/// service (the Tier-A backends — maven `.jar`, nuget `.nupkg` — where the
-/// verified archive bytes ARE the vendored artifact, written verbatim).
-pub(crate) enum ServiceCopy {
-    /// The prebuilt patched bytes (write them verbatim).
-    Used(Vec<u8>),
+/// Outcome of a backend's service fast path, mapped onto the `auto` /
+/// `service` fallback policy by [`ServicePolicy`].
+pub(crate) enum ServiceAttempt<T> {
+    /// The verified service artifact was used; `T` is what the backend made
+    /// of it.
+    Used(T),
     /// Bubble this terminal outcome (boxed — `VendorOutcome` is large).
     HardFail(Box<VendorOutcome>),
     /// Fall back to the local rebuild.
     FallBack,
 }
 
+/// The single-file outcome for the Tier-A backends (maven `.jar`, nuget
+/// `.nupkg`): the prebuilt patched bytes, written verbatim.
+pub(crate) type ServiceCopy = ServiceAttempt<Vec<u8>>;
+
+/// How a backend reports a terminal service failure.
+#[derive(Clone, Copy)]
+pub(crate) enum ServiceTerminal<'a> {
+    /// A [`VendorOutcome::Refused`] carrying the refusal code.
+    Refused,
+    /// The npm backends' failed `Done` for `purl` (the code is not reported).
+    Failure(&'a str),
+}
+
+/// The `auto` / `service` fallback policy every service-backed backend
+/// shares: `service` refuses every miss, `auto` warns (or, for a plain
+/// `Unavailable`, stays quiet) and builds locally. Tampered bytes are always
+/// terminal.
+pub(crate) struct ServicePolicy<'a> {
+    requires_service: bool,
+    terminal: ServiceTerminal<'a>,
+}
+
+impl<'a> ServicePolicy<'a> {
+    pub(crate) fn new(cfg: &VendorServiceConfig, terminal: ServiceTerminal<'a>) -> Self {
+        Self {
+            requires_service: cfg.source.requires_service(),
+            terminal,
+        }
+    }
+
+    pub(crate) fn hard<T>(&self, code: &'static str, detail: String) -> ServiceAttempt<T> {
+        ServiceAttempt::HardFail(Box::new(match self.terminal {
+            ServiceTerminal::Refused => refused(code, detail),
+            ServiceTerminal::Failure(purl) => super::npm_common::done_failure(purl, detail),
+        }))
+    }
+
+    /// `service` refuses with `reason`; `auto` warns under `code` and falls
+    /// back.
+    pub(crate) fn miss<T>(
+        &self,
+        warnings: &mut Vec<VendorWarning>,
+        code: &'static str,
+        reason: String,
+    ) -> ServiceAttempt<T> {
+        if self.requires_service {
+            self.hard("vendor_prebuilt_required", reason)
+        } else {
+            warnings.push(VendorWarning::new(
+                code,
+                format!("{reason}; building locally instead"),
+            ));
+            ServiceAttempt::FallBack
+        }
+    }
+
+    /// The verified archive of a `Ready` outcome, or every other outcome
+    /// mapped onto the policy. `noun` names the artifact kind in messages
+    /// ("crate"); `subject` names this artifact ("crate for serde").
+    pub(crate) fn settle<T>(
+        &self,
+        artifact: ServiceArtifact,
+        noun: &str,
+        subject: &str,
+        warnings: &mut Vec<VendorWarning>,
+    ) -> Result<VerifiedArchive, ServiceAttempt<T>> {
+        match artifact {
+            ServiceArtifact::Ready(archive) => Ok(archive),
+            // Bytes that fail integrity verification are an active tamper
+            // signal: ALWAYS a hard error, in `auto` exactly as in `service`
+            // — never a quiet local-build fallback ([`ServiceArtifact`]'s
+            // documented contract).
+            ServiceArtifact::IntegrityMismatch(reason) => Err(self.hard(
+                "vendor_prebuilt_integrity_mismatch",
+                format!(
+                    "prebuilt {subject} failed integrity verification ({reason}); \
+                     refusing to fall back to a local build on tampered bytes"
+                ),
+            )),
+            ServiceArtifact::Pending => Err(self.miss(
+                warnings,
+                "vendor_prebuilt_pending",
+                format!("prebuilt {noun} is still building"),
+            )),
+            // The common, quiet miss: not built / free-only / not found.
+            ServiceArtifact::Unavailable(reason) if self.requires_service => Err(self.hard(
+                "vendor_prebuilt_required",
+                format!("prebuilt {noun} unavailable: {reason}"),
+            )),
+            ServiceArtifact::Unavailable(_) => Err(ServiceAttempt::FallBack),
+            ServiceArtifact::Failed(reason) => Err(self.miss(
+                warnings,
+                "vendor_prebuilt_unavailable",
+                format!("patch service request failed ({reason})"),
+            )),
+        }
+    }
+}
+
 /// Download + integrity-verify the prebuilt patched archive for the Tier-A
 /// backends, mapping each service outcome onto the `auto` / `service` fallback
 /// policy. `noun` is the artifact kind used in messages (".jar" / ".nupkg").
@@ -186,83 +285,39 @@ pub(crate) async fn service_archive_copy(
     if !cfg.service_enabled() {
         return ServiceCopy::FallBack;
     }
-    fn hard(code: &'static str, detail: String) -> ServiceCopy {
-        ServiceCopy::HardFail(Box::new(refused(code, detail)))
-    }
-    let miss = |warnings: &mut Vec<VendorWarning>, code: &'static str, reason: String| {
-        if cfg.source.requires_service() {
-            hard("vendor_prebuilt_required", reason)
-        } else {
-            warnings.push(VendorWarning::new(
-                code,
-                format!("{reason}; building locally instead"),
-            ));
-            ServiceCopy::FallBack
-        }
+    let policy = ServicePolicy::new(cfg, ServiceTerminal::Refused);
+    let fetched = fetch_verified_archive(cfg, &record.uuid).await;
+    let archive = match policy.settle(fetched, noun, noun, warnings) {
+        Ok(archive) => archive,
+        Err(attempt) => return attempt,
     };
-    match fetch_verified_archive(cfg, &record.uuid).await {
-        // The SRI proves the download is intact, not that it carries the
-        // patch: the bytes are written verbatim and reported AlreadyPatched,
-        // so every patched member must hash to its afterHash first (the
-        // Tier-B backends' extracted-tree check). Fail closed → `auto`
-        // falls back to the local rebuild.
-        ServiceArtifact::Ready(archive)
-            if !archive
-                .prestaged
-                .zip_verdict(&record.files)
-                .unwrap_or_else(|| zip_bytes_match_after_hashes(&archive.bytes, &record.files)) =>
-        {
-            miss(
-                warnings,
-                "vendor_prebuilt_layout_mismatch",
-                format!(
-                    "prebuilt {noun} for {name} does not carry the patched files at their \
-                     recorded paths"
-                ),
-            )
-        }
-        ServiceArtifact::Ready(archive) => {
-            warnings.push(VendorWarning::new(
-                "vendor_prebuilt_downloaded",
-                format!(
-                    "vendored {name} from the patch service ({})",
-                    archive.source_url
-                ),
-            ));
-            ServiceCopy::Used(archive.bytes)
-        }
-        // Bytes that fail integrity verification are an active tamper signal:
-        // ALWAYS a hard error, in `auto` exactly as in `service` — never a
-        // quiet local-build fallback ([`ServiceArtifact`]'s documented
-        // contract).
-        ServiceArtifact::IntegrityMismatch(reason) => hard(
-            "vendor_prebuilt_integrity_mismatch",
+    // The SRI proves the download is intact, not that it carries the
+    // patch: the bytes are written verbatim and reported AlreadyPatched,
+    // so every patched member must hash to its afterHash first (the
+    // Tier-B backends' extracted-tree check). Fail closed → `auto`
+    // falls back to the local rebuild.
+    if !archive
+        .prestaged
+        .zip_verdict(&record.files)
+        .unwrap_or_else(|| zip_bytes_match_after_hashes(&archive.bytes, &record.files))
+    {
+        return policy.miss(
+            warnings,
+            "vendor_prebuilt_layout_mismatch",
             format!(
-                "prebuilt {noun} failed integrity verification ({reason}); \
-                 refusing to fall back to a local build on tampered bytes"
+                "prebuilt {noun} for {name} does not carry the patched files at their \
+                 recorded paths"
             ),
-        ),
-        ServiceArtifact::Pending => miss(
-            warnings,
-            "vendor_prebuilt_pending",
-            format!("prebuilt {noun} is still building"),
-        ),
-        ServiceArtifact::Unavailable(reason) => {
-            if cfg.source.requires_service() {
-                hard(
-                    "vendor_prebuilt_required",
-                    format!("prebuilt {noun} unavailable: {reason}"),
-                )
-            } else {
-                ServiceCopy::FallBack
-            }
-        }
-        ServiceArtifact::Failed(reason) => miss(
-            warnings,
-            "vendor_prebuilt_unavailable",
-            format!("patch service request failed ({reason})"),
-        ),
+        );
     }
+    warnings.push(VendorWarning::new(
+        "vendor_prebuilt_downloaded",
+        format!(
+            "vendored {name} from the patch service ({})",
+            archive.source_url
+        ),
+    ));
+    ServiceCopy::Used(archive.bytes)
 }
 
 /// Outcome of fetching + verifying a named secondary artifact.
diff --git a/crates/socket-patch-core/src/vendor/vlt_lock.rs b/crates/socket-patch-core/src/vendor/vlt_lock.rs
index 49c708f5..ca95185c 100644
--- a/crates/socket-patch-core/src/vendor/vlt_lock.rs
+++ b/crates/socket-patch-core/src/vendor/vlt_lock.rs
@@ -1436,12 +1436,6 @@ pub async fn restore_vlt_uuid_metadata(
     super::npm_dir::restore_uuid_metadata(&project_root.join(uuid_dir)).await
 }
 
-/// Whether `text` passes the router sniff (a BOM-less JSON object
-/// with `lockfileVersion` 0 or 1).
-pub fn vlt_lock_sniff_ok(text: &str) -> bool {
-    sniff_vendor_lock(text).is_ok()
-}
-
 /// The importer package.json files of the project's canonical
 /// `vlt-lock.json`, project-relative: the root one plus every workspace
 /// importer its edges name. Just the root one when the lock is missing or
diff --git a/crates/socket-patch-core/src/vendor/vlt_lock_text.rs b/crates/socket-patch-core/src/vendor/vlt_lock_text.rs
index 214a47d0..e94386d9 100644
--- a/crates/socket-patch-core/src/vendor/vlt_lock_text.rs
+++ b/crates/socket-patch-core/src/vendor/vlt_lock_text.rs
@@ -779,10 +779,6 @@ impl EdgeEntry<'_> {
         self.value.rsplit_once(' ').map_or("", |(_, to)| to)
     }
 
-    pub(crate) fn entry_text(&self) -> String {
-        entry_text(self.key, self.raw_value)
-    }
-
     pub(crate) fn sort_key(&self) -> EdgeSortKey<'_> {
         EdgeSortKey {
             from: self.from(),
@@ -1999,7 +1995,7 @@ mod tests {
         assert_eq!(edge.entry.spec(), "^3.0.0 || ^4.0.0");
         assert_eq!(edge.entry.target(), "~npm~js-tokens@4.0.0");
         assert_eq!(
-            edge.entry.entry_text(),
+            entry_text(edge.entry.key, edge.entry.raw_value),
             "\"~npm~loose-envify@1.4.0 js-tokens\": \"prod ^3.0.0 || ^4.0.0 ~npm~js-tokens@4.0.0\""
         );
         let missing = parse_edge_line("    \"~npm~tap@15.2.3~peer.6f88d0ccf17dbbdc ts-node\": \"peerOptional >=8.5.2 MISSING\"")
diff --git a/crates/socket-patch-core/src/vendor/yarn_layering_tests.rs b/crates/socket-patch-core/src/vendor/yarn_layering_tests.rs
index f720bfd8..4e22591a 100644
--- a/crates/socket-patch-core/src/vendor/yarn_layering_tests.rs
+++ b/crates/socket-patch-core/src/vendor/yarn_layering_tests.rs
@@ -137,7 +137,6 @@ fn hosted_override() -> DepOverride {
         token: TOKEN.to_string(),
         patch_uuid: UUID.to_string(),
         artifact_url: HOSTED_URL.to_string(),
-        berry_zip_url: None,
         registry_override: None,
         integrity: Integrity {
             sha512: Some(HOSTED_SRI.to_string()),
@@ -926,7 +925,6 @@ async fn berry_hosted_redirect_leaves_builtin_patch_entries_untouched() {
         token: TOKEN.to_string(),
         patch_uuid: UUID.to_string(),
         artifact_url: hosted_url.clone(),
-        berry_zip_url: None,
         registry_override: None,
         integrity: Integrity {
             yarn_berry10c0: Some(
@@ -1009,7 +1007,6 @@ async fn berry_hosted_redirect_of_builtin_patched_package_skips_patch_entry() {
         token: TOKEN.to_string(),
         patch_uuid: UUID.to_string(),
         artifact_url: hosted_url.clone(),
-        berry_zip_url: None,
         registry_override: None,
         integrity: Integrity {
             yarn_berry10c0: Some(format!("10c0/{}", "f".repeat(128))),
diff --git a/crates/socket-patch-core/src/vex/discover/bun.rs b/crates/socket-patch-core/src/vex/discover/bun.rs
index ed2ed694..d20b08a5 100644
--- a/crates/socket-patch-core/src/vex/discover/bun.rs
+++ b/crates/socket-patch-core/src/vex/discover/bun.rs
@@ -887,7 +887,6 @@ mod tests {
             token: TOKEN.into(),
             patch_uuid: uuid.into(),
             artifact_url,
-            berry_zip_url: None,
             registry_override: None,
             integrity: Integrity {
                 sha512: Some(SRI.into()),
diff --git a/crates/socket-patch-core/src/vex/discover/npm.rs b/crates/socket-patch-core/src/vex/discover/npm.rs
index 3dbfcc55..8c13232a 100644
--- a/crates/socket-patch-core/src/vex/discover/npm.rs
+++ b/crates/socket-patch-core/src/vex/discover/npm.rs
@@ -1042,7 +1042,6 @@ mod tests {
             token: TOKEN.into(),
             patch_uuid: uuid.into(),
             artifact_url: url,
-            berry_zip_url: None,
             registry_override: None,
             integrity: Integrity {
                 sha512: Some(PNPM_SRI.into()),
diff --git a/crates/socket-patch-core/tests/blob_fetcher_edges_e2e.rs b/crates/socket-patch-core/tests/blob_fetcher_edges_e2e.rs
index a4591bd5..cc11c8dc 100644
--- a/crates/socket-patch-core/tests/blob_fetcher_edges_e2e.rs
+++ b/crates/socket-patch-core/tests/blob_fetcher_edges_e2e.rs
@@ -181,7 +181,6 @@ async fn fetch_missing_sources_diff_mode_with_no_diffs_path() {
     std::fs::create_dir(&blobs).unwrap();
     let sources = PatchSources {
         blobs_path: &blobs,
-        packages_path: None,
         diffs_path: None,
         mem_blobs: None,
     };
@@ -581,7 +580,6 @@ async fn fetch_missing_sources_diff_downloads_and_writes_archive() {
     std::fs::create_dir(&diffs).unwrap();
     let sources = PatchSources {
         blobs_path: &blobs,
-        packages_path: None,
         diffs_path: Some(&diffs),
         mem_blobs: None,
     };
@@ -634,7 +632,6 @@ async fn fetch_missing_sources_diff_404_is_failure_with_kind_message() {
     std::fs::create_dir(&diffs).unwrap();
     let sources = PatchSources {
         blobs_path: &blobs,
-        packages_path: None,
         diffs_path: Some(&diffs),
         mem_blobs: None,
     };
@@ -677,7 +674,6 @@ async fn fetch_missing_sources_diff_invokes_progress_callback() {
     std::fs::create_dir(&diffs).unwrap();
     let sources = PatchSources {
         blobs_path: &blobs,
-        packages_path: None,
         diffs_path: Some(&diffs),
         mem_blobs: None,
     };
diff --git a/crates/socket-patch-core/tests/covgap_api_blob_fetcher.rs b/crates/socket-patch-core/tests/covgap_api_blob_fetcher.rs
index 460bb2e6..1e0bc614 100644
--- a/crates/socket-patch-core/tests/covgap_api_blob_fetcher.rs
+++ b/crates/socket-patch-core/tests/covgap_api_blob_fetcher.rs
@@ -238,7 +238,6 @@ async fn fetch_missing_sources_diff_uncreatable_archives_dir_is_per_archive_writ
     let diffs = notadir.join("diffs");
     let sources = PatchSources {
         blobs_path: &blobs,
-        packages_path: None,
         diffs_path: Some(&diffs),
         mem_blobs: None,
     };
@@ -469,7 +468,6 @@ async fn fetch_missing_sources_diff_disk_write_failure_is_per_archive_failure()
 
     let sources = PatchSources {
         blobs_path: &blobs,
-        packages_path: None,
         diffs_path: Some(&diffs),
         mem_blobs: None,
     };
diff --git a/crates/socket-patch-core/tests/covgap_patch_apply.rs b/crates/socket-patch-core/tests/covgap_patch_apply.rs
index e04849ce..9056c458 100644
--- a/crates/socket-patch-core/tests/covgap_patch_apply.rs
+++ b/crates/socket-patch-core/tests/covgap_patch_apply.rs
@@ -60,7 +60,6 @@ async fn apply_foo(root: &Path, primary: &Path) -> socket_patch_core::patch::app
     );
     let sources = PatchSources {
         blobs_path: &blobs,
-        packages_path: None,
         diffs_path: None,
         mem_blobs: None,
     };
diff --git a/crates/socket-patch-core/tests/covgap_vendor_nuget_feed.rs b/crates/socket-patch-core/tests/covgap_vendor_nuget_feed.rs
index 5f712da1..b4eb5baa 100644
--- a/crates/socket-patch-core/tests/covgap_vendor_nuget_feed.rs
+++ b/crates/socket-patch-core/tests/covgap_vendor_nuget_feed.rs
@@ -66,7 +66,6 @@ async fn stage_tempdir_creation_failure_is_reported_not_fatal() {
     };
     let sources = PatchSources {
         blobs_path: &blobs,
-        packages_path: None,
         diffs_path: None,
         mem_blobs: None,
     };
diff --git a/crates/socket-patch-core/tests/crawler_npm_e2e.rs b/crates/socket-patch-core/tests/crawler_npm_e2e.rs
index d3fbc903..226b9b47 100644
--- a/crates/socket-patch-core/tests/crawler_npm_e2e.rs
+++ b/crates/socket-patch-core/tests/crawler_npm_e2e.rs
@@ -2172,7 +2172,6 @@ async fn apply_and_rollback_reach_every_pnpm_peer_variant_copy() {
 
     let sources = PatchSources {
         blobs_path: &blobs,
-        packages_path: None,
         diffs_path: None,
         mem_blobs: None,
     };
@@ -2282,7 +2281,6 @@ async fn apply_heals_unpatched_pnpm_twin_when_primary_already_patched() {
     );
     let sources = PatchSources {
         blobs_path: &blobs,
-        packages_path: None,
         diffs_path: None,
         mem_blobs: None,
     };
@@ -3082,7 +3080,6 @@ async fn vlt_apply(
     use socket_patch_core::patch::apply::{apply_package_patch, MismatchPolicy, PatchSources};
     let sources = PatchSources {
         blobs_path: &patch.blobs,
-        packages_path: None,
         diffs_path: None,
         mem_blobs: None,
     };
diff --git a/crates/socket-patch-core/tests/pnpm_hosted.rs b/crates/socket-patch-core/tests/pnpm_hosted.rs
index 00f58eea..33a07f3a 100644
--- a/crates/socket-patch-core/tests/pnpm_hosted.rs
+++ b/crates/socket-patch-core/tests/pnpm_hosted.rs
@@ -15,7 +15,6 @@ fn dep(name: &str) -> DepOverride {
         token: "token".into(),
         patch_uuid: "patch-id".into(),
         artifact_url: "https://patch.example/left-pad-1.3.0.tgz".into(),
-        berry_zip_url: None,
         registry_override: None,
         integrity: Integrity {
             sha512: Some("sha512-PATCHED==".into()),
diff --git a/crates/socket-patch-core/tests/poetry_hosted.rs b/crates/socket-patch-core/tests/poetry_hosted.rs
index 80fae366..bd3ca3c8 100644
--- a/crates/socket-patch-core/tests/poetry_hosted.rs
+++ b/crates/socket-patch-core/tests/poetry_hosted.rs
@@ -29,7 +29,6 @@ fn patch() -> DepOverride {
         token: "7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e".into(),
         patch_uuid: "e828efa5-5c6d-43f3-9909-03f5ac232b98".into(),
         artifact_url: URL.into(),
-        berry_zip_url: None,
         registry_override: None,
         integrity: Integrity {
             sha256: Some("a".repeat(64)),
diff --git a/crates/socket-patch-core/tests/telemetry_helpers_e2e.rs b/crates/socket-patch-core/tests/telemetry_helpers_e2e.rs
index 1b600a92..33c34297 100644
--- a/crates/socket-patch-core/tests/telemetry_helpers_e2e.rs
+++ b/crates/socket-patch-core/tests/telemetry_helpers_e2e.rs
@@ -5,7 +5,7 @@
 //! and the home-dir redaction were uncovered.
 //!
 //! Hardening notes: every disable-gate test runs inside `with_clean_env`,
-//! which scrubs ALL four disabling vars first. Each test then proves
+//! which scrubs ALL three disabling vars first. Each test then proves
 //! *causation*, not mere correlation:
 //!   1. clean env => NOT disabled  (kills an always-`true` impl + ambient
 //!      `SOCKET_OFFLINE=1` masking the result),
@@ -20,7 +20,6 @@ use socket_patch_core::telemetry::{is_telemetry_disabled, sanitize_error_message
 /// Scrubbing the full set is what makes the per-var causation asserts honest.
 const DISABLE_VARS: &[&str] = &[
     "SOCKET_TELEMETRY_DISABLED",
-    "SOCKET_PATCH_TELEMETRY_DISABLED",
     "VITEST",
     "SOCKET_OFFLINE",
 ];
@@ -148,32 +147,6 @@ fn telemetry_not_disabled_when_vitest_is_not_literal_true() {
     });
 }
 
-#[test]
-#[serial]
-fn telemetry_disabled_legacy_socket_patch_var_honored() {
-    with_clean_env(|| {
-        assert!(!is_telemetry_disabled(), "baseline must be enabled");
-        // Both accepted spellings of the legacy var must work on their own,
-        // with the new var name absent.
-        for v in ["1", "true"] {
-            std::env::set_var("SOCKET_PATCH_TELEMETRY_DISABLED", v);
-            assert!(
-                std::env::var("SOCKET_TELEMETRY_DISABLED").is_err(),
-                "precondition: new var must be unset so legacy is the only cause"
-            );
-            assert!(
-                is_telemetry_disabled(),
-                "legacy SOCKET_PATCH_TELEMETRY_DISABLED={v:?} must still disable"
-            );
-            std::env::remove_var("SOCKET_PATCH_TELEMETRY_DISABLED");
-            assert!(
-                !is_telemetry_disabled(),
-                "removing legacy var must re-enable telemetry"
-            );
-        }
-    });
-}
-
 #[test]
 #[serial]
 fn telemetry_disabled_when_socket_offline_eq_1() {
diff --git a/crates/socket-patch-core/tests/uv_hosted.rs b/crates/socket-patch-core/tests/uv_hosted.rs
index 81428d28..9a2526cd 100644
--- a/crates/socket-patch-core/tests/uv_hosted.rs
+++ b/crates/socket-patch-core/tests/uv_hosted.rs
@@ -13,7 +13,6 @@ fn patch(name: &str) -> DepOverride {
         token: "11111111-1111-4111-8111-111111111111".into(),
         patch_uuid: "22222222-2222-4222-8222-222222222222".into(),
         artifact_url: format!("https://patch.socket.dev/pkg/{name}-1.0.0-py3-none-any.whl"),
-        berry_zip_url: None,
         registry_override: None,
         integrity: Integrity {
             sha256: Some("a".repeat(64)),
diff --git a/crates/socket-patch-core/tests/vlt_locks.rs b/crates/socket-patch-core/tests/vlt_locks.rs
index e3d67008..ae77dfe1 100644
--- a/crates/socket-patch-core/tests/vlt_locks.rs
+++ b/crates/socket-patch-core/tests/vlt_locks.rs
@@ -547,7 +547,6 @@ fn stage(case: &Case, crlf: bool) -> Staged {
 async fn vendor(case: &Case, staged: &Staged) -> VendorOutcome {
     let sources = PatchSources {
         blobs_path: &staged.blobs,
-        packages_path: None,
         diffs_path: None,
         mem_blobs: None,
     };

From b97a1c24f95c6de21e6feaa794a17916fc2cae75 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Tue, 29 Sep 2026 11:18:04 +0200
Subject: [PATCH 26/32] v5 tests: one suite per command, retire #257 oracles
 (#297)

* Pin the #257 oracle sweeps with golden digests

The randomized equivalence sweeps that compare the blocking-pool
crawlers and single-pass rewriters with their pre-#257 oracles now
also record, per case, a digest of the generated input and of the
output both implementations agreed on, in
crates/socket-patch-core/tests/equivalence/*.golden. The oracles
still run, so every recorded output is proven equal to the oracle's.
The next commit deletes the oracles and keeps the goldens.

The crawler goldens were blessed on Linux as a non-root user: the
sweeps strip permissions and plant symlinks, so they replay only
there (other platforms and root still run the sweeps, without the
golden comparison).

Also moves the crawler sweeps' xorshift test RNG to
crate::test_rng, and renames crawlers::oracle_support to
crawlers::test_tree.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N9YdJqaGiT9Jf5LN1hDFhB

* Retire the #257 crawler and rewriter oracles

The equivalence sweeps now replay against the golden digests pinned
in the previous commit instead of re-running the verbatim previous
implementations: the crawler oracles (cargo, composer, go, maven,
npm, nuget, python), the hosted rewriter oracles and the reference
POM parser are deleted. Every sweep still generates the same inputs
from the same seeds, so a changed output is still caught per case.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N9YdJqaGiT9Jf5LN1hDFhB

* Pin the pdm and poetry rewrites by golden

The pdm plan, pdm and poetry parse-reuse rewrites were checked
against #257's verbatim fresh-parse implementations. Their sweeps
now record per-case digests, blessed while those oracles still
agreed with production, and the oracles are deleted.

Golden keys with whitespace are normalized so a case label can
never split a golden line.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N9YdJqaGiT9Jf5LN1hDFhB

* Merge 67 CLI test binaries into command suites

The subprocess-only integration tests for apply, get, remove,
rollback, repair, scan, vendor, update and the global CLI now build
as one binary per command instead of 67, so CI links and runs 58
fewer test binaries. Each file keeps its name as a module, and the
shared helpers are declared once per suite, so their self-tests run
once per suite instead of once per file.

Binaries a workflow names, the docker e2e suites, crawl_fd_limit_e2e
and the in-process suites (which share process-global notice and
config state) stay separate. Doc links to the moved files are
updated.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N9YdJqaGiT9Jf5LN1hDFhB

* Point docs at the merged test suites

Rows that named a moved test binary now name its suite and module.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N9YdJqaGiT9Jf5LN1hDFhB

* Keep the crawler oracles

A crawler's output follows the directory order the filesystem hands
back, which differs between filesystems: every crawler golden blessed
on ext4 failed when replayed on tmpfs, and macOS and Windows skipped
them. The per-call oracles walk the same tree as the crawler, so they
check the parallel walk on every platform; restore them and drop the
crawler goldens. The rewriter goldens are pure text and stay.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N9YdJqaGiT9Jf5LN1hDFhB

---------

Co-authored-by: Claude <noreply@anthropic.com>
---
 CHANGELOG.md                                  |   2 +-
 crates/socket-patch-cli/CLI_CONTRACT.md       |   8 +-
 .../socket-patch-cli/src/commands/scan/mod.rs |   2 +-
 .../tests/{ => apply}/apply_invariants.rs     |   6 +-
 .../tests/{ => apply}/apply_network.rs        |   0
 .../cli_gem_variant_mismatch_policy.rs        |   0
 .../{ => apply}/covgap_commands_apply.rs      |   3 +-
 .../{ => apply}/e2e_safety_advisories.rs      |   3 +-
 .../in_process_gem_config_warning.rs          |   0
 .../in_process_gem_fallback_home.rs           |   0
 .../{ => apply}/in_process_gem_multicopy.rs   |   0
 .../{ => apply}/in_process_npm_multicopy.rs   |   0
 .../in_process_variant_apply_failure.rs       |   0
 crates/socket-patch-cli/tests/apply/main.rs   |  21 +
 .../tests/{ => cli}/api_client_errors_e2e.rs  |   0
 .../tests/{ => cli}/cli_dry_run_paths_e2e.rs  |   0
 .../tests/{ => cli}/covgap_api_client.rs      |   0
 .../tests/{ => cli}/covgap_commands_list.rs   |   9 +-
 .../tests/{ => cli}/covgap_output.rs          |   5 +-
 .../{ => cli}/interactive_prompts_e2e.rs      |   2 -
 crates/socket-patch-cli/tests/cli/main.rs     |  21 +
 .../tests/{ => cli}/output_modes_e2e.rs       |   3 +-
 .../tests/{ => cli}/telemetry_e2e.rs          |   0
 .../tests/{ => get}/cli_get_silent_errors.rs  |   3 +-
 .../{ => get}/coverage_fix_get_double_json.rs |   3 +-
 .../tests/{ => get}/get_batch_paths_e2e.rs    |   0
 .../tests/{ => get}/get_edge_cases_e2e.rs     |   3 +-
 .../tests/{ => get}/get_invariants.rs         |   3 +-
 .../tests/{ => get}/get_modes_e2e.rs          |  13 +-
 .../get_nested_apply_api_flags_e2e.rs         |   3 +-
 .../tests/{ => get}/get_update_summary_e2e.rs |   3 +-
 .../tests/{ => get}/global_packages_e2e.rs    |   3 +-
 crates/socket-patch-cli/tests/get/main.rs     |  21 +
 .../{ => remove}/covgap_commands_remove.rs    |  11 +-
 crates/socket-patch-cli/tests/remove/main.rs  |  17 +
 .../{ => remove}/remove_duality_invariants.rs |   9 +-
 .../tests/{ => remove}/remove_invariants.rs   |   9 +-
 .../tests/{ => remove}/remove_network.rs      |   0
 .../coverage_fix_repair_vendor_predelete.rs   |   0
 .../{ => repair}/covgap_commands_repair.rs    |   0
 .../covgap_commands_repair_vendor.rs          |   4 -
 crates/socket-patch-cli/tests/repair/main.rs  |  26 +
 .../tests/{ => repair}/repair_invariants.rs   |   0
 .../tests/{ => repair}/repair_vendor_e2e.rs   |  12 +-
 .../{ => repair}/repair_vendor_flavors_e2e.rs |   8 +-
 .../{ => rollback}/cli_rollback_silent.rs     |   0
 .../socket-patch-cli/tests/rollback/main.rs   |  13 +
 .../rollback_duality_invariants.rs            |   0
 .../{ => rollback}/rollback_invariants.rs     |   6 +-
 .../rollback_multicopy_blob_gate.rs           |   0
 ...erage_fix_scan_discovery_corrupt_ledger.rs |   0
 .../{ => scan}/covgap_commands_fetch_stage.rs |   0
 .../covgap_commands_scan_vendor_flow.rs       |   6 +-
 .../{ => scan}/covgap_ecosystem_dispatch.rs   |   0
 .../{ => scan}/hosted_management_refusals.rs  |   0
 .../{ => scan}/hosted_symlinked_files.rs      |   6 +-
 .../{ => scan}/hosted_wheel_metadata_order.rs |   3 +-
 crates/socket-patch-cli/tests/scan/main.rs    |  25 +
 .../tests/{ => scan}/scan_batch_sizing_e2e.rs |   0
 .../{ => scan}/scan_ecosystems_scope_e2e.rs   |   0
 .../tests/{ => scan}/scan_invariants.rs       |   6 +-
 .../scan_ordered_concurrency_e2e.rs           |   0
 .../tests/{ => scan}/scan_paths_e2e.rs        |   0
 .../tests/{ => scan}/scan_sync_e2e.rs         |   0
 .../{ => scan}/scan_vendor_step_error_e2e.rs  |   0
 .../{ => update}/covgap_commands_update.rs    |   8 +-
 .../{ => update}/covgap_update_download.rs    |   6 +-
 .../tests/{ => update}/covgap_update_swap.rs  |   5 +-
 crates/socket-patch-cli/tests/update/main.rs  |  16 +
 .../{ => update}/self_update_channels_e2e.rs  |   6 +-
 .../tests/{ => update}/update_notifier_e2e.rs |   6 +-
 .../docker_vendor_common_selftest.rs          |   3 +-
 .../tests/{ => vendor}/e2e_golang_redirect.rs |   3 +-
 .../{ => vendor}/in_process_vendor_bun.rs     |   6 +-
 crates/socket-patch-cli/tests/vendor/main.rs  |  18 +
 .../{ => vendor}/redirect_npm_allow_remote.rs |   3 +-
 .../vendor_gem_lockfile_only_e2e.rs           |   0
 .../vendor_pristine_fetch_order_e2e.rs        |   0
 .../vendor_rerun_no_network_e2e.rs            |   0
 .../crawlers/maven_pom_equivalence_tests.rs   | 310 +------
 crates/socket-patch-core/src/golden.rs        | 210 +++++
 crates/socket-patch-core/src/lib.rs           |   5 +
 .../redirect/cargo_lock_equivalence_tests.rs  | 369 +-------
 .../redirect/composer_equivalence_tests.rs    | 347 +------
 .../redirect/golang_equivalence_tests.rs      | 434 +--------
 .../redirect/lock_index_equivalence_tests.rs  | 356 +------
 .../src/patch/redirect/mod.rs                 |  11 +-
 .../src/patch/redirect/pdm.rs                 | 199 +---
 .../patch/redirect/pnpm_equivalence_tests.rs  | 287 +-----
 .../src/patch/redirect/poetry.rs              | 142 +--
 .../redirect/python_lock_equivalence_tests.rs | 268 +-----
 .../patch/redirect/rewrite_oracle_support.rs  | 125 ---
 crates/socket-patch-core/src/test_rng.rs      |  35 +
 .../socket-patch-core/src/utils/pdm_lock.rs   | 201 +---
 .../src/utils/poetry_lock.rs                  | 215 +----
 .../src/utils/python_lock.rs                  |   4 -
 .../src/utils/python_lock_oracle.rs           | 239 -----
 .../cargo_lock_hand_written.golden            |  34 +
 .../tests/equivalence/cargo_lock_large.golden |  28 +
 .../equivalence/cargo_lock_random.golden      | 260 ++++++
 .../composer_json_object_end.golden           |  92 ++
 .../equivalence/composer_lock_rewrite.golden  | 302 ++++++
 .../tests/equivalence/golang_rewrite.golden   | 302 ++++++
 .../equivalence/maven_pom_project.golden      | 202 ++++
 .../tests/equivalence/maven_pom_random.golden | 202 ++++
 .../tests/equivalence/npm_lock_rewrite.golden | 202 ++++
 .../equivalence/pdm_lock_reused_parse.golden  | 602 ++++++++++++
 .../tests/equivalence/pdm_plan.golden         | 352 +++++++
 .../pdm_rewrite_shared_parse.golden           | 122 +++
 .../equivalence/pnpm_depscan_sized.golden     |   3 +
 .../pnpm_duplicate_override.golden            |   4 +
 .../equivalence/pnpm_peer_suffixed.golden     |   3 +
 .../tests/equivalence/pnpm_random.golden      | 302 ++++++
 .../poetry_lock_reused_parse.golden           | 872 ++++++++++++++++++
 .../tests/equivalence/poetry_rewrite.golden   | 122 +++
 .../equivalence/python_lock_refusal.golden    |   6 +
 .../equivalence/python_lock_rewrite.golden    | 302 ++++++
 .../equivalence/yarn_classic_rewrite.golden   | 202 ++++
 .../nuget-vendoring-research/code-map.md      |   2 +-
 docs/design/repacking-to-depscan.md           |   2 +-
 docs/testing/bun-compatibility.md             |  12 +-
 docs/testing/vlt-compatibility.md             |   2 +-
 tests/docker/fixtures/npm/README.md           |   2 +-
 123 files changed, 5325 insertions(+), 3349 deletions(-)
 rename crates/socket-patch-cli/tests/{ => apply}/apply_invariants.rs (99%)
 rename crates/socket-patch-cli/tests/{ => apply}/apply_network.rs (100%)
 rename crates/socket-patch-cli/tests/{ => apply}/cli_gem_variant_mismatch_policy.rs (100%)
 rename crates/socket-patch-cli/tests/{ => apply}/covgap_commands_apply.rs (99%)
 rename crates/socket-patch-cli/tests/{ => apply}/e2e_safety_advisories.rs (99%)
 rename crates/socket-patch-cli/tests/{ => apply}/in_process_gem_config_warning.rs (100%)
 rename crates/socket-patch-cli/tests/{ => apply}/in_process_gem_fallback_home.rs (100%)
 rename crates/socket-patch-cli/tests/{ => apply}/in_process_gem_multicopy.rs (100%)
 rename crates/socket-patch-cli/tests/{ => apply}/in_process_npm_multicopy.rs (100%)
 rename crates/socket-patch-cli/tests/{ => apply}/in_process_variant_apply_failure.rs (100%)
 create mode 100644 crates/socket-patch-cli/tests/apply/main.rs
 rename crates/socket-patch-cli/tests/{ => cli}/api_client_errors_e2e.rs (100%)
 rename crates/socket-patch-cli/tests/{ => cli}/cli_dry_run_paths_e2e.rs (100%)
 rename crates/socket-patch-cli/tests/{ => cli}/covgap_api_client.rs (100%)
 rename crates/socket-patch-cli/tests/{ => cli}/covgap_commands_list.rs (98%)
 rename crates/socket-patch-cli/tests/{ => cli}/covgap_output.rs (99%)
 rename crates/socket-patch-cli/tests/{ => cli}/interactive_prompts_e2e.rs (99%)
 create mode 100644 crates/socket-patch-cli/tests/cli/main.rs
 rename crates/socket-patch-cli/tests/{ => cli}/output_modes_e2e.rs (99%)
 rename crates/socket-patch-cli/tests/{ => cli}/telemetry_e2e.rs (100%)
 rename crates/socket-patch-cli/tests/{ => get}/cli_get_silent_errors.rs (99%)
 rename crates/socket-patch-cli/tests/{ => get}/coverage_fix_get_double_json.rs (98%)
 rename crates/socket-patch-cli/tests/{ => get}/get_batch_paths_e2e.rs (100%)
 rename crates/socket-patch-cli/tests/{ => get}/get_edge_cases_e2e.rs (99%)
 rename crates/socket-patch-cli/tests/{ => get}/get_invariants.rs (99%)
 rename crates/socket-patch-cli/tests/{ => get}/get_modes_e2e.rs (99%)
 rename crates/socket-patch-cli/tests/{ => get}/get_nested_apply_api_flags_e2e.rs (99%)
 rename crates/socket-patch-cli/tests/{ => get}/get_update_summary_e2e.rs (99%)
 rename crates/socket-patch-cli/tests/{ => get}/global_packages_e2e.rs (99%)
 create mode 100644 crates/socket-patch-cli/tests/get/main.rs
 rename crates/socket-patch-cli/tests/{ => remove}/covgap_commands_remove.rs (99%)
 create mode 100644 crates/socket-patch-cli/tests/remove/main.rs
 rename crates/socket-patch-cli/tests/{ => remove}/remove_duality_invariants.rs (99%)
 rename crates/socket-patch-cli/tests/{ => remove}/remove_invariants.rs (99%)
 rename crates/socket-patch-cli/tests/{ => remove}/remove_network.rs (100%)
 rename crates/socket-patch-cli/tests/{ => repair}/coverage_fix_repair_vendor_predelete.rs (100%)
 rename crates/socket-patch-cli/tests/{ => repair}/covgap_commands_repair.rs (100%)
 rename crates/socket-patch-cli/tests/{ => repair}/covgap_commands_repair_vendor.rs (99%)
 create mode 100644 crates/socket-patch-cli/tests/repair/main.rs
 rename crates/socket-patch-cli/tests/{ => repair}/repair_invariants.rs (100%)
 rename crates/socket-patch-cli/tests/{ => repair}/repair_vendor_e2e.rs (99%)
 rename crates/socket-patch-cli/tests/{ => repair}/repair_vendor_flavors_e2e.rs (99%)
 rename crates/socket-patch-cli/tests/{ => rollback}/cli_rollback_silent.rs (100%)
 create mode 100644 crates/socket-patch-cli/tests/rollback/main.rs
 rename crates/socket-patch-cli/tests/{ => rollback}/rollback_duality_invariants.rs (100%)
 rename crates/socket-patch-cli/tests/{ => rollback}/rollback_invariants.rs (99%)
 rename crates/socket-patch-cli/tests/{ => rollback}/rollback_multicopy_blob_gate.rs (100%)
 rename crates/socket-patch-cli/tests/{ => scan}/coverage_fix_scan_discovery_corrupt_ledger.rs (100%)
 rename crates/socket-patch-cli/tests/{ => scan}/covgap_commands_fetch_stage.rs (100%)
 rename crates/socket-patch-cli/tests/{ => scan}/covgap_commands_scan_vendor_flow.rs (99%)
 rename crates/socket-patch-cli/tests/{ => scan}/covgap_ecosystem_dispatch.rs (100%)
 rename crates/socket-patch-cli/tests/{ => scan}/hosted_management_refusals.rs (100%)
 rename crates/socket-patch-cli/tests/{ => scan}/hosted_symlinked_files.rs (99%)
 rename crates/socket-patch-cli/tests/{ => scan}/hosted_wheel_metadata_order.rs (99%)
 create mode 100644 crates/socket-patch-cli/tests/scan/main.rs
 rename crates/socket-patch-cli/tests/{ => scan}/scan_batch_sizing_e2e.rs (100%)
 rename crates/socket-patch-cli/tests/{ => scan}/scan_ecosystems_scope_e2e.rs (100%)
 rename crates/socket-patch-cli/tests/{ => scan}/scan_invariants.rs (99%)
 rename crates/socket-patch-cli/tests/{ => scan}/scan_ordered_concurrency_e2e.rs (100%)
 rename crates/socket-patch-cli/tests/{ => scan}/scan_paths_e2e.rs (100%)
 rename crates/socket-patch-cli/tests/{ => scan}/scan_sync_e2e.rs (100%)
 rename crates/socket-patch-cli/tests/{ => scan}/scan_vendor_step_error_e2e.rs (100%)
 rename crates/socket-patch-cli/tests/{ => update}/covgap_commands_update.rs (99%)
 rename crates/socket-patch-cli/tests/{ => update}/covgap_update_download.rs (96%)
 rename crates/socket-patch-cli/tests/{ => update}/covgap_update_swap.rs (98%)
 create mode 100644 crates/socket-patch-cli/tests/update/main.rs
 rename crates/socket-patch-cli/tests/{ => update}/self_update_channels_e2e.rs (99%)
 rename crates/socket-patch-cli/tests/{ => update}/update_notifier_e2e.rs (99%)
 rename crates/socket-patch-cli/tests/{ => vendor}/docker_vendor_common_selftest.rs (98%)
 rename crates/socket-patch-cli/tests/{ => vendor}/e2e_golang_redirect.rs (99%)
 rename crates/socket-patch-cli/tests/{ => vendor}/in_process_vendor_bun.rs (99%)
 create mode 100644 crates/socket-patch-cli/tests/vendor/main.rs
 rename crates/socket-patch-cli/tests/{ => vendor}/redirect_npm_allow_remote.rs (99%)
 rename crates/socket-patch-cli/tests/{ => vendor}/vendor_gem_lockfile_only_e2e.rs (100%)
 rename crates/socket-patch-cli/tests/{ => vendor}/vendor_pristine_fetch_order_e2e.rs (100%)
 rename crates/socket-patch-cli/tests/{ => vendor}/vendor_rerun_no_network_e2e.rs (100%)
 create mode 100644 crates/socket-patch-core/src/golden.rs
 delete mode 100644 crates/socket-patch-core/src/patch/redirect/rewrite_oracle_support.rs
 create mode 100644 crates/socket-patch-core/src/test_rng.rs
 delete mode 100644 crates/socket-patch-core/src/utils/python_lock_oracle.rs
 create mode 100644 crates/socket-patch-core/tests/equivalence/cargo_lock_hand_written.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/cargo_lock_large.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/cargo_lock_random.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/composer_json_object_end.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/composer_lock_rewrite.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/golang_rewrite.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/maven_pom_project.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/maven_pom_random.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/npm_lock_rewrite.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/pdm_lock_reused_parse.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/pdm_plan.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/pdm_rewrite_shared_parse.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/pnpm_depscan_sized.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/pnpm_duplicate_override.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/pnpm_peer_suffixed.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/pnpm_random.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/poetry_lock_reused_parse.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/poetry_rewrite.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/python_lock_refusal.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/python_lock_rewrite.golden
 create mode 100644 crates/socket-patch-core/tests/equivalence/yarn_classic_rewrite.golden

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 635838ec..2c45ee7c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2793,7 +2793,7 @@ and regression tests were added throughout (the lib + integration suites grow by
 
 ### Tests
 
-- New `tests/telemetry_e2e.rs` end-to-end behavioral coverage:
+- New `tests/cli/telemetry_e2e.rs` end-to-end behavioral coverage:
   apply/scan/get/list emit telemetry against a wiremock recorder;
   `SOCKET_OFFLINE=1` produces zero telemetry POSTs across all four;
   scan falls back on 401 + tags the resulting event; scan does NOT
diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index 9eb0c4af..c9af4822 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -134,7 +134,7 @@ For a **9.0 root lock**, the CLI ensures `pnpm-workspace.yaml` carries `trustLoc
 
 `scan --sync` is sugar for `--mode agent --prune` — the canonical single-flag agent-mode bot invocation. `scan --json --sync` discovers, applies, and reconciles state in one pass.
 
-**`scan --ecosystems` scopes the crawl (v5.0)**: without `--prune`/`--sync`, a `scan` given `--ecosystems`/`-e` runs only the named ecosystems' crawlers — everything the run counts, queries and shows (`scannedPackages`, the batch query, `packages[]`, the table, `updates[]`, `wiringLive`, the `gem_bundle_config_path_ignored` warning) was already narrowed to them, so the skipped crawls could only be filtered away. The one visible difference: `lockfileOnlyPackages` (and the human "not yet installed" note) counts only the selected ecosystems' lockfile-only entries (a skipped crawl cannot vouch for another ecosystem's uninstalled lockfile entries). A GC run (`--prune`, or `--sync`, which implies it — in every mode, hosted included) still crawls every ecosystem, because the prune judges each manifest entry against the FULL installed set (see `scan --prune` above); its output, `lockfileOnlyPackages` included, is unchanged. Without `--ecosystems` nothing changes. Pinned by `tests/scan_ecosystems_scope_e2e.rs`.
+**`scan --ecosystems` scopes the crawl (v5.0)**: without `--prune`/`--sync`, a `scan` given `--ecosystems`/`-e` runs only the named ecosystems' crawlers — everything the run counts, queries and shows (`scannedPackages`, the batch query, `packages[]`, the table, `updates[]`, `wiringLive`, the `gem_bundle_config_path_ignored` warning) was already narrowed to them, so the skipped crawls could only be filtered away. The one visible difference: `lockfileOnlyPackages` (and the human "not yet installed" note) counts only the selected ecosystems' lockfile-only entries (a skipped crawl cannot vouch for another ecosystem's uninstalled lockfile entries). A GC run (`--prune`, or `--sync`, which implies it — in every mode, hosted included) still crawls every ecosystem, because the prune judges each manifest entry against the FULL installed set (see `scan --prune` above); its output, `lockfileOnlyPackages` included, is unchanged. Without `--ecosystems` nothing changes. Pinned by `tests/scan/scan_ecosystems_scope_e2e.rs`.
 
 **Path-scoped scans (`scan [PATHS]...`, v5.0)**: what a PATH means depends on the mode.
 
@@ -161,9 +161,9 @@ The rewriter reads a fixed set of candidate files from the project root: the npm
 **get --mode and installed narrowing (v3.6).** `get <identifier> --mode hosted|vendored` consumes the resolved patch(es) through the SAME engines as `scan --mode hosted|vendored`, so for the same selected (purl, uuid) set the on-disk result is identical by construction — the per-advisory selector for hosted/vendored (`get <id> --save-only` then `vendor` still works). **Agent mode (v5.0 lock + residue rules)**: the download phase runs under `<.socket>/apply.lock` and hands the guard to the nested apply, so download → manifest write → apply is one lock window (the nested apply never re-acquires and inherits every caller flag — `--lock-timeout` and `--verbose` included); a failed acquire is `{status: "error", errorCode: "lock_held" | "lock_io", error}` on get's legacy envelope, exit 1, before any fetch (a read-only `.socket/` fails here, naming the lock path). `.socket/` and `.socket/blobs/` are created only when a record is actually persisted — an all-skipped or all-failed run leaves no `.socket/` on a fresh project — and a same-uuid `get <uuid>` re-run rewrites neither the manifest nor the blobs. Semantics:
 
 * **Hosted** (`get GHSA-… --mode hosted`): resolves the advisory, then hands the selected (purl, uuid) pairs to scan's hosted engine — reference grants, cross-mode takeover pre-revert, lockfile rewrite (no ledger, v5.0), gem stale-install probe, warnings, confirmation rules (cargo via `confirmed_cargo_uuids`, golang via `confirmed_golang_uuids` only) all identical to `scan --mode hosted`, and (v5.0) under the same `apply.lock` acquisition — taken around the first wet write, never on `--dry-run` or when nothing would be written; a failed acquire folds as top-level `errorCode: "lock_held" | "lock_io"` + string `error` (exit 1), and `--dry-run` under a held lock still exits 0. **No manifest write, no blobs, no ledger** — the lockfile edits are the persistence. JSON: get's legacy envelope gains the same nested `redirect` sub-object as scan's (`{mode:"hosted", redirected, rewrittenFiles, skipped, warnings, dryRun}`); the top-level shape is `{status, found, patches:[<narrowing skips>], warnings?}` — `downloaded`/`applied` are absent (nothing is downloaded into `.socket/`). Exit codes follow scan's hosted semantics: skipped grants and rewriter warnings never flip the exit; infra errors (reference fetch, file writes) exit 1. Human prompt: `Redirect N packages to the hosted patch server?` (singular for one; `--yes`/`--json`/non-TTY auto-accept as usual). This confirm is get's alone: `scan` never prompts.
-* **Vendored** (`get GHSA-… --mode vendored`): the download phase is scan's vendored posture — **manifest-free (v5.0)**: the selected records are fetched into memory (`download_patch_records`; blobs held in memory; nothing under `.socket/` is written; the nested apply never runs), then scan's vendor step runs under the apply lock over exactly the selected records, like `scan --mode vendored` (no whole-manifest scope and no `[note]` about other records — that blast radius is retired with the manifest; a legacy manifest record for a vendored purl is migrated out of `.socket/manifest.json` the same way scan does it). JSON: get's envelope takes the detached download envelope's shape — `{status, found, downloaded, skipped, failed, detached: true, patches: [{purl, uuid, action: "downloaded" | "skipped" | "failed", …}], warnings?}` (`applied` is absent; `detached: true` is pinned; a `downloaded` record for a purl the vendor ledger holds at another uuid carries the additive `oldUuid`, derived from the ledger — the human `[fetch]` line reads `<purl> (replacing <short uuid>)`) — and gains the nested `vendor` Envelope exactly like scan's `result["vendor"]`; a vendor-step error folds the partial envelope + `{status:"error", error:{code,message}}` in (a pre-failure takeover reconcile may have already mutated the ledger — its events must reach the consumer). Exit: download failures or vendor `has_errors` → `partial_failure`/1. Human prompt: `Download and vendor N patches?`; `--dry-run` prints `[dry-run] Would download and vendor N patches. No changes made.` on both identifier paths (uuid and search). Telemetry mirrors scan's vendored arms (`track_outcomes_for_vendor` / `track_patch_vendor_failed`). **Bun vendored preflight (additive)** — shared by `get --mode vendored` on both its paths and `scan --mode vendored`: before ANY patch download, and only when the selection holds a `pkg:npm/` purl, the download phase reads `bun.lock`/`bun.lockb` once (`preflight_vendor`) and, when the vendor backend would refuse the project — a malformed, unreadable or unsupported `bun.lockb` → `vendor_bun_lockb_invalid`; an unreadable `bun.lock` → `vendor_lockfile_missing`; a `lockfileVersion` other than 0/1/2 or a non-canonical `packages` grammar → `vendor_lockfile_version_unsupported`; `workspace:` packages in a lock below version 2 → `vendor_bun_workspace_unsupported` — every `pkg:npm/` result becomes `{action:"failed", errorCode:<code>, error:<detail>}` with NO fetch (the patch view is never requested) and no patch record; other ecosystems' results are untouched. **Search path** (`get <purl|advisory> --mode vendored`) and `scan --mode vendored`: the records ride `patches[]` / `download.patches[]` with `downloaded: 0`, the download phase writes nothing under `.socket/` (v5.0 — a pre-existing `.socket/manifest.json`, including a record seeded for another purl, is left byte-untouched), the vendor step still runs over the remaining records (no event for the refused purl), exit `partial_failure`/1. **uuid path** (`get <uuid> --mode vendored`): the uuid lookup is the only fetch; the run exits 1 BEFORE the vendor step with exactly `{status:"error", found:1, downloaded:0, skipped:0, failed:1, error:{code, message}, patches:[{purl, uuid, action:"failed", errorCode, error}]}` (the `error` OBJECT is the vendored-mode error shape of the vendor-step fold-in above) and writes nothing — no `.socket/` on a fresh project; human mode prints `Error (<code>): <detail>` on stderr. **Already-vendored exemption**: a purl is exempt from the workspace refusal only when every instance of its `name@version` in `bun.lock` is already a `.socket/vendor/npm/…` local tuple (any uuid; the digest-less 2-tuple counts) — the engine's own criterion — so in-sync re-runs, `repair`, and a superseding patch uuid on a project vendored before it grew a workspace member all flow to the engine (re-pinning an already-local tuple adds no workspace-relative exposure); a wiped ledger alone is not a refusal (the engine path decides). UUID equality in the ledger alone never exempts a purl: `rollback --preserve-state` retains its record after unwiring. Dry-run refusal takes priority over `already_vendored`. **Unreadable vendor ledger**: a `.socket/vendor/state.json` the preflight cannot read or parse is itself the refusal — `vendor_state_unreadable` with the io/parse detail, fail-closed (nothing is exempt) — on the uuid path, the search / `scan` path and the `--dry-run` preview alike; never a Bun lock code. **`--silent`** is "errors only" and never mutes the refusal: the code-tagged `[error] <purl> (<code>): <detail>` (per-patch paths) / `Error (<code>): …` (uuid path) line stays on stderr with an empty stdout. **`--dry-run`** previews the refusal as the additive `would_refuse` action (see `--dry-run` below). Agent-mode `get --save-only` is NOT preflighted (record-only intent has no consumption precondition). Pinned by `tests/in_process_vendor_bun.rs` (exact uuid-path envelope, seeded-manifest survival, `--silent`, `--dry-run`) and `tests/scan_vendor_e2e.rs`.
+* **Vendored** (`get GHSA-… --mode vendored`): the download phase is scan's vendored posture — **manifest-free (v5.0)**: the selected records are fetched into memory (`download_patch_records`; blobs held in memory; nothing under `.socket/` is written; the nested apply never runs), then scan's vendor step runs under the apply lock over exactly the selected records, like `scan --mode vendored` (no whole-manifest scope and no `[note]` about other records — that blast radius is retired with the manifest; a legacy manifest record for a vendored purl is migrated out of `.socket/manifest.json` the same way scan does it). JSON: get's envelope takes the detached download envelope's shape — `{status, found, downloaded, skipped, failed, detached: true, patches: [{purl, uuid, action: "downloaded" | "skipped" | "failed", …}], warnings?}` (`applied` is absent; `detached: true` is pinned; a `downloaded` record for a purl the vendor ledger holds at another uuid carries the additive `oldUuid`, derived from the ledger — the human `[fetch]` line reads `<purl> (replacing <short uuid>)`) — and gains the nested `vendor` Envelope exactly like scan's `result["vendor"]`; a vendor-step error folds the partial envelope + `{status:"error", error:{code,message}}` in (a pre-failure takeover reconcile may have already mutated the ledger — its events must reach the consumer). Exit: download failures or vendor `has_errors` → `partial_failure`/1. Human prompt: `Download and vendor N patches?`; `--dry-run` prints `[dry-run] Would download and vendor N patches. No changes made.` on both identifier paths (uuid and search). Telemetry mirrors scan's vendored arms (`track_outcomes_for_vendor` / `track_patch_vendor_failed`). **Bun vendored preflight (additive)** — shared by `get --mode vendored` on both its paths and `scan --mode vendored`: before ANY patch download, and only when the selection holds a `pkg:npm/` purl, the download phase reads `bun.lock`/`bun.lockb` once (`preflight_vendor`) and, when the vendor backend would refuse the project — a malformed, unreadable or unsupported `bun.lockb` → `vendor_bun_lockb_invalid`; an unreadable `bun.lock` → `vendor_lockfile_missing`; a `lockfileVersion` other than 0/1/2 or a non-canonical `packages` grammar → `vendor_lockfile_version_unsupported`; `workspace:` packages in a lock below version 2 → `vendor_bun_workspace_unsupported` — every `pkg:npm/` result becomes `{action:"failed", errorCode:<code>, error:<detail>}` with NO fetch (the patch view is never requested) and no patch record; other ecosystems' results are untouched. **Search path** (`get <purl|advisory> --mode vendored`) and `scan --mode vendored`: the records ride `patches[]` / `download.patches[]` with `downloaded: 0`, the download phase writes nothing under `.socket/` (v5.0 — a pre-existing `.socket/manifest.json`, including a record seeded for another purl, is left byte-untouched), the vendor step still runs over the remaining records (no event for the refused purl), exit `partial_failure`/1. **uuid path** (`get <uuid> --mode vendored`): the uuid lookup is the only fetch; the run exits 1 BEFORE the vendor step with exactly `{status:"error", found:1, downloaded:0, skipped:0, failed:1, error:{code, message}, patches:[{purl, uuid, action:"failed", errorCode, error}]}` (the `error` OBJECT is the vendored-mode error shape of the vendor-step fold-in above) and writes nothing — no `.socket/` on a fresh project; human mode prints `Error (<code>): <detail>` on stderr. **Already-vendored exemption**: a purl is exempt from the workspace refusal only when every instance of its `name@version` in `bun.lock` is already a `.socket/vendor/npm/…` local tuple (any uuid; the digest-less 2-tuple counts) — the engine's own criterion — so in-sync re-runs, `repair`, and a superseding patch uuid on a project vendored before it grew a workspace member all flow to the engine (re-pinning an already-local tuple adds no workspace-relative exposure); a wiped ledger alone is not a refusal (the engine path decides). UUID equality in the ledger alone never exempts a purl: `rollback --preserve-state` retains its record after unwiring. Dry-run refusal takes priority over `already_vendored`. **Unreadable vendor ledger**: a `.socket/vendor/state.json` the preflight cannot read or parse is itself the refusal — `vendor_state_unreadable` with the io/parse detail, fail-closed (nothing is exempt) — on the uuid path, the search / `scan` path and the `--dry-run` preview alike; never a Bun lock code. **`--silent`** is "errors only" and never mutes the refusal: the code-tagged `[error] <purl> (<code>): <detail>` (per-patch paths) / `Error (<code>): …` (uuid path) line stays on stderr with an empty stdout. **`--dry-run`** previews the refusal as the additive `would_refuse` action (see `--dry-run` below). Agent-mode `get --save-only` is NOT preflighted (record-only intent has no consumption precondition). Pinned by `tests/vendor/in_process_vendor_bun.rs` (exact uuid-path envelope, seeded-manifest survival, `--silent`, `--dry-run`) and `tests/scan_vendor_e2e.rs`.
 
-**Lock-text refusals before the download (v5.0)** — shared by `get --mode vendored` on both its paths and `scan --mode vendored`, after the Bun preflight above and the ledger's `already vendored` skip: a `pkg:npm/` result in a **pnpm, yarn classic or yarn berry** project, or a `pkg:cargo/` result, that its vendor backend refuses on the project's lock and manifest text alone is refused BEFORE its patch view is fetched — the pnpm / classic / berry gates the backend runs before it reads the package (coordinates, the lock and manifest reads and their line-ending / version / `cacheKey` / `.yarnrc.yml` gates, override and `resolutions` conflicts, the lock entry present and rewritable) and cargo's `locked_version_mismatch` (only when it is the crate's FIRST refusal; an in-tree `cargo vendor` copy still refuses in the loop as `already_vendored_in_tree`). **Scope:** only a package the vendor loop would hand to its backend is refused early — one installed on disk (the loop's own qualified-aware resolver plus the npm identity lookup), or one the lockfile inventory resolves to a verifiable registry source (a lock entry with an integrity, or the ledger-recovered pre-vendor resolution — exactly the entry the pristine fetch would use). A package absent from the lock and not installed never reached its backend and is untouched: its view is fetched, it downloads, and the vendor loop skips it `skipped` / `package_not_installed` as in v4.x (so cargo's `locked_version_mismatch` is refused early only for a crate installed at the unlocked version). The result becomes `{action:"failed", errorCode:<code>, error:<detail>}` in `download.patches[]` / `patches[]` with the backend's exact code and detail, no view and no pristine fetch, no patch record, and therefore no vendor event: compared with v4.x, `download.downloaded` drops and `download.failed` rises by the number of such packages, `vendor.summary.failed` and `vendor.events` lose their `failed` events, and a lockfile-only package among them loses its `vendor_fetched_missing` event (it is never fetched). Exit code and top-level `status` are unchanged (`partial_failure`/1); the nested `vendor.status` becomes `success` when those refusals were the vendor step's only failures (observed on the depscan fixture: 3 refusals, `partialFailure` → `success`), and when every selected package is refused this way the human `scan --vendor` arm prints `Nothing was vendored: N patches failed (see above).`. **Precedence:** the lock-text refusal is decided before the view, so it wins over every view-derived outcome — a package that would also have been a paid-access 403 (`[PAID]`/no access), a failed view fetch, or a no-applicable-files skip reports the lock refusal instead (the Bun refusal and the ledger's `already vendored` skip still come first). The human `[error] <purl> (<code>): <detail>` line is printed during the download instead of the vendor step's failure line (the human (non-`--silent`) `scan --vendor` arm's baseline pre-check still fetches the views it verifies; only the download, the pristine fetch and the vendor step skip the package there). A purl the lockfiles pin hosted keeps the loop's refusal (its takeover restore rewrites the lock the gates read); other flavors (package-lock, pnpm-legacy, bun) and ecosystems are untouched, and `--dry-run` is unchanged. `vendor` (manifest-driven, no view fetch) keeps its per-package `failed` events but no longer fetches the pristine source of a lockfile-only package it refuses this way — the source is deferred to the backend, which refuses before reading it (no `vendor_fetched_missing` event and no registry request; a refused package whose registry is unreachable reports the gate's code instead of `vendor_fetch_failed`); only a package the lock resolves to a verifiable source is deferred, and one it does not resolve keeps its `package_not_installed` skip. Pinned by `tests/scan_vendor_e2e.rs` (`exact_download_plan`: scan and exact-purl get, pnpm and cargo scope), `tests/e2e_yarn_legacy_cachekey_refusal_build.rs` and `tests/vendor_rerun_no_network_e2e.rs`.
+**Lock-text refusals before the download (v5.0)** — shared by `get --mode vendored` on both its paths and `scan --mode vendored`, after the Bun preflight above and the ledger's `already vendored` skip: a `pkg:npm/` result in a **pnpm, yarn classic or yarn berry** project, or a `pkg:cargo/` result, that its vendor backend refuses on the project's lock and manifest text alone is refused BEFORE its patch view is fetched — the pnpm / classic / berry gates the backend runs before it reads the package (coordinates, the lock and manifest reads and their line-ending / version / `cacheKey` / `.yarnrc.yml` gates, override and `resolutions` conflicts, the lock entry present and rewritable) and cargo's `locked_version_mismatch` (only when it is the crate's FIRST refusal; an in-tree `cargo vendor` copy still refuses in the loop as `already_vendored_in_tree`). **Scope:** only a package the vendor loop would hand to its backend is refused early — one installed on disk (the loop's own qualified-aware resolver plus the npm identity lookup), or one the lockfile inventory resolves to a verifiable registry source (a lock entry with an integrity, or the ledger-recovered pre-vendor resolution — exactly the entry the pristine fetch would use). A package absent from the lock and not installed never reached its backend and is untouched: its view is fetched, it downloads, and the vendor loop skips it `skipped` / `package_not_installed` as in v4.x (so cargo's `locked_version_mismatch` is refused early only for a crate installed at the unlocked version). The result becomes `{action:"failed", errorCode:<code>, error:<detail>}` in `download.patches[]` / `patches[]` with the backend's exact code and detail, no view and no pristine fetch, no patch record, and therefore no vendor event: compared with v4.x, `download.downloaded` drops and `download.failed` rises by the number of such packages, `vendor.summary.failed` and `vendor.events` lose their `failed` events, and a lockfile-only package among them loses its `vendor_fetched_missing` event (it is never fetched). Exit code and top-level `status` are unchanged (`partial_failure`/1); the nested `vendor.status` becomes `success` when those refusals were the vendor step's only failures (observed on the depscan fixture: 3 refusals, `partialFailure` → `success`), and when every selected package is refused this way the human `scan --vendor` arm prints `Nothing was vendored: N patches failed (see above).`. **Precedence:** the lock-text refusal is decided before the view, so it wins over every view-derived outcome — a package that would also have been a paid-access 403 (`[PAID]`/no access), a failed view fetch, or a no-applicable-files skip reports the lock refusal instead (the Bun refusal and the ledger's `already vendored` skip still come first). The human `[error] <purl> (<code>): <detail>` line is printed during the download instead of the vendor step's failure line (the human (non-`--silent`) `scan --vendor` arm's baseline pre-check still fetches the views it verifies; only the download, the pristine fetch and the vendor step skip the package there). A purl the lockfiles pin hosted keeps the loop's refusal (its takeover restore rewrites the lock the gates read); other flavors (package-lock, pnpm-legacy, bun) and ecosystems are untouched, and `--dry-run` is unchanged. `vendor` (manifest-driven, no view fetch) keeps its per-package `failed` events but no longer fetches the pristine source of a lockfile-only package it refuses this way — the source is deferred to the backend, which refuses before reading it (no `vendor_fetched_missing` event and no registry request; a refused package whose registry is unreachable reports the gate's code instead of `vendor_fetch_failed`); only a package the lock resolves to a verifiable source is deferred, and one it does not resolve keeps its `package_not_installed` skip. Pinned by `tests/scan_vendor_e2e.rs` (`exact_download_plan`: scan and exact-purl get, pnpm and cargo scope), `tests/e2e_yarn_legacy_cachekey_refusal_build.rs` and `tests/vendor/vendor_rerun_no_network_e2e.rs`.
 * **Installed-version narrowing** (all modes, `get`'s search path): a CVE/GHSA fan-out returns one patch record per patched VERSION; get keeps only versions present here and emits calm `skipped` records (`errorCode: "package_not_installed"`) for the rest — never an error exit. Presence = installed on disk (qualified-aware resolver) ∪ already tracked in the manifest (record maintenance keeps working on hosts without an installed copy); hosted/vendored modes additionally count lockfile-resolved deps and vendor-ledger purls (mirroring scan's discovery supplements, including their `--global` gate). **Exempt** (no narrowing): UUID identifiers, exact-versioned PURL identifiers (explicit intent), `--save-only` runs (record-only has no installation precondition — the fresh-clone record→vendor flow keeps working), `--all-releases`, and the package-name path (already installed-derived). When EVERY found patch is filtered out, get exits 0 with the additive status **`not_installed`** (`{status:"not_installed", found:N, downloaded:0, applied:0, patches:[<skip records>], warnings?}`) — never `no_match`, which remains pinned to the fuzzy package-name path. PnP layouts are surfaced, not misreported: yarn-PnP npm results skip with `errorCode: "yarn_pnp_unsupported"` in every mode; pnpm-PnP skips carry `pnpm_pnp_unsupported` in agent/vendored modes; hosted mode — the refusal's own remedy — keeps ONLY the versions the raw `pnpm-lock.yaml` text actually resolves (boundary-anchored probe over the v5/v6/v9 key spellings, so a large fan-out never requests grants for every version ever patched), labels a JUDGED miss `package_not_installed` exactly like a non-PnP project (the layout blocked nothing — the lock was read and the version isn't resolved), and reserves the layout code for an unreadable lock (no judgment possible). When EVERY narrowed-out result is a PnP refusal, the human terminal names the layout instead of claiming "not installed" and never advises `--all-releases` (which cannot make PnP patchable); the JSON status stays `not_installed` — consumers dispatch on the per-record `errorCode`. Hosted mode also runs the per-release VARIANT filter (`filter_to_installed_releases`) on its search path before requesting grants — agent/vendored runs get it inside the download engines — with the same keep-all-plus-warning fallbacks (surfaced as `(release_narrowing)`-prefixed strings in `warnings[]`). An ecosystem this binary has no crawler for is likewise never judged: its results are KEPT (absence from a crawl that never looked carries no information — the same fail-safe as scan's prune GC). The human `Found N patches:` listing shows only the patches whose package version survived the narrowing (the narrowing is judged over every result, so an installed package's paid fix a free user cannot download still lists as `[PAID] (no access)`, while skip records and counts cover only accessible patches), sorted by PURL in natural version order (`4.17.2` before `4.17.10`); the narrowed-out ones are summarized on stderr in one line per reason (`Skipped N patches for M package versions not installed here (use --all-releases to include them).`), and `--verbose` adds one `[skip] <purl> (<reason>)` line per skipped version after that summary, in natural version order. When the candidates hold more patches than were selected and the pick was made without a menu (a paid user's auto-pick, `--yes`, a non-TTY run), a `Selected:` block names the patch (purl, tier, short uuid, advisories) that will be installed before the prompt. Machine output (the prompt count, the JSON envelope) uses the kept set, unchanged. The finer per-release variant narrowing (`filter_to_installed_releases`) is unchanged and still runs inside the download engines (and before an agent-mode `--dry-run` preview, so the preview names only the variants a wet run would fetch).
 * **Deliberate divergences from scan** (documented, not drift): agent-mode get keeps its `selection_required` JSON posture for free multi-patch PURLs (scan and, v5.0, hosted/vendored get auto-pick); get has no `--vex` (an ambient `SOCKET_VEX` is ignored by get's modes), no `--prune`; get does not run scan's pre-vendor baseline annotation; and an all-narrowed-out run exits `not_installed` without entering the vendor step (heal-after-wipe re-vendoring stays `scan --mode vendored`'s job). Agent-mode `get` honors `--dry-run` too (v5.0): the search and uuid paths classify each selected patch against the manifest (read-only; an unreadable manifest fails closed like the wet run) and stop before the prompt, the download, any `.socket/` write and the apply — human `[would-add]` / `[would-update] … (replacing <short uuid>)` / `[skip] … (already in manifest)` lines then `[dry-run] Would download and apply N patches. No changes made.`; JSON `{status:"success", dryRun:true, found, downloaded:0, skipped, applied:0, patches:[{purl, uuid, action:"would_add"|"would_update"(+oldUuid)|"skipped"}, <narrowing skip records>], warnings?}`, exit 0.
 
@@ -1464,7 +1464,7 @@ socket-patch apply --json | jq '
 Exit `0` when `status` is `success`, `noManifest`, or `notFound`-with-zero-failed.
 Exit `1` when `status` is `partialFailure` (any `events[*].action == "failed"`) or `error`.
 
-`apply` with no manifest at all is a clean exit-0 no-op (`status: "noManifest"`), and an **empty** manifest (zero patches) is a plain `success` exit 0 — this is load-bearing for CI steps that run `apply` after every install. A fully rolled-back agent project therefore keeps `.socket/manifest.json` at `{"patches": {}}`: the v5.0 residue rule never deletes a zero-patch manifest, precisely so these CI exits (and `list`'s 0-vs-1 below) never flip. Pinned by `tests/in_process_edge_cases.rs` and `tests/cli_dry_run_paths_e2e.rs`. **One carve-out**: a yarn-berry Plug'n'Play layout (`.pnp.*` loader at `--cwd`) refuses with the loud `yarn_pnp_unsupported` error (exit 1) even when no manifest exists — `scan` cannot discover PnP packages (they live inside `.yarn/cache/*.zip`, no `node_modules/`) and therefore never writes a manifest, so without the carve-out the documented refusal was unreachable and a PnP project's only signal was the calm noManifest exit. Pinned by `tests/e2e_safety_yarn_pnp.rs`.
+`apply` with no manifest at all is a clean exit-0 no-op (`status: "noManifest"`), and an **empty** manifest (zero patches) is a plain `success` exit 0 — this is load-bearing for CI steps that run `apply` after every install. A fully rolled-back agent project therefore keeps `.socket/manifest.json` at `{"patches": {}}`: the v5.0 residue rule never deletes a zero-patch manifest, precisely so these CI exits (and `list`'s 0-vs-1 below) never flip. Pinned by `tests/in_process_edge_cases.rs` and `tests/cli/cli_dry_run_paths_e2e.rs`. **One carve-out**: a yarn-berry Plug'n'Play layout (`.pnp.*` loader at `--cwd`) refuses with the loud `yarn_pnp_unsupported` error (exit 1) even when no manifest exists — `scan` cannot discover PnP packages (they live inside `.yarn/cache/*.zip`, no `node_modules/`) and therefore never writes a manifest, so without the carve-out the documented refusal was unreachable and a PnP project's only signal was the calm noManifest exit. Pinned by `tests/e2e_safety_yarn_pnp.rs`.
 
 ## Exit codes
 
diff --git a/crates/socket-patch-cli/src/commands/scan/mod.rs b/crates/socket-patch-cli/src/commands/scan/mod.rs
index aa7b2ead..38f8fdc6 100644
--- a/crates/socket-patch-cli/src/commands/scan/mod.rs
+++ b/crates/socket-patch-cli/src/commands/scan/mod.rs
@@ -3243,7 +3243,7 @@ mod tests {
 
     // ---- redirectState envelope block (read-only cross-mode visibility) ----
     // The end-to-end envelope placement (report-only + agent runs carry it,
-    // hosted/vendored runs don't) is pinned by `tests/scan_invariants.rs`;
+    // hosted/vendored runs don't) is pinned by `tests/scan/scan_invariants.rs`;
     // these pin the block builder's own gates and shape.
 
     /// Pins present ⇒ the block exists with each pin's canonical purl +
diff --git a/crates/socket-patch-cli/tests/apply_invariants.rs b/crates/socket-patch-cli/tests/apply/apply_invariants.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/apply_invariants.rs
rename to crates/socket-patch-cli/tests/apply/apply_invariants.rs
index ba9861ed..2878ec30 100644
--- a/crates/socket-patch-cli/tests/apply_invariants.rs
+++ b/crates/socket-patch-cli/tests/apply/apply_invariants.rs
@@ -682,10 +682,8 @@ fn unmatched_purl_exit_semantics_are_pinned() {
     assert_eq!(v2["status"], "partialFailure", "{v2}");
 }
 
-#[path = "vlt_hosted_common/mod.rs"]
-mod vlt_hosted_common;
-#[path = "vlt_hosted_common/vendored.rs"]
-mod vlt_vendored;
+use crate::vlt_hosted_common;
+use crate::vlt_vendored;
 
 /// A vlt-vendored purl: `apply` yields it to the vendor ledger (the
 /// committed dir artifact is what vlt installs), leaves `.socket/`
diff --git a/crates/socket-patch-cli/tests/apply_network.rs b/crates/socket-patch-cli/tests/apply/apply_network.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/apply_network.rs
rename to crates/socket-patch-cli/tests/apply/apply_network.rs
diff --git a/crates/socket-patch-cli/tests/cli_gem_variant_mismatch_policy.rs b/crates/socket-patch-cli/tests/apply/cli_gem_variant_mismatch_policy.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/cli_gem_variant_mismatch_policy.rs
rename to crates/socket-patch-cli/tests/apply/cli_gem_variant_mismatch_policy.rs
diff --git a/crates/socket-patch-cli/tests/covgap_commands_apply.rs b/crates/socket-patch-cli/tests/apply/covgap_commands_apply.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/covgap_commands_apply.rs
rename to crates/socket-patch-cli/tests/apply/covgap_commands_apply.rs
index 28d0caa3..035a48da 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_apply.rs
+++ b/crates/socket-patch-cli/tests/apply/covgap_commands_apply.rs
@@ -39,8 +39,7 @@ use serde_json::{json, Value};
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 use common::{git_sha256, parse_json_envelope, run_with_env};
 
diff --git a/crates/socket-patch-cli/tests/e2e_safety_advisories.rs b/crates/socket-patch-cli/tests/apply/e2e_safety_advisories.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/e2e_safety_advisories.rs
rename to crates/socket-patch-cli/tests/apply/e2e_safety_advisories.rs
index 359ffae4..284d0709 100644
--- a/crates/socket-patch-cli/tests/e2e_safety_advisories.rs
+++ b/crates/socket-patch-cli/tests/apply/e2e_safety_advisories.rs
@@ -27,8 +27,7 @@
 
 use std::path::Path;
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 use common::{
     git_sha256, parse_json_envelope, run_with_env, write_blob, write_minimal_manifest, PatchEntry,
diff --git a/crates/socket-patch-cli/tests/in_process_gem_config_warning.rs b/crates/socket-patch-cli/tests/apply/in_process_gem_config_warning.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/in_process_gem_config_warning.rs
rename to crates/socket-patch-cli/tests/apply/in_process_gem_config_warning.rs
diff --git a/crates/socket-patch-cli/tests/in_process_gem_fallback_home.rs b/crates/socket-patch-cli/tests/apply/in_process_gem_fallback_home.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/in_process_gem_fallback_home.rs
rename to crates/socket-patch-cli/tests/apply/in_process_gem_fallback_home.rs
diff --git a/crates/socket-patch-cli/tests/in_process_gem_multicopy.rs b/crates/socket-patch-cli/tests/apply/in_process_gem_multicopy.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/in_process_gem_multicopy.rs
rename to crates/socket-patch-cli/tests/apply/in_process_gem_multicopy.rs
diff --git a/crates/socket-patch-cli/tests/in_process_npm_multicopy.rs b/crates/socket-patch-cli/tests/apply/in_process_npm_multicopy.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/in_process_npm_multicopy.rs
rename to crates/socket-patch-cli/tests/apply/in_process_npm_multicopy.rs
diff --git a/crates/socket-patch-cli/tests/in_process_variant_apply_failure.rs b/crates/socket-patch-cli/tests/apply/in_process_variant_apply_failure.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/in_process_variant_apply_failure.rs
rename to crates/socket-patch-cli/tests/apply/in_process_variant_apply_failure.rs
diff --git a/crates/socket-patch-cli/tests/apply/main.rs b/crates/socket-patch-cli/tests/apply/main.rs
new file mode 100644
index 00000000..52d02b45
--- /dev/null
+++ b/crates/socket-patch-cli/tests/apply/main.rs
@@ -0,0 +1,21 @@
+//! `apply`: invariants, network behavior, silent/exit modes and the gem and npm multi-copy apply paths.
+//!
+//! One test binary per command: each module was its own binary.
+
+#[path = "../common/mod.rs"]
+mod common;
+#[path = "../vlt_hosted_common/mod.rs"]
+mod vlt_hosted_common;
+#[path = "../vlt_hosted_common/vendored.rs"]
+mod vlt_vendored;
+
+mod apply_invariants;
+mod apply_network;
+mod cli_gem_variant_mismatch_policy;
+mod covgap_commands_apply;
+mod e2e_safety_advisories;
+mod in_process_gem_config_warning;
+mod in_process_gem_fallback_home;
+mod in_process_gem_multicopy;
+mod in_process_npm_multicopy;
+mod in_process_variant_apply_failure;
diff --git a/crates/socket-patch-cli/tests/api_client_errors_e2e.rs b/crates/socket-patch-cli/tests/cli/api_client_errors_e2e.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/api_client_errors_e2e.rs
rename to crates/socket-patch-cli/tests/cli/api_client_errors_e2e.rs
diff --git a/crates/socket-patch-cli/tests/cli_dry_run_paths_e2e.rs b/crates/socket-patch-cli/tests/cli/cli_dry_run_paths_e2e.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/cli_dry_run_paths_e2e.rs
rename to crates/socket-patch-cli/tests/cli/cli_dry_run_paths_e2e.rs
diff --git a/crates/socket-patch-cli/tests/covgap_api_client.rs b/crates/socket-patch-cli/tests/cli/covgap_api_client.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/covgap_api_client.rs
rename to crates/socket-patch-cli/tests/cli/covgap_api_client.rs
diff --git a/crates/socket-patch-cli/tests/covgap_commands_list.rs b/crates/socket-patch-cli/tests/cli/covgap_commands_list.rs
similarity index 98%
rename from crates/socket-patch-cli/tests/covgap_commands_list.rs
rename to crates/socket-patch-cli/tests/cli/covgap_commands_list.rs
index a41fceea..2e337c01 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_list.rs
+++ b/crates/socket-patch-cli/tests/cli/covgap_commands_list.rs
@@ -20,12 +20,9 @@ use std::process::Command;
 use base64::Engine as _;
 use wiremock::MockServer;
 
-#[path = "common/mod.rs"]
-mod common;
-#[path = "vlt_hosted_common/mod.rs"]
-mod vlt_hosted_common;
-#[path = "vlt_hosted_common/vendored.rs"]
-mod vlt_vendored;
+use crate::common;
+use crate::vlt_hosted_common;
+use crate::vlt_vendored;
 
 // ---------------------------------------------------------------------------
 // `--debug` provenance echoes (GlobalArgs::telemetry_credentials, config layer)
diff --git a/crates/socket-patch-cli/tests/covgap_output.rs b/crates/socket-patch-cli/tests/cli/covgap_output.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/covgap_output.rs
rename to crates/socket-patch-cli/tests/cli/covgap_output.rs
index b629bb8e..25acecde 100644
--- a/crates/socket-patch-cli/tests/covgap_output.rs
+++ b/crates/socket-patch-cli/tests/cli/covgap_output.rs
@@ -14,8 +14,6 @@
 
 #![cfg(unix)]
 
-#[path = "common/pty_io.rs"]
-mod pty_io;
 use std::path::{Path, PathBuf};
 use std::time::Duration;
 
@@ -26,8 +24,7 @@ use wiremock::{Mock, MockServer, ResponseTemplate};
 // Pulled in for `git_sha256` (the patch-view blob fixture below must clear
 // the "patch has no applicable files" guardrail with a real blob
 // hash). Read-only reuse of the shared helper module.
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 const ORG_SLUG: &str = "test-org";
 const UUID_A: &str = "11111111-1111-4111-8111-111111111111";
diff --git a/crates/socket-patch-cli/tests/interactive_prompts_e2e.rs b/crates/socket-patch-cli/tests/cli/interactive_prompts_e2e.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/interactive_prompts_e2e.rs
rename to crates/socket-patch-cli/tests/cli/interactive_prompts_e2e.rs
index 25da2f43..6f744bfe 100644
--- a/crates/socket-patch-cli/tests/interactive_prompts_e2e.rs
+++ b/crates/socket-patch-cli/tests/cli/interactive_prompts_e2e.rs
@@ -7,8 +7,6 @@
 
 #![cfg(unix)]
 
-#[path = "common/pty_io.rs"]
-mod pty_io;
 use std::path::{Path, PathBuf};
 use std::time::Duration;
 
diff --git a/crates/socket-patch-cli/tests/cli/main.rs b/crates/socket-patch-cli/tests/cli/main.rs
new file mode 100644
index 00000000..9ef09285
--- /dev/null
+++ b/crates/socket-patch-cli/tests/cli/main.rs
@@ -0,0 +1,21 @@
+//! Global CLI behavior: API client errors, dry-run paths, output modes, prompts, telemetry and `list`.
+//!
+//! One test binary per command: each module was its own binary.
+
+#[path = "../common/mod.rs"]
+mod common;
+#[path = "../common/pty_io.rs"]
+mod pty_io;
+#[path = "../vlt_hosted_common/mod.rs"]
+mod vlt_hosted_common;
+#[path = "../vlt_hosted_common/vendored.rs"]
+mod vlt_vendored;
+
+mod api_client_errors_e2e;
+mod cli_dry_run_paths_e2e;
+mod covgap_api_client;
+mod covgap_commands_list;
+mod covgap_output;
+mod interactive_prompts_e2e;
+mod output_modes_e2e;
+mod telemetry_e2e;
diff --git a/crates/socket-patch-cli/tests/output_modes_e2e.rs b/crates/socket-patch-cli/tests/cli/output_modes_e2e.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/output_modes_e2e.rs
rename to crates/socket-patch-cli/tests/cli/output_modes_e2e.rs
index aab9ef8b..31291661 100644
--- a/crates/socket-patch-cli/tests/output_modes_e2e.rs
+++ b/crates/socket-patch-cli/tests/cli/output_modes_e2e.rs
@@ -15,8 +15,7 @@ use std::path::Path;
 
 use sha2::{Digest, Sha256};
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 fn git_sha256(content: &[u8]) -> String {
     let header = format!("blob {}\0", content.len());
diff --git a/crates/socket-patch-cli/tests/telemetry_e2e.rs b/crates/socket-patch-cli/tests/cli/telemetry_e2e.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/telemetry_e2e.rs
rename to crates/socket-patch-cli/tests/cli/telemetry_e2e.rs
diff --git a/crates/socket-patch-cli/tests/cli_get_silent_errors.rs b/crates/socket-patch-cli/tests/get/cli_get_silent_errors.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/cli_get_silent_errors.rs
rename to crates/socket-patch-cli/tests/get/cli_get_silent_errors.rs
index 61dd3818..32b62043 100644
--- a/crates/socket-patch-cli/tests/cli_get_silent_errors.rs
+++ b/crates/socket-patch-cli/tests/get/cli_get_silent_errors.rs
@@ -12,8 +12,7 @@
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 const ORG: &str = "test-org";
 const UUID: &str = "22222222-2222-4222-8222-222222222222";
diff --git a/crates/socket-patch-cli/tests/coverage_fix_get_double_json.rs b/crates/socket-patch-cli/tests/get/coverage_fix_get_double_json.rs
similarity index 98%
rename from crates/socket-patch-cli/tests/coverage_fix_get_double_json.rs
rename to crates/socket-patch-cli/tests/get/coverage_fix_get_double_json.rs
index 2c84264b..43089594 100644
--- a/crates/socket-patch-cli/tests/coverage_fix_get_double_json.rs
+++ b/crates/socket-patch-cli/tests/get/coverage_fix_get_double_json.rs
@@ -12,8 +12,7 @@
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 const ORG: &str = "test-org";
 const GHSA: &str = "GHSA-dbld-json-once";
diff --git a/crates/socket-patch-cli/tests/get_batch_paths_e2e.rs b/crates/socket-patch-cli/tests/get/get_batch_paths_e2e.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/get_batch_paths_e2e.rs
rename to crates/socket-patch-cli/tests/get/get_batch_paths_e2e.rs
diff --git a/crates/socket-patch-cli/tests/get_edge_cases_e2e.rs b/crates/socket-patch-cli/tests/get/get_edge_cases_e2e.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/get_edge_cases_e2e.rs
rename to crates/socket-patch-cli/tests/get/get_edge_cases_e2e.rs
index 71e7433d..e32b4ea9 100644
--- a/crates/socket-patch-cli/tests/get_edge_cases_e2e.rs
+++ b/crates/socket-patch-cli/tests/get/get_edge_cases_e2e.rs
@@ -12,8 +12,7 @@ use wiremock::{Mock, MockServer, ResponseTemplate};
 // inherits the developer's shell — `SOCKET_PROXY_URL` outranks the proxy
 // these tests pin, and `SOCKET_MANIFEST_PATH` makes a *passing* test write its manifest and
 // blobs into whatever real project the variable points at.
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 const ORG_SLUG: &str = "test-org";
 const UUID_A: &str = "11111111-1111-4111-8111-111111111111";
diff --git a/crates/socket-patch-cli/tests/get_invariants.rs b/crates/socket-patch-cli/tests/get/get_invariants.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/get_invariants.rs
rename to crates/socket-patch-cli/tests/get/get_invariants.rs
index 2e5b9b7e..c7916697 100644
--- a/crates/socket-patch-cli/tests/get_invariants.rs
+++ b/crates/socket-patch-cli/tests/get/get_invariants.rs
@@ -8,8 +8,7 @@ use std::path::Path;
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 const ORG_SLUG: &str = "test-org";
 const UUID: &str = "11111111-1111-4111-8111-111111111111";
diff --git a/crates/socket-patch-cli/tests/get_modes_e2e.rs b/crates/socket-patch-cli/tests/get/get_modes_e2e.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/get_modes_e2e.rs
rename to crates/socket-patch-cli/tests/get/get_modes_e2e.rs
index 0390330d..8ba3bd97 100644
--- a/crates/socket-patch-cli/tests/get_modes_e2e.rs
+++ b/crates/socket-patch-cli/tests/get/get_modes_e2e.rs
@@ -21,12 +21,9 @@ use std::path::Path;
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "common/mod.rs"]
-mod common;
-#[path = "npm_e2e_common/manifestless.rs"]
-mod npm_e2e_common;
-#[path = "vex_e2e_common/mod.rs"]
-mod vex_e2e_common;
+use crate::common;
+use crate::npm_e2e_common;
+use crate::vex_e2e_common;
 
 const ORG: &str = "test-org";
 const NAME: &str = "getmodes-pkg";
@@ -235,7 +232,7 @@ async fn get_uuid_hosted_json_envelope_nests_redirect() {
     // committed the run writes no `.npmrc` (so `rewrittenFiles` stays the
     // lock alone) and emits exactly the already-set
     // `redirect_npm_allow_remote` caveat (the auto-config has its own suite:
-    // tests/redirect_npm_allow_remote.rs).
+    // tests/vendor/redirect_npm_allow_remote.rs).
     std::fs::write(tmp.path().join(".npmrc"), "allow-remote=all\n").unwrap();
 
     let (code, stdout, stderr) = run_get(
@@ -594,7 +591,7 @@ async fn get_hosted_dry_run_json_envelope() {
     // committed the run writes no `.npmrc` (so `rewrittenFiles` stays the
     // lock alone) and emits exactly the already-set
     // `redirect_npm_allow_remote` caveat (the auto-config has its own suite:
-    // tests/redirect_npm_allow_remote.rs).
+    // tests/vendor/redirect_npm_allow_remote.rs).
     std::fs::write(tmp.path().join(".npmrc"), "allow-remote=all\n").unwrap();
     let lock_before = std::fs::read_to_string(tmp.path().join("package-lock.json")).unwrap();
 
diff --git a/crates/socket-patch-cli/tests/get_nested_apply_api_flags_e2e.rs b/crates/socket-patch-cli/tests/get/get_nested_apply_api_flags_e2e.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/get_nested_apply_api_flags_e2e.rs
rename to crates/socket-patch-cli/tests/get/get_nested_apply_api_flags_e2e.rs
index e55906b7..f16b2189 100644
--- a/crates/socket-patch-cli/tests/get_nested_apply_api_flags_e2e.rs
+++ b/crates/socket-patch-cli/tests/get/get_nested_apply_api_flags_e2e.rs
@@ -22,8 +22,7 @@
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 const ORG: &str = "test-org";
 const UUID: &str = "11111111-1111-4111-8111-111111111111";
diff --git a/crates/socket-patch-cli/tests/get_update_summary_e2e.rs b/crates/socket-patch-cli/tests/get/get_update_summary_e2e.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/get_update_summary_e2e.rs
rename to crates/socket-patch-cli/tests/get/get_update_summary_e2e.rs
index 973839fd..e68000d3 100644
--- a/crates/socket-patch-cli/tests/get_update_summary_e2e.rs
+++ b/crates/socket-patch-cli/tests/get/get_update_summary_e2e.rs
@@ -16,8 +16,7 @@
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 const ORG: &str = "test-org";
 const OLD_UUID: &str = "00000000-0000-4000-8000-000000000000";
diff --git a/crates/socket-patch-cli/tests/global_packages_e2e.rs b/crates/socket-patch-cli/tests/get/global_packages_e2e.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/global_packages_e2e.rs
rename to crates/socket-patch-cli/tests/get/global_packages_e2e.rs
index 61d0f7d3..25bdadd2 100644
--- a/crates/socket-patch-cli/tests/global_packages_e2e.rs
+++ b/crates/socket-patch-cli/tests/get/global_packages_e2e.rs
@@ -24,8 +24,7 @@
 use std::path::{Path, PathBuf};
 use std::process::Command;
 
-#[path = "common/cache_env.rs"]
-mod cache_env;
+use crate::cache_env;
 
 fn binary() -> PathBuf {
     env!("CARGO_BIN_EXE_socket-patch").into()
diff --git a/crates/socket-patch-cli/tests/get/main.rs b/crates/socket-patch-cli/tests/get/main.rs
new file mode 100644
index 00000000..a06c0915
--- /dev/null
+++ b/crates/socket-patch-cli/tests/get/main.rs
@@ -0,0 +1,21 @@
+//! `get`: batch paths, edge cases, invariants, modes, nested apply flags, update summaries and global packages.
+//!
+//! One test binary per command: each module was its own binary.
+
+#[path = "../common/mod.rs"]
+mod common;
+#[path = "../npm_e2e_common/manifestless.rs"]
+mod npm_e2e_common;
+#[path = "../vex_e2e_common/mod.rs"]
+mod vex_e2e_common;
+use common::cache_env;
+
+mod cli_get_silent_errors;
+mod coverage_fix_get_double_json;
+mod get_batch_paths_e2e;
+mod get_edge_cases_e2e;
+mod get_invariants;
+mod get_modes_e2e;
+mod get_nested_apply_api_flags_e2e;
+mod get_update_summary_e2e;
+mod global_packages_e2e;
diff --git a/crates/socket-patch-cli/tests/covgap_commands_remove.rs b/crates/socket-patch-cli/tests/remove/covgap_commands_remove.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/covgap_commands_remove.rs
rename to crates/socket-patch-cli/tests/remove/covgap_commands_remove.rs
index de10372f..1f577650 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_remove.rs
+++ b/crates/socket-patch-cli/tests/remove/covgap_commands_remove.rs
@@ -13,16 +13,11 @@
 //! remove_invariants.rs / remove_duality_invariants.rs /
 //! interactive_prompts_e2e.rs.
 
-#[path = "common/pty_io.rs"]
-mod pty_io;
 use std::path::{Path, PathBuf};
 
-#[path = "common/mod.rs"]
-mod common;
-#[path = "vlt_hosted_common/mod.rs"]
-mod vlt_hosted_common;
-#[path = "vlt_hosted_common/vendored.rs"]
-mod vlt_vendored;
+use crate::common;
+use crate::vlt_hosted_common;
+use crate::vlt_vendored;
 
 /// Spawn `socket-patch remove` with the scrubbed env plus telemetry
 /// disabled; `env` entries land last so per-test injections survive.
diff --git a/crates/socket-patch-cli/tests/remove/main.rs b/crates/socket-patch-cli/tests/remove/main.rs
new file mode 100644
index 00000000..ae74e97c
--- /dev/null
+++ b/crates/socket-patch-cli/tests/remove/main.rs
@@ -0,0 +1,17 @@
+//! `remove`: invariants, duality with rollback, and network behavior.
+//!
+//! One test binary per command: each module was its own binary.
+
+#[path = "../common/mod.rs"]
+mod common;
+#[path = "../common/pty_io.rs"]
+mod pty_io;
+#[path = "../vlt_hosted_common/mod.rs"]
+mod vlt_hosted_common;
+#[path = "../vlt_hosted_common/vendored.rs"]
+mod vlt_vendored;
+
+mod covgap_commands_remove;
+mod remove_duality_invariants;
+mod remove_invariants;
+mod remove_network;
diff --git a/crates/socket-patch-cli/tests/remove_duality_invariants.rs b/crates/socket-patch-cli/tests/remove/remove_duality_invariants.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/remove_duality_invariants.rs
rename to crates/socket-patch-cli/tests/remove/remove_duality_invariants.rs
index 5939d0dc..8c147f1c 100644
--- a/crates/socket-patch-cli/tests/remove_duality_invariants.rs
+++ b/crates/socket-patch-cli/tests/remove/remove_duality_invariants.rs
@@ -15,8 +15,7 @@
 
 use std::path::{Path, PathBuf};
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 /// Spawn `socket-patch remove` with the scrubbed env (`common::run_with_env`)
 /// plus telemetry disabled; `env` entries land last so per-test injections
@@ -875,10 +874,8 @@ fn drift_kept_vendored_remove_is_partial_failure() {
     );
 }
 
-#[path = "vlt_hosted_common/mod.rs"]
-mod vlt_hosted_common;
-#[path = "vlt_hosted_common/vendored.rs"]
-mod vlt_vendored;
+use crate::vlt_hosted_common;
+use crate::vlt_vendored;
 
 /// `remove --preserve-state` of a vlt-vendored purl restores the registry
 /// lock and package.json but keeps the directory artifact and the ledger
diff --git a/crates/socket-patch-cli/tests/remove_invariants.rs b/crates/socket-patch-cli/tests/remove/remove_invariants.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/remove_invariants.rs
rename to crates/socket-patch-cli/tests/remove/remove_invariants.rs
index 33ff8559..2a92ba27 100644
--- a/crates/socket-patch-cli/tests/remove_invariants.rs
+++ b/crates/socket-patch-cli/tests/remove/remove_invariants.rs
@@ -7,8 +7,7 @@
 
 use std::path::{Path, PathBuf};
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 const TWO_PATCH_MANIFEST: &str = r#"{
   "patches": {
@@ -1039,10 +1038,8 @@ fn remove_dry_run_with_rollback_does_not_create_blobs_dir() {
     assert!(litter.is_empty(), "no stage litter: {litter:?}");
 }
 
-#[path = "vlt_hosted_common/mod.rs"]
-mod vlt_hosted_common;
-#[path = "vlt_hosted_common/vendored.rs"]
-mod vlt_vendored;
+use crate::vlt_hosted_common;
+use crate::vlt_vendored;
 
 /// `remove --skip-rollback` of a vlt-vendored purl drops the manifest
 /// record only: the vlt wiring, the directory artifact and the ledger entry
diff --git a/crates/socket-patch-cli/tests/remove_network.rs b/crates/socket-patch-cli/tests/remove/remove_network.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/remove_network.rs
rename to crates/socket-patch-cli/tests/remove/remove_network.rs
diff --git a/crates/socket-patch-cli/tests/coverage_fix_repair_vendor_predelete.rs b/crates/socket-patch-cli/tests/repair/coverage_fix_repair_vendor_predelete.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/coverage_fix_repair_vendor_predelete.rs
rename to crates/socket-patch-cli/tests/repair/coverage_fix_repair_vendor_predelete.rs
diff --git a/crates/socket-patch-cli/tests/covgap_commands_repair.rs b/crates/socket-patch-cli/tests/repair/covgap_commands_repair.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/covgap_commands_repair.rs
rename to crates/socket-patch-cli/tests/repair/covgap_commands_repair.rs
diff --git a/crates/socket-patch-cli/tests/covgap_commands_repair_vendor.rs b/crates/socket-patch-cli/tests/repair/covgap_commands_repair_vendor.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/covgap_commands_repair_vendor.rs
rename to crates/socket-patch-cli/tests/repair/covgap_commands_repair_vendor.rs
index 64717291..bf4baf45 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_repair_vendor.rs
+++ b/crates/socket-patch-cli/tests/repair/covgap_commands_repair_vendor.rs
@@ -1762,7 +1762,3 @@ async fn repair_inventory_refresh_persist_failure_stays_loud() {
     );
 }
 
-#[path = "vlt_hosted_common/mod.rs"]
-mod vlt_hosted_common;
-#[path = "vlt_hosted_common/vendored.rs"]
-mod vlt_vendored;
diff --git a/crates/socket-patch-cli/tests/repair/main.rs b/crates/socket-patch-cli/tests/repair/main.rs
new file mode 100644
index 00000000..861a4d1d
--- /dev/null
+++ b/crates/socket-patch-cli/tests/repair/main.rs
@@ -0,0 +1,26 @@
+//! `repair`: invariants and vendored-tree repair across flavors.
+//!
+//! One test binary per command: each module was its own binary.
+
+#[path = "../common/mod.rs"]
+mod common;
+// `bun.rs` embeds its own copy of `vex_e2e_common`, which
+// `repair_vendor_e2e` also loads directly.
+#[allow(clippy::duplicate_mod)]
+#[path = "../vex_e2e_common/bun.rs"]
+mod bun_vex;
+#[path = "../npm_e2e_common/manifestless.rs"]
+mod npm_e2e_common;
+#[path = "../vex_e2e_common/mod.rs"]
+mod vex_e2e_common;
+#[path = "../vlt_hosted_common/mod.rs"]
+mod vlt_hosted_common;
+#[path = "../vlt_hosted_common/vendored.rs"]
+mod vlt_vendored;
+
+mod coverage_fix_repair_vendor_predelete;
+mod covgap_commands_repair;
+mod covgap_commands_repair_vendor;
+mod repair_invariants;
+mod repair_vendor_e2e;
+mod repair_vendor_flavors_e2e;
diff --git a/crates/socket-patch-cli/tests/repair_invariants.rs b/crates/socket-patch-cli/tests/repair/repair_invariants.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/repair_invariants.rs
rename to crates/socket-patch-cli/tests/repair/repair_invariants.rs
diff --git a/crates/socket-patch-cli/tests/repair_vendor_e2e.rs b/crates/socket-patch-cli/tests/repair/repair_vendor_e2e.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/repair_vendor_e2e.rs
rename to crates/socket-patch-cli/tests/repair/repair_vendor_e2e.rs
index ca3f90b3..a12a741d 100644
--- a/crates/socket-patch-cli/tests/repair_vendor_e2e.rs
+++ b/crates/socket-patch-cli/tests/repair/repair_vendor_e2e.rs
@@ -16,10 +16,8 @@ use sha2::{Digest, Sha256};
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "npm_e2e_common/manifestless.rs"]
-mod npm_e2e_common;
-#[path = "vex_e2e_common/mod.rs"]
-mod vex_e2e_common;
+use crate::npm_e2e_common;
+use crate::vex_e2e_common;
 
 fn binary() -> PathBuf {
     env!("CARGO_BIN_EXE_socket-patch").into()
@@ -1263,10 +1261,8 @@ async fn repaired_vendored_state_attests_manifest_less() {
     }
 }
 
-#[path = "vlt_hosted_common/mod.rs"]
-mod vlt_hosted_common;
-#[path = "vlt_hosted_common/vendored.rs"]
-mod vlt_vendored;
+use crate::vlt_hosted_common;
+use crate::vlt_vendored;
 
 /// `repair --dry-run` over a deleted vlt directory artifact previews the
 /// rebuild (`wouldRebuild`, the dir path) and writes nothing; the wet run
diff --git a/crates/socket-patch-cli/tests/repair_vendor_flavors_e2e.rs b/crates/socket-patch-cli/tests/repair/repair_vendor_flavors_e2e.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/repair_vendor_flavors_e2e.rs
rename to crates/socket-patch-cli/tests/repair/repair_vendor_flavors_e2e.rs
index f12d2aaf..44620f49 100644
--- a/crates/socket-patch-cli/tests/repair_vendor_flavors_e2e.rs
+++ b/crates/socket-patch-cli/tests/repair/repair_vendor_flavors_e2e.rs
@@ -27,11 +27,9 @@ use sha2::{Digest, Sha256};
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "vex_e2e_common/bun.rs"]
-mod bun_vex;
-#[path = "common/mod.rs"]
-mod common;
-#[path = "repair_vendor_flavors_e2e/vlt.rs"]
+use crate::bun_vex;
+use crate::common;
+#[path = "../repair_vendor_flavors_e2e/vlt.rs"]
 mod vlt;
 
 const ORG_SLUG: &str = "test-org";
diff --git a/crates/socket-patch-cli/tests/cli_rollback_silent.rs b/crates/socket-patch-cli/tests/rollback/cli_rollback_silent.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/cli_rollback_silent.rs
rename to crates/socket-patch-cli/tests/rollback/cli_rollback_silent.rs
diff --git a/crates/socket-patch-cli/tests/rollback/main.rs b/crates/socket-patch-cli/tests/rollback/main.rs
new file mode 100644
index 00000000..46ae232b
--- /dev/null
+++ b/crates/socket-patch-cli/tests/rollback/main.rs
@@ -0,0 +1,13 @@
+//! `rollback`: invariants, duality with remove, silent mode and the multi-copy blob gate.
+//!
+//! One test binary per command: each module was its own binary.
+
+#[path = "../vlt_hosted_common/mod.rs"]
+mod vlt_hosted_common;
+#[path = "../vlt_hosted_common/vendored.rs"]
+mod vlt_vendored;
+
+mod cli_rollback_silent;
+mod rollback_duality_invariants;
+mod rollback_invariants;
+mod rollback_multicopy_blob_gate;
diff --git a/crates/socket-patch-cli/tests/rollback_duality_invariants.rs b/crates/socket-patch-cli/tests/rollback/rollback_duality_invariants.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/rollback_duality_invariants.rs
rename to crates/socket-patch-cli/tests/rollback/rollback_duality_invariants.rs
diff --git a/crates/socket-patch-cli/tests/rollback_invariants.rs b/crates/socket-patch-cli/tests/rollback/rollback_invariants.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/rollback_invariants.rs
rename to crates/socket-patch-cli/tests/rollback/rollback_invariants.rs
index 4ae177ca..8a994e44 100644
--- a/crates/socket-patch-cli/tests/rollback_invariants.rs
+++ b/crates/socket-patch-cli/tests/rollback/rollback_invariants.rs
@@ -1064,10 +1064,8 @@ fn rollback_honors_manifest_path_override() {
     );
 }
 
-#[path = "vlt_hosted_common/mod.rs"]
-mod vlt_hosted_common;
-#[path = "vlt_hosted_common/vendored.rs"]
-mod vlt_vendored;
+use crate::vlt_hosted_common;
+use crate::vlt_vendored;
 
 /// An unscoped `rollback` over a vlt-vendored project reverts the `file`
 /// node, its edges and package.json to the registry bytes and removes the
diff --git a/crates/socket-patch-cli/tests/rollback_multicopy_blob_gate.rs b/crates/socket-patch-cli/tests/rollback/rollback_multicopy_blob_gate.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/rollback_multicopy_blob_gate.rs
rename to crates/socket-patch-cli/tests/rollback/rollback_multicopy_blob_gate.rs
diff --git a/crates/socket-patch-cli/tests/coverage_fix_scan_discovery_corrupt_ledger.rs b/crates/socket-patch-cli/tests/scan/coverage_fix_scan_discovery_corrupt_ledger.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/coverage_fix_scan_discovery_corrupt_ledger.rs
rename to crates/socket-patch-cli/tests/scan/coverage_fix_scan_discovery_corrupt_ledger.rs
diff --git a/crates/socket-patch-cli/tests/covgap_commands_fetch_stage.rs b/crates/socket-patch-cli/tests/scan/covgap_commands_fetch_stage.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/covgap_commands_fetch_stage.rs
rename to crates/socket-patch-cli/tests/scan/covgap_commands_fetch_stage.rs
diff --git a/crates/socket-patch-cli/tests/covgap_commands_scan_vendor_flow.rs b/crates/socket-patch-cli/tests/scan/covgap_commands_scan_vendor_flow.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/covgap_commands_scan_vendor_flow.rs
rename to crates/socket-patch-cli/tests/scan/covgap_commands_scan_vendor_flow.rs
index cf23ca75..decd65db 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_scan_vendor_flow.rs
+++ b/crates/socket-patch-cli/tests/scan/covgap_commands_scan_vendor_flow.rs
@@ -660,10 +660,8 @@ async fn scan_vendor_staging_error_interactive_prints_error_line() {
     );
 }
 
-#[path = "vlt_hosted_common/mod.rs"]
-mod vlt_hosted_common;
-#[path = "vlt_hosted_common/vendored.rs"]
-mod vlt_vendored;
+use crate::vlt_hosted_common;
+use crate::vlt_vendored;
 
 /// The dry-run preview over a vlt project already vendored at the offered
 /// uuid: the lock's `file` node is ours, so the vlt preflight exempts it
diff --git a/crates/socket-patch-cli/tests/covgap_ecosystem_dispatch.rs b/crates/socket-patch-cli/tests/scan/covgap_ecosystem_dispatch.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/covgap_ecosystem_dispatch.rs
rename to crates/socket-patch-cli/tests/scan/covgap_ecosystem_dispatch.rs
diff --git a/crates/socket-patch-cli/tests/hosted_management_refusals.rs b/crates/socket-patch-cli/tests/scan/hosted_management_refusals.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/hosted_management_refusals.rs
rename to crates/socket-patch-cli/tests/scan/hosted_management_refusals.rs
diff --git a/crates/socket-patch-cli/tests/hosted_symlinked_files.rs b/crates/socket-patch-cli/tests/scan/hosted_symlinked_files.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/hosted_symlinked_files.rs
rename to crates/socket-patch-cli/tests/scan/hosted_symlinked_files.rs
index 4ab06e22..431211e7 100644
--- a/crates/socket-patch-cli/tests/hosted_symlinked_files.rs
+++ b/crates/socket-patch-cli/tests/scan/hosted_symlinked_files.rs
@@ -28,10 +28,8 @@ use serde_json::{json, Value};
 use wiremock::matchers::{method, path, path_regex};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "common/mod.rs"]
-mod common;
-#[path = "vlt_hosted_common/mod.rs"]
-mod vlt_hosted_common;
+use crate::common;
+use crate::vlt_hosted_common;
 
 const ORG: &str = "test-org";
 const CODE: &str = "redirect_symlinked_file_unsupported";
diff --git a/crates/socket-patch-cli/tests/hosted_wheel_metadata_order.rs b/crates/socket-patch-cli/tests/scan/hosted_wheel_metadata_order.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/hosted_wheel_metadata_order.rs
rename to crates/socket-patch-cli/tests/scan/hosted_wheel_metadata_order.rs
index c6fe0ab6..1d48d1e7 100644
--- a/crates/socket-patch-cli/tests/hosted_wheel_metadata_order.rs
+++ b/crates/socket-patch-cli/tests/scan/hosted_wheel_metadata_order.rs
@@ -23,8 +23,7 @@ use serde_json::{json, Value};
 use wiremock::matchers::{method, path, path_regex};
 use wiremock::{Mock, MockServer, Request, Respond, ResponseTemplate};
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 const ORG: &str = "test-org";
 
diff --git a/crates/socket-patch-cli/tests/scan/main.rs b/crates/socket-patch-cli/tests/scan/main.rs
new file mode 100644
index 00000000..5e0ce94f
--- /dev/null
+++ b/crates/socket-patch-cli/tests/scan/main.rs
@@ -0,0 +1,25 @@
+//! `scan`: batching, ecosystem scope, ordering, paths, sync, hosted refusals and the vendor flow.
+//!
+//! One test binary per command: each module was its own binary.
+
+#[path = "../common/mod.rs"]
+mod common;
+#[path = "../vlt_hosted_common/mod.rs"]
+mod vlt_hosted_common;
+#[path = "../vlt_hosted_common/vendored.rs"]
+mod vlt_vendored;
+
+mod coverage_fix_scan_discovery_corrupt_ledger;
+mod covgap_commands_fetch_stage;
+mod covgap_commands_scan_vendor_flow;
+mod covgap_ecosystem_dispatch;
+mod hosted_management_refusals;
+mod hosted_symlinked_files;
+mod hosted_wheel_metadata_order;
+mod scan_batch_sizing_e2e;
+mod scan_ecosystems_scope_e2e;
+mod scan_invariants;
+mod scan_ordered_concurrency_e2e;
+mod scan_paths_e2e;
+mod scan_sync_e2e;
+mod scan_vendor_step_error_e2e;
diff --git a/crates/socket-patch-cli/tests/scan_batch_sizing_e2e.rs b/crates/socket-patch-cli/tests/scan/scan_batch_sizing_e2e.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/scan_batch_sizing_e2e.rs
rename to crates/socket-patch-cli/tests/scan/scan_batch_sizing_e2e.rs
diff --git a/crates/socket-patch-cli/tests/scan_ecosystems_scope_e2e.rs b/crates/socket-patch-cli/tests/scan/scan_ecosystems_scope_e2e.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/scan_ecosystems_scope_e2e.rs
rename to crates/socket-patch-cli/tests/scan/scan_ecosystems_scope_e2e.rs
diff --git a/crates/socket-patch-cli/tests/scan_invariants.rs b/crates/socket-patch-cli/tests/scan/scan_invariants.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/scan_invariants.rs
rename to crates/socket-patch-cli/tests/scan/scan_invariants.rs
index 25616c2a..abdf9d77 100644
--- a/crates/socket-patch-cli/tests/scan_invariants.rs
+++ b/crates/socket-patch-cli/tests/scan/scan_invariants.rs
@@ -2112,10 +2112,8 @@ async fn ecosystems_filter_keeps_records_but_not_wiring_live() {
     );
 }
 
-#[path = "vlt_hosted_common/mod.rs"]
-mod vlt_hosted_common;
-#[path = "vlt_hosted_common/vendored.rs"]
-mod vlt_vendored;
+use crate::vlt_hosted_common;
+use crate::vlt_vendored;
 
 /// vlt twin of `scan_agent_over_vendored_purl_surfaces_run_level_warning`:
 /// an agent scan over a purl a vlt directory artifact vendors skips it
diff --git a/crates/socket-patch-cli/tests/scan_ordered_concurrency_e2e.rs b/crates/socket-patch-cli/tests/scan/scan_ordered_concurrency_e2e.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/scan_ordered_concurrency_e2e.rs
rename to crates/socket-patch-cli/tests/scan/scan_ordered_concurrency_e2e.rs
diff --git a/crates/socket-patch-cli/tests/scan_paths_e2e.rs b/crates/socket-patch-cli/tests/scan/scan_paths_e2e.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/scan_paths_e2e.rs
rename to crates/socket-patch-cli/tests/scan/scan_paths_e2e.rs
diff --git a/crates/socket-patch-cli/tests/scan_sync_e2e.rs b/crates/socket-patch-cli/tests/scan/scan_sync_e2e.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/scan_sync_e2e.rs
rename to crates/socket-patch-cli/tests/scan/scan_sync_e2e.rs
diff --git a/crates/socket-patch-cli/tests/scan_vendor_step_error_e2e.rs b/crates/socket-patch-cli/tests/scan/scan_vendor_step_error_e2e.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/scan_vendor_step_error_e2e.rs
rename to crates/socket-patch-cli/tests/scan/scan_vendor_step_error_e2e.rs
diff --git a/crates/socket-patch-cli/tests/covgap_commands_update.rs b/crates/socket-patch-cli/tests/update/covgap_commands_update.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/covgap_commands_update.rs
rename to crates/socket-patch-cli/tests/update/covgap_commands_update.rs
index 809bb3c7..b2d75aaf 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_update.rs
+++ b/crates/socket-patch-cli/tests/update/covgap_commands_update.rs
@@ -9,12 +9,8 @@
 //! itself must never be a swap target. Fixture shapes are copied from
 //! self_update_e2e.rs / interactive_prompts_e2e.rs.
 
-#[path = "common/pty_io.rs"]
-mod pty_io;
-#[path = "common/mod.rs"]
-mod common;
-#[path = "common/update_fixture.rs"]
-mod update_fixture;
+use crate::common;
+use crate::update_fixture;
 
 use update_fixture::{make_served_binary, run_installed, staged_install, FakeReleaseBuilder};
 
diff --git a/crates/socket-patch-cli/tests/covgap_update_download.rs b/crates/socket-patch-cli/tests/update/covgap_update_download.rs
similarity index 96%
rename from crates/socket-patch-cli/tests/covgap_update_download.rs
rename to crates/socket-patch-cli/tests/update/covgap_update_download.rs
index 6bf578ed..18cf2e01 100644
--- a/crates/socket-patch-cli/tests/covgap_update_download.rs
+++ b/crates/socket-patch-cli/tests/update/covgap_update_download.rs
@@ -9,10 +9,8 @@
 //! a failed update must leave the install byte-identical with no stage
 //! droppings.
 
-#[path = "common/mod.rs"]
-mod common;
-#[path = "common/update_fixture.rs"]
-mod update_fixture;
+use crate::common;
+use crate::update_fixture;
 
 use wiremock::matchers::{method, path as urlpath};
 use wiremock::{Mock, ResponseTemplate};
diff --git a/crates/socket-patch-cli/tests/covgap_update_swap.rs b/crates/socket-patch-cli/tests/update/covgap_update_swap.rs
similarity index 98%
rename from crates/socket-patch-cli/tests/covgap_update_swap.rs
rename to crates/socket-patch-cli/tests/update/covgap_update_swap.rs
index 2730744a..bb9c4f8b 100644
--- a/crates/socket-patch-cli/tests/covgap_update_swap.rs
+++ b/crates/socket-patch-cli/tests/update/covgap_update_swap.rs
@@ -16,10 +16,7 @@
 //! `CARGO_BIN_EXE_socket-patch` itself must never be a swap target — and
 //! re-verifies the real artifact at the end.
 
-#[path = "common/mod.rs"]
-mod common;
-#[path = "common/update_fixture.rs"]
-mod update_fixture;
+use crate::update_fixture;
 
 use std::path::Path;
 
diff --git a/crates/socket-patch-cli/tests/update/main.rs b/crates/socket-patch-cli/tests/update/main.rs
new file mode 100644
index 00000000..0b4629b5
--- /dev/null
+++ b/crates/socket-patch-cli/tests/update/main.rs
@@ -0,0 +1,16 @@
+//! Self-update channels, downloads, swaps and the update notifier.
+//!
+//! One test binary per command: each module was its own binary.
+
+#[path = "../common/mod.rs"]
+mod common;
+#[path = "../common/pty_io.rs"]
+mod pty_io;
+#[path = "../common/update_fixture.rs"]
+mod update_fixture;
+
+mod covgap_commands_update;
+mod covgap_update_download;
+mod covgap_update_swap;
+mod self_update_channels_e2e;
+mod update_notifier_e2e;
diff --git a/crates/socket-patch-cli/tests/self_update_channels_e2e.rs b/crates/socket-patch-cli/tests/update/self_update_channels_e2e.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/self_update_channels_e2e.rs
rename to crates/socket-patch-cli/tests/update/self_update_channels_e2e.rs
index a13fb56f..526100ba 100644
--- a/crates/socket-patch-cli/tests/self_update_channels_e2e.rs
+++ b/crates/socket-patch-cli/tests/update/self_update_channels_e2e.rs
@@ -16,10 +16,8 @@
 //! the prefix comparison never fires — which is exactly the behavior the
 //! real cargo/launcher installers see, since they resolve real paths.
 
-#[path = "common/mod.rs"]
-mod common;
-#[path = "common/update_fixture.rs"]
-mod update_fixture;
+use crate::common;
+use crate::update_fixture;
 
 use sha2::{Digest, Sha256};
 use update_fixture::{
diff --git a/crates/socket-patch-cli/tests/update_notifier_e2e.rs b/crates/socket-patch-cli/tests/update/update_notifier_e2e.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/update_notifier_e2e.rs
rename to crates/socket-patch-cli/tests/update/update_notifier_e2e.rs
index 6589c99f..4e679d76 100644
--- a/crates/socket-patch-cli/tests/update_notifier_e2e.rs
+++ b/crates/socket-patch-cli/tests/update/update_notifier_e2e.rs
@@ -11,10 +11,8 @@
 //! without a manifest, and `--version`/`--help` never dispatch (clap
 //! handles them before the hook), so none of those can carry the notifier.
 
-#[path = "common/mod.rs"]
-mod common;
-#[path = "common/update_fixture.rs"]
-mod update_fixture;
+use crate::common;
+use crate::update_fixture;
 
 use std::path::Path;
 use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
diff --git a/crates/socket-patch-cli/tests/docker_vendor_common_selftest.rs b/crates/socket-patch-cli/tests/vendor/docker_vendor_common_selftest.rs
similarity index 98%
rename from crates/socket-patch-cli/tests/docker_vendor_common_selftest.rs
rename to crates/socket-patch-cli/tests/vendor/docker_vendor_common_selftest.rs
index 729f7783..4677da7e 100644
--- a/crates/socket-patch-cli/tests/docker_vendor_common_selftest.rs
+++ b/crates/socket-patch-cli/tests/vendor/docker_vendor_common_selftest.rs
@@ -15,8 +15,7 @@ use std::process::{Command, Output, Stdio};
 
 use sha2::{Digest, Sha256};
 
-#[path = "docker_vendor_common/mod.rs"]
-mod docker_vendor_common;
+use crate::docker_vendor_common;
 
 use docker_vendor_common::{bash_prelude, stage_patch_fn};
 
diff --git a/crates/socket-patch-cli/tests/e2e_golang_redirect.rs b/crates/socket-patch-cli/tests/vendor/e2e_golang_redirect.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/e2e_golang_redirect.rs
rename to crates/socket-patch-cli/tests/vendor/e2e_golang_redirect.rs
index 666220ce..3bcfee7d 100644
--- a/crates/socket-patch-cli/tests/e2e_golang_redirect.rs
+++ b/crates/socket-patch-cli/tests/vendor/e2e_golang_redirect.rs
@@ -12,8 +12,7 @@
 use std::os::unix::fs::PermissionsExt;
 use std::path::Path;
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 use common::{binary, git_sha256, git_sha256_file, write_blob, write_minimal_manifest, PatchEntry};
 
diff --git a/crates/socket-patch-cli/tests/in_process_vendor_bun.rs b/crates/socket-patch-cli/tests/vendor/in_process_vendor_bun.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/in_process_vendor_bun.rs
rename to crates/socket-patch-cli/tests/vendor/in_process_vendor_bun.rs
index 38f15e78..937a6e48 100644
--- a/crates/socket-patch-cli/tests/in_process_vendor_bun.rs
+++ b/crates/socket-patch-cli/tests/vendor/in_process_vendor_bun.rs
@@ -38,10 +38,8 @@ use std::time::{Duration, Instant};
 use wiremock::matchers::{method, path};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "vex_e2e_common/bun.rs"]
-mod bun_vex;
-#[path = "common/mod.rs"]
-mod common;
+use crate::bun_vex;
+use crate::common;
 
 const ORG: &str = "test-org";
 const UUID: &str = "11111111-1111-4111-8111-111111111111";
diff --git a/crates/socket-patch-cli/tests/vendor/main.rs b/crates/socket-patch-cli/tests/vendor/main.rs
new file mode 100644
index 00000000..41bd1f72
--- /dev/null
+++ b/crates/socket-patch-cli/tests/vendor/main.rs
@@ -0,0 +1,18 @@
+//! `vendor`: lockfile-only gems, pristine fetch order, no-network re-runs, bun and the hosted redirects.
+//!
+//! One test binary per command: each module was its own binary.
+
+#[path = "../vex_e2e_common/bun.rs"]
+mod bun_vex;
+#[path = "../common/mod.rs"]
+mod common;
+#[path = "../docker_vendor_common/mod.rs"]
+mod docker_vendor_common;
+
+mod docker_vendor_common_selftest;
+mod e2e_golang_redirect;
+mod in_process_vendor_bun;
+mod redirect_npm_allow_remote;
+mod vendor_gem_lockfile_only_e2e;
+mod vendor_pristine_fetch_order_e2e;
+mod vendor_rerun_no_network_e2e;
diff --git a/crates/socket-patch-cli/tests/redirect_npm_allow_remote.rs b/crates/socket-patch-cli/tests/vendor/redirect_npm_allow_remote.rs
similarity index 99%
rename from crates/socket-patch-cli/tests/redirect_npm_allow_remote.rs
rename to crates/socket-patch-cli/tests/vendor/redirect_npm_allow_remote.rs
index 1c38ab3b..6314f168 100644
--- a/crates/socket-patch-cli/tests/redirect_npm_allow_remote.rs
+++ b/crates/socket-patch-cli/tests/vendor/redirect_npm_allow_remote.rs
@@ -33,8 +33,7 @@ use serde_json::{json, Value};
 use wiremock::matchers::{method, path, path_regex};
 use wiremock::{Mock, MockServer, ResponseTemplate};
 
-#[path = "common/mod.rs"]
-mod common;
+use crate::common;
 
 const ORG: &str = "test-org";
 const NAME: &str = "allow-remote-dep";
diff --git a/crates/socket-patch-cli/tests/vendor_gem_lockfile_only_e2e.rs b/crates/socket-patch-cli/tests/vendor/vendor_gem_lockfile_only_e2e.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/vendor_gem_lockfile_only_e2e.rs
rename to crates/socket-patch-cli/tests/vendor/vendor_gem_lockfile_only_e2e.rs
diff --git a/crates/socket-patch-cli/tests/vendor_pristine_fetch_order_e2e.rs b/crates/socket-patch-cli/tests/vendor/vendor_pristine_fetch_order_e2e.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/vendor_pristine_fetch_order_e2e.rs
rename to crates/socket-patch-cli/tests/vendor/vendor_pristine_fetch_order_e2e.rs
diff --git a/crates/socket-patch-cli/tests/vendor_rerun_no_network_e2e.rs b/crates/socket-patch-cli/tests/vendor/vendor_rerun_no_network_e2e.rs
similarity index 100%
rename from crates/socket-patch-cli/tests/vendor_rerun_no_network_e2e.rs
rename to crates/socket-patch-cli/tests/vendor/vendor_rerun_no_network_e2e.rs
diff --git a/crates/socket-patch-core/src/crawlers/maven_pom_equivalence_tests.rs b/crates/socket-patch-core/src/crawlers/maven_pom_equivalence_tests.rs
index 3eb33b61..1f2de7d8 100644
--- a/crates/socket-patch-core/src/crawlers/maven_pom_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/crawlers/maven_pom_equivalence_tests.rs
@@ -1,273 +1,11 @@
-//! Equivalence oracle for the POM coordinate parser, which now uses static
-//! tag needles, borrows comment-free lines, skips tag-free lines and stops
-//! once the project's own coordinates are complete. The previous
-//! implementation is kept here verbatim; the production parser must return
-//! the identical result on every document.
+//! Seeded POM documents for the coordinate parser, which uses static tag
+//! needles, borrows comment-free lines, skips tag-free lines and stops once
+//! the project's own coordinates are complete. Each sweep is pinned by a
+//! golden (see `crate::golden`) blessed when #257's verbatim previous
+//! parser and this one agreed on every document.
 
 use super::maven_crawler::parse_pom_group_artifact_version;
-
-/// Extract the text value between `<element>` and `</element>` on a single line.
-fn extract_xml_value(line: &str, element: &str) -> Option<String> {
-    let open = format!("<{element}>");
-    let close = format!("</{element}>");
-    let start = line.find(&open)?;
-    let value_start = start + open.len();
-    let end = line[value_start..].find(&close)?;
-    let value = line[value_start..value_start + end].trim().to_string();
-    if value.is_empty() {
-        None
-    } else {
-        Some(value)
-    }
-}
-
-/// Strip the commented-out portions of a single line, threading the
-/// `in_comment` state across lines so multi-line `<!-- ... -->` blocks are
-/// handled. XML comments do not nest, so we always close on the first `-->`.
-///
-/// This runs before any tag matching: POM files routinely carry license
-/// headers and commented-out `<dependency>`/`<build>` snippets, and naive
-/// substring matching would otherwise miscount skip-section depth (e.g. a
-/// comment containing `</build>` could "close" a block that is still open
-/// and leak a plugin's coordinates as the project's).
-fn strip_comment_spans(line: &str, in_comment: &mut bool) -> String {
-    let mut out = String::new();
-    let mut rest = line;
-    loop {
-        if *in_comment {
-            match rest.find("-->") {
-                Some(end) => {
-                    rest = &rest[end + 3..];
-                    *in_comment = false;
-                }
-                None => return out, // remainder of the line is inside a comment
-            }
-        } else {
-            match rest.find("<!--") {
-                Some(start) => {
-                    out.push_str(&rest[..start]);
-                    rest = &rest[start + 4..];
-                    *in_comment = true;
-                }
-                None => {
-                    out.push_str(rest);
-                    return out;
-                }
-            }
-        }
-    }
-}
-
-/// Find the first *real* opening tag for `element` on this line and report
-/// whether it self-closes (`Some(true)` for `<dependencies/>`, `Some(false)`
-/// for a plain `<dependencies>` or `<dependencies foo="x">`); `None` if there
-/// is no opening tag at all.
-///
-/// "Real" means there is a tag boundary immediately after the element name —
-/// `>`, `/`, whitespace, or end-of-line. This is critical: a bare substring
-/// match would prefix-match a *different* element such as `<buildtools>` as if
-/// it opened `<build>`. Because the corresponding close `</buildtools>` never
-/// equals `</build>`, that phantom open would never be matched by a close and
-/// would leak the entire remainder of the document into the skip section,
-/// dropping the project's real coordinates.
-fn opening_tag(line: &str, element: &str) -> Option<bool> {
-    let needle = format!("<{element}");
-    let mut from = 0;
-    while let Some(rel) = line[from..].find(&needle) {
-        let pos = from + rel;
-        let after = &line[pos + needle.len()..];
-        match after.chars().next() {
-            // Tag name runs to the end of the line (attributes continue on the
-            // next line): a real, non-self-closing open.
-            None => return Some(false),
-            Some(c) if c == '>' || c == '/' || c.is_whitespace() => {
-                let self_closes = match after.find('>') {
-                    Some(gt) => after[..gt].trim_end().ends_with('/'),
-                    None => false,
-                };
-                return Some(self_closes);
-            }
-            // Prefix match of a longer name (`<buildtools>`): keep scanning for
-            // a genuine `<build>`/`<build ...>`/`<build/>` later on the line.
-            _ => from = pos + needle.len(),
-        }
-    }
-    None
-}
-
-/// Does this line contain a *real* closing tag `</element>` (tolerating
-/// whitespace before `>`, e.g. `</build >`)? The boundary `>` is required, so
-/// `</buildtools>` is not treated as a close of `</build>` — mirroring the
-/// boundary discipline of [`opening_tag`].
-fn contains_closing_tag(line: &str, element: &str) -> bool {
-    let needle = format!("</{element}");
-    let mut from = 0;
-    while let Some(rel) = line[from..].find(&needle) {
-        let pos = from + rel;
-        let after = &line[pos + needle.len()..];
-        if after.trim_start().starts_with('>') {
-            return true;
-        }
-        from = pos + needle.len();
-    }
-    false
-}
-
-/// Parse `groupId`, `artifactId`, and `version` from a POM XML file.
-///
-/// Uses a simple line-based parser — no XML crate dependency.
-/// Tracks nesting depth to skip `<dependencies>`, `<build>`, `<profiles>`, etc.
-/// Extracts top-level `<groupId>`, `<artifactId>`, `<version>` from `<project>`.
-/// Falls back to `<parent>` block for groupId if missing at top level.
-/// Returns `None` for property references (`${...}`).
-fn reference_parse_pom(content: &str) -> Option<(String, String, String)> {
-    let mut group_id: Option<String> = None;
-    let mut artifact_id: Option<String> = None;
-    let mut version: Option<String> = None;
-    let mut parent_group_id: Option<String> = None;
-
-    let mut in_parent = false;
-    let mut in_comment = false;
-    let mut skip_depth: u32 = 0;
-
-    let skip_sections = [
-        "dependencies",
-        "build",
-        "profiles",
-        "reporting",
-        "dependencyManagement",
-        "pluginManagement",
-        "modules",
-        "distributionManagement",
-        "repositories",
-        "pluginRepositories",
-        // Free-form (xs:any): a property may be named exactly `version`/
-        // `groupId`/`artifactId` (Maven warns but permits it) and would
-        // otherwise win first-match extraction over the project's own
-        // coordinates. Project coordinates never live in <properties>,
-        // so skipping it can only prevent leaks.
-        "properties",
-    ];
-
-    for line in content.lines() {
-        let cleaned = strip_comment_spans(line, &mut in_comment);
-        let trimmed = cleaned.trim();
-
-        // Check for skip section open/close. A tag that opens and closes on
-        // the same line (`<modules></modules>`) or self-closes
-        // (`<dependencies/>`) leaves the depth unchanged; only a lone open
-        // increments and a lone close decrements.
-        //
-        // Any line carrying a close tag still holds that section's content up
-        // to the close (`<version>9.9</version></dependencies>`, or a whole
-        // compact `<dependencies>...</dependencies>` block), so it must not
-        // reach extraction even once the depth is back to 0 — otherwise a
-        // dependency's coordinates leak as the project's. A coordinate that
-        // legitimately follows a close on the same line is sacrificed to
-        // `None`, which scan rescues via the directory-path fallback.
-        let mut saw_section_close = false;
-        for section in &skip_sections {
-            let open = opening_tag(trimmed, section);
-            let has_open = open.is_some();
-            let has_close = contains_closing_tag(trimmed, section);
-            saw_section_close |= has_close;
-            if has_open && !has_close && open != Some(true) {
-                skip_depth += 1;
-            } else if has_close && !has_open {
-                skip_depth = skip_depth.saturating_sub(1);
-            }
-        }
-
-        if skip_depth > 0 || saw_section_close {
-            continue;
-        }
-
-        // Track parent section (a self-closing `<parent/>` carries no
-        // coordinates, so it never opens a parent block).
-        let parent_open = opening_tag(trimmed, "parent");
-        if parent_open.is_some()
-            && !contains_closing_tag(trimmed, "parent")
-            && parent_open != Some(true)
-        {
-            in_parent = true;
-            continue;
-        }
-        if contains_closing_tag(trimmed, "parent") {
-            in_parent = false;
-            continue;
-        }
-
-        if in_parent {
-            if parent_group_id.is_none() {
-                if let Some(val) = extract_xml_value(trimmed, "groupId") {
-                    if val.contains("${") {
-                        // Property reference in parent — skip
-                    } else {
-                        parent_group_id = Some(val);
-                    }
-                }
-            }
-            continue;
-        }
-
-        // Extract top-level coordinates
-        if group_id.is_none() {
-            if let Some(val) = extract_xml_value(trimmed, "groupId") {
-                if val.contains("${") {
-                    return None;
-                }
-                group_id = Some(val);
-            }
-        }
-        if artifact_id.is_none() {
-            if let Some(val) = extract_xml_value(trimmed, "artifactId") {
-                if val.contains("${") {
-                    return None;
-                }
-                artifact_id = Some(val);
-            }
-        }
-        if version.is_none() {
-            if let Some(val) = extract_xml_value(trimmed, "version") {
-                if val.contains("${") {
-                    return None;
-                }
-                version = Some(val);
-            }
-        }
-    }
-
-    // Fall back to parent groupId
-    let final_group_id = group_id.or(parent_group_id)?;
-    let final_artifact_id = artifact_id?;
-    let final_version = version?;
-
-    if final_group_id.is_empty() || final_artifact_id.is_empty() || final_version.is_empty() {
-        return None;
-    }
-
-    Some((final_group_id, final_artifact_id, final_version))
-}
-
-/// Deterministic xorshift64* — no `rand` dev-dependency.
-struct Rng(u64);
-
-impl Rng {
-    fn next(&mut self) -> u64 {
-        let mut x = self.0;
-        x ^= x >> 12;
-        x ^= x << 25;
-        x ^= x >> 27;
-        self.0 = x;
-        x.wrapping_mul(0x2545_F491_4F6C_DD1D)
-    }
-    fn below(&mut self, n: usize) -> usize {
-        (self.next() % n as u64) as usize
-    }
-    fn pick<'a>(&mut self, items: &[&'a str]) -> &'a str {
-        items[self.below(items.len())]
-    }
-}
+use crate::test_rng::Rng;
 
 /// Line fragments covering every branch of the parser: coordinates (plain,
 /// empty, `${…}`, split across lines), skip-section opens/closes in every
@@ -362,25 +100,32 @@ fn synth_pom(rng: &mut Rng) -> String {
 }
 
 #[test]
-fn parser_matches_reference_on_random_poms() {
+fn parser_matches_golden_on_random_poms() {
+    let mut g = crate::golden::Golden::new(
+        "maven_pom_random",
+        "One seeded POM fragment soup, parsed for its coordinates.",
+    )
+    .chunked(100);
     let mut rng = Rng(0xA076_1D64_78BD_642F);
-    for case in 0..20_000 {
+    for _ in 0..20_000 {
         let pom = synth_pom(&mut rng);
-        assert_eq!(
-            parse_pom_group_artifact_version(&pom),
-            reference_parse_pom(&pom),
-            "case {case}: {pom:?}"
-        );
+        g.next(&pom, &parse_pom_group_artifact_version(&pom));
     }
+    g.finish();
 }
 
 /// Well-formed project poms with the coordinates placed before, between and
 /// after the noisy sections — the shapes the early exit stops on.
 #[test]
-fn parser_matches_reference_on_project_shaped_poms() {
+fn parser_matches_golden_on_project_shaped_poms() {
+    let mut g = crate::golden::Golden::new(
+        "maven_pom_project",
+        "One seeded project-shaped POM, parsed for its coordinates.",
+    )
+    .chunked(25);
     let mut rng = Rng(0xE703_7ED1_A0B4_28DB);
     let mut resolved = 0;
-    for case in 0..5_000 {
+    for _ in 0..5_000 {
         let mut lines = vec![
             "<?xml version=\"1.0\"?>".to_string(),
             "<project>".to_string(),
@@ -400,13 +145,10 @@ fn parser_matches_reference_on_project_shaped_poms() {
         lines.extend(body);
         lines.push("</project>".to_string());
         let pom = lines.join(rng.pick(&["\n", "\r\n"]));
-        let want = reference_parse_pom(&pom);
-        resolved += usize::from(want.is_some());
-        assert_eq!(
-            parse_pom_group_artifact_version(&pom),
-            want,
-            "case {case}: {pom:?}"
-        );
+        let got = parse_pom_group_artifact_version(&pom);
+        resolved += usize::from(got.is_some());
+        g.next(&pom, &got);
     }
     assert!(resolved > 1_000, "the corpus exercises the resolving path");
+    g.finish();
 }
diff --git a/crates/socket-patch-core/src/golden.rs b/crates/socket-patch-core/src/golden.rs
new file mode 100644
index 00000000..7c037715
--- /dev/null
+++ b/crates/socket-patch-core/src/golden.rs
@@ -0,0 +1,210 @@
+//! Golden snapshots of the randomized equivalence sweeps.
+//!
+//! #257 moved the crawlers onto the blocking pool and made the hosted
+//! rewriters single-pass, and kept each previous implementation as a
+//! test-only oracle that the new one had to match on thousands of generated
+//! inputs. The oracles are gone; what they proved is kept here instead. Each
+//! sweep still generates the same inputs from the same seeds, and its golden
+//! file pins, per case, a digest of the input and a digest of the output the
+//! oracle and the production code agreed on when the file was blessed. A
+//! changed output digest is a behavior change on that case; a changed input
+//! digest means the generator itself drifted.
+//!
+//! Bless only for an intended behavior change:
+//! `SOCKET_PATCH_BLESS_GOLDEN=1 cargo test -p socket-patch-core <test>`
+//! rewrites the file (review its diff like any other golden).
+
+use std::fmt::Write as _;
+use std::path::PathBuf;
+
+use serde::Serialize;
+use sha2::{Digest as _, Sha256};
+
+/// One sweep's recorded cases, compared against (or blessed into)
+/// `tests/equivalence/<name>.golden` by [`Golden::finish`].
+pub(crate) struct Golden {
+    name: &'static str,
+    about: &'static str,
+    lines: Vec<String>,
+    /// Cases folded into one line, so a 20k-case sweep stays a small file.
+    chunk: usize,
+    cases: usize,
+    pending: Vec<(String, String)>,
+}
+
+/// A short stable digest of `value`'s JSON encoding.
+pub(crate) fn digest<T: Serialize + ?Sized>(value: &T) -> String {
+    let json = serde_json::to_vec(value).expect("golden values serialize");
+    let hash = Sha256::digest(&json);
+    hash[..8].iter().fold(String::new(), |mut s, b| {
+        let _ = write!(s, "{b:02x}");
+        s
+    })
+}
+
+thread_local! {
+    static ACTIVE: std::cell::RefCell<Option<Golden>> = const { std::cell::RefCell::new(None) };
+}
+
+/// A [`Golden`] the sweep's shared helpers record into through [`record`],
+/// for the length of one test.
+pub(crate) struct Sweep;
+
+impl Sweep {
+    pub(crate) fn start(name: &'static str, about: &'static str) -> Self {
+        Self::with(Golden::new(name, about))
+    }
+
+    pub(crate) fn with(golden: Golden) -> Self {
+        ACTIVE.with(|a| *a.borrow_mut() = Some(golden));
+        Sweep
+    }
+
+    pub(crate) fn finish(self) {
+        let golden = ACTIVE
+            .with(|a| a.borrow_mut().take())
+            .expect("sweep started");
+        golden.finish();
+    }
+}
+
+impl Drop for Sweep {
+    fn drop(&mut self) {
+        ACTIVE.with(|a| a.borrow_mut().take());
+    }
+}
+
+/// Record one case into the running [`Sweep`], if any.
+pub(crate) fn record<I, O>(input: &I, output: &O)
+where
+    I: Serialize + ?Sized,
+    O: Serialize + ?Sized,
+{
+    ACTIVE.with(|a| {
+        if let Some(golden) = a.borrow_mut().as_mut() {
+            golden.next(input, output);
+        }
+    });
+}
+
+impl Golden {
+    /// `about` becomes the file's header: what one case is.
+    pub(crate) fn new(name: &'static str, about: &'static str) -> Self {
+        Self {
+            name,
+            about,
+            lines: Vec::new(),
+            chunk: 1,
+            cases: 0,
+            pending: Vec::new(),
+        }
+    }
+
+    /// Fold every `chunk` consecutive cases into one golden line.
+    pub(crate) fn chunked(mut self, chunk: usize) -> Self {
+        self.chunk = chunk.max(1);
+        self
+    }
+
+    /// Record one case under `key` (unique within the sweep).
+    pub(crate) fn case<I, O>(&mut self, key: impl std::fmt::Display, input: &I, output: &O)
+    where
+        I: Serialize + ?Sized,
+        O: Serialize + ?Sized,
+    {
+        self.cases += 1;
+        if self.chunk == 1 {
+            let key = key.to_string().replace(char::is_whitespace, "_");
+            self.lines
+                .push(format!("{key} {} {}", digest(input), digest(output)));
+            return;
+        }
+        self.pending.push((digest(input), digest(output)));
+        if self.pending.len() == self.chunk {
+            self.flush();
+        }
+    }
+
+    fn flush(&mut self) {
+        if self.pending.is_empty() {
+            return;
+        }
+        let first = self.cases - self.pending.len();
+        let (inputs, outputs): (Vec<_>, Vec<_>) =
+            std::mem::take(&mut self.pending).into_iter().unzip();
+        self.lines.push(format!(
+            "{first}-{} {} {}",
+            self.cases - 1,
+            digest(&inputs),
+            digest(&outputs)
+        ));
+    }
+
+    /// [`Golden::case`] keyed by its position in the sweep.
+    pub(crate) fn next<I, O>(&mut self, input: &I, output: &O)
+    where
+        I: Serialize + ?Sized,
+        O: Serialize + ?Sized,
+    {
+        self.case(self.cases, input, output);
+    }
+
+    fn path(&self) -> PathBuf {
+        PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+            .join("tests/equivalence")
+            .join(format!("{}.golden", self.name))
+    }
+
+    /// Compare every recorded case with the golden file, naming the first
+    /// that differs, or rewrite the file under `SOCKET_PATCH_BLESS_GOLDEN`.
+    pub(crate) fn finish(mut self) {
+        self.flush();
+        let path = self.path();
+        if std::env::var_os("SOCKET_PATCH_BLESS_GOLDEN").is_some() {
+            let mut text = String::new();
+            for line in self.about.lines() {
+                let _ = writeln!(text, "# {line}");
+            }
+            text.push_str("# <case> <input digest> <output digest>\n");
+            for line in &self.lines {
+                text.push_str(line);
+                text.push('\n');
+            }
+            std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+            std::fs::write(&path, text).unwrap();
+            return;
+        }
+        let text = std::fs::read_to_string(&path)
+            .unwrap_or_else(|e| panic!("read {}: {e}", path.display()));
+        let want: Vec<&str> = text
+            .lines()
+            .map(|l| l.trim_end_matches('\r'))
+            .filter(|l| !l.is_empty() && !l.starts_with('#'))
+            .collect();
+        for (got, want) in self.lines.iter().zip(&want) {
+            let (got_key, got_rest) = got.split_once(' ').unwrap();
+            let (want_key, want_rest) = want.split_once(' ').unwrap_or((want, ""));
+            assert_eq!(got_key, want_key, "{}: case order changed", self.name);
+            if got_rest != want_rest {
+                let (got_in, got_out) = got_rest.split_once(' ').unwrap();
+                let (want_in, want_out) = want_rest.split_once(' ').unwrap_or((want_rest, ""));
+                assert_eq!(
+                    got_in, want_in,
+                    "{}: case {got_key}: the generated input changed (generator drift)",
+                    self.name
+                );
+                assert_eq!(
+                    got_out, want_out,
+                    "{}: case {got_key}: output differs from the blessed oracle output",
+                    self.name
+                );
+            }
+        }
+        assert_eq!(
+            self.lines.len(),
+            want.len(),
+            "{}: case count changed",
+            self.name
+        );
+    }
+}
diff --git a/crates/socket-patch-core/src/lib.rs b/crates/socket-patch-core/src/lib.rs
index 196beafe..a55bb77d 100644
--- a/crates/socket-patch-core/src/lib.rs
+++ b/crates/socket-patch-core/src/lib.rs
@@ -13,3 +13,8 @@ pub mod utils;
 pub mod vendor;
 pub mod vex;
 
+
+#[cfg(test)]
+mod golden;
+#[cfg(test)]
+mod test_rng;
diff --git a/crates/socket-patch-core/src/patch/redirect/cargo_lock_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/cargo_lock_equivalence_tests.rs
index 570ee762..08284976 100644
--- a/crates/socket-patch-core/src/patch/redirect/cargo_lock_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/cargo_lock_equivalence_tests.rs
@@ -1,294 +1,15 @@
-//! Equivalence oracle for the Cargo.lock hosted splice, which now edits the
-//! byte spans of the lock's one parse ([`CargoLock::parse`] →
-//! [`CargoLock::plan_hosted`]) instead of searching the text for cargo's
-//! canonical `[[package]]\nname = …\nversion = …\n` header. The previous
-//! line-grammar planner is kept below, test-only, as the oracle: over every
-//! canonical lock shape (v1 `[metadata]` + full-id references, v3/v4 inline
-//! checksums, multi-source twins, `[root]`, trailers, a missing final
-//! newline) both must produce identical bytes and identical `FileEdit`s,
-//! for every package of every lock and a re-run over the result. (Locks the
-//! old grammar could not read — a comment or reordered key inside a block —
-//! are where the two differ by design: the span planner finds them.)
-
-use std::sync::LazyLock;
-
-use regex::Regex;
-use serde_json::Value;
-
-use crate::formats::cargo::hosted::{CargoLockPlan, CARGO_LOCK_REFERENCE_KIND};
+//! Seeded and hand-written Cargo.lock sweeps for the hosted splice, which
+//! edits the byte spans of the lock's one parse ([`CargoLock::parse`] →
+//! [`CargoLock::plan_hosted`]). Every plan is pinned per case by
+//! `tests/equivalence/cargo_lock_*.golden`, blessed while the previous
+//! line-grammar planner still ran beside it as an oracle (identical bytes
+//! and edits wherever that grammar could read the lock).
+
+use crate::formats::cargo::hosted::CargoLockPlan;
 use crate::formats::cargo::CargoLock;
+use crate::golden::Golden;
 use crate::patch::redirect::FileEdit;
-
-// ── the oracle: the previous line-grammar planner, verbatim ──
-
-/// The line-anchored header cargo writes for `name`@`version`.
-fn package_head(name: &str, version: &str) -> String {
-    format!("[[package]]\nname = \"{name}\"\nversion = \"{version}\"\n")
-}
-
-/// Every offset of `needle` in `content` that starts a line.
-fn line_anchored<'c>(content: &'c str, needle: &'c str) -> impl Iterator<Item = usize> + 'c {
-    content
-        .match_indices(needle)
-        .map(|(at, _)| at)
-        .filter(|&at| at == 0 || content.as_bytes()[at - 1] == b'\n')
-}
-
-static CARGO_LOCK_SOURCE_LINE_RE: LazyLock<Regex> = LazyLock::new(|| {
-    Regex::new(r#"(?m)^source = "([^"]*)"$"#).expect("static lock source-line regex is valid")
-});
-static CARGO_LOCK_CHECKSUM_LINE_RE: LazyLock<Regex> = LazyLock::new(|| {
-    Regex::new(r#"(?m)^checksum = "[^"]*"$"#).expect("static lock checksum-line regex is valid")
-});
-// `$` (not `\n`) so it also anchors a source line that ENDS the block: the
-// trailing newline sits outside the block region.
-static CARGO_LOCK_AFTER_SOURCE_RE: LazyLock<Regex> = LazyLock::new(|| {
-    Regex::new(r#"(?m)^(source = "[^"]*")$"#).expect("static source-line anchor regex is valid")
-});
-
-/// Repoint the crate's `[[package]]` at the hosted index with the patched
-/// `.crate`'s checksum, in whichever Cargo.lock format the file is:
-///
-/// * v2–v4: `source` + an inline `checksum` in the entry;
-/// * v1 (cargo < 1.41, still read by every cargo): the entry carries only
-///   `source`; the checksum lives in the trailing `[metadata]` table under
-///   `"checksum <name> <version> (<source>)"`, and every dependent names the
-///   crate by its FULL package id `"<name> <version> (<source>)"`. Both are
-///   keyed by the source, so both must follow it — a v1 lock with only the
-///   entry repointed names a package that no longer exists (cargo discards
-///   the lock and re-resolves; `--locked` fails) and pins nothing.
-///
-/// Full-id references are rewritten in any format (v2+ spells them that way
-/// when a name + version is ambiguous). Each changed fragment is its own
-/// `redirect_cargo_lock_entry` edit (unique text, so the fragment revert is
-/// unambiguous) — the entry and the `[metadata]` line — and the dependents'
-/// references are one `redirect_cargo_lock_reference` edit holding the
-/// quoted full id, reverted at every occurrence.
-fn plan_cargo_lock(
-    content: &str,
-    crate_name: &str,
-    version: &str,
-    index_url: &str,
-    cksum: &str,
-) -> CargoLockPlan {
-    // Rust's regex has NO lookahead, so bound the [[package]] block by string
-    // search (see [`lock_block_end`]): from its header to the next block or
-    // trailing table (or EOF), so the bytes after the block (incl. the final
-    // newline) are preserved.
-    let head = package_head(crate_name, version);
-    // Every line-anchored header for this name@version. A Cargo.lock may
-    // legitimately hold TWO blocks for one name@version from different
-    // sources — after a redirect, a transitive crates.io copy resolves beside
-    // the socket-registry copy, and cargo sorts the crates.io block FIRST —
-    // so the first hit alone would repoint the wrong twin.
-    let heads: Vec<usize> = line_anchored(content, &head).collect();
-    let block_start = match heads.as_slice() {
-        [] => return CargoLockPlan::NotFound,
-        [only] => *only,
-        twins => {
-            // Exactly one twin already at the target index is OURS (a re-run
-            // over a redirected lock); anything else cannot be attributed and
-            // the dep is skipped transactionally.
-            let target_source = format!("source = \"{index_url}\"");
-            let mut ours = twins.iter().copied().filter(|&at| {
-                let body_start = at + head.len();
-                content[body_start..lock_block_end(content, body_start)]
-                    .lines()
-                    .any(|line| line == target_source)
-            });
-            match (ours.next(), ours.next()) {
-                (Some(at), None) => at,
-                _ => return CargoLockPlan::Ambiguous,
-            }
-        }
-    };
-    let body_start = block_start + head.len();
-    let block_end = lock_block_end(content, body_start);
-    let original = content[block_start..block_end].to_string();
-    let mut body = content[body_start..block_end].to_string();
-    let old_source = CARGO_LOCK_SOURCE_LINE_RE
-        .captures(&body)
-        .map(|c| c[1].to_string());
-    if old_source.is_some() {
-        body = CARGO_LOCK_SOURCE_LINE_RE
-            .replace(&body, format!("source = \"{index_url}\"").as_str())
-            .to_string();
-    } else {
-        body = format!("source = \"{index_url}\"\n{body}");
-    }
-    // A v1 lock keeps the checksum in `[metadata]`, keyed by the package id
-    // — the chosen block's OWN source when it has one, so a multi-source
-    // twin's line is never taken for ours.
-    let metadata_source = old_source
-        .as_deref()
-        .map_or_else(|| r#"[^)"]*"#.to_string(), regex::escape);
-    let metadata_re = Regex::new(&format!(
-        r#"(?m)^"checksum {} {} \({metadata_source}\)" = "[^"]*"$"#,
-        regex::escape(crate_name),
-        regex::escape(version)
-    ))
-    .expect("escaped lock metadata-line regex is valid");
-    let metadata_line = metadata_re.find(content).map(|m| m.as_str().to_string());
-    if metadata_line.is_none() {
-        if CARGO_LOCK_CHECKSUM_LINE_RE.is_match(&body) {
-            body = CARGO_LOCK_CHECKSUM_LINE_RE
-                .replace(&body, format!("checksum = \"{cksum}\"").as_str())
-                .to_string();
-        } else {
-            body = CARGO_LOCK_AFTER_SOURCE_RE
-                .replace(&body, format!("${{1}}\nchecksum = \"{cksum}\"").as_str())
-                .to_string();
-        }
-    }
-    let rebuilt = format!("{head}{body}");
-    let key = format!("{crate_name}@{version}");
-    let edit = |original: &str, new: &str| FileEdit {
-        path: "Cargo.lock".into(),
-        kind: "redirect_cargo_lock_entry".into(),
-        action: "rewritten".into(),
-        key: Some(key.clone()),
-        original: Some(Value::String(original.to_string())),
-        new: Some(Value::String(new.to_string())),
-    };
-    let mut edits = Vec::new();
-    let mut new_content = content.to_string();
-    if rebuilt != original {
-        new_content.replace_range(block_start..block_end, &rebuilt);
-        edits.push(edit(&original, &rebuilt));
-    }
-    if let Some(line) = metadata_line {
-        let pinned = format!("\"checksum {crate_name} {version} ({index_url})\" = \"{cksum}\"");
-        if line != pinned {
-            new_content = new_content.replacen(&line, &pinned, 1);
-            edits.push(edit(&line, &pinned));
-        }
-    }
-    // Dependents' full-id references to the OLD source, recorded as ONE
-    // `redirect_cargo_lock_reference` edit holding just the quoted id —
-    // never a dependent's whole block: a block referencing two patched
-    // packages (the root of a v1 lock) would hold two overlapping block
-    // edits, and reverting the first-applied one alone would find neither of
-    // its fragments. The id names this name + version + source exactly, so its
-    // inverse puts back EVERY occurrence, independently of any other
-    // package's edits and in any removal order.
-    if let Some(old) = old_source.filter(|old| old != index_url) {
-        let from = format!("\"{crate_name} {version} ({old})\"");
-        let to = format!("\"{crate_name} {version} ({index_url})\"");
-        let mut repointed_any = false;
-        // The oldest v1 locks keep the ROOT package in a standalone `[root]`
-        // table instead of the `[[package]]` array, with its own full-id
-        // `dependencies`. It precedes the array, so the block walk below
-        // never reaches it and the lock would keep naming a package it no
-        // longer contains (`--locked` fails; an unlocked build silently
-        // re-resolves).
-        if let Some((start, end)) = lock_root_table(&new_content) {
-            if new_content[start..end].contains(&from) {
-                let repointed = new_content[start..end].replace(&from, &to);
-                new_content.replace_range(start..end, &repointed);
-                repointed_any = true;
-            }
-        }
-        let mut cursor = 0;
-        while let Some((start, end)) = next_lock_block(&new_content, cursor) {
-            if new_content[start..end].contains(&from) {
-                let repointed = new_content[start..end].replace(&from, &to);
-                new_content.replace_range(start..end, &repointed);
-                repointed_any = true;
-                cursor = start + repointed.len();
-            } else {
-                cursor = end;
-            }
-        }
-        if repointed_any {
-            edits.push(FileEdit {
-                kind: CARGO_LOCK_REFERENCE_KIND.into(),
-                ..edit(&from, &to)
-            });
-        }
-    }
-    // Already redirected (re-run): every fragment is at the target values; a
-    // recorded edit would have original == new and grow the ledger forever.
-    if edits.is_empty() {
-        return CargoLockPlan::AlreadyRedirected;
-    }
-    CargoLockPlan::Rewritten {
-        content: new_content,
-        edits,
-    }
-}
-
-/// The v1 `[root]` table's span, when the lock has one: cargo before the
-/// `[root]` removal recorded the root package there rather than in the
-/// `[[package]]` array, and its `dependencies` spell full package ids the
-/// same way. Bounded by [`lock_block_end`], like a package block.
-fn lock_root_table(content: &str) -> Option<(usize, usize)> {
-    const HEADER: &str = "[root]\n";
-    let at = content
-        .match_indices(HEADER)
-        .map(|(at, _)| at)
-        .find(|&at| at == 0 || content.as_bytes()[at - 1] == b'\n')?;
-    Some((at, lock_block_end(content, at + HEADER.len())))
-}
-
-/// The next `[[package]]` block starting at or after `from`, as
-/// [`lock_block_end`] bounds it.
-fn next_lock_block(content: &str, from: usize) -> Option<(usize, usize)> {
-    let rel = content.get(from..)?.find("[[package]]\n")?;
-    let start = from + rel;
-    if start != 0 && content.as_bytes()[start - 1] != b'\n' {
-        return next_lock_block(content, start + 1);
-    }
-    Some((
-        start,
-        lock_block_end(content, start + "[[package]]\n".len()),
-    ))
-}
-
-/// End of the `[[package]]` block whose body starts at `body_start`,
-/// excluding the newline(s) before the next block / trailing table / EOF (so
-/// a recorded original/new stops after the block's last content byte — the
-/// TS rewriter's `(?=\n*$)` lookahead — while the file keeps its newlines).
-fn lock_block_end(content: &str, body_start: usize) -> usize {
-    // The next block, or the `[metadata]` / `[[patch.unused]]` tables that
-    // trail the packages. The trailing tables are searched only up to the
-    // next block: they sit after every `[[package]]` (absent entirely from
-    // v3/v4 locks), and an unbounded search per block scanned to EOF for
-    // every block of every dep. Each marker holds its only `\n` at offset 0,
-    // so a hit starting before the next block also ends by it — the bounded
-    // minimum is the unbounded one.
-    let rest = &content[body_start..];
-    let next_block = rest.find("\n[[package]]").unwrap_or(rest.len());
-    let mut end = ["\n[metadata]", "\n[[patch.unused]]", "\n[patch"]
-        .iter()
-        .filter_map(|marker| rest[..next_block].find(marker))
-        .min()
-        .map_or(body_start + next_block, |rel| body_start + rel);
-    while end > body_start && content.as_bytes()[end - 1] == b'\n' {
-        end -= 1;
-    }
-    end
-}
-
-
-/// Deterministic xorshift64* — no `rand` dev-dependency.
-struct Rng(u64);
-
-impl Rng {
-    fn next(&mut self) -> u64 {
-        let mut x = self.0;
-        x ^= x >> 12;
-        x ^= x << 25;
-        x ^= x >> 27;
-        self.0 = x;
-        x.wrapping_mul(0x2545_F491_4F6C_DD1D)
-    }
-    fn below(&mut self, n: usize) -> usize {
-        (self.next() % n as u64) as usize
-    }
-    fn chance(&mut self, percent: u64) -> bool {
-        self.next() % 100 < percent
-    }
-}
+use crate::test_rng::Rng;
 
 const CRATES_IO: &str = "registry+https://github.com/rust-lang/crates.io-index";
 
@@ -377,8 +98,6 @@ fn synth_lock(rng: &mut Rng, blocks: usize, v1: bool) -> String {
 }
 
 
-// ── the comparison ──
-
 const INDEX: &str = "sparse+https://socket.example/cargo/index/";
 
 fn plan_new(lock: &str, name: &str, version: &str, cksum: &str) -> CargoLockPlan {
@@ -399,24 +118,9 @@ fn shape(plan: &CargoLockPlan) -> (String, Option<String>, Vec<FileEdit>) {
     }
 }
 
-fn assert_same(lock: &str, name: &str, version: &str, cksum: &str, what: &str) -> Option<String> {
-    let old = plan_cargo_lock(lock, name, version, INDEX, cksum);
-    let new = plan_new(lock, name, version, cksum);
-    let (old, new) = (shape(&old), shape(&new));
-    // The one shape the line grammar cannot read and cargo can: the block's
-    // canonical header without the newline after `version` (a final block
-    // at EOF with no trailing newline). The span planner finds it.
-    let canonical_head = format!("[[package]]\nname = \"{name}\"\nversion = \"{version}\"\n");
-    if old.0 == "not-found" && new.0 != "not-found" && !lock.contains(&canonical_head) {
-        return new.1;
-    }
-    assert_eq!(new.0, old.0, "{what}: {name}@{version} outcome\n{lock}");
-    assert_eq!(new.1, old.1, "{what}: {name}@{version} bytes\n{lock}");
-    assert_eq!(
-        serde_json::to_value(&new.2).unwrap(),
-        serde_json::to_value(&old.2).unwrap(),
-        "{what}: {name}@{version} edits"
-    );
+fn check(g: &mut Golden, lock: &str, name: &str, version: &str, cksum: &str) -> Option<String> {
+    let new = shape(&plan_new(lock, name, version, cksum));
+    g.next(&(lock, name, version, cksum), &new);
     new.1
 }
 
@@ -430,40 +134,45 @@ fn targets(lock: &str) -> Vec<(String, String)> {
         .collect()
 }
 
-/// Every package of `lock`, planned by both, then a second package planned
-/// over the first's output and a re-run of the first (the no-op path).
-fn assert_lock(lock: &str, rng: &mut Rng, what: &str) {
+/// Every package of `lock`, then a second package planned over the first's
+/// output and a re-run of the first (the no-op path), and an absent package.
+fn sweep_lock(g: &mut Golden, lock: &str, rng: &mut Rng) {
     let all = targets(lock);
     for (name, version) in &all {
         let cksum = format!("{:016x}{:016x}", rng.next(), rng.next());
-        let Some(once) = assert_same(lock, name, version, &cksum, what) else {
+        let Some(once) = check(g, lock, name, version, &cksum) else {
             continue;
         };
-        assert_same(&once, name, version, &cksum, &format!("{what} re-run"));
+        check(g, &once, name, version, &cksum);
         if let Some((other, other_version)) = all.get(rng.below(all.len())) {
-            assert_same(&once, other, other_version, "00ff", &format!("{what} then another"));
+            check(g, &once, other, other_version, "00ff");
         }
     }
-    // An absent package, on both sides.
-    assert_same(lock, "absent-crate", "9.9.9", "00", what);
+    check(g, lock, "absent-crate", "9.9.9", "00");
 }
 
 #[test]
-fn span_splice_matches_the_line_grammar_on_random_locks() {
+fn span_splice_matches_golden_on_random_locks() {
+    let mut g = Golden::new(
+        "cargo_lock_random",
+        "One package of a seeded Cargo.lock, planned for the hosted index.",
+    )
+    .chunked(20);
     let mut rng = Rng(0x9E37_79B9_7F4A_7C15);
-    for case in 0..300 {
+    for _ in 0..300 {
         let v1 = rng.chance(50);
         let blocks = rng.below(12);
         let lock = synth_lock(&mut rng, blocks, v1);
-        assert_lock(&lock, &mut rng, &format!("case {case} (v1={v1})"));
+        sweep_lock(&mut g, &lock, &mut rng);
     }
+    g.finish();
 }
 
 /// Hand-written shapes the generator does not produce: multi-source twins
 /// (one at the target index, and none), a v1 `[root]` table, a v1 block with
 /// no source, a source ending the text, and blocks with neither line.
 #[test]
-fn span_splice_matches_the_line_grammar_on_hand_written_locks() {
+fn span_splice_matches_golden_on_hand_written_locks() {
     let crates_io = CRATES_IO;
     let twins_ours = format!(
         "version = 3\n\n[[package]]\nname = \"t\"\nversion = \"1.0.0\"\nsource = \"{crates_io}\"\nchecksum = \"aa\"\n\n[[package]]\nname = \"t\"\nversion = \"1.0.0\"\nsource = \"{INDEX}\"\nchecksum = \"bb\"\n"
@@ -475,8 +184,12 @@ fn span_splice_matches_the_line_grammar_on_hand_written_locks() {
     let sourceless_v1 = "[[package]]\nname = \"s\"\nversion = \"1.0.0\"\n\n[metadata]\n\"checksum s 1.0.0 (registry+x)\" = \"ee\"\n".to_string();
     let source_at_eof = format!("[[package]]\nname = \"e\"\nversion = \"1.0.0\"\nsource = \"{crates_io}\"");
     let bare = "version = 3\n\n[[package]]\nname = \"b\"\nversion = \"1.0.0\"\n\n[[package]]\nname = \"c\"\nversion = \"1.0.0\"\n".to_string();
+    let mut g = Golden::new(
+        "cargo_lock_hand_written",
+        "One package of a hand-written Cargo.lock shape, planned for the hosted index.",
+    );
     let mut rng = Rng(0xD1B5_4A32_D192_ED03);
-    for (what, lock) in [
+    for (_what, lock) in [
         ("twins, one ours", twins_ours),
         ("twins, neither ours", twins_neither),
         ("v1 [root]", v1_root),
@@ -484,20 +197,26 @@ fn span_splice_matches_the_line_grammar_on_hand_written_locks() {
         ("source at EOF", source_at_eof),
         ("bare blocks", bare),
     ] {
-        assert_lock(&lock, &mut rng, what);
+        sweep_lock(&mut g, &lock, &mut rng);
     }
+    g.finish();
 }
 
 /// The large-lock shape: ≥1k blocks, both formats, a sample of targets.
 #[test]
-fn span_splice_matches_the_line_grammar_on_a_large_lock() {
+fn span_splice_matches_golden_on_a_large_lock() {
+    let mut g = Golden::new(
+        "cargo_lock_large",
+        "One sampled package of a seeded ≥1k-block Cargo.lock, planned for the hosted index.",
+    );
     let mut rng = Rng(0x2545_F491_4F6C_DD1D);
     for v1 in [false, true] {
         let lock = synth_lock(&mut rng, 1_200, v1);
         let all = targets(&lock);
         assert!(all.len() >= 1_000, "fixture keeps the ≥1k-block shape");
         for (name, version) in all.iter().step_by(97) {
-            assert_same(&lock, name, version, "abcd", &format!("large (v1={v1})"));
+            check(&mut g, &lock, name, version, "abcd");
         }
     }
+    g.finish();
 }
diff --git a/crates/socket-patch-core/src/patch/redirect/composer_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/composer_equivalence_tests.rs
index 6a326239..0a096ced 100644
--- a/crates/socket-patch-core/src/patch/redirect/composer_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/composer_equivalence_tests.rs
@@ -1,289 +1,19 @@
-//! Equivalence oracle for the hosted composer.lock rewriter, which now tests
-//! each `"name"` occurrence's value before walking its object, walks objects
-//! byte-wise, and splices each edit into the lock in place instead of
-//! re-allocating the whole lock per edit. The previous implementation is kept
-//! here verbatim and the production rewriter must produce the identical
-//! output bytes, FileEdit list and warnings on randomized locks.
+//! Seeded composer.lock sweep for the hosted rewriter (the in-place,
+//! byte-walking splice): output bytes, FileEdits and warnings are pinned per
+//! case by `tests/equivalence/composer_*.golden`, blessed while the
+//! pre-splice rewriter still ran beside it as an oracle.
 
 use super::*;
-use crate::crawlers::composer_crawler::normalize_version;
 use crate::formats::composer::hosted::*;
+use crate::golden::Golden;
+use crate::test_rng::Rng;
 
-fn json_object_end_from_oracle(text: &str, from: usize) -> Option<usize> {
-    let mut depth = 0usize;
-    let mut in_string = false;
-    let mut escaped = false;
-    for (offset, ch) in text[from..].char_indices() {
-        if in_string {
-            match ch {
-                _ if escaped => escaped = false,
-                '\\' => escaped = true,
-                '"' => in_string = false,
-                _ => {}
-            }
-            continue;
-        }
-        match ch {
-            '"' => in_string = true,
-            '{' => depth += 1,
-            '}' if depth == 0 => return Some(from + offset),
-            '}' => depth -= 1,
-            _ => {}
-        }
-    }
-    None
-}
-
-fn find_composer_entry_oracle(content: &str, pkg: &str, version: &str) -> ComposerEntry {
-    let mut mismatched: Option<String> = None;
-    for (name_idx, _) in content.match_indices("\"name\": \"") {
-        let Some(end) = json_object_end_from_oracle(content, name_idx) else {
-            continue;
-        };
-        let entry = &content[name_idx..=end];
-        if !json_string_field(entry, "name").is_some_and(|n| n.eq_ignore_ascii_case(pkg)) {
-            continue;
-        }
-        // Every package entry carries `version`; an `authors[]`/`support`
-        // object that happens to have a matching `name` does not.
-        let Some(locked) = json_string_field(entry, "version") else {
-            continue;
-        };
-        if normalize_version(locked) == normalize_version(version) {
-            return ComposerEntry::Found(name_idx, end);
-        }
-        mismatched = Some(locked.to_string());
-    }
-    match mismatched {
-        Some(locked) => ComposerEntry::VersionMismatch(locked),
-        None => ComposerEntry::NotFound,
-    }
-}
-
-fn composer_source_before_dist_oracle(
-    content: &str,
-    entry_start: usize,
-    dist_start: usize,
-) -> Option<usize> {
-    const SOURCE_KEY: &str = "\"source\": {";
-    let source_start = entry_start + content[entry_start..dist_start].rfind(SOURCE_KEY)?;
-    let source_end = json_object_end_from_oracle(content, source_start + SOURCE_KEY.len())?;
-    (source_end < dist_start && content[source_end + 1..dist_start].trim() == ",")
-        .then_some(source_start)
-}
-
-fn rewrite_composer_lock_oracle(
-    files: &BTreeMap<String, String>,
-    overrides: &[DepOverride],
-    result: &mut RewriteResult,
-) {
-    let composer: Vec<&DepOverride> = overrides
-        .iter()
-        .filter(|o| o.ecosystem == "composer")
-        .collect();
-    if composer.is_empty() {
-        return;
-    }
-    // Parity with `redirect_npm_no_lockfile`: a granted dep the project has
-    // no lock to pin must be SAID, not silently dropped from the redirected
-    // count (a composer.json + installed vendor tree without a lock is
-    // discovered and granted like any other).
-    if !files.contains_key("composer.lock") {
-        result.warnings.push(RewriteWarning {
-            code: "redirect_composer_no_lockfile".into(),
-            detail: "no composer.lock present; composer redirect skipped".into(),
-        });
-        return;
-    }
-    const DIST_KEY: &str = "\"dist\": {";
-    let mut content = files["composer.lock"].clone();
-    let type_re: &Regex = &COMPOSER_DIST_TYPE_RE;
-    let url_re: &Regex = &COMPOSER_DIST_URL_RE;
-    let shasum_re: &Regex = &COMPOSER_DIST_SHASUM_RE;
-    let mut changed = false;
-    for dep in &composer {
-        let composer_name = full_name(dep);
-        let Some(sha1) = dep.integrity.sha1.clone() else {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_composer_missing_sha1".into(),
-                detail: format!("{composer_name} has no sha1 (dist.shasum) integrity"),
-            });
-            continue;
-        };
-        let (entry_start, entry_end) =
-            match find_composer_entry_oracle(&content, &composer_name, &dep.version) {
-                ComposerEntry::Found(start, end) => (start, end),
-                ComposerEntry::VersionMismatch(locked) => {
-                    result.warnings.push(RewriteWarning {
-                        code: "redirect_composer_version_mismatch".into(),
-                        detail: format!(
-                            "composer.lock pins {composer_name}@{locked}, not the patched {}",
-                            dep.version
-                        ),
-                    });
-                    continue;
-                }
-                ComposerEntry::NotFound => {
-                    result.warnings.push(RewriteWarning {
-                        code: "redirect_composer_pkg_not_found".into(),
-                        detail: format!(
-                            "no composer.lock package named {composer_name}@{}",
-                            dep.version
-                        ),
-                    });
-                    continue;
-                }
-            };
-        // The dist block MUST belong to the located entry. Scanning forward
-        // from the name for the next `"dist": {` walked into the FOLLOWING
-        // package whenever the target was installed from source, repointing a
-        // bystander's url + shasum — a checksum-clean install of the wrong
-        // code. A target with no dist of its own pins nothing: fail closed.
-        let Some(dist_start) = content[entry_start..=entry_end]
-            .find(DIST_KEY)
-            .map(|offset| entry_start + offset)
-        else {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_composer_no_dist".into(),
-                detail: format!("{composer_name} has no dist block"),
-            });
-            continue;
-        };
-        let Some(dist_end) = json_object_end_from_oracle(&content, dist_start + DIST_KEY.len())
-        else {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_composer_lock_malformed".into(),
-                detail: format!("{composer_name}'s dist block is unterminated"),
-            });
-            continue;
-        };
-        let block = content[dist_start..=dist_end].to_string();
-        // Already redirected (either slash spelling): recording an edit whose
-        // `original` IS the hosted url would grow the ledger on every re-run
-        // and poison a future revert.
-        if artifact_url_present(&block, &dep.artifact_url) && block.contains(&sha1) {
-            continue;
-        }
-        if !block.contains("\"url\": \"") {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_composer_no_dist_url".into(),
-                detail: format!("{composer_name}'s dist block has no url to redirect"),
-            });
-            continue;
-        }
-        let mut rewritten = type_re.replace(&block, "${1}zip${2}").to_string();
-        rewritten = url_re
-            .replace(
-                &rewritten,
-                format!("${{1}}{}${{2}}", dep.artifact_url).as_str(),
-            )
-            .to_string();
-        rewritten = if rewritten.contains("\"shasum\": \"") {
-            shasum_re
-                .replace(&rewritten, format!("${{1}}{sha1}${{2}}").as_str())
-                .to_string()
-        } else {
-            append_composer_shasum(&rewritten, &sha1)
-        };
-        // Drop the entry's `source` (the vendored backend does the same):
-        // when the dist download fails — checksum mismatch, an expired grant
-        // token, a patch-server outage — composer 1 and composer 2 before its
-        // source-fallback cutoff (2.2 LTS included) print "Now trying to
-        // download from source" and silently install the PRISTINE upstream
-        // commit from git, and `--prefer-source` / `preferred-install:
-        // source` always does. With the source gone the hosted archive is
-        // the only way to install the package, so a failed fetch fails the
-        // install instead of shipping the vulnerable code. The edit then
-        // spans `"source": {…},\n<indent>"dist": {…}`, so the ledger's
-        // fragment revert puts both blocks back byte-for-byte.
-        let (edit_start, original) =
-            match composer_source_before_dist_oracle(&content, entry_start, dist_start) {
-                Some(source_start) => (source_start, content[source_start..=dist_end].to_string()),
-                None => {
-                    if content[entry_start..=entry_end].contains("\"source\": {") {
-                        result.warnings.push(RewriteWarning {
-                            code: "redirect_composer_source_kept".into(),
-                            detail: format!(
-                                "{composer_name}'s source block does not directly precede its \
-                                 dist and was left in place; a failed hosted download may fall \
-                                 back to it"
-                            ),
-                        });
-                    }
-                    (dist_start, block.clone())
-                }
-            };
-        if rewritten != original {
-            content = format!(
-                "{}{}{}",
-                &content[..edit_start],
-                rewritten,
-                &content[dist_end + 1..]
-            );
-            changed = true;
-            result.edits.push(FileEdit {
-                path: "composer.lock".into(),
-                kind: "redirect_composer_dist".into(),
-                action: "rewritten".into(),
-                key: Some(composer_name),
-                original: Some(Value::String(original)),
-                new: Some(Value::String(rewritten)),
-            });
-        }
-    }
-    if changed {
-        result.files.insert("composer.lock".into(), content);
-    }
-}
-
-fn assert_same(want: &RewriteResult, got: &RewriteResult, what: &str) {
-    assert_eq!(got.files, want.files, "{what}: rewritten bytes");
-    assert_eq!(got.edits.len(), want.edits.len(), "{what}: edit count");
-    for (i, (g, w)) in got.edits.iter().zip(&want.edits).enumerate() {
-        assert_eq!(g, w, "{what}: edit #{i}");
-    }
-    let warnings = |r: &RewriteResult| {
-        r.warnings
-            .iter()
-            .map(|w| (w.code.clone(), w.detail.clone()))
-            .collect::<Vec<_>>()
-    };
-    assert_eq!(warnings(got), warnings(want), "{what}: warnings in order");
-}
-
-fn run_both(
-    files: &BTreeMap<String, String>,
-    overrides: &[DepOverride],
-    what: &str,
-) -> RewriteResult {
-    let mut want = RewriteResult::default();
-    rewrite_composer_lock_oracle(files, overrides, &mut want);
+fn run(files: &BTreeMap<String, String>, overrides: &[DepOverride]) -> RewriteResult {
     let mut got = RewriteResult::default();
     rewrite_composer_lock(files, overrides, &mut got);
-    assert_same(&want, &got, what);
     got
 }
 
-/// Deterministic xorshift64* — no `rand` dev-dependency.
-struct Rng(u64);
-
-impl Rng {
-    fn next(&mut self) -> u64 {
-        let mut x = self.0;
-        x ^= x >> 12;
-        x ^= x << 25;
-        x ^= x >> 27;
-        self.0 = x;
-        x.wrapping_mul(0x2545_F491_4F6C_DD1D)
-    }
-    fn below(&mut self, n: usize) -> usize {
-        (self.next() % n as u64) as usize
-    }
-    fn chance(&mut self, percent: u64) -> bool {
-        self.next() % 100 < percent
-    }
-}
-
 fn pkg(i: usize, rng: &mut Rng) -> String {
     if rng.chance(15) {
         format!("Vendor{}/Pkg-{i}", i % 3)
@@ -436,12 +166,17 @@ fn dep(rng: &mut Rng, pool: usize, n: usize) -> DepOverride {
 }
 
 #[test]
-fn in_place_composer_rewrite_matches_oracle() {
+fn in_place_composer_rewrite_matches_golden() {
     let mut rewritten = 0;
     let mut edits = 0;
     let mut codes = std::collections::BTreeSet::new();
+    let mut golden = crate::golden::Golden::new(
+        "composer_lock_rewrite",
+        "One seeded composer.lock + overrides; the output covers a re-run over the result.",
+    )
+    .chunked(10);
     for seed in 1..=3000u64 {
-        let mut rng = Rng(seed.wrapping_mul(0x9E37_79B9_7F4A_7C15) | 1);
+        let mut rng = Rng::new(seed);
         let pool = 3 + rng.below(12);
         let mut files = BTreeMap::new();
         if !rng.chance(3) {
@@ -457,10 +192,11 @@ fn in_place_composer_rewrite_matches_oracle() {
             }
             overrides.push(again);
         }
-        let got = run_both(&files, &overrides, &format!("seed {seed}"));
+        let got = run(&files, &overrides);
         let mut rerun = files.clone();
         rerun.extend(got.files.clone());
-        run_both(&rerun, &overrides, &format!("seed {seed} re-run"));
+        let again = run(&rerun, &overrides);
+        golden.case(seed, &(&files, &overrides), &(&got, &again));
         rewritten += got.files.len();
         edits += got.edits.len();
         codes.extend(got.warnings.iter().map(|w| w.code.clone()));
@@ -478,58 +214,25 @@ fn in_place_composer_rewrite_matches_oracle() {
     ] {
         assert!(codes.contains(code), "no case reached {code}: {codes:?}");
     }
+    golden.finish();
 }
 
 #[test]
-fn byte_walk_matches_the_char_walk() {
+fn json_object_end_matches_golden() {
     let texts = [
         r#"{"a": "}", "b": {"c": "\"}"}, "d": "é\é\\"}"#,
         "{\"x\": \"\\\u{e9}}\"}, \"y\": 1}",
         "\"unterminated {",
         "{{{}}}}",
     ];
+    let mut golden = Golden::new(
+        "composer_json_object_end",
+        "One (text, start) pair: where its JSON object ends.",
+    );
     for text in texts {
         for from in (0..=text.len()).filter(|&i| text.is_char_boundary(i)) {
-            assert_eq!(
-                json_object_end_from(text, from),
-                json_object_end_from_oracle(text, from),
-                "{text:?} from {from}"
-            );
+            golden.next(&(text, from), &json_object_end_from(text, from));
         }
     }
-}
-
-/// Runs the oracle over a large benchmark composer.lock (too large to
-/// commit) when `SOCKET_PATCH_COMPOSER_FIXTURE` names it, redirecting every
-/// package; a no-op otherwise.
-#[test]
-fn in_place_composer_rewrite_matches_oracle_on_fixture() {
-    let Some(path) = std::env::var_os("SOCKET_PATCH_COMPOSER_FIXTURE") else {
-        return;
-    };
-    let text = std::fs::read_to_string(path).unwrap();
-    let doc: Value = serde_json::from_str(&text).unwrap();
-    let overrides: Vec<DepOverride> = ["packages", "packages-dev"]
-        .iter()
-        .flat_map(|k| doc[k].as_array().cloned().unwrap_or_default())
-        .enumerate()
-        .map(|(n, p)| DepOverride {
-            ecosystem: "composer".into(),
-            name: p["name"].as_str().unwrap().to_string(),
-            namespace: None,
-            version: p["version"].as_str().unwrap().to_string(),
-            token: String::new(),
-            patch_uuid: format!("00000000-0000-4000-8000-{n:012}"),
-            artifact_url: format!("https://patch.socket.dev/composer/{n}.zip"),
-            registry_override: None,
-            integrity: Integrity {
-                sha1: Some("0123456789abcdef0123456789abcdef01234567".into()),
-                ..Default::default()
-            },
-        })
-        .collect();
-    let mut files = BTreeMap::new();
-    files.insert("composer.lock".to_string(), text);
-    let got = run_both(&files, &overrides, "fixture");
-    assert!(!got.edits.is_empty());
+    golden.finish();
 }
diff --git a/crates/socket-patch-core/src/patch/redirect/golang_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/golang_equivalence_tests.rs
index d3fe18cf..3a8ebf5c 100644
--- a/crates/socket-patch-core/src/patch/redirect/golang_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/golang_equivalence_tests.rs
@@ -1,353 +1,22 @@
-//! Equivalence oracle for the hosted golang rewriter, which now reads go.mod
-//! once per dep (one walk for the prior directive, the required version and
-//! the upsert scan), appends its directives in place, and edits go.sum as
-//! lines, joining it once at the end. The previous implementation is kept
-//! here verbatim over the text transforms, and the production rewriter must
-//! produce the identical output bytes, FileEdit list and warnings on
-//! randomized go.mod / go.sum pairs — CRLF and mixed endings, unclosed
-//! blocks, socket-owned and user-authored replaces, stale pins, malformed
-//! integrity and duplicate deps.
+//! Seeded go.mod / go.sum sweep for the hosted golang rewriter (one go.mod
+//! walk per dep, directives appended in place, go.sum edited as lines):
+//! CRLF and mixed endings, unclosed blocks, socket-owned and user-authored
+//! replaces, stale pins, malformed integrity and duplicate deps. Output
+//! bytes, FileEdits and warnings are pinned per case by
+//! `tests/equivalence/golang_rewrite.golden`, blessed while the previous
+//! rewriter still ran beside it as an oracle.
 
 use super::*;
+use crate::golden::Golden;
+use crate::test_rng::Rng;
 
-fn rewrite_golang_oracle(
-    files: &BTreeMap<String, String>,
-    overrides: &[DepOverride],
-    result: &mut RewriteResult,
-) {
-    use crate::vendor::go_mod_edit::{self, HOSTED_GO_MODULE_PREFIX};
-    use crate::vendor::go_sum_edit;
-
-    let golang: Vec<&DepOverride> = overrides
-        .iter()
-        .filter(|o| o.ecosystem == "golang")
-        .collect();
-    if golang.is_empty() {
-        return;
-    }
-    // The replace directive can only live in the MAIN module's go.mod.
-    let Some(orig_go_mod) = files.get("go.mod") else {
-        result.warnings.push(RewriteWarning {
-            code: "redirect_golang_no_go_mod".into(),
-            detail: "no go.mod present; golang redirect skipped".into(),
-        });
-        return;
-    };
-    let mut go_mod = orig_go_mod.clone();
-    // An absent go.sum starts empty: the fully-replaced original needs no
-    // lines of its own, so the two socket lines alone are a complete pin.
-    let mut go_sum = files.get("go.sum").cloned().unwrap_or_default();
-    let (mut mod_changed, mut sum_changed) = (false, false);
-
-    for dep in &golang {
-        let fname = full_name(dep);
-        let Some(ov) = registry_override_of_kind(dep, "goproxy") else {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_golang_unsupported".into(),
-                detail: format!(
-                    "{fname}@{}: no hosted Go module is published for this patch; run \
-                     `socket-patch vendor` (committable, offline-verified) instead",
-                    dep.version
-                ),
-            });
-            continue;
-        };
-        let (Some(rhs_module), Some(rhs_version)) = (
-            &ov.identifiers.go_module_path,
-            &ov.identifiers.go_module_version,
-        ) else {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_golang_missing_module".into(),
-                detail: format!(
-                    "{fname}@{} goproxy override lacks goModulePath/goModuleVersion",
-                    dep.version
-                ),
-            });
-            continue;
-        };
-        // Fail closed on a module path outside the socket namespace: the
-        // prefix is the ONLY ownership signal — a directive we couldn't
-        // recognize later would be unremovable, and go.sum removal keys on it.
-        if !go_mod_edit::is_hosted_module_path(rhs_module) {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_golang_untrusted_module_path".into(),
-                detail: format!(
-                    "{fname}@{}: refusing hosted module path `{rhs_module}`: not \
-                     `{HOSTED_GO_MODULE_PREFIX}<patch uuid>`",
-                    dep.version
-                ),
-            });
-            continue;
-        }
-        // Every string interpolated into go.mod/go.sum must be a single clean
-        // token — whitespace or control characters would inject directives.
-        if [fname.as_str(), &dep.version, rhs_module, rhs_version]
-            .iter()
-            .any(|s| !go_token_safe(s))
-        {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_golang_unsafe_coords".into(),
-                detail: format!(
-                    "{fname}@{}: module/version tokens contain whitespace or control \
-                     characters; refusing to write them into go.mod/go.sum",
-                    dep.version
-                ),
-            });
-            continue;
-        }
-        // BOTH go.sum hashes must be pinnable up front — a replace without
-        // them (or with a malformed hash) bricks every `-mod=readonly` build.
-        let (Some(zip_h1), Some(gomod_h1)) = (&dep.integrity.dirhash_h1, &dep.integrity.go_mod_h1)
-        else {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_golang_missing_integrity".into(),
-                detail: format!(
-                    "{fname}@{} has no dirhashH1/goModH1 integrity pair",
-                    dep.version
-                ),
-            });
-            continue;
-        };
-        if !go_sum_edit::is_h1_dirhash(zip_h1) || !go_sum_edit::is_h1_dirhash(gomod_h1) {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_golang_missing_integrity".into(),
-                detail: format!(
-                    "{fname}@{}: integrity hashes must be `h1:` + 44-char base64 dirhashes",
-                    dep.version
-                ),
-            });
-            continue;
-        }
-        // Any pre-existing socket-owned directive for the module (this run is
-        // a refresh, or a takeover of a local/vendored redirect): capture its
-        // text — the ledger's `original` is the only pre-redirect record.
-        let prior = go_mod_edit::parse_replace_entries(&go_mod)
-            .into_iter()
-            .find(|e| e.module == fname && e.socket_owned());
-        let prior_text = prior.as_ref().map(|e| {
-            let target = e.path.clone().unwrap_or_else(|| match &e.rhs_version {
-                Some(v) => format!("{} {v}", e.rhs_module.as_deref().unwrap_or_default()),
-                None => e.rhs_module.clone().unwrap_or_default(),
-            });
-            let ver = e
-                .version
-                .as_deref()
-                .map(|v| format!(" {v}"))
-                .unwrap_or_default();
-            format!("replace {}{ver} => {target}", e.module)
-        });
-
-        // Stale-pin cross-check: `replace` is keyed on module+version, and a
-        // pin the graph no longer selects is SILENTLY inert (the build links
-        // the unpatched module with zero warning) — refuse to write one, and
-        // reconcile away OUR OWN inert directive if one is already committed:
-        // left in place, its module path keeps confirming the dep as
-        // redirected (ledger + VEX attestation) while go links the unpatched
-        // version.
-        let required = go_mod_edit::parse_required_versions(&go_mod);
-        if let Some(required) = required.get(&fname) {
-            if required != &dep.version {
-                result.warnings.push(RewriteWarning {
-                    code: "redirect_golang_version_mismatch".into(),
-                    detail: format!(
-                        "{fname}: go.mod requires {required} but the patch targets {} — \
-                         a version-pinned replace would be silently ignored",
-                        dep.version
-                    ),
-                });
-                let stale_hosted = prior
-                    .as_ref()
-                    .filter(|e| e.owner == Some(go_mod_edit::ReplaceOwner::Hosted));
-                if let Some(stale) = stale_hosted {
-                    if let Ok(Some(new)) = go_mod_edit::remove_replace_entry(
-                        &go_mod,
-                        &fname,
-                        go_mod_edit::ReplaceOwner::Hosted,
-                    ) {
-                        go_mod = new;
-                        mod_changed = true;
-                        result.edits.push(FileEdit {
-                            path: "go.mod".into(),
-                            kind: "redirect_golang_stale_replace_removed".into(),
-                            action: "removed".into(),
-                            key: Some(fname.clone()),
-                            original: prior_text.clone().map(Value::String),
-                            new: None,
-                        });
-                    }
-                    if let Some(stale_rhs) = stale.rhs_module.as_deref() {
-                        if let Some(new) =
-                            go_sum_edit::remove_module_prefix_lines(&go_sum, stale_rhs)
-                        {
-                            go_sum = new;
-                            sum_changed = true;
-                            result.edits.push(FileEdit {
-                                path: "go.sum".into(),
-                                kind: "redirect_golang_stale_gosum_removed".into(),
-                                action: "removed".into(),
-                                key: Some(stale_rhs.to_string()),
-                                original: None,
-                                new: None,
-                            });
-                        }
-                    }
-                }
-                continue;
-            }
-        } else if !go_sum_edit::has_module_version(&go_sum, &fname, &dep.version)
-            && prior
-                .as_ref()
-                .is_none_or(|e| e.version.as_deref() != Some(dep.version.as_str()))
-        {
-            // Not required, not in go.sum at this version, and not already
-            // redirected by us: the module is outside this project's graph
-            // (local discovery crawls the whole module cache). Its replace
-            // would be inert, and confirming it would attest a patch no
-            // build links.
-            result.warnings.push(RewriteWarning {
-                code: "redirect_golang_not_in_module_graph".into(),
-                detail: format!(
-                    "{fname}@{}: not required by go.mod and absent from go.sum — the \
-                     module is not in this project's build graph; nothing redirected",
-                    dep.version
-                ),
-            });
-            continue;
-        }
-
-        match go_mod_edit::upsert_hosted_replace_entry(
-            &go_mod,
-            &fname,
-            &dep.version,
-            rhs_module,
-            rhs_version,
-        ) {
-            Err(e) => {
-                result.warnings.push(RewriteWarning {
-                    code: "redirect_golang_replace_conflict".into(),
-                    detail: format!("{fname}@{}: {e}", dep.version),
-                });
-                continue;
-            }
-            // Re-run over an already-redirected go.mod: nothing to record.
-            Ok(None) => {}
-            Ok(Some(new)) => {
-                go_mod = new;
-                mod_changed = true;
-                result.edits.push(FileEdit {
-                    path: "go.mod".into(),
-                    kind: "redirect_golang_replace".into(),
-                    // A takeover/refresh of an existing socket directive must
-                    // keep its text in `original` — the ledger is the only
-                    // pre-redirect record a future revert can restore from.
-                    action: if prior_text.is_some() {
-                        "updated".into()
-                    } else {
-                        "added".into()
-                    },
-                    key: Some(fname.clone()),
-                    original: prior_text.map(Value::String),
-                    new: Some(Value::String(format!(
-                        "replace {fname} {} => {rhs_module} {rhs_version}",
-                        dep.version
-                    ))),
-                });
-            }
-        }
-        if let Some(new) =
-            go_sum_edit::upsert_module_lines(&go_sum, rhs_module, rhs_version, zip_h1, gomod_h1)
-        {
-            go_sum = new;
-            sum_changed = true;
-            result.edits.push(FileEdit {
-                path: "go.sum".into(),
-                kind: "redirect_golang_gosum".into(),
-                action: "added".into(),
-                key: Some(format!("{rhs_module}@{rhs_version}")),
-                original: None,
-                new: Some(Value::String(format!(
-                    "{rhs_module} {rhs_version} {zip_h1}\n{rhs_module} {rhs_version}/go.mod {gomod_h1}"
-                ))),
-            });
-        }
-        // Prune the replaced original's lines: with the pinned replace in
-        // force go never fetches or verifies the original, and `go mod tidy`
-        // prunes exactly these — writing the tidy-stable state up front keeps
-        // the first day-2 tidy a byte-level no-op. The removed lines ride in
-        // `original` so the ledger can restore them on revert.
-        if let Some((new, removed)) =
-            go_sum_edit::remove_exact_module_version_lines(&go_sum, &fname, &dep.version)
-        {
-            go_sum = new;
-            sum_changed = true;
-            result.edits.push(FileEdit {
-                path: "go.sum".into(),
-                kind: "redirect_golang_gosum_prune".into(),
-                action: "removed".into(),
-                key: Some(format!("{fname}@{}", dep.version)),
-                original: Some(Value::String(removed.join("\n"))),
-                new: None,
-            });
-        }
-        result.confirmed_golang_uuids.insert(dep.patch_uuid.clone());
-    }
-
-    if mod_changed {
-        result.files.insert("go.mod".into(), go_mod);
-    }
-    if sum_changed {
-        result.files.insert("go.sum".into(), go_sum);
-    }
-}
-
-fn assert_same(want: &RewriteResult, got: &RewriteResult, what: &str) {
-    assert_eq!(got.files, want.files, "{what}: rewritten bytes");
-    assert_eq!(got.edits.len(), want.edits.len(), "{what}: edit count");
-    for (i, (g, w)) in got.edits.iter().zip(&want.edits).enumerate() {
-        assert_eq!(g, w, "{what}: edit #{i}");
-    }
-    let warnings = |r: &RewriteResult| {
-        r.warnings
-            .iter()
-            .map(|w| (w.code.clone(), w.detail.clone()))
-            .collect::<Vec<_>>()
-    };
-    assert_eq!(warnings(got), warnings(want), "{what}: warnings in order");
-}
-
-fn run_both(
-    files: &BTreeMap<String, String>,
-    overrides: &[DepOverride],
-    what: &str,
-) -> RewriteResult {
-    let mut want = RewriteResult::default();
-    rewrite_golang_oracle(files, overrides, &mut want);
+fn run(g: &mut Golden, files: &BTreeMap<String, String>, overrides: &[DepOverride]) -> RewriteResult {
     let mut got = RewriteResult::default();
     rewrite_golang(files, overrides, &mut got);
-    assert_same(&want, &got, what);
+    g.next(&(files, overrides), &got);
     got
 }
 
-/// Deterministic xorshift64* — no `rand` dev-dependency.
-struct Rng(u64);
-
-impl Rng {
-    fn next(&mut self) -> u64 {
-        let mut x = self.0;
-        x ^= x >> 12;
-        x ^= x << 25;
-        x ^= x >> 27;
-        self.0 = x;
-        x.wrapping_mul(0x2545_F491_4F6C_DD1D)
-    }
-    fn below(&mut self, n: usize) -> usize {
-        (self.next() % n as u64) as usize
-    }
-    fn chance(&mut self, percent: u64) -> bool {
-        self.next() % 100 < percent
-    }
-}
-
 const H1_A: &str = "h1:0000000000000000000000000000000000000000000=";
 const H1_B: &str = "h1:1111111111111111111111111111111111111111111=";
 
@@ -554,13 +223,18 @@ fn dep(rng: &mut Rng, pool: usize, n: usize) -> DepOverride {
 }
 
 #[test]
-fn single_walk_golang_rewrite_matches_oracle() {
+fn single_walk_golang_rewrite_matches_golden() {
     let mut rewritten = 0;
     let mut edits = 0;
     let mut codes = std::collections::BTreeSet::new();
     let mut kinds = std::collections::BTreeSet::new();
+    let mut g = Golden::new(
+        "golang_rewrite",
+        "One seeded go.mod / go.sum pair + overrides, or the re-run over its output.",
+    )
+    .chunked(20);
     for seed in 1..=3000u64 {
-        let mut rng = Rng(seed.wrapping_mul(0x9E37_79B9_7F4A_7C15) | 1);
+        let mut rng = Rng::new(seed);
         let pool = 3 + rng.below(12);
         let mut files = BTreeMap::new();
         if !rng.chance(3) {
@@ -578,11 +252,11 @@ fn single_walk_golang_rewrite_matches_oracle() {
             let again = overrides[rng.below(overrides.len())].clone();
             overrides.push(again);
         }
-        let got = run_both(&files, &overrides, &format!("seed {seed}"));
-        // A second pass over the output (the idempotent re-run) must agree too.
+        let got = run(&mut g, &files, &overrides);
+        // A second pass over the output: the idempotent re-run.
         let mut rerun = files.clone();
         rerun.extend(got.files.clone());
-        run_both(&rerun, &overrides, &format!("seed {seed} re-run"));
+        run(&mut g, &rerun, &overrides);
         rewritten += got.files.len();
         edits += got.edits.len();
         codes.extend(got.warnings.iter().map(|w| w.code.clone()));
@@ -611,69 +285,5 @@ fn single_walk_golang_rewrite_matches_oracle() {
     ] {
         assert!(kinds.contains(kind), "no case reached {kind}: {kinds:?}");
     }
-}
-
-/// Runs the oracle over the benchmark go.mod / go.sum pairs (too
-/// large to commit) when `SOCKET_PATCH_GO_FIXTURES` names their directory,
-/// redirecting every required module; a no-op otherwise.
-#[test]
-fn single_walk_golang_rewrite_matches_oracle_on_fixtures() {
-    let Some(root) = std::env::var_os("SOCKET_PATCH_GO_FIXTURES") else {
-        return;
-    };
-    let root = std::path::PathBuf::from(root);
-    for dir in ["go-grafana", "go-cache", "go-k8s"] {
-        let read = |name: &str| std::fs::read_to_string(root.join(dir).join(name)).unwrap();
-        let go_mod = read("go.mod");
-        let mut required: Vec<(String, String)> =
-            crate::vendor::go_mod_edit::parse_required_versions(&go_mod)
-                .into_iter()
-                .collect();
-        required.sort();
-        let overrides: Vec<DepOverride> = required
-            .iter()
-            .enumerate()
-            .map(|(n, (m, v))| DepOverride {
-                ecosystem: "golang".into(),
-                name: m.clone(),
-                namespace: None,
-                version: v.clone(),
-                token: String::new(),
-                patch_uuid: uuid(n),
-                artifact_url: String::new(),
-                registry_override: Some(RegistryOverride {
-                    kind: "goproxy".into(),
-                    index_url: "https://patch.socket.dev/patch-registry/golang".into(),
-                    identifiers: RegistryOverrideIdentifiers {
-                        name: m.clone(),
-                        version: v.clone(),
-                        go_module_path: Some(hosted(n)),
-                        go_module_version: Some("v1.0.0-socketpatch.1".into()),
-                        ..Default::default()
-                    },
-                }),
-                integrity: Integrity {
-                    dirhash_h1: Some(H1_A.into()),
-                    go_mod_h1: Some(H1_B.into()),
-                    ..Default::default()
-                },
-            })
-            .collect();
-        for crlf in [false, true] {
-            let conv = |s: String| if crlf { s.replace('\n', "\r\n") } else { s };
-            let mut files = BTreeMap::new();
-            files.insert("go.mod".to_string(), conv(go_mod.clone()));
-            files.insert("go.sum".to_string(), conv(read("go.sum")));
-            let got = run_both(&files, &overrides, &format!("{dir} crlf={crlf}"));
-            // k8s pins every staging module with a user-authored replace, so
-            // there every dep is a refused conflict.
-            assert!(
-                !got.edits.is_empty() || !got.warnings.is_empty(),
-                "{dir}: nothing happened"
-            );
-            let mut rerun = files.clone();
-            rerun.extend(got.files.clone());
-            run_both(&rerun, &overrides, &format!("{dir} crlf={crlf} re-run"));
-        }
-    }
+    g.finish();
 }
diff --git a/crates/socket-patch-core/src/patch/redirect/lock_index_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/lock_index_equivalence_tests.rs
index 6f6004fc..7e0a9164 100644
--- a/crates/socket-patch-core/src/patch/redirect/lock_index_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/lock_index_equivalence_tests.rs
@@ -1,11 +1,12 @@
-//! Equivalence oracles for the npm package-lock and classic yarn.lock hosted
-//! rewriters, which now derive each entry's identity once per lock instead
-//! of once per entry per dep. The previous implementations are kept here
-//! verbatim and the production rewriters must produce the identical output
-//! bytes, FileEdit list, warnings and refusals on randomized locks.
+//! Seeded package-lock.json and classic yarn.lock sweeps for the indexed
+//! hosted rewriters (each entry's identity derived once per lock). Every
+//! output channel is pinned per case by `tests/equivalence/npm_lock_rewrite`
+//! and `yarn_classic_rewrite.golden`, blessed while the pre-index rewriters
+//! still ran beside them as oracles.
 
-use super::rewrite_oracle_support::{assert_same, Rng};
 use super::*;
+use crate::golden::{record, Golden, Sweep};
+use crate::test_rng::Rng;
 
 fn name(i: usize) -> String {
     match i % 4 {
@@ -144,21 +145,26 @@ fn npm_lock(rng: &mut Rng, pool: &mut Vec<(String, String)>) -> String {
 }
 
 #[test]
-fn indexed_npm_lock_rewrite_matches_oracle() {
+fn indexed_npm_lock_rewrite_matches_golden() {
+    let sweep = Sweep::with(
+        Golden::new(
+            "npm_lock_rewrite",
+            "One seeded package-lock.json / npm-shrinkwrap.json + overrides.",
+        )
+        .chunked(4),
+    );
     let mut edits = 0;
     let mut codes = std::collections::BTreeSet::new();
     for seed in 1..=400u64 {
-        let mut rng = Rng(seed.wrapping_mul(0x9E37_79B9_7F4A_7C15) | 1);
+        let mut rng = Rng::new(seed);
         let mut pool = Vec::new();
         let text = npm_lock(&mut rng, &mut pool);
         let deps = overrides(&pool, &mut rng);
         let refs: Vec<&DepOverride> = deps.iter().collect();
         for lockfile in ["package-lock.json", "npm-shrinkwrap.json"] {
-            let mut want = RewriteResult::default();
-            rewrite_one_npm_lock_oracle(&text, lockfile, &refs, &mut want);
             let mut got = RewriteResult::default();
             rewrite_one_npm_lock(&text, lockfile, &refs, &mut got);
-            assert_same(&want, &got, &format!("seed {seed} {lockfile}"));
+            record(&(&text, lockfile, &deps), &got);
             edits += got.edits.len();
             codes.extend(got.warnings.iter().map(|w| w.code.clone()));
         }
@@ -175,6 +181,7 @@ fn indexed_npm_lock_rewrite_matches_oracle() {
     ] {
         assert!(codes.contains(code), "missing {code}: {codes:?}");
     }
+    sweep.finish();
 }
 
 fn yarn_block(rng: &mut Rng, pool: &mut Vec<(String, String)>, i: usize) -> String {
@@ -221,7 +228,14 @@ fn yarn_block(rng: &mut Rng, pool: &mut Vec<(String, String)>, i: usize) -> Stri
 }
 
 #[test]
-fn indexed_yarn_classic_rewrite_matches_oracle() {
+fn indexed_yarn_classic_rewrite_matches_golden() {
+    let sweep = Sweep::with(
+        Golden::new(
+            "yarn_classic_rewrite",
+            "One seeded yarn.lock (v1) + overrides.",
+        )
+        .chunked(2),
+    );
     let mut edits = 0;
     let mut codes = std::collections::BTreeSet::new();
     for seed in 1..=400u64 {
@@ -242,11 +256,9 @@ fn indexed_yarn_classic_rewrite_matches_oracle() {
         }
         let files = BTreeMap::from([("yarn.lock".to_string(), text)]);
         let deps = overrides(&pool, &mut rng);
-        let mut want = RewriteResult::default();
-        rewrite_yarn_classic_oracle(&files, &deps, &mut want);
         let mut got = RewriteResult::default();
         rewrite_yarn_classic(&files, &deps, &mut got);
-        assert_same(&want, &got, &format!("seed {seed}"));
+        record(&(&files, &deps), &got);
         edits += got.edits.len();
         codes.extend(got.warnings.iter().map(|w| w.code.clone()));
     }
@@ -259,317 +271,5 @@ fn indexed_yarn_classic_rewrite_matches_oracle() {
     ] {
         assert!(codes.contains(code), "missing {code}: {codes:?}");
     }
-}
-
-// ── oracles: the pre-index implementations, verbatim ────────────────────────
-
-fn rewrite_one_npm_lock_oracle(
-    content: &str,
-    lockfile: &str,
-    npm: &[&DepOverride],
-    result: &mut RewriteResult,
-) {
-    let Ok(mut lock) = serde_json::from_str::<Value>(content) else {
-        // A corrupt lockfile is strictly worse than a missing one (which
-        // warns in the caller) — never skip the whole npm redirect silently.
-        result.warnings.push(RewriteWarning {
-            code: "redirect_npm_lock_unparseable".into(),
-            detail: format!("{lockfile} is not valid JSON; npm redirect skipped"),
-        });
-        return;
-    };
-    let mut changed = false;
-    for dep in npm {
-        let fname = full_name(dep);
-        let Some(sha512) = dep.integrity.sha512.clone() else {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_npm_missing_sha512".into(),
-                detail: format!("{fname}@{} has no sha512 integrity", dep.version),
-            });
-            continue;
-        };
-        let mut matched_any = false;
-        if let Some(packages) = lock.get_mut("packages").and_then(Value::as_object_mut) {
-            for (key, entry) in packages.iter_mut() {
-                // Only `node_modules/` keys are installable dependencies:
-                // "" is the project root and other bare keys are workspace
-                // members — SOURCE dirs a resolved/integrity insert would
-                // corrupt.
-                let Some((_, key_name)) = key.rsplit_once("node_modules/") else {
-                    continue;
-                };
-                // The package a lock entry stands for: the explicit `name`
-                // field when present (npm writes it for aliases — `npm i
-                // alias@npm:real` keys the entry by the ALIAS), else the
-                // key's trailing path. Mirrors `vendor::npm_lock`'s
-                // `entry_name`, so an alias install of the patched package
-                // redirects and an entry that merely SHARES the key name
-                // (`npm i <fname>@npm:other`) is never hijacked.
-                let entry_nm = entry
-                    .get("name")
-                    .and_then(Value::as_str)
-                    .unwrap_or(key_name);
-                let matches_ver =
-                    entry.get("version").and_then(Value::as_str) == Some(dep.version.as_str());
-                if entry_nm != fname || !matches_ver {
-                    continue;
-                }
-                if entry.get("link").and_then(Value::as_bool) == Some(true) {
-                    matched_any = true;
-                    result.warnings.push(RewriteWarning {
-                        code: "redirect_npm_link_entry_skipped".into(),
-                        detail: format!(
-                            "lock entry `{key}` is a link (npm workspaces/file: dir); skipped"
-                        ),
-                    });
-                    continue;
-                }
-                // npm reify extracts a bundled copy from its PARENT's tarball
-                // and ignores the entry's resolved/integrity, so a rewrite
-                // here would put the hosted URL in the lockfile (confirming
-                // and VEX-attesting the patch) while the unpatched bundled
-                // bytes keep installing. Mirrors the vendored backend's
-                // `vendor_bundled_instance_skipped` refusal.
-                if entry.get("inBundle").and_then(Value::as_bool) == Some(true) {
-                    matched_any = true;
-                    result.warnings.push(RewriteWarning {
-                        code: "redirect_npm_bundled_instance_skipped".into(),
-                        detail: format!(
-                            "lock entry `{key}` is bundled inside its parent's tarball and \
-                             CANNOT be redirected — that copy stays UNPATCHED; vendor or \
-                             update the bundling parent to cover it"
-                        ),
-                    });
-                    continue;
-                }
-                matched_any = true;
-                if let Some(edit) = rewrite_npm_entry(
-                    entry,
-                    dep,
-                    &sha512,
-                    lockfile,
-                    "redirect_npm_lock_entry",
-                    key,
-                ) {
-                    result.edits.push(edit);
-                    changed = true;
-                }
-            }
-        }
-        // v2 legacy `dependencies` tree (keyed by name), recursive.
-        if let Some(deps) = lock.get_mut("dependencies").and_then(Value::as_object_mut) {
-            changed = rewrite_npm_v2_deps(
-                deps,
-                &fname,
-                dep,
-                &sha512,
-                lockfile,
-                result,
-                &mut matched_any,
-            ) || changed;
-        }
-        // Parity with the pnpm/berry/uv rewriters: a granted dep the
-        // lockfile cannot pin must be SAID, not silently dropped from the
-        // redirected count.
-        if !matched_any {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_npm_entry_not_found".into(),
-                detail: format!("no {lockfile} entry for {fname}@{}", dep.version),
-            });
-        }
-    }
-    if changed {
-        // npm <= 6 (the only writer of lockfileVersion 1) installs a registry
-        // dependency from the CONFIGURED registry and ignores the entry's
-        // `resolved` — verified against real npm 6.14.18, while npm 7 / 11
-        // fetch the rewritten url from the same v1 lock. Under npm 6 the
-        // redirected lock therefore fails EINTEGRITY against the patched
-        // sha512 pin (fail-closed: the unpatched bytes never install). Say
-        // so instead of letting an npm 6 CI discover it.
-        if lock.get("lockfileVersion").and_then(Value::as_u64) == Some(1) {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_npm_legacy_client".into(),
-                detail: format!(
-                    "{lockfile} is lockfileVersion 1 (written by npm <= 6). npm <= 6 installs \
-                     registry dependencies from the configured registry and ignores the \
-                     redirected `resolved` url, so its installs fail EINTEGRITY against the \
-                     patched sha512 pin (the unpatched bytes are never installed); install \
-                     with npm >= 7, which fetches the hosted patch (and upgrades the lock)"
-                ),
-            });
-        }
-        result.files.insert(lockfile.into(), serialize_json(&lock));
-    }
-}
-
-fn rewrite_yarn_classic_oracle(
-    files: &BTreeMap<String, String>,
-    overrides: &[DepOverride],
-    result: &mut RewriteResult,
-) {
-    use crate::vendor::yarn_classic_lock::{pattern_real_name, split_key_patterns, split_pattern};
-
-    let npm: Vec<&DepOverride> = overrides.iter().filter(|o| o.ecosystem == "npm").collect();
-    if npm.is_empty() || !files.contains_key("yarn.lock") {
-        return;
-    }
-    let raw = &files["yarn.lock"];
-    if is_berry_lock(raw) {
-        return; // yarn-berry — not classic
-    }
-    // CRLF locks (core.autocrlf Windows checkouts — yarn v1 parses them fine)
-    // are processed LF-normalized and re-expanded on output, so untouched
-    // lines round-trip byte-identically. Without this, `split("\n\n")` never
-    // splits a CRLF file: the whole lock becomes ONE block and the
-    // leftmost-match replaces below would rewrite the FIRST entry in the
-    // file, not the target's. Bare `\r`s outside a CRLF pair make the
-    // round-trip lossy, so such a lock is refused untouched.
-    let crlf = raw.contains('\r');
-    let normalized: String;
-    let content: &str = if crlf {
-        normalized = raw.replace("\r\n", "\n");
-        if normalized.contains('\r') {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_yarn_classic_unsupported_line_endings".into(),
-                detail: "yarn.lock contains bare carriage returns (mixed line endings); \
-                         leaving it untouched"
-                    .into(),
-            });
-            return;
-        }
-        &normalized
-    } else {
-        raw
-    };
-    let mut blocks: Vec<String> = content.split("\n\n").map(String::from).collect();
-    let resolved_re =
-        Regex::new(r#"\n {2}resolved "[^"]*""#).expect("static resolved-line regex is valid");
-    let integrity_re =
-        Regex::new(r"\n {2}integrity [^\n]*").expect("static integrity-line regex is valid");
-    let mut changed = false;
-    for dep in &npm {
-        let fname = full_name(dep);
-        let Some(sha512) = dep.integrity.sha512.clone() else {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_yarn_classic_missing_sha512".into(),
-                detail: format!("{fname}@{} has no sha512 integrity", dep.version),
-            });
-            continue;
-        };
-        let version_re =
-            Regex::new(&(String::from(r#"\n {2}version ""#) + &regex::escape(&dep.version) + "\""))
-                .expect("version regex from the escaped version is valid");
-        let mut matched_any = false;
-        let mut alias_skipped = false;
-        for block in blocks.iter_mut() {
-            // The block's key line names its consumers; resolve every
-            // comma-joined pattern to the REAL package it stands for
-            // (`alias@npm:target@range` → target). A key like
-            // `<fname>@npm:<other-pkg>@…` — yarn v1's fork-substitution
-            // idiom — resolves to <other-pkg>, so it is NOT ours to touch:
-            // matching on the alias name alone would hijack the fork.
-            let Some(key_line) = block
-                .lines()
-                .find(|l| !l.is_empty() && !l.starts_with([' ', '\t', '#']))
-            else {
-                continue;
-            };
-            let Some(key) = key_line.strip_suffix(':') else {
-                continue;
-            };
-            let patterns = split_key_patterns(key);
-            if patterns.is_empty()
-                || !patterns
-                    .iter()
-                    .all(|p| pattern_real_name(p) == Some(fname.as_str()))
-            {
-                continue;
-            }
-            if !version_re.is_match(block) {
-                continue;
-            }
-            // A block reached only through `alias@npm:<fname>@range`
-            // descriptors is left byte-identical (mirroring the berry
-            // rewriter), but never silently: that copy keeps installing the
-            // unpatched artifact.
-            if !patterns
-                .iter()
-                .any(|p| split_pattern(p).is_some_and(|(n, _)| n == fname))
-            {
-                alias_skipped = true;
-                result.warnings.push(RewriteWarning {
-                    code: "redirect_yarn_classic_alias_skipped".into(),
-                    detail: format!(
-                        "lock entry `{key}` consumes {fname}@{} only through npm: alias \
-                         descriptors; the hosted redirect does not rewrite alias entries, \
-                         so this copy stays unpatched",
-                        dep.version
-                    ),
-                });
-                continue;
-            }
-            matched_any = true;
-            let frag = dep
-                .integrity
-                .sha1
-                .as_ref()
-                .map(|s| format!("#{s}"))
-                .unwrap_or_default();
-            let mut rewritten = resolved_re
-                .replace(
-                    block,
-                    format!("\n  resolved \"{}{frag}\"", dep.artifact_url).as_str(),
-                )
-                .to_string();
-            if integrity_re.is_match(&rewritten) {
-                rewritten = integrity_re
-                    .replace(&rewritten, format!("\n  integrity {sha512}").as_str())
-                    .to_string();
-            } else {
-                rewritten = resolved_re
-                    .replace(
-                        &rewritten,
-                        // $0 re-inserts the matched resolved line, then add integrity.
-                        format!(
-                            "\n  resolved \"{}{frag}\"\n  integrity {sha512}",
-                            dep.artifact_url
-                        )
-                        .as_str(),
-                    )
-                    .to_string();
-            }
-            if rewritten != *block {
-                // Ledger originals record the on-disk byte form, so a future
-                // revert of a CRLF lock can match what the file really held.
-                let (edit_original, edit_new) = if crlf {
-                    (block.replace('\n', "\r\n"), rewritten.replace('\n', "\r\n"))
-                } else {
-                    (block.clone(), rewritten.clone())
-                };
-                result.edits.push(FileEdit {
-                    path: "yarn.lock".into(),
-                    kind: "redirect_yarn_classic_entry".into(),
-                    action: "rewritten".into(),
-                    key: Some(format!("{fname}@{}", dep.version)),
-                    original: Some(Value::String(edit_original)),
-                    new: Some(Value::String(edit_new)),
-                });
-                *block = rewritten;
-                changed = true;
-            }
-        }
-        if !matched_any && !alias_skipped {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_yarn_classic_entry_not_found".into(),
-                detail: format!("no yarn.lock entry resolving {fname}@{}", dep.version),
-            });
-        }
-    }
-    if changed {
-        let mut out = blocks.join("\n\n");
-        if crlf {
-            out = out.replace('\n', "\r\n");
-        }
-        result.files.insert("yarn.lock".into(), out);
-    }
+    sweep.finish();
 }
diff --git a/crates/socket-patch-core/src/patch/redirect/mod.rs b/crates/socket-patch-core/src/patch/redirect/mod.rs
index 0738302e..9bfe3a26 100644
--- a/crates/socket-patch-core/src/patch/redirect/mod.rs
+++ b/crates/socket-patch-core/src/patch/redirect/mod.rs
@@ -44,9 +44,7 @@ pub mod npmrc;
 mod pdm;
 mod pipenv;
 pub mod presence;
-// The pnpm entry grammar and hosted planner live with the format's model.
-#[cfg(test)]
-use crate::formats::pnpm::grammar as pnpm;
+// The pnpm hosted planner lives with the format's model.
 use crate::formats::pnpm::plan_hosted;
 use crate::formats::cargo::CargoLock;
 use crate::formats::composer::hosted::rewrite_composer_lock;
@@ -63,8 +61,6 @@ mod poetry;
 #[cfg(test)]
 mod python_lock_equivalence_tests;
 mod requirements;
-#[cfg(test)]
-mod rewrite_oracle_support;
 mod staged;
 mod state;
 mod hosted_url;
@@ -82,6 +78,7 @@ pub(crate) use hosted_url::{hosted_url_names, hosted_url_version};
 
 /// One ecosystem's integrity hashes (mirrors the TS `PatchArtifactIntegrity`).
 #[derive(Debug, Clone, Default, Deserialize)]
+#[cfg_attr(test, derive(Serialize))]
 #[serde(rename_all = "camelCase")]
 pub struct Integrity {
     pub sha512: Option<String>,
@@ -99,6 +96,7 @@ pub struct Integrity {
 }
 
 #[derive(Debug, Clone, Default, Deserialize)]
+#[cfg_attr(test, derive(Serialize))]
 #[serde(rename_all = "camelCase")]
 pub struct RegistryOverrideIdentifiers {
     pub name: String,
@@ -147,6 +145,7 @@ pub struct RegistryOverrideIdentifiers {
 }
 
 #[derive(Debug, Clone, Deserialize)]
+#[cfg_attr(test, derive(Serialize))]
 #[serde(rename_all = "camelCase")]
 pub struct RegistryOverride {
     pub kind: String,
@@ -156,6 +155,7 @@ pub struct RegistryOverride {
 
 /// One patched dependency to redirect (mirrors the TS `DepOverride`).
 #[derive(Debug, Clone, Deserialize)]
+#[cfg_attr(test, derive(Serialize))]
 #[serde(rename_all = "camelCase")]
 pub struct DepOverride {
     pub ecosystem: String,
@@ -196,6 +196,7 @@ pub struct RewriteWarning {
 }
 
 #[derive(Debug, Default, Clone, PartialEq)]
+#[cfg_attr(test, derive(Serialize))]
 pub struct RewriteResult {
     /// Rewritten file contents keyed by repo-relative path — only CHANGED files.
     pub files: BTreeMap<String, String>,
diff --git a/crates/socket-patch-core/src/patch/redirect/pdm.rs b/crates/socket-patch-core/src/patch/redirect/pdm.rs
index 987a362d..95d910f2 100644
--- a/crates/socket-patch-core/src/patch/redirect/pdm.rs
+++ b/crates/socket-patch-core/src/patch/redirect/pdm.rs
@@ -157,49 +157,6 @@ fn plan_in(
     Ok((rewrite.text, edits))
 }
 
-/// The previous [`plan`], which re-derived the rewrite's edits, kept as the
-/// equivalence oracle.
-#[cfg(test)]
-fn plan_reference(text: &str, dep: &DepOverride) -> Result<(String, Vec<FileEdit>), String> {
-    let sha256 = dep
-        .integrity
-        .sha256
-        .as_deref()
-        .ok_or("missing PDM SHA-256")?;
-    let url = reqwest::Url::parse(&dep.artifact_url).map_err(|e| e.to_string())?;
-    if !matches!(url.scheme(), "http" | "https")
-        || url.fragment().is_some()
-        || url.query().is_some()
-    {
-        return Err("unsupported PDM artifact URL".into());
-    }
-    let filename = url
-        .path_segments()
-        .and_then(|mut segments| segments.next_back())
-        .ok_or("missing PDM wheel filename")?;
-    use crate::utils::pdm_lock::{pdm_lock_edits, rewrite_pdm_lock};
-    let rewritten = rewrite_pdm_lock(
-        text,
-        &dep.name,
-        &dep.version,
-        ("url", &dep.artifact_url),
-        filename,
-        sha256,
-    )?;
-    let edits = pdm_lock_edits(text, &rewritten, &dep.name)?
-        .into_iter()
-        .map(|(old, new)| FileEdit {
-            path: "pdm.lock".into(),
-            kind: "redirect_pdm_lock_package".into(),
-            action: "rewritten".into(),
-            key: Some(dep.name.clone()),
-            original: Some(json!(old)),
-            new: Some(json!(new)),
-        })
-        .collect();
-    Ok((rewritten, edits))
-}
-
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -338,11 +295,15 @@ mod equivalence_tests {
         }
     }
 
-    /// `plan` equals the oracle (text and FileEdits, or the refusal) on every
-    /// native lock generation, LF and CRLF, for a landing dep, refusals, and
-    /// again over the landed output (re-run and rotated-token takeover).
+    /// `plan` (text and FileEdits, or the refusal) on every native lock
+    /// generation, LF and CRLF, for a landing dep, refusals, and again over
+    /// the landed output (re-run and rotated-token takeover).
     #[test]
-    fn plan_matches_reference_on_every_lock_generation() {
+    fn plan_matches_golden_on_every_lock_generation() {
+        let mut g = crate::golden::Golden::new(
+            "pdm_plan",
+            "One (lock, dep) pair, planned: the rewritten text and FileEdits, or the refusal.",
+        );
         let sha = "a".repeat(64);
         let wheel = "urllib3-1.26.18-py2.py3-none-any.whl";
         let deps = [
@@ -376,22 +337,20 @@ mod equivalence_tests {
                     lock.clone()
                 };
                 for (i, first) in deps.iter().enumerate() {
-                    let want = plan_reference(&lock, first);
                     let got = plan(&lock, first);
-                    assert_eq!(
-                        format!("{got:?}"),
-                        format!("{want:?}"),
-                        "{name} crlf={crlf} dep#{i}"
+                    g.case(
+                        format!("{name}/{crlf}/{i}"),
+                        &(&lock, i),
+                        &format!("{got:?}"),
                     );
-                    let Ok((rewritten, _)) = want else { continue };
+                    let Ok((rewritten, _)) = got else { continue };
                     landed += 1;
                     for (j, second) in deps.iter().enumerate() {
-                        let want = plan_reference(&rewritten, second);
                         let got = plan(&rewritten, second);
-                        assert_eq!(
-                            format!("{got:?}"),
-                            format!("{want:?}"),
-                            "{name} crlf={crlf} dep#{i} then dep#{j}"
+                        g.case(
+                            format!("{name}/{crlf}/{i}/{j}"),
+                            &(&rewritten, j),
+                            &format!("{got:?}"),
                         );
                     }
                 }
@@ -401,6 +360,7 @@ mod equivalence_tests {
             landed >= 20,
             "the corpus exercises the rewrite path ({landed})"
         );
+        g.finish();
     }
 }
 
@@ -408,113 +368,17 @@ mod equivalence_tests {
 mod parse_reuse_equivalence_tests {
     //! The hosted rewrite sharing one parse per lock state across the
     //! presence probe, the rewrite, the format probe and the next dep,
-    //! against the previous rewrite (a fresh parse for each), kept verbatim.
+    //! pinned by golden (blessed against #257's fresh-parse rewrite).
     use super::*;
     use crate::patch::redirect::Integrity;
     use crate::utils::pdm_lock::parse_reuse_tests::{fixtures, grown, steps};
 
-    fn rewrite_reference(
-        files: &BTreeMap<String, String>,
-        overrides: &[DepOverride],
-        result: &mut RewriteResult,
-    ) {
-        let Some(original) = files.get("pdm.lock") else {
-            return;
-        };
-        let mut text = original.clone();
-        let mut stale_warned = false;
-        for dep in overrides.iter().filter(|dep| dep.ecosystem == "pypi") {
-            // A package `pdm.lock` simply does not contain is not installed by pdm —
-            // a sibling `requirements.txt`/pylock may legitimately carry it — so we
-            // neither redirect it here nor veto the other pypi rewriters. Only a
-            // package the lock DOES contain but the plan refuses (source conflict,
-            // unsupported format, forked variants, bad hashes) withholds siblings.
-            if !lock_contains_reference(&text, &dep.name) {
-                continue;
-            }
-            match plan_reference(&text, dep) {
-                Ok((rewritten, edits)) => {
-                    result.confirmed_pdm_uuids.insert(dep.patch_uuid.clone());
-                    let lock_ver: Option<String> = rewritten
-                        .parse::<toml_edit::DocumentMut>()
-                        .ok()
-                        .and_then(|lock| {
-                            crate::utils::pdm_lock::lock_version(&lock)
-                                .ok()
-                                .map(str::to_string)
-                        });
-                    if lock_ver.as_deref() == Some("2") {
-                        result.warnings.push(RewriteWarning { code: "redirect_pdm_legacy_sync_required".into(), detail: "PDM 0.x may regenerate freshly generated locks during install; use `pdm sync` to preserve this patch, or upgrade PDM".into() });
-                    }
-                    // PDM < 2.11 (lock_version "2"/"4.3"/"4.4") does not replace an
-                    // already-installed package at the same version, so a warm
-                    // `pdm sync`/`pdm install` leaves the upstream bytes live
-                    // (measured: 1.4.5/2.9.3/2.10.4 keep them; 2.11+ reinstall). The
-                    // installed-byte probe only fires for a discoverable venv, so a
-                    // PEP 582 `__pypackages__` or a lock-only/CI scan gets no
-                    // warning: warn proactively once per lock, mirroring poetry's
-                    // `redirect_poetry_stale_install_risk`.
-                    if !stale_warned
-                        && matches!(lock_ver.as_deref(), Some("2") | Some("4.3") | Some("4.4"))
-                    {
-                        stale_warned = true;
-                        result.warnings.push(RewriteWarning {
-                            code: "redirect_pdm_stale_install_risk".into(),
-                            detail: format!(
-                                "pdm.lock (lock_version {}) was written by PDM < 2.11, which does \
-                                 not replace an already-installed package at the same version: an \
-                                 existing environment keeps the upstream {} until it is reinstalled \
-                                 \u{2014} recreate the environment (or uninstall the package) before \
-                                 `pdm sync`/`pdm install`; a fresh install picks up the patched \
-                                 wheel. The installed files were left unchanged.",
-                                lock_ver.as_deref().unwrap_or_default(),
-                                dep.name
-                            ),
-                        });
-                    }
-                    text = rewritten;
-                    result.edits.extend(edits);
-                }
-                Err(detail) => {
-                    result.refused_pdm_uuids.insert(dep.patch_uuid.clone());
-                    result.warnings.push(RewriteWarning {
-                        code: "redirect_pdm_refused".into(),
-                        detail,
-                    });
-                }
-            }
-        }
-        if text != *original {
-            result.files.insert("pdm.lock".into(), text);
-        }
-    }
-
-    /// Whether `pdm.lock` carries a `[[package]]` entry for `name`. When it does
-    /// not, pdm does not install this package, so the caller leaves it to the
-    /// sibling rewriters rather than vetoing them. A malformed lock, or one with no
-    /// package array, returns `true` so the genuine refusal still surfaces from
-    /// `rewrite_pdm_lock` (and, when pdm drives, withholds the siblings).
-    fn lock_contains_reference(text: &str, name: &str) -> bool {
-        let Ok(lock) = text.parse::<toml_edit::DocumentMut>() else {
-            return true;
-        };
-        let canon = canonicalize_pypi_name(name);
-        match lock
-            .get("package")
-            .and_then(toml_edit::Item::as_array_of_tables)
-        {
-            None => true,
-            Some(packages) => packages.iter().any(|package| {
-                package
-                    .get("name")
-                    .and_then(toml_edit::Item::as_str)
-                    .is_some_and(|candidate| canonicalize_pypi_name(candidate) == canon)
-            }),
-        }
-    }
-
     #[test]
-    fn shared_parse_matches_the_fresh_parse_rewrite() {
+    fn shared_parse_matches_golden() {
+        let mut g = crate::golden::Golden::new(
+            "pdm_rewrite_shared_parse",
+            "One grown pdm.lock and its url deps, rewritten, then re-run over the result.",
+        );
         let mut confirmed = 0;
         for (fixture, lock) in fixtures() {
             for extra in [0, 3] {
@@ -544,23 +408,24 @@ mod parse_reuse_equivalence_tests {
                         .collect();
                     let files = BTreeMap::from([("pdm.lock".to_string(), lock)]);
                     let what = format!("{fixture} extra={extra} crlf={crlf}");
-                    let mut want = RewriteResult::default();
-                    rewrite_reference(&files, &deps, &mut want);
                     let mut got = RewriteResult::default();
                     rewrite(&files, &deps, &mut got);
-                    assert_eq!(format!("{got:?}"), format!("{want:?}"), "{what}");
+                    g.case(what.replace(' ', "/"), &(&files, &deps), &format!("{got:?}"));
                     confirmed += got.confirmed_pdm_uuids.len();
 
                     let mut again = files.clone();
-                    again.extend(want.files.clone());
-                    let mut want = RewriteResult::default();
-                    rewrite_reference(&again, &deps, &mut want);
+                    again.extend(got.files.clone());
                     let mut got = RewriteResult::default();
                     rewrite(&again, &deps, &mut got);
-                    assert_eq!(format!("{got:?}"), format!("{want:?}"), "{what} re-run");
+                    g.case(
+                        format!("{}/re-run", what.replace(' ', "/")),
+                        &(&again, &deps),
+                        &format!("{got:?}"),
+                    );
                 }
             }
         }
         assert!(confirmed > 100, "only {confirmed} confirmed");
+        g.finish();
     }
 }
diff --git a/crates/socket-patch-core/src/patch/redirect/pnpm_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/pnpm_equivalence_tests.rs
index d3f54db5..d79bc06b 100644
--- a/crates/socket-patch-core/src/patch/redirect/pnpm_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/pnpm_equivalence_tests.rs
@@ -1,21 +1,19 @@
-//! Equivalence oracle for the indexed pnpm hosted rewriter: the previous
-//! implementation (re-parse every lock per dep, splice per dep) is kept here
-//! verbatim as `rewrite_pnpm_lock_oracle`, and the production
-//! `plan_hosted` must produce the identical `RewriteResult` — output
-//! bytes, the FileEdit list (order and `original` fragments), warnings and
-//! refusals — on depscan-sized synthetic locks and on randomized mixes of
-//! every lock flavor the grammar handles.
+//! Depscan-sized and seeded pnpm-lock.yaml sweeps for the indexed hosted
+//! rewriter (one parse per lock, every dep spliced from it): output bytes,
+//! the FileEdit list (order and `original` fragments), warnings and
+//! refusals are pinned per case by `tests/equivalence/pnpm_*.golden`,
+//! blessed while the per-dep re-parsing rewriter still ran beside it as an
+//! oracle.
 
-use super::rewrite_oracle_support::{assert_same, Rng};
 use super::*;
+use crate::golden::{record, Sweep};
+use crate::test_rng::Rng;
 
-/// Run both implementations and assert they agree; returns the result.
-fn assert_equivalent(files: &BTreeMap<String, String>, overrides: &[DepOverride]) -> RewriteResult {
-    let mut want = RewriteResult::default();
-    rewrite_pnpm_lock_oracle(files, overrides, &mut want);
+/// The production rewriter, recorded into the running sweep.
+fn run(files: &BTreeMap<String, String>, overrides: &[DepOverride]) -> RewriteResult {
     let mut got = RewriteResult::default();
     plan_hosted(files, overrides, &mut got);
-    assert_same(&want, &got, "pnpm");
+    record(&(files, overrides), &got);
     got
 }
 
@@ -217,7 +215,11 @@ fn packages(n: usize, rng: &mut Rng) -> Vec<Pkg> {
 /// already-hosted, residual (unbalanced peer suffix), vendored, not-found and
 /// missing-sha512 deps, plus a non-npm override the rewriter must ignore.
 #[test]
-fn indexed_pnpm_rewrite_matches_oracle_on_depscan_sized_lock_set() {
+fn indexed_pnpm_rewrite_matches_golden_on_depscan_sized_lock_set() {
+    let sweep = Sweep::start(
+        "pnpm_depscan_sized",
+        "A depscan-sized seeded pnpm-lock.yaml set + shuffled overrides.",
+    );
     let mut rng = Rng(0x5eed_cafe_f00d_0001);
     let root = packages(4000, &mut rng);
     let nested = packages(1200, &mut rng);
@@ -311,7 +313,7 @@ fn indexed_pnpm_rewrite_matches_oracle_on_depscan_sized_lock_set() {
         shuffled.push(overrides.remove(i));
     }
 
-    let r = assert_equivalent(&files, &shuffled);
+    let r = run(&files, &shuffled);
     // The fixture must actually exercise the interesting paths.
     assert!(r.edits.len() > 90, "edits: {}", r.edits.len());
     assert_eq!(r.files.len(), 3, "{:?}", r.files.keys());
@@ -324,6 +326,7 @@ fn indexed_pnpm_rewrite_matches_oracle_on_depscan_sized_lock_set() {
     ] {
         assert!(codes.contains(&code), "missing {code}: {codes:?}");
     }
+    sweep.finish();
 }
 
 /// Two overrides of the SAME name@version with different artifacts: the
@@ -331,6 +334,10 @@ fn indexed_pnpm_rewrite_matches_oracle_on_depscan_sized_lock_set() {
 /// is the first's `new`), exactly as the per-dep re-parse did.
 #[test]
 fn duplicate_override_sees_the_prior_rewrite() {
+    let sweep = Sweep::start(
+        "pnpm_duplicate_override",
+        "A pnpm lock whose overrides repeat a package.",
+    );
     let p = Pkg {
         name: "left-pad".into(),
         version: "1.3.0".into(),
@@ -339,7 +346,7 @@ fn duplicate_override_sees_the_prior_rewrite() {
     let files = BTreeMap::from([("pnpm-lock.yaml".to_string(), lock.to_string())]);
     let first = dep(&p, 1, "a", Some("sha512-FIRST=="));
     let second = dep(&p, 2, "b", Some("sha512-SECOND=="));
-    let r = assert_equivalent(&files, &[first.clone(), second.clone()]);
+    let r = run(&files, &[first.clone(), second.clone()]);
     assert_eq!(r.edits.len(), 4, "{:#?}", r.edits);
     for i in 0..2 {
         assert_eq!(r.edits[i + 2].original, r.edits[i].new, "edit {i}");
@@ -352,8 +359,9 @@ fn duplicate_override_sees_the_prior_rewrite() {
     );
     assert!(!out.contains(first.artifact_url.as_str()), "{out}");
     // The same pair with identical artifacts: the second is a no-op.
-    let r = assert_equivalent(&files, &[second.clone(), second]);
+    let r = run(&files, &[second.clone(), second]);
     assert_eq!(r.edits.len(), 2, "{:#?}", r.edits);
+    sweep.finish();
 }
 
 /// Every peer-suffixed instance gets its own edit, in file order, keyed by
@@ -361,6 +369,10 @@ fn duplicate_override_sees_the_prior_rewrite() {
 /// contexts and a v5 `_` suffix in a second lock.
 #[test]
 fn peer_suffixed_instances_rewrite_in_file_order() {
+    let sweep = Sweep::start(
+        "pnpm_peer_suffixed",
+        "A pnpm lock with peer-suffixed instances of one package.",
+    );
     let lock_v6 = "lockfileVersion: '6.0'\n\npackages:\n\n  '/@s/p@1.0.0(react@18.2.0(scheduler@0.23.2))':\n    resolution: {integrity: sha512-UP==}\n\n  /@s/p@1.0.0:\n    resolution: {integrity: sha512-UP==}\n\n  /@s/p@1.0.0(react@17.0.2):\n    resolution: {integrity: sha512-UP==}\n\n  /@s/p@1.0.01:\n    resolution: {integrity: sha512-OTHER==}\n";
     let lock_v5 = "lockfileVersion: 5.4\n\npackages:\n\n  /@s/p/1.0.0_react@18.2.0:\n    resolution: {integrity: sha512-UP==}\n";
     let files = BTreeMap::from([
@@ -371,7 +383,7 @@ fn peer_suffixed_instances_rewrite_in_file_order() {
         name: "@s/p".into(),
         version: "1.0.0".into(),
     };
-    let r = assert_equivalent(&files, &[dep(&p, 1, "a", Some("sha512-P=="))]);
+    let r = run(&files, &[dep(&p, 1, "a", Some("sha512-P=="))]);
     let keys: Vec<(&str, &str)> = r
         .edits
         .iter()
@@ -390,13 +402,18 @@ fn peer_suffixed_instances_rewrite_in_file_order() {
         ]
     );
     assert!(r.files["a/pnpm-lock.yaml"].contains("sha512-OTHER=="));
+    sweep.finish();
 }
 
 /// Randomized small lock sets over every flavor (including the refused
 /// early shrinkwrap and CRLF), with overrides drawn so hits, duplicates,
 /// residuals and misses all interleave.
 #[test]
-fn indexed_pnpm_rewrite_matches_oracle_on_random_lock_sets() {
+fn indexed_pnpm_rewrite_matches_golden_on_random_lock_sets() {
+    let sweep = Sweep::start(
+        "pnpm_random",
+        "One seeded pnpm-lock.yaml set (every flavor) + overrides.",
+    );
     let flavors = [
         Flavor::V9,
         Flavor::V6,
@@ -491,7 +508,7 @@ fn indexed_pnpm_rewrite_matches_oracle_on_random_lock_sets() {
                 overrides.push(dep(&p, i + 100, tag, Some(&sri("DUP"))));
             }
         }
-        let r = assert_equivalent(&files, &overrides);
+        let r = run(&files, &overrides);
         if !r.edits.is_empty() {
             outcomes.insert("edit".into());
         }
@@ -523,233 +540,5 @@ fn indexed_pnpm_rewrite_matches_oracle_on_random_lock_sets() {
             "sweep never reached {want}: {outcomes:?}"
         );
     }
-}
-
-// ── oracle: the pre-index implementation, verbatim ──────────────────────────
-
-fn rewrite_pnpm_lock_oracle(
-    files: &BTreeMap<String, String>,
-    overrides: &[DepOverride],
-    result: &mut RewriteResult,
-) {
-    let npm: Vec<&DepOverride> = overrides.iter().filter(|o| o.ecosystem == "npm").collect();
-    // A pnpm lock lives at the project root or at any nested path (e.g. Rush
-    // repos keep them under `common/config/rush/`); every such files-map key
-    // is rewritten under the same grammar. Deterministic order: BTreeMap
-    // iterates keys sorted, so goldens are stable across every lock in the set.
-    let lock_keys: Vec<&String> = files
-        .keys()
-        .filter(|k| {
-            matches!(
-                k.rsplit('/').next(),
-                Some("pnpm-lock.yaml" | "shrinkwrap.yaml")
-            )
-        })
-        .collect();
-    if npm.is_empty() || lock_keys.is_empty() {
-        return;
-    }
-    let mut contents: Vec<(&String, String, bool)> = lock_keys
-        .iter()
-        .map(|k| (*k, files[*k].clone(), false))
-        .collect();
-    for dep in &npm {
-        let fname = full_name(dep);
-        let unsafe_locks: Vec<_> = contents
-            .iter()
-            .filter(|(_, content, _)| {
-                pnpm::unsupported_early_shrinkwrap(content)
-                    && pnpm::entries(content)
-                        .iter()
-                        .any(|e| pnpm::suffix(e.key, &fname, &dep.version).is_some())
-            })
-            .map(|(path, _, _)| path.as_str())
-            .collect();
-        if !unsafe_locks.is_empty() {
-            result.refused_pnpm_uuids.insert(dep.patch_uuid.clone());
-            result.warnings.push(RewriteWarning {
-                code: "redirect_pnpm_legacy_lockfile_unsupported".into(),
-                detail: format!("{} uses early pnpm 1 shrinkwrapVersion 3 without a supported minor version. Those installers discard hosted tarball URLs; {fname}@{} was left unchanged in every lock. Upgrade to a tested pnpm release (1.43.1 or newer) and regenerate the lock, or use `scan --mode agent` for installed-file patching.", unsafe_locks.join(", "), dep.version),
-            });
-            continue;
-        }
-        let Some(sha512) = dep.integrity.sha512.clone() else {
-            result.warnings.push(RewriteWarning {
-                code: "redirect_pnpm_missing_sha512".into(),
-                detail: format!("{fname}@{} has no sha512 integrity", dep.version),
-            });
-            continue;
-        };
-        // Every peer instance must be redirected, including nested peer
-        // contexts and the block resolutions emitted by pnpm 1–5.
-        let mut matched_any = false;
-        // Per-lock rewrites are PLANNED first and committed only after the
-        // residual gate below proves no instance of this dep escaped the
-        // splice grammar in ANY lock — committing lock-by-lock as we go
-        // would ship exactly the partial rewrite the gate exists to refuse.
-        let mut planned: Vec<(usize, String, Vec<FileEdit>)> = Vec::new();
-        let mut residuals: Vec<(&str, Vec<String>)> = Vec::new();
-        for (idx, (lock_key, content, _)) in contents.iter().enumerate() {
-            // (byte range to replace, replacement text) per instance, plus
-            // one FileEdit per instance keyed by the canonical instance key —
-            // per-instance edits keep the revert ledger lossless when several
-            // instances of one dep live in the same lock.
-            let mut splices: Vec<(std::ops::Range<usize>, String)> = Vec::new();
-            let mut instance_edits: Vec<FileEdit> = Vec::new();
-            for entry in pnpm::entries(content) {
-                let Some(suffix) = pnpm::suffix(entry.key, &fname, &dep.version) else {
-                    continue;
-                };
-                if !pnpm::supported_suffix(suffix) {
-                    continue;
-                }
-                let Some(resolution) = pnpm::resolution(&entry) else {
-                    continue;
-                };
-                matched_any = true;
-                let original = &content[resolution.range.clone()];
-                let rebuilt = resolution.rewrite(&sha512, &dep.artifact_url);
-                if rebuilt == original {
-                    continue;
-                }
-                splices.push((resolution.range, rebuilt.clone()));
-                instance_edits.push(FileEdit {
-                    path: (*lock_key).clone(),
-                    kind: "redirect_pnpm_resolution".into(),
-                    action: "rewritten".into(),
-                    key: Some(format!("{fname}@{}{suffix}", dep.version)),
-                    original: Some(Value::String(original.to_string())),
-                    new: Some(Value::String(rebuilt)),
-                });
-            }
-            // Splice by byte range (package blocks are disjoint and ordered) — a string replace could hit the wrong
-            // instance when two entries share identical surrounding bytes.
-            let candidate: Option<String> = if splices.is_empty() {
-                None
-            } else {
-                let mut out = String::with_capacity(content.len());
-                let mut cursor = 0usize;
-                for (range, replacement) in splices {
-                    out.push_str(&content[cursor..range.start]);
-                    out.push_str(&replacement);
-                    cursor = range.end;
-                }
-                out.push_str(&content[cursor..]);
-                Some(out)
-            };
-            // Residual gate, run over the POST-splice text: any instance of
-            // this exact name@version still resolving somewhere other than
-            // the hosted artifact — in a spelling the splice grammar cannot
-            // parse (e.g. an unbalanced peer suffix) — makes this a partial
-            // rewrite. Shipping it would confirm and VEX-attest the dep while
-            // dependents through the unmatched instance keep installing the
-            // unpatched upstream tarball, so the dep is refused instead.
-            let leftover = pnpm_unrewritten_instances(
-                candidate.as_deref().unwrap_or(content),
-                &fname,
-                &dep.version,
-                &dep.artifact_url,
-            );
-            if !leftover.is_empty() {
-                residuals.push(((*lock_key).as_str(), leftover));
-                continue;
-            }
-            if let Some(out) = candidate {
-                planned.push((idx, out, instance_edits));
-            }
-        }
-        // ANY residual anywhere refuses the dep across the WHOLE lock set —
-        // nothing rewritten, nothing recorded, nothing confirmed (the same
-        // fail-closed contract the pre-splice v5/v6 refusal had): a rewrite
-        // committed in one lock while another still resolves the dep
-        // upstream would confirm the dep set-wide.
-        if !residuals.is_empty() {
-            result.refused_pnpm_uuids.insert(dep.patch_uuid.clone());
-            for (lock_key, keys) in &residuals {
-                result.warnings.push(RewriteWarning {
-                    code: "redirect_pnpm_unsupported_lock_key".into(),
-                    detail: format!(
-                        "{fname}@{} still resolves through pnpm lock key(s) whose \
-                         resolution the redirect grammar cannot repoint: {} in \
-                         {lock_key}; the dep is left unredirected in EVERY lock \
-                         (nothing rewritten, nothing confirmed) — regenerate the \
-                         lock with a current pnpm (lockfileVersion 9) and re-run",
-                        dep.version,
-                        keys.join(", ")
-                    ),
-                });
-            }
-            continue;
-        }
-        for (idx, out, mut instance_edits) in planned {
-            let (_, content, changed) = &mut contents[idx];
-            *content = out;
-            *changed = true;
-            result.edits.append(&mut instance_edits);
-        }
-        // The entry-not-found warning fires only when the dep matched in NO
-        // pnpm lock across the whole set, not once per lock. A VENDORED dep
-        // is named as such: `socket-patch vendor` removes the registry
-        // resolution this grammar looks for (v9 respells the packages key
-        // `<name>@file:.socket/vendor/…`; v5/v6 rekey it to a bare `file:`
-        // key but keep the `<name>@<version>: file:…` overrides line), so
-        // the generic not-locked wording would send users on a wild-goose
-        // `pnpm install` when the real path is a mode switch. Fail-closed
-        // either way: nothing is rewritten for the dep.
-        if !matched_any {
-            let v9_vendored_key = format!("{fname}@file:");
-            let override_key = format!("{fname}@{}", dep.version);
-            let vendored = contents.iter().any(|(_, content, _)| {
-                content.lines().any(|line| {
-                    let t = line.trim_start();
-                    let t = t.strip_prefix('\'').unwrap_or(t);
-                    // v9 packages/snapshots key (leading `/` in v6 spelling).
-                    // The vendor backend always writes the RELATIVE
-                    // `file:.socket/vendor/…` spelling here, so anchoring on
-                    // it keeps a user's own `file:` dep of the same name
-                    // from being misreported as vendored.
-                    let key = t.strip_prefix('/').unwrap_or(t);
-                    if key
-                        .strip_prefix(&v9_vendored_key)
-                        .is_some_and(|rest| rest.starts_with(".socket/vendor/"))
-                    {
-                        return true;
-                    }
-                    // overrides / root-dep line: `<name>@<version>: file:…`
-                    // (pnpm <=8 absolutizes the value, so only the
-                    // `.socket/vendor/` tail is stable enough to match).
-                    t.strip_prefix(&override_key)
-                        .map(|rest| rest.strip_prefix('\'').unwrap_or(rest))
-                        .and_then(|rest| rest.strip_prefix(':'))
-                        .is_some_and(|rest| {
-                            rest.contains("file:") && rest.contains(".socket/vendor/")
-                        })
-                })
-            });
-            if vendored {
-                result.warnings.push(RewriteWarning {
-                    code: "redirect_pnpm_entry_vendored".into(),
-                    detail: format!(
-                        "{fname}@{} has no registry resolution because it is \
-                         VENDORED (the lock resolves it to a \
-                         file:.socket/vendor/… tarball); the hosted redirect \
-                         does not apply — run `socket-patch vendor --revert` to \
-                         restore the registry resolution, then re-run `scan \
-                         --mode hosted`",
-                        dep.version
-                    ),
-                });
-            } else {
-                result.warnings.push(RewriteWarning {
-                    code: "redirect_pnpm_entry_not_found".into(),
-                    detail: format!("no resolution for {fname}@{}", dep.version),
-                });
-            }
-        }
-    }
-    for (key, content, changed) in contents {
-        if changed {
-            result.files.insert(key.clone(), content);
-        }
-    }
+    sweep.finish();
 }
diff --git a/crates/socket-patch-core/src/patch/redirect/poetry.rs b/crates/socket-patch-core/src/patch/redirect/poetry.rs
index 3bd20f47..624b74c4 100644
--- a/crates/socket-patch-core/src/patch/redirect/poetry.rs
+++ b/crates/socket-patch-core/src/patch/redirect/poetry.rs
@@ -157,127 +157,6 @@ pub(super) fn rewrite_poetry(
     }
 }
 
-/// The previous [`rewrite_poetry`], which re-derived each rewrite's edits
-/// and re-judged the lock's writer after every rewrite, kept as the
-/// equivalence oracle.
-#[cfg(test)]
-fn rewrite_poetry_reference(
-    files: &BTreeMap<String, String>,
-    overrides: &[DepOverride],
-    result: &mut RewriteResult,
-) {
-    use crate::utils::poetry_lock::{poetry_lock_edits, rewrite_poetry_lock};
-    let locks: Vec<(&String, &String)> = files
-        .iter()
-        .filter(|(path, _)| path.as_str() == "poetry.lock" || path.ends_with("/poetry.lock"))
-        .collect();
-    if locks.is_empty() {
-        return;
-    }
-    // Intake gate ONCE per dep, not once per lock file (uv parity).
-    let mut usable: Vec<(&DepOverride, &str)> = Vec::new();
-    for dep in overrides.iter().filter(|dep| dep.ecosystem == "pypi") {
-        result.python_lock_uuids.insert(dep.patch_uuid.clone());
-        match dep.integrity.sha256.as_deref() {
-            Some(sha256) => usable.push((dep, sha256)),
-            None => result.warnings.push(RewriteWarning {
-                code: "redirect_poetry_missing_sha256".into(),
-                detail: format!("{} has no SHA-256 integrity", dep.name),
-            }),
-        }
-    }
-    for (path, original) in locks {
-        let mut content = original.clone();
-        let mut stale_warned = false;
-        for &(dep, sha256) in &usable {
-            let filename = dep.artifact_url.rsplit('/').next().unwrap_or("");
-            match rewrite_poetry_lock(
-                &content,
-                &dep.name,
-                &dep.version,
-                "url",
-                &dep.artifact_url,
-                filename,
-                sha256,
-            ) {
-                Ok(Some(rewritten)) if rewritten != content => {
-                    match poetry_lock_edits(&content, &rewritten, &dep.name) {
-                        Ok(edits) => {
-                            for (original, new) in edits {
-                                result.edits.push(FileEdit {
-                                    path: path.clone(),
-                                    kind: "redirect_poetry_lock_package".into(),
-                                    action: "rewritten".into(),
-                                    key: Some(format!("{}@{}", dep.name, dep.version)),
-                                    original: Some(Value::String(original)),
-                                    new: Some(Value::String(new)),
-                                });
-                            }
-                        }
-                        Err(detail) => {
-                            result.refused_python_lock_uuids.insert(dep.patch_uuid.clone());
-                            result.warnings.push(RewriteWarning {
-                                code: "redirect_poetry_lock_unsupported".into(),
-                                detail: format!("{path}: {detail}"),
-                            });
-                            continue;
-                        }
-                    }
-                    result.confirmed_python_lock_uuids.insert(dep.patch_uuid.clone());
-                    content = rewritten;
-                    if !stale_warned {
-                        if let Some(format) = pre_1_4_writer(&content) {
-                            stale_warned = true;
-                            // Poetry 1.0 installs url sources through pip, which reads
-                            // the hash from the URL fragment; pip 22.3–23.0 take the
-                            // rest of the fragment (`&#egg=<name>`, appended by Poetry)
-                            // as part of the digest and refuse the install (measured;
-                            // pip <= 22.2 and >= 23.1 install and verify).
-                            let pip_note = if format == "1.0" {
-                                " Poetry 1.0 installs through pip: pip 22.3–23.0 misparse the \
-                                 hash fragment and refuse the install (fail-closed) — use pip \
-                                 <= 22.2 or >= 23.1 in the virtualenv."
-                            } else {
-                                ""
-                            };
-                            result.warnings.push(RewriteWarning {
-                                code: "redirect_poetry_stale_install_risk".into(),
-                                detail: format!(
-                                    "{path} was written by Poetry < 1.4, which does not replace \
-                                     an already-installed package at the same version: an \
-                                     existing virtualenv keeps the upstream {} until it is \
-                                     recreated (or the package is `pip uninstall`ed) before \
-                                     `poetry install`; fresh installs pick up the patched \
-                                     wheel.{pip_note}",
-                                    dep.name
-                                ),
-                            });
-                        }
-                    }
-                }
-                // Already redirected to this artifact (idempotent re-scan).
-                Ok(Some(_)) => {
-                    result.confirmed_python_lock_uuids.insert(dep.patch_uuid.clone());
-                }
-                Ok(None) => result.warnings.push(RewriteWarning {
-                    code: "redirect_poetry_entry_not_found".into(),
-                    detail: format!("no {path} entry for {}@{}", dep.name, dep.version),
-                }),
-                Err(detail) => {
-                    result.refused_python_lock_uuids.insert(dep.patch_uuid.clone());
-                    result.warnings.push(RewriteWarning {
-                        code: "redirect_poetry_lock_unsupported".into(),
-                        detail: format!("{path}: {detail}"),
-                    });
-                }
-            }
-        }
-        if content != *original {
-            result.files.insert(path.clone(), content);
-        }
-    }
-}
-
 #[cfg(test)]
 mod equivalence_tests {
     use super::*;
@@ -357,10 +236,14 @@ mod equivalence_tests {
     }
 
     /// Every lock generation, LF and CRLF, in two lock files, then again over
-    /// the rewritten output (the idempotent re-scan): the production
-    /// rewriter's files, edits, warnings and uuid sets equal the oracle's.
+    /// the rewritten output (the idempotent re-scan): the rewriter's files,
+    /// edits, warnings and uuid sets, pinned by golden.
     #[test]
-    fn rewrite_matches_reference_on_every_lock_generation() {
+    fn rewrite_matches_golden_on_every_lock_generation() {
+        let mut g = crate::golden::Golden::new(
+            "poetry_rewrite",
+            "One grown poetry.lock pair and its deps, rewritten, then re-run over the result.",
+        );
         for version in VERSIONS {
             for extra in [0, 3] {
                 for crlf in [false, true] {
@@ -375,21 +258,20 @@ mod equivalence_tests {
                     ]);
                     let deps = overrides(extra);
                     let what = format!("{version} extra={extra} crlf={crlf}");
-                    let want = run(rewrite_poetry_reference, &files, &deps);
                     let got = run(rewrite_poetry, &files, &deps);
-                    assert_eq!(format!("{got:?}"), format!("{want:?}"), "{what}");
+                    g.case(&what, &(&files, &deps), &format!("{got:?}"));
                     assert!(
-                        version.starts_with("0.") || !want.edits.is_empty(),
+                        version.starts_with("0.") || !got.edits.is_empty(),
                         "{what}: the corpus exercises the rewrite path"
                     );
 
                     let mut again = files.clone();
-                    again.extend(want.files.clone());
-                    let want = run(rewrite_poetry_reference, &again, &deps);
+                    again.extend(got.files.clone());
                     let got = run(rewrite_poetry, &again, &deps);
-                    assert_eq!(format!("{got:?}"), format!("{want:?}"), "{what} re-run");
+                    g.case(format!("{what}/re-run"), &(&again, &deps), &format!("{got:?}"));
                 }
             }
         }
+        g.finish();
     }
 }
diff --git a/crates/socket-patch-core/src/patch/redirect/python_lock_equivalence_tests.rs b/crates/socket-patch-core/src/patch/redirect/python_lock_equivalence_tests.rs
index d1691c02..b1ca98a0 100644
--- a/crates/socket-patch-core/src/patch/redirect/python_lock_equivalence_tests.rs
+++ b/crates/socket-patch-core/src/patch/redirect/python_lock_equivalence_tests.rs
@@ -1,183 +1,28 @@
-//! Equivalence oracle for the hosted uv.lock / pylock / PEP 723 rewriter,
-//! which now parses each lock once and plans, applies and completes every
-//! dep against that one document. The previous implementation (three parses
-//! and two renders per dep) is kept here verbatim, over the verbatim text
-//! rewriters in `utils::python_lock::oracle`, and the production rewriter
-//! must produce the identical output bytes, FileEdit list, warnings and
-//! confirmed / refused sets on randomized locks — including CRLF and
-//! mixed-ending locks, refusals in the middle of the dep list, duplicate
-//! overrides and metadata completion.
+//! Seeded uv.lock / pylock / PEP 723 sweep for the hosted rewriter, which
+//! parses each lock once and plans, applies and completes every dep against
+//! that one document: CRLF and mixed-ending locks, refusals in the middle of
+//! the dep list, duplicate overrides and metadata completion. Output bytes,
+//! FileEdits, warnings and confirmed / refused sets are pinned per case by
+//! `tests/equivalence/python_lock_*.golden`, blessed while the previous
+//! rewriter (three parses and two renders per dep) still ran beside it as
+//! an oracle.
 
 use super::*;
-use crate::utils::python_lock::oracle;
+use crate::golden::{record, Golden, Sweep};
+use crate::test_rng::Rng;
 
-/// `rewrite_uv_lock` before the single-parse session, verbatim except for
-/// the two text rewriters, which are their verbatim oracles.
-fn rewrite_uv_lock_oracle(
-    files: &BTreeMap<String, String>,
-    overrides: &[DepOverride],
-    python_metadata: &BTreeMap<String, String>,
-    result: &mut RewriteResult,
-) {
-    use crate::utils::python_lock::{is_python_lock_name, ArtifactSource};
-    use oracle::{complete_python_lock_metadata, rewrite_python_lock};
-
-    let locks: Vec<(&String, &String)> = files
-        .iter()
-        .filter(|(path, _)| is_python_lock_name(path))
-        .collect();
-    if locks.is_empty() {
-        return;
-    }
-    let mut usable: Vec<(&DepOverride, &str)> = Vec::new();
-    for dep in overrides.iter().filter(|dep| dep.ecosystem == "pypi") {
-        result.python_lock_uuids.insert(dep.patch_uuid.clone());
-        match dep.integrity.sha256.as_deref() {
-            Some(sha256) => usable.push((dep, sha256)),
-            None => result.warnings.push(RewriteWarning {
-                code: "redirect_uv_missing_sha256".into(),
-                detail: format!("{} has no sha256 integrity", dep.name),
-            }),
-        }
-    }
-    for (path, original) in locks {
-        let mut content = original.clone();
-        for &(dep, sha256) in &usable {
-            let rewritten = match rewrite_python_lock(
-                &content,
-                &dep.name,
-                &dep.version,
-                ArtifactSource::Url(&dep.artifact_url),
-                sha256,
-            ) {
-                Ok(Some(rewritten)) => rewritten,
-                Ok(None) => {
-                    result.warnings.push(RewriteWarning {
-                        code: "redirect_uv_entry_not_found".into(),
-                        detail: format!("no {path} archive entry for {}@{}", dep.name, dep.version),
-                    });
-                    continue;
-                }
-                Err(detail) => {
-                    result
-                        .refused_python_lock_uuids
-                        .insert(dep.patch_uuid.clone());
-                    result.warnings.push(RewriteWarning {
-                        code: "redirect_uv_lock_unsupported".into(),
-                        detail: format!("{path}: {detail}"),
-                    });
-                    continue;
-                }
-            };
-            let (metadata_edit, project) =
-                match plan_python_metadata(path, &content, files, dep, result) {
-                    Ok(plan) => plan,
-                    Err(warning) => {
-                        result
-                            .refused_python_lock_uuids
-                            .insert(dep.patch_uuid.clone());
-                        result.warnings.push(warning);
-                        continue;
-                    }
-                };
-            let rewritten = match complete_python_lock_metadata(
-                &rewritten,
-                project.as_deref(),
-                &dep.name,
-                &dep.version,
-                ArtifactSource::Url(&dep.artifact_url),
-                python_metadata.get(&dep.artifact_url).map(String::as_str),
-            ) {
-                Ok(rewritten) => rewritten,
-                Err(detail) => {
-                    result
-                        .refused_python_lock_uuids
-                        .insert(dep.patch_uuid.clone());
-                    result.warnings.push(RewriteWarning {
-                        code: "redirect_uv_metadata_unsupported".into(),
-                        detail: format!("{path}: {detail}"),
-                    });
-                    continue;
-                }
-            };
-            result
-                .confirmed_python_lock_uuids
-                .insert(dep.patch_uuid.clone());
-            if let Some(edit) = metadata_edit {
-                record_python_metadata_edit(edit, dep, result);
-            }
-            if rewritten != content {
-                record_python_lock_edits(path, dep, &content, &rewritten, result);
-                content = rewritten;
-            }
-        }
-        if content != *original {
-            result.files.insert(path.clone(), content);
-        }
-    }
-}
-
-fn assert_same(want: &RewriteResult, got: &RewriteResult, what: &str) {
-    assert_eq!(got.files, want.files, "{what}: rewritten bytes");
-    assert_eq!(got.edits.len(), want.edits.len(), "{what}: edit count");
-    for (i, (g, w)) in got.edits.iter().zip(&want.edits).enumerate() {
-        assert_eq!(g, w, "{what}: edit #{i}");
-    }
-    let warnings = |r: &RewriteResult| {
-        r.warnings
-            .iter()
-            .map(|w| (w.code.clone(), w.detail.clone()))
-            .collect::<Vec<_>>()
-    };
-    assert_eq!(warnings(got), warnings(want), "{what}: warnings in order");
-    assert_eq!(got.python_lock_uuids, want.python_lock_uuids, "{what}");
-    assert_eq!(
-        got.confirmed_python_lock_uuids, want.confirmed_python_lock_uuids,
-        "{what}: confirmed"
-    );
-    assert_eq!(
-        got.refused_python_lock_uuids, want.refused_python_lock_uuids,
-        "{what}: refused"
-    );
-}
-
-fn run_both(
+/// The production rewriter, recorded into the running sweep.
+fn run(
     files: &BTreeMap<String, String>,
     overrides: &[DepOverride],
     metadata: &BTreeMap<String, String>,
-    what: &str,
 ) -> RewriteResult {
-    let mut want = RewriteResult::default();
-    rewrite_uv_lock_oracle(files, overrides, metadata, &mut want);
     let mut got = RewriteResult::default();
     rewrite_uv_lock(files, overrides, metadata, &mut got);
-    assert_same(&want, &got, what);
+    record(&(files, overrides, metadata), &got);
     got
 }
 
-/// Deterministic xorshift64* — no `rand` dev-dependency.
-struct Rng(u64);
-
-impl Rng {
-    fn next(&mut self) -> u64 {
-        let mut x = self.0;
-        x ^= x >> 12;
-        x ^= x << 25;
-        x ^= x >> 27;
-        self.0 = x;
-        x.wrapping_mul(0x2545_F491_4F6C_DD1D)
-    }
-    fn below(&mut self, n: usize) -> usize {
-        (self.next() % n as u64) as usize
-    }
-    fn chance(&mut self, percent: u64) -> bool {
-        self.next() % 100 < percent
-    }
-    fn pick<'a>(&mut self, items: &[&'a str]) -> &'a str {
-        items[self.below(items.len())]
-    }
-}
-
 const HEX: &str = "ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6";
 
 /// A spelling of `pkg-<i>` that canonicalizes back to it.
@@ -518,7 +363,7 @@ type Case = (
 );
 
 fn case(seed: u64) -> Case {
-    let mut rng = Rng(seed.wrapping_mul(0x9E37_79B9_7F4A_7C15) | 1);
+    let mut rng = Rng::new(seed);
     let pool = 4 + rng.below(10);
     let mut files = BTreeMap::new();
     let mut any = false;
@@ -582,19 +427,26 @@ fn case(seed: u64) -> Case {
 }
 
 #[test]
-fn single_parse_uv_rewrite_matches_oracle() {
+fn single_parse_uv_rewrite_matches_golden() {
+    let sweep = Sweep::with(
+        Golden::new(
+            "python_lock_rewrite",
+            "One seeded uv / pylock / PEP 723 lock set + overrides + wheel metadata.",
+        )
+        .chunked(5),
+    );
     let mut rewritten = 0;
     let mut edits = 0;
     let mut codes = std::collections::BTreeSet::new();
     for seed in 1..=1500u64 {
         let (files, overrides, metadata) = case(seed);
-        let got = run_both(&files, &overrides, &metadata, &format!("seed {seed}"));
+        let got = run(&files, &overrides, &metadata);
         rewritten += got.files.len();
         edits += got.edits.len();
         codes.extend(got.warnings.iter().map(|w| w.code.clone()));
     }
     // The generator must actually reach the rewrite paths and every refusal,
-    // or the oracle compares nothing.
+    // or the golden pins nothing.
     assert!(rewritten > 300, "only {rewritten} rewritten files");
     assert!(edits > 1000, "only {edits} edits");
     for code in [
@@ -608,12 +460,17 @@ fn single_parse_uv_rewrite_matches_oracle() {
     ] {
         assert!(codes.contains(code), "no case reached {code}: {codes:?}");
     }
+    sweep.finish();
 }
 
 /// A refusal between two rewritten deps must leave the lock exactly as the
 /// first dep left it — the session decides every refusal before mutating.
 #[test]
 fn refusal_in_the_middle_leaves_the_prior_rewrite_intact() {
+    let sweep = Sweep::start(
+        "python_lock_refusal",
+        "A uv.lock + pyproject.toml whose middle dep is refused, LF and CRLF.",
+    );
     let lock = "version = 1\nrevision = 3\n\n[[package]]\nname = \"app\"\nversion = \"0.1.0\"\nsource = { virtual = \".\" }\ndependencies = [{ name = \"a\" }, { name = \"b\" }, { name = \"c\" }]\n\n[package.metadata]\nrequires-dist = [{ name = \"a\" }, { name = \"b\" }, { name = \"c\" }]\n\n[[package]]\nname = \"a\"\nversion = \"1.0.0\"\nsource = { registry = \"https://pypi.org/simple\" }\nwheels = [{ url = \"https://files.pythonhosted.org/a-1.0.0-py3-none-any.whl\", hash = \"sha256:00\" }]\n\n[[package]]\nname = \"b\"\nversion = \"1.0.0\"\nsource = { registry = \"https://pypi.org/simple\" }\nwheels = [{ url = \"https://files.pythonhosted.org/b-1.0.0-py3-none-any.whl\", hash = \"sha256:00\" }]\n\n[[package]]\nname = \"c\"\nversion = \"1.0.0\"\nsource = { registry = \"https://pypi.org/simple\" }\nwheels = [{ url = \"https://files.pythonhosted.org/c-1.0.0-py3-none-any.whl\", hash = \"sha256:00\" }]\n";
     let project = "[project]\nname = \"app\"\nversion = \"0.1.0\"\ndependencies = [\"a\", \"b\", \"c\"]\n\n[tool.uv]\noverride-dependencies = [\"b==1.0.0\"]\n";
     let mk = |name: &str, n: usize| DepOverride {
@@ -641,7 +498,7 @@ fn refusal_in_the_middle_leaves_the_prior_rewrite_intact() {
         // b's wheel metadata is unparseable: b is refused after a is applied.
         let mut metadata = BTreeMap::new();
         metadata.insert(overrides[1].artifact_url.clone(), "[broken".to_string());
-        let got = run_both(&files, &overrides, &metadata, "b refused");
+        let got = run(&files, &overrides, &metadata);
         assert!(got
             .refused_python_lock_uuids
             .contains(&overrides[1].patch_uuid));
@@ -663,71 +520,10 @@ fn refusal_in_the_middle_leaves_the_prior_rewrite_intact() {
             1,
         );
         files.insert("uv.lock".to_string(), with_manifest);
-        let got = run_both(&files, &overrides, &BTreeMap::new(), "bad overrides");
+        let got = run(&files, &overrides, &BTreeMap::new());
         assert!(got
             .refused_python_lock_uuids
             .contains(&overrides[1].patch_uuid));
     }
-}
-
-/// Runs the oracle over the benchmark fixtures (real ~1.9 MB uv,
-/// pylock and PEP 723 locks, too large to commit) when
-/// `SOCKET_PATCH_PY_LOCK_FIXTURES` names their directory; a no-op otherwise.
-#[test]
-fn single_parse_uv_rewrite_matches_oracle_on_fixture_locks() {
-    let Some(root) = std::env::var_os("SOCKET_PATCH_PY_LOCK_FIXTURES") else {
-        return;
-    };
-    let root = std::path::PathBuf::from(root);
-    for (dir, lock, metadata_file) in [
-        ("uv-big", "uv.lock", Some("pyproject.toml")),
-        ("pylock-big", "pylock.toml", None),
-        ("script-big", "tool.py.lock", Some("tool.py")),
-    ] {
-        let read = |name: &str| std::fs::read_to_string(root.join(dir).join(name)).unwrap();
-        let text = read(lock);
-        let names: Vec<(String, String)> = {
-            let doc: toml_edit::DocumentMut = text.parse().unwrap();
-            let collection = if lock == "pylock.toml" {
-                "packages"
-            } else {
-                "package"
-            };
-            doc[collection]
-                .as_array_of_tables()
-                .unwrap()
-                .iter()
-                .filter_map(|t| {
-                    Some((
-                        t.get("name")?.as_str()?.to_string(),
-                        t.get("version")?.as_str()?.to_string(),
-                    ))
-                })
-                .collect()
-        };
-        for crlf in [false, true] {
-            let conv = |s: String| if crlf { s.replace('\n', "\r\n") } else { s };
-            let mut files = BTreeMap::new();
-            files.insert(lock.to_string(), conv(text.clone()));
-            if let Some(m) = metadata_file {
-                files.insert(m.to_string(), conv(read(m)));
-            }
-            let mut rng = Rng(0x5eed + crlf as u64);
-            let mut overrides = Vec::new();
-            let mut metadata = BTreeMap::new();
-            for (n, (name, version)) in names.iter().step_by(29).enumerate() {
-                let mut d = dep(0, version, n, &mut rng);
-                d.ecosystem = "pypi".into();
-                d.name = name.clone();
-                d.artifact_url =
-                    format!("https://patch.socket.dev/patch/{n}/{name}-{version}-py3-none-any.whl");
-                if n % 3 == 0 {
-                    metadata.insert(d.artifact_url.clone(), wheel_metadata(&mut rng, 5));
-                }
-                overrides.push(d);
-            }
-            let got = run_both(&files, &overrides, &metadata, &format!("{dir} crlf={crlf}"));
-            assert!(!got.edits.is_empty(), "{dir}: nothing rewritten");
-        }
-    }
+    sweep.finish();
 }
diff --git a/crates/socket-patch-core/src/patch/redirect/rewrite_oracle_support.rs b/crates/socket-patch-core/src/patch/redirect/rewrite_oracle_support.rs
deleted file mode 100644
index c5084166..00000000
--- a/crates/socket-patch-core/src/patch/redirect/rewrite_oracle_support.rs
+++ /dev/null
@@ -1,125 +0,0 @@
-//! Shared support for the hosted rewriters' equivalence oracles.
-//!
-//! One deterministic RNG and ONE snapshot, so the two sweeps cannot drift
-//! apart: the snapshot covers every `RewriteResult` channel, not only the
-//! ones a particular rewriter is known to touch, so a rewriter that starts
-//! writing a new channel is compared there from the first run.
-
-use super::*;
-
-/// Deterministic xorshift64* — no `rand` dev-dependency.
-pub(super) struct Rng(pub u64);
-
-impl Rng {
-    pub(super) fn next(&mut self) -> u64 {
-        let mut x = self.0;
-        x ^= x >> 12;
-        x ^= x << 25;
-        x ^= x >> 27;
-        self.0 = x;
-        x.wrapping_mul(0x2545_F491_4F6C_DD1D)
-    }
-    pub(super) fn below(&mut self, n: usize) -> usize {
-        (self.next() % n as u64) as usize
-    }
-    pub(super) fn chance(&mut self, percent: u64) -> bool {
-        self.next() % 100 < percent
-    }
-}
-
-/// The uuid sets, each under its field name so a mismatch says which.
-type UuidSets = Vec<(&'static str, std::collections::BTreeSet<String>)>;
-
-/// Every output channel of a [`RewriteResult`], in a comparable shape.
-pub(super) struct Snapshot {
-    files: BTreeMap<String, String>,
-    binary_files: BTreeMap<String, Vec<u8>>,
-    edits: Vec<FileEdit>,
-    warnings: Vec<(String, String)>,
-    uuids: UuidSets,
-}
-
-pub(super) fn snapshot(r: &RewriteResult) -> Snapshot {
-    Snapshot {
-        files: r.files.clone(),
-        binary_files: r.binary_files.clone(),
-        edits: r.edits.clone(),
-        warnings: r
-            .warnings
-            .iter()
-            .map(|w| (w.code.clone(), w.detail.clone()))
-            .collect(),
-        uuids: vec![
-            (
-                "confirmed_bun_binary_uuids",
-                r.confirmed_bun_binary_uuids.clone(),
-            ),
-            ("confirmed_cargo_uuids", r.confirmed_cargo_uuids.clone()),
-            ("confirmed_pipenv_uuids", r.confirmed_pipenv_uuids.clone()),
-            ("refused_pipenv_uuids", r.refused_pipenv_uuids.clone()),
-            ("confirmed_pdm_uuids", r.confirmed_pdm_uuids.clone()),
-            ("refused_pdm_uuids", r.refused_pdm_uuids.clone()),
-            ("refused_pnpm_uuids", r.refused_pnpm_uuids.clone()),
-            ("python_lock_uuids", r.python_lock_uuids.clone()),
-            (
-                "confirmed_python_lock_uuids",
-                r.confirmed_python_lock_uuids.clone(),
-            ),
-            (
-                "refused_python_lock_uuids",
-                r.refused_python_lock_uuids.clone(),
-            ),
-            ("hatch_uuids", r.hatch_uuids.clone()),
-            ("confirmed_hatch_uuids", r.confirmed_hatch_uuids.clone()),
-            (
-                "confirmed_requirements_uuids",
-                r.confirmed_requirements_uuids.clone(),
-            ),
-        ],
-    }
-}
-
-/// Assert the production rewriter's `got` equals the oracle's `want` on
-/// every channel, naming the first file byte / edit / set that differs.
-pub(super) fn assert_same(want: &RewriteResult, got: &RewriteResult, what: &str) {
-    let (want, got) = (snapshot(want), snapshot(got));
-    for (path, want_text) in &want.files {
-        let got_text = got.files.get(path);
-        assert!(
-            got_text == Some(want_text),
-            "{what}: rewritten bytes differ for {path} (first diff at byte {:?})",
-            got_text.map(|g| g
-                .bytes()
-                .zip(want_text.bytes())
-                .position(|(a, b)| a != b)
-                .unwrap_or(g.len().min(want_text.len())))
-        );
-    }
-    assert_eq!(
-        got.files.keys().collect::<Vec<_>>(),
-        want.files.keys().collect::<Vec<_>>(),
-        "{what}: rewritten file set"
-    );
-    assert_eq!(
-        got.binary_files.keys().collect::<Vec<_>>(),
-        want.binary_files.keys().collect::<Vec<_>>(),
-        "{what}: rewritten binary file set"
-    );
-    for (path, want_bytes) in &want.binary_files {
-        assert!(
-            got.binary_files.get(path) == Some(want_bytes),
-            "{what}: rewritten bytes differ for binary {path}"
-        );
-    }
-    assert_eq!(got.edits.len(), want.edits.len(), "{what}: edit count");
-    for (i, (g, w)) in got.edits.iter().zip(&want.edits).enumerate() {
-        assert_eq!(g, w, "{what}: edit #{i}");
-    }
-    assert_eq!(
-        got.warnings, want.warnings,
-        "{what}: warnings (code, detail) in order"
-    );
-    for ((field, got_set), (_, want_set)) in got.uuids.iter().zip(&want.uuids) {
-        assert_eq!(got_set, want_set, "{what}: {field}");
-    }
-}
diff --git a/crates/socket-patch-core/src/test_rng.rs b/crates/socket-patch-core/src/test_rng.rs
new file mode 100644
index 00000000..876c54db
--- /dev/null
+++ b/crates/socket-patch-core/src/test_rng.rs
@@ -0,0 +1,35 @@
+//! The one deterministic RNG the randomized tests share (no `rand`
+//! dev-dependency). Every generator seeds it the way its inputs were first
+//! drawn, so the golden snapshots in `tests/equivalence/` keep
+//! replaying the exact same cases.
+
+/// xorshift64*.
+pub(crate) struct Rng(pub(crate) u64);
+
+impl Rng {
+    /// Seed from a small counter, mixing it so seeds 0, 1, 2… diverge at once.
+    pub(crate) fn new(seed: u64) -> Self {
+        Self(seed.wrapping_mul(0x9E37_79B9_7F4A_7C15) | 1)
+    }
+
+    pub(crate) fn next(&mut self) -> u64 {
+        let mut x = self.0;
+        x ^= x >> 12;
+        x ^= x << 25;
+        x ^= x >> 27;
+        self.0 = x;
+        x.wrapping_mul(0x2545_F491_4F6C_DD1D)
+    }
+
+    pub(crate) fn below(&mut self, n: usize) -> usize {
+        (self.next() % n as u64) as usize
+    }
+
+    pub(crate) fn chance(&mut self, percent: u64) -> bool {
+        self.next() % 100 < percent
+    }
+
+    pub(crate) fn pick<'a>(&mut self, items: &[&'a str]) -> &'a str {
+        items[self.below(items.len())]
+    }
+}
diff --git a/crates/socket-patch-core/src/utils/pdm_lock.rs b/crates/socket-patch-core/src/utils/pdm_lock.rs
index dab934e0..2e761d22 100644
--- a/crates/socket-patch-core/src/utils/pdm_lock.rs
+++ b/crates/socket-patch-core/src/utils/pdm_lock.rs
@@ -866,167 +866,10 @@ mod tests {
 
 #[cfg(test)]
 pub(crate) mod parse_reuse_tests {
-    //! Shared by the pdm parse-reuse oracles: the previous
-    //! [`rewrite_pdm_lock_with_edits`], kept verbatim, and the native
-    //! fixtures grown to several packages.
+    //! Shared by the pdm parse-reuse sweeps: the native fixtures grown to
+    //! several packages, and the dep steps rewritten over them.
     use super::*;
 
-    pub(crate) fn rewrite_pdm_lock_with_edits_oracle<'a>(
-        text: &'a str,
-        name: &'a str,
-        version: &str,
-        source: (&str, &str),
-        filename: &str,
-        sha256: &str,
-    ) -> Result<PdmLockRewrite<'a>, String> {
-        let (kind, location) = source;
-        if !matches!(kind, "url" | "path")
-            || sha256.len() != 64
-            || !sha256.bytes().all(|byte| byte.is_ascii_hexdigit())
-        {
-            return Err("invalid PDM artifact source or SHA-256".into());
-        }
-        if !wheel_matches(filename, name, version) {
-            return Err("PDM patch wheel does not match package".into());
-        }
-        let mut lock: DocumentMut = text.parse().map_err(|e| format!("invalid PDM lock: {e}"))?;
-        lock_version(&lock)?;
-        validate_strategy(&lock)?;
-        let packages = lock
-            .get("package")
-            .and_then(Item::as_array_of_tables)
-            .ok_or("missing PDM packages")?;
-        let indices: Vec<_> = packages
-            .iter()
-            .enumerate()
-            .filter(|(_, package)| {
-                package
-                    .get("name")
-                    .and_then(Item::as_str)
-                    .is_some_and(|candidate| {
-                        canonicalize_pypi_name(candidate) == canonicalize_pypi_name(name)
-                    })
-            })
-            .map(|(index, _)| index)
-            .collect();
-        if indices.is_empty() {
-            return Err("missing PDM package".into());
-        }
-        // A marker/multi-target lock (PDM >= 2.17 `pdm lock --append`) can carry the
-        // same package at several versions, one per resolution fork. A single
-        // surgical rewrite would patch one fork and leave the others pinned to the
-        // registry, so refuse the whole lock ahead of the per-unit version check —
-        // the target version IS present, so the plain "version differs" below would
-        // misdirect the user to re-lock.
-        let locked_versions: std::collections::BTreeSet<&str> = indices
-            .iter()
-            .filter_map(|&index| packages.get(index)?.get("version").and_then(Item::as_str))
-            .collect();
-        if locked_versions.len() > 1 {
-            return Err(
-                "PDM lock resolves this package at multiple versions (a marker or \
-                        multi-target fork); patching one fork would leave the others unpatched"
-                    .into(),
-            );
-        }
-        let mut variants = std::collections::BTreeSet::new();
-        let mut edits = Vec::new();
-        for index in indices {
-            let package = packages.get(index).ok_or("missing PDM package")?;
-            if package.get("version").and_then(Item::as_str) != Some(version) {
-                return Err("PDM locked version differs from installed version".into());
-            }
-            let mut extras = Vec::new();
-            if let Some(value) = package.get("extras") {
-                for extra in value.as_array().ok_or("invalid PDM extras")? {
-                    extras.push(extra.as_str().ok_or("invalid PDM extra")?.to_string());
-                }
-            }
-            extras.sort();
-            if !variants.insert(extras) {
-                return Err("forked PDM package".into());
-            }
-            for field in [
-                "url", "path", "git", "hg", "svn", "bzr", "editable", "source",
-            ] {
-                if let Some(existing) = package.get(field) {
-                    let same_target = field == kind && existing.as_str() == Some(location);
-                    // A prior socket-hosted `url` (rotated grant token or a
-                    // superseded patch uuid — same origin and wheel leaf) is taken
-                    // over in place; foreign urls and every other source refuse.
-                    let prior_hosted = field == kind
-                        && kind == "url"
-                        && existing
-                            .as_str()
-                            .is_some_and(|existing| is_prior_hosted_url(existing, location));
-                    if !same_target && !prior_hosted {
-                        return Err(format!("refusing existing PDM {field} source"));
-                    }
-                }
-            }
-            let original_files = files_for(&lock, package).ok_or("missing PDM file hashes")?;
-            if original_files.is_empty()
-                || original_files.iter().any(|file| {
-                    !file
-                        .as_inline_table()
-                        .and_then(|file| file.get("hash"))
-                        .and_then(Value::as_str)
-                        .is_some_and(|hash| {
-                            hash.strip_prefix("sha256:").is_some_and(|hex| {
-                                hex.len() == 64 && hex.bytes().all(|byte| byte.is_ascii_hexdigit())
-                            })
-                        })
-                })
-            {
-                return Err("invalid PDM file hashes".into());
-            }
-            let files_key = legacy_files_key(package).ok_or("missing PDM files key")?;
-            edits.push((index, package.contains_key("files"), files_key));
-        }
-        for (index, inline_files, files_key) in edits {
-            let mut file = InlineTable::new();
-            file.insert("file", Value::from(filename));
-            file.insert(
-                "hash",
-                Value::from(format!("sha256:{}", sha256.to_ascii_lowercase())),
-            );
-            let mut files = Array::new();
-            files.push(file);
-            let package = lock
-                .get_mut("package")
-                .and_then(Item::as_array_of_tables_mut)
-                .and_then(|packages| packages.get_mut(index))
-                .ok_or("missing PDM package")?;
-            package.insert(kind, value(location));
-            if inline_files {
-                package.insert("files", value(files));
-            } else {
-                let table = lock
-                    .get_mut("metadata")
-                    .and_then(|metadata| metadata.get_mut("files"))
-                    .and_then(Item::as_table_like_mut)
-                    .ok_or("missing PDM metadata.files")?;
-                table.insert(&files_key, value(files));
-            }
-        }
-        let rendered = preserve_line_endings(text, lock.to_string());
-        let before = pdm_lock_fragments(text, name)?;
-        let after = pdm_lock_fragments(&rendered, name)?;
-        let edits = pair_pdm_lock_fragments(text, &before, &rendered, after)?;
-        let mut result = text.to_string();
-        for (old, new) in &edits {
-            result = result.replacen(old, new, 1);
-        }
-        let known_edits = (result == rendered).then_some(edits);
-        Ok(PdmLockRewrite {
-            text: result,
-            original: text,
-            name,
-            before,
-            known_edits,
-        })
-    }
-
     /// Every native pdm lock generation in `tests/fixtures/pdm-native`.
     pub(crate) fn fixtures() -> Vec<(String, String)> {
         let dir =
@@ -1156,49 +999,41 @@ pub(crate) mod parse_reuse_tests {
     }
 
     #[test]
-    fn reused_parse_matches_the_fresh_parse_rewrite() {
+    fn reused_parse_matches_golden() {
+        let mut golden = crate::golden::Golden::new(
+            "pdm_lock_reused_parse",
+            "One rewrite step over a grown pdm.lock: the text and edits, or the refusal.",
+        );
         let mut landed = 0;
-        for (fixture, lock) in fixtures() {
+        for (_, lock) in fixtures() {
             for extra in [0, 3] {
                 for crlf in [false, true] {
                     let mut lock = grown(&lock.replace("\r\n", "\n"), extra);
                     if crlf {
                         lock = lock.replace('\n', "\r\n");
                     }
-                    let (mut want_text, mut got_text) = (lock.clone(), lock);
+                    let mut got_text = lock;
                     let mut parse = PdmLockParse::default();
-                    for (i, (name, version, (kind, location), sha)) in
-                        steps(extra).iter().enumerate()
-                    {
-                        let what = format!("{fixture} extra={extra} crlf={crlf} step {i}");
+                    for (name, version, (kind, location), sha) in steps(extra).iter() {
                         let filename = location.rsplit('/').next().unwrap();
                         let source = (kind.as_str(), location.as_str());
-                        let want = rewrite_pdm_lock_with_edits_oracle(
-                            &want_text, name, version, source, filename, sha,
-                        );
                         let got = rewrite_pdm_lock_in(
                             &mut parse, &got_text, name, version, source, filename, sha,
                         );
-                        match (want, got) {
-                            (Err(w), Err(g)) => assert_eq!(g, w, "{what}"),
-                            (Ok(w), Ok(g)) => {
-                                assert_eq!(g.text, w.text, "{what}: text");
-                                assert_eq!(g.edits(), w.edits(), "{what}: edits");
-                                landed += 1;
-                                want_text = w.text;
-                                got_text = g.text;
-                            }
-                            (w, g) => panic!(
-                                "{what}: verdicts differ: {:?} vs {:?}",
-                                w.map(|r| r.text),
-                                g.map(|r| r.text)
-                            ),
+                        golden.next(
+                            &(&got_text, name, version, kind, location, sha),
+                            &format!("{:?}", got.as_ref().map(|r| (&r.text, r.edits()))),
+                        );
+                        if let Ok(g) = got {
+                            landed += 1;
+                            got_text = g.text;
                         }
                     }
                 }
             }
         }
         assert!(landed > 100, "only {landed} rewrites landed");
+        golden.finish();
     }
 
     /// A parse is reused only for byte-identical text.
diff --git a/crates/socket-patch-core/src/utils/poetry_lock.rs b/crates/socket-patch-core/src/utils/poetry_lock.rs
index 6d1b76d1..fc223302 100644
--- a/crates/socket-patch-core/src/utils/poetry_lock.rs
+++ b/crates/socket-patch-core/src/utils/poetry_lock.rs
@@ -896,174 +896,12 @@ mod tests {
 #[cfg(test)]
 mod parse_reuse_equivalence_tests {
     //! The single-parse rewrite ([`rewrite_poetry_lock_in`], reusing the
-    //! previous rewrite's parsed output) against the previous
-    //! [`rewrite_poetry_lock_with_edits`], kept verbatim: identical verdicts,
-    //! texts and edits at every step of a dep sequence, on every lock
-    //! generation, LF and CRLF, with refusals and re-runs in between.
+    //! previous rewrite's parsed output): verdicts, texts and edits at every
+    //! step of a dep sequence, on every lock generation, LF and CRLF, with
+    //! refusals and re-runs in between, pinned by golden (blessed against
+    //! #257's fresh-parse rewrite).
     use super::*;
 
-    fn rewrite_poetry_lock_with_edits_oracle<'a>(
-        text: &'a str,
-        name: &'a str,
-        version: &str,
-        source_type: &str,
-        source_url: &str,
-        filename: &str,
-        sha256: &str,
-    ) -> Result<Option<PoetryLockRewrite<'a>>, String> {
-        if !matches!(source_type, "file" | "url")
-            || sha256.len() != 64
-            || !sha256.bytes().all(|byte| byte.is_ascii_hexdigit())
-        {
-            return Err("invalid Poetry artifact source or SHA-256".into());
-        }
-        // Poetry compares the lock's `sha256:<hex>` against `hashlib`'s lowercase
-        // hexdigest as strings, so an uppercase digest would fail every install.
-        let sha256 = sha256.to_ascii_lowercase();
-        if filename.contains(['/', '\\']) || !filename.ends_with(".whl") {
-            return Err("Poetry patch wheel does not match the locked package".into());
-        }
-        let parts: Vec<_> = filename.split('-').collect();
-        if !matches!(parts.len(), 5 | 6)
-            || canonicalize_pypi_name(parts[0]) != canonicalize_pypi_name(name)
-            || parts[1] != version
-        {
-            return Err("Poetry patch wheel does not match the locked package".into());
-        }
-        let mut lock: DocumentMut = text
-            .parse()
-            .map_err(|e| format!("invalid Poetry lock: {e}"))?;
-        let format = lock_version(&lock)?.to_string();
-        if format == "0" && source_type == "url" {
-            return Err(
-                "Poetry 0.x ignores URL sources; hosted patches require Poetry >= 1.0".into(),
-            );
-        }
-        let effective_url = if format == "1.0" && source_type == "url" {
-            // Poetry 1.0 hands pip `<url>#egg=<name>` unconditionally; the trailing
-            // `&` keeps `sha256=<hex>` a complete fragment parameter when `#egg=`
-            // is appended (pip >= 22 would otherwise read `<hex>#egg=<name>` as the
-            // digest and hard-fail the install).
-            format!("{source_url}#sha256={sha256}&")
-        } else {
-            source_url.to_string()
-        };
-        let packages = lock
-            .get_mut("package")
-            .and_then(Item::as_array_of_tables_mut)
-            .ok_or("missing Poetry packages")?;
-        let indices: Vec<_> = packages
-            .iter()
-            .enumerate()
-            .filter(|(_, package)| {
-                package
-                    .get("name")
-                    .and_then(Item::as_str)
-                    .is_some_and(|candidate| {
-                        canonicalize_pypi_name(candidate) == canonicalize_pypi_name(name)
-                    })
-            })
-            .map(|(index, _)| index)
-            .collect();
-        if indices.is_empty() {
-            return Ok(None);
-        }
-        if indices.len() != 1 {
-            return Err("forked Poetry package requires an unambiguous source".into());
-        }
-        let package = packages
-            .get_mut(indices[0])
-            .ok_or("missing Poetry package")?;
-        if package.get("version").and_then(Item::as_str) != Some(version) {
-            return Ok(None);
-        }
-        let package_name = package
-            .get("name")
-            .and_then(Item::as_str)
-            .unwrap_or(name)
-            .to_string();
-        if let Some(source) = package.get("source") {
-            let existing_type = source.get("type").and_then(Item::as_str);
-            let existing_url = source.get("url").and_then(Item::as_str).unwrap_or("");
-            let same_target = existing_type == Some(source_type) && existing_url == effective_url;
-            let prior_hosted = source_type == "url"
-                && existing_type == Some("url")
-                && is_prior_hosted_url(existing_url, &effective_url);
-            if !same_target && !prior_hosted {
-                return Err(format!(
-                    "refusing to replace an existing Poetry source ({} {}) for {package_name}",
-                    existing_type.unwrap_or("unknown"),
-                    existing_url
-                ));
-            }
-        }
-        let mut entry = InlineTable::new();
-        entry.insert("file", Value::from(filename));
-        entry.insert("hash", Value::from(format!("sha256:{sha256}")));
-        let mut files = Array::new();
-        files.push(entry);
-        let mut source = Table::new();
-        source.insert("type", value(source_type));
-        source.insert("url", value(effective_url));
-        if matches!(format.as_str(), "0" | "1.0") {
-            // Poetry 0.12 / 1.0 read `source.reference` unconditionally (KeyError
-            // without it), even for archive sources.
-            source.insert("reference", value(""));
-        }
-        let rewritten = package.contains_key("source");
-        package.insert("source", Item::Table(source));
-        if matches!(format.as_str(), "1.0" | "1.1") && source_type == "url" {
-            // Poetry >= 1.2 verifies url sources against the package's own
-            // `files` (it never reads `metadata.files` hashes for them), Poetry
-            // 1.0/1.1 against `metadata.files` — write both so whichever installer
-            // consumes this legacy lock enforces the patched hash. Poetry 1.0/1.1
-            // ignore the extra package key (measured on 1.0.10; 1.2.2 rejects a
-            // tampered package `files` hash on a lock-1.0 file only when it is
-            // present).
-            package.insert("files", value(files.clone()));
-        }
-        if format.starts_with('2') {
-            package.insert("files", value(files));
-        } else {
-            let field = if format == "0" { "hashes" } else { "files" };
-            let table = lock
-                .get_mut("metadata")
-                .and_then(Item::as_table_like_mut)
-                .ok_or("missing Poetry lock metadata")?
-                .get_mut(field)
-                .ok_or_else(|| format!("missing Poetry integrity table [metadata.{field}]"))?
-                .as_table_like_mut()
-                .ok_or_else(|| format!("[metadata.{field}] is not a table"))?;
-            if format == "0" {
-                let mut hashes = Array::new();
-                hashes.push(sha256.as_str());
-                table.insert(&package_name, value(hashes));
-            } else {
-                let entry = legacy_files_entry(table, &package_name, files, rewritten);
-                table.insert(&package_name, entry);
-            }
-        }
-        let mut rewritten = lock.to_string();
-        if text.contains("\r\n") {
-            rewritten = rewritten.replace("\r\n", "\n").replace('\n', "\r\n");
-        }
-        let before = poetry_lock_fragments(text, name)?;
-        let after = poetry_lock_fragments(&rewritten, name)?;
-        let edits = pair_poetry_lock_fragments(text, &before, &rewritten, after)?;
-        let mut result = text.to_string();
-        for (original, replacement) in &edits {
-            result = result.replacen(original, replacement, 1);
-        }
-        let known_edits = (result == rewritten).then_some(edits);
-        Ok(Some(PoetryLockRewrite {
-            text: result,
-            original: text,
-            name,
-            before,
-            known_edits,
-        }))
-    }
-
     const VERSIONS: &[&str] = &[
         "0.12.17", "1.0.10", "1.1.15", "1.2.2", "1.3.2", "1.4.2", "1.5.1", "1.6.1", "1.7.1",
         "1.8.5", "2.0.1", "2.1.4", "2.2.1", "2.3.4", "2.4.3",
@@ -1136,7 +974,11 @@ mod parse_reuse_equivalence_tests {
     }
 
     #[test]
-    fn reused_parse_matches_the_fresh_parse_rewrite() {
+    fn reused_parse_matches_golden() {
+        let mut golden = crate::golden::Golden::new(
+            "poetry_lock_reused_parse",
+            "One rewrite step over a grown poetry.lock: the text and edits, none, or the refusal.",
+        );
         let mut landed = 0;
         for version in VERSIONS {
             for extra in [0, 2, 4] {
@@ -1145,20 +987,10 @@ mod parse_reuse_equivalence_tests {
                     if crlf {
                         lock = lock.replace('\n', "\r\n");
                     }
-                    let (mut want_text, mut got_text) = (lock.clone(), lock);
+                    let mut got_text = lock;
                     let mut parse = PoetryLockParse::default();
-                    for (i, (name, version, source_type, url)) in steps(extra).iter().enumerate() {
-                        let what = format!("{version} extra={extra} crlf={crlf} step {i}");
+                    for (name, version, source_type, url) in steps(extra).iter() {
                         let filename = url.rsplit('/').next().unwrap();
-                        let want = rewrite_poetry_lock_with_edits_oracle(
-                            &want_text,
-                            name,
-                            version,
-                            source_type,
-                            url,
-                            filename,
-                            SHA,
-                        );
                         let got = rewrite_poetry_lock_in(
                             &mut parse,
                             &got_text,
@@ -1169,27 +1001,24 @@ mod parse_reuse_equivalence_tests {
                             filename,
                             SHA,
                         );
-                        match (want, got) {
-                            (Err(w), Err(g)) => assert_eq!(g, w, "{what}"),
-                            (Ok(None), Ok(None)) => {}
-                            (Ok(Some(w)), Ok(Some(g))) => {
-                                assert_eq!(g.text, w.text, "{what}: text");
-                                assert_eq!(g.edits(), w.edits(), "{what}: edits");
-                                landed += 1;
-                                want_text = w.text;
-                                got_text = g.text;
-                            }
-                            (w, g) => panic!(
-                                "{what}: verdicts differ: {:?} vs {:?}",
-                                w.map(|r| r.map(|r| r.text)),
-                                g.map(|r| r.map(|r| r.text))
+                        golden.next(
+                            &(&got_text, name, version, source_type, url),
+                            &format!(
+                                "{:?}",
+                                got.as_ref()
+                                    .map(|r| r.as_ref().map(|r| (&r.text, r.edits())))
                             ),
+                        );
+                        if let Ok(Some(g)) = got {
+                            landed += 1;
+                            got_text = g.text;
                         }
                     }
                 }
             }
         }
         assert!(landed > 200, "only {landed} rewrites landed");
+        golden.finish();
     }
 
     /// A parse is reused only for byte-identical text: an external edit
diff --git a/crates/socket-patch-core/src/utils/python_lock.rs b/crates/socket-patch-core/src/utils/python_lock.rs
index feebdd25..70e848dc 100644
--- a/crates/socket-patch-core/src/utils/python_lock.rs
+++ b/crates/socket-patch-core/src/utils/python_lock.rs
@@ -5,10 +5,6 @@ use toml_edit::{Array, ArrayOfTables, DocumentMut, InlineTable, Item, Table, Tab
 use crate::crawlers::python_crawler::canonicalize_pypi_name;
 use crate::utils::digest::{sha256_hex, sha256_prefixed};
 
-#[cfg(test)]
-#[path = "python_lock_oracle.rs"]
-pub(crate) mod oracle;
-
 #[derive(Clone, Copy, Debug)]
 pub enum ArtifactSource<'a> {
     Url(&'a str),
diff --git a/crates/socket-patch-core/src/utils/python_lock_oracle.rs b/crates/socket-patch-core/src/utils/python_lock_oracle.rs
deleted file mode 100644
index 4047300d..00000000
--- a/crates/socket-patch-core/src/utils/python_lock_oracle.rs
+++ /dev/null
@@ -1,239 +0,0 @@
-//! The pre-single-parse text rewriters, kept verbatim as `#[cfg(test)]`
-//! oracles for the hosted uv / pylock / PEP 723 rewriter, which now plans,
-//! applies and completes every dep against one parsed document
-//! ([`super::PythonLockSession`]).
-
-use super::*;
-
-pub(crate) fn complete_python_lock_metadata(
-    text: &str,
-    project: Option<&str>,
-    name: &str,
-    version: &str,
-    artifact: ArtifactSource<'_>,
-    wheel_metadata: Option<&str>,
-) -> Result<String, String> {
-    let mut document: DocumentMut = text
-        .parse()
-        .map_err(|error| format!("invalid Python lock: {error}"))?;
-    if document
-        .get("package")
-        .and_then(Item::as_array_of_tables)
-        .is_none()
-    {
-        return Ok(text.to_string());
-    }
-    let name = canonicalize_pypi_name(name);
-    if let Some(project) = project {
-        let project: DocumentMut = project
-            .parse()
-            .map_err(|error| format!("invalid pyproject.toml: {error}"))?;
-        let packages = document
-            .get_mut("package")
-            .and_then(Item::as_array_of_tables_mut)
-            .expect("package collection checked");
-        for package in packages.iter_mut() {
-            let root = package
-                .get("source")
-                .and_then(Item::as_table_like)
-                .is_some_and(|source| {
-                    ["virtual", "editable"]
-                        .into_iter()
-                        .any(|key| source.get(key).and_then(Item::as_str) == Some("."))
-                });
-            if root {
-                if let Some(metadata) = package
-                    .get_mut("metadata")
-                    .and_then(Item::as_table_like_mut)
-                {
-                    for key in ["requires-dist", "requires-dev"] {
-                        if let Some(requirements) = metadata.get_mut(key) {
-                            rewrite_requirement_sources(requirements, &name, artifact);
-                        }
-                    }
-                }
-            }
-        }
-        let overridden = project
-            .get("tool")
-            .and_then(Item::as_table_like)
-            .and_then(|tool| tool.get("uv"))
-            .and_then(Item::as_table_like)
-            .and_then(|uv| uv.get("override-dependencies"))
-            .and_then(Item::as_array)
-            .is_some_and(|overrides| {
-                overrides.iter().filter_map(Value::as_str).any(|specifier| {
-                    canonicalize_pypi_name(
-                        specifier
-                            .split(|ch: char| {
-                                !ch.is_ascii_alphanumeric() && ch != '-' && ch != '_' && ch != '.'
-                            })
-                            .next()
-                            .unwrap_or_default(),
-                    ) == name
-                })
-            });
-        if overridden {
-            let manifest = document
-                .entry("manifest")
-                .or_insert(Item::Table(Table::new()))
-                .as_table_like_mut()
-                .ok_or("uv manifest must be a table")?;
-            let overrides = manifest
-                .entry("overrides")
-                .or_insert(Item::Value(Value::Array(Array::new())));
-            let exists = overrides.as_array().is_some_and(|overrides| {
-                overrides
-                    .iter()
-                    .filter_map(Value::as_inline_table)
-                    .any(|requirement| {
-                        requirement
-                            .get("name")
-                            .and_then(Value::as_str)
-                            .is_some_and(|value| canonicalize_pypi_name(value) == name)
-                    })
-            });
-            if exists {
-                rewrite_requirement_sources(overrides, &name, artifact);
-            } else {
-                overrides
-                    .as_array_mut()
-                    .ok_or("uv manifest overrides must be an array")?
-                    .push_formatted(inline(&[
-                        ("name", Value::from(name.as_str())),
-                        (artifact.key(), Value::from(artifact.location())),
-                    ]));
-            }
-        }
-    }
-    if let Some(metadata) = wheel_metadata {
-        let metadata: DocumentMut = metadata
-            .parse()
-            .map_err(|error| format!("invalid wheel metadata: {error}"))?;
-        let metadata = metadata
-            .get("package")
-            .and_then(Item::as_table_like)
-            .and_then(|package| package.get("metadata"))
-            .and_then(Item::as_table)
-            .ok_or("wheel metadata has no package metadata table")?;
-        for package in document
-            .get_mut("package")
-            .and_then(Item::as_array_of_tables_mut)
-            .expect("package collection checked")
-            .iter_mut()
-        {
-            if matching_package(package, &name, version) {
-                let mut metadata = metadata.clone();
-                metadata.set_position(None);
-                package.insert("metadata", Item::Table(metadata));
-            }
-        }
-    }
-    Ok(preserve_line_endings(text, document.to_string()))
-}
-
-pub(crate) fn rewrite_python_lock(
-    text: &str,
-    name: &str,
-    version: &str,
-    artifact: ArtifactSource<'_>,
-    sha256: &str,
-) -> Result<Option<String>, String> {
-    let mut document: DocumentMut = text
-        .parse()
-        .map_err(|error| format!("invalid Python lock: {error}"))?;
-    let Some(PythonLockPlan {
-        pep751,
-        legacy,
-        collection,
-        index,
-        name,
-        original_source,
-        legacy_strings,
-        legacy_artifact_tables,
-    }) = plan_python_lock_rewrite(&document, text, name, version, artifact)?
-    else {
-        return Ok(None);
-    };
-    let package = document
-        .get_mut(collection)
-        .and_then(Item::as_array_of_tables_mut)
-        .and_then(|packages| packages.get_mut(index))
-        .expect("planned package index exists");
-    let location = artifact.location();
-    let filename = location
-        .split(['?', '#'])
-        .next()
-        .unwrap_or(&location)
-        .rsplit('/')
-        .next()
-        .unwrap_or(&location);
-    let wheel = filename.ends_with(".whl");
-    for key in ["sdist", "wheel", "wheels", "archive"] {
-        package.remove(key);
-    }
-    if pep751 {
-        package.remove("index");
-        let hashes = inline(&[("sha256", Value::from(sha256))]);
-        package.insert(
-            "archive",
-            Item::Value(inline(&[
-                (artifact.key(), Value::from(location)),
-                ("hashes", hashes),
-            ])),
-        );
-    } else {
-        let source = if legacy_strings {
-            Item::Value(Value::from(format!("direct+{location}")))
-        } else {
-            Item::Value(inline(&[(artifact.key(), Value::from(location.clone()))]))
-        };
-        package.insert("source", source.clone());
-        let artifact_key = if matches!(artifact, ArtifactSource::Path(_)) && wheel {
-            "filename"
-        } else {
-            "url"
-        };
-        let artifact_location = if artifact_key == "filename" {
-            filename
-        } else {
-            &location
-        };
-        let entry = inline(&[
-            (artifact_key, Value::from(artifact_location)),
-            ("hash", Value::from(format!("sha256:{sha256}"))),
-        ]);
-        if legacy_artifact_tables && wheel {
-            let mut table = Table::new();
-            table["url"] = toml_edit::value(artifact_location);
-            table["hash"] = toml_edit::value(format!("sha256:{sha256}"));
-            let mut array = ArrayOfTables::new();
-            array.push(table);
-            package.insert("wheel", Item::ArrayOfTables(array));
-        } else if wheel {
-            let mut array = Array::new();
-            array.push_formatted(entry);
-            package.insert("wheels", Item::Value(Value::Array(array)));
-        } else if legacy_artifact_tables {
-            let mut table = Table::new();
-            table["url"] = toml_edit::value(artifact_location);
-            table["hash"] = toml_edit::value(format!("sha256:{sha256}"));
-            package.insert("sdist", Item::Table(table));
-        } else {
-            package.insert("sdist", Item::Value(entry));
-        }
-        if let Some(original_source) = original_source {
-            rewrite_references(
-                document.as_item_mut(),
-                &name,
-                version,
-                &original_source,
-                &source,
-            );
-        }
-    }
-    if !pep751 && !legacy {
-        rewrite_manifest(&mut document, &name, artifact);
-    }
-    Ok(Some(preserve_line_endings(text, document.to_string())))
-}
diff --git a/crates/socket-patch-core/tests/equivalence/cargo_lock_hand_written.golden b/crates/socket-patch-core/tests/equivalence/cargo_lock_hand_written.golden
new file mode 100644
index 00000000..c416de05
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/cargo_lock_hand_written.golden
@@ -0,0 +1,34 @@
+# One package of a hand-written Cargo.lock shape, planned for the hosted index.
+# <case> <input digest> <output digest>
+0 706a2c1abf97c1b4 26d81ae16d72cab3
+1 0013f297dd492650 1428acc04f9e446f
+2 5c5c9865e85a268e d123c201da48e32f
+3 7e6322041427f070 c9473f27f38da73a
+4 9d8bcf7735d2008e 1428acc04f9e446f
+5 6ec6285a7b61479f 0dcfa85143654a54
+6 ef2fed64a9d24209 8388406d7bc88ba3
+7 3d9a7b57fa5c470a fe8445153947c6af
+8 3b11f8aed597c49d fe8445153947c6af
+9 29994524553d22ee 8388406d7bc88ba3
+10 71499101583df353 e7ecb5ace517a1d6
+11 36d06182e2a1c1e9 1428acc04f9e446f
+12 68989afaeffb42a1 bffffda01b112ac7
+13 af64333e15e6b606 4af8fd36e7286fef
+14 5cec941739965a2b 1428acc04f9e446f
+15 7241469515e1e102 129d26df99f15585
+16 2b16d975ceee5389 8388406d7bc88ba3
+17 fc916c73fcf340b5 9a85046178baaf05
+18 3e48d7d989e4ebc0 1428acc04f9e446f
+19 5036e5b279a082fc 89f28ce664aa4d1a
+20 ea3db94c11b41887 8388406d7bc88ba3
+21 215499487910362c e5b728d164a80524
+22 a543ccd11ef08544 1428acc04f9e446f
+23 fd7112c582ba94ce fa2725078c2108f0
+24 9337c8c0437c0d1e 8388406d7bc88ba3
+25 a01510ddd6232374 209e728561ddbcef
+26 ff44ba433551f787 1428acc04f9e446f
+27 d41fbcbb78263ef7 7b3af5fbb5ff1e34
+28 930b1a4569318906 4ebc39a8335e270b
+29 42ccdafbcf685997 1428acc04f9e446f
+30 4f43463b7f55fee2 36521a8bfb53eec1
+31 f4bf8598e35a43e8 8388406d7bc88ba3
diff --git a/crates/socket-patch-core/tests/equivalence/cargo_lock_large.golden b/crates/socket-patch-core/tests/equivalence/cargo_lock_large.golden
new file mode 100644
index 00000000..327f3f69
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/cargo_lock_large.golden
@@ -0,0 +1,28 @@
+# One sampled package of a seeded ≥1k-block Cargo.lock, planned for the hosted index.
+# <case> <input digest> <output digest>
+0 78045c5e39db073b f2cf0090ac2ce5e7
+1 05dfc47f50a498c1 3f2c8debbb1d0145
+2 d854b4cf14f9f61d 8857fbf24537018f
+3 9c4a785df44318c7 d00b6fc606b303db
+4 a25a1c30b0cdf6b5 76d68a56da0a85aa
+5 101baf93e0a7f9d8 e9c57cf0b99a1684
+6 3a6b3874476a882a 856fa93ccdcfb6af
+7 f9eaf6afbb1a9c66 dd37b2e4b773d076
+8 a2a84f014fb4dabc ee9f4e62becb7cc6
+9 35b474487d5ff6b9 091a8d6e21322223
+10 38789819cea16a4f b378bd7f02a8714d
+11 c4c27c5d4f4daf67 96f19e29103fabd1
+12 be94b55d7c3c1480 8ed48177335ef376
+13 746dbc23026f79ed e17d988ec31acb4f
+14 7d8fe30baee23b9b be565b36d3fa7922
+15 46947f017e5b4c48 cb91d36563a63052
+16 0003561dcc79589c d069f669afd6cd52
+17 b54e0470cd987144 2cb03a40e3a3e409
+18 d4bf856fb926a83f f89b80deec3260fe
+19 cb99923406f3fcd0 e0a883a4b9455386
+20 513193db2b707372 e7463dafaa030836
+21 ea9a3e2b5e22133a 53a9b1d38f0d90c6
+22 5fd2b34ba2924902 cdc341c3b0655b62
+23 8308cfa77d8eb679 8ae5384da5f521a6
+24 30cc19f98558363c 012f808a18623335
+25 20ed7cc1c8b6dd5f 9522170ea2f5a131
diff --git a/crates/socket-patch-core/tests/equivalence/cargo_lock_random.golden b/crates/socket-patch-core/tests/equivalence/cargo_lock_random.golden
new file mode 100644
index 00000000..e205c4ff
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/cargo_lock_random.golden
@@ -0,0 +1,260 @@
+# One package of a seeded Cargo.lock, planned for the hosted index.
+# <case> <input digest> <output digest>
+0-19 f29f7f036e08101d 15fcdd2345db5f51
+20-39 88970b1c782bcc4f 93a31a340b0c206e
+40-59 e549d7f4feee28f7 c161ce241dc3e0e7
+60-79 41b623cd509a8e39 148c8b1efa8b253c
+80-99 f08ba147bc7d2675 7a061e373beb12cd
+100-119 379725799f733b36 4ca10f565e554a57
+120-139 aa62dff09077b08e 1b85d3e33155a2a6
+140-159 2a4c5cd72107f9a3 9d4d48535bbad70b
+160-179 7d647e971cf28a8f e7e33bd606496eab
+180-199 ddff2c72b70e55b3 65383b9cedf5ddb5
+200-219 a1cca3cd191c12b5 1d764cced5ac65d4
+220-239 c91de04cdb183add a32f7decba3bce7f
+240-259 c47f781a988d65c3 4b972d7662c88a87
+260-279 73aa02ab25ba273a 1421ed4bedfb7403
+280-299 04f68baa5c4e4bc9 cd5fe00fb4d285f6
+300-319 047f47e885ede5e2 9c2b76ba612cace4
+320-339 df0836300d651076 c286b98681df94bd
+340-359 a266b0e79a7d84a8 08cfa92f8485ef35
+360-379 58f6b017612c6816 1a419331b35ef70a
+380-399 5ba3d117de9176c2 1164dc9f9b72d7f7
+400-419 ba83002bce60d60b ace83b6844b4e300
+420-439 dc2cf2ba92e262d7 d9dbdaeba998c99a
+440-459 8a9124f759249703 ad7d4fb70740adbf
+460-479 3e6f5a32150c1d46 82654e822d1d1aa9
+480-499 848742697c7dbd06 77b67452702dafa9
+500-519 c34758da24407a5e 64e9642a147fc269
+520-539 22afb2f6091466ce 984c72442984b4df
+540-559 30b34caac24ab212 2167ceb67e82b1a9
+560-579 cf1804b6bead618d 980ab43ca9eb8945
+580-599 715ae75d087e6dcf f3f12b3776555567
+600-619 483b71715363f2ec e8c7324b79e44366
+620-639 b483216cbd0c41c3 66f21dbd9f5002db
+640-659 e01ba3d32f5f418c f94a3dfedf8a33aa
+660-679 08eb9ede990c2e12 efd5e128232021cd
+680-699 9c00cf0528ca7cee f2f1b9e5f022f0d7
+700-719 bdee62c931789604 e1b6432d16fcf963
+720-739 b3612440a4be00f4 7efbb10e59383192
+740-759 bf1691f95878ee6d f671fc5ac13b24ba
+760-779 4e953a507f7593e8 1b7f257fb5c5937d
+780-799 0933b559bc0abf54 da5b93d1b8ae6fd7
+800-819 bf4d2aceb4750e1b 2d130ffd05d9df5b
+820-839 9fb73f3721bf732f 30f3f9a0a65640e4
+840-859 2df21b0d1f4d1f2f 2c59c0dafb5cb638
+860-879 de2ea5ec7d76789e ed449b7d3f0b18f6
+880-899 aab4f16968c175d3 2937195c32e9b980
+900-919 8895cb6b7144ed9e 435ea56f5c5828a9
+920-939 e938457d6c4cc1d6 f478205e3098b08c
+940-959 6afdf98ced22e2b7 03b4312a63ea0589
+960-979 70c5d89b29da668d 30245179f92456ed
+980-999 4aba83fc1363e434 1b46cde2f3583d9a
+1000-1019 192d5ff95b760412 566da0e129ed445a
+1020-1039 3ac6c735f54fbb18 d3c9e1a68df460b7
+1040-1059 8f33d42a12e8573a 3fbae4cd14a0eb2e
+1060-1079 ed67f3c218c44077 3e5106301f0f25e5
+1080-1099 b9abdde99c15b43d 2f6bdab2b53e187f
+1100-1119 1922ffd988064a0d af8d65d647125435
+1120-1139 93705a742562faf3 5adba08db501fa41
+1140-1159 014c38e750a3e021 001baca306a132db
+1160-1179 05aadfdaacfae94a cd7c9efc33dcd03a
+1180-1199 63bc62b68eb2c59e a5f07c35bc0dd51a
+1200-1219 3c00cdeee782ebe8 ac0d3bf871549065
+1220-1239 8bbf5ed2af8288eb fcfa7ac56a5b1916
+1240-1259 59b2c183f8b69485 c02c6863664e45cb
+1260-1279 dbd6fb55e744e369 cd1347421a7cfe62
+1280-1299 ca8eb4cb0d6552f0 45ebcf4c550c37e5
+1300-1319 6f90d259572896ba 927684d7642f118f
+1320-1339 f37906c70ad6a2f4 7bc7ed81986c83ce
+1340-1359 2ccba48216e1de6c 89f1e98e97f3bb25
+1360-1379 ba467b035586147f 023225e36e3b3495
+1380-1399 22b468b5ff39a45b d286c2bb94512a65
+1400-1419 a0dd45690f72a8d0 ead22c45b7ec9ff9
+1420-1439 0b2792d94a0681b1 d026684f4573484e
+1440-1459 47edad566619a8f8 7bfe59dc09a93d41
+1460-1479 15c0e9ceeb4e0e6c a44c9a2a33915853
+1480-1499 e79d5635ab1a462b 81f645b1342bdcf9
+1500-1519 304beca9b1ac6b91 330cefea075ca239
+1520-1539 fbc4b99cf28e76bd 28bd89cb0b2c2475
+1540-1559 b2987da2f02b49ed 8a040ed1d4ae3558
+1560-1579 fd5575bf96e89f2c 82cfb6b0d39ba20d
+1580-1599 41518f7e89703e9d 8ada06dbad0d655a
+1600-1619 68cdea13bca0d10b ddfb0ddc2a883111
+1620-1639 4ac6cc10f072afc6 13d9d63e141ef9ee
+1640-1659 2331c995c5705cfe 1a68ba062744d709
+1660-1679 b5a58935e8dd88ec edca9dc56b388b7d
+1680-1699 a48f20e4bde54b39 d52e0e0373c5aa64
+1700-1719 24567ec898aaafff b546ce1278184168
+1720-1739 4d5a9738aa730c18 5ee312648a112dd6
+1740-1759 43456b7adeadcf56 c310cd6b8066267d
+1760-1779 5bc475bc11a5c16e a485c95285ac355a
+1780-1799 24daef9b23da61f2 b93764d8d56df189
+1800-1819 355c1b7729c6a0a3 ab2490e4d55521ef
+1820-1839 f28e59c983556824 e8af4777388f67c4
+1840-1859 2fb2fec2a71f360e a1206dc7621f1b77
+1860-1879 22d3787161003f0c aaaed7c20ba91f4d
+1880-1899 1837be0743c6cee2 4eb849fa14add39f
+1900-1919 bb1d18e322ba6494 d3b09bbf92643eff
+1920-1939 7e7d61074278d806 609765dca4d6b699
+1940-1959 ad44f61ee06ef232 7a424139b5e0269f
+1960-1979 9134be270d17364b 7025306327a8efca
+1980-1999 ef696e4045391f2d 916f38f3937fd7fb
+2000-2019 8499f868520b3f8e 5b3bc7a31d3d93c1
+2020-2039 8ad512de7b529038 490a3f5aa1778f15
+2040-2059 c69c16b1a115e9ac 5d9a904cda23615e
+2060-2079 945cba5bee5bc399 767fedaebb7bc00e
+2080-2099 e3147fed90db9855 888aeb2af65837cd
+2100-2119 98bf6471b6cb0615 eab6f9b350fc4dae
+2120-2139 90f38a07d2573cf0 efaf3964b0dab056
+2140-2159 da5782e3633006f7 f2beef78afb853f4
+2160-2179 7bdacb27708daa87 a9c3364bc49bc3e1
+2180-2199 2f82996cf7f24576 875ba5c485a0874b
+2200-2219 b1e2199d52cce57f c5fb1f7bbd02c67b
+2220-2239 19a653c17ec51323 aa50e297011141c5
+2240-2259 f5ac4e0c0993f327 af8fb5f449afd87f
+2260-2279 f0a1eb778213dd23 9ba99949b1179d63
+2280-2299 0e50ca7d34ef0d62 1eb1e2cd7c54107b
+2300-2319 7221fb632f837418 6f5e13b31cea030f
+2320-2339 e1cf296bb8e21bde 77c7b92980752534
+2340-2359 636b76011aff79e1 f4431f380618d52f
+2360-2379 71e932a5a3bdfb8e c60b499b397c575f
+2380-2399 c117916cd277ec6f 95bbe2feb60cccb3
+2400-2419 ccfdba5fdf0a9415 8b2cc626871d0fb0
+2420-2439 dc6dd7969e0f1e36 94e0f97378ac1b25
+2440-2459 e1fea14d81ceb91c ae3f79dfdbeb7f7c
+2460-2479 f5cedaabb7724677 d59e1da2bc0e0743
+2480-2499 e26961852ecc22ae da99f352250c1b45
+2500-2519 a25796c4f7fbad7c f8a164c5544a7254
+2520-2539 4fb0e7c218149c7e 0319c40be2e31b64
+2540-2559 0c81e323fb67df40 6e08ef2537f3ca96
+2560-2579 b65f596fff015d46 41feb9684e934416
+2580-2599 b79f6e99dae9205e 031f4009cbbe9af5
+2600-2619 c604cf1aad4f649f d554c480f8b05951
+2620-2639 76f7969d453acebe eebfa9af71697aa6
+2640-2659 b5becb850e265522 1269cdfe95e8974f
+2660-2679 4a2d7d35dfbd1b5f e538ca966604e479
+2680-2699 49d14ba9d02841fb b99bcb47badbb193
+2700-2719 649762baa856d048 7f56e0186ea3d487
+2720-2739 4f96dc61948f2884 334cf1e3e0fd24a4
+2740-2759 be2bdfa73e690282 95f8ab7d42c00ec6
+2760-2779 dcac309d22b001b3 dd4bcc069e011382
+2780-2799 907d81c1fc8e62a8 22f0667e5a46678c
+2800-2819 493cc61dc72b18a0 5fe2e0608206c130
+2820-2839 f2834bfbc9846784 17c670bf5da2d384
+2840-2859 d06f0d7d42652336 ab3835ee6d865319
+2860-2879 2a21a9bc94491852 6a5a3d00ef65f41c
+2880-2899 611504eace82f58d 61473122b3912af9
+2900-2919 352b76e78f376685 a6b5bd24de45e478
+2920-2939 17c034af64775b1a ce5b3f75c461a821
+2940-2959 0f2379bb287254bf 56beb942e124639e
+2960-2979 34fa7e24504b986a 3d7c0cf80891f403
+2980-2999 17d02ce6d30b01d1 e7b3068735bac0ac
+3000-3019 cb56a52b91c07c3a 36120e3f70208071
+3020-3039 a486b88249f2bffc 136f1610c407390d
+3040-3059 edaaaa41992c4c37 da1394f27770b85f
+3060-3079 1cd0f784fd5e3bac 8303db273a0eb798
+3080-3099 17ce14fc832a3ca2 96e326f20334385e
+3100-3119 aee3cf2eeb6c8239 c39c5bcb22400061
+3120-3139 cc7176a5e83d72f6 528969f211608881
+3140-3159 723b7920d611d760 6c19966602d0b8eb
+3160-3179 176b38a6cde2ee46 d0581faff8e98ab7
+3180-3199 6e690a7653ad76e2 3a463fd2fc90a488
+3200-3219 e7f9198eeb91b429 0e4aeb2e4e0a4421
+3220-3239 9cbade3ca42b488a 5544e0538aabf17f
+3240-3259 1d0708203dae99e4 be3e22b909ba487b
+3260-3279 5a2b666997abe74a c0cfc8b3d1c1364b
+3280-3299 3ad2c0076f628fdc 042c47415841b001
+3300-3319 3b4325f4842b3978 575e706f43048a90
+3320-3339 d407e6aad990b794 462153c4561369cb
+3340-3359 5c4064cba50101c5 78c524f4dc4e695d
+3360-3379 63107d93346dd91c fa6a9a6ab55eb079
+3380-3399 a14b22d3d5aa7068 05f78b4d8915ccb0
+3400-3419 5bfe607fa099222f 77e5bd0ec426f62a
+3420-3439 238654ad7fd731fc 1462c995e3025a09
+3440-3459 aff73d40237b79c3 a12121daa5833c0d
+3460-3479 815f03b8e8801faa 5a57de807e2befbd
+3480-3499 6487a346b83c1a78 810b4ad1c78b0e7a
+3500-3519 46edaa06f0ee0769 3bf7c59c715ca7e6
+3520-3539 3e64bec5cf546343 bfe286e4d19c9ab6
+3540-3559 73e6cd8e9b04d93d 5345d890934635b9
+3560-3579 fd4ba4ce60f7cf10 7b604469555ebda3
+3580-3599 444e6b4cbef13ecb 78eb4929919fb9f6
+3600-3619 d25c25858e9d29d2 1c9ec8efeb219413
+3620-3639 11958621d1a0622c 187b3789f90b213c
+3640-3659 32cda6b56d107181 264be07c80829590
+3660-3679 759d6019beced504 c22bf8969db2ecb1
+3680-3699 58a6ba4bd3f5d359 223ff38df5ce4a59
+3700-3719 6e1f4fd78ebd3355 9f361789bebbb98e
+3720-3739 a997d0ccedda5c64 544a8c9090dc9735
+3740-3759 57cbd84d0094ed86 87750b3baf8e796b
+3760-3779 215b7c020db270be e30299b0a287f1a9
+3780-3799 dc5f8938d270c893 976ae59059bfccfd
+3800-3819 3ceef0d65cbf8b7d cc0da82ab8176f45
+3820-3839 ecc8ec56b6dd2e00 769077ac5634bbe5
+3840-3859 6b26c92b7de2c742 24796faa4da5fea9
+3860-3879 248c9b4fe8310237 e352bbff021e9818
+3880-3899 f829bfad2a69ede2 81ac4722d38b28ae
+3900-3919 f6512b14d775e864 8c6eb605dbea1964
+3920-3939 39a927088f4f88b9 a6490708edca0417
+3940-3959 070296b95464b935 b28f872a06cda16e
+3960-3979 236de91489337214 06ec5b3f0cce147b
+3980-3999 44892f2560197b78 74ed890c0d8d9c15
+4000-4019 7aef382a1b427383 e8b0cf479f6f253b
+4020-4039 577683c9d88e1d71 cec8220150a8ea46
+4040-4059 4e2f423ff0f9ea61 ab113a91a641dfc8
+4060-4079 b30a1eee1e9c6368 cd5ed2ddad4a0f18
+4080-4099 1660a2f271745f4d 740c68108d49994a
+4100-4119 4be7d38149f89e9a 13c182ce4ac70210
+4120-4139 c21b510da4ee70cb ee5aa7986d555c33
+4140-4159 366bdb067c694ba2 b2e7035f82d4ab10
+4160-4179 f2cf904fe73b556f 0e3e9a742bbf84ad
+4180-4199 d4ce35fc918e49a7 38ed3f77dc645887
+4200-4219 32b7caf91af21c3c 58e11d8f1d93f505
+4220-4239 cd8010e83e9fd72e ed44a3354dbb4b61
+4240-4259 621ed1bc982212eb 69a57062935da5c9
+4260-4279 8a71c6e538792327 027e291d3c2aefb6
+4280-4299 b1ed226babf0b2a8 1c31138ed6637fb1
+4300-4319 16001aa3329dbe2a 8f7944e375dcbce3
+4320-4339 66c436462def9c0a 386b23cfd1fb1d42
+4340-4359 788e5f3213ce177d 39184f15b26e6bf0
+4360-4379 6caebcdaf6c0f02d 894b49f4db7b10d1
+4380-4399 df18c925dc1ae013 6504168382a7f575
+4400-4419 8bff99e0b48fa3f4 eabe70692a37a208
+4420-4439 0b910c768e5c00f2 b8c1994b0653dd31
+4440-4459 f357166cba13602c 3514d46b12b31021
+4460-4479 63472e5b76fdd703 37c9f08d82226231
+4480-4499 d6e9040e54354020 554305137b8a7250
+4500-4519 ea5f1eb0aafc64d9 5795c80b6165fd48
+4520-4539 05ffe86951490efd c519c0637aff3227
+4540-4559 907af4190b058042 9b2e445e0c0618ae
+4560-4579 60afec8b2e9bf3b6 1809e06b57598a5f
+4580-4599 a2c1a5be4f249df7 5f4edb16b1e6a2ca
+4600-4619 9e2eba5f1395b8d2 84bf62484d2478a3
+4620-4639 126e7be0b4f60180 0262b6351c44eafd
+4640-4659 005e406b74e136a5 d140efb0e813d08c
+4660-4679 9a68cc25f745e30c 8a6c57cc64baa60c
+4680-4699 e992d034fa06e77e f54b9e62475e2adf
+4700-4719 1360a562d6a15ebe a84b5e486396378f
+4720-4739 8263e73d7b9a9e55 dbcb5a5f67f66472
+4740-4759 3ecf06ca573b4450 3af92dd11ad9d29f
+4760-4779 8b562cd2da15acd9 0c3cc6ea2faec5c1
+4780-4799 965c3a17b2013c07 0cb0b5717b8b8ebb
+4800-4819 19da8a20cb2b29e7 8d9e9810948ff151
+4820-4839 f25130d77f8970b2 8da56c91879b4139
+4840-4859 f1014250a60478bb bfc9be790c53808e
+4860-4879 15f973b93b489a2b bffd36c7d2397db2
+4880-4899 972eb459d0b832ea e8e99926f2e81941
+4900-4919 a5d4ba4e6d3f3876 f8cb52226ff18400
+4920-4939 1dbdba5ba4abf9d0 9c5f30bfc028dbc2
+4940-4959 3c4449d0a978cfe5 6b885d6175f23748
+4960-4979 8c32df3e79c709d4 e0f723df9d288603
+4980-4999 993fdee9018d4401 5b957ba534eb769c
+5000-5019 a9c3e1f25d020754 b2dbe851e709da95
+5020-5039 84e18c0fb88538ae f0ee3a067ea3550f
+5040-5059 b031e323c5eddac9 099a9f7cf8c6a9aa
+5060-5079 dc3963dfb34b2748 80f2d7bd7e34f302
+5080-5099 112aec43fae4e864 f6bd4c112eeccc38
+5100-5119 4693e39175662c0a 990e605ffd23e163
+5120-5139 65de9cdc9aa6d49b 2d2b0058899f7c15
+5140-5141 195107ff0499c01b ea616eff5b65486b
diff --git a/crates/socket-patch-core/tests/equivalence/composer_json_object_end.golden b/crates/socket-patch-core/tests/equivalence/composer_json_object_end.golden
new file mode 100644
index 00000000..a73f4563
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/composer_json_object_end.golden
@@ -0,0 +1,92 @@
+# One (text, start) pair: where its JSON object ends.
+# <case> <input digest> <output digest>
+0 7aeb4f0cd8305fb8 74234e98afe7498f
+1 e2b3e7e33cf55c97 71ee45a3c0db9a98
+2 a699980f74eb06fb 7902699be42c8a8e
+3 5a96e9c725068c65 7902699be42c8a8e
+4 30627aa32eb3e425 71ee45a3c0db9a98
+5 933fd7bad3713e4c 71ee45a3c0db9a98
+6 f0adab048e7484a2 71ee45a3c0db9a98
+7 23b311dd221b5145 7902699be42c8a8e
+8 5741602eb0dbcc45 670671cd97404156
+9 e1f3a83531f48d90 71ee45a3c0db9a98
+10 4648133e424a0010 71ee45a3c0db9a98
+11 b0f1e1d18c73939f 71ee45a3c0db9a98
+12 64a0e3ccd5edf191 670671cd97404156
+13 39a5935c34470b73 670671cd97404156
+14 915b63fa95e98aac 71ee45a3c0db9a98
+15 fd7c4b67bddf3339 71ee45a3c0db9a98
+16 cf1d11381d4ba4c7 71ee45a3c0db9a98
+17 3d0a7aeee8930ab0 670671cd97404156
+18 b467d4782c503826 670671cd97404156
+19 dc17b8d924a13be1 670671cd97404156
+20 249e9e7e5bb4c207 670671cd97404156
+21 b3bef0d7e2cc3de3 670671cd97404156
+22 14d2211abafe3af4 670671cd97404156
+23 1a7d91bc398fc4ce 670671cd97404156
+24 03df0f1a1009f7e0 670671cd97404156
+25 9d5c9530a427bf87 b7a56873cd771f2c
+26 b736c7398108e7ba 74234e98afe7498f
+27 3a09e484ad26337a 670671cd97404156
+28 c8d9e501ab9873f7 71ee45a3c0db9a98
+29 0960893517a39ee7 71ee45a3c0db9a98
+30 23391a334f139f74 71ee45a3c0db9a98
+31 3f28fea4ec2e6072 74234e98afe7498f
+32 591e879e2a2135ba 74234e98afe7498f
+33 b7e76e1a31a686e2 71ee45a3c0db9a98
+34 b706d70c8f6e2402 71ee45a3c0db9a98
+35 7638b525b6c72b71 71ee45a3c0db9a98
+36 2c4f20c4290dcace 74234e98afe7498f
+37 1792cef320d2bd9d 74234e98afe7498f
+38 a37e2f62d6750c2f 74234e98afe7498f
+39 fdbdc9dba508876d 74234e98afe7498f
+40 ca3e3c49803e815c 74234e98afe7498f
+41 87155c744c38149b 74234e98afe7498f
+42 dab4f0fde3b38383 71ee45a3c0db9a98
+43 fa77a8ddc63efa1b 74234e98afe7498f
+44 e77aa085232696eb 6f4b6612125fb3a0
+45 9471d5b751a24f8f 6b51d431df5d7f14
+46 80b53a7f7f617553 4a44dc15364204a8
+47 10b24a374484dd79 4a44dc15364204a8
+48 6e11ae9cc1196969 6b51d431df5d7f14
+49 9be44b92e364abf7 6b51d431df5d7f14
+50 9003e52c57d83f39 6b51d431df5d7f14
+51 2ddadc3dbc6ea928 4a44dc15364204a8
+52 029867400738a35f 4a44dc15364204a8
+53 34d047ace6f8ef93 4a44dc15364204a8
+54 512a07a19b13d853 74234e98afe7498f
+55 fb93462a03dbb3b1 6b51d431df5d7f14
+56 01d98301a2b8bdae 6f4b6612125fb3a0
+57 58c339124db4eb5e 6f4b6612125fb3a0
+58 19d0a90a5da36baf 6f4b6612125fb3a0
+59 21b3514debad9cc3 74234e98afe7498f
+60 3066fcc6db90ae91 74234e98afe7498f
+61 4eb12bf85ab46d8b 6f4b6612125fb3a0
+62 e164089493b98d5f 6f4b6612125fb3a0
+63 be20d2ba0eaa369f 6f4b6612125fb3a0
+64 6e8f74932f3c258a 6f4b6612125fb3a0
+65 0ca9dd31dc9e5bd1 74234e98afe7498f
+66 88c94156c2f78bc2 74234e98afe7498f
+67 6f249bbff2abfeb5 74234e98afe7498f
+68 bf2bfe1619d945bd 74234e98afe7498f
+69 69a04aa3a6ff61f0 74234e98afe7498f
+70 5831e00d9dec98de 74234e98afe7498f
+71 58ec3c16942a3de2 74234e98afe7498f
+72 2c5d5c979dd21a6f 74234e98afe7498f
+73 7f4be6a75813577c 74234e98afe7498f
+74 7669a7a4e02cf93d 74234e98afe7498f
+75 7db31c876bd5356f 74234e98afe7498f
+76 6b8efcdccc37754f 74234e98afe7498f
+77 061b83e971e03888 74234e98afe7498f
+78 f87c5c5e65c0d630 74234e98afe7498f
+79 f188223b610955d4 74234e98afe7498f
+80 2d1b5e209e56dd9b 74234e98afe7498f
+81 694c4d359d071414 74234e98afe7498f
+82 1435bf40ff91dfc5 e7f6c011776e8db7
+83 eb75f7ded9ad577e ef2d127de37b942b
+84 b44c44352f16ec40 4b227777d4dd1fc6
+85 6565e9014f23bf34 4e07408562bedb8b
+86 3fe8212bbd3f3426 4b227777d4dd1fc6
+87 a46020c5bfa0cbfe ef2d127de37b942b
+88 5a8dcc2b86882634 e7f6c011776e8db7
+89 756aa6e875b7c450 74234e98afe7498f
diff --git a/crates/socket-patch-core/tests/equivalence/composer_lock_rewrite.golden b/crates/socket-patch-core/tests/equivalence/composer_lock_rewrite.golden
new file mode 100644
index 00000000..784e7073
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/composer_lock_rewrite.golden
@@ -0,0 +1,302 @@
+# One seeded composer.lock + overrides; the output covers a re-run over the result.
+# <case> <input digest> <output digest>
+0-9 3f046091a6016879 b6d816e59837a34a
+10-19 72f2b409c10731c1 a021c92b31297243
+20-29 6d10bc07920e281b 86eb70311eada692
+30-39 4b69232dd2e0c45d e2f10bbfd38362fe
+40-49 166d311b157b2011 af202f87ff4cee11
+50-59 32027bdaefbf5542 c1de7be73a8b3307
+60-69 4574fa553d5c1b1f d964c8de2233194e
+70-79 190c815adb444f93 05c2364e4f6e101a
+80-89 9b7408fac52396b7 0fb80a016e9f1f2b
+90-99 8d34c46fc3c5ba1d 97724c3775768e12
+100-109 c42946a1be8ab1e8 090bf53555f59c80
+110-119 68950f2e2cb96d83 addfc0c403d63548
+120-129 983b7d4815ebe429 a90c2ed09e68a186
+130-139 ac9dc9f64a593652 b5c722d4861b34dd
+140-149 b6ebcf04ef86bcf6 b11badf2c28221d9
+150-159 a8bbd48cdd7bb980 81223f819f52dff8
+160-169 41e56c5f2b5c8dc0 69d2a42c77970c31
+170-179 549e320b51c78495 16e4c082f96aab2d
+180-189 5a32aa242799c81c 9cc6df066bb360e7
+190-199 b79ea3255d8bf7bf 94d92a17832c64cc
+200-209 f02aa88a4ced2be9 1c25b6d380ae7568
+210-219 80bbccf079d11c00 d1a64892ac646334
+220-229 cb0341aa10c0761c 59b0807c13dca350
+230-239 c0e169c6fde95f5b 1bd2c68102893b97
+240-249 27609794bc1a16c6 e7af1b24a0387722
+250-259 caa9f760bc900cc7 6f974477bdbc1755
+260-269 44a5b238ccfdf32e 34fc3a0a92f24ee9
+270-279 546854ebaca4217f 910062258ddfc953
+280-289 bddae03b8ea9b7c1 206af5c4c07f7396
+290-299 8edb35f6e32e5b6a 2e55e5b4ed0a5aab
+300-309 f7dded74f0386f94 e08db2d860db38ab
+310-319 4f7af112dca72670 171c763c3120d62d
+320-329 8ea0d44eca072099 195e34b0d627a808
+330-339 b97f90013e949f4f 68f9e91ba5c38a41
+340-349 f2d9f5f4e0fa273c 3d65308830fb17eb
+350-359 523a90656c8e0c54 1fc06c62a2af7ca8
+360-369 26a2ccef01b46b62 0563036c930a8986
+370-379 1a04a36ba27fb55a 7c4e3a855e78bfb0
+380-389 bd5d24db09f5c57e 0e78bc8c01f8137a
+390-399 5e86d0453c922257 17ddde794f8ca284
+400-409 15f28ed7d7bb945a f68c20fe7e6b6382
+410-419 e82e54f2c5ad1608 43861731ea9538af
+420-429 19941a3318072254 0f413f9a7c184a6e
+430-439 58bcb7ea0a82fb71 831de20722712f27
+440-449 5bb02eadcd944109 dd351425b7a87f6b
+450-459 4f62d532838b7438 f54036cf3048cac4
+460-469 61030781f6879fd8 e7162607c12bc71e
+470-479 d5609e7167dd4c8b 6b32d5def5a5c15d
+480-489 bef1407a564f6745 96812e51ccc52a8e
+490-499 a46aa7341489dd64 44094306ab726b19
+500-509 dd1a6d2f1a1f8bbb c07371af0129b6a0
+510-519 70c183f3870070a8 336945fb32ea88ab
+520-529 32cf2cdc67a80cf7 af5f99074a57d458
+530-539 1f517b9865eaf67f 0f23c4958cead660
+540-549 08d368438d4acf18 4a4ce23c58c27495
+550-559 0dfc8aac2bf45816 67a98ffeeb0c7a9f
+560-569 dea46ce41bfeb1a7 0a8bdbc62e5f5e68
+570-579 92aeb1cc22fb8c6c 4553f911f43b0520
+580-589 558dd2a4c69667e7 6bffecaac2e9a505
+590-599 9e17224bf8395704 f592c0b7bdf0120c
+600-609 0266ee594cbe1c2e 7311263707aaa563
+610-619 2ccf88f3a9d87ba8 355bd1abc1a1c3fa
+620-629 cf55926d24ade9e4 2d85e04560a86277
+630-639 ef5f49c02d2efee6 1d0b582ee4c4aacc
+640-649 7af9dc256ee27c7a 34e06df948e295bb
+650-659 d4c5511321e327f4 73a07c3b0dc613ea
+660-669 165e1f770068a0d5 0dfff168b2bb7db6
+670-679 5eb0b9bc1ffcb8ef f115432a4c7e7f91
+680-689 750543ce910e0f61 4127b43f9de658d6
+690-699 7f29f26ec70b1003 adfaf45e37646bb1
+700-709 b19980a86c03ae67 1372f37a3729211e
+710-719 c44fcd9dc44a4cdc e4a0ac87cdfd5e1a
+720-729 91d7d28ae18fe0bf 31f94021ba08e29b
+730-739 60a0df67d7c978cf fe37b11b900cba01
+740-749 360ae5e039378ad8 a116ee0a6ecef23c
+750-759 7c512337ccba07c6 92ea0e9311000d5b
+760-769 02687b9f99360f05 cbd86dc4c47da56d
+770-779 6471dcb36e7b3be5 9479a27d8a0a766e
+780-789 00428b7fb9f46df2 58263541bcfce839
+790-799 ce08d61f654b5280 55e380555818d7d3
+800-809 0b6bdd3b38b56261 3365278677ca8248
+810-819 b06f2499071ad1e7 8dbe6cdc9d03ab62
+820-829 1702b9f88bc5e1b6 542360ead43705f9
+830-839 fad56f5efcc62de0 d82173f629557472
+840-849 0308dee4bd02ce81 75fab852e747d3e2
+850-859 eee11bab22584929 83a1aaa0c03b4254
+860-869 6ee6700200cf5c09 05457966f86d315a
+870-879 9f11aaa8a7338e2b b74627975bcd0c34
+880-889 a26fc8681f016cdb 9ba346ceef9a7fad
+890-899 2899ace9eef680e6 45730f2333d2530d
+900-909 4085507f86b064ff eeb8eac22c37c2c2
+910-919 090cef7ec598d1a1 dd70fa39c13f3500
+920-929 a5b0271bbc56147d 64cecd6993ded271
+930-939 e342b1bc66777446 3163acdc486544dc
+940-949 987a823423c8dc93 f0d0ff8a18ae8439
+950-959 f178c629b932856e fad3154ff90ce151
+960-969 8b7ccaf119fa59e7 d5de33e1201fb043
+970-979 c19deb138f16ff34 db469eeac9ee625e
+980-989 c89519c6b4e8816d 0c66269cda618b1c
+990-999 1748b2b671c6f022 fc164dd0c1d09fa4
+1000-1009 d12c5235ae5b9ef3 8c078cb4d6488f84
+1010-1019 dcb58b1c4b0df9c5 4cc07848f7a31fe5
+1020-1029 9eb344cce71875d8 dbf91c5b4b44dc89
+1030-1039 5cffd3f43b02760d 7598b65ffec17ecc
+1040-1049 03247b5509ba3aba 28dddbd424223271
+1050-1059 3bcaa5443d373c38 3b5631a3b987361d
+1060-1069 a46ab4ab1c02f3ad b6892c2bd0401944
+1070-1079 bf56e9c5bb2b3d9b 22ecd65a0b741dbb
+1080-1089 34c15e991ea36ba5 d454b0e0f00afa08
+1090-1099 81ae0be5f7ab1ca0 41dc7759353c288e
+1100-1109 6b51baf599131eb3 37f21f68a734a711
+1110-1119 12fdea39ef763877 4eb81d6f4d6c255b
+1120-1129 86d0678788eba128 b8c85d991cfefb90
+1130-1139 1bc397f60cdc32e1 2b3c08f77cabf8f0
+1140-1149 00365a4f4dbfaaba f2ddd82e886f4202
+1150-1159 12d72c7f17311663 31ff65b4cfb7ccce
+1160-1169 1faf2cd1e8cdf95c 56770887024ca954
+1170-1179 dc034c57d3f27ad7 27ebefe77f73e9eb
+1180-1189 38e04238d746b93d cb2e401d444d60ee
+1190-1199 10039f1be9235c71 b8884c9594666ad8
+1200-1209 dbea93def7304632 39ea8069c510d914
+1210-1219 6284603f08bf3408 9e7feb05a2792c14
+1220-1229 eab1f058051a35f3 1f6cca100e55cc0d
+1230-1239 4f6b7247124db857 13f976fd7afe7e9e
+1240-1249 4e9177ca10e0ffe3 a3fbb52c0f5e64ac
+1250-1259 2545e5789157895a 89d9678eaa7756eb
+1260-1269 838c69a362fb52e1 b9eaf2f4f3a9de70
+1270-1279 7d106350c8104fcd 3d534f5031fb551f
+1280-1289 d0f0de3b93af68b4 d2b88419fd6e495b
+1290-1299 530059aca490e4f0 240e97c70a33da4e
+1300-1309 336219367e3e5bd6 9f637af2fa85b5cb
+1310-1319 7ef6957aff82501a b37fcde88257783e
+1320-1329 0681cbd7b3019e40 b6d58222a1fd43a0
+1330-1339 ebf744bbc9a184e9 71cff09e418253bc
+1340-1349 6092dec55235f802 c22328d857091203
+1350-1359 707f7d05f04c2707 e8412ef24f638651
+1360-1369 4df0d2a96298a901 351f8d329197a34a
+1370-1379 b68825b1ca5596d7 6b47f9f0e1285bef
+1380-1389 802c86cc11e1fb0e 1716a77e6c518daf
+1390-1399 8766ce36c9923dc4 cd7fde61be2f70c6
+1400-1409 2a223b57b2eb502a 435bb42c5790735c
+1410-1419 8c22abcfef3ccc42 38e1b3972a8cbb50
+1420-1429 8dc054c79a1facc2 eb33b6f641d45e21
+1430-1439 8316a60e7eef6413 739e52c61ae66e90
+1440-1449 b8f436f10be3056b a79a4f4716c05e6a
+1450-1459 5df407fb6e460c83 0cc2b45c7a55b3f1
+1460-1469 4498a538d957a062 d39456a7d9a19549
+1470-1479 50142a119cd31877 8f34ec3c83d3a9bb
+1480-1489 6f0afb7cdd5ba691 2a4eac5fbb62c0e4
+1490-1499 5c07d74ed5993be8 120b2f46a9b6cbe5
+1500-1509 51290ce97a7680f5 3d1b67601a61b31f
+1510-1519 3acafa859ace0abb a94d5eee2043b818
+1520-1529 242299a425220db0 a5cb00cb7e2885ae
+1530-1539 b3ce7d8e9b195d50 075fd5be1c4456d7
+1540-1549 03f25ecf7322d85e fea9b3404164c00b
+1550-1559 4cb464b12c5bdecb cd248512689b4ac5
+1560-1569 7d0fd9699ea75fc6 ea232776d2bca3ff
+1570-1579 7f4fa9592f14a744 f2af253c27ce305e
+1580-1589 b4e29a307812bcea 6f895be8b1eb000d
+1590-1599 be4a5241d5a1f0ef a34eeb94f4315cdb
+1600-1609 1e96f1806eb85aa2 b50b3aa31022c1be
+1610-1619 5daceda6585dc157 b04200cd7d42a5aa
+1620-1629 c8edabd4eead966b 4e6acb48bf54d9f5
+1630-1639 3dc638c32e3d2ea5 516895c5a69e0605
+1640-1649 8cf674866e020893 68fc1903acf39a24
+1650-1659 ffdaa28b9b894305 7ca52b4dcff57bce
+1660-1669 d20aafe27c32f02c a6ebdecd9177aa68
+1670-1679 6547afbd9a76db3e 2386264643e85561
+1680-1689 a3b2adbaa5188866 0f218b590bba0e8d
+1690-1699 152b49a7dfabb5c5 973a8aaef86676b7
+1700-1709 5e039b8957debeff 58ada83118de2ec9
+1710-1719 7d4333569f5133f8 e23e76c514657d01
+1720-1729 1a191dc37268baf0 a1b3ae03495f89d8
+1730-1739 c363b4a22dbf7a26 a9eb72624cc56a16
+1740-1749 a475d340b8c51cc3 6c6b9c7470fe0d37
+1750-1759 5f987a88449be3af b12bc0a737cc8a47
+1760-1769 66f07eb130a926e4 f5f55c99a9c6c183
+1770-1779 bb6336057f929b20 01d4c90029695a44
+1780-1789 5cf416adc4441304 c48fc1fc19feaf4c
+1790-1799 00f2dca56b920c1d a1774af24eaab0ce
+1800-1809 cba6e1db101000b4 d5d0063aeffe20d7
+1810-1819 8c40ff29ef1eadea 93001d704a7a197a
+1820-1829 b77afd740b34ed54 a6fdf09e60c2c6bf
+1830-1839 6f531835af844d33 fa16dd8f3e25898d
+1840-1849 28e79ac3da45c2ae b02ae62c683344f4
+1850-1859 cc49ac9e7658656f 6c72bdc2d29dd235
+1860-1869 0eb430cf227706a3 f354756118715bf9
+1870-1879 fc024fd3db0051a4 454d3a0dcb0c4ddc
+1880-1889 21e7f920feedbab8 d6d3464aa9512bfe
+1890-1899 4522edebdc0014d7 8a031ad2867b77fb
+1900-1909 1f00b2a13db5e611 74bb85284f8bdfeb
+1910-1919 6cb519edfb8bbc25 7420f29ab285a3f7
+1920-1929 7a346b134cebc233 620b1a90b4f47f2d
+1930-1939 47994539006b6ea1 da265732f041d1e2
+1940-1949 c78310d5f075cfbc 4d9d5dd92fbcc82b
+1950-1959 2ac84eb7f7571f2b 9c6e9529f74e1a13
+1960-1969 300be4544f46647b 5f140583ec4c1fa7
+1970-1979 8871ce43a6dcfdfa 5a38d9d893eb428b
+1980-1989 e78c731081abb6e2 fcb07036b76507f0
+1990-1999 1c7bd695939ae51e 3680f5228c0fd6f3
+2000-2009 a773f8d14a70be95 c4ece89828cad4d8
+2010-2019 a1c3ac6565c20e5e 487430ac2199215e
+2020-2029 3fc9a44b1214a318 bb0adfb04e0e2772
+2030-2039 1b869a518493999f 36ed1f80330ec0b6
+2040-2049 b6c677a2e268c8aa 56dbc314cc50ffd7
+2050-2059 e8f834e20ec184da d05cbf15af150f40
+2060-2069 2b5f92b04ff323ea 64bc5a1db5c8a3f1
+2070-2079 0737d1282828ad1c 421783dd58d625d1
+2080-2089 3dba071e7825bfbf 12cf2fefb19578fb
+2090-2099 67f91cf16eee6510 0e80eaa8a4b597fb
+2100-2109 c5c811d928811b0f f7f06cbaeb558e76
+2110-2119 c5f1929f4460c968 f6997ac29d1a3ff2
+2120-2129 36a2d359db803842 36c3ba8cca52992e
+2130-2139 d49c2a9a68ad6711 7851432872803102
+2140-2149 e7d2ffb89cd50c4c 6b82552c07dcf943
+2150-2159 2d0e91909c361a6a 11b9d816455a0321
+2160-2169 c3cda8e528cf7c1f 3e97ba26fb234fa8
+2170-2179 c85b1103ed71683b 85bcb71693d9225d
+2180-2189 ae19853227a1783f 1581333a5482e4d0
+2190-2199 72605574d3822367 0a6065a2d85f1599
+2200-2209 5299fcf54f8e6e0f c3c7b38251254351
+2210-2219 35e1a5be0f3fc827 96958ec960b807c9
+2220-2229 20403445dd17bede e5db32dddf9fd99b
+2230-2239 90c397d1369c2927 e90f82d7a341f13e
+2240-2249 04cd6fa34cc5203f 11f08e6b524f7567
+2250-2259 9fa83ee45c7ce2b4 57868f765ae85e6b
+2260-2269 9973794704852334 6e72925b1fcbaf5e
+2270-2279 e100a865e4cdbf25 e5f3fc1afdcc89b6
+2280-2289 a6c546ef8a43e3c6 45c549538a84d755
+2290-2299 64faabc620f19f23 4da263732d2902a9
+2300-2309 0fb4be7103a226ea 85012e6ecb67567a
+2310-2319 805795b0c8dec7a6 f3872fc55add2006
+2320-2329 4f4ebc8bcb702f0c 8c95cc8a99f80090
+2330-2339 32888458f2540586 485c85e4b63528f6
+2340-2349 5c5bb6899a0b911e 12c00b404c5c2d21
+2350-2359 c372c1025aa3f1e9 e25533bb07a68767
+2360-2369 0f2b22934ecb453b 4d482cdd08e89dab
+2370-2379 4ada7526611c66c3 20528728cfb64d02
+2380-2389 f159a68b680c21f4 580fb6b8b7e217be
+2390-2399 1b840be18f19f9e3 41412b47ffa12896
+2400-2409 3abca0e4e046e3a8 2bb3b6d4fcca1518
+2410-2419 3406fee9ad3cf9b9 3bd6fed06af46c7a
+2420-2429 0707824eb29ad5e4 2d35daea15cee5c9
+2430-2439 0692385ece129df0 7d99ae093095b450
+2440-2449 c5ca22f6312a2246 d8b3bf0aac28d401
+2450-2459 7e79cc17cf7faae9 2d2ca8735dff6460
+2460-2469 fb694a5634bcdad2 ad33a1480ed13670
+2470-2479 8cfed33c6b96e75b 630003d35245030c
+2480-2489 f14268c584a9c488 d6b365ab6d728880
+2490-2499 77b4d6bce50869b2 ffd23d3c8201bc7a
+2500-2509 3d86844d0b77e1b8 92401ba374964be8
+2510-2519 55883e8c850d1940 856d73c34ec41aa3
+2520-2529 a6f071b4053c1f27 05ead8c3f1ab2ee1
+2530-2539 b5cf82dba26b2566 16b9381912bf2fe5
+2540-2549 0cc0a4d2b29ee1d7 a0307a0b0fba7bd7
+2550-2559 7283c78f1da7fc17 7be2103bd838e1eb
+2560-2569 10377106b9194cea cae058909c20c91b
+2570-2579 cc2110925580ef9b d7496f5fd73ea510
+2580-2589 903d97854b486023 0f3022eafc6a136d
+2590-2599 55f30d322161f006 059990fff3d9a1f0
+2600-2609 88986637284e4fa7 aee2188468674a10
+2610-2619 05a40c485516d4b9 d7d4277b752ff256
+2620-2629 65b24319e0d8c18d 8edb29e95e8d3ce5
+2630-2639 e12e8bd7b81f5246 928dc7de4812f7b0
+2640-2649 e6caded8f46e05af 31cbde5255fd78aa
+2650-2659 c2848b9e2c8f66af af825458292988a8
+2660-2669 0d76f7f525908dd1 27d47fb6a567016b
+2670-2679 c8c6bebbe08591da 973a8a08ada4a2a8
+2680-2689 f14fb82663baf302 31468aec8df439ba
+2690-2699 8749d70a31b7a207 d5808ef0822bb34b
+2700-2709 db4f8ce49cffc4c3 8f4cdeb54383a4c2
+2710-2719 5ea502bb734898df 0113d930b0dff1e9
+2720-2729 3f948a55eef229d2 127310716ca776a5
+2730-2739 b765beb59d7a2148 68867721fa1ea078
+2740-2749 cb9a2cc15fc1e123 b2d41c1f65d3be23
+2750-2759 b4be438d99141a21 41a1178e8c7ed3d5
+2760-2769 de34e46d53effe2a 77cf9f1de31c38d2
+2770-2779 73b74b7775c3623c 953005365502cd02
+2780-2789 228860d230f0d60a 7013efe6c3eb5ead
+2790-2799 d177d57038a93d13 82670341d98f3da3
+2800-2809 191514741a78798a 5320ca1dbe07b0ed
+2810-2819 1c10d6b8c63ca86b b62ba3b54b22434a
+2820-2829 7b6bb49ac33cf968 fd541b192a9bdc2f
+2830-2839 4b11ad8e0ec2a706 c64124ed2ff521b3
+2840-2849 c39b96b5c7ce11a3 f5d715f5eb46afc2
+2850-2859 564d0d38db1d30ce 341008bcba6ac54a
+2860-2869 6e13d1bd6d754af5 24fe09b405c20302
+2870-2879 d2df8ee049e85ddc edcf71ae1e8d83c5
+2880-2889 75842b8279b197e6 0bd808119f3a462b
+2890-2899 ee48822a43893544 719d862bf5ad114b
+2900-2909 99db582ed36da371 6c1b50160211ac72
+2910-2919 711c92cfc5038726 2e0e81d0bec8e027
+2920-2929 04cf911697565ea5 b52b2c830a339bf4
+2930-2939 dd65fd81915f3893 2a88e53cebde77e9
+2940-2949 6046cff9a929871b eff461fc634eabe0
+2950-2959 e09797a030c3f28a 89070a41968488c8
+2960-2969 d7bb925e2405054a 021853c02aad3964
+2970-2979 9bd7406828dba882 cc6aabddec38fb2c
+2980-2989 8597ced8225c7472 b54ee00d5d2caec9
+2990-2999 a1becd59af1ecfce 2a18374ca4e0e4d0
diff --git a/crates/socket-patch-core/tests/equivalence/golang_rewrite.golden b/crates/socket-patch-core/tests/equivalence/golang_rewrite.golden
new file mode 100644
index 00000000..d1755043
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/golang_rewrite.golden
@@ -0,0 +1,302 @@
+# One seeded go.mod / go.sum pair + overrides, or the re-run over its output.
+# <case> <input digest> <output digest>
+0-19 992ef49d9710030e cfb61fda8ead9dfe
+20-39 2ce3243990915fe5 c3edb6138b865a9e
+40-59 704f7205375b171c deea356dff20b1ab
+60-79 b0d49f64438497f8 35d231e30b8a1da8
+80-99 9b011ce7566a4cd9 f423b388175598ba
+100-119 6b67a79750e24dd3 c39342753206b8de
+120-139 fa13c96c073cae08 dd5fc59277757625
+140-159 f31cbe6d9e2f48af f7751f4d46e49cfb
+160-179 71f6d03c2d4375d6 b85826ee6629769d
+180-199 3c086f161e773a7f d90b6bb988306cf5
+200-219 2dbfc36f5c11dad9 f2ca76820e5ee929
+220-239 0317760fdd547229 57a51f50cada0d57
+240-259 47ca04a94948041d c504bff314072199
+260-279 1223bab190d4ad17 bd88df7cc9813075
+280-299 c1f042c26aaccd3c 4d2aefec23d08238
+300-319 4b16f76f77f2864d 9cd531d6442ce036
+320-339 62f6c190d61afbbe 0a42a4908dd35ea2
+340-359 52b489087348cdfb 488145b72e8dd83f
+360-379 fe9855f9bb69c430 190a72101e00926b
+380-399 c644cd41879f5d4d b83abf8dd29041d0
+400-419 8af5995cf2f76dea cb4c682266cf703c
+420-439 9cb2e5ab58f12f52 6ec27ddf7b2f6160
+440-459 c7e8bdeca795eb4a b84ebc45ba9646ad
+460-479 69b8c8c81644d846 2a05b275244b30a1
+480-499 dc92532b559ba578 3f1068fc323b5e76
+500-519 cddbdc3dd3a98b37 89126477ab4ebf0f
+520-539 14ced69da5c9ca03 fa216aa853527650
+540-559 8259451bf283159e 7195bb2ad5f771ce
+560-579 7ce17480c6d397c0 fdbfb7b4a2a3e3af
+580-599 1b9b508f4b2c2a25 9b2980e26bdc2fdb
+600-619 8b5d18e8c42cd6ea 1b16dd536a428b9c
+620-639 e4a8f29f5416d660 746299aae8afa586
+640-659 e6cf9e271701b7bb 7e1d46b3d7ab21bc
+660-679 3fa4966313a17c0d 17c1a7a497ea71fa
+680-699 8d63e77bd076294e 6f7c47208f18010e
+700-719 513cc219e8a8e920 591d9ae3eb3ae09b
+720-739 61b704425a73b56d 2cdefa768429a2e9
+740-759 f7360fc5b441de83 782aecf2092a65a5
+760-779 02556046100081a7 0fb6925b98463b01
+780-799 6a0983ce6589757e b373be106f8aa16a
+800-819 0116b8f40912ff10 af22460213179a03
+820-839 7436226b7c79ccfd c7cad0d8d57681f4
+840-859 09bf17f22d9b5e20 f9442f31e1e0acc5
+860-879 3ffec215a7e32e97 6a53242431c223cf
+880-899 ac8e35ba6f2607c9 c088350169e4f2be
+900-919 0892f5515e4006dc 46a87f861db17c1f
+920-939 19206f8cab68c222 1b9795ad8797f53f
+940-959 b1abc86bef6b3063 95036d70702b674d
+960-979 91a059a20d7961f4 44f9de049d21e73d
+980-999 6642fbe828ba9cd2 d43c047c8e275f33
+1000-1019 c26c202915b06bba e0a6ec5c97a8592d
+1020-1039 6170e2fe8d9c912f 88aee1438b50c94e
+1040-1059 fd983dc3174b36b8 24684edd7716877f
+1060-1079 1fcb1a9b156d83b4 e1b7424ba9ef6ec9
+1080-1099 38a227b69e3f6ae7 df222dc1d2d54d6b
+1100-1119 aadb6db6a158c49c a2bf3a2413253bc6
+1120-1139 1d5c7a423f733e7f e88efac8a1d8fe97
+1140-1159 92d9937cfda2ee21 bde79afca1477a5c
+1160-1179 9e28ff14a9791a74 4a9903bbe7d70032
+1180-1199 509a63f5377e1151 240546a2e45c5176
+1200-1219 1da3d2d5deb1cf4d 94f1186fbf9534e8
+1220-1239 51076902255b8813 81e23f1618825680
+1240-1259 a0b4cfe41f3291ac 1f45e1b11eeed1c1
+1260-1279 a1579b39d5ac7bbe f9c7eb8621d19ce8
+1280-1299 50200bfdc43ebd0a 2f502cd2730a60ba
+1300-1319 63d1f540aeb16e08 5581b65992d7291f
+1320-1339 86094c70406465d1 1a46b7ca1c33bec4
+1340-1359 c190dc1962aadda7 50314a84cb4c34a7
+1360-1379 aba0c23280634c9d 1470099826b24678
+1380-1399 0c86117c7a8f6528 b170fa1fafb09bd8
+1400-1419 aa4e979509698703 0d5cd8b252c101d9
+1420-1439 ac96380695cc241d 143b770f5efad8d6
+1440-1459 0b118514502af233 e461b52e9bb976ca
+1460-1479 71574ed1de3c6fb8 1caf8de27c216844
+1480-1499 2a9f6c089e179107 8e05bc21621b9686
+1500-1519 51e0c4b25e9a8741 929207ed9c42ecf6
+1520-1539 3f07f8546c8a88b8 acf0aed035f2ced9
+1540-1559 65c47245e00e3248 40565518df5f1041
+1560-1579 262f06c164e1cdd9 0c152f1b70a666fe
+1580-1599 ceb59f6639170e68 28e462491ec7c339
+1600-1619 eccdec2aeb7ef8a6 7c95e2375ca33fe8
+1620-1639 7ae7ef0cae7beecd f605a841239d7e61
+1640-1659 64596243610d935c 2cffea8ddd9d7acb
+1660-1679 f3f85177ebff3596 fee585d8cc18b5e2
+1680-1699 f4d3a33eda46bd7d e4ceba8b3767815a
+1700-1719 6054aec27ca858cc 50d69bc624425367
+1720-1739 45747d9290d0b0e9 fdc70d133fedab31
+1740-1759 8be8445798522ab7 414361bca975f14d
+1760-1779 203ce1d018cef4f9 f77b13738b0c5f28
+1780-1799 c4df65f9a3f11d48 850ecbe9fe772b02
+1800-1819 a384e804075283ca ce017362903b025e
+1820-1839 622bba657dd878e4 94283822d37e12d1
+1840-1859 f21b43a074bcc250 a71f2edad771522c
+1860-1879 37945653458c9406 cc2403b2a07e596f
+1880-1899 cb37ec60958d9bf6 10bc42e84df79ea9
+1900-1919 15f5f89601876636 fba3fbc9ad42d9c5
+1920-1939 28e570f13772f19b d4bf15f5512dc58a
+1940-1959 d773904bc29c8b01 179a50c2636720b2
+1960-1979 40f4e598f5ab04c9 69460bff89154908
+1980-1999 8c645c3cdd0dd7d4 c68fe56d117a4016
+2000-2019 325f5116c5754a2d b9656e64977d389e
+2020-2039 bfc90eb7a13c4cce bd4ce7c411b8bd60
+2040-2059 9c697af9321c0fbf fc73ecc9611f5448
+2060-2079 0e1a904d1979e5fe b8b991071c615a07
+2080-2099 c9a673de487d54f9 60438646a0cebd36
+2100-2119 ab3bbcf1e7e21465 b8bade9d59bf7a0b
+2120-2139 2f3e4728c4f25b1f b9e7fa744da8b777
+2140-2159 6b1cb1ef5cabfebf a582bd3588b38d67
+2160-2179 11542938b082a1aa 38c6a7f76dcd064d
+2180-2199 0d02756f72dd9a52 6cec852148533d75
+2200-2219 547f3442128a0271 6683626fb2c64dc2
+2220-2239 70bc1f23691f0ff0 adf628baf7f12376
+2240-2259 99ecc1a8a93d23e9 b17d44d8ee4648f3
+2260-2279 8b2db3ee961a62bf 86ff90b276dfc3ee
+2280-2299 80dd7fdb60bc437f 4568fe441859ef5c
+2300-2319 8bef847fa812bd59 96e9d3b30a8b7e88
+2320-2339 da479c323a75e58b 64dd928266b63e3c
+2340-2359 e1ebf237fca7e63f 3a95d5999b55a01e
+2360-2379 713533f28a620f7b 1dc359eccc56047b
+2380-2399 af9ffc0b144883a4 8633d001257d352b
+2400-2419 77254c03fa59c43f 5cbc35f671c19101
+2420-2439 9596efaa79f07823 6be4ab4f8c9f82fd
+2440-2459 756ee3683a4a145c d803d2c6cd8e0a04
+2460-2479 ec09dd2e975c53e6 a9442198de3b5f40
+2480-2499 58132e884769dddf 7e7711e2b7dc57d9
+2500-2519 652f64025db8cb2b 542bcb404f620d7b
+2520-2539 8247444203a95467 8516b1a55a0d0dce
+2540-2559 2b65764d411b1c6c fa12f0b58a30358a
+2560-2579 df7c8b11820cffb0 421256d8fa63cdfe
+2580-2599 9f129af92ef3ad33 9dd64e42d2fe0ba9
+2600-2619 11d9d5bbc94c5985 0cab1dda6ad3b656
+2620-2639 c8a360230ffa3fc3 7047b7c6b153a1fd
+2640-2659 fea790e433ad8bbb df8d1366b3cb659a
+2660-2679 5410dfc3052a398b 20873d49e81a98c8
+2680-2699 2004c847fc860283 6a666541861aa02f
+2700-2719 a2c1a218bedd74dd 7d7cf2c84854b1d5
+2720-2739 2a2c351e51e23298 08d273563119e9e9
+2740-2759 1f09e83451e3c831 0250a58a991b9804
+2760-2779 f4099378b1fe076e 9bc0b3c900776430
+2780-2799 ce182a92235c7631 7aad80adb6b342fb
+2800-2819 131487c221ccf2bc 7284f342246b1cf4
+2820-2839 712799bcc42c6179 e6c631afd83c28a2
+2840-2859 6d7c6697a0645359 7b0ae492af2ee4ec
+2860-2879 5057d868f431b7d7 e35226f8ec2e1394
+2880-2899 7a8842e5b6591dc8 241193774e2e8d15
+2900-2919 8a80ad707c1a33cc b70124fa7e4107d0
+2920-2939 8338b88e435ce264 8c6e765cc702d976
+2940-2959 4b1d3c03c9038dd6 0c7c8a3b9ac74e62
+2960-2979 3b387441fad83e36 088be9ba44587183
+2980-2999 8c827f840a5b9ed2 38c6ba7bb6d403f4
+3000-3019 3c030faf6bf52d5e 2a4a7d42c174f71e
+3020-3039 bf3d5b73c5f6456b 64df250943e3e19e
+3040-3059 e749881155dcd0bc 74cb08f1de3dbeb6
+3060-3079 b7c0e27f547a64ee a079b9988ed26451
+3080-3099 edf834bfcf47cd6b 652436ac09baa89a
+3100-3119 e1cd525268dc583b 9b036621cbdca3b1
+3120-3139 82a81da2ed139600 ea48dd2f42153a4d
+3140-3159 f7e8513ae78b6059 5f155bfb024ddf42
+3160-3179 f0313ed29b76b2df 39f4de3896ff0436
+3180-3199 96d2c3b6df44a45b 57ce774acbe547fb
+3200-3219 59c6694b87aab4fc 7900dfb72932b73d
+3220-3239 7274408356878e0e 8bdee012561d7a6e
+3240-3259 b980673459f2ff10 1e0f907dfd49a19f
+3260-3279 f68c7e5a05d0945e ebff3bef140c0052
+3280-3299 9b654554e18c8577 e491dcbc31da78ab
+3300-3319 81f3c893279db890 8cd83afe6c778aab
+3320-3339 e4c5ed75090fb3ee e8537c168b72c2b5
+3340-3359 5f80b158db41fc45 36160f09d10dc03b
+3360-3379 59e7c20847d90a98 4b68b91e4d36d229
+3380-3399 c339d408ad1817ee 111bc05fa7f1df1e
+3400-3419 5e68af54fcad599b 0bc85b065f2bc9d9
+3420-3439 f0ebf2a3d9bafa14 ccebf5900bb58a01
+3440-3459 d5df1f88ed55c0c4 02068ee2de04a1d6
+3460-3479 bd67c9e387a4e062 70bddf1ba00095a1
+3480-3499 52f54b11e3386e5d fd6f5e5c577a9dde
+3500-3519 896f05102f69aca2 84e0dfe27c056050
+3520-3539 8bfac158e47a218f dfcfdd2918a22f8d
+3540-3559 46a3bdc6544b19af d74b9d10156600a7
+3560-3579 e7e06fc8e9261029 9ae65ece43e91f48
+3580-3599 0e791f2e1cc88b5a 0f58e22fc5107c38
+3600-3619 b8f4e43b0709505d 8ad25966cd0fa340
+3620-3639 445425d851190334 e2a4c24df2d038ec
+3640-3659 b2b08ad8d0acffbd 446d748f1a2b50fd
+3660-3679 146755ee55b5ef28 20333853750491b4
+3680-3699 38d47a253f4a909f 1e14742b592c70bd
+3700-3719 d41cfab6800120cc a5fb611a8bedc31f
+3720-3739 e1608a68de7441bf b1ab2a8ab9262785
+3740-3759 f4dbc964f3c4abcf 72cd75867e028f90
+3760-3779 d14cf9f38e2133fb 62300bafbe0a48d5
+3780-3799 d63c1379cb42b31b 902ae86fe793b654
+3800-3819 9835bc7593be9cbf 785946aaba05529b
+3820-3839 ca1fee48b41c2890 bf05d1c5efbc63c4
+3840-3859 0f32ea8f73ee7cd0 9c28b46e6e357643
+3860-3879 f8f366c01d82162e 044edc635d100ab6
+3880-3899 ea682a566eaf0791 a058991c988c5c3e
+3900-3919 d157be480d78eb3c f27e8a606a70435d
+3920-3939 47cc145383d3fdf8 c0ab2e1c88502cdb
+3940-3959 f9953fe25a08413e dd800613d7973538
+3960-3979 a551fb3a244e0f04 b10fa6ef246bb0de
+3980-3999 1d07602893d4a382 c0769de641815cc7
+4000-4019 39470cd0c337018c 3772314334a0dd8b
+4020-4039 bf486b2c6e1e5b22 a4ade9bddf4666cf
+4040-4059 f8bdafdae580eec7 1272e8590eda2076
+4060-4079 e46d9ec764ea5c89 c3034badee686879
+4080-4099 ca68f60cc2248338 2b99403759b0e59e
+4100-4119 030ddcea61d13f54 103b69b11098e942
+4120-4139 c2194fbf8ba83cf9 d2ce37345e5e7206
+4140-4159 bd59f9bbaece8982 286cfa254cec65b3
+4160-4179 8e75aebb357d6e3c a88799c32f30cf02
+4180-4199 171a4c5201072c5a 2798f9af5548b61b
+4200-4219 1d1865413a196205 e5d1105796f197a4
+4220-4239 21e9315592104765 49a59fb15998115f
+4240-4259 8681c1c1be57d7e8 fa96ea6a21fd03b9
+4260-4279 2a1b522ddc623168 2016cd5cb2906b17
+4280-4299 3da724e31c6521e9 23e7900cd270556c
+4300-4319 00654f50f2a1ede0 70da790feb208091
+4320-4339 0a13de4f5a403c07 23d77cc04689af6f
+4340-4359 f546fd1859a3093e ea810be1578a3f96
+4360-4379 9e7c48ef22caeb5c dd6a284459c761c8
+4380-4399 b77557bc30305080 34402c13ef42a82b
+4400-4419 910b759e4947506f 99913ba0c1e61b8c
+4420-4439 99cd2b9d7b54c993 ac361f4103c273ad
+4440-4459 e34ffcb1b2142279 53c9c7d2d5da0a15
+4460-4479 d94e53c9b74143dd 140440d60ae8008b
+4480-4499 be655bbf1a4d09fe 92656a99dddc903a
+4500-4519 9d814ba00e980505 6919b6dc30c06829
+4520-4539 68c9a78410c0ace7 5cec0a9cb7c89c91
+4540-4559 bab8c797a71050db 12a75d6d13a6343b
+4560-4579 a59c8c8cecd95029 1bdaa52fea5d55eb
+4580-4599 f2704adbd3b4eab9 ac7349b08398f51f
+4600-4619 6e7629e24839e3de 8fc6a9dee9d05961
+4620-4639 05ddb6a8460e9786 9faf9bbb31aed006
+4640-4659 86995563c98fdd85 995fefdb0f324ec4
+4660-4679 2c3bc42638b1821e e84a1574bb036af4
+4680-4699 fa6df29ba8ad2ea4 7652fcf1a56176d7
+4700-4719 aadd8ea33382912e 615c60f2393d4f70
+4720-4739 6841e2f5a6f5d22a 2e390e437a522b3e
+4740-4759 d53a1fa7602a0513 c6ccdef36502466f
+4760-4779 8ce786d22930e70b c0b37c7a143a3edf
+4780-4799 aae811e20ed8d7a9 64fae785627df52d
+4800-4819 367cbd238adc9c04 1886f56ed621c61b
+4820-4839 14a41d8f4aad31cc dd0a5e5a935c3e6d
+4840-4859 a69502e36a96e998 4675b6ca088c79d4
+4860-4879 fed731149a8fb1a2 b43d9dbff6c5c9bf
+4880-4899 7072d14150fc2925 974ef87fd9aeceac
+4900-4919 7cf6889887bcd482 4bb995089cde4df8
+4920-4939 fb7d3832ccd8a60d 61463f2feb6d1826
+4940-4959 cc4a10ad9cc4ed1b f2404cf60e7f6340
+4960-4979 b4e4dd8234f05604 c29823e3c367decc
+4980-4999 9a740f223cd59942 8d97a2509cb25486
+5000-5019 a3ba3103e8b572e2 54524839b1534d54
+5020-5039 fcce96eb5e5d5224 d1bd7294f2ecdd70
+5040-5059 6c4c9b0240c57867 e560f903417c68ee
+5060-5079 9d08fa6d4ae2edb4 266455f3fdc5c57c
+5080-5099 65c3eff34c7e9d55 6c6292e0cfc6a5a3
+5100-5119 36a28822cd75dd54 a397491371232aeb
+5120-5139 a3b940ec544f8a8f 0f3b5a2ee6e4659a
+5140-5159 3617eca48adcb41f 95a6c1648e5ea937
+5160-5179 b165ad021192aa97 a4ff4baf5f86214a
+5180-5199 787f7b8e06932ea5 54e539dd5249876d
+5200-5219 d9c93081624bf463 d48214b6ddff9501
+5220-5239 adf844cadc992c23 c97d8febf6e11114
+5240-5259 fd54880a9ce740b0 a7450e8e95b433ce
+5260-5279 db9c9f65f5dfb9ad ae6e154761851200
+5280-5299 bb79fd88e738c46f 2ab48dcfac880f9e
+5300-5319 7fddda4649deea19 1278ddca31068fe0
+5320-5339 3ff30573ca06f507 a7274e347681ab0c
+5340-5359 4e213dfece0d3540 c85136fdb7f1035e
+5360-5379 0dc1aa71781b3ee7 689db18b00385c88
+5380-5399 6451f434ca9bd51f 67f663bc7930a60a
+5400-5419 b6871f1c69f90df8 15b5b8ea97b6ffa8
+5420-5439 aae08ac202d750ad 891c2fcce0111481
+5440-5459 fa585eaba8e238ac 46f979b52998c963
+5460-5479 5c5ae33d6612c848 a9b6c9bf021d1d8c
+5480-5499 f4c4a38bce615fad 0197c65d7d5e9507
+5500-5519 88618381193cd78e 69eb73156a3264fe
+5520-5539 56d2d0154a578a5d 750fd9254014aead
+5540-5559 dbc46201eb322ef3 d6c563b37eca9ebe
+5560-5579 8e20d233bc032828 4fd246d9bccde25f
+5580-5599 f30fdc065a509772 a22cc2cb6cb0eb7c
+5600-5619 3aedaffc3ee5b52d 67e38fd702f3dce0
+5620-5639 9fe5c0a391af04c0 ae2e13021e3303ad
+5640-5659 93330ccfd77962b5 a8f270df47c51c46
+5660-5679 4190093bf17da99f 45473bae2e0554f0
+5680-5699 3fc3b812649bd56e f489ab55e8959013
+5700-5719 c1781c0b8636a549 6d5bcbf2baa65fc2
+5720-5739 9c5885f35c9a31a8 63d53c5bfbfe00f4
+5740-5759 f57706c708958d95 1bd8934657451ed5
+5760-5779 4c0011a64cbefc67 14246ff41137c94e
+5780-5799 a7ae61d51de7b3a7 196bea4b293962d3
+5800-5819 40c3b8d04849fbd2 eac9869e7df702b1
+5820-5839 705eb6bedd5bc7e7 596f95c6c52798ff
+5840-5859 7dd46b7ea04800f8 6e514013e4d0f5f8
+5860-5879 85b9ed84639cb2fe 89e3dbbbf5576f69
+5880-5899 9cf04174c0f52c82 d0ebdde22c764214
+5900-5919 27bd9015ce0266c0 bba95be7aebb7f90
+5920-5939 ff4e6413e26667bf e22a156355b80a01
+5940-5959 e5ae669220e6c62a 88d2d62e74f3eaf5
+5960-5979 f86a9bd60d59bfcf 1969aeb02e50e4eb
+5980-5999 92856edee0554d49 9f0110999cfb357f
diff --git a/crates/socket-patch-core/tests/equivalence/maven_pom_project.golden b/crates/socket-patch-core/tests/equivalence/maven_pom_project.golden
new file mode 100644
index 00000000..8bf776b6
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/maven_pom_project.golden
@@ -0,0 +1,202 @@
+# One seeded project-shaped POM, parsed for its coordinates.
+# <case> <input digest> <output digest>
+0-24 a610f5814be56477 732b351a8b2cca3c
+25-49 cb404a6a05a570c7 fd3ce74eef75c5fc
+50-74 0c29406ed49bc10b 87aabca1a8a6a13b
+75-99 559412d885e6b427 d8413303a8652ad7
+100-124 83f5c9670bede1bc 142468508abba53c
+125-149 25d77751a99decf5 0081d935e085a0f6
+150-174 250465c930959d70 0b6591a25467ea39
+175-199 e33516c736ba9670 72406b197f6fb5b5
+200-224 8534bedce8f516cb 8bf996426c8923a6
+225-249 2975407ac1f49d10 c2247e6cc0749184
+250-274 01f45865ec17cf8b 4e716e61598ef15c
+275-299 c8766f54478aeace 980b442e958584e2
+300-324 a653c188efeb5c13 0a60dd568d845e23
+325-349 a5a8567e52df6d55 f48218fb66acf417
+350-374 ea83f43ae67ef0b5 a40437ad81fdde70
+375-399 59a64fe05a3832bd 0b1c5e4b1399a89d
+400-424 4246179c11d7b06e 9a8c12e753da25a7
+425-449 5031666d8204073e 8dd187ff3a4bf2f7
+450-474 6693e59d747fd54a 48a41d59020985fb
+475-499 c98f16980ad73a7e da2f970cd20e9a13
+500-524 417729e81ccc196c 74b27cf5ff7a98c4
+525-549 1c92d7ab9e3ed63b 5dcffd21b0ef0c22
+550-574 5b6b5143ae9e619c ab8e62845db6af60
+575-599 d28000307c7e334e 44600f1ad46d3892
+600-624 21762a2a4a58048f 6ddebe9b1329338e
+625-649 5e85a2167a059f27 f49036f82a9c9721
+650-674 4b5309304a5ba565 a7e627f236d0312d
+675-699 01bf15179e0031bb ec0363db5199dd25
+700-724 417dd1767c3ae775 0813af4d484c9a33
+725-749 67931d2b6e1cd68a a894ac960128c575
+750-774 278c3b6240d69311 f4f35702735beca8
+775-799 b98d229f479c5c7b c5a1df8152683330
+800-824 ed99de308882d930 b11633a01420721b
+825-849 43ea18fcb258c6a0 5cfd30b67fde0a50
+850-874 9348f14d2022ab2d 8981fd2dfa55983d
+875-899 259b7261dd6b6536 c4d461ce4fea3e7d
+900-924 3298b305d39a5d42 732c22f847ced4c5
+925-949 0978990abc91f342 d832f29ef5227aa5
+950-974 c4ebbc9881a88c1c 81be9a89d66424aa
+975-999 bdd65f6c964e03c4 71b7de7715d35271
+1000-1024 3f0c34faf4937556 ae53750a30241b09
+1025-1049 40708c8c7acae580 871efed5a2562200
+1050-1074 733080f3849a569c 3ac587cbc46cea29
+1075-1099 bd034bc1aefddb6f 329f656662abdfce
+1100-1124 4e23b27a7dd50ad1 72c3ab9e69b70909
+1125-1149 8f73c16084832815 e240e6038d71ef83
+1150-1174 8958bfbbcc3a8f84 a4f5731151b25da8
+1175-1199 ef1af7d7180da213 79358c1b8c25ef51
+1200-1224 97675c612e59bc50 9ac72e758370242a
+1225-1249 d1bddb3de70044b9 fa4ffe438f7727e3
+1250-1274 d3fc03c03d8d377d 0270dc471621bd83
+1275-1299 129df415815b540a 0e9a712d5b1c6ebe
+1300-1324 33542aa7d105418e 45b1b3b186700252
+1325-1349 31e354fbec00575b 879ef6f991bddf0d
+1350-1374 599fce9cea41248b 1636edadf3d12449
+1375-1399 a3ad71fc77c7e3a6 9b72e91a3f1fdd59
+1400-1424 1ef2a0e33e69353c 0397b290bc032adf
+1425-1449 d5cb58ae69710b17 07a7b87d37c81369
+1450-1474 086040b190869a33 dea36efd6701bd7d
+1475-1499 d8047365340b9ab6 407d6073c0d80df7
+1500-1524 f64e9f0017aaf002 30a3fe80a95a3dbd
+1525-1549 70870bae91e3e037 b048796e0c2c9271
+1550-1574 677542d7e12589f9 384555edc78e1d0b
+1575-1599 f8abf9fbfd47723d 454351e337c2cf79
+1600-1624 31e60433ac8f9dd7 bbe9a8def52a87f0
+1625-1649 a314802e207b0dbc 031ec828570a469c
+1650-1674 bcf47bee223782d0 4405872e846c77fd
+1675-1699 d4a86e50883cab75 1dd38085703deaa5
+1700-1724 2fc739930dcd61de 1e46c49b0b81190f
+1725-1749 115ff5d5d0dd12d7 97ce1d915f9b2c56
+1750-1774 113bad72a949ba7e b4c87574651738d9
+1775-1799 08514ea59828cedf 06354532c9fbd15a
+1800-1824 7a333eaa20086008 68371ec0b7c59feb
+1825-1849 fa6d330faca83e52 1be9e48943d321e1
+1850-1874 7033e1e9c1cce1a5 914b592320200399
+1875-1899 9d40149e0ecbdbb7 b0b5e6e1df9312df
+1900-1924 c178c682b5eb0b7f bf3f153906951e88
+1925-1949 38750ad6e01ca297 b38b23a611d4eaaf
+1950-1974 7d76a03e300ee434 0390891afc275ede
+1975-1999 11a8c602c4f59a05 5569819cfeadd971
+2000-2024 6c92a3d2209da284 9a039cbf43d1f351
+2025-2049 687de414714c4943 40aa15ec0594f895
+2050-2074 bd094989a3055e01 cf9f722e86c2899f
+2075-2099 e2c089c94f3d6f2c 98c8addd973014c4
+2100-2124 c558891b1927c07f aacf969d770d61da
+2125-2149 81fb71b85491b14b 00b3c1c26b9f0095
+2150-2174 f008d2f1880b2d89 bf084a134e570ddf
+2175-2199 624d7d126108f2d0 2bac95cf11ea69c7
+2200-2224 a7ddb2c9ffd85376 e7fed2c725d26020
+2225-2249 8f14108e8cf142f4 adefaac9e985c6c7
+2250-2274 c44bf87ef351d05c ff60d637a45f1467
+2275-2299 ba0e734028458784 a776502a805ba719
+2300-2324 c0c7aba9c4be593a 5571b3d6493067d2
+2325-2349 424170a262ea6a8c b0dd37e0658874a4
+2350-2374 4c27a1dcb0f48c47 673195f0cf07b979
+2375-2399 1e0c6b24369c0132 a1e8e16281025388
+2400-2424 521364dbc2a5281f e8cb742acc703004
+2425-2449 6265053c0a81c450 d759275a64edbf94
+2450-2474 f49b013a481d0c66 83315cf018c66b8f
+2475-2499 9f73ba97ff7711d9 10d806b00923e9eb
+2500-2524 5de86971e44e9c2c 474423ee3d15169e
+2525-2549 1c1306be8ce0becd 45ebc1e3540b46c7
+2550-2574 6455ac0e298e77d2 4ef9a540816a31c6
+2575-2599 1189bf7911427cce f59cd4f0c2d6ef6c
+2600-2624 a274d063a758fdab d6949ed1d372aee3
+2625-2649 fc7ade3099dc3988 1f62061d08f9edfe
+2650-2674 29811849cf88b54b 280e057179293cfb
+2675-2699 5725a1f7caba6dd2 8e7b05f583d5e2a2
+2700-2724 e0921138a6069211 a2aa2d401396a074
+2725-2749 a384c2a07fa14889 73d7a9c41aee856d
+2750-2774 9f2c3e75a192ebda af339dfc80243ea5
+2775-2799 8a7fd032e84531f5 5b8e4acbe6d3a00a
+2800-2824 24c117a0938dd6aa ffc3c98e6121b532
+2825-2849 97985dd00cf58975 581a5449b3ff0719
+2850-2874 39c1e0bd1b0f348c f8b29279e3de0ebe
+2875-2899 ad5e4d76ae54aca6 a349af10953b9705
+2900-2924 f5a98fdacf7cb014 ac4c197f609db15c
+2925-2949 02ced22ed347ca76 282f7dc0cd7cfaee
+2950-2974 63f4946cf4613a02 9a4d52aa95e023bf
+2975-2999 44d0b92f39db1755 0e7cdaaf264ff64e
+3000-3024 5d0dff4eebf2307d 797c4b59e37840f0
+3025-3049 46baa70b2a2c2e16 2921afbfdcdd6e54
+3050-3074 e753ae3c99977770 9cc364c0d9a3dc0b
+3075-3099 f60071661ebc0c8f ca2d18f44404984b
+3100-3124 f4c9360af48b440f 7af240a2640ea87f
+3125-3149 85407f92e8d4b060 bd145d4f7fd240cd
+3150-3174 dc0c1f3a339ff5ea dd557f80b758e128
+3175-3199 39def0120ef8bd96 be66d6f095492fd5
+3200-3224 47239a7be8a853d6 1035b9b99ecb69b6
+3225-3249 91c3c522fda4bba9 b221fca469a827fe
+3250-3274 6dc078e3dfc06b0c b75ac4e8624fd4ee
+3275-3299 79b85f5a1e50cff2 f2175b4594a23512
+3300-3324 a1b78c9ac96d5d28 504ef969bc9b9022
+3325-3349 8eac57aa3b36a589 906d5790e1dc47d7
+3350-3374 3ca7fbdde7485b09 04ee07a9de9474d4
+3375-3399 51a8d8015b62bbef 75fb3cd95f69e452
+3400-3424 9af28124abfd6a31 1443d5889a2482c9
+3425-3449 bd2644905284d3c3 8460306ffc6efc9f
+3450-3474 51a3a0e4ad44ded3 76d93179d8cdb60a
+3475-3499 c65e07dce54ab62e b2e298cc30050e33
+3500-3524 f9c7a57428eb000b c857dd9d76d14aee
+3525-3549 16b95ba98d3c629b 026a66706018cea8
+3550-3574 a89606d166adaaa1 ca60b9744572abf9
+3575-3599 e0285c98fcb36940 82bbc2e1803afeb4
+3600-3624 ee7581d050ef4f11 f9f8fc40e50539e9
+3625-3649 aa6f7ac119966a03 1f5c2f678cd46782
+3650-3674 533a9058644215cf ed8df24927540681
+3675-3699 b7c58b5494424e72 8e3cbc975614906c
+3700-3724 422a864ec933ce87 83dfc920f48b6c63
+3725-3749 27a8e5b1ed17390f 9ff0705542ff85d9
+3750-3774 37646dfa5884c996 9bdc9a2f4885b927
+3775-3799 17e51d1f7bfa8dcc 2d3ac89642a369de
+3800-3824 a42c87a37c418f7e 7c22b4e77064375f
+3825-3849 ba92d46512ecaa48 7195a05d067dc684
+3850-3874 4e0f257695d60b86 a61d616218326340
+3875-3899 dfff10713ac19342 f4ab0af228ec6f5a
+3900-3924 6a6d0795cd3ab92a 6a875aa1ed07756f
+3925-3949 39c0aeabe7fa7167 50f75144a1b850ce
+3950-3974 a40cae34c076f499 23891da0e0f5599f
+3975-3999 8cee75c9bbf423b8 a4489715ec91dee6
+4000-4024 c7b4a60bd5965916 4986b87884052c23
+4025-4049 793e01cb333688ae 66a4dc9b0699ebc4
+4050-4074 b8f6467ecaced076 42196aaf9ce369ba
+4075-4099 5839526b747a24f1 fa409f5fce794cb0
+4100-4124 4b144f8b6cf32dad d7df7cba966c5e8f
+4125-4149 f76a52b0463d6990 0672da719c4723ba
+4150-4174 297c8766905145b5 e48068db04b83d33
+4175-4199 57829c0edd537317 385b5288f76758f7
+4200-4224 8409611444c6efd9 3765a5d8ecd98d1d
+4225-4249 dc4056f30f39bbb3 d43568b9ab2c37b2
+4250-4274 658f104ded7b342a cb80390b87e36639
+4275-4299 9e06c0f9828d1211 32772763d5cf9058
+4300-4324 7bd7cd738d223f6d 1924177f7d9cba95
+4325-4349 1adede41a01cf174 2484595687ff6cd3
+4350-4374 0db0ae36d387d938 d0d354d53140fd35
+4375-4399 7f748aae1a4675f4 552ff7115328bc60
+4400-4424 0eae5f21629b09b9 07f4ad54e69f0101
+4425-4449 96900510ec7c9c3e 5cad185fd9e81886
+4450-4474 8c3d9fde4c4703ec 809a92acd28c2cc6
+4475-4499 28d01b9db566eebc c774243163da4021
+4500-4524 7d1b219877442a96 3ee75f377de60ffc
+4525-4549 ea457c638c810af5 0ad6d6626414cb9d
+4550-4574 02df6dbf69324b6c 2f7b615eae72f448
+4575-4599 f73dc28476ed6264 9da06970d3de7c63
+4600-4624 98b1a03ba68c18a8 4ab4a5b3cb6c4c37
+4625-4649 1684efa4f16080c0 07ccd6a3894ff168
+4650-4674 1b688c4763a0feba c2984993ab38eb37
+4675-4699 187df5dee75c5fd4 0a1683363c55f355
+4700-4724 b9acc2c2cc852e82 0b0e8f9deaaac737
+4725-4749 01a66ee1fae4433d 3e3e696b8b473092
+4750-4774 30ea6fced6cb893e 95abc03787eaaf23
+4775-4799 84f68c4dc8b7e4ef 3e6ea5e5eef18177
+4800-4824 bd59448b004b91b8 ab57f07ea79513a8
+4825-4849 fe2d0717c1d1bf94 bd262d174383e276
+4850-4874 d809a89766161545 8fff219ba1b02134
+4875-4899 fd36c7fd32a4d3a8 8dcf72f716686e56
+4900-4924 2c60e8b78e5cc57c 835ff7304055929a
+4925-4949 9867b6c5017b757f f03f23cfd82650e3
+4950-4974 9af3cca9bed9c4ed 659717628261f1a2
+4975-4999 dc0ce190698ce4e8 c2e432643acd8f07
diff --git a/crates/socket-patch-core/tests/equivalence/maven_pom_random.golden b/crates/socket-patch-core/tests/equivalence/maven_pom_random.golden
new file mode 100644
index 00000000..8036acbf
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/maven_pom_random.golden
@@ -0,0 +1,202 @@
+# One seeded POM fragment soup, parsed for its coordinates.
+# <case> <input digest> <output digest>
+0-99 ceeda62151aa3e16 fe38e292b8adf574
+100-199 77c8562558e9552e 6d4fe2defeeb46e8
+200-299 ad4b7721cf741277 6d4fe2defeeb46e8
+300-399 a1f14bc33c78db8e 10d9d43fadbbe19a
+400-499 40a4c4025c82e3bf 1ea4903f73b31c0b
+500-599 8644a9e4b8e5cac4 5dfe0126e4a52e0b
+600-699 9a66c87ea7570852 229fd3e184570ab1
+700-799 82518d66ad970a1d 6d4fe2defeeb46e8
+800-899 a26ef5a3db858a94 eb35950f620a95d3
+900-999 f0e259b40bf56549 6d4fe2defeeb46e8
+1000-1099 82028d957345826d 6d4fe2defeeb46e8
+1100-1199 9a4ac4cdf562b771 6d4fe2defeeb46e8
+1200-1299 5626bd302fac539c 6d4fe2defeeb46e8
+1300-1399 55c7d939fb2a21f4 0e2831d674cd77cb
+1400-1499 1b2bd5c98615b4e0 04091012afe8ed0b
+1500-1599 1555f01c427f4c79 6d4fe2defeeb46e8
+1600-1699 e4b02340c8093b84 7268f6a7215f5317
+1700-1799 1f1395e3768115a8 341a23a09222b9f9
+1800-1899 421d2e143c9506a8 7a501d2b9fb09bf7
+1900-1999 7aace17918df5c22 6d4fe2defeeb46e8
+2000-2099 49fe81fb1f9a3c5f 960961d974284703
+2100-2199 f2090f3a5d3706a0 6d4fe2defeeb46e8
+2200-2299 b12426823351edd9 fcceaffc12ac855a
+2300-2399 d081b72558da0ef9 1635f3bb4895f289
+2400-2499 5722caed0a98f5cc b307c3841b6cccb3
+2500-2599 15e5bbeaa500ba4f bebc05768366a44e
+2600-2699 0ab509b624dc7d17 6d4fe2defeeb46e8
+2700-2799 86711b8c9cb3c11e 6d4fe2defeeb46e8
+2800-2899 f8825c3332c7fb91 3aad227d107eff3a
+2900-2999 00214e86be09a10f 6d4fe2defeeb46e8
+3000-3099 acc019432453d12e 0703338c1b240c3a
+3100-3199 a4377ddf0b7332e2 56fb9d6f5e267fd2
+3200-3299 c3d2a4097a0578a9 6d4fe2defeeb46e8
+3300-3399 7fe5af45c1e40d5d 245c172afad22320
+3400-3499 b76b831c8240d53c 6d4fe2defeeb46e8
+3500-3599 0cd462648f1ca732 6d4fe2defeeb46e8
+3600-3699 b8beb692c9bbae71 212a0ae491712f95
+3700-3799 c61c54e2d41f21a0 6d4fe2defeeb46e8
+3800-3899 765694bb38d23d38 2d39184f113a3512
+3900-3999 89942b22fd7b2dec 7268f6a7215f5317
+4000-4099 6b5306fe59d0be23 6d4fe2defeeb46e8
+4100-4199 12c0c4247621df13 6d4fe2defeeb46e8
+4200-4299 2ac0f72474cb735b 6d4fe2defeeb46e8
+4300-4399 ebbe3397ab914690 4d6572ea7e8250cf
+4400-4499 d15d1fcd066b2b38 6d4fe2defeeb46e8
+4500-4599 68f67c6e7a9b7bbb 417464b310a339e6
+4600-4699 165a9ef7063e8510 565247e496a34b72
+4700-4799 0d1339b94bb87a11 6d4fe2defeeb46e8
+4800-4899 9a2132f333bcce62 6d4fe2defeeb46e8
+4900-4999 70f11e20b601d113 6d4fe2defeeb46e8
+5000-5099 6056a9bed0e63ebe 9bc76f00fc324cdf
+5100-5199 4fc9296b090a055b 6d4fe2defeeb46e8
+5200-5299 2c04eeafaf88ba2a 9754700ea1666830
+5300-5399 56bb5fd8b66acc55 6d4fe2defeeb46e8
+5400-5499 ea993fae9ee22d60 6d4fe2defeeb46e8
+5500-5599 f6006e44a0d7e0f8 6d4fe2defeeb46e8
+5600-5699 b7bca94687e7e31c 427d6c166b179647
+5700-5799 f3498da40331e61f 6d4fe2defeeb46e8
+5800-5899 220210f9279a2a57 6d4fe2defeeb46e8
+5900-5999 e89a7a15d0fb818a 103ba96fdf71db1f
+6000-6099 052e3e982563bc18 6d4fe2defeeb46e8
+6100-6199 f6db719e23625017 c71321a6b14adb42
+6200-6299 17ad3348d0fc00e1 d104d78f87c527cd
+6300-6399 1ef6e5580cd1aad9 6d4fe2defeeb46e8
+6400-6499 307f27a5590a2592 39d6239d158e598b
+6500-6599 4e85478897f35302 2b1261a216de3764
+6600-6699 561b17b51fd0484a 6d4fe2defeeb46e8
+6700-6799 b5f7d125ca7dcfd8 6d4fe2defeeb46e8
+6800-6899 2dd58ca901042303 6d4fe2defeeb46e8
+6900-6999 4f5f9fb99bf2fb69 6d4fe2defeeb46e8
+7000-7099 6ed05be8f62f944a 56d4efb8b5cd9382
+7100-7199 a34941ecad55940e 6d4fe2defeeb46e8
+7200-7299 54350f6162c4cd89 6d4fe2defeeb46e8
+7300-7399 8d7fd611ff69dbf7 6d4fe2defeeb46e8
+7400-7499 7299ff2e7e2c0042 6d4fe2defeeb46e8
+7500-7599 b6d3a5ad6c2453e5 a02b27a84a793766
+7600-7699 0f53981a6fb348d0 bc7e68c57c2f02c1
+7700-7799 0e524bdcce5dddf0 6d4fe2defeeb46e8
+7800-7899 ecf0f021b0b42630 6d4fe2defeeb46e8
+7900-7999 b4673fa49050d948 6d4fe2defeeb46e8
+8000-8099 c718d3a723207602 beb44c99a02e9250
+8100-8199 cdf21e602f7e898c 6d4fe2defeeb46e8
+8200-8299 ac20e1dc6c70527b 6d4fe2defeeb46e8
+8300-8399 17f933ff1c618119 6d4fe2defeeb46e8
+8400-8499 392898283456b9f6 3aa2366696aeacde
+8500-8599 a71f8a979453d71b 6d4fe2defeeb46e8
+8600-8699 33f354888335bb64 ca444b1ae466e2b8
+8700-8799 1ce2c764bb6ae8b8 6d4fe2defeeb46e8
+8800-8899 e1be2f0d7d48d9c2 2b28f1c877d45ac1
+8900-8999 e20e32166bdc5e49 6d4fe2defeeb46e8
+9000-9099 ce94a4afbf06edbd a4e3011b1ec49d74
+9100-9199 aa8504cf451bb762 a3029571fa2d4011
+9200-9299 90e7aa70c1ca2dc4 6d4fe2defeeb46e8
+9300-9399 7a07ed626ad4d3e8 6d4fe2defeeb46e8
+9400-9499 3d50279abdf9b36e ac4963053b41507c
+9500-9599 1f963b925830466c 6d4fe2defeeb46e8
+9600-9699 af32fcf1420731ad 6d4fe2defeeb46e8
+9700-9799 06b3ebee17344058 6d4fe2defeeb46e8
+9800-9899 5b125aa057926cf3 8e99a4a9334eaa0a
+9900-9999 9e9d5c1b9f44d979 5a0cfda917d749ea
+10000-10099 78432a22d5e2bf5d 6d4fe2defeeb46e8
+10100-10199 c037c0961dd9f9dd 6d4fe2defeeb46e8
+10200-10299 0dc0322bc5dc084e 6d4fe2defeeb46e8
+10300-10399 9e43869af274a21e 6f547e90f07ef1fb
+10400-10499 5a114f63f9cb4c5b 6d4fe2defeeb46e8
+10500-10599 d5e1eb29f5f15510 50de3f3e36dc159e
+10600-10699 269c112ca7474227 b984bab27f5f1003
+10700-10799 f36998ffaa695a6d b4d93777cb1f0083
+10800-10899 310b460ced5431f8 6045df12bda52d35
+10900-10999 5ba306d3762f94b5 89787880b36e7996
+11000-11099 549ad634fe50f57f 7c31e688ca30cbab
+11100-11199 4883ab5e8e16a7c7 6d4fe2defeeb46e8
+11200-11299 7ff2aeb39e041b96 0d0b1015cc30d8e7
+11300-11399 ae32dc95ad89a286 6d4fe2defeeb46e8
+11400-11499 2ab0533386ef3d40 6d4fe2defeeb46e8
+11500-11599 1c88776f51911b36 6c4a12976cec2649
+11600-11699 b6112d23b1319dd4 6d4fe2defeeb46e8
+11700-11799 89c2da6c43c9c982 4e14d34a8d909a71
+11800-11899 53da7e5b649ee6e1 3e14e23d8655e187
+11900-11999 7d694913ec8fb348 6d4fe2defeeb46e8
+12000-12099 c418910a708c8a54 742aa030473121d3
+12100-12199 50caf91917479196 6d4fe2defeeb46e8
+12200-12299 7199f61b58a89018 6d4fe2defeeb46e8
+12300-12399 705685cd918f1fb5 6d4fe2defeeb46e8
+12400-12499 c0b3f41cfb62c1dc 6d4fe2defeeb46e8
+12500-12599 775ec2ddf3a0e3eb 6d4fe2defeeb46e8
+12600-12699 5de91dbce4de552d 6d4fe2defeeb46e8
+12700-12799 5d2cf1bb68e9aac0 eb52e3bae531ae35
+12800-12899 34aeb26135497fd2 6d4fe2defeeb46e8
+12900-12999 d5d562c9808728b1 6d4fe2defeeb46e8
+13000-13099 127dc2a6b3025cc0 6d4fe2defeeb46e8
+13100-13199 a0d9f899a2e58ffa 3a6233108c49c68e
+13200-13299 4382a19eb609d5b3 6d4fe2defeeb46e8
+13300-13399 ba7a34016a4347cb 5169bfee029ceefa
+13400-13499 4fd3a10515d5921a c1ae132c7ecd0da4
+13500-13599 abde9c4db9f1f17e 36d0bc9ac1a0798f
+13600-13699 17d152c61cad1feb 6d4fe2defeeb46e8
+13700-13799 7089e4891123d2cd 6d4fe2defeeb46e8
+13800-13899 520acc4cab34ec2a 6d4fe2defeeb46e8
+13900-13999 973d0ccbfabb045b 09984a373469e7c9
+14000-14099 664dd90a77ed5ffb 6d4fe2defeeb46e8
+14100-14199 abcec400dfa87489 6d4fe2defeeb46e8
+14200-14299 b1acad0c912bae74 0e3ae5e2c6dd9335
+14300-14399 c317578130eb11db 6d4fe2defeeb46e8
+14400-14499 7d4f11b28354036f 6d4fe2defeeb46e8
+14500-14599 851ef1f65441343e 39f9a1d1d412a789
+14600-14699 480c1e1b0de47743 9cc145536e393384
+14700-14799 79051b86c03326ad d442966e358e11bb
+14800-14899 5a0b80f692ff1829 ede001e0e80a9504
+14900-14999 cf6d54f69b54790d f605d220cb613879
+15000-15099 d5232510ede45e02 a5c6343b1f21e1cf
+15100-15199 a961f1b02b245399 6d4fe2defeeb46e8
+15200-15299 94898cc0310198d1 6d4fe2defeeb46e8
+15300-15399 21a445d67ac33a38 284ae3cfc55ca02f
+15400-15499 2c850c17c20b432b 6d4fe2defeeb46e8
+15500-15599 13b306efa59acf90 fe1744035e766b24
+15600-15699 f4c300e0ff3c4e8b 6d4fe2defeeb46e8
+15700-15799 747aff147a96a84c 77d75b64ff1662e5
+15800-15899 f7cdbc45914d5a3e 6d4fe2defeeb46e8
+15900-15999 3514c344d782376c 7c31e688ca30cbab
+16000-16099 3612ea3a5fe7b919 6d4fe2defeeb46e8
+16100-16199 ffcc4b0a232407d4 6d4fe2defeeb46e8
+16200-16299 28700a74a5b0da16 6d4fe2defeeb46e8
+16300-16399 4da99e8ac8ba9f2a 6d4fe2defeeb46e8
+16400-16499 36444ce857287621 9506f304c6c7e265
+16500-16599 f38bae758801de58 f8e14ef0708361fa
+16600-16699 ce225dc2a5f154df 3a0662521d321b07
+16700-16799 c53ac2d526297ed3 50d6dde2ebd9fe74
+16800-16899 5759244b7926a37b 67b992ddcb3e8d80
+16900-16999 2fd1a4f657a0d9eb 6d4fe2defeeb46e8
+17000-17099 ae8457666e46c947 2a13b63d7a73ae51
+17100-17199 e5c847c4340f36d6 95b223bd39a20da4
+17200-17299 81c3460f91a459b7 97c7bf125951fbd0
+17300-17399 acd214368ee950d1 5fdc6efe27ed457c
+17400-17499 ea2c30dc5466fb4d 91a4502d6de557f3
+17500-17599 fa6778e47ac2d9d3 6d4fe2defeeb46e8
+17600-17699 5fe22e30cf46b8db 8feac4289e0b2325
+17700-17799 cb16bfb6493ce177 6d4fe2defeeb46e8
+17800-17899 83b86226ae444d12 780018a4f635df4c
+17900-17999 52e78adf9d998f8a 6d4fe2defeeb46e8
+18000-18099 9ecc4c6767d06b6a 6d4fe2defeeb46e8
+18100-18199 86967c55bf52f782 6d4fe2defeeb46e8
+18200-18299 0e8379144e6de405 0105786f74125762
+18300-18399 fdf00789a0fb556a ff68630159214641
+18400-18499 85d8946f5fcb28f0 6d4fe2defeeb46e8
+18500-18599 1d6bcd48056a27a8 6d4fe2defeeb46e8
+18600-18699 394a2afff1ccba6e c09469d5386f3652
+18700-18799 10452a6d22ea9ecb 89b071da85e20561
+18800-18899 89ac0a995f8aac3a 6d4fe2defeeb46e8
+18900-18999 fef193875fba5444 bef7850123dfa7f7
+19000-19099 00a892559e739db5 2aa1217f448283d2
+19100-19199 cc512d0380a7812b b3295b0b991d8ba1
+19200-19299 0ec22fd70adbdad2 6d4fe2defeeb46e8
+19300-19399 3bb26aa61319df6a 42a3f19c6eaa2f40
+19400-19499 df77c1f0e1d58cc2 6d4fe2defeeb46e8
+19500-19599 5611b8eb38fa8204 6d4fe2defeeb46e8
+19600-19699 2808f87db8e62ce1 6d4fe2defeeb46e8
+19700-19799 1f3ad58097c6fc5e 6d4fe2defeeb46e8
+19800-19899 7b8a1eb72ce18ebc 6d4fe2defeeb46e8
+19900-19999 bf800d07f4dc6ff4 5de7e3eb519dcde0
diff --git a/crates/socket-patch-core/tests/equivalence/npm_lock_rewrite.golden b/crates/socket-patch-core/tests/equivalence/npm_lock_rewrite.golden
new file mode 100644
index 00000000..c173088c
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/npm_lock_rewrite.golden
@@ -0,0 +1,202 @@
+# One seeded package-lock.json / npm-shrinkwrap.json + overrides.
+# <case> <input digest> <output digest>
+0-3 38b943cc2e19137b 6afbf79b2ea51d7f
+4-7 39d1bec8b19fe2b3 0234d597163850f1
+8-11 ad36d989d79734db 0671dbb2288c2520
+12-15 481675194b39d860 60ec31624712a77a
+16-19 7e15f8f39a3af575 fbb3a1c64927f7dc
+20-23 b8ae78f255f6a932 36c2dd9b52c4f509
+24-27 71eae0c3c0184ecd 58d66e565aa4fd51
+28-31 01fe36b5faeb29ff 29fc8116aa94fb5c
+32-35 cb046b19a5fdfdd6 c5fc2510910daa71
+36-39 efaf1af6b3d201e1 9ea5d8d9e0d0b7bc
+40-43 0b146bc1275f5605 6dc1a2f316fea439
+44-47 6131178fcff5f168 fe7bcd7668916be4
+48-51 7f23e01097535c51 7f6fc1a7d4b046f9
+52-55 0d5e691dad879076 7604ade4a0a89219
+56-59 6aa8ab1476372939 3504a591b574d127
+60-63 98d75ab23a2e9c01 dbc423fe3aa2031c
+64-67 d839bc25655d17bd c58dce409d967d71
+68-71 40f1c301fa3d1824 918eb331f480af44
+72-75 18775954a617d9ad eb8e0a1834f3c4c9
+76-79 cd2aac77dd5fd50c 6ad26aa874db0b3f
+80-83 6914eec135779154 103252c10e0e4796
+84-87 23d6dfca3dc60d0c 078eeb46fd92ff43
+88-91 174afe518c036993 58d76ad81a0736f1
+92-95 55c49569b1ff28ea 2c66448481270ec3
+96-99 e9b8cddfc47c2410 08948aed5135ec1f
+100-103 21dbb73e40e5a210 af5e7560a9d0c0bd
+104-107 0c170349f3052ef9 27e2b78479f64dee
+108-111 b9c3e6c7cdfad95f 98f730a5706b25d6
+112-115 b7f86471de74f76c 392efc30f7f532cb
+116-119 5b317616e7ec450d 892261da3954f566
+120-123 1af385991cee8693 985f1874988de52b
+124-127 45f394bfeb103203 1903864d3d585314
+128-131 32b0731afbcedaf7 80e4b2ec800f162a
+132-135 bf40da5a6099a8ff 244c2f2ce05cadd7
+136-139 98773f82425a6fd9 9011cd7a515c0826
+140-143 7635eee1f74b943c 9da248d486b3c382
+144-147 43ccf3156a238f1d 55da03ffc362d938
+148-151 bd11851bf97a2c30 31b5b52dbaf2afed
+152-155 219d9afb7f6a45b2 7f198d2d08e2d656
+156-159 7c1e1e997c16b02e ca68697c227ebea9
+160-163 143279d02db7a456 11e2adc2d8e75624
+164-167 d4adfb48c56be5b6 a3fa28797bc91236
+168-171 c063c9818a9362b1 bf8c8db42eeccc8c
+172-175 1ee9e3f5a3530fc8 98aa42cd99b2ef29
+176-179 2567d140ce3ceda0 a76633f81f07d4a7
+180-183 8c63f24d3ac472f6 cd0f2d2f7aa925a8
+184-187 768a53cbd61c832c d64742504fdaaba0
+188-191 1b79c77ae63569a4 fc9fd305e1ddc085
+192-195 a652530b7d9610fc 7ef3c98c60d82ab5
+196-199 e81b9c1564f40cb9 1834aaaa0f9cf4e5
+200-203 ac3292d6054c9914 a5c6cacbd076196e
+204-207 f6a5d0e294b53a1f 3fa6da640079201f
+208-211 faac70857d5d0378 ce52ae0e9fe5c201
+212-215 10ca242fff41fc4a 44c191684952c35d
+216-219 1c86705c9f655e90 7335c0978cc1c66e
+220-223 657b5d828c9a98e7 a8c2c5ed16f51ab2
+224-227 ea4b041b46eee835 19df59fcb5719e5f
+228-231 8fdaf1c02bb638d5 10a44be416359fe9
+232-235 f073c1581fe82aca 13685e45ce0530dd
+236-239 e1f60ac97e7ef626 2f9548820333e8ca
+240-243 737595eab5c4dc3f 2c42475072ac9025
+244-247 00b82a270764acad 5bca5722c86de90b
+248-251 b7e7e3ff5921f56b 2dfb1d83eb83cbe4
+252-255 0e058ae2b4f4eef1 f0f9bbd3e645f0a1
+256-259 30c973883ccb389b 1507fd6e0786016b
+260-263 3f7575a697a45103 087b2271977ba307
+264-267 f98b36dd3f4431f7 7c0aeabf6e27638f
+268-271 2242e200be734689 961c2cbf0c72226b
+272-275 9fbf78e7d41a7e58 543f347b65a23c70
+276-279 ea0a7560bb20466c 0c715c2207044d29
+280-283 3ab69851cae70bcd 8e480b61d81592af
+284-287 1fdb596cc87f031b 64578f1e84310366
+288-291 ed84081f4124d522 68797a18e99c2dbd
+292-295 18bc713c335e243c 9c8a170ff899c58b
+296-299 658ce14ea92fffd5 536e77ae46114631
+300-303 9a8fde3916e27342 bab49d863a06a18e
+304-307 ac9ed568f15ba5d7 ee0cc2e069d5e0f9
+308-311 8ddc66826aca8737 28296ac8c39c5dcf
+312-315 b5092b2eb6d28e04 98807cd38d0e4fb4
+316-319 27d1154fe85c9091 281b9314ec579043
+320-323 8f7ded70633dd0a3 2ab2a92cb15c09cc
+324-327 8c22483048c74dca 2e1a0cad7e7f49b8
+328-331 3b6a2eae6af90be3 45de24588519ef65
+332-335 291ee053b410dc25 4821eb617b8d86ec
+336-339 c00ae81f0a2be968 9f069a599d03be8b
+340-343 1b3d34745caf497c 562af394d0cb24db
+344-347 8e350ee856023a1f 7f3b5b09c26ad562
+348-351 7b0511648fa4447c e0f1d4a90bf10bbc
+352-355 460a50b29b48043d 471c904c5bd15578
+356-359 a304ae8e7e03c44c d9b4d4de533a4b35
+360-363 7055899176855866 21c59a685c9b48f8
+364-367 f8819f4cbe245541 f9f82c123e2a73d7
+368-371 3d30266cadaa3712 44f173d7028a72e7
+372-375 a65f748f7e3f6933 e612c7529ecd9fc1
+376-379 ee1ad63fa3935a76 27eb4c24c582e5be
+380-383 0c76dfd9b908af15 c62f2970357958d4
+384-387 7d113d1c4bcf7ede 694120e2b01d24db
+388-391 392bfdf6873fb038 f681d116f11dc011
+392-395 8ab3f5ef6c2260dc fdc1bd49d88b0f00
+396-399 e70ee73cf9f93cdd 1fe4da6c539ccf86
+400-403 dda6b03292721d0b 9795245a300e80da
+404-407 cd2441a35b1c5740 6fd4d2a386eed373
+408-411 91ac4721e77b4500 0bc11d72a0297bb9
+412-415 28af4189511719f9 a2330b0fc992c811
+416-419 d9e2eae424bebb3e 97225086b3cde613
+420-423 0f86f1432c081b6c fadc9e8e38e60240
+424-427 6533c923cb60e539 88649c02c40ace42
+428-431 80c11eb13664c5fb 3875f53d37e204d1
+432-435 d33b5fff79332f39 47fe549195bb9a15
+436-439 c70bbaca1ed730dc d8aaef4d259a74ad
+440-443 b1152d879b9de674 a4f72811e3bffae7
+444-447 a8f916b2e93c9dbe 66e21676c46442a5
+448-451 6203dc0bec8c785e 8a2b3312f0c89fa8
+452-455 9521dde1a284ecb3 fe060608d6730ef9
+456-459 4f253fce1a2e0160 b2def197c1a7f2e3
+460-463 cb3feed1731c395e b45744c5bfb34150
+464-467 1b0fa950663ac590 e1259bda18595a9a
+468-471 9b8b2340d8531f3e 0a64e4abb6603264
+472-475 736df961ac44dd1f 6e0b231581610bca
+476-479 71839c074d059821 e32e1ee9c4690986
+480-483 2dfe4501253d999f 3f2903a8a1f3d955
+484-487 6d4cfdfeda102637 a3c8744a57be0dda
+488-491 8e04bbe242721495 4827195052919674
+492-495 4b804da1bed766bc bdeb1a87ef9305c2
+496-499 e4358ad81f66c66c 1bd273b112273309
+500-503 d497faab2e6374d1 25ff9866dabb19b5
+504-507 bd134b4a4fd9c1af ec0b3fba5c88c493
+508-511 3a1c53db7ba9c199 37616449222b5305
+512-515 9ac76bdafc788702 cc92331d1da45af9
+516-519 cc5cb99242e72eea 2412c7294ae0e7fb
+520-523 df8749c4f1d4c88d 2151d47d975cb37f
+524-527 df1f4eb0a17e6840 7c39d5aa3d8b642a
+528-531 5bd935a1966450a1 b061be4d09b62e08
+532-535 d3c766b67ad93619 3ca34eed97e981b6
+536-539 0abea7838ee8c651 d9bc957c8cae0752
+540-543 5a34e67ca32acd76 441ba16c8b63b7b3
+544-547 8139c395ec116abf 1e3325d4109dd7b7
+548-551 7937635862cd0cc7 cdda5e17b4f48a72
+552-555 f18bccaae83b8a26 d0df0c9009bc78a6
+556-559 0d7281f2dc6cab7c 882e42c94ab9c1ab
+560-563 67b3e9f59200ece4 adb2ddac66bceede
+564-567 eb7c20329e96b501 69123af19dd03c33
+568-571 d293cc2b575a278d b4e3b6ca4d70ca48
+572-575 c17b85264698e947 c31226a5993d36d0
+576-579 86db374e9417a100 b2589b8c5862526d
+580-583 ce0fc0bd2408d817 ae1c81bc0e42a310
+584-587 436c95276aa8074e 365bd19a4a6b4001
+588-591 c09216f32360676b 66b0ec275885c59c
+592-595 2c4e9ab4e7011bcd b690d76fc146a3cb
+596-599 cc8ac6e16d3c70a2 ec2982d7ac00c04d
+600-603 5e61ab66a7b47ef0 0a0039c9514fa44a
+604-607 890a631fda14796b d0d34470f95f0f00
+608-611 36c6f3f1734989cb c9c44c8231adc276
+612-615 918d05dba93bf7af ae6b338ed65863e2
+616-619 cc1fc9fe234e6237 e04ec4070749160b
+620-623 2b1c61c2f9ffecf7 8fbb465964e46b0e
+624-627 9e25c994d6e9f497 3e9ad345fcf9a2c4
+628-631 9569acd0022c72e9 99eeb42b41eac287
+632-635 02a74614410dc8de 82d095eaed3f21e1
+636-639 0064b192beb2f16d fc9da6ebac16e671
+640-643 b2176154f9609f29 3ff41983caa23faf
+644-647 f865a601402d568c 943e9e9921ecb728
+648-651 8ddac4722587be4f ace2b06a8b8c8c2f
+652-655 647ba94842de4a99 8fea29aad4870b17
+656-659 22c5789b07c59689 0aaa723ae5b9df03
+660-663 f981a3e36eabb727 2320f8c204b31436
+664-667 6378568f624c46d3 cb9bf66dc3cda08a
+668-671 53b118efd7818da9 4564ab4a7f0d559d
+672-675 a3219e99fc477e55 c6df6f0d87b9b9c3
+676-679 2dbb5f9d13c34873 7580908dfdcfea1d
+680-683 f59699ffa5de8930 804313d49536b1eb
+684-687 59cb168e9f9a08b3 398c4bfcc9646dad
+688-691 6dfa1486645043d6 e539a4a91043a734
+692-695 bf91bdd85d72f097 cebeb8199696570a
+696-699 30cef91da832598a 806297d879f04028
+700-703 9914c1d4b503c2fa a3ad262fe1bbe8b1
+704-707 db31d2e2f05ae765 1ab6149d78be4168
+708-711 73b257c77137ec8d f77474faf5d33ba7
+712-715 2723b37a94e6f61d cac8d4e20c22b5a2
+716-719 87b719e81d116915 8bfa142895937a5b
+720-723 39aded84cb8ff42d 653e264f24b22aed
+724-727 a3a2175101809603 d75e9978ae05cfff
+728-731 60daab1a32e79814 a026a111e5942609
+732-735 8f36fa43d3e14039 1101d2c2bdbc07cb
+736-739 0055deef8e34fb7e b43ec4abbe4b9637
+740-743 219c65c23e60569e 0ac08b9102fe82c4
+744-747 13ff170d3d8cf8cf 34c8f3d49bf9d824
+748-751 2b646f2ebcca65e2 e1e2ef0f8acc106b
+752-755 9171f34232dc9d5d 1f3743ef48f2b715
+756-759 6e922d3893444fd8 5e1314867d30fa3d
+760-763 d11f1fcb3df5ee76 33ce5e620fa20e08
+764-767 b8a0235197ffeb8f edae9a91a5a0c070
+768-771 84d8643c18a5e371 df626fca46bed1f9
+772-775 dd10317147218f0a 224f4602080a058c
+776-779 19a4e66646f42e84 15185a1ff7aa56d6
+780-783 0bb4a00c871b5a42 e910828f4f26627c
+784-787 c0bb93b2e4e6cf4e aebb40e04549459e
+788-791 850c2fdb73cd8f87 4bed71a422cb5f7a
+792-795 fc1f34260f230d80 02a005a2a4cc27c6
+796-799 89400e26345a7cc1 71dc369195531335
diff --git a/crates/socket-patch-core/tests/equivalence/pdm_lock_reused_parse.golden b/crates/socket-patch-core/tests/equivalence/pdm_lock_reused_parse.golden
new file mode 100644
index 00000000..4fcd301f
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/pdm_lock_reused_parse.golden
@@ -0,0 +1,602 @@
+# One rewrite step over a grown pdm.lock: the text and edits, or the refusal.
+# <case> <input digest> <output digest>
+0 51da3e941788e52a 9f0970f6f87c7931
+1 fdc56b69f9a5d32b bbf2b60628004c99
+2 f115aebddd4eacd8 4a97499202850f2f
+3 3bad998b90e64e11 31987b68f78a15ac
+4 50ae55df589e523e 9d4350e62594c4bd
+5 d3ea53459da34a28 5e7d516c90fbd221
+6 746636e98b80790d a5017370fb037b1c
+7 e82174d3a13e2277 147cedfd51c962e2
+8 327b1a829b329ec7 8354f40fbbe79f15
+9 d07c798cb62d9a56 66f9af1e989003f7
+10 6400bd3ed21dd681 4a97499202850f2f
+11 52863b1511d2568a 31987b68f78a15ac
+12 dd67b60bb734a55e 9d4350e62594c4bd
+13 3cd39cc38ec5053d 2d85be54a1b23258
+14 ea3d45f843bca759 62d8978b89c1919f
+15 bea24469df8f733c 147cedfd51c962e2
+16 8ea4dea4ceaa02e0 5b0d60cd940474a4
+17 76730e639c866305 7c018434c717682f
+18 24b16b19f2c2d5b8 058c4e147605ffbf
+19 acbc667113f91e32 4f223c4b36b8bc50
+20 84a819c45e4164af ea342cc2a624dde0
+21 8df0d973e6c8e282 4a97499202850f2f
+22 8157a4ef3d543821 31987b68f78a15ac
+23 8fd3a82cf7754660 9d4350e62594c4bd
+24 6c81ff4f86d08090 1b1feb2899042ce1
+25 011bcd41f45fac9f 55aebe7de046c85b
+26 d1c73523bb2757b9 147cedfd51c962e2
+27 e0238bf1d76af8da 08dec65ca8d213ac
+28 de3a94e87e8a32c7 1deb3cff276a4b7b
+29 3e72c7dde471c73a 041eef2fbc167231
+30 42c85d0b6cc6717e bf34b713f72d77f0
+31 ead4e3540408528d 4d12e0cf92fd04d5
+32 4e8fa7b44440f069 fc4d63b4f9a3662f
+33 f73a75c5b2128797 4a97499202850f2f
+34 ce36164e6db9c325 31987b68f78a15ac
+35 8e985259f0f2865f 9d4350e62594c4bd
+36 246e7ad2db85ab83 9b638af4dcd1c141
+37 6a56d31f6fc04410 d7e91f2ee61b155d
+38 b85f9ec63056b2b1 147cedfd51c962e2
+39 5aebcb6a99aefa3e f0783f9b854d5a8a
+40 4046b7368477ec44 419d4293e8ff73e9
+41 442f8824559bd810 4a97499202850f2f
+42 f8deda687913891e 4a97499202850f2f
+43 1412ce8f0c900846 31987b68f78a15ac
+44 0de9459b5f5f9af5 9d4350e62594c4bd
+45 110f8e297a0335a2 8343c3422a7b0704
+46 b8dd8d3746371d7a e20e516b7aef80c0
+47 9847b5b9e6d953b7 147cedfd51c962e2
+48 fb3f47ea61bfcd1d 5617053f29ac5c94
+49 afb82deda5b15a08 4a97499202850f2f
+50 691e5cfe019448d5 4a97499202850f2f
+51 e3806b344b7486df 31987b68f78a15ac
+52 2fd2f5546579fa9a 9d4350e62594c4bd
+53 aa6d9aec4aee5271 25429ccae40fe3b8
+54 67a32da4e100772d 912beda1648c98a5
+55 96801d75b42f0ab6 147cedfd51c962e2
+56 2dec5a69f8ffdde2 6b7d983b98c362ca
+57 82b23f5031338f33 b5518dff92fa5c8b
+58 29b86397c5a75e56 d729d0e317a8bfd2
+59 6bf696611506d6cb 29abc716a6385c0c
+60 4c943d2bf37a53e8 4a97499202850f2f
+61 647bc15c17dec3e3 4a97499202850f2f
+62 d54ce5bab8f78fe8 31987b68f78a15ac
+63 b405aa6018a4b855 9d4350e62594c4bd
+64 33602caafe7c09f8 7696e9580cc48bc3
+65 cecb25cc25f06e34 5bf1334db730b807
+66 033b831cf3ccdd1f 147cedfd51c962e2
+67 33d05273f679f096 b9e0f7f23cd531e0
+68 523119b613c5a788 b77f465561ebf4df
+69 fa60a69e3c37c3ae 90d5e51d7e0d69a8
+70 fe070a44fa2f4597 da34afe81c7da945
+71 e7b2812707103183 70b88524f0892347
+72 f066c15cb3ca4c14 4a97499202850f2f
+73 39255d97c29b8e70 4a97499202850f2f
+74 285cad975ce19f53 31987b68f78a15ac
+75 8491bdd25a2f57bf 9d4350e62594c4bd
+76 488c4b7de591a887 2231331235e2f913
+77 a5bdc23bca6e93a8 6465cca65be6fc73
+78 923d2675d18e44ec 147cedfd51c962e2
+79 918b380001651760 34ddbb309b487393
+80 834c2226edb9a309 40b7af0efb673911
+81 a254d43aaed2160d 40b7af0efb673911
+82 dddaf3987c5f65bf 40b7af0efb673911
+83 9cafe0c5639af5ad 40b7af0efb673911
+84 9c84bb72be286829 9d4350e62594c4bd
+85 834c2226edb9a309 40b7af0efb673911
+86 35d391704b679314 40b7af0efb673911
+87 a09ffcbb1f0a4cda 40b7af0efb673911
+88 77bd5404355cb2d7 40b7af0efb673911
+89 15b5dcc7ccb8dfe0 40b7af0efb673911
+90 0e1ec2e34b1d9a30 40b7af0efb673911
+91 b8880102d4fad8fc 40b7af0efb673911
+92 72b884ebec177c79 9d4350e62594c4bd
+93 77bd5404355cb2d7 40b7af0efb673911
+94 b278f711c6bad27b 40b7af0efb673911
+95 3eb2dfae31143cf6 40b7af0efb673911
+96 6c0a270455a5b2e8 40b7af0efb673911
+97 ca55c9edb24ed3fb 40b7af0efb673911
+98 143b7aad87048d3a 40b7af0efb673911
+99 453786b8ff7af18a 40b7af0efb673911
+100 bd413a22034cd225 40b7af0efb673911
+101 5ce5123baa1c3ae1 40b7af0efb673911
+102 f500c474c5e34907 40b7af0efb673911
+103 a4f7850f93dd4328 9d4350e62594c4bd
+104 6c0a270455a5b2e8 40b7af0efb673911
+105 b563f52c5036bf3c 40b7af0efb673911
+106 f514d821d245f81b 40b7af0efb673911
+107 ddfd2988d9942fab 40b7af0efb673911
+108 47d9bf3b11cb6f57 40b7af0efb673911
+109 627e20c162be5c9a 40b7af0efb673911
+110 0ba5f78b254d1902 40b7af0efb673911
+111 ebf24d71507702bf 40b7af0efb673911
+112 e10944aee3e6c526 40b7af0efb673911
+113 089286a57a4abd87 40b7af0efb673911
+114 a59a5caca26f5731 40b7af0efb673911
+115 cc905d6ef643de25 9d4350e62594c4bd
+116 47d9bf3b11cb6f57 40b7af0efb673911
+117 273750e92f8956e5 40b7af0efb673911
+118 cb7e0feca88d9f4c 40b7af0efb673911
+119 9cba74ce2ea6141b 40b7af0efb673911
+120 78413c0783d620f4 e5cfd07aff56674c
+121 7bb857036d73b6c6 e5cfd07aff56674c
+122 ca02e029dd3ab8a7 e5cfd07aff56674c
+123 166f3cb1785df018 e5cfd07aff56674c
+124 268cb0c93256947a 9d4350e62594c4bd
+125 78413c0783d620f4 e5cfd07aff56674c
+126 6c4324791908e935 e5cfd07aff56674c
+127 1e4146b21c80a25c e5cfd07aff56674c
+128 1d04ad4ad2cf6ccd e5cfd07aff56674c
+129 e4c13910bc951502 e5cfd07aff56674c
+130 1ebf1e81f25528cd e5cfd07aff56674c
+131 d823b610f9903730 e5cfd07aff56674c
+132 a485fffdfd765ffb 9d4350e62594c4bd
+133 1d04ad4ad2cf6ccd e5cfd07aff56674c
+134 ec9ad66a504eaeee e5cfd07aff56674c
+135 29b481817b981063 e5cfd07aff56674c
+136 e08ea2099aad8495 e5cfd07aff56674c
+137 b4843e921f065b6b e5cfd07aff56674c
+138 84147e5f50eecb47 e5cfd07aff56674c
+139 fc7e94d7e42ec795 e5cfd07aff56674c
+140 34bb40a9eddcc91d e5cfd07aff56674c
+141 fc8a7c74011210e4 e5cfd07aff56674c
+142 6bd01ae012218b23 e5cfd07aff56674c
+143 1e7d9b8fc56b1c36 9d4350e62594c4bd
+144 e08ea2099aad8495 e5cfd07aff56674c
+145 553a4ac6777383c3 e5cfd07aff56674c
+146 8db355e913350e52 e5cfd07aff56674c
+147 205eb8a7d5a993df e5cfd07aff56674c
+148 1e16857cb80a699b e5cfd07aff56674c
+149 2629b1fd2e8ed753 e5cfd07aff56674c
+150 42fd317c4f62f44c e5cfd07aff56674c
+151 f3f6a4ce1c2e076a e5cfd07aff56674c
+152 87cf9dc22d0b9b32 e5cfd07aff56674c
+153 fe0e54d12b308ca0 e5cfd07aff56674c
+154 dacfbcf5c85f3682 e5cfd07aff56674c
+155 44679c431e4e81df 9d4350e62594c4bd
+156 1e16857cb80a699b e5cfd07aff56674c
+157 1855f19a8a621db3 e5cfd07aff56674c
+158 0721f0d6e012d3eb e5cfd07aff56674c
+159 08d0c228e3ff4db5 e5cfd07aff56674c
+160 78413c0783d620f4 e5cfd07aff56674c
+161 7bb857036d73b6c6 e5cfd07aff56674c
+162 ca02e029dd3ab8a7 e5cfd07aff56674c
+163 166f3cb1785df018 e5cfd07aff56674c
+164 268cb0c93256947a 9d4350e62594c4bd
+165 78413c0783d620f4 e5cfd07aff56674c
+166 6c4324791908e935 e5cfd07aff56674c
+167 1e4146b21c80a25c e5cfd07aff56674c
+168 1d04ad4ad2cf6ccd e5cfd07aff56674c
+169 e4c13910bc951502 e5cfd07aff56674c
+170 1ebf1e81f25528cd e5cfd07aff56674c
+171 d823b610f9903730 e5cfd07aff56674c
+172 a485fffdfd765ffb 9d4350e62594c4bd
+173 1d04ad4ad2cf6ccd e5cfd07aff56674c
+174 ec9ad66a504eaeee e5cfd07aff56674c
+175 29b481817b981063 e5cfd07aff56674c
+176 e08ea2099aad8495 e5cfd07aff56674c
+177 b4843e921f065b6b e5cfd07aff56674c
+178 84147e5f50eecb47 e5cfd07aff56674c
+179 fc7e94d7e42ec795 e5cfd07aff56674c
+180 34bb40a9eddcc91d e5cfd07aff56674c
+181 fc8a7c74011210e4 e5cfd07aff56674c
+182 6bd01ae012218b23 e5cfd07aff56674c
+183 1e7d9b8fc56b1c36 9d4350e62594c4bd
+184 e08ea2099aad8495 e5cfd07aff56674c
+185 553a4ac6777383c3 e5cfd07aff56674c
+186 8db355e913350e52 e5cfd07aff56674c
+187 205eb8a7d5a993df e5cfd07aff56674c
+188 1e16857cb80a699b e5cfd07aff56674c
+189 2629b1fd2e8ed753 e5cfd07aff56674c
+190 42fd317c4f62f44c e5cfd07aff56674c
+191 f3f6a4ce1c2e076a e5cfd07aff56674c
+192 87cf9dc22d0b9b32 e5cfd07aff56674c
+193 fe0e54d12b308ca0 e5cfd07aff56674c
+194 dacfbcf5c85f3682 e5cfd07aff56674c
+195 44679c431e4e81df 9d4350e62594c4bd
+196 1e16857cb80a699b e5cfd07aff56674c
+197 1855f19a8a621db3 e5cfd07aff56674c
+198 0721f0d6e012d3eb e5cfd07aff56674c
+199 08d0c228e3ff4db5 e5cfd07aff56674c
+200 10c2078b66c024a1 83f82bf409a31f5d
+201 2f709b6ca6381750 4a97499202850f2f
+202 7f4d3d263da8a4c2 4a97499202850f2f
+203 be46887f225e4dab 31987b68f78a15ac
+204 ecc8bf1f3c521494 9d4350e62594c4bd
+205 5390313ba4f99848 65bd51df70306521
+206 9c29e72b441b736c a9a06db883716a12
+207 d09cdd2521e60698 147cedfd51c962e2
+208 de9bba1cb6d5ff7c a539bf808e1c34ad
+209 1919b89c2ccc2e3c 4a97499202850f2f
+210 f26da7d8b4c08e4a 4a97499202850f2f
+211 065f6b4af3e6a97b 31987b68f78a15ac
+212 46de38a64b406c88 9d4350e62594c4bd
+213 b662ce4971de793d afc3dab8b3bd4acb
+214 06ffe9617bcb9a44 ec9e04ec5697e4f5
+215 be65d47b26a266af 147cedfd51c962e2
+216 856d9b07f84a8d69 8922a099702ff25d
+217 71678edd5a40427a 727f6feb6252bc6c
+218 e491a17eb0c56d3e 297c5dc6afdec871
+219 e732c9803832d7e5 3654bc5fcb413b8a
+220 d112eb5594136d2c 4a97499202850f2f
+221 bfe71e0c6bdfeaf9 4a97499202850f2f
+222 52d9ff56d1a0adfe 31987b68f78a15ac
+223 bf7d0bb69c52b4e4 9d4350e62594c4bd
+224 e84630edcec7492f 076e0b998e86e668
+225 4434bbbd7a0e9401 4afd178f07d37855
+226 43db72800478f670 147cedfd51c962e2
+227 6ed2a69d3ecdc831 8074768821eb592f
+228 8cf942d530c2f66d 044de390b20b3077
+229 153d5c0d4e038f07 8f28d78c9652ef5b
+230 1a310685218772d0 edb5d2355b2c6376
+231 4982dbb1fb4d8afb 137635e880ae4ec9
+232 b821c969a6b84138 4a97499202850f2f
+233 42d8cbdd7cc23b71 4a97499202850f2f
+234 c54ca0f3a42a969f 31987b68f78a15ac
+235 e8ff617718340bd7 9d4350e62594c4bd
+236 f5eee279bae3d650 d62877bb740c1bef
+237 baf7d0642f95ab8d 0bb61663ac8e74dc
+238 4c450a4c5354a003 147cedfd51c962e2
+239 9de65bc2af470eee 21cdf600590cae82
+240 f5e3c7c3c2fc4a7d 2ecff5f3cf3cff90
+241 ff557cfba1a00d2b 4a97499202850f2f
+242 70ab35fb40c674cf 4a97499202850f2f
+243 dd344084697a3db5 31987b68f78a15ac
+244 e78f84b98a13a850 9d4350e62594c4bd
+245 722ff1cd23180005 a12058a9031e15b5
+246 1f2da8fbb310b818 b1356a5391856ddd
+247 140c327cbafe1766 147cedfd51c962e2
+248 3bb2f90fa1354ba0 31a2b94f7083cb5e
+249 c8aadfc0109f6d9c 4a97499202850f2f
+250 0130831e140aeb91 4a97499202850f2f
+251 5305441ee1edf71e 31987b68f78a15ac
+252 396e06a1c0d882f5 9d4350e62594c4bd
+253 4a4426c0238ab759 7ddbf842132d6221
+254 3bb89a1cc43ac47b e933196a46d1d230
+255 e0514ac8f379aea1 147cedfd51c962e2
+256 de77d87d239c4bcf ff79bbbf23ec1de3
+257 957f75246c1ec336 8bafe1da2532cef1
+258 33771824b3c4d99b 5821b93f187e2c97
+259 f00657356753b5e7 b1f0d4970b77af80
+260 52db94bc16865907 4a97499202850f2f
+261 43351f7825ff4eb5 4a97499202850f2f
+262 ccb08d1cc72fa6bd 31987b68f78a15ac
+263 0ff5212e87c403df 9d4350e62594c4bd
+264 a79eccd2fb7811b2 eb48235ad86b2649
+265 d28895d41f73bc84 6068cd48e63e2d77
+266 8154743847977b56 147cedfd51c962e2
+267 3e6008394ca62172 73a61be271184228
+268 3dfde73c08cea73a c46a2efcb0d77123
+269 35364e92e760479a d3bce982422db87f
+270 c97d883c6bce0906 0b9c9906c0b5d42b
+271 115145a51006f4ae 386dc3e8c7c824b3
+272 82bcf52c606b8f02 4a97499202850f2f
+273 9e2e6193164f014a 4a97499202850f2f
+274 4333452ee7f0a906 31987b68f78a15ac
+275 9ca6590b9273fc59 9d4350e62594c4bd
+276 8b6bfea955224cf5 225bae94d634b36e
+277 5a9df2111cc29133 9035ec492be66782
+278 0d566518acd89511 147cedfd51c962e2
+279 00e0f384d80f159e 3d9c867f5dd7496c
+280 20cab354d97a96d5 453cb9014ec90341
+281 14fd00d455327192 4a97499202850f2f
+282 8e3213115f538638 4a97499202850f2f
+283 bd32b55bc38b5ce5 31987b68f78a15ac
+284 d92b7fad0f5dd6e6 9d4350e62594c4bd
+285 a5718e0c1776130c ae967c2a05c0d032
+286 7b25cfeceadad0fe 79a3a8a28d53ac4e
+287 7c1b62718458c902 147cedfd51c962e2
+288 6995c722b083370f f7dfb74e12694237
+289 9d8168d24ae99e49 4a97499202850f2f
+290 7861d7b9ecc6652c 4a97499202850f2f
+291 6f677162097c97d9 31987b68f78a15ac
+292 38db0669550fd11b 9d4350e62594c4bd
+293 3e269d88201a7436 741766d85c5a5920
+294 453416febeb356b0 f227fad31168bf56
+295 d6f3f7d9ff77bf02 147cedfd51c962e2
+296 4cf9e033a453376b ce15ae2532592ae9
+297 61f51b6602f8723a e5b300d16bc63cd5
+298 c086ee17c56d2dc7 071fd71288d5ce51
+299 8ce3dc2edc26a433 66b476e1a7883936
+300 b4e2df8957fec73d 4a97499202850f2f
+301 1d274d94747b976b 4a97499202850f2f
+302 337531f365585eb9 31987b68f78a15ac
+303 b2a33b09dbd96018 9d4350e62594c4bd
+304 8515659c804c9b7f 06a796110163009b
+305 5c0e76fb50a6dd67 59042d6ce3fe8f20
+306 8ba70be9d1f8d6f1 147cedfd51c962e2
+307 b47ee8e0e0ed5971 e3f36d7ae285c8df
+308 96a20a00ea42dede 0a8afeeb7cfc95c2
+309 34f4192b660c2e10 5e99b06baf4b96f6
+310 4e66eb83afe6b612 4f3124babd96255e
+311 c5034642fe8930d9 25d91cf3e47f6381
+312 b6df2edee43e5965 4a97499202850f2f
+313 7a3e6bd77aaad2db 4a97499202850f2f
+314 6f394506203d14a7 31987b68f78a15ac
+315 7c463a884173e92f 9d4350e62594c4bd
+316 598cdb5c399521f0 c35c780abced4933
+317 dd925eaf074355cb 0bfe7689075f8e86
+318 a05afd7b62c839be 147cedfd51c962e2
+319 d9d0afea7877cdeb fca0e3c6f9d74051
+320 1c77b4696a2f0894 3bfbc89c556dd466
+321 d07b14a30b297ae7 9ec856ff287601e4
+322 e8a0e4b35424e6a7 4a97499202850f2f
+323 882a5411e217edfc 31987b68f78a15ac
+324 2ec38588887d62c5 9d4350e62594c4bd
+325 d8184f07abf632dc 5a69be4d1bc68cd9
+326 b9404d9c5cca5453 6c3ed7b127a8a0e1
+327 2431f1b6fdb2d670 147cedfd51c962e2
+328 159fcb1145b1eb0a 42b7e03bde37663a
+329 34efe6e4d5bcd464 fe1a4a0b04bbd143
+330 06f732f3c6629047 4a97499202850f2f
+331 5bc823657fe8cf99 31987b68f78a15ac
+332 3cf589cdef8744b4 9d4350e62594c4bd
+333 7bc2888722110bb8 716c354e784af8b5
+334 db8c9a7ea1afb42a a48b7bb73eae2a7b
+335 b35ee8b4e2117ceb 147cedfd51c962e2
+336 40a76ee0c9dd880f 99b0c0c7b0d70faa
+337 934875a11deac3c5 985120700e39dabd
+338 818bce5a2df8a6d4 2cb46af8c9041f73
+339 da0d2b41d511642d e7c3779bed148e48
+340 02a93e07bddb1121 67b244c8c7c07610
+341 779feb19ead30446 4a97499202850f2f
+342 a81bb3c2b2176de8 31987b68f78a15ac
+343 a002fd46f1cfaf97 9d4350e62594c4bd
+344 815148be1e4c8b8b d1220727b262ae3f
+345 27a65c7af65ef987 c0a18a21a8533941
+346 401ce13a484d40a6 147cedfd51c962e2
+347 184d94cda76678a0 9b4c6314ea881f5e
+348 7e3c576ee9904fe6 9f66001a828e9cc8
+349 afacd3730e4024cd 0d5e542e41e02256
+350 57d405130c8c9f95 39171751b8c08b2f
+351 c9aea89fac9ee4d1 d3b9c9707a7c6a29
+352 546be7d8896546d6 8b127586c411e830
+353 0605c42f7c7d0bc9 4a97499202850f2f
+354 2c56e4d8d51d0a2f 31987b68f78a15ac
+355 0cf4c0d5bcff1146 9d4350e62594c4bd
+356 7874cc0a35104008 05114f2c3540a5c1
+357 67b5531fdd64685e a061189ac0f59109
+358 1752ab4f8e9aa784 147cedfd51c962e2
+359 1fbddce315136249 36759eeffb31e029
+360 499e6a0d87ff3bf9 f147919beb494533
+361 2098361f04989bd4 4a97499202850f2f
+362 f647519ea7ec75c7 4a97499202850f2f
+363 f77cce552c1c4071 31987b68f78a15ac
+364 1864ea3b24f630b7 9d4350e62594c4bd
+365 d380c423f5a77eb4 bc3601fd98344659
+366 1fa556341ef3e18b 3f6287c2f18b5ee3
+367 e58f872d34428dc2 147cedfd51c962e2
+368 01c306b5a08c5248 e0d3f908a4a5b956
+369 daa6c4038ba3ab02 4a97499202850f2f
+370 e4e989708ba25b02 4a97499202850f2f
+371 14432d412e5d0416 31987b68f78a15ac
+372 591933d36d173969 9d4350e62594c4bd
+373 2a870344feab2435 329acd82cdf02bad
+374 5860b8b8df3f46ae 749ca3766b106126
+375 16316af702589c43 147cedfd51c962e2
+376 bf485bc899bf0401 9bfa7a4a7d028e8a
+377 9fe92cc0e442d47b 772b67ea4d42781a
+378 2adf9ba65e90471d 191a02d32cc06a85
+379 9a36207eebae160f 87e9ead546721228
+380 f67fa68e4eb4253a 4a97499202850f2f
+381 f8cf634e42654a94 4a97499202850f2f
+382 05409ca2a52db772 31987b68f78a15ac
+383 787ea8ea5e1b26d7 9d4350e62594c4bd
+384 0357f61eb2558e1d f87080abe5fd3540
+385 d4b510ab20a0e8f2 5f1d9161f454c012
+386 abff04fca1a2acee 147cedfd51c962e2
+387 60a1e8a5df29df1e e414f518b73230d1
+388 a707541155a80d15 769b2e6c77d31ac2
+389 1a019fb1b7030e46 d6d1e30d84d0ac23
+390 9b38be4b0365e279 3e67352e65b543ec
+391 00fc063b5e72b33a 1cc706ef835de1f5
+392 fe507aa9b02c64b2 4a97499202850f2f
+393 b54986928a79f33b 4a97499202850f2f
+394 b40cb865b688c04d 31987b68f78a15ac
+395 bf65bea84695683b 9d4350e62594c4bd
+396 a225c69bbd1d67e0 f40fb7195f28aa33
+397 c69c3dd6edf05819 b710b1ca83361783
+398 34f0ea08e970ecec 147cedfd51c962e2
+399 38be5157032150ba 5ceb282c1f457903
+400 647ee8d3441c5bf7 19baf59da7b9d9d3
+401 d2256f8f7ade8e83 19baf59da7b9d9d3
+402 b0f50f93e8a44cd3 19baf59da7b9d9d3
+403 11313347e7c68535 19baf59da7b9d9d3
+404 b1522a45a7161f20 9d4350e62594c4bd
+405 647ee8d3441c5bf7 19baf59da7b9d9d3
+406 bf7ebf168c51b295 19baf59da7b9d9d3
+407 dc4f4e404116ea10 19baf59da7b9d9d3
+408 d24eeff4f6959dbf 19baf59da7b9d9d3
+409 17ca09fe5c27d838 19baf59da7b9d9d3
+410 31aa58e9f117330a 19baf59da7b9d9d3
+411 888585d4516e7d79 19baf59da7b9d9d3
+412 160bc87d467f2292 9d4350e62594c4bd
+413 d24eeff4f6959dbf 19baf59da7b9d9d3
+414 7bae6841c0a11d6d 19baf59da7b9d9d3
+415 de6dba3f5ca4f98d 19baf59da7b9d9d3
+416 2693ce139bb13add 19baf59da7b9d9d3
+417 991639b17ed87965 19baf59da7b9d9d3
+418 535d489a07c5c2cc 19baf59da7b9d9d3
+419 1d012050be81d6e4 19baf59da7b9d9d3
+420 a2219882dbb9d2bf 19baf59da7b9d9d3
+421 5dea9607d4d96427 19baf59da7b9d9d3
+422 731c61fe14f5310b 19baf59da7b9d9d3
+423 2423ad27cdc3cb3a 9d4350e62594c4bd
+424 2693ce139bb13add 19baf59da7b9d9d3
+425 f54748293e559970 19baf59da7b9d9d3
+426 6a964da89bd302f6 19baf59da7b9d9d3
+427 8998c2ed76376521 19baf59da7b9d9d3
+428 7c7b19325e4916ee 19baf59da7b9d9d3
+429 7c7fe54d586266a5 19baf59da7b9d9d3
+430 2e4b8f5e416d10eb 19baf59da7b9d9d3
+431 e256f79d68585364 19baf59da7b9d9d3
+432 a77439ee62109032 19baf59da7b9d9d3
+433 9bd36c790386c41d 19baf59da7b9d9d3
+434 52a4a76f541b5aaa 19baf59da7b9d9d3
+435 8560f202e9ecca63 9d4350e62594c4bd
+436 7c7b19325e4916ee 19baf59da7b9d9d3
+437 e503c9450e4958aa 19baf59da7b9d9d3
+438 9c8a932cf22e25ac 19baf59da7b9d9d3
+439 c99e33ee5984331c 19baf59da7b9d9d3
+440 858f6359c6c4f795 84b40e1a94ad80ed
+441 ec6c882299a61119 84b40e1a94ad80ed
+442 86055cae165ed345 84b40e1a94ad80ed
+443 befd60f78c9f00e7 84b40e1a94ad80ed
+444 d6443fbeb262a984 9d4350e62594c4bd
+445 858f6359c6c4f795 84b40e1a94ad80ed
+446 807e30fa43e21b13 84b40e1a94ad80ed
+447 c01b57d10324039f 84b40e1a94ad80ed
+448 d4489cc21574905d 84b40e1a94ad80ed
+449 58037778db0ac83b 84b40e1a94ad80ed
+450 47d756e2c3ce062c 84b40e1a94ad80ed
+451 0fc4112e518534a7 84b40e1a94ad80ed
+452 4ab7ec9d36f2209b 9d4350e62594c4bd
+453 d4489cc21574905d 84b40e1a94ad80ed
+454 ba99ec08c1f99e15 84b40e1a94ad80ed
+455 93d357584194b7c1 84b40e1a94ad80ed
+456 d1245512dcfd7fd6 84b40e1a94ad80ed
+457 e9c02d6d961584ca 84b40e1a94ad80ed
+458 8fa04611a831375c 84b40e1a94ad80ed
+459 6d89b33bcdf06651 84b40e1a94ad80ed
+460 5dc04629d4a9bea1 84b40e1a94ad80ed
+461 4abd556cb6724aa6 84b40e1a94ad80ed
+462 e968c454a2870dbe 84b40e1a94ad80ed
+463 fa9440fb48ade7b0 9d4350e62594c4bd
+464 d1245512dcfd7fd6 84b40e1a94ad80ed
+465 ef8b57d69b695252 84b40e1a94ad80ed
+466 1e5c093e2012db42 84b40e1a94ad80ed
+467 c4e146f10d35f012 84b40e1a94ad80ed
+468 8dd48d14a66f7e09 84b40e1a94ad80ed
+469 b9437b21734dc5dd 84b40e1a94ad80ed
+470 27bc8e943e69e5c2 84b40e1a94ad80ed
+471 5e81baabfdb5b45b 84b40e1a94ad80ed
+472 0d43eec42b24b3c6 84b40e1a94ad80ed
+473 a7e9b26002e36a71 84b40e1a94ad80ed
+474 29a1847f1d50b27e 84b40e1a94ad80ed
+475 7979f59b49b960a8 9d4350e62594c4bd
+476 8dd48d14a66f7e09 84b40e1a94ad80ed
+477 ff91924d0adcbbcc 84b40e1a94ad80ed
+478 957240ed7882b659 84b40e1a94ad80ed
+479 e659eae583d5fb34 84b40e1a94ad80ed
+480 858f6359c6c4f795 84b40e1a94ad80ed
+481 ec6c882299a61119 84b40e1a94ad80ed
+482 86055cae165ed345 84b40e1a94ad80ed
+483 befd60f78c9f00e7 84b40e1a94ad80ed
+484 d6443fbeb262a984 9d4350e62594c4bd
+485 858f6359c6c4f795 84b40e1a94ad80ed
+486 807e30fa43e21b13 84b40e1a94ad80ed
+487 c01b57d10324039f 84b40e1a94ad80ed
+488 d4489cc21574905d 84b40e1a94ad80ed
+489 58037778db0ac83b 84b40e1a94ad80ed
+490 47d756e2c3ce062c 84b40e1a94ad80ed
+491 0fc4112e518534a7 84b40e1a94ad80ed
+492 4ab7ec9d36f2209b 9d4350e62594c4bd
+493 d4489cc21574905d 84b40e1a94ad80ed
+494 ba99ec08c1f99e15 84b40e1a94ad80ed
+495 93d357584194b7c1 84b40e1a94ad80ed
+496 d1245512dcfd7fd6 84b40e1a94ad80ed
+497 e9c02d6d961584ca 84b40e1a94ad80ed
+498 8fa04611a831375c 84b40e1a94ad80ed
+499 6d89b33bcdf06651 84b40e1a94ad80ed
+500 5dc04629d4a9bea1 84b40e1a94ad80ed
+501 4abd556cb6724aa6 84b40e1a94ad80ed
+502 e968c454a2870dbe 84b40e1a94ad80ed
+503 fa9440fb48ade7b0 9d4350e62594c4bd
+504 d1245512dcfd7fd6 84b40e1a94ad80ed
+505 ef8b57d69b695252 84b40e1a94ad80ed
+506 1e5c093e2012db42 84b40e1a94ad80ed
+507 c4e146f10d35f012 84b40e1a94ad80ed
+508 8dd48d14a66f7e09 84b40e1a94ad80ed
+509 b9437b21734dc5dd 84b40e1a94ad80ed
+510 27bc8e943e69e5c2 84b40e1a94ad80ed
+511 5e81baabfdb5b45b 84b40e1a94ad80ed
+512 0d43eec42b24b3c6 84b40e1a94ad80ed
+513 a7e9b26002e36a71 84b40e1a94ad80ed
+514 29a1847f1d50b27e 84b40e1a94ad80ed
+515 7979f59b49b960a8 9d4350e62594c4bd
+516 8dd48d14a66f7e09 84b40e1a94ad80ed
+517 ff91924d0adcbbcc 84b40e1a94ad80ed
+518 957240ed7882b659 84b40e1a94ad80ed
+519 e659eae583d5fb34 84b40e1a94ad80ed
+520 453556fb0220228c 47418fe16fbcc8a9
+521 9a3a25b1fc532ba0 4a97499202850f2f
+522 c26822d00bce67e9 4a97499202850f2f
+523 2397c03c47c05cb5 31987b68f78a15ac
+524 da4f7bd6ef09de3f 9d4350e62594c4bd
+525 748b592010d70267 9c233a3e60a0c647
+526 74db9c5c282833cc e895d9daff6b670b
+527 a31dd7624f11e404 147cedfd51c962e2
+528 e54310fe0bac46aa 80f1a16aa54d8a9b
+529 fb1371d086cc25f5 4a97499202850f2f
+530 2b902d3227cd1d2a 4a97499202850f2f
+531 53af1ac6b1cb488f 31987b68f78a15ac
+532 8409cf4389b3dbd4 9d4350e62594c4bd
+533 7aa2f21e23b94a21 2467740cf96b8eca
+534 907a6eee5205a594 0ca99558d9c1a39f
+535 846bce22287d4538 147cedfd51c962e2
+536 fbdb0191f09bacfd 53621bbd49ffd000
+537 a36e521cbaaabe93 5da1e1b9f1fe3767
+538 47b5cf9bd50e3f32 8697fd33ce12329c
+539 8f3b0f8a0e1ad840 83a59dad6e2963df
+540 5d76f3fa3ae0d9e8 4a97499202850f2f
+541 36f38f8f2939c2af 4a97499202850f2f
+542 eabb6324c613ea43 31987b68f78a15ac
+543 658a4255fb519125 9d4350e62594c4bd
+544 2714e75f946899a4 f0852ce72cb43a22
+545 190c67299a9a2f06 8ce1492bd8fe6f6e
+546 55e6460a6f9548c6 147cedfd51c962e2
+547 1f561d07fb39a2c7 b0fc4ce6c24ee1cc
+548 5b6eed66a470b2e8 b0ad53410f69cd11
+549 0749e676b08f896d 96d0daea03ab1637
+550 2e2d1fe16bfdccda f83d4d7047acc277
+551 8a25c2397979e45d f38dc03c50b0263b
+552 3e107be5eebe5163 4a97499202850f2f
+553 2165632e2d7d2ab7 4a97499202850f2f
+554 c7a13da6471db2b5 31987b68f78a15ac
+555 112c177e4da467b7 9d4350e62594c4bd
+556 fd296bbb282eaf9c c9bba77318b17582
+557 b8e1854503c47ce7 6fa21cc5d0232f24
+558 6e31c13f95e21340 147cedfd51c962e2
+559 9fc87c8c8355dc8a 54fee6532c345a48
+560 453556fb0220228c 47418fe16fbcc8a9
+561 9a3a25b1fc532ba0 4a97499202850f2f
+562 c26822d00bce67e9 4a97499202850f2f
+563 2397c03c47c05cb5 31987b68f78a15ac
+564 da4f7bd6ef09de3f 9d4350e62594c4bd
+565 748b592010d70267 9c233a3e60a0c647
+566 74db9c5c282833cc e895d9daff6b670b
+567 a31dd7624f11e404 147cedfd51c962e2
+568 e54310fe0bac46aa 80f1a16aa54d8a9b
+569 fb1371d086cc25f5 4a97499202850f2f
+570 2b902d3227cd1d2a 4a97499202850f2f
+571 53af1ac6b1cb488f 31987b68f78a15ac
+572 8409cf4389b3dbd4 9d4350e62594c4bd
+573 7aa2f21e23b94a21 2467740cf96b8eca
+574 907a6eee5205a594 0ca99558d9c1a39f
+575 846bce22287d4538 147cedfd51c962e2
+576 fbdb0191f09bacfd 53621bbd49ffd000
+577 a36e521cbaaabe93 5da1e1b9f1fe3767
+578 47b5cf9bd50e3f32 8697fd33ce12329c
+579 8f3b0f8a0e1ad840 83a59dad6e2963df
+580 5d76f3fa3ae0d9e8 4a97499202850f2f
+581 36f38f8f2939c2af 4a97499202850f2f
+582 eabb6324c613ea43 31987b68f78a15ac
+583 658a4255fb519125 9d4350e62594c4bd
+584 2714e75f946899a4 f0852ce72cb43a22
+585 190c67299a9a2f06 8ce1492bd8fe6f6e
+586 55e6460a6f9548c6 147cedfd51c962e2
+587 1f561d07fb39a2c7 b0fc4ce6c24ee1cc
+588 5b6eed66a470b2e8 b0ad53410f69cd11
+589 0749e676b08f896d 96d0daea03ab1637
+590 2e2d1fe16bfdccda f83d4d7047acc277
+591 8a25c2397979e45d f38dc03c50b0263b
+592 3e107be5eebe5163 4a97499202850f2f
+593 2165632e2d7d2ab7 4a97499202850f2f
+594 c7a13da6471db2b5 31987b68f78a15ac
+595 112c177e4da467b7 9d4350e62594c4bd
+596 fd296bbb282eaf9c c9bba77318b17582
+597 b8e1854503c47ce7 6fa21cc5d0232f24
+598 6e31c13f95e21340 147cedfd51c962e2
+599 9fc87c8c8355dc8a 54fee6532c345a48
diff --git a/crates/socket-patch-core/tests/equivalence/pdm_plan.golden b/crates/socket-patch-core/tests/equivalence/pdm_plan.golden
new file mode 100644
index 00000000..8d4ba81f
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/pdm_plan.golden
@@ -0,0 +1,352 @@
+# One (lock, dep) pair, planned: the rewritten text and FileEdits, or the refusal.
+# <case> <input digest> <output digest>
+0.12.3-extras.lock/false/0 78c0d1394f4fc6bc 641af12243061413
+0.12.3-extras.lock/false/0/0 6086a7361d112583 c794dccadef2e1a3
+0.12.3-extras.lock/false/0/1 f502f2fee23a1d58 6594cad621796c4b
+0.12.3-extras.lock/false/0/2 b69d24c9271311c7 31987b68f78a15ac
+0.12.3-extras.lock/false/0/3 b002047527e7ad13 9d4350e62594c4bd
+0.12.3-extras.lock/false/0/4 42bda7e107c53828 9931d34fbe45f32a
+0.12.3-extras.lock/false/1 1d47e9e9d2933b4a 40f75922033dca4b
+0.12.3-extras.lock/false/1/0 5c15040e457bca61 b6bbfc082ad92f41
+0.12.3-extras.lock/false/1/1 b0b8796bf5efc39e b4f2458720f4cd7c
+0.12.3-extras.lock/false/1/2 1bef9b4a2202efa4 31987b68f78a15ac
+0.12.3-extras.lock/false/1/3 f5ed91606d4fbf7d 9d4350e62594c4bd
+0.12.3-extras.lock/false/1/4 7e8301d97dbed85f 0715c58f7c5319d5
+0.12.3-extras.lock/false/2 7dceb2d03ea484d2 31987b68f78a15ac
+0.12.3-extras.lock/false/3 08378e224be26302 9d4350e62594c4bd
+0.12.3-extras.lock/false/4 89e0d2790d70d761 1c82ec45cb26d815
+0.12.3-extras.lock/false/4/0 a3ba92b5ca9b06ba df1b988c1e90b760
+0.12.3-extras.lock/false/4/1 cffeddc5c6f38d5f 73452f1d0bacd19b
+0.12.3-extras.lock/false/4/2 5f650199b59aca2c 31987b68f78a15ac
+0.12.3-extras.lock/false/4/3 c0f461deb814a020 9d4350e62594c4bd
+0.12.3-extras.lock/false/4/4 9a0ed1349a5542d8 0ccd44d1d748b809
+0.12.3-extras.lock/true/0 889c2b3c73c80979 626d1ffaf17c247a
+0.12.3-extras.lock/true/0/0 df7bb229614e769a dfff021916037b96
+0.12.3-extras.lock/true/0/1 6c4cb26fad45df14 3c0e78778d30d550
+0.12.3-extras.lock/true/0/2 7c51eaea5709d0ae 31987b68f78a15ac
+0.12.3-extras.lock/true/0/3 0c399cea1ce94b3a 9d4350e62594c4bd
+0.12.3-extras.lock/true/0/4 2ef570d4e245edcd 9559753bd8985c28
+0.12.3-extras.lock/true/1 f583e3c835985494 0a5237c601b0fbd0
+0.12.3-extras.lock/true/1/0 3d8885bbc50c12e9 4dff40afe23447f4
+0.12.3-extras.lock/true/1/1 c1f70d10dbc04f1f f1c85439230fc62c
+0.12.3-extras.lock/true/1/2 91a07a19f96775dd 31987b68f78a15ac
+0.12.3-extras.lock/true/1/3 b2179a3dc35aa944 9d4350e62594c4bd
+0.12.3-extras.lock/true/1/4 48608e97c7de3b03 36be459d3ef4d437
+0.12.3-extras.lock/true/2 7bb227b4d13f42a9 31987b68f78a15ac
+0.12.3-extras.lock/true/3 f81d4dcb599cd462 9d4350e62594c4bd
+0.12.3-extras.lock/true/4 ce0465fe13e312d5 b266228082334d34
+0.12.3-extras.lock/true/4/0 1e7642b442257662 b9651f3b518c456a
+0.12.3-extras.lock/true/4/1 6783cd75ac86c5c4 4558e18b7fc5f622
+0.12.3-extras.lock/true/4/2 34317bdb4bffd9cb 31987b68f78a15ac
+0.12.3-extras.lock/true/4/3 8a7b9a908ab1a998 9d4350e62594c4bd
+0.12.3-extras.lock/true/4/4 a06ceafad0c4a775 107629accde8a726
+0.12.3.lock/false/0 059cb65cddfebda4 e31aa76ad2f62372
+0.12.3.lock/false/0/0 988c6e73fcfa2749 931937f81c56547a
+0.12.3.lock/false/0/1 fdbc99ae2feaadb8 2247e0a1eb31bd39
+0.12.3.lock/false/0/2 eebb095847f23edd 31987b68f78a15ac
+0.12.3.lock/false/0/3 4bf2c9f0e7447268 9d4350e62594c4bd
+0.12.3.lock/false/0/4 6749570e5eee4a23 4a97499202850f2f
+0.12.3.lock/false/1 de0790bc84133f7e 42f29e6f6f69652d
+0.12.3.lock/false/1/0 dd5e73e43f10f92c 2f149871e57b72cb
+0.12.3.lock/false/1/1 7d8c8dc8d7c07847 30c6e6ab223f47d2
+0.12.3.lock/false/1/2 e46f58ca98c934f9 31987b68f78a15ac
+0.12.3.lock/false/1/3 5e05546155b36e74 9d4350e62594c4bd
+0.12.3.lock/false/1/4 ea6b24f45f680e8a 4a97499202850f2f
+0.12.3.lock/false/2 f5ea0aedb12b55d8 31987b68f78a15ac
+0.12.3.lock/false/3 bd2de7d2e9b5fb14 9d4350e62594c4bd
+0.12.3.lock/false/4 253d0ebb38402458 4a97499202850f2f
+0.12.3.lock/true/0 caf8852d5edcd968 1237e046c1c0ce1f
+0.12.3.lock/true/0/0 8b503807e1f4551e d13fbed86369364a
+0.12.3.lock/true/0/1 4089f2ff1f715bfe 93d31c2c16094584
+0.12.3.lock/true/0/2 271ab0dc5812b332 31987b68f78a15ac
+0.12.3.lock/true/0/3 f9c4bcdac99e31be 9d4350e62594c4bd
+0.12.3.lock/true/0/4 d04710ab7abe0d34 4a97499202850f2f
+0.12.3.lock/true/1 621e8f88515da16a 9989694be8dc3eac
+0.12.3.lock/true/1/0 fba6ecb1a54aee42 462aaedc2f700cff
+0.12.3.lock/true/1/1 218e6f6a30cae17f dbd8029d038a99fd
+0.12.3.lock/true/1/2 f9cf049f5f4a5a42 31987b68f78a15ac
+0.12.3.lock/true/1/3 a9ca6b90954cef2c 9d4350e62594c4bd
+0.12.3.lock/true/1/4 1411304b2d86bb13 4a97499202850f2f
+0.12.3.lock/true/2 249bedf939ae8490 31987b68f78a15ac
+0.12.3.lock/true/3 fff2f091f829799a 9d4350e62594c4bd
+0.12.3.lock/true/4 008bb31ef347fcb3 4a97499202850f2f
+1.15.5.lock/false/0 9d72e20609fc3d38 40b7af0efb673911
+1.15.5.lock/false/1 8588f7862f471b81 40b7af0efb673911
+1.15.5.lock/false/2 f2c5d7ab6bbb0372 40b7af0efb673911
+1.15.5.lock/false/3 02857baf53a5d2f8 9d4350e62594c4bd
+1.15.5.lock/false/4 e116d0b471412989 40b7af0efb673911
+1.15.5.lock/true/0 d2bf27c59177dc0f 40b7af0efb673911
+1.15.5.lock/true/1 e03d432effad6805 40b7af0efb673911
+1.15.5.lock/true/2 3ae7f25cf253ea3f 40b7af0efb673911
+1.15.5.lock/true/3 7f9671aa49ce84d2 9d4350e62594c4bd
+1.15.5.lock/true/4 81545bc098518bd8 40b7af0efb673911
+2.0.3.lock/false/0 67bd95c4e31f570d e5cfd07aff56674c
+2.0.3.lock/false/1 b866378911a6a30a e5cfd07aff56674c
+2.0.3.lock/false/2 7acdd2c1fd2dbae4 e5cfd07aff56674c
+2.0.3.lock/false/3 9e4549c50c0f355b 9d4350e62594c4bd
+2.0.3.lock/false/4 0545dd8d827781e1 e5cfd07aff56674c
+2.0.3.lock/true/0 108d3012c2bf3a7d e5cfd07aff56674c
+2.0.3.lock/true/1 7f432fa1e2eea86c e5cfd07aff56674c
+2.0.3.lock/true/2 bc93cfa09e31941a e5cfd07aff56674c
+2.0.3.lock/true/3 bc28c56a292aad59 9d4350e62594c4bd
+2.0.3.lock/true/4 de66b7ca5a009e29 e5cfd07aff56674c
+2.1.5.lock/false/0 67bd95c4e31f570d e5cfd07aff56674c
+2.1.5.lock/false/1 b866378911a6a30a e5cfd07aff56674c
+2.1.5.lock/false/2 7acdd2c1fd2dbae4 e5cfd07aff56674c
+2.1.5.lock/false/3 9e4549c50c0f355b 9d4350e62594c4bd
+2.1.5.lock/false/4 0545dd8d827781e1 e5cfd07aff56674c
+2.1.5.lock/true/0 108d3012c2bf3a7d e5cfd07aff56674c
+2.1.5.lock/true/1 7f432fa1e2eea86c e5cfd07aff56674c
+2.1.5.lock/true/2 bc93cfa09e31941a e5cfd07aff56674c
+2.1.5.lock/true/3 bc28c56a292aad59 9d4350e62594c4bd
+2.1.5.lock/true/4 de66b7ca5a009e29 e5cfd07aff56674c
+2.10.4.lock/false/0 4b49f0d0cb61a9a5 02e011c925244d30
+2.10.4.lock/false/0/0 7449d96476be77fe fbbd7786d1511c97
+2.10.4.lock/false/0/1 8939f16214c1a975 7dd985a30e3340a4
+2.10.4.lock/false/0/2 c26fc670033ade33 31987b68f78a15ac
+2.10.4.lock/false/0/3 1108cbe009b2a8b8 9d4350e62594c4bd
+2.10.4.lock/false/0/4 7947bc2bcf2160fa 4a97499202850f2f
+2.10.4.lock/false/1 0649801b51d793c0 ebc63b4c53b0af6b
+2.10.4.lock/false/1/0 d58c2e2eebb0724d a2d80e971b4eaf2d
+2.10.4.lock/false/1/1 51e9e12c9d282e5f 2b6d59654a4c4d13
+2.10.4.lock/false/1/2 9d1c7074c077cf37 31987b68f78a15ac
+2.10.4.lock/false/1/3 a7c5868ce2f53a15 9d4350e62594c4bd
+2.10.4.lock/false/1/4 c8974a9aaae5eac2 4a97499202850f2f
+2.10.4.lock/false/2 bcbe81fd8d155b26 31987b68f78a15ac
+2.10.4.lock/false/3 2547935d140b7642 9d4350e62594c4bd
+2.10.4.lock/false/4 0aa1490b81cfef63 4a97499202850f2f
+2.10.4.lock/true/0 84d56df15a998d76 3b6d7173113b0cb5
+2.10.4.lock/true/0/0 807325f90ffc8917 7c21efc4765488ef
+2.10.4.lock/true/0/1 66bd13f9a308afe4 92c765a769d687ee
+2.10.4.lock/true/0/2 cf4d2eea0789b728 31987b68f78a15ac
+2.10.4.lock/true/0/3 0dfaa08357e428e6 9d4350e62594c4bd
+2.10.4.lock/true/0/4 6fec1678f7fbae6e 4a97499202850f2f
+2.10.4.lock/true/1 9dd71c39e8feab41 1c237a052284134c
+2.10.4.lock/true/1/0 eb7f6df52e9307ec a0d8246105e87a8d
+2.10.4.lock/true/1/1 769491e5465071b6 a07cd55953b6b5d2
+2.10.4.lock/true/1/2 a1f4b54e548d12d3 31987b68f78a15ac
+2.10.4.lock/true/1/3 be74589fb91ca7db 9d4350e62594c4bd
+2.10.4.lock/true/1/4 e70b05801ccd40e0 4a97499202850f2f
+2.10.4.lock/true/2 3b4bb5f2ad46201b 31987b68f78a15ac
+2.10.4.lock/true/3 2c3cc2ca3a49c20b 9d4350e62594c4bd
+2.10.4.lock/true/4 a7ce896471327446 4a97499202850f2f
+2.11.2.lock/false/0 1b29f8833aafa886 4aeafa9ba5751804
+2.11.2.lock/false/0/0 c371c8fa028f9282 c02f841018cf9f97
+2.11.2.lock/false/0/1 5a2d0f8322e5fa85 bab2f69ff616c57e
+2.11.2.lock/false/0/2 b5b39cdbb7443660 31987b68f78a15ac
+2.11.2.lock/false/0/3 4da894a325e20f22 9d4350e62594c4bd
+2.11.2.lock/false/0/4 cb0cfa4a7d607ac3 4a97499202850f2f
+2.11.2.lock/false/1 468e5a29dec27241 c0b255d4a846468e
+2.11.2.lock/false/1/0 8efbaa084dd60b35 6245564f1d77986a
+2.11.2.lock/false/1/1 56b215af9e252cfa 4cda3430ffb14c07
+2.11.2.lock/false/1/2 cae3af7aab713faa 31987b68f78a15ac
+2.11.2.lock/false/1/3 4d94bdcfec568d4a 9d4350e62594c4bd
+2.11.2.lock/false/1/4 ac09f36eb19f7ba6 4a97499202850f2f
+2.11.2.lock/false/2 23912b3c6f9a27f9 31987b68f78a15ac
+2.11.2.lock/false/3 8217e98f241873d5 9d4350e62594c4bd
+2.11.2.lock/false/4 03c094b4c51c9285 4a97499202850f2f
+2.11.2.lock/true/0 4e07c96cfcb18376 28ce8fc82e0ea3bc
+2.11.2.lock/true/0/0 93def020a91a9918 b8a37bf5d84fd2e3
+2.11.2.lock/true/0/1 7b78f82427e27501 896cc10f97969cbc
+2.11.2.lock/true/0/2 a9fd9bdc97b60006 31987b68f78a15ac
+2.11.2.lock/true/0/3 b0fa00159780ca47 9d4350e62594c4bd
+2.11.2.lock/true/0/4 09a43ab19e36cbe7 4a97499202850f2f
+2.11.2.lock/true/1 b6a649f59d474bd6 5b90c99302416a3f
+2.11.2.lock/true/1/0 156bb770f0f750f0 aca42b61ee63421f
+2.11.2.lock/true/1/1 2d48df55102a551b 83bac03e13f6e476
+2.11.2.lock/true/1/2 13dc3e43876b9dc9 31987b68f78a15ac
+2.11.2.lock/true/1/3 86a1bd7f05d932c8 9d4350e62594c4bd
+2.11.2.lock/true/1/4 8f543bb91be26075 4a97499202850f2f
+2.11.2.lock/true/2 d98c682914f1ac96 31987b68f78a15ac
+2.11.2.lock/true/3 2738d00d03241c74 9d4350e62594c4bd
+2.11.2.lock/true/4 fbed1f0f8562c76d 4a97499202850f2f
+2.17.3.lock/false/0 1a978bf6ec4e05c4 23c8a0ce65fa30a3
+2.17.3.lock/false/0/0 0fa2f6c2a4960807 2f3fe226135086e4
+2.17.3.lock/false/0/1 de8bb5f5c8213d14 e5147585e36687de
+2.17.3.lock/false/0/2 339863d7500f5f92 31987b68f78a15ac
+2.17.3.lock/false/0/3 061354d117f0ae08 9d4350e62594c4bd
+2.17.3.lock/false/0/4 36ca5c0363f484cb 4a97499202850f2f
+2.17.3.lock/false/1 f46253c14912d0d6 2b8fd04412796181
+2.17.3.lock/false/1/0 9dadfb7d381197eb 246f500d484017a1
+2.17.3.lock/false/1/1 bdaa0c4e009a2fb3 6dd3c4c57ba29cae
+2.17.3.lock/false/1/2 4afbab0568e00923 31987b68f78a15ac
+2.17.3.lock/false/1/3 913372421c075889 9d4350e62594c4bd
+2.17.3.lock/false/1/4 11396f5cee3460ca 4a97499202850f2f
+2.17.3.lock/false/2 986b83a7c6da3851 31987b68f78a15ac
+2.17.3.lock/false/3 62c0c49b913f3d5c 9d4350e62594c4bd
+2.17.3.lock/false/4 dd16c8b258b01501 4a97499202850f2f
+2.17.3.lock/true/0 59f37d4f84d0450a a593999fe97501c0
+2.17.3.lock/true/0/0 ac26a4e3872ebdff c9f98c47fe615945
+2.17.3.lock/true/0/1 bde1452cdeabf4d4 20936f4bc40be4ce
+2.17.3.lock/true/0/2 01da50e7dd0fccd2 31987b68f78a15ac
+2.17.3.lock/true/0/3 0c00fb0ed73d35bc 9d4350e62594c4bd
+2.17.3.lock/true/0/4 4718a0ed75c7c11e 4a97499202850f2f
+2.17.3.lock/true/1 565f0e865fb6f6b4 be834db44553c88f
+2.17.3.lock/true/1/0 c1de231f4a8ecf1e c90fb55476196f9d
+2.17.3.lock/true/1/1 88d27d4f7f2b461b d7394268b65e5add
+2.17.3.lock/true/1/2 9eff0871c3bd5a46 31987b68f78a15ac
+2.17.3.lock/true/1/3 6439ae064dc09a5e 9d4350e62594c4bd
+2.17.3.lock/true/1/4 39f9e4adb8412647 4a97499202850f2f
+2.17.3.lock/true/2 6654e3019c0b2fc3 31987b68f78a15ac
+2.17.3.lock/true/3 d444047068bb51eb 9d4350e62594c4bd
+2.17.3.lock/true/4 f795c54c92bd4a07 4a97499202850f2f
+2.29.2-extras.lock/false/0 4b4f6d3bbd40e8f0 9ee055ba2620d35d
+2.29.2-extras.lock/false/0/0 4236a1120886b33a 2516b8a4d057bc11
+2.29.2-extras.lock/false/0/1 ab121fcf6af55359 394eaf1a20bbe9c0
+2.29.2-extras.lock/false/0/2 5a276ccd185ba008 31987b68f78a15ac
+2.29.2-extras.lock/false/0/3 e5c164555600d1bf 9d4350e62594c4bd
+2.29.2-extras.lock/false/0/4 0ffc545a5ba29e13 20736854c7456967
+2.29.2-extras.lock/false/1 3d6d9f1aa4cd7d38 d78bb3ade5453cdd
+2.29.2-extras.lock/false/1/0 b487008f0aa3a7e4 db3ccf48ea8ecbfc
+2.29.2-extras.lock/false/1/1 0d7877c8042815bb 641d488b23f7c8c9
+2.29.2-extras.lock/false/1/2 c9bd997c198bd870 31987b68f78a15ac
+2.29.2-extras.lock/false/1/3 fb64a25d73a65c9e 9d4350e62594c4bd
+2.29.2-extras.lock/false/1/4 1ece70b4c30be10c 57c6944b8081dc52
+2.29.2-extras.lock/false/2 e566dae95a9e004d 31987b68f78a15ac
+2.29.2-extras.lock/false/3 0d3baab19958d37d 9d4350e62594c4bd
+2.29.2-extras.lock/false/4 cd4d01e96e783f60 cbc8fdf8412618de
+2.29.2-extras.lock/false/4/0 f11388289144bb10 b791924f46a9f5fb
+2.29.2-extras.lock/false/4/1 186c989dc779922a 167cb808ffcbf707
+2.29.2-extras.lock/false/4/2 0f9c440563cfe2f0 31987b68f78a15ac
+2.29.2-extras.lock/false/4/3 587733ccd4f9275c 9d4350e62594c4bd
+2.29.2-extras.lock/false/4/4 5ddfba572f128954 cf0b4824213c096b
+2.29.2-extras.lock/true/0 76cdfeb4a2b94bf0 db320a363f3b0aef
+2.29.2-extras.lock/true/0/0 c47e989c0e4dfe92 e00df16814e293c6
+2.29.2-extras.lock/true/0/1 4f9d83db83c80f72 ac51d054694d0605
+2.29.2-extras.lock/true/0/2 9c5f1bd156b8e30c 31987b68f78a15ac
+2.29.2-extras.lock/true/0/3 362b28a5a539d60f 9d4350e62594c4bd
+2.29.2-extras.lock/true/0/4 542b36ac8e279eb1 3a8e9068f2a4684a
+2.29.2-extras.lock/true/1 2279013e11776cc7 57f2d26e43c09de2
+2.29.2-extras.lock/true/1/0 307f45150e84ed7e 42ffefffbc549990
+2.29.2-extras.lock/true/1/1 10cca6777d487e44 be9060dc1b6a69c9
+2.29.2-extras.lock/true/1/2 4fba6905dcdf89e1 31987b68f78a15ac
+2.29.2-extras.lock/true/1/3 3c79e962b64d0737 9d4350e62594c4bd
+2.29.2-extras.lock/true/1/4 3070f1699a2704ee 6dfad02f0313a3cc
+2.29.2-extras.lock/true/2 076496fce5be8bbb 31987b68f78a15ac
+2.29.2-extras.lock/true/3 a2de7459efec7527 9d4350e62594c4bd
+2.29.2-extras.lock/true/4 5efd91f5a5ba60a0 e8bcc8043f9ab68d
+2.29.2-extras.lock/true/4/0 72f04ccd99c8d742 8b1d9e220912140c
+2.29.2-extras.lock/true/4/1 0d8c673e124427bd 79e77ba52682742e
+2.29.2-extras.lock/true/4/2 e0a8c1d36d42ac3d 31987b68f78a15ac
+2.29.2-extras.lock/true/4/3 d1b8cf0d0d1b4e32 9d4350e62594c4bd
+2.29.2-extras.lock/true/4/4 e7077f7068e1d9bb a66c11ad990d52e6
+2.29.2.lock/false/0 1edece642cfe0c82 0b4d13f6c6530254
+2.29.2.lock/false/0/0 231e0e611fd159e9 59e4551e3a18c54d
+2.29.2.lock/false/0/1 8cb0a3c104d0e085 f2ea3957fce316cf
+2.29.2.lock/false/0/2 41d8e6e9cb5edfd3 31987b68f78a15ac
+2.29.2.lock/false/0/3 2fb1cba7a90ef5ff 9d4350e62594c4bd
+2.29.2.lock/false/0/4 3e058d1109714614 4a97499202850f2f
+2.29.2.lock/false/1 53dc731fb86a6373 e867aaa9c9e6b91b
+2.29.2.lock/false/1/0 b72f4748ae803e97 620ef43ba38ee7e7
+2.29.2.lock/false/1/1 f6068a5e61a71a3c 677fd6c338025580
+2.29.2.lock/false/1/2 b7cc7693d49afdb0 31987b68f78a15ac
+2.29.2.lock/false/1/3 76881ad3bf43d6c7 9d4350e62594c4bd
+2.29.2.lock/false/1/4 20e2253a78534f2e 4a97499202850f2f
+2.29.2.lock/false/2 d89131c69f6c1227 31987b68f78a15ac
+2.29.2.lock/false/3 32e395e43fab5663 9d4350e62594c4bd
+2.29.2.lock/false/4 562e19bd55e8b674 4a97499202850f2f
+2.29.2.lock/true/0 8a43743e5286232e f07f55759755778d
+2.29.2.lock/true/0/0 71a3f31fec800a94 1ca72aab99b79722
+2.29.2.lock/true/0/1 377348d1770d8d3c 83f6e429a4b6dc23
+2.29.2.lock/true/0/2 594f0ebd90887831 31987b68f78a15ac
+2.29.2.lock/true/0/3 a751575c387bd80a 9d4350e62594c4bd
+2.29.2.lock/true/0/4 bde4e70968527015 4a97499202850f2f
+2.29.2.lock/true/1 bf5a4a16b326bbe3 487e511714886b25
+2.29.2.lock/true/1/0 792c78d66ba2c420 0b29c3a314eddedf
+2.29.2.lock/true/1/1 37d19a9b5caa7816 ba96185c0a0d871e
+2.29.2.lock/true/1/2 f2d579e4b4be55ba 31987b68f78a15ac
+2.29.2.lock/true/1/3 a9b40ca4d6485935 9d4350e62594c4bd
+2.29.2.lock/true/1/4 5fe2e98bcb96858a 4a97499202850f2f
+2.29.2.lock/true/2 1caffaf42779819c 31987b68f78a15ac
+2.29.2.lock/true/3 7fb7508b9af1a3d9 9d4350e62594c4bd
+2.29.2.lock/true/4 0505712b6e7cfba9 4a97499202850f2f
+2.3.4.lock/false/0 ac6cf543f7625ad5 19baf59da7b9d9d3
+2.3.4.lock/false/1 55f1f45d7ad970d2 19baf59da7b9d9d3
+2.3.4.lock/false/2 201de4c4094726e2 19baf59da7b9d9d3
+2.3.4.lock/false/3 02f719f63645f2d4 9d4350e62594c4bd
+2.3.4.lock/false/4 4ced9f97d019a596 19baf59da7b9d9d3
+2.3.4.lock/true/0 d44eb779ce8d49af 19baf59da7b9d9d3
+2.3.4.lock/true/1 424f199b199fd495 19baf59da7b9d9d3
+2.3.4.lock/true/2 16039e1e37786287 19baf59da7b9d9d3
+2.3.4.lock/true/3 5657e6b34be73da6 9d4350e62594c4bd
+2.3.4.lock/true/4 996e7bb3c8f1cb24 19baf59da7b9d9d3
+2.6.1.lock/false/0 af3be1157ecd6d58 84b40e1a94ad80ed
+2.6.1.lock/false/1 335238fbbe4c2423 84b40e1a94ad80ed
+2.6.1.lock/false/2 9b33ab2dd33d9cf2 84b40e1a94ad80ed
+2.6.1.lock/false/3 6fd61aa6609508be 9d4350e62594c4bd
+2.6.1.lock/false/4 e90d11b6d3e7f022 84b40e1a94ad80ed
+2.6.1.lock/true/0 c1ac5fa3ca8213cf 84b40e1a94ad80ed
+2.6.1.lock/true/1 6886de274446391d 84b40e1a94ad80ed
+2.6.1.lock/true/2 fa69ac05b81bd422 84b40e1a94ad80ed
+2.6.1.lock/true/3 984ee9676c10b7e8 9d4350e62594c4bd
+2.6.1.lock/true/4 ba3dff3fdab3186a 84b40e1a94ad80ed
+2.7.4.lock/false/0 af3be1157ecd6d58 84b40e1a94ad80ed
+2.7.4.lock/false/1 335238fbbe4c2423 84b40e1a94ad80ed
+2.7.4.lock/false/2 9b33ab2dd33d9cf2 84b40e1a94ad80ed
+2.7.4.lock/false/3 6fd61aa6609508be 9d4350e62594c4bd
+2.7.4.lock/false/4 e90d11b6d3e7f022 84b40e1a94ad80ed
+2.7.4.lock/true/0 c1ac5fa3ca8213cf 84b40e1a94ad80ed
+2.7.4.lock/true/1 6886de274446391d 84b40e1a94ad80ed
+2.7.4.lock/true/2 fa69ac05b81bd422 84b40e1a94ad80ed
+2.7.4.lock/true/3 984ee9676c10b7e8 9d4350e62594c4bd
+2.7.4.lock/true/4 ba3dff3fdab3186a 84b40e1a94ad80ed
+2.8.2.lock/false/0 013cfec6f337268d 3ae5146fc4b223ea
+2.8.2.lock/false/0/0 d80f5deb0440d83c 0d985a6b205233cf
+2.8.2.lock/false/0/1 2d0eb36af655b9af 861a365271db06fb
+2.8.2.lock/false/0/2 61361d1a0b5b0b8f 31987b68f78a15ac
+2.8.2.lock/false/0/3 d50e9644b5415804 9d4350e62594c4bd
+2.8.2.lock/false/0/4 f8962f673b623907 4a97499202850f2f
+2.8.2.lock/false/1 2b3be7571563d16d 6baa2d2dfc13267d
+2.8.2.lock/false/1/0 f95a93faed27af1d e2aaad3d6417a3d8
+2.8.2.lock/false/1/1 9a5fe84f5d756f7a f11528364defd16b
+2.8.2.lock/false/1/2 1e53d25319d5c2d5 31987b68f78a15ac
+2.8.2.lock/false/1/3 ac58dc489d0af8cb 9d4350e62594c4bd
+2.8.2.lock/false/1/4 77797e6ad3eed1bc 4a97499202850f2f
+2.8.2.lock/false/2 eafb788efd65ec0b 31987b68f78a15ac
+2.8.2.lock/false/3 783706256d72eaaf 9d4350e62594c4bd
+2.8.2.lock/false/4 5433ff2877eabd7c 4a97499202850f2f
+2.8.2.lock/true/0 9766a15fc33a49d8 d8edf85713a4fb8a
+2.8.2.lock/true/0/0 c93f89163fe62dc5 990d57106a8e8532
+2.8.2.lock/true/0/1 4da5e25af64ebb55 76646996517a0167
+2.8.2.lock/true/0/2 a40148df14979187 31987b68f78a15ac
+2.8.2.lock/true/0/3 604093f199da859f 9d4350e62594c4bd
+2.8.2.lock/true/0/4 8bd484eea95f2679 4a97499202850f2f
+2.8.2.lock/true/1 e11cc89b01cccf1e 708311e953408c09
+2.8.2.lock/true/1/0 cf32103eaef231ac d6ff4ea362936787
+2.8.2.lock/true/1/1 9e6164c8767f36d3 87ca72cd6d94d656
+2.8.2.lock/true/1/2 d3b2c871128bb7ae 31987b68f78a15ac
+2.8.2.lock/true/1/3 f7910f8688d17c91 9d4350e62594c4bd
+2.8.2.lock/true/1/4 0f67cb536ff941e8 4a97499202850f2f
+2.8.2.lock/true/2 4aa4b46de81d799b 31987b68f78a15ac
+2.8.2.lock/true/3 7282e3d121f92fc3 9d4350e62594c4bd
+2.8.2.lock/true/4 2a6c63b279706c7e 4a97499202850f2f
+2.9.3.lock/false/0 013cfec6f337268d 3ae5146fc4b223ea
+2.9.3.lock/false/0/0 d80f5deb0440d83c 0d985a6b205233cf
+2.9.3.lock/false/0/1 2d0eb36af655b9af 861a365271db06fb
+2.9.3.lock/false/0/2 61361d1a0b5b0b8f 31987b68f78a15ac
+2.9.3.lock/false/0/3 d50e9644b5415804 9d4350e62594c4bd
+2.9.3.lock/false/0/4 f8962f673b623907 4a97499202850f2f
+2.9.3.lock/false/1 2b3be7571563d16d 6baa2d2dfc13267d
+2.9.3.lock/false/1/0 f95a93faed27af1d e2aaad3d6417a3d8
+2.9.3.lock/false/1/1 9a5fe84f5d756f7a f11528364defd16b
+2.9.3.lock/false/1/2 1e53d25319d5c2d5 31987b68f78a15ac
+2.9.3.lock/false/1/3 ac58dc489d0af8cb 9d4350e62594c4bd
+2.9.3.lock/false/1/4 77797e6ad3eed1bc 4a97499202850f2f
+2.9.3.lock/false/2 eafb788efd65ec0b 31987b68f78a15ac
+2.9.3.lock/false/3 783706256d72eaaf 9d4350e62594c4bd
+2.9.3.lock/false/4 5433ff2877eabd7c 4a97499202850f2f
+2.9.3.lock/true/0 9766a15fc33a49d8 d8edf85713a4fb8a
+2.9.3.lock/true/0/0 c93f89163fe62dc5 990d57106a8e8532
+2.9.3.lock/true/0/1 4da5e25af64ebb55 76646996517a0167
+2.9.3.lock/true/0/2 a40148df14979187 31987b68f78a15ac
+2.9.3.lock/true/0/3 604093f199da859f 9d4350e62594c4bd
+2.9.3.lock/true/0/4 8bd484eea95f2679 4a97499202850f2f
+2.9.3.lock/true/1 e11cc89b01cccf1e 708311e953408c09
+2.9.3.lock/true/1/0 cf32103eaef231ac d6ff4ea362936787
+2.9.3.lock/true/1/1 9e6164c8767f36d3 87ca72cd6d94d656
+2.9.3.lock/true/1/2 d3b2c871128bb7ae 31987b68f78a15ac
+2.9.3.lock/true/1/3 f7910f8688d17c91 9d4350e62594c4bd
+2.9.3.lock/true/1/4 0f67cb536ff941e8 4a97499202850f2f
+2.9.3.lock/true/2 4aa4b46de81d799b 31987b68f78a15ac
+2.9.3.lock/true/3 7282e3d121f92fc3 9d4350e62594c4bd
+2.9.3.lock/true/4 2a6c63b279706c7e 4a97499202850f2f
diff --git a/crates/socket-patch-core/tests/equivalence/pdm_rewrite_shared_parse.golden b/crates/socket-patch-core/tests/equivalence/pdm_rewrite_shared_parse.golden
new file mode 100644
index 00000000..b6fa49d6
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/pdm_rewrite_shared_parse.golden
@@ -0,0 +1,122 @@
+# One grown pdm.lock and its url deps, rewritten, then re-run over the result.
+# <case> <input digest> <output digest>
+0.12.3-extras.lock/extra=0/crlf=false 21655a1176272fba 08240ba723af2d0c
+0.12.3-extras.lock/extra=0/crlf=false/re-run 9991f30c983a9730 122633e9e87893b7
+0.12.3-extras.lock/extra=0/crlf=true 5900533590840a46 661d3eab379eec41
+0.12.3-extras.lock/extra=0/crlf=true/re-run 881424448f72e65f 38321d58c8d79860
+0.12.3-extras.lock/extra=3/crlf=false ce9fcf172c1ebe53 835d9c46aa027db3
+0.12.3-extras.lock/extra=3/crlf=false/re-run 3255b7f165a3f1d3 18db90f07be0748b
+0.12.3-extras.lock/extra=3/crlf=true edf41cc43e312ff7 fa72e7e13439bf56
+0.12.3-extras.lock/extra=3/crlf=true/re-run 2c3c4e5915d2acb2 f10bc01b62db6995
+0.12.3.lock/extra=0/crlf=false bb6882fa6e308227 3fcae84c661312d8
+0.12.3.lock/extra=0/crlf=false/re-run 4968389f75327559 a56f9fcdfd15ef59
+0.12.3.lock/extra=0/crlf=true 28fa02d135110df5 bfeb1aefb1e1cb94
+0.12.3.lock/extra=0/crlf=true/re-run d4862ba4b6fc43c9 9a814aa9e74e2b1f
+0.12.3.lock/extra=3/crlf=false 875655d84a273615 7874edd9e47717a8
+0.12.3.lock/extra=3/crlf=false/re-run 3c2b2fe1fa3f2817 b68d461fc7fe171a
+0.12.3.lock/extra=3/crlf=true 5b7bdf5d23ba4480 f2933dc828bfeb6a
+0.12.3.lock/extra=3/crlf=true/re-run b6e20136704fd19e 630aedbd31b3a8aa
+1.15.5.lock/extra=0/crlf=false 4d4f13130b2f5ca6 0ccbe59baa9f0fbe
+1.15.5.lock/extra=0/crlf=false/re-run 4d4f13130b2f5ca6 0ccbe59baa9f0fbe
+1.15.5.lock/extra=0/crlf=true 738ea560b4bac5e9 0ccbe59baa9f0fbe
+1.15.5.lock/extra=0/crlf=true/re-run 738ea560b4bac5e9 0ccbe59baa9f0fbe
+1.15.5.lock/extra=3/crlf=false 05076616697b9f90 5159a2ff08da0af0
+1.15.5.lock/extra=3/crlf=false/re-run 05076616697b9f90 5159a2ff08da0af0
+1.15.5.lock/extra=3/crlf=true 61a0a8be9a863e05 5159a2ff08da0af0
+1.15.5.lock/extra=3/crlf=true/re-run 61a0a8be9a863e05 5159a2ff08da0af0
+2.0.3.lock/extra=0/crlf=false f85fd6eef847aaaf c783b4deb1169551
+2.0.3.lock/extra=0/crlf=false/re-run f85fd6eef847aaaf c783b4deb1169551
+2.0.3.lock/extra=0/crlf=true 5d41e681e269208b c783b4deb1169551
+2.0.3.lock/extra=0/crlf=true/re-run 5d41e681e269208b c783b4deb1169551
+2.0.3.lock/extra=3/crlf=false 4d3cfc88ac5ffece b191be10baefa6d7
+2.0.3.lock/extra=3/crlf=false/re-run 4d3cfc88ac5ffece b191be10baefa6d7
+2.0.3.lock/extra=3/crlf=true 337957cda423fdbf b191be10baefa6d7
+2.0.3.lock/extra=3/crlf=true/re-run 337957cda423fdbf b191be10baefa6d7
+2.1.5.lock/extra=0/crlf=false f85fd6eef847aaaf c783b4deb1169551
+2.1.5.lock/extra=0/crlf=false/re-run f85fd6eef847aaaf c783b4deb1169551
+2.1.5.lock/extra=0/crlf=true 5d41e681e269208b c783b4deb1169551
+2.1.5.lock/extra=0/crlf=true/re-run 5d41e681e269208b c783b4deb1169551
+2.1.5.lock/extra=3/crlf=false 4d3cfc88ac5ffece b191be10baefa6d7
+2.1.5.lock/extra=3/crlf=false/re-run 4d3cfc88ac5ffece b191be10baefa6d7
+2.1.5.lock/extra=3/crlf=true 337957cda423fdbf b191be10baefa6d7
+2.1.5.lock/extra=3/crlf=true/re-run 337957cda423fdbf b191be10baefa6d7
+2.10.4.lock/extra=0/crlf=false 172e58243f676d64 dc874a7a22e7924c
+2.10.4.lock/extra=0/crlf=false/re-run 52c4734e1adb2848 ba6b6361916544f2
+2.10.4.lock/extra=0/crlf=true 84b3284978be45b7 eb97cb41d74e0b09
+2.10.4.lock/extra=0/crlf=true/re-run 7d030b203da8acd0 ff6d620f94840245
+2.10.4.lock/extra=3/crlf=false 9c9557ecc3467229 f87505b8e76d1664
+2.10.4.lock/extra=3/crlf=false/re-run cc827f83fff579f2 460733ce80caa2a2
+2.10.4.lock/extra=3/crlf=true 001be1702fcbb10b 1f33ff52cab24fad
+2.10.4.lock/extra=3/crlf=true/re-run e1337b373345aad8 25f71becb57e2c44
+2.11.2.lock/extra=0/crlf=false 6b4f6ea534403ce1 86e6d1a046779d57
+2.11.2.lock/extra=0/crlf=false/re-run 02e7df4fcb62c310 55ca2409ae480dbf
+2.11.2.lock/extra=0/crlf=true c626206c4024fe46 e5530caff4c2f936
+2.11.2.lock/extra=0/crlf=true/re-run 87f02f8297dce1ec c2f007bdb811f273
+2.11.2.lock/extra=3/crlf=false 71024d43303c242f 390e37055a77d5bf
+2.11.2.lock/extra=3/crlf=false/re-run 4c92b86de4ae77eb 24c66b7c114ad749
+2.11.2.lock/extra=3/crlf=true 986a91c5cd4511b7 8691357982ab4f25
+2.11.2.lock/extra=3/crlf=true/re-run 601377db18458ff3 5abbebea7456d39a
+2.17.3.lock/extra=0/crlf=false 98c5c38de2f9a8e1 e5fede4b116a45fe
+2.17.3.lock/extra=0/crlf=false/re-run bea465fa3cc73663 55ca2409ae480dbf
+2.17.3.lock/extra=0/crlf=true a0c9bb9ed37191ef 74da760c19111918
+2.17.3.lock/extra=0/crlf=true/re-run ea711090534018d5 c2f007bdb811f273
+2.17.3.lock/extra=3/crlf=false 093ae70e2482288c 00f5c85e81a1402a
+2.17.3.lock/extra=3/crlf=false/re-run b73d20dc2ea08fa5 24c66b7c114ad749
+2.17.3.lock/extra=3/crlf=true d21eb6a0c09c524c ec6b9c2e5ffd80bd
+2.17.3.lock/extra=3/crlf=true/re-run 15971e9f41f1f52e 5abbebea7456d39a
+2.29.2-extras.lock/extra=0/crlf=false eb78aecb54bd098d 7d28c3f85178a304
+2.29.2-extras.lock/extra=0/crlf=false/re-run 42d93b5c405df78d 41b2b3b16308685b
+2.29.2-extras.lock/extra=0/crlf=true a74183ac5e064afc 99963c06c57709c7
+2.29.2-extras.lock/extra=0/crlf=true/re-run 9c29d9c8a18cf39b a8281c40211c9564
+2.29.2-extras.lock/extra=3/crlf=false 6485ead297972881 0046bbcdd56d9888
+2.29.2-extras.lock/extra=3/crlf=false/re-run a522a0262db8df40 a3d92a64c9b9161a
+2.29.2-extras.lock/extra=3/crlf=true 53718730bd1cda51 f3460c6de1231dd2
+2.29.2-extras.lock/extra=3/crlf=true/re-run 8b5ab3312a7b27a3 30bc0feb4cf3430e
+2.29.2.lock/extra=0/crlf=false 0afc5c9cc3e3929d 87aafe287ffa1b2d
+2.29.2.lock/extra=0/crlf=false/re-run 95943761aa62a765 55ca2409ae480dbf
+2.29.2.lock/extra=0/crlf=true 36eebecfb1bfccd1 b66b619ce85adfae
+2.29.2.lock/extra=0/crlf=true/re-run 02f20956ed8b4483 c2f007bdb811f273
+2.29.2.lock/extra=3/crlf=false ef194e4c3f23be69 a08e0b96fa59510d
+2.29.2.lock/extra=3/crlf=false/re-run 771462e9c51554c5 24c66b7c114ad749
+2.29.2.lock/extra=3/crlf=true cbaa4943320bfe44 fb06e91706beee85
+2.29.2.lock/extra=3/crlf=true/re-run 35b9ad6159d5458d 5abbebea7456d39a
+2.3.4.lock/extra=0/crlf=false 1edd8acc82a5ddcc 1b22a21fde747f10
+2.3.4.lock/extra=0/crlf=false/re-run 1edd8acc82a5ddcc 1b22a21fde747f10
+2.3.4.lock/extra=0/crlf=true 817bd86e9a710e96 1b22a21fde747f10
+2.3.4.lock/extra=0/crlf=true/re-run 817bd86e9a710e96 1b22a21fde747f10
+2.3.4.lock/extra=3/crlf=false 26d0cc1acb4d1e66 bae07a9d9d86a2dc
+2.3.4.lock/extra=3/crlf=false/re-run 26d0cc1acb4d1e66 bae07a9d9d86a2dc
+2.3.4.lock/extra=3/crlf=true 9e6c6abc2b3b36da bae07a9d9d86a2dc
+2.3.4.lock/extra=3/crlf=true/re-run 9e6c6abc2b3b36da bae07a9d9d86a2dc
+2.6.1.lock/extra=0/crlf=false a1cf90463aec548e 2eb0674ae44aafe5
+2.6.1.lock/extra=0/crlf=false/re-run a1cf90463aec548e 2eb0674ae44aafe5
+2.6.1.lock/extra=0/crlf=true b4f2fc1d2ad04aff 2eb0674ae44aafe5
+2.6.1.lock/extra=0/crlf=true/re-run b4f2fc1d2ad04aff 2eb0674ae44aafe5
+2.6.1.lock/extra=3/crlf=false 0a39d27410f0a359 94669d0d54dd0a72
+2.6.1.lock/extra=3/crlf=false/re-run 0a39d27410f0a359 94669d0d54dd0a72
+2.6.1.lock/extra=3/crlf=true 028a8e1f1bf050a5 94669d0d54dd0a72
+2.6.1.lock/extra=3/crlf=true/re-run 028a8e1f1bf050a5 94669d0d54dd0a72
+2.7.4.lock/extra=0/crlf=false a1cf90463aec548e 2eb0674ae44aafe5
+2.7.4.lock/extra=0/crlf=false/re-run a1cf90463aec548e 2eb0674ae44aafe5
+2.7.4.lock/extra=0/crlf=true b4f2fc1d2ad04aff 2eb0674ae44aafe5
+2.7.4.lock/extra=0/crlf=true/re-run b4f2fc1d2ad04aff 2eb0674ae44aafe5
+2.7.4.lock/extra=3/crlf=false 0a39d27410f0a359 94669d0d54dd0a72
+2.7.4.lock/extra=3/crlf=false/re-run 0a39d27410f0a359 94669d0d54dd0a72
+2.7.4.lock/extra=3/crlf=true 028a8e1f1bf050a5 94669d0d54dd0a72
+2.7.4.lock/extra=3/crlf=true/re-run 028a8e1f1bf050a5 94669d0d54dd0a72
+2.8.2.lock/extra=0/crlf=false 55e31f21f6b597b6 5f6c14896258259e
+2.8.2.lock/extra=0/crlf=false/re-run bdf788b9e0b21711 4ec68a9020622cd5
+2.8.2.lock/extra=0/crlf=true 8860e7f81b315e97 f66e02a7d1d3b103
+2.8.2.lock/extra=0/crlf=true/re-run 152ed911da843927 b19163993a46fe62
+2.8.2.lock/extra=3/crlf=false aa2044473027360e 794fbf9141bfe2b5
+2.8.2.lock/extra=3/crlf=false/re-run a0c3c1cf672c0825 8ee5d959e60359db
+2.8.2.lock/extra=3/crlf=true 59da76de16052042 388cb4ac81e75f84
+2.8.2.lock/extra=3/crlf=true/re-run 37089aac3445a20c 0c38b85d219ec85c
+2.9.3.lock/extra=0/crlf=false 55e31f21f6b597b6 5f6c14896258259e
+2.9.3.lock/extra=0/crlf=false/re-run bdf788b9e0b21711 4ec68a9020622cd5
+2.9.3.lock/extra=0/crlf=true 8860e7f81b315e97 f66e02a7d1d3b103
+2.9.3.lock/extra=0/crlf=true/re-run 152ed911da843927 b19163993a46fe62
+2.9.3.lock/extra=3/crlf=false aa2044473027360e 794fbf9141bfe2b5
+2.9.3.lock/extra=3/crlf=false/re-run a0c3c1cf672c0825 8ee5d959e60359db
+2.9.3.lock/extra=3/crlf=true 59da76de16052042 388cb4ac81e75f84
+2.9.3.lock/extra=3/crlf=true/re-run 37089aac3445a20c 0c38b85d219ec85c
diff --git a/crates/socket-patch-core/tests/equivalence/pnpm_depscan_sized.golden b/crates/socket-patch-core/tests/equivalence/pnpm_depscan_sized.golden
new file mode 100644
index 00000000..8b8c6270
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/pnpm_depscan_sized.golden
@@ -0,0 +1,3 @@
+# A depscan-sized seeded pnpm-lock.yaml set + shuffled overrides.
+# <case> <input digest> <output digest>
+0 782731128c8cd746 f3e10497dfc8fec6
diff --git a/crates/socket-patch-core/tests/equivalence/pnpm_duplicate_override.golden b/crates/socket-patch-core/tests/equivalence/pnpm_duplicate_override.golden
new file mode 100644
index 00000000..6862533a
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/pnpm_duplicate_override.golden
@@ -0,0 +1,4 @@
+# A pnpm lock whose overrides repeat a package.
+# <case> <input digest> <output digest>
+0 cbcf6d49ce612595 d4b25ff165bd224e
+1 044c311bd3d97dbd 8d62d8bae9f344d2
diff --git a/crates/socket-patch-core/tests/equivalence/pnpm_peer_suffixed.golden b/crates/socket-patch-core/tests/equivalence/pnpm_peer_suffixed.golden
new file mode 100644
index 00000000..2a5bf04c
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/pnpm_peer_suffixed.golden
@@ -0,0 +1,3 @@
+# A pnpm lock with peer-suffixed instances of one package.
+# <case> <input digest> <output digest>
+0 261bbcffe0b55afd 53796577f31fa17b
diff --git a/crates/socket-patch-core/tests/equivalence/pnpm_random.golden b/crates/socket-patch-core/tests/equivalence/pnpm_random.golden
new file mode 100644
index 00000000..fac3e4d0
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/pnpm_random.golden
@@ -0,0 +1,302 @@
+# One seeded pnpm-lock.yaml set (every flavor) + overrides.
+# <case> <input digest> <output digest>
+0 d4c5afff183e27a8 86557e9261e7ae3f
+1 ab8309b85e14bb7e 22c28b98ac0f0477
+2 7b069ae888ef3010 c4a8f631b2560cdf
+3 95993c327a66a02d 53ffc15b302ae93a
+4 bf1df8d0019238ca 0329e582d126f538
+5 51b3f407dc08eb47 692f5da9e274faf7
+6 9fbcec927de82f4c 2ba07393b1c33397
+7 731531a13c64e6af 62f0fb68b7e5f39d
+8 ddaf8b213026b0d2 06b2d798e29f432f
+9 c4a246d4960a7f64 0241d1f777c32dec
+10 c76176735055d4a4 10ad8a55f8d139d3
+11 c684a938db242254 2758bb6c40deadc3
+12 c534a628827cedd4 0dfbdf2296ebe401
+13 9c5c37f043a7a0db 3ffb8eb6917aa71d
+14 cf4f0603ee82ee57 de69e5009e8875c8
+15 af3a87dac8a052b3 0b69769ffdb1c53a
+16 3d182ad2fc110a8b b4bf6e4520421e33
+17 24c976e0f7918c63 1e9b82eeb9ddd4ea
+18 fafe8e0cd6894fbb 3e774f29548674c2
+19 197bd2fef31b8622 e8cd4e40e7d9207a
+20 18bb2dd34391f24c 07276d7e463857a1
+21 bd7ea3084e8527f1 beb490c65e1bb2f4
+22 5e6e2273a8de512a d32901b21e3b5d5e
+23 2744eb5624d439f1 f84c23bc4f9edf4e
+24 941ba8ded54937a8 adf2f9fdb9c80c59
+25 59cf02a2f70bb90f dae922c18cc0b1b1
+26 04d9466251270789 0d8ff28f2cd7e153
+27 811cd820317b0775 1fa44c1b66a0380e
+28 8e6f90df7de1b2fb 638d8356a05908cd
+29 3dbdc23aea84c12e 0384892b9a4208ee
+30 fceb9c2bcd214741 7da432dea7f3c696
+31 016324dea73e8ec0 cc24cc58ce10f3a6
+32 9a204a877005427e d9dbd9869f82ce42
+33 1dae2b051454daa3 d5104d612326e9b7
+34 a54dd3e57e7e6a59 d4fc859e33ab0496
+35 83e894a8990db71d f37a267b8014d6e5
+36 f82af26da704f2ce dd3b7f58418bdd79
+37 098f62b05134b3ed e1b918519edd56fb
+38 ab9b893f3277ae40 4f28c68298ffbfb8
+39 50438f783d0e8d90 ccea009b3da5bbb3
+40 26431ed9099800a0 fe306ef78e4cad53
+41 bf0fd1a6ad5d65a7 578ba6ccc7d83f13
+42 b11b0a0992881b30 459cbf4728d9e40a
+43 766535cb4956528b c6af9b9679f58453
+44 c32438f2e414f6eb 2247848bf05f9aa4
+45 471e36241258add7 dfa031cad69c2b50
+46 2865026f42c78a89 b9736369bafb3f1c
+47 52c3b9e9ac38b87b 72439d9c572e2912
+48 d510764281635cb5 de2a67a04009273c
+49 3d5d7d967eed40fb 5264ffd52c909daa
+50 d57de52a059a5cca 1c132cadf66aff8e
+51 6496dcf93833b180 d2bb330a1c6e07e9
+52 ee99b0ea870a0675 e9eb9a4ce7161cf6
+53 9f057c17c0286912 9496bc8280e2b4ca
+54 324f9e4512ed9f47 5ac44e6488a2c6a9
+55 a9f4b3acf12838d9 6ba98e722a794104
+56 34d597e25dcaeb77 8f2b82a204cda555
+57 b22f0982d81de9ec 073f9e4820540a8a
+58 78cba2564f5991fe 33fc749155b68b9a
+59 4e18faed166b49b6 3a2d037d1e7b4f22
+60 ad78d57a29af08c5 469148a7f91c28a7
+61 36bcbc46deacfb46 61ad040ae22bf850
+62 4b5690fddced80db b1e44f8ad57c0d27
+63 2c9f4a1b15e381bf 7b321d1b6f28dc91
+64 d7634e68b7a446e3 b6f635a866e5ce44
+65 7d8fd985ac1ec23e 5c9ff91ce4db1a16
+66 a63a70b86f97b92c 2807c977d3633224
+67 6044dda782ac8d64 850846cc0109609d
+68 f179b04aed0c552d 1d42b79fdaa7d0bc
+69 ad8b64485c134aae cdca0c5f16e10694
+70 025b15dc1ff6d475 7f2e44485c349923
+71 0f3723cacd3f7ba6 1222c58ee04124da
+72 574da5ab5e314995 85dccdb360390c4f
+73 1cce4f4bbc34ec62 1181657312effda4
+74 2fb698fcf0757a8b c82be8ef6892dc71
+75 dc66abf60052be38 ad35fcdd7a1536f6
+76 cdf7e0fedd9e95fd f7ca6e0523cbf03d
+77 60cc647e4007ff0e b612f69addb11e0a
+78 c7094a3d18f21be2 11946c4debd32e1c
+79 20063585f3351f9d b707ea406e8ea6b0
+80 8ea4e1fc8873ba66 e2a0dffdc70b9cd5
+81 9ac230647733daef e26a7ec21c434907
+82 58dda5dd38d669ae 344f2d0da0f3a24d
+83 e81d388a6d1751b0 8b834fa119de2995
+84 1eb5fdee7255b351 cf5f48af022e5b50
+85 5488ae80f49c417e b69175b2d96e56d6
+86 5e40da110b6e9bfa c67c2ce9dcb34e23
+87 744f2541d9d96c90 acbbcc6212f79d7b
+88 2704c43ebc2f2b73 43e5c3352307659a
+89 250344f2dc6e3d63 bafe1da5f0c32145
+90 08e0cb9a784fc383 85dccdb360390c4f
+91 ab983414015b33e1 f992faee0bf0510a
+92 65c472de72bc9346 6a078b629129aa04
+93 a6ca6b96f8333c3b ad439f5fdf1b0cde
+94 c9ec3844b304a21a ae0561438abfe0f6
+95 daaba45c303a961c c6aa50dfdc8d2b42
+96 e607aaae0e79a702 365e7b27785ac089
+97 a88ca2d8a8444ced 7d6ccaece8ebcdfd
+98 a3023b35d23af6f3 57e2fd33f8be657b
+99 8c5423603ddce59a e578553c9368cdb6
+100 47008eedaed5e2d2 c84492172f1a5c4e
+101 0a88785eb6f5e024 8f8451a135448fc4
+102 f3bdd6ef4cb5d4ab 220b9095e99855d7
+103 5f1ecad68ebdb674 a2e3b8320d897a9d
+104 597fd760e8447bcb bea5202dd77d29d6
+105 4a871eec2015a9df ec64ff42bb1723c3
+106 79e96b587babb7fa 2dfd44423162d4b0
+107 9afba82546d4727c c3e0272699ad4c99
+108 a15193cacbf63a88 b248f9262c5c1630
+109 654a8d4d56523d93 fc674d0071093855
+110 c99d8f951dade812 e63b9bfd39c12195
+111 39d48904417b6db3 1b0381853978a436
+112 e3676580782cc6e6 36eb05e727a50b3f
+113 75d9d52468a23258 bb75b309aee3edfd
+114 c36b6a6b54d4c942 71d931da1134ff66
+115 3dcd8aaefc3ba798 3fa7f4239b106521
+116 26b2003c98052f85 9137620f1bcf7966
+117 d24489e261a9957e cfde3dedc8a15beb
+118 cf6c1983136e3aea 0fff908d2383b0b2
+119 723037c92f7ffcea 7ed53916a11f0d80
+120 441896bc4c72a795 8b1fb4cc14cd8d73
+121 600d7309d4a2b6ef 612826613cf0bfb6
+122 283968845d0220ab 473c58d60cacc28d
+123 c9a021cbec7a87e9 51e7a9fef6734712
+124 86153384fd92e5e1 c07d42dfbacc1a7a
+125 44b6a1411b5421c8 ec721e5dcb693c6b
+126 ca9ac80f27907025 799708bedbf8bc54
+127 e3ca7c70f2b92885 5e584b24c0c21155
+128 ce020fb705fe7580 2aaba72d72662e4c
+129 f160c032505433ba ca696c0971d2bba3
+130 2d99455ff759a60a 007b2fa41d0325d0
+131 7fcee8e4aacd0510 937b8245e7f14f65
+132 90e1cc42aa8f7fef b432d92be9026be6
+133 f7e3d9ea4b90201b 65fe5491f741583c
+134 8e70a1ccf3d87d37 24a5f99f46212a79
+135 4a267a3221a9c36f 0a1dfb6fefd2aa1c
+136 1828c637297bc669 7c090e8132dda999
+137 2146e9b268b688ff 631d0f87fe7bad5f
+138 7e651a9c0f7219fe c818776065678941
+139 6513ecd7bcf6a1ac dbd2f0d21102208b
+140 91107925e710b4ca 4f460446228913c4
+141 43a408674c209eae ff9d53b044acbb6a
+142 f736a587da807cdc e6665217433a4070
+143 a7c73dab37315429 861796c69cf863d5
+144 fdfa72db57ac1431 c72dac2e6e44251c
+145 49c0d3e90509c688 f42cf4cd20e6c250
+146 630f156438cb69d0 ada685d3be546c84
+147 30408ebbbdcee387 ddc8a3f45978c6bd
+148 0d1feaef555d57ba 945ef0bea9f4a103
+149 fdc6a240e910bd88 cbbc616420873112
+150 ea5b1cc2e871f4ea d57dc179304613bf
+151 587315a4690f0bcf 528920983f9ebcd2
+152 d0576af903b89697 dcec680cc60325df
+153 c8da668637928748 c36ac8a31afce5a9
+154 d962f49fc884f089 a52fc55e41dbf1e4
+155 838be940cc16f070 21856e4beb2a32cc
+156 e420d0407ae7d9f5 0c7a4850ee33746f
+157 00acf30e0f29fd4c 2a7603286455fe4d
+158 312538e4a6ee067e 3b0c99008ab73566
+159 21551581eafbee1f 097ff0fa720d3247
+160 7b41437c08c891ef c140fb38a4f4ffa9
+161 5de944a49341274e 4d4342beff2bf91a
+162 d575e1706e924b37 b82863b31496acdb
+163 02e82e476f5d4eb8 120bedb9c429a435
+164 1e99b6354db5d0b7 f4535c7d90454632
+165 3ed8e544f096ba13 e97fc66fe6e6394c
+166 a04d95d0de327600 8f22e2da5dd58227
+167 298a4d6800dfb2e5 9650c3af5e7347f6
+168 7b201b1ed7809b9e 89371914a5fdf312
+169 506077c48fad3b2b 68ee98d2f5ec19c0
+170 a94ffa45a7eb5328 a17b4615e1b0cb76
+171 069ce6f8ab8be5d4 3c462c5a11237537
+172 7c8f628a7427099d 0021796de79371fb
+173 a96ab997d71b712e 4f26a400696396e3
+174 4ccfe520e0c699f9 cd1e650b6bd06e16
+175 c607968897ad5e53 0e46e51036dc1098
+176 26c1c8d0bbbcee80 cfe833a61bb4b73c
+177 2e7dc568172293be e88c2bf4a3ae7f83
+178 b2dc32dbe175d643 54c0f42c16a697f6
+179 8d1004808493eb4d 39c778ac3a029ae3
+180 711fa863664ef340 758d0ace624439bf
+181 77cfe25e59c1d7cc 00eb26045e83fac1
+182 cebd6fdc8a1c4a98 a03acaaf2dc73457
+183 35d1f44fa9e7a63b 9e67b2c5d7bd454a
+184 a73f799d6461265a 5662d62477869d37
+185 bed963690a271a34 fef44ae7704f54f5
+186 72cfcc94c4532465 0b1b553fdb67d510
+187 7ad4cd639916e3a0 c6287bcf1f166797
+188 e3f47ddf7b8360b3 e54676099bc664a8
+189 d92e046cd8e76edd 44537fb8d9d46156
+190 6d2010640705a072 7aaa34c616511b04
+191 c6c200c7fa2d2606 cc02b2f14b00426b
+192 c3c75f05946ba879 1e39ede692ce307d
+193 cd4ccc2847745de7 d0ba91fb922300cb
+194 902379b7c34e5a6d e512b3dc4a4ebe7a
+195 5ad96d1fe293acc1 bf6c594c70a7bede
+196 be3fec26847cfe30 6430f68d12f1611c
+197 6162f2f7de39c65b e3801a0cb5638edf
+198 143e383faa7bd192 893218e812b014f9
+199 551e6e8a7d853390 3ad9b509a032213c
+200 b288a2fefc683dfd 41b2d8553aa079f3
+201 605e5ec2399164f2 7507fa5a5cef3b0a
+202 4a505e62ec60e3db 65a65397824787b9
+203 e29151c6bb4abbcc 4f1c0add74ab3041
+204 3db0bd9a9096ffab f530c6a70766d661
+205 61d3b8ce5a725fe2 3c55af7ceee182e7
+206 3f86aaffd1f518a8 98843b30447b37b9
+207 ea2b630f0ff0fece f26877c1ccba5eff
+208 3db94a2d8c11c296 08c0e322fa386a63
+209 f38fc0368f4c55dd bd38e9145de2898a
+210 e63d1f23bf47bfe0 1958e62086157dbe
+211 2d6104533e903daa cb654af40d4cc3aa
+212 7b0d436bbd253127 43f06d65eebc3f26
+213 9e9b90bb1df12f50 731b45310f48a670
+214 477b84d52efdef48 422cfa0fcf192534
+215 5f5599f07b31c847 4373d7e8a999cfdd
+216 47b21878f6cd7c6c 7cb918c5cbecd08e
+217 19464f03f49c5755 52bbc4dca9098108
+218 7fd814469dd07b77 0744b1a8269191de
+219 af4cc2036c73d68d 056eff9d441b9924
+220 8943fbe108b161b4 251f6e74ffe70890
+221 b258b05578d781fc ed8109a9adc2cf5f
+222 a221412e98b312c9 49a0f3b6d3668dc1
+223 58f61bb87ebef7aa 005efd0129732dd5
+224 46b0be7c3dad07fe 131ad0b3d2543b96
+225 64045a836ab0bc58 94b3b4761396ea58
+226 b16f6a11e72565eb b7ea630601d68e4a
+227 0fa27aa097707bd9 a3984649726c3a8f
+228 7c3c59a2d7f48dfc e0f2d14826ec2831
+229 60499254175dc25c fcd68b93fd906049
+230 9d7876135a8eed38 b970669d497f7c75
+231 d3c46cd9aca1d154 e52ff07643088bba
+232 5360e1d35397a61c 542edf290c79e9de
+233 598fe4b11ed104a0 adcbfdb4d9fe9ac0
+234 df57b2ad912d4d6e 6693ac60eb7327e4
+235 d0903434864c211a 0445a42b8a33b97b
+236 cc13e0dced1cee73 b223910d93f2f8ee
+237 9db8971b37ef255f ce1e5ff6ff63f571
+238 7f754288dcf62ead 5f0308acad632beb
+239 17c9e5269c65ced3 162e7342dcd5fb95
+240 7bd989872bf78672 737b4e4d2f5c8738
+241 bf40db1b93babb21 cada05e73e2fe831
+242 695371d9fa56e104 5369d5c87fdab08c
+243 07f940430f40e8bf d007087a4a342f9e
+244 86e5b852c9ba0ce8 37326391150989bb
+245 3eb34d860fecabf7 473a9e943690f9ac
+246 e2949f2634859ccf 310ddeec5698a8f4
+247 0a1ac1f831b02c7f bbefab0ff68deff6
+248 e224b2c53fb48bf6 9419542d8b40b813
+249 e400a2e6995191ec d0b511890e32b0d3
+250 53c2f069cc4aa29a ffb3532c06ced802
+251 191daf5001faaa81 1bc5767f7a495c8a
+252 585f3f541ad82b49 8bc231b46b90403f
+253 9a339c27cdd348dc 327abaa71f7eb193
+254 47f28ff36b67e943 0e579c3915ed01e1
+255 79013af97952c1cb ef31a004eeb8cba4
+256 3e2c1efdfb642761 b65ecf44882fcb3d
+257 986d5426168e018f 18d32f1c8449f18e
+258 83692debc909ab5e 0b4299cafde3b7a7
+259 2c0022b72c454342 096d51700c44cba6
+260 0167b73eee45a263 0669c3ded68f1008
+261 3b1d7274dfa99b15 ceecc9df3546e4ab
+262 a46aa623f782e4d9 2847e98a74eb4d45
+263 12205ec0c23133f1 fd4c46bacccf047a
+264 5cf0d0e0cd5976db 51804dd6660443a7
+265 17001b782f8c4edf 9b8aade0eecda0d2
+266 8770bf1ab25f676a 636dc05e81dd4484
+267 6ec1205c12d83c94 53ce40d303fb6f80
+268 0390333b15511190 2f14d335fc161f5d
+269 795c50cdc23742ea 353dfaa98d41e0be
+270 359a948e9c5c6534 18f96bc2239e7dcf
+271 dd72d1a0339b2d01 751ef70c971bbcea
+272 ee6a245d54463637 692cc7d2ef55a37f
+273 f9f5a2deeb126907 6c97206e8d37760e
+274 cdbedd5eecf3aa9e 81d3f469170025bf
+275 81f849cbb1b433a1 b5a867977a0173d6
+276 3a385222623c4981 5f85e5ca0a8e09a9
+277 a71238a005f62137 021eeb79b6e3668a
+278 37d43e22678cc9d6 5d265cbd9732a0d4
+279 0132ee2df159497f 7eb4d003174524c2
+280 e4cc05b8907dec73 25bc546b43cd4df9
+281 010fff00621664df b5563fb664db457d
+282 0b6a211ffbb73a19 fce72442c59fb99e
+283 693621689d0b2755 f10a86aa929f96d0
+284 1f40db7e7cac2153 723ac9a2b4b3d871
+285 1afa904a744ffb8d 834d65bc7d4d3857
+286 a805c70d86ea49d1 05d50e5d7f22801f
+287 6834fe742564ed35 0756f468aa4c0ff8
+288 783940b87cb67bdd fe657dd1d9d7eb98
+289 2f60f64bfb66e363 91e59d72ed5c10b1
+290 d4af980fbbff56a5 a977fe74e59ccea7
+291 56f0a8109308c06a 4945be4adc6879d6
+292 f43cf547970f065e 83ac874984ed6418
+293 008f6709fad1cd5f 9dbeafc6de348f5d
+294 deae07d7ac33872e f4535c7d90454632
+295 212a92c90509cec8 ef17303d4c19dbcf
+296 989f684dec2dcc01 4a65753d560ff56a
+297 a8da5f39322419b9 156e2738391b2777
+298 555eb572e30fcd7b 186ac9b56b590757
+299 b414e7c2d60a3770 650734e70de17bb3
diff --git a/crates/socket-patch-core/tests/equivalence/poetry_lock_reused_parse.golden b/crates/socket-patch-core/tests/equivalence/poetry_lock_reused_parse.golden
new file mode 100644
index 00000000..92c6bfa5
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/poetry_lock_reused_parse.golden
@@ -0,0 +1,872 @@
+# One rewrite step over a grown poetry.lock: the text and edits, none, or the refusal.
+# <case> <input digest> <output digest>
+0 7838f7f8f4fb2f70 7d3a95318af346aa
+1 b8abc1d318c69857 7d3a95318af346aa
+2 4455ad203c1857e6 7d3a95318af346aa
+3 9aed4d3c7aeecb00 a268e85ef673625d
+4 7838f7f8f4fb2f70 7d3a95318af346aa
+5 dee8f31dd1663146 7d3a95318af346aa
+6 f2fe25536bb05f10 d328039379eaf035
+7 7eeba9a2817615db 7d3a95318af346aa
+8 3db538680f7353af 7d3a95318af346aa
+9 cbe24dc5a979b381 7d3a95318af346aa
+10 a5a09f459a1d08f0 a268e85ef673625d
+11 7eeba9a2817615db 7d3a95318af346aa
+12 48f6e919199e639b 7d3a95318af346aa
+13 b63a603b6da720a8 6c989b8a5ad64ce2
+14 4bff41c15e070a15 7d3a95318af346aa
+15 ec49b75553cb184f 7d3a95318af346aa
+16 9db39321d8af57b9 7d3a95318af346aa
+17 63d4b66d2bb5c28a 7d3a95318af346aa
+18 36086d3b80e12b95 7d3a95318af346aa
+19 37ed1c8272ec221e a268e85ef673625d
+20 4bff41c15e070a15 7d3a95318af346aa
+21 8ca2d669e1fcb2d3 7d3a95318af346aa
+22 0fcfeb1aec3417bf c4aee716944cb5ef
+23 acf64f016131aa8f 2a63c4a3f83df877
+24 bcb06e4477145c98 7d3a95318af346aa
+25 c66750c61b9d9388 7d3a95318af346aa
+26 a80ee7b9ab744029 7d3a95318af346aa
+27 48024bf6176c3160 7d3a95318af346aa
+28 4ce86d4158f01f35 7d3a95318af346aa
+29 e4aba7a8854ac222 a268e85ef673625d
+30 bcb06e4477145c98 7d3a95318af346aa
+31 37c6395a40c06fb0 7d3a95318af346aa
+32 1375e0f1d5fced12 40b28b9e1a6d04ad
+33 bf0f4b6f085e7097 bc6d70529850c25a
+34 31b63481ebdd0481 7d3a95318af346aa
+35 9f92aa30ab1841b4 7d3a95318af346aa
+36 28e9f8a6c02cdc9b 7d3a95318af346aa
+37 fe13e38ebcfa13d1 7d3a95318af346aa
+38 7797272a95160d69 7d3a95318af346aa
+39 5470a8c38bf5bf4b 7d3a95318af346aa
+40 eb073793bef1ed1b 7d3a95318af346aa
+41 d145ac2577111d49 a268e85ef673625d
+42 31b63481ebdd0481 7d3a95318af346aa
+43 4449508eab5ae45f 7d3a95318af346aa
+44 809e3f4586bf7976 f1c5684b36bdf0a1
+45 079671c88ef7ef5d 71dde68bae429dbc
+46 5c9fb292440d6b46 7d3a95318af346aa
+47 86653779b6f48f9f 7d3a95318af346aa
+48 afee00d0a0214b7d 7d3a95318af346aa
+49 85e92dcab30cfa58 7d3a95318af346aa
+50 a566cc7ef71b0733 7d3a95318af346aa
+51 8c277a2959596d65 7d3a95318af346aa
+52 2a9f8041c798f61f 7d3a95318af346aa
+53 9d215cbc7b12dc0e a268e85ef673625d
+54 5c9fb292440d6b46 7d3a95318af346aa
+55 ba41631a3a831c6d 7d3a95318af346aa
+56 7be0a3cc0ce2b585 522aefee3ad06058
+57 bf00ed0c41d94b0b d22fa7470a610982
+58 080acc4ce1486f50 58ee04bf8550b643
+59 f1ba49a21cd72cb8 9a946702625c5b75
+60 a2f5af94f8758c21 539c1d2a923979b9
+61 18924699d59890de a268e85ef673625d
+62 bc05549d3897a7c2 bbf0609ef057d431
+63 be6913494112f00e 2f90002d3fed846e
+64 2f22510f2ae74251 9ea28f11728746d5
+65 25979033e37ea461 d29da66f1eeaa46d
+66 171e3cdb83497f32 9a946702625c5b75
+67 444c9579c55afedd 539c1d2a923979b9
+68 7d466824b6efa319 a268e85ef673625d
+69 6b8a17a57af57c5d 5b10e85632263dfd
+70 cfbde172dde75668 f67335ca72109fc4
+71 31b56b0077a83edc 9ea28f11728746d5
+72 8485a46a61840730 3a8c3537dc04bfe9
+73 3468d51c83811ca3 ca1a3315f07e57c9
+74 d7eedc8edfb834eb 38ed453866e3eb6c
+75 11e9cdcbc3dc8705 9a946702625c5b75
+76 f076099eee3dbf70 539c1d2a923979b9
+77 2147c1088d5b22ce a268e85ef673625d
+78 38edf45143d5e0b1 fc587df0ad3b4295
+79 3a050b4886522c5f 3097e24fdfda4d8a
+80 89e32eecbfc01377 9ea28f11728746d5
+81 1b449b11f6e07151 cf7be6ece6f4062a
+82 4c85c5bc86cf6915 4da124b63aef2f12
+83 5ac8402fc4adec3e fc63fa3ef6cdd242
+84 c39743e275810405 88d41c548793615a
+85 a97fcc9f10016693 9a946702625c5b75
+86 79f745dc9f6e0086 539c1d2a923979b9
+87 f2a2f0a77ecd569e a268e85ef673625d
+88 492204923bc4ebe9 653c4adc7c5f8be1
+89 60947e2cf227d970 381d7ab078d08e8e
+90 35987381cdbb28ee 9ea28f11728746d5
+91 79a976cb0cda34f7 cf7be6ece6f4062a
+92 4fa0be9f74401a83 01edae95d3d4ed47
+93 911aabb001ef6e8d 732e7e26de551f43
+94 3d8f8a0d5f874d57 fb605b9d822a361c
+95 01accde2f128c2d5 b1ee42755c19a7a4
+96 f72bb6ce0c7a9b45 97db4e14557c2d5a
+97 36b1b33c067db182 9a946702625c5b75
+98 758356552da893cb 539c1d2a923979b9
+99 5ba7af3c522ba3bb a268e85ef673625d
+100 10d14b0e411b1aa7 3e9741e5a1291ee6
+101 afb726d50d59c1e5 57e66fc5adebd789
+102 0aa4dcfbe462e5a5 9ea28f11728746d5
+103 381474a81bb774ee cf7be6ece6f4062a
+104 1a049cbf3e516d8e f45e9993f93c5d0d
+105 4dfcd01c2a8e564e 3805ffb61406f72f
+106 6e34751cbff7fc86 cb38816c35d8438f
+107 3f4b2ff713e72ea4 14f4d0a31907198a
+108 79b1b2a0c0f715f6 0af5fa92a361be20
+109 26e5f160f11df203 9a946702625c5b75
+110 24c5c4b7e4655feb 539c1d2a923979b9
+111 ac25471ee5199635 a268e85ef673625d
+112 ab9bbe515103d875 2f511c4eda31a500
+113 a9fe0d84c03236c5 4fa5cb42b68d6914
+114 fd3f376c4a644f78 9ea28f11728746d5
+115 e592e2facd02bbbf cf7be6ece6f4062a
+116 fb5b254b9994a188 cc944f55a5a0082f
+117 9f6fb05b6a75c96b 9a946702625c5b75
+118 60022608dcdb7b6f 539c1d2a923979b9
+119 9465be8865606316 a268e85ef673625d
+120 fd739a9f0836045f a252e7bed1d6a58b
+121 91b491a2852fdcc8 1978bf222c5fa6cb
+122 376fd61cb0dab429 a0c7f8b7a38ce82d
+123 e245a0bf72d8ab96 2cbccb4ec2f0c539
+124 63e577485a115e4e 9a946702625c5b75
+125 c29a0ac19f1a5523 539c1d2a923979b9
+126 3fcbc7aeaefd3917 a268e85ef673625d
+127 70325c0f5e684305 3213d601ce38c9e9
+128 8fe78ae2418b2831 87c9127dd9ddebb8
+129 3e0e275e4acafbf5 a0c7f8b7a38ce82d
+130 7cadfe0d41df5c75 662d03d37ece9276
+131 edd0f61a97a32946 ff9fca563e25cff4
+132 77c59ee7f4197a44 8237c506e6f38ccf
+133 9e8e073841ccc695 9a946702625c5b75
+134 9cfe6337b27ca40d 539c1d2a923979b9
+135 9813ae729caa8b20 a268e85ef673625d
+136 8e40c4787a136b9a ebcab9badc3e7e4d
+137 102423a374b12f00 771aeff31fc5f0d2
+138 772c2c5f97a4147f a0c7f8b7a38ce82d
+139 b5cba363e8ee130a fa079e0607c31b4f
+140 b74f22d0c14464f1 0a5e7223c1076ae2
+141 f488daabeb54ad07 ea40a8b7652bb1c0
+142 71811739278bab3c 3939cf05c8b9c74e
+143 ce90b0de308dabee 9a946702625c5b75
+144 791b5712dffa1955 539c1d2a923979b9
+145 2885f2259db1c515 a268e85ef673625d
+146 4f38204e76521ec3 298a5468c145227a
+147 2554632edf53b598 e9aacb5bd253a27b
+148 f49715f69179628a a0c7f8b7a38ce82d
+149 8d8401d7657d6a30 fa079e0607c31b4f
+150 a22abe031dc7b95b 5c3c377ff82d419e
+151 aff5ca113bca6803 147780fb186a73ac
+152 9d1e352e05da5d4b 74166bd05cc1d38e
+153 0323596d11a80337 a8917c74aa1db2b8
+154 5226569855f0bcae 0ed5c705501d2577
+155 60574077ed330d32 9a946702625c5b75
+156 e51dbd10a22122c5 539c1d2a923979b9
+157 4c3db0765b48b21f a268e85ef673625d
+158 f2fca4eef8a7bae3 bbda4630844e623b
+159 815678f2d5adad1b dbd56be550de7e8b
+160 6602486123f3e196 a0c7f8b7a38ce82d
+161 fa742580fa7d991a fa079e0607c31b4f
+162 7f77dda8c758c262 d769352939fbe184
+163 d85f4c2d65d24a6a 33622e8daa1ac3ec
+164 70993265fb755536 f29907d9ac99a2aa
+165 d4e7b25af7b60eb7 bef30065ef0fec38
+166 2af603c0419c0f59 80403f51d1c6b20d
+167 26deb39bc75f07fd 9a946702625c5b75
+168 62805153865f5092 539c1d2a923979b9
+169 5c6c94942d7ff99b a268e85ef673625d
+170 7b8b60e0f566a443 c0188f1d06f4d428
+171 cfe09a7772cbef30 3db6d68f5e658bbf
+172 2562818d58337be2 a0c7f8b7a38ce82d
+173 8a83d4292a09c86d fa079e0607c31b4f
+174 45222ee34dc2b35e c5123a3cb66596ed
+175 8a683c9af7ce5463 9a946702625c5b75
+176 3600fad12d1cd424 539c1d2a923979b9
+177 d59fbef1233e90a9 a268e85ef673625d
+178 68d1b2f7bd837f3b ae23c70254d2aba5
+179 04d085c24f1c4620 92bc60fc060e693c
+180 12d136a135c448f8 a0c7f8b7a38ce82d
+181 1239f0c80c44803a dde74e8640ca6e35
+182 b511a4f8a4d3e1f1 9a946702625c5b75
+183 768083cdf4027491 539c1d2a923979b9
+184 c878d7c780178d3e a268e85ef673625d
+185 bbe59f8cac508903 c3415dfd9db396c4
+186 714b12197e22fedf 26ab9b68d3bb5830
+187 687331e5a4daa4f8 a0c7f8b7a38ce82d
+188 5d94019155de85a5 93a83ca096dfd9a5
+189 4f920af03cc907c6 5eaca3fe56383b1c
+190 ab181640756eee81 5eaca3fe56383b1c
+191 c37cf7174488ae90 9a946702625c5b75
+192 b4fbdfe593458c46 539c1d2a923979b9
+193 f4843f4a132abb71 a268e85ef673625d
+194 2165a8237beb8d3e b6de9531248cfa9d
+195 281a457928d40310 2078b7f77398c61d
+196 49c9424c5d0956ab a0c7f8b7a38ce82d
+197 d1e01f2d24fcb21e 5eaca3fe56383b1c
+198 2d215351e4d38db2 9441ee325ac2271b
+199 a929a99018f473d2 5eaca3fe56383b1c
+200 a1831604ef7d46f7 5eaca3fe56383b1c
+201 56ade1edf5402c8c 9a946702625c5b75
+202 5e81917e41afc699 539c1d2a923979b9
+203 d42f6da337610b61 a268e85ef673625d
+204 59c700eaab481cd3 a5fc33f20460324c
+205 b36da2d7a5464106 1b0b85cc1611b215
+206 fe72c603e3a9bd1c a0c7f8b7a38ce82d
+207 c1e191b4fce506ea 5eaca3fe56383b1c
+208 052f2e3266a1caa8 dba33b7f150cd263
+209 5fb3066b2cf0130b 5eaca3fe56383b1c
+210 2d4fb90c8df59165 5eaca3fe56383b1c
+211 c67afefa1449e0c4 5eaca3fe56383b1c
+212 dfee7750fef28df7 5eaca3fe56383b1c
+213 2d9e0ed8b651a25c 9a946702625c5b75
+214 fc4271a6660bcba8 539c1d2a923979b9
+215 2776ac58d9c5e91c a268e85ef673625d
+216 9d9daa6d056bfaba e7ba5c068c3a530d
+217 d492f82fd6db94f4 141bef1ee07bb90d
+218 6144d70a110ba571 a0c7f8b7a38ce82d
+219 dc9ad5e0487a83c4 5eaca3fe56383b1c
+220 7865ab773bb0d7e0 5144c7839ce59870
+221 45651293a09fe14d 5eaca3fe56383b1c
+222 2b2870eb4d8e97f9 5eaca3fe56383b1c
+223 c2469bc57e61edbe 5eaca3fe56383b1c
+224 7e4c5ed1feae5430 5eaca3fe56383b1c
+225 686df423991ce00b 9a946702625c5b75
+226 dabb307cd8f28c20 539c1d2a923979b9
+227 f8606dce6c93d293 a268e85ef673625d
+228 203963983d6b848a 3ef2b91309f2e427
+229 611e2ff89c68f95c 2a0d02afedab3a5a
+230 f527497a97f701f8 a0c7f8b7a38ce82d
+231 c28e784b6f102d85 5eaca3fe56383b1c
+232 c1ce402f18781be2 a82074ae17313ffd
+233 007611118fe3a64e 9a946702625c5b75
+234 da193ee6f421e697 539c1d2a923979b9
+235 fcb8370f147cd498 a268e85ef673625d
+236 c7efb7c7e506bf0b fe7ffa81f4b20de5
+237 d239809c873e7cb1 c8209e224eae3bb0
+238 6a7255ffccc5619e a0c7f8b7a38ce82d
+239 3a5597bd79c8cade 9018fb47624482a5
+240 401e4631776091fe 9a946702625c5b75
+241 4a69d5c889a031db 539c1d2a923979b9
+242 d8d466b2b7801b6e a268e85ef673625d
+243 0f60b49e3cdce584 f8c7da65b2a18cf2
+244 0b103a5cc1a06696 8d1ce5e7027e75b3
+245 981098098ade4bfa a0c7f8b7a38ce82d
+246 c34cd2a51a2eeb37 e4ed78f1c41388d4
+247 c533f1cb93e1ac9e 02efbf1956ed0b70
+248 e94a54d03f8c9b7f 6aa30f8bf000ba00
+249 f7734bf6136b0114 9a946702625c5b75
+250 9831933a8516c708 539c1d2a923979b9
+251 5d4ec9ea82d01e14 a268e85ef673625d
+252 c4de19124816bb5f f5dcb94c17255110
+253 68775f1231372347 914b4f0fc4ae8688
+254 d182171b111be3ca a0c7f8b7a38ce82d
+255 e5a8321dfd99df64 fa079e0607c31b4f
+256 d7c34b9bb5fa01d6 166233a1773bf527
+257 cd4a7305624682b3 5dca32195af10b24
+258 89b994c8134d41e0 fbb2ec7dbc87180e
+259 13bfbc9fd10e27c8 9a946702625c5b75
+260 da2be22f4d97c7e8 539c1d2a923979b9
+261 bef183b50b9cc203 a268e85ef673625d
+262 c17fc6e0727ce18c 2c4bc20fc2a070ae
+263 e21bd9e589c3fa39 a5ed0838183c05c1
+264 f10f7f2ac12abf4f a0c7f8b7a38ce82d
+265 6e9013aea83ef4b4 fa079e0607c31b4f
+266 3db0d6d6e25138c1 bdfe2f771c7ed78d
+267 84fa852d79f239e9 7c87b6efac687050
+268 1678ce870260d889 57e11ce0c957c099
+269 8eb04cd46a76a6ac bee5a4b12b49eeb7
+270 a21615085d41c75f 065b4e9a418185b0
+271 b03330b6c47089cb 9a946702625c5b75
+272 b24a296f6c6cf366 539c1d2a923979b9
+273 587e4251a3adaa08 a268e85ef673625d
+274 39b84bd36767d208 36a52490a23076fd
+275 1560c86e86b18946 c13409f239ad2827
+276 68d816d0c1ff2f50 a0c7f8b7a38ce82d
+277 667fa61a12c3b26f fa079e0607c31b4f
+278 1e06368e9dd035c1 ecbb26e83e8f5e59
+279 3157b8a82d7a27f8 2187fd4e7585e54c
+280 201f26c3b7aa1b49 71c9006ab9302884
+281 7b2ff370dd99f08a 934b714b48ce9c7b
+282 31871fd008112edf 4c18d9e63dc6c9a4
+283 0f308a83a740e82f 9a946702625c5b75
+284 812a45e42f669a77 539c1d2a923979b9
+285 fe6bcd3505e01693 a268e85ef673625d
+286 3ef73600e8618ef4 73f09d10c7a90e0e
+287 53d21812e7dcbbb5 83387079942df61b
+288 b0ae87d3ea1849c7 a0c7f8b7a38ce82d
+289 3f3c7ba21cfc91b2 fa079e0607c31b4f
+290 5819cd17bc7035b3 f5940413bb5643fb
+291 1a0ffb221f921ef3 9a946702625c5b75
+292 e46cf780baf5deb0 539c1d2a923979b9
+293 c8e83855647a9402 a268e85ef673625d
+294 c50f51653082c8dd ffa90a689ddf31cc
+295 767e2552ddc22e72 9d4cfc1eda196acd
+296 add89f369b576be6 a0c7f8b7a38ce82d
+297 7ee3b3a90557ae60 5fa91e1d68fcf083
+298 b5839df0792cf58b 9a946702625c5b75
+299 94027948906531b2 539c1d2a923979b9
+300 6ab14b60bffb6cfe a268e85ef673625d
+301 aef183ef38546bc7 ca84cfc1aa0cabe0
+302 88b7fff1698f7752 e6cb8f2ff3fa8151
+303 1916983d5f19b39c a0c7f8b7a38ce82d
+304 c909fa8d25b8fc57 33522e585a3ded91
+305 ced752ddd9e0a466 4d852408fe833d49
+306 1cea8a0f38adb01c b5d9b1be9c5235fa
+307 b97f885b75e872d1 9a946702625c5b75
+308 b5ec2d81684179b4 539c1d2a923979b9
+309 01ac357711aa8bca a268e85ef673625d
+310 efa7b85b999acb6e bca8ad032db77d11
+311 cc65572737675507 e20ecb7d0b851260
+312 1c1a68fb55ad050c a0c7f8b7a38ce82d
+313 97f9df5d2c01caa0 fa079e0607c31b4f
+314 08d3905567d9fcfd 8e77e7911d85bf5b
+315 b54ca71634a47ceb 46d6ee5d5c577fc7
+316 0907461d01669163 a032b526fce85c8b
+317 0010a7478674d7c7 9a946702625c5b75
+318 82659362c339bf82 539c1d2a923979b9
+319 5f26e2eed87b3bea a268e85ef673625d
+320 11ad9f1dd7fbe16c 2f82ad412e85093c
+321 f97db0a712825ecb 3aee5702615e9818
+322 eb68d2c1994600dd a0c7f8b7a38ce82d
+323 f029b1bebd90a56c fa079e0607c31b4f
+324 ae081d30599cbdb1 acf8e147102b617f
+325 f2afa5ee721619c5 3940a3c4124bf277
+326 8b2af7de7336feee 63b5065950d37377
+327 73f653c4d56764b9 bab175aa052cb8dd
+328 0fb73a24ce2eefff a437ec109ba84f07
+329 4d6b2940b14618d7 9a946702625c5b75
+330 badeb4bc1749060e 539c1d2a923979b9
+331 20d0ee4a3bfa8e7f a268e85ef673625d
+332 b5921ec66943c82f cb3db0388f0da7c1
+333 6261ea0752832e7a b8d43c85d5c176ed
+334 4439437c38714bde a0c7f8b7a38ce82d
+335 75c926f9b9d6f752 fa079e0607c31b4f
+336 282cd007845db159 199297046cb33467
+337 9b587c5fb5c606d0 66fbb6297d733d57
+338 3a1d219e4aa4eb8a 4710a88dc8c13239
+339 86650296d7efb262 efe467c906731dfb
+340 37c4f2095bf4e8a1 824c3c6b85d018f4
+341 b41437fb74a3954a 9a946702625c5b75
+342 5c58ae2321976502 539c1d2a923979b9
+343 25a275e691adab57 a268e85ef673625d
+344 e5062a6d749dffdf 278f266e5397d260
+345 8cb8f7e34408f3c6 a8d0c327cb9b757c
+346 1b9043dfc29f0c41 a0c7f8b7a38ce82d
+347 58edc619775a37b9 fa079e0607c31b4f
+348 df5f238e62946b7b 05b61440919a3a80
+349 137d67b693a46d10 9a946702625c5b75
+350 537c4ded7f90291c 539c1d2a923979b9
+351 a027886921e5507a a268e85ef673625d
+352 3cd6c717fd0cae64 30bcdc015f13e84e
+353 80627371d0a05afe c376bd63b287d15f
+354 165290395237362d a0c7f8b7a38ce82d
+355 608af3f256e4e964 4e881033f7f4b97c
+356 c26e0fb16c68b46b 9a946702625c5b75
+357 f20c7a32b924273a 539c1d2a923979b9
+358 143c54520f4eb26f a268e85ef673625d
+359 10fc8bb4f8894bd5 088f0149a0b9931d
+360 a9579b8564654f15 382770193a0ccfef
+361 45a67546df2ea21f a0c7f8b7a38ce82d
+362 4dd9a7b9a479dc32 bd4e2fb6ff95080b
+363 43f408387653144e 1a39c8156bb0e42a
+364 85e0d89b2d8c7d37 4fd03c68fab03bee
+365 ceae1ee16b8ec45b 9a946702625c5b75
+366 61316a1d54bc7de5 539c1d2a923979b9
+367 cc4c77cb9015c840 a268e85ef673625d
+368 f5d5cb02f379639f 5d17e19341fdbc63
+369 9b14068157a4f92f f39d6db13288907b
+370 28a46096d845026e a0c7f8b7a38ce82d
+371 b89bf0643b14993b fa079e0607c31b4f
+372 14af5cbd8202c1d6 f5f551f2949244f9
+373 132bc5cc2dbfca36 dbe7e604c355cfdf
+374 589e6aa3a3f9c43b 09dbe26927b5ab28
+375 58837e13aa6d7192 9a946702625c5b75
+376 54418794ea39b2c7 539c1d2a923979b9
+377 76d723d9a8192536 a268e85ef673625d
+378 4a81e9244c370271 f191c56695b9ae22
+379 96b46e7e53f36028 d7449eb8cdbd7e4a
+380 9aaa1bdb45d790a7 a0c7f8b7a38ce82d
+381 0960dc410feb8e34 fa079e0607c31b4f
+382 680702f92a29b0d7 91c16056ff4cc6fd
+383 53ca57a1f4d18451 6203f199bfdab739
+384 54bb74c301909188 fc4e0678ad5c35d0
+385 68e3e1a0e50f5053 8e9d41a71bc22633
+386 b9d2b8f66a2a9e5a 54df7d108a7fe4ce
+387 1acf625370f03b1a 9a946702625c5b75
+388 55b6cc5cdd88b2eb 539c1d2a923979b9
+389 ed76cab395bd3fd7 a268e85ef673625d
+390 0c8d5e9081885c58 97170325b033756d
+391 40b71f1a825987c0 7a62b016fd2efa85
+392 16d8ca3dba642065 a0c7f8b7a38ce82d
+393 189bd6e139c8091b fa079e0607c31b4f
+394 c3743fd87d67e49a 4d9e775467eea1d0
+395 a9b9da9dd9414ecd 55a6d86c9c5cdd2d
+396 0b93f8e986787677 28e194978b8d5bb8
+397 d4b372b4ede4672f f342227b2841cefb
+398 66641e3b12009f63 8334fbd8e324c4e9
+399 8994cdcbd92db4bd 9a946702625c5b75
+400 92f43aa7fb4c025e 539c1d2a923979b9
+401 1f4054bf7a2c565c a268e85ef673625d
+402 04fcf0b896985bce a961ad6615255ff7
+403 8e7a8173711a50d0 81be6ab46ebf000a
+404 d5718b52dc79e4ec a0c7f8b7a38ce82d
+405 9efcbdd7d0190a5b fa079e0607c31b4f
+406 84aaca46035a146f 5e0bf9076af9e663
+407 344f5f2eccedf798 9a946702625c5b75
+408 a602717a0d806acb 539c1d2a923979b9
+409 188fd2c4e8685e1a a268e85ef673625d
+410 d15f3f04f141fa2e 9c1a55294b98338d
+411 9cce18c74516b8a6 357c0681dd233085
+412 20ac0cf91919c842 a0c7f8b7a38ce82d
+413 9dd8038824cacf85 998e0bf2891431c5
+414 5d72c96ee9ec0302 9a946702625c5b75
+415 07c57c8cdc7764bc 539c1d2a923979b9
+416 7ce2cb89e3a2e0ee a268e85ef673625d
+417 60eb0917c2546591 b25492d8f31939c0
+418 ed807cfb949c655f e34a6aa7e5c64b6a
+419 2d755b67ac659c6a a0c7f8b7a38ce82d
+420 0c79cbc27bdc746c 0f30d19b5c9fc0ad
+421 985c86cc4a0b1351 c75a10669400bc5c
+422 26536576e8031465 4cd2e5a1fbf40af2
+423 d9440f1fa47c4df8 9a946702625c5b75
+424 80f45489cfecb7bf 539c1d2a923979b9
+425 0711119f323e2986 a268e85ef673625d
+426 a31c248aeda39667 779c6e2aad622772
+427 85e7203fde00f03d 83a18362f77801b2
+428 8fcf7dddbbc2f6a2 a0c7f8b7a38ce82d
+429 558b1d26d89be615 fa079e0607c31b4f
+430 ec688e880e6fdc7a 39a7c39d78aa7e4c
+431 0491625f3a26952d 86fb56c929a00448
+432 1cf77352f3b3231b 7fde4ea97d37f1a6
+433 410d9f46d89b19a4 9a946702625c5b75
+434 6d048e41ff743d39 539c1d2a923979b9
+435 573bf3ce8ba174a5 a268e85ef673625d
+436 99a8872eb869db1f 7442ec9c5bf4be6e
+437 481379c82ea76246 2f32b40485c91420
+438 6113b0f4072f961a a0c7f8b7a38ce82d
+439 116d7b5e2f06e648 fa079e0607c31b4f
+440 93c9c70976071883 991c40a7f2ea6d36
+441 05757215fa6cb906 a40455c7fbd8f608
+442 76bd614eba0f795b a4cf6500e4db7952
+443 d4623e23ff8120d9 c755da61cfa0c149
+444 91448f2389ae4555 0c9370cc807da859
+445 92a40d1e35c15a0c 9a946702625c5b75
+446 45f6191e7fe76280 539c1d2a923979b9
+447 079e8e054580c0c4 a268e85ef673625d
+448 7e56722d052d2232 fb2cb89558738336
+449 ca95ca525add07bd 5de7cece8fb4f9e8
+450 96ac2f585069ee14 a0c7f8b7a38ce82d
+451 fb0e3ced2cd6f641 fa079e0607c31b4f
+452 3d668f0fc27b5487 eaee51dd9c46b4e2
+453 f38aed4c82d8cf43 cbe27f2a1d692974
+454 0a11eee54f189b41 9c09ab51c9295dfd
+455 7706538e22ed171f d86902442d3576f0
+456 b63d44cd79f4e6b9 58e7bdd315d5f855
+457 e08eb02752fa5c7e 9a946702625c5b75
+458 468f89317a6abec2 539c1d2a923979b9
+459 a7df00e75c7b1d83 a268e85ef673625d
+460 7dcc3d0c9c68ad4e 968ebfcb1bf1f9ef
+461 7437b5cd9aaf5584 5e63aad87e410d09
+462 9429061c15ad90fe a0c7f8b7a38ce82d
+463 cb972c062d38e80b fa079e0607c31b4f
+464 4b294a6489c0497d 215e551dc3815acf
+465 fc5b5306ede35de5 9a946702625c5b75
+466 71d599ba796386f5 539c1d2a923979b9
+467 3b294bf984262b85 a268e85ef673625d
+468 92216508b0b0e623 993ffead8da75d21
+469 4d56262e277aba84 0f37791c27aa2bbe
+470 209eb3d9570167a8 a0c7f8b7a38ce82d
+471 6b5e3ef33328b409 6c76f9bc1edb03ae
+472 63dd9f334465f84b 9a946702625c5b75
+473 a8c66b07ddf17d98 539c1d2a923979b9
+474 fd82bf829cd003a5 a268e85ef673625d
+475 902a254f7188e316 8ea7b5c2d080b941
+476 151b19de809af4c1 7c78018a7813e2fd
+477 3c18e89e56b26095 a0c7f8b7a38ce82d
+478 1a57237da9bab0b1 b24109b9abe172c9
+479 4c66505e3aea3e57 9d8f596a072f93aa
+480 2d4ec5a541abb340 2db56585ca4e27cf
+481 f1940404bc989dbd 9a946702625c5b75
+482 ac656ebbd6e733dd 539c1d2a923979b9
+483 47db17a38f12c8b1 a268e85ef673625d
+484 e9e00de5cc1cf464 b8b46ca85486610c
+485 4a0cc95f6bea24d2 fefb4a92baf8fa21
+486 82f9809b55071475 a0c7f8b7a38ce82d
+487 416b3ffc0b6bc614 fa079e0607c31b4f
+488 982cb4ce1abaf836 0c165cb0bba061bf
+489 27e435498f74056f f90d0edfccea87b0
+490 eab9a128c3a851c5 a718906f0899fcf7
+491 023e04474bee50b5 9a946702625c5b75
+492 9c670ee6630bce06 539c1d2a923979b9
+493 30242f55b29e389a a268e85ef673625d
+494 5af3aa8b3936cb17 176f3f13b7282c4f
+495 48a17ce7c8402e16 8e63cab086e9ed00
+496 9bd45523da93efa5 a0c7f8b7a38ce82d
+497 238daa228f7034b8 fa079e0607c31b4f
+498 f7426475a8fbf536 89c71d1075640a85
+499 d59f0a839a17f66e 97cd51411a269e3d
+500 11d23c4e453f9334 2ec09967e13baa74
+501 740204dad9986596 53af38f44b449285
+502 e690ea9ac0a03177 366622628af3d69e
+503 a5653f77a2ff29f0 9a946702625c5b75
+504 1f63ea8b0a6367b0 539c1d2a923979b9
+505 89e1b2539f2f6e3c a268e85ef673625d
+506 148d273c65126d33 ec22370901732721
+507 9cf82f2ef603dad1 604b3c665866ae8b
+508 e37d16164e51c99b a0c7f8b7a38ce82d
+509 58d30fb4f67afbc4 fa079e0607c31b4f
+510 4dc11e7c90bc09ae 9dd74e4e2a848eb2
+511 e1f5173eafa1333e 80687ac188957ee6
+512 7cd14b52a0765ebe 8902206f97d1825b
+513 d5e20e4bf10333a0 b8d21a2568f3b9b8
+514 957b8a6610746efa 9cd19872b05165c6
+515 af7863bb77291f4c 9a946702625c5b75
+516 4faf330465de9a56 539c1d2a923979b9
+517 7fd5a46ef61d764a a268e85ef673625d
+518 64119cecffd70ffe f849e65ec76e1a84
+519 b3a787892144f65d 9cc6a994839c45e4
+520 7df01ad13b16f63a a0c7f8b7a38ce82d
+521 a900694ff4711879 fa079e0607c31b4f
+522 3500978961304460 e4bd1f923794b147
+523 0d820a609af80901 9a946702625c5b75
+524 c430378109cad27a 539c1d2a923979b9
+525 176599d913af697a a268e85ef673625d
+526 0b3cf9e19c30b97f 58f2334f8ca9cb80
+527 78fe1d11e94692b2 f1aa6d8047c8323c
+528 a22705517e6515b6 a0c7f8b7a38ce82d
+529 6e19463c6c23ac36 43acaa1e14b30969
+530 8856fde1d1f0b090 9a946702625c5b75
+531 e3f43ace66aa1b41 539c1d2a923979b9
+532 a255b57321113cee a268e85ef673625d
+533 652b5ec6051051a9 5e8e7d4a79f70a69
+534 0dd05a89f94d5b53 a56f43445cc42f9c
+535 618665f5e8a2ca97 a0c7f8b7a38ce82d
+536 d9a3d7ebbdb8a7c0 841bd4b3c07b2e06
+537 fe0748a7a23c9888 167cb9df676ccc19
+538 69817be0896ec6f5 f7a743f7ed13a7ee
+539 9ed6989c768a8c41 9a946702625c5b75
+540 f2cdb95a3c881ac1 539c1d2a923979b9
+541 0cb1d968b3e70e4f a268e85ef673625d
+542 f3ae1399011e2486 008a6d58a73856df
+543 f7b398672cf4eea0 089bb4b0dd4f9855
+544 c4e022380dc98cfc a0c7f8b7a38ce82d
+545 f3aa52ab5dffe244 fa079e0607c31b4f
+546 262875fd15dd282e 7b24b4735525c64e
+547 7ea1e4806770d0bc 32aff86a02175f86
+548 018ffd0302af6a01 fce7fb229c97bf65
+549 e7ea31ae00081a75 9a946702625c5b75
+550 159d0a6f432acef6 539c1d2a923979b9
+551 e651b92483ada564 a268e85ef673625d
+552 dbfdc2a2f5880f4d 3a2e06aaf38036c9
+553 720da9c8af732736 f4353e308d272cd0
+554 6d748581042396dc a0c7f8b7a38ce82d
+555 47bc4e38555b8784 fa079e0607c31b4f
+556 b6187980a2a10e22 714d2a4829ac0c08
+557 0a0392e54aa5b925 4ff7ede1f6e83a5f
+558 d95c53b1a69d8a11 22fad75e10e92a93
+559 86fcd29f82627e38 20531bef9d408c42
+560 e8251a4c7a382bb5 129b9f3c21748863
+561 33d1e4b38e7336e0 9a946702625c5b75
+562 b69415f4ed0e83d5 539c1d2a923979b9
+563 723c167bd4d560dd a268e85ef673625d
+564 b5757b25c5bc48da d24e5e76d6b0c226
+565 ad4cd1c5e9ac52c5 c7cf6407bfcbd282
+566 841a38ad89029f17 a0c7f8b7a38ce82d
+567 2e3c568ab1209181 fa079e0607c31b4f
+568 e20d6f0121da6128 caa5bbe6c70fc7c7
+569 5d636343ed2e49ca 30080b5e818b5dde
+570 2813a364fc20ef6c 29877725f49926b9
+571 4ee0a4860ebbf64b df474ed8f4b878c1
+572 20dd84047c39de0c 9907fec486b664c8
+573 36c678306258f625 9a946702625c5b75
+574 abdc37eea2adf591 539c1d2a923979b9
+575 d245de32c151b25b a268e85ef673625d
+576 89d51a950211cac7 cac9aae7a77c49da
+577 3733edbc1dad4c19 4c7927a7fae749a6
+578 528391d6268f45c3 a0c7f8b7a38ce82d
+579 b48b7ce77c13e0e9 fa079e0607c31b4f
+580 fe6c7c9a26a664a8 e3e9c0d57941e614
+581 aec66a7bb1d6f536 9a946702625c5b75
+582 787302c55ec4a544 539c1d2a923979b9
+583 5b92d9b9a20888d1 a268e85ef673625d
+584 8a68a7728c4e609c e71201dbb772ce76
+585 932c693067900a37 585ade00061b49b4
+586 b9d5041400ac1605 a0c7f8b7a38ce82d
+587 e71879589c6b720f 4fa94170ea5cc6cb
+588 56dfd9521aa9baf5 9a946702625c5b75
+589 5379195f55abf490 539c1d2a923979b9
+590 3bc3a18eb47730d0 a268e85ef673625d
+591 5d6c7f35f53c3338 ed357497a73ae9b6
+592 23a2357e045f51b7 59793ef3961fd807
+593 53698f82c0158a50 a0c7f8b7a38ce82d
+594 f7ef7ebefd99d9a4 80d1209a5ee41d59
+595 b1c3255e9696d0cb 6b82671bd3a7c28a
+596 a6bbc943b01cba35 6ca80fb3ede40791
+597 e514b6dcff24d47a 9a946702625c5b75
+598 16c551c3214efa47 539c1d2a923979b9
+599 b0b034dd85e6cd45 a268e85ef673625d
+600 4665f9f6cdfbb36c ed9bb3898f762aa0
+601 772c32078dcc6c1b 5e3e450bad946e74
+602 85e596d5e81e4afa a0c7f8b7a38ce82d
+603 1551f821e74abc93 fa079e0607c31b4f
+604 2c875b20820b31d5 79ed48a792650b87
+605 c3c315772d321829 fca522c110f1277d
+606 812dde640d810666 123bc50c9dca9e5a
+607 d5e1960efd035a8a 9a946702625c5b75
+608 a34d84bdc20b6b7f 539c1d2a923979b9
+609 495269c10b9c95f1 a268e85ef673625d
+610 c08c609d0b99283e ba11c2d58234a0ca
+611 045d22bc44097421 eddee045502dfcd9
+612 f0e88f56b3a3ff52 a0c7f8b7a38ce82d
+613 5adb93ba90df91fa fa079e0607c31b4f
+614 1ad9b87259968700 bd5764b6af2b45cf
+615 1ebb1ad39f817d88 e7760c144ce87ff4
+616 3e66129926186a5b 8f356aa025326520
+617 7d1dc399888dcc98 e4ccf58e889d7c7a
+618 5acce0378add68fe db07dae6b495f0c4
+619 09b9fccda855b442 9a946702625c5b75
+620 9dc95c3e001357a7 539c1d2a923979b9
+621 650d73ba7de27907 a268e85ef673625d
+622 0087e72643748351 60d3fefff2b481c0
+623 620d85ed97d8ee71 4e0f93cee487c212
+624 7692afbf8e48e4f3 a0c7f8b7a38ce82d
+625 e3323a0a5318b5e4 fa079e0607c31b4f
+626 9d7f635b9a5798b7 1f514fa6595f6cd8
+627 c33cd7d0fc5263b9 e569e2b55c9eb579
+628 a6bb3a6bb53a171b dddeff1d80e4171f
+629 0e82a19e295a02c8 b0ac09b41a5a60c1
+630 756d46c4979301fc d6e7769eb188485f
+631 6ffbbf3054720afc 9a946702625c5b75
+632 d6511adc238f85c2 539c1d2a923979b9
+633 294b9a982f45ad78 a268e85ef673625d
+634 e0c9ffc6b17fc666 99e39c036704d046
+635 a52d50ddbd14cc0b fe97d4123d4058be
+636 10d6c7e40c5bb9c3 a0c7f8b7a38ce82d
+637 95835506c034071f fa079e0607c31b4f
+638 9e388546896bbaaf e1521dab24311489
+639 dec3a5b9cf8016c0 9a946702625c5b75
+640 4f555f7a31338b19 539c1d2a923979b9
+641 9ab86b618d1719d8 a268e85ef673625d
+642 0f5773351acdd6d2 52b8904dad59094d
+643 f033f3d818481203 c63c3604da5e279f
+644 3e8203da4c810e1b a0c7f8b7a38ce82d
+645 bb0b07fffdd7ede6 4b207596c1dbacc1
+646 5b3e4905c6c6eede 9a946702625c5b75
+647 c59c0017140f4c6c 539c1d2a923979b9
+648 e395c1678c830cca a268e85ef673625d
+649 e1a4854622c58eb5 7ab72b2f80ce61a2
+650 9577d41f9b61fbb7 4ced23d2d3d93638
+651 17d34576c8d4f0cc a0c7f8b7a38ce82d
+652 e962d90665f4a973 9ee0091aa73b4ddb
+653 c34853c60583d1f2 d3ee67f51ae74788
+654 2f520b1690ca56a5 32e600ebb7a2827a
+655 8df240f338b20031 9a946702625c5b75
+656 8da1c4bd473363c4 539c1d2a923979b9
+657 c6bf4afb98686b82 a268e85ef673625d
+658 8b73dd9833b0ec8e 6c157e62f840ff53
+659 2f9c186072f74a51 60956bd18bbaf256
+660 692f7da11426bc1f a0c7f8b7a38ce82d
+661 c0b485e3cccfdd82 fa079e0607c31b4f
+662 b7bd0e2b69c645da 1acbdd73063364e6
+663 cac6f5d8649db6b1 bbb1db49eced6d0a
+664 f4e2c14bb9c3c310 f23ed7f2ec8b4615
+665 0913460c7775edf4 9a946702625c5b75
+666 486b348ad26e736e 539c1d2a923979b9
+667 eefe3bac6f42dcd8 a268e85ef673625d
+668 4348268429967e5f 1954d002a278191d
+669 cdebe00feea92200 b70a2e4c15c49fb9
+670 674b2500841b93e6 a0c7f8b7a38ce82d
+671 c0be6b660f34ae07 fa079e0607c31b4f
+672 1a513bf929524ea1 6ace7b4946677f93
+673 e86732b87c457da6 5e4c1e06ce2c3330
+674 2c57da4a6de1a886 d9e3f3962429e75f
+675 db1487806323ba48 1cbb5e205e0d4b54
+676 03fee9758575e009 67dd5e713a3d3ab8
+677 afaf6ba3d330e0bd 9a946702625c5b75
+678 4b9eb586c92f5ff1 539c1d2a923979b9
+679 dd1bcd3e595ae8a4 a268e85ef673625d
+680 83d6d63e6151a524 fbcebfc24a583175
+681 fb6a159ff32a8c80 81a6bc2a91c2870e
+682 19d80a5a7385c273 a0c7f8b7a38ce82d
+683 6b2a63af737c087d fa079e0607c31b4f
+684 f7595f547b77eaaa 9fb838196b19881e
+685 d518355c1a832505 01fc20e67c8f8fc9
+686 69103bcd82facea1 90face6131717a4f
+687 eff63a4021952de5 b485550573b6fb61
+688 93c5c4102ed23a28 6c133795dd88a588
+689 5eb1f6d4f8895bf5 9a946702625c5b75
+690 5e676a635a44a8ac 539c1d2a923979b9
+691 c91bbdeeb6bc21da a268e85ef673625d
+692 93ca4f6f9593debf 1182057cdde2dd06
+693 70c983163ea79e05 fad7fdadbe6be120
+694 06d12e08968eb0a9 a0c7f8b7a38ce82d
+695 0804dceaa131e9e8 fa079e0607c31b4f
+696 72e2b31ef002f93d d11a758692cf05f8
+697 2f91d9474f17acdb 9a946702625c5b75
+698 ce6b43ed0c72194c 539c1d2a923979b9
+699 6c8f6ed88448a3d3 a268e85ef673625d
+700 f36069572f4c663e 03a77b44711d87e1
+701 f2b8a5d78661b51c 885365553b4cf3ae
+702 1d12ce2033db5680 a0c7f8b7a38ce82d
+703 953b6afe9ba1303b fcce80503ea070ad
+704 7720568f3237c2e5 9a946702625c5b75
+705 00303fcfa7aad1f6 539c1d2a923979b9
+706 b71fee3ab753eec7 a268e85ef673625d
+707 ef79d8cd55b54906 208c0fbb8a39a2ee
+708 111de55deb3b8f68 5f76570ca028a4d1
+709 61f062be7c41d9d8 a0c7f8b7a38ce82d
+710 1374f9adf1974004 cb20e850527b4f87
+711 55495a35887e46ee 6380cab448a3f704
+712 ed7a321c76d8547e 9a20a2935ac6a3ac
+713 cb1d0a1f2e036c53 9a946702625c5b75
+714 0c1267270f72aaa8 539c1d2a923979b9
+715 aaea403f4dce7309 a268e85ef673625d
+716 f05ed668f302204c 76c170b955fe47f7
+717 a6abc1bb75ef8847 0d6c2138caa1ac7b
+718 eca6689a6eb21d0d a0c7f8b7a38ce82d
+719 6c9b91fae3902329 fa079e0607c31b4f
+720 cd357ef026ab4f7e 1cd3fea3c9d32499
+721 b692c182e67c1b44 07fbb0c61d02a96e
+722 97d5a67976e8b4ea 7ea414e26ecc3fd3
+723 da1c9dd6c8a51515 9a946702625c5b75
+724 f008d5ea7d28fb67 539c1d2a923979b9
+725 ed6cbba1014436e6 a268e85ef673625d
+726 b56ab639fa5cea66 946dec2cda8972b2
+727 26093ee74fb843ed e7394d5674c04893
+728 e5213be1f282ed25 a0c7f8b7a38ce82d
+729 caa6b57cd4c3ed2f fa079e0607c31b4f
+730 c21404891d7dbe0d a48818f8c6fb10b1
+731 7633bf29ee8cda5d 517d18fbc6c5996f
+732 26ae98512d6a8562 fcea13972a7bbcb2
+733 682eb4212e9aed30 dc770a29a3d15e36
+734 aa86228d27bd6945 f983c22f4b629573
+735 0e4d2aef7a19eb88 9a946702625c5b75
+736 c0c7567259b0cb0a 539c1d2a923979b9
+737 c1f56a784fa2d728 a268e85ef673625d
+738 e08fc4d0ba0cc4dd 11a4ae86948669da
+739 980c6d182b9071af b001360a59397a09
+740 68cadf348e0e2c3b a0c7f8b7a38ce82d
+741 a09e05887498042b fa079e0607c31b4f
+742 cc4513f777cec34b e17d0ba3586c72be
+743 f4b34e1a926dd827 80e3b06d1c216e5f
+744 2a20954451679413 86d2c098b9233abd
+745 dace8b8f5642b846 29e67e78e3077753
+746 c0070275f42f3d6c 464cc91f6c08a58b
+747 c1225ccf13f2041b 9a946702625c5b75
+748 288ef06903377145 539c1d2a923979b9
+749 f3f05b9def0c5f0e a268e85ef673625d
+750 31dfcd70fc37ca75 54383784053856ba
+751 ddb42b6b033ab008 d0c0bb2094876513
+752 40041a7f0a436646 a0c7f8b7a38ce82d
+753 cbeaa107408270af fa079e0607c31b4f
+754 f6cfd1a3d53f692e 60c5cf35167bc2ad
+755 8e9d834717eb8da4 9a946702625c5b75
+756 c85b8006cd75874e 539c1d2a923979b9
+757 80c8e44c7bdf573a a268e85ef673625d
+758 c1b4aeda950cb92d 0ade615542138e42
+759 e5517b5e86093c31 f1a00ff6252b2e5d
+760 14c0863701eda852 a0c7f8b7a38ce82d
+761 8be51200b6511a35 d441335e8942716d
+762 284759850a866f2e 9a946702625c5b75
+763 f9a91d05145eb883 539c1d2a923979b9
+764 82c48b11f7e589b0 a268e85ef673625d
+765 dfdf10a74936725d 49f10baf46415403
+766 7aad1ca52eb8b83f d99d8df33cee5743
+767 657cca3a4f92213c a0c7f8b7a38ce82d
+768 de5c6fc8dded15a4 ff8d7e77ff1b54f3
+769 a4fb9be261f3ad2f 68d5429470596f49
+770 018402b71419e018 2b7741a0a3e2a74f
+771 b3905753aea57078 9a946702625c5b75
+772 2d33b2e49c1006ce 539c1d2a923979b9
+773 e74774d0c7e8d3f1 a268e85ef673625d
+774 f23314326d1670e0 6fa9761719a4e5ef
+775 3a9bd5dc832b1ec2 2cc46f976788f8bf
+776 2e7c38990b912015 a0c7f8b7a38ce82d
+777 27a5161b41e98573 fa079e0607c31b4f
+778 395c003790d4ffc3 1341f97b335a715b
+779 97e0dde0ac748fe2 bdafb3636d9d046d
+780 70b1c741155f3eac 9623037e5434fcaf
+781 b66f5f24454a0fcb 9a946702625c5b75
+782 6c307702d961caa3 539c1d2a923979b9
+783 5259d78dc7dd4029 a268e85ef673625d
+784 8f1d7ff65742f093 58f569834a746374
+785 4b4a9a534e44a2e8 6c5e8657d027b0d1
+786 d05a1e28065ce669 a0c7f8b7a38ce82d
+787 f2b8bef539161d2c fa079e0607c31b4f
+788 959ecd7ca52bc5e5 003ed13368451f27
+789 644d45670a7ed060 a44d437b32d98cc1
+790 fb402af7354ee68e 2bf8b2f8898bdc7e
+791 377c5c3252e4f272 e38f98d27b9d9263
+792 af1f4ac42898f244 ac0e2ccd28dbb4ad
+793 660bd1f258f9d5b8 9a946702625c5b75
+794 4a4900a9dbde81e5 539c1d2a923979b9
+795 7dc571c8a26f94a6 a268e85ef673625d
+796 ae655f1f16fe42ba 580cfa853a8cc0fc
+797 3da9fa8606bb5ae6 ebe35a600c4cc45c
+798 2ef7e96703c99ec8 a0c7f8b7a38ce82d
+799 07256b8e2d86ce0e fa079e0607c31b4f
+800 35e4c74162086005 7955b038ad806e79
+801 af5c394a0ba5ec6d fd3d7c3765ae3fb1
+802 43e5f13e064f1fde 3970f2c7b9f2aad8
+803 8294101db7c9fb8a dd2ec7e9845503c2
+804 760ed642b0985c62 ea208e0fcf600b89
+805 2dd33ba8962483ec 9a946702625c5b75
+806 c1903d7161bb87df 539c1d2a923979b9
+807 ba663d7fe1241c04 a268e85ef673625d
+808 5199e31f86c42804 3900b34a78245d67
+809 387d26844e85ba60 38929bf1af18b989
+810 de98c9d11d6e887e a0c7f8b7a38ce82d
+811 d8cf5579b80cc243 fa079e0607c31b4f
+812 5b5a282a2c78fd8e bda8d93e0d7324a0
+813 540b3362e235c2e9 9a946702625c5b75
+814 0b0e2b47b74560c5 539c1d2a923979b9
+815 e9a7f5dff8d2e377 a268e85ef673625d
+816 c6dad953413cbbe8 610cfb6a683df922
+817 c159dbbf0776747e f9cc4d261de7c34f
+818 9d73898674872ee3 a0c7f8b7a38ce82d
+819 ff512acc6e6d19ec 31d212cb02d89f0d
+820 fe1955fd8e764f2c 9a946702625c5b75
+821 ce52c324b8945714 539c1d2a923979b9
+822 fb5f64d7f2e3cada a268e85ef673625d
+823 1740a219bb94709d 67b307e451d4c455
+824 4ab3170b14032470 b58398529050d69f
+825 b2894d43e8ef4d78 a0c7f8b7a38ce82d
+826 199e9775cd323618 bb9b0e5946c39e6e
+827 739357a7ea6dbc0a f0fc3f50766427f4
+828 9024eaffa691b71c 2eaf6acfc3cabf25
+829 8d18299567927cbb 9a946702625c5b75
+830 e4d6f17c083f6b84 539c1d2a923979b9
+831 4569d66effcb6c83 a268e85ef673625d
+832 7739d57fac469b83 9696af78b7c82e66
+833 3dba91423ab77774 a3aa849c36d584e8
+834 ae77b6bc7d333c99 a0c7f8b7a38ce82d
+835 7885e6f28915897e fa079e0607c31b4f
+836 8a3dc804cc2bf515 94f3eb2d49d1fb8c
+837 919d3d9f16f1459e d8d42d7c68cdf1f7
+838 471d72d59f219163 de9742c264a38905
+839 c8223dbb9e9446f7 9a946702625c5b75
+840 c835e19be7ffdd22 539c1d2a923979b9
+841 c1299ace0e314f25 a268e85ef673625d
+842 68d2f117669d47a6 35d66b136bd1327d
+843 38a0e49225ddbc4f 9e3276e1acdcc526
+844 68457cfc8a9442b9 a0c7f8b7a38ce82d
+845 0d4dd665685a1630 fa079e0607c31b4f
+846 04cb8fc9c3bdfbb2 7fd8f3b5413b80e0
+847 9f4f3fc485e6a5c7 2597d1037afe1450
+848 c09de20e3638f2f6 b82e067679d4a0ca
+849 75735b9163e5c6a7 c50b00c1061f3b38
+850 3b92ccdbbd7943ec 39b8b6a378cce352
+851 f5f1b306cc951a26 9a946702625c5b75
+852 005492aa0e7d6046 539c1d2a923979b9
+853 32024b476c329fab a268e85ef673625d
+854 9e1b1cd2ad677f3a 083e66313157d5f6
+855 ebc1f9ea669f7e58 e1c7dfc57ff8c72c
+856 3f311d401c8478ce a0c7f8b7a38ce82d
+857 304557ae61644f07 fa079e0607c31b4f
+858 743993c74a0404c2 13f6d750674f9e5b
+859 123f000f3a9485d1 88c7118b4f5f164e
+860 ac0f7bdfac5d5a5f 3e9990694c244a92
+861 fa822def9d3d333b 629101ce681b00fe
+862 951c348fa5e6be54 065db272dc7adf99
+863 671b280d23ed273a 9a946702625c5b75
+864 74916a24e3537ebf 539c1d2a923979b9
+865 d8b0327197ff7f76 a268e85ef673625d
+866 4ae66b1b36d885a9 8be4b3eed027c3c4
+867 dc4bfaf40cdb6393 dfdee3d01e052064
+868 42fff8f51e69abd0 a0c7f8b7a38ce82d
+869 770199874b76b133 fa079e0607c31b4f
diff --git a/crates/socket-patch-core/tests/equivalence/poetry_rewrite.golden b/crates/socket-patch-core/tests/equivalence/poetry_rewrite.golden
new file mode 100644
index 00000000..f98b498a
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/poetry_rewrite.golden
@@ -0,0 +1,122 @@
+# One grown poetry.lock pair and its deps, rewritten, then re-run over the result.
+# <case> <input digest> <output digest>
+0.12.17_extra=0_crlf=false d2b80f8d058298a0 7f509240352ad7a8
+0.12.17_extra=0_crlf=false/re-run d2b80f8d058298a0 7f509240352ad7a8
+0.12.17_extra=0_crlf=true 4b3a0e23f3264df8 7f509240352ad7a8
+0.12.17_extra=0_crlf=true/re-run 4b3a0e23f3264df8 7f509240352ad7a8
+0.12.17_extra=3_crlf=false a8bee4606ba5b760 d0a6ea16d4cc417e
+0.12.17_extra=3_crlf=false/re-run a8bee4606ba5b760 d0a6ea16d4cc417e
+0.12.17_extra=3_crlf=true 5ae487fb99db0745 d0a6ea16d4cc417e
+0.12.17_extra=3_crlf=true/re-run 5ae487fb99db0745 d0a6ea16d4cc417e
+1.0.10_extra=0_crlf=false 06d7816556307b33 68d9a638c38495be
+1.0.10_extra=0_crlf=false/re-run 613ac93e03589fac 33bbc0c4a6aa1d37
+1.0.10_extra=0_crlf=true 38755c44d8811d7b ad4fd40d36c0ad94
+1.0.10_extra=0_crlf=true/re-run a039bf51c09a676d 33bbc0c4a6aa1d37
+1.0.10_extra=3_crlf=false cd980d8f38e065ee 4430fc9529674206
+1.0.10_extra=3_crlf=false/re-run 885d4754947c0ec7 058fe94fee294277
+1.0.10_extra=3_crlf=true 684566844b37fcd0 ba84db1bf1aa9ae8
+1.0.10_extra=3_crlf=true/re-run 4fd1416655a91e78 058fe94fee294277
+1.1.15_extra=0_crlf=false d0f26c272489ebe3 4f4f6683942816f7
+1.1.15_extra=0_crlf=false/re-run bc82912108fd25ce 33bbc0c4a6aa1d37
+1.1.15_extra=0_crlf=true 6c566dc6e3aeba50 ce637cba6490743c
+1.1.15_extra=0_crlf=true/re-run dea1745a49ef026f 33bbc0c4a6aa1d37
+1.1.15_extra=3_crlf=false 8870f129976dee0d 21ee9a93167e1565
+1.1.15_extra=3_crlf=false/re-run 8551e339b8b54ddf 058fe94fee294277
+1.1.15_extra=3_crlf=true 4d055246679dee4c d50b3dcc3db91f50
+1.1.15_extra=3_crlf=true/re-run 53fe14f551e02333 058fe94fee294277
+1.2.2_extra=0_crlf=false 4b75722f3771f21c f4162004a278ad59
+1.2.2_extra=0_crlf=false/re-run 133b23c3dfc4cce1 33bbc0c4a6aa1d37
+1.2.2_extra=0_crlf=true 1813b308432ea034 1e67c45e616e507e
+1.2.2_extra=0_crlf=true/re-run 004001fb1c25e747 33bbc0c4a6aa1d37
+1.2.2_extra=3_crlf=false 812817b968306e99 0b39f87964356f2c
+1.2.2_extra=3_crlf=false/re-run f81a1c4a49505bce a465f4f09bd7a1cb
+1.2.2_extra=3_crlf=true 6051efc48c2d3992 f2af39ddf70ee7d4
+1.2.2_extra=3_crlf=true/re-run e3ec0a6371139d8b a465f4f09bd7a1cb
+1.3.2_extra=0_crlf=false 86cda4c82eee7e8b 4bbfd63a2999d619
+1.3.2_extra=0_crlf=false/re-run a9df9acaedd7db22 33bbc0c4a6aa1d37
+1.3.2_extra=0_crlf=true e92e1cd1beeb0002 2066c6ae7e285570
+1.3.2_extra=0_crlf=true/re-run f13a599ff9511fe7 33bbc0c4a6aa1d37
+1.3.2_extra=3_crlf=false fe9f2817767e5612 93587980e1c249f3
+1.3.2_extra=3_crlf=false/re-run d9728f0057845cbb 058fe94fee294277
+1.3.2_extra=3_crlf=true 253448255457216e 62ff09de389cc26e
+1.3.2_extra=3_crlf=true/re-run 71d0a8d8ab2ecc77 058fe94fee294277
+1.4.2_extra=0_crlf=false 00a7bc0a3c89c49b 36b408b703f1d8aa
+1.4.2_extra=0_crlf=false/re-run 4aa5eedcf2dd0b02 33bbc0c4a6aa1d37
+1.4.2_extra=0_crlf=true 44de4691acb61dba 0a9305875ef23cab
+1.4.2_extra=0_crlf=true/re-run 47bf0330a4e93507 33bbc0c4a6aa1d37
+1.4.2_extra=3_crlf=false a3fb1d70a1207ea7 9ce5033d5fe06c49
+1.4.2_extra=3_crlf=false/re-run 60023b576de9ad30 058fe94fee294277
+1.4.2_extra=3_crlf=true bd8911bca06c1262 cb69eada9836807d
+1.4.2_extra=3_crlf=true/re-run a5f5292e17ecb5f4 058fe94fee294277
+1.5.1_extra=0_crlf=false a1795ca286fa80ce 4e26992d707a9185
+1.5.1_extra=0_crlf=false/re-run f19230652767bb30 33bbc0c4a6aa1d37
+1.5.1_extra=0_crlf=true 5871c60c9d63aeee db8424880d0e4a52
+1.5.1_extra=0_crlf=true/re-run 6dab15e1eab2f462 33bbc0c4a6aa1d37
+1.5.1_extra=3_crlf=false 0b33aee716ad5a55 2c4b5cb224ddc8d0
+1.5.1_extra=3_crlf=false/re-run e26d96dd76e1b368 058fe94fee294277
+1.5.1_extra=3_crlf=true 161846bd33f1d508 0554981aff8135c6
+1.5.1_extra=3_crlf=true/re-run 3e4cf8de3fdcb6ea 058fe94fee294277
+1.6.1_extra=0_crlf=false d1e0442566c6ce49 fe6855296498d9fe
+1.6.1_extra=0_crlf=false/re-run ea7966d58c9f2aab 33bbc0c4a6aa1d37
+1.6.1_extra=0_crlf=true db20a2c4edcafbf0 d61e14cff7784574
+1.6.1_extra=0_crlf=true/re-run 8f7c22713b6f70b6 33bbc0c4a6aa1d37
+1.6.1_extra=3_crlf=false afd5d875780cdf40 2db96bfd93c1e9cf
+1.6.1_extra=3_crlf=false/re-run 647ef4eb652f1ba6 058fe94fee294277
+1.6.1_extra=3_crlf=true b37fcda617275f4b 26a0a64c5793d8ac
+1.6.1_extra=3_crlf=true/re-run 1a4219f03efad32a 058fe94fee294277
+1.7.1_extra=0_crlf=false 6600136814fb4134 6e2694ad356a0756
+1.7.1_extra=0_crlf=false/re-run abdbbfe42c8b4d7e 33bbc0c4a6aa1d37
+1.7.1_extra=0_crlf=true 6a85a6a27c99cd2b 8369450b092cf661
+1.7.1_extra=0_crlf=true/re-run ac9d84b451f9c128 33bbc0c4a6aa1d37
+1.7.1_extra=3_crlf=false 020fa829b6a870bc 22176abf3ed1e1f3
+1.7.1_extra=3_crlf=false/re-run 31133977b68135e7 058fe94fee294277
+1.7.1_extra=3_crlf=true bcb1fd00c2d4d5bf e5be1777f605bf60
+1.7.1_extra=3_crlf=true/re-run ac38704d471666ab 058fe94fee294277
+1.8.5_extra=0_crlf=false 7b0c488a965c4f7b fdba5e6b6f532877
+1.8.5_extra=0_crlf=false/re-run 60ce065c6b04b5b1 33bbc0c4a6aa1d37
+1.8.5_extra=0_crlf=true 2094d208abbeabc2 bd0e4b35f46b1016
+1.8.5_extra=0_crlf=true/re-run 5903de75cc2030e8 33bbc0c4a6aa1d37
+1.8.5_extra=3_crlf=false e22381008c314e3d 79c02c70931e0527
+1.8.5_extra=3_crlf=false/re-run 147043d9e02c7a08 058fe94fee294277
+1.8.5_extra=3_crlf=true e42675d2895de9fb b319402713da11d4
+1.8.5_extra=3_crlf=true/re-run 9e97459a7ac1ffb1 058fe94fee294277
+2.0.1_extra=0_crlf=false 2775b8f1411fbadb 5e2d1de5fe694063
+2.0.1_extra=0_crlf=false/re-run 5a19ccf0764fac47 33bbc0c4a6aa1d37
+2.0.1_extra=0_crlf=true 17ebf61a05b76816 438f96aa4087c670
+2.0.1_extra=0_crlf=true/re-run 97eff076ab7188a2 33bbc0c4a6aa1d37
+2.0.1_extra=3_crlf=false bc38767ba9dcc6e6 f8b147dc42d7aebe
+2.0.1_extra=3_crlf=false/re-run 44cce38f20f8f16f 058fe94fee294277
+2.0.1_extra=3_crlf=true b68b1e02f151ef48 84bd0d184fd4841d
+2.0.1_extra=3_crlf=true/re-run 054b4ddcb4dcfafa 058fe94fee294277
+2.1.4_extra=0_crlf=false 6f62ddaa4adc50a4 757a21041de4bafe
+2.1.4_extra=0_crlf=false/re-run 5b7e62f966b8d271 33bbc0c4a6aa1d37
+2.1.4_extra=0_crlf=true 8a8d93a2b2127129 6480c31767f7cbce
+2.1.4_extra=0_crlf=true/re-run d1cd3eeea0692da9 33bbc0c4a6aa1d37
+2.1.4_extra=3_crlf=false 65364c0f4e7aa0e7 466d6a49990d9d78
+2.1.4_extra=3_crlf=false/re-run a3676e7eddbccf4a 058fe94fee294277
+2.1.4_extra=3_crlf=true 821fdbf37b56026b 1ca37ca1cf0d8978
+2.1.4_extra=3_crlf=true/re-run 25f65d16b322be1c 058fe94fee294277
+2.2.1_extra=0_crlf=false 7a500b5022ac388c 7220a5bd51319fbc
+2.2.1_extra=0_crlf=false/re-run b484d2ecc12a5edb 33bbc0c4a6aa1d37
+2.2.1_extra=0_crlf=true 11b39909d694a4f5 545be68d50053014
+2.2.1_extra=0_crlf=true/re-run f73c0184185b55c8 33bbc0c4a6aa1d37
+2.2.1_extra=3_crlf=false 10b0bcde3632669b 81a4c77f7f4e49e1
+2.2.1_extra=3_crlf=false/re-run 679acf31e13b71a0 058fe94fee294277
+2.2.1_extra=3_crlf=true feaa6416a4b168a3 0e8c1642cda6ab31
+2.2.1_extra=3_crlf=true/re-run 4b8aa165ed772485 058fe94fee294277
+2.3.4_extra=0_crlf=false 1ad17cac9704b1ce fffc310706b37104
+2.3.4_extra=0_crlf=false/re-run 398fea1a1ac5d77b 33bbc0c4a6aa1d37
+2.3.4_extra=0_crlf=true d4578a811e547b2c 7df856e191dcd834
+2.3.4_extra=0_crlf=true/re-run 5f79a7161605a083 33bbc0c4a6aa1d37
+2.3.4_extra=3_crlf=false d38430f6b06c87f3 0a52b8d5379a1ab6
+2.3.4_extra=3_crlf=false/re-run ee7114aaad11f4f0 058fe94fee294277
+2.3.4_extra=3_crlf=true 89e72b13eccda257 351bb2773426b174
+2.3.4_extra=3_crlf=true/re-run 04c0dd27743659d0 058fe94fee294277
+2.4.3_extra=0_crlf=false 70d3006a3e404efc 1bfcdd185fb8ff92
+2.4.3_extra=0_crlf=false/re-run cb0289ac6716caab 33bbc0c4a6aa1d37
+2.4.3_extra=0_crlf=true ebe555cb2a5fb1f2 c52420d9986dd40d
+2.4.3_extra=0_crlf=true/re-run 3f6277fd5f2ef21b 33bbc0c4a6aa1d37
+2.4.3_extra=3_crlf=false 7bcb0eb7f4f1150a 63289bf331a1b40c
+2.4.3_extra=3_crlf=false/re-run c7b4e742d1f0f79b 058fe94fee294277
+2.4.3_extra=3_crlf=true f1ba10a6e2549703 9e944e2c50375cbc
+2.4.3_extra=3_crlf=true/re-run 6c2fb99f914a5767 058fe94fee294277
diff --git a/crates/socket-patch-core/tests/equivalence/python_lock_refusal.golden b/crates/socket-patch-core/tests/equivalence/python_lock_refusal.golden
new file mode 100644
index 00000000..e0b491d1
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/python_lock_refusal.golden
@@ -0,0 +1,6 @@
+# A uv.lock + pyproject.toml whose middle dep is refused, LF and CRLF.
+# <case> <input digest> <output digest>
+0 a2feb95faecac550 efb0c5ad3e7e4d37
+1 675efda53823ee32 05f38ded897afaa1
+2 a3fd07e7336c6ac2 5f70dfa0b238ff6a
+3 81de580200f61334 c48407e0913b0c9c
diff --git a/crates/socket-patch-core/tests/equivalence/python_lock_rewrite.golden b/crates/socket-patch-core/tests/equivalence/python_lock_rewrite.golden
new file mode 100644
index 00000000..ba7b1b5d
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/python_lock_rewrite.golden
@@ -0,0 +1,302 @@
+# One seeded uv / pylock / PEP 723 lock set + overrides + wheel metadata.
+# <case> <input digest> <output digest>
+0-4 cd5cd36a37fa8c9b 48a0e144464b8f8a
+5-9 f58e23b53c07f972 ae07e91b0894f326
+10-14 63a0aa035a8a4e90 ce91f93cd49ca4f5
+15-19 7cf3d76e36752625 590f305643295efc
+20-24 c7c648dc10c3c7cd 9fa1deaf96f07fe2
+25-29 831189dc733b8849 3ab9faa9395cf06f
+30-34 dcb109d643382adf ade5041ad97eb6f3
+35-39 99a313947928f593 040d41e8e286d342
+40-44 cf5611d067871c91 b9005c5ab4e2d992
+45-49 04f0e41a9e302f59 703a8fae640714d8
+50-54 03d58da62810b2e4 6ba89e38cf850141
+55-59 daf9f41b5decbf2c 34103170b8df8696
+60-64 58413f6f2f266d0d e269d6e79181da6a
+65-69 cd4f77526796ec70 ffec6efe319265a7
+70-74 3befe3b6747c7c5d b1e8a696d2d54b16
+75-79 f704740390513318 42df63da4590a254
+80-84 6bb2704eadd90bbb 5ca41094d0424e3d
+85-89 2b41ca85da12924d 65b152efd83c3bd6
+90-94 b4f4d21d57b4e3e6 d69a5253edd903d6
+95-99 1fcae5cb34b3557b c47c75663ff48676
+100-104 22d4b081083ec3cf 2c43f956c74c6f26
+105-109 b33352ae7c78a21f e20dfee24af86bff
+110-114 459ff3efdff5f2cc 3466cdd3d19a1300
+115-119 291d724de0819b8d 8466395f3165a0ef
+120-124 21a80a5bc6b9e421 41fc3cf934fc6087
+125-129 8e678fbd38ff1c68 a47bfa725066c0f2
+130-134 a38ee386aaf54bc9 047307c34ed923f7
+135-139 f3c8324bccf53c32 ec9316e47aaf4eab
+140-144 7d6c4b160a757e64 56ac168022c5a5f6
+145-149 e366e05fd9c0ef0b f16c3c8253ab5ddc
+150-154 7f552bc377ac439b 121853d116c28aa3
+155-159 5c987ad06f4c2cf3 853fcb9da6efea74
+160-164 2fd97b5cdeea8344 34d616cba9ff2f92
+165-169 8f16946d73613e52 4ee31b57d3a5fb45
+170-174 72c1e1cb26500151 4d8622bd269f21c5
+175-179 4333d230209fdfdd fe0ef3c12d1a0cb2
+180-184 70af4e6d0a9804eb 849fc5b3c32d6b64
+185-189 6073f94564a728c8 42f8708863320edf
+190-194 0976869c3d0f4aeb 03f687f9a1ef3754
+195-199 6e26da934df4169e a2787877f35e9517
+200-204 fbb5bb450083c437 31aad032ae8b9c21
+205-209 5f65204b08f141e8 b0f2b706aaac0850
+210-214 5325f0b8e4f86617 78fbabe1106e949b
+215-219 93c1a1fd0318dd14 4dd9af60759027c9
+220-224 4b3c1e25ed139fda ea1624f09c3d14b2
+225-229 01df8d39a686d542 6351804ffd423e35
+230-234 d8671c2aa0925484 0bac935606117b80
+235-239 c2ffbce64c565d4e 69b3aa958f41d110
+240-244 8840614f5d6ed107 8e780f81f0f963a3
+245-249 a3a20836097b17a3 a0c928a84a61285a
+250-254 55507d905e78d536 d0f0d350180f3eee
+255-259 ddb6e7f50dc7b9a4 d1e8dd678ec4364f
+260-264 9e561d5848a362eb c28304e6d6901fde
+265-269 d94a03864c991b66 aa18c672fc3c2eaf
+270-274 d0100fe28bcc0b9f 420f0773032cf669
+275-279 c991021006094a2d bb0f59f239f75d75
+280-284 9630c4201e5eb600 bfc9c9e993e9a71a
+285-289 fb53958c9f671828 5f7f1a56d0410550
+290-294 c5bf6275b89317cf 2b87546cfa85399e
+295-299 99fb36209f586bca e891c6658cee191a
+300-304 5240085dd621df82 458bf378d060d912
+305-309 616cfc3aae79162c 9773426cddea96c8
+310-314 a386fe7bc32fc73e aebfc7302ea42601
+315-319 5d7084c26ae0f3f2 2a770b1138e80898
+320-324 e0a4ea3772d1038a 7c2702afd192fef0
+325-329 0cb388111d9a1b86 6c57e6841ecf35c3
+330-334 d1c41d95d297d164 35fdd17d28531ad6
+335-339 2d6db0a042990332 61f544ab33b2cfd6
+340-344 acfe94db4b59c187 164a716794d54313
+345-349 f443e9c02e4c493c 1836f9a125c48b47
+350-354 6b8189fa7c7eb359 75535c0ded362ece
+355-359 48640c9838b42488 135f6304ae30656f
+360-364 86adc1124beaf310 ee7e33f8f8305703
+365-369 c75c9390e1ec4dc0 159ef5b3c823d104
+370-374 4b47480d5c6430c8 eb537062c9b097a3
+375-379 97cadfe0779bf656 0345c0b1783881a7
+380-384 bae2ef0777128159 394248e293242674
+385-389 a72fe500fd93b54b a48cd849bf320b7b
+390-394 1bda7f0386bcb4b2 8a4c74b37267fb35
+395-399 662e2ce03cc70051 5fed6d12d2490ddc
+400-404 27e91e5f8d9d0500 06b82bdf156dad07
+405-409 d97cfed3b6019a84 4c43f9bf02b1c878
+410-414 9fc1135cea15545b 9451b97982579b88
+415-419 ec0440f6f542cdbe 167b4bffef187ba6
+420-424 820d32ca97f38bf1 d23974a3a1068894
+425-429 a187a84aad4ddd82 f5d0b8ab277a2913
+430-434 63cab5602f883c2b e5605a0a65a3449f
+435-439 6b51186155d6b708 29d92ee2415d97a6
+440-444 d3c75dad29457c53 5cc3259644dba24e
+445-449 5b312af32839186f ae824a4613425ce3
+450-454 867d9e5d19789b27 509f4c37ddd7e5c0
+455-459 845c435d60d254cd ed317c05f75fc6d8
+460-464 fe6ab0fb975606e6 1c2cf9bde750b81e
+465-469 cf94bc0890135d7d fd4b8e2927bebd03
+470-474 5e2dbff33d066336 2d8a71aa7154e62a
+475-479 0479e5e66eeb0b35 b85602f8b33a3a40
+480-484 728477d2aff05013 1f45e83958ffd0fc
+485-489 71a0a6cd3a0f1dc4 209f6097b55a6075
+490-494 778ed33daefe5147 f2ef44e740b04752
+495-499 3f3ef0e47bc79f65 14e10c33f2200fd2
+500-504 aa9adf3185bd29fd 5cb08498d8c7701d
+505-509 45a1e1c9fbf16b34 8d22ee5d9c4a28c1
+510-514 818d16cd8b3bec8a ade0d01f88cdff6f
+515-519 c7422c418ed92126 4a93055b7f3ee09a
+520-524 a3e57516f4ee56fe 5cd6cc5bb8431e8a
+525-529 554002fd18293950 43a791951252a9e9
+530-534 70f5bc4e1811144d 2d5fece8c7f51bcc
+535-539 3bc9d29e9245a772 202e07f57fcd5ad4
+540-544 f2d746650f56eb6a a412eafd24000b57
+545-549 3ebc5e64e438a7ed 1a54ff34be5e0e66
+550-554 b9d3351453b65997 b218188b3377d409
+555-559 37bcc4d58a6d31ef 46055bd9e4a3bb42
+560-564 e03fbe4bdb0ce235 2484d12a07617823
+565-569 0b1e0cc286d8e2db 29a97162543d8b50
+570-574 0eca795339181b14 9129c77c05f88fc1
+575-579 5ca964a495b608c9 dccc25c013660626
+580-584 c526bfcdbdb19c13 2c2c062689744a81
+585-589 c0f55f7b738667c8 cf5507fcd05366b8
+590-594 9a57465f007322f6 fe36de2dc975e97d
+595-599 60d49df8b1a1ed60 d2a9ec7caa9fafd6
+600-604 eb8f971fa2c853f1 4c047a0a600ee68c
+605-609 b9a0d832ab3703a4 33a266c3126b7268
+610-614 b7cd2826e9ed4bad 1dae82316d44d372
+615-619 dd6ea62b42964c5d efea9c54f9b7df69
+620-624 f8cafac82b3a2938 cc34678cbba8cbc4
+625-629 71dda2f6b4fcf3ad 35647b7151bbe854
+630-634 c0625fb844d5bd9c b51049d5a507e712
+635-639 89ce072ed93bd8b3 97c29483a27d20fb
+640-644 9a060a7b22a5ea63 3487fe4c2cec2c2a
+645-649 4f18a0402cf96703 3a62197bc682135c
+650-654 799d0d7818b8ecdd 8a9bfc4768db7bb8
+655-659 0f78bdef454a269d 8926ce36aa150d51
+660-664 f1cd906360c54cfa e85fffa3833a1371
+665-669 a5564a8ea2270906 b483caa3c99f50cb
+670-674 c196359f0ba0e6c1 b7bf3747d5fbf62b
+675-679 e0011b91b2f33aef 83b29f9e3c6941d3
+680-684 54159021ceb1a6a4 aee86cac7c126b10
+685-689 8121cfcade405227 420a3a319d2d57be
+690-694 841fe56913ede31a 9a4bf80f37fc9789
+695-699 968e63891e83acad fa37072b6e4e7450
+700-704 b53560cda70aadb8 bbaa6aa02e40ab6a
+705-709 83bece44cdd8d964 8ce390034469015e
+710-714 0096b81bcf606d08 a05f22cc7d6e9e1c
+715-719 afbe3acb8a936112 6c033a3cb4d2f9d3
+720-724 e212d53b068c9367 aadfdb29a8bcc99e
+725-729 b532d08326d3a1c1 091c5a374fc1377c
+730-734 fb89f0ab21e41184 491db122776600fc
+735-739 7f21245b19048f6d 2138cf6efd2f4588
+740-744 f5afc189901e25a7 e2e144556544337d
+745-749 0d669a0c40d9ec06 b97784b37ffa6263
+750-754 a2da5259aa3dc6bb ea15a0ee1b498b25
+755-759 d5fed3964610e80b f12a5d7653e27e6f
+760-764 eb74f4ed1d526a82 959dc5c757d52c8d
+765-769 446fbe655c39474a 049f159ef1f568d2
+770-774 3ed2f6336ae1d8b4 dd07433b2861886f
+775-779 0c443aac3fea26b0 24950068997cf758
+780-784 fff5de443b6d9df3 aea7405cafc4c5b7
+785-789 95fa315efc5c1f38 d09cb03d8bcaa1c0
+790-794 f7e4a7ca516970fa af6b032b8a30c9e4
+795-799 c26cb82b9d6af0ae 7fe79ef93103d105
+800-804 a278c8bb8be83819 6388df7540367932
+805-809 69d4f412ccd64cea 37cd7bcf3db57250
+810-814 76e6c0857a866513 e8dce9cbdaf9c660
+815-819 4bf0e13795a7faff 73bb5b3877877d35
+820-824 e661808004ced5e0 b5ddf35a824246bf
+825-829 d25f4793e042db64 d0a1e91738e2ec76
+830-834 e3d03e8ef8b1295d ece90eb006469f2c
+835-839 c00270de24a49e16 cf44816b0061e2ae
+840-844 865292082469a123 114514f32ba03093
+845-849 0a2f4f3e161db2bd c8bdad3967dcbcc3
+850-854 d5b245a2d4762809 732ca28e3d4297b0
+855-859 d7a4147ec83ccdf3 6aa69904a771b1be
+860-864 e0dfd4ee3b9b9115 bbfe2b44c90238ee
+865-869 3e913b7411e46c27 4306522989316626
+870-874 fdd6c8ad6bcba04e bad87cd34faa9fff
+875-879 daeef0f506171b5e 68cb56df14f44059
+880-884 a19a9111ca539727 78f4d9f2f0dd1801
+885-889 4964fd890aa0994b 3c93b27e52621833
+890-894 50069923d0e0ff0c a3c5804a9da388fc
+895-899 45a6202dc931bd35 ddc86e63ebde42c6
+900-904 3e4b61b6dfc3922b 83e3365600063210
+905-909 c91a83be7091fe1c 457ee81515713cc2
+910-914 8418b5e59791bc82 9306a002b60831fd
+915-919 5a056b11f328365b e87365882f0beeba
+920-924 34137d01c0b33616 25eb24321c54f780
+925-929 2bfe9d227e06cc61 36a2a2804e7199c0
+930-934 44414e0793c1989b b5dddbf9c9184d72
+935-939 2388bd7d5fdcaea3 599467bdcd4949b8
+940-944 9526b9c0ef958cfb 0bb7947f46f77e87
+945-949 c82059b88e2418d3 0b69206a8bdd92aa
+950-954 2af969418fd97751 0d8028b27ca53895
+955-959 cb5af4f26e818f69 35a711c543af79eb
+960-964 703724ea36030a9a fcdcb792020ab11d
+965-969 a5f349b716e2c17b accc4d3b52b55f17
+970-974 2c51d78e4d21f34a d97e1ecca67f167c
+975-979 02fe70fe43798656 1382eae2605e3b7d
+980-984 2dfdeb1d730d437f a0d94833e09775ea
+985-989 c0ce894b61174b60 732049e217f02ccb
+990-994 a4c96d873de9cde3 eb3b3c6230974260
+995-999 3b004642590efb27 d7ebad60ceec36e0
+1000-1004 1e11b2228a87e2cd 0727318c8714df42
+1005-1009 863857d4840e1755 355fdf9286f05798
+1010-1014 f32eb531a0227019 b9b5a3a04eecda96
+1015-1019 5df98b07a3f6fa22 de4ce5e33e0d1833
+1020-1024 7788148d1188683a 489900f10b3cb72c
+1025-1029 2a42ee2c74e792bf 434d0d92660eb334
+1030-1034 8615096392ecaf53 e781914100066bf6
+1035-1039 c24e3d3e2b5b3a7c eacecb30a4ac9cb7
+1040-1044 7940b56d09ea5bc3 2eb630023ef89bd6
+1045-1049 5be1c725b126b43d 36356c5c4b00e9bd
+1050-1054 baf53597dd1ee0f7 bc2a9fe2197ec4b7
+1055-1059 89da0c30103093c2 9cc3743396a581ac
+1060-1064 088462cc1aad7bca 48a9e7854dbc4dc5
+1065-1069 b3d2b22d55140c4d 5565fb9078c47532
+1070-1074 744a72bd25aa8f8a 068bb08e149f4464
+1075-1079 b865bc68064f3bf3 fef6ee44b83a0b99
+1080-1084 22a031b03ca02431 1e2593e8af06cfbd
+1085-1089 7fc382e8a1cfb392 9b87d1e77b5a7538
+1090-1094 09636a2b50a36582 319c81aa9068c32e
+1095-1099 848d4cb5147266ea abb36a2405d57084
+1100-1104 717a47c102e234ea 5579c18523a5832c
+1105-1109 b86d27ca80e7477d 51c62ff51c8af2e4
+1110-1114 e75533c276ca26b6 d7616af8e73b78de
+1115-1119 0967dca7a3b7f0db e6760b2ab436b96a
+1120-1124 2b3d27a962eeecaa 6bbca72310c14bb7
+1125-1129 4c0f197f16fdc203 ae282d0c8193cd22
+1130-1134 b8c883083e2354b4 6b874f3cfe5a8fc9
+1135-1139 052826a8ca213062 6bda0887d04230ba
+1140-1144 643000c4068a73dc 3fb8ade336a5c7d6
+1145-1149 a20dbdc962bf496d 480ad4ea25e080c5
+1150-1154 a8ff0a76fb490212 64986e06854ec675
+1155-1159 265ef1e7e4d619b0 e1c407246e3db283
+1160-1164 fd031848e1246ce5 be60639cbdf765b0
+1165-1169 46392bbe676ae180 3247630f4715bab6
+1170-1174 9ed9aa2666accf82 8ce01f5933288267
+1175-1179 42ba5427c32b6a50 f74c503679d95c63
+1180-1184 ec53e605cb4007b0 b540d1ce2616d726
+1185-1189 a9bca1c3f2f28d14 730d26cf221de4a6
+1190-1194 99c3c937889a535d 6c0326f584d4cc47
+1195-1199 516dc4d7731053d5 b805922b219f6337
+1200-1204 615780e5c51bd99d 1283e8e570bda37e
+1205-1209 2ba50ff0fb6738c8 61e7624495287ee6
+1210-1214 945fc79f04d19aaa 00119cb67fa3ecd6
+1215-1219 0f1fd24ee8266b2f e7b94f1e48147a90
+1220-1224 d00cf5cc9e90ba28 231dd0874c6755f5
+1225-1229 d297953e40966981 df2a03c51d6c3fdc
+1230-1234 2b75e34b10cb22be 670c47a3cce7618c
+1235-1239 299fb21e399aef5d 821efaa24f2b62b9
+1240-1244 c0ae0ef2eacb1d20 3edd06583588d801
+1245-1249 8cece7e0363ae620 512797b949f264fd
+1250-1254 124798b1ca2185da 57a14aa19e34660c
+1255-1259 32bb20f47d09e0fd f88d92dd1bcada2c
+1260-1264 a90cc7dbee7863ee a4f79bdb0ab09720
+1265-1269 9601afdc614c3378 4611ad1016b5130b
+1270-1274 e4027cab6820ab9c 6ce85e6ae2c08b17
+1275-1279 52f35f77c626c7a9 c1826baa46eb4b3e
+1280-1284 54db489225a8498f 9ced5547bd54c1a9
+1285-1289 503688b417683963 5b7faaa1a0713bfd
+1290-1294 0ec750caf91a885a b95d052756067610
+1295-1299 57b68256c467948e 48c3046250deef23
+1300-1304 f69a72cf286243a6 7a99eefa76f2470d
+1305-1309 5427028ca0307488 b63f19108a0245c6
+1310-1314 687bd0b688c5245a 928623220e0baeef
+1315-1319 a3c063f7319cc243 d45a129e78008a8e
+1320-1324 f71d4ea9b4e443ea 48b0bff72e8cc16c
+1325-1329 36b1c933b4769bef 66255eb274356b46
+1330-1334 12fec017822c9408 bb5cb44c0018f1f2
+1335-1339 f2554c70f5b6c871 4f78edd9e58c2c92
+1340-1344 eb3f9210aee55fa0 2421aa9dc78a887f
+1345-1349 2227034cb8224e92 1bf5697c4e214647
+1350-1354 d1c3cc3f3053abef 08fc13aa0d72b77d
+1355-1359 837b255beca431d9 ea6849feb7fcc751
+1360-1364 5a0320d1b8d0c441 41b409e99d3d6407
+1365-1369 bc3c4bdab54f5895 8e01f8a9337c54eb
+1370-1374 5b91bc73f002c848 5ce79828e38e3251
+1375-1379 b942d2d527e313bb f8bc89701ecdb22f
+1380-1384 ba26e589d1e33e42 c16656410a682f46
+1385-1389 814d598e06f65107 4e0785c55962a338
+1390-1394 b086f62b2050c60c 86d8cf73e159021f
+1395-1399 b26420e6d29fdb12 4e4a263e2423589f
+1400-1404 f9fe3b626f1686b5 7e7fb731f6c82704
+1405-1409 4e57a3753006f235 bce4cb677d18c7a8
+1410-1414 115e306882ded7e8 71313b54a3fa6c86
+1415-1419 434caf3c3910b014 bf4169615aefe9c5
+1420-1424 05902fd403f63f45 0944208a7b10e1f2
+1425-1429 8ab91ea0295bfb52 a24c343175848041
+1430-1434 3484e596f0cec9e4 4888e0644305f3e7
+1435-1439 13c16ded50903e22 c3274156d1ccc915
+1440-1444 31e0740b70544201 2c7a5fe6c18d9400
+1445-1449 8be55a7cd8438be9 67b24598732fa3fe
+1450-1454 e9d1c354908dc7d5 029a1152a0c94435
+1455-1459 c8229a6a88eec0ac 8768bc139f54bb69
+1460-1464 ce73f815cae74496 de3ace466142c7e6
+1465-1469 1695babf780735fd cd1492eabdb7ef4a
+1470-1474 7285c5cca58b9f85 9ebcb3c0e2ee91ad
+1475-1479 826e8660179fe16a 83cc3b42bc69dce7
+1480-1484 8ecf1216c69ed810 69f317816faa2b4b
+1485-1489 8a3905febae9ece0 03ac60bf7554ad65
+1490-1494 2f1c19a2427058be 4836d39291d5d3c1
+1495-1499 952ea603e646e84a 077b55523590479c
diff --git a/crates/socket-patch-core/tests/equivalence/yarn_classic_rewrite.golden b/crates/socket-patch-core/tests/equivalence/yarn_classic_rewrite.golden
new file mode 100644
index 00000000..8205b61d
--- /dev/null
+++ b/crates/socket-patch-core/tests/equivalence/yarn_classic_rewrite.golden
@@ -0,0 +1,202 @@
+# One seeded yarn.lock (v1) + overrides.
+# <case> <input digest> <output digest>
+0-1 1190d243c3c9a00e e8dc1c09e202ea26
+2-3 ba98bffaf480d822 3869a61f85e0e1b8
+4-5 d80b15a695b0937f 7d6b98165170e620
+6-7 8e178c2cb5e2cb14 1fb27d735de4cbbe
+8-9 e43fd997c62b9e42 7ad679dee1ec8d49
+10-11 edc61bca32cfc9f9 53c9924e9d031970
+12-13 175b8cae66ba4ad3 fd167be2cc4baa0f
+14-15 ef91b060692096d2 adb4cb06017ef9fc
+16-17 6f0831d9cf265f98 0ce72eed267ebc06
+18-19 751e330a33334e51 612115cd88da46da
+20-21 7bbcf7e2f9c9c88e ea5a9b414bbbb8bf
+22-23 5e8538d25f0c3d2f b94672fd7806ae91
+24-25 1b52d945841c8298 fe67293582497cf7
+26-27 85871c4064b2c3e3 1de8cff6d3df0db6
+28-29 352dff2ab375c6a3 b99cfc831d7ee07a
+30-31 edc5d9ff68527344 99f9347e2bc2b412
+32-33 ce2c969dad5ecb04 e72cd966fddda02c
+34-35 de24932e90101396 2a589c4fbeb4d40d
+36-37 33a2e2444574429e 652c5bf017c28bdb
+38-39 c57c275705d2a2a7 a5198a89e6282db9
+40-41 b5152432f665aeb8 53da7c91b1a67df9
+42-43 eef444c636c55e21 7080fec0ca9bc4ad
+44-45 5cd2da04fa3dac81 35ee0e3337c41a31
+46-47 9dec65795e922fa4 adbd137d774d1f2b
+48-49 1d9d1d776f1f7250 e56094c868ceb733
+50-51 2d362a1b1674d398 e97b13ca8bbc60cb
+52-53 be73a4ad6b8e5aee 284a1324e548f2ab
+54-55 ba9646f86c624aaf ea7cf5752cc054aa
+56-57 3e96a5f86e6af680 e6ac8694ea759078
+58-59 8dcd4ce057935cc3 9e260b7c24d783df
+60-61 6333a5219075a09d 9a223786aae324f4
+62-63 f84be846c0d54615 fce13931283bad56
+64-65 e6f8ad9ceedd2e4c def49b7bcdf8b86a
+66-67 c4e236ff81ac9a8d 90885de7399544af
+68-69 dadc04add7c7c9e0 60507aa4a3c8d08e
+70-71 a5711b822e995dfd 758907b08d749c04
+72-73 c976cf46cd6b6f85 7ac909f471bf7bf9
+74-75 18b9eec756bb47e3 9f12e86f7660befd
+76-77 54ce49f58715780c 0479eadf8d02cb89
+78-79 e8288b75119434a1 859bc3d7150208fd
+80-81 94ff16825564c958 9a9162acc0d9a57b
+82-83 bb940199daee8606 aaa4b0419b62b0ad
+84-85 2ff605c25684cc72 fe0e6827fc7705da
+86-87 157e638a5bba3a3c 1c649f5a07123fbf
+88-89 f5d52d058b7378f8 4852e6e124420ac6
+90-91 c756f82012e55c10 cb1978d1fa63e951
+92-93 7d2b44d28176a529 80b8d9bc47b04a3a
+94-95 174fb249b68ff4ad df88da0ccd6e0553
+96-97 5dbedd5a89add533 46f9dd9d8bbcd3fc
+98-99 3078474883707efc 252802dcfc97d3ae
+100-101 85bdf6d5adbbf56d 5777ad61dbb23d66
+102-103 baa7ffe0727796d9 9f845d084e712e91
+104-105 292106ad225e1037 8a8f51dd658ed10c
+106-107 d08889126f5fe2a3 9d4aadc6ba4e7e2e
+108-109 d7c8957c4b25e62a fc7752feb4e46245
+110-111 3a71c785f0a34d60 19ef39a099202dc3
+112-113 cd9963e800c7f246 53a797787215d9d4
+114-115 e2ec8f5f04db713d 2554ace2dcc93b15
+116-117 9028fc942e7550c3 01efc52f1d4ee70b
+118-119 8ebdd92eeeef6f36 da62a103796737e9
+120-121 92a4e961365a2f97 4cd92c06d45fef35
+122-123 5482e22a9366a649 ed8406bf03a1046b
+124-125 1791bc6454f83fd8 93a3bb7b27cf2ddd
+126-127 3fc012d899a28130 e24509e78a17553b
+128-129 6d3b3fc00498115f c9a345287353c637
+130-131 27f5cff8b7be114c 5e871bed9b4e9c98
+132-133 caeabae83aeb4228 3d2716a58b333b48
+134-135 a376820bfb6ab010 89e0f11f493042c1
+136-137 cfd0efc3c3db5202 a4274a2d1fad5840
+138-139 c587b2ef7d70c2aa 9d297739c36b0b80
+140-141 e09bae32f9966aca 15261be202c167a0
+142-143 60ce0d4f6fa6794b 49565331a76e0c68
+144-145 410e854b4e2efd89 1adfef48bc413bd8
+146-147 fd493568c3ac3652 47ac1f33a38092c0
+148-149 deb618ecb555fd73 61b46c8c1debb3fe
+150-151 d6f51b46647d1d15 fdd9261e4cd099b2
+152-153 d0f497c3393351fc cdf20344f77fb72d
+154-155 a5e2964501d49184 b0e8dfb0419b9ae3
+156-157 342978fadea628c9 e041f45858df4f0a
+158-159 c068738f7de05532 48b7cbdae908784e
+160-161 82f66cf7979cc1e3 aa028597bee05f68
+162-163 79bb0f03807f6b44 295c7736b5336291
+164-165 22981a3f179cfc9a 97689d6bbf14955e
+166-167 0aa1b383329a8627 2f6e344ae5cdbc6c
+168-169 3f162034aef1dee7 fa02bb7098abd57d
+170-171 d270a58f50af5bc2 7f0255cf04696296
+172-173 3de38dd2c44458ee 6e10d8da0eb9599f
+174-175 a1224e468a2a3299 bd55e6c08af6d476
+176-177 2907e9afcb20dcd1 ad46822096f8e346
+178-179 33c22e07e587c29c e555bf01c4758766
+180-181 e6f1f6e30a93629b 2c5dbad8dbee8761
+182-183 aaa04fba9f217938 8618a7b9108deb7d
+184-185 f74901f680aa0406 0e06140ab6510bdf
+186-187 57f8170e481abfa8 7710e41cc383d389
+188-189 2e20a5ea93aa89f6 c77c404f92ce6c4b
+190-191 3f828aa93ae947b7 0d053b599bb56554
+192-193 dd2bebf464535865 0717e0198c5e0e5e
+194-195 5d92b24539551fa0 bdec007fb99201fe
+196-197 507866064aec4111 49b056e43d6bdd14
+198-199 17c0359ab8b2f84c afa62f7958d04aa1
+200-201 53f4743f0fae2db0 4d5e3ed6a85b5ab3
+202-203 6640c39887079e0f 61cf7d4629179860
+204-205 c08391b643d19e32 1b07d17000ef2731
+206-207 6b805f5639c7107c 7f20a40bc4e3b245
+208-209 5c5bfc2ad062e253 e86681d615a21831
+210-211 e041d12d9e34a7e4 6e07ace24940e58a
+212-213 8162e7cdf8275290 eabc32e6e90af593
+214-215 1de934fb8b35e04a 4464d026070c1392
+216-217 410197c9dfc7c2f2 182d9bad1a3a1fcd
+218-219 d739a2f19922bb59 a4bd3eb4c4e69e18
+220-221 82e62cba865edff5 38d8f49d3fbf76d3
+222-223 87879277b6d6b27a 6e6823fdfe1b8664
+224-225 926079079c0ecb3f 5caeaeeb19f12ee2
+226-227 d7a6db3f2ad44ad0 b9491474b79285e1
+228-229 872bca09ed8ba084 90f67ba67e384abd
+230-231 7d7bf22a0e9cb805 52b4c6b05ea94696
+232-233 be20fb9e96cb7c53 1f14c14eefd61f83
+234-235 acd2ff104a2ac96f 1223921bfe62a2b8
+236-237 196b2da9f9488cde aaa4a32af1f0f003
+238-239 afeb25d31570da3e 2de273da1e9fd774
+240-241 ca7bab4e4dc37bdf 8bf52d2859163808
+242-243 0004a191c10ab26d ef342c38d53e55a9
+244-245 d29b7cf3240f3a55 0d7e27edbbb990d1
+246-247 756953a9e086f2d5 7f327d597a8763f8
+248-249 1f0d7cd899a8ef8c d5f144cf6a62f93e
+250-251 21c745b4215a4f2b fdcc68e1c5401a2f
+252-253 6eb261d8c1405b0f 8e3682cf9479eb22
+254-255 1ddd81908edf76f1 63f4dad63dd645d7
+256-257 d9bbc8bfea3bad46 34140dbf8695bcbf
+258-259 25a4e018fbb1645a 39bf6b563208c8c4
+260-261 62e250bc92ffe414 edef78c7b7eaedf5
+262-263 e784b7716f83965a b390cf8ddcc0e2bc
+264-265 e458082ea4c109ad 9cc761805a766424
+266-267 cac892ea348b5ecc 6afe645267922bb7
+268-269 85dd46c8a49a55ef aad62d95630c7d9e
+270-271 506bc333993d7c90 170bb06e956b20aa
+272-273 e97bb5a51749b02b ccef1212c7a4008d
+274-275 292826999ded1d5e 7d3e52ba7bad54cd
+276-277 d90823b57af9eda7 b9acb73685495232
+278-279 ad19b90a41936767 f7e03678929d10b9
+280-281 edafe6d07499b8e4 398bd84b1ca365cb
+282-283 50064db2df0bd060 b8f3b508121835bd
+284-285 c8ee70bf288a3dcd cb1a580793aa0e46
+286-287 04dfa6be66fb6d83 8861a26b49603cef
+288-289 514eb6ba7feedc57 b042339412932249
+290-291 e8eaef431b35e2b3 1f289c9ce2cfacd2
+292-293 eb6dffaf52bd3be4 da8a5b2821d9cc30
+294-295 d904ba055623d9f8 c192f9eab5afc324
+296-297 1f2c741d7d420ce6 47f1b5477ce206b9
+298-299 c03582ccddb96cee 09276f6ba92aa176
+300-301 748a964dddc5b4dd 3fdc694c82dfe2cb
+302-303 42d640238fbf8361 3dfa9851b74e68f4
+304-305 228ec73b8d5ae872 babbaea8499f2201
+306-307 1655281cb4d8c9ce b0341ed0bc387c7a
+308-309 dd3eb82b3e77ec6f 4bb9115ee0710b4d
+310-311 f811e22101402c2c df1b46fdcaa0ab81
+312-313 e44293fa25db1eaa 9093779bcb7d694e
+314-315 1e14263df9269f95 42c43eadd5448d5e
+316-317 686729154bf30a49 3634962bd2e8c100
+318-319 77a4f2ba9a0cf3df 26c5a8b2f0b809df
+320-321 0330a69284ddd224 6744a6189354a042
+322-323 441245a0d0613419 e1dcf138b89effe3
+324-325 27bfb24e0adaca59 3f0d70a5a920e61d
+326-327 dfbfe9addb1ce656 d04a411ef047cac5
+328-329 8d28a268abb3b404 335e7a320f7f4e04
+330-331 48f7939e56400f0f 78144de0c0ce70a0
+332-333 581fc9a0c31802f0 9c86402aa689b375
+334-335 b0350490b1ee0793 90b01dba37cd6e67
+336-337 421a82f155863960 d3a8a82c2c57ed78
+338-339 e1a31b3355f246bf 3859f4780498b2a7
+340-341 4e99c984d6efa99b 35c48ff807ba1e57
+342-343 93cd9abc548829ff 6acade12c4e1dbda
+344-345 4940857b43e7fce5 d2d578b99a6ee9eb
+346-347 089a20d53499ef50 fc16c04ca675aa6b
+348-349 d6cda592cf180789 dba43a02d257d9c3
+350-351 88cf16f5d1148288 f30e1b86ff002b10
+352-353 13fcaa8b580b87c8 bf6f349d67fbfb90
+354-355 0c50455095172a40 fc276d10f198f125
+356-357 4b370e3af0e4f194 14968653c3426a35
+358-359 7f1f14a0f8535a2f 2a1aad673965dcbc
+360-361 a34fbcd774798fac 8f9a63a647a536c1
+362-363 e8deea23e015fbce 897bd9c60815a5b0
+364-365 118298c4bd6929b9 4b3baf5be3e9ca86
+366-367 a88c88ad0662add9 6da67d5894ca93e0
+368-369 7e222e2654d0869d 067e679412065805
+370-371 192d435734b4b17f af6e29e5d26f2598
+372-373 8b9b5c3c4a391ee0 1278c723844e9009
+374-375 30c7c3e962b54688 81c8538c61256b1a
+376-377 58fecebbcdbd5a7e f639404251e3e17e
+378-379 8347ff535fcf69f8 9b870e9074ecac7f
+380-381 8c4209360acca12c 0e7873e2e3061475
+382-383 8c93f53cc0d92461 253c644b42808762
+384-385 19edb8803a2e153b e20810e72dbe25da
+386-387 c70af0e28589e6cf e7a9a9e3d5c53358
+388-389 5602e24e0e9c95ae 81cfcfddccb90d15
+390-391 defead10329f9dda 99e8ae5f267a94f2
+392-393 24b162373746f101 674f91f3d20953e0
+394-395 449abdb26f8b082e b3b9e49e34865327
+396-397 bf06982a6266b8d1 cb51ba17099eac24
+398-399 4a73ec47d01832f8 4681f54698a20616
diff --git a/docs/design/nuget-vendoring-research/code-map.md b/docs/design/nuget-vendoring-research/code-map.md
index c96fd65c..3ef66df0 100644
--- a/docs/design/nuget-vendoring-research/code-map.md
+++ b/docs/design/nuget-vendoring-research/code-map.md
@@ -192,7 +192,7 @@ Run everything from `/home/user/socket-patch`.
 | `docker_e2e_nuget.rs` (apply chain, `:570`, `:607`) | Docker image `socket-patch-test-nuget:latest` | `#![cfg(feature="docker-e2e")]`; soft-skips if the image is missing (`:482`); `cargo test -p socket-patch-cli --features docker-e2e --test docker_e2e_nuget` |
 | `docker_e2e_vendor_nuget.rs` (`:472`: 3-stage vendor → cold offline `--locked-mode` restore → RED/TAMPER(NU1403) → idempotence and revert) | Docker (SDK 8.0) | `--features docker-e2e --test docker_e2e_vendor_nuget` |
 | `setup_matrix_nuget.rs` | host guard runs; `dotnet()` is `#[ignore]` (baseline gap) | `--features setup-e2e --test setup_matrix_nuget` |
-| Other hermetic CLI tests (`in_process_get_hosted_ecosystems.rs:532`, `in_process_scan.rs:1374`, `in_process_rollback_all_ecosystems.rs:552`, `e2e_safety_advisories.rs:412-671`, `ecosystem_dispatch_e2e.rs:310,986`, `vendor_ecosystem_fixtures/mod.rs:748`, `e2e_vex_vendor.rs`, `e2e_vendored_production.rs`) | nothing (production suites are canaries) | normal `cargo test -p socket-patch-cli --test <name>` |
+| Other hermetic CLI tests (`in_process_get_hosted_ecosystems.rs:532`, `in_process_scan.rs:1374`, `in_process_rollback_all_ecosystems.rs:552`, `apply/e2e_safety_advisories.rs`, `ecosystem_dispatch_e2e.rs:310,986`, `vendor_ecosystem_fixtures/mod.rs:748`, `e2e_vex_vendor.rs`, `e2e_vendored_production.rs`) | nothing (production suites are canaries) | normal `cargo test -p socket-patch-cli --test <name>` |
 
 **Docker images:** build `tests/docker/Dockerfile.base` tagged `socket-patch-test-base:latest`, then `tests/docker/Dockerfile.nuget` (FROM `mcr.microsoft.com/dotnet/sdk:8.0`, copies the binary from base) tagged `socket-patch-test-nuget:latest`.
 
diff --git a/docs/design/repacking-to-depscan.md b/docs/design/repacking-to-depscan.md
index fc516a54..a8f5acc7 100644
--- a/docs/design/repacking-to-depscan.md
+++ b/docs/design/repacking-to-depscan.md
@@ -757,7 +757,7 @@ land, because WS5 rewrites vendor.rs by ±318 lines.
 | vendor.rs pristine ladder: `fetch_pristine_package`, `missing_local_rung`, `MissingRung::Fetch` | `commands/vendor.rs` | ~147 | — |
 | `VendorSource::Build` outside maven/nuget, args plumbing | `vendor/mod.rs`, `args.rs` | ~30 | — |
 | `berry_zip_url` plumbing (F33; re-measure on #280, which adds another `berry_zip_url: None` site at upstream/bun_lockb.rs:154) | redirect/hosted | ~3 | 41 |
-| Pristine fetch-order e2e | `tests/vendor_pristine_fetch_order_e2e.rs` | — | 228 |
+| Pristine fetch-order e2e | `tests/vendor/vendor_pristine_fetch_order_e2e.rs` | — | 228 |
 | **Total (CLI)** | | **~2,050** | **~1,260** |
 
 Rewritten, not deleted or counted:
diff --git a/docs/testing/bun-compatibility.md b/docs/testing/bun-compatibility.md
index 53ad0feb..90b30702 100644
--- a/docs/testing/bun-compatibility.md
+++ b/docs/testing/bun-compatibility.md
@@ -23,12 +23,12 @@ does not list as lagging — the cases authored Rust-first here lag until
 `bun.ts` is ported, see [depscan TS parity](#depscan-ts-parity); refusal
 fixtures pin their warning code through `expected-warnings.json`) and by
 hermetic CLI suites that
-need no Bun binary (`tests/in_process_vendor_bun.rs`,
+need no Bun binary (`tests/vendor/in_process_vendor_bun.rs`,
 `tests/in_process_vendor_bun_takeover.rs`, the bun cases of
 `tests/in_process_redirect.rs`, `tests/covgap_commands_scan_hosted.rs`,
 `tests/covgap_commands_scan_mod.rs`, `tests/covgap_commands_rollback.rs`,
-`tests/scan_vendor_e2e.rs`, `tests/get_modes_e2e.rs`,
-`tests/repair_vendor_flavors_e2e.rs`). The
+`tests/scan_vendor_e2e.rs`, `tests/get/get_modes_e2e.rs`,
+`tests/repair/repair_vendor_flavors_e2e.rs`). The
 [machine contract](../../crates/socket-patch-cli/CLI_CONTRACT.md) is the
 authority on envelopes and codes; this page is the measured matrix behind it.
 See the [ecosystem matrix](../ecosystems.md#mode--ecosystem-matrix) for the
@@ -466,14 +466,14 @@ table above.
 | Text lock 0 / 1 / 2 rewritten and installed, both modes | 1.1.39–1.4.2 | `e2e_redirect_bun_build` + `e2e_vendor_bun_build` on 1.4.2 (3 OS), 1.1.45 and 1.2.23 (Linux); the fixture asserts the lock version matches the era table, the v1-on-1.4 leg proves a committed v1 lock keeps installing | goldens `lock-v0`, `basic` (v1), `lock-v2`; `bun_lock.rs`, `lock_inventory/bun.rs` |
 | Native binary formats 1 / 2 / 3: inventory, hosted, vendored, repair, takeovers, rollback | `direct`, `legacy-lockb`, conversion shapes; dedicated `backtest-bun-lockb.py` | `e2e_bun_lockb` across writer / reader revisions | `bun_lockb.rs` and committed real binary fixtures; native CLI tests |
 | Version-0 workspace hosted refusal + remedy | `text-workspace` (1.1.39–1.1.45) | — | golden `lock-v0-workspace-refusal` (+ `expected-warnings.json`), `redirect/mod.rs` unit tests |
-| Pre-v2 workspace vendored refusal (policy) + remedy; version 2 supported incl. nested | v1: 1.2.0–1.3.14 `workspace*`; v0: `text-workspace`; v2: 1.4.x | `e2e_vendor_bun_build` scoped leg (deps + bin meta survive) | `bun_lock.rs` (`legacy_workspace_tarballs_refuse_before_writes`, in-sync / rebuild exemptions), `in_process_vendor_bun`, `repair_vendor_flavors_e2e` over {0, 1, 2} × workspace shapes |
+| Pre-v2 workspace vendored refusal (policy) + remedy; version 2 supported incl. nested | v1: 1.2.0–1.3.14 `workspace*`; v0: `text-workspace`; v2: 1.4.x | `e2e_vendor_bun_build` scoped leg (deps + bin meta survive) | `bun_lock.rs` (`legacy_workspace_tarballs_refuse_before_writes`, in-sync / rebuild exemptions), `vendor::in_process_vendor_bun`, `repair::repair_vendor_flavors_e2e` over {0, 1, 2} × workspace shapes |
 | Digest boundary 1.3.10 (registry tuples 1.2.0) | 1.3.9 vs 1.3.10 cells, `registryDigestEnforced` | tampered twins in both suites, pinned from both sides | — |
-| Digest-less re-saves below 1.3.10 recognised, healed and unwound (both modes, takeovers, scoped unwinds, `repair`) | `already-vendored-workspace` on 1.2.0–1.3.9 (`digestDroppedOnResave`; `resaveKeepsDigest` from 1.3.10) | `bun_redirect_survives_a_digest_dropping_lock_resave`, `bun_vendor_survives_a_digest_dropping_lock_resave` (real `file:`-dep re-save; the era's spelling asserted from both sides) | goldens `digestless-hosted-already-wired`, `digestless-hosted-stale-url-repin`; `bun_lock_text.rs` (`same_wiring_modulo_integrity`), `redirect/mod.rs`, `replay.rs`, `takeover.rs`, `bun_lock.rs` unit tests; `in_process_redirect`, `in_process_vendor_bun`, `in_process_vendor_bun_takeover` |
+| Digest-less re-saves below 1.3.10 recognised, healed and unwound (both modes, takeovers, scoped unwinds, `repair`) | `already-vendored-workspace` on 1.2.0–1.3.9 (`digestDroppedOnResave`; `resaveKeepsDigest` from 1.3.10) | `bun_redirect_survives_a_digest_dropping_lock_resave`, `bun_vendor_survives_a_digest_dropping_lock_resave` (real `file:`-dep re-save; the era's spelling asserted from both sides) | goldens `digestless-hosted-already-wired`, `digestless-hosted-stale-url-repin`; `bun_lock_text.rs` (`same_wiring_modulo_integrity`), `redirect/mod.rs`, `replay.rs`, `takeover.rs`, `bun_lock.rs` unit tests; `in_process_redirect`, `vendor::in_process_vendor_bun`, `in_process_vendor_bun_takeover` |
 | Mode conversion both directions; scoped `rollback` / `remove` | `hosted-then-vendored`, `vendored-then-hosted` | `mode_migration_bun` (1.4.2 × 3 OS, 1.3.14) | `in_process_vendor_bun_takeover`, `takeover.rs`, `covgap_commands_rollback` |
 | CRLF lockfiles preserved (hosted line, vendored, rollback) | `crlf-lock` | — | golden `lock-v2-crlf`, `bun_lock.rs` |
 | Bun 0.8.1 / 1.0.0 peer / transitive upstream limitation | recorded per cell; no selected target is installed, exit 0 and lock unchanged | — | — |
 | Manifest-less VEX: attested `(redirected)` / `(vendored)` from the lock with no `.socket/manifest.json` (ledgers kept, then deleted too), `--offline` → `record_unavailable`, reverted lock → not attested (also `--no-verify`), embedded `apply --vex` / `vendor --vex` | every supported cell after its installs (`vex*` checks; public patch API) | `vex_e2e_common/bun.rs` step at the end of every `e2e_redirect_bun_build` / `e2e_vendor_bun_build` / `mode_migration_bun` / `e2e_bun_lockb` flow (fresh checkout + real frozen install, wiremock API with a zero-request oracle offline); tampered install / artifact → `hash_mismatch` / `vendor_hash_mismatch`; stale takeover manifest → the wired uuid wins; production `bun_*_install_proof` legs | `e2e_vex_lockfile::bun` (text v0/1/2 + `bun.lockb` × both modes: spoofed hosts, record mismatch, pristine / tampered / alias installs, stale lockb); `in_process_vendor_bun*` lockfile-only twins |
-| Pre-download preflight envelopes, `--silent`, `--dry-run` `would_refuse`, manifest-free footprint | `get-uuid` / `get-search` / `workspace-get-uuid` / `workspace-get-search` refusals (exit codes, `downloaded == 0`) | — | `in_process_vendor_bun` (exact uuid-path envelope), `scan_vendor_e2e`, `get_modes_e2e`, `vendor_flow.rs` |
+| Pre-download preflight envelopes, `--silent`, `--dry-run` `would_refuse`, manifest-free footprint | `get-uuid` / `get-search` / `workspace-get-uuid` / `workspace-get-search` refusals (exit codes, `downloaded == 0`) | — | `vendor::in_process_vendor_bun` (exact uuid-path envelope), `scan_vendor_e2e`, `get::get_modes_e2e`, `vendor_flow.rs` |
 
 Not measured: a `--cwd <workspace member>` run (the member holds no
 `bun.lock`, so the preflight passes and the engine refuses
diff --git a/docs/testing/vlt-compatibility.md b/docs/testing/vlt-compatibility.md
index c5b46d97..b61b7aa2 100644
--- a/docs/testing/vlt-compatibility.md
+++ b/docs/testing/vlt-compatibility.md
@@ -40,7 +40,7 @@ socket-patch alike.
 | Layer | Where | What it proves |
 |---|---|---|
 | Unit and golden | `socket-patch-core` lib tests; `tests/redirect_golden.rs` (`npm/vlt/*`, shared with depscan's TS rewriter), `tests/redirect_golden_reverse_replay.rs`, `tests/vlt_locks.rs` (captured locks of every era, and vendored wiring byte for byte against what real `vlt ci`, `vlt install --frozen-lockfile` and `vlt install <new>` keep on 1.2.0, 1.0.10, 1.0.4, 1.0.0-rc.32 and 1.0.0-rc.14) | DepID codec, collation (`tests/fixtures/vlt/collation-golden.json`), the node-line grammar, the hosted slot rewrite and its slot revert, vendored lock surgery and its inverse, lock inventory, VEX discovery |
-| Hermetic suites | `in_process_redirect`, `in_process_vendor`, `in_process_rollback_hosted`, `in_process_vendor_bun_takeover`, `repair_vendor_flavors_e2e`, `e2e_vex_lockfile`, … (the 3-OS `test` job) | every code of the vlt support, the artifact preflight against a wiremock server, the heal, takeovers, repair, the CLI surface |
+| Hermetic suites | `in_process_redirect`, `in_process_vendor`, `in_process_rollback_hosted`, `in_process_vendor_bun_takeover`, `repair::repair_vendor_flavors_e2e`, `e2e_vex_lockfile`, … (the 3-OS `test` job) | every code of the vlt support, the artifact preflight against a wiremock server, the heal, takeovers, repair, the CLI surface |
 | Real-vlt capstones | the five binaries below plus the vlt legs of `e2e_hosted_production` / `e2e_vendored_production` | real installs: `vlt ci` and frozen installs of patched locks, byte-stable locks, integrity enforcement, the heal on a warm tree, re-saves, upgrades, the hardlinked global store |
 | Native backtest | `scripts/backtest-vlt.py` | the production service end to end, per release, mode and project shape, against an oracle of the documented boundaries |
 
diff --git a/tests/docker/fixtures/npm/README.md b/tests/docker/fixtures/npm/README.md
index cfb4da93..eb693f08 100644
--- a/tests/docker/fixtures/npm/README.md
+++ b/tests/docker/fixtures/npm/README.md
@@ -8,7 +8,7 @@ with the bytes in `blobs/<after_hash>`. The test uses `--force` to skip the
 beforeHash check (we don't bother synthesizing a believable beforeHash —
 the goal is to validate the install + scan + apply dispatch end to end,
 not to test the hash-verification logic which is already covered by
-`apply_invariants.rs`).
+`apply/apply_invariants.rs`).
 
 To regenerate after editing the patched-content marker:
 

From b9e106d6d48cf260b376b6d1dc19df3e5e0da98c Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Tue, 29 Sep 2026 12:20:22 +0200
Subject: [PATCH 27/32] v5: socket.yml patch rollout config and filtering
 (#293)

* Plan staged patch rollout for v5

Adds the design for rolling Socket patches out gradually: a
`patches:` block in socket.yml that narrows what scan may patch
(paths, ecosystems, packages, severity floor, on/off), and a
severity-ordered per-run cap on new patches so each scan lands the
next few most critical fixes.

The plan splits the work into two parallel items with a frozen
interface, lists every hard-coded filter and where it belongs, and
covers the depscan autopatch follow-up. configuration.md now records
that socket-patch reads socket.yml for selection policy only, with
the trust boundary unchanged.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Revise rollout plan after adversarial review

Three independent reviews (ambiguity, churn, trust boundary) found
gaps that would have let the two implementations disagree or let a
repo file widen or stall the rollout. The plan now:

- matches paths against marker files with the backend's top-down
  gitignore rules, so projectIgnorePaths means the same everywhere
- uses one data source for severity, supersession and ordering
- spends the budget only on patches the planning pass proves can
  land, and admits nothing new when a lookup failed
- uses the merged recorded view in every mode and engine
- has depscan read the policy from the base commit for PR jobs
- hardens file handling (regular files, aliases, size, encoding,
  trusted repo root) and reports what a policy hides

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Close interface gaps in the rollout plan

A final consistency pass found places where the two work items
would have produced incompatible code: base purls admitted in one
directory being charged again in the next, no defined hand-off of
the unfiltered offers from the severity filter to classification,
no shared repo-relative path helper, and override sources the JSON
must report but the interface could not carry. The shared contract
now defines each of these, and the parity tests match each engine's
budget scope.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Clarify who shapes scan's selection output

The plan said both that the selector returns the shared offers
struct (work item A) and that it returns admitted/deferred rows
(work item B). The selector now returns the offers, and B adds the
rollout stage after it.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Add the socket.yml selection policy to core

New socket_patch_core::policy module: the SelectionPolicy, Offers and
repo-root helpers that the staged-rollout plan freezes as the shared
contract between the socket.yml work and the --max-new-patches work.

It reads the repo root's socket.yml/socket.yaml strictly and fails
closed: bad YAML, a misspelled `patches` block, unknown keys (with a
did-you-mean hint), wrong types, empty allowlists, bad globs and
anchors or aliases inside the keys we read are all errors that name
the key path. Path lists match marker files with npm `ignore`
semantics, walked top-down; a golden fixture generated from the npm
package pins that. The built-in test/fixture ignores become
overridable defaults for discovered roots.

--package matching moves to core so scan and the policy share it.

Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Honor socket.yml patch policy in disk scans

scan now reads the repo root's socket.yml before any write and applies
its patches block in hosted, vendored and agent mode, --dry-run
included: path filters on project roots (PATH-glob matches also get
the built-in test/fixture ignores), ecosystem and package filters on
crawled packages, and a severity floor on the patches a package may
receive. An invalid or ambiguous file fails the run with exit 1 and
an errorCode before any request.

Packages that already carry a patch are never removed, upgraded or
replaced by the policy: they are held and reported under
policy.retained. A recorded patch below a new floor stays in place.
patches.enabled: false reports what would be patched and writes
nothing.

New flags: --no-socket-yml / SOCKET_NO_SOCKET_YML and
--min-severity / SOCKET_MIN_SEVERITY. Every successful scan --json
result gains a top-level policy block. A PATH outside the repository
root is a usage error.

Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Apply socket.yml policy in the in-memory engine

selectHostedScanPaths now streams the root socket.yml/socket.yaml and
returns them as policyPaths; it drops test and fixture trees through
the policy's built-in default ignores instead of a hard-coded segment
list (structural excludes like node_modules and vendor stay fixed).

The session reads the policy before any root is processed: path
filters run before the project limit, ecosystem and package filters
on each root's packages, and the severity floor before selection. A
listed policy file that arrives without content, or an invalid one,
yields policyError with no root processed and no file changed. New
options noSocketYml, minSeverity and policyPaths; the result gains a
policy block. hosted-bundle and index.d.ts carry the new fields.

get now warns policy_bypassed when the repo's socket.yml would have
skipped the package it patches.

Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Document the socket.yml patch policy

CLI_CONTRACT.md gains a "socket.yml patch policy" section (grammar,
precedence, paths, lookup, validation, commands, error codes and the
policy JSON block), the flag and env rows, and the "narrow or pace"
half of the trust-boundary rule. README adds a "Roll out gradually"
section with copyable socket.yml recipes, CHANGELOG lists the new
policy and the breaking scan changes, and the design docs record the
decisions made while building it.

Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Harden the socket.yml policy after review

Fixes from an adversarial self-review of the policy work:

- A non-ASCII package spec no longer panics validation, and error
  text, warnings and verbose lines drop terminal escapes and bidi or
  zero-width characters.
- Ignore lists that fail to compile together are an error instead of
  silently matching nothing, and the policy file is opened by its
  resolved path without following a swapped-in symlink.
- A top-level key that looks like a misspelled `patches` (`patchs`),
  a top-level merge key or an aliased key now fails closed.
- Repo-root lookup follows a `.git` symlink and trusts the checkout
  owner under root and sudo, so CI containers keep the policy.
- The severity floor always reports the patch it held back, report-
  only --json runs report what a floor or `enabled: false` hides, a
  root skipped as a whole is always one entry and no longer prints
  "No packages found", warnings print once per invocation, and the
  policy line is omitted when there is nothing to say.
- policy entries are sorted and use canonical purls on disk and in
  memory; the in-memory engine applies a socket.yml negation of a
  built-in ignore to roots it was given, and policyError carries no
  CLI-only remedy.
- A lockfile-less disk root matches path filters by its manifests.

Tests cover each fix, plus the prune universe, agent path filters, a
vendored package held byte-identical, and tighter oracles; docs are
corrected where they overstated what the human output names.

Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Give the release test job more time

The optimized test job now has to build two more crates and one more
test binary for the socket.yml policy. It ran out of time on its last
40 minutes, about a minute short, and a docs-only change already takes
38. Raise the limit to 50 minutes so it can finish.

Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Apply socket.yml paths during memory selection

The merged plan makes in-memory path selection two-phase: the host
fetches the root socket.yml first and passes its text to
selectHostedScanPaths. Selection now applies the full path policy, so
a negation such as `!/e2e/tests/` brings a test tree back in memory
exactly as on disk. A listed policy file that is missing, symlinked
or invalid returns policyError with nothing selected.

Selection returns policySha256, and the session fails closed when the
policy it reads differs. Roots the policy excludes keep their marker
files presence-only, so the session still lists them as filtered.

Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Keep excluded roots out of the memory stream

Review follow-ups to two-phase selection:

- Roots the policy excludes are reported in ignoredSample instead of
  streamed presence-only, so a repo with many fixture lockfiles no
  longer runs into the session's file limit.
- A session that bypasses socket.yml while selection applied it now
  fails closed instead of processing roots it never fetched.
- The docs say policy text must decode losslessly (TextDecoder drops
  a BOM) and when policySha256 is null.

Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Keep scan -h short with the policy flags

The v5 help rules cap each command's short help at about eight
options. `--no-socket-yml` and `--min-severity` pushed `scan -h` to
ten, so they now appear only in `scan --help`, like the other
advanced scan flags.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3

* Fail report-only JSON when detail queries fail

A report-only `scan --json` (`--prune` with no mode) with a severity
floor or `enabled: false` fetches patch details to fill
`policy.filtered[]`. If every query failed it still printed a success
envelope and exited 0. It now reports the error and exits 1, like the
agent and vendored runs.

Human-mode policy warnings now print `Warning: <detail>` like the rest
of `scan`; the code stays in the JSON `warnings[]` entry.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3

---------

Co-authored-by: Claude <noreply@anthropic.com>
---
 CHANGELOG.md                                  |   49 +
 Cargo.lock                                    |  127 +-
 Cargo.toml                                    |    2 +
 README.md                                     |   72 +
 crates/socket-patch-cli/CLI_CONTRACT.md       |   93 +-
 crates/socket-patch-cli/src/commands/get.rs   |    4 +-
 .../src/commands/hosted_bundle.rs             |   15 +-
 .../src/commands/scan/hosted.rs               |    8 +-
 .../socket-patch-cli/src/commands/scan/mod.rs |  363 +++--
 .../src/commands/scan/policy.rs               |  550 +++++++
 .../src/commands/scan/socket_yml_args.rs      |   58 +
 .../src/commands/scan/vendor_flow.rs          |    9 +-
 crates/socket-patch-cli/src/lib.rs            |    2 +
 .../socket-patch-cli/tests/cli_parse_scan.rs  |   91 ++
 .../tests/e2e_socket_yml_policy.rs            |  990 ++++++++++++
 .../tests/hosted_memory_common/mod.rs         |   23 +-
 .../tests/hosted_memory_parity.rs             |  366 +++++
 .../tests/in_process_cargo_apply.rs           |    3 +
 .../tests/in_process_gem_apply.rs             |    2 +
 .../tests/in_process_gem_multi_platform.rs    |    1 +
 .../tests/in_process_pypi_apply.rs            |    4 +
 .../tests/in_process_pypi_multi_release.rs    |    1 +
 .../tests/in_process_python_envs.rs           |    1 +
 .../tests/in_process_redirect.rs              |    1 +
 .../tests/in_process_redirect_pdm.rs          |    1 +
 .../tests/in_process_redirect_pipenv.rs       |    1 +
 .../tests/in_process_redirect_pnpm.rs         |    1 +
 .../tests/in_process_redirect_poetry.rs       |    1 +
 .../in_process_remote_ecosystems_apply.rs     |    1 +
 .../tests/in_process_rollback_hosted.rs       |    1 +
 .../socket-patch-cli/tests/in_process_scan.rs |    1 +
 .../tests/in_process_vendor.rs                |    1 +
 crates/socket-patch-core/Cargo.toml           |    2 +
 .../src/hosted/memory/limits.rs               |   28 +
 .../src/hosted/memory/mod.rs                  |  232 ++-
 .../src/hosted/memory/roots.rs                |   75 +-
 .../src/hosted/memory/select.rs               |  136 +-
 .../src/hosted/memory/types.rs                |   61 +
 crates/socket-patch-core/src/lib.rs           |    1 +
 crates/socket-patch-core/src/policy/mod.rs    |  892 +++++++++++
 crates/socket-patch-core/src/policy/paths.rs  |  250 +++
 crates/socket-patch-core/src/policy/report.rs |   88 ++
 .../src/policy/socket_yml.rs                  | 1277 +++++++++++++++
 crates/socket-patch-core/src/policy/tests.rs  |  594 +++++++
 .../tests/fixtures/ignore_golden.json         | 1379 +++++++++++++++++
 crates/socket-patch-node/npm/index.d.ts       |   27 +-
 docs/design/configuration.md                  |   18 +-
 docs/design/staged-rollout.md                 |   79 +
 scripts/gen-ignore-golden.mjs                 |  113 ++
 49 files changed, 7891 insertions(+), 204 deletions(-)
 create mode 100644 crates/socket-patch-cli/src/commands/scan/policy.rs
 create mode 100644 crates/socket-patch-cli/src/commands/scan/socket_yml_args.rs
 create mode 100644 crates/socket-patch-cli/tests/e2e_socket_yml_policy.rs
 create mode 100644 crates/socket-patch-core/src/policy/mod.rs
 create mode 100644 crates/socket-patch-core/src/policy/paths.rs
 create mode 100644 crates/socket-patch-core/src/policy/report.rs
 create mode 100644 crates/socket-patch-core/src/policy/socket_yml.rs
 create mode 100644 crates/socket-patch-core/src/policy/tests.rs
 create mode 100644 crates/socket-patch-core/tests/fixtures/ignore_golden.json
 create mode 100644 scripts/gen-ignore-golden.mjs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2c45ee7c..1c261cf8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -652,8 +652,57 @@ into the new version's section — see docs/releasing.md.
   batch is reported as failed (warning, or the all-failed error when it was
   the only batch) — instead of that one package being skipped silently.
 
+- **scan honors the repo's socket.yml.** `projectIgnorePaths` (the
+  scanner's key) now also keeps `scan` from patching the matching projects,
+  in every mode and in the in-memory engine, whether or not the file has a
+  `patches` block (malformed values there only warn
+  `socket_yml_ignored_value`). See "socket.yml patch policy" in
+  CLI_CONTRACT.md.
+- **Test and fixture trees are skipped by default when scan discovers
+  projects.** `test/ tests/ fixtures/ __fixtures__/ testdata/` (any case)
+  are built-in `ignorePaths` for discovered roots: hosted/vendored
+  PATH-glob matches (`scan 'services/*'`) and the in-memory engine's
+  detected roots (which used to skip them through a hard-coded, case-
+  sensitive segment list). A directory you name (`--cwd`, a literal PATH,
+  `projectRoots`) is not affected; `ignorePaths: ["!/e2e/tests/"]`
+  re-includes one, in memory too.
+- **An invalid socket.yml fails scan.** An unparseable file, a misspelled
+  top-level `patches` key (`Patches`, `patchs`), a top-level merge or
+  aliased key, an invalid `patches` block (unknown key, wrong type, bad glob, `patches`
+  without `version: 2`), or `socket.yml` and `socket.yaml` that disagree
+  now fail `scan` before any request or write: exit 1, `errorCode:
+  socket_yml_invalid` / `socket_yml_ambiguous`, the key path and the fix
+  in the message. `--no-socket-yml` ignores the file for one run.
+- **scan rejects a PATH outside the repository root** (exit 2): one socket.yml
+  policy per invocation.
+
 ### Added
 
+- **socket.yml patch policy (staged rollout).** A `patches` block in the
+  repo-root socket.yml narrows what `scan` patches: `enabled` (false =
+  report only), `includePaths` / `ignorePaths` (gitignore patterns matched
+  against each project's lockfiles, npm `ignore` semantics),
+  `ecosystems`, `packages` / `ignorePackages` (`--package` specs),
+  `minSeverity` (critical|high|medium|moderate|low, judged by the worst
+  advisory a patch fixes) and `maxNewPatches` (validated; the per-run cap
+  lands with `--max-new-patches`). List flags (`--ecosystems`,
+  `--package`, PATHs) only narrow further; `--min-severity` beats the
+  file's floor and `--no-socket-yml` ignores the file. A package
+  that already carries a patch is never removed, upgraded or replaced by
+  the policy: it is held and reported under `policy.retained[]`. New flags
+  `--min-severity` / `SOCKET_MIN_SEVERITY` and `--no-socket-yml` /
+  `SOCKET_NO_SOCKET_YML`; every successful `scan --json` result gains a
+  top-level `policy` block (`source`, `sha256`, `minSeverity`, `filtered[]`,
+  `retained[]`) and the human output a `Policy (socket.yml): …` line that
+  names every skipped project and every critical/high patch the severity
+  floor held back. In memory, selection is two-phase:
+  `selectHostedScanPaths` takes the root policy files' text
+  (`policyFiles`) and `noSocketYml`, applies the full path policy and
+  returns `policyPaths`, `policySha256` and `policyError`; the session
+  takes `noSocketYml` / `minSeverity` / `policyPaths` / `policySha256` and
+  its result carries `policy` or `policyError`.
+  `get` ignores the policy and warns `policy_bypassed`.
+
 - **`scan --package <name|purl>`** (repeatable or comma-separated, env
   `SOCKET_SCAN_PACKAGES`) scopes a scan to the named packages: a name
   (`lodash`, `@scope/pkg`, `group:artifact`) or a purl with or without its
diff --git a/Cargo.lock b/Cargo.lock
index 4a1aa3b4..efa5fd8b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -17,6 +17,17 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "annotate-snippets"
+version = "0.12.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f211a51805bc641f3ad5b7664c77d2547af685cc33b4cd8d31964027a46f13f1"
+dependencies = [
+ "anstyle",
+ "memchr",
+ "unicode-width",
+]
+
 [[package]]
 name = "anstream"
 version = "0.6.21"
@@ -73,6 +84,12 @@ version = "1.0.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
 
+[[package]]
+name = "arraydeque"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d902e3d592a523def97af8f317b08ce16b7ab854c1985a0c671e6f15cebc236"
+
 [[package]]
 name = "assert-json-diff"
 version = "2.0.2"
@@ -122,6 +139,16 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "bstr"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6bb31b46c14244e20ee9984b11bf5c992b91fb6939fea616e3512c8baecdbe5f"
+dependencies = [
+ "memchr",
+ "serde_core",
+]
+
 [[package]]
 name = "bumpalo"
 version = "3.20.2"
@@ -266,6 +293,12 @@ dependencies = [
  "unicode-segmentation",
 ]
 
+[[package]]
+name = "core_detect"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f8f80099a98041a3d1622845c271458a2d73e688351bf3cb999266764b81d48"
+
 [[package]]
 name = "cpufeatures"
 version = "0.2.17"
@@ -404,6 +437,29 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0"
 
+[[package]]
+name = "encoding_rs"
+version = "0.8.42"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e985e0451871ad22fb8d2b6b076e2028a502a0d3950998c2c5c0a4f9b5d9679"
+dependencies = [
+ "cfg-if",
+ "core_detect",
+ "multiversion_no_op",
+ "rustversion",
+ "scopeguard",
+ "simdutf8",
+]
+
+[[package]]
+name = "encoding_rs_io"
+version = "0.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fba3fe847045ecff794b9c138293a80db914678c453ad63fbf0c6a9eb6e00b22"
+dependencies = [
+ "encoding_rs",
+]
+
 [[package]]
 name = "equivalent"
 version = "1.0.2"
@@ -628,6 +684,29 @@ version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b"
 
+[[package]]
+name = "globset"
+version = "0.4.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07c34a9410465b45bd9787443bc7370f37735bad04b0f0cd57ff1a3186c98988"
+dependencies = [
+ "aho-corasick",
+ "bstr",
+ "log",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "granit-parser"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e20f99e46474f56bd905c56e817ebddcf377a611f94c53ac4649e4d3fa3c0cd0"
+dependencies = [
+ "arraydeque",
+ "smallvec",
+]
+
 [[package]]
 name = "h2"
 version = "0.4.14"
@@ -896,6 +975,22 @@ dependencies = [
  "icu_properties",
 ]
 
+[[package]]
+name = "ignore"
+version = "0.4.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b69833ed729dc5aa7d19541d96d6cf8e9137194207a04916d658e43168402f"
+dependencies = [
+ "crossbeam-deque",
+ "globset",
+ "log",
+ "memchr",
+ "regex-automata",
+ "same-file",
+ "walkdir",
+ "winapi-util",
+]
+
 [[package]]
 name = "indexmap"
 version = "2.13.0"
@@ -1040,6 +1135,12 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "multiversion_no_op"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "743fb55ba31b18fb1ecef6bdc9aa2743314978ac084044301a7eee33fb99a20d"
+
 [[package]]
 name = "napi"
 version = "3.13.0"
@@ -1390,9 +1491,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.14"
+version = "0.4.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -1589,6 +1690,20 @@ dependencies = [
  "serde_derive",
 ]
 
+[[package]]
+name = "serde-saphyr"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8050abb251097357e24aff63ba2c52a6309ecb7d23a5474023df960a02694d8"
+dependencies = [
+ "annotate-snippets",
+ "encoding_rs_io",
+ "granit-parser",
+ "num-traits",
+ "serde_core",
+ "smallvec",
+]
+
 [[package]]
 name = "serde_core"
 version = "1.0.228"
@@ -1742,6 +1857,12 @@ version = "0.3.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "703d5c7ef118737c72f1af64ad2f6f8c5e1921f818cdcb97b8fe6fc69bf66214"
 
+[[package]]
+name = "simdutf8"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
+
 [[package]]
 name = "slab"
 version = "0.4.12"
@@ -1799,6 +1920,7 @@ dependencies = [
  "fs2",
  "futures-util",
  "hex",
+ "ignore",
  "libc",
  "once_cell",
  "qbsdiff",
@@ -1809,6 +1931,7 @@ dependencies = [
  "self-replace",
  "semver",
  "serde",
+ "serde-saphyr",
  "serde_json",
  "serial_test",
  "sha1",
diff --git a/Cargo.toml b/Cargo.toml
index 6a95c787..2d241db0 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -59,6 +59,8 @@ serial_test = "=3.4.0"
 napi = { version = "=3.13.0", features = ["napi8", "tokio_rt"] }
 napi-derive = "=3.6.9"
 napi-build = "=2.5.0"
+serde-saphyr = { version = "=1.3.0", default-features = false, features = ["deserialize"] }
+ignore = "=0.4.33"
 
 [profile.release]
 strip = true
diff --git a/README.md b/README.md
index 6045f81d..6cb2ba7c 100644
--- a/README.md
+++ b/README.md
@@ -413,6 +413,10 @@ socket-patch scan 'services/*'                                   # directory glo
 hosted and vendored mode each PATH is a project directory, scanned as if it were
 `--cwd` under an `== <dir> ==` header; the worst exit code wins.
 
+To make the choice stick for everyone who runs `scan` in the repo (CI and the Socket
+autopatch bot included), put it in `socket.yml` instead — see
+[Roll out gradually](#roll-out-gradually-with-socketyml).
+
 ### Patch one specific CVE or advisory
 
 ```bash
@@ -647,6 +651,8 @@ socket-patch scan [PATHS]... [options]
 | `--prune` | — | Agent-mode garbage collection after the scan: remove manifest entries for packages no longer present in the crawl (installed trees + lockfiles — a wiped `node_modules` alone doesn't prune lockfile-listed entries) and delete orphan blob/diff-archive files (plus any legacy package archives). [Vendored](#vendor) packages are exempt from the crawl-based prune, but a vendored entry whose dependency has left the lockfile is reverted. Ignored, with a `redirect_prune_ignored` warning, in hosted mode; without a mode the scan is report-only. |
 | `--sync` | — | Shorthand for `--mode agent --prune`: the one-flag agent-mode auto-update run. |
 | `--batch-size <n>` | `SOCKET_BATCH_SIZE` | Packages per API request (default: `500` on the authenticated API, `100` on the public proxy). A request whose body would exceed 256 KiB is split into smaller ones. |
+| `--min-severity <level>` | `SOCKET_MIN_SEVERITY` | Only patch packages whose patch fixes an advisory of at least `critical`, `high`, `medium` (or `moderate`) or `low`; `none` lifts the floor. Overrides `patches.minSeverity` in socket.yml. Patches of unknown severity are skipped whenever a floor is set. |
+| `--no-socket-yml` | `SOCKET_NO_SOCKET_YML` | Ignore the repo's socket.yml patch policy for this run (the built-in test/fixture directory ignores still apply). |
 | `--all-releases` | `SOCKET_ALL_RELEASES` | Store patches for every release/distribution variant, not just the installed one — PyPI wheel/sdist, RubyGems platform, Maven classifier. Makes the manifest portable across environments (e.g. cross-platform CI caches). |
 | `--vex <path>` | `SOCKET_VEX` | On a successful scan, also write an OpenVEX 0.2.0 document to this path. See [Inline VEX](#inline-vex-on-apply--scan--vendor). |
 | `--vex-product`, `--vex-no-verify`, `--vex-doc-id`, `--vex-compact` | `SOCKET_VEX_*` | Passthrough to the embedded VEX builder; mirror the standalone [`vex`](#vex) knobs. Inert unless `--vex` is set. |
@@ -692,6 +698,72 @@ socket-patch scan --vex socket.vex.json
 > artifact is the patch); a newer available patch still appears in `updates[]` — re-run
 > `scan --mode vendored` to take it.
 
+#### Roll out gradually with socket.yml
+
+A `patches` block in the repo-root `socket.yml` (the file the Socket scanner already
+reads; keep `version: 2`) narrows what `scan` may patch, for every mode and for the
+in-memory engine behind the Socket autopatch bot. It can only narrow: nothing in it can
+name an endpoint or token, pick a mode, or turn off a safety check.
+
+```yaml
+# Critical first: widen by editing one line
+version: 2
+patches:
+  minSeverity: critical   # later: high, then low, then remove the key
+                          # (low still skips patches whose severity is unknown)
+```
+
+```yaml
+# One directory first (monorepo)
+version: 2
+patches:
+  includePaths:
+    - "/services/payments/"
+    # add "/services/checkout/" next sprint
+```
+
+```yaml
+# One ecosystem, hold one package
+version: 2
+patches:
+  ecosystems: [npm]
+  ignorePackages: ["pkg:npm/left-pad"]
+```
+
+```yaml
+# Pause: report only; existing patches stay in place
+version: 2
+patches:
+  enabled: false
+```
+
+- Paths are gitignore patterns (the same rules as `projectIgnorePaths`, which scan now
+  honors too), matched against each project's lockfiles: `"/services/payments/"`,
+  `"**/yarn.lock"`, `"examples/**"`. `test/`, `tests/`, `fixtures/`, `__fixtures__/`
+  and `testdata/` directories are skipped by default when scan discovers projects
+  (a directory glob such as `scan 'services/*'`); re-include one with a negation
+  (`ignorePaths: ["!/e2e/tests/"]`). A directory you name yourself is always scanned.
+  (The autopatch bot's tree listing skips those directories before it reads
+  socket.yml, so there a negation cannot bring one back.)
+- `packages` / `ignorePackages` take `--package` specs; prefer purls (`pkg:npm/core`),
+  because a bare name also matches other ecosystems and scoped packages (`core`
+  matches `@babel/core`).
+- Narrowing never removes a patch: a package that already carries one and is now
+  filtered out is left exactly as it is (reported under `policy.retained[]`). Use
+  `rollback` or `remove` to take a patch out.
+- A broken file fails the scan (exit 1, `errorCode: socket_yml_invalid`) before anything
+  is written, with the key and the fix in the message — a typo never widens the
+  rollout. `--no-socket-yml` ignores the file for one run.
+- `scan --json` reports what the policy did in a top-level `policy` block
+  (`jq '.policy.counts'`); the human output adds a `Policy (socket.yml): …` line that
+  names every skipped project and every critical/high patch the severity floor held
+  back (`--verbose` lists everything). `get` ignores the policy (explicit
+  intent) and warns `policy_bypassed`.
+
+Every key: `enabled`, `includePaths`, `ignorePaths`, `ecosystems`, `packages`,
+`ignorePackages`, `minSeverity`, `maxNewPatches` — see CLI_CONTRACT.md "socket.yml patch
+policy" for the full grammar, precedence and validation rules.
+
 ### `vex`
 
 Generate an [OpenVEX](https://github.com/openvex) 0.2.0 attestation describing the
diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index c9af4822..6d2e797d 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -30,7 +30,7 @@ Rows are in `--help` order (v5.0): the hosted/vendored workflow (`scan` → `vex
 
 **Root `--update` flag.** `socket-patch --update [VERSION]` updates the binary itself from GitHub Releases. It is a root flag, not a subcommand: argv is rewritten (the same mechanism as the bare-UUID fallback) onto an internal hidden subcommand whose name carries no stability guarantee — script the flag, never the internal name. Combining the flag with a subcommand (`socket-patch --update scan`) is a usage error (exit 2). Full contract: [Self-update contract](#self-update-contract-socket-patch---update).
 
-**Internal `hosted-bundle` subcommand.** `socket-patch hosted-bundle` is a hidden, INTERNAL parity/debug harness for the in-memory hosted engine (`socket-patch-core` `src/hosted/memory/`, the engine the Node addon embeds): it reads a JSON bundle `{"files": {path: text}, "binaryFiles"?: {path: base64}, "presentOnly"?: [path], "symlinks"?: [path], "projectRoots"?: [dir], "pipenvMajor"?: n, "batchSize"?: n}` on stdin, queries the authenticated org API built from `--api-url` / `--api-token` / `--org` only (both of the latter are required; no public-proxy fallback), and prints the engine result — or `{"status":"error","error":{"code","message"}}` with exit 1 (exit 2 for unusable input or missing credentials). It never touches the filesystem. Its name, input and output carry NO stability guarantee; do not script it.
+**Internal `hosted-bundle` subcommand.** `socket-patch hosted-bundle` is a hidden, INTERNAL parity/debug harness for the in-memory hosted engine (`socket-patch-core` `src/hosted/memory/`, the engine the Node addon embeds): it reads a JSON bundle `{"files": {path: text}, "binaryFiles"?: {path: base64}, "presentOnly"?: [path], "symlinks"?: [path], "projectRoots"?: [dir], "pipenvMajor"?: n, "batchSize"?: n, "noSocketYml"?: bool, "minSeverity"?: s, "policyPaths"?: [path], "policySha256"?: s}` on stdin, queries the authenticated org API built from `--api-url` / `--api-token` / `--org` only (both of the latter are required; no public-proxy fallback), and prints the engine result — or `{"status":"error","error":{"code","message"}}` with exit 1 (exit 2 for unusable input or missing credentials). It never touches the filesystem. Its name, input and output carry NO stability guarantee; do not script it.
 
 ## Global arguments
 
@@ -87,6 +87,8 @@ Beyond the globals above, each subcommand defines a small set of local arguments
 | `scan` | `--package <name\|purl>` (repeatable or comma-separated) | `SOCKET_SCAN_PACKAGES` | (v5.0) Only scan these packages: a name (`lodash`, `@scope/pkg`, `requests`, `group:artifact`; matched against the full name or its last segment, case-insensitively) or a purl with or without a version (`pkg:npm/lodash` matches every version, `pkg:pypi/requests@2.31.0` only that one). Qualifiers are ignored. Filters the crawl like `--ecosystems`, after the prune universe is captured, so `--prune` still judges the full crawl |
 | `scan` | `--vendor` | — | Vendor every patched dependency instead of applying in place (`--vendor` == `--mode vendored`; conflicts with `--apply`/`--sync`, combines with `--prune`). Vendored mode is manifest-free (v5.0): the vendor ledger embeds the patch records and `.socket/manifest.json` is never written. The former opt-in for exactly that, `--detached`, is removed in v5.0 (unknown-flag usage error) |
 | `scan` | `--batch-size` | `SOCKET_BATCH_SIZE` | API batch chunk size. Unset (v5.0): `500` on the authenticated API (the server's per-request maximum), `100` on the public proxy; a given value applies on either endpoint (`0` is floored to `1`). A chunk whose request body would exceed 256 KiB (the public proxy's body cap) is split into consecutive smaller chunks, deterministically (greedy, in crawl order). A mid-run downgrade to the proxy keeps the chunks already formed |
+| `scan` | `--no-socket-yml` | `SOCKET_NO_SOCKET_YML` | (v5.0) Ignore the repository's socket.yml patch policy (its `patches` block and `projectIgnorePaths`) for this run; the built-in test/fixture ignores still apply. The `policy` block reports `source: "bypassed"`. See "socket.yml patch policy". |
+| `scan` | `--min-severity <critical\|high\|medium\|moderate\|low\|none>` | `SOCKET_MIN_SEVERITY` | (v5.0) Severity floor for the patch a package may receive (worst advisory severity; unknown severity is skipped whenever a floor is set). Beats `patches.minSeverity`; the flag beats the env; `none` lifts the floor. A malformed value is exit 2. |
 | `get`, `scan` | `--all-releases` | `SOCKET_ALL_RELEASES` | Download patches for every release/distribution variant of a matched package — PyPI wheel/sdist (`artifact_id`), RubyGems (`platform`), Maven (`classifier`) — not just the one(s) matching the locally-installed distribution. On `scan` this makes the stored manifest portable across environments (e.g. cross-platform CI caches). On `get` (v3.6) it ALSO disables the coarse installed-**version** narrowing of CVE/GHSA fan-outs (see "get --mode and installed narrowing"): every found version's patch is fetched, installed or not |
 | `get` | positional `identifier`; `--id` / `--cve` / `--ghsa` / `--package` (`-p`); `--save-only` (alias `--no-apply`); `--mode <hosted\|vendored\|agent>` | `SOCKET_SAVE_ONLY` | Patch lookup + consumption mode (v3.6). `--mode` reuses scan's value enum (same hidden value aliases `host`/`redirect`/`vendor`; deliberately no env binding, matching scan). Default (v5.0): `hosted`, like scan; `agent` (save + apply in place) when `--save-only` or `--global`/`--global-prefix` is given. An explicit `--save-only` conflicts with `--mode hosted\|vendored` — rejected with **exit 1** via get's established self-enforced-conflict style (unlike scan's exit-2 mode conflicts; see the exit-code table) |
 | `remove` | positional `identifier`; `--skip-rollback`; `--preserve-state` (v5.0) | `SOCKET_SKIP_ROLLBACK`, `SOCKET_PRESERVE_STATE` | Manifest entry removal. `--preserve-state` is the single-patch twin of `rollback --preserve-state`: restore the tree and unwind the identifier's vendored/hosted wiring, but keep the manifest entry, the vendored artifact + ledger entry, and skip all GC. Combining it with `--skip-rollback` is a self-enforced usage error (exit 2): one flag keeps the tree and drops the state, the other restores the tree and keeps the state — together they select the do-nothing quadrant ("the combination would be a no-op: nothing would change"). The conflict fires whether either flag is spelled on the command line or sourced from its env var |
@@ -175,6 +177,87 @@ The hidden alias `--no-apply` on `get --save-only` is **part of the contract** 
 
 **Python stale-install guard**: after a hosted redirect, `scan` / `get` use the Python crawler to inspect every matching installed package, including Poetry's out-of-tree virtualenvs and `--global-prefix`. A readable file that differs from the patch's `afterHash` emits `redirect_pypi_stale_install` in JSON `redirect.warnings[]` and human stderr. The probe changes no installed files, re-runs on idempotent scans, and falls back to persisted patch records when fresh record fetching fails. Missing/unreadable files alone do not prove staleness; lock-only checkouts stay quiet. Dry runs skip the probe. Same-run VEX excludes positively stale Python packages (qualifier-insensitive), even with `--vex-no-verify` or a healthy copy in another interpreter; if nothing remains to attest, the command exits 1 with `no_applicable_patches`. Reinstall from the rewritten lock in the affected interpreter and verify with `socket-patch vex`.
 
+### socket.yml patch policy (v5.0)
+
+A repository can **narrow** what `scan` patches with a `patches` block in its root `socket.yml` (the Socket scanner's config file; `version: 2` keeps every other consumer working — they strip or ignore the block). Design record: `docs/design/staged-rollout.md`.
+
+**Grammar.** Every key is optional; camelCase, like the rest of socket.yml.
+
+```yaml
+version: 2                          # required once a patches block exists (integer 2 or string "2")
+projectIgnorePaths: ["examples/**"] # the scanner's key; socket-patch honors it too
+patches:
+  enabled: true                     # bool, default true; false = report only, nothing is written
+  includePaths: ["/services/payments/"]   # gitignore list; absent = every project
+  ignorePaths: ["/legacy/"]         # gitignore list, evaluated after the built-in defaults
+  ecosystems: [npm, pypi]           # any --ecosystems name (npm pypi cargo gem golang maven composer nuget deno)
+  packages: ["pkg:npm/lodash"]      # allowlist in the --package grammar
+  ignorePackages: ["pkg:npm/left-pad"]    # denylist in the --package grammar
+  minSeverity: high                 # critical|high|medium|moderate|low (moderate = medium)
+  maxNewPatches: 5                  # integer 0..=4294967295; validated now, the per-run cap lands with `--max-new-patches`
+```
+
+- Deny wins: `ignorePackages` beats `packages`, ignore paths beat `includePaths`. An empty allowlist (`includePaths: []`, `ecosystems: []`, `packages: []`) is an error ("use `enabled: false`"), never "all".
+- Package specs are exactly `--package`'s: a name (full or last segment, case-insensitive) or a purl with or without a version; qualifiers ignored. A bare name matches across ecosystems (`core` matches `@babel/core`), so prefer purls. Invalid: empty, or `pkg:` without a type and a name.
+- `minSeverity` judges the patch by the worst severity across the advisories it fixes (the per-package records scan fetches, never the batch summary). With a floor set, a patch of unknown severity is skipped (`minSeverity: low` therefore still skips those). The floor restricts which patch may **win** a package: a lower-ranked patch above the floor can still win.
+
+**Precedence (flags narrow, never widen).** List filters intersect: `--ecosystems`, `--package` and PATH arguments narrow the file's lists further. Scalars go flag > env > file > default: `--min-severity <critical|high|medium|moderate|low|none>` > `SOCKET_MIN_SEVERITY` > `patches.minSeverity` > no floor. `--no-socket-yml` / `SOCKET_NO_SOCKET_YML` skips the file entirely (the built-in default ignores still apply). An empty env value is unset; a malformed flag or env value is a usage error (exit 2).
+
+**Paths.** Path lists are gitignore patterns with the npm `ignore` package's semantics (the backend's `projectIgnorePaths` matcher): case-insensitive, anchored at the repo root, a leading or middle `/` anchors, a bare name matches at any depth, a trailing `/` matches directories only, `!` negates, the last match wins, and a negation cannot re-include anything under an ignored directory (evaluation walks top-down). Backslash is gitignore's escape character, not a separator. Patterns with a `..` segment, a drive letter, a NUL byte, or over 1024 bytes are rejected.
+
+- They are matched against a project root's **marker files**, repo-relative: the lockfiles in the root's directory (`package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`, `bun.lock(b)`, `vlt-lock.json`, `rush.json`, `uv.lock`, `poetry.lock`, `pdm.lock`, `Pipfile.lock`, `requirements.txt`, `*.py.lock`/`pylock*.toml`, `Cargo.lock`, `go.mod`, `go.sum`, `composer.lock`, `Gemfile.lock`, `gems.locked`, plus the Maven/NuGet markers). A root is ignored iff **every** marker is ignored; with `includePaths`, it is included iff **any** marker matches; a disk root with no lockfile uses its manifests (`package.json`, `pyproject.toml`, `setup.py`, `Cargo.toml`, `composer.json`, `Gemfile`, `pom.xml`, `build.gradle`) instead, and one with neither is matched as its directory. So `/package-lock.json`, `**/yarn.lock` and `examples/**` mean what they mean to the scanner; `includePaths: ["/*", "!/*/"]` targets only the repo-root project.
+- Evaluation order (one combined list): the **built-in defaults** `test/ tests/ fixtures/ __fixtures__/ testdata/`, then `projectIgnorePaths`, then `patches.ignorePaths`. Re-include a default with a negation (`ignorePaths: ["!/e2e/tests/"]`). The defaults apply only to **discovered** roots: hosted/vendored PATH-glob matches and roots the in-memory engine detects. A root you name — `--cwd`, a literal PATH, an in-memory `projectRoots` entry — skips them (the other lists still apply). `node_modules .git .socket .yarn vendor` stay structural excludes of in-memory root detection; no policy negates them.
+- A workspace member that shares its root's lockfile is part of that root's project: exclude it with `ignorePackages`, not paths.
+- A hosted/vendored PATH that resolves outside the repository root is a usage error (exit 2): one policy per invocation.
+
+**Lookup.** The repo root is the nearest ancestor of `--cwd` (inclusive) holding `.git` (a directory, a file for worktrees and submodules, or a symlink to either), not walking past a `GIT_CEILING_DIRECTORIES` entry or into the home directory (unless `--cwd` is it), and, on Unix, only when `.git` belongs to the current user, to root, or to the user `sudo` ran for (`SUDO_UID`); a root process trusts every owner, since CI containers commonly run as root over a checkout owned by another uid (otherwise warning `socket_yml_repo_untrusted` and `--cwd` is the root). No `.git`: the root is `--cwd`. Only `<root>/socket.yml` and `<root>/socket.yaml` are read, matched by exact directory-entry name (`Socket.yml` is not read: warning `socket_yml_name_case`); nested files never are. A symlinked file is followed only to a regular file inside the repo root. `--global` / `--global-prefix` scans read no file.
+
+**In memory (two-phase).** The host fetches the tree's root `socket.yml` / `socket.yaml` first and passes each to `selectHostedScanPaths` as `policyFiles: [{path, text} | {path, missing: true}]` (and `noSocketYml` when the session will bypass it). `text` must be a lossless UTF-8 decode (Node `buffer.toString('utf8')`; `TextDecoder` drops a BOM). Selection applies the full path policy (defaults, `projectIgnorePaths`, `patches` lists, negations), so a negated default-ignored root is fetched and patched as on disk; an excluded root is not streamed and is reported in `ignoredSample` with its `policy_*` reason (the session's `policy.filtered[]` lists only roots it received). Unless `noSocketYml`, a listed policy file not passed, passed `missing`, symlinked or invalid makes selection return `policyError` with nothing selected. Selection returns `policyPaths` and `policySha256` (`null` with no file, an empty file, or `noSocketYml`); the host streams the same text and passes both to the session, with the same `noSocketYml`. The session fails `socket_yml_invalid` when the policy it reads differs from `policySha256`, including a bypassed session given a digest.
+
+**Validation (fail closed).** Because the file only narrows, a file that cannot be honored never means "no policy". Checked in order: file access (a regular file after resolving, at most 64 KiB, read from the opened handle), encoding (UTF-8; a BOM is stripped and CRLF is fine; UTF-16 and NUL bytes are errors), YAML 1.2 syntax (duplicate keys, a non-mapping top level, nesting deeper than 32 and a second document are errors), a top-level key that looks like a misspelled `patches` (equal to `patch`/`patches` ignoring case, or within two edits of it and starting `pat`/`pac`, e.g. `patchs`), a top-level merge key (`<<`) or aliased key (either could carry a `patches` block other YAML readers apply), the version gate (`patches` requires `version: 2`), then the keys. Inside `patches` and `projectIgnorePaths`, anchors, aliases, merge keys (`<<`) and custom tags are errors (aliases elsewhere are never expanded). An unknown key under `patches` is an error with a did-you-mean hint and "a newer socket-patch may support it". Wrong types are errors — no coercion (`"false"` is not a bool; YAML 1.2, so `no` is a string) — as are an unknown severity, an out-of-range `maxNewPatches`, an invalid pattern or spec, a list over 1000 entries and an entry over 1024 bytes. Every error names the file and the key path (`patches.minSeverity`). `projectIgnorePaths` is validated strictly when a `patches` block exists (a single string is coerced to a one-element list); without one, a malformed value only warns `socket_yml_ignored_value` and is ignored, and it is honored whatever the `version`. An empty or comment-only file counts as no file. When both `socket.yml` and `socket.yaml` exist, both are validated; if their `projectIgnorePaths` and `patches` are equal as parsed values `socket.yml` is used, otherwise the run fails with `socket_yml_ambiguous`.
+
+**Error output.** Before any request or write, `scan` exits **1** with scan's error object plus an additive `errorCode` (`socket_yml_invalid` or `socket_yml_ambiguous`): `{"status": "error", "error": "socket.yml: patches.minSeverty: unknown key … (fix the file, or pass --no-socket-yml to ignore it)", "errorCode": "socket_yml_invalid", …}` with every count at zero; no `policy` block. Human output: `Error (socket_yml_invalid): …` on stderr. The in-memory engine reports `policyError: {code, detail}` (the detail without the CLI remedy) with no root processed and no file changed.
+
+**The trust boundary holds.** No key names an endpoint, a credential, an org, a mode, a download format or a safety switch — such keys are unknown keys and fail validation. Every key only removes candidates or (`maxNewPatches`) delays them; none can add a package or bypass the tier filter, the agent partition, reference grants, containment checks or any refusal.
+
+**Narrowing never removes.** The policy runs after the `--prune` universe is captured, so `--prune` still judges the full crawl. A package that already carries a recorded patch (the merged recorded view: manifest > hosted lockfile pins > vendor ledger) and is now excluded by paths, ecosystems, packages or `enabled: false` is **retained**: never handed to the hosted rewriters, the vendor engine or agent apply, never upgraded, left byte-identical, and listed under `policy.retained[]` with `upgradeAvailable`. A recorded package whose patches all fall below a new floor keeps its recorded patch, and the floor never replaces a recorded patch that outranks every admitted one (a recorded merged patch stays). Removing a patch is only ever `rollback` / `remove`, or the dependency leaving the lockfile.
+
+**`enabled: false`.** Discovery and the table still run; nothing is written (the `--prune` GC is skipped too); every candidate is reported `policy_disabled` (recorded ones as retained); warning `patches_disabled`; exit 0.
+
+**Commands.** `scan` (hosted, vendored, agent; wet and `--dry-run`), the in-memory engine and `hosted-bundle` honor the policy. `get` is explicit intent: it ignores the policy and warns `policy_bypassed` (in `warnings[]`, and on stderr) when socket.yml would have skipped the package; an invalid file never fails `get`, it only drops the warning. `apply`, `list`, `vex`, `rollback`, `remove`, `repair` and `vendor` ignore it.
+
+**`policy` JSON block** (additive, MINOR; on every successful `scan --json` result, and session-level on the in-memory result):
+
+```json
+"policy": {
+  "source": "file",
+  "path": "socket.yml",
+  "sha256": "…",
+  "enabled": true,
+  "minSeverity": {"value": "high", "source": "file"},
+  "counts": {"filtered": 3, "retained": 1},
+  "filtered": [
+    {"purl": "pkg:npm/qs@6.5.2", "uuid": null, "project": "services/legacy",
+     "reason": "policy_path_excluded", "detail": "/legacy/ (patches.ignorePaths)"}
+  ],
+  "retained": [
+    {"purl": "pkg:npm/lodash@4.17.20", "project": "", "recordedUuid": "…",
+     "reason": "policy_package_ignored", "detail": "lodash (patches.ignorePackages)", "upgradeAvailable": true}
+  ]
+}
+```
+
+- `source`: `none` (no file, an empty file, `--global`, or only a case variant; `path`/`sha256` null), `file` (the file used and the SHA-256 of its bytes), `bypassed` (`--no-socket-yml`).
+- `minSeverity.source`: `flag` | `env` | `file` | `default`; `value` null = no floor (`moderate` reads as `medium`).
+- `project`: the repo-relative root directory (`""` for the repo root).
+- `filtered[]`: `uuid` is null for a package filtered before any patch lookup (path, ecosystem and package reasons — those packages are never queried); a root filtered as a whole is one entry with `purl: null`. A severity entry names the top-ranked patch the floor withheld. `retained[]`: recorded packages the filters hold in place.
+- Reason codes (stable): `policy_disabled`, `policy_path_excluded`, `policy_path_not_included`, `policy_ecosystem`, `policy_package_not_listed`, `policy_package_ignored`, `policy_severity` (detail `low < high`, `unknown < high`). In-memory `ProjectResult.skipped[]` carries the post-lookup ones (severity, disabled) with the same codes.
+- Every string copied from the file (patterns, specs, key names) is truncated to 200 characters with control characters stripped.
+- Warnings ride scan's top-level `warnings[]` (`{code, detail}`): `socket_yml_ignored_value`, `socket_yml_name_case`, `socket_yml_repo_untrusted`, `patches_disabled`.
+- Human output: one line after the table when anything was filtered or held, e.g. `Policy (socket.yml): 3 skipped by filters, 1 patched package held.`, then every skipped project and every critical/high patch the severity floor or `enabled: false` held back, by name (a policy must not hide those silently; path, ecosystem and package filters run before any patch lookup, so their severity is unknown); `--verbose` lists every entry. A report-only `--json` run (`--prune` or `--global` with no mode) fetches patch details only when a floor or `enabled: false` could withhold something, so its `filtered[]` matches the human output.
+- `filtered[]` and `retained[]` are sorted by project, then purl; purls use the canonical spelling (qualifiers stripped, percent-decoded).
+- Exit code is unchanged by filtering.
+
 ### Embedded VEX (`apply --vex` / `scan --vex` / `vendor --vex`)
 
 `--vex <path>` folds OpenVEX 0.2.0 generation into `apply`, `scan`, and `vendor`: on a successful run the command writes the document to `<path>` using the same engine as the standalone `vex` command. The `--vex-*` flags mirror `vex`'s `--product` / `--no-verify` / `--doc-id` / `--compact` knobs (namespaced to avoid colliding with the host command), and reuse the standalone env vars (`SOCKET_VEX_PRODUCT`, etc.). They are inert unless `--vex` is set.
@@ -929,6 +1012,8 @@ Empty string means unset at every layer: exported-but-empty flag-bound vars are
 | `SOCKET_PATCH_VERSION` | `--update <VERSION>` | (latest) | Local to `--update`; the same pin `install.sh` and the gem launcher honor. |
 | `SOCKET_BATCH_SIZE` | `scan --batch-size` | `500` authenticated / `100` proxy | Local to `scan`. |
 | `SOCKET_SCAN_PACKAGES` | `scan --package` | (none) | Local to `scan` (v5.0); comma-separated names or purls. |
+| `SOCKET_NO_SOCKET_YML` | `scan --no-socket-yml` | `false` | Local to `scan` (v5.0); bool vocabulary, empty = unset. |
+| `SOCKET_MIN_SEVERITY` | `scan --min-severity` | (none) | Local to `scan` (v5.0); read by scan (not clap) so the `policy` block can say `source: "env"`; empty = unset, malformed = exit 2. |
 | `SOCKET_SAVE_ONLY` | `get --save-only` | `false` | Local to `get`. |
 | `SOCKET_ALL_RELEASES` | `get --all-releases` / `scan --all-releases` | `false` | Local to `get`/`scan`. Download patches for every release/distribution variant, not just the installed one. |
 | `SOCKET_SKIP_ROLLBACK` | `remove --skip-rollback` | `false` | Local to `remove`. Conflicts with `--preserve-state`/`SOCKET_PRESERVE_STATE` (exit 2 — see below). |
@@ -972,7 +1057,7 @@ Contract properties:
 - The file is read lazily at most once per process, only when a key is still unresolved after flag + env.
 - The telemetry endpoint resolver shares the same `apiBaseUrl` chain as API-client construction (`resolve_api_base_url`), so telemetry can never target a different host than the client.
 - `--offline` semantics are unchanged: reading the local file is not network contact; a config-sourced token is inert offline.
-- **Repo-level files never carry endpoints, credentials, or interlock-disablers**: configuration for those comes only from flags, env vars, this user-level file, and built-in defaults — never from files inside the repository being patched (manifest, socket.yml, `.env`, …).
+- **Repo-level files never carry endpoints, credentials, or interlock-disablers**: configuration for those comes only from flags, env vars, this user-level file, and built-in defaults — never from files inside the repository being patched (manifest, socket.yml, `.env`, …). A repository file may **narrow or pace** what `scan` patches (socket.yml's `patches` block and `projectIgnorePaths`, see "socket.yml patch policy"). It may never name an endpoint or credential, pick a mode or download format, turn off a safety check, or make `scan` patch anything it would not patch with no file present; the one exception is negating the built-in test/fixture path ignores, which are repo policy by nature.
 - `--debug` names the source on stderr whenever a setting resolves from the socket-cli config (the token value itself is never echoed).
 
 ### Registry override env vars
@@ -1471,8 +1556,8 @@ Exit `1` when `status` is `partialFailure` (any `events[*].action == "failed"`)
 | Code | Meaning |
 |---|---|
 | `0` | Success |
-| `1` | Error (missing/invalid manifest, fetch failed, apply failed, selection cancelled in non-JSON mode, etc.) |
-| `2` | Usage error: clap parse failures (unknown flag/value, missing required arg, an unknown subcommand such as the removed `setup`) and the conflicts the commands enforce themselves — `scan`'s cross-mode conflicts (`--mode` combined with a DIFFERENT mode's boolean spelling, rejected in `resolve_mode_flags`) and `--mode hosted` with `--global`/`--global-prefix` (same enforcement point); in hosted/vendored `scan` (bare `scan` included), a PATH that is not a directory, a PATH glob matching no directory, and `--json` with more than one project directory (`run_project_dirs`); `remove --preserve-state --skip-rollback` (the no-op quadrant; flag- or env-sourced alike), an unparseable path glob on `scan`/`rollback`, `repair --offline --download-only`. `vex` also exits `2` on hard errors before document generation (see its tri-state table below). v5.0: `get`'s self-enforced conflicts exit `2` too (`--id`/`--cve`/`--ghsa`/`--package` multi-select, `--mode hosted\|vendored --save-only`, a malformed identifier for a forced `--id`/`--cve`/`--ghsa`) — previously `1` (MAJOR). The never-implemented `get --one-off` / `rollback --one-off` (and `SOCKET_ONE_OFF`) are removed in v5.0; `--one-off` is now an ordinary unknown-flag clap error. |
+| `1` | Error (missing/invalid manifest, fetch failed, apply failed, selection cancelled in non-JSON mode, an invalid or ambiguous socket.yml on `scan` (v5.0), etc.) |
+| `2` | Usage error: clap parse failures (unknown flag/value, missing required arg, an unknown subcommand such as the removed `setup`) and the conflicts the commands enforce themselves — `scan`'s cross-mode conflicts (`--mode` combined with a DIFFERENT mode's boolean spelling, rejected in `resolve_mode_flags`) and `--mode hosted` with `--global`/`--global-prefix` (same enforcement point); in hosted/vendored `scan` (bare `scan` included), a PATH that is not a directory, a PATH glob matching no directory, and `--json` with more than one project directory (`run_project_dirs`); `remove --preserve-state --skip-rollback` (the no-op quadrant; flag- or env-sourced alike), an unparseable path glob on `scan`/`rollback`, a `scan` PATH outside the repository root and a malformed `SOCKET_MIN_SEVERITY` (v5.0), `repair --offline --download-only`. `vex` also exits `2` on hard errors before document generation (see its tri-state table below). v5.0: `get`'s self-enforced conflicts exit `2` too (`--id`/`--cve`/`--ghsa`/`--package` multi-select, `--mode hosted\|vendored --save-only`, a malformed identifier for a forced `--id`/`--cve`/`--ghsa`) — previously `1` (MAJOR). The never-implemented `get --one-off` / `rollback --one-off` (and `SOCKET_ONE_OFF`) are removed in v5.0; `--one-off` is now an ordinary unknown-flag clap error. |
 
 `list` returns **`0`** for every project it can read, empty or not (**v5.0, BREAKING**: a project with no manifest and no ledger record — normal for hosted mode, which writes no manifest — used to exit `1` with `manifest_not_found`; it is now an empty list: `No patches in this project. Run \`socket-patch scan\`.` on stdout, and under `--json` the success envelope with `events: []`). Only an unreadable or invalid manifest (`manifest_unreadable` / `manifest_invalid`) exits `1`. Every lock-taking subcommand — including `scan`/`get --mode hosted` as of v5.0 — returns **`1`** with `errorCode: lock_held` when another live socket-patch process holds `<.socket>/apply.lock`.
 
diff --git a/crates/socket-patch-cli/src/commands/get.rs b/crates/socket-patch-cli/src/commands/get.rs
index 16a34a65..e02f3908 100644
--- a/crates/socket-patch-cli/src/commands/get.rs
+++ b/crates/socket-patch-cli/src/commands/get.rs
@@ -2935,7 +2935,7 @@ pub async fn run(args: GetArgs) -> i32 {
     // included, so the listing can still show an installed package's paid
     // fix as `[PAID] (no access)`; selection, the skip records and the
     // JSON envelope only ever see the accessible share.
-    let (accessible, listed, narrow_skips, narrow_warnings) = if narrowing_exempt {
+    let (accessible, listed, narrow_skips, mut narrow_warnings) = if narrowing_exempt {
         let listed: Vec<PatchSearchResult> = search_response.patches.clone();
         (accessible, listed, Vec::new(), Vec::new())
     } else {
@@ -2956,6 +2956,8 @@ pub async fn run(args: GetArgs) -> i32 {
             .collect();
         (kept_accessible, narrowing.kept, skips, narrowing.warnings)
     };
+    // `get` bypasses the repo's socket.yml policy, but says so.
+    narrow_warnings.extend(super::scan::policy::policy_bypass_warnings(&args.common, &accessible));
     // Layout refusals print even when informational output is quieted only
     // by --json (stderr; the envelope carries them too) — but --silent
     // mutes them like scan does.
diff --git a/crates/socket-patch-cli/src/commands/hosted_bundle.rs b/crates/socket-patch-cli/src/commands/hosted_bundle.rs
index 392ac771..277bc104 100644
--- a/crates/socket-patch-cli/src/commands/hosted_bundle.rs
+++ b/crates/socket-patch-cli/src/commands/hosted_bundle.rs
@@ -9,7 +9,8 @@
 //!
 //! Stdin: `{"files": {path: text}, "binaryFiles"?: {path: base64},
 //! "presentOnly"?: [path], "symlinks"?: [path], "projectRoots"?: [dir],
-//! "pipenvMajor"?: n, "batchSize"?: n}`. Stdout: the engine result
+//! "pipenvMajor"?: n, "batchSize"?: n, "noSocketYml"?: bool,
+//! "minSeverity"?: severity, "policyPaths"?: [path]}`. Stdout: the engine result
 //! (`HostedScanResult`, binary contents base64), or
 //! `{"status":"error","error":{"code","message"}}` with exit 2 for bad
 //! credentials/bundle input, or exit 1 for an engine failure.
@@ -53,6 +54,14 @@ struct Bundle {
     pipenv_major: Option<u32>,
     #[serde(default)]
     batch_size: Option<u32>,
+    #[serde(default)]
+    no_socket_yml: Option<bool>,
+    #[serde(default)]
+    min_severity: Option<String>,
+    #[serde(default)]
+    policy_paths: Option<Vec<String>>,
+    #[serde(default)]
+    policy_sha256: Option<String>,
 }
 
 fn print_error(code: &str, message: &str) {
@@ -121,6 +130,10 @@ pub async fn run(args: HostedBundleArgs) -> i32 {
         trust_lockfile_config: Some(!common.no_trust_lockfile_config),
         npm_allow_remote_config: Some(!common.no_npm_allow_remote_config),
         project_roots: bundle.project_roots.clone(),
+        no_socket_yml: bundle.no_socket_yml,
+        min_severity: bundle.min_severity.clone(),
+        policy_paths: bundle.policy_paths.clone(),
+        policy_sha256: bundle.policy_sha256.clone(),
         ..HostedScanOptions::default()
     };
     let input = match build_input(bundle, options) {
diff --git a/crates/socket-patch-cli/src/commands/scan/hosted.rs b/crates/socket-patch-cli/src/commands/scan/hosted.rs
index 6c999e80..078df2b8 100644
--- a/crates/socket-patch-cli/src/commands/scan/hosted.rs
+++ b/crates/socket-patch-cli/src/commands/scan/hosted.rs
@@ -520,11 +520,13 @@ fn gem_sha_key(purl: &str) -> (String, String) {
 /// then rewrite ONLY those dependencies' lockfile/registry-config entries to
 /// point at the hosted vendored patches (the byte-identical counterpart of the
 /// GitHub-app registry mode). No artifact bytes land in the repo.
+#[allow(clippy::too_many_arguments)]
 pub(super) async fn run_redirect(
     args: &ScanArgs,
     api_client: &socket_patch_core::api::client::ApiClient,
     all_packages_with_patches: &[BatchPackagePatches],
     can_access_paid_patches: bool,
+    policy: &super::policy::ScanPolicy,
     // The classic scan object `run` builds for the `--json` path (`Some` in
     // JSON mode, `None` for human output). The redirect result is NESTED into
     // it so the hosted `--json` envelope stays schema-consistent with every
@@ -539,11 +541,11 @@ pub(super) async fn run_redirect(
     npm_prior: Option<&crate::ecosystem_dispatch::NpmCrawlSnapshot>,
 ) -> i32 {
     // Same discovery/selection as `--apply`/`--vendor`.
-    let selected = match discover_selected(
+    let selected: Vec<socket_patch_core::api::types::PatchSearchResult> = match discover_selected(
         api_client,
         all_packages_with_patches,
         can_access_paid_patches,
-        &args.common,
+        policy,
         false,
         false,
         telemetry,
@@ -551,7 +553,7 @@ pub(super) async fn run_redirect(
     )
     .await
     {
-        Ok(s) => s,
+        Ok(offers) => offers.selected.into_values().collect(),
         // Hosted mode has no discovery envelope to fold the message into at
         // this point (it builds its `redirect` result further down).
         // `discover_selected` already printed the message to stderr; a
diff --git a/crates/socket-patch-cli/src/commands/scan/mod.rs b/crates/socket-patch-cli/src/commands/scan/mod.rs
index 38f8fdc6..39dece92 100644
--- a/crates/socket-patch-cli/src/commands/scan/mod.rs
+++ b/crates/socket-patch-cli/src/commands/scan/mod.rs
@@ -32,11 +32,16 @@ use crate::commands::vex::{generate_vex_from_manifest_path, VexEmbedArgs};
 use crate::ecosystem_dispatch::{crawl_ecosystems, crawl_ecosystems_with_npm};
 use crate::ui::{self, plural, print_json, StatusLine};
 
-use super::get::{download_and_apply_patches_with, select_patches, DownloadParams, DownloadRun};
+use super::get::{download_and_apply_patches_with, DownloadParams, DownloadRun};
+
+pub use self::socket_yml_args::{SocketYmlArgs, MIN_SEVERITY_ENV};
+use self::policy::{load_invocation_policy, InvocationPolicy, PolicyLoadError, ScanPolicy};
 
 mod discovery;
 mod gc;
 pub(crate) mod hosted;
+pub(crate) mod policy;
+mod socket_yml_args;
 pub(crate) mod render;
 pub(crate) mod vendor_flow;
 
@@ -332,46 +337,13 @@ pub struct ScanArgs {
     /// VEX makes the command exit non-zero.
     #[command(flatten)]
     pub vex: VexEmbedArgs,
-}
 
-/// Whether a `--package` spec names the package at `purl`: a purl spec
-/// matches the same purl, or any version of it when it carries none; a
-/// bare spec matches the package's full name (`@scope/pkg`, `group/name`)
-/// or its last segment. Qualifiers are ignored and names compare
-/// case-insensitively (PyPI, NuGet and Composer names are case-insensitive;
-/// npm forbids uppercase).
-pub(crate) fn package_spec_matches(spec: &str, purl: &str) -> bool {
-    let decoded = normalize_purl(strip_purl_qualifiers(purl)).to_lowercase();
-    let spec = spec.trim().to_lowercase();
-    if spec.is_empty() {
-        return false;
-    }
-    let Some(rest) = decoded.strip_prefix("pkg:") else {
-        return false;
-    };
-    let Some((_eco, name_version)) = rest.split_once('/') else {
-        return false;
-    };
-    let name = match name_version.rfind('@').filter(|&i| i > 0) {
-        Some(at) => &name_version[..at],
-        None => name_version,
-    };
-    if let Some(spec_rest) = spec.strip_prefix("pkg:") {
-        let spec_purl = normalize_purl(strip_purl_qualifiers(&format!("pkg:{spec_rest}"))).to_lowercase();
-        let spec_rest = &spec_purl[4..];
-        let has_version = spec_rest
-            .split_once('/')
-            .is_some_and(|(_, nv)| nv.rfind('@').is_some_and(|i| i > 0));
-        return if has_version {
-            decoded == spec_purl
-        } else {
-            decoded.strip_prefix(&spec_purl).is_some_and(|tail| tail.starts_with('@'))
-        };
-    }
-    let spec = spec.replace(':', "/");
-    name == spec || name.rsplit('/').next() == Some(spec.as_str())
+    #[command(flatten)]
+    pub socket_yml: SocketYmlArgs,
 }
 
+pub(crate) use socket_patch_core::policy::package_spec_matches;
+
 /// Embedded-VEX side-effect for `scan`'s JSON terminal returns. When
 /// `--vex` was requested and `base_code` is 0, generate the OpenVEX
 /// document from the post-scan manifest and fold the outcome into
@@ -500,9 +472,9 @@ async fn embed_vex_human(
 /// resolve the top-ranked accessible patch per PURL. Per-package search
 /// errors are skipped, but when EVERY query errors the empty set would be
 /// indistinguishable from a genuine "no patches" result, so that surfaces
-/// as `Err(1)` with the failure on stderr. Selects with [`selection_args`]:
-/// scan never prompts, so every run auto-selects the top-ranked patch (see
-/// `api::ranking`) rather than erroring with `selection_required`. `Err`
+/// as `Err(1)` with the failure on stderr. Selects with
+/// [`select_accessible`]: scan never prompts, so every run auto-selects the
+/// top-ranked patch the policy admits (see `api::ranking`). `Err`
 /// carries the exit code AND the message, since JSON callers must fold it
 /// into their single envelope (CLI_CONTRACT.md). `show_progress` / `warn`
 /// are the human-only knobs of [`fetch_patch_details`] (JSON callers pass
@@ -514,12 +486,12 @@ async fn discover_selected(
     api_client: &socket_patch_core::api::client::ApiClient,
     packages: &[BatchPackagePatches],
     can_access_paid_patches: bool,
-    common: &GlobalArgs,
+    policy: &ScanPolicy,
     show_progress: bool,
     warn: bool,
     telemetry: &mut PendingTelemetry,
     json_warnings: Option<&mut serde_json::Value>,
-) -> Result<Vec<PatchSearchResult>, (i32, String)> {
+) -> Result<socket_patch_core::policy::Offers, (i32, String)> {
     let (all_search_results, failures) =
         fetch_patch_details(api_client, packages, show_progress, warn).await;
     // The scan event's send overlapped the detail fetches; every caller's
@@ -539,6 +511,7 @@ async fn discover_selected(
     // Some queries failed, some succeeded: a `--json` run has no stderr
     // warning (`warn` is human-only), so each failed package becomes a
     // run-level `warnings[]` entry — never a silent drop from the envelope.
+    let offers = select_accessible(all_search_results, can_access_paid_patches, policy);
     if let Some(result) = json_warnings {
         for (purl, e) in &failures {
             push_scan_json_warning(
@@ -547,26 +520,24 @@ async fn discover_selected(
                 &format!("could not fetch details for {purl}: {e}"),
             );
         }
+        policy.fold_into_json(result);
     }
-    if all_search_results.is_empty() {
-        return Ok(Vec::new());
-    }
-    if common.json {
-        // Pre-filter to accessible patches so `select_patches` takes the
-        // top-ranked one per PURL.
-        let accessible: Vec<PatchSearchResult> = all_search_results
-            .into_iter()
-            .filter(|p| can_access_paid_patches || p.tier == "free")
-            .collect();
-        return select_patches(&accessible, true, &selection_args(common))
-            .map_err(|code| (code, "patch selection failed".to_string()));
-    }
-    select_patches(
-        &all_search_results,
-        can_access_paid_patches,
-        &selection_args(common),
-    )
-    .map_err(|code| (code, "patch selection failed".to_string()))
+    Ok(offers)
+}
+
+/// The tier filter, then the policy's per-package selection (see
+/// [`ScanPolicy::select`]): scan never prompts, so every package gets its
+/// top-ranked admitted patch (see `api::ranking`).
+fn select_accessible(
+    all_search_results: Vec<PatchSearchResult>,
+    can_access_paid_patches: bool,
+    policy: &ScanPolicy,
+) -> socket_patch_core::policy::Offers {
+    let accessible: Vec<PatchSearchResult> = all_search_results
+        .into_iter()
+        .filter(|p| can_access_paid_patches || p.tier == "free")
+        .collect();
+    policy.select(accessible)
 }
 
 /// `common` for `select_patches`: scan never prompts, so it always takes
@@ -1202,41 +1173,54 @@ pub async fn run(args: ScanArgs) -> i32 {
     // delivered, as with an inline send). The flush here is the
     // backstop that keeps every event ahead of the process exit.
     let mut telemetry = PendingTelemetry::new();
-    let code = Box::pin(run_scan(args, &mut telemetry)).await;
+    let code = Box::pin(run_scan(args, &mut telemetry, None, true)).await;
     telemetry.flush().await;
     code
 }
 
 /// The project directories a hosted or vendored scan's PATHs name: each
 /// PATH is a directory, or a glob matching directories, relative to
-/// `--cwd`. Sorted and deduplicated.
-fn project_dirs(cwd: &Path, paths: &[String]) -> Result<Vec<PathBuf>, String> {
-    let mut dirs: Vec<PathBuf> = Vec::new();
+/// `--cwd`. Sorted and deduplicated; the flag says whether the user named
+/// the directory literally (explicit roots skip the built-in default path
+/// ignores; glob matches are discovered roots).
+fn project_dirs(cwd: &Path, paths: &[String]) -> Result<Vec<(PathBuf, bool)>, String> {
+    let mut dirs: Vec<(PathBuf, bool)> = Vec::new();
     for raw in paths {
         let joined = cwd.join(raw);
         if raw.contains(['*', '?', '[']) {
             let pattern = joined.to_string_lossy().into_owned();
             let matches = glob::glob(&pattern).map_err(|e| format!("invalid path pattern `{raw}`: {e}"))?;
             let before = dirs.len();
-            dirs.extend(matches.filter_map(Result::ok).filter(|p| p.is_dir()));
+            dirs.extend(
+                matches
+                    .filter_map(Result::ok)
+                    .filter(|p| p.is_dir())
+                    .map(|p| (p, false)),
+            );
             if dirs.len() == before {
                 return Err(format!("`{raw}` matches no directory"));
             }
         } else if joined.is_dir() {
-            dirs.push(joined);
+            dirs.push((joined, true));
         } else {
             return Err(format!("`{raw}` is not a directory"));
         }
     }
-    dirs.sort();
-    dirs.dedup();
+    // A directory both named and matched counts as named.
+    dirs.sort_by(|a, b| a.0.cmp(&b.0).then(b.1.cmp(&a.1)));
+    dirs.dedup_by(|later, earlier| later.0 == earlier.0);
     Ok(dirs)
 }
 
 /// Run a hosted or vendored scan once per project directory its PATHs
 /// name, as if each were `--cwd`. The exit code is the worst of the runs.
-/// `--json` takes one directory, so stdout stays one document.
-async fn run_project_dirs(args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
+/// `--json` takes one directory, so stdout stays one document. Every
+/// directory must be inside the repository root the policy was read from.
+async fn run_project_dirs(
+    args: ScanArgs,
+    telemetry: &mut PendingTelemetry,
+    invocation: &InvocationPolicy,
+) -> i32 {
     let dirs = match project_dirs(&args.common.cwd, &args.paths) {
         Ok(dirs) => dirs,
         Err(message) => {
@@ -1244,6 +1228,21 @@ async fn run_project_dirs(args: ScanArgs, telemetry: &mut PendingTelemetry) -> i
             return 2;
         }
     };
+    if !args.common.is_global() {
+        for (dir, _) in &dirs {
+            let resolved = std::fs::canonicalize(dir).unwrap_or_else(|_| dir.clone());
+            if !resolved.starts_with(&invocation.repo_root) {
+                eprintln!(
+                    "Error: `{}` is outside {} (the repository root socket.yml is read \
+                     from; without a trusted .git it is --cwd): run one scan per repository, \
+                     or pass --cwd at a common parent",
+                    dir.display(),
+                    invocation.repo_root.display()
+                );
+                return 2;
+            }
+        }
+    }
     if args.common.json && dirs.len() > 1 {
         eprintln!(
             "Error: --json takes one project directory ({} given); run one scan per directory",
@@ -1252,7 +1251,7 @@ async fn run_project_dirs(args: ScanArgs, telemetry: &mut PendingTelemetry) -> i
         return 2;
     }
     let mut code = 0;
-    for dir in &dirs {
+    for (dir, explicit) in &dirs {
         if dirs.len() > 1 && !args.common.silent {
             let shown = dir.strip_prefix(&args.common.cwd).unwrap_or(dir);
             println!("\n== {} ==", shown.display());
@@ -1260,12 +1259,29 @@ async fn run_project_dirs(args: ScanArgs, telemetry: &mut PendingTelemetry) -> i
         let mut child = args.clone();
         child.paths.clear();
         child.common.cwd = dir.clone();
-        code = code.max(Box::pin(run_scan(child, telemetry)).await);
+        code = code.max(Box::pin(run_scan(child, telemetry, Some(invocation), *explicit)).await);
     }
     code
 }
 
-async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
+/// Print a policy file that cannot be honored (fail closed, exit 1).
+fn report_policy_error(err: &socket_patch_core::policy::PolicyError, args: &ScanArgs) -> i32 {
+    if args.common.json {
+        print_json(&policy::policy_error_json(err, &args.paths));
+    } else {
+        eprintln!("Error ({}): {err}", err.code());
+    }
+    1
+}
+
+/// `invocation` is the policy a PATH-list parent already loaded (`None`
+/// loads it here); `explicit` says whether the user named this root.
+async fn run_scan(
+    mut args: ScanArgs,
+    telemetry: &mut PendingTelemetry,
+    invocation: Option<&InvocationPolicy>,
+    explicit: bool,
+) -> i32 {
     apply_env_toggles(&args.common);
 
     // Fold the legacy mode booleans into `args.mode` (see
@@ -1277,14 +1293,39 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         return 2;
     }
 
+    // The repo's socket.yml policy, read once per invocation before any
+    // write (an invalid file fails the run closed).
+    let loaded;
+    let invocation = match invocation {
+        Some(invocation) => invocation,
+        None => match load_invocation_policy(&args) {
+            Ok(i) => {
+                loaded = i;
+                &loaded
+            }
+            Err(PolicyLoadError::Usage(message)) => {
+                eprintln!("Error: {message}");
+                return 2;
+            }
+            Err(PolicyLoadError::Policy(err)) => return report_policy_error(&err, &args),
+        },
+    };
+
     // Hosted and vendored modes rewire a project's lockfiles, so their
     // PATHs name project directories: one scan per directory.
     if matches!(args.mode, Some(ScanMode::Hosted) | Some(ScanMode::Vendored))
         && !args.paths.is_empty()
     {
-        return Box::pin(run_project_dirs(args, telemetry)).await;
+        return Box::pin(run_project_dirs(args, telemetry, invocation)).await;
     }
 
+    let mut policy = Box::new(ScanPolicy::for_root(
+        invocation,
+        &args.common.cwd,
+        explicit,
+        args.common.is_global(),
+    ));
+
     // Positional PATH globs (see `ScanArgs::paths`). An unparseable glob
     // is a usage error, same exit-2 shape as the mode conflicts.
     let path_scope = match crate::path_scope::PathScope::parse(&args.paths) {
@@ -1315,7 +1356,8 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
     let apply = args.mode == Some(ScanMode::Agent);
     let vendor = args.mode == Some(ScanMode::Vendored);
     let hosted = args.mode == Some(ScanMode::Hosted);
-    let prune = args.prune || args.sync;
+    // `patches.enabled: false` writes nothing, the GC included.
+    let prune = (args.prune || args.sync) && policy.writes_allowed();
 
     // Hosted mode runs no GC: say so once up front on the human path. The
     // `--json` path carries it in `redirect.warnings[]`.
@@ -1436,6 +1478,33 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         .map(VendorState::purl_keys)
         .unwrap_or_default();
 
+    // Read existing manifest once for update detection.
+    let existing_manifest = ctx.ledgers().await.manifest;
+    // Hosted mode records its patches ONLY in the lockfiles (v5 keeps no
+    // hosted ledger) and vendored mode ONLY in its ledger, so the hosted
+    // pins and the vendor ledger's purl→uuid records are folded into update
+    // detection (otherwise their `updates[]` would stay empty). The same
+    // merged view is the policy's recorded state (the retained set).
+    let hosted_pin_list: Vec<socket_patch_core::patch::redirect::upstream::HostedPin> =
+        if args.common.is_global() {
+            Vec::new()
+        } else {
+            socket_patch_core::patch::redirect::upstream::HostedPin::all(ctx.discovery().await)
+        };
+    let hosted_state = (!args.common.is_global())
+        .then(|| crate::commands::hosted_state_from_pins(&hosted_pin_list));
+    let redirect_state = hosted_state.as_ref();
+    let hosted_pins: Vec<(String, String)> = hosted_pin_list
+        .iter()
+        .map(|pin| (pin.purl.clone(), pin.uuid.clone()))
+        .collect();
+    let update_manifest = merge_ledger_records_for_updates(
+        existing_manifest,
+        vendor_state.as_ref().ok(),
+        &hosted_pins,
+    );
+    policy.set_recorded(update_manifest.as_deref());
+
     // Filter by --ecosystems if provided
     let filtered_crawled: Vec<_> = all_crawled
         .into_iter()
@@ -1498,6 +1567,13 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
             .collect()
     };
 
+    // The socket.yml root/ecosystem/package filters, after the flags
+    // (which only narrow further) and after the prune-universe capture.
+    let filtered_crawled: Vec<_> = filtered_crawled
+        .into_iter()
+        .filter(|pkg| policy.admit_crawled(&pkg.purl))
+        .collect();
+
     let all_purls: Vec<String> = filtered_crawled.iter().map(|p| p.purl.clone()).collect();
     let package_count = all_purls.len();
 
@@ -1507,6 +1583,7 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
             for (_, detail) in &layout_refusals {
                 eprintln!("Warning: {detail}");
             }
+            policy.print_warnings(args.common.silent);
             // Hosted mode already printed its own prune-ignored warning.
             if prune && !hosted {
                 eprintln!("{}", render::PRUNE_SKIPPED_EMPTY);
@@ -1553,6 +1630,7 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
             if !layout_refusals.is_empty() {
                 result["warnings"] = layout_refusal_json(&layout_refusals);
             }
+            policy.fold_into_json(&mut result);
             // Hosted mode: a no-op `redirect` block keeps the envelope
             // schema-consistent with the ≥1-package path.
             if hosted {
@@ -1587,14 +1665,18 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
             print_json(&result);
             return code;
         } else if !args.common.silent {
-            println!(
-                "{}",
-                render::no_packages_message(
-                    args.common.is_global(),
-                    args.common.ecosystems.as_deref(),
-                    &args.paths,
-                )
-            );
+            // A project the policy skipped as a whole is not an empty one.
+            if !policy.root_excluded() {
+                println!(
+                    "{}",
+                    render::no_packages_message(
+                        args.common.is_global(),
+                        args.common.ecosystems.as_deref(),
+                        &args.paths,
+                    )
+                );
+            }
+            policy.print_human(args.common.silent, args.common.verbose);
         }
         return embed_vex_human(&args.common, &args.vex, &manifest_path, 0).await;
     }
@@ -1632,6 +1714,7 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         for (_, detail) in &layout_refusals {
             eprintln!("Warning: {detail}");
         }
+        policy.print_warnings(args.common.silent);
     }
 
     // Query API in batches
@@ -1833,31 +1916,8 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         telemetry_org.as_deref(),
     );
 
-    // Read existing manifest once for update detection.
-    let existing_manifest = ctx.ledgers().await.manifest;
-    // Hosted mode records its patches ONLY in the lockfiles (v5 keeps no
-    // hosted ledger) and vendored mode ONLY in its ledger, so the hosted
-    // pins and the vendor ledger's purl→uuid records are folded into update
-    // detection (otherwise their `updates[]` would stay empty).
-    let hosted_pin_list: Vec<socket_patch_core::patch::redirect::upstream::HostedPin> =
-        if args.common.is_global() {
-            Vec::new()
-        } else {
-            socket_patch_core::patch::redirect::upstream::HostedPin::all(ctx.discovery().await)
-        };
-    let hosted_state = (!args.common.is_global())
-        .then(|| crate::commands::hosted_state_from_pins(&hosted_pin_list));
-    let redirect_state = hosted_state.as_ref();
-    let hosted_pins: Vec<(String, String)> = hosted_pin_list
-        .iter()
-        .map(|pin| (pin.purl.clone(), pin.uuid.clone()))
-        .collect();
-    let update_manifest = merge_ledger_records_for_updates(
-        existing_manifest,
-        vendor_state.as_ref().ok(),
-        &hosted_pins,
-    );
     let updates = detect_updates(update_manifest.as_deref(), &all_packages_with_patches);
+    policy.set_update_purls(updates.iter().map(|u| u.purl.as_str()));
 
     // The hosted-wiring probes below take `all_purls` (POST-filter: only
     // packages this run covered), unlike the PRE-filter `scanned_purls`
@@ -1892,6 +1952,7 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
             let detail = line.strip_prefix("Warning: ").unwrap_or(&line);
             push_scan_json_warning(&mut result, API_BATCH_FAILED, detail);
         }
+        policy.fold_into_json(&mut result);
         // Flag lockfile-only packages (additive; absent means installed).
         // `normalize_purl` bridges the API's percent-encoded spelling to the
         // supplement's literal form.
@@ -1916,6 +1977,7 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
                 &api_client,
                 &all_packages_with_patches,
                 can_access_paid_patches,
+                &policy,
                 Some(result),
                 telemetry,
                 npm_crawl.as_ref(),
@@ -1942,13 +2004,34 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         let dry = args.common.dry_run;
         let mut apply_code = 0i32;
 
+        // A report-only run selects nothing, but a severity floor or
+        // `enabled: false` still hides candidates; report them like the
+        // human arm does (the detail fetch runs only then).
+        if !apply && !vendor && policy.reports_selection() && !all_packages_with_patches.is_empty() {
+            if let Err((code, message)) = discover_selected(
+                &api_client,
+                &all_packages_with_patches,
+                can_access_paid_patches,
+                &policy,
+                false,
+                false,
+                telemetry,
+                Some(&mut result),
+            )
+            .await
+            {
+                emit_discovery_error_json(&mut result, &message);
+                return code;
+            }
+        }
+
         // --- Apply path (if requested) -----------------------------------
         if apply {
-            let selected = match discover_selected(
+            let selected: Vec<PatchSearchResult> = match discover_selected(
                 &api_client,
                 &all_packages_with_patches,
                 can_access_paid_patches,
-                &args.common,
+                &policy,
                 false,
                 false,
                 telemetry,
@@ -1956,7 +2039,7 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
             )
             .await
             {
-                Ok(s) => s,
+                Ok(offers) => offers.selected.into_values().collect(),
                 Err((code, message)) => {
                     emit_discovery_error_json(&mut result, &message);
                     return code;
@@ -2068,6 +2151,7 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
                 use_public_proxy,
                 &all_packages_with_patches,
                 can_access_paid_patches,
+                &policy,
                 &mut result,
                 &manifest_path,
                 &socket_dir,
@@ -2124,7 +2208,9 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
     // the embedded VEX. An early "nothing to apply" exit still runs the GC.
     let (args_ref, manifest_ref, socket_ref) = (&args, &manifest_path, &socket_dir);
     let (scanned_ref, vendored_ref) = (&scanned_purls, &vendored_purls);
+    let policy_ref: &ScanPolicy = &policy;
     let finish_human = move |code: i32| async move {
+        policy_ref.print_human(silent, verbose);
         if prune && !vendor && !hosted && code == 0 {
             gc::run_human_gc(
                 &args_ref.common,
@@ -2292,11 +2378,11 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
     // engine (the same entry as `get --mode hosted`) — it must NOT fall
     // through to the apply/vendor branches.
     if hosted {
-        let selected = match discover_selected(
+        let selected: Vec<PatchSearchResult> = match discover_selected(
             &api_client,
             &all_packages_with_patches,
             can_access_paid_patches,
-            &args.common,
+            &policy,
             human,
             !silent,
             telemetry,
@@ -2304,12 +2390,13 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
         )
         .await
         {
-            Ok(s) => s,
+            Ok(offers) => offers.selected.into_values().collect(),
             // `discover_selected` already printed the failure to stderr.
             Err((code, _)) => {
                 return code;
             }
         };
+        policy.print_human(silent, verbose);
         let pairs: Vec<(String, String)> = selected
             .iter()
             .map(|s| (s.purl.clone(), s.uuid.clone()))
@@ -2341,14 +2428,13 @@ async fn run_scan(mut args: ScanArgs, telemetry: &mut PendingTelemetry) -> i32 {
     // `resolve_mode_flags`) only reports, plus the `--prune` GC.
     let report_only = args.mode.is_none();
 
-    // Scan always takes the top-ranked patch (see `selection_args`).
-    let mut select_common = selection_args(&args.common);
-    select_common.silent |= report_only;
+    // Scan always takes the top-ranked patch the policy admits.
     let selected: Vec<PatchSearchResult> =
-        match select_patches(&all_search_results, can_access_paid_patches, &select_common) {
-            Ok(s) => s,
-            Err(code) => return code,
-        };
+        select_accessible(all_search_results, can_access_paid_patches, &policy)
+            .selected
+            .into_values()
+            .collect();
+    policy.print_human(silent, verbose);
 
     // The skip / already-recorded lines below open their own paragraph
     // under the table's Summary: one blank line before the first of them.
@@ -2610,14 +2696,27 @@ mod tests {
             std::fs::create_dir_all(tmp.path().join(d)).unwrap();
         }
         std::fs::write(tmp.path().join("apps/README"), "").unwrap();
-        let rel = |dirs: Vec<PathBuf>| -> Vec<String> {
+        let rel = |dirs: Vec<(PathBuf, bool)>| -> Vec<(String, bool)> {
             dirs.iter()
-                .map(|d| d.strip_prefix(tmp.path()).unwrap().to_string_lossy().replace('\\', "/"))
+                .map(|(d, explicit)| {
+                    (
+                        d.strip_prefix(tmp.path()).unwrap().to_string_lossy().replace('\\', "/"),
+                        *explicit,
+                    )
+                })
                 .collect()
         };
         let got = project_dirs(tmp.path(), &["apps/*".into(), "libs/core".into(), "apps/web".into()])
             .unwrap();
-        assert_eq!(rel(got), ["apps/api", "apps/web", "libs/core"]);
+        // Named literally = explicit (also when a glob matches it too).
+        assert_eq!(
+            rel(got),
+            [
+                ("apps/api".to_string(), false),
+                ("apps/web".to_string(), true),
+                ("libs/core".to_string(), true)
+            ]
+        );
         assert!(project_dirs(tmp.path(), &["apps/README".into()])
             .unwrap_err()
             .contains("is not a directory"));
@@ -2986,20 +3085,6 @@ mod tests {
         );
     }
 
-    #[test]
-    fn selection_args_never_prompts() {
-        for common in [
-            GlobalArgs::default(),
-            GlobalArgs {
-                json: true,
-                ..GlobalArgs::default()
-            },
-        ] {
-            let picked = selection_args(&common);
-            assert!(!picked.json && picked.yes, "scan always takes the top patch");
-        }
-    }
-
     #[test]
     fn takeover_detail_names_package_and_remediation() {
         let purls = vec!["pkg:npm/minimist@1.2.2".to_string()];
diff --git a/crates/socket-patch-cli/src/commands/scan/policy.rs b/crates/socket-patch-cli/src/commands/scan/policy.rs
new file mode 100644
index 00000000..0cd466bf
--- /dev/null
+++ b/crates/socket-patch-cli/src/commands/scan/policy.rs
@@ -0,0 +1,550 @@
+//! Disk `scan`'s side of the socket.yml patch policy: loading it once per
+//! invocation, the per-root and per-package filters, the severity floor in
+//! selection, the retained set, and the `policy` JSON block / human line.
+//! The policy itself lives in `socket_patch_core::policy`.
+
+use std::collections::{BTreeMap, BTreeSet, HashMap, HashSet};
+use std::path::{Path, PathBuf};
+use std::sync::Mutex;
+
+use socket_patch_core::api::ranking::cmp_search_results;
+use socket_patch_core::api::types::PatchSearchResult;
+use socket_patch_core::manifest::schema::PatchManifest;
+use socket_patch_core::policy::{
+    canon, find_repo_root_with_warnings, policy_block, FilteredEntry, RetainedEntry, patch_severity_order, repo_relative_checked, sanitize, severity_name,
+    DiskPolicyFs, FilterReason, Offers, PolicyError, PolicySource, PolicyWarning, Root, SelectionPolicy,
+    PATCHES_DISABLED,
+};
+use socket_patch_core::utils::purl::normalize_purl;
+
+use super::ScanArgs;
+use crate::hosted_memory::roots::{marker_ecosystem, UNSUPPORTED_MARKERS};
+
+/// Why the policy could not be loaded.
+pub(crate) enum PolicyLoadError {
+    /// A malformed flag or env value: exit 2.
+    Usage(String),
+    /// A policy file that cannot be honored: exit 1, `errorCode`.
+    Policy(PolicyError),
+}
+
+/// The invocation's policy: loaded once, shared by every project
+/// directory a PATH list names.
+pub(crate) struct InvocationPolicy {
+    pub policy: SelectionPolicy,
+    pub repo_root: PathBuf,
+    pub warnings: Vec<PolicyWarning>,
+    /// Set once the invocation's warnings were printed (a PATH list runs
+    /// one scan per directory; the file was read once).
+    pub warned: std::sync::atomic::AtomicBool,
+}
+
+/// Load the policy for `args` (4.5): `--global` scans have no repo and read
+/// no file; everything else reads the repo root's socket.yml.
+pub(crate) fn load_invocation_policy(args: &ScanArgs) -> Result<InvocationPolicy, PolicyLoadError> {
+    let overrides = args.socket_yml.overrides().map_err(PolicyLoadError::Usage)?;
+    let cwd = std::fs::canonicalize(&args.common.cwd).unwrap_or_else(|_| args.common.cwd.clone());
+    if args.common.is_global() {
+        let policy = SelectionPolicy::load(&socket_patch_core::policy::MemoryPolicyFs::default(), &overrides)
+            .map_err(PolicyLoadError::Policy)?
+            .0;
+        return Ok(InvocationPolicy {
+            policy,
+            repo_root: cwd,
+            warnings: Vec::new(),
+            warned: Default::default(),
+        });
+    }
+    let (repo_root, mut warnings) = find_repo_root_with_warnings(&cwd);
+    let (policy, load_warnings) =
+        SelectionPolicy::load(&DiskPolicyFs::new(&repo_root), &overrides).map_err(PolicyLoadError::Policy)?;
+    warnings.extend(load_warnings);
+    Ok(InvocationPolicy {
+        policy,
+        repo_root,
+        warnings,
+        warned: Default::default(),
+    })
+}
+
+/// The marker files of a disk project root: the same lock markers the
+/// in-memory engine detects roots by, plus the maven/nuget markers disk
+/// scans support. Manifests are not markers (so both engines agree).
+pub(crate) fn dir_markers(dir: &Path) -> Vec<String> {
+    let mut markers: Vec<String> = std::fs::read_dir(dir)
+        .map(|entries| {
+            entries
+                .filter_map(|e| e.ok())
+                .filter(|e| e.file_type().is_ok_and(|t| t.is_file() || t.is_symlink()))
+                .filter_map(|e| e.file_name().into_string().ok())
+                .filter(|name| {
+                    marker_ecosystem(name).is_some()
+                        || UNSUPPORTED_MARKERS
+                            .iter()
+                            .any(|(_, names)| names.contains(&name.as_str()))
+                })
+                .collect()
+        })
+        .unwrap_or_default();
+    if markers.is_empty() {
+        // No lockfile: the manifests say what the project is.
+        markers = MANIFEST_MARKERS
+            .iter()
+            .filter(|name| dir.join(name).is_file())
+            .map(|name| name.to_string())
+            .collect();
+    }
+    markers.sort();
+    markers
+}
+
+/// Manifests that stand in as markers for a root with no lockfile.
+const MANIFEST_MARKERS: [&str; 8] = [
+    "package.json",
+    "pyproject.toml",
+    "setup.py",
+    "Cargo.toml",
+    "composer.json",
+    "Gemfile",
+    "pom.xml",
+    "build.gradle",
+];
+
+#[derive(Default)]
+struct Report {
+    filtered: Vec<FilteredEntry>,
+    retained: Vec<RetainedEntry>,
+    retained_purls: BTreeSet<String>,
+    filtered_purls: HashSet<String>,
+    update_purls: HashSet<String>,
+    human_printed: bool,
+}
+
+/// One project root's view of the invocation policy (disk scans run one
+/// root per `run_scan`).
+pub(crate) struct ScanPolicy {
+    pub policy: SelectionPolicy,
+    pub warnings: Vec<PolicyWarning>,
+    /// Print [`Self::warnings`] on the human path (first root only).
+    announce_warnings: bool,
+    /// Repo-relative root directory (`""` for the repo root).
+    pub project: String,
+    /// The root filter's verdict (`Ok` for global scans).
+    root_verdict: Result<(), FilterReason>,
+    /// Recorded patches of this root: canonical purl → uuid.
+    recorded: HashMap<String, String>,
+    report: Mutex<Report>,
+}
+
+impl ScanPolicy {
+    /// The policy for the project rooted at `root_dir`.
+    pub(crate) fn for_root(invocation: &InvocationPolicy, root_dir: &Path, explicit: bool, global: bool) -> Self {
+        let root_dir = std::fs::canonicalize(root_dir).unwrap_or_else(|_| root_dir.to_path_buf());
+        let project = repo_relative_checked(&invocation.repo_root, &root_dir).unwrap_or_default();
+        let root_verdict = if global {
+            Ok(())
+        } else {
+            let markers = dir_markers(&root_dir);
+            invocation.policy.admits_root(&Root {
+                rel_dir: &project,
+                markers: &markers,
+                explicit,
+            })
+        };
+        let mut warnings = invocation.warnings.clone();
+        if !invocation.policy.enabled() {
+            warnings.push(PolicyWarning {
+                code: PATCHES_DISABLED,
+                detail: "patches.enabled is false in socket.yml: report only, nothing is written \
+                         (existing patches stay in place; the --prune GC is skipped too)"
+                    .to_string(),
+            });
+        }
+        let mut report = Report::default();
+        // A root filtered as a whole is one entry, whatever it holds.
+        if let Err(reason) = &root_verdict {
+            report.filtered.push(FilteredEntry {
+                purl: None,
+                uuid: None,
+                project: project.clone(),
+                reason: reason.clone(),
+                severity: None,
+            });
+        }
+        let announce_warnings = !invocation.warned.swap(true, std::sync::atomic::Ordering::Relaxed);
+        Self {
+            policy: invocation.policy.clone(),
+            warnings,
+            announce_warnings,
+            project,
+            root_verdict,
+            recorded: HashMap::new(),
+            report: Mutex::new(report),
+        }
+    }
+
+    /// Whether selection can filter anything (a floor, or patching
+    /// disabled): report-only runs select only for the report then.
+    pub(crate) fn reports_selection(&self) -> bool {
+        !self.policy.enabled() || self.policy.min_severity().0.is_some()
+    }
+
+    /// Whether the policy filtered this whole project root.
+    pub(crate) fn root_excluded(&self) -> bool {
+        self.root_verdict.is_err()
+    }
+
+    fn report(&self) -> std::sync::MutexGuard<'_, Report> {
+        self.report.lock().unwrap_or_else(|e| e.into_inner())
+    }
+
+    /// Whether anything may be written this run.
+    pub(crate) fn writes_allowed(&self) -> bool {
+        self.policy.enabled()
+    }
+
+    /// Set the merged recorded view (manifest > hosted pins > vendor ledger).
+    pub(crate) fn set_recorded(&mut self, merged: Option<&PatchManifest>) {
+        self.recorded = merged
+            .map(|m| {
+                m.patches
+                    .iter()
+                    .map(|(purl, record)| (canon(purl), record.uuid.clone()))
+                    .collect()
+            })
+            .unwrap_or_default();
+    }
+
+    fn recorded_uuid(&self, purl: &str) -> Option<&str> {
+        self.recorded.get(&canon(purl)).map(String::as_str)
+    }
+
+    /// Step 3: the root, ecosystem and package filters. Returns whether the
+    /// package stays in the batch query. A recorded package the filters
+    /// exclude stays in the query (so `upgradeAvailable` can be reported)
+    /// but joins the retained set, which never reaches a writer.
+    pub(crate) fn admit_crawled(&self, purl: &str) -> bool {
+        let verdict = self.root_verdict.clone().and_then(|()| self.policy.admits_purl(purl));
+        let reason = match verdict {
+            Ok(()) => return true,
+            Err(reason) => reason,
+        };
+        let mut report = self.report();
+        if let Some(uuid) = self.recorded_uuid(purl) {
+            let key = canon(purl);
+            if report.retained_purls.insert(key.clone()) {
+                report.retained.push(RetainedEntry {
+                    purl: key,
+                    project: self.project.clone(),
+                    recorded_uuid: uuid.to_string(),
+                    reason,
+                    upgrade_available: false,
+                });
+            }
+            return true;
+        }
+        if self.root_verdict.is_err() {
+            // Already reported as the root's one entry.
+        } else if report.filtered_purls.insert(canon(purl)) {
+            report.filtered.push(FilteredEntry {
+                purl: Some(canon(purl)),
+                uuid: None,
+                project: self.project.clone(),
+                reason,
+                severity: None,
+            });
+        }
+        false
+    }
+
+    /// Record the purls with a newer patch (`updates[]`), for
+    /// `retained[].upgradeAvailable`.
+    pub(crate) fn set_update_purls<'a>(&self, purls: impl IntoIterator<Item = &'a str>) {
+        self.report().update_purls = purls.into_iter().map(canon).collect();
+    }
+
+    /// Steps 5-6: group the tier-accessible offers, keep retained packages
+    /// out, apply the severity floor and pick one patch per package with
+    /// the canonical ranking. With no floor the result is exactly today's
+    /// top-ranked selection. The floor never moves a package off its
+    /// recorded patch unless an admitted patch outranks the recorded one,
+    /// and a recorded package with nothing above the floor keeps its patch.
+    pub(crate) fn select(&self, accessible: Vec<PatchSearchResult>) -> Offers {
+        let mut grouped: BTreeMap<String, Vec<PatchSearchResult>> = BTreeMap::new();
+        {
+            let report = self.report();
+            for offer in accessible {
+                if report.retained_purls.contains(&canon(&offer.purl)) {
+                    continue;
+                }
+                grouped.entry(offer.purl.clone()).or_default().push(offer);
+            }
+        }
+        for group in grouped.values_mut() {
+            group.sort_by(cmp_search_results);
+        }
+        let mut offers = Offers {
+            unfiltered: BTreeMap::new(),
+            selected: BTreeMap::new(),
+        };
+        let mut report = self.report();
+        for (purl, group) in grouped {
+            let recorded = self.recorded_uuid(&purl).map(str::to_string);
+            if !self.policy.enabled() {
+                let reason = FilterReason::Disabled;
+                match recorded {
+                    Some(uuid) => {
+                        let key = canon(&purl);
+                        if report.retained_purls.insert(key.clone()) {
+                            report.retained.push(RetainedEntry {
+                                purl: key,
+                                project: self.project.clone(),
+                                recorded_uuid: uuid,
+                                reason,
+                                upgrade_available: false,
+                            });
+                        }
+                    }
+                    None => report.filtered.push(FilteredEntry {
+                        purl: Some(canon(&purl)),
+                        uuid: Some(group[0].uuid.clone()),
+                        project: self.project.clone(),
+                        severity: Some(patch_severity_order(&group[0])),
+                        reason,
+                    }),
+                }
+                continue;
+            }
+            let floor_winner = group
+                .iter()
+                .position(|p| self.policy.admits_severity(patch_severity_order(p)).is_ok());
+            let recorded_at = recorded
+                .as_deref()
+                .and_then(|uuid| group.iter().position(|p| p.uuid == uuid));
+            let chosen = match (recorded.is_some(), floor_winner, recorded_at) {
+                // The recorded patch outranks every admitted one: keep it.
+                (true, Some(w), Some(r)) if r < w => Some(r),
+                (_, Some(w), _) => Some(w),
+                // Nothing above the floor: a recorded package keeps its patch.
+                (true, None, Some(r)) => Some(r),
+                (_, None, _) => None,
+            };
+            // What the floor hid is reported: the top-ranked patch it withheld
+            // when the package ends up unpatched or held at its recorded patch
+            // (not when a lower-ranked admitted patch simply wins).
+            let top_withheld = self.policy.admits_severity(patch_severity_order(&group[0]));
+            if let Err(reason) = top_withheld {
+                let upgrade_withheld = chosen.is_some() && chosen == recorded_at && recorded_at != Some(0);
+                if chosen.is_none() || upgrade_withheld {
+                    report.filtered.push(FilteredEntry {
+                        purl: Some(canon(&purl)),
+                        uuid: Some(group[0].uuid.clone()),
+                        project: self.project.clone(),
+                        severity: Some(patch_severity_order(&group[0])),
+                        reason,
+                    });
+                }
+            }
+            if let Some(i) = chosen {
+                offers.selected.insert(purl.clone(), group[i].clone());
+            }
+            offers.unfiltered.insert(purl, group);
+        }
+        offers
+    }
+
+    /// The top-level `policy` block (4.7).
+    pub(crate) fn json(&self) -> serde_json::Value {
+        let report = self.report();
+        let retained: Vec<RetainedEntry> = report
+            .retained
+            .iter()
+            .map(|r| RetainedEntry {
+                upgrade_available: report.update_purls.contains(&r.purl),
+                ..r.clone()
+            })
+            .collect();
+        policy_block(&self.policy, &report.filtered, &retained)
+    }
+
+    /// Put the `policy` block and the policy warnings on a scan `--json`
+    /// result (idempotent: the block is rebuilt, warnings added once).
+    pub(crate) fn fold_into_json(&self, result: &mut serde_json::Value) {
+        result["policy"] = self.json();
+        let warnings = result
+            .as_object_mut()
+            .expect("scan JSON result is an object")
+            .entry("warnings")
+            .or_insert_with(|| serde_json::json!([]));
+        if let Some(arr) = warnings.as_array_mut() {
+            for w in &self.warnings {
+                let present = arr
+                    .iter()
+                    .any(|e| e["code"] == w.code && e["detail"] == w.detail.as_str());
+                if !present {
+                    arr.push(serde_json::json!({ "code": w.code, "detail": w.detail }));
+                }
+            }
+            if arr.is_empty() {
+                result.as_object_mut().map(|o| o.remove("warnings"));
+            }
+        }
+    }
+
+    /// Print the policy warnings (stderr) once, human path.
+    pub(crate) fn print_warnings(&self, silent: bool) {
+        if silent || !self.announce_warnings {
+            return;
+        }
+        for w in &self.warnings {
+            eprintln!("Warning: {}", w.detail);
+        }
+    }
+
+    /// The human policy line (stdout), printed at most once per root: the
+    /// counts, then every filtered critical/high candidate by name (a
+    /// policy must not hide those silently), or every entry with
+    /// `--verbose`.
+    pub(crate) fn print_human(&self, silent: bool, verbose: bool) {
+        let mut report = self.report();
+        if silent || std::mem::replace(&mut report.human_printed, true) {
+            return;
+        }
+        let filtered = report.filtered.len();
+        let retained = report.retained.len();
+        if filtered == 0 && retained == 0 && self.policy.enabled() {
+            return;
+        }
+        let label = match self.policy.source() {
+            PolicySource::File { path, .. } => format!("Policy ({path})"),
+            PolicySource::Bypassed => "Policy (socket.yml ignored)".to_string(),
+            PolicySource::None => "Policy (built-in defaults)".to_string(),
+        };
+        let mut line = format!(
+            "\n{label}: {} skipped by filters, {} held.",
+            filtered,
+            crate::ui::plural(retained, "patched package", "patched packages")
+        );
+        if !self.policy.enabled() {
+            line.push_str(" Patching is disabled (patches.enabled: false).");
+        }
+        println!("{line}");
+        let mut entries: Vec<&FilteredEntry> = report.filtered.iter().collect();
+        entries.sort_by(|a, b| (&a.project, &a.purl).cmp(&(&b.project, &b.purl)));
+        for f in entries {
+            // A skipped project and a withheld critical/high patch are always
+            // named; everything else only with --verbose.
+            let severe = f.severity.is_some_and(|s| s <= 1);
+            if !(verbose || severe || f.purl.is_none()) {
+                continue;
+            }
+            let what = match &f.purl {
+                Some(purl) => sanitize(&normalize_purl(purl)),
+                None if self.project.is_empty() => "this project".to_string(),
+                None => format!("project {}", sanitize(&self.project)),
+            };
+            let severity = f
+                .severity
+                .and_then(severity_name)
+                .map(|s| format!(" ({s})"))
+                .unwrap_or_default();
+            println!("  skipped {what}{severity}: {}", f.reason.detail());
+        }
+        if verbose {
+            for r in &report.retained {
+                println!(
+                    "  held {} at {}: {}",
+                    sanitize(&normalize_purl(&r.purl)),
+                    sanitize(&r.recorded_uuid),
+                    r.reason.detail()
+                );
+            }
+        }
+    }
+}
+
+/// The JSON error object for a policy file that cannot be honored: scan's
+/// error shape plus `errorCode`.
+pub(crate) fn policy_error_json(err: &PolicyError, paths: &[String]) -> serde_json::Value {
+    serde_json::json!({
+        "status": "error",
+        "error": err.to_string(),
+        "errorCode": err.code(),
+        "scannedPackages": 0,
+        "lockfileOnlyPackages": 0,
+        "packagesWithPatches": 0,
+        "totalPatches": 0,
+        "freePatches": 0,
+        "paidPatches": 0,
+        "canAccessPaidPatches": false,
+        "packages": [],
+        "updates": [],
+        "paths": paths,
+    })
+}
+
+/// `get`'s `policy_bypassed` warnings: `get` is explicit intent, so it
+/// ignores the policy, but says when the repo's socket.yml would have
+/// filtered what it is about to patch. Never fails: an unreadable or
+/// invalid file just yields no warning.
+pub(crate) fn policy_bypass_warnings(
+    common: &crate::args::GlobalArgs,
+    patches: &[PatchSearchResult],
+) -> Vec<(String, String)> {
+    if common.is_global() || patches.is_empty() {
+        return Vec::new();
+    }
+    let cwd = std::fs::canonicalize(&common.cwd).unwrap_or_else(|_| common.cwd.clone());
+    let (repo_root, _) = find_repo_root_with_warnings(&cwd);
+    let Ok((policy, _)) = SelectionPolicy::load(
+        &DiskPolicyFs::new(&repo_root),
+        &socket_patch_core::policy::PolicyOverrides::default(),
+    ) else {
+        return Vec::new();
+    };
+    if !matches!(policy.source(), PolicySource::File { .. }) {
+        return Vec::new();
+    }
+    let project = repo_relative_checked(&repo_root, &cwd).unwrap_or_default();
+    let markers = dir_markers(&cwd);
+    let root_verdict = policy.admits_root(&Root {
+        rel_dir: &project,
+        markers: &markers,
+        explicit: true,
+    });
+    let mut by_purl: BTreeMap<&str, Vec<&PatchSearchResult>> = BTreeMap::new();
+    for patch in patches {
+        by_purl.entry(patch.purl.as_str()).or_default().push(patch);
+    }
+    let mut out = Vec::new();
+    for (purl, mut group) in by_purl {
+        group.sort_by(|a, b| cmp_search_results(a, b));
+        let verdict = if !policy.enabled() {
+            Err(FilterReason::Disabled)
+        } else {
+            root_verdict.clone().and_then(|()| policy.admits_purl(purl)).and_then(|()| {
+                // The floor only hides a package when none of its patches pass.
+                match group
+                    .iter()
+                    .map(|p| policy.admits_severity(patch_severity_order(p)))
+                    .find(Result::is_ok)
+                {
+                    Some(ok) => ok,
+                    None => policy.admits_severity(patch_severity_order(group[0])),
+                }
+            })
+        };
+        if let Err(reason) = verdict {
+            out.push((
+                socket_patch_core::policy::POLICY_BYPASSED.to_string(),
+                format!(
+                    "{} would be skipped by socket.yml ({}: {}); get patches it anyway",
+                    normalize_purl(purl),
+                    reason.code(),
+                    reason.detail()
+                ),
+            ));
+        }
+    }
+    out
+}
diff --git a/crates/socket-patch-cli/src/commands/scan/socket_yml_args.rs b/crates/socket-patch-cli/src/commands/scan/socket_yml_args.rs
new file mode 100644
index 00000000..211167d0
--- /dev/null
+++ b/crates/socket-patch-cli/src/commands/scan/socket_yml_args.rs
@@ -0,0 +1,58 @@
+//! `scan`'s `socket.yml` patch-policy flags.
+
+use clap::Args;
+use socket_patch_core::policy::{parse_min_severity, OverrideSource, PolicyOverrides};
+
+/// Env binding of `--min-severity`, read by [`SocketYmlArgs::overrides`]
+/// (not by clap) so the policy can say which layer set the floor.
+pub const MIN_SEVERITY_ENV: &str = "SOCKET_MIN_SEVERITY";
+
+#[derive(Args, Clone, Debug, Default)]
+pub struct SocketYmlArgs {
+    /// Ignore the repository's socket.yml patch policy (its `patches`
+    /// block and `projectIgnorePaths`) for this run. The built-in
+    /// test/fixture directory ignores still apply
+    #[arg(
+        long = "no-socket-yml",
+        env = "SOCKET_NO_SOCKET_YML",
+        default_value_t = false,
+        value_parser = crate::args::parse_bool_flag,
+    )]
+    pub no_socket_yml: bool,
+
+    /// Only patch packages whose patch fixes an advisory of at least this
+    /// severity: critical, high, medium (or moderate), low, or none for no
+    /// floor. Overrides `patches.minSeverity` in socket.yml. Patches of
+    /// unknown severity are skipped whenever a floor is set
+    /// [env: SOCKET_MIN_SEVERITY]
+    #[arg(long = "min-severity", value_name = "SEVERITY", value_parser = min_severity_value)]
+    pub min_severity: Option<String>,
+}
+
+fn min_severity_value(value: &str) -> Result<String, String> {
+    parse_min_severity(value).map(|_| value.to_string())
+}
+
+impl SocketYmlArgs {
+    /// The trusted overrides: `--min-severity` beats `SOCKET_MIN_SEVERITY`
+    /// (an empty value is unset). `Err` is a usage error (exit 2).
+    pub fn overrides(&self) -> Result<PolicyOverrides, String> {
+        let min_severity = match self.min_severity.as_deref() {
+            Some(flag) => Some((
+                parse_min_severity(flag).map_err(|e| format!("--min-severity: {e}"))?,
+                OverrideSource::Flag,
+            )),
+            None => match std::env::var(MIN_SEVERITY_ENV) {
+                Ok(value) if !value.trim().is_empty() => Some((
+                    parse_min_severity(&value).map_err(|e| format!("{MIN_SEVERITY_ENV}: {e}"))?,
+                    OverrideSource::Env,
+                )),
+                _ => None,
+            },
+        };
+        Ok(PolicyOverrides {
+            bypass: self.no_socket_yml,
+            min_severity,
+        })
+    }
+}
diff --git a/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs b/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs
index eb38a147..9b2e11e8 100644
--- a/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs
+++ b/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs
@@ -452,6 +452,7 @@ async fn run_vendor_json_path(
     use_public_proxy: bool,
     all_packages_with_patches: &[BatchPackagePatches],
     can_access_paid_patches: bool,
+    policy: &super::policy::ScanPolicy,
     result: &mut serde_json::Value,
     manifest_path: &Path,
     socket_dir: &Path,
@@ -469,11 +470,11 @@ async fn run_vendor_json_path(
     // Same discovery as `--apply`. Vendored purls are NOT filtered here —
     // re-vendoring a stale uuid is the point of the flag (same-uuid re-runs
     // land on the backend's `already_vendored` skip).
-    let selected = match discover_selected(
+    let selected: Vec<socket_patch_core::api::types::PatchSearchResult> = match discover_selected(
         api_client,
         all_packages_with_patches,
         can_access_paid_patches,
-        &args.common,
+        policy,
         false,
         false,
         telemetry,
@@ -481,7 +482,7 @@ async fn run_vendor_json_path(
     )
     .await
     {
-        Ok(s) => s,
+        Ok(offers) => offers.selected.into_values().collect(),
         Err((code, message)) => {
             emit_discovery_error_json(result, &message);
             return code;
@@ -780,6 +781,7 @@ pub(super) fn boxed_vendor_json_path<'a>(
     use_public_proxy: bool,
     all_packages_with_patches: &'a [BatchPackagePatches],
     can_access_paid_patches: bool,
+    policy: &'a super::policy::ScanPolicy,
     result: &'a mut serde_json::Value,
     manifest_path: &'a Path,
     socket_dir: &'a Path,
@@ -797,6 +799,7 @@ pub(super) fn boxed_vendor_json_path<'a>(
         use_public_proxy,
         all_packages_with_patches,
         can_access_paid_patches,
+        policy,
         result,
         manifest_path,
         socket_dir,
diff --git a/crates/socket-patch-cli/src/lib.rs b/crates/socket-patch-cli/src/lib.rs
index 371a8c88..297fb9f3 100644
--- a/crates/socket-patch-cli/src/lib.rs
+++ b/crates/socket-patch-cli/src/lib.rs
@@ -180,6 +180,8 @@ fn short_help_hidden_own(sub: &str) -> &'static [&'static str] {
             "vex_no_verify",
             "vex_doc_id",
             "vex_compact",
+            "no_socket_yml",
+            "min_severity",
         ],
         "get" => &["id", "cve", "ghsa", "package", "save_only", "all_releases"],
         "vex" => &["doc_id", "compact"],
diff --git a/crates/socket-patch-cli/tests/cli_parse_scan.rs b/crates/socket-patch-cli/tests/cli_parse_scan.rs
index 64bb72a1..d6af0472 100644
--- a/crates/socket-patch-cli/tests/cli_parse_scan.rs
+++ b/crates/socket-patch-cli/tests/cli_parse_scan.rs
@@ -45,6 +45,8 @@ const SCAN_ENV_VARS: &[&str] = &[
     "SOCKET_JSON",
     "SOCKET_LOCK_TIMEOUT",
     "SOCKET_MANIFEST_PATH",
+    "SOCKET_MIN_SEVERITY",
+    "SOCKET_NO_SOCKET_YML",
     "SOCKET_NO_TRUST_LOCKFILE_CONFIG",
     "SOCKET_NO_NPM_ALLOW_REMOTE_CONFIG",
     "SOCKET_NO_VLT_INSTALL_CLEANUP",
@@ -472,6 +474,8 @@ fn scan_json_empty_cwd_emits_updates_key() {
     // sub-object onto the hosted default path fails loudly.
     let bin = env!("CARGO_BIN_EXE_socket-patch");
     let tmp = tempfile::tempdir().expect("tempdir");
+    // Its own repo root, so no socket.yml above the temp dir leaks in.
+    std::fs::create_dir(tmp.path().join(".git")).expect(".git");
     let mut cmd = std::process::Command::new(bin);
     cmd.args(["scan", "--json", "--cwd"]).arg(tmp.path());
     // Strip *every* SOCKET_* override the child would otherwise inherit.
@@ -526,6 +530,18 @@ fn scan_json_empty_cwd_emits_updates_key() {
             "warnings": [],
             "dryRun": false
         },
+        // v5: the socket.yml patch policy block rides every successful
+        // scan (no file here: the built-in defaults).
+        "policy": {
+            "source": "none",
+            "path": null,
+            "sha256": null,
+            "enabled": true,
+            "minSeverity": { "value": null, "source": "default" },
+            "counts": { "filtered": 0, "retained": 0 },
+            "filtered": [],
+            "retained": []
+        },
     });
     assert_eq!(
         v,
@@ -854,3 +870,78 @@ fn no_vlt_install_cleanup_flag_and_env_parse() {
         _ => panic!("expected Scan"),
     }
 }
+
+/// Parse `scan` under a clean env plus `env`, restoring it afterwards.
+fn parse_scan_with_env(extra: &[&str], env: &[(&str, &str)]) -> Result<ScanArgs, clap::Error> {
+    with_clean_env(|| {
+        for (k, v) in env {
+            std::env::set_var(k, v);
+        }
+        let mut argv = vec!["socket-patch", "scan"];
+        argv.extend_from_slice(extra);
+        let cli = Cli::try_parse_from(&argv);
+        for (k, _) in env {
+            std::env::remove_var(k);
+        }
+        cli.map(|c| match c.command {
+            Commands::Scan(a) => a,
+            _ => panic!("expected Scan"),
+        })
+    })
+}
+
+/// `--no-socket-yml` / `SOCKET_NO_SOCKET_YML`: a bool with the repo-wide
+/// vocabulary; empty is unset; garbage is a parse error.
+#[test]
+#[serial_test::serial]
+fn no_socket_yml_flag_and_env() {
+    assert!(!parse_scan(&[]).socket_yml.no_socket_yml);
+    assert!(parse_scan(&["--no-socket-yml"]).socket_yml.no_socket_yml);
+    for (value, expected) in [("1", true), ("true", true), ("0", false), ("", false)] {
+        let args = parse_scan_with_env(&[], &[("SOCKET_NO_SOCKET_YML", value)]).expect("parse");
+        assert_eq!(args.socket_yml.no_socket_yml, expected, "{value:?}");
+    }
+    assert!(parse_scan_with_env(&[], &[("SOCKET_NO_SOCKET_YML", "garbage")]).is_err());
+}
+
+/// `--min-severity` / `SOCKET_MIN_SEVERITY`: the flag beats the env, the
+/// layer is recorded, `none` lifts the floor, empty env is unset, and a
+/// malformed value is a usage error (the flag at parse time, the env when
+/// the overrides are resolved; scan exits 2 either way).
+#[test]
+#[serial_test::serial]
+fn min_severity_flag_and_env() {
+    use socket_patch_core::policy::OverrideSource;
+    let overrides = |extra: &[&str], env: &[(&str, &str)]| {
+        let args = parse_scan_with_env(extra, env).expect("parse");
+        with_clean_env(|| {
+            for (k, v) in env {
+                std::env::set_var(k, v);
+            }
+            let out = args.socket_yml.overrides();
+            for (k, _) in env {
+                std::env::remove_var(k);
+            }
+            out
+        })
+    };
+    assert_eq!(parse_scan(&[]).socket_yml.min_severity, None);
+    assert_eq!(overrides(&[], &[]).unwrap().min_severity, None);
+    assert_eq!(
+        overrides(&["--min-severity", "High"], &[]).unwrap().min_severity,
+        Some((Some(1), OverrideSource::Flag))
+    );
+    assert_eq!(
+        overrides(&["--min-severity", "none"], &[("SOCKET_MIN_SEVERITY", "critical")]).unwrap().min_severity,
+        Some((None, OverrideSource::Flag))
+    );
+    assert_eq!(
+        overrides(&[], &[("SOCKET_MIN_SEVERITY", "moderate")]).unwrap().min_severity,
+        Some((Some(2), OverrideSource::Env))
+    );
+    assert_eq!(overrides(&[], &[("SOCKET_MIN_SEVERITY", "")]).unwrap().min_severity, None);
+    assert!(overrides(&[], &[("SOCKET_MIN_SEVERITY", "severe")]).is_err());
+    assert!(try_parse_scan(&["--min-severity", "severe"]).is_err());
+    assert!(overrides(&["--no-socket-yml"], &[]).unwrap().bypass);
+}
+
diff --git a/crates/socket-patch-cli/tests/e2e_socket_yml_policy.rs b/crates/socket-patch-cli/tests/e2e_socket_yml_policy.rs
new file mode 100644
index 00000000..cc354014
--- /dev/null
+++ b/crates/socket-patch-cli/tests/e2e_socket_yml_policy.rs
@@ -0,0 +1,990 @@
+//! End-to-end tests for the socket.yml patch policy on disk scans: a
+//! monorepo with several npm roots (plus a gem, for the ecosystem filter)
+//! scanned through the real binary in hosted, agent and vendored mode
+//! against a mock patch API that serves a small catalog.
+
+use std::collections::BTreeMap;
+use std::path::{Path, PathBuf};
+
+use serde_json::{json, Value};
+use serial_test::serial;
+use socket_patch_core::hash::git_sha256::compute_git_sha256_from_bytes;
+use wiremock::matchers::{method, path, path_regex};
+use wiremock::{Mock, MockServer, Request, ResponseTemplate};
+
+const ORG: &str = "test-org";
+const TOKEN_SEGMENT: &str = "55555555-5555-4555-8555-555555555555";
+
+#[derive(Clone)]
+struct Patch {
+    uuid: &'static str,
+    name: &'static str,
+    version: &'static str,
+    eco: &'static str,
+    severities: &'static [&'static str],
+    published: &'static str,
+}
+
+impl Patch {
+    fn purl(&self) -> String {
+        format!("pkg:{}/{}@{}", self.eco, self.name, self.version)
+    }
+
+    fn hosted_url(&self) -> String {
+        format!(
+            "http://patch.test/patch/npm/{n}/{v}/{TOKEN_SEGMENT}/{u}/{n}-{v}.tgz",
+            n = self.name,
+            v = self.version,
+            u = self.uuid
+        )
+    }
+
+    fn vulnerabilities(&self) -> Value {
+        let mut map = serde_json::Map::new();
+        for (i, severity) in self.severities.iter().enumerate() {
+            map.insert(
+                format!("GHSA-{}-{i:04}", &self.uuid[..4]),
+                json!({"cves": [], "summary": "s", "severity": severity, "description": "d"}),
+            );
+        }
+        Value::Object(map)
+    }
+
+    fn batch_severity(&self) -> &'static str {
+        let rank = |s: &str| match s {
+            "critical" => 0,
+            "high" => 1,
+            "medium" => 2,
+            "low" => 3,
+            _ => 4,
+        };
+        self.severities.iter().copied().min_by_key(|s| rank(s)).unwrap_or("unknown")
+    }
+}
+
+const P_ALPHA: Patch = Patch {
+    uuid: "a1a1a1a1-0000-4000-8000-000000000001",
+    name: "alpha",
+    version: "1.0.0",
+    eco: "npm",
+    severities: &["critical"],
+    published: "2024-01-01T00:00:00Z",
+};
+const P_BETA: Patch = Patch {
+    uuid: "b1b1b1b1-0000-4000-8000-000000000001",
+    name: "beta",
+    version: "1.0.0",
+    eco: "npm",
+    severities: &["low"],
+    published: "2024-01-01T00:00:00Z",
+};
+const P_LEFTPAD: Patch = Patch {
+    uuid: "c1c1c1c1-0000-4000-8000-000000000001",
+    name: "left-pad",
+    version: "1.0.0",
+    eco: "npm",
+    severities: &["high"],
+    published: "2024-01-01T00:00:00Z",
+};
+const P_GAMMA: Patch = Patch {
+    uuid: "d1d1d1d1-0000-4000-8000-000000000001",
+    name: "gamma",
+    version: "1.0.0",
+    eco: "npm",
+    severities: &["high"],
+    published: "2024-01-01T00:00:00Z",
+};
+const P_DELTA: Patch = Patch {
+    uuid: "e1e1e1e1-0000-4000-8000-000000000001",
+    name: "delta",
+    version: "1.0.0",
+    eco: "npm",
+    severities: &["high"],
+    published: "2024-01-01T00:00:00Z",
+};
+const P_RACK: Patch = Patch {
+    uuid: "f1f1f1f1-0000-4000-8000-000000000001",
+    name: "rack",
+    version: "1.0.0",
+    eco: "gem",
+    severities: &["high"],
+    published: "2024-01-01T00:00:00Z",
+};
+/// A merged (two-advisory) low patch for alpha: ranks first while no floor
+/// applies.
+const P_ALPHA_MERGED_LOW: Patch = Patch {
+    uuid: "a2a2a2a2-0000-4000-8000-000000000002",
+    name: "alpha",
+    version: "1.0.0",
+    eco: "npm",
+    severities: &["low", "low"],
+    published: "2024-02-01T00:00:00Z",
+};
+/// A newer merged patch for alpha (supersedes P_ALPHA).
+const P_ALPHA_MERGED_NEW: Patch = Patch {
+    uuid: "a3a3a3a3-0000-4000-8000-000000000003",
+    name: "alpha",
+    version: "1.0.0",
+    eco: "npm",
+    severities: &["critical", "high"],
+    published: "2024-03-01T00:00:00Z",
+};
+
+fn catalog() -> Vec<Patch> {
+    vec![P_ALPHA, P_BETA, P_LEFTPAD, P_GAMMA, P_DELTA, P_RACK]
+}
+
+fn orig_index(name: &str) -> String {
+    format!("module.exports = () => '{name} orig';\n")
+}
+
+fn patched_index(name: &str) -> String {
+    format!("module.exports = () => '{name} patched';\n")
+}
+
+fn percent_decode(s: &str) -> String {
+    let bytes = s.as_bytes();
+    let mut out = Vec::with_capacity(bytes.len());
+    let mut i = 0;
+    while i < bytes.len() {
+        if bytes[i] == b'%' && i + 3 <= bytes.len() {
+            if let Ok(b) = u8::from_str_radix(&s[i + 1..i + 3], 16) {
+                out.push(b);
+                i += 3;
+                continue;
+            }
+        }
+        out.push(bytes[i]);
+        i += 1;
+    }
+    String::from_utf8(out).unwrap()
+}
+
+/// Serve `patches` from every patches route scan uses.
+async fn mount_api(server: &MockServer, patches: Vec<Patch>) {
+    let by_purl = {
+        let mut m: BTreeMap<String, Vec<Patch>> = BTreeMap::new();
+        for p in &patches {
+            m.entry(p.purl()).or_default().push(p.clone());
+        }
+        m
+    };
+    let batch_map = by_purl.clone();
+    Mock::given(method("POST"))
+        .and(path(format!("/v0/orgs/{ORG}/patches/batch")))
+        .respond_with(move |req: &Request| {
+            let body: Value = serde_json::from_slice(&req.body).unwrap();
+            let mut packages = Vec::new();
+            for c in body["components"].as_array().unwrap() {
+                let purl = c["purl"].as_str().unwrap();
+                if let Some(list) = batch_map.get(purl) {
+                    let infos: Vec<Value> = list
+                        .iter()
+                        .map(|p| {
+                            json!({
+                                "uuid": p.uuid, "purl": purl, "tier": "free", "cveIds": [],
+                                "ghsaIds": p.vulnerabilities().as_object().unwrap().keys().collect::<Vec<_>>(),
+                                "severity": p.batch_severity(), "title": "fixture"
+                            })
+                        })
+                        .collect();
+                    packages.push(json!({"purl": purl, "patches": infos}));
+                }
+            }
+            ResponseTemplate::new(200).set_body_json(json!({"packages": packages, "canAccessPaidPatches": false}))
+        })
+        .mount(server)
+        .await;
+    let detail_map = by_purl.clone();
+    Mock::given(method("GET"))
+        .and(path_regex(format!("^/v0/orgs/{ORG}/patches/by-package/.+$")))
+        .respond_with(move |req: &Request| {
+            let raw = req.url.path().rsplit('/').next().unwrap();
+            let purl = percent_decode(raw);
+            let list: Vec<Value> = detail_map
+                .get(&purl)
+                .into_iter()
+                .flatten()
+                .map(|p| {
+                    json!({
+                        "uuid": p.uuid, "purl": purl, "publishedAt": p.published,
+                        "description": "x", "license": "MIT", "tier": "free",
+                        "vulnerabilities": p.vulnerabilities()
+                    })
+                })
+                .collect();
+            ResponseTemplate::new(200).set_body_json(json!({"patches": list, "canAccessPaidPatches": false}))
+        })
+        .mount(server)
+        .await;
+    let by_uuid: BTreeMap<String, Patch> = patches.iter().map(|p| (p.uuid.to_string(), p.clone())).collect();
+    let refs = by_uuid.clone();
+    Mock::given(method("POST"))
+        .and(path(format!("/v0/orgs/{ORG}/patches/package")))
+        .respond_with(move |req: &Request| {
+            let body: Value = serde_json::from_slice(&req.body).unwrap();
+            let mut results = serde_json::Map::new();
+            for uuid in body["uuids"].as_array().unwrap() {
+                let uuid = uuid.as_str().unwrap();
+                if let Some(p) = refs.get(uuid) {
+                    results.insert(
+                        uuid.to_string(),
+                        json!({
+                            "status": "granted", "url": p.hosted_url(), "purl": p.purl(),
+                            "artifacts": [{"kind": "tarball", "url": p.hosted_url(),
+                                           "integrity": {"sha512": format!("sha512-PATCHED{}==", &p.uuid[..8])}}],
+                            "registryOverride": null
+                        }),
+                    );
+                }
+            }
+            ResponseTemplate::new(200).set_body_json(json!({"results": results}))
+        })
+        .mount(server)
+        .await;
+    let views = by_uuid;
+    Mock::given(method("GET"))
+        .and(path_regex(format!("^/v0/orgs/{ORG}/patches/view/.+$")))
+        .respond_with(move |req: &Request| {
+            use base64::Engine as _;
+            let uuid = req.url.path().rsplit('/').next().unwrap();
+            let Some(p) = views.get(uuid) else {
+                return ResponseTemplate::new(404);
+            };
+            let before = compute_git_sha256_from_bytes(orig_index(p.name).as_bytes());
+            let after_bytes = patched_index(p.name);
+            let after = compute_git_sha256_from_bytes(after_bytes.as_bytes());
+            ResponseTemplate::new(200).set_body_json(json!({
+                "uuid": p.uuid, "purl": p.purl(), "publishedAt": p.published,
+                "files": {"package/index.js": {
+                    "beforeHash": before, "afterHash": after,
+                    "blobContent": base64::engine::general_purpose::STANDARD.encode(after_bytes.as_bytes())
+                }},
+                "vulnerabilities": p.vulnerabilities(),
+                "description": "x", "license": "MIT", "tier": "free"
+            }))
+        })
+        .mount(server)
+        .await;
+}
+
+/// An npm project root: package.json, installed copies, a v3 lockfile.
+fn write_npm_root(dir: &Path, deps: &[&str]) {
+    std::fs::create_dir_all(dir).unwrap();
+    let dep_map: BTreeMap<&str, &str> = deps.iter().map(|d| (*d, "1.0.0")).collect();
+    std::fs::write(
+        dir.join("package.json"),
+        serde_json::to_string_pretty(&json!({"name": "consumer", "version": "0.0.0", "dependencies": dep_map}))
+            .unwrap(),
+    )
+    .unwrap();
+    let mut packages = serde_json::Map::new();
+    packages.insert(
+        String::new(),
+        json!({"name": "consumer", "version": "0.0.0", "dependencies": dep_map}),
+    );
+    for name in deps {
+        let pkg = dir.join("node_modules").join(name);
+        std::fs::create_dir_all(&pkg).unwrap();
+        std::fs::write(pkg.join("package.json"), format!(r#"{{ "name": "{name}", "version": "1.0.0" }}"#)).unwrap();
+        std::fs::write(pkg.join("index.js"), orig_index(name)).unwrap();
+        packages.insert(
+            format!("node_modules/{name}"),
+            json!({
+                "version": "1.0.0",
+                "resolved": format!("https://registry.npmjs.org/{name}/-/{name}-1.0.0.tgz"),
+                "integrity": "sha512-UPSTREAMupstream=="
+            }),
+        );
+    }
+    let lock = json!({
+        "name": "consumer", "version": "0.0.0", "lockfileVersion": 3, "requires": true,
+        "packages": packages
+    });
+    std::fs::write(dir.join("package-lock.json"), serde_json::to_string_pretty(&lock).unwrap() + "\n").unwrap();
+}
+
+fn write_gem(dir: &Path, name: &str, version: &str) {
+    std::fs::create_dir_all(dir.join("vendor/bundle/ruby/3.0.0/gems").join(format!("{name}-{version}")).join("lib"))
+        .unwrap();
+}
+
+/// The monorepo: `services/web` (alpha, beta, left-pad + a gem),
+/// `services/legacy` (gamma), `services/test` (delta).
+struct Repo {
+    _tmp: tempfile::TempDir,
+    root: PathBuf,
+}
+
+impl Repo {
+    fn new(socket_yml: Option<&str>) -> Self {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = std::fs::canonicalize(tmp.path()).unwrap().join("repo");
+        std::fs::create_dir_all(root.join(".git")).unwrap();
+        write_npm_root(&root.join("services/web"), &["alpha", "beta", "left-pad"]);
+        write_gem(&root.join("services/web"), "rack", "1.0.0");
+        write_npm_root(&root.join("services/legacy"), &["gamma"]);
+        write_npm_root(&root.join("services/test"), &["delta"]);
+        if let Some(text) = socket_yml {
+            std::fs::write(root.join("socket.yml"), text).unwrap();
+        }
+        Self { _tmp: tmp, root }
+    }
+
+    fn dir(&self, rel: &str) -> PathBuf {
+        self.root.join(rel)
+    }
+
+    fn lock(&self, rel: &str) -> String {
+        std::fs::read_to_string(self.dir(rel).join("package-lock.json")).unwrap()
+    }
+
+    fn snapshot(&self) -> BTreeMap<String, Vec<u8>> {
+        fn walk(dir: &Path, root: &Path, out: &mut BTreeMap<String, Vec<u8>>) {
+            for entry in std::fs::read_dir(dir).unwrap().filter_map(Result::ok) {
+                let path = entry.path();
+                if entry.file_type().unwrap().is_dir() {
+                    walk(&path, root, out);
+                } else {
+                    let rel = path.strip_prefix(root).unwrap().to_string_lossy().into_owned();
+                    out.insert(rel, std::fs::read(&path).unwrap());
+                }
+            }
+        }
+        let mut out = BTreeMap::new();
+        walk(&self.root, &self.root, &mut out);
+        out
+    }
+}
+
+/// Run the binary with ambient `SOCKET_*` scrubbed; `(code, stdout, stderr)`.
+fn run_cli(cwd: &Path, args: &[&str], env: &[(&str, &str)]) -> (i32, String, String) {
+    let mut cmd = std::process::Command::new(env!("CARGO_BIN_EXE_socket-patch"));
+    cmd.args(args).current_dir(cwd);
+    for (key, _) in std::env::vars() {
+        if key.starts_with("SOCKET_") && key != "SOCKET_NO_CONFIG" {
+            cmd.env_remove(key);
+        }
+    }
+    cmd.env_remove("GIT_CEILING_DIRECTORIES").env_remove("VIRTUAL_ENV");
+    cmd.env("SOCKET_TELEMETRY_DISABLED", "1");
+    // The fixture's hosted pins name this origin; it makes them recorded.
+    cmd.env("SOCKET_PATCH_SERVER_URL", "http://patch.test");
+    let absent = cwd.join(".absent-npm-config");
+    for var in [
+        "NPM_CONFIG_USERCONFIG",
+        "npm_config_userconfig",
+        "NPM_CONFIG_GLOBALCONFIG",
+        "npm_config_globalconfig",
+        "PREFIX",
+    ] {
+        cmd.env(var, &absent);
+    }
+    cmd.env("NPM_CONFIG_ALLOW_REMOTE", "").env("npm_config_allow_remote", "");
+    for (k, v) in env {
+        cmd.env(k, v);
+    }
+    let out = cmd.output().expect("spawn socket-patch");
+    (
+        out.status.code().unwrap_or(-1),
+        String::from_utf8_lossy(&out.stdout).into_owned(),
+        String::from_utf8_lossy(&out.stderr).into_owned(),
+    )
+}
+
+fn scan(cwd: &Path, api: &str, extra: &[&str], env: &[(&str, &str)]) -> (i32, String, String) {
+    let mut args = vec![
+        "scan",
+        "--yes",
+        "--cwd",
+        cwd.to_str().unwrap(),
+        "--api-url",
+        api,
+        "--org",
+        ORG,
+        "--api-token",
+        "fake",
+        "--batch-size",
+        "100",
+    ];
+    args.extend_from_slice(extra);
+    run_cli(cwd, &args, env)
+}
+
+fn scan_json(cwd: &Path, api: &str, extra: &[&str], env: &[(&str, &str)]) -> (i32, Value) {
+    let mut args = vec!["--json"];
+    args.extend_from_slice(extra);
+    let (code, stdout, stderr) = scan(cwd, api, &args, env);
+    let doc: Value = serde_json::from_str(&stdout)
+        .unwrap_or_else(|e| panic!("stdout must be JSON ({e})\nstdout=\n{stdout}\nstderr=\n{stderr}"));
+    (code, doc)
+}
+
+fn filtered(doc: &Value) -> Vec<(Option<String>, String)> {
+    doc["policy"]["filtered"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .map(|f| (f["purl"].as_str().map(str::to_string), f["reason"].as_str().unwrap().to_string()))
+        .collect()
+}
+
+fn filtered_reason<'a>(doc: &'a Value, purl: &str) -> &'a Value {
+    doc["policy"]["filtered"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .find(|f| f["purl"] == purl)
+        .unwrap_or_else(|| panic!("{purl} not in policy.filtered: {:#}", doc["policy"]))
+}
+
+fn warning_codes(doc: &Value) -> Vec<String> {
+    doc["warnings"]
+        .as_array()
+        .map(|w| w.iter().filter_map(|e| e["code"].as_str().map(str::to_string)).collect())
+        .unwrap_or_default()
+}
+
+// ---------------------------------------------------------------------------
+// Hosted
+// ---------------------------------------------------------------------------
+
+#[tokio::test]
+#[serial]
+async fn hosted_filters_by_ecosystem_package_and_severity() {
+    let server = MockServer::start().await;
+    mount_api(&server, catalog()).await;
+    let repo = Repo::new(Some(
+        "version: 2\npatches:\n  ecosystems: [npm]\n  ignorePackages: [\"pkg:npm/left-pad\"]\n  minSeverity: high\n",
+    ));
+    let (code, doc) = scan_json(&repo.dir("services/web"), &server.uri(), &[], &[]);
+    assert_eq!(code, 0, "{doc:#}");
+
+    let lock = repo.lock("services/web");
+    assert!(lock.contains(&P_ALPHA.hosted_url()), "alpha is patched:\n{lock}");
+    assert!(!lock.contains(P_BETA.uuid), "beta is below the floor:\n{lock}");
+    assert!(!lock.contains(P_LEFTPAD.uuid), "left-pad is ignored:\n{lock}");
+
+    let policy = &doc["policy"];
+    assert_eq!(policy["source"], "file");
+    assert_eq!(policy["path"], "socket.yml");
+    assert_eq!(policy["sha256"].as_str().unwrap().len(), 64);
+    assert_eq!(policy["enabled"], true);
+    assert_eq!(policy["minSeverity"], json!({"value": "high", "source": "file"}));
+    let beta = filtered_reason(&doc, "pkg:npm/beta@1.0.0");
+    assert_eq!(beta["reason"], "policy_severity");
+    assert_eq!(beta["detail"], "low < high");
+    assert_eq!(beta["uuid"], P_BETA.uuid);
+    assert_eq!(beta["project"], "services/web");
+    let left_pad = filtered_reason(&doc, "pkg:npm/left-pad@1.0.0");
+    assert_eq!(left_pad["reason"], "policy_package_ignored");
+    assert_eq!(left_pad["uuid"], Value::Null, "filtered before any patch lookup");
+    assert_eq!(left_pad["detail"], "pkg:npm/left-pad (patches.ignorePackages)");
+    let rack = filtered_reason(&doc, "pkg:gem/rack@1.0.0");
+    assert_eq!(rack["reason"], "policy_ecosystem");
+    assert_eq!(policy["counts"]["filtered"], 3);
+    assert_eq!(policy["counts"]["retained"], 0);
+    // Packages filtered before lookup are never queried.
+    let reqs = server.received_requests().await.unwrap();
+    for r in &reqs {
+        if r.url.path().ends_with("/patches/batch") {
+            let body = String::from_utf8_lossy(&r.body);
+            assert!(!body.contains("left-pad") && !body.contains("rack"), "{body}");
+        }
+    }
+    assert_eq!(doc["redirect"]["redirected"], 1, "{:#}", doc["redirect"]);
+}
+
+#[tokio::test]
+#[serial]
+async fn hosted_dry_run_makes_the_same_decisions_and_writes_nothing() {
+    let server = MockServer::start().await;
+    mount_api(&server, catalog()).await;
+    let repo = Repo::new(Some("version: 2\npatches:\n  minSeverity: high\n  ecosystems: [npm]\n"));
+    let before = repo.snapshot();
+    let (code, doc) = scan_json(&repo.dir("services/web"), &server.uri(), &["--dry-run"], &[]);
+    assert_eq!(code, 0, "{doc:#}");
+    assert_eq!(repo.snapshot(), before, "a dry run changes no bytes");
+    assert_eq!(doc["redirect"]["redirected"], 2, "alpha and left-pad: {:#}", doc["redirect"]);
+    assert_eq!(filtered_reason(&doc, "pkg:npm/beta@1.0.0")["reason"], "policy_severity");
+}
+
+#[tokio::test]
+#[serial]
+async fn path_globs_apply_default_ignores_and_ignore_paths_human() {
+    let server = MockServer::start().await;
+    mount_api(&server, catalog()).await;
+    let repo = Repo::new(Some("version: 2\npatches:\n  ignorePaths: [\"/services/legacy/\"]\n"));
+    let legacy = repo.lock("services/legacy");
+    let test_lock = repo.lock("services/test");
+    let (code, stdout, stderr) = scan(&repo.root, &server.uri(), &["services/*"], &[]);
+    assert_eq!(code, 0, "stdout:\n{stdout}\nstderr:\n{stderr}");
+    assert!(repo.lock("services/web").contains(&P_ALPHA.hosted_url()));
+    assert_eq!(repo.lock("services/legacy"), legacy, "ignored by patches.ignorePaths");
+    assert_eq!(repo.lock("services/test"), test_lock, "a discovered test/ root is a built-in ignore");
+    assert!(stdout.contains("Policy (socket.yml)"), "{stdout}");
+
+    // Named literally, the test/ root is explicit: defaults do not apply.
+    let (code, stdout, stderr) = scan(&repo.root, &server.uri(), &["services/test"], &[]);
+    assert_eq!(code, 0, "stdout:\n{stdout}\nstderr:\n{stderr}");
+    assert!(repo.lock("services/test").contains(&P_DELTA.hosted_url()));
+}
+
+#[tokio::test]
+#[serial]
+async fn include_paths_limit_roots() {
+    let server = MockServer::start().await;
+    mount_api(&server, catalog()).await;
+    let repo = Repo::new(Some("version: 2\npatches:\n  includePaths: [\"/services/legacy/\"]\n"));
+    let web = repo.lock("services/web");
+    let (code, doc) = scan_json(&repo.dir("services/web"), &server.uri(), &[], &[]);
+    assert_eq!(code, 0, "{doc:#}");
+    assert_eq!(repo.lock("services/web"), web);
+    assert_eq!(
+        filtered(&doc),
+        vec![(None, "policy_path_not_included".to_string())],
+        "a root filtered as a whole is one entry with purl null"
+    );
+    let (code, doc) = scan_json(&repo.dir("services/legacy"), &server.uri(), &[], &[]);
+    assert_eq!(code, 0, "{doc:#}");
+    assert!(repo.lock("services/legacy").contains(&P_GAMMA.hosted_url()));
+    assert_eq!(doc["policy"]["counts"]["filtered"], 0);
+}
+
+#[tokio::test]
+#[serial]
+async fn invalid_file_fails_closed_before_any_request_or_write() {
+    let server = MockServer::start().await;
+    mount_api(&server, catalog()).await;
+    let repo = Repo::new(Some("version: 2\npatches:\n  minSeverty: high\n"));
+    let before = repo.snapshot();
+    let (code, doc) = scan_json(&repo.dir("services/web"), &server.uri(), &[], &[]);
+    assert_eq!(code, 1);
+    assert_eq!(doc["status"], "error");
+    assert_eq!(doc["errorCode"], "socket_yml_invalid");
+    let message = doc["error"].as_str().unwrap();
+    assert!(message.contains("patches.minSeverty"), "{message}");
+    assert!(message.contains("did you mean `minSeverity`"), "{message}");
+    assert!(message.contains("--no-socket-yml"), "{message}");
+    assert!(doc.get("policy").is_none());
+    assert_eq!(repo.snapshot(), before);
+    assert!(server.received_requests().await.unwrap().is_empty(), "no request before the policy loads");
+
+    // Human output names the code on stderr, same exit code.
+    let (code, _, stderr) = scan(&repo.dir("services/web"), &server.uri(), &[], &[]);
+    assert_eq!(code, 1);
+    assert!(stderr.contains("socket_yml_invalid"), "{stderr}");
+
+    // --no-socket-yml (and its env var) skips the file.
+    let (code, doc) = scan_json(&repo.dir("services/web"), &server.uri(), &["--no-socket-yml", "--dry-run"], &[]);
+    assert_eq!(code, 0, "{doc:#}");
+    assert_eq!(doc["policy"]["source"], "bypassed");
+    let (code, doc) = scan_json(&repo.dir("services/web"), &server.uri(), &["--dry-run"], &[("SOCKET_NO_SOCKET_YML", "1")]);
+    assert_eq!(code, 0, "{doc:#}");
+    assert_eq!(doc["policy"]["source"], "bypassed");
+}
+
+#[tokio::test]
+#[serial]
+async fn both_files_disagreeing_is_ambiguous() {
+    let server = MockServer::start().await;
+    mount_api(&server, catalog()).await;
+    let repo = Repo::new(Some("version: 2\npatches:\n  maxNewPatches: 1\n"));
+    std::fs::write(repo.root.join("socket.yaml"), "version: 2\npatches:\n  maxNewPatches: 2\n").unwrap();
+    let (code, doc) = scan_json(&repo.dir("services/web"), &server.uri(), &[], &[]);
+    assert_eq!(code, 1);
+    assert_eq!(doc["errorCode"], "socket_yml_ambiguous");
+}
+
+#[tokio::test]
+#[serial]
+async fn severity_flag_and_env_override_the_file() {
+    let server = MockServer::start().await;
+    mount_api(&server, catalog()).await;
+    let repo = Repo::new(Some("version: 2\npatches:\n  minSeverity: high\n"));
+    let web = repo.dir("services/web");
+    let (code, doc) = scan_json(&web, &server.uri(), &["--dry-run", "--min-severity", "none"], &[]);
+    assert_eq!(code, 0, "{doc:#}");
+    assert_eq!(doc["policy"]["minSeverity"], json!({"value": null, "source": "flag"}));
+    assert_eq!(doc["redirect"]["redirected"], 3, "beta too once the floor is lifted");
+
+    let (code, doc) = scan_json(&web, &server.uri(), &["--dry-run"], &[("SOCKET_MIN_SEVERITY", "critical")]);
+    assert_eq!(code, 0, "{doc:#}");
+    assert_eq!(doc["policy"]["minSeverity"], json!({"value": "critical", "source": "env"}));
+    assert_eq!(doc["redirect"]["redirected"], 1);
+
+    // The flag beats the env; an empty env value is unset.
+    let (_, doc) = scan_json(&web, &server.uri(), &["--dry-run", "--min-severity", "moderate"], &[("SOCKET_MIN_SEVERITY", "critical")]);
+    assert_eq!(doc["policy"]["minSeverity"], json!({"value": "medium", "source": "flag"}));
+    let (_, doc) = scan_json(&web, &server.uri(), &["--dry-run"], &[("SOCKET_MIN_SEVERITY", "")]);
+    assert_eq!(doc["policy"]["minSeverity"], json!({"value": "high", "source": "file"}));
+
+    // Malformed values are usage errors.
+    let (code, _, stderr) = scan(&web, &server.uri(), &["--min-severity", "severe"], &[]);
+    assert_eq!(code, 2, "{stderr}");
+    let (code, _, stderr) = scan(&web, &server.uri(), &[], &[("SOCKET_MIN_SEVERITY", "severe")]);
+    assert_eq!(code, 2, "{stderr}");
+    assert!(stderr.contains("SOCKET_MIN_SEVERITY"), "{stderr}");
+}
+
+#[tokio::test]
+#[serial]
+async fn narrowing_after_a_hosted_patch_leaves_the_pin_byte_identical() {
+    let server = MockServer::start().await;
+    mount_api(&server, vec![P_ALPHA]).await;
+    let repo = Repo::new(None);
+    let web = repo.dir("services/web");
+    let (code, doc) = scan_json(&web, &server.uri(), &[], &[]);
+    assert_eq!(code, 0, "{doc:#}");
+    let pinned = repo.lock("services/web");
+    assert!(pinned.contains(&P_ALPHA.hosted_url()));
+
+    // A newer merged patch appears, and the repo now ignores alpha.
+    std::fs::write(repo.root.join("socket.yml"), "version: 2\npatches:\n  ignorePackages: [alpha]\n").unwrap();
+    server.reset().await;
+    mount_api(&server, vec![P_ALPHA, P_ALPHA_MERGED_NEW]).await;
+    let (code, doc) = scan_json(&web, &server.uri(), &[], &[]);
+    assert_eq!(code, 0, "{doc:#}");
+    assert_eq!(repo.lock("services/web"), pinned, "retained: not upgraded, not removed");
+    let retained = &doc["policy"]["retained"][0];
+    assert_eq!(retained["purl"], "pkg:npm/alpha@1.0.0");
+    assert_eq!(retained["recordedUuid"], P_ALPHA.uuid);
+    assert_eq!(retained["reason"], "policy_package_ignored");
+    assert_eq!(retained["upgradeAvailable"], true);
+    assert_eq!(retained["project"], "services/web");
+    assert_eq!(doc["policy"]["counts"]["retained"], 1);
+
+    // Same with the whole root excluded, and with enabled: false.
+    for yml in [
+        "version: 2\npatches:\n  ignorePaths: [\"services/\"]\n",
+        "version: 2\npatches:\n  enabled: false\n",
+    ] {
+        std::fs::write(repo.root.join("socket.yml"), yml).unwrap();
+        let (code, doc) = scan_json(&web, &server.uri(), &[], &[]);
+        assert_eq!(code, 0, "{doc:#}");
+        assert_eq!(repo.lock("services/web"), pinned, "{yml}");
+        assert_eq!(doc["policy"]["retained"][0]["purl"], "pkg:npm/alpha@1.0.0", "{yml}: {:#}", doc["policy"]);
+    }
+}
+
+#[tokio::test]
+#[serial]
+async fn enabled_false_reports_and_writes_nothing() {
+    let server = MockServer::start().await;
+    mount_api(&server, catalog()).await;
+    let repo = Repo::new(Some("version: 2\npatches:\n  enabled: false\n"));
+    let before = repo.snapshot();
+    let (code, doc) = scan_json(&repo.dir("services/web"), &server.uri(), &[], &[]);
+    assert_eq!(code, 0, "{doc:#}");
+    assert_eq!(repo.snapshot(), before);
+    assert_eq!(doc["policy"]["enabled"], false);
+    assert!(warning_codes(&doc).contains(&"patches_disabled".to_string()), "{doc:#}");
+    let reasons: Vec<String> = filtered(&doc).into_iter().map(|(_, r)| r).collect();
+    assert!(!reasons.is_empty() && reasons.iter().all(|r| r == "policy_disabled"), "{reasons:?}");
+    assert_eq!(doc["redirect"]["redirected"], 0);
+}
+
+#[tokio::test]
+#[serial]
+async fn report_only_json_fails_when_every_detail_query_fails() {
+    let server = MockServer::start().await;
+    Mock::given(method("GET"))
+        .and(path_regex(format!("^/v0/orgs/{ORG}/patches/by-package/.+$")))
+        .respond_with(ResponseTemplate::new(500))
+        .with_priority(1)
+        .mount(&server)
+        .await;
+    mount_api(&server, catalog()).await;
+    // `--prune` with no mode is the report-only arm.
+    let repo = Repo::new(Some("version: 2\npatches:\n  minSeverity: critical\n"));
+    let before = repo.snapshot();
+    let (code, doc) = scan_json(&repo.dir("services/web"), &server.uri(), &["--prune"], &[]);
+    assert_eq!(code, 1, "{doc:#}");
+    assert_eq!(doc["status"], "error", "{doc:#}");
+    assert!(
+        doc["error"].as_str().unwrap_or_default().contains("patch-detail queries failed"),
+        "{doc:#}"
+    );
+    assert_eq!(repo.snapshot(), before);
+}
+
+#[tokio::test]
+#[serial]
+async fn recorded_merged_patch_below_a_new_floor_is_kept() {
+    let server = MockServer::start().await;
+    mount_api(&server, vec![P_ALPHA_MERGED_LOW, P_ALPHA]).await;
+    let repo = Repo::new(None);
+    let web = repo.dir("services/web");
+    let (code, doc) = scan_json(&web, &server.uri(), &[], &[]);
+    assert_eq!(code, 0, "{doc:#}");
+    let pinned = repo.lock("services/web");
+    assert!(pinned.contains(&P_ALPHA_MERGED_LOW.hosted_url()), "merged ranks first:\n{pinned}");
+
+    std::fs::write(repo.root.join("socket.yml"), "version: 2\npatches:\n  minSeverity: high\n").unwrap();
+    let (code, doc) = scan_json(&web, &server.uri(), &[], &[]);
+    assert_eq!(code, 0, "{doc:#}");
+    assert_eq!(repo.lock("services/web"), pinned, "the floor never replaces the recorded merged patch");
+    assert_eq!(doc["policy"]["minSeverity"], json!({"value": "high", "source": "file"}));
+    assert_eq!(doc["policy"]["counts"]["filtered"], 0, "a kept recorded patch is not a skip: {:#}", doc["policy"]);
+
+    // The floor is live: a fresh root with the same offers gets the
+    // floor-admitted patch, not the merged low one.
+    let fresh = Repo::new(Some("version: 2\npatches:\n  minSeverity: high\n"));
+    let (code, doc) = scan_json(&fresh.dir("services/web"), &server.uri(), &[], &[]);
+    assert_eq!(code, 0, "{doc:#}");
+    let lock = fresh.lock("services/web");
+    assert!(lock.contains(&P_ALPHA.hosted_url()), "{lock}");
+    assert!(!lock.contains(P_ALPHA_MERGED_LOW.uuid), "{lock}");
+}
+
+#[tokio::test]
+#[serial]
+async fn floor_with_nothing_admitted_reports_the_withheld_patch() {
+    let server = MockServer::start().await;
+    mount_api(&server, vec![P_BETA]).await;
+    let repo = Repo::new(Some("version: 2\npatches:\n  minSeverity: critical\n"));
+    let web = repo.dir("services/web");
+    let lock = repo.lock("services/web");
+    let (code, stdout, stderr) = scan(&web, &server.uri(), &[], &[]);
+    assert_eq!(code, 0, "{stdout}\n{stderr}");
+    assert_eq!(repo.lock("services/web"), lock);
+    assert!(stdout.contains("Policy (socket.yml): 1 skipped by filters"), "{stdout}");
+    // Only critical/high are named without --verbose.
+    assert!(!stdout.contains("skipped beta"), "{stdout}");
+    let (_, stdout, _) = scan(&web, &server.uri(), &["--verbose"], &[]);
+    assert!(stdout.contains("skipped pkg:npm/beta@1.0.0 (low): low < critical"), "{stdout}");
+}
+
+#[tokio::test]
+#[serial]
+async fn path_outside_the_repo_is_a_usage_error() {
+    let server = MockServer::start().await;
+    mount_api(&server, catalog()).await;
+    let repo = Repo::new(None);
+    let outside = repo.root.parent().unwrap().join("elsewhere");
+    write_npm_root(&outside, &["alpha"]);
+    let (code, _, stderr) = scan(&repo.dir("services"), &server.uri(), &["web", "../../elsewhere"], &[]);
+    assert_eq!(code, 2, "{stderr}");
+    assert!(stderr.contains("is outside") && stderr.contains("run one scan per repository"), "{stderr}");
+}
+
+#[tokio::test]
+#[serial]
+async fn project_ignore_paths_is_honored_without_a_patches_block() {
+    let server = MockServer::start().await;
+    mount_api(&server, catalog()).await;
+    let repo = Repo::new(Some("version: 2\nprojectIgnorePaths:\n  - \"services/legacy/**\"\n"));
+    let legacy = repo.lock("services/legacy");
+    let (code, doc) = scan_json(&repo.dir("services/legacy"), &server.uri(), &[], &[]);
+    assert_eq!(code, 0, "{doc:#}");
+    assert_eq!(repo.lock("services/legacy"), legacy);
+    let entry = &doc["policy"]["filtered"][0];
+    assert_eq!(entry["reason"], "policy_path_excluded");
+    assert_eq!(entry["detail"], "services/legacy/** (projectIgnorePaths)");
+
+    // A malformed projectIgnorePaths without a patches block only warns.
+    std::fs::write(repo.root.join("socket.yml"), "version: 2\nprojectIgnorePaths: {a: 1}\n").unwrap();
+    let (code, doc) = scan_json(&repo.dir("services/legacy"), &server.uri(), &["--dry-run"], &[]);
+    assert_eq!(code, 0, "{doc:#}");
+    assert!(warning_codes(&doc).contains(&"socket_yml_ignored_value".to_string()), "{doc:#}");
+}
+
+// ---------------------------------------------------------------------------
+// Agent
+// ---------------------------------------------------------------------------
+
+#[tokio::test]
+#[serial]
+async fn agent_mode_applies_only_admitted_patches() {
+    let server = MockServer::start().await;
+    mount_api(&server, catalog()).await;
+    let repo = Repo::new(Some(
+        "version: 2\npatches:\n  minSeverity: high\n  ecosystems: [npm]\n  ignorePackages: [\"pkg:npm/left-pad\"]\n",
+    ));
+    let web = repo.dir("services/web");
+    let (code, doc) = scan_json(&web, &server.uri(), &["--mode", "agent", "--dry-run"], &[]);
+    assert_eq!(code, 0, "{doc:#}");
+    let planned: Vec<&str> = doc["apply"]["patches"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .map(|p| p["purl"].as_str().unwrap())
+        .collect();
+    assert_eq!(planned, ["pkg:npm/alpha@1.0.0"], "{doc:#}");
+
+    let (code, doc) = scan_json(&web, &server.uri(), &["--mode", "agent"], &[]);
+    assert_eq!(code, 0, "{doc:#}");
+    let manifest: Value =
+        serde_json::from_str(&std::fs::read_to_string(web.join(".socket/manifest.json")).unwrap()).unwrap();
+    let keys: Vec<&String> = manifest["patches"].as_object().unwrap().keys().collect();
+    assert_eq!(keys, ["pkg:npm/alpha@1.0.0"]);
+    assert_eq!(
+        std::fs::read_to_string(web.join("node_modules/alpha/index.js")).unwrap(),
+        patched_index("alpha")
+    );
+    assert_eq!(std::fs::read_to_string(web.join("node_modules/beta/index.js")).unwrap(), orig_index("beta"));
+}
+
+#[tokio::test]
+#[serial]
+async fn agent_mode_retains_a_recorded_patch_the_policy_now_excludes() {
+    let server = MockServer::start().await;
+    mount_api(&server, vec![P_ALPHA]).await;
+    let repo = Repo::new(None);
+    let web = repo.dir("services/web");
+    let (code, doc) = scan_json(&web, &server.uri(), &["--mode", "agent"], &[]);
+    assert_eq!(code, 0, "{doc:#}");
+    let manifest_before = std::fs::read(web.join(".socket/manifest.json")).unwrap();
+    let installed_before = std::fs::read(web.join("node_modules/alpha/index.js")).unwrap();
+
+    std::fs::write(repo.root.join("socket.yml"), "version: 2\npatches:\n  ecosystems: [pypi]\n").unwrap();
+    server.reset().await;
+    mount_api(&server, vec![P_ALPHA, P_ALPHA_MERGED_NEW]).await;
+    let (code, doc) = scan_json(&web, &server.uri(), &["--mode", "agent"], &[]);
+    assert_eq!(code, 0, "{doc:#}");
+    assert_eq!(std::fs::read(web.join(".socket/manifest.json")).unwrap(), manifest_before);
+    assert_eq!(std::fs::read(web.join("node_modules/alpha/index.js")).unwrap(), installed_before);
+    assert_eq!(doc["policy"]["retained"][0]["reason"], "policy_ecosystem");
+    assert_eq!(doc["policy"]["retained"][0]["upgradeAvailable"], true);
+}
+
+// ---------------------------------------------------------------------------
+// Vendored
+// ---------------------------------------------------------------------------
+
+#[tokio::test]
+#[serial]
+async fn vendored_dry_run_previews_only_admitted_patches() {
+    let server = MockServer::start().await;
+    mount_api(&server, catalog()).await;
+    let repo = Repo::new(Some("version: 2\npatches:\n  packages: [\"pkg:npm/beta\", \"pkg:npm/left-pad\"]\n  minSeverity: medium\n"));
+    let before = repo.snapshot();
+    let (code, doc) = scan_json(&repo.dir("services/web"), &server.uri(), &["--mode", "vendored", "--dry-run"], &[]);
+    assert_eq!(code, 0, "{doc:#}");
+    assert_eq!(repo.snapshot(), before);
+    let previewed: Vec<&str> = doc["vendor"]["patches"]
+        .as_array()
+        .unwrap_or_else(|| panic!("{doc:#}"))
+        .iter()
+        .filter_map(|p| p["purl"].as_str())
+        .collect();
+    assert_eq!(previewed, ["pkg:npm/left-pad@1.0.0"], "{doc:#}");
+    assert_eq!(filtered_reason(&doc, "pkg:npm/alpha@1.0.0")["reason"], "policy_package_not_listed");
+    assert_eq!(filtered_reason(&doc, "pkg:npm/beta@1.0.0")["reason"], "policy_severity");
+}
+
+// ---------------------------------------------------------------------------
+// get
+// ---------------------------------------------------------------------------
+
+#[tokio::test]
+#[serial]
+async fn get_bypasses_the_policy_with_a_warning() {
+    let server = MockServer::start().await;
+    mount_api(&server, catalog()).await;
+    let repo = Repo::new(Some("version: 2\npatches:\n  ignorePackages: [alpha]\n"));
+    let web = repo.dir("services/web");
+    let args = [
+        "get",
+        "pkg:npm/alpha@1.0.0",
+        "--json",
+        "--yes",
+        "--dry-run",
+        "--cwd",
+        web.to_str().unwrap(),
+        "--api-url",
+        &server.uri(),
+        "--org",
+        ORG,
+        "--api-token",
+        "fake",
+    ];
+    let (code, stdout, stderr) = run_cli(&web, &args, &[]);
+    assert_eq!(code, 0, "stdout:\n{stdout}\nstderr:\n{stderr}");
+    let doc: Value = serde_json::from_str(&stdout).unwrap();
+    let warnings: Vec<&str> = doc["warnings"].as_array().unwrap().iter().filter_map(Value::as_str).collect();
+    assert!(
+        warnings.iter().any(|w| w.starts_with("(policy_bypassed)") && w.contains("alpha")),
+        "{doc:#}"
+    );
+
+    // An invalid file never fails `get`; it only drops the warning.
+    std::fs::write(repo.root.join("socket.yml"), "version: 2\npatches: [\n").unwrap();
+    let (code, stdout, stderr) = run_cli(&web, &args, &[]);
+    assert_eq!(code, 0, "stdout:\n{stdout}\nstderr:\n{stderr}");
+    assert!(!stdout.contains("policy_bypassed"), "{stdout}");
+}
+
+#[tokio::test]
+#[serial]
+async fn agent_mode_honors_path_filters_and_keeps_the_prune_universe() {
+    let server = MockServer::start().await;
+    mount_api(&server, vec![P_ALPHA, P_BETA]).await;
+    let repo = Repo::new(None);
+    let web = repo.dir("services/web");
+    let (code, doc) = scan_json(&web, &server.uri(), &["--mode", "agent"], &[]);
+    assert_eq!(code, 0, "{doc:#}");
+    let manifest_before = std::fs::read(web.join(".socket/manifest.json")).unwrap();
+    let recorded: Value = serde_json::from_slice(&manifest_before).unwrap();
+    assert_eq!(recorded["patches"].as_object().unwrap().len(), 2);
+
+    // The root is excluded by path: nothing selected, and a --sync (agent
+    // + prune) still judges the full crawl, so no entry is pruned.
+    std::fs::write(repo.root.join("socket.yml"), "version: 2\npatches:\n  includePaths: [\"/services/legacy/\"]\n").unwrap();
+    let (code, doc) = scan_json(&web, &server.uri(), &["--sync"], &[]);
+    assert_eq!(code, 0, "{doc:#}");
+    assert_eq!(std::fs::read(web.join(".socket/manifest.json")).unwrap(), manifest_before);
+    assert_eq!(doc["policy"]["filtered"][0]["purl"], Value::Null);
+    assert_eq!(doc["policy"]["filtered"][0]["reason"], "policy_path_not_included");
+    assert_eq!(doc["policy"]["counts"]["retained"], 2, "{:#}", doc["policy"]);
+    assert_eq!(doc["gc"]["removed"].as_array().map_or(0, Vec::len), 0, "{:#}", doc["gc"]);
+
+    // A narrower ecosystem list under --sync prunes nothing either.
+    std::fs::write(repo.root.join("socket.yml"), "version: 2\npatches:\n  ecosystems: [pypi]\n").unwrap();
+    let (code, doc) = scan_json(&web, &server.uri(), &["--sync"], &[]);
+    assert_eq!(code, 0, "{doc:#}");
+    assert_eq!(std::fs::read(web.join(".socket/manifest.json")).unwrap(), manifest_before);
+
+    // patches.enabled: false skips the GC entirely.
+    std::fs::remove_dir_all(web.join("node_modules/beta")).unwrap();
+    let pkg_lock = repo.lock("services/web").replace("\"node_modules/beta\"", "\"node_modules/gone\"");
+    std::fs::write(web.join("package-lock.json"), pkg_lock).unwrap();
+    std::fs::write(repo.root.join("socket.yml"), "version: 2\npatches:\n  enabled: false\n").unwrap();
+    let (code, doc) = scan_json(&web, &server.uri(), &["--sync"], &[]);
+    assert_eq!(code, 0, "{doc:#}");
+    assert!(doc.get("gc").is_none(), "{doc:#}");
+    assert_eq!(std::fs::read(web.join(".socket/manifest.json")).unwrap(), manifest_before);
+}
+
+#[tokio::test]
+#[serial]
+async fn narrowing_after_vendoring_leaves_the_vendored_package_byte_identical() {
+    let server = MockServer::start().await;
+    mount_api(&server, vec![P_ALPHA]).await;
+    let repo = Repo::new(None);
+    let web = repo.dir("services/web");
+    // Vendor alpha for real (offline, from a seeded manifest + blob).
+    let before = compute_git_sha256_from_bytes(orig_index("alpha").as_bytes());
+    let after = compute_git_sha256_from_bytes(patched_index("alpha").as_bytes());
+    std::fs::create_dir_all(web.join(".socket/blobs")).unwrap();
+    std::fs::write(web.join(".socket/blobs").join(&after), patched_index("alpha")).unwrap();
+    let manifest = json!({"patches": {P_ALPHA.purl(): {
+        "uuid": P_ALPHA.uuid, "exportedAt": "2026-01-01T00:00:00Z",
+        "files": {"package/index.js": {"beforeHash": before, "afterHash": after}},
+        "vulnerabilities": {}, "description": "d", "license": "MIT", "tier": "free"
+    }}});
+    std::fs::write(web.join(".socket/manifest.json"), serde_json::to_vec_pretty(&manifest).unwrap()).unwrap();
+    let (code, stdout, stderr) = run_cli(&web, &["vendor", "--json", "--offline", "--cwd", web.to_str().unwrap()], &[]);
+    assert_eq!(code, 0, "vendor fixture: {stdout}\n{stderr}");
+    assert!(repo.lock("services/web").contains(".socket/vendor/"), "vendored lock");
+    let snapshot = repo.snapshot();
+
+    std::fs::write(repo.root.join("socket.yml"), "version: 2\npatches:\n  ignorePackages: [\"pkg:npm/alpha\"]\n").unwrap();
+    let (code, doc) = scan_json(&web, &server.uri(), &["--mode", "vendored"], &[]);
+    assert_eq!(code, 0, "{doc:#}");
+    let mut after_scan = repo.snapshot();
+    after_scan.remove("socket.yml");
+    assert_eq!(after_scan, snapshot, "the vendored package, its lock wiring and ledger stay byte-identical");
+    assert_eq!(doc["policy"]["retained"][0]["purl"], "pkg:npm/alpha@1.0.0", "{:#}", doc["policy"]);
+}
+
diff --git a/crates/socket-patch-cli/tests/hosted_memory_common/mod.rs b/crates/socket-patch-cli/tests/hosted_memory_common/mod.rs
index 9ff12449..6d8b2427 100644
--- a/crates/socket-patch-cli/tests/hosted_memory_common/mod.rs
+++ b/crates/socket-patch-cli/tests/hosted_memory_common/mod.rs
@@ -305,13 +305,28 @@ pub struct DiskRun {
 /// node / pipenv / gem subprocesses), `HOME` and the language caches at
 /// empty directories, no socket-cli config, no telemetry.
 pub fn run_disk(server: &MockServer, files: &BTreeMap<String, Vec<u8>>, dry_run: bool) -> DiskRun {
-    let project = tempfile::tempdir().unwrap();
+    run_disk_in(server, files, "", dry_run)
+}
+
+/// [`run_disk`] with `--cwd` at the repo-relative `cwd_rel` of a checkout
+/// (a `.git` directory marks the repo root, so a root `socket.yml`
+/// applies); `changed` stays relative to the repo root.
+pub fn run_disk_in(
+    server: &MockServer,
+    files: &BTreeMap<String, Vec<u8>>,
+    cwd_rel: &str,
+    dry_run: bool,
+) -> DiskRun {
+    let checkout = tempfile::tempdir().unwrap();
     let home = tempfile::tempdir().unwrap();
     for (rel, bytes) in files {
-        let path = project.path().join(rel);
+        let path = checkout.path().join(rel);
         std::fs::create_dir_all(path.parent().unwrap()).unwrap();
         std::fs::write(&path, bytes).unwrap();
     }
+    // The checkout is its own repo: no socket.yml above the temp dir applies.
+    std::fs::create_dir_all(checkout.path().join(".git")).unwrap();
+    let cwd = checkout.path().join(cwd_rel);
     let mut cmd = std::process::Command::new(env!("CARGO_BIN_EXE_socket-patch"));
     cmd.env_clear();
     for keep in [
@@ -349,7 +364,7 @@ pub fn run_disk(server: &MockServer, files: &BTreeMap<String, Vec<u8>>, dry_run:
         "--json",
         "--yes",
         "--cwd",
-        project.path().to_str().unwrap(),
+        cwd.to_str().unwrap(),
         "--org",
         ORG,
         "--api-token",
@@ -365,7 +380,7 @@ pub fn run_disk(server: &MockServer, files: &BTreeMap<String, Vec<u8>>, dry_run:
     let stderr = String::from_utf8_lossy(&output.stderr).to_string();
     let envelope: Value = serde_json::from_str(&stdout)
         .unwrap_or_else(|e| panic!("disk --json output is not JSON ({e}):\n{stdout}\n{stderr}"));
-    let after = read_tree(project.path());
+    let after = read_tree(checkout.path());
     let changed = after
         .into_iter()
         .filter(|(rel, bytes)| files.get(rel) != Some(bytes))
diff --git a/crates/socket-patch-cli/tests/hosted_memory_parity.rs b/crates/socket-patch-cli/tests/hosted_memory_parity.rs
index 5876fe19..b297eaf7 100644
--- a/crates/socket-patch-cli/tests/hosted_memory_parity.rs
+++ b/crates/socket-patch-cli/tests/hosted_memory_parity.rs
@@ -745,3 +745,369 @@ async fn excluded_nested_cargo_project_is_its_own_root_through_selection() {
         memory.warnings
     );
 }
+
+/// A three-root repo with a root socket.yml: two copies of the npm
+/// fixture and the cargo fixture.
+fn policy_repo(socket_yml: &str) -> (Vec<Patch>, BTreeMap<String, Vec<u8>>) {
+    let npm = fixtures_root().join("redirect/npm/package-lock-v3/basic");
+    let cargo = fixtures_root().join("redirect/cargo/cargo/basic");
+    let mut patches = patches_from_overrides(&npm.join("overrides.json"), None);
+    patches.extend(patches_from_overrides(&cargo.join("overrides.json"), None));
+    let mut repo: BTreeMap<String, Vec<u8>> = BTreeMap::new();
+    for (root, dir) in [("apps/web", &npm), ("apps/legacy", &npm), ("services/api", &cargo)] {
+        for (rel, bytes) in fixture_files(&dir.join("input")) {
+            repo.insert(format!("{root}/{rel}"), bytes);
+        }
+    }
+    repo.insert("socket.yml".to_string(), socket_yml.as_bytes().to_vec());
+    (patches, repo)
+}
+
+/// The host's two-phase flow: fetch the root policy files, select with
+/// their text, stream what selection asks for (presence-only paths marked
+/// present) and pass selection's policy outputs to the session.
+fn two_phase(
+    files: &BTreeMap<String, Vec<u8>>,
+    mut opts: socket_patch_cli::hosted_memory::HostedScanOptions,
+) -> (
+    socket_patch_cli::hosted_memory::PathSelection,
+    socket_patch_cli::hosted_memory::HostedScanInput,
+) {
+    use socket_patch_cli::hosted_memory::{select_paths, PolicyFileInput, SelectOptions, TreeEntryInput};
+    let entries: Vec<TreeEntryInput> = files
+        .iter()
+        .map(|(p, bytes)| TreeEntryInput {
+            path: p.clone(),
+            mode: "100644".into(),
+            kind: "blob".into(),
+            size: Some(bytes.len() as u64),
+        })
+        .collect();
+    let policy_files: Vec<PolicyFileInput> = ["socket.yml", "socket.yaml"]
+        .iter()
+        .filter_map(|name| {
+            files.get(*name).map(|bytes| PolicyFileInput {
+                path: name.to_string(),
+                text: Some(String::from_utf8(bytes.clone()).unwrap()),
+                missing: None,
+            })
+        })
+        .collect();
+    let selection = select_paths(
+        &entries,
+        &SelectOptions {
+            policy_files: Some(policy_files),
+            no_socket_yml: opts.no_socket_yml,
+            ..SelectOptions::default()
+        },
+    );
+    let fetched: BTreeMap<String, Vec<u8>> = selection
+        .fetch_text
+        .iter()
+        .chain(selection.fetch_binary.iter())
+        .map(|p| (p.clone(), files[p].clone()))
+        .collect();
+    let present: Vec<&str> = selection.present_only.iter().map(String::as_str).collect();
+    opts.policy_paths = Some(selection.policy_paths.clone());
+    opts.policy_sha256 = selection.policy_sha256.clone();
+    let input = build_input(&fetched, &present, opts);
+    (selection, input)
+}
+
+fn policy_input(files: &BTreeMap<String, Vec<u8>>) -> socket_patch_cli::hosted_memory::HostedScanInput {
+    let (selection, input) = two_phase(files, options(false));
+    assert!(selection.policy_error.is_none(), "{:?}", selection.policy_error);
+    input
+}
+
+/// Session options as selection of `files` would hand them over, without
+/// going through selection (for inputs a host may get wrong).
+fn policy_options(files: &BTreeMap<String, Vec<u8>>) -> socket_patch_cli::hosted_memory::HostedScanOptions {
+    let (selection, _) = two_phase(files, options(false));
+    let mut opts = options(false);
+    opts.policy_paths = Some(selection.policy_paths);
+    opts.policy_sha256 = selection.policy_sha256;
+    opts
+}
+
+/// `(project, purl, reason)` of a `policy.filtered[]` list.
+fn filtered_set(policy: &Value) -> std::collections::BTreeSet<(String, Option<String>, String)> {
+    policy["filtered"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .map(|f| {
+            (
+                f["project"].as_str().unwrap().to_string(),
+                f["purl"].as_str().map(str::to_string),
+                f["reason"].as_str().unwrap().to_string(),
+            )
+        })
+        .collect()
+}
+
+#[tokio::test]
+async fn parity_socket_yml_filters_the_same_roots_and_packages() {
+    let (patches, repo) = policy_repo(
+        "version: 2\npatches:\n  ignorePaths: [\"/apps/legacy/\"]\n  ignorePackages: [\"pkg:cargo/serde\"]\n",
+    );
+    let server = MockServer::start().await;
+    mount_api(&server, &patches).await;
+    let (selection, input) = two_phase(&repo, options(false));
+    assert!(selection.policy_error.is_none(), "{:?}", selection.policy_error);
+    let memory = run_engine(&server, input).await;
+    assert!(memory.policy_error.is_none(), "{:?}", memory.policy_error);
+    let roots: Vec<&str> = memory.projects.iter().map(|p| p.root.as_str()).collect();
+    assert_eq!(roots, vec!["apps/web", "services/api"], "the ignored root is not processed");
+    // Selection reports the root it excluded; nothing of it is streamed.
+    assert!(selection
+        .ignored_sample
+        .iter()
+        .any(|i| i.path == "apps/legacy/package-lock.json" && i.reason == "policy_path_excluded"));
+    assert!(!selection.fetch_text.iter().chain(&selection.present_only).any(|p| p.starts_with("apps/legacy/")));
+    let memory_policy = memory.policy.clone().expect("policy block");
+    assert_eq!(memory_policy["source"], "file");
+
+    let mut disk_filtered = std::collections::BTreeSet::new();
+    for root in ["apps/web", "apps/legacy", "services/api"] {
+        let disk = run_disk_in(&server, &repo, root, false);
+        assert_eq!(disk.envelope["status"], "success", "{root}: {}", disk.stderr);
+        assert_eq!(disk.envelope["policy"]["sha256"], memory_policy["sha256"], "{root}");
+        disk_filtered.extend(filtered_set(&disk.envelope["policy"]));
+        if let Some(project) = memory.projects.iter().find(|p| p.root == root) {
+            assert_eq!(project.redirect, disk.envelope["redirect"], "{root}");
+            let prefix = format!("{root}/");
+            let memory_changed: BTreeMap<String, Vec<u8>> = engine_changed(&memory)
+                .into_iter()
+                .filter(|(k, _)| k.starts_with(&prefix))
+                .collect();
+            assert_eq!(memory_changed, disk.changed, "{root}");
+        } else {
+            assert!(disk.changed.is_empty(), "{root}: an ignored root changes nothing");
+        }
+    }
+    let mut memory_filtered = filtered_set(&memory_policy);
+    memory_filtered.insert(("apps/legacy".to_string(), None, "policy_path_excluded".to_string()));
+    assert_eq!(memory_filtered, disk_filtered);
+    assert!(disk_filtered.contains(&("apps/legacy".to_string(), None, "policy_path_excluded".to_string())));
+    assert!(disk_filtered.contains(&(
+        "services/api".to_string(),
+        Some("pkg:cargo/serde@1.0.190".to_string()),
+        "policy_package_ignored".to_string()
+    )));
+}
+
+#[tokio::test]
+async fn parity_socket_yml_severity_floor() {
+    let (patches, repo) = policy_repo("version: 2\npatches:\n  minSeverity: critical\n");
+    let server = MockServer::start().await;
+    mount_api(&server, &patches).await;
+    let memory = run_engine(&server, policy_input(&repo)).await;
+    let web = memory.projects.iter().find(|p| p.root == "apps/web").unwrap();
+    assert!(web.redirected.is_empty(), "{:#}", web.redirect);
+    assert!(web.skipped.iter().any(|s| s.reason == "policy_severity"), "{:?}", web.skipped);
+    assert!(engine_changed(&memory).is_empty());
+    let disk = run_disk_in(&server, &repo, "apps/web", false);
+    assert!(disk.changed.is_empty());
+    assert_eq!(disk.envelope["redirect"], web.redirect);
+    let memory_web: std::collections::BTreeSet<_> = filtered_set(memory.policy.as_ref().unwrap())
+        .into_iter()
+        .filter(|(project, _, _)| project == "apps/web")
+        .collect();
+    assert_eq!(memory_web, filtered_set(&disk.envelope["policy"]));
+}
+
+#[tokio::test]
+async fn memory_policy_file_withheld_or_invalid_is_a_policy_error() {
+    let (patches, repo) = policy_repo("version: 2\npatches:\n  maxNewPatches: 1\n");
+    let server = MockServer::start().await;
+    mount_api(&server, &patches).await;
+    let opts = policy_options(&repo);
+    // Listed by selection but never streamed.
+    let mut withheld = repo.clone();
+    withheld.remove("socket.yml");
+    let out = run_engine(&server, build_input(&withheld, &[], opts.clone())).await;
+    let err = out.policy_error.expect("policyError");
+    assert_eq!(err.code, "socket_yml_invalid");
+    assert!(out.projects.is_empty() && out.changed_files.is_empty() && out.policy.is_none());
+    // Streamed present-without-content.
+    let out = run_engine(&server, build_input(&withheld, &["socket.yml"], opts.clone())).await;
+    assert_eq!(out.policy_error.expect("policyError").code, "socket_yml_invalid");
+    // Content other than what selection read.
+    let mut changed = repo.clone();
+    changed.insert("socket.yml".to_string(), b"version: 2\n".to_vec());
+    let out = run_engine(&server, build_input(&changed, &[], opts.clone())).await;
+    let err = out.policy_error.expect("policyError");
+    assert!(err.detail.contains("differs"), "{}", err.detail);
+    // The file streamed without selection's policySha256.
+    let mut no_sha = opts.clone();
+    no_sha.policy_sha256 = None;
+    let out = run_engine(&server, build_input(&repo, &[], no_sha)).await;
+    assert_eq!(out.policy_error.expect("policyError").code, "socket_yml_invalid");
+    // Invalid content: selection refuses it before anything is fetched.
+    let (_, bad) = policy_repo("version: 2\npatches:\n  apiUrl: https://evil.example\n");
+    let (selection, _) = two_phase(&bad, options(false));
+    let err = selection.policy_error.expect("selection policyError");
+    assert!(err.detail.contains("patches.apiUrl"), "{}", err.detail);
+    assert!(selection.roots.is_empty() && selection.fetch_text.is_empty());
+    let out = run_engine(&server, build_input(&bad, &[], opts.clone())).await;
+    let err = out.policy_error.expect("policyError");
+    assert!(err.detail.contains("patches.apiUrl"), "{}", err.detail);
+    assert!(out.changed_files.is_empty());
+    // A bypassed session with a selection that applied the file.
+    let mut half = opts.clone();
+    half.no_socket_yml = Some(true);
+    let out = run_engine(&server, build_input(&repo, &[], half)).await;
+    assert_eq!(out.policy_error.expect("policyError").code, "socket_yml_invalid");
+    // noSocketYml skips it on both sides.
+    let mut bypass = options(false);
+    bypass.no_socket_yml = Some(true);
+    let (selection, input) = two_phase(&bad, bypass);
+    assert!(selection.policy_error.is_none() && selection.policy_sha256.is_none());
+    let out = run_engine(&server, input).await;
+    assert!(out.policy_error.is_none());
+    assert_eq!(out.policy.unwrap()["source"], "bypassed");
+}
+
+#[tokio::test]
+async fn memory_min_severity_option_beats_the_file() {
+    let (patches, repo) = policy_repo("version: 2\npatches:\n  minSeverity: critical\n");
+    let server = MockServer::start().await;
+    mount_api(&server, &patches).await;
+    let mut opts = options(false);
+    opts.min_severity = Some("none".to_string());
+    let (_, input) = two_phase(&repo, opts);
+    let out = run_engine(&server, input).await;
+    let policy = out.policy.unwrap();
+    assert_eq!(policy["minSeverity"], serde_json::json!({"value": null, "source": "flag"}));
+    assert!(out.projects.iter().any(|p| !p.redirected.is_empty()));
+    let mut bad = options(false);
+    bad.min_severity = Some("severe".to_string());
+    assert!(socket_patch_cli::hosted_memory::SessionBuilder::new(bad).is_err());
+}
+
+#[test]
+fn selection_applies_the_path_policy_and_fails_closed() {
+    use socket_patch_cli::hosted_memory::{select_paths, PolicyFileInput, SelectOptions, TreeEntryInput};
+    let blob = |path: &str, mode: &str| TreeEntryInput {
+        path: path.to_string(),
+        mode: mode.to_string(),
+        kind: "blob".into(),
+        size: Some(1),
+    };
+    let text = |path: &str, text: &str| PolicyFileInput {
+        path: path.to_string(),
+        text: Some(text.to_string()),
+        missing: None,
+    };
+    let mut entries = vec![
+        blob("socket.yml", "100644"),
+        blob("Socket.yml", "100644"),
+        blob("apps/web/package-lock.json", "100644"),
+        blob("apps/web/tests/app/package-lock.json", "100644"),
+        blob("Fixtures/x/yarn.lock", "100644"),
+        blob("apps/old/yarn.lock", "100644"),
+    ];
+    let with = |files: Vec<PolicyFileInput>| SelectOptions {
+        policy_files: Some(files),
+        ..SelectOptions::default()
+    };
+    let yml = "version: 2\npatches:\n  ignorePaths: [\"/apps/old/\"]\n";
+    let selection = select_paths(&entries, &with(vec![text("socket.yml", yml)]));
+    assert!(selection.policy_error.is_none(), "{:?}", selection.policy_error);
+    assert_eq!(selection.policy_paths, vec!["socket.yml"]);
+    assert_eq!(selection.policy_sha256.as_ref().map(String::len), Some(64));
+    assert!(selection.fetch_text.contains(&"socket.yml".to_string()));
+    assert_eq!(selection.roots, vec!["apps/web"]);
+    // Excluded roots (file list and built-in ignores, any case) are
+    // reported and never streamed.
+    for path in ["apps/old/yarn.lock", "apps/web/tests/app/package-lock.json", "Fixtures/x/yarn.lock"] {
+        assert!(
+            selection.ignored_sample.iter().any(|i| i.path == path && i.reason == "policy_path_excluded"),
+            "{path}: {selection:?}"
+        );
+        assert!(!selection.fetch_text.contains(&path.to_string()) && !selection.present_only.contains(&path.to_string()), "{path}");
+    }
+    // Named roots are explicit: the built-in ignores do not apply.
+    let named = select_paths(
+        &entries,
+        &SelectOptions {
+            project_roots: Some(vec!["apps/web/tests/app".to_string()]),
+            ..with(vec![text("socket.yml", yml)])
+        },
+    );
+    assert_eq!(named.roots, vec!["apps/web/tests/app"]);
+    // A listed policy file with no text, `missing`, or invalid text fails
+    // closed: nothing is selected.
+    let missing = PolicyFileInput {
+        path: "socket.yml".to_string(),
+        text: None,
+        missing: Some(true),
+    };
+    for files in [vec![], vec![missing], vec![text("socket.yml", "version: 2\npatches:\n  apiUrl: x\n")]] {
+        let out = select_paths(&entries, &with(files));
+        assert_eq!(out.policy_error.as_ref().map(|e| e.code.as_str()), Some("socket_yml_invalid"));
+        assert!(out.roots.is_empty() && out.fetch_text.is_empty(), "{out:?}");
+        assert_eq!(out.policy_paths, vec!["socket.yml"]);
+    }
+    let out = select_paths(&entries, &with(vec![text("nested/socket.yml", yml)]));
+    assert!(out.policy_error.is_some());
+    // A symlinked policy file is never read.
+    entries.push(blob("socket.yaml", "120000"));
+    let out = select_paths(&entries, &with(vec![text("socket.yml", yml), text("socket.yaml", yml)]));
+    assert_eq!(out.policy_error.map(|e| e.code), Some("socket_yml_invalid".to_string()));
+    // noSocketYml: only the built-in ignores; the file need not be passed.
+    let out = select_paths(
+        &entries,
+        &SelectOptions {
+            no_socket_yml: Some(true),
+            ..SelectOptions::default()
+        },
+    );
+    assert!(out.policy_error.is_none() && out.policy_sha256.is_none());
+    assert_eq!(out.roots, vec!["apps/old", "apps/web"]);
+}
+
+#[tokio::test]
+async fn memory_negation_reincludes_a_default_ignored_root() {
+    let npm = fixtures_root().join("redirect/npm/package-lock-v3/basic");
+    let patches = patches_from_overrides(&npm.join("overrides.json"), None);
+    let server = MockServer::start().await;
+    mount_api(&server, &patches).await;
+    let mut repo: BTreeMap<String, Vec<u8>> = BTreeMap::new();
+    for root in ["e2e/tests", "x/tests"] {
+        for (rel, bytes) in fixture_files(&npm.join("input")) {
+            repo.insert(format!("{root}/{rel}"), bytes);
+        }
+    }
+    repo.insert(
+        "socket.yml".to_string(),
+        b"version: 2\npatches:\n  ignorePaths: [\"!/e2e/tests/\"]\n".to_vec(),
+    );
+    let (selection, input) = two_phase(&repo, options(false));
+    assert_eq!(selection.roots, vec!["e2e/tests"]);
+    assert!(selection.fetch_text.contains(&"e2e/tests/package-lock.json".to_string()));
+    assert!(!selection.fetch_text.iter().any(|p| p.starts_with("x/")), "{selection:?}");
+    assert!(selection
+        .ignored_sample
+        .iter()
+        .any(|i| i.path == "x/tests/package-lock.json" && i.reason == "policy_path_excluded"));
+    let memory = run_engine(&server, input).await;
+    let roots: Vec<&str> = memory.projects.iter().map(|p| p.root.as_str()).collect();
+    assert_eq!(roots, vec!["e2e/tests"]);
+    assert!(!memory.projects[0].redirected.is_empty(), "{:#}", memory.projects[0].redirect);
+
+    // Given every root anyway, the session applies the same filter itself.
+    let direct = run_engine(&server, build_input(&repo, &[], policy_options(&repo))).await;
+    let roots: Vec<&str> = direct.projects.iter().map(|p| p.root.as_str()).collect();
+    assert_eq!(roots, vec!["e2e/tests"]);
+    let entry = &direct.policy.as_ref().unwrap()["filtered"][0];
+    assert_eq!((entry["project"].as_str(), entry["detail"].as_str()), (Some("x/tests"), Some("tests/ (built-in default)")));
+
+    // Disk patches the same root the same way.
+    let disk = run_disk_in(&server, &repo, "e2e/tests", false);
+    assert_eq!(disk.envelope["status"], "success", "{}", disk.stderr);
+    assert_eq!(memory.projects[0].redirect, disk.envelope["redirect"]);
+    let memory_changed = engine_changed(&memory);
+    assert_eq!(memory_changed, disk.changed, "{}", describe(&memory_changed));
+}
diff --git a/crates/socket-patch-cli/tests/in_process_cargo_apply.rs b/crates/socket-patch-cli/tests/in_process_cargo_apply.rs
index 9502d312..8c7dc960 100644
--- a/crates/socket-patch-cli/tests/in_process_cargo_apply.rs
+++ b/crates/socket-patch-cli/tests/in_process_cargo_apply.rs
@@ -220,6 +220,7 @@ async fn cargo_fetch_scan_sync_patches_real_file() {
     make_writable(&lib_file);
 
     let args = ScanArgs {
+        socket_yml: Default::default(),
         paths: Vec::new(),
         packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
@@ -335,6 +336,7 @@ async fn cargo_apply_refuses_on_before_hash_mismatch() {
     make_writable(&lib_file);
 
     let args = ScanArgs {
+        socket_yml: Default::default(),
         paths: Vec::new(),
         packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
@@ -436,6 +438,7 @@ async fn cargo_crawler_finds_real_fetched_crate() {
 
     std::env::set_var("CARGO_HOME", &cargo_home);
     let args = ScanArgs {
+        socket_yml: Default::default(),
         paths: Vec::new(),
         packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
diff --git a/crates/socket-patch-cli/tests/in_process_gem_apply.rs b/crates/socket-patch-cli/tests/in_process_gem_apply.rs
index af56d13a..45cbaedd 100644
--- a/crates/socket-patch-cli/tests/in_process_gem_apply.rs
+++ b/crates/socket-patch-cli/tests/in_process_gem_apply.rs
@@ -199,6 +199,7 @@ async fn gem_install_scan_sync_patches_real_file() {
     .await;
 
     let args = ScanArgs {
+        socket_yml: Default::default(),
         paths: Vec::new(),
         packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
@@ -310,6 +311,7 @@ async fn gem_crawler_finds_real_installed_gem() {
         .await;
 
     let args = ScanArgs {
+        socket_yml: Default::default(),
         paths: Vec::new(),
         packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
diff --git a/crates/socket-patch-cli/tests/in_process_gem_multi_platform.rs b/crates/socket-patch-cli/tests/in_process_gem_multi_platform.rs
index fba7f6c2..1b0f8e35 100644
--- a/crates/socket-patch-cli/tests/in_process_gem_multi_platform.rs
+++ b/crates/socket-patch-cli/tests/in_process_gem_multi_platform.rs
@@ -217,6 +217,7 @@ async fn mount_view(
 
 fn scan_args(cwd: &Path, api_url: String, all_releases: bool) -> ScanArgs {
     ScanArgs {
+        socket_yml: Default::default(),
         paths: Vec::new(),
         packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
diff --git a/crates/socket-patch-cli/tests/in_process_pypi_apply.rs b/crates/socket-patch-cli/tests/in_process_pypi_apply.rs
index fa520987..e169dffe 100644
--- a/crates/socket-patch-cli/tests/in_process_pypi_apply.rs
+++ b/crates/socket-patch-cli/tests/in_process_pypi_apply.rs
@@ -248,6 +248,7 @@ async fn pypi_install_scan_sync_patches_real_file() {
     setup_pypi_apply_mock(&server, &before_hash, &after_hash, &patched).await;
 
     let mut args = ScanArgs {
+        socket_yml: Default::default(),
         paths: Vec::new(),
         packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
@@ -323,6 +324,7 @@ async fn pypi_scan_then_apply_force_patches_real_file() {
 
     // 1. scan --sync to write the manifest + blob.
     let scan_args = ScanArgs {
+        socket_yml: Default::default(),
         paths: Vec::new(),
         packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
@@ -431,6 +433,7 @@ async fn pypi_apply_dry_run_does_not_modify_file() {
     setup_pypi_apply_mock(&server, &before_hash, &after_hash, &patched).await;
 
     let scan_args = ScanArgs {
+        socket_yml: Default::default(),
         paths: Vec::new(),
         packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
@@ -559,6 +562,7 @@ async fn pypi_crawler_finds_real_installed_six() {
         .await;
 
     let args = ScanArgs {
+        socket_yml: Default::default(),
         paths: Vec::new(),
         packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
diff --git a/crates/socket-patch-cli/tests/in_process_pypi_multi_release.rs b/crates/socket-patch-cli/tests/in_process_pypi_multi_release.rs
index 3e4b098e..28fa350a 100644
--- a/crates/socket-patch-cli/tests/in_process_pypi_multi_release.rs
+++ b/crates/socket-patch-cli/tests/in_process_pypi_multi_release.rs
@@ -291,6 +291,7 @@ async fn mount_view(
 
 fn scan_args(tmp: &Path, api_url: String, all_releases: bool) -> ScanArgs {
     ScanArgs {
+        socket_yml: Default::default(),
         paths: Vec::new(),
         packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
diff --git a/crates/socket-patch-cli/tests/in_process_python_envs.rs b/crates/socket-patch-cli/tests/in_process_python_envs.rs
index 5d759c5c..855b04fd 100644
--- a/crates/socket-patch-cli/tests/in_process_python_envs.rs
+++ b/crates/socket-patch-cli/tests/in_process_python_envs.rs
@@ -114,6 +114,7 @@ async fn scan_scrubbed(args: ScanArgs) -> i32 {
 
 fn default_args(cwd: &Path, api_url: String) -> ScanArgs {
     ScanArgs {
+        socket_yml: Default::default(),
         paths: Vec::new(),
         packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
diff --git a/crates/socket-patch-cli/tests/in_process_redirect.rs b/crates/socket-patch-cli/tests/in_process_redirect.rs
index 5eb700f1..25273828 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect.rs
@@ -45,6 +45,7 @@ const GHSA: &str = "GHSA-rdir-aaaa-bbbb";
 
 fn redirect_args(cwd: &Path, api_url: String) -> ScanArgs {
     ScanArgs {
+        socket_yml: Default::default(),
         paths: Vec::new(),
         packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
diff --git a/crates/socket-patch-cli/tests/in_process_redirect_pdm.rs b/crates/socket-patch-cli/tests/in_process_redirect_pdm.rs
index ea99779f..a72ca5c3 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect_pdm.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect_pdm.rs
@@ -151,6 +151,7 @@ fn assert_no_ledger(root: &Path) {
 
 fn hosted_args(cwd: &Path, api_url: String, vex: Option<&Path>) -> ScanArgs {
     ScanArgs {
+        socket_yml: Default::default(),
         paths: Vec::new(),
         packages: Vec::new(),
         common: global(cwd, api_url),
diff --git a/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs b/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs
index 2c80118b..738d2c91 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs
@@ -80,6 +80,7 @@ fn global(cwd: &Path, api_url: String) -> GlobalArgs {
 
 fn hosted_args(cwd: &Path, api_url: String, vex: Option<&Path>) -> ScanArgs {
     ScanArgs {
+        socket_yml: Default::default(),
         paths: Vec::new(),
         packages: Vec::new(),
         common: global(cwd, api_url),
diff --git a/crates/socket-patch-cli/tests/in_process_redirect_pnpm.rs b/crates/socket-patch-cli/tests/in_process_redirect_pnpm.rs
index ddc76a93..4ad77067 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect_pnpm.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect_pnpm.rs
@@ -77,6 +77,7 @@ async fn rollback_hosted(cwd: &Path, server: &MockServer) -> i32 {
 /// `--mode hosted`.
 fn hosted_args(cwd: &Path, api_url: String) -> ScanArgs {
     ScanArgs {
+        socket_yml: Default::default(),
         paths: Vec::new(),
         packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
diff --git a/crates/socket-patch-cli/tests/in_process_redirect_poetry.rs b/crates/socket-patch-cli/tests/in_process_redirect_poetry.rs
index 5b1bb834..d90c2039 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect_poetry.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect_poetry.rs
@@ -120,6 +120,7 @@ fn assert_no_ledger(root: &Path) {
 
 fn hosted_args(cwd: &Path, api_url: String, vex: Option<&Path>) -> ScanArgs {
     ScanArgs {
+        socket_yml: Default::default(),
         paths: Vec::new(),
         packages: Vec::new(),
         common: global(cwd, api_url),
diff --git a/crates/socket-patch-cli/tests/in_process_remote_ecosystems_apply.rs b/crates/socket-patch-cli/tests/in_process_remote_ecosystems_apply.rs
index 1ff92dcc..7a50373a 100644
--- a/crates/socket-patch-cli/tests/in_process_remote_ecosystems_apply.rs
+++ b/crates/socket-patch-cli/tests/in_process_remote_ecosystems_apply.rs
@@ -71,6 +71,7 @@ async fn assert_discovered_purl(server: &MockServer, expected_purl: &str) {
 
 fn default_scan_args(cwd: &Path, eco: &str, api_url: String) -> ScanArgs {
     ScanArgs {
+        socket_yml: Default::default(),
         paths: Vec::new(),
         packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
diff --git a/crates/socket-patch-cli/tests/in_process_rollback_hosted.rs b/crates/socket-patch-cli/tests/in_process_rollback_hosted.rs
index 19ff8dae..d79e89f8 100644
--- a/crates/socket-patch-cli/tests/in_process_rollback_hosted.rs
+++ b/crates/socket-patch-cli/tests/in_process_rollback_hosted.rs
@@ -70,6 +70,7 @@ const GEM_PATCH_REMOTE: &str = "http://patch.test/gems/t0k3nt0k3n/";
 
 fn hosted_scan_args(cwd: &Path, api_url: String) -> ScanArgs {
     ScanArgs {
+        socket_yml: Default::default(),
         paths: Vec::new(),
         packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
diff --git a/crates/socket-patch-cli/tests/in_process_scan.rs b/crates/socket-patch-cli/tests/in_process_scan.rs
index e9d816d8..5521dded 100644
--- a/crates/socket-patch-cli/tests/in_process_scan.rs
+++ b/crates/socket-patch-cli/tests/in_process_scan.rs
@@ -19,6 +19,7 @@ const UUID: &str = "11111111-1111-4111-8111-111111111111";
 
 fn default_args(cwd: &Path) -> ScanArgs {
     ScanArgs {
+        socket_yml: Default::default(),
         paths: Vec::new(),
         packages: Vec::new(),
         common: socket_patch_cli::args::GlobalArgs {
diff --git a/crates/socket-patch-cli/tests/in_process_vendor.rs b/crates/socket-patch-cli/tests/in_process_vendor.rs
index 122d3d03..20bcfa5f 100644
--- a/crates/socket-patch-cli/tests/in_process_vendor.rs
+++ b/crates/socket-patch-cli/tests/in_process_vendor.rs
@@ -3246,6 +3246,7 @@ snapshots:
     /// `in_process_redirect_pnpm.rs` shape).
     fn hosted_args(cwd: &Path, api_url: String) -> ScanArgs {
         ScanArgs {
+            socket_yml: Default::default(),
             paths: Vec::new(),
             packages: Vec::new(),
             common: GlobalArgs {
diff --git a/crates/socket-patch-core/Cargo.toml b/crates/socket-patch-core/Cargo.toml
index 7bbbb82e..5b78b852 100644
--- a/crates/socket-patch-core/Cargo.toml
+++ b/crates/socket-patch-core/Cargo.toml
@@ -44,6 +44,8 @@ tempfile = { workspace = true }
 zip = { workspace = true }
 base64 = { workspace = true }
 semver = { workspace = true }
+serde-saphyr = { workspace = true }
+ignore = { workspace = true }
 
 [target.'cfg(unix)'.dependencies]
 libc = { workspace = true }
diff --git a/crates/socket-patch-core/src/hosted/memory/limits.rs b/crates/socket-patch-core/src/hosted/memory/limits.rs
index f84dbbed..af11729c 100644
--- a/crates/socket-patch-core/src/hosted/memory/limits.rs
+++ b/crates/socket-patch-core/src/hosted/memory/limits.rs
@@ -27,6 +27,9 @@ pub(crate) struct ResolvedOptions {
     pub(crate) provider_concurrency: usize,
     pub(crate) request_timeout: std::time::Duration,
     pub(crate) limits: ResolvedLimits,
+    pub(crate) policy_overrides: crate::policy::PolicyOverrides,
+    pub(crate) policy_paths: Vec<String>,
+    pub(crate) policy_sha256: Option<String>,
 }
 
 pub(crate) fn resolve_options(options: &HostedScanOptions) -> Result<ResolvedOptions, EngineError> {
@@ -54,6 +57,28 @@ pub(crate) fn resolve_options(options: &HostedScanOptions) -> Result<ResolvedOpt
             ));
         }
     }
+    let min_severity = match options.min_severity.as_deref() {
+        None => None,
+        Some(value) => Some((
+            crate::policy::parse_min_severity(value)
+                .map_err(|e| EngineError::invalid("invalid_min_severity", format!("minSeverity: {e}")))?,
+            crate::policy::OverrideSource::Flag,
+        )),
+    };
+    let policy_overrides = crate::policy::PolicyOverrides {
+        bypass: options.no_socket_yml.unwrap_or(false),
+        min_severity,
+    };
+    let mut policy_paths: Vec<String> = Vec::new();
+    for path in options.policy_paths.iter().flatten() {
+        if !crate::policy::POLICY_FILE_NAMES.contains(&path.as_str()) {
+            return Err(EngineError::invalid(
+                "invalid_policy_path",
+                format!("policyPaths entry `{path}` is not a root socket.yml or socket.yaml"),
+            ));
+        }
+        policy_paths.push(path.clone());
+    }
     let project_roots = match &options.project_roots {
         Some(roots) => {
             let mut out: Vec<String> = Vec::with_capacity(roots.len());
@@ -103,6 +128,9 @@ pub(crate) fn resolve_options(options: &HostedScanOptions) -> Result<ResolvedOpt
         provider_concurrency: provider_concurrency.min(MAX_PROVIDER_CONCURRENCY) as usize,
         request_timeout: std::time::Duration::from_millis(timeout_ms),
         limits: options.limits.clone().unwrap_or_default().resolve(),
+        policy_overrides,
+        policy_paths,
+        policy_sha256: options.policy_sha256.clone(),
     })
 }
 
diff --git a/crates/socket-patch-core/src/hosted/memory/mod.rs b/crates/socket-patch-core/src/hosted/memory/mod.rs
index cc760463..b80d1d2d 100644
--- a/crates/socket-patch-core/src/hosted/memory/mod.rs
+++ b/crates/socket-patch-core/src/hosted/memory/mod.rs
@@ -49,7 +49,7 @@ use tokio_util::sync::CancellationToken;
 
 pub(crate) mod discover;
 pub mod limits;
-pub(crate) mod roots;
+pub mod roots;
 pub mod select;
 pub(crate) mod stages;
 pub mod types;
@@ -60,6 +60,10 @@ pub use types::*;
 
 use discover::Provider;
 use stages::{Planned, RewriteRefused, Rewritten, StageOptions};
+use crate::policy::{
+    canon, patch_severity_order, policy_block, FilterReason, FilteredEntry, MemoryPolicyFs, PolicyError,
+    PolicySource, Root, RootFile, SelectionPolicy, PATCHES_DISABLED, POLICY_FILE_NAMES,
+};
 
 /// `"<crate version>+<git sha or 'unknown'>"`; the sha comes from the
 /// `SOCKET_PATCH_GIT_SHA` build-time variable.
@@ -113,6 +117,8 @@ struct RootState {
     packages: Vec<crate::api::types::BatchPackagePatches>,
     selected: Vec<(String, String)>,
     skipped: Vec<SkippedPatch>,
+    /// Candidates the socket.yml policy withheld (`policy_*` reasons).
+    policy_skipped: Vec<SkippedPatch>,
     error: Option<ProjectError>,
 }
 
@@ -311,6 +317,7 @@ fn unrooted_unsupported_warnings<'a>(
     paths: impl Iterator<Item = &'a str>,
     roots: &[String],
     ecosystems: Option<&[String]>,
+    policy: &SelectionPolicy,
     out: &mut Vec<EngineWarning>,
 ) {
     let root_set: BTreeSet<&str> = roots.iter().map(String::as_str).collect();
@@ -328,6 +335,13 @@ fn unrooted_unsupported_warnings<'a>(
             || dir
                 .split('/')
                 .any(|seg| roots::EXCLUDED_ROOT_SEGMENTS.contains(&seg))
+            || policy
+                .admits_root(&Root {
+                    rel_dir: dir,
+                    markers: &[base.to_string()],
+                    explicit: false,
+                })
+                .is_err()
         {
             continue;
         }
@@ -372,10 +386,77 @@ async fn engine(
     let ecosystems = options.ecosystems.as_deref();
     let provider = Provider::new(api, options.request_timeout, options.provider_concurrency);
 
+    // The repo's socket.yml policy, before any root is processed: a file
+    // that cannot be honored fails the whole session closed.
+    let (policy, policy_warnings) =
+        match SelectionPolicy::load(&memory_policy_fs(&files, &options.policy_paths), &options.policy_overrides) {
+            Ok(loaded) => loaded,
+            Err(error) => {
+                return Ok(policy_error_output(&error, warnings, files_input, bytes_input));
+            }
+        };
+    // Path selection chose which files to send by the policy it read; a
+    // different policy here would judge roots it never fetched.
+    let read = match policy.source() {
+        PolicySource::File { path, sha256 } => Some((path.as_str(), sha256.as_str())),
+        PolicySource::None | PolicySource::Bypassed => None,
+    };
+    // Selection returns no digest when it bypassed the file, so a digest
+    // with a bypassed session means the two sides disagree.
+    let expected = if options.policy_overrides.bypass { None } else { read.map(|(_, sha)| sha) };
+    if expected != options.policy_sha256.as_deref() {
+        let error = PolicyError::Invalid {
+            file: read.map_or(POLICY_FILE_NAMES[0], |(path, _)| path).to_string(),
+            key: String::new(),
+            message: "the policy content differs from the one path selection read: pass \
+                      selectHostedScanPaths' policySha256 and stream the same text"
+                .to_string(),
+        };
+        return Ok(policy_error_output(&error, warnings, files_input, bytes_input));
+    }
+    for w in policy_warnings {
+        warnings.push(EngineWarning::new(w.code, w.detail, None));
+    }
+    if !policy.enabled() {
+        warnings.push(EngineWarning::new(
+            PATCHES_DISABLED,
+            "patches.enabled is false in socket.yml: report only, nothing is written",
+            None,
+        ));
+    }
+    let mut policy_filtered: Vec<FilteredEntry> = Vec::new();
+
     let root_list: Vec<String> = match &options.project_roots {
         Some(roots) => roots.clone(),
         None => roots::detect_roots(files.keys().map(String::as_str), ecosystems).0,
     };
+    // The full policy (paths from the file too) judges every root before
+    // the project limit; roots named in `projectRoots` are explicit.
+    let explicit_roots = options.project_roots.is_some();
+    let detected_roots = root_list.clone();
+    let root_list: Vec<String> = root_list
+        .into_iter()
+        .filter(|root| {
+            let markers = roots::root_markers(root, files.keys().map(String::as_str));
+            match policy.admits_root(&Root {
+                rel_dir: root,
+                markers: &markers,
+                explicit: explicit_roots,
+            }) {
+                Ok(()) => true,
+                Err(reason) => {
+                    policy_filtered.push(FilteredEntry {
+                        purl: None,
+                        uuid: None,
+                        project: root.clone(),
+                        reason,
+                        severity: None,
+                    });
+                    false
+                }
+            }
+        })
+        .collect();
     if root_list.len() as u64 > options.limits.max_projects {
         return Err(EngineError::limit(
             "max_projects",
@@ -388,8 +469,9 @@ async fn engine(
     }
     unrooted_unsupported_warnings(
         files.keys().map(String::as_str),
-        &root_list,
+        &detected_roots,
         ecosystems,
+        &policy,
         &mut warnings,
     );
     let mut states: Vec<RootState> = root_list
@@ -407,6 +489,7 @@ async fn engine(
             packages: Vec::new(),
             selected: Vec::new(),
             skipped: Vec::new(),
+            policy_skipped: Vec::new(),
             error: None,
         })
         .collect();
@@ -432,7 +515,20 @@ async fn engine(
             .filter_map(|e| discover::supplement_purl(&e.purl))
             .filter(|p| ecosystem_allowed(ecosystems, p))
             .collect();
-        state.purls = purls.into_iter().collect();
+        let mut admitted: Vec<String> = Vec::with_capacity(purls.len());
+        for purl in purls {
+            match policy.admits_purl(&purl) {
+                Ok(()) => admitted.push(purl),
+                Err(reason) => policy_filtered.push(FilteredEntry {
+                    purl: Some(canon(&purl)),
+                    uuid: None,
+                    project: state.root.clone(),
+                    reason,
+                    severity: None,
+                }),
+            }
+        }
+        state.purls = admitted;
         state.summary.scanned_packages = state.purls.len() as u64;
     }
     let union_purls: BTreeSet<&str> = states
@@ -536,7 +632,14 @@ async fn engine(
                 Some(&state.root),
             ));
         }
-        state.selected = discover::select_top_ranked(&results, can_access_paid);
+        state.selected = select_with_policy(
+            &policy,
+            results,
+            can_access_paid,
+            &state.root,
+            &mut policy_filtered,
+            &mut state.policy_skipped,
+        );
     }
     phases.mark("details");
 
@@ -629,7 +732,7 @@ async fn engine(
     let mut results: BTreeMap<usize, ProjectResult> = BTreeMap::new();
     for (index, done) in rewritten {
         let state = &mut states[index];
-        let result = finish_root(
+        let mut result = finish_root(
             state,
             done,
             &records,
@@ -638,6 +741,7 @@ async fn engine(
             &mut changed_binary,
             &mut warnings,
         );
+        result.skipped.extend(state.policy_skipped.iter().cloned());
         results.insert(index, result);
     }
     let mut projects: Vec<ProjectResult> = Vec::with_capacity(states.len());
@@ -656,12 +760,14 @@ async fn engine(
                 options.dry_run,
             ),
         };
+        let mut skipped = state.skipped.clone();
+        skipped.extend(state.policy_skipped.iter().cloned());
         projects.push(ProjectResult {
             root: state.root.clone(),
             redirect,
             summary: state.summary.clone(),
             redirected: Vec::new(),
-            skipped: state.skipped.clone(),
+            skipped,
             error: state.error.clone(),
         });
     }
@@ -698,9 +804,113 @@ async fn engine(
         warnings,
         stats,
         engine_version: engine_version(),
+        policy: Some(policy_block(&policy, &policy_filtered, &[])),
+        policy_error: None,
     })
 }
 
+/// The root policy files as the session received them. A path selection
+/// listed but the host never sent is present without content (never
+/// absent: it may narrow the scan).
+fn memory_policy_fs(files: &BTreeMap<String, SharedFile>, listed: &[String]) -> MemoryPolicyFs {
+    let mut fs = MemoryPolicyFs::default();
+    for name in POLICY_FILE_NAMES {
+        let file = match files.get(name).map(|f| &f.entry) {
+            Some(MemoryEntry::Text(text)) => RootFile::Present(text.as_bytes().to_vec()),
+            Some(MemoryEntry::Binary(bytes)) => RootFile::Present(bytes.to_vec()),
+            Some(_) => RootFile::PresentWithoutContent,
+            None if listed.iter().any(|l| l == name) => RootFile::PresentWithoutContent,
+            None => continue,
+        };
+        fs.files.insert(name.to_string(), file);
+        fs.root_names.push(name.to_string());
+    }
+    fs
+}
+
+/// The session result for a policy file that cannot be honored: no root
+/// processed, no file changed.
+fn policy_error_output(
+    error: &crate::policy::PolicyError,
+    warnings: Vec<EngineWarning>,
+    files_input: u64,
+    bytes_input: u64,
+) -> HostedScanOutput {
+    HostedScanOutput {
+        projects: Vec::new(),
+        changed_files: Vec::new(),
+        changed_binary_files: Vec::new(),
+        deleted_files: Vec::new(),
+        warnings,
+        stats: EngineStats {
+            files_input,
+            bytes_input,
+            ..EngineStats::default()
+        },
+        engine_version: engine_version(),
+        policy: None,
+        policy_error: Some(PolicyErrorInfo {
+            code: error.code().to_string(),
+            detail: error.detail(),
+        }),
+    }
+}
+
+/// The tier filter, the severity floor and the per-package ranking (the
+/// disk `ScanPolicy::select` without a recorded view, which the in-memory
+/// engine does not read yet). With `patches.enabled: false` nothing is
+/// selected and every candidate is reported `policy_disabled`.
+fn select_with_policy(
+    policy: &SelectionPolicy,
+    results: Vec<PatchSearchResult>,
+    can_access_paid: bool,
+    root: &str,
+    filtered: &mut Vec<FilteredEntry>,
+    skipped: &mut Vec<SkippedPatch>,
+) -> Vec<(String, String)> {
+    let accessible: Vec<PatchSearchResult> = results
+        .into_iter()
+        .filter(|p| can_access_paid || p.tier == "free")
+        .collect();
+    let (admitted, dropped) = if policy.enabled() {
+        policy.floor_filter(accessible)
+    } else {
+        (
+            Vec::new(),
+            accessible
+                .into_iter()
+                .map(|p| (p, FilterReason::Disabled))
+                .collect(),
+        )
+    };
+    let selected = discover::select_top_ranked(&admitted, true);
+    let chosen: BTreeSet<&str> = selected.iter().map(|(purl, _)| purl.as_str()).collect();
+    let mut by_purl: BTreeMap<String, Vec<(PatchSearchResult, FilterReason)>> = BTreeMap::new();
+    for (patch, reason) in dropped {
+        if !chosen.contains(patch.purl.as_str()) {
+            by_purl.entry(patch.purl.clone()).or_default().push((patch, reason));
+        }
+    }
+    for (purl, mut group) in by_purl {
+        group.sort_by(|a, b| crate::api::ranking::cmp_search_results(&a.0, &b.0));
+        let (winner, reason) = group.swap_remove(0);
+        skipped.push(SkippedPatch {
+            purl: purl.clone(),
+            uuid: winner.uuid.clone(),
+            reason: reason.code().to_string(),
+            detail: Some(reason.detail()),
+        });
+        filtered.push(FilteredEntry {
+            purl: Some(canon(&purl)),
+            uuid: Some(winner.uuid.clone()),
+            project: root.to_string(),
+            severity: Some(patch_severity_order(&winner)),
+            reason,
+        });
+    }
+    selected
+}
+
 /// Records → the project's result and changed files.
 fn finish_root(
     state: &mut RootState,
@@ -854,6 +1064,7 @@ mod tests {
             packages: Vec::new(),
             selected: Vec::new(),
             skipped: Vec::new(),
+            policy_skipped: Vec::new(),
             error: None,
         }
     }
@@ -1050,7 +1261,13 @@ mod tests {
             "src/Main.java",
         ];
         let mut out = Vec::new();
-        unrooted_unsupported_warnings(paths.into_iter(), &["web".to_string()], None, &mut out);
+        unrooted_unsupported_warnings(
+            paths.into_iter(),
+            &["web".to_string()],
+            None,
+            crate::policy::builtin_defaults(),
+            &mut out,
+        );
         assert_eq!(out.len(), 2);
         assert!(out
             .iter()
@@ -1070,6 +1287,7 @@ mod tests {
             paths.into_iter(),
             &[],
             Some(&["npm".to_string()]),
+            crate::policy::builtin_defaults(),
             &mut filtered,
         );
         assert!(filtered.is_empty());
diff --git a/crates/socket-patch-core/src/hosted/memory/roots.rs b/crates/socket-patch-core/src/hosted/memory/roots.rs
index c715f85a..d22d2493 100644
--- a/crates/socket-patch-core/src/hosted/memory/roots.rs
+++ b/crates/socket-patch-core/src/hosted/memory/roots.rs
@@ -14,7 +14,7 @@ use super::types::IgnoredPath;
 
 /// Marker files of the ecosystems the in-memory engine cannot inventory
 /// (disk discovers them only through installed-tree crawlers).
-pub(crate) const UNSUPPORTED_MARKERS: [(&str, &[&str]); 2] = [
+pub const UNSUPPORTED_MARKERS: [(&str, &[&str]); 2] = [
     (
         "maven",
         &[
@@ -29,23 +29,31 @@ pub(crate) const UNSUPPORTED_MARKERS: [(&str, &[&str]); 2] = [
 ];
 
 /// Directory names whose subtrees never hold a project root: installed
-/// trees, VCS and tool state, vendored dependencies, and test fixtures.
-pub(crate) const EXCLUDED_ROOT_SEGMENTS: [&str; 10] = [
-    "node_modules",
-    ".git",
-    ".socket",
-    ".yarn",
-    "vendor",
-    "test",
-    "tests",
-    "fixtures",
-    "__fixtures__",
-    "testdata",
-];
+/// trees, VCS and tool state, and vendored dependencies. Structural, so no
+/// policy can negate them. (Test and fixture trees are the socket.yml
+/// policy's overridable built-in ignores.)
+pub(crate) const EXCLUDED_ROOT_SEGMENTS: [&str; 5] = ["node_modules", ".git", ".socket", ".yarn", "vendor"];
+
+/// The marker basenames of `root` among `paths` (the files the policy's
+/// path filters test for that root).
+pub(crate) fn root_markers<'a>(root: &str, paths: impl IntoIterator<Item = &'a str>) -> Vec<String> {
+    let mut out: Vec<String> = paths
+        .into_iter()
+        .filter_map(|path| {
+            let (dir, base) = split_path(path);
+            let marker = marker_ecosystem(base).is_some()
+                || UNSUPPORTED_MARKERS.iter().any(|(_, names)| names.contains(&base));
+            (dir == root && marker).then(|| base.to_string())
+        })
+        .collect();
+    out.sort();
+    out.dedup();
+    out
+}
 
 /// The ecosystem a root marker basename belongs to: a [`registry::ROOT`]
 /// row (manifests alone never make a root) or a PEP 751 / PEP 723 lock.
-pub(crate) fn marker_ecosystem(base: &str) -> Option<&'static str> {
+pub fn marker_ecosystem(base: &str) -> Option<&'static str> {
     if let Some(row) = registry::root_marker(base) {
         return Some(row.ecosystem);
     }
@@ -82,6 +90,8 @@ fn allowed(ecosystems: Option<&[String]>, eco: &str) -> bool {
 }
 
 /// The detected roots (sorted) and the marker paths that did not make one.
+/// The socket.yml path policy (built-in default ignores included) is the
+/// caller's to apply.
 pub(crate) fn detect_roots<'a>(
     paths: impl IntoIterator<Item = &'a str>,
     ecosystems: Option<&[String]>,
@@ -133,21 +143,15 @@ pub(crate) fn detect_roots<'a>(
                 || *dir == internal("common/temp")
                 || dir.starts_with(&format!("{}/", internal("common/temp")))
         });
-        let reason = if rush_internal {
-            Some("rush_internal")
-        } else {
-            None
-        };
-        match reason {
-            Some(reason) => {
-                for path in marker_paths.get(dir).into_iter().flatten() {
-                    ignored.push(IgnoredPath {
-                        path: path.clone(),
-                        reason: reason.to_string(),
-                    });
-                }
+        if rush_internal {
+            for path in marker_paths.get(dir).into_iter().flatten() {
+                ignored.push(IgnoredPath {
+                    path: path.clone(),
+                    reason: "rush_internal".to_string(),
+                });
             }
-            None => roots.push(dir.clone()),
+        } else {
+            roots.push(dir.clone());
         }
     }
     roots.sort();
@@ -190,11 +194,20 @@ mod tests {
             ],
             None,
         );
-        assert_eq!(found, vec!["docs"]);
-        assert_eq!(ignored.len(), 4);
+        // Test and fixture trees are left to the socket.yml path policy.
+        assert_eq!(found, vec!["docs", "test/fixtures"]);
+        assert_eq!(ignored.len(), 3);
         assert!(ignored.iter().all(|i| i.reason == "excluded_dir"));
     }
 
+    #[test]
+    fn root_markers_name_every_marker_of_the_root_only() {
+        assert_eq!(
+            root_markers("a", ["a/yarn.lock", "a/package.json", "a/b/yarn.lock", "a/pom.xml"]),
+            vec!["pom.xml".to_string(), "yarn.lock".to_string()]
+        );
+    }
+
     #[test]
     fn rush_internals_are_not_roots_but_nested_cargo_locks_are() {
         assert_eq!(
diff --git a/crates/socket-patch-core/src/hosted/memory/select.rs b/crates/socket-patch-core/src/hosted/memory/select.rs
index 76750320..be43ec8e 100644
--- a/crates/socket-patch-core/src/hosted/memory/select.rs
+++ b/crates/socket-patch-core/src/hosted/memory/select.rs
@@ -14,10 +14,18 @@ use crate::constants::npm_family::{
 use crate::patch::redirect::npmrc::NPMRC_REL;
 use crate::utils::python_lock::is_python_lock_name;
 
+use crate::policy::{
+    MemoryPolicyFs, PolicyOverrides, PolicySource, Root, RootFile, SelectionPolicy, POLICY_FILE_NAMES,
+    SOCKET_YML_INVALID,
+};
+
 use super::roots::{
-    detect_roots, split_path, strip_root, EXCLUDED_ROOT_SEGMENTS, UNSUPPORTED_MARKERS,
+    detect_roots, join_root, root_markers, split_path, strip_root, EXCLUDED_ROOT_SEGMENTS,
+    UNSUPPORTED_MARKERS,
+};
+use super::types::{
+    IgnoredPath, PathSelection, PolicyErrorInfo, PolicyFileInput, SelectOptions, TreeEntryInput,
 };
-use super::types::{IgnoredPath, PathSelection, SelectOptions, TreeEntryInput};
 use crate::hosted::engine::{REDIRECT_CANDIDATE_FILES, RUSH_REPO_STATE_REL};
 use crate::hosted::guidance::PNPM_WORKSPACE_REL;
 
@@ -160,9 +168,60 @@ fn classify(rel: &str, root_files: &BTreeSet<&str>) -> Option<Need> {
     None
 }
 
+/// The listed root policy files with the text the caller fetched first. A
+/// listed file with no text (not passed, `missing`, or a symlink) is present
+/// without content, so loading it fails closed.
+fn selection_policy_fs(blobs: &BTreeMap<String, bool>, supplied: &[PolicyFileInput]) -> MemoryPolicyFs {
+    let mut fs = MemoryPolicyFs::default();
+    for name in POLICY_FILE_NAMES {
+        let Some(&symlink) = blobs.get(name) else {
+            continue;
+        };
+        let text = supplied
+            .iter()
+            .find(|f| f.path == name && !f.missing.unwrap_or(false))
+            .and_then(|f| f.text.as_ref());
+        let file = match text {
+            Some(text) if !symlink => RootFile::Present(text.as_bytes().to_vec()),
+            _ => RootFile::PresentWithoutContent,
+        };
+        fs.files.insert(name.to_string(), file);
+        fs.root_names.push(name.to_string());
+    }
+    fs
+}
+
+/// The policy path selection applies, or why it cannot be honored.
+fn selection_policy(
+    blobs: &BTreeMap<String, bool>,
+    options: &SelectOptions,
+) -> Result<SelectionPolicy, PolicyErrorInfo> {
+    let supplied = options.policy_files.as_deref().unwrap_or_default();
+    if let Some(bad) = supplied.iter().find(|f| !POLICY_FILE_NAMES.contains(&f.path.as_str())) {
+        return Err(PolicyErrorInfo {
+            code: SOCKET_YML_INVALID.to_string(),
+            detail: format!(
+                "policyFiles entry `{}` is not a root socket.yml or socket.yaml",
+                crate::policy::sanitize(&bad.path)
+            ),
+        });
+    }
+    let overrides = PolicyOverrides {
+        bypass: options.no_socket_yml.unwrap_or(false),
+        min_severity: None,
+    };
+    SelectionPolicy::load(&selection_policy_fs(blobs, supplied), &overrides)
+        .map(|(policy, _)| policy)
+        .map_err(|e| PolicyErrorInfo {
+            code: e.code().to_string(),
+            detail: e.detail(),
+        })
+}
+
 /// `selectHostedScanPaths`: roots (detected, or `options.projectRoots`)
-/// plus the files to stream for them. Only `blob` entries are files; mode
-/// `120000` is a symbolic link and is reported, never fetched.
+/// that the repo's socket.yml path policy admits, plus the files to stream
+/// for them. Only `blob` entries are files; mode `120000` is a symbolic link
+/// and is reported, never fetched.
 pub fn select_paths(entries: &[TreeEntryInput], options: &SelectOptions) -> PathSelection {
     let mut ignored: Vec<IgnoredPath> = Vec::new();
     let mut blobs: BTreeMap<String, bool> = BTreeMap::new();
@@ -181,7 +240,27 @@ pub fn select_paths(entries: &[TreeEntryInput], options: &SelectOptions) -> Path
         }
     }
 
-    let roots: Vec<String> = match &options.project_roots {
+    let policy_paths: Vec<String> = POLICY_FILE_NAMES
+        .iter()
+        .filter(|name| blobs.contains_key(**name))
+        .map(|name| name.to_string())
+        .collect();
+    let policy = match selection_policy(&blobs, options) {
+        Ok(policy) => policy,
+        Err(error) => {
+            return PathSelection {
+                policy_paths,
+                policy_error: Some(error),
+                ..PathSelection::default()
+            }
+        }
+    };
+    let policy_sha256 = match policy.source() {
+        PolicySource::File { sha256, .. } => Some(sha256.clone()),
+        PolicySource::None | PolicySource::Bypassed => None,
+    };
+
+    let candidate_roots: Vec<String> = match &options.project_roots {
         Some(requested) => {
             let mut out: BTreeSet<String> = BTreeSet::new();
             for root in requested {
@@ -206,6 +285,35 @@ pub fn select_paths(entries: &[TreeEntryInput], options: &SelectOptions) -> Path
             found
         }
     };
+    // The same root filter the session applies, so a socket.yml negation
+    // of a built-in ignore brings that tree's files in here too. An
+    // excluded root is reported here, not streamed: its markers would
+    // count against the session's file limit.
+    let explicit = options.project_roots.is_some();
+    let mut roots: Vec<String> = Vec::with_capacity(candidate_roots.len());
+    for root in candidate_roots {
+        let markers = root_markers(&root, blobs.keys().map(String::as_str));
+        match policy.admits_root(&Root {
+            rel_dir: &root,
+            markers: &markers,
+            explicit,
+        }) {
+            Ok(()) => roots.push(root),
+            Err(reason) => {
+                let paths: Vec<String> = if markers.is_empty() {
+                    vec![root.clone()]
+                } else {
+                    markers.iter().map(|m| join_root(&root, m)).collect()
+                };
+                for path in paths {
+                    ignored.push(IgnoredPath {
+                        path,
+                        reason: reason.code().to_string(),
+                    });
+                }
+            }
+        }
+    }
     let root_set: BTreeSet<&str> = roots.iter().map(String::as_str).collect();
 
     let mut per_root: BTreeMap<&str, BTreeSet<&str>> = BTreeMap::new();
@@ -233,7 +341,7 @@ pub fn select_paths(entries: &[TreeEntryInput], options: &SelectOptions) -> Path
             let Some(need) = classify(rel, files) else {
                 continue;
             };
-            let full = super::roots::join_root(root, rel);
+            let full = join_root(root, rel);
             let slot = needs.entry(full).or_insert(need);
             *slot = (*slot).min(need);
         }
@@ -253,14 +361,28 @@ pub fn select_paths(entries: &[TreeEntryInput], options: &SelectOptions) -> Path
                 && !dir
                     .split('/')
                     .any(|seg| EXCLUDED_ROOT_SEGMENTS.contains(&seg))
+                && policy
+                    .admits_root(&Root {
+                        rel_dir: dir,
+                        markers: &[base.to_string()],
+                        explicit: false,
+                    })
+                    .is_ok()
         });
         if let Some(path) = first {
             needs.entry(path.clone()).or_insert(Need::Present);
         }
     }
 
+    // The session reads the same policy text again.
+    for name in &policy_paths {
+        needs.entry(name.clone()).or_insert(Need::Text);
+    }
+
     let mut selection = PathSelection {
         roots,
+        policy_paths,
+        policy_sha256,
         ..PathSelection::default()
     };
     for (path, need) in needs {
@@ -423,6 +545,7 @@ mod tests {
             &SelectOptions {
                 project_roots: None,
                 ecosystems: Some(vec!["npm".into()]),
+                ..SelectOptions::default()
             },
         );
         assert!(s.present_only.is_empty());
@@ -436,6 +559,7 @@ mod tests {
             &SelectOptions {
                 project_roots: Some(vec!["b/".into(), "../x".into()]),
                 ecosystems: None,
+                ..SelectOptions::default()
             },
         );
         assert_eq!(s.roots, vec!["b"]);
diff --git a/crates/socket-patch-core/src/hosted/memory/types.rs b/crates/socket-patch-core/src/hosted/memory/types.rs
index f29c5777..e982c14e 100644
--- a/crates/socket-patch-core/src/hosted/memory/types.rs
+++ b/crates/socket-patch-core/src/hosted/memory/types.rs
@@ -100,6 +100,21 @@ pub struct HostedScanOptions {
     pub request_timeout_ms: Option<u64>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub limits: Option<HostedScanLimits>,
+    /// Ignore the repo's socket.yml (`--no-socket-yml`); default false.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub no_socket_yml: Option<bool>,
+    /// `critical|high|medium|moderate|low|none`; beats the file's
+    /// `patches.minSeverity` (`--min-severity`).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub min_severity: Option<String>,
+    /// The `policyPaths` path selection returned: each must arrive with
+    /// content, or the session fails with `policyError`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub policy_paths: Option<Vec<String>>,
+    /// The `policySha256` path selection returned: the session fails with
+    /// `policyError` when the policy it reads differs.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub policy_sha256: Option<String>,
 }
 
 pub const DEFAULT_BATCH_SIZE: u32 = 100;
@@ -279,6 +294,23 @@ pub struct HostedScanOutput {
     pub warnings: Vec<EngineWarning>,
     pub stats: EngineStats,
     pub engine_version: String,
+    /// The session-level `policy` block (the CLI's `policy` JSON shape);
+    /// absent on a `policyError`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub policy: Option<serde_json::Value>,
+    /// A socket.yml that cannot be honored: no root was processed and no
+    /// file changed.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub policy_error: Option<PolicyErrorInfo>,
+}
+
+/// `HostedScanResult.policyError`.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct PolicyErrorInfo {
+    /// `socket_yml_invalid` or `socket_yml_ambiguous`.
+    pub code: String,
+    pub detail: String,
 }
 
 /// `TreeEntryInput`.
@@ -301,6 +333,24 @@ pub struct SelectOptions {
     pub project_roots: Option<Vec<String>>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub ecosystems: Option<Vec<String>>,
+    /// One entry per root socket.yml / socket.yaml the listing holds.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub policy_files: Option<Vec<PolicyFileInput>>,
+    /// Must match the session's `noSocketYml`.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub no_socket_yml: Option<bool>,
+}
+
+/// `SelectOptions.policyFiles` entry: the root policy file's text, or
+/// `missing: true` when the host could not fetch it.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct PolicyFileInput {
+    pub path: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub text: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub missing: Option<bool>,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
@@ -322,6 +372,17 @@ pub struct PathSelection {
     pub ignored_count: u64,
     /// At most [`super::select::IGNORED_SAMPLE_MAX`] entries.
     pub ignored_sample: Vec<IgnoredPath>,
+    /// The root socket.yml / socket.yaml the tree lists (pass them back as
+    /// the session's `policyPaths`).
+    #[serde(default)]
+    pub policy_paths: Vec<String>,
+    /// The policy file the selection applied (`null` without one): pass it
+    /// back as the session's `policySha256`.
+    #[serde(default)]
+    pub policy_sha256: Option<String>,
+    /// A socket.yml that cannot be honored: nothing is selected.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub policy_error: Option<PolicyErrorInfo>,
 }
 
 /// Engine failure (`finish()` rejection codes).
diff --git a/crates/socket-patch-core/src/lib.rs b/crates/socket-patch-core/src/lib.rs
index a55bb77d..c16adb55 100644
--- a/crates/socket-patch-core/src/lib.rs
+++ b/crates/socket-patch-core/src/lib.rs
@@ -7,6 +7,7 @@ pub mod hosted;
 pub mod ledgers;
 pub mod manifest;
 pub mod patch;
+pub mod policy;
 pub mod telemetry;
 pub mod update;
 pub mod utils;
diff --git a/crates/socket-patch-core/src/policy/mod.rs b/crates/socket-patch-core/src/policy/mod.rs
new file mode 100644
index 00000000..3e922569
--- /dev/null
+++ b/crates/socket-patch-core/src/policy/mod.rs
@@ -0,0 +1,892 @@
+//! The repository's patch policy: the `patches` block and
+//! `projectIgnorePaths` of the root `socket.yml`, plus the built-in default
+//! path ignores. See `docs/design/staged-rollout.md` §3-§4.
+//!
+//! A policy only ever **narrows** what `scan` patches (trust boundary,
+//! CLI_CONTRACT.md): nothing here names an endpoint, a credential, a mode
+//! or a safety switch. Because it only narrows, an unreadable or invalid
+//! file fails closed ([`PolicyError`]) instead of meaning "no policy".
+
+pub mod paths;
+mod report;
+pub mod socket_yml;
+
+use std::collections::BTreeMap;
+use std::io::Read;
+use std::path::{Path, PathBuf};
+
+use sha2::{Digest, Sha256};
+
+use crate::api::ranking::max_severity_order;
+use crate::api::types::PatchSearchResult;
+use crate::crawlers::Ecosystem;
+use crate::utils::purl::{normalize_purl, strip_purl_qualifiers};
+
+use self::paths::{PathHit, PathMatcher};
+use self::socket_yml::{parse_file, ParsedFile, PatchesBlock};
+
+pub use self::report::{canon, policy_block, FilteredEntry, RetainedEntry};
+pub use self::socket_yml::MAX_FILE_BYTES;
+
+/// Root file names, in the order they are read.
+pub const POLICY_FILE_NAMES: [&str; 2] = ["socket.yml", "socket.yaml"];
+
+/// Built-in ignores for discovered project roots (overridable with `!`).
+pub const DEFAULT_IGNORE_PATHS: [&str; 5] =
+    ["test/", "tests/", "fixtures/", "__fixtures__/", "testdata/"];
+
+/// List label of [`DEFAULT_IGNORE_PATHS`] in filter details.
+pub const DEFAULT_IGNORE_LIST: &str = "built-in default";
+
+pub const SOCKET_YML_INVALID: &str = "socket_yml_invalid";
+pub const SOCKET_YML_AMBIGUOUS: &str = "socket_yml_ambiguous";
+pub const SOCKET_YML_IGNORED_VALUE: &str = "socket_yml_ignored_value";
+pub const SOCKET_YML_NAME_CASE: &str = "socket_yml_name_case";
+pub const SOCKET_YML_REPO_UNTRUSTED: &str = "socket_yml_repo_untrusted";
+pub const PATCHES_DISABLED: &str = "patches_disabled";
+pub const POLICY_BYPASSED: &str = "policy_bypassed";
+
+/// Longest file-derived string copied into output.
+const MAX_OUTPUT_CHARS: usize = 200;
+
+/// Characters never copied into output: controls (terminal escapes) and
+/// the invisible formatting characters that can reorder or hide text
+/// (bidi overrides and isolates, zero-width characters, BOM).
+fn unsafe_for_output(c: char) -> bool {
+    c.is_control()
+        || matches!(c, '\u{200B}'..='\u{200F}' | '\u{202A}'..='\u{202E}' | '\u{2060}'..='\u{2069}' | '\u{FEFF}')
+}
+
+/// [`sanitize`] without the length cap, for whole messages.
+pub fn strip_unsafe(s: &str) -> String {
+    s.chars().filter(|c| !unsafe_for_output(*c)).collect()
+}
+
+/// Make a file-derived string safe to print: control and invisible
+/// formatting characters dropped, at most 200 characters.
+pub fn sanitize(s: &str) -> String {
+    s.chars()
+        .filter(|c| !unsafe_for_output(*c))
+        .take(MAX_OUTPUT_CHARS)
+        .collect()
+}
+
+/// Where the policy came from.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum PolicySource {
+    /// No file, an empty file, a file-less scan (`--global`), or only a
+    /// case variant of the name.
+    None,
+    /// A root file was read; `path` is its name relative to the repo root.
+    File { path: String, sha256: String },
+    /// `--no-socket-yml` / `SOCKET_NO_SOCKET_YML`.
+    Bypassed,
+}
+
+impl PolicySource {
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            PolicySource::None => "none",
+            PolicySource::File { .. } => "file",
+            PolicySource::Bypassed => "bypassed",
+        }
+    }
+}
+
+/// Why a root, package or patch was filtered. Codes are stable.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum FilterReason {
+    Disabled,
+    PathExcluded {
+        pattern: String,
+        list: &'static str,
+    },
+    PathNotIncluded,
+    Ecosystem,
+    PackageNotListed,
+    PackageIgnored {
+        spec: String,
+    },
+    Severity {
+        found: Option<String>,
+        floor: String,
+    },
+}
+
+impl FilterReason {
+    pub fn code(&self) -> &'static str {
+        match self {
+            FilterReason::Disabled => "policy_disabled",
+            FilterReason::PathExcluded { .. } => "policy_path_excluded",
+            FilterReason::PathNotIncluded => "policy_path_not_included",
+            FilterReason::Ecosystem => "policy_ecosystem",
+            FilterReason::PackageNotListed => "policy_package_not_listed",
+            FilterReason::PackageIgnored { .. } => "policy_package_ignored",
+            FilterReason::Severity { .. } => "policy_severity",
+        }
+    }
+
+    pub fn detail(&self) -> String {
+        match self {
+            FilterReason::Disabled => "patches.enabled is false".to_string(),
+            FilterReason::PathExcluded { pattern, list } => {
+                format!("{} ({list})", sanitize(pattern))
+            }
+            FilterReason::PathNotIncluded => "not matched by patches.includePaths".to_string(),
+            FilterReason::Ecosystem => "ecosystem not in patches.ecosystems".to_string(),
+            FilterReason::PackageNotListed => "not in patches.packages".to_string(),
+            FilterReason::PackageIgnored { spec } => {
+                format!("{} (patches.ignorePackages)", sanitize(spec))
+            }
+            FilterReason::Severity { found, floor } => {
+                format!("{} < {floor}", found.as_deref().unwrap_or("unknown"))
+            }
+        }
+    }
+}
+
+/// A policy file that cannot be honored. Scan fails closed on it.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum PolicyError {
+    Invalid {
+        file: String,
+        key: String,
+        message: String,
+    },
+    Ambiguous {
+        files: [String; 2],
+    },
+}
+
+impl PolicyError {
+    pub fn code(&self) -> &'static str {
+        match self {
+            PolicyError::Invalid { .. } => SOCKET_YML_INVALID,
+            PolicyError::Ambiguous { .. } => SOCKET_YML_AMBIGUOUS,
+        }
+    }
+
+    /// The message without the remedy.
+    pub fn detail(&self) -> String {
+        match self {
+            PolicyError::Invalid { file, key, message } if key.is_empty() => {
+                format!("{file}: {}", strip_unsafe(message))
+            }
+            PolicyError::Invalid { file, key, message } => {
+                format!("{file}: {}: {}", sanitize(key), strip_unsafe(message))
+            }
+            PolicyError::Ambiguous { files } => format!(
+                "{} and {} both exist and their `patches`/`projectIgnorePaths` differ; keep one file",
+                files[0], files[1]
+            ),
+        }
+    }
+}
+
+impl std::fmt::Display for PolicyError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(
+            f,
+            "{} (fix the file, or pass --no-socket-yml to ignore it)",
+            self.detail()
+        )
+    }
+}
+
+impl std::error::Error for PolicyError {}
+
+/// A root file as the policy source sees it.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum RootFile {
+    Absent,
+    Present(Vec<u8>),
+    /// Listed, but its bytes were withheld (symlink, oversize, LFS pointer,
+    /// binary): never "absent", because the file may narrow the scan.
+    PresentWithoutContent,
+}
+
+/// Read access to the repo root's policy files.
+pub trait PolicyFs {
+    /// The root file named exactly `name`, read up to `cap + 1` bytes.
+    fn read_root_file(&self, name: &str, cap: usize) -> std::io::Result<RootFile>;
+
+    /// Root entries whose names equal a policy file name only ignoring case.
+    fn case_variants(&self) -> Vec<String> {
+        Vec::new()
+    }
+}
+
+/// [`PolicyFs`] over a directory on disk (the repo root).
+pub struct DiskPolicyFs {
+    root: PathBuf,
+}
+
+impl DiskPolicyFs {
+    pub fn new(root: impl Into<PathBuf>) -> Self {
+        Self { root: root.into() }
+    }
+
+    fn entry_names(&self) -> Vec<String> {
+        std::fs::read_dir(&self.root)
+            .map(|entries| {
+                entries
+                    .filter_map(|e| e.ok())
+                    .filter_map(|e| e.file_name().into_string().ok())
+                    .collect()
+            })
+            .unwrap_or_default()
+    }
+}
+
+#[cfg(unix)]
+fn open_nonblocking(path: &Path) -> std::io::Result<std::fs::File> {
+    use std::os::unix::fs::OpenOptionsExt;
+    // O_NONBLOCK: opening a FIFO must not wait for a writer; the handle's
+    // metadata then refuses it. O_NOFOLLOW: the path was resolved already.
+    std::fs::OpenOptions::new()
+        .read(true)
+        .custom_flags(libc::O_NONBLOCK | libc::O_NOFOLLOW)
+        .open(path)
+}
+
+#[cfg(not(unix))]
+fn open_nonblocking(path: &Path) -> std::io::Result<std::fs::File> {
+    std::fs::File::open(path)
+}
+
+fn io_other(message: &str) -> std::io::Error {
+    std::io::Error::other(message.to_string())
+}
+
+impl PolicyFs for DiskPolicyFs {
+    fn read_root_file(&self, name: &str, cap: usize) -> std::io::Result<RootFile> {
+        if !self.entry_names().iter().any(|n| n == name) {
+            return Ok(RootFile::Absent);
+        }
+        // Resolve first, confine, then open the resolved path without
+        // following a final symlink: a link swapped in after the check is
+        // refused instead of followed out of the repository.
+        let root = std::fs::canonicalize(&self.root)?;
+        let target = std::fs::canonicalize(self.root.join(name))?;
+        if !target.starts_with(&root) {
+            return Err(io_other("symlink resolves outside the repository root"));
+        }
+        let file = open_nonblocking(&target)?;
+        let meta = file.metadata()?;
+        if !meta.is_file() {
+            return Err(io_other("not a regular file"));
+        }
+        let mut bytes = Vec::new();
+        file.take(cap as u64 + 1).read_to_end(&mut bytes)?;
+        if bytes.len() > cap {
+            return Err(io_other(&format!("larger than {} KiB", cap / 1024)));
+        }
+        Ok(RootFile::Present(bytes))
+    }
+
+    fn case_variants(&self) -> Vec<String> {
+        let mut out: Vec<String> = self
+            .entry_names()
+            .into_iter()
+            .filter(|n| {
+                POLICY_FILE_NAMES
+                    .iter()
+                    .any(|p| n.eq_ignore_ascii_case(p) && n != p)
+            })
+            .collect();
+        out.sort();
+        out
+    }
+}
+
+/// [`PolicyFs`] over an in-memory tree root (the hosted engine).
+#[derive(Debug, Clone, Default)]
+pub struct MemoryPolicyFs {
+    pub files: BTreeMap<String, RootFile>,
+    /// Every root entry name the tree lists, for the case-variant warning.
+    pub root_names: Vec<String>,
+}
+
+impl PolicyFs for MemoryPolicyFs {
+    fn read_root_file(&self, name: &str, cap: usize) -> std::io::Result<RootFile> {
+        match self.files.get(name) {
+            None => Ok(RootFile::Absent),
+            Some(RootFile::Present(bytes)) if bytes.len() > cap => {
+                Err(io_other(&format!("larger than {} KiB", cap / 1024)))
+            }
+            Some(file) => Ok(file.clone()),
+        }
+    }
+
+    fn case_variants(&self) -> Vec<String> {
+        let mut out: Vec<String> = self
+            .root_names
+            .iter()
+            .filter(|n| {
+                POLICY_FILE_NAMES
+                    .iter()
+                    .any(|p| n.eq_ignore_ascii_case(p) && n != p)
+            })
+            .cloned()
+            .collect();
+        out.sort();
+        out.dedup();
+        out
+    }
+}
+
+/// Which layer set a scalar override.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum OverrideSource {
+    Flag,
+    Env,
+}
+
+/// The invoking user's overrides (trusted; they beat the file).
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct PolicyOverrides {
+    /// Skip the file entirely (built-in default ignores still apply).
+    pub bypass: bool,
+    /// `(None, _)` is `none`: no floor, even when the file sets one.
+    pub min_severity: Option<(Option<u8>, OverrideSource)>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct PolicyWarning {
+    pub code: &'static str,
+    pub detail: String,
+}
+
+/// Where the effective severity floor came from.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum SeveritySource {
+    Flag,
+    Env,
+    File,
+    Default,
+}
+
+impl SeveritySource {
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            SeveritySource::Flag => "flag",
+            SeveritySource::Env => "env",
+            SeveritySource::File => "file",
+            SeveritySource::Default => "default",
+        }
+    }
+}
+
+/// A project root, as the path filters see it.
+#[derive(Debug, Clone, Copy)]
+pub struct Root<'a> {
+    /// Repo-relative directory, `/` separators, `""` for the repo root.
+    pub rel_dir: &'a str,
+    /// The lockfile/manifest files the engine reads for this root,
+    /// relative to `rel_dir`.
+    pub markers: &'a [String],
+    /// Named by the user (never subject to the built-in default ignores).
+    pub explicit: bool,
+}
+
+/// The effective selection policy of one invocation.
+#[derive(Debug, Clone)]
+pub struct SelectionPolicy {
+    source: PolicySource,
+    enabled: bool,
+    ignore_discovered: PathMatcher,
+    ignore_explicit: PathMatcher,
+    include: Option<PathMatcher>,
+    ecosystems: Option<Vec<String>>,
+    packages: Option<Vec<String>>,
+    ignore_packages: Vec<String>,
+    min_severity: Option<u8>,
+    min_severity_source: SeveritySource,
+    max_new_patches: Option<u32>,
+}
+
+/// Canonical severity name of an order (`moderate` reads as `medium`).
+pub fn severity_name(order: u8) -> Option<&'static str> {
+    match order {
+        0 => Some("critical"),
+        1 => Some("high"),
+        2 => Some("medium"),
+        3 => Some("low"),
+        _ => None,
+    }
+}
+
+/// Parse a `--min-severity` / `SOCKET_MIN_SEVERITY` value: a severity
+/// name, or `none` for no floor.
+pub fn parse_min_severity(value: &str) -> Result<Option<u8>, String> {
+    if value.trim().eq_ignore_ascii_case("none") {
+        return Ok(None);
+    }
+    socket_yml::parse_severity_name(value)
+        .map(Some)
+        .ok_or_else(|| {
+            format!(
+                "invalid severity `{}`: expected critical, high, medium, moderate, low or none",
+                sanitize(value)
+            )
+        })
+}
+
+/// The severity the floor judges a patch by: the worst severity across
+/// the advisories it fixes (never `RankKey.severity`).
+pub fn patch_severity_order(patch: &PatchSearchResult) -> u8 {
+    max_severity_order(patch.vulnerabilities.values().map(|v| v.severity.as_str()))
+}
+
+fn defaults_list() -> Vec<String> {
+    DEFAULT_IGNORE_PATHS.iter().map(|s| s.to_string()).collect()
+}
+
+/// Compile a combined list. Each list was validated on its own, but the
+/// combination can still exceed the glob engine's size limit; that is an
+/// error (fail closed), never an empty matcher.
+fn compile(file: &str, lists: &[(&'static str, &[String])]) -> Result<PathMatcher, PolicyError> {
+    PathMatcher::new(lists).map_err(|(list, _, message)| PolicyError::Invalid {
+        file: file.to_string(),
+        key: list.to_string(),
+        message: format!("the path patterns cannot be compiled together: {message}"),
+    })
+}
+
+/// The built-in defaults, compiled once (for callers that only need the
+/// default path ignores, e.g. tree-listing root detection).
+pub fn builtin_defaults() -> &'static SelectionPolicy {
+    static DEFAULTS: std::sync::LazyLock<SelectionPolicy> = std::sync::LazyLock::new(SelectionPolicy::unrestricted);
+    &DEFAULTS
+}
+
+impl SelectionPolicy {
+    /// No file: only the built-in default ignores.
+    pub fn unrestricted() -> Self {
+        Self::from_parts("", PolicySource::None, &[], &PatchesBlock::default())
+            .expect("the built-in default ignores always compile")
+    }
+
+    fn from_parts(
+        file: &str,
+        source: PolicySource,
+        project_ignore_paths: &[String],
+        block: &PatchesBlock,
+    ) -> Result<Self, PolicyError> {
+        let defaults = defaults_list();
+        let ignore_discovered = compile(
+            file,
+            &[
+                (DEFAULT_IGNORE_LIST, &defaults),
+                ("projectIgnorePaths", project_ignore_paths),
+                ("patches.ignorePaths", &block.ignore_paths),
+            ],
+        )?;
+        let ignore_explicit = compile(
+            file,
+            &[
+                ("projectIgnorePaths", project_ignore_paths),
+                ("patches.ignorePaths", &block.ignore_paths),
+            ],
+        )?;
+        let include = match block.include_paths.as_ref() {
+            Some(list) => Some(compile(file, &[("patches.includePaths", list)])?),
+            None => None,
+        };
+        Ok(Self {
+            source,
+            enabled: block.enabled.unwrap_or(true),
+            ignore_discovered,
+            ignore_explicit,
+            include,
+            ecosystems: block.ecosystems.clone(),
+            packages: block.packages.clone(),
+            ignore_packages: block.ignore_packages.clone(),
+            min_severity: block.min_severity,
+            min_severity_source: if block.min_severity.is_some() {
+                SeveritySource::File
+            } else {
+                SeveritySource::Default
+            },
+            max_new_patches: block.max_new_patches,
+        })
+    }
+
+    fn apply_overrides(&mut self, overrides: &PolicyOverrides) {
+        if let Some((value, source)) = overrides.min_severity {
+            self.min_severity = value;
+            self.min_severity_source = match source {
+                OverrideSource::Flag => SeveritySource::Flag,
+                OverrideSource::Env => SeveritySource::Env,
+            };
+        }
+    }
+
+    /// Read, validate and combine the repo root's policy files (4.4-4.5).
+    pub fn load(
+        fs: &dyn PolicyFs,
+        overrides: &PolicyOverrides,
+    ) -> Result<(Self, Vec<PolicyWarning>), PolicyError> {
+        let mut warnings = Vec::new();
+        if overrides.bypass {
+            let mut policy = Self::unrestricted();
+            policy.source = PolicySource::Bypassed;
+            policy.apply_overrides(overrides);
+            return Ok((policy, warnings));
+        }
+        for variant in fs.case_variants() {
+            warnings.push(PolicyWarning {
+                code: SOCKET_YML_NAME_CASE,
+                detail: format!(
+                    "`{}` is not read: the policy file must be named exactly socket.yml or socket.yaml",
+                    sanitize(&variant)
+                ),
+            });
+        }
+        let mut files: Vec<(&'static str, Vec<u8>, ParsedFile)> = Vec::new();
+        for name in POLICY_FILE_NAMES {
+            let invalid = |message: String| PolicyError::Invalid {
+                file: name.to_string(),
+                key: String::new(),
+                message,
+            };
+            match fs.read_root_file(name, MAX_FILE_BYTES) {
+                Ok(RootFile::Absent) => {}
+                Ok(RootFile::PresentWithoutContent) => {
+                    return Err(invalid(
+                        "the file is listed but its content was not provided (symlink, oversize, LFS pointer or binary)"
+                            .to_string(),
+                    ))
+                }
+                Ok(RootFile::Present(bytes)) => {
+                    if bytes.len() > MAX_FILE_BYTES {
+                        return Err(invalid(format!("cannot read the file: larger than {} KiB", MAX_FILE_BYTES / 1024)));
+                    }
+                    let parsed = parse_file(name, &bytes, &mut warnings)?;
+                    files.push((name, bytes, parsed));
+                }
+                Err(e) => return Err(invalid(format!("cannot read the file: {e}"))),
+            }
+        }
+        if let [(first, _, a), (second, _, b)] = files.as_slice() {
+            if !a.same_policy(b) {
+                return Err(PolicyError::Ambiguous {
+                    files: [first.to_string(), second.to_string()],
+                });
+            }
+        }
+        let mut policy = match files.into_iter().next() {
+            Some((name, bytes, parsed)) if !parsed.empty => {
+                let source = PolicySource::File {
+                    path: name.to_string(),
+                    sha256: hex::encode(Sha256::digest(&bytes)),
+                };
+                let block = parsed.patches.clone().unwrap_or_default();
+                Self::from_parts(name, source, &parsed.project_ignore_paths, &block)?
+            }
+            _ => Self::unrestricted(),
+        };
+        policy.apply_overrides(overrides);
+        Ok((policy, warnings))
+    }
+
+    pub fn source(&self) -> &PolicySource {
+        &self.source
+    }
+
+    /// `patches.enabled`. When false nothing is written (report only).
+    pub fn enabled(&self) -> bool {
+        self.enabled
+    }
+
+    /// The effective severity floor and its source.
+    pub fn min_severity(&self) -> (Option<u8>, SeveritySource) {
+        (self.min_severity, self.min_severity_source)
+    }
+
+    /// The file's `maxNewPatches`; `None` when there is no file, it was
+    /// bypassed, or the key is absent.
+    pub fn max_new_patches(&self) -> Option<u32> {
+        match self.source {
+            PolicySource::File { .. } => self.max_new_patches,
+            _ => None,
+        }
+    }
+
+    /// Path filters for one project root (4.3): ignored iff every marker
+    /// is ignored; with `includePaths`, included iff any marker matches.
+    pub fn admits_root(&self, root: &Root) -> Result<(), FilterReason> {
+        let rel_dir = root.rel_dir.trim_matches('/');
+        let subjects: Vec<(String, bool)> = if root.markers.is_empty() {
+            vec![(rel_dir.to_string(), true)]
+        } else {
+            root.markers
+                .iter()
+                .map(|m| {
+                    let m = m.trim_start_matches('/');
+                    if rel_dir.is_empty() {
+                        (m.to_string(), false)
+                    } else {
+                        (format!("{rel_dir}/{m}"), false)
+                    }
+                })
+                .collect()
+        };
+        let ignore = if root.explicit {
+            &self.ignore_explicit
+        } else {
+            &self.ignore_discovered
+        };
+        let mut first_hit: Option<PathHit> = None;
+        let mut all_ignored = true;
+        for (path, is_dir) in &subjects {
+            match ignore.check(path, *is_dir) {
+                Some(hit) => {
+                    first_hit.get_or_insert(hit);
+                }
+                None => {
+                    all_ignored = false;
+                    break;
+                }
+            }
+        }
+        if all_ignored {
+            if let Some(hit) = first_hit {
+                return Err(FilterReason::PathExcluded {
+                    pattern: sanitize(&hit.pattern),
+                    list: hit.list,
+                });
+            }
+        }
+        if let Some(include) = &self.include {
+            if !subjects
+                .iter()
+                .any(|(path, is_dir)| include.check(path, *is_dir).is_some())
+            {
+                return Err(FilterReason::PathNotIncluded);
+            }
+        }
+        Ok(())
+    }
+
+    /// Ecosystem and package filters for one package (deny wins).
+    pub fn admits_purl(&self, purl: &str) -> Result<(), FilterReason> {
+        if let Some(ecosystems) = &self.ecosystems {
+            let eco = Ecosystem::from_purl(purl).map(|e| e.cli_name());
+            if !eco.is_some_and(|e| ecosystems.iter().any(|x| x == e)) {
+                return Err(FilterReason::Ecosystem);
+            }
+        }
+        if let Some(spec) = self
+            .ignore_packages
+            .iter()
+            .find(|s| package_spec_matches(s, purl))
+        {
+            return Err(FilterReason::PackageIgnored {
+                spec: sanitize(spec),
+            });
+        }
+        if let Some(packages) = &self.packages {
+            if !packages.iter().any(|s| package_spec_matches(s, purl)) {
+                return Err(FilterReason::PackageNotListed);
+            }
+        }
+        Ok(())
+    }
+
+    /// The severity floor for one patch (`severity_order` ranks, unknown
+    /// = 4 is filtered whenever a floor is set).
+    pub fn admits_severity(&self, severity_order: u8) -> Result<(), FilterReason> {
+        let Some(floor) = self.min_severity else {
+            return Ok(());
+        };
+        if severity_order <= floor && severity_name(severity_order).is_some() {
+            return Ok(());
+        }
+        Err(FilterReason::Severity {
+            found: severity_name(severity_order).map(str::to_string),
+            floor: severity_name(floor).unwrap_or("unknown").to_string(),
+        })
+    }
+
+    /// Split offers by the severity floor, keeping order.
+    pub fn floor_filter(
+        &self,
+        offers: Vec<PatchSearchResult>,
+    ) -> (
+        Vec<PatchSearchResult>,
+        Vec<(PatchSearchResult, FilterReason)>,
+    ) {
+        let mut admitted = Vec::with_capacity(offers.len());
+        let mut filtered = Vec::new();
+        for offer in offers {
+            match self.admits_severity(patch_severity_order(&offer)) {
+                Ok(()) => admitted.push(offer),
+                Err(reason) => filtered.push((offer, reason)),
+            }
+        }
+        (admitted, filtered)
+    }
+}
+
+/// The step 5 → 7 seam: every offer per purl (after the tier filter) and
+/// the winner among the floor-admitted ones.
+#[derive(Debug, Clone, Default)]
+pub struct Offers {
+    pub unfiltered: BTreeMap<String, Vec<PatchSearchResult>>,
+    pub selected: BTreeMap<String, PatchSearchResult>,
+}
+
+/// Whether a `--package` spec names the package at `purl`: a purl spec
+/// matches the same purl, or any version of it when it carries none; a
+/// bare spec matches the package's full name (`@scope/pkg`, `group/name`)
+/// or its last segment. Qualifiers are ignored and names compare
+/// case-insensitively (PyPI, NuGet and Composer names are case-insensitive;
+/// npm forbids uppercase).
+pub fn package_spec_matches(spec: &str, purl: &str) -> bool {
+    let decoded = normalize_purl(strip_purl_qualifiers(purl)).to_lowercase();
+    let spec = spec.trim().to_lowercase();
+    if spec.is_empty() {
+        return false;
+    }
+    let Some(rest) = decoded.strip_prefix("pkg:") else {
+        return false;
+    };
+    let Some((_eco, name_version)) = rest.split_once('/') else {
+        return false;
+    };
+    let name = match name_version.rfind('@').filter(|&i| i > 0) {
+        Some(at) => &name_version[..at],
+        None => name_version,
+    };
+    if let Some(spec_rest) = spec.strip_prefix("pkg:") {
+        let spec_purl =
+            normalize_purl(strip_purl_qualifiers(&format!("pkg:{spec_rest}"))).to_lowercase();
+        let spec_rest = &spec_purl[4..];
+        let has_version = spec_rest
+            .split_once('/')
+            .is_some_and(|(_, nv)| nv.rfind('@').is_some_and(|i| i > 0));
+        return if has_version {
+            decoded == spec_purl
+        } else {
+            decoded
+                .strip_prefix(&spec_purl)
+                .is_some_and(|tail| tail.starts_with('@'))
+        };
+    }
+    let spec = spec.replace(':', "/");
+    name == spec || name.rsplit('/').next() == Some(spec.as_str())
+}
+
+fn home_dir() -> Option<PathBuf> {
+    let var = if cfg!(windows) { "USERPROFILE" } else { "HOME" };
+    std::env::var_os(var)
+        .filter(|v| !v.is_empty())
+        .map(PathBuf::from)
+        .map(|p| std::fs::canonicalize(&p).unwrap_or(p))
+}
+
+fn ceiling_dirs() -> Vec<PathBuf> {
+    std::env::var_os("GIT_CEILING_DIRECTORIES")
+        .map(|v| {
+            std::env::split_paths(&v)
+                .filter(|p| !p.as_os_str().is_empty())
+                .map(|p| std::fs::canonicalize(&p).unwrap_or(p))
+                .collect()
+        })
+        .unwrap_or_default()
+}
+
+#[cfg(unix)]
+fn trusted_owner(meta: &std::fs::Metadata) -> bool {
+    use std::os::unix::fs::MetadataExt;
+    let sudo_uid = std::env::var("SUDO_UID").ok().and_then(|v| v.trim().parse::<u32>().ok());
+    // SAFETY: geteuid has no preconditions and cannot fail.
+    owner_trusted(meta.uid(), unsafe { libc::geteuid() }, sudo_uid)
+}
+
+/// `.git` is trusted when it belongs to the invoking user, to root, or
+/// (under sudo) to the user sudo ran for. Root trusts every owner: a root
+/// process is exposed to the whole filesystem anyway, and CI containers
+/// commonly run as root over a checkout owned by another uid, where
+/// distrust would silently drop the repo's policy (which only narrows).
+#[cfg(unix)]
+fn owner_trusted(owner: u32, euid: u32, sudo_uid: Option<u32>) -> bool {
+    euid == 0 || owner == euid || owner == 0 || sudo_uid == Some(owner)
+}
+
+#[cfg(not(unix))]
+fn trusted_owner(_meta: &std::fs::Metadata) -> bool {
+    true
+}
+
+/// The repo root for `cwd` (4.5) with the lookup's warnings: the nearest
+/// ancestor (inclusive) holding a `.git` directory or file, not walking
+/// past `GIT_CEILING_DIRECTORIES` or into the home directory, and (Unix)
+/// only when `.git` belongs to a trusted owner ([`owner_trusted`]).
+/// Otherwise `cwd`.
+pub fn find_repo_root_with_warnings(cwd: &Path) -> (PathBuf, Vec<PolicyWarning>) {
+    let cwd = std::fs::canonicalize(cwd).unwrap_or_else(|_| cwd.to_path_buf());
+    let ceilings = ceiling_dirs();
+    let home = home_dir();
+    let mut warnings = Vec::new();
+    let mut dir: &Path = &cwd;
+    loop {
+        if dir != cwd && home.as_deref() == Some(dir) {
+            break;
+        }
+        // `metadata` follows a `.git` symlink, as git does.
+        if let Ok(meta) = std::fs::metadata(dir.join(".git")) {
+            if meta.is_dir() || meta.is_file() {
+                if trusted_owner(&meta) {
+                    return (dir.to_path_buf(), warnings);
+                }
+                warnings.push(PolicyWarning {
+                    code: SOCKET_YML_REPO_UNTRUSTED,
+                    detail: format!(
+                        "{} is owned by another user; using {} as the repository root",
+                        dir.join(".git").display(),
+                        cwd.display()
+                    ),
+                });
+                break;
+            }
+        }
+        let Some(parent) = dir.parent() else { break };
+        if ceilings.iter().any(|c| c == parent) {
+            break;
+        }
+        dir = parent;
+    }
+    (cwd.clone(), warnings)
+}
+
+/// [`find_repo_root_with_warnings`] without the warnings.
+pub fn find_repo_root(cwd: &Path) -> PathBuf {
+    find_repo_root_with_warnings(cwd).0
+}
+
+/// `dir` relative to `repo_root` with `/` separators (`""` for the root
+/// itself); `None` when `dir` is not inside it.
+pub fn repo_relative_checked(repo_root: &Path, dir: &Path) -> Option<String> {
+    let rel = dir.strip_prefix(repo_root).ok()?;
+    let mut parts = Vec::new();
+    for component in rel.components() {
+        match component {
+            std::path::Component::Normal(part) => parts.push(part.to_string_lossy().into_owned()),
+            std::path::Component::CurDir => {}
+            _ => return None,
+        }
+    }
+    Some(parts.join("/"))
+}
+
+/// [`repo_relative_checked`], falling back to `dir` itself (with `/`
+/// separators) when it is outside the root.
+pub fn repo_relative(repo_root: &Path, dir: &Path) -> String {
+    repo_relative_checked(repo_root, dir)
+        .unwrap_or_else(|| dir.to_string_lossy().replace('\\', "/"))
+}
+
+#[cfg(test)]
+mod tests;
diff --git a/crates/socket-patch-core/src/policy/paths.rs b/crates/socket-patch-core/src/policy/paths.rs
new file mode 100644
index 00000000..78219ae7
--- /dev/null
+++ b/crates/socket-patch-core/src/policy/paths.rs
@@ -0,0 +1,250 @@
+//! Path lists of the `socket.yml` patch policy: gitignore patterns matched
+//! the way the npm `ignore` package (the backend's `projectIgnorePaths`
+//! matcher) matches them.
+//!
+//! Evaluation walks top-down: for `a/b/c.lock` the matcher tests `a/`,
+//! then `a/b/`, then the file, and the first ignored ancestor decides. A
+//! negation can therefore never re-include anything under an ignored
+//! directory, as in git and npm `ignore`. `ignore::gitignore`'s
+//! `matched_path_or_any_parents` walks bottom-up and would re-include, so
+//! it is not used.
+
+use std::path::PathBuf;
+
+use ignore::gitignore::{Gitignore, GitignoreBuilder};
+use ignore::Match;
+
+/// Longest accepted pattern, in bytes.
+pub(crate) const MAX_PATTERN_BYTES: usize = 1024;
+
+/// Why a pattern is refused before it reaches the glob compiler.
+pub(crate) fn pattern_hygiene_error(pattern: &str) -> Option<String> {
+    if pattern.len() > MAX_PATTERN_BYTES {
+        return Some(format!("pattern is longer than {MAX_PATTERN_BYTES} bytes"));
+    }
+    if pattern.contains('\0') {
+        return Some("pattern contains a NUL byte".to_string());
+    }
+    if pattern.trim().is_empty() {
+        return Some("pattern is empty".to_string());
+    }
+    let body = pattern.strip_prefix('!').unwrap_or(pattern);
+    let body_no_slash = body.strip_prefix('/').unwrap_or(body);
+    let bytes = body_no_slash.as_bytes();
+    if bytes.len() >= 2 && bytes[0].is_ascii_alphabetic() && bytes[1] == b':' {
+        return Some("pattern starts with a drive letter; paths are repo-relative".to_string());
+    }
+    if body.split('/').any(|segment| segment == "..") {
+        return Some("pattern contains a `..` segment; paths are repo-relative".to_string());
+    }
+    None
+}
+
+/// One compiled, ordered pattern list (several named source lists joined;
+/// the last matching pattern wins within a path).
+#[derive(Clone, Debug)]
+pub(crate) struct PathMatcher {
+    gitignore: Gitignore,
+    list_names: Vec<&'static str>,
+}
+
+/// The pattern that decided a path, and the list it came from.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct PathHit {
+    pub pattern: String,
+    pub list: &'static str,
+}
+
+impl PathMatcher {
+    /// Compile `lists` in order. The error names the list and the pattern.
+    pub(crate) fn new(
+        lists: &[(&'static str, &[String])],
+    ) -> Result<Self, (&'static str, String, String)> {
+        let mut builder = GitignoreBuilder::new("");
+        // Never fails in ignore 0.4 (the Result is historical).
+        let _ = builder.case_insensitive(true);
+        builder.allow_unclosed_class(false);
+        let mut list_names = Vec::with_capacity(lists.len());
+        for (name, patterns) in lists {
+            list_names.push(*name);
+            for pattern in patterns.iter() {
+                if let Some(message) = pattern_hygiene_error(pattern) {
+                    return Err((name, pattern.clone(), message));
+                }
+                if let Err(e) = builder.add_line(Some(PathBuf::from(*name)), pattern) {
+                    return Err((name, pattern.clone(), format!("invalid pattern: {e}")));
+                }
+            }
+        }
+        let gitignore = builder.build().map_err(|e| {
+            (
+                lists.last().map_or("", |l| l.0),
+                String::new(),
+                e.to_string(),
+            )
+        })?;
+        Ok(Self {
+            gitignore,
+            list_names,
+        })
+    }
+
+    fn hit(&self, glob: &ignore::gitignore::Glob) -> PathHit {
+        let list = glob
+            .from()
+            .and_then(|from| {
+                self.list_names
+                    .iter()
+                    .copied()
+                    .find(|name| from == std::path::Path::new(name))
+            })
+            .unwrap_or("");
+        PathHit {
+            pattern: glob.original().to_string(),
+            list,
+        }
+    }
+
+    /// The pattern that matches the repo-relative `path` (`/` separators,
+    /// no leading `/`), walking its ancestors top-down; `None` when nothing
+    /// matches or a negation has the last word.
+    pub(crate) fn check(&self, path: &str, is_dir: bool) -> Option<PathHit> {
+        let path = path.trim_matches('/');
+        if path.is_empty() || self.gitignore.is_empty() {
+            return None;
+        }
+        let segments: Vec<&str> = path.split('/').collect();
+        for end in 1..segments.len() {
+            let ancestor = segments[..end].join("/");
+            if let Match::Ignore(glob) = self.gitignore.matched(&ancestor, true) {
+                return Some(self.hit(glob));
+            }
+        }
+        match self.gitignore.matched(path, is_dir) {
+            Match::Ignore(glob) => Some(self.hit(glob)),
+            _ => None,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn matcher(patterns: &[&str]) -> PathMatcher {
+        let owned: Vec<String> = patterns.iter().map(|p| p.to_string()).collect();
+        PathMatcher::new(&[("test", &owned)]).expect("patterns compile")
+    }
+
+    #[derive(serde::Deserialize)]
+    struct GoldenCase {
+        patterns: Vec<String>,
+        path: String,
+        ignored: bool,
+    }
+
+    #[derive(serde::Deserialize)]
+    struct Golden {
+        generator: String,
+        cases: Vec<GoldenCase>,
+    }
+
+    #[test]
+    fn agrees_with_npm_ignore_golden_fixture() {
+        let text = include_str!("../../tests/fixtures/ignore_golden.json");
+        let golden: Golden = serde_json::from_str(text).expect("golden fixture parses");
+        assert!(golden.generator.starts_with("ignore@"));
+        assert!(golden.cases.len() > 1000);
+        let mut mismatches = Vec::new();
+        for case in &golden.cases {
+            let m = PathMatcher::new(&[("test", &case.patterns)]).expect("golden patterns compile");
+            let got = m.check(&case.path, false).is_some();
+            if got != case.ignored {
+                mismatches.push(format!(
+                    "{:?} on {:?}: npm ignore says {}, we say {}",
+                    case.patterns, case.path, case.ignored, got
+                ));
+            }
+        }
+        assert!(
+            mismatches.is_empty(),
+            "{} mismatches:\n{}",
+            mismatches.len(),
+            mismatches.join("\n")
+        );
+    }
+
+    #[test]
+    fn excluded_parent_cannot_be_reincluded() {
+        let m = matcher(&["fixtures/", "!/a/fixtures/keep/"]);
+        let hit = m
+            .check("a/fixtures/keep/yarn.lock", false)
+            .expect("still ignored");
+        assert_eq!(hit.pattern, "fixtures/");
+        assert_eq!(hit.list, "test");
+    }
+
+    #[test]
+    fn negation_of_the_directory_itself_reincludes() {
+        let m = matcher(&["tests/", "!/e2e/tests/"]);
+        assert!(m.check("e2e/tests/package-lock.json", false).is_none());
+        assert!(m.check("x/tests/package-lock.json", false).is_some());
+    }
+
+    #[test]
+    fn case_insensitive_and_anchoring() {
+        let m = matcher(&["/legacy/"]);
+        assert!(m.check("Legacy/requirements.txt", false).is_some());
+        assert!(m.check("x/legacy/requirements.txt", false).is_none());
+        let bare = matcher(&["legacy/"]);
+        assert!(bare.check("x/legacy/requirements.txt", false).is_some());
+    }
+
+    #[test]
+    fn trailing_slash_only_matches_directories() {
+        let m = matcher(&["package-lock.json/"]);
+        assert!(m.check("package-lock.json", false).is_none());
+        assert!(m.check("package-lock.json/x", false).is_some());
+    }
+
+    #[test]
+    fn reports_the_list_of_the_deciding_pattern() {
+        let a = vec!["tests/".to_string()];
+        let b = vec!["/legacy/".to_string()];
+        let m = PathMatcher::new(&[("defaults", &a), ("patches.ignorePaths", &b)]).unwrap();
+        assert_eq!(
+            m.check("legacy/x.lock", false).unwrap().list,
+            "patches.ignorePaths"
+        );
+        assert_eq!(m.check("a/tests/x.lock", false).unwrap().list, "defaults");
+    }
+
+    #[test]
+    fn hygiene_rejects_unsafe_patterns() {
+        for bad in [
+            "../x", "a/../b", "!../x", "C:/x", "/c:/x", "a\0b", "", "   ",
+        ] {
+            assert!(
+                pattern_hygiene_error(bad).is_some(),
+                "{bad:?} must be rejected"
+            );
+        }
+        let long = "a".repeat(MAX_PATTERN_BYTES + 1);
+        assert!(pattern_hygiene_error(&long).is_some());
+        for good in ["/a/", "..a/", "a..b/", "**/x", "!/e2e/tests/", "ab:c"] {
+            assert!(
+                pattern_hygiene_error(good).is_none(),
+                "{good:?} must be accepted"
+            );
+        }
+    }
+
+    #[test]
+    fn bad_glob_is_an_error_naming_the_pattern() {
+        let bad = vec!["a/[b".to_string()];
+        let err = PathMatcher::new(&[("patches.ignorePaths", &bad)])
+            .expect_err("unclosed class rejected");
+        assert_eq!(err.0, "patches.ignorePaths");
+        assert_eq!(err.1, "a/[b");
+    }
+}
diff --git a/crates/socket-patch-core/src/policy/report.rs b/crates/socket-patch-core/src/policy/report.rs
new file mode 100644
index 00000000..3279b195
--- /dev/null
+++ b/crates/socket-patch-core/src/policy/report.rs
@@ -0,0 +1,88 @@
+//! The `policy` JSON block (4.7) both engines report: disk scans and the
+//! in-memory engine build the same entries and render them here.
+
+use super::{severity_name, FilterReason, PolicySource, SelectionPolicy};
+use crate::utils::purl::{normalize_purl, strip_purl_qualifiers};
+
+/// The canonical spelling filters and the recorded view compare on.
+pub fn canon(purl: &str) -> String {
+    normalize_purl(strip_purl_qualifiers(purl)).into_owned()
+}
+
+/// One `policy.filtered[]` entry.
+#[derive(Debug, Clone)]
+pub struct FilteredEntry {
+    pub purl: Option<String>,
+    pub uuid: Option<String>,
+    pub project: String,
+    pub reason: FilterReason,
+    /// The would-be patch's severity order, when a patch was looked up.
+    pub severity: Option<u8>,
+}
+
+/// One `policy.retained[]` entry.
+#[derive(Debug, Clone)]
+pub struct RetainedEntry {
+    pub purl: String,
+    pub project: String,
+    pub recorded_uuid: String,
+    pub reason: FilterReason,
+    pub upgrade_available: bool,
+}
+
+/// The top-level `policy` block (4.7), shared by disk scans and the
+/// in-memory engine.
+pub fn policy_block(
+    policy: &SelectionPolicy,
+    filtered: &[FilteredEntry],
+    retained: &[RetainedEntry],
+) -> serde_json::Value {
+    let (path, sha256) = match policy.source() {
+        PolicySource::File { path, sha256 } => (serde_json::json!(path), serde_json::json!(sha256)),
+        _ => (serde_json::Value::Null, serde_json::Value::Null),
+    };
+    let (floor, floor_source) = policy.min_severity();
+    // Sorted: crawl order is filesystem order, and the two engines differ.
+    let mut filtered: Vec<&FilteredEntry> = filtered.iter().collect();
+    filtered.sort_by(|a, b| (&a.project, &a.purl, a.reason.code()).cmp(&(&b.project, &b.purl, b.reason.code())));
+    let mut retained: Vec<&RetainedEntry> = retained.iter().collect();
+    retained.sort_by(|a, b| (&a.project, &a.purl).cmp(&(&b.project, &b.purl)));
+    let filtered: Vec<serde_json::Value> = filtered
+        .iter()
+        .map(|f| {
+            serde_json::json!({
+                "purl": f.purl,
+                "uuid": f.uuid,
+                "project": f.project,
+                "reason": f.reason.code(),
+                "detail": f.reason.detail(),
+            })
+        })
+        .collect();
+    let retained: Vec<serde_json::Value> = retained
+        .iter()
+        .map(|r| {
+            serde_json::json!({
+                "purl": r.purl,
+                "project": r.project,
+                "recordedUuid": r.recorded_uuid,
+                "reason": r.reason.code(),
+                "detail": r.reason.detail(),
+                "upgradeAvailable": r.upgrade_available,
+            })
+        })
+        .collect();
+    serde_json::json!({
+        "source": policy.source().as_str(),
+        "path": path,
+        "sha256": sha256,
+        "enabled": policy.enabled(),
+        "minSeverity": {
+            "value": floor.and_then(severity_name),
+            "source": floor_source.as_str(),
+        },
+        "counts": { "filtered": filtered.len(), "retained": retained.len() },
+        "filtered": filtered,
+        "retained": retained,
+    })
+}
diff --git a/crates/socket-patch-core/src/policy/socket_yml.rs b/crates/socket-patch-core/src/policy/socket_yml.rs
new file mode 100644
index 00000000..30a99499
--- /dev/null
+++ b/crates/socket-patch-core/src/policy/socket_yml.rs
@@ -0,0 +1,1277 @@
+//! Parser and strict validator for the parts of `socket.yml` socket-patch
+//! reads: `version`, `projectIgnorePaths` and the `patches` block.
+//!
+//! The file is read as a YAML 1.2 event stream (serde-saphyr's parser)
+//! into a small node tree. Aliases are never expanded: an alias inside the
+//! keys we read is refused, and one anywhere else is left alone, so an
+//! alias bomb cannot cost anything. Plain scalars resolve with the YAML 1.2
+//! core schema (`no` is a string, `"false"` is not a bool).
+
+use std::collections::HashSet;
+
+use serde_saphyr::granit_parser::{Event, Options, Parser, ScalarStyle, Tag};
+
+use super::paths::{PathMatcher, MAX_PATTERN_BYTES};
+use super::{sanitize, PolicyError, PolicyWarning};
+use crate::api::ranking::severity_order;
+use crate::crawlers::Ecosystem;
+
+/// Largest accepted file, in bytes.
+pub const MAX_FILE_BYTES: usize = 64 * 1024;
+const MAX_DEPTH: usize = 32;
+const MAX_LIST_ENTRIES: usize = 1000;
+
+pub(crate) const PATCHES_KEYS: [&str; 8] = [
+    "enabled",
+    "includePaths",
+    "ignorePaths",
+    "ecosystems",
+    "packages",
+    "ignorePackages",
+    "minSeverity",
+    "maxNewPatches",
+];
+
+#[derive(Debug, Clone, PartialEq)]
+enum Scalar {
+    Null,
+    Bool(bool),
+    Int(i128),
+    /// A float, or an integer too large for `i128`.
+    Number,
+    Str(String),
+}
+
+#[derive(Debug)]
+enum Kind {
+    Scalar {
+        value: Scalar,
+        raw: String,
+        plain: bool,
+    },
+    Seq(Vec<Node>),
+    Map(Vec<(Node, Node)>),
+    Alias,
+}
+
+#[derive(Debug)]
+struct Node {
+    kind: Kind,
+    anchored: bool,
+    custom_tag: bool,
+}
+
+impl Node {
+    fn as_str(&self) -> Option<&str> {
+        match &self.kind {
+            Kind::Scalar {
+                value: Scalar::Str(s),
+                ..
+            } => Some(s),
+            _ => None,
+        }
+    }
+
+    fn is_merge_key(&self) -> bool {
+        matches!(&self.kind, Kind::Scalar { raw, plain: true, .. } if raw == "<<")
+    }
+
+    fn describe(&self) -> &'static str {
+        match &self.kind {
+            Kind::Scalar { value, .. } => match value {
+                Scalar::Null => "null",
+                Scalar::Bool(_) => "a boolean",
+                Scalar::Int(_) | Scalar::Number => "a number",
+                Scalar::Str(_) => "a string",
+            },
+            Kind::Seq(_) => "a list",
+            Kind::Map(_) => "a mapping",
+            Kind::Alias => "an alias",
+        }
+    }
+}
+
+fn is_int_body(s: &str) -> bool {
+    !s.is_empty() && s.bytes().all(|b| b.is_ascii_digit())
+}
+
+fn is_float(s: &str) -> bool {
+    let lower = s.to_ascii_lowercase();
+    let unsigned = lower.trim_start_matches(['-', '+']);
+    if matches!(unsigned, ".inf") || lower == ".nan" {
+        return true;
+    }
+    let (mantissa, exponent) = match unsigned.split_once('e') {
+        Some((m, e)) => (m, Some(e)),
+        None => (unsigned, None),
+    };
+    let mantissa_ok = match mantissa.split_once('.') {
+        Some((whole, frac)) => {
+            (whole.is_empty() || is_int_body(whole))
+                && (frac.is_empty() || is_int_body(frac))
+                && !(whole.is_empty() && frac.is_empty())
+        }
+        None => is_int_body(mantissa),
+    };
+    let exponent_ok = exponent.is_none_or(|e| is_int_body(e.trim_start_matches(['-', '+'])));
+    mantissa_ok && exponent_ok && (mantissa.contains('.') || exponent.is_some())
+}
+
+/// YAML 1.2 core-schema resolution of a plain scalar.
+fn resolve_plain(raw: &str) -> Scalar {
+    match raw {
+        "" | "~" | "null" | "Null" | "NULL" => return Scalar::Null,
+        "true" | "True" | "TRUE" => return Scalar::Bool(true),
+        "false" | "False" | "FALSE" => return Scalar::Bool(false),
+        _ => {}
+    }
+    let (negative, unsigned) = match raw.as_bytes().first() {
+        Some(b'-') => (true, &raw[1..]),
+        Some(b'+') => (false, &raw[1..]),
+        _ => (false, raw),
+    };
+    if is_int_body(unsigned) {
+        return match unsigned.parse::<i128>() {
+            Ok(n) => Scalar::Int(if negative { -n } else { n }),
+            Err(_) => Scalar::Number,
+        };
+    }
+    if let Some(hex) = raw.strip_prefix("0x") {
+        if !hex.is_empty() && hex.bytes().all(|b| b.is_ascii_hexdigit()) {
+            return i128::from_str_radix(hex, 16).map_or(Scalar::Number, Scalar::Int);
+        }
+    }
+    if let Some(oct) = raw.strip_prefix("0o") {
+        if !oct.is_empty() && oct.bytes().all(|b| (b'0'..=b'7').contains(&b)) {
+            return i128::from_str_radix(oct, 8).map_or(Scalar::Number, Scalar::Int);
+        }
+    }
+    if is_float(raw) {
+        return Scalar::Number;
+    }
+    Scalar::Str(raw.to_string())
+}
+
+/// Resolve a scalar with its tag. `Err` is an explicit core tag the value
+/// does not fit (`!!int abc`).
+fn resolve_scalar(
+    raw: &str,
+    style: ScalarStyle,
+    tag: Option<&Tag>,
+) -> Result<(Scalar, bool), String> {
+    let core = tag.and_then(|t| t.core_suffix().map(str::to_string));
+    let custom = tag.is_some() && core.is_none();
+    let plain = style == ScalarStyle::Plain;
+    let value = match core.as_deref() {
+        Some("str") => Scalar::Str(raw.to_string()),
+        Some(kind @ ("int" | "bool" | "null" | "float")) => {
+            let resolved = resolve_plain(raw);
+            let fits = matches!(
+                (kind, &resolved),
+                ("int", Scalar::Int(_))
+                    | ("bool", Scalar::Bool(_))
+                    | ("null", Scalar::Null)
+                    | ("float", Scalar::Number | Scalar::Int(_))
+            );
+            if !fits {
+                return Err(format!("`{}` is not a valid !!{kind}", sanitize(raw)));
+            }
+            resolved
+        }
+        _ if plain && tag.is_none() => resolve_plain(raw),
+        _ => Scalar::Str(raw.to_string()),
+    };
+    Ok((value, custom))
+}
+
+enum Frame {
+    Seq(Node, Vec<Node>),
+    Map(Node, Vec<(Node, Node)>, Option<Node>, HashSet<String>),
+}
+
+fn key_identity(key: &Node) -> Option<String> {
+    match &key.kind {
+        Kind::Scalar { value, .. } => Some(format!("{value:?}")),
+        _ => None,
+    }
+}
+
+/// Parse `text` into one document's root node; `None` for an empty or
+/// comment-only stream.
+fn build_tree(text: &str) -> Result<Option<Node>, String> {
+    let mut options = Options::default();
+    options.emit_comments = false;
+    let parser = Parser::new_from_str_with_options(text, options);
+    let mut stack: Vec<Frame> = Vec::new();
+    let mut root: Option<Node> = None;
+    let mut documents = 0usize;
+
+    fn attach(stack: &mut [Frame], root: &mut Option<Node>, node: Node) -> Result<(), String> {
+        match stack.last_mut() {
+            None => {
+                *root = Some(node);
+                Ok(())
+            }
+            Some(Frame::Seq(_, items)) => {
+                items.push(node);
+                Ok(())
+            }
+            Some(Frame::Map(_, pairs, pending, seen)) => match pending.take() {
+                None => {
+                    *pending = Some(node);
+                    Ok(())
+                }
+                Some(key) => {
+                    if let Some(id) = key_identity(&key) {
+                        if !seen.insert(id) {
+                            let name = match &key.kind {
+                                Kind::Scalar { raw, .. } => sanitize(raw),
+                                _ => String::new(),
+                            };
+                            return Err(format!("duplicate key `{name}`"));
+                        }
+                    }
+                    pairs.push((key, node));
+                    Ok(())
+                }
+            },
+        }
+    }
+
+    for event in parser {
+        let (event, span) = event.map_err(|e| e.to_string())?;
+        let line = span.start.line();
+        let header = |anchor: usize, tag: Option<&Tag>| Node {
+            kind: Kind::Alias,
+            anchored: anchor != 0,
+            custom_tag: tag.is_some_and(|t| t.core_suffix().is_none()),
+        };
+        match event {
+            Event::StreamStart | Event::StreamEnd | Event::DocumentEnd | Event::Comment(..) => {}
+            Event::DocumentStart(..) => {
+                documents += 1;
+                if documents > 1 {
+                    return Err(format!("more than one YAML document (line {line})"));
+                }
+            }
+            Event::Alias(_) => {
+                let node = Node {
+                    kind: Kind::Alias,
+                    anchored: false,
+                    custom_tag: false,
+                };
+                attach(&mut stack, &mut root, node)?;
+            }
+            Event::Scalar(raw, style, anchor, tag) => {
+                let (value, custom_tag) = resolve_scalar(&raw, style, tag.as_deref())
+                    .map_err(|m| format!("{m} (line {line})"))?;
+                let node = Node {
+                    kind: Kind::Scalar {
+                        value,
+                        raw: raw.into_owned(),
+                        plain: style == ScalarStyle::Plain,
+                    },
+                    anchored: anchor != 0,
+                    custom_tag,
+                };
+                attach(&mut stack, &mut root, node)?;
+            }
+            Event::SequenceStart(_, anchor, tag) => {
+                if stack.len() >= MAX_DEPTH {
+                    return Err(format!(
+                        "nesting is deeper than {MAX_DEPTH} levels (line {line})"
+                    ));
+                }
+                stack.push(Frame::Seq(header(anchor, tag.as_deref()), Vec::new()));
+            }
+            Event::MappingStart(_, anchor, tag) => {
+                if stack.len() >= MAX_DEPTH {
+                    return Err(format!(
+                        "nesting is deeper than {MAX_DEPTH} levels (line {line})"
+                    ));
+                }
+                stack.push(Frame::Map(
+                    header(anchor, tag.as_deref()),
+                    Vec::new(),
+                    None,
+                    HashSet::new(),
+                ));
+            }
+            Event::SequenceEnd => {
+                let Some(Frame::Seq(mut node, items)) = stack.pop() else {
+                    return Err("unbalanced sequence".to_string());
+                };
+                node.kind = Kind::Seq(items);
+                attach(&mut stack, &mut root, node)?;
+            }
+            Event::MappingEnd => {
+                let Some(Frame::Map(mut node, pairs, _, _)) = stack.pop() else {
+                    return Err("unbalanced mapping".to_string());
+                };
+                node.kind = Kind::Map(pairs);
+                attach(&mut stack, &mut root, node)?;
+            }
+            _ => return Err(format!("unsupported YAML construct (line {line})")),
+        }
+    }
+    Ok(root)
+}
+
+/// The validated `patches` block. `None` list fields mean "absent".
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub(crate) struct PatchesBlock {
+    pub enabled: Option<bool>,
+    pub include_paths: Option<Vec<String>>,
+    pub ignore_paths: Vec<String>,
+    pub ecosystems: Option<Vec<String>>,
+    pub packages: Option<Vec<String>>,
+    pub ignore_packages: Vec<String>,
+    pub min_severity: Option<u8>,
+    pub max_new_patches: Option<u32>,
+}
+
+/// What one root file contributes.
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub(crate) struct ParsedFile {
+    /// Empty, comment-only or null document: the file counts as absent.
+    pub empty: bool,
+    pub patches: Option<PatchesBlock>,
+    pub project_ignore_paths: Vec<String>,
+}
+
+impl ParsedFile {
+    /// The parts two files must agree on when both exist.
+    pub(crate) fn same_policy(&self, other: &ParsedFile) -> bool {
+        self.patches == other.patches && self.project_ignore_paths == other.project_ignore_paths
+    }
+}
+
+/// Levenshtein distance, for did-you-mean hints.
+fn edit_distance(a: &str, b: &str) -> usize {
+    let b: Vec<char> = b.chars().collect();
+    let mut row: Vec<usize> = (0..=b.len()).collect();
+    for (i, ca) in a.chars().enumerate() {
+        let mut prev = row[0];
+        row[0] = i + 1;
+        for (j, cb) in b.iter().enumerate() {
+            let cur = row[j + 1];
+            row[j + 1] = if ca == *cb {
+                prev
+            } else {
+                1 + prev.min(cur).min(row[j])
+            };
+            prev = cur;
+        }
+    }
+    row[b.len()]
+}
+
+fn did_you_mean<'a>(input: &str, known: impl IntoIterator<Item = &'a str>) -> Option<&'a str> {
+    let lower = input.to_lowercase();
+    known
+        .into_iter()
+        .map(|k| (edit_distance(&lower, &k.to_lowercase()), k))
+        .filter(|(d, _)| *d <= 2)
+        .min_by_key(|(d, _)| *d)
+        .map(|(_, k)| k)
+}
+
+struct Ctx<'a> {
+    file: &'a str,
+}
+
+impl Ctx<'_> {
+    fn err(&self, key: impl Into<String>, message: impl Into<String>) -> PolicyError {
+        PolicyError::Invalid {
+            file: self.file.to_string(),
+            key: sanitize(&key.into()),
+            message: super::strip_unsafe(&message.into()),
+        }
+    }
+}
+
+/// Refuse anchors, aliases, merge keys and custom tags anywhere in `node`.
+fn check_plain_subtree(node: &Node, path: &str) -> Result<(), (String, String)> {
+    if node.anchored {
+        return Err((
+            path.to_string(),
+            "YAML anchors are not allowed here".to_string(),
+        ));
+    }
+    if node.custom_tag {
+        return Err((
+            path.to_string(),
+            "custom YAML tags are not allowed here".to_string(),
+        ));
+    }
+    match &node.kind {
+        Kind::Alias => Err((
+            path.to_string(),
+            "YAML aliases are not allowed here".to_string(),
+        )),
+        Kind::Scalar { .. } => Ok(()),
+        Kind::Seq(items) => {
+            for (i, item) in items.iter().enumerate() {
+                check_plain_subtree(item, &format!("{path}[{i}]"))?;
+            }
+            Ok(())
+        }
+        Kind::Map(pairs) => {
+            for (key, value) in pairs {
+                if key.is_merge_key() {
+                    return Err((
+                        path.to_string(),
+                        "YAML merge keys (`<<`) are not allowed here".to_string(),
+                    ));
+                }
+                let name = key.as_str().map(sanitize).unwrap_or_default();
+                let child = if path.is_empty() {
+                    name
+                } else {
+                    format!("{path}.{name}")
+                };
+                check_plain_subtree(key, &child)?;
+                check_plain_subtree(value, &child)?;
+            }
+            Ok(())
+        }
+    }
+}
+
+/// A list of strings, with the size limits every list key shares.
+fn string_list(node: &Node, key: &str) -> Result<Vec<String>, (String, String)> {
+    let Kind::Seq(items) = &node.kind else {
+        return Err((
+            key.to_string(),
+            format!("must be a list of strings, found {}", node.describe()),
+        ));
+    };
+    if items.len() > MAX_LIST_ENTRIES {
+        return Err((
+            key.to_string(),
+            format!("has more than {MAX_LIST_ENTRIES} entries"),
+        ));
+    }
+    let mut out = Vec::with_capacity(items.len());
+    for (i, item) in items.iter().enumerate() {
+        let path = format!("{key}[{i}]");
+        let Some(s) = item.as_str() else {
+            return Err((
+                path,
+                format!("must be a string, found {} (quote it)", item.describe()),
+            ));
+        };
+        if s.len() > MAX_PATTERN_BYTES {
+            return Err((path, format!("is longer than {MAX_PATTERN_BYTES} bytes")));
+        }
+        out.push(s.to_string());
+    }
+    Ok(out)
+}
+
+/// Compile a pattern list so a bad glob fails here, with its key path.
+fn check_patterns(patterns: &[String], key: &'static str) -> Result<(), (String, String)> {
+    PathMatcher::new(&[(key, patterns)])
+        .map(|_| ())
+        .map_err(|(_, pattern, message)| {
+            let index = patterns.iter().position(|p| *p == pattern);
+            let path = index.map_or_else(|| key.to_string(), |i| format!("{key}[{i}]"));
+            (path, format!("{message}: `{}`", sanitize(&pattern)))
+        })
+}
+
+/// Why a `--package`-grammar spec is invalid, if it is.
+pub(crate) fn package_spec_error(spec: &str) -> Option<&'static str> {
+    let spec = spec.trim();
+    if spec.is_empty() {
+        return Some("package spec is empty");
+    }
+    if let Some(rest) = spec.get(..4).filter(|p| p.eq_ignore_ascii_case("pkg:")).map(|_| &spec[4..]) {
+        let valid = rest.split_once('/').is_some_and(|(ty, name)| {
+            !ty.is_empty() && !name.trim_matches('/').is_empty() && !name.starts_with('@')
+        });
+        if !valid {
+            return Some("purl spec needs a type and a name (`pkg:npm/lodash`)");
+        }
+    }
+    None
+}
+
+fn project_ignore_paths(node: &Node) -> Result<Vec<String>, (String, String)> {
+    const KEY: &str = "projectIgnorePaths";
+    check_plain_subtree(node, KEY)?;
+    let list = match &node.kind {
+        Kind::Scalar {
+            value: Scalar::Null,
+            ..
+        } => Vec::new(),
+        Kind::Scalar {
+            value: Scalar::Str(s),
+            ..
+        } => vec![s.clone()],
+        _ => string_list(node, KEY)?,
+    };
+    if list.len() == 1 && list[0].len() > MAX_PATTERN_BYTES {
+        return Err((
+            KEY.to_string(),
+            format!("is longer than {MAX_PATTERN_BYTES} bytes"),
+        ));
+    }
+    check_patterns(&list, KEY)?;
+    Ok(list)
+}
+
+fn patches_block(node: &Node) -> Result<PatchesBlock, (String, String)> {
+    let mut block = PatchesBlock::default();
+    let pairs = match &node.kind {
+        Kind::Scalar {
+            value: Scalar::Null,
+            ..
+        } if !node.anchored && !node.custom_tag => return Ok(block),
+        Kind::Map(pairs) => pairs,
+        _ => {
+            check_plain_subtree(node, "patches")?;
+            return Err((
+                "patches".to_string(),
+                format!("must be a mapping, found {}", node.describe()),
+            ));
+        }
+    };
+    check_plain_subtree(node, "patches")?;
+    for (key, value) in pairs {
+        let Some(name) = key.as_str() else {
+            return Err((
+                "patches".to_string(),
+                format!("keys must be strings, found {}", key.describe()),
+            ));
+        };
+        let path = format!("patches.{}", sanitize(name));
+        if !PATCHES_KEYS.contains(&name) {
+            let hint = did_you_mean(name, PATCHES_KEYS)
+                .map(|k| format!(" (did you mean `{k}`?)"))
+                .unwrap_or_default();
+            return Err((
+                path,
+                format!(
+                    "unknown key{hint}; a newer socket-patch may support it: upgrade socket-patch or remove the key"
+                ),
+            ));
+        }
+        if matches!(
+            &value.kind,
+            Kind::Scalar {
+                value: Scalar::Null,
+                ..
+            }
+        ) {
+            return Err((
+                path,
+                "has no value; remove the key to use the default".to_string(),
+            ));
+        }
+        match name {
+            "enabled" => match &value.kind {
+                Kind::Scalar {
+                    value: Scalar::Bool(b),
+                    ..
+                } => block.enabled = Some(*b),
+                _ => {
+                    return Err((
+                        path,
+                        format!("must be true or false, found {}", value.describe()),
+                    ))
+                }
+            },
+            "includePaths" | "ignorePaths" => {
+                let list = string_list(value, &path)?;
+                let key: &'static str = if name == "includePaths" {
+                    "patches.includePaths"
+                } else {
+                    "patches.ignorePaths"
+                };
+                check_patterns(&list, key)?;
+                if name == "includePaths" {
+                    if list.is_empty() {
+                        return Err((path, "is empty and would match nothing; use `enabled: false` to pause patching".to_string()));
+                    }
+                    block.include_paths = Some(list);
+                } else {
+                    block.ignore_paths = list;
+                }
+            }
+            "ecosystems" => {
+                let list = string_list(value, &path)?;
+                if list.is_empty() {
+                    return Err((
+                        path,
+                        "is empty and would match nothing; use `enabled: false` to pause patching"
+                            .to_string(),
+                    ));
+                }
+                let known: Vec<&str> = Ecosystem::all().iter().map(|e| e.cli_name()).collect();
+                let mut out = Vec::with_capacity(list.len());
+                for (i, entry) in list.iter().enumerate() {
+                    let lower = entry.trim().to_lowercase();
+                    if !known.contains(&lower.as_str()) {
+                        let hint = did_you_mean(&lower, known.iter().copied())
+                            .map(|k| format!(" (did you mean `{k}`?)"))
+                            .unwrap_or_default();
+                        return Err((
+                            format!("{path}[{i}]"),
+                            format!(
+                                "unknown ecosystem `{}`{hint}; expected one of {}",
+                                sanitize(entry),
+                                known.join(", ")
+                            ),
+                        ));
+                    }
+                    out.push(lower);
+                }
+                block.ecosystems = Some(out);
+            }
+            "packages" | "ignorePackages" => {
+                let list = string_list(value, &path)?;
+                if name == "packages" && list.is_empty() {
+                    return Err((
+                        path,
+                        "is empty and would match nothing; use `enabled: false` to pause patching"
+                            .to_string(),
+                    ));
+                }
+                for (i, spec) in list.iter().enumerate() {
+                    if let Some(message) = package_spec_error(spec) {
+                        return Err((
+                            format!("{path}[{i}]"),
+                            format!("{message}: `{}`", sanitize(spec)),
+                        ));
+                    }
+                }
+                if name == "packages" {
+                    block.packages = Some(list);
+                } else {
+                    block.ignore_packages = list;
+                }
+            }
+            "minSeverity" => {
+                let Some(s) = value.as_str() else {
+                    return Err((
+                        path,
+                        format!("must be a string, found {}", value.describe()),
+                    ));
+                };
+                match parse_severity_name(s) {
+                    Some(order) => block.min_severity = Some(order),
+                    None => {
+                        return Err((
+                            path,
+                            format!("unknown severity `{}`; expected critical, high, medium, moderate or low", sanitize(s)),
+                        ))
+                    }
+                }
+            }
+            "maxNewPatches" => match &value.kind {
+                Kind::Scalar {
+                    value: Scalar::Int(n),
+                    ..
+                } if (0..=i128::from(u32::MAX)).contains(n) => {
+                    block.max_new_patches = Some(u32::try_from(*n).unwrap_or(u32::MAX));
+                }
+                _ => {
+                    return Err((
+                        path,
+                        format!(
+                            "must be an integer from 0 to {}, found {}",
+                            u32::MAX,
+                            value.describe()
+                        ),
+                    ))
+                }
+            },
+            _ => unreachable!("PATCHES_KEYS is exhaustive"),
+        }
+    }
+    Ok(block)
+}
+
+/// `critical|high|medium|moderate|low` (any case) to a severity order.
+pub(crate) fn parse_severity_name(s: &str) -> Option<u8> {
+    match s.trim().to_ascii_lowercase().as_str() {
+        name @ ("critical" | "high" | "medium" | "moderate" | "low") => {
+            Some(severity_order(Some(name)))
+        }
+        _ => None,
+    }
+}
+
+fn decode(ctx: &Ctx<'_>, bytes: &[u8]) -> Result<String, PolicyError> {
+    if bytes.starts_with(&[0xFE, 0xFF]) || bytes.starts_with(&[0xFF, 0xFE]) {
+        return Err(ctx.err("", "file is UTF-16; save it as UTF-8"));
+    }
+    let bytes = bytes.strip_prefix(&[0xEF, 0xBB, 0xBF]).unwrap_or(bytes);
+    if bytes.contains(&0) {
+        return Err(ctx.err("", "file contains NUL bytes; save it as UTF-8 text"));
+    }
+    String::from_utf8(bytes.to_vec()).map_err(|_| ctx.err("", "file is not valid UTF-8"))
+}
+
+/// Parse and validate one root policy file (4.4).
+pub(crate) fn parse_file(
+    file: &str,
+    bytes: &[u8],
+    warnings: &mut Vec<PolicyWarning>,
+) -> Result<ParsedFile, PolicyError> {
+    let ctx = Ctx { file };
+    let text = decode(&ctx, bytes)?;
+    let root = build_tree(&text).map_err(|m| ctx.err("", format!("invalid YAML: {m}")))?;
+    let Some(root) = root else {
+        return Ok(ParsedFile {
+            empty: true,
+            ..ParsedFile::default()
+        });
+    };
+    let pairs = match &root.kind {
+        Kind::Map(pairs) => pairs,
+        Kind::Scalar {
+            value: Scalar::Null,
+            ..
+        } => {
+            return Ok(ParsedFile {
+                empty: true,
+                ..ParsedFile::default()
+            })
+        }
+        _ => {
+            return Err(ctx.err(
+                "",
+                format!("the top level must be a mapping, found {}", root.describe()),
+            ));
+        }
+    };
+
+    let mut version: Option<&Node> = None;
+    let mut patches: Option<&Node> = None;
+    let mut ignore_paths: Option<&Node> = None;
+    for (key, value) in pairs {
+        // A merge key or an aliased key could carry a `patches` block that
+        // other YAML readers apply; refuse rather than read "no policy".
+        if key.is_merge_key() || matches!(key.kind, Kind::Alias) || key.anchored {
+            return Err(ctx.err(
+                "",
+                "top-level merge keys (`<<`) and aliased keys are not supported; write the keys out",
+            ));
+        }
+        let Some(name) = key.as_str() else { continue };
+        let lower = name.to_ascii_lowercase();
+        let near_patches = (lower.starts_with("pat") || lower.starts_with("pac"))
+            && edit_distance(&lower, "patches") <= 2;
+        if (lower == "patch" || lower == "patches" || near_patches) && name != "patches" {
+            return Err(ctx.err(
+                sanitize(name),
+                "looks like a misspelled `patches` block; the key must be exactly `patches`",
+            ));
+        }
+        match name {
+            "version" => version = Some(value),
+            "patches" => patches = Some(value),
+            "projectIgnorePaths" => ignore_paths = Some(value),
+            _ => {}
+        }
+    }
+
+    let Some(patches) = patches else {
+        let project_ignore_paths = match ignore_paths.map(project_ignore_paths) {
+            None => Vec::new(),
+            Some(Ok(list)) => list,
+            Some(Err((key, message))) => {
+                warnings.push(PolicyWarning {
+                    code: super::SOCKET_YML_IGNORED_VALUE,
+                    detail: super::strip_unsafe(&format!("{file}: {key} {message}; the key is ignored")),
+                });
+                Vec::new()
+            }
+        };
+        return Ok(ParsedFile {
+            empty: false,
+            patches: None,
+            project_ignore_paths,
+        });
+    };
+
+    let version_ok = version.is_some_and(|v| {
+        matches!(
+            &v.kind,
+            Kind::Scalar {
+                value: Scalar::Int(2),
+                ..
+            }
+        ) || matches!(&v.kind, Kind::Scalar { value: Scalar::Str(s), .. } if s == "2")
+    });
+    if !version_ok {
+        return Err(ctx.err("version", "a `patches` block requires `version: 2`"));
+    }
+    let project_ignore_paths = match ignore_paths {
+        None => Vec::new(),
+        Some(node) => project_ignore_paths(node).map_err(|(key, message)| ctx.err(key, message))?,
+    };
+    let block = patches_block(patches).map_err(|(key, message)| ctx.err(key, message))?;
+    Ok(ParsedFile {
+        empty: false,
+        patches: Some(block),
+        project_ignore_paths,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn parse(text: &str) -> Result<ParsedFile, PolicyError> {
+        let mut warnings = Vec::new();
+        parse_file("socket.yml", text.as_bytes(), &mut warnings)
+    }
+
+    fn parse_warn(text: &str) -> (ParsedFile, Vec<PolicyWarning>) {
+        let mut warnings = Vec::new();
+        let parsed = parse_file("socket.yml", text.as_bytes(), &mut warnings).expect("parses");
+        (parsed, warnings)
+    }
+
+    fn err_key(text: &str) -> (String, String) {
+        match parse(text) {
+            Err(PolicyError::Invalid { key, message, .. }) => (key, message),
+            other => panic!("expected an invalid-file error for {text:?}, got {other:?}"),
+        }
+    }
+
+    fn block(text: &str) -> PatchesBlock {
+        parse(text).expect("valid").patches.expect("patches block")
+    }
+
+    #[test]
+    fn every_key_parses() {
+        let b = block(
+            "version: 2\npatches:\n  enabled: false\n  includePaths: [\"/services/\"]\n  ignorePaths: [\"/legacy/\"]\n  ecosystems: [NPM, pypi]\n  packages: [\"pkg:npm/lodash\"]\n  ignorePackages: [\"pkg:npm/left-pad\", \"core\"]\n  minSeverity: High\n  maxNewPatches: 5\n",
+        );
+        assert_eq!(b.enabled, Some(false));
+        assert_eq!(b.include_paths, Some(vec!["/services/".to_string()]));
+        assert_eq!(b.ignore_paths, vec!["/legacy/".to_string()]);
+        assert_eq!(
+            b.ecosystems,
+            Some(vec!["npm".to_string(), "pypi".to_string()])
+        );
+        assert_eq!(b.packages, Some(vec!["pkg:npm/lodash".to_string()]));
+        assert_eq!(b.ignore_packages.len(), 2);
+        assert_eq!(b.min_severity, Some(1));
+        assert_eq!(b.max_new_patches, Some(5));
+    }
+
+    #[test]
+    fn defaults_when_absent() {
+        for text in [
+            "version: 2\npatches:\n",
+            "version: 2\npatches: {}\n",
+            "version: 2\npatches: null\n",
+        ] {
+            assert_eq!(block(text), PatchesBlock::default(), "{text:?}");
+        }
+        let parsed = parse("version: 2\n").unwrap();
+        assert!(parsed.patches.is_none());
+        assert!(!parsed.empty);
+    }
+
+    #[test]
+    fn empty_and_comment_only_files_are_absent() {
+        for text in ["", "\n\n", "# just a comment\n", "---\n", "~\n"] {
+            assert!(parse(text).unwrap().empty, "{text:?}");
+        }
+    }
+
+    #[test]
+    fn bom_and_crlf_are_fine() {
+        let mut bytes = vec![0xEF, 0xBB, 0xBF];
+        bytes.extend_from_slice(b"version: 2\r\npatches:\r\n  maxNewPatches: 3\r\n");
+        let parsed = parse_file("socket.yml", &bytes, &mut Vec::new()).unwrap();
+        assert_eq!(parsed.patches.unwrap().max_new_patches, Some(3));
+    }
+
+    #[test]
+    fn encoding_errors() {
+        for (bytes, expected) in [
+            (&b"\xFF\xFEv\0e\0r\0"[..], "UTF-16"),
+            (&b"\xFE\xFF\0v\0e"[..], "UTF-16"),
+            (&b"version: 2\0\n"[..], "NUL"),
+            (&b"version: \xC3\x28\n"[..], "not valid UTF-8"),
+        ] {
+            match parse_file("socket.yml", bytes, &mut Vec::new()) {
+                Err(PolicyError::Invalid { message, .. }) => {
+                    assert!(message.contains(expected), "{message}")
+                }
+                other => panic!("{bytes:?}: {other:?}"),
+            }
+        }
+    }
+
+    #[test]
+    fn checks_run_in_order() {
+        // YAML beats everything; the case variant beats the version gate;
+        // the version gate beats the keys.
+        assert_eq!(err_key("patches: {minSeverty: x}\n").0, "version");
+        assert!(err_key("Patches: {}\npatches: {minSeverty: x}\n").1.contains("misspelled"));
+        assert!(err_key("patches: {minSeverty: x\n").1.contains("invalid YAML"));
+    }
+
+    #[test]
+    fn top_level_typos_merge_keys_and_aliases_fail_closed() {
+        for text in [
+            "version: 2\npatchs: {enabled: false}\n",
+            "version: 2\npacthes: {}\n",
+            "version: 2\npatches_: {}\n",
+        ] {
+            assert!(err_key(text).1.contains("misspelled"), "{text:?}");
+        }
+        for text in [
+            "base: &b {patches: {enabled: false}}\n<<: *b\nversion: 2\n",
+            "k: &k patches\nversion: 2\n*k : {enabled: false}\n",
+        ] {
+            assert!(err_key(text).1.contains("merge keys"), "{text:?}");
+        }
+        // Unrelated scanner keys are fine.
+        assert!(parse(
+            "version: 2\ntriggerPaths: [a]\nissueRules: {x: true}\ngithubApp: {enabled: true}\n"
+        )
+        .is_ok());
+    }
+
+    #[test]
+    fn non_ascii_specs_and_escapes_never_panic_or_leak() {
+        for spec in ["abc\u{e9}", "ab\u{20ac}", "p\u{e9}g:npm/x", "\u{1F600}"] {
+            let text = format!("version: 2\npatches:\n  ignorePackages: [\"{spec}\"]\n");
+            assert!(parse(&text).is_ok(), "{spec:?}");
+        }
+        let text = "version: 2\npatches:\n  ignorePaths: [\"\\e]0;pwned\\a\\e[2J[x\u{202E}\"]\n";
+        let err = parse(text).unwrap_err();
+        let shown = err.to_string();
+        assert!(
+            !shown.chars().any(|c| c.is_control() || c == '\u{202E}'),
+            "{shown:?}"
+        );
+    }
+
+    #[test]
+    fn nesting_limit_boundary() {
+        // The top-level mapping is level 1: 31 nested lists reach 32 levels.
+        let at_limit = format!("a: {}{}\n", "[".repeat(31), "]".repeat(31));
+        assert!(parse(&at_limit).is_ok());
+        let over = format!("a: {}{}\n", "[".repeat(32), "]".repeat(32));
+        assert!(err_key(&over).1.contains("deeper than 32"));
+    }
+
+    #[test]
+    fn project_ignore_paths_string_without_patches_block() {
+        let parsed = parse("version: 2\nprojectIgnorePaths: \"examples/**\"\n").unwrap();
+        assert_eq!(parsed.project_ignore_paths, vec!["examples/**".to_string()]);
+    }
+
+    #[test]
+    fn yaml_errors() {
+        for text in [
+            "version: 2\npatches: [\n",
+            "a: 1\na: 2\n",
+            "version: 2\npatches:\n  enabled: true\n  enabled: false\n",
+            "- a\n- b\n",
+            "just a string\n",
+            "a: 1\n---\nb: 2\n",
+            "projectIgnorePaths:\n  - **\n",
+        ] {
+            let (key, message) = err_key(text);
+            assert_eq!(key, "", "{text:?}");
+            assert!(
+                [
+                    "invalid YAML",
+                    "top level must be a mapping",
+                ]
+                .iter()
+                .any(|m| message.contains(m)),
+                "{text:?}: {message}"
+            );
+        }
+    }
+
+    #[test]
+    fn nesting_limit() {
+        let deep = format!("a: {}{}\n", "[".repeat(40), "]".repeat(40));
+        let (key, message) = err_key(&deep);
+        assert_eq!(key, "");
+        assert!(message.contains("deeper than 32"), "{message}");
+        let ok = format!("a: {}{}\n", "[".repeat(30), "]".repeat(30));
+        assert!(parse(&ok).is_ok());
+    }
+
+    #[test]
+    fn alias_bomb_elsewhere_is_never_expanded() {
+        let mut text = String::from(
+            "a: &a [\"lol\",\"lol\",\"lol\",\"lol\",\"lol\",\"lol\",\"lol\",\"lol\",\"lol\"]\n",
+        );
+        let names = ["b", "c", "d", "e", "f", "g", "h", "i", "j"];
+        let mut prev = "a";
+        for name in names {
+            text.push_str(&format!("{name}: &{name} [*{prev},*{prev},*{prev},*{prev},*{prev},*{prev},*{prev},*{prev},*{prev}]\n"));
+            prev = name;
+        }
+        text.push_str("version: 2\npatches:\n  maxNewPatches: 1\n");
+        let started = std::time::Instant::now();
+        assert_eq!(block(&text).max_new_patches, Some(1));
+        assert!(started.elapsed() < std::time::Duration::from_secs(2));
+    }
+
+    #[test]
+    fn anchors_aliases_and_merge_keys_are_refused_in_our_keys() {
+        for text in [
+            "version: 2\nx: &x [\"/a/\"]\npatches:\n  ignorePaths: *x\n",
+            "version: 2\npatches:\n  ignorePaths: &y [\"/a/\"]\n",
+            "version: 2\nbase: &b {maxNewPatches: 1}\npatches:\n  <<: *b\n",
+            "version: 2\npatches:\n  <<: {maxNewPatches: 1}\n",
+            "version: 2\nx: &x \"/a/\"\npatches: {}\nprojectIgnorePaths: [*x]\n",
+            "version: 2\npatches: &p {}\n",
+            "version: 2\npatches:\n  minSeverity: !custom high\n",
+        ] {
+            let (_, message) = err_key(text);
+            assert!(message.contains("not allowed"), "{text:?}: {message}");
+        }
+        // Outside the keys we read, anchors and aliases are someone else's business.
+        let ok = "version: 2\nissueRules: &r {a: 1}\nother: *r\npatches:\n  maxNewPatches: 2\n";
+        assert_eq!(block(ok).max_new_patches, Some(2));
+    }
+
+    #[test]
+    fn case_variant_of_patches_is_an_error() {
+        for text in [
+            "version: 2\nPatches: {}\n",
+            "version: 2\npatch:\n  enabled: false\n",
+            "PATCHES: {}\n",
+        ] {
+            let (_, message) = err_key(text);
+            assert!(message.contains("misspelled"), "{text:?}: {message}");
+        }
+    }
+
+    #[test]
+    fn version_gate() {
+        for text in [
+            "patches: {}\n",
+            "version: 1\npatches: {}\n",
+            "version: 3\npatches: {}\n",
+            "version: 2.0\npatches: {}\n",
+        ] {
+            assert_eq!(err_key(text).0, "version", "{text:?}");
+        }
+        assert!(parse("version: \"2\"\npatches: {}\n").is_ok());
+        // No patches block: any version, projectIgnorePaths honored.
+        let parsed = parse("version: 1\nprojectIgnorePaths: [\"/a/\"]\n").unwrap();
+        assert_eq!(parsed.project_ignore_paths, vec!["/a/".to_string()]);
+    }
+
+    #[test]
+    fn unknown_keys_with_hint() {
+        let (key, message) = err_key("version: 2\npatches:\n  minSeverty: high\n");
+        assert_eq!(key, "patches.minSeverty");
+        assert!(message.contains("did you mean `minSeverity`"), "{message}");
+        assert!(message.contains("newer socket-patch"), "{message}");
+        let (_, message) = err_key("version: 2\npatches:\n  apiToken: x\n");
+        assert!(!message.contains("did you mean"), "{message}");
+        let (key, message) = err_key("version: 2\npatches:\n  maxnewpatches: 1\n");
+        assert_eq!(key, "patches.maxnewpatches");
+        assert!(
+            message.contains("did you mean `maxNewPatches`"),
+            "{message}"
+        );
+    }
+
+    #[test]
+    fn trust_boundary_keys_are_unknown() {
+        for key in [
+            "apiUrl",
+            "apiToken",
+            "org",
+            "mode",
+            "downloadMode",
+            "patchServerUrl",
+            "noVerify",
+            "strict",
+        ] {
+            let text = format!("version: 2\npatches:\n  {key}: x\n");
+            assert_eq!(err_key(&text).0, format!("patches.{key}"));
+        }
+    }
+
+    #[test]
+    fn wrong_types() {
+        let cases = [
+            ("enabled: \"false\"", "patches.enabled"),
+            ("enabled: no", "patches.enabled"),
+            ("enabled: 1", "patches.enabled"),
+            ("enabled:", "patches.enabled"),
+            ("includePaths: \"/a/\"", "patches.includePaths"),
+            ("includePaths: [1]", "patches.includePaths[0]"),
+            ("includePaths: []", "patches.includePaths"),
+            ("ecosystems: []", "patches.ecosystems"),
+            ("ecosystems: [npn]", "patches.ecosystems[0]"),
+            ("packages: []", "patches.packages"),
+            ("packages: [\"pkg:\"]", "patches.packages[0]"),
+            (
+                "ignorePackages: [\"pkg:npm/\"]",
+                "patches.ignorePackages[0]",
+            ),
+            ("ignorePackages: [\"  \"]", "patches.ignorePackages[0]"),
+            ("minSeverity: severe", "patches.minSeverity"),
+            ("minSeverity: none", "patches.minSeverity"),
+            ("minSeverity: 1", "patches.minSeverity"),
+            ("maxNewPatches: -1", "patches.maxNewPatches"),
+            ("maxNewPatches: 4294967296", "patches.maxNewPatches"),
+            ("maxNewPatches: 1.5", "patches.maxNewPatches"),
+            ("maxNewPatches: \"5\"", "patches.maxNewPatches"),
+            ("ignorePaths: [\"../x\"]", "patches.ignorePaths[0]"),
+            ("ignorePaths: [\"C:/x\"]", "patches.ignorePaths[0]"),
+            ("ignorePaths: [\"a/[b\"]", "patches.ignorePaths[0]"),
+            ("ignorePaths: {a: 1}", "patches.ignorePaths"),
+        ];
+        for (line, key) in cases {
+            let text = format!("version: 2\npatches:\n  {line}\n");
+            assert_eq!(err_key(&text).0, key, "{line}");
+        }
+        assert!(parse("version: 2\npatches: [a]\n").is_err());
+        assert!(parse("version: 2\npatches: true\n").is_err());
+    }
+
+    #[test]
+    fn size_limits_on_lists() {
+        let many: Vec<String> = (0..1001).map(|i| format!("\"/a{i}/\"")).collect();
+        let text = format!(
+            "version: 2\npatches:\n  ignorePaths: [{}]\n",
+            many.join(",")
+        );
+        assert_eq!(err_key(&text).0, "patches.ignorePaths");
+        let long = "a".repeat(1025);
+        let text = format!("version: 2\npatches:\n  ignorePackages: [\"{long}\"]\n");
+        assert_eq!(err_key(&text).0, "patches.ignorePackages[0]");
+    }
+
+    #[test]
+    fn integer_forms_and_boundaries() {
+        assert_eq!(
+            block("version: 2\npatches:\n  maxNewPatches: 0\n").max_new_patches,
+            Some(0)
+        );
+        assert_eq!(
+            block("version: 2\npatches:\n  maxNewPatches: 4294967295\n").max_new_patches,
+            Some(u32::MAX)
+        );
+        assert_eq!(
+            block("version: 2\npatches:\n  maxNewPatches: 0x10\n").max_new_patches,
+            Some(16)
+        );
+        assert_eq!(
+            block("version: 2\npatches:\n  maxNewPatches: !!int \"7\"\n").max_new_patches,
+            Some(7)
+        );
+        assert!(parse("version: 2\npatches:\n  maxNewPatches: !!int seven\n").is_err());
+    }
+
+    #[test]
+    fn moderate_is_medium() {
+        assert_eq!(
+            block("version: 2\npatches:\n  minSeverity: moderate\n").min_severity,
+            Some(2)
+        );
+        assert_eq!(
+            block("version: 2\npatches:\n  minSeverity: medium\n").min_severity,
+            Some(2)
+        );
+    }
+
+    #[test]
+    fn project_ignore_paths_rules() {
+        // Strict with a patches block.
+        let parsed = parse("version: 2\nprojectIgnorePaths: \"/a/\"\npatches: {}\n").unwrap();
+        assert_eq!(parsed.project_ignore_paths, vec!["/a/".to_string()]);
+        assert_eq!(
+            err_key("version: 2\nprojectIgnorePaths: 5\npatches: {}\n").0,
+            "projectIgnorePaths"
+        );
+        assert_eq!(
+            err_key("version: 2\nprojectIgnorePaths: [\"../x\"]\npatches: {}\n").0,
+            "projectIgnorePaths[0]"
+        );
+        // Lenient without one: warning, key ignored.
+        let (parsed, warnings) = parse_warn("version: 2\nprojectIgnorePaths: {a: 1}\n");
+        assert!(parsed.project_ignore_paths.is_empty());
+        assert_eq!(warnings.len(), 1);
+        assert_eq!(warnings[0].code, "socket_yml_ignored_value");
+        let (parsed, warnings) = parse_warn("projectIgnorePaths: [\"/a/\", \"b/\"]\n");
+        assert_eq!(parsed.project_ignore_paths.len(), 2);
+        assert!(warnings.is_empty());
+    }
+
+    #[test]
+    fn yaml12_scalars() {
+        assert_eq!(resolve_plain("no"), Scalar::Str("no".to_string()));
+        assert_eq!(resolve_plain("yes"), Scalar::Str("yes".to_string()));
+        assert_eq!(resolve_plain("True"), Scalar::Bool(true));
+        assert_eq!(resolve_plain("~"), Scalar::Null);
+        assert_eq!(resolve_plain("-12"), Scalar::Int(-12));
+        assert_eq!(resolve_plain("0o17"), Scalar::Int(15));
+        assert_eq!(resolve_plain("1e3"), Scalar::Number);
+        assert_eq!(resolve_plain(".5"), Scalar::Number);
+        assert_eq!(resolve_plain("1.2.3"), Scalar::Str("1.2.3".to_string()));
+        assert_eq!(resolve_plain("0x"), Scalar::Str("0x".to_string()));
+    }
+
+    #[test]
+    fn same_policy_compares_parsed_values() {
+        let a = parse("version: 2\npatches: {maxNewPatches: 1}\n").unwrap();
+        let b = parse(
+            "# other comments\nversion: \"2\"\npatches:\n  maxNewPatches: 0x1\nissueRules: {}\n",
+        )
+        .unwrap();
+        assert!(a.same_policy(&b));
+        let c = parse("version: 2\npatches: {maxNewPatches: 2}\n").unwrap();
+        assert!(!a.same_policy(&c));
+        let d = parse("version: 2\nprojectIgnorePaths: [\"/b/\", \"/a/\"]\n").unwrap();
+        let e = parse("version: 2\nprojectIgnorePaths: [\"/a/\", \"/b/\"]\n").unwrap();
+        assert!(!d.same_policy(&e), "order-sensitive");
+    }
+
+    #[test]
+    fn package_specs() {
+        for good in [
+            "lodash",
+            "@babel/core",
+            "pkg:npm/lodash",
+            "pkg:npm/lodash@4.17.21",
+            "pkg:pypi/requests",
+            "PKG:npm/x",
+        ] {
+            assert!(package_spec_error(good).is_none(), "{good}");
+        }
+        for bad in [
+            "",
+            " ",
+            "pkg:",
+            "pkg:npm",
+            "pkg:npm/",
+            "pkg:/lodash",
+            "pkg:npm/@1.0.0",
+        ] {
+            assert!(package_spec_error(bad).is_some(), "{bad:?}");
+        }
+    }
+
+    #[test]
+    fn did_you_mean_distance() {
+        assert_eq!(
+            did_you_mean("ignorePath", PATCHES_KEYS),
+            Some("ignorePaths")
+        );
+        assert_eq!(did_you_mean("zzzzzz", PATCHES_KEYS), None);
+    }
+}
diff --git a/crates/socket-patch-core/src/policy/tests.rs b/crates/socket-patch-core/src/policy/tests.rs
new file mode 100644
index 00000000..fd824749
--- /dev/null
+++ b/crates/socket-patch-core/src/policy/tests.rs
@@ -0,0 +1,594 @@
+use super::*;
+
+fn mem(files: &[(&str, &str)]) -> MemoryPolicyFs {
+    let mut fs = MemoryPolicyFs::default();
+    for (name, text) in files {
+        fs.files.insert(
+            name.to_string(),
+            RootFile::Present(text.as_bytes().to_vec()),
+        );
+        fs.root_names.push(name.to_string());
+    }
+    fs
+}
+
+fn load(files: &[(&str, &str)]) -> SelectionPolicy {
+    SelectionPolicy::load(&mem(files), &PolicyOverrides::default())
+        .expect("valid policy")
+        .0
+}
+
+fn strings(v: &[&str]) -> Vec<String> {
+    v.iter().map(|s| s.to_string()).collect()
+}
+
+fn root<'a>(rel_dir: &'a str, markers: &'a [String], explicit: bool) -> Root<'a> {
+    Root {
+        rel_dir,
+        markers,
+        explicit,
+    }
+}
+
+#[test]
+fn no_file_is_unrestricted_with_default_ignores() {
+    let (policy, warnings) =
+        SelectionPolicy::load(&MemoryPolicyFs::default(), &PolicyOverrides::default()).unwrap();
+    assert_eq!(policy.source(), &PolicySource::None);
+    assert!(warnings.is_empty());
+    assert!(policy.enabled());
+    assert_eq!(policy.max_new_patches(), None);
+    let lock = strings(&["package-lock.json"]);
+    assert!(policy.admits_root(&root("", &lock, false)).is_ok());
+    let err = policy
+        .admits_root(&root("packages/a/test", &lock, false))
+        .unwrap_err();
+    assert_eq!(err.code(), "policy_path_excluded");
+    assert_eq!(err.detail(), "test/ (built-in default)");
+    // Case-insensitive defaults, unlike the old hard-coded segment list.
+    assert!(policy
+        .admits_root(&root("Tests/app", &lock, false))
+        .is_err());
+    // Explicit roots never see the defaults.
+    assert!(policy
+        .admits_root(&root("packages/a/test", &lock, true))
+        .is_ok());
+}
+
+#[test]
+fn empty_file_is_source_none() {
+    let policy = load(&[("socket.yml", "# nothing\n")]);
+    assert_eq!(policy.source(), &PolicySource::None);
+}
+
+#[test]
+fn file_source_carries_path_and_hash() {
+    let text = "version: 2\npatches:\n  maxNewPatches: 3\n";
+    let policy = load(&[("socket.yml", text)]);
+    match policy.source() {
+        PolicySource::File { path, sha256 } => {
+            assert_eq!(path, "socket.yml");
+            assert_eq!(sha256, &hex::encode(Sha256::digest(text.as_bytes())));
+        }
+        other => panic!("{other:?}"),
+    }
+    assert_eq!(policy.max_new_patches(), Some(3));
+    let yaml = load(&[("socket.yaml", text)]);
+    assert!(matches!(yaml.source(), PolicySource::File { path, .. } if path == "socket.yaml"));
+}
+
+#[test]
+fn bypass_ignores_the_file_but_keeps_defaults_and_flag_floor() {
+    let overrides = PolicyOverrides {
+        bypass: true,
+        min_severity: Some((Some(1), OverrideSource::Flag)),
+    };
+    let fs = mem(&[(
+        "socket.yml",
+        "version: 2\npatches:\n  enabled: false\n  maxNewPatches: 1\n",
+    )]);
+    let (policy, _) = SelectionPolicy::load(&fs, &overrides).unwrap();
+    assert_eq!(policy.source(), &PolicySource::Bypassed);
+    assert!(policy.enabled());
+    assert_eq!(policy.max_new_patches(), None);
+    assert_eq!(policy.min_severity(), (Some(1), SeveritySource::Flag));
+    let lock = strings(&["yarn.lock"]);
+    assert!(policy
+        .admits_root(&root("fixtures/x", &lock, false))
+        .is_err());
+    // An invalid file is not even read when bypassed.
+    let broken = mem(&[("socket.yml", "version: 2\npatches: [\n")]);
+    assert!(SelectionPolicy::load(&broken, &overrides).is_ok());
+}
+
+#[test]
+fn severity_precedence_flag_env_file_default() {
+    let fs = mem(&[("socket.yml", "version: 2\npatches:\n  minSeverity: high\n")]);
+    let (p, _) = SelectionPolicy::load(&fs, &PolicyOverrides::default()).unwrap();
+    assert_eq!(p.min_severity(), (Some(1), SeveritySource::File));
+    let env = PolicyOverrides {
+        bypass: false,
+        min_severity: Some((Some(0), OverrideSource::Env)),
+    };
+    assert_eq!(
+        SelectionPolicy::load(&fs, &env).unwrap().0.min_severity(),
+        (Some(0), SeveritySource::Env)
+    );
+    let none = PolicyOverrides {
+        bypass: false,
+        min_severity: Some((None, OverrideSource::Flag)),
+    };
+    assert_eq!(
+        SelectionPolicy::load(&fs, &none).unwrap().0.min_severity(),
+        (None, SeveritySource::Flag)
+    );
+    assert_eq!(
+        SelectionPolicy::unrestricted().min_severity(),
+        (None, SeveritySource::Default)
+    );
+}
+
+#[test]
+fn severity_floor_filters_unknown_and_below() {
+    let policy = load(&[(
+        "socket.yml",
+        "version: 2\npatches:\n  minSeverity: moderate\n",
+    )]);
+    assert!(policy.admits_severity(0).is_ok());
+    assert!(policy.admits_severity(2).is_ok());
+    let low = policy.admits_severity(3).unwrap_err();
+    assert_eq!(low.code(), "policy_severity");
+    assert_eq!(low.detail(), "low < medium");
+    assert_eq!(
+        policy.admits_severity(4).unwrap_err().detail(),
+        "unknown < medium"
+    );
+    let lowest = load(&[("socket.yml", "version: 2\npatches:\n  minSeverity: low\n")]);
+    assert!(lowest.admits_severity(3).is_ok());
+    assert!(
+        lowest.admits_severity(4).is_err(),
+        "low still drops unknown severity"
+    );
+    assert!(SelectionPolicy::unrestricted().admits_severity(4).is_ok());
+}
+
+#[test]
+fn floor_filter_uses_max_advisory_severity() {
+    use crate::api::types::VulnerabilityResponse;
+    use std::collections::HashMap;
+    let patch = |uuid: &str, severities: &[&str]| PatchSearchResult {
+        uuid: uuid.to_string(),
+        purl: "pkg:npm/a@1.0.0".to_string(),
+        published_at: String::new(),
+        description: String::new(),
+        license: String::new(),
+        tier: "free".to_string(),
+        vulnerabilities: severities
+            .iter()
+            .enumerate()
+            .map(|(i, s)| {
+                (
+                    format!("GHSA-{i}"),
+                    VulnerabilityResponse {
+                        cves: vec![],
+                        summary: String::new(),
+                        severity: s.to_string(),
+                        description: String::new(),
+                    },
+                )
+            })
+            .collect::<HashMap<_, _>>(),
+    };
+    let policy = load(&[("socket.yml", "version: 2\npatches:\n  minSeverity: high\n")]);
+    let (kept, dropped) = policy.floor_filter(vec![
+        patch("merged", &["LOW", "CRITICAL"]),
+        patch("low", &["LOW"]),
+        patch("none", &[]),
+    ]);
+    assert_eq!(
+        kept.iter().map(|p| p.uuid.as_str()).collect::<Vec<_>>(),
+        ["merged"]
+    );
+    assert_eq!(dropped.len(), 2);
+}
+
+#[test]
+fn both_files_equal_different_and_one_invalid() {
+    let a = "version: 2\npatches:\n  maxNewPatches: 2\n";
+    let same = "# different bytes, same policy\nversion: \"2\"\npatches: {maxNewPatches: 2}\n";
+    let policy = load(&[("socket.yml", a), ("socket.yaml", same)]);
+    assert!(matches!(policy.source(), PolicySource::File { path, .. } if path == "socket.yml"));
+
+    let other = "version: 2\npatches:\n  maxNewPatches: 3\n";
+    let err = SelectionPolicy::load(
+        &mem(&[("socket.yml", a), ("socket.yaml", other)]),
+        &PolicyOverrides::default(),
+    )
+    .unwrap_err();
+    assert_eq!(err.code(), "socket_yml_ambiguous");
+
+    let broken = "version: 2\npatches: [\n";
+    let err = SelectionPolicy::load(
+        &mem(&[("socket.yml", a), ("socket.yaml", broken)]),
+        &PolicyOverrides::default(),
+    )
+    .unwrap_err();
+    assert_eq!(err.code(), "socket_yml_invalid");
+    assert!(err.detail().starts_with("socket.yaml:"), "{}", err.detail());
+}
+
+#[test]
+fn present_without_content_is_invalid_not_absent() {
+    let mut fs = MemoryPolicyFs::default();
+    fs.files
+        .insert("socket.yml".to_string(), RootFile::PresentWithoutContent);
+    let err = SelectionPolicy::load(&fs, &PolicyOverrides::default()).unwrap_err();
+    assert_eq!(err.code(), "socket_yml_invalid");
+}
+
+#[test]
+fn oversize_memory_file_is_invalid() {
+    let mut fs = MemoryPolicyFs::default();
+    fs.files.insert(
+        "socket.yml".to_string(),
+        RootFile::Present(vec![b' '; MAX_FILE_BYTES + 1]),
+    );
+    assert!(SelectionPolicy::load(&fs, &PolicyOverrides::default()).is_err());
+}
+
+#[test]
+fn case_variant_is_not_read_and_warns() {
+    let mut fs = mem(&[]);
+    fs.root_names.push("Socket.yml".to_string());
+    let (policy, warnings) = SelectionPolicy::load(&fs, &PolicyOverrides::default()).unwrap();
+    assert_eq!(policy.source(), &PolicySource::None);
+    assert_eq!(warnings[0].code, "socket_yml_name_case");
+}
+
+#[test]
+fn error_display_names_file_key_and_remedy() {
+    let err = SelectionPolicy::load(
+        &mem(&[(
+            "socket.yml",
+            "version: 2\npatches:\n  minSeverity: severe\n",
+        )]),
+        &PolicyOverrides::default(),
+    )
+    .unwrap_err();
+    let text = err.to_string();
+    assert!(
+        text.starts_with("socket.yml: patches.minSeverity: unknown severity `severe`"),
+        "{text}"
+    );
+    assert!(text.contains("--no-socket-yml"), "{text}");
+}
+
+#[test]
+fn marker_rule_all_ignored_or_any_included() {
+    let policy = load(&[(
+        "socket.yml",
+        "version: 2\npatches:\n  ignorePaths: [\"**/yarn.lock\"]\n  includePaths: [\"/services/payments/\"]\n",
+    )]);
+    let both = strings(&["package.json", "yarn.lock"]);
+    let yarn = strings(&["yarn.lock"]);
+    // Not every marker ignored: the root stays.
+    assert!(policy
+        .admits_root(&root("services/payments", &both, false))
+        .is_ok());
+    assert_eq!(
+        policy
+            .admits_root(&root("services/payments", &yarn, false))
+            .unwrap_err()
+            .code(),
+        "policy_path_excluded"
+    );
+    assert_eq!(
+        policy
+            .admits_root(&root("services/api", &both, false))
+            .unwrap_err(),
+        FilterReason::PathNotIncluded
+    );
+    // The repo-root project alone: `/*` plus `!/*/`.
+    let only_root = load(&[(
+        "socket.yml",
+        "version: 2\npatches:\n  includePaths: [\"/*\", \"!/*/\"]\n",
+    )]);
+    let lock = strings(&["package-lock.json"]);
+    assert!(only_root.admits_root(&root("", &lock, true)).is_ok());
+    assert!(only_root.admits_root(&root("a", &lock, false)).is_err());
+}
+
+#[test]
+fn deny_wins_over_include() {
+    let policy = load(&[(
+        "socket.yml",
+        "version: 2\npatches:\n  includePaths: [\"/services/\"]\n  ignorePaths: [\"/services/legacy/\"]\n",
+    )]);
+    let lock = strings(&["package-lock.json"]);
+    let err = policy
+        .admits_root(&root("services/legacy", &lock, true))
+        .unwrap_err();
+    assert_eq!(err.detail(), "/services/legacy/ (patches.ignorePaths)");
+}
+
+#[test]
+fn defaults_negation_and_project_ignore_paths() {
+    let policy = load(&[(
+        "socket.yml",
+        "version: 2\nprojectIgnorePaths: [\"examples/**\"]\npatches:\n  ignorePaths: [\"!/e2e/tests/\"]\n",
+    )]);
+    let lock = strings(&["package-lock.json"]);
+    assert!(policy.admits_root(&root("e2e/tests", &lock, false)).is_ok());
+    assert!(policy
+        .admits_root(&root("other/tests", &lock, false))
+        .is_err());
+    let err = policy
+        .admits_root(&root("examples/demo", &lock, true))
+        .unwrap_err();
+    assert_eq!(err.detail(), "examples/** (projectIgnorePaths)");
+    // An unrelated ignore never re-enables fixtures.
+    let unrelated = load(&[(
+        "socket.yml",
+        "version: 2\npatches:\n  ignorePaths: [\"/legacy/\"]\n",
+    )]);
+    assert!(unrelated
+        .admits_root(&root("a/fixtures", &lock, false))
+        .is_err());
+    // projectIgnorePaths without a patches block is honored too.
+    let scanner_only = load(&[(
+        "socket.yml",
+        "version: 2\nprojectIgnorePaths:\n  - \"crates/*/tests/fixtures/**\"\n",
+    )]);
+    let cargo = strings(&["Cargo.lock"]);
+    assert!(scanner_only
+        .admits_root(&root("crates/x/tests/fixtures/app", &cargo, true))
+        .is_err());
+}
+
+#[test]
+fn ecosystems_and_packages() {
+    let policy = load(&[(
+        "socket.yml",
+        "version: 2\npatches:\n  ecosystems: [npm, deno]\n  packages: [\"pkg:npm/lodash\", \"left-pad\", \"@std/path\"]\n  ignorePackages: [\"pkg:npm/left-pad@1.0.0\"]\n",
+    )]);
+    assert!(policy.admits_purl("pkg:npm/lodash@4.17.20").is_ok());
+    assert!(policy.admits_purl("pkg:jsr/@std/path@1.0.0").is_ok());
+    assert_eq!(
+        policy.admits_purl("pkg:pypi/requests@2.0.0").unwrap_err(),
+        FilterReason::Ecosystem
+    );
+    assert_eq!(
+        policy.admits_purl("pkg:npm/qs@6.5.2").unwrap_err(),
+        FilterReason::PackageNotListed
+    );
+    let err = policy.admits_purl("pkg:npm/left-pad@1.0.0").unwrap_err();
+    assert_eq!(err.code(), "policy_package_ignored");
+    assert_eq!(
+        err.detail(),
+        "pkg:npm/left-pad@1.0.0 (patches.ignorePackages)"
+    );
+    assert!(policy.admits_purl("pkg:npm/left-pad@1.1.0").is_ok());
+    assert_eq!(
+        policy.admits_purl("pkg:unknown/x@1").unwrap_err(),
+        FilterReason::Ecosystem
+    );
+}
+
+#[test]
+fn package_spec_matching_grammar() {
+    assert!(package_spec_matches("lodash", "pkg:npm/lodash@4.17.20"));
+    assert!(package_spec_matches("core", "pkg:npm/%40babel/core@7.0.0"));
+    assert!(package_spec_matches(
+        "@babel/core",
+        "pkg:npm/@babel/core@7.0.0"
+    ));
+    assert!(package_spec_matches(
+        "Requests",
+        "pkg:pypi/requests@2.0.0?artifact_id=x"
+    ));
+    assert!(package_spec_matches(
+        "pkg:npm/lodash",
+        "pkg:npm/lodash@1.0.0"
+    ));
+    assert!(!package_spec_matches(
+        "pkg:npm/lodash",
+        "pkg:npm/lodash-es@1.0.0"
+    ));
+    assert!(!package_spec_matches(
+        "pkg:npm/lodash@1.0.1",
+        "pkg:npm/lodash@1.0.0"
+    ));
+    assert!(!package_spec_matches("", "pkg:npm/lodash@1.0.0"));
+    assert!(!package_spec_matches("pkg:", "pkg:npm/lodash@1.0.0"));
+    assert!(package_spec_matches(
+        "org.example:lib",
+        "pkg:maven/org.example/lib@1.0"
+    ));
+}
+
+#[test]
+fn enabled_false_is_reported_by_callers() {
+    let policy = load(&[("socket.yml", "version: 2\npatches:\n  enabled: false\n")]);
+    assert!(!policy.enabled());
+    assert_eq!(FilterReason::Disabled.code(), "policy_disabled");
+}
+
+#[test]
+fn min_severity_flag_values() {
+    assert_eq!(parse_min_severity("none"), Ok(None));
+    assert_eq!(parse_min_severity("NONE"), Ok(None));
+    assert_eq!(parse_min_severity("Critical"), Ok(Some(0)));
+    assert_eq!(parse_min_severity("moderate"), Ok(Some(2)));
+    assert!(parse_min_severity("severe").is_err());
+    assert!(parse_min_severity("").is_err());
+}
+
+#[test]
+fn sanitize_strips_controls_and_truncates() {
+    assert_eq!(sanitize("a\u{1b}[31mb\nc"), "a[31mbc");
+    assert_eq!(sanitize(&"x".repeat(500)).chars().count(), 200);
+}
+
+#[test]
+fn repo_relative_paths() {
+    let root = Path::new("/r");
+    assert_eq!(repo_relative(root, Path::new("/r")), "");
+    assert_eq!(repo_relative(root, Path::new("/r/a/b")), "a/b");
+    assert_eq!(repo_relative_checked(root, Path::new("/other")), None);
+}
+
+mod disk {
+    use super::*;
+    use std::fs;
+
+    fn read(dir: &Path, name: &str) -> std::io::Result<RootFile> {
+        DiskPolicyFs::new(dir).read_root_file(name, MAX_FILE_BYTES)
+    }
+
+    #[test]
+    fn regular_file_absent_and_case_variant() {
+        let tmp = tempfile::tempdir().unwrap();
+        assert_eq!(read(tmp.path(), "socket.yml").unwrap(), RootFile::Absent);
+        fs::write(tmp.path().join("Socket.yml"), "version: 2\n").unwrap();
+        // Even on case-insensitive disks the exact name must be listed.
+        assert_eq!(read(tmp.path(), "socket.yml").unwrap(), RootFile::Absent);
+        assert_eq!(
+            DiskPolicyFs::new(tmp.path()).case_variants(),
+            vec!["Socket.yml".to_string()]
+        );
+        fs::write(tmp.path().join("socket.yaml"), "version: 2\n").unwrap();
+        assert_eq!(
+            read(tmp.path(), "socket.yaml").unwrap(),
+            RootFile::Present(b"version: 2\n".to_vec())
+        );
+    }
+
+    #[test]
+    fn directory_and_oversize_are_errors() {
+        let tmp = tempfile::tempdir().unwrap();
+        fs::create_dir(tmp.path().join("socket.yml")).unwrap();
+        assert!(read(tmp.path(), "socket.yml").is_err());
+        fs::write(
+            tmp.path().join("socket.yaml"),
+            vec![b'#'; MAX_FILE_BYTES + 1],
+        )
+        .unwrap();
+        assert!(read(tmp.path(), "socket.yaml").is_err());
+        let err =
+            SelectionPolicy::load(&DiskPolicyFs::new(tmp.path()), &PolicyOverrides::default())
+                .unwrap_err();
+        assert_eq!(err.code(), "socket_yml_invalid");
+    }
+
+    #[test]
+    fn exactly_the_size_limit_is_fine() {
+        let tmp = tempfile::tempdir().unwrap();
+        fs::write(tmp.path().join("socket.yml"), vec![b'#'; MAX_FILE_BYTES]).unwrap();
+        assert!(
+            matches!(read(tmp.path(), "socket.yml").unwrap(), RootFile::Present(b) if b.len() == MAX_FILE_BYTES)
+        );
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn symlink_inside_is_followed_outside_is_refused() {
+        let tmp = tempfile::tempdir().unwrap();
+        let repo = tmp.path().join("repo");
+        fs::create_dir_all(repo.join("config")).unwrap();
+        fs::write(repo.join("config/policy.yml"), "version: 2\n").unwrap();
+        std::os::unix::fs::symlink("config/policy.yml", repo.join("socket.yml")).unwrap();
+        assert!(matches!(
+            read(&repo, "socket.yml").unwrap(),
+            RootFile::Present(_)
+        ));
+
+        fs::write(tmp.path().join("outside.yml"), "version: 2\n").unwrap();
+        std::os::unix::fs::symlink("../outside.yml", repo.join("socket.yaml")).unwrap();
+        let err = read(&repo, "socket.yaml").unwrap_err();
+        assert!(err.to_string().contains("outside"), "{err}");
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn fifo_is_refused_without_blocking() {
+        let tmp = tempfile::tempdir().unwrap();
+        let fifo = tmp.path().join("socket.yml");
+        let c = std::ffi::CString::new(fifo.to_str().unwrap()).unwrap();
+        // SAFETY: a valid NUL-terminated path.
+        assert_eq!(unsafe { libc::mkfifo(c.as_ptr(), 0o600) }, 0);
+        let err = read(tmp.path(), "socket.yml").unwrap_err();
+        assert!(err.to_string().contains("regular file"), "{err}");
+    }
+
+    #[test]
+    fn repo_root_lookup_git_dir_git_file_and_none() {
+        let tmp = tempfile::tempdir().unwrap();
+        let base = fs::canonicalize(tmp.path()).unwrap();
+        let repo = base.join("repo");
+        fs::create_dir_all(repo.join(".git")).unwrap();
+        fs::create_dir_all(repo.join("a/b")).unwrap();
+        assert_eq!(find_repo_root(&repo.join("a/b")), repo);
+        assert_eq!(find_repo_root(&repo), repo);
+
+        let worktree = base.join("wt");
+        fs::create_dir_all(worktree.join("sub")).unwrap();
+        fs::write(worktree.join(".git"), "gitdir: /elsewhere\n").unwrap();
+        assert_eq!(find_repo_root(&worktree.join("sub")), worktree);
+
+        let bare = base.join("plain/x");
+        fs::create_dir_all(&bare).unwrap();
+        assert_eq!(find_repo_root(&bare), bare);
+    }
+
+    #[test]
+    #[serial_test::serial(git_ceiling_env)]
+    fn repo_root_lookup_honors_ceiling_dirs() {
+        let tmp = tempfile::tempdir().unwrap();
+        let base = fs::canonicalize(tmp.path()).unwrap();
+        fs::create_dir_all(base.join(".git")).unwrap();
+        let cwd = base.join("ceiling/cwd");
+        fs::create_dir_all(&cwd).unwrap();
+        std::env::set_var("GIT_CEILING_DIRECTORIES", base.join("ceiling"));
+        let found = find_repo_root(&cwd);
+        std::env::remove_var("GIT_CEILING_DIRECTORIES");
+        assert_eq!(found, cwd);
+        assert_eq!(find_repo_root(&cwd), base);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn owner_rule() {
+        assert!(owner_trusted(1000, 1000, None));
+        assert!(owner_trusted(0, 1000, None));
+        assert!(!owner_trusted(1001, 1000, None));
+        assert!(owner_trusted(1001, 1000, Some(1001)), "sudo's invoking user");
+        assert!(owner_trusted(1001, 0, None), "root trusts every owner");
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn symlinked_git_marks_the_repo_root() {
+        let tmp = tempfile::tempdir().unwrap();
+        let base = fs::canonicalize(tmp.path()).unwrap();
+        fs::create_dir_all(base.join("gitdir")).unwrap();
+        let repo = base.join("repo");
+        fs::create_dir_all(repo.join("sub")).unwrap();
+        std::os::unix::fs::symlink(base.join("gitdir"), repo.join(".git")).unwrap();
+        assert_eq!(find_repo_root(&repo.join("sub")), repo);
+    }
+}
+
+#[test]
+fn this_repos_socket_yml_loads_and_excludes_its_fixtures() {
+    let repo = Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
+    let (policy, warnings) =
+        SelectionPolicy::load(&DiskPolicyFs::new(&repo), &PolicyOverrides::default()).expect("valid");
+    assert!(warnings.is_empty(), "{warnings:?}");
+    assert!(matches!(policy.source(), PolicySource::File { path, .. } if path == "socket.yml"));
+    let lock = strings(&["package-lock.json"]);
+    let err = policy
+        .admits_root(&root("crates/socket-patch-core/tests/fixtures/redirect/npm", &lock, true))
+        .unwrap_err();
+    assert_eq!(err.detail(), "crates/socket-patch-core/tests/fixtures/** (projectIgnorePaths)");
+    assert!(policy.admits_root(&root("", &lock, true)).is_ok());
+}
diff --git a/crates/socket-patch-core/tests/fixtures/ignore_golden.json b/crates/socket-patch-core/tests/fixtures/ignore_golden.json
new file mode 100644
index 00000000..af975e19
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/ignore_golden.json
@@ -0,0 +1,1379 @@
+{"generator": "ignore@7.0.10", "cases": [
+  {"patterns":[],"path":"package-lock.json","ignored":false},
+  {"patterns":[],"path":"Cargo.lock","ignored":false},
+  {"patterns":[],"path":"a/package-lock.json","ignored":false},
+  {"patterns":[],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":[],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":[],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":[],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":[],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":[],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":[],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":[],"path":"test/package-lock.json","ignored":false},
+  {"patterns":[],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":[],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":[],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":[],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":[],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":[],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":[],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":[],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":[],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":[],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":[],"path":"testdata/go.sum","ignored":false},
+  {"patterns":[],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":[],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":[],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":[],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":[],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["/package-lock.json"],"path":"package-lock.json","ignored":true},
+  {"patterns":["/package-lock.json"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["/package-lock.json"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["/package-lock.json"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["/package-lock.json"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["/package-lock.json"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["/package-lock.json"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["/package-lock.json"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["/package-lock.json"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["/package-lock.json"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["/package-lock.json"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["/package-lock.json"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["/package-lock.json"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["/package-lock.json"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["/package-lock.json"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["/package-lock.json"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["/package-lock.json"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["/package-lock.json"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["/package-lock.json"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["/package-lock.json"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["/package-lock.json"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["/package-lock.json"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["/package-lock.json"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["/package-lock.json"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["/package-lock.json"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["/package-lock.json"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["/package-lock.json"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["package-lock.json"],"path":"package-lock.json","ignored":true},
+  {"patterns":["package-lock.json"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["package-lock.json"],"path":"a/package-lock.json","ignored":true},
+  {"patterns":["package-lock.json"],"path":"a/b/package-lock.json","ignored":true},
+  {"patterns":["package-lock.json"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["package-lock.json"],"path":"services/api/package-lock.json","ignored":true},
+  {"patterns":["package-lock.json"],"path":"services/payments/package-lock.json","ignored":true},
+  {"patterns":["package-lock.json"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["package-lock.json"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["package-lock.json"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["package-lock.json"],"path":"test/package-lock.json","ignored":true},
+  {"patterns":["package-lock.json"],"path":"Test/package-lock.json","ignored":true},
+  {"patterns":["package-lock.json"],"path":"tests/fixtures/app/package-lock.json","ignored":true},
+  {"patterns":["package-lock.json"],"path":"e2e/tests/package-lock.json","ignored":true},
+  {"patterns":["package-lock.json"],"path":"e2e/tests/keep/package-lock.json","ignored":true},
+  {"patterns":["package-lock.json"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["package-lock.json"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["package-lock.json"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["package-lock.json"],"path":"examples/demo/package-lock.json","ignored":true},
+  {"patterns":["package-lock.json"],"path":"examples/package-lock.json","ignored":true},
+  {"patterns":["package-lock.json"],"path":"docs/examples/package-lock.json","ignored":true},
+  {"patterns":["package-lock.json"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["package-lock.json"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["package-lock.json"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["package-lock.json"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["package-lock.json"],"path":"foo bar/package-lock.json","ignored":true},
+  {"patterns":["package-lock.json"],"path":"x[1]/package-lock.json","ignored":true},
+  {"patterns":["**/yarn.lock"],"path":"package-lock.json","ignored":false},
+  {"patterns":["**/yarn.lock"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["**/yarn.lock"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["**/yarn.lock"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["**/yarn.lock"],"path":"a/b/c/yarn.lock","ignored":true},
+  {"patterns":["**/yarn.lock"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["**/yarn.lock"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["**/yarn.lock"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["**/yarn.lock"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["**/yarn.lock"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["**/yarn.lock"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["**/yarn.lock"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["**/yarn.lock"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["**/yarn.lock"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["**/yarn.lock"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["**/yarn.lock"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["**/yarn.lock"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["**/yarn.lock"],"path":"a/fixtures/keep/yarn.lock","ignored":true},
+  {"patterns":["**/yarn.lock"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["**/yarn.lock"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["**/yarn.lock"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["**/yarn.lock"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["**/yarn.lock"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["**/yarn.lock"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["**/yarn.lock"],"path":"a.lock/yarn.lock","ignored":true},
+  {"patterns":["**/yarn.lock"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["**/yarn.lock"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["examples/**"],"path":"package-lock.json","ignored":false},
+  {"patterns":["examples/**"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["examples/**"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["examples/**"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["examples/**"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["examples/**"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["examples/**"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["examples/**"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["examples/**"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["examples/**"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["examples/**"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["examples/**"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["examples/**"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["examples/**"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["examples/**"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["examples/**"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["examples/**"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["examples/**"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["examples/**"],"path":"examples/demo/package-lock.json","ignored":true},
+  {"patterns":["examples/**"],"path":"examples/package-lock.json","ignored":true},
+  {"patterns":["examples/**"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["examples/**"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["examples/**"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["examples/**"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["examples/**"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["examples/**"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["examples/**"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["examples/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["examples/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["examples/"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["examples/"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["examples/"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["examples/"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["examples/"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["examples/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["examples/"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["examples/"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["examples/"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["examples/"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["examples/"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["examples/"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["examples/"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["examples/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["examples/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["examples/"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["examples/"],"path":"examples/demo/package-lock.json","ignored":true},
+  {"patterns":["examples/"],"path":"examples/package-lock.json","ignored":true},
+  {"patterns":["examples/"],"path":"docs/examples/package-lock.json","ignored":true},
+  {"patterns":["examples/"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["examples/"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["examples/"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["examples/"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["examples/"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["examples/"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["/examples/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["/examples/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["/examples/"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["/examples/"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["/examples/"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["/examples/"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["/examples/"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["/examples/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["/examples/"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["/examples/"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["/examples/"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["/examples/"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["/examples/"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["/examples/"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["/examples/"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["/examples/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["/examples/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["/examples/"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["/examples/"],"path":"examples/demo/package-lock.json","ignored":true},
+  {"patterns":["/examples/"],"path":"examples/package-lock.json","ignored":true},
+  {"patterns":["/examples/"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["/examples/"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["/examples/"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["/examples/"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["/examples/"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["/examples/"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["/examples/"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["examples"],"path":"package-lock.json","ignored":false},
+  {"patterns":["examples"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["examples"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["examples"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["examples"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["examples"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["examples"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["examples"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["examples"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["examples"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["examples"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["examples"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["examples"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["examples"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["examples"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["examples"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["examples"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["examples"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["examples"],"path":"examples/demo/package-lock.json","ignored":true},
+  {"patterns":["examples"],"path":"examples/package-lock.json","ignored":true},
+  {"patterns":["examples"],"path":"docs/examples/package-lock.json","ignored":true},
+  {"patterns":["examples"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["examples"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["examples"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["examples"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["examples"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["examples"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["crates/x/fixtures/**"],"path":"package-lock.json","ignored":false},
+  {"patterns":["crates/x/fixtures/**"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["crates/x/fixtures/**"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["crates/x/fixtures/**"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["crates/x/fixtures/**"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["crates/x/fixtures/**"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["crates/x/fixtures/**"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["crates/x/fixtures/**"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["crates/x/fixtures/**"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["crates/x/fixtures/**"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["crates/x/fixtures/**"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["crates/x/fixtures/**"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["crates/x/fixtures/**"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["crates/x/fixtures/**"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["crates/x/fixtures/**"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["crates/x/fixtures/**"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["crates/x/fixtures/**"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":true},
+  {"patterns":["crates/x/fixtures/**"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["crates/x/fixtures/**"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["crates/x/fixtures/**"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["crates/x/fixtures/**"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["crates/x/fixtures/**"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["crates/x/fixtures/**"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["crates/x/fixtures/**"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["crates/x/fixtures/**"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["crates/x/fixtures/**"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["crates/x/fixtures/**"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["crates/*/tests/fixtures/**"],"path":"package-lock.json","ignored":false},
+  {"patterns":["crates/*/tests/fixtures/**"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["crates/*/tests/fixtures/**"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["crates/*/tests/fixtures/**"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["crates/*/tests/fixtures/**"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["crates/*/tests/fixtures/**"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["crates/*/tests/fixtures/**"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["crates/*/tests/fixtures/**"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["crates/*/tests/fixtures/**"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["crates/*/tests/fixtures/**"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["crates/*/tests/fixtures/**"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["crates/*/tests/fixtures/**"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["crates/*/tests/fixtures/**"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["crates/*/tests/fixtures/**"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["crates/*/tests/fixtures/**"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["crates/*/tests/fixtures/**"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":true},
+  {"patterns":["crates/*/tests/fixtures/**"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["crates/*/tests/fixtures/**"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["crates/*/tests/fixtures/**"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["crates/*/tests/fixtures/**"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["crates/*/tests/fixtures/**"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["crates/*/tests/fixtures/**"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["crates/*/tests/fixtures/**"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["crates/*/tests/fixtures/**"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["crates/*/tests/fixtures/**"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["crates/*/tests/fixtures/**"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["crates/*/tests/fixtures/**"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["/legacy/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["/legacy/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["/legacy/"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["/legacy/"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["/legacy/"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["/legacy/"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["/legacy/"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["/legacy/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["/legacy/"],"path":"legacy/requirements.txt","ignored":true},
+  {"patterns":["/legacy/"],"path":"Legacy/requirements.txt","ignored":true},
+  {"patterns":["/legacy/"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["/legacy/"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["/legacy/"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["/legacy/"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["/legacy/"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["/legacy/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["/legacy/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["/legacy/"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["/legacy/"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["/legacy/"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["/legacy/"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["/legacy/"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["/legacy/"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["/legacy/"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["/legacy/"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["/legacy/"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["/legacy/"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["legacy/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["legacy/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["legacy/"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["legacy/"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["legacy/"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["legacy/"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["legacy/"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["legacy/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["legacy/"],"path":"legacy/requirements.txt","ignored":true},
+  {"patterns":["legacy/"],"path":"Legacy/requirements.txt","ignored":true},
+  {"patterns":["legacy/"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["legacy/"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["legacy/"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["legacy/"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["legacy/"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["legacy/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["legacy/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["legacy/"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["legacy/"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["legacy/"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["legacy/"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["legacy/"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["legacy/"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["legacy/"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["legacy/"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["legacy/"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["legacy/"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["/services/payments/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["/services/payments/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["/services/payments/"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["/services/payments/"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["/services/payments/"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["/services/payments/"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["/services/payments/"],"path":"services/payments/package-lock.json","ignored":true},
+  {"patterns":["/services/payments/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":true},
+  {"patterns":["/services/payments/"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["/services/payments/"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["/services/payments/"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["/services/payments/"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["/services/payments/"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["/services/payments/"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["/services/payments/"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["/services/payments/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["/services/payments/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["/services/payments/"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["/services/payments/"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["/services/payments/"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["/services/payments/"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["/services/payments/"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["/services/payments/"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["/services/payments/"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["/services/payments/"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["/services/payments/"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["/services/payments/"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["/services/*/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["/services/*/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["/services/*/"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["/services/*/"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["/services/*/"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["/services/*/"],"path":"services/api/package-lock.json","ignored":true},
+  {"patterns":["/services/*/"],"path":"services/payments/package-lock.json","ignored":true},
+  {"patterns":["/services/*/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":true},
+  {"patterns":["/services/*/"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["/services/*/"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["/services/*/"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["/services/*/"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["/services/*/"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["/services/*/"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["/services/*/"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["/services/*/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["/services/*/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["/services/*/"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["/services/*/"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["/services/*/"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["/services/*/"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["/services/*/"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["/services/*/"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["/services/*/"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["/services/*/"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["/services/*/"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["/services/*/"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["services/**/package-lock.json"],"path":"package-lock.json","ignored":false},
+  {"patterns":["services/**/package-lock.json"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["services/**/package-lock.json"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["services/**/package-lock.json"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["services/**/package-lock.json"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["services/**/package-lock.json"],"path":"services/api/package-lock.json","ignored":true},
+  {"patterns":["services/**/package-lock.json"],"path":"services/payments/package-lock.json","ignored":true},
+  {"patterns":["services/**/package-lock.json"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["services/**/package-lock.json"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["services/**/package-lock.json"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["services/**/package-lock.json"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["services/**/package-lock.json"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["services/**/package-lock.json"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["services/**/package-lock.json"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["services/**/package-lock.json"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["services/**/package-lock.json"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["services/**/package-lock.json"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["services/**/package-lock.json"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["services/**/package-lock.json"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["services/**/package-lock.json"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["services/**/package-lock.json"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["services/**/package-lock.json"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["services/**/package-lock.json"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["services/**/package-lock.json"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["services/**/package-lock.json"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["services/**/package-lock.json"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["services/**/package-lock.json"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["/*","!/*/"],"path":"package-lock.json","ignored":true},
+  {"patterns":["/*","!/*/"],"path":"Cargo.lock","ignored":true},
+  {"patterns":["/*","!/*/"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["/*","!/*/"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["/*","!/*/"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["/*","!/*/"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["/*","!/*/"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["/*","!/*/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["/*","!/*/"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["/*","!/*/"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["/*","!/*/"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["/*","!/*/"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["/*","!/*/"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["/*","!/*/"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["/*","!/*/"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["/*","!/*/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["/*","!/*/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["/*","!/*/"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["/*","!/*/"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["/*","!/*/"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["/*","!/*/"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["/*","!/*/"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["/*","!/*/"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["/*","!/*/"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["/*","!/*/"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["/*","!/*/"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["/*","!/*/"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["*","!*/"],"path":"package-lock.json","ignored":true},
+  {"patterns":["*","!*/"],"path":"Cargo.lock","ignored":true},
+  {"patterns":["*","!*/"],"path":"a/package-lock.json","ignored":true},
+  {"patterns":["*","!*/"],"path":"a/b/package-lock.json","ignored":true},
+  {"patterns":["*","!*/"],"path":"a/b/c/yarn.lock","ignored":true},
+  {"patterns":["*","!*/"],"path":"services/api/package-lock.json","ignored":true},
+  {"patterns":["*","!*/"],"path":"services/payments/package-lock.json","ignored":true},
+  {"patterns":["*","!*/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":true},
+  {"patterns":["*","!*/"],"path":"legacy/requirements.txt","ignored":true},
+  {"patterns":["*","!*/"],"path":"Legacy/requirements.txt","ignored":true},
+  {"patterns":["*","!*/"],"path":"test/package-lock.json","ignored":true},
+  {"patterns":["*","!*/"],"path":"Test/package-lock.json","ignored":true},
+  {"patterns":["*","!*/"],"path":"tests/fixtures/app/package-lock.json","ignored":true},
+  {"patterns":["*","!*/"],"path":"e2e/tests/package-lock.json","ignored":true},
+  {"patterns":["*","!*/"],"path":"e2e/tests/keep/package-lock.json","ignored":true},
+  {"patterns":["*","!*/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":true},
+  {"patterns":["*","!*/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":true},
+  {"patterns":["*","!*/"],"path":"a/fixtures/keep/yarn.lock","ignored":true},
+  {"patterns":["*","!*/"],"path":"examples/demo/package-lock.json","ignored":true},
+  {"patterns":["*","!*/"],"path":"examples/package-lock.json","ignored":true},
+  {"patterns":["*","!*/"],"path":"docs/examples/package-lock.json","ignored":true},
+  {"patterns":["*","!*/"],"path":"testdata/go.sum","ignored":true},
+  {"patterns":["*","!*/"],"path":"pkg/testdata/go.sum","ignored":true},
+  {"patterns":["*","!*/"],"path":"__fixtures__/x/package.json","ignored":true},
+  {"patterns":["*","!*/"],"path":"a.lock/yarn.lock","ignored":true},
+  {"patterns":["*","!*/"],"path":"foo bar/package-lock.json","ignored":true},
+  {"patterns":["*","!*/"],"path":"x[1]/package-lock.json","ignored":true},
+  {"patterns":["fixtures/","!/a/fixtures/keep/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["fixtures/","!/a/fixtures/keep/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["fixtures/","!/a/fixtures/keep/"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["fixtures/","!/a/fixtures/keep/"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["fixtures/","!/a/fixtures/keep/"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["fixtures/","!/a/fixtures/keep/"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["fixtures/","!/a/fixtures/keep/"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["fixtures/","!/a/fixtures/keep/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["fixtures/","!/a/fixtures/keep/"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["fixtures/","!/a/fixtures/keep/"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["fixtures/","!/a/fixtures/keep/"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["fixtures/","!/a/fixtures/keep/"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["fixtures/","!/a/fixtures/keep/"],"path":"tests/fixtures/app/package-lock.json","ignored":true},
+  {"patterns":["fixtures/","!/a/fixtures/keep/"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["fixtures/","!/a/fixtures/keep/"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["fixtures/","!/a/fixtures/keep/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":true},
+  {"patterns":["fixtures/","!/a/fixtures/keep/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":true},
+  {"patterns":["fixtures/","!/a/fixtures/keep/"],"path":"a/fixtures/keep/yarn.lock","ignored":true},
+  {"patterns":["fixtures/","!/a/fixtures/keep/"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["fixtures/","!/a/fixtures/keep/"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["fixtures/","!/a/fixtures/keep/"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["fixtures/","!/a/fixtures/keep/"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["fixtures/","!/a/fixtures/keep/"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["fixtures/","!/a/fixtures/keep/"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["fixtures/","!/a/fixtures/keep/"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["fixtures/","!/a/fixtures/keep/"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["fixtures/","!/a/fixtures/keep/"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["fixtures/","!fixtures/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["fixtures/","!fixtures/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["fixtures/","!fixtures/"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["fixtures/","!fixtures/"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["fixtures/","!fixtures/"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["fixtures/","!fixtures/"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["fixtures/","!fixtures/"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["fixtures/","!fixtures/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["fixtures/","!fixtures/"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["fixtures/","!fixtures/"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["fixtures/","!fixtures/"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["fixtures/","!fixtures/"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["fixtures/","!fixtures/"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["fixtures/","!fixtures/"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["fixtures/","!fixtures/"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["fixtures/","!fixtures/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["fixtures/","!fixtures/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["fixtures/","!fixtures/"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["fixtures/","!fixtures/"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["fixtures/","!fixtures/"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["fixtures/","!fixtures/"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["fixtures/","!fixtures/"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["fixtures/","!fixtures/"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["fixtures/","!fixtures/"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["fixtures/","!fixtures/"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["fixtures/","!fixtures/"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["fixtures/","!fixtures/"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/"],"path":"test/package-lock.json","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/"],"path":"Test/package-lock.json","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/"],"path":"tests/fixtures/app/package-lock.json","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/"],"path":"e2e/tests/package-lock.json","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/"],"path":"e2e/tests/keep/package-lock.json","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/"],"path":"a/fixtures/keep/yarn.lock","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/"],"path":"testdata/go.sum","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/"],"path":"pkg/testdata/go.sum","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/"],"path":"__fixtures__/x/package.json","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!/e2e/tests/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!/e2e/tests/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!/e2e/tests/"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!/e2e/tests/"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!/e2e/tests/"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!/e2e/tests/"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!/e2e/tests/"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!/e2e/tests/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!/e2e/tests/"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!/e2e/tests/"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!/e2e/tests/"],"path":"test/package-lock.json","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!/e2e/tests/"],"path":"Test/package-lock.json","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!/e2e/tests/"],"path":"tests/fixtures/app/package-lock.json","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!/e2e/tests/"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!/e2e/tests/"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!/e2e/tests/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!/e2e/tests/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!/e2e/tests/"],"path":"a/fixtures/keep/yarn.lock","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!/e2e/tests/"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!/e2e/tests/"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!/e2e/tests/"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!/e2e/tests/"],"path":"testdata/go.sum","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!/e2e/tests/"],"path":"pkg/testdata/go.sum","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!/e2e/tests/"],"path":"__fixtures__/x/package.json","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!/e2e/tests/"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!/e2e/tests/"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!/e2e/tests/"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!tests/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!tests/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!tests/"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!tests/"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!tests/"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!tests/"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!tests/"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!tests/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!tests/"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!tests/"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!tests/"],"path":"test/package-lock.json","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!tests/"],"path":"Test/package-lock.json","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!tests/"],"path":"tests/fixtures/app/package-lock.json","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!tests/"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!tests/"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!tests/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!tests/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!tests/"],"path":"a/fixtures/keep/yarn.lock","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!tests/"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!tests/"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!tests/"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!tests/"],"path":"testdata/go.sum","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!tests/"],"path":"pkg/testdata/go.sum","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!tests/"],"path":"__fixtures__/x/package.json","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!tests/"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!tests/"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","!tests/"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","/legacy/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","/legacy/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","/legacy/"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","/legacy/"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","/legacy/"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","/legacy/"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","/legacy/"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","/legacy/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","/legacy/"],"path":"legacy/requirements.txt","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","/legacy/"],"path":"Legacy/requirements.txt","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","/legacy/"],"path":"test/package-lock.json","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","/legacy/"],"path":"Test/package-lock.json","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","/legacy/"],"path":"tests/fixtures/app/package-lock.json","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","/legacy/"],"path":"e2e/tests/package-lock.json","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","/legacy/"],"path":"e2e/tests/keep/package-lock.json","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","/legacy/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","/legacy/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","/legacy/"],"path":"a/fixtures/keep/yarn.lock","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","/legacy/"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","/legacy/"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","/legacy/"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","/legacy/"],"path":"testdata/go.sum","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","/legacy/"],"path":"pkg/testdata/go.sum","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","/legacy/"],"path":"__fixtures__/x/package.json","ignored":true},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","/legacy/"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","/legacy/"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["test/","tests/","fixtures/","__fixtures__/","testdata/","/legacy/"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["a/","!a/b/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["a/","!a/b/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["a/","!a/b/"],"path":"a/package-lock.json","ignored":true},
+  {"patterns":["a/","!a/b/"],"path":"a/b/package-lock.json","ignored":true},
+  {"patterns":["a/","!a/b/"],"path":"a/b/c/yarn.lock","ignored":true},
+  {"patterns":["a/","!a/b/"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["a/","!a/b/"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["a/","!a/b/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["a/","!a/b/"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["a/","!a/b/"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["a/","!a/b/"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["a/","!a/b/"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["a/","!a/b/"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["a/","!a/b/"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["a/","!a/b/"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["a/","!a/b/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["a/","!a/b/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["a/","!a/b/"],"path":"a/fixtures/keep/yarn.lock","ignored":true},
+  {"patterns":["a/","!a/b/"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["a/","!a/b/"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["a/","!a/b/"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["a/","!a/b/"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["a/","!a/b/"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["a/","!a/b/"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["a/","!a/b/"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["a/","!a/b/"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["a/","!a/b/"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["a/*","!a/b/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["a/*","!a/b/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["a/*","!a/b/"],"path":"a/package-lock.json","ignored":true},
+  {"patterns":["a/*","!a/b/"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["a/*","!a/b/"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["a/*","!a/b/"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["a/*","!a/b/"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["a/*","!a/b/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["a/*","!a/b/"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["a/*","!a/b/"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["a/*","!a/b/"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["a/*","!a/b/"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["a/*","!a/b/"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["a/*","!a/b/"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["a/*","!a/b/"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["a/*","!a/b/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["a/*","!a/b/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["a/*","!a/b/"],"path":"a/fixtures/keep/yarn.lock","ignored":true},
+  {"patterns":["a/*","!a/b/"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["a/*","!a/b/"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["a/*","!a/b/"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["a/*","!a/b/"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["a/*","!a/b/"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["a/*","!a/b/"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["a/*","!a/b/"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["a/*","!a/b/"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["a/*","!a/b/"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["a/**","!a/b/**"],"path":"package-lock.json","ignored":false},
+  {"patterns":["a/**","!a/b/**"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["a/**","!a/b/**"],"path":"a/package-lock.json","ignored":true},
+  {"patterns":["a/**","!a/b/**"],"path":"a/b/package-lock.json","ignored":true},
+  {"patterns":["a/**","!a/b/**"],"path":"a/b/c/yarn.lock","ignored":true},
+  {"patterns":["a/**","!a/b/**"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["a/**","!a/b/**"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["a/**","!a/b/**"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["a/**","!a/b/**"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["a/**","!a/b/**"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["a/**","!a/b/**"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["a/**","!a/b/**"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["a/**","!a/b/**"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["a/**","!a/b/**"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["a/**","!a/b/**"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["a/**","!a/b/**"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["a/**","!a/b/**"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["a/**","!a/b/**"],"path":"a/fixtures/keep/yarn.lock","ignored":true},
+  {"patterns":["a/**","!a/b/**"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["a/**","!a/b/**"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["a/**","!a/b/**"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["a/**","!a/b/**"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["a/**","!a/b/**"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["a/**","!a/b/**"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["a/**","!a/b/**"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["a/**","!a/b/**"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["a/**","!a/b/**"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["a/**/yarn.lock"],"path":"package-lock.json","ignored":false},
+  {"patterns":["a/**/yarn.lock"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["a/**/yarn.lock"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["a/**/yarn.lock"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["a/**/yarn.lock"],"path":"a/b/c/yarn.lock","ignored":true},
+  {"patterns":["a/**/yarn.lock"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["a/**/yarn.lock"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["a/**/yarn.lock"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["a/**/yarn.lock"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["a/**/yarn.lock"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["a/**/yarn.lock"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["a/**/yarn.lock"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["a/**/yarn.lock"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["a/**/yarn.lock"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["a/**/yarn.lock"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["a/**/yarn.lock"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["a/**/yarn.lock"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["a/**/yarn.lock"],"path":"a/fixtures/keep/yarn.lock","ignored":true},
+  {"patterns":["a/**/yarn.lock"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["a/**/yarn.lock"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["a/**/yarn.lock"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["a/**/yarn.lock"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["a/**/yarn.lock"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["a/**/yarn.lock"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["a/**/yarn.lock"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["a/**/yarn.lock"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["a/**/yarn.lock"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["**/b/**"],"path":"package-lock.json","ignored":false},
+  {"patterns":["**/b/**"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["**/b/**"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["**/b/**"],"path":"a/b/package-lock.json","ignored":true},
+  {"patterns":["**/b/**"],"path":"a/b/c/yarn.lock","ignored":true},
+  {"patterns":["**/b/**"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["**/b/**"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["**/b/**"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["**/b/**"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["**/b/**"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["**/b/**"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["**/b/**"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["**/b/**"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["**/b/**"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["**/b/**"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["**/b/**"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["**/b/**"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["**/b/**"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["**/b/**"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["**/b/**"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["**/b/**"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["**/b/**"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["**/b/**"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["**/b/**"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["**/b/**"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["**/b/**"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["**/b/**"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["*.lock"],"path":"package-lock.json","ignored":false},
+  {"patterns":["*.lock"],"path":"Cargo.lock","ignored":true},
+  {"patterns":["*.lock"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["*.lock"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["*.lock"],"path":"a/b/c/yarn.lock","ignored":true},
+  {"patterns":["*.lock"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["*.lock"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["*.lock"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["*.lock"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["*.lock"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["*.lock"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["*.lock"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["*.lock"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["*.lock"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["*.lock"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["*.lock"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":true},
+  {"patterns":["*.lock"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":true},
+  {"patterns":["*.lock"],"path":"a/fixtures/keep/yarn.lock","ignored":true},
+  {"patterns":["*.lock"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["*.lock"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["*.lock"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["*.lock"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["*.lock"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["*.lock"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["*.lock"],"path":"a.lock/yarn.lock","ignored":true},
+  {"patterns":["*.lock"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["*.lock"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["*.json","!package-lock.json"],"path":"package-lock.json","ignored":false},
+  {"patterns":["*.json","!package-lock.json"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["*.json","!package-lock.json"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["*.json","!package-lock.json"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["*.json","!package-lock.json"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["*.json","!package-lock.json"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["*.json","!package-lock.json"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["*.json","!package-lock.json"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["*.json","!package-lock.json"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["*.json","!package-lock.json"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["*.json","!package-lock.json"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["*.json","!package-lock.json"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["*.json","!package-lock.json"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["*.json","!package-lock.json"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["*.json","!package-lock.json"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["*.json","!package-lock.json"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["*.json","!package-lock.json"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["*.json","!package-lock.json"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["*.json","!package-lock.json"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["*.json","!package-lock.json"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["*.json","!package-lock.json"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["*.json","!package-lock.json"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["*.json","!package-lock.json"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["*.json","!package-lock.json"],"path":"__fixtures__/x/package.json","ignored":true},
+  {"patterns":["*.json","!package-lock.json"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["*.json","!package-lock.json"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["*.json","!package-lock.json"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["!package-lock.json"],"path":"package-lock.json","ignored":false},
+  {"patterns":["!package-lock.json"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["!package-lock.json"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["!package-lock.json"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["!package-lock.json"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["!package-lock.json"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["!package-lock.json"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["!package-lock.json"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["!package-lock.json"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["!package-lock.json"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["!package-lock.json"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["!package-lock.json"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["!package-lock.json"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["!package-lock.json"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["!package-lock.json"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["!package-lock.json"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["!package-lock.json"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["!package-lock.json"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["!package-lock.json"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["!package-lock.json"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["!package-lock.json"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["!package-lock.json"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["!package-lock.json"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["!package-lock.json"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["!package-lock.json"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["!package-lock.json"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["!package-lock.json"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["a/b"],"path":"package-lock.json","ignored":false},
+  {"patterns":["a/b"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["a/b"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["a/b"],"path":"a/b/package-lock.json","ignored":true},
+  {"patterns":["a/b"],"path":"a/b/c/yarn.lock","ignored":true},
+  {"patterns":["a/b"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["a/b"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["a/b"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["a/b"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["a/b"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["a/b"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["a/b"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["a/b"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["a/b"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["a/b"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["a/b"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["a/b"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["a/b"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["a/b"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["a/b"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["a/b"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["a/b"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["a/b"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["a/b"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["a/b"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["a/b"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["a/b"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["/a/b/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["/a/b/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["/a/b/"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["/a/b/"],"path":"a/b/package-lock.json","ignored":true},
+  {"patterns":["/a/b/"],"path":"a/b/c/yarn.lock","ignored":true},
+  {"patterns":["/a/b/"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["/a/b/"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["/a/b/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["/a/b/"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["/a/b/"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["/a/b/"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["/a/b/"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["/a/b/"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["/a/b/"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["/a/b/"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["/a/b/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["/a/b/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["/a/b/"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["/a/b/"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["/a/b/"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["/a/b/"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["/a/b/"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["/a/b/"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["/a/b/"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["/a/b/"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["/a/b/"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["/a/b/"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["b/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["b/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["b/"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["b/"],"path":"a/b/package-lock.json","ignored":true},
+  {"patterns":["b/"],"path":"a/b/c/yarn.lock","ignored":true},
+  {"patterns":["b/"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["b/"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["b/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["b/"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["b/"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["b/"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["b/"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["b/"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["b/"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["b/"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["b/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["b/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["b/"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["b/"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["b/"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["b/"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["b/"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["b/"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["b/"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["b/"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["b/"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["b/"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["**/c/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["**/c/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["**/c/"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["**/c/"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["**/c/"],"path":"a/b/c/yarn.lock","ignored":true},
+  {"patterns":["**/c/"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["**/c/"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["**/c/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["**/c/"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["**/c/"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["**/c/"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["**/c/"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["**/c/"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["**/c/"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["**/c/"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["**/c/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["**/c/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["**/c/"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["**/c/"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["**/c/"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["**/c/"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["**/c/"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["**/c/"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["**/c/"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["**/c/"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["**/c/"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["**/c/"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["LEGACY/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["LEGACY/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["LEGACY/"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["LEGACY/"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["LEGACY/"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["LEGACY/"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["LEGACY/"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["LEGACY/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["LEGACY/"],"path":"legacy/requirements.txt","ignored":true},
+  {"patterns":["LEGACY/"],"path":"Legacy/requirements.txt","ignored":true},
+  {"patterns":["LEGACY/"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["LEGACY/"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["LEGACY/"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["LEGACY/"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["LEGACY/"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["LEGACY/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["LEGACY/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["LEGACY/"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["LEGACY/"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["LEGACY/"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["LEGACY/"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["LEGACY/"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["LEGACY/"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["LEGACY/"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["LEGACY/"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["LEGACY/"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["LEGACY/"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["Services/API/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["Services/API/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["Services/API/"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["Services/API/"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["Services/API/"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["Services/API/"],"path":"services/api/package-lock.json","ignored":true},
+  {"patterns":["Services/API/"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["Services/API/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["Services/API/"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["Services/API/"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["Services/API/"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["Services/API/"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["Services/API/"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["Services/API/"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["Services/API/"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["Services/API/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["Services/API/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["Services/API/"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["Services/API/"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["Services/API/"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["Services/API/"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["Services/API/"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["Services/API/"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["Services/API/"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["Services/API/"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["Services/API/"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["Services/API/"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["foo bar/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["foo bar/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["foo bar/"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["foo bar/"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["foo bar/"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["foo bar/"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["foo bar/"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["foo bar/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["foo bar/"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["foo bar/"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["foo bar/"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["foo bar/"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["foo bar/"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["foo bar/"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["foo bar/"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["foo bar/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["foo bar/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["foo bar/"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["foo bar/"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["foo bar/"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["foo bar/"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["foo bar/"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["foo bar/"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["foo bar/"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["foo bar/"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["foo bar/"],"path":"foo bar/package-lock.json","ignored":true},
+  {"patterns":["foo bar/"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["foo\\ bar/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["foo\\ bar/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["foo\\ bar/"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["foo\\ bar/"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["foo\\ bar/"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["foo\\ bar/"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["foo\\ bar/"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["foo\\ bar/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["foo\\ bar/"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["foo\\ bar/"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["foo\\ bar/"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["foo\\ bar/"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["foo\\ bar/"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["foo\\ bar/"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["foo\\ bar/"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["foo\\ bar/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["foo\\ bar/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["foo\\ bar/"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["foo\\ bar/"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["foo\\ bar/"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["foo\\ bar/"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["foo\\ bar/"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["foo\\ bar/"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["foo\\ bar/"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["foo\\ bar/"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["foo\\ bar/"],"path":"foo bar/package-lock.json","ignored":true},
+  {"patterns":["foo\\ bar/"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["x\\[1\\]/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["x\\[1\\]/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["x\\[1\\]/"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["x\\[1\\]/"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["x\\[1\\]/"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["x\\[1\\]/"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["x\\[1\\]/"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["x\\[1\\]/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["x\\[1\\]/"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["x\\[1\\]/"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["x\\[1\\]/"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["x\\[1\\]/"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["x\\[1\\]/"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["x\\[1\\]/"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["x\\[1\\]/"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["x\\[1\\]/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["x\\[1\\]/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["x\\[1\\]/"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["x\\[1\\]/"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["x\\[1\\]/"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["x\\[1\\]/"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["x\\[1\\]/"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["x\\[1\\]/"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["x\\[1\\]/"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["x\\[1\\]/"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["x\\[1\\]/"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["x\\[1\\]/"],"path":"x[1]/package-lock.json","ignored":true},
+  {"patterns":["x[1]/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["x[1]/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["x[1]/"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["x[1]/"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["x[1]/"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["x[1]/"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["x[1]/"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["x[1]/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["x[1]/"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["x[1]/"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["x[1]/"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["x[1]/"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["x[1]/"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["x[1]/"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["x[1]/"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["x[1]/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["x[1]/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["x[1]/"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["x[1]/"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["x[1]/"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["x[1]/"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["x[1]/"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["x[1]/"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["x[1]/"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["x[1]/"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["x[1]/"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["x[1]/"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["?.lock/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["?.lock/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["?.lock/"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["?.lock/"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["?.lock/"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["?.lock/"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["?.lock/"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["?.lock/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["?.lock/"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["?.lock/"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["?.lock/"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["?.lock/"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["?.lock/"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["?.lock/"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["?.lock/"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["?.lock/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["?.lock/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["?.lock/"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["?.lock/"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["?.lock/"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["?.lock/"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["?.lock/"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["?.lock/"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["?.lock/"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["?.lock/"],"path":"a.lock/yarn.lock","ignored":true},
+  {"patterns":["?.lock/"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["?.lock/"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["a.lock/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["a.lock/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["a.lock/"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["a.lock/"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["a.lock/"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["a.lock/"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["a.lock/"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["a.lock/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["a.lock/"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["a.lock/"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["a.lock/"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["a.lock/"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["a.lock/"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["a.lock/"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["a.lock/"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["a.lock/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["a.lock/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["a.lock/"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["a.lock/"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["a.lock/"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["a.lock/"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["a.lock/"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["a.lock/"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["a.lock/"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["a.lock/"],"path":"a.lock/yarn.lock","ignored":true},
+  {"patterns":["a.lock/"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["a.lock/"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["a/b/c/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["a/b/c/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["a/b/c/"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["a/b/c/"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["a/b/c/"],"path":"a/b/c/yarn.lock","ignored":true},
+  {"patterns":["a/b/c/"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["a/b/c/"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["a/b/c/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["a/b/c/"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["a/b/c/"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["a/b/c/"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["a/b/c/"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["a/b/c/"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["a/b/c/"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["a/b/c/"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["a/b/c/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["a/b/c/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["a/b/c/"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["a/b/c/"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["a/b/c/"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["a/b/c/"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["a/b/c/"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["a/b/c/"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["a/b/c/"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["a/b/c/"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["a/b/c/"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["a/b/c/"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["**"],"path":"package-lock.json","ignored":true},
+  {"patterns":["**"],"path":"Cargo.lock","ignored":true},
+  {"patterns":["**"],"path":"a/package-lock.json","ignored":true},
+  {"patterns":["**"],"path":"a/b/package-lock.json","ignored":true},
+  {"patterns":["**"],"path":"a/b/c/yarn.lock","ignored":true},
+  {"patterns":["**"],"path":"services/api/package-lock.json","ignored":true},
+  {"patterns":["**"],"path":"services/payments/package-lock.json","ignored":true},
+  {"patterns":["**"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":true},
+  {"patterns":["**"],"path":"legacy/requirements.txt","ignored":true},
+  {"patterns":["**"],"path":"Legacy/requirements.txt","ignored":true},
+  {"patterns":["**"],"path":"test/package-lock.json","ignored":true},
+  {"patterns":["**"],"path":"Test/package-lock.json","ignored":true},
+  {"patterns":["**"],"path":"tests/fixtures/app/package-lock.json","ignored":true},
+  {"patterns":["**"],"path":"e2e/tests/package-lock.json","ignored":true},
+  {"patterns":["**"],"path":"e2e/tests/keep/package-lock.json","ignored":true},
+  {"patterns":["**"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":true},
+  {"patterns":["**"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":true},
+  {"patterns":["**"],"path":"a/fixtures/keep/yarn.lock","ignored":true},
+  {"patterns":["**"],"path":"examples/demo/package-lock.json","ignored":true},
+  {"patterns":["**"],"path":"examples/package-lock.json","ignored":true},
+  {"patterns":["**"],"path":"docs/examples/package-lock.json","ignored":true},
+  {"patterns":["**"],"path":"testdata/go.sum","ignored":true},
+  {"patterns":["**"],"path":"pkg/testdata/go.sum","ignored":true},
+  {"patterns":["**"],"path":"__fixtures__/x/package.json","ignored":true},
+  {"patterns":["**"],"path":"a.lock/yarn.lock","ignored":true},
+  {"patterns":["**"],"path":"foo bar/package-lock.json","ignored":true},
+  {"patterns":["**"],"path":"x[1]/package-lock.json","ignored":true},
+  {"patterns":["**/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["**/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["**/"],"path":"a/package-lock.json","ignored":true},
+  {"patterns":["**/"],"path":"a/b/package-lock.json","ignored":true},
+  {"patterns":["**/"],"path":"a/b/c/yarn.lock","ignored":true},
+  {"patterns":["**/"],"path":"services/api/package-lock.json","ignored":true},
+  {"patterns":["**/"],"path":"services/payments/package-lock.json","ignored":true},
+  {"patterns":["**/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":true},
+  {"patterns":["**/"],"path":"legacy/requirements.txt","ignored":true},
+  {"patterns":["**/"],"path":"Legacy/requirements.txt","ignored":true},
+  {"patterns":["**/"],"path":"test/package-lock.json","ignored":true},
+  {"patterns":["**/"],"path":"Test/package-lock.json","ignored":true},
+  {"patterns":["**/"],"path":"tests/fixtures/app/package-lock.json","ignored":true},
+  {"patterns":["**/"],"path":"e2e/tests/package-lock.json","ignored":true},
+  {"patterns":["**/"],"path":"e2e/tests/keep/package-lock.json","ignored":true},
+  {"patterns":["**/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":true},
+  {"patterns":["**/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":true},
+  {"patterns":["**/"],"path":"a/fixtures/keep/yarn.lock","ignored":true},
+  {"patterns":["**/"],"path":"examples/demo/package-lock.json","ignored":true},
+  {"patterns":["**/"],"path":"examples/package-lock.json","ignored":true},
+  {"patterns":["**/"],"path":"docs/examples/package-lock.json","ignored":true},
+  {"patterns":["**/"],"path":"testdata/go.sum","ignored":true},
+  {"patterns":["**/"],"path":"pkg/testdata/go.sum","ignored":true},
+  {"patterns":["**/"],"path":"__fixtures__/x/package.json","ignored":true},
+  {"patterns":["**/"],"path":"a.lock/yarn.lock","ignored":true},
+  {"patterns":["**/"],"path":"foo bar/package-lock.json","ignored":true},
+  {"patterns":["**/"],"path":"x[1]/package-lock.json","ignored":true},
+  {"patterns":["/**/package-lock.json"],"path":"package-lock.json","ignored":true},
+  {"patterns":["/**/package-lock.json"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["/**/package-lock.json"],"path":"a/package-lock.json","ignored":true},
+  {"patterns":["/**/package-lock.json"],"path":"a/b/package-lock.json","ignored":true},
+  {"patterns":["/**/package-lock.json"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["/**/package-lock.json"],"path":"services/api/package-lock.json","ignored":true},
+  {"patterns":["/**/package-lock.json"],"path":"services/payments/package-lock.json","ignored":true},
+  {"patterns":["/**/package-lock.json"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["/**/package-lock.json"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["/**/package-lock.json"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["/**/package-lock.json"],"path":"test/package-lock.json","ignored":true},
+  {"patterns":["/**/package-lock.json"],"path":"Test/package-lock.json","ignored":true},
+  {"patterns":["/**/package-lock.json"],"path":"tests/fixtures/app/package-lock.json","ignored":true},
+  {"patterns":["/**/package-lock.json"],"path":"e2e/tests/package-lock.json","ignored":true},
+  {"patterns":["/**/package-lock.json"],"path":"e2e/tests/keep/package-lock.json","ignored":true},
+  {"patterns":["/**/package-lock.json"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["/**/package-lock.json"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["/**/package-lock.json"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["/**/package-lock.json"],"path":"examples/demo/package-lock.json","ignored":true},
+  {"patterns":["/**/package-lock.json"],"path":"examples/package-lock.json","ignored":true},
+  {"patterns":["/**/package-lock.json"],"path":"docs/examples/package-lock.json","ignored":true},
+  {"patterns":["/**/package-lock.json"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["/**/package-lock.json"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["/**/package-lock.json"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["/**/package-lock.json"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["/**/package-lock.json"],"path":"foo bar/package-lock.json","ignored":true},
+  {"patterns":["/**/package-lock.json"],"path":"x[1]/package-lock.json","ignored":true},
+  {"patterns":["services/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["services/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["services/"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["services/"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["services/"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["services/"],"path":"services/api/package-lock.json","ignored":true},
+  {"patterns":["services/"],"path":"services/payments/package-lock.json","ignored":true},
+  {"patterns":["services/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":true},
+  {"patterns":["services/"],"path":"legacy/requirements.txt","ignored":false},
+  {"patterns":["services/"],"path":"Legacy/requirements.txt","ignored":false},
+  {"patterns":["services/"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["services/"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["services/"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["services/"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["services/"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["services/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["services/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["services/"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["services/"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["services/"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["services/"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["services/"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["services/"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["services/"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["services/"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["services/"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["services/"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["#comment","legacy/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["#comment","legacy/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["#comment","legacy/"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["#comment","legacy/"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["#comment","legacy/"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["#comment","legacy/"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["#comment","legacy/"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["#comment","legacy/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["#comment","legacy/"],"path":"legacy/requirements.txt","ignored":true},
+  {"patterns":["#comment","legacy/"],"path":"Legacy/requirements.txt","ignored":true},
+  {"patterns":["#comment","legacy/"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["#comment","legacy/"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["#comment","legacy/"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["#comment","legacy/"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["#comment","legacy/"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["#comment","legacy/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["#comment","legacy/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["#comment","legacy/"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["#comment","legacy/"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["#comment","legacy/"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["#comment","legacy/"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["#comment","legacy/"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["#comment","legacy/"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["#comment","legacy/"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["#comment","legacy/"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["#comment","legacy/"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["#comment","legacy/"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["\\#x","legacy/"],"path":"package-lock.json","ignored":false},
+  {"patterns":["\\#x","legacy/"],"path":"Cargo.lock","ignored":false},
+  {"patterns":["\\#x","legacy/"],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["\\#x","legacy/"],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["\\#x","legacy/"],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["\\#x","legacy/"],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["\\#x","legacy/"],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["\\#x","legacy/"],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["\\#x","legacy/"],"path":"legacy/requirements.txt","ignored":true},
+  {"patterns":["\\#x","legacy/"],"path":"Legacy/requirements.txt","ignored":true},
+  {"patterns":["\\#x","legacy/"],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["\\#x","legacy/"],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["\\#x","legacy/"],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["\\#x","legacy/"],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["\\#x","legacy/"],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["\\#x","legacy/"],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["\\#x","legacy/"],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["\\#x","legacy/"],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["\\#x","legacy/"],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["\\#x","legacy/"],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["\\#x","legacy/"],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["\\#x","legacy/"],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["\\#x","legacy/"],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["\\#x","legacy/"],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["\\#x","legacy/"],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["\\#x","legacy/"],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["\\#x","legacy/"],"path":"x[1]/package-lock.json","ignored":false},
+  {"patterns":["legacy/   "],"path":"package-lock.json","ignored":false},
+  {"patterns":["legacy/   "],"path":"Cargo.lock","ignored":false},
+  {"patterns":["legacy/   "],"path":"a/package-lock.json","ignored":false},
+  {"patterns":["legacy/   "],"path":"a/b/package-lock.json","ignored":false},
+  {"patterns":["legacy/   "],"path":"a/b/c/yarn.lock","ignored":false},
+  {"patterns":["legacy/   "],"path":"services/api/package-lock.json","ignored":false},
+  {"patterns":["legacy/   "],"path":"services/payments/package-lock.json","ignored":false},
+  {"patterns":["legacy/   "],"path":"services/payments/sub/pnpm-lock.yaml","ignored":false},
+  {"patterns":["legacy/   "],"path":"legacy/requirements.txt","ignored":true},
+  {"patterns":["legacy/   "],"path":"Legacy/requirements.txt","ignored":true},
+  {"patterns":["legacy/   "],"path":"test/package-lock.json","ignored":false},
+  {"patterns":["legacy/   "],"path":"Test/package-lock.json","ignored":false},
+  {"patterns":["legacy/   "],"path":"tests/fixtures/app/package-lock.json","ignored":false},
+  {"patterns":["legacy/   "],"path":"e2e/tests/package-lock.json","ignored":false},
+  {"patterns":["legacy/   "],"path":"e2e/tests/keep/package-lock.json","ignored":false},
+  {"patterns":["legacy/   "],"path":"crates/x/tests/fixtures/app/Cargo.lock","ignored":false},
+  {"patterns":["legacy/   "],"path":"crates/x/fixtures/keep/Cargo.lock","ignored":false},
+  {"patterns":["legacy/   "],"path":"a/fixtures/keep/yarn.lock","ignored":false},
+  {"patterns":["legacy/   "],"path":"examples/demo/package-lock.json","ignored":false},
+  {"patterns":["legacy/   "],"path":"examples/package-lock.json","ignored":false},
+  {"patterns":["legacy/   "],"path":"docs/examples/package-lock.json","ignored":false},
+  {"patterns":["legacy/   "],"path":"testdata/go.sum","ignored":false},
+  {"patterns":["legacy/   "],"path":"pkg/testdata/go.sum","ignored":false},
+  {"patterns":["legacy/   "],"path":"__fixtures__/x/package.json","ignored":false},
+  {"patterns":["legacy/   "],"path":"a.lock/yarn.lock","ignored":false},
+  {"patterns":["legacy/   "],"path":"foo bar/package-lock.json","ignored":false},
+  {"patterns":["legacy/   "],"path":"x[1]/package-lock.json","ignored":false}
+]}
diff --git a/crates/socket-patch-node/npm/index.d.ts b/crates/socket-patch-node/npm/index.d.ts
index e5fc61dc..c70f28fa 100644
--- a/crates/socket-patch-node/npm/index.d.ts
+++ b/crates/socket-patch-node/npm/index.d.ts
@@ -9,8 +9,14 @@ export interface PathSelection {
   symlinks: string[]           // candidate paths that are symlinks (mode 120000) — refuse-to-write
   ignoredCount: number
   ignoredSample: { path: string; reason: string }[]   // ≤100
+  policyPaths: string[]        // root socket.yml / socket.yaml the tree lists (also in fetchText or symlinks); pass back as the session's policyPaths
+  policySha256: string | null  // the policy file selection applied (null: none, empty, or noSocketYml); pass back as the session's policySha256
+  policyError?: { code: 'socket_yml_invalid' | 'socket_yml_ambiguous'; detail: string }   // nothing selected
 }
-export function selectHostedScanPaths(entries: TreeEntryInput[], options?: { projectRoots?: string[]; ecosystems?: Ecosystem[] }): PathSelection
+// Fetch every root socket.yml / socket.yaml the listing holds first and pass it in policyFiles: selection applies the full socket.yml path policy.
+// text must decode losslessly (buffer.toString('utf8'); TextDecoder drops a BOM and the session then sees different content). Excluded roots are reported in ignoredSample, not streamed.
+export type PolicyFileInput = { path: string; text: string } | { path: string; missing: true }
+export function selectHostedScanPaths(entries: TreeEntryInput[], options?: { projectRoots?: string[]; ecosystems?: Ecosystem[]; policyFiles?: PolicyFileInput[]; noSocketYml?: boolean }): PathSelection
 export function hostedScanCandidateFiles(): string[]    // debug listing only
 export function engineVersion(): string                  // "<crate version>+<git sha or 'unknown'>"
 
@@ -48,6 +54,10 @@ export interface HostedScanSessionOptions {
   providerConcurrency?: number     // default 8
   requestTimeoutMs?: number        // per provider call, default 60000
   limits?: HostedScanLimits
+  noSocketYml?: boolean            // ignore the repo's socket.yml (built-in test/fixture ignores still apply); default false
+  minSeverity?: 'critical' | 'high' | 'medium' | 'moderate' | 'low' | 'none'   // beats socket.yml patches.minSeverity
+  policyPaths?: string[]           // selectHostedScanPaths' policyPaths; each must be streamed with content or the session returns policyError
+  policySha256?: string            // selectHostedScanPaths' policySha256; a policy file that differs (or arrives without it) is a policyError
 }
 export class HostedScanSession {
   constructor(options: HostedScanSessionOptions, provider: PatchProvider)
@@ -63,7 +73,7 @@ export interface ProjectResult {
   redirect: Record<string, unknown>                   // same shape as CLI `--json` `redirect` block
   summary: { scannedPackages: number; packagesWithPatches: number; totalPatches: number; freePatches: number; paidPatches: number; canAccessPaidPatches: boolean }
   redirected: { purl: string; uuid: string }[]
-  skipped: { purl: string; uuid: string; reason: string; detail?: string }[]
+  skipped: { purl: string; uuid: string; reason: string; detail?: string }[]   // reasons include the policy_* codes
   error?: { code: string; message: string }           // project-level failure (e.g. corrupt_ledger, patch_lookup_failed)
 }
 export interface HostedScanResult {
@@ -74,6 +84,19 @@ export interface HostedScanResult {
   warnings: EngineWarning[]
   stats: { projects: number; filesInput: number; bytesInput: number; packagesScanned: number; packagesWithPatches: number; patchesSelected: number; patchesRedirected: number; filesChanged: number; providerCalls: Record<string, number>; phaseMs: Record<string, number> }
   engineVersion: string
+  policy?: PolicyBlock                                         // absent only with policyError
+  policyError?: { code: 'socket_yml_invalid' | 'socket_yml_ambiguous'; detail: string }   // no root processed, no file changed
+}
+export type PolicyReason = 'policy_disabled' | 'policy_path_excluded' | 'policy_path_not_included' | 'policy_ecosystem' | 'policy_package_not_listed' | 'policy_package_ignored' | 'policy_severity'
+export interface PolicyBlock {
+  source: 'none' | 'file' | 'bypassed'
+  path: string | null
+  sha256: string | null
+  enabled: boolean
+  minSeverity: { value: 'critical' | 'high' | 'medium' | 'low' | null; source: 'flag' | 'env' | 'file' | 'default' }
+  counts: { filtered: number; retained: number }
+  filtered: { purl: string | null; uuid: string | null; project: string; reason: PolicyReason; detail: string }[]
+  retained: { purl: string; project: string; recordedUuid: string; reason: PolicyReason; detail: string; upgradeAvailable: boolean }[]
 }
 
 export class SocketPatchAddonUnavailableError extends Error {
diff --git a/docs/design/configuration.md b/docs/design/configuration.md
index 4c4a617c..555b1db4 100644
--- a/docs/design/configuration.md
+++ b/docs/design/configuration.md
@@ -1,7 +1,8 @@
 # Configuration design: env vars, the socket-cli config file, and what we deliberately don't read
 
 Status: **implemented** (v3.5); section 4 (`socket.yml` patch policy) is
-**planned** for v5.0 (see `staged-rollout.md`). This document records the
+**implemented** in v5.0 for its filters (`socket_patch_core::policy`; the
+per-run cap follows with `--max-new-patches`, see `staged-rollout.md`). This document records the
 settled design so future configuration surface grows inside it instead of
 inventing new mechanisms.
 
@@ -113,6 +114,14 @@ The trust boundary is unchanged and gains its positive half:
   `remove`, `repair`, `apply`, `vendor`) ignore it; `get` bypasses it with
   a warning.
 
+Implementation: `socket_patch_core::policy` (`SelectionPolicy::load` over a
+`PolicyFs`: `DiskPolicyFs` for a checkout, `MemoryPolicyFs` for the
+in-memory engine) parses the file as a YAML 1.2 event stream (serde-saphyr's
+parser, so aliases are never expanded) and validates only `version`,
+`projectIgnorePaths` and `patches`. Disk scan glue lives in
+`commands/scan/policy.rs`; the flags in `commands/scan/socket_yml_args.rs`.
+The full contract is CLI_CONTRACT.md "socket.yml patch policy".
+
 ## Explicitly rejected
 
 | Idea | Why not |
@@ -149,6 +158,13 @@ The trust boundary is unchanged and gains its positive half:
 
 ## Test strategy (how this stays true)
 
+- socket.yml policy: table-driven unit tests in
+  `socket-patch-core/src/policy/` (every validation row, the lookup and
+  file-access rules, and a golden fixture generated from the npm `ignore`
+  package by `scripts/gen-ignore-golden.mjs`), the parser contract in
+  `tests/cli_parse_scan.rs`, disk e2e in `tests/e2e_socket_yml_policy.rs`
+  and disk/memory parity in `tests/hosted_memory_parity.rs`.
+
 - `tests/cli_config_fallback.rs` spawns the binary against fixture
   `config.json` files (fresh process per case — the disk read is cached per
   process) and pins: config token/apiBaseUrl authenticate, `defaultOrg`
diff --git a/docs/design/staged-rollout.md b/docs/design/staged-rollout.md
index 38f916e8..5a9c32ca 100644
--- a/docs/design/staged-rollout.md
+++ b/docs/design/staged-rollout.md
@@ -1019,6 +1019,85 @@ change), README (recipe R5, `--max-new-patches`), CHANGELOG
 - If B is ready before A merges, B ships with the file layer passed as
   `None` and wires it in a follow-up commit on its branch once A lands.
 
+### 9.4 Work item A: decisions made while building
+
+Gaps and contradictions A resolved with the smallest reasonable decision
+(each is also in A's PR description):
+
+1. **YAML crate.** `serde-saphyr` 1.3.0 (maintained, YAML 1.2), driven
+   through its re-exported event parser (`serde_saphyr::granit_parser`, no
+   extra dependency) into a small node tree. Aliases are never expanded, so
+   an alias bomb anywhere costs nothing, and anchors / aliases / merge keys /
+   custom tags are refused only inside `patches` and `projectIgnorePaths`
+   (an anchor in `issueRules` keeps working). Duplicate keys and the depth
+   bound are enforced while building the tree. `serde_norway` was not
+   picked: its libyaml core expands aliases with only a global repetition
+   limit and cannot refuse them per subtree. Unit tests prove each property.
+2. **Disk markers** are the in-memory engine's lock markers (plus the
+   Maven/NuGet markers disk scans support); manifests are not markers.
+   With `package.json` as a disk marker, `ignorePaths: ["**/package-lock.json"]`
+   would never exclude a disk root while excluding the same root in memory.
+3. **Whole-file errors.** YAML syntax, duplicate keys, a non-mapping top
+   level, depth and a second document are errors even without a `patches`
+   block (the file cannot be known not to have one). `patches: null` counts
+   as present for the version gate; a key under `patches` with no value is an
+   error, never "default".
+4. **`enabled: false`** reports recorded packages under `retained[]`
+   (`policy_disabled`) and every other candidate under `filtered[]`.
+5. **Floor vs recorded patch** (until B's `search_result_supersedes`): a
+   recorded package keeps its recorded patch when it outranks every
+   floor-admitted patch in the canonical ranking, or when nothing passes the
+   floor; otherwise the admitted winner is selected, exactly as without a
+   floor.
+6. **Retained packages** stay in the batch query (so `upgradeAvailable` can
+   be reported) but never reach selection or a writer.
+7. **PATH-glob matches under a default ignore** are still visited as roots
+   and root-filtered (one `purl: null` entry), so a recorded patch there is
+   reported as retained.
+8. **In-memory engine gaps until B lands its recorded view**: `retained[]`
+   is empty and the floor rule of item 5 cannot see recorded pins (filtered
+   packages' pins stay byte-identical regardless: the rewriters only touch
+   selected dependencies). A root named in `projectRoots` is explicit and
+   skips the defaults. There is no case-variant warning in memory
+   (selection reads exact names only). `ProjectResult.skipped[]` carries the post-lookup policy reasons
+   (severity, disabled); the pre-lookup ones are in the session `policy`
+   block only.
+9. **Session option `policyPaths`** (selection's list, handed back like
+   `projectRoots`) is how the session tells "listed but never sent" from
+   absent. Two-phase selection (7.2) names its outputs: selection returns
+   `policySha256` (`null` without a file) and the session takes it as an
+   option, since 7.2 does not say how the session learns what the
+   selector saw; a session that reads a policy file without it fails
+   closed. Selection also takes `noSocketYml` so both sides bypass
+   together; a bypassed session given a digest fails closed. A root the
+   selector excludes is reported in its `ignoredSample` with the
+   `policy_*` reason and never streamed (streaming its markers would count
+   every fixture lockfile against `maxFiles`), so in memory
+   `policy.filtered[]` lists only the roots the session received.
+10. **Env layer of `--min-severity`** is read by scan, not clap, so the
+    `policy` block can say `source: "env"`; a malformed env value exits 2 at
+    run time, a malformed flag at parse time.
+11. **README recipes**: R2-R4 and R6 ship without `maxNewPatches` lines (A
+    validates the key but does not enforce the cap); R1 and R5 come with B.
+12. **`get`'s `policy_bypassed`** is one warning per package; the severity
+    reason fires only when none of the package's patches passes the floor.
+13. **Repo-root trust** (review follow-up): root trusts every `.git` owner
+    and `SUDO_UID`'s user is trusted, so a root CI container over a checkout
+    owned by another uid still applies the policy (distrust would drop a
+    policy that only narrows). A `.git` symlink counts, as in git.
+14. **A disk root with no lockfile** uses its manifests as markers, so
+    `includePaths: ["/*", "!/*/"]` can match a lockfile-less repo root.
+15. **Top-level typos and merge keys fail closed**: a key within two edits
+    of `patches` starting `pat`/`pac`, and a top-level `<<` or aliased key,
+    are errors (another YAML reader could see a `patches` block there).
+16. **Report-only `--json`** fetches patch details only when a floor or
+    `enabled: false` could withhold something, so its `filtered[]` matches
+    the human output.
+17. **What the floor reports**: the top-ranked patch it withheld, when the
+    package ends up unpatched or held at its recorded patch; not when a
+    lower-ranked admitted patch wins. A kept recorded patch that is itself
+    below the floor is not a skip.
+
 ## 10. Open questions (decided by default, revisit with evidence)
 
 - A separate upgrade cap (`maxUpgrades`) if server-side republishes rotate
diff --git a/scripts/gen-ignore-golden.mjs b/scripts/gen-ignore-golden.mjs
new file mode 100644
index 00000000..35bedac3
--- /dev/null
+++ b/scripts/gen-ignore-golden.mjs
@@ -0,0 +1,113 @@
+// Regenerates crates/socket-patch-core/tests/fixtures/ignore_golden.json:
+// the (patterns, path, ignored) table the socket.yml path matcher must
+// agree with. The expected values come from the npm `ignore` package, the
+// matcher the Socket backend applies to `projectIgnorePaths`.
+//
+//   cd "$(mktemp -d)" && npm init -y >/dev/null && npm i ignore@7.0.10 \
+//     && NODE_PATH="$PWD/node_modules" node /path/to/scripts/gen-ignore-golden.mjs
+import { createRequire } from 'node:module'
+import { writeFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const require = createRequire(join(process.env.NODE_PATH ?? '.', 'x.js'))
+const ignore = require('ignore')
+const version = require('ignore/package.json').version
+
+const paths = [
+  'package-lock.json',
+  'Cargo.lock',
+  'a/package-lock.json',
+  'a/b/package-lock.json',
+  'a/b/c/yarn.lock',
+  'services/api/package-lock.json',
+  'services/payments/package-lock.json',
+  'services/payments/sub/pnpm-lock.yaml',
+  'legacy/requirements.txt',
+  'Legacy/requirements.txt',
+  'test/package-lock.json',
+  'Test/package-lock.json',
+  'tests/fixtures/app/package-lock.json',
+  'e2e/tests/package-lock.json',
+  'e2e/tests/keep/package-lock.json',
+  'crates/x/tests/fixtures/app/Cargo.lock',
+  'crates/x/fixtures/keep/Cargo.lock',
+  'a/fixtures/keep/yarn.lock',
+  'examples/demo/package-lock.json',
+  'examples/package-lock.json',
+  'docs/examples/package-lock.json',
+  'testdata/go.sum',
+  'pkg/testdata/go.sum',
+  '__fixtures__/x/package.json',
+  'a.lock/yarn.lock',
+  'foo bar/package-lock.json',
+  'x[1]/package-lock.json',
+]
+
+const sets = [
+  [],
+  ['/package-lock.json'],
+  ['package-lock.json'],
+  ['**/yarn.lock'],
+  ['examples/**'],
+  ['examples/'],
+  ['/examples/'],
+  ['examples'],
+  ['crates/x/fixtures/**'],
+  ['crates/*/tests/fixtures/**'],
+  ['/legacy/'],
+  ['legacy/'],
+  ['/services/payments/'],
+  ['/services/*/'],
+  ['services/**/package-lock.json'],
+  ['/*', '!/*/'],
+  ['*', '!*/'],
+  ['fixtures/', '!/a/fixtures/keep/'],
+  ['fixtures/', '!fixtures/'],
+  ['test/', 'tests/', 'fixtures/', '__fixtures__/', 'testdata/'],
+  ['test/', 'tests/', 'fixtures/', '__fixtures__/', 'testdata/', '!/e2e/tests/'],
+  ['test/', 'tests/', 'fixtures/', '__fixtures__/', 'testdata/', '!tests/'],
+  ['test/', 'tests/', 'fixtures/', '__fixtures__/', 'testdata/', '/legacy/'],
+  ['a/', '!a/b/'],
+  ['a/*', '!a/b/'],
+  ['a/**', '!a/b/**'],
+  ['a/**/yarn.lock'],
+  ['**/b/**'],
+  ['*.lock'],
+  ['*.json', '!package-lock.json'],
+  ['!package-lock.json'],
+  ['a/b'],
+  ['/a/b/'],
+  ['b/'],
+  ['**/c/'],
+  ['LEGACY/'],
+  ['Services/API/'],
+  ['foo bar/'],
+  ['foo\\ bar/'],
+  ['x\\[1\\]/'],
+  ['x[1]/'],
+  ['?.lock/'],
+  ['a.lock/'],
+  ['a/b/c/'],
+  ['**'],
+  ['**/'],
+  ['/**/package-lock.json'],
+  ['services/'],
+  ['#comment', 'legacy/'],
+  ['\\#x', 'legacy/'],
+  ['legacy/   '],
+]
+
+const cases = []
+for (const patterns of sets) {
+  const ig = ignore().add(patterns)
+  for (const path of paths) {
+    cases.push({ patterns, path, ignored: ig.ignores(path) })
+  }
+}
+
+const here = dirname(fileURLToPath(import.meta.url))
+const out = join(here, '..', 'crates', 'socket-patch-core', 'tests', 'fixtures', 'ignore_golden.json')
+const body = cases.map((c) => '  ' + JSON.stringify(c)).join(',\n')
+writeFileSync(out, `{"generator": "ignore@${version}", "cases": [\n${body}\n]}\n`)
+console.log(`wrote ${cases.length} cases to ${out}`)

From 180f10f248f53b11513964bd8648872944b0ecb7 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Tue, 29 Sep 2026 14:18:02 +0200
Subject: [PATCH 28/32] v5: cap new patches per scan, most critical first
 (#294)

* Plan staged patch rollout for v5

Adds the design for rolling Socket patches out gradually: a
`patches:` block in socket.yml that narrows what scan may patch
(paths, ecosystems, packages, severity floor, on/off), and a
severity-ordered per-run cap on new patches so each scan lands the
next few most critical fixes.

The plan splits the work into two parallel items with a frozen
interface, lists every hard-coded filter and where it belongs, and
covers the depscan autopatch follow-up. configuration.md now records
that socket-patch reads socket.yml for selection policy only, with
the trust boundary unchanged.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Revise rollout plan after adversarial review

Three independent reviews (ambiguity, churn, trust boundary) found
gaps that would have let the two implementations disagree or let a
repo file widen or stall the rollout. The plan now:

- matches paths against marker files with the backend's top-down
  gitignore rules, so projectIgnorePaths means the same everywhere
- uses one data source for severity, supersession and ordering
- spends the budget only on patches the planning pass proves can
  land, and admits nothing new when a lookup failed
- uses the merged recorded view in every mode and engine
- has depscan read the policy from the base commit for PR jobs
- hardens file handling (regular files, aliases, size, encoding,
  trusted repo root) and reports what a policy hides

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Close interface gaps in the rollout plan

A final consistency pass found places where the two work items
would have produced incompatible code: base purls admitted in one
directory being charged again in the next, no defined hand-off of
the unfiltered offers from the severity filter to classification,
no shared repo-relative path helper, and override sources the JSON
must report but the interface could not carry. The shared contract
now defines each of these, and the parity tests match each engine's
budget scope.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Clarify who shapes scan's selection output

The plan said both that the selector returns the shared offers
struct (work item A) and that it returns admitted/deferred rows
(work item B). The selector now returns the offers, and B adds the
rollout stage after it.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Add the rollout planner for capped scans

A new core module plans a capped scan: rows that already carry a
patch always go through, NEW packages are admitted most critical
first until the budget is spent, and the rest are deferred with
their rank. The order is total and uses no dates, so repeated scans
on an unchanged repo land the same patches and converge.

ranking gains search_result_supersedes, the by-package twin of
batch_supersedes, so ALREADY vs UPGRADE is judged on the same
records that pick the patch.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Add the socket.yml selection policy to core

New socket_patch_core::policy module: the SelectionPolicy, Offers and
repo-root helpers that the staged-rollout plan freezes as the shared
contract between the socket.yml work and the --max-new-patches work.

It reads the repo root's socket.yml/socket.yaml strictly and fails
closed: bad YAML, a misspelled `patches` block, unknown keys (with a
did-you-mean hint), wrong types, empty allowlists, bad globs and
anchors or aliases inside the keys we read are all errors that name
the key path. Path lists match marker files with npm `ignore`
semantics, walked top-down; a golden fixture generated from the npm
package pins that. The built-in test/fixture ignores become
overridable defaults for discovered roots.

--package matching moves to core so scan and the policy share it.

Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Cap new patches per scan, most critical first

scan gains --max-new-patches <N|none> (env SOCKET_MAX_NEW_PATCHES).
Each selected package is classified against the recorded state
(manifest, hosted pins, vendor ledger): packages that already carry a
patch always go through, and an already-applied patch is kept unless
the selection really supersedes it, so re-scans never swap patches.
Packages getting their first patch are admitted most severe first
until the budget is spent; the rest are deferred to the next scan.

Hosted, vendored and agent runs decide eligibility with their own
write-free checks before any budget is spent, so a patch that cannot
land never holds a slot. Several PATH directories share one budget.
--json reports a rollout block, deferred rows show up in
redirect.skipped[] as rollout_deferred, and human output adds a
Rollout line and a Next up list. updates[] now uses the by-package
records.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Test the scan cap end to end in every mode

Nine packages under a cap of three roll forward three per run in
hosted, agent and vendored mode, most severe first, and a fourth run
changes nothing. The dry run predicts the wet run, upgrades land with
a cap of zero, patches that cannot land hold no slot, a failed lookup
admits nothing new, and several project directories share one budget.

A hosted pin on a patch server scan does not recognize still counts
as applied when the lockfile names its patch uuid, so the rollout
cannot stall on a missing --patch-server-url.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Honor socket.yml patch policy in disk scans

scan now reads the repo root's socket.yml before any write and applies
its patches block in hosted, vendored and agent mode, --dry-run
included: path filters on project roots (PATH-glob matches also get
the built-in test/fixture ignores), ecosystem and package filters on
crawled packages, and a severity floor on the patches a package may
receive. An invalid or ambiguous file fails the run with exit 1 and
an errorCode before any request.

Packages that already carry a patch are never removed, upgraded or
replaced by the policy: they are held and reported under
policy.retained. A recorded patch below a new floor stays in place.
patches.enabled: false reports what would be patched and writes
nothing.

New flags: --no-socket-yml / SOCKET_NO_SOCKET_YML and
--min-severity / SOCKET_MIN_SEVERITY. Every successful scan --json
result gains a top-level policy block. A PATH outside the repository
root is a usage error.

Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Cap new patches in the in-memory hosted engine

The napi engine and hosted-bundle take maxNewPatches (a count or
"none"), maxNewPatchesCap (a server ceiling that only tightens) and
inFlightPatches (ranked first). One budget spans every project root:
the engine classifies each root against its committed manifest,
vendor ledger and the hosted pins its lockfiles name, plans once
after every root's write-free checks, and rewrites a root again
without its deferred rows. Results gain a session-level rollout
block and ProjectResult.deferred; deferred rows also appear in
skipped[] as rollout_deferred.

Parity tests hold disk and memory to the same rollout and redirect
blocks run after run until converged, and show memory's run-wide
budget beside disk's per-directory one.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Document the per-run cap on new patches

CLI_CONTRACT.md gains the limit's semantics (classification,
eligibility, unit, budget scope, order, convergence), the flag and env
rows, the rollout block, rollout_deferred and a jq recipe; "Which
patch gets selected" now describes the by-package supersession and the
separate cross-package order. README adds a gradual-rollout task and
the flag row; CHANGELOG adds both entries. The design doc records the
gaps B decided.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Apply socket.yml policy in the in-memory engine

selectHostedScanPaths now streams the root socket.yml/socket.yaml and
returns them as policyPaths; it drops test and fixture trees through
the policy's built-in default ignores instead of a hard-coded segment
list (structural excludes like node_modules and vendor stay fixed).

The session reads the policy before any root is processed: path
filters run before the project limit, ecosystem and package filters
on each root's packages, and the severity floor before selection. A
listed policy file that arrives without content, or an invalid one,
yields policyError with no root processed and no file changed. New
options noSocketYml, minSeverity and policyPaths; the result gains a
policy block. hosted-bundle and index.d.ts carry the new fields.

get now warns policy_bypassed when the repo's socket.yml would have
skipped the package it patches.

Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Document the socket.yml patch policy

CLI_CONTRACT.md gains a "socket.yml patch policy" section (grammar,
precedence, paths, lookup, validation, commands, error codes and the
policy JSON block), the flag and env rows, and the "narrow or pace"
half of the trust-boundary rule. README adds a "Roll out gradually"
section with copyable socket.yml recipes, CHANGELOG lists the new
policy and the breaking scan changes, and the design docs record the
decisions made while building it.

Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Fix rollout review findings

The recorded view is now an index built once per project and keyed
like discovery (case-folded nuget/composer, PEP 503 pypi names), and it
keeps every hosted pin, so a case-folded pin or a pair of pinned
qualifier twins no longer reads as NEW or as a phantom upgrade. The
hosted gate uses key sets instead of linear scans, takes the apply lock
for rows an earlier directory admitted, and error envelopes drop the
rollout block. The in-memory engine keeps the first pass's skips when
it rewrites a root again, and a root whose lookups all failed freezes
new admissions. Human output words dry runs, incomplete lookups, zero
caps and shared budgets correctly, an explicit flag no longer reads
the env value, and the docs say the socket.yml layer arrives with the
patch policy. New tests cover reference failures, upgrades under a cap
of zero in hosted mode, recorded packages with failed lookups, and
stronger dry-run and parity checks.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Harden the socket.yml policy after review

Fixes from an adversarial self-review of the policy work:

- A non-ASCII package spec no longer panics validation, and error
  text, warnings and verbose lines drop terminal escapes and bidi or
  zero-width characters.
- Ignore lists that fail to compile together are an error instead of
  silently matching nothing, and the policy file is opened by its
  resolved path without following a swapped-in symlink.
- A top-level key that looks like a misspelled `patches` (`patchs`),
  a top-level merge key or an aliased key now fails closed.
- Repo-root lookup follows a `.git` symlink and trusts the checkout
  owner under root and sudo, so CI containers keep the policy.
- The severity floor always reports the patch it held back, report-
  only --json runs report what a floor or `enabled: false` hides, a
  root skipped as a whole is always one entry and no longer prints
  "No packages found", warnings print once per invocation, and the
  policy line is omitted when there is nothing to say.
- policy entries are sorted and use canonical purls on disk and in
  memory; the in-memory engine applies a socket.yml negation of a
  built-in ignore to roots it was given, and policyError carries no
  CLI-only remedy.
- A lockfile-less disk root matches path filters by its manifests.

Tests cover each fix, plus the prune universe, agent path filters, a
vendored package held byte-identical, and tighter oracles; docs are
corrected where they overstated what the human output names.

Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Match zero-cap test to dry-run wording

The dry-run tense fix changed the deferred line to "would be
deferred"; the unit test still expected the wet-run wording.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Give the release test job more time

The optimized test job now has to build two more crates and one more
test binary for the socket.yml policy. It ran out of time on its last
40 minutes, about a minute short, and a docs-only change already takes
38. Raise the limit to 50 minutes so it can finish.

Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Apply socket.yml paths during memory selection

The merged plan makes in-memory path selection two-phase: the host
fetches the root socket.yml first and passes its text to
selectHostedScanPaths. Selection now applies the full path policy, so
a negation such as `!/e2e/tests/` brings a test tree back in memory
exactly as on disk. A listed policy file that is missing, symlinked
or invalid returns policyError with nothing selected.

Selection returns policySha256, and the session fails closed when the
policy it reads differs. Roots the policy excludes keep their marker
files presence-only, so the session still lists them as filtered.

Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Keep excluded roots out of the memory stream

Review follow-ups to two-phase selection:

- Roots the policy excludes are reported in ignoredSample instead of
  streamed presence-only, so a repo with many fixture lockfiles no
  longer runs into the session's file limit.
- A session that bypasses socket.yml while selection applied it now
  fails closed instead of processing roots it never fetched.
- The docs say policy text must decode losslessly (TextDecoder drops
  a BOM) and when policySha256 is null.

Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Keep scan -h short with the policy flags

The v5 help rules cap each command's short help at about eight
options. `--no-socket-yml` and `--min-severity` pushed `scan -h` to
ten, so they now appear only in `scan --help`, like the other
advanced scan flags.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3

* v5: keep scan -h within the option budget

The staged-rollout and socket.yml flags pushed scan's short help past
nine options once #279 trimmed -h. --max-new-patches and
--no-socket-yml now show only in --help and parse as before.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Fail report-only JSON when detail queries fail

A report-only `scan --json` (`--prune` with no mode) with a severity
floor or `enabled: false` fetches patch details to fill
`policy.filtered[]`. If every query failed it still printed a success
envelope and exited 0. It now reports the error and exits 1, like the
agent and vendored runs.

Human-mode policy warnings now print `Warning: <detail>` like the rest
of `scan`; the code stays in the JSON `warnings[]` entry.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BKsyzefGhAnPkYmXCwq3H3

---------

Co-authored-by: Claude <noreply@anthropic.com>
---
 CHANGELOG.md                                  |   33 +-
 README.md                                     |   43 +-
 crates/socket-patch-cli/CLI_CONTRACT.md       |   83 +-
 crates/socket-patch-cli/src/commands/get.rs   |    2 +
 .../src/commands/hosted_bundle.rs             |   13 +-
 .../src/commands/scan/discovery.rs            |   56 +-
 .../src/commands/scan/hosted.rs               |  204 +++-
 .../socket-patch-cli/src/commands/scan/mod.rs |  400 +++++--
 .../src/commands/scan/rollout.rs              |  649 +++++++++++
 .../src/commands/scan/rollout_args.rs         |  128 ++
 .../src/commands/scan/vendor_flow.rs          |   64 +-
 crates/socket-patch-cli/src/lib.rs            |    1 +
 .../socket-patch-cli/tests/cli_parse_scan.rs  |   61 +
 .../tests/hosted_memory_common/mod.rs         |   92 +-
 .../tests/hosted_memory_rollout.rs            |  639 ++++++++++
 .../tests/in_process_cargo_apply.rs           |    3 +
 .../tests/in_process_gem_apply.rs             |    2 +
 .../tests/in_process_gem_multi_platform.rs    |    1 +
 .../tests/in_process_pypi_apply.rs            |    4 +
 .../tests/in_process_pypi_multi_release.rs    |    1 +
 .../tests/in_process_python_envs.rs           |    1 +
 .../tests/in_process_redirect.rs              |    1 +
 .../tests/in_process_redirect_pdm.rs          |    1 +
 .../tests/in_process_redirect_pipenv.rs       |    1 +
 .../tests/in_process_redirect_pnpm.rs         |    1 +
 .../tests/in_process_redirect_poetry.rs       |    1 +
 .../in_process_remote_ecosystems_apply.rs     |    1 +
 .../tests/in_process_rollback_hosted.rs       |    1 +
 .../socket-patch-cli/tests/in_process_scan.rs |    1 +
 .../tests/in_process_vendor.rs                |    1 +
 .../tests/scan_rollout_e2e.rs                 | 1038 +++++++++++++++++
 crates/socket-patch-core/src/api/ranking.rs   |   57 +-
 crates/socket-patch-core/src/hosted/engine.rs |    2 +-
 .../src/hosted/memory/discover.rs             |   38 +-
 .../src/hosted/memory/limits.rs               |   27 +
 .../src/hosted/memory/mod.rs                  |  248 +++-
 .../src/hosted/memory/select.rs               |    6 +-
 .../src/hosted/memory/stages.rs               |    4 +-
 .../src/hosted/memory/types.rs                |   82 ++
 crates/socket-patch-core/src/hosted/vlt.rs    |    2 +-
 crates/socket-patch-core/src/ledgers.rs       |   54 +
 crates/socket-patch-core/src/lib.rs           |    1 +
 crates/socket-patch-core/src/rollout.rs       |  696 +++++++++++
 crates/socket-patch-core/src/rollout/stage.rs |  505 ++++++++
 .../src/vendor/lock_inventory/view.rs         |    1 -
 crates/socket-patch-node/npm/index.d.ts       |   13 +-
 crates/socket-patch-node/npm/test/smoke.mjs   |   18 +
 docs/design/staged-rollout.md                 |   70 ++
 48 files changed, 5110 insertions(+), 241 deletions(-)
 create mode 100644 crates/socket-patch-cli/src/commands/scan/rollout.rs
 create mode 100644 crates/socket-patch-cli/src/commands/scan/rollout_args.rs
 create mode 100644 crates/socket-patch-cli/tests/hosted_memory_rollout.rs
 create mode 100644 crates/socket-patch-cli/tests/scan_rollout_e2e.rs
 create mode 100644 crates/socket-patch-core/src/rollout.rs
 create mode 100644 crates/socket-patch-core/src/rollout/stage.rs

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1c261cf8..aec6c862 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -678,14 +678,34 @@ into the new version's section — see docs/releasing.md.
 
 ### Added
 
+- **`scan --max-new-patches <N|none>` rolls patches out gradually**
+  (env `SOCKET_MAX_NEW_PATCHES`; socket.yml `patches.maxNewPatches`).
+  Each run adds at most N patches to packages that had none, most severe first
+  (then by how many advisories a patch fixes), and defers the rest to the
+  next run; upgrades of packages that are already patched are never
+  capped, and `0` means upgrades only. Repeated scans on an unchanged repo
+  add the same packages in the same order and stop once everything is
+  patched. A patch that cannot land (not granted, refused by a preflight,
+  nothing in the lockfile to pin) never holds a slot, and a failed lookup
+  admits nothing new that run (`rollout_incomplete_lookup`). The project
+  directories of one scan share the budget. Works in hosted, vendored and
+  agent mode, `--dry-run` included; `scan --json` gains a top-level
+  `rollout` block (`maxNewPatches`, `counts`, ranked `deferred[]`) and
+  hosted mode lists deferred rows in `redirect.skipped[]` as
+  `rollout_deferred`.
+- **The in-memory hosted engine paces rollouts too.** It (napi,
+  `hosted-bundle`) takes
+  `maxNewPatches`, `maxNewPatchesCap` and `inFlightPatches`, spends one
+  budget across every project root, and reports a session `rollout` block
+  and `ProjectResult.deferred[]`.
 - **socket.yml patch policy (staged rollout).** A `patches` block in the
   repo-root socket.yml narrows what `scan` patches: `enabled` (false =
   report only), `includePaths` / `ignorePaths` (gitignore patterns matched
   against each project's lockfiles, npm `ignore` semantics),
   `ecosystems`, `packages` / `ignorePackages` (`--package` specs),
   `minSeverity` (critical|high|medium|moderate|low, judged by the worst
-  advisory a patch fixes) and `maxNewPatches` (validated; the per-run cap
-  lands with `--max-new-patches`). List flags (`--ecosystems`,
+  advisory a patch fixes) and `maxNewPatches` (the per-run cap of
+  `--max-new-patches`). List flags (`--ecosystems`,
   `--package`, PATHs) only narrow further; `--min-severity` beats the
   file's floor and `--no-socket-yml` ignores the file. A package
   that already carries a patch is never removed, upgraded or replaced by
@@ -1909,6 +1929,15 @@ into the new version's section — see docs/releasing.md.
 
 ### Changed
 
+- **`scan` keeps a patch you already have unless the new one supersedes
+  it.** A package whose recorded patch (agent manifest, hosted lockfile
+  pin or vendor ledger) still ranks level with the top offer on every
+  meaningful rung (merged state, severity, a later publish date) keeps
+  its recorded patch instead of switching on the tier or uuid tiebreak,
+  so re-running `scan` never swaps patches. `updates[]` and the
+  `[UPDATE]` marker now use the per-package records the selection itself
+  uses, so they list exactly the upgrades the run applies; a JSON
+  report-only run still reads the batch records.
 - **Fewer downloads in vendored runs.** A vendored run now asks the patch
   service for all of its planned packages' download references in one
   request (in chunks of 500) from the first package it reaches, in place
diff --git a/README.md b/README.md
index 6cb2ba7c..6305f33b 100644
--- a/README.md
+++ b/README.md
@@ -257,7 +257,13 @@ the same way everywhere, from the patches your account can download:
 
 "Newest" is when the patch was published, not the package version. When a better patch
 appears for a package you already patched, the JSON `updates[]` array lists it and the
-next `scan` in the same mode takes it.
+next `scan` in the same mode takes it. A patch that only wins on the tier or UUID
+tiebreak never replaces one you already have, so re-running `scan` never swaps patches.
+
+This order picks the patch *for* a package. When a capped scan
+([`--max-new-patches`](#add-a-few-new-patches-per-run)) has to choose *which packages*
+get their first patch, it takes the most severe first, then the ones fixing the most
+advisories.
 
 ### State in `.socket/`
 
@@ -416,6 +422,37 @@ hosted and vendored mode each PATH is a project directory, scanned as if it were
 To make the choice stick for everyone who runs `scan` in the repo (CI and the Socket
 autopatch bot included), put it in `socket.yml` instead — see
 [Roll out gradually](#roll-out-gradually-with-socketyml).
+### Add a few new patches per run
+
+```bash
+socket-patch scan --max-new-patches 5          # at most 5 packages get their first patch
+socket-patch scan --max-new-patches 0          # only upgrade patches you already have
+socket-patch scan --max-new-patches none       # no cap this run
+```
+
+A capped scan patches the most critical packages first: by the severity of the patch,
+then by how many advisories it fixes. Upgrades of packages that are already patched are
+never capped. Commit the result and run `scan` again to add the next batch; repeated
+runs on an unchanged repo add the same packages in the same order and stop once
+everything is patched. `--dry-run` shows exactly what the run would add and defer, and
+`--json` reports it under `rollout` (`jq '.rollout.counts.deferred'`). In hosted and
+vendored mode, several project directories in one run (`scan apps/*`) share the cap,
+visited in sorted order; `--json` takes one directory, so a CI job per directory gets
+its own N.
+
+To drip patches in through a PR bot, set the cap once in the repo's `socket.yml`
+(part of its [`patches:` policy](#roll-out-gradually-with-socketyml); the flag and
+`SOCKET_MAX_NEW_PATCHES` override it, and `--no-socket-yml` ignores it):
+
+```yaml
+# Weekly drip with the depscan autopatch PR
+version: 2
+patches:
+  maxNewPatches: 5        # the PR keeps the same 5 until merged, then the next 5
+```
+
+A cap only advances when the scan's changes are committed (or merged by a PR bot). In a
+CI job that scans without committing, set no cap.
 
 ### Patch one specific CVE or advisory
 
@@ -650,6 +687,7 @@ socket-patch scan [PATHS]... [options]
 | `--package <name\|purl>` | `SOCKET_SCAN_PACKAGES` | Only scan these packages: a name (`lodash`, `@scope/pkg`, `requests`; case-insensitive) or a purl with or without its version (`pkg:npm/lodash`, `pkg:pypi/requests@2.31.0`). Repeat the flag or separate with commas. |
 | `--prune` | — | Agent-mode garbage collection after the scan: remove manifest entries for packages no longer present in the crawl (installed trees + lockfiles — a wiped `node_modules` alone doesn't prune lockfile-listed entries) and delete orphan blob/diff-archive files (plus any legacy package archives). [Vendored](#vendor) packages are exempt from the crawl-based prune, but a vendored entry whose dependency has left the lockfile is reverted. Ignored, with a `redirect_prune_ignored` warning, in hosted mode; without a mode the scan is report-only. |
 | `--sync` | — | Shorthand for `--mode agent --prune`: the one-flag agent-mode auto-update run. |
+| `--max-new-patches <N\|none>` | `SOCKET_MAX_NEW_PATCHES` | Add at most N patches to packages that have none yet, most severe first; the rest are deferred to the next scan and listed in the output. Upgrades of already-patched packages are not capped. `0` adds no new patches, `none` means no cap (it also lifts a `socket.yml` `patches.maxNewPatches`). See [Add a few new patches per run](#add-a-few-new-patches-per-run). |
 | `--batch-size <n>` | `SOCKET_BATCH_SIZE` | Packages per API request (default: `500` on the authenticated API, `100` on the public proxy). A request whose body would exceed 256 KiB is split into smaller ones. |
 | `--min-severity <level>` | `SOCKET_MIN_SEVERITY` | Only patch packages whose patch fixes an advisory of at least `critical`, `high`, `medium` (or `moderate`) or `low`; `none` lifts the floor. Overrides `patches.minSeverity` in socket.yml. Patches of unknown severity are skipped whenever a floor is set. |
 | `--no-socket-yml` | `SOCKET_NO_SOCKET_YML` | Ignore the repo's socket.yml patch policy for this run (the built-in test/fixture directory ignores still apply). |
@@ -678,6 +716,9 @@ socket-patch scan --package lodash
 # Two projects of a monorepo
 socket-patch scan apps/web apps/api
 
+# Roll out gradually: at most 5 new patches, most critical first
+socket-patch scan --max-new-patches 5
+
 # Vendored mode: build + commit every patched dependency
 socket-patch scan --json --mode vendored
 
diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index 6d2e797d..e9e7d099 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -87,6 +87,7 @@ Beyond the globals above, each subcommand defines a small set of local arguments
 | `scan` | `--package <name\|purl>` (repeatable or comma-separated) | `SOCKET_SCAN_PACKAGES` | (v5.0) Only scan these packages: a name (`lodash`, `@scope/pkg`, `requests`, `group:artifact`; matched against the full name or its last segment, case-insensitively) or a purl with or without a version (`pkg:npm/lodash` matches every version, `pkg:pypi/requests@2.31.0` only that one). Qualifiers are ignored. Filters the crawl like `--ecosystems`, after the prune universe is captured, so `--prune` still judges the full crawl |
 | `scan` | `--vendor` | — | Vendor every patched dependency instead of applying in place (`--vendor` == `--mode vendored`; conflicts with `--apply`/`--sync`, combines with `--prune`). Vendored mode is manifest-free (v5.0): the vendor ledger embeds the patch records and `.socket/manifest.json` is never written. The former opt-in for exactly that, `--detached`, is removed in v5.0 (unknown-flag usage error) |
 | `scan` | `--batch-size` | `SOCKET_BATCH_SIZE` | API batch chunk size. Unset (v5.0): `500` on the authenticated API (the server's per-request maximum), `100` on the public proxy; a given value applies on either endpoint (`0` is floored to `1`). A chunk whose request body would exceed 256 KiB (the public proxy's body cap) is split into consecutive smaller chunks, deterministically (greedy, in crawl order). A mid-run downgrade to the proxy keeps the chunks already formed |
+| `scan` | `--max-new-patches <N\|none>` | `SOCKET_MAX_NEW_PATCHES` | (v5.0) Per-run cap on NEW patches (packages with no recorded patch in the project), most severe first; the rest are deferred to the next scan. `0` admits upgrades only, `none` (case-insensitive) is unlimited, absent is unlimited unless socket.yml sets `patches.maxNewPatches`. Precedence: flag > env > socket.yml > unlimited (`--no-socket-yml` drops the socket.yml layer). The env value is read at run time (the `rollout` block reports `flag` vs `env`): empty is unset, malformed is a usage error (exit 2, before any network access). Upgrades and already-applied patches are never capped. See "Per-run limit on new patches" below |
 | `scan` | `--no-socket-yml` | `SOCKET_NO_SOCKET_YML` | (v5.0) Ignore the repository's socket.yml patch policy (its `patches` block and `projectIgnorePaths`) for this run; the built-in test/fixture ignores still apply. The `policy` block reports `source: "bypassed"`. See "socket.yml patch policy". |
 | `scan` | `--min-severity <critical\|high\|medium\|moderate\|low\|none>` | `SOCKET_MIN_SEVERITY` | (v5.0) Severity floor for the patch a package may receive (worst advisory severity; unknown severity is skipped whenever a floor is set). Beats `patches.minSeverity`; the flag beats the env; `none` lifts the floor. A malformed value is exit 2. |
 | `get`, `scan` | `--all-releases` | `SOCKET_ALL_RELEASES` | Download patches for every release/distribution variant of a matched package — PyPI wheel/sdist (`artifact_id`), RubyGems (`platform`), Maven (`classifier`) — not just the one(s) matching the locally-installed distribution. On `scan` this makes the stored manifest portable across environments (e.g. cross-platform CI caches). On `get` (v3.6) it ALSO disables the coarse installed-**version** narrowing of CVE/GHSA fan-outs (see "get --mode and installed narrowing"): every found version's patch is fetched, installed or not |
@@ -194,7 +195,7 @@ patches:
   packages: ["pkg:npm/lodash"]      # allowlist in the --package grammar
   ignorePackages: ["pkg:npm/left-pad"]    # denylist in the --package grammar
   minSeverity: high                 # critical|high|medium|moderate|low (moderate = medium)
-  maxNewPatches: 5                  # integer 0..=4294967295; validated now, the per-run cap lands with `--max-new-patches`
+  maxNewPatches: 5                  # integer 0..=4294967295; the per-run cap of `--max-new-patches`
 ```
 
 - Deny wins: `ignorePackages` beats `packages`, ignore paths beat `includePaths`. An empty allowlist (`includePaths: []`, `ecosystems: []`, `packages: []`) is an error ("use `enabled: false`"), never "all".
@@ -258,6 +259,49 @@ patches:
 - `filtered[]` and `retained[]` are sorted by project, then purl; purls use the canonical spelling (qualifiers stripped, percent-decoded).
 - Exit code is unchanged by filtering.
 
+### Per-run limit on new patches (`scan --max-new-patches`, v5.0)
+
+`scan --max-new-patches <N|none>` (env `SOCKET_MAX_NEW_PATCHES`; socket.yml `patches.maxNewPatches`) paces a rollout: each run adds at most N patches to packages that had none, the most critical first, and defers the rest to the next run. It applies to `scan` in hosted, vendored and agent mode, wet and `--dry-run`, and to the in-memory engine (napi `maxNewPatches`, `hosted-bundle`); `get` is explicit intent and ignores it. Design: `docs/design/staged-rollout.md` §5.
+
+**Classification.** After per-package selection, each selected `(project, purl)` row is compared with the project's **recorded view** — the merged manifest > hosted lockfile pins > vendor ledger that `updates[]` reads (§5.1):
+
+| Class | Rule | Capped | The writer gets |
+|---|---|---|---|
+| ALREADY | the recorded uuid is the selected one, or the selection does not supersede it | no | the **recorded** uuid (re-confirmed idempotently, never swapped) |
+| UPGRADE | the selection supersedes the recorded uuid (`ranking::search_result_supersedes`), or the recorded uuid is no longer offered | no | the selected uuid |
+| NEW | nothing recorded for the base purl in this project | **yes** | the selected uuid, if admitted |
+
+Supersession is judged on the by-package records the selection itself uses, so a scan with or without a cap never replaces an applied patch with an equal sibling (the tier and uuid tiebreaks and a missing date never count). When the lockfiles of a project pin a purl to several uuids, the recorded uuid is the selected one if it is among them, else the smallest. A hosted pin on a patch server that discovery does not recognize (an origin missing from `--patch-server-url`) still counts as ALREADY when a lockfile names the selected uuid, so the cap can never stall on it.
+
+**Eligibility.** A NEW row is eligible only if every check the mode can decide without writing passes: the tier filter; the agent partition (vendor-owned and not-installed packages); the vendored Bun / vlt preflight; a `granted` hosted reference with a usable purl and url; the vlt artifact preflight; the vendored-to-hosted takeover refusals; wheel metadata; and a hosted rewrite whose confirmation probe shows a lockfile edit that pins it. Ineligible rows keep their own skip reasons and never hold a slot. References are fetched for every row before the budget is spent, and `--dry-run` fetches them too, so a dry run makes exactly the wet run's decisions.
+
+**Unit and order.** The budget counts distinct **base purls** (ecosystem + name + version, qualifiers stripped, percent-decoded; qualifier twins are one package): admitting one admits all of its eligible rows and costs one slot. Eligible NEW base purls are ranked by, ascending: in-flight first (in-memory `inFlightPatches` only); severity of the selected patch (critical, high, medium, low, unknown — the worst advisory it fixes); advisory count, descending; ecosystem name; base purl (bytewise); uuid. The order is total and has no time-dependent key (publish dates still pick the patch within a package, never the package order).
+
+**Budget scope.** Disk: one budget per invocation. The project directories a hosted or vendored scan's PATHs name are visited in sorted order; each spends what is left in rank order, and a base purl admitted in an earlier directory is admitted free in a later one. `scan --json` takes one directory, so a CI job per directory gets N per directory. In memory: one budget across every project root (roots are collected, planned once, then applied). The two therefore rank a multi-root repo differently, by design.
+
+**Incomplete data.** With a finite cap, a failed batch query, or a failed detail query for a package with no recorded patch, admits no NEW row that run (they are all deferred) and adds warning `rollout_incomplete_lookup`: a missing package must not let lower-ranked ones take its slot. ALREADY and UPGRADE rows proceed as usual. A failed hosted reference lookup that could only affect NEW rows of a capped run is warning `rollout_reference_failed` (the rows are deferred) instead of a run failure.
+
+**Convergence.** The limit is stateless: run k lands the top N, run k+1 finds them recorded and lands the next N, so M waiting patches take at most ceil(M/N) *committed* runs. A newly published or re-scored more severe patch moves ahead of the queue (intended: most critical first), and low-severity patches can wait while more severe ones keep arriving. A CI job that does not commit the scan's changes never advances: there a cap means "only the top N, every run" — commit the changes (or use a PR bot), or set no cap in such jobs. A write failure after admission still spends its slot (no backfill within a run). Known limits: a dependency that moves to a new version is NEW again (its hosted pin stays with the old lock entry); a qualifier twin that lands on a later run joins its package as ALREADY / UPGRADE, uncapped.
+
+**Output.** Every successful `scan --json` result carries an additive top-level `rollout` block (MINOR), zero counts when the run planned nothing (report-only and empty scans):
+
+```json
+"rollout": {
+  "maxNewPatches": {"value": 5, "source": "flag"},
+  "counts": {"new": 5, "deferred": 9, "upgrade": 1, "already": 12},
+  "deferred": [
+    {"purl": "pkg:npm/minimist@1.2.5", "uuids": ["…"], "severity": "critical",
+     "advisoryCount": 1, "projects": [""], "rank": 6}
+  ]
+}
+```
+
+`maxNewPatches.value` is `null` for unlimited; `source` is `flag`, `env`, `file`, `default` or `cap` (the in-memory `maxNewPatchesCap` tightened it; the in-memory `maxNewPatches` option reports `flag`). `counts.new` / `counts.deferred` count base purls, `counts.upgrade` / `counts.already` count `(project, purl)` rows. `deferred[]` is in rank order: `purl` is the base purl, `uuids` the distinct selected uuids across its rows, `projects` the repo-relative project directories (`""` is the scanned directory), `rank` 1-based among eligible NEW base purls. Deferred rows are never written, downloaded or vendored: hosted mode mirrors each into `redirect.skipped[]` as `{purl, uuid, reason: "rollout_deferred", detail}`, the in-memory engine lists them in `ProjectResult.deferred[]` (`{purl, uuid, severity, rank}`) and `skipped[]`, and agent / vendored mode leave them out of `apply.patches[]` / `vendor`. Warnings (`rollout_incomplete_lookup`, `rollout_reference_failed`) go to the top-level `warnings[]`. Exit codes are unchanged: deferring is not a failure.
+
+Human output adds, when a cap is set, `Rollout: 3 of 9 new patches applied (maxNewPatches=3 from --max-new-patches); 0 upgrades, 0 already applied.` (with several project directories: `…, shared by this run's directories, 1 left)`) and next steps naming the deferred patches (`6 new patches deferred; commit these changes and run scan again to apply the next 3.`, `Next up: minimist@1.2.5 (critical), …`; a dry run says `would be deferred`, and an incomplete lookup says so instead). Hosted mode prints them on stdout after its own next steps, unindented; agent and vendored mode under a `Next steps:` heading. The `rollout` block is left out of error envelopes (`status: "error"`).
+
+CI recipe: `socket-patch scan --json --max-new-patches 5 | jq '.rollout.counts.deferred'`.
+
 ### Embedded VEX (`apply --vex` / `scan --vex` / `vendor --vex`)
 
 `--vex <path>` folds OpenVEX 0.2.0 generation into `apply`, `scan`, and `vendor`: on a successful run the command writes the document to `<path>` using the same engine as the standalone `vex` command. The `--vex-*` flags mirror `vex`'s `--product` / `--no-verify` / `--doc-id` / `--compact` knobs (namespaced to avoid colliding with the host command), and reuse the standalone env vars (`SOCKET_VEX_PRODUCT`, etc.). They are inert unless `--vex` is set.
@@ -1011,6 +1055,7 @@ Empty string means unset at every layer: exported-but-empty flag-bound vars are
 | `SOCKET_FORCE` | `apply --force` / `-f`, `vendor --force` / `-f`, `--update --force` | `false` | Local to `apply`, `vendor` and `--update`. |
 | `SOCKET_PATCH_VERSION` | `--update <VERSION>` | (latest) | Local to `--update`; the same pin `install.sh` and the gem launcher honor. |
 | `SOCKET_BATCH_SIZE` | `scan --batch-size` | `500` authenticated / `100` proxy | Local to `scan`. |
+| `SOCKET_MAX_NEW_PATCHES` | `scan --max-new-patches` | (unlimited) | Local to `scan` (v5.0): a count or `none`; empty is unset, malformed exits 2. |
 | `SOCKET_SCAN_PACKAGES` | `scan --package` | (none) | Local to `scan` (v5.0); comma-separated names or purls. |
 | `SOCKET_NO_SOCKET_YML` | `scan --no-socket-yml` | `false` | Local to `scan` (v5.0); bool vocabulary, empty = unset. |
 | `SOCKET_MIN_SEVERITY` | `scan --min-severity` | (none) | Local to `scan` (v5.0); read by scan (not clap) so the `policy` block can say `source: "env"`; empty = unset, malformed = exit 2. |
@@ -1452,10 +1497,24 @@ excluded before ranking for callers whose `canAccessPaidPatches` is
 false, so the winner is the best patch the account can download.
 
 `scan`'s `[UPDATE]` marker and `updates[]` use the same order
-(`ranking::batch_supersedes`): a candidate supersedes the applied patch
-only on a meaningful rung — merged over unmerged, higher severity between
-unmerged patches, or a real, strictly later publish date. The tier and
-uuid tiebreaks and a missing date never count.
+(`ranking::search_result_supersedes`, v5.0): a candidate supersedes the
+applied patch only on a meaningful rung — merged over unmerged, higher
+severity between unmerged patches, or a real, strictly later publish
+date. The tier and uuid tiebreaks and a missing date never count. Every
+mode that fetches the by-package records (hosted, vendored, agent, and
+every human run with a downloadable patch) judges this on those records,
+so `updates[]` lists exactly the UPGRADE rows the run acts on; a package
+the by-package lookup returns no offer for, and a JSON report-only run
+(which fetches no by-package records), fall back to the batch records
+(`ranking::batch_supersedes`). When the selection does not supersede the
+recorded patch, scan keeps the recorded one (v5.0): a re-scan never swaps
+an applied patch for an equal sibling.
+
+This order picks one patch **per package**. Which packages a capped scan
+patches first is a separate, cross-package order (`rollout::rollout_cmp`,
+see "Per-run limit on new patches"): severity of the selected patch, then
+advisory count, then ecosystem, base purl and uuid — never the publish
+date.
 
 #### Merge state is inferred, not reported
 
@@ -1495,8 +1554,8 @@ supplies it (the public-proxy fallback path fills it in from the
 per-package results).
 
 > **Known gap — batch responses without `publishedAt`.** `scan`'s
-> discovery (`packages[]`, the table, `updates[]`) is built from the
-> **batch** endpoint, whose response shape currently omits `publishedAt`;
+> discovery (`packages[]`, and `updates[]` on a JSON report-only run) is
+> built from the **batch** endpoint, whose response shape currently omits `publishedAt`;
 > the selection that `--apply` performs is built from the **by-package**
 > endpoint, which carries it. The two diverge wherever the date decides —
 > between merged patches, or between unmerged patches of equal severity —
@@ -1515,6 +1574,14 @@ per-package results).
 
 ### `jq` recipes for PR-comment bots
 
+Deferred by the per-run cap (`scan --max-new-patches`), most urgent first:
+
+```bash
+socket-patch scan --json --max-new-patches 5 | jq -r '
+  .rollout.deferred[] | "\(.rank). \(.purl) (\(.severity))"
+'
+```
+
 Applied + updated patches (envelope shape):
 
 ```bash
@@ -1557,7 +1624,7 @@ Exit `1` when `status` is `partialFailure` (any `events[*].action == "failed"`)
 |---|---|
 | `0` | Success |
 | `1` | Error (missing/invalid manifest, fetch failed, apply failed, selection cancelled in non-JSON mode, an invalid or ambiguous socket.yml on `scan` (v5.0), etc.) |
-| `2` | Usage error: clap parse failures (unknown flag/value, missing required arg, an unknown subcommand such as the removed `setup`) and the conflicts the commands enforce themselves — `scan`'s cross-mode conflicts (`--mode` combined with a DIFFERENT mode's boolean spelling, rejected in `resolve_mode_flags`) and `--mode hosted` with `--global`/`--global-prefix` (same enforcement point); in hosted/vendored `scan` (bare `scan` included), a PATH that is not a directory, a PATH glob matching no directory, and `--json` with more than one project directory (`run_project_dirs`); `remove --preserve-state --skip-rollback` (the no-op quadrant; flag- or env-sourced alike), an unparseable path glob on `scan`/`rollback`, a `scan` PATH outside the repository root and a malformed `SOCKET_MIN_SEVERITY` (v5.0), `repair --offline --download-only`. `vex` also exits `2` on hard errors before document generation (see its tri-state table below). v5.0: `get`'s self-enforced conflicts exit `2` too (`--id`/`--cve`/`--ghsa`/`--package` multi-select, `--mode hosted\|vendored --save-only`, a malformed identifier for a forced `--id`/`--cve`/`--ghsa`) — previously `1` (MAJOR). The never-implemented `get --one-off` / `rollback --one-off` (and `SOCKET_ONE_OFF`) are removed in v5.0; `--one-off` is now an ordinary unknown-flag clap error. |
+| `2` | Usage error: clap parse failures (unknown flag/value, missing required arg, an unknown subcommand such as the removed `setup`) and the conflicts the commands enforce themselves — `scan`'s cross-mode conflicts (`--mode` combined with a DIFFERENT mode's boolean spelling, rejected in `resolve_mode_flags`) and `--mode hosted` with `--global`/`--global-prefix` (same enforcement point); in hosted/vendored `scan` (bare `scan` included), a PATH that is not a directory, a PATH glob matching no directory, and `--json` with more than one project directory (`run_project_dirs`); `remove --preserve-state --skip-rollback` (the no-op quadrant; flag- or env-sourced alike), an unparseable path glob on `scan`/`rollback`, a `scan` PATH outside the repository root and a malformed `SOCKET_MIN_SEVERITY` or `SOCKET_MAX_NEW_PATCHES` (v5.0), `repair --offline --download-only`. `vex` also exits `2` on hard errors before document generation (see its tri-state table below). v5.0: `get`'s self-enforced conflicts exit `2` too (`--id`/`--cve`/`--ghsa`/`--package` multi-select, `--mode hosted\|vendored --save-only`, a malformed identifier for a forced `--id`/`--cve`/`--ghsa`) — previously `1` (MAJOR). The never-implemented `get --one-off` / `rollback --one-off` (and `SOCKET_ONE_OFF`) are removed in v5.0; `--one-off` is now an ordinary unknown-flag clap error. |
 
 `list` returns **`0`** for every project it can read, empty or not (**v5.0, BREAKING**: a project with no manifest and no ledger record — normal for hosted mode, which writes no manifest — used to exit `1` with `manifest_not_found`; it is now an empty list: `No patches in this project. Run \`socket-patch scan\`.` on stdout, and under `--json` the success envelope with `events: []`). Only an unreadable or invalid manifest (`manifest_unreadable` / `manifest_invalid`) exits `1`. Every lock-taking subcommand — including `scan`/`get --mode hosted` as of v5.0 — returns **`1`** with `errorCode: lock_held` when another live socket-patch process holds `<.socket>/apply.lock`.
 
diff --git a/crates/socket-patch-cli/src/commands/get.rs b/crates/socket-patch-cli/src/commands/get.rs
index e02f3908..daf8abbd 100644
--- a/crates/socket-patch-cli/src/commands/get.rs
+++ b/crates/socket-patch-cli/src/commands/get.rs
@@ -3590,6 +3590,8 @@ async fn run_get_hosted(
         &pairs,
         scan_result,
         None,
+        // `get` is explicit intent: the rollout cap never applies.
+        None,
     )
     .await
 }
diff --git a/crates/socket-patch-cli/src/commands/hosted_bundle.rs b/crates/socket-patch-cli/src/commands/hosted_bundle.rs
index 277bc104..a054e7e7 100644
--- a/crates/socket-patch-cli/src/commands/hosted_bundle.rs
+++ b/crates/socket-patch-cli/src/commands/hosted_bundle.rs
@@ -10,7 +10,9 @@
 //! Stdin: `{"files": {path: text}, "binaryFiles"?: {path: base64},
 //! "presentOnly"?: [path], "symlinks"?: [path], "projectRoots"?: [dir],
 //! "pipenvMajor"?: n, "batchSize"?: n, "noSocketYml"?: bool,
-//! "minSeverity"?: severity, "policyPaths"?: [path]}`. Stdout: the engine result
+//! "minSeverity"?: severity, "policyPaths"?: [path],
+//! "maxNewPatches"?: n | "none", "maxNewPatchesCap"?: n,
+//! "inFlightPatches"?: [purl]}`. Stdout: the engine result
 //! (`HostedScanResult`, binary contents base64), or
 //! `{"status":"error","error":{"code","message"}}` with exit 2 for bad
 //! credentials/bundle input, or exit 1 for an engine failure.
@@ -62,6 +64,12 @@ struct Bundle {
     policy_paths: Option<Vec<String>>,
     #[serde(default)]
     policy_sha256: Option<String>,
+    #[serde(default)]
+    max_new_patches: Option<crate::hosted_memory::MaxNewPatchesOption>,
+    #[serde(default)]
+    max_new_patches_cap: Option<u32>,
+    #[serde(default)]
+    in_flight_patches: Option<Vec<String>>,
 }
 
 fn print_error(code: &str, message: &str) {
@@ -134,6 +142,9 @@ pub async fn run(args: HostedBundleArgs) -> i32 {
         min_severity: bundle.min_severity.clone(),
         policy_paths: bundle.policy_paths.clone(),
         policy_sha256: bundle.policy_sha256.clone(),
+        max_new_patches: bundle.max_new_patches,
+        max_new_patches_cap: bundle.max_new_patches_cap,
+        in_flight_patches: bundle.in_flight_patches.clone(),
         ..HostedScanOptions::default()
     };
     let input = match build_input(bundle, options) {
diff --git a/crates/socket-patch-cli/src/commands/scan/discovery.rs b/crates/socket-patch-cli/src/commands/scan/discovery.rs
index ce5425e9..cd389626 100644
--- a/crates/socket-patch-cli/src/commands/scan/discovery.rs
+++ b/crates/socket-patch-cli/src/commands/scan/discovery.rs
@@ -13,7 +13,6 @@ use socket_patch_core::utils::concurrent::{api_concurrency_for, ordered_concurre
 use socket_patch_core::utils::purl::{normalize_purl, strip_purl_qualifiers};
 use socket_patch_core::vendor::lock_inventory::LockfileEntry;
 use socket_patch_core::vendor::VendorState;
-use std::borrow::Cow;
 use std::collections::{HashMap, HashSet};
 
 use crate::args::GlobalArgs;
@@ -365,58 +364,8 @@ pub(super) async fn preverify_vendor_baselines<W: std::io::Write>(
     (mismatched, views)
 }
 
-/// Fold the hosted pins and the vendor ledger's patch records into the
-/// manifest view update detection consults. Hosted mode records purl→uuid
-/// ONLY in the lockfiles (`hosted_pins`, uuid only; v5 keeps no hosted
-/// ledger) and vendored mode ONLY in `.socket/vendor/state.json`, so without
-/// this fold a pure hosted or vendored project's `updates[]` would always
-/// be empty. Precedence on a collision: manifest > hosted pins > vendor
-/// ledger (the live lock over a possibly superseded vendored entry); the
-/// vendor entries fold under the shared owner rule
-/// ([`socket_patch_core::ledgers::Ledgers::owned`]), so one the manifest
-/// claims (its key or base purl) stays behind the manifest's record.
-/// Vendor entries are keyed by their ledger key (`detect_updates` bridges
-/// the spellings); a legacy entry without an embedded record contributes
-/// its uuid alone. Borrows the manifest untouched when nothing else
-/// contributes.
-pub(super) fn merge_ledger_records_for_updates<'a>(
-    manifest: Option<&'a PatchManifest>,
-    vendor: Option<&VendorState>,
-    hosted_pins: &[(String, String)],
-) -> Option<Cow<'a, PatchManifest>> {
-    use socket_patch_core::ledgers::{uuid_only_record, Ledgers, Store};
-    let vendor = vendor.filter(|s| !s.entries.is_empty());
-    if vendor.is_none() && hosted_pins.is_empty() {
-        return manifest.map(Cow::Borrowed);
-    }
-    let mut merged = manifest.cloned().unwrap_or_default();
-    for (purl, uuid) in hosted_pins {
-        merged
-            .patches
-            .entry(purl.clone())
-            .or_insert_with(|| uuid_only_record(uuid));
-    }
-    let ledgers = Ledgers {
-        manifest,
-        vendor,
-        redirect: None,
-    };
-    for owned in ledgers.owned() {
-        if owned.store == Store::Manifest {
-            continue;
-        }
-        merged
-            .patches
-            .entry(owned.key.to_string())
-            .or_insert_with(|| {
-                owned
-                    .record
-                    .cloned()
-                    .unwrap_or_else(|| uuid_only_record(owned.uuid))
-            });
-    }
-    Some(Cow::Owned(merged))
-}
+pub(super) use socket_patch_core::ledgers::merge_ledger_records_for_updates;
+
 
 /// Cross-reference an existing manifest against discovery results to find
 /// PURLs whose newest available patch UUID differs from the locally-recorded
@@ -566,6 +515,7 @@ pub(super) fn severity_order(s: &str) -> u8 {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use std::borrow::Cow;
     use socket_patch_core::api::types::BatchPatchInfo;
 
     use crate::commands::scan::tests::manifest_with;
diff --git a/crates/socket-patch-cli/src/commands/scan/hosted.rs b/crates/socket-patch-cli/src/commands/scan/hosted.rs
index 078df2b8..b5c939e1 100644
--- a/crates/socket-patch-cli/src/commands/scan/hosted.rs
+++ b/crates/socket-patch-cli/src/commands/scan/hosted.rs
@@ -78,6 +78,10 @@ fn emit_json_error_with_code(
     let mut result = scan_result.unwrap_or_else(|| serde_json::json!({ "status": "error" }));
     result["status"] = serde_json::json!("error");
     result["error"] = serde_json::json!(message);
+    // The rollout block describes a successful run only.
+    if let Some(obj) = result.as_object_mut() {
+        obj.remove("rollout");
+    }
     if let Some(code) = code {
         result["errorCode"] = serde_json::json!(code);
     }
@@ -539,21 +543,28 @@ pub(super) async fn run_redirect(
     // handed to the VEX step so it does not walk the tree for the npm
     // roots again.
     npm_prior: Option<&crate::ecosystem_dispatch::NpmCrawlSnapshot>,
+    // The merged recorded view (manifest > hosted pins > vendor ledger) the
+    // rollout classifies against, whether a batch failed, and the stage
+    // that holds this directory's budget.
+    recorded: &super::rollout::RecordedState<'_>,
+    batch_failed: bool,
+    stage: &mut super::rollout::Stage,
 ) -> i32 {
     // Same discovery/selection as `--apply`/`--vendor`.
-    let selected: Vec<socket_patch_core::api::types::PatchSearchResult> = match discover_selected(
+    let discovered = match discover_selected(
         api_client,
         all_packages_with_patches,
         can_access_paid_patches,
         policy,
         false,
         false,
+        false,
         telemetry,
         scan_result.as_mut(),
     )
     .await
     {
-        Ok(offers) => offers.selected.into_values().collect(),
+        Ok(d) => d,
         // Hosted mode has no discovery envelope to fold the message into at
         // this point (it builds its `redirect` result further down).
         // `discover_selected` already printed the message to stderr; a
@@ -570,13 +581,22 @@ pub(super) async fn run_redirect(
             return code;
         }
     };
+    let rows = super::classified_rows(
+        stage,
+        &discovered,
+        recorded,
+        batch_failed,
+        all_packages_with_patches,
+        scan_result.as_mut(),
+    );
 
     // The redirect body consumes the selection only as (purl, uuid) pairs —
     // the seam `get --mode hosted` injects its advisory-pinned selection
-    // through (see `run_redirect_selected`).
-    let pairs: Vec<(String, String)> = selected
+    // through (see `run_redirect_selected`). ALREADY rows carry the
+    // recorded uuid, so a re-scan re-confirms the pin instead of swapping it.
+    let pairs: Vec<(String, String)> = rows
         .iter()
-        .map(|s| (s.purl.clone(), s.uuid.clone()))
+        .map(|r| (r.writer.purl.clone(), r.writer.uuid.clone()))
         .collect();
     run_redirect_selected(
         &args.common,
@@ -586,6 +606,7 @@ pub(super) async fn run_redirect(
         &pairs,
         scan_result,
         npm_prior,
+        Some(super::rollout::Gate::new(stage, rows)),
     )
     .await
 }
@@ -614,6 +635,7 @@ pub(super) async fn run_redirect(
 /// human/JSON split keys on `common.json`; a `--json` caller passing `None`
 /// would get a minimal envelope that drops its own keys). `prune_requested`
 /// only feeds the `redirect_prune_ignored` warning — `get` passes `false`.
+#[allow(clippy::too_many_arguments)]
 pub(crate) async fn run_redirect_selected(
     common: &crate::args::GlobalArgs,
     vex: &crate::commands::vex::VexEmbedArgs,
@@ -622,6 +644,9 @@ pub(crate) async fn run_redirect_selected(
     selected: &[(String, String)],
     mut scan_result: Option<serde_json::Value>,
     npm_prior: Option<&crate::ecosystem_dispatch::NpmCrawlSnapshot>,
+    // `scan`'s rollout gate: NEW rows past the budget are deferred after
+    // every write-free eligibility check below (§5.2). `get` passes `None`.
+    mut rollout: Option<super::rollout::Gate<'_>>,
 ) -> i32 {
     use socket_patch_core::hosted::engine::{
         self, Candidate, CandidateFiles, RewriteOptions, SkippedPatch,
@@ -647,6 +672,24 @@ pub(crate) async fn run_redirect_selected(
         status.finish();
         let references = match fetched {
             Ok(r) => r,
+            // A capped run whose every row is NEW: the failure affects only
+            // rows the incomplete lookup defers anyway (§5.2), so it becomes
+            // a warning instead of failing the run.
+            Err(e)
+                if rollout.as_ref().is_some_and(|gate| {
+                    let new = gate.new_keys();
+                    gate.stage.capped()
+                        && selected
+                            .iter()
+                            .all(|(p, u)| new.contains(&(p.clone(), u.clone())))
+                }) =>
+            {
+                if let Some(gate) = rollout.as_mut() {
+                    gate.stage.incomplete = true;
+                    gate.stage.reference_failed = Some(e.to_string());
+                }
+                std::collections::HashMap::new()
+            }
             Err(e) => {
                 let message = format!("failed to resolve patch references: {e}");
                 eprintln!(
@@ -659,8 +702,27 @@ pub(crate) async fn run_redirect_selected(
                 return 1;
             }
         };
-        candidates = engine::build_candidates(selected, &references, &mut skipped);
+        // Deferred rows need no reference: a failed lookup that only hit
+        // them builds nothing (and records no `not_found` for them).
+        if rollout
+            .as_ref()
+            .is_none_or(|gate| gate.stage.reference_failed.is_none())
+        {
+            candidates = engine::build_candidates(selected, &references, &mut skipped);
+        }
     }
+    // The rollout rows key on the selection's purl spelling; the server's
+    // reference may spell a candidate's `purl` differently. Uuids are unique
+    // across the selection.
+    let sel_purl_of: std::collections::HashMap<&str, &str> = selected
+        .iter()
+        .map(|(purl, uuid)| (uuid.as_str(), purl.as_str()))
+        .collect();
+    let sel_purl = |c: &Candidate| -> String {
+        sel_purl_of
+            .get(c.dep.patch_uuid.as_str())
+            .map_or_else(|| c.purl.clone(), |p| (*p).to_string())
+    };
 
     // Check binary lock symlinks before a mode takeover changes any wiring
     // (the takeover reverts rewrite locks in place, never create or remove
@@ -699,7 +761,15 @@ pub(crate) async fn run_redirect_selected(
     // preview must not create `.socket/`, flip to `lock_held` under a
     // concurrent wet run, or fail on a read-only checkout). Held to the end
     // of the function.
-    let _lock: Option<LockGuard> = if !common.dry_run && !candidates.is_empty() {
+    // A capped run whose only candidates are NEW rows it cannot admit
+    // (budget 0, or incomplete data) writes nothing: take no lock either.
+    let may_write = rollout.as_ref().is_none_or(|gate| {
+        let new = gate.new_keys();
+        candidates.iter().any(|c| {
+            !new.contains(&(sel_purl(c), c.dep.patch_uuid.clone())) || gate.may_admit(&sel_purl(c))
+        })
+    });
+    let mut lock: Option<LockGuard> = if !common.dry_run && !candidates.is_empty() && may_write {
         match acquire_hosted_lock(common, &mut scan_result) {
             Ok(guard) => Some(guard),
             Err(code) => return code,
@@ -864,28 +934,83 @@ pub(crate) async fn run_redirect_selected(
             socket_patch_core::utils::fs::read_regular_to_string_sync(path).ok()
         })
     };
-    let done = engine::rewrite(
+    let rewrite_options = || RewriteOptions {
+        dry_run: common.dry_run,
+        targets_pipenv_lock,
+        pipenv_major,
+        pipenv_unknown_detail: format!(
+            "Pipenv was not found on PATH, so the Pipfile.lock references use the modern `file` form (Pipenv 2018 and later). A project installed with Pipenv 7–11 needs `path` references instead: put that pipenv on PATH or set {}=<major> and re-run `scan --mode hosted`.",
+            socket_patch_core::utils::pipenv::MAJOR_OVERRIDE_ENV
+        ),
+        trust_lockfile_config: !common.no_trust_lockfile_config,
+        npm_allow_remote_config: !common.no_npm_allow_remote_config,
+        npm_outer: &npm_outer,
+        blocking: true,
+    };
+    // The rollout gate plans again without its deferred rows: keep what
+    // the second pass needs.
+    let second_pass = rollout
+        .is_some()
+        .then(|| (read.clone(), python_metadata.clone()));
+    let mut done = engine::rewrite(
         &view,
         read,
         &candidates,
         python_metadata,
         &vlt_preflight.withheld_from_vlt,
         &dry_run_takeover_urls,
-        RewriteOptions {
-            dry_run: common.dry_run,
-            targets_pipenv_lock,
-            pipenv_major,
-            pipenv_unknown_detail: format!(
-                "Pipenv was not found on PATH, so the Pipfile.lock references use the modern `file` form (Pipenv 2018 and later). A project installed with Pipenv 7–11 needs `path` references instead: put that pipenv on PATH or set {}=<major> and re-run `scan --mode hosted`.",
-                socket_patch_core::utils::pipenv::MAJOR_OVERRIDE_ENV
-            ),
-            trust_lockfile_config: !common.no_trust_lockfile_config,
-            npm_allow_remote_config: !common.no_npm_allow_remote_config,
-            npm_outer: &npm_outer,
-            blocking: true,
-        },
+        rewrite_options(),
     )
     .await;
+
+    // The rollout gate (§5.2): every write-free check has run — grants,
+    // purl/url, vlt preflight, takeover refusals, wheel metadata, and the
+    // rewrite above, whose confirmation probe proves a NEW row would be
+    // pinned. Only then is the budget spent; deferred rows leave the
+    // rewrite set, which is rewritten again without them.
+    if let (Some(gate), Some((read, python_metadata))) = (rollout.as_mut(), second_pass) {
+        let eligible: std::collections::HashSet<(String, String)> = done
+            .confirmed
+            .iter()
+            .map(|(purl, uuid)| {
+                let purl = sel_purl_of.get(uuid.as_str()).map_or(purl.as_str(), |p| p);
+                (purl.to_string(), uuid.clone())
+            })
+            .collect();
+        let texts: Vec<&str> = done.files.values().map(String::as_str).collect();
+        super::rollout::mark_pinned(&mut gate.rows, &texts);
+        let unknown = gate.stage.reference_failed.is_some();
+        gate.stage.plan(&gate.rows, |row| {
+            unknown || eligible.contains(&(row.writer.purl.clone(), row.writer.uuid.clone()))
+        });
+        let deferred = gate.stage.deferred_keys();
+        skipped.extend(gate.stage.deferred_skips());
+        let before = candidates.len();
+        candidates.retain(|c| !deferred.contains(&(sel_purl(c), c.dep.patch_uuid.clone())));
+        if candidates.len() != before {
+            done = engine::rewrite(
+                &view,
+                read,
+                &candidates,
+                python_metadata,
+                &vlt_preflight.withheld_from_vlt,
+                &dry_run_takeover_urls,
+                rewrite_options(),
+            )
+            .await;
+        }
+        // A row that turned out to be pinned already (`mark_pinned`: a pin
+        // discovery did not recognize) still gets written: take the lock
+        // skipped above. Only NEW rows ran without it, so no takeover did.
+        if lock.is_none() && !common.dry_run && !candidates.is_empty() {
+            match acquire_hosted_lock(common, &mut scan_result) {
+                Ok(guard) => lock = Some(guard),
+                Err(code) => return code,
+            }
+        }
+    }
+    // Held to the end of the function.
+    let _lock = lock;
     // Dry-run mode-takeover previews were withheld from the rewriters (their
     // lock fragments still carry the vendored wiring the wet run reverts
     // first), so the presence probe cannot see them: the wet run reverts
@@ -1188,6 +1313,9 @@ pub(crate) async fn run_redirect_selected(
             common.dry_run,
         );
         let mut result = build_redirect_json_envelope(scan_result.take(), redirect);
+        if let Some(gate) = &rollout {
+            super::finish_rollout_json(gate.stage, &mut result);
+        }
         if let Some(statements) = vex_statements {
             result["vex"] = serde_json::json!({
                 "path": vex.vex.as_ref().expect("vex_statements is Some only when --vex was given").display().to_string(),
@@ -1228,8 +1356,9 @@ pub(crate) async fn run_redirect_selected(
             human_files.extend(takeover_files.iter().cloned());
             human_files.sort();
             human_files.dedup();
-            // The one stdout line: scripts read it, so it stays on stdout;
-            // everything below is on stderr and names its package itself.
+            // The summary line: scripts read it, so it stays on stdout, as do
+            // the rollout line and the next steps; the warnings below are on
+            // stderr and name their package themselves.
             println!(
                 "{}",
                 format_redirect_summary(confirmed.len(), human_files.len(), common.dry_run)
@@ -1250,8 +1379,10 @@ pub(crate) async fn run_redirect_selected(
                 .collect();
             // Human output prints the bare strings — `Value`'s `Display`
             // would JSON-quote them.
+            // Deferred rows are summed up by the rollout lines instead.
             let skipped_pairs: Vec<(String, String)> = skipped
                 .iter()
+                .filter(|s| s.reason != super::rollout::ROLLOUT_DEFERRED)
                 .map(|s| (s.purl.clone(), s.reason.clone()))
                 .collect();
             // Granted, but nothing in the project pins it (no lock entry,
@@ -1311,12 +1442,26 @@ pub(crate) async fn run_redirect_selected(
                     crate::commands::vex::format_vex_dry_run_skip("rewritten")
                 );
             }
-            if !common.dry_run {
-                for line in
-                    format_next_steps(&human_files, !takeover_migrated.is_empty())
-                {
-                    println!("{line}");
+            let (rollout_line, deferred_steps) = match &rollout {
+                Some(gate) => {
+                    for (code, detail) in gate.stage.warnings() {
+                        eprintln!("{}", format_warning(code, &detail, width));
+                    }
+                    super::rollout::human(gate.stage, common.dry_run)
                 }
+                None => (None, Vec::new()),
+            };
+            if let Some(line) = rollout_line {
+                println!("{line}");
+            }
+            let mut next_steps = if common.dry_run {
+                Vec::new()
+            } else {
+                format_next_steps(&human_files, !takeover_migrated.is_empty())
+            };
+            next_steps.extend(deferred_steps);
+            for line in next_steps {
+                println!("{line}");
             }
         }
         // Errors print even under --silent ("errors only", never
@@ -2060,6 +2205,7 @@ fn format_next_steps(files: &[String], vendored_removed: bool) -> Vec<String> {
 /// future embeds the whole hosted engine, and callers outside scan (`get
 /// --mode hosted`) must not materialize it in their own poll frame (Windows
 /// 1 MiB main-thread stack; same rationale as scan's `boxed_*` family).
+#[allow(clippy::too_many_arguments)]
 pub(crate) fn boxed_run_redirect_selected<'a>(
     common: &'a crate::args::GlobalArgs,
     vex: &'a crate::commands::vex::VexEmbedArgs,
@@ -2068,6 +2214,7 @@ pub(crate) fn boxed_run_redirect_selected<'a>(
     selected: &'a [(String, String)],
     scan_result: Option<serde_json::Value>,
     npm_prior: Option<&'a crate::ecosystem_dispatch::NpmCrawlSnapshot>,
+    rollout: Option<super::rollout::Gate<'a>>,
 ) -> std::pin::Pin<Box<dyn std::future::Future<Output = i32> + 'a>> {
     Box::pin(run_redirect_selected(
         common,
@@ -2077,6 +2224,7 @@ pub(crate) fn boxed_run_redirect_selected<'a>(
         selected,
         scan_result,
         npm_prior,
+        rollout,
     ))
 }
 
diff --git a/crates/socket-patch-cli/src/commands/scan/mod.rs b/crates/socket-patch-cli/src/commands/scan/mod.rs
index 39dece92..f1714644 100644
--- a/crates/socket-patch-cli/src/commands/scan/mod.rs
+++ b/crates/socket-patch-cli/src/commands/scan/mod.rs
@@ -43,6 +43,8 @@ pub(crate) mod hosted;
 pub(crate) mod policy;
 mod socket_yml_args;
 pub(crate) mod render;
+pub(crate) mod rollout;
+pub mod rollout_args;
 pub(crate) mod vendor_flow;
 
 use self::discovery::{
@@ -338,6 +340,9 @@ pub struct ScanArgs {
     #[command(flatten)]
     pub vex: VexEmbedArgs,
 
+    #[command(flatten)]
+    pub rollout: rollout_args::RolloutArgs,
+
     #[command(flatten)]
     pub socket_yml: SocketYmlArgs,
 }
@@ -480,7 +485,7 @@ async fn embed_vex_human(
 /// are the human-only knobs of [`fetch_patch_details`] (JSON callers pass
 /// `false, false`). `json_warnings` is the JSON callers' envelope: a
 /// partial failure adds one [`PATCH_DETAILS_FAILED`] warning per failed
-/// package to it.
+/// package to it, and [`Discovered::failed`] lists each failed purl.
 #[allow(clippy::too_many_arguments)]
 async fn discover_selected(
     api_client: &socket_patch_core::api::client::ApiClient,
@@ -489,9 +494,10 @@ async fn discover_selected(
     policy: &ScanPolicy,
     show_progress: bool,
     warn: bool,
+    detail_error_line: bool,
     telemetry: &mut PendingTelemetry,
     json_warnings: Option<&mut serde_json::Value>,
-) -> Result<socket_patch_core::policy::Offers, (i32, String)> {
+) -> Result<Discovered, (i32, String)> {
     let (all_search_results, failures) =
         fetch_patch_details(api_client, packages, show_progress, warn).await;
     // The scan event's send overlapped the detail fetches; every caller's
@@ -501,16 +507,20 @@ async fn discover_selected(
     let error_count = failures.len();
     if error_count > 0 && error_count == packages.len() {
         let err = failures
-            .into_iter()
             .last()
-            .map_or_else(|| "all patch-detail queries failed".to_string(), |(_, e)| e);
+            .map_or_else(|| "all patch-detail queries failed".to_string(), |(_, e)| e.clone());
         let message = format!("all {error_count} patch-detail queries failed: {err}");
-        eprintln!("Error: {message}");
+        if detail_error_line {
+            eprintln!("{}", render::fetch_details_failed(&failures));
+        } else {
+            eprintln!("Error: {message}");
+        }
         return Err((1, message));
     }
     // Some queries failed, some succeeded: a `--json` run has no stderr
     // warning (`warn` is human-only), so each failed package becomes a
     // run-level `warnings[]` entry — never a silent drop from the envelope.
+    let fetched = all_search_results.len();
     let offers = select_accessible(all_search_results, can_access_paid_patches, policy);
     if let Some(result) = json_warnings {
         for (purl, e) in &failures {
@@ -522,7 +532,140 @@ async fn discover_selected(
         }
         policy.fold_into_json(result);
     }
-    Ok(offers)
+    Ok(Discovered {
+        offers,
+        fetched,
+        failed: failures,
+    })
+}
+
+/// [`discover_selected`]'s result: the offers, how many records came back
+/// (before the tier filter), and each failed detail query as `(purl,
+/// error)` (a failure for a package with no recorded patch makes a capped
+/// run's data incomplete).
+struct Discovered {
+    offers: rollout::Offers,
+    fetched: usize,
+    failed: Vec<(String, String)>,
+}
+
+/// The `updates[]` JSON array.
+fn updates_json(updates: &[discovery::UpdateInfo]) -> Vec<serde_json::Value> {
+    updates
+        .iter()
+        .map(|u| {
+            serde_json::json!({
+                "purl": u.purl,
+                "oldUuid": u.old_uuid,
+                "newUuid": u.new_uuid,
+            })
+        })
+        .collect()
+}
+
+/// Classify the discovered offers against the recorded view (§5.1), note
+/// whether a capped run's data is incomplete, and (JSON) replace the
+/// batch-derived `updates[]` with the by-package UPGRADE rows.
+fn classified_rows(
+    stage: &mut rollout::Stage,
+    discovered: &Discovered,
+    recorded: &rollout::RecordedState<'_>,
+    batch_failed: bool,
+    packages: &[BatchPackagePatches],
+    result: Option<&mut serde_json::Value>,
+) -> Vec<rollout::Row> {
+    let failed: Vec<String> = discovered.failed.iter().map(|(purl, _)| purl.clone()).collect();
+    stage.incomplete = rollout::lookup_incomplete(&recorded.index, &failed, batch_failed);
+    let rows = rollout::classify(&discovered.offers, &recorded.index, &stage.project);
+    if let Some(result) = result {
+        let updates = offer_updates(&rows, discovered, recorded, packages);
+        result["updates"] = serde_json::Value::Array(updates_json(&updates));
+    }
+    rows
+}
+
+/// `common` for `select_patches`: scan never prompts, so it always takes
+/// the top-ranked patch, and with `json` off it never gets
+/// `selection_required` (scan has no "re-run with the chosen UUID" path).
+pub(crate) fn selection_args(common: &GlobalArgs) -> GlobalArgs {
+    GlobalArgs {
+        json: false,
+        yes: true,
+        ..common.clone()
+    }
+}
+
+/// `updates[]` from the by-package records (see [`rollout::merge_updates`]).
+fn offer_updates(
+    rows: &[rollout::Row],
+    discovered: &Discovered,
+    recorded: &rollout::RecordedState<'_>,
+    packages: &[BatchPackagePatches],
+) -> Vec<discovery::UpdateInfo> {
+    let purls: Vec<String> = packages.iter().map(|p| p.purl.clone()).collect();
+    rollout::merge_updates(
+        rows,
+        &discovered.offers,
+        &purls,
+        detect_updates(recorded.manifest, packages),
+    )
+}
+
+/// The offers the writers would receive, one per row.
+fn writers_of(rows: &[rollout::Row]) -> Vec<PatchSearchResult> {
+    rows.iter().map(|r| r.writer.clone()).collect()
+}
+
+/// Plan the rows whose writer survived the mode's own partition (`kept`;
+/// the rest cannot land and hold no slot), then return `kept` without the
+/// deferred rows.
+fn plan_kept_rows(
+    stage: &mut rollout::Stage,
+    rows: Vec<rollout::Row>,
+    kept: Vec<PatchSearchResult>,
+) -> Vec<PatchSearchResult> {
+    let kept_keys: HashSet<(&str, &str)> = kept
+        .iter()
+        .map(|p| (p.purl.as_str(), p.uuid.as_str()))
+        .collect();
+    let kept_rows: Vec<rollout::Row> = rows
+        .into_iter()
+        .filter(|r| kept_keys.contains(&(r.writer.purl.as_str(), r.writer.uuid.as_str())))
+        .collect();
+    stage.plan(&kept_rows, |_| true);
+    let deferred = stage.deferred_keys();
+    kept.into_iter()
+        .filter(|p| !deferred.contains(&(p.purl.clone(), p.uuid.clone())))
+        .collect()
+}
+
+/// Fold the stage's `rollout` block and warnings into a JSON result.
+pub(super) fn finish_rollout_json(stage: &rollout::Stage, result: &mut serde_json::Value) {
+    result["rollout"] = stage.json();
+    for (code, detail) in stage.warnings() {
+        push_scan_json_warning(result, code, &detail);
+    }
+}
+
+/// The human `Rollout:` line and the Next-steps lines about deferred
+/// patches, for the agent and vendored summaries.
+fn print_rollout_human(stage: &rollout::Stage, dry_run: bool, silent: bool) {
+    if silent {
+        return;
+    }
+    for (code, detail) in stage.warnings() {
+        eprintln!("Warning ({code}): {detail}");
+    }
+    let (line, next) = rollout::human(stage, dry_run);
+    if let Some(line) = line {
+        println!("\n{line}");
+    }
+    if !next.is_empty() {
+        println!("Next steps:");
+        for step in next {
+            println!("  {step}");
+        }
+    }
 }
 
 /// The tier filter, then the policy's per-package selection (see
@@ -540,17 +683,6 @@ fn select_accessible(
     policy.select(accessible)
 }
 
-/// `common` for `select_patches`: scan never prompts, so it always takes
-/// the top-ranked patch, and with `json` off it never gets
-/// `selection_required` (scan has no "re-run with the chosen UUID" path).
-pub(crate) fn selection_args(common: &GlobalArgs) -> GlobalArgs {
-    GlobalArgs {
-        json: false,
-        yes: true,
-        ..common.clone()
-    }
-}
-
 /// Print the blank stdout line that opens a paragraph, once: `opened`
 /// flips on the first call.
 fn open_paragraph(opened: &mut bool) {
@@ -626,6 +758,9 @@ async fn fetch_patch_details(
 fn emit_discovery_error_json(result: &mut serde_json::Value, message: &str) {
     result["status"] = serde_json::json!("error");
     result["error"] = serde_json::json!(message);
+    if let Some(obj) = result.as_object_mut() {
+        obj.remove("rollout");
+    }
     print_json(result);
 }
 
@@ -1250,6 +1385,17 @@ async fn run_project_dirs(
         );
         return 2;
     }
+    // One budget per invocation (§5.2): the directories spend it in sorted
+    // order, and a package admitted in one is admitted free in the next.
+    let configured = match args.rollout.resolve_from_env(invocation.policy.max_new_patches()) {
+        Ok(max) => max,
+        Err(message) => {
+            eprintln!("Error: {message}");
+            return 2;
+        }
+    };
+    let root = std::fs::canonicalize(&args.common.cwd).unwrap_or_else(|_| args.common.cwd.clone());
+    let carry = rollout_args::RolloutCarry::new(configured, root);
     let mut code = 0;
     for (dir, explicit) in &dirs {
         if dirs.len() > 1 && !args.common.silent {
@@ -1259,6 +1405,7 @@ async fn run_project_dirs(
         let mut child = args.clone();
         child.paths.clear();
         child.common.cwd = dir.clone();
+        child.rollout.carry = Some(carry.clone());
         code = code.max(Box::pin(run_scan(child, telemetry, Some(invocation), *explicit)).await);
     }
     code
@@ -1336,6 +1483,25 @@ async fn run_scan(
         }
     };
 
+    // The per-run cap on NEW patches (`--max-new-patches` > env > the
+    // socket.yml `patches.maxNewPatches`). A malformed env value is a usage
+    // error.
+    let configured_cap = match args.rollout.carry.as_ref() {
+        Some(carry) => carry.lock().configured,
+        None => match args.rollout.resolve_from_env(invocation.policy.max_new_patches()) {
+            Ok(max) => max,
+            Err(message) => {
+                eprintln!("Error: {message}");
+                return 2;
+            }
+        },
+    };
+    let mut stage = rollout::Stage::new(
+        configured_cap,
+        args.rollout.carry.clone(),
+        &args.common.cwd,
+    );
+
     // Strict airgap (CLI_CONTRACT.md `--offline`): scan's patch discovery
     // is remote data, so refuse before the crawl and before the API client
     // is built (org auto-resolve is itself a network call).
@@ -1623,6 +1789,7 @@ async fn run_scan(
                 "packages": [],
                 "updates": [],
                 "paths": path_scope.raw(),
+                "rollout": stage.json(),
             });
             // Layout refusals: additive top-level `warnings` (omitted when
             // empty) so a consumer can tell an unscannable project from an
@@ -1916,8 +2083,12 @@ async fn run_scan(
         telemetry_org.as_deref(),
     );
 
-    let updates = detect_updates(update_manifest.as_deref(), &all_packages_with_patches);
+    let mut updates = detect_updates(update_manifest.as_deref(), &all_packages_with_patches);
     policy.set_update_purls(updates.iter().map(|u| u.purl.as_str()));
+    let recorded = rollout::RecordedState {
+        manifest: update_manifest.as_deref(),
+        index: rollout::RecordedIndex::new(update_manifest.as_deref(), &hosted_pins),
+    };
 
     // The hosted-wiring probes below take `all_purls` (POST-filter: only
     // packages this run covered), unlike the PRE-filter `scanned_purls`
@@ -1935,11 +2106,8 @@ async fn run_scan(
             "canAccessPaidPatches": can_access_paid_patches,
             "packages": all_packages_with_patches,
             "paths": path_scope.raw(),
-            "updates": updates.iter().map(|u| serde_json::json!({
-                "purl": u.purl,
-                "oldUuid": u.old_uuid,
-                "newUuid": u.new_uuid,
-            })).collect::<Vec<_>>(),
+            "updates": updates_json(&updates),
+            "rollout": stage.json(),
         });
         // Layout refusals ride the non-empty envelope too (additive,
         // omitted when empty).
@@ -1981,6 +2149,9 @@ async fn run_scan(
                 Some(result),
                 telemetry,
                 npm_crawl.as_ref(),
+                &recorded,
+                batch_error_count > 0,
+                &mut stage,
             )
             .await;
         }
@@ -2015,6 +2186,7 @@ async fn run_scan(
                 &policy,
                 false,
                 false,
+                false,
                 telemetry,
                 Some(&mut result),
             )
@@ -2027,33 +2199,44 @@ async fn run_scan(
 
         // --- Apply path (if requested) -----------------------------------
         if apply {
-            let selected: Vec<PatchSearchResult> = match discover_selected(
+            let discovered = match discover_selected(
                 &api_client,
                 &all_packages_with_patches,
                 can_access_paid_patches,
                 &policy,
                 false,
                 false,
+                false,
                 telemetry,
                 Some(&mut result),
             )
             .await
             {
-                Ok(offers) => offers.selected.into_values().collect(),
+                Ok(d) => d,
                 Err((code, message)) => {
                     emit_discovery_error_json(&mut result, &message);
                     return code;
                 }
             };
+            let rows = classified_rows(
+                &mut stage,
+                &discovered,
+                &recorded,
+                batch_error_count > 0,
+                &all_packages_with_patches,
+                Some(&mut result),
+            );
 
             // Vendor-owned and lockfile-only purls leave the selection as
-            // skip records BEFORE download (see `partition_agent_selection`).
+            // skip records BEFORE download (see `partition_agent_selection`);
+            // they cannot land, so they hold no rollout slot either.
             let AgentSelection {
-                kept: selected,
+                kept,
                 skip_records: vendored_records,
                 vendored_purls: vendored_skip_purls,
                 ..
-            } = partition_agent_selection(selected, &vendored_purls, &lockfile_only);
+            } = partition_agent_selection(writers_of(&rows), &vendored_purls, &lockfile_only);
+            let selected = plan_kept_rows(&mut stage, rows, kept);
 
             if dry {
                 // Synthesize the per-patch outcome without touching disk.
@@ -2151,6 +2334,9 @@ async fn run_scan(
                 use_public_proxy,
                 &all_packages_with_patches,
                 can_access_paid_patches,
+                &recorded,
+                batch_error_count > 0,
+                &mut stage,
                 &policy,
                 &mut result,
                 &manifest_path,
@@ -2184,6 +2370,7 @@ async fn run_scan(
             .await;
         }
 
+        finish_rollout_json(&stage, &mut result);
         let final_code = embed_vex_into_json(
             &args.common,
             &args.vex,
@@ -2233,6 +2420,73 @@ async fn run_scan(
         return finish_human(0).await;
     }
 
+    // Count downloadable patches: a free-tier org whose every offer is
+    // paid-tier has nothing any mode could select, so every human arm stops
+    // below the table with the same paid-subscription line.
+    let downloadable_count = if can_access_paid_patches {
+        all_packages_with_patches.len()
+    } else {
+        all_packages_with_patches
+            .iter()
+            .filter(|pkg| pkg.patches.iter().any(|p| p.tier == "free"))
+            .count()
+    };
+
+    // The by-package records every arm selects from, fetched before the
+    // table so its `[UPDATE]` markers are the same UPGRADE rows the
+    // selection acts on (§5.1). Discovery said these packages HAVE
+    // patches, so an empty merged set is a fetch failure.
+    // A failed discovery still prints the table first; its exit code is
+    // returned below it.
+    let mut discovery_failure: Option<i32> = None;
+    let rows: Vec<rollout::Row> = if downloadable_count == 0 {
+        Vec::new()
+    } else {
+        match discover_selected(
+            &api_client,
+            &all_packages_with_patches,
+            can_access_paid_patches,
+            &policy,
+            human,
+            !silent,
+            !hosted,
+            telemetry,
+            None,
+        )
+        .await
+        {
+            // The agent / vendored / report-only arms need records to show:
+            // an empty merged set is a fetch failure there.
+            Ok(discovered) if !hosted && discovered.fetched == 0 => {
+                eprintln!("{}", render::fetch_details_failed(&discovered.failed));
+                discovery_failure = Some(1);
+                Vec::new()
+            }
+            Ok(discovered) => {
+                let rows = classified_rows(
+                    &mut stage,
+                    &discovered,
+                    &recorded,
+                    batch_error_count > 0,
+                    &all_packages_with_patches,
+                    None,
+                );
+                updates = offer_updates(
+                    &rows,
+                    &discovered,
+                    &recorded,
+                    &all_packages_with_patches,
+                );
+                rows
+            }
+            // `discover_selected` already printed the failure to stderr.
+            Err((code, _)) => {
+                discovery_failure = Some(code);
+                Vec::new()
+            }
+        }
+    };
+
     // Presentational only, so `--silent` skips it wholesale.
     if !silent {
         let mut updates_available = 0usize;
@@ -2354,52 +2608,25 @@ async fn run_scan(
         }
     }
 
-    // Count downloadable patches: a free-tier org whose every offer is
-    // paid-tier has nothing any mode could select, so every human arm stops
-    // here with the same paid-subscription line.
-    let downloadable_count = if can_access_paid_patches {
-        all_packages_with_patches.len()
-    } else {
-        all_packages_with_patches
-            .iter()
-            .filter(|pkg| pkg.patches.iter().any(|p| p.tier == "free"))
-            .count()
-    };
-
     if downloadable_count == 0 {
         if !silent {
             println!("\nNo downloadable patches: every patch found requires a paid Socket plan.");
         }
         return finish_human(0).await;
     }
+    if let Some(code) = discovery_failure {
+        return code;
+    }
+    policy.print_human(silent, verbose);
 
     // Hosted mode is a self-contained flow: it reuses the discovery, table
     // and update detection above, then hands the selection to the redirect
     // engine (the same entry as `get --mode hosted`) — it must NOT fall
     // through to the apply/vendor branches.
     if hosted {
-        let selected: Vec<PatchSearchResult> = match discover_selected(
-            &api_client,
-            &all_packages_with_patches,
-            can_access_paid_patches,
-            &policy,
-            human,
-            !silent,
-            telemetry,
-            None,
-        )
-        .await
-        {
-            Ok(offers) => offers.selected.into_values().collect(),
-            // `discover_selected` already printed the failure to stderr.
-            Err((code, _)) => {
-                return code;
-            }
-        };
-        policy.print_human(silent, verbose);
-        let pairs: Vec<(String, String)> = selected
+        let pairs: Vec<(String, String)> = rows
             .iter()
-            .map(|s| (s.purl.clone(), s.uuid.clone()))
+            .map(|r| (r.writer.purl.clone(), r.writer.uuid.clone()))
             .collect();
         return boxed_run_redirect_selected(
             &args.common,
@@ -2409,32 +2636,15 @@ async fn run_scan(
             &pairs,
             None,
             npm_crawl.as_ref(),
+            Some(rollout::Gate::new(&mut stage, rows)),
         )
         .await;
     }
 
-    // Fetch the full per-package patch lists — the same loop the JSON arms
-    // run through `discover_selected`, here with progress + per-package
-    // warnings. Discovery said these packages HAVE patches, so an empty
-    // merged set is a fetch failure.
-    let (all_search_results, detail_failures) =
-        fetch_patch_details(&api_client, &all_packages_with_patches, human, !silent).await;
-    if all_search_results.is_empty() {
-        eprintln!("{}", render::fetch_details_failed(&detail_failures));
-        return 1;
-    }
-
     // A scan left without a mode (`--prune` or global; see
     // `resolve_mode_flags`) only reports, plus the `--prune` GC.
     let report_only = args.mode.is_none();
-
-    // Scan always takes the top-ranked patch the policy admits.
-    let selected: Vec<PatchSearchResult> =
-        select_accessible(all_search_results, can_access_paid_patches, &policy)
-            .selected
-            .into_values()
-            .collect();
-    policy.print_human(silent, verbose);
+    let selected: Vec<PatchSearchResult> = writers_of(&rows);
 
     // The skip / already-recorded lines below open their own paragraph
     // under the table's Summary: one blank line before the first of them.
@@ -2459,6 +2669,23 @@ async fn run_scan(
         split.kept
     };
 
+    // The rollout plan (§5.2): deferred NEW rows leave the selection here.
+    // Vendored eligibility is the wet run's Bun / vlt preflight; the agent
+    // partition above already removed what cannot land in place.
+    let selected = if report_only {
+        selected
+    } else if vendor {
+        let refused = vendor_flow::preflight_refused_purls(&args.common.cwd, &selected).await;
+        stage.plan(&rows, |r| !refused.contains(&r.writer.purl));
+        let deferred = stage.deferred_keys();
+        selected
+            .into_iter()
+            .filter(|p| !deferred.contains(&(p.purl.clone(), p.uuid.clone())))
+            .collect()
+    } else {
+        plan_kept_rows(&mut stage, rows, selected)
+    };
+
     // Drop selections the manifest already records at the same uuid.
     // Agent mode only: vendored mode never reads the manifest.
     let recorded = |p: &PatchSearchResult| {
@@ -2485,12 +2712,19 @@ async fn run_scan(
     if selected.is_empty() {
         if !silent {
             open_paragraph(&mut skip_paragraph);
-            if already_recorded.is_empty() {
+            if !stage.deferred_keys().is_empty() {
+                if args.common.dry_run {
+                    println!("No new patches would be added this run.");
+                } else {
+                    println!("No new patches added this run.");
+                }
+            } else if already_recorded.is_empty() {
                 println!("No patches selected.");
             } else {
                 println!("{}", render::ALL_ALREADY_RECORDED);
             }
         }
+        print_rollout_human(&stage, args.common.dry_run, silent);
         return finish_human(0).await;
     }
 
@@ -2569,6 +2803,7 @@ async fn run_scan(
                 print_dry_run_refusals(preview);
             }
         }
+        print_rollout_human(&stage, true, silent);
         return finish_human(0).await;
     }
 
@@ -2668,6 +2903,9 @@ async fn run_scan(
         }
     }
 
+    // The deferred next steps assume a run that landed.
+    print_rollout_human(&stage, false, silent || code != 0);
+
     // Post-apply GC: only with `--prune` or `--sync`; otherwise an agent
     // apply leaves every other manifest entry alone (`socket-patch repair`
     // cleans up explicitly). Vendor mode runs its own GC in `vendor_flow`.
diff --git a/crates/socket-patch-cli/src/commands/scan/rollout.rs b/crates/socket-patch-cli/src/commands/scan/rollout.rs
new file mode 100644
index 00000000..c2256945
--- /dev/null
+++ b/crates/socket-patch-cli/src/commands/scan/rollout.rs
@@ -0,0 +1,649 @@
+//! Scan's side of the rollout stage (`docs/design/staged-rollout.md` §5,
+//! §9.2): `updates[]`, the hosted gate and the human lines. The stage
+//! itself is [`socket_patch_core::rollout::stage`].
+
+use std::collections::{BTreeMap, BTreeSet, HashSet};
+
+use socket_patch_core::rollout::{canonical_base_purl, severity_label, MaxNew, MaxNewSource, Recorded, RolloutPlan};
+pub(crate) use socket_patch_core::rollout::stage::*;
+
+use super::discovery::UpdateInfo;
+
+/// `updates[]`: the UPGRADE rows, reported under the batch package's purl
+/// spelling when one names the same base purl (one entry per package).
+pub(super) fn upgrades(rows: &[Row], package_purls: &[String]) -> Vec<UpdateInfo> {
+    let by_base: BTreeMap<String, &String> = package_purls
+        .iter()
+        .map(|p| (canonical_base_purl(p), p))
+        .collect();
+    let mut seen: HashSet<String> = HashSet::new();
+    let mut out = Vec::new();
+    for row in rows {
+        let Recorded::Superseded { old_uuid } = &row.candidate.recorded else {
+            continue;
+        };
+        let purl = by_base
+            .get(&row.candidate.base_purl)
+            .map_or_else(|| row.candidate.purl.clone(), |p| (*p).clone());
+        if seen.insert(purl.clone()) {
+            out.push(UpdateInfo {
+                purl,
+                old_uuid: old_uuid.clone(),
+                new_uuid: row.candidate.uuid.clone(),
+            });
+        }
+    }
+    out.sort_by(|a, b| a.purl.cmp(&b.purl));
+    out
+}
+
+/// The rows the hosted engine plans (§9.0 step 7 inside the engine, after
+/// its eligibility checks) and the stage that records the plan.
+pub(crate) struct Gate<'a> {
+    pub(crate) stage: &'a mut Stage,
+    pub(crate) rows: Vec<Row>,
+}
+
+impl<'a> Gate<'a> {
+    pub(crate) fn new(stage: &'a mut Stage, rows: Vec<Row>) -> Self {
+        Gate { stage, rows }
+    }
+
+    /// `(purl, uuid)` of every NEW row, for O(1) [`Self::is_new`] checks.
+    pub(crate) fn new_keys(&self) -> HashSet<(String, String)> {
+        self.rows
+            .iter()
+            .filter(|r| r.candidate.recorded.is_new())
+            .map(|r| (r.writer.purl.clone(), r.writer.uuid.clone()))
+            .collect()
+    }
+
+    /// Whether a NEW `(purl, uuid)` row could be admitted: budget left, or
+    /// its package already admitted by an earlier directory.
+    pub(crate) fn may_admit(&self, purl: &str) -> bool {
+        self.stage.may_admit_new()
+            || (!(self.stage.capped() && self.stage.incomplete)
+                && self
+                    .stage
+                    .already_admitted
+                    .contains(&canonical_base_purl(purl)))
+    }
+}
+
+/// `updates[]` for a run that fetched by-package records: the UPGRADE rows,
+/// plus the batch-derived entries for packages the by-package lookup
+/// returned no offer for (nothing was selected there to disagree with).
+pub(super) fn merge_updates(
+    rows: &[Row],
+    offers: &Offers,
+    package_purls: &[String],
+    batch: Vec<UpdateInfo>,
+) -> Vec<UpdateInfo> {
+    let offered: BTreeSet<String> = offers
+        .unfiltered
+        .keys()
+        .map(|p| canonical_base_purl(p))
+        .collect();
+    let mut out = upgrades(rows, package_purls);
+    out.extend(
+        batch
+            .into_iter()
+            .filter(|u| !offered.contains(&canonical_base_purl(&u.purl))),
+    );
+    out.sort_by(|a, b| a.purl.cmp(&b.purl));
+    out.dedup_by(|a, b| a.purl == b.purl);
+    out
+}
+
+/// The human `Rollout:` line (only when a cap is set) and the
+/// Next-steps lines about deferred patches.
+pub(crate) fn human(stage: &Stage, dry_run: bool) -> (Option<String>, Vec<String>) {
+    let Some(plan) = stage.plan.as_ref() else {
+        return (None, Vec::new());
+    };
+    let ctx = HumanContext {
+        dry_run,
+        incomplete: stage.incomplete && stage.capped(),
+        shared: stage.carry.is_some(),
+    };
+    human_lines(&stage.configured, plan, ctx)
+}
+
+/// `pkg:npm/@scope/x@1.0.0` → `@scope/x@1.0.0`.
+fn short_name(base_purl: &str) -> &str {
+    base_purl
+        .strip_prefix("pkg:")
+        .and_then(|rest| rest.split_once('/'))
+        .map_or(base_purl, |(_, name)| name)
+}
+
+/// How [`human_lines`] words a run.
+#[derive(Debug, Clone, Copy, Default)]
+pub(crate) struct HumanContext {
+    pub(crate) dry_run: bool,
+    /// A lookup failed, so no new patch could be admitted.
+    pub(crate) incomplete: bool,
+    /// The budget is shared with other project directories of this run.
+    pub(crate) shared: bool,
+}
+
+pub(crate) fn human_lines(
+    configured: &MaxNew,
+    plan: &RolloutPlan,
+    ctx: HumanContext,
+) -> (Option<String>, Vec<String>) {
+    let c = plan.counts;
+    let line = configured.value.map(|cap| {
+        let verb = if ctx.dry_run {
+            "would be applied"
+        } else {
+            "applied"
+        };
+        let shared = match (ctx.shared, plan.remaining) {
+            (true, Some(left)) => format!(", shared by this run's directories, {left} left"),
+            _ => String::new(),
+        };
+        format!(
+            "Rollout: {} of {} {verb} (maxNewPatches={cap} from {}{shared}); {}, {} already applied.",
+            c.new,
+            crate::ui::plural((c.new + c.deferred) as usize, "new patch", "new patches"),
+            source_label(configured),
+            crate::ui::plural(c.upgrade as usize, "upgrade", "upgrades"),
+            c.already,
+        )
+    });
+    let groups = deferred_groups(plan);
+    if groups.is_empty() {
+        return (line, Vec::new());
+    }
+    let deferred = crate::ui::plural(groups.len(), "new patch", "new patches");
+    let deferred = if ctx.dry_run {
+        format!("{deferred} would be deferred")
+    } else {
+        format!("{deferred} deferred")
+    };
+    let first = match configured.value {
+        _ if ctx.incomplete => format!(
+            "{deferred}: a patch lookup failed, so no new patch was added this run; run scan \
+             again once the patch API answers."
+        ),
+        Some(0) => format!(
+            "{deferred}: maxNewPatches=0 adds no new patches; {} to add them.",
+            match configured.source {
+                MaxNewSource::Flag => "pass a larger --max-new-patches",
+                MaxNewSource::Env => "raise SOCKET_MAX_NEW_PATCHES",
+                MaxNewSource::File => "raise patches.maxNewPatches in socket.yml",
+                MaxNewSource::Cap | MaxNewSource::Default => "raise the cap",
+            }
+        ),
+        Some(cap) if ctx.dry_run => format!(
+            "{deferred}; the wet run adds the top {}, and each later committed scan the next ones.",
+            (cap as usize).min(c.new as usize + groups.len())
+        ),
+        Some(cap) => format!(
+            "{deferred}; commit these changes and run scan again to apply the next {}.",
+            (cap as usize).min(groups.len())
+        ),
+        None => format!("{deferred}; run scan again to add them."),
+    };
+    let shown: Vec<String> = groups
+        .iter()
+        .take(3)
+        .map(|g| {
+            format!(
+                "{} ({})",
+                short_name(&g.base_purl),
+                severity_label(g.severity_order)
+            )
+        })
+        .collect();
+    let more = if groups.len() > 3 { ", …" } else { "" };
+    (
+        line,
+        vec![first, format!("Next up: {}{more}", shown.join(", "))],
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use socket_patch_core::api::types::PatchSearchResult;
+    use socket_patch_core::manifest::schema::PatchManifest;
+    use std::path::Path;
+    use socket_patch_core::api::types::VulnerabilityResponse;
+    use socket_patch_core::manifest::schema::PatchRecord;
+    use std::collections::HashMap;
+
+    fn offer(purl: &str, uuid: &str, published: &str, severities: &[&str]) -> PatchSearchResult {
+        PatchSearchResult {
+            uuid: uuid.to_string(),
+            purl: purl.to_string(),
+            published_at: published.to_string(),
+            description: String::new(),
+            license: "MIT".to_string(),
+            tier: "free".to_string(),
+            vulnerabilities: severities
+                .iter()
+                .enumerate()
+                .map(|(i, s)| {
+                    (
+                        format!("GHSA-{uuid}-{i}"),
+                        VulnerabilityResponse {
+                            cves: Vec::new(),
+                            summary: String::new(),
+                            severity: (*s).to_string(),
+                            description: String::new(),
+                        },
+                    )
+                })
+                .collect(),
+        }
+    }
+
+    fn manifest(entries: &[(&str, &str)]) -> PatchManifest {
+        let mut m = PatchManifest::new();
+        for (purl, uuid) in entries {
+            m.patches.insert(
+                (*purl).to_string(),
+                PatchRecord {
+                    uuid: (*uuid).to_string(),
+                    exported_at: String::new(),
+                    files: HashMap::new(),
+                    vulnerabilities: HashMap::new(),
+                    description: String::new(),
+                    license: String::new(),
+                    tier: String::new(),
+                },
+            );
+        }
+        m
+    }
+
+    fn classes(rows: &[Row]) -> Vec<(String, Recorded, String)> {
+        rows.iter()
+            .map(|r| {
+                (
+                    r.candidate.purl.clone(),
+                    r.candidate.recorded.clone(),
+                    r.writer.uuid.clone(),
+                )
+            })
+            .collect()
+    }
+
+    #[test]
+    fn offers_drop_inaccessible_paid_patches_and_pick_the_top_one() {
+        let mut paid = offer("pkg:npm/a@1", "p", "2026-01-01T00:00:00Z", &["critical"]);
+        paid.tier = "paid".into();
+        let results = vec![
+            offer("pkg:npm/a@1", "old", "2020-01-01T00:00:00Z", &["high"]),
+            paid,
+            offer("pkg:npm/a@1", "new", "2026-01-01T00:00:00Z", &["high"]),
+        ];
+        let free = offers_from_results(&results, false);
+        assert_eq!(free.selected["pkg:npm/a@1"].uuid, "new");
+        assert_eq!(free.unfiltered["pkg:npm/a@1"].len(), 2);
+        let all = offers_from_results(&results, true);
+        assert_eq!(all.selected["pkg:npm/a@1"].uuid, "p");
+    }
+
+    #[test]
+    fn classification_rows() {
+        let results = vec![
+            // NEW
+            offer("pkg:npm/new@1", "n1", "2026-01-01T00:00:00Z", &["high"]),
+            // ALREADY: recorded == selected
+            offer("pkg:npm/same@1", "s1", "2026-01-01T00:00:00Z", &["high"]),
+            // UPGRADE: the selection is newer than the recorded patch
+            offer("pkg:npm/up@1", "u-new", "2026-06-01T00:00:00Z", &["high"]),
+            offer("pkg:npm/up@1", "u-old", "2026-01-01T00:00:00Z", &["high"]),
+            // ALREADY (kept): the selection only wins on the uuid tiebreak
+            offer("pkg:npm/tie@1", "a-sel", "", &["high"]),
+            offer("pkg:npm/tie@1", "z-rec", "", &["high"]),
+            // UPGRADE: the recorded uuid is no longer offered
+            offer("pkg:npm/gone@1", "g2", "2026-01-01T00:00:00Z", &["low"]),
+        ];
+        let offers = offers_from_results(&results, true);
+        let recorded = manifest(&[
+            ("pkg:npm/same@1", "s1"),
+            ("pkg:npm/up@1", "u-old"),
+            ("pkg:npm/tie@1", "z-rec"),
+            ("pkg:npm/gone@1", "g1"),
+        ]);
+        let rows = classify(&offers, &RecordedIndex::new(Some(&recorded), &[]), "");
+        assert_eq!(
+            classes(&rows),
+            vec![
+                (
+                    "pkg:npm/gone@1".into(),
+                    Recorded::Superseded {
+                        old_uuid: "g1".into()
+                    },
+                    "g2".into()
+                ),
+                ("pkg:npm/new@1".into(), Recorded::None, "n1".into()),
+                ("pkg:npm/same@1".into(), Recorded::Same, "s1".into()),
+                (
+                    "pkg:npm/tie@1".into(),
+                    Recorded::Kept {
+                        uuid: "z-rec".into()
+                    },
+                    "z-rec".into()
+                ),
+                (
+                    "pkg:npm/up@1".into(),
+                    Recorded::Superseded {
+                        old_uuid: "u-old".into()
+                    },
+                    "u-new".into()
+                ),
+            ]
+        );
+        let updates = upgrades(&rows, &["pkg:npm/up@1".to_string()]);
+        assert_eq!(
+            updates
+                .iter()
+                .map(|u| (u.purl.as_str(), u.old_uuid.as_str(), u.new_uuid.as_str()))
+                .collect::<Vec<_>>(),
+            [
+                ("pkg:npm/gone@1", "g1", "g2"),
+                ("pkg:npm/up@1", "u-old", "u-new")
+            ]
+        );
+    }
+
+    #[test]
+    fn recorded_matches_percent_encoding_and_qualifier_twins() {
+        let results = vec![
+            offer("pkg:npm/%40s/x@1", "e1", "", &["high"]),
+            offer("pkg:pypi/w@1?artifact_id=b", "w2", "", &["high"]),
+        ];
+        let offers = offers_from_results(&results, true);
+        let recorded = manifest(&[
+            ("pkg:npm/@s/x@1", "e1"),
+            ("pkg:pypi/w@1?artifact_id=a", "w1"),
+        ]);
+        let rows = classify(&offers, &RecordedIndex::new(Some(&recorded), &[]), "");
+        assert_eq!(rows[0].candidate.recorded, Recorded::Same);
+        // The twin's recorded uuid is not offered for this twin: the late
+        // twin lands uncapped as an UPGRADE.
+        assert_eq!(
+            rows[1].candidate.recorded,
+            Recorded::Superseded {
+                old_uuid: "w1".into()
+            }
+        );
+    }
+
+    #[test]
+    fn several_recorded_uuids_prefer_the_selected_one_else_the_smallest() {
+        let results = vec![offer("pkg:pypi/w@1", "b", "", &["high"])];
+        let offers = offers_from_results(&results, true);
+        let recorded = manifest(&[
+            ("pkg:pypi/w@1?artifact_id=1", "c"),
+            ("pkg:pypi/w@1?artifact_id=2", "b"),
+        ]);
+        let rows = classify(&offers, &RecordedIndex::new(Some(&recorded), &[]), "");
+        assert_eq!(rows[0].candidate.recorded, Recorded::Same);
+        let recorded = manifest(&[
+            ("pkg:pypi/w@1?artifact_id=1", "d"),
+            ("pkg:pypi/w@1?artifact_id=2", "c"),
+        ]);
+        let rows = classify(&offers, &RecordedIndex::new(Some(&recorded), &[]), "");
+        assert_eq!(
+            rows[0].candidate.recorded,
+            Recorded::Superseded {
+                old_uuid: "c".into()
+            }
+        );
+    }
+
+    #[test]
+    fn mentioned_uuids_finds_every_canonical_shape_once() {
+        let mut out = HashSet::new();
+        mentioned_uuids(
+            "https://h/p/22222222-2222-4222-8222-222222222222/AAAAAAAA-1111-4111-8111-00000000000A/x.tgz \
+             not-a-uuid 1234 socket-patch-bbbbbbbb-1111-4111-8111-00000000000b",
+            &mut out,
+        );
+        let mut got: Vec<&str> = out.iter().map(String::as_str).collect();
+        got.sort();
+        assert_eq!(
+            got,
+            [
+                "22222222-2222-4222-8222-222222222222",
+                "aaaaaaaa-1111-4111-8111-00000000000a",
+                "bbbbbbbb-1111-4111-8111-00000000000b",
+            ]
+        );
+    }
+
+    #[test]
+    fn a_lock_naming_the_selected_uuid_marks_the_row_already() {
+        let results = vec![
+            offer(
+                "pkg:npm/a@1",
+                "aaaaaaaa-1111-4111-8111-00000000000a",
+                "",
+                &["high"],
+            ),
+            offer(
+                "pkg:npm/b@1",
+                "bbbbbbbb-1111-4111-8111-00000000000b",
+                "",
+                &["high"],
+            ),
+        ];
+        let offers = offers_from_results(&results, true);
+        let mut rows = classify(&offers, &RecordedIndex::default(), "");
+        mark_pinned(
+            &mut rows,
+            &["resolved: https://x/AAAAAAAA-1111-4111-8111-00000000000A/a.tgz"],
+        );
+        assert_eq!(rows[0].candidate.recorded, Recorded::Same);
+        assert_eq!(rows[1].candidate.recorded, Recorded::None);
+    }
+
+    #[test]
+    fn case_folded_pins_match_the_selection_spelling() {
+        // Discovery keys a nuget pin by the lowercased name; the API and
+        // the lockfile keep the original case.
+        let results = vec![
+            offer("pkg:nuget/Newtonsoft.Json@13.0.3", "a-sel", "", &["high"]),
+            offer("pkg:nuget/Newtonsoft.Json@13.0.3", "z-pin", "", &["high"]),
+        ];
+        let offers = offers_from_results(&results, true);
+        let index = RecordedIndex::new(
+            None,
+            &[("pkg:nuget/newtonsoft.json@13.0.3".into(), "z-pin".into())],
+        );
+        let rows = classify(&offers, &index, "");
+        assert_eq!(
+            rows[0].candidate.recorded,
+            Recorded::Kept {
+                uuid: "z-pin".into()
+            },
+            "an equal sibling never replaces the pinned patch"
+        );
+        assert_eq!(rows[0].writer.uuid, "z-pin");
+    }
+
+    #[test]
+    fn both_pinned_qualifier_twins_are_already() {
+        // Hosted pins are keyed by base purl; each twin carries its own
+        // patch. Neither may read as an UPGRADE on a converged repo.
+        let results = vec![
+            offer(
+                "pkg:pypi/foo@1.0?artifact_id=sdist",
+                "u-sdist",
+                "",
+                &["high"],
+            ),
+            offer("pkg:pypi/foo@1.0?artifact_id=whl", "u-whl", "", &["high"]),
+        ];
+        let offers = offers_from_results(&results, true);
+        let pins = vec![
+            ("pkg:pypi/foo@1.0".to_string(), "u-sdist".to_string()),
+            ("pkg:pypi/foo@1.0".to_string(), "u-whl".to_string()),
+        ];
+        let mut merged = PatchManifest::new();
+        merged.patches.insert(
+            "pkg:pypi/foo@1.0".into(),
+            manifest(&[("x", "u-sdist")]).patches.remove("x").unwrap(),
+        );
+        let rows = classify(&offers, &RecordedIndex::new(Some(&merged), &pins), "");
+        assert!(
+            rows.iter().all(|r| r.candidate.recorded == Recorded::Same),
+            "{rows:?}"
+        );
+    }
+
+    #[test]
+    fn lookup_incomplete_only_when_a_new_package_could_be_missing() {
+        let index = RecordedIndex::new(Some(&manifest(&[("pkg:npm/rec@1", "u")])), &[]);
+        assert!(!lookup_incomplete(&index, &[], false));
+        assert!(
+            lookup_incomplete(&index, &[], true),
+            "a failed batch hides unknown packages"
+        );
+        assert!(
+            !lookup_incomplete(&index, &["pkg:npm/rec@1".into()], false),
+            "a recorded package's failed lookup cannot hide a NEW row"
+        );
+        assert!(lookup_incomplete(
+            &index,
+            &["pkg:npm/other@1".into()],
+            false
+        ));
+    }
+
+    #[test]
+    fn stage_carries_the_budget_and_renders_the_block() {
+        let configured = MaxNew {
+            value: Some(2),
+            source: MaxNewSource::Flag,
+        };
+        let carry = RolloutCarry::new(configured, "/repo".into());
+        let results = vec![
+            offer("pkg:npm/a@1", "ua", "", &["critical"]),
+            offer("pkg:npm/b@1", "ub", "", &["low"]),
+        ];
+        let offers = offers_from_results(&results, true);
+        let mut first = Stage::new(configured, Some(carry.clone()), Path::new("/repo/x"));
+        assert_eq!(first.project, "x");
+        let rows = classify(&offers, &RecordedIndex::default(), &first.project);
+        first.plan(&rows, |_| true);
+        assert_eq!(carry.lock().remaining, Some(0));
+        let results = vec![
+            offer("pkg:npm/a@1", "ua", "", &["critical"]),
+            offer("pkg:npm/c@1", "uc", "", &["high"]),
+        ];
+        let offers = offers_from_results(&results, true);
+        let mut second = Stage::new(configured, Some(carry.clone()), Path::new("/repo/y"));
+        let rows = classify(&offers, &RecordedIndex::default(), &second.project);
+        second.plan(&rows, |_| true);
+        let json = second.json();
+        assert_eq!(
+            json["maxNewPatches"],
+            serde_json::json!({"value": 2, "source": "flag"})
+        );
+        assert_eq!(
+            json["counts"],
+            serde_json::json!({"new": 1, "deferred": 1, "upgrade": 0, "already": 0})
+        );
+        assert_eq!(
+            json["deferred"],
+            serde_json::json!([{
+                "purl": "pkg:npm/c@1", "uuids": ["uc"], "severity": "high",
+                "advisoryCount": 1, "projects": ["y"], "rank": 2
+            }])
+        );
+        assert_eq!(
+            serde_json::to_value(second.deferred_skips()).unwrap(),
+            serde_json::json!([{
+                "purl": "pkg:npm/c@1", "uuid": "uc", "reason": "rollout_deferred",
+                "detail": "rank 2 in the rollout queue; a later scan adds it"
+            }])
+        );
+        let (line, next) = human(&second, false);
+        assert_eq!(
+            line.as_deref(),
+            Some(
+                "Rollout: 1 of 2 new patches applied (maxNewPatches=2 from --max-new-patches, \
+                 shared by this run's directories, 0 left); 0 upgrades, 0 already applied."
+            )
+        );
+        assert_eq!(
+            next,
+            [
+                "1 new patch deferred; commit these changes and run scan again to apply the next 1.",
+                "Next up: c@1 (high)"
+            ]
+        );
+    }
+
+    #[test]
+    fn unlimited_runs_print_no_rollout_line() {
+        let results = vec![offer("pkg:npm/a@1", "ua", "", &["critical"])];
+        let offers = offers_from_results(&results, true);
+        let mut stage = Stage::new(MaxNew::UNLIMITED, None, Path::new("/repo"));
+        let rows = classify(&offers, &RecordedIndex::default(), "");
+        stage.plan(&rows, |_| true);
+        assert_eq!(human(&stage, false), (None, Vec::new()));
+        assert_eq!(
+            stage.json()["maxNewPatches"]["value"],
+            serde_json::Value::Null
+        );
+        assert_eq!(stage.json()["counts"]["new"], 1);
+    }
+
+    #[test]
+    fn a_zero_cap_says_how_to_add_the_deferred_patches() {
+        let results: Vec<PatchSearchResult> = ["a", "b", "c", "d"]
+            .iter()
+            .map(|n| offer(&format!("pkg:npm/{n}@1"), n, "", &["high"]))
+            .collect();
+        let offers = offers_from_results(&results, true);
+        let zero = MaxNew {
+            value: Some(0),
+            source: MaxNewSource::File,
+        };
+        let mut stage = Stage::new(zero, None, Path::new("/repo"));
+        let rows = classify(&offers, &RecordedIndex::default(), "");
+        stage.plan(&rows, |_| true);
+        let (line, next) = human(&stage, true);
+        assert_eq!(
+            line.as_deref(),
+            Some(
+                "Rollout: 0 of 4 new patches would be applied (maxNewPatches=0 from socket.yml); \
+                 0 upgrades, 0 already applied."
+            )
+        );
+        assert!(
+            next[0].starts_with("4 new patches would be deferred: maxNewPatches=0"),
+            "{next:?}"
+        );
+        assert_eq!(next[1], "Next up: a@1 (high), b@1 (high), c@1 (high), …");
+    }
+
+    #[test]
+    fn incomplete_lookups_warn_only_when_they_deferred_something() {
+        let results = vec![offer("pkg:npm/a@1", "ua", "", &["critical"])];
+        let offers = offers_from_results(&results, true);
+        let capped = MaxNew {
+            value: Some(3),
+            source: MaxNewSource::Flag,
+        };
+        let mut stage = Stage::new(capped, None, Path::new("/repo"));
+        stage.incomplete = true;
+        assert!(!stage.may_admit_new());
+        stage.plan(&classify(&offers, &RecordedIndex::default(), ""), |_| true);
+        let codes: Vec<&str> = stage.warnings().iter().map(|(c, _)| *c).collect();
+        assert_eq!(codes, [ROLLOUT_INCOMPLETE_LOOKUP]);
+        let mut unlimited = Stage::new(MaxNew::UNLIMITED, None, Path::new("/repo"));
+        unlimited.incomplete = true;
+        assert!(unlimited.may_admit_new());
+        unlimited.plan(&classify(&offers, &RecordedIndex::default(), ""), |_| true);
+        assert!(unlimited.warnings().is_empty());
+    }
+}
diff --git a/crates/socket-patch-cli/src/commands/scan/rollout_args.rs b/crates/socket-patch-cli/src/commands/scan/rollout_args.rs
new file mode 100644
index 00000000..47b7b7ca
--- /dev/null
+++ b/crates/socket-patch-cli/src/commands/scan/rollout_args.rs
@@ -0,0 +1,128 @@
+//! `scan --max-new-patches` (work item B of the staged-rollout design,
+//! `docs/design/staged-rollout.md` §5).
+
+
+use clap::Args;
+pub(crate) use socket_patch_core::rollout::stage::RolloutCarry;
+use socket_patch_core::rollout::{resolve_max_new, MaxNew};
+
+/// The env binding of `--max-new-patches`. Read by [`RolloutArgs::resolve`]
+/// rather than clap's `env =`, because the rollout block reports whether
+/// the value came from the flag or the environment.
+pub use socket_patch_core::rollout::stage::MAX_NEW_PATCHES_ENV;
+
+/// A parsed `--max-new-patches` value; `None` is `none` (no cap).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct MaxNewPatches(pub Option<u32>);
+
+/// `N` (0..=4294967295) or `none`, case-insensitive.
+pub fn parse_max_new_patches(s: &str) -> Result<MaxNewPatches, String> {
+    let s = s.trim();
+    if s.is_empty() {
+        return Err("a number of patches (0 to 4294967295) or `none` is required".to_string());
+    }
+    if s.eq_ignore_ascii_case("none") {
+        return Ok(MaxNewPatches(None));
+    }
+    s.parse::<u32>()
+        .map(|n| MaxNewPatches(Some(n)))
+        .map_err(|_| format!("`{s}` is not a number of patches (0 to 4294967295) or `none`"))
+}
+
+#[derive(Args, Clone, Default)]
+pub struct RolloutArgs {
+    /// Add at most N patches to packages that have none yet, most severe
+    /// first; the rest are deferred to the next scan. Upgrades of patched
+    /// packages are not capped, and `0` adds only upgrades. `none` means no
+    /// cap. Also read from SOCKET_MAX_NEW_PATCHES
+    #[arg(
+        long = "max-new-patches",
+        value_name = "N|none",
+        value_parser = parse_max_new_patches
+    )]
+    pub max_new_patches: Option<MaxNewPatches>,
+
+    /// The budget shared by the project directories of one invocation.
+    #[arg(skip)]
+    pub(crate) carry: Option<RolloutCarry>,
+}
+
+impl RolloutArgs {
+    /// The configured cap: the flag, then `env` (the
+    /// [`MAX_NEW_PATCHES_ENV`] value; empty is unset), then the socket.yml
+    /// value, then unlimited. A malformed env value is a usage error.
+    pub fn resolve(&self, env: Option<&str>, file: Option<u32>) -> Result<MaxNew, String> {
+        // The flag wins outright: an env value it overrides is never read.
+        let env = env.filter(|_| self.max_new_patches.is_none());
+        let env = match env.filter(|v| !v.trim().is_empty()) {
+            Some(raw) => Some(
+                parse_max_new_patches(raw)
+                    .map_err(|e| format!("{MAX_NEW_PATCHES_ENV}: {e}"))?
+                    .0,
+            ),
+            None => None,
+        };
+        Ok(resolve_max_new(
+            self.max_new_patches.map(|v| v.0),
+            env,
+            file,
+            None,
+        ))
+    }
+
+    /// [`Self::resolve`] against the process environment.
+    pub fn resolve_from_env(&self, file: Option<u32>) -> Result<MaxNew, String> {
+        let env = std::env::var(MAX_NEW_PATCHES_ENV).ok();
+        self.resolve(env.as_deref(), file)
+    }
+}
+
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use socket_patch_core::rollout::MaxNewSource;
+
+    #[test]
+    fn parses_numbers_and_none() {
+        assert_eq!(parse_max_new_patches("5"), Ok(MaxNewPatches(Some(5))));
+        assert_eq!(parse_max_new_patches("0"), Ok(MaxNewPatches(Some(0))));
+        assert_eq!(
+            parse_max_new_patches("4294967295"),
+            Ok(MaxNewPatches(Some(u32::MAX)))
+        );
+        assert_eq!(parse_max_new_patches("NONE"), Ok(MaxNewPatches(None)));
+        for bad in ["", "-1", "4294967296", "five", "1.5", "all"] {
+            assert!(parse_max_new_patches(bad).is_err(), "{bad:?}");
+        }
+    }
+
+    #[test]
+    fn flag_beats_env_beats_file() {
+        let flag = RolloutArgs {
+            max_new_patches: Some(MaxNewPatches(Some(1))),
+            carry: None,
+        };
+        let none = RolloutArgs::default();
+        let got = flag.resolve(Some("2"), Some(3)).unwrap();
+        assert_eq!((got.value, got.source), (Some(1), MaxNewSource::Flag));
+        let got = none.resolve(Some("2"), Some(3)).unwrap();
+        assert_eq!((got.value, got.source), (Some(2), MaxNewSource::Env));
+        let got = none.resolve(Some("none"), Some(3)).unwrap();
+        assert_eq!((got.value, got.source), (None, MaxNewSource::Env));
+        let got = none.resolve(Some(""), Some(3)).unwrap();
+        assert_eq!((got.value, got.source), (Some(3), MaxNewSource::File));
+        let got = none.resolve(None, None).unwrap();
+        assert_eq!((got.value, got.source), (None, MaxNewSource::Default));
+        let err = none.resolve(Some("lots"), None).unwrap_err();
+        assert!(err.starts_with("SOCKET_MAX_NEW_PATCHES: "), "{err}");
+        let got = none.resolve(Some("  "), Some(3)).unwrap();
+        assert_eq!(got.source, MaxNewSource::File, "whitespace is unset");
+        let got = flag.resolve(Some("lots"), None).unwrap();
+        assert_eq!(
+            got.source,
+            MaxNewSource::Flag,
+            "an overridden env value is not parsed"
+        );
+    }
+}
diff --git a/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs b/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs
index 9b2e11e8..2f388504 100644
--- a/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs
+++ b/crates/socket-patch-cli/src/commands/scan/vendor_flow.rs
@@ -41,9 +41,10 @@ use crate::json_envelope::{Command as EnvelopeCommand, Envelope};
 use crate::ui::{plural, print_json};
 
 use super::gc::{gc_json, print_gc_vendored_line, run_apply_gc};
+use super::rollout::Stage;
 use super::{
-    discover_selected, download_params, embed_vex_into_json, emit_discovery_error_json,
-    push_run_warning, ScanArgs,
+    classified_rows, discover_selected, download_params, embed_vex_into_json,
+    emit_discovery_error_json, finish_rollout_json, push_run_warning, writers_of, ScanArgs,
 };
 
 /// Run-level warning: a `.socket/manifest.json` record for a purl the
@@ -124,6 +125,29 @@ pub(crate) async fn preview_vendor_json(
     serde_json::json!({ "dryRun": true, "patches": patches })
 }
 
+/// The purls of `selected` the wet run's Bun or vlt preflight would refuse
+/// before any download (the `would_refuse` rows of
+/// [`preview_vendor_json`]): the vendored planning pass, so a refused NEW
+/// patch holds no rollout slot.
+pub(super) async fn preflight_refused_purls(
+    cwd: &Path,
+    selected: &[PatchSearchResult],
+) -> HashSet<String> {
+    let state = load_state(cwd).await;
+    let refusal =
+        bun_vendor_preflight_with_ledger(cwd, selected, state.as_ref().map(|s| &s.entries)).await;
+    let vlt_refusals =
+        vlt_vendor_preflight_selected(cwd, selected, state.as_ref().map(|s| &s.entries)).await;
+    selected
+        .iter()
+        .filter(|p| {
+            refusal.as_ref().is_some_and(|r| r.applies_to(&p.purl))
+                || vlt_refusal_for(&vlt_refusals, &p.purl).is_some()
+        })
+        .map(|p| p.purl.clone())
+        .collect()
+}
+
 /// Human rendering of the vendored dry-run preview's `would_refuse` records
 /// (see [`preview_vendor_json`]): the count line above it still says
 /// "would download and vendor", so name what the wet run would refuse and
@@ -452,6 +476,9 @@ async fn run_vendor_json_path(
     use_public_proxy: bool,
     all_packages_with_patches: &[BatchPackagePatches],
     can_access_paid_patches: bool,
+    recorded: &super::rollout::RecordedState<'_>,
+    batch_failed: bool,
+    stage: &mut Stage,
     policy: &super::policy::ScanPolicy,
     result: &mut serde_json::Value,
     manifest_path: &Path,
@@ -470,24 +497,44 @@ async fn run_vendor_json_path(
     // Same discovery as `--apply`. Vendored purls are NOT filtered here —
     // re-vendoring a stale uuid is the point of the flag (same-uuid re-runs
     // land on the backend's `already_vendored` skip).
-    let selected: Vec<socket_patch_core::api::types::PatchSearchResult> = match discover_selected(
+    let discovered = match discover_selected(
         api_client,
         all_packages_with_patches,
         can_access_paid_patches,
         policy,
         false,
         false,
+        false,
         telemetry,
         Some(&mut *result),
     )
     .await
     {
-        Ok(offers) => offers.selected.into_values().collect(),
+        Ok(d) => d,
         Err((code, message)) => {
             emit_discovery_error_json(result, &message);
             return code;
         }
     };
+    let rows = classified_rows(
+        stage,
+        &discovered,
+        recorded,
+        batch_failed,
+        all_packages_with_patches,
+        Some(&mut *result),
+    );
+    // The planning pass: a patch the preflight refuses holds no slot (it
+    // still reaches the engine, which reports the refusal).
+    let writers = writers_of(&rows);
+    let refused = preflight_refused_purls(&args.common.cwd, &writers).await;
+    stage.plan(&rows, |r| !refused.contains(&r.writer.purl));
+    let deferred = stage.deferred_keys();
+    let selected: Vec<PatchSearchResult> = writers
+        .into_iter()
+        .filter(|p| !deferred.contains(&(p.purl.clone(), p.uuid.clone())))
+        .collect();
+    finish_rollout_json(stage, result);
 
     if args.common.dry_run {
         // No downloads, no backends: classify against the ledger
@@ -557,6 +604,9 @@ async fn run_vendor_json_path(
                 "code": code,
                 "message": message,
             });
+            if let Some(obj) = result.as_object_mut() {
+                obj.remove("rollout");
+            }
             print_json(result);
             return 1;
         }
@@ -781,6 +831,9 @@ pub(super) fn boxed_vendor_json_path<'a>(
     use_public_proxy: bool,
     all_packages_with_patches: &'a [BatchPackagePatches],
     can_access_paid_patches: bool,
+    recorded: &'a super::rollout::RecordedState<'a>,
+    batch_failed: bool,
+    stage: &'a mut Stage,
     policy: &'a super::policy::ScanPolicy,
     result: &'a mut serde_json::Value,
     manifest_path: &'a Path,
@@ -799,6 +852,9 @@ pub(super) fn boxed_vendor_json_path<'a>(
         use_public_proxy,
         all_packages_with_patches,
         can_access_paid_patches,
+        recorded,
+        batch_failed,
+        stage,
         policy,
         result,
         manifest_path,
diff --git a/crates/socket-patch-cli/src/lib.rs b/crates/socket-patch-cli/src/lib.rs
index 297fb9f3..32e01e9e 100644
--- a/crates/socket-patch-cli/src/lib.rs
+++ b/crates/socket-patch-cli/src/lib.rs
@@ -182,6 +182,7 @@ fn short_help_hidden_own(sub: &str) -> &'static [&'static str] {
             "vex_compact",
             "no_socket_yml",
             "min_severity",
+            "max_new_patches",
         ],
         "get" => &["id", "cve", "ghsa", "package", "save_only", "all_releases"],
         "vex" => &["doc_id", "compact"],
diff --git a/crates/socket-patch-cli/tests/cli_parse_scan.rs b/crates/socket-patch-cli/tests/cli_parse_scan.rs
index d6af0472..ab81fa6e 100644
--- a/crates/socket-patch-cli/tests/cli_parse_scan.rs
+++ b/crates/socket-patch-cli/tests/cli_parse_scan.rs
@@ -45,6 +45,7 @@ const SCAN_ENV_VARS: &[&str] = &[
     "SOCKET_JSON",
     "SOCKET_LOCK_TIMEOUT",
     "SOCKET_MANIFEST_PATH",
+    "SOCKET_MAX_NEW_PATCHES",
     "SOCKET_MIN_SEVERITY",
     "SOCKET_NO_SOCKET_YML",
     "SOCKET_NO_TRUST_LOCKFILE_CONFIG",
@@ -521,6 +522,11 @@ fn scan_json_empty_cwd_emits_updates_key() {
         // v4 duality rework: the positional PATH globs are echoed on every
         // scan envelope, always present (empty when no scoping was given).
         "paths": [],
+        "rollout": {
+            "maxNewPatches": { "value": null, "source": "default" },
+            "counts": { "new": 0, "deferred": 0, "upgrade": 0, "already": 0 },
+            "deferred": [],
+        },
         // v5: a bare scan runs hosted mode, so its result nests here.
         "redirect": {
             "mode": "hosted",
@@ -871,6 +877,61 @@ fn no_vlt_install_cleanup_flag_and_env_parse() {
     }
 }
 
+// ── --max-new-patches (staged rollout) ───────────────────────────────────
+
+#[test]
+#[serial_test::serial]
+fn max_new_patches_defaults_to_unset() {
+    let args = parse_scan(&[]);
+    assert_eq!(args.rollout.max_new_patches, None);
+}
+
+#[test]
+#[serial_test::serial]
+fn max_new_patches_takes_a_count_or_none() {
+    use socket_patch_cli::commands::scan::rollout_args::MaxNewPatches;
+    for (raw, want) in [
+        ("5", Some(5)),
+        ("0", Some(0)),
+        ("4294967295", Some(u32::MAX)),
+        ("none", None),
+        ("NONE", None),
+    ] {
+        let args = parse_scan(&["--max-new-patches", raw]);
+        assert_eq!(args.rollout.max_new_patches, Some(MaxNewPatches(want)), "{raw}");
+    }
+}
+
+#[test]
+#[serial_test::serial]
+fn max_new_patches_rejects_malformed_values() {
+    for raw in ["-1", "4294967296", "five", "", "all"] {
+        let err = match try_parse_scan(&[&format!("--max-new-patches={raw}")]) {
+            Ok(_) => panic!("{raw:?} must not parse"),
+            Err(e) => e,
+        };
+        assert_eq!(err.exit_code(), 2, "{raw:?}: usage error");
+    }
+}
+
+#[test]
+fn max_new_patches_env_is_read_at_run_time() {
+    // The env binding is resolved by `RolloutArgs::resolve` (the rollout
+    // block reports flag vs env), not by clap: empty is unset, malformed is
+    // a usage error, and the flag wins.
+    use socket_patch_cli::commands::scan::rollout_args::{MaxNewPatches, RolloutArgs};
+    use socket_patch_core::rollout::MaxNewSource;
+    let unset = RolloutArgs::default();
+    let got = unset.resolve(Some("7"), None).unwrap();
+    assert_eq!((got.value, got.source), (Some(7), MaxNewSource::Env));
+    let got = unset.resolve(Some(""), None).unwrap();
+    assert_eq!((got.value, got.source), (None, MaxNewSource::Default));
+    assert!(unset.resolve(Some("x"), None).is_err());
+    let mut flag = RolloutArgs::default();
+    flag.max_new_patches = Some(MaxNewPatches(Some(1)));
+    let got = flag.resolve(Some("7"), None).unwrap();
+    assert_eq!((got.value, got.source), (Some(1), MaxNewSource::Flag));
+}
 /// Parse `scan` under a clean env plus `env`, restoring it afterwards.
 fn parse_scan_with_env(extra: &[&str], env: &[(&str, &str)]) -> Result<ScanArgs, clap::Error> {
     with_clean_env(|| {
diff --git a/crates/socket-patch-cli/tests/hosted_memory_common/mod.rs b/crates/socket-patch-cli/tests/hosted_memory_common/mod.rs
index 6d8b2427..cecd456b 100644
--- a/crates/socket-patch-cli/tests/hosted_memory_common/mod.rs
+++ b/crates/socket-patch-cli/tests/hosted_memory_common/mod.rs
@@ -305,7 +305,7 @@ pub struct DiskRun {
 /// node / pipenv / gem subprocesses), `HOME` and the language caches at
 /// empty directories, no socket-cli config, no telemetry.
 pub fn run_disk(server: &MockServer, files: &BTreeMap<String, Vec<u8>>, dry_run: bool) -> DiskRun {
-    run_disk_in(server, files, "", dry_run)
+    run_disk_with(server, files, dry_run, &[])
 }
 
 /// [`run_disk`] with `--cwd` at the repo-relative `cwd_rel` of a checkout
@@ -317,6 +317,76 @@ pub fn run_disk_in(
     cwd_rel: &str,
     dry_run: bool,
 ) -> DiskRun {
+    run_disk_in_with(server, files, cwd_rel, dry_run, &[])
+}
+
+/// A human (non-`--json`) disk scan with `args`: exit code, stdout, and the
+/// files it changed.
+pub fn run_disk_args(
+    server: &MockServer,
+    files: &BTreeMap<String, Vec<u8>>,
+    args: &[&str],
+) -> (i32, String, BTreeMap<String, Vec<u8>>) {
+    let (checkout, _home, mut cmd) = disk_command(server, files, "");
+    cmd.args(args);
+    let output = cmd.output().expect("spawn socket-patch");
+    let stdout = String::from_utf8_lossy(&output.stdout).to_string();
+    let after = read_tree(checkout.path());
+    let changed = after
+        .into_iter()
+        .filter(|(rel, bytes)| files.get(rel) != Some(bytes))
+        .collect();
+    (output.status.code().unwrap_or(-1), stdout, changed)
+}
+
+/// [`run_disk`] with extra `scan --json` arguments.
+pub fn run_disk_with(
+    server: &MockServer,
+    files: &BTreeMap<String, Vec<u8>>,
+    dry_run: bool,
+    extra: &[&str],
+) -> DiskRun {
+    run_disk_in_with(server, files, "", dry_run, extra)
+}
+
+fn run_disk_in_with(
+    server: &MockServer,
+    files: &BTreeMap<String, Vec<u8>>,
+    cwd_rel: &str,
+    dry_run: bool,
+    extra: &[&str],
+) -> DiskRun {
+    let (checkout, _home, mut cmd) = disk_command(server, files, cwd_rel);
+    cmd.arg("--json");
+    if dry_run {
+        cmd.arg("--dry-run");
+    }
+    cmd.args(extra);
+    let output = cmd.output().expect("spawn socket-patch");
+    let stdout = String::from_utf8_lossy(&output.stdout).to_string();
+    let stderr = String::from_utf8_lossy(&output.stderr).to_string();
+    let envelope: Value = serde_json::from_str(&stdout)
+        .unwrap_or_else(|e| panic!("disk --json output is not JSON ({e}):\n{stdout}\n{stderr}"));
+    let after = read_tree(checkout.path());
+    let changed = after
+        .into_iter()
+        .filter(|(rel, bytes)| files.get(rel) != Some(bytes))
+        .collect();
+    DiskRun {
+        envelope,
+        changed,
+        stderr,
+    }
+}
+
+/// The scrubbed `scan --mode hosted` command over a checkout of `files`,
+/// run at `cwd_rel` (the returned tempdirs, the checkout and `HOME`, must
+/// outlive the run).
+fn disk_command(
+    server: &MockServer,
+    files: &BTreeMap<String, Vec<u8>>,
+    cwd_rel: &str,
+) -> (tempfile::TempDir, tempfile::TempDir, std::process::Command) {
     let checkout = tempfile::tempdir().unwrap();
     let home = tempfile::tempdir().unwrap();
     for (rel, bytes) in files {
@@ -361,7 +431,6 @@ pub fn run_disk_in(
         "scan",
         "--mode",
         "hosted",
-        "--json",
         "--yes",
         "--cwd",
         cwd.to_str().unwrap(),
@@ -372,24 +441,7 @@ pub fn run_disk_in(
         "--api-url",
         &server.uri(),
     ]);
-    if dry_run {
-        cmd.arg("--dry-run");
-    }
-    let output = cmd.output().expect("spawn socket-patch");
-    let stdout = String::from_utf8_lossy(&output.stdout).to_string();
-    let stderr = String::from_utf8_lossy(&output.stderr).to_string();
-    let envelope: Value = serde_json::from_str(&stdout)
-        .unwrap_or_else(|e| panic!("disk --json output is not JSON ({e}):\n{stdout}\n{stderr}"));
-    let after = read_tree(checkout.path());
-    let changed = after
-        .into_iter()
-        .filter(|(rel, bytes)| files.get(rel) != Some(bytes))
-        .collect();
-    DiskRun {
-        envelope,
-        changed,
-        stderr,
-    }
+    (checkout, home, cmd)
 }
 
 /// The engine's changed files (text and binary) as bytes.
diff --git a/crates/socket-patch-cli/tests/hosted_memory_rollout.rs b/crates/socket-patch-cli/tests/hosted_memory_rollout.rs
new file mode 100644
index 00000000..ccaf92cc
--- /dev/null
+++ b/crates/socket-patch-cli/tests/hosted_memory_rollout.rs
@@ -0,0 +1,639 @@
+//! The staged rollout (`maxNewPatches`) in the in-memory hosted engine,
+//! held to the disk `scan --mode hosted --json --max-new-patches` run: one
+//! root admits and defers the same rows run after run until converged; two
+//! roots show memory's run-wide budget next to disk's per-directory one
+//! (they differ by design, §5.2); a committed manifest, vendor ledger or
+//! lockfile pin counts as recorded, never NEW.
+
+use std::collections::BTreeMap;
+
+use serde_json::{json, Value};
+use socket_patch_cli::hosted_memory::{HostedScanOptions, HostedScanOutput, MaxNewPatchesOption};
+use wiremock::matchers::{method, path, path_regex};
+use wiremock::{Mock, MockServer, Request, Respond, ResponseTemplate};
+
+#[path = "hosted_memory_common/mod.rs"]
+mod common;
+
+use common::{build_input, run_disk_args, run_disk_with, run_engine, ORG};
+
+const TOKEN: &str = "22222222-2222-4222-8222-222222222222";
+
+/// `(name, severities)`: one advisory per severity.
+const PACKAGES: [(&str, &[&str]); 5] = [
+    ("mem-a", &["low"]),
+    ("mem-b", &["critical"]),
+    ("mem-c", &["high"]),
+    ("mem-d", &["medium"]),
+    ("mem-e", &["critical", "high"]),
+];
+
+/// Most severe first: severity, then advisory count, then name.
+const ORDER: [&str; 5] = ["mem-e", "mem-b", "mem-c", "mem-d", "mem-a"];
+
+fn uuid(name: &str) -> String {
+    let n = PACKAGES.iter().position(|(p, _)| *p == name).unwrap() + 1;
+    format!("{n:08x}-3333-4333-8333-{n:012x}")
+}
+
+fn purl(name: &str) -> String {
+    format!("pkg:npm/{name}@1.0.0")
+}
+
+fn url(name: &str) -> String {
+    format!(
+        "https://patch.socket.dev/patch/npm/{name}/1.0.0/{TOKEN}/{}/{name}-1.0.0.tgz",
+        uuid(name)
+    )
+}
+
+fn name_of(purl: &str) -> Option<&'static str> {
+    PACKAGES
+        .iter()
+        .map(|(n, _)| *n)
+        .find(|n| purl.contains(&format!("{n}@")) || purl.contains(&format!("{n}%40")))
+}
+
+fn vulns(name: &str) -> Value {
+    let sevs = PACKAGES.iter().find(|(n, _)| *n == name).unwrap().1;
+    let mut map = serde_json::Map::new();
+    for (i, sev) in sevs.iter().enumerate() {
+        map.insert(
+            format!("GHSA-{name}-{i}"),
+            json!({ "cves": [], "summary": "s", "severity": sev, "description": "d" }),
+        );
+    }
+    Value::Object(map)
+}
+
+struct Batch;
+impl Respond for Batch {
+    fn respond(&self, request: &Request) -> ResponseTemplate {
+        let body: Value = serde_json::from_slice(&request.body).unwrap_or(Value::Null);
+        let packages: Vec<Value> = body["components"]
+            .as_array()
+            .into_iter()
+            .flatten()
+            .filter_map(|c| {
+                let p = c["purl"].as_str()?;
+                let name = name_of(p)?;
+                Some(json!({ "purl": p, "patches": [{
+                    "uuid": uuid(name), "purl": p, "tier": "free", "cveIds": [],
+                    "ghsaIds": [format!("GHSA-{name}-0")], "severity": "high", "title": name
+                }]}))
+            })
+            .collect();
+        ResponseTemplate::new(200)
+            .set_body_json(json!({ "packages": packages, "canAccessPaidPatches": false }))
+    }
+}
+
+struct ByPackage;
+impl Respond for ByPackage {
+    fn respond(&self, request: &Request) -> ResponseTemplate {
+        let patches: Vec<Value> = name_of(request.url.path())
+            .map(|name| {
+                vec![json!({
+                    "uuid": uuid(name), "purl": purl(name),
+                    "publishedAt": "2024-01-01T00:00:00Z",
+                    "description": name, "license": "MIT", "tier": "free",
+                    "vulnerabilities": vulns(name),
+                })]
+            })
+            .unwrap_or_default();
+        ResponseTemplate::new(200)
+            .set_body_json(json!({ "patches": patches, "canAccessPaidPatches": false }))
+    }
+}
+
+struct References;
+impl Respond for References {
+    fn respond(&self, request: &Request) -> ResponseTemplate {
+        let body: Value = serde_json::from_slice(&request.body).unwrap_or(Value::Null);
+        let mut results = serde_json::Map::new();
+        for requested in body["uuids"].as_array().into_iter().flatten() {
+            let Some(requested) = requested.as_str() else {
+                continue;
+            };
+            if let Some((name, _)) = PACKAGES.iter().find(|(n, _)| uuid(n) == requested) {
+                results.insert(
+                    requested.to_string(),
+                    json!({
+                        "status": "granted", "url": url(name), "purl": null,
+                        "artifacts": [{ "kind": "tarball", "url": url(name),
+                            "integrity": { "sha512": format!("sha512-PATCHED{name}==") } }],
+                        "registryOverride": null
+                    }),
+                );
+            }
+        }
+        ResponseTemplate::new(200).set_body_json(json!({ "results": results }))
+    }
+}
+
+struct View;
+impl Respond for View {
+    fn respond(&self, request: &Request) -> ResponseTemplate {
+        let requested = request.url.path().rsplit('/').next().unwrap_or("");
+        match PACKAGES.iter().find(|(n, _)| uuid(n) == requested) {
+            Some((name, _)) => ResponseTemplate::new(200).set_body_json(json!({
+                "uuid": uuid(name), "purl": purl(name), "publishedAt": "2024-01-01T00:00:00Z",
+                "files": { "package/index.js": { "beforeHash": "a".repeat(64), "afterHash": "b".repeat(64) } },
+                "vulnerabilities": vulns(name),
+                "description": name, "license": "MIT", "tier": "free"
+            })),
+            None => ResponseTemplate::new(404),
+        }
+    }
+}
+
+async fn mount(server: &MockServer) {
+    Mock::given(method("POST"))
+        .and(path(format!("/v0/orgs/{ORG}/patches/batch")))
+        .respond_with(Batch)
+        .mount(server)
+        .await;
+    Mock::given(method("GET"))
+        .and(path_regex(format!(
+            "^/v0/orgs/{ORG}/patches/by-package/.+$"
+        )))
+        .respond_with(ByPackage)
+        .mount(server)
+        .await;
+    Mock::given(method("POST"))
+        .and(path(format!("/v0/orgs/{ORG}/patches/package")))
+        .respond_with(References)
+        .mount(server)
+        .await;
+    Mock::given(method("GET"))
+        .and(path_regex(format!("^/v0/orgs/{ORG}/patches/view/.+$")))
+        .respond_with(View)
+        .mount(server)
+        .await;
+}
+
+/// A v3 package-lock at `dir` locking `names` (no install needed: both
+/// engines read the lock).
+fn lock(files: &mut BTreeMap<String, Vec<u8>>, dir: &str, names: &[&str]) {
+    let prefix = if dir.is_empty() {
+        String::new()
+    } else {
+        format!("{dir}/")
+    };
+    let deps: serde_json::Map<String, Value> = names
+        .iter()
+        .map(|n| (n.to_string(), json!("1.0.0")))
+        .collect();
+    let mut packages = serde_json::Map::new();
+    packages.insert(
+        String::new(),
+        json!({ "name": "c", "version": "0.0.0", "dependencies": deps }),
+    );
+    for n in names {
+        packages.insert(
+            format!("node_modules/{n}"),
+            json!({
+                "version": "1.0.0",
+                "resolved": format!("https://registry.npmjs.org/{n}/-/{n}-1.0.0.tgz"),
+                "integrity": "sha512-UPSTREAM=="
+            }),
+        );
+    }
+    let mut text = serde_json::to_vec_pretty(&json!({
+        "name": "c", "version": "0.0.0", "lockfileVersion": 3, "requires": true,
+        "packages": packages
+    }))
+    .unwrap();
+    text.push(b'\n');
+    files.insert(format!("{prefix}package-lock.json"), text);
+    files.insert(
+        format!("{prefix}package.json"),
+        serde_json::to_vec(&json!({ "name": "c", "version": "0.0.0", "dependencies": deps }))
+            .unwrap(),
+    );
+}
+
+fn options(cap: Option<u32>) -> HostedScanOptions {
+    HostedScanOptions {
+        org_slug: ORG.to_string(),
+        max_new_patches: cap.map(|n| MaxNewPatchesOption(Some(n))),
+        ..HostedScanOptions::default()
+    }
+}
+
+async fn memory(
+    server: &MockServer,
+    files: &BTreeMap<String, Vec<u8>>,
+    o: HostedScanOptions,
+) -> HostedScanOutput {
+    run_engine(server, build_input(files, &[], o)).await
+}
+
+/// [`memory`] through two-phase path selection, as a host with a root
+/// socket.yml runs it: select with the policy text, fetch what selection
+/// asks for, then pass its `policyPaths` / `policySha256` to the session.
+async fn memory_selected(
+    server: &MockServer,
+    files: &BTreeMap<String, Vec<u8>>,
+    mut o: HostedScanOptions,
+) -> HostedScanOutput {
+    use socket_patch_cli::hosted_memory::{select_paths, PolicyFileInput, SelectOptions, TreeEntryInput};
+    let entries: Vec<TreeEntryInput> = files
+        .iter()
+        .map(|(p, bytes)| TreeEntryInput {
+            path: p.clone(),
+            mode: "100644".into(),
+            kind: "blob".into(),
+            size: Some(bytes.len() as u64),
+        })
+        .collect();
+    let policy_files: Vec<PolicyFileInput> = ["socket.yml", "socket.yaml"]
+        .iter()
+        .filter_map(|name| {
+            files.get(*name).map(|bytes| PolicyFileInput {
+                path: name.to_string(),
+                text: Some(String::from_utf8(bytes.clone()).unwrap()),
+                missing: None,
+            })
+        })
+        .collect();
+    let selection = select_paths(
+        &entries,
+        &SelectOptions {
+            policy_files: Some(policy_files),
+            no_socket_yml: o.no_socket_yml,
+            ..SelectOptions::default()
+        },
+    );
+    assert!(selection.policy_error.is_none(), "{:?}", selection.policy_error);
+    let fetched: BTreeMap<String, Vec<u8>> = selection
+        .fetch_text
+        .iter()
+        .chain(selection.fetch_binary.iter())
+        .map(|p| (p.clone(), files[p].clone()))
+        .collect();
+    let present: Vec<&str> = selection.present_only.iter().map(String::as_str).collect();
+    o.policy_paths = Some(selection.policy_paths.clone());
+    o.policy_sha256 = selection.policy_sha256.clone();
+    run_engine(server, build_input(&fetched, &present, o)).await
+}
+
+/// `files` with the engine's changed files applied: the next run's input.
+fn apply(files: &BTreeMap<String, Vec<u8>>, out: &HostedScanOutput) -> BTreeMap<String, Vec<u8>> {
+    let mut next = files.clone();
+    for f in &out.changed_files {
+        next.insert(f.path.clone(), f.content.clone().into_bytes());
+    }
+    next
+}
+
+fn pinned(files: &BTreeMap<String, Vec<u8>>, lock_path: &str) -> Vec<&'static str> {
+    let text = String::from_utf8_lossy(&files[lock_path]).into_owned();
+    ORDER
+        .iter()
+        .copied()
+        .filter(|n| text.contains(&uuid(n)))
+        .collect()
+}
+
+#[tokio::test]
+async fn one_root_disk_and_memory_admit_and_defer_the_same_rows_until_converged() {
+    let server = MockServer::start().await;
+    mount(&server).await;
+    let mut files = BTreeMap::new();
+    let names: Vec<&str> = PACKAGES.iter().map(|(n, _)| *n).collect();
+    lock(&mut files, "", &names);
+
+    for (run, expected) in [&ORDER[..2], &ORDER[..4], &ORDER[..5], &ORDER[..5]]
+        .iter()
+        .enumerate()
+    {
+        let disk = run_disk_with(&server, &files, false, &["--max-new-patches", "2"]);
+        let mem = memory(&server, &files, options(Some(2))).await;
+        let project = &mem.projects[0];
+        assert!(project.error.is_none(), "{:?}", project.error);
+        assert_eq!(
+            mem.rollout,
+            disk.envelope["rollout"],
+            "run {}: the rollout blocks agree\nstderr: {}",
+            run + 1,
+            disk.stderr
+        );
+        assert_eq!(
+            project.redirect,
+            disk.envelope["redirect"],
+            "run {}: the redirect blocks agree",
+            run + 1
+        );
+        let next = apply(&files, &mem);
+        let memory_changed: Vec<&String> = mem.changed_files.iter().map(|f| &f.path).collect();
+        assert_eq!(
+            memory_changed,
+            disk.changed.keys().collect::<Vec<_>>(),
+            "run {}: the same files change",
+            run + 1
+        );
+        for (rel, bytes) in &disk.changed {
+            assert_eq!(
+                String::from_utf8_lossy(&next[rel]),
+                String::from_utf8_lossy(bytes),
+                "run {}: {rel}",
+                run + 1
+            );
+        }
+        assert_eq!(pinned(&next, "package-lock.json"), expected.to_vec());
+        let deferred: Vec<&str> = project.deferred.iter().map(|d| d.purl.as_str()).collect();
+        let want: Vec<String> = ORDER[expected.len()..].iter().map(|n| purl(n)).collect();
+        assert_eq!(
+            deferred,
+            want.iter().map(String::as_str).collect::<Vec<_>>()
+        );
+        let skipped: Vec<&str> = project
+            .skipped
+            .iter()
+            .filter(|s| s.reason == "rollout_deferred")
+            .map(|s| s.purl.as_str())
+            .collect();
+        assert_eq!(skipped, deferred, "deferred rows are mirrored in skipped[]");
+        files = next;
+    }
+    assert_eq!(
+        memory(&server, &files, options(Some(2))).await.rollout["counts"],
+        json!({ "new": 0, "deferred": 0, "upgrade": 0, "already": 5 })
+    );
+}
+
+#[tokio::test]
+async fn two_roots_spend_one_budget_in_memory_and_one_per_directory_on_disk() {
+    let server = MockServer::start().await;
+    mount(&server).await;
+    let mut files = BTreeMap::new();
+    lock(&mut files, "a", &["mem-a", "mem-b"]);
+    lock(&mut files, "b", &["mem-c", "mem-d", "mem-e"]);
+
+    // Memory: one run-wide queue, e (b/), b (a/) first.
+    let mem = memory(&server, &files, options(Some(2))).await;
+    assert_eq!(
+        mem.rollout["counts"],
+        json!({ "new": 2, "deferred": 3, "upgrade": 0, "already": 0 })
+    );
+    let next = apply(&files, &mem);
+    assert_eq!(pinned(&next, "a/package-lock.json"), ["mem-b"]);
+    assert_eq!(pinned(&next, "b/package-lock.json"), ["mem-e"]);
+    let mut ranks: Vec<(String, u32)> = mem
+        .projects
+        .iter()
+        .flat_map(|p| p.deferred.iter().map(|d| (d.purl.clone(), d.rank)))
+        .collect();
+    ranks.sort();
+    assert_eq!(
+        ranks,
+        [(purl("mem-a"), 5), (purl("mem-c"), 3), (purl("mem-d"), 4)],
+        "ranks are run-wide"
+    );
+
+    // Disk: the directories spend the budget in sorted order, so `a/`
+    // takes both slots before `b/` is visited.
+    let (code, stdout, changed) =
+        run_disk_args(&server, &files, &["--max-new-patches", "2", "a", "b"]);
+    assert_eq!(code, 0, "{stdout}");
+    let mut disk_files = files.clone();
+    disk_files.extend(changed);
+    assert_eq!(
+        pinned(&disk_files, "a/package-lock.json"),
+        ["mem-b", "mem-a"]
+    );
+    assert!(
+        pinned(&disk_files, "b/package-lock.json").is_empty(),
+        "{stdout}"
+    );
+}
+
+/// The socket.yml policy and the cap together (§9.3): `includePaths`
+/// keeps `legacy/` out, `minSeverity: high` leaves only e, b and c
+/// eligible, and `maxNewPatches: 2` paces them; both engines converge in
+/// two runs. `--no-socket-yml` then drops the file's floor, paths and cap
+/// but keeps a flag cap, and each engine spends it in its own scope.
+#[tokio::test]
+async fn socket_yml_policy_and_cap_converge_on_disk_and_in_memory() {
+    let server = MockServer::start().await;
+    mount(&server).await;
+    let mut files = BTreeMap::new();
+    files.insert(
+        "socket.yml".to_string(),
+        b"version: 2\npatches:\n  includePaths: [\"/apps/\"]\n  minSeverity: high\n  maxNewPatches: 2\n"
+            .to_vec(),
+    );
+    lock(&mut files, "apps/one", &["mem-a", "mem-b", "mem-c", "mem-d", "mem-e"]);
+    lock(&mut files, "apps/two", &["mem-b", "mem-c", "mem-d"]);
+    lock(&mut files, "legacy", &["mem-b", "mem-e"]);
+    let dirs = ["apps/one", "apps/two", "legacy"];
+    let pins = |f: &BTreeMap<String, Vec<u8>>| -> Vec<Vec<&'static str>> {
+        dirs.iter()
+            .map(|d| pinned(f, &format!("{d}/package-lock.json")))
+            .collect()
+    };
+    let expected: [Vec<Vec<&str>>; 3] = [
+        vec![vec!["mem-e", "mem-b"], vec!["mem-b"], vec![]],
+        vec![vec!["mem-e", "mem-b", "mem-c"], vec!["mem-b", "mem-c"], vec![]],
+        vec![vec!["mem-e", "mem-b", "mem-c"], vec!["mem-b", "mem-c"], vec![]],
+    ];
+
+    let mut mem_files = files.clone();
+    let mut disk_files = files.clone();
+    for (run, want) in expected.iter().enumerate() {
+        let mem = memory_selected(&server, &mem_files, options(None)).await;
+        assert_eq!(
+            mem.rollout["maxNewPatches"],
+            json!({ "value": 2, "source": "file" }),
+            "run {}",
+            run + 1
+        );
+        assert_eq!(mem.policy.as_ref().map(|p| p["source"].clone()), Some(json!("file")));
+        mem_files = apply(&mem_files, &mem);
+        assert_eq!(&pins(&mem_files), want, "memory run {}", run + 1);
+
+        let (code, stdout, changed) = run_disk_args(&server, &disk_files, &dirs);
+        assert_eq!(code, 0, "{stdout}");
+        assert!(
+            stdout.contains("maxNewPatches=2 from socket.yml"),
+            "disk run {}: {stdout}",
+            run + 1
+        );
+        disk_files.extend(changed);
+        assert_eq!(&pins(&disk_files), want, "disk run {}: {stdout}", run + 1);
+    }
+
+    // Disk visits the directories in sorted order: `apps/one` spends the
+    // one slot on d, `apps/two` gets d free, and `legacy` defers e and b.
+    let (code, stdout, changed) = run_disk_args(
+        &server,
+        &disk_files,
+        &["--no-socket-yml", "--max-new-patches", "1", "apps/one", "apps/two", "legacy"],
+    );
+    assert_eq!(code, 0, "{stdout}");
+    disk_files.extend(changed);
+    assert_eq!(
+        pins(&disk_files),
+        [
+            vec!["mem-e", "mem-b", "mem-c", "mem-d"],
+            vec!["mem-b", "mem-c", "mem-d"],
+            vec![],
+        ],
+        "{stdout}"
+    );
+
+    // Memory ranks every root in one queue: legacy's critical e goes first.
+    let mut o = options(Some(1));
+    o.no_socket_yml = Some(true);
+    let mem = memory_selected(&server, &mem_files, o).await;
+    assert_eq!(
+        mem.rollout["maxNewPatches"],
+        json!({ "value": 1, "source": "flag" })
+    );
+    mem_files = apply(&mem_files, &mem);
+    assert_eq!(
+        pins(&mem_files),
+        [
+            vec!["mem-e", "mem-b", "mem-c"],
+            vec!["mem-b", "mem-c"],
+            vec!["mem-e"],
+        ]
+    );
+}
+
+#[tokio::test]
+async fn memory_counts_a_committed_manifest_vendor_entry_or_pin_as_recorded() {
+    let server = MockServer::start().await;
+    mount(&server).await;
+    let mut files = BTreeMap::new();
+    let names: Vec<&str> = PACKAGES.iter().map(|(n, _)| *n).collect();
+    lock(&mut files, "", &names);
+    // mem-e is recorded by the agent manifest, mem-b by the vendor ledger.
+    files.insert(
+        ".socket/manifest.json".into(),
+        serde_json::to_vec(&json!({ "patches": { purl("mem-e"): {
+            "uuid": uuid("mem-e"), "exportedAt": "", "files": {}, "vulnerabilities": {},
+            "description": "", "license": "", "tier": "free"
+        }}}))
+        .unwrap(),
+    );
+    files.insert(
+        ".socket/vendor/state.json".into(),
+        serde_json::to_vec(&json!({
+            "version": 1,
+            "entries": { purl("mem-b"): {
+                "ecosystem": "npm", "uuid": uuid("mem-b"), "basePurl": purl("mem-b"),
+                "artifact": { "path": format!(".socket/vendor/npm/{}/mem-b-1.0.0.tgz", uuid("mem-b")) },
+                "wiring": []
+            }}
+        }))
+        .unwrap(),
+    );
+    let mem = memory(&server, &files, options(Some(1))).await;
+    assert_eq!(
+        mem.rollout["counts"],
+        json!({ "new": 1, "deferred": 2, "upgrade": 0, "already": 2 }),
+        "{:#}",
+        mem.rollout
+    );
+    let deferred: Vec<&str> = mem.projects[0]
+        .deferred
+        .iter()
+        .map(|d| d.purl.as_str())
+        .collect();
+    assert_eq!(deferred, [purl("mem-d"), purl("mem-a")]);
+    // mem-e (manifest) re-confirms its pin; mem-b (vendored) is refused as a
+    // takeover; mem-c is the one NEW patch admitted.
+    let next = apply(&files, &mem);
+    assert_eq!(pinned(&next, "package-lock.json"), ["mem-e", "mem-c"]);
+    // The rerun lands the next one.
+    let again = memory(&server, &next, options(Some(1))).await;
+    assert_eq!(
+        again.rollout["counts"],
+        json!({ "new": 1, "deferred": 1, "upgrade": 0, "already": 3 })
+    );
+    assert_eq!(
+        pinned(&apply(&next, &again), "package-lock.json"),
+        ["mem-e", "mem-c", "mem-d"]
+    );
+}
+
+#[tokio::test]
+async fn memory_defers_new_rows_when_the_reference_lookup_fails_under_a_cap() {
+    let server = MockServer::start().await;
+    Mock::given(method("POST"))
+        .and(path(format!("/v0/orgs/{ORG}/patches/package")))
+        .respond_with(ResponseTemplate::new(500))
+        .with_priority(1)
+        .mount(&server)
+        .await;
+    mount(&server).await;
+    let mut files = BTreeMap::new();
+    let names: Vec<&str> = PACKAGES.iter().map(|(n, _)| *n).collect();
+    lock(&mut files, "", &names);
+    let mem = memory(&server, &files, options(Some(2))).await;
+    let project = &mem.projects[0];
+    assert!(project.error.is_none(), "{:?}", project.error);
+    assert_eq!(project.deferred.len(), 5);
+    assert!(mem.changed_files.is_empty());
+    let codes: Vec<&str> = mem.warnings.iter().map(|w| w.code.as_str()).collect();
+    assert!(codes.contains(&"rollout_reference_failed"), "{codes:?}");
+    // Uncapped, the failure is the root's.
+    let mem = memory(&server, &files, options(None)).await;
+    assert_eq!(
+        mem.projects[0].error.as_ref().map(|e| e.code.as_str()),
+        Some("reference_lookup_failed")
+    );
+}
+
+#[tokio::test]
+async fn memory_in_flight_patches_go_first_and_the_server_cap_tightens() {
+    let server = MockServer::start().await;
+    mount(&server).await;
+    let mut files = BTreeMap::new();
+    let names: Vec<&str> = PACKAGES.iter().map(|(n, _)| *n).collect();
+    lock(&mut files, "", &names);
+    let mem = memory(
+        &server,
+        &files,
+        HostedScanOptions {
+            max_new_patches: Some(MaxNewPatchesOption(None)),
+            max_new_patches_cap: Some(1),
+            in_flight_patches: Some(vec![purl("mem-a")]),
+            ..options(None)
+        },
+    )
+    .await;
+    assert_eq!(
+        mem.rollout["maxNewPatches"],
+        json!({ "value": 1, "source": "cap" })
+    );
+    assert_eq!(
+        pinned(&apply(&files, &mem), "package-lock.json"),
+        ["mem-a"],
+        "the in-flight patch keeps its slot"
+    );
+}
+
+#[test]
+fn the_max_new_patches_option_takes_a_count_or_none() {
+    let parse = |v: Value| {
+        serde_json::from_value::<HostedScanOptions>(json!({ "orgSlug": "o", "maxNewPatches": v }))
+    };
+    assert_eq!(
+        parse(json!(3)).unwrap().max_new_patches,
+        Some(MaxNewPatchesOption(Some(3)))
+    );
+    assert_eq!(
+        parse(json!("none")).unwrap().max_new_patches,
+        Some(MaxNewPatchesOption(None))
+    );
+    for bad in [json!(-1), json!(1.5), json!("all"), json!(4294967296u64)] {
+        assert!(parse(bad.clone()).is_err(), "{bad}");
+    }
+    assert_eq!(
+        serde_json::to_value(MaxNewPatchesOption(None)).unwrap(),
+        json!("none")
+    );
+}
diff --git a/crates/socket-patch-cli/tests/in_process_cargo_apply.rs b/crates/socket-patch-cli/tests/in_process_cargo_apply.rs
index 8c7dc960..fa9021fc 100644
--- a/crates/socket-patch-cli/tests/in_process_cargo_apply.rs
+++ b/crates/socket-patch-cli/tests/in_process_cargo_apply.rs
@@ -246,6 +246,7 @@ async fn cargo_fetch_scan_sync_patches_real_file() {
         mode: None,
         all_releases: false,
         vex: Default::default(),
+        rollout: Default::default(),
     };
     // CARGO_HOME must be set in this process's env so the cargo crawler
     // probes the isolated location (not the developer's real ~/.cargo).
@@ -365,6 +366,7 @@ async fn cargo_apply_refuses_on_before_hash_mismatch() {
         mode: None,
         all_releases: false,
         vex: Default::default(),
+        rollout: Default::default(),
     };
     std::env::set_var("CARGO_HOME", &cargo_home);
 
@@ -463,6 +465,7 @@ async fn cargo_crawler_finds_real_fetched_crate() {
         mode: None,
         all_releases: false,
         vex: Default::default(),
+        rollout: Default::default(),
     };
     assert_eq!(scan_run(args).await, 0);
 
diff --git a/crates/socket-patch-cli/tests/in_process_gem_apply.rs b/crates/socket-patch-cli/tests/in_process_gem_apply.rs
index 45cbaedd..8efb7392 100644
--- a/crates/socket-patch-cli/tests/in_process_gem_apply.rs
+++ b/crates/socket-patch-cli/tests/in_process_gem_apply.rs
@@ -224,6 +224,7 @@ async fn gem_install_scan_sync_patches_real_file() {
         mode: None,
         all_releases: false,
         vex: Default::default(),
+        rollout: Default::default(),
     };
     let code = scan_run(args).await;
     assert_eq!(
@@ -336,6 +337,7 @@ async fn gem_crawler_finds_real_installed_gem() {
         mode: None,
         all_releases: false,
         vex: Default::default(),
+        rollout: Default::default(),
     };
     assert_eq!(scan_run(args).await, 0);
 
diff --git a/crates/socket-patch-cli/tests/in_process_gem_multi_platform.rs b/crates/socket-patch-cli/tests/in_process_gem_multi_platform.rs
index 1b0f8e35..be197eec 100644
--- a/crates/socket-patch-cli/tests/in_process_gem_multi_platform.rs
+++ b/crates/socket-patch-cli/tests/in_process_gem_multi_platform.rs
@@ -244,6 +244,7 @@ fn scan_args(cwd: &Path, api_url: String, all_releases: bool) -> ScanArgs {
         mode: None,
         all_releases,
         vex: Default::default(),
+        rollout: Default::default(),
     }
 }
 
diff --git a/crates/socket-patch-cli/tests/in_process_pypi_apply.rs b/crates/socket-patch-cli/tests/in_process_pypi_apply.rs
index e169dffe..4cbac457 100644
--- a/crates/socket-patch-cli/tests/in_process_pypi_apply.rs
+++ b/crates/socket-patch-cli/tests/in_process_pypi_apply.rs
@@ -273,6 +273,7 @@ async fn pypi_install_scan_sync_patches_real_file() {
         mode: None,
         all_releases: false,
         vex: Default::default(),
+        rollout: Default::default(),
     };
     // Avoid borrow problem with into_iter
     let _ = &mut args;
@@ -349,6 +350,7 @@ async fn pypi_scan_then_apply_force_patches_real_file() {
         mode: None,
         all_releases: false,
         vex: Default::default(),
+        rollout: Default::default(),
     };
     let scan_code = scan_run(scan_args).await;
     assert_eq!(scan_code, 0, "scan --sync should succeed (exit 0)");
@@ -458,6 +460,7 @@ async fn pypi_apply_dry_run_does_not_modify_file() {
         mode: None,
         all_releases: false,
         vex: Default::default(),
+        rollout: Default::default(),
     };
     // Require success: otherwise an early crash (before the apply path
     // is ever reached) would leave the file untouched and let this test
@@ -587,6 +590,7 @@ async fn pypi_crawler_finds_real_installed_six() {
         mode: None,
         all_releases: false,
         vex: Default::default(),
+        rollout: Default::default(),
     };
     assert_eq!(scan_run(args).await, 0);
 
diff --git a/crates/socket-patch-cli/tests/in_process_pypi_multi_release.rs b/crates/socket-patch-cli/tests/in_process_pypi_multi_release.rs
index 28fa350a..bdc63edb 100644
--- a/crates/socket-patch-cli/tests/in_process_pypi_multi_release.rs
+++ b/crates/socket-patch-cli/tests/in_process_pypi_multi_release.rs
@@ -322,6 +322,7 @@ fn scan_args(tmp: &Path, api_url: String, all_releases: bool) -> ScanArgs {
         mode: None,
         all_releases,
         vex: Default::default(),
+        rollout: Default::default(),
     }
 }
 
diff --git a/crates/socket-patch-cli/tests/in_process_python_envs.rs b/crates/socket-patch-cli/tests/in_process_python_envs.rs
index 855b04fd..97a730bc 100644
--- a/crates/socket-patch-cli/tests/in_process_python_envs.rs
+++ b/crates/socket-patch-cli/tests/in_process_python_envs.rs
@@ -139,6 +139,7 @@ fn default_args(cwd: &Path, api_url: String) -> ScanArgs {
         mode: None,
         all_releases: false,
         vex: Default::default(),
+        rollout: Default::default(),
     }
 }
 
diff --git a/crates/socket-patch-cli/tests/in_process_redirect.rs b/crates/socket-patch-cli/tests/in_process_redirect.rs
index 25273828..3c132eec 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect.rs
@@ -65,6 +65,7 @@ fn redirect_args(cwd: &Path, api_url: String) -> ScanArgs {
         mode: Some(socket_patch_cli::commands::scan::ScanMode::Hosted),
         all_releases: false,
         vex: Default::default(),
+        rollout: Default::default(),
     }
 }
 
diff --git a/crates/socket-patch-cli/tests/in_process_redirect_pdm.rs b/crates/socket-patch-cli/tests/in_process_redirect_pdm.rs
index a72ca5c3..97f4a171 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect_pdm.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect_pdm.rs
@@ -166,6 +166,7 @@ fn hosted_args(cwd: &Path, api_url: String, vex: Option<&Path>) -> ScanArgs {
             vex: vex.map(Path::to_path_buf),
             ..Default::default()
         },
+        rollout: Default::default(),
     }
 }
 
diff --git a/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs b/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs
index 738d2c91..bf2e00fd 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect_pipenv.rs
@@ -99,6 +99,7 @@ fn hosted_args(cwd: &Path, api_url: String, vex: Option<&Path>) -> ScanArgs {
             vex_product: vex.map(|_| "pkg:pypi/pipenv-fixture@0.1.0".to_string()),
             ..Default::default()
         },
+        rollout: Default::default(),
     }
 }
 
diff --git a/crates/socket-patch-cli/tests/in_process_redirect_pnpm.rs b/crates/socket-patch-cli/tests/in_process_redirect_pnpm.rs
index 4ad77067..592d72c1 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect_pnpm.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect_pnpm.rs
@@ -97,6 +97,7 @@ fn hosted_args(cwd: &Path, api_url: String) -> ScanArgs {
         mode: Some(ScanMode::Hosted),
         all_releases: false,
         vex: Default::default(),
+        rollout: Default::default(),
     }
 }
 
diff --git a/crates/socket-patch-cli/tests/in_process_redirect_poetry.rs b/crates/socket-patch-cli/tests/in_process_redirect_poetry.rs
index d90c2039..ec348334 100644
--- a/crates/socket-patch-cli/tests/in_process_redirect_poetry.rs
+++ b/crates/socket-patch-cli/tests/in_process_redirect_poetry.rs
@@ -135,6 +135,7 @@ fn hosted_args(cwd: &Path, api_url: String, vex: Option<&Path>) -> ScanArgs {
             vex: vex.map(Path::to_path_buf),
             ..Default::default()
         },
+        rollout: Default::default(),
     }
 }
 
diff --git a/crates/socket-patch-cli/tests/in_process_remote_ecosystems_apply.rs b/crates/socket-patch-cli/tests/in_process_remote_ecosystems_apply.rs
index 7a50373a..3b000c46 100644
--- a/crates/socket-patch-cli/tests/in_process_remote_ecosystems_apply.rs
+++ b/crates/socket-patch-cli/tests/in_process_remote_ecosystems_apply.rs
@@ -97,6 +97,7 @@ fn default_scan_args(cwd: &Path, eco: &str, api_url: String) -> ScanArgs {
         mode: None,
         all_releases: false,
         vex: Default::default(),
+        rollout: Default::default(),
     }
 }
 
diff --git a/crates/socket-patch-cli/tests/in_process_rollback_hosted.rs b/crates/socket-patch-cli/tests/in_process_rollback_hosted.rs
index d79e89f8..b093b492 100644
--- a/crates/socket-patch-cli/tests/in_process_rollback_hosted.rs
+++ b/crates/socket-patch-cli/tests/in_process_rollback_hosted.rs
@@ -90,6 +90,7 @@ fn hosted_scan_args(cwd: &Path, api_url: String) -> ScanArgs {
         mode: Some(ScanMode::Hosted),
         all_releases: false,
         vex: Default::default(),
+        rollout: Default::default(),
     }
 }
 
diff --git a/crates/socket-patch-cli/tests/in_process_scan.rs b/crates/socket-patch-cli/tests/in_process_scan.rs
index 5521dded..5ca5608a 100644
--- a/crates/socket-patch-cli/tests/in_process_scan.rs
+++ b/crates/socket-patch-cli/tests/in_process_scan.rs
@@ -43,6 +43,7 @@ fn default_args(cwd: &Path) -> ScanArgs {
         mode: None,
         all_releases: false,
         vex: Default::default(),
+        rollout: Default::default(),
     }
 }
 
diff --git a/crates/socket-patch-cli/tests/in_process_vendor.rs b/crates/socket-patch-cli/tests/in_process_vendor.rs
index 20bcfa5f..492538f1 100644
--- a/crates/socket-patch-cli/tests/in_process_vendor.rs
+++ b/crates/socket-patch-cli/tests/in_process_vendor.rs
@@ -3266,6 +3266,7 @@ snapshots:
             mode: Some(ScanMode::Hosted),
             all_releases: false,
             vex: Default::default(),
+            rollout: Default::default(),
         }
     }
 
diff --git a/crates/socket-patch-cli/tests/scan_rollout_e2e.rs b/crates/socket-patch-cli/tests/scan_rollout_e2e.rs
new file mode 100644
index 00000000..2e0fba55
--- /dev/null
+++ b/crates/socket-patch-cli/tests/scan_rollout_e2e.rs
@@ -0,0 +1,1038 @@
+//! `scan --max-new-patches` end to end (staged rollout, work item B): a
+//! project with nine patchable packages and a cap of three rolls forward
+//! three packages per run, most severe first, in hosted, agent and vendored
+//! mode; a fourth run changes nothing. Mock API, the built binary.
+
+use std::path::{Path, PathBuf};
+use std::process::Command;
+
+use serde_json::{json, Value};
+use sha2::{Digest, Sha256};
+use wiremock::matchers::{method, path, path_regex};
+use wiremock::{Mock, MockServer, ResponseTemplate};
+
+const ORG: &str = "test-org";
+const TOKEN: &str = "22222222-2222-4222-8222-222222222222";
+const HOST: &str = "http://patch.test";
+
+/// `(name, severities)`: one advisory per severity; none = unknown.
+const PACKAGES: [(&str, &[&str]); 9] = [
+    ("roll-a", &["low"]),
+    ("roll-b", &["critical"]),
+    ("roll-c", &["high"]),
+    ("roll-d", &["medium"]),
+    ("roll-e", &["critical", "high"]),
+    ("roll-f", &[]),
+    ("roll-g", &["high", "low", "low"]),
+    ("roll-h", &["medium"]),
+    ("roll-i", &["low"]),
+];
+
+/// The rollout order: severity, then advisory count, then name.
+const ORDER: [&str; 9] = [
+    "roll-e", "roll-b", "roll-g", "roll-c", "roll-d", "roll-h", "roll-a", "roll-i", "roll-f",
+];
+
+fn binary() -> PathBuf {
+    env!("CARGO_BIN_EXE_socket-patch").into()
+}
+
+fn uuid(name: &str) -> String {
+    let n = PACKAGES.iter().position(|(p, _)| *p == name).unwrap() + 1;
+    format!("{n:08x}-1111-4111-8111-{n:012x}")
+}
+
+fn purl(name: &str) -> String {
+    format!("pkg:npm/{name}@1.0.0")
+}
+
+fn hosted_url(name: &str) -> String {
+    format!(
+        "{HOST}/patch/npm/{name}/1.0.0/{TOKEN}/{}/{name}-1.0.0.tgz",
+        uuid(name)
+    )
+}
+
+fn before(name: &str) -> Vec<u8> {
+    format!("module.exports = '{name} before';\n").into_bytes()
+}
+
+fn after(name: &str) -> Vec<u8> {
+    format!("module.exports = '{name} after';\n").into_bytes()
+}
+
+fn git_sha256(content: &[u8]) -> String {
+    let mut hasher = Sha256::new();
+    hasher.update(format!("blob {}\0", content.len()).as_bytes());
+    hasher.update(content);
+    hex::encode(hasher.finalize())
+}
+
+fn b64(bytes: &[u8]) -> String {
+    use base64::Engine;
+    base64::engine::general_purpose::STANDARD.encode(bytes)
+}
+
+fn vulns(name: &str, severities: &[&str]) -> Value {
+    let mut map = serde_json::Map::new();
+    for (i, sev) in severities.iter().enumerate() {
+        map.insert(
+            format!("GHSA-{name}-{i}"),
+            json!({ "cves": [], "summary": "s", "severity": sev, "description": "d" }),
+        );
+    }
+    Value::Object(map)
+}
+
+/// A v3 npm project in `dir` with `names` installed and locked.
+fn write_project(dir: &Path, names: &[&str]) {
+    std::fs::create_dir_all(dir).unwrap();
+    let deps: serde_json::Map<String, Value> = names
+        .iter()
+        .map(|n| (n.to_string(), json!("1.0.0")))
+        .collect();
+    std::fs::write(
+        dir.join("package.json"),
+        serde_json::to_vec_pretty(&json!({
+            "name": "rollout-consumer", "version": "0.0.0", "dependencies": deps
+        }))
+        .unwrap(),
+    )
+    .unwrap();
+    let mut packages = serde_json::Map::new();
+    packages.insert(
+        String::new(),
+        json!({ "name": "rollout-consumer", "version": "0.0.0", "dependencies": deps }),
+    );
+    for name in names {
+        packages.insert(
+            format!("node_modules/{name}"),
+            json!({
+                "version": "1.0.0",
+                "resolved": format!("https://registry.npmjs.org/{name}/-/{name}-1.0.0.tgz"),
+                "integrity": "sha512-UPSTREAMupstream==",
+                "license": "MIT"
+            }),
+        );
+        let pkg = dir.join("node_modules").join(name);
+        std::fs::create_dir_all(&pkg).unwrap();
+        std::fs::write(
+            pkg.join("package.json"),
+            format!(r#"{{"name":"{name}","version":"1.0.0"}}"#),
+        )
+        .unwrap();
+        std::fs::write(pkg.join("index.js"), before(name)).unwrap();
+    }
+    let mut lock = serde_json::to_vec_pretty(&json!({
+        "name": "rollout-consumer",
+        "version": "0.0.0",
+        "lockfileVersion": 3,
+        "requires": true,
+        "packages": packages,
+    }))
+    .unwrap();
+    lock.push(b'\n');
+    std::fs::write(dir.join("package-lock.json"), lock).unwrap();
+}
+
+/// How the mock answers one package's reference grant.
+#[derive(Clone, Copy, PartialEq)]
+enum Grant {
+    Granted,
+    Withdrawn,
+    BadPurl,
+}
+
+/// Batch, by-package, view and reference mocks for every package.
+async fn mount_api(mock: &MockServer, grant: impl Fn(&str) -> Grant) {
+    let batch: Vec<Value> = PACKAGES
+        .iter()
+        .map(|(name, sevs)| {
+            json!({
+                "purl": purl(name),
+                "patches": [{
+                    "uuid": uuid(name), "purl": purl(name), "tier": "free",
+                    "cveIds": [],
+                    "ghsaIds": (0..sevs.len()).map(|i| format!("GHSA-{name}-{i}")).collect::<Vec<_>>(),
+                    "severity": sevs.first().copied(),
+                    "title": name,
+                }]
+            })
+        })
+        .collect();
+    Mock::given(method("POST"))
+        .and(path(format!("/v0/orgs/{ORG}/patches/batch")))
+        .respond_with(
+            ResponseTemplate::new(200)
+                .set_body_json(json!({ "packages": batch, "canAccessPaidPatches": false })),
+        )
+        .mount(mock)
+        .await;
+    let mut results = serde_json::Map::new();
+    for (name, sevs) in PACKAGES {
+        Mock::given(method("GET"))
+            .and(path_regex(format!(
+                "^/v0/orgs/{ORG}/patches/by-package/.*{name}(%40|@)1\\.0\\.0$"
+            )))
+            .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+                "patches": [{
+                    "uuid": uuid(name), "purl": purl(name),
+                    "publishedAt": "2026-01-01T00:00:00Z",
+                    "description": name, "license": "MIT", "tier": "free",
+                    "vulnerabilities": vulns(name, sevs),
+                }],
+                "canAccessPaidPatches": false,
+            })))
+            .mount(mock)
+            .await;
+        Mock::given(method("GET"))
+            .and(path(format!("/v0/orgs/{ORG}/patches/view/{}", uuid(name))))
+            .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+                "uuid": uuid(name), "purl": purl(name),
+                "publishedAt": "2026-01-01T00:00:00Z",
+                "files": { "package/index.js": {
+                    "beforeHash": git_sha256(&before(name)),
+                    "afterHash": git_sha256(&after(name)),
+                    "blobContent": b64(&after(name)),
+                }},
+                "vulnerabilities": vulns(name, sevs),
+                "description": name, "license": "MIT", "tier": "free",
+            })))
+            .mount(mock)
+            .await;
+        let entry = match grant(name) {
+            Grant::Granted => json!({
+                "status": "granted",
+                "url": hosted_url(name),
+                "purl": purl(name),
+                "artifacts": [{
+                    "kind": "tarball", "url": hosted_url(name),
+                    "integrity": { "sha512": format!("sha512-PATCHED{name}==") }
+                }],
+                "registryOverride": null
+            }),
+            Grant::Withdrawn => json!({ "status": "withdrawn" }),
+            Grant::BadPurl => json!({
+                "status": "granted", "url": hosted_url(name), "purl": "garbage",
+                "artifacts": [], "registryOverride": null
+            }),
+        };
+        results.insert(uuid(name), entry);
+    }
+    Mock::given(method("POST"))
+        .and(path(format!("/v0/orgs/{ORG}/patches/package")))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({ "results": results })))
+        .mount(mock)
+        .await;
+}
+
+fn run(root: &Path, mock: &MockServer, args: &[&str]) -> (i32, String, String) {
+    let uri = mock.uri();
+    let mut argv = vec![
+        "scan",
+        "--yes",
+        "--api-url",
+        uri.as_str(),
+        "--api-token",
+        "fake-token",
+        "--org",
+        ORG,
+    ];
+    argv.extend_from_slice(args);
+    let mut cmd = Command::new(binary());
+    cmd.args(&argv).current_dir(root);
+    for (key, _) in std::env::vars_os() {
+        if key.to_string_lossy().starts_with("SOCKET_") {
+            cmd.env_remove(&key);
+        }
+    }
+    cmd.env("SOCKET_TELEMETRY_DISABLED", "1");
+    let out = cmd.output().expect("run socket-patch");
+    (
+        out.status.code().unwrap_or(-1),
+        String::from_utf8_lossy(&out.stdout).into_owned(),
+        String::from_utf8_lossy(&out.stderr).into_owned(),
+    )
+}
+
+fn run_json(root: &Path, mock: &MockServer, args: &[&str]) -> Value {
+    let mut all = vec!["--json"];
+    all.extend_from_slice(args);
+    let (code, stdout, stderr) = run(root, mock, &all);
+    assert_eq!(code, 0, "stdout={stdout}\nstderr={stderr}");
+    serde_json::from_str(stdout.trim()).unwrap_or_else(|e| panic!("{e}: {stdout}"))
+}
+
+/// How many times the mock served `view/{uuid}`.
+async fn view_fetches(mock: &MockServer, uuid: &str) -> usize {
+    mock.received_requests()
+        .await
+        .unwrap_or_default()
+        .iter()
+        .filter(|r| r.url.path().ends_with(&format!("/patches/view/{uuid}")))
+        .count()
+}
+
+/// The packages whose hosted artifact the lockfile pins.
+fn pinned(root: &Path) -> Vec<String> {
+    let lock = std::fs::read_to_string(root.join("package-lock.json")).unwrap();
+    ORDER
+        .iter()
+        .filter(|n| lock.contains(&hosted_url(n)))
+        .map(|n| n.to_string())
+        .collect()
+}
+
+fn names(list: &[&str]) -> Vec<String> {
+    list.iter().map(|s| s.to_string()).collect()
+}
+
+fn deferred_names(v: &Value) -> Vec<String> {
+    v["rollout"]["deferred"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .map(|d| {
+            d["purl"]
+                .as_str()
+                .unwrap()
+                .trim_start_matches("pkg:npm/")
+                .trim_end_matches("@1.0.0")
+                .to_string()
+        })
+        .collect()
+}
+
+fn counts(v: &Value) -> (u64, u64, u64, u64) {
+    let c = &v["rollout"]["counts"];
+    (
+        c["new"].as_u64().unwrap(),
+        c["deferred"].as_u64().unwrap(),
+        c["upgrade"].as_u64().unwrap(),
+        c["already"].as_u64().unwrap(),
+    )
+}
+
+#[tokio::test]
+async fn hosted_cap_rolls_nine_packages_forward_three_per_run() {
+    let mock = MockServer::start().await;
+    mount_api(&mock, |_| Grant::Granted).await;
+    let tmp = tempfile::tempdir().unwrap();
+    let names9: Vec<&str> = PACKAGES.iter().map(|(n, _)| *n).collect();
+    write_project(tmp.path(), &names9);
+    let args = [
+        "--mode",
+        "hosted",
+        "--max-new-patches",
+        "3",
+        "--patch-server-url",
+        HOST,
+    ];
+
+    // The dry run predicts exactly what the wet run does.
+    let lock_before = std::fs::read(tmp.path().join("package-lock.json")).unwrap();
+    let mut dry_args = args.to_vec();
+    dry_args.push("--dry-run");
+    let dry = run_json(tmp.path(), &mock, &dry_args);
+    assert_eq!(
+        std::fs::read(tmp.path().join("package-lock.json")).unwrap(),
+        lock_before,
+        "a dry run writes nothing"
+    );
+
+    let mut previous_lock = lock_before;
+    let mut dry = dry;
+    for run_no in 0..3 {
+        let v = run_json(tmp.path(), &mock, &args);
+        // The dry run before each wet run predicts it exactly.
+        // (Warning details switch tense: "would be written" / "was written".)
+        let decisions = |block: &Value| -> Value {
+            let mut block = block.clone();
+            let obj = block.as_object_mut().unwrap();
+            obj.remove("dryRun");
+            let codes: Vec<Value> = obj["warnings"]
+                .as_array()
+                .unwrap()
+                .iter()
+                .map(|w| w["code"].clone())
+                .collect();
+            obj.insert("warnings".into(), Value::Array(codes));
+            block
+        };
+        let (predicted, actual) = (decisions(&dry["redirect"]), decisions(&v["redirect"]));
+        assert_eq!(
+            dry["rollout"],
+            v["rollout"],
+            "run {}: dry run == wet run",
+            run_no + 1
+        );
+        assert_eq!(predicted, actual, "run {}: dry run == wet run", run_no + 1);
+        if run_no == 0 {
+            assert_eq!(
+                v["rollout"]["deferred"][0],
+                json!({
+                    "purl": "pkg:npm/roll-c@1.0.0",
+                    "uuids": [uuid("roll-c")],
+                    "severity": "high",
+                    "advisoryCount": 1,
+                    "projects": [""],
+                    "rank": 4,
+                })
+            );
+        }
+        assert_eq!(
+            v["rollout"]["maxNewPatches"],
+            json!({ "value": 3, "source": "flag" })
+        );
+        let done = 3 * run_no as u64;
+        assert_eq!(
+            counts(&v),
+            (3, 6 - done, 0, done),
+            "run {}: {v}",
+            run_no + 1
+        );
+        assert_eq!(
+            pinned(tmp.path()),
+            names(&ORDER[..3 * (run_no + 1)]),
+            "run {} pins the next three, most severe first",
+            run_no + 1
+        );
+        assert_eq!(deferred_names(&v), names(&ORDER[3 * (run_no + 1)..]));
+        let ranks: Vec<u64> = v["rollout"]["deferred"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .map(|d| d["rank"].as_u64().unwrap())
+            .collect();
+        assert_eq!(ranks, (4..4 + ranks.len() as u64).collect::<Vec<_>>());
+        let skipped: Vec<&str> = v["redirect"]["skipped"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .map(|s| s["reason"].as_str().unwrap())
+            .collect();
+        assert!(skipped.iter().all(|r| *r == "rollout_deferred"));
+        assert_eq!(skipped.len() as u64, 6 - done);
+        assert_eq!(v["redirect"]["redirected"], 3 * (run_no as u64 + 1));
+        previous_lock = std::fs::read(tmp.path().join("package-lock.json")).unwrap();
+        let mut next_dry = args.to_vec();
+        next_dry.push("--dry-run");
+        dry = run_json(tmp.path(), &mock, &next_dry);
+    }
+
+    let v = run_json(tmp.path(), &mock, &args);
+    assert_eq!(counts(&v), (0, 0, 0, 9), "a fourth run adds nothing: {v}");
+    assert_eq!(
+        std::fs::read(tmp.path().join("package-lock.json")).unwrap(),
+        previous_lock,
+        "a converged run is byte-stable"
+    );
+}
+
+#[tokio::test]
+async fn hosted_converges_even_when_the_patch_server_is_not_configured() {
+    // Without --patch-server-url discovery does not recognize the test
+    // host's pins; the rollout still treats a lockfile that names the
+    // selected patch as recorded, so it never re-spends a slot on it.
+    let mock = MockServer::start().await;
+    mount_api(&mock, |_| Grant::Granted).await;
+    let tmp = tempfile::tempdir().unwrap();
+    let names9: Vec<&str> = PACKAGES.iter().map(|(n, _)| *n).collect();
+    write_project(tmp.path(), &names9);
+    for run_no in 1..=3 {
+        run_json(
+            tmp.path(),
+            &mock,
+            &["--mode", "hosted", "--max-new-patches", "3"],
+        );
+        assert_eq!(pinned(tmp.path()), names(&ORDER[..3 * run_no]));
+    }
+    let v = run_json(
+        tmp.path(),
+        &mock,
+        &["--mode", "hosted", "--max-new-patches", "3"],
+    );
+    assert_eq!(counts(&v), (0, 0, 0, 9));
+}
+
+#[tokio::test]
+async fn hosted_ineligible_top_ranked_patches_hold_no_slot() {
+    let mock = MockServer::start().await;
+    mount_api(&mock, |name| match name {
+        "roll-e" => Grant::Withdrawn,
+        "roll-b" => Grant::BadPurl,
+        _ => Grant::Granted,
+    })
+    .await;
+    let tmp = tempfile::tempdir().unwrap();
+    let names9: Vec<&str> = PACKAGES.iter().map(|(n, _)| *n).collect();
+    write_project(tmp.path(), &names9);
+    let v = run_json(
+        tmp.path(),
+        &mock,
+        &[
+            "--mode",
+            "hosted",
+            "--max-new-patches",
+            "2",
+            "--patch-server-url",
+            HOST,
+        ],
+    );
+    assert_eq!(pinned(tmp.path()), names(&["roll-g", "roll-c"]), "{v}");
+    assert_eq!(counts(&v), (2, 5, 0, 0));
+    assert_eq!(
+        deferred_names(&v),
+        names(&["roll-d", "roll-h", "roll-a", "roll-i", "roll-f"])
+    );
+    assert_eq!(
+        v["rollout"]["deferred"][0]["rank"], 3,
+        "ranks count eligible rows only"
+    );
+    let reasons: Vec<(&str, &str)> = v["redirect"]["skipped"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .map(|s| (s["purl"].as_str().unwrap(), s["reason"].as_str().unwrap()))
+        .collect();
+    assert!(
+        reasons.contains(&("pkg:npm/roll-e@1.0.0", "withdrawn")),
+        "{reasons:?}"
+    );
+    assert!(reasons.contains(&("garbage", "bad_purl")), "{reasons:?}");
+}
+
+#[tokio::test]
+async fn a_failed_detail_lookup_admits_nothing_new_under_a_cap() {
+    let mock = MockServer::start().await;
+    // Mounted first, so it wins over the per-package mock below.
+    Mock::given(method("GET"))
+        .and(path_regex(format!(
+            "^/v0/orgs/{ORG}/patches/by-package/.*roll-i(%40|@)1\\.0\\.0$"
+        )))
+        .respond_with(ResponseTemplate::new(500))
+        .mount(&mock)
+        .await;
+    mount_api(&mock, |_| Grant::Granted).await;
+    let tmp = tempfile::tempdir().unwrap();
+    let names9: Vec<&str> = PACKAGES.iter().map(|(n, _)| *n).collect();
+    write_project(tmp.path(), &names9);
+    let lock_before = std::fs::read(tmp.path().join("package-lock.json")).unwrap();
+    let v = run_json(
+        tmp.path(),
+        &mock,
+        &[
+            "--mode",
+            "hosted",
+            "--max-new-patches",
+            "3",
+            "--patch-server-url",
+            HOST,
+        ],
+    );
+    assert_eq!(counts(&v), (0, 8, 0, 0), "{v}");
+    assert_eq!(
+        std::fs::read(tmp.path().join("package-lock.json")).unwrap(),
+        lock_before
+    );
+    let codes: Vec<&str> = v["warnings"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .map(|w| w["code"].as_str().unwrap())
+        .collect();
+    assert!(codes.contains(&"rollout_incomplete_lookup"), "{codes:?}");
+    assert!(codes.contains(&"patch_details_failed"), "{codes:?}");
+}
+
+#[tokio::test]
+async fn agent_cap_rolls_forward_and_upgrades_ignore_the_cap() {
+    let mock = MockServer::start().await;
+    mount_api(&mock, |_| Grant::Granted).await;
+    let tmp = tempfile::tempdir().unwrap();
+    let names9: Vec<&str> = PACKAGES.iter().map(|(n, _)| *n).collect();
+    write_project(tmp.path(), &names9);
+    let recorded = |root: &Path| -> Vec<String> {
+        let m: Value = serde_json::from_slice(
+            &std::fs::read(root.join(".socket/manifest.json")).unwrap_or_else(|_| b"{}".to_vec()),
+        )
+        .unwrap();
+        ORDER
+            .iter()
+            .filter(|n| m["patches"].get(purl(n)).is_some())
+            .map(|n| n.to_string())
+            .collect()
+    };
+    let args = ["--mode", "agent", "--max-new-patches", "3"];
+    let dry = {
+        let mut a = args.to_vec();
+        a.push("--dry-run");
+        run_json(tmp.path(), &mock, &a)
+    };
+    for run_no in 1..=3 {
+        let v = run_json(tmp.path(), &mock, &args);
+        if run_no == 1 {
+            assert_eq!(dry["rollout"], v["rollout"], "dry run == wet run");
+            let added: Vec<&str> = dry["apply"]["patches"]
+                .as_array()
+                .unwrap()
+                .iter()
+                .map(|p| p["purl"].as_str().unwrap())
+                .collect();
+            assert_eq!(added.len(), 3, "{dry}");
+        }
+        assert_eq!(recorded(tmp.path()), names(&ORDER[..3 * run_no]), "{v}");
+        for name in &ORDER[..3 * run_no] {
+            assert_eq!(
+                std::fs::read(tmp.path().join("node_modules").join(name).join("index.js")).unwrap(),
+                after(name)
+            );
+        }
+        for name in &ORDER[3 * run_no..] {
+            assert_eq!(
+                std::fs::read(tmp.path().join("node_modules").join(name).join("index.js")).unwrap(),
+                before(name),
+                "a deferred package is not touched"
+            );
+            assert_eq!(
+                view_fetches(&mock, &uuid(name)).await,
+                0,
+                "a deferred patch is never downloaded: {name}"
+            );
+        }
+    }
+    let manifest = std::fs::read(tmp.path().join(".socket/manifest.json")).unwrap();
+    let v = run_json(tmp.path(), &mock, &args);
+    assert_eq!(counts(&v), (0, 0, 0, 9));
+    assert_eq!(
+        std::fs::read(tmp.path().join(".socket/manifest.json")).unwrap(),
+        manifest,
+        "a converged run is byte-stable"
+    );
+
+    // A newer patch for an applied package is an UPGRADE: it lands even
+    // with `--max-new-patches 0`, and is reported in `updates[]`.
+    mock.reset().await;
+    mount_api(&mock, |_| Grant::Granted).await;
+    let newer = "0000000a-1111-4111-8111-00000000000a";
+    Mock::given(method("GET"))
+        .and(path_regex(format!(
+            "^/v0/orgs/{ORG}/patches/by-package/.*roll-a(%40|@)1\\.0\\.0$"
+        )))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+            "patches": [
+                { "uuid": newer, "purl": purl("roll-a"), "publishedAt": "2026-06-01T00:00:00Z",
+                  "description": "newer", "license": "MIT", "tier": "free",
+                  "vulnerabilities": vulns("roll-a", &["low"]) },
+                { "uuid": uuid("roll-a"), "purl": purl("roll-a"), "publishedAt": "2026-01-01T00:00:00Z",
+                  "description": "roll-a", "license": "MIT", "tier": "free",
+                  "vulnerabilities": vulns("roll-a", &["low"]) }
+            ],
+            "canAccessPaidPatches": false,
+        })))
+        .with_priority(1)
+        .mount(&mock)
+        .await;
+    Mock::given(method("GET"))
+        .and(path(format!("/v0/orgs/{ORG}/patches/view/{newer}")))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+            "uuid": newer, "purl": purl("roll-a"), "publishedAt": "2026-06-01T00:00:00Z",
+            "files": { "package/index.js": {
+                "beforeHash": git_sha256(&before("roll-a")),
+                "afterHash": git_sha256(&after("roll-a")),
+                "blobContent": b64(&after("roll-a")),
+            }},
+            "vulnerabilities": vulns("roll-a", &["low"]),
+            "description": "newer", "license": "MIT", "tier": "free",
+        })))
+        .mount(&mock)
+        .await;
+    let v = run_json(
+        tmp.path(),
+        &mock,
+        &["--mode", "agent", "--max-new-patches", "0"],
+    );
+    assert_eq!(counts(&v), (0, 0, 1, 8), "{v}");
+    assert_eq!(
+        v["updates"],
+        json!([{ "purl": purl("roll-a"), "oldUuid": uuid("roll-a"), "newUuid": newer }])
+    );
+    let m: Value =
+        serde_json::from_slice(&std::fs::read(tmp.path().join(".socket/manifest.json")).unwrap())
+            .unwrap();
+    assert_eq!(m["patches"][purl("roll-a")]["uuid"], newer);
+}
+
+#[tokio::test]
+async fn vendored_cap_rolls_forward_three_per_run() {
+    let mock = MockServer::start().await;
+    mount_api(&mock, |_| Grant::Granted).await;
+    let tmp = tempfile::tempdir().unwrap();
+    let names9: Vec<&str> = PACKAGES.iter().map(|(n, _)| *n).collect();
+    write_project(tmp.path(), &names9);
+    let vendored = |root: &Path| -> Vec<String> {
+        let state: Value = std::fs::read(root.join(".socket/vendor/state.json"))
+            .ok()
+            .map(|b| serde_json::from_slice(&b).unwrap())
+            .unwrap_or(json!({}));
+        ORDER
+            .iter()
+            .filter(|n| state["entries"].get(purl(n)).is_some())
+            .map(|n| n.to_string())
+            .collect()
+    };
+    let args = ["--mode", "vendored", "--max-new-patches", "3"];
+    let dry = {
+        let mut a = args.to_vec();
+        a.push("--dry-run");
+        run_json(tmp.path(), &mock, &a)
+    };
+    assert!(
+        !tmp.path().join(".socket").exists(),
+        "a dry run writes nothing"
+    );
+    for run_no in 1..=3 {
+        let v = run_json(tmp.path(), &mock, &args);
+        if run_no == 1 {
+            assert_eq!(dry["rollout"], v["rollout"], "dry run == wet run");
+            assert_eq!(dry["vendor"]["patches"].as_array().unwrap().len(), 3);
+        }
+        assert_eq!(vendored(tmp.path()), names(&ORDER[..3 * run_no]), "{v}");
+    }
+    let lock = std::fs::read(tmp.path().join("package-lock.json")).unwrap();
+    let v = run_json(tmp.path(), &mock, &args);
+    assert_eq!(counts(&v), (0, 0, 0, 9));
+    assert_eq!(
+        std::fs::read(tmp.path().join("package-lock.json")).unwrap(),
+        lock
+    );
+}
+
+#[tokio::test]
+async fn project_directories_share_one_budget_in_sorted_order() {
+    let mock = MockServer::start().await;
+    mount_api(&mock, |_| Grant::Granted).await;
+    let tmp = tempfile::tempdir().unwrap();
+    // `a/` sorts first and spends two slots; `b/` gets the one left, and
+    // its copy of roll-b rides free (already admitted in `a/`).
+    write_project(&tmp.path().join("a"), &["roll-a", "roll-b"]);
+    write_project(
+        &tmp.path().join("b"),
+        &["roll-b", "roll-c", "roll-e", "roll-h"],
+    );
+    let (code, stdout, stderr) = run(
+        tmp.path(),
+        &mock,
+        &[
+            "--mode",
+            "hosted",
+            "--max-new-patches",
+            "3",
+            "--patch-server-url",
+            HOST,
+            // Given out of order: the directories are still visited sorted.
+            "b",
+            "a",
+        ],
+    );
+    assert_eq!(code, 0, "stdout={stdout}\nstderr={stderr}");
+    assert_eq!(pinned(&tmp.path().join("a")), names(&["roll-b", "roll-a"]));
+    assert_eq!(pinned(&tmp.path().join("b")), names(&["roll-e", "roll-b"]));
+    assert!(
+        stdout.contains(
+            "Rollout: 2 of 2 new patches applied (maxNewPatches=3 from --max-new-patches, \
+             shared by this run's directories, 1 left)"
+        ),
+        "{stdout}"
+    );
+    assert!(
+        stdout.contains(
+            "Rollout: 2 of 4 new patches applied (maxNewPatches=3 from --max-new-patches, \
+             shared by this run's directories, 0 left)"
+        ),
+        "b/ admits roll-b free and roll-e with the last slot: {stdout}"
+    );
+    assert!(
+        stdout.contains("Next up: roll-c@1.0.0 (high), roll-h@1.0.0 (medium)"),
+        "{stdout}"
+    );
+}
+
+#[tokio::test]
+async fn a_malformed_env_cap_is_a_usage_error_unless_the_flag_overrides_it() {
+    let mock = MockServer::start().await;
+    mount_api(&mock, |_| Grant::Granted).await;
+    let tmp = tempfile::tempdir().unwrap();
+    write_project(tmp.path(), &["roll-a", "roll-b"]);
+    let mut cmd = Command::new(binary());
+    cmd.args(["scan", "--json", "--api-url"])
+        .arg(mock.uri())
+        .args(["--api-token", "t", "--org", ORG])
+        .current_dir(tmp.path());
+    for (key, _) in std::env::vars_os() {
+        if key.to_string_lossy().starts_with("SOCKET_") {
+            cmd.env_remove(&key);
+        }
+    }
+    cmd.env("SOCKET_TELEMETRY_DISABLED", "1")
+        .env("SOCKET_MAX_NEW_PATCHES", "lots");
+    let out = cmd.output().unwrap();
+    assert_eq!(out.status.code(), Some(2));
+    assert!(String::from_utf8_lossy(&out.stderr).contains("SOCKET_MAX_NEW_PATCHES"));
+
+    // A flag overrides the env value without reading it.
+    let mut with_flag = Command::new(binary());
+    with_flag
+        .args([
+            "scan",
+            "--json",
+            "--dry-run",
+            "--max-new-patches",
+            "1",
+            "--api-url",
+        ])
+        .arg(mock.uri())
+        .args(["--api-token", "t", "--org", ORG])
+        .current_dir(tmp.path());
+    for (key, _) in std::env::vars_os() {
+        if key.to_string_lossy().starts_with("SOCKET_") {
+            with_flag.env_remove(&key);
+        }
+    }
+    with_flag
+        .env("SOCKET_TELEMETRY_DISABLED", "1")
+        .env("SOCKET_MAX_NEW_PATCHES", "lots");
+    let out = with_flag.output().unwrap();
+    assert_eq!(
+        out.status.code(),
+        Some(0),
+        "{}",
+        String::from_utf8_lossy(&out.stderr)
+    );
+    let v: Value = serde_json::from_slice(&out.stdout).unwrap();
+    assert_eq!(
+        v["rollout"]["maxNewPatches"],
+        json!({ "value": 1, "source": "flag" })
+    );
+
+    cmd.env("SOCKET_MAX_NEW_PATCHES", "1");
+    let out = cmd.output().unwrap();
+    let v: Value = serde_json::from_slice(&out.stdout).unwrap();
+    assert_eq!(
+        v["rollout"]["maxNewPatches"],
+        json!({ "value": 1, "source": "env" })
+    );
+    assert_eq!(v["rollout"]["counts"]["new"], 1);
+
+    cmd.args(["--max-new-patches", "none"]);
+    let out = cmd.output().unwrap();
+    let v: Value = serde_json::from_slice(&out.stdout).unwrap();
+    assert_eq!(
+        v["rollout"]["maxNewPatches"],
+        json!({ "value": null, "source": "flag" })
+    );
+    assert_eq!(
+        v["rollout"]["counts"]["new"], 1,
+        "roll-b landed on the capped run; roll-a now"
+    );
+}
+
+/// Mount, ahead of `mount_api`'s answers, a newer superseding patch for
+/// `name`: offered first by-package, granted, and viewable.
+async fn mount_newer(mock: &MockServer, name: &str, newer: &str) {
+    let sevs = PACKAGES.iter().find(|(n, _)| *n == name).unwrap().1;
+    Mock::given(method("GET"))
+        .and(path_regex(format!(
+            "^/v0/orgs/{ORG}/patches/by-package/.*{name}(%40|@)1\\.0\\.0$"
+        )))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+            "patches": [
+                { "uuid": newer, "purl": purl(name), "publishedAt": "2026-06-01T00:00:00Z",
+                  "description": "newer", "license": "MIT", "tier": "free",
+                  "vulnerabilities": vulns(name, sevs) },
+                { "uuid": uuid(name), "purl": purl(name), "publishedAt": "2026-01-01T00:00:00Z",
+                  "description": name, "license": "MIT", "tier": "free",
+                  "vulnerabilities": vulns(name, sevs) }
+            ],
+            "canAccessPaidPatches": false,
+        })))
+        .with_priority(1)
+        .mount(mock)
+        .await;
+    let mut results = serde_json::Map::new();
+    for (n, _) in PACKAGES {
+        results.insert(
+            uuid(n),
+            json!({ "status": "granted", "url": hosted_url(n), "purl": purl(n),
+                "artifacts": [{ "kind": "tarball", "url": hosted_url(n),
+                    "integrity": { "sha512": format!("sha512-PATCHED{n}==") } }],
+                "registryOverride": null }),
+        );
+    }
+    let newer_url = hosted_url(name).replace(&uuid(name), newer);
+    results.insert(
+        newer.to_string(),
+        json!({ "status": "granted", "url": newer_url, "purl": purl(name),
+            "artifacts": [{ "kind": "tarball", "url": newer_url,
+                "integrity": { "sha512": "sha512-NEWER==" } }],
+            "registryOverride": null }),
+    );
+    Mock::given(method("POST"))
+        .and(path(format!("/v0/orgs/{ORG}/patches/package")))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({ "results": results })))
+        .with_priority(1)
+        .mount(mock)
+        .await;
+}
+
+#[tokio::test]
+async fn hosted_upgrades_land_with_a_cap_of_zero() {
+    let mock = MockServer::start().await;
+    mount_api(&mock, |_| Grant::Granted).await;
+    let tmp = tempfile::tempdir().unwrap();
+    let names9: Vec<&str> = PACKAGES.iter().map(|(n, _)| *n).collect();
+    write_project(tmp.path(), &names9);
+    let args = [
+        "--mode",
+        "hosted",
+        "--max-new-patches",
+        "3",
+        "--patch-server-url",
+        HOST,
+    ];
+    run_json(tmp.path(), &mock, &args);
+    assert_eq!(pinned(tmp.path()), names(&ORDER[..3]));
+
+    // roll-e (applied) gains a newer patch; six packages still wait.
+    let newer = "0000000e-1111-4111-8111-00000000000e";
+    mount_newer(&mock, "roll-e", newer).await;
+    let v = run_json(
+        tmp.path(),
+        &mock,
+        &[
+            "--mode",
+            "hosted",
+            "--max-new-patches",
+            "0",
+            "--patch-server-url",
+            HOST,
+        ],
+    );
+    assert_eq!(counts(&v), (0, 6, 1, 2), "{v}");
+    assert_eq!(
+        v["updates"],
+        json!([{ "purl": purl("roll-e"), "oldUuid": uuid("roll-e"), "newUuid": newer }])
+    );
+    let lock = std::fs::read_to_string(tmp.path().join("package-lock.json")).unwrap();
+    assert!(lock.contains(newer), "the upgrade landed: {lock}");
+    assert_eq!(
+        pinned(tmp.path()),
+        names(&["roll-b", "roll-g"]),
+        "nothing new was added"
+    );
+}
+
+#[tokio::test]
+async fn a_failed_reference_lookup_defers_new_rows_instead_of_failing() {
+    let tmp = tempfile::tempdir().unwrap();
+    let names9: Vec<&str> = PACKAGES.iter().map(|(n, _)| *n).collect();
+    write_project(tmp.path(), &names9);
+    let lock_before = std::fs::read(tmp.path().join("package-lock.json")).unwrap();
+    let args = [
+        "--mode",
+        "hosted",
+        "--max-new-patches",
+        "3",
+        "--patch-server-url",
+        HOST,
+    ];
+
+    let failing = MockServer::start().await;
+    Mock::given(method("POST"))
+        .and(path(format!("/v0/orgs/{ORG}/patches/package")))
+        .respond_with(ResponseTemplate::new(500))
+        .with_priority(1)
+        .mount(&failing)
+        .await;
+    mount_api(&failing, |_| Grant::Granted).await;
+
+    // Every row is NEW: the failure only affects rows the incomplete lookup
+    // defers anyway, so the capped run succeeds and writes nothing.
+    let v = run_json(tmp.path(), &failing, &args);
+    assert_eq!(counts(&v), (0, 9, 0, 0), "{v}");
+    let codes: Vec<&str> = v["warnings"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .map(|w| w["code"].as_str().unwrap())
+        .collect();
+    assert!(codes.contains(&"rollout_reference_failed"), "{codes:?}");
+    assert!(codes.contains(&"rollout_incomplete_lookup"), "{codes:?}");
+    assert_eq!(
+        std::fs::read(tmp.path().join("package-lock.json")).unwrap(),
+        lock_before
+    );
+    assert!(!tmp.path().join(".socket").exists(), "no lock, no state");
+
+    // Without a cap the failure is the run's, as before.
+    let (code, stdout, _) = run(tmp.path(), &failing, &["--json", "--mode", "hosted"]);
+    assert_eq!(code, 1, "{stdout}");
+    let v: Value = serde_json::from_str(stdout.trim()).unwrap();
+    assert_eq!(v["status"], "error");
+    assert!(
+        v.get("rollout").is_none(),
+        "no rollout block on an error envelope"
+    );
+
+    // With applied rows the failure affects them too: the run fails.
+    let ok = MockServer::start().await;
+    mount_api(&ok, |_| Grant::Granted).await;
+    run_json(tmp.path(), &ok, &args);
+    let mut failing_args = vec!["--json"];
+    failing_args.extend_from_slice(&args);
+    let (code, stdout, _) = run(tmp.path(), &failing, &failing_args);
+    assert_eq!(code, 1, "{stdout}");
+}
+
+#[tokio::test]
+async fn a_failed_detail_lookup_for_an_applied_package_does_not_freeze_new_rows() {
+    let mock = MockServer::start().await;
+    mount_api(&mock, |_| Grant::Granted).await;
+    let tmp = tempfile::tempdir().unwrap();
+    let names9: Vec<&str> = PACKAGES.iter().map(|(n, _)| *n).collect();
+    write_project(tmp.path(), &names9);
+    let args = [
+        "--mode",
+        "hosted",
+        "--max-new-patches",
+        "3",
+        "--patch-server-url",
+        HOST,
+    ];
+    run_json(tmp.path(), &mock, &args);
+    Mock::given(method("GET"))
+        .and(path_regex(format!(
+            "^/v0/orgs/{ORG}/patches/by-package/.*roll-e(%40|@)1\\.0\\.0$"
+        )))
+        .respond_with(ResponseTemplate::new(500))
+        .with_priority(1)
+        .mount(&mock)
+        .await;
+    let v = run_json(tmp.path(), &mock, &args);
+    assert_eq!(
+        counts(&v).0,
+        3,
+        "roll-e is recorded, so the next three land: {v}"
+    );
+    let codes: Vec<&str> = v["warnings"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .map(|w| w["code"].as_str().unwrap())
+        .collect();
+    assert!(!codes.contains(&"rollout_incomplete_lookup"), "{codes:?}");
+    assert!(
+        pinned(tmp.path()).contains(&"roll-e".to_string()),
+        "the pin stays"
+    );
+}
diff --git a/crates/socket-patch-core/src/api/ranking.rs b/crates/socket-patch-core/src/api/ranking.rs
index 395f790d..4aca7fac 100644
--- a/crates/socket-patch-core/src/api/ranking.rs
+++ b/crates/socket-patch-core/src/api/ranking.rs
@@ -25,6 +25,11 @@
 //!
 //! `tier` is an access filter, not a ranking signal: callers drop the paid
 //! patches a free user cannot download before ranking.
+//!
+//! This order picks one patch per package. Which *packages* a capped scan
+//! patches first is a different order, [`crate::rollout::rollout_cmp`]:
+//! it reads the same severity ladder and advisory count, but never the
+//! publish date, so a missing date cannot reshuffle the rollout queue.
 
 use std::cmp::{Ordering, Reverse};
 
@@ -159,7 +164,18 @@ pub fn cmp_search_results(a: &PatchSearchResult, b: &PatchSearchResult) -> Order
 /// never count, and neither does a missing date (the batch endpoint omits
 /// `publishedAt`), so an equal sibling is never reported as an update.
 pub fn batch_supersedes(candidate: &BatchPatchInfo, applied: &BatchPatchInfo) -> bool {
-    let (c, a) = (rank_batch_info(candidate), rank_batch_info(applied));
+    key_supersedes(&rank_batch_info(candidate), &rank_batch_info(applied))
+}
+
+/// [`batch_supersedes`] over the by-package shape: the rule scan uses to
+/// classify a recorded patch (ALREADY vs UPGRADE) and to report
+/// `updates[]`, on the same records that pick the patch, so selection,
+/// classification and reporting cannot disagree.
+pub fn search_result_supersedes(candidate: &PatchSearchResult, recorded: &PatchSearchResult) -> bool {
+    key_supersedes(&rank_search_result(candidate), &rank_search_result(recorded))
+}
+
+fn key_supersedes(c: &RankKey<'_>, a: &RankKey<'_>) -> bool {
     if c.not_merged != a.not_merged {
         return !c.not_merged;
     }
@@ -807,6 +823,45 @@ mod tests {
         );
     }
 
+    // ── search_result_supersedes ─────────────────────────────────────
+
+    #[test]
+    fn search_supersedes_on_merged_state_first() {
+        let merged = search_multi("z", "free", "2020-01-01T00:00:00Z", &["low", "low"]);
+        let single = search("a", "free", "2026-01-01T00:00:00Z", "critical");
+        assert!(search_result_supersedes(&merged, &single));
+        assert!(!search_result_supersedes(&single, &merged));
+    }
+
+    #[test]
+    fn search_supersedes_on_severity_between_unmerged() {
+        let crit = search("z", "free", "2020-01-01T00:00:00Z", "critical");
+        let high = search("a", "free", "2026-01-01T00:00:00Z", "high");
+        assert!(search_result_supersedes(&crit, &high));
+        assert!(!search_result_supersedes(&high, &crit));
+    }
+
+    #[test]
+    fn search_supersedes_on_a_real_later_date_only() {
+        let newer = search("z", "free", "2026-01-01T00:00:00Z", "high");
+        let older = search("a", "free", "2024-01-01T00:00:00Z", "high");
+        assert!(search_result_supersedes(&newer, &older));
+        assert!(!search_result_supersedes(&older, &newer));
+        let undated = search("z", "free", "", "high");
+        assert!(!search_result_supersedes(&undated, &older));
+        assert!(!search_result_supersedes(&newer, &undated));
+    }
+
+    #[test]
+    fn search_supersedes_ignores_tier_and_uuid_tiebreaks() {
+        let paid = search("a", "paid", "2026-01-01T00:00:00Z", "high");
+        let free = search("z", "free", "2026-01-01T00:00:00Z", "high");
+        assert_eq!(cmp_search_results(&paid, &free), Ordering::Less);
+        assert!(!search_result_supersedes(&paid, &free));
+        assert!(!search_result_supersedes(&free, &paid));
+        assert!(!search_result_supersedes(&paid, &paid));
+    }
+
     #[test]
     fn batch_without_published_at_still_ranks_by_severity() {
         // The batch endpoint historically omits `publishedAt`; losing the
diff --git a/crates/socket-patch-core/src/hosted/engine.rs b/crates/socket-patch-core/src/hosted/engine.rs
index bc0afe8a..2d9173b9 100644
--- a/crates/socket-patch-core/src/hosted/engine.rs
+++ b/crates/socket-patch-core/src/hosted/engine.rs
@@ -287,7 +287,7 @@ pub fn withhold_everywhere(
 }
 
 /// The project's candidate files as the rewriters read them.
-#[derive(Debug, Default)]
+#[derive(Debug, Clone, Default)]
 pub struct CandidateFiles {
     /// Readable candidate texts, keyed by project-relative path.
     pub files: BTreeMap<String, String>,
diff --git a/crates/socket-patch-core/src/hosted/memory/discover.rs b/crates/socket-patch-core/src/hosted/memory/discover.rs
index 1a7758c8..6e5b36e0 100644
--- a/crates/socket-patch-core/src/hosted/memory/discover.rs
+++ b/crates/socket-patch-core/src/hosted/memory/discover.rs
@@ -15,7 +15,7 @@ use std::time::Duration;
 use crate::api::client::{ApiError, ApiFuture, PatchApi};
 use crate::api::ranking::cmp_search_results;
 use crate::api::types::{
-    BatchPackagePatches, PackageVendorResult, PatchResponse, PatchSearchResult, SearchResponse,
+    BatchPackagePatches, PackageVendorResult, PatchResponse, SearchResponse,
 };
 use crate::utils::purl::{normalize_purl, strip_purl_qualifiers};
 
@@ -280,29 +280,6 @@ pub(crate) async fn fetch_details(
         .collect()
 }
 
-/// The disk `--json` selection over one root's merged detail results:
-/// accessible patches only, then the top-ranked patch per purl, sorted by
-/// purl, as `(purl, uuid)`.
-pub(crate) fn select_top_ranked(
-    results: &[PatchSearchResult],
-    can_access_paid: bool,
-) -> Vec<(String, String)> {
-    let mut by_purl: BTreeMap<&str, Vec<&PatchSearchResult>> = BTreeMap::new();
-    for patch in results
-        .iter()
-        .filter(|p| can_access_paid || p.tier == "free")
-    {
-        by_purl.entry(patch.purl.as_str()).or_default().push(patch);
-    }
-    by_purl
-        .into_iter()
-        .filter_map(|(purl, mut group)| {
-            group.sort_by(|a, b| cmp_search_results(a, b));
-            group.first().map(|p| (purl.to_string(), p.uuid.clone()))
-        })
-        .collect()
-}
-
 /// Reference grants for every distinct uuid (`MAX_REFERENCE_BATCH` per
 /// request): the merged results, plus the uuids whose request failed.
 pub(crate) async fn fetch_references(
@@ -389,6 +366,7 @@ pub(crate) async fn fetch_records(
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::api::types::PatchSearchResult;
     use std::sync::atomic::{AtomicUsize, Ordering};
 
     #[tokio::test]
@@ -440,13 +418,21 @@ mod tests {
             result("pkg:npm/a@1", "a-paid", "paid", "critical"),
             result("pkg:npm/a@1", "a-free", "free", "low"),
         ];
+        // The engine selects through the disk flow's own seam.
+        let pairs = |paid: bool| -> Vec<(String, String)> {
+            crate::rollout::stage::offers_from_results(&results, paid)
+                .selected
+                .into_iter()
+                .map(|(purl, p)| (purl, p.uuid))
+                .collect()
+        };
         assert_eq!(
-            select_top_ranked(&results, false),
+            pairs(false),
             vec![
                 ("pkg:npm/a@1".to_string(), "a-free".to_string()),
                 ("pkg:npm/b@1".to_string(), "b-crit".to_string())
             ]
         );
-        assert_eq!(select_top_ranked(&results, true)[0].1, "a-paid");
+        assert_eq!(pairs(true)[0].1, "a-paid");
     }
 }
diff --git a/crates/socket-patch-core/src/hosted/memory/limits.rs b/crates/socket-patch-core/src/hosted/memory/limits.rs
index af11729c..9f895d6c 100644
--- a/crates/socket-patch-core/src/hosted/memory/limits.rs
+++ b/crates/socket-patch-core/src/hosted/memory/limits.rs
@@ -27,11 +27,30 @@ pub(crate) struct ResolvedOptions {
     pub(crate) provider_concurrency: usize,
     pub(crate) request_timeout: std::time::Duration,
     pub(crate) limits: ResolvedLimits,
+    /// `maxNewPatches` (`Some(None)` is `"none"`); see [`Self::max_new`].
+    max_new_patches: Option<Option<u32>>,
+    max_new_patches_cap: Option<u32>,
+    /// `inFlightPatches` as canonical base purls.
+    pub(crate) in_flight: std::collections::BTreeSet<String>,
     pub(crate) policy_overrides: crate::policy::PolicyOverrides,
     pub(crate) policy_paths: Vec<String>,
     pub(crate) policy_sha256: Option<String>,
 }
 
+impl ResolvedOptions {
+    /// The run-wide cap on NEW patches: the `maxNewPatches` option (reported
+    /// as `flag`), then the socket.yml `patches.maxNewPatches`, then
+    /// unlimited; `maxNewPatchesCap` only tightens it.
+    pub(crate) fn max_new(&self, file: Option<u32>) -> crate::rollout::MaxNew {
+        crate::rollout::resolve_max_new(
+            self.max_new_patches,
+            None,
+            file,
+            self.max_new_patches_cap,
+        )
+    }
+}
+
 pub(crate) fn resolve_options(options: &HostedScanOptions) -> Result<ResolvedOptions, EngineError> {
     if options.org_slug.trim().is_empty() {
         return Err(EngineError::invalid(
@@ -128,6 +147,14 @@ pub(crate) fn resolve_options(options: &HostedScanOptions) -> Result<ResolvedOpt
         provider_concurrency: provider_concurrency.min(MAX_PROVIDER_CONCURRENCY) as usize,
         request_timeout: std::time::Duration::from_millis(timeout_ms),
         limits: options.limits.clone().unwrap_or_default().resolve(),
+        max_new_patches: options.max_new_patches.map(|v| v.0),
+        max_new_patches_cap: options.max_new_patches_cap,
+        in_flight: options
+            .in_flight_patches
+            .iter()
+            .flatten()
+            .map(|p| crate::rollout::canonical_base_purl(p))
+            .collect(),
         policy_overrides,
         policy_paths,
         policy_sha256: options.policy_sha256.clone(),
diff --git a/crates/socket-patch-core/src/hosted/memory/mod.rs b/crates/socket-patch-core/src/hosted/memory/mod.rs
index b80d1d2d..e11aa036 100644
--- a/crates/socket-patch-core/src/hosted/memory/mod.rs
+++ b/crates/socket-patch-core/src/hosted/memory/mod.rs
@@ -58,6 +58,11 @@ pub use limits::SessionBuilder;
 pub use select::{candidate_files, safe_repo_path, select_paths};
 pub use types::*;
 
+use crate::rollout::stage::{
+    classify, lookup_incomplete, mentioned_uuids, offers_from_results, Offers, RecordedIndex, Row,
+    Stage,
+    ROLLOUT_DEFERRED,
+};
 use discover::Provider;
 use stages::{Planned, RewriteRefused, Rewritten, StageOptions};
 use crate::policy::{
@@ -115,8 +120,15 @@ struct RootState {
     purls: Vec<String>,
     summary: ProjectSummary,
     packages: Vec<crate::api::types::BatchPackagePatches>,
+    /// Every accessible offer per purl, and the winner per purl.
+    offers: Offers,
+    /// Purls whose detail query failed.
+    failed_details: Vec<String>,
+    /// The classified rows (§5.1) the run-wide rollout plan spends on.
+    rows: Vec<Row>,
     selected: Vec<(String, String)>,
     skipped: Vec<SkippedPatch>,
+    deferred: Vec<DeferredPatch>,
     /// Candidates the socket.yml policy withheld (`policy_*` reasons).
     policy_skipped: Vec<SkippedPatch>,
     error: Option<ProjectError>,
@@ -365,6 +377,56 @@ fn unrooted_unsupported_warnings<'a>(
     }
 }
 
+/// One root's recorded view (§5.1) in memory: its `.socket/manifest.json`,
+/// the hosted pins its lockfiles name, and its vendor ledger — the disk
+/// merge's precedence. A pin is a mention of an offered uuid for the purl
+/// in one of the root's own files (a nested root's files are its own); a
+/// pin to a patch the API no longer offers reads as NEW, which costs one
+/// slot once instead of stalling.
+fn memory_recorded(
+    project: &MemoryProject,
+    root: &str,
+    roots: &[String],
+    offers: &Offers,
+) -> RecordedIndex {
+    let manifest = project
+        .text(select::MANIFEST_REL)
+        .and_then(|text| serde_json::from_str(text).ok());
+    let vendor = stages::vendored_entries(project);
+    let nested: Vec<String> = roots
+        .iter()
+        .filter(|other| other.as_str() != root)
+        .filter_map(|other| roots::strip_root(root, other).map(|rel| format!("{rel}/")))
+        .filter(|rel| rel != "/")
+        .collect();
+    let mut mentioned = std::collections::HashSet::new();
+    for (path, entry) in project.entries() {
+        if path.starts_with(".socket/") || nested.iter().any(|n| path.starts_with(n.as_str())) {
+            continue;
+        }
+        if let MemoryEntry::Text(text) = entry {
+            mentioned_uuids(text, &mut mentioned);
+        }
+    }
+    let pins: Vec<(String, String)> = offers
+        .selected
+        .iter()
+        .filter_map(|(purl, selected)| {
+            let offered = offers.unfiltered.get(purl)?;
+            std::iter::once(selected)
+                .chain(offered.iter())
+                .find(|p| mentioned.contains(&p.uuid.to_ascii_lowercase()))
+                .map(|p| (purl.clone(), p.uuid.clone()))
+        })
+        .collect();
+    let merged = crate::ledgers::merge_ledger_records_for_updates(
+        manifest.as_ref(),
+        vendor.as_ref(),
+        &pins,
+    );
+    RecordedIndex::new(merged.as_deref(), &pins)
+}
+
 async fn engine(
     input: HostedScanInput,
     api: Arc<dyn PatchApi>,
@@ -487,8 +549,12 @@ async fn engine(
             purls: Vec::new(),
             summary: ProjectSummary::default(),
             packages: Vec::new(),
+            offers: Offers::default(),
+            failed_details: Vec::new(),
+            rows: Vec::new(),
             selected: Vec::new(),
             skipped: Vec::new(),
+            deferred: Vec::new(),
             policy_skipped: Vec::new(),
             error: None,
         })
@@ -555,6 +621,8 @@ async fn engine(
         .collect();
     let batch = discover::batch_search(&provider, &root_purls, options.batch_size).await;
     let can_access_paid = batch.can_access_paid_patches;
+    // A package a failed batch hid could have been NEW (§5.2).
+    let mut batch_failed = false;
     for state in states.iter_mut().filter(|s| s.error.is_none()) {
         state.summary.can_access_paid_patches = can_access_paid;
         let Some(outcome) = batch.roots.get(&state.root) else {
@@ -569,6 +637,7 @@ async fn engine(
             continue;
         }
         if outcome.failed_purls > 0 {
+            batch_failed = true;
             warnings.push(EngineWarning::new(
                 "batch_failed",
                 format!(
@@ -609,8 +678,14 @@ async fn engine(
         for pkg in &state.packages {
             match details.get(&pkg.purl) {
                 Some(Ok(response)) => results.extend(response.patches.iter().cloned()),
-                Some(Err(error)) => failures.push(error.clone()),
-                None => failures.push("patch details were not fetched".to_string()),
+                Some(Err(error)) => {
+                    failures.push(error.clone());
+                    state.failed_details.push(pkg.purl.clone());
+                }
+                None => {
+                    failures.push("patch details were not fetched".to_string());
+                    state.failed_details.push(pkg.purl.clone());
+                }
             }
         }
         if !failures.is_empty() && failures.len() == state.packages.len() {
@@ -632,7 +707,7 @@ async fn engine(
                 Some(&state.root),
             ));
         }
-        state.selected = select_with_policy(
+        state.offers = select_with_policy(
             &policy,
             results,
             can_access_paid,
@@ -643,6 +718,39 @@ async fn engine(
     }
     phases.mark("details");
 
+    // Classify every root's selection against its recorded view (§5.1):
+    // the tree's manifest and vendor ledger, and the hosted pins its
+    // lockfiles name. ALREADY rows carry the recorded uuid, so a re-scan
+    // re-confirms a pin instead of swapping it.
+    let mut stage = Stage::new(options.max_new(policy.max_new_patches()), None, std::path::Path::new(""));
+    // A root whose every lookup failed hides packages that could have been
+    // NEW: a capped run then admits none anywhere (§5.2).
+    stage.incomplete |= states
+        .iter()
+        .any(|s| s.error.as_ref().is_some_and(|e| e.code == "patch_lookup_failed"));
+    let roots_by_path: Vec<String> = states.iter().map(|s| s.root.clone()).collect();
+    for state in states.iter_mut().filter(|s| s.error.is_none()) {
+        let Some(project) = state.project.as_ref() else {
+            continue;
+        };
+        let recorded = memory_recorded(project, &state.root, &roots_by_path, &state.offers);
+        stage.incomplete |= lookup_incomplete(
+            &recorded,
+            &state.failed_details,
+            batch_failed,
+        );
+        let mut rows = classify(&state.offers, &recorded, &state.root);
+        for row in &mut rows {
+            row.candidate.in_flight = options.in_flight.contains(&row.candidate.base_purl);
+        }
+        state.selected = rows
+            .iter()
+            .map(|r| (r.writer.purl.clone(), r.writer.uuid.clone()))
+            .collect();
+        state.rows = rows;
+    }
+    phases.mark("classify");
+
     let uuids: BTreeSet<String> = states
         .iter()
         .filter(|s| s.error.is_none())
@@ -653,12 +761,24 @@ async fn engine(
     } else {
         discover::fetch_references(&provider, &uuids).await
     };
+    // Roots whose rows' eligibility is unknown: a reference failure that
+    // hit only NEW rows of a capped run defers them instead of failing the
+    // root (§5.2).
+    let mut unknown_roots: BTreeSet<String> = BTreeSet::new();
     for state in states.iter_mut().filter(|s| s.error.is_none()) {
         if let Some(error) = state
             .selected
             .iter()
             .find_map(|(_, uuid)| failed_refs.get(uuid))
         {
+            if stage.capped() && state.rows.iter().all(|r| r.candidate.recorded.is_new()) {
+                stage.incomplete = true;
+                stage.reference_failed = Some(error.clone());
+                unknown_roots.insert(state.root.clone());
+                state.selected.clear();
+                continue;
+            }
+            stage.incomplete = true;
             state.fail(
                 "reference_lookup_failed",
                 format!("failed to resolve patch references: {error}"),
@@ -693,16 +813,20 @@ async fn engine(
     };
     phases.mark("plan");
 
-    let stage = StageOptions {
+    let stage_options = StageOptions {
         dry_run: options.dry_run,
         pipenv_major: options.pipenv_major,
         trust_lockfile_config: options.trust_lockfile_config,
         npm_allow_remote_config: options.npm_allow_remote_config,
     };
     let mut rewritten: Vec<(usize, Rewritten)> = Vec::new();
+    let mut first_plans: BTreeMap<usize, Planned> = BTreeMap::new();
     for (index, plan) in planned {
         checkpoint(&cancel).await?;
-        match stages::rewrite(plan, &wheel_metadata, stage).await {
+        if stage.capped() {
+            first_plans.insert(index, plan.clone());
+        }
+        match stages::rewrite(plan, &wheel_metadata, stage_options).await {
             Ok(done) => rewritten.push((index, done)),
             Err(RewriteRefused { refusal, skipped }) => {
                 states[index].skipped = skipped;
@@ -712,6 +836,103 @@ async fn engine(
     }
     phases.mark("rewrite");
 
+    // The run-wide rollout plan (§5.2): one budget across every root, spent
+    // after each root's write-free checks (grants, takeover refusals, vlt,
+    // wheel metadata, the rewrite's confirmation probe). A root with
+    // deferred rows is rewritten again without them.
+    let confirmed: BTreeSet<(String, String)> = rewritten
+        .iter()
+        .flat_map(|(index, done)| {
+            let root = states[*index].root.clone();
+            done.done
+                .confirmed
+                .iter()
+                .map(move |(_, uuid)| (root.clone(), uuid.clone()))
+        })
+        .collect();
+    let all_rows: Vec<Row> = states
+        .iter()
+        .filter(|s| s.error.is_none())
+        .flat_map(|s| s.rows.iter().cloned())
+        .collect();
+    stage.plan(&all_rows, |row| {
+        unknown_roots.contains(&row.candidate.project)
+            || confirmed.contains(&(row.candidate.project.clone(), row.writer.uuid.clone()))
+    });
+    let deferred_rows: Vec<(crate::rollout::Candidate, u32)> =
+        stage.plan.as_ref().map(|p| p.deferred.clone()).unwrap_or_default();
+    if !deferred_rows.is_empty() {
+        let root_index: BTreeMap<String, usize> = states
+            .iter()
+            .enumerate()
+            .map(|(i, s)| (s.root.clone(), i))
+            .collect();
+        for (row, rank) in &deferred_rows {
+            let Some(&i) = root_index.get(&row.project) else {
+                continue;
+            };
+            states[i].deferred.push(DeferredPatch {
+                purl: row.purl.clone(),
+                uuid: row.uuid.clone(),
+                severity: crate::rollout::severity_label(row.severity_order).into(),
+                rank: *rank,
+            });
+        }
+        let deferred_skip = |d: &DeferredPatch| SkippedPatch {
+            purl: d.purl.clone(),
+            uuid: d.uuid.clone(),
+            reason: ROLLOUT_DEFERRED.to_string(),
+            detail: Some(format!(
+                "rank {} in the rollout queue; a later scan adds it",
+                d.rank
+            )),
+        };
+        let mut again: Vec<(usize, Rewritten)> = Vec::with_capacity(rewritten.len());
+        for (index, done) in rewritten {
+            let root_deferred: BTreeSet<String> = states[index]
+                .deferred
+                .iter()
+                .map(|d| d.uuid.clone())
+                .collect();
+            if root_deferred.is_empty() {
+                again.push((index, done));
+                continue;
+            }
+            checkpoint(&cancel).await?;
+            // The first pass's skips stay (wheel metadata the rewrite could
+            // not fetch): its candidates are already gone, so the second
+            // pass cannot report them again.
+            let Some(mut plan) = first_plans.remove(&index) else {
+                again.push((index, done));
+                continue;
+            };
+            plan.candidates
+                .retain(|c| !root_deferred.contains(&c.dep.patch_uuid));
+            plan.skipped
+                .extend(states[index].deferred.iter().map(deferred_skip));
+            match stages::rewrite(plan, &wheel_metadata, stage_options).await {
+                Ok(done) => again.push((index, done)),
+                Err(RewriteRefused { refusal, skipped }) => {
+                    states[index].skipped = skipped;
+                    states[index].error = Some(ProjectError::from(refusal));
+                }
+            }
+        }
+        rewritten = again;
+        // Roots that never reached the rewrite (unknown eligibility) list
+        // their deferred rows as skipped too.
+        for state in states.iter_mut() {
+            if unknown_roots.contains(&state.root) && state.error.is_none() {
+                let extra: Vec<SkippedPatch> = state.deferred.iter().map(deferred_skip).collect();
+                state.skipped.extend(extra);
+            }
+        }
+    }
+    for (code, detail) in stage.warnings() {
+        warnings.push(EngineWarning::new(code, detail, None));
+    }
+    phases.mark("rollout");
+
     let record_uuids: BTreeSet<String> = if options.dry_run {
         BTreeSet::new()
     } else {
@@ -768,6 +989,7 @@ async fn engine(
             summary: state.summary.clone(),
             redirected: Vec::new(),
             skipped,
+            deferred: state.deferred.clone(),
             error: state.error.clone(),
         });
     }
@@ -802,6 +1024,7 @@ async fn engine(
         changed_binary_files,
         deleted_files: Vec::new(),
         warnings,
+        rollout: stage.json(),
         stats,
         engine_version: engine_version(),
         policy: Some(policy_block(&policy, &policy_filtered, &[])),
@@ -842,6 +1065,7 @@ fn policy_error_output(
         changed_binary_files: Vec::new(),
         deleted_files: Vec::new(),
         warnings,
+        rollout: serde_json::Value::Null,
         stats: EngineStats {
             files_input,
             bytes_input,
@@ -867,7 +1091,7 @@ fn select_with_policy(
     root: &str,
     filtered: &mut Vec<FilteredEntry>,
     skipped: &mut Vec<SkippedPatch>,
-) -> Vec<(String, String)> {
+) -> Offers {
     let accessible: Vec<PatchSearchResult> = results
         .into_iter()
         .filter(|p| can_access_paid || p.tier == "free")
@@ -883,8 +1107,8 @@ fn select_with_policy(
                 .collect(),
         )
     };
-    let selected = discover::select_top_ranked(&admitted, true);
-    let chosen: BTreeSet<&str> = selected.iter().map(|(purl, _)| purl.as_str()).collect();
+    let offers = offers_from_results(&admitted, true);
+    let chosen: BTreeSet<&str> = offers.selected.keys().map(String::as_str).collect();
     let mut by_purl: BTreeMap<String, Vec<(PatchSearchResult, FilterReason)>> = BTreeMap::new();
     for (patch, reason) in dropped {
         if !chosen.contains(patch.purl.as_str()) {
@@ -908,7 +1132,7 @@ fn select_with_policy(
             reason,
         });
     }
-    selected
+    offers
 }
 
 /// Records → the project's result and changed files.
@@ -1000,6 +1224,7 @@ fn finish_root(
             summary: state.summary.clone(),
             redirected: Vec::new(),
             skipped,
+            deferred: state.deferred.clone(),
             error: Some(ProjectError {
                 code: "conflicting_write".into(),
                 message,
@@ -1045,6 +1270,7 @@ fn finish_root(
             .map(|(purl, uuid)| RedirectedPatch { purl, uuid })
             .collect(),
         skipped,
+        deferred: state.deferred.clone(),
         error: None,
     }
 }
@@ -1062,8 +1288,12 @@ mod tests {
             purls: Vec::new(),
             summary: ProjectSummary::default(),
             packages: Vec::new(),
+            offers: Offers::default(),
+            failed_details: Vec::new(),
+            rows: Vec::new(),
             selected: Vec::new(),
             skipped: Vec::new(),
+            deferred: Vec::new(),
             policy_skipped: Vec::new(),
             error: None,
         }
diff --git a/crates/socket-patch-core/src/hosted/memory/select.rs b/crates/socket-patch-core/src/hosted/memory/select.rs
index be43ec8e..fb4dfc83 100644
--- a/crates/socket-patch-core/src/hosted/memory/select.rs
+++ b/crates/socket-patch-core/src/hosted/memory/select.rs
@@ -41,8 +41,12 @@ const MAX_PATH_DEPTH: usize = 64;
 /// The vendored-mode ledger (its presence refuses a vendored takeover).
 pub(crate) const VENDOR_STATE_REL: &str = ".socket/vendor/state.json";
 
+/// The agent-mode manifest: part of the recorded view the rollout cap
+/// classifies against (a package it records is not NEW).
+pub(crate) const MANIFEST_REL: &str = ".socket/manifest.json";
+
 /// Root-relative text files read beyond `REDIRECT_CANDIDATE_FILES`.
-const EXTRA_TEXT_FILES: [&str; 3] = [PNPM_WORKSPACE_REL, NPMRC_REL, VENDOR_STATE_REL];
+const EXTRA_TEXT_FILES: [&str; 4] = [PNPM_WORKSPACE_REL, NPMRC_REL, VENDOR_STATE_REL, MANIFEST_REL];
 
 /// The one directory name the disk Cargo member walk never enters (it
 /// follows `members`, `exclude`, path dependencies and `[patch]` paths
diff --git a/crates/socket-patch-core/src/hosted/memory/stages.rs b/crates/socket-patch-core/src/hosted/memory/stages.rs
index a2b8d403..61944e59 100644
--- a/crates/socket-patch-core/src/hosted/memory/stages.rs
+++ b/crates/socket-patch-core/src/hosted/memory/stages.rs
@@ -38,7 +38,7 @@ pub(crate) struct StageOptions {
 /// The vendored ledger's entries (the disk `vendor::load_state` parse,
 /// including its legacy `{mode}`-only shape); `None` when absent or
 /// unreadable.
-fn vendored_entries(project: &MemoryProject) -> Option<VendorState> {
+pub(crate) fn vendored_entries(project: &MemoryProject) -> Option<VendorState> {
     let bytes: Vec<u8> = match project.get(VENDOR_STATE_REL)? {
         MemoryEntry::Text(text) => text.as_bytes().to_vec(),
         MemoryEntry::Binary(bytes) => bytes.to_vec(),
@@ -142,7 +142,7 @@ fn refuse_takeovers(
 
 /// A project's state between the reference grants and the wheel-metadata
 /// fetch.
-#[derive(Debug)]
+#[derive(Debug, Clone)]
 pub(crate) struct Planned {
     pub(crate) project: MemoryProject,
     pub(crate) candidates: Vec<Candidate>,
diff --git a/crates/socket-patch-core/src/hosted/memory/types.rs b/crates/socket-patch-core/src/hosted/memory/types.rs
index e982c14e..2a11daed 100644
--- a/crates/socket-patch-core/src/hosted/memory/types.rs
+++ b/crates/socket-patch-core/src/hosted/memory/types.rs
@@ -115,6 +115,68 @@ pub struct HostedScanOptions {
     /// `policyError` when the policy it reads differs.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub policy_sha256: Option<String>,
+    /// The run-wide cap on NEW patches (`scan --max-new-patches`); absent
+    /// or `"none"` is unlimited, 0 admits upgrades only.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub max_new_patches: Option<MaxNewPatchesOption>,
+    /// A server ceiling applied on top of `maxNewPatches`, `"none"`
+    /// included: it can tighten the cap, never loosen it.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub max_new_patches_cap: Option<u32>,
+    /// Base purls already proposed in an open rollout PR: ranked first, so
+    /// a newly published patch never displaces one under review.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub in_flight_patches: Option<Vec<String>>,
+}
+
+/// `maxNewPatches`: a count, or `"none"` (`None`).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct MaxNewPatchesOption(pub Option<u32>);
+
+impl Serialize for MaxNewPatchesOption {
+    fn serialize<S: serde::Serializer>(&self, s: S) -> Result<S::Ok, S::Error> {
+        match self.0 {
+            Some(n) => s.serialize_u32(n),
+            None => s.serialize_str("none"),
+        }
+    }
+}
+
+impl<'de> Deserialize<'de> for MaxNewPatchesOption {
+    fn deserialize<D: serde::Deserializer<'de>>(d: D) -> Result<Self, D::Error> {
+        struct Visitor;
+        impl serde::de::Visitor<'_> for Visitor {
+            type Value = MaxNewPatchesOption;
+            fn expecting(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result {
+                f.write_str("a patch count (0 to 4294967295) or \"none\"")
+            }
+            fn visit_u64<E: serde::de::Error>(self, v: u64) -> Result<Self::Value, E> {
+                u32::try_from(v)
+                    .map(|n| MaxNewPatchesOption(Some(n)))
+                    .map_err(|_| E::custom("maxNewPatches exceeds 4294967295"))
+            }
+            fn visit_i64<E: serde::de::Error>(self, v: i64) -> Result<Self::Value, E> {
+                u64::try_from(v)
+                    .map_err(|_| E::custom("maxNewPatches must not be negative"))
+                    .and_then(|v| self.visit_u64(v))
+            }
+            fn visit_f64<E: serde::de::Error>(self, v: f64) -> Result<Self::Value, E> {
+                if v.fract() == 0.0 && (0.0..=f64::from(u32::MAX)).contains(&v) {
+                    Ok(MaxNewPatchesOption(Some(v as u32)))
+                } else {
+                    Err(E::custom("maxNewPatches must be a whole number of patches"))
+                }
+            }
+            fn visit_str<E: serde::de::Error>(self, v: &str) -> Result<Self::Value, E> {
+                if v == "none" {
+                    Ok(MaxNewPatchesOption(None))
+                } else {
+                    Err(E::custom(format!("maxNewPatches must be a number or \"none\", not `{v}`")))
+                }
+            }
+        }
+        d.deserialize_any(Visitor)
+    }
 }
 
 pub const DEFAULT_BATCH_SIZE: u32 = 100;
@@ -244,10 +306,26 @@ pub struct ProjectResult {
     pub summary: ProjectSummary,
     pub redirected: Vec<RedirectedPatch>,
     pub skipped: Vec<SkippedPatch>,
+    /// NEW patches over the run-wide `maxNewPatches` budget, in rank order
+    /// (also in `skipped[]` as `rollout_deferred`).
+    #[serde(default)]
+    pub deferred: Vec<DeferredPatch>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub error: Option<ProjectError>,
 }
 
+/// One deferred NEW patch.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct DeferredPatch {
+    pub purl: String,
+    pub uuid: String,
+    /// `critical` … `unknown`.
+    pub severity: String,
+    /// 1-based rank among the run's eligible NEW base purls.
+    pub rank: u32,
+}
+
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
 pub struct ChangedFile {
@@ -292,6 +370,10 @@ pub struct HostedScanOutput {
     pub changed_binary_files: Vec<ChangedBinaryFile>,
     pub deleted_files: Vec<String>,
     pub warnings: Vec<EngineWarning>,
+    /// The session-level `rollout` block, the CLI `--json` shape; absent
+    /// when the session failed on its socket.yml (`policyError`).
+    #[serde(default, skip_serializing_if = "serde_json::Value::is_null")]
+    pub rollout: serde_json::Value,
     pub stats: EngineStats,
     pub engine_version: String,
     /// The session-level `policy` block (the CLI's `policy` JSON shape);
diff --git a/crates/socket-patch-core/src/hosted/vlt.rs b/crates/socket-patch-core/src/hosted/vlt.rs
index e2e83aaf..85f02cf9 100644
--- a/crates/socket-patch-core/src/hosted/vlt.rs
+++ b/crates/socket-patch-core/src/hosted/vlt.rs
@@ -61,7 +61,7 @@ pub(crate) fn bun_lockb_present(view: &ProjectView<'_>) -> bool {
 }
 
 /// What the artifact preflight decided for this run's npm candidates.
-#[derive(Debug, Default)]
+#[derive(Debug, Clone, Default)]
 pub struct Preflight {
     /// Failed while vlt drives, or for a vlt-vendored takeover: withheld
     /// from every rewriter.
diff --git a/crates/socket-patch-core/src/ledgers.rs b/crates/socket-patch-core/src/ledgers.rs
index 5ad5e73d..9bcf5662 100644
--- a/crates/socket-patch-core/src/ledgers.rs
+++ b/crates/socket-patch-core/src/ledgers.rs
@@ -22,6 +22,7 @@
 //! lockfile evidence (`vex`). The hosted records only ever join as the
 //! last store.
 
+use std::borrow::Cow;
 use std::collections::{HashMap, HashSet};
 use std::path::Path;
 
@@ -370,6 +371,59 @@ pub fn uuid_only_record(uuid: &str) -> PatchRecord {
     }
 }
 
+
+/// Fold the hosted pins and the vendor ledger's patch records into the
+/// manifest view update detection consults. Hosted mode records purl→uuid
+/// ONLY in the lockfiles (`hosted_pins`, uuid only; v5 keeps no hosted
+/// ledger) and vendored mode ONLY in `.socket/vendor/state.json`, so without
+/// this fold a pure hosted or vendored project's `updates[]` would always
+/// be empty. Precedence on a collision: manifest > hosted pins > vendor
+/// ledger (the live lock over a possibly superseded vendored entry); the
+/// vendor entries fold under the shared owner rule
+/// ([`Ledgers::owned`]), so one the manifest
+/// claims (its key or base purl) stays behind the manifest's record.
+/// Vendor entries are keyed by their ledger key (`detect_updates` bridges
+/// the spellings); a legacy entry without an embedded record contributes
+/// its uuid alone. Borrows the manifest untouched when nothing else
+/// contributes.
+pub fn merge_ledger_records_for_updates<'a>(
+    manifest: Option<&'a PatchManifest>,
+    vendor: Option<&VendorState>,
+    hosted_pins: &[(String, String)],
+) -> Option<Cow<'a, PatchManifest>> {
+    let vendor = vendor.filter(|s| !s.entries.is_empty());
+    if vendor.is_none() && hosted_pins.is_empty() {
+        return manifest.map(Cow::Borrowed);
+    }
+    let mut merged = manifest.cloned().unwrap_or_default();
+    for (purl, uuid) in hosted_pins {
+        merged
+            .patches
+            .entry(purl.clone())
+            .or_insert_with(|| uuid_only_record(uuid));
+    }
+    let ledgers = Ledgers {
+        manifest,
+        vendor,
+        redirect: None,
+    };
+    for owned in ledgers.owned() {
+        if owned.store == Store::Manifest {
+            continue;
+        }
+        merged
+            .patches
+            .entry(owned.key.to_string())
+            .or_insert_with(|| {
+                owned
+                    .record
+                    .cloned()
+                    .unwrap_or_else(|| uuid_only_record(owned.uuid))
+            });
+    }
+    Some(Cow::Owned(merged))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
diff --git a/crates/socket-patch-core/src/lib.rs b/crates/socket-patch-core/src/lib.rs
index c16adb55..f257d0be 100644
--- a/crates/socket-patch-core/src/lib.rs
+++ b/crates/socket-patch-core/src/lib.rs
@@ -8,6 +8,7 @@ pub mod ledgers;
 pub mod manifest;
 pub mod patch;
 pub mod policy;
+pub mod rollout;
 pub mod telemetry;
 pub mod update;
 pub mod utils;
diff --git a/crates/socket-patch-core/src/rollout.rs b/crates/socket-patch-core/src/rollout.rs
new file mode 100644
index 00000000..ac955e4c
--- /dev/null
+++ b/crates/socket-patch-core/src/rollout.rs
@@ -0,0 +1,696 @@
+//! Staged rollout: the per-run cap on NEW patches (`scan
+//! --max-new-patches`, `patches.maxNewPatches` in socket.yml).
+//!
+//! Pure planning only. Callers classify each selected `(project, purl)` row
+//! against the recorded state ([`Recorded`]), decide eligibility with their
+//! planning pass, and hand the rows to [`plan_rollout`], which admits the
+//! most critical NEW packages up to the budget and defers the rest. Rows
+//! that already carry a patch (ALREADY, UPGRADE) never count toward the cap.
+//!
+//! The order ([`rollout_cmp`]) is total and time-independent, so the same
+//! inputs always give the same plan and repeated runs converge: run k lands
+//! the top N, run k+1 sees them as recorded and lands the next N.
+
+pub mod stage;
+
+use std::cmp::{Ordering, Reverse};
+use std::collections::{BTreeMap, BTreeSet};
+
+/// What the recorded state (manifest > hosted pins > vendor ledger) says
+/// about one selected row.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Recorded {
+    /// No patch recorded for this base purl in this project: NEW.
+    None,
+    /// The recorded uuid is the selected one: ALREADY.
+    Same,
+    /// A different uuid is recorded and the selection does not supersede
+    /// it: ALREADY, and the writer keeps `uuid`.
+    Kept { uuid: String },
+    /// The selection supersedes the recorded uuid, or the recorded uuid is
+    /// no longer offered: UPGRADE.
+    Superseded { old_uuid: String },
+}
+
+impl Recorded {
+    pub fn is_new(&self) -> bool {
+        matches!(self, Recorded::None)
+    }
+}
+
+/// One selected `(project, purl)` row.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Candidate {
+    /// Repo-relative project root; `""` is the repo root.
+    pub project: String,
+    pub purl: String,
+    /// [`canonical_base_purl`] of `purl`: the budget unit.
+    pub base_purl: String,
+    /// The selected uuid.
+    pub uuid: String,
+    /// `Ecosystem::cli_name`.
+    pub ecosystem: &'static str,
+    /// `ranking::max_severity_order` of the selected patch (0 = critical).
+    pub severity_order: u8,
+    pub advisory_count: usize,
+    pub recorded: Recorded,
+    /// Every check the planning pass can decide without writing passed.
+    /// Only read for NEW rows.
+    pub eligible: bool,
+    /// Already proposed in an open rollout PR (in-memory engine option).
+    pub in_flight: bool,
+}
+
+/// Where the effective cap came from.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum MaxNewSource {
+    Flag,
+    Env,
+    File,
+    Default,
+    /// A server ceiling (`maxNewPatchesCap`) tightened the value.
+    Cap,
+}
+
+impl MaxNewSource {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            MaxNewSource::Flag => "flag",
+            MaxNewSource::Env => "env",
+            MaxNewSource::File => "file",
+            MaxNewSource::Default => "default",
+            MaxNewSource::Cap => "cap",
+        }
+    }
+}
+
+/// The effective cap. `value: None` is unlimited.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct MaxNew {
+    pub value: Option<u32>,
+    pub source: MaxNewSource,
+}
+
+impl MaxNew {
+    pub const UNLIMITED: MaxNew = MaxNew {
+        value: None,
+        source: MaxNewSource::Default,
+    };
+}
+
+/// Resolve the cap: flag > env > file > unlimited, then a server `cap`
+/// tightens it (never loosens; it applies to `none` too). For `flag` and
+/// `env`, `Some(None)` is an explicit `none`.
+pub fn resolve_max_new(
+    flag: Option<Option<u32>>,
+    env: Option<Option<u32>>,
+    file: Option<u32>,
+    cap: Option<u32>,
+) -> MaxNew {
+    let chosen = if let Some(value) = flag {
+        MaxNew {
+            value,
+            source: MaxNewSource::Flag,
+        }
+    } else if let Some(value) = env {
+        MaxNew {
+            value,
+            source: MaxNewSource::Env,
+        }
+    } else if let Some(value) = file {
+        MaxNew {
+            value: Some(value),
+            source: MaxNewSource::File,
+        }
+    } else {
+        MaxNew::UNLIMITED
+    };
+    match cap {
+        Some(cap) if chosen.value.is_none_or(|v| v > cap) => MaxNew {
+            value: Some(cap),
+            source: MaxNewSource::Cap,
+        },
+        _ => chosen,
+    }
+}
+
+/// The budget unit: ecosystem + name + version, qualifiers stripped,
+/// percent-decoded and case-folded where the ecosystem is case-insensitive
+/// (discovery's [`crate::vex::discover::canonical_base_purl`], the key
+/// hosted pins carry), so qualifier twins (a wheel and its sdist, gem
+/// platforms), the API's encoded spelling and a lockfile's `Newtonsoft.Json`
+/// vs a pin's `newtonsoft.json` are one package.
+pub fn canonical_base_purl(purl: &str) -> String {
+    crate::vex::discover::canonical_base_purl(purl)
+}
+
+/// Rollout order, most urgent first: in-flight, severity, advisory count
+/// (descending), ecosystem, base purl, uuid. Total, and free of
+/// time-dependent keys.
+pub fn rollout_cmp(a: &Candidate, b: &Candidate) -> Ordering {
+    rollout_key(a).cmp(&rollout_key(b))
+}
+
+type RolloutKey<'a> = (bool, u8, Reverse<usize>, &'a str, &'a str, &'a str);
+
+fn rollout_key(c: &Candidate) -> RolloutKey<'_> {
+    (
+        !c.in_flight,
+        c.severity_order,
+        Reverse(c.advisory_count),
+        c.ecosystem,
+        c.base_purl.as_str(),
+        c.uuid.as_str(),
+    )
+}
+
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub struct RolloutCounts {
+    /// Distinct base purls admitted as NEW.
+    pub new: u32,
+    /// Distinct base purls deferred.
+    pub deferred: u32,
+    /// UPGRADE rows.
+    pub upgrade: u32,
+    /// ALREADY rows (same or kept).
+    pub already: u32,
+}
+
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct RolloutPlan {
+    /// Rows the writers receive: admitted NEW rows plus every ALREADY and
+    /// UPGRADE row, in input order. Ineligible NEW rows are in neither
+    /// list; they keep their own skip reasons.
+    pub admitted: Vec<Candidate>,
+    /// Eligible NEW rows over the budget, in rank order, each with the
+    /// 1-based rank of its base purl among eligible NEW base purls.
+    pub deferred: Vec<(Candidate, u32)>,
+    pub counts: RolloutCounts,
+    /// Budget left for the next project directory; `None` is unlimited.
+    pub remaining: Option<u32>,
+    /// Base purls admitted so far in this invocation (input set included).
+    pub admitted_base_purls: BTreeSet<String>,
+}
+
+/// Admit eligible NEW base purls in [`rollout_cmp`] order until the budget
+/// is spent. A base purl already in `already_admitted` (an earlier
+/// directory of the same invocation) is admitted without spending budget.
+/// With a finite cap and `incomplete` set (a lookup failed for a package
+/// that could have been NEW), no NEW row is admitted: a missing package
+/// must not let lower-ranked ones take its slot.
+pub fn plan_rollout(
+    candidates: Vec<Candidate>,
+    max_new: &MaxNew,
+    incomplete: bool,
+    already_admitted: &BTreeSet<String>,
+) -> RolloutPlan {
+    let mut counts = RolloutCounts::default();
+    let mut remaining = max_new.value;
+    let mut admitted_base_purls = already_admitted.clone();
+
+    let mut new_rows: Vec<&Candidate> = candidates
+        .iter()
+        .filter(|c| c.recorded.is_new() && c.eligible)
+        .collect();
+    new_rows.sort_by(|a, b| rollout_cmp(a, b));
+    // Base purl → (rank, admitted), in rank order.
+    let mut decisions: BTreeMap<&str, (u32, bool)> = BTreeMap::new();
+    let mut rank = 0u32;
+    for row in &new_rows {
+        if decisions.contains_key(row.base_purl.as_str()) {
+            continue;
+        }
+        rank += 1;
+        let admit = if incomplete && max_new.value.is_some() {
+            false
+        } else if already_admitted.contains(&row.base_purl) {
+            true
+        } else {
+            match remaining.as_mut() {
+                None => true,
+                Some(0) => false,
+                Some(left) => {
+                    *left -= 1;
+                    true
+                }
+            }
+        };
+        if admit {
+            counts.new += 1;
+            admitted_base_purls.insert(row.base_purl.clone());
+        } else {
+            counts.deferred += 1;
+        }
+        decisions.insert(row.base_purl.as_str(), (rank, admit));
+    }
+
+    let deferred: Vec<(Candidate, u32)> = new_rows
+        .iter()
+        .filter_map(|row| match decisions[row.base_purl.as_str()] {
+            (rank, false) => Some(((*row).clone(), rank)),
+            _ => None,
+        })
+        .collect();
+    let mut admitted = Vec::new();
+    for row in &candidates {
+        match &row.recorded {
+            Recorded::None => {
+                if row.eligible && decisions[row.base_purl.as_str()].1 {
+                    admitted.push(row.clone());
+                }
+            }
+            Recorded::Superseded { .. } => {
+                counts.upgrade += 1;
+                admitted.push(row.clone());
+            }
+            Recorded::Same | Recorded::Kept { .. } => {
+                counts.already += 1;
+                admitted.push(row.clone());
+            }
+        }
+    }
+    RolloutPlan {
+        admitted,
+        deferred,
+        counts,
+        remaining,
+        admitted_base_purls,
+    }
+}
+
+/// The severity label for a `ranking::severity_order` value.
+pub fn severity_label(order: u8) -> &'static str {
+    match order {
+        0 => "critical",
+        1 => "high",
+        2 => "medium",
+        3 => "low",
+        _ => "unknown",
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn row(project: &str, purl: &str, uuid: &str, severity: u8, advisories: usize) -> Candidate {
+        Candidate {
+            project: project.to_string(),
+            purl: purl.to_string(),
+            base_purl: canonical_base_purl(purl),
+            uuid: uuid.to_string(),
+            ecosystem: purl
+                .strip_prefix("pkg:")
+                .and_then(|r| r.split('/').next())
+                .map(|e| match e {
+                    "npm" => "npm",
+                    "pypi" => "pypi",
+                    "cargo" => "cargo",
+                    "gem" => "gem",
+                    _ => "golang",
+                })
+                .unwrap_or("npm"),
+            severity_order: severity,
+            advisory_count: advisories,
+            recorded: Recorded::None,
+            eligible: true,
+            in_flight: false,
+        }
+    }
+
+    fn cap(n: u32) -> MaxNew {
+        MaxNew {
+            value: Some(n),
+            source: MaxNewSource::Flag,
+        }
+    }
+
+    fn admitted_purls(plan: &RolloutPlan) -> Vec<&str> {
+        plan.admitted.iter().map(|c| c.purl.as_str()).collect()
+    }
+
+    fn deferred_purls(plan: &RolloutPlan) -> Vec<(&str, u32)> {
+        plan.deferred
+            .iter()
+            .map(|(c, r)| (c.purl.as_str(), *r))
+            .collect()
+    }
+
+    fn nine() -> Vec<Candidate> {
+        vec![
+            row("", "pkg:npm/a@1", "u1", 3, 1),
+            row("", "pkg:npm/b@1", "u2", 0, 1),
+            row("", "pkg:npm/c@1", "u3", 1, 1),
+            row("", "pkg:npm/d@1", "u4", 2, 1),
+            row("", "pkg:npm/e@1", "u5", 0, 2),
+            row("", "pkg:npm/f@1", "u6", 4, 1),
+            row("", "pkg:npm/g@1", "u7", 1, 3),
+            row("", "pkg:npm/h@1", "u8", 2, 1),
+            row("", "pkg:npm/i@1", "u9", 3, 1),
+        ]
+    }
+
+    fn permutations<T: Clone>(items: &[T]) -> Vec<Vec<T>> {
+        if items.len() <= 1 {
+            return vec![items.to_vec()];
+        }
+        let mut out = Vec::new();
+        for i in 0..items.len() {
+            let mut rest = items.to_vec();
+            let head = rest.remove(i);
+            for mut tail in permutations(&rest) {
+                tail.insert(0, head.clone());
+                out.push(tail);
+            }
+        }
+        out
+    }
+
+    #[test]
+    fn rollout_cmp_is_a_total_order_every_permutation_sorts_the_same() {
+        let mut in_flight = row("", "pkg:pypi/z@1", "u9", 4, 0);
+        in_flight.in_flight = true;
+        let items = vec![
+            row("", "pkg:npm/b@1", "u2", 1, 1),
+            row("", "pkg:npm/a@1", "u3", 1, 1),
+            row("", "pkg:cargo/a@1", "u1", 1, 1),
+            row("", "pkg:npm/m@1", "u0", 1, 2),
+            row("", "pkg:npm/a@1", "u1", 1, 1),
+            in_flight,
+        ];
+        let expected: Vec<(String, String)> = vec![
+            ("pkg:pypi/z@1".into(), "u9".into()),
+            ("pkg:npm/m@1".into(), "u0".into()),
+            ("pkg:cargo/a@1".into(), "u1".into()),
+            ("pkg:npm/a@1".into(), "u1".into()),
+            ("pkg:npm/a@1".into(), "u3".into()),
+            ("pkg:npm/b@1".into(), "u2".into()),
+        ];
+        for mut perm in permutations(&items) {
+            perm.sort_by(rollout_cmp);
+            let got: Vec<(String, String)> = perm
+                .iter()
+                .map(|c| (c.purl.clone(), c.uuid.clone()))
+                .collect();
+            assert_eq!(got, expected);
+        }
+    }
+
+    #[test]
+    fn severity_then_advisory_count_decide_before_names() {
+        let mut rows = [
+            row("", "pkg:npm/a@1", "u", 2, 5),
+            row("", "pkg:npm/b@1", "u", 0, 1),
+            row("", "pkg:npm/c@1", "u", 0, 3),
+            row("", "pkg:npm/d@1", "u", 4, 9),
+        ];
+        rows.sort_by(rollout_cmp);
+        let order: Vec<&str> = rows.iter().map(|c| c.purl.as_str()).collect();
+        assert_eq!(
+            order,
+            ["pkg:npm/c@1", "pkg:npm/b@1", "pkg:npm/a@1", "pkg:npm/d@1"]
+        );
+    }
+
+    #[test]
+    fn a_cap_admits_the_most_critical_and_defers_the_rest_with_ranks() {
+        let plan = plan_rollout(nine(), &cap(3), false, &BTreeSet::new());
+        assert_eq!(
+            admitted_purls(&plan),
+            ["pkg:npm/b@1", "pkg:npm/e@1", "pkg:npm/g@1"]
+        );
+        assert_eq!(
+            deferred_purls(&plan),
+            [
+                ("pkg:npm/c@1", 4),
+                ("pkg:npm/d@1", 5),
+                ("pkg:npm/h@1", 6),
+                ("pkg:npm/a@1", 7),
+                ("pkg:npm/i@1", 8),
+                ("pkg:npm/f@1", 9),
+            ]
+        );
+        assert_eq!(
+            plan.counts,
+            RolloutCounts {
+                new: 3,
+                deferred: 6,
+                upgrade: 0,
+                already: 0
+            }
+        );
+        assert_eq!(plan.remaining, Some(0));
+    }
+
+    #[test]
+    fn three_runs_roll_nine_packages_forward_and_a_fourth_changes_nothing() {
+        let mut state = nine();
+        let mut landed: Vec<Vec<String>> = Vec::new();
+        for _ in 0..4 {
+            let plan = plan_rollout(state.clone(), &cap(3), false, &BTreeSet::new());
+            let new: Vec<String> = plan
+                .admitted
+                .iter()
+                .filter(|c| c.recorded.is_new())
+                .map(|c| c.purl.clone())
+                .collect();
+            for c in &mut state {
+                if new.contains(&c.purl) {
+                    c.recorded = Recorded::Same;
+                }
+            }
+            landed.push(new);
+        }
+        assert_eq!(landed[0], ["pkg:npm/b@1", "pkg:npm/e@1", "pkg:npm/g@1"]);
+        assert_eq!(landed[1], ["pkg:npm/c@1", "pkg:npm/d@1", "pkg:npm/h@1"]);
+        assert_eq!(landed[2], ["pkg:npm/a@1", "pkg:npm/f@1", "pkg:npm/i@1"]);
+        assert!(landed[3].is_empty());
+    }
+
+    #[test]
+    fn zero_admits_no_new_rows_but_keeps_upgrades_and_already() {
+        let mut rows = nine();
+        rows[0].recorded = Recorded::Superseded {
+            old_uuid: "old".into(),
+        };
+        rows[1].recorded = Recorded::Same;
+        rows[2].recorded = Recorded::Kept { uuid: "k".into() };
+        let plan = plan_rollout(rows, &cap(0), false, &BTreeSet::new());
+        assert_eq!(
+            admitted_purls(&plan),
+            ["pkg:npm/a@1", "pkg:npm/b@1", "pkg:npm/c@1"]
+        );
+        assert_eq!(plan.counts.new, 0);
+        assert_eq!(plan.counts.deferred, 6);
+        assert_eq!(plan.counts.upgrade, 1);
+        assert_eq!(plan.counts.already, 2);
+        assert_eq!(plan.deferred[0].1, 1, "ranks start at 1 among NEW rows");
+    }
+
+    #[test]
+    fn a_cap_of_one_admits_exactly_the_top_package() {
+        let plan = plan_rollout(nine(), &cap(1), false, &BTreeSet::new());
+        assert_eq!(admitted_purls(&plan), ["pkg:npm/e@1"]);
+        assert_eq!(plan.counts.deferred, 8);
+    }
+
+    #[test]
+    fn unlimited_and_a_cap_above_the_supply_admit_everything() {
+        for max in [MaxNew::UNLIMITED, cap(50)] {
+            let plan = plan_rollout(nine(), &max, false, &BTreeSet::new());
+            assert_eq!(plan.admitted.len(), 9);
+            assert!(plan.deferred.is_empty());
+            assert_eq!(plan.counts.new, 9);
+        }
+        let plan = plan_rollout(nine(), &cap(50), false, &BTreeSet::new());
+        assert_eq!(plan.remaining, Some(41));
+        let plan = plan_rollout(nine(), &MaxNew::UNLIMITED, false, &BTreeSet::new());
+        assert_eq!(plan.remaining, None);
+    }
+
+    #[test]
+    fn ineligible_rows_hold_no_slot_and_are_not_reported_as_deferred() {
+        let mut rows = nine();
+        // The top two by rank cannot land.
+        rows[4].eligible = false; // e
+        rows[1].eligible = false; // b
+        let plan = plan_rollout(rows, &cap(2), false, &BTreeSet::new());
+        assert_eq!(admitted_purls(&plan), ["pkg:npm/c@1", "pkg:npm/g@1"]);
+        assert!(plan
+            .deferred
+            .iter()
+            .all(|(c, _)| c.purl != "pkg:npm/b@1" && c.purl != "pkg:npm/e@1"));
+        assert_eq!(plan.counts.deferred, 5);
+        assert_eq!(plan.deferred[0].1, 3);
+    }
+
+    #[test]
+    fn incomplete_lookups_admit_nothing_new_under_a_cap() {
+        let mut rows = nine();
+        rows[0].recorded = Recorded::Superseded {
+            old_uuid: "old".into(),
+        };
+        let plan = plan_rollout(rows.clone(), &cap(3), true, &BTreeSet::new());
+        assert_eq!(admitted_purls(&plan), ["pkg:npm/a@1"]);
+        assert_eq!(plan.counts.deferred, 8);
+        assert_eq!(plan.remaining, Some(3), "nothing was spent");
+        // Without a cap there is no slot to steal.
+        let plan = plan_rollout(rows, &MaxNew::UNLIMITED, true, &BTreeSet::new());
+        assert_eq!(plan.admitted.len(), 9);
+    }
+
+    #[test]
+    fn one_package_across_roots_costs_one_slot() {
+        let rows = vec![
+            row("services/api", "pkg:npm/qs@6.5.2", "u1", 1, 1),
+            row("services/web", "pkg:npm/qs@6.5.2", "u1", 1, 1),
+            row("", "pkg:npm/minimist@1.2.5", "u2", 0, 1),
+            row("", "pkg:npm/zzz@1.0.0", "u3", 3, 1),
+        ];
+        let plan = plan_rollout(rows, &cap(2), false, &BTreeSet::new());
+        assert_eq!(
+            admitted_purls(&plan),
+            [
+                "pkg:npm/qs@6.5.2",
+                "pkg:npm/qs@6.5.2",
+                "pkg:npm/minimist@1.2.5"
+            ]
+        );
+        assert_eq!(plan.counts.new, 2);
+        assert_eq!(deferred_purls(&plan), [("pkg:npm/zzz@1.0.0", 3)]);
+    }
+
+    #[test]
+    fn qualifier_twins_share_a_base_purl_and_a_rank() {
+        assert_eq!(
+            canonical_base_purl("pkg:pypi/foo@1.0?artifact_id=abc"),
+            canonical_base_purl("pkg:pypi/foo@1.0?artifact_id=def")
+        );
+        assert_eq!(
+            canonical_base_purl("pkg:npm/%40scope/x@1.0.0"),
+            "pkg:npm/@scope/x@1.0.0"
+        );
+        assert_eq!(
+            canonical_base_purl("pkg:nuget/Newtonsoft.Json@13.0.3"),
+            canonical_base_purl("pkg:nuget/newtonsoft.json@13.0.3")
+        );
+        assert_eq!(
+            canonical_base_purl("pkg:pypi/Foo_Bar@1.0"),
+            canonical_base_purl("pkg:pypi/foo-bar@1.0")
+        );
+        let rows = vec![
+            row("", "pkg:pypi/foo@1.0?artifact_id=whl", "u2", 1, 1),
+            row("", "pkg:pypi/foo@1.0?artifact_id=sdist", "u1", 1, 1),
+            row("", "pkg:pypi/bar@1.0", "u3", 0, 1),
+        ];
+        let plan = plan_rollout(rows, &cap(1), false, &BTreeSet::new());
+        assert_eq!(admitted_purls(&plan), ["pkg:pypi/bar@1.0"]);
+        assert_eq!(
+            deferred_purls(&plan),
+            [
+                ("pkg:pypi/foo@1.0?artifact_id=sdist", 2),
+                ("pkg:pypi/foo@1.0?artifact_id=whl", 2)
+            ]
+        );
+        assert_eq!(plan.counts.deferred, 1);
+    }
+
+    // The ecosystem key agrees with the purl type prefix of the base purl
+    // key below it; the test pins the combined order.
+    #[test]
+    fn ties_across_ecosystems_break_by_ecosystem_then_name() {
+        let rows = vec![
+            row("", "pkg:npm/x@1", "u1", 1, 1),
+            row("", "pkg:cargo/x@1", "u2", 1, 1),
+            row("", "pkg:pypi/x@1", "u3", 1, 1),
+            row("", "pkg:gem/x@1", "u4", 1, 1),
+        ];
+        let plan = plan_rollout(rows, &cap(2), false, &BTreeSet::new());
+        assert_eq!(admitted_purls(&plan), ["pkg:cargo/x@1", "pkg:gem/x@1"]);
+        assert_eq!(
+            deferred_purls(&plan),
+            [("pkg:npm/x@1", 3), ("pkg:pypi/x@1", 4)]
+        );
+    }
+
+    #[test]
+    fn in_flight_rows_go_first_whatever_their_severity() {
+        let mut rows = nine();
+        rows[5].in_flight = true; // f, unknown severity
+        let plan = plan_rollout(rows, &cap(1), false, &BTreeSet::new());
+        assert_eq!(admitted_purls(&plan), ["pkg:npm/f@1"]);
+    }
+
+    #[test]
+    fn remaining_budget_carries_across_directories() {
+        let first = vec![
+            row("a", "pkg:npm/x@1", "u1", 0, 1),
+            row("a", "pkg:npm/y@1", "u2", 1, 1),
+        ];
+        let plan_a = plan_rollout(first, &cap(3), false, &BTreeSet::new());
+        assert_eq!(plan_a.remaining, Some(1));
+        let carried = MaxNew {
+            value: plan_a.remaining,
+            source: MaxNewSource::Flag,
+        };
+        let second = vec![
+            row("b", "pkg:npm/x@1", "u1", 0, 1),
+            row("b", "pkg:npm/z@1", "u3", 2, 1),
+            row("b", "pkg:npm/w@1", "u4", 3, 1),
+        ];
+        let plan_b = plan_rollout(second, &carried, false, &plan_a.admitted_base_purls);
+        assert_eq!(admitted_purls(&plan_b), ["pkg:npm/x@1", "pkg:npm/z@1"]);
+        assert_eq!(plan_b.remaining, Some(0));
+        assert_eq!(deferred_purls(&plan_b), [("pkg:npm/w@1", 3)]);
+        assert_eq!(plan_b.admitted_base_purls.len(), 3);
+    }
+
+    #[test]
+    fn an_empty_plan_is_empty() {
+        let plan = plan_rollout(Vec::new(), &cap(3), true, &BTreeSet::new());
+        assert!(plan.admitted.is_empty() && plan.deferred.is_empty());
+        assert_eq!(plan.counts, RolloutCounts::default());
+        assert_eq!(plan.remaining, Some(3));
+    }
+
+    #[test]
+    fn resolve_max_new_precedence_table() {
+        use MaxNewSource::*;
+        type Case = (
+            Option<Option<u32>>,
+            Option<Option<u32>>,
+            Option<u32>,
+            Option<u32>,
+            Option<u32>,
+            MaxNewSource,
+        );
+        let cases: [Case; 10] = [
+            (None, None, None, None, None, Default),
+            (None, None, Some(5), None, Some(5), File),
+            (None, Some(Some(2)), Some(5), None, Some(2), Env),
+            (Some(Some(1)), Some(Some(2)), Some(5), None, Some(1), Flag),
+            (Some(None), None, Some(5), None, None, Flag),
+            (None, Some(None), Some(5), None, None, Env),
+            (Some(None), None, None, Some(4), Some(4), Cap),
+            (None, None, None, Some(4), Some(4), Cap),
+            (Some(Some(9)), None, None, Some(4), Some(4), Cap),
+            (Some(Some(2)), None, None, Some(4), Some(2), Flag),
+        ];
+        for (flag, env, file, cap, value, source) in cases {
+            assert_eq!(
+                resolve_max_new(flag, env, file, cap),
+                MaxNew { value, source },
+                "flag={flag:?} env={env:?} file={file:?} cap={cap:?}"
+            );
+        }
+        assert_eq!(resolve_max_new(None, None, Some(4), Some(4)).source, File);
+    }
+
+    #[test]
+    fn severity_labels_follow_the_ladder() {
+        assert_eq!(
+            (0..=5).map(severity_label).collect::<Vec<_>>(),
+            ["critical", "high", "medium", "low", "unknown", "unknown"]
+        );
+    }
+}
diff --git a/crates/socket-patch-core/src/rollout/stage.rs b/crates/socket-patch-core/src/rollout/stage.rs
new file mode 100644
index 00000000..eb6c08df
--- /dev/null
+++ b/crates/socket-patch-core/src/rollout/stage.rs
@@ -0,0 +1,505 @@
+//! The per-run rollout stage (`docs/design/staged-rollout.md` §5, §9.2)
+//! the disk scan and the in-memory engine share: classify the selected
+//! offers against the recorded state, spend the budget on NEW packages
+//! most critical first once each mode's eligibility checks ran, and
+//! render the `rollout` block.
+
+use std::collections::{BTreeMap, BTreeSet, HashMap, HashSet};
+use std::path::{Path, PathBuf};
+use std::sync::{Arc, Mutex};
+
+use crate::api::ranking::{cmp_search_results, max_severity_order, search_result_supersedes};
+use crate::api::types::PatchSearchResult;
+use crate::crawlers::Ecosystem;
+use crate::manifest::schema::PatchManifest;
+pub use crate::policy::Offers;
+
+use super::{
+    canonical_base_purl, plan_rollout, severity_label, Candidate, MaxNew, MaxNewSource, Recorded,
+    RolloutPlan,
+};
+
+/// The env binding of `scan --max-new-patches`.
+pub const MAX_NEW_PATCHES_ENV: &str = "SOCKET_MAX_NEW_PATCHES";
+
+/// What one invocation's project directories share: the cap as configured,
+/// the budget left, and the base purls already admitted (admitted free in
+/// later directories).
+#[derive(Debug)]
+pub struct Carry {
+    pub configured: MaxNew,
+    pub remaining: Option<u32>,
+    pub admitted: BTreeSet<String>,
+    /// The directory the project paths are relative to.
+    pub root: PathBuf,
+}
+
+#[derive(Debug, Clone)]
+pub struct RolloutCarry(pub Arc<Mutex<Carry>>);
+
+impl RolloutCarry {
+    pub fn new(configured: MaxNew, root: PathBuf) -> Self {
+        RolloutCarry(Arc::new(Mutex::new(Carry {
+            configured,
+            remaining: configured.value,
+            admitted: BTreeSet::new(),
+            root,
+        })))
+    }
+
+    pub fn lock(&self) -> std::sync::MutexGuard<'_, Carry> {
+        self.0.lock().unwrap_or_else(|e| e.into_inner())
+    }
+}
+
+/// Warning: a lookup failed for a package that could have been NEW, so a
+/// capped run admitted no NEW patch.
+pub const ROLLOUT_INCOMPLETE_LOOKUP: &str = "rollout_incomplete_lookup";
+/// Warning: the reference lookup failed, but only for rows that were
+/// deferred anyway, so the run went on.
+pub const ROLLOUT_REFERENCE_FAILED: &str = "rollout_reference_failed";
+/// `skipped[].reason` of a deferred row.
+pub const ROLLOUT_DEFERRED: &str = "rollout_deferred";
+
+/// Group the by-package records per purl into the step 5 → 7 seam (work
+/// item A's [`Offers`]), dropping paid patches the org cannot download, and
+/// take the top-ranked offer per purl.
+pub fn offers_from_results(results: &[PatchSearchResult], can_access_paid: bool) -> Offers {
+    let mut unfiltered: BTreeMap<String, Vec<PatchSearchResult>> = BTreeMap::new();
+    for p in results {
+        if can_access_paid || p.tier == "free" {
+            unfiltered
+                .entry(p.purl.clone())
+                .or_default()
+                .push(p.clone());
+        }
+    }
+    for group in unfiltered.values_mut() {
+        group.sort_by(cmp_search_results);
+        group.dedup_by(|a, b| a.uuid == b.uuid);
+    }
+    let selected = unfiltered
+        .iter()
+        .filter_map(|(purl, group)| group.first().map(|p| (purl.clone(), p.clone())))
+        .collect();
+    Offers {
+        unfiltered,
+        selected,
+    }
+}
+
+/// One classified row plus the offer its writer receives: the selection,
+/// or the recorded patch when the selection does not supersede it.
+#[derive(Debug, Clone)]
+pub struct Row {
+    pub candidate: Candidate,
+    pub writer: PatchSearchResult,
+}
+
+/// The recorded view (§5.1), indexed once so every row is an O(1) lookup:
+/// the merged manifest (manifest > hosted pins > vendor ledger) plus every
+/// hosted pin (the merge keeps one per key; a project can pin each
+/// qualifier twin of a package to its own patch).
+#[derive(Debug, Default)]
+pub struct RecordedIndex {
+    exact: HashMap<String, Vec<String>>,
+    /// Discovery's folded base purl plus the raw qualifier suffix.
+    qualified: HashMap<String, Vec<String>>,
+    by_base: HashMap<String, Vec<String>>,
+}
+
+/// The recorded view one project root classifies against: the merged
+/// manifest (`updates[]`'s batch fallback reads it) and its index.
+pub struct RecordedState<'a> {
+    pub manifest: Option<&'a PatchManifest>,
+    pub index: RecordedIndex,
+}
+
+/// `purl`'s folded base plus its qualifiers: equal for two spellings of the
+/// same qualified purl (percent-encoding, case where it does not matter).
+pub fn qualified_key(purl: &str) -> String {
+    let suffix = purl.find(['?', '#']).map_or("", |i| &purl[i..]);
+    format!("{}{suffix}", canonical_base_purl(purl))
+}
+
+impl RecordedIndex {
+    pub fn new(manifest: Option<&PatchManifest>, pins: &[(String, String)]) -> Self {
+        let mut index = RecordedIndex::default();
+        let entries = manifest
+            .into_iter()
+            .flat_map(|m| m.patches.iter().map(|(k, r)| (k.as_str(), r.uuid.as_str())))
+            .chain(pins.iter().map(|(p, u)| (p.as_str(), u.as_str())));
+        for (key, uuid) in entries {
+            index
+                .exact
+                .entry(key.to_string())
+                .or_default()
+                .push(uuid.to_string());
+            index
+                .qualified
+                .entry(qualified_key(key))
+                .or_default()
+                .push(uuid.to_string());
+            index
+                .by_base
+                .entry(canonical_base_purl(key))
+                .or_default()
+                .push(uuid.to_string());
+        }
+        for list in index
+            .exact
+            .values_mut()
+            .chain(index.qualified.values_mut())
+            .chain(index.by_base.values_mut())
+        {
+            list.sort();
+            list.dedup();
+        }
+        index
+    }
+
+    /// The uuids recorded for `purl`, sorted: the exact key, else the same
+    /// purl in another spelling, else any qualifier twin.
+    pub fn uuids(&self, purl: &str) -> &[String] {
+        self.exact
+            .get(purl)
+            .or_else(|| self.qualified.get(&qualified_key(purl)))
+            .or_else(|| self.by_base.get(&canonical_base_purl(purl)))
+            .map_or(&[], Vec::as_slice)
+    }
+
+    /// Whether any patch is recorded for `purl`'s base purl.
+    pub fn records_package(&self, purl: &str) -> bool {
+        self.by_base.contains_key(&canonical_base_purl(purl))
+    }
+}
+
+/// Classify every selected purl of one project root (§5.1). `recorded` is
+/// the merged view (manifest > hosted pins > vendor ledger).
+pub fn classify(offers: &Offers, recorded: &RecordedIndex, project: &str) -> Vec<Row> {
+    offers
+        .selected
+        .iter()
+        .map(|(purl, selected)| {
+            let uuids = recorded.uuids(purl);
+            let offered = offers
+                .unfiltered
+                .get(purl)
+                .map(Vec::as_slice)
+                .unwrap_or(&[]);
+            let (class, writer) = if uuids.is_empty() {
+                (Recorded::None, selected.clone())
+            } else if uuids.contains(&selected.uuid) {
+                (Recorded::Same, selected.clone())
+            } else {
+                let old = uuids[0].clone();
+                match offered.iter().find(|p| p.uuid == old) {
+                    Some(prior) if !search_result_supersedes(selected, prior) => {
+                        (Recorded::Kept { uuid: old }, prior.clone())
+                    }
+                    _ => (Recorded::Superseded { old_uuid: old }, selected.clone()),
+                }
+            };
+            Row {
+                candidate: Candidate {
+                    project: project.to_string(),
+                    purl: purl.clone(),
+                    base_purl: canonical_base_purl(purl),
+                    uuid: selected.uuid.clone(),
+                    ecosystem: Ecosystem::from_purl(purl).map_or("", |e| e.cli_name()),
+                    severity_order: max_severity_order(
+                        selected
+                            .vulnerabilities
+                            .values()
+                            .map(|v| v.severity.as_str()),
+                    ),
+                    advisory_count: selected.vulnerabilities.len(),
+                    recorded: class,
+                    eligible: true,
+                    in_flight: false,
+                },
+                writer,
+            }
+        })
+        .collect()
+}
+
+/// Whether a failed detail lookup hit a package that could have been NEW
+/// (nothing recorded for it), or a whole batch failed (its packages are
+/// unknown).
+pub fn lookup_incomplete(
+    recorded: &RecordedIndex,
+    failed_details: &[String],
+    batch_failed: bool,
+) -> bool {
+    batch_failed
+        || failed_details
+            .iter()
+            .any(|purl| !recorded.records_package(purl))
+}
+
+/// Every canonical-shaped uuid (`8-4-4-4-12` hex) `text` mentions,
+/// lowercased, in one linear pass.
+pub fn mentioned_uuids(text: &str, out: &mut HashSet<String>) {
+    let bytes = text.as_bytes();
+    if bytes.len() < 36 {
+        return;
+    }
+    let mut i = 0;
+    while i + 36 <= bytes.len() {
+        let window = &bytes[i..i + 36];
+        let shaped = window.iter().enumerate().all(|(k, b)| match k {
+            8 | 13 | 18 | 23 => *b == b'-',
+            _ => b.is_ascii_hexdigit(),
+        });
+        if shaped {
+            out.insert(String::from_utf8_lossy(window).to_ascii_lowercase());
+            i += 36;
+        } else {
+            i += 1;
+        }
+    }
+}
+
+/// Mark NEW rows whose selected uuid the project's lockfile texts already
+/// mention as ALREADY. A hosted pin on a patch server discovery does not
+/// recognize (an origin missing from `--patch-server-url`) would otherwise
+/// read as NEW on every run and hold its slot forever; patch uuids are
+/// unique, so a mention is a pin.
+pub fn mark_pinned(rows: &mut [Row], texts: &[&str]) {
+    if !rows.iter().any(|r| r.candidate.recorded.is_new()) {
+        return;
+    }
+    let mut mentioned = HashSet::new();
+    for text in texts {
+        mentioned_uuids(text, &mut mentioned);
+    }
+    for row in rows.iter_mut().filter(|r| r.candidate.recorded.is_new()) {
+        if mentioned.contains(&row.candidate.uuid.to_ascii_lowercase()) {
+            row.candidate.recorded = Recorded::Same;
+        }
+    }
+}
+
+/// One directory's budget and the outcome of its plan.
+#[derive(Debug, Clone)]
+pub struct Stage {
+    /// The cap as configured (reported).
+    pub configured: MaxNew,
+    /// The budget this directory may spend (the carried remainder).
+    pub budget: MaxNew,
+    pub already_admitted: BTreeSet<String>,
+    /// A lookup failed for a package that could have been NEW.
+    pub incomplete: bool,
+    pub project: String,
+    pub carry: Option<RolloutCarry>,
+    /// Set by [`Self::plan`].
+    pub plan: Option<RolloutPlan>,
+    /// The reference lookup failed and only deferred rows were affected.
+    pub reference_failed: Option<String>,
+}
+
+impl Stage {
+    /// The stage for one scan of `cwd`: a fresh budget, or the invocation's
+    /// shared one.
+    pub fn new(configured: MaxNew, carry: Option<RolloutCarry>, cwd: &Path) -> Self {
+        let (budget, already_admitted, project) = match &carry {
+            Some(c) => {
+                let c = c.lock();
+                (
+                    MaxNew {
+                        value: c.remaining,
+                        source: c.configured.source,
+                    },
+                    c.admitted.clone(),
+                    crate::policy::repo_relative(
+                        &c.root,
+                        &std::fs::canonicalize(cwd).unwrap_or_else(|_| cwd.to_path_buf()),
+                    ),
+                )
+            }
+            None => (configured, BTreeSet::new(), String::new()),
+        };
+        Stage {
+            configured,
+            budget,
+            already_admitted,
+            incomplete: false,
+            project,
+            carry,
+            plan: None,
+            reference_failed: None,
+        }
+    }
+
+    pub fn capped(&self) -> bool {
+        self.configured.value.is_some()
+    }
+
+    /// Whether any NEW row can be admitted at all.
+    pub fn may_admit_new(&self) -> bool {
+        !(self.capped() && self.incomplete) && self.budget.value != Some(0)
+    }
+
+    /// Plan `rows` with `eligible` deciding each NEW row, record the plan
+    /// and hand the remaining budget to the next directory.
+    pub fn plan(&mut self, rows: &[Row], eligible: impl Fn(&Row) -> bool) -> &RolloutPlan {
+        let candidates: Vec<Candidate> = rows
+            .iter()
+            .map(|row| Candidate {
+                eligible: !row.candidate.recorded.is_new() || eligible(row),
+                ..row.candidate.clone()
+            })
+            .collect();
+        let plan = plan_rollout(
+            candidates,
+            &self.budget,
+            self.incomplete,
+            &self.already_admitted,
+        );
+        if let Some(carry) = &self.carry {
+            let mut c = carry.lock();
+            c.remaining = plan.remaining;
+            c.admitted = plan.admitted_base_purls.clone();
+        }
+        self.plan.insert(plan)
+    }
+
+    /// `(purl, uuid)` of every deferred row.
+    pub fn deferred_keys(&self) -> HashSet<(String, String)> {
+        self.plan
+            .iter()
+            .flat_map(|p| &p.deferred)
+            .map(|(c, _)| (c.purl.clone(), c.uuid.clone()))
+            .collect()
+    }
+
+    /// Run-level warnings the plan earned.
+    pub fn warnings(&self) -> Vec<(&'static str, String)> {
+        let mut out = Vec::new();
+        if let Some(detail) = &self.reference_failed {
+            out.push((
+                ROLLOUT_REFERENCE_FAILED,
+                format!(
+                    "the hosted reference lookup failed ({detail}); only new patches were \
+                     affected and they were deferred to the next scan"
+                ),
+            ));
+        }
+        let deferred = self.plan.as_ref().map_or(0, |p| p.counts.deferred);
+        if self.capped() && self.incomplete && deferred > 0 {
+            out.push((
+                ROLLOUT_INCOMPLETE_LOOKUP,
+                format!(
+                    "a patch lookup failed for a package that could get its first patch, so \
+                     no new patches were added this run ({} deferred) and none can take the \
+                     missing package's place; re-run once the API answers",
+                    if deferred == 1 { "1 package".to_string() } else { format!("{deferred} packages") }
+                ),
+            ));
+        }
+        out
+    }
+
+    /// The top-level `rollout` block (§5.5).
+    pub fn json(&self) -> serde_json::Value {
+        rollout_json(&self.configured, self.plan.as_ref())
+    }
+
+    /// `redirect.skipped[]` entries mirroring the deferred rows.
+    pub fn deferred_skips(&self) -> Vec<crate::hosted::engine::SkippedPatch> {
+        self.plan
+            .iter()
+            .flat_map(|p| &p.deferred)
+            .map(|(c, rank)| crate::hosted::engine::SkippedPatch {
+                purl: c.purl.clone(),
+                uuid: c.uuid.clone(),
+                reason: ROLLOUT_DEFERRED.to_string(),
+                detail: Some(format!("rank {rank} in the rollout queue; a later scan adds it")),
+            })
+            .collect()
+    }
+}
+
+pub fn source_label(max: &MaxNew) -> &'static str {
+    match max.source {
+        MaxNewSource::Flag => "--max-new-patches",
+        MaxNewSource::Env => MAX_NEW_PATCHES_ENV,
+        MaxNewSource::File => "socket.yml",
+        MaxNewSource::Cap => "the server cap",
+        MaxNewSource::Default => "default",
+    }
+}
+
+/// One deferred package, grouped over its rows.
+pub struct DeferredGroup {
+    pub base_purl: String,
+    pub uuids: BTreeSet<String>,
+    pub severity_order: u8,
+    pub advisory_count: usize,
+    pub projects: BTreeSet<String>,
+    pub rank: u32,
+}
+
+pub fn deferred_groups(plan: &RolloutPlan) -> Vec<DeferredGroup> {
+    let mut groups: Vec<DeferredGroup> = Vec::new();
+    let mut at: HashMap<&str, usize> = HashMap::new();
+    for (c, rank) in &plan.deferred {
+        match at.get(c.base_purl.as_str()).map(|&i| &mut groups[i]) {
+            Some(g) => {
+                g.uuids.insert(c.uuid.clone());
+                g.projects.insert(c.project.clone());
+                g.severity_order = g.severity_order.min(c.severity_order);
+                g.advisory_count = g.advisory_count.max(c.advisory_count);
+            }
+            None => {
+                at.insert(c.base_purl.as_str(), groups.len());
+                groups.push(DeferredGroup {
+                    base_purl: c.base_purl.clone(),
+                    uuids: BTreeSet::from([c.uuid.clone()]),
+                    severity_order: c.severity_order,
+                    advisory_count: c.advisory_count,
+                    projects: BTreeSet::from([c.project.clone()]),
+                    rank: *rank,
+                })
+            }
+        }
+    }
+    groups.sort_by_key(|g| g.rank);
+    groups
+}
+
+/// The `rollout` block. `plan: None` (a run that planned nothing) reports
+/// zero counts.
+pub fn rollout_json(configured: &MaxNew, plan: Option<&RolloutPlan>) -> serde_json::Value {
+    let counts = plan.map(|p| p.counts).unwrap_or_default();
+    let deferred: Vec<serde_json::Value> = plan
+        .map(deferred_groups)
+        .unwrap_or_default()
+        .into_iter()
+        .map(|g| {
+            serde_json::json!({
+                "purl": g.base_purl,
+                "uuids": g.uuids,
+                "severity": severity_label(g.severity_order),
+                "advisoryCount": g.advisory_count,
+                "projects": g.projects,
+                "rank": g.rank,
+            })
+        })
+        .collect();
+    serde_json::json!({
+        "maxNewPatches": {
+            "value": configured.value,
+            "source": configured.source.as_str(),
+        },
+        "counts": {
+            "new": counts.new,
+            "deferred": counts.deferred,
+            "upgrade": counts.upgrade,
+            "already": counts.already,
+        },
+        "deferred": deferred,
+    })
+}
+
diff --git a/crates/socket-patch-core/src/vendor/lock_inventory/view.rs b/crates/socket-patch-core/src/vendor/lock_inventory/view.rs
index 02e55b99..acd48d72 100644
--- a/crates/socket-patch-core/src/vendor/lock_inventory/view.rs
+++ b/crates/socket-patch-core/src/vendor/lock_inventory/view.rs
@@ -84,7 +84,6 @@ impl MemoryProject {
         matches!(self.entries.get(rel), Some(MemoryEntry::Symlink))
     }
 
-    #[cfg(test)]
     pub(crate) fn entries(&self) -> impl Iterator<Item = (&str, &MemoryEntry)> {
         self.entries.iter().map(|(k, v)| (k.as_str(), v))
     }
diff --git a/crates/socket-patch-node/npm/index.d.ts b/crates/socket-patch-node/npm/index.d.ts
index c70f28fa..a6cadfba 100644
--- a/crates/socket-patch-node/npm/index.d.ts
+++ b/crates/socket-patch-node/npm/index.d.ts
@@ -54,6 +54,9 @@ export interface HostedScanSessionOptions {
   providerConcurrency?: number     // default 8
   requestTimeoutMs?: number        // per provider call, default 60000
   limits?: HostedScanLimits
+  maxNewPatches?: number | 'none'  // run-wide cap on NEW patches, most severe first; 0 = upgrades only; absent/'none' = unlimited
+  maxNewPatchesCap?: number        // server ceiling: tightens maxNewPatches (including 'none'), never loosens it
+  inFlightPatches?: string[]       // base purls already in the open rollout PR: ranked first
   noSocketYml?: boolean            // ignore the repo's socket.yml (built-in test/fixture ignores still apply); default false
   minSeverity?: 'critical' | 'high' | 'medium' | 'moderate' | 'low' | 'none'   // beats socket.yml patches.minSeverity
   policyPaths?: string[]           // selectHostedScanPaths' policyPaths; each must be streamed with content or the session returns policyError
@@ -73,15 +76,23 @@ export interface ProjectResult {
   redirect: Record<string, unknown>                   // same shape as CLI `--json` `redirect` block
   summary: { scannedPackages: number; packagesWithPatches: number; totalPatches: number; freePatches: number; paidPatches: number; canAccessPaidPatches: boolean }
   redirected: { purl: string; uuid: string }[]
-  skipped: { purl: string; uuid: string; reason: string; detail?: string }[]   // reasons include the policy_* codes
+  skipped: { purl: string; uuid: string; reason: string; detail?: string }[]   // reasons include the policy_* codes; deferred rows appear as `rollout_deferred`
+  deferred: DeferredPatch[]                           // NEW patches over the maxNewPatches budget, rank order
   error?: { code: string; message: string }           // project-level failure (e.g. corrupt_ledger, patch_lookup_failed)
 }
+export interface DeferredPatch { purl: string; uuid: string; severity: 'critical' | 'high' | 'medium' | 'low' | 'unknown'; rank: number }
+export interface RolloutBlock {                       // same shape as CLI `scan --json` `rollout`
+  maxNewPatches: { value: number | null; source: 'flag' | 'env' | 'file' | 'default' | 'cap' }
+  counts: { new: number; deferred: number; upgrade: number; already: number }
+  deferred: { purl: string; uuids: string[]; severity: string; advisoryCount: number; projects: string[]; rank: number }[]
+}
 export interface HostedScanResult {
   projects: ProjectResult[]
   changedFiles: { path: string; content: string }[]            // repo-relative, sorted, only byte-changed, includes ledgers (wet runs only)
   changedBinaryFiles: { path: string; content: Buffer }[]
   deletedFiles: string[]
   warnings: EngineWarning[]
+  rollout?: RolloutBlock                              // session-level: one budget across every project; absent only with policyError
   stats: { projects: number; filesInput: number; bytesInput: number; packagesScanned: number; packagesWithPatches: number; patchesSelected: number; patchesRedirected: number; filesChanged: number; providerCalls: Record<string, number>; phaseMs: Record<string, number> }
   engineVersion: string
   policy?: PolicyBlock                                         // absent only with policyError
diff --git a/crates/socket-patch-node/npm/test/smoke.mjs b/crates/socket-patch-node/npm/test/smoke.mjs
index 826932ca..0009f955 100644
--- a/crates/socket-patch-node/npm/test/smoke.mjs
+++ b/crates/socket-patch-node/npm/test/smoke.mjs
@@ -234,6 +234,24 @@ test('dry run previews the lockfile without patch fetches', async () => {
   assert.equal(calls.fetchPatch, 0)
 })
 
+test('maxNewPatches defers new patches and reports the rollout block', async () => {
+  const { provider } = fakeProvider()
+  const selection = addon.selectHostedScanPaths(tree)
+  const session = new addon.HostedScanSession({ orgSlug: 'test-org', maxNewPatches: 0 }, provider)
+  streamSelection(session, selection)
+  const result = await session.finish()
+  const [project] = result.projects
+  assert.deepEqual(project.redirected, [])
+  assert.deepEqual(
+    project.deferred.map((d) => [d.purl, d.rank]),
+    [['pkg:npm/left-pad@1.3.0', 1]],
+  )
+  assert.ok(project.skipped.some((s) => s.reason === 'rollout_deferred'))
+  assert.deepEqual(result.rollout.maxNewPatches, { value: 0, source: 'flag' })
+  assert.deepEqual(result.rollout.counts, { new: 0, deferred: 1, upgrade: 0, already: 0 })
+  assert.deepEqual(result.changedFiles, [])
+})
+
 test('provider failures become project errors, never rejections', async () => {
   for (const searchPatchesBatch of [
     async () => ({ ok: false, error: { kind: 'unauthorized', message: 'token revoked' } }),
diff --git a/docs/design/staged-rollout.md b/docs/design/staged-rollout.md
index 5a9c32ca..09a0f5a9 100644
--- a/docs/design/staged-rollout.md
+++ b/docs/design/staged-rollout.md
@@ -1108,3 +1108,73 @@ Gaps and contradictions A resolved with the smallest reasonable decision
   the docs, to keep validators from drifting.
 - Recognizing a dependency version bump of an already-patched package as
   exempt from the cap (needs state hosted mode does not keep).
+
+## 11. Implementation notes (work item B)
+
+Where the plan left a gap, work item B made the smallest decision that
+keeps its rules intact:
+
+- **`updates[]` without by-package data.** A `--json` report-only run
+  (`--prune` / `--global` with no mode) fetches no by-package records, so
+  its `updates[]` stays on the batch rungs (`batch_supersedes`). In every
+  other run `updates[]` is the UPGRADE rows, plus the batch-derived entry
+  for a package the by-package lookup returned no offer for (nothing was
+  selected there to disagree with).
+- **Report-only and empty scans** carry the `rollout` block with zero
+  counts: they plan nothing.
+- **Unrecognized hosted pins.** Discovery only treats URLs on
+  `patch.socket.dev` or a `--patch-server-url` origin as hosted pins. A
+  scan against another server without that flag would read every pin as
+  NEW and re-spend the same N slots forever. The hosted gate therefore
+  also counts a NEW row as ALREADY when a lockfile names its selected
+  uuid (uuids are unique; one linear scan per file).
+- **In-memory recorded view.** The engine has no disk discovery, so a
+  root's hosted pins are the offered uuids of each purl that its own
+  files mention (nested roots' files excluded), merged with the tree's
+  `.socket/manifest.json` (now selected by `selectHostedScanPaths`) and
+  `.socket/vendor/state.json` at the disk precedence. A pin to a patch
+  the API no longer offers reads as NEW: it costs one slot once, and the
+  next run sees the new pin.
+- **Option source.** The in-memory `maxNewPatches` option reports
+  `source: "flag"` (it is the caller's explicit layer); `maxNewPatchesCap`
+  reports `cap` when it tightens the value.
+- **Key 6 across a base purl's rows.** Rows are sorted with
+  `rollout_cmp` and a base purl takes the rank of its first row, which is
+  the "minimum key over its rows" of 5.2; the uuid key only orders rows of
+  one base purl, which are admitted or deferred together.
+- **Reference failures.** On disk the reference lookup is one call; when
+  it fails in a capped run whose rows are all NEW, the rows are deferred
+  with `rollout_reference_failed` and `rollout_incomplete_lookup` instead
+  of failing the run. In memory the same rule applies per root.
+- **Human output.** The `Rollout:` line prints only when a cap is set.
+  Hosted mode appends the deferred lines to its existing next steps;
+  agent and vendored mode print them under a `Next steps:` heading.
+- **Lock.** A wet hosted run whose only candidates are NEW rows it cannot
+  admit (budget 0, or incomplete data) takes no apply lock and writes
+  nothing, `.socket/` included.
+- **Folding.** `canonical_base_purl` is discovery's, so a nuget or
+  composer pin (lowercased) and a pypi pin (PEP 503 name) match the API's
+  spelling, and a package in two spellings is one budget unit. Every hosted
+  pin joins the recorded index, not just the first per key, so both pinned
+  qualifier twins read ALREADY.
+- **Flag over env.** An explicit `--max-new-patches` wins without parsing
+  `SOCKET_MAX_NEW_PATCHES`; whitespace-only env values are unset.
+- **Known limits.** (1) In memory, the symlink / unreadable-file refusals
+  run inside the first rewrite, before the plan, so a candidate file that
+  only a deferred NEW row would rewrite still refuses its root (disk runs
+  its symlink guard after the gate). (2) On disk, a project directory that
+  fails outright spends nothing and does not freeze later directories. (3)
+  A NEW row that `mark_pinned` turns ALREADY in a run that could admit no
+  NEW row takes the apply lock only after its files were read. (4) Memory
+  pin evidence is any fetched text file of the root; disk's is its
+  discovery plus the candidate files. (5) No e2e case covers a
+  vlt-withheld top-ranked row; it takes the same ineligible path as the
+  withdrawn and `bad_purl` rows the e2e tests cover.
+- **socket.yml layer.** B resolves the cap as flag > env > file >
+  unlimited through `resolve_max_new`; the file value is A's
+  `SelectionPolicy::max_new_patches()` (none when bypassed). The rollout
+  classifies what A's selection keeps: a retained package is neither NEW
+  nor an UPGRADE, and a severity floor removes a NEW row before it can
+  take a slot (9.3). The in-memory engine resolves the cap after the
+  session's socket.yml loads; a session that fails on it has no
+  `rollout` block.

From 909c08c8b5f4db0606ade0b34b1e82719fc0c265 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Wed, 30 Sep 2026 10:13:35 +0200
Subject: [PATCH 29/32] ci: stabilize v5 compatibility tests and macOS patch
 host resolution (#295)

* ci: pin TLS-verified patch hosts on macOS compat legs

The Bun, vlt and Poetry compatibility workflows drive real package managers
against the production patch service. On GitHub's hosted macOS runners the
system resolver intermittently answers patch.socket.dev with EAI_NONAME
("[Errno 8] nodename nor servname provided"; bun: FailedToOpenSocket; Bun
1.3.x workspace installs never exit) for minutes at a time, at job start or
mid-job, while the service is up: ubuntu and windows legs of the same run
pass, and the same macOS cells pass before and after the window. Over the
last 60 Bun runs (69 attempts) 29 macOS native jobs failed this way and no
other OS did; the CLI's own API calls in those cells succeeded.

A pre-flight wait cannot cover a mid-job window, and the failing processes
are bun / vlt / poetry / python rather than the CLI, so a product retry
cannot help. The runner's resolver is not under test, so take it out of the
path: .github/actions/pin-socket-hosts runs scripts/pin-socket-hosts.py on
macOS, which resolves patch.socket.dev and patches-api.socket.dev (system
resolver, then DNS-over-HTTPS by IP literal, with bounded backoff), keeps
only addresses whose TLS handshake verifies the hostname, and pins them in
/etc/hosts. Every cell still hits production over TLS verified for the
hostname, so the captures depscan imports stay production captures.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* ci: fix historical Yarn and vlt upstream restore expectations

* ci: retain JSON CLI failures for vlt transport retries

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
---
 .github/actions/pin-socket-hosts/action.yml   |  42 ++++++
 .github/workflows/bun-compatibility.yml       |   9 ++
 .github/workflows/poetry-compatibility.yml    |   8 +
 .github/workflows/vlt-compatibility.yml       |   8 +
 .../tests/e2e_redirect_vlt_build.rs           |  44 ++++--
 .../tests/mode_migration_npm.rs               |  81 +++++++---
 docs/testing/bun-compatibility.md             |  12 ++
 docs/testing/vlt-compatibility.md             |  12 +-
 scripts/backtest-vlt.py                       |  11 +-
 scripts/pin-socket-hosts.py                   | 140 ++++++++++++++++++
 scripts/tests/test_backtest_harnesses.py      |  23 +++
 scripts/tests/test_pin_socket_hosts.py        |  76 ++++++++++
 scripts/yarn-classic-vex-matrix.sh            |   2 +
 13 files changed, 431 insertions(+), 37 deletions(-)
 create mode 100644 .github/actions/pin-socket-hosts/action.yml
 create mode 100644 scripts/pin-socket-hosts.py
 create mode 100644 scripts/tests/test_pin_socket_hosts.py

diff --git a/.github/actions/pin-socket-hosts/action.yml b/.github/actions/pin-socket-hosts/action.yml
new file mode 100644
index 00000000..c7807042
--- /dev/null
+++ b/.github/actions/pin-socket-hosts/action.yml
@@ -0,0 +1,42 @@
+name: Pin Socket patch hosts
+description: >-
+  On macOS runners, resolve the production patch hosts once (system resolver,
+  then DNS-over-HTTPS by IP literal), TLS-verify every address for its host,
+  and pin them in /etc/hosts for the rest of the job
+inputs:
+  hosts:
+    description: Space-separated hostnames to pin
+    default: patch.socket.dev patches-api.socket.dev
+runs:
+  using: composite
+  steps:
+    # GitHub's hosted macOS runners intermittently answer patch.socket.dev
+    # with EAI_NONAME ("[Errno 8] nodename nor servname provided", bun's
+    # `FailedToOpenSocket`) for minutes at a time — at job start or mid-job —
+    # while the service is up: the ubuntu / windows legs of the same run pass
+    # and the same macOS cells pass before and after the window. A pre-flight
+    # wait cannot cover a mid-job window and the failing processes are the
+    # real package managers, not the CLI, so the job takes the runner's
+    # resolver out of the path instead. Every request still goes to the
+    # production service over TLS verified for the hostname.
+    # scripts/pin-socket-hosts.py documents the resolution and verification.
+    - name: Pin hosts
+      if: runner.os == 'macOS'
+      shell: bash
+      env:
+        PIN_HOSTS: ${{ inputs.hosts }}
+      run: |
+        set -euo pipefail
+        # shellcheck disable=SC2086 # PIN_HOSTS is a space-separated list
+        lines=$(python3 "$GITHUB_WORKSPACE/scripts/pin-socket-hosts.py" $PIN_HOSTS)
+        printf '%s\n' "$lines"
+        printf '\n# pinned by .github/actions/pin-socket-hosts\n%s\n' "$lines" | sudo tee -a /etc/hosts >/dev/null
+        sudo dscacheutil -flushcache
+        sudo killall -HUP mDNSResponder || true
+        for host in $PIN_HOSTS; do
+          got=$(python3 -c 'import socket, sys; print(" ".join(sorted({i[4][0] for i in socket.getaddrinfo(sys.argv[1], 443)})))' "$host" || true)
+          echo "$host now resolves to: ${got:-nothing}"
+          if [ -z "$got" ] || ! grep -qE "^(${got// /|}) $host\$" <<<"$lines"; then
+            echo "::warning::$host does not resolve to its pinned address after pinning (got: ${got:-nothing})"
+          fi
+        done
diff --git a/.github/workflows/bun-compatibility.yml b/.github/workflows/bun-compatibility.yml
index 3f6b325f..9894fe3b 100644
--- a/.github/workflows/bun-compatibility.yml
+++ b/.github/workflows/bun-compatibility.yml
@@ -17,6 +17,8 @@ on:
   pull_request:
     paths:
       - '.github/actions/upload-artifact/**'
+      - '.github/actions/pin-socket-hosts/**'
+      - 'scripts/pin-socket-hosts.py'
       - '.github/workflows/bun-compatibility.yml'
       - 'scripts/backtest-bun*.py'
       - 'scripts/probe-bun-historical-linux.py'
@@ -57,6 +59,8 @@ on:
     branches: [main]
     paths:
       - '.github/workflows/bun-compatibility.yml'
+      - '.github/actions/pin-socket-hosts/**'
+      - 'scripts/pin-socket-hosts.py'
       - 'scripts/backtest-bun*.py'
       - 'scripts/probe-bun-historical-linux.py'
       - 'scripts/bun-historical-shas.json'
@@ -187,6 +191,11 @@ jobs:
         with:
           python-version: '3.12'
 
+      - name: Pin the production patch hosts (macOS)
+        # The hosted macOS resolver intermittently loses patch.socket.dev for
+        # minutes (EAI_NONAME) while the service is up; see the action.
+        uses: ./.github/actions/pin-socket-hosts
+
       - name: Download Bun ${{ matrix.bun }}
         id: bun
         # Pre-populate the exact directory layout the script's install_tool()
diff --git a/.github/workflows/poetry-compatibility.yml b/.github/workflows/poetry-compatibility.yml
index c4b07934..585e8378 100644
--- a/.github/workflows/poetry-compatibility.yml
+++ b/.github/workflows/poetry-compatibility.yml
@@ -15,6 +15,8 @@ on:
   pull_request:
     paths:
       - '.github/actions/upload-artifact/**'
+      - '.github/actions/pin-socket-hosts/**'
+      - 'scripts/pin-socket-hosts.py'
       - '.github/workflows/poetry-compatibility.yml'
       - 'scripts/backtest-poetry.py'
       - 'crates/socket-patch-core/src/utils/poetry_lock.rs'
@@ -29,6 +31,8 @@ on:
     branches: [main]
     paths:
       - 'scripts/backtest-poetry.py'
+      - '.github/actions/pin-socket-hosts/**'
+      - 'scripts/pin-socket-hosts.py'
       - 'crates/socket-patch-core/src/utils/poetry_lock.rs'
       - 'crates/socket-patch-core/src/patch/redirect/**'
       - 'crates/socket-patch-core/src/vendor/pypi*.rs'
@@ -91,6 +95,10 @@ jobs:
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.12'
+      - name: Pin the production patch hosts (macOS)
+        # The hosted macOS resolver intermittently loses patch.socket.dev for
+        # minutes (EAI_NONAME) while the service is up; see the action.
+        uses: ./.github/actions/pin-socket-hosts
       # uv bootstraps every pinned Poetry release (and its interpreter)
       # itself; pinning uv keeps the bootstrap reproducible.
       - run: python -m pip install uv==0.11.19
diff --git a/.github/workflows/vlt-compatibility.yml b/.github/workflows/vlt-compatibility.yml
index 738a2f54..a30976d9 100644
--- a/.github/workflows/vlt-compatibility.yml
+++ b/.github/workflows/vlt-compatibility.yml
@@ -21,6 +21,8 @@ on:
   pull_request:
     paths:
       - '.github/actions/upload-artifact/**'
+      - '.github/actions/pin-socket-hosts/**'
+      - 'scripts/pin-socket-hosts.py'
       - '.github/workflows/vlt-compatibility.yml'
       - 'Cargo.lock'
       - 'rust-toolchain.toml'
@@ -60,6 +62,8 @@ on:
     branches: [main]
     paths:
       - '.github/actions/upload-artifact/**'
+      - '.github/actions/pin-socket-hosts/**'
+      - 'scripts/pin-socket-hosts.py'
       - '.github/workflows/vlt-compatibility.yml'
       - 'Cargo.lock'
       - 'rust-toolchain.toml'
@@ -407,6 +411,10 @@ jobs:
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.12'
+      - name: Pin the production patch hosts (macOS)
+        # The hosted macOS resolver intermittently loses patch.socket.dev for
+        # minutes (EAI_NONAME) while the service is up; see the action.
+        uses: ./.github/actions/pin-socket-hosts
       - name: Backtest against production
         # Every hosted cell probes the artifact first; it records
         # blocked-by-server-encoding only when that probe saw a non-identity
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_vlt_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_vlt_build.rs
index 55a4708a..3807f9e8 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_vlt_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_vlt_build.rs
@@ -29,6 +29,24 @@ fn hosted_leg(name: &'static str) -> Option<Leg> {
     Leg::start(SUITE, name)
 }
 
+/// v5 restores upstream pins without a saved lock fragment. The earliest
+/// vlt releases record npmjs URLs even with the harness registry configured;
+/// restore may omit that redundant slot or point it at the harness registry.
+/// All other bytes, including bystanders and line endings, must still match.
+fn assert_restored_lock(fx: &Fixture, before: &[u8]) {
+    let mut expected = String::from_utf8(before.to_vec()).unwrap();
+    let mut actual = String::from_utf8(lock_bytes(&fx.proj)).unwrap();
+    if fx.leg.version() <= VltVersion::zero(11) {
+        for target in &fx.svc.targets {
+            let bare = target.name.rsplit('/').next().unwrap();
+            let path = Registry::tarball_path(&target.name, bare, &target.version);
+            expected = expected.replace(&format!(",\"https://registry.npmjs.org{path}\""), "");
+            actual = actual.replace(&format!(",\"{}{path}\"", fx.reg.server.uri()), "");
+        }
+    }
+    assert_eq!(actual, expected, "rollback restores the upstream lock");
+}
+
 // ── drivers and fresh checkouts ───────────────────────────────────────────
 
 /// `scan --mode hosted --vex`: the lock pins the artifact (one preflight
@@ -167,7 +185,7 @@ async fn vlt_pinned_matrix_hosted_tamper_cold_eintegrity() {
 
 // ── rollback, rerun, heal ─────────────────────────────────────────────────
 
-/// Rollback restores the lock byte-for-byte, heals the patched store copy
+/// Rollback restores the upstream lock, heals the patched store copy
 /// (and nothing else), and the next `vlt install` is pristine.
 #[tokio::test(flavor = "multi_thread")]
 #[ignore = "real vlt: SOCKET_PATCH_VLT_E2E_JS"]
@@ -184,11 +202,7 @@ async fn vlt_pinned_matrix_hosted_rollback_byte_exact() {
     let out = fx.rollback(&[]);
     assert_eq!(out.code, 0, "{out}");
     let doc = out.json();
-    assert_eq!(
-        String::from_utf8_lossy(&lock_bytes(&fx.proj)),
-        String::from_utf8_lossy(&fx.lock_before),
-        "rollback restores vlt-lock.json byte-for-byte"
-    );
+    assert_restored_lock(&fx, &fx.lock_before);
     assert!(
         fx.ledger().is_none(),
         "no hosted ledger is ever written (v5)"
@@ -762,11 +776,10 @@ async fn vlt_pinned_matrix_hosted_crlf_lock() {
     assert_eq!(state(&co, fx.t()), State::Patched);
     let out = fx.rollback(&[]);
     assert_eq!(out.code, 0, "{out}");
-    assert_eq!(
-        lock_bytes(&fx.proj),
-        crlf,
-        "rollback restores the CRLF lock"
-    );
+    assert_restored_lock(&fx, &crlf);
+    let co = fx.checkout("restored-crlf");
+    fx.vlt_ok_profile(&co, &fx.leg.locked_install_args(), "restored-crlf");
+    assert_eq!(state(&co, fx.t()), State::Pristine);
     fx.leg.ran();
 }
 
@@ -1185,11 +1198,7 @@ async fn vlt_pinned_matrix_hosted_idempotence() {
     assert!(fx.ledger().is_none());
     let out = fx.rollback(&[]);
     assert_eq!(out.code, 0, "{out}");
-    assert_eq!(
-        String::from_utf8_lossy(&lock_bytes(&fx.proj)),
-        String::from_utf8_lossy(&fx.lock_before),
-        "rollback restores the registry lock byte-for-byte: {out}"
-    );
+    assert_restored_lock(&fx, &fx.lock_before);
     assert!(fx.ledger().is_none());
     let files = package_files(&fx.proj);
     let out = fx.rollback(&[]);
@@ -1199,6 +1208,9 @@ async fn vlt_pinned_matrix_hosted_idempotence() {
         "a second rollback finds no state: {out}"
     );
     assert_eq!(package_files(&fx.proj), files, "and writes nothing");
+    let co = fx.checkout("restored-idempotence");
+    fx.vlt_ok_profile(&co, &fx.leg.locked_install_args(), "restored-idempotence");
+    assert_eq!(state(&co, fx.t()), State::Pristine);
     fx.leg.ran();
 }
 
diff --git a/crates/socket-patch-cli/tests/mode_migration_npm.rs b/crates/socket-patch-cli/tests/mode_migration_npm.rs
index f734f77a..7e7a3b71 100644
--- a/crates/socket-patch-cli/tests/mode_migration_npm.rs
+++ b/crates/socket-patch-cli/tests/mode_migration_npm.rs
@@ -388,11 +388,15 @@ async fn mount_hosted_mocks(
 /// Serve, from `server` (as `SOCKET_NPM_REGISTRY`), the npm registry version
 /// document the v5 upstream restore reads for DEP — mirrored from what the
 /// PRISTINE classic lock recorded (`resolved "<tarball>#<sha1>"`,
-/// `integrity`). The restore of a hosted classic entry must reproduce the
-/// registry entry yarn wrote from exactly that document; mirroring it keeps
+/// `integrity`, or the SHA-1 fragment on pre-1.10 releases). The restore must
+/// reproduce the registry entry yarn wrote from that document; mirroring it keeps
 /// the unwind hermetic (the binary's TLS stack need not reach the real
-/// registry). Returns the registry base to hand the binary.
-async fn mount_registry_from_classic_lock(server: &MockServer, lock: &str) -> String {
+/// registry). Returns the registry base and expected upstream lock. Hosted
+/// mode adds an integrity line even on pre-1.10 yarn, and v5 restores that
+/// line's registry hash without a saved fragment to recover its absence.
+async fn mount_registry_from_classic_lock(server: &MockServer, lock: &str) -> (String, String) {
+    use base64::Engine as _;
+
     let block = lock
         .split("\n\n")
         .find(|b| {
@@ -404,23 +408,43 @@ async fn mount_registry_from_classic_lock(server: &MockServer, lock: &str) -> St
             .lines()
             .find_map(|l| l.trim().strip_prefix(&format!("{name} ")))
             .map(|v| v.trim_matches('"').to_string())
-            .unwrap_or_else(|| panic!("no `{name}` in {block}"))
     };
-    let resolved = field("resolved");
+    let resolved = field("resolved").unwrap_or_else(|| panic!("no `resolved` in {block}"));
     let (tarball, shasum) = resolved
         .split_once('#')
         .map(|(t, s)| (t.to_string(), Some(s.to_string())))
         .unwrap_or((resolved.clone(), None));
+    let integrity = field("integrity").unwrap_or_else(|| {
+        let sha1 = hex::decode(
+            shasum
+                .as_ref()
+                .expect("pre-1.10 yarn pins a SHA-1 fragment"),
+        )
+        .expect("the resolved fragment is hex SHA-1");
+        format!(
+            "sha1-{}",
+            base64::engine::general_purpose::STANDARD.encode(sha1)
+        )
+    });
+    let upstream_lock = if field("integrity").is_some() {
+        lock.to_string()
+    } else {
+        lock.replacen(
+            &format!("  resolved \"{resolved}\""),
+            &format!("  resolved \"{resolved}\"\n  integrity {integrity}"),
+            1,
+        )
+    };
     Mock::given(method("GET"))
         .and(path(format!("/registry/{DEP}/{DEP_VERSION}")))
         .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
             "name": DEP,
             "version": DEP_VERSION,
-            "dist": { "tarball": tarball, "integrity": field("integrity"), "shasum": shasum }
+            "dist": { "tarball": tarball, "integrity": integrity, "shasum": shasum }
         })))
         .mount(server)
         .await;
-    format!("{}/registry", server.uri())
+    (format!("{}/registry", server.uri()), upstream_lock)
 }
 
 fn run_hosted_scan(proj: &Path, server_uri: &str) -> (i32, String, String) {
@@ -642,7 +666,7 @@ fn assert_pure_vendored_and_round_trip(
         "fresh vendored install must carry the PATCHED bytes ({tag})"
     );
 
-    // (b) Round trip: `vendor --revert` restores the REGISTRY lock
+    // (b) Round trip: `vendor --revert` restores the expected REGISTRY lock
     // byte-identically (pre-fix it restored the hosted fragment, with no CLI
     // path back to registry state).
     let (code, stdout, stderr) = run_socket(
@@ -659,8 +683,8 @@ fn assert_pure_vendored_and_round_trip(
     assert_eq!(
         std::fs::read(proj.join("yarn.lock")).unwrap(),
         lock_pristine,
-        "yarn.lock must be restored byte-identical to the pre-hosted \
-         REGISTRY pristine ({tag}); got:\n{}",
+        "yarn.lock must be restored byte-identical to the expected \
+         upstream REGISTRY lock ({tag}); got:\n{}",
         read(proj, "yarn.lock")
     );
     assert_eq!(
@@ -809,7 +833,7 @@ async fn classic_hosted_then_vendored_takeover_round_trips_to_registry() {
     // upstream restore re-resolves the registry entry (mirrored from the
     // pristine lock), and the mock origin is named hosted via
     // --patch-server-url.
-    let registry =
+    let (registry, lock_upstream) =
         mount_registry_from_classic_lock(&server, &String::from_utf8_lossy(&lock_pristine)).await;
     stage_patch(&proj, &fx.orig, &fx.patched);
     let (code, stdout, stderr) = run_socket_env(
@@ -847,7 +871,7 @@ async fn classic_hosted_then_vendored_takeover_round_trips_to_registry() {
         "classic",
         false,
         &hosted_url,
-        &lock_pristine,
+        lock_upstream.as_bytes(),
         &pkg_json_pristine,
         &stdout,
     );
@@ -1055,10 +1079,10 @@ async fn classic_vendored_then_hosted_takeover_leaves_pure_hosted() {
         )
     });
 
-    // The originals chain across migrations: `rollback` restores the hosted
-    // pin's upstream registry entry, which is the pristine lock byte for
-    // byte (online: the entry is re-resolved from the registry document).
-    let registry =
+    // Rollback re-resolves the upstream registry entry. Hosted mode added an
+    // integrity line even on pre-1.10 yarn; v5 has no saved fragment to tell
+    // whether it was originally absent, so it restores the registry hash.
+    let (registry, lock_upstream) =
         mount_registry_from_classic_lock(&server, &String::from_utf8_lossy(&lock_pristine)).await;
     let (code, stdout, stderr) = run_socket_env(
         &proj,
@@ -1076,8 +1100,27 @@ async fn classic_vendored_then_hosted_takeover_leaves_pure_hosted() {
     assert_eq!(code, 0, "rollback failed: {stdout}\n{stderr}");
     assert_eq!(
         read(&proj, "yarn.lock"),
-        String::from_utf8_lossy(&lock_pristine),
-        "rollback lands on the pristine registry lock"
+        lock_upstream,
+        "rollback restores the registry lock, allowing the added upstream integrity"
+    );
+    let fresh = fresh_checkout(&proj, fx.tmp.path(), "classic-rollback", false);
+    let fresh_cache = fx.tmp.path().join("fresh-cache-classic-rollback");
+    let ci = corepack(
+        &fresh,
+        &yarn_classic_vex::yarn_classic(),
+        &["install", "--frozen-lockfile", "--no-progress"],
+        &[("YARN_CACHE_FOLDER", fresh_cache.to_str().unwrap())],
+    );
+    assert!(
+        ci.status.success(),
+        "fresh-checkout rollback install must succeed.\nstdout:\n{}\nstderr:\n{}",
+        String::from_utf8_lossy(&ci.stdout),
+        String::from_utf8_lossy(&ci.stderr),
+    );
+    assert_eq!(
+        std::fs::read(fresh.join("node_modules").join(DEP).join("index.js")).unwrap(),
+        fx.orig,
+        "rollback installs the pristine registry bytes"
     );
 }
 
diff --git a/docs/testing/bun-compatibility.md b/docs/testing/bun-compatibility.md
index 90b30702..d6782a2e 100644
--- a/docs/testing/bun-compatibility.md
+++ b/docs/testing/bun-compatibility.md
@@ -345,6 +345,18 @@ matrix to six concurrent jobs, with three cells per job. Each cell has its own
 temporary directory so historical Bun processes cannot collide while extracting
 identically named packages.
 
+On macOS the job first runs `.github/actions/pin-socket-hosts`
+(`scripts/pin-socket-hosts.py`): the hosted macOS resolver intermittently
+answers `patch.socket.dev` with EAI_NONAME for minutes at a time, at job start
+or mid-job, while the service is up, which failed every hosted cell in the
+window (`FailedToOpenSocket`, `[Errno 8] nodename nor servname provided`, or a
+Bun 1.3.x workspace install that never exits). The action resolves the patch
+hosts once (the system resolver, then DNS-over-HTTPS by IP literal), keeps only
+addresses whose TLS handshake verifies the hostname, and pins them in
+`/etc/hosts`, so cells still reach the production service over verified TLS
+without depending on the runner's resolver. The vlt and Poetry workflows run
+the same step.
+
 **Pinned versions:** 0.8.1, 1.0.0, 1.0.36, 1.1.0, 1.1.38 (binary lock),
 1.1.39 (first text lock, version 0), 1.1.43 (first `--lockfile-only`), 1.1.45
 (last version-0 writer), 1.2.0, 1.2.23, 1.3.0 (version 1), 1.3.9 / 1.3.10
diff --git a/docs/testing/vlt-compatibility.md b/docs/testing/vlt-compatibility.md
index b61b7aa2..4fd50669 100644
--- a/docs/testing/vlt-compatibility.md
+++ b/docs/testing/vlt-compatibility.md
@@ -75,7 +75,10 @@ asserted and each named test or row exists.
   collation golden, and the store linkers auto / hardlink / copy / unpack / a `/dev/shm`
   cache root; a cell `ci.yml`'s `e2e` rows run identically is left to them,
   see `scripts/ci-vlt-proof-suites.py`, except on dispatch); `native` (the backtest against production, artifacts
-  `vlt-results-<os>-<vlt>` in depscan's capture `result.json` shape);
+  `vlt-results-<os>-<vlt>` in depscan's capture `result.json` shape; on macOS
+  it first pins the TLS-verified patch hosts in `/etc/hosts` through
+  `.github/actions/pin-socket-hosts`, because the hosted macOS resolver
+  intermittently loses `patch.socket.dev` for minutes while the service is up);
   `lock-diff` (the same cell's `vlt-lock.json` must be byte-identical on Linux,
   macOS and Windows); `matrix-coverage` (every era × suite × OS).
 - **Nightly:** `canary` runs every capstone on `vlt@latest` on 3 OS (only the
@@ -131,6 +134,13 @@ The capstones serve npmjs bytes from a local wiremock registry `R` and write
 | rc.30 … rc.32 | `{"config":{"registry": R}}` | yes | URL-segment DepIDs |
 | ≥ rc.33 | `{"config":{"registries":{"npm": R}}}` (+ `config.registry = R` for rc.33 … 1.0.4) | yes | |
 
+The 0.0.0-1 and 0.0.0-11 writers can record an explicit npmjs tarball URL
+despite the configured harness registry. v5 rollback reconstructs the upstream
+pin without a saved lock fragment, so the rollback assertions allow that target
+URL to be omitted or restored on the harness registry. They still compare every
+other byte, including bystanders and CRLF line endings, and verify pristine
+package contents after a real install from the restored lock.
+
 `scripts/backtest-vlt.py`'s `write_vlt_json` follows the same table against
 public npm (a `registry` equal to vlt's npmjs default is left out: vlt strips
 it from the lock anyway).
diff --git a/scripts/backtest-vlt.py b/scripts/backtest-vlt.py
index ed8b5436..f9e565ae 100644
--- a/scripts/backtest-vlt.py
+++ b/scripts/backtest-vlt.py
@@ -992,13 +992,20 @@ def __init__(self, ctx, version, mode, shape_name):
         self.record = ctx['record']
         self.envelopes = []
         self.fresh_patched = {}
+        self.cli_failures = []
 
     # CLI -------------------------------------------------------------------
     def cli(self, args, cwd=None):
         command = [self.ctx['cli'], *args, '--json', '--no-telemetry']
         if self.ctx.get('patch_server_url'):
             command += ['--patch-server-url', self.ctx['patch_server_url']]
-        return run(command, cwd or self.project, self.ctx['cli_env'], self.log)
+        code, out, err = run(command, cwd or self.project, self.ctx['cli_env'], self.log)
+        if code:
+            # --json errors go to stdout, including on repeat/revert calls.
+            # Keep them on the result row so the transport retry sees them.
+            self.cli_failures.append(dict(command=str(args[0]), exitCode=code,
+                                          envelope=parse_envelope(out), stderr=tail(err, 3000)))
+        return code, out, err
 
     def patch_run(self, mode, cwd=None):
         cwd = cwd or self.project
@@ -1195,6 +1202,8 @@ def blocked_refusal(self, row, envelopes, reference):
         return clean
 
     def finish(self, row, checks, started):
+        if self.cli_failures:
+            row['cliFailures'] = self.cli_failures
         row['failingChecks'] = [k for k, v in checks.items() if v is False]
         row['notEvaluated'] = [k for k, v in checks.items() if v is None]
         row.setdefault('codes', [])
diff --git a/scripts/pin-socket-hosts.py b/scripts/pin-socket-hosts.py
new file mode 100644
index 00000000..df36bb1e
--- /dev/null
+++ b/scripts/pin-socket-hosts.py
@@ -0,0 +1,140 @@
+#!/usr/bin/env python3
+"""Pin the production Socket patch hosts in the hosts file of a CI runner.
+
+The compatibility workflows drive REAL package managers (bun, vlt, poetry,
+...) against the production patch service. On GitHub's hosted macOS runners
+the system resolver intermittently answers `patch.socket.dev` with
+EAI_NONAME ("[Errno 8] nodename nor servname provided, or not known";
+bun: `FailedToOpenSocket`) for minutes at a time, starting at job start or
+mid-job, while the service itself is up (the ubuntu and windows legs of the
+same run pass, and the same macOS cells pass before and after the window).
+The runner's resolver is not under test, so the workflow takes it out of the
+path: this script resolves each host once, verifies every address, and
+prints `hosts(5)` lines the workflow appends to /etc/hosts.
+
+Resolution tries the system resolver first, then DNS-over-HTTPS to IP-literal
+endpoints (no DNS needed to reach them), retrying with backoff inside a
+bounded window. An address is only pinned after a TLS handshake to it with
+SNI = the host verifies the host's certificate, so a pinned address is one
+that really serves that name; the package managers still verify TLS for the
+hostname on every request. Both families are resolved; an IPv6 address is
+pinned only when it verifies too, so a runner without an IPv6 route never gets
+an unreachable entry.
+
+Exit status is non-zero, with nothing printed, when a host cannot be pinned
+within the window: the job then fails at this step, naming the host, rather
+than in a hundred cells downstream.
+"""
+
+import argparse
+import ipaddress
+import json
+import socket
+import ssl
+import sys
+import time
+import urllib.request
+
+DEFAULT_HOSTS = ['patch.socket.dev', 'patches-api.socket.dev']
+# DoH JSON endpoints reached by IP literal; both serve certificates with the
+# IP in the subjectAltName, so they verify without any name resolution.
+DOH_ENDPOINTS = [
+    'https://1.1.1.1/dns-query?name={host}&type={rrtype}',
+    'https://8.8.8.8/resolve?name={host}&type={rrtype}',
+]
+RR_TYPES = {'A': 1, 'AAAA': 28}
+
+
+def log(message):
+    print(message, file=sys.stderr, flush=True)
+
+
+def system_resolve(host):
+    infos = socket.getaddrinfo(host, 443, socket.AF_UNSPEC, socket.SOCK_STREAM)
+    return [info[4][0] for info in infos]
+
+
+def doh_resolve(host, template, timeout):
+    addresses = []
+    for rrtype, code in RR_TYPES.items():
+        request = urllib.request.Request(template.format(host=host, rrtype=rrtype),
+                                         headers={'accept': 'application/dns-json'})
+        with urllib.request.urlopen(request, timeout=timeout) as response:
+            answer = json.loads(response.read()).get('Answer') or []
+        # CNAME answers (type 5) precede the address records and are skipped.
+        addresses += [record['data'] for record in answer if record.get('type') == code]
+    return addresses
+
+
+def verified(host, address, timeout):
+    """A TLS handshake to `address` with SNI `host` verifies `host`'s cert."""
+    context = ssl.create_default_context()
+    try:
+        with socket.create_connection((address, 443), timeout=timeout) as raw:
+            with context.wrap_socket(raw, server_hostname=host):
+                return True
+    except (OSError, ssl.SSLError) as error:
+        log(f'{host}: {address} failed verification: {error}')
+        return False
+
+
+def resolve(host, window, timeout):
+    """Verified addresses of `host` (IPv4 first), or [] once `window` seconds pass."""
+    sources = [('system resolver', lambda: system_resolve(host))]
+    sources += [(template.split('/')[2], lambda t=template: doh_resolve(host, t, timeout))
+                for template in DOH_ENDPOINTS]
+    deadline = time.monotonic() + window
+    attempt = 0
+    fallback = []
+    while True:
+        attempt += 1
+        for name, source in sources:
+            try:
+                candidates = source()
+            except Exception as error:  # noqa: BLE001 - every source is best effort
+                log(f'{host}: {name} attempt {attempt} failed: {error}')
+                continue
+            addresses = []
+            for candidate in dict.fromkeys(candidates):
+                try:
+                    ipaddress.ip_address(candidate)
+                except ValueError:
+                    continue
+                if verified(host, candidate, timeout):
+                    addresses.append(candidate)
+            addresses.sort(key=lambda a: ipaddress.ip_address(a).version)
+            # A source that only verified IPv6 is not enough on its own: try
+            # the next one for an IPv4 address before settling for it.
+            if any(ipaddress.ip_address(a).version == 4 for a in addresses):
+                log(f'{host}: pinned {" ".join(addresses)} (from {name}, attempt {attempt})')
+                return addresses
+            log(f'{host}: {name} attempt {attempt} gave no verified IPv4 address')
+            fallback = fallback or addresses
+        remaining = deadline - time.monotonic()
+        if remaining <= 0:
+            return fallback
+        time.sleep(min(5 * attempt, 30, remaining))
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser(description=__doc__,
+                                     formatter_class=argparse.RawDescriptionHelpFormatter)
+    parser.add_argument('hosts', nargs='*', default=DEFAULT_HOSTS)
+    parser.add_argument('--window', type=float, default=300,
+                        help='seconds to keep retrying a host before failing (default 300)')
+    parser.add_argument('--timeout', type=float, default=10,
+                        help='per-request timeout in seconds (default 10)')
+    args = parser.parse_args(argv)
+    lines = []
+    for host in args.hosts:
+        addresses = resolve(host, args.window, args.timeout)
+        if not addresses:
+            log(f'::error::could not resolve and verify {host} within {args.window:.0f} s')
+            return 1
+        lines += [f'{address} {host}' for address in addresses]
+    print('\n'.join(lines))
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main())
diff --git a/scripts/tests/test_backtest_harnesses.py b/scripts/tests/test_backtest_harnesses.py
index b5b7dc07..5b393228 100644
--- a/scripts/tests/test_backtest_harnesses.py
+++ b/scripts/tests/test_backtest_harnesses.py
@@ -608,6 +608,29 @@ def test_snapshot_never_follows_a_link(self):
 
 
 class VltRetryTests(unittest.TestCase):
+    def test_json_cli_failures_reach_the_retry_classifier(self):
+        for phase in ('initial', 'repeat', 'rollback'):
+            for status in (504, 404):
+                with self.subTest(phase=phase, status=status), tempfile.TemporaryDirectory() as temp:
+                    cell = vlt.Cell({'out': Path(temp), 'record': {}, 'cli': 'socket-patch',
+                                     'cli_env': {}}, '1.2.0', 'hosted', 'direct')
+                    cell.project.mkdir(parents=True)
+                    row = dict(cell=cell.name, expectedVerdict='patched', passed=False, checks={})
+                    envelope = {'status': 'error',
+                                'error': f'API request failed with status {status}: error code: {status}'}
+                    with patch.object(vlt, 'run', return_value=(1, json.dumps(envelope), '')):
+                        if phase == 'initial':
+                            cell.patch_run('hosted')
+                        elif phase == 'repeat':
+                            cell.repeat(row, row['checks'], b'')
+                        else:
+                            cell.revert()
+                    with patch('sys.stdout'):
+                        cell.finish(row, row['checks'], vlt.time.time())
+                    captured = json.loads((cell.case / 'result.json').read_text())
+                    self.assertEqual(captured['cliFailures'][0]['envelope'], envelope)
+                    self.assertEqual(vlt.transient(captured), status == 504)
+
     def test_only_transport_failures_retry(self):
         self.assertFalse(vlt.transient({'matchesExpectation': True, 'serveProbe': {'curlExit': 7}}))
         self.assertTrue(vlt.transient({'serveProbe': {'curlExit': 7}}))
diff --git a/scripts/tests/test_pin_socket_hosts.py b/scripts/tests/test_pin_socket_hosts.py
new file mode 100644
index 00000000..56094000
--- /dev/null
+++ b/scripts/tests/test_pin_socket_hosts.py
@@ -0,0 +1,76 @@
+"""Hermetic coverage for scripts/pin-socket-hosts.py's resolution fallbacks."""
+
+import contextlib
+import importlib.util
+import io
+from pathlib import Path
+import socket
+import unittest
+from unittest.mock import patch
+
+
+spec = importlib.util.spec_from_file_location(
+    'pin_socket_hosts', Path(__file__).resolve().parents[1] / 'pin-socket-hosts.py')
+pin = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(pin)
+
+HOST = 'patch.socket.dev'
+EAI_NONAME = socket.gaierror(8, 'nodename nor servname provided, or not known')
+
+
+def run(fn):
+    with contextlib.redirect_stderr(io.StringIO()):
+        return fn()
+
+
+class PinSocketHostsTests(unittest.TestCase):
+    def test_system_resolver_answer_is_pinned_when_it_verifies(self):
+        with patch.object(pin, 'system_resolve', return_value=['172.66.3.58', '172.66.3.58']), \
+                patch.object(pin, 'doh_resolve') as doh, \
+                patch.object(pin, 'verified', return_value=True):
+            self.assertEqual(run(lambda: pin.resolve(HOST, 0, 1)), ['172.66.3.58'])
+        doh.assert_not_called()
+
+    def test_doh_takes_over_when_the_system_resolver_fails(self):
+        with patch.object(pin, 'system_resolve', side_effect=EAI_NONAME), \
+                patch.object(pin, 'doh_resolve', return_value=['2606:4700:7::32d', '162.159.143.62']), \
+                patch.object(pin, 'verified', return_value=True):
+            self.assertEqual(run(lambda: pin.resolve(HOST, 0, 1)),
+                             ['162.159.143.62', '2606:4700:7::32d'])
+
+    def test_unverified_addresses_are_never_pinned(self):
+        with patch.object(pin, 'system_resolve', return_value=['140.82.112.3']), \
+                patch.object(pin, 'doh_resolve', return_value=['140.82.112.3']), \
+                patch.object(pin, 'verified', return_value=False):
+            self.assertEqual(run(lambda: pin.resolve(HOST, 0, 1)), [])
+
+    def test_ipv6_only_is_a_last_resort(self):
+        with patch.object(pin, 'system_resolve', return_value=['2606:4700:7::32d']), \
+                patch.object(pin, 'doh_resolve', return_value=[]), \
+                patch.object(pin, 'verified', return_value=True):
+            self.assertEqual(run(lambda: pin.resolve(HOST, 0, 1)), ['2606:4700:7::32d'])
+
+    def test_retries_until_the_resolver_recovers(self):
+        answers = [EAI_NONAME, ['172.66.3.58']]
+        with patch.object(pin, 'system_resolve', side_effect=answers), \
+                patch.object(pin, 'doh_resolve', side_effect=OSError('no route')), \
+                patch.object(pin, 'verified', return_value=True), \
+                patch.object(pin.time, 'sleep') as sleep:
+            self.assertEqual(run(lambda: pin.resolve(HOST, 60, 1)), ['172.66.3.58'])
+        sleep.assert_called_once()
+
+    def test_main_prints_hosts_lines_and_fails_closed(self):
+        out = io.StringIO()
+        with patch.object(pin, 'resolve', return_value=['172.66.3.58']), \
+                contextlib.redirect_stdout(out):
+            self.assertEqual(pin.main([HOST]), 0)
+        self.assertEqual(out.getvalue(), f'172.66.3.58 {HOST}\n')
+        out = io.StringIO()
+        with patch.object(pin, 'resolve', return_value=[]), \
+                contextlib.redirect_stdout(out), contextlib.redirect_stderr(io.StringIO()):
+            self.assertEqual(pin.main([HOST]), 1)
+        self.assertEqual(out.getvalue(), '')
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/scripts/yarn-classic-vex-matrix.sh b/scripts/yarn-classic-vex-matrix.sh
index 5b0ffc9d..ea509ba0 100755
--- a/scripts/yarn-classic-vex-matrix.sh
+++ b/scripts/yarn-classic-vex-matrix.sh
@@ -41,11 +41,13 @@ for release in "${releases[@]}"; do
   for entry in "${suites[@]}"; do
     IFS=: read -r suite filter ignored <<<"$entry"
     echo "== yarn@$release $suite ${filter:-}" >&2
+    start_line=$(wc -l < "$log")
     if ! (cd "$root" && SOCKET_PATCH_YARN_CLASSIC_E2E_VERSION="$release" \
       SOCKET_PATCH_YARN_E2E_REQUIRED=1 \
       cargo test -q -p socket-patch-cli --test "$suite" -- ${filter:+"$filter"} \
       ${ignored:+"$ignored"} --nocapture --test-threads=1 >>"$log" 2>&1); then
       echo "FAIL yarn@$release $suite (log: $log)" >&2
+      tail -n "+$((start_line + 1))" "$log" >&2
       echo "VEXCELL leg=$suite yarn=$release mode=- cell=SUITE FAIL" >>"$log"
       status=1
     fi

From 31c0ae496bffb3c50c419abead3d16485bdba828 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Wed, 30 Sep 2026 10:44:12 +0200
Subject: [PATCH 30/32] chore(v5): simplify distributions to binaries, Cargo,
 and npm (#298)

---
 .github/workflows/ci.yml                      |  21 +-
 .github/workflows/publish-pypi.yml            | 151 ---------
 .github/workflows/publish-rubygems.yml        | 124 -------
 .github/workflows/release.yml                 |  82 +----
 .gitignore                                    |   1 -
 CHANGELOG.md                                  |  12 +-
 README.md                                     | 102 ++----
 crates/socket-patch-cli/CLI_CONTRACT.md       |  45 +--
 .../socket-patch-cli/src/commands/update.rs   |  12 +-
 .../tests/update/self_update_channels_e2e.rs  |  41 ++-
 .../socket-patch-core/src/update/channel.rs   |  43 +--
 crates/socket-patch-core/src/update/state.rs  |   6 +-
 docs/design/v5-plan.md                        |  16 +-
 docs/installer-hosting.md                     |   2 +-
 docs/releasing.md                             |  76 ++---
 gem/socket-patch-bundler/README.md            |  41 ---
 gem/socket-patch-bundler/plugins.rb           | 314 -----------------
 .../socket-patch-bundler.gemspec              |  25 --
 gem/socket-patch/README.md                    |  34 --
 gem/socket-patch/exe/socket-patch             |   9 -
 gem/socket-patch/lib/socket_patch/launcher.rb | 286 ----------------
 gem/socket-patch/socket-patch.gemspec         |  30 --
 pypi/socket-patch-hook/README.md              |  70 ----
 pypi/socket-patch-hook/pyproject.toml         |  36 --
 pypi/socket-patch-hook/socket_patch_hook.pth  |  13 -
 .../socket_patch_hook/__init__.py             | 294 ----------------
 pypi/socket-patch-hook/test_hook.py           | 260 --------------
 pypi/socket-patch/pyproject.toml              |  32 --
 pypi/socket-patch/socket_patch/__init__.py    |  45 ---
 pypi/socket-patch/socket_patch/bin/.gitkeep   |   0
 pypi/socket-patch/test_dispatch.py            | 128 -------
 scripts/build-pypi-wheels.py                  | 316 ------------------
 scripts/bump-version.sh                       |   4 +-
 scripts/dispatch-publish.sh                   |   2 +-
 scripts/release-lint.sh                       |   2 +-
 scripts/version-sync.sh                       |  23 --
 36 files changed, 182 insertions(+), 2516 deletions(-)
 delete mode 100644 .github/workflows/publish-pypi.yml
 delete mode 100644 .github/workflows/publish-rubygems.yml
 delete mode 100644 gem/socket-patch-bundler/README.md
 delete mode 100644 gem/socket-patch-bundler/plugins.rb
 delete mode 100644 gem/socket-patch-bundler/socket-patch-bundler.gemspec
 delete mode 100644 gem/socket-patch/README.md
 delete mode 100755 gem/socket-patch/exe/socket-patch
 delete mode 100644 gem/socket-patch/lib/socket_patch/launcher.rb
 delete mode 100644 gem/socket-patch/socket-patch.gemspec
 delete mode 100644 pypi/socket-patch-hook/README.md
 delete mode 100644 pypi/socket-patch-hook/pyproject.toml
 delete mode 100644 pypi/socket-patch-hook/socket_patch_hook.pth
 delete mode 100644 pypi/socket-patch-hook/socket_patch_hook/__init__.py
 delete mode 100644 pypi/socket-patch-hook/test_hook.py
 delete mode 100644 pypi/socket-patch/pyproject.toml
 delete mode 100644 pypi/socket-patch/socket_patch/__init__.py
 delete mode 100644 pypi/socket-patch/socket_patch/bin/.gitkeep
 delete mode 100644 pypi/socket-patch/test_dispatch.py
 delete mode 100755 scripts/build-pypi-wheels.py

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dbd1ddde..0d51607c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -96,9 +96,8 @@ jobs:
       - name: Smoke-test addon
         run: node --test crates/socket-patch-node/npm/test/smoke.mjs
 
-  # Lint the out-of-workspace packaging artifacts: the RubyGems CLI launcher
-  # gem (Ruby), and the curl|sh installer. Ruby is
-  # pre-installed on the ubuntu-latest runner.
+  # Check the standalone installer, release scripts, and native installer
+  # test harnesses.
   lint-ecosystems:
     runs-on: ubuntu-latest
     timeout-minutes: 10
@@ -108,17 +107,11 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Ruby — syntax-check + build the launcher gem
-        run: |
-          ( cd gem/socket-patch && ruby -c lib/socket_patch/launcher.rb && ruby -c exe/socket-patch && gem build socket-patch.gemspec )
-
       - name: Python — test native installer harnesses
         run: python3 -B -m unittest discover -s scripts/tests -v
 
       - name: Shell — shellcheck the curl|sh installer
-        # install.sh is the other distribution artifact this job lints; it
-        # had no coverage anywhere before the self-update work touched the
-        # same surface. shellcheck is pre-installed on ubuntu-latest.
+        # shellcheck is pre-installed on ubuntu-latest.
         run: shellcheck --shell=sh scripts/install.sh
 
       - name: Shell — run the installer end to end
@@ -685,14 +678,6 @@ jobs:
       - name: Run npm dispatch tests
         run: node --test npm/socket-patch/bin/socket-patch.test.mjs
 
-      - name: Setup Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
-        with:
-          python-version: '3.12.x'
-
-      - name: Run pypi dispatch tests
-        run: python pypi/socket-patch/test_dispatch.py
-
   # Compiles the CLI and every CLI test target once per OS (--all-features,
   # so this is also the feature-gated suites' compile-rot check) and uploads
   # the binaries the e2e, e2e-full and cargo-vex legs run. The legs run the
diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
deleted file mode 100644
index 1c97969f..00000000
--- a/.github/workflows/publish-pypi.yml
+++ /dev/null
@@ -1,151 +0,0 @@
-name: Publish PyPI
-run-name: "Publish PyPI ${{ inputs.version }}${{ inputs.distinct-id != '' && format(' [{0}]', inputs.distinct-id) || '' }}"
-
-# Publishes socket-patch (platform wheels) to PyPI for an existing
-# v<version> release. (The socket-patch-hook .pth wheel is no longer
-# published: `setup` was removed in v5.) Dispatched two
-# ways, both as a plain workflow_dispatch run:
-#   - by release.yml (scripts/dispatch-publish.sh), as one leg of the
-#     single-dispatch release fan-out — distinct-id carries the release
-#     run's correlation id into this run's name;
-#   - manually (Actions → Publish PyPI → Run workflow), to retry just this
-#     registry after a mid-release failure: fix the cause, enter the release
-#     version, leave distinct-id blank.
-# Every run checks out refs/tags/v<version> and takes the prebuilt binaries
-# from the GitHub release's assets (verified against SHA256SUMS), so a
-# manual retry publishes exactly what the release run would have — no
-# rebuild needed. The GitHub release must already exist with all assets.
-#
-# Idempotent: uploads run with skip-existing, so re-runs and retries after a
-# partial upload are safe.
-#
-# OIDC trusted publishing: each project's PyPI trusted publisher is keyed on
-# this repo + THIS file's name (publish-pypi.yml) + environment `pypi`.
-# Because this workflow only ever runs as its own top-level
-# workflow_dispatch run (never as a called reusable workflow), the OIDC
-# token's workflow_ref and job_workflow_ref claims both name this file — so
-# the one registration per project keeps working when PyPI flips its
-# matching from job_workflow_ref to workflow_ref (warehouse PR #20083).
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'Release version (X.Y.Z; the v<version> GitHub release must exist with binaries + SHA256SUMS)'
-        required: true
-        type: string
-      distinct-id:
-        description: 'Correlation id set by release.yml to track its dispatched run — leave blank for manual runs'
-        required: false
-        default: ''
-        type: string
-      sums-digest:
-        description: 'Expected sha256 of the release''s SHA256SUMS asset — set by release.yml to pin the assets to what its build produced; leave blank for manual runs'
-        required: false
-        default: ''
-        type: string
-
-# Serialize same-version runs: uploads are skip-existing but the wheel
-# builds and both project uploads are not atomic, so keep two runs for one
-# version from interleaving. A duplicate (e.g. re-dispatched by a
-# release-run watcher whose `gh run watch` timed out while this run was
-# still going) waits behind the live run and then no-ops. NOTE: the group
-# holds at most ONE waiting run — a further same-version dispatch displaces
-# (cancels) the waiting duplicate, and a watcher following the displaced
-# run reports that as a failure; the publish itself is unaffected (the
-# surviving runs no-op or publish).
-concurrency:
-  group: publish-pypi-${{ inputs.version }}
-
-permissions: {}
-
-jobs:
-  pypi-publish:
-    runs-on: ubuntu-latest
-    # Bounds how long a wedged run (hung registry call) can hold this
-    # workflow's per-version concurrency group before retries can proceed.
-    # (A pending environment approval pauses the run BEFORE the job starts,
-    # so it does not consume this timeout.)
-    timeout-minutes: 45
-    # OIDC trusted publishing scoped to a deployment environment; also lets a
-    # maintainer gate publishing with required reviewers. Auto-created with no
-    # protection rules until configured. NOTE: if required reviewers are ever
-    # configured, a pending approval pauses THIS run while the release run's
-    # watcher counts toward its own timeout-minutes — approve promptly. If
-    # the watcher timed out, re-running it dispatches a NEW run that needs
-    # its own approval before it can no-op; this run is unaffected either way.
-    environment: pypi
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - name: Validate version input
-        env:
-          VERSION: ${{ inputs.version }}
-        run: |
-          if ! printf '%s' "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then
-            echo "::error::'${VERSION}' is not a plain X.Y.Z release version"
-            exit 1
-          fi
-
-      - name: Checkout release tag
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: refs/tags/v${{ inputs.version }}
-          persist-credentials: false
-
-      - name: Verify tag carries the requested version
-        env:
-          VERSION: ${{ inputs.version }}
-        run: |
-          CARGO_VERSION=$(grep '^version = ' Cargo.toml | head -1 | sed 's/version = "\(.*\)"/\1/')
-          if [ "$CARGO_VERSION" != "$VERSION" ]; then
-            echo "::error::tag v${VERSION} carries workspace version ${CARGO_VERSION} — refusing to publish"
-            exit 1
-          fi
-
-      - name: Download binaries from the GitHub release
-        env:
-          GH_TOKEN: ${{ github.token }}
-          VERSION: ${{ inputs.version }}
-          SUMS_DIGEST: ${{ inputs.sums-digest }}
-        run: |
-          mkdir artifacts
-          gh release download "v${VERSION}" \
-            --repo "$GITHUB_REPOSITORY" \
-            --dir artifacts \
-            --pattern '*.tar.gz' --pattern '*.zip' --pattern 'SHA256SUMS'
-          cd artifacts
-          # Release assets are mutable (contents:write can clobber them), and
-          # SHA256SUMS is itself an asset of the same release — so when the
-          # release run dispatched us it pinned the sums file by digest,
-          # binding this publish to exactly what that run built (the same
-          # provenance the pre-split inline jobs got from same-run
-          # artifacts). Manual retries leave the pin blank: integrity-only.
-          if [ -n "$SUMS_DIGEST" ]; then
-            echo "${SUMS_DIGEST}  SHA256SUMS" | sha256sum -c -
-          fi
-          # -c also fails on a file that SHA256SUMS lists but the download
-          # missed, so this doubles as a completeness check: the sums file
-          # was generated from the full 14-target artifact set.
-          sha256sum -c SHA256SUMS
-
-      - name: Setup Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
-        with:
-          python-version: '3.12.13'
-
-      - name: Copy README for PyPI package
-        run: cp README.md pypi/socket-patch/README.md
-
-      - name: Build wheels (platform socket-patch)
-        env:
-          VERSION: ${{ inputs.version }}
-        run: python scripts/build-pypi-wheels.py --version "$VERSION" --artifacts artifacts --dist dist
-
-      - name: Publish socket-patch to PyPI
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
-        with:
-          packages-dir: dist/
-          # Idempotent for re-runs: already-uploaded files skip.
-          skip-existing: true
diff --git a/.github/workflows/publish-rubygems.yml b/.github/workflows/publish-rubygems.yml
deleted file mode 100644
index c65f850a..00000000
--- a/.github/workflows/publish-rubygems.yml
+++ /dev/null
@@ -1,124 +0,0 @@
-name: Publish RubyGems
-run-name: "Publish RubyGems ${{ inputs.version }}${{ inputs.distinct-id != '' && format(' [{0}]', inputs.distinct-id) || '' }}"
-
-# Publishes the CLI launcher gem (gem/socket-patch) via OIDC trusted
-# publishing. The gem downloads the prebuilt binary from the GitHub release
-# at its own version, so this workflow only needs the GitHub release +
-# SHA256SUMS to exist. (The socket-patch-bundler plugin gem is no longer
-# published: `setup` was removed in v5.)
-#
-# Dispatched two ways, both as a plain workflow_dispatch run:
-#   - by release.yml (scripts/dispatch-publish.sh), as one leg of the
-#     single-dispatch release fan-out — distinct-id carries the release
-#     run's correlation id into this run's name;
-#   - manually (Actions → Publish RubyGems → Run workflow), to retry just
-#     this registry after a mid-release failure: fix the cause, enter the
-#     release version, leave distinct-id blank.
-# Every run checks out refs/tags/v<version>, so a manual retry publishes
-# exactly what the release run would have.
-#
-# Idempotent: already-published versions are probed and skipped, so re-runs
-# and partial-failure retries are safe.
-#
-# OIDC trusted publishing: the RubyGems trusted publisher on each gem is
-# keyed on this repo + THIS file's name (publish-rubygems.yml) + environment
-# `rubygems`. Because this workflow only ever runs as its own top-level
-# workflow_dispatch run (never as a called reusable workflow), the OIDC
-# token's workflow_ref and job_workflow_ref claims both name this file — one
-# publisher registration covers every path.
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: 'Release version (X.Y.Z; the v<version> GitHub release must exist — the launcher gem downloads its binary from it)'
-        required: true
-        type: string
-      distinct-id:
-        description: 'Correlation id set by release.yml to track its dispatched run — leave blank for manual runs'
-        required: false
-        default: ''
-        type: string
-
-# Serialize same-version runs: the already-published probes below are
-# check-then-act, so two CONCURRENT runs for one version could both pass a
-# probe and the loser would hard-fail on the registry ("Repushing of gem
-# versions is not allowed"). Serialized, a duplicate (e.g. re-dispatched by
-# a release-run watcher whose `gh run watch` timed out while this run was
-# still going) waits behind the live run and then no-ops. NOTE: the group
-# holds at most ONE waiting run — a further same-version dispatch displaces
-# (cancels) the waiting duplicate, and a watcher following the displaced
-# run reports that as a failure; the publish itself is unaffected (the
-# surviving runs no-op or publish).
-concurrency:
-  group: publish-rubygems-${{ inputs.version }}
-
-permissions: {}
-
-jobs:
-  rubygems-publish:
-    runs-on: ubuntu-latest
-    # Bounds how long a wedged run (hung registry call) can hold this
-    # workflow's per-version concurrency group before retries can proceed.
-    # (A pending environment approval pauses the run BEFORE the job starts,
-    # so it does not consume this timeout.)
-    timeout-minutes: 45
-    # OIDC trusted publishing scoped to a deployment environment; also lets a
-    # maintainer gate publishing with required reviewers. Auto-created with no
-    # protection rules until configured. NOTE: if required reviewers are ever
-    # configured, a pending approval pauses THIS run while the release run's
-    # watcher counts toward its own timeout-minutes — approve promptly. If
-    # the watcher timed out, re-running it dispatches a NEW run that needs
-    # its own approval before it can no-op; this run is unaffected either way.
-    environment: rubygems
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - name: Validate version input
-        env:
-          VERSION: ${{ inputs.version }}
-        run: |
-          if ! printf '%s' "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then
-            echo "::error::'${VERSION}' is not a plain X.Y.Z release version"
-            exit 1
-          fi
-
-      - name: Checkout release tag
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: refs/tags/v${{ inputs.version }}
-          persist-credentials: false
-
-      # Ruby is pre-installed on ubuntu-latest; no setup action needed.
-      - name: Lint + version-check the launcher gem
-        working-directory: gem/socket-patch
-        env:
-          EXPECTED_VERSION: ${{ inputs.version }}
-        run: |
-          ruby -c lib/socket_patch/launcher.rb
-          ruby -c exe/socket-patch
-          # The gemspec version is baked at the tag by scripts/version-sync.sh.
-          gemver="$(ruby -e 'print Gem::Specification.load("socket-patch.gemspec").version')"
-          if [ "$gemver" != "$EXPECTED_VERSION" ]; then
-            echo "::error::gemspec version $gemver != release $EXPECTED_VERSION (run scripts/version-sync.sh before tagging)"
-            exit 1
-          fi
-
-      - name: Configure RubyGems credentials (OIDC trusted publishing)
-        uses: rubygems/configure-rubygems-credentials@dc5a8d8553e6ee01fc26761a49e99e733d17954a # v2.1.0
-
-      - name: Publish socket-patch to RubyGems
-        working-directory: gem/socket-patch
-        env:
-          VERSION: ${{ inputs.version }}
-        run: |
-          gem build socket-patch.gemspec
-          # `gem list -r -e -a` prints `socket-patch (3.3.0, 3.2.0, ...)`; match
-          # this version as a precise list element (preceded by `(`/space,
-          # followed by `,`/`)`).
-          if gem list --remote --exact --all socket-patch 2>/dev/null | grep -qE "[ (]${VERSION}[,)]"; then
-            echo "socket-patch ${VERSION} already on RubyGems; skipping."
-            exit 0
-          fi
-          gem push "socket-patch-${VERSION}.gem"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index eaf6eda9..6fbee700 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -2,27 +2,21 @@ name: Release
 
 # One-dispatch release orchestrator: version gate, build matrix, tag, and
 # GitHub release live here; each registry publish lives in its own
-# independently-runnable workflow (publish-cargo.yml, publish-npm.yml,
-# publish-pypi.yml, publish-rubygems.yml). The fan-out jobs below dispatch
-# each of those at the release tag via `gh workflow run`
+# independently-runnable workflow (publish-cargo.yml, publish-npm.yml).
+# The fan-out jobs below dispatch each at the release tag via `gh workflow run`
 # (scripts/dispatch-publish.sh) and watch the dispatched run to completion,
 # so this run's job graph still reflects every registry's real outcome and
 # "Re-run failed jobs" re-dispatches exactly the failed legs. A failed leg
 # can also be retried without this run at all: fix the cause and dispatch
 # that registry's workflow manually with the release version — no rebuild
-# happens either way. The npm and PyPI legs take the prebuilt binaries from
+# happens either way. The npm leg takes the prebuilt binaries from
 # the GitHub release's assets (verified against SHA256SUMS, pinned by digest
-# on the fan-out path), and the launcher gem downloads its binary from the
-# release at run time — which is why npm/PyPI/RubyGems wait on
-# `github-release` below.
+# on the fan-out path), which is why it waits on `github-release` below.
 #
 # Why dispatch instead of `uses:` (reusable workflows) — two GitHub/registry
 # facts, verified 2026-08-21 against the registries' docs and source:
-#   1. Registry OIDC trusted publishers are keyed on a workflow FILENAME,
-#      but the registries disagree on WHICH one: npm and crates.io match the
-#      top-level workflow (`workflow_ref` claim), while PyPI and RubyGems
-#      match the file defining the job (`job_workflow_ref`) — and PyPI plans
-#      to flip to top-level matching (warehouse PR #20083). npm additionally
+#   1. npm and crates.io OIDC trusted publishers match the top-level
+#      workflow filename (`workflow_ref` claim). npm additionally
 #      allows only ONE trusted publisher per package, so a leg that is
 #      sometimes `uses:`-called (top-level = release.yml) and sometimes
 #      dispatched (top-level = its own file) can never be authorized for
@@ -35,14 +29,11 @@ name: Release
 #      are documented exceptions, so `gh workflow run` with GITHUB_TOKEN
 #      works without a PAT/GitHub App token.
 #
-# Credentials / deployment-environment matrix (per-registry):
+# Registry credentials:
 #   - crates.io:     OIDC trusted publishing (rust-lang/crates-io-auth-action);
 #                    no long-lived secret, no environment.
 #   - npm:           OIDC via `npm stage publish`; staged versions require
 #                    manual 2FA approval (see the npm run's step summary).
-#   - PyPI:          OIDC trusted publishing; environment `pypi`.
-#   - RubyGems:      OIDC trusted publishing; environment `rubygems`
-#                    (the `socket-patch` launcher gem).
 # Every registry's trusted publisher is keyed on the repo + the publish
 # workflow's own filename (see each publish-*.yml header), NOT release.yml.
 
@@ -240,9 +231,9 @@ jobs:
     permissions:
       contents: write
     outputs:
-      # sha256 of the SHA256SUMS file uploaded below. The npm/PyPI fan-out
-      # passes it to those legs, which re-download the assets from the
-      # release: pinning the sums file by digest binds what the legs publish
+      # sha256 of the SHA256SUMS file uploaded below. The npm fan-out
+      # passes it to the publish leg, which re-downloads the assets from the
+      # release: pinning the sums file by digest binds what it publishes
       # to exactly what THIS run built, restoring the same-run-artifact
       # provenance the pre-split inline jobs had (release assets are mutable;
       # anyone with contents:write could clobber them between jobs).
@@ -318,9 +309,8 @@ jobs:
           VERSION: ${{ needs.version.outputs.version }}
         run: bash scripts/dispatch-publish.sh publish-cargo.yml "$VERSION"
 
-  # npm, PyPI, and RubyGems consume the GitHub release (npm/PyPI take the
-  # prebuilt binaries from its assets; the launcher gem downloads its binary
-  # from it at run time), so all three wait on `github-release`.
+  # npm takes the prebuilt binaries from the GitHub release's assets,
+  # so it waits on `github-release`.
   npm-publish:
     needs: [version, github-release]
     if: ${{ !inputs.dry-run }}
@@ -348,51 +338,3 @@ jobs:
             exit 1
           fi
           bash scripts/dispatch-publish.sh publish-npm.yml "$VERSION" "sums-digest=${SUMS_DIGEST}"
-
-  pypi-publish:
-    needs: [version, github-release]
-    if: ${{ !inputs.dry-run }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    permissions:
-      contents: read
-      actions: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Dispatch and watch Publish PyPI
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          VERSION: ${{ needs.version.outputs.version }}
-          SUMS_DIGEST: ${{ needs.github-release.outputs.sums-digest }}
-        run: |
-          # Fail closed: an empty digest would silently downgrade the leg's
-          # asset check from provenance-pinned to integrity-only.
-          if [ -z "$SUMS_DIGEST" ]; then
-            echo "::error::github-release produced no SHA256SUMS digest; refusing to dispatch an unpinned publish"
-            exit 1
-          fi
-          bash scripts/dispatch-publish.sh publish-pypi.yml "$VERSION" "sums-digest=${SUMS_DIGEST}"
-
-  rubygems-publish:
-    needs: [version, github-release]
-    if: ${{ !inputs.dry-run }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 45
-    permissions:
-      contents: read
-      actions: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Dispatch and watch Publish RubyGems
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          VERSION: ${{ needs.version.outputs.version }}
-        run: bash scripts/dispatch-publish.sh publish-rubygems.yml "$VERSION"
diff --git a/.gitignore b/.gitignore
index d7c6d412..c2de49e7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -151,7 +151,6 @@ npm/socket-patch/bin/socket-patch-*
 # READMEs copied at publish time
 crates/socket-patch-cli/README.md
 npm/socket-patch/README.md
-pypi/socket-patch/README.md
 
 # Generated by scripts/study-crates.ts
 study-output/
diff --git a/CHANGELOG.md b/CHANGELOG.md
index cb575eb0..5e31e5ad 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -63,10 +63,14 @@ into the new version's section — see docs/releasing.md.
   and the commands to move to hosted mode or keep agent mode. Agent mode is now `socket-patch scan --mode agent` once
   (commit `.socket/`), then `socket-patch apply` in CI after every install.
   Hosted and vendored mode never needed a hook.
-- **The `socket-patch-hook` PyPI wheel and the `socket-patch-bundler` gem
-  are no longer built or published**, and the `socket-patch[hook]` extra is
-  gone from the `socket-patch` wheel (pip warns about the unknown extra and
-  installs the CLI). Their sources stay in the tree, frozen, for reference.
+- **PyPI and RubyGems distributions are removed.** The `socket-patch` wheel
+  and launcher gem, `socket-patch-hook` wheel, and `socket-patch-bundler` gem
+  are no longer built or published. Their sources, package tests, publishing
+  workflows, wheel builder, and version-sync entries are removed. Install
+  the standalone binary via `https://install.socket.dev/patch` (preferred),
+  `cargo install socket-patch-cli`, or `npm install -g @socketsecurity/socket-patch`.
+  npm remains available for the official Socket CLI. Python and Ruby dependency
+  patching remain supported; see the README's migration instructions.
 - **`vex` no longer drops agent-mode patches whose ecosystem has no
   install hook** ("Property 7"). A manifest patch that verifies as applied
   (or any manifest patch under `--no-verify`) is now attested whatever the
diff --git a/README.md b/README.md
index 6305f33b..9d71e375 100644
--- a/README.md
+++ b/README.md
@@ -21,85 +21,37 @@ your repo when installs must work offline.
 
 ## Installation
 
-One-line install (macOS / Linux):
+Install the standalone binary (**recommended**, macOS / Linux):
 
 ```bash
 curl -fsSL https://install.socket.dev/patch | sh
 ```
 
-Detects your platform (macOS/Linux, x64/ARM64), downloads the latest binary, verifies it
-against the release's `SHA256SUMS`, and installs to `/usr/local/bin` or `~/.local/bin`.
-Use `sudo sh` instead of `sh` if `/usr/local/bin` requires root. Pin a version with
-`SOCKET_PATCH_VERSION=3.3.0 sh` instead of plain `sh`.
+The installer detects your platform, downloads the latest binary, verifies it against
+the release's `SHA256SUMS`, and installs to `/usr/local/bin` or `~/.local/bin`.
+It needs no language runtime. Set `SOCKET_PATCH_INSTALL_DIR` to choose a directory or
+`SOCKET_PATCH_VERSION` to pin a release; pass either variable to `sh` after the pipe.
+You can inspect the [installer source](scripts/install.sh) and read about
+[mirrors and restricted networks](docs/installer-hosting.md#installing-without-reaching-githubcom).
 
-On a network that blocks or distrusts `github.com`, set `SOCKET_PATCH_BASE_URL` so the
-archives come from Socket too — `install.socket.dev` relays them from the GitHub release,
-checksums included:
-
-```bash
-curl -fsSL https://install.socket.dev/patch \
-  | SOCKET_PATCH_BASE_URL=https://install.socket.dev/patch/SocketDev/socket-patch/releases sh
-```
-
-`install.socket.dev` serves a copy of [`scripts/install.sh`](scripts/install.sh) from
-this repository — read it before you run it, either there or at
-[install.socket.dev/patch](https://install.socket.dev/patch). If you would rather not
-depend on the Socket domain, `curl -fsSL
-https://raw.githubusercontent.com/SocketDev/socket-patch/main/scripts/install.sh | sh`
-does the same thing from the same bytes. See
-[docs/installer-hosting.md](docs/installer-hosting.md) for how the hosted copy is
-published.
-
-On Windows, install via npm (below), or grab a prebuilt
+On Windows, download a prebuilt
 `socket-patch-*-pc-windows-msvc.zip` from the
-[latest release](https://github.com/SocketDev/socket-patch/releases/latest).
+[latest release](https://github.com/SocketDev/socket-patch/releases/latest), extract it
+into a directory on your `PATH`, or install via npm below. The full
+[platform list](docs/ecosystems.md#supported-platforms) includes Linux, macOS, Windows,
+and Android release archives.
+
+### Cargo and npm
 
-Or install through your package manager:
+These are the supported package-manager distributions:
 
 | Package manager | Command |
 |-----------------|---------|
-| npm | `npm install -g @socketsecurity/socket-patch` (or one-shot: `npx @socketsecurity/socket-patch`) |
-| pip | `pip install socket-patch` |
 | cargo | `cargo install socket-patch-cli` (builds from source with every ecosystem compiled in) |
-| gem | `gem install socket-patch` |
-
-The gem package is a thin launcher: on first run it downloads the prebuilt binary for
-your platform from the matching GitHub release, verifies its SHA-256, caches it, and
-execs it. Set `SOCKET_PATCH_BIN` to an existing binary to skip the download.
-
-<details>
-<summary>Manual download</summary>
-
-Download a prebuilt binary from the [latest release](https://github.com/SocketDev/socket-patch/releases/latest):
-
-```bash
-# macOS (Apple Silicon)
-curl -fsSL https://github.com/SocketDev/socket-patch/releases/latest/download/socket-patch-aarch64-apple-darwin.tar.gz | tar xz
-
-# macOS (Intel)
-curl -fsSL https://github.com/SocketDev/socket-patch/releases/latest/download/socket-patch-x86_64-apple-darwin.tar.gz | tar xz
-
-# Linux (x86_64)
-curl -fsSL https://github.com/SocketDev/socket-patch/releases/latest/download/socket-patch-x86_64-unknown-linux-musl.tar.gz | tar xz
-
-# Linux (ARM64)
-curl -fsSL https://github.com/SocketDev/socket-patch/releases/latest/download/socket-patch-aarch64-unknown-linux-musl.tar.gz | tar xz
-```
-
-The musl builds are fully static and run on any distro; glibc (`-gnu`) variants are also
-on the releases page, alongside Windows (`socket-patch-x86_64-pc-windows-msvc.zip`) and
-other targets.
-
-Then move the binary onto your `PATH`:
-
-```bash
-sudo mv socket-patch /usr/local/bin/
-```
-
-The full list of prebuilt targets (Windows, 32-bit ARM, i686, Android) is in
-[docs/ecosystems.md](docs/ecosystems.md#supported-platforms).
+| npm | `npm install -g @socketsecurity/socket-patch` (or one-shot: `npx @socketsecurity/socket-patch`) |
 
-</details>
+The npm distribution also supplies Socket Patch to the official
+[Socket CLI](https://docs.socket.dev/docs/socket-cli).
 
 ### Updating
 
@@ -116,6 +68,19 @@ installs are detected and pointed at their own upgrade command instead (e.g.
 interactive runs print a once-a-day reminder on stderr — set
 `SOCKET_NO_UPDATE_CHECK=1` to turn that off.
 
+### Migrating from PyPI or RubyGems
+
+Starting with v5, Socket Patch is distributed as standalone binaries, Cargo crates,
+and npm packages. The `socket-patch` PyPI package and Ruby gem, along with
+`socket-patch-hook` and `socket-patch-bundler`, are no longer published.
+Python and Ruby projects remain fully supported by all three distributions.
+
+Uninstall the old CLI with the manager that installed it (`pip uninstall socket-patch`,
+`pipx uninstall socket-patch`, or `gem uninstall socket-patch`), then use one of the
+installation methods above. Remove it from project dependencies and CI bootstrap
+commands too. Run `socket-patch --version` to confirm your shell finds the new binary.
+Projects that used install hooks should also follow [Upgrading from `setup`](#upgrading-from-setup).
+
 ## Five-minute tutorial
 
 No account or token is needed to follow along — without an API token `socket-patch`
@@ -1259,8 +1224,9 @@ project that ran `setup`:
      `scripts.post-install-cmd` and `scripts.post-update-cmd`.
    - **Python**: remove `socket-patch[hook]` from `requirements.txt`, or from
      `[project].dependencies` / `[tool.poetry.dependencies]` in `pyproject.toml`, then
-     `pip uninstall socket-patch-hook` in each environment that has it (the wheel is no
-     longer published, so a fresh install fails while the dependency is still listed).
+     `pip uninstall socket-patch-hook` in each environment that has it. Those packages
+     no longer receive releases; install the CLI separately using the
+     [v5 installation methods](#installation).
    - **Bundler**: delete the managed `plugin "socket-patch", path: ...` block from the
      `Gemfile`, then `bundle plugin uninstall socket-patch`, and delete
      `.socket/bundler-plugin/`, `.socket/gem-plugin-stamp` and the `/gem-plugin-stamp`
diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index fd980fc8..70f217f7 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -974,28 +974,33 @@ Synopsis and behavior:
 | Invocation | Behavior |
 |---|---|
 | `--update` | Resolve the latest release; install it if newer than the running version. Already-newest (including a dev build newer than any release): informational no-op, exit 0. `latest` never downgrades. |
-| `--update 3.4.0` | Install exactly that version, **up or down** — an explicit pin is explicit intent, no `--force` needed. Pin == current: no-op, exit 0. The inline `--update=3.4.0` spelling is equivalent. Also settable via `SOCKET_PATCH_VERSION` (the same pin env `install.sh` and the gem launcher honor); a malformed version is a usage error (exit 2). |
+| `--update 3.4.0` | Install exactly that version, **up or down** — an explicit pin is explicit intent, no `--force` needed. Pin == current: no-op, exit 0. The inline `--update=3.4.0` spelling is equivalent. Also settable via `SOCKET_PATCH_VERSION` (the same pin env `install.sh` honors); a malformed version is a usage error (exit 2). |
 | `--update --force` | Reinstall/downgrade even when already at the target version, and proceed past a managed-install refusal (with a warning that the owning manager's next upgrade will overwrite the binary). Env: `SOCKET_FORCE`. |
 | `--update --dry-run` | **Check-only**: one metadata request, zero downloads, zero mutation, exit 0 — and always the `verified`/`update_check` event shape, whether or not an update exists. `--json` details carry `{current, latest, updateAvailable, target, asset, path}` — the cheap scriptable "is an update available" probe. |
 | `--update --offline` | Refused up front (strict airgap, before any client exists), exit 1. `--force` does **not** bypass it. |
 
 Honored global flags: `--json`, `--silent` (errors only), `--yes` (skip the confirm prompt; `--json` also auto-confirms), `--dry-run`, `--offline`, `--verbose`, `--debug`, `--no-telemetry`. Other global flags parse and are ignored (the `list --global` precedent).
 
-**Managed-install refusal.** The canonicalized executable path (symlinked invocations resolve to the real file) is classified before any network I/O; non-standalone channels exit 1 with `errorCode: managed_install` and the owning manager's command:
+**Managed-install refusal.** The canonicalized executable path (symlinked invocations resolve to the real file) is classified before any network I/O; non-standalone channels exit 1 with `errorCode: managed_install` and an upgrade or migration command:
 
 | Detected channel | Hint |
 |---|---|
 | npm (`node_modules` path component) | project-local (the directory holding the outermost `node_modules` has a `package.json`, and it is not directly under `lib`/`npm` or below a yarn/pnpm `global` store): `npm install @socketsecurity/socket-patch@latest`, or `vlt install @socketsecurity/socket-patch@latest` when that directory holds `vlt-lock.json`, or `vlx -y -- @socketsecurity/socket-patch@latest …` when its `package.json` is vlx's (`"name": "vlx"`, the vlx cache); otherwise global (including version-manager prefixes such as nvm-windows and fnm): `npm update -g @socketsecurity/socket-patch` |
-| PyPI wheel (`site-packages`/`dist-packages`) | `pip install --upgrade socket-patch` |
+| Legacy PyPI wheel (`site-packages`/`dist-packages`) | `pip uninstall socket-patch` followed by the standalone installer (macOS/Linux) or `npm install -g @socketsecurity/socket-patch` (Windows) |
 | `cargo install` (`$CARGO_HOME/bin`, `~/.cargo/bin`) | `cargo install socket-patch-cli` |
-| gem launcher cache (`<cache>/socket-patch/bin/…`) | `gem update socket-patch` |
+| Legacy gem launcher cache (`<cache>/socket-patch/bin/…`) | `gem uninstall socket-patch` followed by the standalone installer (macOS/Linux) or `npm install -g @socketsecurity/socket-patch` (Windows) |
 | Homebrew (`Cellar`, `/opt/homebrew`) | `brew upgrade socket-patch` |
 
+v5 publishes only standalone binaries, Cargo crates, and npm packages. Legacy
+PyPI and RubyGems locations remain detectable so self-update does not silently
+replace a binary owned by an old package. The standalone migration command is
+`curl -fsSL https://install.socket.dev/patch | sh`.
+
 **Pipeline order** (each step gates the next; a failure at any point leaves the installed binary untouched): fetch `SHA256SUMS` → fetch the archive (`socket-patch-<target-triple>.tar.gz`/`.zip`, explicit timeouts, size caps) → verify the SHA-256 **before** extraction → extract the single expected member → stage as an executable sibling **in the install directory** (`EACCES` here is the permissions preflight → exit 1 with a sudo hint; system temp is never used, so `noexec` mounts don't matter) → run the staged binary's `--version` self-check (against real GitHub the reported version must equal the release tag; under a `SOCKET_UPDATE_BASE_URL` override a mismatch only warns) → one atomic rename over the install path (mode-preserving; a **setuid/setgid** target — or, on Linux, one carrying **file capabilities** (`setcap`) — is refused, since an unprivileged swap cannot restore those grants; Windows uses the rename-dance via `self-replace`). Concurrent updates are single-flighted per environment by an advisory lock at `<state dir>/update.lock` (`errorCode: update_in_progress`; the OS releases a dead holder's lock, so there is no stale-lock state). Two updaters whose state dirs diverge (e.g. different `$HOME`s targeting one shared `/usr/local/bin`) are not serialized, but every path to the destination is a whole-file rename and stage cleanup is age-gated — the worst case is duplicated work, never a torn binary.
 
 **Envelope.** `command: "update"`. Success events: `downloaded` (`details: {asset, bytes, sha256}`) then `updated` (`details: {from, to, path, target}`). No-op: `skipped` with reason `already_latest`. Dry-run: `verified` with reason `update_check`. Non-fatal advisories ride the run-level `warnings[]` (`{code, detail}`, omitted when empty) — human runs print the same text to stderr as `Warning: <detail>` (first letter capitalized), and `--json` (which silences stderr) carries them here instead so an override is never silent: `managed_install_override` (a `--force` run replaced a package-manager-owned binary that manager's next upgrade will overwrite) and `update_warning` (a non-fatal note from the update engine, today the relaxed version self-check under a `SOCKET_UPDATE_BASE_URL` override). Top-level `errorCode` values (stable): `offline`, `managed_install`, `check_failed`, `asset_not_found`, `download_failed`, `checksum_mismatch`, `verify_failed`, `swap_failed`, `permission_denied`, `update_in_progress`. Exit codes: 0 success / no-op / dry-run; 1 operational failure; 2 usage.
 
-**Trust model.** Checksum-only, rooted in HTTPS + GitHub (identical to install.sh and the launcher wrappers): `SHA256SUMS` is served from the same origin as the archives, there are no signatures yet. Downloads are credential-free — the Socket API bearer is never sent to the release host — and non-HTTPS redirect hops are refused when talking to the default endpoints.
+**Trust model.** Checksum-only, rooted in HTTPS + GitHub (identical to install.sh): `SHA256SUMS` is served from the same origin as the archives, there are no signatures yet. Downloads are credential-free — the Socket API bearer is never sent to the release host — and non-HTTPS redirect hops are refused when talking to the default endpoints.
 
 ### Passive update notice
 
@@ -1124,11 +1129,10 @@ Env-only knobs (no CLI flag) read by the vendor auto-fetch / artifact-rebuild pa
 
 ### Internal env vars (no stability guarantee)
 
-These exist for staged rollouts and the launcher wrappers. They are **internal**: names, semantics, and existence may change in any release without a semver bump.
+These exist for mirrors and testing. They are **internal**: names, semantics, and existence may change in any release without a semver bump.
 
 | Env var | Purpose |
 |---|---|
-| `SOCKET_PATCH_BIN` | Points the RubyGems CLI launcher and the gem Bundler plugin at an existing `socket-patch` binary (skips the download-on-first-run). |
 | `SOCKET_UPDATE_BASE_URL` | Points BOTH the release-metadata and asset-download routes of `--update`/the update notice at one base (mirror or test fixture) instead of `github.com` + `api.github.com`. Overriding it relaxes the downloaded binary's version self-check from hard-fail to warning. |
 | `SOCKET_UPDATE_STATE_DIR` | Overrides the per-user dir holding `update-check.json` + `update.lock` (tests point it into a tempdir). |
 | `SOCKET_UPDATE_TIMEOUT_MS` | Caps the update fetches' connect/metadata/download budgets (defaults 10 s / 30 s / 300 s; the notice's fetch defaults to 2 s). Doubles as the slow-network escape hatch. |
@@ -1655,7 +1659,7 @@ When verification is enabled (the default) and a patch is omitted, the failed PU
 
 ## Semver policy
 
-Versioning lives in **`Cargo.toml`** at the workspace root (`version = "..."`) and is propagated to every ecosystem wrapper and launcher package by **`scripts/version-sync.sh <new-version>`** (the full list of stamped files is below).
+Versioning lives in **`Cargo.toml`** at the workspace root (`version = "..."`) and is propagated to the Cargo and npm packages by **`scripts/version-sync.sh <new-version>`** (the full list of stamped files is below).
 
 | Change | Bump |
 |---|---|
@@ -1687,20 +1691,19 @@ scripts/version-sync.sh <new-version>
 
 This syncs the workspace package version into:
 
-- `npm/socket-patch/package.json` (and its `optionalDependencies`)
+- `Cargo.toml` (workspace version and the exact `socket-patch-core` dependency pin)
+- `npm/socket-patch/package.json` (and its `optionalDependencies`) and `package-lock.json`
 - every per-platform `npm/socket-patch-*/package.json`
-- `pypi/socket-patch/pyproject.toml`
-- `gem/socket-patch/socket-patch.gemspec` + its launcher `VERSION` (the RubyGems CLI launcher)
-
-All ecosystem publishing fans out from the single
-**`.github/workflows/release.yml`** dispatch: one run publishes crates.io,
-npm, and PyPI plus the CLI launcher gem (`socket-patch` on RubyGems). Each
-registry leg lives in its own workflow
-(`.github/workflows/publish-{cargo,npm,pypi,rubygems}.yml`), dispatched at
-the release tag by the release run and also independently dispatchable to
-retry one registry against an existing release. The npm, PyPI, and
-launcher-gem legs are gated on the GitHub release — with its binaries and
-`SHA256SUMS` — existing.
+
+Publishing fans out from the single **`.github/workflows/release.yml`**
+dispatch: one run creates a GitHub release with standalone binaries and
+`SHA256SUMS`, and publishes the crates.io and npm packages. The binary is
+the preferred install via `https://install.socket.dev/patch`; npm also
+supplies the official Socket CLI. Each registry leg lives in its own
+workflow (`.github/workflows/publish-{cargo,npm}.yml`), dispatched at the
+release tag and independently dispatchable to retry one registry against
+an existing release. The npm leg waits for the GitHub release so it can
+package those same binaries. See [the release runbook](../../docs/releasing.md).
 
 ## How the contract is enforced
 
diff --git a/crates/socket-patch-cli/src/commands/update.rs b/crates/socket-patch-cli/src/commands/update.rs
index d75138fd..fea0d06a 100644
--- a/crates/socket-patch-cli/src/commands/update.rs
+++ b/crates/socket-patch-cli/src/commands/update.rs
@@ -41,8 +41,7 @@ pub struct UpdateArgs {
     /// Exact version to install instead of the latest release (e.g.
     /// `socket-patch --update 3.4.0`). An explicit pin installs that
     /// version even if it is older than the current one. Also settable via
-    /// SOCKET_PATCH_VERSION — the same pin install.sh and the gem launcher
-    /// honor.
+    /// SOCKET_PATCH_VERSION — the same pin install.sh honors.
     //
     // Not named `version`: under `propagate_version` clap already owns a
     // `--version` arg id on every subcommand, and the collision panics at
@@ -55,7 +54,7 @@ pub struct UpdateArgs {
     pub pin_version: Option<String>,
 
     /// Proceed even when this install looks package-manager-managed
-    /// (npm/pip/cargo/Homebrew/launcher), and reinstall even when already
+    /// (e.g. npm or cargo), and reinstall even when already
     /// on the requested version.
     #[arg(
         long,
@@ -144,10 +143,13 @@ fn confirm_prompt(current: &semver::Version, target: &semver::Version) -> String
     }
 }
 
-
 /// The result line after a successful install, naming the same action as
 /// [`confirm_prompt`].
-fn installed_message(current: &semver::Version, target: &semver::Version, path: &std::path::Path) -> String {
+fn installed_message(
+    current: &semver::Version,
+    target: &semver::Version,
+    path: &std::path::Path,
+) -> String {
     let path = path.display();
     if target < current {
         format!("Downgraded socket-patch {current} \u{2192} {target} ({path})")
diff --git a/crates/socket-patch-cli/tests/update/self_update_channels_e2e.rs b/crates/socket-patch-cli/tests/update/self_update_channels_e2e.rs
index 526100ba..6ec85f7e 100644
--- a/crates/socket-patch-cli/tests/update/self_update_channels_e2e.rs
+++ b/crates/socket-patch-cli/tests/update/self_update_channels_e2e.rs
@@ -53,7 +53,10 @@ async fn npm_project_local_refuses_with_local_hint() {
         "a project install must get the in-project upgrade command: {stderr}"
     );
     assert!(!stderr.contains("npm update -g"), "{stderr}");
-    assert!(stderr.starts_with("Error: This socket-patch binary ("), "{stderr}");
+    assert!(
+        stderr.starts_with("Error: This socket-patch binary ("),
+        "{stderr}"
+    );
 }
 
 /// An npm-bundled binary (any `node_modules` component) refuses with the
@@ -109,10 +112,10 @@ async fn npm_bundled_refuses_with_npm_hint() {
     release.verify_request_hygiene().await;
 }
 
-/// A PyPI-wheel-bundled binary (`site-packages` component) refuses with
-/// the pip upgrade command.
+/// A legacy PyPI-wheel-bundled binary (`site-packages` component) refuses
+/// in-place updates and points at a supported v5 distribution.
 #[tokio::test]
-async fn pip_bundled_refuses_with_pip_hint() {
+async fn pip_bundled_refuses_with_migration_hint() {
     let install = staged_install_at("venv/lib/python3.12/site-packages/socket_patch/bin");
 
     let (code, _stdout, stderr) = run_installed(
@@ -125,8 +128,13 @@ async fn pip_bundled_refuses_with_pip_hint() {
         "pip-managed install must refuse.\nstderr:\n{stderr}"
     );
     assert!(
-        stderr.contains("pip install --upgrade socket-patch"),
-        "refusal must route to pip's own upgrade command: {stderr}"
+        stderr.contains("pip uninstall socket-patch && ")
+            && stderr.contains(if cfg!(windows) {
+                "npm install -g @socketsecurity/socket-patch"
+            } else {
+                "curl -fsSL https://install.socket.dev/patch | sh"
+            }),
+        "refusal must route to a supported v5 distribution: {stderr}"
     );
 
     install.assert_binary_intact();
@@ -173,14 +181,14 @@ async fn cargo_install_refuses_with_cargo_hint() {
     install.assert_only_binary_present();
 }
 
-/// The gem launcher execs a per-version cached binary under
+/// The legacy gem launcher execs a per-version cached binary under
 /// `<cache>/socket-patch/bin/<version>/<triple>/`; replacing the cache
 /// entry is meaningless (the launcher re-resolves every run), so the
-/// refusal points at the gem's own upgrade command.
+/// refusal points at a supported v5 distribution.
 /// Unix resolution goes through XDG_CACHE_HOME.
 #[cfg(unix)]
 #[tokio::test]
-async fn launcher_cache_refuses_with_gem_hint() {
+async fn launcher_cache_refuses_with_migration_hint() {
     let install = staged_install_at("cache/socket-patch/bin/3.3.0/x86_64-unknown-linux-gnu");
     let cache_root = install
         .root
@@ -203,9 +211,10 @@ async fn launcher_cache_refuses_with_gem_hint() {
         "launcher-cache install must refuse.\nstderr:\n{stderr}"
     );
     assert!(
-        stderr.contains("gem update"),
-        "the launcher-cache refusal must point at the gem's own upgrade \
-         command: {stderr}"
+        stderr.contains(
+            "gem uninstall socket-patch && curl -fsSL https://install.socket.dev/patch | sh"
+        ),
+        "the launcher-cache refusal must point at the standalone installer: {stderr}"
     );
 
     install.assert_binary_intact();
@@ -216,7 +225,7 @@ async fn launcher_cache_refuses_with_gem_hint() {
 /// %LOCALAPPDATA% there (no ~/.cache convention).
 #[cfg(windows)]
 #[tokio::test]
-async fn launcher_cache_refuses_with_gem_hint_windows() {
+async fn launcher_cache_refuses_with_migration_hint_windows() {
     let install = staged_install_at("cache/socket-patch/bin/3.3.0/x86_64-pc-windows-msvc");
     // Canonicalized for the same reason as the unix rows: the exe path is
     // canonicalized (verbatim \\?\ form on Windows), so the root must be
@@ -242,9 +251,9 @@ async fn launcher_cache_refuses_with_gem_hint_windows() {
         "launcher-cache install must refuse.\nstderr:\n{stderr}"
     );
     assert!(
-        stderr.contains("gem update"),
-        "the launcher-cache refusal must point at the gem's own upgrade \
-         command: {stderr}"
+        stderr
+            .contains("gem uninstall socket-patch && npm install -g @socketsecurity/socket-patch"),
+        "the launcher-cache refusal must point at the npm distribution: {stderr}"
     );
 
     install.assert_binary_intact();
diff --git a/crates/socket-patch-core/src/update/channel.rs b/crates/socket-patch-core/src/update/channel.rs
index 32a8c788..0b5e332a 100644
--- a/crates/socket-patch-core/src/update/channel.rs
+++ b/crates/socket-patch-core/src/update/channel.rs
@@ -2,13 +2,12 @@
 //!
 //! socket-patch ships through several channels, and only the standalone
 //! ones (install.sh, manual tarball copy) own a binary that self-update may
-//! replace. npm and PyPI bundle the binary inside a version-pinned package
-//! directory — swapping it there desyncs the package manager's metadata and
-//! the next `npm install` / `pip install` silently reverts the update. The
-//! gem launcher execs a per-version cached binary it re-resolves on every
-//! run, so replacing the cache entry is meaningless.
-//! For all of those, `--update` refuses and prints the channel's own
-//! upgrade command instead (`--force` overrides).
+//! replace. npm bundles the binary inside a version-pinned package directory;
+//! swapping it there desyncs the package manager's metadata. Legacy PyPI
+//! installs and RubyGems launcher caches remain protected for the same reason,
+//! but their hints migrate to a supported distribution: v5 no longer publishes
+//! those packages. `--update` refuses managed installs and prints an upgrade
+//! or migration command instead (`--force` overrides).
 //!
 //! Detection is a pure function over the canonicalized executable path plus
 //! a snapshot of the relevant environment, so the heuristics are
@@ -25,13 +24,13 @@ pub enum InstallChannel {
     /// Inside a `node_modules` tree (the npm platform packages bundle the
     /// binary; the JS shim spawns it from there).
     Npm,
-    /// Inside `site-packages`/`dist-packages` (the PyPI wheel bundles the
+    /// Inside `site-packages`/`dist-packages` (the pre-v5 PyPI wheel bundled the
     /// binary under `socket_patch/bin/`).
     Pypi,
     /// Under `$CARGO_HOME/bin` — managed by `cargo install`.
     Cargo,
     /// Under the launcher cache (`<cache>/socket-patch/bin/…`) used by the
-    /// RubyGems launcher.
+    /// pre-v5 RubyGems launcher.
     LauncherCache,
     /// Under a Homebrew prefix (`Cellar`, `/opt/homebrew`).
     Homebrew,
@@ -100,14 +99,24 @@ pub fn detect_channel(canonical_exe: &Path, env: &ChannelEnv) -> InstallChannel
     InstallChannel::Standalone
 }
 
-/// The channel's own upgrade command, shown when `--update` refuses.
+/// The channel's upgrade or migration command, shown when `--update` refuses.
 pub fn upgrade_hint(channel: InstallChannel) -> &'static str {
     match channel {
         InstallChannel::Standalone => "socket-patch --update",
         InstallChannel::Npm => "npm update -g @socketsecurity/socket-patch",
-        InstallChannel::Pypi => "pip install --upgrade socket-patch",
+        InstallChannel::Pypi if cfg!(windows) => {
+            "pip uninstall socket-patch && npm install -g @socketsecurity/socket-patch"
+        }
+        InstallChannel::Pypi => {
+            "pip uninstall socket-patch && curl -fsSL https://install.socket.dev/patch | sh"
+        }
         InstallChannel::Cargo => "cargo install socket-patch-cli",
-        InstallChannel::LauncherCache => "gem update socket-patch",
+        InstallChannel::LauncherCache if cfg!(windows) => {
+            "gem uninstall socket-patch && npm install -g @socketsecurity/socket-patch"
+        }
+        InstallChannel::LauncherCache => {
+            "gem uninstall socket-patch && curl -fsSL https://install.socket.dev/patch | sh"
+        }
         InstallChannel::Homebrew => "brew upgrade socket-patch",
     }
 }
@@ -142,8 +151,7 @@ fn is_vlx_cache_dir(dir: &Path) -> bool {
     crate::utils::fs::read_regular_to_string_sync(&dir.join("package.json"))
         .ok()
         .and_then(|text| {
-            serde_json::from_str::<serde_json::Value>(crate::utils::serde::strip_bom(&text))
-                .ok()
+            serde_json::from_str::<serde_json::Value>(crate::utils::serde::strip_bom(&text)).ok()
         })
         .is_some_and(|pkg| pkg.get("name").and_then(|n| n.as_str()) == Some("vlx"))
 }
@@ -215,11 +223,10 @@ fn cargo_bin_dir(env: &ChannelEnv) -> Option<PathBuf> {
     env.home.as_ref().map(|h| h.join(".cargo").join("bin"))
 }
 
-/// Cache roots the gem launcher resolves, in its probe order:
+/// Cache roots the pre-v5 gem launcher resolved, in its probe order:
 /// `$XDG_CACHE_HOME`, `~/.cache`, `%LOCALAPPDATA%`, and the launcher's
 /// Windows fallback when LOCALAPPDATA is unset — `~/AppData/Local`
-/// (launcher.rb: `ENV["LOCALAPPDATA"] || File.join(Dir.home, "AppData",
-/// "Local")`).
+/// (`ENV["LOCALAPPDATA"] || File.join(Dir.home, "AppData", "Local")`).
 fn launcher_cache_roots(env: &ChannelEnv) -> Vec<PathBuf> {
     let mut roots = Vec::new();
     if let Some(xdg) = &env.xdg_cache_home {
@@ -655,9 +662,7 @@ mod tests {
     #[test]
     fn hints_route_to_the_owning_manager() {
         assert!(upgrade_hint(InstallChannel::Npm).contains("npm update -g"));
-        assert!(upgrade_hint(InstallChannel::Pypi).contains("pip install --upgrade"));
         assert!(upgrade_hint(InstallChannel::Cargo).contains("cargo install"));
-        assert!(upgrade_hint(InstallChannel::LauncherCache).contains("gem update"));
         assert!(upgrade_hint(InstallChannel::Homebrew).contains("brew upgrade"));
         assert!(upgrade_hint(InstallChannel::Standalone).contains("--update"));
     }
diff --git a/crates/socket-patch-core/src/update/state.rs b/crates/socket-patch-core/src/update/state.rs
index 0a2ef0c2..d0ec6669 100644
--- a/crates/socket-patch-core/src/update/state.rs
+++ b/crates/socket-patch-core/src/update/state.rs
@@ -3,8 +3,7 @@
 //! notifier never nags about a version the user just installed).
 //!
 //! This is disposable *cache* state, not configuration: it lives under the
-//! per-user cache root (the same root the gem launcher uses for its
-//! binary cache) and every read tolerates absence, corruption, and
+//! per-user cache root and every read tolerates absence, corruption, and
 //! clock skew by degrading to "never checked". Nothing in here may ever
 //! fail a command — callers treat all errors as "skip the check".
 
@@ -51,8 +50,7 @@ pub fn unix_now() -> u64 {
 /// Directory holding the state file (and the update lock). Resolution:
 /// `SOCKET_UPDATE_STATE_DIR` (internal override so tests never touch the
 /// real per-user dir) → `$XDG_CACHE_HOME` → `~/.cache` (all Unix flavors,
-/// macOS included — deliberately the launchers' shared cache root, not
-/// `~/Library/Caches`) → `%LOCALAPPDATA%` → `%USERPROFILE%\AppData\Local`
+/// macOS included) → `%LOCALAPPDATA%` → `%USERPROFILE%\AppData\Local`
 /// (Windows). `None` = no resolvable base; callers silently skip.
 pub fn state_dir() -> Option<PathBuf> {
     fn env_dir(name: &str) -> Option<PathBuf> {
diff --git a/docs/design/v5-plan.md b/docs/design/v5-plan.md
index 7d3612f2..9a516aa1 100644
--- a/docs/design/v5-plan.md
+++ b/docs/design/v5-plan.md
@@ -170,21 +170,19 @@ patch-UI review.
 ### WS7 — Remove `setup`  *(branch `v5/remove-setup`)*
 - Delete the `setup` subcommand, core/setup/**, package_json/** helpers only
   setup uses, the setup-matrix CI job, and the Bundler plugin gem +
-  `socket-patch-hook` wheel publishing (or mark them deprecated/unpublished;
-  confirm with owner before deleting release workflows). Keep `apply`.
+  `socket-patch-hook` wheel publishing. Keep `apply`.
   Docs: agent mode = `scan --mode agent` + `socket-patch apply` in CI.
 - **Status (branch `v5/remove-setup-and-ui`):** subcommand, core `setup/` +
   `package_json/`, setup tests, `setup-e2e` feature, setup-matrix CI job,
   `tests/setup_matrix/`, `scripts/setup-matrix.sh` and the setup-only
   `Dockerfile.gem-b1`/`gem-b4` are deleted. vex's "Property 7" filter went
   with it (agent patches attest on verification; `setup.manual` is parsed
-  but ignored). The `socket-patch-hook` wheel and `socket-patch-bundler` gem
-  are out of `publish-pypi.yml` / `publish-rubygems.yml`,
-  `build-pypi-wheels.py` and `version-sync.sh`, and the `socket-patch[hook]`
-  extra is dropped. **Owner decision pending:** `pypi/socket-patch-hook/`
-  and `gem/socket-patch-bundler/` sources are kept (frozen, README marked
-  deprecated) — delete them, and optionally yank/deprecate the published
-  packages and remove their PyPI/RubyGems trusted publishers, once confirmed.
+  but ignored). The v5 distribution cleanup removes the PyPI and RubyGems
+  CLI packages and both hook packages, including their sources, tests,
+  publishing workflows, wheel builder, and version-sync entries. The
+  supported distributions are the standalone binary via `install.socket.dev`
+  (preferred), Cargo crates, and npm (required by the official Socket CLI).
+  Previously published package versions remain available for older users.
 
 ### WS8 — Patch UI streamlining  *(branch `v5/ui`)*
 - `-h` shows ~8 options (hide_short_help for the rest); hide deprecated
diff --git a/docs/installer-hosting.md b/docs/installer-hosting.md
index 03dd68a2..ae03fd50 100644
--- a/docs/installer-hosting.md
+++ b/docs/installer-hosting.md
@@ -70,7 +70,7 @@ Unchanged by the hosting move, and worth being precise about:
 - **The binary** is fetched from the GitHub release and verified against that
   release's `SHA256SUMS` before it is unpacked. Neither the script nor the
   checksums are signed — this is checksum integrity rooted in HTTPS plus GitHub,
-  the same model `--update` and the gem launcher use (see
+  the same model `--update` uses (see
   [CLI_CONTRACT.md](../crates/socket-patch-cli/CLI_CONTRACT.md)).
 - Nothing in the install path sends a Socket API token anywhere.
 
diff --git a/docs/releasing.md b/docs/releasing.md
index a20205fb..383d6ed7 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -1,15 +1,17 @@
 # Releasing socket-patch — publish runbook
 
 One release = one version-bump PR + one dispatch of the **Release** workflow.
-The CLI publishes to five channels, all from that single dispatch:
+The CLI publishes to three channels, all from that single dispatch:
 
 | Channel | Package(s) | Auth |
 |---------|------------|------|
-| GitHub release | prebuilt binaries for 14 targets + `SHA256SUMS` (also feeds `install.socket.dev` / `scripts/install.sh`, `--update`, and the gem launcher) | workflow `GITHUB_TOKEN` |
+| Standalone binary (preferred) | GitHub release archives for 14 targets + `SHA256SUMS`; installed via `install.socket.dev/patch`, updated with `--update` | workflow `GITHUB_TOKEN` |
 | crates.io | `socket-patch-core`, `socket-patch-cli` | OIDC trusted publishing, no environment |
 | npm | `@socketsecurity/socket-patch` + 14 platform packages | OIDC via `npm stage publish`; **manual 2FA approval** |
-| PyPI | `socket-patch`, `socket-patch-hook` | OIDC trusted publishing; environment `pypi` |
-| RubyGems | `socket-patch` (launcher gem), `socket-patch-bundler` | OIDC trusted publishing; environment `rubygems` |
+
+The npm distribution is also required by the official Socket CLI. v5 no longer
+builds or publishes the PyPI and RubyGems CLI packages or their install hooks.
+See the [migration instructions](../README.md#migrating-from-pypi-or-rubygems).
 
 ## 1. Write the release notes
 
@@ -22,14 +24,13 @@ a release whose CHANGELOG section is missing or empty.
 From a developer machine (preferred — CI runs on the PR normally):
 
 ```sh
-scripts/bump-version.sh 3.4.0 --pr
+scripts/bump-version.sh 5.0.0 --pr
 ```
 
-This stamps `3.4.0` into every packaging site (`scripts/version-sync.sh`:
-`Cargo.toml`, the npm main + platform packages and lockfile, both PyPI
-`pyproject.toml`s, both gemspecs and the gem launcher constant), rolls
-`[Unreleased]` into a dated `## [3.4.0]` section, and opens a
-`release/v3.4.0` PR whose body carries the rolled-over notes.
+This stamps `5.0.0` into every packaging site (`scripts/version-sync.sh`:
+`Cargo.toml`, the npm main + platform packages and lockfile), rolls
+`[Unreleased]` into a dated `## [5.0.0]` section, and opens a
+`release/v5.0.0` PR whose body carries the rolled-over notes.
 
 Alternatively, dispatch the **Version Bump** workflow from the Actions tab
 (input: the new version). Caveat: a PR opened by a workflow's `GITHUB_TOKEN`
@@ -50,12 +51,11 @@ publishing.
 
 The real run: re-verifies the release gate → builds the matrix → creates and
 pushes `v<version>` → creates the GitHub release with `SHA256SUMS` → fans out
-to crates.io, npm, PyPI, and RubyGems in parallel (all OIDC trusted
+to crates.io and npm in parallel (both use OIDC trusted
 publishing; no long-lived registry secrets). Each registry leg is its own
-workflow (`publish-cargo.yml`, `publish-npm.yml`, `publish-pypi.yml`,
-`publish-rubygems.yml`), dispatched at the release tag by the release run
-and watched to completion, so the release run's job graph still reflects
-each registry's outcome (its step summaries link the four leg runs) — and
+workflow (`publish-cargo.yml`, `publish-npm.yml`), dispatched at the release
+tag by the release run and watched to completion, so the job graph still reflects
+each registry's outcome (its step summaries link both leg runs) — and
 each leg can equally be dispatched by hand (see "If a job fails
 mid-release"). The `release.yml` header records why the legs are dispatched
 runs rather than reusable workflows (registry trusted-publisher filename
@@ -71,19 +71,15 @@ release run's `npm-publish` job summary links to that run), the
 [org staged-packages dashboard](https://www.npmjs.com/settings/socketsecurity/staged-packages),
 or the CLI (`npm stage list` / `npm stage approve <stage-id>`, npm 11.15+).
 
-The other channels go live without human action; the RubyGems launcher gem
-fetches its binary from the GitHub release at run time.
+The standalone binaries and Cargo crates go live without human action.
 
 ## 5. Verify
 
 ```sh
-V=3.4.0
+V=5.0.0
 gh release view "v$V" --repo SocketDev/socket-patch          # binaries + SHA256SUMS
 cargo info socket-patch-cli | grep "$V"                      # crates.io
 npm view "@socketsecurity/socket-patch@$V" version           # npm (after approval)
-curl -sf "https://pypi.org/pypi/socket-patch/$V/json" >/dev/null && echo pypi ok
-curl -sf "https://pypi.org/pypi/socket-patch-hook/$V/json" >/dev/null && echo hook ok
-gem list --remote --exact --all socket-patch | grep "$V"     # rubygems
 ```
 
 End-to-end smoke test of the installer path:
@@ -106,12 +102,12 @@ partial release never requires deleting tags or re-bumping.
 2. **Dispatch the failed registry's own workflow** — right when the fix
    needed a change (registry-side config such as a trusted publisher, or a
    workflow edit landed on the default branch): Actions → **Publish
-   crates.io** / **Publish npm** / **Publish PyPI** / **Publish RubyGems** →
+   crates.io** / **Publish npm** →
    Run workflow, entering the release version (`X.Y.Z`, no `v`) and leaving
    the other inputs blank. This runs the publish workflow as it exists on the
    dispatched branch (default: the default branch), so workflow fixes apply.
    Nothing rebuilds: each publish workflow checks out the `v<version>` tag
-   and (npm/PyPI) takes the prebuilt binaries from the GitHub release's
+   and npm takes the prebuilt binaries from the GitHub release's
    assets, verified against `SHA256SUMS` — the same inputs the release run
    would have published. The GitHub release must exist with all assets, so
    failures in `build`, `tag`, or `github-release` itself are still fixed
@@ -119,14 +115,9 @@ partial release never requires deleting tags or re-bumping.
 
 ## One-time registry setup
 
-Deployment environments (`pypi`, `rubygems`) and each registry's trusted
-publisher are listed in the checklist of
-[PR #138](https://github.com/SocketDev/socket-patch/pull/138). All four
-registry channels authenticate via OIDC trusted publishing, so a missing or
-misconfigured trusted publisher (or environment) **fails that channel's
-job** — configure it before dispatching a real release. The one
-non-blocking push is the `socket-patch-bundler` gem (`continue-on-error`
-Phase-2 scaffolding).
+Both registries authenticate via OIDC trusted publishing, so a missing or
+misconfigured trusted publisher **fails that channel's job** — configure it
+before dispatching a real release. Neither workflow uses a deployment environment.
 
 Since the publish legs moved into their own workflow files, each trusted
 publisher is registered against repo `SocketDev/socket-patch` + **the
@@ -134,20 +125,15 @@ publish workflow's filename** (not `release.yml`). The legs only ever run
 as top-level `workflow_dispatch` runs of their own file — whether the
 release run dispatched them or a maintainer did — so the OIDC token's
 `workflow_ref` and `job_workflow_ref` claims both name that file, and one
-registration per package satisfies every registry's matching rule (npm and
-crates.io match the top-level workflow; PyPI and RubyGems match the
-job-defining workflow).
-
-| Registry | Publisher workflow | Environment |
-|----------|--------------------|-------------|
-| crates.io (`socket-patch-core`, `socket-patch-cli`) | `publish-cargo.yml` | — |
-| npm (main + 14 platform packages) | `publish-npm.yml` | — |
-| PyPI (`socket-patch`, `socket-patch-hook`) | `publish-pypi.yml` | `pypi` |
-| RubyGems (`socket-patch`, `socket-patch-bundler`) | `publish-rubygems.yml` | `rubygems` |
-
-**Migration from the `release.yml` publishers:** crates.io (up to 5 configs
-per crate), PyPI, and RubyGems (both: multiple publishers per package) can
-carry the old `release.yml` publisher alongside the new one until every
+registration per package satisfies both registries' top-level workflow matching.
+
+| Registry | Publisher workflow |
+|----------|--------------------|
+| crates.io (`socket-patch-core`, `socket-patch-cli`) | `publish-cargo.yml` |
+| npm (main + 14 platform packages) | `publish-npm.yml` |
+
+**Migration from the `release.yml` publishers:** crates.io can carry the
+old `release.yml` publisher alongside the new one until every
 release run predating this split — whose re-run legs still authenticate as
 `release.yml` — has fully landed; then delete the `release.yml` publishers.
 npm allows only **one** trusted publisher per package, so its cutover is
diff --git a/gem/socket-patch-bundler/README.md b/gem/socket-patch-bundler/README.md
deleted file mode 100644
index 5e49e857..00000000
--- a/gem/socket-patch-bundler/README.md
+++ /dev/null
@@ -1,41 +0,0 @@
-# socket-patch-bundler
-
-> **Deprecated — no longer published.** `socket-patch setup` (which wired this
-> plugin) was removed in socket-patch v5, and this gem is no longer built or
-> published. In agent mode, run `socket-patch apply` in CI after
-> `bundle install` instead. The source is kept for reference only.
-> To remove the hook from a project, see
-> [Upgrading from `setup`](https://github.com/SocketDev/socket-patch#upgrading-from-setup).
-
-A [Bundler plugin](https://bundler.io/guides/bundler_plugins.html) that keeps the
-gem patches recorded in your project's `.socket/manifest.json` applied on every
-`bundle install` — cached **and** fresh — by re-running the
-[`socket-patch`](https://github.com/SocketDev/socket-patch) CLI.
-
-> **Status: Phase 2 (scaffolding).** `socket-patch setup` currently wires the gem
-> ecosystem by committing an in-tree copy of this plugin under
-> `.socket/bundler-plugin/` and referencing it from the `Gemfile` via a `path:`
-> source (`plugin 'socket-patch', path: File.expand_path('.socket/bundler-plugin', __dir__)`).
-> This published gem is the planned replacement; once it is published to
-> RubyGems, a follow-up switches the generated `Gemfile` directive to
-> `plugin "socket-patch-bundler", "~> <major.minor>"`.
-
-## Requirements
-
-The `socket-patch` CLI must be on `PATH` (or pointed at by `SOCKET_PATCH_BIN`)
-wherever `bundle install` runs — the same requirement as the in-tree plugin and
-the cargo build-time guard.
-
-## How it works
-
-Two triggers feed one idempotent applier: a load-time pass (covers cached/no-op
-installs) and an `after-install-all` hook (covers fresh installs). A digest of
-the manifest + committed `.socket/` files + `Gemfile.lock` + the patch-target
-files gates the work; the digest is cached in `.socket/gem-plugin-stamp`
-(machine-local, safe to gitignore or delete). On a patch failure it warns
-(naming the failure and the remediation) and lets `bundle install` continue;
-set `SOCKET_PATCH_STRICT=1` to raise `Bundler::BundlerError` instead.
-
-## License
-
-MIT
diff --git a/gem/socket-patch-bundler/plugins.rb b/gem/socket-patch-bundler/plugins.rb
deleted file mode 100644
index 32b3bfdb..00000000
--- a/gem/socket-patch-bundler/plugins.rb
+++ /dev/null
@@ -1,314 +0,0 @@
-# socket-patch Bundler plugin (published-gem form).
-#
-# Keeps the gem patches recorded in .socket/manifest.json applied by
-# re-running the socket-patch CLI whenever Bundler touches the gem set. This
-# is the Phase-2 published-gem counterpart of the in-tree plugin generated by
-# `socket-patch setup` under .socket/bundler-plugin/; the applier logic is
-# identical, but because a published plugin is loaded from the gem cache (not
-# from inside the repo) it resolves the project root from the bundle context
-# rather than relative to its own location.
-#
-# When each trigger actually runs (verified against bundler 2.7 and 4.0; hook
-# subscriptions are recorded in .bundle/plugin/index at plugin REGISTRATION,
-# and bundler evaluates this file whenever a subscribed event first fires in a
-# bundle process):
-#
-#   * plugin registration — the FIRST `bundle install` evaluates this file
-#     BEFORE any project gem is installed, so the load-time trigger is
-#     bootstrap-gated (no patch target exists yet) and quietly no-ops there;
-#     the install hooks below re-apply once the gems land.
-#   * every `bundle install` — fresh AND fully cached — fires the per-gem
-#     `after-install` events and then `after-install-all`; the forced
-#     `after-install-all` re-apply is the actual patch point.
-#   * `bundle pristine` fires ONLY the per-gem `after-install` events, so that
-#     digest-gated hook is what catches pristine's patch reversion in the same
-#     run. (A checkout registered by an older plugin version keeps its old
-#     subscription set until it re-registers — fresh clones and CI always
-#     re-register, a dev checkout can `rm -rf .bundle/plugin`.)
-#   * nothing fires on `bundle exec` / `bundle check` / plain `ruby`, and
-#     `gem pristine` bypasses bundler entirely — a reversion via those is only
-#     healed at the NEXT `bundle install`.
-#
-# A digest of (manifest + every committed file under .socket/ + Gemfile.lock +
-# the on-disk content of every gem-patch target file) gates the non-forced
-# triggers. The stamp is a pure digest cache at .socket/gem-plugin-stamp —
-# machine-local state, safe to gitignore or delete (deleting only forces one
-# re-probe); a stale copy that reaches version control anyway is harmless on
-# a fresh clone, because the bootstrap gate keys on the patch targets
-# existing on disk, never on the stamp. Older plugin versions stamped a
-# fixed-name file under Bundler.bundle_path (machine-global when no bundle
-# path is configured); that legacy stamp is deleted best-effort when seen.
-#
-# A patch failure NEVER breaks `bundle install`: it prints a warning naming
-# what failed and the remediation. Set SOCKET_PATCH_STRICT=1 to restore
-# raise-on-failure (Bundler::BundlerError). The socket-patch CLI must be on
-# PATH (or pointed at by SOCKET_PATCH_BIN).
-
-require "digest"
-require "fileutils"
-require "json"
-
-module SocketPatch
-  # Bundler evaluates this file twice in a bootstrap install (registration +
-  # first hook load), so constant assignments are guarded against re-runs.
-  BIN_ENV = "SOCKET_PATCH_BIN".freeze unless defined?(BIN_ENV)
-  STRICT_ENV = "SOCKET_PATCH_STRICT".freeze unless defined?(STRICT_ENV)
-  STAMP_NAME = "gem-plugin-stamp".freeze unless defined?(STAMP_NAME)
-  LEGACY_STAMP_NAME = ".socket-patch-gem-stamp".freeze unless defined?(LEGACY_STAMP_NAME)
-  # Bundler's parallel installer can fire per-gem hooks from worker threads;
-  # one applier runs at a time so a single bundle process never races
-  # concurrent `socket-patch apply` children against each other.
-  APPLY_LOCK = Mutex.new unless defined?(APPLY_LOCK)
-
-  module_function
-
-  # A published plugin is loaded from the gem cache, so the project root (where
-  # the Gemfile / .socket/ live) is resolved from the bundle context: prefer
-  # `Bundler.root` (the Gemfile's directory), then walk up from the working
-  # directory to a dir containing .socket/manifest.json, else fall back to cwd.
-  def project_root
-    begin
-      return Bundler.root.to_s if defined?(Bundler) && Bundler.respond_to?(:root) && Bundler.root
-    rescue StandardError
-      # Bundler.root raises outside a bundle context — fall through to the walk.
-    end
-    dir = Dir.pwd
-    loop do
-      return dir if File.file?(File.join(dir, ".socket", "manifest.json"))
-      parent = File.dirname(dir)
-      break if parent == dir
-      dir = parent
-    end
-    Dir.pwd
-  end
-
-  def socket_dir
-    File.join(project_root, ".socket")
-  end
-
-  def manifest_path
-    File.join(socket_dir, "manifest.json")
-  end
-
-  def socket_bin
-    env = ENV[BIN_ENV]
-    env && !env.empty? ? env : "socket-patch"
-  end
-
-  def strict?
-    %w[1 true].include?(ENV[STRICT_ENV].to_s)
-  end
-
-  def bundle_path
-    Bundler.bundle_path.to_s
-  rescue StandardError
-    File.join(project_root, "vendor", "bundle")
-  end
-
-  def stamp_path
-    File.join(socket_dir, STAMP_NAME)
-  end
-
-  # The on-disk files the manifest's gem patches target:
-  # <bundle_path>/gems/<name>-<version>[-<platform>]/<file key sans package/>.
-  # Paths are collected whether or not the file exists — `current_digest`
-  # folds an absence marker, so a gem appearing or vanishing flips the digest.
-  def patch_target_files
-    records = begin
-      JSON.parse(File.read(manifest_path)).fetch("patches", {})
-    rescue StandardError
-      return []
-    end
-    return [] unless records.is_a?(Hash)
-    gems_dir = File.join(bundle_path, "gems")
-    # Dir.glob treats `\` as an escape on EVERY platform, so a Windows-style
-    # bundle path (Bundler.bundle_path carries backslash separators through
-    # verbatim) would never match the platform-gem wildcard below: platform
-    # installs (nokogiri-1.15.0-x64-mingw-ucrt) drop out of the digest and a
-    # `bundle pristine` reversion of them leaves the stamp matching. Forward
-    # slashes are valid separators on Windows, so normalize the GLOB BASE
-    # only — the direct join below is not a pattern and stays byte-faithful.
-    glob_gems_dir = gems_dir.tr("\\", "/")
-    targets = []
-    records.each do |purl, record|
-      next unless purl.is_a?(String) && purl.start_with?("pkg:gem/")
-      coordinate = purl.split("pkg:gem/", 2).last.split("?", 2).first
-      name, at, version = coordinate.rpartition("@")
-      next if at.empty? || name.empty? || version.empty?
-      files = record.is_a?(Hash) ? record["files"] : nil
-      next unless files.is_a?(Hash)
-      files.each_key do |key|
-        rel = key.to_s.sub(%r{\Apackage/}, "")
-        targets << File.join(gems_dir, "#{name}-#{version}", rel)
-        targets.concat(Dir.glob(File.join(glob_gems_dir, "#{name}-#{version}-*", rel)))
-      end
-    end
-    targets.uniq.sort
-  end
-
-  # Files whose change must force a reapply: the manifest, every committed file
-  # under .socket/ (patch blobs etc. — the stamp itself excluded, or each write
-  # would invalidate the digest it records), Gemfile.lock, and the current
-  # on-disk state of every patch target.
-  def digest_inputs
-    inputs = [manifest_path]
-    lock = File.join(project_root, "Gemfile.lock")
-    inputs << lock if File.file?(lock)
-    if File.directory?(socket_dir)
-      Dir.glob(File.join(socket_dir, "**", "*")).sort.each do |p|
-        inputs << p if File.file?(p) && p != stamp_path
-      end
-    end
-    inputs.concat(patch_target_files)
-    inputs.uniq
-  end
-
-  def current_digest
-    d = Digest::SHA256.new
-    digest_inputs.each do |path|
-      d.update(path)
-      d.update("\0")
-      d.update(File.file?(path) ? "+" : "-")
-      begin
-        d.update(File.binread(path))
-      rescue StandardError
-        # Unreadable now -> contributes only its path + absence marker; a later
-        # readable state changes the digest and forces a reapply.
-      end
-      d.update("\0")
-    end
-    d.hexdigest
-  end
-
-  def stamped?(digest)
-    File.file?(stamp_path) && File.read(stamp_path).strip == digest
-  rescue StandardError
-    false
-  end
-
-  def write_stamp(digest)
-    FileUtils.mkdir_p(File.dirname(stamp_path))
-    File.write(stamp_path, digest)
-  rescue StandardError
-    # Best-effort: a missing/unwritable stamp just means we re-probe next time.
-  end
-
-  # Older plugin versions stamped under Bundler.bundle_path. It is never read
-  # anymore; delete it (best-effort, once per process) so it does not linger
-  # as an orphan in a shared gem dir.
-  def remove_legacy_stamp
-    return if @legacy_stamp_checked
-    @legacy_stamp_checked = true
-    legacy = File.join(bundle_path, LEGACY_STAMP_NAME)
-    File.delete(legacy) if File.file?(legacy)
-  rescue StandardError
-    # Best-effort cleanup only.
-  end
-
-  # Tolerant by default: a patch failure must never break `bundle install` —
-  # the first install of a fresh checkout runs the applier before any project
-  # gem exists, and raising there deadlocks the project on its own bootstrap
-  # (plugin registration fails, so every retry fails identically). Warn once
-  # per process with the remediation; SOCKET_PATCH_STRICT=1 restores the raise
-  # for builds that must not proceed unpatched. The trailer states what the
-  # ACTIVE mode does — the strict raise must not claim the install continues.
-  def failure_trailer
-    if strict?
-      "Failing `bundle install` because #{STRICT_ENV} is set; unset it to " \
-        "warn and continue instead."
-    else
-      "`bundle install` continues; set #{STRICT_ENV}=1 to make patch " \
-        "failures fatal."
-    end
-  end
-
-  def report_failure(message)
-    message = "#{message} #{failure_trailer}"
-    if strict?
-      raise(defined?(Bundler::BundlerError) ? Bundler::BundlerError.new(message) : message)
-    end
-    return if @warned
-    @warned = true
-    warn(message)
-  end
-
-  # Idempotent applier behind every trigger. No manifest -> the project does
-  # not use socket-patch, nothing to do.
-  # force: skip the digest gate (the installer just changed the gem set).
-  # bootstrap_gate: bail while NONE of the manifest's gem-patch targets exist
-  # on disk. The load-time trigger and the per-gem after-install hook use it
-  # so a bootstrap install's early evaluations (plugin REGISTRATION runs
-  # before any project gem lands) never shell out, warn, or — in strict mode —
-  # raise while there is nothing to patch; the forced after-install-all pass
-  # does the first real apply once the gems exist. The gate reads only the
-  # live gem tree, never the stamp: a stale stamp committed by mistake cannot
-  # re-open the bootstrap deadlock on a fresh clone, and deleting the stamp
-  # costs one re-probe instead of disabling these triggers.
-  def apply!(force: false, bootstrap_gate: false)
-    APPLY_LOCK.synchronize do
-      return unless File.file?(manifest_path)
-      remove_legacy_stamp
-      return if bootstrap_gate && patch_target_files.none? { |t| File.file?(t) }
-      return if !force && stamped?(current_digest)
-
-      ok = system(
-        socket_bin, "apply",
-        "--ecosystems", "gem", "--offline", "--silent",
-        "--cwd", project_root
-      )
-
-      if ok.nil?
-        report_failure(
-          "socket-patch: could not run `#{socket_bin} apply` — the gem patches in " \
-          ".socket/manifest.json are NOT applied. Install the socket-patch CLI (or set " \
-          "#{BIN_ENV} to its path), then run `socket-patch apply --ecosystems gem` " \
-          "manually."
-        )
-        return
-      elsif !ok
-        report_failure(
-          "socket-patch: `#{socket_bin} apply --ecosystems gem` failed — the gem patches " \
-          "in .socket/manifest.json may NOT be applied. Run `socket-patch apply " \
-          "--ecosystems gem` in #{project_root} to apply them manually."
-        )
-        return
-      end
-
-      if @warned
-        @warned = false
-        warn("socket-patch: gem patches applied; the earlier warning is resolved.")
-      end
-      # Recompute: the apply just rewrote the target files the digest folds in.
-      write_stamp(current_digest)
-    end
-  end
-end
-
-# Trigger 1 — load time. Runs at plugin registration and whenever a subscribed
-# hook event first loads the plugin in a bundle process. Bootstrap-gated on
-# the patch targets existing on disk (never on the stamp — a committed stale
-# stamp must not re-open the registration deadlock): on the bootstrap install
-# no gems exist to patch, so this quietly defers to Trigger 3. In strict mode
-# a genuine patch failure (Bundler::BundlerError) still propagates.
-begin
-  SocketPatch.apply!(bootstrap_gate: true)
-rescue StandardError => e
-  raise if defined?(Bundler::BundlerError) && e.is_a?(Bundler::BundlerError)
-end
-
-# Trigger 2 — after each individual gem (re)install. The only event bundler
-# fires during `bundle pristine`, so this is what catches pristine's patch
-# reversion in the same run — even when the stamp was deleted, since the gate
-# reads the gem tree, not the stamp. Digest- and bootstrap-gated: on a fresh
-# install's per-gem events the targets are only just landing and Trigger 3 is
-# about to do the real work.
-Bundler::Plugin.add_hook("after-install") do |_spec_install|
-  SocketPatch.apply!(bootstrap_gate: true)
-end
-
-# Trigger 3 — after the installer finishes (fresh AND fully-cached installs).
-# Forced, because the install just changed the gem set; the applier is
-# idempotent so a redundant run on an already-patched tree is a cheap no-op.
-Bundler::Plugin.add_hook("after-install-all") do |_install|
-  SocketPatch.apply!(force: true)
-end
diff --git a/gem/socket-patch-bundler/socket-patch-bundler.gemspec b/gem/socket-patch-bundler/socket-patch-bundler.gemspec
deleted file mode 100644
index 986ee96e..00000000
--- a/gem/socket-patch-bundler/socket-patch-bundler.gemspec
+++ /dev/null
@@ -1,25 +0,0 @@
-# frozen_string_literal: true
-
-# Published form of the socket-patch Bundler plugin (CLI_CONTRACT property:
-# "gem" support matrix, Phase 2). `socket-patch setup` today references the
-# in-tree plugin under `.socket/bundler-plugin/` via `path:`; once this gem is
-# published, a follow-up switches the Gemfile directive to
-# `plugin "socket-patch-bundler", "~> <major.minor>"`. The version is kept in
-# sync with the workspace by `scripts/version-sync.sh`.
-Gem::Specification.new do |s|
-  s.name        = "socket-patch-bundler"
-  s.version     = "4.0.0"
-  s.summary     = "Bundler plugin that keeps socket-patch gem patches applied on every bundle install."
-  s.description = "Re-applies the gem patches recorded in a project's .socket/manifest.json on " \
-                  "every `bundle install` (cached and fresh) by invoking the socket-patch CLI. " \
-                  "The CLI must be on PATH (or pointed at by SOCKET_PATCH_BIN)."
-  s.authors     = ["Socket"]
-  s.license     = "MIT"
-  s.homepage    = "https://github.com/SocketDev/socket-patch"
-  s.files       = ["plugins.rb", "README.md"]
-  s.required_ruby_version = ">= 2.6.0"
-  s.metadata = {
-    "source_code_uri" => "https://github.com/SocketDev/socket-patch",
-    "rubygems_mfa_required" => "true",
-  }
-end
diff --git a/gem/socket-patch/README.md b/gem/socket-patch/README.md
deleted file mode 100644
index c2e1791a..00000000
--- a/gem/socket-patch/README.md
+++ /dev/null
@@ -1,34 +0,0 @@
-# socket-patch (RubyGems)
-
-Distributes the [`socket-patch`](https://github.com/SocketDev/socket-patch) CLI
-through RubyGems so it can be installed in Ruby / Bundler environments:
-
-```sh
-gem install socket-patch
-socket-patch --help
-```
-
-This is a thin **launcher** gem. On first run it downloads the prebuilt binary
-for your platform from the GitHub release **matching the installed gem's own
-version** (so `gem install socket-patch -v 3.2.0` fetches the `v3.2.0` binary),
-verifies it against the release's `SHA256SUMS`, caches it under your user cache
-(`~/.cache/socket-patch/bin/` or `%LOCALAPPDATA%\socket-patch\bin\` on Windows),
-and execs it. Subsequent runs use the cached binary.
-
-## Airgapped / offline use
-
-The launcher downloads on first run, so for offline CI either pre-warm the cache
-or point it at an already-installed binary:
-
-```sh
-export SOCKET_PATCH_BIN=/usr/local/bin/socket-patch
-```
-
-When `SOCKET_PATCH_BIN` is set to an executable, the launcher skips the download
-entirely and execs it. (The npm and PyPI distributions bundle the binary instead
-of downloading; a future hardening may ship platform-specific gems that bundle
-the binary too.)
-
-## License
-
-MIT
diff --git a/gem/socket-patch/exe/socket-patch b/gem/socket-patch/exe/socket-patch
deleted file mode 100755
index ab632602..00000000
--- a/gem/socket-patch/exe/socket-patch
+++ /dev/null
@@ -1,9 +0,0 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-# Executable shim for the `socket-patch` launcher gem. Resolves the platform
-# binary (download-on-first-run, cached) and execs it, replacing this process so
-# exit codes / signals pass through unchanged.
-require "socket_patch/launcher"
-
-SocketPatch::Launcher.run(ARGV)
diff --git a/gem/socket-patch/lib/socket_patch/launcher.rb b/gem/socket-patch/lib/socket_patch/launcher.rb
deleted file mode 100644
index 557c772c..00000000
--- a/gem/socket-patch/lib/socket_patch/launcher.rb
+++ /dev/null
@@ -1,286 +0,0 @@
-# frozen_string_literal: true
-
-require "rbconfig"
-require "digest"
-require "fileutils"
-require "net/http"
-require "uri"
-require "tmpdir"
-
-module SocketPatch
-  # Resolves and runs the prebuilt `socket-patch` binary for the host platform.
-  #
-  # Strategy (mirrors scripts/install.sh's target mapping):
-  #   1. honor SOCKET_PATCH_BIN if it points at an executable (airgap escape);
-  #   2. else use a cached binary under the per-user cache, keyed by
-  #      version + target;
-  #   3. else download `socket-patch-<target>.{tar.gz,zip}` from the matching
-  #      GitHub release, verify its SHA-256 against the release's SHA256SUMS,
-  #      extract the binary, cache it, and run it.
-  module Launcher
-    # Fallback version, used ONLY when the installed gem's version can't be read
-    # (e.g. running this file from a checkout). In a real `gem install` the
-    # download uses the installed gem's own version — see `version`.
-    VERSION = "4.0.0"
-    REPO = "SocketDev/socket-patch"
-    BINARY = "socket-patch"
-
-    module_function
-
-    def run(argv)
-      bin = resolve_binary
-      if Gem.win_platform?
-        # Windows has no exec() that replaces the process cleanly for console
-        # apps; spawn + wait and propagate the child's real exit status (a
-        # blanket 1 would erase the CLI's meaningful non-zero codes, e.g.
-        # `vex`'s usage-error 2 vs nothing-attested 1).
-        ok = system(bin, *argv)
-        raise LauncherError, "could not run #{bin}" if ok.nil?
-        exit($?.exitstatus || 1)
-      else
-        exec([bin, bin], *argv)
-      end
-    rescue LauncherError => e
-      warn("socket-patch: #{e.message}")
-      exit(1)
-    rescue StandardError => e
-      # First-run download/extract failures outside our own error type (DNS
-      # outages, TLS errors, ...) must exit cleanly, not escape as raw
-      # backtraces.
-      warn("socket-patch: #{e.class}: #{e.message}")
-      exit(1)
-    end
-
-    class LauncherError < StandardError; end
-
-    # ── binary resolution ─────────────────────────────────────────────────────
-
-    def resolve_binary
-      env = ENV["SOCKET_PATCH_BIN"]
-      return env if env && !env.empty? && File.executable?(env)
-
-      ver = version
-      target, ext = detect_target
-      exe = BINARY + (Gem.win_platform? ? ".exe" : "")
-      cached = File.join(cache_dir, ver, target, exe)
-      # Cache hit: the cached binary was SHA-256-verified when first downloaded
-      # and lives under the user's own cache dir. We trust it without
-      # re-verifying (re-verification would require re-fetching SHA256SUMS every
-      # run), matching npx / pip / rustup; an attacker able to write here can
-      # already replace the installed gem or the binary itself.
-      return cached if File.executable?(cached)
-
-      download_binary(ver, target, ext, cached)
-      cached
-    end
-
-    # The version to fetch — the binary MUST match the CLI package the user
-    # actually installed, so derive it from the installed gem's own spec rather
-    # than trusting the `VERSION` constant (which `version-sync.sh` keeps current
-    # but which could drift). Falls back to the constant when the gem isn't
-    # activated (e.g. running this file directly from a checkout).
-    def version
-      if (spec = Gem.loaded_specs["socket-patch"])
-        return spec.version.to_s
-      end
-      Gem::Specification.find_by_name("socket-patch").version.to_s
-    rescue StandardError, Gem::LoadError
-      # Gem::MissingSpecError (the gem isn't installed at all — running from
-      # a checkout) is a Gem::LoadError, which is NOT a StandardError, so it
-      # must be rescued by name for the fallback to engage.
-      VERSION
-    end
-
-    # Map the host to a release target triple + archive extension. Mirrors
-    # scripts/install.sh.
-    def detect_target
-      host_os = RbConfig::CONFIG["host_os"].downcase
-      host_cpu = RbConfig::CONFIG["host_cpu"].downcase
-
-      arch =
-        case host_cpu
-        when /x86_64|x64|amd64/ then "x86_64"
-        when /aarch64|arm64/ then "aarch64"
-        when /i[3-6]86|x86/ then "i686"
-        when /armv7|armhf|arm\b/ then "arm"
-        else raise LauncherError, "unsupported CPU architecture: #{host_cpu}"
-        end
-
-      case host_os
-      when /darwin|mac/
-        raise LauncherError, "unsupported macOS arch: #{arch}" unless %w[x86_64 aarch64].include?(arch)
-        ["#{arch}-apple-darwin", "tar.gz"]
-      when /mswin|mingw|cygwin|windows/
-        win =
-          case arch
-          when "x86_64" then "x86_64-pc-windows-msvc"
-          when "aarch64" then "aarch64-pc-windows-msvc"
-          when "i686" then "i686-pc-windows-msvc"
-          else raise LauncherError, "unsupported Windows arch: #{arch}"
-          end
-        [win, "zip"]
-      when /linux/
-        libc = musl? ? "musl" : "gnu"
-        suffix = arch == "arm" ? "eabihf" : ""
-        ["#{arch}-unknown-linux-#{libc}#{suffix}", "tar.gz"]
-      else
-        raise LauncherError, "unsupported OS: #{host_os}"
-      end
-    end
-
-    def musl?
-      return true if RbConfig::CONFIG["host_os"].downcase.include?("musl")
-      Dir.glob("/lib/ld-musl-*.so.1").any?
-    rescue StandardError
-      false
-    end
-
-    def cache_dir
-      base =
-        if Gem.win_platform?
-          ENV["LOCALAPPDATA"] || File.join(Dir.home, "AppData", "Local")
-        else
-          ENV["XDG_CACHE_HOME"] || File.join(Dir.home, ".cache")
-        end
-      File.join(base, "socket-patch", "bin")
-    end
-
-    # ── download + verify + extract ───────────────────────────────────────────
-
-    def download_binary(ver, target, ext, dest)
-      archive = "#{BINARY}-#{target}.#{ext}"
-      base = "https://github.com/#{REPO}/releases/download/v#{ver}"
-
-      Dir.mktmpdir("socket-patch") do |tmp|
-        archive_path = File.join(tmp, archive)
-        fetch("#{base}/#{archive}", archive_path)
-
-        sums = fetch_string("#{base}/SHA256SUMS")
-        verify_sha256!(archive_path, archive, sums)
-
-        extract(archive_path, ext, tmp)
-        exe = BINARY + (ext == "zip" ? ".exe" : "")
-        extracted = File.join(tmp, exe)
-        unless File.file?(extracted)
-          raise LauncherError, "release archive #{archive} did not contain #{exe}"
-        end
-
-        install_executable(extracted, dest)
-      end
-    end
-
-    # Publish the verified binary into the cache atomically: copy to a temp
-    # file in the destination dir, set the exec bit, then rename over the
-    # final path — a concurrent first run can only ever see a complete,
-    # executable binary, never a torn or not-yet-chmodded one.
-    def install_executable(src, dest)
-      FileUtils.mkdir_p(File.dirname(dest))
-      tmp = File.join(File.dirname(dest), ".#{File.basename(dest)}.#{Process.pid}.tmp")
-      begin
-        FileUtils.cp(src, tmp)
-        File.chmod(0o755, tmp) unless Gem.win_platform?
-        begin
-          File.rename(tmp, dest)
-        rescue SystemCallError
-          # Windows rename cannot replace an existing file: a concurrent
-          # first run already published the (identical, verified) binary.
-          raise unless File.exist?(dest)
-        end
-      ensure
-        begin
-          File.delete(tmp) if File.file?(tmp)
-        rescue StandardError
-          # Leftover temp cleanup is best-effort.
-        end
-      end
-    end
-
-    # Require HTTPS for every request — including after a redirect. GitHub
-    # release downloads redirect to a CDN (still HTTPS); a redirect to http://
-    # would let a network attacker serve a malicious binary AND a matching
-    # SHA256SUMS (both attacker-controlled), defeating the checksum check. So a
-    # non-HTTPS URL — initial or redirect target — is refused.
-    def https_uri(url)
-      uri = URI(url)
-      unless uri.is_a?(URI::HTTPS)
-        raise LauncherError, "refusing non-HTTPS URL: #{url}"
-      end
-      uri
-    end
-
-    # Follow redirects (GitHub release downloads redirect to a CDN) and stream
-    # the body to `dest`. Relative redirects are resolved against the current
-    # URL; the result must still be HTTPS (see `https_uri`).
-    def fetch(url, dest, redirects = 10)
-      raise LauncherError, "too many redirects fetching #{url}" if redirects.zero?
-      uri = https_uri(url)
-      Net::HTTP.start(uri.host, uri.port, use_ssl: true) do |http|
-        http.request(Net::HTTP::Get.new(uri)) do |res|
-          case res
-          when Net::HTTPRedirection
-            return fetch(URI.join(url, res["location"]).to_s, dest, redirects - 1)
-          when Net::HTTPSuccess
-            File.open(dest, "wb") { |f| res.read_body { |chunk| f.write(chunk) } }
-          else
-            raise LauncherError, "download failed (#{res.code}) for #{url}"
-          end
-        end
-      end
-    end
-
-    def fetch_string(url, redirects = 10)
-      raise LauncherError, "too many redirects fetching #{url}" if redirects.zero?
-      uri = https_uri(url)
-      res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) do |http|
-        http.request(Net::HTTP::Get.new(uri))
-      end
-      case res
-      when Net::HTTPRedirection then fetch_string(URI.join(url, res["location"]).to_s, redirects - 1)
-      when Net::HTTPSuccess then res.body
-      else raise LauncherError, "download failed (#{res.code}) for #{url}"
-      end
-    end
-
-    # SHA256SUMS lines are "<hex>  <filename>" (some tools prefix the name
-    # with `*` for binary mode); match either.
-    def verify_sha256!(path, archive, sums)
-      expected = nil
-      sums.each_line do |line|
-        hex, name = line.split(/\s+/, 2)
-        next unless name
-        name = name.strip.sub(/\A\*/, "")
-        if name == archive
-          expected = hex.strip
-          break
-        end
-      end
-      raise LauncherError, "no SHA256SUMS entry for #{archive}" unless expected
-      actual = Digest::SHA256.file(path).hexdigest
-      return if actual.casecmp?(expected)
-      raise LauncherError, "checksum mismatch for #{archive} (expected #{expected}, got #{actual})"
-    end
-
-    # Quote a value for interpolation into a PowerShell command: single-quoted
-    # strings are literal except for embedded single quotes, which are escaped
-    # by doubling them (paths like `it's here` would otherwise break the
-    # command).
-    def powershell_quote(value)
-      "'#{value.gsub("'", "''")}'"
-    end
-
-    def extract(archive_path, ext, dir)
-      ok =
-        if ext == "zip"
-          # bsdtar (the `tar` on modern Windows) extracts zip; fall back to
-          # PowerShell Expand-Archive.
-          system("tar", "-xf", archive_path, "-C", dir) ||
-            system("powershell", "-NoProfile", "-Command",
-                   "Expand-Archive -Force -LiteralPath #{powershell_quote(archive_path)} " \
-                   "-DestinationPath #{powershell_quote(dir)}")
-        else
-          system("tar", "xzf", archive_path, "-C", dir)
-        end
-      raise LauncherError, "failed to extract #{File.basename(archive_path)}" unless ok
-    end
-  end
-end
diff --git a/gem/socket-patch/socket-patch.gemspec b/gem/socket-patch/socket-patch.gemspec
deleted file mode 100644
index 81545bf2..00000000
--- a/gem/socket-patch/socket-patch.gemspec
+++ /dev/null
@@ -1,30 +0,0 @@
-# frozen_string_literal: true
-
-# RubyGems distribution of the `socket-patch` CLI. A thin launcher gem: on first
-# run it downloads the prebuilt binary for the host platform from the matching
-# GitHub release (`v<version>`), verifies it against SHA256SUMS, caches it, and
-# execs it. `gem install socket-patch` therefore puts `socket-patch` on PATH —
-# useful in Bundler/Ruby environments (e.g. a CI `socket-patch apply` step after
-# `bundle install`). Set `SOCKET_PATCH_BIN` to an existing binary to skip the
-# download (airgapped CI). The version is synced with the workspace by
-# `scripts/version-sync.sh`.
-Gem::Specification.new do |s|
-  s.name        = "socket-patch"
-  s.version     = "4.0.0"
-  s.summary     = "CLI tool for applying security patches to dependencies."
-  s.description = "Launcher gem for the socket-patch CLI: downloads the prebuilt binary for the " \
-                  "host platform from the matching GitHub release, verifies its SHA-256, caches " \
-                  "it, and execs it. Set SOCKET_PATCH_BIN to bypass the download."
-  s.authors     = ["Socket Security"]
-  s.license     = "MIT"
-  s.homepage    = "https://github.com/SocketDev/socket-patch"
-  s.files       = ["lib/socket_patch/launcher.rb", "exe/socket-patch", "README.md"]
-  s.bindir      = "exe"
-  s.executables = ["socket-patch"]
-  s.require_paths = ["lib"]
-  s.required_ruby_version = ">= 2.6.0"
-  s.metadata = {
-    "source_code_uri" => "https://github.com/SocketDev/socket-patch",
-    "rubygems_mfa_required" => "true",
-  }
-end
diff --git a/pypi/socket-patch-hook/README.md b/pypi/socket-patch-hook/README.md
deleted file mode 100644
index 88517036..00000000
--- a/pypi/socket-patch-hook/README.md
+++ /dev/null
@@ -1,70 +0,0 @@
-# socket-patch-hook
-
-> **Deprecated — no longer published.** `socket-patch setup` (which added the
-> `socket-patch[hook]` dependency) was removed in socket-patch v5, and this
-> wheel is no longer built or published; the `socket-patch[hook]` extra is
-> gone too. In agent mode, run `socket-patch apply` in CI after install
-> instead. The source is kept for reference only.
-> To remove the hook from a project, see
-> [Upgrading from `setup`](https://github.com/SocketDev/socket-patch#upgrading-from-setup).
-
-A tiny, package-manager-agnostic **post-install hook** for
-[`socket-patch`](https://pypi.org/project/socket-patch/).
-
-Python package managers (pip, uv, poetry, pdm, hatch) have no universal
-post-install step, so a `pip install` / `--force-reinstall` can silently revert
-files that `socket-patch` previously patched. This package closes that gap.
-
-## How it works
-
-Installing this wheel lays down a startup `.pth` file in `site-packages`
-(RECORD-tracked, so `pip uninstall` removes it cleanly). At interpreter startup
-the hook does a microsecond-cheap check of whether the set of installed
-distributions changed since the last run; only then does it re-apply your
-project's **committed** patches by invoking `socket-patch apply --offline`. All
-real patching (hash verification, atomic writes, locking) is done by the
-`socket-patch` binary — this package only *triggers* it.
-
-Because it rides on Python's interpreter-startup `.pth` mechanism (not on any
-one installer's hooks), it works the same under every Python package manager.
-
-## Safety
-
-A `.pth` that runs code at startup deserves a careful safety model. This one:
-
-- **Fail-open** — every code path is wrapped so it can never raise into the
-  interpreter; the worst outcome of any bug is that patches aren't re-applied.
-- **Venv-anchored** — it applies only the `.socket/manifest.json` of the project
-  that owns the virtualenv it's installed in, never whatever `.socket/` happens
-  to sit above the current working directory.
-- **Hash-verified, in-tree only** — the underlying `socket-patch apply` verifies
-  each file's hash before patching and refuses manifest keys that would write
-  outside the installed package directory.
-- **Trusted binary** — it runs the `socket-patch` binary from the installed
-  `socket-patch` package, not the first one found on `PATH`.
-- **Offline + cheap** — no network at startup; the no-change path is a couple of
-  syscalls. It only spawns `socket-patch` when installed packages changed.
-- **Opt-in + easy off** — present only when a project committed it; disable any
-  interpreter with `SOCKET_PATCH_HOOK=off`.
-
-## Activating it
-
-Don't add this by hand. Run, in your project:
-
-```
-socket-patch setup
-```
-
-That commits a `socket-patch[hook]` dependency to your repo — the `[hook]`
-extra on the main `socket-patch` package, which pulls in both the CLI and this
-wheel (you never reference `socket-patch-hook` directly). The committed
-dependency is the source of truth — there's no separate marker file. The hook
-then activates automatically in CI after install. Remove it with `socket-patch
-setup --remove` followed by `pip uninstall socket-patch-hook`. (Classic Poetry
-can't express an extra as a bare key, so there `setup` writes the equivalent
-`socket-patch = { extras = ["hook"] }`.)
-
-## Disabling at runtime
-
-Set `SOCKET_PATCH_HOOK=off` (or `SOCKET_NO_HOOK=1`) to fully bypass the hook for
-a given interpreter — checked before any hook code runs.
diff --git a/pypi/socket-patch-hook/pyproject.toml b/pypi/socket-patch-hook/pyproject.toml
deleted file mode 100644
index 469c2301..00000000
--- a/pypi/socket-patch-hook/pyproject.toml
+++ /dev/null
@@ -1,36 +0,0 @@
-[build-system]
-requires = ["setuptools>=64"]
-build-backend = "setuptools.build_meta"
-
-[project]
-name = "socket-patch-hook"
-version = "4.0.0"
-description = "Auto-apply Socket security patches after install via a package-manager-agnostic .pth startup hook"
-readme = "README.md"
-license = "MIT"
-requires-python = ">=3.8"
-authors = [
-    { name = "Socket Security" }
-]
-keywords = ["security", "patch", "hook", "dependencies", "pth"]
-classifiers = [
-    "Development Status :: 4 - Beta",
-    "Intended Audience :: Developers",
-    "Programming Language :: Python :: 3",
-    "Topic :: Security",
-    "Topic :: Software Development :: Build Tools",
-]
-# Intentionally NO dependency on socket-patch: the hook is version-agnostic. It
-# runs the binary bundled in an installed `socket_patch` package, falls back to
-# `socket-patch` on PATH, and no-ops if neither exists. Projects commit
-# `socket-patch[hook]`, which pulls in both the CLI and this wheel.
-# (The canonical build is scripts/build-pypi-wheels.py, which also lays down the
-# startup .pth; this block keeps the directory a valid project for `pip install .`.)
-dependencies = []
-
-[project.urls]
-Homepage = "https://github.com/SocketDev/socket-patch"
-Repository = "https://github.com/SocketDev/socket-patch"
-
-[tool.setuptools]
-packages = ["socket_patch_hook"]
diff --git a/pypi/socket-patch-hook/socket_patch_hook.pth b/pypi/socket-patch-hook/socket_patch_hook.pth
deleted file mode 100644
index 38c4307f..00000000
--- a/pypi/socket-patch-hook/socket_patch_hook.pth
+++ /dev/null
@@ -1,13 +0,0 @@
-# socket-patch post-install hook — installed by the `socket-patch-hook` wheel.
-# Re-applies this project's committed Socket security patches (.socket/) after a
-# pip/uv/poetry/etc. install reverts a patched file. At interpreter startup it
-# does a cheap "did the installed packages change?" check and, only then, runs
-# `socket-patch apply --offline`. Fail-open: every error is swallowed so it can
-# never break interpreter startup, and it does nothing unless this environment's
-# project has a committed .socket/manifest.json.
-#   Disable (this interpreter):  SOCKET_PATCH_HOOK=off   (or SOCKET_NO_HOOK=1)
-#   Remove (this project):       socket-patch setup --remove  then  pip uninstall socket-patch-hook
-#   Details:                     https://github.com/SocketDev/socket-patch
-# (Lines starting with `#` are ignored by Python's site module; the single
-#  `import` line below is the only code it executes.)
-import os; exec("try:\n import socket_patch_hook as _h; _h.run()\nexcept Exception: pass") if (os.environ.get('SOCKET_PATCH_HOOK','').strip().lower() not in ('off','0','false','no') and os.environ.get('SOCKET_NO_HOOK','').strip().lower() not in ('1','true','yes','on')) else None
diff --git a/pypi/socket-patch-hook/socket_patch_hook/__init__.py b/pypi/socket-patch-hook/socket_patch_hook/__init__.py
deleted file mode 100644
index 9e3dee76..00000000
--- a/pypi/socket-patch-hook/socket_patch_hook/__init__.py
+++ /dev/null
@@ -1,294 +0,0 @@
-"""socket-patch post-install hook (package-manager-agnostic).
-
-This module is imported at Python interpreter startup by a wheel-shipped
-``socket_patch_hook.pth`` file (the same ``.pth`` ``import``-line mechanism
-coverage.py uses). When the set of installed distributions has changed since the
-last run -- e.g. ``pip install`` / ``--force-reinstall`` / ``uv sync`` reverted a
-file that Socket had patched -- it re-applies the project's committed patches by
-invoking the hardened ``socket-patch apply`` binary in offline mode. All actual
-patching (hash verification, atomic writes, locking) stays in that binary; this
-module only *triggers* it.
-
-Hard safety contract:
-  * ``run()`` must NEVER raise into ``site.py`` (a raise here would hit every
-    interpreter start in the environment). Every step is failure-swallowing.
-  * The common, no-change path must cost only a few syscalls (it does: a bounded
-    parent walk, one ``scandir`` of site-packages, and one small file read).
-  * The worst outcome of any bug here is that patches are simply not re-applied.
-
-Disable entirely with ``SOCKET_PATCH_HOOK=off`` (also checked in the ``.pth``
-line before this module is even imported) or ``SOCKET_NO_HOOK=1``.
-"""
-
-import os
-import sys
-
-__all__ = ["run"]
-
-# Set in the environment of the spawned ``apply`` process so a nested
-# interpreter started underneath it does not re-trigger the hook. (The apply
-# binary itself is native Rust, but it -- or a tool it shells out to -- may
-# invoke ``python``, which would re-process the ``.pth``.)
-_REENTRANCY_ENV = "_SOCKET_PATCH_HOOK_ACTIVE"
-
-# Upper bound on the parent-directory walk used to locate the project root.
-_MAX_PARENTS = 40
-
-# Generous safety net for a single hook-triggered apply. The apply is offline
-# and local, so this only ever fires if something is badly wrong; it exists so a
-# hung apply can never wedge interpreter startup forever.
-_APPLY_TIMEOUT_SECONDS = 120
-
-
-def _truthy(value):
-    return str(value or "").strip().lower() in ("1", "true", "yes", "on")
-
-
-def _disabled():
-    """True if the user has switched the hook off via env var."""
-    if _truthy(os.environ.get("SOCKET_NO_HOOK")):
-        return True
-    return os.environ.get("SOCKET_PATCH_HOOK", "").strip().lower() in (
-        "off",
-        "0",
-        "false",
-        "no",
-    )
-
-
-def _site_packages_dir():
-    # __file__ == <site-packages>/socket_patch_hook/__init__.py
-    return os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
-
-
-def _find_project_root():
-    """Locate the project whose committed ``.socket/manifest.json`` this
-    environment opted into. Returns ``None`` (hook no-ops) if none is found.
-
-    SECURITY — which manifest do we trust? When running inside a virtualenv we
-    anchor the search to the **venv** (``sys.prefix``), NOT the current working
-    directory: the committed ``socket-patch[hook]`` dependency installed this
-    hook into THIS venv, so the owning project is an ancestor of the venv (e.g.
-    ``<project>/.venv``). Anchoring to the venv ties the patches we apply to the
-    project that opted in, instead of whatever ``.socket/`` happens to sit above
-    the cwd — which could belong to an unrelated or hostile parent/sibling
-    project (a `python` started from elsewhere must not pull in a foreign
-    manifest). Only when there is no venv (a system / container interpreter,
-    where there is nothing to anchor to) do we fall back to the cwd.
-    """
-    in_venv = getattr(sys, "prefix", "") != getattr(sys, "base_prefix", getattr(sys, "prefix", ""))
-    anchors = []
-    if in_venv:
-        anchors.append(sys.prefix)
-        env_venv = os.environ.get("VIRTUAL_ENV")
-        if env_venv:
-            anchors.append(env_venv)
-    else:
-        try:
-            anchors.append(os.getcwd())
-        except OSError:
-            pass
-
-    seen = set()
-    for start in anchors:
-        try:
-            d = os.path.abspath(start)
-        except OSError:
-            continue
-        for _ in range(_MAX_PARENTS):
-            if d in seen:
-                break
-            seen.add(d)
-            if os.path.isfile(os.path.join(d, ".socket", "manifest.json")):
-                return d
-            parent = os.path.dirname(d)
-            if parent == d:  # reached the filesystem root
-                break
-            d = parent
-    return None
-
-
-def _fingerprint(site_dir):
-    """Cheap signature of the installed distributions in ``site_dir``.
-
-    A SHA-1 of the sorted ``(name, mtime)`` of every ``*.dist-info`` /
-    ``*.egg-info`` entry. This changes on any install / reinstall / uninstall,
-    but is deliberately immune to:
-      * our own patch writes (which touch package *files*, not the metadata
-        dirs), so the fingerprint is stable across an apply -- no re-apply loop;
-      * the stamp file (kept in a user cache, outside site-packages);
-      * ``__pycache__`` / ``.pyc`` churn.
-    Returns ``"?"`` on error so we fail toward a (harmless, idempotent) re-apply.
-    """
-    import hashlib
-
-    try:
-        items = []
-        with os.scandir(site_dir) as it:
-            for entry in it:
-                name = entry.name
-                if name.endswith(".dist-info") or name.endswith(".egg-info"):
-                    try:
-                        mtime = entry.stat().st_mtime_ns
-                    except OSError:
-                        mtime = 0
-                    items.append("%s:%d" % (name, mtime))
-        items.sort()
-        return hashlib.sha1(
-            "\n".join(items).encode("utf-8", "replace")
-        ).hexdigest()
-    except OSError:
-        return "?"
-
-
-def _cache_dir():
-    if os.name == "nt":
-        base = os.environ.get("LOCALAPPDATA") or os.path.expanduser("~")
-    else:
-        base = os.environ.get("XDG_CACHE_HOME") or os.path.join(
-            os.path.expanduser("~"), ".cache"
-        )
-    return os.path.join(base, "socket-patch", "hook-stamps")
-
-
-def _stamp_path(site_dir):
-    """Per-site-packages stamp file, in a user cache so writing it never
-    perturbs the site-packages fingerprint and never dirties the repo."""
-    import hashlib
-
-    key = hashlib.sha1(
-        os.path.abspath(site_dir).encode("utf-8", "replace")
-    ).hexdigest()
-    return os.path.join(_cache_dir(), key)
-
-
-def _read_stamp(path):
-    try:
-        with open(path, "r") as f:
-            return f.read().strip()
-    except OSError:
-        return None
-
-
-def _write_stamp(path, value):
-    tmp = None
-    try:
-        os.makedirs(os.path.dirname(path), exist_ok=True)
-        tmp = "%s.%d.tmp" % (path, os.getpid())
-        with open(tmp, "w") as f:
-            f.write(value)
-        os.replace(tmp, path)
-    except OSError:
-        if tmp:
-            try:
-                os.unlink(tmp)
-            except OSError:
-                pass
-
-
-def _resolve_binary():
-    """Locate the ``socket-patch`` binary to run.
-
-    SECURITY — order matters. We prefer the binary **bundled in the installed
-    ``socket_patch`` package** (the one `socket-patch[hook]` pulls in: a
-    RECORD-tracked file resolved by the dependency solver) and only fall back to
-    ``PATH`` if that package isn't present. Resolving via ``PATH`` first would
-    let a malicious ``socket-patch`` placed earlier on ``PATH`` (or `.` on PATH)
-    be executed at every interpreter startup. Returns ``None`` if neither is
-    found, in which case the hook no-ops.
-    """
-    try:
-        import socket_patch
-
-        resolver = getattr(socket_patch, "_resolve_binary", None)
-        if resolver is not None:
-            path = resolver()
-            if path:
-                return path
-    except Exception:
-        pass
-    try:
-        import shutil
-
-        return shutil.which("socket-patch")
-    except Exception:
-        return None
-
-
-def _apply(binary, project_root):
-    """Run ``socket-patch apply`` synchronously, offline, best-effort.
-
-    Synchronous so the patched bytes are in place before the interpreter
-    proceeds to user imports. Offline so it only ever re-heals from the
-    committed ``.socket/`` cache and never blocks startup on the network.
-    ``--lock-timeout 0`` so a parallel interpreter that loses the apply lock
-    (e.g. under ``pytest -n``) skips instantly instead of piling up.
-
-    Returns ``True`` only if apply exited 0. A non-zero exit (e.g. losing the
-    apply lock to a sibling interpreter) returns ``False`` so the caller does
-    NOT stamp the state as handled and the heal is retried on the next start.
-    """
-    import subprocess
-
-    argv = [
-        binary,
-        "apply",
-        "--offline",
-        "--silent",
-        "--ecosystems",
-        "pypi",
-        "--cwd",
-        project_root,
-        "--lock-timeout",
-        "0",
-    ]
-    env = dict(os.environ)
-    env[_REENTRANCY_ENV] = "1"
-    kwargs = {
-        "cwd": project_root,
-        "env": env,
-        "stdin": subprocess.DEVNULL,
-        "stdout": subprocess.DEVNULL,
-        "stderr": subprocess.DEVNULL,
-        "timeout": _APPLY_TIMEOUT_SECONDS,
-    }
-    # Don't flash a console window for a pythonw-hosted (no-console) app.
-    if os.name == "nt":
-        kwargs["creationflags"] = getattr(subprocess, "CREATE_NO_WINDOW", 0)
-    try:
-        return subprocess.run(argv, **kwargs).returncode == 0
-    except Exception:
-        # Includes TimeoutExpired and OSError (binary vanished mid-run).
-        return False
-
-
-def run():
-    """Entry point invoked by the ``.pth`` line. Never raises."""
-    try:
-        # Cheapest possible bail-outs first.
-        if os.environ.get(_REENTRANCY_ENV):
-            return
-        if _disabled():
-            return
-        project_root = _find_project_root()
-        if project_root is None:
-            return
-        site_dir = _site_packages_dir()
-        fp = _fingerprint(site_dir)
-        stamp_path = _stamp_path(site_dir)
-        if _read_stamp(stamp_path) == fp:
-            return  # nothing installed/reinstalled since the last apply
-        binary = _resolve_binary()
-        if not binary:
-            return
-        # Stamp only on a successful apply. The dist-info fingerprint is
-        # unchanged by an apply (which patches package files, not metadata
-        # dirs), so storing the pre-apply value is correct -- and gating on
-        # success means a lock-contended / failed apply is retried next start
-        # rather than being silently marked as handled.
-        if _apply(binary, project_root):
-            _write_stamp(stamp_path, fp)
-    except Exception:
-        # Final backstop. The .pth wrapper also guards, but a raise here would
-        # hit every interpreter start, so never rely on a single layer.
-        return
diff --git a/pypi/socket-patch-hook/test_hook.py b/pypi/socket-patch-hook/test_hook.py
deleted file mode 100644
index e843f981..00000000
--- a/pypi/socket-patch-hook/test_hook.py
+++ /dev/null
@@ -1,260 +0,0 @@
-"""Tests for the socket-patch startup hook.
-
-Run with: ``python -m unittest test_hook`` (no third-party deps required).
-
-The overriding contract under test is *safety*: the hook must never raise, must
-no-op cheaply when there is nothing to do, must invoke ``socket-patch apply``
-with the right offline arguments only when the installed distributions have
-changed, and must only ever apply the manifest of the project that owns this
-environment (never a foreign one above the cwd).
-"""
-
-import os
-import sys
-import unittest
-from unittest import mock
-
-sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
-
-import socket_patch_hook as hook  # noqa: E402
-
-
-class HookTestBase(unittest.TestCase):
-    def setUp(self):
-        self._cwd = os.getcwd()
-        # Isolate env: clear switches + reentrancy + venv + cache redirect.
-        self._saved_env = dict(os.environ)
-        for k in ("SOCKET_PATCH_HOOK", "SOCKET_NO_HOOK", "VIRTUAL_ENV", hook._REENTRANCY_ENV):
-            os.environ.pop(k, None)
-        self._tmp = self._mkdtemp()
-        os.environ["XDG_CACHE_HOME"] = os.path.join(self._tmp, "cache")
-        os.environ["LOCALAPPDATA"] = os.path.join(self._tmp, "cache")
-
-    def tearDown(self):
-        os.chdir(self._cwd)
-        os.environ.clear()
-        os.environ.update(self._saved_env)
-
-    def _mkdtemp(self):
-        import tempfile
-
-        d = tempfile.mkdtemp()
-        self.addCleanup(self._rmtree, d)
-        return d
-
-    @staticmethod
-    def _rmtree(path):
-        import shutil
-
-        shutil.rmtree(path, ignore_errors=True)
-
-    def _make_project(self):
-        """A temp dir that looks like a socket-patch project (has a manifest)."""
-        root = self._mkdtemp()
-        os.makedirs(os.path.join(root, ".socket"))
-        with open(os.path.join(root, ".socket", "manifest.json"), "w") as f:
-            f.write('{"patches": {}}')
-        return root
-
-
-class TestRunSpawning(HookTestBase):
-    # These exercise the spawn/guard/stamp logic; project discovery is mocked
-    # (it has its own tests in TestProjectRootDiscovery).
-    def test_applies_when_manifest_present_and_state_changed(self):
-        root = self._make_project()
-        with mock.patch.object(hook, "_find_project_root", return_value=root), \
-                mock.patch.object(hook, "_resolve_binary", return_value="/fake/socket-patch"), \
-                mock.patch("subprocess.run", return_value=mock.Mock(returncode=0)) as run:
-            hook.run()
-        self.assertEqual(run.call_count, 1)
-        argv = run.call_args[0][0]
-        self.assertEqual(argv[0], "/fake/socket-patch")
-        self.assertIn("apply", argv)
-        self.assertIn("--offline", argv)
-        self.assertIn("--silent", argv)
-        self.assertEqual(argv[argv.index("--ecosystems") + 1], "pypi")
-        self.assertEqual(
-            os.path.realpath(argv[argv.index("--cwd") + 1]),
-            os.path.realpath(root),
-        )
-        self.assertEqual(argv[argv.index("--lock-timeout") + 1], "0")
-        env = run.call_args[1]["env"]
-        self.assertEqual(env[hook._REENTRANCY_ENV], "1")
-
-    def test_second_run_is_a_noop_when_state_unchanged(self):
-        root = self._make_project()
-        with mock.patch.object(hook, "_find_project_root", return_value=root), \
-                mock.patch.object(hook, "_resolve_binary", return_value="/fake/socket-patch"), \
-                mock.patch("subprocess.run", return_value=mock.Mock(returncode=0)) as run:
-            hook.run()  # first run applies + writes the stamp (success)
-            hook.run()  # second run: fingerprint matches stamp -> skip
-        self.assertEqual(run.call_count, 1)
-
-    def test_failed_apply_does_not_stamp_so_it_retries(self):
-        root = self._make_project()
-        with mock.patch.object(hook, "_find_project_root", return_value=root), \
-                mock.patch.object(hook, "_resolve_binary", return_value="/fake/socket-patch"), \
-                mock.patch("subprocess.run", return_value=mock.Mock(returncode=1)) as run:
-            hook.run()
-            hook.run()
-        self.assertEqual(run.call_count, 2, "a failed apply must be retried next start")
-
-    def test_noop_without_manifest(self):
-        with mock.patch.object(hook, "_find_project_root", return_value=None), \
-                mock.patch.object(hook, "_resolve_binary", return_value="/fake/socket-patch"), \
-                mock.patch("subprocess.run") as run:
-            hook.run()
-        run.assert_not_called()
-
-    def test_noop_when_binary_missing(self):
-        root = self._make_project()
-        with mock.patch.object(hook, "_find_project_root", return_value=root), \
-                mock.patch.object(hook, "_resolve_binary", return_value=None), \
-                mock.patch("subprocess.run") as run:
-            hook.run()
-        run.assert_not_called()
-
-
-class TestDisableSwitches(HookTestBase):
-    def _run_disabled(self):
-        root = self._make_project()
-        with mock.patch.object(hook, "_find_project_root", return_value=root), \
-                mock.patch.object(hook, "_resolve_binary", return_value="/fake/socket-patch"), \
-                mock.patch("subprocess.run") as run:
-            hook.run()
-        return run
-
-    def test_socket_patch_hook_off(self):
-        os.environ["SOCKET_PATCH_HOOK"] = "off"
-        self._run_disabled().assert_not_called()
-
-    def test_socket_no_hook(self):
-        os.environ["SOCKET_NO_HOOK"] = "1"
-        self._run_disabled().assert_not_called()
-
-    def test_reentrancy_guard(self):
-        os.environ[hook._REENTRANCY_ENV] = "1"
-        self._run_disabled().assert_not_called()
-
-
-class TestNeverRaises(HookTestBase):
-    def test_run_swallows_resolver_errors(self):
-        root = self._make_project()
-        with mock.patch.object(hook, "_find_project_root", return_value=root), \
-                mock.patch.object(hook, "_resolve_binary", side_effect=RuntimeError("boom")):
-            hook.run()  # must not propagate
-
-    def test_run_swallows_subprocess_errors(self):
-        root = self._make_project()
-        with mock.patch.object(hook, "_find_project_root", return_value=root), \
-                mock.patch.object(hook, "_resolve_binary", return_value="/fake/socket-patch"), \
-                mock.patch("subprocess.run", side_effect=OSError("no such binary")):
-            hook.run()  # must not raise
-
-    def test_apply_timeout_is_swallowed(self):
-        import subprocess
-
-        root = self._make_project()
-        with mock.patch.object(hook, "_find_project_root", return_value=root), \
-                mock.patch.object(hook, "_resolve_binary", return_value="/fake/socket-patch"), \
-                mock.patch(
-                    "subprocess.run",
-                    side_effect=subprocess.TimeoutExpired(cmd="x", timeout=1),
-                ):
-            hook.run()  # must not raise
-
-    def test_run_swallows_discovery_errors(self):
-        with mock.patch.object(hook, "_find_project_root", side_effect=RuntimeError("boom")), \
-                mock.patch("subprocess.run") as run:
-            hook.run()  # must not raise
-        run.assert_not_called()
-
-
-class TestProjectRootDiscovery(HookTestBase):
-    """The hook must apply only the manifest of the project that OWNS this
-    environment — anchored to the venv, not whatever .socket/ sits above cwd."""
-
-    def _socket(self, d):
-        os.makedirs(os.path.join(d, ".socket"))
-        with open(os.path.join(d, ".socket", "manifest.json"), "w") as f:
-            f.write('{"patches": {}}')
-
-    def test_anchors_to_venv_not_cwd(self):
-        # venv at <proj>/.venv; manifest at <proj>; cwd is elsewhere.
-        proj = os.path.join(self._tmp, "proj")
-        self._socket(proj)
-        venv = os.path.join(proj, ".venv")
-        elsewhere = os.path.join(self._tmp, "elsewhere")
-        os.makedirs(elsewhere)
-        os.chdir(elsewhere)
-        with mock.patch.object(sys, "prefix", venv), \
-                mock.patch.object(sys, "base_prefix", self._tmp):  # in_venv = True
-            got = hook._find_project_root()
-        self.assertEqual(os.path.realpath(got), os.path.realpath(proj))
-
-    def test_in_venv_ignores_unrelated_cwd_manifest(self):
-        # SECURITY: a hostile .socket/ above the cwd must NOT be picked up when
-        # running inside a venv whose project committed no manifest.
-        proj = os.path.join(self._tmp, "proj")  # venv's project: NO .socket
-        os.makedirs(proj)
-        venv = os.path.join(proj, ".venv")
-        attacker = os.path.join(self._tmp, "attacker")
-        self._socket(attacker)
-        os.chdir(attacker)
-        with mock.patch.object(sys, "prefix", venv), \
-                mock.patch.object(sys, "base_prefix", self._tmp):  # in_venv = True
-            got = hook._find_project_root()
-        self.assertIsNone(got, "must not apply a foreign manifest found above cwd")
-
-    def test_system_python_falls_back_to_cwd(self):
-        # No venv (sys.prefix == base_prefix): the container/system case, where
-        # the project is wherever the process runs from.
-        proj = os.path.join(self._tmp, "proj")
-        self._socket(proj)
-        os.chdir(proj)
-        with mock.patch.object(sys, "prefix", "/usr"), \
-                mock.patch.object(sys, "base_prefix", "/usr"):  # in_venv = False
-            got = hook._find_project_root()
-        self.assertEqual(os.path.realpath(got), os.path.realpath(proj))
-
-
-class TestPthLine(unittest.TestCase):
-    """The .pth must be valid: comment lines are ignored by site.py, the import
-    line execs, and the kill switch short-circuits before importing."""
-
-    def _pth_import_line(self):
-        # site.py execs only lines starting with `import`; `#` lines are
-        # comments. Mirror that: run the import line(s) the way site would.
-        here = os.path.dirname(os.path.abspath(__file__))
-        with open(os.path.join(here, "socket_patch_hook.pth")) as f:
-            lines = [
-                ln.rstrip("\n")
-                for ln in f
-                if ln.strip() and not ln.lstrip().startswith("#")
-            ]
-        # Exactly one executable (import) line.
-        assert len(lines) == 1, f"expected one import line, got {lines!r}"
-        assert lines[0].startswith("import "), lines[0]
-        return lines[0]
-
-    def test_pth_line_executes_and_calls_run(self):
-        line = self._pth_import_line()
-        with mock.patch.object(hook, "run") as run:
-            os.environ.pop("SOCKET_PATCH_HOOK", None)
-            os.environ.pop("SOCKET_NO_HOOK", None)
-            exec(compile(line, "socket_patch_hook.pth", "exec"), {})
-        run.assert_called_once()
-
-    def test_pth_line_respects_off_switch(self):
-        line = self._pth_import_line()
-        with mock.patch.object(hook, "run") as run:
-            os.environ["SOCKET_PATCH_HOOK"] = "off"
-            try:
-                exec(compile(line, "socket_patch_hook.pth", "exec"), {})
-            finally:
-                os.environ.pop("SOCKET_PATCH_HOOK", None)
-        run.assert_not_called()
-
-
-if __name__ == "__main__":
-    unittest.main()
diff --git a/pypi/socket-patch/pyproject.toml b/pypi/socket-patch/pyproject.toml
deleted file mode 100644
index adc2bc40..00000000
--- a/pypi/socket-patch/pyproject.toml
+++ /dev/null
@@ -1,32 +0,0 @@
-[build-system]
-requires = ["setuptools>=64"]
-build-backend = "setuptools.build_meta"
-
-[project]
-name = "socket-patch"
-version = "4.0.0"
-description = "CLI tool for applying security patches to dependencies"
-readme = "README.md"
-license = "MIT"
-requires-python = ">=3.8"
-authors = [
-    { name = "Socket Security" }
-]
-keywords = ["security", "patch", "cli", "dependencies"]
-classifiers = [
-    "Development Status :: 5 - Production/Stable",
-    "Intended Audience :: Developers",
-    "Programming Language :: Python :: 3",
-    "Topic :: Security",
-    "Topic :: Software Development :: Build Tools",
-]
-
-[project.urls]
-Homepage = "https://github.com/SocketDev/socket-patch"
-Repository = "https://github.com/SocketDev/socket-patch"
-
-[project.scripts]
-socket-patch = "socket_patch:main"
-
-[tool.setuptools.package-data]
-socket_patch = ["bin/*"]
diff --git a/pypi/socket-patch/socket_patch/__init__.py b/pypi/socket-patch/socket_patch/__init__.py
deleted file mode 100644
index f754d553..00000000
--- a/pypi/socket-patch/socket_patch/__init__.py
+++ /dev/null
@@ -1,45 +0,0 @@
-import os
-import sys
-import subprocess
-
-
-def _resolve_binary():
-    """Locate the bundled socket-patch binary, or return ``None``.
-
-    Single source of truth for binary discovery, reused by both ``main()`` (the
-    console-script entry point) and the legacy ``socket_patch_hook`` startup hook
-    (no longer published since v5, but older installs still import this). Never
-    raises: returns ``None`` if the binary can't be found, so callers that run at
-    interpreter startup stay safe.
-    """
-    bin_dir = os.path.join(os.path.dirname(os.path.abspath(__file__)), "bin")
-    try:
-        entries = os.listdir(bin_dir)
-    except OSError:
-        return None
-    bins = [e for e in entries if e.startswith("socket-patch")]
-    if len(bins) != 1:
-        return None
-    bin_path = os.path.join(bin_dir, bins[0])
-    try:
-        if not os.access(bin_path, os.X_OK):
-            os.chmod(bin_path, os.stat(bin_path).st_mode | 0o111)
-    except OSError:
-        return None
-    return bin_path
-
-
-def main():
-    bin_path = _resolve_binary()
-    if bin_path is None:
-        bin_dir = os.path.join(os.path.dirname(os.path.abspath(__file__)), "bin")
-        try:
-            count = len([e for e in os.listdir(bin_dir) if e.startswith("socket-patch")])
-        except OSError:
-            count = 0
-        print(
-            f"Expected exactly one socket-patch binary in {bin_dir}, found {count}",
-            file=sys.stderr,
-        )
-        sys.exit(1)
-    raise SystemExit(subprocess.call([bin_path] + sys.argv[1:]))
diff --git a/pypi/socket-patch/socket_patch/bin/.gitkeep b/pypi/socket-patch/socket_patch/bin/.gitkeep
deleted file mode 100644
index e69de29b..00000000
diff --git a/pypi/socket-patch/test_dispatch.py b/pypi/socket-patch/test_dispatch.py
deleted file mode 100644
index 07380f4c..00000000
--- a/pypi/socket-patch/test_dispatch.py
+++ /dev/null
@@ -1,128 +0,0 @@
-import ast
-import os
-import stat
-import sys
-import tempfile
-import textwrap
-import unittest
-from pathlib import Path
-from unittest import mock
-
-# Import the module source for inspection
-INIT_PATH = Path(__file__).parent / "socket_patch" / "__init__.py"
-INIT_SRC = INIT_PATH.read_text()
-
-
-class TestInitModule(unittest.TestCase):
-    """Test that __init__.py correctly finds and runs the single binary."""
-
-    def test_source_parses(self):
-        """Verify __init__.py is valid Python."""
-        ast.parse(INIT_SRC)
-
-    def test_main_defined(self):
-        """Verify main() function exists."""
-        tree = ast.parse(INIT_SRC)
-        func_names = [
-            node.name for node in ast.walk(tree) if isinstance(node, ast.FunctionDef)
-        ]
-        self.assertIn("main", func_names)
-
-    def test_dispatches_single_binary(self):
-        """main() should find the single binary in bin/ and call it."""
-        with tempfile.TemporaryDirectory() as tmpdir:
-            bin_dir = os.path.join(tmpdir, "bin")
-            os.makedirs(bin_dir)
-            fake_bin = os.path.join(bin_dir, "socket-patch-test")
-            Path(fake_bin).write_text("#!/bin/sh\nexit 0\n")
-            os.chmod(fake_bin, os.stat(fake_bin).st_mode | stat.S_IEXEC)
-
-            with mock.patch("socket_patch.os.path.dirname", return_value=tmpdir):
-                with mock.patch("socket_patch.subprocess.call", return_value=42) as mock_call:
-                    with self.assertRaises(SystemExit) as cm:
-                        import socket_patch
-
-                        socket_patch.main()
-                    self.assertEqual(cm.exception.code, 42)
-                    mock_call.assert_called_once()
-                    called_args = mock_call.call_args[0][0]
-                    self.assertEqual(called_args[0], fake_bin)
-
-    def test_errors_on_no_binary(self):
-        """main() should exit with error if no binary found."""
-        with tempfile.TemporaryDirectory() as tmpdir:
-            bin_dir = os.path.join(tmpdir, "bin")
-            os.makedirs(bin_dir)
-
-            with mock.patch("socket_patch.os.path.dirname", return_value=tmpdir):
-                with self.assertRaises(SystemExit) as cm:
-                    import socket_patch
-
-                    socket_patch.main()
-                self.assertEqual(cm.exception.code, 1)
-
-    def test_errors_on_multiple_binaries(self):
-        """main() should exit with error if multiple binaries found."""
-        with tempfile.TemporaryDirectory() as tmpdir:
-            bin_dir = os.path.join(tmpdir, "bin")
-            os.makedirs(bin_dir)
-            Path(os.path.join(bin_dir, "socket-patch-a")).touch()
-            Path(os.path.join(bin_dir, "socket-patch-b")).touch()
-
-            with mock.patch("socket_patch.os.path.dirname", return_value=tmpdir):
-                with self.assertRaises(SystemExit) as cm:
-                    import socket_patch
-
-                    socket_patch.main()
-                self.assertEqual(cm.exception.code, 1)
-
-    def test_errors_on_missing_bin_dir(self):
-        """main() should exit with error if bin/ dir doesn't exist."""
-        with tempfile.TemporaryDirectory() as tmpdir:
-            # Don't create bin_dir
-            with mock.patch("socket_patch.os.path.dirname", return_value=tmpdir):
-                with self.assertRaises(SystemExit) as cm:
-                    import socket_patch
-
-                    socket_patch.main()
-                self.assertEqual(cm.exception.code, 1)
-
-
-class TestWheelBuilder(unittest.TestCase):
-    """Test the wheel builder script configuration."""
-
-    def test_wheel_builder_exists(self):
-        """Verify the wheel builder script exists."""
-        script_path = Path(__file__).parent.parent.parent / "scripts" / "build-pypi-wheels.py"
-        self.assertTrue(script_path.exists(), f"Wheel builder script not found at {script_path}")
-
-    def test_wheel_builder_parses(self):
-        """Verify the wheel builder script is valid Python."""
-        script_path = Path(__file__).parent.parent.parent / "scripts" / "build-pypi-wheels.py"
-        ast.parse(script_path.read_text())
-
-    def test_wheel_builder_targets(self):
-        """Verify the wheel builder covers all expected targets."""
-        script_path = Path(__file__).parent.parent.parent / "scripts" / "build-pypi-wheels.py"
-        src = script_path.read_text()
-
-        expected_targets = [
-            "aarch64-apple-darwin",
-            "x86_64-apple-darwin",
-            "x86_64-unknown-linux-musl",
-            "aarch64-unknown-linux-gnu",
-            "arm-unknown-linux-gnueabihf",
-            "i686-unknown-linux-gnu",
-            "x86_64-pc-windows-msvc",
-            "i686-pc-windows-msvc",
-            "aarch64-pc-windows-msvc",
-        ]
-        for target in expected_targets:
-            self.assertIn(target, src, f"Target {target} missing from wheel builder")
-
-        # Android should NOT be in the targets
-        self.assertNotIn('"aarch64-linux-android"', src)
-
-
-if __name__ == "__main__":
-    unittest.main()
diff --git a/scripts/build-pypi-wheels.py b/scripts/build-pypi-wheels.py
deleted file mode 100755
index 47718e87..00000000
--- a/scripts/build-pypi-wheels.py
+++ /dev/null
@@ -1,316 +0,0 @@
-#!/usr/bin/env python3
-"""Build platform-tagged PyPI wheels for socket-patch.
-
-Each wheel contains only the binary for a single platform, so users download
-only the ~4 MB they need instead of ~40 MB for all platforms.
-"""
-
-import argparse
-import csv
-import hashlib
-import io
-import os
-import re
-import stat
-import subprocess
-import sys
-import tempfile
-import zipfile
-from base64 import urlsafe_b64encode
-from pathlib import Path
-
-# Mapping from Rust target triple to:
-#   (wheel platform tag(s), archive extension, binary name inside archive)
-# Android is omitted — no standard PyPI platform tag exists for it.
-TARGETS = {
-    "aarch64-apple-darwin": {
-        "platform_tag": "macosx_11_0_arm64",
-        "archive_ext": "tar.gz",
-        "binary_name": "socket-patch",
-    },
-    "x86_64-apple-darwin": {
-        "platform_tag": "macosx_10_12_x86_64",
-        "archive_ext": "tar.gz",
-        "binary_name": "socket-patch",
-    },
-    "x86_64-unknown-linux-gnu": {
-        "platform_tag": "manylinux_2_17_x86_64.manylinux2014_x86_64",
-        "archive_ext": "tar.gz",
-        "binary_name": "socket-patch",
-    },
-    "x86_64-unknown-linux-musl": {
-        "platform_tag": "musllinux_1_1_x86_64",
-        "archive_ext": "tar.gz",
-        "binary_name": "socket-patch",
-    },
-    "aarch64-unknown-linux-gnu": {
-        "platform_tag": "manylinux_2_17_aarch64.manylinux2014_aarch64",
-        "archive_ext": "tar.gz",
-        "binary_name": "socket-patch",
-    },
-    "aarch64-unknown-linux-musl": {
-        "platform_tag": "musllinux_1_1_aarch64",
-        "archive_ext": "tar.gz",
-        "binary_name": "socket-patch",
-    },
-    "arm-unknown-linux-gnueabihf": {
-        "platform_tag": "manylinux_2_17_armv7l.manylinux2014_armv7l",
-        "archive_ext": "tar.gz",
-        "binary_name": "socket-patch",
-    },
-    "arm-unknown-linux-musleabihf": {
-        "platform_tag": "musllinux_1_1_armv7l",
-        "archive_ext": "tar.gz",
-        "binary_name": "socket-patch",
-    },
-    "i686-unknown-linux-gnu": {
-        "platform_tag": "manylinux_2_17_i686.manylinux2014_i686",
-        "archive_ext": "tar.gz",
-        "binary_name": "socket-patch",
-    },
-    "i686-unknown-linux-musl": {
-        "platform_tag": "musllinux_1_1_i686",
-        "archive_ext": "tar.gz",
-        "binary_name": "socket-patch",
-    },
-    "x86_64-pc-windows-msvc": {
-        "platform_tag": "win_amd64",
-        "archive_ext": "zip",
-        "binary_name": "socket-patch.exe",
-    },
-    "i686-pc-windows-msvc": {
-        "platform_tag": "win32",
-        "archive_ext": "zip",
-        "binary_name": "socket-patch.exe",
-    },
-    "aarch64-pc-windows-msvc": {
-        "platform_tag": "win_arm64",
-        "archive_ext": "zip",
-        "binary_name": "socket-patch.exe",
-    },
-}
-
-DIST_NAME = "socket_patch"
-PKG_NAME = "socket-patch"
-
-
-def sha256_digest(data: bytes) -> str:
-    """Return the URL-safe base64 SHA-256 digest for RECORD."""
-    h = hashlib.sha256(data)
-    return "sha256=" + urlsafe_b64encode(h.digest()).decode("ascii").rstrip("=")
-
-
-def extract_binary(artifacts_dir: Path, target: str, info: dict) -> bytes:
-    """Extract the binary from the artifact archive and return its contents."""
-    ext = info["archive_ext"]
-    archive_path = artifacts_dir / f"socket-patch-{target}.{ext}"
-    if not archive_path.exists():
-        raise FileNotFoundError(f"Artifact not found: {archive_path}")
-
-    binary_name = info["binary_name"]
-    if ext == "tar.gz":
-        import tarfile
-
-        with tarfile.open(archive_path, "r:gz") as tf:
-            member = tf.getmember(binary_name)
-            f = tf.extractfile(member)
-            if f is None:
-                raise ValueError(f"Could not extract {binary_name} from {archive_path}")
-            return f.read()
-    elif ext == "zip":
-        with zipfile.ZipFile(archive_path, "r") as zf:
-            return zf.read(binary_name)
-    else:
-        raise ValueError(f"Unknown archive extension: {ext}")
-
-
-def read_pyproject_metadata(pyproject_dir: Path) -> dict:
-    """Read metadata fields from pyproject.toml (simple parser, no toml dep)."""
-    pyproject_path = pyproject_dir / "pyproject.toml"
-    text = pyproject_path.read_text()
-
-    def extract_field(name: str) -> str:
-        m = re.search(rf'^{name}\s*=\s*"(.*?)"', text, re.MULTILINE)
-        if not m:
-            raise ValueError(f"Could not find {name} in {pyproject_path}")
-        return m.group(1)
-
-    readme_path = pyproject_dir / "README.md"
-    readme = readme_path.read_text() if readme_path.exists() else ""
-
-    return {
-        "name": extract_field("name"),
-        "version": extract_field("version"),
-        "description": extract_field("description"),
-        "license": extract_field("license"),
-        "requires_python": extract_field("requires-python"),
-        "readme": readme,
-    }
-
-
-def read_init_py(pyproject_dir: Path) -> bytes:
-    """Read the __init__.py file for inclusion in wheels."""
-    init_path = pyproject_dir / "socket_patch" / "__init__.py"
-    return init_path.read_bytes()
-
-
-def build_wheel(
-    target: str,
-    info: dict,
-    version: str,
-    metadata: dict,
-    init_py: bytes,
-    binary_data: bytes,
-    dist_dir: Path,
-) -> Path:
-    """Build a single platform-tagged wheel and return the path."""
-    platform_tag = info["platform_tag"]
-    binary_name = info["binary_name"]
-
-    # Wheel filename: {name}-{version}-{python tag}-{abi tag}-{platform tag}.whl
-    wheel_name = f"{DIST_NAME}-{version}-py3-none-{platform_tag}.whl"
-    wheel_path = dist_dir / wheel_name
-
-    dist_info = f"{DIST_NAME}-{version}.dist-info"
-
-    # Build file entries: (archive_name, data, is_executable)
-    files = []
-
-    # __init__.py
-    files.append((f"{DIST_NAME}/__init__.py", init_py, False))
-
-    # Binary
-    files.append((f"{DIST_NAME}/bin/{binary_name}", binary_data, True))
-
-    # METADATA
-    metadata_header = (
-        f"Metadata-Version: 2.1\n"
-        f"Name: {metadata['name']}\n"
-        f"Version: {version}\n"
-        f"Summary: {metadata['description']}\n"
-        f"License: {metadata['license']}\n"
-        f"Requires-Python: {metadata['requires_python']}\n"
-    )
-    if metadata.get("readme"):
-        metadata_header += "Description-Content-Type: text/markdown\n"
-        metadata_header += f"\n{metadata['readme']}"
-    metadata_content = metadata_header.encode()
-    files.append((f"{dist_info}/METADATA", metadata_content, False))
-
-    # WHEEL
-    wheel_content = (
-        f"Wheel-Version: 1.0\n"
-        f"Generator: build-pypi-wheels.py\n"
-        f"Root-Is-Purelib: false\n"
-        f"Tag: py3-none-{platform_tag}\n"
-    ).encode()
-    files.append((f"{dist_info}/WHEEL", wheel_content, False))
-
-    # entry_points.txt
-    entry_points_content = (
-        "[console_scripts]\n" "socket-patch = socket_patch:main\n"
-    ).encode()
-    files.append((f"{dist_info}/entry_points.txt", entry_points_content, False))
-
-    # Build RECORD (must be last, references all other files)
-    record_lines = []
-    for name, data, _ in files:
-        record_lines.append(f"{name},{sha256_digest(data)},{len(data)}")
-    # RECORD itself has no hash
-    record_name = f"{dist_info}/RECORD"
-    record_lines.append(f"{record_name},,")
-    record_content = "\n".join(record_lines).encode()
-    files.append((record_name, record_content, False))
-
-    # Write the zip
-    with zipfile.ZipFile(wheel_path, "w", zipfile.ZIP_DEFLATED) as zf:
-        for name, data, is_exec in files:
-            info_obj = zipfile.ZipInfo(name)
-            # Set external_attr for executable files (unix permissions)
-            if is_exec:
-                info_obj.external_attr = (stat.S_IRWXU | stat.S_IRGRP | stat.S_IXGRP | stat.S_IROTH | stat.S_IXOTH) << 16
-            else:
-                info_obj.external_attr = (stat.S_IRUSR | stat.S_IWUSR | stat.S_IRGRP | stat.S_IROTH) << 16
-            info_obj.compress_type = zipfile.ZIP_DEFLATED
-            zf.writestr(info_obj, data)
-
-    return wheel_path
-
-
-def main():
-    parser = argparse.ArgumentParser(
-        description="Build platform-tagged PyPI wheels for socket-patch"
-    )
-    parser.add_argument(
-        "--version",
-        required=True,
-        help="Package version (e.g., 1.5.0)",
-    )
-    parser.add_argument(
-        "--artifacts",
-        required=True,
-        help="Directory containing build artifacts",
-    )
-    parser.add_argument(
-        "--dist",
-        default="dist",
-        help="Output directory for wheels (default: dist)",
-    )
-    parser.add_argument(
-        "--pyproject-dir",
-        default=None,
-        help="Directory containing pyproject.toml (default: pypi/socket-patch relative to script)",
-    )
-    args = parser.parse_args()
-
-    dist_dir = Path(args.dist)
-    dist_dir.mkdir(parents=True, exist_ok=True)
-
-    repo_root = Path(__file__).resolve().parent.parent
-
-    built = []
-    skipped = []
-
-    artifacts_dir = Path(args.artifacts)
-
-    if args.pyproject_dir:
-        pyproject_dir = Path(args.pyproject_dir)
-    else:
-        pyproject_dir = repo_root / "pypi" / "socket-patch"
-
-    metadata = read_pyproject_metadata(pyproject_dir)
-    init_py = read_init_py(pyproject_dir)
-
-    for target, info in TARGETS.items():
-        archive_ext = info["archive_ext"]
-        archive_path = artifacts_dir / f"socket-patch-{target}.{archive_ext}"
-        if not archive_path.exists():
-            skipped.append(target)
-            continue
-
-        print(f"Building wheel for {target} ({info['platform_tag']})...")
-        binary_data = extract_binary(artifacts_dir, target, info)
-        wheel_path = build_wheel(
-            target=target,
-            info=info,
-            version=args.version,
-            metadata=metadata,
-            init_py=init_py,
-            binary_data=binary_data,
-            dist_dir=dist_dir,
-        )
-        size_mb = wheel_path.stat().st_size / (1024 * 1024)
-        print(f"  -> {wheel_path.name} ({size_mb:.1f} MB)")
-        built.append(wheel_path)
-
-    print(f"\nBuilt {len(built)} wheel(s) in {dist_dir}/")
-    if skipped:
-        print(f"Skipped {len(skipped)} target(s) (artifact not found): {', '.join(skipped)}")
-
-    if not built:
-        print("ERROR: No wheels were built!", file=sys.stderr)
-        sys.exit(1)
-
-
-if __name__ == "__main__":
-    main()
diff --git a/scripts/bump-version.sh b/scripts/bump-version.sh
index 061e175b..d80cd24c 100755
--- a/scripts/bump-version.sh
+++ b/scripts/bump-version.sh
@@ -7,7 +7,7 @@
 # scripts/release-lint.sh, run by CI on the bump PR and again by the `version`
 # job in release.yml), so this script is the intended way to start a release:
 #
-#   scripts/bump-version.sh 3.4.0 --pr
+#   scripts/bump-version.sh 5.0.0 --pr
 #
 # or dispatch the "Version Bump" workflow (.github/workflows/version-bump.yml),
 # which runs this script on a fresh checkout of main. Running it locally is
@@ -147,7 +147,7 @@ ${NOTES}
 
 1. Dispatch the **Release** workflow on the default branch (optionally with
    \`dry-run: true\` first). It builds all targets, tags \`v${VERSION}\`, creates
-   the GitHub release, and publishes every ecosystem package.
+   the GitHub release, and publishes the crates.io and npm packages.
 2. Approve the staged npm versions with 2FA — platform packages first, then
    \`@socketsecurity/socket-patch\` (link in the run's step summary).
 3. On a partial failure: fix the cause and use "Re-run failed jobs" on the
diff --git a/scripts/dispatch-publish.sh b/scripts/dispatch-publish.sh
index 235a47fa..349e7ca5 100755
--- a/scripts/dispatch-publish.sh
+++ b/scripts/dispatch-publish.sh
@@ -13,7 +13,7 @@
 #   <version>        X.Y.Z; the tag v<version> must exist (the dispatch runs
 #                    the workflow file as of that tag)
 #   [key=value]...   extra workflow inputs, passed through as `-f key=value`
-#                    (e.g. sums-digest=<sha256> for the npm/PyPI legs)
+#                    (e.g. sums-digest=<sha256> for the npm leg)
 #
 # Requires: gh authenticated via GH_TOKEN with actions:write on
 # $GITHUB_REPOSITORY; GITHUB_RUN_ID/GITHUB_RUN_ATTEMPT for run correlation.
diff --git a/scripts/release-lint.sh b/scripts/release-lint.sh
index 6f52493e..64d54284 100755
--- a/scripts/release-lint.sh
+++ b/scripts/release-lint.sh
@@ -7,7 +7,7 @@
 # Checks (all failures are collected and reported together):
 #   1. The version is a plain X.Y.Z release version and matches Cargo.toml.
 #   2. Version coherence: `scripts/version-sync.sh <version>` is a no-op —
-#      every stamped site (npm/pypi/gem/cargo) already
+#      every stamped site (npm/cargo) already
 #      carries the workspace version. Catches hand-edited drift in any single
 #      site. NOTE: this runs version-sync, which refreshes the npm lockfile
 #      (network); files the sync touches are restored afterwards, so the tree
diff --git a/scripts/version-sync.sh b/scripts/version-sync.sh
index 7b06e4ef..1aa22514 100755
--- a/scripts/version-sync.sh
+++ b/scripts/version-sync.sh
@@ -3,8 +3,6 @@
 #   - Cargo.toml (workspace version + socket-patch-core exact pin)
 #   - npm/socket-patch/package.json (+ optionalDependencies, package-lock.json)
 #   - npm/socket-patch-*/package.json (per-platform packages)
-#   - pypi/socket-patch/pyproject.toml
-#   - gem/socket-patch/socket-patch.gemspec + lib/socket_patch/launcher.rb
 set -euo pipefail
 
 VERSION="${1:?Usage: version-sync.sh <version>}"
@@ -63,25 +61,4 @@ for platform_dir in "$REPO_ROOT"/npm/socket-patch-*/; do
   fi
 done
 
-# Update PyPI package version
-pyproject="$REPO_ROOT/pypi/socket-patch/pyproject.toml"
-sed -i.bak "s/^version = \".*\"/version = \"$VERSION\"/" "$pyproject"
-rm -f "$pyproject.bak"
-
-# pypi/socket-patch-hook and gem/socket-patch-bundler are frozen: `setup`
-# was removed in v5 and neither is built or published any more.
-
-# Update the RubyGems CLI launcher gem (gemspec version + the VERSION constant
-# the launcher uses to pick the matching GitHub release binary).
-ruby_cli_gemspec="$REPO_ROOT/gem/socket-patch/socket-patch.gemspec"
-if [ -f "$ruby_cli_gemspec" ]; then
-  sed -i.bak "s/s\.version *= *\".*\"/s.version     = \"$VERSION\"/" "$ruby_cli_gemspec"
-  rm -f "$ruby_cli_gemspec.bak"
-fi
-ruby_cli_launcher="$REPO_ROOT/gem/socket-patch/lib/socket_patch/launcher.rb"
-if [ -f "$ruby_cli_launcher" ]; then
-  sed -i.bak "s/VERSION = \".*\"/VERSION = \"$VERSION\"/" "$ruby_cli_launcher"
-  rm -f "$ruby_cli_launcher.bak"
-fi
-
 echo "Synced version to $VERSION"

From 785fbb0c60a2f799a7ef8cbe2485d3c4d2114a6b Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Wed, 30 Sep 2026 12:01:46 +0200
Subject: [PATCH 31/32] docs(v5): consolidate guides and remove stale research
 (#299)

---
 CHANGELOG.md                                  |  2304 +-
 README.md                                     |  1606 +-
 crates/socket-patch-cli/CLI_CONTRACT.md       |    30 +-
 .../src/commands/scan/rollout.rs              |     4 +-
 .../src/commands/scan/rollout_args.rs         |     4 +-
 .../tests/e2e_golang_hosted_build.rs          |     2 +-
 .../tests/e2e_hosted_production.rs            |     4 +-
 .../tests/e2e_redirect_gem_build.rs           |     6 +-
 crates/socket-patch-core/README.md            |    14 +-
 .../src/patch/redirect/mod.rs                 |     2 +-
 crates/socket-patch-core/src/policy/mod.rs    |     2 +-
 crates/socket-patch-core/src/rollout/stage.rs |     2 +-
 .../src/vendor/go_sum_edit.rs                 |     2 +-
 crates/socket-patch-core/src/vendor/golang.rs |     2 +-
 docs/configuration.md                         |   146 +
 docs/design/configuration.md                  |   178 -
 docs/design/golang-hosted-no-go.md            |   115 -
 docs/design/golang-hosted.md                  |   211 -
 .../adversarial-env.md                        |   162 -
 .../adversarial-integrity.md                  |   192 -
 .../adversarial-lifecycle.md                  |   305 -
 .../adversarial-shapes.md                     |   161 -
 .../nuget-vendoring-research/code-map.md      |   228 -
 .../design/nuget-vendoring-research/critic.md |    84 -
 .../nuget-vendoring-research/depscan.md       |   204 -
 .../nuget-vendoring-research/lock-cache.md    |    81 -
 .../design/nuget-vendoring-research/shapes.md |   155 -
 .../nuget-vendoring-research/signing.md       |   102 -
 .../nuget-vendoring-research/sources.md       |   134 -
 docs/design/nuget-vendoring.md                |   914 -
 docs/design/repacking-to-depscan.md           |  1014 -
 docs/design/staged-rollout.md                 |  1180 -
 docs/design/v5-plan.md                        |   227 -
 docs/design/v5-waste-review.md                |   360 -
 docs/development.md                           |    98 +
 docs/ecosystems.md                            |    65 +-
 docs/migrating-to-v5.md                       |    78 +
 docs/releasing.md                             |     2 +-
 docs/testing/README.md                        |    50 +
 docs/testing/bun-compatibility.md             |    56 +-
 docs/testing/hosted-production-e2e.md         |   351 +-
 docs/testing/npm-compatibility.md             |    35 +-
 docs/testing/pdm-compatibility.md             |    57 +-
 docs/testing/pdm-compatibility/results.json   | 29124 -------
 docs/testing/pipenv-compatibility.md          |    66 +-
 .../testing/pipenv-compatibility/results.json | 72046 ----------------
 docs/testing/poetry-compatibility.md          |    52 +-
 .../testing/poetry-compatibility/results.json | 11925 ---
 docs/testing/uv-compatibility.md              |   216 +-
 docs/testing/uv-compatibility/binaries.json   |   296 -
 .../uv-compatibility/conditional-probes.json  |   573 -
 docs/testing/uv-compatibility/results.json    | 21810 -----
 docs/testing/vendored-production-e2e.md       |   257 +-
 docs/testing/yarn-berry-compatibility.md      |    43 +-
 docs/usage.md                                 |   195 +
 scripts/backtest-uv.py                        |     4 +-
 56 files changed, 1067 insertions(+), 146469 deletions(-)
 create mode 100644 docs/configuration.md
 delete mode 100644 docs/design/configuration.md
 delete mode 100644 docs/design/golang-hosted-no-go.md
 delete mode 100644 docs/design/golang-hosted.md
 delete mode 100644 docs/design/nuget-vendoring-research/adversarial-env.md
 delete mode 100644 docs/design/nuget-vendoring-research/adversarial-integrity.md
 delete mode 100644 docs/design/nuget-vendoring-research/adversarial-lifecycle.md
 delete mode 100644 docs/design/nuget-vendoring-research/adversarial-shapes.md
 delete mode 100644 docs/design/nuget-vendoring-research/code-map.md
 delete mode 100644 docs/design/nuget-vendoring-research/critic.md
 delete mode 100644 docs/design/nuget-vendoring-research/depscan.md
 delete mode 100644 docs/design/nuget-vendoring-research/lock-cache.md
 delete mode 100644 docs/design/nuget-vendoring-research/shapes.md
 delete mode 100644 docs/design/nuget-vendoring-research/signing.md
 delete mode 100644 docs/design/nuget-vendoring-research/sources.md
 delete mode 100644 docs/design/nuget-vendoring.md
 delete mode 100644 docs/design/repacking-to-depscan.md
 delete mode 100644 docs/design/staged-rollout.md
 delete mode 100644 docs/design/v5-plan.md
 delete mode 100644 docs/design/v5-waste-review.md
 create mode 100644 docs/development.md
 create mode 100644 docs/migrating-to-v5.md
 create mode 100644 docs/testing/README.md
 delete mode 100644 docs/testing/pdm-compatibility/results.json
 delete mode 100644 docs/testing/pipenv-compatibility/results.json
 delete mode 100644 docs/testing/poetry-compatibility/results.json
 delete mode 100644 docs/testing/uv-compatibility/binaries.json
 delete mode 100644 docs/testing/uv-compatibility/conditional-probes.json
 delete mode 100644 docs/testing/uv-compatibility/results.json
 create mode 100644 docs/usage.md

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5e31e5ad..028853db 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,2200 +17,122 @@ into the new version's section — see docs/releasing.md.
 
 ## [Unreleased]
 
-> **v5 at a glance.** The CLI is built around one workflow: `socket-patch
-> scan` patches dependencies by rewriting lockfiles so only the patched
-> packages resolve to Socket-hosted, integrity-pinned copies (hosted mode is
-> the default, and scan never prompts); `socket-patch vex` emits OpenVEX for
-> vulnerability scanners; `socket-patch vendor` ejects the patches into
-> `.socket/vendor/` for offline installs (it ejects a hosted project: no
-> manifest needed); `socket-patch list` shows them. Hosted mode keeps no
-> ledger — the lockfile edits are the whole change, and `rollback` restores
-> each hosted package to its upstream registry entry. `get`, `remove` and
-> `rollback` work in every mode; `apply` and `repair` are the agent-mode
-> commands; `setup` is removed.
-
-> **Semver note:** this entry changes `rollback`'s default behavior, narrows
-> the meaning of its existing `vendored: []` JSON key, makes vendored mode
-> manifest-free, moves vendored cargo wiring from `.cargo/config*` into
-> `Cargo.toml`, tags vendored cargo copies' versions with `+socket.<uuid>`
-> (visible to the patched crate as `CARGO_PKG_VERSION`), makes a bare `scan`
-> run hosted mode without prompting, changes which patch scan picks when a
-> package has several, makes `vex`
-> refuse to attest stale ledger records and corrupt vendor ledgers, drops the
-> hosted redirect ledger (`rollback` / `remove` now restore upstream registry
-> entries and refuse where they cannot; `list`'s hosted `details.ledger`
-> becomes `details.lockfiles`; scan's `redirectState` loses `ledger` /
-> `ledgerKey`; `vendor_supersedes_redirect` and `hosted_revert_unsupported`
-> are gone), and
-> retries a throttled patch API (new error text, added waiting, a throttled
-> package failing its legacy-proxy batch), and removes the `setup`
-> subcommand — all
-> MAJOR per CLI_CONTRACT.md's semver policy — so it ships as the next major
-> release (v5.0).
-
-### Removed (BREAKING)
-
-- **`setup` is removed, with every install hook it wired.** `socket-patch
-  setup` (and `--check` / `--remove` / `--exclude`, `SOCKET_SETUP_EXCLUDE`)
-  is now an unknown subcommand: a clap usage error, exit 2. The hooks it
-  wrote were npm `postinstall` / `dependencies` scripts, the
-  `socket-patch[hook]` Python dependency (a `.pth` startup hook), a Bundler
-  plugin under `.socket/bundler-plugin/` plus a managed `plugin
-  "socket-patch"` Gemfile block, and Composer `post-install-cmd` /
-  `post-update-cmd` entries. Hooks already committed keep working, since
-  they only call `socket-patch apply`, which stays; delete them by hand to
-  stop them. The README's "Upgrading from `setup`" section lists each hook
-  and the commands to move to hosted mode or keep agent mode. Agent mode is now `socket-patch scan --mode agent` once
-  (commit `.socket/`), then `socket-patch apply` in CI after every install.
-  Hosted and vendored mode never needed a hook.
-- **PyPI and RubyGems distributions are removed.** The `socket-patch` wheel
-  and launcher gem, `socket-patch-hook` wheel, and `socket-patch-bundler` gem
-  are no longer built or published. Their sources, package tests, publishing
-  workflows, wheel builder, and version-sync entries are removed. Install
-  the standalone binary via `https://install.socket.dev/patch` (preferred),
-  `cargo install socket-patch-cli`, or `npm install -g @socketsecurity/socket-patch`.
-  npm remains available for the official Socket CLI. Python and Ruby dependency
-  patching remain supported; see the README's migration instructions.
-- **`vex` no longer drops agent-mode patches whose ecosystem has no
-  install hook** ("Property 7"). A manifest patch that verifies as applied
-  (or any manifest patch under `--no-verify`) is now attested whatever the
-  ecosystem. The `ecosystem_not_setup` `skipped` code, its stderr note and
-  its `no_applicable_patches` message are retired. A manifest's `setup`
-  object (`manual`, `exclude`) still parses and is kept on rewrite, but
-  nothing reads it.
-- **The `patch_setup` telemetry event** is gone with the command.
-- **Core crate:** the `setup` and `package_json` modules and the
-  `gem_setup` / `composer_setup` / `pth_hook` aliases are removed from
-  `socket-patch-core`, along with the setup-only `npm_family` table column
-  (`FileRow::detects_pnpm`) and `VLT_SETUP_MARKERS`.
-- **v3/v4 compatibility spellings are gone.**
-  - The v3.0 legacy env names `SOCKET_PATCH_PROXY_URL`, `SOCKET_PATCH_DEBUG`
-    and `SOCKET_PATCH_TELEMETRY_DISABLED` are no longer read and no longer
-    print a deprecation warning. Use `SOCKET_PROXY_URL`, `SOCKET_DEBUG` and
-    `SOCKET_TELEMETRY_DISABLED`.
-  - The hidden `scan --redirect` flag (use `--mode hosted`) and the hidden
-    no-op `scan --detached` flag (vendored mode is always manifest-free) are
-    removed. Both are now unknown-flag usage errors (exit 2).
-  - The hidden `--mode` values `host`, `redirect` and `vendor` on `scan` and
-    `get` are rejected; only `hosted`, `vendored` and `agent` are accepted.
-    The hidden `scan --apply` and `scan --vendor` spellings stay.
-- **`get --one-off` and `rollback --one-off`** (and `SOCKET_ONE_OFF`) are
-  removed. They were never implemented and only failed with a usage error;
-  `--one-off` is now an unknown-flag error (still exit 2) and
-  `SOCKET_ONE_OFF` is ignored.
-- **`.socket/packages/` package archives are no longer read.** Nothing has
-  written them for several releases. `apply`, `vendor` and `repair` stop
-  probing and staging the directory, and `apply`'s JSON `appliedVia` loses
-  its `"package"` value (`"diff"` or `"blob"` remain). The GC sweeps
-  (`scan --prune`, `rollback`, `remove`, `repair`) delete any leftover
-  `.socket/packages/` files whole (`rollback` and `scan --prune` still
-  report them as `removedPackageArchives`).
-- **Core crate:** removed uncalled public helpers
-  (`bun_lock::snapshot_binary_workspace_artifacts`, `vlt_lock_sniff_ok`,
-  and several `lock_inventory::view` accessors) and the never-read
-  `DepOverride::berry_zip_url` field (a `berryZipUrl` key in a patch
-  reference still parses).
-
-### Changed (BREAKING): patch UI streamlining
-
-- **`list` on an empty project exits 0.** A project with no manifest and
-  no ledger record (normal for hosted mode) used to exit 1 with
-  `manifest_not_found`; it now prints `No patches in this project. Run
-  \`socket-patch scan\`.` (human) or the success envelope with
-  `events: []` (`--json`). Only an unreadable or invalid manifest fails.
-- **Help is grouped by task**: patch (`scan`, `get`, `list`), undo
-  (`remove`, `rollback`), ship (`vex`, `vendor`), and agent mode
-  (`apply`, `repair`). `-h` keeps `--cwd`, `--ecosystems` and
-  `--offline`; `scan --prune` moves to `--help`.
-- **Hosted and vendored `get` never prompt.** Like `scan`, they take the
-  top-ranked accessible patch per package with no picker and no
-  confirmation, in `--json` too (no `selection_required` outside agent
-  mode). Agent-mode `get` keeps its picker and `Download and apply N
-  patches?` prompt.
-- **`get` usage errors exit 2** (were 1): `get`'s
-  `--id`/`--cve`/`--ghsa`/`--package` multi-select,
-  `--mode hosted|vendored --save-only` and a malformed forced identifier.
-  Every usage error now exits 2.
-- **Human output:** warning lines no longer carry the `(code)` tag
-  (`Warning: …`, `GC: skipped: …`); the codes stay in the JSON envelope.
-  Error lines keep theirs (`Error (<code>): …`). Hosted mode is called "hosted", not "redirect", in human
-  text (`Switched 2 packages to hosted patches; rewrote 1 file.`). npm's
-  `allow-remote` notice is one line (full text under `--verbose` and in
-  `--json`). Hosted and vendored runs share one numbered `Next steps:`
-  block. Every declined prompt prints `Cancelled; no changes made.`, and
-  scan/get share one paid-plan upsell line.
-- **`-h` is short**: about eight options per command (`--json`,
-  `--dry-run`, `--cwd`, `--ecosystems`, `--offline`, `--yes` where the
-  command prompts, and the command's main flags); `--help` still lists everything. The deprecated
-  `scan --apply` / `--vendor` spellings are hidden from both (still
-  accepted).
-
-### Changed (BREAKING)
-
-> **Ledger-free hosted mode.** The first entries below supersede every
-> earlier entry in this section (and under Added / Fixed) that describes
-> the hosted redirect ledger (`.socket/vendor/redirect-state.json`): its
-> writes, quarantine, per-purl reverts, whole-ledger replay, ledger
-> records in `list` / `vex` / `scan`, and `vendor_supersedes_redirect`.
-> Those describe intermediate v5 development states; the ledger-free
-> contract here is what ships.
-
-- **Hosted mode keeps no ledger.** `scan --mode hosted` / `get --mode
-  hosted` (and the in-memory hosted engine behind the hosted bundle) write
-  ONLY their lockfile / registry-config edits:
-  `.socket/vendor/redirect-state.json` is never written — not on success,
-  not on failure — so a hosted project commits just its lockfile and config
-  changes (`Commit package-lock.json to keep the redirect.`). A pre-v5
-  ledger on disk is ignored by scan (never read for planning, never
-  quarantined, left byte-identical); a re-run plans from the current lock
-  text and is idempotent. The in-run `scan --mode hosted --vex` attests from
-  the patch records this run fetched, and the gem / Python stale-install
-  probes judge only those (a purl whose record fetch failed is not judged
-  this run: `record_fetch_failed` now says the in-run VEX omits it and
-  `socket-patch vex` fetches it again once the API answers).
-- **`rollback` and `remove` restore hosted pins to their upstream registry
-  entries.** With no ledger to replay, each hosted pin the lockfiles wire
-  (discovered like `vex` does: a hosted URL counts only on
-  `https://patch.socket.dev` or the `--patch-server-url` origin) is
-  rewritten back to the DEFAULT UPSTREAM registry entry for `name@version`,
-  re-resolving what the entry pins from the public registry (core
-  `patch::redirect::upstream`). Restored formats: `package-lock.json` /
-  `npm-shrinkwrap.json`, `yarn.lock` (classic and berry), `pnpm-lock.yaml` /
-  `shrinkwrap.yaml`, `bun.lock` and `vlt-lock.json` (npm registry version
-  document), `Cargo.lock` + `Cargo.toml` + the project cargo config
-  (crates.io sparse index), `go.mod` / `go.sum` (module proxy + checksum
-  database; a user's pre-hosted `replace` is not recoverable, so the
-  restore lands on the plain upstream module), `Pipfile.lock`,
-  `requirements.txt`, Hatch direct references, `poetry.lock`, `pdm.lock`,
-  `uv.lock`, PEP 723 script locks and `pylock*.toml` (PyPI JSON API),
-  `Gemfile.lock` / `gems.locked` + the Gemfile source block (rubygems.org
-  compact index; the declaration comes back as the exact pin), `composer.lock`
-  (packagist v2 metadata), `pom.xml` + the `.mvn` trusted-checksums lines
-  (no network — restores offline), and `nuget.config` + `packages.lock.json`
-  (nuget.org `contentHash`). A pin is all-or-nothing and nothing is written
-  until every pin resolved; `--dry-run` resolves exactly like a wet run.
-  **Refused**, with nothing written for the pin and the message `cannot
-  restore <purl> to its upstream registry entry: <why>; restore it from
-  version control instead (`git checkout -- <files>`)`: every pin under
-  `--offline` except Maven, a registry that does not answer or no longer
-  describes the entry, a binary `bun.lockb` (for `rollback` / `remove`; see
-  the vendor takeover below), a composer entry that
-  is not packagist-sourced or whose `dist.reference` packagist no longer
-  serves, a gem whose upstream section is ambiguous or not rubygems.org, a
-  nuget id the restored config would not resolve from nuget.org alone, a
-  `pdm.lock` without `cross_platform` or a uv / pylock lock whose release has
-  a non-pure-Python-3 wheel, a uv lock whose options filter files or whose
-  registry is not PyPI's, uv 0.2 `[[distribution]]` locks, and any file
-  format the restore does not know. Rollback reports a refusal in
-  `hosted.failed[{purl, error}]` (exit 1, `partial_failure`; human `Error:
-  Cannot restore …`), `remove` as `hosted_revert_failed` before touching the
-  manifest. Human lines are `Restored <purl> to its upstream registry entry`
-  / `Would restore …`, and the prompt clause is `restore N hosted packages
-  to the upstream registry`. Scoped runs restore only the named pins (no
-  whole-ledger replay; `hosted.unsupported` is always empty and
-  `hosted_revert_unsupported` is gone), `--preserve-state` still restores
-  (`hosted_state_not_preservable`), and the vlt install heal still runs.
-  Side settings: a project `.npmrc` that is exactly `allow-remote=all` and a
-  `pnpm-workspace.yaml` that is exactly hosted mode's scaffold are deleted
-  once no lock entry needs them; otherwise the line stays with
-  `npm_allow_remote_left` / `pnpm_trust_lockfile_left` (v5 records no
-  provenance). New advisories: `maven_trusted_checksums_left`,
-  `nuget_default_config_left`, `upstream_uv_override_removed`. A pin
-  discovery cannot see (a lockless cargo pin, a nuget mapping with no
-  `packages.lock.json`, a Gemfile-only gem) is out of reach: restore those
-  files from version control. v4's `redirect_state_unreadable`,
-  `redirect_pnpm_trust_scaffold_modified` and
-  `redirect_npmrc_allow_remote_modified` are no longer emitted.
-- **The Pipenv hosted redirect keeps the entry's `index`.** A hosted
-  `Pipfile.lock` entry is now `{"file" | "path", "hashes"}` plus every key
-  but `version` exactly as Pipenv wrote it — `index` included, present or
-  absent — so `rollback` / `remove` carry it back instead of guessing it
-  from sibling entries. Pipenv records `index` by release, Pipfile spelling
-  and locking environment (2018.11.26 writes it for a marker-excluded
-  package, 2022.12.19 does not; 2022.12.19 writes it for an `extras` table,
-  2023.12.1 and later do not; no release writes it for a transitive
-  package), so no rule over the lock could re-derive it, and the guess left
-  those rollbacks off by one key. Measured on Pipenv 2018.11.26, 2020.11.15,
-  2021.11.23, 2022.12.19, 2023.12.1, 2024.4.1, 2025.1.3 and 2026.8.0: a
-  `file` entry carrying `index` still installs the referenced wheel itself
-  (`install --deploy`, `sync`, `verify`); Pipenv 7–11 ignore `index` on a
-  `path` entry. The restore refuses when the entry's `index` (or the
-  Pipfile's explicit one) does not name a PyPI source in `_meta.sources`.
-- **`list`, `vex`, `scan` and `repair` derive hosted state from the
-  lockfiles.** `list` shows one entry per hosted pin: JSON
-  `details.mode: "hosted"` plus `details.lockfiles: [<files wiring it>]`
-  (no `details.ledger`), human `Mode: hosted (wired in package-lock.json)`;
-  a pin carries only its uuid unless a pre-v5 ledger records the same purl
-  and uuid, and a ledger record whose pin is in no lockfile is no longer
-  listed. `scan --json`'s `redirectState` is now `{mode, records: [{purl,
-  uuid}], wiringLive}` built from the pins (no `ledger`, no
-  `records[].ledgerKey`) and is omitted when no lockfile pins a hosted
-  patch; `updates[]` folds the pins in (manifest > hosted pins > vendor
-  ledger), and `hosted_wiring_retained` keys on them. `vex` takes hosted
-  references from the lockfiles and their records from the API (online);
-  offline without a local record the pin is `record_unavailable`. A
-  malformed pre-v5 redirect ledger is now the WARNING
-  `redirect_ledger_corrupt` in `vex` (every form) and `list` — the run
-  continues — instead of `vex`'s exit-2 hard error. `repair` treats a
-  project with hosted pins (or a pre-v5 ledger) and nothing vendored as the
-  `redirect_only_project` skip, exit 0. A hosted URL on a staging host is
-  seen only with `--patch-server-url` (no ledger vouches for it any more).
-- **`vendor` ejects a hosted project, and vendoring over a hosted pin
-  restores upstream first.** Standalone `vendor` with no manifest and hosted
-  pins in the lockfiles takes its patch set from those pins, fetches each
-  record from the patch API, vendors into `.socket/vendor/` and rewires
-  hosted → vendored (`Ejecting N hosted packages into .socket/vendor/...`,
-  `Would eject …` on a dry run). The eject is one planned, all-or-nothing
-  transition: every record is fetched and every upstream restore resolved
-  before anything is written (a failure is `eject_refused`, nothing
-  touched); a dry run writes nothing (`eject_planned`); the wet run
-  snapshots the files it touches and, if vendoring then fails, puts them
-  back so the project stays hosted (`eject_rolled_back`). It works from a
-  fresh checkout (no installed tree needed). `--offline` refuses it with
-  `offline_eject_unavailable` and makes no requests. A lock whose hosted
-  wiring discovery cannot attribute is refused with
-  `hosted_wiring_contested` by eject, `rollback` and `remove` (a warning in
-  `list`). Without hosted pins the no-manifest no-op is unchanged. Every vendored flow (`vendor`, `scan` / `get --mode
-  vendored`) that meets a hosted pin — any ecosystem, no longer just cargo,
-  golang and the npm family — first restores its upstream registry entry
-  with the same restore as `rollback`, so the vendor ledger records the
-  upstream entry and **`vendor --revert` returns to upstream, never to
-  hosted**. `vendor_takeover_reverted_redirect` (`… was hosted; restored its
-  upstream registry entry (<files>) before vendoring (mode takeover)`) and
-  the dry-run `vendor_would_revert_redirect` keep their codes; a refused
-  restore fails the purl `redirect_revert_failed` (`cannot vendor over the
-  live hosted pin: …`) and leaves it hosted. The cargo backend's
-  `hosted_redirect_live` refusal now names `socket-patch rollback` and
-  `git checkout -- Cargo.toml Cargo.lock` instead of the ledger.
-- **Vendoring over a hosted binary `bun.lockb` works again** (Bun 0.8–1.1's
-  default lock and Bun 1.2's legacy lock; it was refused
-  `redirect_revert_failed` once the hosted ledger was gone). The takeover
-  and the eject rebuild each hosted remote-tarball record as Bun's npm
-  registry record for `name@version` from the registry's `dist.tarball` /
-  `dist.integrity`, re-derive the package metadata hash, drop the hosted
-  URL from the string pool, then vendor; `vendor --revert` returns the
-  pre-hosted lock. The hosted rewrite now keeps the registry record's
-  inactive bytes (padding, semver) in the tarball record it writes, and a
-  re-pin to a later grant's URL drops the superseded URL from the string
-  pool, so the rebuild is byte-exact — early writers' uninitialized padding included.
-  Where the hosted rewrite had to normalize the lock it marks it (in the
-  root package's resolution bytes, which no Bun reader reads): a binary
-  format 1 lock (Bun 0.1.1-0.1.6), promoted to format 2, is demoted back to
-  its exact format-1 bytes, and a lock whose workspace dependency behaviors
-  were normalized is refused with the `git checkout -- bun.lockb` remedy
-  instead of taken over non-exactly. `rollback` / `remove` keep refusing a
-  hosted `bun.lockb` pin with that remedy; an `--offline` vendor still refuses.
-- **`vendor_supersedes_redirect` is removed.** The vendored flows no longer
-  warn about (or auto-reconcile, or unwind the `.npmrc` for) a stale hosted
-  ledger record: once the lock routes a package to `.socket/vendor/`, no
-  hosted state is left to go stale. `redirect_supersedes_vendored` (hosted
-  over a vendored package) stays, classified from the lockfile pins.
-- **A pre-v5 hosted ledger is read for migration only, and `rollback`
-  retires it.** No command writes `redirect-state.json` any more; `list`
-  and `vex` read it only as an extra record source for a pin with the same
-  purl and uuid, and its edits are never replayed. `rollback` and `remove`
-  delete it once no lockfile pins a hosted patch (`legacy_redirect_ledger_kept`
-  warns when the delete fails), and a `rollback` in a project whose only
-  state is that file removes it and exits 0 (JSON
-  `legacyRedirectLedgerRemoved: true`) instead of failing on the missing
-  manifest.
-- **Registry base overrides for the upstream restore.** Besides the existing
-  `SOCKET_NPM_REGISTRY`, `SOCKET_GOPROXY` and `SOCKET_PYPI_JSON_API`, the
-  restore honors new env-only knobs for mirrors and tests:
-  `SOCKET_CRATES_INDEX` (default `https://index.crates.io`),
-  `SOCKET_GOSUMDB_URL` (`https://sum.golang.org`; else `GOSUMDB` /
-  `GONOSUMDB` / `GOPRIVATE` as go reads them), `SOCKET_RUBYGEMS_URL`
-  (`https://rubygems.org`), `SOCKET_PACKAGIST_URL`
-  (`https://repo.packagist.org`) and `SOCKET_NUGET_URL`
-  (`https://api.nuget.org`).
-
-- **`repair` no longer rebuilds the vendor ledger from lockfiles.** A
-  lockfile that references `.socket/vendor/<eco>/<uuid>/` with no entry in
-  `.socket/vendor/state.json` now fails with `vendor_ledger_missing` (an
-  artifact-level `failed` event with `uuid` and `details.{ecosystem,path}`;
-  exit 1) instead of re-synthesizing the entry (`details.ledgerRestored` is
-  gone). The rewired lockfile cannot supply the pre-vendor originals a
-  revert needs, so the remedy is restoring `state.json` from version
-  control (or `git checkout -- <lockfile>` and re-vendoring). The unverified
-  npm "rebuild from the wired integrity" rung and the gem Gemfile wiring
-  reconstruction went with it; `rollback`'s missing-ledger error now asks
-  for `state.json` to be restored instead of naming `repair`.
-- **`repair` re-vendors broken artifacts the way `vendor` does.** Missing
-  or corrupt vendored artifacts go through the same vendored backend as
-  `vendor` / `scan --mode vendored` / `get --mode vendored`, so under the
-  default `--vendor-source auto` the patch service's prebuilt artifact is
-  downloaded again, with a local build as the fallback (and the only
-  source under `--offline` / `--vendor-source build`). The result is still
-  verified against the ledger fingerprint before it counts as `rebuilt`.
-  Failure details are now `vendor`'s own (for example "no installed
-  package found on disk"), and a drifted installed copy of a gem or pypi
-  release variant is no longer force-overwritten by repair — it fails the
-  same installed-variant check `vendor` applies. Internally, `vendor`, `scan`/`get --mode vendored`, `vendor --revert`,
-  `rollback`'s vendored leg, `remove` and `repair` now share one
-  `VendoredBackend { apply, revert, repair }`.
-- **Vendored runs refuse lock-text failures before downloading them.**
-  `scan --mode vendored` and `get --mode vendored` evaluate the vendor
-  backends' pure lock-text gates — pnpm, yarn classic and yarn berry
-  (coordinates; the lock / manifest reads and their line-ending, version,
-  `cacheKey` and `.yarnrc.yml` gates; override and `resolutions`
-  conflicts; the lock entry present and rewritable) and cargo's
-  `locked_version_mismatch` when it is the crate's first refusal — before
-  fetching patch views and pristine sources, so a package that will be
-  refused costs no network. This applies only to a package the vendor loop
-  would hand to its backend — one installed on disk, or one the lockfile
-  resolves to a verifiable registry source (the pristine fetch would
-  happen); a package absent from the lock and not installed keeps its
-  `skipped` / `package_not_installed` vendor event and its download
-  record, exactly as before. Such a package is now reported in the download
-  phase: `download.patches[]` records it as `action: "failed"` with the
-  backend's exact `errorCode` and `error`, `download.downloaded` drops and
-  `download.failed` rises by the number of such packages, and the vendor
-  envelope no longer carries their `failed` events (`vendor.summary.failed`
-  drops by the same number) nor, for lockfile-only packages, their
-  `vendor_fetched_missing` events. Exit code and the top-level `status`
-  are unchanged; the nested `vendor.status` becomes `success` when those
-  refusals were the vendor step's only failures (and when every selected
-  package is refused this way, the human arm prints `Nothing was
-  vendored: N patches failed (see above).`).
-  (The human `scan --mode vendored` arm still fetches the views its
-  baseline pre-check verifies.) Purls the lockfiles pin hosted keep the
-  vendor loop's refusal. Because no view is fetched, the
-  lock-text refusal now takes precedence over every outcome that came
-  from the view: a package that would also have hit a paid-access 403, a
-  failed view fetch or the no-applicable-files guardrail reports the lock
-  refusal instead.
-  The manifest-driven `vendor` command keeps its `failed` events but no
-  longer fetches the pristine source of a lockfile-only package it refuses
-  this way (no `vendor_fetched_missing` event, no registry request; with an
-  unreachable registry the gate's code replaces `vendor_fetch_failed`) —
-  again only when the lockfile resolves it to a verifiable source; one the
-  lock does not resolve keeps its `package_not_installed` skip.
-  On the polyglot monorepo fixture: 80 of 560 packages (74
-  `vendor_lock_entry_not_found`, 4 `vendor_override_conflict`, 2
-  `vendor_lock_entry_unsupported`) move to the download phase, saving 80
-  view requests and 3 registry tarballs per run.
-
-- **Vendored cargo copies carry a tagged version: `<version>+socket.<uuid>`.**
-  The vendored copy's own `Cargo.toml` `[package] version` is rewritten to
-  the patch-tagged version (`1.0.4+socket.<uuid>`; a version that already
-  has build metadata keeps it: `2.0.1+zstd.1.5.2.socket.<uuid>`), and the
-  detached `Cargo.lock` entry records that tagged version with no
-  `source` / `checksum` — exactly the lock cargo itself writes when it
-  resolves the `[patch]` against the tagged copy (verified by building on
-  cargo 1.41 in docker and on current stable, and by the CI
-  `cargo-old-toolchains` leg on the 1.41 / 1.56 docker images — a local
-  run without those images only type-checks on rustup toolchains:
-  `--locked` builds, the patched bytes compile, a registry crate that
-  depends on the patched one (`^1`) resolves to the copy too, since cargo
-  ignores build metadata when matching requirements, and `cargo metadata`
-  reports the tagged version). Every lock reference that spells the old
-  version (`"cfg-if 1.0.4"`, v1's `"cfg-if 1.0.4 (registry+…)"`) is
-  rewritten to the tagged version, in lock formats v1–v4; a lock the edit
-  cannot keep consistent (a leftover reference in another spelling, a v1
-  `replace`, an entry already at the tagged version) refuses before any
-  write with `cargo_lock_untaggable`, and a copy manifest whose version
-  literal cannot be rewritten byte-exactly fails the package with
-  `cargo_copy_untaggable`. The patch uuid of the copy cargo actually
-  builds is therefore recoverable from `Cargo.lock` alone (a config-level
-  `[patch]` override pointing elsewhere changes the locked version). **The
-  patched crate sees the tag in `CARGO_PKG_VERSION`** (and in
-  `env!("CARGO_PKG_VERSION")`-derived strings such as `--version` output
-  of a vendored binary crate): requirement matching on it
-  (`semver::VersionReq::matches`) is unaffected, but string comparisons
-  AND equality / ordering on a parsed `semver::Version` see the tag
-  (`semver` 1.x compares build metadata: `1.0.4+socket.<uuid>` is not
-  `== Version::new(1, 0, 4)` and sorts above it). Re-runs are idempotent
-  (a dry run previews the tag as "would tag", and the wet run's
-  `cargo_lock_untaggable` / `cargo_copy_untaggable` refusals); a uuid bump
-  re-tags the copy and the lock; `vendor --revert` / `rollback` /
-  `remove` / GC / the hosted takeover restore the original lock byte for
-  byte (tag dropped with the `source` / `checksum`; a crate vendored
-  before any `Cargo.lock` existed has no originals, so only the tag its
-  first build locked is dropped). A user's own same-version path crate
-  that cargo later locks beside the tagged copy (an untagged sourceless
-  entry) is never mistaken for it: re-runs stay in sync, and the revert
-  restores the registry entry — spelled by its full id while the fork
-  shares its name+version, exactly as cargo writes it — without touching
-  the fork. GC keeps an entry whose lock tag is stale (another uuid) while
-  the manifest still wires this entry's copy: cargo re-locks any unlocked
-  build to the wired copy, and the next re-run retags. Projects vendored
-  before tagged versions (the pre-v5 `.cargo/config*` wiring, or an
-  untagged manifest wiring) are tagged by the next re-run or `repair`
-  (`cargo_version_tagged` note; a tag `repair` cannot write is the
-  `cargo_version_untagged` warning); a whole-tree file inventory recorded
-  for the copy is kept, and still verifies through exactly this uuid's
-  tag, so tagging never re-baselines it over unverified bytes. VEX
-  discovery treats the tagged lock version as the primary identity
-  (`pkg:cargo/<name>@<version>` is the tag stripped): a detached entry
-  tagged for a different uuid than the wiring's copy path is dead wiring
-  (not attested), and so is a copy whose own `Cargo.toml` is tagged for
-  another uuid than its path; a tagged entry no visible wiring names is
-  diagnosed unattributable; an untagged detached entry counts only beside
-  an untagged copy (the pre-tag vendored shape) — beside a tagged copy it
-  is some other crate cargo built, not attested. A patch that edits the
-  crate's own `Cargo.toml` verifies with the tag dropped — the tag being
-  this copy's own uuid, the same pin the inventory check applies, so a copy
-  tagged for another patch stays a mismatch instead of verifying clean
-  while VEX refuses it.
-- **Vendored cargo wiring moved to `Cargo.toml`.** `vendor` / `scan` /
-  `get --mode vendored` write the `[patch.crates-io]` path entry into the
-  workspace-root `Cargo.toml` (beside the `Cargo.lock` it detaches) instead
-  of `.cargo/config.toml` / `.cargo/config`, so Socket scanners can recover
-  the patch uuid from the manifest alone and single-version wiring builds
-  on cargo older than 1.56 (the floor of config-file `[patch]`; proven on
-  cargo 1.41 with no network). TWO vendored versions of one crate need
-  cargo 1.45 or newer: from 1.45 `--offline` from an empty `$CARGO_HOME` is
-  enough (without `--offline` it first tries to update the crates.io index
-  and fails when that is unreachable), while cargo before 1.45 resolves
-  every source-less lock entry for a crate through one `[patch]` path and
-  fails closed on the other — see the `cargo_multi_version_old_cargo`
-  entry under Fixed. The edit is
-  format-preserving (comments, ordering, CRLF / mixed line endings, a
-  UTF-8 BOM and the trailing-newline state survive; a revert restores the
-  manifest byte for byte and keeps a user's own `[patch]` /
-  `[patch.crates-io]` headers). The key is always the Socket-owned
-  `<name>-socket-<uuid8>` with `package = "<name>"`, never the bare crate
-  name: cargo lets a config-file `[patch]` item (project, ancestor
-  directory or `$CARGO_HOME`) replace the manifest item with the same key
-  whatever its version, so a crate-named key could be silently shadowed —
-  and two vendored versions of one crate get distinct keys instead of
-  clobbering each other (the config wiring keyed by crate name let the
-  second overwrite the first). The ledger's `cargo_patch_entry` record now
-  names `Cargo.toml` (its `key` is the TOML key). New refusals, each before
-  any write: `cargo_manifest_unreadable`, `cargo_manifest_unparseable`,
-  `cargo_manifest_symlink_unsupported` (vendor and revert),
-  `cargo_manifest_not_workspace_root` (run from a workspace member, whose
-  `[patch]` cargo ignores) and `cargo_manifest_patch_source_alias` (the
-  manifest spells crates.io by URL in `[patch."https://github.com/rust-lang/crates.io-index"]`,
-  which replaces `[patch.crates-io]` wholesale);
-  `user_authored_patch_entry` now covers user entries in `Cargo.toml` and
-  in every cargo config file cargo merges (project, ancestors,
-  `$CARGO_HOME`) and matches by crate (`package` or key), sparing a path
-  patch that is provably another version. **Old wiring migrates
-  automatically**: a re-run or `repair` moves a Socket-owned
-  `.cargo/config*` entry into `Cargo.toml` (`cargo_wiring_migrated` note; a
-  migrating vendor re-run reports the package `applied`) and cleans a
-  config file / `.cargo/` the move emptied — a legacy entry that cannot be
-  removed fails the run and unwinds it (`cargo_legacy_wiring_kept`) — while
-  `rollback` / `remove` / `vendor --revert` / GC / hosted takeover remove
-  both spellings. Projects hit by the pre-v5 multi-version overwrite (a
-  detached lock entry nothing wired) are healed by a re-run or `repair`
-  (`cargo_wiring_restored`). User config entries are never touched. VEX
-  discovery reads the manifest first (key-agnostic), skips a manifest entry
-  that cargo ignores (a same-key project-config item or a URL-spelled
-  crates.io table replaces it), and still honors pre-v5 config wiring. The
-  hosted takeover's missing-ledger guard is now per version.
-- **Binary Bun lockfiles are patched natively in place.** Hosted and vendored
-  modes read and rewrite `bun.lockb` formats 1–3 directly, including mode
-  changes, repair, and scoped rollback. Binary-to-text conversion, migration
-  ledger replay, and their warning codes and tests have been removed.
-- **`rollback` is now the full-state dual of `scan`.** `scan` and `rollback`
-  are the batch primaries (`get`↔`remove` stay the single-patch duals): a
-  bare `rollback` restores the SYSTEM to unpatched across all three modes —
-  in-place file restore (agent), vendored unwire + artifact deletion +
-  ledger-entry drop, hosted lockfile-redirect unwind + redirect-record drop
-  — then removes the rolled-back entries from `.socket/manifest.json` and
-  GCs the now-unused blobs plus diff/package archives. No `--mode` needed:
-  state is inferred from the manifest, the vendor ledger, and the redirect
-  ledger, and rollback now runs manifest-less when a ledger holds work
-  (hosted-only and vendored projects; the truly-empty project
-  keeps the "Manifest not found" exit 1, and a wired-but-ledgerless project
-  errors naming `socket-patch repair`). Wet non-preserve runs confirm once
-  ("Roll back N patches, remove them from the local manifest, and delete
-  M vendored artifacts and their ledger records?" — auto-accepted under `--yes`/`--json`/non-TTY;
-  declining prints "Rollback cancelled." and exits 0). Drift-keeps, hosted
-  refusals/unsupported targets, corrupt ledgers, and a failed manifest
-  write exit 1 `partial_failure`; not-installed entries still exit 0.
-- **`rollback --json`'s `vendored: []` array narrows** to vendor-owned purls
-  the run did NOT act on (today: the corrupt-vendor-ledger skip). Acted-on
-  entries move to the new always-present `vendoredReverted` /
-  `vendoredPreserved` / `vendoredKept` arrays; the envelope also gains
-  always-present `warnings[]` (`{code, detail}`, now populated), `hosted`
-  (`{reverted, failed, unsupported, editedFiles}`), `manifest`
-  (`{removedEntries, preserved}`), `gc`, and `paths` keys.
-- **Vendored mode is manifest-free.** `scan --mode vendored` and
-  `get --mode vendored` never write (or read) `.socket/manifest.json`: the
-  selected patch records are fetched into memory and every vendor-ledger entry
-  carries `detached: true` plus the embedded `record` as its verification
-  source, so a vendored project's footprint is `.socket/vendor/**` only. The
-  former `--detached` opt-in is now the only vendored posture, and the flag
-  itself is removed (see "Removed"). JSON uses the detached download vocabulary for both
-  commands (`downloaded: N`, `detached: true`, `patches[].action` =
-  `downloaded` | `skipped` | `failed`). The vendor step vendors exactly what
-  discovery selected — the "whole manifest is vendored" re-vendor from a
-  committed manifest on an empty discovery is retired (`repair` verifies and
-  rebuilds committed vendored state) — and a legacy manifest record for a purl
-  a vendored run vendors is migrated into the ledger (dropped from the
-  manifest; an emptied manifest is left as `{"patches": {}}`). `list` now
-  reads the vendor ledger too, so a vendored-only project lists its patches
-  with a `Mode: vendored` label and exits 0 instead of `manifest_not_found`;
-  `scan --prune`'s lockfile-unused reconcile applies to every ledger entry
-  (the check is about the lockfile, not the manifest); and standalone `vendor`
-  with no manifest is a clean exit-0 no-op whose message names the missing
-  manifest (and the ledger entries `repair` verifies) instead of claiming
-  "No .socket folder found".
-- **A bare `scan` runs hosted mode and never prompts.** With no `--mode`
-  (or legacy mode flag), `scan` rewrites lockfiles so the patched
-  dependencies resolve to Socket-hosted packages, exactly like
-  `scan --mode hosted`; under `--json` its result nests under `redirect` as
-  before. Only a `--prune` or `--global` scan with no mode is still
-  report-only (neither has a project lockfile to rewire); it prints the
-  report and `To apply these patches in place, run: socket-patch scan
-  --mode agent [PATHS]`. `scan` asks nothing in any mode: the download and
-  redirect confirmations and the free-tier patch menu are gone (and with
-  them the `Non-interactive mode detected` note), so `--yes` no longer
-  changes what `scan` does. Human `scan --mode hosted` prints the results
-  table and update detection like the other modes, fetches patch details
-  with the agent arm's progress counter and per-package warnings, and an
-  empty hosted discovery prints `No patches available for installed
-  packages.` and exits 0 without entering the redirect engine; a discovery
-  whose every offer is paid-tier for an org without paid access stops the
-  same way with `No downloadable patches (paid subscription required).`.
-- **`get` defaults to hosted mode too.** `socket-patch get <id>` (and the
-  bare-UUID shortcut `socket-patch <uuid>`) now redirects the package's
-  lockfile entry to its Socket-hosted patched copy, like `scan`. Agent mode
-  (manifest + in-place apply) is `--mode agent`, and stays the default with
-  `--save-only` or `--global`/`--global-prefix`.
-- **scan picks the newest merged patch.** When a package has several
-  patches, `scan` (and `get`, and the `[UPDATE]` detection) now takes the
-  newest merged patch (one that fixes several advisories in one blob — the
-  package's cumulative fix) the account can download, whatever its
-  severity. A package with no merged patch keeps the old order: highest
-  severity, then newest.
-- **`apply.lock` never outlives a command, and hosted mode takes it.** Lock
-  acquisition creates `.socket/` when missing; the lock file is unlinked
-  (while still held) and an otherwise-empty `.socket/` removed when the
-  command exits, dry runs included, so there is nothing to `.gitignore` and
-  `repair` no longer has a lock-cleanup step (a leftover from a crashed run is
-  reclaimed and removed by the next lock-taking command; a live holder is
-  still `lock_held`, exit 1). `scan`/`get --mode hosted` now acquire the lock
-  around their first wet write — never on `--dry-run` or when nothing would
-  be written, so previews create no `.socket/` — and report `lock_held` /
-  `lock_io` like the other lock holders (top-level `errorCode` on the hosted
-  JSON shape; a read-only project root or a file squatting on `.socket/` is
-  refused at the lock, before any file is touched, and a
-  vendored→hosted takeover over a symlinked wiring file is refused with
-  `redirect_symlinked_file_unsupported` before any revert). The lock guard
-  unlinks only the file it holds (a replacement planted by a non-cooperating
-  `rm` + `touch` is left for the next acquire), and a long `--lock-timeout`
-  wait behind a hot loop of short commands can no longer accumulate its
-  vanished-file retries into a spurious `lock_io`. Agent-mode `get`
-  and `scan --apply`/`--sync` hold one lock window across download →
-  manifest write → nested apply (the nested apply no longer re-acquires and
-  now inherits `--lock-timeout`/`--verbose`); `scan --prune` acquires once for its vendored
-  reconcile and manifest prune, and the GC legs of `scan --prune` and
-  `vendor` honor `--lock-timeout` and report a lock I/O error instead of
-  silently skipping on it.
-- **Retired:** the legacy `.socket/cargo-patches` redirect takeover in the
-  cargo vendor backend (never shipped in a tagged release — such
-  `[patch.crates-io]` entries now refuse as `user_authored_patch_entry`) and
-  the `pypi_pipenv_invalid_wheel` refusal code (the Pipenv backend takes the
-  resolved version instead of parsing the wheel filename).
-- **`vex` attests a ledger record only while a lockfile still wires it —
-  even under `--no-verify`.** A vendor-ledger entry whose artifact no
-  lockfile/config references any more is omitted as `vendor_unwired`, and a
-  redirect-ledger record whose hosted patch no lockfile references as
-  `redirect_unwired` (a manifest-owned purl falls back to agent-mode
-  verification instead). Previously a reverted lockfile plus a leftover
-  `.socket/vendor/state.json` / `redirect-state.json` kept attesting, and
-  `--no-verify` / `--vex-no-verify` attested every ledger record outright;
-  those flags now skip only the hashing, never the wiring, record-match and
-  conflict gates. A malformed or unreadable `.socket/vendor/state.json` is
-  now the hard error `vendor_ledger_corrupt` (exit 2 standalone, the host
-  command fails under `--vex`) — a malformed pre-v5 redirect ledger is only
-  the `redirect_ledger_corrupt` warning (see the ledger-free entries) — instead
-  of a warning after which vendored patches silently lost their
-  committed-artifact verification and detached records.
-  Lockfiles that wire one package to different patches attest none of them
-  (`wiring_conflict`), and when the lockfile wires a package to patch U, a
-  manifest or ledger record for it under another uuid is superseded.
-
-- **A throttled patch API is retried with a bounded backoff.** An HTTP
-  429 or 503 from the patch API made the affected batch (or patch-list
-  query) fail on the first answer — likelier now that up to 32 requests are
-  in flight. Now every patch-API JSON call (batch search, per-package patch
-  lists, patch views and VEX record fetches, hosted package references)
-  retries a 429 / 503 up to 3 times: it waits as long as `Retry-After` asks
-  (delta-seconds or HTTP-date; one over 30 s is not waited out — the answer
-  is final at once — and one under the jittered first step, such as `0` or a
-  past date, waits that step), otherwise 0.5 s, 1 s, 2 s (steps capped at
-  8 s, jittered into their upper half). All retries in a run must end
-  within a 60 s wall-clock window opened by the run's first retry, so a
-  throttled run adds at most about a minute however many requests it makes
-  (requests waiting in parallel each keep their retries).
-  `SOCKET_API_MAX_RETRIES=<n>` (0-10) changes the count; `0` restores the
-  old single attempt. Nothing else is retried: 401/403 still trigger the
-  proxy fallback at once, and the public proxy's permanent `503 "Patch API
-  is not configured"` is never retried on any path (the batch still
-  degrades to per-package lookups at once; a per-package lookup answering
-  it is still skipped). Output folds in request order exactly as an
-  unthrottled run's. What breaks: a throttled run now takes longer before
-  it fails (up to ~60 s of added waiting); the error text changes — it
-  names why retrying stopped (`Rate limit exceeded (HTTP 429, gave up after
-  3 retries). Please try again later.`, `API request failed with status
-  503: <body> (gave up after 3 retries)`, `(Retry-After 120 s exceeds the
-  30 s retry cap)`, `(the run's 60 s retry window has closed)`); and on
-  the token-less legacy per-package proxy path (a proxy without `POST
-  /patch/batch`) a package still throttled after its retries now fails its
-  whole batch query — every package in that batch goes unchecked and the
-  batch is reported as failed (warning, or the all-failed error when it was
-  the only batch) — instead of that one package being skipped silently.
-
-- **scan honors the repo's socket.yml.** `projectIgnorePaths` (the
-  scanner's key) now also keeps `scan` from patching the matching projects,
-  in every mode and in the in-memory engine, whether or not the file has a
-  `patches` block (malformed values there only warn
-  `socket_yml_ignored_value`). See "socket.yml patch policy" in
-  CLI_CONTRACT.md.
-- **Test and fixture trees are skipped by default when scan discovers
-  projects.** `test/ tests/ fixtures/ __fixtures__/ testdata/` (any case)
-  are built-in `ignorePaths` for discovered roots: hosted/vendored
-  PATH-glob matches (`scan 'services/*'`) and the in-memory engine's
-  detected roots (which used to skip them through a hard-coded, case-
-  sensitive segment list). A directory you name (`--cwd`, a literal PATH,
-  `projectRoots`) is not affected; `ignorePaths: ["!/e2e/tests/"]`
-  re-includes one, in memory too.
-- **An invalid socket.yml fails scan.** An unparseable file, a misspelled
-  top-level `patches` key (`Patches`, `patchs`), a top-level merge or
-  aliased key, an invalid `patches` block (unknown key, wrong type, bad glob, `patches`
-  without `version: 2`), or `socket.yml` and `socket.yaml` that disagree
-  now fail `scan` before any request or write: exit 1, `errorCode:
-  socket_yml_invalid` / `socket_yml_ambiguous`, the key path and the fix
-  in the message. `--no-socket-yml` ignores the file for one run.
-- **scan rejects a PATH outside the repository root** (exit 2): one socket.yml
-  policy per invocation.
+v5 centers the workflow on `scan` (hosted patches), `vex` (OpenVEX attestations),
+and `vendor` (committed patched packages), with `list` for inspection. See the
+[v5 migration guide](docs/migrating-to-v5.md) before updating existing automation.
+
+### Breaking changes
+
+- `scan` and `get` default to hosted mode. `scan` never prompts, and hosted or
+  vendored `get` selects without an interactive menu. Explicit `--mode agent`
+  retains in-place patching; `get --save-only` and global targeting select agent
+  behavior by default. A mode-less global scan or `scan --prune` does not acquire
+  new patches, though `--prune` still cleans up obsolete state.
+- Hosted mode writes no ledger. `list`, VEX, and update discovery read the live
+  dependency references. `rollback` and `remove` restore upstream registry entries
+  rather than replaying saved edits, and refuse where restoration is unavailable
+  (including offline operation and binary `bun.lockb`). Legacy hosted ledgers are
+  read only for compatibility and removed by full rollback.
+- `rollback` restores dependencies and removes patch records and unused artifacts.
+  `--preserve-state`, also available on `remove`, keeps local state for reuse.
+  Hosted state has no local artifact to preserve.
+- Vendored scans and targeted gets are manifest-free. The vendor ledger embeds
+  patch records; `repair` no longer reconstructs a missing ledger from lockfiles.
+  `vendor` can eject hosted pins when no agent manifest exists. Reverting an
+  ejected package restores upstream dependencies.
+- Vendored Cargo patches use workspace-root `Cargo.toml` wiring and tagged
+  `<version>+socket.<uuid>` versions, visible to `CARGO_PKG_VERSION`. Re-running
+  vendoring or repair migrates older config-file wiring and untagged copies.
+- `socket.yml` policy now constrains scans. Invalid patch policy fails before
+  requests or writes. Discovered test and fixture projects are excluded by
+  default; literal project targets skip those defaults. Hosted/vendored PATHs
+  outside the repository are rejected.
+- Automatic patch selection prefers the newest merged patch, otherwise severity
+  and publication date. Existing patches change only when the new patch outranks
+  them; tier/UUID tie-breaking alone does not trigger replacement.
+- `setup`, its publishing helpers, and the PyPI/RubyGems CLI distributions are
+  removed. Standalone binaries, Cargo, and npm remain supported; Python and Ruby
+  project support is unchanged. Remove old hooks using the migration guide.
+- Removed `scan --redirect`, `scan --detached`, mode aliases `host`/`redirect`/
+  `vendor`, the unimplemented `--one-off` flags, and the three legacy
+  `SOCKET_PATCH_*` environment aliases listed in the migration guide.
+  `.socket/packages/` archives are no longer consumed; cleanup removes leftovers.
+- `list` on an empty project exits 0; `get` usage errors exit 2. Human help and
+  output are grouped by task, with diagnostic codes retained in JSON and verbose
+  output. Hosted JSON identifies lockfiles instead of a ledger; rollback's
+  `vendored` results contain vendor-owned entries only. See the
+  [CLI contract](crates/socket-patch-cli/CLI_CONTRACT.md) for exact schemas.
+- VEX requires live hosted/vendored wiring and reports corrupt vendor ledgers.
+  Verified agent patches no longer require a `setup` hook for attestation.
+- The core crate removes setup-related modules, obsolete public helpers, and the
+  unused `DepOverride::berry_zip_url` field. Patch references containing
+  `berryZipUrl` still parse.
 
 ### Added
 
-- **`scan --max-new-patches <N|none>` rolls patches out gradually**
-  (env `SOCKET_MAX_NEW_PATCHES`; socket.yml `patches.maxNewPatches`).
-  Each run adds at most N patches to packages that had none, most severe first
-  (then by how many advisories a patch fixes), and defers the rest to the
-  next run; upgrades of packages that are already patched are never
-  capped, and `0` means upgrades only. Repeated scans on an unchanged repo
-  add the same packages in the same order and stop once everything is
-  patched. A patch that cannot land (not granted, refused by a preflight,
-  nothing in the lockfile to pin) never holds a slot, and a failed lookup
-  admits nothing new that run (`rollout_incomplete_lookup`). The project
-  directories of one scan share the budget. Works in hosted, vendored and
-  agent mode, `--dry-run` included; `scan --json` gains a top-level
-  `rollout` block (`maxNewPatches`, `counts`, ranked `deferred[]`) and
-  hosted mode lists deferred rows in `redirect.skipped[]` as
-  `rollout_deferred`.
-- **The in-memory hosted engine paces rollouts too.** It (napi,
-  `hosted-bundle`) takes
-  `maxNewPatches`, `maxNewPatchesCap` and `inFlightPatches`, spends one
-  budget across every project root, and reports a session `rollout` block
-  and `ProjectResult.deferred[]`.
-- **socket.yml patch policy (staged rollout).** A `patches` block in the
-  repo-root socket.yml narrows what `scan` patches: `enabled` (false =
-  report only), `includePaths` / `ignorePaths` (gitignore patterns matched
-  against each project's lockfiles, npm `ignore` semantics),
-  `ecosystems`, `packages` / `ignorePackages` (`--package` specs),
-  `minSeverity` (critical|high|medium|moderate|low, judged by the worst
-  advisory a patch fixes) and `maxNewPatches` (the per-run cap of
-  `--max-new-patches`). List flags (`--ecosystems`,
-  `--package`, PATHs) only narrow further; `--min-severity` beats the
-  file's floor and `--no-socket-yml` ignores the file. A package
-  that already carries a patch is never removed, upgraded or replaced by
-  the policy: it is held and reported under `policy.retained[]`. New flags
-  `--min-severity` / `SOCKET_MIN_SEVERITY` and `--no-socket-yml` /
-  `SOCKET_NO_SOCKET_YML`; every successful `scan --json` result gains a
-  top-level `policy` block (`source`, `sha256`, `minSeverity`, `filtered[]`,
-  `retained[]`) and the human output a `Policy (socket.yml): …` line that
-  names every skipped project and every critical/high patch the severity
-  floor held back. In memory, selection is two-phase:
-  `selectHostedScanPaths` takes the root policy files' text
-  (`policyFiles`) and `noSocketYml`, applies the full path policy and
-  returns `policyPaths`, `policySha256` and `policyError`; the session
-  takes `noSocketYml` / `minSeverity` / `policyPaths` / `policySha256` and
-  its result carries `policy` or `policyError`.
-  `get` ignores the policy and warns `policy_bypassed`.
-
-- **`scan --package <name|purl>`** (repeatable or comma-separated, env
-  `SOCKET_SCAN_PACKAGES`) scopes a scan to the named packages: a name
-  (`lodash`, `@scope/pkg`, `group:artifact`) or a purl with or without its
-  version (`pkg:npm/lodash`, `pkg:pypi/requests@2.31.0`); names compare
-  case-insensitively.
-- **Hosted projects report patch updates from their lockfiles.** scan's
-  `updates[]` and `[UPDATE]` marker also see the hosted pins the lockfiles
-  wire (hosted mode keeps no ledger), so a hosted project still reports a
-  superseding patch.
-
-- **`apply` and `rollback` patch vlt installs in place.** A project
-  installed by vlt (`node_modules/.vlt/` or `node_modules/.vlt-lock.json`)
-  is detected as vlt ahead of any sibling bun, pnpm, yarn or npm marker,
-  and `apply` prints `Note: vlt layout detected…` in human mode. `scan`,
-  `get`, `apply`, `rollback` and `vex` find every package in vlt's store
-  (`node_modules/.vlt/<DepID>/node_modules/<name>`) in every DepID era,
-  including transitive-only packages, aliases, git/remote/`file:` entries
-  and workspace members' link-only trees. `apply` and `rollback` reach
-  every store copy of a patched `name@version` (vlt's `~peer.<n>`,
-  hashed-peer and modifier variants, and the legacy `··` / `·npm·` pair),
-  and every write replaces the file rather than writing through it, so
-  vlt 1.2's machine-wide store (hardlinked on Linux) stays untouched. The
-  store-copy failure note is now `store copy <path> failed to patch` /
-  `failed to roll back` for pnpm and vlt alike. `--update` in a vlt
-  project suggests `vlt install @socketsecurity/socket-patch@latest`, and
-  in vlx's cache `vlx -y -- @socketsecurity/socket-patch@latest …`.
-- **`rollback`, `remove` and the vendored takeover revert hosted vlt
-  redirects.** A `redirect_vlt_lock_node` ledger edit (written by the
-  depscan PR flow, or by `scan --mode hosted` once it rewrites
-  `vlt-lock.json`) puts the registry integrity and URL back on the node,
-  keeping whatever vlt re-laid since (a moved comma, a new flag or bins
-  slot, CRLF re-saved as LF). A node vlt has since re-locked away is
-  already reverted; any other change refuses with the `vlt-lock.json`
-  remedy. Peer and modifier variants are claimed per `name@version`.
-- **`scan --mode hosted` and `get --mode hosted` redirect vlt projects.**
-  `vlt-lock.json` default-registry nodes of a patched `name@version` (every
-  peer and modifier variant, in every DepID era and CRLF lock) keep their
-  DepID and get the patched sha512 and hosted URL; `vlt.json` is read only.
-  vlt drives confirmation when its install state is present or no other
-  npm-family lock is; otherwise both locks are rewritten
-  (`redirect_vlt_sibling_lockfiles`). Before anything is written, each
-  artifact is fetched as vlt fetches it: a response vlt would reject
-  (re-gzipped, wrong sha512, HTTP error, unreachable) withholds the dep
-  (`redirect_vlt_artifact_unverifiable`, whose detail spells the URL's
-  grant-token level `<redacted>`) instead of pinning a lock `vlt ci`
-  cannot install. After the write, stale installed copies of the
-  Socket-owned nodes (`node_modules/.vlt-lock.json` and their
-  `node_modules/.vlt/<DepID>` entries) are removed so the next `vlt install`
-  extracts the patched packages; `rollback` and `remove` do the same for
-  the registry bytes. New `--no-vlt-install-cleanup` /
-  `SOCKET_NO_VLT_INSTALL_CLEANUP` keeps them, and the
-  `redirect_vlt_reinstall_required` advisory says what to run. A stale
-  copy of an optional dependency is never removed, because `vlt install`
-  would not put it back; the advisory says to run `vlt ci` instead
-  (after upgrading to vlt 1.0.5 or later when every dependency is
-  optional, since 0.0.0-30 … 1.0.4 would drop the installed copy). A
-  same-run `--vex` does not attest a vlt package whose installed copy is
-  stale or unchecked, whose lock a vlt release may ignore, or which also
-  resolves from a non-default registry. vlt ledgers require the socket-patch
-  release that adds vlt support.
-- **`vendor` wires vlt projects.** A `vlt-lock.json` (lockfileVersion 0
-  or 1) routes npm vendoring to the new vlt backend ahead of every other
-  lockfile. A direct dependency of the root or of a workspace member is
-  vendored as a patched package directory,
-  `.socket/vendor/npm/<uuid>/<name>-<version>/node_modules/<name>/`, so a
-  package that `require()`s its own name still resolves; its
-  `devDependencies` are dropped from the vendored `package.json`, and the
-  uuid dir's `.gitignore` re-includes the payload against the project's
-  own ignores while `.gitattributes` keeps EOL conversion off it. The
-  lock's node becomes a `file` node, its importer edges and the importers'
-  `package.json` specs move to the `file:` path, and every moved entry is
-  placed where vlt's own serializer puts it, so `vlt ci`, warm and cold
-  `vlt install --frozen-lockfile` keep the lock byte-identical and `vlt
-  install <new>` keeps the wiring (checked against vlt 1.2.0, 1.0.10,
-  1.0.4, 1.0.0-rc.32 and 1.0.0-rc.14). A node whose only extra is one
-  peer context (a root dependency with resolved peers from vlt 1.0.8, a
-  workspace member's from rc.15) is vendored without the extra, as vlt
-  writes `file:` dependencies. Transitive targets
-  (`vendor_vlt_transitive_unsupported`), several instances of one
-  `name@version`, modifier variants, foreign registries, peer edges and
-  dependencies declared in several fields refuse before any write, as do
-  locks vlt
-  cannot read and specs that no longer match the lock
-  (`vendor_vlt_lock_out_of_sync`); a payload git would ignore refuses with
-  `vendor_artifact_gitignored` (git failing to answer warns
-  `vendor_artifact_gitignore_unchecked`), and a package already vendored through
-  another lockfile flavor with `vendor_flavor_changed`. `vendor --revert`
-  restores the registry node, edges and specs (keeping flags, trailing
-  slots and outgoing edge values vlt rewrote since) or keeps everything on
-  drift. Lock inventory reads `vlt-lock.json` too, Socket-hosted pins
-  included. Era-A locks (`··` ids, or URL-segment ids equal to a scalar
-  `registry`) warn `vendor_vlt_legacy_lockfile`. A vendored optional
-  dependency gets the new `vendor_vlt_reinstall_required` advisory: from
-  vlt 0.0.0-30 a plain `vlt install` keeps its installed upstream copy,
-  so it says to run `vlt ci` (or delete `node_modules` and run `vlt
-  install`); it also names any dependency whose `node_modules` link still
-  resolves to vlt's store. Reverting a vendored optional dependency (also
-  in a vendored-to-hosted takeover) gives the same advisory, since from
-  vlt 0.0.0-30 a plain `vlt install` then keeps the link to the removed
-  vendored directory.
-- **Vendored vlt through every command.** `vendor`, `scan --mode vendored`
-  and `get --mode vendored` run the complete vlt vendored preflight (lock
-  version and layout, transitive, peer or foreign-registry targets,
-  dependencies declared in several fields, out-of-sync specs, a package
-  already vendored through another lockfile flavor, the installed copy's
-  `bundleDependencies` or duplicate `devDependencies`, a git rule that
-  ignores `.socket/`) before any patch is downloaded, anything is written,
-  or a hosted redirect is reverted for the takeover; the dry-run previews
-  report the same codes as `would_refuse`. A committed vlt directory
-  artifact is staged inventory-verified when nothing is installed (a fresh
-  clone), and vlt's own link to it is never taken as a pristine source.
-  After a hosted → vendored takeover the store copies vlt installed from
-  the hosted pin are removed (`redirect_vlt_reinstall_required`), except
-  optional ones, which the advisory reports as installed copies of the
-  vendored optional dependencies. `repair`
-  finds vlt references in `vlt-lock.json` and workspace `package.json`
-  files, rebuilds vlt directories against the inventory that leaves out
-  vlt's `node_modules/` links, restores a missing `<uuid>/.gitignore` or
-  `.gitattributes`, and stamps reconstructed entries `flavor: "vlt"`. The
-  human output names the vlt committables and `vlt install`. A Bun lock
-  beside `vlt-lock.json` no longer triggers the Bun vendored preflight.
-  The git-ignore check refuses only a rule that ignores the vendored
-  uuid directory itself (such as `.socket/`), not one like `*.json` that
-  the directory's own `.gitignore` overrides. A takeover whose vendoring
-  then fails still removes the hosted store copies against the restored
-  registry pin. When vlt's link to the committed directory is the only
-  installed copy, `vendor` says so (`vendor_ledger_entry_missing`, run
-  `socket-patch repair`, when the vendor ledger lost the entry) instead of
-  reporting the package as not installed.
-- **`vex` reads `vlt-lock.json`.** Manifest-less VEX (and the ledger
-  liveness gates behind `vex`, `scan`'s takeovers and the
-  `hosted_wiring_retained` advisory) discovers hosted vlt nodes (a Socket
-  URL and sha512 on a registry node, every DepID era) and vendored vlt
-  package directories, and verifies a vendored directory with the vlt
-  `package.json` exemption, including the out-of-sync check of the
-  installed link. A lock vlt cannot read (BOM, other `lockfileVersion`)
-  wires nothing. A hosted npm package is now judged by every store variant
-  of its installed copies (pnpm and vlt peer, modifier and registry-alias
-  instances), and a same-version instance on another registry (or a
-  Socket-shaped one that does not verify) keeps a vlt hosted pin from
-  attesting before install, as does a lock some vlt release discards (no
-  `lockfileVersion`, a pre-v1 legacy-id lock without vlt.json `modifiers`,
-  or a scalar `registry` outside a v1 lock with `registries.npm`), which
-  also warns `patched_ref_unattributable`. A vendored vlt directory
-  verified without its vendor ledger checks a devDependencies-stripped
-  `package.json` against the patched blob in `.socket/blobs`, and is
-  omitted as `vendor_manifest_unverifiable` when that blob is absent.
-- **vlt support is proven against real vlt releases.** Every supported vlt
-  release (0.0.0-1 … 1.2.0, see `docs/testing/vlt-compatibility.md` for the
-  excluded ones) ran the five real-vlt capstones locally; CI now runs 35 of
-  those cells on every pull request (ci.yml's `e2e` vlt rows, each checked
-  by `scripts/check-vlt-legs.py` against the leg manifest), the vlt legs of
-  the required `hosted-e2e` production job (hosted and vendored), and the
-  advisory `vlt-compatibility.yml`: every capstone on every era of Linux,
-  macOS and Windows, the Node engine floors, the store linkers,
-  `scripts/backtest-vlt.py` against the production service, a cross-OS
-  `vlt-lock.json` comparison, and nightly `vlt@latest`, release-watchdog and
-  downgrade jobs. `vlt-serve-watchdog.yml` probes the public patch artifact
-  every 6 hours the way vlt fetches it. vlt releases are installed from a
-  sha512-checked `npm pack` (`scripts/install-vlt.sh`, pins in
-  `scripts/vlt-historical-integrity.json`). Hosted vlt projects stay
-  refused (`redirect_vlt_artifact_unverifiable`) until patch.socket.dev
-  stops re-encoding artifacts; vendored and agent mode work against
-  production today.
-- **`--json` reports a failed patch-API query as a warning.** Under
-  `--json`, a batch query that failed (after the bounded retry above) while
-  others succeeded vanished from the envelope without a trace, exit 0, and
-  the agent / hosted / vendored flows' failed per-package patch-list
-  queries did the same; the human run already warned on stderr. Each is now
-  a run-level `warnings[]` entry carrying the human line's text:
-  `{code: "api_batch_failed", detail: "API batch <n> of <total> failed:
-  <error>"}` (in batch order) and `{code: "patch_details_failed", detail:
-  "could not fetch details for <purl>: <error>"}`. Additive: `status` and
-  the exit code are unchanged while some query succeeded, and the
-  all-failed error envelope and exit 1 still apply when none did.
-
-- **`redirect_yarn_berry_mixed_line_endings` and
-  `vendor_yarn_berry_mixed_line_endings`.** A `yarn.lock` (or, vendored, a
-  root `package.json`) that mixes CRLF and LF line endings — or holds a bare
-  CR — has no single ending to keep, and yarn itself rejects such a lock
-  under `--immutable` (YN0028) and rewrites it wholesale on its next plain
-  install. Both modes now refuse it before any write with a code naming the
-  line endings and the `yarn install` remedy; a revert never refuses on line
-  endings (a restored lock entry takes the terminator of the entry it
-  replaces). The real-yarn berry suites gained `SOCKET_PATCH_YARN_BERRY_EOL=crlf`
-  to run on CRLF files on macOS / Linux as yarn writes them on Windows, and
-  print a `BERRY-EOL|<yarn>|<flow>|<file>|yarn=…|flow=…` line per fixture
-  file — see [yarn berry compatibility](docs/testing/yarn-berry-compatibility.md).
-- **Hosted npm redirects configure npm 12's `allow-remote` for you.** npm 12
-  defaults to `allow-remote=none` and refuses (EALLOWREMOTE) a lock that
-  resolves patched packages from the Socket patch host. When `scan --mode
-  hosted` / `get --mode hosted` leaves a root `package-lock.json` /
-  `npm-shrinkwrap.json` redirected, it now writes `allow-remote=all` to the
-  project `.npmrc` — creating the file, or appending one line with the BOM,
-  CRLF and every other byte preserved — so a plain `npm ci` installs the
-  patched bytes on npm 12 (verified on npm 10.9.9, 11.20.0 and 12.1.0). The
-  edit is ledger-recorded (`redirect_npmrc_allow_remote`, `created` / `added`)
-  and `rollback`, `remove`, scoped unwinds and the hosted → vendored takeover
-  remove exactly what was added once no package-lock entry needs it (a
-  modified created file keeps its other lines:
-  `redirect_npmrc_allow_remote_modified`, reported by `rollback`, `remove`,
-  `vendor` and the vendored reconcile). An explicit user
-  `allow-remote=none` / `root` is respected — in the project `.npmrc`, in the
-  user / global / builtin npm config (a committed project line would
-  silently override that machine policy), or in an `npm_config_allow_remote`
-  environment variable (which beats every `.npmrc`) — and the warning names
-  where it was found. A symlinked, unreadable or bare-CR `.npmrc` is left
-  alone (and a symlinked one refuses an unwind before anything is written),
-  `--dry-run` writes nothing but previews the write — also for a vendored →
-  hosted takeover — and
-  `--no-npm-allow-remote-config` / `SOCKET_NO_NPM_ALLOW_REMOTE_CONFIG` opts
-  out. `redirect_npm_allow_remote` now fires on EVERY hosted npm run —
-  including when `.npmrc` already allows it — and always states the
-  tradeoff: `allow-remote=all` admits any url-resolved dependency, not just
-  Socket's, while the sha512 integrity pins stay enforced. The `.npmrc`
-  sniff now follows npm 12's measured grammar: only the exact key
-  `allow-remote` counts (an `allow_remote` / `ALLOW-REMOTE` line, which npm
-  ignores, previously silenced the warning), lines split on a bare `\r` as
-  well as `\n`, a `[section]` header only counts on the untrimmed line (as
-  in npm's `ini`), section bodies are not top-level (a section-scoped copy of
-  the line never makes the unwind ambiguous), and the value is
-  case-sensitive. Mode-preserving atomic writes now create their stage file
-  with the destination's permission bits, so a 0600 token-bearing `.npmrc`
-  is never staged world-readable. Vendored mode is unaffected
-  (npm gates `file:` tarballs by `allow-file`, default `all`).
-
-- **Manifest-less VEX: `vex` attests hosted and vendored patches straight
-  from the lockfiles.** `socket-patch vex`, and `apply` / `scan` / `vendor
-  --vex`, no longer need `.socket/manifest.json`, or the `.socket/vendor`
-  ledgers, to attest hosted and vendored patches. That covers a
-  depscan-opened PR, a clone that never committed its ledgers, and a lock-only
-  CI checkout. New read-only discovery (`socket-patch-core` `vex::discover`)
-  reads every supported root lockfile and config:
-  - npm: package-lock / shrinkwrap;
-  - pnpm: every lock generation, plus Rush locks;
-  - yarn classic and berry;
-  - `bun.lock` / `bun.lockb`;
-  - cargo: `Cargo.lock` + `Cargo.toml` + cargo config;
-  - Go: `go.mod` / `go.work` + sums;
-  - Python: uv, PEP 723 script locks, `pylock.toml`, poetry, pdm,
-    `Pipfile.lock`, requirements (+ `-r` includes), Hatch / PEP 621 direct
-    references;
-  - `Gemfile.lock` / `gems.locked`;
-  - `composer.lock`;
-  - maven: `pom.xml`;
-  - nuget: `nuget.config` + `packages.lock.json`.
-
-  Each patch uuid is recovered from a Socket patch-host URL (or the
-  `--patch-server-url` origin) or a `.socket/vendor/<eco>/<uuid>/…` path,
-  validated fail-closed. A lock that resolves the same package elsewhere
-  contests the wiring and blocks it. Records come from the manifest, then
-  the ledgers, then (online only) the patch API by uuid; nothing is written
-  to the manifest. `--offline` or a failed fetch omits the patch as
-  `record_unavailable`, and a record naming another patch or package as
-  `record_mismatch`. Evidence: vendored patches hash the committed artifact.
-  Hosted patches hash the installed copy the build consumes (the Go
-  replacement module, never the pristine cache copy), or, before any
-  install, attest from the lockfile's integrity pin. Unreadable or
-  unparseable lockfiles and rejected references surface as run warnings
-  (`lockfile_unreadable`, `lockfile_unparseable`, `patched_ref_invalid`,
-  `patched_ref_unattributable`) and never abort the run. Why a patch was
-  gated rides `warnings[]` too, so `--json` keeps it: a failed record fetch
-  (`vex_record_fetch_failed`, `vex_record_not_found`,
-  `vex_record_offline`), a stale-credential fallback to the public proxy
-  (`api_auth_fallback`, `get` / `scan`'s warning), a wiring conflict
-  (`vex_wiring_conflict`), a superseded record (`vex_record_superseded`)
-  and a dead ledger claim (`vex_claim_unwired`); a failed embedded `--vex`
-  adds one `vex_omitted` per omitted patch to the host command's
-  `warnings[]`. `apply --vex` and
-  `vendor --vex` with no manifest now write the document instead of exiting
-  0 with none. A project with nothing wired anywhere keeps that calm exit,
-  and `apply --check` never generates. Manifest-less runs honor `vex
-  --dry-run` and `-O -` like every `vex` run, and show a transient
-  `Fetching patch records...` status line on a terminal. Per-PM support and
-  limitations: the README's "No manifest needed for hosted and vendored
-  patches" and CLI_CONTRACT.md's "Manifest-less VEX".
-- **One lockfile reader per format, and one ledger-liveness rule.**
-  Discovery and the lock inventory read each lockfile through one reader
-  (the package-lock, composer.lock and Pipfile.lock entry walks, the hosted
-  rewriter's `pnpm-lock.yaml` grammar with one key grammar for every lock
-  generation, the backends' fail-closed `bun.lock` line grammar — so a hand
-  re-indented `bun.lock` is diagnosed `lockfile_unparseable` instead of
-  attested — one berry key splitter, which the vendored berry backend now
-  uses too, a shared `Gemfile.lock` model, the vendor backend's
-  `Cargo.lock` model, the Python lock and requirements-file readers the
-  rewriters use, with one exact-pin rule and one hosted pypi url
-  grammar).
-  `scan`'s cross-mode takeover warning `redirect_supersedes_vendored`,
-  `hosted_wiring_retained` and
-  `redirectState.wiringLive` now prove the live lock with the same
-  discovery and liveness rules `vex` gates attestations on, instead of a
-  looser text scan: a ledger record counts as live only while a lockfile
-  wires that package to the record's patch (a hosted url carrying its
-  uuid, or the exact vendored artifact the ledger names). That rule reads
-  EVERY lock's entry for the package (a PEP 723 script lock resolving it
-  from PyPI no longer vetoes the project lock's hosted entry) and a
-  recorded Gemfile with discovery's source-block grammar (a commented-out
-  `source … do` block no longer keeps a reverted record alive). The
-  shared readers
-  also change the lock inventory at the edges: a v1 `Cargo.lock`'s
-  `[metadata]` checksums now verify a crates.io fetch, `requirements.txt` is
-  read as pip's logical lines (continuations joined, comments cut, a BOM
-  dropped), a wildcard `requirements.txt` pin (`six==1.*`) is no exact
-  version, a Pipfile.lock hosted reference to an sdist, an `http://` origin
-  or a path-prefixed origin stays inventoried, a CRLF `pnpm-lock.yaml` is
-  inventoried (it used to read as having no packages), and a `poetry.lock` /
-  `pdm.lock` / `Cargo.lock` that is not valid TOML contributes nothing
-  instead of a best-effort line scan. The vendored berry backend splits a
-  multi-descriptor lock key the way yarn writes it, so a key mixing the
-  patched package with another descriptor (`"lp@npm:left-pad@1.3.0,
-  left-pad@npm:1.3.0"`) is refused `vendor_override_conflict` instead of
-  being read as one descriptor.
-- **Standalone `vendor` embeds the patch record in its ledger entries too.**
-  Vendored mode (`scan` / `get --mode vendored`) already writes every entry
-  `detached: true` with its embedded `record`; the manifest-driven `vendor`
-  command now also writes `record` into `.socket/vendor/state.json` (never
-  `detached` — the manifest record stays authoritative while the manifest
-  covers the package), so a project it wired whose manifest is gone still
-  verifies, lists and attests offline: `vex` and `list` read
-  the embedded copy whenever no manifest entry covers the package, and
-  `repair` recovers the record without the API when there is no manifest at
-  all. Entries written by older releases keep working.
-- **VEX product auto-detection covers Go, Composer, Maven, NuGet and
-  RubyGems projects**, after the existing git / `package.json` /
-  `pyproject.toml` / `Cargo.toml` probes: `go.mod` `module`, `composer.json`
-  `name`, `pom.xml` coordinates, the root's single `*.csproj`, the root's
-  single `*.gemspec`. Ambiguous roots yield no product rather than a guess.
-- **Pipenv projects can use hosted patches, and vendored patches keep every
-  category.** `scan --mode hosted` rewrites every `Pipfile.lock` category
-  (`default`, `develop`, Pipenv 2022+ named categories) that pins the patched
-  release to the hosted wheel — `file` references for Pipenv 2018 and later,
-  `path` for 7–11 (probed once with `pipenv --version`; `SOCKET_PIPENV_MAJOR`
-  pins it), pipfile-spec < 6 refused — preserving markers, extras, unrelated
-  entries, the Pipfile and its content hash, with per-entry rollback
-  (`redirect_pipenv_entry`). Vendored mode keeps custom categories and extras,
-  uses `path` for wheels with extras (Pipenv 2022's file-URL bug) and refuses
-  installers older than 2018 (`pypi_pipenv_installer_unsupported`). A stale
-  Pipfile.lock only vetoes the sibling Python rewriters on a real pin/source
-  conflict (`redirect_pipenv_refused`); anything else is
-  `redirect_pipenv_skipped`. Measured across the last stable release of all
-  18 published Pipenv majors — see `docs/testing/pipenv-compatibility.md` and
-  `scripts/backtest-pipenv.py`.
-- **`Pipfile.lock` is inventoried.** Lock-only Pipenv checkouts (a fresh
-  clone with nothing installed) now discover their pins in every mode —
-  hosted redirects them, vendored fetches the pristine wheel by one of the
-  lock's recorded digests (`LockIntegrity::Sha256AnyOf`, resolved through
-  PyPI's JSON API and verified against the same digest) and agent/scan list
-  them as lockfile-only packages. Previously they discovered nothing and
-  exited 0. Socket's own references stay discoverable, so a re-scan of an
-  already-redirected or already-vendored lock-only checkout re-confirms it;
-  a lock that resolves only from private indexes is never looked up on
-  pypi.org.
-- **Pipenv's out-of-tree virtualenv is discovered.** Discovery (`scan` in
-  every mode, `rollback`, `vex`) now finds `$WORKON_HOME/<dir>-<hash>[-<python>]` (the
-  `.venv` file pointer, `PIPENV_CUSTOM_VENV_NAME` and `PIPENV_PIPFILE`
-  included) exactly as Pipenv 7 through 2026 place it, instead of falling
-  through to the global interpreter's site-packages.
-- **Pipenv stale-install guard.** Pipenv never reinstalls a release that is
-  already present, so a hosted or vendored rewrite over a warm venv leaves the
-  upstream bytes installed; `redirect_pypi_stale_install` /
-  `pypi_pipenv_stale_install` now say so, naming the site-packages dir and
-  the verified remedy (`pipenv run pip uninstall -y <pkg> && pipenv sync`, or
-  a clean `pipenv --rm && pipenv sync`), and the stale purl is excluded from
-  the same-run `--vex`.
-- **PDM projects take hosted patches, and hosted and vendored patches share
-  one validated `pdm.lock` rewriter.** `scan --mode hosted` rewrites `pdm.lock`
-  to point the target `[[package]]` at the hosted wheel URL with the patched
-  SHA-256 (`redirect_pdm_lock_package`), and `scan --mode vendored` wires the
-  same unit to a committed wheel through the shared rewriter
-  (`utils/pdm_lock.rs`). Both preserve line endings and non-canonical spacing,
-  support the legacy `[metadata.files]` table and separate `extras` entries,
-  are idempotent, and leave `pyproject.toml` and `content_hash` untouched.
-  Supported lock formats are `2` (PDM 0.12–1.4) and `4.3`–`4.5.1` (PDM 2.8.1+;
-  PDM 2.8.0 writes the same `4.3` lock but still loses candidate identity, so
-  upgrade to ≥ 2.8.1);
-  the identity-losing `3.1` / `4.0`–`4.2` formats (PDM 1.8–2.7) and unknown
-  future formats are refused before any write (`redirect_pdm_refused` /
-  `pypi_pdm_lock_version_unsupported`), leaving the registry lock installable.
-  A `pdm.lock` written by PDM 0.x/1.x (lock format `2`) warns
-  `redirect_pdm_legacy_sync_required`: those releases have an upstream
-  freshness bug, so `pdm install` can regenerate the lock — use `pdm sync`.
-  Verified end-to-end against real PDM 0.12–2.29 across hosted, vendored and
-  agent mode on Linux, Windows and macOS; see
-  `docs/testing/pdm-compatibility.md` and `scripts/backtest-pdm.py`. When
-  several Python lockfiles coexist, `uv.lock` and `poetry.lock` drive hosted
-  PyPI redirects ahead of `pdm.lock`, so a leftover `pdm.lock` beside them
-  neither blocks a live redirect nor is falsely attested. A hosted lock-only
-  `pdm.lock` checkout is discovered and redirected (the lock inventory now
-  reads `pdm.lock`), and a re-scan after an external `pdm lock` rebases the
-  ledger's recorded edits onto the relocked text so `rollback` stays
-  byte-invertible even when PDM reflows the lock's line endings.
-- **Poetry projects take hosted patches, and vendored patches now cover every
-  `poetry.lock` generation.** `scan --mode hosted` rewrites `poetry.lock` to a
-  `[package.source] type = "url"` pointing at the Socket-hosted, SHA-256-pinned
-  wheel (Poetry 1.0 through 2.x; Poetry 0.12 ignores URL sources and is refused
-  with `redirect_poetry_lock_unsupported`), and `scan --mode vendored` accepts
-  the legacy `[metadata.hashes]` (0.12) and `[metadata.files]` (lock 1.0/1.1)
-  layouts next to the 2.x `files` arrays, CRLF locks included. The rewrite keeps
-  every other byte of the lock — dependency metadata, groups, markers, extras
-  and the pyproject `content-hash` — and records independent rollback fragments
-  per patch, so `rollback` restores the recorded originals in any order.
-  Verified end-to-end against real Poetry 0.12.17, 1.0.10, 1.1.15, 1.2.2,
-  1.3.2, 1.4.2, 1.5.1, 1.6.1, 1.7.1, 1.8.5, 2.0.1, 2.1.4, 2.2.1, 2.3.4 and
-  2.4.3 in hosted, vendored and agent mode — see
-  `docs/testing/poetry-compatibility.md` and `scripts/backtest-poetry.py`.
-  Poetry releases before 1.4 neither verify local wheel hashes nor replace an
-  already-installed package at the same version; both modes surface that as an
-  advisory (`pypi_poetry_integrity_unverified`, `redirect_poetry_stale_install_risk`)
-  keyed on the lock's writer, and the hosted rewriter warns
-  `redirect_poetry_entry_not_found` when a lock has no entry for a granted
-  patch (uv parity). A rotated grant token or republished patch supersedes the
-  earlier hosted URL in place instead of being refused as a foreign source,
-  a future `lock-version = "2.<n>"` is rewritten like 2.1 on every path
-  (the vendored loader already accepted it), and a malformed
-  `[metadata.files]` / `[metadata.hashes]` value is refused instead of
-  panicking the scan. Rollback stays invertible across Poetry's own relocks:
-  the recorded package fragment carries its boundary header, so a unit that
-  Poetry 1.1/1.2 re-laid (source kept, inserted `files` line dropped) is
-  refused rather than mistaken for an already-reverted lock, a lock-1.0
-  redirect restored by hand converges instead of refusing, and a re-scan
-  after such a relock REBASES the ledger's edits (pristine → current)
-  instead of appending a chain whose older links match nothing — which made
-  `rollback` and `remove` refuse forever. (#241)
-- **Python patches survive uv lockfiles in both hosted and vendored modes.**
-  `scan --mode hosted|vendored` now rewrites native `uv.lock` together with
-  the paired `pyproject.toml` source and metadata, PEP 723 script locks
-  (`*.py.lock` plus the script's inline metadata), PEP 751 `pylock*.toml`,
-  and uv-compiled hashed `requirements.txt`, so `uv sync --frozen|--locked`,
-  `uv run --script`, and `uv pip sync --require-hashes` install the patched
-  wheel instead of the registry artifact. Verified against real uv binaries
-  from every 0.x release family (0.0 through 0.12) — first and latest release
-  of each plus every observed behaviour boundary — see
-  `docs/testing/uv-compatibility.md`: hosted mode covers requirements from
-  uv 0.0.5 and native `uv.lock` from 0.1.45 — the first release whose
-  `uv lock` writes one — through all three `[[distribution]]` lock shapes
-  and `[[package]]`; vendored native covers every `[[package]]` release
-  (uv ≥ 0.2.35), vendored requirements cover uv ≥ 0.1.24 (hash-enforced by
-  `uv pip sync --require-hashes` from 0.1.32 and by default from 0.5.x).
-  Follow-up hardening:
-  `vendor --revert` refuses to delete a vendored Python wheel a lock still
-  references when the ledger entry has no wiring to replay (the shape
-  `repair` rebuilds), a script or PEP 751 lock supplements rather than hides
-  `poetry.lock`/`requirements.txt` pins, symlinked locks are discovered, and
-  refused before any write (never rewritten in place — uv writes through the
-  link, an atomic rename would replace it; hosted
-  `redirect_symlinked_file_unsupported`, vendored
-  `pypi_uv_symlink_unsupported` / `pypi_lock_symlink_unsupported`), CRLF
-  locks keep their line endings in both the hosted rewriter and the vendored
-  uv backend (`pyproject.toml`, the rewritten `[[package]]` unit and the
-  appended `[manifest]` / `[package.metadata]` fragments, plus their revert),
-  and the hosted `[tool.uv.sources]` edit renders as a header after
-  `[project]` the way uv writes it. (#238, #239)
-- **uv `--locked` survives the project shapes the plain fixture never
-  reached.** A package listed only in `[tool.uv] dev-dependencies` is now
-  classified as a direct dependency (it was wired as a transitive override
-  and its `requires-dev` entry left stale), and every duplicate
-  `requires-dist` / `requires-dev` entry for the package — extras, markers —
-  is repointed rather than only the first, so `uv sync --locked` and
-  `uv lock --check` accept the patched lock instead of exiting 2 and a plain
-  `uv sync` no longer rewrites it. `[tool.uv] constraint-dependencies` /
-  `build-constraint-dependencies` naming the package have their `[manifest]`
-  `constraints` / `build-constraints` entries repointed too (uv ≥ 0.5.6
-  serializes them with the package's source; 0.2.37–0.5.3 reject the
-  repointed entry under `--locked`, so the repoint emits the advisory
-  `pypi_uv_constraints_require_uv_0_5_6`). The transitive
-  (override-dependencies) branch emits the advisory
-  `pypi_uv_override_requires_uv_0_5_6`: uv applies `[tool.uv.sources]` to
-  overrides only from 0.5.6, so on 0.2.35–0.5.3 `--frozen` installs the
-  patch but a plain `uv sync` reinstalls the registry wheel. The
-  `[[distribution]]`-grammar vendoring refusal now names the real reasons
-  (relative path sources unparseable through 0.2.6, rejected by `--locked`
-  and absolutized by `uv lock` / `uv sync` on 0.2.17–0.2.34) instead of
-  "records absolute paths". `scripts/backtest-uv.py` gains a project-variant
-  lane covering these shapes on every `[[package]]` binary and a
-  `--render-doc-table` mode that prints the doc's results tables from
-  `results.json`; its export lane reads `uv export` from stdout because
-  `--output-file` only exists from 0.4.7. (#239)
-- **Unwired Python vendor entries revert safely.** `vendor --revert` /
-  `rollback` on a ledger entry without wiring to replay (the shape `repair`
-  reconstructs) skips the lock-reference guard under `--preserve-state`
-  (nothing is deleted, so nothing needs protecting), refuses fail-closed when
-  the project root cannot be listed or a lock's symlink target cannot be
-  read (instead of treating "could not enumerate locks" as "no lock
-  references it" and deleting the wheel), probes `-r` / `--requirement`
-  includes of `requirements.txt` alongside the root file — the orphan sweep
-  and `repair` see include-hosted pins too — and reclaims a genuinely
-  orphaned artifact directory whose lock is gone or whose ledger flavor is
-  unknown instead of failing forever. Hosted `scan` / `get`, `repair`, and
-  ledger-less `rollback` read candidate lockfiles through the FIFO-safe
-  reader, so a named pipe at a lockfile name no longer wedges the command in
-  `open(2)`. (#239)
-
-- **Path targeting on `scan` and `rollback`.** `scan [PATHS]...` scopes
-  discovery to packages with an installed copy under a matching glob
-  (ancestor rule: `scan packages/foo` covers the subtree; `*` never crosses
-  `/`; absolute patterns are the only way to reach `--global` stores); the
-  prune universe is never narrowed (`scan PATHS --prune` prunes exactly
-  what an unscoped run would), lockfile-only/vendor-ledger supplements are
-  excluded with a `path_scope_excluded_supplements` warning, an empty match
-  is a normal empty scan (exit 0, no GC). In hosted and vendored mode
-  (so also a bare `scan`) PATHS name project directories instead: each
-  directory or directory glob (`apps/*`) is scanned on its own, as if it
-  were `--cwd`, under a `== <dir> ==` header; the exit code is the worst of
-  the runs, a PATH that is not a directory is a usage error (exit 2), and
-  `--json` takes one directory. `rollback [TARGET]...` accepts
-  PURLs, UUIDs, and path globs (variadic, unioned); only path-SHAPED tokens
-  (separator, glob metachar, `./` prefix, absolute) become globs, so a
-  mistyped identifier stays a safe exit-1 error. A path target selecting
-  nothing is an error on rollback (exit 1) and an empty scan on scan
-  (exit 0); path targets select installed copies, and rollback restores
-  EVERY installed copy of a selected patch (`out_of_scope_copies_restored`
-  warning when copies live outside the patterns).
-- **`--preserve-state` on `rollback` and `remove`** (env
-  `SOCKET_PRESERVE_STATE`): fully unpatch the system but keep the local
-  state for a later re-apply — manifest entries, vendored artifacts +
-  ledger entries (kept byte-identical; re-vendor re-wires from the live
-  lock) — and skip all GC. Hosted pins have no preservable state: they are
-  restored to upstream either way (`hosted_state_not_preservable`
-  warning). On `remove`, combining it with
-  `--skip-rollback` is a usage error (exit 2, flag- or env-sourced): the
-  combination would be a no-op — one flag keeps the tree and drops the
-  state, the other restores the tree and keeps the state.
-- **Hosted unwind.** `rollback` restores every in-scope hosted pin to its
-  upstream registry entry, in every ecosystem — see "`rollback` and `remove`
-  restore hosted pins to their upstream registry entries" under Changed
-  (BREAKING); a pin that cannot be restored is refused with the `git checkout
-  -- <files>` remedy.
-- **`remove` gains the hosted leg and full archive GC**: an identifier
-  matching hosted lockfile pins restores their upstream registry entries
-  (works manifest-less on hosted-only projects; a refused restore fails
-  `hosted_revert_failed` before the manifest mutation), and remove's
-  default GC extends from blobs-only to blobs + diff + package archives
-  (parity with rollback/repair/`scan --prune`).
-- **`SOCKET_API_CONCURRENCY` paces `scan`'s patch-API requests.** `scan`
-  now keeps several patch-API requests in flight (8 authenticated, 4 on the
-  public proxy) instead of one at a time. Set this variable — clamped to
-  `1`-`32`, and on the public proxy only downward — when something in front
-  of the API caps in-flight requests per client (a self-hosted `--api-url`,
-  a corporate reverse proxy, a WAF, a CDN) and a scan starts losing
-  requests to it. `SOCKET_API_CONCURRENCY=1` restores one request at a
-  time. Unset, empty or non-numeric values keep the defaults. Results,
-  warnings and their order never depend on the setting.
-
-  Two request-count consequences an operator may see before they read the
-  code, neither of which changes any output:
-
-  - A vendored run fetches prebuilt archives ahead of the wiring loop.
-    The plan it fetches is exact — it is gated by the same pre-flight each
-    vendor backend runs before it would ask the service (an unsupported or
-    absent lockfile entry, an override conflict, a workspace gate), so a
-    package the run does not end up vendoring is never asked for: the
-    `POST /v0/orgs/<org>/patches/package` download grants, which can start
-    a server-side archive build and count against quota, are exactly the
-    one-at-a-time loop's (71 on a fresh depscan run, where an earlier
-    draft of the look-ahead issued 74). What changes is only their timing:
-    they are requested in one batch at the first planned package (see
-    "Fewer downloads in vendored runs"), and up to four archives are in
-    flight at once. `SOCKET_API_CONCURRENCY=1` turns the look-ahead off
-    entirely.
-  - A token revoked *mid-run* now costs the authenticated batch endpoint
-    the requests already in flight — up to the in-flight cap instead of
-    one — before the run downgrades to the public proxy. Their answers are
-    discarded and the connections are dropped mid-response, so the
-    endpoint's access log shows them; the downgrade warning, the patches
-    and the exit code are the same as before.
+- `socket.yml` patch policy for paths, ecosystems, packages, severity, and per-run
+  limits. `scan --package`, `--min-severity`, `--max-new-patches`, and
+  `--no-socket-yml` support targeted and gradual rollout. Already-patched packages
+  retain protection when excluded; updates do not spend the new-patch budget.
+  Disk scans and the in-memory hosted engine share these rules.
+- Manifest-free VEX discovery from hosted and vendored references, including fresh
+  checkouts. Product inference covers Go, Composer, Maven, NuGet, and RubyGems in
+  addition to existing formats. Embedded VEX supports the same evidence checks.
+- vlt support across agent, hosted, and vendored workflows, with native installer
+  coverage and explicit version/layout refusals.
+- Native binary `bun.lockb` reading and rewriting, alongside text `bun.lock`,
+  without invoking Bun or converting binary locks to text.
+- Expanded Python lockfile support for uv, Poetry, PDM, and Pipenv, including
+  lock-only inventory, supported multi-version/marker shapes, and stale-install
+  diagnostics. Unsupported installer formats are refused before writes.
+- npm 12 hosted `allow-remote` configuration and dual-lock handling, plus pnpm
+  trust-lockfile configuration. Explicit user settings are respected.
+- Path targeting on scan and rollback, hosted update detection from lockfiles,
+  and configurable API request concurrency.
+
+See [ecosystem support](docs/ecosystems.md) and the
+[compatibility guides](docs/testing/README.md) for format boundaries, integrity
+limits, and required install commands.
 
 ### Fixed
 
-- **`apply` no longer half-applies a patch that creates a file from a
-  diff-only cache.** A diff archive has no delta for a file the patch
-  creates, but the source check counted a cached diff archive as covering
-  the whole patch: `apply --offline` passed it, patched the modified files,
-  then failed on the created file's missing blob; online `apply` never
-  fetched that blob. Coverage is now per file (a diff covers only files
-  with a `beforeHash`), so `apply --offline` reports the patch as having no
-  local source up front and changes nothing, online `apply` fetches just
-  the created files' blobs, and a default (diff-mode) `repair` downloads
-  them too. Such a repair's `--json` envelope carries a second
-  `downloaded` (dry-run `verified`) artifact event with `mode: "file"` for
-  those blobs.
-- **Hosted `scan` resolves more than 500 patches.** The package-reference
-  request is sent in chunks of 500 uuids, the endpoint's limit; a larger
-  scan used to fail with a 400.
-- **Hosted nuget redirects survive a `<clear />` in `nuget.config`.** The
-  Socket source (and, in an existing `<packageSourceMapping>`, its
-  mapping) was inserted ahead of the section's `<clear />`, which NuGet
-  applies to everything read before it: `dotnet restore` then failed
-  NU1100 / NU1101 for the patched package. Both now land after the last
-  `<clear />`.
-
-- **nuget redirects and vendoring edit the config NuGet actually reads.**
-  NuGet reads the first of `nuget.config`, `NuGet.config` and
-  `NuGet.Config` in a directory. Hosted mode only knew `nuget.config`
-  and vendored mode missed `NuGet.config`, so on a case-sensitive
-  filesystem they created a fresh `nuget.config` that shadowed the
-  project's own file: its sources and mappings vanished and private
-  packages failed restore. Both modes now edit the existing spelling in
-  place.
-
-- **`rollback` fetches a before-blob that only a store peer variant
-  needs.** The before-blob gate now probes every pnpm and vlt store variant
-  copy the rollback restores, so an online rollback no longer fails
-  `Before blob not found` for a still-patched variant beside an
-  already-original copy.
-
-- **Re-vendoring under a newer patch never builds from the old patch's
-  artifact.** With no installed copy, `vendor` staged the committed
-  artifact of the previous patch as the build source, so a file only the
-  old patch changed reached the new artifact unnoticed. The committed
-  artifact is now staged only for the patch that built it; a newer patch
-  fetches the pristine package per the lockfile (`--offline` skips it).
-
-- **Ledgers written by a newer socket-patch are never half-reverted.**
-  A hosted redirect edit kind this release does not understand used to
-  let `rollback` drop the npm record beside it, leaving that lockfile
-  redirected with nothing tracking it. Such an edit now holds every
-  record in the redirect ledger ("the redirect ledger holds a {kind}
-  edit this socket-patch release does not understand; upgrade
-  socket-patch"). When it names a purl, that purl's own revert in
-  `rollback <purl>`, `remove` and the hosted-to-vendored takeover
-  refuses with nothing written, and the takeover's ledger reconcile
-  leaves the purl for the manual cleanup. When the scope still covers
-  every hosted record, the whole-ledger replay goes on to unwind the
-  lockfiles this release understands, but keeps every record and the
-  unknown edit.
-  `repair` skips vendored npm entries whose `flavor` it does not know
-  (`vendor_wiring_unknown_revert_blocked`) instead of rebuilding them
-  with the wrong layout rules. vlt ledgers (`redirect_vlt_lock_node`,
-  `flavor: "vlt"`) require the socket-patch release that adds vlt
-  support.
-
-- **A patch file the patch never changes no longer blocks vendoring.** The
-  patch view serves `blobContent` only for the files a patch CHANGES, so a
-  zero-delta file (`beforeHash == afterHash`) comes back with hashes and no
-  content — and needs none: the pristine copy already carries the patched
-  bytes. The vendor stager counted such a view as a failed fetch, which made
-  any patch carrying a zero-delta file permanently unvendorable (live
-  example: `pkg:npm/tar-fs@2.1.1`).
-- **One unstageable patch no longer kills a whole vendored run.** A package
-  whose patch content cannot be obtained now gets its own `failed` event
-  with `errorCode: "no_local_source"` and the rest of the run still vendors,
-  in `vendor`, `scan`/`get --mode vendored` and `repair` alike. The event's
-  `error` names the real reason (which file the view served without content,
-  a malformed blob, or the fetch error) instead of the generic run-level
-  "patch artifacts unavailable (offline or download failure)".
-  **JSON consumers:** for a partial staging failure the vendor envelope is
-  now `status: "partialFailure"` with `error: null` and per-package events,
-  where it used to be `status: "error"` with a top-level
-  `error.code: "no_local_source"` and an empty `events[]`. The run-level
-  shape is unchanged when NOTHING in the manifest can be staged (including
-  a one-patch manifest) — `no_local_source` can therefore arrive run-level
-  or event-level, and both shapes are documented in CLI_CONTRACT.md.
-- **`get` emits its patch lists in a stable order.** The release-variant
-  narrowing drained a `HashMap`, so `download.patches`, `apply.patches` and
-  the per-patch stderr lines came out in bucket order: two identical runs of
-  the same project emitted the same records in different orders. All of them
-  are purl-ordered now, matching every sibling collection in the envelope.
-- **A requirements.txt this CLI already rewired stays in the lockfile
-  inventory.** Both shapes we write — the hosted `name @ <patch-server url>`
-  direct reference and the vendored bare `./.socket/vendor/pypi/…` wheel
-  path tagged `# socket-patch vendor: <name>==<ver>` — are read back as the
-  package they replace (discovery-only, exactly like the `==` pin they
-  replaced). A second hosted run over a wet requirements.txt reported
-  `packagesWithPatches: 1` instead of 12; a vendored one under-reported the
-  same way.
-- **`vex`'s API-fallback note no longer depends on which refusal landed
-  first.** When the patch API refuses several patch records, the
-  `api_auth_fallback` note quoted whichever refusal happened to answer
-  first — a race, so two runs of the same project could report different
-  text (`Unauthorized` or `Forbidden`) and retry the refused records in a
-  different order. Both now follow the order the records are listed in,
-  like every other note.
-- **Hosted Go redirects no longer claim patches that did not land.**
-  `scan`/`get --mode hosted` counted a Go module as redirected (recorded
-  it in the redirect ledger, so `vex` attested it) whenever any project
-  file contained the patch-server origin — e.g. an already hosted
-  `package-lock.json` — or leftover `patch.socket.dev/gopatch/…` go.sum
-  lines, even when the go.mod rewrite was refused. A Go module now counts
-  only when its go.mod `replace` and both go.sum lines are in place. A
-  module that go.mod does not require and go.sum does not list at the
-  patched version (another project's module found in the shared module
-  cache) is refused with `redirect_golang_not_in_module_graph` instead of
-  getting an inert `replace`.
-- **Switching a vendored Go module to hosted mode cleans up the vendored
-  copy.** `scan`/`get --mode hosted` rewrote the vendored `replace` but
-  left `.socket/vendor/golang/<uuid>/` and its vendor-ledger entry
-  behind, so the next `vendor` run switched the module back. The hosted
-  run now reverts the vendored state first, as it already did for cargo
-  and npm.
-- **Go `replace` directives the CLI did not write are left alone.** A
-  replace onto another checkout's vendored copy
-  (`../other/.socket/vendor/golang/…`) or onto a module under
-  `patch.socket.dev/gopatch/` other than `<patch uuid>` was treated as
-  socket-owned and could be rewritten or removed. Only
-  `./.socket/vendor/golang/…`, `./.socket/go-patches/…` and exactly
-  `patch.socket.dev/gopatch/<uuid>` are now owned.
-- **Go replace edits keep go.mod valid and readable.** A go.mod carrying
-  two socket-owned `replace` lines for one module (for example after a
-  merge) is collapsed to one instead of leaving a duplicate go rejects;
-  refreshing a directive keeps its trailing `// comment`; and quoted
-  module paths (`"github.com/x/y"`) are recognized, so a quoted user
-  replace is no longer duplicated and a quoted `require` still gets the
-  version check.
-- **`+incompatible` Go modules resolve in vendor and apply.** Purls that
-  spell the version `v2.0.0%2Bincompatible` are now percent-decoded, so
-  the module is found in the module cache and the `replace` and copy
-  directory carry the real `+incompatible` version.
-- **`+incompatible` Go copies survive `apply` reconcile.** A manifest key
-  spelled `%2Bincompatible` no longer makes the freshly applied
-  `.socket/go-patches/…@v2.0.0+incompatible` copy look orphaned, so it and
-  its `replace` are kept.
-- **Hosted Go rollback restores go.sum byte for byte.** The upstream
-  module's go.sum lines that the redirect pruned went back at the end of
-  the file; they now return to the position `go mod tidy` sorts them to
-  (semver order within a module). CRLF go.mod/go.sum files also unwind
-  cleanly, with no leftover socket lines or blank lines.
-- **Vendoring a hosted Go module unwinds the hosted redirect first.**
-  `vendor` / `get --mode vendored` over a hosted-redirected Go module left
-  its redirect-ledger record and the socket module's go.sum lines behind
-  (with the upstream lines still pruned). Go now takes the same per-purl
-  takeover revert as cargo and npm (`vendor_takeover_reverted_redirect`),
-  and scoped `rollback <purl>` / `remove <purl>` of one hosted Go module
-  works without an unscoped rollback.
-- **Vendored Go fetches honor `GOPROXY=off`, `direct` and `GOPRIVATE`.**
-  With the module missing from the module cache, the pristine fetch fell
-  back to `https://proxy.golang.org` even when go itself would ask no
-  proxy, sending private module paths off the machine. It is now refused
-  (`vendor_fetch_unverifiable`, then the usual `package_not_installed`
-  skip) unless `SOCKET_GOPROXY` names a proxy.
-- **yarn berry projects on Windows (CRLF files) are redirected and vendored
-  instead of refused.** yarn berry (2.x–4.x) writes a file it creates with
-  the OS line ending (`os.EOL`) and keeps an existing file's majority ending
-  on every later write (`normalizeLineEndings` in yarnpkg-fslib's
-  `FakeFS.ts`, used by `Project.persistLockfile` and
-  `Workspace.persistManifest`) — so on Windows a fresh `yarn.lock` and the
-  `package.json` yarn first pretty-prints are CRLF, and a `core.autocrlf`
-  checkout makes them CRLF on any OS. `scan --mode hosted` / `get --mode
-  hosted` refused every such lock (`redirect_yarn_berry_crlf_unsupported`,
-  redirected 0); a CRLF lock is now rewritten in its own line ending — every
-  untouched byte, a leading BOM included, round-trips — and the ledger records
-  the lock's on-disk CRLF fragments, so `rollback`, `remove` and the hosted →
-  vendored takeover restore it byte-for-byte (they also replay a ledger
-  recorded on a checkout whose uniform line ending has since flipped, LF ↔
-  CRLF). `vendor` / `scan --mode vendored` now keep `package.json`'s layout
-  (BOM, indent, line ending, trailing-newline shape) on both the wiring and
-  the revert: `vendor --revert` wrote a CRLF manifest back LF, never
-  byte-identical to the pre-vendor file. A BOM'd `package.json` (and a
-  BOM'd `.yarnrc.yml`, whose first-line `compressionLevel` was read as
-  unset) no longer fails the vendored backend, and every berry reader skips
-  a BOM in front of a header-less `__metadata:`. Verified on real yarn
-  4.12.0 (hosted, vendored, workspaces, pnpm linker, both mode takeovers)
-  with the fixtures re-spelled CRLF, and on yarn 2.4.3 / 3.8.7 (still
-  refused for their cacheKey, never for their endings).
-- **A yarn berry mode takeover no longer strips the old mode's patch before
-  the new mode refuses the project.** `scan` / `get --mode hosted` over a
-  vendored berry purl reverted its vendored wiring, ledger entry and
-  artifact (`redirect_takeover_reverted_vendored`: "now fully hosted") and
-  only then ran the rewriter, which refused a lock with mixed line endings
-  (or an unsupported `cacheKey` / `.yarnrc.yml` `compressionLevel`) —
-  `redirected: 0`, and the next `yarn install` pulled the unpatched registry
-  package. `vendor` / `scan --mode vendored` over a hosted berry purl did the
-  same in reverse (`vendor_takeover_reverted_redirect`, then `failed`
-  `vendor_yarn_berry_mixed_line_endings`). Both takeovers now run the new
-  mode's berry gates first — wet and `--dry-run` alike — and a refused purl
-  keeps the old mode's wiring byte-identical.
-- **Two vendored versions of one cargo crate are documented — and now
-  warned about — as needing cargo 1.45.** The docs said older cargo (1.41)
-  only needed a populated crates.io index. It needs more than that: cargo
-  before 1.45 resolves every source-less `Cargo.lock` entry for a crate
-  through ONE `[patch.crates-io]` path — the entry whose KEY sorts last —
-  so one of the two versions is pinned to the other's copy and `cargo build
-  --locked` fails closed with ``patch for `<crate>` … did not resolve to
-  any crates``, index or no index. The old-toolchain e2e passed only
-  because its fixture uuids happened to sort the other way; it now uses the
-  adversarial order, and the floor was measured rather than assumed — on
-  one two-version fixture in both key orders, 1.41.1, 1.42, 1.43 and 1.44
-  refuse the adversarial order while 1.45, 1.49, 1.53, 1.56 and current
-  stable resolve either order, each lock entry to its own copy. Vendoring a
-  second version of a crate warns with `cargo_multi_version_old_cargo`
-  unless the project's `rust-version` or `rust-toolchain[.toml]` promises
-  cargo 1.45 or newer (socket-patch never runs `cargo`, so those files are
-  the only signal it has). A SINGLE vendored version still builds on cargo
-  1.41, as before.
-- **A CRLF `Cargo.lock` stays CRLF, and reverts byte-for-byte.** Vendoring
-  rewrote every line of a lock committed with Windows line endings as LF
-  (`toml_edit` renders LF only), and `vendor --revert` then "restored" the
-  all-LF file — a whole-file diff on a Windows checkout and a rollback that
-  was not byte-identical. The lock edits (detach, retag, restore) now map
-  the rendering back onto the file's own line endings, the way the copy's
-  `Cargo.toml` already did, in lock formats v1–v4: a CRLF lock stays CRLF,
-  a missing trailing newline stays missing, and every line a mixed-ending
-  lock's edit leaves alone keeps its own ending.
-- **Vendored mode can patch a package whose version carries build
-  metadata.** The patches API serves canonical PURLs, so a semver build
-  metadata version arrives percent-encoded
-  (`pkg:cargo/wasi@0.11.0%2Bwasi-snapshot-preview1`). The PURL parsers
-  compared that raw spelling against the lockfile / install directory's
-  `0.11.0+wasi-snapshot-preview1`, never matched, and refused the package
-  (`vendor_fetched_missing`, then `locked_version_mismatch`) — so no cargo
-  crate with build metadata (`wasi` is in most Rust dependency graphs)
-  could be vendored at all. Every ecosystem's PURL parse now
-  percent-decodes the namespace, name and version once, after the
-  `/`-and-`@` split and before the path-safety guards, so an escaped
-  separator still cannot introduce a path segment. Hosted mode was already
-  correct.
-- **A vendoring-service outage no longer re-vendors packages.** An npm
-  re-run (every lock flavor, `bun.lockb` included) re-acquired its tarball
-  from whichever source answered — the service's prebuilt, or a local pack
-  with different bytes — so an outage or its recovery rewrote the lock's
-  integrity and the committed tarball and reported `applied`. A re-run now
-  keeps the committed artifact whenever the vendor ledger vouches for it
-  (uuid-bound path, no symlink, sha256 + size equal to the ledger, a
-  canonical archive an installer extracts exactly as decoded, every
-  patched file verified from the same bytes) and is `already_vendored`
-  with no service request, in every `--vendor-source` mode (including
-  `service` + `--offline`, as cargo and composer already did; golang now
-  matches). A pypi re-scan after a relock re-wires the committed wheel
-  instead of pinning a new sha, the PDM partial-relock guard holds
-  whichever source built the wheel, a wiring failure no longer deletes a
-  committed wheel, and a missing prebuilt wheel during an outage now says
-  to wait for the service. `--dry-run` previews the same reuse, so it no
-  longer predicts a `service` + `--offline` refusal the real run does not
-  have. Transient service failures (network, timeouts, 429, 5xx) are
-  retried with backoff, each attempt is time-bounded, and after two
-  consecutive exhausted fetches the run stops calling the service.
-- **Terminal output is clean on every command.** Progress lines no longer
-  leave stale text behind (`scan` printed e.g. `Found 7 patches for 1
-  packagesatch 7/7)`) or run into warnings printed while they are active.
-  Progress, prompts, color and truncation now share one implementation.
-  - **Progress lines:** a status line clears itself on finish. It is never
-    drawn off a TTY, under `TERM=dumb`, in debug mode, or under
-    `--json`/`--silent`. `fetch`, `vendor`, lock waits and
-    `--update` checks now show progress instead of going quiet.
-  - **Prompts:** Ctrl-D at a `[Y/n]` prompt now declines instead of
-    accepting. Keys pressed while a command is working no longer answer
-    the prompt that follows (`get`, `rollback`). The cursor is restored when a selection menu is
-    interrupted.
-  - **Color:** `NO_COLOR`, `CLICOLOR`, `CLICOLOR_FORCE` and `TERM=dumb` are
-    honored. Colored table rows now align.
-  - **Wording:** counted nouns read `1 package` / `2 packages` instead of
-    `package(s)`. `Error:` / `Warning:` prefixes are consistent, and
-    warnings go to stderr. `--silent` is errors-only, but a failing run
-    still prints why. Output that came out in random order is now sorted.
-    `--help` pages no longer show developer notes.
-  - **Behavior fixes:** `get --dry-run` and `vex --dry-run` no longer write
-    anything, and `vex -O -` writes to stdout. `scan --json` never stops at
-    an interactive menu. API errors show the server's message instead of a
-    raw JSON body.
-- **Reversal leaves no `.socket/` residue.** `rollback`, `remove`,
-  `vendor --revert`, the hosted unwind and the GC sweeps now prune what they
-  empty: an emptied redirect or vendor ledger is deleted together with the
-  empty `.socket/vendor/<eco>/` and `.socket/vendor/` directories (per-entry
-  vendored reverts prune their ecosystem husk; a `redirect-state.json.corrupt`
-  quarantine keeps its directory), emptied `blobs/`, `diffs/` and `packages/`
-  stores are removed, and `.socket/` itself goes with the lock when nothing is
-  left — so a fully unwound hosted or vendored project has no `.socket/` at
-  all. Deliberately kept: the zero-patch `.socket/manifest.json`
-  (`{"patches": {}}` — `list`/`apply`/`vex` exit codes depend on it).
-- **`scan --prune` says what it skipped and what it could not finish.** The
-  `gc` JSON sub-object gains `failedVendoredEntries` plus the additive
-  `skipped: {code, message}` (`lock_held` | `lock_io`) and
-  `warnings: [{code, detail}]` (`vendor_state_write_failed`,
-  `manifest_write_failed`, `cleanup_failed`) keys, with matching `GC: …`
-  human lines, so a pass that could not take the lock or could not rewrite a
-  ledger no longer reads as a clean all-zero sweep — and a lock I/O fault or
-  a failed rewrite is never mislabelled as lock contention. A legacy manifest
-  record migrated into the vendor ledger is reported as the
-  `vendor_manifest_record_migrated` / `vendor_manifest_migration_failed` run
-  warnings; a corrupt manifest no longer fails a vendored run (standalone
-  `vendor` still fails closed on it).
-- **Vendored `get`/`scan` name the patch they replace.** A `downloaded`
-  record for a purl the vendor ledger holds at another uuid carries `oldUuid`
-  and the human `[fetch]` line reads `(replacing <uuid>)`;
-  `get --mode vendored --dry-run` prints `[dry-run] Would download and vendor
-  N patches. No changes made.` on both identifier paths; the `[note]` and
-  `Patch record saved to` lines are gone with the manifest.
-- **Agent-mode `get` leaves nothing behind when it records nothing.**
-  `.socket/` and `.socket/blobs/` are created only when a record is
-  persisted (all-skipped and all-failed runs leave no `.socket/`), a
-  same-uuid `get <uuid>` re-run rewrites neither the manifest nor the blobs,
-  and a blob/diff fetch that lands nothing creates no `.socket/blobs/` or
-  `diffs/` — the `Cannot create blobs/archives directory` all-failed envelope
-  is gone; an uncreatable cache dir is a per-entry
-  `Failed to write blob/archive to disk`.
-- **`ownership_not_restored` is a warning, not silence.** A file `apply`
-  patched (or `rollback` restored) whose ownership could not be put back to
-  the original uid/gid now surfaces as an `ownership_not_restored` run
-  warning (`warnings[]` plus `Warning (ownership_not_restored): …` on
-  stderr) instead of riding a successful result unseen; the mode is still
-  restored.
-- **`remove` on ledger-only state.** A missing manifest beside a vendor or
-  redirect ledger that holds nothing for the identifier answers `not_found`
-  (exit 1) instead of `manifest_not_found`; a second `--skip-rollback` on
-  the ledger-only leftover of an earlier `--skip-rollback` is refused with
-  `vendor_state_retained` (was `not_found`); every matching vendor-ledger
-  entry — detached or not — is removable through the ledger with
-  `--preserve-state` and drift-keeps honored exactly as on the manifest
-  path; manifest entries are removed in sorted order, and the
-  `(not installed)` line prints only when something was not installed.
-  `rollback` prints `No patches found in manifest` only for an unscoped run
-  with no work in any leg.
-- **A corrupt vendor ledger is reported, never swallowed.** `vex` refuses
-  it outright (`vendor_ledger_corrupt`, see Changed); `list` degrades it to
-  a `Warning: unreadable vendor ledger …` line (muted by `--silent`) rather
-  than an error.
-- **`repair`/`vendor` state hygiene.** `repair` resolves installed copies
-  through qualified ledger keys (gem `?platform=`, pypi `?artifact_id=`,
-  maven `?classifier=` no longer read as "not installed"), puts a crashed
-  rebuild's `<uuid>.pre-rebuild` set-aside back when it is the only copy,
-  and reports an absent or empty blobs dir as `No blobs to clean up.`; every
-  artifact sweep (`repair`, `rollback`, `remove`, `scan --prune`) keeps going
-  past one unremovable file and reports the failures afterwards; `vendor`'s
-  dropped-record reconcile saves per purl and counts a failed save as
-  `vendor_state_write_failed`; `vendor_marker_write_failed` is the one
-  marker-failure warning for every backend (cargo/golang/pypi's
-  `marker_write_failed` retired), and a pypi vendor whose informational
-  marker cannot be written now succeeds with that warning instead of
-  sweeping the wheel; npm, yarn (classic and berry) and pnpm reverts honor
-  the drift-keep on an unwired entry like bun and legacy pnpm already did;
-  the hosted replay no longer credits a byte-identical hatch rewrite as an
-  edited file; a corrupt redirect ledger met by a hosted scan is reported
-  once, not twice.
-- **Manifest inputs are validated before they become paths.** `apply`
-  refuses an `afterHash` that is not a 64-hex blob hash or a uuid that is not
-  a plain path segment and reads blobs through a symlink-refusing opener (a
-  poisoned manifest or a planted `blobs/` symlink can no longer read out of
-  tree); `rollback` deletes patch-added files in every pnpm store copy and
-  heals a patched twin of an already-original primary.
-- **Human chrome.** The global-mode `Using <X> at: <path>` banner moves to
-  stderr so piped stdout stays clean; the empty-crawl hint of `scan` and
-  `get` reads `Run your package manager's install first.` instead of a fixed
-  npm/yarn/pnpm/pip/cargo/go/mvn/composer list; `vendor --revert` and the no-manifest
-  no-ops of `vendor` and `apply` (and `apply --check`) build no API client,
-  so the `SOCKET_API_TOKEN` advisories no longer print on hooked
-  manifest-less runs, and `repair` prints its token notice once.
-- **Telemetry and self-update robustness.** The telemetry client uses a 2 s
-  connect timeout (a blackholed endpoint no longer stalls every command for
-  the full request budget), and `--update` maps only a contention errno to
-  `update_in_progress` — other lock failures surface their real cause.
-- **A scan that writes nothing never creates `.socket/`.** Report-only, `--dry-run`,
-  zero-discovery and no-op runs (hosted or otherwise) no longer scaffold the
-  directory or a lock file; a GC pass checks for a manifest before it locks.
-- **`apply --silent` on an all-unmatched manifest prints its error line** —
-  errors are never muted by `--silent`; and the no-manifest early exits of
-  `apply` and `vendor` name the missing `.socket/manifest.json` instead of
-  "No .socket folder found" (the folder may legitimately hold vendored
-  state).
-- **Hosted redirect hygiene.** Missing project files no longer skip silently:
-  `redirect_composer_no_lockfile`, `redirect_gem_no_gemfile` (neither manifest
-  nor lock present) and `redirect_maven_no_pom` (no `pom.xml`, no Gradle
-  build) warn once per run; a present-but-corrupt `packages.lock.json` warns
-  `redirect_nuget_lock_unparseable` before any config mutation; a `Cargo.lock`
-  with several same-name+version `[[package]]` blocks and no `source`
-  disambiguation warns `redirect_cargo_lock_pkg_ambiguous` and skips
-  transactionally; a registry override of the wrong kind now warns the arm's
-  missing-override code for nuget/gem/golang (previously a silent skip); the
-  ledger's `redirect_nuget_source` edit records `action: "added"` when
-  `nuget.config` was authored from scratch; hosted-revert lockfile restores are
-  atomic and mode-preserving (including `bun.lockb`), and a FIFO or symlink
-  squatting on a lockfile is refused instead of wedging the revert.
-- **Vendor backend parity.** Gem reverts follow every other backend's
-  drift-keep rule (genuine drift keeps artifact + ledger entry; converged files
-  are silent; a missing `Gemfile`/`Gemfile.lock` warns `vendor_lockfile_missing`
-  and still removes the artifact); composer, maven and nuget reverts keep the
-  artifact + ledger entry (`kept_artifact`, the `vendor_revert_kept` skip)
-  while the live `composer.lock` / `pom.xml` / `nuget.config` still names the
-  drift-skipped entry's uuid dir — previously the dir was deleted under a
-  `<repository>` / `<add>` that still routed at it — and remove it once
-  nothing references it; the golang service leg stages its download
-  and, when a re-download of a wired present copy fails, keeps the copy and
-  directive instead of tearing them down; poetry/pipenv/requirements refuse
-  symlinked targets (`pypi_{poetry,pipenv,requirements}_symlink_unsupported`)
-  and every pypi flavor refuses a project file that changed between plan and
-  write (`pypi_{poetry,pdm,pipenv,uv}_changed`) instead of clobbering it;
-  an
-  unreadable (EACCES / squatting directory or FIFO) redirect ledger is
-  reported as unreadable and left in place instead of being quarantined as
-  "malformed"; a blob-cleanup pass keeps sweeping after one unremovable file
-  and reports the first error afterwards; the ledgers skip byte-identical
-  rewrites.
-- **Hosted composer redirects no longer fall back to the pristine git
-  source.** Composer 1 and 2.2 LTS silently install the upstream commit from
-  `source` when the hosted dist fails; the rewriter now drops the entry's
-  adjacent `source` block (one fragment edit, reverted byte-for-byte) and
-  warns `redirect_composer_source_kept` when a hand-ordered source cannot be
-  dropped.
-- **Hosted gem locks keep bundler's source order.** The patch-registry
-  `GEM` section is inserted where bundler sorts it, so `BUNDLE_FROZEN=true
-  bundle install` on bundler ≥ 4.0.19 no longer refuses the converged lock.
-- **v1 `Cargo.lock` files redirect and vendor correctly.** Hosted and
-  vendored rewrites now follow the `[metadata]` checksum table and rewrite
-  dependents' full-id references, so `cargo --locked` accepts the lock (and
-  the revert stays byte-identical).
-- **Hosted cargo pins every declaration of the patched version.** Each
-  version of a multi-version crate is pinned only in the declarations whose
-  requirement selects it (a requirement matching several locked versions is
-  refused `redirect_cargo_toml_dep_unrewritable`), and workspace-member and
-  in-root path-dependency manifests are pinned beside the root, so
-  `cargo --locked` accepts the redirected lock. Member discovery never
-  follows a symbolic link, so nothing outside the project is rewritten.
-- **Hosted cargo refuses crates a pin cannot reach.** A crate another
-  `Cargo.lock` package also depends on (a crates.io or git crate, or a path
-  package outside the project) now warns
-  `redirect_cargo_transitive_dependents` and is skipped instead of being
-  reported redirected while that package compiled the unpatched copy; a
-  transitive-only crate's `redirect_cargo_toml_dep_not_found` detail now
-  says so and points to `--mode vendored`. A crate declared only with
-  requirements the patched version does not satisfy (cargo resolves those
-  declarations to another version) is refused
-  `redirect_cargo_toml_dep_unrewritable`, the Socket backend's code for the
-  same shape, instead of `redirect_cargo_toml_dep_not_found`. A project with
-  NO `Cargo.lock` has no resolved graph to ask, so a crate declared beside
-  any other dependency — anything but a path dependency on a manifest the
-  same run pins — or beside a workspace member this run did not read (a
-  glob, a member outside the project or behind a symbolic link) is refused
-  `redirect_cargo_lockless_dependents` (commit a lockfile, or use `--mode
-  vendored`); a project whose only dependency is the patched crate has
-  nothing that could pull it in and still redirects.
-- **CRLF cargo projects redirect in hosted mode.** All-CRLF `Cargo.toml`,
-  `Cargo.lock` and cargo configs are rewritten with their endings kept
-  (they were refused), and `remove` / rollback still find the recorded
-  edits after a checkout converts the line endings.
-- **Hosted cargo `remove` restores every byte, in any order.** An appended
-  registry block leaves the user's config exactly as it was (trailing blank
-  lines or a missing final newline included) and a created config is
-  deleted with the last block; v1-lock and multi-version patches, ledgers
-  written by older CLIs included, can be removed in any order; and a crate
-  declared with the same line in two sections gets both pins reverted.
-- **yarn 4.0.x checksums keep the lock's own spelling.** Vendored and hosted
-  berry rewrites write bare-hex `cacheKey: 10c0` checksums when the lock
-  does, so `yarn install --immutable` no longer fails with YN0028.
-- **npm 12 dual-lock projects vendor both locks.** `vendor` rewires a
-  `package-lock.json` npm 12 keeps beside a committed shrinkwrap (else warns
-  `vendor_npm_sibling_lock_unwired`), and hosted runs warn
-  `redirect_npm_allow_remote` (npm 12's `allow-remote=none` refuses
-  redirected tarballs unless `.npmrc` sets `allow-remote=all` — which hosted
-  mode now writes itself, see Added) and `redirect_npm_legacy_client` (npm 6
-  ignores a v1 lock's `resolved`).
-
-- **Bun refusal safety:** hosted compatibility is checked before removing
-  an existing vendored patch, including during dry-run. Vendored preflight
-  exemptions require live local lock tuples; a ledger retained by
-  `rollback --preserve-state` cannot bypass a refusal or hide it in a preview.
-  Symlinked `bun.lockb` files are refused before patching so their links
-  survive, and `vendor --silent` keeps refusal diagnostics on stderr.
-
-- **Bun projects: every text-lock generation is accepted, vendored refusals
-  fire before any write, and every mode change unwinds.** `bun.lock`
-  `lockfileVersion` 0 — the opt-in text lock Bun 1.1.39–1.1.45 write with
-  `--save-text-lockfile` — joins 1 and 2 in the shared version gate, so hosted
-  mode redirects it (golden fixture `npm/bun/lock-v0`), vendored mode wires it
-  and the lockfile inventory discovers it; a newer version is now refused with
-  "update socket-patch" instead of a re-lock that would reproduce it. Workspace
-  locks are refused only where Bun cannot consume the rewrite: hosted mode
-  refuses a version-0 lock holding `workspace:` packages
-  (`redirect_bun_workspace_unsupported`; delete `bun.lock` and re-lock with
-  Bun ≥ 1.2, which writes version 1 — accepted; a plain in-place
-  `bun install` bumps the version only when a workspace depends on another
-  workspace, otherwise Bun 1.2.0 keeps version 0 and 1.2.23+ fail to
-  resolve) and vendored mode refuses any pre-version-2 workspace lock before
-  writing (`vendor_bun_workspace_unsupported` — Bun 1.2–1.3 resolve a
-  workspace member's local tarball path relative to the member; delete
-  `bun.lock` and re-lock with Bun ≥ 1.4, since an in-place `bun install`
-  keeps the existing version, or — for a version-1 lock — use hosted mode; a
-  version-0 lock is told to re-lock with Bun ≥ 1.2 first, since hosted
-  refuses it too), while purls already vendored (by the ledger at the
-  selected uuid, or with every matching lock tuple already pointing into
-  `.socket/vendor/`, so a superseding patch uuid re-pins in place), re-runs
-  and `repair` on such a lock keep working; a corrupt
-  `.socket/vendor/state.json` met by that preflight is reported as
-  `vendor_state_unreadable` rather than a Bun lock code. `scan --mode vendored`,
-  `get --mode vendored` (search and uuid paths) now
-  preflight the Bun lock BEFORE any download: a malformed binary, unreadable,
-  unsupported-version or pre-version-2 workspace lock marks the npm patches
-  `failed` with the vendor refusal code and detail, fetches nothing and
-  records no patch — the `scan` / `get <purl>` path writes nothing under
-  `.socket/` and exits `partial_failure`, `get <uuid> --mode
-  vendored` exits 1 with `status: "error"` and writes nothing — where
-  previously the record landed in the manifest and the vendor step failed
-  afterwards (and a detached run over an alias install misreported
-  `package_not_installed`). The refusals stay visible under `--silent`
-  (code-tagged stderr line), `--dry-run` previews them as the additive
-  `would_refuse` action (the human `scan` and `get` previews both print the
-  `[would-refuse]` lines). Valid binary locks are inventoried and patched
-  directly without a Bun runtime; malformed binary locks report
-  `bun_lockb_invalid`, `redirect_bun_lockb_invalid`, or
-  `vendor_bun_lockb_invalid` at the corresponding entry point. Hosted → vendored
-  takeover now works for bun —
-  `scan`/`get --mode vendored` and `vendor` over a hosted-redirected `bun.lock`
-  claim and replay that purl's hosted edit instead of refusing
-  `redirect_revert_failed`, and `vendor --dry-run` probes the takeover instead
-  of promising it — as do `rollback <purl>` / `remove <purl>` of one of
-  several hosted bun records; on a lock the vendored backend refuses (a
-  pre-version-2 workspace lock) `vendor` and its dry run report the refusal
-  BEFORE the hosted revert, leaving the purl hosted-patched instead of
-  un-hosting it and then refusing. Native `bun.lockb` edits preserve the
-  dependency graph and unrelated package metadata while updating binary
-  pointers, tarball integrity, and the package metadata hash. The hosted text
-  rewrite keeps CRLF on the rewritten `bun.lock` line. Real-Bun
-  coverage now runs in CI: the hermetic hosted and vendored suites on Linux,
-  macOS and Windows (Bun 1.4.2, plus 1.1.45 and 1.2.23 lock-era legs), and
-  the production native matrix — 16 releases from 0.8.1 to 1.4.2 in hosted
-  and vendored mode — on pull requests and `main` (rows
-  carry `cliRevision` and `cliBuildSha` provenance), with
-  the corrected digest boundary (Bun verifies URL/local tarball sha512 from
-  1.3.10, not 1.3.14). Bun 1.1.39–1.3.9 also re-save a hosted URL or
-  vendored local-tarball tuple WITHOUT its `sha512` on any later lock
-  re-save (`bun add`, `bun install` after a manifest change); that
-  digest-less 2-tuple is now recognised as the CLI's own wiring — repeat runs
-  heal the digest, `repair` rebuilds through it, and `rollback`, scoped
-  `rollback` / `remove`, `vendor --revert` and both mode takeovers unwind it
-  to the registry line — where previously every re-save on those releases
-  left `redirect_bun_entry_not_found` beside `redirected: 1`, a
-  `partial_failure` rollback and `vendor_lock_entry_not_found` /
-  `vendor_lock_entry_drifted` refusals. See
-  `docs/testing/bun-compatibility.md` and `scripts/backtest-bun.py`. (#245)
-- **Rollback after a Pipenv relock no longer refuses forever.** `pipenv lock`
-  (and `update`, and `install <other>` before 2024) regenerates a redirected
-  or vendored entry to registry shape on every Pipenv major; that is now the
-  desired end state — the hosted edit retires and the vendored record is
-  dropped (`vendor_lock_entry_relocked`) — instead of a permanent drift
-  refusal that held every pypi revert and kept the orphaned wheel dir. A
-  foreign `file`/`path` reference is still drift.
-- **Same-run `--vex` attests lock-only pypi redirects.** The confirmed purl is
-  unqualified while the ledger records the API's artifact-qualified purl;
-  both sides now match on the qualifier-stripped purl, so a lock-only Pipenv
-  (or uv) checkout no longer exits 1 `no_applicable_patches` after
-  redirecting its lock.
-- **The Pipenv installer probe runs only when a patch targets the lock**, warns
-  only when the lock was actually rewritten, resolves `pipenv` on absolute
-  `PATH` entries only (a relative entry would have executed a `pipenv` planted
-  in the scanned repository), finds `.bat`/`.cmd` shims on Windows, and takes
-  only the token after `version` (never a stray `Python 3.12` banner).
-- Hosted Python redirects now warn when installed files still contain upstream
-  or modified bytes and omit those packages from same-run VEX. The read-only
-  probe covers Poetry virtualenvs, repeats on re-scans, and uses persisted patch
-  records if fetching fresh records fails.
-
-- **Agent mode finds Poetry's out-of-tree virtualenv.** Poetry keeps a
-  project's virtualenv under `{cache-dir}/virtualenvs/<name>-<hash>-py<X.Y>`
-  by default, so after a plain `poetry install` the crawler saw no
-  `VIRTUAL_ENV` / `.venv` / `venv` and fell through to the global interpreter:
-  `scan --mode agent` patched nothing for the project's dependencies (or the
-  wrong interpreter) while reporting success, and a bare `rollback` pruned the
-  manifest while the venv stayed patched. The crawler now reproduces Poetry's
-  own placement — `virtualenvs.create` / `in-project` / `path` and `cache-dir`
-  from `POETRY_*`, the project's `poetry.toml` and the user `config.toml`, the
-  platform default cache dir, and Poetry's env-name hash — without running
-  Poetry, and scans every `-py<X.Y>` sibling. `poetry run socket-patch …` and
-  `VIRTUAL_ENV` keep working as before.
-- **`scan --mode vendored` works from a lock-only Poetry checkout.** The
-  `poetry.lock` inventory was discovery-only, so a fresh clone with nothing
-  installed was skipped with `vendor_fetch_unverifiable` even though the lock
-  records the wheel's sha256 (uv's lock vendored fine in the same scenario).
-  The inventory now carries the pure-Python wheel's sha256 from `files` (lock
-  2.x) or `[metadata.files]` (lock 1.0/1.1), and the pypi fetcher resolves a
-  hash-only entry through PyPI's JSON API by that digest (verified again after
-  download; `SOCKET_PYPI_JSON_API` overrides the endpoint). Poetry 0.12's bare
-  `[metadata.hashes]` names no wheel and still needs an installed copy.
-- **`remove` no longer drops the manifest entry of a drift-kept vendored
-  purl.** When the vendored revert keeps the artifact (`kept_artifact` —
-  the lockfile drifted), the manifest entry is now kept too
-  (`skipped`/`vendor_revert_kept`), matching the core RevertOutcome
-  contract; previously the entry was deleted, stranding a live ledger
-  entry with no backing record. An all-kept run exits 1 `partialFailure`
-  with `summary.removed: 0` (never `not_found` — the identifier matched).
-- **Rebuilding a missing gem, maven or nuget vendored artifact now updates
-  the ledger.** When `vendor` / `scan --vendor` found a wired project whose
-  committed artifact was missing or broken, it rebuilt the artifact but kept
-  the old fingerprint in `.socket/vendor/state.json` (the gem file
-  inventory, the maven/nuget `sha256`, and the nuget `packages.lock.json`
-  pin). If the rebuild came from the other source (the patch service instead
-  of a local build, or the reverse), the new bytes no longer matched the
-  ledger. VEX and verification then reported the artifact as tampered,
-  `repair` could fail, and `vendor --revert` left `packages.lock.json`
-  pinned to the patched `contentHash`. A rebuild from the patch service was
-  also reported as `already_vendored` instead of `applied`. The rebuild now
-  records the new fingerprint and keeps the entry's original wiring records,
-  so revert still restores the pre-vendor files. If `state.json` has no
-  entry for the package, or only an entry from another patch uuid, the
-  rebuild still runs but the ledger is left as it is, because the run has no
-  pre-vendor originals to record.
-- **A prebuilt maven `.jar`, nuget `.nupkg`, pypi wheel or npm tarball from
-  the patch service must now contain the patched files.** Checking its integrity hash only showed that
-  the download was intact, not that the archive carried the patch. The
-  archive was still written as-is and every file was reported as already
-  patched, so an unpatched archive could be committed and then rebuilt on
-  every run. Each patched file inside the archive is now checked against the
-  patch's expected hash before the archive is used. On a mismatch, `auto`
-  builds the archive locally and warns `vendor_prebuilt_layout_mismatch`,
-  and `--vendor-source=service` refuses with `vendor_prebuilt_required` (npm
-  fails the package with the detail).
-- **A prebuilt artifact that fails its integrity check is always refused.**
-  Under the default `--vendor-source=auto`, npm, pypi, golang, composer and
-  gem (both the `.gem` and its stub gemspec) printed a warning and built the
-  package locally when the downloaded bytes did not match the integrity the
-  patch service reported. Bytes that fail verification may have been
-  tampered with, so these ecosystems now refuse the package in every mode,
-  as cargo, maven and nuget already did. The refusal code is
-  `vendor_prebuilt_integrity_mismatch` (npm fails the package with the
-  integrity detail). Under `--vendor-source=service`, golang, composer, gem
-  and pypi now report `vendor_prebuilt_integrity_mismatch` instead of
-  `vendor_prebuilt_required`.
-- **`service` vendor source without an API client is refused.** This affects
-  `socket-patch-core` callers that pass a `VendorServiceConfig` with
-  `source: Service` and no `client` (the CLI always configures a client).
-  Every backend used to build the artifact locally in that case, even though
-  `service` promises that only the patch service's artifact is used. They now
-  refuse with `vendor_prebuilt_required` before doing any work, the same way
-  `--offline` is already refused.
-- **Rebuilding a missing cargo vendored copy now honours
-  `--vendor-source`.** When a wired project's committed crate copy was
-  missing or stale, `vendor` always rebuilt it locally from the installed
-  source. Under `--vendor-source=service` it did so even with `--offline`
-  or without an API client, and reported success. The rebuild now uses the
-  patch service's prebuilt crate like a fresh vendor does, so `service`
-  mode refuses (`vendor_service_offline_conflict` / `vendor_prebuilt_required`)
-  when the service cannot be used, and `auto` still builds locally when it
-  has no prebuilt crate.
-
-### Changed
-
-- **`scan` keeps a patch you already have unless the new one supersedes
-  it.** A package whose recorded patch (agent manifest, hosted lockfile
-  pin or vendor ledger) still ranks level with the top offer on every
-  meaningful rung (merged state, severity, a later publish date) keeps
-  its recorded patch instead of switching on the tier or uuid tiebreak,
-  so re-running `scan` never swaps patches. `updates[]` and the
-  `[UPDATE]` marker now use the per-package records the selection itself
-  uses, so they list exactly the upgrades the run applies; a JSON
-  report-only run still reads the batch records.
-- **Fewer downloads in vendored runs.** A vendored run now asks the patch
-  service for all of its planned packages' download references in one
-  request (in chunks of 500) from the first package it reaches, in place
-  of one request per package; an outage costs the same retries as before,
-  and a package the service reports still building is asked again at its
-  turn. A pypi patch the service serves as an sdist (every patch without a
-  file qualifier) is refused from its reference, before its bytes are
-  downloaded: `auto` still warns `vendor_prebuilt_unavailable` and builds
-  the wheel locally, `service` still refuses.
-- **One owner rule for the patch stores.** `list`, `vex`, `scan`'s
-  `updates[]`, `rollback` and `remove` now read the
-  manifest and the vendor ledger (plus, in `vex`, the hosted records)
-  through one view (`socket_patch_core::ledgers`) with one precedence:
-  manifest, then vendor ledger, then hosted records, by ledger key; a
-  manifest key claims every vendor entry filed under it or naming it as
-  base purl. Visible differences: `scan`'s `updates[]` no longer folds a
-  vendor entry the manifest claims by base purl; `vex` treats every vendor
-  entry a manifest key claims as a fallback copy of that key's record (a
-  second variant of the same base purl used to become its own candidate).
-  `get`'s installed-version narrowing now uses
-  `scan`'s lockfile and vendored-ledger discovery, so a corrupt vendor
-  ledger falls back to the committed artifacts there too.
-- **The npm crawl skips tagged cache directories.** The walk that finds
-  workspace `node_modules` trees no longer descends into a directory that
-  carries a [Cache Directory Tagging](https://bford.info/cachedir/)
-  `CACHEDIR.TAG` beginning with the standard signature (every cargo
-  `target/` does), using the directory listing it already reads. One
-  semantic change: a `node_modules` inside such a directory, or anywhere
-  below it, is no longer crawled, so its packages are no longer scanned,
-  patched or attested. Every command that looks for installed npm copies
-  walks the same trees, so the change reaches past `scan`: `scan --prune` /
-  `--sync` treat a package installed only under a tagged directory as not
-  installed and garbage-collect its manifest entry and blobs (unless a
-  lockfile still resolves it), and `apply`, `rollback`, `remove`, `repair`,
-  `vendor` and `vex` no longer find copies there — so `remove` leaves such a
-  copy's patched files in place. The scan root itself is always crawled, and a
-  `CACHEDIR.TAG` without the signature (or that is a directory or a
-  symlink) prunes nothing. On a Rust-plus-JS monorepo this skipped 57% of
-  the walked directories. See docs/ecosystems.md.
-
-- **`scan` sends up to 32 patch-API requests at once on the authenticated
-  API, up from 8.** Each step sizes its window from the requests it has to
-  make: a quarter of them, between 8 and 32 — the batch queries, the
-  per-package patch lists, the hosted and vendored record views, discovery's
-  baseline views and `get`'s views. A step with 32 or fewer requests still
-  runs 8 at once; one with 128 or more runs 32. The fixed-size windows
-  follow the new cap up to their own ceilings: `vex` / `scan --vex` record
-  fetches now run up to 10 at once (was 8), wheel metadata stays at 4 and the
-  vendored archive prefetch at 4. The public proxy stays at 4.
-  `SOCKET_API_CONCURRENCY=<n>` still overrides the adaptive cap (1-32; on
-  the proxy it can only lower it); the fixed windows keep their own ceilings
-  on top of it. Output is unchanged — every window folds its
-  answers in request order — but a large monorepo's hosted scan at 100 ms of
-  latency drops from ~20 s to ~9 s.
-
-- **`scan` queries the authenticated API 500 packages per batch, up from
-  100.** Unset, `--batch-size` / `SOCKET_BATCH_SIZE` now follows the
-  endpoint: 500 purls per `POST /v0/orgs/{org}/patches/batch` (the server's
-  own per-request maximum) and 100 per `POST {proxy}/patch/batch` on the
-  public proxy, as before. A given size still applies as-is on either
-  endpoint. A batch whose JSON body would pass 256 KiB (the public proxy's
-  body cap) is now split, deterministically, into consecutive smaller
-  batches; at the default sizes that takes purls averaging over ~500 bytes.
-  A run downgraded to the proxy mid-run keeps its chunks, so it can send
-  the proxy batches of up to 500 purls (within the proxy's 256 KiB cap and
-  its upstream's 500-purl limit). Output is unchanged; the request count
-  and shape change — a large monorepo sends 30 batch requests instead of
-  147 (depscan: 12 instead of 56), and `api_batch_failed` warnings number
-  the larger batches (`API batch 2 of 12 failed: …`).
-
-- **The crawl's directory walks run on 4 threads by default.** The walk
-  pool behind the `node_modules` walk and the Maven repository walk (and its
-  POM parse) used one thread per logical CPU (up to 16), but the walk is
-  bound by the kernel's directory cache: on a 14-core Mac and on Linux
-  ext4, 4 threads walked a large monorepo's `node_modules` as fast as or
-  faster than one per CPU, with a quarter of the system time (see
-  `walk_pool.rs` for the measurements; the Maven walk shares the pool and was
-  not measured separately). The default is now 4, or the performance-core
-  count when that is lower (`hw.perflevel0.logicalcpu` on Apple silicon).
-  `SOCKET_WALK_THREADS=<n>` overrides it, clamped to 1-16 and to the CPU
-  count. What the crawl finds, and its order, are unchanged.
-
-- **Maven discovery takes coordinates from the `~/.m2` path.** A POM at its
-  canonical `<group path>/<artifactId>/<version>/<artifactId>-<version>.pom`
-  location is no longer opened: its groupId / artifactId / version come from
-  the directory names, which is where Maven itself writes every POM, so the
-  crawl skips reading and parsing tens of thousands of files. The path only
-  spells the right group when the scan root is the repository root, so each
-  top-level group directory (`org/`, `com/`, ...) is confirmed first: the
-  first canonical POM under it whose contents parse must agree with its
-  path, and a directory whose first such POM disagrees — every one of them
-  when `--global-prefix` / `SOCKET_GLOBAL_PREFIX` / `MAVEN_REPO_LOCAL` points
-  one level above or inside the repository — is read content-first exactly
-  as before. Other `.pom` files (timestamped SNAPSHOT POMs, hand-placed
-  extras, a dotted group directory) are parsed as before. One semantic
-  change: under a confirmed directory, a POM at a canonical path whose
-  contents disagree with its directory (hand-placed, or a legacy upstream
-  POM with mismatched coordinates) now reports the directory's coordinates
-  instead of the ones in the file.
-- **`scan --ecosystems` crawls only the named ecosystems.** Without
-  `--prune`/`--sync`, a `scan -e npm` no longer walks `~/.m2`, the cargo
-  registry, the Go module cache and the rest only to filter their packages
-  away. What the run counts, queries and shows is unchanged
-  (`scannedPackages` already counted only the selected ecosystems), with
-  one exception: `lockfileOnlyPackages` and the human "not yet installed"
-  note now count only the selected ecosystems' lockfile-only entries
-  instead of every ecosystem's. A GC run (`--prune`/`--sync`) still crawls
-  every ecosystem — the prune needs the full installed set — and reports
-  exactly what it did before.
-
-- **An already-vendored project re-runs `vendor` without the network.** A
-  vendorable purl with no installed copy (the fresh-clone case) used to have
-  its pristine artifact downloaded and verified before the backend was even
-  asked, although the backend's in-sync check answers from the committed
-  artifact alone. That download is now deferred to the backend branch that
-  actually reads the pristine tree, whenever the vendor ledger already
-  covers the purl (its entry records the record's patch uuid and the
-  committed artifact is on disk — a file artifact such as a wheel or
-  tarball only while it still hashes to the ledger's `sha256`; `--force`
-  keeps the eager fetch), and for every lockfile-only npm, cargo, golang
-  or composer package the registry would fetch and verify (a lock entry
-  with an integrity, or the pre-vendor resolution the ledger recovers,
-  that none of its fetcher's pre-download refusals applies to) while the
-  patch service is enabled (those backends read the pristine source only
-  once the service falls back to the local build; pypi and gem keep the
-  eager fetch, which their installed-variant probe reads). A git, path,
-  local-tarball or custom-registry package is never deferred: it keeps the
-  eager ladder's `vendor_fetch_unverifiable` + `package_not_installed`
-  refusal and is not vendored from the service's registry build, and a committed
-  file artifact that no longer matches its pin keeps the eager ladder's
-  outcome too. Visible effects: an idempotent re-run
-  makes no registry requests and no longer reports `vendor_fetched_missing`
-  for fetches it never needed; with no network (or under `--offline`) the
-  re-run of an already-vendored pypi, cargo, go or lockfile-only gem
-  project now SUCCEEDS (`already_vendored`, exit 0) instead of failing
-  `vendor_fetch_failed` / `package_not_installed`; an npm, cargo, golang or
-  composer package the service serves is never downloaded from the
-  registry. When a deferred fetch does
-  happen (a drifted committed copy being rebuilt locally, a service miss),
-  its `vendor_fetched_missing` warning is recorded just ahead of that
-  package's own event instead of in the up-front fetch pass, and a failed,
-  unverifiable or `--offline`-refused deferred fetch reports exactly the
-  eager ladder's outcome for the purl (`vendor_fetch_failed` /
-  `vendor_fetch_unverifiable` + `package_not_installed` /
-  `package_not_installed`), in loop order. `vendor --vendor-source build`
-  (or no service config) now refuses a not-installed gem that the lock can
-  verify and no ledger entry covers with `gem_spec_missing` BEFORE
-  downloading it: a local build can never vendor a downloaded `.gem` (no
-  eval-able stub gemspec), so the download was pure waste. The refusal
-  keeps the backend's detail text and drops the `vendor_fetched_missing`
-  warning that used to precede it; since it now comes first, a gem the
-  backend would have refused for another reason after the download (an
-  uneditable Gemfile declaration, a Gemfile.lock it cannot edit) also
-  reports `gem_spec_missing`. `--dry-run` is unchanged: it still fetches
-  the gem and previews it (`vendor_fetched_missing` + `verified`).
-
-- **The vendor ledger stores a whole-file snapshot's new text as an edit.**
-  Several backends record an entire file as a wiring record's `original` /
-  `new` (maven's `pom.xml`, nuget's config, `pylock*.toml`, PEP 723 scripts
-  and hatch's project files), so a ledger held two near-identical copies of
-  that file per vendored package. In `.socket/vendor/state.json` such a
-  record's `new` text of 1 KiB or more is now written as a line-level edit
-  of the same record's `original`: `{"snapshot": "<sha256 of the text>",
-  "ops": [[start, len] | "inserted text", …]}` (a `[start, len]` pair copies
-  that byte range of the `original`, a string inserts itself), and the
-  ledger's `"version"` is `2`. The `original` stays the plain string it
-  always was, every lockfile fragment record (poetry, composer, npm, …) is
-  untouched, and a ledger without such a record keeps its version-1 bytes.
-  Every command reads both versions: version-1 ledgers load and revert
-  exactly as before, and a version-2 edit is rebuilt and checked against its
-  hash (an edit that does not reproduce its text, has no `original` to
-  apply to, or any other `{"snapshot": …}` value, is
-  `vendor_state_unreadable`). Revert, repair, `vex`, rollback and the
-  re-vendor carry-forward see the same full texts as before. Each record is
-  self-contained, so an older socket-patch that re-saves the ledger (it
-  keeps `original` / `new` verbatim) loses nothing; reading a version-2
-  record it leaves that fragment alone with its drift warning. No consumer
-  outside socket-patch reads `state.json` wiring.
-
-- **A vendored run commits its lockfile and ledger edits once, not per
-  package.** `vendor`, `scan --mode vendored` and `get --mode vendored` used
-  to rewrite every touched lockfile / `package.json` / `pnpm-workspace.yaml`
-  / config and the whole `.socket/vendor/state.json` after EACH package. The
-  run now captures those edits in memory (every backend still reads its own
-  and its siblings' earlier edits) and writes the final state once, after
-  the loop, through a roll-forward journal
-  (`.socket/vendor/.commit-journal.json`, removed when the commit
-  completes). The packages that succeeded are committed even when others
-  failed, so a completed run leaves exactly the files per-package commits
-  left. Crash semantics move from per-package to per-run: a crash before
-  the commit leaves the project's lockfiles and ledgers as they were before
-  the run (the artifacts it wrote are orphans the next run re-vendors over);
-  a crash during the commit is finished by the next command that takes the
-  apply lock, before it reads any of those files. When a file the journal
-  covers was edited since, that file is never written over and the journal
-  is set aside (`.commit-journal.set-aside-<uuid>.json`, which keeps every
-  file's pre-commit bytes; a stderr warning names `repair`): if the edited
-  files still carry the commit's own lines the rest of the commit is
-  finished around them (so the ledger records the wiring on disk), if none
-  of them does the files the crash had already replaced are put back to
-  their pre-commit bytes, and otherwise nothing is applied. A journal that
-  would write through a symbolic link, or outside the lockfiles and
-  ledgers, is set aside unapplied. A replay that fails on I/O keeps the
-  journal and fails the command's lock acquire (`lock_io`) rather than
-  letting it work over a half-committed project. A re-vendor under a newer
-  patch uuid now removes the replaced uuid's artifact dir after the commit,
-  so its `vendor_stale_artifact_removed` event comes after the run's
-  per-package events instead of right after the package's own; a golang
-  takeover likewise deletes the `.socket/go-patches/` copy only after the
-  commit that repoints `go.mod` away from it. A commit that cannot be
-  written fails the run with the new top-level error `vendor_commit_failed`
-  (exit 1), leaving the pre-run lockfiles and ledger in place — or, when
-  putting back the files already replaced failed too, keeping the journal
-  (the message says so) for the next locked command to finish the commit.
-  `repair`, `vendor --revert` and `rollback` keep their per-entry saves.
-
-- **Vendored artifacts are no longer fsynced one by one.** The files a
-  vendored run produces under `.socket/vendor/<eco>/<uuid>/` — patched copy
-  trees, the `.tgz` / `.whl` / `.nupkg` / `.jar` + `.pom` artifacts and their
-  `.sha1` sidecars, and the marker — are still written atomically (stage +
-  rename) but without their own `fsync`/`F_FULLFSYNC`. One durability
-  barrier syncs every such file and, once per directory, their directories
-  (with a single `F_FULLFSYNC` per device on macOS) before the next durable
-  commit point — a lockfile, `go.mod`/`go.sum`, `pom.xml`, `nuget.config`,
-  `package.json`, `pnpm-workspace.yaml`, the vendor ledger or the redirect
-  ledger — is written, so nothing durable ever names an artifact that could
-  still be lost. An artifact rebuilt in place that no commit point follows
-  (a drifted committed artifact healed with the lockfiles and ledger
-  unchanged) is synced by the same barrier at the end of the vendored run's
-  commit and when the command releases the apply lock, so no command
-  returns with an unsynced artifact the committed state names; a failed
-  barrier keeps its files pending for the next one. A crash can at worst
-  lose an artifact nothing durable names yet, which the next run rebuilds
-  (see `socket_patch_core::utils::durability` for the full argument). The
-  in-place `apply` of an installed tree keeps its per-file durable writes.
-
-- **Release publishing decomposed into per-registry workflows.** The
-  crates.io, npm, PyPI, and RubyGems legs of the `Release` workflow now live
-  in their own workflows
-  (`.github/workflows/publish-{cargo,npm,pypi,rubygems}.yml`). A release is
-  still one dispatch — `release.yml` dispatches each leg at the release tag
-  (`scripts/dispatch-publish.sh`) and watches it to completion — but after a
-  mid-release failure any single registry can now also be retried
-  standalone (Actions → the registry's publish workflow → Run workflow with
-  the release version) without rebuilding: each leg checks out the
-  `v<version>` tag and, where binaries are needed, takes them from the
-  GitHub release's assets verified against `SHA256SUMS` (release-run
-  dispatches additionally pin the sums file by digest, and same-version leg
-  runs serialize through a concurrency group). Registry-side
-  trusted publishers must be re-registered against the new workflow
-  filenames (the legs always run as top-level `workflow_dispatch` runs, so
-  every registry's filename matching sees the leg's own file) — see
-  docs/releasing.md § One-time registry setup.
+- Patch application, reversal, and cleanup handle missing files, release variants,
+  corrupt state, newer ledger formats, and unsafe manifest paths without silently
+  dropping protection. File ownership restoration failures produce warnings.
+- Hosted Cargo handles v1 locks, CRLF files, and repeated declarations, and refuses
+  transitive dependencies its registry pin cannot reach. Vendored Cargo preserves
+  multiple versions and warns about old-toolchain limitations.
+- Go preserves user-authored replacements, handles `+incompatible` versions,
+  restores checksums, and unwinds hosted references during vendoring. Registry
+  fetches honor `GOPROXY` and private-module settings.
+- Yarn Berry preserves supported line endings and checksum spellings. Mode
+  preflights, including Bun's, run before discarding existing protection.
+- Composer hosted references remove upstream source fallbacks and mirrors;
+  RubyGems hosted locks preserve source order; NuGet edits use the active config
+  and survive `<clear />` entries.
+- Python rewrites preserve supported markers, groups, extras, source metadata, and
+  integrity pins. Relocks, out-of-tree environments, and lock-only VEX are handled
+  consistently with each installer's supported behavior.
+- Vendoring reuses valid committed artifacts during service outages. Updates do
+  not build from a previous patch's modified bytes. Verified service artifacts
+  keep their identity; integrity failures do not fall through to a local rebuild.
+  Repair rebuilds against recorded pins and reports unavailable inputs.
+- API throttling uses bounded retries, failed queries appear in JSON diagnostics,
+  and hosted reference resolution handles batches larger than 500 patches.
+- Transient apply locks are removed on normal command exit; no-op scans and full
+  reversal avoid leaving unused `.socket/` state. Terminal output, telemetry
+  timeouts, and update-check handling are more consistent.
+
+### Maintenance
+
+- Shared format models, project snapshots, ledger views, and a vendored backend
+  consolidate discovery and lifecycle handling. Grouped writes and bounded
+  concurrency reduce repeated disk and network work.
+- CI reuses compiled test binaries and splits broader compatibility matrices into
+  dedicated jobs. Release publishing uses separate Cargo and npm workflows.
+- Documentation now separates usage, configuration, migration, compatibility, and
+  development guidance; completed plans, prototype research, and historical run
+  reports are removed from the maintained docs.
 
 ## [4.0.0] — 2026-08-20
 
@@ -2310,7 +232,7 @@ plain (agent), `(vendored)`, and `(redirected)` (hosted).
   partial writes) on missing hashes, an out-of-namespace module path, a
   require-version mismatch, or a user-authored replace conflict; references
   without the override keep the historical `redirect_golang_unsupported`
-  warning (paid tier stays vendored — see `docs/design/golang-hosted.md`).
+  warning (paid tier stays vendored — see `docs/ecosystems.md#go-directory-replaces-and-gosum`).
   Wire schema gains `integrity.goModH1` and
   `registryOverride.identifiers.goModuleVersion` (additive). Requires
   server-side publication of the grant-free `gopatch` artifact flavor —
@@ -2365,7 +287,7 @@ plain (agent), `(vendored)`, and `(redirected)` (hosted).
   warns once on stderr and is ignored; `--json` stdout is unaffected. The
   telemetry endpoint now resolves the API base through the same chain as
   client construction, so a config-supplied `apiBaseUrl` applies to both.
-  Design notes: `docs/design/configuration.md`.
+  Design notes: `docs/configuration.md`.
 
 
 - **Hosted patch mode: `scan --mode hosted` (a.k.a. the hidden `--redirect`).**
@@ -2514,7 +436,7 @@ plain (agent), `(vendored)`, and `(redirected)` (hosted).
   config; Go's module-path identity would force per-grant artifacts against
   the build-once converter; and the default `GOPROXY` chain would leak
   licensed bytes / tokened URLs to the public mirror. The full analysis lives
-  in `docs/design/golang-hosted-no-go.md`; both the CLI rewriter and the
+  in `docs/ecosystems.md#go-directory-replaces-and-gosum`; both the CLI rewriter and the
   depscan backend twin emit `redirect_golang_unsupported` naming the remedy
   (use vendored mode, which gives Go everything hosted promises elsewhere).
   The one sanctioned exception — an ephemeral-CI GOPROXY recipe — is
diff --git a/README.md b/README.md
index 9d71e375..07ac2951 100644
--- a/README.md
+++ b/README.md
@@ -1,1548 +1,136 @@
-# Socket Patch CLI
+# Socket Patch
 
-Fix known vulnerabilities in the dependencies you already have — without waiting for an
-upstream release, and without a risky version bump.
+Apply security fixes to the dependency versions your project already uses.
+Socket provides patches for specific package versions so you can address known
+vulnerabilities without waiting for an upstream release or upgrading the dependency.
 
-Socket's security team backports minimal fixes to the *exact versions* of packages you
-use. `socket-patch scan` finds which of your dependencies have a patch and rewrites your
-lockfile so that only those dependencies resolve to Socket-hosted, integrity-pinned
-patched packages. Your package manager then installs the fix like any other dependency:
-no install hook, no CI changes. It works across npm, PyPI, Cargo, Go, RubyGems, Maven,
-Composer, NuGet, and Deno. `socket-patch vex` then emits an [OpenVEX
-attestation](#openvex-attestations) so your vulnerability scanner stops flagging the CVEs
-you've fixed, and `socket-patch scan --mode vendored` commits the patched packages into
-your repo when installs must work offline.
+The default workflow is **scan → install → vex**:
 
-**Contents:** [Installation](#installation) · [Five-minute tutorial](#five-minute-tutorial)
-· [How it works](#how-socket-patch-works) · [Common tasks](#common-tasks)
-· [Command reference](#command-reference) · [OpenVEX](#openvex-attestations)
-· [Scripting & CI/CD](#scripting--cicd) · [Manifest format](#manifest-format)
-· [Ecosystem support →](docs/ecosystems.md)
+- `socket-patch scan` finds available patches and updates your dependency files to
+  use Socket-hosted patched packages.
+- Your package manager installs those packages using the updated references and
+  integrity pins. Commit the files that `scan` reports.
+- `socket-patch vex` produces an OpenVEX document describing the vulnerabilities
+  addressed by those patches.
 
-## Installation
-
-Install the standalone binary (**recommended**, macOS / Linux):
-
-```bash
-curl -fsSL https://install.socket.dev/patch | sh
-```
-
-The installer detects your platform, downloads the latest binary, verifies it against
-the release's `SHA256SUMS`, and installs to `/usr/local/bin` or `~/.local/bin`.
-It needs no language runtime. Set `SOCKET_PATCH_INSTALL_DIR` to choose a directory or
-`SOCKET_PATCH_VERSION` to pin a release; pass either variable to `sh` after the pipe.
-You can inspect the [installer source](scripts/install.sh) and read about
-[mirrors and restricted networks](docs/installer-hosting.md#installing-without-reaching-githubcom).
-
-On Windows, download a prebuilt
-`socket-patch-*-pc-windows-msvc.zip` from the
-[latest release](https://github.com/SocketDev/socket-patch/releases/latest), extract it
-into a directory on your `PATH`, or install via npm below. The full
-[platform list](docs/ecosystems.md#supported-platforms) includes Linux, macOS, Windows,
-and Android release archives.
-
-### Cargo and npm
-
-These are the supported package-manager distributions:
-
-| Package manager | Command |
-|-----------------|---------|
-| cargo | `cargo install socket-patch-cli` (builds from source with every ecosystem compiled in) |
-| npm | `npm install -g @socketsecurity/socket-patch` (or one-shot: `npx @socketsecurity/socket-patch`) |
-
-The npm distribution also supplies Socket Patch to the official
-[Socket CLI](https://docs.socket.dev/docs/socket-cli).
-
-### Updating
-
-If you installed via the one-liner or a manual download, the CLI updates itself:
-
-```bash
-socket-patch --update            # latest release (--update 3.4.0 pins a version)
-```
-
-It downloads the release for your platform, verifies its SHA-256 against the
-published `SHA256SUMS`, and atomically swaps the binary in place. Package-manager
-installs are detected and pointed at their own upgrade command instead (e.g.
-`npm update -g @socketsecurity/socket-patch`). When a newer release exists,
-interactive runs print a once-a-day reminder on stderr — set
-`SOCKET_NO_UPDATE_CHECK=1` to turn that off.
-
-### Migrating from PyPI or RubyGems
-
-Starting with v5, Socket Patch is distributed as standalone binaries, Cargo crates,
-and npm packages. The `socket-patch` PyPI package and Ruby gem, along with
-`socket-patch-hook` and `socket-patch-bundler`, are no longer published.
-Python and Ruby projects remain fully supported by all three distributions.
-
-Uninstall the old CLI with the manager that installed it (`pip uninstall socket-patch`,
-`pipx uninstall socket-patch`, or `gem uninstall socket-patch`), then use one of the
-installation methods above. Remove it from project dependencies and CI bootstrap
-commands too. Run `socket-patch --version` to confirm your shell finds the new binary.
-Projects that used install hooks should also follow [Upgrading from `setup`](#upgrading-from-setup).
-
-## Five-minute tutorial
-
-No account or token is needed to follow along — without an API token `socket-patch`
-talks to Socket's public patch proxy, which serves the free tier of patches anonymously.
-(An API token unlocks your organization's patch tier; if you've already run
-`socket login` with the separate [Socket CLI](https://docs.socket.dev/docs/socket-cli),
-`socket-patch` picks it up automatically — see
-[Configuration sources](#configuration-sources).)
-
-**1. Scan.** From your project root:
-
-```bash
-cd your-project
-socket-patch scan
-```
-
-`scan` reads your lockfiles and installed packages, asks Socket which dependency
-versions have a patch, prints each one with its severity and CVE/GHSA identifiers, and
-patches them in **hosted mode**: it rewrites the lockfile so only the patched
-dependencies resolve to Socket-hosted, integrity-pinned packages on `patch.socket.dev`.
-It never prompts, keeps no ledger — the lockfile edits are the whole change — and ends by
-listing the files it changed. (Add `--dry-run` to preview without writing.)
-
-> If it prints `No patches available for installed packages.`, none of your dependency
-> versions currently has a Socket patch — the good outcome, with nothing to do. To walk
-> the rest of the loop anyway, make a scratch project pinned to a version that has a free
-> patch — at the time of writing, `flatted@3.3.1`:
->
-> ```bash
-> mkdir demo && cd demo && git init -q && npm init -y && npm install flatted@3.3.1 && socket-patch scan
-> ```
->
-> (The patch catalog changes over time; if that finds nothing, pick another patched
-> version.)
-
-**2. Commit.** The lockfile edit *is* the patch, so commit just the files `scan`
-changed — there is no other state to commit (`rollback`, `list` and `vex` read the
-lockfile itself):
-
-```bash
-git add package-lock.json .npmrc   # npm example
-git commit -m "apply Socket security patches"
-```
-
-The exact files depend on your package manager — `scan` names them. For npm it also
-writes `allow-remote=all` to `.npmrc`, which npm 12 needs to install from
-`patch.socket.dev` (see [npm: hosted mode and npm 12](#npm-hosted-mode-and-npm-12));
-for pnpm 9+ locks it sets `trustLockfile: true` in `pnpm-workspace.yaml`
-([pnpm](#pnpm)).
-
-**3. Reinstall.** A clean install fetches the patched packages and checks them against
-the lockfile's integrity pins:
-
-```bash
-npm ci        # or pnpm install, yarn install, pip install -r ..., uv sync, bundle install, ...
-```
-
-Every later install — yours, your teammates', CI's — does the same. There is no hook to
-wire and nothing to add to CI.
-
-**4. Tell your scanner.** Emit an OpenVEX document that marks each patched CVE
-`not_affected`, and hand it to Grype, Trivy or any other VEX-aware scanner:
-
-```bash
-socket-patch vex --output socket.vex.json
-grype . --vex socket.vex.json
-```
-
-**5. See what you have.** `list` shows each patch and the mode that holds it. A hosted
-patch is read straight from the lockfile, so it shows its UUID and the files that wire
-it (`vex` fetches its full record from the API):
-
-```bash
-socket-patch list
-```
-
-```
-Found 1 patch:
-
-Package: pkg:npm/flatted@3.3.1
-  UUID: 5cac955f-eab1-4d29-8f4f-c408a6cc9647
-  Mode: hosted (wired in package-lock.json)
-```
-
-**6. Go offline, if you need to.** Hosted installs must reach `patch.socket.dev`. For
-airgapped builds, eject to vendored mode with `socket-patch vendor`: it fetches the patch
-behind each hosted pin, copies the patched packages into `.socket/vendor/`, and points the
-lockfile at them — no manifest needed:
-
-```bash
-socket-patch vendor
-git add .socket/vendor package-lock.json .npmrc && git commit -m "vendor Socket patches"
-```
-
-(Vendored npm installs don't need the `.npmrc` line: the switch deletes the `.npmrc` hosted
-mode created, or leaves it with an `npm_allow_remote_left` warning if you added settings to
-it.) Each
-package is first restored to its upstream registry entry and then vendored, so a later
-`socket-patch vendor --revert` returns the project to the plain upstream packages, not to
-hosted. After the switch, `list` reads `Mode: vendored (recorded in
-.socket/vendor/state.json)` with the patch's full record.
-
-To undo everything, run `socket-patch rollback`: it restores each hosted lockfile entry to
-its upstream registry entry (re-resolved from the registry), reverts vendored wiring, and
-drops the records. Where it cannot restore an entry — offline, or a binary `bun.lockb` —
-it changes nothing for that package and tells you to restore the file from version control
-(`git checkout -- <lockfile>`).
-
-That's the whole loop: **scan → commit → reinstall → vex**, with `socket-patch vendor`
-when installs must be offline. The older *agent* mode, which patches installed files in
-place and needs `socket-patch apply` after every install, is still supported; the next section
-compares the three.
-
-## How Socket Patch works
-
-**A patch** is a minimal fix — usually the upstream security fix, backported — for one
-exact published version of a package. Socket distributes it as per-file edits: for each
-touched file, the hash of the expected original (`beforeHash`), the hash of the patched
-result (`afterHash`), and the replacement content. Patches are looked up by package URL
-([PURL](https://github.com/package-url/purl-spec)) — e.g. `pkg:npm/lodash@4.17.20` — so
-everything is keyed to exact versions. In hosted and vendored mode your package manager
-installs a patched copy of the package, pinned by the lockfile's integrity check; in
-agent mode the CLI edits
-the installed files itself and verifies every hash before and after (a file matching
-neither hash is overwritten with the verified patched content plus a
-`content_mismatch_overwritten` warning, unless `--strict` is set).
-
-### Which patch is picked
-
-A package version can have several patches (one per advisory, or a later *merged* patch
-that folds several advisories into one). `scan` and `get` apply exactly one, chosen
-the same way everywhere, from the patches your account can download:
-
-1. the newest **merged** patch (one covering two or more advisories) wins, regardless of
-   severity — it is the cumulative fix;
-2. otherwise the patch with the worst severity it fixes (critical > high > medium > low),
-   then the newest;
-3. paid tier, then UUID, only break exact ties.
-
-"Newest" is when the patch was published, not the package version. When a better patch
-appears for a package you already patched, the JSON `updates[]` array lists it and the
-next `scan` in the same mode takes it. A patch that only wins on the tier or UUID
-tiebreak never replaces one you already have, so re-running `scan` never swaps patches.
-
-This order picks the patch *for* a package. When a capped scan
-([`--max-new-patches`](#add-a-few-new-patches-per-run)) has to choose *which packages*
-get their first patch, it takes the most severe first, then the ones fixing the most
-advisories.
-
-### State in `.socket/`
-
-Local state lives in `.socket/` at your project root, and is designed to be committed:
-
-| Path | Contents |
-|------|----------|
-| `.socket/vendor/state.json` + `.socket/vendor/<ecosystem>/…` | Vendored mode: the ledger (with embedded patch records) and the patched package artifacts |
-| `.socket/manifest.json` | Agent mode only: the record of downloaded patches — PURLs, file hashes, vulnerability metadata ([format](#manifest-format)) |
-| `.socket/blobs/` | Agent mode only: patched file contents, named by git-sha256 hash |
-
-Hosted mode writes nothing here: its patches live only in your lockfiles (and the
-registry configs it edits). Hosted and vendored mode never write `manifest.json`. A
-`.socket/vendor/redirect-state.json` from a pre-v5 release is no longer used — `list`
-and `vex` read it only for details, and `rollback` deletes it.
-
-> While a command runs it holds a transient advisory lock, `.socket/apply.lock`, and
-> removes it when it finishes — the file never outlives the command, so there is nothing
-> to `.gitignore`. A crashed run can leave one behind; the next command reclaims and
-> removes it. Nothing in the table is written until there is something to record: a
-> report-only `scan`, a `--dry-run`, or a run that changes nothing leaves no `.socket/` at
-> all, and a full [`rollback`](#rollback) removes everything it created (only the
-> zero-patch `manifest.json` stays).
-
-### Three patch modes
-
-The same patched bytes can reach your build three ways. The modes differ in *where the
-patch lives* and *what must happen at install time*. `scan --mode <name>` picks one per
-run; a bare `scan` is hosted.
-
-| Mode | Where the patch lives | Install-time requirement | Trade-off |
-|------|----------------------|--------------------------|-----------|
-| **hosted** (default) — `scan` | Nowhere in your repo: the lockfile is rewritten so **only** the patched dependencies resolve to Socket-hosted, integrity-pinned packages on `patch.socket.dev`; nothing else is written | Installs must be able to reach `patch.socket.dev` (no CLI, no install hook) | Smallest possible diff (just the lockfile / registry-config edits); not for airgapped installs |
-| **vendored** — `scan --mode vendored` or [`vendor`](#vendor) (which ejects a hosted project) | Patched packages committed under `.socket/vendor/`, with the lockfile rewired to consume them | **None** — the package manager installs the committed bytes | Fully airgapped and hermetic, at the cost of repo size |
-| **agent** (older) — `scan --mode agent`, [`get`](#get), [`apply`](#apply) | `.socket/manifest.json` + blobs, committed; the CLI patches installed files in place | The `socket-patch` CLI must run after every install (an `apply` step in CI after each install) | No lockfile edits and a small repo footprint, but the only mode that needs a CI change |
-
-Every mode pins the patched bytes: vendored and hosted modes lean on your package
-manager's own lockfile integrity checks (sha512 / sha256 / contentHash / CHECKSUMS) where
-the ecosystem enforces them — hosted Maven, which has no lockfile, gets a fail-closed
-version-suffixing scheme instead — and agent mode verifies every file on each apply. A
-few combinations have weaker install-time pins (vendored Maven, NuGet without a lockfile,
-Go's directory replaces, pipenv's Pipfile.lock) — there the committed bytes are the
-protection; see the [per-ecosystem caveats](docs/ecosystems.md).
-
-**Choosing:** use *hosted* unless your installs can't reach `patch.socket.dev`; then
-use *vendored*. *Agent* mode remains fully supported for projects already built around
-it, and for Deno, which has no hosted or vendored mode.
-
-Mode support varies by ecosystem — e.g. Rush monorepos can't do vendored, and Go hosted
-mode covers the free tier only. See the full
-**[mode × ecosystem matrix](docs/ecosystems.md#mode--ecosystem-matrix)** for details.
-
-### Package-manager notes
-
-#### npm: hosted mode and npm 12
-
-npm 12 defaults to `allow-remote=none` and refuses (`EALLOWREMOTE`) any lockfile
-entry whose tarball is not served by your configured registry — which is what a
-hosted redirect writes. So when a hosted `scan` (or `get --mode hosted`) leaves a
-`package-lock.json` / `npm-shrinkwrap.json` pointing at `patch.socket.dev`, it also
-writes `allow-remote=all` to the project `.npmrc` (creating it, or appending one line
-and keeping everything else byte-for-byte) and warns `redirect_npm_allow_remote`.
-Commit the `.npmrc` with the lock; a plain `npm ci` then installs the patched
-packages on every npm from 7 to 12. The tradeoff: `allow-remote=all` lets npm install
-**any** URL-resolved dependency, not just Socket's patched ones — the per-entry sha512
-integrity pins are still enforced. An explicit `allow-remote=none` / `root` of yours is
-never changed or overridden — whether it sits in the project `.npmrc`, in your user
-(`~/.npmrc`), global or builtin npm config, or in an `npm_config_allow_remote`
-environment variable (the warning names where it found it and how to install anyway),
-`--no-npm-allow-remote-config`
-(`SOCKET_NO_NPM_ALLOW_REMOTE_CONFIG`) turns the write off (install with
-`npm ci --allow-remote=all` instead). Once `rollback` / `remove` / switching to vendored
-mode has restored the last hosted `package-lock.json` entry, an `.npmrc` that holds only
-`allow-remote=all` is deleted; if you have other settings in it, the line is left alone
-with an `npm_allow_remote_left` warning (hosted mode keeps no record of whether it added
-the line). Vendored mode needs none of this:
-npm treats its `file:` tarballs under `allow-file`, which defaults to `all`. See
-[npm compatibility](docs/testing/npm-compatibility.md) for the tested majors.
-
-#### pnpm
-
-For a lockfileVersion 9 `pnpm-lock.yaml`, hosted mode also sets `trustLockfile: true` in
-`pnpm-workspace.yaml` (pnpm 11+ rejects the redirected lock without it; commit the file
-with the lock) unless the project disables it or you pass `--no-trust-lockfile-config`.
-It skips pnpm's registry re-verification for the whole lock, while tarball integrity
-stays enforced. A warm store can keep serving the upstream bytes, so reinstall from a
-clean tree and an empty store, then check with `socket-patch vex`. See
-[pnpm compatibility](docs/testing/pnpm-compatibility.md).
-
-#### Bun
-
-Both text `bun.lock` and binary `bun.lockb` support hosted and vendored
-patches, mode switching, repair, and rollback — with one exception: a hosted
-`bun.lockb` entry is not rolled back to its upstream registry entry, so
-`rollback` and `remove` refuse it and point you at `git checkout -- bun.lockb`
-(switching it to vendored mode rebuilds the registry entry and works). Binary locks are read and
-patched natively: Socket Patch does not need Bun installed to discover or
-rewrite them, and does not convert them to text. If both filenames exist,
-`bun.lock` takes precedence. See [Bun compatibility](docs/testing/bun-compatibility.md)
-for the tested versions, workspace behavior, and installer integrity limits.
-
-#### vlt
-
-[vlt](https://www.vlt.sh) projects (`vlt-lock.json`) work in agent and hosted mode on
-every vlt release from 0.0.0-1 to 1.2.0, and in vendored mode on locks with
-`lockfileVersion` 0 or 1 (0.0.0-19 and later; older locks are refused with
-`vendor_lockfile_version_unsupported`). Hosted mode checks that each artifact is served
-the way vlt can verify and removes stale installed copies so the next `vlt install`
-fetches the patched packages. Vendored mode covers direct dependencies of the root or a
-workspace member (transitive dependencies need hosted mode); after vendoring an optional
-dependency run `vlt ci`. See [vlt notes](docs/ecosystems.md#npm-vlt-notes) for the
-caveats and [vlt compatibility](docs/testing/vlt-compatibility.md) for the tested
-releases.
-
-#### Pipenv
+Use `socket-patch vendor` to put the selected patched packages in your repository
+when installs must work without Socket's patch server.
 
-Hosted mode rewrites every `Pipfile.lock` category that pins the patched release and
-keeps the Pipfile, its content hash, markers and unrelated entries, so `pipenv install
---deploy`, `pipenv sync` and `pipenv verify` keep passing (Pipenv 7 and later; older
-lock formats are refused unchanged). Socket Patch probes `pipenv --version` once per run
-to pick the reference shape; `SOCKET_PIPENV_MAJOR=<major>` pins it on machines without
-pipenv. Vendored mode requires Pipenv 2018 or later; Pipenv 2023+ does not hash-check
-local wheels, so commit the wheel and run `socket-patch vex --product <purl>` (a Pipfile
-names no project). A clone with only `Pipfile` + `Pipfile.lock` works in every mode.
+> This branch documents the v5 prerelease. Installation commands below select the
+> latest published release, which may have different behavior. To try this branch,
+> [build from source](docs/development.md#build). Existing users should read the
+> [v5 migration guide](docs/migrating-to-v5.md).
 
-Pipenv never reinstalls a release that is already present, so a rewrite protects fresh
-installs, and Socket Patch warns (`redirect_pypi_stale_install` /
-`pypi_pipenv_stale_install`) when a venv still holds the upstream release, with the
-remedy `pipenv run pip uninstall -y <pkg> && pipenv sync`. Don't use `pipenv uninstall
-<pkg>` for this — it re-locks the patch away — and re-run `scan` after `pipenv lock` /
-`pipenv update`, which regenerate the entry to its registry reference. Measured
-boundaries are in [Pipenv compatibility](docs/testing/pipenv-compatibility.md).
-
-## Common tasks
-
-### Patch everything that can be patched
-
-```bash
-socket-patch scan                    # hosted mode: rewrite lockfiles (never prompts)
-socket-patch scan --dry-run          # preview what it would change
-socket-patch scan --json             # same run, machine-readable result
-```
-
-### Patch only some packages, or some projects in a monorepo
-
-```bash
-socket-patch scan --package lodash --package pkg:pypi/requests   # or --package lodash,requests
-socket-patch scan apps/web apps/api                              # each PATH is a project directory
-socket-patch scan 'services/*'                                   # directory globs work too
-```
-
-`--package` takes a name (case-insensitive) or a purl with or without its version. In
-hosted and vendored mode each PATH is a project directory, scanned as if it were
-`--cwd` under an `== <dir> ==` header; the worst exit code wins.
-
-To make the choice stick for everyone who runs `scan` in the repo (CI and the Socket
-autopatch bot included), put it in `socket.yml` instead — see
-[Roll out gradually](#roll-out-gradually-with-socketyml).
-### Add a few new patches per run
-
-```bash
-socket-patch scan --max-new-patches 5          # at most 5 packages get their first patch
-socket-patch scan --max-new-patches 0          # only upgrade patches you already have
-socket-patch scan --max-new-patches none       # no cap this run
-```
-
-A capped scan patches the most critical packages first: by the severity of the patch,
-then by how many advisories it fixes. Upgrades of packages that are already patched are
-never capped. Commit the result and run `scan` again to add the next batch; repeated
-runs on an unchanged repo add the same packages in the same order and stop once
-everything is patched. `--dry-run` shows exactly what the run would add and defer, and
-`--json` reports it under `rollout` (`jq '.rollout.counts.deferred'`). In hosted and
-vendored mode, several project directories in one run (`scan apps/*`) share the cap,
-visited in sorted order; `--json` takes one directory, so a CI job per directory gets
-its own N.
-
-To drip patches in through a PR bot, set the cap once in the repo's `socket.yml`
-(part of its [`patches:` policy](#roll-out-gradually-with-socketyml); the flag and
-`SOCKET_MAX_NEW_PATCHES` override it, and `--no-socket-yml` ignores it):
-
-```yaml
-# Weekly drip with the depscan autopatch PR
-version: 2
-patches:
-  maxNewPatches: 5        # the PR keeps the same 5 until merged, then the next 5
-```
-
-A cap only advances when the scan's changes are committed (or merged by a PR bot). In a
-CI job that scans without committing, set no cap.
-
-### Patch one specific CVE or advisory
-
-```bash
-socket-patch get CVE-2024-12345 --mode hosted
-socket-patch get GHSA-xxxx-yyyy-zzzz --mode hosted
-```
-
-Like `scan`, `get` defaults to hosted mode; `--mode vendored` or `--mode agent`
-(in-place apply, also implied by `--save-only` and `--global`) picks the others.
-
-### Check for patches in CI without changing anything
-
-```bash
-socket-patch scan --json --dry-run | jq '{patches: .totalPatches, updates: (.updates | length)}'
-```
-
-### Run an auto-update bot in CI
-
-```bash
-socket-patch scan --json
-```
-
-A hosted scan takes new patches and newer versions of the ones already applied. Your PR
-tooling (e.g. `peter-evans/create-pull-request`) commits the changed lockfiles and
-registry configs (hosted mode writes nothing else); use the JSON result for the PR title/body. See
-[Scripting & CI/CD](#scripting--cicd), including how to supply `SOCKET_API_TOKEN` for
-org-tier patches.
-
-### Tell your vulnerability scanner about the patches
-
-```bash
-socket-patch vex --output socket.vex.json
-grype <image-or-dir> --vex socket.vex.json     # or trivy image --vex ...
-```
-
-The OpenVEX document marks each patched CVE `not_affected`. Run it after installing, so
-hosted patches are hash-verified against the installed copies. You can also emit it
-inline with `scan --vex <path>`. Details in [OpenVEX attestations](#openvex-attestations).
-
-### Work offline / airgapped
-
-```bash
-socket-patch vendor              # ejects a hosted project; or: socket-patch scan --mode vendored
-git add .socket/vendor <your lockfile>
-```
-
-`socket-patch vendor` in a hosted project (no manifest) fetches the patch behind each
-hosted lockfile pin and vendors it; `scan --mode vendored` discovers and vendors from
-scratch. Either way a hosted package is restored to its upstream registry entry before it
-is vendored, so `socket-patch vendor --revert` later returns to upstream. Vendored mode needs no Socket infrastructure and no `socket-patch` binary at install
-time — the patched packages install from the committed bytes (other, unvendored
-dependencies still resolve from your registry or mirror as usual). Agent mode also works
-offline once its blobs are committed (`socket-patch apply --offline`). `scan` and `get`
-need the network and refuse to run with `--offline`.
-
-### Undo things
-
-| Command | What it does |
-|---------|--------------|
-| [`rollback`](#rollback) | **Fully unpatches, in every mode**: restores each hosted lockfile entry to its upstream registry entry (re-resolved from the registry; refused with a `git checkout -- <lockfile>` hint where that is impossible, e.g. offline or `bun.lockb`), unwinds vendored lockfile wiring, restores in-place files, and drops the records — everything, or just the given targets; `--preserve-state` keeps the local patch state for a later re-apply |
-| [`remove`](#remove) | The single-patch form of `rollback`: restore, unwind, drop the record and GC for one PURL/UUID (a hosted patch is restored to upstream) |
-| [`vendor --revert`](#vendor) | **Un-vendors wholesale**: restores the recorded original lockfile fragments byte-for-byte and removes the `.socket/vendor/` artifacts (a package vendored over a hosted pin returns to upstream, not to hosted) |
-| [`scan --prune`](#scan) | Agent mode: **reconciles, doesn't reverse** — drops manifest entries for packages that have left the project and garbage-collects orphan blob/diff/archive files |
-| [`repair`](#repair) (alias `gc`) | **Restores health, not originals**: re-downloads missing blobs, re-vendors missing/corrupt vendored artifacts, and cleans up unused ones |
-
-> Reverting a hosted edit by hand (e.g. `git checkout -- <lockfile>`) is always safe:
-> hosted mode keeps no other state, so there is nothing else to clean up.
-
-## Command reference
-
-| Command | What it does |
-|---------|--------------|
-| [`scan`](#scan) | Find patches for your dependencies and apply them — by default by rewriting lockfiles to Socket-hosted patched packages |
-| [`vex`](#vex) | Generate an OpenVEX document for the vulnerabilities the project's patches fix |
-| [`vendor`](#vendor) | Eject patched dependencies into committable `.socket/vendor/` and rewire lockfiles to use them (`--revert` undoes it) |
-| [`list`](#list) | List the patches in this project: hosted and vendored records plus any agent-mode manifest entries |
-| [`get`](#get) | Patch one package, CVE, GHSA or patch UUID (hosted by default; alias: `download`) |
-| [`remove`](#remove) | Unwind one patch by PURL or UUID, in any mode |
-| [`rollback`](#rollback) | Unwind every patch, in any mode: restore original files and hosted or vendored lockfile wiring |
-| **[Agent mode](#agent-mode)** | |
-| [`apply`](#apply) | Apply the patches in `.socket/manifest.json` in place (run it after every install) |
-| [`repair`](#repair) | Download missing patch artifacts, re-vendor broken vendored artifacts, clean up unused ones (alias: `gc`) |
-
-`socket-patch --update` updates the CLI itself (see [Updating](#updating)).
-
-### Global options
-
-These flags are accepted by **every** subcommand and go after the command name —
-`socket-patch <command> --json --cwd ./app` works uniformly (`socket-patch --json
-<command>` is a parse error). A command silently ignores any global flag it doesn't use
-(e.g. `list --global` parses fine and the flag is a no-op).
-
-Each flag has a matching `SOCKET_*` environment variable, listed in the table;
-command-specific flags list theirs in each command's own table. **Precedence is CLI arg
-> env var > default** — with one extra fallback layer for the three authentication
-settings, described in [Configuration sources](#configuration-sources) below.
-
-| Flag | Env var | Description |
-|------|---------|-------------|
-| `--cwd <dir>` | `SOCKET_CWD` | Working directory (default: `.`). The manifest path is resolved relative to this. |
-| `--manifest-path <path>` | `SOCKET_MANIFEST_PATH` | Path to the patch manifest, resolved relative to `--cwd` (default: `.socket/manifest.json`). |
-| `--api-url <url>` | `SOCKET_API_URL` | Socket API URL for the authenticated endpoint (default: `https://api.socket.dev`). |
-| `--api-token <token>` | `SOCKET_API_TOKEN` | Socket API token — optional. When no token resolves from any source, the anonymous public patch proxy is used (free patches). See [Configuration sources](#configuration-sources) for how to obtain and persist one. |
-| `-o, --org <slug>` | `SOCKET_ORG_SLUG` | Organization slug. Auto-resolved when omitted and a token is set. |
-| `--proxy-url <url>` | `SOCKET_PROXY_URL` | Public proxy URL used when no API token is set (default: `https://patches-api.socket.dev`). |
-| `-e, --ecosystems <list>` | `SOCKET_ECOSYSTEMS` | Restrict to specific ecosystems (comma-separated, e.g. `npm,pypi`). Unknown names are rejected. |
-| `--download-mode <mode>` | `SOCKET_DOWNLOAD_MODE` | Artifact to fetch when local files are missing: `diff` (default, smallest delta) or `file` (legacy per-file blobs). |
-| `--vendor-source <mode>` | `SOCKET_VENDOR_SOURCE` | How vendored mode acquires the installable artifact: `auto` (default — download the prebuilt package from patch.socket.dev, fall back to a local build on any miss), `service` (require the service, fail-closed), or `build` (always build locally). Covers npm, pypi, cargo, golang, composer, gem, nuget, and maven. |
-| `--vendor-url <url>` | `SOCKET_VENDOR_URL` | Base host for the vendoring service's package-reference request (default: the active `--api-url`/`--proxy-url` base). Point at staging / local dev for testing. |
-| `--patch-server-url <url>` | `SOCKET_PATCH_SERVER_URL` | Override the host of the prebuilt-archive download URL the service returns (default: as returned). Mainly for local-dev / testing. |
-| `--offline` | `SOCKET_OFFLINE` | Strict airgap: never contact the network. Operations that need remote data fail loudly. |
-| `--strict` | `SOCKET_STRICT` | Fail-closed on before-hash mismatches instead of the default warn-and-overwrite: a file whose current content matches neither `beforeHash` nor `afterHash` aborts that package's apply. Overridden by `--force`. |
-| `-g, --global` | `SOCKET_GLOBAL` | Operate on globally-installed packages. |
-| `--global-prefix <path>` | `SOCKET_GLOBAL_PREFIX` | Override the path used to discover globally-installed packages. |
-| `-j, --json` | `SOCKET_JSON` | Emit machine-readable JSON output. Every JSON response includes a `"status"` field — camelCase on the envelope commands (`"success"`, `"error"`, `"noManifest"`, `"partialFailure"`, `"paidRequired"`, `"notFound"`; apply/list/repair/remove/vendor), snake_case on the legacy shapes (`"partial_failure"`, `"not_found"`; get/scan/rollback). See [CLI_CONTRACT.md](crates/socket-patch-cli/CLI_CONTRACT.md) for the exact shapes. |
-| `-v, --verbose` | `SOCKET_VERBOSE` | Show extra detail in human-readable output. |
-| `-s, --silent` | `SOCKET_SILENT` | Suppress non-error output. |
-| `--dry-run` | `SOCKET_DRY_RUN` | Preview the operation without making any mutations. |
-| `-y, --yes` | `SOCKET_YES` | Skip confirmation prompts (`get`, `rollback`, `remove`, `--update`). `scan` never prompts, so it ignores this flag. |
-| `--lock-timeout <secs>` | `SOCKET_LOCK_TIMEOUT` | Seconds to wait for `.socket/apply.lock` before giving up. `0`/unset = a single non-blocking try; a positive value retries with backoff. Only meaningful for the commands that take the lock — `apply`, `rollback`, `repair`, `remove`, `vendor`, and `scan`/`get` whenever they write (agent-mode download + apply, vendored, hosted). The lock file exists only while a command runs. |
-| `--debug` | `SOCKET_DEBUG` | Emit verbose debug logs to stderr. |
-| `--no-telemetry` | `SOCKET_TELEMETRY_DISABLED` | Disable anonymous usage telemetry. |
-| `--no-npm-allow-remote-config` | `SOCKET_NO_NPM_ALLOW_REMOTE_CONFIG` | Hosted mode: don't write `allow-remote=all` to the project `.npmrc` (see [npm compatibility](#npm-hosted-mode-and-npm-12)). |
-| `--no-trust-lockfile-config` | `SOCKET_NO_TRUST_LOCKFILE_CONFIG` | Hosted mode: don't set `trustLockfile: true` in `pnpm-workspace.yaml` for a lockfileVersion 9 pnpm lock (pnpm 11+ then needs `pnpm install --trust-lockfile`). |
-| `--no-vlt-install-cleanup` | `SOCKET_NO_VLT_INSTALL_CLEANUP` | Hosted mode: don't remove stale vlt installed copies after `vlt-lock.json` is repointed or restored (run `vlt ci` instead). |
-
-#### Configuration sources
-
-For the three authentication settings, the [Socket CLI](https://docs.socket.dev/docs/socket-cli)'s
-persisted login sits between the env var and the built-in default — run `socket login`
-(or `socket config set apiToken` / `defaultOrg`) once and `socket-patch` picks it up
-too. The `SOCKET_CLI_*` env vars the JS CLI reads are honored as peer aliases as well,
-so one export configures both tools. To set a token directly instead, create one in the
-[Socket dashboard](https://socket.dev) under your organization's API tokens settings and
-use the raw token (`sktsec_<...>_api`) shown at generation time, **not** the
-`sha512-...` display hash. Resolution is per key, and an empty value means "unset" at
-every layer:
-
-```
---api-token / --org / --api-url
-  1. CLI flag
-  2. Env var           SOCKET_API_TOKEN / SOCKET_ORG_SLUG / SOCKET_API_URL — or the
-                       SOCKET_CLI_* peer aliases (SOCKET_CLI_API_TOKEN /
-                       SOCKET_CLI_ORG_SLUG / SOCKET_CLI_API_BASE_URL); the
-                       canonical name wins when both are set
-  3. socket-cli config <data dir>/socket/settings/config.json — read-only
-                       (Linux: $XDG_DATA_HOME, else ~/.local/share;
-                        macOS: $XDG_DATA_HOME, else ~/Library/Application Support,
-                        then legacy ~/.local/share; Windows: %LOCALAPPDATA%)
-  4. Built-in default  no token → public proxy; org → auto-resolve;
-                       url → https://api.socket.dev
-```
-
-Two env-only toggles adjust this. `SOCKET_NO_API_TOKEN=1` ignores ambient tokens (env +
-config; an explicit `--api-token` still wins) — useful to force the anonymous public
-proxy in CI or a test run. `SOCKET_NO_CONFIG=1` disables the config-file layer entirely.
-`socket-patch` never *writes* the config file, and a corrupt one only produces a stderr
-warning — it never breaks a command or pollutes `--json` output. `socket-patch` does
-**not** read `.env` files or any per-repository config for endpoints or credentials: a
-cloned repo must never be able to redirect where patches come from or spend your token.
-(Full rationale: [docs/design/configuration.md](docs/design/configuration.md).)
-
-Three env-only knobs tune pacing rather than routing:
-
-- `SOCKET_API_CONCURRENCY=<n>` (clamped to `1`-`32`) caps in-flight patch-API requests.
-  By default `scan` runs a quarter of a step's requests at once, between 8 and 32, against
-  the authenticated API, and 4 against the public proxy (where the knob can only lower
-  it); `vex` record fetches run up to 10 (4 on the proxy). Lower it when a self-hosted
-  `--api-url`, corporate proxy, WAF or CDN caps requests per client and a scan starts
-  reporting fewer patches than it should.
-- `SOCKET_API_MAX_RETRIES=<n>` (`0`-`10`, default 3) sets how often a `429` / `503`
-  answer is retried. Retries honor `Retry-After` (a wait over 30 s gives up at once) or
-  back off 0.5 s, 1 s, 2 s with jitter, and all retries in a run must finish within 60 s.
-  Other errors are never retried. A query still failing is reported, never dropped
-  (`Warning: API batch <n> of <total> failed: …`, or `api_batch_failed` /
-  `patch_details_failed` in `--json` `warnings[]`); if every query fails the scan exits 1.
-- `SOCKET_WALK_THREADS=<n>` (clamped to `1`-`16` and the CPU count; default 4, fewer on small machines) sizes the
-  thread pool for the `node_modules` and Maven repository walks. A soft open-file limit
-  below 128 forces one thread.
-
-An unset, empty or non-numeric value leaves the default in place.
-
-The sections below list only each command's **command-specific** flags.
-
-### `scan`
-
-Find patches for your dependencies and apply them. `scan` is the entry point for all
-three [patch modes](#three-patch-modes):
-
-- **hosted** (the default — a bare `scan`, `scan --json` included) rewrites lockfiles /
-  registry configs so only the patched dependencies resolve to Socket-hosted packages
-  (the lockfile edits are the only record — no ledger);
-- `--mode vendored` discovers, downloads, and builds + wires the committable
-  `.socket/vendor/` artifacts in one pass (re-vendoring automatically when a newer patch
-  is selected), writing no `.socket/manifest.json`. It works on a fresh clone:
-  dependencies listed in the lockfile but not yet installed are fetched pristine from
-  their registry and integrity-verified against the lockfile before vendoring;
-- `--mode agent` downloads the selected patches into `.socket/manifest.json` + blobs and
-  applies them to the installed files in place.
-
-`scan` never prompts, in any mode — `--yes` changes nothing. Use `--dry-run` to preview
-any run. A `--prune` or `--global` / `--global-prefix` scan with no mode is the one
-report-only case: it lists what it found (plus, with `--prune`, runs the agent-mode
-garbage collection) and prints `To apply these patches in place, run: socket-patch scan
---mode agent [PATHS]`. Hosted mode cannot be combined with `--global`.
+## Installation
 
-When a package has several patches, `scan` applies the one described in
-[Which patch is picked](#which-patch-is-picked). The JSON `updates[]` array lists
-packages whose recorded patch has been superseded — agent manifest entries, vendored
-entries, and hosted pins read from the lockfiles — and the next
-`scan` in that mode takes the newer patch.
+Install a standalone binary on macOS or Linux:
 
-**Usage:**
-```bash
-socket-patch scan [PATHS]... [options]
+```sh
+curl -fsSL https://install.socket.dev/patch | sh
 ```
 
-**Arguments:**
-- `PATHS` — restrict the scan. In hosted and vendored mode each PATH (or directory glob,
-  e.g. `apps/*`) is a **project directory**, scanned on its own as if it were `--cwd`,
-  under an `== <dir> ==` header; the worst exit code wins. A PATH that is not a
-  directory exits 2, and `--json` accepts only one directory. In agent mode PATHS are
-  globs over **installed package paths** (a bare directory scopes its whole subtree;
-  `--prune` still considers the whole project, and lockfile-only packages are left out
-  with a warning).
-
-**Command-specific options** (plus all [Global options](#global-options)):
-| Flag | Env var | Description |
-|------|---------|-------------|
-| `--mode <hosted\|vendored\|agent>` | — | Selects one of the three [patch modes](#three-patch-modes) (default: `hosted`). Combining `--mode` with a legacy boolean flag of a *different* mode is an error (exit 2); the same mode spelled both ways is accepted. |
-| `--package <name\|purl>` | `SOCKET_SCAN_PACKAGES` | Only scan these packages: a name (`lodash`, `@scope/pkg`, `requests`; case-insensitive) or a purl with or without its version (`pkg:npm/lodash`, `pkg:pypi/requests@2.31.0`). Repeat the flag or separate with commas. |
-| `--prune` | — | Agent-mode garbage collection after the scan: remove manifest entries for packages no longer present in the crawl (installed trees + lockfiles — a wiped `node_modules` alone doesn't prune lockfile-listed entries) and delete orphan blob/diff-archive files (plus any legacy package archives). [Vendored](#vendor) packages are exempt from the crawl-based prune, but a vendored entry whose dependency has left the lockfile is reverted. Ignored, with a `redirect_prune_ignored` warning, in hosted mode; without a mode the scan is report-only. |
-| `--sync` | — | Shorthand for `--mode agent --prune`: the one-flag agent-mode auto-update run. |
-| `--max-new-patches <N\|none>` | `SOCKET_MAX_NEW_PATCHES` | Add at most N patches to packages that have none yet, most severe first; the rest are deferred to the next scan and listed in the output. Upgrades of already-patched packages are not capped. `0` adds no new patches, `none` means no cap (it also lifts a `socket.yml` `patches.maxNewPatches`). See [Add a few new patches per run](#add-a-few-new-patches-per-run). |
-| `--batch-size <n>` | `SOCKET_BATCH_SIZE` | Packages per API request (default: `500` on the authenticated API, `100` on the public proxy). A request whose body would exceed 256 KiB is split into smaller ones. |
-| `--min-severity <level>` | `SOCKET_MIN_SEVERITY` | Only patch packages whose patch fixes an advisory of at least `critical`, `high`, `medium` (or `moderate`) or `low`; `none` lifts the floor. Overrides `patches.minSeverity` in socket.yml. Patches of unknown severity are skipped whenever a floor is set. |
-| `--no-socket-yml` | `SOCKET_NO_SOCKET_YML` | Ignore the repo's socket.yml patch policy for this run (the built-in test/fixture directory ignores still apply). |
-| `--all-releases` | `SOCKET_ALL_RELEASES` | Store patches for every release/distribution variant, not just the installed one — PyPI wheel/sdist, RubyGems platform, Maven classifier. Makes the manifest portable across environments (e.g. cross-platform CI caches). |
-| `--vex <path>` | `SOCKET_VEX` | On a successful scan, also write an OpenVEX 0.2.0 document to this path. See [Inline VEX](#inline-vex-on-apply--scan--vendor). |
-| `--vex-product`, `--vex-no-verify`, `--vex-doc-id`, `--vex-compact` | `SOCKET_VEX_*` | Passthrough to the embedded VEX builder; mirror the standalone [`vex`](#vex) knobs. Inert unless `--vex` is set. |
-
-> Deprecated, hidden spellings (still accepted): `--apply` (== `--mode agent`) and
-> `--vendor` (== `--mode vendored`).
-
-**Examples:**
-```bash
-# Hosted mode (default): rewrite lockfiles to Socket-hosted patched packages
-socket-patch scan
-
-# Same, JSON output
-socket-patch scan --json
-
-# Preview without writing anything
-socket-patch scan --json --dry-run
-
-# Only npm packages / only one package
-socket-patch scan --ecosystems npm
-socket-patch scan --package lodash
-
-# Two projects of a monorepo
-socket-patch scan apps/web apps/api
-
-# Roll out gradually: at most 5 new patches, most critical first
-socket-patch scan --max-new-patches 5
+The installer verifies the download against the release's `SHA256SUMS` and installs
+in `/usr/local/bin` or `~/.local/bin`. To choose a directory or release, pass
+`SOCKET_PATCH_INSTALL_DIR` or `SOCKET_PATCH_VERSION` to `sh` after the pipe.
+See the [installer source](scripts/install.sh) and
+[mirror configuration](docs/installer-hosting.md).
 
-# Vendored mode: build + commit every patched dependency
-socket-patch scan --json --mode vendored
+On Windows, extract a `socket-patch-*-pc-windows-msvc.zip` archive from
+[GitHub Releases](https://github.com/SocketDev/socket-patch/releases) into a directory
+on your `PATH`, or install through npm:
 
-# Agent mode: patch installed files in place
-socket-patch scan --json --mode agent
-
-# Agent-mode auto-update: discover, apply, garbage-collect
-socket-patch scan --json --sync
-
-# Report-only scan of global packages
-socket-patch scan -g
-
-# Hosted mode + an OpenVEX attestation in one pass
-socket-patch scan --vex socket.vex.json
+```sh
+npm install -g @socketsecurity/socket-patch
 ```
 
-> Already-vendored packages are **skipped by an agent-mode scan** (the committed
-> artifact is the patch); a newer available patch still appears in `updates[]` — re-run
-> `scan --mode vendored` to take it.
+Cargo users can build and install the published CLI with
+`cargo install socket-patch-cli`. All distributions support the same ecosystems;
+you do not need Node.js or Rust to use the standalone binary.
 
-#### Roll out gradually with socket.yml
+For standalone installs, run `socket-patch --update` to update. For npm or Cargo
+installs, use that package manager's update command. The
+[platform matrix](docs/ecosystems.md#supported-platforms) lists release targets.
 
-A `patches` block in the repo-root `socket.yml` (the file the Socket scanner already
-reads; keep `version: 2`) narrows what `scan` may patch, for every mode and for the
-in-memory engine behind the Socket autopatch bot. It can only narrow: nothing in it can
-name an endpoint or token, pick a mode, or turn off a safety check.
+## Quick start
 
-```yaml
-# Critical first: widen by editing one line
-version: 2
-patches:
-  minSeverity: critical   # later: high, then low, then remove the key
-                          # (low still skips patches whose severity is unknown)
-```
+From the root of a project with dependency files:
 
-```yaml
-# One directory first (monorepo)
-version: 2
-patches:
-  includePaths:
-    - "/services/payments/"
-    # add "/services/checkout/" next sprint
+```sh
+socket-patch scan --dry-run       # preview available patches and edits
+socket-patch scan                 # apply hosted references; never prompts
 ```
 
-```yaml
-# One ecosystem, hold one package
-version: 2
-patches:
-  ecosystems: [npm]
-  ignorePackages: ["pkg:npm/left-pad"]
-```
-
-```yaml
-# Pause: report only; existing patches stay in place
-version: 2
-patches:
-  enabled: false
-```
-
-- Paths are gitignore patterns (the same rules as `projectIgnorePaths`, which scan now
-  honors too), matched against each project's lockfiles: `"/services/payments/"`,
-  `"**/yarn.lock"`, `"examples/**"`. `test/`, `tests/`, `fixtures/`, `__fixtures__/`
-  and `testdata/` directories are skipped by default when scan discovers projects
-  (a directory glob such as `scan 'services/*'`); re-include one with a negation
-  (`ignorePaths: ["!/e2e/tests/"]`). A directory you name yourself is always scanned.
-  (The autopatch bot's tree listing skips those directories before it reads
-  socket.yml, so there a negation cannot bring one back.)
-- `packages` / `ignorePackages` take `--package` specs; prefer purls (`pkg:npm/core`),
-  because a bare name also matches other ecosystems and scoped packages (`core`
-  matches `@babel/core`).
-- Narrowing never removes a patch: a package that already carries one and is now
-  filtered out is left exactly as it is (reported under `policy.retained[]`). Use
-  `rollback` or `remove` to take a patch out.
-- A broken file fails the scan (exit 1, `errorCode: socket_yml_invalid`) before anything
-  is written, with the key and the fix in the message — a typo never widens the
-  rollout. `--no-socket-yml` ignores the file for one run.
-- `scan --json` reports what the policy did in a top-level `policy` block
-  (`jq '.policy.counts'`); the human output adds a `Policy (socket.yml): …` line that
-  names every skipped project and every critical/high patch the severity floor held
-  back (`--verbose` lists everything). `get` ignores the policy (explicit
-  intent) and warns `policy_bypassed`.
-
-Every key: `enabled`, `includePaths`, `ignorePaths`, `ecosystems`, `packages`,
-`ignorePackages`, `minSeverity`, `maxNewPatches` — see CLI_CONTRACT.md "socket.yml patch
-policy" for the full grammar, precedence and validation rules.
+Without an API token, the CLI uses Socket's public proxy for free patches.
+To use your organization's patch tier, set `SOCKET_API_TOKEN`, or sign in with the
+separate Socket CLI using `socket login`. See [configuration](docs/configuration.md).
 
-### `vex`
+A scan with no available patches means the catalog has no applicable patch for
+this run. It is **not** a finding that the project has no vulnerabilities.
 
-Generate an [OpenVEX](https://github.com/openvex) 0.2.0 attestation describing the
-vulnerabilities that the applied patches have mitigated — agent-mode patches from the
-manifest, and hosted / vendored patches straight from the lockfiles (no manifest needed).
-See [OpenVEX attestations](#openvex-attestations) below for the full workflow.
+Review and commit the files the scan changed. Hosted mode keeps no patch ledger;
+its state is in the project's lockfiles, manifests, and package-manager configuration.
+For example, an npm project may change both `package-lock.json` and `.npmrc`:
 
-**Usage:**
-```bash
-socket-patch vex [options]
-```
-
-**Command-specific options** (plus all [Global options](#global-options)):
-| Flag | Env var | Description |
-|------|---------|-------------|
-| `-O, --output <path>` | `SOCKET_VEX_OUTPUT` | Write the VEX document to this path instead of stdout. Required when combined with `--json`. |
-| `--product <id>` | `SOCKET_VEX_PRODUCT` | Override the auto-detected top-level product PURL/identifier. |
-| `--no-verify` | `SOCKET_VEX_NO_VERIFY` | Skip the on-disk file-hash check and trust the patch records — useful on a build machine that doesn't have the patched files laid out. The wiring checks still apply: a vendored ledger record the lockfile no longer wires, or a lockfile reference whose record is unavailable or names another package, is omitted either way. |
-| `--doc-id <id>` | `SOCKET_VEX_DOC_ID` | Override the document `@id`. Default is a random `urn:uuid:<v4>` regenerated each run; pin this for a reproducible identifier. |
-| `--compact` | `SOCKET_VEX_COMPACT` | Emit compact JSON instead of pretty-printed. |
-
-**Examples:**
-```bash
-# Print a VEX document to stdout (human-readable status goes to stderr)
-socket-patch vex
-
-# Write the document to a file
+```sh
+git diff
+git add package-lock.json .npmrc
+git commit -m "Apply Socket security patches"
+npm ci
 socket-patch vex --output socket.vex.json
-
-# CI shape: VEX doc to file, machine-readable envelope to stdout
-socket-patch vex --json --output socket.vex.json
-
-# Generate on a build box without verifying on-disk files
-socket-patch vex --no-verify --output socket.vex.json
-```
-
-### `vendor`
-
-The command behind [vendored mode](#three-patch-modes). Instead of patching installed
-packages in place, it ejects each patched package into
-`.socket/vendor/<ecosystem>/<patch-uuid>/…` and rewires your lockfile so the project
-consumes the vendored copy. Commit `.socket/vendor/` (the artifacts plus the ledger whose
-embedded patch records [`vex`](#vex), [`list`](#list) and [`repair`](#repair) read)
-along with the lockfile edits, and **every fresh checkout builds with the patched
-dependency**: no `socket-patch` binary, no Socket API access and no install hook on the
-consuming machine.
-
-There are two ways in:
-
-- **`socket-patch vendor`** vendors the agent-mode patches listed in
-  `.socket/manifest.json`. With no manifest in a **hosted** project it **ejects**: it
-  takes the patch set from the lockfiles' hosted pins, fetches each patch from the API,
-  and vendors it (`Ejecting N hosted packages into .socket/vendor/...`). This is the way
-  to move a hosted project offline (run it while online; it works from a fresh checkout).
-  The eject is all-or-nothing: if any patch can't be fetched or vendored, the project is
-  left hosted exactly as it was. With neither a manifest nor hosted pins (a
-  `scan --mode vendored` project) it has nothing to vendor and says so; `vendor --revert`
-  works either way.
-- **`socket-patch scan --mode vendored`** discovers, downloads and vendors in one pass,
-  writes no `.socket/manifest.json`, and takes over packages a hosted scan redirected.
-
-Taking over a hosted package (either way) first restores its upstream registry entry —
-the same restore `rollback` does — so `vendor --revert` later returns it to upstream,
-never back to hosted. A package whose entry cannot be restored (offline, `bun.lockb`)
-fails with `redirect_revert_failed` and stays hosted.
-
-Vendoring is per-patch: only dependencies with a Socket patch are vendored. For the
-lockfile flavors each ecosystem supports, see the
-[mode × ecosystem matrix](docs/ecosystems.md#mode--ecosystem-matrix).
-
-**Usage:**
-```bash
-socket-patch vendor [options]
-socket-patch scan --mode vendored [PATHS]... [options]
-```
-
-**Command-specific options** (plus all [Global options](#global-options)):
-| Flag | Env var | Description |
-|------|---------|-------------|
-| `-f, --force` | `SOCKET_FORCE` | Tolerate *missing* patch-target files in the staged copy (skipped instead of failing the vendor) and bypass the variant probe for multi-release ecosystems. A plain before-hash mismatch doesn't need this: vendor staging always overwrites mismatched content with the verified patched bytes (surfaced as a `vendor_content_mismatch_overwritten` warning). |
-| `--revert` | `SOCKET_VENDOR_REVERT` | Undo vendoring: restore the recorded original lockfile fragments byte-for-byte and remove the `.socket/vendor/` artifacts. Works without a manifest. A package vendored over a hosted pin returns to its upstream registry entry. |
-| `--vex <path>` | `SOCKET_VEX` | On a successful vendor, also write an OpenVEX 0.2.0 document to this path. |
-| `--vex-product`, `--vex-no-verify`, `--vex-doc-id`, `--vex-compact` | `SOCKET_VEX_*` | Passthrough to the embedded VEX builder. Inert unless `--vex` is set. |
-
-**How it interacts with the rest of the CLI** — once a package is vendored, `vendor` owns
-it:
-
-- [`apply`](#apply) and [`rollback`](#rollback) skip vendored packages (they never touch
-  a vendor-owned tree or lockfile entry).
-- [`remove`](#remove) **reverts the vendoring** as part of removing the patch — lockfile
-  restored, artifact deleted — so one command fully undoes it.
-- An agent-mode [`scan`](#scan) skips vendored packages, and `--prune` exempts them
-  from its crawl-based prune (though a vendored entry whose dependency has left the
-  lockfile is reverted and dropped); newer patches show up in `updates[]` as the signal
-  to re-run `scan --mode vendored`.
-- [`vex`](#vex) attests vendored patches by verifying the **committed artifact** (marked
-  `(vendored)` in the impact statement) — no install step needed.
-- Re-running either form is idempotent. Patches dropped from `.socket/manifest.json`
-  are auto-reverted on the next `vendor` run; on a project vendored by
-  `scan --mode vendored`, use [`repair`](#repair) to verify or rebuild the committed
-  artifacts.
-
-**Examples:**
-```bash
-# Discover, download and vendor every patchable dependency (takes over hosted redirects)
-socket-patch scan --mode vendored
-
-# Preview it (would_vendor / would_revendor / already_vendored)
-socket-patch scan --json --mode vendored --dry-run
-
-# Vendor the agent-mode patches listed in .socket/manifest.json,
-# or, in a hosted project with no manifest, eject its hosted pins
-socket-patch vendor
-
-# Preview without writing anything
-socket-patch vendor --dry-run
-
-# Then make it stick: commit .socket/ (vendor artifacts + ledger) and the lockfile
-git add .socket package-lock.json && git commit -m "vendor Socket patches"
-
-# Undo everything (restores the original lockfile byte-for-byte; ejected hosted
-# packages come back as their upstream registry entries)
-socket-patch vendor --revert
-
-# JSON output for scripting
-socket-patch vendor --json
-```
-
-### `list`
-
-List the patches in this project: the hosted pins your lockfiles wire (labeled
-`Mode: hosted (wired in <lockfiles>)` — JSON `details.mode: "hosted"` and
-`details.lockfiles`), the vendor ledger's records (`Mode: vendored`), and any agent-mode
-entries in `.socket/manifest.json`. A hosted pin shows its UUID only (hosted mode keeps no
-local record; `vex` fetches it from the API), unless a pre-v5
-`.socket/vendor/redirect-state.json` still records it. A project with none prints `No
-patches in this project. Run \`socket-patch scan\`.` and exits 0 (`--json`: the success
-envelope with no events).
-
-**Usage:**
-```bash
-socket-patch list [options]
-```
-
-No command-specific options — see [Global options](#global-options) (`--json`,
-`--manifest-path`, `--cwd` are the relevant ones).
-
-**Examples:**
-```bash
-# List patches
 socket-patch list
-
-# JSON output
-socket-patch list --json
-```
-
-**Sample output:**
-```
-Found 1 patch:
-
-Package: pkg:npm/flatted@3.3.1
-  UUID: 5cac955f-eab1-4d29-8f4f-c408a6cc9647
-  Mode: vendored (recorded in .socket/vendor/state.json)
-  Tier: free
-  License: MIT
-  Exported: Wed, 18 Mar 2026 22:53:26 GMT
-  Vulnerabilities (1):
-    - GHSA-25h7-pfq9-p65f (CVE-2026-32141)
-      Severity: HIGH
-      Summary: flatted vulnerable to unbounded recursion DoS in parse() revive phase
-  Files patched (6):
-    - package/cjs/index.js
-    - package/es.js
-    ...
-```
-
-### `get`
-
-Get one security patch from the Socket API and apply it. Accepts a UUID, CVE ID, GHSA
-ID, PURL, or package name. The identifier type is auto-detected but can be forced with a
-flag. Like `scan`, `get` defaults to hosted mode; pass `--mode vendored`, or
-`--mode agent` for the manifest + in-place apply (implied by `--save-only` and
-`--global`). When a package has
-several patches, `get` picks the same one `scan` does (see
-[Which patch is picked](#which-patch-is-picked)). Hosted and vendored `get` never
-prompt, like `scan`; agent-mode `get` asks before applying (`--yes` or a non-TTY stdin
-accepts).
-
-Alias: `download`. And as a shortcut, `socket-patch <uuid>` with a bare patch UUID is
-rewritten to `socket-patch get <uuid>`.
-
-**Usage:**
-```bash
-socket-patch get <identifier> [options]
-```
-
-**Arguments:**
-- `identifier` — patch UUID, CVE ID, GHSA ID, package PURL, or package name. Type is
-  auto-detected; force it with `--id` / `--cve` / `--ghsa` / `--package`.
-
-**Command-specific options** (plus all [Global options](#global-options)):
-| Flag | Env var | Description |
-|------|---------|-------------|
-| `--id` | — | Force identifier to be treated as a UUID. |
-| `--cve` | — | Force identifier to be treated as a CVE ID. |
-| `--ghsa` | — | Force identifier to be treated as a GHSA ID. |
-| `-p, --package` | — | Force identifier to be treated as a package name. |
-| `--save-only` | `SOCKET_SAVE_ONLY` | Download the patch without applying it (alias: `--no-apply`). |
-| `--all-releases` | `SOCKET_ALL_RELEASES` | Download patches for every release/distribution variant of a matched package (PyPI wheel/sdist, RubyGems platform, Maven classifier), not just the installed one. |
-| `--mode <hosted\|vendored\|agent>` | — | How to consume the patch; the same modes as `scan --mode` (default: `agent`). |
-
-> Authenticated lookups run against an org. The slug is auto-resolved from your token
-> when omitted; pass `--org <slug>` (or set `SOCKET_ORG_SLUG`) to pick one explicitly —
-> useful when the token belongs to multiple orgs.
-
-**Examples:**
-```bash
-# Get patch by UUID
-socket-patch get 550e8400-e29b-41d4-a716-446655440000
-
-# Get patch by CVE
-socket-patch get CVE-2024-12345
-
-# Get patch by GHSA
-socket-patch get GHSA-xxxx-yyyy-zzzz
-
-# Get patch by package name (fuzzy matches installed packages)
-socket-patch get lodash
-
-# Consume the patch in hosted mode (lockfile rewrite) instead of in place
-socket-patch get CVE-2024-12345 --mode hosted
-
-# Download only, don't apply
-socket-patch get CVE-2024-12345 --save-only
-
-# Apply to global packages
-socket-patch get lodash -g
-
-# JSON output for scripting
-socket-patch get CVE-2024-12345 --json -y
-```
-
-### `remove`
-
-Remove a patch from the manifest (rolls back files first by default). If the package is
-[vendored](#vendor), `remove` also **reverts the vendoring** — the lockfile is restored
-byte-for-byte and the `.socket/vendor/` artifact is deleted — so the patch is fully gone
-in one command. Patches vendored by `scan --mode vendored` have no manifest entry and are
-removable by PURL or UUID all the same (reverting the vendoring *is* the removal, so
-`--skip-rollback` is refused for them). A hosted patch is removed the same way: its
-lockfile entries are restored to their upstream registry entry, exactly as `rollback`
-does it (refused, with the manifest untouched, where that is impossible).
-
-**Usage:**
-```bash
-socket-patch remove <identifier> [options]
-```
-
-**Arguments:**
-- `identifier` — package PURL (e.g. `pkg:npm/package@version`) or patch UUID.
-
-**Command-specific options** (plus all [Global options](#global-options)):
-| Flag | Env var | Description |
-|------|---------|-------------|
-| `--preserve-state` | `SOCKET_PRESERVE_STATE` | Restore the files and lockfiles but keep the patch's local state (manifest entry, vendored artifact + ledger entry) for a later re-apply, and skip blob cleanup — the single-patch twin of `rollback --preserve-state`. Conflicts with `--skip-rollback`. |
-| `--skip-rollback` | `SOCKET_SKIP_ROLLBACK` | Only update the manifest, do not restore original files (for a vendored package that still has a manifest entry this also leaves the vendor wiring + artifact in place; refused for manifest-less vendored patches, where the revert *is* the removal). |
-
-**Examples:**
-```bash
-# Remove by PURL
-socket-patch remove "pkg:npm/lodash@4.17.20"
-
-# Remove by UUID
-socket-patch remove 550e8400-e29b-41d4-a716-446655440000
-
-# Remove without rolling back files
-socket-patch remove "pkg:npm/lodash@4.17.20" --skip-rollback
-
-# JSON output
-socket-patch remove "pkg:npm/lodash@4.17.20" --json
-```
-
-### `rollback`
-
-Roll back patches to restore the system to unpatched. If no target is given, everything
-is rolled back, across all three modes: in-place file restores (agent), vendored unwire +
-artifact deletion + ledger-entry drop, and hosted lockfile entries restored to their
-upstream registry entries.
-The rolled-back entries are then removed from `.socket/manifest.json` (a zero-patch
-`{"patches": {}}` husk stays) and their blobs are garbage-collected — a later `apply` has
-nothing to re-apply. Pass `--preserve-state` to keep the local patch state (manifest
-entries, vendored artifacts + ledger entries) for a later re-apply; use
-[`remove`](#remove) for a single patch.
-
-**Hosted patches** are read from the lockfiles (hosted mode keeps no ledger). Each one is
-rewritten back to the default upstream registry entry, with the tarball URL, integrity or
-checksum re-resolved from the public registry — npm, crates.io, the Go module proxy, PyPI,
-rubygems.org, packagist, nuget.org (Maven needs no network). Where that is impossible the
-package is refused, nothing is written for it, and the run exits 1 with a hint to restore
-the file from version control (`git checkout -- <lockfile>`): under `--offline`, when the
-registry does not answer, for a binary `bun.lockb`, and for a few lock shapes whose
-entries only the package manager can compute (see
-[CLI_CONTRACT.md](crates/socket-patch-cli/CLI_CONTRACT.md), "Hosted unwind coverage").
-The registry bases honor the `SOCKET_NPM_REGISTRY`, `SOCKET_CRATES_INDEX`,
-`SOCKET_GOPROXY`, `SOCKET_GOSUMDB_URL`, `SOCKET_PYPI_JSON_API`, `SOCKET_RUBYGEMS_URL`,
-`SOCKET_PACKAGIST_URL` and `SOCKET_NUGET_URL` overrides for mirrors. A leftover pre-v5
-`.socket/vendor/redirect-state.json` is deleted once no lockfile pins a hosted patch.
-
-A wet run confirms once (auto-accepted under `--yes`/`--json`/non-TTY). Vendor-owned purls
-the run did NOT act on (a corrupt vendor ledger) are listed in the JSON output's
-`vendored` array; acted-on entries ride `vendoredReverted` / `vendoredPreserved` /
-`vendoredKept`.
-
-**Usage:**
-```bash
-socket-patch rollback [targets]... [options]
 ```
 
-**Arguments:**
-- `targets` — zero or more package PURLs, patch UUIDs or path globs (unioned). Omit to roll
-  back everything.
-
-**Command-specific options** (plus all [Global options](#global-options)):
-| Flag | Env var | Description |
-|------|---------|-------------|
-| `--preserve-state` | `SOCKET_PRESERVE_STATE` | Unpatch the system but keep the local patch state — manifest entries, vendored artifacts + ledger entries — for a later re-apply, and skip GC. Hosted patches have no preservable state (the lockfile is their only record) and are restored to upstream either way. |
-
-**Examples:**
-```bash
-# Rollback all patches
-socket-patch rollback
-
-# Rollback a specific package
-socket-patch rollback "pkg:npm/lodash@4.17.20"
-
-# Rollback by UUID
-socket-patch rollback 550e8400-e29b-41d4-a716-446655440000
+Use your project's normal install command in place of `npm ci`. Some package
+managers reuse installed or cached upstream packages; follow any reinstall warning
+from the CLI and the [ecosystem notes](docs/ecosystems.md). Generate VEX after
+installing to verify the copies your build consumes, then pass the document to your
+VEX-aware vulnerability scanner.
 
-# Dry run
-socket-patch rollback --dry-run
+## Patch modes
 
-# JSON output
-socket-patch rollback --json
-```
-
-### Agent mode
+| Mode | Command | What to commit | What installs need |
+| --- | --- | --- | --- |
+| Hosted (default) | `socket-patch scan` | Changed lockfiles, manifests, and registry configuration | Access to Socket's patch server |
+| Vendored | `socket-patch scan --mode vendored` | Changed dependency files and `.socket/vendor/` (artifacts and ledger) | The committed patched packages |
+| Agent | `socket-patch scan --mode agent` | `.socket/manifest.json` and patch data; Go also uses a committed patched tree | `socket-patch apply` after dependency installs |
 
-Agent mode keeps patches in `.socket/manifest.json` + `.socket/blobs/` and edits the
-installed files in place, so the CLI has to run again after every install. `apply`
-and `repair` are agent-mode commands; `get`, `list`, `remove` and `rollback` work in
-every mode.
+Vendored mode stores **patched dependencies**, not the entire dependency graph.
+Other dependencies still need their normal registry, mirror, or offline cache.
+Hosted and vendored installs do not need an install hook or the Socket Patch CLI.
 
-### `apply`
+The CLI supports npm, PyPI, Cargo, Go, RubyGems, Maven, Composer, NuGet, and Deno.
+Mode and package-manager support vary: Deno uses agent mode, for example. Check the
+[ecosystem support matrix](docs/ecosystems.md) before choosing a mode.
 
-Apply the patches in `.socket/manifest.json` to the installed files in place. Idempotent — safe to run from install
-hooks and CI on every build.
+## Common commands
 
-**Usage:**
-```bash
-socket-patch apply [options]
+```sh
+socket-patch scan --package lodash          # limit selection to a package
+socket-patch scan --max-new-patches 5        # introduce at most five new patches
+socket-patch scan 'apps/*'                  # scan project directories in a monorepo
+socket-patch get CVE-2024-12345              # target an advisory; hosted by default
+socket-patch vendor                        # eject an existing hosted patch set
+socket-patch rollback                      # restore upstream dependencies
 ```
 
-**Command-specific options** (plus all [Global options](#global-options)):
-| Flag | Env var | Description |
-|------|---------|-------------|
-| `-f, --force` | `SOCKET_FORCE` | Skip pre-application hash verification (apply even if package version differs). |
-| `--check` | — | Read-only audit that the committed **Go** `replace`-redirects match the manifest (for CI / GitHub-App auditing) — Go only, since cargo patches in place and has no redirect to audit. Lock-free, crawl-free, and offline-safe: exits 0 in sync, 1 on drift. Vendored modules are excluded from the audit. |
-| `--vex <path>` | `SOCKET_VEX` | On a successful apply, also write an OpenVEX 0.2.0 document to this path. See [Inline VEX generation](#inline-vex-on-apply--scan--vendor). |
-| `--vex-product`, `--vex-no-verify`, `--vex-doc-id`, `--vex-compact` | `SOCKET_VEX_*` | Passthrough to the embedded VEX builder; mirror the standalone [`vex`](#vex) knobs. Inert unless `--vex` is set. |
-
-**Examples:**
-```bash
-# Apply patches
-socket-patch apply
-
-# Dry run
-socket-patch apply --dry-run
-
-# Apply only npm patches
-socket-patch apply --ecosystems npm
-
-# Apply in offline mode
-socket-patch apply --offline
-
-# JSON output for CI/CD
-socket-patch apply --json
-
-# Apply and emit an OpenVEX attestation in one step
-socket-patch apply --vex socket.vex.json
-```
-
-> Packages managed by [`vendor`](#vendor) are skipped (`skipped`/`vendored` in JSON): the
-> committed vendored artifact is the patch, so there is nothing for `apply` to do — even
-> when the installed tree (e.g. `node_modules/`) is absent.
-
-### Agent mode in CI
-
-Agent mode patches the installed files in place, so every fresh dependency install
-reverts the patches until `socket-patch apply` runs again. (Hosted and vendored projects
-need no such step: the lockfile already names the patched packages.) Commit
-`.socket/manifest.json` and its blobs, then run `apply` in CI after every install:
-
-```bash
-# once, locally: record the patches (commit .socket/)
-socket-patch scan --mode agent
-
-# in CI, after `npm ci` / `pip install` / `bundle install` / ...
-socket-patch apply
-```
-
-> **v5.0: `setup` was removed.** See [Upgrading from `setup`](#upgrading-from-setup) to
-> retire the install hooks it wrote.
-
-Per-ecosystem notes for in-place patching:
-
-- **Cargo** patches the crate in place (in `vendor/` or the registry cache, rewriting
-  `.cargo-checksum.json` so `cargo build` accepts it) — note that a non-vendored crate
-  patches the **shared** `$CARGO_HOME/registry` cache, which affects every project on
-  the machine and is silently reset by `cargo clean` or a cache prune; vendor the
-  dependency (`--mode vendored`) for a project-local, committable patch.
-- **Go** writes a project-local patched copy under `.socket/go-patches/` plus a `go.mod`
-  `replace` directive (the module cache is `go.sum`-verified, so in-place patching can't
-  build); commit `go.mod` + `.socket/go-patches/` so a clone builds the patched bytes.
-- **Maven / NuGet**: in-place patching leaves the caches' own checksum sidecars stale
-  (NuGet's fixup deletes `.nupkg.metadata` and raises an advisory for the signed-package
-  `.nupkg.sha512` marker; Maven's `.jar.sha1`/`.jar.md5` are left as-is) — the copy-out
-  modes, `scan --mode vendored` and `scan --mode hosted`, never touch the caches and
-  avoid the issue entirely. See
-  [ecosystems.md](docs/ecosystems.md#maven--nuget-caveats).
-- **Deno** has no hosted or vendored mode, so agent mode is the only way to patch it.
-
-### Upgrading from `setup`
-
-v5 removes `socket-patch setup`. The hooks it wrote only ran `socket-patch apply`, so
-they keep working until you delete them, but nothing maintains them any more. For each
-project that ran `setup`:
-
-1. **Pick a mode.**
-   - *Move to hosted mode* (recommended; nothing runs after installs): run
-     `socket-patch rollback` (restores the patched files and empties the agent-mode
-     manifest), then `socket-patch scan`, and commit the lockfile changes and
-     `.socket/`.
-   - *Stay in agent mode*: keep `.socket/`, and add `socket-patch apply` to CI after
-     every install (see [Agent mode in CI](#agent-mode-in-ci)).
-2. **Delete the hook for each ecosystem `setup` wired:**
-   - **npm / pnpm / yarn / bun**: in `package.json`, remove the
-     `npx @socketsecurity/socket-patch apply --silent --ecosystems npm` command (or its
-     `pnpm dlx` twin) from `scripts.postinstall`, and from `scripts.dependencies` if it
-     is there. Drop the script key if nothing else is left in it.
-   - **Composer**: in `composer.json`, remove
-     `socket-patch apply --offline --silent --ecosystems composer` from
-     `scripts.post-install-cmd` and `scripts.post-update-cmd`.
-   - **Python**: remove `socket-patch[hook]` from `requirements.txt`, or from
-     `[project].dependencies` / `[tool.poetry.dependencies]` in `pyproject.toml`, then
-     `pip uninstall socket-patch-hook` in each environment that has it. Those packages
-     no longer receive releases; install the CLI separately using the
-     [v5 installation methods](#installation).
-   - **Bundler**: delete the managed `plugin "socket-patch", path: ...` block from the
-     `Gemfile`, then `bundle plugin uninstall socket-patch`, and delete
-     `.socket/bundler-plugin/`, `.socket/gem-plugin-stamp` and the `/gem-plugin-stamp`
-     line in `.socket/.gitignore`.
-3. **Check:** `socket-patch list` shows what remains. In agent mode, run
-   `socket-patch apply` once to confirm the manifest still applies.
-
-### `repair`
-
-Download missing blobs, re-vendor missing or corrupt vendored artifacts, and clean up unused
-blobs.
-
-Alias: `gc`
-
-`repair` cleans up the `.socket/` directory without running a scan — useful when you've
-manually adjusted the manifest, recovered from a partial-failure state, or just want to
-free space. It also re-vendors missing or corrupt vendored artifacts the same way `vendor`
-does (the patch service's prebuilt artifact first, a local build as the fallback), checked
-against `.socket/vendor/state.json`. `repair` does not recreate a lost `state.json`: if a
-lockfile points into `.socket/vendor/` and the ledger has no entry for it, `repair` fails with
-`vendor_ledger_missing` — restore `state.json` from version control. For the combined
-agent-mode workflow (discover + apply + GC in one pass), use `scan --sync` instead.
-
-Like every other mutating command, `repair` takes the `.socket/apply.lock` advisory lock
-while it runs and removes it when it finishes. If another `socket-patch` process is
-actively running, `repair` refuses up front with `lock_held` (exit 1); it never steals a
-live lock — wait for the other process to finish, or budget a wait with `--lock-timeout`.
-
-**Usage:**
-```bash
-socket-patch repair [options]
-```
-
-**Command-specific options** (plus all [Global options](#global-options)):
-| Flag | Env var | Description |
-|------|---------|-------------|
-| `--download-only` | `SOCKET_DOWNLOAD_ONLY` | Only download missing artifacts, do not clean up (incompatible with `--offline`). |
-
-**Examples:**
-```bash
-# Full repair (download missing + clean up unused)
-socket-patch repair
-
-# Cleanup only — missing blobs are warned about and skipped, never downloaded
-socket-patch repair --offline
-
-# Download missing blobs only
-socket-patch repair --download-only
-
-# JSON output for scripting
-socket-patch repair --json
-```
-
-## OpenVEX attestations
-
-`socket-patch vex` turns the patches your project carries into a machine-readable statement of *which
-known vulnerabilities no longer affect your build* because a Socket patch has been applied.
-This lets vulnerability scanners stop flagging CVEs that you've already remediated in
-place — without bumping the package version.
-
-**How it works**
-
-1. Gathers every patch the project can prove: agent-mode patches from
-   `.socket/manifest.json`, and [vendored](#vendor) / [hosted](#three-patch-modes) patches
-   from the wiring in your **lockfiles** (plus the vendor ledger when it is committed;
-   hosted records are fetched from the API). See [No manifest needed for hosted and vendored
-   patches](#no-manifest-needed-for-hosted-and-vendored-patches).
-2. Unless `--no-verify` is passed, re-checks each patch's bytes so the attestation only
-   covers patches that are actually applied: agent patches against the installed tree,
-   vendored patches against the **committed artifact** (marker `(vendored)`), and hosted
-   patches against the installed copy the build consumes — or, before any install, against
-   the lockfile's integrity pin (marker `(redirected)`). Whatever `--no-verify` says, a record the
-   lockfile no longer wires is never attested.
-3. Auto-detects the top-level **product** identifier (override with `--product`), probing
-   in order:
-   - `.git/config` `[remote "origin"]` → `pkg:github/<owner>/<repo>` (similar for
-     GitLab/Bitbucket; raw URL otherwise)
-   - `package.json` → `pkg:npm/<name>@<version>`
-   - `pyproject.toml` → `pkg:pypi/<name>@<version>`
-   - `Cargo.toml` → `pkg:cargo/<name>@<version>`
-   - `go.mod` → `pkg:golang/<module>`
-   - `composer.json` → `pkg:composer/<vendor>/<name>[@<version>]`
-   - `pom.xml` → `pkg:maven/<groupId>/<artifactId>[@<version>]`
-   - the root's single `*.csproj` → `pkg:nuget/<id>[@<version>]`
-   - the root's single `*.gemspec` → `pkg:gem/<name>[@<version>]`
-4. Emits an OpenVEX 0.2.0 document whose statements mark each mitigated vulnerability as
-   `not_affected` (justification: the patch is present), suitable for piping into
-   `vexctl`, Grype, Trivy, and similar tools.
-
-**Provenance markers**
-
-Each statement's impact string records *how* the patch is persisted — one marker per
-[patch mode](#three-patch-modes):
-
-| Impact statement | Mode | What the evidence is | What a consumer should do |
-|---|---|---|---|
-| `Patched via Socket patch <uuid>` | agent | The installed tree: every patched file's hash was verified against the manifest's `afterHash` | Trust the statement as long as a CI `apply` keeps re-applying after every install |
-| `Patched via Socket patch <uuid> (vendored)` | vendored | The **committed** `.socket/vendor/` artifact was hash-verified — no install hook needed; the lockfile wiring is the persistence mechanism | Trust it on any checkout; the committed bytes are the patch |
-| `Patched via Socket patch <uuid> (redirected)` | hosted | The lockfile's integrity pin points at the Socket-hosted patched package. A post-install `socket-patch vex` hash-verifies the installed copy; before any install it attests from the pin. When emitted in-run by a hosted `scan --vex`, the statement is attested **without hash verification** (the bytes are fetched at install time — the JSON `vex` summary carries `verified: false`) | Ensure installs still resolve from `patch.socket.dev` (the lockfile edit is intact), and run `socket-patch vex` **after installing** to have the redirected patches hash-verified against the installed tree |
-
-The markers are stable strings (see
-[CLI_CONTRACT.md](crates/socket-patch-cli/CLI_CONTRACT.md)); scanners and policy engines
-may match on them.
-
-**Output channels**
-
-| Invocation | VEX document | Status / summary |
-|------------|--------------|------------------|
-| _default_ (no `--output`, no `--json`) | stdout | one-line summary (stderr) |
-| `--output <path>` | the file | one-line summary (stdout) |
-| `--json --output <path>` | the file | machine-readable envelope on stdout (the CI shape) |
-
-`--json` requires `--output`, since the VEX document is itself JSON and would otherwise
-collide with the envelope on stdout.
-
-**Using it with a scanner**
-
-```bash
-# Generate the attestation as part of CI, then hand it to a scanner
-socket-patch vex --output socket.vex.json
-
-# Suppress already-patched findings in Grype
-grype <image-or-dir> --vex socket.vex.json
-
-# Or with Trivy
-trivy image --vex socket.vex.json <image>
-```
-
-Patch first (in any mode). When nothing names a patch anywhere — no manifest
-entry, no vendor ledger entry, no hosted or vendored lockfile reference — `vex`
-errors with `no_patches` (exit 1) when the manifest file exists but is empty, or with
-`manifest_not_found` (exit 2) when there is no manifest either. When there are patches but
-none can be attested, it exits 1 with `no_applicable_patches`, and each omission is listed
-with its reason: `hash_mismatch`, `record_unavailable`, `redirect_unwired`, and so on.
-
-### No manifest needed for hosted and vendored patches
-
-A hosted or vendored checkout needs no `.socket/manifest.json`, and no vendor ledger
-either. This covers a depscan-opened PR, a clone of a repo that never committed its
-vendor ledger, and every hosted project (hosted mode keeps no ledger at all). `vex` reads
-the patch reference out of each root lockfile or config: a `patch.socket.dev` URL (or one
-on your `--patch-server-url`) or a `.socket/vendor/<eco>/<uuid>/…` path carries the patch
-uuid. It then finds that patch's record in the manifest or vendor ledger, or fetches it
-from the patch API — the normal path for hosted patches. The references it accepts are what socket-patch's own
-rewriters write: a URL on any other host, or an entry the package manager would not
-install from, is ignored.
-
-```bash
-# Fresh clone of a hosted or vendored project: nothing installed, no .socket/manifest.json
-socket-patch vex --output socket.vex.json
-```
-
-Behavior worth knowing:
-
-- **Network.** Without a local record, `vex` fetches the patch by uuid from the patch API.
-  With `--offline`, or when the fetch fails or the patch is paid and not entitled, the patch
-  is omitted as `record_unavailable`. Hosted patches therefore need the network to be
-  attested; commit the vendor ledger, or keep the manifest, to attest offline.
-- **Liveness.** A vendor ledger entry (or a leftover pre-v5 hosted record) attests only
-  while a lockfile still wires it. Otherwise it is omitted as `vendor_unwired` or
-  `redirect_unwired`, even under `--no-verify`. Lockfiles
-  that wire one package to different patches (`wiring_conflict`) attest none of them. A
-  package that one lock wires to a patch while another lock resolves it from the registry
-  is not attested either.
-- **Diagnostics.** A lockfile that cannot be read or parsed, or a Socket reference that
-  fails validation, is reported as a warning (`lockfile_unparseable`, `patched_ref_invalid`,
-  …) and never aborts the run. With `--json` these go in `warnings[]`.
-- **Scope.** Only the project root is read (plus Rush's `common/config` pnpm locks). Nested
-  workspace-member lockfiles are not.
-
-| Ecosystem | Files read (project root) | Limitations |
-|---|---|---|
-| npm | `package-lock.json`, `npm-shrinkwrap.json` (both) | `link` / bundled entries never count |
-| pnpm | `pnpm-lock.yaml` (all generations), `shrinkwrap.yaml` (pnpm 1/2), Rush locks | Aliased / nested `resolution` shapes are diagnosed, not attested; `overrides` alone prove nothing |
-| yarn | `yarn.lock` (classic + berry) | Berry vendored entries also need the root `package.json` `resolutions` mapping; member locks are not read |
-| bun | `bun.lock`, else `bun.lockb` | A hosted entry that Bun < 1.3.10 re-saved without its sha512 attests only after install |
-| vlt | `vlt-lock.json` (`lockfileVersion` absent, 0 or 1) | A BOM-prefixed or other-version lock wires nothing; a same-version instance on another registry keeps a hosted pin from attesting before install; a vendored directory whose `package.json` patch lost its devDependencies needs the patched blob in `.socket/blobs` without the vendor ledger |
-| cargo | `Cargo.lock`, `Cargo.toml`, `.cargo/config[.toml]` | Root manifest + project config only (no `$CARGO_HOME` / parent configs); vendored `[patch.crates-io]` entries are read from `Cargo.toml` first (v5), the project config for pre-v5 projects, and must agree with the detached lock entry's tagged version `<version>+socket.<uuid>` (a tag for another uuid — in the lock or in the copy's own `Cargo.toml` — is dead wiring; an untagged detached entry counts only beside an untagged, pre-tag copy); a manifest entry cargo ignores (a same-key project-config item, or a URL-spelled crates.io `[patch]` table) is not attested; a lockless hosted pin (no `Cargo.lock`) names no version and is not attested — nor seen by `list` / `rollback` (only a pre-v5 redirect ledger record keeps it live) |
-| golang | `go.mod`, `go.work`, `go.sum`, `go.work.sum` | A replace that `require` no longer selects is inert; `vendor/modules.txt` is not read |
-| pypi | `uv.lock`, `*.py.lock`, `pylock*.toml`, `poetry.lock`, `pdm.lock`, `Pipfile.lock`, `requirements.txt` (+ `-r` includes), `pyproject.toml` / `hatch.toml` | A `uv.lock` beside a `pyproject.toml` must agree with its `[tool.uv.sources]`; PDM 3.1 / 4.0–4.2 locks are refused; a Pipenv project needs `--product` (or a git remote) |
-| gem | `Gemfile.lock`, `gems.locked` | Platform gems unsupported; a Gemfile-only (pre-bundler-2.6, not yet locked) wiring is not attested — nor seen by `list` / `rollback` (only a pre-v5 redirect ledger record keeps it live) |
-| composer | `composer.lock` | `installed.json` and `COMPOSER=`-renamed locks are not read |
-| maven | `pom.xml` (+ `.mvn/` checksums) | Root pom only (no parents / submodules, no Gradle); legacy same-GAV hosted repositories cannot be attributed |
-| nuget | `nuget.config`, `packages.lock.json` | Hosted needs a `packages.lock.json` entry for the id: with no lock, the mapping names no version and is not attested — nor seen by `list` / `rollback` (only a pre-v5 redirect ledger record keeps it live); root config only |
-| deno | none | No hosted or vendored mode exists; Deno patches attest only through the manifest (agent mode) |
-
-The full recognition rules are in
-[CLI_CONTRACT.md](crates/socket-patch-cli/CLI_CONTRACT.md) ("Manifest-less VEX").
-
-### Inline VEX on `apply` / `scan` / `vendor`
-
-You don't need a separate `vex` invocation: pass `--vex <path>` to `apply`, `scan`, or
-`vendor` and the same OpenVEX document is generated as a side-effect of a successful run.
-
-```bash
-# Hosted scan and attest in one step (not hash-verified until installed: re-run `vex` then)
-socket-patch scan --vex socket.vex.json
-
-# Vendor and attest — manifest-less by construction
-socket-patch scan --json --mode vendored --vex socket.vex.json
-
-# Agent mode: patch in place and attest
-socket-patch apply --vex socket.vex.json
-socket-patch scan --json --sync --vex socket.vex.json
-```
-
-The `--vex-product`, `--vex-no-verify`, `--vex-doc-id`, and `--vex-compact` flags mirror
-the standalone command's `--product` / `--no-verify` / `--doc-id` / `--compact` knobs.
-
-Contract:
-
-- The document is **always written to the file** (never stdout), so it never collides
-  with the command's own `--json` output. JSON mode adds a top-level `vex` summary —
-  `{ path, statements, format }` — to the envelope (`apply`) / result (`scan`).
-- It's built from the project **as it stands after the run** — the manifest (including
-  any `--mode agent` writes), the vendor ledger, and the lockfile wiring — and
-  verified against on-disk state unless `--vex-no-verify` is set. Generated for real runs
-  and report-only scans alike; `--dry-run` skips it (nothing was changed, so nothing is
-  attested).
-- `apply --vex` and `vendor --vex` with **no manifest** still attest what the lockfiles and
-  the vendor ledger wire. A project with nothing wired anywhere keeps the calm exit 0 and writes no
-  document. `apply --check` never generates one.
-- **Fail-the-command:** if `--vex` was requested but generation fails (no detectable
-  product, nothing attestable, a corrupt vendor ledger, unwritable path), the command exits
-  non-zero **even when the apply/scan itself succeeded**, with a stable error code in the
-  JSON output.
-
-## Scripting & CI/CD
-
-All commands support `--json` for machine-readable output. JSON responses always include
-a `"status"` field for easy error detection.
-
-**Authentication in CI:** a runner has no `socket login` state — if your organization
-has org-tier patches, provide the token as a CI secret via `SOCKET_API_TOKEN` (without
-it, runs silently fall back to the anonymous public proxy and see free patches only, and
-paid-tier blob downloads report `paidRequired`). To deliberately pin a run to the
-anonymous free tier, set `SOCKET_NO_API_TOKEN=1`. See
-[Configuration sources](#configuration-sources).
-
-```bash
-# Read-only check: what would a hosted scan patch? (writes nothing)
-result=$(socket-patch scan --json --dry-run --ecosystems npm)
-echo "$result" | jq '{patches: .totalPatches, redirected: .redirect.redirected, updates: (.updates | length)}'
-
-# Auto-update bot (hosted): take new and newer patches, then let the PR action commit
-socket-patch scan --json | jq '{redirected: .redirect.redirected, files: .redirect.rewrittenFiles}'
-# The PR action (e.g. peter-evans/create-pull-request) commits the working-tree
-# changes (lockfiles + .socket/vendor/); use this summary as the PR body.
-
-# Agent-mode bot: discover, apply, and garbage-collect in one pass
-socket-patch scan --json --sync | jq '{
-  applied:     [.apply.patches[]? | select(.action == "added" or .action == "updated") | .purl],
-  pruned:      (.gc.prunedManifestEntries // []),
-  bytes_freed: (.gc.bytesFreed // 0)
-}'
-
-# Agent mode: re-apply committed patches and check the result
-socket-patch apply --json | jq '.status'
-# "success", "partialFailure", "noManifest", or "error"
-```
-
-`scan` and hosted/vendored `get` never prompt, so CI needs no `--yes` for them. The
-commands that do confirm (agent-mode `get`, `rollback`, `remove`) auto-proceed when stdin is not a TTY. Progress
-indicators and ANSI colors are automatically suppressed when output is piped.
-
-The exact JSON shapes, exit codes, and stability guarantees are specified in
-[CLI_CONTRACT.md](crates/socket-patch-cli/CLI_CONTRACT.md).
-
-## Manifest format
-
-Agent mode records downloaded patches in `.socket/manifest.json` (hosted and vendored
-mode never write it):
-
-```json
-{
-  "patches": {
-    "pkg:npm/package-name@1.0.0": {
-      "uuid": "unique-patch-id",
-      "exportedAt": "2024-01-01T00:00:00Z",
-      "files": {
-        "path/to/file.js": {
-          "beforeHash": "git-sha256-before",
-          "afterHash": "git-sha256-after"
-        }
-      },
-      "vulnerabilities": {
-        "GHSA-xxxx-xxxx-xxxx": {
-          "cves": ["CVE-2024-12345"],
-          "summary": "Vulnerability summary",
-          "severity": "high",
-          "description": "Detailed description"
-        }
-      },
-      "description": "Patch description",
-      "license": "MIT",
-      "tier": "free"
-    }
-  }
-}
-```
+`get` also accepts a GHSA, patch UUID, PURL, or package name. `scan` selects from
+patches your account can download, preferring the newest merged patch and then the
+highest-severity patch. Existing patches are upgraded only by a better-ranked patch.
 
-Patched file contents are in `.socket/blobs/` (named by git SHA256 hash).
+Hosted rollback resolves upstream metadata and generally needs network access.
+Where restoration is unsupported, including hosted binary `bun.lockb`, the CLI
+refuses the change and gives a version-control recovery hint. See
+[usage and recovery](docs/usage.md).
 
-A manifest written by an earlier release may also carry a top-level `"setup"` key
-(`manual`, `exclude`) from the removed `setup` command; v5 keeps it on rewrite but
-ignores it.
+Use `socket-patch <command> --help` for options and
+[`socket.yml`](docs/configuration.md#repository-patch-policy) for a shared rollout policy.
 
-## Further reading
+## Documentation
 
-- **[Ecosystem & platform support](docs/ecosystems.md)** — the full mode × ecosystem
-  matrix, per-ecosystem caveats (Maven, NuGet, Rush monorepos, Go), and supported
-  platforms.
-- **[CLI contract](crates/socket-patch-cli/CLI_CONTRACT.md)** — the machine-readable
-  surface: exact JSON shapes, exit codes, flag/env bindings, and the semver policy that
-  governs them.
-- **[Design notes](docs/design/)** — e.g. [the configuration model](docs/design/configuration.md)
-  and [hosted mode for Go](docs/design/golang-hosted.md) (free tier; the
-  [paid-tier no-go analysis](docs/design/golang-hosted-no-go.md) it supersedes).
-- **[Changelog](CHANGELOG.md)**
+- [Usage](docs/usage.md): targeting, CI, vendoring, agent mode, VEX, and recovery.
+- [Configuration](docs/configuration.md): authentication, environment, and rollout policy.
+- [Ecosystem support](docs/ecosystems.md): package-manager formats and limitations.
+- [Migrating to v5](docs/migrating-to-v5.md): changed defaults and retired install hooks.
+- [CLI contract](crates/socket-patch-cli/CLI_CONTRACT.md): flags, JSON, diagnostics, and exit codes.
+- [Development](docs/development.md): code map, builds, and test entry points.
+- [Release runbook](docs/releasing.md) and [changelog](CHANGELOG.md).
diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index 70f217f7..0a6c90b5 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -1,9 +1,17 @@
 # socket-patch CLI contract
 
-This document defines the **public surface** of the `socket-patch` binary. Anything listed here is part of the user-visible contract: third-party scripts, CI pipelines, and the npm/pypi/cargo wrappers depend on it. Changes are governed by the semver policy at the bottom of this file.
+This document defines the **public surface** of the `socket-patch` binary. Third-party scripts, CI pipelines, and the npm distribution depend on this contract. Changes are governed by the semver policy at the bottom of this file.
 
 > **Why this exists.** A flag rename, a default-value change, or a JSON key rename can land green and break every shipped wrapper silently. The contract below is backed by the unit tests under `crates/socket-patch-cli/src/**` (`#[cfg(test)] mod tests`) and the parser tests under `crates/socket-patch-cli/tests/cli_parse_*.rs`. Changes that violate the contract must update those tests in lock-step with a major version bump.
 
+For task-oriented guidance, start with [usage](../../docs/usage.md),
+[configuration](../../docs/configuration.md), or [v5 migration](../../docs/migrating-to-v5.md).
+
+**Reference:** [Commands](#subcommands) · [Arguments](#global-arguments) ·
+[Policy](#socketyml-patch-policy-v50) · [VEX](#manifest-less-vex-lockfile-discovery) ·
+[Vendoring](#vendor-command-contract) · [Rollback](#rollback-command-contract-v50) ·
+[Environment](#environment-variables) · [JSON](#json-output-shapes) · [Exit codes](#exit-codes)
+
 ## Subcommands
 
 | Name | Visible alias(es) | Notes |
@@ -12,11 +20,11 @@ This document defines the **public surface** of the `socket-patch` binary. Anyth
 | `vex` | — | Emit an OpenVEX 0.2.0 attestation derived from the local manifest, the vendor ledger, and the hosted / vendored patch references the project's lockfiles wire (no manifest required; hosted records come from the API) |
 | `vendor` | — | Eject patched dependencies into committable `.socket/vendor/` and rewire lockfiles |
 | `list` | — | Print patches in the local manifest, plus the vendor ledger's records (v5.0) and the hosted pins the lockfiles wire (labeled; see the action matrix; an empty project exits 0) |
-| `get` | `download` | Agent mode by default (`--mode` selects hosted/vendored): fetch + apply a patch; requires positional `identifier` |
+| `get` | `download` | Fetch a selected patch in hosted mode by default; `--mode agent` selects in-place application, also the default with `--save-only` or global targeting. Requires positional `identifier`. |
 | `apply` | — | Agent mode: apply patches from the local manifest |
 | `rollback` | — | **Full-state rollback (v5.0, MAJOR)**: restore original files AND unwind vendored lockfile wiring / restore hosted pins to their upstream registry entries, remove the rolled-back entries from the manifest, and GC their blobs/archives; takes optional variadic positional `targets` (PURL \| UUID \| path glob). See [Rollback command contract](#rollback-command-contract-v50) |
-| `remove` | — | Agent mode: remove a patch from manifest (rolls back first); requires positional `identifier` |
-| `repair` | `gc` | Agent mode: download missing blobs, re-vendor missing/corrupt vendored artifacts (never re-synthesizing a lost ledger), and clean up unused ones (refuses with `lock_held` when a live process holds the lock; see "Lock lifecycle" below) |
+| `remove` | — | Restore and remove one patch across hosted, vendored, and agent state; requires positional `identifier`. |
+| `repair` | `gc` | Download missing agent blobs, re-vendor missing/corrupt vendored artifacts (never re-synthesizing a lost ledger), and clean up unused ones (refuses with `lock_held` when a live process holds the lock; see "Lock lifecycle" below) |
 
 Rows are in `--help` order (v5.0): the hosted/vendored workflow (`scan` → `vex` → `vendor`, with `list` to inspect), then the agent-mode (in-place patching) commands.
 
@@ -34,7 +42,7 @@ Rows are in `--help` order (v5.0): the hosted/vendored workflow (`scan` → `vex
 
 ## Global arguments
 
-In v3.0 every subcommand accepts the same set of "global" flags via a single shared `GlobalArgs` struct that's `#[command(flatten)]`-ed into each per-command struct (`crates/socket-patch-cli/src/args.rs`). Subcommands that don't actually consume a given flag accept it silently — e.g. `list --global` parses fine and is a no-op. Every flag also has an environment-variable binding; precedence is **CLI arg > env var > default** — and for exactly three keys (`--api-token`, `--org`, `--api-url`) the JS socket-cli's persisted login sits between env var and default: **CLI arg > env var (canonical, then `SOCKET_CLI_*` alias) > socket-cli `config.json` > default**. See "Persisted configuration" under Environment variables.
+Every subcommand accepts the same set of "global" flags via a single shared `GlobalArgs` struct that's `#[command(flatten)]`-ed into each per-command struct (`crates/socket-patch-cli/src/args.rs`). Subcommands that don't actually consume a given flag accept it silently — e.g. `list --global` parses fine and is a no-op. Every flag also has an environment-variable binding; precedence is **CLI arg > env var > default** — and for exactly three keys (`--api-token`, `--org`, `--api-url`) the JS socket-cli's persisted login sits between env var and default: **CLI arg > env var (canonical, then `SOCKET_CLI_*` alias) > socket-cli `config.json` > default**. See "Persisted configuration" under Environment variables.
 
 | Long | Short | Env var | Default | Type | Semantic |
 |---|---|---|---|---|---|
@@ -180,7 +188,7 @@ The hidden alias `--no-apply` on `get --save-only` is **part of the contract** 
 
 ### socket.yml patch policy (v5.0)
 
-A repository can **narrow** what `scan` patches with a `patches` block in its root `socket.yml` (the Socket scanner's config file; `version: 2` keeps every other consumer working — they strip or ignore the block). Design record: `docs/design/staged-rollout.md`.
+A repository can **narrow** what `scan` patches with a `patches` block in its root `socket.yml` (the Socket scanner's config file; `version: 2` keeps every other consumer working — they strip or ignore the block). Usage guide: [repository patch policy](../../docs/configuration.md#repository-patch-policy).
 
 **Grammar.** Every key is optional; camelCase, like the rest of socket.yml.
 
@@ -261,9 +269,9 @@ patches:
 
 ### Per-run limit on new patches (`scan --max-new-patches`, v5.0)
 
-`scan --max-new-patches <N|none>` (env `SOCKET_MAX_NEW_PATCHES`; socket.yml `patches.maxNewPatches`) paces a rollout: each run adds at most N patches to packages that had none, the most critical first, and defers the rest to the next run. It applies to `scan` in hosted, vendored and agent mode, wet and `--dry-run`, and to the in-memory engine (napi `maxNewPatches`, `hosted-bundle`); `get` is explicit intent and ignores it. Design: `docs/design/staged-rollout.md` §5.
+`scan --max-new-patches <N|none>` (env `SOCKET_MAX_NEW_PATCHES`; socket.yml `patches.maxNewPatches`) paces a rollout: each run adds at most N patches to packages that had none, the most critical first, and defers the rest to the next run. It applies to `scan` in hosted, vendored and agent mode, wet and `--dry-run`, and to the in-memory engine (napi `maxNewPatches`, `hosted-bundle`); `get` is explicit intent and ignores it. Usage guide: [gradual rollout](../../docs/configuration.md#gradual-rollout).
 
-**Classification.** After per-package selection, each selected `(project, purl)` row is compared with the project's **recorded view** — the merged manifest > hosted lockfile pins > vendor ledger that `updates[]` reads (§5.1):
+**Classification.** After per-package selection, each selected `(project, purl)` row is compared with the project's **recorded view** — the merged manifest > hosted lockfile pins > vendor ledger that `updates[]` reads:
 
 | Class | Rule | Capped | The writer gets |
 |---|---|---|---|
@@ -422,7 +430,7 @@ hand (the `postinstall`/`dependencies` entries, the `socket-patch[hook]` depende
 `socket-patch-bundler` gem are no longer published.
 
 Prefer hosted or vendored mode: their lockfile (and `.socket/vendor/`) edits are the persistence, so
-no install step exists. Agent mode (`scan --mode agent`, `get`, `apply`) patches the installed tree
+no Socket Patch install hook is needed. Agent mode (`scan --mode agent`, `get --mode agent`, `apply`) patches the installed tree
 in place, which the next package-manager install reverts; wire it into CI yourself:
 
 ```sh
@@ -1023,7 +1031,7 @@ State lives at `$XDG_CACHE_HOME`|`~/.cache` (Unix/macOS) or `%LOCALAPPDATA%` (Wi
 
 ## Environment variables
 
-All v3.0 env vars use the `SOCKET_*` prefix. Three legacy `SOCKET_PATCH_*` names are still honored at runtime for compatibility: on first read of any of the three the binary emits a one-shot deprecation warning to stderr (the warning fires unconditionally — even under `--silent` / `--json` — because it's a transition signal users need to see). The legacy names will be removed in a future major release.
+Public configuration uses the `SOCKET_*` names below. The three deprecated v3/v4 environment aliases were removed in v5; see [Removed env vars](#removed-env-vars).
 
 Four `SOCKET_CLI_*` names from the sibling JS Socket CLI are additionally accepted as **peer aliases** (supported, not deprecated — no warning): `SOCKET_CLI_API_TOKEN` → `SOCKET_API_TOKEN`, `SOCKET_CLI_ORG_SLUG` → `SOCKET_ORG_SLUG`, `SOCKET_CLI_API_BASE_URL` → `SOCKET_API_URL`, `SOCKET_CLI_NO_API_TOKEN` → `SOCKET_NO_API_TOKEN`. The canonical `SOCKET_*` name always wins when both are set; promotion is silent and happens in-process before clap parses. Other socket-cli names (`SOCKET_CLI_CONFIG`, `SOCKET_CLI_API_PROXY`, `SOCKET_CLI_DEBUG`) are deliberately **not** honored.
 
@@ -1058,7 +1066,7 @@ Empty string means unset at every layer: exported-but-empty flag-bound vars are
 | `SOCKET_NO_NPM_ALLOW_REMOTE_CONFIG` | `--no-npm-allow-remote-config` | `false` | Hosted mode: skip the `allow-remote=all` write to the project `.npmrc`. |
 | `SOCKET_NO_VLT_INSTALL_CLEANUP` | `--no-vlt-install-cleanup` | `false` | Hosted mode, `rollback`, `remove`: keep stale vlt installed copies. |
 | `SOCKET_FORCE` | `apply --force` / `-f`, `vendor --force` / `-f`, `--update --force` | `false` | Local to `apply`, `vendor` and `--update`. |
-| `SOCKET_PATCH_VERSION` | `--update <VERSION>` | (latest) | Local to `--update`; the same pin `install.sh` and the gem launcher honor. |
+| `SOCKET_PATCH_VERSION` | `--update <VERSION>` | (latest) | Local to `--update`; the same pin `install.sh` honors. |
 | `SOCKET_BATCH_SIZE` | `scan --batch-size` | `500` authenticated / `100` proxy | Local to `scan`. |
 | `SOCKET_MAX_NEW_PATCHES` | `scan --max-new-patches` | (unlimited) | Local to `scan` (v5.0): a count or `none`; empty is unset, malformed exits 2. |
 | `SOCKET_SCAN_PACKAGES` | `scan --package` | (none) | Local to `scan` (v5.0); comma-separated names or purls. |
diff --git a/crates/socket-patch-cli/src/commands/scan/rollout.rs b/crates/socket-patch-cli/src/commands/scan/rollout.rs
index 8c7042f7..82ef99e1 100644
--- a/crates/socket-patch-cli/src/commands/scan/rollout.rs
+++ b/crates/socket-patch-cli/src/commands/scan/rollout.rs
@@ -1,5 +1,5 @@
-//! Scan's side of the rollout stage (`docs/design/staged-rollout.md` §5,
-//! §9.2): `updates[]`, the hosted gate and the human lines. The stage
+//! Scan's side of the rollout stage (`docs/configuration.md#gradual-rollout`):
+//! `updates[]`, the hosted gate and the human lines. The stage
 //! itself is [`socket_patch_core::rollout::stage`].
 
 use std::collections::{BTreeMap, BTreeSet, HashSet};
diff --git a/crates/socket-patch-cli/src/commands/scan/rollout_args.rs b/crates/socket-patch-cli/src/commands/scan/rollout_args.rs
index 47b7b7ca..e4d251e9 100644
--- a/crates/socket-patch-cli/src/commands/scan/rollout_args.rs
+++ b/crates/socket-patch-cli/src/commands/scan/rollout_args.rs
@@ -1,5 +1,5 @@
-//! `scan --max-new-patches` (work item B of the staged-rollout design,
-//! `docs/design/staged-rollout.md` §5).
+//! `scan --max-new-patches` (see the rollout guide,
+//! `docs/configuration.md#gradual-rollout`).
 
 
 use clap::Args;
diff --git a/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs b/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
index 59a96a70..6adcb5a7 100644
--- a/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs
@@ -6,7 +6,7 @@
 //! machinery still has teeth against a tampered pin.
 //!
 //! The three properties this pins (each validated empirically before the
-//! feature was built — see `docs/design/golang-hosted.md`):
+//! feature was built — see `docs/ecosystems.md#go-directory-replaces-and-gosum`):
 //!
 //! 1. **No sumdb consultation**: `GOSUMDB` is set to a bogus database name
 //!    for every day-2 command. go parses `GOSUMDB` lazily and consults it only
diff --git a/crates/socket-patch-cli/tests/e2e_hosted_production.rs b/crates/socket-patch-cli/tests/e2e_hosted_production.rs
index be8b9b90..89384e9a 100644
--- a/crates/socket-patch-cli/tests/e2e_hosted_production.rs
+++ b/crates/socket-patch-cli/tests/e2e_hosted_production.rs
@@ -51,7 +51,7 @@
 //!   cargo tier emptied on 2026-08-28, so the leg was demoted to the canary
 //!   (`docs/testing/hosted-production-e2e.md` says how to re-promote it).
 //! * **golang** — hosted mode is supported for free-tier references carrying
-//!   a `goproxy` override (`docs/design/golang-hosted.md`), but production
+//!   a `goproxy` override (`docs/ecosystems.md#go-directory-replaces-and-gosum`), but production
 //!   publishes no golang hosted modules yet. Covered as a shape guard that
 //!   holds in both worlds.
 //! * **deno** — hosted mode is not supported. Covered as a negative assertion.
@@ -2427,7 +2427,7 @@ fn statements_for_opt(doc: Option<&serde_json::Value>, purl: &str) -> usize {
 // ===========================================================================
 
 /// Go hosted mode: supported for free-tier references that carry a `goproxy`
-/// override (`docs/design/golang-hosted.md`); refused with
+/// override (`docs/ecosystems.md#go-directory-replaces-and-gosum`); refused with
 /// `redirect_golang_unsupported` otherwise (`golang-hosted-no-go.md`, the
 /// paid-tier analysis).
 ///
diff --git a/crates/socket-patch-cli/tests/e2e_redirect_gem_build.rs b/crates/socket-patch-cli/tests/e2e_redirect_gem_build.rs
index 5ba18f3e..28191bbf 100644
--- a/crates/socket-patch-cli/tests/e2e_redirect_gem_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_redirect_gem_build.rs
@@ -6,7 +6,7 @@
 //! `/api/v1/dependencies` fallback returned a zero-byte body); the 2026-08-18
 //! gem catalog republish fixed the served index, and this hermetic suite pins
 //! the contract from both sides regardless of production's current state —
-//! see the history section of `docs/testing/hosted-production-e2e.md`.
+//! see `docs/testing/hosted-production-e2e.md` for the live-service counterpart.
 //!
 //! Unlike the npm/cargo siblings, this suite is FULLY hermetic: the fixture
 //! gems are authored here and built with the real `gem build`, and ONE
@@ -1390,8 +1390,8 @@ async fn gem_hosted_gems_rb_spelling_redirects_and_installs() {
 
 /// The compact-index DEPENDENCY contract, pinned from the red side: a patch
 /// registry whose `/info` omits the gem's runtime deps (production's
-/// HISTORICAL behavior until the 2026-08-18 republish fixed the served index
-/// — see docs/testing/hosted-production-e2e.md's history section) BREAKS the
+/// HISTORICAL behavior until the 2026-08-18 republish fixed the served index)
+/// BREAKS the
 /// prescribed install with bundler's `APIResponseMismatchError`. If the CLI
 /// or fixture ever starts tolerating that silently, this turns red.
 #[tokio::test(flavor = "multi_thread")]
diff --git a/crates/socket-patch-core/README.md b/crates/socket-patch-core/README.md
index ebb97ad4..594d15da 100644
--- a/crates/socket-patch-core/README.md
+++ b/crates/socket-patch-core/README.md
@@ -4,11 +4,15 @@ Core library for [socket-patch](https://github.com/SocketDev/socket-patch) — a
 
 ## What this crate provides
 
-- **Manifest management** — read, write, and validate `.socket/manifest.json` patch manifests
-- **Patch engine** — apply and rollback file-level patches using git SHA-256 content hashes
-- **Crawlers** — discover installed packages across npm, PyPI, Ruby gems, Cargo, Go, Maven, Composer, NuGet, and Deno
-- **API client** — fetch patches from the Socket API
-- **Utilities** — PURL parsing, blob storage, hash verification, fuzzy matching
+- Dependency discovery from installed packages and lockfiles.
+- Hosted dependency rewriting, including the in-memory engine used by the Node bindings.
+- Selection policy and gradual rollout shared across disk and in-memory scans.
+- Vendored artifact acquisition, verification, wiring, and reversal.
+- Agent patch manifests and file-level apply/rollback with content-hash checks.
+- Socket API access and OpenVEX generation from patch records and live references.
+
+See the repository's [development guide](../../docs/development.md) for the code map
+and [ecosystem matrix](../../docs/ecosystems.md) for supported formats and limits.
 
 ## Usage
 
diff --git a/crates/socket-patch-core/src/patch/redirect/mod.rs b/crates/socket-patch-core/src/patch/redirect/mod.rs
index 9c148ad4..59d148cd 100644
--- a/crates/socket-patch-core/src/patch/redirect/mod.rs
+++ b/crates/socket-patch-core/src/patch/redirect/mod.rs
@@ -5868,7 +5868,7 @@ fn go_token_safe(s: &str) -> bool {
     !s.is_empty() && !s.chars().any(|c| c.is_whitespace() || c.is_control())
 }
 
-// The committable shape (validated empirically — `docs/design/golang-hosted.md`):
+// The committable shape (validated empirically — `docs/ecosystems.md#go-directory-replaces-and-gosum`):
 //
 //   go.mod:  replace <orig> <ver> => patch.socket.dev/gopatch/<uuid> <sver>
 //   go.sum:  patch.socket.dev/gopatch/<uuid> <sver> h1:…          (zip dirhash)
diff --git a/crates/socket-patch-core/src/policy/mod.rs b/crates/socket-patch-core/src/policy/mod.rs
index 0577c45d..15778f26 100644
--- a/crates/socket-patch-core/src/policy/mod.rs
+++ b/crates/socket-patch-core/src/policy/mod.rs
@@ -1,6 +1,6 @@
 //! The repository's patch policy: the `patches` block and
 //! `projectIgnorePaths` of the root `socket.yml`, plus the built-in default
-//! path ignores. See `docs/design/staged-rollout.md` §3-§4.
+//! path ignores. See `docs/configuration.md#repository-patch-policy`.
 //!
 //! A policy only ever **narrows** what `scan` patches (trust boundary,
 //! CLI_CONTRACT.md): nothing here names an endpoint, a credential, a mode
diff --git a/crates/socket-patch-core/src/rollout/stage.rs b/crates/socket-patch-core/src/rollout/stage.rs
index eb6c08df..9ebd7e7a 100644
--- a/crates/socket-patch-core/src/rollout/stage.rs
+++ b/crates/socket-patch-core/src/rollout/stage.rs
@@ -1,4 +1,4 @@
-//! The per-run rollout stage (`docs/design/staged-rollout.md` §5, §9.2)
+//! The per-run rollout stage (`docs/configuration.md#gradual-rollout`)
 //! the disk scan and the in-memory engine share: classify the selected
 //! offers against the recorded state, spend the budget on NEW packages
 //! most critical first once each mode's eligibility checks ran, and
diff --git a/crates/socket-patch-core/src/vendor/go_sum_edit.rs b/crates/socket-patch-core/src/vendor/go_sum_edit.rs
index e216b147..a84c2d72 100644
--- a/crates/socket-patch-core/src/vendor/go_sum_edit.rs
+++ b/crates/socket-patch-core/src/vendor/go_sum_edit.rs
@@ -10,7 +10,7 @@
 //! ```
 //!
 //! Both lines are load-bearing on day-2 machines (validated empirically —
-//! see `docs/design/golang-hosted.md`): under the default `-mod=readonly` a
+//! see `docs/ecosystems.md#go-directory-replaces-and-gosum`): under the default `-mod=readonly` a
 //! missing zip line fails resolution up front, a missing `/go.mod` line fails
 //! after download, and a *present* line is verified against the fetched bytes
 //! (a wrong hash is a hard `SECURITY ERROR`). Crucially, go consults the
diff --git a/crates/socket-patch-core/src/vendor/golang.rs b/crates/socket-patch-core/src/vendor/golang.rs
index c54d16b8..83477a03 100644
--- a/crates/socket-patch-core/src/vendor/golang.rs
+++ b/crates/socket-patch-core/src/vendor/golang.rs
@@ -1562,7 +1562,7 @@ mod tests {
             .any(|e| e.module == MODULE && e.owner == Some(ReplaceOwner::Vendor)));
     }
 
-    /// Cross-mode policy regression (docs/design/golang-hosted.md): vendor
+    /// Cross-mode policy regression (docs/ecosystems.md#go-directory-replaces-and-gosum): vendor
     /// takes over a hosted-mode replace through the LOCAL build leg too — only
     /// local *apply* refuses a Hosted-owned directive (its go-patches copy is
     /// uncommitted, so the takeover would break other machines). The hosted
diff --git a/docs/configuration.md b/docs/configuration.md
new file mode 100644
index 00000000..274692dc
--- /dev/null
+++ b/docs/configuration.md
@@ -0,0 +1,146 @@
+# Configuration
+
+Socket Patch reads command-line flags, environment variables, the Socket CLI's
+persisted login, and repository patch-selection policy. For the complete flag and
+environment-variable tables, see the
+[CLI contract](../crates/socket-patch-cli/CLI_CONTRACT.md#environment-variables).
+
+## Authentication and endpoints
+
+Without a token, Socket Patch uses `https://patches-api.socket.dev` to access the
+free patch catalog. With a token, it uses `https://api.socket.dev` and your
+organization's patch entitlement.
+
+For the token, organization, and authenticated API URL, precedence is:
+
+1. Command-line flag.
+2. Canonical environment variable, then its Socket CLI alias.
+3. Socket CLI's persisted `config.json`.
+4. Built-in default.
+
+| Setting | Flag | Environment variable | Socket CLI alias | Persisted key |
+| --- | --- | --- | --- | --- |
+| Token | `--api-token` | `SOCKET_API_TOKEN` | `SOCKET_CLI_API_TOKEN` | `apiToken` |
+| Organization | `--org` | `SOCKET_ORG_SLUG` | `SOCKET_CLI_ORG_SLUG` | `defaultOrg` (also accepts `org`) |
+| Authenticated API | `--api-url` | `SOCKET_API_URL` | `SOCKET_CLI_API_BASE_URL` | `apiBaseUrl` |
+
+The separate Socket CLI writes that file through `socket login` or `socket config`.
+Socket Patch only reads it. Missing configuration is silent; an unreadable or
+invalid login file produces a warning and falls back to the other sources.
+Empty environment values are treated as unset.
+
+- `SOCKET_NO_CONFIG=1` disables persisted configuration.
+- `SOCKET_NO_API_TOKEN=1` ignores ambient tokens from the environment and login
+  file; an explicit `--api-token` still wins. `SOCKET_CLI_NO_API_TOKEN` is an alias.
+- `--proxy-url` / `SOCKET_PROXY_URL` selects the public patch API endpoint. It is
+  distinct from an HTTP forward proxy: use `HTTP_PROXY`, `HTTPS_PROXY`, and
+  `NO_PROXY` for those.
+- `--offline` prohibits network access. `scan` and `get` require the patch API
+  and refuse offline operation. Other commands can use locally available state;
+  missing records or artifacts can still prevent completion.
+- `SOCKET_NO_UPDATE_CHECK=1` disables the passive update notice.
+
+For other settings, precedence is flag → environment → default, except for the
+repository policy scalars below. Socket Patch does not automatically load `.env`
+files, and repository files cannot set credentials, API endpoints, or safety options.
+
+## Repository patch policy
+
+Commit a root `socket.yml` to control what `scan` may patch:
+
+```yaml
+version: 2
+patches:
+  enabled: true
+  ecosystems: [npm, pypi]
+  minSeverity: high
+  maxNewPatches: 5
+  includePaths: ["apps/**", "services/**"]
+  ignorePaths: ["services/legacy/**"]
+  ignorePackages: ["pkg:npm/example-package"]
+```
+
+Omit lists you do not need. The policy narrows selection; it does not choose a patch
+mode or add dependencies. Socket Patch reads only `projectIgnorePaths` and the
+`patches` block from the shared Socket configuration, plus the `version` needed to
+validate that block.
+
+| Key under `patches` | Meaning |
+| --- | --- |
+| `enabled` | `false` reports candidates without changing patches or running prune |
+| `ecosystems` | Limit selection to ecosystem slugs from the [support matrix](ecosystems.md) |
+| `includePaths` / `ignorePaths` | Include or exclude project roots by their dependency-file paths |
+| `packages` / `ignorePackages` | Include or exclude package names or PURLs, optionally with exact versions |
+| `minSeverity` | Minimum severity: `critical`, `high`, `medium` (`moderate`), or `low`; omit for no floor |
+| `maxNewPatches` | Maximum newly patched package identities per invocation; integer from 0 to 4294967295; omit for unlimited |
+
+A package already patched but now excluded is retained unchanged. Narrowing policy
+never unpatches it. Use `rollback` or `remove` to remove a patch.
+
+### Precedence and scope
+
+CLI list filters (`--ecosystems`, `--package`, and PATHs) intersect with the file's
+lists. Scalar settings follow flag → environment → file → default:
+
+```sh
+socket-patch scan --min-severity critical
+socket-patch scan --max-new-patches 2
+socket-patch scan --no-socket-yml
+```
+
+The scalar environment variables are `SOCKET_MIN_SEVERITY` and
+`SOCKET_MAX_NEW_PATCHES`. `--no-socket-yml` / `SOCKET_NO_SOCKET_YML` bypasses the file;
+built-in discovery exclusions still apply.
+
+Policy applies to every `scan` mode, including previews, and to the in-memory hosted
+engine. `get` is an explicit selection: it bypasses policy and warns when a valid
+policy would exclude its target. `apply`, `list`, `vex`, `vendor`, `repair`, `rollback`,
+and `remove` do not apply selection policy to existing patches.
+
+Only the repository root's `socket.yml` or `socket.yaml` is read, not a file per
+subdirectory. Repository lookup starts at `--cwd` and uses the nearest trusted `.git`
+ancestor; without one it uses `--cwd`. Global scans read no repository policy.
+If both filenames exist, their policies must agree. Invalid patch policy fails the
+scan before network requests or writes rather than silently broadening selection.
+See the [exact lookup and validation rules](../crates/socket-patch-cli/CLI_CONTRACT.md#socketyml-patch-policy-v50).
+
+### Paths and monorepos
+
+Path lists use case-insensitive gitignore semantics, relative to the repository
+root. Later matches win; `!` negates, but cannot re-include a child of an ignored
+directory. A root is excluded only when all of its dependency markers are ignored;
+`includePaths` admits it when any marker matches. A workspace member sharing the
+root's lockfile is part of that project: use package filters to restrict its patches.
+
+Discovered project roots under `test/`, `tests/`, `fixtures/`, `__fixtures__/`, and
+`testdata/` are excluded by default. An explicitly named root (`--cwd` or a literal
+PATH) skips these defaults, but still follows repository policy. A file pattern can
+re-include a default, for example `ignorePaths: ["!/e2e/tests/"]`.
+
+```sh
+socket-patch scan --cwd apps/web
+socket-patch scan 'apps/*' --mode hosted
+```
+
+Each PATH in hosted or vendored mode is a project directory. Paths outside the
+repository are rejected. For JSON output, scan one project per invocation.
+
+### Gradual rollout
+
+```sh
+socket-patch scan --max-new-patches 5       # add at most five newly patched packages
+socket-patch scan --max-new-patches 0       # upgrade existing patches only
+socket-patch scan --max-new-patches none    # remove the cap for this run
+```
+
+New patches are prioritized by severity, then advisory count, with deterministic
+tie-breaking. Updates of already patched packages do not consume the cap. Multiple
+project directories in one invocation share the budget and are visited in sorted
+order; the same admitted package identity does not spend it twice. Separate commands
+have separate budgets.
+
+A preview reports what would be admitted or deferred. JSON results include `policy`
+and `rollout` summaries. Repeated scans advance against the state from previous runs;
+in a PR workflow, merge the changed dependency files before expecting a fresh
+checkout to advance to the next batch. The CLI does not schedule runs or count open
+PRs.
diff --git a/docs/design/configuration.md b/docs/design/configuration.md
deleted file mode 100644
index 555b1db4..00000000
--- a/docs/design/configuration.md
+++ /dev/null
@@ -1,178 +0,0 @@
-# Configuration design: env vars, the socket-cli config file, and what we deliberately don't read
-
-Status: **implemented** (v3.5); section 4 (`socket.yml` patch policy) is
-**implemented** in v5.0 for its filters (`socket_patch_core::policy`; the
-per-run cap follows with `--max-new-patches`, see `staged-rollout.md`). This document records the
-settled design so future configuration surface grows inside it instead of
-inventing new mechanisms.
-
-## Problem
-
-socket-patch's configuration was flags + `SOCKET_*` env vars only. That
-architecture is correct for a CLI in the package-manager class, but it had
-no story for "configure once, use everywhere": a user who ran
-`socket login` with the JS Socket CLI still had to export
-`SOCKET_API_TOKEN` for socket-patch. Meanwhile `.env`-style repo-local
-config kept coming up as a "simpler setup" suggestion.
-
-## Decisions
-
-### 1. Flag > env > socket-cli config > default — per key
-
-Every flag keeps its clap `env =` binding (`SOCKET_*` prefix, CLI arg wins).
-For exactly three settings the JS socket-cli's persisted login state is a
-fallback layer between env and default:
-
-```
-apiToken / org / apiBaseUrl:
-  1. CLI flag              --api-token / --org / --api-url
-  2. Canonical env         SOCKET_API_TOKEN / SOCKET_ORG_SLUG / SOCKET_API_URL
-  3. Peer alias env        SOCKET_CLI_API_TOKEN / SOCKET_CLI_ORG_SLUG / SOCKET_CLI_API_BASE_URL
-                           (silent in-process promotion before clap; canonical wins)
-  4. socket-cli config     <data dir>/socket/settings/config.json  (READ-ONLY)
-                           keys: apiToken, defaultOrg (accepts alias "org"), apiBaseUrl
-  5. Built-in default      no token → public proxy; org → auto-resolve;
-                           url → https://api.socket.dev
-
-Vetoes:
-  SOCKET_NO_API_TOKEN (alias SOCKET_CLI_NO_API_TOKEN) — ambient tokens
-    (layers 2–4) yield none; an explicit --api-token flag still wins.
-  SOCKET_NO_CONFIG — layer 4 disabled entirely (also the test-hermeticity
-    switch; the workspace .cargo/config.toml exports it for all cargo runs).
-
-Empty string == unset at every layer (repo-wide rule).
-```
-
-Implementation: `socket_patch_core::utils::socket_cli_config` (path
-resolution mirrors socket-cli's `getSocketAppDataPath` — plus, on macOS, a
-second probe of the legacy `~/.local/share` location that older socket-cli
-releases wrote on every platform; lenient base64→JSON→plain-JSON decode,
-allowlist copy, `OnceLock` disk cache with the gate checked per call),
-consumed by `get_api_client_with_overrides`
-(`api/client.rs`) and — for `apiBaseUrl` — by the shared
-`resolve_api_base_url()` that the telemetry endpoint resolver also uses, so
-client and telemetry can never disagree about the API host. The
-`--api-url`/`--proxy-url` clap defaults were removed (fields are
-`Option<String>`) so the layer isn't dead code; the documented defaults are
-applied at client construction.
-
-### 2. The file is socket-cli's; we only read it
-
-No `socket-patch login`, no `socket-patch config set`, no writes ever. The
-file (base64-encoded JSON) is written by `socket login` / `socket config
-set`. Corrupt or unreadable → one-shot stderr warning naming the path, then
-treated as absent; missing → silent. `--json` stdout purity holds because
-all diagnostics are stderr-only. Keys other than the three above
-(`apiProxy`, `enforcedOrgs`, `skipAskToPersistDefaultOrg`) are socket-cli
-UX policy and are ignored.
-
-### 3. Alignment across Socket tools
-
-- The python `socketsecurity` CLI already accepts `SOCKET_API_TOKEN`, so
-  the canonical names are the cross-tool bridge; no `SOCKET_SECURITY_*`
-  aliases were added.
-- `socket.yml` is shared with the scanning product (projectIgnorePaths /
-  triggerPaths / issueRules / githubApp). As of v5.0 socket-patch reads
-  exactly two of its keys, `projectIgnorePaths` and a new `patches` block,
-  and nothing else (section 4).
-- `SOCKET_PROXY_URL` (the public patch **endpoint**) must never be
-  conflated with socket-cli's `apiProxy` (an HTTP **forward proxy**).
-  Forward-proxy behavior comes from the standard
-  `HTTP_PROXY`/`HTTPS_PROXY`/`NO_PROXY` vars, which reqwest honors.
-
-### 4. `socket.yml` carries patch selection policy, never settings (v5.0)
-
-Revisits the v3.5 position that socket-patch does not read `socket.yml`.
-Staged rollout needs a repo-owned, reviewable place to say which projects,
-ecosystems and packages may be patched, a severity floor and a per-run cap
-on new patches (`staged-rollout.md`). `socket.yml` is where Socket users
-already express repo policy, it lives at the repo root, and a new
-top-level `patches:` key is stripped or ignored by every existing parser.
-
-The trust boundary is unchanged and gains its positive half:
-
-- A repository file may **narrow or pace** what `scan` patches. It may
-  never widen it, name an endpoint or credential, choose a mode or download
-  format, or disable a safety interlock. The parser has no fields for any
-  of those; such keys are unknown keys and fail validation.
-- Because the file only narrows, an unreadable file or an invalid
-  `patches` block fails closed (exit 1, `socket_yml_invalid`, nothing
-  written) instead of being treated as absent. (A repo with no `patches`
-  block and a malformed `projectIgnorePaths` gets a warning, so repos that
-  never opted in do not start failing.) This is the opposite of the socket-cli `config.json` rule above
-  (corrupt → warn and ignore), and deliberately so: ignoring a broken
-  user-level login file loses a convenience; ignoring a broken repo policy
-  widens the rollout.
-- Lookup is bounded to the repository (nearest `.git` ancestor of
-  `--cwd` owned by the user, honoring `GIT_CEILING_DIRECTORIES`, else
-  `--cwd`), root files only, regular files only.
-- Flags and env vars still win over the file for scalars (CLI > env >
-  file > default) and intersect with it for list filters;
-  `--no-socket-yml` / `SOCKET_NO_SOCKET_YML` ignores the file.
-- Only `scan` (every mode) and the in-memory engine honor it. Commands
-  that report, attest or undo existing state (`list`, `vex`, `rollback`,
-  `remove`, `repair`, `apply`, `vendor`) ignore it; `get` bypasses it with
-  a warning.
-
-Implementation: `socket_patch_core::policy` (`SelectionPolicy::load` over a
-`PolicyFs`: `DiskPolicyFs` for a checkout, `MemoryPolicyFs` for the
-in-memory engine) parses the file as a YAML 1.2 event stream (serde-saphyr's
-parser, so aliases are never expanded) and validates only `version`,
-`projectIgnorePaths` and `patches`. Disk scan glue lives in
-`commands/scan/policy.rs`; the flags in `commands/scan/socket_yml_args.rs`.
-The full contract is CLI_CONTRACT.md "socket.yml patch policy".
-
-## Explicitly rejected
-
-| Idea | Why not |
-|---|---|
-| Auto-loading `.env` / `.env.local` | Trust boundary: the tool mutates installed packages while holding an API token; a file in a *cloned repo* must never redirect endpoints, disable interlocks, or spend the token. Also the wrong convention class — npm/cargo/pip/git read no `.env`; dotenv is an app-runtime convention. Users who want it have direnv/mise/dotenvx. |
-| A new socket-patch config file (`.socket/config.toml`, …) | Duplicates socket-cli's persisted config; one more file format to trust, document, and migrate. |
-| Writing to socket-cli's `config.json` | No login flow here; shared mutable state and format drift for zero benefit. |
-| Honoring endpoints/credentials/interlock switches from repo-level files (manifest, socket.yml) | Same trust boundary as `.env`. Stated as a contract property in `CLI_CONTRACT.md`. Selection policy that only narrows is the one exception (section 4). |
-| A `version: 3` socket.yml for the `patches` block | socket-cli rejects any version but 2; older ajv parsers would treat 3 as 2 anyway. The block is additive under `version: 2`. |
-| Per-directory `socket.yml` files | No existing consumer supports them; one root file with `includePaths` covers monorepos. |
-| `SOCKET_CLI_CONFIG` (ephemeral full-JSON config override) | Imports socket-cli's whole config vocabulary as a permanent compat contract. |
-| Mapping `apiProxy` → anything | Forward-proxy vs patch-endpoint semantic trap; `HTTP_PROXY` et al. already work. |
-| `enforcedOrgs` / `skipAskToPersistDefaultOrg` | Interactive socket-cli UX policy with no socket-patch analog. |
-
-## Deferred (designated homes, no implementation yet)
-
-- **Project-level behavioral defaults** (`downloadMode`, `vendorSource`,
-  mode): not planned. The v3.5 idea of a manifest `setup.defaults` block is
-  obsolete in v5 (hosted and vendored projects have no manifest and `setup`
-  is removed). Selection policy (ecosystems, packages, paths, severity,
-  per-run cap) went to `socket.yml` `patches` instead (section 4). Anything
-  that is not pure narrowing stays out of repo files.
-- **Env cleanup sweep**: core's direct env readers (`SOCKET_OFFLINE` in
-  `utils/env_compat.rs`, `SOCKET_TELEMETRY_DISABLED` in `telemetry.rs`)
-  still match only `1|true`, unlike `parse_bool_flag`'s vocabulary (the CLI
-  mirrors `--offline` into `SOCKET_OFFLINE=1`, so only a hand-set env value
-  sees the narrower dialect); consider `FORCE_COLOR` as an alias for `CLICOLOR_FORCE` in
-  `ui::color_enabled` (which already honors `NO_COLOR`, `CLICOLOR`,
-  `CLICOLOR_FORCE` and `TERM=dumb`); document
-  `HTTP_PROXY`/`HTTPS_PROXY`/`NO_PROXY` support in the README.
-- **`SOCKET_API_TOKEN_FILE` / keychain sourcing** for the token — the
-  conventional next step for secret hygiene; not urgent now that the
-  config-file path exists.
-
-## Test strategy (how this stays true)
-
-- socket.yml policy: table-driven unit tests in
-  `socket-patch-core/src/policy/` (every validation row, the lookup and
-  file-access rules, and a golden fixture generated from the npm `ignore`
-  package by `scripts/gen-ignore-golden.mjs`), the parser contract in
-  `tests/cli_parse_scan.rs`, disk e2e in `tests/e2e_socket_yml_policy.rs`
-  and disk/memory parity in `tests/hosted_memory_parity.rs`.
-
-- `tests/cli_config_fallback.rs` spawns the binary against fixture
-  `config.json` files (fresh process per case — the disk read is cached per
-  process) and pins: config token/apiBaseUrl authenticate, `defaultOrg`
-  skips org auto-resolve with telemetry following the config host+token,
-  env-beats-config per key, alias honored with canonical winning, corrupt
-  config warns while `--json` stdout parses, both toggles, and the
-  missing-file silence.
-- Hermeticity: `.cargo/config.toml` `[env]` exports `SOCKET_NO_CONFIG=1` so
-  a developer's real login can never authenticate a test; the e2e env
-  scrub loops deliberately skip that variable so the guard survives into
-  spawned binaries.
diff --git a/docs/design/golang-hosted-no-go.md b/docs/design/golang-hosted-no-go.md
deleted file mode 100644
index 154f6d01..00000000
--- a/docs/design/golang-hosted-no-go.md
+++ /dev/null
@@ -1,115 +0,0 @@
-# Hosted redirect for Go: a deliberate no-go
-
-> **SUPERSEDED for the FREE tier (2026-08-13)** by
-> [golang-hosted.md](golang-hosted.md): a fork-style `replace` onto a
-> grant-free, content-addressed `patch.socket.dev/gopatch/<uuid>` module plus
-> committed `go.sum` lines dissolves all three blockers below — empirically,
-> go consults the checksum database only for modules *absent* from `go.sum`,
-> so committed hashes ARE the committable per-module exemption Blocker 1 said
-> Go lacked, and a token-free module path defuses Blockers 2 and 3. **The
-> analysis below still governs the PAID tier** (tokened URLs re-trigger
-> Blockers 2 and 3), whose remedy remains vendored mode or the
-> [ephemeral-CI recipe](#sanctioned-exception-ephemeral-ci-goproxy).
-
-**Status:** paid tier only — free-tier golang HOSTED mode is designed in
-[golang-hosted.md](golang-hosted.md).
-**Remedy:** `socket-patch vendor` (VENDORED mode: bytes committed to
-`.socket/vendor/`, offline-verified, `replace => ./path` in `go.mod`).
-**Warning code:** `redirect_golang_unsupported` (emitted for golang references
-that carry no `goproxy` override — paid grants, or free patches the server has
-not yet published a hosted Go module for — by both the Rust CLI rewriter and
-the depscan backend's TS twin,
-`workspaces/app/src/patches/registry-rewrite/golang.ts`).
-
-HOSTED mode's contract is a *committable, per-dependency* lockfile/registry
-edit: only the patched dependency resolves from `patch.socket.dev`, everything
-else resolves exactly where it did before, and install-time integrity
-verification stays intact. Go cannot meet that contract. The patch-server does
-serve a correct GOPROXY for the patched module
-(`/patch-registry/golang/...`) — the problem is not serving the bytes, it is
-that every way of *pointing* a Go build at them requires machine-local
-configuration or breaks Go's verification model. Three independent blockers,
-any one of which is disqualifying:
-
-## Blocker 1 — day-2 sumdb hard-fail, and the fix is uncommittable
-
-A patched module version (e.g. `v1.2.3-socketpatch.1`) does not exist in
-`sum.golang.org`. With the default `GOSUMDB=sum.golang.org`, any `go` command
-that resolves the patched version hard-fails checksum verification — not on
-the machine that ran the redirect (its `go.sum` could carry the patched
-hashes), but on **every other machine, day 2**: CI, a teammate's fresh clone,
-a Docker build. The only sanctioned escape is `GOPRIVATE`/`GONOSUMCHECK`-style
-configuration — which lives in the developer's environment or `go env -w`
-(machine-local), **not** in any committable project file. A redirect that
-requires every future builder to mutate their machine before `go build` works
-is not a redirect; it is an outage with extra steps. Committing
-`GOFLAGS`/`GONOSUMDB` via `go.work` or a wrapper script was rejected as a
-shim around the real boundary: Go simply has no committable per-module
-sumdb exemption.
-
-## Blocker 2 — module-path identity forces per-grant artifacts
-
-In Go, the module path **is** the identity: the `module` directive inside the
-served `.mod`/zip must byte-match the import path the consumer requests. Our
-hosted patch URLs are per-grant (`/{token}/{uuid}/`), and grants are
-per-organization. Serving `example.com/lib` from a grant-scoped GOPROXY path
-still works only while the module path inside the zip stays
-`example.com/lib` — but then the zip's `h1:` dirhash must ALSO match what the
-consumer's `go.sum` pins, which means the artifact must be built once and
-byte-frozen. The patch converter is deliberately **build-once**: one artifact
-per patch, shared by every grant (content-addressed, cache-friendly,
-attestable). A Go redirect that embedded grant/token material into the module
-zip (vanity import paths, rewritten module directives) would need one artifact
-*per grant*, which is incompatible with the build-once converter and would
-multiply storage and attestation surface by the number of customers. Rejected.
-
-## Blocker 3 — default GOPROXY publishes licensed bytes and leaks tokened URLs
-
-`GOPROXY` defaults to `proxy.golang.org,direct`. The moment any machine
-without our override fetches the patched pseudo-version by name, the request
-goes to **Google's public mirror**, which will try to fetch and then *cache
-publicly forever* whatever it can reach. Two failure shapes:
-
-- If the patched module were reachable without auth, the public mirror would
-  republish licensed patch bytes to the world — a direct license violation.
-- Because it is NOT reachable without auth, the fetch fails — but the
-  tokened URL (`/{token}/{uuid}/...`) has now been shipped to a third party's
-  logs, burning a capability URL we treat as a bearer secret.
-
-Either way, the default-GOPROXY world is hostile to a hosted Go patch: we
-cannot control which resolver a downstream machine asks first, and both
-possible outcomes (public caching, token leakage) are unacceptable.
-
-## Sanctioned exception: ephemeral-CI GOPROXY
-
-The one place machine-local configuration is acceptable is a **single-use,
-ephemeral CI job**, where "the machine" is created and destroyed around one
-build and no day-2 clone exists. Teams that cannot vendor may opt in,
-explicitly and per-job:
-
-```yaml
-# CI job (ephemeral runner) — NOT for developer machines or committed config.
-env:
-  # Patched module resolves from Socket first, everything else falls through.
-  GOPROXY: "https://patch.socket.dev/patch-registry/golang/${SOCKET_PATCH_TOKEN}/${PATCH_UUID},https://proxy.golang.org,direct"
-  # The patched pseudo-version is not in sum.golang.org — exempt ONLY the
-  # patched module from sumdb lookups; all other modules stay verified.
-  GOPRIVATE: "example.com/patched-module"
-steps:
-  - run: go mod download example.com/patched-module
-  - run: go build ./...
-```
-
-The token enters through the CI secret store, never a committed file; the
-runner is discarded so no drifted `go env` survives; and `GOPRIVATE` is scoped
-to the single patched module so sumdb verification stays on for the rest of
-the graph. This recipe is documentation-only — neither `scan --mode hosted` nor
-the backend PR flow will ever write it into a repository.
-
-## Decision
-
-`scan --mode hosted` (and the backend hosted PR flow) emit
-`redirect_golang_unsupported` naming the remedy — run `socket-patch vendor`
-(committable, offline-verified) — and the golang dependency is otherwise left
-untouched. Vendored mode already gives Go users everything hosted mode
-promises elsewhere: per-dependency, committable, verifiable at install time.
diff --git a/docs/design/golang-hosted.md b/docs/design/golang-hosted.md
deleted file mode 100644
index ad8a55fa..00000000
--- a/docs/design/golang-hosted.md
+++ /dev/null
@@ -1,211 +0,0 @@
-# Hosted redirect for Go: the fork-replace design (free tier)
-
-**Status:** implemented CLI-side (rewriter, golden fixture, day-2 e2e); waiting
-on server-side publication (see [Server requirements](#server-requirements-depscan)).
-**Supersedes:** [golang-hosted-no-go.md](golang-hosted-no-go.md) for the FREE
-tier. The paid-tier analysis there (blockers 2 and 3 against tokened URLs)
-still stands; paid golang references must not carry a `goproxy` override.
-
-## The shape
-
-`scan --mode hosted` commits exactly two files' worth of edits — no artifact
-bytes, no machine-local configuration:
-
-```text
-# go.mod
-replace github.com/foo/bar v1.4.2 => patch.socket.dev/gopatch/<patch-uuid> v1.4.2-socketpatch.1
-
-# go.sum
-patch.socket.dev/gopatch/<patch-uuid> v1.4.2-socketpatch.1 h1:…          (module-zip dirhash)
-patch.socket.dev/gopatch/<patch-uuid> v1.4.2-socketpatch.1/go.mod h1:…   (served .mod bytes)
-```
-
-The patched module is published — grant-free and content-addressed, one
-build-once artifact per patch — at a Socket-owned module path under
-`patch.socket.dev/gopatch/`, served over the standard GOPROXY protocol. The
-`replace` is Go's native fork mechanism; the committed `go.sum` lines are the
-integrity pin. The rewriter also prunes the replaced original's two `go.sum`
-lines: with the pinned replace in force, go removes the original from the
-module graph entirely, and writing the tidy-stable state up front keeps the
-first day-2 `go mod tidy` a byte-level no-op.
-
-## Why this dissolves the no-go doc's blockers (free tier)
-
-Every claim below was validated empirically against go 1.26 before the feature
-was built (file-`GOPROXY` fixtures, fresh per-"machine" caches; the capstone
-lives in `crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs`).
-
-**Blocker 1 — day-2 sumdb hard-fail.** The no-go analysis assumed every fresh
-machine re-consults `sum.golang.org` for the patched version. In fact go
-consults the checksum database **only for modules absent from `go.sum`**.
-Proven with a tripwire: every day-2 command run with `GOSUMDB` set to a bogus
-database name (which fails loudly the moment it is consulted) — `go build`,
-`go run`, `go test`, `go vet`, `go mod download`, `go mod verify`,
-`go mod tidy` all succeed on an empty cache with only the committed
-`go.mod` + `go.sum`, and zero `/sumdb/` requests appear in proxy logs. The
-control (deleting one go.sum line) fails with `invalid GOSUMDB`, proving the
-tripwire works. Committed `go.sum` lines ARE the committable per-module sumdb
-exemption the old doc said Go didn't have.
-
-**Blocker 2 — module-path identity forces per-grant artifacts.** Only true if
-grant material rides in the module path. The socket module path is
-content-addressed by patch uuid and carries no token: one frozen artifact per
-patch, shared by every consumer — build-once compatible. The zip's entry
-prefix must be the socket path (`gopatch/<uuid>@<version>/`, go rejects any
-other prefix), but its **internal `go.mod` may keep declaring the ORIGINAL
-module path** — go accepts a replacement declaring either side of the arrow —
-and patched sources MUST keep their original import spellings (rewriting them
-to the socket path fails with `used for two different module paths`). So the
-artifact is the upstream module with patched files, rezipped under a new
-prefix: a zero-source-rewrite converter.
-
-**Blocker 3 — default GOPROXY publishes licensed bytes / leaks tokens.** For
-the free tier, both horns are blunt: free patches are already anonymously
-fetchable (production mints free-tier grants with no auth today), so
-`proxy.golang.org` caching the module is republication of something already
-public — and there is no token to leak because the path is grant-free. Google's
-mirror caching the bytes is a robustness *win*: after first fetch, day-2
-builds succeed even if `patch.socket.dev` is down. (Also measured: with the
-pinned replace in force, go never fetches or verifies the ORIGINAL module at
-all — the patched graph builds even if the upstream registry is down.)
-
-## Day-2 contract (all validated)
-
-- Fresh clone/CI with committed `go.mod` + `go.sum`, empty caches, default
-  `-mod=readonly`, no `GOPRIVATE`/`GONOSUMDB`/`GOFLAGS`: builds and links the
-  patched code.
-- `go.sum` verification keeps its teeth: one flipped character in the
-  committed `h1:` fails the build with go's checksum `SECURITY ERROR` — a
-  wrong CLI-written hash can never be silently built. (This is also why the
-  rewriter fails closed unless BOTH hashes are present: a replace committed
-  without its go.sum lines bricks every downstream `-mod=readonly` build.)
-- `go mod tidy` is a byte-level no-op on the rewriter's output.
-- `go mod vendor` vendors the PATCHED bytes under the upstream import path
-  (`vendor/modules.txt` records the replace) and `-mod=vendor` builds stay
-  patched — the vendored escape hatch composes.
-- Proxy fetch sequence for the pinned module is exactly `.zip`, `.mod`,
-  `.info` (`.info` is required even for a fully pinned build; `/@v/list` and
-  `/@latest` are never requested on the pinned path).
-- Module zips' `h1:` dirhash is content-derived (entry names + contents;
-  compression, mtimes, ordering, modes are ignored) — but the `/go.mod h1:`
-  hashes the SERVED `.mod` bytes, and go does NOT cross-check them against the
-  zip's internal `go.mod`. Server contract: freeze the two together.
-
-## Known limitations (documented, not blockers)
-
-- **Upgrade drift** (shared with local/vendored modes): `replace` is keyed on
-  module+version. `go get -u` / a require bump silently strands the pin — the
-  build reverts to the vulnerable version with zero warning while the inert
-  replace line stays in `go.mod`, and the next tidy strips the patch's go.sum
-  lines. Reliable text-only drift signals for a future `--check`: replace LHS
-  version ≠ require version; socket replace present with no matching go.sum
-  line. The rewriter refuses up front when `require` already disagrees with
-  the patch version (`redirect_golang_version_mismatch`).
-- **Corporate proxies**: a `GOPROXY` pinned to an internal mirror (Artifactory
-  etc.) that cannot reach `patch.socket.dev` will 404 the socket module unless
-  the mirror passes through. Comma-fallback semantics also mean a proxy that
-  answers 403/500 (rather than 404/410) blocks the fetch.
-- **Pre-modules packages**: modules without a `go.mod` are rejected by the
-  build pipeline (`UNSUPPORTED_ARCHIVE_FORMAT`) — same limit as vendored mode.
-- **v2+ originals**: the socket module is always published in the v0/v1
-  version range (a v2+ RHS version would force a `/v2` path suffix); the RHS
-  version need not relate to the original's. Not yet exercised against a real
-  `/v2` module — verify when the first such patch ships.
-- **Paid tier**: unchanged no-go. Tokened URLs re-trigger blockers 2 and 3;
-  the ephemeral-CI `GOPROXY` recipe in the old doc remains the documented
-  paid workaround.
-
-## CLI implementation
-
-- `patch/redirect/mod.rs rewrite_golang` — pure rewriter, activates per-dep on
-  `registry_override.kind == "goproxy"`; absent override falls back to the
-  historical `redirect_golang_unsupported` warning. Fails closed (warning, no
-  partial writes) on: missing `go.mod`, missing/malformed `goModulePath` /
-  `goModuleVersion`, module path outside `patch.socket.dev/gopatch/`, missing
-  either integrity hash, require-version mismatch, user-authored replace
-  conflict. Warning codes: `redirect_golang_no_go_mod`,
-  `redirect_golang_missing_module`, `redirect_golang_untrusted_module_path`,
-  `redirect_golang_missing_integrity`, `redirect_golang_version_mismatch`,
-  `redirect_golang_replace_conflict`.
-- `vendor/go_mod_edit.rs` — `ReplaceOwner::Hosted` (ownership = RHS module
-  path under `HOSTED_GO_MODULE_PREFIX`; go.mod and go.sum carry no other
-  marker), module-target parse (`rhs_module`/`rhs_version`) and
-  `upsert_hosted_replace_entry`, with in-place cross-owner takeover between
-  local `.socket/go-patches/`, vendored, and hosted directives.
-- `vendor/go_sum_edit.rs` — pure go.sum editing: sorted upsert of the socket
-  module's two lines, prune of the replaced original's lines (removed lines
-  ride in the ledger `original` for revert), prefix-keyed removal.
-- `scan/hosted.rs` — `go.mod`/`go.sum` added to `REDIRECT_CANDIDATE_FILES`;
-  the redirected-confirmation matcher additionally accepts the socket module
-  path (a Go rewrite contains no artifact/index URL).
-- Wire schema — `Integrity.goModH1` (new) alongside `dirhashH1`;
-  `RegistryOverrideIdentifiers.goModuleVersion` (new) alongside the
-  previously-reserved `goModulePath`.
-- Cross-mode policy (adversarially reviewed): takeover into hosted (from a
-  local `.socket/go-patches/` or vendored replace) and vendor-takes-over-hosted
-  are supported, in-place, and ledger-recorded with the replaced directive in
-  `original`; **local apply refuses** a Hosted-owned replace (taking it over
-  would strand the pruned go.sum lines) and `apply --check` exempts
-  hosted-owned modules from MissingReplace drift. A committed pin whose
-  version `require` no longer selects is reconciled away (directive + go.sum
-  lines removed) rather than left to confirm a redirect it no longer performs.
-  `vendor --revert` after a hosted takeover warns to re-run
-  `scan --mode hosted` or `go mod tidy`.
-- Tests — unit suite in `redirect/mod.rs`; golden fixture
-  `tests/fixtures/redirect/golang/gomod/basic/` (the cross-language contract
-  the depscan TS twin must match byte-identically); capstone
-  `e2e_golang_hosted_build.rs` (real go, file proxy, bogus-GOSUMDB tripwire,
-  tidy no-op, tamper SECURITY ERROR).
-
-## Server requirements (depscan)
-
-What already exists (verified in code + live prod probes, 2026-08-13):
-
-- The GOPROXY protocol implementation (`patch-serving/registry-decision.ts`
-  `golangDecision`: `/@v/list`, `.info`, `.mod`, `.zip`, `/@latest`) — deployed
-  and executing in prod, but token-gated
-  (`/patch-registry/golang/{token}/{uuid}/…`) and serving the ORIGINAL module
-  path + version.
-- A byte-deterministic golang repack (STORE-only zips, epoch mtimes, sorted
-  names; e2e-pinned to reproduce `sum.golang.org`'s h1 for unpatched input).
-- `hashGoZip` (persisted as `package_dirhash_h1`) and `hashGoMod` (exists in
-  `lib/src/go/sum.ts` but never persisted or exposed).
-- Anonymous free-tier grant minting via `POST /patch/package`.
-
-What the free-tier Go redirect needs:
-
-1. **A second artifact flavor per golang patch**: same patched contents,
-   zip entries prefixed `patch.socket.dev/gopatch/<uuid>@<version>/`
-   (internal `go.mod` unchanged — keep declaring the original path). Because
-   h1 covers entry names, this flavor has its OWN dirhash: persist both its
-   zip h1 and its `/go.mod` h1 (`hashGoMod` of the served `.mod` bytes).
-2. **A token-free route family** serving that flavor over the GOPROXY
-   protocol at a stable public path for module `patch.socket.dev/gopatch/<uuid>`,
-   free-tier patches only. Strictly 404/410 anything else (including bare
-   parent-prefix `/@v/list` probes go issues during tidy) so comma-fallback
-   proxies fall through. `.info` needs no `Time` field.
-3. **`?go-get=1` discovery**: serve
-   `<meta name="go-import" content="patch.socket.dev/gopatch/<uuid> mod <proxy-base-url>">`
-   at the module path on `patch.socket.dev`, so `GOPROXY=direct` users and
-   `proxy.golang.org` itself can resolve it (validated end-to-end with the
-   `mod` VCS type; `sum.golang.org`'s own lookup does the same discovery).
-4. **Reference API**: populate `registryOverride.kind = "goproxy"`,
-   `indexUrl` = the proxy base (the server origin), and on `identifiers`:
-   `goModulePath` / `goModuleVersion` (`<version>-socketpatch.<n>`, always
-   v0/v1-range) plus the hash pair `goZipDirhashH1` (the gopatch-flavor
-   zip h1) and `goModH1`. The pair rides **identifiers**, not the tarball
-   artifact's integrity — the tarball `dirhashH1` must stay the
-   original-path flavor, which released CLIs verify vendor-mode downloads
-   against. DepOverride builders (this CLI's `scan/hosted.rs` and the
-   backend's hosted PR flow) merge the pair into the normalized
-   `integrity.dirhashH1`/`goModH1` that the rewriters read. FREE patches
-   only — never emit a `goproxy` override for a paid-tier grant.
-5. **Write-once invariant (the kill-shot risk)**: once a
-   `gopatch/<uuid>@<version>` is fetchable, `proxy.golang.org` caches its
-   bytes immutably and consumers commit its hashes. Any rebuild that changes
-   bytes MUST bump `-socketpatch.<n>`; the existing admin
-   "regenerate to populate" rebuild practice must be forbidden for published
-   gopatch versions.
-6. **TS twin**: replace `registry-rewrite/golang.ts`'s unconditional warning
-   with the byte-identical twin of the Rust rewriter, pinned by the shared
-   `golang/gomod` golden fixture.
diff --git a/docs/design/nuget-vendoring-research/adversarial-env.md b/docs/design/nuget-vendoring-research/adversarial-env.md
deleted file mode 100644
index 20b9e347..00000000
--- a/docs/design/nuget-vendoring-research/adversarial-env.md
+++ /dev/null
@@ -1,162 +0,0 @@
-# Adversarial review: NuGet vendoring v2 (unique-version fallback seed) on real environments and CI
-
-I found one blocker and seven majors. The blocker is that git line-ending normalization breaks the committed seed. On a fresh CI clone the build fails with SOCKETPATCH002, while it still passes on the author's machine. The design's core behaviour survived the attacks I ran: the redirects, SOCKETPATCH005, the Docker-style bypass and symlinked checkouts all behaved as designed.
-
-**How I tested.** SDK 8.0.131 with HOME, NUGET_PACKAGES, NUGET_HTTP_CACHE_PATH, TMPDIR and DOTNET_CLI_HOME isolated under `scratchpad/adv-env/`, one dotnet process at a time. I built a Lib/App sln fixture with locks. `adv-env/r1/.socket/vendor/nuget/socket-patch.targets` is the §6.3 targets file rendered almost exactly (seed-presence check, direct redirect and the full guard). I added only two `Message` lines for diagnostics. The seed is the design-D 13.0.1 seed under a uuid root. Clones of the fixture are in `adv-env/c1`, `c2` and `c3`. Git experiments are in `adv-env/git1`.
-
-Labels: **VERIFIED** means I ran it here. **REASONED** means I did not run it.
-
----
-
-## BLOCKER
-
-### B1. Git EOL normalization changes seed bytes, so every fresh clone fails SOCKETPATCH002 (VERIFIED)
-- **Scenario.**
-  - The repo has `* text=auto` in `.gitattributes`. That is the Visual Studio template default and is common in .NET repos.
-  - Newtonsoft's nuspec, `LICENSE.md` and `lib/*/Newtonsoft.Json.xml` are CRLF. I checked: 38/38, 20/20 and 11305/11305 lines are CRLF.
-  - Git stores them as LF in the index. The author's working tree stays CRLF and `git status` is clean, so every local build passes.
-- **Wrong outcome.**
-  - On a fresh CI clone the files check out as LF. The inventory check then fails:
-    - `error SOCKETPATCH002: seed modified: …/13.0.1.1843260417/LICENSE.md`
-  - VERIFIED in `adv-env/c1`, built after `git clone`.
-  - The same class of failure also occurs with:
-    - `core.autocrlf=true` (the Git for Windows installer default): LF text files become CRLF on checkout. VERIFIED: a committed LF `x.json` came back `\r\n` in the autocrlf clone.
-    - `core.autocrlf=input` on the author's machine.
-    - `*.xml text eol=crlf` rules.
-    - A root LFS rule such as `*.dll filter=lfs`. With `actions/checkout`'s default `lfs: false`, CI gets pointer files and fails SOCKETPATCH002. That failure is loud, but it is a surprise.
-- **Fix.**
-  - The CLI writes `.socket/vendor/nuget/.gitattributes` **before** the user's first `git add`:
-    ```
-    /*-*-*-*-*/** -text -filter -diff -merge
-    socket-patch.targets text eol=lf
-    .gitignore text eol=lf
-    ```
-  - VERIFIED: `git check-attr` shows text, filter and eol all unset under a hostile root file (`* text=auto`, `*.dll filter=lfs`, `*.xml text eol=crlf`). An autocrlf=true clone then passes the hash check, and `dotnet build` succeeds (`adv-env/c2`).
-  - Blobs committed before the attribute existed stay normalized. I had to `git rm --cached` and re-add them.
-  - So `vendor --check` must compare the inventory against the committed blobs (`git cat-file` of `HEAD:<path>`), not the working tree. It should also check `git ls-files --eol` and refuse or fix with `vendor_nuget_eol_normalized`. Otherwise the author's green local run hides the CI failure.
-  - Add a golden-image e2e leg: commit, then `git clone`, then build. Run it with both `text=auto` and `autocrlf=true`.
-
----
-
-## MAJOR
-
-### M1. The same V′ in the GPF (same bytes) fails SOCKETPATCH003 and prints destructive advice (VERIFIED)
-- **Scenario.** A shared machine or self-hosted runner with a shared `~/.nuget/packages`, where one repo uses the feed tier (§10) or, later, hosted V′ (§11.2) for the same patch. Those tiers extract `<idl>/<V′>/` into the GPF, and the GPF beats fallback folders at asset resolution.
-- **Wrong outcome.**
-  - The fallback-tier repo resolves the GPF copy and fails:
-    - `error SOCKETPATCH003: foreign …/gpf/newtonsoft.json/13.0.1.1843260417/lib/netstandard2.0/Newtonsoft.Json.dll`
-  - This happens even with byte-identical files. VERIFIED in `adv-env/c2`: I copied the seed into the GPF, `restore --locked-mode` succeeded, and the build failed.
-  - The error text says "Delete that package folder". Doing that breaks the other repo, which re-extracts the package, and the two repos keep undoing each other.
-  - This contradicts the design's own rule that one V′ is always one byte sequence (§6.1).
-- **Fix.**
-  - Key `SocketPatchNuGetHashes` by `<idl>/<V′>/<relpath>`, not by `<uuid>/…`. Hash the consumed files wherever they resolved.
-  - Accept files from a foreign root when all of them match the inventory. Fail SOCKETPATCH003 only when they differ. This is also the feed-tier guard, so the two tiers share one code path.
-  - Alternatively, add a tier bit to V′ so fallback V′ never appears in any feed. That costs a bit of the 29-bit uuid space.
-
-### M2. The guard runs in design-time builds, contrary to §9 and G9 (VERIFIED)
-- **Scenario.** VS, Rider or C# Dev Kit run a design-time build (`ResolveAssemblyReferencesDesignTime`, `DesignTimeBuild=true`).
-- **Wrong outcome.**
-  - `ResolvePackageAssets` runs, so the `AfterTargets` guard runs too. VERIFIED: `SPGUARD-RAN DesignTimeBuild='true'`.
-  - Any SOCKETPATCH001/002/003/005 condition, such as a stale restore right after `git pull`, fails the design-time build. IntelliSense then shows "project load" errors and references go unresolved on every edit.
-  - §9 states "The guard runs only in real builds", which is incorrect.
-- **Fix.** Add `and '$(DesignTimeBuild)' != 'true'` to the guard condition. Optionally, emit SOCKETPATCH005/003 as warnings when `$(BuildingInsideVisualStudio)` is true and keep the errors for the command line. Fix the §9 text.
-
-### M3. Windows paths are about 80 characters deeper than the GPF (REASONED, lengths computed)
-- **Scenario.** The seed sits at `.socket\vendor\nuget\<36-char uuid>\<idlower>\<V′ with a 10-digit part>\…`.
-  - Under the GitHub Actions workspace, `D:\a\my-service-repo\my-service-repo\` plus the Microsoft.Extensions.DependencyInjection.Abstractions `lib/netstandard2.1/*.xml` gives **242** characters.
-  - The repo-relative part is only 205, so the §9 warning ("seed path > 240") never fires.
-  - `runtimes/<rid>/native/…` and satellite paths are deeper still.
-- **Wrong outcome.**
-  - Git for Windows (`core.longpaths` is false by default) fails checkout with "Filename too long".
-  - MSBuild.exe on .NET Framework and some tools hit MAX_PATH. The same package works fine from `%USERPROFILE%\.nuget\packages`.
-- **Fix.**
-  - Use a uuid8 directory name (with collision refusal).
-  - Compute the warning on an **absolute** path under a pessimistic prefix: 60 characters for CI, or the real root.
-  - Refuse above 250 unless `--allow-long-paths`.
-  - Document `git config core.longpaths true`.
-  - Add the Windows leg to the prototype acceptance criteria, not only to promotion.
-
-### M4. EOL-sensitive byte comparisons in the hot path, `--check` and revert break on Windows and on mixed teams (REASONED; the conversion is VERIFIED in B1)
-- **Scenario.** `fallback_in_sync` and `--check` require the targets file and `.gitignore` to be byte-equal to a fresh render. Lock and import records compare the live text with the recorded `new` or `original`.
-  - With autocrlf=true, a Windows checkout turns LF-committed files into CRLF (VERIFIED for `.json`).
-- **Wrong outcome.**
-  - `vendor --check` fails on every Windows CI job.
-  - The hot path re-renders on every run.
-  - Lock and import revert on Windows treats every record as drift. It keeps the seed, and the revert is not clean.
-- **Fix.**
-  - Pin `eol=lf` on the generated files via B1's `.gitattributes`.
-  - For user-tree files (locks, `Directory.Build.targets`), compare after normalizing CRLF to LF. Splice using the live file's detected EOL.
-  - Store records as EOL-neutral text plus the observed EOL.
-
-### M5. Mixed packages.config and SDK repos are left undefined (REASONED)
-- **Scenario.** An enterprise solution has old packages.config web apps and new SDK libraries that use the same id@V. This is very common.
-- **Wrong outcome.**
-  - §5 and §7.1 route packages.config to legacy and allow one tier per repo. `vendor_nuget_layout_mixed` refuses a same-id legacy entry.
-  - So either the whole patch is refused, or the legacy path runs. The legacy path brings back the nuget.config catch-all mapping and same-version GPF poisoning for the whole machine, which is exactly what v2 set out to remove.
-  - The design never says which of the two happens.
-- **Fix.**
-  - Define a single entry with two wiring sets: the legacy feed for packages.config projects only, and the fallback tier for SDK projects.
-  - Alternatively, refuse explicitly with `vendor_nuget_mixed_project_styles` and describe the options.
-  - Either way, add a docker leg that uses nuget.exe under mono (for example the `mono` image), since no packages.config coverage exists today.
-
-### M6. `vendor --check` and the hot path depend on restore outputs (REASONED)
-- **Scenario.** A typical CI job runs `git clean -fdx` (or starts from a fresh checkout), then `socket-patch vendor --check`, then `dotnet restore`.
-- **Wrong outcome.**
-  - Lockless projects have no `obj/project.assets.json`.
-  - `plan_closure` then refuses with `vendor_nuget_unrestored`, or reports `closure_changed`, so the pre-restore check fails for no real reason.
-- **Fix.**
-  - Persist the closure in state and make `--check` validate against it.
-  - Recompute the closure only when assets are present.
-  - Add a fallback that plans from `dotnet msbuild -getItem:PackageReference` without a restore.
-
-### M7. Renovate and Dependabot rewrite or misread the generated targets file (REASONED)
-- **Renovate.** Renovate's nuget manager matches `\.(props|targets)$` and parses `PackageReference Update=… Version=`. It can propose `[13.0.1.N]` → `[13.0.3]` in `socket-patch.targets`.
-  - Renovate's default `ignorePaths` (`**/vendor/**`, dot-matching) probably covers `.socket/vendor/nuget/`.
-  - But any repo that sets `ignorePaths` replaces that default and is then exposed.
-- **Dependabot.** Dependabot's native (MSBuild-evaluating) updater sees the evaluated version V′ and may try to edit the file where it is declared, or skip the dependency.
-- **Wrong outcome.**
-  - The redirect silently pins some other version.
-  - `SocketPatchNuGetUpstream` only knows 13.0.1, so SOCKETPATCH005 does not fire.
-  - The patch drops out, and only the lock diff and a later `--check` show it.
-- **Fix.**
-  - Put the versions in properties (`Version="$(_SpV_3f9a01bc)"`) so regex tools see no literal.
-  - Add a render-hash self-check: a `SocketPatchTargetsHash` property that the CLI verifies, plus a SOCKETPATCH006 build warning when the file was edited.
-  - Have `vendor` print or emit `ignorePaths: [".socket/**"]` for Renovate.
-  - Add a Q3 experiment with the Dependabot nuget updater container.
-
----
-
-## MINOR
-
-| # | Scenario | Outcome | Fix |
-|---|---|---|---|
-| m1 | Sparse checkout in cone mode on monorepos: root files are included, root directories are not. | `.socket/` is absent and every build fails MSB4019. VERIFIED (`adv-env/c3`). Loud, but a friction failure mode for every sparse user. | Emit a comment above the Import that names `git sparse-checkout add .socket/vendor/nuget`. `vendor` prints it. Document it for Scalar users. |
-| m2 | Declared literal `[13.0.1]` or `13.0.1.0` in a new project. | The redirect does not engage and SOCKETPATCH005 fires. VERIFIED for both. The failure is loud, but CLI planning treats it as "literal known". | Emit one redirect condition per observed normalized-equal literal (`13.0.1`, `13.0.1.0`, `[13.0.1]`, `[13.0.1, )`). |
-| m3 | Docker `COPY *.csproj` → `restore` without DBT or `.socket` → `COPY . .` → `build --no-restore`. | SOCKETPATCH005, so fail-closed as designed. VERIFIED. Every Dockerfile needs `COPY Directory.Build.targets .socket/vendor/nuget`, and the layer cache is invalidated per patch. | Document it. `vendor` scans for `Dockerfile*` with `dotnet restore` and warns `vendor_nuget_dockerfile_copy`. |
-| m4 | `git clean -fdx` after `vendor` but before commit. | The untracked seed and targets are deleted. The tracked DBT edit stays, giving MSB4019. | Print "commit `.socket/vendor/nuget`" in the outcome. `--check` detects untracked seeds. |
-| m5 | Seeds for big packages (native runtimes, analyzers, satellites). | GitHub hard-limits files to 100 MB and warns at 50 MB. The whole package goes into history once per uuid, and org pre-receive hooks may demand LFS. | Cap file and seed size with `vendor_nuget_seed_too_large`. Record a per-repo LFS opt-in only with `checkout lfs:true` documented. Future G-experiment: prune the seed to the closure's TFMs and RIDs (contentHash comes only from `.nupkg.metadata`). |
-| m6 | Seed entries that differ only by case, on macOS or Windows. | Checkout collision and SOCKETPATCH002. | Refuse at vendor time on a case-folded inventory collision. |
-| m7 | Seed missing, VS restore (no SOCKETPATCH001 there), lockless, and a source that serves V′. V′ is predictable from the committed uuid. | An attacker's `build/*.targets` imports at evaluation, before any guard. This needs control of the id on a source (private or virtual feeds, unreserved ids). | The server-side collision check must cover the org's configured upstreams, not just nuget.org. Refuse the fallback tier for ids that are not prefix-reserved on multi-upstream feeds, or make redirects depend on `Exists(seed)` combined with a hard evaluation error. |
-| m8 | GitHub dependency graph, Trivy and CycloneDX read `packages.lock.json`. | They see `12.0.1.N`, so alerts persist and Dependabot security PRs bump the version and drop the patch. Tools that fetch nuspec metadata from nuget.org for V′ fail. | depscan SBOM mapping (already a GA blocker). Document the alert behaviour. Consider emitting Dependabot `ignore` entries. |
-| m9 | actions/setup-dotnet `cache: true` keys on the hash of the lock files. | One cache miss per vendor or revert. Also, `NUGET_PACKAGES=${{github.workspace}}/.nuget/packages` puts the GPF inside the repo, and `discover_projects` does not skip `.nuget/` (template packages contain `*.csproj`). | Skip every dot-directory and any directory that is a configured package folder during discovery. |
-| m10 | Concurrent restores or builds. | No writes to seed roots, so this is safe (REASONED). The pack hook writes `obj/socket-patch-pack/`, per project. | None needed. Add one parallel `-m` sln leg to the docker suite. |
-
----
-
-## Attacks that failed (the design holds)
-- **Symlinked checkout path.** The resolved paths and `SocketPatchNuGetDir` stay consistent, so the guard passes. VERIFIED.
-- **Guard cost.** 52 ms per project for the full 8.7 MB Newtonsoft seed, with `GetFileHash` at 10 ms. Stamp-free hashing is affordable. VERIFIED.
-- **Guard targets as written.** They parse and work on SDK 8: the unquoted `StartsWith($(...))`, the `Substring` key and the `%(SpKey)` batching. That is partial G1 evidence, one root only. VERIFIED.
-- **Direct redirect, auto-follow and locked-mode restore from the fallback root with a warm upstream 13.0.1 in the GPF.** VERIFIED.
-- **Accepted from earlier research, not re-run here:** `NUGET_PACKAGES`, `--packages`, `RestorePackagesPath`, `locals all --clear` and offline for the patched package (VERIFIED-D and VERIFIED-C).
-
-## Required design changes, in priority order
-1. Write the nested `.gitattributes` from B1, and have `--check` compare against committed blobs.
-2. Make the hash guard location-independent, as in M1.
-3. Skip the guard in design-time builds.
-4. Use a uuid8 directory and compute the MAX_PATH check on absolute paths.
-5. Compare EOL-neutrally in the hot path, `--check` and revert.
-6. Define the mixed packages.config policy.
-7. Make `--check` work before any restore.
-8. Stop exposing literal versions in the targets file, and add a render-hash check.
-9. Add real-clone e2e legs (`text=auto`, `autocrlf=true`, sparse, Windows) to the **prototype** acceptance criteria.
\ No newline at end of file
diff --git a/docs/design/nuget-vendoring-research/adversarial-integrity.md b/docs/design/nuget-vendoring-research/adversarial-integrity.md
deleted file mode 100644
index 24678743..00000000
--- a/docs/design/nuget-vendoring-research/adversarial-integrity.md
+++ /dev/null
@@ -1,192 +0,0 @@
-# Adversarial integrity review: NuGet vendoring v2 (unique-version fallback seed)
-
-**Verdict: not ready.** The design's integrity story has one gap that decides everything else. Nothing pins the set of files in the committed seed, and every check (lock `contentHash`, the `SOCKETPATCH002` tables, `.nupkg.metadata`, `state.json` `fileInventory`) points back at other files in the same repo. I proved these gaps with dotnet runs:
-- a tampered seed, or one with files added, passes `--locked-mode`;
-- files added to the seed run as MSBuild code before the guard runs, and can switch the guard off;
-- an environment variable switches the guard off;
-- a nested `Directory.Build.targets` added later silently builds upstream;
-- git's `* text=auto` rewrites seed bytes, so `SOCKETPATCH002` fails on every clean clone.
-
-Most fixes are cheap.
-
-**Setup.** .NET SDK 8.0.131. HOME, NUGET_PACKAGES, NUGET_HTTP_CACHE_PATH, TMPDIR and DOTNET_CLI_HOME were isolated under `<scratch>/adv-integrity/` (`env.sh`). The package feed was an offline local folder holding upstream Newtonsoft.Json 13.0.1. The seed was the design-D e1 seed `13.0.1.1843260417`, placed at `.socket/vendor/nuget/u1/`. The fixture repo is `adv-integrity/base`. It uses the design's §6.3 guard logic (redirect, `SOCKETPATCH005`/`003`/`002`, and the `SocketPatchSeedFile` hash check) almost unchanged. The other experiments ran in `x0` to `x5`.
-
-Labels: **VERIFIED** means I ran it here. **REASONED** means it follows from verified facts or from the code but I did not run it. **DOCS** means it comes from documentation only.
-
----
-
-## Blockers
-
-### B1. The seed's file set is not pinned. Added files are consumed, run before the guard, and can turn it off. The lock pins nothing.
-- **Scenario.** A PR, a bad merge, or a compromised dependency bot changes a seed dll. It also adds `build/netstandard2.0/Newtonsoft.Json.props` and `.targets`, which are not in the nuspec, not in `fileInventory`, and not in `SocketPatchSeedFile`.
-- **Result (VERIFIED, `x1`).**
-  - On a fresh clone, `dotnet restore --locked-mode` succeeds with the tampered dll. The lock `contentHash` is compared only with `.nupkg.metadata`, and that file sits in the seed and was not changed.
-  - NuGet enumerates the seed directory, so the added `build/` files go into `project.assets.json` and are imported: the props through `nuget.g.props`, the targets through `nuget.g.targets`.
-  - The props set `SocketPatchNuGetGuard=false`. `dotnet build` then prints `EVIL: injected seed build/ code executed` and `Build succeeded`. No `SOCKETPATCH002` is raised, even though the dll was changed.
-- **What this means.**
-  - In the fallback tier the lock gives version identity only, not integrity. The claim in §2.5/§4 that the patched package is integrity-pinned is overstated.
-  - The design's inventory check hashes only the files it lists, never "these files and no others". It also runs only when `_SpLocal != ''`.
-  - A single added file in a large, binary-heavy seed diff is easy for a reviewer to miss.
-- **Severity: blocker.**
-- **Fixes (all needed):**
-  1. **Set-equality check at restore time.** Add a target at `BeforeTargets="_GenerateRestoreGraph;CollectPackageReferences"` that globs `$(SocketPatchNuGetDir)<uuid>/**` (including dotfiles) and fails if the glob differs from the inventory or any hash differs. Restore runs in its own evaluation before `nuget.g.*` is regenerated, so on a clean CI checkout the check runs before the planted code is imported. Run it unconditionally, not gated on `_SpLocal`.
-  2. **The CLI checks set equality too.** `fallback_in_sync`, `verify.rs` and `vendor --check` should walk the directory, reject any extra file, symlink or non-regular file, and compare against `fileInventory`.
-  3. **Anchor the seed outside the repo.** Add `vendor --check --online`, which rebuilds the expected tree from an independent source and diffs the committed seed against it byte for byte. The source is either the SRI-checked service `nupkg-socket-version`, or the upstream nupkg (with its signature or depscan `upstreamSha512` checked) plus the patch afterHashes. Recommend it as the CI gate. Without it, every pin is self-referential (see M6).
-  4. **Harden the guard property.** Covered in M1.
-
-### B2. Git line-ending normalisation changes seed bytes, so SOCKETPATCH002 fails on clean clones.
-- **Scenario.** The repo has `* text=auto` in `.gitattributes`, as the common VisualStudio template does, or a developer uses `core.autocrlf=true`, the Git for Windows default.
-- **Result (VERIFIED, `x5`, `x4`).**
-  - With `* text=auto`, `git add` normalises CRLF to LF in `newtonsoft.json.nuspec`, `LICENSE.md` and `lib/*/Newtonsoft.Json.xml`. The clone's hashes differ from the originals (for example the nuspec goes from `a1d0fb81…` to `2fd73470…`). The dll is unchanged.
-  - With `autocrlf=true`, LF-only text members such as `socket-patched.txt` are rewritten on checkout.
-- **Wrong outcome.**
-  - The developer who vendored still has the original bytes and passes. Every other clone and CI fails `SOCKETPATCH002` on the `SocketPatchSeedFile` rows.
-  - The hot path always sees drift, so `vendor` rewrites the seed every run.
-  - Legacy mode never hit this, because a `.nupkg` is binary to git.
-- **Severity: blocker** (correctness and CI friction; it makes the integrity guard useless in practice).
-- **Fix.**
-  - Generate `.socket/vendor/nuget/.gitattributes` containing `* -text -diff -merge -filter`. This also turns off LFS.
-  - After writing, run `git check-attr text eol filter -- <seed files>`. Refuse with `vendor_artifact_git_transformed` if any file is still text or filtered.
-  - Add a case to the Docker test: a repo with `* text=auto`, then clone and build.
-  - If `*.dll filter=lfs` survives (the negation does not win), LFS pointer files in the checkout give a loud `SOCKETPATCH002` rather than a silent failure, but refuse at vendor time anyway.
-
----
-
-## Major
-
-### M1. The guard can be turned off by an environment variable, package props, or a Directory.Build.rsp.
-- **VERIFIED (`x3`):**
-  - `SocketPatchNuGetGuard=false dotnet build` with a tampered seed dll ends in `Build succeeded`. MSBuild reads environment variables as properties. One stray variable in a CI template turns off every guard in the org.
-  - B1 showed that package-level props can do the same.
-- **REASONED:** a committed `Directory.Build.rsp` containing `-p:SocketPatchNuGetGuard=false`, or `SocketPatchNuGetAllowUnpatched=true` in the environment, does the same thing and is easy to miss in review.
-- **Fix (VERIFIED, `x1` second run).**
-  - Assign `<SocketPatchNuGetGuard>true</SocketPatchNuGetGuard>` unconditionally in `socket-patch.targets`. The `-pp` output shows `Directory.Build.targets` imported after the package `build/*.targets` (line 9218 vs 9173). A project or package cannot override that assignment, and neither can an environment variable. Only a global `-p:` can. With this change, the props attack was stopped and `SOCKETPATCH002` fired.
-  - Because our file is imported last, our `SocketPatchNuGetGuard` target definition also wins over a package that redefines the target (VERIFIED). A `BeforeTargets` hook in the planted code is still arbitrary code, which is why B1's restore-time check is the real defence.
-  - Replace the free `SocketPatchNuGetAllowUnpatched` property with a project allowlist generated by the CLI from `state.json`.
-  - Make `vendor --check` flag `Directory.Build.rsp` and `MSBuild.rsp` files that mention `SocketPatch*`.
-
-### M2. A nested Directory.Build.targets added later hides the import. The project builds upstream silently and SOCKETPATCH005 never runs.
-- **VERIFIED (`x3`).**
-  - Adding `src/Directory.Build.targets`, which does not chain to the root, plus a new `src/New/New.csproj` that references 13.0.1, gives `Build succeeded`.
-  - A new lock is created with `resolved: 13.0.1` and the upstream hash. No `SOCKETPATCH*` error appears.
-- **Why the design misses it.** §4 and §9 say `SOCKETPATCH005` covers new projects. It covers them only if the import is reached. `ImportDirectoryBuildTargets=false` added later behaves the same way.
-- **Severity: major.** The build silently ships the known-vulnerable version.
-- **Fix.**
-  - `vendor --check` (the CI gate) evaluates every discovered project with `dotnet msbuild -getProperty:SocketPatchNuGetTargetsImported` (batched, or with `-graph` from the sln). It fails if any project that resolves the patched id at V is missing the import.
-  - Also, when writing a nested DBT, prefer adding the `GetPathOfFileAbove` chain line.
-  - Document that the protection holds only up to the next nested DBT.
-
-### M3. A copy of V′ in the global packages folder takes priority over the committed seed.
-The global packages folder (GPF) is NuGet's shared package cache.
-- **VERIFIED (`x2`).**
-  - When `$NUGET_PACKAGES/newtonsoft.json/13.0.1.1843260417/` holds different dll bytes and a copy of the seed's `.nupkg.metadata`, `restore --locked-mode` succeeds and resolves from the GPF.
-  - The guard then fires `SOCKETPATCH003` correctly.
-  - If that GPF copy also carries a `build/*.props` that sets `SocketPatchNuGetGuard=false`, the build ends in `Build succeeded` with the other bytes in `bin/`.
-- **Consequences.**
-  - (a) §9's "NU1403 when locked" holds only when the planted `.nupkg.metadata` hash differs. A copied directory, for example from a cache-sync tool, passes. With M1's fix, `SOCKETPATCH003` still catches it.
-  - (b) **Cross-tier false positive (REASONED from the verified priority).** Once any feed-tier repo, or the future hosted V′ (§11.2), puts builder-0 V′ into a shared CI or developer GPF, every fallback-tier repo using that uuid fails `SOCKETPATCH003` on that machine, although the bytes are identical. The GPF is never refreshed, so the failure persists until someone deletes the entry by hand.
-- **Fix.**
-  - Make the resolved-root check depend on content. Accept a foreign root when the package's whole file set hashes equal the inventory (same set-equality as B1), and fail otherwise.
-  - Also narrow the `StartsWith` prefix from `SocketPatchNuGetDir` to the exact `<uuid>` root. Today one uuid's V′ served from a different uuid directory passes (minor).
-
-### M4. Builder bit 1 does not map to a single byte sequence. In the feed tier this gives persistent NU1403 on a shared GPF.
-- **REASONED.** Builder 1 covers three different byte producers:
-  - the CLI re-versioning the same-version service nupkg;
-  - `local_rebuild` from upstream;
-  - either of those produced by a different CLI version, where zip writer details change.
-- **Consequence.** The §6.1 promise that one V′ equals one byte sequence everywhere is false for builder 1.
-  - In the feed tier on a shared runner GPF, the first writer wins. The second repo gets NU1403 on every locked restore on that runner. The research also verified that a failed locked restore still writes to the GPF, so the failure persists.
-  - Lockless projects silently use the other repo's bytes. `SOCKETPATCH002` catches this only if the table covers every consumed file.
-  - In the fallback tier the only cost is lock churn between developers.
-- **Severity: major for the feed tier, minor for the fallback tier.**
-- **Fix, any one of:**
-  - the feed tier requires builder 0 (service bytes) only;
-  - for local builds, derive N from the V′ nupkg's sha512 instead of the uuid, and record the uuid in state and in a nuspec field;
-  - freeze `reversion_nupkg` output with a cross-version golden, and forbid `local_rebuild` under builder 1 (give it a third code).
-
-### M5. Revert drift repair "from the signed-content-hash of a GPF copy" trusts a poisoned cache.
-- **REASONED from the verified facts (first writer wins; the legacy layout wrote patched same-version bytes to `<idl>/<V>/`).**
-  - After legacy use, or on any shared or poisoned GPF, §7.4 step 1 computes the "upstream" hash from patched or tampered bytes and writes it into the committed lock under upstream V.
-  - The local locked restore then passes against the poisoned cache, which blesses it. CI either gets NU1403, or, if CI shares the cache, keeps the bad bytes.
-- **Fix.**
-  - Repair only from depscan `upstreamContentHash`, or from a freshly downloaded nuget.org nupkg whose repository signature has been checked.
-  - Never repair from the GPF. If a GPF copy is used at all, require `.nupkg.metadata.source` to be nuget.org, a valid `.signature.p7s`, and `dotnet nuget verify` to pass.
-
-### M6. Provenance of the unpatched files is lost, and verify has no external anchor.
-- **REASONED.**
-  - A normal restore checks nuget.org's repository signature on every extraction.
-  - Vendoring drops the signature once (it has to; NU3008). The fallback tier then never checks anything again (VERIFIED earlier: V-D9 and signing §b).
-  - For the unpatched members of the seed, integrity therefore rests on one HTTPS download on the vendoring machine.
-  - `verify` and `--check` compare state against seed against lock against targets. All of these are repo data. Only afterHashes (patched files only) come from the server.
-- **Fix.**
-  - At vendor time, check the upstream nupkg's repository signature, or its sha512 against depscan `upstreamSha512` or the nuget.org catalog `packageHash`.
-  - Record `upstreamSha512` and afterHashes in state.
-  - `--check --online` (B1 fix 3) recomputes the full expected tree.
-  - Make depscan item #3 a GA requirement, not only a revert aid.
-
-### M7. Feed-tier trust: a repo-level, self-signed author trustedSigner applies to every package id.
-- **DOCS and VERIFIED mechanics.** The signing research verified that trustedSigners merge across config levels and that `allowUntrustedRoot` passes `require`. NuGet documentation says `<author>` trust has no `owners` or id scope.
-- **Scenario.** Whoever holds the pfx (§10) can sign any package id, with any content, and it passes the enterprise's `require` in this repo. The design also normalises repos extending enterprise trust. A contributor could equally add their own fingerprint, and it would look like routine socket-patch churn.
-- **Fix.**
-  - Generate an ephemeral key per uuid, sign, and destroy the private key before writing the fingerprint, so the trust covers exactly the bytes already signed.
-  - Better: never write trustedSigners. Print the `<author>` block for the admin to add to machine-level config, or wait for depscan's CA-issued certificate with an RFC 3161 timestamp (item #8) and trust Socket's certificate once at org level.
-  - `vendor --check` flags any repo trustedSigner not recorded in state.
-
-### M8. Name handling: percent-decoding after validation allows path traversal; MSBuild metacharacters allow injection.
-- **REASONED from the code.**
-  - `read_zip_members` (`crates/socket-patch-core/src/vendor/common.rs:336`) checks the **raw** name with `is_safe_relative_subpath`. §6.2 then percent-decodes. `%2E%2E%2Fx`, `lib%2F..%2F..%2Fx`, or `%5C` passes the raw check and decodes to traversal. Decoded names can also collide (`a%20b` and `a b`) or differ only in case.
-  - `is_plain_archive_name` allows `$ @ % ; ' ( )`. These are interpolated into `Include=`, `Condition=` and the `;path=hash;` `Contains` tables. `%XX` is unescaped by MSBuild, `;` splits items, `@(...)` and `$(Prop.Method())` are expanded. The result is a broken or forgeable inventory (a crafted name containing `=HASH;` can satisfy `Contains`) and property expansion at evaluation.
-  - `state.json` fields (id, versions, uuid, project paths) are rendered into the targets file by `regenerate_shared` straight from disk.
-- **Fix.**
-  - Decode, then re-run `is_safe_relative_subpath`, `is_plain_archive_name` and `names_are_unambiguous`, case-folded.
-  - Refuse names containing `$ @ % ; ' = ( )`. Otherwise MSBuild-escape (`%24 %40 %25 %3B %27`) and XML-escape every interpolated value.
-  - Check id against `^[A-Za-z0-9_.-]+$`, versions against the parser, uuids against strict UUID format, and project paths on every render, not only in the prelude.
-  - Zip-bomb protection is already there (`MAX_ENTRIES`, per-entry and total caps enforced against the actual decompressed size). Reuse it and keep it.
-
-### M9. Guard coverage: packages without lib or ref assets are not checked at all.
-- **REASONED.**
-  - `_SpCand` is built only from runtime, compile, native and resource items. For an analyzer-only or build-only package (source generators, SourceLink, MSBuild task packages), `_SpLocal` is empty.
-  - Then nothing is hashed, the `SocketPatchSeedFile` check is skipped (gated on `_SpLocal`), and `SOCKETPATCH003`/`005` never run.
-  - Even for lib packages, analyzers and `build/` files are not in `_SpCand`, although they run inside the compiler and MSBuild.
-- **Fix.**
-  - Decide "patched package present" from the `project.assets.json` `libraries` and `targets` keys, not from asset items.
-  - Add `@(Analyzer)` to the candidates.
-  - Run the full-inventory check (B1) unconditionally at restore.
-  - Gate G1 on an analyzer-only fixture.
-
----
-
-## Minor
-
-- **m1. Symlinks (REASONED).**
-  - Committed symlinks inside the seed, or on its ancestors (`.socket`, `vendor`, `nuget`, `<uuid>`), pass `SOCKETPATCH003`, because that check compares path strings without resolving symlinks. A seed linked outside the repo also opens a check-then-use race between hashing and compilation.
-  - Revert's "delete the seed and prune" through a symlinked ancestor deletes outside the repo. Rust's `remove_dir_all` does not follow a symlink passed as its own argument, but it does traverse symlinked ancestors in the path.
-  - Fix: apply the existing `refuse_symlinked`/`first_symlink` to the seed and all its ancestors in apply, verify and revert, and refuse non-regular files in the inventory walk.
-- **m2. The signature policy is checked only at vendor time (REASONED).** A `require` added later to a repo, ancestor or user config is bypassed silently. The design documents only the CI-only case. Fix: `vendor --check` probes the policy again, and the restore-time target warns when it can see `signatureValidationMode` in `$(RestoreConfigFile)` or repo configs.
-- **m3. Seed nuspec edits.** An added `<dependency>` in the nuspec pulls in a new package. That is loud under locked mode (NU1004) and silent when lockless. B1's set-and-hash check at restore closes it. The current design only checks the nuspec after resolution, and only when `_SpLocal` is non-empty.
-- **m4. Wording in §9.** "V′ present elsewhere → NU1403 when locked" holds only when the planted `.nupkg.metadata` hash differs (VERIFIED `x2`). The row should say that `SOCKETPATCH003`/`002` is the actual defence.
-- **m5. Stale `obj/` (REASONED, low).** A pre-vendor `project.assets.json` followed by `build --no-restore` is caught by `SOCKETPATCH005`. After a revert, a stale assets file pointing at a deleted seed gives a loud missing-file error. Both are fine; keep them as test legs.
-- **m6. Hash tables.** They depend on `GetFileHash` giving uppercase hex and on case-sensitive `String.Contains`. This works (VERIFIED `x0`: the metadata comparison passes, and editing `.nupkg.metadata` gives `SOCKETPATCH002`). Pin it with a golden test so a lowercase render never ships.
-
----
-
-## Verified experiment log
-
-| ID | Where | Result |
-|---|---|---|
-| x0 | `adv-integrity/x0` | Baseline passes: locked restore, `packageFolders` = GPF then the seed, guard `ok local=2`. The `SocketPatchSeedFile` hash check works: editing `.nupkg.metadata` gives `SOCKETPATCH002`. |
-| x1 | `x1` | Tampered dll plus unlisted `build/*.props`/`.targets` in the seed: locked restore passes, the planted targets run, the guard is off, `Build succeeded`. With an unconditional `SocketPatchNuGetGuard=true` in our targets: `SOCKETPATCH002` fires, and a planted redefinition of the guard target is ignored. The `-pp` output shows the DBT imported after the package `build/*.targets`. |
-| x2 | `x2` | V′ in the GPF with a copied `.nupkg.metadata` and other bytes: locked restore passes and resolves from the GPF, `SOCKETPATCH003` fires. Adding planted props that disable the guard: `Build succeeded` with the other bytes. |
-| x3 | `x3` | A new nested `src/Directory.Build.targets` that does not chain: the new project builds upstream 13.0.1, a new lock is written, no error. The environment variable `SocketPatchNuGetGuard=false` hides a tampered seed. |
-| x4/x5 | `x4`, `x5c` | `* text=auto` changes the hashes of the nuspec, LICENSE and xml members; `autocrlf=true` changes LF-only text members; the dll is unchanged. |
-
-## Priority fixes before the prototype is accepted
-1. Restore-time full-set check of the seed, plus a CLI set-equality walk (B1).
-2. Generated `.gitattributes` with `* -text -diff -merge -filter`, plus a `git check-attr` probe (B2).
-3. Unconditional guard assignment and a CLI-managed allowlist (M1).
-4. `vendor --check` evaluates every project for the import (M2) and supports `--online` rebuild verification (B1, M6).
-5. A resolved-root check that also compares content hashes (M3).
-6. Decode-then-validate names and escape MSBuild metacharacters (M8).
-7. Candidates chosen from the assets file, including analyzers (M9).
-8. Remove GPF-based drift repair (M5).
-9. For the feed tier: builder 0 only, or content-derived V′ (M4), and no pfx-holder trust written at repo level (M7).
\ No newline at end of file
diff --git a/docs/design/nuget-vendoring-research/adversarial-lifecycle.md b/docs/design/nuget-vendoring-research/adversarial-lifecycle.md
deleted file mode 100644
index 60883f9d..00000000
--- a/docs/design/nuget-vendoring-research/adversarial-lifecycle.md
+++ /dev/null
@@ -1,305 +0,0 @@
-# Adversarial lifecycle review: NuGet vendoring v2 (unique-version fallback seed)
-
-## Verdict
-
-The build-time mechanism holds up: V′, the fallback folder, evaluation-time redirects and the guards. The weak part is the lifecycle, which the design does not specify well enough to implement.
-
-The design adds generated files shared by every NuGet entry: `socket-patch.targets`, `.gitignore`, and one DBT import per directory. It then tracks them with per-entry records, inside a CLI that:
-- saves the ledger and sweeps old uuid dirs *after* the backend returns;
-- drops cross-uuid wiring on re-vendor;
-- keeps "preserved" entries byte-identical.
-
-Those three behaviours cause the two lifecycle blockers:
-- **Patch update:** the most common lifecycle event breaks restore for every project in the repo.
-- **Revert after an update, or reverting in the wrong order:** leaves an import to a deleted targets file. Restore then quietly rewrites locks to upstream.
-
-A third blocker is the git line-ending problem: under the common `* text=auto` rule, the committed seed does not survive a clone byte-for-byte.
-
-With the fixes below the design is still workable. §15 should grow by one structural piece: a pass that regenerates the shared NuGet outputs from the final ledger state.
-
-## Experiments run (SDK 8.0.131)
-
-All runs used an isolated `HOME`, `NUGET_PACKAGES`, `NUGET_HTTP_CACHE_PATH`, `TMPDIR` and `DOTNET_CLI_HOME`, under `<scratch>/adv-lifecycle/`. Env script: `adv-lifecycle/env.sh`. The fixture is a copy of design-D `e1/r` (Lib, App, Tool; 13.0.1 and 12.0.1 redirected to `.1843260417`).
-
-| ID | Experiment | Result |
-|---|---|---|
-| **V1** | Cold GPF, then `dotnet restore S.sln --locked-mode` on the vendored repo | **VERIFIED.** Afterwards the GPF holds only `newtonsoft.json.bson/1.0.2`. It holds **no** `newtonsoft.json` at any version, because upstream 13.0.1 and 12.0.1 are never downloaded. `packageFolders` = [gpf, `.socket/vendor/nuget/packages`]. |
-| **V2** | Add one non-existent uuid root to `RestoreAdditionalProjectFallbackFolders` | **VERIFIED.** `error NU1301: The local source '…' doesn't exist` for **every** project that imports the targets: Lib, App and Tool, including projects that do not use the patched package. |
-| **V3** | Unguarded `Import` of `socket-patch.targets` with the targets file deleted | **VERIFIED.** A plain `dotnet restore` **succeeds without error**, because NuGet's restore evaluation ignores missing imports. It **rewrites `Lib/packages.lock.json` from `13.0.1.1843260417` back to upstream `13.0.1`**. Only `dotnet build` then fails with MSB4019. A later `--locked-mode` restore passes against the rewritten upstream lock. |
-| **V4** | Commit the extracted seed in a repo with `.gitattributes` `* text=auto`, then `git clone` | **VERIFIED.** In the clone, `newtonsoft.json.nuspec`, `LICENSE.md` and `lib/*/Newtonsoft.Json.xml` have different sha256 (CRLF became LF). The vendoring machine's tree still reports clean. The dll and `.nupkg.metadata` are unchanged. The fix below is also VERIFIED under both `text=auto` and `core.autocrlf=true`: a nested `.socket/vendor/nuget/.gitattributes` containing `* -text -diff -merge -filter` gives byte-identical clones. |
-
-Everything else below is **REASONED**, from the code as cited or from the verified facts above.
-
-## Findings
-
-### B1. Patch update to a new uuid breaks every restore, pins a dead V′, and makes revert unrecoverable (BLOCKER)
-
-**Scenario.** Patch A (uuid `3f9a…`, 13.0.1 → V′a) is vendored. The manifest moves to patch B (new uuid) for the same purl, and the user runs `socket-patch vendor`.
-
-**What the code does** (`vendor.rs` `record_vendor_entry` :1020, `sweep_stale_artifact` :1073):
-1. The backend runs while A's entry is **still in the ledger**.
-2. The CLI then replaces the entry under the same key.
-3. The CLI deletes A's uuid dir.
-
-**What goes wrong:**
-- §7.1 step 5 renders the targets from "state on disk minus *this* uuid (B) plus this entry". So it renders **both** A and B:
-  - A's root stays in `RestoreAdditionalProjectFallbackFolders`;
-  - there are two `Update` redirects for the same declared 13.0.1, and the later one wins;
-  - SOCKETPATCH001 checks A's seed.
-- After `sweep_stale_artifact` deletes A's dir, every project fails with NU1301 (V2) or SOCKETPATCH001. Nothing regenerates the targets after the sweep.
-- `plan_closure` and `plan_lock_edits` look for entries that resolve to **V**. After A, every lock resolves to V′a, so B finds no closure and makes no lock edits (or refuses). The targets redirect to V′b while the locks pin V′a, which gives NU1004 in locked mode.
-- If B does edit V′a → V′b, it records `original` = the V′a text. `carry_forward_wiring` (`state.rs:418`) fills an original **only when `original` is None**. So B's revert would restore V′a, a version whose seed is gone (NU1301 or NU1102).
-- The prelude checks `vendor_nuget_duplicate_patch` and `vendor_nuget_version_collision` against A's entry for the same purl and may refuse the update outright.
-
-**Fix:**
-- The shared-output render must exclude every entry with the same ledger key or basePurl as the entry being written.
-- More robustly, regenerate `socket-patch.targets` and `.gitignore` in a CLI step that runs **after** `persist_vendor_entry`, `sweep_stale_artifact` and each revert's `save_state` (see P1).
-- The closure planner and lock planner must treat any `resolved` that `parse_socket_nuget_version` decodes to (id, V) as "ours". For those entries they should record `original: None`, so that `carry_forward_wiring` fills in the true upstream original from A (the key `<lockrel>#<tfm>#<id>` is uuid-agnostic, so the match works).
-- Duplicate and collision checks must ignore the entry being replaced.
-- Add a docker leg: vendor A, update to B, run a locked restore, revert, then `git diff --exit-code`.
-
-### B2. Import records are "reference-counted" per entry, but the ledger cannot hold them, leaving the repo unbuildable after revert (BLOCKER)
-
-**Scenario 1 (patch update, then revert).** B's apply finds the imports already present. `inject_import` returns None, so nothing is recorded. `carry_forward_wiring` performs its union **only when `prev.uuid == entry.uuid`** (`state.rs:461`), so A's `nuget_msbuild_import` records are dropped. When B is reverted:
-- no import record remains;
-- step 2 deletes the targets because no entries are left;
-- every DBT still imports a missing file.
-
-**Scenario 2 (two ids, reverted in creation order).** Entries X and Y exist, and X created the imports. `vendor --revert` walks keys in sorted order and saves after each entry (`rollback.rs:891-902`). X is not last, so its import records vanish with X's ledger entry. Y has none, so the imports stay.
-
-**Scenario 3 (crash).** The process is killed between the import write and the ledger save. The next run sees the imports as pre-existing and has no record to undo them.
-
-**Outcome.** Every `dotnet build` fails with MSB4019. Worse, by V3 every plain `dotnet restore` (Dependabot, Renovate, `dotnet list package`, IDE restore) **silently rewrites the locks to upstream**. A bot PR can then commit unpatched locks.
-
-**Fix:**
-- Stop tracking imports in per-entry records.
-- Make import removal deterministic and free of records: on the last `nuget-fallback` revert, discover every DBT (same discovery as apply) and excise exactly the line carrying `Label="socket-patch"`.
-- Delete a DBT only if its whole text equals `created_dbt(import_rel)`.
-- Optionally keep a state-level `nugetShared` object (an additive optional field on `VendorState`) with the created and edited DBT originals, for byte-exact restore.
-- **Order:** remove the imports first, and delete the targets only after every import is gone. If any excision drifts, write a no-op stub `socket-patch.targets` (just `<Project/>`) rather than deleting it.
-
-### B3. The committed seed is not byte-stable through git (BLOCKER for Windows and VS-template repos)
-
-**Scenario.** The repo has `.gitattributes` `* text=auto` (the stock Visual Studio template), `core.autocrlf=true` on Windows, or an LFS rule such as `*.dll filter=lfs`.
-
-**Outcome (V4).** Every fresh clone or CI checkout has different bytes for the nuspec, xml docs and LICENSE. Then:
-- the seed-inventory hash in the guard fails with SOCKETPATCH002 on **every build except the vendoring machine's**;
-- `fallback_in_sync` never holds, so each `socket-patch vendor` rewrites the seed, and git hides this because it normalises;
-- patched text members (content files, `build/*.targets`, `.ps1`) also fail afterHash verification;
-- with LFS, clones without LFS get pointer files.
-
-The legacy layout is immune because a `.nupkg` is binary. So this is a regression specific to the new layout.
-
-**Fix:**
-- Generate `.socket/vendor/nuget/.gitattributes` with `* -text -diff -merge -filter` (V4 verified that it fixes `text=auto` and autocrlf).
-- After writing, probe with `git check-attr text filter eol` on each seed file, and refuse with `vendor_artifact_git_transformed` if any file is still transformed.
-- Add `.gitattributes` to the reserved names (§11.4) and the hot-path render check.
-
-### M1. Preserved, kept or failed-save entries are re-wired by the next render (MAJOR)
-
-**Scenario.** One of:
-- `rollback --preserve-state` or `remove --preserve-state`: `VendorRevertStep::Preserved` keeps the entry byte-identical (`rollback.rs:860-864`);
-- drift-keep (`Kept`);
-- `LedgerWriteFailed`.
-
-After that, any later NuGet vendor or revert, or even the hot path of a *different* entry ("targets byte-equal to a fresh render"), renders from all `nuget-fallback` entries. The supposedly reverted patch comes back into the targets.
-
-**Outcome:**
-- Locked projects: NU1004, because their locks were restored to upstream.
-- Lockless projects: silently patched again.
-- If the seed was deleted: NU1301 for every project (V2).
-
-**Fix.** Render only the entries that are actually wired. Add `nuget.wired: bool`, or `unwiredAt`, to `NugetMeta`, and set it false on Preserved and Kept. Never render an entry whose seed directory is missing; emit a warning instead.
-
-### M2. Revert step order defeats drift-keep, and deletes the targets before import removal can fail (MAJOR)
-
-**Scenario.** §7.4 step 2 regenerates the targets **without** this uuid. Step 4 then keeps the seed only if "the live targets file still names the uuid". That can never be true at step 4, so drift-keep never fires. The seed is deleted while a drifted lock still pins V′. The result is NU1004 when locked, and a dangling V′ pin for any tool that reads the lock.
-
-Step 2 also deletes the targets before step 3 tries to excise the imports, which is the B2 failure mode.
-
-**Fix.** Use this order:
-1. lock records;
-2. compute keep = any drifted record whose live text still contains V′;
-3. if keep, leave the uuid in the targets, keep the seed, and return `kept_artifact`;
-4. otherwise remove imports (last entry only, per B2);
-5. regenerate or delete the targets;
-6. delete the seed.
-
-### M3. On a clean machine the package never counts as installed: repair, update and migration have no pristine source (MAJOR)
-
-**Scenario.** CI or a teammate's clone. V1 shows the GPF never holds upstream `newtonsoft.json/13.0.1` again after vendoring. With §7.5, the crawler skips the seed folders. The loop (`vendor.rs:1840-1910`) therefore sees the purl as missing, and what happens next depends on the case:
-- **Same uuid:** `ledger_covers` returns true for a directory artifact with `sha256: ""` (`state.rs:293` checks existence only), so the source becomes `Deferred`. The `vend_installed!` `debug_assert!(PackageSource::Installed)` (`vendor.rs:171`) then panics in debug and test builds. In release, `installed_dir` is a hint path. This does exist for legacy with a cold GPF, but legacy's first restore repairs it; in fallback it is permanent.
-- **New uuid (patch update), `repair` (service None, `repair_vendor.rs:1632`), or `--offline`:** there is no fetch rung, so `package_not_installed` and exit 1. A NuGet patch can then only be updated where the service is reachable, or after revert, restore and re-vendor.
-
-**Fix:**
-- Add a NuGet pristine-fetch rung: nuget.org flatcontainer, `<idl>/<v>/<idl>.<v>.nupkg`.
-- Verify it fail-closed against the upstream `contentHash` that the ledger already holds in each `nuget_lock_entry_v2` `original`. For signed packages, compute the signed-content hash (zip without `.signature.p7s`, signing §e) instead of hashing the file.
-- Treat that fragment like npm's "ledger-recovered pre-vendor registry fragment".
-- Replace the `debug_assert` for nuget-fallback entries. The fallback hot path must never read `installed_dir`.
-
-### M4. The hot path and `--check` fail on CI before restore, and the closure re-plan misreads its own output (MAJOR)
-
-**Scenario.** §7.2 requires the recomputed closure plan to match `nuget.projects`, and §7.1 refuses `vendor_nuget_unrestored` when a project has neither a lock nor an assets file.
-
-**Outcome:**
-- On a fresh clone (no `obj/`), lockless projects have neither, so `socket-patch vendor` or `--check` refuses or reports "closure changed" on every CI run.
-- Even with locks, the post-vendor lock resolves **V′**, not V. A `pin` project's entry has become `Direct`, so without V′-awareness it looks like `direct`. `auto-follow` is ambiguous in the same way. The re-plan then "re-keys" and churns the targets.
-
-**Fix:**
-- Persist the plan in state and treat it as authoritative.
-- Re-plan only from csproj and CPM text plus the locks, with decoded V′ counted as V. Missing assets for a project already in the plan is not a refusal.
-- Keep `vendor_nuget_unrestored` only for **new** projects that the plan has not seen.
-
-### M5. Older binaries (v4.0.0 is released) corrupt fallback entries; the "flavor gate in the same PR" protects only v5+ (MAJOR)
-
-**Scenario.** A teammate, or a CI action pinned to v4, runs `socket-patch vendor --revert` or `vendor` on a repo with `nuget-fallback` entries.
-
-**v4 revert** (`nuget_feed.rs:772-873`):
-- every kind is unknown, so each produces a `vendor_lock_entry_drifted` warning;
-- drift-keep probes only single-segment wiring files for the literal `.socket/vendor/nuget/<uuid>`;
-- `Directory.Build.targets` contains only the targets path, so the probe finds nothing;
-- the seed is deleted and the call reports success;
-- `revert_vendor_entry` drops the entry;
-- the targets and locks still reference the uuid, so NU1301 in every project (V2), with no ledger entry left.
-
-**v4 vendor:** `config_wired` is false (there is no `socket-patch-<uuid>` in `nuget.config`), so v4 runs a full legacy apply on top. It:
-- writes a `.nupkg` into the same uuid dir;
-- adds a source and catch-all to `nuget.config`;
-- rewrites the root lock;
-- writes a legacy entry. Because the uuid is the same, `carry_forward_wiring` merges the fallback records into it, and that entry then routes to the legacy revert.
-
-`load_state` has no version gate (`state.rs:562-590`), so bumping `VENDOR_STATE_VERSION` does not help.
-
-**Fix:**
-- In the root DBT, emit one comment per uuid: `<!-- socket-patch: .socket/vendor/nuget/<uuid> -->`. v4's drift-keep then keeps the seed and the entry, which is fail-safe. This also fixes M6's liveness probe.
-- In v5, route any entry that carries `nuget_lock_entry_v2` or `nuget_msbuild_import` records to the fallback backend, whatever its `flavor`.
-- Detect and heal a legacy `socket-patch-<uuid>` source that sits beside a fallback seed.
-- Document the minimum version.
-
-### M6. VEX silently stops attesting fallback-vendored patches (MAJOR, missing from the §15 module table)
-
-**Scenario.** `vex/discover/nuget.rs` is driven entirely by `nuget.config` (source plus mapping). The vendored liveness probe list for nuget is `CONFIG_NAMES` (`vex/discover/mod.rs:1750`). `vendored_wiring_in_files` looks for the literal `.socket/vendor/nuget/<uuid>`.
-
-The fallback entry's recorded files are the DBT (which has only the targets path) and the locks (which have only V′). The targets file uses `$(SocketPatchNuGetDir)<uuid>`, which is not the literal string. So `vendored_wiring_live` returns false and the entry reads as dead.
-
-**Outcome.** VEX output drops the patch without any error.
-
-**Fix:**
-- Add a fallback extractor: parse `socket-patch.targets` (uuid roots plus `Update`/`Include` V′) and every discovered lock (decode V′ to purl@V plus the uuid prefix).
-- Add `.socket/vendor/nuget/socket-patch.targets` and the discovered locks to the nuget probe files.
-- Spell the uuid dir literally in the targets, as a comment or in the SOCKETPATCH001 path.
-- Set `artifact_rel` to the seed directory.
-- Put all of this in prototype scope.
-
-### M7. Partial-failure unwind is unsafe for shared outputs and reused seeds (MAJOR)
-
-**Scenario:**
-- §7.1 step 4 may *reuse* an existing, already committed seed, for example on a closure re-plan. The unwind for steps 5–8 then "deletes the seed".
-- Step 5 overwrites the shared targets and `.gitignore`, which have no recorded original.
-- A lock edit fails at project k of N, for example on an unparseable lock.
-
-**Outcome.** A committed seed can be deleted while the targets still name it (NU1301 everywhere, V2). Alternatively, the new targets file is left behind with only some locks edited, which gives NU1004.
-
-**Fix:**
-- Snapshot the bytes of `socket-patch.targets`, `.gitignore` and `.gitattributes` before step 5, and restore them on unwind.
-- Delete the seed only if this run created it.
-- Stage all lock splices in memory and write them last, each by temp file and rename. Unwind must restore every written file.
-
-### M8. Migration from the legacy layout destroys its own pristine source and leaves the repo unpatched on refusal (MAJOR)
-
-**Scenario.** §11.1 runs the legacy revert (step 1) before the fallback apply (step 2).
-
-**Problems:**
-- The legacy revert deletes the committed patched `.nupkg`, which is the only local copy of the patched bytes.
-- On a legacy machine the GPF `newtonsoft.json/13.0.1/*.nupkg` is **the patched one**, extracted from our feed. `local_rebuild` would therefore apply the patch to already-patched bytes, and the before-hash gate fails.
-- Any fallback-only refusal (`exact_dependency`, `dbt_disabled`, `unrestored`, `version_literal_unknown`) that fires after step 1 leaves the repo **unpatched**.
-
-**Fix:**
-1. Run `fallback_prelude` and `plan_closure` first.
-2. Materialise V′ with `reversion_nupkg(committed_legacy_nupkg)`, builder Local, and verify the afterHashes.
-3. Only then revert the legacy wiring and write the fallback wiring, as one unit that can be unwound.
-4. The migration must fail as a whole and leave legacy intact.
-
-### M9. Restore does not fail closed when the targets file is missing (MAJOR; contradicts §6.4)
-
-§6.4 says an unguarded import means "it never degrades silently to upstream". V3 shows otherwise:
-- `dotnet restore` ignores the missing import and **rewrites the locks to upstream**;
-- only build fails.
-
-Restore-only pipelines therefore produce unpatched locks without any error: Dependabot/Renovate lock refresh, `dotnet restore` Docker layers without `.socket/`, and `dotnet list package --vulnerable`.
-
-**Fix.** Update §6.4 and §9 to describe this accurately. Recommend `socket-patch vendor --check` as a required CI step, and document that lock diffs from V′ to V in bot PRs mean the patch was dropped. In Docker, the COPY step must include `.socket/vendor/nuget/` whenever it copies `Directory.Build.targets`.
-
-### M10. Transitive pins keep themselves alive and never disengage (MAJOR)
-
-**Scenario.** Tool pins `[12.0.1.N]` because Bson 1.0.2 pulls in 12.0.1. Later Bson is removed, or bumped to a version that needs 13.x.
-
-**Outcome:**
-- **Bson removed:** the pin's condition (the project has no PackageReference for the id) still holds. Tool keeps a direct dependency on patched 12.0.1 indefinitely, and `Publish="true"` ships the dll.
-- **Bson needs ≥ 13:** NU1605 against the exact pin.
-- The in-use probe ("any lock resolves V′") is satisfied by our own pin, so gc never reclaims the entry.
-
-**Fix.** The in-use probe and `vendor --check` must ignore edges the tool created itself. A pin counts as in use only if some other package in the assets or lock `dependencies` still lists the id at a range V′ satisfies. Otherwise, report `vendor_nuget_pin_orphaned` and drop the pin on the next `vendor`.
-
-### M11. The layout choice does not persist, so repos end up with mixed layouts (MAJOR)
-
-**Scenario.**
-- `--nuget-layout` defaults to `feed`.
-- Only *existing* entries are sticky.
-- The flag is threaded only into `dispatch_vendor_one` and the preflight. It is not on `scan --mode vendored`, `get --mode vendored` or `repair`.
-
-**Outcome.** A teammate or CI adding a new NuGet patch without the flag vendors it in the legacy layout. The repo then has both a `nuget.config` catch-all and fallback targets. This is untested, and legacy GPF poisoning returns for that id.
-
-**Fix.** Infer the layout: if any `nuget-fallback` entry exists, new entries use fallback. Or persist a `nugetLayout` optional top-level field in the state. Put the flag on `GlobalArgs`.
-
-### Minor findings
-
-| # | Scenario | Outcome | Fix |
-|---|---|---|---|
-| m1 | A user edits `socket-patch.targets`, for example to add `SocketPatchNuGetAllowUnpatched` or exclude a project | The next render overwrites the edit without warning | Store the render sha in state. If the on-disk file differs from the last render, warn `vendor_nuget_targets_edited` and refuse without `--force`. Provide a supported user hook: an optional `socket-patch.user.targets` imported last, plus per-project properties. |
-| m2 | "Import into every nearest DBT" reaches git submodules, `dotnet new` template content (`PackageType=Template`), samples, or vendored third-party trees | Submodule edits cannot be committed from the superproject, so projects there resolve upstream silently. Templates ship a broken import to their consumers. | Limit to projects in the same git worktree (`git rev-parse --show-toplevel`). Skip template content. Warn `vendor_nuget_import_skipped`. |
-| m3 | A new subdirectory is added later with its own DBT that does not chain to the parent | The targets are never imported, so SOCKETPATCH005 cannot fire and the project is silently unpatched. §4's claim that 005 covers new projects is only partly true. | Say so explicitly. Have `vendor --check` list uncovered projects, and make `--check` part of the recommended CI step. |
-| m4 | Developers with and without service access (builder 0 vs 1), and Q4 | Different V′ for the same uuid. Lock and targets churn as soon as anyone runs `--force` or a re-plan. | Hot path accepts either builder for the same uuid. Never switch builders without an explicit `--nuget-rebuild-service`. |
-| m5 | Dry run | Earlier entries in the run are not persisted, so the preview render leaves them out and understates the diff | Render from the in-memory run state. |
-| m6 | Directory artifact with `sha256: ""` | `ledger_covers`, `list` and orphan labelling rely on existence only. The `path.rs` leaf parser expects a `.nupkg` leaf. | Add a `fileInventory`-based intact check for nuget-fallback artifacts, and a nested leaf parser. |
-| m7 | NU1903 on V′ | VERIFIED during V1: `NU1903 … 12.0.1.1843260417 has a known high severity vulnerability`. This is the same as before the patch, but still a false positive once patched. Under `TreatWarningsAsErrors` or `NuGetAuditLevel` it fails the build. NuGetAuditSuppress is out of prototype scope. | Bring NuGetAuditSuppress into the prototype for NuGet ≥ 6.11, or document the gap. |
-
-## P1. Can the prototype (§15) be built in the current code structure?
-
-Only with CLI changes that §15 does not list. What is missing:
-
-1. **No per-ecosystem finalize hook.** Shared outputs derived from the whole ledger need a `vendor::nuget_fallback::sync_shared(cwd, &VendorState)` call after every ledger mutation:
-   - `run_vendor` after `persist_vendor_entry` and `sweep_stale_artifact`;
-   - `run_revert`, `rollback`, `remove` (`revert_vendor_entry` after `save_state`);
-   - `run_vendor_gc`, `repair`, and scan/get vendored.
-
-   Doing this inside the backend is what causes B1 and M1.
-2. **`carry_forward_wiring` contract.**
-   - The backend must emit `original: None` for lock entries already at a Socket V′.
-   - Import wiring must move out of per-entry records (B2).
-   - A new-uuid re-vendor unions nothing.
-3. **Layout plumbing is more than two call sites.**
-   - `vendor::service_preflight` (`vendor/mod.rs:918`) is a public 6-argument function with no ledger access, so `layout_for(entry_flavor, …)` cannot be evaluated there without a signature change.
-   - `dispatch_vendor_one` has callers at `vendor.rs:2636` and `repair_vendor.rs:1632`, and is also reached through `vendor_records` from scan and get. The flag belongs on `GlobalArgs`.
-4. `vend_installed!` `debug_assert` and a NuGet fetch rung (M3).
-5. VEX discovery and liveness (M6), the in-use probe with self-edge exclusion (M10), and crawler skipping all have to be in scope. Otherwise `vex`, `gc` and `list` regress as soon as the flag is used.
-6. A v4 hybrid-entry router plus the DBT uuid comment (M5).
-
-Scale: the core modules in the §15 table look sized correctly. The CLI and VEX work above probably adds another 30–40% and touches 6–8 more files. None of it conflicts with the backend and dispatch shape.
-
-## Recommended design edits (summary)
-
-1. Add §6.7 "Shared outputs":
-   - `sync_shared` after every ledger save;
-   - render only wired entries whose seed is present;
-   - record-free import excision, removing imports before the targets;
-   - a stub targets file on drift;
-   - a generated `.gitattributes` checked with `git check-attr`.
-2. Add §7.6 "Patch update":
-   - V′-aware planner;
-   - `original: None` carry-forward;
-   - exclude the entry being replaced;
-   - a docker leg for update, revert and a clean diff.
-3. Reorder §7.4 revert as in M2. Reorder §11.1 migration as in M8.
-4. Correct §6.4 and §9 on restore behaviour when the targets file is missing (V3), and make `vendor --check` the documented CI gate.
-5. Extend §15 scope: VEX, the in-use probe, the fetch rung, the v4 hybrid router, layout inference, and the finalize hook.
\ No newline at end of file
diff --git a/docs/design/nuget-vendoring-research/adversarial-shapes.md b/docs/design/nuget-vendoring-research/adversarial-shapes.md
deleted file mode 100644
index 6ed57854..00000000
--- a/docs/design/nuget-vendoring-research/adversarial-shapes.md
+++ /dev/null
@@ -1,161 +0,0 @@
-# Adversarial review: NuGet vendoring v2 (unique-version fallback seed), project shapes
-
-**Environment.** .NET SDK 8.0.131 on Linux, with HOME, NUGET_PACKAGES, NUGET_HTTP_CACHE_PATH, TMPDIR and DOTNET_CLI_HOME isolated per experiment. I ran one dotnet process at a time.
-
-**Where everything is.** Experiments are under `<scratch>/adv-shapes/exp/e{1,2,3,5,7,8,9}`. The generator is `adv-shapes/gen.py`: it renders the §6.3 targets as the design wrote them (guard, SOCKETPATCH001, pack guard) using design-D's real seeds (`13.0.1.1843260417`, `12.0.1.1843260417`). Lock "after" states come from `restore --force-evaluate`, which is the ideal output the CLI's edits would have to match.
-
-**Labels.** VERIFIED means I ran it. REASONED means I did not.
-
-## What held up (VERIFIED)
-- The §6.3 guard works as written, with no MSB4096 metadata errors.
-  - SOCKETPATCH002 fires on a tampered dll that is consumed, and on a tampered seed file that is not.
-  - SOCKETPATCH005 fires.
-  - `GetFileHash` keeps the custom `Sha256` metadata.
-- SOCKETPATCH001 (`BeforeTargets=CollectPackageReferences`) fires in normal restore and in static-graph restore, with and without `--locked-mode`. That covers part of G4.
-- CPM with transitive pinning on, under a static-graph `--locked-mode` restore, passes (part of G7).
-- The pack range restore fixes both a direct CPM reference and a CentralTransitive pin: the nuspec says `13.0.1`.
-- Package ids that differ only in case are redirected (`newtonsoft.JSON`). F# (`.fsproj`) works. GlobalPackageReference and nuget.g.targets are imported before DBT, so `Update` reaches them.
-
----
-
-## Blockers
-
-### B1. An exact `[V′]` spreads through ProjectReference and breaks projects the closure never sees (VERIFIED, e2)
-**Setup.** Lib has Newtonsoft 13.0.1 (patched). Lib12 has 12.0.1 (patched). Lib3 has 13.0.3 (unpatched).
-- AppA references Lib and Lib3. It resolved 13.0.3 before vendoring.
-- AppB references Lib and Lib12. It resolved 13.0.1.
-- AppC has a direct 13.0.3 reference and references Lib.
-
-**Results after vendoring:**
-- **AppA:** `NU1107 Version conflict: AppA -> Lib -> Newtonsoft.Json (= 13.0.1.1843260417) / AppA -> Lib3 -> (>= 13.0.3)`. This is a hard restore failure. AppA is not in the closure, because it resolves 13.0.3, not V, so the prelude never checks it.
-- **AppB:** `NU1107` between `(= 13.0.1.N)` and `(= 12.0.1.N)`. Patching two versions of one id breaks any project that reaches both. This is exactly the "multi-version of the same id" shape the design says is Supported.
-- **AppC:** `NU1608` (Lib requires `= 13.0.1.N` but 13.0.3 resolved). This breaks the build under `TreatWarningsAsErrors`.
-- **Locks outside the closure change too.** AppA's and AppC's `packages.lock.json` Project entries (`"Newtonsoft.Json": "[13.0.1, )"` → `"[13.0.1.N, 13.0.1.N]"`) change even though those projects are not in the closure. The CLI only edits locks in the closure, so AppC gets **`NU1004 ... references lib whose dependencies has changed`** in locked mode.
-
-**Fix (the range part is VERIFIED):**
-1. Redirect to `[V′, )` instead of `[V′]`. After that change:
-   - AppA resolves 13.0.3, as before.
-   - AppB resolves 13.0.1.N (lowest applicable).
-   - AppC resolves 13.0.3, with no NU1608.
-   - Lib and Lib12 resolve V′.
-   - No NU1107.
-2. Close the drift that `[V′, )` opens with a new guard, SOCKETPATCH006. Put a marker item (`<SocketPatchRedirect Include="newtonsoft.json/13.0.1.N"/>`) inside the same conditioned ItemGroup as the redirect. The guard fails if a project where the redirect engaged resolved the id at anything other than V′. Do not make NU1603 a repo-wide error: that would break existing builds that already have approximate matches on other packages.
-3. The planner must edit the `Project`-entry range in **every** lock whose graph includes a redirected project, not only locks in the closure. Record each edit for revert.
-4. Update the range-restore replace string to the `[V′, )` form.
-
-### B2. With chained nested DBT files, the once-guard imports the targets too early (VERIFIED, e7)
-**Setup.** A common pattern: `src/Directory.Build.targets` imports the root DBT on its first line through `GetPathOfFileAbove`, then declares `<PackageReference Include="Newtonsoft.Json" Version="13.0.1"/>`.
-
-**Why it breaks.** The root DBT's import runs first and sets `SocketPatchNuGetTargetsImported`. The import the design injects as the last child of `src/Directory.Build.targets` is then skipped. The redirect ItemGroup is therefore evaluated before the PackageReference exists.
-
-**Results:**
-- Restore resolves **upstream 13.0.1**.
-- The build fails with SOCKETPATCH005, so it is loud. In locked mode it fails NU1004 against the edited lock.
-- When the project was planned as `pin`, the misfire is worse. The pin condition `@(PackageReference…)==''` is true at that point, so the pin is added next to the later Include. The result is `NU1504 Duplicate 'PackageReference'`, and the version that wins is arbitrary.
-
-**Fix (VERIFIED on SDK 8).** Stop injecting into DBT files. Put one line in the root, or nearest, `Directory.Build.props`:
-```xml
-<CustomAfterDirectoryBuildTargets>$(CustomAfterDirectoryBuildTargets);$(MSBuildThisFileDirectory).socket/vendor/nuget/socket-patch.targets</CustomAfterDirectoryBuildTargets>
-```
-- `Microsoft.Common.targets:55` imports that property after the whole DBT chain, so ordering no longer matters. With this line the redirect applied and the build passed.
-- It is also imported without the `ImportDirectoryBuildTargets` condition, so `vendor_nuget_dbt_disabled` becomes unnecessary.
-- This needs a gating experiment on SDK 6 and 7 (MSBuild 17.0 to 17.7) to confirm the property exists there.
-
-### B3. Windows `core.autocrlf=true`, the Git for Windows default, breaks every build (VERIFIED by simulation, e1/clone)
-**Cause.** An extracted seed contains text files: `.nuspec`, `lib/**/*.xml`, `LICENSE.md`, `.nupkg.metadata`, and content, build and props files. With `autocrlf=true`, git rewrites them to CRLF on checkout.
-
-**Result.** Every affected project fails with `SOCKETPATCH002 vendored NuGet seed file modified`. Today's layout commits a binary `.nupkg` and is immune, so this is a regression specific to the new layout.
-
-**Fix (VERIFIED: the clone builds).** Generate `.socket/vendor/nuget/.gitattributes` containing `* -text -diff -merge`, and treat it as a reserved name. Also decide how to handle a root `.gitattributes` that puts `*.dll` under git LFS: a clone without LFS gets pointer files and fails SOCKETPATCH002. Either add `-filter` or refuse with `vendor_artifact_lfs`.
-
----
-
-## Major
-
-### M1. A multi-target transitive pin is not conditioned on TFM (VERIFIED, e3)
-**Setup.** ToolA targets `net8.0;netstandard2.0`. Bson is referenced only for netstandard2.0.
-
-**Result.** The §6.3 pin has no `$(TargetFramework)` condition. It adds `Newtonsoft.Json [12.0.1.N]` as a new **Direct** dependency to `net8.0`, which previously had `{}`.
-- The CLI plans edits only for the TFMs where the id resolves, so locked mode fails NU1004.
-- Lockless builds start shipping a new dll for net8.0.
-- If the other TFM resolved a higher version, this becomes an NU1605 downgrade.
-
-**Fix.**
-- Add `and '$(TargetFramework)' == '<alias>'` to each pin condition.
-- Map aliases to lock keys. The lock uses `.NETStandard,Version=v2.0`, not `netstandard2.0` (VERIFIED), so this needs a real alias-to-framework mapping. Refuse custom aliases.
-
-### M2. A consumer outside the `.socket` root breaks, and the B1 fix would make it silent (VERIFIED, e8)
-**Setup.** A project outside the root (a sibling repo, or a monorepo where `.socket` lives in a subdirectory) references the patched Lib through ProjectReference.
-
-**Results:**
-- With `[V′]`: `NU1102 Unable to find Newtonsoft.Json (= 13.0.1.N)`. The consumer does not import the targets, so it has no fallback folder.
-- With `[V′, )`: `NU1603` and a silent resolve of **13.0.2**.
-
-**Fix.**
-- The planner walks ProjectReferences in both directions. It refuses (`vendor_nuget_external_consumer`) when a project outside the root references a redirected project, or when a redirected project is listed in a `.sln` or `.slnf` above the root.
-- Document that `.socket` must sit at the root of the solution.
-
-### M3. SOCKETPATCH004 fires after the leaking `.nupkg` is already written (VERIFIED, e5)
-**Result.** With range restore disabled, `dotnet pack -o out3` fails SOCKETPATCH004, but `out3/Lib.1.0.0.nupkg` already exists and has `<dependency id="Newtonsoft.Json" version="[13.0.1.1843260417]"/>`. PackTask writes the nuspec and the nupkg in the same step. A later `nuget push out/*.nupkg`, or a retry, publishes a package that consumers cannot restore. The "fail-closed" claim is false.
-
-**Fix.**
-- Add a pre-check `BeforeTargets="GenerateNuspec"` against the rewritten pack assets.
-- On a post-check failure, delete `@(NuGetPackOutput)` before raising the error.
-
-### M4. The pack guard fails with MSB4184 when `obj` holds more than one nuspec (VERIFIED, e5)
-**Result.** Pack once, then again with `-p:Version=1.0.1`. `$(NuspecOutputAbsolutePath)*.nuspec` matches both `Lib.1.0.0.nuspec` and `Lib.1.0.1.nuspec`, and `ReadAllText("a;b")` fails the pack. Local and CI version bumps hit this routinely.
-
-**Fix.** Read exactly `$(NuspecOutputAbsolutePath)$(PackageId).$(PackageVersion).nuspec`, or filter `@(NuGetPackOutput)` by extension.
-
-### M5. The guard does not run for non-SDK csproj files that use PackageReference (REASONED; no mono here)
-**Cause.** Legacy WPF and WinForms csproj files with PackageReference import DBT, so the redirect applies. They do not have `ResolvePackageAssets` or `RuntimeCopyLocalItems`, so SOCKETPATCH002, 003 and 005 silently never run.
-
-**Fix.** Detect a project with no `Sdk` that uses PackageReference, and refuse it or route it to legacy. Alternatively, hook `ResolveNuGetPackageAssets` and `@(ReferenceCopyLocalPaths)` and gate that on the Windows leg (G8).
-
-### M6. NuGetAudit still flags V′ (VERIFIED, e1)
-**Result.** `warning NU1903: Package 'Newtonsoft.Json' 12.0.1.1843260417 has a known high severity vulnerability`. §2.3's "no false NU1903" holds only when the advisory's fixed version is V's own next patch. Here the fix is in 13.0.1, so `12.0.1.N` still falls inside `< 13.0.1`.
-- Repos that treat NU1903 as an error stay broken after patching.
-- NuGetAuditSuppress is out of the prototype's scope and needs NuGet 6.11 or later (SDK 8.0.4xx). The 8.0.1xx SDK here cannot use it.
-
-**Fix.** State the limitation in the design. Ship NuGetAuditSuppress with the prototype. On older SDKs, emit an informational `vendor_nuget_audit_still_flags`.
-
-### M7. The closure planner misses whole project types and version spellings (VERIFIED and REASONED)
-- **VERIFIED (e9):** `Version="13.0.1.0"` means the same to NuGet as 13.0.1, but the literal redirect does not match it. The result is SOCKETPATCH005, and NU1004 if the CLI edited the lock. Render one condition per recorded literal spelling, or refuse the non-canonical spelling.
-- **REASONED:** the enumerator looks only at `*.csproj|fsproj|vbproj`. It misses NoTargets and Traversal `.proj` files (from `global.json` `msbuild-sdks`), `.sqlproj`, `.esproj`, and others. They import DBT, so they get redirected with no lock edits. Enumerate `*.*proj` plus the projects listed in the sln.
-- **REASONED:** property-expanded versions (Arcade `eng/Versions.props`) and `NuGetLockFilePath=$(MSBuildProjectDirectory)/…` depend on `dotnet msbuild -getItem`/`-getProperty`, which need MSBuild 17.8, i.e. SDK 8. Repos whose `global.json` pins SDK 6 or 7 get refused. Also, a `global.json` SDK that is not installed on the vendoring machine breaks every `dotnet msbuild` call.
-
----
-
-## Minor
-
-1. **The lock golden table is wrong for CPM with pinning on (VERIFIED, e5).** With the uniform `PackageVersion Update`, the entry stays `CentralTransitive` and only `requested` becomes `[V′, V′]`. It does not turn into Direct.
-2. **Pin conversion reorders lock entries (VERIFIED, e3).** NuGet writes Direct entries first. Plain and locked restores do not rewrite a lock whose order differs, but `--force-evaluate`, Dependabot relocks, and the `--nuget-relock` text-diff check all see churn. Compare semantically, and write the canonical order.
-3. **One tampered seed file fails every project (VERIFIED, e1).** The whole-inventory `SocketPatchSeedFile` hash made Tool, which only uses the 12.0.1 seed, fail for a tampered 13.0.1 seed. The cost also scales with the total seed size times the number of projects; think of native-heavy packages such as SkiaSharp. Filter on `PackageKey` for the packages this project resolved.
-4. **An exact-bracket declared literal `[13.0.1]` is widened by pack range restore to `[13.0.1, )` (REASONED).** Render the replacement from the recorded literal.
-5. **F# FSharp.Core and other implicit, SDK-versioned references drift across SDK versions (REASONED; props file checked).** Their version comes from the SDK that `global.json` resolves (`Microsoft.FSharp.NetSdk.props:95`). Refuse ids with `IsImplicitlyDefined`.
-6. **The `vendor_nuget_tool_manifest` refusal is aimed at the wrong thing (REASONED).** `dotnet-tools.json` lists tool packages, and their dependencies are bundled inside those packages. MSBuild never resolves them. Say that tools cannot be patched, and keep the crawler from reporting that they are covered.
-7. **RID lock sections list only packages with RID-specific assets (VERIFIED, e3/Rid).** Newtonsoft is absent from `net8.0/linux-x64`. RID edits matter only for packages that ship `runtimes/`. Add goldens for such a package, for example SqlClient.
-8. **Windows MAX_PATH.** A 36-character uuid directory plus a long id plus a 4-part V′ is about 225 characters under `C:\agent\_work\1\s`. Use a short uuid8 directory.
-9. **Analyzer-only packages are invisible to the guard (G1 still open).**
-
----
-
-## How the verdict changes
-
-The D base is sound for GPF safety, source mapping, and CPM with static-graph restore. It is **not** ready for its own "Supported" rows:
-- multiple versions of one id;
-- a patched library consumed next to a higher-versioned sibling;
-- nested DBT chaining;
-- multi-TFM transitive-only projects;
-- Windows checkouts.
-
-**Minimum changes before prototype acceptance:**
-1. `[V′, )` redirect plus SOCKETPATCH006.
-2. Project-range edits in every lock that consumes a redirected project.
-3. Injection through `CustomAfterDirectoryBuildTargets`.
-4. TFM-conditioned pins.
-5. The seed `.gitattributes`.
-6. Pack guard pre-check, deletion of the bad nupkg, and an exact nuspec path.
-7. The external-consumer refusal.
-
-Add e2, e3, e7 and the autocrlf clone as docker and e2e legs.
\ No newline at end of file
diff --git a/docs/design/nuget-vendoring-research/code-map.md b/docs/design/nuget-vendoring-research/code-map.md
deleted file mode 100644
index 3ef66df0..00000000
--- a/docs/design/nuget-vendoring-research/code-map.md
+++ /dev/null
@@ -1,228 +0,0 @@
-# socket-patch NuGet implementation map (branch v5/nuget-vendoring, read-only)
-
-All paths are relative to `/home/user/socket-patch/crates/`. Where a line number carries a `~` it points to the right block but is not exact.
-
-## 1. Backend interface a new vendored layout must implement
-
-**There is no trait.** Backends are free functions with one shared signature. The CLI calls them through `match` arms.
-
-**Vendor entry** (the same 9 arguments for every backend), `socket-patch-core/src/vendor/nuget_feed.rs:399`:
-```rust
-pub async fn vendor_nuget(purl: &str, installed_dir: &Path, project_root: &Path,
-    record: &PatchRecord, sources: &PatchSources<'_>, vendored_at: &str,
-    dry_run: bool, force: bool, service: Option<&VendorServiceConfig>) -> VendorOutcome
-```
-
-**Revert entry**, `nuget_feed.rs:762` and `:772`:
-```rust
-pub async fn revert_nuget(entry: &VendorEntry, project_root: &Path, dry_run: bool) -> RevertOutcome
-pub async fn revert_nuget_opts(entry: &VendorEntry, project_root: &Path, opts: RevertOpts) -> RevertOutcome
-```
-
-**Service preflight**, `nuget_feed.rs:372`:
-```rust
-pub(crate) async fn service_preflight(purl, project_root, record) -> Option<PlannedDownload>
-```
-- It must run the same refusal checks as `vendor_nuget`, so the download plan never asks the service for a package the loop will refuse. Today it shares `nuget_prelude` (`:243`) for this.
-- It is routed from `vendor/mod.rs:918` (the nuget arm is at `:932`).
-
-**Dispatch points** in `socket-patch-cli/src/commands/vendor.rs`:
-- `dispatch_vendor_one` (`:112`) uses the `vend_installed!` macro (`:168-190`). That macro asserts `PackageSource::Installed`, because NuGet and Maven have no registry-fetch rung. The nuget arm is at `:215`.
-- `SERVICE_ECOSYSTEMS` includes nuget (`:135`).
-- `dispatch_revert_one_opts` (`:237`), nuget arm at `:245`.
-- `dispatch_in_use_one` (`:256`) returns `None` for nuget, so there is no in-use probe.
-
-**Types**
-- `vendor/mod.rs`:
-  - `VendorWarning` `:142`
-  - `VendorServiceConfig` `:268`
-  - `VendorOutcome::{Refused{code,detail}, Done{result: ApplyResult, entry: Option<VendorEntry>, warnings}}` `:785`
-  - `RevertOpts{dry_run, keep_artifact}` `:801`
-  - `RevertOutcome{success, warnings, error, kept_artifact}` `:824`
-  - `force_apply_staged` `:732`, which applies the patch into a private stage and is hash-gated.
-- `vendor/state.rs`:
-  - `VendorArtifact{path, sha256, size, platform_locked, file_inventory}` `:52`
-  - `WiringAction{Rewritten, Added}` `:83`
-  - `WiringRecord{file, kind, action, key, original, new}` `:97`
-  - `VendorEntry` `:212`
-  - `VendorState` `:324`
-  - `VENDOR_STATE_REL = ".socket/vendor/state.json"` `:43`
-  - `VENDOR_MARKER_FILE = "socket-patch.vendor.json"` `:764`
-  - `VendorEntry::committed_artifact_intact` (a sha256 check of file artifacts), right after `:212`.
-
-**Shared helpers to hook into**
-- `vendor/common.rs`: `refused`, `done`, `already_patched_result`, `prepare_memory_repack`/`MemoryRepack`, `rebuild_zip`, `write_zip_entries`, `zip_bytes_match_after_hashes`, `any_live_file_references` (`:993`), `prune_empty_vendor_levels`.
-- `vendor/path.rs`:
-  - `vendor_uuid_dir_rel("nuget", uuid)`
-  - leaf parser for `nuget` at `:280-286`, with `split_nuget_leaf` at `:207`
-  - ecosystem list at `:44`
-- `vendor/ledger_snapshots.rs:56-62`: `WHOLE_FILE_KINDS` includes `"nuget_config_source"`. Whole-file values of 1024 bytes or more (`SNAPSHOT_MIN_BYTES`) are stored as diff ops, and those ledgers are written as version 2.
-- `vendor/verify.rs:93-102, 488-498, 711`: `.nupkg` is treated as a single committed zip file, and its members are checked against the afterHashes.
-- `vendor/reuse.rs:1-12`: the reuse path is for npm/pypi only. NuGet decides "in sync" from the committed artifact itself.
-- `vendor/service_fetch.rs:155-240`: `service_archive_copy` returns `ServiceCopy::{Used, HardFail, FallBack}` (the Tier-A path).
-- `socket-patch-cli/src/commands/repair_vendor.rs:105-129`: `WIRING_FILES` **does not include `nuget.config`** (see §7).
-
-## 2. Current on-disk layout, edits, state record and revert
-
-**Artifact**
-- Path: `.socket/vendor/nuget/<uuid>/<idLower>.<versionNorm>.nupkg` (`nupkg_leaf` `:172`, `normalize_nuget_version` `:125`). The normalizer mirrors the TS `normalizeNuGetVersion` and the two must stay in sync.
-- Marker `socket-patch.vendor.json` is written beside it (`:664`).
-- The uuid dir is the local folder feed itself (module doc `:8-18`).
-
-**Source key:** `socket-patch-<uuid>` (prelude, around `:280`).
-
-**nuget.config** (`build_config_edit` `:1161`)
-- Config lookup is root-only. `existing_config_path` (`:1145`) probes `nuget.config`, then `NuGet.Config`. It does not probe `NuGet.config`, although `nuget_config.rs:228` `CONFIG_NAMES` lists all three.
-- **No config:** writes a fresh file (`:1171-1195`) containing the nuget.org source plus ours, and a mapping of `nuget.org → *` plus `socket → <exact id>`. It is written to `project_root/nuget.config` (`:599`).
-- **Existing config** (`:1196-1285`):
-  - Anchors are found on a comment-blanked view (`blank_comments` `:1292`).
-  - Our `<add>` is inserted before `</packageSources>`. A self-closing `<packageSources/>` is expanded (`:1390`), and if the section is missing it is created before `</configuration>`.
-  - If `</packageSourceMapping>` exists, only our `<packageSource>` block is appended.
-  - Otherwise a new mapping is created that fans `*` out to every pre-existing source key (`parse_config_source_keys` `:1330`). nuget.org is seeded if there are none.
-  - It errors if there is no `</configuration>`.
-
-**packages.lock.json** (`edit_lock` `:1545`)
-- Only the root `project_root/packages.lock.json` is considered (`:93`).
-- Every `dependencies.<tfm>.<id>` entry (case-insensitive) whose `resolved` normalizes to the version (`locked_at` `:208`) gets `contentHash` replaced with `base64(sha512(nupkg))` (`content_hash` `:1116`).
-- This is a string replace of the quoted old hash, so formatting is preserved.
-- Entries that disagree on the hash cause a failure. An entry with no match gives the `vendor_nuget_lock_entry_absent` warning (`~:633`). A missing lock gives `vendor_nuget_no_lockfile` (`:653`).
-
-**Edit order:** artifact → config → lock. A failure in the lock step unwinds the config and deletes the uuid dir (`unwind_config` `:1641`, called around `:619` and `:646`).
-
-**state.json entry** (`nuget_entry` `:713`)
-- Fields: `ecosystem:"nuget"`, `basePurl`, `uuid`, `artifact{path, sha256 (plain hex of the nupkg), size}`. All the extras (`lock`, `flavor`, `uv`, …) are `None`.
-- The CLI adds `detached`/`record`.
-- Wiring records, in application order (`:678-705`):
-  1. `nuget_config_source`: `file` = the config basename; `Added` if we created the file, otherwise `Rewritten`; `key` = the source key; `original` = the whole pre-vendor file text (or none); `new` = the whole post-edit file text. This is the authoritative revert record.
-  2. `nuget_config_mapping`: `Added`, `key` = the id, `new` = the mapping fragment. Audit only.
-  3. `nuget_lock_entry`: `Rewritten`, `key` = the id, `original` = the old contentHash, `new` = the new one.
-- Example: `socket-patch-cli/tests/fixtures/legacy-ledgers/nuget/wired/.socket/vendor/state.json`.
-
-**Hot path** (prelude, around `:318-345`; `vendor_nuget` `:437-535`)
-- `config_wired` is a plain substring test: does the config text contain the source key?
-- `in_sync` also requires the committed nupkg's members to match the afterHashes, and the lock to be pinned (or to have no matching entry).
-- Wired and in sync: returns `AlreadyPatched` with no entry.
-- Wired but stale: rebuilds only the artifact and re-pins the lock (with `original: None`; the CLI's `carry_forward_wiring` fills it in), and warns `vendor_artifact_rebuilt`. The config is never touched on this path.
-
-**Revert** (`revert_nuget_opts` `:772`)
-- The uuid is validated first.
-- Records are walked in reverse:
-  - Lock (`revert_lock_record` `:1606`): replaces our hash with the original. If ours is gone but the original is present, it counts as done. Otherwise it is drift.
-  - Mapping record: no-op.
-  - Config (`revert_config_record` `:1419`):
-    - The file name must be a safe single segment.
-    - If the live file is byte-identical to `new`: restore `original`, or delete the file if we created it.
-    - Otherwise: excise only our verbatim `<add …/>` line and our `<packageSource key=…>` block (`excise_source_mapping` `:1507`).
-    - If neither is present: drift (`Ok(false)`).
-    - The catch-all mapping is left in place.
-- **Drift-keep** (`:844-860`): if any record drifted and a live wiring file still contains the uuid dir path, the artifact is kept (`kept_artifact`) so the exclusive mapping is not left pointing at a missing dir.
-- Otherwise `remove_tree_and_prune` runs (`:871`). `keep_artifact` supports `--preserve-state`.
-
-## 3. Supported and refused project shapes
-
-**Explicit refusals** (prelude `:250-310`)
-- Not a NuGet purl, non-canonical uuid, or id/version outside `[A-Za-z0-9._+-]` → `unsafe_coordinates`.
-- Unreadable config → `vendor_nuget_config_unreadable`.
-- Unreadable lock → `vendor_nuget_lock_unreadable`.
-- No cached `.nupkg` → `vendor_nupkg_not_found` (`:962`).
-- A config without `</configuration>` → a failed result (not a refusal).
-
-**Everything else is accepted without detection:**
-
-| Shape | Handling today |
-|---|---|
-| **No lockfile** | Accepted with a warning. There is no content pin (`:653`; `docs/ecosystems.md:382-386`). |
-| **Existing mapping** | Accepted. Our block is appended (`:1255-1260`). Nothing checks whether another source already maps the same exact id. NuGet then treats both sources as eligible, so the patched copy is not guaranteed. The vex doc lists this as a non-goal (`vex/discover/nuget.rs:59-65`). |
-| **Multi-project / per-project locks** | Only the root `packages.lock.json` and root `nuget.config` are used (`:93`, `:1145`). Locks in sub-projects are never pinned. Parent-dir or user-level configs, `<clear/>`, and custom `NuGetLockFilePath` are not handled (`vex/discover/nuget.rs:59-65`). The crawler reads `obj/project.assets.json` one level deep (`crawlers/nuget_crawler.rs:483-498`), but only to find package folders. |
-| **CPM (`Directory.Packages.props`)** | Not referenced anywhere. No refusal and no special handling. A typical CPM solution keeps its locks per project, so it falls into the "no lockfile" warning path. |
-| **packages.config** | Recognized as a .NET marker (`nuget_crawler.rs:419-436`), and the legacy `packages/<Name>.<Version>/` dir is crawled. `vendor_nuget` accepts that dir as `installed_dir` (doc `:392-397`). No special handling and no test for restore under packages.config. |
-| **Warm global cache** | Every real-restore test uses a cold `NUGET_PACKAGES` (`docker_e2e_vendor_nuget.rs:185-224`; `e2e_nuget_dotnet_build.rs` also uses a "cold `NUGET_PACKAGES`"). A same-id/version pristine copy already in `~/.nuget/packages` is untested. |
-
-## 4. How the patched .nupkg is built (`materialise_patched_nupkg` `:892`)
-
-1. **Service first.** `service_archive_copy(service, record, name, ".nupkg")` (`service_fetch.rs:169`).
-   - It POSTs `/v0/orgs/{slug}/patches/package` (or the public proxy's `/patch/package`) and GETs the grant URL (`api/client.rs:1106-1113`).
-   - The SRI is checked, and every member must hash to its afterHash, before the bytes are written verbatim.
-   - An integrity mismatch is always a hard failure.
-   - A miss under `auto` falls back to the local build. Under `--vendor-source=service` it is refused (`vendor_prebuilt_required`).
-2. **Local rebuild** (`local_rebuild` `:949`).
-   - `locate_cached_nupkg(installed_dir)` (`:1123`) takes the first `*.nupkg` in the crawler's package dir. That is `~/.nuget/packages/<idLower>/<ver>/` or `$NUGET_PACKAGES`, or the legacy `packages/<Name>.<Ver>/`. **The pristine bytes therefore come from the global packages folder** (or the legacy folder), never from a registry: NuGet has no fetch rung (`vendor.rs:168-170`).
-   - The in-memory repack (`prepare_memory_repack`, which also stages `.nupkg.metadata` and `*.nupkg.sha512`), then `force_apply_staged`, which also runs the sidecar fixup.
-   - Deterministic lexicographic re-zip that drops `.signature.p7s` (`rebuild_nupkg_bytes` `:1079`, `SIGNATURE_PART` `:108`).
-   - The upstream id and version are kept, with the same filename leaf.
-
-## 5. Hosted NuGet (`patch/redirect/mod.rs`)
-
-**Entry point:** `rewrite_nuget` (`:5317`), registered at `:449`.
-- It reads only a root `nuget.config` (lowercase) and `packages.lock.json` (`scan/hosted.rs:75-76`, `mod.rs:5330`, `:5346`). If there is no config it starts from `default_nuget_config()` (`:5127`).
-- An unparseable lock skips the whole NuGet rewrite (`redirect_nuget_lock_unparseable`).
-- Per dep it requires a `nuget-v3` override and a sha512 (`:5362-5376`).
-
-**Config**
-- `add_nuget_source` (`:5142`) adds `<add key="socket-patch-<uuid>" value="<indexUrl>"/>`. It seeds nuget.org when the new mapping would otherwise have no catch-all target.
-- If there is no mapping, it creates socket-exact-id plus a `*` catch-all for each pre-existing source. If a mapping exists, it prepends only ours after `<packageSourceMapping>`.
-
-**Lock**
-- For every framework entry whose id matches (**id only, not version**; `:5431`), it sets `resolved` = `nugetVersionNorm` and `contentHash` = the SRI with `sha512-` stripped.
-
-**URL form** (fixtures `socket-patch-core/tests/fixtures/redirect/nuget/packages-lock/{basic,empty-sources,empty-sources-selfclosing,no-preexisting-mapping}`):
-- index: `https://patch.socket.dev/patch-registry/nuget/<grantToken>/<uuid>/index.json`
-- artifact: `…/<uuid>/flat/<idLower>/<ver>/<idLower>.<ver>.nupkg`
-- The data comes from `api_client.fetch_registry_references` (`scan/hosted.rs:1244`, `client.rs:748-776`, same POST `…/patches/package`). Integrity is taken from the reference's `tarball`-kind artifact (`hosted.rs:1281-1287`).
-
-**Why hosted revert is unsupported**
-- The config `FileEdit` records only `new: {source, pattern}` with `original: None` (`:5413-5421`). No pre-edit snapshot exists, so it cannot be inverted.
-- `replay.rs:181` classifies `redirect_nuget_source` and `redirect_nuget_lock` as `Inverse::Unsupported`; the module doc `:20-23` says these groups refuse with `hosted_revert_unsupported`.
-- `takeover.rs:79-83` `redirect_revert_supported` covers only cargo, npm and golang. So vendored takeover of a hosted NuGet purl is also blocked (`vendor.rs:1585`, `:2416`), and `remove.rs:1359` reports `hosted_revert_unsupported`.
-- The v5 plan (`docs/design/v5-plan.md` WS1) replaces this with a re-resolve from nuget v3.
-- Hosted in-memory mode can't take inventory from NuGet either (`hosted_memory/roots.rs:51` `UNSUPPORTED_MARKERS`).
-
-## 6. Tests and how to run them
-
-Run everything from `/home/user/socket-patch`.
-
-| Test | Needs | Gate / command |
-|---|---|---|
-| Inline unit tests in `nuget_feed.rs` (from `:1662`, roughly 3.7k lines: config surgery, lock, revert, drift, hot path, service, tamper guards) | nothing | `cargo test -p socket-patch-core --lib nuget_feed` |
-| `socket-patch-core/tests/covgap_vendor_nuget_feed.rs` (TMPDIR failure; `cfg(unix)`) | nothing | `cargo test -p socket-patch-core --test covgap_vendor_nuget_feed` |
-| `crawler_nuget_e2e.rs`, `redirect_golden.rs` (shared TS goldens), redirect `mod.rs` tests `:7915+`, `replay.rs:3406` | nothing | `cargo test -p socket-patch-core` |
-| `socket-patch-cli/tests/e2e_vex_lockfile/nuget.rs` (module in the `e2e_vex_lockfile` binary; hermetic, wiremock, no dotnet) | nothing | `cargo test -p socket-patch-cli --test e2e_vex_lockfile nuget` |
-| `e2e_nuget.rs` (crawl only, wiremock proxy) | nothing | `#[ignore]` at `:182`, `:250`; run with `cargo test -p socket-patch-cli --test e2e_nuget -- --ignored` |
-| `e2e_nuget_dotnet_build.rs` (hosted `:725` + vendored `:834`, real SDK, needs nuget.org) | host `dotnet` + network | `#[ignore]`; soft-skips without dotnet unless `SOCKET_PATCH_DOTNET_E2E_REQUIRED=1`; `SOCKET_PATCH_DOTNET_E2E_VERSION=8` picks the SDK; `cargo test -p socket-patch-cli --all-features --test e2e_nuget_dotnet_build -- --ignored` |
-| `docker_e2e_nuget.rs` (apply chain, `:570`, `:607`) | Docker image `socket-patch-test-nuget:latest` | `#![cfg(feature="docker-e2e")]`; soft-skips if the image is missing (`:482`); `cargo test -p socket-patch-cli --features docker-e2e --test docker_e2e_nuget` |
-| `docker_e2e_vendor_nuget.rs` (`:472`: 3-stage vendor → cold offline `--locked-mode` restore → RED/TAMPER(NU1403) → idempotence and revert) | Docker (SDK 8.0) | `--features docker-e2e --test docker_e2e_vendor_nuget` |
-| `setup_matrix_nuget.rs` | host guard runs; `dotnet()` is `#[ignore]` (baseline gap) | `--features setup-e2e --test setup_matrix_nuget` |
-| Other hermetic CLI tests (`in_process_get_hosted_ecosystems.rs:532`, `in_process_scan.rs:1374`, `in_process_rollback_all_ecosystems.rs:552`, `apply/e2e_safety_advisories.rs`, `ecosystem_dispatch_e2e.rs:310,986`, `vendor_ecosystem_fixtures/mod.rs:748`, `e2e_vex_vendor.rs`, `e2e_vendored_production.rs`) | nothing (production suites are canaries) | normal `cargo test -p socket-patch-cli --test <name>` |
-
-**Docker images:** build `tests/docker/Dockerfile.base` tagged `socket-patch-test-base:latest`, then `tests/docker/Dockerfile.nuget` (FROM `mcr.microsoft.com/dotnet/sdk:8.0`, copies the binary from base) tagged `socket-patch-test-nuget:latest`.
-
-**CI (`.github/workflows/ci.yml`)**
-- `coverage-docker` (`:455`, matrix `:479`) and `e2e-docker` (`:1390`, matrix `:1398`) run `docker_e2e_nuget`, adding `docker_e2e_vendor_nuget` at `:561` and `:1447`.
-- `e2e` (`:675`) runs `suite: e2e_nuget` (`:696`) and `e2e_nuget_dotnet_build` for dotnet 6/7/8/9/10 on ubuntu and 8 on macOS (`:1057-1064`, setup-dotnet at `:1248`, env at `:1351`). The default filter is `--ignored` (`:1353`).
-- `setup-matrix` (`:1634`) is non-blocking.
-
-## 7. Known TODOs and limitations
-
-- `v5-plan.md:30-31`: "a better vendored story for … NuGet (… NuGet feed is fragile). Keep the current behavior; do not invest further now."
-- There are no literal `TODO`/`FIXME` comments in the NuGet files. Documented non-goals are in `vex/discover/nuget.rs:59-65`: parent/user configs, per-project locks, `<clear/>`, a non-Socket source that also maps the id, and `NuGetLockFilePath`.
-- **Orphan-sweep gap.** `nuget.config` is missing from `repair_vendor.rs` `WIRING_FILES` (`:105-129`). That list feeds both `repair`'s ledger reconstruction and `sweep_orphan_vendor_dirs` (`vendor.rs:283-326`). Separately, the config names the uuid dir rather than a leaf file. Together this likely means repair cannot recover a NuGet entry, and the sweep could delete a NuGet uuid dir that is still wired. This comes from reading the code only; no test was run to confirm it.
-- Config-name mismatch: vendor probes 2 spellings, vex/crawler probe 3, hosted probes only `nuget.config`.
-- The hosted lock rewrite matches on id regardless of version (`redirect/mod.rs:5431`).
-- The same id+version as upstream means the global-cache collision is untested (every test uses a cold `NUGET_PACKAGES`).
-- The signature is dropped, so the package reads as unsigned. This relies on NuGet's default signature validation mode being `accept` (`:15-18`).
-- Sidecar (agent mode): `patch/sidecars/nuget.rs:1-18` deletes `.nupkg.metadata` and only advises when `.nupkg.sha512` is present.
-- `dispatch_in_use_one` has no NuGet probe (`vendor.rs:256-265`).
-
-## 8. The NuGet crawler (`socket-patch-core/src/crawlers/nuget_crawler.rs`)
-
-- **Global mode** (`:37-49`): uses `--global-prefix` if given, else `NUGET_PACKAGES`, else `~/.nuget/packages` (`nuget_home` `:392`).
-- **Local mode** is gated by `is_dotnet_project(cwd)` (`:406`): a root entry that is `*.csproj`, `*.fsproj`, `*.vbproj`, `*.sln` or `*.slnx`, or `nuget.config` / `packages.config` in any casing. When the gate passes, paths are returned in this order:
-  1. `<cwd>/packages/` (legacy)
-  2. the global cache
-  3. the `packageFolders` keys of `obj/project.assets.json` in cwd and one level of subdirectories (`:472-512`)
-- **Layouts** (`classify_package_entry` `:228`):
-  - Global: `<name>/<version>/`, where the version must start with a digit (`:286-328`).
-  - Legacy: `<Name>.<Version>/`, split at the first `.`+digit (`:453`).
-  - A package is verified by `lib/` or a `*.nuspec` (`:331`).
-- It crawls **every package in those folders**. It does not filter by the project's dependency graph (it does not read assets targets or the lock).
-- The purl comes from the directory name, which is lowercased in the global cache.
\ No newline at end of file
diff --git a/docs/design/nuget-vendoring-research/critic.md b/docs/design/nuget-vendoring-research/critic.md
deleted file mode 100644
index a1d8a80e..00000000
--- a/docs/design/nuget-vendoring-research/critic.md
+++ /dev/null
@@ -1,84 +0,0 @@
-# NuGet vendoring research: critic pass (contradictions, verified gaps, open questions)
-
-I ran six experiments myself on SDK 8.0.131. Two results change the design:
-- **A committed repo-local package folder only survives if it is set through `RestorePackagesPath`.** If it is set through `nuget.config` `globalPackagesFolder`, a user's `dotnet nuget locals --clear` deletes it.
-- **Once a package is in that folder, NuGet never looks at sources or `packageSourceMapping` for it.** That makes the folder the only offline mechanism that does not depend on source mapping. The catch is that it also skips signature checks.
-
-Full notes are in `<scratch>/research/critic/FINDINGS.md`, with the helpers (`env.sh`, `mkpatch.py`) and `seed/`, `tmpl/`, `exp/` next to it. In the text below, "package folder" means NuGet's global packages folder (normally `~/.nuget/packages`), and "seed" means a patched package pre-extracted into a repo-local package folder.
-
-**Isolation incident.** My first experiment ran `dotnet nuget locals all --clear` before I had set `TMPDIR`. It cleared the shared `/tmp/NuGetScratchroot`, which is NuGet's temp directory. A restore running in another agent at that moment could have failed. `env.sh` now sets `TMPDIR`, and every later experiment used it.
-
-## 1. Contradictions and tensions between reports
-
-1. **Option C, the repo-local package folder, conflicts with the signing report.**
-   - The shapes and lock-cache reports recommend seeding a repo-local package folder.
-   - The signing report verified that anything already extracted into a package folder skips signature validation, even under `signatureValidationMode=require`. It says this "quietly gets around enterprise policy; should not document it".
-   - Consequence: if we adopt option C, the tool itself has to check the effective signature policy. It should refuse, or require a Socket author signer, when the policy is `require`. It cannot rely on NuGet to enforce it.
-2. **Which unique-version form to use.**
-   - The sources report recommends `X.Y.Z.N-socket.M`; the shapes and lock-cache reports recommend `X.Y.Z.N`.
-   - The trade-off: plain `X.Y.Z.N` collides with a real upstream 4-part version. The prerelease form never collides, but `pack` warns about it: **VERIFIED** `warning NU5104: A stable release of a package should not have a prerelease dependency` for `[13.0.3.1-socket.1]`, and no warning for `[13.0.3.1]`.
-   - Both forms leak into the nuspec of a packed library: **VERIFIED** `version="[13.0.3.1-socket.1]"` and `version="[13.0.3.1]"`.
-3. **How serious NU3005 is.**
-   - The shapes report says keeping the signature "does not work" and cites NU3005.
-   - The lock-cache and signing reports verified that NU3005 is only a warning and the package installs as unsigned.
-   - Reconciled: a malformed signature entry means "treated as unsigned". It fails only under `require` (NU3004) or when warnings are treated as errors (DOCS).
-4. **Whether NuGet trusts `.nupkg.sha512`.**
-   - The sources report says its content is ignored in a hierarchical feed; the lock-cache report says its text is copied when `.nupkg.metadata` is rebuilt for an unsigned package in the package folder.
-   - Both are correct, in different contexts. Either way the file is not a trust anchor.
-5. **Implications across reports for today's code.**
-   - The code map says vendoring appends an exact-id mapping to our feed. The shapes report verified that id-wide mapping breaks every other version of that id in the repo (NU1102 for Tool's 12.0.1). So current vendoring likely breaks multi-version repos whenever `nuget.config` already has a mapping.
-   - The hosted lock rewrite matches on id regardless of version (`redirect/mod.rs:5431`). Combined with the shapes finding that one id resolves to different versions per project, this would rewrite the wrong versions' entries.
-6. **Different bytes from the two build routes.**
-   - depscan repacks STORE-only; the local rebuild uses its own deterministic re-zip. The signing report verified that every layout change changes `contentHash`.
-   - So the service route and the local route give different lock pins. Verify and revert must hash the committed artifact, never a rebuild.
-
-## 2. DOCS claims worth verifying
-
-| Claim | Status |
-|---|---|
-| A dot-prefixed folder is excluded from SDK default globs (shapes) | **VERIFIED.** `.socket/nuget-packages/zz/1.0.0/Broken.cs` under a root-level csproj: `-getItem:Compile` lists only `Program.cs` and the build succeeds. Control: the same file in `pkgs-visible/` fails with `error CS1040`. |
-| Local folder feeds are not HTTP-cached (lock-cache) | **VERIFIED (partial).** After restoring from a folder feed there are no newtonsoft entries in `NUGET_HTTP_CACHE_PATH`, and `.nupkg.metadata` `source` is the folder path. |
-| An exact `[x]` dependency against a 4-part version gives NU1608 | Not verified. It needs a real package with an exact-version dependency. It matters for option B together with `TreatWarningsAsErrors`. |
-| CPM allows one `PackageVersion` per id | Not verified. Cheap to check. |
-| `require` mode has no per-package exemption; an untimestamped signature expires with its certificate | Not verified. The first is probably right given the NU3004 behaviour. |
-| nuget.exe behaviour for packages.config | Unverifiable here (see §4). |
-
-## 3. Research topics nobody covered, and my results
-
-Of the topics on the list, only packages.config is still open (§4). The rest are covered at least partly. These next ones were not on the list; the first four are now answered:
-
-- **V1: `dotnet nuget locals --clear` against a committed seed.**
-  - With `RestorePackagesPath=$(MSBuildThisFileDirectory).socket/nuget-packages` in `Directory.Build.props`, `locals all --list` does not show the repo folder, and `--clear` leaves the seed in place. **VERIFIED**
-  - With `nuget.config` `<add key="globalPackagesFolder" value=".socket/nuget-packages"/>` it printed `Clearing NuGet global packages folder: .../r/.socket/nuget-packages` and **deleted the committed seed**. **VERIFIED**
-  - Design rule: never point `globalPackagesFolder` in `nuget.config` at committed data.
-- **V2: a seed bypasses sources and mapping.**
-  - The mapping mapped only `Humanizer.*` to nuget.org and left Newtonsoft.Json unmapped: restore succeeded, with no NU1100, from the seed. **VERIFIED**
-  - The only source was `./does-not-exist`, `obj/` was deleted, and `dotnet restore --locked-mode` printed `Restored ... (in 252 ms)`. `dotnet run` printed `{"a":1}` and the output dll ends with `SOCKETPATCHED`. **VERIFIED**
-  - This confirms the lock-cache claim that mapping is never consulted once a package is in the folder.
-- **V2b: restore does not touch the seed.** `diff -r` of the seed before and after restore, build and run found no differences, so the git tree stays clean. **VERIFIED**
-- **V3: dot-folder globbing.** See the table in §2. A repo-local folder under a root csproj must be dot-prefixed, or covered by `DefaultItemExcludes`. **VERIFIED**
-- **Still uncovered:**
-  - `NuGetLockFilePath` and the `RestoreLockedMode` property
-  - static-graph restore (`RestoreUseStaticGraphEvaluation`)
-  - whether Visual Studio or nuget.exe honour `RestorePackagesPath`
-  - `dotnet test` with a repo-local folder
-  - macOS and Windows case-insensitivity for the seed path
-  - Dependabot/Renovate rewriting the version or lock
-
-## 4. Remaining unknowns
-
-- **packages.config.** A legacy csproj that imports `Microsoft.Common.targets` with a `packages.config`, run through `dotnet msbuild -t:restore -p:RestorePackagesConfig=true`, printed `Nothing to do. None of the projects specified contain packages to restore.` **VERIFIED.** DOCS: packages.config restore exists only in desktop MSBuild or nuget.exe. mono and nuget.exe are not installed, so it cannot be tested on this machine; it needs a Windows or mono CI leg.
-- **CI overrides.** A CI job that passes `-p:RestorePackagesPath` or `--packages` bypasses the seed. With the upstream hash in the lock this silently gives an unpatched build; with the patched hash it fails with NU1403 (shapes, VERIFIED). There is no way to prevent it, only to fail closed.
-- **Signature policy with a seed** (see §1.1). We would need a detection rule for an effective `require` policy across the user, machine and repo configs.
-- **Pack leak for option B.** There is no verified mitigation other than limiting option B to non-packable projects or transitive `PrivateAssets=all` redirects.
-
-## 5. Implications for vendoring a patched package with the upstream id+version
-
-1. The id+version can stay the same **only inside a package folder the repo owns**:
-   - **Location:** `RestorePackagesPath=$(MSBuildThisFileDirectory).socket/nuget-packages`. Import it from an Exists-guarded `.socket` props file that is chained into every nearest `Directory.Build.props`. The folder must be dot-prefixed (V3) and must not be set through `nuget.config` (V1).
-   - **Seed contents:** `<idlower>/<vernorm>/` holding `.nupkg.metadata`, the lowercase nuspec and `lib/`. No `.nupkg` or `.sha512` is needed. Git sees no changes after a restore (V2b).
-   - **Lock pin:** put the patched hash in both `.nupkg.metadata` and every lock in the closure, so bypassing the folder fails closed with NU1403.
-   - **Cost:** every other package also downloads into the repo folder, so `.gitignore` needs negation rules for the seed.
-2. With the seed in place, **no `nuget.config` edit is needed for the patched package** (V2). That removes the fragile source-mapping surgery, including the catch-all `*` and the multi-version NU1102 breakage. Revert is: delete the seed, restore the original lock hashes, and remove the props import. There is no global-cache eviction, because the shared package folder is never used.
-3. The seed skips signature validation. The tool must detect an effective `signatureValidationMode=require` and refuse, or sign the package and document the `<author>` signer entry. Otherwise the tool silently weakens the organisation's policy.
-4. Any shared-cache variant, meaning today's folder feed plus mapping, cannot be made safe. All reports agree on this: the first copy written wins, the wrong copy leaks both ways, and NU1403 repeats until the entry is evicted.
\ No newline at end of file
diff --git a/docs/design/nuget-vendoring-research/depscan.md b/docs/design/nuget-vendoring-research/depscan.md
deleted file mode 100644
index cd26a6d4..00000000
--- a/docs/design/nuget-vendoring-research/depscan.md
+++ /dev/null
@@ -1,204 +0,0 @@
-# depscan backend research for NuGet vendoring (for socket-patch v5)
-
-## TL;DR
-- depscan already builds **one prebuilt patched `.nupkg` per patch**. It keeps the **same id and version as upstream**, repacks the zip STORE-only, strips `.signature.p7s` and adds no signature. The bytes are written once to object storage, and their **sha512 SRI** is saved as `package_integrity`.
-- You can get it two ways:
-  - **Artifact route:** `/patch/nuget/...`. The vendoring service (`POST /v0/orgs/{org}/patches/package`) returns this URL, and socket-patch's `service_fetch.rs` already downloads and checks it.
-  - **Single-package NuGet v3 feed:** `/patch-registry/nuget/{token}/{uuid}/index.json`, used by hosted mode.
-- **For unsigned packages, NuGet's `contentHash` is the base64 sha512 of the nupkg bytes.** That equals `package_integrity` with the `sha512-` prefix removed. A dotnet e2e test proves this.
-- **A patched-version suffix exists for Maven (`<base>-socket.<hex8>`) and Go (`<base>-socketpatch.<n>`). NuGet has none.** NuGet is always served under the upstream id+version.
-- **Nothing is signed anywhere.** `sign.ts` is an identity stub, and there is no key custody.
-- **No NuGet-specific vendoring artifact exists server-side**, beyond the plain `.nupkg`. For comparison, gem has a stub gemspec, Go has the gopatch zip and npm has a berry zip.
-
----
-
-## 1. Hosted NuGet serving (patch-server)
-
-**Server entry:** `depscan/workspaces/patches/src/services/patch-serving/server.ts:65-80` registers three route families:
-- `/patch/...`: `registerPatchServeRoute` in `serve-route.ts`
-- `/patch-registry/...`: `registerPatchRegistryRoutes` in `registry-routes.ts:32`, one regex route that parses `req.path`
-- `/gopatch/...`
-
-**URL grammar:** `depscan/workspaces/lib/src/socket-patch/patch-url.ts:1-23`. These parsers are shared by the server and SBOM recognition.
-- Artifact URL: `https://{host}/patch/{eco}/{name}/{version}/{token}/{patch-uuid}/{filename}` (`parsePatchServeUrl`, :82)
-- Registry URL: `https://{host}/patch-registry/{eco}/{token}/{patch-uuid}/<tail>` (`parsePatchRegistryUrl`, :156)
-- Vendored path: `file:.socket/vendor/{eco}/{patch-uuid}/{leaf}` (`parseSocketVendorPath`, :253, a TS port of socket-patch `vendor/path.rs`)
-
-**NuGet v3 feed:** `nugetDecision` in `patch-serving/registry-decision.ts:361-427`. This is a pure function. It serves a feed containing exactly one package version, pinned by the uuid in the URL:
-
-| tail | response |
-|---|---|
-| `index.json` | Service index with only two resources: `PackageBaseAddress/3.0.0` → `{base}/flat/` and `RegistrationsBaseUrl/3.6.0` → `{base}/reg/` (:370-387). No search, autocomplete or catalog. |
-| `flat/{idLower}/index.json` | `{versions:[verNorm]}` (:389-396) |
-| `flat/{idLower}/{verNorm}/{idLower}.{verNorm}.nupkg` | Streams the object-store bytes with `ETag: "<sha512 SRI>"` (:397-406) |
-| `reg/{idLower}/index.json` | Minimal registration: one page, one leaf, with `catalogEntry:{id,version}` and `packageContent`. **No `packageHash`, no dependency groups, no `listed`** (:407-425) |
-
-**Gates, before any of the above** (`evaluateRegistryDecision`, :190-222):
-- `unpublished_at` set → 410
-- ecosystem mismatch → 404
-- `package_status !== 'built'` → 408, or 404 if the build failed
-
-**Artifact headers:** `archive-response-headers.ts:11`
-- `Cache-Control: public, max-age=3600, no-transform`, deliberately not `immutable`, so that revoking a grant still has an effect.
-- There is no `X-Socket-Patch-Unsigned` header, although `sign.ts` suggests one.
-
-**Bytes served:** the output of `nugetRepacker` in `patches/src/repack/repackers/nuget.ts:35-69`:
-- Unzips the upstream nupkg and substitutes the patched files.
-- Leaves the nuspec, id and version unchanged.
-- Removes `.signature.p7s` via `stripSignedArchiveMetadata` (`patches-shared/src/archive/repack-utils.ts:1290-1314`).
-- Re-zips with `store: true`, level 0 (`repack-utils.ts:696-701`).
-- The doc comment (:24-33) says unsigned output is the "current v1 contract".
-
-**Upstream fetch:** `patches/src/repack/upstream/nuget.ts:13-62`.
-- Downloads from `api.nuget.org/v3-flatcontainer` using the lowercased id and normalized version.
-- Does **not** verify against the registry `packageHash`. Per the comment at :49-59, only the per-file `before_sha` check applies.
-
-**Hash computation:** `patches/src/services/patch-package/build.ts:309-320`.
-- Computes `sha512-<b64>` (`package_integrity`), sha256 (`package_blob_file_hash`), sha1 and md5 over the archive.
-- Storage is write-once (:235-240); `gcs-store.ts:194-205` re-hashes on read-back.
-
-**Proof that `contentHash` equals `package_integrity` without the prefix:** `patches/src/test/integration/installers/nuget.installer.e2e.test.ts:1-36, 166-261`.
-- Uses a real `dotnet restore` against a folder feed with `<clear/>`.
-- Runs `--locked-mode` with fresh `NUGET_PACKAGES` and `NUGET_HTTP_CACHE_PATH`.
-- A negative leg swaps in the upstream package and expects NU1403.
-- Note: the test isolates the global packages folder precisely **because** the same id+version collides in the global packages cache.
-
-## 2. Vendoring service contract (server ↔ client pairing)
-
-**Endpoint:** `POST /v0/orgs/{org_slug}/patches/package`, defined in `depscan/workspaces/api-v0/src/endpoints/orgs/patches/package.ts:252-258` (operationId `getPatchPackages`).
-- **Request** (:37-42): `{uuids[], freeOnly}`.
-- **Response** (:137-169): `results[uuid] = {status, url, purl, artifacts[], registryOverride}`.
-  - `status` is one of `granted | reused | pending_build | build_failed | withdrawn | forbidden | not_found`.
-  - `artifacts[].kind` is one of `tarball | yarn-berry-zip | gem-stub-gemspec` (:121-134).
-  - Integrity fields: `{sha512, sha256, sha1, md5, dirhashH1, goModH1, yarnBerry10c0}` (:46-62).
-
-**Public proxy:** `POST /patch/package` in `depscan/workspaces/patches-api-proxy/src/server.ts:1003-1030` forwards to the same endpoint and forces `freeOnly`.
-
-**Core logic:** `depscan/workspaces/app/src/patches/patch-package-references.ts`
-- `getPatchPackageReferences` (:933).
-- `buildPatchPackageArtifacts` (:469-530): the tarball comes first and carries sha512, sha256, sha1 and md5. For NuGet that is the only artifact; it points at the `/patch/nuget/...` serve URL.
-- `buildRegistryOverride` for NuGet (:668-683) returns:
-  - `kind: 'nuget-v3'`
-  - `indexUrl: {base}/index.json`
-  - `nugetIdLower` and `nugetVersionNorm`
-  - **no hash** in the identifiers; the rewriter uses the artifact's sha512.
-
-**Client side (socket-patch):**
-
-| Step | File and lines |
-|---|---|
-| Choose endpoint: authenticated vs `/patch/package` proxy | `crates/socket-patch-core/src/api/client.rs:742-743`, `vendor_package_url` :1373-1386 |
-| Two-step request, then download; `patch_server_url` rewrites the download host | `fetch_vendor_package` :1115-1160, `_once` :1242-1350 |
-| Secondary artifacts | client.rs :1310-1348 |
-| Checks the sha512 SRI floor (plus Go `h1:`) and fails closed on mismatch | `vendor/service_fetch.rs:88-138` (`fetch_verified_archive`) |
-| Maven/NuGet path: service first, else local rebuild; `--vendor-source=service` hard-fails | `service_fetch.rs:170-200` (`service_archive_copy`) |
-| NuGet vendoring calls it | `vendor/nuget_feed.rs:906` |
-| Hosted-mode rewriter reads `nuget_id_lower` / `nuget_version_norm` | `patch/redirect/mod.rs:126-127, 449, 5126-5280` |
-
-The hosted-mode rewriter is mirrored in depscan: `depscan/workspaces/app/src/patches/registry-rewrite/nuget.ts:1-232`. It:
-- adds a source plus a `packageSourceMapping`, with a catch-all for existing sources (:160-211);
-- sets `contentHash` to the sha512 without the prefix and `resolved` to `nugetVersionNorm` (:69-112).
-
-**Answer to (2): yes, a prebuilt patched `.nupkg` is already available for vendoring.** socket-patch already consumes it through `service_fetch`. There is no NuGet-specific variant: no renamed or re-versioned build and no signed build.
-
-## 3. Patched-version suffix and distinct-identity precedents
-
-**Maven: `<base>-socket.<first-8-hex-of-uuid>`**
-- Derivation: `depscan/workspaces/app/src/patches/maven-suffix.ts:1-65`. `suffixMavenPom` rewrites the pom's `<version>` and literalizes `${project.version}`, or returns null so the caller falls back to the same GAV.
-- Serve: `registry-decision.ts:~430-470`. When the pom rewrite succeeds, the artifact is served only under the suffixed version and the bare-upstream paths return 404. There is deliberately no `maven-metadata.xml`, so version ranges cannot resolve it (fail-closed).
-- The pom's sha256 is published as `mavenPomSha256` (`package.ts:93-101`) for a trusted-checksum pin.
-- Note: the jar bytes themselves are not re-versioned; only the pom is.
-
-**Go: `<base>-socketpatch.<n>`, with the module re-homed to `patch.socket.dev/gopatch/<uuid>`**
-- `depscan/workspaces/lib/src/go/gopatch.ts:21-64`.
-- `GopatchFlavor` (`repack/ecosystem-repacker.ts:65-80`) is a **second stored artifact** with its own sha512 and `h1:`, stored in `build.ts:395-405, 485-500`.
-- Changed content must bump `<n>`, never reuse a version (`build.ts:487-491`; `patch-sync/import-db.ts:56`).
-
-**Other secondary vendoring artifacts:**
-- gem stub gemspec: `repackers/gem-stub-gemspec.ts`, stored in `build.ts:412-419`.
-- npm yarn-berry cache zip: `build.ts:344-390`.
-
-**NuGet:** none. There is no `-socket.N` prerelease, no `+socket` metadata and no distinct id. `normalizeNuGetVersion` actually **drops** `+metadata` (`repack/nuget-version.ts:1-35`). That makes `+socket` useless as a distinguisher, because NuGet also ignores build metadata for identity and for the global packages cache path.
-
-**Other ecosystems' vendored artifacts server-side:**
-- There is exactly one pipeline: the converter build in `services/patch-package/build.ts` feeding the `published_patches.package_*` columns (`queue.ts:410`), then the serve route.
-- There is no separate "vendor" build; vendoring reuses the hosted tarball.
-
-## 4. NuGet identity in depscan
-
-**PURL:** `depscan/workspaces/lib/src/purl/schema/nuget.ts:1-25`.
-- `pkg:nuget/<name>@<version>`, with no namespace.
-- The name keeps its case (spec: case-sensitive in the archive, case-insensitive for lookup).
-- `purl-full-name.ts:258-263` sets namespace to null.
-
-**Version normalization (three implementations kept in sync):**
-- `patches/src/repack/nuget-version.ts:15-35`: lowercase, drop `+meta`, strip leading zeros, pad to 3 parts, drop a zero 4th part.
-- `app/src/patches/patch-package-references.ts:555-590`.
-- socket-patch `vendor/nuget_feed.rs`.
-
-Serve paths, the upstream fetch and `nugetVersionNorm` all use the normalized form. The serve decision checks the tail against the row using `idLower` and `verNorm`.
-
-**SBOM:** the pipeline NuGet tasks (`pipeline/src/task/cs/nuget/**`) have **no Socket-patch reference detection**. That detection exists for npm, pypi and gem only (grep of `detectSocketPatchReference`/`parseSocketVendorPath` in `pipeline/src`). A patched NuGet dependency therefore shows up as plain upstream `name@version`. If the NuGet package id or version changed, SBOM/purl mapping would need new detection.
-
-## 5. Signing
-
-- `patches/src/repack/sign.ts:1-38`: `defaultSign` returns null.
-- The comments list a future `authenticode-p7s` kind for NuGet, but state "no key custody / KMS / HSM exists yet".
-- Columns `package_signature` and `package_signature_kind` exist (`ecosystem-repacker.ts:55-62`; `queue.ts:410-411`) and are always null.
-- There are **no repository or author signatures** for any ecosystem.
-- Consequence: consumers using `signatureValidationMode=require` or `<trustedSigners>` will reject Socket nupkgs. The nuget repacker comment (:27-31) acknowledges this.
-
----
-
-## What could live server-side for NuGet vendoring
-
-1. **Keep today's prebuilt `.nupkg` and add the missing integrity pieces.**
-   - Feasibility: exists; the additions are trivial.
-   - The artifact and its sha512 are already served. `contentHash` is the sha512 payload of that artifact.
-   - Cheap additions:
-     - put `packageHash`/`packageHashAlgorithm` into the registration leaf in `registry-decision.ts:407-425`;
-     - add dependency groups taken from the nuspec so the registration is spec-complete.
-   - This does not remove the global-packages-cache collision.
-
-2. **A Socket-suffixed NuGet flavor, `<ver>-socket.<hex8>` (prerelease), as a second artifact.**
-   - Feasibility: moderate. The Maven and Go flavors are close templates: `GopatchFlavor` storage in `build.ts:395-500`, and the fail-closed serve/404 pattern for bare paths in `mavenDecision`.
-   - Work required:
-     - rewrite `<version>` in the nuspec;
-     - rename the entry `{id}.nuspec` and possibly rebuild `[Content_Types].xml`/`_rels`;
-     - the flat path, registration and `normalizeNuGetVersion` then handle the new version as-is;
-     - add `nugetSuffixedVersion` to `RegistryOverrideIdentifiers` and a new `artifacts[].kind` (for example `nupkg-socket`).
-   - Benefit: removes the global-packages-cache collision, source-mapping ambiguity and fall-through to nuget.org.
-   - Costs:
-     - a prerelease version changes resolution semantics: floating ranges ignore prereleases, NU5104 warnings appear, and transitive `>= x` constraints are still satisfied;
-     - the consumer must change `<PackageReference Version>` or use central package management (CPM) / `Directory.Packages.props`;
-     - SBOM must learn to map `-socket.` back to the upstream purl (see §4).
-   - Using `+socket` metadata instead of a prerelease is **not viable**, because NuGet drops it for identity.
-
-3. **A distinct package id, e.g. `Socket.Patched.<Id>`.**
-   - Feasibility: low.
-   - Assembly and type identity would not change, but every transitive dependent still references the original id. It would need a shim or `PackageReference` aliasing that NuGet does not support. Not recommended.
-
-4. **Serve the vendored feed metadata server-side.**
-   - Feasibility: exists for hosted mode.
-   - The single-package v3 feed can be "ejected": socket-patch already gets the bytes. A local feed only needs the nupkg (a folder feed needs no metadata). Nothing extra is needed from the server.
-
-5. **Repository signature (`.signature.p7s`) with a Socket certificate.**
-   - Feasibility: not feasible now. There is no key custody (`sign.ts`).
-   - It would also make `contentHash` follow the signed-package rules, so it would no longer equal the plain sha512. The e2e test's claim would change.
-
-6. **Upstream `packageHash` recording, for the restore-upstream / revert of workstream WS1.**
-   - Feasibility: small to moderate.
-   - The server does not fetch or store the upstream nuget.org `packageHash` (`upstream/nuget.ts:49-59` skips it).
-   - Persisting the upstream sha512 and signed `contentHash` would let the CLI restore the original `packages.lock.json` entry offline. This addresses "hosted revert unsupported".
-
-7. **SBOM recognition of patched NuGet dependencies.**
-   - Feasibility: moderate. It does not exist today for NuGet.
-   - Needed if option 2 or 3 ships. It is useful even for same-version packages, via the `nuget.config` source URL or a `.socket/vendor/nuget/<uuid>` path.
-
-**Items that do not exist anywhere in depscan:**
-- a NuGet version suffix or distinct id;
-- any signing;
-- `packageHash` in the served registration;
-- an upstream NuGet digest check;
-- a vendoring-specific NuGet artifact;
-- NuGet patch detection in SBOM.
\ No newline at end of file
diff --git a/docs/design/nuget-vendoring-research/lock-cache.md b/docs/design/nuget-vendoring-research/lock-cache.md
deleted file mode 100644
index 19a75141..00000000
--- a/docs/design/nuget-vendoring-research/lock-cache.md
+++ /dev/null
@@ -1,81 +0,0 @@
-# NuGet lock-file and package-cache research (SDK 8.0.131, Linux)
-
-Every experiment ran with its own fresh HOME, NUGET_PACKAGES and NUGET_HTTP_CACHE_PATH under `<scratch>/research/lock-cache/exp/<name>/`. Full notes, commands and outputs are in `<scratch>/research/lock-cache/FINDINGS.md`. The helper scripts (`env.sh`, `mkapp.sh`, `lockhash.sh`, `work/mkver.py`) and the test feeds are in the same directory.
-
-Terms used below:
-- **GPF** is the global packages folder, normally `~/.nuget/packages`.
-- **Patched** means a copy of Newtonsoft.Json 13.0.3 with bytes appended to `lib/net6.0/Newtonsoft.Json.dll` and a `SOCKET_PATCHED.txt` file added.
-- **Upstream** means the unmodified package from nuget.org.
-
-## (a) What the lock file contains
-- **VERIFIED:** For a signed package, `contentHash` is the base64 sha512 of the .nupkg with the `.signature.p7s` entry removed. It is not the hash of the file as downloaded. `zip -d t.nupkg .signature.p7s; openssl dgst -sha512 -binary t.nupkg | base64` gave `HrC5BXdl…`, which matches the lock file. The hash of the raw file is `mbJSvHfR…`, which is what the GPF's `newtonsoft.json.13.0.3.nupkg.sha512` holds.
-- **VERIFIED:** For an unsigned package, `contentHash` is the sha512 of the file bytes (`hNLqr27u…` for the patched copy, both ways).
-- **VERIFIED:** `.nupkg.metadata` in the GPF holds `{"version":2,"contentHash":<same kind of hash as the lock>,"source":<feed>}`.
-- **VERIFIED** entry shapes:
-  - Direct: `{"type":"Direct","requested":"[13.0.3, )","resolved":"13.0.3","contentHash":…,"dependencies":{…}}`
-  - Transitive: `{"type":"Transitive","resolved","contentHash"}`
-  - Project: `{"type":"Project","dependencies":{"Humanizer.Core":"[2.14.1, )"}}`, with no hash
-  - CentralTransitive: `{"type":"CentralTransitive","requested":"[13.0.3.1, )",…}`. This needs Central Package Management with `CentralPackageTransitivePinningEnabled`.
-
-## (b) What restore does when hashes don't match
-- **VERIFIED, cold cache:** Empty GPF, feed has the patched package, lock pins the upstream hash, `--locked-mode`. It fails with `error NU1403: Package content hash validation failed for Newtonsoft.Json.13.0.3. The package is different than the last restore.` But the patched package has already been fully extracted into the GPF, `.nupkg.metadata` included. **A failed restore still poisons the cache.**
-- **VERIFIED:** GPF has upstream, lock pins patched, feed has patched: NU1403. Nothing is re-downloaded and the GPF is unchanged.
-- **VERIFIED:** GPF has patched, lock pins upstream: NU1403.
-- **VERIFIED, what NuGet compares against:**
-  - I left the upstream bytes in the GPF and edited only the `contentHash` in `.nupkg.metadata` to the patched hash. A locked restore against the patched lock **succeeded**.
-  - Editing only `.nupkg.sha512` still gave NU1403.
-  - So when a package is already in the GPF, NuGet compares the lock hash with the `.nupkg.metadata` value only. It never rehashes the .nupkg, the extracted files, or the feed bytes.
-- **VERIFIED:** NU1403 also happens **without** `--locked-mode` whenever a `packages.lock.json` exists and its hash differs.
-- **VERIFIED, other error codes:**
-  - NU1004: locked mode after a PackageReference changed (`The package references have changed for net8.0…`).
-  - NU1605: a direct reference to 13.0.3-socket.1 while a dependency needs >=13.0.3 (`Detected package downgrade: Newtonsoft.Json from 13.0.3 to 13.0.3-socket.1`). The SDK treats this warning as an error, yet the lock file was still rewritten.
-  - NU1102: the lock pins a version the feed doesn't have.
-- **VERIFIED, signatures:**
-  - Keeping a stale signature that is well-formed and is the last zip entry gives `error NU3008: The package integrity check failed. The package has changed since it was signed.`
-  - A misplaced or malformed signature entry gives only `warning NU3005` and the restore continues.
-  - Signatures are checked only when a package is extracted, not when it is already in the GPF.
-
-## (c) The GPF never refreshes an existing package
-- **VERIFIED:** I tampered with a dll inside the GPF. The locked restore passed and the tampered dll was used.
-- **VERIFIED:** `.nupkg.metadata` is the marker that a package is complete.
-  - Delete it but keep `.sha512`: NuGet recreates `.nupkg.metadata` from the local files (`"source": null`) and does not re-extract.
-  - How it recreates the hash: for a signed package it recomputes the hash from the .nupkg; for an unsigned one it copies the text of `.sha512`.
-  - Delete both files: the package is downloaded and extracted again (the tampered dll went back to its original size).
-- **VERIFIED:** `dotnet restore --no-cache --force --force-evaluate` does not refresh a GPF entry.
-- **VERIFIED, stale copies leak both ways without a lock file:**
-  - After the failed restore above left the patched copy in the GPF, an unrelated nuget.org project with no lock file built against it (its output dll ends in `SOCKETPATCH`).
-  - The other way round: GPF has upstream, feed has patched, no lock. Restore quietly used upstream and wrote a lock with the upstream hash.
-
-## (d) Repo-local GPF
-- **VERIFIED:** A relative `globalPackagesFolder` in nuget.config resolves relative to the nuget.config file, not the current directory. Restoring the solution from `src/app` created the folder at the solution root.
-- **VERIFIED:** Restore, build and publish all used it (`project.assets.json` packageFolders and `NuGetPackageRoot` in `nuget.g.props`). `$HOME/.nuget/packages` was never created. `dotnet test` was not run.
-- **VERIFIED, which setting wins:** `RestorePackagesPath` (MSBuild property) beats the `NUGET_PACKAGES` env var, which beats nuget.config. So a CI job that sets `NUGET_PACKAGES` overrides a nuget.config setting, but not a `Directory.Build.props` property.
-- **VERIFIED:** A relative `RestorePackagesPath` in `Directory.Build.props` resolves per project directory, giving one GPF per project. Use `$(MSBuildThisFileDirectory)`.
-- **DOCS:** The HTTP cache stays machine-wide. Local folder feeds are not HTTP-cached.
-
-## (e) Fallback folders
-- **VERIFIED:** I pointed nuget.config's `<fallbackPackageFolders>` at a folder holding the extracted patched package. It was used in place and not copied to the GPF (the GPF stayed empty), and the built dll was the patched one. The lock hash came from the fallback's `.nupkg.metadata` and was byte-identical to the lock produced from a feed.
-- **VERIFIED:** The minimum a fallback entry needs is `.nupkg.metadata`, the nuspec and `lib/`. It needs neither the .nupkg nor `.sha512`, and it worked with the only source pointing at a folder that doesn't exist. Without `.nupkg.metadata` the entry is ignored and NuGet goes to the source (NU1301).
-- **VERIFIED:** An upstream lock against a patched fallback gives NU1403. The hash check only trusts the value written in `.nupkg.metadata`.
-- **VERIFIED, the GPF beats fallback folders:** if the GPF already holds upstream 13.0.3, a patched lock fails with NU1403, and with no lock the upstream copy is used silently. A committed fallback folder is therefore not a vendoring mechanism on its own. It only works together with an isolated GPF.
-
-## (f) The lock doesn't record the source
-- **VERIFIED:** A lock generated from nuget.org passed a locked restore from a local folder feed holding the same bytes, and the lock stayed byte-identical. The lock only pins id, version and contentHash.
-
-## (g) Version suffixes
-- **VERIFIED:** `13.0.3+socket.1` collides completely with 13.0.3.
-  - The GPF path is `newtonsoft.json/13.0.3`, the lock says `resolved "13.0.3"`, and it says `requested "[13.0.3, )"` even when the csproj says `Version="13.0.3+socket.1"`.
-  - A second nuget.org project on the same GPF then built against the patched dll.
-- **VERIFIED:** `13.0.3-socket.1` gets its own GPF folder, but it sorts below 13.0.3. That causes NU1605 whenever something needs >=13.0.3.
-- **VERIFIED:** A four-part `13.0.3.1` gets its own GPF folder and sorts above 13.0.3, so there's no downgrade error. It works as a direct reference and as a CentralTransitive pin.
-- **DOCS:** A dependency with an exact `[13.0.3]` range would give NU1608. A real upstream 13.0.3.1 would collide, but that's rare.
-
-## What this means for vendoring a patched copy with the same id+version as upstream
-1. **A shared GPF can't be made safe.** The first copy written wins and is never refreshed. Patched bytes leak to other projects and CI caches, and upstream bytes leak in. A failed locked restore still leaves the wrong copy behind.
-2. **The lock hash detects the problem but can't fix it.** It only compares against `.nupkg.metadata`. The only recovery is deleting that GPF entry, so hosted or cached-CI revert needs cache eviction as well as rewriting the lock.
-3. **Robust options:**
-   - **(a) Repo-local GPF** set with `RestorePackagesPath=$(MSBuildThisFileDirectory)…` in `Directory.Build.props`. It beats `NUGET_PACKAGES` and covers restore, build and publish. It could be pre-seeded with the extracted patched package (a `.nupkg.metadata` file plus a minimal file set) and gitignore everything else.
-   - **(b) A distinct four-part version** such as 13.0.3.1, with Central Package Management transitive pinning. This removes the collision entirely. Don't use `+metadata` (it collides) or `-prerelease` (NU1605).
-   - **(c) A committed fallback folder.** It gives offline use without copying into the GPF, but only if the GPF doesn't already have that id+version, so it depends on (a).
-4. **Always drop `.signature.p7s`** (otherwise NU3008). The patched package's lock hash is then just the sha512 of the rebuilt file, and the current rewrite of the lock `contentHash` must use that.
-5. **The current design's catch-all `*` source mapping doesn't help.** Once the package is in any GPF, the mapping is never consulted.
\ No newline at end of file
diff --git a/docs/design/nuget-vendoring-research/shapes.md b/docs/design/nuget-vendoring-research/shapes.md
deleted file mode 100644
index 59802b45..00000000
--- a/docs/design/nuget-vendoring-research/shapes.md
+++ /dev/null
@@ -1,155 +0,0 @@
-# NuGet vendoring across project shapes: findings
-
-All tests ran on .NET SDK 8.0.131 on Linux. Each experiment had its own HOME, NUGET_PACKAGES and NUGET_HTTP_CACHE_PATH under `exp/<name>/`. Patched packages were built by `mkpatch.py`: it appends `SOCKETPATCHED` to the netstandard2.0 dll, adds `socket-patched.txt`, drops the signature and can rewrite the nuspec `<version>`.
-
-The main test solution has three projects:
-- **Lib** references Newtonsoft.Json 13.0.1 directly.
-- **App** has a ProjectReference to Lib.
-- **Tool** references Newtonsoft.Json.Bson 1.0.2, which pulls in Newtonsoft.Json ≥12.0.1, resolved as 12.0.1.
-
-Full notes are in `<scratch>/research/shapes/FINDINGS.md`. The templates, `env.sh`, `mkpatch.py` and the feeds are in the same directory.
-
-## 1. Multi-project solution with PackageReference and lock files
-
-**VERIFIED:** each project's lock lists the package itself:
-- Lib: `"type": "Direct", "requested": "[13.0.1, )"`.
-- App: `"Transitive"`, with its own contentHash, plus a `lib` entry of `"type": "Project"` whose dependencies are `{"Newtonsoft.Json": "[13.0.1, )"}`.
-- Tool: `Transitive 12.0.1`.
-
-So one package id shows up in every lock in the closure, and it can resolve to a different version in each project.
-
-**A (same id+version):**
-- **Source mapping works per package id, not per version.**
-  - VERIFIED: once Newtonsoft.Json was mapped only to the local feed, Tool failed with `NU1102 Unable to find package Newtonsoft.Json with version (>= 12.0.1) … Versions from nuget.org were not considered`.
-  - Every version of that id used anywhere in the repo has to be in the local feed, or the id has to be mapped to both sources.
-  - VERIFIED: mapping to both worked 3 out of 3 times, and the local feed won each time.
-  - DOCS: which source wins when both hold the same version is not guaranteed.
-- **Every project in the closure needs its lock contentHash rewritten.**
-  - VERIFIED: without it, Lib and App failed with `NU1403 Package content hash validation failed`.
-  - For an unsigned rebuilt package, contentHash = base64(sha512(nupkg)). VERIFIED: restore passed after rewriting it that way.
-- **Global cache poisoning is fatal.** VERIFIED: with upstream 13.0.1 already in the global packages folder, restore failed with `NU1403`, even with `--force`.
-- **No-op restore can hide the problem.** VERIFIED: with `obj/` left from an earlier good restore, restore did nothing and hid the poisoned cache.
-- **The patched copy leaks into other repos.** VERIFIED: an unrelated project with no lock file, using only nuget.org and sharing the same cache, silently got the patched 13.0.1.
-- **Keeping the original signature does not work.** VERIFIED: `NU3005 … signature file entry is invalid … compression method (8)`.
-- **Pack is correct.** VERIFIED: the nuspec says `version="13.0.1"`, so there is no leak.
-
-**B (unique version):**
-- **A prerelease suffix is ruled out.**
-  - VERIFIED: `-socket.1` sorts below the release. It triggered a false vulnerability warning, `NU1903 … 13.0.1-socket.1 has a known high severity vulnerability`.
-  - VERIFIED: next to a dependency that needs ≥12.0.1 it fails with `NU1605 Detected package downgrade: … from 12.0.1 to 12.0.1-socket.1`.
-- **Build metadata does not create a new identity.** VERIFIED: `13.0.1+socket.1` is stripped and resolves as 13.0.1, which is the same as A.
-- **A 4th version part works.** VERIFIED: `12.0.1.1` / `13.0.1.1` had no NU1605 and no false NU1903.
-- **Metadata conditions must go inside a target.** VERIFIED: a `%(Version)` condition on an item Update outside a target fails with `MSB4191`.
-- **Working repo-wide redirect, no csproj edits** (VERIFIED):
-  - `Directory.Build.targets` imports `.socket/vendor/nuget/socket.targets`.
-  - That file has a target with `BeforeTargets="CollectPackageReferences"`, which rewrites any PackageReference with `'%(Identity)'=='Newtonsoft.Json' and '%(Version)'=='13.0.1'` to `13.0.1.1`.
-  - Resulting locks: Lib Direct `[13.0.1.1, )`; App Transitive 13.0.1.1, with its `lib` project entry changed to `[13.0.1.1, )`; a project with a direct 13.0.3 is left alone.
-  - Then a `--locked-mode` restore with an empty cache passes, and build/publish output contains the patched dll.
-- **Old locks fail and must be regenerated for the whole closure.** VERIFIED: `NU1004 The package reference … version has changed`, and on App `NU1004 The project references lib whose dependencies has changed`.
-- **If the vendor feed is unusable, restore silently moves to a different version.**
-  - VERIFIED: with a ≥13.0.1.1 reference and the feed unmapped, NuGet picked 13.0.2 from nuget.org with only `NU1601 … ended up with Newtonsoft.Json 13.0.2`.
-  - VERIFIED: exact brackets `[13.0.1.1]` turn this into a hard `NU1102`.
-- **`RestoreAdditionalProjectSources` only helps when the repo has no source mapping.**
-  - VERIFIED: set from an imported props file, it adds the feed without touching nuget.config.
-  - VERIFIED: when the repo has source mapping, that feed is used only if mapped by its **absolute path**. A relative key failed (NU1102). So nuget.config has to be edited anyway.
-- **Pack leaks the new version to consumers.**
-  - VERIFIED: the nuspec gets `version="13.0.1.1"` (or `[13.0.1.1]` with brackets).
-  - VERIFIED: a consumer with an empty cache then fails with `NU1102`. Without brackets it would drift to 13.0.2 with NU1601.
-  - VERIFIED: a transitive redirect with PrivateAssets=all does not leak.
-
-**C (repo-local package folder):**
-- **`RestorePackagesPath` in Directory.Build.props wins.**
-  - VERIFIED: `RestorePackagesPath=$(MSBuildThisFileDirectory).socket/nuget-packages` beat the NUGET_PACKAGES env var (the env cache stayed empty).
-  - VERIFIED: a pre-extracted patched `newtonsoft.json/13.0.1` was used as is; other packages were downloaded into the repo folder.
-- **The seed can be minimal.** VERIFIED: `.nupkg.metadata` + nuspec + lib/ is enough; the .nupkg and .sha512 are not needed and NuGet does not re-hash the files.
-- **The seed can carry the upstream hash, so the locks stay as they are.** VERIFIED: a `.nupkg.metadata` with the upstream contentHash, with locks untouched, passed `--locked-mode` and the patched dll was built.
-- **It survives forced restores.** VERIFIED: `restore --force --no-cache` left the seed in place.
-- **A CI override bypasses it.**
-  - VERIFIED: with `-p:RestorePackagesPath=…` and the upstream hash in the locks, restore silently downloads the unpatched package.
-  - VERIFIED: with the patched hash in the locks, it fails closed with NU1403.
-- **Fallback folders are unsafe.** VERIFIED: `RestoreFallbackFolders` works with an empty cache, but if the cache already holds upstream 13.0.1, the cache wins and the result is silently unpatched.
-- **Folder name and CI cost** (DOCS): a dot-prefixed folder is excluded from SDK default globs. Every package then lives in the repo, so a `.gitignore` with negation rules is needed and CI caching of the global folder stops helping.
-- **Pack is correct.** VERIFIED: the nuspec says 13.0.1.
-
-## 2. Central Package Management
-
-- **Lock entry types** (VERIFIED):
-  - Transitive packages that have a PackageVersion appear as `"CentralTransitive"` even with pinning off.
-  - Tool showed `requested [13.0.1, )` but `resolved 12.0.1`.
-  - A project with a VersionOverride shows as Direct.
-- **Turning pinning on changes nothing until locks are re-evaluated.** VERIFIED: with existing locks, both `--locked-mode` and a plain restore passed and kept Tool at 12.0.1. Only `--force-evaluate` moved it to 13.0.1.
-- **Redirect without editing Directory.Packages.props** (VERIFIED):
-  - A `<PackageVersion Update="Newtonsoft.Json" Condition="'@(PackageVersion->WithMetadataValue('Identity','Newtonsoft.Json')->WithMetadataValue('Version','13.0.1'))' != ''" Version="13.0.1.1"/>` in the imported targets file works. A non-matching version check did not redirect.
-  - Lib and App moved to 13.0.1.1. The VersionOverride project was untouched.
-  - Without pinning, Tool's requested range became `[13.0.1.1, )` but it still resolved 12.0.1.
-  - With pinning, Tool moved to 13.0.1.1.
-  - Old locks fail with `NU1004 Mistmatch between the requestedVersion of a lock file dependency marked as CentralTransitive…`.
-- **Transitive-only project without pinning** (VERIFIED):
-  - Needs `<PackageReference Include=… VersionOverride="12.0.1.1" PrivateAssets="all"/>` scoped to that project.
-  - `Version=` fails with `NU1008`. If the repo sets `CentralPackageVersionOverrideEnabled=false`, it fails with `NU1013`.
-- **Pinning should not be the patch mechanism.** CPM allows one PackageVersion per id (DOCS). Turning pinning on changes other projects' versions: VERIFIED, Tool went from 12.0.1 to 13.0.1.
-- **Answer to "only Directory.Packages.props?"** No. An imported targets file can do the redirect, but every lock in the closure still has to change.
-
-## 3. packages.config
-
-- **Not testable here.** VERIFIED: `which mono nuget` finds nothing. `dotnet restore` on the solution, on the csproj, and `msbuild -t:restore -p:RestorePackagesConfig=true` all print `Nothing to do. None of the projects specified contain packages to restore.`
-- **How nuget.exe works** (DOCS):
-  - It restores to `<solutionDir>/packages/<Id>.<Version>/`, or to `repositoryPath` if set in nuget.config.
-  - There is no lock file and no contentHash; projects reference dlls through HintPath.
-  - It skips any folder that already holds `<Id>.<Version>.nupkg`.
-- **Verdicts:**
-  - C (pre-seed or commit the `packages/` folder) is the practical option.
-  - B needs every packages.config and HintPath edited.
-  - A with a folder feed works, but the packages/ folder poisons it the same way the global cache does.
-
-## 4. Directory.Build.props/targets injection
-
-- **Only the nearest file is imported.**
-  - VERIFIED: a nested `src/Directory.Build.props` hides the root one.
-  - VERIFIED: chaining with `$([MSBuild]::GetPathOfFileAbove(Directory.Build.props, $(MSBuildThisFileDirectory)..))` restores it.
-  - VERIFIED: the root .targets file is still found independently of the .props.
-  - So the injector must add its Import to the nearest existing file for every project.
-- **A separate imported file works.** VERIFIED: an Exists-guarded `.socket/vendor/nuget/socket.props|targets` worked for all the properties and items above.
-- **Limits outside MSBuild** (DOCS): source mapping can only be set in nuget.config. `Directory.Build.rsp` affects the msbuild CLI only.
-
-## 5. Transitive redirect
-
-VERIFIED: a per-project PackageReference with PrivateAssets=all (or VersionOverride under CPM) changes the lock entry from Transitive or CentralTransitive to Direct, with the new requested range. The parent's dependency line stays the same (Bson still lists `"Newtonsoft.Json": "12.0.1"`). No csproj edits are needed.
-
-## 6. Build, publish and pack
-
-- **Build and publish:** VERIFIED patched dll in the output for A, B (4th part) and C.
-- **Pack:** VERIFIED A and C are correct. B leaks the new version into the nuspec whenever the package is a direct dependency of a packable project.
-
-## 7. Floating versions and ranges
-
-- **Resolution:** VERIFIED `13.0.*` and `13.*` resolve 13.0.4 today; `[13.0.1,14.0)` resolves 13.0.1.
-- **Lock files win:** VERIFIED a plain restore with an existing lock keeps the locked versions.
-- **4th-part versions are not picked up on their own:** VERIFIED 13.0.1.1 was not chosen for the range with `--force-evaluate`, so B has to replace the floating spec with the exact version.
-- **A and C patch whatever the lock resolved:** DOCS/inferred, re-evaluating after upstream publishes a newer version silently drops the patch.
-
-## Verdicts
-
-| Shape | A (same version) | B (4th-part version + redirect) | C (repo-local packages folder) |
-|---|---|---|---|
-| Multi-project sln | Fragile: id-wide mapping, hash rewrite in every lock, cache poisoning and leaks to other repos | Works with the imported-targets redirect and exact brackets; locks must be regenerated; pack leaks | Works and is isolated from the global cache; a CI override bypasses it |
-| CPM | Same as sln | Works with a PackageVersion Update; transitive-only projects need VersionOverride; the pinning trap | Works |
-| packages.config | Poor | Heavy edits | Best (seed `packages/`) |
-| Transitive-only | Automatic (id-based) | Per-project redirect, lock type becomes Direct | Automatic |
-| pack/consumers | Correct | Leaks the new version | Correct |
-| Floating/ranges | Tied to the lock | Must pin exactly | Tied to the lock |
-
-## What this means for a patched copy with the upstream id+version
-
-- **Same id+version is inherently unsafe in any shared cache.** Both the global packages folder and the packages/ folder are keyed on id/version alone. Every A failure seen here comes from that: NU1403 poisoning, silent leaks into other repos, per-id mapping breaking other versions.
-- **The same identity is only safe in a cache the repo owns (C).**
-  - Recommended form: an Exists-guarded `RestorePackagesPath` import chained into every nearest Directory.Build.props.
-  - Seed a minimal extracted package.
-  - Write the patched contentHash into both `.nupkg.metadata` and the locks, so that bypassing the folder fails closed (NU1403) instead of silently restoring upstream.
-  - Do not use fallback folders.
-- **If a unique version (B) is used:**
-  - Use a 4th version part, never a prerelease suffix or `+metadata`.
-  - Pin it with exact brackets.
-  - Apply the redirect through an imported targets file, not csproj edits.
-  - Regenerate the locks for the whole closure.
-  - Handle the pack leak, for example by limiting B to non-packable projects.
\ No newline at end of file
diff --git a/docs/design/nuget-vendoring-research/signing.md b/docs/design/nuget-vendoring-research/signing.md
deleted file mode 100644
index 810aa2ef..00000000
--- a/docs/design/nuget-vendoring-research/signing.md
+++ /dev/null
@@ -1,102 +0,0 @@
-# NuGet signing and verification when vendoring a patched same-id+version nupkg
-
-**Headline:** once we change a package we have to drop its `.signature.p7s`. Keeping it fails restore with NU3008, even on Linux with no special settings. Dropping it works under the default policy but fails under `require` with NU3004. Signing, or not signing, never changes the lock `contentHash`. That means we can sign with a Socket certificate and keep lock pinning as it is.
-
-Setup: .NET SDK 8.0.131 on Linux. Each experiment had a fresh HOME, NUGET_PACKAGES and NUGET_HTTP_CACHE_PATH under `exp/<name>/`. The test package was Newtonsoft.Json 13.0.3 from nuget.org, which is author-signed and carries the nuget.org repository countersignature. The "patch" appends bytes to `lib/net6.0/Newtonsoft.Json.dll`. Restores used a single local folder feed (`<clear/>`) with `RestorePackagesWithLockFile`.
-
-## Environment
-- **VERIFIED:** signature verification is on by default on Linux with SDK 8. `dotnet nuget verify` prints `X.509 certificate chain validation will use the fallback certificate bundle at '/usr/lib/dotnet/sdk/8.0.131/trustedroots/codesignctl.pem'`. A tampered signed package fails restore with no env var or config set.
-- **VERIFIED:** the certificate revocation servers can't be reached from here. Genuine packages only get NU3018/NU3028 `RevocationStatusUnknown` warnings, even in `require` mode.
-- **VERIFIED:** timestamp.digicert.com returns HTTP 403 through the proxy, so I could not test timestamped signing.
-
-## (a) Keeping vs dropping `.signature.p7s` (default mode, `accept`)
-- **VERIFIED:** modified dll with the signature kept fails: `error NU3008: ... The package integrity check failed. The package has changed since it was signed.`
-- **VERIFIED:** re-zipping with no content change and the signature kept also fails with NU3008. The signature covers the zip bytes, not just the file contents.
-- **VERIFIED:** modified dll with the signature dropped installs cleanly, with no warnings.
-- **VERIFIED:** `DOTNET_NUGET_SIGNATURE_VERIFICATION=false` turns verification off entirely. The tampered, still-signed package then installs.
-- **VERIFIED:** if the signature entry has non-zero external file attributes (Python `zipfile` writes `0o600<<16` by default), restore only warns (`NU3005: The package signature file entry is invalid ... 'external file attributes' has an invalid value (25165824)`) and installs the package as if it were unsigned.
-
-## (b) `require` mode (enterprise setup)
-The config was `signatureValidationMode=require` plus a `<trustedSigners><repository name="nuget.org" serviceIndex="https://api.nuget.org/v3/index.json">` entry with the three nuget.org repository certificate fingerprints (SHA256 `0E5F38F5…`, `5A2901D6…`, `1F4B311D…`).
-
-- **VERIFIED:** the genuine package installs even from a local folder feed. Repository trust is tied to the certificate, not the source URL.
-- **VERIFIED:** the unsigned patched package fails: `error NU3004: ... signatureValidationMode is set to require, so packages are allowed only if signed by trusted signers; however, this package is unsigned.`
-- **VERIFIED:** the patched package with the upstream signature kept fails with NU3008.
-- **VERIFIED:** `DOTNET_NUGET_SIGNATURE_VERIFICATION=false` overrides `require`, and the unsigned package installs.
-- **VERIFIED:** config precedence. With `require` in the user-level `~/.nuget/NuGet/NuGet.Config` and `accept` in the repo's `nuget.config`, the unsigned package installs, so a repo config can weaken the policy. With `require` at user level only, it fails with NU3004.
-- **VERIFIED:** `trustedSigners` add up across config levels. The user level had `require` plus the nuget.org `<repository>`; the repo level added only an `<author>`. Both the Socket-signed patched package and genuine nuget.org packages installed.
-- **VERIFIED:** if the global packages folder already holds the extracted patched package, restore succeeds under `require` with no check at all. Signatures are only verified when a package is extracted into that folder.
-- **DOCS:** `require` mode has no per-package or per-source exemption. `trustedSigners` entries are per certificate: an `<author>` fingerprint, or a `<repository>` fingerprint with optional `<owners>`. `allowUntrustedRoot` only relaxes chain building for a listed certificate; it does not let unsigned packages through.
-
-## (c) Signing with a self-signed certificate (`dotnet nuget sign`)
-I made the certificate with `openssl req -x509` (extended key use codeSigning, key use digitalSignature) and exported it to a pfx.
-
-- **VERIFIED:** signing works on Linux in about 1.1 s with exit code 0. `dotnet nuget sign moddrop.nupkg --certificate-path cert.pfx --certificate-password pw -o signed` warns NU3002 (no timestamper), NU3042 (root not in the codesignctl.pem bundle) and `NU3018: UntrustedRoot: self-signed certificate`.
-- **VERIFIED:** restore results for the signed patched package:
-
-| Config | Result |
-|---|---|
-| Default `accept`, nothing trusted | Installs, with warnings NU3018 ("signing certificate is not trusted by the trust provider"), NU3027 (not timestamped) and NU3042 |
-| `require` + `<author>` fingerprint, `allowUntrustedRoot="false"` | `error NU3018` |
-| `require` + `<author>` fingerprint, `allowUntrustedRoot="true"` | Installs, only a NU3027 warning |
-| `require`, no `<author>` | `error NU3018` plus `error NU3034: This package is signed but not by a trusted signer` |
-
-- **VERIFIED:** re-signing a package that still has the upstream signature fails without `--overwrite` (`NU3001: The package already contains a signature`). With `--overwrite` it succeeds and installs under `require` with the author trusted.
-- **VERIFIED:** `dotnet nuget sign` writes a valid signature entry even when the input zip has Python-style attributes.
-- **VERIFIED (from `--help`):** the CLI can only create author signatures, so we cannot make a repository signature like nuget.org's. **DOCS:** repository signing exists only in the NuGet.Packaging API.
-- **DOCS:** a signature without a timestamp stops being valid when the certificate expires.
-- **Cost:** about a second per package, and no system trust store changes are needed. The user does have to add one `<author>` entry with `allowUntrustedRoot="true"` if they use `require`.
-
-## (d) `dotnet nuget verify --all` (all VERIFIED)
-- Unsigned: `error: NU3004: The package is not signed.` (exit 1)
-- Modified with the upstream signature kept: prints `Signature type: Author` and `Signature type: Repository`, then `error: NU3008` (exit 1).
-- Self-signed: `error: NU3018 ... not trusted by the trust provider` (exit 1). `--certificate-fingerprint` alone does not change that. With `--configfile` pointing at a config that has the `<author allowUntrustedRoot="true">` entry, it exits 0 with only a NU3027 warning.
-- Genuine: `Successfully verified package`, with revocation warnings.
-
-## (e) Global packages folder metadata and `contentHash`
-- **VERIFIED:** the package's folder holds `.nupkg.metadata` (`{version:2, contentHash, source}`), `<id>.<ver>.nupkg.sha512`, a byte-identical copy of the nupkg, and an extracted `.signature.p7s`. The metadata records nothing about the signer.
-- **VERIFIED: the lock `contentHash` does not depend on the signature file.** This corrects the assumption in the brief.
-  - For signed packages, `contentHash` is the SHA-512 of the archive with the `.signature.p7s` entry removed from both the file data and the central directory, and the end-of-archive record offsets and counts adjusted. My `signed_content_hash.py` reproduces the upstream `HrC5BXdl…zQ==` exactly.
-  - That differs from SHA-512 of the whole file (`mbJSvHfR…kg==`), which is what `.nupkg.sha512` stores.
-  - The unsigned patched package, the Socket-signed one and the re-signed one all produce the same `contentHash` (`Lb2f3WlJ…`), equal to SHA-512 of the unsigned file.
-  - `dotnet nuget sign` appends the signature and leaves every other byte unchanged. Swapping signed and unsigned files passes `--locked-mode`.
-- **VERIFIED:** when the global packages folder already has upstream and the lock pins the patched hash, `--locked-mode` fails with `error NU1403: Package content hash validation failed`. Without a lock file, restore silently uses upstream and writes the upstream hash into the new lock.
-
-## (f) Zip layout and packaging metadata files (all VERIFIED; unsigned packages in `accept` mode all installed)
-- These variants all restored fine:
-  - `.psmdcp` removed, even though `_rels/.rels` still points to it
-  - `_rels/.rels` and `.psmdcp` both removed
-  - `[Content_Types].xml` removed
-  - all three removed
-  - a new file with an extension not listed in `[Content_Types].xml` (`.patchmeta`, extracted to `lib/net6.0/`)
-  - entries in reverse order
-  - all entries stored without compression
-- The version with all three files removed, then self-signed, installed under `require`. The console app built with `-m:1`, ran, and the copied dll ended with the patch marker.
-- The global packages folder never contains `[Content_Types].xml`, `_rels` or `.psmdcp`.
-- Every layout change produced a different `contentHash`, so the repack must be deterministic for the hash to be reproducible.
-- **DOCS:** other tools that read these files the Office-document way (older `nuget.exe push`, Package Explorer) may still expect them. Keeping them, and adding a `Default` entry for any new extension, costs nothing.
-
-## Implications for each vendoring mechanism
-1. **Same id+version, unsigned (current approach).**
-   - Works under `accept`. Always fails under `require` (NU3004), with no per-package exemption.
-   - The upstream `.signature.p7s` must always be removed (NU3008). A hand-written signature entry with non-zero attributes is silently treated as unsigned.
-   - The lock pin, plain SHA-512 of the file, is correct for unsigned packages.
-   - The main risk is a collision with an existing copy in the global packages folder (NU1403 in locked mode, silently using upstream otherwise). That comes from reusing id+version, not from signing.
-2. **Same id+version, signed by Socket or a repo-local author certificate.**
-   - The lock hash is unaffected, and signing is cheap.
-   - Under `accept` the only cost is warnings: NU3018/NU3042 go away only if the certificate chains to a root in the SDK bundle, and NU3027 goes away only with a timestamp.
-   - Under `require` the user needs one `<author>` entry with `allowUntrustedRoot="true"` for a self-signed certificate. It can go in the repo's `nuget.config` because it merges with the enterprise-level `trustedSigners`. This is the setup to document for enterprises.
-   - A self-signed or repo-local key is only as trustworthy as whoever can write to the repo.
-   - A CA-issued Socket code-signing certificate with a timestamp would remove `allowUntrustedRoot` and the warnings. Signing could happen on Socket's server, because the signature does not affect the lock hash. We cannot reproduce the nuget.org repository signature.
-3. **Pre-filling the global packages folder or a fallback folder.** This skips verification even under `require`, which means it quietly gets around enterprise policy. We should not document it.
-4. **A renamed id or new version (e.g. `13.0.3-socket.1`).** The signing situation is the same (unsigned fails NU3004 under `require` unless Socket-signed), but it removes the global-folder and lock collisions. This is inferred, not run.
-5. **Overrides we should not recommend.** `DOTNET_NUGET_SIGNATURE_VERIFICATION=false` and a repo-level `signatureValidationMode=accept` both work, but both quietly weaken an organization's policy. The tool should detect an effective `require` and fail with a clear message pointing to the `<author>` instruction.
-
-Everything is in `<scratch>/research/signing/`:
-- `FINDINGS.md` — full notes with commands and output
-- `env.sh`, `run.sh` — setup and restore scripts
-- `repack.py` — rebuilds the test packages
-- `signed_content_hash.py` — the signed-package hash calculation
-- `cert/` — the test certificate
-- `v/`, `signed*/` — the package variants
-- `exp/<name>/` — one folder per experiment
\ No newline at end of file
diff --git a/docs/design/nuget-vendoring-research/sources.md b/docs/design/nuget-vendoring-research/sources.md
deleted file mode 100644
index dae0627e..00000000
--- a/docs/design/nuget-vendoring-research/sources.md
+++ /dev/null
@@ -1,134 +0,0 @@
-# NuGet sources, packageSourceMapping and nuget.config research (SDK 8.0.131, NuGet 6.8.2)
-
-The tool harness refused to let me write `FINDINGS.md`, so the notes are below instead of in that file. The experiment dirs, helpers (`env.sh`), test packages and the delayed-HTTP feed server are under `<scratch>/research/sources/` (in `exp/`, `pkgs/` and `httpfeed/server.py`). Every experiment ran with a fresh HOME, NUGET_PACKAGES, NUGET_HTTP_CACHE_PATH and DOTNET_CLI_HOME.
-
-To tell which bytes won, I read `gpf/<id>/<ver>/SOCKET_PATCHED.txt` and the `source` field in `.nupkg.metadata`. "gpf" below means the global packages folder (`~/.nuget/packages`).
-
-**Command not available:** `dotnet nuget config paths` does not exist in 8.0.131. It fails with `error: Unrecognized command or argument 'config'` (VERIFIED). I used `dotnet restore -v:n` (the "NuGet Config files used" and "Feeds used" lines) and strace instead.
-
-## (a) Local folder feeds
-
-**Flat feed**
-- A file named `<id>.*.nupkg` resolves. The filename match is case-insensitive (`Newtonsoft.Json.13.0.3.nupkg`, lowercase and UPPERCASE all worked). Even `Newtonsoft.Json.13.0.3-whatever.nupkg` worked, because the version comes from the nuspec inside the package (VERIFIED).
-- These fail with NU1101 (VERIFIED):
-  - `zzz-random.nupkg`
-  - `Newtonsoft.Json.nupkg`
-  - a nupkg in a subdirectory (the flat feed is not recursive)
-
-**Hierarchical feed (`<id>/<ver>/`)** (VERIFIED)
-- It needs three files:
-  - the lowercase nupkg,
-  - `.nupkg.sha512`, which acts as the existence marker (nupkg + nuspec without it gives NU1101),
-  - `<id>.nuspec` (nupkg + sha512 without it gives `error NU5037: The package is missing the required nuspec file`).
-- **Linux needs lowercase.** A `Newtonsoft.Json/13.0.3/Newtonsoft.Json.13.0.3.nupkg` layout gives NU1101.
-- **The `.sha512` content is not trusted.** I put garbage in it, and the gpf and lock contentHash still came out as the real SHA512 of the nupkg (`dkeh7b…`). NuGet re-hashes the package on install.
-- **Dependencies come from the loose `.nuspec`, not the one inside the nupkg.** A loose nuspec with an extra dependency made restore pull Humanizer.Core. The nuspec extracted into gpf had no such dependency. So the loose nuspec must be byte-identical to the inner one.
-
-**`dotnet nuget push -s <dir>`** (VERIFIED)
-- An empty dir gets a flat file, `Newtonsoft.Json.13.0.3.nupkg`.
-- A dir that already has one full hierarchical entry (nupkg + nuspec + sha512) gets a full expanded entry: lowercase dirs, `.nupkg.sha512`, nuspec, `.nupkg.metadata` and all extracted files. It is not a `nuget add`-style minimal entry.
-
-**Performance:** a flat feed with 1 vs 201 `Newtonsoft.Json.*` files restored in 236–263 ms either way (VERIFIED). The difference doesn't matter at our scale.
-
-**Signatures**
-- Keeping the original `.signature.p7s` on modified contents gives `error NU3008: The package integrity check failed. The package has changed since it was signed.` This happens even under the default `accept` mode (VERIFIED). The signature must be dropped.
-- An unsigned package under `signatureValidationMode=require` gives `error NU3004 ... this package is unsigned` (VERIFIED).
-
-**Global packages folder poisoning** (VERIFIED)
-- I restored upstream 13.0.3, then switched the config to only the patched feed and ran `restore --force`. There was no error, the gpf entry stayed upstream (`source: https://api.nuget.org/...`), and the assets file kept the upstream hash. A matching id+version in gpf means the feeds are never asked.
-- With the patched contentHash in the lock file, `--locked-mode` gives `error NU1403: Package content hash validation failed ... different than the last restore`. Upstream was still written to gpf. After that, restoring with the patched feed also fails NU1403 until the gpf entry is deleted.
-
-## (b) packageSourceMapping
-
-**Exclusivity** (VERIFIED)
-- Once any mapping exists, a package that no pattern matches fails: `error NU1100: Unable to resolve 'Humanizer.Core (>= 2.14.1)' ... PackageSourceMapping is enabled, the following source(s) were not considered: loc, nuget.org.`
-- The catch-all is skipped for an id that a more specific pattern matches. With `nuget.org:*`, `loc:Newtonsoft.Json` and an empty loc, the result is `NU1101 ... No packages exist with this id in source(s): loc ... not considered: nuget.org`. There is no fallback.
-
-**Pattern precedence** (VERIFIED)
-- The longest prefix wins: `Newtonsoft.Js*` on loc beats `Newtonsoft.*` on nuget.org.
-- An exact id beats a prefix: `Newtonsoft.Json` on nuget.org beats `Newtonsoft.*` on loc.
-- If the same pattern is on two sources, both are eligible. With loc empty it silently falls back to nuget.org; with both holding the package, it becomes the race described in (d).
-- Pattern matching is case-insensitive. The source key is case-sensitive: a mapping for `LOC` against a source `loc` gives NU1100.
-
-**Missing or disabled source** (VERIFIED)
-- A mapping to a key with no `<add>` entry gives NU1100.
-- A mapping to a source that exists but is disabled also gives NU1100.
-
-**Multiple config files** (VERIFIED)
-- **A user-level mapping silently hides a repo source that has no mapping.** User `~/.nuget/NuGet/NuGet.Config` mapped `nuget.org:*`; the repo added `loc` with no mapping. Upstream was installed with no error.
-- **Different keys combine across files.** User `nuget.org:*` plus repo `loc:Newtonsoft.Json` gave the patched package.
-- **The same key in a nearer file replaces the farther file's patterns.** User `nuget.org:{*, Newtonsoft.Json}` plus repo `nuget.org:{Humanizer.*}` made Newtonsoft.Json fail NU1100.
-- **`<clear/>` inside `<packageSourceMapping>` drops the user-level mappings.** Anything the repo file doesn't map then fails NU1100.
-
-## (c) nuget.config precedence
-
-**Discovery** (VERIFIED, strace): NuGet probes `nuget.config`, `NuGet.config` and `NuGet.Config` in every ancestor directory up to `/`. It then reads:
-- `$HOME/.nuget/NuGet/NuGet.Config`
-- `$HOME/.nuget/NuGet/config/` (a directory of extra user-level configs)
-- `/etc/opt/NuGet/Config/` (machine-wide)
-- `/etc/opt/NuGet/NuGetDefaults.config`
-
-**File-name casing on Linux** (VERIFIED)
-- `nuget.config`, `NuGet.config` and `NuGet.Config` all work. `NUGET.CONFIG` and `Nuget.Config` are ignored.
-- If several are in one directory, only one is read, in the order `nuget.config` > `NuGet.config` > `NuGet.Config`.
-
-**Merging** (VERIFIED)
-- Configs are merged and applied from farthest to nearest.
-- `<clear/>` in `packageSources` removes only sources from farther files. In the child it removes the parent's and the user's sources; in the parent it removes only the user's.
-- A relative source value (`./feed`) resolves against the directory of the config file that declares it.
-
-**`--source` and `RestoreSources`** (VERIFIED)
-- Both replace the configured sources, but the mapping still applies.
-- A `--source` value equal to a configured source's value takes that source's key and mapping.
-- An unconfigured path is named by its path, so it matches no mapping and fails NU1100 (`not considered: /other, nuget.org`).
-- `-p:RestoreSources=<nuget.org URL>` drops loc, so Newtonsoft.Json fails NU1100.
-
-## (d) Same id+version from two sources, no mapping (VERIFIED)
-- **Local folder vs nuget.org:** the local folder won every time, in both config orders and with a cold or warm HTTP cache (4 runs each).
-- **Two local folders:** the first-listed one won 6/6 times, and swapping the order flipped the result.
-- **Local HTTP feed:** with 0 s delay it won in both orders. With 3 s delay it lost to nuget.org in both orders.
-
-Conclusion: the first source to respond wins, so the result depends on timing and is nondeterministic on real networks.
-
-## (e) RestoreAdditionalProjectSources in Directory.Build.props (VERIFIED)
-- **With no mapping anywhere:** the source is added (it shows in "Feeds used") and joins the race.
-- **With any mapping** (e.g. `nuget.org:*`): it is ignored and upstream is installed silently.
-- **A mapping keyed by the absolute path works.** A relative value is named by its resolved absolute path, so a mapping keyed `feed` fails NU1100. This setup can't be committed portably.
-
-## (f) Giving the patched package a unique version
-
-**It resolves only from our feed** (VERIFIED)
-- `13.0.3-socket.1` resolved from loc with no mapping.
-- `13.0.3.1-socket.1` resolved from an HTTP feed with 3 s delay even though nuget.org was faster (restore took 9.95 s). There is no race when only one source has the version.
-
-**When our feed is missing** (VERIFIED)
-- An exact `[13.0.3.1]` or `[13.0.3-socket.1]` gives `error NU1102: Unable to find package Newtonsoft.Json with version (= 13.0.3.1) - Found 0 version(s) in loc - Found 86 version(s) in nuget.org [ Nearest version: 13.0.4-beta1 ]`.
-- A plain `13.0.3-socket.1` gives `warning NU1603 ... approximate best match of Newtonsoft.Json 13.0.3 was resolved` (upstream, silently).
-- A plain `13.0.3.1` gives NU1603 and resolves upstream **13.0.4**.
-
-**Interaction with other packages' dependency ranges** (VERIFIED)
-- A dependency asking `>=13.0.1` plus a direct `13.0.3-socket.1` is fine.
-- A dependency asking `>=13.0.3` plus a direct `13.0.3-socket.1` gives `error NU1605: Warning As Error: Detected package downgrade: Newtonsoft.Json from 13.0.3 to 13.0.3-socket.1`. A prerelease sorts below its base version.
-- A dependency asking `>=13.0.3` works with a direct `13.0.3.1` and with `13.0.3.1-socket.1`. The latter sorts above 13.0.3 and below 13.0.4, and also below any future upstream 13.0.3.1.
-- `13.0.3+socket.1` (build metadata) is treated as 13.0.3 and came from nuget.org, so it is useless.
-
-**Transitive-only use needs a pin** (VERIFIED)
-- If only a dependency references it (`>=13.0.1`), restore picks upstream 13.0.1.
-- Central Package Management works: `ManagePackageVersionsCentrally` + `CentralPackageTransitivePinningEnabled` + `PackageVersion 13.0.3.1-socket.1` gave the patched package with no direct reference.
-
-**No cache collision:** the unique version gets its own gpf dir (`newtonsoft.json/13.0.3.1-socket.1`), so it can't collide with a cached upstream 13.0.3 (VERIFIED).
-
-## What this means for vendoring a patched copy with the same id+version
-
-1. **Same id+version can't be made robust.**
-   - gpf wins silently, even with `--force` (VERIFIED).
-   - A poisoned gpf, CI cache or shared runner gives permanent NU1403 or silent unpatched builds (VERIFIED).
-   - Without a mapping the winner is timing-dependent (VERIFIED).
-   - A mapping can be undone by a user-level, CI or ancestor-dir config: an unmapped repo source, a replaced pattern list for the same key, `<clear/>`, or `--source` / `RestoreSources` (all VERIFIED).
-   - The current catch-all `*` workaround turns every package no pattern matches into an NU1100 risk once another config adds its own mapping.
-2. **A unique version is deterministic** and needs no `packageSourceMapping`. Use `X.Y.Z.N-socket.M` (4-part base plus prerelease tag), not `X.Y.Z-socket.N` (NU1605 against any `>=X.Y.Z` dependency) and not `+meta` (same identity as upstream).
-   - Reference it with an exact bracket `[v]` (via `Directory.Packages.props` with transitive pinning, or a direct PackageReference), so a missing vendor dir fails hard with NU1102 instead of the NU1603 silent upgrade to upstream (VERIFIED).
-   - Revert is just restoring the original version string; no gpf cleanup is needed.
-   - Trade-offs (DOCS/inference): the lock file changes version and contentHash, and packable libraries would publish a dependency on a version consumers can't get.
-3. **Feed format:** prefer a flat folder with `<id>.<ver>.nupkg`, which needs no sidecar files (VERIFIED). A hierarchical feed needs a lowercase path, a `.sha512` marker (its content is ignored) and a loose nuspec byte-identical to the inner one (VERIFIED). Declare the feed with a relative path in a lowercase `nuget.config` at the repo root (VERIFIED). Don't use `RestoreAdditionalProjectSources` (VERIFIED).
-4. **Signatures:** always strip `.signature.p7s` (NU3008 otherwise). Repos using `signatureValidationMode=require` will reject any rebuilt package (NU3004), so detect that and refuse.
\ No newline at end of file
diff --git a/docs/design/nuget-vendoring.md b/docs/design/nuget-vendoring.md
deleted file mode 100644
index 67c3f329..00000000
--- a/docs/design/nuget-vendoring.md
+++ /dev/null
@@ -1,914 +0,0 @@
-# NuGet vendoring v2: unique-version fallback seed
-
-**Status:** draft, revision 3. Revision 2 added the four adversarial reviews (§16). Revision 3 records where the prototype overrides the design (§0). Vendored NuGet redesign stays future work for v5 (see `v5-plan.md`). This document lands on its own; the prototype code lives on the branch [`v5/nuget-vendoring-prototype`](https://github.com/SocketDev/socket-patch/tree/v5/nuget-vendoring-prototype) and is not merged.
-
----
-
-## 0. Where the prototype overrides this design
-
-The prototype on the branch [`v5/nuget-vendoring-prototype`](https://github.com/SocketDev/socket-patch/tree/v5/nuget-vendoring-prototype) was built after the design review. Building it and testing it against real `dotnet` changed several decisions. When anything below conflicts with this table, **this table wins**. The full list is in §17.
-
-| Design text | Prototype (authoritative) | Why |
-|---|---|---|
-| `.socket/vendor/nuget` is listed as an "anchor" fallback folder, so restore fails with NU1301 when it is missing (§6.3, G12) | **Removed.** The DBP block now holds a `SocketPatchNuGetImportCheck` target that fails restore with **SOCKETPATCH007** when `socket-patch.targets` was not imported | With the anchor, anyone could plant `<id>/<ver>/` next to the uuid dirs and NuGet would restore it under `--locked-mode` with no seed check. The security review reproduced this on SDK 8. SOCKETPATCH007 is proven by e2e for both locked and unlocked restore. |
-| V′ carries a builder bit: `N = 2^30 + ((u32 >> 3) << 1) + builder` (§6.1) | `N = 2^30 + (u32(uuid[0..8]) >> 2)`, with **no builder bit** | contentHash is `base64(sha512(canonical zip of the seed file set))`. It does not depend on whether the bytes came from the service or a local rebuild, so one uuid gives one V′ and one hash. |
-| Seed dirs named by uuid8 (§6.2) | Full canonical uuid: `.socket/vendor/nuget/<uuid>/<idlower>/<V′>/` | Keeps `vendor_uuid_dir_rel`, the orphan sweep and the path parsers unchanged. Long Windows paths are still an open item (G8). |
-| `--nuget-layout` flag on `GlobalArgs`, and a `nugetShared` ledger section (§5, §6.7) | Opt in with `SOCKET_PATCH_NUGET_LAYOUT=fallback`, or automatically once the ledger has a `nuget-fallback` entry. A purl the ledger holds as a legacy feed entry keeps the feed layout. Shared outputs are rendered from the per-uuid markers, using the ledger `fileInventory` when there is one. | Keeps the prototype contained in the core backend with a few CLI routing lines. It needs no new ledger schema. |
-| Lock revert from per-edit records (§6.5, §7.4) | One `nuget_lock_file_v2` record per lock. Revert **unsplices only this entry's V′ values**, back to the recorded originals. | Seeds that share a lock can be reverted in any order, and edits made after vendoring are kept. |
-| SOCKETPATCH003/004/006, per-project transitive pins, `--check`, pack range restore, VEX extractor | Not in the prototype. Transitive-only use refuses with `vendor_nuget_transitive_only` (CPM with transitive pinning is supported). | Scope (§15 was too large for one PR). |
-
-## 1. Status and summary
-
-**Status.** Proposed. This design ships as an opt-in layout, `--nuget-layout=fallback`, next to today's feed layout. Today's layout stays the default until the promotion criteria in §15 are met. Hosted mode is unchanged. packages.config projects stay on the legacy layout. A repo that has both packages.config and SDK projects using the same id@V is refused (§5).
-
-**Summary.** The patched package gets its own version, V′, that nothing else can produce. For a stable 3-part upstream version, V′ adds a 4th part derived from the patch uuid, for example `13.0.1` → `13.0.1.1340506222`. The package is committed already extracted, as a NuGet fallback package folder at `.socket/vendor/nuget/<uuid8>/<idlower>/<V′>/`.
-
-The CLI adds one generated block to the nearest `Directory.Build.props` (DBP) of every SDK project. The block has three parts:
-- It appends `.socket/vendor/nuget/socket-patch.targets` to `CustomAfterDirectoryBuildTargets`. MSBuild imports that property after the whole `Directory.Build.targets` chain.
-- It adds a restore-time `SocketPatchNuGetImportCheck` target. If the targets file was not imported, for example because `.socket/vendor/nuget` is missing, restore fails with SOCKETPATCH007. (§0: this replaces the original anchor fallback folder.)
-- It adds one literal uuid comment per patch.
-
-The generated targets file does five things:
-1. It adds each uuid8 directory to `RestoreAdditionalProjectFallbackFolders`.
-2. It redirects the planned references to the floor range `[V′, )`, using evaluation-time `Update` and `Include` items. Direct references, CPM `PackageVersion`, and TFM-conditioned transitive pins are all handled. An exact `[V′]` is not used, because it spreads through ProjectReference (§16, S-B1).
-3. At restore time, it checks that the files in the seed are exactly the recorded set and have the recorded hashes (SOCKETPATCH001/002).
-4. At build time, it checks the files that were actually consumed:
-   - where they resolved from, and whether their content matches (SOCKETPATCH003);
-   - whether the project resolved the unpatched V (SOCKETPATCH005);
-   - whether a project where a redirect engaged resolved anything other than V′ (SOCKETPATCH006).
-5. It writes the original version range back into packed nuspecs, checks the nuspec before and after pack, and deletes a nupkg that leaks V′ (SOCKETPATCH004).
-
-The CLI also edits, entry by entry, every lock whose graph contains a redirected project. It writes `.socket/vendor/nuget/.gitattributes` so that git stores the seed bytes exactly as written.
-
-**Why this shape:**
-- The global packages folder (GPF) is never read or written for the patched package. Every other package keeps its normal GPF and caches.
-- `nuget.config` is never edited in the fallback tier.
-- Source mapping, user, CI and ancestor configs, `--source`, `NUGET_PACKAGES`, `--packages` and `locals --clear` do not affect the patched package.
-- Revert is deterministic: remove the generated block, restore the recorded lock entries, delete the seed. No cache eviction is needed.
-
-**What the lock gives, and what it does not.** In the fallback tier the lock `contentHash` is compared only with the committed `.nupkg.metadata`, so it pins version identity only. Byte integrity comes from three checks:
-- the restore-time set-and-hash check of the seed;
-- the build-time check of consumed files;
-- `vendor --check --online`, which rebuilds the expected seed from an anchor outside the repo (§7.3).
-
-**Enterprise `signatureValidationMode=require`.** A fallback folder is never signature-verified. These repos need the feed tier (§10). That tier is out of prototype scope and waits on depscan's CA-issued signing.
-
-## 2. Background: verified NuGet facts
-
-The research reports cited below, for example `lock-cache §c`, `sources §b` and `adv-env`, are committed in [`nuget-vendoring-research/`](nuget-vendoring-research/). They are the raw notes of the parallel research agents and the adversarial reviewers. `<scratch>` paths in them refer to the throwaway sandbox the experiments ran in.
-
-All runs used .NET SDK 8.0.131 (NuGet 6.8.2) on Linux. Labels:
-- **VERIFIED**: run in the original research; the report is cited.
-- **VERIFIED-D / -C**: run by the candidate authors.
-- **VERIFIED-ADV**: run by the adversarial reviewers: `adv-shapes eN`, `adv-env`, `adv-integrity xN`, `adv-lifecycle VN`.
-- **DOCS**: documentation only.
-- **REASONED**: inferred from code or from verified facts; not run.
-- **UNVERIFIED**: a proposal waiting on a gating experiment (§14).
-
-### 2.1 Why the same id+version cannot be made safe
-| Fact | Status |
-|---|---|
-| The GPF is keyed by id/version only. The first writer wins, and the entry is never refreshed, even with `--force --no-cache --force-evaluate`. | VERIFIED lock-cache §c, sources §a |
-| A failed `--locked-mode` restore (NU1403) still extracts the wrong copy into the GPF. | VERIFIED lock-cache §b |
-| Lock `contentHash` is compared only with `.nupkg.metadata`. A tampered dll passes locked restore. | VERIFIED lock-cache §b/§c; VERIFIED-ADV x1 (a seed) |
-| Patched bytes leak to other lockless projects on the same GPF, and the reverse happens too. | VERIFIED lock-cache §c, shapes §1A |
-| For the **same** id+version, the GPF beats a fallback folder. This is also true for V′: a GPF copy of V′ wins over the seed. | VERIFIED lock-cache §e; VERIFIED-ADV x2, adv-env M1 |
-| A fallback folder is used in place and never copied into the GPF. The minimum content is `.nupkg.metadata`, the nuspec and `lib/`. NuGet enumerates the whole directory, so extra `build/` files are imported. | VERIFIED lock-cache §e; VERIFIED-D V-D1/2; VERIFIED-ADV x1 |
-| A missing folder in `RestoreAdditionalProjectFallbackFolders` gives NU1301 in every project that imports it. | VERIFIED-ADV V2 |
-| Restore ignores missing imports. It rewrites locks to upstream, and only `build` fails with MSB4019. | VERIFIED-ADV V3 |
-
-### 2.2 Source routing is fragile
-| Fact | Status |
-|---|---|
-| Source mapping is exclusive and matches by id, not version. Mapping an id to a local feed breaks the id's other versions (NU1102). | VERIFIED sources §b |
-| When two sources hold the same id+version, the first to respond wins, so the result is nondeterministic. | VERIFIED sources §d |
-| A user-level mapping hides an unmapped repo source. A nearer file replaces a farther file's patterns for the same key. `<clear/>` drops farther levels. | VERIFIED sources §b/§c |
-| Config probing covers 3 spellings in every ancestor, then user, `config/*.config` and machine files. | VERIFIED sources §c |
-
-### 2.3 Version identity
-| Fact | Status |
-|---|---|
-| `X.Y.Z+meta` collides with X.Y.Z. `X.Y.Z-socket.N` sorts below X.Y.Z, which gives NU1605 and a false NU1903. | VERIFIED lock-cache §g, shapes §1B |
-| A 4-part `X.Y.Z.N` gets its own GPF directory and sorts above X.Y.Z. It works as a direct reference and as a CentralTransitive pin. | VERIFIED lock-cache §g, shapes §1B |
-| NuGetAudit still flags V′ whenever the advisory's vulnerable range includes V′. Example: `12.0.1.N` against the `< 13.0.1` advisory. "No false NU1903" holds only when the fix is V's next release. | VERIFIED-ADV e1, V1 (this corrects revision 1) |
-| An exact `[V′]` spreads through ProjectReference. It causes NU1107 against a sibling's `>= 13.0.3`, NU1107 across two patched versions of one id, and NU1608 in consumers. | VERIFIED-ADV e2 |
-| With `[V′, )` the declaring project resolves V′, AppA/AppC resolve 13.0.3 as before, and AppB resolves 13.0.1.N. No NU1107 or NU1608. | VERIFIED-ADV e2 |
-| When V′ is unreachable (an external consumer), `[V′, )` silently resolves the next higher version (NU1603). | VERIFIED-ADV e8 |
-| Floating ranges never select a 4th-part version. | VERIFIED shapes §7 |
-| A unique version leaks into packed nuspecs. | VERIFIED shapes §1B |
-| `Version="13.0.1.0"` means the same as 13.0.1 to NuGet but does not match the literal condition. | VERIFIED-ADV e9 |
-
-### 2.4 MSBuild and injection
-| Fact | Status |
-|---|---|
-| Only the nearest DBP/DBT is imported. Chaining with `GetPathOfFileAbove` works. | VERIFIED shapes §4 |
-| With chained DBTs, an import at the end of a nested DBT runs too early when it has a once-guard, so the redirect misses items declared later. | VERIFIED-ADV e7 |
-| `CustomAfterDirectoryBuildTargets`, set in DBP, is imported after the whole DBT chain (`Microsoft.Common.targets:55`), without the `ImportDirectoryBuildTargets` condition. | VERIFIED-ADV e7 (SDK 8 only) |
-| Our file, imported after DBT, comes after package `build/*.targets`. An unconditional property assignment there beats env vars and package props; only a global `-p:` beats it. | VERIFIED-ADV x1 |
-| `@(Item->WithMetadataValue(...))` conditions on evaluation-time ItemGroups work for PackageReference and PackageVersion Update. GlobalPackageReference and case-variant ids are covered. | VERIFIED shapes §2; VERIFIED-D e1/e7; VERIFIED-ADV (shapes) |
-| A PrivateAssets=all pin becomes a Direct lock entry and does not leak into pack. Without `Publish="true"` the dll is missing from publish output. | VERIFIED shapes §5; VERIFIED-D V-D11 |
-| A pin without a `$(TargetFramework)` condition adds a new Direct dependency to every TFM. | VERIFIED-ADV e3 |
-| The `AfterTargets=ResolvePackageAssets` guard runs in design-time builds. | VERIFIED-ADV (adv-env M2) |
-| Evaluation-time redirects work under static-graph restore (sln, and CPM with pinning on). SOCKETPATCH001 at `BeforeTargets=CollectPackageReferences` fires in normal and static-graph restore. | VERIFIED-D V-D3b; VERIFIED-ADV (shapes) |
-| The guard as written runs cleanly: it parses, batches, and preserves `GetFileHash` metadata. Cost is 52 ms per project for an 8.7 MB seed. | VERIFIED-ADV (shapes, env) |
-
-### 2.5 Integrity, signing and git
-| Fact | Status |
-|---|---|
-| For an unsigned nupkg, contentHash = base64(sha512(file)). For a signed nupkg it is computed with `.signature.p7s` removed. Signing never changes contentHash. | VERIFIED lock-cache §a, signing §e |
-| depscan's SRI with `sha512-` removed equals the unsigned contentHash. | VERIFIED depscan §1 |
-| Keeping the upstream signature on changed bytes gives NU3008. An unsigned package under `require` gives NU3004. Package and fallback folders are never verified. | VERIFIED signing §a/§b; VERIFIED-D V-D9 |
-| A self-signed author cert plus `<author allowUntrustedRoot>` passes `require`. `<author>` trust has no id scope. | VERIFIED signing §b/§c; DOCS |
-| `* text=auto`, `core.autocrlf=true` and `eol` rules rewrite seed text members. The author's tree stays clean, and every clone gets different bytes. | VERIFIED-ADV adv-env B1, x4/x5, V4 |
-| A nested `.gitattributes` with `* -text -diff -merge -filter` gives byte-identical clones under hostile root rules. | VERIFIED-ADV adv-env c2, V4 |
-| Seed files added outside the nuspec are imported and can disable a guard whose assignment is conditional. | VERIFIED-ADV x1 |
-
-## 3. Candidates considered
-
-| Key | Summary | Judge mean (/100) |
-|---|---|---|
-| A (feed hardened) | Same-version local feed, chain-aware mapping, pins in every lock, gitignored per-generation `RestorePackagesPath` | 59.6 |
-| B (unique version via feed) | `X.Y.Z.(D+1)-socket.p<uuid8>.<rev>` in a local feed, with per-project redirects | 70.5 |
-| C (repo-local seed) | Same id+version seeded into a committed repo-wide `RestorePackagesPath` | 70.2 |
-| D (unique-version fallback seed) | 4th-part V′ in a committed fallback folder; no config edits | **76.3** (chosen by 2 of 3 judges) |
-
-Mean judge scores per criterion (1–10; the total is out of 100, with correctness, GPF safety and integrity weighted double). Each judge scored through a different lens: shapes and environments, integrity and supply chain, and operability.
-
-| Candidate | correctness | integrity | gpf safety | diff size | revert | ci friction | impl cost | server side | total |
-|---|---|---|---|---|---|---|---|---|---|
-| A-feed-hardened | 5.7 | 7.0 | 7.7 | 5.7 | 6.3 | 3.7 | 3.7 | 5.7 | 59.6 |
-| B-unique-version | 6.3 | 7.7 | 9.7 | 5.7 | 8.0 | 5.3 | 2.7 | 8.3 | 70.5 |
-| C-repo-local-seed | 7.7 | 7.3 | 9.3 | 4.3 | 8.0 | 4.0 | 6.3 | 5.7 | 70.2 |
-| D-wildcard | 7.7 | 7.3 | 9.7 | 5.7 | 8.7 | 8.3 | 4.7 | 7.7 | 76.3 |
-
-## 4. Decision
-
-**D is the base.** The grafts from the other candidates:
-- **From C:** the resolved-root and consumed-file hash guard, now content-aware; `.gitignore` negations checked with `git check-ignore`; eviction of GPF entries leaked by the legacy layout, identified through `.nupkg.metadata` `source`.
-- **From B:** an invertible V′ derivation shared with depscan; the declared-version guard; refusal when a dependency constraint excludes V′; server-recorded upstream hashes; a sandboxed relock; the pack-roots policy; NuGetAuditSuppress.
-- **From A:** version-precise pins in every affected lock; config-chain discovery, used for signature policy only; the WIRING_FILES and sweep fix; the fix for the id-only hosted lock match at `redirect/mod.rs:5431`.
-
-**C was rejected** because a repo-wide `RestorePackagesPath` moves every package into the repo. That throws away the CI and developer GPF caches and breaks Docker layers and scripts, which is an operational regression for every repo.
-
-**Structural changes after adversarial review:**
-1. The floor range `[V′, )` replaces `[V′]`. SOCKETPATCH006 is added, and lock edits reach every consumer of a redirected project.
-2. The injection point moves from a DBT Import line to a DBP `CustomAfterDirectoryBuildTargets` block.
-3. A generated `.gitattributes` is added, and `--check` compares against committed blobs.
-4. A restore-time set-equality check of the seed is added. The guard property is assigned unconditionally. Exemptions come from a CLI-managed allowlist.
-5. The foreign-root check depends on content, and hash keys are `<idl>/<V′>/<rel>`.
-6. Shared outputs are regenerated by a CLI finalize hook (`sync_shared`) that runs after every ledger mutation. Removing the block needs no records.
-7. Patch updates, revert ordering, migration ordering and v4 compatibility are specified (§7.4–§7.7).
-8. Directories are named by uuid8, and the long-path check uses absolute paths.
-
-## 5. Tiers and layout selection
-
-| Tier | When | Mechanism |
-|---|---|---|
-| **fallback** | SDK-style PackageReference projects with no visible require policy | Committed extracted seed. Prototype scope. |
-| **feed** | A require policy is visible, the depscan org policy says require, or `--nuget-tier=feed` | Signed V′ nupkg in a per-uuid flat feed. Builder 0 (service bytes) only. Post-prototype, blocked on G6 and depscan #8 (§10). |
-| **legacy** | packages.config-only repos, `--nuget-layout=feed`, and existing legacy entries | Today's `nuget_feed.rs`, unchanged. |
-
-**Selection rules:**
-- The layout is selected by `--nuget-layout <feed|fallback>` on `GlobalArgs`, so it applies to vendor, scan, get and repair. The environment variable is `SOCKET_NUGET_LAYOUT`. The default is `feed` until promotion.
-- **Inference:** if any `nuget-fallback` entry exists, or the top-level optional `state.nugetLayout == "fallback"`, new NuGet entries use fallback whatever the flag says. The first fallback vendor sets `nugetLayout`.
-- **Hybrid router:** an entry whose `flavor` is `nuget-fallback`, or that carries `nuget_lock_entry_v2` records, always routes to the fallback backend. This covers entries that an older binary relabelled (§11.3).
-- **Refusals:**
-  - `vendor_nuget_tier_mixed`: more than one tier per repo.
-  - `vendor_nuget_mixed_project_styles`: packages.config and SDK projects resolve the same id@V. A dual-wiring entry is open question Q5.
-
-## 6. Mechanism
-
-### 6.1 Deriving V′
-The function is pure and must be identical in `vendor/nuget_version.rs` and in depscan `lib/src/nuget/socket-version.ts`, with shared golden vectors. Its inputs are the normalized upstream V, the uuid, and the builder (service = 0, local = 1).
-
-| Upstream V | V′ | Status |
-|---|---|---|
-| Stable, ≤ 3 parts or zero 4th part | `V.N`, where `N = 2^30 + ((u32(uuid[0..8]) >> 3) << 1) + builder`, in [2^30, 2^31−1] | Form VERIFIED-D (e1/e7) |
-| 4-part with D > 0 | `A.B.C.(D+1)-socket.p<uuid8>.<builder>` | Refused (`vendor_nuget_version_unsuffixable`) until G5 |
-| Prerelease | `X.Y.Z-pre.socket.p<uuid8>.<builder>` | Refused until G5 |
-
-- **Example:** uuid `3f9a01bc-…` gives `13.0.1.1340506222` for a service build, and `…223` for a local build.
-- **Collision refusals:**
-  - `vendor_nuget_version_collision`: two entries for the same id@V derive the same V′.
-  - `vendor_nuget_version_gap`: a published version of the id lies in (V, V′]. For example, an upstream 4-part `13.0.1.5` would change floor-range resolution. The server checks nuget.org and the org's configured upstreams (adv-env m7). The CLI repeats the check against the flatcontainer index when it is online.
-- **One V′, one byte sequence:** service artifacts are write-once per uuid. Builder 1 is not a single byte producer (adv-integrity M4), but in the fallback tier V′ bytes exist only in the committed seed, so the only cost is lock churn. The feed tier accepts builder 0 only.
-- The hot path accepts either builder for an existing uuid. The builder changes only with `--nuget-rebuild-service` (Q4).
-
-### 6.2 On-disk layout (fallback tier)
-```
-Directory.Build.props                  EDITED (socket-patch block) or CREATED
-src/Directory.Build.props              EDITED where it is the nearest DBP of an SDK project
-src/Lib/packages.lock.json             EDITED (entries for id@V and Project ranges only)
-src/AppA/packages.lock.json            EDITED (Project range only: consumer of a redirected project)
-.socket/vendor/state.json              flavor "nuget-fallback", nugetLayout, nugetShared
-.socket/vendor/nuget/
-  socket-patch.targets                 GENERATED by sync_shared (LF, -text)
-  .gitignore                           GENERATED (negations)
-  .gitattributes                       GENERATED
-  3f9a01bc/                            fallback root (uuid8; full uuid in marker + state)
-    socket-patch.vendor.json
-    newtonsoft.json/13.0.1.1340506222/
-      .nupkg.metadata                  {"version":2,"contentHash":"<b64 sha512 of V′ nupkg>","source":null}
-      newtonsoft.json.nuspec
-      lib/netstandard2.0/Newtonsoft.Json.dll   (patched)
-      …
-```
-
-**`.gitattributes`:**
-```
-* -text -diff -merge -filter
-/socket-patch.targets -text diff
-/.gitignore -text diff
-/.gitattributes -text diff
-```
-
-**`.gitignore`:**
-```
-!/3f9a01bc/
-!/3f9a01bc/**
-!/socket-patch.targets
-!/.gitattributes
-```
-
-**Post-write checks.** After writing, the CLI runs:
-- `git check-ignore` on the seed files, refusing with `vendor_artifact_gitignored`;
-- `git check-attr text eol filter` on the seed files, refusing with `vendor_artifact_git_transformed`, for example when a root LFS rule survives.
-
-**Seed extraction.** The seed is extracted from the V′ nupkg following NuGet's own rules:
-- entry names are percent-decoded, **then** validated with `is_safe_relative_subpath`, `is_plain_archive_name` and `names_are_unambiguous`, compared case-folded;
-- names containing any of `$ @ % ; ' = ( )` are refused (`vendor_nuget_unsafe_member`);
-- OPC parts and `.signature.p7s` are dropped;
-- the nuspec is renamed to `<idlower>.nuspec`;
-- no `.nupkg` or `.sha512` is written;
-- the existing zip-bomb caps (`MAX_ENTRIES`, per-entry and total limits) are reused.
-
-**Size and path limits:**
-- `vendor_nuget_seed_too_large` if any file is over 50 MB or the seed is over 200 MB (configurable).
-- `vendor_nuget_long_path` warns when the absolute path, under a pessimistic 60-character CI prefix or the real root, exceeds 240 characters. Above 250 characters the CLI refuses unless `--allow-long-paths` is given.
-
-### 6.3 Directory.Build.props block
-```xml
-  <!-- socket-patch:begin (generated; run `socket-patch vendor --revert` to remove) -->
-  <!-- socket-patch: .socket/vendor/nuget/3f9a01bc uuid=3f9a01bc-… -->
-  <PropertyGroup Label="socket-patch">
-    <CustomAfterDirectoryBuildTargets Condition="!$(CustomAfterDirectoryBuildTargets.Contains('socket-patch.targets'))">$(CustomAfterDirectoryBuildTargets);$(MSBuildThisFileDirectory).socket/vendor/nuget/socket-patch.targets</CustomAfterDirectoryBuildTargets>
-    <RestoreAdditionalProjectFallbackFolders>$(RestoreAdditionalProjectFallbackFolders);$(MSBuildThisFileDirectory).socket/vendor/nuget</RestoreAdditionalProjectFallbackFolders>
-  </PropertyGroup>
-  <!-- socket-patch:end -->
-```
-
-**Placement.** The block goes in the nearest DBP of **every** SDK project in the same git worktree, including projects that do not use the patched package. That lets SOCKETPATCH005 and 006 cover projects added later. Submodules, template content (`PackageType=Template`) and dot-directories are skipped, with warning `vendor_nuget_import_skipped`. Nested files use a relative `../` path. If the root has no DBP, the CLI creates `<Project>` containing the block and nothing else.
-
-**What the block does:**
-- **Import ordering.** The targets are imported after the entire DBT chain, which fixes the nested-chain misfire (VERIFIED-ADV e7, SDK 8). The `Contains` guard dedupes chained DBPs. Whether the property exists on SDK 6 and 7 is G10.
-- **Restore fail-closed.** Superseded (§0). The anchor folder let anyone plant packages. The prototype's `SocketPatchNuGetImportCheck` target fails restore with SOCKETPATCH007 instead. VERIFIED in the e2e.
-- **v4 compatibility.** The literal uuid comments let v4 drift-keep and VEX liveness see the uuid (§11.3).
-
-**Refusals:**
-- `vendor_nuget_dbp_disabled`: a project sets `ImportDirectoryBuildProps=false`.
-- `vendor_nuget_non_sdk_project`: a non-SDK project uses PackageReference, because the guard would never run there (adv-shapes M5).
-
-### 6.4 `socket-patch.targets` (generated; illustrative, deterministic, sorted)
-The example repo:
-- Lib has a direct 13.0.1 reference.
-- AppA references Lib and Lib3 (13.0.3).
-- Tool gets 12.0.1 through Bson, for netstandard2.0 only.
-- Web uses CPM.
-
-```xml
-<Project>
-  <!-- Generated by socket-patch from .socket/vendor/state.json; render sha256 recorded in state. Do not edit. -->
-  <!-- socket-patch: .socket/vendor/nuget/3f9a01bc  .socket/vendor/nuget/7c21d0e4 -->
-  <PropertyGroup>
-    <SocketPatchNuGetTargetsImported>true</SocketPatchNuGetTargetsImported>
-    <SocketPatchNuGetGuard>true</SocketPatchNuGetGuard>
-    <SocketPatchNuGetDir>$([MSBuild]::NormalizeDirectory('$(MSBuildThisFileDirectory)'))</SocketPatchNuGetDir>
-    <SocketPatchRepoRoot>$([MSBuild]::NormalizeDirectory('$(MSBuildThisFileDirectory)', '..', '..', '..'))</SocketPatchRepoRoot>
-    <SocketPatchProject>$([MSBuild]::MakeRelative('$(SocketPatchRepoRoot)', '$(MSBuildProjectFullPath)').Replace('\', '/'))</SocketPatchProject>
-    <_SpV_3f9a01bc>13.0.1.1340506222</_SpV_3f9a01bc>
-    <_SpV_7c21d0e4>12.0.1.1994350720</_SpV_7c21d0e4>
-    <RestoreAdditionalProjectFallbackFolders>$(RestoreAdditionalProjectFallbackFolders);$(SocketPatchNuGetDir)3f9a01bc;$(SocketPatchNuGetDir)7c21d0e4</RestoreAdditionalProjectFallbackFolders>
-    <_SpPatched>;newtonsoft.json/$(_SpV_3f9a01bc);newtonsoft.json/$(_SpV_7c21d0e4);</_SpPatched>
-    <_SpUpstream>;newtonsoft.json/13.0.1;newtonsoft.json/12.0.1;</_SpUpstream>
-    <_SpAllowUnpatched>;src/Legacy/Legacy.csproj;</_SpAllowUnpatched>
-    <_SpHashes>;newtonsoft.json/13.0.1.1340506222/lib/netstandard2.0/newtonsoft.json.dll=4F33…BD;…;</_SpHashes>
-  </PropertyGroup>
-
-  <!-- 3f9a01bc: Newtonsoft.Json 13.0.1 -> V′; one condition per recorded spelling of 13.0.1 -->
-  <ItemGroup Condition="'@(PackageReference->WithMetadataValue('Identity','Newtonsoft.Json')->WithMetadataValue('Version','13.0.1'))' != '' or '@(PackageReference->WithMetadataValue('Identity','Newtonsoft.Json')->WithMetadataValue('Version','13.0.1.0'))' != ''">
-    <PackageReference Update="Newtonsoft.Json" Version="[$(_SpV_3f9a01bc), )" />
-    <SocketPatchRedirect Include="newtonsoft.json/$(_SpV_3f9a01bc)" />
-    <NuGetAuditSuppress Include="https://github.com/advisories/GHSA-5crp-9r3c-p9vr" />
-  </ItemGroup>
-  <ItemGroup Condition="'$(ManagePackageVersionsCentrally)' == 'true' and '@(PackageVersion->WithMetadataValue('Identity','Newtonsoft.Json')->WithMetadataValue('Version','13.0.1'))' != ''">
-    <PackageVersion Update="Newtonsoft.Json" Version="[$(_SpV_3f9a01bc), )" />
-    <SocketPatchRedirect Include="newtonsoft.json/$(_SpV_3f9a01bc)" />
-  </ItemGroup>
-
-  <!-- 7c21d0e4: 12.0.1 transitive-only in Tool, netstandard2.0 only, while its direct parent Bson is still referenced -->
-  <ItemGroup Condition="'$(SocketPatchProject)' == 'src/Tool/Tool.csproj' and '$(TargetFramework)' == 'netstandard2.0' and '@(PackageReference->WithMetadataValue('Identity','Newtonsoft.Json'))' == '' and '@(PackageReference->WithMetadataValue('Identity','Newtonsoft.Json.Bson'))' != ''">
-    <PackageReference Include="Newtonsoft.Json" Version="[$(_SpV_7c21d0e4), )" PrivateAssets="all" Publish="true" />
-    <SocketPatchRedirect Include="newtonsoft.json/$(_SpV_7c21d0e4)" />
-  </ItemGroup>
-
-  <ItemGroup>
-    <SocketPatchSeedFile Include="$(SocketPatchNuGetDir)3f9a01bc/newtonsoft.json/13.0.1.1340506222/.nupkg.metadata" Sha256="C3E7…AF" PackageKey="newtonsoft.json/13.0.1.1340506222" />
-    <!-- … one row per seed file, every uuid -->
-  </ItemGroup>
-
-  <!-- restore time: the seed must be exactly the inventory (SOCKETPATCH001), with the recorded hashes (SOCKETPATCH002) -->
-  <Target Name="SocketPatchNuGetSeedCheck" BeforeTargets="_GenerateRestoreGraph;CollectPackageReferences" Condition="'$(SocketPatchNuGetGuard)' != 'false' and '$(_SpSeedChecked)' != 'true'">
-    <ItemGroup>
-      <_SpOnDisk Include="$(SocketPatchNuGetDir)3f9a01bc/**;$(SocketPatchNuGetDir)7c21d0e4/**" Exclude="$(SocketPatchNuGetDir)*/socket-patch.vendor.json" />
-      <_SpExtra Include="@(_SpOnDisk)" Exclude="@(SocketPatchSeedFile)" />
-      <_SpMissing Include="@(SocketPatchSeedFile)" Condition="!Exists('%(FullPath)')" />
-    </ItemGroup>
-    <Error Condition="'@(_SpMissing)@(_SpExtra)' != ''" Code="SOCKETPATCH001" Text="socket-patch: vendored NuGet seed does not match its inventory (missing: @(_SpMissing); unexpected: @(_SpExtra)). Run 'git checkout -- .socket/vendor/nuget' or 'socket-patch vendor'." />
-    <GetFileHash Files="@(SocketPatchSeedFile)" Algorithm="SHA256"><Output TaskParameter="Items" ItemName="_SpSeedHashed" /></GetFileHash>
-    <Error Condition="'%(_SpSeedHashed.FileHash)' != '%(_SpSeedHashed.Sha256)'" Code="SOCKETPATCH002" Text="socket-patch: vendored NuGet seed file modified: %(_SpSeedHashed.Identity)." />
-    <PropertyGroup><_SpSeedChecked>true</_SpSeedChecked></PropertyGroup>
-  </Target>
-
-  <!-- build time: consumed files (G1). Skipped in design-time builds. -->
-  <Target Name="SocketPatchNuGetGuard" AfterTargets="ResolvePackageAssets" Condition="'$(SocketPatchNuGetGuard)' != 'false' and '$(DesignTimeBuild)' != 'true'">
-    <ItemGroup>
-      <_SpCand Include="@(RuntimeCopyLocalItems);@(ResolvedCompileFileDefinitions);@(RuntimeTargetsCopyLocalItems);@(NativeCopyLocalItems);@(ResourceCopyLocalItems);@(Analyzer)"
-               SpKey=";$([System.String]::Copy('%(NuGetPackageId)/%(NuGetPackageVersion)').ToLowerInvariant());" />
-      <_SpPatched Include="@(_SpCand)" Condition="$(_SpPatched.Contains('%(SpKey)'))" />
-      <_SpUnpatched Include="@(_SpCand)" Condition="$(_SpUpstream.Contains('%(SpKey)'))" />
-      <_SpDrift Include="@(_SpCand)" Condition="'@(SocketPatchRedirect)' != '' and '%(NuGetPackageId)' != '' and $([System.String]::Copy('@(SocketPatchRedirect)').ToLowerInvariant().Contains('$([System.String]::Copy('%(NuGetPackageId)').ToLowerInvariant())/')) and !$(_SpPatched.Contains('%(SpKey)'))" />
-    </ItemGroup>
-    <Error Condition="'@(_SpUnpatched)' != '' and !$(_SpAllowUnpatched.Contains(';$(SocketPatchProject);'))" Code="SOCKETPATCH005" Text="socket-patch: $(SocketPatchProject) resolved UNPATCHED %(_SpUnpatched.NuGetPackageId) %(_SpUnpatched.NuGetPackageVersion), which is vendored-patched in this repo. Run 'socket-patch vendor'." />
-    <Error Condition="'@(_SpDrift)' != ''" Code="SOCKETPATCH006" Text="socket-patch: $(SocketPatchProject) redirects %(_SpDrift.NuGetPackageId) to the Socket-patched version but resolved %(_SpDrift.NuGetPackageVersion). Run 'socket-patch vendor' to re-plan." />
-    <GetFileHash Files="@(_SpPatched)" Algorithm="SHA256" Condition="'@(_SpPatched)' != ''"><Output TaskParameter="Items" ItemName="_SpHashed" /></GetFileHash>
-    <ItemGroup>
-      <_SpBad Include="@(_SpHashed)" Condition="!$(_SpHashes.Contains(';%(SpKeyPath)=%(FileHash);'))" />
-    </ItemGroup>
-    <Error Condition="'@(_SpBad)' != ''" Code="SOCKETPATCH003" Text="socket-patch: %(_SpBad.NuGetPackageId) %(_SpBad.NuGetPackageVersion) resolved from '%(_SpBad.FullPath)' with content that differs from the vendored patch. Another tool placed a different copy of this version in a package folder; remove it only if no other repo relies on it." />
-  </Target>
-  <!-- pack targets: §6.6 -->
-</Project>
-```
-
-**Notes on the file:**
-- **Content-aware foreign root.** `SpKeyPath` is `<idl>/<V′>/<rel>`, computed from the path relative to the package root it resolved in. The mechanics are G15. A byte-identical copy in the GPF passes. A different copy fails SOCKETPATCH003. The error message no longer tells the user to delete the folder.
-- **Package presence.** Presence is decided from `@(_SpCand)`, which now includes `@(Analyzer)`. For packages with no lib, ref or analyzer assets, the guard also reads the `libraries` keys of `project.assets.json` (G1).
-- **Guard escape hatch.** `SocketPatchNuGetGuard` is assigned unconditionally, so the only way to turn it off is a global `-p:SocketPatchNuGetGuard=false`. `vendor --check` flags `*.rsp` files that mention `SocketPatch*`.
-- **SOCKETPATCH005 exemptions.** Projects are exempted only through `_SpAllowUnpatched`, which is rendered from `state.nuget.allowUnpatched` (`socket-patch vendor --nuget-allow-unpatched <proj>`). There is no free-form property any more.
-- **Versions behind properties.** Versions sit in `_SpV_*` properties, so regex updaters see no literals. If a bot edits them anyway, SOCKETPATCH006 fires, and `--check` compares the render sha.
-- **Split CPM.** When one central PackageVersion resolves differently across projects, the CLI emits the per-project form `('$(SocketPatchProject)'=='a' or …)` (VERIFIED-D e7). A CPM transitive-only project gets a Version-less `Include` pin plus `Publish="true"`. A `VersionOverride` equal to V gets `VersionOverride="[V′, )"`. VersionOverrides to other versions are left alone.
-- **TFM conditions.** Pin TFM conditions use the alias taken from assets `project.frameworks`. A multi-TFM pin with no assets file, or with a custom alias, is refused (`vendor_nuget_tfm_alias_unknown`).
-
-### 6.5 Lock edits
-**Which lock.** For each project, in order:
-1. a static `NuGetLockFilePath` (a dynamic value is refused with `vendor_nuget_lockpath_dynamic`);
-2. `packages.<Project>.lock.json`;
-3. `packages.lock.json`.
-
-**Edits.** Splices are byte-preserving and TFM/RID-scoped. The exact `[V′, )` text is G11; the goldens are re-captured from `--force-evaluate`.
-
-| Project role | Before | After |
-|---|---|---|
-| Direct / CPM direct | `Direct`, `requested "[13.0.1, )"`, `resolved 13.0.1` | `Direct`, `requested "[V′, )"`, `resolved V′`, `contentHash <seed>` |
-| CPM uniform, pinning on (CentralTransitive) | `CentralTransitive`, `requested "[13.0.1, )"` | stays `CentralTransitive`; `requested "[V′, )"` plus new resolved and hash (VERIFIED-ADV e5 corrects revision 1) |
-| Transitive pin | `Transitive` | `Direct` with `requested` inserted. Written in NuGet's canonical order: Direct entries first (VERIFIED-ADV e3). |
-| Auto-follow consumer that resolved V | `Transitive 13.0.1` | `Transitive V′` plus hash |
-| Consumer that resolved R > V (AppA/AppC) | unchanged | unchanged. Its resolution is R because R > V′ is guaranteed by the gap check. |
-| `Project` entry listing a redirected project | `"[13.0.1, )"` | `"[V′, )"`, in **every** lock whose graph contains that project |
-
-**Records.**
-- One record per edit: `nuget_lock_entry_v2` (key `<lockrel>#<tfm>[/<rid>]#<id>`) or `nuget_lock_project_range`.
-- Records are stored EOL-neutral, together with the observed EOL.
-- Live-text comparisons normalize CRLF to LF, and splices use the live file's EOL.
-- Relock comparison is semantic (parsed JSON), not textual.
-
-### 6.6 Pack
-- **Range restore** (`AfterTargets=_GetAbsoluteOutputPathsForPack`, VERIFIED-D V-D6 and VERIFIED-ADV e5): `"[V′, )"` is replaced with the **recorded original literal range**, for example `[13.0.1]` stays exact.
-- **Pre-check**, `BeforeTargets=GenerateNuspec`: fail SOCKETPATCH004 if the rewritten assets still contain any V′.
-- **Post-check**, `AfterTargets=GenerateNuspec`: read exactly `$(NuspecOutputAbsolutePath)$(PackageId).$(PackageVersion).nuspec`. This avoids MSB4184 when several nuspecs are present (VERIFIED-ADV e5). On failure, `<Delete Files="@(NuGetPackOutput)"/>` runs before the error, because the nupkg was already written (VERIFIED-ADV e5).
-- Both checks are G2. If G2 fails on any supported SDK, packable projects with a direct patched reference are refused (`vendor_nuget_packable_direct`). Opt-in: `--nuget-pack-policy=roots`.
-
-### 6.7 State
-```json
-{"ecosystem":"nuget","flavor":"nuget-fallback","basePurl":"pkg:nuget/Newtonsoft.Json@13.0.1","uuid":"3f9a01bc-…",
- "artifact":{"path":".socket/vendor/nuget/3f9a01bc/newtonsoft.json/13.0.1.1340506222","sha256":"",
-   "fileInventory":{"lib/netstandard2.0/Newtonsoft.Json.dll":"4f33…","…":"…"}},
- "nuget":{"tier":"fallback","wired":true,"upstreamVersion":"13.0.1","patchedVersion":"13.0.1.1340506222",
-   "builder":"local","contentHash":"FRVi…","upstreamSha512":"…","upstreamContentHash":"…","packPolicy":"restore-ranges",
-   "literals":["13.0.1","13.0.1.0"],"allowUnpatched":[],
-   "projects":[{"path":"src/Lib/Lib.csproj","role":"direct","declared":"13.0.1","tfms":["net8.0"]},
-               {"path":"src/AppA/AppA.csproj","role":"range-consumer","tfms":["net8.0"]}]},
- "wiring":[
-   {"file":"src/Lib/packages.lock.json","kind":"nuget_lock_entry_v2","key":"…#net8.0#Newtonsoft.Json","original":"…","new":"…"},
-   {"file":"Directory.Build.props","kind":"nuget_uuid_anchor","action":"Referenced"}]}
-```
-Top-level additions to `VendorState`, all additive and optional:
-- `nugetLayout`;
-- `nugetShared`: `{renderSha256, props:[{file, created, original}]}`.
-
-**Rules:**
-- The DBP block is owned by the state, not by any entry. `nuget_uuid_anchor` is a reference only: v5 never reverts from it, and it exists so v4 sees the file (§11.3).
-- `nuget.projects` is the authoritative closure (§7.2).
-- `wired=false` marks Preserved or Kept entries. `sync_shared` never renders them.
-- `fileInventory` intactness replaces the existence-only `ledger_covers` check for directory artifacts.
-
-## 7. Algorithms
-
-### 7.1 Apply (`vendor_nuget_fallback`)
-1. **Prelude** (`fallback_prelude`, shared with `service_preflight`). It refuses on:
-   - unsafe coordinates;
-   - `version_unsuffixable`, `version_gap`, `version_collision`;
-   - signature policy: config chain for every project directory, plus `DOTNET_NUGET_SIGNATURE_VERIFICATION`;
-   - `mixed_project_styles`, `dbp_disabled`, `non_sdk_project`;
-   - `external_consumer`: a project outside the root references a redirected project, or an `.sln`/`.slnf` above the root lists one;
-   - `exact_dependency`: a dependency constraint excludes V′;
-   - `version_literal_unknown`: property-expanded versions on an SDK without `-getItem` (< 8), which are refused;
-   - `sdk_unavailable`: the SDK that `global.json` pins is not installed;
-   - `implicit_reference`: `IsImplicitlyDefined`, for example FSharp.Core;
-   - `tool_only`: tool packages cannot be patched this way, and the crawler must not claim that they are covered;
-   - `tier_mixed`, `layout_mixed`.
-
-   Entries that share this entry's ledger key or basePurl are excluded from the duplicate and collision checks.
-2. **Closure plan** (`plan_closure`):
-   - Enumerate `*.*proj` plus the projects listed in the sln. Skip dot-directories, `bin`, `obj`, `node_modules` and configured package folders.
-   - Read assets, or else the lock, or else csproj and CPM text.
-   - Count a `resolved` that decodes (`parse_socket_nuget_version`) to (id, V) as V.
-   - Roles: `direct`, `cpm-uniform`, `cpm-split`, `auto-follow`, `pin`, and `range-consumer`. A range-consumer is any project whose graph reaches a redirected project; ProjectReferences are walked in both directions.
-   - Projects that are already planned and have no assets are not refused. `vendor_nuget_unrestored` applies only to **new** projects with neither a lock nor assets.
-3. **Materialise the V′ nupkg:**
-   - from the service `nupkg-socket-version` artifact (builder 0), or
-   - by running `reversion_nupkg` on the SRI-verified same-version service nupkg or on `local_rebuild` output (builder 1).
-
-   The upstream is verified by its repository signature, or by sha512 against depscan `upstreamSha512`. Every patched member is checked against its afterHash.
-4. **Stage everything in memory:** the seed tree, all lock splices, and the new DBP blocks.
-5. **Write, with snapshots:**
-   - Write the seed atomically (temp directory, then rename). Reuse it if it already matches `fileInventory`.
-   - Snapshot the bytes of every file about to be touched, then write the locks and DBPs, each by temp file and rename.
-6. Optional `--nuget-relock`: a sandboxed `--force-evaluate` run with a throwaway `NUGET_PACKAGES`, then a semantic diff against the planned key set.
-7. **Unwind** on any failure in steps 5–6: restore every snapshot, and delete the seed only if this run created it.
-8. Return `VendorOutcome::Done`. The CLI then persists the entry, sweeps stale artifacts, and calls **`sync_shared`**.
-
-### 7.2 `sync_shared(cwd, &VendorState)`, the CLI finalize hook
-It is called after every ledger mutation: `run_vendor` (after persist and sweep), revert, rollback, remove, gc, repair, and scan/get in vendored mode. It runs:
-- in memory during `--dry-run`;
-- idempotently; on failure it reports `vendor_nuget_shared_sync_failed` and exits non-zero.
-
-What it does:
-1. It selects entries that are `nuget-fallback`, `wired`, and whose seed directory is present. For an entry that is wired but has a missing seed, it warns and does not render it.
-2. If the selection is non-empty:
-   - it renders `socket-patch.targets`, `.gitignore` and `.gitattributes`, and writes the DBP blocks into every nearest DBP;
-   - it refuses without `--force` when the on-disk targets differ from `nugetShared.renderSha256` (`vendor_nuget_targets_edited`).
-3. If the selection is empty:
-   - it removes the block from every discovered DBP, plus every DBP listed in `nugetShared.props`, without needing any per-entry records;
-   - it deletes a DBP whose text equals the created text; otherwise it restores `original` when the rest of the file is unchanged;
-   - it deletes the targets file only after every block is gone. If any excision drifts, it writes a stub `<Project/>` targets file instead;
-   - it deletes `.gitignore` and `.gitattributes` last.
-
-### 7.3 Hot path, `--check`, `--check --online`
-**In sync**, which returns `AlreadyPatched`, requires all of:
-- the seed file set equals `fileInventory`, with no extra, symlinked or non-regular files, and the hashes match;
-- `.nupkg.metadata` equals the recorded contentHash;
-- the shared outputs are byte-equal to the render (they are `-text`, so this is safe);
-- every lock record's live text equals `new`, compared EOL-neutral;
-- a re-plan from csproj, CPM and locks, with V′ counted as V, matches `nuget.projects`.
-
-A changed closure is re-planned and re-keyed, and warns `vendor_nuget_closure_changed`.
-
-**`--check`** does everything above, plus:
-- it compares seed hashes against the **committed** blobs (`git cat-file HEAD:<path>`) and checks `git ls-files --eol`, reporting `vendor_nuget_eol_normalized`;
-- it evaluates every discovered project with `dotnet msbuild -getProperty:SocketPatchNuGetTargetsImported` (batched). Any project that resolves the id at V without importing the targets fails (`vendor_nuget_project_uncovered`);
-- it probes the signature policy again;
-- it flags repo trustedSigners that are not in state, and `.rsp` overrides;
-- it reports untracked seeds, stale keys, unused entries and orphaned pins.
-
-It works before any restore, because it relies on the persisted closure.
-
-**`--check --online`** also rebuilds the expected tree from an anchor outside the repo and diffs it byte for byte. The anchor is either the service artifact (SRI) or upstream plus afterHashes. This is the recommended required CI step.
-
-### 7.4 Revert
-Steps, in order:
-1. **Lock records.**
-   - Live text equal to `new`: splice `original` back.
-   - Live text equal to `original`: the record is done.
-   - Otherwise it is drift. Drift is repaired **only** from depscan `upstreamContentHash`, or from a freshly downloaded nuget.org nupkg whose repository signature was checked. It is never repaired from the GPF (adv-integrity M5).
-2. **keep** = any drifted record whose live text still contains V′. If keep is set, the entry becomes `wired=true`, `kept_artifact`, and the process stops here.
-3. The CLI drops the entry, or marks it `wired=false` for Preserved, then saves state and runs `sync_shared`. That regenerates the targets or removes the blocks, deleting the targets only after the blocks are gone.
-4. It deletes the seed and prunes empty levels. It first runs `refuse_symlinked`/`first_symlink` on the seed and all its ancestors.
-5. No GPF eviction is needed (VERIFIED-D V-D12).
-
-### 7.5 Patch update (a new uuid for the same purl)
-- The planner treats the old V′a as V (step 2). Lock edits V′a → V′b record `original: None`, so `carry_forward_wiring` fills in A's true upstream original. The key has no uuid in it.
-- `carry_forward_wiring` merges import state across uuids implicitly, because that state now lives in the state-level `nugetShared`.
-- The old entry is excluded from the prelude checks. The CLI replaces the entry, sweeps A's seed, and then runs `sync_shared`, which renders only B.
-- Docker leg: vendor A, update to B, locked restore, revert, then `git diff --exit-code`.
-
-### 7.6 Migration from the legacy layout (`--migrate-nuget`)
-1. Run `fallback_prelude` and `plan_closure` first. A refusal leaves legacy intact.
-2. Materialise V′ by running `reversion_nupkg` on the **committed legacy `.nupkg`** (builder 1), and verify the afterHashes. Local rebuild is not used, because the GPF holds patched bytes.
-3. As one unwindable unit: run the legacy revert (config, catch-all when the live text equals the legacy `new`, root lock), then apply fallback.
-4. Opt-in `--nuget-evict-legacy-cache`: delete `<idl>/<V>/` GPF entries whose `.nupkg.metadata` `source` is a `.socket/vendor/nuget/<uuid>` path, and print the command for CI caches.
-
-### 7.7 Pristine source on clean machines
-When the GPF never holds upstream V, a rung fetches `https://api.nuget.org/v3-flatcontainer/<idl>/<v>/<idl>.<v>.nupkg`. It verifies the result fail-closed against the upstream contentHash recorded in the ledger (the `original` of any `nuget_lock_entry_v2`), using the signed-content hash. Repair, patch update and `--offline` use this rung.
-
-For fallback entries, `vend_installed!` no longer `debug_assert`s `Installed`, and the hot path never reads `installed_dir`.
-
-### 7.8 Crawler, VEX, in-use
-- **Crawler:** `nuget_crawler.rs` skips `.socket/vendor/nuget/**` packageFolders and maps V′ to (upstream purl, uuid).
-- **VEX:** the fallback extractor parses `socket-patch.targets` (literal uuid comments and `_SpV_*`) and the discovered locks (V′ decoded). The nuget probe files gain the targets file, the DBPs and the locks.
-- **In use:** an entry is in use when a lock or assets file resolves V′ for a reason other than our own pin. A pin with no remaining parent edge gives `vendor_nuget_pin_orphaned` and is dropped on the next `vendor`.
-
-## 8. Supported shapes (fallback tier)
-
-| Shape | Status | Evidence / notes |
-|---|---|---|
-| SDK sln, per-project locks, `--locked-mode`, warm or cold GPF | Supported | VERIFIED-D V-D3/V-D10, VERIFIED-ADV (env). Goldens for the `[V′, )` form: G11. |
-| Patched library consumed next to a higher sibling (AppA/AppC) | Supported | `[V′, )` plus Project-range edits in every consumer lock (VERIFIED-ADV e2) |
-| Multiple patched versions of one id reached by one project | Supported | Resolves the higher V′ (VERIFIED-ADV e2) |
-| CPM, pinning off/on, VersionOverride | Supported | VERIFIED-D V-D7; static graph with pinning on VERIFIED-ADV |
-| Transitive-only, multi-TFM | Supported | TFM-conditioned pin (VERIFIED-ADV e3 shows the need; the fix is G11) |
-| Nested and chained DBT/DBP | Supported | `CustomAfterDirectoryBuildTargets` (VERIFIED-ADV e7 on SDK 8; SDK 6/7 is G10) |
-| No lockfile | Supported, warning `vendor_nuget_no_lockfile` | 001/002/003/005/006 |
-| Spelling variants `13.0.1.0`, `[13.0.1]` | Supported | One condition per recorded spelling. A new spelling in a new project gives loud 005. |
-| `*.proj` NoTargets/Traversal, `.fsproj`, `.sqlproj` | Supported if SDK-style | Enumerated through `*.*proj` plus the sln |
-| Any source mapping, `<clear/>`, `--source`, `NUGET_PACKAGES`, `--packages`, `locals --clear` | Supported | VERIFIED-D V-D2/4/5b/9 |
-| Byte-identical V′ in a shared GPF | Supported | Content-aware 003 (G15) |
-| Windows checkout with `autocrlf`, `* text=auto`, LFS rules | Supported | `.gitattributes` (VERIFIED-ADV c2/V4). A surviving LFS rule is refused. |
-| Packable library with a direct patched dependency | Supported with warning, or refused until G2 | §6.6 |
-| Project outside the `.socket` root referencing a redirected project | Refused: `vendor_nuget_external_consumer` | VERIFIED-ADV e8 |
-| Non-SDK csproj with PackageReference | Refused: `vendor_nuget_non_sdk_project` | REASONED (no mono) |
-| Mixed packages.config and SDK on the same id@V | Refused: `vendor_nuget_mixed_project_styles` | Q5 |
-| packages.config only | Legacy layout | |
-| Property-expanded version on SDK < 8, or `global.json` SDK missing | Refused | REASONED |
-| Implicit SDK references (FSharp.Core) | Refused | REASONED |
-| 4-part non-zero or prerelease upstream | Refused until G5 | |
-| `require` policy visible | Refused (fallback tier) | Feed tier is post-prototype |
-| Submodules, template content | Skipped with warning | |
-
-## 9. Failure modes
-
-| Situation | Result | Loud? |
-|---|---|---|
-| Seed file missing or added (for example planted `build/*.props`) | SOCKETPATCH001 at restore, before `nuget.g.*` is regenerated on a clean checkout | Yes (G13) |
-| Seed file edited | SOCKETPATCH002 at restore and build | Yes |
-| All of `.socket/vendor/nuget` missing | SOCKETPATCH007 at restore (prototype, VERIFIED in the e2e), then MSB4019 at build | Yes |
-| Only `socket-patch.targets` missing | Restore **succeeds and rewrites locks to upstream** (V3). Build gives MSB4019, and `--check` fails. | Build only; the CI gate is `--check` |
-| V′ elsewhere, different bytes | SOCKETPATCH003. NU1403 applies only if `.nupkg.metadata` differs (VERIFIED-ADV x2). | Yes |
-| V′ elsewhere, same bytes | Accepted | — |
-| New or renamed project that imports the targets | SOCKETPATCH005, and NU1004 when locked | Yes |
-| New nested DBP that does not chain to the root | **Silent at build** (VERIFIED-ADV x3, DBT analogue). Caught by `--check` import evaluation. | CI gate |
-| Redirect engaged but drifted (bot edit, parent bump, NU1603) | SOCKETPATCH006 | Yes |
-| Bot bumps the declared version | Redirect disengages; the lock diff shows V′ → new; `--check` flags the unused entry | In PR |
-| Env var or package props setting `SocketPatchNuGetGuard=false` | Ignored (unconditional assignment) | — |
-| Global `-p:SocketPatchNuGetGuard=false` | Guards off (escape hatch) | User choice |
-| Planted `build/*.targets` on a dev machine that already restored | Arbitrary code before the guard; residual risk | Accepted; mitigated by `--check --online` in CI |
-| Design-time build | Redirects apply; the guard is skipped | — (G16) |
-| Docker `COPY *.csproj` without DBP/.socket | Locked: NU1004. Lockless: SOCKETPATCH005 at full build. `vendor` warns `vendor_nuget_dockerfile_copy`. | Yes |
-| Sparse checkout without `.socket/` | NU1301/MSB4019. The block comment names `git sparse-checkout add .socket/vendor/nuget`. | Yes |
-| CI-only `require` policy | Silently bypassed; closed by depscan org policy #6 | No (accepted gap) |
-| NuGetAudit when V′ is still in an advisory range | NuGetAuditSuppress (NuGet ≥ 6.11). Older SDKs emit info `vendor_nuget_audit_still_flags`. | Parity with pre-patch |
-| SBOM and dependency-graph tools reading locks | They see V′; depscan mapping (#4); document Dependabot alert behaviour | Docs |
-| Missing seed + VS nomination restore + lockless + attacker feed serving V′ | Possible code execution | Accepted residual. Server gap check covers org upstreams. |
-
-## 10. Signing and enterprise policy (feed tier; post-prototype)
-
-- **Fallback tier:** it never claims signature enforcement. It refuses under a visible `require`, never writes `accept`, and never sets `DOTNET_NUGET_SIGNATURE_VERIFICATION`.
-- **Feed tier:**
-  - Builder 0 only, so shared GPFs stay safe (adv-integrity M4).
-  - It adds exactly one `<add>` for the per-uuid feed. Id-exact mapping is added only where a repo mapping already exists. It refuses with `vendor_nuget_feed_mapping_conflict` when the only mapping is outside the repo and the repo uses several versions of the id.
-  - **Trust:** it never writes a pfx-holder `<author>` to repo config by default. The default path is depscan's CA-issued certificate plus RFC3161 timestamp (#8), trusted once at org or machine level. The opt-in `--nuget-sign-ephemeral` generates a per-uuid key, signs, destroys the key, then writes the fingerprint, so trust covers exactly the bytes already signed. `--check` flags unrecorded trustedSigners.
-  - **Guard:** the same content-aware 003/002 as the fallback tier.
-  - Gated by G6.
-
-## 11. Compatibility
-
-### 11.1 Hosted
-- Unchanged until WS1 (`hosted_revert_unsupported`).
-- Later, hosted can serve V′ from v3 and reuse the targets file.
-- Independent fix: version-precise hosted lock matching at `redirect/mod.rs:5431`.
-
-### 11.2 Repair and sweep
-- WIRING_FILES gains the three `nuget.config` spellings, the discovered DBP and DBT files, and `packages*.lock.json`.
-- Reserved names: `socket-patch.targets`, `.gitignore`, `.gitattributes`.
-- A wiring file that names a uuid directory makes that directory live.
-
-### 11.3 Older binaries (v4.0.0 is released)
-- **The risk (REASONED from code).** Without mitigation, v4's revert deletes the seed while the locks and targets still reference it. v4's vendor applies a legacy layout on top.
-- **Mitigations:**
-  - The literal `.socket/vendor/nuget/<uuid>` comments in the root DBP block, plus a `nuget_uuid_anchor` record, make v4's drift-keep keep the seed and the entry (fail-safe).
-  - The v5 hybrid router (§5) and a heal step: detect a legacy `socket-patch-<uuid>` source next to a fallback seed, remove it, and restore the lock.
-  - `revert_nuget_opts` fails closed on an unknown flavor (v5).
-  - The minimum version is documented.
-- **Test:** G14 runs the real v4 binary against a fallback repo.
-
-## 12. Server/CLI split (depscan)
-
-| # | depscan addition | Needed for |
-|---|---|---|
-| 1 | `lib/src/nuget/socket-version.ts` derive/parse, with golden vectors shared with Rust | GA |
-| 2 | `nuget-socket-version` repacker (V′ nuspec, STORE-only, deterministic, write-once). Refuses versions in (V, V′] on nuget.org **and the org's configured upstreams**. | GA |
-| 3 | `artifacts[].kind="nupkg-socket-version"`, `nugetPatchedVersion`, `upstreamContentHash`, `upstreamSha512` | **GA** (provenance, drift repair, `--check --online`) |
-| 4 | SBOM mapping V′ → upstream purl plus uuid; recognise the fallback folders. Bump task versions, run `generate-task-metadata`, use `RunTask` helpers. | **GA blocker** |
-| 5 | Fixed-advisory GHSA list per patch (NuGetAuditSuppress) | Prototype nice-to-have; the CLI can fall back to local advisory data |
-| 6 | Org `nugetSignaturePolicy: require` | GA for enterprises |
-| 7 | `nuget-seed` artifact (extracted layout plus inventory), tested with real dotnet | Post-GA |
-| 8 | CA-issued Socket author signing plus timestamp | Feed tier |
-| 9 | Hosted V′ in flat and registration indexes | Later |
-
-Identity and bytes (about 30% of the logic) belong to the server. All repo and machine wiring is 100% CLI.
-
-## 13. Test plan
-
-**Hermetic unit tests** (`cargo test -p socket-patch-core --lib nuget_`):
-- `nuget_version`: vectors, round-trip, gap refusal.
-- `nuget_lock`: goldens from real `--force-evaluate` output for `[V′, )`, covering:
-  - each role, including CentralTransitive with pinning on, range-consumers and canonical Direct ordering;
-  - CRLF and no trailing newline;
-  - RID goldens for a `runtimes/` package (SqlClient);
-  - EOL-neutral revert and drift.
-- `nuget_targets`: render golden with uppercase-hex pinning; XML and MSBuild escaping; DBP block inject and excise on CRLF, BOM, `<Project/>`, chained DBPs; stub rendering.
-- `nuget_seed`: decode-then-validate traversal cases (`%2E%2E%2F`, `%5C`), metacharacter refusal, case-fold collisions, OPC drops, `reversion_nupkg` determinism.
-- `nuget_projects`: closure on fixtures (e2 AppA/AppB/AppC, multi-TFM e3, external consumer e8, spellings e9, submodule, template).
-- `nuget_policy`: chain merge.
-- `sync_shared`: update, revert order, Preserved, dry run.
-
-**Real-dotnet e2e** (`e2e_nuget_dotnet_build.rs`; SDK 6–10 ubuntu, 8 macOS, **windows-latest**). Legs:
-- `sln_locked`, `cpm_locked`;
-- warm GPF;
-- `RestorePackagesPath`/`NUGET_PACKAGES`;
-- `locals --clear`;
-- tamper (002) and planted file (001);
-- env-var disable ignored;
-- pack (range restore, 004 pre and post, output deleted);
-- revert plus `git diff --exit-code`.
-
-**Docker** (`docker_e2e_vendor_nuget.rs`):
-- static graph; no lockfile;
-- 005 rename; 006 bot edit;
-- anchor NU1301; `--packages` then `--no-restore`;
-- hostile user mapping;
-- require refusal;
-- migration plus eviction;
-- idempotence;
-- G3 two roots;
-- e2/e3/e7/e8 fixtures;
-- same-bytes V′ in the GPF (003 passes) and different bytes (003 fails);
-- patch update A→B then revert;
-- two-id revert in both orders;
-- crash between write and save (resume via `sync_shared`);
-- v4 binary (G14);
-- parallel `-m`;
-- mono image for the packages.config refusal.
-
-**Real-clone legs** (prototype acceptance): commit, `git clone`, build under `* text=auto`, `autocrlf=true`, a `*.dll filter=lfs` root rule, and sparse checkout.
-
-**Regression:** every existing `nuget_feed` test passes unchanged with the default layout.
-
-## 14. Gating experiments and open questions
-
-| ID | Question | Blocks |
-|---|---|---|
-| G1 | Content-aware guard with multiple roots; `@(Analyzer)`; analyzer-only and build-only packages via the assets `libraries` | Prototype |
-| G2 | Pack pre/post checks and `@(NuGetPackOutput)` deletion on SDK 6–10 | Packable support |
-| G3 | Multiple uuid roots plus the anchor root together | Prototype |
-| G4 | SOCKETPATCH005/006 on renamed projects (001 is VERIFIED-ADV) | Prototype |
-| G5 | Prerelease-tagged V′ forms | 4-part/prerelease |
-| G6 | Feed tier with V′ under `require`; shared GPF across repos | Feed tier |
-| G7 | Static graph plus `dotnet test` across CPM variants | Promotion |
-| G8 | macOS/Windows path case; nuget.exe packages.config | Promotion |
-| G9 | VS/Rider design-time restore honours redirects | Docs |
-| G10 | `CustomAfterDirectoryBuildTargets` on SDK 6/7; chained-DBP dedupe | **Prototype** |
-| G11 | `[V′, )` lock goldens, TFM-conditioned pins, no NU1603 when the seed is present | **Prototype** |
-| G12 | The anchor fallback folder gives NU1301 at restore when `.socket/vendor/nuget` is missing, and nothing when present | **Prototype** |
-| G13 | Restore-time set check: glob includes dotfiles, runs under static graph, runs before a planted `build/` file on a clean checkout | **Prototype** |
-| G14 | v4.0.0 revert and vendor against a fallback repo keep the seed (fail-safe) | **Prototype** |
-| G15 | `SpKeyPath` computation for GPF-resolved files | Prototype |
-| G16 | Guard skipped when `DesignTimeBuild=true` in VS, Rider and C# Dev Kit | Promotion |
-| Q1 | Should SOCKETPATCH005/006 be warnings for one release? | Product |
-| Q2 | Is org require policy (#6) enough, or should the feed tier be default for paid orgs? | Product |
-| Q3 | Renovate and Dependabot behaviour on the targets file; emit `ignorePaths: [".socket/**"]`? | Docs |
-| Q4 | Re-vendor builder-1 seeds to builder 0 once the service artifact ships? | Post-GA |
-| Q5 | Dual wiring (legacy for packages.config plus fallback for SDK) for mixed repos? | Post-prototype |
-
-## 15. Prototype scope
-
-**Goal.** A working prototype for SDK sln with locks in locked mode, and for CPM, with no change to default behaviour.
-
-**Gating.**
-- `--nuget-layout` on `GlobalArgs`, with the inference rules from §5.
-- `layout_for(entry, state, run)` is used by `dispatch_vendor_one` (callers at `vendor.rs:2636` and `repair_vendor.rs:1632`, and via `vendor_records`).
-- `service_preflight` changes signature to take `&VendorState`.
-- The revert arm uses the hybrid router.
-
-**In scope:**
-- Fallback tier; 3-part V′.
-- All roles, including range-consumers.
-- The DBP block, the anchor, and `sync_shared`.
-- `.gitattributes` with probes.
-- Guards 001–006 and the pack checks.
-- NuGetAuditSuppress.
-- Hot path, `--check` (including `--online`), revert.
-- Patch update.
-- The pristine fetch rung.
-- VEX extractor, crawler skip, in-use probe.
-- v4 anchor and hybrid router.
-- Flavor gate, WIRING_FILES, sweep.
-- Name validation and escaping.
-
-**Out of scope:** the feed tier and signing; 4-part and prerelease upstreams; packages.config (legacy, and mixed repos are refused); `--nuget-relock`; migration (refused with `vendor_nuget_layout_mixed`); hosted, apart from the `:5431` fix.
-
-**Modules** (under `crates/socket-patch-core/src/vendor/` unless noted):
-
-| Module | Items |
-|---|---|
-| `nuget_version.rs` | `NugetBuilder`, `SocketNugetVersion`, `socket_nuget_version`, `parse_socket_nuget_version`, `check_version_gap` |
-| `nuget_projects.rs` | `NugetProject`, `discover_projects` (`*.*proj`, sln, worktree-bounded), `plan_closure` (V′-aware, bidirectional), `ProjectRole::{Direct, CpmUniform, CpmSplit, AutoFollow, Pin{tfm_alias, parent}, RangeConsumer}`, `excluding_constraints`, `external_consumers` |
-| `nuget_lock.rs` | `LockEntryEdit`, `plan_lock_edits`, `splice` (EOL-aware), `revert_lock_entry_record`, `semantic_eq` |
-| `nuget_seed.rs` | `reversion_nupkg`, `extract_seed` (decode then validate), `seed_inventory`, `walk_seed_strict`, `write_seed_atomic` |
-| `nuget_targets.rs` | `render_targets`, `render_gitignore`, `render_gitattributes`, `render_dbp_block`, `inject_block`, `excise_block`, `msbuild_escape` |
-| `nuget_shared.rs` | `sync_shared(cwd, &VendorState, dry_run)` |
-| `nuget_policy.rs` | `effective_signature_mode` |
-| `nuget_fallback.rs` | `vendor_nuget_fallback`, `revert_nuget_fallback_opts`, `service_preflight`, `fallback_prelude`, `fallback_in_sync`, `layout_for`, `fetch_pristine` |
-| `state.rs` | `NugetMeta` (with `wired`, `literals`, `allowUnpatched`, upstream hashes), `nugetLayout`, `nugetShared`, `fileInventory` intactness in `ledger_covers` |
-| `ledger_snapshots.rs`, `path.rs`, `verify.rs` | new kinds; uuid8 nested leaf parser; reserved names; set-equality verify |
-| `nuget_feed.rs` | flavor gate; `CONFIG_NAMES` |
-| `crawlers/nuget_crawler.rs`, `vex/discover/nuget.rs`, `vex/discover/mod.rs:1750` | skip seeds; fallback extractor; probe files |
-| CLI `vendor.rs`, `rollback.rs`, `remove`, `gc`, `repair_vendor.rs`, scan/get | `sync_shared` calls; `vend_installed!` fix; in-use probe; `GlobalArgs` flag |
-
-The CLI and VEX work adds roughly 30–40% over the revision 1 estimate.
-
-**Prototype acceptance:**
-- the §13 unit goldens;
-- sln and CPM e2e on SDK 6–10, plus Windows and macOS;
-- the docker suite and the real-clone legs;
-- G1, G3, G4, G10–G15;
-- zero changes to existing NuGet test outcomes.
-
-**Promotion to default** additionally requires G2, G7, G8 and G16; depscan #2–#4; and one release as opt-in.
-
-## 16. Adversarial review
-
-Dispositions: **Fixed** (design changed), **Refused** (moved to refused shapes), **Accepted** (risk kept, with rationale), **Open** (gating experiment or question).
-
-### Shapes
-| ID | Finding | Disposition |
-|---|---|---|
-| S-B1 | `[V′]` spreads via ProjectReference (NU1107, NU1608, NU1004 outside the closure) | **Fixed:** `[V′, )`, SOCKETPATCH006, range-consumer lock edits, gap check (§6.1, §6.4, §6.5). Goldens G11. |
-| S-B2 | Once-guard on a chained DBT imports too early; pin gives NU1504 | **Fixed:** DBP `CustomAfterDirectoryBuildTargets` (§6.3). SDK 6/7 is G10. |
-| S-B3 | autocrlf breaks the seed | **Fixed:** generated `.gitattributes` plus `check-attr`; LFS refused (§6.2) |
-| S-M1 | Pins not TFM-conditioned | **Fixed:** alias condition from assets; unknown alias refused |
-| S-M2 | Consumer outside the root breaks, or goes silent under `[V′, )` | **Refused:** `vendor_nuget_external_consumer`; 006 covers in-root drift |
-| S-M3 | 004 fires after the nupkg is written | **Fixed:** pre-check plus deletion of `NuGetPackOutput` (G2) |
-| S-M4 | Several nuspecs give MSB4184 | **Fixed:** exact nuspec path |
-| S-M5 | Non-SDK PackageReference projects are unguarded | **Refused:** `vendor_nuget_non_sdk_project` |
-| S-M6 | NU1903 still fires on V′ | **Fixed:** §2.3 corrected; NuGetAuditSuppress in prototype; info code on < 6.11 |
-| S-M7 | Literal spellings, `*.proj` types, SDK < 8 `-getItem` | **Fixed:** one condition per spelling, `*.*proj` plus sln; SDK < 8 property versions and missing SDK refused |
-| S-minor | CPM golden, canonical order, per-package seed hashing, exact literal in pack, implicit refs, tool wording, RID goldens, MAX_PATH, analyzers | **Fixed:** §6.5, §6.6, §7.1, §13, uuid8. Seed hashing moved to a once-per-restore check (`_SpSeedChecked`). Analyzers are G1. |
-
-### Environments and CI
-| ID | Finding | Disposition |
-|---|---|---|
-| E-B1 | EOL normalization fails fresh clones | **Fixed:** `.gitattributes`, `--check` against HEAD blobs, `ls-files --eol`, clone legs in acceptance |
-| E-M1 | Same-bytes V′ in the GPF fails 003 with destructive advice | **Fixed:** content-aware 003, `<idl>/<V′>` keys, new message (G15) |
-| E-M2 | Guard runs in design-time builds | **Fixed:** `DesignTimeBuild` condition; §9 corrected (G16) |
-| E-M3 | Windows path depth | **Fixed:** uuid8 directory, absolute-path check with refusal, Windows leg in prototype |
-| E-M4 | EOL-sensitive comparisons | **Fixed:** generated files `-text`; EOL-neutral records and splices |
-| E-M5 | Mixed packages.config/SDK undefined | **Refused:** `vendor_nuget_mixed_project_styles`; dual wiring is Q5 |
-| E-M6 | `--check` needs restore outputs | **Fixed:** persisted closure is authoritative; unrestored applies only to new projects |
-| E-M7 | Renovate/Dependabot edit the targets | **Fixed:** property-indirected versions, render sha, 006 catches edits. Q3 stays open. |
-| E-minor | Sparse checkout, Docker COPY, `git clean`, seed size, case collisions, predictable-V′ attack, SBOM alerts, setup-dotnet cache, concurrency | **Fixed/Accepted:** block comment; `vendor_nuget_dockerfile_copy`; untracked-seed check; size caps; case-fold refusal; server gap check over org upstreams (residual accepted, §9); depscan #4; dot-directory skip; no fix needed for concurrency |
-
-### Integrity
-| ID | Finding | Disposition |
-|---|---|---|
-| I-B1 | Seed file set unpinned; planted files disable the guard; lock pins nothing | **Fixed:** restore-time set and hash check (G13), strict CLI walk, `--check --online`, unconditional guard. §1 wording narrowed. **Accepted residual:** a dev machine that already restored a planted seed runs its code; CI `--online` is the defence. |
-| I-B2 | Git transforms seed bytes | **Fixed** (same as E-B1) |
-| I-M1 | Env var, props or rsp disable the guard | **Fixed:** unconditional assignment (VERIFIED-ADV x1), CLI allowlist, rsp flagging |
-| I-M2 | New nested DBT hides the import silently | **Fixed/Accepted:** `--check` evaluates every project's import; documented as the CI gate. Build-time silence is accepted. |
-| I-M3 | GPF V′ beats the seed | **Fixed:** content-aware 003; §9 wording corrected; exact per-uuid root is no longer needed because keys are content-based |
-| I-M4 | Builder 1 is not one byte sequence | **Fixed:** feed tier accepts builder 0 only. **Accepted** for the fallback tier: only lock churn. |
-| I-M5 | Drift repair from a poisoned GPF | **Fixed:** repair only from depscan or a signature-verified download |
-| I-M6 | Upstream provenance lost | **Fixed:** signature or sha512 check at vendor; `upstreamSha512` recorded; depscan #3 is GA |
-| I-M7 | Repo-level pfx author trust is id-unscoped | **Fixed:** feed tier defaults to CA cert; ephemeral-key opt-in; `--check` flags trustedSigners |
-| I-M8 | Percent-decoding traversal and MSBuild injection | **Fixed:** decode then validate, metacharacter refusal, escaping, strict validation at render |
-| I-M9 | Analyzer and build-only packages unguarded | **Fixed:** `@(Analyzer)`, assets `libraries`, unconditional restore check (G1) |
-| I-minor | Symlinks, late `require`, nuspec edits, §9 wording, stale obj, hex-case golden | **Fixed:** symlink refusal on ancestors; `--check` policy re-probe; set check; wording; test legs; golden |
-
-### Lifecycle
-| ID | Finding | Disposition |
-|---|---|---|
-| L-B1 | Patch update renders both uuids, pins a dead V′, breaks revert | **Fixed:** `sync_shared` after persist and sweep; V′-aware planner; `original: None` carry-forward; replaced entry excluded (§7.5) |
-| L-B2 | Import records lost across uuids, order and crashes | **Fixed:** state-owned block, record-free excision, blocks removed before the targets, stub on drift (§7.2) |
-| L-B3 | Seed not byte-stable through git | **Fixed** (E-B1) |
-| L-M1 | Preserved or Kept entries re-wired | **Fixed:** `wired` flag; missing seeds are never rendered |
-| L-M2 | Revert order defeats drift-keep | **Fixed:** §7.4 order |
-| L-M3 | No pristine source on clean machines; `debug_assert` panic | **Fixed:** fetch rung verified against ledger hashes; assert removed for fallback (§7.7) |
-| L-M4 | Hot path and `--check` before restore; re-plan misreads V′ | **Fixed:** persisted plan; V′ decoded as V |
-| L-M5 | v4 binaries corrupt fallback entries | **Fixed/Open:** literal uuid anchor, hybrid router, heal step; G14 |
-| L-M6 | VEX silently drops fallback patches | **Fixed:** extractor and probe files in prototype scope |
-| L-M7 | Unsafe unwind of shared outputs and reused seeds | **Fixed:** staged writes, snapshots, delete only what this run created |
-| L-M8 | Migration destroys its own source | **Fixed:** prelude first, re-version the committed legacy nupkg, one atomic unit (§7.6) |
-| L-M9 | Restore does not fail closed on a missing targets file | **Fixed/Accepted:** anchor NU1301 when `.socket` is gone (G12); targets-only deletion accepted, with `--check` as CI gate; §9 corrected |
-| L-M10 | Transitive pins keep themselves alive | **Fixed:** pin conditioned on the direct parent; in-use probe excludes self-edges; `pin_orphaned` |
-| L-M11 | Layout choice does not persist | **Fixed:** `GlobalArgs` flag, inference, `nugetLayout` |
-| L-P1 | Prototype needs CLI hooks not in §15 | **Fixed:** §15 scope and module table extended (+30–40%) |
-| L-minor | User edits of the targets, submodules/templates, builder churn, dry run, directory `ledger_covers`, NU1903 | **Fixed:** render sha plus `targets_edited`; worktree bound plus skip; builder sticky; in-memory render; inventory intactness; S-M6 |
-
-## 17. Prototype (follow-up branch `v5/nuget-vendoring-prototype`): what was built and how it deviates
-
-**Code:** `crates/socket-patch-core/src/vendor/nuget_{version,seed,lock,targets,fallback}.rs`, plus small routing hooks in `vendor/mod.rs`, `commands/vendor.rs` and `commands/repair_vendor.rs`.
-
-**Tests:**
-- unit tests in each module;
-- lock fixtures captured from real `dotnet` in `crates/socket-patch-core/tests/fixtures/nuget-fallback/{sln,cpm,cpmpin,cpm-tool}`. NuGet's own `--force-evaluate` output is the golden for the splice;
-- `crates/socket-patch-cli/tests/e2e_nuget_fallback_dotnet.rs`, which is `#[ignore]` and runs against the real SDK and nuget.org. Its legs are `sln_locked`, `cpm_locked`, `cpm_pinning` and `sln_patch_update`.
-
-The default layout is unchanged: every existing NuGet test passes untouched.
-
-Implementation: `crates/socket-patch-core/src/vendor/nuget_{version,lock,seed,targets,fallback}.rs`.
-
-### Behaviour deviations (deliberate)
-
-1. **Lock rule for a range at V that resolved elsewhere.** The spec only edits entries whose `resolved` is V. NuGet also rewrites `requested "[V, )"` → `"[V′, )"` on a `CentralTransitive` (or `Direct`) entry that resolved to some other version (cpm-tool `Tool`: `resolved 12.0.1`). Without this edit, `--locked-mode` fails NU1004. The splice now makes the requested-only edit (`resolved` and `contentHash` are left unchanged), and the golden `cpm-tool` fixture proves it.
-2. **`CentralTransitive` at V counts for transitive-only too.** Under CPM *without* pinning, a `CentralTransitive` V entry is refused `vendor_nuget_transitive_only` when the project has no `Project` reference to a redirected project. This follows from NuGet itself: without pinning the central version is not applied, so the entry resolves upstream V and the build guard would fire. With `CentralPackageTransitivePinningEnabled` it is redirected. Pinning is detected by a repo-global text scan.
-3. **Layout selection is per purl.** The env var or any `nuget-fallback` ledger entry selects the fallback layout, except for a purl the ledger already holds as a legacy feed entry: that purl keeps routing to `nuget_feed` (vendor and service preflight), so an in-sync legacy entry never fails `vendor_nuget_layout_mixed` once the repo opts in. The refusal stays in the backend for direct callers. The earlier "targets file exists" signal was dropped: `.socket/` writes are outside the group commit, so a failed or crashed run could leave the targets behind and silently opt the repo in.
-4. **DBP block text.**
-   - The begin comment is `(generated; remove with: socket-patch vendor revert)`. An XML comment cannot contain `--`, and a DBP that fails to load is silently ignored by restore.
-   - `<rel>` is rendered with its trailing slash (`""` / `../`), which gives `$(MSBuildThisFileDirectory).socket/...` and never `//.socket`.
-   - **The anchor line is gone.** Registering `.socket/vendor/nuget` itself as a fallback folder let anyone plant `<id>/<ver>/` beside the uuid dirs and have NuGet restore it under `--locked-mode` with no seed check (security review, reproduced on SDK 8). The block now holds a `SocketPatchNuGetImportCheck` target instead (`BeforeTargets="_GenerateRestoreGraph;CollectPackageReferences"`, condition `'$(SocketPatchNuGetTargetsImported)' != 'true'`), which fails restore with **SOCKETPATCH007** when the targets were not imported (the vendored tree is missing; restore ignores the missing import). The e2e proves it for locked and unlocked restore. `-p:SocketPatchNuGetGuard=false` disables it like the other guards.
-   - A props file socket-patch **created** carries `socket-patch:begin created` on its begin line. Only such a file is deleted on the last revert, when nothing but its block was added (compared with BOM and CRLF normalised). A user's own `<Project>\n</Project>\n` is kept, and a CRLF checkout of a created file is still deleted. Re-rendering a block keeps the tag.
-   - The `</Project>` insertion point (and a self-closing `<Project/>`) is found with comments blanked, so a `</Project>` inside a trailing comment is never used.
-5. **The render inputs live in the marker.**
-   - `socket-patch.vendor.json` gains an optional `nuget` section: `id`, `version`, `socketVersion`, `contentHash`, `spellings`, `inventory`, and `wired` (default true).
-   - `sync_shared` renders the seed inventory from the marker, never from the disk, so a tampered seed is never re-baselined.
-   - The marker is not trusted alone: when the ledger has a `nuget-fallback` entry for the uuid, its `artifact.file_inventory` replaces the marker's inventory in the render. The one exception is the seed the current vendor run just wrote (`RenderScope::fresh`). The markers are also diffable in `.gitattributes` (`/*/socket-patch.vendor.json -text diff`), so a changed hash shows in review.
-   - The `AlreadyPatched` fast path also requires every patched file in the seed to hash to its `afterHash`.
-   - A `--preserve-state` revert (`keep_artifact`) writes `wired: false`. The seed stays on disk but is no longer rendered into the targets.
-6. **Extra refusal codes** beyond the spec list:
-   - `vendor_nuget_nuspec_patched`: the patch rewrites the root nuspec, which the layout re-versions.
-   - `vendor_nuget_version_literal_unknown`: a `$(Property)` or item version for the id.
-   - `vendor_nuget_lock_unreadable`: an unparseable or unreadable lock.
-   - `vendor_nuget_seed_failed`: the canonical zip failed.
-   - `vendor_nuget_symlink_unsupported`: a project file, `Directory.Build.props` or `packages.lock.json` under the root is a symlink (an atomic rewrite would replace the link, and a skipped linked props file would silently shadow the wiring). `sync_shared` and revert refuse the same way before writing anything.
-   - `vendor_nuget_repo_too_large`: the discovery walk hit its 100,000-entry cap. Vendor refuses, and `sync_shared` / revert fail before writing, instead of silently wiring only part of the tree.
-   - Coordinates containing `--` refuse `unsafe_coordinates` (they are rendered into XML comments); `.` / `..` and `--` never render from a marker either.
-   - Floating (`*`) or bracketed ranges naming V in csproj/props text refuse `vendor_nuget_range_unsupported`, the same code as lock ranges.
-7. **Member-name validation.**
-   - Names are percent-decoded first.
-   - They must then pass `is_safe_relative_subpath` + `is_plain_archive_name` + `names_are_unambiguous` (printable ASCII; no `\ : * ? " < > |`; no case-fold collisions).
-   - Names containing `$ @ % ; '` are refused instead of escaped.
-   - Members named `.nupkg.metadata`, `*.nupkg` or `*.nupkg.sha512` are refused.
-   - OPC parts (`[Content_Types].xml`, `_rels/`, `package/`) and `.signature.p7s` are dropped, compared case-insensitively.
-   - The nuspec `<id>` must match the purl id.
-8. **`vendor_nuget_no_lockfile`** is emitted when **no** discovered `packages.lock.json` references the id (at V, V′ or an older Socket version of V), not per project.
-9. **Signature policy is conservative.**
-   - The CLI refuses if *any* config sets `signatureValidationMode=require`. It checks every dir from each SDK project dir up to the root, the root and its ancestors (all three config spellings), `~/.nuget/NuGet/NuGet.Config`, and `%APPDATA%/NuGet/NuGet.Config`.
-   - NuGet's nearest-wins override is not modelled, and `DOTNET_NUGET_SIGNATURE_VERIFICATION` is not read.
-10. **contentHash bytes.** The canonical zip is built with the existing `write_zip_entries` (zip-crate deflate level 6, fixed DOS time, mode 0644), so its hash differs from the Python-built fixture hash (`DDiM…`). NuGet only string-compares lock ↔ `.nupkg.metadata`, and the real-dotnet e2e proves the Rust value works.
-11. **Wiring record shape and per-entry revert.**
-    - One `nuget_lock_file_v2` record per lock that pins the id after the splice (edited now or already spliced): `key` is the id, `original` and `new` hold the whole text. Recording unchanged-but-spliced locks keeps their revert across a partial re-vendor.
-    - The kind is registered in `ledger_snapshots::WHOLE_FILE_KINDS`, so large `new` values are diff-encoded (ledger version 2).
-    - When the pre-edit lock already names a Socket version of V anywhere (a re-vendor, same or older uuid), `original` is `None` and `carry_forward_wiring` fills it from the replaced entry.
-    - **The revert does not restore whole files.** `nuget_lock::unsplice_lock` puts back only this entry's values (V′ in `resolved`, `requested`, Project `[V′, )` ranges, and the matching `contentHash`), each to the value the recorded `original` held at the same JSON path (else plain V / `[V, )`; a hash only from `original`). Another seed's splice, a package or framework added since, and EOLs are untouched, so seeds sharing a lock revert in any order and a stale carried-forward original cannot discard later edits. When no upstream hash is recorded the entry is left at V′ and reported `vendor_lock_entry_drifted` (the seed is then kept).
-12. **Seed rebuild.** An existing but stale seed dir for the same uuid is rebuilt through `<uuid>.socket-stage` + `swap_stage_into_place`. If a later step fails, the unwind deletes the seed only when this run created it, so a replaced stale seed is not restored.
-13. **Self-closing `<Project/>` DBP.** It is expanded to `<Project>…</Project>`, and excision leaves `<Project>\n</Project>` rather than byte-restoring the self-closing spelling (the file is kept, never deleted, since socket-patch did not create it). The same applies to a `</Project>` sharing a line with other content, where one extra EOL remains.
-14. **Seed materialisation.**
-    - The new `nuget_feed::patched_nupkg_bytes` wraps the unchanged `materialise_patched_nupkg` (service download → local rebuild) in a private temp stage.
-    - `config_wired=true` is passed only so a failed build does not prune the stage's parents.
-    - The seed is then extracted from those same-version bytes.
-15. **Patch update (new uuid).** `splice_lock` treats any value at an *older* Socket version of the same V (resolved, requested, Project range) as a re-splice target and moves it to the new V′ and hash. The vendor run leaves the superseded uuid's seed out of the render (`RenderScope::exclude`), and the CLI re-runs `sync_shared` after `sweep_stale_artifact` deletes the old uuid dir. The new `sln_patch_update` e2e leg proves the flow with real dotnet.
-
-### Verified with real dotnet (SDK 8.0.131, nuget.org)
-`e2e_nuget_fallback_dotnet` covers `sln_locked`, `cpm_locked`, `cpm_pinning` and `sln_patch_update`. The first three each do the following:
-- runs the real `socket-patch scan --mode vendored --vendor-source build` with `SOCKET_PATCH_NUGET_LAYOUT=fallback`;
-- on a fresh copy, runs `restore --locked-mode` with a cold GPF: the locks are unchanged and the App (and Tool) bin dll carries the patched bytes;
-- does the same with a warm GPF that holds upstream 13.0.1;
-- tampers a seed file and checks for `SOCKETPATCH002`, then restores the committed bytes and checks that restore passes;
-- removes `.socket/vendor/nuget` from a checkout and checks that locked and unlocked restore fail `SOCKETPATCH007`;
-- re-runs vendor **without** the env var (the ledger alone selects the layout) and checks that no project file changes;
-- runs `vendor --revert` without the env var and checks that the tree outside `.socket/` is byte-identical and no `.socket/vendor/` remains;
-- runs a locked restore and build of the reverted tree and checks that the pristine dll is back.
-
-`sln_patch_update` vendors uuid 1, then a newer patch (uuid 2) without the env var, and checks: no `vendor_nuget_no_lockfile`, both locks at V′₂ only, the targets name only uuid 2, the uuid 1 dir is gone, a cold locked restore leaves the locks unchanged and builds the uuid 2 bytes, and `vendor --revert` restores the pre-vendor tree byte for byte.
-
-### Known gaps (out of scope / follow-ups)
-- The following are not implemented:
-  - SOCKETPATCH003/004/006, pack range restore, per-project transitive pins, packages.config, the feed tier and signing, migration from the legacy layout (refused as `vendor_nuget_layout_mixed` for the same purl only), and `--check`.
-  - Post-write git probes: `vendor_artifact_gitignored` / `_git_transformed`.
-  - Long-path warning, size caps beyond the existing zip-bomb caps, and the version-gap/collision checks against nuget.org.
-- **Lock discovery** reads only `<projdir>/packages.lock.json`. `NuGetLockFilePath` and `packages.<Project>.lock.json` are ignored.
-- **Version literals** are found only as `Version=` attributes or `<Version>` children of `PackageReference` / `PackageVersion` / `GlobalPackageReference` in `*.csproj|fsproj|vbproj|props|targets` text. MSBuild evaluation is not used.
-- **DBP placement** only considers DBPs inside the root. A `Directory.Build.props` *above* the repo root that a project relied on is shadowed by the created root DBP, because the created file does not import the parent.
-- **Repair.** It can re-synthesise a fallback entry from the targets file (flavor stamped `nuget-fallback`), but not its lock wiring records. A revert of such a reconstructed entry deletes the seed and leaves the locks spliced.
-- **Service download path.** Every e2e vendor uses `--vendor-source build`; the fallback's use of a downloaded service artifact (`patched_nupkg_bytes` → service copy, fallback `service_preflight`) is covered only by unit tests of the shared feed pipeline.
-- **SOCKETPATCH005** (the build guard) is not exercised by the e2e.
-- **Marker trust.** A uuid dir with no ledger entry (state.json lost, or before the entry is committed) still renders from its own marker.
-- **Orphan sweep.** It now treats uuid dirs named in `socket-patch.targets` as wired.
-- **Migration.** A purl held by a legacy feed entry keeps the feed layout even with the env var set; migrating it needs a `vendor --revert` first.
-- **VEX.** There is no fallback extractor. Discovery returns nothing for fallback repos (the golden `vex-discover-golden/nuget-fallback.json` records empty results; there is no crash). Ledger-based VEX verifies the seed dir through the existing dir-artifact path, members plus `fileInventory`.
-- **Crawler.** After a restore, `obj/project.assets.json` lists the fallback folder as a package folder, so the crawler may report `newtonsoft.json@13.0.1.<N>` as an installed package. This is not mapped back to the upstream purl.
-- **Pre-existing failures, unrelated.**
-  - `cargo clippy --workspace --all-targets --all-features -- -D warnings` fails only in the untouched `crates/socket-patch-cli/tests/covgap_commands_rollback.rs:152` (dead fields `before_hash`/`after_hash`).
-  - 9 core lib tests fail in this environment regardless of this change (it runs as root: read-only-permission tests and an RSS measurement).
-  - `cargo fmt --all` reformats ~75 unrelated files on HEAD. Those changes were reverted; only the files touched here are rustfmt-clean.
-
diff --git a/docs/design/repacking-to-depscan.md b/docs/design/repacking-to-depscan.md
deleted file mode 100644
index a8f5acc7..00000000
--- a/docs/design/repacking-to-depscan.md
+++ /dev/null
@@ -1,1014 +0,0 @@
-# Repacking moves to depscan (server-primary, one local class)
-
-> Reference copy of PR #286, which was closed without merging. Each
-> finding's owner (workstream, in-flight PR or owner decision) is in
-> the [triage map](https://github.com/SocketDev/socket-patch/pull/286#issuecomment-5869109317).
-
-Status: chosen design, pending owner sign-off on the open questions (last
-section). Baseline: socket-patch `release/v5-prerelease` at 8ae7dc37,
-depscan `master` at 93e149c9ba. Supporting evidence: the repacking inventory
-of both repos and the verified waste findings (cited as F01–F80). Line
-numbers are at those baselines; depscan paths carry a `depscan:` prefix.
-Where a claim rests on an in-flight v5 branch, the branch is named.
-
-## Summary
-
-- **depscan becomes the producer of installable patched bytes** for every
-  vendorable ecosystem except maven/nuget (frozen, unchanged). The CLI
-  resolves, downloads, verifies, and wires. It computes no lock pin except
-  the one class below, and a pin it does compute is always cross-checked
-  against the server's value where one exists.
-- **Exactly one local builder stays**: the pypi wheel built from the
-  installed dist (`pypi_wheel.rs`). It runs only when the server returns a
-  terminal `refused { localBuild: "allowed" }` verdict: releases with no
-  servable wheel for the requested tags (the installed binary was
-  necessarily built on the user's machine), or an upstream file over the
-  serve cap. The verdict is keyed on (uuid, requested wheel) and carries a
-  TTL, because PyPI can add wheels to a release later; the ledger's
-  `producer` keeps the choice sticky. It never runs because of an outage.
-- **One producer per artifact, and the ledger keeps it sticky.** Vendor
-  `state.json` records `producer`, `recipe`, `generation`, and
-  `statementDigest`. Outages, 5xx responses and `pending_build` fail
-  retryably and leave the lock untouched. The integrity flip that #250 and
-  `reuse.rs` exist to hide can no longer happen. Reuse stays, as the
-  network-free re-run path.
-- **Contract v2 is additive, on the existing endpoint** `POST
-  /v0/orgs/{slug}/patches/package` (and its anonymous twin `POST
-  /patch/package`). It adds per-uuid `refused`, `format`, `generation`,
-  `retryAfterSeconds`, pypi wheel variants, and a detached signed
-  statement (DSSE over JCS). Offline use gets a content-addressed user
-  cache and a signed export bundle. v1 stays schema-compatible: the only
-  changes are `yarn-berry-zip.url` becoming null and an additive
-  `yarnBerry10c0` on the tarball integrity.
-- **Sequencing respects WS5.** Everything before step 24 is additive and
-  flag-gated. Flipping the default (step 24) and deleting the builders
-  (Phase 4; about 2,050 CLI src LOC and about 1,260 test LOC) both need
-  the owner to reverse the WS5 caveat after #283 merges; step 24 also
-  needs 30 days of telemetry. CI minutes saved: about 0. This is a
-  correctness and maintenance change, not a CI lever. The CI levers are
-  F51 (≈280 job-min), F41, F52, F53 and F55 (see v5-waste-review.md
-  Top-10); F78, which contains F63, is a transient saving during the v5
-  draft train.
-
-## Current state
-
-### Who builds what
-
-LOC counts treat `#[cfg(test)] mod` as the boundary between src and test.
-"Byte-identical" means the CLI's local build equals the server artifact.
-
-| Flavor (all PM versions stay) | Server artifact (depscan:workspaces/patches/src/repack) | Server src/test LOC | CLI local build | CLI build src/test LOC | Lock pin (vendored) | Byte-identical? |
-|---|---|---|---|---|---|---|
-| npm, pnpm 1–10 incl. legacy, bun.lock/bun.lockb | tgz, `repackers/npm.ts` (upstream order, mtime 0, zlib default; depscan:workspaces/patches-shared/src/archive/repack-utils.ts:597-660) | 557 / 467 (npm incl. berry) | `npm_pack.rs:73-177` (sorted, mtime 499162500, flate2 level 6) plus `npm_common.rs:248-396` stage branch | 177 / 247 plus about 149 | sha512 SRI | **No** |
-| yarn classic | same tgz | — | same | — | sha1 `#hash` plus integrity | **No** |
-| yarn berry | tgz plus `yarnBerry10c0` (`berry-cache-zip.ts`, a TS port of `berry_zip.rs`); `.berry.zip` sidecar stored and never read (F33) | 353 / 167 | `berry_zip.rs` recompute over the local tgz | 333 / 320 | `checksum 10c0/…` plus `hash=` (first 6 hex of tgz sha512, `yarn_berry_lock.rs:272-277`) | Recipe yes; input tgz differs, so **no** in practice |
-| vlt | same tgz | — | `npm_dir.rs` `stage_patch_dir` local branch (about 594-730) | about 137 | none vendored (directory); hosted pins raw sha512 | n/a (extracted) |
-| pypi: uv, poetry, pdm, pipenv, requirements, hatch | wheel only with `artifact_id`/`packaging=wheel` qualifier, else the sdist (`pypiPurlWantsWheel`); bz2/xz sdists refused after download (`repackers/pypi.ts:131-138`, F69) | 411 / 816 | `pypi_wheel.rs` from installed site-packages RECORD, Deflated zip | 696 / 1,288 | wheel sha256 | **No** |
-| gem (Bundler, all eras) | `.gem` plus stub `.gemspec`; platform gems refused | 777 / 768 | `gem.rs` `materialise_patched_copy` (1192-1339) | 148 | none (PATH source, CHECKSUMS stripped) | n/a (extracted) |
-| cargo (lock v1–v4) | `.crate` plus sparse-index line | 982 / 976 | `cargo.rs` `copy_and_patch` | 86 | none (path dep, `.cargo-checksum.json` dropped at `cargo.rs:394`) | n/a (extracted) |
-| golang | module zip plus gopatch zip plus go.mod, dirhashH1; no-go.mod modules refused (depscan:…/repackers/golang.ts:109-115) | 792 / 485 | FallBack arm (`golang.rs` about 291-354) into `patch/redirect/golang_local.rs` (agent-mode code, stays) | about 64 | none (dir `replace`, no go.sum) | n/a (extracted, h1 verified) |
-| composer | dist zip (STORE) | 308 / 352 | `composer_lock.rs` `copy_and_patch` | 60 | none (path dist) | n/a (extracted) |
-| maven | jar (STORE) plus pom | 483 / 523 | `local_rebuild_jar`/`rebuild_jar_bytes` (Deflate, `maven_repo.rs:776-862`; the byte difference is shown by the test at :4112) | about 160 | `.sha1` sidecars | **No** (frozen) |
-| nuget | nupkg (STORE, unsigned) | 167 / 187 | `nuget_feed.rs` `local_rebuild` | 130 | contentHash = b64(sha512) | untested (frozen) |
-
-Shared machinery:
-- CLI side:
-  - `registry_fetch.rs`: 2,316 src and 2,914 test LOC. It holds the
-    pristine ladder, the verifiers and the extractors.
-  - `source.rs`: 222 / 135.
-  - `reuse.rs`: 382 / 741.
-  - `service_fetch.rs`: 321 / 564.
-  - `prestage.rs`: service-only, despite being listed in WS5.
-- Server side:
-  - `upstream/*`: about 3,043 LOC including tests.
-  - `patches-shared/src/archive`: 2,041 / 1,894.
-  - `services/patch-package`: 3,031 / 646.
-  - repack overall: 6,015 / 4,976, 133 tap tests.
-- Churn:
-  - The CLI builders are cold: npm_pack 4 commits, berry_zip 4,
-    pypi_wheel 7.
-  - The server repack is under active hardening: 31 commits, including
-    #22388, #23523, #25259, #26792 and #26857.
-- Bug history:
-  - CLI builders: no packing-specific fix commit. The npm_pack (4),
-    berry_zip (4) and pypi_wheel (7) commits are all omnibus or feature
-    PRs.
-  - Shared machinery: registry_fetch has 11 commits (16 with `--follow`,
-    15 of them fix-matching), including #175 (bundler audit, 13 bugs),
-    #241 (poetry) and #242 (pipenv). service_fetch has #249 (trust
-    hardening) and #194 (cargo fail-closed); reuse.rs came from #250.
-  - Server `pypi.ts`: 5 fix subjects (#21508 sdist reliability, #22724
-    src-layout rescue, #22752 version spelling, #23523 artifact
-    integrity, #25259 bz2/xz).
-
-**Integrity today:**
-- **Hosted mode already derives no pin.** Every value comes from the
-  server (`scan/hosted.rs:1282-1318`). The CLI hashes only to verify: vlt
-  preflight, wheel METADATA, and gem stale-cache warnings.
-- **Vendored mode produces pins locally** whenever `auto` falls back:
-  - The fallback triggers on Pending, Unavailable, Failed, layout or
-    afterHash mismatch, or no client (`service_fetch.rs:170-265`).
-    `IntegrityMismatch` is always a hard failure.
-  - The CLI ignores the server's `yarnBerry10c0` (`api/client.rs:1278-1280`).
-  - Repair on the base branch is build-only (`commands/vendor.rs:123-126`).
-  - A pypi dry run always previews the local build (`pypi.rs:1807-1809`).
-
-**Waste the two producers cause:**
-- `reuse.rs:1-12` says in its own header that it exists so "a prebuilt ↔
-  local source flip between two runs (a service outage, or its recovery)"
-  does not rewrite the lock.
-- The Auto/Service policy is hand-rolled in 7 backends (F32; 35-45
-  duplicated lines each). The shared `service_archive_copy` serves only
-  maven and nuget.
-- Every vendored reference is one POST per uuid at quota 20 each
-  (`client.rs:1429-1437`, F28).
-- Qualifier-less pypi purls are a guaranteed service miss, downloaded in
-  full before being rejected (F70, F71).
-- The 12 `e2e_vendor_*_build.rs` capstones (15,853 LOC, about 92 tests) and
-  the 58 `--vendor-source build` call sites (in 36 test files at 8ae7dc37;
-  the same on v5/integration) test only the local builder.
-
-**Unmeasured:** the real service-hit versus local-fallback rate. CLI
-telemetry does not record the vendor source. `patch_vendored` is also
-unclassified server-side, and its endpoint sunsets on 2026-12-31 (F22).
-
-### WS5 caveat answer: does depscan use CLI packing code?
-
-**No.** depscan has:
-- no napi or FFI link to socket-patch-core;
-- no crate dependency;
-- no subprocess packing.
-
-It imports only the `@socketsecurity/socket-patch/schema` TS types
-(depscan:workspaces/lib/src/socket-patch/manifest-schema.ts:9). The CLI
-binary runs in depscan only in tests and tools, plus `socket-patch apply`
-in the autotester image (depscan:docker/Dockerfile.autotester-worker:19-25)
-and the pipeline postinstall `pnpm dlx @socketsecurity/socket-patch@4.0.0
-apply` (depscan:workspaces/pipeline/package.json:15-16). Both are
-agent-mode apply, not vendoring.
-`berry-cache-zip.ts` is a port of `berry_zip.rs`, not a consumer of it.
-Deleting the CLI builders is therefore a CLI-only product decision.
-
-Two couplings are still real:
-1. **depscan api-v0 e2e vendor suites 89-94** run in `auto` and silently
-   fall back to the local builder on a service miss. Removing the builder
-   weakens them without failing them.
-2. **WS1 (#280) consumes CLI helpers.** It consumes `registry_fetch` and
-   `berry_zip` (origin/v5/ledger-free-hosted
-   `patch/redirect/upstream/client.rs:11,204,256-257,361-369,500-504,592`,
-   `upstream/vlt.rs:76`, `upstream/npm.rs:432`). Those helpers stay (see
-   What must stay).
-
-`prestage.rs` is not a local-rebuild file: it pre-extracts service
-archives.
-
-## Design
-
-### Principles
-
-1. **One producer per (uuid, variant).** The server's verdict decides it,
-   never availability. The verdict is terminal; the ledger's recorded
-   `producer` keeps it sticky across runs.
-2. **The CLI computes a pin only for `producer = local`.** Otherwise the pin
-   is copied from the reference and cross-checked against the verified
-   bytes. The two must agree, or the result is `IntegrityMismatch`.
-3. **Acquire before wiring.** Every artifact in the run is acquired and
-   verified into the cache before any project file is written. Per-package
-   failures leave that package's lock untouched.
-4. **Trust decisions happen in one verify step.** It never falls back to
-   another source on mismatch.
-5. **maven and nuget keep today's artifact acquisition and wiring
-   byte-for-byte:** `service_archive_copy`, the local rebuild, and
-   `--vendor-source build`. They do take part in the batch reference POST
-   (step 1), which is behavior-neutral. Under contract 2 the CLI maps a
-   `refused` answer for a maven/nuget uuid onto the existing v1
-   `build_failed`/fallback arm (or requests those uuids under contract 1),
-   so `service_archive_copy` behavior is unchanged.
-
-### When the one local build is allowed
-
-A class may build locally only when all three of these hold:
-- (a) the server's refusal is terminal for the requested artifact (for
-  pypi: the uuid plus the requested filename or tags; see the TTL note
-  below the table);
-- (b) the correct bytes depend on the user's machine;
-- (c) the CLI can build deterministically from local state.
-
-| Class | Resolution |
-|---|---|
-| npm family, berry, vlt | server only; local packing deleted |
-| gem (ruby platform), cargo, composer | server only; `copy_and_patch` arms deleted |
-| gem platform | refused on both sides (`gem.rs:209-237`); unchanged |
-| golang without go.mod | server synthesizes `module <path>` as proxy.golang.org does; lifts golang.ts:109-115 |
-| pypi, upstream wheel exists (bare or sdist purl) | server builds the wheel variant the lock pins |
-| pypi, no servable wheel (sdist-only, no tag match, bz2/xz-only) | `refused {code: pypi_no_servable_wheel, localBuild: allowed}` → `pypi_wheel.rs` from the installed dist |
-| pypi, upstream file larger than the serve cap (torch, tensorflow, jaxlib, `nvidia-*` wheels) | `refused {code: artifact_too_large, localBuild: allowed}`, emitted before download from the size in the PyPI JSON → `pypi_wheel.rs` (no cap on the installed dist) |
-| npm family, upstream tarball larger than the serve cap | `refused {code: artifact_too_large, localBuild: forbidden}`, emitted before download from the packument; an accepted regression (Open questions) |
-| output exceeds the CLI's extraction caps | `refused {code: artifact_exceeds_client_caps, localBuild: forbidden}` (see Risks) |
-| maven ext/classifier, all maven/nuget | frozen: current behavior, including `auto` fallback |
-
-The serve cap is `MAX_SERVABLE_ARCHIVE_BYTES` = 100 MiB
-(depscan:workspaces/patches/src/services/patch-package/build.ts:37-44), and
-upstream downloads are capped at 256 MiB
-(depscan:workspaces/patches-shared/src/archive/repack-utils.ts:23). Today
-the output-size check runs after the build, as a deterministic
-`build_failed`; without the pre-download refusal, large pypi releases
-would lose their only working path.
-
-`pypi_no_servable_wheel` is not immutable: PyPI accepts new wheels for an
-existing release at any time (late cp313 or musllinux wheels are common),
-and "no tag match" depends on the requester's platform. The refusal is
-keyed on (uuid, requested filename or tags) and carries a TTL. Flips are
-prevented by the ledger: once an artifact is recorded as
-`producer = local`, later runs keep it until `--repin`.
-
-The retained recipe is versioned as `local:pypi-wheel/1`. It pins today's
-bytes: lexicographic order, RECORD last, and fixed stamps, via
-`common.rs:248` Deflated.
-
-`Cargo.lock:457-465` shows flate2 1.1.9 pulling both `miniz_oxide` and
-`zlib-rs`, so a dependency bump could silently change the bytes. To guard
-against that:
-- a committed golden vector asserts the output bytes;
-- the backend is pinned explicitly;
-- any byte change bumps the recipe id.
-
-Bytes built under an old id stay reusable. Repairing one under a new CLI
-fails closed with a `--repin` remedy.
-
-### API contract (depscan)
-
-**Endpoints.**
-- Authenticated: `POST /v0/orgs/{slug}/patches/package`
-  (depscan:workspaces/api-v0/src/endpoints/orgs/patches/package.ts, quota 20
-  at :293, max 500 uuids at :330). It is backed by
-  depscan:workspaces/app/src/patches/patch-package-references.ts.
-- Anonymous: `POST /patch/package` in
-  depscan:workspaces/patches-api-proxy/src/server.ts:1003. It already
-  forwards the parsed body verbatim except for forcing `freeOnly`
-  (:1043-1066), and it caps bodies at 256 KiB
-  (`MAX_PATCH_PROXY_BODY_BYTES`, :199).
-  depscan:workspaces/purl-api-proxy/routes/patch.ts is a pass-through
-  `/patch/*` alias (including `package`) with its own 1 MB cap.
-- **Body size.** A 500-uuid request with `variants` must fit the 256 KiB
-  cap. The CLI caps `variants` per request and chunks at fewer than 500
-  uuids when variants are present.
-- No new artifact routes. Bytes stay on patch.socket.dev.
-
-**Request (v2).** Additions are marked `+`.
-
-```
-{ "uuids": ["<uuid>", …],                  // ≤ 500
-  "freeOnly": false,
-+ "contract": 2,
-+ "variants": { "<uuid>": {
-+     "pypiWheelFilename": "foo-1.2.3-cp311-cp311-manylinux_2_17_x86_64.whl",
-+     "pypiUpstreamSha256": ["<hex>", …],
-+     "pypiWheelTags": ["cp311-cp311-manylinux_2_17_x86_64"],
-+     "generation": 1 } } }                 // optional; repair only
-```
-
-`pypiWheelFilename` is the upstream file the project's lock pins (uv, pdm
-and poetry list per-file hashes). `pypiUpstreamSha256` covers locks that
-pin hashes with no filenames (Pipfile.lock, `requirements --hash`): the
-server maps each hash to the upstream file through the PyPI JSON it
-already reads, so those flavors need no installed dist and the CLI keeps
-no hash-to-URL resolver. `pypiWheelTags` is the last fallback: it comes
-from the installed `*.dist-info/WHEEL` when the lock pins neither, for
-example requirements without hashes. `generation` lets repair request the
-generation its ledger recorded.
-
-**Response (v2).** The endpoint returns `{ results: { <uuid>: … } }`
-(depscan:workspaces/api-v0/src/endpoints/orgs/patches/package.ts:147-174,
-343-372). The sketch is one value of that map; additions are marked `+`.
-
-```
-{ + "contract": 2,
-    "results": { "<uuid>": {
-      "status": "granted" | "reused" | "pending_build" | "build_failed"
-              | "refused" (+, v2 only) | "withdrawn" | "forbidden" | "not_found",
-      "url": "…" | null,                     // tarball URL; unchanged
-      "purl": "…" | null,                    // unchanged
-  +   "retryAfterSeconds": 20,               // pending_build only
-  +   "failureCode": "UNSUPPORTED_ARCHIVE_FORMAT", // build_failed only; static
-  +   "refusal": { "code": "pypi_no_servable_wheel" | "artifact_too_large"
-  +                      | "artifact_exceeds_client_caps" | "gem_platform"
-  +                      | "maven_classifier",
-  +                "localBuild": "allowed" | "forbidden" },  // refused only
-  +   "generation": 1,
-      "artifacts": [{
-        "kind": "tarball" | "gem-stub-gemspec",
-  +     "format": "npm-tgz" | "whl" | "sdist-tgz" | "sdist-zip" | "gem"
-  +             | "crate" | "go-zip" | "composer-zip" | "jar" | "nupkg",
-  +     "variant": "default" | "<upstream wheel filename>",
-  +     "filename": "…",
-        "url": "…", "contentType": "…", "sizeBytes": 123,
-  +     "recipe": "depscan-repack/npm@1",
-        "integrity": { "sha512": "sha512-…", "sha256": "…", "sha1": "…",
-                       "md5": "…", "dirhashH1": "h1:…", "goModH1": "h1:…",
-                       "yarnBerry10c0": "10c0/…" } }],  // 10c0 now on the tarball
-  +   "statement": { "payloadType": "application/vnd.in-toto+json",
-  +                  "payload": "<b64 JCS statement>",
-  +                  "signatures": [{ "keyid": "sp-2026-1", "sig": "<b64>" }] }
-  +              | null,                     // null until backfilled
-      "registryOverride": { … } } } }        // unchanged (hosted mode)
-```
-
-Schema notes: `status` and `kind` are `SEnum`s (package.ts:128-131,
-148-159), so the status enum gains `refused`, emitted under contract 2
-only. Every new field is a nullable `SStruct` member. PEP 658 metadata
-(F60: `pypiMetadata: { url, sha256 }` per wheel artifact, so hosted scan
-stops downloading whole wheels) is a later additive v2 field and is not
-in this plan.
-
-**Versioning rules:**
-- **v1 stays schema-compatible.** With `contract` absent or equal to 1,
-  the response is today's except that, after step 4, `yarn-berry-zip.url`
-  is null (the schema already allows it, depscan:…/package.ts:124-133; no
-  CLI reads it, F33), and `yarnBerry10c0` is also added to the tarball's
-  integrity (additive; old hosted CLIs pick it up through
-  `integrity.clone()`):
-  - `kind: "tarball"` stays the authored variant, so v4 and v5.0 CLIs keep
-    their `find(kind == "tarball")` (`client.rs:1279-1283`) and their
-    `auto` fallback.
-  - `refused` is reported as `build_failed`.
-  - The `yarn-berry-zip` entry `{url: null, integrity.yarnBerry10c0}` keeps
-    being emitted until v1 itself sunsets. v4/v5.0 hosted scan
-    (`scan/hosted.rs:1290-1300`), `hosted_memory/redirect.rs:110-151` and
-    depscan's GitHub-app hosted PR flow
-    (depscan:workspaces/app/src/autopatch-pr/github-patch-pr-hosted.ts:400-426)
-    read the 10c0 checksum only from that entry; without it their berry
-    rewriter fails closed ("has no yarnBerry10c0",
-    depscan:workspaces/app/src/patches/registry-rewrite/yarn-berry.ts:139-143).
-  - `r{n}` URLs are never sent to v1 callers. For a uuid with a
-    generation ≥ 2, v1 is answered with the gen-1 artifact and its hashes
-    under the legacy URL. Old Rust and TS path parsers (vex discover,
-    rollback, list; depscan:workspaces/lib/src/socket-patch/patch-url.ts)
-    do not know the segment.
-- **v2 changes:** `yarnBerry10c0` is on the tarball's integrity, and
-  `yarn-berry-zip` is not emitted. `r{n}` URLs appear only in contract-2
-  responses.
-- **Unknown fields are ignored.** The CLI response types derive
-  `Deserialize` without `deny_unknown_fields` (`api/types.rs`).
-- **Negotiation.** The CLI sends the highest contract it supports. The
-  server answers `min(requested, supported)` and echoes `contract` in the
-  response. A breaking change needs contract 3.
-- **Failure strings are static and low-cardinality**, per depscan
-  AGENTS.md; per-call detail goes to `logContext`.
-  - Deterministic statuses (`build_failed`, `refused`) never carry
-    `retryAfterSeconds`.
-  - Only `pending_build` and transient upstream failures are retryable.
-- **Generations are immutable.** `generation` bumps only on an admin
-  regenerate, and the old generation's bytes stay served. Each generation
-  is a row in a per-generation table (step 7), so older URLs, hashes and
-  statements stay resolvable.
-
-**Signed statement (in-toto v1, JCS-canonical, DSSE-wrapped).**
-
-```
-{ "_type": "https://in-toto.io/Statement/v1",
-  "subject": [{ "name": "<filename>",
-                "digest": { "sha512": "<hex>", "sha256": "<hex>" } }],
-  "predicateType": "https://socket.dev/patch-artifact/v1",
-  "predicate": {
-    "uuid": "…", "purl": "…", "ecosystem": "npm", "variant": "default",
-    "generation": 1, "recipe": "depscan-repack/npm@1",
-    "upstream": { "filename": "…", "url": "…", "sha512": "sha512-…" },
-    "patchRecordDigest": "sha256:<hex of JCS(record projection)>",
-    "pins": { "sri": "sha512-…", "sha1": "…", "sha256": "…",
-              "yarnBerry10c0": "10c0/…", "dirhashH1": "h1:…",
-              "goModH1": "h1:…", "cargoCksum": "…",
-              "gemChecksumSha256": "…" } } }
-```
-
-- **DSSE binding.** `payloadType` is `application/vnd.in-toto+json`, as the
-  in-toto Statement v1 binding requires, so standard in-toto, sigstore
-  and cosign tooling can verify it. The socket-specific version lives in
-  `predicateType` (`https://socket.dev/patch-artifact/v1`).
-- **`patchRecordDigest`.** The CLI's `.socket/manifest.json` record and
-  the server's DB row carry different field sets, so the digest is over
-  an explicit minimal projection:
-  `{uuid, purl, files: [{path, beforeHash, afterHash}] sorted by path}`.
-  The predicate schema specifies it, and a shared golden vector is used by
-  both the Rust verifier and the TS signer.
-- **`upstream.sha512`** is the registry digest where one exists. Where
-  none does (GitHub-backed composer dists, legacy npm packages), it is the
-  server's own hash of the downloaded bytes, and beforeSha is the only
-  upstream anchor.
-
-**Signing:**
-- The signer runs at build time with a GCP KMS asymmetric key (Ed25519 or
-  P-256, non-exportable). It is *detached*: it never touches archive
-  bytes.
-- The in-format seam `depscan:workspaces/patches/src/repack/sign.ts`
-  (`defaultSign` always returns null) is deleted, as F38 recommends.
-  Statements are a separate build step after the write-once store.
-- **Backfill.** Existing built rows get statements from their persisted
-  digests and columns, with no rebuild. An unsigned legacy row is never
-  made unvendorable.
-- **Revocation.** `GET https://patch.socket.dev/.well-known/socket-patch-keys.json`
-  serves the key list plus a revocation list. The list is signed by an
-  offline root key whose public half is embedded in the CLI.
-- **The CLI never trusts a key fetched at runtime.** Signing keys are
-  embedded (current plus next); the fetched document only *revokes*
-  embedded keys.
-
-### CLI flow (vendor, scan --mode vendored, get vendored, repair, WS2 eject)
-
-The flow is one shared `acquire_service_artifact` inside #283's
-`VendoredBackend`, replacing the 7 hand-rolled policies (F32). maven and
-nuget stay on `service_archive_copy`.
-
-1. **Plan.**
-   - Collect records from one of three places:
-     - `.socket/manifest.json`;
-     - hosted pins (WS2 eject);
-     - a bundle.
-   - Compute selection keys: for pypi, the lock's wheel filename, else
-     the lock's pinned sha256 hashes (Pipfile.lock, `requirements
-     --hash`), else the installed `WHEEL` tags. No other ecosystem needs a
-     key or an installed copy.
-2. **Reuse, with no network.** Use `reuse::verify_committed_artifact`
-   (`reuse.rs:212-318`) or `reusable_committed_dir` against the ledger.
-   An in-sync artifact is finished here. This is a hard contract:
-   `vendor_rerun_no_network_e2e.rs` stays.
-3. **Resolve.** Send one batch POST per 500 uuids (fewer when `variants`
-   would push the body past the proxy's 256 KiB cap) with `contract: 2`
-   plus `variants` (F28). `hosted.rs:1244` gets the same 500-chunking, because
-   it gets a 400 above 500 today.
-4. **Decide.** The action depends on the reference answer and on the
-   producer recorded in the ledger:
-
-| Reference answer | Ledger producer | Action |
-|---|---|---|
-| granted / reused | any or none | acquire → verify → wire; same sha as the ledger means no lock change |
-| granted, same uuid, new `generation` | service | `vendor_artifact_regenerated`: keep the committed bytes; `--repin` adopts the new ones |
-| pending_build | – | poll with `retryAfterSeconds` plus jitter up to `--vendor-wait` (default 120 s interactive, 0 in CI), then `vendor_artifact_pending` (retryable) |
-| refused, localBuild=allowed | – or local | local `pypi_wheel` from the installed dist; if not installed: "install, then re-run" |
-| refused, localBuild=forbidden | – | `vendor_unsupported_variant` (hard) |
-| build_failed | – | `vendor_prebuilt_unavailable` (hard, no local build) |
-| granted, but the bytes fail layout or afterHash membership (server defect, #23144) | any | `vendor_prebuilt_defective` (hard, no local build); server-side metric |
-| granted gem, stub gemspec missing or invalid (#221; pre-stub-rollout rows) | any | `vendor_prebuilt_stub_missing` / `vendor_prebuilt_stub_invalid` (hard); a server backfill (regenerate) of pre-stub rows is a prerequisite for the gem flip. Native-extension gems get no stub by design (gem.rs:922-926), so the server should answer them with a `refused` code instead |
-| granted npm, berry lock, `yarnBerry10c0` null (the error-isolated berry rebuild failed, depscan build.ts:364-382) | any | `vendor_berry_checksum_unavailable` (hard) |
-| network error, 5xx, timeout | local | local pypi rebuild (ledger stickiness: `producer = local` is kept); a result whose sha256 differs from the ledger fails closed with a `--repin` remedy |
-| network error, 5xx, timeout | service, legacy-local, or none | `vendor_service_unavailable` (retryable); the lock is untouched |
-| withdrawn / not_found | any | refuse to wire; report existing wiring for `vendor --revert` |
-| any digest or signature mismatch | any | `IntegrityMismatch`, hard; never retried from another source |
-
-5. **Acquire** from the first source that has the bytes:
-   - (a) `--bundle <dir|tar>` (repeatable) or `SOCKET_PATCH_BUNDLE`;
-   - (b) the user cache `$XDG_CACHE_HOME/socket-patch/artifacts/sha512/<h2>/<hex>`,
-     with the reference and statement indexed under
-     `index/<uuid>/<generation>/<variant>.json`;
-   - (c) the service GET through the `vendor_prefetch` download window
-     (F28), capped by `MAX_VENDOR_PACKAGE_BYTES`.
-
-   `--offline` stops after (b).
-6. **Verify**, in this order:
-   - (i) the statement signature, if present; it is required for bundle
-     sources and, after backfill, everywhere (see Rollout);
-   - (ii) size, sha512 and sha256 against the reference *and* the
-     statement subject (`fetch_verified_archive`,
-     `service_fetch.rs:89-142`);
-   - (iii) canonical decode and afterHash membership (#249):
-     `tgz_bytes_match_after_hashes` (`npm_common.rs:658`), or
-     `zip_bytes_match_after_hashes` / `copy_matches_after_hashes`
-     (`common.rs`);
-   - (iv) go h1 via `verify_go_h1` (`registry_fetch.rs:1507`);
-   - (v) `patchRecordDigest` equals the digest of the projection of the
-     record being wired;
-   - (vi) berry only: `berry_cache_checksum_10c0` recomputed over the
-     verified tgz must equal the server value. This turns the Rust/TS
-     twin (F35) into a runtime tripwire.
-7. **Gate.**
-   - By default, packages that failed are listed with their class, and
-     packages that verified are wired.
-   - `--require-all` refuses to wire anything if any required artifact is
-     missing. It is the plan-then-commit mode for CI that wants
-     all-or-nothing.
-   - Exit codes separate retryable (pending or unavailable) from hard
-     failures.
-8. **Wire.**
-   - Directory flavors are extracted through the existing validators and
-     caps (`prestage.rs` pool, `registry_fetch.rs` `extract_*`/`validate_*`).
-   - Lock writers are unchanged; WS3 owns them.
-   - Pins come from the reference or statement. Local compute is allowed
-     only for `producer = local`.
-9. **Ledger.**
-   - The `state.json` entry gains
-     `{producer, recipe, generation, statementDigest}`.
-   - Missing fields on old entries read as `legacy-local` or
-     `legacy-service`, inferred from the existing source code.
-   - The statement is written as `<artifact>.statement.json` next to the
-     vendored artifact, so `vex` can attest offline.
-
-**Dry run.** A dry run calls the reference API only, with no GET, and
-prints the real pins. It previews a local build only for
-`refused/localBuild=allowed`. This fixes `pypi.rs:1807-1809` and
-`npm_common.rs` "a dry run previews the local build".
-
-**Repair (#283).** Repair re-acquires through (a)→(b)→(c) from the ledger's
-producer:
-- A missing `legacy-local` artifact is re-pinned to service bytes. Only
-  the integrity and URL slots are spliced (the #269 vlt precedent), and
-  repair emits `vendor_repinned_to_service`. #283's fail-closed ledger
-  check (`vendored_backend/repair.rs:1-24` on origin/v5/vendor-backend)
-  gains this arm instead of refusing.
-- Nothing else re-pins silently. `vendor --repin` does it on purpose.
-
-**Flags:**
-- `--vendor-source` stays parseable in v5, because depscan
-  `99_socket-patch-cargo-modes.js:205,552` passes it.
-  - `auto` (the default) follows the table above.
-  - `service` is strict: no local bytes ever, so it also refuses
-    `localBuild=allowed` and the local-producer outage row.
-  - `build` stays valid only for maven and nuget. Anywhere else it exits 2
-    with `vendor_source_build_removed` after deletion.
-- New flags: `--bundle`, `--export-bundle`, `--prefetch` (fill the cache,
-  no wiring), `--vendor-wait`, `--require-all`, `--repin`.
-- WS8 hides the rarely used ones from `-h`.
-
-### Per-format integrity after the change
-
-| Flavor | Bytes on disk | CLI verifies before write | Lock pin | Pin source |
-|---|---|---|---|---|
-| npm, pnpm 1–10, bun.lock/bun.lockb | served tgz verbatim | sha512 + sha256 vs reference and statement; tgz afterHash | sha512 SRI | reference; `PackedTarball::from_bytes` (`npm_pack.rs:47-60`) must agree; `bun_lock.rs:403` rehash stays verify-only |
-| yarn classic | same | same | sha1 `#hash` plus integrity | reference sha1, cross-checked |
-| yarn berry | same | same plus the 10c0 tripwire | `10c0/…` plus `hash=` | reference `yarnBerry10c0`; hash6 sliced from the verified sha512 |
-| vlt (vendored) | tgz extracted to dir (`npm_dir` `try_service_dir`, 890-970) | tgz digests plus tree afterHash | none | — |
-| pypi (service) | served wheel verbatim | sha256 + sha512; zip afterHash | wheel sha256 | reference |
-| pypi (local class) | `local:pypi-wheel/1` build | afterHash of staged tree | wheel sha256 | local; ledger `producer = local` |
-| gem | `.gem` → data.tar.gz dir plus served stub gemspec | digests; gem data validators; stub validity | none | — |
-| cargo | `.crate` extracted; `.cargo-checksum.json` dropped; `cargo_tag` | digests | none | — |
-| golang | module zip extracted; dir `replace` | digests plus `verify_go_h1` against dirhashH1 | none (no go.sum) | — |
-| composer | dist zip extracted; path dist | digests (no upstream digest exists; beforeSha anchors server-side) | none | — |
-| maven, nuget | unchanged | unchanged | unchanged | unchanged |
-
-## Offline / airgap
-
-- **A committed `.socket/vendor/` is the offline store.** Installs never
-  need Socket, and re-runs and repair of in-sync artifacts make no network
-  calls. Both are unchanged.
-- **Cache.** The user cache is immutable and sha512-keyed, so CI can share
-  it across projects (actions/cache or an equivalent).
-- **First vendoring or repair on an air-gapped machine uses a bundle:**
-  - On a connected machine, `socket-patch vendor --export-bundle <dir>`
-    reads only the manifest and lockfiles and writes nothing into the
-    project. All pypi variants are included by default, so the bundle does
-    not depend on the target platform.
-  - On the air-gapped machine: `vendor --offline --bundle <dir>`.
-  - The layout doubles as a mirror an operator can host (internal HTTP,
-    Artifactory generic):
-
-    ```
-    <dir>/bundle.json                  {schema:1, createdAt, apiBase, org, cliVersion, keysetVersion}
-    <dir>/index/<uuid>.json            {record, reference (contract-2 entry), statement}
-    <dir>/cas/sha512/<h[0:2]>/<hex>    artifact bytes
-    <dir>/keys.json                    signed revocation list at export time
-    ```
-  - Records are carried too, so WS2 eject works offline.
-  - Bundles carry no maven/nuget artifacts. Those frozen ecosystems keep
-    today's `--offline --vendor-source build` path.
-  - Bundle entries **must** carry a valid statement. The statement binds
-    the record digest and the artifact digests, so the carrier is
-    untrusted.
-- **What is lost.** A new, non-pypi patch cannot be vendored with no
-  network, no cache and no bundle. Today that case builds locally
-  (`--offline --vendor-source build`). The pypi local class and
-  local-producer artifacts still work offline. This is an explicit owner
-  decision (Open questions).
-
-## Outage behavior & idempotence
-
-| Situation | Result |
-|---|---|
-| Service down; committed artifacts in sync | success, no network (reuse); unchanged |
-| Service down; artifact in cache or bundle | success, fully verified |
-| Service down; nothing local; producer service, legacy or none | per-package `vendor_service_unavailable` (retryable); lock untouched; remedy: retry, or `--export-bundle` elsewhere plus `--bundle` |
-| Service down; producer local (pypi class) | local rebuild, same recipe id. Byte identity holds only on the same machine with the same installed dist: an sdist-only C extension compiles differently per machine. A rebuild whose sha256 differs from the ledger fails closed with a `--repin` remedy |
-| `pending_build` | `--vendor-wait` polling, then retryable exit |
-| Recovery storm | `retryAfterSeconds` plus client jitter plus the per-uuid breaker kept on the download step (F28) |
-| Admin regenerate | new generation row, new object key; old generations stay resolvable through the per-generation table; CLI keeps committed bytes (`vendor_artifact_regenerated`), and repair of a missing artifact requests the ledger's generation |
-| CDN re-encodes a body | hard `IntegrityMismatch`; `no-transform` stays on every artifact byte response (depscan:…/patch-serving/archive-response-headers.ts:11) |
-
-**Relation to #250 and `reuse.rs`:**
-- #250 (e0246295) added reuse because the auto fallback flipped between two
-  producers across an outage and its recovery.
-- With R1 (the verdict decides the producer) and R3 (an outage is not a
-  refusal), no run can pick a different producer than the ledger
-  recorded. Service bytes are write-once per (uuid, generation), so a
-  re-acquire returns identical bytes.
-- `reuse.rs` stays for network-free re-runs, and its header is rewritten.
-  `select_prior_entry` loses its flip-hiding reason and can shrink after
-  deletion; that saving is unmeasured and not counted.
-- A new invariant test runs every fixture capstone twice, the second time
-  with reuse disabled, and asserts byte-identical locks and artifacts.
-
-**Server side:**
-- **Write-once stays** (`STORED_OBJECT_CONFLICT`,
-  depscan:workspaces/patches/src/services/patch-package/build.ts:425-470).
-- **Regenerate never deletes in place.** All three regenerate/reset paths
-  fold into `resetOne()` (F39) and mint generation N+1 under a new object
-  key. `deleteGcsObject` is retired for referenced keys.
-- **Hosted URLs become immutable too.** Hosted installer URLs gain an
-  optional `r{n}` segment, emitted only for generation ≥ 2 and only in
-  contract-2 responses. A URL without it means generation 1 forever, and
-  v1 callers keep getting the gen-1 artifact under that URL. The Rust path
-  parser learns it in the same step, with a shared redirect golden that
-  includes an `r{n}` case in the TS_LAGGING/RUST_IMPLEMENTED lists.
-- **Per-generation storage.** `published_patches` is one row per patch
-  with a single `package_object_key`, `package_integrity` and
-  `package_size_bytes`, and the serve route resolves URL to object key
-  through that row
-  (depscan:workspaces/patches/src/services/patch-serving/serve-route.ts:125-140).
-  A scalar generation column cannot keep old generations served. A table
-  `published_patch_generations(uuid, variant, generation, object_key,
-  digests, size, statement)` holds one row per generation; serve-decision
-  resolves (uuid, generation parsed from `r{n}`, defaulting to 1) through
-  it.
-
-## Integrity, provenance & signing
-
-Chain of trust:
-1. **Upstream digest verified server-side**
-   (depscan:workspaces/patches/src/repack/upstream/*: packument
-   integrity, PyPI sha256, crates cksum, sumdb h1, maven sha1) and
-   persisted as `upstreamIntegrity`. Coverage is not universal:
-   - composer: sha1 when Packagist supplies `dist.shasum`, else beforeSha
-     only (GitHub-backed dists; upstream/composer.ts:65-71);
-   - npm: packument integrity or shasum, else beforeSha only (legacy
-     packages; upstream/npm.ts:125-130).
-2. **Each patched file** is anchored by beforeSha in
-   `substitutePatchedFiles`.
-3. **The repack is built once**, written write-once and read back. The
-   publish-time dry run builds the same bytes only on the same host and
-   zlib build. F61: have the converter adopt that build instead of
-   rebuilding (optional).
-4. **The detached statement** binds uuid → purl → upstream digest → record
-   digest → artifact digests → pins, signed through KMS.
-5. **The CLI verifies** the signature, then the digests, then the
-   afterHash, then the berry tripwire (verify step 6). Only
-   `producer = local` pins are computed locally.
-
-Ride-along fixes:
-- **Wheel signatures.** Strip `RECORD.jws` and `RECORD.p7s` in
-  `regenerateWheelRecord`
-  (depscan:workspaces/patches-shared/src/archive/repack-utils.ts:~1330,
-  F38). With a single producer, the served wheel must match what
-  `pypi_wheel.rs:570-585` already does. This is a behavior change and
-  bumps the converter version. It applies to new builds only; existing
-  bytes are immutable.
-- **Dead signature columns.** `package_signature` and
-  `package_signature_kind` are always null and read only by the admin
-  package-job API
-  (depscan:workspaces/next-app/src/pages/api/admin/patches/package-job.ts:88-89,114).
-  They are also written by patch-sync (patch-sync/import.ts:174-175) and
-  queue.ts (:410-411, :733-734). Step 13b stops the writes and drops them
-  with a safe migration; statements live in the per-generation table.
-- **Maven.** The `META-INF/*.SF` gap is recorded only (maven is frozen).
-
-**Provenance on disk.** The ledger holds
-`producer/recipe/generation/statementDigest`, and
-`<artifact>.statement.json` sits next to each vendored artifact.
-
-**Audit.** A depscan CI golden re-runs the repackers offline over the
-shared fixture corpus, split by format. The gzip bytes are
-zlib-build-sensitive and differ between a dev machine and the CI runner
-(depscan:workspaces/patches-shared/src/archive/repack-utils.ts:632-640),
-so:
-- gzip-bearing artifacts (npm tgz, pypi sdist tar.gz, the `.gem`'s
-  data.tar.gz, cargo `.crate`): the golden pins the sha256 of the
-  decompressed tar stream plus per-member afterHashes, and treats the
-  committed bundle bytes as opaque signed inputs, not re-derived outputs;
-- STORE-zip formats (wheel, go module zip, composer zip, jar, nupkg) and
-  `yarnBerry10c0`: the golden asserts byte-exact digest reproduction.
-
-## Cache/CDN/storage cost
-
-**Build:**
-- The default artifact costs nothing new; the converter already builds
-  every published row after publish.
-- Added: pypi wheel variants, built lazily, keyed by
-  `(uuid, upstream filename)` that a client actually requested. Cost is
-  bounded by real demand, not by wheel-matrix width.
-- Added: go no-go.mod builds, which are rare.
-- Removed: the `.berry.zip` store and read-back per npm patch. The zip
-  rebuild stays, because it is the 10c0 source: the `berryChecksum10c0`
-  and `berryZip` locals (build.ts:349-350), the `rebuildBerryCacheZip`
-  call and the sha512 at :373-387 are kept.
-
-**Storage:**
-- One fewer GCS object per npm patch (F33). Berry zips use STORE, so each
-  is likely larger than its tgz (inference, unmeasured).
-- Added: the variant wheels.
-- A regenerate adds a generation instead of replacing one. Old
-  generations are kept, because committed pins may reference them and the
-  server cannot know.
-
-**Origin I/O.** Send crc32c/md5 on the PUT and read back only on a 412
-(F34; md5 is already computed at build.ts:315/532). This removes 1–4 full
-GETs per build.
-
-**Egress:**
-- Vendoring downloads once per (project, patch), then reuses git, the
-  cache or a bundle.
-- The CLI's eager pristine fetches from public registries disappear (F80).
-- The wasted sdist downloads disappear, up to the 256 MiB cap each
-  (F70, F71).
-- Quota drops from N×20 to ceil(N/500)×20 per run (F28).
-
-**CDN:**
-- Keep `public, max-age=3600, no-transform` on artifact bytes.
-- The per-org token in the path fragments edge keys, and revocation must
-  bite, so no `immutable`.
-- Revisit `immutable` for generation-keyed URLs only after infra confirms
-  patch.socket.dev's edge-cache and auth behavior. Metadata and
-  go-import responses keep their current headers (F37 verification: that is
-  intentional).
-
-**Sizing.** Before step 11 (pypi variant queue), a read-only query
-through the Grafana skill: count built pypi rows by selected artifact
-kind, plus wheels per release from the PyPI JSON. This query is an
-explicit gate on step 11.
-
-**Unmeasured:** variant-wheel storage, the berry.zip bytes removed, and
-the egress delta. The step 5 dashboards and the pre-step-11 sizing query
-produce them, and the owner reviews them before enabling
-`patchPypiVariants`.
-
-## What gets deleted
-
-Deletion happens after the gate, at Phase 4. The numbers are measured by
-line span at 8ae7dc37. Rows marked ~ are re-measured after #283 and #280
-land, because WS5 rewrites vendor.rs by ±318 lines.
-
-| Item | Files | src LOC | test LOC |
-|---|---|---:|---:|
-| npm_pack `pack_deterministic`, `pack_to_bytes`, `collect_regular_files`, `NPM_PACK_MTIME` (keep `from_bytes`) | `vendor/npm_pack.rs:73-177` | 105 | ~210 of 247 |
-| npm_common local stage-and-pack branch | `vendor/npm_common.rs:248-396` | ~149 | in-file tests edited |
-| vlt local stage branch in `stage_patch_dir` | `vendor/npm_dir.rs:~594-730` | ~137 | edited |
-| registry_fetch pristine ladder: `FetchedPackage`, `fetch_and_stage`, `fetch_{npm,npm_inner,cargo,golang,composer,gem,pypi}`, `resolve_pypi_url_by_hash`, `crates_registry_base`, `stage_local_artifact(_dir)`, `fetch_npm_unverified` (**not** the WS1 keep-list) | `vendor/registry_fetch.rs` | ~700 | ~650 |
-| `PackageSource` Pending/Deferred (keep the `path()` naming query) | `vendor/source.rs` | ~200 of 222 | 135 |
-| cargo `copy_and_patch` | `vendor/cargo.rs` | 86 | edited |
-| composer `copy_and_patch` | `vendor/composer_lock.rs` | 60 | edited |
-| gem `materialise_patched_copy` | `vendor/gem.rs:1192-1339` | 148 | edited |
-| golang vendored FallBack arm (`golang_local.rs` stays) | `vendor/golang.rs:~291-354` | ~64 | edited |
-| Auto/Service policy arms in 7 backends, collapsed into one mapping (F32; 35-45 lines each) | 7 backends | ~220 net | edited |
-| vendor.rs pristine ladder: `fetch_pristine_package`, `missing_local_rung`, `MissingRung::Fetch` | `commands/vendor.rs` | ~147 | — |
-| `VendorSource::Build` outside maven/nuget, args plumbing | `vendor/mod.rs`, `args.rs` | ~30 | — |
-| `berry_zip_url` plumbing (F33; re-measure on #280, which adds another `berry_zip_url: None` site at upstream/bun_lockb.rs:154) | redirect/hosted | ~3 | 41 |
-| Pristine fetch-order e2e | `tests/vendor/vendor_pristine_fetch_order_e2e.rs` | — | 228 |
-| **Total (CLI)** | | **~2,050** | **~1,260** |
-
-Rewritten, not deleted or counted:
-- the 12 capstones (15,853 LOC), which move onto fixture bundles;
-- the 58 `--vendor-source build` call sites (8ae7dc37), which become
-  `auto` against bundles (maven and nuget keep `build`);
-- the fallback assertions in the in-process and covgap tests;
-- `yarn_layering_tests.rs:114`;
-- the pypi `in_sync_local_rebuild` tests.
-
-CLI additions (estimated):
-- src, about 900: the acquire mapping, the cache, bundle import and
-  export, statement verification with the embedded keyset, ledger fields,
-  and the decision table.
-- tests, about 900.
-- Net src change: about −1,150.
-
-**CI.** No job is deleted, and about 0 job-minutes are saved per run.
-- These keep running because they test wiring across every PM version,
-  which the owner keeps:
-  - the 58 vendored e2e legs (about 177 job-min; the 5 maven legs stay on
-    `build`, and the other 53 switch to fixture bundles);
-  - cargo-vex-matrix (18 legs);
-  - docker vendor jobs.
-- The non-maven legs switch from local builds to fixture bundles at
-  similar cost.
-- One test binary goes (`vendor_pristine_fetch_order_e2e`).
-- depscan adds a fixture-freshness golden of about 1–2 min.
-- The CI levers are F51 (≈280 job-min), F41, F52, F53 and F55 (see
-  v5-waste-review.md Top-10); F78, which contains F63, is a transient
-  saving during the v5 draft train. None is credited here.
-
-depscan changes:
-
-| Change | LOC | Source |
-|---|---:|---|
-| Deleted: `.berry.zip` store/read-back/serve/reset branches (build.ts:351-353 object key/size/integrity locals, :473-482 `storeSidecarObject`; serve-decision.ts:45-50, :145-157; serve-route.ts:136-137). The `rebuildBerryCacheZip` call and the sha512 at build.ts:373-387 stay | ~150 | F33 |
-| Deleted: dead `sign.ts` seam plus threads (convert-patch.ts:220, run-repack-cli.ts:371) | ~60 | F38 |
-| Deleted (co-landing in step 9): serve-route stream-pump duplication; admin reset paths onto `resetOne` | ~100 + ~45 | F37, F39 |
-| Added (estimate): contract v2 ~150; verdict columns, per-generation table plus batched backfill and patch-sync ~220; generation-in-key, serve-decision through the generation table, and `r{n}` ~170; pypi variant queue ~450; go no-go.mod ~80; statements plus keys route plus backfill ~350; fixture exporter plus golden ~200; metrics ~60 | ~1,680 | — |
-
-### What must stay
-
-- **Verifiers:**
-  - `artifact_matches_integrity`, `verify_integrity` and `verify_sri`
-    (`registry_fetch.rs:1931-2058`);
-  - `go_h1_of_zip` and `verify_go_h1` (1342-1524).
-    `verify_sri` and `go_h1_of_zip` are private at 8ae7dc37; WS1 makes
-    them `pub(crate)` and calls them (origin/v5/ledger-free-hosted
-    `upstream/client.rs:257,367`);
-  - `PackedTarball::from_bytes`;
-  - `zip_bytes_match_after_hashes` and `copy_matches_after_hashes`
-    (`common.rs`);
-  - `tgz_bytes_match_after_hashes`.
-- **`berry_zip.rs` (333 / 320), permanently.** It is a verifier
-  (`registry_fetch.rs:1943`, `artifact_matches_integrity`; the :1719 call
-  sits inside the pristine npm fetch that step 27 deletes) and the runtime
-  10c0 tripwire, and WS1 calls `berry_cache_checksum_10c0`
-  (`upstream/npm.rs:432`).
-- **The WS1 keep-list in `registry_fetch.rs`:**
-  - `download`, `MAX_DOWNLOAD_BYTES`, `DEFAULT_NPM_REGISTRY` (WS1
-    `upstream/npm.rs:239`);
-  - `build_registry_client`, `RegistryClient`, `npm_registry_base`,
-    `npm_tarball_url`, `pypi_json_api_base`;
-  - `goproxy_base`, `go_match_prefix_patterns` and `go_glob_match`.
-
-  WS1 imports all of them on origin/v5/ledger-free-hosted. Ownership
-  moves with F16's shared registry module if that lands.
-- **Acquisition and verification plumbing:** all `extract_*`/`validate_*`
-  functions and the caps; `service_fetch.rs`; `prestage.rs`;
-  `reuse.rs` (`verify_committed_artifact`); `vendor_prefetch.rs` as a
-  download-only window.
-- **`pypi_wheel.rs` (696 / 1,288).** It is the one local class.
-- **`golang_local.rs`.** It is agent-mode redirect (`apply.rs:14`), not
-  vendoring.
-- **Everything maven/nuget:** `local_rebuild_jar`, the nuget
-  `local_rebuild`, `common.rs` `rebuild_zip` and the memory repack (about
-  150 src), `service_archive_copy`, and their legs.
-- **depscan:** `berry-cache-zip.ts` and its test (the 10c0 source), and
-  the zip rebuild in build.ts.
-
-## Migration plan
-
-Prerequisites:
-- **Phase 3 step 24 and Phase 4 need the owner's reversal.** After #283
-  (WS5) merges, the owner reverses the WS5 caveat for non-maven/nuget
-  ecosystems, with the Phase 0 data in hand. Step 24 removes the local
-  rebuild from the default path, so it cannot land while WS5 keeps it.
-- **depscan gitlink bumps** follow F79's three steps:
-  1. release tip;
-  2. v5/integration (#279+#281+#283), with 89-94 required not to skip;
-  3. past #280, together with the GitHub-app ledger change.
-
-  This plan's bumps come after step 3, and each one is pre-flighted with
-  the `socket_patch_ref` workflow input.
-
-Flags:
-- depscan (feature_flags table): `patchPackageContractV2`,
-  `patchPypiVariants`, `patchArtifactStatements`,
-  `patchGenerationKeys`.
-- CLI: `SOCKET_VENDOR_POLICY=legacy|server-primary` and
-  `SOCKET_PATCH_REQUIRE_STATEMENT`.
-
-Server steps always deploy before the CLI step that needs them.
-
-| # | Repo | Scope (one PR) | Gate | Rollback | Coordinates with |
-|---|---|---|---|---|---|
-| **Phase 0: independent wins and measurement (no policy change)** | | | | | |
-| 1 | CLI | Batch reference resolution, chunked at 500 (F28); chunk `hosted.rs:1244`. maven/nuget uuids take part in the batch POST (behavior-neutral; their acquisition and wiring are unchanged) | in_process_vendor, vendor_prefetch, hosted e2e green | revert | WS4 #282 (hosted engine moves; land on whichever is first, port the other) |
-| 2 | CLI | Single `acquire_service_artifact` in `VendoredBackend` (F32); warning codes kept as parameters | all vendored e2e legs byte-identical output | revert | after #283 merges |
-| 3 | CLI | Drop `berry_zip_url` (F33); decide `.whl` before download (F70/F71) | unit plus pypi e2e | revert | WS3 #281 touches the same files |
-| 4 | depscan | Stop storing/serving `.berry.zip` after a log check for GETs (F33), keeping the v1 `yarn-berry-zip` entry with `url: null` and adding `yarnBerry10c0` to the tarball integrity; update the v1 response snapshot; RECORD.jws/.p7s strip (F38); upload checksums (F34) | patch-package tests, installer e2e; Grafana check of `.berry.zip` requests | revert; zip columns kept until a later drop | — |
-| 5 | depscan | `patch_package_reference_status_total{ecosystem,status}`, `package_status` gauges, gate counters for the future hard codes (defective afterHash/layout, missing or invalid gem stub, null berry 10c0, over-cap outputs), `/patches/package` SLO alert in workspaces/grafana-dashboards; classify `patch_vendored` (F22) | dashboards render | revert | F22 sunset 2026-12-31 |
-| 6 | CLI | `patch_vendored` carries `source=reuse|cache|bundle|service|local` plus a static reason | telemetry e2e | revert | WS8 (no user-visible change) |
-| **Phase 1: server contract v2 (additive)** | | | | | |
-| 7 | depscan | Nullable column `package_refusal_code` (plain ADD COLUMN); table `published_patch_generations(uuid, variant, generation, object_key, digests, size, statement)` with CONCURRENTLY indexes; batched background backfill (one generation-1 row per built patch, refusal codes from build state); patch-sync import/export of the new column and table; regenerate DB types | migration on a staging copy; no long locks | columns unused, harmless | — |
-| 8 | depscan | Contract v2 in patch-package-references.ts and package.ts; `refused` (SEnum, v2 only), `format`, `variant`, `generation`, `recipe`, `retryAfterSeconds`; `variants.pypiUpstreamSha256` and per-uuid `generation`; static refusals `artifact_too_large` (before download, from the upstream size) and `artifact_exceeds_client_caps` against a caps fixture shared with the CLI; github-patch-pr-hosted.ts reads 10c0 from the tarball integrity | v1 response snapshot unchanged relative to post-step-4 master; flag `patchPackageContractV2` | flag off | — |
-| 9 | depscan | Generation-in-key; serve-decision resolves (uuid, generation from `r{n}`, default 1) through `published_patch_generations`; admin routes onto `resetOne` (F39); serve-route onto `serveStoredArtifact` (F37); `r{n}` URL segment, emitted in contract-2 responses only (v1 keeps gen 1 under the legacy URL), plus the lib patch-url.ts grammar | serve integration tests; regenerate-immutability test (gen-1 URL and hashes still served after gen 2); flag `patchGenerationKeys` | flag off (gen 1 only) | CLI step 10 must parse `r{n}` before any gen ≥ 2 is minted |
-| 10 | CLI | Path parser accepts `r{n}`; shared redirect golden with an `r{n}` case in TS_LAGGING/RUST_IMPLEMENTED | redirect goldens (shared with depscan golden.test.ts) | revert | WS3 #281 goldens |
-| 11 | depscan | pypi variant queue `published_patch_variants` (index CONCURRENTLY; claim with `UPDATE … RETURNING` plus `FOR UPDATE SKIP LOCKED`); per-variant static failure codes; `refused pypi_no_servable_wheel` keyed on (uuid, requested filename/tags) with a TTL; `refused artifact_too_large` (localBuild allowed) | pre-step-11 sizing query reviewed; real-Postgres integration harness; installer e2e for uv/pip/poetry | flag `patchPypiVariants` off | — |
-| 12 | depscan | go no-go.mod synthesis matching proxy.golang.org bytes; bz2/xz sdists rejected before download (F69) | golang repack tests; hosted go e2e | revert | — |
-| 13 | depscan | Statement signer (KMS) post-store, `payloadType` `application/vnd.in-toto+json`, `patchRecordDigest` over the minimal record projection with a golden vector shared with the Rust verifier; backfill statements for built rows from persisted digests; `.well-known/socket-patch-keys.json`; delete the `sign.ts` seam | real file-backed test key (a KMS double needs explicit approval); flag `patchArtifactStatements` | flag off (`statement: null`) | — |
-| 13b | depscan | Stop writing `package_signature*` (queue.ts:410-411, :733-734; patch-sync/import.ts:174-175) and drop them from the admin package-job API (next-app package-job.ts:88-89,114); after one deploy, drop both columns (the drop needs no long lock); regenerate DB types | migration on a staging copy | revert before the drop | — |
-| 14 | depscan | Fixture exporter: `run-repack-cli --patched-dir` over one patch per flavor → bundle layout signed with a test key, committed to socket-patch `crates/socket-patch-core/tests/fixtures/served/`; depscan golden split by format (gzip-bearing: gunzipped-tar sha256 plus per-member afterHashes, committed bytes opaque; STORE zips and 10c0: byte-exact digests); berry 10c0 vectors including sorted-vs-upstream order, CRLF, exec bits, tombstones and the Rust fail-closed cases (F35) | golden green in both repos | revert | submodule bump |
-| **Phase 2: CLI consumes v2 (additive, v5.x minor)** | | | | | |
-| 15 | CLI | Contract v2 client; format-before-download; `variants.pypiWheelFilename`/`pypiUpstreamSha256`/tags, chunked under the 256 KiB proxy cap; for maven/nuget uuids, v2 `refused` maps onto the existing v1 `build_failed`/fallback arm (or those uuids are requested under contract 1), so `service_archive_copy` behavior is unchanged | fixture-bundle tests; api-v0 e2e | revert | WS3 python family |
-| 16 | CLI | Ledger fields `producer/recipe/generation/statementDigest`; legacy inference | ledger round-trip tests; old state.json reads | fields ignored by old code | WS6 `Ledgers` view |
-| 17 | CLI | User CAS cache, `--prefetch`, `--offline` source order | offline e2e | revert | — |
-| 18 | CLI | Statement verification, embedded keyset plus signed revocation list; `<artifact>.statement.json`; vex reads it | tamper tests (bad sig, revoked key, digest swap) | revert | vex (WS1 discover) |
-| 19 | CLI | `--export-bundle` / `--bundle` (records included; WS2 eject offline) | export → import round trip, air-gap e2e | revert | WS2 |
-| 20a/b/c | CLI | Re-point capstones to fixture bundles: npm family (npm, pnpm, yarn classic/berry, bun, vlt); pypi; gem/cargo/composer/golang | every PM-version leg green; no change to maven/nuget legs | revert per family | compatibility workflows unchanged |
-| 21 | CLI | Berry tripwire; pin `local:pypi-wheel/1` deflate backend plus a golden byte vector | berry e2e matrix (7 legs); pypi goldens | revert | — |
-| **Phase 3: policy flip** | | | | | |
-| 22 | CLI | §Decide table behind `SOCKET_VENDOR_POLICY=server-primary`; repin arms (`--repin`, repair `vendor_repinned_to_service`); dry-run parity; `--vendor-wait`; `--require-all` | reuse-disabled idempotence invariant; decision-table unit tests; regenerate test | env back to `legacy` | #283 repair.rs |
-| 23 | depscan | Submodule bump with 89-94 pinned to require no skip, a strict `service` leg added, and 99 cargo-modes dropping `build` | depscan pre-flight green | revert gitlink | F79 step order |
-| 24 | CLI | Flip the default to `server-primary` once the Phase 0 gate holds (30 days, per-ecosystem `pending + build_failed + fallback` < owner threshold); CLI_CONTRACT, CHANGELOG, README "Work offline" | gate data reviewed by owner; WS5 caveat reversed by owner (Open question 1) | set default back | release notes |
-| 25 | CLI | `SOCKET_PATCH_REQUIRE_STATEMENT` default on, after the step 13 backfill is complete and one release has passed | zero `statement: null` in reference metrics | default off | — |
-| **Phase 4: delete (one release after 24, zero `legacy` policy use in telemetry, WS5 caveat reversed)** | | | | | |
-| 26 | CLI | npm-family local packers (npm_pack pack fns, npm_common/npm_dir local branches) | all npm-family legs | git revert (irreversible for users only after release) | — |
-| 27 | CLI | registry_fetch ladder minus the WS1 keep-list; `source.rs`; vendor.rs ladder; `vendor_pristine_fetch_order_e2e.rs` | WS1 hosted restore tests green | git revert | #280 merged first |
-| 28 | CLI | Directory-backend local arms (cargo, composer, gem, golang FallBack); collapse FallBack variants; `--vendor-source build` exits 2 outside maven/nuget | all vendored legs; cargo-vex-matrix | git revert | WS8 exit-2 convention |
-| 29 | depscan | Submodule bump; api-v0 vendor suites updated | pre-flight | revert gitlink | — |
-| **Phase 5 (optional)** | | | | | |
-| 30 | depscan | Sandboxed sdist→wheel for pure `py3-none-any` results (autotester container infra), shrinking the pypi local class to C-extension sdist-only releases | installer e2e | flag | owner decision |
-
-Release boundary:
-- Phases 0–3 ship in v5.x minors, except that step 24 is itself a
-  behavior change (the default stops building locally on outages,
-  `pending_build` and `build_failed`) and needs the same v5.x-vs-v6 owner
-  call as Phase 4.
-- Phase 4 changes CLI behavior (`build` refused, `--offline` narrower).
-  Ship it in v5.x with one release of deprecation warnings, or in v6
-  (owner call).
-- Removing the `--vendor-source` flag itself is v6.
-
-## Risks & mitigations
-
-| Risk | Mitigation |
-|---|---|
-| First vendoring of a new patch depends on the server | committed artifacts, cache, bundles; retryable exits; SLO alert; `--vendor-wait` |
-| Server defects ship to every vendored user (#23144 defective rebuilds; #24466 invalid gem stub, which #221 papered over with a local fallback) | CLI keeps afterHash and stub-validity checks, which fail closed with specific codes; depscan installer e2e plus the fixture golden; generation-in-key rolls fixes out without breaking pins |
-| Hit rate is unknown | Phase 0 metrics; flip gated on 30 days per ecosystem |
-| Locks that pin locally built bytes (F72 blocker 3) | reuse keeps them; re-pin only on `--repin` or when repair finds the artifact missing; one notice code |
-| Air-gapped users lose ad-hoc local builds | bundles and mirror layout; pypi local class stays; owner decision |
-| pypi variant fan-out | lazy, keyed by requested filename; sizing SQL first; berry.zip removal offsets storage |
-| `r{n}` grammar change touches hosted URLs | only minted for gen ≥ 2 after the CLI parser ships (step 10 before step 9's flag), and only in contract-2 responses: v4/v5.0 CLIs on v1 keep getting gen 1 under the legacy URL; shared golden with an `r{n}` case |
-| Server and CLI extraction caps differ: the server allows 200,000 entries and 256 MiB (depscan:…/repack-utils.ts:23,30); the CLI extractors allow 60,000 entries and 128 MiB per entry (`registry_fetch.rs:41-47`, used by `cargo.rs` extract_tgz, `golang.rs`, `common.rs`), and `patch/package.rs` is stricter still. With no local path, the server can serve an artifact the CLI must refuse | Phase 1 (step 8): the server emits static `artifact_exceeds_client_caps` when the output exceeds the CLI's published caps, checked against one caps fixture shared by both repos (or the CLI caps are raised to match) |
-| Large upstream artifacts exceed the 100 MiB serve cap | `artifact_too_large` refusal before download; pypi falls back to the local class; npm family is an accepted regression (Open questions) |
-| KMS or key custody | non-exportable KMS key; embedded current plus next key; signed revocation from an offline root; statements optional online until step 25 |
-| Retained pypi recipe drifts on a dependency bump | golden byte vector, pinned backend, versioned recipe id |
-| Old CLIs | v1 contract schema-compatible (only `yarn-berry-zip.url` becomes null; the entry and its 10c0 stay until v1 sunsets); `tarball` stays the authored variant; no `r{n}` URLs on v1 |
-| depscan 89-94 masked a divergence via silent fallback | step 23 pins service mode and fails on skips |
-| WS1 breakage from deletions | the WS1 keep-list is carved out; step 27 runs after #280 with its tests as the gate |
-| Test doubles | capstones use committed bundles on the real import path, not a loopback service; depscan uses real Postgres, the file store and a file-backed key; any KMS or registry double needs explicit approval |
-
-## Design panel (record)
-
-Four variants were scored by three judges (integrity, ops, delivery), on a
-0–10 scale:
-
-| Variant | Integrity | Ops | Delivery | Total | Claimed CLI src/test deleted |
-|---|---:|---:|---:|---:|---|
-| A: server-only plus signed bundle | **8** | 6 | 6.5 | 20.5 | 3,400 / 2,580 |
-| **B: server-primary, minimal fallback (winner)** | 7 | **8** | **7.5** | **22.5** | 2,200 / 1,200 |
-| C: content-addressed store plus signed manifests | 7 | 6.5 | 5.5 | 19.0 | 3,090 / 2,820 |
-| D: spec-first shared builder (crate plus wasm) | 6 | 6 | 5 | 17.0 | 950 / 1,200 |
-
-**Why B won** (two of three lenses, highest total):
-- It prevents flip-flop structurally, with sticky producers and "an outage
-  is not a refusal", instead of hiding it.
-- It keeps the one local build that has no server substitute, so there is
-  no pypi airgap regression and no new sdist lock-writer arm.
-- It is the smallest correct server change.
-- It has an honest rollback at every phase, and it keeps `berry_zip` for
-  WS1.
-
-**Corrections applied to B:**
-- The registry_fetch row now carves out the WS1 keep-list (`download`,
-  `goproxy_base`, `go_match_prefix_patterns`, `MAX_DOWNLOAD_BYTES`,
-  `npm_tarball_url`, …) and is re-measured down to about 700.
-- The policy-duplication citation is F32 (220), not F31.
-- `no-transform` applies to artifact bytes only (F37 verification).
-
-**Grafted:**
-- from A: the user CAS cache; bundle export and import carrying records;
-  the SLO and gauges; acquire-before-wire with opt-in `--require-all`;
-  `<artifact>.statement.json`; the fixture-bundle capstones instead of a
-  loopback service double; the v1 compatibility rule; the note to
-  re-measure after #283;
-- from C: JCS canonicalization; the backfill of verdicts, generations and
-  statements for existing rows; the mirror layout; `r{n}` immutable
-  hosted URLs; upload checksums; F37 and F39 co-landing;
-- from A and the integrity judge: signing promoted from optional to
-  planned (step 13), with a signed revocation list;
-- from D: the flate2 backend caveat applied to the retained pypi recipe,
-  and a fixture golden as a reproducibility audit.
-
-**Rejected alternatives:**
-- **A as a whole.** It deletes `berry_zip` and the WS1 helpers. Old rows
-  fail closed without statements, and there is no backfill. Its
-  all-or-nothing default is harsh. Eager variant fan-out is costly. It
-  needs a new sdist lock arm.
-- **C as a whole.** It has the largest blast radius: hosted serving is
-  re-routed through a new CAS. It deletes `berry_zip`, which breaks WS1.
-  It accepts JWKS keys over TLS, which collapses trust back to TLS. A
-  1-year digest-keyed shared cache plus `stale-if-error` weakens
-  revocation. Its automatic one-time re-pin in `vendor` is a silent
-  substitution path.
-- **D.** Byte identity across 5 targets plus wasm is unproven, and the
-  fallback profile is 3–5× larger. It adds a permanent cross-repo crate
-  and wasm release chain. It has no signing, deletes the least code (about
-  300 net src), and covers only npm and pypi.
-
-## Open questions for the owner
-
-1. Reverse the WS5 caveat (drop the local rebuild everywhere except the
-   pypi class, and except maven/nuget) once the Phase 0 gate passes? What
-   per-ecosystem thresholds?
-2. Ship Phase 4 in v5.x after one deprecation release, or in v6?
-3. Accept the narrower `--offline`: reuse, cache, bundle, and the pypi
-   local class only. Today `--offline` builds locally for every ecosystem.
-   Also accept that npm-family packages whose upstream tarball exceeds the
-   100 MiB serve cap become unvendorable (`artifact_too_large`, no local
-   build)?
-4. Signing: approve KMS key custody, the offline root key for revocation,
-   and making statements mandatory online (step 25).
-5. Accept the optional `r{n}` hosted URL segment, which is a URL grammar
-   change shared with the depscan TS parser and the goldens.
-6. pypi variant caps: is lazy on-request enough, or should pure wheels
-   also be built eagerly for faster first vendoring?
-7. Phase 5 sandboxed sdist→wheel builds: worth the autotester-infra
-   dependency?
-8. Telemetry: move `patch_vendored` to `/v1/orgs/{slug}/events` or extend
-   the 2026-12-31 sunset (F22)? The Phase 0 gate depends on it.
diff --git a/docs/design/staged-rollout.md b/docs/design/staged-rollout.md
deleted file mode 100644
index 09a0f5a9..00000000
--- a/docs/design/staged-rollout.md
+++ /dev/null
@@ -1,1180 +0,0 @@
-# Staged patch rollout: `socket.yml` patch policy + `scan --max-new-patches`
-
-Status: **planned** (v5.0). Target branch `release/v5-prerelease`.
-Two work items, built in parallel: **A** (policy file + filters) and
-**B** (per-run limit + ordering + reporting). Section 9 specifies both.
-
-## 1. Goal
-
-Make it easy to roll Socket patches out gradually:
-
-1. **Repo policy in `socket.yml`.** Say which projects, ecosystems and
-   packages socket-patch may patch, and a severity floor. Defaults apply
-   when the file or the block is absent. The hard-coded repo-path filter
-   that exists today moves here as an overridable default.
-2. **A per-run cap on new patches.** `scan` adds at most N patches to
-   packages that have none yet, most severe first. Repeated runs converge:
-   each run lands the next N.
-
-Non-goals: open-PR accounting (a CLI patching a working tree has no PR
-state; that stays in depscan), schedules, release-age cooldowns (security
-fixes are exempt from cooldowns in Dependabot and Renovate too), and
-per-directory `socket.yml` files.
-
-## 2. What exists today (research summary)
-
-### 2.1 `socket.yml` v2 and its consumers
-
-| Parser | Where | Unknown top-level keys | Wrong type on a known key |
-|---|---|---|---|
-| P1 `@socketsecurity/config` 3.0.1 (archived; bundled in `socket` 1.x) | `socket-config-js/index.js:30-88` | stripped (ajv `removeAdditional: 'failing'`, `additionalProperties: false` at top level and under `githubApp`) | file rejected |
-| P2 depscan copy (GitHub App, fix-PR) | `workspaces/lib/src/config-js/socket-yaml-schema.ts`, `parse-socket-yaml.ts` | stripped (same ajv options) | whole file rejected; PR check goes neutral with "error processing the socket.yml" (`diff-report-runner/index.ts:441-464`) |
-| P3 socket-cli 2.x | `src/util/socket-yaml.mts` | ignored (hand-written picker) | that key dropped |
-| P4 Coana | not available | unverified | reads `projectIgnorePaths` only |
-
-- Keys in the wild: `version` (integer; P1/P2 accept any integer, P3
-  rejects anything but 2), `projectIgnorePaths`, `triggerPaths`,
-  `issueRules`, `githubApp.*`. Nothing mentions patches.
-- **A new top-level `patches:` key breaks no parser** as long as the file
-  keeps `version: 2`. P1/P2 strip it, P3 ignores it. None of them will
-  ever see it; socket-patch is its only reader.
-- Lookup: the GitHub App reads only the repo-root `socket.yml` /
-  `socket.yaml` at the scanned commit, and when both exist `socket.yaml`
-  wins (git tree order, `get-socket-repo-config.ts:96-120`). socket-cli
-  walks up from cwd and prefers `socket.yml`. The docs say `socket.yml`
-  wins. Nobody merges multiple files; there are no per-directory files.
-- Glob semantics (backend): the `ignore` npm package, i.e. **gitignore
-  rules**, case-insensitive, tested against each manifest **file** path
-  (`list-files.ts:476-507`). A leading `/` or a
-  middle `/` anchors to the repo root, a bare name matches at any depth, a
-  trailing `/` matches directories only, `!` negates, last match wins, a
-  child of an excluded directory cannot be re-included.
-- An unquoted `**` entry is a YAML error. Case-insensitivity and the
-  "excluded parent" rule are the two things users trip over.
-
-### 2.2 socket-patch v5 today
-
-- Selection per package: `socket_patch_core::api::ranking`
-  (`ranking.rs:85`): merged patches (>= 2 advisories) newest first, then
-  severity, then publish date, then tier/uuid. `RankKey.severity` is forced
-  to 0 for merged patches, so it is **not** the patch's real severity.
-  `severity_order` (`ranking.rs:41`) and `max_severity_order` are.
-- Per-patch data: severity (max, uppercase), advisory ids, tier, optional
-  `publishedAt` (batch endpoint usually lacks it). No CVSS, EPSS, KEV,
-  reachability or direct/transitive information anywhere.
-- Scan selects patches in five disk call sites plus one in the in-memory
-  engine: `discover_selected` (`scan/mod.rs:553`, called from `mod.rs:1999`,
-  `hosted.rs:1063`, `vendor_flow.rs:473`, `mod.rs:2349`), the human
-  agent/vendored arm (`mod.rs:2386-2402` via `get.rs:1097`), and
-  `hosted_memory/discover.rs:286` (`select_top_ranked`, called at
-  `hosted_memory/mod.rs:537`).
-- Existing filters: `--ecosystems`, `--package` (`package_spec_matches`,
-  `mod.rs:383`), PATH globs (`path_scope.rs`), all applied after the prune
-  universe is captured (`mod.rs:1480`).
-- Recorded state: `merge_ledger_records_for_updates` (`discovery.rs:412`,
-  manifest > hosted lockfile pins > vendor ledger) and `detect_updates`
-  (`discovery.rs:452`) with `batch_supersedes` (`ranking.rs:157`). The
-  in-memory engine has **no** hosted-pin discovery.
-- `docs/design/configuration.md` said socket-patch never reads
-  `socket.yml`. This plan reverses that (section 3); the doc is updated in
-  the same PR.
-
-### 2.3 Hard-coded filtering inventory
-
-socket-patch (paths relative to `crates/`):
-
-| # | Location | What | Verdict |
-|---|---|---|---|
-| H1 | `socket-patch-cli/src/hosted_memory/roots.rs:56-67` `EXCLUDED_ROOT_SEGMENTS` | the in-memory engine never detects a project root under `node_modules .git .socket .yarn vendor test tests fixtures __fixtures__ testdata` | **Move** `test tests fixtures __fixtures__ testdata` to the overridable default `ignorePaths` (section 4.3), applied on disk too. Keep `node_modules .git .socket .yarn vendor` structural. |
-| H2 | `socket-patch-core/src/crawlers/npm_crawler.rs:19-27` `SKIP_DIRS` (dist build coverage tmp temp `__pycache__` vendor) | npm workspace walk looking for nested `node_modules` | Stays: crawler heuristic, not selection policy |
-| H3 | `socket-patch-cli/src/hosted_memory/select.rs:46,53-70` | cargo `target/` and `cargo vendor` output skipped | Stays: correctness |
-| H4 | `socket-patch-cli/src/hosted_memory/roots.rs:40-53` | maven/nuget unsupported in memory | Stays: capability |
-| H5 | `socket-patch-cli/src/hosted_memory/mod.rs:274` `ecosystem_allowed` | `options.ecosystems` | Stays: the in-memory `--ecosystems`; intersects with the file |
-| H6 | `crawlers/python_crawler.rs:288`, dot-dir skips in `cargo_crawler.rs:373`, `go_crawler.rs:344`, `nuget_crawler.rs:236`, `ruby_crawler.rs:576` | discovery locations | Stays: crawler heuristics |
-| H7 | `ruby_crawler.rs:823` BUNDLE_PATH containment | refuse config roots outside the project | Stays: **safety** |
-| H8 | `scan/mod.rs:596-603`, `get.rs:1101-1107` tier filter | paid patches for free orgs | Stays: entitlement |
-| H9 | `scan/mod.rs:723-762` agent partition | vendored / not-installed skips | Stays: ownership safety |
-| H10 | `scan/hosted.rs:1256-1296` non-granted references | not_found, forbidden, pending_build, build_failed, withdrawn | Stays: server truth |
-| H11 | `hosted.rs:1352-1402`, `hosted.rs:1448`, core rewriter refusals, vendor revert allowlists, `vlt_lock_text.rs:311` | write safety, format gates, ledger-poisoning guards | Stays: **safety** |
-
-No package-name, uuid or repo denylists exist anywhere in socket-patch.
-
-depscan (`feat/socket-patch-cli-autopatch`, PR #26860; `workspaces/app/src/autopatch-pr/cli/` unless noted):
-
-| # | Location | What | Verdict |
-|---|---|---|---|
-| D1 | `run-job.ts:94-102,293`; `next-app/.../socket-patch-cli/enqueue.ts:104` | per-org `socketPatchCliAutopatch` flag | Server (kill switch) |
-| D2 | `provider/create-patch-provider.ts:189-279` | `enablePatchesAccess`, paid entitlement | Server (entitlement) |
-| D3 | `lib/src/socket-patch/autopatch-job.ts:152-169` | per-job admin `config.ecosystems` allowlist, `batchSize` (lookup batch, not a patch cap) | Server; ecosystems **intersect** with `patches.ecosystems` |
-| D4 | `repo-files.ts:290-513` | tree/path/size/depth caps, unsafe path drops | Server (safety) |
-| D5 | `pull-request-rules.ts:473-491` | fork/default/protected heads are check-only | Server (safety) |
-| D6 | `next-app/src/lib/admin/autopatch/socket-patch-cli-branches.ts:10-31` | branch-name guards | Server |
-| D7 | legacy `patch-pr-worker.ts:65-109`, `github-patch-pr.ts:262-283,1598-1740`, `github-patch-pr-hosted.ts:196-486`, `compute-full-patch-set.ts:41-273` | already-applied, not-in-SBOM, unpublished, deprecated, vlt gates | Server (correctness); not policy |
-
-Nothing in depscan filters by repo path, package or severity, and nothing
-caps patches per PR. The only repo-path policy in the whole system is H1,
-and it lives in the engine. It is the one hard-coded filter that moves.
-
-### 2.4 Prior art (vocabulary borrowed, complexity not)
-
-| Tool | Limit | Counts | Order when capped |
-|---|---|---|---|
-| Dependabot | `open-pull-requests-limit` (5; security updates exempt) | open PRs | undocumented; shuffled |
-| Renovate | `prConcurrentLimit`, `prHourlyLimit` (security fixes bypass) | open PRs / new per hour | vulnerability, `prPriority`, update type, title |
-| Snyk | 5 open upgrade PRs; backlog "one PR a day, top vulnerability" | open PRs / per day | priority score |
-| GitLab auto-remediation | 10 open MRs, "three vulnerabilities at a time, highest severity first", `high` threshold | open MRs + per run | severity |
-| OSV-Scanner | `--apply-top=N`, `--min-severity` | per run | fixed |
-
-Borrowed: gitignore paths (`projectIgnorePaths`), `include`/`ignore`
-pairs, `enabled`, a severity floor spelled as a minimum (`--min-severity`,
-Snyk/GitLab/OSV), a per-run new-item cap (GitLab/OSV/Snyk backlog), a
-fixed total order (not Dependabot's shuffle), deny-wins.
-
-
-## 3. Trust boundary (decision)
-
-The rule in `CLI_CONTRACT.md` ("Repo-level files never carry endpoints,
-credentials, or interlock-disablers") stays and gains its positive half:
-
-> A repository file may **narrow or pace** what `scan` patches. It may
-> never name an endpoint or credential, pick a mode or download format,
-> turn off a safety check, or make `scan` patch anything it would not
-> patch with no file present. The one exception is negating the built-in
-> test/fixture path ignores (4.3), which are repo policy by nature.
-
-Every `patches:` key only removes candidates (`enabled`, `includePaths`,
-`ignorePaths`, `ecosystems`, `packages`, `ignorePackages`, `minSeverity`)
-or delays them (`maxNewPatches`). No key can add a package, bypass the tier
-filter, the agent partition, reference grants, containment checks or any
-refusal in H7-H11. The parser has no fields for URLs, tokens, org, mode,
-download mode or any `--no-*` safety switch; such keys are unknown keys and
-fail validation (4.4).
-
-Failure direction follows from that: because the file only narrows, an
-unreadable or invalid policy must not mean "no policy". It fails closed.
-And because a policy can hide security fixes, what it hides is always
-reported (4.7, 7.3), never silent.
-
-## 4. `socket.yml` grammar (work item A)
-
-### 4.1 Keys
-
-```yaml
-version: 2                     # required for socket-patch to honor `patches`
-projectIgnorePaths:            # existing scanner key; socket-patch honors it too
-  - "crates/*/tests/fixtures/**"
-patches:                       # new; every key optional
-  enabled: true                # bool. Default true. false = report only.
-  includePaths: ["/services/payments/"]   # gitignore list. Absent = every project.
-  ignorePaths: ["/legacy/"]    # gitignore list, evaluated after the defaults. Default [].
-  ecosystems: [npm, pypi]      # allowlist of --ecosystems names. Absent = all.
-  packages: ["pkg:npm/lodash"] # allowlist of --package specs. Absent = all.
-  ignorePackages: ["pkg:npm/left-pad"]  # denylist of --package specs. Default [].
-  minSeverity: high            # critical|high|medium|moderate|low. Absent = no floor.
-  maxNewPatches: 5             # integer 0..=4294967295. Absent = unlimited. 0 = upgrades only.
-```
-
-- camelCase, like every existing socket.yml key.
-- Ecosystem names are any `Ecosystem::cli_name()` (`npm pypi cargo gem
-  golang maven composer nuget deno`), case-insensitive, valid whatever the
-  build supports; an unsupported ecosystem simply matches nothing.
-- Package specs use exactly the `--package` grammar and matcher
-  (`package_spec_matches`, moved from the cli crate to core by A): a name
-  (full or last segment, case-insensitive) or a purl with or without a
-  version; qualifiers ignored. A bare name matches across ecosystems and
-  by last segment (`core` matches `@babel/core`), so the docs recommend
-  purls in `packages`/`ignorePackages`. Invalid spec: empty, or `pkg:`
-  without a type and name.
-- `moderate` is an alias of `medium` everywhere (file, flag, env, napi).
-- An empty allowlist (`includePaths: []`, `ecosystems: []`,
-  `packages: []`) is an error ("use `enabled: false`"), never "all".
-- Deny wins: `ignorePackages` beats `packages`, ignore paths beat
-  `includePaths`.
-
-### 4.2 Precedence against flags and env
-
-| Setting | Rule |
-|---|---|
-| List filters (paths vs PATH args; `ecosystems` vs `--ecosystems`; `packages`/`ignorePackages` vs `--package`) | **intersect**: flags narrow further, never widen |
-| `minSeverity` | `--min-severity <critical\|high\|medium\|moderate\|low\|none>` > `SOCKET_MIN_SEVERITY` > file > no floor |
-| `maxNewPatches` | `--max-new-patches <N\|none>` > `SOCKET_MAX_NEW_PATCHES` > file > unlimited |
-| whole file | `--no-socket-yml` / `SOCKET_NO_SOCKET_YML` (bool, the contract's spellings) skips the file; built-in default path ignores still apply |
-
-Scalars follow the contract's CLI > env > default order, with the file as
-the layer above the default. The person running the CLI is trusted; the
-file is the repo's default. Every new flag has an env binding. An empty env
-value is unset (repo-wide rule); a malformed flag or env value is a usage
-error (exit 2). depscan adds its own server ceiling (7.1).
-
-### 4.3 Paths
-
-- **Subject: marker files.** The backend tests `projectIgnorePaths`
-  against manifest file paths, so socket-patch does the same for every
-  path list. A project root's **markers** are the lockfile/manifest files
-  in its directory that the engine reads for it (disk: the root's
-  lockfiles per the formats registry, plus its manifest; memory:
-  `hosted_memory/roots.rs` marker files). Paths are repo-relative with `/`
-  separators, e.g. `services/api/package-lock.json`, `package-lock.json`
-  for the repo-root project.
-  - A root is **ignored** iff **every** marker is ignored.
-  - With `includePaths` set, a root is **included** iff **any** marker
-    matches `includePaths`.
-  - Admitted iff included and not ignored.
-  This makes `/package-lock.json`, `**/yarn.lock`, `examples/**` and
-  `crates/x/fixtures/**` mean what they mean to the scanner, and needs no
-  special form for the repo-root project (target only it with
-  `includePaths: ["/*", "!/*/"]`).
-- **Semantics: npm `ignore` exactly.** gitignore rules, case-insensitive,
-  anchored at the repo root: a leading or middle `/` anchors, a bare name
-  matches at any depth, a trailing `/` matches directories only, `!`
-  negates, last match wins. Evaluation walks **top-down**: for
-  `a/b/c.lock`, test `a/`, then `a/b/`, then the file; the first ignored
-  ancestor decides and a negation cannot re-include anything under it
-  (`fixtures/` + `!/a/fixtures/keep/` leaves `keep` ignored, as in the
-  backend). Do not use `ignore::gitignore`'s `matched_path_or_any_parents`
-  as-is: it walks bottom-up and would re-include. Implement the walk over
-  `Gitignore::matched(path, is_dir)`. `includePaths` uses the same walk
-  with "matched" in place of "ignored".
-- A golden fixture of (patterns, path, expected) generated from the npm
-  `ignore` package is checked into the tests; the Rust matcher must agree
-  on all of it.
-- **Pattern hygiene.** Reject (4.4) patterns that contain a `..` segment, a
-  drive letter, NUL, or exceed 1024 bytes. Backslash is gitignore's escape
-  character, not a separator (documented).
-- **Evaluation order** of the ignore lists (one combined list, last match
-  wins within a path, top-down across ancestors):
-  1. built-in defaults: `test/ tests/ fixtures/ __fixtures__/ testdata/`
-  2. `projectIgnorePaths`
-  3. `patches.ignorePaths`
-
-  Re-include a default with a negation: `ignorePaths: ["!/e2e/tests/"]`.
-  Adding an unrelated ignore never re-enables fixtures. The defaults are
-  now case-insensitive (`Test/` too), unlike H1. The backend's own
-  scanner defaults (`coverage`, `bower_components`, …) are not mirrored:
-  those are not dependency roots socket-patch would find.
-- **Defaults apply to discovered roots only.** Step 1 never applies to a
-  root the user named explicitly:
-
-  | Mode / entry point | Explicit roots | Discovered roots |
-  |---|---|---|
-  | disk hosted/vendored | `--cwd` with no PATH; a literal (non-glob) PATH | PATH-glob matches (`run_project_dirs` carries the flag per directory) |
-  | disk agent | `--cwd` (its only project; agent PATHs are package globs, not roots) | none |
-  | in-memory | roots given in `projectRoots` | roots found by detection |
-
-  Steps 2-3 and `includePaths` apply to every root.
-- **Structural excludes** (`node_modules .git .socket .yarn vendor`) stay
-  hard-coded and cannot be negated.
-- **Granularity.** A workspace member that shares the root lockfile is part
-  of the root project; exclude it with `ignorePackages`, not paths.
-- **Outside the repo.** Roots are canonicalized; a PATH that resolves
-  outside the repo root (4.5) is a usage error (exit 2). One policy per
-  invocation.
-
-### 4.4 Validation (fail closed)
-
-socket-patch validates `version`, `projectIgnorePaths` and `patches`, and
-checks top-level key names for case variants of `patches`. It does not
-validate any other key.
-
-Checks run in this order: file access, encoding, YAML, top-level shape,
-case-variant check, version gate, keys.
-
-| Situation | Behavior |
-|---|---|
-| No file; empty or comment-only file | no file: defaults |
-| Not a regular file after resolving (directory, FIFO, device), resolves outside the repo root, larger than 64 KiB (read at most 64 KiB + 1 from the opened handle; metadata from the same handle) | **error** |
-| Invalid UTF-8, UTF-16, NUL bytes (a UTF-8 BOM is stripped; CRLF is fine) | **error** |
-| YAML syntax error, duplicate key, top level not a mapping, nesting deeper than 32 | **error** |
-| An anchor, alias or merge key (`<<`) inside `patches` or `projectIgnorePaths` | **error** (bounds expansion; nobody needs them here) |
-| Top-level key equal to `patch` or `patches` ignoring case but not exactly `patches` | **error**: a misspelled block must not mean "no policy" |
-| `patches` present and `version` is not 2 (integer 2 or string `"2"`, as ajv coerces), including missing | **error** ("patches requires version: 2") |
-| `patches: null` or `patches: {}` | defaults |
-| Unknown key under `patches` | **error**, with a did-you-mean hint (edit distance <= 2) and "a newer socket-patch may support it; upgrade or remove it" |
-| Wrong type (no coercion: `"false"` is not a bool; YAML 1.2, so `no` is a string), unknown severity, `maxNewPatches` not an integer in range, empty allowlist, invalid pattern or spec, a list over 1000 entries, an entry over 1024 bytes | **error** naming the key path (`patches.minSeverity`) |
-| `projectIgnorePaths` with a `patches` block present: a string is coerced to a one-element list (as ajv does); anything else not a list of strings is an **error** | |
-| `projectIgnorePaths` with **no** `patches` block: same coercion; otherwise warning `socket_yml_ignored_value` and the key is ignored | repos that never opted in do not start failing on a scanner key |
-| No `patches` block, any `version` | `projectIgnorePaths` honored whatever the version, as the backend (P2) does |
-| Both `socket.yml` and `socket.yaml` at the root | validate both (either invalid is an error). If their `projectIgnorePaths` and `patches` are equal as parsed values (order-sensitive), use `socket.yml`; otherwise **error** `socket_yml_ambiguous`. The existing consumers disagree on which file wins, so we refuse to pick. |
-| Only a case variant exists (`Socket.yml`) | not read (the name must match a directory entry exactly, via `read_dir`, so case-insensitive disks behave like the memory tree); warning `socket_yml_name_case` |
-
-**Error behavior.** Before any write, `scan` fails with exit **1** and
-`errorCode: socket_yml_invalid` (or `socket_yml_ambiguous`). The message
-names the file, the key path and the remedy (fix the file, or
-`--no-socket-yml`). Exit 1, not 2: it is a bad input file, like an invalid
-manifest. Scan's JSON is still the legacy shape (not the unified envelope):
-the error output is scan's existing error object `{"status": "error",
-"error": "<message>"}` plus an additive `"errorCode"`; no `policy` or
-`rollout` block is emitted on error.
-
-Every string copied from the file into output (patterns, specs, key names)
-is truncated to 200 characters with control characters stripped; depscan
-additionally renders them as escaped code spans (7.3).
-
-Keys are only ever added in minor releases and never change meaning. An
-older pinned CLI fails on a newer key by design, and the error says so.
-
-### 4.5 Lookup
-
-1. Canonicalize `--cwd`. Repo root := the nearest ancestor (inclusive)
-   containing `.git` (a directory, or a file for worktrees and submodules),
-   not walking past any directory in `GIT_CEILING_DIRECTORIES`, and, on
-   Unix, only if `.git` is owned by the current user or root (git's
-   safe.directory spirit; otherwise warning `socket_yml_repo_untrusted`
-   and the walk stops). With no qualifying `.git`, repo root := `--cwd`.
-   Never the home directory unless `--cwd` is it; never above `--cwd`
-   without a `.git`.
-2. Read `<repo root>/socket.yml` and `<repo root>/socket.yaml` only.
-   Nested files are never read (one file per repo, as in the GitHub App).
-   A symlinked socket.yml is followed only if it resolves to a regular
-   file inside the repo root.
-3. In memory, the repo root is the tree root; the caller supplies the
-   file's content to path selection and to the session (7.2). A socket.yml the tree lists but the engine never
-   receives, or receives only as present-without-content (symlink,
-   oversize, LFS pointer, binary), is `socket_yml_invalid`, never absent.
-4. `--global` / `--global-prefix` scans have no repo and ignore the file.
-
-### 4.6 Commands
-
-| Command | Policy |
-|---|---|
-| `scan` (hosted, vendored, agent; wet and `--dry-run`), `hosted-bundle`, the napi engine | honor filters and limit |
-| `get` | explicit intent: ignores filters and limit; warns `policy_bypassed` when the target would have been filtered; never fails on the policy (an invalid file just skips the warning) |
-| `apply`, `list`, `vex`, `rollback`, `remove`, `repair`, `vendor` (eject/revert) | ignore it: they report, attest or undo existing state |
-
-**Narrowing never removes.** The policy runs after the prune universe is
-captured (`mod.rs:1480`), so `--prune` still judges the full crawl. A
-package that already has a recorded patch but is now excluded by paths,
-ecosystems, packages or `enabled: false` is **retained**: not passed to the
-hosted rewriters, vendor engine or agent apply; not upgraded; not taken
-over; left byte-identical. It is reported under `policy.retained[]` with
-`upgradeAvailable`. Removing a patch is only ever `rollback`/`remove`, or
-the dependency leaving the lockfile.
-
-**Severity floor.** One data source: the by-package records the selector
-already fetches (`fetch_patch_details` on disk, the provider's by-package
-lookup in memory), severity = `max_severity_order` over the patch's
-`vulnerabilities`, never `RankKey.severity` (forced to 0 for merged
-patches) and never the batch list. The floor restricts which candidates
-may **win** per-package ranking; a lower-ranked patch above the floor can
-still win. With a floor set, unknown severity is filtered (fail closed;
-note `minSeverity: low` therefore drops unknown-severity patches, which the
-recipes say). Supersession of a recorded patch is judged against the
-**unfiltered** offer list (5.1): the floor never turns a recorded patch
-into "no longer offered". A recorded package with no candidate above the
-floor keeps its recorded patch (ALREADY).
-
-`enabled: false`: discovery and the table still run; nothing is written;
-every candidate is reported filtered with `policy_disabled`; warning
-`patches_disabled`; exit 0. Upgrades are frozen too.
-
-### 4.7 JSON (`policy` block, owned by A)
-
-Additive top-level key on every successful `scan --json` result (MINOR),
-always present. Policy warnings go to scan's top-level `warnings[]`.
-
-```json
-"policy": {
-  "source": "file",
-  "path": "socket.yml",
-  "sha256": "…",
-  "enabled": true,
-  "minSeverity": {"value": "high", "source": "file"},
-  "counts": {"filtered": 3, "retained": 1},
-  "filtered": [
-    {"purl": "pkg:npm/qs@6.5.2", "uuid": null, "project": "services/legacy",
-     "reason": "policy_path_excluded", "detail": "/legacy/ (patches.ignorePaths)"}
-  ],
-  "retained": [
-    {"purl": "pkg:npm/lodash@4.17.20", "project": "", "recordedUuid": "…",
-     "reason": "policy_package_ignored", "upgradeAvailable": true}
-  ]
-}
-```
-
-| `source` | When | `path` / `sha256` |
-|---|---|---|
-| `none` | no file, empty file, file ignored (`--global`), or only a case variant | null |
-| `file` | a root file was read (with or without a `patches` block) | the file used (`socket.yml` when both are equal) / its bytes' hash |
-| `bypassed` | `--no-socket-yml` / `SOCKET_NO_SOCKET_YML` | null |
-
-- `project` is the repo-relative root directory; the repo root is `""`
-  (the memory engine's spelling) everywhere.
-- `minSeverity.source` is `flag|env|file|default`; `value` null = no floor.
-- `uuid` is null when the package was filtered before any patch lookup
-  (path, ecosystem, package reasons). A root filtered as a whole is one
-  entry with `purl: null`.
-- `counts.filtered` counts entries of `filtered[]`; `counts.retained`
-  counts entries of `retained[]`.
-- Reason codes (stable): `policy_disabled`, `policy_path_excluded`,
-  `policy_path_not_included`, `policy_ecosystem`,
-  `policy_package_not_listed`, `policy_package_ignored`, `policy_severity`
-  (detail `unknown < high` or `medium < high`).
-- Human output: one line, e.g. `Policy (socket.yml): 3 skipped by filters,
-  1 patched package held.` Filtered critical/high candidates are always
-  named on the human path (a policy must not silently hide them);
-  `--verbose` lists everything.
-
-## 5. Per-run limit (work item B)
-
-### 5.1 Classification
-
-**Recorded view.** Always the merged view, in every mode and both engines:
-`merge_ledger_records_for_updates` (manifest > hosted lockfile pins >
-vendor ledger), scoped to the lockfiles and state files of the project
-root being written. The in-memory engine reads the same three stores from
-the tree (`.socket/manifest.json`, `.socket/vendor/state.json`, hosted
-pins discovered from the in-memory lockfiles; new, B). When the lockfiles
-of one root pin a purl to different uuids, the recorded uuid is the
-selected uuid if it is among them, else the smallest (today's rule).
-
-**Supersession** uses the by-package records (the same data as selection
-and the severity floor), with the `batch_supersedes` rungs applied to
-them: merged over unmerged, higher severity between unmerged, a real,
-strictly later publish date. It is judged against the **unfiltered** offer
-list. B adds the by-package twin of `batch_supersedes` in `ranking.rs`;
-`detect_updates` and scan's `updates[]` switch to it so classification,
-selection and reporting can never disagree.
-
-After filtering and per-package selection, each selected `(project root,
-purl)` row is:
-
-| Class | Rule | Counts toward the cap | Writer receives |
-|---|---|---|---|
-| ALREADY | recorded uuid == selected uuid, or the selection does not supersede the recorded uuid | no | the **recorded** uuid (re-confirmed idempotently) |
-| UPGRADE | the selection supersedes the recorded uuid, or the recorded uuid is no longer offered at all (unfiltered) | no | the selected uuid |
-| NEW | nothing recorded for this base purl in this project root | **yes** | the selected uuid, if admitted |
-| ALREADY (kept) | recorded, offers exist in `Offers.unfiltered` but none survive the floor | no | the recorded uuid (counted in `counts.already`) |
-
-- NEW is per project root. Widening `includePaths` makes piloted packages
-  NEW in the added roots, so they go through the cap again.
-- UPGRADEs are exempt (decision): rollout risk is about whether a package
-  runs patched code at all, and an upgrade fixes more in an already-patched
-  package. `enabled: false` freezes everything; `maxNewPatches: 0` freezes
-  new packages only.
-- **Known limit: version bumps.** When a dependency moves to a new version
-  its hosted pin goes with the old lockfile entry, so the new version is
-  NEW and goes through the cap. (Hosted state cannot tell a bump from a new
-  package.) Documented.
-- **Qualifier twins** (wheel/sdist, gem platforms) share a base purl. If
-  one twin lands and another was ineligible, the next run sees the base
-  purl as recorded and the late twin lands as ALREADY/UPGRADE, uncapped.
-  Documented; it is one package.
-
-### 5.2 Eligibility, budget and ordering
-
-- **Eligibility is decided by the planning pass**, the same pass
-  `--dry-run` runs, before any budget is spent. A NEW row is eligible only
-  if every check that can be decided without writing passes:
-  - tier filter;
-  - agent partition (vendored / not installed);
-  - vendored preflight;
-  - hosted reference grant `granted`, with a usable purl and url;
-  - vlt artifact preflight;
-  - symlink refusals;
-  - rewriter planning shows at least one lockfile edit that would pin it
-    (no refusal, entry found).
-
-  Ineligible rows keep their existing skip reasons and never hold a slot,
-  so a patch that cannot land can never stall the rollout.
-- **One fetch strategy.** References are requested for every eligible-so-far
-  candidate (NEW, UPGRADE and ALREADY) in the run's normal batches, before
-  budgeting; never lazily in rank order. A reference or lookup failure that
-  affects only rows that end up deferred never fails the run or the root;
-  it becomes warning `rollout_reference_failed`.
-- **Incomplete data.** With a finite cap, if any batch, detail or reference
-  lookup failed for a package that could have been NEW, no NEW row is
-  admitted this run (all NEW rows deferred) and warning
-  `rollout_incomplete_lookup` is emitted. Otherwise a failure would let
-  lower-ranked patches take the missing ones' slots. ALREADY and UPGRADE
-  rows proceed as today.
-- **Unit:** a distinct **base purl** (ecosystem + name + version,
-  qualifiers stripped, via one shared core function `canonical_base_purl`)
-  among eligible NEW rows. Admitting a base purl admits all of its eligible
-  NEW rows in every root of the invocation; it costs 1 slot.
-- **Scope of the budget:**
-  - in-memory engine: one budget across all roots (collect, plan, apply);
-  - disk: one budget per invocation. `run_project_dirs` visits
-    directories in sorted order and passes the **remaining** budget to
-    each, together with the set of base purls already admitted (a base
-    purl admitted in an earlier directory is admitted free in later ones);
-    each directory spends the budget in rank order. `scan --json` accepts one
-    directory, so a CI job per directory gets N per directory. Documented.
-- **Order** (ascending; total; no time-dependent keys):
-  1. in-flight first (in-memory option `inFlightPatches` only, matched by
-     base purl; absent on the CLI)
-  2. severity of the selected patch (`max_severity_order`: critical, high,
-     medium, low, unknown)
-  3. advisory count, descending (merged patches first within a severity)
-  4. ecosystem `cli_name`, ascending
-  5. canonical base purl, ascending bytewise
-  6. smallest selected uuid across the base purl's rows, ascending
-
-  A base purl in several roots uses the minimum key over its rows.
-  `publishedAt` is not a key: it would reorder the queue whenever a date is
-  missing. Per-package ranking (which patch a package gets) still uses
-  `publishedAt` as today; this order only decides which packages go first.
-- **Write failures** after admission (I/O at commit time) consume budget
-  and are reported as failures. No backfill within a run, so `--dry-run`
-  predicts the wet run exactly.
-- **`maxNewPatches: 0`** admits no NEW rows; ALREADY and UPGRADE proceed.
-- Everything eligible and NEW beyond the budget is **deferred**: not
-  written, not downloaded, not vendored, reported with its rank.
-
-### 5.3 Convergence and determinism
-
-- Same inputs, same plan, same bytes. The limit is stateless: run k lands
-  the top N; on run k+1 they are ALREADY and the next N land. M waiting
-  patches take **at most** ceil(M/N) committed runs, absent new or
-  ineligible patches.
-- A newly published or re-scored higher-severity patch moves ahead of the
-  queue. That is intended ("most critical first") and visible, because
-  every deferred entry carries its rank and severity.
-- Low-severity patches can wait indefinitely while higher ones keep
-  arriving. Documented; it is the point of severity ordering.
-- **CI that does not commit** the scan's result never advances recorded
-  state, so a cap there means "only the top N, every run". The recipes
-  say: commit the lockfile changes (or use a PR bot), or set no cap in
-  non-committing jobs.
-- `pending_build` references are transient: a row can be ineligible one
-  run and eligible the next. The plan is still a function of the inputs.
-- `--dry-run` fetches reference grants like a wet run (it must, to decide
-  eligibility), so it has the same server-side effects a dry run has
-  today.
-
-### 5.4 Modes
-
-| Mode | ALREADY / UPGRADE surface | Deferred rows |
-|---|---|---|
-| hosted (disk) | re-confirmed / rewritten, as today | never rewritten; mirrored into `redirect.skipped[]` with reason `rollout_deferred` |
-| vendored | `already_vendored` / `would_revendor` | never downloaded or vendored |
-| agent | `skipped` / `updated` | never downloaded; not in `apply.patches[]` |
-| in-memory (napi, hosted-bundle) | as hosted | in `ProjectResult.deferred[]` and `skipped[]` with `rollout_deferred` |
-
-Recorded state is the merged view (5.1) in every row. A takeover of an
-existing vendored or hosted entry counts as recorded, not NEW. `--dry-run`
-makes exactly the same decisions.
-
-### 5.5 JSON (`rollout` block, owned by B)
-
-Additive top-level key on every successful `scan --json` result (MINOR),
-always present:
-
-```json
-"rollout": {
-  "maxNewPatches": {"value": 5, "source": "file"},
-  "counts": {"new": 5, "deferred": 9, "upgrade": 1, "already": 12},
-  "deferred": [
-    {"purl": "pkg:npm/minimist@1.2.5", "uuids": ["…"], "severity": "critical",
-     "advisoryCount": 1, "projects": ["services/api", "services/web"], "rank": 6}
-  ]
-}
-```
-
-- `maxNewPatches.value` null = unlimited; `source` is
-  `flag|env|file|default|cap`.
-- `counts.new` and `counts.deferred` count base purls (admitted this run,
-  or would be under `--dry-run`; deferred). `counts.upgrade` and
-  `counts.already` count `(project, purl)` rows.
-- `deferred[]` is in rank order; `purl` is the base purl; `uuids` lists
-  the distinct selected uuids across its rows and qualifier twins; `rank`
-  is 1-based among **eligible** NEW base purls. Ineligible rows are not
-  ranked; they appear under their existing skip reasons.
-- Human output (after the mode's summary, then the Next-steps renderer):
-
-  ```
-  Rollout: 5 of 14 new patches applied (maxNewPatches=5 from socket.yml); 1 upgrade, 12 already applied.
-  Next steps:
-    9 new patches deferred; commit these changes and run scan again to apply the next 5.
-    Next up: minimist@1.2.5 (critical), qs@6.5.2 (high), …
-  ```
-- Exit code unchanged (0) when patches are deferred or filtered.
-- `jq` recipe for CI: `jq '.rollout.counts.deferred'`.
-
-## 6. Rollout recipes
-
-```yaml
-# R1 Canary: one new patch per run
-version: 2
-patches:
-  maxNewPatches: 1
-```
-
-```yaml
-# R2 Critical first: widen by editing one line
-version: 2
-patches:
-  minSeverity: critical   # later: high, then low, then remove the key
-  maxNewPatches: 5        # (low still skips patches whose severity is unknown)
-```
-
-```yaml
-# R3 One directory first (monorepo)
-version: 2
-patches:
-  includePaths:
-    - "/services/payments/"
-    # add "/services/checkout/" next sprint
-  maxNewPatches: 5
-```
-
-```yaml
-# R4 One ecosystem, hold one package
-version: 2
-patches:
-  ecosystems: [npm]
-  ignorePackages: ["pkg:npm/left-pad"]
-```
-
-```yaml
-# R5 Weekly drip with the depscan autopatch PR
-version: 2
-patches:
-  maxNewPatches: 5        # the PR keeps the same 5 until merged, then the next 5
-```
-
-```yaml
-# R6 Pause
-version: 2
-patches:
-  enabled: false          # report only; existing patches stay in place
-# or keep upgrades flowing but add nothing new:
-#   maxNewPatches: 0
-```
-
-A cap only advances when the scan's changes are committed (or merged by a
-PR bot). In a CI job that scans without committing, set no cap.
-
-One-off overrides from the command line: `socket-patch scan
---max-new-patches none` (drain the queue this run), `--min-severity none`,
-`--no-socket-yml` (ignore the file entirely).
-
-## 7. depscan autopatch service
-
-### 7.1 Behavior with the new engine
-
-- `repo` jobs rebuild one commit from the base SHA each run. With
-  `maxNewPatches: 5`, "recorded" means recorded on the **base** branch, so
-  every rebuild proposes the same top 5 until the PR merges, then the next
-  5. `inFlightPatches` (the base purls already in the open PR) keeps a
-  reviewed patch from being displaced by a newly published one mid-review.
-- **Policy source.** Both job kinds read socket.yml from the **base** SHA:
-  the reviewed, merged policy. A pull request cannot loosen the policy
-  that judges its own check (for example by adding `ignorePackages` for
-  the vulnerable dependency it introduces). If the PR head changes
-  `patches` or `projectIgnorePaths`, the check run says so and lists what
-  the head's policy would additionally filter.
-- `pull_request` jobs honor the filters and pass `maxNewPatches: "none"`
-  and **no** `maxNewPatchesCap`: deferring there would leave the check
-  permanently showing work.
-- Effective limit for `repo` jobs = min(repo value, `maxNewPatchesCap`).
-  The server can tighten, never loosen; the cap applies to every value
-  including `"none"`. Org-level kill switches, entitlement and safety
-  (D1-D6) always win.
-
-### 7.2 Engine API changes (napi `HostedScanOptions` / result, and the `hosted-bundle` harness)
-
-| Owner | Change |
-|---|---|
-| A | Two-phase selection so the memory engine applies the same path policy as disk. `selectHostedScanPaths` gains an option `policyFiles?: Array<{path: string, text: string} \| {path: string, missing: true}>`, one entry per root `socket.yml` / `socket.yaml` the listing contains (the both-files rule of 4.4 applies): the caller fetches those root blobs first (they are root files, known from the tree listing) and passes the content. The selector parses it with the same loader and applies the **full** path policy (defaults, `projectIgnorePaths`, `patches` lists, negations) when choosing which files to fetch, so an `ignorePaths` negation re-includes a default-ignored tree in memory exactly as on disk. If the listing has a root policy file with no matching entry, or an entry is `missing: true`, or the text is invalid, the selector returns `policyError` (never "no policy"). The session re-parses the same text and fails `socket_yml_invalid` if the policy content that arrives differs (sha256) from what the selector saw |
-| A | the session applies the full policy to detected roots **before** the `max_projects` check (`hosted_memory/mod.rs:377`) |
-| A | options `noSocketYml?: boolean`, `minSeverity?: "critical"\|"high"\|"medium"\|"moderate"\|"low"\|"none"` |
-| A | result: session-level `policy` block (4.7) and `policyError?: {code, detail}`; on error no root is processed and no files change; `skipped[].reason` gains the `policy_*` codes |
-| B | options `maxNewPatches?: number \| "none"`, `maxNewPatchesCap?: number`, `inFlightPatches?: string[]` (base purls) |
-| B | result: session-level `rollout` block (5.5); `ProjectResult.deferred[]`; `skipped[]` rows with `rollout_deferred` |
-| B | hosted-pin discovery over the in-memory lockfiles and reading `.socket/manifest.json` / `.socket/vendor/state.json` from the tree, for the merged recorded view. A finite cap must never ship in the engine without it: every merged pin would look NEW and the rollout would stall at N. |
-| B | restructure the per-root loop around `hosted_memory/mod.rs:537` into collect all roots → plan once → apply, so the budget is run-wide |
-
-`hosted-bundle` rejects unknown fields, so each owner adds its fields there
-too.
-
-### 7.3 depscan follow-up (after A and B merge; separate PR in depscan)
-
-1. Bump the socket-patch submodule and rebuild the addon.
-2. Fetch the root socket.yml / socket.yaml blob from the **base** SHA
-   for both job kinds **before** calling `selectHostedScanPaths`, and
-   pass them as `policyFiles` (7.2); stream the same content to the session.
-   Never let the file be dropped by the size/path caps silently: a
-   missing or oversize policy blob is passed as `missing: true`, which the
-   engine turns into `policyError`.
-3. Pass `inFlightPatches` (base purls in the open patch-all PR); for
-   `pull_request` jobs pass `maxNewPatches: "none"` and no cap.
-4. New job outcome `policy_invalid` (from `policyError`): leave the
-   existing PR untouched, surface the error on the admin page and in the
-   check-run text.
-5. PR body and check run: a "Deferred (next batch)" table with severity
-   and rank; `policy.filtered`/`retained` counts, naming every critical or
-   high candidate the policy suppressed; a note when the PR head changes
-   the policy. Render every file-derived string as an escaped code span,
-   truncated.
-6. Stats: `patchesDeferred`, `patchesFiltered`.
-7. Optional server cap per org (future setting) passed as
-   `maxNewPatchesCap`; keep passing the admin `config.ecosystems` (D3) as
-   `ecosystems`, which intersects with the file.
-8. Do **not** add `patches` with strict types to the ajv schema in
-   `socket-yaml-schema.ts`: a typo there rejects the whole file and turns
-   PR checks neutral. If wanted for docs, add a permissive `{type: object}`.
-9. Docs repo: a `patches` section on the socket.yml page; fix the two
-   stale statements found in research (which file wins when both exist;
-   v1 files are rejected by the GitHub App).
-
-A closed or rejected rolling PR re-proposes the same patches next run;
-`ignorePackages` is the documented way to decline one.
-
-## 8. Decisions log
-
-| # | Decision | Why |
-|---|---|---|
-| 1 | Top-level `patches:` in socket.yml v2; no `version: 3` | breaks no parser (P1/P2 strip, P3 ignores); P3 rejects any version but 2 |
-| 2 | socket-patch reads socket.yml (reverses configuration.md) | owner request; policy that only narrows fits the trust boundary |
-| 3 | Keys `enabled includePaths ignorePaths ecosystems packages ignorePackages minSeverity maxNewPatches` | include/ignore pairs mirror existing keys; `packages` covers single-package pilots; `maxNewPatches` says it counts new patches only |
-| 4 | Paths match marker **files**, npm-`ignore` semantics, top-down, case-insensitive; golden parity fixture | identical meaning to `projectIgnorePaths` in the backend; no root special form |
-| 5 | socket-patch also honors `projectIgnorePaths` (leniently when there is no `patches` block) | users expect one ignore list; repos that never opted in do not start failing |
-| 6 | Defaults `test/ tests/ fixtures/ __fixtures__/ testdata/` first, overridden by `!`; discovered roots only | moves H1; replace-on-set would re-enable fixtures on any unrelated edit |
-| 7 | Strict validation of `patches`, fail closed, exit 1 `socket_yml_invalid` | a broken narrowing rule must not widen the rollout |
-| 8 | Both files: error only if the parts we read differ | consumers disagree on precedence; repos that have both keep working |
-| 9 | Repo root = nearest trusted `.git` ancestor (ceiling dirs honored), else `--cwd`; root files only; PATHs outside it are exit 2 | matches the GitHub App; memory can mirror it; never reads outside the checkout |
-| 10 | Flags intersect lists; scalars CLI > env > file > default; `--no-socket-yml` with env | contract precedence and "every flag has an env var" |
-| 11 | `maxNewPatches: 0` = upgrades only; absent / `none` = unlimited | literal meaning; avoids the Dependabot/Renovate 0 disagreement |
-| 12 | Unknown severity is filtered when a floor is set | fail closed |
-| 13 | One data source (by-package records) for floor, supersession, classification and order | selection, classification and reporting can never disagree |
-| 14 | NEW per (project root, base purl); budget per base purl; memory run-wide, disk per invocation carried across directories | a widened pilot re-enters the cap; one package in many roots costs 1 |
-| 15 | Upgrades exempt from the cap | rollout risk is per package; keeps patched packages current |
-| 16 | Order: severity, advisory count, ecosystem, base purl, uuid; no `publishedAt` | total and time-independent |
-| 17 | Eligibility = everything the planning pass can decide; fetch-all references; incomplete lookups admit no NEW rows | a broken patch never holds a slot; failures never reshuffle the queue |
-| 18 | Filtered packages with recorded patches are retained, never removed or upgraded | narrowing freezes, never removes |
-| 19 | `get` bypasses the policy with a warning | explicit intent |
-| 20 | Separate `policy` (A) and `rollout` (B) JSON blocks | clean ownership seam; both additive |
-| 21 | depscan reads the policy from the base SHA for PR jobs too | a PR cannot loosen the policy judging it |
-| 22 | Everything ships in 5.0 | honoring `projectIgnorePaths`, disk default ignores and fail-closed file errors change scan's default behavior (MAJOR) |
-
-## 9. Work items
-
-Both items branch from `release/v5-prerelease` (suggested branches
-`v5/rollout-policy` for A, `v5/rollout-limit` for B). **Merge order: A,
-then B.** B rebases onto A and owns the final integration (9.3). The
-seams are small and listed in 9.0: the step 5 → step 7 `Offers` struct
-(A), the repo-relative path helpers (A), the file's `maxNewPatches` value
-(A → B), and the pipeline order.
-
-### 9.0 Shared contract (frozen by this plan)
-
-Scan pipeline, in order (disk and memory):
-
-1. load policy (A); fail closed before any write
-2. crawl; capture the prune universe (unchanged)
-3. root filter, ecosystem/package filter, retained set (A)
-4. batch API, by-package details (unchanged fetches)
-5. candidate severity filter on by-package records (A); `discover_selected`
-   returns `Offers` (below) so B sees both the unfiltered and the
-   floor-filtered candidates
-6. per-package ranking (unchanged `ranking`)
-7. classify, planning pass for eligibility, budget, deferral (B)
-8. writers (receive only admitted NEW rows, ALREADY rows with the recorded
-   uuid, and UPGRADE rows)
-
-```rust
-// crates/socket-patch-core/src/policy/mod.rs — OWNER A
-pub struct SelectionPolicy { /* private fields */ }
-pub enum PolicySource { None, File { path: String, sha256: String }, Bypassed }
-pub enum FilterReason {
-    Disabled, PathExcluded { pattern: String, list: &'static str }, PathNotIncluded,
-    Ecosystem, PackageNotListed, PackageIgnored { spec: String },
-    Severity { found: Option<String>, floor: String },
-}
-impl FilterReason { pub fn code(&self) -> &'static str; pub fn detail(&self) -> String; }
-pub enum PolicyError {
-    Invalid { file: String, key: String, message: String },
-    Ambiguous { files: [String; 2] },
-}
-impl PolicyError { pub fn code(&self) -> &'static str; } // socket_yml_invalid | socket_yml_ambiguous
-pub enum RootFile { Absent, Present(Vec<u8>), PresentWithoutContent }
-pub trait PolicyFs { fn read_root_file(&self, name: &str, cap: usize) -> std::io::Result<RootFile>; }
-pub enum OverrideSource { Flag, Env }
-pub struct PolicyOverrides { pub bypass: bool, pub min_severity: Option<(Option<u8>, OverrideSource)> } // (None, _) = "none"
-pub struct PolicyWarning { pub code: &'static str, pub detail: String }
-pub struct Root<'a> { pub rel_dir: &'a str, pub markers: &'a [String], pub explicit: bool }
-impl SelectionPolicy {
-    pub fn unrestricted() -> Self;                          // built-in default ignores only
-    pub fn load(fs: &dyn PolicyFs, o: &PolicyOverrides) -> Result<(Self, Vec<PolicyWarning>), PolicyError>;
-    pub fn source(&self) -> &PolicySource;
-    pub fn enabled(&self) -> bool;
-    pub fn admits_root(&self, root: &Root) -> Result<(), FilterReason>;
-    pub fn admits_purl(&self, purl: &str) -> Result<(), FilterReason>;        // ecosystem + packages
-    pub fn admits_severity(&self, severity_order: u8) -> Result<(), FilterReason>;
-    pub fn max_new_patches(&self) -> Option<u32>;  // the file's value; None when source() is None or Bypassed, or the key is absent
-}
-pub fn package_spec_matches(spec: &str, purl: &str) -> bool; // moved from cli scan/mod.rs:383
-pub fn find_repo_root(cwd: &Path) -> PathBuf;                // 4.5
-pub fn repo_relative(repo_root: &Path, dir: &Path) -> String; // "" for the repo root, `/` separators
-
-// crates/socket-patch-core/src/policy/mod.rs — OWNER A (the step 5 → 7 seam)
-pub struct Offers {
-    pub unfiltered: BTreeMap<String, Vec<PatchSearchResult>>, // purl → every offer (after tier)
-    pub selected: BTreeMap<String, PatchSearchResult>,        // purl → winner among floor-admitted offers
-}
-
-// crates/socket-patch-core/src/rollout.rs — OWNER B
-pub enum Recorded { None, Same, Kept { uuid: String }, Superseded { old_uuid: String } }
-pub struct Candidate {
-    pub project: String, pub purl: String, pub base_purl: String, pub uuid: String,
-    pub ecosystem: &'static str, pub severity_order: u8, pub advisory_count: usize,
-    pub recorded: Recorded, pub eligible: bool, pub in_flight: bool,
-}
-pub enum MaxNewSource { Flag, Env, File, Default, Cap }
-pub struct MaxNew { pub value: Option<u32>, pub source: MaxNewSource }
-pub fn resolve_max_new(flag: Option<Option<u32>>, env: Option<Option<u32>>,
-                       file: Option<u32>, cap: Option<u32>) -> MaxNew;
-pub fn canonical_base_purl(purl: &str) -> String;
-pub fn rollout_cmp(a: &Candidate, b: &Candidate) -> std::cmp::Ordering;
-pub struct RolloutCounts { pub new: u32, pub deferred: u32, pub upgrade: u32, pub already: u32 }
-pub struct RolloutPlan {
-    pub admitted: Vec<Candidate>, pub deferred: Vec<(Candidate, u32)>,
-    pub counts: RolloutCounts,
-    pub remaining: Option<u32>,                       // carried to the next directory
-    pub admitted_base_purls: BTreeSet<String>,        // carried too
-}
-// Rows whose base_purl is in `already_admitted` are admitted without spending budget.
-pub fn plan_rollout(candidates: Vec<Candidate>, max_new: &MaxNew, incomplete: bool,
-                    already_admitted: &BTreeSet<String>) -> RolloutPlan; // pure
-
-// crates/socket-patch-core/src/api/ranking.rs — OWNER B (addition)
-pub fn search_result_supersedes(candidate: &PatchSearchResult, recorded: &PatchSearchResult) -> bool;
-```
-
-Rules both items follow:
-- Severity input is always `max_severity_order` over the by-package
-  record's `vulnerabilities`, never `RankKey.severity`, never the batch
-  list.
-- Skip-reason strings are the stable codes in 4.7 and 5.5; warnings go to
-  scan's top-level `warnings[]`.
-- JSON: A owns the top-level `policy` block; B owns the top-level
-  `rollout` block. Neither edits the other's.
-- CLI args: A adds a `#[command(flatten)]` `SocketYmlArgs`
-  (`--no-socket-yml`, `--min-severity`) in `scan/socket_yml_args.rs`; B
-  adds a flattened `RolloutArgs` (`--max-new-patches`) in
-  `scan/rollout_args.rs`. Both derive `Default`; each adds its field to
-  the ~18 `ScanArgs` struct literals. B resolves the adjacent-line
-  conflicts on rebase.
-- `run_project_dirs` changes: A adds the per-directory `explicit` flag;
-  B adds the carried remaining budget. B resolves the overlap on rebase.
-
-### 9.1 Work item A — socket.yml loading and filtering
-
-Scope:
-- `crates/socket-patch-core/src/policy/{mod.rs, socket_yml.rs, paths.rs}`;
-  `pub mod policy;` in `crates/socket-patch-core/src/lib.rs`; move
-  `package_spec_matches` to core (the cli re-uses it).
-- Dependencies, exact-pinned in `Cargo.toml`: a maintained YAML 1.2 serde
-  crate that reports duplicate keys and can refuse aliases and bound depth
-  (e.g. `serde_norway`; prove each property with a test, pick another
-  crate otherwise), and `ignore` (for `Gitignore::matched`; the top-down
-  walk is ours). No other new deps.
-- Loader: lookup (4.5, incl. ceiling dirs and ownership), regular-file,
-  size and symlink confinement on the opened handle, exact-name match,
-  encoding, both-files rule, strict validation with key paths and
-  did-you-mean (4.4), `PolicyFs` for disk and memory.
-- Path matcher (4.3): marker-file subject, npm-`ignore` top-down
-  semantics, defaults + lists in order, `includePaths`, pattern hygiene;
-  golden fixture generated from npm `ignore` (commit the generator script
-  under `scripts/` and the fixture under `crates/socket-patch-core/tests/`).
-- Filters at the pipeline points in 9.0:
-  - disk: root filter in `project_dirs` / `run_project_dirs`
-    (`scan/mod.rs:1268-1320`, carrying `explicit`) and the agent project;
-    `admits_purl` next to `--package` (`scan/mod.rs:1490-1511`); severity
-    filter on by-package candidates before `select_patches`
-    (`discover_selected`, `scan/mod.rs:553`, and the human arm,
-    `mod.rs:2386-2402`); retained set computed from the recorded view and
-    excluded from writers.
-  - memory: full path policy in `selectHostedScanPaths`
-    (`hosted_memory/select.rs`), from the caller-supplied `policyFiles`
-    text (7.2, two-phase); the same root filter in the session before
-    `max_projects` (`hosted_memory/mod.rs:377`); `admits_purl` at
-    `hosted_memory/mod.rs:428-432`; severity filter before
-    `select_top_ranked`.
-- Move `test tests fixtures __fixtures__ testdata` out of
-  `EXCLUDED_ROOT_SEGMENTS` (`hosted_memory/roots.rs:56-67`) into the
-  built-in default ignores, and apply them to disk PATH-glob expansion.
-- `enabled: false` report-only path; `get`'s `policy_bypassed` warning;
-  `--global` ignores the file; PATHs outside the repo root → exit 2.
-- Flags: `--no-socket-yml`/`SOCKET_NO_SOCKET_YML`,
-  `--min-severity`/`SOCKET_MIN_SEVERITY` (`SocketYmlArgs`).
-- napi + hosted-bundle (7.2, A rows); `npm/index.d.ts` types.
-- JSON `policy` block (4.7), human policy line (naming suppressed
-  critical/high), error output with `errorCode`, warnings
-  `socket_yml_ignored_value`, `socket_yml_name_case`,
-  `socket_yml_repo_untrusted`, `patches_disabled`, `policy_bypassed`;
-  output string hygiene.
-
-Tests:
-- Unit (core, table-driven): every row of 4.4 in order; the npm-`ignore`
-  golden fixture (anchoring, bare names, trailing `/`, `!`, excluded
-  parents, case); marker rule (all markers ignored / any included);
-  defaults + negation; explicit vs discovered; package specs incl.
-  invalid ones; severity floor incl. unknown and `moderate`; both-files
-  equal / different / one invalid; lookup with `.git` dir, `.git` file,
-  none, `GIT_CEILING_DIRECTORIES`, foreign-owned `.git`; symlink inside
-  and outside, directory, FIFO; alias bomb; oversize; BOM, CRLF, UTF-16.
-- Parser contract: `tests/cli_parse_scan.rs` rows for both flags and env
-  vars (empty = unset, malformed = exit 2).
-- E2E (wiremock, `tests/in_process_scan.rs` style): hosted, vendored,
-  agent and `--dry-run` with a socket.yml filtering by path, ecosystem,
-  package and severity; invalid file → exit 1, `errorCode`, no bytes
-  changed; `--no-socket-yml`; narrowing after a patch is applied leaves the
-  pinned package byte-identical in all three modes (retained); a recorded
-  merged patch below a new floor is kept, not replaced; `--prune` universe
-  unchanged; PATH outside the repo → exit 2.
-- Parity: `tests/hosted_memory_parity.rs` gains a socket.yml fixture
-  (single-lockfile roots) where disk and memory filter the same roots and
-  packages; a memory test where the tree lists socket.yml but its content
-  is withheld → `policyError`; a memory test where
-  `ignorePaths: ["!/e2e/tests/"]` re-includes a default-ignored root, so
-  its lockfile is selected, fetched and patched as on disk.
-- This repo's own `socket.yml` keeps working (its `projectIgnorePaths`
-  now also excludes the fixtures from patching).
-
-Docs (A): `CLI_CONTRACT.md` (new "socket.yml patch policy" section:
-grammar, precedence, paths, lookup, validation, commands; flag + env rows;
-error codes; `policy` JSON block; the trust-boundary bullet gains the
-"narrow or pace" sentence), README (scan section: "Roll out gradually"
-with recipes R1-R4, R6), CHANGELOG `[Unreleased]` (Added: socket.yml
-patch policy; Changed (BREAKING): scan honors `projectIgnorePaths`,
-default test/fixture ignores on discovered roots, invalid socket.yml with
-a `patches` block fails scan).
-
-### 9.2 Work item B — limit, ordering, reporting
-
-Scope:
-- `crates/socket-patch-core/src/rollout.rs`; `pub mod rollout;` in
-  `crates/socket-patch-core/src/lib.rs`; `search_result_supersedes` in
-  `ranking.rs`, and `detect_updates` / `updates[]` switched to by-package
-  supersession; move the `detect_updates` call (today `scan/mod.rs:1912`,
-  on batch data) after `discover_selected` so it receives the by-package
-  offers.
-- Make `discover_selected` (`scan/mod.rs:553`) the single disk selection
-  point: route the human agent/vendored arm (`mod.rs:2386-2402`) through
-  it, and add the step-7 stage after it (classify its `Offers`, planning
-  pass, `plan_rollout`) yielding `{admitted, deferred}`, so hosted
-  (`run_redirect_selected`, `hosted.rs:1196`), vendored and agent writers
-  receive only the rows 9.0 step 8 allows (ALREADY with the recorded
-  uuid). `discover_selected`'s return type is A's `Offers`.
-- Classification from the merged recorded view (5.1); the planning pass
-  for eligibility (hosted: grants, purl/url, vlt preflight, symlink
-  refusals, rewriter planning; vendored: preflight; agent: partition);
-  fetch-all references; `rollout_reference_failed` and
-  `rollout_incomplete_lookup`; `plan_rollout`; the remaining budget
-  carried through `run_project_dirs` in sorted directory order.
-- In-memory engine (7.2, B rows): pin discovery and state-file reads,
-  collect → plan → apply, options and result fields, `npm/index.d.ts`,
-  hosted-bundle fields.
-- Flag: `--max-new-patches <N|none>`/`SOCKET_MAX_NEW_PATCHES`
-  (`RolloutArgs`); `resolve_max_new` including the file value from A
-  (9.3).
-- JSON `rollout` block (5.5), `redirect.skipped[]` mirror, human
-  "Rollout:" line and the Next-steps deferred line (hosted
-  `format_next_steps`, `hosted.rs:3457`, and the agent/vendored
-  summaries).
-
-Tests:
-- Unit (core): `rollout_cmp` total order (property test: every
-  permutation sorts the same); `plan_rollout` caps only eligible NEW,
-  counts base purls, one package across roots costs 1, 0 = no NEW, `none`
-  = unlimited, ineligible rows hold no slot, `incomplete` admits nothing
-  NEW, in-flight first, remaining budget; `resolve_max_new` precedence
-  table incl. cap on `none`; `canonical_base_purl` twins;
-  `search_result_supersedes` rungs.
-- E2E (wiremock): hosted, vendored, agent, `--dry-run`: 9 candidates with
-  `--max-new-patches 3` apply the 3 most severe; a rerun on the result
-  applies the next 3; a third run the last 3; a fourth changes nothing;
-  dry-run output equals the wet run's decisions; upgrades land regardless
-  of the cap; a withdrawn, a `bad_purl` and a vlt-withheld top-ranked
-  patch hold no slot; a failed detail lookup with a cap admits nothing
-  NEW; two PATH directories share one budget in sorted order; JSON
-  `rollout` and `redirect.skipped[]`; exit 0.
-- Parity: `hosted_memory_parity.rs` single-root cap fixture: disk and
-  memory admit and defer the same rows. Two-root fixture: assert memory's
-  run-wide order and disk's per-directory order separately (they differ by
-  design, 5.2). A memory rerun with pins (and with a committed
-  manifest / vendor state) lands the next N.
-- Parser contract rows for the flag and env var.
-
-Docs (B): `CLI_CONTRACT.md` (limit semantics: classification,
-eligibility, unit, budget scope, order, convergence, version-bump and
-twin notes, starvation and non-committing CI; flag + env rows; `rollout`
-block; `rollout_deferred`; warnings; `jq` recipe; "Which patch gets
-selected" gains the cross-package order and the by-package supersession
-change), README (recipe R5, `--max-new-patches`), CHANGELOG
-`[Unreleased]` Added (and Changed: `updates[]` uses by-package data).
-
-### 9.3 Integration (B, after rebasing on A)
-
-- Pass `policy.max_new_patches()` as the `file` layer of `resolve_max_new`.
-- Resolve the `ScanArgs` struct-literal and `run_project_dirs` conflicts.
-- Combined e2e: a socket.yml with `includePaths`, `minSeverity: high` and
-  `maxNewPatches: 2` over a two-root fixture, disk and memory, three runs to
-  convergence, asserting each engine's own budget scope (5.2);
-  `--no-socket-yml` drops the file's cap but keeps a flag cap.
-- Switch `Candidate.project` to A's `repo_relative` and consume A's
-  `Offers` (before A lands, B uses canonical `--cwd` as the repo root and
-  treats the selected offers as the unfiltered list).
-- If B is ready before A merges, B ships with the file layer passed as
-  `None` and wires it in a follow-up commit on its branch once A lands.
-
-### 9.4 Work item A: decisions made while building
-
-Gaps and contradictions A resolved with the smallest reasonable decision
-(each is also in A's PR description):
-
-1. **YAML crate.** `serde-saphyr` 1.3.0 (maintained, YAML 1.2), driven
-   through its re-exported event parser (`serde_saphyr::granit_parser`, no
-   extra dependency) into a small node tree. Aliases are never expanded, so
-   an alias bomb anywhere costs nothing, and anchors / aliases / merge keys /
-   custom tags are refused only inside `patches` and `projectIgnorePaths`
-   (an anchor in `issueRules` keeps working). Duplicate keys and the depth
-   bound are enforced while building the tree. `serde_norway` was not
-   picked: its libyaml core expands aliases with only a global repetition
-   limit and cannot refuse them per subtree. Unit tests prove each property.
-2. **Disk markers** are the in-memory engine's lock markers (plus the
-   Maven/NuGet markers disk scans support); manifests are not markers.
-   With `package.json` as a disk marker, `ignorePaths: ["**/package-lock.json"]`
-   would never exclude a disk root while excluding the same root in memory.
-3. **Whole-file errors.** YAML syntax, duplicate keys, a non-mapping top
-   level, depth and a second document are errors even without a `patches`
-   block (the file cannot be known not to have one). `patches: null` counts
-   as present for the version gate; a key under `patches` with no value is an
-   error, never "default".
-4. **`enabled: false`** reports recorded packages under `retained[]`
-   (`policy_disabled`) and every other candidate under `filtered[]`.
-5. **Floor vs recorded patch** (until B's `search_result_supersedes`): a
-   recorded package keeps its recorded patch when it outranks every
-   floor-admitted patch in the canonical ranking, or when nothing passes the
-   floor; otherwise the admitted winner is selected, exactly as without a
-   floor.
-6. **Retained packages** stay in the batch query (so `upgradeAvailable` can
-   be reported) but never reach selection or a writer.
-7. **PATH-glob matches under a default ignore** are still visited as roots
-   and root-filtered (one `purl: null` entry), so a recorded patch there is
-   reported as retained.
-8. **In-memory engine gaps until B lands its recorded view**: `retained[]`
-   is empty and the floor rule of item 5 cannot see recorded pins (filtered
-   packages' pins stay byte-identical regardless: the rewriters only touch
-   selected dependencies). A root named in `projectRoots` is explicit and
-   skips the defaults. There is no case-variant warning in memory
-   (selection reads exact names only). `ProjectResult.skipped[]` carries the post-lookup policy reasons
-   (severity, disabled); the pre-lookup ones are in the session `policy`
-   block only.
-9. **Session option `policyPaths`** (selection's list, handed back like
-   `projectRoots`) is how the session tells "listed but never sent" from
-   absent. Two-phase selection (7.2) names its outputs: selection returns
-   `policySha256` (`null` without a file) and the session takes it as an
-   option, since 7.2 does not say how the session learns what the
-   selector saw; a session that reads a policy file without it fails
-   closed. Selection also takes `noSocketYml` so both sides bypass
-   together; a bypassed session given a digest fails closed. A root the
-   selector excludes is reported in its `ignoredSample` with the
-   `policy_*` reason and never streamed (streaming its markers would count
-   every fixture lockfile against `maxFiles`), so in memory
-   `policy.filtered[]` lists only the roots the session received.
-10. **Env layer of `--min-severity`** is read by scan, not clap, so the
-    `policy` block can say `source: "env"`; a malformed env value exits 2 at
-    run time, a malformed flag at parse time.
-11. **README recipes**: R2-R4 and R6 ship without `maxNewPatches` lines (A
-    validates the key but does not enforce the cap); R1 and R5 come with B.
-12. **`get`'s `policy_bypassed`** is one warning per package; the severity
-    reason fires only when none of the package's patches passes the floor.
-13. **Repo-root trust** (review follow-up): root trusts every `.git` owner
-    and `SUDO_UID`'s user is trusted, so a root CI container over a checkout
-    owned by another uid still applies the policy (distrust would drop a
-    policy that only narrows). A `.git` symlink counts, as in git.
-14. **A disk root with no lockfile** uses its manifests as markers, so
-    `includePaths: ["/*", "!/*/"]` can match a lockfile-less repo root.
-15. **Top-level typos and merge keys fail closed**: a key within two edits
-    of `patches` starting `pat`/`pac`, and a top-level `<<` or aliased key,
-    are errors (another YAML reader could see a `patches` block there).
-16. **Report-only `--json`** fetches patch details only when a floor or
-    `enabled: false` could withhold something, so its `filtered[]` matches
-    the human output.
-17. **What the floor reports**: the top-ranked patch it withheld, when the
-    package ends up unpatched or held at its recorded patch; not when a
-    lower-ranked admitted patch wins. A kept recorded patch that is itself
-    below the floor is not a skip.
-
-## 10. Open questions (decided by default, revisit with evidence)
-
-- A separate upgrade cap (`maxUpgrades`) if server-side republishes rotate
-  too many pins at once. Default: none.
-- CVSS/EPSS/KEV or reachability as ordering keys once the patch API
-  exposes them; they would slot between severity and advisory count.
-- A generated JSON Schema for the `patches` block, shared with depscan and
-  the docs, to keep validators from drifting.
-- Recognizing a dependency version bump of an already-patched package as
-  exempt from the cap (needs state hosted mode does not keep).
-
-## 11. Implementation notes (work item B)
-
-Where the plan left a gap, work item B made the smallest decision that
-keeps its rules intact:
-
-- **`updates[]` without by-package data.** A `--json` report-only run
-  (`--prune` / `--global` with no mode) fetches no by-package records, so
-  its `updates[]` stays on the batch rungs (`batch_supersedes`). In every
-  other run `updates[]` is the UPGRADE rows, plus the batch-derived entry
-  for a package the by-package lookup returned no offer for (nothing was
-  selected there to disagree with).
-- **Report-only and empty scans** carry the `rollout` block with zero
-  counts: they plan nothing.
-- **Unrecognized hosted pins.** Discovery only treats URLs on
-  `patch.socket.dev` or a `--patch-server-url` origin as hosted pins. A
-  scan against another server without that flag would read every pin as
-  NEW and re-spend the same N slots forever. The hosted gate therefore
-  also counts a NEW row as ALREADY when a lockfile names its selected
-  uuid (uuids are unique; one linear scan per file).
-- **In-memory recorded view.** The engine has no disk discovery, so a
-  root's hosted pins are the offered uuids of each purl that its own
-  files mention (nested roots' files excluded), merged with the tree's
-  `.socket/manifest.json` (now selected by `selectHostedScanPaths`) and
-  `.socket/vendor/state.json` at the disk precedence. A pin to a patch
-  the API no longer offers reads as NEW: it costs one slot once, and the
-  next run sees the new pin.
-- **Option source.** The in-memory `maxNewPatches` option reports
-  `source: "flag"` (it is the caller's explicit layer); `maxNewPatchesCap`
-  reports `cap` when it tightens the value.
-- **Key 6 across a base purl's rows.** Rows are sorted with
-  `rollout_cmp` and a base purl takes the rank of its first row, which is
-  the "minimum key over its rows" of 5.2; the uuid key only orders rows of
-  one base purl, which are admitted or deferred together.
-- **Reference failures.** On disk the reference lookup is one call; when
-  it fails in a capped run whose rows are all NEW, the rows are deferred
-  with `rollout_reference_failed` and `rollout_incomplete_lookup` instead
-  of failing the run. In memory the same rule applies per root.
-- **Human output.** The `Rollout:` line prints only when a cap is set.
-  Hosted mode appends the deferred lines to its existing next steps;
-  agent and vendored mode print them under a `Next steps:` heading.
-- **Lock.** A wet hosted run whose only candidates are NEW rows it cannot
-  admit (budget 0, or incomplete data) takes no apply lock and writes
-  nothing, `.socket/` included.
-- **Folding.** `canonical_base_purl` is discovery's, so a nuget or
-  composer pin (lowercased) and a pypi pin (PEP 503 name) match the API's
-  spelling, and a package in two spellings is one budget unit. Every hosted
-  pin joins the recorded index, not just the first per key, so both pinned
-  qualifier twins read ALREADY.
-- **Flag over env.** An explicit `--max-new-patches` wins without parsing
-  `SOCKET_MAX_NEW_PATCHES`; whitespace-only env values are unset.
-- **Known limits.** (1) In memory, the symlink / unreadable-file refusals
-  run inside the first rewrite, before the plan, so a candidate file that
-  only a deferred NEW row would rewrite still refuses its root (disk runs
-  its symlink guard after the gate). (2) On disk, a project directory that
-  fails outright spends nothing and does not freeze later directories. (3)
-  A NEW row that `mark_pinned` turns ALREADY in a run that could admit no
-  NEW row takes the apply lock only after its files were read. (4) Memory
-  pin evidence is any fetched text file of the root; disk's is its
-  discovery plus the candidate files. (5) No e2e case covers a
-  vlt-withheld top-ranked row; it takes the same ineligible path as the
-  withdrawn and `bad_purl` rows the e2e tests cover.
-- **socket.yml layer.** B resolves the cap as flag > env > file >
-  unlimited through `resolve_max_new`; the file value is A's
-  `SelectionPolicy::max_new_patches()` (none when bypassed). The rollout
-  classifies what A's selection keeps: a retained package is neither NEW
-  nor an UPGRADE, and a severity floor removes a NEW row before it can
-  take a slot (9.3). The in-memory engine resolves the cap after the
-  session's socket.yml loads; a session that fails on it has no
-  `rollout` block.
diff --git a/docs/design/v5-plan.md b/docs/design/v5-plan.md
deleted file mode 100644
index 9a516aa1..00000000
--- a/docs/design/v5-plan.md
+++ /dev/null
@@ -1,227 +0,0 @@
-# v5 plan (branch `release/v5-prerelease`, PR #277)
-
-Decided 2026-09-27 by the project owner. Each workstream is its own branch
-cut from `release/v5-prerelease` and its own PR back into it. Signed commits,
-explicit push refspecs (`git push origin HEAD:refs/heads/<branch>`), never
-push to `main`.
-
-Supporting analysis (session reports, summarized here): stale-doc audit
-(567 findings, fixed), complexity-vs-value inventory, duplicated-code map,
-patch-UI review.
-
-## Product decisions
-
-- **Workflow:** `scan` (hosted, default, no prompts) → `vex` → `vendor`
-  (eject to `.socket/vendor/` for offline) + `list`. `get` defaults to hosted
-  too (done).
-- **vlt stays** in every mode (hosted, vendored, agent). Not a cut candidate.
-- **Every package-manager version we support stays** (pnpm 1–10 incl. 7/8
-  vendored, bun.lockb, yarn classic + berry, pipenv/pdm/poetry/hatch/uv,
-  bundler eras, …). Version support is not negotiable.
-- **Agent mode** is deprecated over time but stays in v5. **`setup` is
-  removed in v5** (install hooks: npm postinstall, the pypi `.pth` hook
-  wheel, the Bundler plugin gem, Composer). `apply` stays (users wire it
-  into CI themselves).
-- **Hosted ledger (`.socket/vendor/redirect-state.json`) is removed.**
-  `scan`/`get` hosted write only lockfile edits. Rollback of hosted wiring
-  no longer replays recorded fragments.
-- **In-place vendored ledger re-synthesis in `repair` is cut**; repair
-  re-downloads artifacts from the remote instead (see WS5 caveat).
-- **Future work (not v5):** a better vendored story for Maven and NuGet
-  (vendored Maven refuses multi-module/Gradle; NuGet feed is fragile).
-  Keep the current behavior; do not invest further now.
-
-## Workstreams (ordered; WS1–WS3 unblock the rest)
-
-### WS1 — Ledger-free hosted mode + new rollback  *(branch `v5/ledger-free-hosted`)*
-- Start from local WIP `wip/v5-ledger-free-hosted` (6426bd68: scan stops
-  writing the ledger; broke ~230 hosted round-trip tests).
-- Hosted rollback/remove: for each hosted pin discovered from lockfiles
-  (`vex::discover` refs), restore the **default upstream** entry: re-resolve
-  the registry artifact for `name@version` (npm registry tarball + integrity,
-  PyPI JSON, crates index, rubygems, packagist, proxy.golang.org, maven
-  central, nuget v3) and rewrite the lock entry with the same per-format
-  writer used for hosted (WS3 LockModel). Where that is impossible
-  (formats with non-derivable fields, offline), refuse with a clear
-  `git checkout -- <lockfile>` remedy. No fragment replay.
-- Keep *reading* a legacy `redirect-state.json` only for migration (list/vex
-  may show its records; rollback may delete it). Never write it.
-- vex/list/vendor/scan-updates derive hosted state from lockfiles only.
-- Rewrite the ~230 affected tests to the new contract; update
-  CLI_CONTRACT/README/CHANGELOG.
-
-### WS2 — `vendor` ejects hosted projects  *(branch `v5/vendor-eject`)*
-- Standalone `vendor` today no-ops without `.socket/manifest.json`
-  (vendor.rs ~672). New behavior: with no manifest, take the patch set from
-  the hosted pins in the lockfiles (uuid in the hosted URL), fetch records
-  from the API, vendor each into `.socket/vendor/`, and rewire the lock
-  from hosted → vendored (reuse `scan --mode vendored` takeover path, or
-  WS1's upstream-restore + vendored rewrite).
-- `vendor --revert` → back to upstream (WS1 mechanism), not hosted.
-- `lib.rs` after_help line "socket-patch vendor  Eject…" becomes true;
-  README tutorial/“Work offline” switch back to `socket-patch vendor`.
-
-### WS3 — One lockfile model per ecosystem  *(branch `v5/lock-models`)*
-- Today pnpm-lock.yaml has 7 readers (redirect/mod.rs pnpm, vendor/pnpm_lock,
-  pnpm_lock_legacy, lock_inventory/pnpm, lock_inventory/wired+recover,
-  get.rs:1511 heuristic, repair_vendor scan_vendor_references); cargo 3
-  grammars (redirect/mod.rs:1059–3261, vendor/cargo_lock+cargo_manifest,
-  takeover.rs); gem 2; composer 3; yarn/bun partially shared.
-- Target: `core/formats/<fmt>` per lock format, parse once, exposing
-  `entries()` (inventory), `wired_refs()` (vex discover + repair),
-  `plan_hosted()`, `plan_vendored()`, `restore_upstream()` (WS1), `in_use()`.
-  Follow the `utils/python_lock.rs` pattern (already shared by disk + memory).
-- One PR per family: pnpm (incl. legacy — support must stay) → cargo → gem →
-  composer → yarn/bun/npm/vlt → go/maven/nuget.
-- Gate: redirect golden fixtures (shared with depscan TS), the
-  `*_equivalence_tests`, vex discover goldens, lock_inventory tests,
-  byte-exact CRLF output.
-- Also unify the 4 "which files carry wiring" lists into `formats::registry()`.
-
-### WS4 — One hosted engine, disk + memory  *(branch `v5/one-hosted-engine`)*
-- Both functions stay: disk `scan/get --mode hosted` and the in-memory
-  engine (`hosted_memory/`, used by `socket-patch-node` and `hosted-bundle`).
-- Extract plan → rewrite → edits from `run_redirect_selected`
-  (scan/hosted.rs:1205–3358, 2.1k LOC) into a pure core function over
-  `ProjectView`; `hosted_memory` calls it (delete its redirect.rs/ledger.rs
-  copies, ~2.5k LOC); disk keeps only lock, probes, symlink guard, commit.
-  Move the engine to core so `socket-patch-node` stops depending on the CLI
-  crate. Keep `hosted_memory_parity` green until the final commit.
-- Depends on WS1 (no ledger delta to merge) and benefits from WS3.
-
-### WS5 — Consolidate vendored apply/revert wrappers + cut ledger rebuild  *(branch `v5/vendor-backend`)*
-- Apply wrappers (4): `vendor.rs run/run_vendor`, `scan/vendor_flow.rs`
-  (json/interactive/preview/legacy + 7 `boxed_*` shims), `get.rs
-  run_get_vendored`, `repair_vendor.rs` (1.2k-LOC fn). Revert wrappers (3):
-  `vendor.rs run_revert`, `rollback.rs run_vendored_leg`, `remove.rs
-  revert_vendored_matches`. → one `VendoredBackend { apply, revert, repair }`.
-- Cut `repair`'s vendored-ledger re-synthesis from lockfiles; repair
-  re-downloads missing/corrupt artifacts from the vendoring service/remote.
-- **Caveat to verify first:** the local rebuild path (`vendor/npm_pack.rs`,
-  `pypi_wheel.rs`, `berry_zip.rs`, `registry_fetch.rs`, `prestage.rs`) may be
-  what depscan's server-side vendoring uses via the CLI for packing. Check
-  `../depscan` (grep for `socket-patch`, `vendor-source`, `npm_pack`,
-  `hosted-bundle`, napi usage) before deleting anything; if used, keep it as
-  a library path.
-- **Depscan check (done 2026-09-27 against SocketDev/depscan master 784013d6;
-  re-verified from a fresh clone by the WS5 routine — no spawn/exec of
-  the CLI, no Cargo/napi dependency on socket-patch crates):**
-  depscan does **not** use the CLI's local rebuild/pack path.
-  - Server-side prebuilt packages (what patch.socket.dev and the CLI's
-    `--vendor-source service|auto` download) are built by depscan's own
-    TypeScript **patch-package-converter** (`workspaces/patches/src/repack/`:
-    per-ecosystem repackers, upstream downloaders, `berry-cache-zip.ts` — a
-    TS port of `berry_zip.rs`, not a call into it). It re-downloads the
-    upstream archive, verifies `before_sha` + the registry digest, applies
-    the patched bytes and repacks. No spawn/exec of `socket-patch`, no napi.
-  - The `socket-patch` binary appears in depscan only as: the
-    `submodules/socket-patch` build for the autotester image and dev tools
-    (`tools/validate-patch.ts`, `tools/patch-mode-smoke.ts`) — both drive
-    `apply`/`scan`; `pnpm dlx @socketsecurity/socket-patch apply` postinstall
-    snippets; the `@socketsecurity/socket-patch/schema` manifest-schema
-    re-export; and the api-v0 e2e suites (`89`–`94_socket-patch-vendor-*`,
-    `82_…telemetry-coverage` runs `repair` on an empty manifest) that drive
-    the real CLI against the live API. `hosted-bundle`, `vendor-source`,
-    `npm_pack` and `socket-patch-node` have no production references.
-  - Consequence: `npm_pack.rs`, `pypi_wheel.rs`, `berry_zip.rs`,
-    `registry_fetch.rs`, `prestage.rs` are **CLI-internal**. They stay for
-    now anyway: they are the CLI's own `--vendor-source build` / `auto`
-    fallback (offline and service-outage vendoring) and `prestage.rs` +
-    `registry_fetch::artifact_matches_integrity` also serve the service
-    path. Dropping the local build is a separate product decision (it
-    would make vendoring service-only), not part of WS5.
-  - Side note for WS1: `workspaces/app/src/autopatch-pr/github-patch-pr-hosted.ts`
-    still writes `.socket/vendor/redirect-state.json` into hosted PRs so a
-    post-install `socket-patch vex` can attest them; WS1's "never write the
-    ledger" needs a depscan follow-up (or vex keeps reading it).
-- **Done in WS5:** `commands/vendored_backend.rs` owns `VendoredBackend {
-  apply, revert, repair }`. `vendor`, `scan --mode vendored` (JSON and
-  interactive arms) and `get --mode vendored` all go through `apply`
-  (in-memory staging → `vendor_records_reusing` → per-package ledger
-  persist); `vendor --revert`, `rollback`'s vendored leg and both of
-  `remove`'s paths go through `revert`; `repair` goes through `repair`,
-  which health-checks ledger entries and re-vendors broken ones through the
-  same `apply` engine (patch.socket.dev prebuilt first under the default
-  `--vendor-source auto`, local build as the fallback). Lockfile references
-  with no ledger entry are reported (`vendor_ledger_missing`, an
-  artifact-level event with `uuid` + `details.{ecosystem,path}`), never
-  re-synthesized. Cut with it: the gem Gemfile wiring reconstruction and
-  empty-wiring backfill, the unverified npm "rebuild to the wired
-  integrity" rung (`registry_fetch::fetch_npm_unverified`), soft
-  fingerprint-less restores, and `details.ledgerRestored`.
-- **Behavior notes (WS5):** repair now inherits `vendor`'s pristine-source
-  ladder and messages, so (a) a drifted installed copy of a release-variant
-  ecosystem (gem/pypi) fails the installed-variant probe and is reported as
-  `vendor_artifact_unrepairable` ("no installed package found on disk")
-  instead of being force-overwritten; (b) the old ledger-recovery detail
-  strings are replaced by the engine's. The carried-inventory refresh
-  (`vendor_inventory_refreshed`) and fingerprint post-verify are kept.
-
-### WS6 — Unified ledgers/context  *(branch `v5/project-context`)*
-- After WS1 only two stores remain (manifest for agent mode, vendor
-  `state.json`). One `Ledgers` view with one owner-precedence rule replaces
-  the 7 merge implementations (list combined_entries, fold_vendor_records,
-  scan merge_ledger_records_for_updates, vex_sources plan/build_candidates,
-  classify_overlap_takeover, rollback, remove) and the 61 load sites.
-- `ProjectContext` (crawl snapshot, lock set, ledgers; lazy) shared by
-  scan/vendor/vex/list/get; `get` reuses scan's discovery instead of
-  get.rs:1583.
-
-### WS7 — Remove `setup`  *(branch `v5/remove-setup`)*
-- Delete the `setup` subcommand, core/setup/**, package_json/** helpers only
-  setup uses, the setup-matrix CI job, and the Bundler plugin gem +
-  `socket-patch-hook` wheel publishing. Keep `apply`.
-  Docs: agent mode = `scan --mode agent` + `socket-patch apply` in CI.
-- **Status (branch `v5/remove-setup-and-ui`):** subcommand, core `setup/` +
-  `package_json/`, setup tests, `setup-e2e` feature, setup-matrix CI job,
-  `tests/setup_matrix/`, `scripts/setup-matrix.sh` and the setup-only
-  `Dockerfile.gem-b1`/`gem-b4` are deleted. vex's "Property 7" filter went
-  with it (agent patches attest on verification; `setup.manual` is parsed
-  but ignored). The v5 distribution cleanup removes the PyPI and RubyGems
-  CLI packages and both hook packages, including their sources, tests,
-  publishing workflows, wheel builder, and version-sync entries. The
-  supported distributions are the standalone binary via `install.socket.dev`
-  (preferred), Cargo crates, and npm (required by the official Socket CLI).
-  Previously published package versions remain available for older users.
-
-### WS8 — Patch UI streamlining  *(branch `v5/ui`)*
-- `-h` shows ~8 options (hide_short_help for the rest); hide deprecated
-  `--apply/--vendor`; one-line npm allow-remote note; no `(code)` tags in
-  human warnings; "hosted" not "redirect" in human text; one shared
-  Next-steps renderer; hosted/vendored `get` without prompts; `list` without
-  manifest says "No patches in this project"; unify cancel/upsell strings;
-  exit 2 for all usage errors; scan/get JSON onto `json_envelope`.
-- Full item list: 22 findings from the UI review (sizes S/M/L, contract flags).
-- **Status (branch `v5/remove-setup-and-ui`):** done — short `-h`
-  (`cli_command()` hides the rest; `--help` unchanged), hidden
-  `scan --apply/--vendor`, one-line npm allow-remote note (`--verbose`/JSON
-  keep the detail), code-free `Warning:`/`GC: skipped:` lines (error lines keep their code),
-  "hosted" wording in human text, `ui::next_steps` shared by hosted and
-  vendored, prompt-free hosted/vendored `get` (JSON too), `list`'s
-  `No patches in this project.` line (exit 0, empty success envelope in JSON; was 1 missing,
-  0 empty), `ui::CANCELLED` / `ui::PAID_UPGRADE`, exit 2 for `get` and
-  `rollback --one-off` usage errors. **Not done:** scan/get JSON onto
-  `json_envelope` (larger contract change; deferred). Per-row
-  `[error] <purl> (<code>)` / `[would-refuse]` lines keep their codes
-  (grep-able under `--silent`).
-
-### WS9 — Staged patch rollout  *(branches `v5/rollout-policy` (A), `v5/rollout-limit` (B))*
-- Added 2026-09-28 at the owner's request. `socket.yml` `patches:` policy
-  (paths, ecosystems, packages, severity floor, enabled) read by `scan`
-  and the in-memory engine, plus `scan --max-new-patches` (severity-ordered
-  per-run cap on new patches). Full plan and the two work-item specs:
-  `docs/design/staged-rollout.md`. Merge order A then B.
-
-## Remaining small follow-ups
-*(All done on `v5/remove-setup-and-ui`: the vacuous rows are dropped,
-GEM_PATCHES has both patches, `tool_command` and the deprecated aliases —
-plus the CI grep that guarded them — are removed, and the backtest label is
-retired.)*
-- ci.yml `e2e_cargo`/`e2e_golang` rows select `--ignored` but have no ignored
-  tests (vacuous legs) → give them `--include-ignored` or drop the rows.
-- `e2e_vendored_production` GEM_PATCHES lacks merged `01019627` (v5 ranking
-  picks it) and `9c2b4925`.
-- `utils::process::tool_command` has no prod callers.
-- Deprecated re-export aliases in core (`patch/mod.rs`, `lib.rs`,
-  `utils/mod.rs`) — drop in v5.
-- `scripts/backtest-poetry.py:541` "known crawler gap" label.
diff --git a/docs/design/v5-waste-review.md b/docs/design/v5-waste-review.md
deleted file mode 100644
index 1d1f89c4..00000000
--- a/docs/design/v5-waste-review.md
+++ /dev/null
@@ -1,360 +0,0 @@
-# v5 waste review: socket-patch + depscan patch system
-
-> Reference copy of PR #286, which was closed without merging. Each
-> finding's owner (workstream, in-flight PR or owner decision) is in
-> the [triage map](https://github.com/SocketDev/socket-patch/pull/286#issuecomment-5869109317).
-
-Scope: socket-patch at `release/v5-prerelease` (8ae7dc37; in-flight branches
-#279–#283 and `v5/integration` f8b8d80a where noted) and depscan `master`
-(repack in `workspaces/patches/src/repack`, serving in
-`workspaces/patches/src/services/patch-serving` and
-`workspaces/patches-api-proxy/src/server.ts`, api-v0 endpoints). Respects the
-owner decisions in [v5-plan.md](v5-plan.md): vlt stays, every PM version
-stays, `setup` goes, hosted ledger goes, maven/nuget vendoring is frozen, and
-WS5 (#283) keeps the local rebuild. Nothing here proposes dropping vlt or any
-PM version; CI tiering only moves legs between PR, main push and nightly.
-
-Companion: [repacking-to-depscan.md](repacking-to-depscan.md) (what each repo
-builds and what moving the rest of repacking to depscan would take).
-
-## Summary
-
-**Method.** Both repos were inventoried: the CLI's local rebuild, the
-per-ecosystem builders, hosted/napi, depscan repack, depscan's use of the
-CLI, CI and test cost, and churn and bug history. Findings were swept over 9
-dimensions: cross-repo duplication, intra-repo duplication, dead code, test
-overlap, CI matrix, redundant network, repacking, expensive abstractions, and
-high-cost/low-value features. A gap review then covered the diff channel,
-the upstream fetchers vs the CLI pristine ladder, signing, fallback-rate
-observability, patches-harness-contract, patch-publication, the cost of the
-in-flight PRs, and the depscan bump break list. Each finding was
-independently re-verified on three criteria: facts (re-measure every
-claim), value (is it really waste, and does it conflict with owner
-decisions?) and savings (≥150 LOC or ≥2 CI job-min/run). A finding was kept
-when at least two held. Verified numbers replace the initial estimates.
-
-**Counts.** 85 raw findings were de-duplicated to 75, and the gap round
-added 31 (106 reviewed). 80 were kept and 26 dropped. Of the 80 kept, 69 are
-waste (ranked below) and 11 are measurements or checks that found no waste.
-
-**Top line (net new, after de-duplicating against v5-plan WS1–WS8 and PRs
-#279–#283):**
-- Actionable now: about **32.8k lines**: 9.1k code, 14.9k test, and 8.8k of
-  docs and workflow YAML.
-- Gated on a precondition or owner decision: a further **15.7k lines** (6.3k
-  code, 9.4k test). 10.5k of that is the depscan TS rewriter twin (F01).
-- CI: about **478 job-min per socket-patch `ci.yml` PR run**, or 438 on a
-  main push, against a 945 job-min main-push run. Add about 95 job-min
-  across the compatibility workflows per PR push that triggers them (F55 65
-  pdm, F57 12 npm/pnpm, F56 ≈10 vlt, F54 8 pdm Windows; pdm-compat alone
-  ≈73), and about 9.5 per depscan api-v0 CI run (roughly 130 runs a day).
-- The biggest single lever is build-once fan-out for the e2e matrix (F51,
-  280 job-min per run). The biggest code/test levers are the #257
-  equivalence oracles (F03, 6.5k), the depscan TS rewriter twin (F01, 10.5k,
-  gated) and depscan's stale refactor docs (F02, 8.2k lines).
-- Precondition for reading any v5 CI: the base branch is red on one
-  assertion (F77), so the e2e tier has not run on any v5 PR.
-
-## Ranked findings
-
-Rank is verified savings × confidence (3/3 upheld over 2/3) × low risk.
-Runtime-only findings (0 LOC, 0 CI) rank by avoided work per run. `sp` means
-socket-patch, `ds` means depscan. LOC is verified lines removed (src + test,
-or YAML/docs where noted). CI is job-min per run of the named workflow. "⊂
-Fnn" means the figure is contained in another finding and is not counted
-again.
-
-| # | id | finding | repo | category | evidence | verified LOC | CI min/run | risk | already planned? | recommendation |
-|---|----|---------|------|----------|----------|-------------:|-----------:|------|------------------|----------------|
-| 1 | F51 | e2e matrix recompiles the CLI and its test binary in each of 176 legs | sp | ci-matrix | .github/workflows/ci.yml:1098,1355; run 36359489402: 176 legs = 530 job-min, 2m06s compile vs 0.03s test | 0 | 280 | L | no | Per-OS `e2e-build` job (`cargo test --no-run --message-format=json`), upload the binaries, legs run the downloaded suite; pattern at vlt-compatibility.yml:143-187. Restore the CARGO_BIN_EXE path or add an override. Every leg and PM version stays. |
-| 2 | F03 | ~7.5k LOC of test-only "verbatim previous implementation" oracles from #257 | sp | test-overlap | crates/socket-patch-core/src/crawlers/*/oracle.rs (2,680); crates/socket-patch-core/src/patch/redirect/pnpm_equivalence_tests.rs:1-7; xorshift constant in 23 files | 6,500 | 0.5 | L-M | no (WS3 names them as a gate) | Snapshot the generated inputs into the redirect goldens first, keep one shared test RNG, delete the crawler oracles plus their inline `mod equivalence` blocks now, and delete each rewriter oracle in its WS3 family PR. |
-| 3 | F02 | depscan patches/docs/refactor: 9.4k lines; 61% of cited paths no longer exist | ds | dead-code (docs) | depscan:workspaces/patches/docs/refactor (37 files, 9,398 lines; 181/297 paths missing; README.md:3 "temporary") | 8,222 docs | 0 | none | no | Delete everything except DAG/ (1,176 lines, backfill still active); reword the dag-lift comments that cite missing files. |
-| 4 | F41 | e2e-docker is a strict subset of coverage-docker | sp | test-overlap | ci.yml:1390 vs :455; 9 legs 65.1 vs 89.2 job-min; bind-mount at crates/socket-patch-cli/tests/docker_e2e_cargo.rs:34-49 | 65 YAML | 65 | L | no | Drop per-push e2e-docker, or run it nightly as the check of the full-LTO release binary (it is the only per-push run of that binary). |
-| 5 | F04 | covgap_/coverage_fix_/in_process_ categories no longer mean anything; one command's tests span up to 16 binaries | sp | test-overlap | crates/socket-patch-cli/tests: covgap_* 25 files/27.6k LOC, in_process_* 38/34.3k; get_modes_e2e.rs:465 covers in_process_get_modes.rs:649 | 4,000 | ⊂ F58 | L-M | partial (WS7 deletes covgap_setup*, excluded) | When WS5/WS8 touch a command, merge its files into one suite (in-process + subprocess modules) and delete sampled duplicates. Stop adding covgap_* files. |
-| 6 | F53 | Dockerfile.base release build rebuilt with no cache 27× per run; binary unused in coverage-docker | sp | ci-matrix | ci.yml:518,1421,1662; 121.5 job-min of base builds (12.9% of run) | 0 | 68 (≈35 after F41) | L | partial (setup-matrix share = WS7, excluded) | Build once, then `docker save`/load or ghcr (gha cache is unusable with `driver: docker`, ci.yml:486-494). Keep a binary for the Dockerfile.gem/deno build-time `--version` checks. |
-| 7 | F55 | pdm capstone recompiles e2e_vex_build in 30 legs and repeats 7 ci.yml rows | sp | ci-matrix | pdm-compatibility.yml:151-182; run 36363939533 capstone 30 legs/91 job-min, 2m03s compile vs 9.5s tests | 0 | 65 (per pdm-compat run) | L | no | `needs: build` plus a `--no-run` test-binary artifact. Exclude the 7 cells ci.yml gates, guarded by a leg-checker like scripts/tests/test_ci_vlt_rows.py. Every PDM version stays. |
-| 8 | F52 | Tier PM-version legs: boundaries on PRs, every version on main push/nightly | sp | ci-matrix | ci.yml e2e include: 176 rows, 155 version-keyed, 78 ubuntu middle rows; no `schedule` trigger (ci.yml:3-16) | 0 | ≈90 PR (≈40 after F51) | M | no | Mark middle rows `tier: full` and skip them on `pull_request`; keep them on main push, nightly and dispatch. Keep the boundary versions named in ci.yml comments on PRs. Most of the 78 middle rows are such named boundaries (bundler, pdm, hatch, vlt eras, uv 0.5.4/0.5.5, poetry lock formats, maven); about 33 carry none, so ≈90 standalone (33 × 2.75). The recorded 140 holds only if all 78 move. |
-| 9 | F06 | depscan legacy/ hosts the live admin package-detail engine; it blocks the 2026-11-04 table drop | ds | dead-code | depscan:workspaces/patches/src/legacy/fetch-autopatch-package-status.ts (3,093; 68 commits); depscan:workspaces/patches/src/api/commands/review/upgrade-risk.ts:14,181-207 | 3,000 (incl. F19) | 0 | M | partial (depscan legacy/README.md:30-31) | Before 2026-11-04: make the upgrade-risk lookup one query, give detail a version-scoped path, port the admin page to the read-models, then delete the engine, poc-result.ts, queue-driven-suites.ts and their tests. |
-| 10 | F01 | GitHub-app hosted PR flow keeps a ~6k-LOC TS port of the Rust rewriter; the napi engine has 0 consumers | both | cross-repo-dup | depscan:workspaces/app/src/patches/registry-rewrite (5,978 src + 5,582 test); depscan:workspaces/app/src/autopatch-pr/github-patch-pr-hosted.ts:63,308,494; depscan 9752b91237 (cargo drift) | 10,500 (gated) | 1 | M-H | partial (WS4 keeps napi; no depscan adoption plan) | After bumps past WS1 and WS4, call the Rust engine (socket-patch-node or `hosted-bundle` subprocess) and delete the TS rewriters. Freeze the TS port until then. The 141 goldens gate byte-identity. |
-| 11 | F47 | cargo-vex 17-leg cross recompiles every leg; repeats e2e_safety_cargo_build | sp | ci-matrix | ci.yml:1531-1577 (18 legs/48.2 job-min); e2e safety rows 11.1 job-min; lock knob headline-only at crates/socket-patch-cli/tests/e2e_safety_cargo_build.rs:326 | 10 YAML | 30 (≈23 after F51) | L-M | no | Drop the 3 e2e_safety rows from the e2e matrix. Run a pairwise toolchain×lock subset on PRs and the full cross on main/nightly. Build once per OS. |
-| 12 | F11 | depscan break list for the #279 bump: 30 loud setup e2e failures | both | cross-repo-dup | depscan:workspaces/api-v0/e2e-tests/tests/59_socket-patch-setup.js (1,344; 27 setup calls), 82_socket-patch-telemetry-coverage.js:229-262, 65_patch-telemetry.js:478-502 | 1,380 | 2 | L | partial (WS7 covers only the CLI side) | In the depscan bump past #279, delete 59_socket-patch-setup.js (the apply edge cases at :812-1114 also run `setup --yes`; move only the bun `--help` subtest at :1170 elsewhere if it is wanted) and the 82 setup case at :229-262. Retire 65's patch_setup case after an owner check. |
-| 13 | F09 | Python lock family missing from WS3's PR order; 4–5 readers per format | sp | intra-dup | v5-plan.md:75-76; check_target_guards ×4 at crates/socket-patch-core/src/vendor/pypi_poetry.rs:207, pypi_uv.rs:312, pypi_pdm.rs:184, pypi_pipenv.rs:162; utils/pdm_lock.rs:129 = utils/poetry_lock.rs:105 | 1,600 | 0 | M | extends WS3 | Add a Python PR to WS3 (formats/{poetry,pdm,pipfile,pylock_uv,requirements} on utils/python_lock). One generic guard with one documented fork rule. |
-| 14 | F12 | 8 npm-family vendored backends repeat one vendor/revert skeleton; pnpm vs pnpm-legacy clone survives #281 | sp | intra-dup | crates/socket-patch-core/src/vendor/{npm_lock.rs:90, pnpm_lock.rs:110, pnpm_lock_legacy.rs:287, bun_lock.rs:327} (2,076 + 1,428 LOC); 256–367 cloned lines | 1,200 | 0 | M | extends WS3/WS5 | One `NpmFlavorBackend` trait and one driver in npm_common over utils/group_commit.rs; derive Default on VendorEntry (57 literals). |
-| 15 | F49 | default suite compiled twice per `test` leg (feature-set mismatch) | sp | ci-matrix | ci.yml:331-332 (`--all-features --no-run`, then default), :372-373; documented as intentional at :336-338 | 2 YAML | 18 | L | no | Use one feature set for `--no-run` and the run in test and test-release. Owner to confirm the #150 rationale. |
-| 16 | F58 | 238 CLI integration-test binaries, 78 with ≤3 tests; linking dominates test/test-release | sp | test-overlap | crates/socket-patch-cli/tests (238 files; 23 with 0–1 tests); ci.yml:335-341 "~240 test binaries" | 0 | 20 (≈30 combined with F49, F04) | M | no | Consolidate into multi-module crates per command family (as tests/e2e_vex_build/), keeping `#[serial]` (565 uses in 58 files). About 21 setup binaries go with WS7 anyway. |
-| 17 | F10 | CRLF/corrupt/dry-run/round-trip invariants re-tested per writer | sp | test-overlap | 79 CRLF fns in 44 files (crates/socket-patch-core/src/patch/redirect/mod.rs 11); 232 dry_run fns | 1,400 | 0.3 | M | extends WS3 | One property harness over every LockModel impl (CRLF in = out, plan+restore identity, dry run writes nothing, rerun is a no-op). Move edge cases into its fixtures. |
-| 18 | F39 | 3 regenerate/reset paths; the admin routes delete Go zips before requeue and skip the gopatch refusal | ds | intra-dup | depscan:workspaces/patches/src/services/patch-package/reset-decision.ts:32-39 vs depscan:workspaces/next-app/src/pages/api/admin/patches/regenerate-range.ts:242-264 (no force guard) | 100 | 0 | L | no | Both admin routes call resetOne() in reset-ops.ts. This removes a live hazard: a range regenerate over a Go patch breaks committed go.sum pins. |
-| 19 | F19 | admin package-detail "lite" engine dead since #18370 | ds | dead-code | fetch-autopatch-package-status.ts:2211-2709 and :305-352; depscan:workspaces/next-app/src/pages/api/admin/autopatch/package-detail.ts:3,27,42,47-62 | 560 (⊂ F06) | 0 | L | no | Delete now, independent of F06. |
-| 20 | F24 | patches-harness-contract carries a dead autopatch-backport config module | ds | dead-code | depscan:workspaces/patches-harness-contract/src/autopatch-backport-config.ts (273) + test (143) | 425 | 0 | L | no | Delete; fix doc paths; inline the depscan:workspaces/patches/src/services/patch-publication/dependent-merges.ts:21-26 pass-through (`trx: any`). |
-| 21 | F20 | purl-api-proxy keeps a full /patch/* forward that no client calls | ds | dead-code | depscan:workspaces/purl-api-proxy/routes/patch.ts (181), lib/patch-target.ts (121), lib/forward-headers.ts (57); CLI default is patches-api (crates/socket-patch-core/src/api/client.rs:1922) | 560 | 0 | L-M | no | Confirm zero traffic in gateway logs, then delete the route, guard, forward-headers, their tests and PATCHES_ORIGIN. abort-client-response and upstream-origin are shared and stay. |
-| 22 | F16 | WS1 upstream/* builds a second per-format grammar outside WS3 formats/ and imports a module #281 deletes | sp | intra-dup | origin/v5/ledger-free-hosted crates/socket-patch-core/src/patch/redirect/upstream/* (8,359 @08c30b7e; 8,752 @65aa0744); formats/mod.rs:71 stub; upstream/gem.rs:61 uses removed `vendor::gemfile_lock` | 900 | 0 | M | partial (WS3 restore_upstream stub) | Rebase #280 onto integration. Split each upstream/<fmt>.rs into a pure `formats::<fmt>::restore_upstream(pins)` and one async resolver. This also fixes the compile break. |
-| 23 | F07 | real-installer pdm/pipenv/poetry backtests duplicated in depscan (hatch and pip exist only in depscan), run against pinned CLI SHAs | both | cross-repo-dup | depscan:tools/pipeline/{pdm,pipenv,poetry,hatch,pip}-patch-backtest.py (3,759); depscan:.github/workflows/pdm-patch-compatibility.yaml:20 SOCKET_PATCH_REVISION; scripts/backtest-{pdm,pipenv,poetry}.py | 2,900 (gated) | 30 (ds, per pypi trigger) | M | no | socket-patch compatibility workflows publish versioned captures; depscan SBOM tests consume them via the submodule; delete depscan's pdm workflow and the pdm/pipenv/poetry scripts; delete depscan's hatch workflow and script only after socket-patch adds a hatch capture. F74 is the interim step. |
-| 24 | F73 | depscan api-v0 shards rebuild the pinned CLI every run despite a 963 MB cache hit | ds | ci-matrix | depscan:workspaces/github-actions/src/jobs/test-api-v0.ts:82-91,146; depscan:.github/workflows/pull-request.yaml:2273-2277; 7 runs, mean 7.9 job-min | 0 | 7.5 (~130 runs/day) | L | no | Cache the binary keyed on `HEAD:submodules/socket-patch`, or build it once and share it; the 7.5 is this cache alone. Optional, not counted: a path-gated shard for the 23 patch e2e files (see D26; the filter must keep the lib/app/pipeline import paths). |
-| 25 | F23 | deploy-patches prod/staging workflows are 500-line twins edited in lockstep | ds | intra-dup | depscan:.github/workflows/deploy-patches-{prod,staging}.yaml (500 each; 68-line diff; 62 shared commits) | 440 YAML | 0 | L | no | One `workflow_call` workflow plus two dispatch wrappers; keep environment protection bound to the right job. |
-| 26 | F21 | hidden legacy scan spellings and the v3 SOCKET_PATCH_* env shim survive v5 | both | dead-code | crates/socket-patch-cli/src/commands/scan/mod.rs:291,312,322,326; crates/socket-patch-core/src/utils/env_compat.rs:20-68,108-117,165-178; depscan:workspaces/patches/src/test/integration/live/hosted-live.e2e.test.ts:569-571 | 450 | 0 | L (env, --detached) / M (flags) | partial (WS8 hid, kept) | In v5.0 drop `--detached` and SOCKET_PATCH_*. Drop or warn-and-map `--redirect/--apply/--vendor`. Update the depscan tests in the same bump. |
-| 27 | F29 | `--one-off` on get/rollback exists only to error | sp | dead-code | crates/socket-patch-cli/src/commands/rollback.rs:98-115,1123-1158; crates/socket-patch-cli/src/commands/get.rs:506-521,2623-2657 | 260 | 0 | L | no (WS8 kept it) | Remove the flag, SOCKET_ONE_OFF, the tests and the CLI_CONTRACT/README rows in v5.0. |
-| 28 | F30 | `.socket/packages/<uuid>.tar.gz` is never written but still probed, overlaid and swept | sp | dead-code | crates/socket-patch-core/src/api/blob_fetcher.rs:30-38; crates/socket-patch-cli/src/commands/fetch_stage.rs:212-235,339,460; apply.rs:1048-1056 | 250 | 0 | L | no | Delete resolve_from_archive, packages_path, the pkg_present arm and the sweeps (keep the archive helpers shared with diffs). gc sweeps the leftover dir for one release. Drop `appliedVia: "package"`. |
-| 29 | F57 | vlt-serve-watchdog cannot alert; npm/pnpm compatibility have no path filter | sp | ci-matrix | vlt-serve-watchdog.yml:18,28; npm-compatibility.yml:9-13; pnpm-compatibility.yml:3-7 | 0 | 12 (PR pushes) | L | no | Path-filter npm/pnpm like bun-compatibility.yml. Arm the watchdog after a manual dispatch confirms depscan #26856/#26867 in prod, or run it daily until then. |
-| 30 | F54 | pdm-compat Windows native legs vacuous (47/47 SKIP, green) | sp | ci-matrix | scripts/backtest-pdm.py:484-486,1320-1324,1352-1355; job 108746808097 | 0 | 8 | L | no | Treat a bootstrap failure or 100% SKIP as ERROR. Then either fix `Scripts\python.exe` (adds ~50–60 job-min) or drop the 16 Windows rows. |
-| 31 | F46 | e2e_maven/e2e_nuget/e2e_composer rows spend ~2.5 min each on 0.03 s hermetic tests | sp | ci-matrix | ci.yml:686,688-693,696; crates/socket-patch-cli/tests/e2e_nuget.rs:182,250 and e2e_maven.rs:102,229 `#[ignore]` | 13 YAML | 7 (≈3 after F51) | L | extends follow-up (v5-plan.md:134-135) | Un-ignore the 4 hermetic tests so `test` runs them; delete the 3 rows. |
-| 32 | F33 | npm `.berry.zip` sidecar is built, stored, served, never read | both | dead-code | crates/socket-patch-core/src/patch/redirect/mod.rs:166 (0 reads); depscan:workspaces/patches/src/services/patch-package/build.ts:475-482; serve-decision.ts:145-157 | 150 | 0 | L | no | CLI: drop `berry_zip_url` (44 lines). depscan: keep the rebuild (it is the 10c0 source) but stop storing and serving the zip after an access-log check; api-v0 package.ts:124-133 exposes it publicly. Drop the columns later. |
-| 33 | F25 | parse_memo: process-global parse caches that work around per-package re-parsing | sp | expensive-abstraction | crates/socket-patch-core/src/vendor/parse_memo.rs (275; 21 statics in 16 files) | 320 | 0 | L | extends WS3/WS6 | Delete once LockModel parses once per run through ProjectContext; add no new sites. |
-| 34 | F32 | Auto/Service fallback policy hand-rolled in 7 backends; the shared helper serves only frozen maven/nuget | sp | intra-dup | crates/socket-patch-core/src/vendor/service_fetch.rs:170-265 (callers maven_repo.rs:713, nuget_feed.rs:906); golang.rs:550-563,701-731 | 220 | 0 | M | extends WS5 | `acquire_service_artifact(cfg, record, verdict_fn)` → Used/FallBack/HardFail inside VendoredBackend. Ready arms stay per backend; warning codes become parameters. |
-| 35 | F27 | the GitHub app mirrors the redirect-state.json schema that WS1 deletes | both | cross-repo-dup | depscan:workspaces/app/src/autopatch-pr/github-patch-pr-hosted.ts:81,235-300,534-575 | 300 | 0 | L | partial (WS1 CLI side) | In the depscan bump past #280, stop writing the ledger. The CLI keeps legacy reads (v5-plan.md:47-48), so this is a stale writer, not an attestation loss. Fixture captures are not prunable LOC. |
-| 36 | F28 | vendored path POSTs /patches/package once per uuid; the endpoint takes 500 | both | redundant-network | crates/socket-patch-core/src/api/client.rs:1429-1437; crates/socket-patch-core/src/api/vendor_prefetch.rs (601 src); depscan:workspaces/api-v0/src/endpoints/orgs/patches/package.ts:287,330 | 300 | 0 | M | no | One chunked batch reference POST per vendor run; keep per-package GETs and the breaker. Also chunk hosted scan's unchunked call (client.rs:759-776), which returns 400 above 500 uuids. |
-| 37 | F18 | one-off cargo index-line backfill runs inside every converter cycle | ds | high-cost-low-value | depscan:workspaces/patches/src/services/patch-package/converter.ts:341-352; queue.ts:593-686; cargo-index-backfill.test.ts (429) | 690 (gated) | 0.3 | L | no | Gate: backlog count = 0 (added 2026-09-28, not yet drained). Then a one-shot admin script, or a flag defaulting off. |
-| 38 | F14 | depscan diff channel: on-demand bsdiff task, hidden route, proxy with per-request view preflight | ds | high-cost-low-value | depscan:workspaces/api-v0/src/endpoints/orgs/patches/diff.ts:93-107; generate-patch-diff-archive-task.ts:41-56,133 (throws in a task); depscan:workspaces/patches-api-proxy/src/server.ts:1263-1345 | 1,130 (gated) | 0.5 | M | no | Needs an owner decision on CLI diff mode: D19 showed default `repair` writes diff-only sources, so the channel is not dead (see F67). Meanwhile remove the task throws and the doubled preflight. If retired, a 404 is a safe interim (crates/socket-patch-core/src/api/blob_fetcher.rs:274-281). |
-| 39 | F22 | 14 of 18 CLI telemetry events are never classified server-side; the endpoint sunsets 2026-12-31 | both | high-cost-low-value | crates/socket-patch-core/src/telemetry.rs:33-57,449-913; depscan:workspaces/api-v0/src/endpoints/orgs/telemetry-discriminators.ts:17-43; telemetry.ts:145 | 450 (gated) | 0 | L | no | Owner decision. Either classify the v5 events and move to `/v1/orgs/{slug}/events` (or get the sunset extended), or delete the unread track_* wrappers. |
-| 40 | F56 | vlt capstones run in ci.yml (35 rows) and in vlt-compat install-proof (70 legs) | sp | ci-matrix | ci.yml:917-955 (112.5 job-min); vlt-compatibility.yml:189-270 | 0 | 60 (≈10 beyond F51) | L | no | vlt and every vlt version stay. Put the rows on F51's build-once; install-proof excludes the 35 cells ci.yml gates, enforced by test_ci_vlt_rows.py. |
-| 41 | F74 | depscan pdm/hatch workflows trigger on pypi task code they never run | ds | ci-matrix | depscan:.github/workflows/pdm-patch-compatibility.yaml:8,20,39; runs 36239865114 (72.1 job-min), 36239865149 (114.9) | 0 | 15 (⊂ F07) | L | partial (F07) | Drop the `pipeline/src/task/python/pypi/**` trigger and add the fixtures/pdm path. Cache the CLI keyed on SOCKET_PATCH_REVISION. |
-| 42 | F13 | shared redirect goldens cover ecosystems unevenly; each repo keeps unshared rewriter tests | both | cross-repo-dup | crates/socket-patch-core/tests/fixtures/redirect: 141 cases (vlt 68; pnpm 2; gem/golang/uv 1; poetry/pdm/pipenv 0) | 1,200 (alt. to F01) | 0 | L-M | partial (WS3 gate) | Only if F01 is not done: move byte-asserting TS and Rust cases into shared fixture dirs, starting with pnpm, package-lock, gem, golang and uv. |
-| 43 | F37 | serve-route.ts re-inlines the stream/304/HEAD logic that serve-artifact.ts centralizes | ds | intra-dup | depscan:workspaces/patches/src/services/patch-serving/serve-route.ts:158-268; #26856 had to patch both | 110 | 0 | L | no | Route through `serveStoredArtifact({headFastPath: true})`; share `makeDeny`. Metadata Cache-Control is intentionally different, so it is not drift. |
-| 44 | F35 | Berry 10c0 checksum implemented twice with hand-copied fixtures; vendored CLI ignores the server value | both | cross-repo-dup | crates/socket-patch-core/src/vendor/berry_zip.rs:335; depscan:workspaces/patches/src/repack/berry-cache-zip.test.ts:1-7; crates/socket-patch-core/src/api/client.rs:1278-1280 | 120 | 0 | L | no | Both implementations stay. Share the fixtures via crates/socket-patch-core/tests/fixtures/berry_zip, read by both; vendored takes the server's yarnBerry10c0 for service artifacts. repacking-to-depscan.md goes further: its verify step 6(vi) always recomputes over the verified tgz as a runtime tripwire, and step 14 puts the vectors under tests/fixtures/served/. |
-| 45 | F36 | two npm-registry tarball fetchers inside depscan | ds | intra-dup | depscan:workspaces/patches/src/repack/upstream/npm.ts:56-60,89-145 vs depscan:workspaces/patches-shared/src/registry/npm-registry-source.ts; socket-patch-publishing-tool.ts:1264-1268 | 110 | 0 | L-M | no | Make npm.ts an adapter over fetchNpmTarballBytes (fetch-archive.ts is shared infra and stays); use the packument URL in the publishing tool. |
-| 46 | F38 | signature handling diverges; depscan signer seam and signature columns are dead | both | dead-code | depscan:workspaces/patches/src/repack/sign.ts (defaultSign → null); repack-utils.ts:1333-1370 keeps RECORD.jws; crates/socket-patch-core/src/vendor/pypi_wheel.rs:570-585 | 110 | 0 | L | no | Strip RECORD.jws/.p7s in depscan; delete the sign seam; stop writing package_signature. Leave CLI maven alone (frozen). |
-| 47 | F34 | every stored object is streamed back in full after upload | ds | expensive-abstraction | depscan:workspaces/patches/src/services/patch-package/build.ts:209,456; gcs-store.ts:108-117 (no checksum header) | 150 | 0 | L | no | Send md5/crc32c (md5 is already computed at build.ts:315,532) and read back only on a 412 collision. The berry and reset parts are in F33/F39. |
-| 48 | F43 | public core fns with zero callers survive because rustc exempts pub | sp | dead-code | on integration f8b8d80a: crates/socket-patch-core/src/vendor/bun_lock.rs:89; vlt_lock.rs:1441; lock_inventory/view.rs:57,219,264 | 55 | 0 | L | no | Delete the 5 zero-caller fns and DirEntryInfo; move test-only helpers under cfg(test); add `#![warn(unreachable_pub)]`. |
-| 49 | F48 | module-wide `#[allow(dead_code)]` on vlt_lock_text masks a dead method | sp | dead-code | crates/socket-patch-core/src/vendor/mod.rs:102; vlt_lock_text.rs:782 | 7 | 0 | none | no | Remove the allow; delete EdgeEntry::entry_text; use `cfg_attr` on find_node_dirs_sync. |
-| 50 | F15 | setup leftovers: frozen hook wheel and Bundler plugin source, plus SetupConfig | sp | dead-code | pypi/socket-patch-hook, gem/socket-patch-bundler (1,053); crates/socket-patch-core/src/manifest/schema.rs:39-60 (43 `setup: None`) | 1,100 (70 new) | 0 | L | yes, WS7 (1,030) | Owner confirms, then delete both dirs; replace the initializers with `..Default::default()`. |
-| 51 | F40 | setup-matrix (9 docker legs) is continue-on-error and tests `setup` | sp | ci-matrix | ci.yml:1634-1700; run 36359489402: 50.9 + e2e setup rows | 70 YAML | 56 | none | yes, WS7 (#279, already on integration) | Land WS7. |
-| 52 | F17 | napi addon + hosted-bundle have 0 consumers; parity upkeep in 3 PRs | sp | high-cost-low-value | crates/socket-patch-cli/src/hosted_memory (4,546); crates/socket-patch-cli/src/commands/hosted_bundle.rs; ci.yml:77-105 node-addon 2m34s | 0 counted (750 claimed; parity retirement refuted, D4) | 1 | L | WS4 (owner keeps both engines) | After #280 lands and #282 is rebased onto it (F26), make no more hosted edits outside core/hosted. Run node-addon and parity only on `core/hosted/**` PRs until depscan adopts (F01). |
-| 53 | F45 | publish dry run re-extracts the file map and re-unpacks upstream to disk to list names (no re-download) | ds | repacking | depscan:workspaces/patches/src/api/commands/review/validate-upstream-anchors.ts:118,178-190; publish.ts:1437-1454 | 30 | 0 | L | no | Fold into F61: convertPatchToPackage returns the entry order; drop the re-unpack. |
-| 54 | F61 | one publish downloads upstream up to 3× and repacks twice | ds | repacking | validate-upstream-anchors.ts:74-86 (build discarded); depscan:workspaces/patches/src/services/patch-package/converter.ts:444-454; certify.ts:200-213,351 | 0 | 0 | L-M | no | Stage the dry-run archive by (purl, upstream digest) and let the converter adopt it after a digest re-verify, or cache verified upstream bytes by digest. |
-| 55 | F59 | after WS1, vex refetches every record per run | sp | redundant-network | origin/v5/ledger-free-hosted crates/socket-patch-cli/src/commands/vex_sources.rs:888-960 (fetch_patch per uuid :930, fresh client :911) | 0 | 0 | L | partial (WS1/WS6) | Pass fetched records through WS6 ProjectContext, or add an immutable per-uuid on-disk cache (honouring `--offline`). Otherwise each vex run pays about +N views. |
-| 56 | F71 | qualifier-less pypi patches: the CLI downloads the served sdist before rejecting it | both | redundant-network | crates/socket-patch-core/src/vendor/pypi.rs:1015-1041,1918-1926; crates/socket-patch-core/src/api/client.rs:1302-1308; depscan:workspaces/patches-shared/src/archive/ecosystem-archive-format.ts:146-165 | 0 | 0 | L | no | Decide from the step-1 artifact filename before the GET; server exposes artifact kind. |
-| 57 | F70 | same waste seen from the vendored download path (one fix with F71) | sp | redundant-network | client.rs:1627-1631,1723 (256 MiB cap); crates/socket-patch-core/src/vendor/pypi.rs:1920,2040 | 0 | 0 | L | no | Same change as F71; add one shared sdist-served pypi golden. |
-| 58 | F80 | auto mode eagerly fetches pristine upstream for uninstalled packages (only cargo defers) | sp | redundant-network | crates/socket-patch-cli/src/commands/vendor.rs:1838-1913 | −15 | 0 | L-M | no | Generalize the `cargo_via_service` deferral (PackageSource::Deferred) to every service-backed ecosystem. Superseded if repacking-to-depscan.md Phase 4 lands; the Deferred arm is deleted there (step 27). |
-| 59 | F60 | hosted scan downloads each patched wheel in full to read METADATA | both | redundant-network | crates/socket-patch-cli/src/commands/scan/hosted.rs:1974-2096; crates/socket-patch-core/src/vendor/pypi.rs:89-127 | 0 | 0 | M | no | depscan persists PEP 658 metadata + hash and returns them from /patches/package; the CLI uses them and falls back to the download. |
-| 60 | F66 | converter reads patched blobs one at a time | ds | other | depscan:workspaces/patches/src/repack/convert-patch.ts:140-185 | 0 | 0 | L | no | Bounded concurrency (~16), start the upstream download first; the dry-run adapter should honour abortSignal (validate-upstream-anchors.ts:323-327). |
-| 61 | F69 | pypi bz2/xz sdists are selected, downloaded (≤256 MiB), then refused | ds | high-cost-low-value | depscan:workspaces/patches/src/repack/upstream/pypi.ts:152-168; repackers/pypi.ts:131-138; repack-utils.ts:771-797 | 0 | 0 | L | no | Reject non-.tar.gz/.zip sdists in the selector before downloading; add an xz arm. No CLI change. |
-| 62 | F67 | disk stager treats diff-archive presence as full coverage; created files fail after default `repair` | sp | other (latent bug) | crates/socket-patch-cli/src/commands/fetch_stage.rs:212-235,316-320; crates/socket-patch-cli/src/commands/apply.rs:236,281; depscan generate-patch-diff-archive-task.ts:84-92 | 0 | 0 | L | no | Plausible, not reproduced. Make `repair` default to file mode, or require blobs for files with an empty before_hash; add a created-file test. |
-| 63 | F50 | next depscan bump fails golden.test.ts on the 68 new vlt cases | both | cross-repo-dup | depscan:workspaces/app/src/patches/registry-rewrite/golden.test.ts:50-60; crates/socket-patch-core/tests/redirect_golden.rs:22-37 | 0 | 0 | L | no | Add a per-flavor TS_IMPLEMENTED allow-list mirroring RUST_IMPLEMENTED; do not port vlt to TS. |
-| 64 | F77 | one red base test skips the e2e tier on all v5 PRs | sp | ci-matrix | crates/socket-patch-cli/tests/e2e_redirect_cargo_build.rs:829; ci.yml:676 `needs: test` | 0 | one-off (~3,100 spent) | L | no | Fix or quarantine case (3) and decide offline-vex-without-ledger semantics in WS1; rebase #279–#283. Do first. |
-| 65 | F78 | in-flight v5 PRs: 344 runs, 34% cancelled or failed; #280 3.75 h without a CI verdict | sp | ci-matrix | ci.yml:22-24; run 36371317869 cancelled at 22 min after 303 job-min | 0 | ~200 per draft push (transient) | L | no | For drafts, run heavy CI and compatibility workflows on ready_for_review, a label or dispatch; put cheap gating jobs first. |
-| 66 | F63 | five drafts cut in parallel from one base on the same hot files | sp | ci-matrix | merge-base 8ae7dc37 for all; crates/socket-patch-cli/src/commands/get.rs and tests/covgap_commands_rollback.rs touched by all 5 | 0 | ⊂ F78 | L | no | Rebase serially (WS1 → WS3 → WS4 → WS5 → WS7/8); skip compatibility workflows on drafts. |
-| 67 | F26 | #282 moves the hosted ledger into core while #280 deletes it | sp | other | origin/v5/one-hosted-engine crates/socket-patch-core/src/hosted/ledger.rs (311); merge-tree: 10 conflicts | 0 terminal (311 churn) | 0 | L | partial (WS4 depends on WS1) | Land #280 first, rebase #282, drop core/hosted/ledger.rs except the migration-only reader. |
-| 68 | F44 | #279 WS8 edits hosted text and tests that #280 deletes and #282 moves | sp | other | #279 469a6711/f200524f; core/hosted/guidance.rs:46-107 on #282 still says "redirect" | 0 terminal (30 churn) | 0 | L | WS8 | Apply the WS8 hosted wording after #282, in core/hosted/guidance.rs. |
-| 69 | F05 | two builders per archive-shaped artifact produce different bytes; reuse.rs hides the flip | both | repacking | crates/socket-patch-core/src/vendor/npm_pack.rs:21-43 vs depscan:workspaces/patches-shared/src/archive/repack-utils.ts:597-660; crates/socket-patch-core/src/vendor/reuse.rs:1-12 | 0 counted (3,300 if rebuild dropped) | 0 | M | WS5 caveat; #283 keeps rebuild | The owner keeps the local rebuild (WS5; blockers in F72). The only actionable part is aligning the npm recipe (upstream order, mtime 0) so both builders produce the same bytes and reuse.rs shrinks; this stays useful while WS5 keeps the rebuild. See repacking-to-depscan.md for the gated deletion path (gross ~2,050 src / ~1,260 test, net ≈ −1,150 src after ~900 src / ~900 test of additions). |
-
-## Measurements and checked-not-waste
-
-These are kept as facts. They are not ranked and their LOC is not counted as
-net-new.
-
-| id | what it established | use |
-|----|---------------------|-----|
-| F08 | WS1 test surface: 80 test files and 326 refs to redirect-state; about 2.2k LOC of ledger-only tests | Within WS1: delete ledger-only corrupt/replay tests instead of porting them; keep tests for the legacy-read migration (v5-plan.md:47). |
-| F31 | hosted.rs ↔ hosted_memory still share 161 verbatim lines on integration; only #282 removes them | Counted inside WS4 (#282). |
-| F42 | Deprecated aliases, tool_command and the CI old-path grep are already deleted on integration | Done; list them as breaking changes in the v5 notes. |
-| F62 | bun.lockb writer and vex/discover reuse the shared codecs | Not waste; WS3 `wired_refs()` absorbs the glue. |
-| F64 | Per-PR deletion ledger (see Totals) | Use it for the de-duplication below. |
-| F65 | #283 keeps the local rebuild and resolves repair/service | The #283 plan note is the WS5-caveat answer. |
-| F68 | The diff archive and the repacked package serve different modes | Assess the diff channel against blobs, never against repacking. |
-| F72 | Server fail-closed classes make the local rebuild the only vendoring path for them (pypi qualifier-less/wheel-only, locally pinned wheels and tarballs, bzip2 sdists) | Blocks F05; verification removed gem platform and go no-go.mod as blockers. |
-| F75 | depscan repack tests are 0.4% of Tap Unit and 0.9% of Tap Integration time | Do not cut repack tests; patches Tap cost is orchestration and backtests. |
-| F76 | Map corrections: repack 6,015 src / 4,976 test (111 `tap.test` + 22 `t.test`); berry_zip.rs 333 src; reuse.rs 382 src; purl-api-proxy path | Figures used here. |
-| F79 | Bump depscan's gitlink in three steps (base tip, then integration, then past #280), pre-flighting each SHA | Sequencing for F11, F27 and F50. |
-
-## Top-10 cuts
-
-| # | id | cut | code | test | docs/YAML | CI job-min/run |
-|---|----|-----|-----:|-----:|----------:|---------------:|
-| 1 | F51 | e2e build-once fan-out | 0 | 0 | 0 | 280 (ci.yml) |
-| 2 | F03 | delete #257 oracles after snapshotting inputs | 0 | 6,500 | 0 | 0.5 |
-| 3 | F02 | delete depscan refactor docs except DAG/ | 0 | 0 | 8,222 | 0 |
-| 4 | F41 | drop per-push e2e-docker | 0 | 0 | 65 | 65 (ci.yml) |
-| 5 | F04 | one test suite per command | 0 | 4,000 | 0 | ⊂ F58 |
-| 6 | F53 | build Dockerfile.base once | 0 | 0 | 0 | ≈35 after F41 (ci.yml) |
-| 7 | F55 | pdm capstone build-once + dedupe | 0 | 0 | 0 | 65 (pdm-compat) |
-| 8 | F52 | tier middle PM versions off PRs | 0 | 0 | 0 | ≈40 after F51 (ci.yml, PR only) |
-| 9 | F06 | retire depscan legacy engine (incl. F19) | 2,750 | 250 | 0 | 0 |
-| 10 | F01 | depscan calls the Rust engine; delete TS twin (gated) | 5,000 (gated) | 5,500 (gated) | 0 | 1 (depscan) |
-| | | **total** | **7,750** | **16,250** | **8,287** | **≈420 ci.yml per PR run (≈380 main push) + 65 pdm-compat + 1 depscan (F01, gated)** |
-
-32.3k lines in all, including the gated F01 (10.5k); 21.8k actionable now.
-
-## Totals
-
-### Net-new savings (not in v5-plan or PRs #279–#283)
-
-| bucket | (a) code | (b) test | (c) docs/non-code | total |
-|--------|---------:|---------:|------------------:|------:|
-| Actionable now | 9,137 | 14,925 | 8,752 | 32,814 |
-| Gated (F01 adoption, F07 capture contract, F14 diff-mode decision, F18 backlog drain, F22 telemetry decision) | 6,275 | 9,395 | 0 | 15,670 |
-| **Net-new total** | **15,412** | **24,320** | **8,752** | **48,484** |
-
-- Code (a): F06 2,750, F09 1,600, F12 1,200, F16 900, F20 360, F25 320,
-  F24 280, F32 220, F21 150, F28 150, F30 150, F34 150, F27 140, F33 100,
-  F39 100, F36/F37/F38 110 each, F15 (SetupConfig part) 70, F29 90, F43 55,
-  F45 30, F48 7, F80 −15. Gated: F01 5,000, F14 565, F22 450, F18 260.
-- Test (b): F03 6,500, F04 4,000, F10 1,400, F11 1,380, F21 300, F06 250,
-  F20 200, F29 170, F27 160, F28 150, F24 145, F35 120, F30 100, F33 50.
-  Gated: F01 5,500, F07 2,900 (Python harness), F18 430, F14 565.
-- Docs and non-code (c): F02 8,222 (depscan refactor docs), F23 440 (depscan
-  deploy YAML), F41 65, F46 13, F47 10, F49 2 (ci.yml).
-- (d) CI job-min per run, de-duplicated:
-  - socket-patch `ci.yml`: F51 280, F41 65, F52 ≈40 (after F51, PR only),
-    F53 ≈35 (after F41), F47 ≈23 (after F51), F49+F58 ≈30 combined, F46 ≈3
-    (after F51), F17 1, F03 0.5, F10 0.3. Total **≈478 per PR run, ≈438 per
-    main push**, against 945 for main push 36359489402. The standalone sum
-    is about 585 (F52 at ≈90); the difference is the overlaps below.
-  - Compatibility workflows, per triggered PR push: F55 65, F57 12, F56 ≈10
-    (install-proof dedupe beyond F51), F54 8. About **95**.
-  - depscan, actionable: F73 7.5 + F11 2 ≈ **9.5 per api-v0 CI run** (~130
-    runs/day). Gated: F01 1, F14 0.5, F18 0.3 (Tap unit/integration, not
-    api-v0). F07 adds 30 per pdm/hatch trigger (F74's 15 is its interim
-    subset).
-  - Transient, during the v5 train only: F78 about 200 per draft push. F78
-    uses the savings verification's ≈200 rather than the recorded 250
-    (compatibility workflows are path-filtered). F63's recorded 475 is an
-    upper bound on the same cancelled runs and is not counted. F77: about
-    3,100 job-min already spent on runs whose result was known in advance.
-
-### Overlaps not double counted
-
-- F19 ⊂ F06 (same file); F74 ⊂ F07; F70 = F71 (one fix); F63 ⊂ F78;
-  F45 ⊂ F61's change.
-- F13 is the alternative to F01: its TS half is inside F01's 5.5k test LOC.
-  It is excluded.
-- F17's 750 is excluded because hosted_memory_parity retirement was refuted
-  (D4); only its CI gating (1) counts. F31 is WS4.
-- F56's ci.yml half (≈50 of 60) is inside F51. F52 and F46 shrink once F51
-  cuts leg cost from about 3.0 to about 1.2 min.
-- F47's 3 e2e_safety rows are F51 legs (11.1 job-min at full cost); after
-  F51 they save ≈4, so F47 ≈23 is counted, not 30.
-- F53 after F41 keeps only coverage-docker's builder stage; its setup-matrix
-  share is WS7.
-- F49, F58 and F04 overlap (fewer binaries and one compile), so ≈30 is
-  counted, not 43.
-- F11 carries the depscan setup test deletion; F40 and F73 mention the same
-  59 file and are not counted again.
-- F27 carries the depscan ledger change; F11(e) is the same item.
-- F26 and F44 are churn avoided (0 terminal LOC).
-- F05 (3,300) is excluded: the owner keeps the rebuild, and F72 lists the
-  blockers.
-- Residual risk of double counting: F10 vs F04 (≤0.7k of e2e/in_process
-  CRLF tests); F04 vs F08 (ledger tests inside covgap files, which WS1 owns).
-
-### Already planned (context, not counted)
-
-Per-PR ledger (F64, verified; `git diff --shortstat 8ae7dc37`):
-
-| branch | + / − | net | note |
-|--------|-------|----:|------|
-| #279 remove-setup-and-ui (WS7/WS8) | +1,599 / −31,648 | −30,049 | setup removal |
-| #280 ledger-free-hosted (WS1) @08c30b7e | +21,968 / −21,268 | +700 | adds upstream/* 8.4k (see F16); at 65aa0744: +23,055 / −21,269, net +1,786; upstream/* 8,752 |
-| #281 lock-models (WS3) @85421f3b | +4,495 / −3,353 | +1,142 | |
-| #282 one-hosted-engine (WS4) | +5,209 / −4,634 | +575 | ports ledger into core (F26) |
-| #283 vendor-backend (WS5) | +2,776 / −6,325 | −3,549 | keeps local rebuild |
-| v5/integration (#279+#281+#283) | +7,974 / −40,841 | −32,867 | tests 9,256 → 8,589 |
-
-- Setup removal is 77.5% of integration's gross deletions and about 91% of
-  its net. WS1, WS3 and WS4 are net additions until F16 and F26 are folded
-  in. Report v5 savings from integration totals, never per PR.
-- Findings that fall inside this planned work: F08 (2.2k WS1 tests), F15
-  (1,030 of 1,100, WS7), F31 (WS4), F40 (70 YAML, 56 job-min, WS7), F42
-  (follow-ups, done). Also excluded: F04's covgap_setup* (2,717), F58's ~21
-  setup binaries, F10's core/setup CRLF tests, and F53's setup-matrix image
-  builds.
-- Extends-plan items are counted as net-new because the plan does not name
-  their deletions: F09, F10, F16, F25 (WS3); F12, F32 (WS3/WS5); F21, F29
-  (WS8); F46 (follow-ups); F27, F59 (WS1/WS6 counterparts); F17 (WS4
-  sequencing).
-
-## Repacking summary
-
-Full treatment: [repacking-to-depscan.md](repacking-to-depscan.md).
-- depscan builds every served artifact asynchronously after publish:
-  `published_patches` is the queue, patch-package-converter does the build,
-  and outputs are write-once GCS objects. Only registry metadata is
-  assembled per request. depscan repack is 6,015 src / 4,976 test LOC.
-- The CLI's local builders are about 2.8k src (npm_pack, berry_zip,
-  pypi_wheel, reuse, part of registry_fetch; F05 correction). They are the
-  `auto` fallback, `build`, `--offline` and dry-run path. The 9-file map
-  total of 6,515 src / 7,780 test includes golang_local.rs and prestage.rs,
-  which are not the local build. Of the local build,
-  repacking-to-depscan.md deletes ~2,050 src / ~1,260 test if the WS5
-  caveat is reversed; pypi_wheel (the one local class), berry_zip (the
-  verifier and WS1), the verifiers and maven/nuget stay.
-- The two builders' bytes differ for every archive-shaped ecosystem (F05).
-  #283 keeps the rebuild; F72 lists the classes only it can vendor.
-- Waste on the server: F61 and F45 (publish re-downloads and repacks), F66
-  (serial blob reads), F69 (bz2/xz after download), F33/F34/F38/F39
-  (sidecars, read-back, sign seam, reset paths), F36 (second npm fetcher).
-- Waste in the CLI: F70/F71 (discarded sdist downloads), F80 (eager
-  pristine fetch), F28 (per-uuid reference POSTs).
-- Shared: F35 (10c0 twins, fixtures only).
-- Not waste: repack test time (F75); diff vs repack (F68).
-- The service-hit vs local-fallback rate is still unmeasured. CLI telemetry
-  does not record vendor-source fallback. Any decision to drop the rebuild
-  needs that number first (see Caveats).
-
-## Dropped findings (refuted; do not re-raise)
-
-| # | finding | refuted because |
-|---|---------|-----------------|
-| D1 | Two lockfile patch-reference recognizers with unequal fixture corpora | Both are needed: the offline fail-closed CLI and the server SBOM resolve. Nothing is removable (0 LOC). |
-| D2 | Go hosted pin implemented three times | False: the CLI has one go.sum writer; rewrite_golang calls go_sum_edit (redirect/mod.rs:7160). |
-| D3 | #280 carries dead takeover.rs/replay.rs/client.rs.orig | Stale snapshot: the #280 head already deleted them (9b0f61b8). |
-| D4 | hosted_memory_parity becomes a self-comparison after WS4 | False: the memory side keeps its own discovery, roots and selection front end; savings overstated ~10×. |
-| D5 | vlt scenarios tested up to 4 times | Not duplicates: synthetic in-process trees vs real-installer e2e; deletion would drop unique coverage. |
-| D6 | depscan api-v0 e2e retests CLI internals; vendor suites never hit the server | False: 89–94 seed real patches and download through live api-v0. |
-| D7 | Test LOC concentrated in low-churn code; lock_inventory barely tested | Measurement error (test-only files counted as src); 0 savings. |
-| D8 | depscan repack operator CLIs are dead | Manual operator tools, not dead code. |
-| D9 | CLI fetches full patch views instead of metadata/batch records | Most call sites reuse the full view for the download; the fix adds code (a new client method and proxy route) and removes none. |
-| D10 | Vendored staging downloads blobs before asking the service | False for scan/get: they seed blobs from the records download; the fix needs an endpoint the client lacks. |
-| D11 | vlt preflight downloads every hosted tarball each scan | The bodies feed heal and stale detection; the fix adds code; 0 savings. |
-| D12 | Telemetry builds a new HTTPS client per event | Each command sends once; negligible savings. |
-| D13 | scan/vex/vendor re-crawl in separate processes | By design (VEX attests current disk bytes); `scan --vex` already reuses the crawl; 0 savings. |
-| D14 | Self-evolving harness: 10.3k LOC plus 2×1 TiB Filestore | Infra is gated per env (prod disabled); the cost claim is wrong. |
-| D15 | Maven/NuGet vendoring costs 13k LOC and ~87 job-min | Most of it is hosted maven/nuget (not frozen; WS1 extends it) or setup (WS7). |
-| D16 | ledger_snapshots v2 schema is waste | The proposed redesign is the one reverted for data loss (5c173d6c); net savings ≈0. |
-| D17 | Self-update subsystem is high-cost/low-value | Standalone install is the headline channel (Windows needs it); 0 savings proposed. |
-| D18 | WS1 makes berry_zip/registry_fetch load-bearing | Already load-bearing across vendored paths; the recommendation moves code, it deletes none. |
-| D19 | Default diff mode always downloads blobs; delete the bsdiff channel | The default `repair` writes diff-only sources that later apply from, so the channel does save bytes (see F14, F67). |
-| D20 | Size/entry caps differ between the server and CLI fetchers | Mostly false (the CLI is more permissive on served artifacts); not waste. |
-| D21 | depscan upstream fetchers have no fetch/verify tests | False: 8 live repack-checksum e2e suites (3,219 LOC); it is a coverage gap, not waste. |
-| D22 | Missing-digest policy differs (composer/old npm) | Not waste; misreads when the CLI composer fetch runs. |
-| D23 | Sidecar md5 computed for every artifact but served only to maven | Negligible (~15 LOC); misreads the maven freeze. |
-| D24 | Service-hit vs fallback rate unobservable | Service side is observable (patchServer.downloads); the fix adds code. The data gap is kept as a caveat. |
-| D25 | Build-state gauges lack an ecosystem label | Per-ecosystem failure counters already exist; the fix adds code. |
-| D26 | depscan "patches - Installer E2E" path filter too broad | A safe filter must keep imported lib/app/pipeline paths; savings fall below the bar. |
-
-## Caveats
-
-- **History.** socket-patch history starts at 2025-11-10 (51ea2850). Churn
-  and fix-commit counts cover about 10.5 months, and subject-only vs
-  body-matching `--grep=fix` counts differ; the verification notes say
-  which. depscan
-  counts use `--follow` where files moved.
-- **Moving branches.** #280 and #281 moved during the review (#280 f1cc47bb
-  → 08c30b7e → dc634b31 → 65aa0744). F16, F26, F44 and F59 cite branch heads and need a
-  re-check before acting.
-- **Line numbers.** They are against release/v5-prerelease 8ae7dc37 unless
-  marked integration (f8b8d80a) or branch. ci.yml lines differ by about 22
-  between the two.
-- **socket-patch CI minutes.** Job-minutes from the Actions job API: main
-  push 36359489402 (246 jobs, 944.9 job-min) and PR runs 36363939533,
-  36363939563, 36368399706, 36362334985. They are job-minutes, not wall-clock
-  and not billed minutes (macOS bills 10×, Windows 2×). Some logs were read
-  only from the 5,000-line tail, so compile shares were sampled. Numbers
-  "after Fnn" are derived, not measured.
-- **depscan CI minutes.** An early estimate came from
-  localdev/tap/test-durations.json and was corrected by measuring 7 runs
-  (F75). Deploy and pdm/hatch runs report 0 billable ms (non-billed runners),
-  so their totals come from per-job durations.
-- **Production data.** None of it was queried. Grafana SQL and gateway logs
-  are needed for F18 (backlog count), F20 (purl-api /patch traffic), F33
-  (.berry.zip fetches), F71 (bare-purl pypi share), F14 (diff-route
-  telemetry), and the service-hit vs local-fallback rate that any
-  local-rebuild decision needs.
-- **Not measured.** The full cost of a depscan submodule bump was not run
-  end to end (F11 is grep-based; its vendor suites 89–94 were not run
-  against integration). F67 is plausible but not reproduced.
-- **Savings.** They assume the recommended change, not deletion by default.
-  Savings lens refuted but 2 of 3 upheld: F13, F17, F28, F34–F39, F43, F45,
-  F48, F80 (figures are the corrected ones, or 0 where the correction says
-  nothing is removable). Value lens refuted but 2 of 3 upheld: F05, F10,
-  F14, F18, F23, F24, F25, F27, F63, F78. The 0-LOC ranked findings F44,
-  F50, F59–F61, F66, F67, F69–F71 and F77 also had the savings lens refuted
-  and count nothing. The rank column does not show votes; this list does.
diff --git a/docs/development.md b/docs/development.md
new file mode 100644
index 00000000..1dcb3e88
--- /dev/null
+++ b/docs/development.md
@@ -0,0 +1,98 @@
+# Development
+
+Socket Patch discovers dependency versions, selects available Socket patches, and
+makes those patches consumable through hosted references, committed artifacts, or
+in-place application. The [README](../README.md) describes the user workflow; the
+[CLI contract](../crates/socket-patch-cli/CLI_CONTRACT.md) specifies public behavior.
+
+## Build
+
+Use Rust's stable toolchain and Cargo from the repository root:
+
+```sh
+cargo build --locked -p socket-patch-cli
+./target/debug/socket-patch --help
+```
+
+`Cargo.toml` is the source of the binary's version. The v5 prerelease branch can
+still carry the previous version until the release bump; use a binary built from
+this checkout when verifying branch behavior.
+
+The workspace's `.cargo/config.toml` disables persisted Socket login and passive
+update checks for Cargo runs. This keeps tests independent of a developer's account.
+Override `SOCKET_NO_CONFIG=0` explicitly when a manual `cargo run` should use the
+persisted login.
+
+## Code map
+
+| Component | Responsibility |
+| --- | --- |
+| [`socket-patch-cli`](../crates/socket-patch-cli/src/) | Arguments, command orchestration, terminal output, and JSON responses |
+| [`socket-patch-core`](../crates/socket-patch-core/src/) | API access, discovery, selection policy, patching, format handling, vendoring, and VEX |
+| [`socket-patch-node`](../crates/socket-patch-node/) | Node bindings for the in-memory hosted engine |
+| [`scripts/`](../scripts/) | Installers, release tooling, compatibility runners, and performance tools |
+| [`tests/docker/`](../tests/docker/README.md) | Container fixtures for native package-manager integration tests |
+
+Within core, start with `crawlers/` and `vendor/lock_inventory/` for package
+inventory, `formats/` for shared format models, `api/ranking.rs` for patch ranking,
+`policy/` and `rollout/` for selection, `hosted/` for the hosted engine,
+`patch/redirect/` for dependency rewrites and upstream restoration, `vendor/` for
+artifact backends, and `vex/` for attestation.
+
+### State and command boundaries
+
+- **Hosted state** is derived from dependency files. The lockfiles and related
+  manifests/configs identify the patch and the source the package manager consumes.
+  The CLI fetches patch metadata as needed; it writes no hosted ledger.
+- **Vendored state** pairs `.socket/vendor/state.json` with its artifacts. Entries
+  carry patch records, fingerprints, and reversible edits. A ledger is required for
+  repair and managed reversal; discovering a reference is not enough to rebuild it.
+- **Agent state** uses `.socket/manifest.json` and patch data. Agent commands apply
+  and verify file-level changes against installed packages.
+- **Legacy hosted records** can supplement metadata while migrating old projects.
+  They do not prove a patch is still wired into the project.
+
+CLI commands share [`ProjectContext`](../crates/socket-patch-cli/src/commands/context.rs)
+for lazy ledger, inventory, and reference discovery. Its disk snapshot gives readers
+the same file contents. Writers reload mutable state under the apply lock; embedded
+VEX reloads the result after writes. Vendored commands share
+[`VendoredBackend`](../crates/socket-patch-cli/src/commands/vendored_backend/).
+The in-memory hosted engine operates on supplied files, and parity tests compare
+its results with the disk path.
+
+Keep these boundaries when extending the project:
+
+- A repository policy can narrow or pace selection, but cannot set credentials,
+  endpoints, or bypass safety checks. See [configuration](configuration.md).
+- Presence in a manifest or ledger is separate from whether the package manager
+  consumes a patch. VEX checks live references and available evidence.
+- Preserve unrelated dependency-file edits. Refuse unsupported formats or unsafe
+  drift instead of claiming a patch is applied.
+- Test the files and bytes the native installer consumes, including fresh checkouts
+  and relevant warm caches. A successful rewrite alone does not prove delivery.
+
+## Validation
+
+Choose checks for the affected behavior:
+
+```sh
+cargo test --locked -p socket-patch-core --lib
+cargo test --locked -p socket-patch-cli --test cli_parse_scan --test cli_parse_get
+python3 -B -m unittest discover -s scripts/tests -v
+cargo clippy --workspace --all-features -- -D warnings
+```
+
+The parser suites cover the public CLI. Core unit tests and committed fixtures cover
+format handling. Integration suites cover lifecycle, failures, and native installers;
+see the [testing guide](testing/README.md) for toolchains and opt-in network tests.
+Update relevant contract entries and tests when changing flags, defaults, output,
+exit codes, or supported formats.
+
+Compatibility tables describe support boundaries and reproducible checks. In
+particular, the vlt tables and `vlt-coverage.json` are inputs to validation scripts:
+keep them in sync with tests and workflows. Store individual experiment logs and
+full backtest results as run artifacts, not as new product documentation.
+
+For performance work, use the [record/replay harness](../scripts/perf/README.md).
+For publishing, follow the [release runbook](releasing.md) and
+[installer hosting guide](installer-hosting.md).
diff --git a/docs/ecosystems.md b/docs/ecosystems.md
index f94ed82b..a9048866 100644
--- a/docs/ecosystems.md
+++ b/docs/ecosystems.md
@@ -1,11 +1,11 @@
 # Ecosystem & platform support
 
 This is the detailed support matrix for `socket-patch`: which package ecosystems work
-with which [patch mode](../README.md#three-patch-modes), the per-ecosystem caveats, and
+with which [patch mode](../README.md#patch-modes), the per-ecosystem caveats, and
 the platforms the binary ships for.
 
 For what the three modes *are* and how to choose between them, see
-[How Socket Patch works](../README.md#how-socket-patch-works) in the README.
+[Patch modes](../README.md#patch-modes) in the README.
 
 ## Mode × ecosystem matrix
 
@@ -18,7 +18,7 @@ The backticked slug in each row is the value `-e`/`--ecosystems` accepts (e.g.
 | PyPI (`pypi`) — uv / poetry / pdm / pipenv / pip | ✅ in place | ✅ uv project/script locks, PEP 751 `pylock.toml` / `pylock.<name>.toml`, poetry, pdm, pipenv (Pipenv 2018 or later — every `Pipfile.lock` category is rewired, lock-only checkouts included; Pipenv 2023+ does not hash-check local wheels — `vendor_integrity_unverified`; a venv still holding the upstream release is reported as `pypi_pipenv_stale_install`; see [Pipenv compatibility](testing/pipenv-compatibility.md)), and requirements.txt. Native uv vendoring requires uv ≥ 0.2.35 (the `[[package]]` lock grammar); hosted mode covers native `uv.lock` from uv 0.1.45 (the first release whose `uv lock` writes one) and requirements from uv 0.0.5; see [uv compatibility](testing/uv-compatibility.md). | ✅ requirements.txt including hash continuations, uv project/script locks, and PEP 751 locks. Version/source ambiguity is refused; see [uv compatibility](testing/uv-compatibility.md). Poetry 1.x and 2.x locks are supported; Poetry 0.x ignores URL sources and is refused. See [Poetry compatibility](testing/poetry-compatibility.md). Pipenv `Pipfile.lock` (pipfile-spec 6 — Pipenv 7 and later; `path` references for 7–11, `file` from 2018; lock-only checkouts and Pipenv's out-of-tree venv are discovered; a warm venv that Pipenv will not reinstall over warns `redirect_pypi_stale_install`; see [Pipenv compatibility](testing/pipenv-compatibility.md)). `pdm.lock` is supported for the lock formats PDM 0.12–1.4 and 2.8.1+ write (`lock_version` 2 / 4.3–4.5.1); the identity-losing 3.1 / 4.0–4.2 formats (PDM 1.8–2.7) are refused. PDM 2.8.0 writes an indistinguishable `4.3` lock but shares that identity-loss bug, so a rewritten 2.8.0 lock crashes `pdm sync` — upgrade to ≥ 2.8.1. See [PDM compatibility](testing/pdm-compatibility.md). |
 | Cargo (`cargo`) | ✅ in-place + `.cargo-checksum.json` rewrite (shared registry-cache caveat — see [Cargo: shared registry cache](#cargo-shared-registry-cache)) | ✅ `[patch.crates-io]` path entry in the root `Cargo.toml` (v5; per-version Socket keys; pre-v5 `.cargo/config*` wiring migrates on re-run) | ✅ per-patch sparse registry (`[registries.socket-patch-<uuid>]` + Cargo.lock source/checksum); direct dependencies only — a crate another dependency also pulls in is refused, use `--mode vendored`; with no `Cargo.lock` the graph is unknown, so only a project whose sole dependency is the patched crate is redirected |
 | RubyGems (`gem`) | ✅ in place | ✅ Gemfile + Gemfile.lock path pair (`Gemfile` spelling only — a `gems.rb` project cannot vendor yet) | ✅ per-dep `source` block — edits `gems.rb` + `gems.locked` when present (bundler prefers them over `Gemfile`; spellings that diverge beyond Socket's own edits fail closed with `redirect_gem_gemfile_spellings_diverge`); the `CHECKSUMS` pin needs bundler ≥ 2.6 (older locks get a `redirect_gem_no_checksums_section` warning); a stale pre-redirect materialization that `bundle install` would reuse instead of refetching is flagged `redirect_gem_stale_install` with a prescriptive remedy (see CLI_CONTRACT.md's "Gem stale-install guard") |
-| Go (`golang`) | ✅ `go.mod` `replace` → `.socket/go-patches/` — see [Go: directory replaces and go.sum](#go-directory-replaces-and-gosum) | ✅ `replace` → the committed vendor tree | ✅ (free tier) fork-style `replace` → `patch.socket.dev/gopatch/<uuid>` + committed `go.sum` pin; see [golang-hosted.md](design/golang-hosted.md). Paid tier stays ❌ ([golang-hosted-no-go.md](design/golang-hosted-no-go.md)); `redirect_golang_unsupported` names the vendored remedy |
+| Go (`golang`) | ✅ `go.mod` `replace` → `.socket/go-patches/` — see [Go: directory replaces and go.sum](#go-directory-replaces-and-gosum) | ✅ `replace` → the committed vendor tree | ✅ (free tier) fork-style `replace` → `patch.socket.dev/gopatch/<uuid>` + committed `go.sum` pin; see [Go notes](#go-directory-replaces-and-gosum). Paid hosted patches are unsupported; `redirect_golang_unsupported` names the vendored remedy |
 | Maven (`maven`) | ✅ in-place jar patching leaves the `~/.m2` checksum sidecars stale — prefer vendored / hosted, see [Maven & NuGet caveats](#maven--nuget-caveats) | ✅ committed maven2 `file://` repository. A root pom declaring `<modules>` (multi-module aggregator) is refused (`vendor_maven_multimodule_unsupported`), and a gradle-only project is refused (`vendor_gradle_unsupported`) | ✅ **pom projects only, fail-closed** — the patched jar is pinned at a Socket-only `<version>-socket.<hex8>` suffix; `${property}` versions are refused; Gradle gets a manual `exclusiveContent` snippet — see [Maven & NuGet caveats](#maven--nuget-caveats) |
 | NuGet (`nuget`) | ✅ in-place patching deletes `.nupkg.metadata` and advises on the `.nupkg.sha512` tamper-evidence sidecar — prefer vendored / hosted, see [Maven & NuGet caveats](#maven--nuget-caveats) | ✅ committed folder feed + `packageSourceMapping` + `packages.lock.json` contentHash pin | ✅ `nuget.config` source + source-mapping, `packages.lock.json` contentHash rewrite. See the locked-mode note in [Maven & NuGet caveats](#maven--nuget-caveats) |
 | Composer (`composer`) | ✅ in place (`vendor/`) | ✅ `composer.lock` `dist: path` rewrite | ✅ `composer.lock` dist url + shasum rewrite; the entry's `source` and `dist.mirrors` are removed. See [composer-compatibility.md](testing/composer-compatibility.md) |
@@ -384,6 +384,14 @@ Honest limits of the Maven and NuGet flows — documented behavior, not bugs:
   client-side content pin (vendored surfaces this as a `vendor_nuget_no_lockfile`
   warning; the feed + source mapping still force the patched copy).
 
+* **NuGet package signatures (local vendoring).** Rebuilding a `.nupkg` changes
+  its contents, so the local builder removes the upstream `.signature.p7s` rather
+  than retaining an invalid signature. Environments requiring signed packages need
+  a compatible signing policy or an appropriate service artifact; local vendoring
+  does not preserve the upstream author's signature. Service artifacts are copied
+  without local repacking. The current implementation uses a folder feed with
+  source mapping.
+
 ## Cargo: shared registry cache
 
 Agent mode patches the crate in place wherever the crawler finds it. For a non-vendored
@@ -523,17 +531,46 @@ commit it, and review it like any other vendored code. The wiring survives
 `go mod tidy`, and `apply --check` gives CI a read-only audit that the committed
 redirects still match the manifest.
 
-Hosted mode uses Go's other native `replace` form — a fork-style
-module-to-module directive onto a Socket-published, content-addressed module
-(`replace <mod> <ver> => patch.socket.dev/gopatch/<uuid> <ver>-socketpatch.<n>`)
-plus the module's two committed `go.sum` lines. Because go consults the
-checksum database only for modules *absent* from `go.sum`, the committed pair
-is the complete day-2 state: fresh clones and CI build the patched module with
-no machine-local configuration, and a tampered hash still fails closed with
-go's checksum `SECURITY ERROR`. Free tier only; the paid-tier analysis (and
-the ephemeral-CI workaround) is in
-[golang-hosted-no-go.md](design/golang-hosted-no-go.md), the full free-tier
-design in [golang-hosted.md](design/golang-hosted.md).
+Hosted mode uses a fork-style module replacement and two committed checksums:
+
+```text
+# go.mod
+replace example.com/module v1.4.2 => patch.socket.dev/gopatch/<uuid> v1.4.2-socketpatch.1
+
+# go.sum
+patch.socket.dev/gopatch/<uuid> v1.4.2-socketpatch.1 h1:<module-zip-hash>
+patch.socket.dev/gopatch/<uuid> v1.4.2-socketpatch.1/go.mod h1:<module-file-hash>
+```
+
+The service supplies the replacement path, version, and both hashes; the example
+version is illustrative. Both hashes must be present before the CLI writes the
+replacement. Go uses committed `go.sum` entries without consulting the checksum
+database for those entries, so a fresh checkout needs no per-machine checksum
+exemption. A mismatched checksum still fails the build. The rewriter removes the
+replaced version's original sum lines to keep the result stable under `go mod tidy`.
+
+This requires a free, publicly retrievable patch reference carrying a `goproxy`
+override. CLI support does not imply a patch is published for a particular module.
+Paid hosted Go references are unsupported: embedding credentials in module paths
+would expose them to module proxies and change module identity. Use vendored mode
+for those patches; the CLI reports `redirect_golang_unsupported` when the required
+hosted reference is absent.
+
+Important limits:
+
+- A replacement targets an exact original module version. Updating the `require`
+  can leave it unused; re-scan and regenerate VEX after dependency updates.
+- An internal `GOPROXY` must be able to serve or forward the Socket module path.
+  Comma-separated proxy fallbacks do not recover from every HTTP error.
+- User-authored conflicting replacements are preserved and the patch is refused.
+  Missing module metadata, untrusted Socket module paths, or missing integrity
+  values are also refused before writing.
+- Local directory replacements in agent and vendored mode are not checked against
+  `go.sum`; commit and review those trees. Hosted replacements use the module
+  checksum mechanism above.
+
+The implemented hosted shape and fresh-checkout behavior are exercised by
+[`e2e_golang_hosted_build.rs`](../crates/socket-patch-cli/tests/e2e_golang_hosted_build.rs).
 
 ## Supported platforms
 
diff --git a/docs/migrating-to-v5.md b/docs/migrating-to-v5.md
new file mode 100644
index 00000000..e597b32d
--- /dev/null
+++ b/docs/migrating-to-v5.md
@@ -0,0 +1,78 @@
+# Migrating to v5
+
+v5 makes hosted patching the default workflow. Review these changes before running
+existing scripts against the new CLI; the [changelog](../CHANGELOG.md) and
+[CLI contract](../crates/socket-patch-cli/CLI_CONTRACT.md) cover the full release.
+
+## Defaults and stored state
+
+- Bare `scan` and `get` now patch in hosted mode. `scan` never prompts;
+  hosted and vendored `get` do not prompt either. Use `scan --dry-run` for a preview
+  or `--mode agent` to retain in-place patching. Global scans and a mode-less
+  `scan --prune` do not acquire new patches; `--prune` still performs cleanup.
+- Hosted state lives in dependency files. No command writes
+  `.socket/vendor/redirect-state.json`. Legacy hosted records can still supply
+  metadata, but do not replace live references.
+- Hosted `rollback` and `remove` reconstruct upstream registry entries and
+  generally need network access. They refuse unsupported restoration, including
+  binary `bun.lockb`, with a version-control recovery hint.
+- `rollback` now removes patch records and unused artifacts as well as restoring
+  dependencies. Pass `--preserve-state` to retain local state for reuse.
+- `scan` / `get --mode vendored` need no agent manifest. Commit
+  `.socket/vendor/state.json` with the artifacts. `repair` no longer reconstructs
+  a missing ledger from lockfiles.
+- Vendored Cargo patches move into workspace-root `Cargo.toml` and use
+  `<version>+socket.<uuid>` versions. Re-running vendoring or repair migrates
+  older wiring. The tag is visible in `CARGO_PKG_VERSION`; see
+  [Cargo details](ecosystems.md#cargo-vendored-wiring-in-cargotoml).
+- `list` succeeds on an empty project. Hosted results identify lockfiles instead
+  of a hosted ledger. Scripts must use the updated
+  [JSON shapes and exit codes](../crates/socket-patch-cli/CLI_CONTRACT.md#json-output-shapes).
+
+## Installation channels
+
+v5 distributes standalone binaries, Cargo crates, and npm packages. The PyPI and
+RubyGems CLI distributions and the `socket-patch-hook` / `socket-patch-bundler`
+helpers are no longer published. Python and Ruby projects remain supported.
+
+Remove the old CLI with the manager that installed it (`pip uninstall socket-patch`,
+`pipx uninstall socket-patch`, or `gem uninstall socket-patch`). Install through a
+[supported channel](../README.md#installation), update CI bootstrap commands, and
+run `socket-patch --version` to check which binary your shell finds.
+
+## Retire `setup` hooks
+
+`socket-patch setup` is removed. Existing hooks may still call `apply`, but v5 no
+longer creates or maintains them.
+
+To move an agent project to hosted mode, run `socket-patch rollback`, then
+`socket-patch scan`, review and commit the changes, and reinstall dependencies.
+To stay in agent mode, retain `.socket/` and explicitly run `socket-patch apply`
+after dependency installs in CI.
+
+Remove only the Socket-managed portions of old hooks, preserving other commands:
+
+| Ecosystem | Cleanup |
+| --- | --- |
+| npm / pnpm / yarn / bun | Remove the Socket Patch `apply --silent --ecosystems npm` command from `package.json`'s `postinstall` and `dependencies` scripts; remove empty script keys |
+| Composer | Remove `socket-patch apply --offline --silent --ecosystems composer` from `post-install-cmd` and `post-update-cmd` |
+| Python | Remove `socket-patch[hook]` from requirements or project dependencies, and uninstall `socket-patch-hook` in affected environments |
+| Bundler | Remove the managed `plugin "socket-patch", path: ...` Gemfile block; run `bundle plugin uninstall socket-patch`; remove `.socket/bundler-plugin/`, `.socket/gem-plugin-stamp`, and its `.socket/.gitignore` entry |
+
+Use `socket-patch list` to inspect the remaining patch set. For agent projects,
+run `socket-patch apply` once after migration to confirm the manifest still applies.
+
+## Retired spellings
+
+| Removed | Replacement |
+| --- | --- |
+| `scan --redirect` | `scan --mode hosted` |
+| `scan --detached` | `scan --mode vendored` is already manifest-free |
+| `--mode host`, `--mode redirect`, `--mode vendor` | `hosted`, `hosted`, `vendored` respectively |
+| `get --one-off`, `rollback --one-off`, `SOCKET_ONE_OFF` | No replacement; these had no implementation |
+| `SOCKET_PATCH_PROXY_URL` | `SOCKET_PROXY_URL` |
+| `SOCKET_PATCH_DEBUG` | `SOCKET_DEBUG` |
+| `SOCKET_PATCH_TELEMETRY_DISABLED` | `SOCKET_TELEMETRY_DISABLED` |
+
+Legacy `.socket/packages/` archives are no longer read. Patch data uses diff
+archives or blobs; cleanup commands remove obsolete package archives.
diff --git a/docs/releasing.md b/docs/releasing.md
index 383d6ed7..64463d92 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -11,7 +11,7 @@ The CLI publishes to three channels, all from that single dispatch:
 
 The npm distribution is also required by the official Socket CLI. v5 no longer
 builds or publishes the PyPI and RubyGems CLI packages or their install hooks.
-See the [migration instructions](../README.md#migrating-from-pypi-or-rubygems).
+See the [migration instructions](migrating-to-v5.md#installation-channels).
 
 ## 1. Write the release notes
 
diff --git a/docs/testing/README.md b/docs/testing/README.md
new file mode 100644
index 00000000..c6970a50
--- /dev/null
+++ b/docs/testing/README.md
@@ -0,0 +1,50 @@
+# Testing
+
+Tests should establish that a package manager consumes the intended patched bytes,
+that VEX describes the resulting state, and that reruns and reversal preserve
+unrelated project data. See [development](../development.md#validation) for basic
+Rust and Python checks.
+
+## Test layers
+
+| Layer | Location / entry point | Purpose |
+| --- | --- | --- |
+| Core unit tests and fixtures | `cargo test --locked -p socket-patch-core --lib`; core `tests/fixtures/` | Parsers, rewrites, integrity checks, and refusal cases |
+| CLI parser and in-process tests | `crates/socket-patch-cli/tests/cli_parse_*.rs`, `in_process_*`, command suites | Flags, defaults, output, lifecycle, and failures |
+| Native package-manager suites | CLI `e2e_redirect_*_build`, `e2e_vendor_*_build`, and VEX suites | Real installs against controlled patch inputs |
+| Production suites | [Hosted](hosted-production-e2e.md), [vendored](vendored-production-e2e.md) | Real patch-service responses and artifact delivery |
+| Release compatibility backtests | Package-manager guides below and `scripts/backtest-*.py` | Format and installer boundaries across published releases |
+| Container suites | [Docker guide](../../tests/docker/README.md) | Toolchain isolation and offline installs |
+
+Native suites require the tools named in their guide. Opt-in or unavailable-toolchain
+skips are not installation evidence. Use the suite's `*_REQUIRED` or `*_STRICT`
+setting when that toolchain is required for the check.
+
+## Package-manager guides
+
+| Ecosystem | Guides |
+| --- | --- |
+| npm family | [npm](npm-compatibility.md), [pnpm](pnpm-compatibility.md), [Yarn Berry](yarn-berry-compatibility.md), [Bun](bun-compatibility.md), [vlt](vlt-compatibility.md) |
+| Python | [uv](uv-compatibility.md), [Poetry](poetry-compatibility.md), [PDM](pdm-compatibility.md), [Pipenv](pipenv-compatibility.md), [Hatch](hatch.md) |
+| PHP | [Composer](composer-compatibility.md) |
+
+Other ecosystems have Rust and container suites listed in
+[ecosystem support](../ecosystems.md) and the Docker guide.
+
+## CI and results
+
+[CI](../../.github/workflows/ci.yml) separates normal PR coverage from broader
+release, main-branch, nightly, and manual matrices. Package-manager compatibility
+workflows define additional matrices. Read the workflow for the authoritative
+versions, triggers, required flags, and artifact names.
+
+The vlt [compatibility tables](vlt-compatibility.md) define a generated leg manifest;
+[`vlt-coverage.json`](vlt-coverage.json) maps diagnostics to tests. These are
+executable specifications and are checked by `scripts/tests/`, not historical
+reports.
+
+Backtest runners write JSON results and can render summary tables. Keep each run's
+results, binary versions, source revision, and logs together in CI artifacts or a
+local output directory. Update the maintained compatibility boundaries when new
+evidence changes them. A past successful run or catalog snapshot is not a claim
+that the current branch or production service passes today.
diff --git a/docs/testing/bun-compatibility.md b/docs/testing/bun-compatibility.md
index d6782a2e..5b632028 100644
--- a/docs/testing/bun-compatibility.md
+++ b/docs/testing/bun-compatibility.md
@@ -176,54 +176,14 @@ frozen and ordinary installs, and digest tampering.
 `cargo test -p socket-patch-cli --test e2e_bun_lockb` uses Bun on `PATH`; a modern
 Bun reads the committed binary fixture, so no separate old writer is needed.
 
-### Measured validation
-
-Measured on 2026-09-21, macOS arm64, using the native binary implementation in
-the worktree based on `4b61c9620b800d26056211060ebb4a4c60288da5`:
-
-| Suite | Result | Coverage |
-|-------|--------|----------|
-| Public patch service | 370 / 370 cases passed | 11 releases: 0.8.1, 1.0.0, 1.0.36, 1.1.0, 1.1.38, 1.1.45, 1.2.0, 1.2.23, 1.3.0, 1.3.14, 1.4.2. 340 accepted flows and 30 expected text-workspace refusals. Direct, alias, transitive, two-version, workspace, nested workspace, root workspace, lockfile-only, UUID/search get, legacy binary and both takeover shapes. |
-| Explicit warm-cache installs | 90 / 90 cases passed | Six eras: 0.8.1, 1.0.36, 1.1.45, 1.2.23, 1.3.14, 1.4.2. Direct, workspace, nested workspace, legacy binary and both takeovers, with cold and warmed-cache frozen and ordinary installs. Includes eight expected text-workspace refusals. |
-| Native binary writer/reader matrix | 25 / 25 pairs passed | All 17 fixture writers listed above; own-version readers from 0.5.9 onward, 0.5.9 readers for the three 0.1.x writers, five 1.2–1.4 readers of 1.1.45, and 1.4.2 readers of 0.1.1, 0.1.6 and 0.6.7. All three Rust acceptance tests ran in each pair. |
-| Historical concurrency regression | 30 / 30 pairs passed | Six repetitions of 0.5.9 reading 0.1.1, 0.1.6 and 0.5.9, plus 1.4.2 reading 0.1.1 and 0.1.6, with isolated temporary directories. |
-
-The public-service captures record CLI SHA-256
-`a3e7683d66e6e6654644c3cd51ada1260a58a8d8f9b96c0a2ea4f585a9219910`.
-The binary matrix records both Bun executable hashes and its test executable
-hash in every result. The final local reports are under
-`/tmp/socket-patch-bun-public-final`, `/tmp/socket-patch-bun-public-warm-final`
-and `/tmp/socket-patch-bun-native-final-isolated`.
-
-Early parallel historical probes exposed Bun 0.5.9's `FileNotFound extracting
-tarball` and Bun 0.1.1's lockfile `AccessDenied` errors in a shared temporary
-directory. The harness now gives every fixture its own temporary directory and
-an empty cache directory. Historical writers use timestamp-derived temporary
-names. The failing logs remain under `/tmp/socket-patch-bun-native-verified` and
-`/tmp/socket-patch-bun-native-emptycache-*`; the six repeated runs above verify
-the corrected isolation without retrying failed assertions or changing readers.
-
-On 2026-09-22, the full workspace test run passed 7,326 tests with no failures,
-and production Clippy passed with warnings denied. The production-filter
-regression passed all 33 public-service cases across the same 11 release eras,
-including cold and warmed-cache frozen and ordinary installs. A separate complex
-graph passed both scoped rollback orders on 0.8.1 and 1.0.0; that graph is now
-part of the permanent binary matrix. These local measurements use macOS arm64.
-
-The [PR validation run for `9644add`](https://github.com/SocketDev/socket-patch/actions/runs/35729497310)
-also passed all 25 native binary writer/reader pairs on macOS and all 13 pairs
-available on Windows, including the permanent production/scoped-rollback cases.
-Windows has no official Bun binaries before 1.1.0. Each pair ran all three Rust
-acceptance tests.
-
-The Linux runner exposed a separate historical-runtime boundary: official Bun
-0.5.9, 0.6.7 and 0.6.8 crashed with `SIGSEGV` during pristine installs on
-`ubuntu-latest` (Ubuntu 24.04), before `socket-patch` ran. The workflow retains
-all 25 required historical pairs on Ubuntu 22.04, and additionally runs the 16
-pairs using Bun 0.8.1 and later on `ubuntu-latest`; every historical format and
-reader remains in the required matrix. Linux failures upload bounded pristine
-runtime probes and, when available, syscall traces under the binary result artifact's
-`linux-diagnostics/` directory.
+### Historical runtime limitations
+
+The binary matrix keeps each fixture's temporary directory and cache isolated;
+old Bun writers can collide when sharing temporary paths. Windows has no official
+Bun binaries before 1.1.0. Official Bun 0.5.9, 0.6.7, and 0.6.8 can crash during
+pristine installs on Ubuntu 24.04, before Socket Patch runs; the compatibility
+workflow retains those historical pairs on Ubuntu 22.04. Read the workflow and
+its uploaded diagnostics for each run's coverage and results.
 
 ## Installer boundaries (measured)
 
diff --git a/docs/testing/hosted-production-e2e.md b/docs/testing/hosted-production-e2e.md
index c874d891..1af30895 100644
--- a/docs/testing/hosted-production-e2e.md
+++ b/docs/testing/hosted-production-e2e.md
@@ -1,290 +1,103 @@
-# Hosted-mode production e2e
+# Hosted production tests
 
-`crates/socket-patch-cli/tests/e2e_hosted_production.rs` is the only test suite
-in this repo that exercises [hosted mode](../ecosystems.md#mode--ecosystem-matrix)
-(`scan --mode hosted`) against the **real** Socket production service with **no
-mocking anywhere**. Every other hosted-mode capstone (`e2e_redirect_*_build.rs`)
-serves the patch artifact from a local wiremock, which proves the CLI's rewrite
-grammar but cannot notice production drifting away from it.
+[`e2e_hosted_production.rs`](../../crates/socket-patch-cli/tests/e2e_hosted_production.rs)
+exercises hosted patching against Socket's production public proxy, patch server,
+and upstream registries. It complements controlled-input native installer suites,
+which can validate rewrite behavior without detecting production-service drift.
 
 ## What it proves
 
-For each ecosystem × package manager:
-
-1. install a pinned, known-vulnerable dependency from its **real** upstream
-   registry with the **real** package manager;
-2. assert the installed bytes are pristine (anti-vacuity);
-3. `socket-patch scan --mode hosted --json --yes` — resolves a hosted patch
-   reference from `patches-api.socket.dev` and rewrites the lockfile / registry
-   config to point at `patch.socket.dev`;
-4. assert the rewrite landed (patch host + patch UUID present, integrity pin
-   replaced);
-5. **wipe the install tree and reinstall from the rewritten lock alone** — the
-   package manager itself fetches from `patch.socket.dev` and verifies the
-   integrity pin it was handed;
-6. assert the reinstalled bytes carry the patch.
-
-Step 5 is the point. It is the only place in this repo where a third-party
-package manager — not socket-patch — downloads a Socket-hosted artifact and
-independently verifies its checksum.
-
-## Required production patches
-
-The suite is pinned to these patches. They must stay **published** and
-**free-tier** on `patches-api.socket.dev`; the suite runs against the
-unauthenticated public proxy on purpose, because that is the surface every user
-without a token gets. No API token is used, and `SOCKET_API_TOKEN` is scrubbed
-from the child environment.
-
-| Ecosystem | PURL | Patch UUID | Advisory | Used by |
-|-----------|------|------------|----------|---------|
-| npm | `pkg:npm/minimist@1.2.2` | `80630680-4da6-45f9-bba8-b888e0ffd58c` | GHSA-xvch-5gv4-984h / CVE-2021-44906 | every npm-family leg (npm, npm-shrinkwrap, pnpm, yarn classic, yarn berry, bun, vlt) |
-| PyPI | `pkg:pypi/urllib3@1.26.18` | `de58c8b8-796c-4b6d-8a48-539b5563db76`, `26242e35-f867-4da8-8789-f0d2ea49e0f1`, `e828efa5-5c6d-43f3-9909-03f5ac232b98` | GHSA-38jv-5279-wg99, GHSA-2xpw-w6gg-jr37, GHSA-gm62-xv2j-4w53 | requirements.txt, uv.lock |
-| RubyGems | `pkg:gem/activestorage@6.0.3` | any of `15e960b5-f432-4b6c-b8aa-534a2b419323` (GHSA-m42x-37p3-fv5w / CVE-2020-8162), `6c4141c5-1535-4fd2-9db1-b5f8e4834bdb` (GHSA-w749-p3v6-hccq / CVE-2022-21831, published 2026-08-19), `eeb6bf9f-96c0-4963-a0f1-2e88f91f8b1a` (GHSA-9xrj-h377-fr87 / CVE-2026-33195, published 2026-08-20), `c1a1cd3c-b670-4e44-b4fa-1a63ecd42db6` (GHSA-r4mg-4433-c7g3 / CVE-2025-24293, published 2026-08-20), `9c2b4925-b413-4a3a-bb3a-9990440fb446` (GHSA-xr9x-r78c-5hrm / CVE-2026-66066, published 2026-08-21), `01019627-b481-4bae-bc09-e93b5a5e4481` (MERGED: CVE-2022-21831 + CVE-2025-24293 + CVE-2026-66066, published 2026-09-04) | see UUID column | bundler leg |
-
-urllib3 1.26.18 carries **three** distinct free patches, one per advisory. The
-CLI picks one with its own ranking
-(`crates/socket-patch-core/src/api/ranking.rs`) over server-supplied severity
-and publish dates, so a newly published or re-scored patch can change the pick;
-the suite therefore accepts any of the three rather than pinning one.
-
-`preflight_required_patches_are_published` checks all three every run and fails
-first with the offending PURL named, so a withdrawn patch produces one clear
-failure instead of N confusing ones that look like CLI regressions.
+Each install-proof case installs a pinned upstream package, checks that its bytes
+are pristine, runs a hosted scan, and verifies the new reference and integrity pin.
+It then removes the installed tree, installs from the changed dependency files with
+fresh caches, and verifies patched bytes. The suite also exercises manifest-free
+VEX. This proves delivery of the selected patch; it does not test exploit efficacy.
+
+## Catalog fixtures and coverage
+
+The test's catalog constants and preflight checks are authoritative for required
+PURLs, patch UUIDs, and byte markers. They use free patches through
+`patches-api.socket.dev`, with ambient authentication scrubbed. Catalog contents
+can change independently of this repository; do not treat a past run as a current
+publication guarantee.
+
+| Coverage | Cases |
+| --- | --- |
+| Native production installs | npm/shrinkwrap, pnpm, Yarn Classic, Yarn Berry with node-modules, Bun, pip requirements, uv, and Bundler |
+| Conditional production proof | vlt: validates the served encoding before attempting installation |
+| Catalog canaries | Cargo, Maven, NuGet, and Composer: detect when a free fixture becomes available; do not prove an install |
+| Go | Validates the required hosted reference shape; see [Go support](../ecosystems.md#go-directory-replaces-and-gosum) |
+| Unsupported mode | Deno hosted refusal |
+
+Poetry, PDM, and Pipenv production installers are covered by their
+[release backtests](README.md#package-manager-guides). Rush and Yarn PnP are not
+production install-proof cases in this suite. Controlled fixtures and production
+coverage are distinct; neither should be inferred from the other.
 
 ### If a required patch is withdrawn
 
-1. Find a replacement in the same ecosystem:
-   ```sh
-   # version-less lookup lists every patched version of a package
-   curl -s 'https://patches-api.socket.dev/patch/by-package/pkg%3Anpm%2Flodash' | jq
-   ```
-   Prefer a package that is small, dependency-free, and installable by every
-   package manager in that ecosystem's leg.
-2. Update the catalog constants at the top of `e2e_hosted_production.rs`
-   (`*_PURL`, `*_NAME`, `*_VERSION`, `*_UUID`) **and** the table above.
-3. If the new patch does not inject the `// Socket Community Patch` header,
-   pick a marker unique to the patch and set the ecosystem's `*_MARKER`
-   constant.
-
-## Ecosystem coverage, and the honest gaps
-
-| Ecosystem | Hosted mode | Free patches in production | Suite coverage |
-|-----------|-------------|----------------------------|----------------|
-| npm | ✅ | ✅ many | ✅ npm, npm-shrinkwrap, pnpm, yarn classic, yarn berry, bun; vlt probe-driven (see [vlt](#vlt-the-serve-encoding-gate)) |
-| PyPI | ✅ (requirements.txt, uv.lock, poetry.lock, pdm.lock, Pipfile.lock) | ✅ many | ✅ requirements.txt, uv.lock (poetry.lock / pdm.lock / Pipfile.lock via per-release backtests, see below) |
-| RubyGems | ✅ | ✅ (this suite pins one purl/UUID: `activestorage@6.0.3`; the 2026-08-18 republish covers more versions) | ✅ full bundler install proof |
-| Cargo | ✅ | ❌ **none** (tier emptied 2026-08-28) | canary only |
-| Maven | ✅ | ❌ **none** | canary only |
-| NuGet | ✅ | ❌ **none** | canary only |
-| Composer | ✅ | ❌ **none** | canary only |
-| Go | ✅ free tier [by design](../design/golang-hosted.md) (paid: ❌ [analysis](../design/golang-hosted-no-go.md)) | ❌ none published yet | shape guard (redirects only via `goproxy` override) |
-| Deno | ❌ not supported | — | negative assertion |
-
-Cargo, Maven, NuGet and Composer all *implement* hosted mode, but production
-publishes **zero** free-tier patches for them, so there is nothing real to
-redirect to. Rather than skipping silently, `canary_unpublished_ecosystems`
-probes production every run and reports the moment that changes, so coverage
-can be extended deliberately. It does not fail when patches appear — production
-publishing a patch is not a socket-patch regression — but
-`SOCKET_PATCH_HOSTED_E2E_CANARY_STRICT=1` makes it fail, for use in a scheduled
-nag run.
-
-**Cargo was demoted to the canary on 2026-09-01.** Until then the suite carried
-a full sparse-registry install proof pinned to one crate, but production's free
-cargo tier emptied on 2026-08-28 (both pinned patches were deleted server-side,
-leaving zero live free patches for any cargo crate), so there is nothing honest
-left to pin. This deliberately drops the cargo install-proof coverage — the
-canary only watches for the tier lighting up again. To re-promote cargo: pick a
-live free patch and follow
-[the withdrawn-patch procedure](#if-a-required-patch-is-withdrawn); the git
-history of this demotion shows every piece to restore (catalog constants,
-preflight registration, the install-proof leg, and these tables) in both
-production suites.
-
-PyPI's `poetry.lock`, `pdm.lock` and `Pipfile.lock` ARE rewritten by hosted
-mode (Poetry 1.0+; PDM lock formats `2` and `4.3`–`4.5.1`; Pipenv 7+); their
-live coverage is the per-release matrices in
-[poetry-compatibility.md](poetry-compatibility.md) (`scripts/backtest-poetry.py`),
-[pdm-compatibility.md](pdm-compatibility.md) (`scripts/backtest-pdm.py`) and
-[pipenv-compatibility.md](pipenv-compatibility.md) (`scripts/backtest-pipenv.py`),
-which install the redirected lock with every release rather than one pinned
-installer, so they are not duplicated as legs here.
+1. Choose a published free patch in the same ecosystem, preferably a small package
+   supported by each affected installer.
+2. Update the catalog constants, accepted patch set, and patched-byte marker in
+   both production suites. Read the selected record rather than assuming the
+   catalog's ranking is unchanged.
+3. Run preflight and every affected native install proof. Keep the production
+   fixtures and assertions consistent; a missing fixture must not silently turn a
+   required install check into a pass.
 
-Two supported hosted shapes are deliberately **not** covered here:
-
-* **npm Rush monorepos** — hosted mode supports them (`common/config/rush/pnpm-lock.yaml`
-  plus per-subspace locks), but a faithful leg needs a real `rush install`, which
-  is a much heavier fixture than everything else in this file. It also inherits
-  the pnpm issue below. Covered by `e2e_redirect_rush_sim.rs` against a mock.
-* **yarn berry with the PnP linker** — documented as untested for hosted mode
-  (the lock rewrite fires, but PnP's `.yarn/cache` resolution is not exercised).
-  The berry leg here pins `nodeLinker: node-modules`, matching the documented
-  support boundary.
+To promote a canary into installation coverage, add its catalog fixture, preflight
+registration, install-proof test, and CI toolchain. Update this coverage table and
+the [vendored suite](vendored-production-e2e.md) together.
 
 ## vlt: the serve-encoding gate
 
-`vlt_pinned_matrix_production_hosted_install_proof` pins the public minimist
-patch in a vlt 1.2.0 project (`vlt.json` with `registries.npm`). vlt hashes the
-wire body of a tarball and sends `accept-encoding: gzip;q=1.0, identity;q=0.5`,
-so it fails `EINTEGRITY` whenever patch.socket.dev (or its CDN) serves the
-artifact content-encoded. The leg therefore probes the artifact the way vlt
-does (the core `fetch_artifact_probe`) and branches on what it sees:
-
-| Probe | Asserted |
-|---|---|
-| `Content-Encoding` other than identity | the clean refusal: `redirect_vlt_artifact_unverifiable` naming the encoding, `vlt-lock.json` byte-identical (v5 hosted mode writes no ledger either way). With `SOCKET_PATCH_VLT_HOSTED_PRODUCTION_REQUIRED=1` the encoded response is itself a failure. |
-| identity | the full proof: slot [2] is the served sha512, and a fresh checkout's `vlt ci` installs the patched minimist |
-
-So the leg neither breaks nor goes vacuous when the serve fix
-(`Cache-Control: no-transform`) deploys. As of 2026-09-26 production still
-re-gzips the artifact and the leg runs the refusal branch. Under
-`SOCKET_PATCH_HOSTED_E2E_STRICT=1` a missing `SOCKET_PATCH_VLT_E2E_JS` fails
-instead of skipping, and CI runs the leg's output through
-`scripts/check-vlt-legs.py`. `.github/workflows/vlt-serve-watchdog.yml` probes
-the same artifact every 6 hours; see [vlt compatibility](vlt-compatibility.md).
-
-## Known issues this suite surfaced
-
-All were found by running against real production; none is a test bug.
-
-### 1. `gem` — hosted mode was unusable for gems with dependencies (SERVER) — FIXED
-
-Socket's gem patch-registry used to serve a compact index whose `/info/<gem>`
-line declared **no runtime dependencies** while the `.gem` it served declared
-several, so bundler's `ensure_same_dependencies` check failed closed with
-`Bundler::APIResponseMismatchError` — hosted gem mode was unusable for any gem
-with runtime dependencies. (The suite's original pin, activestorage@7.0.2.2 /
-`2535d43d-…` / GHSA-w749-p3v6-hccq, was unpublished on 2026-08-14 pending the
-fix.)
-
-**Fixed by the 2026-08-18 gem catalog republish**: the patch-registry's compact
-index now serves the gemspec's runtime dependencies (verified against
-activestorage@6.0.3: `/versions` 200, `/info/activestorage` 200 with the full
-dep list). The leg's probe-based tolerance — pass on a non-2xx `/versions`,
-enforce on 2xx — retired itself as designed and was deleted along with its
-`SOCKET_PATCH_HOSTED_E2E_GEM_STRICT` knob; the leg is now the unconditional
-`gem_bundler_hosted_install_proof`.
-
-**Latent, still open (server)**: the registry's `/api/v1/dependencies` route
-answers 200 with an empty body. Unreachable today — bundler only falls back to
-the Dependency fetcher when the compact index is unavailable — but it would
-resurface as a confusing Marshal error if the compact index ever broke again.
-
-### 2. `pnpm` — trust configuration and cache handling
-
-The CLI now configures `trustLockfile: true` for root lockfileVersion 9 projects
-unless the project explicitly disables it or the user passes
-`--no-trust-lockfile-config`. This accepts hosted tarball URLs on pnpm >=11;
-it disables registry re-verification for the entire lock while retaining
-per-artifact integrity checks. The historical missing-warning gap is closed.
-
-An installed tree or warm store can still retain upstream bytes. Use a clean
-install tree and an empty store, then verify with `socket-patch vex`.
-`--force` alone is not a portable recovery. The required
-[pnpm compatibility matrix](pnpm-compatibility.md) tests this distinction,
-integrity rejection, peer instances, and rollback across pnpm majors 1–12.
-The production pnpm test proves installation from the public hosted service;
-it does not test the SBOM backend, dashboard badges, policies, or alert counts.
+vlt verifies the raw response body. If the patch server returns a content-encoded
+artifact, the hosted CLI refuses it with `redirect_vlt_artifact_unverifiable` and
+leaves the lock unchanged. The production leg probes the artifact using vlt's
+request headers and asserts either that refusal or, for identity encoding, the
+full fresh-checkout `vlt ci` proof.
 
-### 3. `uv.lock` — the `sdist` entry was rewritten to a wheel URL (CLI) — FIXED
-
-The uv.lock rewriter used to point the `sdist` entry at the patched wheel while
-keeping the original sdist's `size`. It now drops the entry's existing
-`sdist` / `wheel` / `wheels` / `archive` keys and writes back only the
-redirected artifact (a wheel goes in `wheels`), pinned by the urllib3 1.26.18
-unit test in `crates/socket-patch-core/src/utils/python_lock.rs`.
+`SOCKET_PATCH_VLT_HOSTED_PRODUCTION_REQUIRED=1` requires the install branch and
+fails on an encoded response. The
+[serve watchdog](../../.github/workflows/vlt-serve-watchdog.yml) monitors this
+boundary; the current run's probe, not a dated note, determines server behavior.
+The [vlt guide](vlt-compatibility.md) defines the required leg reporting.
 
 ## Running
 
 ```sh
-# everything, soft-skipping legs whose toolchain is absent
-cargo test -p socket-patch-cli --test e2e_hosted_production -- --ignored
+cargo test --locked -p socket-patch-cli --test e2e_hosted_production -- --ignored
 
-# one leg
-cargo test -p socket-patch-cli --test e2e_hosted_production -- --ignored \
-  yarn_berry_hosted_install_proof --nocapture
+# One install proof:
+cargo test --locked -p socket-patch-cli --test e2e_hosted_production -- \
+  --ignored yarn_berry_hosted_install_proof --nocapture
 ```
 
-The suite is `#[ignore]`-gated, so it stays out of the `test` and `e2e` jobs and
-runs only where it is explicitly asked for.
-
-### Environment knobs
+The suite is opt-in. Missing tools can skip local cases; use strict mode when
+coverage is required.
 
 | Variable | Effect |
-|----------|--------|
-| `SOCKET_PATCH_HOSTED_E2E_STRICT=1` | Turn every "toolchain missing" soft-skip into a hard failure. **CI sets this** — a required check must never report green on an unexercised leg. |
-| `SOCKET_PATCH_HOSTED_E2E_CANARY_STRICT=1` | Fail when cargo/maven/nuget/composer gain their first free published patch. |
-| `SOCKET_PATCH_VLT_E2E_JS` / `SOCKET_PATCH_VLT_E2E_VERSION` | The vlt release the vlt leg runs (`node <vlt.js>`, exact `--version`); CI installs 1.2.0 with `scripts/install-vlt.sh`. |
-| `SOCKET_PATCH_VLT_HOSTED_PRODUCTION_REQUIRED=1` | Fail the vlt leg while the artifact is served content-encoded. Unset until the serve fix is verified in production. |
-
-### Toolchains
-
-`npm`, `corepack` (pnpm + yarn classic + yarn berry), `bun`, `vlt` (Node ≥ 22.22), `uv`,
-`ruby` + `bundle` (**≥ 2.6** — `bundle lock --add-checksums` emits the CHECKSUMS
-section the gem rewrite pins into), `go`.
-
-### Network egress
-
-`patches-api.socket.dev`, `patch.socket.dev`, `registry.npmjs.org`, `pypi.org`,
-`files.pythonhosted.org`, `rubygems.org`.
-
-## CI: the `hosted-e2e` job
-
-Defined in `.github/workflows/ci.yml`. It is intended to be a **required** status
-check in branch protection, registered under exactly the name `hosted-e2e`.
-
-The job deliberately has **no** job-level `if:`, **no** `needs:`, **no** matrix
-and **no** `continue-on-error`. A *skipped* required check is ambiguous to branch
-protection and can wedge a PR at "Expected — waiting for status", so the job
-always runs and always reaches success or failure; the kill switch gates the
-*steps*, not the job.
-
-It retries the suite up to three times with backoff, because the public proxy
-intermittently returns 503 "Service temporarily over capacity" — the documented
-reason the older live-API suites were pulled from the PR matrix.
-
-The job installs `bun@1` through npm, so its bun leg (`bun_hosted_install_proof`)
-runs against whatever 1.x release that resolves to (a lockfileVersion-2 lock
-today). Lock-era coverage — version-0 and version-1 locks, native `bun.lockb`
-rewrites, the 1.3.10 digest boundary — lives in `ci.yml`'s hermetic
-`e2e_redirect_bun_build` legs and in `bun-compatibility.yml`; see
-[Bun compatibility](bun-compatibility.md).
-
-The job also installs vlt 1.2.0 (`scripts/install-vlt.sh`: `npm pack`, the
-tarball's sha512 checked against the registry and
-`scripts/vlt-historical-integrity.json`), exports `SOCKET_PATCH_VLT_E2E_JS`,
-`_VERSION` and `_REQUIRED=1`, checks the passing attempt's vlt leg with
-`scripts/check-vlt-legs.py`, and then runs the vendored vlt proof
-(`e2e_vendored_production -- --include-ignored vlt_pinned_matrix`) with the
-same retries. Release-era coverage lives in `ci.yml`'s `e2e` vlt rows and in
-`vlt-compatibility.yml`; see [vlt compatibility](vlt-compatibility.md).
-
-### Escape hatch — production is down and this is blocking merges
-
-Set a repository variable (Settings → Secrets and variables → Actions →
-Variables):
-
-```
-HOSTED_E2E_DISABLED = true
-```
-
-then hit **Re-run failed jobs** on any blocked PR. `vars` is read at job-run
-time, so no commit and no push is needed: the job goes green with a loud
-`::warning::` and a **BYPASSED** banner in the job summary, and every open PR
-clears on its next re-run.
-
-**Delete the variable to re-arm.** Any value other than exactly `true` (including
-`yes`, `1`, `True`) leaves the suite armed — a typo must not silently disable
-production coverage.
-
-For a single run without touching the variable: **Actions → CI → Run workflow**,
-then `hosted_e2e = force` (ignore the variable) or `skip` (bypass this run).
-
-### Turning it on
-
-The job runs as soon as this lands. Making it *required* is a one-time repo
-setting, done after the first green run on `main`:
-
-> Settings → Branches → branch protection rule for `main` → Require status
-> checks to pass → add **`hosted-e2e`**.
+| --- | --- |
+| `SOCKET_PATCH_HOSTED_E2E_STRICT=1` | Fail instead of skipping missing required toolchains |
+| `SOCKET_PATCH_HOSTED_E2E_CANARY_STRICT=1` | Fail when a watched ecosystem gains a free fixture, prompting promotion |
+| `SOCKET_PATCH_VLT_E2E_JS` / `SOCKET_PATCH_VLT_E2E_VERSION` | Select an installed, version-pinned vlt executable |
+| `SOCKET_PATCH_VLT_HOSTED_PRODUCTION_REQUIRED=1` | Require vlt's actual install proof rather than its encoding refusal |
+
+Tools include npm, Corepack for pnpm/Yarn, Bun, uv, Go, and Ruby/Bundler. The gem
+proof requires Bundler 2.6+ for lockfile checksums. vlt requires its configured
+Node runtime and executable. The workflow pins and provisions CI versions.
+Network access includes Socket's public API and patch server, npm, PyPI, and
+RubyGems registries.
+
+## CI and service outages
+
+The [`hosted-e2e` job](../../.github/workflows/ci.yml) runs independently of the
+other test jobs and retries production failures up to three times. It also runs
+the vendored vlt production proof and validates vlt leg output. Branch protection
+settings are configured separately from the workflow.
+
+During a production outage, maintainers can set the repository Actions variable
+`HOSTED_E2E_DISABLED` to exactly `true`, then rerun affected jobs. The steps report
+**BYPASSED** in the job summary; that successful job is not test evidence. Delete
+the variable to restore coverage. Manual workflow dispatch accepts `hosted_e2e`
+values `force` (ignore the variable) or `skip` (bypass that run).
diff --git a/docs/testing/npm-compatibility.md b/docs/testing/npm-compatibility.md
index d7be6fc3..e8c1a05f 100644
--- a/docs/testing/npm-compatibility.md
+++ b/docs/testing/npm-compatibility.md
@@ -26,9 +26,11 @@ npm 12 notes:
   dependencies. `allow-remote=all` is the setting a hosted redirect needs; it
   also admits any other url-resolved dependency (the per-entry sha512 pins
   stay enforced). The hosted run writes it to the project `.npmrc` (created,
-  or one appended line; ledger kind `redirect_npmrc_allow_remote`, removed by
-  `rollback` / `remove` / the vendored takeover once no package-lock entry
-  needs it), respects an explicit other value — in the project `.npmrc`, the
+  or one appended line). Hosted mode keeps no ledger. Once rollback, removal,
+  or vendored takeover removes the last hosted npm pin, an `.npmrc` containing
+  only that setting is deleted; a file with other settings is retained with
+  `npm_allow_remote_left`. The writer respects an explicit other value — in the
+  project `.npmrc`, the
   user / global / builtin npm config, or an `npm_config_allow_remote`
   environment variable (which beats every `.npmrc`) — and is disabled by
   `--no-npm-allow-remote-config`.
@@ -59,7 +61,7 @@ npm 12 notes:
 | `e2e_redirect_npm_build` (`#[ignore]`) | real | scan / get-uuid / get-ghsa hosted redirects, shrinkwrap flavor, tampered-tarball rejection, fresh-checkout `npm ci`, manifest-less VEX tail |
 | `e2e_vendor_npm_build` | real | vendor / get-vendored, shrinkwrap flavor, npm 6 × v2 lock, idempotency, byte-exact revert, manifest-less VEX tail |
 | `e2e_vex_lockfile::npm` | none | tamper / spoof / mismatch / pin cells over lockfileVersion 1, 2, 3, shrinkwrap and dual-lock shapes |
-| `redirect_npm_allow_remote` | none | the npm 12 `allow-remote` auto-config: `.npmrc` create / append (BOM, CRLF), explicit values respected (project file, user / global config, env var), unhonored spellings, bare-CR and indented-section files, section-scoped copies, opt-out flag + env, dry run, symlinked `.npmrc`, `--silent`, rollback removing exactly what was added, `remove` surfacing `redirect_npmrc_allow_remote_modified` |
+| `redirect_npm_allow_remote` | none | the npm 12 `allow-remote` auto-config: `.npmrc` create / append (BOM, CRLF), explicit values respected (project file, user / global config, env var), unhonored spellings, bare-CR and indented-section files, section-scoped copies, opt-out flag + env, dry run, symlinked `.npmrc`, `--silent`, rollback/removal deleting a standalone setting or warning `npm_allow_remote_left` when other settings remain |
 | `e2e_hosted_production` / `e2e_vendored_production` (`#[ignore]`) | real (ambient) | the same flows against production, ending in the manifest-less VEX tail |
 
 The manifest-less VEX tail (`tests/npm_e2e_common/manifestless.rs`) runs four
@@ -88,26 +90,5 @@ unreachable registry into a failure instead of a skip.
 6 cross-version cell needs an npm >= 7 to write its v2 lock: `npm` on `PATH`,
 or `SOCKET_PATCH_NPM_E2E_LOCK_WRITER_BIN`.
 
-## Local results (2026-09-22)
-
-Every row below ran both real-npm suites with `SOCKET_PATCH_NPM_E2E_REQUIRED=1`
-on Node 24.21 (macOS): all 20 legs green, 77 manifest-less VEX matrices, each
-with all four cells (manifest deleted, ledgers deleted, `--offline`, lock
-reverted) passing. Re-run 2026-09-23 after the `.npmrc` auto-config landed:
-`e2e_redirect_npm_build` on 10.9.9, 11.20.0 and 12.1.0 (every hosted flow
-installs from the committed, auto-configured `.npmrc` with a plain `npm ci`;
-the main capstone's `rollback` removes it) and `e2e_vendor_npm_build` on
-12.1.0 (no `.npmrc`), all green with every manifest-less VEX cell passing.
-
-| npm | hosted flows (scan, get uuid, get GHSA, shrinkwrap) | hosted fresh install | vendored flows | vendored fresh install |
-| --- | --- | --- | --- | --- |
-| 6.14.18 | 4 | refused EINTEGRITY (fail closed); VEX cells on the lockfile basis | v1 lock refused; npm 6 × v2-lock cell | patched (from the v2 legacy mirror) |
-| 7.0.0 | 4 | patched | vendor, get vendored, in-place VEX, shrinkwrap | patched |
-| 7.24.2 | 4 | patched | 4 | patched |
-| 8.19.4 | 4 | patched | 4 | patched |
-| 9.0.0 | 4 | patched | 4 | patched |
-| 9.9.4 | 4 | patched | 4 | patched |
-| 10.9.9 | 4 | patched | 4 | patched |
-| 11.20.0 | 4 | patched | 4 | patched |
-| 12.0.0 | 4 | EALLOWREMOTE, then patched with `allow-remote=all` (measured before the auto-config) | 4 (shrinkwrap: both locks wired) | patched |
-| 12.1.0 | 4 | patched with a plain `npm ci` from the auto-configured `.npmrc` (EALLOWREMOTE without it); `rollback` removes the `.npmrc` | 4 (shrinkwrap: both locks wired) | patched |
+Full run results belong with the source revision and toolchain versions in CI
+artifacts or a local output directory. See the [testing guide](README.md#ci-and-results).
diff --git a/docs/testing/pdm-compatibility.md b/docs/testing/pdm-compatibility.md
index 8090e4bb..4541634b 100644
--- a/docs/testing/pdm-compatibility.md
+++ b/docs/testing/pdm-compatibility.md
@@ -36,9 +36,10 @@ span-based edits, and produces byte-exact fragments for replay. The
 
 Both modes retain the package version, extras, groups, markers and the
 `content_hash`; no `pyproject.toml` edit is required. A repeated scan leaves the
-lock unchanged (idempotent). Rollback restores the recorded original
-fragments — one per patch, plus the legacy integrity-table entry — so a
-`pdm.lock` the tool rewrote returns byte-for-byte to its pre-scan state.
+lock unchanged (idempotent). Vendored rollback restores recorded fragments.
+Hosted rollback reconstructs
+upstream entries from registry metadata and may refuse after incompatible relocks;
+it does not keep the original lockfile bytes.
 Refused before any write: a `[[package]]` locked at several versions (a marker
 fork), a user-authored `url`/`path`/VCS/`editable` source, an unsupported
 `lock_version` or `strategy`, hash-less `files`, malformed hashes, and a wheel
@@ -61,11 +62,10 @@ Measured details:
   `pdm lock --refresh` and `pdm update <pkg>` re-resolve the entry back to the
   registry source. `content_hash` is unchanged by that, so `pdm lock --check`
   cannot detect the loss: re-run `socket-patch scan --mode …` after any of them,
-  or gate CI on `socket-patch vex`. A re-scan after a relock re-applies the
-  patch and **rebases** the ledger's recorded edits onto the relocked text
-  (pristine → current, never an appended chain), so `rollback` still lands on the
-  pristine lock afterwards. This matters most for CRLF locks, which PDM
-  re-renders to a different byte layout on relock.
+  or gate CI on `socket-patch vex`. Re-scan after a relock to restore patch references.
+  Vendored state records
+  reversible edits; hosted state is the lock itself, and reversal resolves
+  upstream metadata.
 - **Hosted mode verifies the lock's file hash** on install for every supported
   release (tamper the hash and `pdm sync` fails closed). Vendored mode's
   protection is the committed wheel bytes, verified by the same hash.
@@ -111,42 +111,5 @@ every Windows cell used to skip, and a run whose cells all skip or whose PDM
 bootstrap fails is now an error. The matrix needs no Socket API token (the
 `urllib3@1.26.18` patch is a free tier).
 
-> **Note (v5.0):** the "refused vendored scan still writes a `.socket/manifest.json`
-> record" observation in the notes column below describes the 4.0.0 binary the run
-> was captured with. Vendored mode is manifest-free since v5.0 — `scan --mode vendored`
-> never writes `.socket/manifest.json` — so the note disappears on the next regeneration.
-
-<!-- GENERATED:BEGIN — printed by `python3 scripts/backtest-pdm.py --render-doc-table docs/testing/pdm-compatibility/results.json`;
-     regenerate after a matrix run instead of editing by hand. -->
-
-Run captured 2026-09-18 on macOS-26.6.2-arm64-arm-64bit-Mach-O with socket-patch `socket-patch 4.0.0` (source `fixed2`, binary sha256 `b7ac2064ae2a466ab2d2bd74447ba1ae1f47b94943eab9a4310012fc253cac38`), 25 PDM releases, shapes: direct, transitive, dev, optional, extras, marker, marker-excluded, platform-linux, platform-windows, crlf, static-urls, space-unicode, dependency-groups, multi-target, two-versions, custom-lockfile, pep582.
-
-| PDM | Python | lock_version | hosted | vendored | agent | tamper rejected (H/V) | `pdm install` keeps lock (H/V) | relock keeps patch (H/V) | notes |
-| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
-| 0.8.7 | 3.8 | — | refused (11 shapes) | 10/11 (11 shapes) | 7/8 (8 shapes) | n/a / n/a | n/a / n/a | n/a / n/a | lock_version absent unsupported: refused before any write, native install intact; `__pypackages__` layout: crawler does not see it (falls through to the PATH interpreter); agent mode on a `__pypackages__` project patched the PATH interpreter's site-packages; refused vendored scan still writes a `.socket/manifest.json` record; lock-only checkout (nothing installed) is not redirected |
-| 0.12.3 | 3.8 | 2 | pass (12 shapes) | 11/12 (12 shapes) | 8/9 (9 shapes) | yes / yes | yes / yes | false / false | `__pypackages__` layout: crawler does not see it (falls through to the PATH interpreter); agent mode on a `__pypackages__` project patched the PATH interpreter's site-packages; relock dropped urllib3 1.26.18 (`transitive`: pinned resolution, no overrides on this release); re-scan then has nothing to redirect and rollback of the stale ledger exits 0/1; `pdm install` re-locked (extras,marker,marker-excluded,platform-linux,platform-windows): PDM's own freshness check flags its freshly generated lock as stale; patched install afterwards=false/true; use `pdm sync` |
-| 1.0.0 | 3.8 | 2 | pass (12 shapes) | 11/12 (12 shapes) | 8/9 (9 shapes) | yes / yes | yes / yes | false / false | `__pypackages__` layout: crawler does not see it (falls through to the PATH interpreter); agent mode on a `__pypackages__` project patched the PATH interpreter's site-packages; relock dropped urllib3 1.26.18 (`transitive`: pinned resolution, no overrides on this release); re-scan then has nothing to redirect and rollback of the stale ledger exits 0/1 |
-| 1.4.5 | 3.8 | 2 | pass (12 shapes) | 11/12 (12 shapes) | 8/9 (9 shapes) | yes / yes | yes / yes | false / false | `__pypackages__` layout: crawler does not see it (falls through to the PATH interpreter); agent mode on a `__pypackages__` project patched the PATH interpreter's site-packages; relock dropped urllib3 1.26.18 (`transitive`: pinned resolution, no overrides on this release); re-scan then has nothing to redirect and rollback of the stale ledger exits 0/1 |
-| 1.8.5 | 3.8 | 3.1 | refused (11 shapes) | 10/11 (11 shapes) | 7/8 (8 shapes) | n/a / n/a | n/a / n/a | n/a / n/a | lock_version 3.1 unsupported: refused before any write, native install intact; `__pypackages__` layout: crawler does not see it (falls through to the PATH interpreter); agent mode on a `__pypackages__` project patched the PATH interpreter's site-packages; refused vendored scan still writes a `.socket/manifest.json` record; lock-only checkout (nothing installed) is not redirected |
-| 1.12.8 | 3.8 | 3.1 | refused (12 shapes) | 11/12 (12 shapes) | 8/9 (9 shapes) | n/a / n/a | n/a / n/a | n/a / n/a | lock_version 3.1 unsupported: refused before any write, native install intact; `__pypackages__` layout: crawler does not see it (falls through to the PATH interpreter); agent mode on a `__pypackages__` project patched the PATH interpreter's site-packages; refused vendored scan still writes a `.socket/manifest.json` record; lock-only checkout (nothing installed) is not redirected |
-| 1.15.5 | 3.8 | 3.1 | refused (12 shapes) | 12/13 (13 shapes) | 8/9 (9 shapes) | n/a / n/a | n/a / n/a | n/a / n/a | lock_version 3.1 unsupported: refused before any write, native install intact; `__pypackages__` layout: crawler does not see it (falls through to the PATH interpreter); refused vendored scan still writes a `.socket/manifest.json` record; lock-only checkout (nothing installed) is not redirected |
-| 2.0.3 | 3.11 | 4.0 | refused (12 shapes) | 12/13 (13 shapes) | 8/9 (9 shapes) | n/a / n/a | n/a / n/a | n/a / n/a | lock_version 4.0 unsupported: refused before any write, native install intact; `__pypackages__` layout: crawler does not see it (falls through to the PATH interpreter); refused vendored scan still writes a `.socket/manifest.json` record; lock-only checkout (nothing installed) is not redirected |
-| 2.1.5 | 3.11 | 4.0 | refused (12 shapes) | 12/13 (13 shapes) | 8/9 (9 shapes) | n/a / n/a | n/a / n/a | n/a / n/a | lock_version 4.0 unsupported: refused before any write, native install intact; `__pypackages__` layout: crawler does not see it (falls through to the PATH interpreter); refused vendored scan still writes a `.socket/manifest.json` record; lock-only checkout (nothing installed) is not redirected |
-| 2.2.1 | 3.11 | 4.0 | refused (12 shapes) | 12/13 (13 shapes) | 8/9 (9 shapes) | n/a / n/a | n/a / n/a | n/a / n/a | lock_version 4.0 unsupported: refused before any write, native install intact; `__pypackages__` layout: crawler does not see it (falls through to the PATH interpreter); refused vendored scan still writes a `.socket/manifest.json` record; lock-only checkout (nothing installed) is not redirected |
-| 2.3.4 | 3.11 | 4.1 | refused (12 shapes) | 12/13 (13 shapes) | 8/9 (9 shapes) | n/a / n/a | n/a / n/a | n/a / n/a | lock_version 4.1 unsupported: refused before any write, native install intact; `__pypackages__` layout: crawler does not see it (falls through to the PATH interpreter); refused vendored scan still writes a `.socket/manifest.json` record; lock-only checkout (nothing installed) is not redirected |
-| 2.6.1 | 3.11 | 4.2 | refused (12 shapes) | 12/13 (13 shapes) | 8/9 (9 shapes) | n/a / n/a | n/a / n/a | n/a / n/a | lock_version 4.2 unsupported: refused before any write, native install intact; `__pypackages__` layout: crawler does not see it (falls through to the PATH interpreter); refused vendored scan still writes a `.socket/manifest.json` record; lock-only checkout (nothing installed) is not redirected |
-| 2.7.4 | 3.11 | 4.2 | refused (12 shapes) | 12/13 (13 shapes) | 8/9 (9 shapes) | n/a / n/a | n/a / n/a | n/a / n/a | lock_version 4.2 unsupported: refused before any write, native install intact; `__pypackages__` layout: crawler does not see it (falls through to the PATH interpreter); refused vendored scan still writes a `.socket/manifest.json` record; lock-only checkout (nothing installed) is not redirected |
-| 2.8.2 | 3.11 | 4.3 | pass (13 shapes) | 12/13 (13 shapes) | 8/9 (9 shapes) | yes / yes | yes / yes | false / false | `__pypackages__` layout: crawler does not see it (falls through to the PATH interpreter); refused vendored scan still writes a `.socket/manifest.json` record |
-| 2.9.3 | 3.11 | 4.3 | pass (13 shapes) | 12/13 (13 shapes) | 8/9 (9 shapes) | yes / yes | yes / yes | false / false | `__pypackages__` layout: crawler does not see it (falls through to the PATH interpreter); agent mode on a `__pypackages__` project patched the PATH interpreter's site-packages; refused vendored scan still writes a `.socket/manifest.json` record |
-| 2.10.4 | 3.11 | 4.4 | pass (13 shapes) | 12/13 (13 shapes) | 8/9 (9 shapes) | yes / yes | yes / yes | false / false | `__pypackages__` layout: crawler does not see it (falls through to the PATH interpreter); refused vendored scan still writes a `.socket/manifest.json` record |
-| 2.11.2 | 3.11 | 4.4.1 | pass (14 shapes) | 13/14 (14 shapes) | 9/10 (10 shapes) | yes / yes | yes / yes | false / false | `__pypackages__` layout: crawler does not see it (falls through to the PATH interpreter); refused vendored scan still writes a `.socket/manifest.json` record |
-| 2.12.4 | 3.11 | 4.4.1 | pass (14 shapes) | 13/14 (14 shapes) | 9/10 (10 shapes) | yes / yes | yes / yes | false / false | `__pypackages__` layout: crawler does not see it (falls through to the PATH interpreter); refused vendored scan still writes a `.socket/manifest.json` record |
-| 2.15.4 | 3.11 | 4.4.1 | pass (14 shapes) | 13/14 (14 shapes) | 9/10 (10 shapes) | yes / yes | yes / yes | false / false | `__pypackages__` layout: crawler does not see it (falls through to the PATH interpreter); refused vendored scan still writes a `.socket/manifest.json` record |
-| 2.17.3 | 3.11 | 4.5.0 | pass (16 shapes) | 15/16 (16 shapes) | 10/11 (11 shapes) | yes / yes | yes / yes | false / false | `__pypackages__` layout: crawler does not see it (falls through to the PATH interpreter); refused vendored scan still writes a `.socket/manifest.json` record |
-| 2.20.1 | 3.11 | 4.5.0 | pass (17 shapes) | 16/17 (17 shapes) | 11/12 (12 shapes) | yes / yes | yes / yes | false / false | `__pypackages__` layout: crawler does not see it (falls through to the PATH interpreter); refused vendored scan still writes a `.socket/manifest.json` record |
-| 2.22.4 | 3.12 | — | n/a | n/a | n/a | n/a / n/a | n/a / n/a | n/a / n/a | lock_version absent |
-| 2.25.9 | 3.12 | — | n/a | n/a | n/a | n/a / n/a | n/a / n/a | n/a / n/a | lock_version absent |
-| 2.27.0 | 3.13 | 4.5.0 | pass (17 shapes) | 16/17 (17 shapes) | 11/12 (12 shapes) | yes / yes | yes / yes | false / false | `__pypackages__` layout: crawler does not see it (falls through to the PATH interpreter); refused vendored scan still writes a `.socket/manifest.json` record |
-| 2.29.2 | 3.13 | 4.5.1 | pass (17 shapes) | 16/17 (17 shapes) | 11/12 (12 shapes) | yes / yes | yes / yes | false / false | `__pypackages__` layout: crawler does not see it (falls through to the PATH interpreter); refused vendored scan still writes a `.socket/manifest.json` record |
-
-<!-- GENERATED:END -->
+Full run results belong with the source revision and toolchain versions in CI
+artifacts or a local output directory. See the [testing guide](README.md#ci-and-results).
diff --git a/docs/testing/pdm-compatibility/results.json b/docs/testing/pdm-compatibility/results.json
deleted file mode 100644
index e6a84ee2..00000000
--- a/docs/testing/pdm-compatibility/results.json
+++ /dev/null
@@ -1,29124 +0,0 @@
-{
- "provenance": {
-  "capturedAt": "2026-09-18T00:43:22.692909+00:00",
-  "cliPath": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/9840a7e8-5cf9-4f42-8960-54a9c23b7cd7/scratchpad/socket-patch-fixed2",
-  "cliRevision": "fixed2",
-  "cliSha256": "b7ac2064ae2a466ab2d2bd74447ba1ae1f47b94943eab9a4310012fc253cac38",
-  "cliVersion": "socket-patch 4.0.0",
-  "hostPython": "3.14.3",
-  "modes": [
-   "hosted",
-   "vendored",
-   "agent"
-  ],
-  "patchUuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-  "pdmVersions": [
-   "0.8.7",
-   "0.12.3",
-   "1.0.0",
-   "1.4.5",
-   "1.8.5",
-   "1.12.8",
-   "1.15.5",
-   "2.0.3",
-   "2.1.5",
-   "2.2.1",
-   "2.3.4",
-   "2.6.1",
-   "2.7.4",
-   "2.8.2",
-   "2.9.3",
-   "2.10.4",
-   "2.11.2",
-   "2.12.4",
-   "2.15.4",
-   "2.17.3",
-   "2.20.1",
-   "2.22.4",
-   "2.25.9",
-   "2.27.0",
-   "2.29.2"
-  ],
-  "platform": "macOS-26.6.2-arm64-arm-64bit-Mach-O",
-  "shapes": [
-   "direct",
-   "transitive",
-   "dev",
-   "optional",
-   "extras",
-   "marker",
-   "marker-excluded",
-   "platform-linux",
-   "platform-windows",
-   "crlf",
-   "static-urls",
-   "space-unicode",
-   "dependency-groups",
-   "multi-target",
-   "two-versions",
-   "custom-lockfile",
-   "pep582"
-  ],
-  "toolsDir": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/9840a7e8-5cf9-4f42-8960-54a9c23b7cd7/scratchpad/pdm-venvs",
-  "uvVersion": "uv 0.11.19 (7b2cff1c3 2026-06-03 aarch64-apple-darwin)"
- },
- "shapes": null,
- "results": [
-  {
-   "pdm": "0.8.7",
-   "shape": "crlf",
-   "mode": "agent",
-   "outcome": "PASS",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "crlf",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "python": "3.8",
-   "expected": "refused: lock_version None is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 37
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "crlf",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "python": "3.8",
-   "expected": "refused: lock_version None is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "dev",
-   "mode": "agent",
-   "outcome": "PASS",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "dev",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "python": "3.8",
-   "expected": "refused: lock_version None is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 37
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "dev",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "python": "3.8",
-   "expected": "refused: lock_version None is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "direct",
-   "mode": "agent",
-   "outcome": "PASS",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "direct",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "python": "3.8",
-   "expected": "refused: lock_version None is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 37
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "direct",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "python": "3.8",
-   "expected": "refused: lock_version None is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "extras",
-   "mode": "agent",
-   "outcome": "PASS",
-   "python": "3.8",
-   "baselineFresh": false,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": false,
-     "exit": 0,
-     "lockStable": false
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "extras",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "python": "3.8",
-   "expected": "refused: lock_version None is not supported by the rewriter",
-   "baselineFresh": false,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 2,
-     "redirected": 0,
-     "scannedPackages": 38
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "extras",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "python": "3.8",
-   "expected": "refused: lock_version None is not supported by the rewriter",
-   "baselineFresh": false,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "marker",
-   "mode": "agent",
-   "outcome": "PASS",
-   "python": "3.8",
-   "baselineFresh": false,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": false,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "marker",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "python": "3.8",
-   "expected": "refused: lock_version None is not supported by the rewriter",
-   "baselineFresh": false,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 37
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "marker",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "python": "3.8",
-   "expected": "refused: lock_version None is not supported by the rewriter",
-   "baselineFresh": false,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "marker-excluded",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "python": "3.8",
-   "expected": "refused: lock_version None is not supported by the rewriter",
-   "baselineFresh": false,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 37
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "marker-excluded",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "python": "3.8",
-   "expected": "refused: lock_version None is not supported by the rewriter",
-   "baselineFresh": false,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "optional",
-   "mode": "agent",
-   "outcome": "PASS",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "optional",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "python": "3.8",
-   "expected": "refused: lock_version None is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 37
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "optional",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "python": "3.8",
-   "expected": "refused: lock_version None is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "pep582",
-   "mode": "agent",
-   "outcome": "UNSUPPORTED",
-   "python": "3.8",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "patchedOutsideProject": {
-     "applied": 1,
-     "crawled": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ]
-    },
-    "applied": 1,
-    "codes": [
-     "package_not_installed"
-    ],
-    "rollbackOutsideProject": {
-     "exit": 0,
-     "restored": true
-    }
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "pep582",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "python": "3.8",
-   "expected": "refused: lock_version None is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "pep582",
-   "mode": "vendored",
-   "outcome": "UNSUPPORTED",
-   "python": "3.8",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed",
-     "pypi_pdm_lock_version_unsupported",
-     "vendor_fetch_unverifiable"
-    ]
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "platform-linux",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "python": "3.8",
-   "expected": "refused: lock_version None is not supported by the rewriter",
-   "baselineFresh": false,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 37
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "platform-linux",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "python": "3.8",
-   "expected": "refused: lock_version None is not supported by the rewriter",
-   "baselineFresh": false,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "platform-windows",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "python": "3.8",
-   "expected": "refused: lock_version None is not supported by the rewriter",
-   "baselineFresh": false,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 37
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "platform-windows",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "python": "3.8",
-   "expected": "refused: lock_version None is not supported by the rewriter",
-   "baselineFresh": false,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "space-unicode",
-   "mode": "agent",
-   "outcome": "SKIP",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {}
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "space-unicode",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.8",
-   "expected": "refused: lock_version None is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 37
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "space-unicode",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.8",
-   "expected": "refused: lock_version None is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "transitive",
-   "mode": "agent",
-   "outcome": "PASS",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "transitive",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "python": "3.8",
-   "expected": "refused: lock_version None is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 5,
-     "redirected": 0,
-     "scannedPackages": 41
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "0.8.7",
-   "shape": "transitive",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "python": "3.8",
-   "expected": "refused: lock_version None is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "crlf",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "crlf",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": false,
-     "equalsOriginal": false,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 38
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "crlf",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": false,
-     "equalsOriginal": false,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "dev",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "dev",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 38
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "dev",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "direct",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "direct",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": false,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 38
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "direct",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": false,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "extras",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": false,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": false,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "extras",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": false,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": false,
-     "exit": 0,
-     "lockStable": false
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 2,
-     "redirected": 1,
-     "scannedPackages": 39
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "extras",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": false,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": false,
-     "exit": 0,
-     "lockStable": false
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "marker",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": false,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": false,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "marker",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": false,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": false,
-     "exit": 0,
-     "lockStable": false
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 38
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "marker",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": false,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": false,
-     "exit": 0,
-     "lockStable": false
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "marker-excluded",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": false,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": false,
-     "exit": 0,
-     "lockStable": false
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 38
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "marker-excluded",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": false,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": false,
-     "exit": 0,
-     "lockStable": false
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "optional",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "optional",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 38
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "optional",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "pep582",
-   "mode": "agent",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "2",
-   "python": "3.8",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "patchedOutsideProject": {
-     "applied": 1,
-     "crawled": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ]
-    },
-    "applied": 1,
-    "codes": [
-     "package_not_installed"
-    ],
-    "rollbackOutsideProject": {
-     "exit": 0,
-     "restored": true
-    }
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "pep582",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_refused",
-     "redirect_pdm_stale_install_risk"
-    ]
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "pep582",
-   "mode": "vendored",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "2",
-   "python": "3.8",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed",
-     "pypi_pdm_lock_package_missing",
-     "vendor_fetch_unverifiable"
-    ]
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "platform-linux",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": false,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": false,
-     "exit": 0,
-     "lockStable": false
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 38
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "platform-linux",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": false,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": false,
-     "exit": 0,
-     "lockStable": false
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "platform-windows",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": false,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": false,
-     "exit": 0,
-     "lockStable": false
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 38
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "platform-windows",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": false,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": false,
-     "exit": 0,
-     "lockStable": false
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "space-unicode",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "space-unicode",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 38
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "space-unicode",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "transitive",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "transitive",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": false,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "note": "relock dropped urllib3 1.26.18 from the lock; re-scan/rollback recorded only",
-     "pyprojectUnchanged": true,
-     "targetKept": false
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 5,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ],
-    "rollbackAfterRelock": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    }
-   }
-  },
-  {
-   "pdm": "0.12.3",
-   "shape": "transitive",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rescanAfterRelock": {
-     "applied": 0,
-     "codes": [
-      "package_not_installed",
-      "pypi_pdm_lock_package_missing",
-      "vendor_fetch_unverifiable"
-     ],
-     "exit": 1,
-     "patchInLock": false
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": false,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "note": "relock dropped urllib3 1.26.18 from the lock; re-scan/rollback recorded only",
-     "pyprojectUnchanged": true,
-     "targetKept": false
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ],
-    "rollbackAfterRelock": {
-     "exit": 1,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "partial_failure"
-    }
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "crlf",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "crlf",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": false,
-     "equalsOriginal": false,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 38
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "crlf",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": false,
-     "equalsOriginal": false,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "dev",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 1,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "dev",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 1,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 38
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "dev",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 1,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "direct",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "direct",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 38
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "direct",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "extras",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "extras",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 2,
-     "redirected": 1,
-     "scannedPackages": 39
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "extras",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "marker",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "marker",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 38
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "marker",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "marker-excluded",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 38
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "marker-excluded",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "optional",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "optional",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 38
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "optional",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "pep582",
-   "mode": "agent",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "2",
-   "python": "3.8",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "patchedOutsideProject": {
-     "applied": 1,
-     "crawled": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ]
-    },
-    "applied": 1,
-    "codes": [
-     "package_not_installed"
-    ],
-    "rollbackOutsideProject": {
-     "exit": 0,
-     "restored": true
-    }
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "pep582",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 1,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_refused",
-     "redirect_pdm_stale_install_risk"
-    ]
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "pep582",
-   "mode": "vendored",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "2",
-   "python": "3.8",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed",
-     "pypi_pdm_lock_package_missing",
-     "vendor_fetch_unverifiable"
-    ]
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "platform-linux",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 38
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "platform-linux",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "platform-windows",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 38
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "platform-windows",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "space-unicode",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "space-unicode",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 38
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "space-unicode",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "transitive",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "transitive",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": false,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "note": "relock dropped urllib3 1.26.18 from the lock; re-scan/rollback recorded only",
-     "pyprojectUnchanged": true,
-     "targetKept": false
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 5,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ],
-    "rollbackAfterRelock": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    }
-   }
-  },
-  {
-   "pdm": "1.0.0",
-   "shape": "transitive",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rescanAfterRelock": {
-     "applied": 0,
-     "codes": [
-      "package_not_installed",
-      "pypi_pdm_lock_package_missing",
-      "vendor_fetch_unverifiable"
-     ],
-     "exit": 1,
-     "patchInLock": false
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": false,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "note": "relock dropped urllib3 1.26.18 from the lock; re-scan/rollback recorded only",
-     "pyprojectUnchanged": true,
-     "targetKept": false
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ],
-    "rollbackAfterRelock": {
-     "exit": 1,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "partial_failure"
-    }
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "crlf",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "crlf",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": false,
-     "equalsOriginal": false,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 47
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "crlf",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": false,
-     "equalsOriginal": false,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "dev",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "dev",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 47
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "dev",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "direct",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "direct",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 47
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "direct",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "extras",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "extras",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 2,
-     "redirected": 1,
-     "scannedPackages": 48
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "extras",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "marker",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "marker",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 47
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "marker",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "marker-excluded",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 47
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "marker-excluded",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "optional",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "optional",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 47
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "optional",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "pep582",
-   "mode": "agent",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "2",
-   "python": "3.8",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "patchedOutsideProject": {
-     "applied": 2,
-     "crawled": [
-      "pkg:pypi/jaraco-context@6.0.1",
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ]
-    },
-    "applied": 2,
-    "codes": [
-     "package_not_installed"
-    ],
-    "rollbackOutsideProject": {
-     "exit": 0,
-     "restored": true
-    }
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "pep582",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_refused",
-     "redirect_pdm_stale_install_risk"
-    ]
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "pep582",
-   "mode": "vendored",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "2",
-   "python": "3.8",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed",
-     "pypi_pdm_lock_package_missing",
-     "vendor_fetch_unverifiable"
-    ]
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "platform-linux",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 47
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "platform-linux",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "platform-windows",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 47
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "platform-windows",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "space-unicode",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "space-unicode",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 47
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "space-unicode",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "pypi_pdm_legacy_sync_required",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "transitive",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "transitive",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": false,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "note": "relock dropped urllib3 1.26.18 from the lock; re-scan/rollback recorded only",
-     "pyprojectUnchanged": true,
-     "targetKept": false
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_legacy_sync_required",
-      "redirect_pdm_refused",
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@1.26.20"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 5,
-     "redirected": 1,
-     "scannedPackages": 51
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_legacy_sync_required",
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ],
-    "rollbackAfterRelock": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    }
-   }
-  },
-  {
-   "pdm": "1.4.5",
-   "shape": "transitive",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "2",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rescanAfterRelock": {
-     "applied": 0,
-     "codes": [
-      "package_not_installed",
-      "pypi_pdm_lock_package_missing",
-      "vendor_fetch_unverifiable"
-     ],
-     "exit": 1,
-     "patchInLock": false
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": false,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "note": "relock dropped urllib3 1.26.18 from the lock; re-scan/rollback recorded only",
-     "pyprojectUnchanged": true,
-     "targetKept": false
-    },
-    "applied": 1,
-    "codes": [
-     "pypi_pdm_legacy_sync_required",
-     "vendor_prebuilt_downloaded"
-    ],
-    "rollbackAfterRelock": {
-     "exit": 1,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "partial_failure"
-    }
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "crlf",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "crlf",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@2.2.3"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 35
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "crlf",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "custom-lockfile",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.8",
-   "info": {}
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "custom-lockfile",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.8",
-   "info": {}
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "dev",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "dev",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@2.2.3"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 35
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "dev",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "direct",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "direct",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@2.2.3"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 35
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "direct",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "extras",
-   "mode": "agent",
-   "outcome": "SKIP",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {}
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "extras",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@2.2.3"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 2,
-     "redirected": 0,
-     "scannedPackages": 36
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "extras",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "marker",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "marker",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@2.2.3"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 35
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "marker",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "marker-excluded",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@2.2.3"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 35
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "marker-excluded",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "optional",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "optional",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@2.2.3"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 35
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "optional",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "pep582",
-   "mode": "agent",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "patchedOutsideProject": {
-     "applied": 1,
-     "crawled": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@2.2.3"
-     ]
-    },
-    "applied": 1,
-    "codes": [
-     "package_not_installed"
-    ],
-    "rollbackOutsideProject": {
-     "exit": 0,
-     "restored": true
-    }
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "pep582",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "pep582",
-   "mode": "vendored",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed",
-     "pypi_pdm_lock_version_unsupported",
-     "vendor_fetch_unverifiable"
-    ]
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "platform-linux",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@2.2.3"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 35
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "platform-linux",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "platform-windows",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@2.2.3"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 35
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "platform-windows",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "space-unicode",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "space-unicode",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@2.2.3"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 35
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "space-unicode",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "transitive",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "transitive",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@2.2.3"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 4,
-     "redirected": 0,
-     "scannedPackages": 38
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.8.5",
-   "shape": "transitive",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "crlf",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "crlf",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@2.2.3"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 36
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "crlf",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "custom-lockfile",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.8",
-   "info": {}
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "custom-lockfile",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.8",
-   "info": {}
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "dev",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "dev",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@2.2.3"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 36
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "dev",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "direct",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "direct",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@2.2.3"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 36
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "direct",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "extras",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "extras",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@2.2.3"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 2,
-     "redirected": 0,
-     "scannedPackages": 37
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "extras",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "marker",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "marker",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@2.2.3"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 36
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "marker",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "marker-excluded",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@2.2.3"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 36
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "marker-excluded",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "optional",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "optional",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@2.2.3"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 36
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "optional",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "pep582",
-   "mode": "agent",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "patchedOutsideProject": {
-     "applied": 1,
-     "crawled": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@2.2.3"
-     ]
-    },
-    "applied": 1,
-    "codes": [
-     "package_not_installed"
-    ],
-    "rollbackOutsideProject": {
-     "exit": 0,
-     "restored": true
-    }
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "pep582",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "pep582",
-   "mode": "vendored",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed",
-     "pypi_pdm_lock_version_unsupported",
-     "vendor_fetch_unverifiable"
-    ]
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "platform-linux",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@2.2.3"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 36
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "platform-linux",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "platform-windows",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@2.2.3"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 36
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "platform-windows",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "space-unicode",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "space-unicode",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@2.2.3"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 36
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "space-unicode",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "transitive",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "transitive",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@2.2.3"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 4,
-     "redirected": 0,
-     "scannedPackages": 39
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.12.8",
-   "shape": "transitive",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "crlf",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "crlf",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 25
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "crlf",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "custom-lockfile",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [],
-     "exit": 0,
-     "lockfileOnlyPackages": 0,
-     "redirected": 0,
-     "scannedPackages": 24
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "custom-lockfile",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_no_lockfile"
-    ]
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "dev",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "dev",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 25
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "dev",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "direct",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "direct",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 25
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "direct",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "extras",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "extras",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 2,
-     "redirected": 0,
-     "scannedPackages": 26
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "extras",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "marker",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "marker",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 25
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "marker",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "marker-excluded",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 25
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "marker-excluded",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "optional",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "optional",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 25
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "optional",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "pep582",
-   "mode": "agent",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed"
-    ]
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "pep582",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "pep582",
-   "mode": "vendored",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed",
-     "vendor_fetch_unverifiable"
-    ]
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "platform-linux",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 25
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "platform-linux",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "platform-windows",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 25
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "platform-windows",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "space-unicode",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "space-unicode",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 25
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "space-unicode",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "transitive",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "transitive",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 5,
-     "redirected": 0,
-     "scannedPackages": 29
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "1.15.5",
-   "shape": "transitive",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "3.1",
-   "python": "3.8",
-   "expected": "refused: lock_version '3.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "crlf",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "crlf",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 44
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "crlf",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "custom-lockfile",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [],
-     "exit": 0,
-     "lockfileOnlyPackages": 0,
-     "redirected": 0,
-     "scannedPackages": 43
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "custom-lockfile",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_no_lockfile"
-    ]
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "dev",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "dev",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 44
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "dev",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "direct",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "direct",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 44
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "direct",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "extras",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "extras",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 2,
-     "redirected": 0,
-     "scannedPackages": 45
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "extras",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "marker",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "marker",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 44
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "marker",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "marker-excluded",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 44
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "marker-excluded",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "optional",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "optional",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 44
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "optional",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "pep582",
-   "mode": "agent",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed"
-    ]
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "pep582",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "pep582",
-   "mode": "vendored",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed",
-     "vendor_fetch_unverifiable"
-    ]
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "platform-linux",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 44
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "platform-linux",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "platform-windows",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 44
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "platform-windows",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "space-unicode",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "space-unicode",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 44
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "space-unicode",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "transitive",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "transitive",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 5,
-     "redirected": 0,
-     "scannedPackages": 48
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.0.3",
-   "shape": "transitive",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "crlf",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "crlf",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 43
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "crlf",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "custom-lockfile",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [],
-     "exit": 0,
-     "lockfileOnlyPackages": 0,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "custom-lockfile",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_no_lockfile"
-    ]
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "dev",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "dev",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 43
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "dev",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "direct",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "direct",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 43
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "direct",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "extras",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "extras",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 2,
-     "redirected": 0,
-     "scannedPackages": 44
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "extras",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "marker",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "marker",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 43
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "marker",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "marker-excluded",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 43
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "marker-excluded",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "optional",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "optional",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 43
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "optional",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "pep582",
-   "mode": "agent",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed"
-    ]
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "pep582",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "pep582",
-   "mode": "vendored",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed",
-     "vendor_fetch_unverifiable"
-    ]
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "platform-linux",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 43
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "platform-linux",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "platform-windows",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 43
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "platform-windows",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "space-unicode",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "space-unicode",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 43
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "space-unicode",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "transitive",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "transitive",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 5,
-     "redirected": 0,
-     "scannedPackages": 47
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.1.5",
-   "shape": "transitive",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "crlf",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "crlf",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 43
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "crlf",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "custom-lockfile",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [],
-     "exit": 0,
-     "lockfileOnlyPackages": 0,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "custom-lockfile",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_no_lockfile"
-    ]
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "dev",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "dev",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 43
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "dev",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "direct",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "direct",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 43
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "direct",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "extras",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "extras",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 2,
-     "redirected": 0,
-     "scannedPackages": 44
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "extras",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "marker",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "marker",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 43
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "marker",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "marker-excluded",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 43
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "marker-excluded",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "optional",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "optional",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 43
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "optional",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "pep582",
-   "mode": "agent",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed"
-    ]
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "pep582",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "pep582",
-   "mode": "vendored",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed",
-     "vendor_fetch_unverifiable"
-    ]
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "platform-linux",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 43
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "platform-linux",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "platform-windows",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 43
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "platform-windows",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "space-unicode",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "space-unicode",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 43
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "space-unicode",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "transitive",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "transitive",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 5,
-     "redirected": 0,
-     "scannedPackages": 47
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.2.1",
-   "shape": "transitive",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.0",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.0' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "crlf",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "crlf",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "crlf",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "custom-lockfile",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [],
-     "exit": 0,
-     "lockfileOnlyPackages": 0,
-     "redirected": 0,
-     "scannedPackages": 41
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "custom-lockfile",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_no_lockfile"
-    ]
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "dev",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "dev",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "dev",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "direct",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "direct",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "direct",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "extras",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "extras",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 2,
-     "redirected": 0,
-     "scannedPackages": 43
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "extras",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "marker",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "marker",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "marker",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "marker-excluded",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "marker-excluded",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "optional",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "optional",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "optional",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "pep582",
-   "mode": "agent",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed"
-    ]
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "pep582",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "pep582",
-   "mode": "vendored",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed",
-     "vendor_fetch_unverifiable"
-    ]
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "platform-linux",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "platform-linux",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "platform-windows",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "platform-windows",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "space-unicode",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "space-unicode",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "space-unicode",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "transitive",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "transitive",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 5,
-     "redirected": 0,
-     "scannedPackages": 46
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.3.4",
-   "shape": "transitive",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.1",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.1' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "crlf",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "crlf",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "crlf",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "custom-lockfile",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [],
-     "exit": 0,
-     "lockfileOnlyPackages": 0,
-     "redirected": 0,
-     "scannedPackages": 41
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "custom-lockfile",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_no_lockfile"
-    ]
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "dev",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "dev",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "dev",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "direct",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "direct",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "direct",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "extras",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "extras",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 2,
-     "redirected": 0,
-     "scannedPackages": 43
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "extras",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "marker",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "marker",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "marker",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "marker-excluded",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "marker-excluded",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "optional",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "optional",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "optional",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "pep582",
-   "mode": "agent",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed"
-    ]
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "pep582",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "pep582",
-   "mode": "vendored",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed",
-     "vendor_fetch_unverifiable"
-    ]
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "platform-linux",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "platform-linux",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "platform-windows",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "platform-windows",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "space-unicode",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "space-unicode",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "space-unicode",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "transitive",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "transitive",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 5,
-     "redirected": 0,
-     "scannedPackages": 46
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.6.1",
-   "shape": "transitive",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "crlf",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "crlf",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "crlf",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "custom-lockfile",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [],
-     "exit": 0,
-     "lockfileOnlyPackages": 0,
-     "redirected": 0,
-     "scannedPackages": 41
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "custom-lockfile",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_no_lockfile"
-    ]
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "dev",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "dev",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "dev",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "direct",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "direct",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "direct",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "extras",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "extras",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 2,
-     "redirected": 0,
-     "scannedPackages": 43
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "extras",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "marker",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "marker",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "marker",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "marker-excluded",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "marker-excluded",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "optional",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "optional",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "optional",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "pep582",
-   "mode": "agent",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed"
-    ]
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "pep582",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "pep582",
-   "mode": "vendored",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed",
-     "vendor_fetch_unverifiable"
-    ]
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "platform-linux",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "platform-linux",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "platform-windows",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "platform-windows",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "space-unicode",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "space-unicode",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "space-unicode",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "transitive",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "transitive",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 5,
-     "redirected": 0,
-     "scannedPackages": 46
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.7.4",
-   "shape": "transitive",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.2",
-   "python": "3.11",
-   "expected": "refused: lock_version '4.2' is not supported by the rewriter",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_lock_version_unsupported"
-    ]
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "crlf",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "crlf",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": true,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "crlf",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": true,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "custom-lockfile",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [],
-     "exit": 0,
-     "lockfileOnlyPackages": 0,
-     "redirected": 0,
-     "scannedPackages": 41
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "custom-lockfile",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_no_lockfile"
-    ]
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "dev",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "dev",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "dev",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "direct",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "direct",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "direct",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "extras",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "extras",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 2,
-     "redirected": 1,
-     "scannedPackages": 43
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "extras",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "marker",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "marker",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "marker",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "marker-excluded",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "marker-excluded",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "optional",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "optional",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "optional",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "pep582",
-   "mode": "agent",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed"
-    ]
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "pep582",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk"
-    ]
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "pep582",
-   "mode": "vendored",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed",
-     "vendor_fetch_unverifiable"
-    ]
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "platform-linux",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "platform-linux",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "platform-windows",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "platform-windows",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "space-unicode",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "space-unicode",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "space-unicode",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "transitive",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "transitive",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 5,
-     "redirected": 1,
-     "scannedPackages": 46
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.8.2",
-   "shape": "transitive",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "crlf",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "crlf",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": true,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 0,
-     "redirected": 1,
-     "scannedPackages": 45
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "crlf",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": true,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "custom-lockfile",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 0,
-     "redirected": 0,
-     "scannedPackages": 45
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "custom-lockfile",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_no_lockfile"
-    ]
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "dev",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "dev",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 0,
-     "redirected": 1,
-     "scannedPackages": 45
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "dev",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "direct",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "direct",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 0,
-     "redirected": 1,
-     "scannedPackages": 45
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "direct",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "extras",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "extras",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 46
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "extras",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "marker",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "marker",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 0,
-     "redirected": 1,
-     "scannedPackages": 45
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "marker",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "marker-excluded",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 0,
-     "redirected": 1,
-     "scannedPackages": 45
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "marker-excluded",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "optional",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "optional",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 0,
-     "redirected": 1,
-     "scannedPackages": 45
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "optional",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "pep582",
-   "mode": "agent",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "patchedOutsideProject": {
-     "applied": 1,
-     "crawled": [
-      "pkg:pypi/urllib3@1.26.18"
-     ]
-    },
-    "applied": 1,
-    "codes": [],
-    "rollbackOutsideProject": {
-     "exit": 0,
-     "restored": true
-    }
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "pep582",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk"
-    ]
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "pep582",
-   "mode": "vendored",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "patchedOutsideProject": {
-     "applied": 1,
-     "crawled": [
-      "pkg:pypi/urllib3@1.26.18"
-     ]
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ],
-    "rollbackOutsideProject": {
-     "exit": 0,
-     "restored": true
-    }
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "platform-linux",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 0,
-     "redirected": 1,
-     "scannedPackages": 45
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "platform-linux",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "platform-windows",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 0,
-     "redirected": 1,
-     "scannedPackages": 45
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "platform-windows",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "space-unicode",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "space-unicode",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 0,
-     "redirected": 1,
-     "scannedPackages": 45
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "space-unicode",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "transitive",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "transitive",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 4,
-     "redirected": 1,
-     "scannedPackages": 49
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.9.3",
-   "shape": "transitive",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.3",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "crlf",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "crlf",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": true,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 43
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "crlf",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": true,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "custom-lockfile",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [],
-     "exit": 0,
-     "lockfileOnlyPackages": 0,
-     "redirected": 0,
-     "scannedPackages": 42
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "custom-lockfile",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_no_lockfile"
-    ]
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "dev",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "dev",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 43
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "dev",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "direct",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "direct",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 43
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "direct",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "extras",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "extras",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 2,
-     "redirected": 1,
-     "scannedPackages": 44
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "extras",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "marker",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "marker",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 43
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "marker",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "marker-excluded",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 43
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "marker-excluded",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "optional",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "optional",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 43
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "optional",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "pep582",
-   "mode": "agent",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed"
-    ]
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "pep582",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk"
-    ]
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "pep582",
-   "mode": "vendored",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed",
-     "vendor_fetch_unverifiable"
-    ]
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "platform-linux",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 43
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "platform-linux",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "platform-windows",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk",
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 43
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "platform-windows",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "space-unicode",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "space-unicode",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 43
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "space-unicode",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "transitive",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "transitive",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_stale_install_risk"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 5,
-     "redirected": 1,
-     "scannedPackages": 47
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pdm_stale_install_risk",
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.10.4",
-   "shape": "transitive",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "crlf",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "crlf",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": true,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 44
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "crlf",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": true,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "custom-lockfile",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [],
-     "exit": 0,
-     "lockfileOnlyPackages": 0,
-     "redirected": 0,
-     "scannedPackages": 43
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "custom-lockfile",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_no_lockfile"
-    ]
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "dev",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "dev",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 44
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "dev",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "direct",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "direct",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 44
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "direct",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "extras",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "extras",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 2,
-     "redirected": 1,
-     "scannedPackages": 45
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "extras",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "marker",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "marker",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 44
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "marker",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "marker-excluded",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 44
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "marker-excluded",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "optional",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "optional",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 44
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "optional",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "pep582",
-   "mode": "agent",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed"
-    ]
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "pep582",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "pep582",
-   "mode": "vendored",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed",
-     "vendor_fetch_unverifiable"
-    ]
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "platform-linux",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 44
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "platform-linux",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "platform-windows",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 44
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "platform-windows",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "space-unicode",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "space-unicode",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 44
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "space-unicode",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "static-urls",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "static-urls",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 44
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "static-urls",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "transitive",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "transitive",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 5,
-     "redirected": 1,
-     "scannedPackages": 48
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.11.2",
-   "shape": "transitive",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "crlf",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "crlf",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": true,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 44
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "crlf",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": true,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "custom-lockfile",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [],
-     "exit": 0,
-     "lockfileOnlyPackages": 0,
-     "redirected": 0,
-     "scannedPackages": 43
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "custom-lockfile",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_no_lockfile"
-    ]
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "dev",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "dev",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 44
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "dev",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "direct",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "direct",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 44
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "direct",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "extras",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "extras",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 2,
-     "redirected": 1,
-     "scannedPackages": 45
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "extras",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "marker",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "marker",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 44
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "marker",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "marker-excluded",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 44
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "marker-excluded",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "optional",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "optional",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 44
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "optional",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "pep582",
-   "mode": "agent",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed"
-    ]
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "pep582",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "pep582",
-   "mode": "vendored",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed",
-     "vendor_fetch_unverifiable"
-    ]
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "platform-linux",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 44
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "platform-linux",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "platform-windows",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 44
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "platform-windows",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "space-unicode",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "space-unicode",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 44
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "space-unicode",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "static-urls",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "static-urls",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 44
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "static-urls",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "transitive",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "transitive",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 5,
-     "redirected": 1,
-     "scannedPackages": 48
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.12.4",
-   "shape": "transitive",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "crlf",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "crlf",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": true,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "crlf",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": true,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "custom-lockfile",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [],
-     "exit": 0,
-     "lockfileOnlyPackages": 0,
-     "redirected": 0,
-     "scannedPackages": 41
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "custom-lockfile",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_no_lockfile"
-    ]
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "dev",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "dev",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "dev",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "direct",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "direct",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "direct",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "extras",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "extras",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 2,
-     "redirected": 1,
-     "scannedPackages": 43
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "extras",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "marker",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "marker",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "marker",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "marker-excluded",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "marker-excluded",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "optional",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "optional",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "optional",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "pep582",
-   "mode": "agent",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed"
-    ]
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "pep582",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "pep582",
-   "mode": "vendored",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed",
-     "vendor_fetch_unverifiable"
-    ]
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "platform-linux",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "platform-linux",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "platform-windows",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "platform-windows",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "space-unicode",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "space-unicode",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "space-unicode",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "static-urls",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "static-urls",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "static-urls",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "transitive",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "transitive",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 5,
-     "redirected": 1,
-     "scannedPackages": 46
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.15.4",
-   "shape": "transitive",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.4.1",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "crlf",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "crlf",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": true,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "crlf",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": true,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "custom-lockfile",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [],
-     "exit": 0,
-     "lockfileOnlyPackages": 0,
-     "redirected": 0,
-     "scannedPackages": 41
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "custom-lockfile",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_no_lockfile"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "dev",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "dev",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "dev",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "direct",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "direct",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "direct",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "extras",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "extras",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 2,
-     "redirected": 1,
-     "scannedPackages": 43
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "extras",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "marker",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "marker",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "marker",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "marker-excluded",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "marker-excluded",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "multi-target",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "multi-target",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "multi-target",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "optional",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "optional",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "optional",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "pep582",
-   "mode": "agent",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "pep582",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "pep582",
-   "mode": "vendored",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed",
-     "vendor_fetch_unverifiable"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "platform-linux",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "platform-linux",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "platform-windows",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "platform-windows",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "space-unicode",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "space-unicode",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "space-unicode",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "static-urls",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "static-urls",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "static-urls",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "transitive",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "transitive",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 5,
-     "redirected": 1,
-     "scannedPackages": 46
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "transitive",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "two-versions",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "expected": "refused: two locked urllib3 versions (forked package)",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@2.2.3"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 2,
-     "redirected": 0,
-     "scannedPackages": 43
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.17.3",
-   "shape": "two-versions",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "expected": "refused: two locked urllib3 versions (forked package)",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-     "pkg:pypi/urllib3@2.2.3?artifact_id=py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "package_not_installed",
-     "pypi_pdm_lock_forked_package",
-     "vendor_fetch_unverifiable"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "crlf",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "crlf",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": true,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "crlf",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": true,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "custom-lockfile",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [],
-     "exit": 0,
-     "lockfileOnlyPackages": 0,
-     "redirected": 0,
-     "scannedPackages": 41
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "custom-lockfile",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_no_lockfile"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "dependency-groups",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "dependency-groups",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "dependency-groups",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "dev",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "dev",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "dev",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "direct",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "direct",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "direct",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "extras",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "extras",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 2,
-     "redirected": 1,
-     "scannedPackages": 43
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "extras",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "marker",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "marker",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "marker",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "marker-excluded",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "marker-excluded",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "multi-target",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "multi-target",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "multi-target",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "optional",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "optional",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "optional",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "pep582",
-   "mode": "agent",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "pep582",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "pep582",
-   "mode": "vendored",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed",
-     "vendor_fetch_unverifiable"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "platform-linux",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "platform-linux",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "platform-windows",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "platform-windows",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "space-unicode",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "space-unicode",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "space-unicode",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "static-urls",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "static-urls",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 42
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "static-urls",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "transitive",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "transitive",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 5,
-     "redirected": 1,
-     "scannedPackages": 46
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "transitive",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "two-versions",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "expected": "refused: two locked urllib3 versions (forked package)",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@2.2.3"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 2,
-     "redirected": 0,
-     "scannedPackages": 43
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.20.1",
-   "shape": "two-versions",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.5.0",
-   "python": "3.11",
-   "expected": "refused: two locked urllib3 versions (forked package)",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-     "pkg:pypi/urllib3@2.2.3?artifact_id=py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "package_not_installed",
-     "pypi_pdm_lock_forked_package",
-     "vendor_fetch_unverifiable"
-    ]
-   }
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "crlf",
-   "mode": "agent",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "crlf",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "crlf",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "custom-lockfile",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "custom-lockfile",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "dependency-groups",
-   "mode": "agent",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "dependency-groups",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "dependency-groups",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "dev",
-   "mode": "agent",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "dev",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "dev",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "direct",
-   "mode": "agent",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "direct",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "direct",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "extras",
-   "mode": "agent",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "extras",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "extras",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "marker",
-   "mode": "agent",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "marker",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "marker",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "marker-excluded",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "marker-excluded",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "multi-target",
-   "mode": "agent",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "multi-target",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "multi-target",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "optional",
-   "mode": "agent",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "optional",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "optional",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "pep582",
-   "mode": "agent",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "pep582",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "pep582",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "platform-linux",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "platform-linux",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "platform-windows",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "platform-windows",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "space-unicode",
-   "mode": "agent",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "space-unicode",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "space-unicode",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "static-urls",
-   "mode": "agent",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "static-urls",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "static-urls",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "transitive",
-   "mode": "agent",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "transitive",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "transitive",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "two-versions",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.22.4",
-   "shape": "two-versions",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "crlf",
-   "mode": "agent",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "crlf",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "crlf",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "custom-lockfile",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "custom-lockfile",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "dependency-groups",
-   "mode": "agent",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "dependency-groups",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "dependency-groups",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "dev",
-   "mode": "agent",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "dev",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "dev",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "direct",
-   "mode": "agent",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "direct",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "direct",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "extras",
-   "mode": "agent",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "extras",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "extras",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "marker",
-   "mode": "agent",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "marker",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "marker",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "marker-excluded",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "marker-excluded",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "multi-target",
-   "mode": "agent",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "multi-target",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "multi-target",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "optional",
-   "mode": "agent",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "optional",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "optional",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "pep582",
-   "mode": "agent",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "pep582",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "pep582",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "platform-linux",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "platform-linux",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "platform-windows",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "platform-windows",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "space-unicode",
-   "mode": "agent",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "space-unicode",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "space-unicode",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "static-urls",
-   "mode": "agent",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "static-urls",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "static-urls",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "transitive",
-   "mode": "agent",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "transitive",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "transitive",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "two-versions",
-   "mode": "hosted",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.25.9",
-   "shape": "two-versions",
-   "mode": "vendored",
-   "outcome": "SKIP",
-   "python": "3.12",
-   "info": {}
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "crlf",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "crlf",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": false,
-     "equalsOriginal": false,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 45
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "crlf",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": false,
-     "equalsOriginal": false,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "custom-lockfile",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [],
-     "exit": 0,
-     "lockfileOnlyPackages": 0,
-     "redirected": 0,
-     "scannedPackages": 44
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "custom-lockfile",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_no_lockfile"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "dependency-groups",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "dependency-groups",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 45
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "dependency-groups",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "dev",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "dev",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 45
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "dev",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "direct",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "direct",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 45
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "direct",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "extras",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "extras",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 2,
-     "redirected": 1,
-     "scannedPackages": 46
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "extras",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "marker",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "marker",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 45
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "marker",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "marker-excluded",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 45
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "marker-excluded",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "multi-target",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "multi-target",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 45
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "multi-target",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "optional",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "optional",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 45
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "optional",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "pep582",
-   "mode": "agent",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "pep582",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "pep582",
-   "mode": "vendored",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed",
-     "vendor_fetch_unverifiable"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "platform-linux",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 45
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "platform-linux",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "platform-windows",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 45
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "platform-windows",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "space-unicode",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "space-unicode",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 45
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "space-unicode",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "static-urls",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "static-urls",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 45
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "static-urls",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "transitive",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "transitive",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 5,
-     "redirected": 1,
-     "scannedPackages": 49
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "transitive",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "two-versions",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "expected": "refused: two locked urllib3 versions (forked package)",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@2.2.3"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 2,
-     "redirected": 0,
-     "scannedPackages": 46
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.27.0",
-   "shape": "two-versions",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.5.0",
-   "python": "3.13",
-   "expected": "refused: two locked urllib3 versions (forked package)",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-     "pkg:pypi/urllib3@2.2.3?artifact_id=py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "package_not_installed",
-     "pypi_pdm_lock_forked_package",
-     "vendor_fetch_unverifiable"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "crlf",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "crlf",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": false,
-     "equalsOriginal": false,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 49
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "crlf",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": false,
-     "equalsOriginal": false,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "custom-lockfile",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [],
-     "exit": 0,
-     "lockfileOnlyPackages": 0,
-     "redirected": 0,
-     "scannedPackages": 48
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "custom-lockfile",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "expected": "no-op: the CLI only reads pdm.lock",
-   "baselineFresh": false,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "pypi_pdm_no_lockfile"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "dependency-groups",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "dependency-groups",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 49
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "dependency-groups",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "dev",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "dev",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 49
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "dev",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "direct",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "direct",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 49
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "direct",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "extras",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "extras",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 2,
-     "redirected": 1,
-     "scannedPackages": 50
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "extras",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "marker",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "marker",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 49
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "marker",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "marker-excluded",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 49
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "marker-excluded",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "multi-target",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "multi-target",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 49
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "multi-target",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "optional",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "optional",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 49
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "optional",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "pep582",
-   "mode": "agent",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "pep582",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "pep582",
-   "mode": "vendored",
-   "outcome": "UNSUPPORTED",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "expected": "PDM `__pypackages__` layout: agent/vendored cannot verify the install (use hosted, or set `python.use_venv`)",
-   "baselineFresh": true,
-   "info": {
-    "applied": 0,
-    "codes": [
-     "package_not_installed",
-     "vendor_fetch_unverifiable"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "platform-linux",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 49
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "platform-linux",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "platform-windows",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "redirect_pypi_stale_install"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 49
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "platform-windows",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": false,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "space-unicode",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "space-unicode",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 49
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "space-unicode",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "static-urls",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "static-urls",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 1,
-     "redirected": 1,
-     "scannedPackages": 49
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "static-urls",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "transitive",
-   "mode": "agent",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "applied": 1,
-    "codes": []
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "transitive",
-   "mode": "hosted",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "lockOnlyHosted": {
-     "codes": [],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 5,
-     "redirected": 1,
-     "scannedPackages": 53
-    },
-    "applied": 1,
-    "codes": [
-     "redirect_pypi_stale_install"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "transitive",
-   "mode": "vendored",
-   "outcome": "PASS",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "baselineFresh": true,
-   "info": {
-    "tamper": {
-     "installExit": 1,
-     "installedPatchedAnyway": false,
-     "mentionsHash": true
-    },
-    "ordinaryInstall": {
-     "baselineFresh": true,
-     "exit": 0,
-     "lockStable": true
-    },
-    "ordinaryInstallPatched": true,
-    "rollbackAfterRelockPristine": {
-     "exit": 0,
-     "failed": [],
-     "lockEqualsRelocked": true,
-     "status": "success"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "codes": [
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0,
-     "patchInLock": true
-    },
-    "relock": {
-     "crlfKept": null,
-     "equalsOriginal": true,
-     "exit": 0,
-     "keepsPatch": false,
-     "lockBytesUnchanged": false,
-     "pyprojectUnchanged": true,
-     "targetKept": true
-    },
-    "applied": 1,
-    "codes": [
-     "vendor_prebuilt_downloaded"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "two-versions",
-   "mode": "hosted",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "expected": "refused: two locked urllib3 versions (forked package)",
-   "baselineFresh": true,
-   "info": {
-    "lockOnlyHosted": {
-     "codes": [
-      "redirect_pdm_refused"
-     ],
-     "crawledUrllib3": [
-      "pkg:pypi/urllib3@1.26.18",
-      "pkg:pypi/urllib3@2.2.3"
-     ],
-     "exit": 0,
-     "lockfileOnlyPackages": 2,
-     "redirected": 0,
-     "scannedPackages": 50
-    },
-    "manifestLeftover": [],
-    "applied": 0,
-    "codes": [
-     "redirect_pdm_refused"
-    ]
-   }
-  },
-  {
-   "pdm": "2.29.2",
-   "shape": "two-versions",
-   "mode": "vendored",
-   "outcome": "REFUSED-EXPECTED",
-   "lockVersion": "4.5.1",
-   "python": "3.13",
-   "expected": "refused: two locked urllib3 versions (forked package)",
-   "baselineFresh": true,
-   "info": {
-    "manifestLeftover": [
-     "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-     "pkg:pypi/urllib3@2.2.3?artifact_id=py3-none-any-whl"
-    ],
-    "applied": 0,
-    "codes": [
-     "package_not_installed",
-     "pypi_pdm_lock_forked_package",
-     "vendor_fetch_unverifiable"
-    ]
-   }
-  }
- ],
- "errors": []
-}
\ No newline at end of file
diff --git a/docs/testing/pipenv-compatibility.md b/docs/testing/pipenv-compatibility.md
index 32145f5f..086ee8e6 100644
--- a/docs/testing/pipenv-compatibility.md
+++ b/docs/testing/pipenv-compatibility.md
@@ -122,67 +122,5 @@ hybrid that still carries our reference rolls back to the original entry),
 repeat installs and `sync` keep the in-place patch, and the out-of-tree leg
 requires an agent-mode scan run outside `pipenv run` to see Pipenv's venv.
 
-## Results
-
-<!-- GENERATED:BEGIN pipenv-matrix -->
-### macOS — full matrix (18 majors × 8 shapes × 4 modes)
-
-CLI revision `e521093`: **470 cases, 470 pass** (103 expected refusals, 36 skipped installer limitations, 0 failing, 0 harness errors).
-
-| Pipenv | hosted | vendored | agent (in-project venv) | agent (out-of-tree venv) | bare CLI sees out-of-tree venv | tamper rejected (hosted / vendored) | warm venv re-installed (hosted / vendored) | relock keeps patch (hosted / vendored) | `pipenv verify` (hosted / vendored) |
-| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
-| 0.2.8 | refused (redirect_pipenv_skipped) | refused (pypi_pipenv_spec_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | refused (skipped: Pipenv 0.x has no `--venv` and no WORKON_HOME placement to discover) | none | n/a / n/a | n/a / n/a | n/a / n/a | n/a / n/a |
-| 3.6.2 | refused (redirect_pipenv_skipped) | refused (pypi_pipenv_spec_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | none/true | n/a / n/a | n/a / n/a | n/a / n/a | n/a / n/a |
-| 4.1.4 | refused (redirect_pipenv_skipped) | refused (pypi_pipenv_spec_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | none/true | n/a / n/a | n/a / n/a | n/a / n/a | n/a / n/a |
-| 5.4.2 | refused (redirect_pipenv_skipped) | refused (pypi_pipenv_spec_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | none/true | n/a / n/a | n/a / n/a | n/a / n/a | n/a / n/a |
-| 6.2.9 | refused (redirect_pipenv_skipped) | refused (pypi_pipenv_spec_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | none/true | n/a / n/a | n/a / n/a | n/a / n/a | n/a / n/a |
-| 7.9.10 | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | refused (pypi_pipenv_installer_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | refused (skipped: Pipenv 7 cannot create its out-of-tree virtualenv in the harness image) | none | yes / n/a | false / n/a | false / n/a | 2 / n/a |
-| 8.3.2 | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | refused (pypi_pipenv_installer_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | true | yes / n/a | false / n/a | false / n/a | 2 / n/a |
-| 9.1.0 | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | refused (pypi_pipenv_installer_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | true | yes / n/a | false / n/a | false / n/a | 2 / n/a |
-| 10.1.2 | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | refused (pypi_pipenv_installer_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | true | yes / n/a | false / n/a | false / n/a | 2 / n/a |
-| 11.10.4 | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | refused (pypi_pipenv_installer_unsupported) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | true | yes / n/a | false / n/a | false / n/a | 2 / n/a |
-| 2018.11.26 | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | true | yes / yes | false / false | false / false | 2 / 2 |
-| 2020.11.15 | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | true | yes / yes | false / false | false / false | 2 / 2 |
-| 2021.11.23 | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,marker-excluded,transitive) | pass (dev,direct,extras,marker,transitive) | true | yes / yes | false / false | false / false | 2 / 2 |
-| 2022.12.19 | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,transitive) | true | yes / yes | false / false | false / false | 0 / 0 |
-| 2023.12.1 | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,transitive) | true | yes / no | false / false | false / false | 0 / 0 |
-| 2024.4.1 | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,transitive) | true | yes / no | false / false | false / false | 0 / 0 |
-| 2025.1.3 | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,transitive) | true | yes / no | false / false | false / false | 0 / 0 |
-| 2026.8.0 | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,crlf,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,marker-excluded,transitive) | pass (category,dev,direct,extras,marker,transitive) | true | yes / no | false / false | false / false | 0 / 0 |
-
-### Linux — release binary in a container (2018+ majors, direct shape, 4 modes)
-
-CLI revision `e521093`: **32 cases, 32 pass** (0 expected refusals, 0 skipped installer limitations, 0 failing, 0 harness errors).
-
-| Pipenv | hosted | vendored | agent (in-project venv) | agent (out-of-tree venv) | bare CLI sees out-of-tree venv | tamper rejected (hosted / vendored) | warm venv re-installed (hosted / vendored) | relock keeps patch (hosted / vendored) | `pipenv verify` (hosted / vendored) |
-| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
-| 2018.11.26 | pass (direct) | pass (direct) | pass (direct) | pass (direct) | true | yes / yes | false / false | false / false | 2 / 2 |
-| 2020.11.15 | pass (direct) | pass (direct) | pass (direct) | pass (direct) | true | yes / yes | false / false | false / false | 2 / 2 |
-| 2021.11.23 | pass (direct) | pass (direct) | pass (direct) | pass (direct) | true | yes / yes | false / false | false / false | 2 / 2 |
-| 2022.12.19 | pass (direct) | pass (direct) | pass (direct) | pass (direct) | true | yes / yes | false / false | false / false | 0 / 0 |
-| 2023.12.1 | pass (direct) | pass (direct) | pass (direct) | pass (direct) | true | yes / no | false / false | false / false | 0 / 0 |
-| 2024.4.1 | pass (direct) | pass (direct) | pass (direct) | pass (direct) | true | yes / no | false / false | false / false | 0 / 0 |
-| 2025.1.3 | pass (direct) | pass (direct) | pass (direct) | pass (direct) | true | yes / no | false / false | false / false | 0 / 0 |
-| 2026.8.0 | pass (direct) | pass (direct) | pass (direct) | pass (direct) | true | yes / no | false / false | false / false | 0 / 0 |
-
-### Invocation variants (`--cwd`, nested `--cwd`, symlinked project directory; direct shape, 4 modes)
-
-CLI revision `e521093`: **48 cases, 48 pass** (3 expected refusals, 0 skipped installer limitations, 0 failing, 0 harness errors).
-
-| Pipenv | invocation | hosted | vendored | agent | agent-oot |
-| --- | --- | --- | --- | --- | --- |
-| 11.10.4 | `--cwd <project>` | pass | refused (pypi_pipenv_installer_unsupported) | pass | pass |
-| 11.10.4 | `--cwd` from a nested directory | pass | refused (pypi_pipenv_installer_unsupported) | pass | pass |
-| 11.10.4 | symlinked project directory | pass | refused (pypi_pipenv_installer_unsupported) | pass | pass |
-| 2018.11.26 | `--cwd <project>` | pass | pass | pass | pass |
-| 2018.11.26 | `--cwd` from a nested directory | pass | pass | pass | pass |
-| 2018.11.26 | symlinked project directory | pass | pass | pass | pass |
-| 2022.12.19 | `--cwd <project>` | pass | pass | pass | pass |
-| 2022.12.19 | `--cwd` from a nested directory | pass | pass | pass | pass |
-| 2022.12.19 | symlinked project directory | pass | pass | pass | pass |
-| 2026.8.0 | `--cwd <project>` | pass | pass | pass | pass |
-| 2026.8.0 | `--cwd` from a nested directory | pass | pass | pass | pass |
-| 2026.8.0 | symlinked project directory | pass | pass | pass | pass |
-
-Every `pass` cell verified the installed `urllib3/response.py` against the patch record's Git blob SHA-256 after a real Pipenv install. Columns: `warm venv re-installed` and `relock keeps patch` are measured Pipenv boundaries (see above), not requirements; `pipenv verify` exit 2 means the subcommand does not exist on that release. Per-case checks, notes and harness provenance: [`results.json`](pipenv-compatibility/results.json).
-<!-- GENERATED:END pipenv-matrix -->
+Full run results belong with the source revision and toolchain versions in CI
+artifacts or a local output directory. See the [testing guide](README.md#ci-and-results).
diff --git a/docs/testing/pipenv-compatibility/results.json b/docs/testing/pipenv-compatibility/results.json
deleted file mode 100644
index 755e0c00..00000000
--- a/docs/testing/pipenv-compatibility/results.json
+++ /dev/null
@@ -1,72046 +0,0 @@
-{
-  "capturedOn": "2026-09-18",
-  "cliRevision": "e521093",
-  "runs": {
-    "invocations": {
-      "errors": [],
-      "platform": "macOS 15 (arm64), native CLI",
-      "provenance": {
-        "capturedAt": "2026-09-18T14:21:08.543839+00:00",
-        "cliRevision": "e521093",
-        "cliSha256": "3dedb1f8b597dec8e4ee74320a1028b1cfdab6257595185e296ed969a775c84f",
-        "host": "Darwin arm64",
-        "invocations": [
-          "cwd-flag",
-          "subdir",
-          "symlink"
-        ],
-        "legacyImage": "python:3.6.15-slim",
-        "modes": [
-          "hosted",
-          "vendored",
-          "agent",
-          "agent-oot"
-        ],
-        "pipenvVersions": [
-          "2026.8.0",
-          "2022.12.19",
-          "2018.11.26",
-          "11.10.4"
-        ],
-        "shapes": [
-          "direct"
-        ]
-      },
-      "results": [
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "cwd-flag",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "subdir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "symlink",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/11.10.4-direct-agent-oot-cwd-flag/venvs/project-wAwCAktN-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/legacy-tools/11.10.4/bin/python",
-            "ootVenvNameMatchesWorkon": false,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "cwd-flag",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/11.10.4-direct-agent-oot-subdir/venvs/app-4oK9yKve-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/legacy-tools/11.10.4/bin/python",
-            "ootVenvNameMatchesWorkon": false,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "subdir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/11.10.4-direct-agent-oot-symlink/venvs/project-RoaKTazg-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/legacy-tools/11.10.4/bin/python",
-            "ootVenvNameMatchesWorkon": false,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "symlink",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/11.10.4-direct-hosted-cwd-flag/project/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipe\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/11.10.4-direct-hosted-cwd-flag/project/.venv/lib/python3.8/site-packages stil"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/11.10.4-direct-hosted-cwd-flag/project/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipe\u2026"
-              }
-            ]
-          },
-          "invocation": "cwd-flag",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without t\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those byte"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without t\u2026"
-              }
-            ]
-          },
-          "invocation": "subdir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/11.10.4-direct-hosted-symlink/link/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv i\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/11.10.4-direct-hosted-symlink/link/.venv/lib/python3.8/site-packages still di"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/11.10.4-direct-hosted-symlink/link/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv i\u2026"
-              }
-            ]
-          },
-          "invocation": "symlink",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "cwd-flag",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "subdir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "symlink",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "cwd-flag",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "subdir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "symlink",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-agent-oot-cwd-flag/venvs/project-uP3pTgYV-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/tools/2018.11.26/bin/python",
-            "ootVenvNameMatchesWorkon": false,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "cwd-flag",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-agent-oot-subdir/venvs/app-ABVCOMdn-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/tools/2018.11.26/bin/python",
-            "ootVenvNameMatchesWorkon": false,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "subdir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-agent-oot-symlink/venvs/project-Xepy222U-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/tools/2018.11.26/bin/python",
-            "ootVenvNameMatchesWorkon": false,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "symlink",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-hosted-cwd-flag/project/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`p\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-hosted-cwd-flag/project/.venv/lib/python3.8/site-packages s"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-hosted-cwd-flag/project/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`p\u2026"
-              }
-            ]
-          },
-          "invocation": "cwd-flag",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without t\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those byte"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without t\u2026"
-              }
-            ]
-          },
-          "invocation": "subdir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-hosted-symlink/link/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipen\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-hosted-symlink/link/.venv/lib/python3.8/site-packages still"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-hosted-symlink/link/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipen\u2026"
-              }
-            ]
-          },
-          "invocation": "symlink",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-vendored-cwd-flag/project/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-vendored-cwd-flag/project/.ve"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-vendored-cwd-flag/project/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "cwd-flag",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in app/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in app/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so "
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in app/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "subdir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-vendored-symlink/link/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv ins\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-vendored-symlink/link/.venv/l"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2018.11.26-direct-vendored-symlink/link/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv ins\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "symlink",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "cwd-flag",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "subdir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "symlink",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-agent-oot-cwd-flag/venvs/project-4nuNhCus-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "cwd-flag",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-agent-oot-subdir/venvs/app-ePSOQNAV-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "subdir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-agent-oot-symlink/venvs/project-q4pR13ah-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "symlink",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-hosted-cwd-flag/project/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`p\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-hosted-cwd-flag/project/.venv/lib/python3.8/site-packages s"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-hosted-cwd-flag/project/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`p\u2026"
-              }
-            ]
-          },
-          "invocation": "cwd-flag",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without t\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those byte"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without t\u2026"
-              }
-            ]
-          },
-          "invocation": "subdir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-hosted-symlink/link/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipen\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-hosted-symlink/link/.venv/lib/python3.8/site-packages still"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-hosted-symlink/link/.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipen\u2026"
-              }
-            ]
-          },
-          "invocation": "symlink",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-vendored-cwd-flag/project/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-vendored-cwd-flag/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-vendored-cwd-flag/project/.ve"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-vendored-cwd-flag/project/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "cwd-flag",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in app/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-vendored-subdir/nested/app/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in app/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so "
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in app/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "subdir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-vendored-symlink/link/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv ins\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-vendored-symlink/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-vendored-symlink/link/.venv/l"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2022.12.19-direct-vendored-symlink/link/.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv ins\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "symlink",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "cwd-flag",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "subdir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "symlink",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-agent-oot-cwd-flag/venvs/project-PAsYMkTS-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "cwd-flag",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-agent-oot-subdir/venvs/app-bSlpRn1y-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "subdir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-agent-oot-symlink/venvs/project-GgQxs9OK-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "symlink",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-hosted-cwd-flag/project/.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pi\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-hosted-cwd-flag/project/.venv/lib/python3.12/site-packages st"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-hosted-cwd-flag/project/.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pi\u2026"
-              }
-            ]
-          },
-          "invocation": "cwd-flag",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without \u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those byt"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in app/.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without \u2026"
-              }
-            ]
-          },
-          "invocation": "subdir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-hosted-symlink/link/.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-hosted-symlink/link/.venv/lib/python3.12/site-packages still "
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-hosted-symlink/link/.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv\u2026"
-              }
-            ]
-          },
-          "invocation": "symlink",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-vendored-cwd-flag/project/.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-vendored-cwd-flag/project/.venv"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 0,
-              "installedPatchedAnyway": true
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-vendored-cwd-flag/project/.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "cwd-flag",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in app/.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching th\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in app/.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 0,
-              "installedPatchedAnyway": true
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in app/.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching th\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "subdir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-vendored-symlink/link/.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv inst\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-vendored-symlink/link/.venv/lib"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 0,
-              "installedPatchedAnyway": true
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in /private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-inv/captures/2026.8.0-direct-vendored-symlink/link/.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv inst\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "symlink",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        }
-      ]
-    },
-    "linux": {
-      "errors": [],
-      "platform": "Debian 12 (arm64) container, release CLI",
-      "provenance": {
-        "capturedAt": "2026-09-18T14:23:15.899056+00:00",
-        "cliRevision": "e521093",
-        "cliSha256": "dea3c3fdf39512216dc382aaca5f07ce88eeeef1b7cf38683068956a71c42c04",
-        "host": "Linux aarch64",
-        "invocations": [
-          "in-dir"
-        ],
-        "legacyImage": "python:3.6.15-slim",
-        "modes": [
-          "hosted",
-          "vendored",
-          "agent",
-          "agent-oot"
-        ],
-        "pipenvVersions": [
-          "2018.11.26",
-          "2020.11.15",
-          "2021.11.23",
-          "2022.12.19",
-          "2023.12.1",
-          "2024.4.1",
-          "2025.1.3",
-          "2026.8.0"
-        ],
-        "shapes": [
-          "direct"
-        ]
-      },
-      "results": [
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/out/final/captures/2018.11.26-direct-agent-oot/venvs/project-mF2HGUnO-/out/tools/tools/2018.11.26/bin/python",
-            "ootVenvNameMatchesWorkon": false,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2020.11.15",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/out/final/captures/2020.11.15-direct-agent-oot/venvs/project-69ycha_K-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2020.11.15",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2020.11.15",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2020.11.15",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2021.11.23",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/out/final/captures/2021.11.23-direct-agent-oot/venvs/project-Gx4HxHSi-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2021.11.23",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2021.11.23",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2021.11.23",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/out/final/captures/2022.12.19-direct-agent-oot/venvs/project-0g61h4-J-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "file:///out/final/captures/2022.12.19-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/out/final/captures/2023.12.1-direct-agent-oot/venvs/project-PVj1ALdm-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 0,
-              "installedPatchedAnyway": true
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/out/final/captures/2024.4.1-direct-agent-oot/venvs/project-Q1XxEGgw-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 0,
-              "installedPatchedAnyway": true
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/out/final/captures/2025.1.3-direct-agent-oot/venvs/project-ZiSwsYIx-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 0,
-              "installedPatchedAnyway": true
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/out/final/captures/2026.8.0-direct-agent-oot/venvs/project-X5QLZv1w-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 0,
-              "installedPatchedAnyway": true
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        }
-      ]
-    },
-    "macos": {
-      "errors": [],
-      "platform": "macOS 15 (arm64), native CLI; Pipenv 0.2.8-11.10.4 inside python:3.6.15-slim",
-      "provenance": {
-        "capturedAt": "2026-09-18T14:21:06.520127+00:00",
-        "cliRevision": "e521093",
-        "cliSha256": "3dedb1f8b597dec8e4ee74320a1028b1cfdab6257595185e296ed969a775c84f",
-        "host": "Darwin arm64",
-        "invocations": [
-          "in-dir"
-        ],
-        "legacyImage": "python:3.6.15-slim",
-        "mergedFrom": [
-          {
-            "path": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-fix-a/summary.json",
-            "provenance": {
-              "capturedAt": "2026-09-18T14:45:17.630925+00:00",
-              "cliRevision": "e521093",
-              "cliSha256": "3dedb1f8b597dec8e4ee74320a1028b1cfdab6257595185e296ed969a775c84f",
-              "host": "Darwin arm64",
-              "invocations": [
-                "in-dir"
-              ],
-              "legacyImage": "python:3.6.15-slim",
-              "modes": [
-                "agent"
-              ],
-              "pipenvVersions": [
-                "0.2.8"
-              ],
-              "shapes": [
-                "dev"
-              ]
-            }
-          },
-          {
-            "path": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-fix-b/summary.json",
-            "provenance": {
-              "capturedAt": "2026-09-18T14:45:31.872148+00:00",
-              "cliRevision": "e521093",
-              "cliSha256": "3dedb1f8b597dec8e4ee74320a1028b1cfdab6257595185e296ed969a775c84f",
-              "host": "Darwin arm64",
-              "invocations": [
-                "in-dir"
-              ],
-              "legacyImage": "python:3.6.15-slim",
-              "modes": [
-                "agent-oot"
-              ],
-              "pipenvVersions": [
-                "5.4.2"
-              ],
-              "shapes": [
-                "dev",
-                "direct"
-              ]
-            }
-          },
-          {
-            "path": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-fix-c/summary.json",
-            "provenance": {
-              "capturedAt": "2026-09-18T14:45:49.934581+00:00",
-              "cliRevision": "e521093",
-              "cliSha256": "3dedb1f8b597dec8e4ee74320a1028b1cfdab6257595185e296ed969a775c84f",
-              "host": "Darwin arm64",
-              "invocations": [
-                "in-dir"
-              ],
-              "legacyImage": "python:3.6.15-slim",
-              "modes": [
-                "agent-oot"
-              ],
-              "pipenvVersions": [
-                "4.1.4"
-              ],
-              "shapes": [
-                "transitive"
-              ]
-            }
-          },
-          {
-            "path": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-fix-d/summary.json",
-            "provenance": {
-              "capturedAt": "2026-09-18T14:47:07.046287+00:00",
-              "cliRevision": "e521093",
-              "cliSha256": "3dedb1f8b597dec8e4ee74320a1028b1cfdab6257595185e296ed969a775c84f",
-              "host": "Darwin arm64",
-              "invocations": [
-                "in-dir"
-              ],
-              "legacyImage": "python:3.6.15-slim",
-              "modes": [
-                "hosted",
-                "vendored"
-              ],
-              "pipenvVersions": [
-                "2023.12.1",
-                "2024.4.1",
-                "2025.1.3",
-                "2026.8.0"
-              ],
-              "shapes": [
-                "marker-excluded"
-              ]
-            }
-          }
-        ],
-        "modes": [
-          "hosted",
-          "vendored",
-          "agent",
-          "agent-oot"
-        ],
-        "pipenvVersions": [
-          "0.2.8",
-          "3.6.2",
-          "4.1.4",
-          "5.4.2",
-          "6.2.9",
-          "7.9.10",
-          "8.3.2",
-          "9.1.0",
-          "10.1.2",
-          "11.10.4",
-          "2018.11.26",
-          "2020.11.15",
-          "2021.11.23",
-          "2022.12.19",
-          "2023.12.1",
-          "2024.4.1",
-          "2025.1.3",
-          "2026.8.0"
-        ],
-        "shapes": [
-          "direct",
-          "dev",
-          "category",
-          "marker",
-          "marker-excluded",
-          "extras",
-          "transitive",
-          "crlf"
-        ]
-      },
-      "results": [
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 0
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 0
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "0.2.8",
-          "pipfileSpec": null,
-          "shape": "crlf",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 0
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 0
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "0.2.8",
-          "pipfileSpec": null,
-          "shape": "crlf",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "0.2.8",
-          "pipfileSpec": null,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x has no `--venv` and no WORKON_HOME placement to discover",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "0.2.8",
-          "pipfileSpec": null,
-          "shape": "dev",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 0
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 0
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "0.2.8",
-          "pipfileSpec": null,
-          "shape": "dev",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 0
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 0
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "0.2.8",
-          "pipfileSpec": null,
-          "shape": "dev",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "0.2.8",
-          "pipfileSpec": null,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x has no `--venv` and no WORKON_HOME placement to discover",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "0.2.8",
-          "pipfileSpec": null,
-          "shape": "direct",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 0
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 0
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "0.2.8",
-          "pipfileSpec": null,
-          "shape": "direct",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 0
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 0
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "0.2.8",
-          "pipfileSpec": null,
-          "shape": "direct",
-          "supported": false
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "0.2.8",
-          "pipfileSpec": null,
-          "shape": "extras",
-          "supported": false
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "0.2.8",
-          "pipfileSpec": null,
-          "shape": "extras",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 0
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 0
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "0.2.8",
-          "pipfileSpec": null,
-          "shape": "extras",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 0
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 0
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "0.2.8",
-          "pipfileSpec": null,
-          "shape": "extras",
-          "supported": false
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "0.2.8",
-          "pipfileSpec": null,
-          "shape": "marker",
-          "supported": false
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "0.2.8",
-          "pipfileSpec": null,
-          "shape": "marker",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "0.2.8",
-          "pipfileSpec": null,
-          "shape": "marker",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "0.2.8",
-          "pipfileSpec": null,
-          "shape": "marker",
-          "supported": false
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "0.2.8",
-          "pipfileSpec": null,
-          "shape": "marker-excluded",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "0.2.8",
-          "pipfileSpec": null,
-          "shape": "marker-excluded",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "0.2.8",
-          "pipfileSpec": null,
-          "shape": "marker-excluded",
-          "supported": false
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x cannot stamp the transitive Pipfile's content hash",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "0.2.8",
-          "pipfileSpec": null,
-          "shape": "transitive",
-          "supported": false
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x cannot stamp the transitive Pipfile's content hash",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "0.2.8",
-          "pipfileSpec": null,
-          "shape": "transitive",
-          "supported": false
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x cannot stamp the transitive Pipfile's content hash",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "0.2.8",
-          "pipfileSpec": null,
-          "shape": "transitive",
-          "supported": false
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x cannot stamp the transitive Pipfile's content hash",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "0.2.8",
-          "pipfileSpec": null,
-          "shape": "transitive",
-          "supported": false
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "crlfPreserved": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "10.1.2",
-          "pipfileSpec": 6,
-          "shape": "crlf",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "10.1.2",
-          "pipfileSpec": 6,
-          "shape": "crlf",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "10.1.2",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/10.1.2-dev-agent-oot/venvs/project-le2Kar3x",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "10.1.2",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "develop"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "10.1.2",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "10.1.2",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "10.1.2",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/10.1.2-direct-agent-oot/venvs/project-Vi8Y6k5P",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "10.1.2",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "10.1.2",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "10.1.2",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "10.1.2",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 5,
-              "urllib3Listed": true,
-              "venvDistributions": 5
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 5,
-              "urllib3Listed": true,
-              "venvDistributions": 5
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/10.1.2-extras-agent-oot/venvs/project-Hdy1kYbO",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "10.1.2",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "10.1.2",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 2
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "10.1.2",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "10.1.2",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/10.1.2-marker-agent-oot/venvs/project-mSh7SIOh",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "10.1.2",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version < '4'",
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "10.1.2",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "10.1.2",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": false
-        },
-        {
-          "checks": {
-            "excludedStaysAbsent": true,
-            "lockUntouched": true,
-            "nothingApplied": true
-          },
-          "expected": "marker excludes urllib3: nothing installed, nothing to patch",
-          "info": {
-            "nothingApplied": {
-              "applied": 0,
-              "exit": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "10.1.2",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "excludedStaysAbsent": true,
-            "expectedSourceKey": true,
-            "freshCloneKeepsExcluded": true,
-            "freshCloneLockUnchanged": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "excludedStaysAbsent": {
-              "urllib3/response.py": null
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneKeepsExcluded": {
-              "exit": 0
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version > '4'",
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "10.1.2",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "10.1.2",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "10.1.2",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 8,
-              "urllib3Listed": true,
-              "venvDistributions": 8
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 8,
-              "urllib3Listed": true,
-              "venvDistributions": 8
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/10.1.2-transitive-agent-oot/venvs/project-bkGR-pKq",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "10.1.2",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "10.1.2",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 5
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "10.1.2",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": false
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "crlfPreserved": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "crlf",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "crlf",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/11.10.4-dev-agent-oot/venvs/project-EuBgobiP-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/legacy-tools/11.10.4/bin/python",
-            "ootVenvNameMatchesWorkon": false,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "develop"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/11.10.4-direct-agent-oot/venvs/project-p4uodGuH-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/legacy-tools/11.10.4/bin/python",
-            "ootVenvNameMatchesWorkon": false,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 5,
-              "urllib3Listed": true,
-              "venvDistributions": 5
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 5,
-              "urllib3Listed": true,
-              "venvDistributions": 5
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/11.10.4-extras-agent-oot/venvs/project-c6zJSbVZ-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/legacy-tools/11.10.4/bin/python",
-            "ootVenvNameMatchesWorkon": false,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 2
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/11.10.4-marker-agent-oot/venvs/project-TLOj7X4t-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/legacy-tools/11.10.4/bin/python",
-            "ootVenvNameMatchesWorkon": false,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version < '4'",
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": false
-        },
-        {
-          "checks": {
-            "excludedStaysAbsent": true,
-            "lockUntouched": true,
-            "nothingApplied": true
-          },
-          "expected": "marker excludes urllib3: nothing installed, nothing to patch",
-          "info": {
-            "nothingApplied": {
-              "applied": 0,
-              "exit": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "excludedStaysAbsent": true,
-            "expectedSourceKey": true,
-            "freshCloneKeepsExcluded": true,
-            "freshCloneLockUnchanged": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "excludedStaysAbsent": {
-              "urllib3/response.py": null
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneKeepsExcluded": {
-              "exit": 0
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version > '4'",
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 8,
-              "urllib3Listed": true,
-              "venvDistributions": 8
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 8,
-              "urllib3Listed": true,
-              "venvDistributions": 8
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/11.10.4-transitive-agent-oot/venvs/project-TPz-ubcN-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/legacy-tools/11.10.4/bin/python",
-            "ootVenvNameMatchesWorkon": false,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 5
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "11.10.4",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": false
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "crlfPreserved": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "crlf",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "crlfPreserved": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "crlf",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2018.11.26-dev-agent-oot/venvs/project-rvumQJR7-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/tools/2018.11.26/bin/python",
-            "ootVenvNameMatchesWorkon": false,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "develop"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "develop"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2018.11.26-direct-agent-oot/venvs/project-rRD3ZqKE-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/tools/2018.11.26/bin/python",
-            "ootVenvNameMatchesWorkon": false,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 5,
-              "urllib3Listed": true,
-              "venvDistributions": 5
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 5,
-              "urllib3Listed": true,
-              "venvDistributions": 5
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2018.11.26-extras-agent-oot/venvs/project-oO1dqUUx-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/tools/2018.11.26/bin/python",
-            "ootVenvNameMatchesWorkon": false,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "extras": [
-                    "socks"
-                  ],
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "extras": [
-                    "socks"
-                  ],
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2018.11.26-marker-agent-oot/venvs/project-p-7NMJlC-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/tools/2018.11.26/bin/python",
-            "ootVenvNameMatchesWorkon": false,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version < '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version < '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "excludedStaysAbsent": true,
-            "lockUntouched": true,
-            "nothingApplied": true
-          },
-          "expected": "marker excludes urllib3: nothing installed, nothing to patch",
-          "info": {
-            "nothingApplied": {
-              "applied": 0,
-              "exit": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "excludedStaysAbsent": true,
-            "expectedSourceKey": true,
-            "freshCloneKeepsExcluded": true,
-            "freshCloneLockUnchanged": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "excludedStaysAbsent": {
-              "urllib3/response.py": null
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneKeepsExcluded": {
-              "exit": 0
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version > '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "excludedStaysAbsent": true,
-            "expectedSourceKey": true,
-            "freshCloneKeepsExcluded": true,
-            "freshCloneLockUnchanged": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "excludedStaysAbsent": {
-              "urllib3/response.py": null
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneKeepsExcluded": {
-              "exit": 0
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version > '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 8,
-              "urllib3Listed": true,
-              "venvDistributions": 8
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 8,
-              "urllib3Listed": true,
-              "venvDistributions": 8
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2018.11.26-transitive-agent-oot/venvs/project-uDoo2NrU-/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/pipenv-matrix/tools/2018.11.26/bin/python",
-            "ootVenvNameMatchesWorkon": false,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2018.11.26",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "crlfPreserved": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2020.11.15",
-          "pipfileSpec": 6,
-          "shape": "crlf",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "crlfPreserved": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2020.11.15",
-          "pipfileSpec": 6,
-          "shape": "crlf",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2020.11.15",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2020.11.15-dev-agent-oot/venvs/project-WBeaWwaZ-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2020.11.15",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "develop"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2020.11.15",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "develop"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2020.11.15",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2020.11.15",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2020.11.15-direct-agent-oot/venvs/project-_BmhyZkL-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2020.11.15",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2020.11.15",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2020.11.15",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2020.11.15",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 5,
-              "urllib3Listed": true,
-              "venvDistributions": 5
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 5,
-              "urllib3Listed": true,
-              "venvDistributions": 5
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2020.11.15-extras-agent-oot/venvs/project-usOBprOu-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2020.11.15",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "extras": [
-                    "socks"
-                  ],
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2020.11.15",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "extras": [
-                    "socks"
-                  ],
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2020.11.15",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2020.11.15",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2020.11.15-marker-agent-oot/venvs/project-P5aQHRYw-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2020.11.15",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version < '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2020.11.15",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version < '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2020.11.15",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "excludedStaysAbsent": true,
-            "lockUntouched": true,
-            "nothingApplied": true
-          },
-          "expected": "marker excludes urllib3: nothing installed, nothing to patch",
-          "info": {
-            "nothingApplied": {
-              "applied": 0,
-              "exit": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2020.11.15",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "excludedStaysAbsent": true,
-            "expectedSourceKey": true,
-            "freshCloneKeepsExcluded": true,
-            "freshCloneLockUnchanged": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "excludedStaysAbsent": {
-              "urllib3/response.py": null
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneKeepsExcluded": {
-              "exit": 0
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version > '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2020.11.15",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "excludedStaysAbsent": true,
-            "expectedSourceKey": true,
-            "freshCloneKeepsExcluded": true,
-            "freshCloneLockUnchanged": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "excludedStaysAbsent": {
-              "urllib3/response.py": null
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneKeepsExcluded": {
-              "exit": 0
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version > '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2020.11.15",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2020.11.15",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 8,
-              "urllib3Listed": true,
-              "venvDistributions": 8
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 8,
-              "urllib3Listed": true,
-              "venvDistributions": 8
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2020.11.15-transitive-agent-oot/venvs/project-RHhZLWm9-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2020.11.15",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2020.11.15",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2020.11.15",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "crlfPreserved": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2021.11.23",
-          "pipfileSpec": 6,
-          "shape": "crlf",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "crlfPreserved": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2021.11.23",
-          "pipfileSpec": 6,
-          "shape": "crlf",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2021.11.23",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2021.11.23-dev-agent-oot/venvs/project-jotSn62P-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2021.11.23",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "develop"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2021.11.23",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "develop"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2021.11.23",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2021.11.23",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2021.11.23-direct-agent-oot/venvs/project-7YJlTv1q-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2021.11.23",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2021.11.23",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2021.11.23",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2021.11.23",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 5,
-              "urllib3Listed": true,
-              "venvDistributions": 5
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 5,
-              "urllib3Listed": true,
-              "venvDistributions": 5
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2021.11.23-extras-agent-oot/venvs/project-O9SEazj5-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2021.11.23",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "extras": [
-                    "socks"
-                  ],
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2021.11.23",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "extras": [
-                    "socks"
-                  ],
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2021.11.23",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2021.11.23",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2021.11.23-marker-agent-oot/venvs/project-hximekEn-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2021.11.23",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version < '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2021.11.23",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version < '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2021.11.23",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "excludedStaysAbsent": true,
-            "lockUntouched": true,
-            "nothingApplied": true
-          },
-          "expected": "marker excludes urllib3: nothing installed, nothing to patch",
-          "info": {
-            "nothingApplied": {
-              "applied": 0,
-              "exit": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2021.11.23",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "excludedStaysAbsent": true,
-            "expectedSourceKey": true,
-            "freshCloneKeepsExcluded": true,
-            "freshCloneLockUnchanged": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "excludedStaysAbsent": {
-              "urllib3/response.py": null
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneKeepsExcluded": {
-              "exit": 0
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version > '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2021.11.23",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "excludedStaysAbsent": true,
-            "expectedSourceKey": true,
-            "freshCloneKeepsExcluded": true,
-            "freshCloneLockUnchanged": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "excludedStaysAbsent": {
-              "urllib3/response.py": null
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneKeepsExcluded": {
-              "exit": 0
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version > '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2021.11.23",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2021.11.23",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 8,
-              "urllib3Listed": true,
-              "venvDistributions": 8
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 8,
-              "urllib3Listed": true,
-              "venvDistributions": 8
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2021.11.23-transitive-agent-oot/venvs/project-avsbOHLg-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2021.11.23",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2021.11.23",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2021.11.23",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "category",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-category-agent-oot/venvs/project-VPPSdrXF-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "category",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "tests",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "tests",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "tests"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "category",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "tests",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "tests",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-category-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "tests"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "category",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "crlfPreserved": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "crlf",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "crlfPreserved": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "crlf",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-dev-agent-oot/venvs/project-Oe79nwd5-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "develop"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-dev-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "develop"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-direct-agent-oot/venvs/project-xrFY7ef0-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 5,
-              "urllib3Listed": true,
-              "venvDistributions": 5
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 5,
-              "urllib3Listed": true,
-              "venvDistributions": 5
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-extras-agent-oot/venvs/project-fj5TX4um-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 1,
-              "lockBytesUnchanged": true,
-              "patchSourceKept": true,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3#egg=urllib3[socks]"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "extras": [
-                    "socks"
-                  ],
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl[socks]"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "extras": [
-                    "socks"
-                  ],
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-marker-agent-oot/venvs/project-3kF_SAjR-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3 ; python_version < '4'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version < '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-marker-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version < '4'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version < '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "excludedStaysAbsent": true,
-            "lockUntouched": true,
-            "nothingApplied": true
-          },
-          "expected": "marker excludes urllib3: nothing installed, nothing to patch",
-          "info": {
-            "nothingApplied": {
-              "applied": 0,
-              "exit": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "excludedStaysAbsent": true,
-            "expectedSourceKey": true,
-            "freshCloneKeepsExcluded": true,
-            "freshCloneLockUnchanged": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "excludedStaysAbsent": {
-              "urllib3/response.py": null
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneKeepsExcluded": {
-              "exit": 0
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3 ; python_version > '4'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version > '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "excludedStaysAbsent": true,
-            "expectedSourceKey": true,
-            "freshCloneKeepsExcluded": true,
-            "freshCloneLockUnchanged": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "excludedStaysAbsent": {
-              "urllib3/response.py": null
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneKeepsExcluded": {
-              "exit": 0
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-marker-excluded-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version > '4'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version > '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 8,
-              "urllib3Listed": true,
-              "venvDistributions": 8
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 8,
-              "urllib3Listed": true,
-              "venvDistributions": 8
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-transitive-agent-oot/venvs/project-4b8AKKsv-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#egg=urllib3"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "file:///private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2022.12.19-transitive-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ]
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so th"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.8/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the P\u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2022.12.19",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "category",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2023.12.1-category-agent-oot/venvs/project-xEc6rJSO-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "category",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "tests",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "tests",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "tests"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "category",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "tests",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "tests",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "tests"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "category",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "crlfPreserved": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "crlf",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "crlfPreserved": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 0,
-              "installedPatchedAnyway": true
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "crlf",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2023.12.1-dev-agent-oot/venvs/project-PtTzFqFB-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "develop"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "develop"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2023.12.1-direct-agent-oot/venvs/project-0UeNFdlr-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 0,
-              "installedPatchedAnyway": true
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 3,
-              "urllib3Listed": true,
-              "venvDistributions": 3
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 3,
-              "urllib3Listed": true,
-              "venvDistributions": 3
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2023.12.1-extras-agent-oot/venvs/project-xkdemobK-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "extras": [
-                    "socks"
-                  ],
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "extras": [
-                    "socks"
-                  ],
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'",
-                  "path": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2023.12.1-marker-agent-oot/venvs/project-DDR4ZCp_-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version < '4'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version < '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version < '4'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version < '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "excludedStaysAbsent": true,
-            "lockUntouched": true,
-            "nothingApplied": true
-          },
-          "expected": "marker excludes urllib3: nothing installed, nothing to patch",
-          "info": {
-            "nothingApplied": {
-              "applied": 0,
-              "exit": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "excludedStaysAbsent": true,
-            "expectedSourceKey": true,
-            "freshCloneKeepsExcluded": true,
-            "freshCloneLockUnchanged": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "excludedStaysAbsent": {
-              "urllib3/response.py": null
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneKeepsExcluded": {
-              "exit": 0
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": true,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version > '4'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version > '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 1,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "hybridRelock": true,
-              "lockKeptRelocked": false,
-              "lockRestoredOriginal": true,
-              "referenceLeft": false
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "excludedStaysAbsent": true,
-            "expectedSourceKey": true,
-            "freshCloneKeepsExcluded": true,
-            "freshCloneLockUnchanged": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "excludedStaysAbsent": {
-              "urllib3/response.py": null
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneKeepsExcluded": {
-              "exit": 0
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": true,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version > '4'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version > '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "hybridRelock": true,
-              "lockKeptRelocked": false,
-              "lockRestoredOriginal": true,
-              "referenceLeft": false
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 6,
-              "urllib3Listed": true,
-              "venvDistributions": 6
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 6,
-              "urllib3Listed": true,
-              "venvDistributions": 6
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2023.12.1-transitive-agent-oot/venvs/project-7-es0NIB-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2023.12.1",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "category",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2024.4.1-category-agent-oot/venvs/project--fnruCrf-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "category",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "tests",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "tests",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "tests"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "category",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "tests",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "tests",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "tests"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "category",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "crlfPreserved": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "crlf",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "crlfPreserved": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 0,
-              "installedPatchedAnyway": true
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "crlf",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2024.4.1-dev-agent-oot/venvs/project-xsC0u6dL-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "develop"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "develop"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2024.4.1-direct-agent-oot/venvs/project-Nlq3YoNQ-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 0,
-              "installedPatchedAnyway": true
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 3,
-              "urllib3Listed": true,
-              "venvDistributions": 3
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 3,
-              "urllib3Listed": true,
-              "venvDistributions": 3
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2024.4.1-extras-agent-oot/venvs/project-Jsn3tijM-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "extras": [
-                    "socks"
-                  ],
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "extras": [
-                    "socks"
-                  ],
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'",
-                  "path": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2024.4.1-marker-agent-oot/venvs/project-Vj1hhlg6-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version < '4'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version < '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version < '4'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version < '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "excludedStaysAbsent": true,
-            "lockUntouched": true,
-            "nothingApplied": true
-          },
-          "expected": "marker excludes urllib3: nothing installed, nothing to patch",
-          "info": {
-            "nothingApplied": {
-              "applied": 0,
-              "exit": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "excludedStaysAbsent": true,
-            "expectedSourceKey": true,
-            "freshCloneKeepsExcluded": true,
-            "freshCloneLockUnchanged": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "excludedStaysAbsent": {
-              "urllib3/response.py": null
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneKeepsExcluded": {
-              "exit": 0
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": true,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version > '4'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version > '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 1,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "hybridRelock": true,
-              "lockKeptRelocked": false,
-              "lockRestoredOriginal": true,
-              "referenceLeft": false
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "excludedStaysAbsent": true,
-            "expectedSourceKey": true,
-            "freshCloneKeepsExcluded": true,
-            "freshCloneLockUnchanged": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "excludedStaysAbsent": {
-              "urllib3/response.py": null
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneKeepsExcluded": {
-              "exit": 0
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": true,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version > '4'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version > '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "hybridRelock": true,
-              "lockKeptRelocked": false,
-              "lockRestoredOriginal": true,
-              "referenceLeft": false
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 6,
-              "urllib3Listed": true,
-              "venvDistributions": 6
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 6,
-              "urllib3Listed": true,
-              "venvDistributions": 6
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2024.4.1-transitive-agent-oot/venvs/project-yDGP0fUF-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2024.4.1",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "category",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2025.1.3-category-agent-oot/venvs/project-yAeGV-DD-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "category",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "tests",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "tests",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "tests"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "category",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "tests",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "tests",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "tests"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "category",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "crlfPreserved": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "crlf",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "crlfPreserved": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 0,
-              "installedPatchedAnyway": true
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "crlf",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2025.1.3-dev-agent-oot/venvs/project-Fdze9eCY-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "develop"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "develop"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2025.1.3-direct-agent-oot/venvs/project-UDidtARQ-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 0,
-              "installedPatchedAnyway": true
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 3,
-              "urllib3Listed": true,
-              "venvDistributions": 3
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 3,
-              "urllib3Listed": true,
-              "venvDistributions": 3
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2025.1.3-extras-agent-oot/venvs/project-wKfQ5P1A-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "extras": [
-                    "socks"
-                  ],
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "extras": [
-                    "socks"
-                  ],
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'",
-                  "path": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2025.1.3-marker-agent-oot/venvs/project-Ua-x4uOM-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version < '4'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version < '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version < '4'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version < '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "excludedStaysAbsent": true,
-            "lockUntouched": true,
-            "nothingApplied": true
-          },
-          "expected": "marker excludes urllib3: nothing installed, nothing to patch",
-          "info": {
-            "nothingApplied": {
-              "applied": 0,
-              "exit": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "excludedStaysAbsent": true,
-            "expectedSourceKey": true,
-            "freshCloneKeepsExcluded": true,
-            "freshCloneLockUnchanged": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "excludedStaysAbsent": {
-              "urllib3/response.py": null
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneKeepsExcluded": {
-              "exit": 0
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": true,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version > '4'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version > '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 1,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "hybridRelock": true,
-              "lockKeptRelocked": false,
-              "lockRestoredOriginal": true,
-              "referenceLeft": false
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "excludedStaysAbsent": true,
-            "expectedSourceKey": true,
-            "freshCloneKeepsExcluded": true,
-            "freshCloneLockUnchanged": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "excludedStaysAbsent": {
-              "urllib3/response.py": null
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneKeepsExcluded": {
-              "exit": 0
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": true,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version > '4'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version > '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "hybridRelock": true,
-              "lockKeptRelocked": false,
-              "lockRestoredOriginal": true,
-              "referenceLeft": false
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 6,
-              "urllib3Listed": true,
-              "venvDistributions": 6
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 6,
-              "urllib3Listed": true,
-              "venvDistributions": 6
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2025.1.3-transitive-agent-oot/venvs/project-sqNtW4tO-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2025.1.3",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "category",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2026.8.0-category-agent-oot/venvs/project-jp5oYRPn-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "category",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "tests",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "tests",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "tests"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "category",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "tests",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "tests",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "tests"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "category",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "crlfPreserved": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "crlf",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "crlfPreserved": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 0,
-              "installedPatchedAnyway": true
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "crlf",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2026.8.0-dev-agent-oot/venvs/project-XetQvjsN-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "develop"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "develop"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2026.8.0-direct-agent-oot/venvs/project-QZo5Ld-I-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "tamper": {
-              "expectsReject": false,
-              "installExit": 0,
-              "installedPatchedAnyway": true
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 3,
-              "urllib3Listed": true,
-              "venvDistributions": 3
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 3,
-              "urllib3Listed": true,
-              "venvDistributions": 3
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2026.8.0-extras-agent-oot/venvs/project-Pb7pwpA2-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "extras": [
-                    "socks"
-                  ],
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "extras": [
-                    "socks"
-                  ],
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'",
-                  "path": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 2,
-              "urllib3Listed": true,
-              "venvDistributions": 2
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2026.8.0-marker-agent-oot/venvs/project-Z_FGngEQ-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version < '4'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version < '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version < '4'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version < '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "excludedStaysAbsent": true,
-            "lockUntouched": true,
-            "nothingApplied": true
-          },
-          "expected": "marker excludes urllib3: nothing installed, nothing to patch",
-          "info": {
-            "nothingApplied": {
-              "applied": 0,
-              "exit": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "excludedStaysAbsent": true,
-            "expectedSourceKey": true,
-            "freshCloneKeepsExcluded": true,
-            "freshCloneLockUnchanged": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "excludedStaysAbsent": {
-              "urllib3/response.py": null
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneKeepsExcluded": {
-              "exit": 0
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": true,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version > '4'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version > '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 1,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "hybridRelock": true,
-              "lockKeptRelocked": false,
-              "lockRestoredOriginal": true,
-              "referenceLeft": false
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "excludedStaysAbsent": true,
-            "expectedSourceKey": true,
-            "freshCloneKeepsExcluded": true,
-            "freshCloneLockUnchanged": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "excludedStaysAbsent": {
-              "urllib3/response.py": null
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneKeepsExcluded": {
-              "exit": 0
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": true,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version > '4'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version > '4'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "hybridRelock": true,
-              "lockKeptRelocked": false,
-              "lockRestoredOriginal": true,
-              "referenceLeft": false
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true,
-            "survivesSync": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 6,
-              "urllib3Listed": true,
-              "venvDistributions": 6
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 6,
-              "urllib3Listed": true,
-              "venvDistributions": 6
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/2026.8.0-transitive-agent-oot/venvs/project-tFo0iv7w-python",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "survivesSync": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6 ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.12/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without to\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasVendoredRef": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsVendorState": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRemovesVendoredWheel": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "vendoredWheelPresent": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "action": "applied",
-                  "files": [
-                    {
-                      "path": "urllib3/response.py",
-                      "verified": true
-                    }
-                  ],
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_integrity_unverified",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "pypi_pipenv_stale_install",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-                },
-                {
-                  "action": "skipped",
-                  "errorCode": "vendor_prebuilt_downloaded",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "file",
-              "got": [
-                "file"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [
-                "vendor_fetched_missing",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [
-                "already_vendored",
-                "vendor_fetched_missing"
-              ],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "requirementsExport": {
-              "exit": 0,
-              "exportsPatchRef": true,
-              "urllib3Line": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl ; python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "file": "./.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl",
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version >= '2.7' and python_version not in '3.0, 3.1, 3.2, 3.3, 3.4, 3.5'"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": [
-                "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              ]
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "file"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "pypi_pipenv_stale_install",
-                "vendor_integrity_unverified",
-                "vendor_prebuilt_downloaded"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so t"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 0
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              },
-              "sync": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "action": "applied",
-                "files": [
-                  {
-                    "path": "urllib3/response.py",
-                    "verified": true
-                  }
-                ],
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_integrity_unverified",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "Pipenv does not consistently enforce the hashes recorded on file-ref lock entries (2018\u20132022 verify them, 2023+ install a local wheel without checking), so the vendored wheel is protected only by the committed wheel itself; `socket-patch vex --product <purl>` verifies the installed files against the patch record"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "pypi_pipenv_stale_install",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl: the UNPATCHED upstream release is still installed in ./.venv/lib/python3.12/site-packages. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the wired Pipfile.lock only protects fresh installs. Reinstall it from the lock without touching the \u2026"
-              },
-              {
-                "action": "skipped",
-                "errorCode": "vendor_prebuilt_downloaded",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "2026.8.0",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "3.6.2",
-          "pipfileSpec": null,
-          "shape": "crlf",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "3.6.2",
-          "pipfileSpec": null,
-          "shape": "crlf",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "3.6.2",
-          "pipfileSpec": null,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/3.6.2-dev-agent-oot/venvs/project-H7fL1xTY",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "3.6.2",
-          "pipfileSpec": null,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "3.6.2",
-          "pipfileSpec": null,
-          "shape": "dev",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "3.6.2",
-          "pipfileSpec": null,
-          "shape": "dev",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "3.6.2",
-          "pipfileSpec": null,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/3.6.2-direct-agent-oot/venvs/project-SjHJBH5g",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "3.6.2",
-          "pipfileSpec": null,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "3.6.2",
-          "pipfileSpec": null,
-          "shape": "direct",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "3.6.2",
-          "pipfileSpec": null,
-          "shape": "direct",
-          "supported": false
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "3.6.2",
-          "pipfileSpec": null,
-          "shape": "extras",
-          "supported": false
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "3.6.2",
-          "pipfileSpec": null,
-          "shape": "extras",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "3.6.2",
-          "pipfileSpec": null,
-          "shape": "extras",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "3.6.2",
-          "pipfileSpec": null,
-          "shape": "extras",
-          "supported": false
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "3.6.2",
-          "pipfileSpec": null,
-          "shape": "marker",
-          "supported": false
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "3.6.2",
-          "pipfileSpec": null,
-          "shape": "marker",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "3.6.2",
-          "pipfileSpec": null,
-          "shape": "marker",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "3.6.2",
-          "pipfileSpec": null,
-          "shape": "marker",
-          "supported": false
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "3.6.2",
-          "pipfileSpec": null,
-          "shape": "marker-excluded",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "3.6.2",
-          "pipfileSpec": null,
-          "shape": "marker-excluded",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "3.6.2",
-          "pipfileSpec": null,
-          "shape": "marker-excluded",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "3.6.2",
-          "pipfileSpec": null,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 8,
-              "urllib3Listed": true,
-              "venvDistributions": 8
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 8,
-              "urllib3Listed": true,
-              "venvDistributions": 8
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/3.6.2-transitive-agent-oot/venvs/project-R9KbIlov",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "3.6.2",
-          "pipfileSpec": null,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "3.6.2",
-          "pipfileSpec": null,
-          "shape": "transitive",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 5
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "3.6.2",
-          "pipfileSpec": null,
-          "shape": "transitive",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "4.1.4",
-          "pipfileSpec": null,
-          "shape": "crlf",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "4.1.4",
-          "pipfileSpec": null,
-          "shape": "crlf",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "4.1.4",
-          "pipfileSpec": null,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/4.1.4-dev-agent-oot/venvs/project-156NY79G",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "4.1.4",
-          "pipfileSpec": null,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "4.1.4",
-          "pipfileSpec": null,
-          "shape": "dev",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "4.1.4",
-          "pipfileSpec": null,
-          "shape": "dev",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "4.1.4",
-          "pipfileSpec": null,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/4.1.4-direct-agent-oot/venvs/project-S8Z-YEC3",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "4.1.4",
-          "pipfileSpec": null,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "4.1.4",
-          "pipfileSpec": null,
-          "shape": "direct",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "4.1.4",
-          "pipfileSpec": null,
-          "shape": "direct",
-          "supported": false
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "4.1.4",
-          "pipfileSpec": null,
-          "shape": "extras",
-          "supported": false
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "4.1.4",
-          "pipfileSpec": null,
-          "shape": "extras",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "4.1.4",
-          "pipfileSpec": null,
-          "shape": "extras",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 2
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "4.1.4",
-          "pipfileSpec": null,
-          "shape": "extras",
-          "supported": false
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "4.1.4",
-          "pipfileSpec": null,
-          "shape": "marker",
-          "supported": false
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "4.1.4",
-          "pipfileSpec": null,
-          "shape": "marker",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "4.1.4",
-          "pipfileSpec": null,
-          "shape": "marker",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "4.1.4",
-          "pipfileSpec": null,
-          "shape": "marker",
-          "supported": false
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "4.1.4",
-          "pipfileSpec": null,
-          "shape": "marker-excluded",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "4.1.4",
-          "pipfileSpec": null,
-          "shape": "marker-excluded",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "4.1.4",
-          "pipfileSpec": null,
-          "shape": "marker-excluded",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "4.1.4",
-          "pipfileSpec": null,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 8,
-              "urllib3Listed": true,
-              "venvDistributions": 8
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 8,
-              "urllib3Listed": true,
-              "venvDistributions": 8
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-fix-c/captures/4.1.4-transitive-agent-oot/venvs/project-hOJKMBk9",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "4.1.4",
-          "pipfileSpec": null,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "4.1.4",
-          "pipfileSpec": null,
-          "shape": "transitive",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 5
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is None; only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "4.1.4",
-          "pipfileSpec": null,
-          "shape": "transitive",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "5.4.2",
-          "pipfileSpec": 1,
-          "shape": "crlf",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is Some(1); only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "5.4.2",
-          "pipfileSpec": 1,
-          "shape": "crlf",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "5.4.2",
-          "pipfileSpec": 1,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-fix-b/captures/5.4.2-dev-agent-oot/venvs/project-HHSeGvEK",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "5.4.2",
-          "pipfileSpec": 1,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "5.4.2",
-          "pipfileSpec": 1,
-          "shape": "dev",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is Some(1); only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "5.4.2",
-          "pipfileSpec": 1,
-          "shape": "dev",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "5.4.2",
-          "pipfileSpec": 1,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final-fix-b/captures/5.4.2-direct-agent-oot/venvs/project-75euv67j",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "5.4.2",
-          "pipfileSpec": 1,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "5.4.2",
-          "pipfileSpec": 1,
-          "shape": "direct",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is Some(1); only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "5.4.2",
-          "pipfileSpec": 1,
-          "shape": "direct",
-          "supported": false
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "5.4.2",
-          "pipfileSpec": 1,
-          "shape": "extras",
-          "supported": false
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "5.4.2",
-          "pipfileSpec": 1,
-          "shape": "extras",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "5.4.2",
-          "pipfileSpec": 1,
-          "shape": "extras",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 2
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is Some(1); only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "5.4.2",
-          "pipfileSpec": 1,
-          "shape": "extras",
-          "supported": false
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "5.4.2",
-          "pipfileSpec": 1,
-          "shape": "marker",
-          "supported": false
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "5.4.2",
-          "pipfileSpec": 1,
-          "shape": "marker",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "5.4.2",
-          "pipfileSpec": 1,
-          "shape": "marker",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is Some(1); only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "5.4.2",
-          "pipfileSpec": 1,
-          "shape": "marker",
-          "supported": false
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "5.4.2",
-          "pipfileSpec": 1,
-          "shape": "marker-excluded",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "5.4.2",
-          "pipfileSpec": 1,
-          "shape": "marker-excluded",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is Some(1); only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "5.4.2",
-          "pipfileSpec": 1,
-          "shape": "marker-excluded",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "5.4.2",
-          "pipfileSpec": 1,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 8,
-              "urllib3Listed": true,
-              "venvDistributions": 8
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 8,
-              "urllib3Listed": true,
-              "venvDistributions": 8
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/5.4.2-transitive-agent-oot/venvs/project-PWzNFRQ1",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "5.4.2",
-          "pipfileSpec": 1,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "5.4.2",
-          "pipfileSpec": 1,
-          "shape": "transitive",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 5
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is Some(1); only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "5.4.2",
-          "pipfileSpec": 1,
-          "shape": "transitive",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "6.2.9",
-          "pipfileSpec": 3,
-          "shape": "crlf",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is Some(3); only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "6.2.9",
-          "pipfileSpec": 3,
-          "shape": "crlf",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "6.2.9",
-          "pipfileSpec": 3,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/6.2.9-dev-agent-oot/venvs/project-WccTvFLA",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "6.2.9",
-          "pipfileSpec": 3,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "6.2.9",
-          "pipfileSpec": 3,
-          "shape": "dev",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is Some(3); only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "6.2.9",
-          "pipfileSpec": 3,
-          "shape": "dev",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "6.2.9",
-          "pipfileSpec": 3,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/6.2.9-direct-agent-oot/venvs/project-96LD91ty",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "6.2.9",
-          "pipfileSpec": 3,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "6.2.9",
-          "pipfileSpec": 3,
-          "shape": "direct",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is Some(3); only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "6.2.9",
-          "pipfileSpec": 3,
-          "shape": "direct",
-          "supported": false
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "6.2.9",
-          "pipfileSpec": 3,
-          "shape": "extras",
-          "supported": false
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "6.2.9",
-          "pipfileSpec": 3,
-          "shape": "extras",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "6.2.9",
-          "pipfileSpec": 3,
-          "shape": "extras",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 2
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is Some(3); only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "6.2.9",
-          "pipfileSpec": 3,
-          "shape": "extras",
-          "supported": false
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "6.2.9",
-          "pipfileSpec": 3,
-          "shape": "marker",
-          "supported": false
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "6.2.9",
-          "pipfileSpec": 3,
-          "shape": "marker",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "6.2.9",
-          "pipfileSpec": 3,
-          "shape": "marker",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is Some(3); only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "6.2.9",
-          "pipfileSpec": 3,
-          "shape": "marker",
-          "supported": false
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 0.x\u20136.x mishandle inline-table (markers/extras) Pipfile entries",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "6.2.9",
-          "pipfileSpec": 3,
-          "shape": "marker-excluded",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "6.2.9",
-          "pipfileSpec": 3,
-          "shape": "marker-excluded",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is Some(3); only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "6.2.9",
-          "pipfileSpec": 3,
-          "shape": "marker-excluded",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "6.2.9",
-          "pipfileSpec": 3,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 8,
-              "urllib3Listed": true,
-              "venvDistributions": 8
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 8,
-              "urllib3Listed": true,
-              "venvDistributions": 8
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/6.2.9-transitive-agent-oot/venvs/project-NnL-gs-7",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "6.2.9",
-          "pipfileSpec": 3,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": true,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (redirect_pipenv_skipped)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 0,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "redirect_pipenv_skipped"
-              ],
-              "exit": 0
-            },
-            "rollbackHarmless": {
-              "exit": 1
-            },
-            "scanExit": 0,
-            "warnings": [
-              {
-                "code": "redirect_pipenv_skipped",
-                "detail": "only pipfile-spec 6 supports patch file references"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "6.2.9",
-          "pipfileSpec": 3,
-          "shape": "transitive",
-          "supported": false
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-lock-spec (pypi_pipenv_spec_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported",
-                "vendor_fetched_missing"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 5
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_spec_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "Pipfile.lock _meta.pipfile-spec is Some(3); only spec 6 locks are fixture-tested",
-                "errorCode": "pypi_pipenv_spec_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "6.2.9",
-          "pipfileSpec": 3,
-          "shape": "transitive",
-          "supported": false
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "crlfPreserved": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "7.9.10",
-          "pipfileSpec": 6,
-          "shape": "crlf",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "7.9.10",
-          "pipfileSpec": 6,
-          "shape": "crlf",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "7.9.10",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 7 cannot create its out-of-tree virtualenv in the harness image",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "7.9.10",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": false
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "develop"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "7.9.10",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "7.9.10",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "7.9.10",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 7 cannot create its out-of-tree virtualenv in the harness image",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "7.9.10",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": false
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "7.9.10",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "7.9.10",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "7.9.10",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 7 cannot create its out-of-tree virtualenv in the harness image",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "7.9.10",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": false
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "7.9.10",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 2
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "7.9.10",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "7.9.10",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 7 cannot create its out-of-tree virtualenv in the harness image",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "7.9.10",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": false
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version < '4'",
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "7.9.10",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "7.9.10",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": false
-        },
-        {
-          "checks": {
-            "excludedStaysAbsent": true,
-            "lockUntouched": true,
-            "nothingApplied": true
-          },
-          "expected": "marker excludes urllib3: nothing installed, nothing to patch",
-          "info": {
-            "nothingApplied": {
-              "applied": 0,
-              "exit": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "7.9.10",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "excludedStaysAbsent": true,
-            "expectedSourceKey": true,
-            "freshCloneKeepsExcluded": true,
-            "freshCloneLockUnchanged": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "excludedStaysAbsent": {
-              "urllib3/response.py": null
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneKeepsExcluded": {
-              "exit": 0
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version > '4'",
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "7.9.10",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "7.9.10",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "7.9.10",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {},
-          "expected": "skipped: Pipenv 7 cannot create its out-of-tree virtualenv in the harness image",
-          "info": {},
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "7.9.10",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": false
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "7.9.10",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 5
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "7.9.10",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": false
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "crlfPreserved": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "8.3.2",
-          "pipfileSpec": 6,
-          "shape": "crlf",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "8.3.2",
-          "pipfileSpec": 6,
-          "shape": "crlf",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "8.3.2",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/8.3.2-dev-agent-oot/venvs/project-Iq5OMDdg",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "8.3.2",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "develop"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "8.3.2",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "8.3.2",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "8.3.2",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/8.3.2-direct-agent-oot/venvs/project-RW6cQyoM",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "8.3.2",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "8.3.2",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "8.3.2",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "8.3.2",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 5,
-              "urllib3Listed": true,
-              "venvDistributions": 5
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 5,
-              "urllib3Listed": true,
-              "venvDistributions": 5
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/8.3.2-extras-agent-oot/venvs/project-qCX_4SXE",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "8.3.2",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "8.3.2",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 2
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "8.3.2",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "8.3.2",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/8.3.2-marker-agent-oot/venvs/project-tk6-Ud0l",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "8.3.2",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version < '4'",
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "8.3.2",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "8.3.2",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": false
-        },
-        {
-          "checks": {
-            "excludedStaysAbsent": true,
-            "lockUntouched": true,
-            "nothingApplied": true
-          },
-          "expected": "marker excludes urllib3: nothing installed, nothing to patch",
-          "info": {
-            "nothingApplied": {
-              "applied": 0,
-              "exit": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "8.3.2",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "excludedStaysAbsent": true,
-            "expectedSourceKey": true,
-            "freshCloneKeepsExcluded": true,
-            "freshCloneLockUnchanged": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "excludedStaysAbsent": {
-              "urllib3/response.py": null
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneKeepsExcluded": {
-              "exit": 0
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version > '4'",
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "8.3.2",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "8.3.2",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "8.3.2",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 8,
-              "urllib3Listed": true,
-              "venvDistributions": 8
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 8,
-              "urllib3Listed": true,
-              "venvDistributions": 8
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/8.3.2-transitive-agent-oot/venvs/project-iGJfHZ9t",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "8.3.2",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "8.3.2",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 5
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "8.3.2",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": false
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "crlfPreserved": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "9.1.0",
-          "pipfileSpec": 6,
-          "shape": "crlf",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "9.1.0",
-          "pipfileSpec": 6,
-          "shape": "crlf",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "9.1.0",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/9.1.0-dev-agent-oot/venvs/project-9NPbAK7d",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "9.1.0",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "develop",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "develop"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "9.1.0",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "9.1.0",
-          "pipfileSpec": 6,
-          "shape": "dev",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "9.1.0",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/9.1.0-direct-agent-oot/venvs/project-zwilhVJE",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "9.1.0",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRestoredAfterTamper": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "tamperRejected": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "tamper": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "tamperRejected": {
-              "expectsReject": true,
-              "installExit": 1,
-              "installedPatchedAnyway": false
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "9.1.0",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "9.1.0",
-          "pipfileSpec": 6,
-          "shape": "direct",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "9.1.0",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 5,
-              "urllib3Listed": true,
-              "venvDistributions": 5
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 5,
-              "urllib3Listed": true,
-              "venvDistributions": 5
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/9.1.0-extras-agent-oot/venvs/project-VoTeUWTM",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "9.1.0",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "9.1.0",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 2
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 2
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "9.1.0",
-          "pipfileSpec": 6,
-          "shape": "extras",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "9.1.0",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 4,
-              "urllib3Listed": true,
-              "venvDistributions": 4
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/9.1.0-marker-agent-oot/venvs/project-KTlWVSq1",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "9.1.0",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version < '4'",
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "9.1.0",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "9.1.0",
-          "pipfileSpec": 6,
-          "shape": "marker",
-          "supported": false
-        },
-        {
-          "checks": {
-            "excludedStaysAbsent": true,
-            "lockUntouched": true,
-            "nothingApplied": true
-          },
-          "expected": "marker excludes urllib3: nothing installed, nothing to patch",
-          "info": {
-            "nothingApplied": {
-              "applied": 0,
-              "exit": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "9.1.0",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "excludedStaysAbsent": true,
-            "expectedSourceKey": true,
-            "freshCloneKeepsExcluded": true,
-            "freshCloneLockUnchanged": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "excludedStaysAbsent": {
-              "urllib3/response.py": null
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneKeepsExcluded": {
-              "exit": 0
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "markers": "python_version > '4'",
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "9.1.0",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 1
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "9.1.0",
-          "pipfileSpec": 6,
-          "shape": "marker-excluded",
-          "supported": false
-        },
-        {
-          "checks": {
-            "appliedExactlyOne": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rescanIdempotent": true,
-            "rollbackClearsManifest": true,
-            "rollbackExit0": true,
-            "rollbackKeepsLock": true,
-            "rollbackRestoresUpstreamBytes": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "appliedExactlyOne": {
-              "applied": 1,
-              "patches": [
-                {
-                  "action": "added",
-                  "description": "",
-                  "exportedAt": "Wed, 29 Jul 2026 20:20:47 GMT",
-                  "license": "",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "severity": "HIGH",
-                  "tier": "free",
-                  "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-                  "vulnerabilities": [
-                    {
-                      "cves": [
-                        "CVE-2025-66418"
-                      ],
-                      "description": "## Impact\n\nurllib3 supports chained HTTP encoding algorithms for response content according to RFC 9110 (e.g., `Content-Encoding: gzip, zstd`).\n\nHowever, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data.\n\n\n## Affected \u2026",
-                      "id": "GHSA-gm62-xv2j-4w53",
-                      "severity": "HIGH",
-                      "summary": "urllib3 allows an unbounded number of links in the decompression chain"
-                    }
-                  ]
-                }
-              ],
-              "status": "success"
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "rescanIdempotent": {
-              "applied": 0,
-              "exit": 0,
-              "status": "success"
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 0,
-                "failed": [],
-                "reverted": [],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ]
-              },
-              "rolledBack": 1,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "rollbackRestoresUpstreamBytes": {
-              "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-            },
-            "scanExit": 0,
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "vex": {
-              "exit": 1,
-              "statements": 0
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent",
-          "passed": true,
-          "pipenv": "9.1.0",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "bareScanSeesPipenvVenv": true,
-            "installedBytesPatched": true,
-            "lockUntouched": true,
-            "rollbackClearsManifest": true,
-            "rollbackRestoresUpstream": true,
-            "scanApplied": true,
-            "survivesRepeatInstall": true
-          },
-          "expected": null,
-          "info": {
-            "applyPath": "bare",
-            "bareScan": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 8,
-              "urllib3Listed": true,
-              "venvDistributions": 8
-            },
-            "bareScanSeesPipenvVenv": {
-              "exit": 0,
-              "foreignInterpreterHit": false,
-              "found": 1,
-              "paths": [],
-              "scannedPackages": 8,
-              "urllib3Listed": true,
-              "venvDistributions": 8
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "ootVenv": "/private/tmp/claude-501/-Users-mikolalysenko-Projects-socket-patch/56821dee-aa37-470e-81d6-869966c18cc1/scratchpad/matrix-final/captures/9.1.0-transitive-agent-oot/venvs/project-xNX_V925",
-            "ootVenvNameMatchesWorkon": true,
-            "rollbackRestoresUpstream": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-              }
-            },
-            "scanApplied": {
-              "applied": 1,
-              "exit": 0,
-              "path": "bare"
-            },
-            "survivesRepeatInstall": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            }
-          },
-          "invocation": "in-dir",
-          "mode": "agent-oot",
-          "passed": true,
-          "pipenv": "9.1.0",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "allCategoriesRewritten": true,
-            "appliedExactlyOne": true,
-            "dryRunParity": true,
-            "expectedSourceKey": true,
-            "freshCloneInstallsPatch": true,
-            "freshCloneLockUnchanged": true,
-            "installedBytesPatched": true,
-            "lockHasPatchUrl": true,
-            "lockOnlyApplies": true,
-            "lockOnlyRescanGreen": true,
-            "lockRewritten": true,
-            "lockStillJson": true,
-            "lockUnchangedByInstall": true,
-            "markersExtrasPreserved": true,
-            "metaUnchanged": true,
-            "noCrlfIntroduced": true,
-            "pipenvInstallExit0": true,
-            "pipfileUnchanged": true,
-            "pipfileUnchangedByInstall": true,
-            "recordHasFiles": true,
-            "rescanIdempotent": true,
-            "rollbackAfterRelockRetires": true,
-            "rollbackClearsManifest": true,
-            "rollbackClearsRedirectLedger": true,
-            "rollbackExit0": true,
-            "rollbackKeepsPipfile": true,
-            "rollbackRestoresLockBytes": true,
-            "staleInstallWarned": true,
-            "warmInstallReplacesUpstream": false
-          },
-          "expected": null,
-          "info": {
-            "allCategoriesRewritten": {
-              "pristine": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ],
-              "rewritten": [
-                [
-                  "default",
-                  "urllib3"
-                ]
-              ]
-            },
-            "applied": 1,
-            "appliedExactlyOne": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success",
-              "warnings": [
-                {
-                  "code": "redirect_pypi_stale_install",
-                  "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-                }
-              ]
-            },
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "expectedSourceKey": {
-              "expected": "path",
-              "got": [
-                "path"
-              ]
-            },
-            "freshCloneInstallsPatch": {
-              "exit": 0,
-              "oracle": {
-                "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-              }
-            },
-            "installedBytesPatched": {
-              "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-            },
-            "lockOnly": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 1,
-              "codes": [],
-              "exit": 0,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyRescanGreen": {
-              "codes": [],
-              "exit": 0,
-              "status": "success"
-            },
-            "relock": {
-              "exit": 0,
-              "lockBytesUnchanged": false,
-              "patchSourceKept": false,
-              "pipfileUnchanged": true
-            },
-            "rescanIdempotent": {
-              "applied": 1,
-              "exit": 0,
-              "status": "success"
-            },
-            "rewrittenEntries": [
-              {
-                "entry": {
-                  "hashes": [
-                    "sha256:ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                  ],
-                  "path": "https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6"
-                },
-                "key": "urllib3",
-                "section": "default"
-              }
-            ],
-            "rollbackAfterRelockRetires": {
-              "cleared": true,
-              "envelope": {
-                "failed": 0,
-                "hosted": {
-                  "editedFiles": 0,
-                  "failed": [],
-                  "reverted": [
-                    "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                  ],
-                  "unsupported": []
-                },
-                "status": "success",
-                "vendoredReverted": []
-              },
-              "exit": 0,
-              "lockKeptRelocked": true
-            },
-            "rollbackEnvelope": {
-              "failed": 0,
-              "hosted": {
-                "editedFiles": 1,
-                "failed": [],
-                "reverted": [
-                  "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-                ],
-                "unsupported": []
-              },
-              "manifest": {
-                "preserved": false,
-                "removedEntries": []
-              },
-              "rolledBack": 0,
-              "status": "success",
-              "vendoredReverted": []
-            },
-            "scanExit": 0,
-            "sourceKeys": [
-              "path"
-            ],
-            "staleInstallWarned": {
-              "codes": [
-                "redirect_pypi_stale_install"
-              ],
-              "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes)"
-            },
-            "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-            "verify": {
-              "exit": 2
-            },
-            "vex": {
-              "exit": 0,
-              "statements": 1
-            },
-            "warmInstallReplacesUpstream": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warmReinstalled": {
-              "install": {
-                "exit": 0,
-                "patched": false
-              }
-            },
-            "warnings": [
-              {
-                "code": "redirect_pypi_stale_install",
-                "detail": "pkg:pypi/urllib3@1.26.18 was redirected to a hosted patch, but installed files in ./.venv/lib/python3.8/site-packages still differ from the patched hashes. Pipenv does not reinstall a release that is already present (`pipenv install`, `pipenv install --deploy` and `pipenv sync` all keep those bytes), so the rewritten Pipfile.lock only protects fresh installs. Reinstall it from the lock without tou\u2026"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "hosted",
-          "passed": true,
-          "pipenv": "9.1.0",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": true
-        },
-        {
-          "checks": {
-            "dryRunParity": false,
-            "lockOnlyApplies": false,
-            "lockUnchanged": true,
-            "noLedger": true,
-            "pipfileUnchanged": true,
-            "refusedWithCode": true,
-            "rollbackHarmless": true
-          },
-          "expected": "refused: unsupported-vendored-installer (pypi_pipenv_installer_unsupported)",
-          "info": {
-            "applied": 0,
-            "dryRun": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "dryRunParity": {
-              "applied": 1,
-              "exit": 0,
-              "untouched": true
-            },
-            "lockOnly": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 5
-            },
-            "lockOnlyApplies": {
-              "applied": 0,
-              "codes": [
-                "package_not_installed",
-                "vendor_fetch_unverifiable"
-              ],
-              "exit": 1,
-              "lockfileOnlyPackages": 5
-            },
-            "refusedWithCode": {
-              "applied": 0,
-              "codes": [
-                "pypi_pipenv_installer_unsupported"
-              ],
-              "exit": 1
-            },
-            "rollbackHarmless": {
-              "exit": 0
-            },
-            "scanExit": 1,
-            "warnings": [
-              {
-                "action": "failed",
-                "error": "vendored wheel references require Pipenv 2018 or later; upgrade Pipenv or use hosted mode",
-                "errorCode": "pypi_pipenv_installer_unsupported",
-                "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-              }
-            ]
-          },
-          "invocation": "in-dir",
-          "mode": "vendored",
-          "passed": true,
-          "pipenv": "9.1.0",
-          "pipfileSpec": 6,
-          "shape": "transitive",
-          "supported": false
-        }
-      ]
-    }
-  }
-}
diff --git a/docs/testing/poetry-compatibility.md b/docs/testing/poetry-compatibility.md
index 28848071..c59d7fcc 100644
--- a/docs/testing/poetry-compatibility.md
+++ b/docs/testing/poetry-compatibility.md
@@ -25,9 +25,10 @@ managers.
 
 Both modes retain the package version, dependencies, groups, markers, extras
 and the pyproject `content-hash`; no pyproject edit is required. A repeated
-scan leaves the lock unchanged. Rollback restores the recorded original
-fragments — one per patch (plus the integrity-table entry on legacy formats),
-so either of two patches can be rolled back first and unrelated edits survive.
+scan leaves the lock unchanged. Vendored rollback restores the recorded original
+fragments. Hosted rollback
+resolves upstream registry entries; it has no replay ledger or guarantee of the
+original byte layout. Both preserve unrelated entries.
 Refused before any write: a `[[package]]` listed at several versions (marker
 fork), a user-authored `[package.source]` on another origin (an earlier Socket
 URL for the same wheel is superseded in place, e.g. after a grant-token
@@ -95,11 +96,9 @@ Other measured details:
   `files` the rewrite added for Poetry ≥ 1.2's hash check; a lock relocked by
   1.1 and then installed by 1.2+ installs the hosted wheel unverified. Re-run
   `socket-patch scan --mode hosted` after relocking on those releases: the
-  re-scan restores the entry and rebases the ledger's recorded edits onto the
-  relocked text (pristine → current, never an appended chain), so `rollback`
-  still lands on the pristine lock afterwards. A relocked-but-not-rescanned
-  lock is refused by `rollback` (its recorded fragments match nothing) rather
-  than reported as already reverted.
+  re-scan restores the source and integrity fields. In v5, hosted rollback
+  reconstructs upstream metadata and may refuse a drifted lock; it does not replay
+  pre-scan fragments.
 - Poetry 0.12 and 1.0 resolve a relative `type = "file"` path against the
   shell's working directory, not the project root; run `poetry install` from
   the project root on those releases.
@@ -172,38 +171,5 @@ utils::poetry_lock vendor::pypi_poetry` and `cargo test -p socket-patch-core
 `crates/socket-patch-core/tests/fixtures/poetry/<version>/` are the harness's
 `original/` inputs (same pyproject, same `content-hash`).
 
-## Results
-
-<!-- GENERATED:BEGIN — everything down to GENERATED:END is printed by
-     `python3 scripts/backtest-poetry.py --render-doc-table docs/testing/poetry-compatibility/results.json`;
-     regenerate rather than hand-edit. -->
-| Poetry | hosted | vendored | agent (in-project venv) | agent (`poetry run`, out-of-tree venv) | tamper rejected (hosted / vendored) | warm venv re-installed (hosted / vendored) | relock keeps patch (hosted / vendored) | lock-only vendored |
-| --- | --- | --- | --- | --- | --- | --- | --- | --- |
-| 0.12.17 | refused (0.x ignores URL sources) | pass (crlf,direct,populated) | pass (direct) | n/a | n/a / no | n/a / false | n/a / false | refused |
-| 1.0.10 | pass (crlf,direct,populated) | pass (crlf,direct,populated) | pass (direct) | pass (direct) | yes / no | false / false | false / false | refused (crlf), refused (direct), yes (populated) |
-| 1.1.15 | pass (crlf,direct,populated) | pass (crlf,direct,populated) | pass (direct) | pass (direct) | yes / no | false / false | true / true | refused (crlf), refused (direct), yes (populated) |
-| 1.2.2 | pass (crlf,direct) | pass (crlf,direct) | pass (direct) | pass (direct) | yes / no | false / false | true / true | yes |
-| 1.3.2 | pass (crlf,direct) | pass (crlf,direct) | pass (direct) | pass (direct) | yes / no | false / false | true / true | yes |
-| 1.4.2 | pass (crlf,direct) | pass (crlf,direct) | pass (direct) | pass (direct) | yes / yes | true / true | true / true | yes |
-| 1.5.1 | pass (crlf,direct) | pass (crlf,direct) | pass (direct) | pass (direct) | yes / yes | true / true | true / true | yes |
-| 1.6.1 | pass (crlf,direct) | pass (crlf,direct) | pass (direct) | pass (direct) | yes / yes | true / true | true / true | yes |
-| 1.7.1 | pass (crlf,direct) | pass (crlf,direct) | pass (direct) | pass (direct) | yes / yes | true / true | true / true | yes |
-| 1.8.5 | pass (crlf,direct) | pass (crlf,direct) | pass (direct) | pass (direct) | yes / yes | true / true | true / true | yes |
-| 2.0.1 | pass (crlf,direct,pep621) | pass (crlf,direct,pep621) | pass (direct) | pass (direct) | yes / yes | true / true | true / true | yes |
-| 2.1.4 | pass (crlf,direct,pep621) | pass (crlf,direct,pep621) | pass (direct) | pass (direct) | yes / yes | true / true | true / true | yes |
-| 2.2.1 | pass (crlf,direct,pep621) | pass (crlf,direct,pep621) | pass (direct) | pass (direct) | yes / yes | true / true | true / true | yes |
-| 2.3.4 | pass (crlf,direct,pep621) | pass (crlf,direct,pep621) | pass (direct) | pass (direct) | yes / yes | true / true | true / true | yes |
-| 2.4.3 | pass (crlf,direct,pep621) | pass (crlf,direct,pep621) | pass (direct) | pass (direct) | yes / yes | true / true | true / true | yes |
-<!-- GENERATED:END -->
-
-Captured 2026-09-17 on macOS arm64 against the fix-branch head; 108 cases,
-all passing (the `pass`/`refused` cells are the asserted outcomes; the
-`tamper` / `warm venv` / `relock` / `lock-only vendored` columns are the
-measured installer facts the sections above describe). The
-[machine-readable results](poetry-compatibility/results.json) carry every
-check, the CLI envelopes' relevant fields and the per-step exit codes.
-`poetry lock` on 0.12 / 1.0 is bare (no `--no-update`), hence
-`relock keeps patch = false` there; `lock-only vendored = refused` on 0.12 and
-on the unpopulated 1.0/1.1 fixtures (`urllib3 = []`) because those locks name
-no wheel hash. The companion SBOM annotation work and its own capture set live
-in SocketDev/depscan (`tools/pipeline/poetry-patch-backtest.py`).
+Full run results belong with the source revision and toolchain versions in CI
+artifacts or a local output directory. See the [testing guide](README.md#ci-and-results).
diff --git a/docs/testing/poetry-compatibility/results.json b/docs/testing/poetry-compatibility/results.json
deleted file mode 100644
index d85d8915..00000000
--- a/docs/testing/poetry-compatibility/results.json
+++ /dev/null
@@ -1,11925 +0,0 @@
-{
- "errors": [],
- "provenance": {
-  "capturedAt": "2026-09-17T20:22:39.127492+00:00",
-  "cliRevision": "75d49ac",
-  "cliSha256": "40a16bf5f5fe0f58e738710b88283a6dd412de0e6e23f958b324d9debacf201d",
-  "host": "Darwin arm64",
-  "modes": [
-   "hosted",
-   "vendored",
-   "agent",
-   "agent-oot",
-   "setup"
-  ],
-  "note": "Single harness run on the fix-branch head; the Poetry 1.1.15 `setup` case was re-run alone after its first attempt hit Poetry <= 1.1's shared HTTP-cache lock (the CLI-spawned `poetry lock` now also gets the case-isolated HOME).",
-  "poetryVersions": [
-   "0.12.17",
-   "1.0.10",
-   "1.1.15",
-   "1.2.2",
-   "1.3.2",
-   "1.4.2",
-   "1.5.1",
-   "1.6.1",
-   "1.7.1",
-   "1.8.5",
-   "2.0.1",
-   "2.1.4",
-   "2.2.1",
-   "2.3.4",
-   "2.4.3"
-  ],
-  "shapes": [
-   "direct",
-   "populated",
-   "crlf",
-   "pep621"
-  ]
- },
- "results": [
-  {
-   "checks": {
-    "lockUnchanged": true,
-    "noLedger": true,
-    "pyprojectUnchanged": true,
-    "refusedWithWarning": true
-   },
-   "expected": "refused: Poetry 0.x ignores URL sources",
-   "info": {
-    "applied": 0,
-    "refusedWithWarning": [
-     {
-      "code": "redirect_poetry_lock_unsupported",
-      "detail": "poetry.lock: Poetry 0.x ignores URL sources; hosted patches require Poetry >= 1.0"
-     }
-    ],
-    "scanExit": 0,
-    "warnings": [
-     {
-      "code": "redirect_poetry_lock_unsupported",
-      "detail": "poetry.lock: Poetry 0.x ignores URL sources; hosted patches require Poetry >= 1.0"
-     }
-    ]
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "0.12.17",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "crlfPreserved": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": false,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": false
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "pypi_poetry_integrity_unverified",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "poetry.lock was written by Poetry < 1.4: that installer does not verify local wheel hashes (the committed wheel bytes are the protection \u2014 review them) and does not replace an already-installed package at the same version \u2014 upgrade to Poetry >= 1.4, or recreate the virtualenv (or `pip uninstall` the package) before `poetry install`"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 .socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n  - Installing poetry-patch-fixture (0.1.0)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": null
-    },
-    "lockOnlyVendor": {
-     "applied": 0,
-     "codes": [
-      "package_not_installed",
-      "vendor_fetch_unverifiable"
-     ],
-     "exit": 1
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 0,
-     "codes": [
-      "package_not_installed",
-      "vendor_fetch_unverifiable"
-     ],
-     "exit": 1
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 .socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n  - Installing poetry-patch-fixture (0.1.0)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": false,
-     "patchSourceKept": false,
-     "pyprojectUnchanged": true,
-     "tail": "Updating dependencies\nResolving dependencies...\n\nWriting lock file\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNothing to install or update\n\n  - Installing poetry-patch-fixture (0.1.0)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNothing to install or update\n\n  - Installing poetry-patch-fixture (0.1.0)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "pypi_poetry_integrity_unverified",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "poetry.lock was written by Poetry < 1.4: that installer does not verify local wheel hashes (the committed wheel bytes are the protection \u2014 review them) and does not replace an already-installed package at the same version \u2014 upgrade to Poetry >= 1.4, or recreate the virtualenv (or `pip uninstall` the package) before `poetry install`"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "0.12.17",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "installedBytesPatched": true,
-    "lockUnchanged": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "rollbackRestoresUpstreamBytes": true,
-    "survivesRepeatInstall": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 1,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "rollbackRestoresUpstreamBytes": {
-     "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-    },
-    "scanExit": 0,
-    "survivesRepeatInstall": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "warnings": []
-   },
-   "mode": "agent",
-   "passed": true,
-   "poetry": "0.12.17",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "lockUnchanged": true,
-    "noLedger": true,
-    "pyprojectUnchanged": true,
-    "refusedWithWarning": true
-   },
-   "expected": "refused: Poetry 0.x ignores URL sources",
-   "info": {
-    "applied": 0,
-    "refusedWithWarning": [
-     {
-      "code": "redirect_poetry_lock_unsupported",
-      "detail": "poetry.lock: Poetry 0.x ignores URL sources; hosted patches require Poetry >= 1.0"
-     }
-    ],
-    "scanExit": 0,
-    "warnings": [
-     {
-      "code": "redirect_poetry_lock_unsupported",
-      "detail": "poetry.lock: Poetry 0.x ignores URL sources; hosted patches require Poetry >= 1.0"
-     }
-    ]
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "0.12.17",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": false,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": false
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "pypi_poetry_integrity_unverified",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "poetry.lock was written by Poetry < 1.4: that installer does not verify local wheel hashes (the committed wheel bytes are the protection \u2014 review them) and does not replace an already-installed package at the same version \u2014 upgrade to Poetry >= 1.4, or recreate the virtualenv (or `pip uninstall` the package) before `poetry install`"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 .socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n  - Installing poetry-patch-fixture (0.1.0)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": null
-    },
-    "lockOnlyVendor": {
-     "applied": 0,
-     "codes": [
-      "package_not_installed",
-      "vendor_fetch_unverifiable"
-     ],
-     "exit": 1
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 0,
-     "codes": [
-      "package_not_installed",
-      "vendor_fetch_unverifiable"
-     ],
-     "exit": 1
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 .socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n  - Installing poetry-patch-fixture (0.1.0)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": false,
-     "patchSourceKept": false,
-     "pyprojectUnchanged": true,
-     "tail": "Updating dependencies\nResolving dependencies...\n\nWriting lock file\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": false,
-     "installExit": 0,
-     "installedPatchedAnyway": true
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": false,
-     "installExit": 0,
-     "installedPatchedAnyway": true
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNothing to install or update\n\n  - Installing poetry-patch-fixture (0.1.0)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNothing to install or update\n\n  - Installing poetry-patch-fixture (0.1.0)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "pypi_poetry_integrity_unverified",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "poetry.lock was written by Poetry < 1.4: that installer does not verify local wheel hashes (the committed wheel bytes are the protection \u2014 review them) and does not replace an already-installed package at the same version \u2014 upgrade to Poetry >= 1.4, or recreate the virtualenv (or `pip uninstall` the package) before `poetry install`"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "0.12.17",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "lockUnchanged": true,
-    "noLedger": true,
-    "pyprojectUnchanged": true,
-    "refusedWithWarning": true
-   },
-   "expected": "refused: Poetry 0.x ignores URL sources",
-   "info": {
-    "applied": 0,
-    "refusedWithWarning": [
-     {
-      "code": "redirect_poetry_lock_unsupported",
-      "detail": "poetry.lock: Poetry 0.x ignores URL sources; hosted patches require Poetry >= 1.0"
-     }
-    ],
-    "scanExit": 0,
-    "warnings": [
-     {
-      "code": "redirect_poetry_lock_unsupported",
-      "detail": "poetry.lock: Poetry 0.x ignores URL sources; hosted patches require Poetry >= 1.0"
-     }
-    ]
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "0.12.17",
-   "shape": "populated"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": false,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": false
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "pypi_poetry_integrity_unverified",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "poetry.lock was written by Poetry < 1.4: that installer does not verify local wheel hashes (the committed wheel bytes are the protection \u2014 review them) and does not replace an already-installed package at the same version \u2014 upgrade to Poetry >= 1.4, or recreate the virtualenv (or `pip uninstall` the package) before `poetry install`"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 .socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n  - Installing poetry-patch-fixture (0.1.0)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": null
-    },
-    "lockOnlyVendor": {
-     "applied": 0,
-     "codes": [
-      "package_not_installed",
-      "vendor_fetch_unverifiable"
-     ],
-     "exit": 1
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 0,
-     "codes": [
-      "package_not_installed",
-      "vendor_fetch_unverifiable"
-     ],
-     "exit": 1
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 .socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n  - Installing poetry-patch-fixture (0.1.0)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": false,
-     "patchSourceKept": false,
-     "pyprojectUnchanged": true,
-     "tail": "Updating dependencies\nResolving dependencies...\n\nWriting lock file\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": false,
-     "installExit": 0,
-     "installedPatchedAnyway": true
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": false,
-     "installExit": 0,
-     "installedPatchedAnyway": true
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNothing to install or update\n\n  - Installing poetry-patch-fixture (0.1.0)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNothing to install or update\n\n  - Installing poetry-patch-fixture (0.1.0)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "pypi_poetry_integrity_unverified",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "poetry.lock was written by Poetry < 1.4: that installer does not verify local wheel hashes (the committed wheel bytes are the protection \u2014 review them) and does not replace an already-installed package at the same version \u2014 upgrade to Poetry >= 1.4, or recreate the virtualenv (or `pip uninstall` the package) before `poetry install`"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "0.12.17",
-   "shape": "populated"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "crlfPreserved": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "warmInstallReplacesUpstream": false
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "code": "redirect_poetry_stale_install_risk",
-       "detail": "poetry.lock was written by Poetry < 1.4, which does not replace an already-installed package at the same version: an existing virtualenv keeps the upstream urllib3 until it is recreated (or the package is `pip uninstall`ed) before `poetry install`; fresh installs pick up the patched wheel. Poetry 1.0 installs through pip: pip 22.3\u201323.0 misparse the hash fragment and refuse the install (fail-closed) \u2014 use pip <= 22.2 or >= 23.1 in the virtualenv."
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6&)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": null
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6&)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": false,
-     "patchSourceKept": false,
-     "pyprojectUnchanged": true,
-     "tail": "Updating dependencies\nResolving dependencies...\n\nWriting lock file\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNo dependencies to install or update\n\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNo dependencies to install or update\n\n"
-    },
-    "warnings": [
-     {
-      "code": "redirect_poetry_stale_install_risk",
-      "detail": "poetry.lock was written by Poetry < 1.4, which does not replace an already-installed package at the same version: an existing virtualenv keeps the upstream urllib3 until it is recreated (or the package is `pip uninstall`ed) before `poetry install`; fresh installs pick up the patched wheel. Poetry 1.0 installs through pip: pip 22.3\u201323.0 misparse the hash fragment and refuse the install (fail-closed) \u2014 use pip <= 22.2 or >= 23.1 in the virtualenv."
-     }
-    ]
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "1.0.10",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "crlfPreserved": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": false,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": false
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "pypi_poetry_integrity_unverified",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "poetry.lock was written by Poetry < 1.4: that installer does not verify local wheel hashes (the committed wheel bytes are the protection \u2014 review them) and does not replace an already-installed package at the same version \u2014 upgrade to Poetry >= 1.4, or recreate the virtualenv (or `pip uninstall` the package) before `poetry install`"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 .socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": null
-    },
-    "lockOnlyVendor": {
-     "applied": 0,
-     "codes": [
-      "package_not_installed",
-      "vendor_fetch_unverifiable"
-     ],
-     "exit": 1
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 0,
-     "codes": [
-      "package_not_installed",
-      "vendor_fetch_unverifiable"
-     ],
-     "exit": 1
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 .socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": false,
-     "patchSourceKept": false,
-     "pyprojectUnchanged": true,
-     "tail": "Updating dependencies\nResolving dependencies...\n\nWriting lock file\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNo dependencies to install or update\n\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNo dependencies to install or update\n\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "pypi_poetry_integrity_unverified",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "poetry.lock was written by Poetry < 1.4: that installer does not verify local wheel hashes (the committed wheel bytes are the protection \u2014 review them) and does not replace an already-installed package at the same version \u2014 upgrade to Poetry >= 1.4, or recreate the virtualenv (or `pip uninstall` the package) before `poetry install`"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "1.0.10",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "installedBytesPatched": true,
-    "lockUnchanged": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "rollbackRestoresUpstreamBytes": true,
-    "survivesRepeatInstall": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 1,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "rollbackRestoresUpstreamBytes": {
-     "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-    },
-    "scanExit": 0,
-    "survivesRepeatInstall": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "warnings": []
-   },
-   "mode": "agent",
-   "passed": true,
-   "poetry": "1.0.10",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "bareScanSeesPoetryVenv": true,
-    "patchedViaPoetryRun": true,
-    "poetryRunScanApplied": true,
-    "rollbackClearsManifest": true,
-    "rollbackRestoresUpstream": true,
-    "survivesRepeatInstall": true
-   },
-   "expected": "bareScanSeesPoetryVenv is informational (known crawler gap); the rest must pass",
-   "info": {
-    "applyPath": "bare",
-    "bareScan": {
-     "exit": 0,
-     "packageDirs": [],
-     "packagesWithPatches": 1,
-     "paths": [],
-     "scannedPackages": 3,
-     "urllib3Found": true
-    },
-    "bareScanSeesPoetryVenv": {
-     "found": 1,
-     "scannedPackages": 3
-    },
-    "ootVenv": "<scratch>/matrix-final2/captures/1.0.10-direct-agent-oot/venvs/poetry-patch-fixture-OOp1MSO--py3.8",
-    "patchedViaPoetryRun": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "poetryRunScanApplied": {
-     "applied": 1,
-     "exit": 0,
-     "path": "bare"
-    },
-    "rollbackRestoresUpstream": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-     }
-    },
-    "survivesRepeatInstall": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    }
-   },
-   "mode": "agent-oot",
-   "passed": true,
-   "poetry": "1.0.10",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "warmInstallReplacesUpstream": false
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "code": "redirect_poetry_stale_install_risk",
-       "detail": "poetry.lock was written by Poetry < 1.4, which does not replace an already-installed package at the same version: an existing virtualenv keeps the upstream urllib3 until it is recreated (or the package is `pip uninstall`ed) before `poetry install`; fresh installs pick up the patched wheel. Poetry 1.0 installs through pip: pip 22.3\u201323.0 misparse the hash fragment and refuse the install (fail-closed) \u2014 use pip <= 22.2 or >= 23.1 in the virtualenv."
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6&)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": null
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6&)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": false,
-     "patchSourceKept": false,
-     "pyprojectUnchanged": true,
-     "tail": "Updating dependencies\nResolving dependencies...\n\nWriting lock file\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNo dependencies to install or update\n\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNo dependencies to install or update\n\n"
-    },
-    "warnings": [
-     {
-      "code": "redirect_poetry_stale_install_risk",
-      "detail": "poetry.lock was written by Poetry < 1.4, which does not replace an already-installed package at the same version: an existing virtualenv keeps the upstream urllib3 until it is recreated (or the package is `pip uninstall`ed) before `poetry install`; fresh installs pick up the patched wheel. Poetry 1.0 installs through pip: pip 22.3\u201323.0 misparse the hash fragment and refuse the install (fail-closed) \u2014 use pip <= 22.2 or >= 23.1 in the virtualenv."
-     }
-    ]
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "1.0.10",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": false,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": false
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "pypi_poetry_integrity_unverified",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "poetry.lock was written by Poetry < 1.4: that installer does not verify local wheel hashes (the committed wheel bytes are the protection \u2014 review them) and does not replace an already-installed package at the same version \u2014 upgrade to Poetry >= 1.4, or recreate the virtualenv (or `pip uninstall` the package) before `poetry install`"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 .socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": null
-    },
-    "lockOnlyVendor": {
-     "applied": 0,
-     "codes": [
-      "package_not_installed",
-      "vendor_fetch_unverifiable"
-     ],
-     "exit": 1
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 0,
-     "codes": [
-      "package_not_installed",
-      "vendor_fetch_unverifiable"
-     ],
-     "exit": 1
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 .socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": false,
-     "patchSourceKept": false,
-     "pyprojectUnchanged": true,
-     "tail": "Updating dependencies\nResolving dependencies...\n\nWriting lock file\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": false,
-     "installExit": 0,
-     "installedPatchedAnyway": true
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": false,
-     "installExit": 0,
-     "installedPatchedAnyway": true
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNo dependencies to install or update\n\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNo dependencies to install or update\n\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "pypi_poetry_integrity_unverified",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "poetry.lock was written by Poetry < 1.4: that installer does not verify local wheel hashes (the committed wheel bytes are the protection \u2014 review them) and does not replace an already-installed package at the same version \u2014 upgrade to Poetry >= 1.4, or recreate the virtualenv (or `pip uninstall` the package) before `poetry install`"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "1.0.10",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "warmInstallReplacesUpstream": false
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "code": "redirect_poetry_stale_install_risk",
-       "detail": "poetry.lock was written by Poetry < 1.4, which does not replace an already-installed package at the same version: an existing virtualenv keeps the upstream urllib3 until it is recreated (or the package is `pip uninstall`ed) before `poetry install`; fresh installs pick up the patched wheel. Poetry 1.0 installs through pip: pip 22.3\u201323.0 misparse the hash fragment and refuse the install (fail-closed) \u2014 use pip <= 22.2 or >= 23.1 in the virtualenv."
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6&)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": null
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl#sha256=ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6&)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": false,
-     "patchSourceKept": false,
-     "pyprojectUnchanged": true,
-     "tail": "Updating dependencies\nResolving dependencies...\n\nWriting lock file\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNo dependencies to install or update\n\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNo dependencies to install or update\n\n"
-    },
-    "warnings": [
-     {
-      "code": "redirect_poetry_stale_install_risk",
-      "detail": "poetry.lock was written by Poetry < 1.4, which does not replace an already-installed package at the same version: an existing virtualenv keeps the upstream urllib3 until it is recreated (or the package is `pip uninstall`ed) before `poetry install`; fresh installs pick up the patched wheel. Poetry 1.0 installs through pip: pip 22.3\u201323.0 misparse the hash fragment and refuse the install (fail-closed) \u2014 use pip <= 22.2 or >= 23.1 in the virtualenv."
-     }
-    ]
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "1.0.10",
-   "shape": "populated"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": false
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "pypi_poetry_integrity_unverified",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "poetry.lock was written by Poetry < 1.4: that installer does not verify local wheel hashes (the committed wheel bytes are the protection \u2014 review them) and does not replace an already-installed package at the same version \u2014 upgrade to Poetry >= 1.4, or recreate the virtualenv (or `pip uninstall` the package) before `poetry install`"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 .socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": null
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "pypi_poetry_integrity_unverified",
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "pypi_poetry_integrity_unverified",
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 .socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": false,
-     "patchSourceKept": false,
-     "pyprojectUnchanged": true,
-     "tail": "Updating dependencies\nResolving dependencies...\n\nWriting lock file\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": false,
-     "installExit": 0,
-     "installedPatchedAnyway": true
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": false,
-     "installExit": 0,
-     "installedPatchedAnyway": true
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNo dependencies to install or update\n\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNo dependencies to install or update\n\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "pypi_poetry_integrity_unverified",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "poetry.lock was written by Poetry < 1.4: that installer does not verify local wheel hashes (the committed wheel bytes are the protection \u2014 review them) and does not replace an already-installed package at the same version \u2014 upgrade to Poetry >= 1.4, or recreate the virtualenv (or `pip uninstall` the package) before `poetry install`"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "1.0.10",
-   "shape": "populated"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "crlfPreserved": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanAfterRelockApplies": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "warmInstallReplacesUpstream": false
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "code": "redirect_poetry_stale_install_risk",
-       "detail": "poetry.lock was written by Poetry < 1.4, which does not replace an already-installed package at the same version: an existing virtualenv keeps the upstream urllib3 until it is recreated (or the package is `pip uninstall`ed) before `poetry install`; fresh installs pick up the patched wheel."
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": null
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": false,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n\nWriting lock file\n"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "exit": 0,
-     "lockChanged": true
-    },
-    "rescanAfterRelockApplies": {
-     "applied": 1,
-     "exit": 0
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNo dependencies to install or update\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNo dependencies to install or update\n"
-    },
-    "warnings": [
-     {
-      "code": "redirect_poetry_stale_install_risk",
-      "detail": "poetry.lock was written by Poetry < 1.4, which does not replace an already-installed package at the same version: an existing virtualenv keeps the upstream urllib3 until it is recreated (or the package is `pip uninstall`ed) before `poetry install`; fresh installs pick up the patched wheel."
-     }
-    ]
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "1.1.15",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "crlfPreserved": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": false,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": false
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "pypi_poetry_integrity_unverified",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "poetry.lock was written by Poetry < 1.4: that installer does not verify local wheel hashes (the committed wheel bytes are the protection \u2014 review them) and does not replace an already-installed package at the same version \u2014 upgrade to Poetry >= 1.4, or recreate the virtualenv (or `pip uninstall` the package) before `poetry install`"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.1.15-crlf-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": null
-    },
-    "lockOnlyVendor": {
-     "applied": 0,
-     "codes": [
-      "package_not_installed",
-      "vendor_fetch_unverifiable"
-     ],
-     "exit": 1
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 0,
-     "codes": [
-      "package_not_installed",
-      "vendor_fetch_unverifiable"
-     ],
-     "exit": 1
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.1.15-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNo dependencies to install or update\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNo dependencies to install or update\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "pypi_poetry_integrity_unverified",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "poetry.lock was written by Poetry < 1.4: that installer does not verify local wheel hashes (the committed wheel bytes are the protection \u2014 review them) and does not replace an already-installed package at the same version \u2014 upgrade to Poetry >= 1.4, or recreate the virtualenv (or `pip uninstall` the package) before `poetry install`"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "1.1.15",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "installedBytesPatched": true,
-    "lockUnchanged": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "rollbackRestoresUpstreamBytes": true,
-    "survivesRepeatInstall": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 1,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "rollbackRestoresUpstreamBytes": {
-     "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-    },
-    "scanExit": 0,
-    "survivesRepeatInstall": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "warnings": []
-   },
-   "mode": "agent",
-   "passed": true,
-   "poetry": "1.1.15",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "bareScanSeesPoetryVenv": true,
-    "patchedViaPoetryRun": true,
-    "poetryRunScanApplied": true,
-    "rollbackClearsManifest": true,
-    "rollbackRestoresUpstream": true,
-    "survivesRepeatInstall": true
-   },
-   "expected": "bareScanSeesPoetryVenv is informational (known crawler gap); the rest must pass",
-   "info": {
-    "applyPath": "bare",
-    "bareScan": {
-     "exit": 0,
-     "packageDirs": [],
-     "packagesWithPatches": 1,
-     "paths": [],
-     "scannedPackages": 4,
-     "urllib3Found": true
-    },
-    "bareScanSeesPoetryVenv": {
-     "found": 1,
-     "scannedPackages": 4
-    },
-    "ootVenv": "<scratch>/matrix-final2/captures/1.1.15-direct-agent-oot/venvs/poetry-patch-fixture-Ynsj_tRb-py3.8",
-    "patchedViaPoetryRun": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "poetryRunScanApplied": {
-     "applied": 1,
-     "exit": 0,
-     "path": "bare"
-    },
-    "rollbackRestoresUpstream": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-     }
-    },
-    "survivesRepeatInstall": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    }
-   },
-   "mode": "agent-oot",
-   "passed": true,
-   "poetry": "1.1.15",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanAfterRelockApplies": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "warmInstallReplacesUpstream": false
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "code": "redirect_poetry_stale_install_risk",
-       "detail": "poetry.lock was written by Poetry < 1.4, which does not replace an already-installed package at the same version: an existing virtualenv keeps the upstream urllib3 until it is recreated (or the package is `pip uninstall`ed) before `poetry install`; fresh installs pick up the patched wheel."
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": null
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": false,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n\nWriting lock file\n"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "exit": 0,
-     "lockChanged": true
-    },
-    "rescanAfterRelockApplies": {
-     "applied": 1,
-     "exit": 0
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNo dependencies to install or update\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNo dependencies to install or update\n"
-    },
-    "warnings": [
-     {
-      "code": "redirect_poetry_stale_install_risk",
-      "detail": "poetry.lock was written by Poetry < 1.4, which does not replace an already-installed package at the same version: an existing virtualenv keeps the upstream urllib3 until it is recreated (or the package is `pip uninstall`ed) before `poetry install`; fresh installs pick up the patched wheel."
-     }
-    ]
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "1.1.15",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": false,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": false
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "pypi_poetry_integrity_unverified",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "poetry.lock was written by Poetry < 1.4: that installer does not verify local wheel hashes (the committed wheel bytes are the protection \u2014 review them) and does not replace an already-installed package at the same version \u2014 upgrade to Poetry >= 1.4, or recreate the virtualenv (or `pip uninstall` the package) before `poetry install`"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.1.15-direct-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": null
-    },
-    "lockOnlyVendor": {
-     "applied": 0,
-     "codes": [
-      "package_not_installed",
-      "vendor_fetch_unverifiable"
-     ],
-     "exit": 1
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 0,
-     "codes": [
-      "package_not_installed",
-      "vendor_fetch_unverifiable"
-     ],
-     "exit": 1
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.1.15-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": false,
-     "installExit": 0,
-     "installedPatchedAnyway": true
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": false,
-     "installExit": 0,
-     "installedPatchedAnyway": true
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNo dependencies to install or update\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNo dependencies to install or update\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "pypi_poetry_integrity_unverified",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "poetry.lock was written by Poetry < 1.4: that installer does not verify local wheel hashes (the committed wheel bytes are the protection \u2014 review them) and does not replace an already-installed package at the same version \u2014 upgrade to Poetry >= 1.4, or recreate the virtualenv (or `pip uninstall` the package) before `poetry install`"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "1.1.15",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanAfterRelockApplies": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "warmInstallReplacesUpstream": false
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "code": "redirect_poetry_stale_install_risk",
-       "detail": "poetry.lock was written by Poetry < 1.4, which does not replace an already-installed package at the same version: an existing virtualenv keeps the upstream urllib3 until it is recreated (or the package is `pip uninstall`ed) before `poetry install`; fresh installs pick up the patched wheel."
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": null
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": false,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n\nWriting lock file\n"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "exit": 0,
-     "lockChanged": true
-    },
-    "rescanAfterRelockApplies": {
-     "applied": 1,
-     "exit": 0
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNo dependencies to install or update\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNo dependencies to install or update\n"
-    },
-    "warnings": [
-     {
-      "code": "redirect_poetry_stale_install_risk",
-      "detail": "poetry.lock was written by Poetry < 1.4, which does not replace an already-installed package at the same version: an existing virtualenv keeps the upstream urllib3 until it is recreated (or the package is `pip uninstall`ed) before `poetry install`; fresh installs pick up the patched wheel."
-     }
-    ]
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "1.1.15",
-   "shape": "populated"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": false
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "pypi_poetry_integrity_unverified",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "poetry.lock was written by Poetry < 1.4: that installer does not verify local wheel hashes (the committed wheel bytes are the protection \u2014 review them) and does not replace an already-installed package at the same version \u2014 upgrade to Poetry >= 1.4, or recreate the virtualenv (or `pip uninstall` the package) before `poetry install`"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.1.15-populated-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": null
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "pypi_poetry_integrity_unverified",
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "pypi_poetry_integrity_unverified",
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.1.15-populated-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": false,
-     "installExit": 0,
-     "installedPatchedAnyway": true
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": false,
-     "installExit": 0,
-     "installedPatchedAnyway": true
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNo dependencies to install or update\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nNo dependencies to install or update\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "pypi_poetry_integrity_unverified",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "poetry.lock was written by Poetry < 1.4: that installer does not verify local wheel hashes (the committed wheel bytes are the protection \u2014 review them) and does not replace an already-installed package at the same version \u2014 upgrade to Poetry >= 1.4, or recreate the virtualenv (or `pip uninstall` the package) before `poetry install`"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "1.1.15",
-   "shape": "populated"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "crlfPreserved": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanAfterRelockApplies": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "warmInstallReplacesUpstream": false
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "code": "redirect_poetry_stale_install_risk",
-       "detail": "poetry.lock was written by Poetry < 1.4, which does not replace an already-installed package at the same version: an existing virtualenv keeps the upstream urllib3 until it is recreated (or the package is `pip uninstall`ed) before `poetry install`; fresh installs pick up the patched wheel."
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "lock --check",
-     "exit": 0,
-     "tail": "poetry.lock is consistent with pyproject.toml.\n"
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": false,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n\nWriting lock file\n"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "exit": 0,
-     "lockChanged": true
-    },
-    "rescanAfterRelockApplies": {
-     "applied": 1,
-     "exit": 0
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  \u2022 Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  \u2022 Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "code": "redirect_poetry_stale_install_risk",
-      "detail": "poetry.lock was written by Poetry < 1.4, which does not replace an already-installed package at the same version: an existing virtualenv keeps the upstream urllib3 until it is recreated (or the package is `pip uninstall`ed) before `poetry install`; fresh installs pick up the patched wheel."
-     }
-    ]
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "1.2.2",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "crlfPreserved": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": false
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "pypi_poetry_integrity_unverified",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "poetry.lock was written by Poetry < 1.4: that installer does not verify local wheel hashes (the committed wheel bytes are the protection \u2014 review them) and does not replace an already-installed package at the same version \u2014 upgrade to Poetry >= 1.4, or recreate the virtualenv (or `pip uninstall` the package) before `poetry install`"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.2.2-crlf-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "lock --check",
-     "exit": 0,
-     "tail": "poetry.lock is consistent with pyproject.toml.\n"
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "pypi_poetry_integrity_unverified",
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "pypi_poetry_integrity_unverified",
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.2.2-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": false,
-     "tail": "\u2022 Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/1.2.2-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": false,
-     "tail": "\u2022 Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/1.2.2-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "pypi_poetry_integrity_unverified",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "poetry.lock was written by Poetry < 1.4: that installer does not verify local wheel hashes (the committed wheel bytes are the protection \u2014 review them) and does not replace an already-installed package at the same version \u2014 upgrade to Poetry >= 1.4, or recreate the virtualenv (or `pip uninstall` the package) before `poetry install`"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "1.2.2",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "installedBytesPatched": true,
-    "lockUnchanged": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "rollbackRestoresUpstreamBytes": true,
-    "survivesRepeatInstall": true,
-    "survivesSync": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 1,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "rollbackRestoresUpstreamBytes": {
-     "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-    },
-    "scanExit": 0,
-    "survivesRepeatInstall": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    },
-    "survivesSync": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "warnings": []
-   },
-   "mode": "agent",
-   "passed": true,
-   "poetry": "1.2.2",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "bareScanSeesPoetryVenv": true,
-    "patchedViaPoetryRun": true,
-    "poetryRunScanApplied": true,
-    "rollbackClearsManifest": true,
-    "rollbackRestoresUpstream": true,
-    "survivesRepeatInstall": true,
-    "survivesSync": true
-   },
-   "expected": "bareScanSeesPoetryVenv is informational (known crawler gap); the rest must pass",
-   "info": {
-    "applyPath": "bare",
-    "bareScan": {
-     "exit": 0,
-     "packageDirs": [],
-     "packagesWithPatches": 1,
-     "paths": [],
-     "scannedPackages": 4,
-     "urllib3Found": true
-    },
-    "bareScanSeesPoetryVenv": {
-     "found": 1,
-     "scannedPackages": 4
-    },
-    "ootVenv": "<scratch>/matrix-final2/captures/1.2.2-direct-agent-oot/venvs/poetry-patch-fixture--o8xsesc-py3.12",
-    "patchedViaPoetryRun": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "poetryRunScanApplied": {
-     "applied": 1,
-     "exit": 0,
-     "path": "bare"
-    },
-    "rollbackRestoresUpstream": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-     }
-    },
-    "survivesRepeatInstall": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "survivesSync": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    }
-   },
-   "mode": "agent-oot",
-   "passed": true,
-   "poetry": "1.2.2",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanAfterRelockApplies": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "warmInstallReplacesUpstream": false
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "code": "redirect_poetry_stale_install_risk",
-       "detail": "poetry.lock was written by Poetry < 1.4, which does not replace an already-installed package at the same version: an existing virtualenv keeps the upstream urllib3 until it is recreated (or the package is `pip uninstall`ed) before `poetry install`; fresh installs pick up the patched wheel."
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "lock --check",
-     "exit": 0,
-     "tail": "poetry.lock is consistent with pyproject.toml.\n"
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": false,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n\nWriting lock file\n"
-    },
-    "rescanAfterRelock": {
-     "applied": 1,
-     "exit": 0,
-     "lockChanged": true
-    },
-    "rescanAfterRelockApplies": {
-     "applied": 1,
-     "exit": 0
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  \u2022 Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  \u2022 Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "code": "redirect_poetry_stale_install_risk",
-      "detail": "poetry.lock was written by Poetry < 1.4, which does not replace an already-installed package at the same version: an existing virtualenv keeps the upstream urllib3 until it is recreated (or the package is `pip uninstall`ed) before `poetry install`; fresh installs pick up the patched wheel."
-     }
-    ]
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "1.2.2",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": false
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "pypi_poetry_integrity_unverified",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "poetry.lock was written by Poetry < 1.4: that installer does not verify local wheel hashes (the committed wheel bytes are the protection \u2014 review them) and does not replace an already-installed package at the same version \u2014 upgrade to Poetry >= 1.4, or recreate the virtualenv (or `pip uninstall` the package) before `poetry install`"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.2.2-direct-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "lock --check",
-     "exit": 0,
-     "tail": "poetry.lock is consistent with pyproject.toml.\n"
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "pypi_poetry_integrity_unverified",
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "pypi_poetry_integrity_unverified",
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.2.2-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": false,
-     "installExit": 0,
-     "installedPatchedAnyway": true
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": false,
-     "installExit": 0,
-     "installedPatchedAnyway": true
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/1.2.2-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/1.2.2-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "pypi_poetry_integrity_unverified",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "poetry.lock was written by Poetry < 1.4: that installer does not verify local wheel hashes (the committed wheel bytes are the protection \u2014 review them) and does not replace an already-installed package at the same version \u2014 upgrade to Poetry >= 1.4, or recreate the virtualenv (or `pip uninstall` the package) before `poetry install`"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "1.2.2",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "crlfPreserved": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "warmInstallReplacesUpstream": false
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "code": "redirect_poetry_stale_install_risk",
-       "detail": "poetry.lock was written by Poetry < 1.4, which does not replace an already-installed package at the same version: an existing virtualenv keeps the upstream urllib3 until it is recreated (or the package is `pip uninstall`ed) before `poetry install`; fresh installs pick up the patched wheel."
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "lock --check",
-     "exit": 0,
-     "tail": "poetry.lock is consistent with pyproject.toml.\n"
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  \u2022 Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  \u2022 Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "code": "redirect_poetry_stale_install_risk",
-      "detail": "poetry.lock was written by Poetry < 1.4, which does not replace an already-installed package at the same version: an existing virtualenv keeps the upstream urllib3 until it is recreated (or the package is `pip uninstall`ed) before `poetry install`; fresh installs pick up the patched wheel."
-     }
-    ]
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "1.3.2",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "crlfPreserved": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": false
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "pypi_poetry_integrity_unverified",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "poetry.lock was written by Poetry < 1.4: that installer does not verify local wheel hashes (the committed wheel bytes are the protection \u2014 review them) and does not replace an already-installed package at the same version \u2014 upgrade to Poetry >= 1.4, or recreate the virtualenv (or `pip uninstall` the package) before `poetry install`"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.3.2-crlf-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "lock --check",
-     "exit": 0,
-     "tail": "poetry.lock is consistent with pyproject.toml.\n"
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "pypi_poetry_integrity_unverified",
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "pypi_poetry_integrity_unverified",
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.3.2-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": false,
-     "tail": "\u2022 Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/1.3.2-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": false,
-     "tail": "\u2022 Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/1.3.2-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "pypi_poetry_integrity_unverified",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "poetry.lock was written by Poetry < 1.4: that installer does not verify local wheel hashes (the committed wheel bytes are the protection \u2014 review them) and does not replace an already-installed package at the same version \u2014 upgrade to Poetry >= 1.4, or recreate the virtualenv (or `pip uninstall` the package) before `poetry install`"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "1.3.2",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "installedBytesPatched": true,
-    "lockUnchanged": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "rollbackRestoresUpstreamBytes": true,
-    "survivesRepeatInstall": true,
-    "survivesSync": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 1,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "rollbackRestoresUpstreamBytes": {
-     "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-    },
-    "scanExit": 0,
-    "survivesRepeatInstall": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    },
-    "survivesSync": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "warnings": []
-   },
-   "mode": "agent",
-   "passed": true,
-   "poetry": "1.3.2",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "bareScanSeesPoetryVenv": true,
-    "patchedViaPoetryRun": true,
-    "poetryRunScanApplied": true,
-    "rollbackClearsManifest": true,
-    "rollbackRestoresUpstream": true,
-    "survivesRepeatInstall": true,
-    "survivesSync": true
-   },
-   "expected": "bareScanSeesPoetryVenv is informational (known crawler gap); the rest must pass",
-   "info": {
-    "applyPath": "bare",
-    "bareScan": {
-     "exit": 0,
-     "packageDirs": [],
-     "packagesWithPatches": 1,
-     "paths": [],
-     "scannedPackages": 4,
-     "urllib3Found": true
-    },
-    "bareScanSeesPoetryVenv": {
-     "found": 1,
-     "scannedPackages": 4
-    },
-    "ootVenv": "<scratch>/matrix-final2/captures/1.3.2-direct-agent-oot/venvs/poetry-patch-fixture-nqgm3NcM-py3.12",
-    "patchedViaPoetryRun": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "poetryRunScanApplied": {
-     "applied": 1,
-     "exit": 0,
-     "path": "bare"
-    },
-    "rollbackRestoresUpstream": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-     }
-    },
-    "survivesRepeatInstall": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "survivesSync": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    }
-   },
-   "mode": "agent-oot",
-   "passed": true,
-   "poetry": "1.3.2",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "warmInstallReplacesUpstream": false
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "code": "redirect_poetry_stale_install_risk",
-       "detail": "poetry.lock was written by Poetry < 1.4, which does not replace an already-installed package at the same version: an existing virtualenv keeps the upstream urllib3 until it is recreated (or the package is `pip uninstall`ed) before `poetry install`; fresh installs pick up the patched wheel."
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "lock --check",
-     "exit": 0,
-     "tail": "poetry.lock is consistent with pyproject.toml.\n"
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  \u2022 Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  \u2022 Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "code": "redirect_poetry_stale_install_risk",
-      "detail": "poetry.lock was written by Poetry < 1.4, which does not replace an already-installed package at the same version: an existing virtualenv keeps the upstream urllib3 until it is recreated (or the package is `pip uninstall`ed) before `poetry install`; fresh installs pick up the patched wheel."
-     }
-    ]
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "1.3.2",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": false
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "pypi_poetry_integrity_unverified",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "poetry.lock was written by Poetry < 1.4: that installer does not verify local wheel hashes (the committed wheel bytes are the protection \u2014 review them) and does not replace an already-installed package at the same version \u2014 upgrade to Poetry >= 1.4, or recreate the virtualenv (or `pip uninstall` the package) before `poetry install`"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.3.2-direct-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "lock --check",
-     "exit": 0,
-     "tail": "poetry.lock is consistent with pyproject.toml.\n"
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "pypi_poetry_integrity_unverified",
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "pypi_poetry_integrity_unverified",
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.3.2-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": false,
-     "installExit": 0,
-     "installedPatchedAnyway": true
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": false,
-     "installExit": 0,
-     "installedPatchedAnyway": true
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/1.3.2-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": false,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/1.3.2-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "pypi_poetry_integrity_unverified",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "poetry.lock was written by Poetry < 1.4: that installer does not verify local wheel hashes (the committed wheel bytes are the protection \u2014 review them) and does not replace an already-installed package at the same version \u2014 upgrade to Poetry >= 1.4, or recreate the virtualenv (or `pip uninstall` the package) before `poetry install`"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "1.3.2",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "crlfPreserved": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "lock --check",
-     "exit": 0,
-     "tail": "poetry.lock is consistent with pyproject.toml.\n"
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  \u2022 Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  \u2022 Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": []
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "1.4.2",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "crlfPreserved": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.4.2-crlf-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "lock --check",
-     "exit": 0,
-     "tail": "poetry.lock is consistent with pyproject.toml.\n"
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.4.2-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "\u2022 Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/1.4.2-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "\u2022 Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/1.4.2-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "1.4.2",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "installedBytesPatched": true,
-    "lockUnchanged": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "rollbackRestoresUpstreamBytes": true,
-    "survivesRepeatInstall": true,
-    "survivesSync": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 1,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "rollbackRestoresUpstreamBytes": {
-     "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-    },
-    "scanExit": 0,
-    "survivesRepeatInstall": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    },
-    "survivesSync": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "warnings": []
-   },
-   "mode": "agent",
-   "passed": true,
-   "poetry": "1.4.2",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "bareScanSeesPoetryVenv": true,
-    "patchedViaPoetryRun": true,
-    "poetryRunScanApplied": true,
-    "rollbackClearsManifest": true,
-    "rollbackRestoresUpstream": true,
-    "survivesRepeatInstall": true,
-    "survivesSync": true
-   },
-   "expected": "bareScanSeesPoetryVenv is informational (known crawler gap); the rest must pass",
-   "info": {
-    "applyPath": "bare",
-    "bareScan": {
-     "exit": 0,
-     "packageDirs": [],
-     "packagesWithPatches": 1,
-     "paths": [],
-     "scannedPackages": 4,
-     "urllib3Found": true
-    },
-    "bareScanSeesPoetryVenv": {
-     "found": 1,
-     "scannedPackages": 4
-    },
-    "ootVenv": "<scratch>/matrix-final2/captures/1.4.2-direct-agent-oot/venvs/poetry-patch-fixture-7SNtuRHk-py3.12",
-    "patchedViaPoetryRun": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "poetryRunScanApplied": {
-     "applied": 1,
-     "exit": 0,
-     "path": "bare"
-    },
-    "rollbackRestoresUpstream": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-     }
-    },
-    "survivesRepeatInstall": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "survivesSync": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    }
-   },
-   "mode": "agent-oot",
-   "passed": true,
-   "poetry": "1.4.2",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "lock --check",
-     "exit": 0,
-     "tail": "poetry.lock is consistent with pyproject.toml.\n"
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  \u2022 Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  \u2022 Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": []
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "1.4.2",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.4.2-direct-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "lock --check",
-     "exit": 0,
-     "tail": "poetry.lock is consistent with pyproject.toml.\n"
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.4.2-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/1.4.2-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/1.4.2-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "1.4.2",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "crlfPreserved": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "lock --check",
-     "exit": 0,
-     "tail": "poetry.lock is consistent with pyproject.toml.\n"
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  \u2022 Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  \u2022 Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": []
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "1.5.1",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "crlfPreserved": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.5.1-crlf-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "lock --check",
-     "exit": 0,
-     "tail": "poetry.lock is consistent with pyproject.toml.\n"
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.5.1-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "\u2022 Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/1.5.1-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "\u2022 Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/1.5.1-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "1.5.1",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "installedBytesPatched": true,
-    "lockUnchanged": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "rollbackRestoresUpstreamBytes": true,
-    "survivesRepeatInstall": true,
-    "survivesSync": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 1,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "rollbackRestoresUpstreamBytes": {
-     "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-    },
-    "scanExit": 0,
-    "survivesRepeatInstall": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    },
-    "survivesSync": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "warnings": []
-   },
-   "mode": "agent",
-   "passed": true,
-   "poetry": "1.5.1",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "bareScanSeesPoetryVenv": true,
-    "patchedViaPoetryRun": true,
-    "poetryRunScanApplied": true,
-    "rollbackClearsManifest": true,
-    "rollbackRestoresUpstream": true,
-    "survivesRepeatInstall": true,
-    "survivesSync": true
-   },
-   "expected": "bareScanSeesPoetryVenv is informational (known crawler gap); the rest must pass",
-   "info": {
-    "applyPath": "bare",
-    "bareScan": {
-     "exit": 0,
-     "packageDirs": [],
-     "packagesWithPatches": 1,
-     "paths": [],
-     "scannedPackages": 2,
-     "urllib3Found": true
-    },
-    "bareScanSeesPoetryVenv": {
-     "found": 1,
-     "scannedPackages": 2
-    },
-    "ootVenv": "<scratch>/matrix-final2/captures/1.5.1-direct-agent-oot/venvs/poetry-patch-fixture-_zoUJMnU-py3.12",
-    "patchedViaPoetryRun": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "poetryRunScanApplied": {
-     "applied": 1,
-     "exit": 0,
-     "path": "bare"
-    },
-    "rollbackRestoresUpstream": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-     }
-    },
-    "survivesRepeatInstall": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "survivesSync": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    }
-   },
-   "mode": "agent-oot",
-   "passed": true,
-   "poetry": "1.5.1",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "lock --check",
-     "exit": 0,
-     "tail": "poetry.lock is consistent with pyproject.toml.\n"
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  \u2022 Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  \u2022 Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": []
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "1.5.1",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.5.1-direct-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "lock --check",
-     "exit": 0,
-     "tail": "poetry.lock is consistent with pyproject.toml.\n"
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.5.1-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/1.5.1-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/1.5.1-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "1.5.1",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "crlfPreserved": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "All set!\n"
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  \u2022 Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  \u2022 Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": []
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "1.6.1",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "crlfPreserved": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.6.1-crlf-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "All set!\n"
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.6.1-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "\u2022 Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/1.6.1-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "\u2022 Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/1.6.1-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "1.6.1",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "installedBytesPatched": true,
-    "lockUnchanged": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "rollbackRestoresUpstreamBytes": true,
-    "survivesRepeatInstall": true,
-    "survivesSync": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 1,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "rollbackRestoresUpstreamBytes": {
-     "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-    },
-    "scanExit": 0,
-    "survivesRepeatInstall": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    },
-    "survivesSync": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "warnings": []
-   },
-   "mode": "agent",
-   "passed": true,
-   "poetry": "1.6.1",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "bareScanSeesPoetryVenv": true,
-    "patchedViaPoetryRun": true,
-    "poetryRunScanApplied": true,
-    "rollbackClearsManifest": true,
-    "rollbackRestoresUpstream": true,
-    "survivesRepeatInstall": true,
-    "survivesSync": true
-   },
-   "expected": "bareScanSeesPoetryVenv is informational (known crawler gap); the rest must pass",
-   "info": {
-    "applyPath": "bare",
-    "bareScan": {
-     "exit": 0,
-     "packageDirs": [],
-     "packagesWithPatches": 1,
-     "paths": [],
-     "scannedPackages": 2,
-     "urllib3Found": true
-    },
-    "bareScanSeesPoetryVenv": {
-     "found": 1,
-     "scannedPackages": 2
-    },
-    "ootVenv": "<scratch>/matrix-final2/captures/1.6.1-direct-agent-oot/venvs/poetry-patch-fixture-3oGutE4e-py3.12",
-    "patchedViaPoetryRun": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "poetryRunScanApplied": {
-     "applied": 1,
-     "exit": 0,
-     "path": "bare"
-    },
-    "rollbackRestoresUpstream": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-     }
-    },
-    "survivesRepeatInstall": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "survivesSync": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    }
-   },
-   "mode": "agent-oot",
-   "passed": true,
-   "poetry": "1.6.1",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "All set!\n"
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  \u2022 Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  \u2022 Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": []
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "1.6.1",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.6.1-direct-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "All set!\n"
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.6.1-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/1.6.1-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/1.6.1-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "1.6.1",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "crlfPreserved": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "All set!\n"
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  \u2022 Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  \u2022 Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": []
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "1.7.1",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "crlfPreserved": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.7.1-crlf-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "All set!\n"
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.7.1-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "\u2022 Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/1.7.1-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "\u2022 Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/1.7.1-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "1.7.1",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "installedBytesPatched": true,
-    "lockUnchanged": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "rollbackRestoresUpstreamBytes": true,
-    "survivesRepeatInstall": true,
-    "survivesSync": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 1,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "rollbackRestoresUpstreamBytes": {
-     "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-    },
-    "scanExit": 0,
-    "survivesRepeatInstall": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    },
-    "survivesSync": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "warnings": []
-   },
-   "mode": "agent",
-   "passed": true,
-   "poetry": "1.7.1",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "bareScanSeesPoetryVenv": true,
-    "patchedViaPoetryRun": true,
-    "poetryRunScanApplied": true,
-    "rollbackClearsManifest": true,
-    "rollbackRestoresUpstream": true,
-    "survivesRepeatInstall": true,
-    "survivesSync": true
-   },
-   "expected": "bareScanSeesPoetryVenv is informational (known crawler gap); the rest must pass",
-   "info": {
-    "applyPath": "bare",
-    "bareScan": {
-     "exit": 0,
-     "packageDirs": [],
-     "packagesWithPatches": 1,
-     "paths": [],
-     "scannedPackages": 2,
-     "urllib3Found": true
-    },
-    "bareScanSeesPoetryVenv": {
-     "found": 1,
-     "scannedPackages": 2
-    },
-    "ootVenv": "<scratch>/matrix-final2/captures/1.7.1-direct-agent-oot/venvs/poetry-patch-fixture-h-NPhXP2-py3.12",
-    "patchedViaPoetryRun": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "poetryRunScanApplied": {
-     "applied": 1,
-     "exit": 0,
-     "path": "bare"
-    },
-    "rollbackRestoresUpstream": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-     }
-    },
-    "survivesRepeatInstall": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "survivesSync": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    }
-   },
-   "mode": "agent-oot",
-   "passed": true,
-   "poetry": "1.7.1",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "All set!\n"
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  \u2022 Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  \u2022 Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": []
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "1.7.1",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.7.1-direct-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "All set!\n"
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  \u2022 Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.7.1-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/1.7.1-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/1.7.1-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "1.7.1",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "crlfPreserved": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "All set!\n"
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": []
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "1.8.5",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "crlfPreserved": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.8.5-crlf-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "All set!\n"
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.8.5-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "- Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/1.8.5-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "- Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/1.8.5-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "1.8.5",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "installedBytesPatched": true,
-    "lockUnchanged": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "rollbackRestoresUpstreamBytes": true,
-    "survivesRepeatInstall": true,
-    "survivesSync": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 1,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "rollbackRestoresUpstreamBytes": {
-     "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-    },
-    "scanExit": 0,
-    "survivesRepeatInstall": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    },
-    "survivesSync": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "warnings": []
-   },
-   "mode": "agent",
-   "passed": true,
-   "poetry": "1.8.5",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "bareScanSeesPoetryVenv": true,
-    "patchedViaPoetryRun": true,
-    "poetryRunScanApplied": true,
-    "rollbackClearsManifest": true,
-    "rollbackRestoresUpstream": true,
-    "survivesRepeatInstall": true,
-    "survivesSync": true
-   },
-   "expected": "bareScanSeesPoetryVenv is informational (known crawler gap); the rest must pass",
-   "info": {
-    "applyPath": "bare",
-    "bareScan": {
-     "exit": 0,
-     "packageDirs": [],
-     "packagesWithPatches": 1,
-     "paths": [],
-     "scannedPackages": 2,
-     "urllib3Found": true
-    },
-    "bareScanSeesPoetryVenv": {
-     "found": 1,
-     "scannedPackages": 2
-    },
-    "ootVenv": "<scratch>/matrix-final2/captures/1.8.5-direct-agent-oot/venvs/poetry-patch-fixture-A0_pGI6P-py3.12",
-    "patchedViaPoetryRun": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "poetryRunScanApplied": {
-     "applied": 1,
-     "exit": 0,
-     "path": "bare"
-    },
-    "rollbackRestoresUpstream": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-     }
-    },
-    "survivesRepeatInstall": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "survivesSync": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    }
-   },
-   "mode": "agent-oot",
-   "passed": true,
-   "poetry": "1.8.5",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "All set!\n"
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": []
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "1.8.5",
-   "shape": "direct"
-  },
-  {
-   "checks": {},
-   "expected": "informational: setup edits pyproject; poetry must resolve socket-patch[hook]",
-   "info": {
-    "lockChanged": true,
-    "poetryLockAfterSetup": {
-     "exit": 0,
-     "tail": "Resolving dependencies...\nCreating virtualenv poetry-patch-fixture in <scratch>/matrix-final2/captures/1.8.5-direct-setup/project/.venv\n"
-    },
-    "pyprojectChanged": true,
-    "pyprojectDiff": "[tool.poetry]\nname = \"poetry-patch-fixture\"\nversion = \"0.1.0\"\ndescription = \"\"\nauthors = [\"Socket <engineering@socket.dev>\"]\n\n[tool.poetry.dependencies]\npython = \">=3.8\"\nurllib3 = \"1.26.18\"\nsocket-patch = { version = \"*\", extras = [\"hook\"] }\n",
-    "setupCheckExit": 0,
-    "setupEnvelope": {
-     "alreadyConfigured": 0,
-     "errors": 0,
-     "files": [
-      {
-       "error": null,
-       "kind": "pth",
-       "path": "<scratch>/matrix-final2/captures/1.8.5-direct-setup/project/pyproject.toml",
-       "status": "updated"
-      }
-     ],
-     "packageManager": "npm",
-     "pythonPackageManager": "poetry",
-     "status": "success",
-     "updated": 1
-    },
-    "setupExit": 0
-   },
-   "mode": "setup",
-   "passed": true,
-   "poetry": "1.8.5",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.8.5-direct-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "All set!\n"
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/1.8.5-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock --no-update -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/1.8.5-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/1.8.5-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "1.8.5",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "crlfPreserved": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "dynamic].\nIf you want to set the version dynamically via `poetry build --local-version` or you are using a plugin, which sets the version dynamically, you should define the version in [tool.poetry] and add 'version' to [project.dynamic].\nWarning: [tool.poetry.description] is deprecated. Use [project.description] instead.\nWarning: [tool.poetry.authors] is deprecated. Use [project.authors] instead.\n"
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": []
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "2.0.1",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "crlfPreserved": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.0.1-crlf-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "dynamic].\nIf you want to set the version dynamically via `poetry build --local-version` or you are using a plugin, which sets the version dynamically, you should define the version in [tool.poetry] and add 'version' to [project.dynamic].\nWarning: [tool.poetry.description] is deprecated. Use [project.description] instead.\nWarning: [tool.poetry.authors] is deprecated. Use [project.authors] instead.\n"
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.0.1-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "- Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.0.1-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "- Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.0.1-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "2.0.1",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "installedBytesPatched": true,
-    "lockUnchanged": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "rollbackRestoresUpstreamBytes": true,
-    "survivesRepeatInstall": true,
-    "survivesSync": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 1,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "rollbackRestoresUpstreamBytes": {
-     "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-    },
-    "scanExit": 0,
-    "survivesRepeatInstall": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    },
-    "survivesSync": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "warnings": []
-   },
-   "mode": "agent",
-   "passed": true,
-   "poetry": "2.0.1",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "bareScanSeesPoetryVenv": true,
-    "patchedViaPoetryRun": true,
-    "poetryRunScanApplied": true,
-    "rollbackClearsManifest": true,
-    "rollbackRestoresUpstream": true,
-    "survivesRepeatInstall": true,
-    "survivesSync": true
-   },
-   "expected": "bareScanSeesPoetryVenv is informational (known crawler gap); the rest must pass",
-   "info": {
-    "applyPath": "bare",
-    "bareScan": {
-     "exit": 0,
-     "packageDirs": [],
-     "packagesWithPatches": 1,
-     "paths": [],
-     "scannedPackages": 2,
-     "urllib3Found": true
-    },
-    "bareScanSeesPoetryVenv": {
-     "found": 1,
-     "scannedPackages": 2
-    },
-    "ootVenv": "<scratch>/matrix-final2/captures/2.0.1-direct-agent-oot/venvs/poetry-patch-fixture-0k24feQr-py3.12",
-    "patchedViaPoetryRun": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "poetryRunScanApplied": {
-     "applied": 1,
-     "exit": 0,
-     "path": "bare"
-    },
-    "rollbackRestoresUpstream": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-     }
-    },
-    "survivesRepeatInstall": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "survivesSync": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    }
-   },
-   "mode": "agent-oot",
-   "passed": true,
-   "poetry": "2.0.1",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "dynamic].\nIf you want to set the version dynamically via `poetry build --local-version` or you are using a plugin, which sets the version dynamically, you should define the version in [tool.poetry] and add 'version' to [project.dynamic].\nWarning: [tool.poetry.description] is deprecated. Use [project.description] instead.\nWarning: [tool.poetry.authors] is deprecated. Use [project.authors] instead.\n"
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": []
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "2.0.1",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.0.1-direct-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "dynamic].\nIf you want to set the version dynamically via `poetry build --local-version` or you are using a plugin, which sets the version dynamically, you should define the version in [tool.poetry] and add 'version' to [project.dynamic].\nWarning: [tool.poetry.description] is deprecated. Use [project.description] instead.\nWarning: [tool.poetry.authors] is deprecated. Use [project.authors] instead.\n"
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.0.1-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.0.1-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.0.1-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "2.0.1",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "All set!\n"
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": []
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "2.0.1",
-   "shape": "pep621"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.0.1-pep621-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "All set!\n"
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.0.1-pep621-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.0.1-pep621-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.0.1-pep621-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "2.0.1",
-   "shape": "pep621"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "crlfPreserved": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "dynamic].\nIf you want to set the version dynamically via `poetry build --local-version` or you are using a plugin, which sets the version dynamically, you should define the version in [tool.poetry] and add 'version' to [project.dynamic].\nWarning: [tool.poetry.description] is deprecated. Use [project.description] instead.\nWarning: [tool.poetry.authors] is deprecated. Use [project.authors] instead.\n"
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": []
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "2.1.4",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "crlfPreserved": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.1.4-crlf-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "dynamic].\nIf you want to set the version dynamically via `poetry build --local-version` or you are using a plugin, which sets the version dynamically, you should define the version in [tool.poetry] and add 'version' to [project.dynamic].\nWarning: [tool.poetry.description] is deprecated. Use [project.description] instead.\nWarning: [tool.poetry.authors] is deprecated. Use [project.authors] instead.\n"
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.1.4-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "- Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.1.4-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "- Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.1.4-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "2.1.4",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "installedBytesPatched": true,
-    "lockUnchanged": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "rollbackRestoresUpstreamBytes": true,
-    "survivesRepeatInstall": true,
-    "survivesSync": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 1,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "rollbackRestoresUpstreamBytes": {
-     "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-    },
-    "scanExit": 0,
-    "survivesRepeatInstall": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    },
-    "survivesSync": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "warnings": []
-   },
-   "mode": "agent",
-   "passed": true,
-   "poetry": "2.1.4",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "bareScanSeesPoetryVenv": true,
-    "patchedViaPoetryRun": true,
-    "poetryRunScanApplied": true,
-    "rollbackClearsManifest": true,
-    "rollbackRestoresUpstream": true,
-    "survivesRepeatInstall": true,
-    "survivesSync": true
-   },
-   "expected": "bareScanSeesPoetryVenv is informational (known crawler gap); the rest must pass",
-   "info": {
-    "applyPath": "bare",
-    "bareScan": {
-     "exit": 0,
-     "packageDirs": [],
-     "packagesWithPatches": 1,
-     "paths": [],
-     "scannedPackages": 2,
-     "urllib3Found": true
-    },
-    "bareScanSeesPoetryVenv": {
-     "found": 1,
-     "scannedPackages": 2
-    },
-    "ootVenv": "<scratch>/matrix-final2/captures/2.1.4-direct-agent-oot/venvs/poetry-patch-fixture-V-8iOFCt-py3.12",
-    "patchedViaPoetryRun": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "poetryRunScanApplied": {
-     "applied": 1,
-     "exit": 0,
-     "path": "bare"
-    },
-    "rollbackRestoresUpstream": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-     }
-    },
-    "survivesRepeatInstall": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "survivesSync": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    }
-   },
-   "mode": "agent-oot",
-   "passed": true,
-   "poetry": "2.1.4",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "dynamic].\nIf you want to set the version dynamically via `poetry build --local-version` or you are using a plugin, which sets the version dynamically, you should define the version in [tool.poetry] and add 'version' to [project.dynamic].\nWarning: [tool.poetry.description] is deprecated. Use [project.description] instead.\nWarning: [tool.poetry.authors] is deprecated. Use [project.authors] instead.\n"
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": []
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "2.1.4",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.1.4-direct-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "dynamic].\nIf you want to set the version dynamically via `poetry build --local-version` or you are using a plugin, which sets the version dynamically, you should define the version in [tool.poetry] and add 'version' to [project.dynamic].\nWarning: [tool.poetry.description] is deprecated. Use [project.description] instead.\nWarning: [tool.poetry.authors] is deprecated. Use [project.authors] instead.\n"
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.1.4-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.1.4-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.1.4-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "2.1.4",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "All set!\n"
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": []
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "2.1.4",
-   "shape": "pep621"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.1.4-pep621-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "All set!\n"
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.1.4-pep621-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.1.4-pep621-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.1.4-pep621-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "2.1.4",
-   "shape": "pep621"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "crlfPreserved": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "dynamic].\nIf you want to set the version dynamically via `poetry build --local-version` or you are using a plugin, which sets the version dynamically, you should define the version in [tool.poetry] and add 'version' to [project.dynamic].\nWarning: [tool.poetry.description] is deprecated. Use [project.description] instead.\nWarning: [tool.poetry.authors] is deprecated. Use [project.authors] instead.\n"
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": []
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "2.2.1",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "crlfPreserved": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.2.1-crlf-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "dynamic].\nIf you want to set the version dynamically via `poetry build --local-version` or you are using a plugin, which sets the version dynamically, you should define the version in [tool.poetry] and add 'version' to [project.dynamic].\nWarning: [tool.poetry.description] is deprecated. Use [project.description] instead.\nWarning: [tool.poetry.authors] is deprecated. Use [project.authors] instead.\n"
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.2.1-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "- Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.2.1-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "- Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.2.1-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "2.2.1",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "installedBytesPatched": true,
-    "lockUnchanged": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "rollbackRestoresUpstreamBytes": true,
-    "survivesRepeatInstall": true,
-    "survivesSync": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 1,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "rollbackRestoresUpstreamBytes": {
-     "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-    },
-    "scanExit": 0,
-    "survivesRepeatInstall": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    },
-    "survivesSync": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "warnings": []
-   },
-   "mode": "agent",
-   "passed": true,
-   "poetry": "2.2.1",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "bareScanSeesPoetryVenv": true,
-    "patchedViaPoetryRun": true,
-    "poetryRunScanApplied": true,
-    "rollbackClearsManifest": true,
-    "rollbackRestoresUpstream": true,
-    "survivesRepeatInstall": true,
-    "survivesSync": true
-   },
-   "expected": "bareScanSeesPoetryVenv is informational (known crawler gap); the rest must pass",
-   "info": {
-    "applyPath": "bare",
-    "bareScan": {
-     "exit": 0,
-     "packageDirs": [],
-     "packagesWithPatches": 1,
-     "paths": [],
-     "scannedPackages": 2,
-     "urllib3Found": true
-    },
-    "bareScanSeesPoetryVenv": {
-     "found": 1,
-     "scannedPackages": 2
-    },
-    "ootVenv": "<scratch>/matrix-final2/captures/2.2.1-direct-agent-oot/venvs/poetry-patch-fixture-GNeKz0YO-py3.12",
-    "patchedViaPoetryRun": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "poetryRunScanApplied": {
-     "applied": 1,
-     "exit": 0,
-     "path": "bare"
-    },
-    "rollbackRestoresUpstream": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-     }
-    },
-    "survivesRepeatInstall": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "survivesSync": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    }
-   },
-   "mode": "agent-oot",
-   "passed": true,
-   "poetry": "2.2.1",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "dynamic].\nIf you want to set the version dynamically via `poetry build --local-version` or you are using a plugin, which sets the version dynamically, you should define the version in [tool.poetry] and add 'version' to [project.dynamic].\nWarning: [tool.poetry.description] is deprecated. Use [project.description] instead.\nWarning: [tool.poetry.authors] is deprecated. Use [project.authors] instead.\n"
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": []
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "2.2.1",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.2.1-direct-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "dynamic].\nIf you want to set the version dynamically via `poetry build --local-version` or you are using a plugin, which sets the version dynamically, you should define the version in [tool.poetry] and add 'version' to [project.dynamic].\nWarning: [tool.poetry.description] is deprecated. Use [project.description] instead.\nWarning: [tool.poetry.authors] is deprecated. Use [project.authors] instead.\n"
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.2.1-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.2.1-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.2.1-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "2.2.1",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "All set!\n"
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": []
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "2.2.1",
-   "shape": "pep621"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.2.1-pep621-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "All set!\n"
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.2.1-pep621-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.2.1-pep621-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.2.1-pep621-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "2.2.1",
-   "shape": "pep621"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "crlfPreserved": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "dynamic].\nIf you want to set the version dynamically via `poetry build --local-version` or you are using a plugin, which sets the version dynamically, you should define the version in [tool.poetry] and add 'version' to [project.dynamic].\nWarning: [tool.poetry.description] is deprecated. Use [project.description] instead.\nWarning: [tool.poetry.authors] is deprecated. Use [project.authors] instead.\n"
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": []
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "2.3.4",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "crlfPreserved": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.3.4-crlf-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "dynamic].\nIf you want to set the version dynamically via `poetry build --local-version` or you are using a plugin, which sets the version dynamically, you should define the version in [tool.poetry] and add 'version' to [project.dynamic].\nWarning: [tool.poetry.description] is deprecated. Use [project.description] instead.\nWarning: [tool.poetry.authors] is deprecated. Use [project.authors] instead.\n"
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.3.4-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "- Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.3.4-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "- Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.3.4-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "2.3.4",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "installedBytesPatched": true,
-    "lockUnchanged": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "rollbackRestoresUpstreamBytes": true,
-    "survivesRepeatInstall": true,
-    "survivesSync": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 1,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "rollbackRestoresUpstreamBytes": {
-     "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-    },
-    "scanExit": 0,
-    "survivesRepeatInstall": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    },
-    "survivesSync": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "warnings": []
-   },
-   "mode": "agent",
-   "passed": true,
-   "poetry": "2.3.4",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "bareScanSeesPoetryVenv": true,
-    "patchedViaPoetryRun": true,
-    "poetryRunScanApplied": true,
-    "rollbackClearsManifest": true,
-    "rollbackRestoresUpstream": true,
-    "survivesRepeatInstall": true,
-    "survivesSync": true
-   },
-   "expected": "bareScanSeesPoetryVenv is informational (known crawler gap); the rest must pass",
-   "info": {
-    "applyPath": "bare",
-    "bareScan": {
-     "exit": 0,
-     "packageDirs": [],
-     "packagesWithPatches": 1,
-     "paths": [],
-     "scannedPackages": 2,
-     "urllib3Found": true
-    },
-    "bareScanSeesPoetryVenv": {
-     "found": 1,
-     "scannedPackages": 2
-    },
-    "ootVenv": "<scratch>/matrix-final2/captures/2.3.4-direct-agent-oot/venvs/poetry-patch-fixture-a0nSdvf5-py3.12",
-    "patchedViaPoetryRun": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "poetryRunScanApplied": {
-     "applied": 1,
-     "exit": 0,
-     "path": "bare"
-    },
-    "rollbackRestoresUpstream": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-     }
-    },
-    "survivesRepeatInstall": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "survivesSync": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    }
-   },
-   "mode": "agent-oot",
-   "passed": true,
-   "poetry": "2.3.4",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "dynamic].\nIf you want to set the version dynamically via `poetry build --local-version` or you are using a plugin, which sets the version dynamically, you should define the version in [tool.poetry] and add 'version' to [project.dynamic].\nWarning: [tool.poetry.description] is deprecated. Use [project.description] instead.\nWarning: [tool.poetry.authors] is deprecated. Use [project.authors] instead.\n"
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": []
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "2.3.4",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.3.4-direct-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "dynamic].\nIf you want to set the version dynamically via `poetry build --local-version` or you are using a plugin, which sets the version dynamically, you should define the version in [tool.poetry] and add 'version' to [project.dynamic].\nWarning: [tool.poetry.description] is deprecated. Use [project.description] instead.\nWarning: [tool.poetry.authors] is deprecated. Use [project.authors] instead.\n"
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.3.4-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.3.4-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.3.4-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "2.3.4",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "All set!\n"
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": []
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "2.3.4",
-   "shape": "pep621"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.3.4-pep621-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "All set!\n"
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.3.4-pep621-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.3.4-pep621-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.3.4-pep621-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "2.3.4",
-   "shape": "pep621"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "crlfPreserved": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "dynamic].\nIf you want to set the version dynamically via `poetry build --local-version` or you are using a plugin, which sets the version dynamically, you should define the version in [tool.poetry] and add 'version' to [project.dynamic].\nWarning: [tool.poetry.description] is deprecated. Use [project.description] instead.\nWarning: [tool.poetry.authors] is deprecated. Use [project.authors] instead.\n"
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": []
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "2.4.3",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "crlfPreserved": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.4.3-crlf-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "dynamic].\nIf you want to set the version dynamically via `poetry build --local-version` or you are using a plugin, which sets the version dynamically, you should define the version in [tool.poetry] and add 'version' to [project.dynamic].\nWarning: [tool.poetry.description] is deprecated. Use [project.description] instead.\nWarning: [tool.poetry.authors] is deprecated. Use [project.authors] instead.\n"
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.4.3-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "- Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.4.3-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "- Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.4.3-crlf-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "2.4.3",
-   "shape": "crlf"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "installedBytesPatched": true,
-    "lockUnchanged": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "rollbackRestoresUpstreamBytes": true,
-    "survivesRepeatInstall": true,
-    "survivesSync": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 1,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "rollbackRestoresUpstreamBytes": {
-     "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-    },
-    "scanExit": 0,
-    "survivesRepeatInstall": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    },
-    "survivesSync": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "warnings": []
-   },
-   "mode": "agent",
-   "passed": true,
-   "poetry": "2.4.3",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "bareScanSeesPoetryVenv": true,
-    "patchedViaPoetryRun": true,
-    "poetryRunScanApplied": true,
-    "rollbackClearsManifest": true,
-    "rollbackRestoresUpstream": true,
-    "survivesRepeatInstall": true,
-    "survivesSync": true
-   },
-   "expected": "bareScanSeesPoetryVenv is informational (known crawler gap); the rest must pass",
-   "info": {
-    "applyPath": "bare",
-    "bareScan": {
-     "exit": 0,
-     "packageDirs": [],
-     "packagesWithPatches": 1,
-     "paths": [],
-     "scannedPackages": 2,
-     "urllib3Found": true
-    },
-    "bareScanSeesPoetryVenv": {
-     "found": 1,
-     "scannedPackages": 2
-    },
-    "ootVenv": "<scratch>/matrix-final2/captures/2.4.3-direct-agent-oot/venvs/poetry-patch-fixture-8DuawaLX-py3.12",
-    "patchedViaPoetryRun": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "poetryRunScanApplied": {
-     "applied": 1,
-     "exit": 0,
-     "path": "bare"
-    },
-    "rollbackRestoresUpstream": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "ea86196bb5cb3f20fee709d7507cd6b9b2c98017050f3a70033c27f47051ce06"
-     }
-    },
-    "survivesRepeatInstall": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "survivesSync": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     }
-    }
-   },
-   "mode": "agent-oot",
-   "passed": true,
-   "poetry": "2.4.3",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "dynamic].\nIf you want to set the version dynamically via `poetry build --local-version` or you are using a plugin, which sets the version dynamically, you should define the version in [tool.poetry] and add 'version' to [project.dynamic].\nWarning: [tool.poetry.description] is deprecated. Use [project.description] instead.\nWarning: [tool.poetry.authors] is deprecated. Use [project.authors] instead.\n"
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": []
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "2.4.3",
-   "shape": "direct"
-  },
-  {
-   "checks": {},
-   "expected": "informational: setup edits pyproject; poetry must resolve socket-patch[hook]",
-   "info": {
-    "lockChanged": true,
-    "poetryLockAfterSetup": {
-     "exit": 0,
-     "tail": "Resolving dependencies...\nCreating virtualenv poetry-patch-fixture in <scratch>/matrix-final2/captures/2.4.3-direct-setup/project/.venv\n"
-    },
-    "pyprojectChanged": true,
-    "pyprojectDiff": "[tool.poetry]\nname = \"poetry-patch-fixture\"\nversion = \"0.1.0\"\ndescription = \"\"\nauthors = [\"Socket <engineering@socket.dev>\"]\n\n[tool.poetry.dependencies]\npython = \">=3.8\"\nurllib3 = \"1.26.18\"\nsocket-patch = { version = \"*\", extras = [\"hook\"] }\n",
-    "setupCheckExit": 0,
-    "setupEnvelope": {
-     "alreadyConfigured": 0,
-     "errors": 0,
-     "files": [
-      {
-       "error": null,
-       "kind": "pth",
-       "path": "<scratch>/matrix-final2/captures/2.4.3-direct-setup/project/pyproject.toml",
-       "status": "updated"
-      }
-     ],
-     "packageManager": "npm",
-     "pythonPackageManager": "poetry",
-     "status": "success",
-     "updated": 1
-    },
-    "setupExit": 0
-   },
-   "mode": "setup",
-   "passed": true,
-   "poetry": "2.4.3",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.4.3-direct-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "dynamic].\nIf you want to set the version dynamically via `poetry build --local-version` or you are using a plugin, which sets the version dynamically, you should define the version in [tool.poetry] and add 'version' to [project.dynamic].\nWarning: [tool.poetry.description] is deprecated. Use [project.description] instead.\nWarning: [tool.poetry.authors] is deprecated. Use [project.authors] instead.\n"
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.4.3-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.4.3-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.4.3-direct-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "2.4.3",
-   "shape": "direct"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasUrlSource": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackClearsRedirectLedger": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": []
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "All set!\n"
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 1,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 1,
-      "failed": [],
-      "reverted": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": []
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": []
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 0 installs, 1 update, 0 removals\n\n  - Updating urllib3 (1.26.18 -> 1.26.18 https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": []
-   },
-   "mode": "hosted",
-   "passed": true,
-   "poetry": "2.4.3",
-   "shape": "pep621"
-  },
-  {
-   "checks": {
-    "appliedExactlyOne": true,
-    "freshCloneInstallsPatch": true,
-    "installedBytesPatched": true,
-    "lockHasFileSource": true,
-    "lockOnlyVendorApplies": true,
-    "lockRewritten": true,
-    "lockUnchangedByInstall": true,
-    "poetryInstallExit0": true,
-    "pyprojectUnchanged": true,
-    "recordHasFiles": true,
-    "rescanIdempotent": true,
-    "rollbackClearsManifest": true,
-    "rollbackExit0": true,
-    "rollbackKeepsPyproject": true,
-    "rollbackRemovesVendoredWheel": true,
-    "rollbackRestoresLockBytes": true,
-    "tamperBehaviorAsDocumented": true,
-    "vendoredWheelPresent": true,
-    "warmInstallReplacesUpstream": true
-   },
-   "info": {
-    "applied": 1,
-    "appliedExactlyOne": {
-     "applied": 1,
-     "status": "success",
-     "warnings": [
-      {
-       "action": "applied",
-       "files": [
-        {
-         "path": "urllib3/response.py",
-         "verified": true
-        }
-       ],
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      },
-      {
-       "action": "skipped",
-       "errorCode": "vendor_prebuilt_downloaded",
-       "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-       "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-      }
-     ]
-    },
-    "freshCloneInstallsPatch": {
-     "exit": 0,
-     "oracle": {
-      "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-     },
-     "tail": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.4.3-pep621-vendored/fresh/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "installedBytesPatched": {
-     "urllib3/response.py": "9027726cab26bb63b978e6af295b22ec6172b100cda66d9b91cdc30bebc03730"
-    },
-    "lockCheck": {
-     "cmd": "check --lock",
-     "exit": 0,
-     "tail": "All set!\n"
-    },
-    "lockOnlyVendor": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "lockOnlyVendorApplies": {
-     "applied": 1,
-     "codes": [
-      "vendor_fetched_missing",
-      "vendor_prebuilt_downloaded"
-     ],
-     "exit": 0
-    },
-    "poetryInstallExit0": "Installing dependencies from lock file\n\nPackage operations: 1 install, 0 updates, 0 removals\n\n  - Installing urllib3 (1.26.18 <scratch>/matrix-final2/captures/2.4.3-pep621-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n",
-    "relock": {
-     "cmd": "lock -n",
-     "exit": 0,
-     "lockBytesUnchanged": true,
-     "patchSourceKept": true,
-     "pyprojectUnchanged": true,
-     "tail": "Resolving dependencies...\n"
-    },
-    "rescanIdempotent": {
-     "applied": 0,
-     "exit": 0,
-     "status": "success"
-    },
-    "rollbackEnvelope": {
-     "failed": 0,
-     "hosted": {
-      "editedFiles": 0,
-      "failed": [],
-      "reverted": [],
-      "unsupported": []
-     },
-     "manifest": {
-      "preserved": false,
-      "removedEntries": [
-       "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-      ]
-     },
-     "rolledBack": 0,
-     "status": "success",
-     "vendoredReverted": [
-      "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     ]
-    },
-    "scanExit": 0,
-    "tamper": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "tamperBehaviorAsDocumented": {
-     "expectsReject": true,
-     "installExit": 1,
-     "installedPatchedAnyway": false
-    },
-    "uuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-    "vex": {
-     "exit": 0,
-     "statements": 1
-    },
-    "warmInstall": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.4.3-pep621-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warmInstallReplacesUpstream": {
-     "exit": 0,
-     "patched": true,
-     "tail": "Updating urllib3 (1.26.18 -> 1.26.18 <scratch>/matrix-final2/captures/2.4.3-pep621-vendored/project/.socket/vendor/pypi/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)\n"
-    },
-    "warnings": [
-     {
-      "action": "applied",
-      "files": [
-       {
-        "path": "urllib3/response.py",
-        "verified": true
-       }
-      ],
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl"
-     },
-     {
-      "action": "skipped",
-      "errorCode": "vendor_prebuilt_downloaded",
-      "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-      "reason": "vendored the wheel for pkg:pypi/urllib3@1.26.18 from the patch service (https://patch.socket.dev/patch/pypi/urllib3/1.26.18/7e52b8b6-53f2-4dc8-860a-1ae7ebd8be0e/e828efa5-5c6d-43f3-9909-03f5ac232b98/urllib3-1.26.18-py2.py3-none-any.whl)"
-     }
-    ]
-   },
-   "mode": "vendored",
-   "passed": true,
-   "poetry": "2.4.3",
-   "shape": "pep621"
-  },
-  {
-   "checks": {},
-   "expected": "informational: setup edits pyproject; poetry must resolve socket-patch[hook]",
-   "info": {
-    "lockChanged": true,
-    "poetryLockAfterSetup": {
-     "exit": 0,
-     "tail": "Creating virtualenv poetry-patch-fixture in <scratch>/matrix-final2-setup/captures/1.1.15-direct-setup/project/.venv\nResolving dependencies...\n"
-    },
-    "pyprojectChanged": true,
-    "pyprojectDiff": "[tool.poetry]\nname = \"poetry-patch-fixture\"\nversion = \"0.1.0\"\ndescription = \"\"\nauthors = [\"Socket <engineering@socket.dev>\"]\n\n[tool.poetry.dependencies]\npython = \">=3.8\"\nurllib3 = \"1.26.18\"\nsocket-patch = { version = \"*\", extras = [\"hook\"] }\n",
-    "setupCheckExit": 0,
-    "setupEnvelope": {
-     "alreadyConfigured": 0,
-     "errors": 0,
-     "files": [
-      {
-       "error": null,
-       "kind": "pth",
-       "path": "<scratch>/matrix-final2-setup/captures/1.1.15-direct-setup/project/pyproject.toml",
-       "status": "updated"
-      }
-     ],
-     "packageManager": "npm",
-     "pythonPackageManager": "poetry",
-     "status": "success",
-     "updated": 1
-    },
-    "setupExit": 0
-   },
-   "mode": "setup",
-   "passed": true,
-   "poetry": "1.1.15",
-   "shape": "direct"
-  }
- ]
-}
\ No newline at end of file
diff --git a/docs/testing/uv-compatibility.md b/docs/testing/uv-compatibility.md
index 86b3f4e8..16f1a67b 100644
--- a/docs/testing/uv-compatibility.md
+++ b/docs/testing/uv-compatibility.md
@@ -75,7 +75,7 @@ frozen, locked, and ordinary installation outcomes separately where supported.
   `pypi_uv_lock_package_missing`.
 - Native lock versions other than `version = 1`, and PEP 751 versions other than
   `lock-version = "1.0"`, are refused. Lock `revision` values 1 (0.6.0–0.6.14),
-  2 (0.6.15–0.8.3) and 3 (0.8.4 onward) are all covered by the matrix below.
+  2 (0.6.15–0.8.3) and 3 (0.8.4 onward) are covered by the release-family runner.
 - Command availability boundaries observed with real binaries: `uv lock`
   writes a lock from 0.1.45 (see above); `uv export` from 0.4.1, its
   `--output-file` flag from 0.4.7 (the harness reads the export from stdout
@@ -250,9 +250,8 @@ untouched, and the installed bytes:
 A plain `uv sync` that rewrites the lock is recorded (`lockUnchanged: false`),
 not raised: it is a real observation, not a harness error. No export or PEP 751
 lanes run for the variants. Each version row in `results.json` carries a
-`variants` summary; the tables below are printed from that file with
-`--render-doc-table` (see the markers in the results section), so the doc can be
-regenerated after a full run without hand-editing:
+`variants` summary. Render a summary alongside the run's output with
+`--render-doc-table`:
 
 ```sh
 python3 scripts/backtest-uv.py --render-doc-table /tmp/socket-patch-uv-backtest/results.json
@@ -299,210 +298,5 @@ Lanes a release lacks are reported `n/a`: uv 0.1.45 writes the
 locks need `uv lock --script` (0.5.17), pylock lanes need `uv pip sync
 pylock.toml` (0.7).
 
-## Full matrix results
-
-<!-- GENERATED:BEGIN — everything down to GENERATED:END is printed by
-     `python3 scripts/backtest-uv.py --render-doc-table <output>/results.json`;
-     regenerate it after a matrix run instead of editing by hand. -->
-The complete run finished on **2026-09-15**, using
-**macOS-26.6.2-arm64-arm-64bit-Mach-O** and Python **3.9.6**. It tested
-socket-patch source commit `17d0dcb84bab1bec030117e0f111c7bfd893c2eb`
-(`socket-patch 4.0.0`), with binary SHA-256:
-
-```text
-be7a0e3dd86d540b0dc038437410bec6042bcaad5ae8beba92fae23015b56548
-```
-
-**1403 installed-byte comparisons** ran, with **18 mismatches**. **1086
-lock-preservation checks** were recorded — every install attempt against a
-patched lock (`--frozen` and `--locked` where the binary provides them, plain
-`uv sync` where it does not, `uv run --frozen --script`, `uv pip sync
-pylock.toml`, and the project-variant installs), including failed installs whose
-lock was left untouched — and **32 changed the lock**. `--frozen` never writes
-the lock, so the 383 `--locked` rows are the ones that measure preservation; 351
-of them exited 0. The [machine-readable results](uv-compatibility/results.json)
-contain all 2769 observations and their command definitions. The [binary
-catalog](uv-compatibility/binaries.json) records each uv wheel's public PyPI
-source and verified hash.
-
-Each paired result below is **hosted / vendored**. “Pass” means the installed
-`urllib3/response.py` matched the published patch; “—” means that uv binary did
-not provide the format or command. Requirements include plain and hashed
-compilation. PEP 751 covers both standalone locks and exported locks.
-
-| uv | Native grammar | Native H/V | Requirements H/V | Requirements export H/V | Scripts H/V | PEP 751 H/V | Verified installs |
-|----|----------------|------------|------------------|-------------------------|-------------|-------------|-------------------|
-| 0.0.5 | No native lock | — / — | Pass / rejected path | — / — | — / — | — / — | 2 |
-| 0.1.0 | No native lock | — / — | Pass / rejected path | — / — | — / — | — / — | 2 |
-| 0.1.23 | No native lock | — / — | Pass / rejected path | — / — | — / — | — / — | 2 |
-| 0.1.24 | No native lock | — / — | Pass / Pass | — / — | — / — | — / — | 4 |
-| 0.1.44 | No native lock | — / — | Pass / Pass | — / — | — / — | — / — | 4 |
-| 0.1.45 | `distribution`, v1 | Pass / refused | Pass / Pass | — / — | — / — | — / — | 6 |
-| 0.2.0 | `distribution`, v1 | Pass / refused | Pass / Pass | — / — | — / — | — / — | 6 |
-| 0.2.5 | `distribution`, v1 | Pass / refused | Pass / Pass | — / — | — / — | — / — | 6 |
-| 0.2.6 | `distribution`, v1 | Pass / refused | Pass / Pass | — / — | — / — | — / — | 6 |
-| 0.2.17 | `distribution`, v1 | Pass / refused | Pass / Pass | — / — | — / — | — / — | 6 |
-| 0.2.18 | `distribution`, v1 | Pass / refused | Pass / Pass | — / — | — / — | — / — | 6 |
-| 0.2.34 | `distribution`, v1 | Pass / refused | Pass / Pass | — / — | — / — | — / — | 7 |
-| 0.2.35 | `package`, v1 | Pass / Pass¹ | Pass / Pass | — / — | — / — | — / — | 24 |
-| 0.2.36 | `package`, v1 | Pass / Pass¹ | Pass / Pass | — / — | — / — | — / — | 24 |
-| 0.2.37 | `package`, v1 | Pass / Pass¹ | Pass / Pass | — / — | — / — | — / — | 28 |
-| 0.3.0 | `package`, v1 | Pass / Pass¹ | Pass / Pass | — / — | — / — | — / — | 28 |
-| 0.3.5 | `package`, v1 | Pass / Pass | Pass / Pass | — / — | — / — | — / — | 28 |
-| 0.4.0 | `package`, v1 | Pass / Pass | Pass / Pass | — / — | — / — | — / — | 28 |
-| 0.4.1 | `package`, v1 | Pass / Pass | Pass / Pass | Pass / Pass | — / — | — / — | 30 |
-| 0.4.30 | `package`, v1 | Pass / Pass | Pass / Pass | Pass / Pass | — / — | — / — | 36 |
-| 0.5.0 | `package`, v1 | Pass / Pass | Pass / Pass | Pass / Pass | — / — | — / — | 36 |
-| 0.5.16 | `package`, v1 | Pass / Pass | Pass / Pass | Pass / Pass | — / — | — / — | 42 |
-| 0.5.17 | `package`, v1 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | — / — | 48 |
-| 0.5.31 | `package`, v1 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | — / — | 48 |
-| 0.6.0 | `package`, v1 r1 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | — / — | 48 |
-| 0.6.14 | `package`, v1 r1 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | — / — | 48 |
-| 0.6.15 | `package`, v1 r2 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | 52 |
-| 0.6.17 | `package`, v1 r2 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | 52 |
-| 0.7.0 | `package`, v1 r2 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | 52 |
-| 0.7.22 | `package`, v1 r2 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | 52 |
-| 0.8.0 | `package`, v1 r2 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | 52 |
-| 0.8.3 | `package`, v1 r2 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | 52 |
-| 0.8.4 | `package`, v1 r3 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | 52 |
-| 0.8.24 | `package`, v1 r3 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | 52 |
-| 0.9.0 | `package`, v1 r3 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | 52 |
-| 0.9.30 | `package`, v1 r3 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | 52 |
-| 0.10.0 | `package`, v1 r3 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | 52 |
-| 0.10.12 | `package`, v1 r3 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | 52 |
-| 0.11.0 | `package`, v1 r3 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | 52 |
-| 0.11.33 | `package`, v1 r3 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | 52 |
-| 0.12.0 | `package`, v1 r3 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | 52 |
-| 0.12.15 | `package`, v1 r3 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | 52 |
-
-### Project variants (uv ≥ 0.2.35)
-
-Each `[[package]]`-grammar binary also locks five further project shapes
-(`variant-*` cases in the results), scans them in both modes, and installs from
-the patched lock with `--frozen`, `--locked` (where available) and a plain `uv
-sync`, each into a fresh environment. “Pass” requires the patched bytes from
-every executed install and an untouched lock after `--locked`; “Fail: …” names
-the installs that missed; “refused” means the CLI reported the shape unsupported
-and left the lock unpatched; “—” means the binary cannot lock that shape (no
-`[dependency-groups]`, no `[manifest]` constraints, or no `exclude-newer`
-setting).
-
-| uv | tool-uv-dev H/V | dependency-groups H/V | extras-duplicate H/V | constraints H/V | transitive H/V |
-|----|-----------------|-----------------------|----------------------|-----------------|----------------|
-| 0.2.35 | Pass / Pass | — / — | Pass / Pass | — / — | Fail: locked, plain / Fail: locked, plain |
-| 0.2.36 | Pass / Pass | — / — | Pass / Pass | — / — | Fail: locked, plain / Fail: locked, plain |
-| 0.2.37 | Pass / Pass | — / — | Pass / Pass | Fail: locked / Fail: locked | Fail: locked, plain / Fail: locked, plain |
-| 0.3.0 | Pass / Pass | — / — | Pass / Pass | Fail: locked / Fail: locked | Fail: locked, plain / Fail: locked, plain |
-| 0.3.5 | Pass / Pass | — / — | Pass / Pass | Fail: locked / Fail: locked | Fail: locked, plain / Fail: locked, plain |
-| 0.4.0 | Pass / Pass | — / — | Pass / Pass | Fail: locked / Fail: locked | Fail: locked, plain / Fail: locked, plain |
-| 0.4.1 | Pass / Pass | — / — | Pass / Pass | Fail: locked / Fail: locked | Fail: locked, plain / Fail: locked, plain |
-| 0.4.30 | Pass / Pass | Pass / Pass | Pass / Pass | Fail: locked / Fail: locked | Fail: locked, plain / Fail: locked, plain |
-| 0.5.0 | Pass / Pass | Pass / Pass | Pass / Pass | Fail: locked / Fail: locked | Fail: locked, plain / Fail: locked, plain |
-| 0.5.16 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass |
-| 0.5.17 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass |
-| 0.5.31 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass |
-| 0.6.0 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass |
-| 0.6.14 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass |
-| 0.6.15 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass |
-| 0.6.17 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass |
-| 0.7.0 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass |
-| 0.7.22 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass |
-| 0.8.0 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass |
-| 0.8.3 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass |
-| 0.8.4 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass |
-| 0.8.24 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass |
-| 0.9.0 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass |
-| 0.9.30 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass |
-| 0.10.0 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass |
-| 0.10.12 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass |
-| 0.11.0 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass |
-| 0.11.33 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass |
-| 0.12.0 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass |
-| 0.12.15 | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass | Pass / Pass |
-<!-- GENERATED:END -->
-
-Nonzero outcomes and mismatches in this run, and what each one is:
-
-- uv 0.0.5 through 0.1.23 rejected vendored requirements' local wheel path
-  syntax (`Unexpected '.', expected '-c', '-e', '-r' or the start of a
-  requirement`); 0.1.24 onward accepted it. Both hosted requirements variants
-  installed the patch on every binary. uv 0.0.5–0.1.44 have no working
-  `uv lock` (the `lock` rows exit 2), so their native lanes are `—`.
-- Native vendoring on every `[[distribution]]`-grammar binary (0.1.45 through
-  0.2.34) was refused with `pypi_uv_legacy_lock_unsupported`; hosted native
-  installs — in all three shapes: sub-table artifacts (through 0.2.5), inline
-  artifacts with string sources (0.2.6–0.2.17), and inline-table sources
-  (0.2.18–0.2.34) — and both requirements modes installed the patch.
-- ¹ uv 0.2.35, 0.2.36, 0.2.37 and 0.3.0 cannot build the root fixture from an
-  empty cache under `--offline` (`setuptools>=40.8.0` was absent). The
-  network-enabled retry (`project-vendored-frozen-sync-root-build-networked`)
-  installed the patched wheel; the subsequent locked and ordinary installation
-  checks also passed.
-- Export, script-lock, and PEP 751 commands unavailable in older binaries were
-  recorded as unavailable, not installation successes (`uv export` from 0.4.1,
-  `uv lock --script` from 0.5.17, PEP 751 compilation from 0.6.15 — 0.6.14
-  exits 2 on the `pylock.toml` output). Some older uv binaries accepted an
-  output filename ending in `pylock.toml` but emitted requirements text; those
-  results have `formatSupported: false`.
-- The **18 installed-byte mismatches** are all the `transitive` variant's plain
-  `uv sync` rows on 0.2.35–0.5.0 (nine binaries, both modes): those releases
-  do not apply `[tool.uv.sources]` to `override-dependencies`, so the plain
-  sync re-resolves the override against the registry and installs the pristine
-  wheel; `--frozen` installed the patch on every one of them. This is the
-  boundary the `pypi_uv_override_requires_uv_0_5_6` advisory names; from
-  0.5.16 (the first ≥ 0.5.6 binary in the matrix) every install passes.
-- The **32 lock changes** and the 32 non-zero `--locked` rows are those same
-  18 transitive rows plus the `constraints` variant's plain-sync / `--locked`
-  rows on 0.2.37–0.5.0 (seven binaries, both modes): those releases serialize
-  `[manifest] constraints` as `{ name, specifier }` regardless of sources, so
-  they reject the repointed entry under `--locked` and rewrite it back on a
-  plain sync — which still installed the patch (no mismatch). 0.2.35 and
-  0.2.36 do not record constraints in the lock (`—`). This is the boundary the
-  `pypi_uv_constraints_require_uv_0_5_6` advisory names; from 0.5.16 every
-  constraints install passes with the lock untouched.
-- Every other `--locked`, `--frozen`, plain, script and PEP 751 install
-  delivered the patched bytes with the lock byte-unchanged, including the
-  `[tool.uv] dev-dependencies`, `[dependency-groups]` and extras-duplicate
-  shapes on every binary that can lock them.
-
-## Completed conditional-requirements and refusal checks
-
-The following checks ran on 2026-09-14 with uv `0.12.13`, Python `3.9.6`, the
-rebuilt CLI, real PyPI distributions, and the public Socket patch service.
-Their [sanitized command evidence](uv-compatibility/conditional-probes.json)
-records both the installed hashes and the byte-preservation assertions. These
-supplemental probes were captured during implementation; their individual CLI
-binary hashes were not recorded, so they are kept separate from the exact-source
-matrix above.
-
-| Case | Observed result |
-|------|-----------------|
-| `urllib3==1.26.18` for Python below 3.10; `urllib3==2.6.3` for Python 3.10 and newer | Only 1.26.18 received a patch. The complete 2.6.3 requirement and original hash continuations remained byte-identical. Fresh hash-verified installation succeeded. |
-| The same markers selecting 1.26.18 and 2.0.0, both with published patches | Each version received its own artifact URL and hash. A repeated scan and fresh hash-verified installation succeeded; one override did not replace the other's version. |
-| Hashed `urllib3[socks]==1.26.18` with a platform marker | Extras and the marker survived the rewrite; unrelated dependency hashes were preserved. Fresh hash-verified installation succeeded. |
-| A PEP 723 script locking both 1.26.18 and 2.0.0 | Hosted and vendored scans reported the competing-version refusal. Both the script and its lock remained byte-identical. |
-| A native project locking both 1.26.18 and 2.0.0 | Hosted scan reported the competing-version refusal. Both `pyproject.toml` and `uv.lock` remained byte-identical. |
-
-The requirements inputs were generated with real uv compilation, including:
-
-```sh
-uv pip compile requirements.in \
-  --universal --python-version 3.9 \
-  --generate-hashes --no-strip-markers \
-  --output-file requirements.txt
-socket-patch scan --mode hosted --json --yes --no-telemetry
-uv venv .venv-sync --python /path/to/python3.9
-uv pip sync --python .venv-sync/bin/python \
-  --require-hashes requirements.txt
-```
-
-The extras case also used `--no-strip-extras`. For the selected 1.26.18 patch,
-UUID `e828efa5-5c6d-43f3-9909-03f5ac232b98`, the freshly installed
-`urllib3/response.py` matched the published patched wheel's SHA-256:
-
-```text
-21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4
-```
-
-This hash records the patch selected for that run. Production patch ordering
-can change; a later run must compare against the artifact it actually selects.
+Full run results belong with the source revision and toolchain versions in CI
+artifacts or a local output directory. See the [testing guide](README.md#ci-and-results).
diff --git a/docs/testing/uv-compatibility/binaries.json b/docs/testing/uv-compatibility/binaries.json
deleted file mode 100644
index 58ebb0e7..00000000
--- a/docs/testing/uv-compatibility/binaries.json
+++ /dev/null
@@ -1,296 +0,0 @@
-[
-  {
-    "version": "0.0.5",
-    "url": "https://files.pythonhosted.org/packages/0c/49/fe6bd6b2ca5b661461d608218ca79a004ae0f51dd069e33b629714fb442b/uv-0.0.5-py3-none-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl",
-    "sha256": "2fb16b693c8997100040291890522880dde83f9fda533845ec24352d8becded5",
-    "uploaded": "2024-02-15T18:56:14.105999Z",
-    "filename": "uv-0.0.5-py3-none-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl"
-  },
-  {
-    "version": "0.1.0",
-    "url": "https://files.pythonhosted.org/packages/0c/e3/415f40a86918316951b69b42661731bf6c5e5007f4063bc564773aec4815/uv-0.1.0-py3-none-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl",
-    "sha256": "71291b3b3222da25a6af5ab9dfaec3bdd97fd4f0d21cf38a04cbd63000fa9da5",
-    "uploaded": "2024-02-15T19:44:47.783250Z",
-    "filename": "uv-0.1.0-py3-none-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl"
-  },
-  {
-    "version": "0.1.23",
-    "url": "https://files.pythonhosted.org/packages/e4/02/824e40366ecd913483d67723aa10079b5d127b43d7f8c3f164dcf19fb9c4/uv-0.1.23-py3-none-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl",
-    "sha256": "d9d1d6d2bca50b9ea2ed764a6931b53995f6b5dbf3def9eafbcec57a88b4a6e2",
-    "uploaded": "2024-03-21T03:09:59.075241Z",
-    "filename": "uv-0.1.23-py3-none-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl"
-  },
-  {
-    "version": "0.1.24",
-    "url": "https://files.pythonhosted.org/packages/1e/ef/90fc17103183c23e8e5142c455b1ca8c1c38142c89c8aaa27f7ab37c34f5/uv-0.1.24-py3-none-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl",
-    "sha256": "33d74c4c67df34de18c4318a6c568efef9dfab6d05332b1d1eddc8e516fc8806",
-    "uploaded": "2024-03-22T20:15:08.127518Z",
-    "filename": "uv-0.1.24-py3-none-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl"
-  },
-  {
-    "version": "0.1.44",
-    "url": "https://files.pythonhosted.org/packages/85/6a/4e98521c359f593cdd8cebc6381c09be1d133bd93031e76accc6b8aa7788/uv-0.1.44-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "e247dca0d8d42d71032ac99ef3d72a4fcbad4ae3114ef5979878a81a40fed274",
-    "uploaded": "2024-05-14T14:28:43.548037Z",
-    "filename": "uv-0.1.44-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.1.45",
-    "url": "https://files.pythonhosted.org/packages/7f/15/46efcaa86ebef51b8663d8beb95c8376fbdaaf45aeffbc269bf0a3527092/uv-0.1.45-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "4e5d55f0f8b6ae416c72d78106e224c8e8338356da21ddebecc7b1723de80924",
-    "uploaded": "2024-05-20T21:05:54.623510Z",
-    "filename": "uv-0.1.45-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.2.0",
-    "url": "https://files.pythonhosted.org/packages/cc/4a/7c3d702c5920487d481bd03a3ca821f8886ad2d6937e49f4efc0a16c6e61/uv-0.2.0-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "ba5e339a0fb32a02142346eea4d46f6ad618a390df5d70515ba0e1d3c6f7ce41",
-    "uploaded": "2024-05-22T19:11:42.407716Z",
-    "filename": "uv-0.2.0-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.2.5",
-    "url": "https://files.pythonhosted.org/packages/06/d2/ef1c65a0715731da623b430757a9b851167309fc7e326140d27d246e6541/uv-0.2.5-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "650f81439c4f65e86fdba84f2cbb6700a074b95d70c5cc3d38e8ce2b87e43a45",
-    "uploaded": "2024-05-28T18:33:49.720762Z",
-    "filename": "uv-0.2.5-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.2.6",
-    "url": "https://files.pythonhosted.org/packages/a0/53/4c9a7370ec5bf75b89b82117fae68d7bb268d229deb82c51264ca27a1368/uv-0.2.6-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "1ac3b96c6284ef2e5367e62f31472cc3f27ba4c7e14f579e7c6dbd081943e38b",
-    "uploaded": "2024-06-03T18:22:26.325121Z",
-    "filename": "uv-0.2.6-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.2.17",
-    "url": "https://files.pythonhosted.org/packages/90/c0/27b6fc7cc85984b0c86ffd0e42abf4c97aeff2cc3425b09ce86e679bedae/uv-0.2.17-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "d6628bcb0d21f2f8489ed33818fa6c2da3a472adead076864701ae7a3bafb4de",
-    "uploaded": "2024-06-26T23:39:17.070293Z",
-    "filename": "uv-0.2.17-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.2.18",
-    "url": "https://files.pythonhosted.org/packages/60/0d/d462d188343464876ca196f064ba1682982446012c4893da0d7dbba01a8c/uv-0.2.18-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "eee9773a0a9f02d084a584279891df1fdf4de32d067f273b9480f86c9f91dcdb",
-    "uploaded": "2024-06-29T18:49:23.499620Z",
-    "filename": "uv-0.2.18-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.2.34",
-    "url": "https://files.pythonhosted.org/packages/f2/a0/840b0fa6b9f884384b558b8690cad603bdc0da2b7a67cec2755b612839c9/uv-0.2.34-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "4ce15beeba44e4ea052d83c89eb4ea3586dfd68bab039c5cdf44b90fbfc5698d",
-    "uploaded": "2024-08-07T20:59:42.011904Z",
-    "filename": "uv-0.2.34-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.2.35",
-    "url": "https://files.pythonhosted.org/packages/00/eb/c578ebb0f606be6a3a1c37e36a8b6068008ceab54db95a2ab70452c792fd/uv-0.2.35-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "3ff91eb85e0804d5f609f18a911b33d81b06e11c1bced1bf1396a2d738e97bc0",
-    "uploaded": "2024-08-10T00:42:30.944714Z",
-    "filename": "uv-0.2.35-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.2.36",
-    "url": "https://files.pythonhosted.org/packages/80/40/e951bc5598dbd7d58a6daf33a93977ecbaad60fdaa584610349f00acf521/uv-0.2.36-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "8820dd5b77ffcda07dde09712a43d969d39b0aace112d8074c540f19a4911cc2",
-    "uploaded": "2024-08-13T17:28:27.711187Z",
-    "filename": "uv-0.2.36-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.2.37",
-    "url": "https://files.pythonhosted.org/packages/e6/84/2c973ddb320642d02d2d117123a61ec6666bbc0143f5263b1e0c791c1252/uv-0.2.37-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "99d4f0f510c5aa807ef1141fd8cb31f25fb53587dadacb0e28e4f51eaca6f0ad",
-    "uploaded": "2024-08-16T02:45:56.044623Z",
-    "filename": "uv-0.2.37-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.3.0",
-    "url": "https://files.pythonhosted.org/packages/61/95/b6603342b9a0a180776e7aec845079cdc66fb521157ed9bf62b4e4174983/uv-0.3.0-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "39a4276afe0808ca6c033e0cd6cb73249f934b4a0c9d7b18a944f3f8ea635e27",
-    "uploaded": "2024-08-20T17:52:38.258401Z",
-    "filename": "uv-0.3.0-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.3.5",
-    "url": "https://files.pythonhosted.org/packages/83/8e/956ad3788cfa863cc8de148907e371b025acd97f7a0bb2a9e78ce63c2b1e/uv-0.3.5-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "89c1515200a838014b1fa6c9cfb2b9a055bcad3178ccf7d31768bf38b43cac65",
-    "uploaded": "2024-08-27T17:10:36.293543Z",
-    "filename": "uv-0.3.5-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.4.0",
-    "url": "https://files.pythonhosted.org/packages/2e/86/9844e8ab08e25cbf2094e2fa1a7ad66563036bfed77b46986b6a2489c10c/uv-0.4.0-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "02e0295566454289348de502677e2240ad86f2cb5fa058504e1b2ca2a2ebf7e1",
-    "uploaded": "2024-08-28T18:00:42.051786Z",
-    "filename": "uv-0.4.0-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.4.1",
-    "url": "https://files.pythonhosted.org/packages/46/ad/90e0d7a448b4c92846589c8bb92813ac45d2b123a2b9d4cab4167e805f9f/uv-0.4.1-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "fcdc6503100e86fecf6a727d3149e54581e8e9ad6c10e814fc5d22c1e80fab8d",
-    "uploaded": "2024-08-30T14:42:40.152858Z",
-    "filename": "uv-0.4.1-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.4.30",
-    "url": "https://files.pythonhosted.org/packages/67/37/8994c3d0be99851a21a6ee01bbf3cb35ddc4b202a2f6f4014098d5893660/uv-0.4.30-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "353617bfcf72e1eabade426d83fb86a69d11273d1612aabc3f4566d41c596c97",
-    "uploaded": "2024-11-05T01:13:59.667063Z",
-    "filename": "uv-0.4.30-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.5.0",
-    "url": "https://files.pythonhosted.org/packages/69/fb/e778bce57b12eac37c1e9e8e1efc8b190a2c72dee02b532d13706be447f4/uv-0.5.0-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "a3bc6911be7d86f3750bce1580e664877a3a88c126eb68afbb132cd0896fd109",
-    "uploaded": "2024-11-07T23:05:15.972013Z",
-    "filename": "uv-0.5.0-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.5.16",
-    "url": "https://files.pythonhosted.org/packages/0f/c4/74f4507f48ce5e38cef46cecd7716af0348dffcb3d40245189422226c7b7/uv-0.5.16-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "3419888b178b82511faebd8d1ca9cb9f5920a7142406898d76878adaffe8dfb1",
-    "uploaded": "2025-01-08T16:40:50.904248Z",
-    "filename": "uv-0.5.16-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.5.17",
-    "url": "https://files.pythonhosted.org/packages/f1/7e/4c8b7ca07945fe6ffd1a7e5d1f992b72534be69e97e20a2536d192734adc/uv-0.5.17-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "12789bf19457e3c5fc20767960203ab60222124afe2cbdfde92a657318651a64",
-    "uploaded": "2025-01-10T21:13:54.034599Z",
-    "filename": "uv-0.5.17-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.5.31",
-    "url": "https://files.pythonhosted.org/packages/1f/5a/1eb42f481a9f9010c8c194d70ab375a6eda96d67ca1fd011bf869d4016c8/uv-0.5.31-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "335c16f91b46b4f4a3b31c18cf112a0643d59d4c1708a177103621da0addbaef",
-    "uploaded": "2025-02-12T21:28:12.802785Z",
-    "filename": "uv-0.5.31-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.6.0",
-    "url": "https://files.pythonhosted.org/packages/6d/c3/c1e81bfdd3414492650ca2647dbb466bb9e0063ee71020dc49f5f011f9ac/uv-0.6.0-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "26d655adf59ec088f07a2459de3f5e0565e8f84f389bfe936a354e5e169dfc8f",
-    "uploaded": "2025-02-14T18:20:31.778738Z",
-    "filename": "uv-0.6.0-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.6.14",
-    "url": "https://files.pythonhosted.org/packages/72/89/e7fc8a047f08234cc26d1e37e5f573887744205d087f8e8e6f3d0feb04ce/uv-0.6.14-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "9fc8fe58871b4fe02a863b05b8b1b25ef1b6c60d4d224e85338f5c2be0ab4f0e",
-    "uploaded": "2025-04-09T21:56:12.061201Z",
-    "filename": "uv-0.6.14-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.6.15",
-    "url": "https://files.pythonhosted.org/packages/f6/88/ad35ecc3b986274ff560267cb6e3b9119ca0f8cc82c61e2acae28c8b9ffe/uv-0.6.15-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "f113d1746ce7fdffada6f9e12b2f667d2b9069a3c3d5b05b680836102f2586c1",
-    "uploaded": "2025-04-22T00:50:26.375142Z",
-    "filename": "uv-0.6.15-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.6.17",
-    "url": "https://files.pythonhosted.org/packages/a5/4f/66c7153120c155446f319647c1bafec2d9288f2b48d769cd9f9da39aa1f2/uv-0.6.17-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "ce243bec19c47cc274e7e9eedbaeeb3dacbe94430b0f085dd506ba15a41676ee",
-    "uploaded": "2025-04-25T18:51:15.410083Z",
-    "filename": "uv-0.6.17-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.7.0",
-    "url": "https://files.pythonhosted.org/packages/ed/1d/cad304d6107208fdd90adf5ca519e86a2e35786cb7229d6cd39cf29bec3d/uv-0.7.0-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "1f48eeaeb46a5f81be873c1662c999e78ff267798ecea9dd48c7082e022048ec",
-    "uploaded": "2025-04-29T22:03:35.477030Z",
-    "filename": "uv-0.7.0-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.7.22",
-    "url": "https://files.pythonhosted.org/packages/64/f5/0ee734f5e988fd8f26aad1f150703fe8c7d664029c9c677b989b69caf104/uv-0.7.22-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "573edda226dc26e6fea03aa89a45af2f2a367ad1f466af15c4eb54286dae042f",
-    "uploaded": "2025-07-17T17:00:10.010548Z",
-    "filename": "uv-0.7.22-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.8.0",
-    "url": "https://files.pythonhosted.org/packages/9d/98/9a89983caa05cf998eea3dac1e6cff2e0ab8099be0695fd8b9dc6a5038a0/uv-0.8.0-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "2d0ebf05eaee75921b3f23e7401a56bc0732bcdabb7469081ab00769340a93b4",
-    "uploaded": "2025-07-17T22:51:04.941749Z",
-    "filename": "uv-0.8.0-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.8.3",
-    "url": "https://files.pythonhosted.org/packages/9c/ba/8ceec5d6a1adf6b827db557077d8059e573a84c3708a70433d22a0470fab/uv-0.8.3-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "3f904f574dc2d7aa1d96ddf2483480ecd121dc9d060108cadd8bff100b754b64",
-    "uploaded": "2025-07-24T21:13:57.570096Z",
-    "filename": "uv-0.8.3-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.8.4",
-    "url": "https://files.pythonhosted.org/packages/16/39/7d4b68132868c550ae97c3b2c348c55db47a987dff05ab0e5f577bf0e197/uv-0.8.4-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "edc813645348665a3b4716a7d5e961cf7c8d1d3bfb9d907a4f18cf87c712a430",
-    "uploaded": "2025-07-30T17:10:20.417141Z",
-    "filename": "uv-0.8.4-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.8.24",
-    "url": "https://files.pythonhosted.org/packages/ea/00/08f4e93989129bb3378f20315dddcac6f8cf26a12bdd90443a340e7ecdb4/uv-0.8.24-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "a2bd708a545c1c21d7be8575f4cff00d0cff26be13fc81e3f7e54b8751fb90c0",
-    "uploaded": "2025-10-07T03:33:24.533046Z",
-    "filename": "uv-0.8.24-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.9.0",
-    "url": "https://files.pythonhosted.org/packages/8e/06/f5e38314e318bfaa20ccce966f6d0a69b093854648d31085b2d8b2097aab/uv-0.9.0-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "b900e84d992a657e16371426dbb030ab031c0322a604b632dada34401ebe7145",
-    "uploaded": "2025-10-07T23:44:30.076333Z",
-    "filename": "uv-0.9.0-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.9.30",
-    "url": "https://files.pythonhosted.org/packages/42/5f/3ccc9415ef62969ed01829572338ea7bdf4c5cf1ffb9edc1f8cb91b571f3/uv-0.9.30-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "777ecd117cf1d8d6bb07de8c9b7f6c5f3e802415b926cf059d3423699732eb8c",
-    "uploaded": "2026-02-04T21:45:40.881824Z",
-    "filename": "uv-0.9.30-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.10.0",
-    "url": "https://files.pythonhosted.org/packages/ee/77/ec8f24f8d0f19c4fda0718d917bb78b9e6f02a4e1963b401f1c4f4614a54/uv-0.10.0-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "aefea608971f4f23ac3dac2006afb8eb2b2c1a2514f5fee1fac18e6c45fd70c4",
-    "uploaded": "2026-02-05T20:57:10.581974Z",
-    "filename": "uv-0.10.0-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.10.12",
-    "url": "https://files.pythonhosted.org/packages/ce/db/c41ace81b8ef5d5952433df38e321c0b6e5f88ce210c508b14f84817963f/uv-0.10.12-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "551f799d53e397843b6cde7e3c61de716fb487da512a21a954b7d0cbc06967e0",
-    "uploaded": "2026-03-19T21:50:53.693778Z",
-    "filename": "uv-0.10.12-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.11.0",
-    "url": "https://files.pythonhosted.org/packages/d9/1c/6ddd0febcea06cf23e59d9bff90d07025ecfd600238807f41ed2bdafd159/uv-0.11.0-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "4b0ebbd7ae019ea9fc4bff6a07d0c1e1d6784d1842bbdcb941982d30e2391972",
-    "uploaded": "2026-03-23T22:05:48.771767Z",
-    "filename": "uv-0.11.0-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.11.33",
-    "url": "https://files.pythonhosted.org/packages/4d/e5/17a4e36299e9bd5e8101680be697c7832afac686d1fe8b28be28046c1d95/uv-0.11.33-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "8017991a398a55d177c33ecdb29beb33e7b53969921183e4681e3e5b278d73c2",
-    "uploaded": "2026-07-28T10:24:17.589531Z",
-    "filename": "uv-0.11.33-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.12.0",
-    "url": "https://files.pythonhosted.org/packages/a5/7b/15d6865264120bd30c738b4bf63ddff66d087087cadeb2a6b88c6284a446/uv-0.12.0-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "009758d8fde2da2b90900f5fe863c71d0e1b8b28bbdba59863ceb967973a3735",
-    "uploaded": "2026-07-28T18:56:32.904863Z",
-    "filename": "uv-0.12.0-py3-none-macosx_11_0_arm64.whl"
-  },
-  {
-    "version": "0.12.15",
-    "url": "https://files.pythonhosted.org/packages/84/62/82e86e03e111463ab224c132c0f0e6b649d98d22710b177fbc000d379103/uv-0.12.15-py3-none-macosx_11_0_arm64.whl",
-    "sha256": "03b2c763f8b3c5595fa103221bc667e3af0146f8cb327aa06630ebcf5cfe16e9",
-    "uploaded": "2026-09-15T12:07:07.611580Z",
-    "filename": "uv-0.12.15-py3-none-macosx_11_0_arm64.whl"
-  }
-]
diff --git a/docs/testing/uv-compatibility/conditional-probes.json b/docs/testing/uv-compatibility/conditional-probes.json
deleted file mode 100644
index 8cdb6af5..00000000
--- a/docs/testing/uv-compatibility/conditional-probes.json
+++ /dev/null
@@ -1,573 +0,0 @@
-{
-  "date": "2026-09-14",
-  "uvVersion": "0.12.13",
-  "pythonVersion": "3.9.6",
-  "provenance": "Supplemental real-service probes captured during implementation; an exact CLI binary hash was not recorded for these individual probes. The separately recorded release-family matrix identifies its tested source and binary.",
-  "redactions": [
-    "Working directories and executable paths use placeholders.",
-    "Hosted artifact URLs are redacted to remove download grants.",
-    "CLI output keeps command results and refusal details; patch catalog descriptions are omitted."
-  ],
-  "cases": [
-    {
-      "case": "conditional-unpatched-version",
-      "otherVersionRequirementByteIdentical": true,
-      "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-      "expectedPatchedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-      "commands": [
-        {
-          "command": [
-            "<uv-0.12.13>",
-            "venv",
-            ".venv",
-            "--python",
-            "/usr/bin/python3"
-          ],
-          "cwd": "<case>",
-          "key": "venv",
-          "exitCode": 0,
-          "stderr": "Using CPython 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtual environment at: .venv\nActivate with: source .venv/bin/activate\n"
-        },
-        {
-          "command": [
-            "<uv-0.12.13>",
-            "pip",
-            "install",
-            "--python",
-            "<case>/.venv/bin/python",
-            "<pristine-wheel>"
-          ],
-          "cwd": "<case>",
-          "key": "install-original",
-          "exitCode": 0,
-          "stderr": "Resolved 1 package in 0.82ms\nPrepared 1 package in 5ms\nInstalled 1 package in 1ms\n + urllib3==1.26.18 (from file://<pristine-wheel>)\n"
-        },
-        {
-          "command": [
-            "<socket-patch>",
-            "scan",
-            "--cwd",
-            "<case>",
-            "--mode",
-            "hosted",
-            "--json",
-            "--yes",
-            "--no-telemetry"
-          ],
-          "cwd": "<case>",
-          "key": "scan-single-published-version",
-          "exitCode": 0,
-          "cliResult": {
-            "status": "success",
-            "scannedPackages": 2,
-            "lockfileOnlyPackages": 1,
-            "redirect": {
-              "mode": "hosted",
-              "redirected": 1,
-              "rewrittenFiles": [
-                "requirements.txt"
-              ],
-              "skipped": [],
-              "warnings": [],
-              "dryRun": false
-            }
-          },
-          "stderr": "No SOCKET_API_TOKEN set (and no socket-cli login found) \u2014 using the public patch API proxy (free patches only). Run `socket login` or set SOCKET_API_TOKEN to access org patches.\nNon-interactive mode: auto-selecting first option.\n"
-        },
-        {
-          "command": [
-            "<uv-0.12.13>",
-            "venv",
-            ".venv-sync",
-            "--python",
-            "/usr/bin/python3"
-          ],
-          "cwd": "<case>",
-          "key": "fresh-venv",
-          "exitCode": 0,
-          "stderr": "Using CPython 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtual environment at: .venv-sync\nActivate with: source .venv-sync/bin/activate\n"
-        },
-        {
-          "command": [
-            "<uv-0.12.13>",
-            "pip",
-            "sync",
-            "--python",
-            "<case>/.venv-sync/bin/python",
-            "--require-hashes",
-            "requirements.txt"
-          ],
-          "cwd": "<case>",
-          "key": "hash-verified-sync",
-          "exitCode": 0,
-          "stderr": "Using Python 3.9.6 environment at: .venv-sync\nResolved 1 package in 551ms\nPrepared 1 package in 157ms\nInstalled 1 package in 5ms\n + urllib3==1.26.18 (from https://patch.socket.dev/<redacted-artifact-url>\n"
-        }
-      ]
-    },
-    {
-      "case": "conditional-two-patched-versions",
-      "bothPublishedVersionsRetainOwnArtifact": true,
-      "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-      "expectedPatchedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-      "commands": [
-        {
-          "command": [
-            "<uv-0.12.13>",
-            "venv",
-            ".venv",
-            "--python",
-            "/usr/bin/python3"
-          ],
-          "cwd": "<case>",
-          "key": "venv",
-          "exitCode": 0,
-          "stderr": "Using CPython 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtual environment at: .venv\nActivate with: source .venv/bin/activate\n"
-        },
-        {
-          "command": [
-            "<uv-0.12.13>",
-            "pip",
-            "install",
-            "--python",
-            "<case>/.venv/bin/python",
-            "<pristine-wheel>"
-          ],
-          "cwd": "<case>",
-          "key": "install-original",
-          "exitCode": 0,
-          "stderr": "Resolved 1 package in 1ms\nPrepared 1 package in 6ms\nInstalled 1 package in 1ms\n + urllib3==1.26.18 (from file://<pristine-wheel>)\n"
-        },
-        {
-          "command": [
-            "<socket-patch>",
-            "scan",
-            "--cwd",
-            "<case>",
-            "--mode",
-            "hosted",
-            "--json",
-            "--yes",
-            "--no-telemetry"
-          ],
-          "cwd": "<case>",
-          "key": "scan-two-published-versions-rerun",
-          "exitCode": 0,
-          "cliResult": {
-            "status": "success",
-            "scannedPackages": 1,
-            "lockfileOnlyPackages": 0,
-            "redirect": {
-              "mode": "hosted",
-              "redirected": 1,
-              "rewrittenFiles": [],
-              "skipped": [],
-              "warnings": [],
-              "dryRun": false
-            }
-          },
-          "stderr": "No SOCKET_API_TOKEN set (and no socket-cli login found) \u2014 using the public patch API proxy (free patches only). Run `socket login` or set SOCKET_API_TOKEN to access org patches.\nNon-interactive mode: auto-selecting first option.\n"
-        },
-        {
-          "command": [
-            "<uv-0.12.13>",
-            "venv",
-            ".venv-sync",
-            "--python",
-            "/usr/bin/python3"
-          ],
-          "cwd": "<case>",
-          "key": "fresh-venv",
-          "exitCode": 0,
-          "stderr": "Using CPython 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtual environment at: .venv-sync\nActivate with: source .venv-sync/bin/activate\n"
-        },
-        {
-          "command": [
-            "<uv-0.12.13>",
-            "pip",
-            "sync",
-            "--python",
-            "<case>/.venv-sync/bin/python",
-            "--require-hashes",
-            "requirements.txt"
-          ],
-          "cwd": "<case>",
-          "key": "hash-verified-sync",
-          "exitCode": 0,
-          "stderr": "Using Python 3.9.6 environment at: .venv-sync\nResolved 1 package in 1.75s\nPrepared 1 package in 218ms\nInstalled 1 package in 4ms\n + urllib3==1.26.18 (from https://patch.socket.dev/<redacted-artifact-url>\n"
-        }
-      ]
-    },
-    {
-      "case": "extras-and-marker",
-      "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-      "expectedPatchedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-      "commands": [
-        {
-          "command": [
-            "<uv-0.12.13>",
-            "pip",
-            "compile",
-            "requirements.in",
-            "--generate-hashes",
-            "--universal",
-            "--no-strip-extras",
-            "--no-strip-markers",
-            "-o",
-            "requirements.txt"
-          ],
-          "cwd": "<case>",
-          "key": "compile",
-          "exitCode": 0,
-          "stdout": "# This file was autogenerated by uv via the following command:\n#    uv pip compile requirements.in --generate-hashes --universal --no-strip-extras --no-strip-markers -o requirements.txt\npysocks==1.7.1 ; sys_platform == 'darwin' \\\n    --hash=sha256:08e69f092cc6dbe92a0fdd16eeb9b9ffbc13cadfe5ca4c7bd92ffb078b293299 \\\n    --hash=sha256:2725bd0a9925919b9b51739eea5f9e2bae91e83288108a9ad338b2e3a4435ee5 \\\n    --hash=sha256:3f8804571ebe159c380ac6de37643bb4685970655d3bba243530d6558b799aa0\n    # via urllib3\nurllib3[socks]==1.26.18 ; sys_platform == 'darwin' \\\n    --hash=sha256:34b97092d7e0a3a8cf7cd10e386f401b3737364026c45e622aa02903dffe0f07 \\\n    --hash=sha256:f8ecc1bba5667413457c529ab955bf8c67b45db799d159066261719e328580a0\n    # via -r requirements.in\n",
-          "stderr": "Resolved 2 packages in 261ms\n"
-        },
-        {
-          "command": [
-            "<uv-0.12.13>",
-            "venv",
-            ".venv",
-            "--python",
-            "/usr/bin/python3"
-          ],
-          "cwd": "<case>",
-          "key": "venv",
-          "exitCode": 0,
-          "stderr": "Using CPython 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtual environment at: .venv\nActivate with: source .venv/bin/activate\n"
-        },
-        {
-          "command": [
-            "<uv-0.12.13>",
-            "pip",
-            "install",
-            "--python",
-            "<case>/.venv/bin/python",
-            "<pristine-wheel>"
-          ],
-          "cwd": "<case>",
-          "key": "install-original",
-          "exitCode": 0,
-          "stderr": "Resolved 1 package in 0.84ms\nPrepared 1 package in 6ms\nInstalled 1 package in 1ms\n + urllib3==1.26.18 (from file://<pristine-wheel>)\n"
-        },
-        {
-          "command": [
-            "<socket-patch>",
-            "scan",
-            "--cwd",
-            "<case>",
-            "--mode",
-            "hosted",
-            "--json",
-            "--yes",
-            "--no-telemetry"
-          ],
-          "cwd": "<case>",
-          "key": "socket-patch",
-          "exitCode": 0,
-          "cliResult": {
-            "status": "success",
-            "scannedPackages": 2,
-            "lockfileOnlyPackages": 1,
-            "redirect": {
-              "mode": "hosted",
-              "redirected": 1,
-              "rewrittenFiles": [
-                "requirements.txt"
-              ],
-              "skipped": [],
-              "warnings": [],
-              "dryRun": false
-            }
-          },
-          "stderr": "No SOCKET_API_TOKEN set (and no socket-cli login found) \u2014 using the public patch API proxy (free patches only). Run `socket login` or set SOCKET_API_TOKEN to access org patches.\nNon-interactive mode: auto-selecting first option.\n"
-        },
-        {
-          "command": [
-            "<uv-0.12.13>",
-            "venv",
-            ".venv-sync",
-            "--python",
-            "/usr/bin/python3"
-          ],
-          "cwd": "<case>",
-          "key": "fresh-venv",
-          "exitCode": 0,
-          "stderr": "Using CPython 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtual environment at: .venv-sync\nActivate with: source .venv-sync/bin/activate\n"
-        },
-        {
-          "command": [
-            "<uv-0.12.13>",
-            "pip",
-            "sync",
-            "--python",
-            "<case>/.venv-sync/bin/python",
-            "--require-hashes",
-            "requirements.txt"
-          ],
-          "cwd": "<case>",
-          "key": "hashed-sync",
-          "exitCode": 0,
-          "stderr": "Using Python 3.9.6 environment at: .venv-sync\nResolved 2 packages in 424ms\nPrepared 2 packages in 142ms\nInstalled 2 packages in 4ms\n + pysocks==1.7.1\n + urllib3==1.26.18 (from https://patch.socket.dev/<redacted-artifact-url>\n"
-        }
-      ]
-    },
-    {
-      "case": "script-hosted-refusal",
-      "kind": "script",
-      "mode": "hosted",
-      "filesByteIdentical": {
-        "job.py": true,
-        "job.py.lock": true
-      },
-      "commands": [
-        {
-          "command": [
-            "<uv-0.12.13>",
-            "venv",
-            ".venv",
-            "--python",
-            "/usr/bin/python3"
-          ],
-          "cwd": "<case>",
-          "key": "venv",
-          "exitCode": 0,
-          "stderr": "Using CPython 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtual environment at: .venv\nActivate with: source .venv/bin/activate\n"
-        },
-        {
-          "command": [
-            "<uv-0.12.13>",
-            "pip",
-            "install",
-            "--python",
-            "<case>/.venv/bin/python",
-            "<pristine-wheel>"
-          ],
-          "cwd": "<case>",
-          "key": "install-original",
-          "exitCode": 0,
-          "stderr": "Resolved 1 package in 1ms\nPrepared 1 package in 7ms\nInstalled 1 package in 1ms\n + urllib3==1.26.18 (from file://<pristine-wheel>)\n"
-        },
-        {
-          "command": [
-            "<socket-patch>",
-            "scan",
-            "--cwd",
-            "<case>",
-            "--mode",
-            "hosted",
-            "--json",
-            "--yes",
-            "--no-telemetry"
-          ],
-          "cwd": "<case>",
-          "key": "scan",
-          "exitCode": 0,
-          "cliResult": {
-            "status": "success",
-            "scannedPackages": 2,
-            "lockfileOnlyPackages": 1,
-            "redirect": {
-              "mode": "hosted",
-              "redirected": 0,
-              "rewrittenFiles": [],
-              "skipped": [],
-              "warnings": [
-                {
-                  "code": "redirect_uv_lock_unsupported",
-                  "detail": "job.py.lock: urllib3 resolves to multiple versions; a global uv source would replace other versions, so marker-specific source mappings are required"
-                },
-                {
-                  "code": "redirect_uv_lock_unsupported",
-                  "detail": "job.py.lock: urllib3 resolves to multiple versions; a global uv source would replace other versions, so marker-specific source mappings are required"
-                }
-              ],
-              "dryRun": false
-            }
-          },
-          "stderr": "No SOCKET_API_TOKEN set (and no socket-cli login found) \u2014 using the public patch API proxy (free patches only). Run `socket login` or set SOCKET_API_TOKEN to access org patches.\nNon-interactive mode: auto-selecting first option.\nNon-interactive mode: auto-selecting first option.\n"
-        }
-      ]
-    },
-    {
-      "case": "script-vendored-refusal",
-      "kind": "script",
-      "mode": "vendored",
-      "filesByteIdentical": {
-        "job.py": true,
-        "job.py.lock": true
-      },
-      "commands": [
-        {
-          "command": [
-            "<uv-0.12.13>",
-            "venv",
-            ".venv",
-            "--python",
-            "/usr/bin/python3"
-          ],
-          "cwd": "<case>",
-          "key": "venv",
-          "exitCode": 0,
-          "stderr": "Using CPython 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtual environment at: .venv\nActivate with: source .venv/bin/activate\n"
-        },
-        {
-          "command": [
-            "<uv-0.12.13>",
-            "pip",
-            "install",
-            "--python",
-            "<case>/.venv/bin/python",
-            "<pristine-wheel>"
-          ],
-          "cwd": "<case>",
-          "key": "install-original",
-          "exitCode": 0,
-          "stderr": "Resolved 1 package in 1ms\nPrepared 1 package in 13ms\nInstalled 1 package in 1ms\n + urllib3==1.26.18 (from file://<pristine-wheel>)\n"
-        },
-        {
-          "command": [
-            "<socket-patch>",
-            "scan",
-            "--cwd",
-            "<case>",
-            "--mode",
-            "vendored",
-            "--json",
-            "--yes",
-            "--no-telemetry"
-          ],
-          "cwd": "<case>",
-          "key": "scan",
-          "exitCode": 1,
-          "cliResult": {
-            "status": "partial_failure",
-            "scannedPackages": 2,
-            "lockfileOnlyPackages": 1,
-            "vendor": {
-              "status": "partialFailure",
-              "events": [
-                {
-                  "action": "skipped",
-                  "purl": "pkg:pypi/urllib3@2.0.0?artifact_id=py3-none-any-whl",
-                  "reason": "pkg:pypi/urllib3@2.0.0?artifact_id=py3-none-any-whl is not installed; fetched the pristine artifact from https://files.pythonhosted.org/packages/ca/25/fe81738a115a2f1005b19bd69b6253b7b5cd6c9119164f13f02ec627fc41/urllib3-2.0.0-py3-none-any.whl (integrity verified) and vendored from that copy \u2014 the project tree was not touched",
-                  "errorCode": "vendor_fetched_missing"
-                },
-                {
-                  "action": "failed",
-                  "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-                  "errorCode": "pypi_lock_unsupported",
-                  "error": "job.py.lock: urllib3 resolves to multiple versions; a global uv source would replace other versions, so marker-specific source mappings are required"
-                },
-                {
-                  "action": "failed",
-                  "purl": "pkg:pypi/urllib3@2.0.0?artifact_id=py3-none-any-whl",
-                  "errorCode": "pypi_lock_unsupported",
-                  "error": "job.py.lock: urllib3 resolves to multiple versions; a global uv source would replace other versions, so marker-specific source mappings are required"
-                }
-              ],
-              "summary": {
-                "discovered": 0,
-                "downloaded": 0,
-                "applied": 0,
-                "updated": 0,
-                "skipped": 0,
-                "failed": 2,
-                "removed": 0,
-                "verified": 0
-              }
-            }
-          },
-          "stderr": "No SOCKET_API_TOKEN set (and no socket-cli login found) \u2014 using the public patch API proxy (free patches only). Run `socket login` or set SOCKET_API_TOKEN to access org patches.\nNon-interactive mode: auto-selecting first option.\nNon-interactive mode: auto-selecting first option.\nNo SOCKET_API_TOKEN set (and no socket-cli login found) \u2014 using the public patch API proxy (free patches only). Run `socket login` or set SOCKET_API_TOKEN to access org patches.\nNo SOCKET_API_TOKEN set (and no socket-cli login found) \u2014 using the public patch API proxy (free patches only). Run `socket login` or set SOCKET_API_TOKEN to access org patches.\nNo SOCKET_API_TOKEN set (and no socket-cli login found) \u2014 using the public patch API proxy (free patches only). Run `socket login` or set SOCKET_API_TOKEN to access org patches.\n"
-        }
-      ]
-    },
-    {
-      "case": "project-hosted-refusal",
-      "kind": "project",
-      "mode": "hosted",
-      "filesByteIdentical": {
-        "pyproject.toml": true,
-        "uv.lock": true
-      },
-      "commands": [
-        {
-          "command": [
-            "<uv-0.12.13>",
-            "lock",
-            "--python",
-            "/usr/bin/python3"
-          ],
-          "cwd": "<case>",
-          "key": "original-lock",
-          "exitCode": 0,
-          "stderr": "Using CPython 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nResolved 3 packages in 251ms\nwarning: `urllib3==2.0.0` is yanked (reason: \"Truncated response bodies when streaming a large compressed body. Upgrade to at least 2.0.2 (See: https://github.com/urllib3/urllib3/issues/3009)\")\n"
-        },
-        {
-          "command": [
-            "<uv-0.12.13>",
-            "venv",
-            ".venv",
-            "--python",
-            "/usr/bin/python3"
-          ],
-          "cwd": "<case>",
-          "key": "venv",
-          "exitCode": 0,
-          "stderr": "Using CPython 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtual environment at: .venv\nActivate with: source .venv/bin/activate\n"
-        },
-        {
-          "command": [
-            "<uv-0.12.13>",
-            "pip",
-            "install",
-            "--python",
-            "<case>/.venv/bin/python",
-            "<pristine-wheel>"
-          ],
-          "cwd": "<case>",
-          "key": "install-original",
-          "exitCode": 0,
-          "stderr": "Resolved 1 package in 0.79ms\nPrepared 1 package in 6ms\nInstalled 1 package in 1ms\n + urllib3==1.26.18 (from file://<pristine-wheel>)\n"
-        },
-        {
-          "command": [
-            "<socket-patch>",
-            "scan",
-            "--cwd",
-            "<case>",
-            "--mode",
-            "hosted",
-            "--json",
-            "--yes",
-            "--no-telemetry"
-          ],
-          "cwd": "<case>",
-          "key": "scan",
-          "exitCode": 0,
-          "cliResult": {
-            "status": "success",
-            "scannedPackages": 2,
-            "lockfileOnlyPackages": 1,
-            "redirect": {
-              "mode": "hosted",
-              "redirected": 0,
-              "rewrittenFiles": [],
-              "skipped": [],
-              "warnings": [
-                {
-                  "code": "redirect_uv_project_unsupported",
-                  "detail": "pyproject.toml: urllib3 resolves to multiple versions; a global uv source would replace other versions, so marker-specific source mappings are required"
-                },
-                {
-                  "code": "redirect_uv_project_unsupported",
-                  "detail": "pyproject.toml: urllib3 resolves to multiple versions; a global uv source would replace other versions, so marker-specific source mappings are required"
-                }
-              ],
-              "dryRun": false
-            }
-          },
-          "stderr": "No SOCKET_API_TOKEN set (and no socket-cli login found) \u2014 using the public patch API proxy (free patches only). Run `socket login` or set SOCKET_API_TOKEN to access org patches.\nNon-interactive mode: auto-selecting first option.\nNon-interactive mode: auto-selecting first option.\n"
-        }
-      ]
-    }
-  ]
-}
diff --git a/docs/testing/uv-compatibility/results.json b/docs/testing/uv-compatibility/results.json
deleted file mode 100644
index d3721766..00000000
--- a/docs/testing/uv-compatibility/results.json
+++ /dev/null
@@ -1,21810 +0,0 @@
-{
-  "date": "2026-09-15",
-  "scope": "42 pinned uv releases on macOS-26.6.2-arm64-arm-64bit-Mach-O; interpreter /usr/bin/python3",
-  "pythonVersion": "3.9.6",
-  "socketPatchRevision": "17d0dcb84bab1bec030117e0f111c7bfd893c2eb",
-  "socketPatchVersion": "socket-patch 4.0.0",
-  "socketPatchBinarySha256": "be7a0e3dd86d540b0dc038437410bec6042bcaad5ae8beba92fae23015b56548",
-  "patchUuid": "e828efa5-5c6d-43f3-9909-03f5ac232b98",
-  "originalWheelSha256": "34b97092d7e0a3a8cf7cd10e386f401b3737364026c45e622aa02903dffe0f07",
-  "patchedWheelSha256": "ccc9a9e0b18a5efc7038c504cfc580e47d2e02e5390f2e29cad833cbccb956b6",
-  "patchedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-  "commands": {
-    "lock": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "lock",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/original"
-    },
-    "requirements-hosted-socket-patch": {
-      "args": [
-        "<socket-patch>",
-        "scan",
-        "--cwd",
-        "<output>/matrix/<uv-version>/requirements-hosted",
-        "--mode",
-        "hosted",
-        "--json",
-        "--yes",
-        "--no-telemetry"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/requirements-hosted"
-    },
-    "requirements-hosted-pip-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "pip",
-        "sync",
-        "requirements.txt"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/requirements-hosted"
-    },
-    "requirements-vendored-socket-patch": {
-      "args": [
-        "<socket-patch>",
-        "scan",
-        "--cwd",
-        "<output>/matrix/<uv-version>/requirements-vendored",
-        "--mode",
-        "vendored",
-        "--json",
-        "--yes",
-        "--no-telemetry"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/requirements-vendored"
-    },
-    "requirements-vendored-pip-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "pip",
-        "sync",
-        "requirements.txt"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/requirements-vendored"
-    },
-    "compile-plain": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "pip",
-        "compile",
-        "requirements.in",
-        "-o",
-        "requirements.txt"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/requirements-plain-hosted"
-    },
-    "requirements-plain-hosted-socket-patch": {
-      "args": [
-        "<socket-patch>",
-        "scan",
-        "--cwd",
-        "<output>/matrix/<uv-version>/requirements-plain-hosted",
-        "--mode",
-        "hosted",
-        "--json",
-        "--yes",
-        "--no-telemetry"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/requirements-plain-hosted"
-    },
-    "requirements-plain-hosted-pip-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "pip",
-        "sync",
-        "requirements.txt"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/requirements-plain-hosted"
-    },
-    "compile-plain-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "pip",
-        "compile",
-        "requirements.in",
-        "-o",
-        "requirements.txt"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/requirements-plain-vendored"
-    },
-    "requirements-plain-vendored-socket-patch": {
-      "args": [
-        "<socket-patch>",
-        "scan",
-        "--cwd",
-        "<output>/matrix/<uv-version>/requirements-plain-vendored",
-        "--mode",
-        "vendored",
-        "--json",
-        "--yes",
-        "--no-telemetry"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/requirements-plain-vendored"
-    },
-    "requirements-plain-vendored-pip-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "pip",
-        "sync",
-        "requirements.txt"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/requirements-plain-vendored"
-    },
-    "script-lock-hosted": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "lock",
-        "--script",
-        "example.py",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/script-direct-hosted"
-    },
-    "script-lock-vendored": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "lock",
-        "--script",
-        "example.py",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/script-direct-vendored"
-    },
-    "compile-pylock-hosted": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "pip",
-        "compile",
-        "requirements.in",
-        "--python-version",
-        "3.9",
-        "-o",
-        "pylock.toml"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/pylock-direct-hosted"
-    },
-    "compile-pylock-vendored": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "pip",
-        "compile",
-        "requirements.in",
-        "--python-version",
-        "3.9",
-        "-o",
-        "pylock.toml"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/pylock-direct-vendored"
-    },
-    "project-hosted-socket-patch": {
-      "args": [
-        "<socket-patch>",
-        "scan",
-        "--cwd",
-        "<output>/matrix/<uv-version>/project-hosted",
-        "--mode",
-        "hosted",
-        "--json",
-        "--yes",
-        "--no-telemetry"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/project-hosted"
-    },
-    "project-hosted-export-requirements-txt": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "export",
-        "--frozen",
-        "--format",
-        "requirements-txt"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/project-hosted"
-    },
-    "project-hosted-export-pylock.toml": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "export",
-        "--frozen",
-        "--format",
-        "pylock.toml"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/project-hosted"
-    },
-    "project-hosted-lock-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/project-hosted"
-    },
-    "project-vendored-socket-patch": {
-      "args": [
-        "<socket-patch>",
-        "scan",
-        "--cwd",
-        "<output>/matrix/<uv-version>/project-vendored",
-        "--mode",
-        "vendored",
-        "--json",
-        "--yes",
-        "--no-telemetry"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/project-vendored"
-    },
-    "project-hosted-unfrozen-install": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/project-unfrozen-hosted"
-    },
-    "project-hosted-lock-sync-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--python",
-        "/usr/bin/python3",
-        "--frozen"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/project-hosted"
-    },
-    "project-hosted-locked-install": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--locked",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/project-unfrozen-hosted"
-    },
-    "project-vendored-export-requirements-txt": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "export",
-        "--frozen",
-        "--format",
-        "requirements-txt"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/project-vendored"
-    },
-    "project-vendored-export-pylock.toml": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "export",
-        "--frozen",
-        "--format",
-        "pylock.toml"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/project-vendored"
-    },
-    "project-vendored-lock-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--python",
-        "/usr/bin/python3",
-        "--frozen",
-        "--offline"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/project-vendored"
-    },
-    "project-vendored-frozen-sync-root-build-networked": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--frozen",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/project-vendored"
-    },
-    "project-vendored-locked-install": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--locked",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/project-unfrozen-vendored"
-    },
-    "project-vendored-unfrozen-install": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/project-unfrozen-vendored"
-    },
-    "variant-tool-uv-dev-hosted-lock": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "lock",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-tool-uv-dev-hosted"
-    },
-    "variant-tool-uv-dev-hosted-socket-patch": {
-      "args": [
-        "<socket-patch>",
-        "scan",
-        "--cwd",
-        "<output>/matrix/<uv-version>/variant-tool-uv-dev-hosted",
-        "--mode",
-        "hosted",
-        "--json",
-        "--yes",
-        "--no-telemetry"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-tool-uv-dev-hosted"
-    },
-    "variant-tool-uv-dev-hosted-frozen-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--frozen",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-tool-uv-dev-hosted"
-    },
-    "variant-tool-uv-dev-hosted-locked-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--locked",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-tool-uv-dev-hosted"
-    },
-    "variant-tool-uv-dev-hosted-plain-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-tool-uv-dev-hosted"
-    },
-    "variant-tool-uv-dev-vendored-lock": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "lock",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-tool-uv-dev-vendored"
-    },
-    "variant-tool-uv-dev-vendored-socket-patch": {
-      "args": [
-        "<socket-patch>",
-        "scan",
-        "--cwd",
-        "<output>/matrix/<uv-version>/variant-tool-uv-dev-vendored",
-        "--mode",
-        "vendored",
-        "--json",
-        "--yes",
-        "--no-telemetry"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-tool-uv-dev-vendored"
-    },
-    "variant-tool-uv-dev-vendored-frozen-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--frozen",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-tool-uv-dev-vendored"
-    },
-    "variant-tool-uv-dev-vendored-locked-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--locked",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-tool-uv-dev-vendored"
-    },
-    "variant-tool-uv-dev-vendored-plain-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-tool-uv-dev-vendored"
-    },
-    "variant-dependency-groups-hosted-lock": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "lock",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-dependency-groups-hosted"
-    },
-    "variant-dependency-groups-vendored-lock": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "lock",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-dependency-groups-vendored"
-    },
-    "variant-extras-duplicate-hosted-lock": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "lock",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-extras-duplicate-hosted"
-    },
-    "variant-extras-duplicate-hosted-socket-patch": {
-      "args": [
-        "<socket-patch>",
-        "scan",
-        "--cwd",
-        "<output>/matrix/<uv-version>/variant-extras-duplicate-hosted",
-        "--mode",
-        "hosted",
-        "--json",
-        "--yes",
-        "--no-telemetry"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-extras-duplicate-hosted"
-    },
-    "variant-extras-duplicate-hosted-frozen-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--frozen",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-extras-duplicate-hosted"
-    },
-    "variant-extras-duplicate-hosted-locked-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--locked",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-extras-duplicate-hosted"
-    },
-    "variant-extras-duplicate-hosted-plain-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-extras-duplicate-hosted"
-    },
-    "variant-extras-duplicate-vendored-lock": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "lock",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-extras-duplicate-vendored"
-    },
-    "variant-extras-duplicate-vendored-socket-patch": {
-      "args": [
-        "<socket-patch>",
-        "scan",
-        "--cwd",
-        "<output>/matrix/<uv-version>/variant-extras-duplicate-vendored",
-        "--mode",
-        "vendored",
-        "--json",
-        "--yes",
-        "--no-telemetry"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-extras-duplicate-vendored"
-    },
-    "variant-extras-duplicate-vendored-frozen-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--frozen",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-extras-duplicate-vendored"
-    },
-    "variant-extras-duplicate-vendored-locked-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--locked",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-extras-duplicate-vendored"
-    },
-    "variant-extras-duplicate-vendored-plain-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-extras-duplicate-vendored"
-    },
-    "variant-constraints-hosted-lock": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "lock",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-constraints-hosted"
-    },
-    "variant-constraints-vendored-lock": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "lock",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-constraints-vendored"
-    },
-    "variant-transitive-hosted-lock": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "lock",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-transitive-hosted"
-    },
-    "variant-transitive-hosted-socket-patch": {
-      "args": [
-        "<socket-patch>",
-        "scan",
-        "--cwd",
-        "<output>/matrix/<uv-version>/variant-transitive-hosted",
-        "--mode",
-        "hosted",
-        "--json",
-        "--yes",
-        "--no-telemetry"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-transitive-hosted"
-    },
-    "variant-transitive-hosted-frozen-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--frozen",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-transitive-hosted"
-    },
-    "variant-transitive-hosted-locked-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--locked",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-transitive-hosted"
-    },
-    "variant-transitive-hosted-plain-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-transitive-hosted"
-    },
-    "variant-transitive-vendored-lock": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "lock",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-transitive-vendored"
-    },
-    "variant-transitive-vendored-socket-patch": {
-      "args": [
-        "<socket-patch>",
-        "scan",
-        "--cwd",
-        "<output>/matrix/<uv-version>/variant-transitive-vendored",
-        "--mode",
-        "vendored",
-        "--json",
-        "--yes",
-        "--no-telemetry"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-transitive-vendored"
-    },
-    "variant-transitive-vendored-frozen-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--frozen",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-transitive-vendored"
-    },
-    "variant-transitive-vendored-locked-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--locked",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-transitive-vendored"
-    },
-    "variant-transitive-vendored-plain-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-transitive-vendored"
-    },
-    "variant-constraints-hosted-socket-patch": {
-      "args": [
-        "<socket-patch>",
-        "scan",
-        "--cwd",
-        "<output>/matrix/<uv-version>/variant-constraints-hosted",
-        "--mode",
-        "hosted",
-        "--json",
-        "--yes",
-        "--no-telemetry"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-constraints-hosted"
-    },
-    "variant-constraints-hosted-frozen-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--frozen",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-constraints-hosted"
-    },
-    "variant-constraints-hosted-locked-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--locked",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-constraints-hosted"
-    },
-    "variant-constraints-hosted-plain-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-constraints-hosted"
-    },
-    "variant-constraints-vendored-socket-patch": {
-      "args": [
-        "<socket-patch>",
-        "scan",
-        "--cwd",
-        "<output>/matrix/<uv-version>/variant-constraints-vendored",
-        "--mode",
-        "vendored",
-        "--json",
-        "--yes",
-        "--no-telemetry"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-constraints-vendored"
-    },
-    "variant-constraints-vendored-frozen-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--frozen",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-constraints-vendored"
-    },
-    "variant-constraints-vendored-locked-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--locked",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-constraints-vendored"
-    },
-    "variant-constraints-vendored-plain-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--python",
-        "/usr/bin/python3"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-constraints-vendored"
-    },
-    "project-hosted-lock-sync-variant-3": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--python",
-        "/usr/bin/python3",
-        "--frozen",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/project-hosted"
-    },
-    "project-vendored-lock-sync-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--python",
-        "/usr/bin/python3",
-        "--frozen",
-        "--no-install-project",
-        "--offline"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/project-vendored"
-    },
-    "project-hosted-locked-install-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--locked",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/project-unfrozen-hosted"
-    },
-    "project-hosted-unfrozen-install-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/project-unfrozen-hosted"
-    },
-    "project-vendored-locked-install-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--locked",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/project-unfrozen-vendored"
-    },
-    "project-vendored-unfrozen-install-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/project-unfrozen-vendored"
-    },
-    "variant-tool-uv-dev-hosted-frozen-sync-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--frozen",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-tool-uv-dev-hosted"
-    },
-    "variant-tool-uv-dev-hosted-locked-sync-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--locked",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-tool-uv-dev-hosted"
-    },
-    "variant-tool-uv-dev-hosted-plain-sync-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-tool-uv-dev-hosted"
-    },
-    "variant-tool-uv-dev-vendored-frozen-sync-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--frozen",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-tool-uv-dev-vendored"
-    },
-    "variant-tool-uv-dev-vendored-locked-sync-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--locked",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-tool-uv-dev-vendored"
-    },
-    "variant-tool-uv-dev-vendored-plain-sync-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-tool-uv-dev-vendored"
-    },
-    "variant-extras-duplicate-hosted-frozen-sync-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--frozen",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-extras-duplicate-hosted"
-    },
-    "variant-extras-duplicate-hosted-locked-sync-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--locked",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-extras-duplicate-hosted"
-    },
-    "variant-extras-duplicate-hosted-plain-sync-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-extras-duplicate-hosted"
-    },
-    "variant-extras-duplicate-vendored-frozen-sync-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--frozen",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-extras-duplicate-vendored"
-    },
-    "variant-extras-duplicate-vendored-locked-sync-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--locked",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-extras-duplicate-vendored"
-    },
-    "variant-extras-duplicate-vendored-plain-sync-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-extras-duplicate-vendored"
-    },
-    "variant-constraints-hosted-frozen-sync-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--frozen",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-constraints-hosted"
-    },
-    "variant-constraints-hosted-locked-sync-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--locked",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-constraints-hosted"
-    },
-    "variant-constraints-hosted-plain-sync-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-constraints-hosted"
-    },
-    "variant-constraints-vendored-frozen-sync-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--frozen",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-constraints-vendored"
-    },
-    "variant-constraints-vendored-locked-sync-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--locked",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-constraints-vendored"
-    },
-    "variant-constraints-vendored-plain-sync-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-constraints-vendored"
-    },
-    "variant-transitive-hosted-frozen-sync-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--frozen",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-transitive-hosted"
-    },
-    "variant-transitive-hosted-locked-sync-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--locked",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-transitive-hosted"
-    },
-    "variant-transitive-hosted-plain-sync-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-transitive-hosted"
-    },
-    "variant-transitive-vendored-frozen-sync-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--frozen",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-transitive-vendored"
-    },
-    "variant-transitive-vendored-locked-sync-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--locked",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-transitive-vendored"
-    },
-    "variant-transitive-vendored-plain-sync-variant-2": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-transitive-vendored"
-    },
-    "requirements-hosted-export-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "pip",
-        "sync",
-        "requirements.txt"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/export-requirements-hosted"
-    },
-    "requirements-vendored-export-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "pip",
-        "sync",
-        "requirements.txt",
-        "--offline"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/export-requirements-vendored"
-    },
-    "variant-dependency-groups-hosted-socket-patch": {
-      "args": [
-        "<socket-patch>",
-        "scan",
-        "--cwd",
-        "<output>/matrix/<uv-version>/variant-dependency-groups-hosted",
-        "--mode",
-        "hosted",
-        "--json",
-        "--yes",
-        "--no-telemetry"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-dependency-groups-hosted"
-    },
-    "variant-dependency-groups-hosted-frozen-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--frozen",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-dependency-groups-hosted"
-    },
-    "variant-dependency-groups-hosted-locked-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--locked",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-dependency-groups-hosted"
-    },
-    "variant-dependency-groups-hosted-plain-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-dependency-groups-hosted"
-    },
-    "variant-dependency-groups-vendored-socket-patch": {
-      "args": [
-        "<socket-patch>",
-        "scan",
-        "--cwd",
-        "<output>/matrix/<uv-version>/variant-dependency-groups-vendored",
-        "--mode",
-        "vendored",
-        "--json",
-        "--yes",
-        "--no-telemetry"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-dependency-groups-vendored"
-    },
-    "variant-dependency-groups-vendored-frozen-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--frozen",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-dependency-groups-vendored"
-    },
-    "variant-dependency-groups-vendored-locked-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--locked",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-dependency-groups-vendored"
-    },
-    "variant-dependency-groups-vendored-plain-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "sync",
-        "--python",
-        "/usr/bin/python3",
-        "--no-install-project"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/variant-dependency-groups-vendored"
-    },
-    "script-direct-hosted-socket-patch": {
-      "args": [
-        "<socket-patch>",
-        "scan",
-        "--cwd",
-        "<output>/matrix/<uv-version>/script-direct-hosted",
-        "--mode",
-        "hosted",
-        "--json",
-        "--yes",
-        "--no-telemetry"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/script-direct-hosted"
-    },
-    "script-direct-hosted-install": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "run",
-        "--frozen",
-        "--python",
-        "/usr/bin/python3",
-        "--script",
-        "example.py"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/script-direct-hosted"
-    },
-    "script-direct-vendored-socket-patch": {
-      "args": [
-        "<socket-patch>",
-        "scan",
-        "--cwd",
-        "<output>/matrix/<uv-version>/script-direct-vendored",
-        "--mode",
-        "vendored",
-        "--json",
-        "--yes",
-        "--no-telemetry"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/script-direct-vendored"
-    },
-    "script-direct-vendored-install": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "run",
-        "--offline",
-        "--frozen",
-        "--python",
-        "/usr/bin/python3",
-        "--script",
-        "example.py"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/script-direct-vendored"
-    },
-    "script-hosted-locked-install": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "run",
-        "--locked",
-        "--python",
-        "/usr/bin/python3",
-        "--script",
-        "example.py"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/script-unfrozen-hosted"
-    },
-    "script-hosted-unfrozen-install": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "run",
-        "--python",
-        "/usr/bin/python3",
-        "--script",
-        "example.py"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/script-unfrozen-hosted"
-    },
-    "script-vendored-locked-install": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "run",
-        "--locked",
-        "--python",
-        "/usr/bin/python3",
-        "--script",
-        "example.py"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/script-unfrozen-vendored"
-    },
-    "script-vendored-unfrozen-install": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "run",
-        "--python",
-        "/usr/bin/python3",
-        "--script",
-        "example.py"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/script-unfrozen-vendored"
-    },
-    "pylock-hosted-export-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "pip",
-        "sync",
-        "pylock.toml"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/export-pylock-hosted"
-    },
-    "pylock-vendored-export-sync": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "pip",
-        "sync",
-        "pylock.toml",
-        "--offline"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/export-pylock-vendored"
-    },
-    "pylock-direct-hosted-socket-patch": {
-      "args": [
-        "<socket-patch>",
-        "scan",
-        "--cwd",
-        "<output>/matrix/<uv-version>/pylock-direct-hosted",
-        "--mode",
-        "hosted",
-        "--json",
-        "--yes",
-        "--no-telemetry"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/pylock-direct-hosted"
-    },
-    "pylock-direct-hosted-install": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "pip",
-        "sync",
-        "pylock.toml"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/pylock-direct-hosted"
-    },
-    "pylock-direct-vendored-socket-patch": {
-      "args": [
-        "<socket-patch>",
-        "scan",
-        "--cwd",
-        "<output>/matrix/<uv-version>/pylock-direct-vendored",
-        "--mode",
-        "vendored",
-        "--json",
-        "--yes",
-        "--no-telemetry"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/pylock-direct-vendored"
-    },
-    "pylock-direct-vendored-install": {
-      "args": [
-        "<output>/bin/<uv-version>/uv",
-        "pip",
-        "--offline",
-        "sync",
-        "pylock.toml"
-      ],
-      "cwd": "<output>/matrix/<uv-version>/pylock-direct-vendored"
-    }
-  },
-  "versions": [
-    {
-      "version": "0.0.5",
-      "lockSchema": null,
-      "lockVersion": null,
-      "lockRevision": null,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": null,
-          "vendored": null
-        },
-        "dependency-groups": {
-          "hosted": null,
-          "vendored": null
-        },
-        "extras-duplicate": {
-          "hosted": null,
-          "vendored": null
-        },
-        "constraints": {
-          "hosted": null,
-          "vendored": null
-        },
-        "transitive": {
-          "hosted": null,
-          "vendored": null
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'lock'\n\n  tip: a similar subcommand exists: 'uv pip compile'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 2,
-          "diagnostic": "error: Unexpected '.', expected '-c', '-e', '-r' or the start of a requirement in `requirements.txt` at position 144\n"
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 2,
-          "diagnostic": "error: Unexpected '.', expected '-c', '-e', '-r' or the start of a requirement in `requirements.txt` at position 126\n"
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'lock'\n\n  tip: a similar subcommand exists: 'uv pip compile'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'lock'\n\n  tip: a similar subcommand exists: 'uv pip compile'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": false
-        }
-      ]
-    },
-    {
-      "version": "0.1.0",
-      "lockSchema": null,
-      "lockVersion": null,
-      "lockRevision": null,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": null,
-          "vendored": null
-        },
-        "dependency-groups": {
-          "hosted": null,
-          "vendored": null
-        },
-        "extras-duplicate": {
-          "hosted": null,
-          "vendored": null
-        },
-        "constraints": {
-          "hosted": null,
-          "vendored": null
-        },
-        "transitive": {
-          "hosted": null,
-          "vendored": null
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'lock'\n\n  tip: a similar subcommand exists: 'uv pip compile'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 2,
-          "diagnostic": "error: Unexpected '.', expected '-c', '-e', '-r' or the start of a requirement in `requirements.txt` at position 144\n"
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 2,
-          "diagnostic": "error: Unexpected '.', expected '-c', '-e', '-r' or the start of a requirement in `requirements.txt` at position 126\n"
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'lock'\n\n  tip: a similar subcommand exists: 'uv pip compile'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'lock'\n\n  tip: a similar subcommand exists: 'uv pip compile'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": false
-        }
-      ]
-    },
-    {
-      "version": "0.1.23",
-      "lockSchema": null,
-      "lockVersion": null,
-      "lockRevision": null,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": null,
-          "vendored": null
-        },
-        "dependency-groups": {
-          "hosted": null,
-          "vendored": null
-        },
-        "extras-duplicate": {
-          "hosted": null,
-          "vendored": null
-        },
-        "constraints": {
-          "hosted": null,
-          "vendored": null
-        },
-        "transitive": {
-          "hosted": null,
-          "vendored": null
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'lock'\n\n  tip: a similar subcommand exists: 'uv pip compile'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 2,
-          "diagnostic": "error: Unexpected '.', expected '-c', '-e', '-r' or the start of a requirement at requirements.txt:3:1\n"
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 2,
-          "diagnostic": "error: Unexpected '.', expected '-c', '-e', '-r' or the start of a requirement at requirements.txt:3:1\n"
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'lock'\n\n  tip: a similar subcommand exists: 'uv pip compile'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'lock'\n\n  tip: a similar subcommand exists: 'uv pip compile'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": false
-        }
-      ]
-    },
-    {
-      "version": "0.1.24",
-      "lockSchema": null,
-      "lockVersion": null,
-      "lockRevision": null,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": null,
-          "vendored": null
-        },
-        "dependency-groups": {
-          "hosted": null,
-          "vendored": null
-        },
-        "extras-duplicate": {
-          "hosted": null,
-          "vendored": null
-        },
-        "constraints": {
-          "hosted": null,
-          "vendored": null
-        },
-        "transitive": {
-          "hosted": null,
-          "vendored": null
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'lock'\n\n  tip: a similar subcommand exists: 'uv pip compile'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'lock'\n\n  tip: a similar subcommand exists: 'uv pip compile'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'lock'\n\n  tip: a similar subcommand exists: 'uv pip compile'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": false
-        }
-      ]
-    },
-    {
-      "version": "0.1.44",
-      "lockSchema": null,
-      "lockVersion": null,
-      "lockRevision": null,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": null,
-          "vendored": null
-        },
-        "dependency-groups": {
-          "hosted": null,
-          "vendored": null
-        },
-        "extras-duplicate": {
-          "hosted": null,
-          "vendored": null
-        },
-        "constraints": {
-          "hosted": null,
-          "vendored": null
-        },
-        "transitive": {
-          "hosted": null,
-          "vendored": null
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 101,
-          "diagnostic": "warning: `uv lock` is experimental and may change without warning.\nUsing Python 3.14.3 interpreter at: /opt/homebrew/opt/python@3.14/bin/python3.14\nCreating virtualenv at: .venv\nResolved 2 packages in 538ms\nthread 'main' panicked at crates/uv-resolver/src/lock.rs:304:40:\nnot yet implemented\nnote: run with `RUST_BACKTRACE=1` environment variable to display a backtrace\n"
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": false
-        }
-      ]
-    },
-    {
-      "version": "0.1.45",
-      "lockSchema": "distribution",
-      "lockVersion": 1,
-      "lockRevision": null,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": null,
-          "vendored": null
-        },
-        "dependency-groups": {
-          "hosted": null,
-          "vendored": null
-        },
-        "extras-duplicate": {
-          "hosted": null,
-          "vendored": null
-        },
-        "constraints": {
-          "hosted": null,
-          "vendored": null
-        },
-        "transitive": {
-          "hosted": null,
-          "vendored": null
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-lock-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 1,
-          "vendorSummary": {
-            "applied": 0,
-            "failed": 1
-          },
-          "vendorErrors": [
-            {
-              "action": "failed",
-              "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-              "errorCode": "pypi_uv_legacy_lock_unsupported",
-              "error": "uv `[[distribution]]` lockfiles (uv < 0.2.35, experimental `uv lock`) cannot carry a portable local wheel: `--locked` rejects relative paths and `uv lock`/`uv sync` rewrite them to absolute ones; upgrade to uv >=0.2.35 for native vendoring, or use a requirements.txt installation"
-            }
-          ]
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "project-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        }
-      ]
-    },
-    {
-      "version": "0.2.0",
-      "lockSchema": "distribution",
-      "lockVersion": 1,
-      "lockRevision": null,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": null,
-          "vendored": null
-        },
-        "dependency-groups": {
-          "hosted": null,
-          "vendored": null
-        },
-        "extras-duplicate": {
-          "hosted": null,
-          "vendored": null
-        },
-        "constraints": {
-          "hosted": null,
-          "vendored": null
-        },
-        "transitive": {
-          "hosted": null,
-          "vendored": null
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-lock-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 1,
-          "vendorSummary": {
-            "applied": 0,
-            "failed": 1
-          },
-          "vendorErrors": [
-            {
-              "action": "failed",
-              "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-              "errorCode": "pypi_uv_legacy_lock_unsupported",
-              "error": "uv `[[distribution]]` lockfiles (uv < 0.2.35, experimental `uv lock`) cannot carry a portable local wheel: `--locked` rejects relative paths and `uv lock`/`uv sync` rewrite them to absolute ones; upgrade to uv >=0.2.35 for native vendoring, or use a requirements.txt installation"
-            }
-          ]
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "project-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        }
-      ]
-    },
-    {
-      "version": "0.2.5",
-      "lockSchema": "distribution",
-      "lockVersion": 1,
-      "lockRevision": null,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": null,
-          "vendored": null
-        },
-        "dependency-groups": {
-          "hosted": null,
-          "vendored": null
-        },
-        "extras-duplicate": {
-          "hosted": null,
-          "vendored": null
-        },
-        "constraints": {
-          "hosted": null,
-          "vendored": null
-        },
-        "transitive": {
-          "hosted": null,
-          "vendored": null
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-lock-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 1,
-          "vendorSummary": {
-            "applied": 0,
-            "failed": 1
-          },
-          "vendorErrors": [
-            {
-              "action": "failed",
-              "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-              "errorCode": "pypi_uv_legacy_lock_unsupported",
-              "error": "uv `[[distribution]]` lockfiles (uv < 0.2.35, experimental `uv lock`) cannot carry a portable local wheel: `--locked` rejects relative paths and `uv lock`/`uv sync` rewrite them to absolute ones; upgrade to uv >=0.2.35 for native vendoring, or use a requirements.txt installation"
-            }
-          ]
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "project-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        }
-      ]
-    },
-    {
-      "version": "0.2.6",
-      "lockSchema": "distribution",
-      "lockVersion": 1,
-      "lockRevision": null,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": null,
-          "vendored": null
-        },
-        "dependency-groups": {
-          "hosted": null,
-          "vendored": null
-        },
-        "extras-duplicate": {
-          "hosted": null,
-          "vendored": null
-        },
-        "constraints": {
-          "hosted": null,
-          "vendored": null
-        },
-        "transitive": {
-          "hosted": null,
-          "vendored": null
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-lock-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 1,
-          "vendorSummary": {
-            "applied": 0,
-            "failed": 1
-          },
-          "vendorErrors": [
-            {
-              "action": "failed",
-              "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-              "errorCode": "pypi_uv_legacy_lock_unsupported",
-              "error": "uv `[[distribution]]` lockfiles (uv < 0.2.35, experimental `uv lock`) cannot carry a portable local wheel: `--locked` rejects relative paths and `uv lock`/`uv sync` rewrite them to absolute ones; upgrade to uv >=0.2.35 for native vendoring, or use a requirements.txt installation"
-            }
-          ]
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "project-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        }
-      ]
-    },
-    {
-      "version": "0.2.17",
-      "lockSchema": "distribution",
-      "lockVersion": 1,
-      "lockRevision": null,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": null,
-          "vendored": null
-        },
-        "dependency-groups": {
-          "hosted": null,
-          "vendored": null
-        },
-        "extras-duplicate": {
-          "hosted": null,
-          "vendored": null
-        },
-        "constraints": {
-          "hosted": null,
-          "vendored": null
-        },
-        "transitive": {
-          "hosted": null,
-          "vendored": null
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-lock-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 1,
-          "vendorSummary": {
-            "applied": 0,
-            "failed": 1
-          },
-          "vendorErrors": [
-            {
-              "action": "failed",
-              "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-              "errorCode": "pypi_uv_legacy_lock_unsupported",
-              "error": "uv `[[distribution]]` lockfiles (uv < 0.2.35, experimental `uv lock`) cannot carry a portable local wheel: `--locked` rejects relative paths and `uv lock`/`uv sync` rewrite them to absolute ones; upgrade to uv >=0.2.35 for native vendoring, or use a requirements.txt installation"
-            }
-          ]
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "project-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        }
-      ]
-    },
-    {
-      "version": "0.2.18",
-      "lockSchema": "distribution",
-      "lockVersion": 1,
-      "lockRevision": null,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": null,
-          "vendored": null
-        },
-        "dependency-groups": {
-          "hosted": null,
-          "vendored": null
-        },
-        "extras-duplicate": {
-          "hosted": null,
-          "vendored": null
-        },
-        "constraints": {
-          "hosted": null,
-          "vendored": null
-        },
-        "transitive": {
-          "hosted": null,
-          "vendored": null
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-lock-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 1,
-          "vendorSummary": {
-            "applied": 0,
-            "failed": 1
-          },
-          "vendorErrors": [
-            {
-              "action": "failed",
-              "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-              "errorCode": "pypi_uv_legacy_lock_unsupported",
-              "error": "uv `[[distribution]]` lockfiles (uv < 0.2.35, experimental `uv lock`) cannot carry a portable local wheel: `--locked` rejects relative paths and `uv lock`/`uv sync` rewrite them to absolute ones; upgrade to uv >=0.2.35 for native vendoring, or use a requirements.txt installation"
-            }
-          ]
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "project-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        }
-      ]
-    },
-    {
-      "version": "0.2.34",
-      "lockSchema": "distribution",
-      "lockVersion": 1,
-      "lockRevision": null,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": null,
-          "vendored": null
-        },
-        "dependency-groups": {
-          "hosted": null,
-          "vendored": null
-        },
-        "extras-duplicate": {
-          "hosted": null,
-          "vendored": null
-        },
-        "constraints": {
-          "hosted": null,
-          "vendored": null
-        },
-        "transitive": {
-          "hosted": null,
-          "vendored": null
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 1,
-          "vendorSummary": {
-            "applied": 0,
-            "failed": 1
-          },
-          "vendorErrors": [
-            {
-              "action": "failed",
-              "purl": "pkg:pypi/urllib3@1.26.18?artifact_id=py2-py3-none-any-whl",
-              "errorCode": "pypi_uv_legacy_lock_unsupported",
-              "error": "uv `[[distribution]]` lockfiles (uv < 0.2.35, experimental `uv lock`) cannot carry a portable local wheel: `--locked` rejects relative paths and `uv lock`/`uv sync` rewrite them to absolute ones; upgrade to uv >=0.2.35 for native vendoring, or use a requirements.txt installation"
-            }
-          ]
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "project-hosted-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        }
-      ]
-    },
-    {
-      "version": "0.2.35",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": null,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "unsupported",
-          "vendored": "unsupported"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": "unsupported",
-          "vendored": "unsupported"
-        },
-        "transitive": {
-          "hosted": [
-            "fail",
-            [
-              "locked",
-              "plain"
-            ]
-          ],
-          "vendored": [
-            "fail",
-            [
-              "locked",
-              "plain"
-            ]
-          ]
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-vendored-lock-sync",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "warning: `uv sync` is experimental and may change without warning\nUsing Python 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtualenv at: .venv\nerror: Failed to prepare distributions\n  Caused by: Failed to fetch wheel: socket-uv-patch-fixture @ file://<output>/matrix/0.2.35/project-vendored\n  Caused by: Failed to build: `socket-uv-patch-fixture @ file://<output>/matrix/0.2.35/project-vendored`\n  Caused by: Failed to install requirements from setup.py build (resolve)\n  Caused by: No solution found when resolving: setuptools>=40.8.0\n  Caused by: Because setuptools was not found in the cache and you require setuptools>=40.8.0, we can conclude that the requirements are unsatisfiable.\n\nhint: Packages were unavailable because the network was disabled\n"
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-frozen-sync-root-build-networked",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "project-hosted-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "warning: `uv sync` is experimental and may change without warning\nUsing Python 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtualenv at: .venv\nResolved 6 packages in 194ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "50f80b9a71e3e33ef56671fc8af60eca77004e27d33b0f4542e914a839dc9027",
-          "installedPatch": false
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "warning: `uv sync` is experimental and may change without warning\nUsing Python 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtualenv at: .venv\nResolved 6 packages in 334ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "50f80b9a71e3e33ef56671fc8af60eca77004e27d33b0f4542e914a839dc9027",
-          "installedPatch": false
-        }
-      ]
-    },
-    {
-      "version": "0.2.36",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": null,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "unsupported",
-          "vendored": "unsupported"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": "unsupported",
-          "vendored": "unsupported"
-        },
-        "transitive": {
-          "hosted": [
-            "fail",
-            [
-              "locked",
-              "plain"
-            ]
-          ],
-          "vendored": [
-            "fail",
-            [
-              "locked",
-              "plain"
-            ]
-          ]
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-vendored-lock-sync",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "warning: `uv sync` is experimental and may change without warning\nUsing Python 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtualenv at: .venv\nerror: Failed to prepare distributions\n  Caused by: Failed to fetch wheel: socket-uv-patch-fixture @ file://<output>/matrix/0.2.36/project-vendored\n  Caused by: Failed to build: `socket-uv-patch-fixture @ file://<output>/matrix/0.2.36/project-vendored`\n  Caused by: Failed to install requirements from setup.py build (resolve)\n  Caused by: No solution found when resolving: setuptools>=40.8.0\n  Caused by: Because setuptools was not found in the cache and you require setuptools>=40.8.0, we can conclude that the requirements are unsatisfiable.\n\nhint: Packages were unavailable because the network was disabled\n"
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-frozen-sync-root-build-networked",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "project-hosted-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "warning: `uv sync` is experimental and may change without warning\nUsing Python 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtualenv at: .venv\nResolved 6 packages in 339ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "50f80b9a71e3e33ef56671fc8af60eca77004e27d33b0f4542e914a839dc9027",
-          "installedPatch": false
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "warning: `uv sync` is experimental and may change without warning\nUsing Python 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtualenv at: .venv\nResolved 6 packages in 211ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "50f80b9a71e3e33ef56671fc8af60eca77004e27d33b0f4542e914a839dc9027",
-          "installedPatch": false
-        }
-      ]
-    },
-    {
-      "version": "0.2.37",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": null,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "unsupported",
-          "vendored": "unsupported"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": [
-            "fail",
-            [
-              "locked"
-            ]
-          ],
-          "vendored": [
-            "fail",
-            [
-              "locked"
-            ]
-          ]
-        },
-        "transitive": {
-          "hosted": [
-            "fail",
-            [
-              "locked",
-              "plain"
-            ]
-          ],
-          "vendored": [
-            "fail",
-            [
-              "locked",
-              "plain"
-            ]
-          ]
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-vendored-lock-sync",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "warning: `uv sync` is experimental and may change without warning\nUsing Python 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtualenv at: .venv\nerror: Failed to prepare distributions\n  Caused by: Failed to fetch wheel: socket-uv-patch-fixture @ file://<output>/matrix/0.2.37/project-vendored\n  Caused by: Failed to install requirements from setup.py build (resolve)\n  Caused by: No solution found when resolving: setuptools>=40.8.0\n  Caused by: Because setuptools was not found in the cache and you require setuptools>=40.8.0, we can conclude that your requirements are unsatisfiable.\n\nhint: Packages were unavailable because the network was disabled\n"
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-frozen-sync-root-build-networked",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "project-hosted-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-constraints-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-locked-sync",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "warning: `uv sync` is experimental and may change without warning\nUsing Python 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtualenv at: .venv\nwarning: `uv.sources` is experimental and may change without warning\nResolved 2 packages in 7ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-constraints-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-constraints-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-locked-sync",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "warning: `uv sync` is experimental and may change without warning\nUsing Python 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtualenv at: .venv\nwarning: `uv.sources` is experimental and may change without warning\nResolved 2 packages in 3ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-constraints-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "warning: `uv sync` is experimental and may change without warning\nUsing Python 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtualenv at: .venv\nResolved 6 packages in 349ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "50f80b9a71e3e33ef56671fc8af60eca77004e27d33b0f4542e914a839dc9027",
-          "installedPatch": false
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "warning: `uv sync` is experimental and may change without warning\nUsing Python 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtualenv at: .venv\nResolved 6 packages in 539ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "50f80b9a71e3e33ef56671fc8af60eca77004e27d33b0f4542e914a839dc9027",
-          "installedPatch": false
-        }
-      ]
-    },
-    {
-      "version": "0.3.0",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": null,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "unsupported",
-          "vendored": "unsupported"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": [
-            "fail",
-            [
-              "locked"
-            ]
-          ],
-          "vendored": [
-            "fail",
-            [
-              "locked"
-            ]
-          ]
-        },
-        "transitive": {
-          "hosted": [
-            "fail",
-            [
-              "locked",
-              "plain"
-            ]
-          ],
-          "vendored": [
-            "fail",
-            [
-              "locked",
-              "plain"
-            ]
-          ]
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-vendored-lock-sync",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "Using Python 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtualenv at: .venv\nerror: Failed to prepare distributions\n  Caused by: Failed to fetch wheel: socket-uv-patch-fixture @ file://<output>/matrix/0.3.0/project-vendored\n  Caused by: Failed to install requirements from setup.py build (resolve)\n  Caused by: No solution found when resolving: setuptools>=40.8.0\n  Caused by: Because setuptools was not found in the cache and you require setuptools>=40.8.0, we can conclude that your requirements are unsatisfiable.\n\nhint: Packages were unavailable because the network was disabled. When the network is disabled, registry packages may only be read from the cache.\n"
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-frozen-sync-root-build-networked",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "project-hosted-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-constraints-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-locked-sync",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "Using Python 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtualenv at: .venv\nResolved 2 packages in 5ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-constraints-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-constraints-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-locked-sync",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "Using Python 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtualenv at: .venv\nResolved 2 packages in 6ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-constraints-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "Using Python 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtualenv at: .venv\nResolved 6 packages in 642ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "50f80b9a71e3e33ef56671fc8af60eca77004e27d33b0f4542e914a839dc9027",
-          "installedPatch": false
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "Using Python 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtualenv at: .venv\nResolved 6 packages in 347ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "50f80b9a71e3e33ef56671fc8af60eca77004e27d33b0f4542e914a839dc9027",
-          "installedPatch": false
-        }
-      ]
-    },
-    {
-      "version": "0.3.5",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": null,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "unsupported",
-          "vendored": "unsupported"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": [
-            "fail",
-            [
-              "locked"
-            ]
-          ],
-          "vendored": [
-            "fail",
-            [
-              "locked"
-            ]
-          ]
-        },
-        "transitive": {
-          "hosted": [
-            "fail",
-            [
-              "locked",
-              "plain"
-            ]
-          ],
-          "vendored": [
-            "fail",
-            [
-              "locked",
-              "plain"
-            ]
-          ]
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-3",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-vendored-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "project-hosted-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-constraints-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-locked-sync-variant-2",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "Using Python 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtualenv at: .venv\nResolved 2 packages in 5ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-constraints-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-constraints-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-locked-sync-variant-2",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "Using Python 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtualenv at: .venv\nResolved 2 packages in 4ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-constraints-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync-variant-2",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "Using Python 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtualenv at: .venv\nResolved 6 packages in 700ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "50f80b9a71e3e33ef56671fc8af60eca77004e27d33b0f4542e914a839dc9027",
-          "installedPatch": false
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync-variant-2",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "Using Python 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtualenv at: .venv\nResolved 6 packages in 777ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "50f80b9a71e3e33ef56671fc8af60eca77004e27d33b0f4542e914a839dc9027",
-          "installedPatch": false
-        }
-      ]
-    },
-    {
-      "version": "0.4.0",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": null,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "unsupported",
-          "vendored": "unsupported"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": [
-            "fail",
-            [
-              "locked"
-            ]
-          ],
-          "vendored": [
-            "fail",
-            [
-              "locked"
-            ]
-          ]
-        },
-        "transitive": {
-          "hosted": [
-            "fail",
-            [
-              "locked",
-              "plain"
-            ]
-          ],
-          "vendored": [
-            "fail",
-            [
-              "locked",
-              "plain"
-            ]
-          ]
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-3",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: unrecognized subcommand 'export'\n\nUsage: uv [OPTIONS] <COMMAND>\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-vendored-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "project-hosted-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-constraints-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-locked-sync-variant-2",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "Using Python 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtualenv at: .venv\nResolved 2 packages in 6ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-constraints-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-constraints-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-locked-sync-variant-2",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "Using Python 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtualenv at: .venv\nResolved 2 packages in 8ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-constraints-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync-variant-2",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "Using Python 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtualenv at: .venv\nResolved 6 packages in 541ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "50f80b9a71e3e33ef56671fc8af60eca77004e27d33b0f4542e914a839dc9027",
-          "installedPatch": false
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync-variant-2",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "Using Python 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtualenv at: .venv\nResolved 6 packages in 1.16s\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "50f80b9a71e3e33ef56671fc8af60eca77004e27d33b0f4542e914a839dc9027",
-          "installedPatch": false
-        }
-      ]
-    },
-    {
-      "version": "0.4.1",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": null,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "unsupported",
-          "vendored": "unsupported"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": [
-            "fail",
-            [
-              "locked"
-            ]
-          ],
-          "vendored": [
-            "fail",
-            [
-              "locked"
-            ]
-          ]
-        },
-        "transitive": {
-          "hosted": [
-            "fail",
-            [
-              "locked",
-              "plain"
-            ]
-          ],
-          "vendored": [
-            "fail",
-            [
-              "locked",
-              "plain"
-            ]
-          ]
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: invalid value 'pylock.toml' for '--format <FORMAT>'\n  [possible values: requirements-txt]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-3",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: invalid value 'pylock.toml' for '--format <FORMAT>'\n  [possible values: requirements-txt]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-vendored-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "project-hosted-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-constraints-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-locked-sync-variant-2",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "Using Python 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtualenv at: .venv\nResolved 2 packages in 4ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-constraints-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-constraints-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-locked-sync-variant-2",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "Using Python 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtualenv at: .venv\nResolved 2 packages in 6ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-constraints-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync-variant-2",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "Using Python 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtualenv at: .venv\nResolved 6 packages in 1.03s\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "50f80b9a71e3e33ef56671fc8af60eca77004e27d33b0f4542e914a839dc9027",
-          "installedPatch": false
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync-variant-2",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "Using Python 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtualenv at: .venv\nResolved 6 packages in 517ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "50f80b9a71e3e33ef56671fc8af60eca77004e27d33b0f4542e914a839dc9027",
-          "installedPatch": false
-        }
-      ]
-    },
-    {
-      "version": "0.4.30",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": null,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": [
-            "fail",
-            [
-              "locked"
-            ]
-          ],
-          "vendored": [
-            "fail",
-            [
-              "locked"
-            ]
-          ]
-        },
-        "transitive": {
-          "hosted": [
-            "fail",
-            [
-              "locked",
-              "plain"
-            ]
-          ],
-          "vendored": [
-            "fail",
-            [
-              "locked",
-              "plain"
-            ]
-          ]
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: invalid value 'pylock.toml' for '--format <FORMAT>'\n  [possible values: requirements-txt]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-3",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: invalid value 'pylock.toml' for '--format <FORMAT>'\n  [possible values: requirements-txt]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-vendored-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "project-hosted-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-dependency-groups-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-dependency-groups-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-constraints-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-locked-sync-variant-2",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "Using CPython 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtual environment at: .venv\nResolved 2 packages in 18ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-constraints-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-constraints-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-locked-sync-variant-2",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "Using CPython 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtual environment at: .venv\nResolved 2 packages in 8ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-constraints-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync-variant-2",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "Using CPython 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtual environment at: .venv\nResolved 6 packages in 321ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "50f80b9a71e3e33ef56671fc8af60eca77004e27d33b0f4542e914a839dc9027",
-          "installedPatch": false
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync-variant-2",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "Using CPython 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtual environment at: .venv\nResolved 6 packages in 312ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "50f80b9a71e3e33ef56671fc8af60eca77004e27d33b0f4542e914a839dc9027",
-          "installedPatch": false
-        }
-      ]
-    },
-    {
-      "version": "0.5.0",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": null,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": [
-            "fail",
-            [
-              "locked"
-            ]
-          ],
-          "vendored": [
-            "fail",
-            [
-              "locked"
-            ]
-          ]
-        },
-        "transitive": {
-          "hosted": [
-            "fail",
-            [
-              "locked",
-              "plain"
-            ]
-          ],
-          "vendored": [
-            "fail",
-            [
-              "locked",
-              "plain"
-            ]
-          ]
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: invalid value 'pylock.toml' for '--format <FORMAT>'\n  [possible values: requirements-txt]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-3",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: invalid value 'pylock.toml' for '--format <FORMAT>'\n  [possible values: requirements-txt]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-vendored-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "project-hosted-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-dependency-groups-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-dependency-groups-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-constraints-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-locked-sync-variant-2",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "Using CPython 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtual environment at: .venv\nResolved 2 packages in 3ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-constraints-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-constraints-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-locked-sync-variant-2",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "Using CPython 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtual environment at: .venv\nResolved 2 packages in 5ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-constraints-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync-variant-2",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "Using CPython 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtual environment at: .venv\nResolved 6 packages in 346ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "50f80b9a71e3e33ef56671fc8af60eca77004e27d33b0f4542e914a839dc9027",
-          "installedPatch": false
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync-variant-2",
-          "exitCode": 2,
-          "lockUnchanged": true,
-          "diagnostic": "Using CPython 3.9.6 interpreter at: /Applications/Xcode.app/Contents/Developer/usr/bin/python3\nCreating virtual environment at: .venv\nResolved 6 packages in 297ms\nerror: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided. To update the lockfile, run `uv lock`.\n"
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": false,
-          "installedResponseSha256": "50f80b9a71e3e33ef56671fc8af60eca77004e27d33b0f4542e914a839dc9027",
-          "installedPatch": false
-        }
-      ]
-    },
-    {
-      "version": "0.5.16",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": null,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "transitive": {
-          "hosted": "pass",
-          "vendored": "pass"
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: invalid value 'pylock.toml' for '--format <FORMAT>'\n  [possible values: requirements-txt]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-3",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: invalid value 'pylock.toml' for '--format <FORMAT>'\n  [possible values: requirements-txt]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-vendored-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 2,
-          "diagnostic": "error: unexpected argument '--script' found\n\nUsage: uv lock [OPTIONS]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "project-hosted-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-dependency-groups-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-dependency-groups-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-constraints-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-constraints-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        }
-      ]
-    },
-    {
-      "version": "0.5.17",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": null,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "transitive": {
-          "hosted": "pass",
-          "vendored": "pass"
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: invalid value 'pylock.toml' for '--format <FORMAT>'\n  [possible values: requirements-txt]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-3",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: invalid value 'pylock.toml' for '--format <FORMAT>'\n  [possible values: requirements-txt]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-vendored-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "example.py",
-            "example.py.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "script-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "script-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "project-hosted-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-dependency-groups-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-dependency-groups-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-constraints-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-constraints-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        }
-      ]
-    },
-    {
-      "version": "0.5.31",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": null,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "transitive": {
-          "hosted": "pass",
-          "vendored": "pass"
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: invalid value 'pylock.toml' for '--format <FORMAT>'\n  [possible values: requirements-txt]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-3",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: invalid value 'pylock.toml' for '--format <FORMAT>'\n  [possible values: requirements-txt]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-vendored-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "example.py",
-            "example.py.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "script-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "script-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "project-hosted-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-dependency-groups-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-dependency-groups-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-constraints-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-constraints-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        }
-      ]
-    },
-    {
-      "version": "0.6.0",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": 1,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "transitive": {
-          "hosted": "pass",
-          "vendored": "pass"
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: invalid value 'pylock.toml' for '--format <FORMAT>'\n  [possible values: requirements-txt]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-3",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: invalid value 'pylock.toml' for '--format <FORMAT>'\n  [possible values: requirements-txt]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-vendored-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "example.py",
-            "example.py.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "script-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "script-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": false
-        },
-        {
-          "command": "project-hosted-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-dependency-groups-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-dependency-groups-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-constraints-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-constraints-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        }
-      ]
-    },
-    {
-      "version": "0.6.14",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": 1,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "transitive": {
-          "hosted": "pass",
-          "vendored": "pass"
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: invalid value 'pylock.toml' for '--format <FORMAT>'\n  [possible values: requirements-txt]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-3",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 2,
-          "diagnostic": "error: invalid value 'pylock.toml' for '--format <FORMAT>'\n  [possible values: requirements-txt]\n\nFor more information, try '--help'.\n"
-        },
-        {
-          "command": "project-vendored-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "example.py",
-            "example.py.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "script-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "script-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 2,
-          "formatSupported": false,
-          "diagnostic": "error: TOML is not a supported output format for `uv pip compile` (only `requirements.txt`-style output is supported)\n"
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 2,
-          "formatSupported": false,
-          "diagnostic": "error: TOML is not a supported output format for `uv pip compile` (only `requirements.txt`-style output is supported)\n"
-        },
-        {
-          "command": "project-hosted-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-dependency-groups-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-dependency-groups-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-constraints-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-constraints-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        }
-      ]
-    },
-    {
-      "version": "0.6.15",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": 2,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "transitive": {
-          "hosted": "pass",
-          "vendored": "pass"
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-3",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "example.py",
-            "example.py.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "script-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "script-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pylock.toml"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "pylock-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "pylock-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-dependency-groups-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-dependency-groups-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-constraints-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-constraints-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        }
-      ]
-    },
-    {
-      "version": "0.6.17",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": 2,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "transitive": {
-          "hosted": "pass",
-          "vendored": "pass"
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-3",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "example.py",
-            "example.py.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "script-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "script-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pylock.toml"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "pylock-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "pylock-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-dependency-groups-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-dependency-groups-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-constraints-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-constraints-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        }
-      ]
-    },
-    {
-      "version": "0.7.0",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": 2,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "transitive": {
-          "hosted": "pass",
-          "vendored": "pass"
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-3",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "example.py",
-            "example.py.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "script-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "script-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pylock.toml"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "pylock-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "pylock-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-dependency-groups-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-dependency-groups-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-constraints-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-constraints-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        }
-      ]
-    },
-    {
-      "version": "0.7.22",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": 2,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "transitive": {
-          "hosted": "pass",
-          "vendored": "pass"
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-3",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "example.py",
-            "example.py.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "script-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "script-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pylock.toml"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "pylock-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "pylock-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-dependency-groups-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-dependency-groups-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-constraints-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-constraints-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        }
-      ]
-    },
-    {
-      "version": "0.8.0",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": 2,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "transitive": {
-          "hosted": "pass",
-          "vendored": "pass"
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-3",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "example.py",
-            "example.py.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "script-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "script-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pylock.toml"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "pylock-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "pylock-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-dependency-groups-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-dependency-groups-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-constraints-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-constraints-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        }
-      ]
-    },
-    {
-      "version": "0.8.3",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": 2,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "transitive": {
-          "hosted": "pass",
-          "vendored": "pass"
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-3",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "example.py",
-            "example.py.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "script-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "script-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pylock.toml"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "pylock-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "pylock-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-dependency-groups-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-dependency-groups-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-constraints-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-constraints-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        }
-      ]
-    },
-    {
-      "version": "0.8.4",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": 3,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "transitive": {
-          "hosted": "pass",
-          "vendored": "pass"
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-3",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "example.py",
-            "example.py.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "script-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "script-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pylock.toml"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "pylock-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "pylock-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-dependency-groups-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-dependency-groups-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-constraints-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-constraints-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        }
-      ]
-    },
-    {
-      "version": "0.8.24",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": 3,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "transitive": {
-          "hosted": "pass",
-          "vendored": "pass"
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-3",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "example.py",
-            "example.py.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "script-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "script-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pylock.toml"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "pylock-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "pylock-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-dependency-groups-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-dependency-groups-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-constraints-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-constraints-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        }
-      ]
-    },
-    {
-      "version": "0.9.0",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": 3,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "transitive": {
-          "hosted": "pass",
-          "vendored": "pass"
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-3",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "example.py",
-            "example.py.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "script-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "script-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pylock.toml"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "pylock-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "pylock-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-dependency-groups-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-dependency-groups-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-constraints-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-constraints-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        }
-      ]
-    },
-    {
-      "version": "0.9.30",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": 3,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "transitive": {
-          "hosted": "pass",
-          "vendored": "pass"
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-3",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "example.py",
-            "example.py.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "script-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "script-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pylock.toml"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "pylock-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "pylock-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-dependency-groups-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-dependency-groups-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-constraints-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-constraints-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        }
-      ]
-    },
-    {
-      "version": "0.10.0",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": 3,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "transitive": {
-          "hosted": "pass",
-          "vendored": "pass"
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-3",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "example.py",
-            "example.py.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "script-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "script-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pylock.toml"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "pylock-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "pylock-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-dependency-groups-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-dependency-groups-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-constraints-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-constraints-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        }
-      ]
-    },
-    {
-      "version": "0.10.12",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": 3,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "transitive": {
-          "hosted": "pass",
-          "vendored": "pass"
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-3",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "example.py",
-            "example.py.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "script-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "script-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pylock.toml"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "pylock-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "pylock-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-dependency-groups-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-dependency-groups-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-constraints-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-constraints-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        }
-      ]
-    },
-    {
-      "version": "0.11.0",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": 3,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "transitive": {
-          "hosted": "pass",
-          "vendored": "pass"
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-3",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "example.py",
-            "example.py.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "script-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "script-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pylock.toml"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "pylock-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "pylock-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-dependency-groups-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-dependency-groups-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-constraints-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-constraints-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        }
-      ]
-    },
-    {
-      "version": "0.11.33",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": 3,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "transitive": {
-          "hosted": "pass",
-          "vendored": "pass"
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-3",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "example.py",
-            "example.py.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "script-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "script-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pylock.toml"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "pylock-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "pylock-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-dependency-groups-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-dependency-groups-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-constraints-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-constraints-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        }
-      ]
-    },
-    {
-      "version": "0.12.0",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": 3,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "transitive": {
-          "hosted": "pass",
-          "vendored": "pass"
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-3",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "example.py",
-            "example.py.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "script-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "script-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pylock.toml"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "pylock-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "pylock-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-dependency-groups-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-dependency-groups-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-constraints-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-constraints-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        }
-      ]
-    },
-    {
-      "version": "0.12.15",
-      "lockSchema": "package",
-      "lockVersion": 1,
-      "lockRevision": 3,
-      "variants": {
-        "tool-uv-dev": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "dependency-groups": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "extras-duplicate": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "constraints": {
-          "hosted": "pass",
-          "vendored": "pass"
-        },
-        "transitive": {
-          "hosted": "pass",
-          "vendored": "pass"
-        }
-      },
-      "observations": [
-        {
-          "command": "lock",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "project-hosted-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-hosted-lock-sync-variant-3",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "project-vendored-export-requirements-txt",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-export-pylock.toml",
-          "exitCode": 0
-        },
-        {
-          "command": "project-vendored-lock-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "requirements.txt"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "requirements-plain-hosted-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-plain-variant-2",
-          "exitCode": 0
-        },
-        {
-          "command": "requirements-plain-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "requirements-plain-vendored-pip-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-hosted-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "requirements-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "pylock-vendored-export-sync",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-hosted",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "example.py",
-            "example.py.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "script-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-lock-vendored",
-          "exitCode": 0
-        },
-        {
-          "command": "script-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "script-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-hosted",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-hosted-socket-patch",
-          "exitCode": 0,
-          "rewrittenFiles": [
-            "pylock.toml"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "pylock-direct-hosted-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "compile-pylock-vendored",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "pylock-direct-vendored-socket-patch",
-          "exitCode": 0,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "pylock-direct-vendored-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-hosted-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-locked-install-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "project-vendored-unfrozen-install-variant-2",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-hosted-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-locked-install",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "script-vendored-unfrozen-install",
-          "exitCode": 0,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-tool-uv-dev-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-dependency-groups-hosted-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-hosted-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-dependency-groups-vendored-frozen-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-locked-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-dependency-groups-vendored-plain-sync",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-extras-duplicate-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-constraints-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-constraints-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-constraints-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-constraints-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-hosted-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "rewrittenFiles": [
-            "pyproject.toml",
-            "uv.lock"
-          ],
-          "redirected": 1,
-          "warnings": []
-        },
-        {
-          "command": "variant-transitive-hosted-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-hosted-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-lock",
-          "exitCode": 0,
-          "formatSupported": true
-        },
-        {
-          "command": "variant-transitive-vendored-socket-patch",
-          "exitCode": 0,
-          "patchInLock": true,
-          "vendorSummary": {
-            "applied": 1,
-            "failed": 0
-          },
-          "vendorErrors": []
-        },
-        {
-          "command": "variant-transitive-vendored-frozen-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-locked-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        },
-        {
-          "command": "variant-transitive-vendored-plain-sync-variant-2",
-          "exitCode": 0,
-          "lockUnchanged": true,
-          "installedResponseSha256": "21d9a7810de52973c88d9170f437e98921456bce445ab0618576987478a6a6e4",
-          "installedPatch": true
-        }
-      ]
-    }
-  ]
-}
diff --git a/docs/testing/vendored-production-e2e.md b/docs/testing/vendored-production-e2e.md
index e7d81330..a31f0054 100644
--- a/docs/testing/vendored-production-e2e.md
+++ b/docs/testing/vendored-production-e2e.md
@@ -1,209 +1,76 @@
-# Vendored-mode production e2e
+# Vendored production tests
 
-`crates/socket-patch-cli/tests/e2e_vendored_production.rs` is the vendored-mode
-counterpart to [`hosted-production-e2e.md`](./hosted-production-e2e.md). The
-synthetic `e2e_vendor_*_build.rs` capstones prove the vendoring *mechanism* with
-a hand-staged `.socket/` blob and `vendor --offline`; they never contact
-production. This suite is the opposite: it drives `scan --mode vendored` against
-the **real** Socket production service and the **real** upstream registries with
-**no mocking anywhere**, on the anonymous **free public proxy** (no API token).
+[`e2e_vendored_production.rs`](../../crates/socket-patch-cli/tests/e2e_vendored_production.rs)
+uses the public patch service and real upstream registries to test committed
+patched artifacts. It complements the [hosted suite](hosted-production-e2e.md)
+and controlled-input vendor tests.
 
 ## What it proves
 
-For each ecosystem × package manager:
-
-1. install a pinned, known-vulnerable dependency from its **real** upstream
-   registry with the **real** package manager;
-2. assert the installed bytes are pristine (anti-vacuity);
-3. `socket-patch scan --mode vendored --json --yes` — resolves a free patch from
-   `patches-api.socket.dev`, materializes the patched package into the
-   committable `.socket/vendor/<eco>/<uuid>/` tree, and rewires the lockfile /
-   manifest to consume it;
-4. assert the vendor landed (`summary.applied >= 1`, `failed == 0`, expected
-   patch UUID present, artifact on disk, lock rewired);
-5. **DELIVERY proof** — copy ONLY the committable files (project manifest +
-   lockfile + `.socket/` + any PM config) into a fresh dir, point every cache
-   var at a fresh EMPTY dir, run the package manager's clean-install offline,
-   and assert the installed bytes are the VENDORED (patched) bytes, NOT the
-   pristine registry bytes;
-6. idempotency (a second run is an `already_vendored` no-op with a byte-stable
-   lock) and `vendor --revert` byte-restores.
-
-Step 5 is the point. It is the only place in this repo where a third-party
-package manager installs, from a genuinely cold cache and with only the
-committable files, a package vendored from a **real** Socket production patch.
-
-This suite proves **byte delivery** — the bytes the vendored patch produced are
-the bytes the package manager installs. It does NOT assert CVE efficacy;
-whether the fix content actually closes the advisory is a separate concern, and
-several production patches are byte-valid but that is a different question. This
-matches how the `e2e_vendor_*_build.rs` capstones assert.
-
-## Required production patches
-
-Pinned to these free-tier patches; they must stay published on
-`patches-api.socket.dev`. `preflight_required_patches_are_published` checks all
-three every run and fails first with the offending PURL named.
-
-| Ecosystem | PURL | Patch UUID | Marker in the patched bytes |
-|-----------|------|------------|-----------------------------|
-| npm | `pkg:npm/minimist@1.2.2` | `80630680-4da6-45f9-bba8-b888e0ffd58c` | `Socket Community Patch` header |
-| PyPI | `pkg:pypi/urllib3@1.26.18` | one of three (picked by the CLI's `api::ranking`; the suite accepts any) | `Socket Community Patch` header |
-| RubyGems | `pkg:gem/activestorage@6.0.3` | any of the `GEM_PATCHES` table (each patch marks a different file): the same 6 live UUIDs as the hosted doc, including `9c2b4925` and the merged `01019627` that v5 ranking prefers | `Socket Community Patch` header |
-
-If a required patch is withdrawn, update the catalog constants at the top of
-`e2e_vendored_production.rs` **and** the table above (same procedure as the
-hosted suite).
-
-## Coverage: PM × proof
-
-| Package manager | Fixture | Delivery install (cold, offline, committable-only) | Status |
-|-----------------|---------|-----------------------------------------------------|--------|
-| npm | minimist@1.2.2 | `npm ci` | ✅ full |
-| pnpm | minimist@1.2.2 | `pnpm install --frozen-lockfile --offline` | ✅ full |
-| yarn classic | minimist@1.2.2 | `yarn install --frozen-lockfile --offline` | ✅ full |
-| yarn berry (node-modules) | minimist@1.2.2 | `yarn install --immutable --check-cache` | ✅ full |
-| bun (text lockfile) | minimist@1.2.2 | `bun install --frozen-lockfile` | ✅ full |
-| vlt 1.2.0 (`vlt-lock.json`) | minimist@1.2.2 | fresh checkout, `vlt ci` (lock byte-stable) | ✅ full (`vlt_pinned_matrix_production_vendored_install_proof`) |
-| pip (requirements.txt) | urllib3@1.26.18 | `pip install --no-index -r requirements.txt` | ✅ full |
-| uv (uv.lock) | urllib3@1.26.18 | `uv sync --frozen --offline` | ✅ full |
-| bundler | activestorage@6.0.3 | frozen `bundle install`, fresh empty `BUNDLE_PATH` | ✅ full |
-| go | — | — | zero-patch assertion (no free golang patches) |
-| deno | — | — | negative assertion (unsupported) |
-| cargo / maven / nuget / composer | — | — | canary (no free production patches) |
-
-Cargo sat in the ✅-full rows until 2026-09-01: the leg vendored a pinned crate
-as a `[patch.crates-io]` path dep and proved delivery with
-`cargo fetch --offline --locked` from an empty `CARGO_HOME`. Production's free
-cargo tier emptied on 2026-08-28 (the pinned patches were deleted server-side,
-leaving zero live free patches for any cargo crate), so the leg was demoted to
-`canary_unpublished_vendored_ecosystems` — deliberately dropping the cargo
-install-proof coverage. To re-promote: pick a live free cargo patch and follow
-the withdrawn-patch procedure in the
-[hosted doc](./hosted-production-e2e.md#if-a-required-patch-is-withdrawn); the
-git history of this demotion shows every piece to restore in both production
-suites.
-
-## Known issues this suite surfaced
-
-All were found against real production + real toolchains; none is a test bug.
-The first two are fixed; the third is mitigated CLI-side (the served artifact
-is still defective server-side).
-
-### 1. `pnpm` >= 11 — vendored `overrides` land in the wrong file (CLI) — FIXED
-
-pnpm 11 stopped reading `overrides` from `package.json`'s `pnpm` field — it
-moved to `pnpm-workspace.yaml` (https://pnpm.io/settings). The CLI used to write
-only `package.json` `pnpm.overrides`, so pnpm 11 ignored it and a frozen install
-refused with `ERR_PNPM_LOCKFILE_CONFIG_MISMATCH`, even though the vendored
-tarball and lock were correct (the lockfile passes pnpm's supply-chain policy).
-
-**Fixed** (`fix/pnpm11-overrides-location`): the pnpm vendor backend now
-mirrors the same versioned `<name>@<version>` → `file:` override into
-`pnpm-workspace.yaml` (creating the file with a root-only `packages: ['.']`
-list — pnpm 9 refuses a workspace file with no `packages` field — when the
-project has none), alongside the existing `package.json` `pnpm.overrides` for
-pnpm 9/10. The committable set installs cleanly on pnpm 9/10/11 with no config
-mismatch, and `vendor --revert` deletes a file it created (or splices its
-override back out of one it edited). This leg now asserts the frozen install
-succeeds directly, with no workaround.
-
-### 2. `gem` — vendoring the platform-qualified purl was unsupported (CLI) — FIXED
-
-`scan --mode vendored` resolved and downloaded the activestorage patch, but the
-vendor backend refused the platform-qualified purl
-(`pkg:gem/activestorage@…?platform=ruby` — the spelling production publishes)
-with `platform_gem_unsupported`, so `summary.applied == 0`, `failed == 1`, and
-the run exited non-zero with `"status": "partial_failure"`.
-
-**Fixed** (PR #172): the gate in `vendor/gem.rs` now refuses only non-empty,
-non-`ruby` platform qualifiers — `?platform=ruby` is the portable default and
-vendors like a bare purl. The suite's original pin
-(`activestorage@7.0.2.2` / `2535d43d-67ce-4944-be27-c19e113997fb`) was
-withdrawn on 2026-08-14; the 2026-08-18 catalog republish REPLACED it, and the
-suite was re-pinned to `activestorage@6.0.3` /
-`15e960b5-f432-4b6c-b8aa-534a2b419323`. The vendor succeeds live and the leg
-was upgraded to the full fresh-dir `bundle install` delivery proof
-(`gem_bundler_vendored_install_proof`), retiring its failure-tolerance branch
-and its `SOCKET_PATCH_VENDORED_E2E_GEM_STRICT` knob.
-
-### 3. `gem` — the served gem-stub gemspec is invalid (SERVER; CLI mitigated)
-
-Discovered 2026-08-19 while upgrading the gem leg to a full delivery proof:
-the gem-stub-gemspec artifact production serves is invalid — it is missing
-`summary`/`authors`, which rubygems validation requires — so writing it
-verbatim makes bundler reject the vendored `path:` source and
-`bundle install` exit 1 on every bundler major.
-
-**Mitigated CLI-side**: the gem vendor backend now validates BOTH stub sources
-at the write choke point (a conservative textual check matched to what
-rubygems 3.3–3.6 actually hard-fails — empirically verified in the bundler-era
-docker images). `--vendor-source auto` detects the served defect, warns
-(`vendor_prebuilt_stub_invalid`), and falls back to the local build — which is
-how `gem_bundler_vendored_install_proof` passes against production today —
-while explicit `--vendor-source service` refuses with
-`vendor_prebuilt_stub_invalid`. When the gem is also not installed (no local
-stub to derive), `auto` refuses with the same code, the served defect named,
-and the install-the-gem remedy; a corrupted LOCAL `specifications/` stub
-refuses `gem_spec_invalid`. Re-vendoring a project that committed a defective
-stub pre-hardening re-validates the ON-DISK stub and rebuilds the artifact
-with a valid one. The leg's route-attribution assertion (exactly one of
-`vendor_prebuilt_downloaded` / `vendor_prebuilt_stub_invalid`) auto-retires
-the fallback expectation once the depscan stub-generator fix deploys and the
-rebuilt artifacts serve valid stubs — the same leg then exercises the service
-artifact directly.
+Each install-proof case starts with pristine installed bytes, runs
+`scan --mode vendored`, and checks the artifact, ledger, and dependency edits.
+It copies only committable project files to a fresh checkout, isolates caches,
+installs from the committed artifacts, and checks the patched bytes. Reruns,
+reversal, and manifest-free VEX exercise the rest of the lifecycle.
+
+This tests patch delivery, not exploit efficacy. The fixture determines which
+other dependencies must be available during installation; vendoring patched
+packages does not itself make every dependency offline.
+
+## Catalog fixtures and coverage
+
+The test source defines required PURLs, accepted patch UUIDs, byte markers, and
+preflight checks. It shares the npm, PyPI, and RubyGems fixture families with the
+hosted suite. Follow its [withdrawn-patch procedure](hosted-production-e2e.md#if-a-required-patch-is-withdrawn)
+when the catalog changes, updating both suites.
+
+| Coverage | Cases |
+| --- | --- |
+| Native production installs | npm, pnpm, Yarn Classic, Yarn Berry with node-modules, Bun text locks, vlt, pip requirements, uv, and Bundler |
+| Catalog canaries | Cargo, Maven, NuGet, and Composer; require a published free fixture before adding full install proofs |
+| Go / Deno | Catalog/unsupported-mode assertions, not production vendor install proofs |
+
+The vlt case installs a committed directory artifact with `vlt ci`. The CLI
+decodes the service download before vendoring it, so the hosted vlt
+[serve-encoding gate](hosted-production-e2e.md#vlt-the-serve-encoding-gate) does
+not prevent this proof. Per-release coverage lives in the
+[compatibility guides](README.md#package-manager-guides).
+
+### RubyGems artifact validation
+
+A vendored Bundler path source needs a valid stub gemspec. The CLI validates
+service and local stubs before writing them. An invalid service stub causes
+`--vendor-source auto` to try a local build when possible;
+`--vendor-source service` refuses with `vendor_prebuilt_stub_invalid`.
+A missing local source can prevent that fallback. The production test accepts
+and checks the actual acquisition route, so it does not assume a previously
+observed server defect is still present.
 
 ## Running
 
 ```sh
-# everything, soft-skipping legs whose toolchain is absent
-cargo test -p socket-patch-cli --test e2e_vendored_production -- --ignored --test-threads=1
+cargo test --locked -p socket-patch-cli --test e2e_vendored_production -- \
+  --ignored --test-threads=1
 
-# CI: turn every "toolchain missing" soft-skip into a hard failure
+# Require the toolchains instead of allowing local skips:
 SOCKET_PATCH_VENDORED_E2E_STRICT=1 \
-  cargo test -p socket-patch-cli --test e2e_vendored_production -- --ignored --test-threads=1
+  cargo test --locked -p socket-patch-cli --test e2e_vendored_production -- \
+  --ignored --test-threads=1
 ```
 
-The suite is `#[ignore]`-gated, so it stays out of the `test` and `e2e` jobs and
-runs only where it is explicitly asked for. `--test-threads=1` keeps the real
-installs from contending on the shared cache sandbox.
-
-The bun leg (`bun_vendored_install_proof`) is therefore on-demand production
-coverage. The per-PR real-Bun evidence for vendored mode is the hermetic
-`e2e_vendor_bun_build` suite in `ci.yml`'s `e2e` matrix (Bun 1.4.2 on three
-OSes, 1.1.45 and 1.2.23 on Linux) plus the production native matrix in
-`bun-compatibility.yml` (16 releases × 3 OS in hosted and vendored mode —
-vendored is manifest-free) — see [Bun compatibility](bun-compatibility.md).
-
-The vlt leg vendors the service's directory artifact into the D19 layout
-(`.socket/vendor/npm/<uuid>/minimist-1.2.2/node_modules/minimist`) and proves
-it with a fresh `vlt ci`. The CLI's own download decodes the transfer, so the
-serve-encoding gate that blocks hosted vlt (see the
-[hosted doc](hosted-production-e2e.md#vlt-the-serve-encoding-gate)) does not
-apply. CI runs it in the `hosted-e2e` job
-(`--test e2e_vendored_production -- --include-ignored vlt_pinned_matrix`,
-through `scripts/check-vlt-legs.py`); the per-release evidence is in
-[vlt compatibility](vlt-compatibility.md).
-
-### Environment knobs
+The suite is opt-in. Single-threaded execution avoids competing native installs.
+It clears ambient Socket credentials and disables persisted login; no API token
+is needed.
 
 | Variable | Effect |
-|----------|--------|
-| `SOCKET_PATCH_VENDORED_E2E_STRICT=1` | Turn every "toolchain missing" soft-skip into a hard failure. |
-| `SOCKET_PATCH_VLT_E2E_JS` / `SOCKET_PATCH_VLT_E2E_VERSION` | The vlt release the vlt leg runs (`node <vlt.js>`, exact `--version`). |
-| `SOCKET_PATCH_VENDORED_E2E_CANARY_STRICT=1` | Fail when cargo/maven/nuget/composer gain their first free published patch. |
-
-The suite forces `SOCKET_NO_CONFIG=true` and scrubs every ambient `SOCKET_*`
-var, planting hostile seeds so a dropped scrub reddens the suite instead of
-letting a developer's socket-cli login move the run onto the org catalog. No API
-token is used.
-
-### Toolchains
-
-`npm`, `pnpm`, `corepack` (yarn classic + berry), `bun`, `vlt` (Node ≥ 22.22), `uv`, `python3` (pip),
-`ruby` + `bundle`, `go`.
-
-### Network egress
-
-`patches-api.socket.dev`, `patch.socket.dev`, `registry.npmjs.org`, `pypi.org`,
-`files.pythonhosted.org`, `rubygems.org`.
+| --- | --- |
+| `SOCKET_PATCH_VENDORED_E2E_STRICT=1` | Fail instead of skipping missing required toolchains |
+| `SOCKET_PATCH_VENDORED_E2E_CANARY_STRICT=1` | Fail when a watched ecosystem gains a free fixture |
+| `SOCKET_PATCH_VLT_E2E_JS` / `SOCKET_PATCH_VLT_E2E_VERSION` | Select the version-pinned vlt executable |
+
+Tools include npm, pnpm, Corepack for Yarn, Bun, vlt, uv, Python/pip, Ruby/Bundler,
+and Go. Networked fixture preparation requires Socket's API and patch server plus
+npm, PyPI, and RubyGems. CI versions and triggers are defined in the
+[main workflow](../../.github/workflows/ci.yml) and package-manager workflows.
+The main `hosted-e2e` job includes the vendored vlt proof; it does not imply that
+every vendored production case ran.
diff --git a/docs/testing/yarn-berry-compatibility.md b/docs/testing/yarn-berry-compatibility.md
index 7c36cb69..5bd45eee 100644
--- a/docs/testing/yarn-berry-compatibility.md
+++ b/docs/testing/yarn-berry-compatibility.md
@@ -37,49 +37,20 @@ core unit tests.
 
 ## Line endings
 
-yarn berry keeps one line ending per file, chosen by the same function for
-the lockfile and every manifest. At tag `@yarnpkg/cli/4.12.0` (the same code
-ships at 4.0.0 and 4.18.0; the published 3.8.7, 4.0.2, 4.6.0, 4.9.2 and
-4.18.0 bundles carry it verbatim, and 2.4.3 applies the same rule through
-`changeFilePromise`):
-
-- `packages/yarnpkg-fslib/sources/FakeFS.ts` (lines 799–812):
-  `getEndOfLine(content)` returns `os.EOL` when `content` has no line break —
-  the file is new — and otherwise `\r\n` only when CRLF breaks strictly
-  outnumber LF ones (a tie is LF); `normalizeLineEndings(original, next)`
-  respells every break of `next` that way.
-- `packages/yarnpkg-core/sources/Project.ts`: `persistLockfile` (lines
-  2014–2033) writes the generated lock through `normalizeLineEndings` against
-  the current file; the `--immutable` check (lines 1789–1858) fails with
-  YN0028 whenever `normalizeLineEndings(initialLockfile, generateLockfile())`
-  differs from the file — so a uniformly CRLF lock passes, while a lock with
-  mixed endings (or a BOM, which the re-render never writes) always fails.
-- `packages/yarnpkg-core/sources/Workspace.ts` (lines 217–229):
-  `persistManifest` writes `JSON.stringify(data, null, indent) + "\n"` through
-  `changeFilePromise(…, {automaticNewlines: true})`, the same rule, after every
-  install (`Project.ts` line 1881, `--immutable` included).
-  `Manifest.loadFromText` strips a BOM when reading (`Manifest.ts` lines
-  135–146 and 984–990); the rewrite never writes one back.
-- `packages/yarnpkg-parsers/sources/syml.ts`: `parseSyml` reads the lock with
-  js-yaml, which accepts CRLF.
-
-So on Windows every yarn berry project starts CRLF: the first `yarn install`
-writes a CRLF `yarn.lock`, and a `package.json` yarn pretty-prints for the
-first time (any compact one) comes back CRLF. On macOS and Linux both are LF.
-An existing file keeps its majority ending on every OS. Git adds its own
-path to CRLF: `core.autocrlf=true` (the Git for Windows installer's default)
-checks LF-committed text out as CRLF, and so does `core.autocrlf=true` or a
-`text eol=crlf` attribute on macOS and Linux; a lock committed with CRLF stays
-CRLF in every checkout.
+Yarn Berry preserves a file's majority line ending and uses the platform's
+ending for a new file. Uniform LF and CRLF files are supported. Mixed line
+endings can fail Yarn's immutable-install check; Socket Patch refuses mixed
+lockfiles before rewriting them. The suites below cover native and forced CRLF
+checkouts.
 
 What socket-patch does with those files:
 
 | | hosted (`yarn.lock`) | vendored (`yarn.lock` + root `package.json`) |
 | --- | --- | --- |
-| uniformly LF or CRLF | rewritten in the file's own ending; ledger fragments recorded as on disk | lock entry spliced in the file's ending; `package.json` re-serialized in its own layout (BOM, indent, ending, trailing newline) |
+| uniformly LF or CRLF | rewritten in the file's own ending; no hosted ledger | lock entry spliced in the file's ending; `package.json` re-serialized in its own layout (BOM, indent, ending, trailing newline) |
 | leading BOM | kept | kept, both files |
 | mixed CRLF / LF, or a bare CR | refused untouched: `redirect_yarn_berry_mixed_line_endings` | refused before any write: `vendor_yarn_berry_mixed_line_endings` |
-| revert (`rollback`, `remove`, takeovers) | byte-exact; a ledger recorded before a uniform LF ↔ CRLF checkout flip is replayed respelled; a mixed lock refuses as drift | byte-exact; a lock mixed after vendoring gets the restored entry in the terminator of the entry it replaces |
+| revert (`rollback`, `remove`, takeovers) | upstream entries reconstructed from registry metadata; mixed endings refuse as drift | byte-exact; a lock mixed after vendoring gets the restored entry in the terminator of the entry it replaces |
 | mode takeover into this mode | the berry gates (line endings, `cacheKey`, `compressionLevel`) run BEFORE the vendored wiring is reverted; a refused purl stays vendored, byte-identical | the backend's project gates (both files' line endings, `cacheKey`, `compressionLevel`) run BEFORE the hosted redirect is reverted; a refused purl stays hosted, byte-identical |
 
 Every reader — manifest-less `vex`, the lockfile inventory, the npm flavor
diff --git a/docs/usage.md b/docs/usage.md
new file mode 100644
index 00000000..f9d92256
--- /dev/null
+++ b/docs/usage.md
@@ -0,0 +1,195 @@
+# Using Socket Patch
+
+Start with the [README quick start](../README.md#quick-start). This guide covers
+selection, automation, offline preparation, attestations, and recovery. Detailed
+flags, response fields, and diagnostic codes live in the
+[CLI contract](../crates/socket-patch-cli/CLI_CONTRACT.md).
+
+## Select patches
+
+A bare `scan` applies hosted patches without prompting. Use `--dry-run` to inspect
+what it would change, and `--json` for a machine-readable result:
+
+```sh
+socket-patch scan --dry-run --json
+socket-patch scan --package lodash --package pkg:pypi/requests
+socket-patch scan --ecosystems npm,pypi
+socket-patch scan apps/web apps/api
+```
+
+Package filters accept names or PURLs, with or without an exact version, and can be
+repeated or comma-separated. Hosted and vendored PATH arguments name project
+directories; quote globs to let the CLI expand them. Use one directory per invocation
+with `--json`. Use one project and a distinct output path per `scan --vex` run.
+
+To make selection consistent across contributors and CI, commit a
+[repository policy](configuration.md#repository-patch-policy). To target a specific
+advisory or patch:
+
+```sh
+socket-patch get CVE-2024-12345 --mode hosted
+socket-patch get GHSA-xxxx-yyyy-zzzz --mode vendored
+socket-patch get pkg:npm/lodash@4.17.20 --mode agent
+```
+
+Replace the example identifiers with the advisory or package you need. `get` also
+accepts a patch UUID or package name. It defaults to hosted mode; `--save-only` and
+global targeting default to agent mode instead. Hosted and vendored `get` do not
+prompt. Agent-mode searches can offer an interactive choice.
+
+For each package version, automatic selection prefers the newest downloadable
+merged patch (covering multiple advisories). Otherwise it selects by severity and
+then publication date. Exact ties use tier and UUID. A rerun replaces a recorded
+patch only with one that outranks it by merge status, severity, or date; tie-breaking
+alone does not cause a replacement. The
+[ranking contract](../crates/socket-patch-cli/CLI_CONTRACT.md#which-patch-gets-selected)
+details selection and upgrades.
+
+## CI and automation
+
+Hosted and vendored projects use their normal dependency install step. Run scans
+in a job that reviews and commits dependency-file changes, then install and verify
+that result. Supply `SOCKET_API_TOKEN` through your CI secret store for organization
+patches; a token is not needed for the free catalog.
+
+```sh
+socket-patch scan --json > scan-result.json
+```
+
+Check the command's exit status before processing the result. A preview reports
+patch availability; it does not fail merely because patches exist. JSON schemas
+vary by command: use the [output reference](../crates/socket-patch-cli/CLI_CONTRACT.md#json-output-shapes)
+rather than parsing human output. A pipeline that uses `jq` should preserve the
+CLI's exit status, for example with Bash's `set -o pipefail`.
+
+`scan --max-new-patches 5` limits new patches per run; it does not limit updates to
+existing patches. See [gradual rollout](configuration.md#gradual-rollout).
+
+## Vendoring and offline installs
+
+For an existing hosted project without an agent manifest:
+
+```sh
+socket-patch vendor --dry-run
+socket-patch vendor
+```
+
+`vendor` ejects the patches referenced by the project's hosted dependency files.
+When an agent manifest exists, it uses that manifest's patch set. To discover and
+vendor available patches in one run, use:
+
+```sh
+socket-patch scan --mode vendored
+```
+
+Commit `.socket/vendor/`, including `state.json`, and every dependency or config
+file the CLI reports. The ledger stores patch records, artifact fingerprints, and
+reversal information. A checkout can install the committed patched packages without
+Socket API access or a Socket Patch binary.
+
+This does not vendor unpatched dependencies. Provision those through your normal
+mirror or package-manager cache, and test a clean offline install before relying
+on an airgapped build. Integrity enforcement and cache behavior differ by package
+manager; see [ecosystem support](ecosystems.md).
+
+Artifact acquisition is controlled by `--vendor-source`:
+
+| Value | Behavior |
+| --- | --- |
+| `auto` (default) | Use a service artifact when available, with local building as a fallback for eligible misses |
+| `service` | Require a service artifact; refuse if unavailable |
+| `build` | Build locally from available package and patch data |
+
+An integrity failure is refused rather than bypassed with a fallback. Offline
+operation never fetches missing inputs. `repair` can restore missing or corrupt
+artifacts from a valid ledger when sufficient inputs are available; it cannot
+reconstruct a lost vendor ledger. Restore a lost ledger from version control.
+
+## OpenVEX
+
+Generate an attestation after installing the patched dependencies:
+
+```sh
+socket-patch vex --output socket.vex.json
+socket-patch vex --json --output socket.vex.json
+```
+
+The document marks vulnerabilities covered by verified Socket patches as
+`not_affected`. It does not assess other vulnerabilities. A VEX-aware scanner must
+be configured to consume the resulting file.
+
+| Patch mode | Evidence used by VEX |
+| --- | --- |
+| Agent | Installed patched files, checked against the manifest's hashes |
+| Vendored | Committed artifacts and live dependency-file references |
+| Hosted | Live hosted references and their integrity pins; installed copies are verified when available |
+
+Before installation, hosted VEX can describe the pinned dependency state without
+verifying installed bytes. `scan --vex socket.vex.json` also emits hosted VEX before
+installation; rerun standalone `vex` afterward. Impact statements include the patch
+UUID; vendored and hosted statements add `(vendored)` and `(redirected)` respectively.
+Exact strings are in the [provenance contract](../crates/socket-patch-cli/CLI_CONTRACT.md#vex-provenance-markers-contract).
+
+`vex` reads patch records from local state or fetches them from the API. Without a
+local record, `--offline` omits the patch as `record_unavailable`. Commit the vendor
+ledger when offline attestation is required. A reference no longer used by the
+project is excluded even with `--no-verify`; that flag bypasses file-hash checks,
+not reference validation. A patch record alone does not prove it is consumed.
+
+The product identifier is inferred from the Git origin or project metadata. Use
+`--product <identifier>` when inference is unavailable or unsuitable. `--json`
+requires `--output` so the document and command result do not share stdout.
+
+`scan`, `apply`, and `vendor` accept `--vex <path>` plus `--vex-product`,
+`--vex-no-verify`, `--vex-doc-id`, and `--vex-compact`. Embedded generation is skipped
+for `--dry-run`; an attestation failure makes the command fail even if patching
+succeeded. See the [VEX contract](../crates/socket-patch-cli/CLI_CONTRACT.md#embedded-vex-apply---vex--scan---vex--vendor---vex)
+for output and empty-project behavior.
+
+## Agent mode
+
+Agent mode records patches and applies them to installed files:
+
+```sh
+socket-patch scan --mode agent
+# Commit .socket/ and any project wiring the command reports.
+
+# After every fresh install, locally and in CI:
+socket-patch apply
+```
+
+Once the required patch data is committed, `socket-patch apply --offline` works
+without downloading it again. `get <identifier> --save-only` records a patch without
+applying it. `apply` skips packages owned by the vendor ledger.
+
+Deno uses agent mode. Cargo agent patches can affect a shared registry cache; Go
+uses project-local copies and `replace` directives. Read the
+[ecosystem caveats](ecosystems.md) before using agent mode in shared environments.
+The removed `setup` command is covered in the [migration guide](migrating-to-v5.md).
+
+## Inspect, undo, and repair
+
+| Command | Effect |
+| --- | --- |
+| `list` | Show agent records, vendor records, and hosted pins; an empty project succeeds |
+| `rollback [PURL\|UUID\|PATH]...` | Restore selected patches, or all patches when no target is given, and remove their local state |
+| `remove <PURL\|UUID>` | Restore and remove one patch |
+| `vendor --revert` | Undo vendoring from its recorded edits and remove the vendored artifacts |
+| `repair` | Restore missing patch data or damaged vendored artifacts and clean unused data |
+| `scan --mode agent --prune` | Patch discovered packages and remove records for dependencies that left the project |
+
+Use `--dry-run` to preview. `rollback --preserve-state` and
+`remove --preserve-state` restore dependencies while keeping local patch records
+and artifacts for later reuse. Hosted pins have no local state to preserve.
+`remove --skip-rollback` removes tracking without restoring installed files and
+cannot be combined with `--preserve-state`.
+
+Hosted reversal resolves original registry entries; it does not replay saved file
+snapshots. It needs upstream access and can refuse an unsupported or drifted entry.
+Hosted binary `bun.lockb` reversal requires restoring the lockfile from version
+control. Review and restore any companion manifest or registry-config changes too.
+A package converted from hosted to vendored returns to upstream on `vendor --revert`.
+
+Vendored reversal preserves unrelated edits and refuses unsafe drift. Keep its
+ledger with the artifacts. Full details and per-ecosystem restoration limits are in
+the [rollback contract](../crates/socket-patch-cli/CLI_CONTRACT.md#rollback-command-contract-v50).
diff --git a/scripts/backtest-uv.py b/scripts/backtest-uv.py
index 38be686d..308c2f7d 100644
--- a/scripts/backtest-uv.py
+++ b/scripts/backtest-uv.py
@@ -1285,9 +1285,9 @@ def paragraph(text):
         f"untouched — and **{len(lock_changed)} changed the lock**. `--frozen` "
         f"never writes the lock, so the {len(locked_rows)} `--locked` rows are the "
         f"ones that measure preservation; {locked_ok} of them exited 0. The "
-        "[machine-readable results](uv-compatibility/results.json) contain all "
+        "machine-readable results JSON contains all "
         f"{len(all_obs)} observations and their command definitions. The "
-        "[binary catalog](uv-compatibility/binaries.json) records each uv wheel's "
+        "binary catalog records each uv wheel's "
         "public PyPI source and verified hash."
     )
     paragraph(

From ae775fb50b1f84d4ae5e747ad01fddc2249ef3d5 Mon Sep 17 00:00:00 2001
From: Mikola Lysenko <mikolalysenko@gmail.com>
Date: Wed, 30 Sep 2026 13:28:16 +0200
Subject: [PATCH 32/32] feat(v5): implement vendored Maven reactors and Gradle
 builds (#287)

* Add the vendored Maven and Gradle design

Vendored Maven today works for a single pom.xml only. It refuses
multi-module reactors and Gradle builds, which covers most enterprise
Java. This design says how vendored mode should handle both without
dropping any Maven or Gradle version that works today.

- Maven uses the server's suffixed version (<v>-socket.<hex8>), found
  through a committed maven2 tree. Maven 3.9.2+ reads it through
  maven.repo.local.tail; every version also gets a file:// fallback
  repository and dependencyManagement pins in each local root pom.
- Gradle keeps the same coordinates. One owned settings script, applied
  by one line, adds an exclusiveContent file repository and checks the
  vendored files' sha256 on every configuration. Lockfiles, catalogs
  and build.gradle files are never edited.
- Build-time Maven pins (trusted checksums, deny lines) are opt-in for
  later. The adversarial review found crashes and silent no-ops in
  them on common Maven versions.

The doc includes the supported-shapes matrix, the failure modes, the
refusal-code mapping, the migration plan, the server/CLI split, the
test plan, the panel scores and the adversarial review findings.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019ZLLAZfofQZ2ywkgrHkdEZ

* Drop unused rollback fixture hash fields

Workspace clippy with -D warnings failed on two fields of the
covgap_commands_rollback fixture that nothing reads. The hashes are
still computed and used to stage the manifest and blobs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019ZLLAZfofQZ2ywkgrHkdEZ

* Prototype vendored Maven reactors and Gradle

Vendored Maven refuses multi-module reactors and Gradle builds today.
With SOCKET_PATCH_EXPERIMENTAL_JVM_VENDOR=1 set, those two shapes now
go to a new backend (vendor/jvm) that implements the v5.0 cut of
docs/design/maven-vendoring.md. With the variable unset, nothing that
vendors today behaves differently.

- Maven reactor: pins the server's suffixed version in every local
  root pom and rewrites literal and property declarations (including
  in profiles and middle parents). Adds one shared file:// fallback
  repository, two .mvn/maven.config lines (offline file protocol and
  maven.repo.local.tail) and a committed maven2 tree.
- Gradle: keeps the same coordinates. One apply line per settings
  file (root, buildSrc, literal includeBuild) loads an owned script.
  It adds an exclusiveContent file repository and fails configuration
  if a vendored file's sha256 no longer matches the index. Lockfiles,
  catalogs and build scripts are never edited; an existing
  verification-metadata.xml gets the patched hash.
- Revert is per fragment and byte-exact in any order. Shared pieces
  stay until no other patch uses them. Re-runs, patch updates,
  --preserve-state, the cold-cache fast path, VEX liveness and
  repair all handle the new trees.

The real-tool capstones (e2e_vendor_jvm_build, ignored by default)
build a reactor and a locked Kotlin DSL Gradle build offline from a
fresh checkout. They pass on Maven 3.8.8 to 4.0.0-rc-7 and Gradle
6.9.4 to 9.8.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019ZLLAZfofQZ2ywkgrHkdEZ

* Keep rollback fixture hashes for the macOS test

The previous commit dropped two fixture fields to quiet clippy on
Linux. A macOS-only test reads them, so the macOS test build broke.
Restore the fields and allow dead code on other platforms instead.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019ZLLAZfofQZ2ywkgrHkdEZ

* Check out the Gradle settings script byte for byte

The owned Gradle script is embedded with include_str! and written into
user repos as is. A Windows checkout with autocrlf turned it into CRLF,
so Windows builds would write different script bytes (and the script
sanity test failed there). Mark it -text like the other byte-exact
files.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019ZLLAZfofQZ2ywkgrHkdEZ

* feat: complete v5 Maven reactor and Gradle vendoring

* test: close v5 validation gaps and require JVM toolchains

* test: align v5 help and canonical restore goldens

* test: make JVM build capstones portable on Windows

* ci: extract Maven without interpreting Windows drives as hosts

* ci: use native-path Maven extraction and parallelize build checks

* test: normalize paths in Gradle integrity diagnostics

---------

Co-authored-by: Claude <noreply@anthropic.com>
---
 .gitattributes                                |    4 +
 .github/workflows/ci.yml                      |   59 +-
 CHANGELOG.md                                  |    6 +
 README.md                                     |    4 +
 crates/socket-patch-cli/CLI_CONTRACT.md       |   26 +-
 crates/socket-patch-cli/src/args.rs           |    7 +
 .../socket-patch-cli/src/commands/vendor.rs   |  207 +-
 .../src/commands/vex_sources.rs               |   17 +
 .../socket-patch-cli/tests/cli_global_args.rs |   14 +-
 .../tests/covgap_commands_vendor.rs           |    2 +
 .../tests/e2e_vendor_composer_build.rs        |    3 +-
 .../tests/e2e_vendor_jvm_build.rs             | 1040 +++++
 .../tests/in_process_rollback_vendored.rs     |    2 +
 .../tests/in_process_vendor.rs                |    2 +
 .../socket-patch-cli/tests/vendor_jvm_cli.rs  |  676 +++
 .../src/api/vendor_prefetch.rs                |    1 +
 .../src/utils/group_commit.rs                 |   15 +-
 crates/socket-patch-core/src/vendor/cargo.rs  |    1 +
 .../src/vendor/composer_lock.rs               |    1 +
 crates/socket-patch-core/src/vendor/gem.rs    |    1 +
 crates/socket-patch-core/src/vendor/golang.rs |    1 +
 .../socket-patch-core/src/vendor/jvm/apply.rs | 1293 ++++++
 .../src/vendor/jvm/archive.rs                 |  140 +
 .../jvm/fixtures/repack/archiver-7.0.1.jar    |  Bin 0 -> 433 bytes
 .../vendor/jvm/fixtures/repack/generate.cjs   |   17 +
 .../src/vendor/jvm/gradle.rs                  | 2935 ++++++++++++
 .../src/vendor/jvm/maven_reactor.rs           | 3949 +++++++++++++++++
 .../socket-patch-core/src/vendor/jvm/mod.rs   |  609 +++
 .../vendor/jvm/socket-patch.settings.gradle   |   66 +
 .../src/vendor/maven_repo.rs                  | 1054 ++++-
 crates/socket-patch-core/src/vendor/mod.rs    |    3 +
 .../src/vendor/npm_common.rs                  |    1 +
 .../socket-patch-core/src/vendor/npm_lock.rs  |    1 +
 .../src/vendor/nuget_feed.rs                  |    4 +
 crates/socket-patch-core/src/vendor/pypi.rs   |    1 +
 .../src/vendor/service_fetch.rs               |    2 +
 .../src/vendor/test_support.rs                |    1 +
 crates/socket-patch-core/src/vendor/verify.rs |    8 +-
 .../src/vex/discover/maven.rs                 |   17 +
 .../socket-patch-core/src/vex/discover/mod.rs |    5 +
 .../restored/composer.lock                    |   39 +
 .../dist-mirrors/restored/composer.lock       |   39 +
 .../source-after-dist/restored/composer.lock  |   42 +
 .../source-before-name/restored/composer.lock |   39 +
 .../source-last-key/restored/composer.lock    |   39 +
 .../restored/composer.lock                    |   42 +
 .../tests/upstream_restore_golden.rs          |    8 +-
 docs/design/maven-vendoring.md                |  176 +
 docs/ecosystems.md                            |    9 +-
 docs/testing/README.md                        |    1 +
 docs/usage.md                                 |   18 +
 51 files changed, 12587 insertions(+), 60 deletions(-)
 create mode 100644 crates/socket-patch-cli/tests/e2e_vendor_jvm_build.rs
 create mode 100644 crates/socket-patch-cli/tests/vendor_jvm_cli.rs
 create mode 100644 crates/socket-patch-core/src/vendor/jvm/apply.rs
 create mode 100644 crates/socket-patch-core/src/vendor/jvm/archive.rs
 create mode 100644 crates/socket-patch-core/src/vendor/jvm/fixtures/repack/archiver-7.0.1.jar
 create mode 100644 crates/socket-patch-core/src/vendor/jvm/fixtures/repack/generate.cjs
 create mode 100644 crates/socket-patch-core/src/vendor/jvm/gradle.rs
 create mode 100644 crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs
 create mode 100644 crates/socket-patch-core/src/vendor/jvm/mod.rs
 create mode 100644 crates/socket-patch-core/src/vendor/jvm/socket-patch.settings.gradle
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/composer/composer-lock/dist-mirrors-before-url/restored/composer.lock
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/composer/composer-lock/dist-mirrors/restored/composer.lock
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/composer/composer-lock/source-after-dist/restored/composer.lock
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/composer/composer-lock/source-before-name/restored/composer.lock
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/composer/composer-lock/source-last-key/restored/composer.lock
 create mode 100644 crates/socket-patch-core/tests/fixtures/redirect/composer/composer-lock/source-not-adjacent/restored/composer.lock
 create mode 100644 docs/design/maven-vendoring.md

diff --git a/.gitattributes b/.gitattributes
index 85808065..e27b01a6 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -29,3 +29,7 @@ crates/socket-patch-core/tests/fixtures/vendor/** -text
 # compares the result byte for byte, so a CRLF checkout would change both
 # the replayed wiring files and the expected revert.
 crates/socket-patch-cli/tests/fixtures/legacy-ledgers/** -text
+
+# The owned Gradle settings script is embedded with include_str! and
+# written into user repos byte for byte; a CRLF checkout would change it.
+crates/socket-patch-core/src/vendor/jvm/socket-patch.settings.gradle -text
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0d51607c..d1c1f16a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -729,7 +729,8 @@ jobs:
           retention-days: 3
 
   e2e:
-    needs: [test, e2e-build]
+    # These jobs consume e2e-build's binaries and can run alongside unit tests.
+    needs: [e2e-build]
     strategy:
       fail-fast: false
       matrix:
@@ -1069,6 +1070,18 @@ jobs:
           - {os: ubuntu-latest, suite: e2e_vendor_maven_build, maven: '3.9.16'}
           - {os: ubuntu-latest, suite: e2e_vendor_maven_build, maven: '4.0.0-rc-6'}
           - {os: macos-latest, suite: e2e_vendor_maven_build, maven: '3.9.16'}
+          - {os: ubuntu-latest, suite: e2e_vendor_jvm_build, maven: '3.6.3', test_filter: '--ignored maven_reactor'}
+          - {os: ubuntu-latest, suite: e2e_vendor_jvm_build, maven: '3.8.9', test_filter: '--ignored maven_reactor'}
+          - {os: ubuntu-latest, suite: e2e_vendor_jvm_build, maven: '3.9.2', test_filter: '--ignored maven_reactor'}
+          - {os: ubuntu-latest, suite: e2e_vendor_jvm_build, maven: '3.9.16', test_filter: '--ignored maven_reactor'}
+          - {os: ubuntu-latest, suite: e2e_vendor_jvm_build, maven: '4.0.0-rc-6', test_filter: '--ignored maven_reactor'}
+          - {os: macos-latest, suite: e2e_vendor_jvm_build, maven: '3.9.16', test_filter: '--ignored maven_reactor'}
+          - {os: windows-latest, suite: e2e_vendor_jvm_build, maven: '3.9.16', test_filter: '--ignored maven_reactor'}
+          - {os: ubuntu-latest, suite: e2e_vendor_jvm_build, gradle: '6.9.4', java: '11', test_filter: '--ignored gradle_multi_project'}
+          - {os: ubuntu-latest, suite: e2e_vendor_jvm_build, gradle: '7.6.4', java: '17', test_filter: '--ignored gradle_multi_project'}
+          - {os: ubuntu-latest, suite: e2e_vendor_jvm_build, gradle: '8.14.3', java: '17', test_filter: '--ignored gradle_multi_project'}
+          - {os: ubuntu-latest, suite: e2e_vendor_jvm_build, gradle: '9.8.0', java: '17', test_filter: '--ignored gradle_multi_project'}
+          - {os: windows-latest, suite: e2e_vendor_jvm_build, gradle: '8.14.3', java: '17', test_filter: '--ignored gradle_multi_project'}
           # Real .NET SDK capstones: hosted + vendored nuget, one leg per SDK
           # major (the suite pins the major through a sandbox global.json):
           # the oldest and newest here, 7-9 on ubuntu in e2e-full.
@@ -1238,28 +1251,46 @@ jobs:
           php-version: '8.2'
           tools: composer:${{ matrix.composer }}
 
-      - name: Setup Java (Maven legs)
-        if: matrix.maven != ''
+      - name: Setup Java (Maven and Gradle legs)
+        if: matrix.maven != '' || matrix.gradle != ''
         uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: temurin
-          java-version: '17'
+          java-version: ${{ matrix.java || '17' }}
 
-      - name: Install Maven ${{ matrix.maven }}
-        if: matrix.maven != ''
+      - name: Install Maven ${{ matrix.maven || '3.9.16' }}
+        if: matrix.maven != '' || matrix.gradle != ''
         # Straight from the Apache archive (sha512-verified), so a leg gets
         # exactly the release it names rather than the runner's Maven.
         shell: bash
         env:
-          MAVEN_VERSION: ${{ matrix.maven }}
+          MAVEN_VERSION: ${{ matrix.maven || '3.9.16' }}
         run: |
           major="${MAVEN_VERSION%%.*}"
           url="https://archive.apache.org/dist/maven/maven-${major}/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz"
           curl -fsSL --retry 3 "$url" -o "$RUNNER_TEMP/maven.tgz"
-          sum="$(curl -fsSL --retry 3 "$url.sha512" | cut -d' ' -f1)"
-          echo "$sum  $RUNNER_TEMP/maven.tgz" | shasum -a 512 -c -
-          tar -xzf "$RUNNER_TEMP/maven.tgz" -C "$RUNNER_TEMP"
-          echo "SOCKET_PATCH_MAVEN_E2E_MVN=$RUNNER_TEMP/apache-maven-${MAVEN_VERSION}/bin/mvn" >> "$GITHUB_ENV"
+          curl -fsSL --retry 3 "$url.sha512" -o "$RUNNER_TEMP/maven.sha512"
+          python -c 'import hashlib, pathlib, os; p=pathlib.Path(os.environ["RUNNER_TEMP"]); assert hashlib.sha512((p/"maven.tgz").read_bytes()).hexdigest() == (p/"maven.sha512").read_text().split()[0]'
+          # Python accepts native Windows paths for both archive and destination.
+          python -m tarfile -e "$RUNNER_TEMP/maven.tgz" "$RUNNER_TEMP"
+          launcher="$RUNNER_TEMP/apache-maven-${MAVEN_VERSION}/bin/mvn"
+          if [ "$RUNNER_OS" = Windows ]; then launcher="${launcher}.cmd"; fi
+          echo "SOCKET_PATCH_MAVEN_E2E_MVN=$launcher" >> "$GITHUB_ENV"
+
+      - name: Install Gradle ${{ matrix.gradle }}
+        if: matrix.gradle != ''
+        shell: bash
+        env:
+          GRADLE_VERSION: ${{ matrix.gradle }}
+        run: |
+          url="https://services.gradle.org/distributions/gradle-${GRADLE_VERSION}-bin.zip"
+          curl -fsSL --retry 3 "$url" -o "$RUNNER_TEMP/gradle.zip"
+          curl -fsSL --retry 3 "$url.sha256" -o "$RUNNER_TEMP/gradle.sha256"
+          python -c 'import hashlib, pathlib, os; p=pathlib.Path(os.environ["RUNNER_TEMP"]); assert hashlib.sha256((p/"gradle.zip").read_bytes()).hexdigest() == (p/"gradle.sha256").read_text().strip()'
+          unzip -q "$RUNNER_TEMP/gradle.zip" -d "$RUNNER_TEMP"
+          launcher="$RUNNER_TEMP/gradle-${GRADLE_VERSION}/bin/gradle"
+          if [ "$RUNNER_OS" = Windows ]; then launcher="${launcher}.bat"; fi
+          echo "SOCKET_PATCH_GRADLE_E2E_GRADLE=$launcher" >> "$GITHUB_ENV"
 
       - name: Setup .NET SDK
         if: matrix.dotnet != ''
@@ -1363,8 +1394,10 @@ jobs:
           SOCKET_PATCH_BUNDLER_E2E_VERSION: ${{ matrix.bundler }}
           SOCKET_PATCH_COMPOSER_E2E_REQUIRED: ${{ matrix.composer != '' && '1' || '' }}
           SOCKET_PATCH_COMPOSER_E2E_VERSION: ${{ matrix.composer }}
-          SOCKET_PATCH_MAVEN_E2E_REQUIRED: ${{ matrix.maven != '' && '1' || '' }}
-          SOCKET_PATCH_MAVEN_E2E_VERSION: ${{ matrix.maven }}
+          SOCKET_PATCH_MAVEN_E2E_REQUIRED: ${{ (matrix.maven != '' || matrix.gradle != '') && '1' || '' }}
+          SOCKET_PATCH_MAVEN_E2E_VERSION: ${{ matrix.maven || (matrix.gradle != '' && '3.9.16') || '' }}
+          SOCKET_PATCH_GRADLE_E2E_REQUIRED: ${{ matrix.gradle != '' && '1' || '' }}
+          SOCKET_PATCH_GRADLE_E2E_VERSION: ${{ matrix.gradle }}
           SOCKET_PATCH_DOTNET_E2E_REQUIRED: ${{ matrix.dotnet != '' && '1' || '' }}
           SOCKET_PATCH_DOTNET_E2E_VERSION: ${{ matrix.dotnet }}
           SOCKET_PATCH_DENO_E2E_REQUIRED: ${{ matrix.deno != '' && '1' || '' }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 028853db..e80101ac 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -70,6 +70,12 @@ and `vendor` (committed patched packages), with `list` for inspection. See the
 
 ### Added
 
+- Vendored Maven reactors and Gradle builds, with committed repositories,
+  reversible wiring, repair, rollback, and VEX. Reactors use suffixed versions;
+  Gradle preserves coordinates and lockfiles, checks artifact hashes, and updates
+  existing verification metadata. `vendor --check` audits artifacts and wiring
+  offline; `--local-repo` checks Maven cache conflicts and `--maven-config=none`
+  selects the fallback file repository. Single-POM vendoring is unchanged.
 - `socket.yml` patch policy for paths, ecosystems, packages, severity, and per-run
   limits. `scan --package`, `--min-severity`, `--max-new-patches`, and
   `--no-socket-yml` support targeted and gradual rollout. Already-patched packages
diff --git a/README.md b/README.md
index 07ac2951..e7424641 100644
--- a/README.md
+++ b/README.md
@@ -102,6 +102,10 @@ The CLI supports npm, PyPI, Cargo, Go, RubyGems, Maven, Composer, NuGet, and Den
 Mode and package-manager support vary: Deno uses agent mode, for example. Check the
 [ecosystem support matrix](docs/ecosystems.md) before choosing a mode.
 
+Vendored Maven reactors and Gradle 6.8+ builds are supported. See
+[JVM vendoring](docs/design/maven-vendoring.md) for supported project shapes,
+cache behavior, and offline checks.
+
 ## Common commands
 
 ```sh
diff --git a/crates/socket-patch-cli/CLI_CONTRACT.md b/crates/socket-patch-cli/CLI_CONTRACT.md
index 0a6c90b5..afe5eac1 100644
--- a/crates/socket-patch-cli/CLI_CONTRACT.md
+++ b/crates/socket-patch-cli/CLI_CONTRACT.md
@@ -42,7 +42,7 @@ Rows are in `--help` order (v5.0): the hosted/vendored workflow (`scan` → `vex
 
 ## Global arguments
 
-Every subcommand accepts the same set of "global" flags via a single shared `GlobalArgs` struct that's `#[command(flatten)]`-ed into each per-command struct (`crates/socket-patch-cli/src/args.rs`). Subcommands that don't actually consume a given flag accept it silently — e.g. `list --global` parses fine and is a no-op. Every flag also has an environment-variable binding; precedence is **CLI arg > env var > default** — and for exactly three keys (`--api-token`, `--org`, `--api-url`) the JS socket-cli's persisted login sits between env var and default: **CLI arg > env var (canonical, then `SOCKET_CLI_*` alias) > socket-cli `config.json` > default**. See "Persisted configuration" under Environment variables.
+Every subcommand accepts the same set of "global" flags via a single shared `GlobalArgs` struct that's `#[command(flatten)]`-ed into each per-command struct (`crates/socket-patch-cli/src/args.rs`). Subcommands that don't actually consume a given flag accept it silently — e.g. `list --global` parses fine and is a no-op. For flags with an environment-variable binding, precedence is **CLI arg > env var > default** — and for exactly three keys (`--api-token`, `--org`, `--api-url`) the JS socket-cli's persisted login sits between env var and default: **CLI arg > env var (canonical, then `SOCKET_CLI_*` alias) > socket-cli `config.json` > default**. See "Persisted configuration" under Environment variables.
 
 | Long | Short | Env var | Default | Type | Semantic |
 |---|---|---|---|---|---|
@@ -55,6 +55,7 @@ Every subcommand accepts the same set of "global" flags via a single shared `Glo
 | `--ecosystems` | `-e` | `SOCKET_ECOSYSTEMS` | (all) | CSV → `Vec<String>` | Restrict to these ecosystems |
 | `--download-mode` | — | `SOCKET_DOWNLOAD_MODE` | **`diff`** | enum: `diff` \| `file` (`package` was removed and is rejected) | Patch artifact format |
 | `--vendor-source` | — | `SOCKET_VENDOR_SOURCE` | **`auto`** | enum: `auto` \| `service` \| `build` | How `vendor` acquires the installable artifact (see "Prebuilt vendor artifacts") |
+| `--maven-config` | — | — | (recorded choice, else `auto`) | enum: `auto` \| `none` | Maven reactor vendoring: write the repository tail (`auto`) or use only the fallback file repository (`none`). The choice persists in the vendor ledger. |
 | `--vendor-url` | — | `SOCKET_VENDOR_URL` | (active API/proxy base) | string | Base host for the vendoring-service package-reference request |
 | `--patch-server-url` | — | `SOCKET_PATCH_SERVER_URL` | (server-returned) | string | Override the host of the prebuilt-archive download URL (local-dev / testing) |
 | `--offline` | — | `SOCKET_OFFLINE` | `false` | bool | **Strict airgap on every command** — never contact the network |
@@ -87,6 +88,8 @@ Beyond the globals above, each subcommand defines a small set of local arguments
 | `apply` | `--check` | — | Read-only audit that the committed **Go** `replace`-redirects match the manifest (CI / GitHub-App auditing) — Go ONLY (cargo patches in place, so there is no redirect to audit). Lock-free, crawl-free, offline-safe; exits 0 in sync, 1 on drift. Vendored modules are excluded from the audit |
 | `vendor` | `--force` / `-f` | `SOCKET_FORCE` | Tolerate missing patch-target files in the stage + bypass the variant probe. A beforeHash mismatch no longer needs it: vendor staging auto-overwrites with the verified patched content (`vendor_content_mismatch_overwritten` warning) |
 | `vendor` | `--revert` | `SOCKET_VENDOR_REVERT` | Undo vendoring: restore recorded original lockfile fragments + remove `.socket/vendor/` artifacts. Works without a manifest. A package vendored over a hosted pin returns to its upstream registry entry, never to hosted (see "Takeover reconciliation") |
+| `vendor` | `--check` | — | Offline, read-only artifact and wiring audit; exits 1 on drift. Conflicts with `--revert`. |
+| `vendor` | `--local-repo <path>` | — | With `--check`, also inspect suffixed Maven jar/POM copies in this cache for conflicts. |
 | `apply`, `scan`, `vendor` | `--vex` | `SOCKET_VEX` | Generate an OpenVEX 0.2.0 document at this path on a successful run; see "embedded VEX" below |
 | `apply`, `scan`, `vendor` | `--vex-product`, `--vex-no-verify`, `--vex-doc-id`, `--vex-compact` | `SOCKET_VEX_PRODUCT`, `SOCKET_VEX_NO_VERIFY`, `SOCKET_VEX_DOC_ID`, `SOCKET_VEX_COMPACT` | Passthrough to the embedded VEX builder; mirror the standalone `vex` knobs. Inert unless `--vex` is set |
 | `scan` | positional `[PATHS]...` | — | (v5.0) Meaning depends on the mode. **Hosted / vendored** (bare `scan` included): each PATH, or directory glob (`apps/*`), is a project directory scanned on its own as if it were `--cwd`. **Agent** (and a mode-less `--prune`/`--global` report): path globs scoping DISCOVERY to packages installed under matching paths (`packages/foo`, `apps/**`). See "Path-scoped scans" below |
@@ -1722,3 +1725,24 @@ Every item in this document is locked in by at least one of:
 - **Async `run()` integration tests** in `tests/cli_parse_list.rs`, `tests/cli_parse_remove.rs` — exercise the no-network error paths and assert JSON shape via `serde_json::from_str::<Value>` + per-key assertions.
 
 If you add a new flag/subcommand/JSON key, add a test here that locks the new surface in the same PR.
+
+
+### Vendored JVM support (v5)
+
+Maven reactors and Gradle 6.8+ route to the JVM backend automatically. Ledger
+entries use ecosystem `jvm` with Maven PURLs. Revert, remove, rollback and repair
+share the v5 vendored backend; existing prototype wiring remains readable.
+See [the JVM design](../../docs/design/maven-vendoring.md) for supported shapes.
+
+`vendor --check` is an offline, read-only audit. Healthy entries emit `verified`
+with `vendor_check_ok`; drift emits `failed` with `vendor_check_failed`, a
+`partialFailure` envelope and exit 1. Missing ledger entries fail with
+`vendor_ledger_missing`. Offline upstream metadata is reported as the run warning
+`vendor_jvm_upstream_unverified`. The check never starts an API client or writes
+lock/recovery files. `--check` conflicts with `--revert`.
+
+`vendor --check --local-repo <path>` additionally checks existing suffixed Maven
+jar/POM copies for conflicting bytes. `--maven-config auto|none` is a global
+vendoring option so scan/get/repair receive it too; omission preserves the
+ledger's recorded choice. Switching existing auto-config wiring to `none`
+requires reverting it first. `none` cannot be combined with a repository ban.
diff --git a/crates/socket-patch-cli/src/args.rs b/crates/socket-patch-cli/src/args.rs
index 412ed9d7..13731f26 100644
--- a/crates/socket-patch-cli/src/args.rs
+++ b/crates/socket-patch-cli/src/args.rs
@@ -176,6 +176,11 @@ pub struct GlobalArgs {
     )]
     pub vendor_source: String,
 
+    /// Vendored Maven: auto writes the repository tail; none uses only the file repository.
+    /// The choice is preserved on subsequent runs.
+    #[arg(help_heading = GLOBAL_OPTIONS, long, value_parser = ["auto", "none"])]
+    pub maven_config: Option<String>,
+
     /// Base URL for the patch vendoring service. Defaults to the active API base (`--api-url`) when
     /// authenticated or the proxy base (`--proxy-url`) otherwise. Override to
     /// point `vendor` at staging / local dev independently of `--api-url`.
@@ -507,6 +512,7 @@ impl GlobalArgs {
         use_public_proxy: bool,
     ) -> VendorServiceConfig {
         VendorServiceConfig {
+            maven_config: self.maven_config.as_deref().map(|v| v != "none"),
             source: VendorSource::parse(&self.vendor_source).unwrap_or_default(),
             client,
             use_public_proxy,
@@ -675,6 +681,7 @@ impl Default for GlobalArgs {
             ecosystems: None,
             download_mode: "diff".to_string(),
             vendor_source: "auto".to_string(),
+            maven_config: None,
             vendor_url: None,
             patch_server_url: None,
             offline: false,
diff --git a/crates/socket-patch-cli/src/commands/vendor.rs b/crates/socket-patch-cli/src/commands/vendor.rs
index a4e60c7e..dfdfedb2 100644
--- a/crates/socket-patch-cli/src/commands/vendor.rs
+++ b/crates/socket-patch-cli/src/commands/vendor.rs
@@ -93,6 +93,14 @@ pub struct VendorArgs {
     )]
     pub revert: bool,
 
+    /// Verify committed artifacts and JVM wiring offline without changing files.
+    #[arg(long, conflicts_with = "revert")]
+    pub check: bool,
+
+    /// Also check suffixed Maven jars in this local repository for conflicting bytes.
+    #[arg(long, requires = "check", hide_short_help = true)]
+    pub local_repo: Option<std::path::PathBuf>,
+
     /// On a successful vendor, also generate an OpenVEX 0.2.0 document
     /// (same contract as `apply --vex`).
     #[command(flatten)]
@@ -168,11 +176,13 @@ pub(crate) async fn dispatch_vendor_one(
     }
     // Maven and NuGet have no registry-fetch rung — `fetch_and_stage` serves
     // no fetcher for either and `stage_local_artifact` is npm-only — so their
-    // source is always the crawler's own directory.
+    // source is the crawler's own directory. A ledger-driven maven re-run on
+    // a cold cache gets a deferred hint instead: the committed tree answers
+    // an in-sync re-run, and anything else refuses for the missing jar.
     macro_rules! vend_installed {
         ($backend:path) => {{
             debug_assert!(
-                matches!(pkg_path, PackageSource::Installed(_)),
+                eco == "maven" || matches!(pkg_path, PackageSource::Installed(_)),
                 "{eco} has no fetch rung; a pending source would need materialising"
             );
             $backend(
@@ -244,7 +254,7 @@ pub(crate) async fn dispatch_revert_one_opts(
         "golang" => vendor::golang::revert_go_vendor_opts(entry, project_root, opts).await,
         "composer" => vendor::composer_lock::revert_composer_opts(entry, project_root, opts).await,
         "nuget" => vendor::nuget_feed::revert_nuget_opts(entry, project_root, opts).await,
-        "maven" => vendor::maven_repo::revert_maven_opts(entry, project_root, opts).await,
+        "maven" | "jvm" => vendor::maven_repo::revert_maven_opts(entry, project_root, opts).await,
         other => RevertOutcome::failed(format!(
             "this build has no vendor backend for ecosystem `{other}`"
         )),
@@ -643,6 +653,9 @@ pub(crate) fn note_classic_migration_risk(
 }
 
 pub async fn run(args: VendorArgs) -> i32 {
+    if args.check {
+        return run_check(&args).await;
+    }
     apply_env_toggles(&args.common);
 
     let manifest_path = args.common.resolved_manifest_path();
@@ -873,6 +886,81 @@ pub async fn run(args: VendorArgs) -> i32 {
     exit
 }
 
+/// Read-only audit: no API client, lock recovery, staging, or telemetry is started.
+async fn run_check(args: &VendorArgs) -> i32 {
+    let root = &args.common.project_root();
+    let local_repo = args.local_repo.as_ref().map(|p| args.common.cwd.join(p));
+    let mut env = Envelope::new(Command::Vendor);
+    let state = match load_state(root).await {
+        Ok(state) => state,
+        Err(e) => {
+            return emit_eject_refusal(&args.common, "vendor_state_unreadable", &e.to_string())
+        }
+    };
+    if state.entries.is_empty()
+        && [
+            ".socket/vendor/maven2",
+            ".socket/vendor/gradle",
+            ".socket/vendor/gradle-index.tsv",
+        ]
+        .iter()
+        .any(|rel| root.join(rel).exists())
+    {
+        return emit_eject_refusal(&args.common, "vendor_ledger_missing", "JVM artifacts exist without a vendor ledger; restore .socket/vendor/state.json from version control");
+    }
+    let manifest_path = args.common.resolved_manifest_path();
+    let manifest = match read_manifest(&manifest_path).await {
+        Ok(m) => m.unwrap_or_default(),
+        Err(e) => return emit_eject_refusal(&args.common, "manifest_unreadable", &e.to_string()),
+    };
+    let mut entries: Vec<_> = state.entries.iter().collect();
+    entries.sort_by_key(|(key, _)| *key);
+    for (key, entry) in entries {
+        let record = entry.record.as_ref().or_else(|| manifest.patches.get(key));
+        let mut failure = match record {
+            Some(record) => match vendor::check_vendored_artifact(root, entry, record).await {
+                vendor::ArtifactHealth::Healthy => None,
+                health => Some(format!("artifact verification failed: {health:?}")),
+            },
+            None => Some("patch record missing; restore the manifest or vendor ledger".to_string()),
+        };
+        if failure.is_none() && vendor::jvm::apply::is_jvm_entry(entry) {
+            failure = vendor::jvm::apply::check_entry(root, entry, local_repo.as_deref()).err();
+        }
+        if vendor::jvm::apply::upstream_unverified(entry) {
+            env.warnings.push(RunWarning {code: "vendor_jvm_upstream_unverified".into(), detail: format!("{key}: upstream metadata was accepted offline; run vendor online to verify registry checksums")});
+        }
+        let event = match failure {
+            Some(reason) => {
+                PatchEvent::new(PatchAction::Failed, key).with_reason("vendor_check_failed", reason)
+            }
+            None => PatchEvent::new(PatchAction::Verified, key)
+                .with_reason("vendor_check_ok", "committed artifact and wiring verified"),
+        };
+        if !args.common.json && (!args.common.silent || event.action == PatchAction::Failed) {
+            println!("{}: {}", key, event.reason.as_deref().unwrap_or("verified"));
+        }
+        env.record(event);
+    }
+    for key in manifest
+        .patches
+        .keys()
+        .filter(|k| !state.entries.contains_key(*k))
+    {
+        if !args.common.json {
+            eprintln!("{key}: patch has no vendored ledger entry");
+        }
+        env.record(PatchEvent::new(PatchAction::Failed, key).with_reason(
+            "vendor_ledger_missing",
+            "patch has no vendored ledger entry",
+        ));
+    }
+    if args.common.json {
+        println!("{}", env.to_pretty_json());
+    }
+    i32::from(env.summary.failed != 0)
+}
+
 /// A refused eject: the JSON error envelope (`status: error`) or an
 /// `Error:` line (printed even under `--silent`). Exit 1; nothing touched.
 fn emit_eject_refusal(common: &GlobalArgs, code: &'static str, message: &str) -> i32 {
@@ -935,7 +1023,11 @@ impl EjectSnapshot {
         let mut out = std::collections::BTreeSet::new();
         for eco in std::fs::read_dir(&base).into_iter().flatten().flatten() {
             if eco.file_type().is_ok_and(|t| t.is_dir()) {
-                for unit in std::fs::read_dir(eco.path()).into_iter().flatten().flatten() {
+                for unit in std::fs::read_dir(eco.path())
+                    .into_iter()
+                    .flatten()
+                    .flatten()
+                {
                     out.insert(unit.path());
                 }
             }
@@ -971,7 +1063,8 @@ impl EjectSnapshot {
             let path = self.root.join(rel);
             let result = match bytes {
                 Some(bytes) => {
-                    socket_patch_core::utils::fs::atomic_write_bytes_preserving_mode(&path, bytes).await
+                    socket_patch_core::utils::fs::atomic_write_bytes_preserving_mode(&path, bytes)
+                        .await
                 }
                 None => match tokio::fs::remove_file(&path).await {
                     Err(e) if e.kind() == std::io::ErrorKind::NotFound => Ok(()),
@@ -1032,7 +1125,11 @@ async fn run_eject(args: &VendorArgs, pins: Vec<HostedPin>) -> i32 {
     if !common.json && !common.silent {
         println!(
             "{} {} into .socket/vendor/...",
-            if common.dry_run { "Would eject" } else { "Ejecting" },
+            if common.dry_run {
+                "Would eject"
+            } else {
+                "Ejecting"
+            },
             plural(pins.len(), "hosted package", "hosted packages")
         );
     }
@@ -1105,8 +1202,14 @@ async fn run_eject(args: &VendorArgs, pins: Vec<HostedPin>) -> i32 {
         if common.json {
             println!("{}", env.to_pretty_json());
         }
-        track_outcomes_for_vendor(true, &env, common.dry_run, api_token.as_deref(), org_slug.as_deref())
-            .await;
+        track_outcomes_for_vendor(
+            true,
+            &env,
+            common.dry_run,
+            api_token.as_deref(),
+            org_slug.as_deref(),
+        )
+        .await;
         return 1;
     }
 
@@ -1147,8 +1250,14 @@ async fn run_eject(args: &VendorArgs, pins: Vec<HostedPin>) -> i32 {
         if common.json {
             println!("{}", env.to_pretty_json());
         }
-        track_outcomes_for_vendor(true, &env, common.dry_run, api_token.as_deref(), org_slug.as_deref())
-            .await;
+        track_outcomes_for_vendor(
+            true,
+            &env,
+            common.dry_run,
+            api_token.as_deref(),
+            org_slug.as_deref(),
+        )
+        .await;
         return 1;
     }
 
@@ -1158,13 +1267,15 @@ async fn run_eject(args: &VendorArgs, pins: Vec<HostedPin>) -> i32 {
         let mut env = Envelope::new(Command::Vendor);
         env.dry_run = true;
         for pin in &pins {
-            env.record(PatchEvent::new(PatchAction::Applied, pin.purl.clone()).with_reason(
-                "eject_planned",
-                format!(
-                    "would restore the upstream registry entry ({}) and vendor the patch",
-                    pin.files.join(", ")
+            env.record(
+                PatchEvent::new(PatchAction::Applied, pin.purl.clone()).with_reason(
+                    "eject_planned",
+                    format!(
+                        "would restore the upstream registry entry ({}) and vendor the patch",
+                        pin.files.join(", ")
+                    ),
                 ),
-            ));
+            );
             if !common.json && !common.silent {
                 println!(
                     "Would eject {} (restore {}, then vendor into .socket/vendor/)",
@@ -1174,12 +1285,16 @@ async fn run_eject(args: &VendorArgs, pins: Vec<HostedPin>) -> i32 {
             }
         }
         if args.vex.vex.is_some() && !common.json && !common.silent {
-            println!("{}", crate::commands::vex::format_vex_dry_run_skip("vendored"));
+            println!(
+                "{}",
+                crate::commands::vex::format_vex_dry_run_skip("vendored")
+            );
         }
         if common.json {
             println!("{}", env.to_pretty_json());
         }
-        track_outcomes_for_vendor(false, &env, true, api_token.as_deref(), org_slug.as_deref()).await;
+        track_outcomes_for_vendor(false, &env, true, api_token.as_deref(), org_slug.as_deref())
+            .await;
         return 0;
     }
 
@@ -1234,7 +1349,10 @@ async fn run_eject(args: &VendorArgs, pins: Vec<HostedPin>) -> i32 {
     if let Some(why) = restore_failure {
         env.mark_error(EnvelopeError::new("redirect_revert_failed", why.clone()));
         if !common.json {
-            eprintln!("Error: {}", crate::commands::rollback::capitalize_first(&why));
+            eprintln!(
+                "Error: {}",
+                crate::commands::rollback::capitalize_first(&why)
+            );
         }
         exit = 1;
     } else {
@@ -1315,7 +1433,10 @@ async fn run_eject(args: &VendorArgs, pins: Vec<HostedPin>) -> i32 {
         if let Some(vex_path) = args.vex.vex.as_ref() {
             if common.dry_run {
                 if !common.json && !common.silent {
-                    println!("{}", crate::commands::vex::format_vex_dry_run_skip("vendored"));
+                    println!(
+                        "{}",
+                        crate::commands::vex::format_vex_dry_run_skip("vendored")
+                    );
                 }
             } else {
                 let params = args.vex.to_build_params();
@@ -1573,6 +1694,32 @@ async fn sweep_stale_artifact(
     stale: StaleArtifact,
 ) {
     let StaleArtifact { candidate, prev } = stale;
+    // A JVM tree is not a uuid dir: the replaced entry's own tree files go,
+    // minus any path a live entry records (a Gradle update rewrites them).
+    if vendor::jvm::apply::is_jvm_entry(&prev) {
+        let removed = if common.dry_run {
+            Ok(false)
+        } else {
+            vendor::jvm::apply::sweep_replaced_tree(&common.cwd, &prev, state.entries.values())
+                .await
+        };
+        match removed {
+            Ok(true) => env.record(
+                PatchEvent::new(PatchAction::Removed, candidate).with_reason(
+                    "vendor_stale_artifact_removed",
+                    "previous patch uuid's vendored artifact removed",
+                ),
+            ),
+            Ok(false) => {}
+            Err(detail) => record_warning(
+                env,
+                &candidate,
+                &VendorWarning::new("vendor_stale_artifact_kept", detail),
+                common,
+            ),
+        }
+        return;
+    }
     let still_referenced = state
         .entries
         .values()
@@ -3011,7 +3158,12 @@ pub(crate) async fn vendor_records_reusing(
                     continue;
                 }
                 for (code, detail) in &restore.warnings {
-                    record_warning(env, candidate, &VendorWarning::new(code, detail.clone()), common);
+                    record_warning(
+                        env,
+                        candidate,
+                        &VendorWarning::new(code, detail.clone()),
+                        common,
+                    );
                 }
                 if common.dry_run {
                     record_warning(
@@ -3681,7 +3833,12 @@ async fn run_revert(args: &VendorArgs, env: &mut Envelope) -> i32 {
     // reconcile): dispatch → drift-keep → per-entry ledger save. Only the
     // event vocabulary and the human lines are this command's.
     let reverted = VendoredBackend::new(common, None)
-        .revert(&recorded, &mut state, RevertOpts::new(common.dry_run), false)
+        .revert(
+            &recorded,
+            &mut state,
+            RevertOpts::new(common.dry_run),
+            false,
+        )
         .await;
     for RevertedEntry {
         key: purl,
@@ -4183,7 +4340,11 @@ mod plan_gate_tests {
         .unwrap();
         let packages = [
             ("pkg:composer/psr/cache@1.0.0", "psr/cache", UUID_A),
-            ("pkg:composer/psr/http-message@1.1.0", "psr/http-message", UUID_B),
+            (
+                "pkg:composer/psr/http-message@1.1.0",
+                "psr/http-message",
+                UUID_B,
+            ),
             ("pkg:composer/psr/log@3.0.2", "psr/log", UUID_C),
         ];
         let mut all_packages: Vec<(String, StagedSource)> = Vec::new();
diff --git a/crates/socket-patch-cli/src/commands/vex_sources.rs b/crates/socket-patch-cli/src/commands/vex_sources.rs
index 71992387..174c0f00 100644
--- a/crates/socket-patch-cli/src/commands/vex_sources.rs
+++ b/crates/socket-patch-cli/src/commands/vex_sources.rs
@@ -338,6 +338,23 @@ pub(crate) async fn plan(common: &GlobalArgs, sources: Sources, assume_live: &[S
     let mut liveness = LedgerLiveness::new(root, &discovery, redirect.as_ref());
     let mut based: Vec<(Cand, Basis)> = Vec::new();
     for mut cand in cands {
+        if let Some(entry) = cand
+            .vendor_entry
+            .as_ref()
+            .filter(|e| socket_patch_core::vendor::jvm::apply::is_jvm_entry(e))
+        {
+            if let Err(detail) =
+                socket_patch_core::vendor::jvm::apply::entry_wired_checked(root, entry)
+            {
+                const CODE: &str = "vendor_jvm_shape_unsupported";
+                gated.push(failed(&cand.key, CODE));
+                notes.push(note(
+                    CODE,
+                    format!("{}: cannot establish JVM wiring: {detail}", cand.key),
+                ));
+                continue;
+            }
+        }
         let basis = if let Some(vref) = cand
             .discovered
             .iter()
diff --git a/crates/socket-patch-cli/tests/cli_global_args.rs b/crates/socket-patch-cli/tests/cli_global_args.rs
index cb1bc8fd..3a19ef43 100644
--- a/crates/socket-patch-cli/tests/cli_global_args.rs
+++ b/crates/socket-patch-cli/tests/cli_global_args.rs
@@ -87,6 +87,9 @@ fn global_flag_cases() -> Vec<(&'static str, Option<&'static str>, fn(&GlobalArg
         ("--download-mode", Some("file"), |c| {
             assert_eq!(c.download_mode, "file")
         }),
+        ("--maven-config", Some("none"), |c| {
+            assert_eq!(c.maven_config.as_deref(), Some("none"))
+        }),
         ("--vendor-source", Some("service"), |c| {
             assert_eq!(c.vendor_source, "service")
         }),
@@ -237,13 +240,14 @@ fn global_flag_cases_cover_every_global_field() {
         vendor_source: _,
         vendor_url: _,
         patch_server_url: _,
+        maven_config: _,
     } = common;
 
-    // 26 fields ↔ 26 long-flag cases. Bump both this count and add a case when
+    // 27 fields ↔ 27 long-flag cases. Bump both this count and add a case when
     // the destructure above forces you to add a field.
     assert_eq!(
         global_flag_cases().len(),
-        26,
+        27,
         "every GlobalArgs field needs a long-flag case in global_flag_cases()",
     );
 
@@ -767,7 +771,11 @@ fn empty_nonbool_env_vars_do_not_crash_the_binary() {
         envelope["status"], "success",
         "blank env vars must fall back to defaults: {envelope}",
     );
-    assert_eq!(out.status.code(), Some(0), "an empty project lists with exit 0");
+    assert_eq!(
+        out.status.code(),
+        Some(0),
+        "an empty project lists with exit 0"
+    );
 }
 
 /// `save_and_clear_global_env` must clear **every** env var `GlobalArgs`
diff --git a/crates/socket-patch-cli/tests/covgap_commands_vendor.rs b/crates/socket-patch-cli/tests/covgap_commands_vendor.rs
index b079903f..b8f62b99 100644
--- a/crates/socket-patch-cli/tests/covgap_commands_vendor.rs
+++ b/crates/socket-patch-cli/tests/covgap_commands_vendor.rs
@@ -162,6 +162,8 @@ fn vendor_args(cwd: &Path) -> VendorArgs {
         },
         force: false,
         revert: false,
+        check: false,
+        local_repo: None,
         vex: Default::default(),
     }
 }
diff --git a/crates/socket-patch-cli/tests/e2e_vendor_composer_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_composer_build.rs
index a42519e9..ce903692 100644
--- a/crates/socket-patch-cli/tests/e2e_vendor_composer_build.rs
+++ b/crates/socket-patch-cli/tests/e2e_vendor_composer_build.rs
@@ -1364,7 +1364,8 @@ fn composer_vendor_keeps_files_mirror_filters_would_drop() {
         "vendor failed.\nstdout:\n{stdout}\nstderr:\n{stderr}"
     );
     assert!(
-        stderr.contains("Warning (vendor_composer_mirror_filters_neutralized)"),
+        stderr.contains("Warning:")
+            && stderr.contains("Composer's path mirror would have skipped files"),
         "the neutralization is surfaced:\n{stderr}"
     );
     assert!(
diff --git a/crates/socket-patch-cli/tests/e2e_vendor_jvm_build.rs b/crates/socket-patch-cli/tests/e2e_vendor_jvm_build.rs
new file mode 100644
index 00000000..748793ed
--- /dev/null
+++ b/crates/socket-patch-cli/tests/e2e_vendor_jvm_build.rs
@@ -0,0 +1,1040 @@
+//! Real-tool capstones for the v5 JVM vendored backend
+//! (`docs/design/maven-vendoring.md`): Maven reactors and Gradle builds.
+//!
+//! Both start from the ACTUAL registry bytes of `commons-text:1.10.0` (see
+//! `maven_build_common`), stage a marker patch on its `META-INF/NOTICE.txt`
+//! (manifest + blob), run the real binary's `vendor --json --offline`, and:
+//!
+//! * **Maven reactor** — an aggregator root, a separate corp parent module
+//!   and two modules (`a` declares the base literally, with CRLF + tabs;
+//!   `b` reaches it only through sibling `a`). The plan's edits are asserted
+//!   exactly (2-line `.mvn/maven.config`, the `maven2` tree, the corp
+//!   parent's repository + pin, `a`'s rewrite, aggregator and `b`
+//!   untouched). A fresh checkout with commons-text purged from the local
+//!   repository then builds offline from the root and from `cd a`, and
+//!   every resolved classpath carries the vendored suffixed jar with the
+//!   patched NOTICE. `vendor --revert` restores every file byte-for-byte.
+//! * **Gradle multi-project** — Kotlin DSL settings with
+//!   `FAIL_ON_PROJECT_REPOS` and `mavenCentral()`, `app` → `lib`, STRICT
+//!   `lockAllConfigurations()` with lockfiles written before vendoring. After
+//!   vendoring the lockfiles are byte-unchanged, `:app` runtimeClasspath
+//!   resolves the vendored jar online and `--offline`, a tampered vendored
+//!   jar fails the build with the socket-patch message, and
+//!   `vendor --revert` is byte-exact.
+//!
+//! Gated like the other real-toolchain capstones: `#[ignore]` (network to
+//! Maven Central), Maven via `SOCKET_PATCH_MAVEN_E2E_{MVN,VERSION,REQUIRED}`
+//! (`maven_build_common`), Gradle via `SOCKET_PATCH_GRADLE_E2E_GRADLE` (the
+//! launcher; default `gradle` on `PATH`), `SOCKET_PATCH_GRADLE_E2E_VERSION`
+//! (the version it must report) and `SOCKET_PATCH_GRADLE_E2E_REQUIRED` (no
+//! SKIP). Scratch trees go under `TMPDIR`.
+
+#[path = "maven_build_common/mod.rs"]
+mod maven_build_common;
+
+use std::collections::BTreeMap;
+use std::ffi::OsString;
+use std::path::{Path, PathBuf};
+use std::process::{Command, Output};
+
+use maven_build_common::*;
+
+const UUID: &str = "1d3c1fd2-7b4e-4c1a-9f0e-2a3b4c5d6e7f";
+const SV: &str = "1.10.0-socket.1d3c1fd2";
+
+const GRADLE_ENV: &str = "SOCKET_PATCH_GRADLE_E2E_GRADLE";
+const GRADLE_VERSION_ENV: &str = "SOCKET_PATCH_GRADLE_E2E_VERSION";
+const GRADLE_REQUIRED_ENV: &str = "SOCKET_PATCH_GRADLE_E2E_REQUIRED";
+
+/// The classpath probe. Not [`DEPENDENCY_PLUGIN`]: 3.6.x itself depends on
+/// `commons-text:1.10.0` (3.5.0 on 1.3), so purging the fixture version from
+/// the local repository would break the plugin realm, not the project.
+const CLASSPATH_PLUGIN: &str = "org.apache.maven.plugins:maven-dependency-plugin:3.5.0";
+
+/// Directories a build writes that a checkout never carries.
+const BUILD_OUTPUT_DIRS: &[&str] = &["target", "build", ".gradle", ".kotlin"];
+
+fn binary() -> PathBuf {
+    env!("CARGO_BIN_EXE_socket-patch").into()
+}
+
+/// Java rejects the extended Windows paths returned by canonicalize.
+/// Keep a canonical root for symlinked macOS temp directories, but use the
+/// ordinary drive/UNC spelling when handing paths to Maven and Gradle.
+fn fixture_root(tmp: &tempfile::TempDir) -> PathBuf {
+    let root = tmp.path().canonicalize().unwrap();
+    #[cfg(windows)]
+    if let Some(path) = root.to_str() {
+        if let Some(rest) = path.strip_prefix(r"\\?\UNC\") {
+            return format!(r"\\{rest}").into();
+        }
+        if let Some(rest) = path.strip_prefix(r"\\?\") {
+            return rest.into();
+        }
+    }
+    root
+}
+
+fn git_sha256(bytes: &[u8]) -> String {
+    socket_patch_core::hash::git_sha256::compute_git_sha256_from_bytes(bytes)
+}
+
+/// `socket-patch <args>` with ambient `SOCKET_*` scrubbed and `m2` as the Maven repo.
+fn socket(cwd: &Path, m2: &Path, args: &[&str]) -> (Option<i32>, serde_json::Value, String) {
+    let mut cmd = Command::new(binary());
+    for (k, _) in std::env::vars_os() {
+        if k.to_string_lossy().starts_with("SOCKET_") {
+            cmd.env_remove(&k);
+        }
+    }
+    let out = cmd
+        .args(args)
+        .current_dir(cwd)
+        .env("SOCKET_TELEMETRY_DISABLED", "1")
+        .env("SOCKET_NO_CONFIG", "1")
+        .env("MAVEN_REPO_LOCAL", m2)
+        .env_remove("M2_HOME")
+        .env_remove("VIRTUAL_ENV")
+        .output()
+        .expect("run socket-patch");
+    let stdout = String::from_utf8_lossy(&out.stdout).into_owned();
+    let stderr = String::from_utf8_lossy(&out.stderr).into_owned();
+    let env = serde_json::from_str(&stdout)
+        .unwrap_or_else(|e| panic!("{args:?}: not JSON ({e})\n{stdout}\n{stderr}"));
+    (out.status.code(), env, stderr)
+}
+
+fn vendor(proj: &Path, m2: &Path) -> serde_json::Value {
+    let (code, env, stderr) = socket(
+        proj,
+        m2,
+        &[
+            "vendor",
+            "--json",
+            "--offline",
+            "--cwd",
+            proj.to_str().unwrap(),
+        ],
+    );
+    assert_eq!(code, Some(0), "vendor: {env}\n{stderr}");
+    assert_eq!(env["summary"]["failed"], 0, "{env}");
+    env
+}
+
+fn revert(proj: &Path, m2: &Path) {
+    let (code, env, stderr) = socket(
+        proj,
+        m2,
+        &[
+            "vendor",
+            "--revert",
+            "--json",
+            "--offline",
+            "--cwd",
+            proj.to_str().unwrap(),
+        ],
+    );
+    assert_eq!(code, Some(0), "vendor --revert: {env}\n{stderr}");
+}
+
+/// What `get` saves for an agent-mode patch: the manifest record + the
+/// after-hash blob (so `vendor --offline` needs no network).
+fn stage_manifest(proj: &Path, member_before: &[u8], member_after: &[u8]) {
+    let record = serde_json::json!({
+        "uuid": UUID,
+        "exportedAt": "2026-01-01T00:00:00Z",
+        "files": { MEMBER: {
+            "beforeHash": git_sha256(member_before),
+            "afterHash": git_sha256(member_after),
+        } },
+        "vulnerabilities": { "GHSA-vendor-jvm-real": {
+            "cves": ["CVE-2026-7203"], "summary": "s", "severity": "high", "description": "d"
+        } },
+        "description": "jvm vendored capstone",
+        "license": "MIT",
+        "tier": "free",
+    });
+    let manifest = serde_json::json!({ "patches": { purl(): record } });
+    std::fs::create_dir_all(proj.join(".socket/blobs")).unwrap();
+    std::fs::write(
+        proj.join(".socket/manifest.json"),
+        serde_json::to_string_pretty(&manifest).unwrap(),
+    )
+    .unwrap();
+    std::fs::write(
+        proj.join(".socket/blobs").join(git_sha256(member_after)),
+        member_after,
+    )
+    .unwrap();
+}
+
+/// Every committable file under `root` (build output skipped), keyed by its
+/// forward-slash relative path.
+fn snapshot(root: &Path) -> BTreeMap<String, Vec<u8>> {
+    fn walk(root: &Path, dir: &Path, out: &mut BTreeMap<String, Vec<u8>>) {
+        for entry in std::fs::read_dir(dir).unwrap() {
+            let entry = entry.unwrap();
+            let name = entry.file_name().to_string_lossy().into_owned();
+            let path = entry.path();
+            if entry.file_type().unwrap().is_dir() {
+                if !BUILD_OUTPUT_DIRS.contains(&name.as_str()) {
+                    walk(root, &path, out);
+                }
+                continue;
+            }
+            let rel = path
+                .strip_prefix(root)
+                .unwrap()
+                .to_string_lossy()
+                .replace('\\', "/");
+            out.insert(rel, std::fs::read(&path).unwrap());
+        }
+    }
+    let mut out = BTreeMap::new();
+    walk(root, root, &mut out);
+    out
+}
+
+/// `(changed, added, removed)` paths from `before` to `after`.
+fn diff(
+    before: &BTreeMap<String, Vec<u8>>,
+    after: &BTreeMap<String, Vec<u8>>,
+) -> (Vec<String>, Vec<String>, Vec<String>) {
+    let changed = after
+        .iter()
+        .filter(|(k, v)| before.get(*k).is_some_and(|b| b != *v))
+        .map(|(k, _)| k.clone())
+        .collect();
+    let added = after
+        .keys()
+        .filter(|k| !before.contains_key(*k))
+        .cloned()
+        .collect();
+    let removed = before
+        .keys()
+        .filter(|k| !after.contains_key(*k))
+        .cloned()
+        .collect();
+    (changed, added, removed)
+}
+
+fn assert_restored(proj: &Path, before: &BTreeMap<String, Vec<u8>>) {
+    let after = snapshot(proj);
+    let (changed, added, removed) = diff(before, &after);
+    assert!(
+        changed.is_empty() && added.is_empty() && removed.is_empty(),
+        "revert must restore the tree byte-for-byte: changed {changed:?}, added {added:?}, \
+         removed {removed:?}"
+    );
+}
+
+/// A fresh checkout of `proj` in `dst`: every committable file, minus the
+/// manifest and blobs (a vendored checkout builds without them).
+fn fresh_checkout_all(proj: &Path, dst: &Path) {
+    for (rel, bytes) in snapshot(proj) {
+        if rel == ".socket/manifest.json" || rel.starts_with(".socket/blobs/") {
+            continue;
+        }
+        let to = dst.join(&rel);
+        std::fs::create_dir_all(to.parent().unwrap()).unwrap();
+        std::fs::write(to, bytes).unwrap();
+    }
+}
+
+/// Drop the base and suffixed fixture versions from the local repository
+/// (other commons-text versions stay: [`CLASSPATH_PLUGIN`] runs on one).
+fn purge(m2: &Path) {
+    for version in [VERSION, SV] {
+        let dir = repo_dir(m2, version);
+        if dir.exists() {
+            std::fs::remove_dir_all(&dir).unwrap();
+        }
+    }
+}
+
+fn text(bytes: &[u8]) -> &str {
+    std::str::from_utf8(bytes).unwrap()
+}
+
+// ── P1: multi-module Maven reactor ──────────────────────────────────────
+
+const AGGREGATOR_POM: &str = r#"<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>com.example</groupId>
+  <artifactId>aggregator</artifactId>
+  <version>1.0.0</version>
+  <packaging>pom</packaging>
+  <modules>
+    <module>corp-parent</module>
+    <module>a</module>
+    <module>b</module>
+  </modules>
+</project>
+"#;
+
+const CORP_PARENT_POM: &str = r#"<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+  <modelVersion>4.0.0</modelVersion>
+  <!-- the corp parent every module inherits -->
+  <groupId>com.example</groupId>
+  <artifactId>corp-parent</artifactId>
+  <version>1.0.0</version>
+  <packaging>pom</packaging>
+  <properties>
+    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+  </properties>
+</project>
+"#;
+
+const B_POM: &str = r#"<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+  <modelVersion>4.0.0</modelVersion>
+  <parent>
+    <groupId>com.example</groupId>
+    <artifactId>corp-parent</artifactId>
+    <version>1.0.0</version>
+    <relativePath>../corp-parent</relativePath>
+  </parent>
+  <artifactId>b</artifactId>
+  <dependencies>
+    <dependency>
+      <groupId>com.example</groupId>
+      <artifactId>a</artifactId>
+      <version>${project.version}</version>
+    </dependency>
+  </dependencies>
+</project>
+"#;
+
+/// Module `a`: CRLF line endings and tab indentation, a comment, and the
+/// patched library declared at its literal base version.
+fn a_pom() -> String {
+    [
+        r#"<?xml version="1.0" encoding="UTF-8"?>"#,
+        r#"<project xmlns="http://maven.apache.org/POM/4.0.0">"#,
+        "\t<modelVersion>4.0.0</modelVersion>",
+        "\t<parent>",
+        "\t\t<groupId>com.example</groupId>",
+        "\t\t<artifactId>corp-parent</artifactId>",
+        "\t\t<version>1.0.0</version>",
+        "\t\t<relativePath>../corp-parent/pom.xml</relativePath>",
+        "\t</parent>",
+        "\t<artifactId>a</artifactId>",
+        "\t<dependencies>",
+        "\t\t<!-- text utilities -->",
+        "\t\t<dependency>",
+        "\t\t\t<groupId>org.apache.commons</groupId>",
+        "\t\t\t<artifactId>commons-text</artifactId>",
+        "\t\t\t<version>1.10.0</version>",
+        "\t\t</dependency>",
+        "\t</dependencies>",
+        "</project>",
+        "",
+    ]
+    .join("\r\n")
+}
+
+fn write_reactor(proj: &Path) {
+    for (rel, body) in [
+        ("pom.xml", AGGREGATOR_POM.to_string()),
+        ("corp-parent/pom.xml", CORP_PARENT_POM.to_string()),
+        ("a/pom.xml", a_pom()),
+        ("b/pom.xml", B_POM.to_string()),
+    ] {
+        let path = proj.join(rel);
+        std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+        std::fs::write(path, body).unwrap();
+    }
+}
+
+fn maven_tree_rel() -> String {
+    format!(".socket/vendor/maven2/{GROUP_PATH}/{ARTIFACT}/{SV}")
+}
+
+/// `package` + `build-classpath` into each module's `target/cp.txt`.
+fn mvn_classpath(mvn: &Mvn, cwd: &Path, m2: &Path, settings: &Path, offline: bool) -> Output {
+    let goal = format!("{CLASSPATH_PLUGIN}:build-classpath");
+    let mut args = vec!["package", goal.as_str(), "-Dmdep.outputFile=target/cp.txt"];
+    if offline {
+        args.insert(0, "-o");
+    }
+    mvn.run(cwd, m2, settings, &args)
+}
+
+/// The commons-text entry of `<module>/target/cp.txt`.
+fn classpath_entry(module_dir: &Path) -> PathBuf {
+    let cp = std::fs::read_to_string(module_dir.join("target/cp.txt"))
+        .unwrap_or_else(|e| panic!("{}: no target/cp.txt ({e})", module_dir.display()));
+    let sep = if cfg!(windows) { ';' } else { ':' };
+    let hits: Vec<&str> = cp
+        .trim()
+        .split(sep)
+        .filter(|p| p.contains(ARTIFACT))
+        .collect();
+    assert_eq!(hits.len(), 1, "{}: classpath {cp}", module_dir.display());
+    PathBuf::from(hits[0])
+}
+
+fn assert_vendored_on_classpath(module_dir: &Path, patched: &[u8], what: &str) {
+    let entry = classpath_entry(module_dir);
+    assert_eq!(
+        entry.file_name().unwrap().to_string_lossy(),
+        format!("{ARTIFACT}-{SV}.jar"),
+        "{what}: resolved {}",
+        entry.display()
+    );
+    let jar = std::fs::read(&entry).unwrap();
+    assert_jar_patched(&jar, patched, what);
+    println!("{what}: resolved {}", entry.display());
+}
+
+#[test]
+#[ignore = "real Maven + Maven Central (fixture); run with --ignored"]
+fn maven_reactor_vendor_fresh_checkout_offline_build_and_byte_exact_revert() {
+    const SUITE: &str = "e2e_vendor_jvm_build::maven_reactor";
+    let Some(mvn) = Mvn::detect(SUITE) else {
+        return;
+    };
+    let tmp = tempfile::tempdir().unwrap();
+    let root = fixture_root(&tmp);
+    let m2 = root.join("m2");
+    let proj = root.join("proj");
+    let settings = root.join("settings.xml");
+    write_settings(&settings, &[]);
+
+    // Registry bytes + every plugin the offline builds need.
+    let Some((jar, upstream_pom)) = warm_fixture(SUITE, &mvn, &root.join("warm"), &m2, &settings)
+    else {
+        return;
+    };
+    write_reactor(&proj);
+    let out = mvn_classpath(&mvn, &proj, &m2, &settings, false);
+    assert!(ok(&out), "pre-vendor reactor build:\n{}", dump(&out));
+    let entry = classpath_entry(&proj.join("b"));
+    assert_eq!(
+        std::fs::read(&entry).unwrap(),
+        jar,
+        "pre-vendor `b` resolves Central's jar transitively"
+    );
+    // Maven 4 keeps its project-local repository in `.mvn/target/`.
+    for dir in [
+        "target",
+        "corp-parent/target",
+        "a/target",
+        "b/target",
+        ".mvn/target",
+    ] {
+        let _ = std::fs::remove_dir_all(proj.join(dir));
+    }
+    let _ = std::fs::remove_dir(proj.join(".mvn"));
+    assert!(!proj.join(".mvn").exists(), "no .mvn before vendoring");
+
+    let (orig, patched) = patched_member(&jar, UUID);
+    stage_manifest(&proj, &orig, &patched);
+    let before = snapshot(&proj);
+
+    let env = vendor(&proj, &m2);
+    assert_eq!(env["summary"]["applied"], 1, "{env}");
+    println!("vendor envelope: {env}");
+    let vendored = snapshot(&proj);
+    let (changed, added, removed) = diff(&before, &vendored);
+    let tree = maven_tree_rel();
+    let mut want_added = vec![
+        ".mvn/maven.config".to_string(),
+        ".socket/vendor/maven2/.gitattributes".to_string(),
+        format!("{tree}/{ARTIFACT}-{SV}.jar"),
+        format!("{tree}/{ARTIFACT}-{SV}.jar.sha1"),
+        format!("{tree}/{ARTIFACT}-{SV}.pom"),
+        format!("{tree}/{ARTIFACT}-{SV}.pom.sha1"),
+        format!("{tree}/socket-patch.vendor.json"),
+        ".socket/vendor/state.json".to_string(),
+    ];
+    want_added.sort();
+    assert_eq!(added, want_added, "added files");
+    assert!(removed.is_empty(), "removed {removed:?}");
+    assert_eq!(
+        changed,
+        vec!["a/pom.xml".to_string(), "corp-parent/pom.xml".to_string()],
+        "only the literal module and the local root are edited (aggregator and `b` untouched)"
+    );
+
+    assert_eq!(
+        text(&vendored[".mvn/maven.config"]),
+        "-Daether.offline.protocols=file\n\
+         -Dmaven.repo.local.tail=${session.rootDirectory}/.socket/vendor/maven2\n"
+    );
+    assert_eq!(
+        text(&vendored[".socket/vendor/maven2/.gitattributes"]),
+        "* -text\n"
+    );
+    let vendored_jar = &vendored[&format!("{tree}/{ARTIFACT}-{SV}.jar")];
+    assert_jar_patched(vendored_jar, &patched, "vendored jar");
+    assert_eq!(
+        text(&vendored[&format!("{tree}/{ARTIFACT}-{SV}.jar.sha1")]),
+        sha1_hex(vendored_jar)
+    );
+    let tree_pom = &vendored[&format!("{tree}/{ARTIFACT}-{SV}.pom")];
+    assert_eq!(
+        text(&vendored[&format!("{tree}/{ARTIFACT}-{SV}.pom.sha1")]),
+        sha1_hex(tree_pom)
+    );
+    let tree_pom = text(tree_pom);
+    assert!(
+        tree_pom.contains(&format!("<version>{SV}</version>"))
+            && tree_pom.contains("commons-lang3"),
+        "suffixed pom keeps the upstream graph:\n{tree_pom}"
+    );
+    assert_eq!(
+        tree_pom.replace(SV, VERSION),
+        text(&upstream_pom),
+        "the suffixed pom differs from upstream only in its version"
+    );
+
+    // `a`: exactly the version element rewritten; CRLF, tabs, comment kept.
+    assert_eq!(
+        text(&vendored["a/pom.xml"]),
+        a_pom().replace(
+            "<version>1.10.0</version>",
+            &format!("<version>{SV}</version>")
+        )
+    );
+    let corp = text(&vendored["corp-parent/pom.xml"]);
+    assert!(
+        corp.starts_with(&CORP_PARENT_POM[..CORP_PARENT_POM.find("</properties>").unwrap()]),
+        "the corp parent's content before the insertions is untouched:\n{corp}"
+    );
+    for needle in [
+        "<!-- socket-patch:begin -->",
+        "<id>socket-patch-vendor</id>",
+        "<url>file://${maven.multiModuleProjectDirectory}/.socket/vendor/maven2</url>",
+        "<checksumPolicy>fail</checksumPolicy>",
+        "<!-- socket-patch:end -->",
+        "<dependencyManagement>",
+        &format!("<version>{SV}</version>"),
+    ] {
+        assert!(corp.contains(needle), "corp parent lacks {needle}:\n{corp}");
+    }
+    assert_eq!(corp.matches("<repository>").count(), 1, "{corp}");
+    assert_eq!(corp.matches(SV).count(), 1, "one pin:\n{corp}");
+
+    // Idempotent: a second vendor run changes no project file.
+    vendor(&proj, &m2);
+    let again = snapshot(&proj);
+    let (changed, added, removed) = diff(&vendored, &again);
+    assert!(
+        changed.iter().all(|p| p == ".socket/vendor/state.json")
+            && added.is_empty()
+            && removed.is_empty(),
+        "re-vendor: changed {changed:?}, added {added:?}, removed {removed:?}"
+    );
+
+    // FRESH CHECKOUT: commons-text only from the committed tree.
+    let fresh = root.join("fresh");
+    fresh_checkout_all(&proj, &fresh);
+    purge(&m2);
+    let out = mvn_classpath(&mvn, &fresh, &m2, &settings, true);
+    assert!(ok(&out), "fresh offline reactor build:\n{}", dump(&out));
+    assert_vendored_on_classpath(&fresh.join("a"), &patched, "root build, module a");
+    assert_vendored_on_classpath(
+        &fresh.join("b"),
+        &patched,
+        "root build, module b (transitive via sibling a)",
+    );
+    let lang3 = std::fs::read_to_string(fresh.join("b/target/cp.txt")).unwrap();
+    assert!(
+        lang3.contains(TRANSITIVE_JAR),
+        "the suffixed pom's transitive resolves: {lang3}"
+    );
+    let _ = std::fs::remove_dir_all(fresh.join("a/target"));
+    purge(&m2);
+    let goal = format!("{CLASSPATH_PLUGIN}:build-classpath");
+    let out = mvn.run(
+        &fresh.join("a"),
+        &m2,
+        &settings,
+        &["-o", &goal, "-Dmdep.outputFile=target/cp.txt"],
+    );
+    assert!(ok(&out), "fresh offline `cd a` build:\n{}", dump(&out));
+    assert_vendored_on_classpath(&fresh.join("a"), &patched, "cd a");
+
+    // Byte-exact revert of the source project.
+    revert(&proj, &m2);
+    assert_restored(&proj, &before);
+    assert!(!proj.join(".mvn").exists(), ".mvn residue");
+    assert!(
+        !proj.join(".socket/vendor").exists(),
+        ".socket/vendor residue"
+    );
+}
+
+// ── P2: Gradle multi-project with dependency locking ────────────────────
+
+fn gradle_flag(name: &str) -> bool {
+    std::env::var_os(name).is_some_and(|v| !v.is_empty())
+}
+
+fn gradle_skip(suite: &str, why: &str) {
+    assert!(
+        !gradle_flag(GRADLE_REQUIRED_ENV),
+        "{suite}: {GRADLE_REQUIRED_ENV} is set but the Gradle capstone cannot run: {why}"
+    );
+    println!("SKIP {suite}: {why}");
+}
+
+/// The selected Gradle launcher, run hermetically: a per-test
+/// `GRADLE_USER_HOME`, no daemon, plain console, ambient options scrubbed.
+struct Gradle {
+    program: OsString,
+    version: String,
+}
+
+impl Gradle {
+    fn command(program: &OsString, home: Option<&Path>) -> Command {
+        let mut cmd = Command::new(program);
+        for key in ["GRADLE_OPTS", "JAVA_OPTS", "GRADLE_USER_HOME"] {
+            cmd.env_remove(key);
+        }
+        for key in CI_DETECTOR_ENV {
+            cmd.env_remove(key);
+        }
+        if let Some(home) = home {
+            cmd.env("GRADLE_USER_HOME", home);
+        }
+        cmd
+    }
+
+    fn detect(suite: &str, home: &Path) -> Option<Gradle> {
+        let program: OsString = std::env::var_os(GRADLE_ENV)
+            .filter(|v| !v.is_empty())
+            .unwrap_or_else(|| {
+                if cfg!(windows) {
+                    "gradle.bat"
+                } else {
+                    "gradle"
+                }
+                .into()
+            });
+        let out = match Self::command(&program, Some(home))
+            .args(["--version", "--no-daemon"])
+            .output()
+        {
+            Ok(out) => out,
+            Err(e) => {
+                gradle_skip(
+                    suite,
+                    &format!("`{}` did not run: {e}", program.to_string_lossy()),
+                );
+                return None;
+            }
+        };
+        let banner = String::from_utf8_lossy(&out.stdout).into_owned();
+        let Some(version) = banner.lines().find_map(|l| {
+            l.trim()
+                .strip_prefix("Gradle ")
+                .map(|v| v.trim().to_string())
+        }) else {
+            gradle_skip(
+                suite,
+                &format!(
+                    "`{} --version` printed no `Gradle <v>` banner:\n{}{}",
+                    program.to_string_lossy(),
+                    banner,
+                    String::from_utf8_lossy(&out.stderr)
+                ),
+            );
+            return None;
+        };
+        if let Some(pin) = std::env::var(GRADLE_VERSION_ENV)
+            .ok()
+            .filter(|v| !v.is_empty())
+        {
+            assert_eq!(
+                version,
+                pin,
+                "{GRADLE_VERSION_ENV} pins Gradle {pin} but `{}` is Gradle {version}",
+                program.to_string_lossy()
+            );
+        }
+        println!(
+            "{suite}: driving Gradle {version} ({})",
+            program.to_string_lossy()
+        );
+        Some(Gradle { program, version })
+    }
+
+    fn run(&self, cwd: &Path, home: &Path, args: &[&str]) -> Output {
+        Self::command(&self.program, Some(home))
+            .current_dir(cwd)
+            .args(["--no-daemon", "--console=plain", "--stacktrace"])
+            .args(args)
+            .output()
+            .expect("spawn gradle")
+    }
+}
+
+const GRADLE_SETTINGS: &str = r#"buildscript {
+    repositories { mavenCentral() }
+    dependencies { classpath("org.apache.commons:commons-text:1.10.0") }
+}
+val socketSettingsJar = java.util.jar.JarFile(java.io.File(org.apache.commons.text.StringSubstitutor::class.java.protectionDomain.codeSource.location.toURI()))
+println("SOCKET-SETTINGS-PATCHED " + socketSettingsJar.use { jar -> jar.getInputStream(jar.getJarEntry("META-INF/NOTICE.txt")).bufferedReader().readText().contains("SOCKET-PATCH-MAVEN-E2E-MARKER") })
+dependencyResolutionManagement {
+    repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
+    repositories {
+        mavenCentral()
+    }
+}
+
+rootProject.name = "jvm-e2e"
+include("app", "lib")
+"#;
+
+const GRADLE_LIB: &str = r#"plugins {
+    `java-library`
+}
+
+dependencies {
+    api("org.apache.commons:commons-text:1.10.0")
+}
+
+dependencyLocking {
+    lockAllConfigurations()
+    lockMode.set(LockMode.STRICT)
+}
+"#;
+
+const GRADLE_APP: &str = r#"plugins {
+    java
+}
+
+dependencies {
+    implementation(project(":lib"))
+}
+
+dependencyLocking {
+    lockAllConfigurations()
+    lockMode.set(LockMode.STRICT)
+}
+
+tasks.register("printRuntimeClasspath") {
+    val runtime = configurations.named("runtimeClasspath")
+    doLast {
+        runtime.get().files.forEach { println("SOCKET-CP " + it.absolutePath) }
+    }
+}
+"#;
+
+const APPLY_LINE: &str =
+    r#"apply(from = ".socket/gradle/socket-patch.settings.gradle") // socket-patch"#;
+
+fn write_gradle_project(proj: &Path) {
+    for (rel, body) in [
+        ("settings.gradle.kts", GRADLE_SETTINGS),
+        ("lib/build.gradle.kts", GRADLE_LIB),
+        ("app/build.gradle.kts", GRADLE_APP),
+    ] {
+        let path = proj.join(rel);
+        std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+        std::fs::write(path, body).unwrap();
+    }
+}
+
+/// The `SOCKET-CP` lines `:app:printRuntimeClasspath` printed.
+fn gradle_classpath(out: &Output) -> Vec<PathBuf> {
+    String::from_utf8_lossy(&out.stdout)
+        .lines()
+        .filter_map(|l| l.strip_prefix("SOCKET-CP "))
+        .map(PathBuf::from)
+        .collect()
+}
+
+/// Every Gradle lockfile under `root`: `<project>/gradle.lockfile` on 7+,
+/// `<project>/gradle/dependency-locks/<configuration>.lockfile` on 6.x.
+fn lockfiles(root: &Path) -> BTreeMap<String, Vec<u8>> {
+    snapshot(root)
+        .into_iter()
+        .filter(|(rel, _)| rel.ends_with(".lockfile"))
+        .collect()
+}
+
+fn gradle_tree_rel() -> String {
+    format!(".socket/vendor/gradle/{GROUP_PATH}/{ARTIFACT}/{VERSION}")
+}
+
+fn assert_gradle_vendored(out: &Output, checkout: &Path, patched: &[u8], what: &str) {
+    assert!(ok(out), "{what}:\n{}", dump(out));
+    assert!(
+        String::from_utf8_lossy(&out.stdout).contains("SOCKET-SETTINGS-PATCHED true"),
+        "{what}: settings buildscript must load the patched jar:\n{}",
+        dump(out)
+    );
+    let cp = gradle_classpath(out);
+    let hits: Vec<&PathBuf> = cp
+        .iter()
+        .filter(|p| p.to_string_lossy().contains(ARTIFACT))
+        .collect();
+    let want = checkout.join(format!("{}/{ARTIFACT}-{VERSION}.jar", gradle_tree_rel()));
+    assert_eq!(
+        hits,
+        vec![&want],
+        "{what}: :app runtimeClasspath must resolve the vendored jar:\n{cp:?}"
+    );
+    assert_jar_patched(&std::fs::read(&want).unwrap(), patched, what);
+    assert!(
+        cp.iter()
+            .any(|p| p.file_name().is_some_and(|n| n == TRANSITIVE_JAR)),
+        "{what}: the vendored pom's transitive resolves: {cp:?}"
+    );
+    println!("{what}: resolved {}", want.display());
+}
+
+#[test]
+#[ignore = "real Gradle + Maven + Maven Central (fixture); run with --ignored"]
+fn gradle_multi_project_vendor_locked_offline_tamper_and_byte_exact_revert() {
+    const SUITE: &str = "e2e_vendor_jvm_build::gradle";
+    let tmp = tempfile::tempdir().unwrap();
+    let root = fixture_root(&tmp);
+    let gradle_home = root.join("gradle-home");
+    let Some(gradle) = Gradle::detect(SUITE, &gradle_home) else {
+        return;
+    };
+    // The crawler reads a maven repository: seed it with the registry bytes.
+    let Some(mvn) = Mvn::detect(SUITE) else {
+        return;
+    };
+    let m2 = root.join("m2");
+    let settings = root.join("settings.xml");
+    write_settings(&settings, &[]);
+    std::fs::create_dir_all(root.join("seed")).unwrap();
+    let out = mvn.run(
+        &root.join("seed"),
+        &m2,
+        &settings,
+        &[
+            &format!("{DEPENDENCY_PLUGIN}:get"),
+            &format!("-Dartifact={GROUP}:{ARTIFACT}:{VERSION}"),
+        ],
+    );
+    if !ok(&out) {
+        skip(
+            SUITE,
+            &format!(
+                "seeding the maven repo from Central failed:\n{}",
+                dump(&out)
+            ),
+        );
+        return;
+    }
+    // Gradle verifies the standalone parent's import as well as the child's
+    // effective import. Maven does not fetch the former or their module metadata.
+    for version in ["5.9.0", "5.9.1"] {
+        let out = mvn.run(
+            &root.join("seed"),
+            &m2,
+            &settings,
+            &[
+                &format!("{DEPENDENCY_PLUGIN}:get"),
+                &format!("-Dartifact=org.junit:junit-bom:{version}:module"),
+                "-Dtransitive=false",
+            ],
+        );
+        assert!(ok(&out), "seeding imported BOM metadata:\n{}", dump(&out));
+    }
+    let jar =
+        std::fs::read(repo_dir(&m2, VERSION).join(format!("{ARTIFACT}-{VERSION}.jar"))).unwrap();
+
+    let proj = root.join("proj");
+    write_gradle_project(&proj);
+    let out = gradle.run(
+        &proj,
+        &gradle_home,
+        &[":app:dependencies", ":lib:dependencies", "--write-locks"],
+    );
+    if !ok(&out) {
+        gradle_skip(
+            SUITE,
+            &format!(
+                "writing lockfiles against Maven Central failed:\n{}",
+                dump(&out)
+            ),
+        );
+        return;
+    }
+    let locked = lockfiles(&proj);
+    for project in ["app", "lib"] {
+        assert!(
+            locked
+                .iter()
+                .any(|(rel, body)| rel.starts_with(&format!("{project}/"))
+                    && text(body).contains(&format!("{GROUP}:{ARTIFACT}:{VERSION}"))),
+            "{project} locks the patched GAV: {:?}",
+            locked.keys()
+        );
+    }
+    let out = gradle.run(
+        &proj,
+        &gradle_home,
+        &[
+            ":app:printRuntimeClasspath",
+            "--write-verification-metadata",
+            "sha256",
+        ],
+    );
+    assert!(ok(&out), "pre-vendor build:\n{}", dump(&out));
+    assert!(
+        gradle_classpath(&out)
+            .iter()
+            .any(|p| p.starts_with(&gradle_home) && p.to_string_lossy().contains(ARTIFACT)),
+        "pre-vendor :app resolves Central's jar from the Gradle cache:\n{}",
+        dump(&out)
+    );
+
+    // Remove parent entries to prove vendor adds the metadata needed by the local POM.
+    let verification = proj.join("gradle/verification-metadata.xml");
+    let verification_text = std::fs::read_to_string(&verification).unwrap();
+    let parents = regex::Regex::new(r#"(?s)\s*<component (?:group="org.apache" name="apache" version="27"|group="org.apache.commons" name="commons-parent" version="54")[^>]*>.*?</component>"#).unwrap();
+    std::fs::write(
+        &verification,
+        parents.replace_all(&verification_text, "").as_bytes(),
+    )
+    .unwrap();
+    let (orig, patched) = patched_member(&jar, UUID);
+    stage_manifest(&proj, &orig, &patched);
+    let before = snapshot(&proj);
+
+    let env = vendor(&proj, &m2);
+    assert_eq!(env["summary"]["applied"], 1, "{env}");
+    println!("vendor envelope: {env}");
+    let vendored = snapshot(&proj);
+    let (changed, added, removed) = diff(&before, &vendored);
+    let tree = gradle_tree_rel();
+    let mut want_added = vec![
+        socket_patch_core::vendor::jvm::gradle::SCRIPT_REL.to_string(),
+        socket_patch_core::vendor::jvm::gradle::INDEX_REL.to_string(),
+        ".socket/vendor/gradle/.gitattributes".to_string(),
+        format!("{tree}/{ARTIFACT}-{VERSION}.jar"),
+        format!("{tree}/{ARTIFACT}-{VERSION}.pom"),
+        format!("{tree}/socket-patch.vendor.json"),
+        ".socket/vendor/state.json".to_string(),
+    ];
+    want_added.sort();
+    assert_eq!(added, want_added, "added files");
+    assert!(removed.is_empty(), "removed {removed:?}");
+    assert_eq!(
+        changed,
+        vec!["gradle/verification-metadata.xml".to_string(), "settings.gradle.kts".to_string()],
+        "settings and existing verification metadata are edited; lockfiles and build scripts stay byte-unchanged"
+    );
+    assert!(text(&vendored["settings.gradle.kts"]).ends_with(&format!("{APPLY_LINE}\n")));
+    assert!(text(&vendored["settings.gradle.kts"]).contains("exclusiveContent"));
+    assert_eq!(
+        text(&vendored[socket_patch_core::vendor::jvm::gradle::SCRIPT_REL]),
+        socket_patch_core::vendor::jvm::gradle::SCRIPT
+    );
+    let vendored_jar = &vendored[&format!("{tree}/{ARTIFACT}-{VERSION}.jar")];
+    assert_jar_patched(vendored_jar, &patched, "vendored jar");
+    assert_ne!(vendored_jar, &jar);
+    assert_eq!(
+        text(&vendored[socket_patch_core::vendor::jvm::gradle::INDEX_REL]),
+        format!(
+            "#socket-patch-gradle-index 1\n{GROUP}:{ARTIFACT}:{VERSION}\t{GROUP_PATH}/{ARTIFACT}/\
+             {VERSION}/{ARTIFACT}-{VERSION}.jar\t{}\t{UUID}\n{GROUP}:{ARTIFACT}:{VERSION}\t\
+             {GROUP_PATH}/{ARTIFACT}/{VERSION}/{ARTIFACT}-{VERSION}.pom\t{}\t{UUID}\n",
+            sha256_hex(vendored_jar),
+            sha256_hex(&vendored[&format!("{tree}/{ARTIFACT}-{VERSION}.pom")]),
+        )
+    );
+
+    // Idempotent: a second vendor run changes no project file.
+    vendor(&proj, &m2);
+    let (changed, added, removed) = diff(&vendored, &snapshot(&proj));
+    assert!(
+        changed.iter().all(|p| p == ".socket/vendor/state.json")
+            && added.is_empty()
+            && removed.is_empty(),
+        "re-vendor: changed {changed:?}, added {added:?}, removed {removed:?}"
+    );
+
+    // Fresh checkout (no manifest, blobs, .gradle or build output).
+    let fresh = root.join("fresh");
+    fresh_checkout_all(&proj, &fresh);
+    let out = gradle.run(&fresh, &gradle_home, &[":app:printRuntimeClasspath"]);
+    assert_gradle_vendored(&out, &fresh, &patched, "online");
+    let out = gradle.run(
+        &fresh,
+        &gradle_home,
+        &["--offline", ":app:printRuntimeClasspath"],
+    );
+    assert_gradle_vendored(&out, &fresh, &patched, "--offline");
+    assert_eq!(
+        lockfiles(&fresh),
+        locked,
+        "lockfiles unchanged by the vendored builds"
+    );
+
+    // A tampered vendored jar fails the build at configuration time.
+    let jar_path = fresh.join(format!("{tree}/{ARTIFACT}-{VERSION}.jar"));
+    let tampered = jar_with_member(vendored_jar, MEMBER, b"tampered\n");
+    std::fs::write(&jar_path, &tampered).unwrap();
+    let out = gradle.run(
+        &fresh,
+        &gradle_home,
+        &["--offline", ":app:printRuntimeClasspath"],
+    );
+    let log = dump(&out);
+    assert!(
+        !ok(&out),
+        "a tampered vendored jar must fail the build:\n{log}"
+    );
+    assert!(
+        log.contains("Dependency verification failed") || log.contains("socket-patch:"),
+        "unexpected tamper failure: {log}"
+    );
+    // The index remains enforced when the user's Gradle verification is off.
+    let out = gradle.run(
+        &fresh,
+        &gradle_home,
+        &[
+            "--offline",
+            "--dependency-verification=off",
+            ":app:printRuntimeClasspath",
+        ],
+    );
+    let log = dump(&out);
+    assert!(
+        !ok(&out),
+        "the index must reject a tampered jar even with Gradle verification off: {log}"
+    );
+    // Java prints native separators, while a Windows PathBuf can retain the
+    // forward slashes in the fixture's relative repository path.
+    assert!(
+        log.replace('\\', "/").contains(&format!(
+            "socket-patch: {} has sha256 {}, pinned {}",
+            jar_path.to_string_lossy().replace('\\', "/"),
+            sha256_hex(&tampered),
+            sha256_hex(vendored_jar)
+        )),
+        "the socket-patch integrity message:\n{log}"
+    );
+    std::fs::write(&jar_path, vendored_jar).unwrap();
+    let out = gradle.run(
+        &fresh,
+        &gradle_home,
+        &["--offline", ":app:printRuntimeClasspath"],
+    );
+    assert_gradle_vendored(&out, &fresh, &patched, "restored jar");
+    println!("{SUITE}: Gradle {} green", gradle.version);
+
+    // Byte-exact revert of the source project.
+    revert(&proj, &m2);
+    assert_restored(&proj, &before);
+    assert!(
+        !proj.join(".socket/vendor").exists(),
+        ".socket/vendor residue"
+    );
+    assert!(
+        !proj.join(".socket/gradle").exists(),
+        ".socket/gradle residue"
+    );
+}
diff --git a/crates/socket-patch-cli/tests/in_process_rollback_vendored.rs b/crates/socket-patch-cli/tests/in_process_rollback_vendored.rs
index 34430eaa..0c0da738 100644
--- a/crates/socket-patch-cli/tests/in_process_rollback_vendored.rs
+++ b/crates/socket-patch-cli/tests/in_process_rollback_vendored.rs
@@ -194,6 +194,8 @@ fn vendor_args(cwd: &Path) -> VendorArgs {
         },
         force: false,
         revert: false,
+        check: false,
+        local_repo: None,
         vex: Default::default(),
     }
 }
diff --git a/crates/socket-patch-cli/tests/in_process_vendor.rs b/crates/socket-patch-cli/tests/in_process_vendor.rs
index 492538f1..e701c7f7 100644
--- a/crates/socket-patch-cli/tests/in_process_vendor.rs
+++ b/crates/socket-patch-cli/tests/in_process_vendor.rs
@@ -217,6 +217,8 @@ fn vendor_args(cwd: &Path) -> VendorArgs {
         },
         force: false,
         revert: false,
+        check: false,
+        local_repo: None,
         vex: Default::default(),
     }
 }
diff --git a/crates/socket-patch-cli/tests/vendor_jvm_cli.rs b/crates/socket-patch-cli/tests/vendor_jvm_cli.rs
new file mode 100644
index 00000000..06a4624f
--- /dev/null
+++ b/crates/socket-patch-cli/tests/vendor_jvm_cli.rs
@@ -0,0 +1,676 @@
+//! CLI flows of the v5 JVM vendored backend over synthetic offline
+//! fixtures: a reactor (an aggregator and one module) and a
+//! Gradle multi-project, each fed by a fake local Maven repository.
+//!
+//! These pin the review findings that only show through the CLI's own
+//! bookkeeping (ledger carry-forward, the stale-uuid sweep, per-package
+//! rollback, repair, `vex`): two patches revert in any order, a patch
+//! update re-wires and reverts to pristine, a re-run needs no jar source,
+//! and a tampered ledger or an escaping symlink is refused.
+
+use std::collections::BTreeMap;
+use std::io::Write as _;
+use std::path::Path;
+use std::process::Command;
+
+use sha2::{Digest as _, Sha256};
+
+const FOO_UUID: &str = "1d3c1fd2-7b4e-4c1a-9f0e-2a3b4c5d6e7f";
+const BAR_UUID: &str = "9a8b7c6d-7b4e-4c1a-9f0e-2a3b4c5d6e7f";
+const FOO_UPDATE_UUID: &str = "2e4d6f80-7b4e-4c1a-9f0e-2a3b4c5d6e7f";
+const MEMBER: &str = "META-INF/NOTICE.txt";
+
+#[derive(Clone, Copy, PartialEq)]
+enum Shape {
+    Reactor,
+    Gradle,
+}
+
+fn git_sha256(bytes: &[u8]) -> String {
+    socket_patch_core::hash::git_sha256::compute_git_sha256_from_bytes(bytes)
+}
+
+fn purl(name: &str) -> String {
+    format!("pkg:maven/org.example/{name}@1.0")
+}
+
+fn jar(notice: &[u8]) -> Vec<u8> {
+    let mut zw = zip::ZipWriter::new(std::io::Cursor::new(Vec::new()));
+    let opts = zip::write::SimpleFileOptions::default();
+    for (name, bytes) in [
+        ("META-INF/MANIFEST.MF", &b"Manifest-Version: 1.0\n"[..]),
+        (MEMBER, notice),
+    ] {
+        zw.start_file(name, opts).unwrap();
+        zw.write_all(bytes).unwrap();
+    }
+    zw.finish().unwrap().into_inner()
+}
+
+/// `root/{m2,proj}` for `shape` depending on every `(name, uuid)` package.
+fn fixture(root: &Path, shape: Shape, packages: &[(&str, &str)]) {
+    let proj = root.join("proj");
+    std::fs::create_dir_all(proj.join(".socket/blobs")).unwrap();
+    let mut patches = serde_json::Map::new();
+    for (name, uuid) in packages {
+        let dir = root.join(format!("m2/org/example/{name}/1.0"));
+        std::fs::create_dir_all(&dir).unwrap();
+        let before = format!("NOTICE {name}\n").into_bytes();
+        let after = [before.as_slice(), b"PATCHED\n"].concat();
+        std::fs::write(dir.join(format!("{name}-1.0.jar")), jar(&before)).unwrap();
+        std::fs::write(
+            dir.join(format!("{name}-1.0.pom")),
+            format!(
+                "<project><modelVersion>4.0.0</modelVersion><groupId>org.example</groupId>\
+                 <artifactId>{name}</artifactId><version>1.0</version></project>\n"
+            ),
+        )
+        .unwrap();
+        std::fs::write(proj.join(".socket/blobs").join(git_sha256(&after)), &after).unwrap();
+        patches.insert(
+            purl(name),
+            serde_json::json!({
+                "uuid": uuid,
+                "exportedAt": "2026-01-01T00:00:00Z",
+                "files": { MEMBER: {
+                    "beforeHash": git_sha256(&before),
+                    "afterHash": git_sha256(&after),
+                } },
+                "vulnerabilities": { "GHSA-xxxx-yyyy-zzzz": {
+                    "cves": ["CVE-2026-0001"], "summary": "s", "severity": "high", "description": "d"
+                } },
+                "description": "x",
+                "license": "MIT",
+                "tier": "free",
+            }),
+        );
+    }
+    std::fs::write(
+        proj.join(".socket/manifest.json"),
+        serde_json::to_string_pretty(&serde_json::json!({ "patches": patches })).unwrap(),
+    )
+    .unwrap();
+    match shape {
+        Shape::Reactor => {
+            std::fs::create_dir_all(proj.join(".mvn/wrapper")).unwrap();
+            std::fs::write(
+                proj.join(".mvn/wrapper/maven-wrapper.properties"),
+                "distributionUrl=https://repo.maven.apache.org/apache-maven-3.9.16-bin.zip\n",
+            )
+            .unwrap();
+            let deps: String = packages
+                .iter()
+                .map(|(name, _)| {
+                    format!(
+                        "\n    <dependency><groupId>org.example</groupId>\
+                         <artifactId>{name}</artifactId><version>1.0</version></dependency>"
+                    )
+                })
+                .collect();
+            std::fs::write(
+                proj.join("pom.xml"),
+                "<project>\n  <modelVersion>4.0.0</modelVersion>\n  <groupId>com.x</groupId>\
+                 <artifactId>agg</artifactId><version>1</version><packaging>pom</packaging>\n  \
+                 <modules>\n    <module>a</module>\n  </modules>\n</project>\n",
+            )
+            .unwrap();
+            std::fs::create_dir_all(proj.join("a")).unwrap();
+            std::fs::write(
+                proj.join("a/pom.xml"),
+                format!(
+                    "<project>\r\n  <modelVersion>4.0.0</modelVersion>\r\n  <parent><groupId>com.x\
+                     </groupId><artifactId>agg</artifactId><version>1</version></parent>\r\n  \
+                     <artifactId>a</artifactId>\r\n  <dependencies>{deps}\r\n  </dependencies>\r\n\
+                     </project>\r\n"
+                ),
+            )
+            .unwrap();
+        }
+        Shape::Gradle => {
+            std::fs::write(
+                proj.join("settings.gradle"),
+                "plugins {\n    id 'org.gradle.toolchains.foojay-resolver-convention' version '0.8.0'\n}\nrootProject.name = 'x'\ninclude 'app'\n",
+            )
+            .unwrap();
+            std::fs::create_dir_all(proj.join("app")).unwrap();
+            let deps: String = packages
+                .iter()
+                .map(|(name, _)| format!("  implementation 'org.example:{name}:1.0'\n"))
+                .collect();
+            std::fs::write(
+                proj.join("app/build.gradle"),
+                format!("plugins {{ id 'java' }}\nrepositories {{ mavenCentral() }}\ndependencies {{\n{deps}}}\n"),
+            )
+            .unwrap();
+        }
+    }
+}
+
+/// `socket-patch <args> --json --offline --cwd <root>/proj`; `(exit, envelope)`.
+fn socket(root: &Path, args: &[&str]) -> (Option<i32>, serde_json::Value) {
+    let mut cmd = Command::new(env!("CARGO_BIN_EXE_socket-patch"));
+    for (k, _) in std::env::vars_os() {
+        if k.to_string_lossy().starts_with("SOCKET_") {
+            cmd.env_remove(&k);
+        }
+    }
+    let proj = root.join("proj");
+    let out = cmd
+        .args(args)
+        .args(["--json", "--offline", "--cwd", proj.to_str().unwrap()])
+        .env("SOCKET_TELEMETRY_DISABLED", "1")
+        .env("SOCKET_NO_CONFIG", "1")
+        .env("MAVEN_REPO_LOCAL", root.join("m2"))
+        .env_remove("M2_HOME")
+        .output()
+        .expect("run socket-patch");
+    let stdout = String::from_utf8_lossy(&out.stdout).into_owned();
+    let env = serde_json::from_str(&stdout).unwrap_or_else(|e| {
+        panic!(
+            "{args:?}: not JSON ({e})\n{stdout}\n{}",
+            String::from_utf8_lossy(&out.stderr)
+        )
+    });
+    (out.status.code(), env)
+}
+
+fn ok(root: &Path, args: &[&str]) -> serde_json::Value {
+    let (code, env) = socket(root, args);
+    assert_eq!(code, Some(0), "{args:?}: {env}");
+    let failed = env["summary"].get("failed").unwrap_or(&env["failed"]);
+    assert_eq!(failed, 0, "{args:?}: {env}");
+    env
+}
+
+/// Every file and directory under `proj`, minus the manifest and blobs
+/// (the inputs the tests edit).
+fn snapshot(root: &Path) -> BTreeMap<String, Option<Vec<u8>>> {
+    fn walk(base: &Path, dir: &Path, out: &mut BTreeMap<String, Option<Vec<u8>>>) {
+        for entry in std::fs::read_dir(dir).unwrap() {
+            let path = entry.unwrap().path();
+            let rel = path
+                .strip_prefix(base)
+                .unwrap()
+                .to_string_lossy()
+                .replace('\\', "/");
+            if rel == ".socket/manifest.json" || rel == ".socket/blobs" {
+                continue;
+            }
+            if std::fs::symlink_metadata(&path).unwrap().is_dir() {
+                out.insert(format!("{rel}/"), None);
+                walk(base, &path, out);
+            } else {
+                out.insert(rel, Some(std::fs::read(&path).unwrap()));
+            }
+        }
+    }
+    let proj = root.join("proj");
+    let mut out = BTreeMap::new();
+    walk(&proj, &proj, &mut out);
+    out
+}
+
+fn wiring_text(root: &Path) -> String {
+    snapshot(root)
+        .into_iter()
+        .filter(|(rel, _)| {
+            !rel.starts_with(".socket/vendor/maven2/") && !rel.starts_with(".socket/vendor/gradle/")
+        })
+        .filter(|(rel, _)| rel != ".socket/vendor/state.json")
+        .filter_map(|(_, bytes)| bytes.map(|b| String::from_utf8_lossy(&b).into_owned()))
+        .collect()
+}
+
+fn events(env: &serde_json::Value) -> Vec<(String, String, String)> {
+    env["events"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .map(|e| {
+            let s = |k: &str| e[k].as_str().unwrap_or_default().to_string();
+            (s("purl"), s("action"), s("errorCode"))
+        })
+        .collect()
+}
+
+/// Rolling back one of two vendored packages leaves the other wired (a
+/// re-vendor finds it in sync), and reverting the rest — with the switch
+/// unset — restores every byte and directory.
+#[test]
+fn two_patches_roll_back_one_at_a_time_to_pristine() {
+    for shape in [Shape::Reactor, Shape::Gradle] {
+        for first in ["foo", "bar"] {
+            let tmp = tempfile::tempdir().unwrap();
+            let root = tmp.path();
+            fixture(root, shape, &[("foo", FOO_UUID), ("bar", BAR_UUID)]);
+            let pristine = snapshot(root);
+            let env = ok(root, &["vendor"]);
+            assert_eq!(env["summary"]["applied"], 2, "{env}");
+            ok(root, &["rollback", &purl(first)]);
+            let other = if first == "foo" { "bar" } else { "foo" };
+            let env = ok(root, &["vendor"]);
+            assert_eq!(
+                events(&env),
+                [(
+                    purl(other),
+                    "skipped".to_string(),
+                    "already_vendored".to_string()
+                )],
+                "{env}"
+            );
+            ok(root, &["vendor", "--revert"]);
+            assert_eq!(snapshot(root), pristine, "first={first}");
+        }
+    }
+}
+
+/// A patch update (same GAV, new uuid) re-points every wiring fragment at
+/// the new patch, sweeps the old Maven tree for real, and reverts to
+/// pristine.
+#[test]
+fn patch_update_rewires_sweeps_and_reverts_to_pristine() {
+    for shape in [Shape::Reactor, Shape::Gradle] {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        fixture(root, shape, &[("foo", FOO_UUID)]);
+        let pristine = snapshot(root);
+        ok(root, &["vendor"]);
+        let manifest_path = root.join("proj/.socket/manifest.json");
+        let manifest = std::fs::read_to_string(&manifest_path).unwrap();
+        std::fs::write(&manifest_path, manifest.replace(FOO_UUID, FOO_UPDATE_UUID)).unwrap();
+        let env = ok(root, &["vendor"]);
+        let removed = events(&env)
+            .iter()
+            .any(|(_, _, code)| code == "vendor_stale_artifact_removed");
+        let old_tree = root.join("proj/.socket/vendor/maven2/org/example/foo/1.0-socket.1d3c1fd2");
+        assert_eq!(removed, shape == Shape::Reactor, "{env}");
+        assert!(!old_tree.exists());
+        let wiring = wiring_text(root);
+        assert!(
+            !wiring.contains("1d3c1fd2"),
+            "old uuid still wired:\n{wiring}"
+        );
+        assert!(wiring.contains(if shape == Shape::Reactor {
+            "1.0-socket.2e4d6f80"
+        } else {
+            FOO_UPDATE_UUID
+        }));
+        ok(root, &["vendor", "--revert"]);
+        assert_eq!(snapshot(root), pristine);
+    }
+}
+
+/// A re-run over the committed tree needs no jar source (cold cache, even
+/// `--vendor-source=service --offline`); `vex` attests the entry; a deleted
+/// tree jar is rebuilt by `repair`; the whole thing still reverts clean.
+#[test]
+fn cold_cache_rerun_vex_repair_and_revert() {
+    for shape in [Shape::Reactor, Shape::Gradle] {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        fixture(root, shape, &[("foo", FOO_UUID)]);
+        let pristine = snapshot(root);
+        ok(root, &["vendor"]);
+        let m2 = root.join("m2");
+        let parked = root.join("m2-parked");
+        std::fs::rename(&m2, &parked).unwrap();
+        for args in [&["vendor"][..], &["vendor", "--vendor-source=service"]] {
+            let env = ok(root, args);
+            assert_eq!(
+                events(&env),
+                [(
+                    purl("foo"),
+                    "skipped".to_string(),
+                    "already_vendored".to_string()
+                )],
+                "{args:?}: {env}"
+            );
+        }
+        let vex = root.join("vex.json");
+        ok(
+            root,
+            &[
+                "vex",
+                "-O",
+                vex.to_str().unwrap(),
+                "--product",
+                "pkg:generic/x@1",
+            ],
+        );
+        let doc: serde_json::Value = serde_json::from_slice(&std::fs::read(&vex).unwrap()).unwrap();
+        assert_eq!(doc["statements"][0]["status"], "not_affected", "{doc}");
+        std::fs::rename(&parked, &m2).unwrap();
+        let tree_jar = if shape == Shape::Reactor {
+            "proj/.socket/vendor/maven2/org/example/foo/1.0-socket.1d3c1fd2/foo-1.0-socket.1d3c1fd2.jar"
+        } else {
+            "proj/.socket/vendor/gradle/org/example/foo/1.0/foo-1.0.jar"
+        };
+        std::fs::remove_file(root.join(tree_jar)).unwrap();
+        let env = ok(root, &["repair"]);
+        assert_eq!(env["events"][0]["action"], "rebuilt", "{env}");
+        assert!(root.join(tree_jar).is_file());
+        let expected = std::fs::read(root.join(tree_jar)).unwrap();
+        std::fs::write(root.join(tree_jar), jar(b"CORRUPT\n")).unwrap();
+        let env = ok(root, &["repair"]);
+        assert_eq!(env["events"][0]["action"], "rebuilt", "{env}");
+        assert_eq!(std::fs::read(root.join(tree_jar)).unwrap(), expected);
+        ok(root, &["vendor", "--revert"]);
+        assert_eq!(snapshot(root), pristine);
+    }
+}
+
+/// `rollback --preserve-state` keeps the tree and the ledger entry.
+#[test]
+fn preserve_state_keeps_the_tree() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    fixture(root, Shape::Reactor, &[("foo", FOO_UUID)]);
+    ok(root, &["vendor"]);
+    ok(root, &["rollback", "--preserve-state"]);
+    let proj = root.join("proj");
+    assert!(proj
+        .join(
+            ".socket/vendor/maven2/org/example/foo/1.0-socket.1d3c1fd2/foo-1.0-socket.1d3c1fd2.jar"
+        )
+        .is_file());
+    assert!(!std::fs::read_to_string(proj.join("a/pom.xml"))
+        .unwrap()
+        .contains("socket"));
+    assert!(
+        std::fs::read_to_string(proj.join(".socket/vendor/state.json"))
+            .unwrap()
+            .contains(FOO_UUID)
+    );
+}
+
+/// A forged JVM ledger entry naming `.git/config` is refused before any
+/// write, using only allowed JVM paths.
+#[test]
+fn forged_ledger_entries_touch_nothing() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    fixture(root, Shape::Reactor, &[("foo", FOO_UUID)]);
+    let proj = root.join("proj");
+    std::fs::create_dir_all(proj.join(".git")).unwrap();
+    std::fs::write(proj.join(".git/config"), "[core]\n").unwrap();
+    std::fs::create_dir_all(proj.join("src")).unwrap();
+    std::fs::write(proj.join("src/Main.java"), "class Main {}\n").unwrap();
+    let sha = hex::encode(Sha256::digest(b"class Main {}\n"));
+    for (uuid, wiring) in [
+        (
+            FOO_UUID,
+            serde_json::json!([{ "file": ".git/config", "kind": "maven_pom_fragment",
+                "action": "rewritten", "key": "repository",
+                "new": { "op": "replace", "from": "[core]\n\tfsmonitor = touch PWNED\n", "to": "[core]\n" } }]),
+        ),
+        (
+            "../../../NOT-A-UUID",
+            serde_json::json!([{ "file": "src/Main.java", "kind": "jvm_vendor_tree",
+                "action": "added", "new": sha }]),
+        ),
+    ] {
+        let state = serde_json::json!({ "version": 1, "entries": { purl("foo"): {
+            "ecosystem": "maven", "basePurl": purl("foo"), "uuid": uuid,
+            "artifact": { "path": "x", "sha256": "" }, "wiring": wiring,
+        } } });
+        std::fs::create_dir_all(proj.join(".socket/vendor")).unwrap();
+        std::fs::write(proj.join(".socket/vendor/state.json"), state.to_string()).unwrap();
+        let (code, env) = socket(root, &["vendor", "--revert"]);
+        assert_ne!(code, Some(0), "{env}");
+        assert_eq!(
+            std::fs::read(proj.join(".git/config")).unwrap(),
+            b"[core]\n"
+        );
+        assert!(proj.join("src/Main.java").is_file());
+    }
+}
+
+/// A build directory symlinked out of the checkout is refused with
+/// `build_file_outside_root`, and nothing is written through it.
+#[cfg(unix)]
+#[test]
+fn escaping_symlinks_are_refused() {
+    for link in [".mvn", ".socket/vendor", "a"] {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        fixture(root, Shape::Reactor, &[("foo", FOO_UUID)]);
+        let proj = root.join("proj");
+        let outside = root.join("outside");
+        std::fs::create_dir_all(&outside).unwrap();
+        if link == ".mvn" {
+            std::fs::remove_dir_all(proj.join(".mvn")).unwrap();
+        }
+        if link == "a" {
+            std::fs::rename(proj.join("a/pom.xml"), outside.join("pom.xml")).unwrap();
+            std::fs::remove_dir(proj.join("a")).unwrap();
+        }
+        std::os::unix::fs::symlink(&outside, proj.join(link)).unwrap();
+        let before: Vec<_> = std::fs::read_dir(&outside)
+            .unwrap()
+            .map(|e| e.unwrap().path())
+            .collect();
+        let (code, env) = socket(root, &["vendor"]);
+        assert_ne!(code, Some(0), "{link}: {env}");
+        assert_eq!(
+            env["events"][0]["errorCode"], "vendor_jvm_shape_unsupported",
+            "{link}: {env}"
+        );
+        assert!(
+            env["events"][0]["error"]
+                .as_str()
+                .unwrap_or_default()
+                .starts_with("reason: build_file_outside_root: "),
+            "{link}: {env}"
+        );
+        let after: Vec<_> = std::fs::read_dir(&outside)
+            .unwrap()
+            .map(|e| e.unwrap().path())
+            .collect();
+        assert_eq!(before, after, "{link}: wrote outside the checkout");
+    }
+}
+
+#[test]
+fn offline_check_detects_metadata_and_wiring_drift_without_writes() {
+    for shape in [Shape::Reactor, Shape::Gradle] {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        fixture(root, shape, &[("foo", FOO_UUID)]);
+        ok(root, &["vendor"]);
+        let before = snapshot(root);
+        ok(root, &["vendor", "--check"]);
+        assert_eq!(snapshot(root), before);
+        let pom = match shape {
+            Shape::Reactor => "proj/.socket/vendor/maven2/org/example/foo/1.0-socket.1d3c1fd2/foo-1.0-socket.1d3c1fd2.pom",
+            Shape::Gradle => "proj/.socket/vendor/gradle/org/example/foo/1.0/foo-1.0.pom",
+        };
+        let original = std::fs::read(root.join(pom)).unwrap();
+        std::fs::write(root.join(pom), b"tampered").unwrap();
+        let corrupt = snapshot(root);
+        let (code, env) = socket(root, &["vendor", "--check"]);
+        assert_eq!(code, Some(1), "{env}");
+        assert_eq!(snapshot(root), corrupt);
+        std::fs::write(root.join(pom), original).unwrap();
+        let wiring = if shape == Shape::Reactor {
+            "proj/a/pom.xml"
+        } else {
+            "proj/settings.gradle"
+        };
+        let text = std::fs::read_to_string(root.join(wiring)).unwrap();
+        let drifted = if shape == Shape::Reactor {
+            text.replace("1.0-socket.1d3c1fd2", "1.0")
+        } else {
+            text.lines()
+                .filter(|l| !l.contains("apply from:"))
+                .collect::<Vec<_>>()
+                .join("\n")
+        };
+        std::fs::write(root.join(wiring), drifted).unwrap();
+        let (code, env) = socket(root, &["vendor", "--check"]);
+        assert_eq!(code, Some(1), "{env}");
+    }
+}
+
+#[test]
+fn maven_config_none_survives_rerun_and_checks_conflicting_local_cache() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    fixture(root, Shape::Reactor, &[("foo", FOO_UUID)]);
+    let before = snapshot(root);
+    ok(root, &["vendor", "--maven-config=none"]);
+    assert!(!root.join("proj/.mvn/maven.config").exists());
+    ok(root, &["vendor"]);
+    assert!(!root.join("proj/.mvn/maven.config").exists());
+    ok(root, &["vendor", "--check"]);
+    let m2 = root.join("other-cache");
+    let jar = m2.join("org/example/foo/1.0-socket.1d3c1fd2/foo-1.0-socket.1d3c1fd2.jar");
+    std::fs::create_dir_all(jar.parent().unwrap()).unwrap();
+    std::fs::write(&jar, b"conflicting bytes").unwrap();
+    let (code, env) = socket(
+        root,
+        &["vendor", "--check", "--local-repo", m2.to_str().unwrap()],
+    );
+    assert_eq!(code, Some(1), "{env}");
+    std::fs::remove_dir_all(m2).unwrap();
+    ok(root, &["vendor", "--revert"]);
+    assert_eq!(snapshot(root), before);
+}
+
+#[test]
+fn gradle_old_wrapper_refuses_before_writes() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    fixture(root, Shape::Gradle, &[("foo", FOO_UUID)]);
+    std::fs::create_dir_all(root.join("proj/gradle/wrapper")).unwrap();
+    std::fs::write(
+        root.join("proj/gradle/wrapper/gradle-wrapper.properties"),
+        "distributionUrl=https\\://services.gradle.org/distributions/gradle-6.7.1-bin.zip\n",
+    )
+    .unwrap();
+    let before = snapshot(root);
+    let (code, env) = socket(root, &["vendor"]);
+    assert_eq!(code, Some(1), "{env}");
+    assert!(env.to_string().contains("gradle_below_6_8"), "{env}");
+    assert_eq!(snapshot(root), before);
+}
+
+#[test]
+fn gradle_verification_parents_and_boms_are_shared_and_revert_in_either_order() {
+    for (first, components) in [
+        ("foo", "<components>\n  </components>"),
+        ("bar", "<components>\n  </components>"),
+        ("foo", "<components/>"),
+        ("bar", "<components/>"),
+    ] {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        fixture(root, Shape::Gradle, &[("foo", FOO_UUID), ("bar", BAR_UUID)]);
+        for name in ["foo", "bar"] {
+            std::fs::write(root.join(format!("m2/org/example/{name}/1.0/{name}-1.0.pom")), format!("<project><modelVersion>4.0.0</modelVersion><parent><groupId>org.example</groupId><artifactId>parent</artifactId><version>1</version></parent><artifactId>{name}</artifactId><version>1.0</version><properties><bom.version>2</bom.version></properties></project>")).unwrap();
+        }
+        for (name, body) in [
+            ("parent", "<properties><bom.version>1</bom.version></properties><dependencyManagement><dependencies><dependency><groupId>org.example</groupId><artifactId>bom</artifactId><version>${bom.version}</version><scope>import</scope><type>pom</type></dependency></dependencies></dependencyManagement>"),
+            ("bom", ""),
+        ] {
+            let version = if name == "bom" { "2" } else { "1" };
+            let dir = root.join(format!("m2/org/example/{name}/{version}"));
+            std::fs::create_dir_all(&dir).unwrap();
+            std::fs::write(dir.join(format!("{name}-{version}.pom")), format!("<project><groupId>org.example</groupId><artifactId>{name}</artifactId><version>{version}</version>{body}</project>")).unwrap();
+        }
+        let default_bom = root.join("m2/org/example/bom/1");
+        std::fs::create_dir_all(&default_bom).unwrap();
+        std::fs::write(default_bom.join("bom-1.pom"), "<project><groupId>org.example</groupId><artifactId>bom</artifactId><version>1</version></project>").unwrap();
+        let verification = root.join("proj/gradle/verification-metadata.xml");
+        std::fs::create_dir_all(verification.parent().unwrap()).unwrap();
+        let original = format!("<verification-metadata>\n  <configuration><verify-metadata>true</verify-metadata></configuration>\n  {components}\n</verification-metadata>\n");
+        std::fs::write(&verification, &original).unwrap();
+        let before = snapshot(root);
+        ok(root, &["vendor"]);
+        ok(root, &["vendor", "--check"]);
+        let text = std::fs::read_to_string(&verification).unwrap();
+        assert!(text.contains("name=\"parent\""), "{text}");
+        assert!(text.contains("name=\"bom\" version=\"1\""), "{text}");
+        assert!(text.contains("name=\"bom\" version=\"2\""), "{text}");
+        let drifted = text.replace("name=\"parent\"", "name=\"not-parent\"");
+        std::fs::write(&verification, drifted).unwrap();
+        let (code, env) = socket(root, &["vendor", "--check"]);
+        assert_eq!(code, Some(1), "{env}");
+        std::fs::write(&verification, &text).unwrap();
+        ok(root, &["remove", &purl(first)]);
+        assert!(std::fs::read_to_string(&verification)
+            .unwrap()
+            .contains("name=\"parent\""));
+        ok(root, &["vendor", "--revert"]);
+        assert_eq!(std::fs::read_to_string(&verification).unwrap(), original);
+        // remove changes the manifest by design; all build wiring remains byte exact.
+        let mut after = snapshot(root);
+        let mut before = before;
+        after.remove(".socket/manifest.json");
+        before.remove(".socket/manifest.json");
+        assert_eq!(after, before);
+    }
+}
+
+#[test]
+fn check_refuses_a_missing_ledger_and_honors_manifest_path() {
+    let tmp = tempfile::tempdir().unwrap();
+    let root = tmp.path();
+    fixture(root, Shape::Gradle, &[("foo", FOO_UUID)]);
+    ok(root, &["vendor"]);
+    let nested = root.join("proj/elsewhere");
+    std::fs::create_dir_all(nested.join(".socket")).unwrap();
+    std::fs::write(nested.join(".socket/manifest.json"), "{\"patches\":{}}").unwrap();
+    // A manifest path selects its project root, even with a different --cwd.
+    let env = ok(
+        root,
+        &[
+            "vendor",
+            "--check",
+            "--manifest-path",
+            "elsewhere/.socket/manifest.json",
+        ],
+    );
+    assert_eq!(env["summary"]["verified"], 0);
+    std::fs::remove_file(root.join("proj/.socket/manifest.json")).unwrap();
+    std::fs::remove_file(root.join("proj/.socket/vendor/state.json")).unwrap();
+    let before = snapshot(root);
+    let (code, env) = socket(root, &["vendor", "--check"]);
+    assert_eq!(code, Some(1), "{env}");
+    assert!(env.to_string().contains("vendor_ledger_missing"), "{env}");
+    assert_eq!(snapshot(root), before);
+}
+
+#[test]
+fn vex_reports_an_unreadable_jvm_layout_instead_of_an_unwired_patch() {
+    for shape in [Shape::Reactor, Shape::Gradle] {
+        let tmp = tempfile::tempdir().unwrap();
+        let root = tmp.path();
+        fixture(root, shape, &[("foo", FOO_UUID)]);
+        ok(root, &["vendor"]);
+        let rel = if shape == Shape::Reactor {
+            "proj/a/pom.xml"
+        } else {
+            "proj/.socket/vendor/gradle-index.tsv"
+        };
+        std::fs::write(root.join(rel), "INVALID").unwrap();
+        let vex = root.join("vex.json");
+        let (_, env) = socket(
+            root,
+            &[
+                "vex",
+                "-O",
+                vex.to_str().unwrap(),
+                "--product",
+                "pkg:generic/x@1",
+            ],
+        );
+        assert!(
+            env.to_string().contains("vendor_jvm_shape_unsupported"),
+            "{env}"
+        );
+        assert!(!env.to_string().contains("vendor_unwired"), "{env}");
+        if let Ok(bytes) = std::fs::read(vex) {
+            assert!(!String::from_utf8_lossy(&bytes).contains("not_affected"));
+        }
+    }
+}
diff --git a/crates/socket-patch-core/src/api/vendor_prefetch.rs b/crates/socket-patch-core/src/api/vendor_prefetch.rs
index 212fdd29..d2c76d07 100644
--- a/crates/socket-patch-core/src/api/vendor_prefetch.rs
+++ b/crates/socket-patch-core/src/api/vendor_prefetch.rs
@@ -1420,6 +1420,7 @@ mod tests {
             out
         }
         let cfg = crate::vendor::VendorServiceConfig {
+            maven_config: None,
             source: crate::vendor::VendorSource::Auto,
             client: Some(client(&server.uri())),
             use_public_proxy: false,
diff --git a/crates/socket-patch-core/src/utils/group_commit.rs b/crates/socket-patch-core/src/utils/group_commit.rs
index d00a2da3..e8f2284f 100644
--- a/crates/socket-patch-core/src/utils/group_commit.rs
+++ b/crates/socket-patch-core/src/utils/group_commit.rs
@@ -167,7 +167,15 @@ fn is_captured(rel: &Path) -> bool {
         return false;
     }
     let spelled = rel.to_string_lossy().replace('\\', "/");
-    if LEDGERS.contains(&spelled.as_str()) {
+    if LEDGERS.contains(&spelled.as_str())
+        || [
+            ".socket/vendor/gradle-index.tsv",
+            ".socket/gradle/socket-patch.settings.gradle",
+            ".socket/vendor/maven2/.gitattributes",
+            ".socket/vendor/gradle/.gitattributes",
+        ]
+        .contains(&spelled.as_str())
+    {
         return true;
     }
     !rel.components()
@@ -1061,6 +1069,11 @@ mod tests {
             (".cargo/config.toml", true),
             (".socket/vendor/state.json", true),
             (".socket/vendor/redirect-state.json", true),
+            (".socket/vendor/gradle-index.tsv", true),
+            (".socket/gradle/socket-patch.settings.gradle", true),
+            (".socket/vendor/maven2/.gitattributes", true),
+            (".socket/vendor/gradle/.gitattributes", true),
+            (".socket/vendor/gradle/g/a/1/a-1.jar", false),
             (".socket/vendor/npm/u/left-pad-1.3.0.tgz", false),
             (".socket/manifest.json", false),
             ("packages/a/.socket/vendor/npm/u/a.tgz", false),
diff --git a/crates/socket-patch-core/src/vendor/cargo.rs b/crates/socket-patch-core/src/vendor/cargo.rs
index 2e728264..1aa0cde1 100644
--- a/crates/socket-patch-core/src/vendor/cargo.rs
+++ b/crates/socket-patch-core/src/vendor/cargo.rs
@@ -3574,6 +3574,7 @@ mod tests {
 
     fn cargo_service_cfg(uri: &str, source: VendorSource, offline: bool) -> VendorServiceConfig {
         VendorServiceConfig {
+            maven_config: None,
             source,
             client: Some(
                 ApiClient::new(ApiClientOptions {
diff --git a/crates/socket-patch-core/src/vendor/composer_lock.rs b/crates/socket-patch-core/src/vendor/composer_lock.rs
index 03117b36..34ff95c1 100644
--- a/crates/socket-patch-core/src/vendor/composer_lock.rs
+++ b/crates/socket-patch-core/src/vendor/composer_lock.rs
@@ -2277,6 +2277,7 @@ mod tests {
 
     fn composer_service_cfg(uri: &str, source: VendorSource, offline: bool) -> VendorServiceConfig {
         VendorServiceConfig {
+            maven_config: None,
             source,
             client: Some(
                 ApiClient::new(ApiClientOptions {
diff --git a/crates/socket-patch-core/src/vendor/gem.rs b/crates/socket-patch-core/src/vendor/gem.rs
index 078f452d..463d4113 100644
--- a/crates/socket-patch-core/src/vendor/gem.rs
+++ b/crates/socket-patch-core/src/vendor/gem.rs
@@ -4589,6 +4589,7 @@ mod tests {
 
     fn gem_service_cfg(uri: &str, source: VendorSource, offline: bool) -> VendorServiceConfig {
         VendorServiceConfig {
+            maven_config: None,
             source,
             client: Some(
                 ApiClient::new(ApiClientOptions {
diff --git a/crates/socket-patch-core/src/vendor/golang.rs b/crates/socket-patch-core/src/vendor/golang.rs
index 83477a03..1b14ff72 100644
--- a/crates/socket-patch-core/src/vendor/golang.rs
+++ b/crates/socket-patch-core/src/vendor/golang.rs
@@ -1677,6 +1677,7 @@ mod tests {
 
     fn go_service_cfg(uri: &str, source: VendorSource, offline: bool) -> VendorServiceConfig {
         VendorServiceConfig {
+            maven_config: None,
             source,
             client: Some(
                 ApiClient::new(ApiClientOptions {
diff --git a/crates/socket-patch-core/src/vendor/jvm/apply.rs b/crates/socket-patch-core/src/vendor/jvm/apply.rs
new file mode 100644
index 00000000..9ad6fc78
--- /dev/null
+++ b/crates/socket-patch-core/src/vendor/jvm/apply.rs
@@ -0,0 +1,1293 @@
+//! Disk side of the JVM backend: write a [`JvmPlan`], record it,
+//! and revert it.
+//!
+//! Records: the planners' fragment records, plus
+//! * [`TREE_KIND`] — one per vendored artifact file, `new` = its sha256.
+//!   Revert deletes it while the hash still matches;
+//! * [`CREATED_DIR_KIND`] — a directory vendor created; removed on revert
+//!   once empty.
+//!
+//! SECURITY: state.json is committed and tamper-able, so every recorded path
+//! must be one a planner can produce for the entry's own coordinates, and
+//! every path is resolved component by component: a symlink leaving the
+//! checkout fails closed (`build_file_outside_root`), one inside it is
+//! followed, so a symlinked build file is edited through its link.
+
+use std::cell::RefCell;
+use std::collections::BTreeSet;
+use std::path::{Path, PathBuf};
+
+use serde_json::Value;
+
+use crate::patch::path_safety::is_canonical_uuid;
+use crate::utils::fs::{
+    atomic_write_bytes_preserving_mode, read_regular_to_bytes_sync, remove_file,
+};
+use crate::utils::group_commit;
+use crate::utils::purl::parse_maven_purl;
+
+use super::super::state::{VendorEntry, WiringAction, WiringRecord};
+use super::super::{RevertOpts, RevertOutcome, VendorWarning};
+use super::{
+    gradle, maven_reactor, op_of, op_str, safe_coordinates, sha256_hex, Coords, JvmPlan, JvmUnplan,
+    CONFIG_LINE_KIND, CREATED_DIR_KIND, KINDS, OWNED_FILE_KIND, POM_FRAGMENT_KIND,
+    SETTINGS_FRAGMENT_KIND, TREE_KIND, VERIFICATION_FRAGMENT_KIND,
+};
+
+/// Whether `entry` was written by this backend: it has wiring and every
+/// record is one of this backend's kinds.
+pub fn is_jvm_entry(entry: &VendorEntry) -> bool {
+    !entry.wiring.is_empty()
+        && entry
+            .wiring
+            .iter()
+            .all(|w| KINDS.contains(&w.kind.as_str()))
+}
+
+/// Offline inputs have not been authenticated by independent registry checksums.
+pub fn upstream_unverified(entry: &VendorEntry) -> bool {
+    is_jvm_entry(entry)
+        && !entry
+            .wiring
+            .iter()
+            .any(|w| w.kind == super::UPSTREAM_KIND && op_of(w) == "registry_verified")
+}
+
+/// The validated `(group, artifact, version)` of a JVM entry: a maven purl
+/// in the JVM coordinate grammar and a canonical uuid.
+pub fn entry_gav(entry: &VendorEntry) -> Result<(String, String, String), String> {
+    if !is_canonical_uuid(&entry.uuid) {
+        return Err(format!("non-canonical patch uuid {:?}", entry.uuid));
+    }
+    let (g, a, v) = parse_maven_purl(&entry.base_purl)
+        .ok_or_else(|| format!("not a maven purl: {:?}", entry.base_purl))?;
+    if !safe_coordinates(&g, &a, &v) {
+        return Err(format!("unsafe maven coordinates in {:?}", entry.base_purl));
+    }
+    Ok((g.into_owned(), a.into_owned(), v.into_owned()))
+}
+
+/// A project-relative path with no `..`, no empty or absolute segment and
+/// no `.git` segment.
+fn safe_rel(rel: &str) -> bool {
+    !rel.is_empty()
+        && !rel.starts_with('/')
+        && !rel.contains('\\')
+        && !rel.contains(':')
+        && rel
+            .split('/')
+            .all(|s| !s.is_empty() && s != "." && s != ".." && !s.eq_ignore_ascii_case(".git"))
+}
+
+fn is_settings_file(rel: &str) -> bool {
+    matches!(
+        rel.rsplit('/').next(),
+        Some("settings.gradle" | "settings.gradle.kts")
+    )
+}
+
+/// A text file some planner edits or owns.
+fn is_wiring_file(rel: &str) -> bool {
+    let under_owned = rel.starts_with(".socket/") || rel.starts_with(".mvn/");
+    rel == maven_reactor::MAVEN_CONFIG
+        || is_owned_file(rel)
+        || (!under_owned && (rel.ends_with(".xml") || is_settings_file(rel)))
+}
+
+fn is_owned_file(rel: &str) -> bool {
+    [
+        maven_reactor::GITATTRIBUTES_REL,
+        gradle::GITATTRIBUTES_REL,
+        gradle::SCRIPT_REL,
+        gradle::INDEX_REL,
+    ]
+    .contains(&rel)
+}
+
+/// A file directly in `c`'s own Maven or Gradle version directory.
+fn is_own_tree_file(rel: &str, c: &Coords<'_>) -> bool {
+    [maven_reactor::tree_dir(c), gradle::tree_dir(c)]
+        .iter()
+        .any(|dir| {
+            rel.strip_prefix(dir.as_str())
+                .and_then(|r| r.strip_prefix('/'))
+                .is_some_and(|name| !name.is_empty() && !name.contains('/'))
+        })
+}
+
+/// A directory a plan may create.
+fn is_creatable_dir(rel: &str) -> bool {
+    rel == ".mvn" || rel == ".socket" || rel.starts_with(".socket/")
+}
+
+/// Whether record `w` of the entry for `c` names a path its kind allows.
+fn record_allowed(w: &WiringRecord, c: &Coords<'_>) -> bool {
+    let rel = w.file.as_str();
+    safe_rel(rel)
+        && match w.kind.as_str() {
+            POM_FRAGMENT_KIND => {
+                rel.ends_with(".xml") && !rel.starts_with(".socket/") && !rel.starts_with(".mvn/")
+            }
+            CONFIG_LINE_KIND => rel == maven_reactor::MAVEN_CONFIG,
+            SETTINGS_FRAGMENT_KIND => is_settings_file(rel) && !rel.starts_with(".socket/"),
+            VERIFICATION_FRAGMENT_KIND => rel == gradle::VERIFICATION_REL,
+            OWNED_FILE_KIND => is_owned_file(rel),
+            TREE_KIND | super::UPSTREAM_KIND => is_own_tree_file(rel, c),
+            CREATED_DIR_KIND => is_creatable_dir(rel),
+            _ => false,
+        }
+}
+
+/// Reads project files for the planners, resolving every path inside the
+/// checkout (see the module doc) and honouring an open group commit. The
+/// first path that resolved outside the checkout is kept for the caller's
+/// refusal.
+pub struct ProjectReader {
+    root: PathBuf,
+    canonical: Option<PathBuf>,
+    escaped: RefCell<Option<String>>,
+    read_error: RefCell<Option<String>>,
+}
+
+impl ProjectReader {
+    pub fn new(root: &Path) -> Self {
+        Self {
+            root: root.to_path_buf(),
+            canonical: std::fs::canonicalize(root).ok(),
+            escaped: RefCell::new(None),
+            read_error: RefCell::new(None),
+        }
+    }
+
+    /// Regular files only; a directory, special file or unsafe path reads
+    /// as missing.
+    pub fn read(&self, rel: &str) -> Option<Vec<u8>> {
+        let path = match self.resolve(rel) {
+            Ok(path) => path,
+            Err(e) => {
+                self.read_error.borrow_mut().get_or_insert(e);
+                return None;
+            }
+        };
+        match group_commit::read(&path).unwrap_or_else(|| read_regular_to_bytes_sync(&path)) {
+            Ok(bytes) => Some(bytes),
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => None,
+            Err(e) => {
+                self.read_error
+                    .borrow_mut()
+                    .get_or_insert(format!("{rel}: {e}"));
+                None
+            }
+        }
+    }
+
+    /// The first path that resolved outside the checkout.
+    pub fn escaped(&self) -> Option<String> {
+        self.escaped.borrow().clone()
+    }
+
+    /// `rel` under the canonical root, following in-checkout symlinks.
+    fn resolve(&self, rel: &str) -> Result<PathBuf, String> {
+        if !safe_rel(rel) {
+            return Err(format!("unsafe path {rel:?}"));
+        }
+        let Some(canonical) = &self.canonical else {
+            return Err(format!(
+                "cannot resolve project root {}",
+                self.root.display()
+            ));
+        };
+        let segments: Vec<&str> = rel.split('/').collect();
+        let mut cur = canonical.clone();
+        for (i, seg) in segments.iter().enumerate() {
+            let next = cur.join(seg);
+            match std::fs::symlink_metadata(&next) {
+                Err(e) if e.kind() == std::io::ErrorKind::NotFound => {
+                    return Ok(segments[i + 1..].iter().fold(next, |p, s| p.join(s)));
+                }
+                Err(e) => return Err(format!("cannot inspect {}: {e}", next.display())),
+                Ok(meta) if meta.file_type().is_symlink() => {
+                    let target = std::fs::canonicalize(&next)
+                        .ok()
+                        .filter(|t| t.starts_with(canonical));
+                    let Some(target) = target else {
+                        let at = segments[..=i].join("/");
+                        self.escaped.borrow_mut().get_or_insert(at.clone());
+                        return Err(format!(
+                            "{at} is a symlink that leaves the project (or dangles)"
+                        ));
+                    };
+                    cur = target;
+                }
+                Ok(_) => cur = next,
+            }
+        }
+        Ok(cur)
+    }
+}
+
+/// Read a project file for the planners (see [`ProjectReader::read`]).
+pub fn read_project_file(root: &Path, rel: &str) -> Option<Vec<u8>> {
+    ProjectReader::new(root).read(rel)
+}
+
+/// The `build_file_outside_root` refusal detail for `rel`.
+pub fn outside_root_detail(rel: &str) -> String {
+    format!(
+        "reason: build_file_outside_root: {rel} is a symlink that leaves the project (or \
+         dangles); vendoring only edits files inside the checkout"
+    )
+}
+
+/// Whether `existing` at the tree path `rel` is a file an earlier vendoring
+/// wrote: listed with its hash in the directory's marker, or the marker.
+fn is_vendored_tree_file(reader: &ProjectReader, rel: &str, existing: &[u8]) -> bool {
+    let Some((dir, name)) = rel.rsplit_once('/') else {
+        return false;
+    };
+    let parse = |bytes: &[u8]| serde_json::from_slice::<Value>(bytes).ok();
+    if name == maven_reactor::MARKER_FILE {
+        return parse(existing)
+            .is_some_and(|m| m.get("uuid").is_some() && m.get("schema").is_some());
+    }
+    reader
+        .read(&format!("{dir}/{}", maven_reactor::MARKER_FILE))
+        .and_then(|m| parse(&m))
+        .and_then(|m| {
+            m.get("files")?
+                .get(name)?
+                .get("sha256")?
+                .as_str()
+                .map(str::to_string)
+        })
+        .is_some_and(|sha| sha == sha256_hex(existing))
+}
+
+/// Write `plan` under `root` and return its records: the plan's fragment
+/// records, then the created directories and the tree files. Nothing is
+/// written for a plan that fails validation.
+pub async fn write_plan(root: &Path, plan: &JvmPlan) -> Result<Vec<WiringRecord>, String> {
+    let state = super::super::state::load_state(root)
+        .await
+        .map_err(|e| format!("vendor_state_unreadable: {e}"))?;
+    let reader = ProjectReader::new(root);
+    let mut targets = Vec::new();
+    for w in &plan.writes {
+        let allowed = if w.tree {
+            w.rel.starts_with(".socket/vendor/maven2/")
+                || w.rel.starts_with(".socket/vendor/gradle/")
+        } else {
+            is_wiring_file(&w.rel)
+        };
+        if !allowed || !safe_rel(&w.rel) {
+            return Err(format!(
+                "refusing to write {:?}: not a vendoring path",
+                w.rel
+            ));
+        }
+        let path = reader.resolve(&w.rel)?;
+        match reader.read(&w.rel) {
+            Some(existing) if w.tree && existing != w.bytes => {
+                let owned = state.entries.values().any(|e| {
+                    let Ok((g, a, v)) = entry_gav(e) else {
+                        return false;
+                    };
+                    let c = Coords {
+                        group_id: &g,
+                        artifact_id: &a,
+                        version: &v,
+                        uuid: &e.uuid,
+                    };
+                    is_jvm_entry(e)
+                        && e.wiring.iter().any(|r| {
+                            r.kind == TREE_KIND && r.file == w.rel && record_allowed(r, &c)
+                        })
+                });
+                if !owned && !is_vendored_tree_file(&reader, &w.rel, &existing) {
+                    return Err(format!(
+                        "{} already exists and was not written by socket-patch; refusing to \
+                         overwrite it",
+                        w.rel
+                    ));
+                }
+            }
+            None if path.exists() => {
+                return Err(format!(
+                    "{} is not a regular file; refusing to edit it",
+                    w.rel
+                ));
+            }
+            _ => {}
+        }
+        targets.push((w, path));
+    }
+
+    let mut created_dirs: Vec<String> = Vec::new();
+    for w in &plan.writes {
+        let mut prefix = String::new();
+        let segments: Vec<&str> = w.rel.split('/').collect();
+        for seg in &segments[..segments.len() - 1] {
+            if !prefix.is_empty() {
+                prefix.push('/');
+            }
+            prefix.push_str(seg);
+            if created_dirs.contains(&prefix) || reader.resolve(&prefix)?.is_dir() {
+                continue;
+            }
+            if !is_creatable_dir(&prefix) {
+                return Err(format!("refusing to create directory {prefix:?}"));
+            }
+            created_dirs.push(prefix.clone());
+        }
+    }
+
+    let mut records = plan.records.clone();
+    records.extend(created_dirs.into_iter().map(|dir| WiringRecord {
+        file: dir,
+        kind: CREATED_DIR_KIND.to_string(),
+        action: WiringAction::Added,
+        key: None,
+        original: None,
+        new: None,
+    }));
+    // Artifacts first: nothing names them until the wiring lands.
+    targets.sort_by_key(|(w, _)| !w.tree);
+    for (w, path) in targets {
+        write_bytes(&path, &w.bytes)
+            .await
+            .map_err(|e| format!("failed to write {}: {e}", w.rel))?;
+    }
+    let mut tree: Vec<(String, String)> = plan.tree_files.clone();
+    tree.extend(
+        plan.writes
+            .iter()
+            .filter(|w| w.tree)
+            .map(|w| (w.rel.clone(), sha256_hex(&w.bytes))),
+    );
+    tree.sort();
+    tree.dedup();
+    records.extend(tree.into_iter().map(|(file, sha)| WiringRecord {
+        file,
+        kind: TREE_KIND.to_string(),
+        action: WiringAction::Added,
+        key: None,
+        original: None,
+        new: Some(Value::String(sha)),
+    }));
+    Ok(records)
+}
+
+async fn write_bytes(path: &Path, bytes: &[u8]) -> std::io::Result<()> {
+    if let Some(parent) = path.parent() {
+        tokio::fs::create_dir_all(parent).await?;
+    }
+    atomic_write_bytes_preserving_mode(path, bytes).await
+}
+
+/// Complete `records` from other JVM entries: an `adopt` record takes
+/// the creation record of the peer that wrote that shared fragment, a
+/// rewrite of another patch's suffixed version takes its pristine
+/// `original`, and the directories a peer created that this entry now
+/// relies on are listed too. The ledger entry this one replaces is a peer.
+pub fn inherit_peer_records<'e>(
+    records: &mut Vec<WiringRecord>,
+    peers: impl IntoIterator<Item = &'e VendorEntry>,
+) {
+    let peer_records: Vec<&WiringRecord> = peers
+        .into_iter()
+        .filter(|e| is_jvm_entry(e))
+        .flat_map(|e| &e.wiring)
+        .collect();
+    let same =
+        |p: &WiringRecord, r: &WiringRecord| p.file == r.file && p.kind == r.kind && p.key == r.key;
+    for r in records.iter_mut() {
+        if op_of(r) == "adopt" {
+            if let Some(p) = peer_records
+                .iter()
+                .find(|p| same(p, r) && op_of(p) != "adopt")
+            {
+                *r = (*p).clone();
+            }
+        } else if r.kind == POM_FRAGMENT_KIND
+            && r.action == WiringAction::Rewritten
+            && r.original.is_none()
+        {
+            if let Some(p) = peer_records
+                .iter()
+                .find(|p| same(p, r) && p.original.is_some())
+            {
+                r.original = p.original.clone();
+            }
+        } else if r.kind == VERIFICATION_FRAGMENT_KIND && op_str(r, "from").is_none() {
+            let from = peer_records
+                .iter()
+                .find(|p| same(p, r))
+                .and_then(|p| op_str(p, "from"));
+            if let (Some(from), Some(op)) = (from, r.new.as_mut().and_then(Value::as_object_mut)) {
+                op.insert("from".to_string(), Value::String(from.to_string()));
+            }
+        }
+    }
+    let mut needed: BTreeSet<String> = BTreeSet::new();
+    for r in records.iter().filter(|r| r.kind != CREATED_DIR_KIND) {
+        let mut dir = r.file.as_str();
+        while let Some((parent, _)) = dir.rsplit_once('/') {
+            needed.insert(parent.to_string());
+            dir = parent;
+        }
+    }
+    for p in peer_records.iter().filter(|p| p.kind == CREATED_DIR_KIND) {
+        let listed = records
+            .iter()
+            .any(|r| r.kind == CREATED_DIR_KIND && r.file == p.file);
+        if needed.contains(&p.file) && !listed {
+            records.push((*p).clone());
+        }
+    }
+}
+
+fn drifted(detail: String) -> VendorWarning {
+    VendorWarning::new("vendor_lock_entry_drifted", format!("{detail}; left alone"))
+}
+
+/// Whether the wiring belongs to the Gradle planner.
+fn is_gradle(wiring: &[WiringRecord]) -> bool {
+    wiring.iter().any(|w| {
+        matches!(
+            w.kind.as_str(),
+            SETTINGS_FRAGMENT_KIND | VERIFICATION_FRAGMENT_KIND
+        ) || w.file == gradle::INDEX_REL
+            || w.file == gradle::SCRIPT_REL
+            || w.file.starts_with(&format!("{}/", gradle::TREE_ROOT))
+    })
+}
+
+/// Revert the JVM `entry`: its own fragments now, shared fragments
+/// only once no other patch references them, so peers stay wired whatever
+/// the revert order. A fragment still present but in a shape vendor did
+/// not write is left alone with `vendor_lock_entry_drifted`; while it still
+/// references the tree, the tree is kept too (`kept_artifact`).
+pub async fn revert(root: &Path, entry: &VendorEntry, opts: RevertOpts) -> RevertOutcome {
+    let (g, a, v) = match entry_gav(entry) {
+        Ok(gav) => gav,
+        Err(e) => return RevertOutcome::failed(format!("refusing revert: {e}")),
+    };
+    let c = Coords {
+        group_id: &g,
+        artifact_id: &a,
+        version: &v,
+        uuid: &entry.uuid,
+    };
+    if let Some(w) = entry.wiring.iter().find(|w| !record_allowed(w, &c)) {
+        return RevertOutcome::failed(format!(
+            "refusing revert: recorded {} path {:?} is not one vendoring writes for {}",
+            w.kind, w.file, entry.base_purl
+        ));
+    }
+    let reader = ProjectReader::new(root);
+    let read = |rel: &str| reader.read(rel);
+    let peers = match super::super::state::load_state(root).await {
+        Ok(state) => state,
+        Err(e) => return RevertOutcome::failed(format!("vendor_state_unreadable: {e}")),
+    };
+    let records: Vec<_> = entry
+        .wiring
+        .iter()
+        .filter(|w| {
+            !(w.kind == VERIFICATION_FRAGMENT_KIND
+                && w.key.as_deref().is_some_and(|k| k.starts_with("metadata:"))
+                && peers.entries.values().any(|peer| {
+                    peer.base_purl != entry.base_purl
+                        && entry_wired(root, peer)
+                        && peer
+                            .wiring
+                            .iter()
+                            .any(|p| p.kind == w.kind && p.file == w.file && p.key == w.key)
+                }))
+        })
+        .cloned()
+        .collect();
+    let unplan: JvmUnplan = if is_gradle(&entry.wiring) {
+        gradle::unplan(&read, &c, &records)
+    } else {
+        maven_reactor::unplan(&read, &c, &entry.wiring)
+    };
+    if let Some(rel) = reader.escaped() {
+        return RevertOutcome::failed(format!(
+            "refusing revert: {rel} is a symlink that leaves the project"
+        ));
+    }
+    let mut warnings: Vec<VendorWarning> = unplan.drifted.into_iter().map(drifted).collect();
+    let mut kept = unplan.still_wired;
+    let mut present = Vec::new();
+    if !kept && !opts.keep_artifact {
+        for w in entry.wiring.iter().filter(|w| w.kind == TREE_KIND) {
+            let Some(bytes) = reader.read(&w.file) else {
+                continue;
+            };
+            if w.new.as_ref().and_then(Value::as_str) != Some(sha256_hex(&bytes).as_str()) {
+                warnings.push(drifted(format!("{} was modified", w.file)));
+                kept = true;
+            }
+            present.push(w);
+        }
+    }
+    if opts.dry_run {
+        return RevertOutcome {
+            success: true,
+            warnings,
+            error: None,
+            kept_artifact: kept,
+        };
+    }
+    let fail = |warnings: Vec<VendorWarning>, e: String| RevertOutcome {
+        success: false,
+        warnings,
+        error: Some(e),
+        kept_artifact: false,
+    };
+
+    let mut removed: Vec<String> = Vec::new();
+    for (rel, bytes) in &unplan.changes {
+        if !is_wiring_file(rel) {
+            return fail(
+                warnings,
+                format!("refusing revert: {rel:?} is not a vendoring path"),
+            );
+        }
+        let path = match reader.resolve(rel) {
+            Ok(path) => path,
+            Err(e) => return fail(warnings, format!("refusing revert: {e}")),
+        };
+        let res = match bytes {
+            Some(bytes) => write_bytes(&path, bytes).await,
+            None => {
+                removed.push(rel.clone());
+                remove_file(&path).await
+            }
+        };
+        if let Err(e) = res {
+            return fail(warnings, format!("failed to restore {rel}: {e}"));
+        }
+    }
+
+    if !kept && !opts.keep_artifact {
+        // One modified file keeps the whole tree: a partial artifact is
+        // worse than a kept one.
+        for w in present.into_iter().filter(|_| !kept) {
+            let res = match reader.resolve(&w.file) {
+                Ok(path) => remove_file(&path).await.map_err(|e| e.to_string()),
+                Err(e) => Err(e),
+            };
+            if let Err(e) = res {
+                return fail(warnings, format!("failed to remove {}: {e}", w.file));
+            }
+            removed.push(w.file.clone());
+        }
+    }
+    prune_dirs(&reader, &entry.wiring, &removed).await;
+    RevertOutcome {
+        success: true,
+        warnings,
+        error: None,
+        kept_artifact: kept,
+    }
+}
+
+/// Owned directories pruned once empty, up to and including themselves.
+const OWNED_DIRS: &[&str] = &[
+    ".socket/vendor/maven2",
+    ".socket/vendor/gradle",
+    ".socket/gradle",
+];
+
+/// Remove, deepest first and only when empty, the parents of `removed` up to
+/// their owned root, and every directory `wiring` records as created.
+async fn prune_dirs(reader: &ProjectReader, wiring: &[WiringRecord], removed: &[String]) {
+    let mut dirs: BTreeSet<String> = wiring
+        .iter()
+        .filter(|w| w.kind == CREATED_DIR_KIND)
+        .map(|w| w.file.clone())
+        .collect();
+    for rel in removed {
+        let mut dir = rel.as_str();
+        while let Some((parent, _)) = dir.rsplit_once('/') {
+            if !OWNED_DIRS
+                .iter()
+                .any(|o| parent == *o || parent.starts_with(&format!("{o}/")))
+            {
+                break;
+            }
+            dirs.insert(parent.to_string());
+            dir = parent;
+        }
+    }
+    let mut dirs: Vec<String> = dirs.into_iter().collect();
+    dirs.sort_by_key(|d| std::cmp::Reverse(d.matches('/').count()));
+    for dir in dirs {
+        if let Ok(path) = reader.resolve(&dir) {
+            group_commit::remove_dir_after_commit(&path).await;
+        }
+    }
+}
+
+/// After a patch update replaced `prev`, delete its tree files that no live
+/// entry records (a Maven update moves to a new suffixed-version directory;
+/// a Gradle one rewrote the same paths). `Ok(true)` when anything went.
+pub async fn sweep_replaced_tree<'e>(
+    root: &Path,
+    prev: &VendorEntry,
+    live: impl IntoIterator<Item = &'e VendorEntry>,
+) -> Result<bool, String> {
+    let (g, a, v) = entry_gav(prev)?;
+    let c = Coords {
+        group_id: &g,
+        artifact_id: &a,
+        version: &v,
+        uuid: &prev.uuid,
+    };
+    let live_files: BTreeSet<&str> = live
+        .into_iter()
+        .flat_map(|e| &e.wiring)
+        .filter(|w| w.kind == TREE_KIND)
+        .map(|w| w.file.as_str())
+        .collect();
+    let reader = ProjectReader::new(root);
+    let mut removed = Vec::new();
+    for w in prev.wiring.iter().filter(|w| w.kind == TREE_KIND) {
+        if !record_allowed(w, &c) || live_files.contains(w.file.as_str()) {
+            continue;
+        }
+        let Some(bytes) = reader.read(&w.file) else {
+            continue;
+        };
+        if w.new.as_ref().and_then(Value::as_str) != Some(sha256_hex(&bytes).as_str()) {
+            continue;
+        }
+        let path = reader.resolve(&w.file)?;
+        remove_file(&path)
+            .await
+            .map_err(|e| format!("failed to remove {}: {e}", w.file))?;
+        removed.push(w.file.clone());
+    }
+    prune_dirs(&reader, &[], &removed).await;
+    Ok(!removed.is_empty())
+}
+
+/// Whether the project still wires the JVM `entry` (its suffixed version in
+/// a reactor pom; its index rows plus the root apply line for Gradle).
+pub fn entry_wired(root: &Path, entry: &VendorEntry) -> bool {
+    // Failure to read does not prove that deleting a tree is safe. Attestation
+    // uses the checked variant and reports the diagnostic instead.
+    entry_wired_checked(root, entry).unwrap_or(true)
+}
+
+pub fn entry_wired_checked(root: &Path, entry: &VendorEntry) -> Result<bool, String> {
+    let (g, a, v) = entry_gav(entry)?;
+    let c = Coords {
+        group_id: &g,
+        artifact_id: &a,
+        version: &v,
+        uuid: &entry.uuid,
+    };
+    let reader = ProjectReader::new(root);
+    let read = |rel: &str| reader.read(rel);
+    let wired = if is_gradle(&entry.wiring) {
+        gradle::wired_checked(&read, &c).map_err(|e| e.detail)
+    } else {
+        maven_reactor::wired_checked(&read, &c).map_err(|e| e.detail)
+    };
+    if let Some(e) = reader.read_error.borrow().as_ref() {
+        return Err(e.clone());
+    }
+    wired
+}
+
+/// Verify every recorded file plus the effective wiring, without writes or network I/O.
+pub fn check_entry(
+    root: &Path,
+    entry: &VendorEntry,
+    local_repo: Option<&Path>,
+) -> Result<(), String> {
+    let (g, a, v) = entry_gav(entry)?;
+    let c = Coords {
+        group_id: &g,
+        artifact_id: &a,
+        version: &v,
+        uuid: &entry.uuid,
+    };
+    let reader = ProjectReader::new(root);
+    let read = |rel: &str| reader.read(rel);
+    for w in &entry.wiring {
+        if !record_allowed(w, &c) {
+            return Err(format!("unsafe wiring record: {}", w.file));
+        }
+        if w.kind == TREE_KIND {
+            let bytes = read(&w.file).ok_or_else(|| format!("missing or unreadable {}", w.file))?;
+            if w.new.as_ref().and_then(Value::as_str) != Some(sha256_hex(&bytes).as_str()) {
+                return Err(format!("hash mismatch: {}", w.file));
+            }
+        }
+        if w.kind == VERIFICATION_FRAGMENT_KIND
+            && w.key.as_deref().is_some_and(|k| k.starts_with("metadata:"))
+        {
+            let bytes = read(&w.file).ok_or_else(|| format!("missing {}", w.file))?;
+            let text = std::str::from_utf8(&bytes).map_err(|e| e.to_string())?;
+            if !gradle::metadata_record_present(text, w) {
+                return Err(format!(
+                    "upstream verification entry drifted: {}",
+                    w.key.as_deref().unwrap_or("")
+                ));
+            }
+        }
+    }
+    let gradle = is_gradle(&entry.wiring);
+    let (jar, pom, module) = if gradle {
+        gradle::committed(&read, &c)
+    } else {
+        maven_reactor::committed(&read, &c).map(|(j, p)| (j, p, None))
+    }
+    .ok_or_else(|| "committed JVM tree is incomplete".to_string())?;
+    let patch = super::JvmPatch {
+        group_id: &g,
+        artifact_id: &a,
+        version: &v,
+        uuid: &entry.uuid,
+        jar: &jar,
+        upstream_pom: &pom,
+        upstream_module: module.as_deref(),
+    };
+    let plan = if gradle {
+        gradle::plan(&read, &patch)
+    } else {
+        let config = !entry.wiring.iter().any(|w| op_of(w) == "config_none");
+        maven_reactor::plan_with_config(&read, &patch, config)
+    }
+    .map_err(|e| e.detail)?;
+    if let Some(w) = plan.writes.first() {
+        return Err(format!("vendored wiring or metadata drifted: {}", w.rel));
+    }
+    if !entry_wired_checked(root, entry)? {
+        return Err("vendored artifact is no longer wired into the build".into());
+    }
+    let dir = reader.resolve(&plan.tree_dir)?;
+    for item in std::fs::read_dir(&dir).map_err(|e| e.to_string())? {
+        let item = item.map_err(|e| e.to_string())?;
+        let rel = format!("{}/{}", plan.tree_dir, item.file_name().to_string_lossy());
+        if !entry
+            .wiring
+            .iter()
+            .any(|w| w.kind == TREE_KIND && w.file == rel)
+        {
+            return Err(format!("unindexed vendored file: {rel}"));
+        }
+    }
+    if !gradle {
+        if let Some(repo) = local_repo {
+            for ext in ["jar", "pom"] {
+                let sv = c.suffixed_version();
+                let name = format!("{a}-{sv}.{ext}");
+                let cached = repo.join(c.group_path()).join(&a).join(&sv).join(&name);
+                if cached.exists() {
+                    let bytes = read_regular_to_bytes_sync(&cached).map_err(|e| e.to_string())?;
+                    if Some(bytes) != read(&format!("{}/{name}", plan.tree_dir)) {
+                        return Err(format!(
+                            "local Maven cache conflicts with vendored bytes: {}",
+                            cached.display()
+                        ));
+                    }
+                }
+            }
+        }
+    }
+    if let Some(rel) = reader.escaped() {
+        return Err(outside_root_detail(&rel));
+    }
+    Ok(())
+}
+
+/// The vendored jar of the JVM `entry` for `uuid`, project-relative: the
+/// artifact path must be the entry's own tree jar (the Maven directory
+/// carries the uuid; the Gradle one's marker must name it).
+pub fn checked_tree_jar(root: &Path, entry: &VendorEntry, uuid: &str) -> Result<String, String> {
+    let unsafe_path = || "vendor_path_unsafe".to_string();
+    if !is_jvm_entry(entry) {
+        return Err(unsafe_path());
+    }
+    let (g, a, v) = entry_gav(entry).map_err(|_| unsafe_path())?;
+    if entry.uuid != uuid {
+        return Err("vendor_uuid_mismatch".to_string());
+    }
+    let c = Coords {
+        group_id: &g,
+        artifact_id: &a,
+        version: &v,
+        uuid,
+    };
+    let rel = entry.artifact.path.as_str();
+    ProjectReader::new(root)
+        .resolve(rel)
+        .map_err(|_| unsafe_path())?;
+    let maven = format!(
+        "{}/{a}-{}.jar",
+        maven_reactor::tree_dir(&c),
+        c.suffixed_version()
+    );
+    let gradle_jar = format!("{}/{a}-{v}.jar", gradle::tree_dir(&c));
+    if rel == maven {
+        return Ok(maven);
+    }
+    if rel != gradle_jar {
+        return Err(unsafe_path());
+    }
+    let marker = ProjectReader::new(root)
+        .read(&format!("{}/{}", gradle::tree_dir(&c), gradle::MARKER_NAME))
+        .and_then(|m| serde_json::from_slice::<Value>(&m).ok());
+    match marker
+        .as_ref()
+        .and_then(|m| m.get("uuid"))
+        .and_then(Value::as_str)
+    {
+        Some(u) if u == uuid => Ok(gradle_jar),
+        _ => Err("vendor_uuid_mismatch".to_string()),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::super::FileWrite;
+    use super::*;
+
+    const UUID: &str = "1d3c1fd2-5e6f-4a7b-8c9d-0e1f2a3b4c5d";
+
+    fn coords() -> Coords<'static> {
+        Coords {
+            group_id: "g",
+            artifact_id: "a",
+            version: "1",
+            uuid: UUID,
+        }
+    }
+
+    fn entry(wiring: Vec<WiringRecord>) -> VendorEntry {
+        serde_json::from_value(serde_json::json!({
+            "ecosystem": "maven",
+            "basePurl": "pkg:maven/g/a@1",
+            "uuid": UUID,
+            "artifact": { "path": ".socket/vendor/maven2/g/a/1-socket.1d3c1fd2/a-1-socket.1d3c1fd2.jar", "sha256": "" },
+            "wiring": serde_json::to_value(wiring).unwrap(),
+        }))
+        .unwrap()
+    }
+
+    fn record(kind: &str, file: &str) -> WiringRecord {
+        WiringRecord {
+            file: file.to_string(),
+            kind: kind.to_string(),
+            action: WiringAction::Added,
+            key: Some("owned".into()),
+            original: None,
+            new: Some(serde_json::json!({ "op": "create" })),
+        }
+    }
+
+    fn tree_file(name: &str) -> String {
+        format!(".socket/vendor/maven2/g/a/1-socket.1d3c1fd2/{name}")
+    }
+
+    fn plan(writes: Vec<FileWrite>) -> JvmPlan {
+        JvmPlan {
+            writes,
+            ..JvmPlan::default()
+        }
+    }
+
+    #[test]
+    fn recorded_paths_are_whitelisted_per_kind() {
+        let c = coords();
+        let ok = [
+            (POM_FRAGMENT_KIND, "a/pom.xml"),
+            (POM_FRAGMENT_KIND, "mod/custom.xml"),
+            (CONFIG_LINE_KIND, ".mvn/maven.config"),
+            (SETTINGS_FRAGMENT_KIND, "settings.gradle"),
+            (SETTINGS_FRAGMENT_KIND, "build-logic/settings.gradle.kts"),
+            (
+                VERIFICATION_FRAGMENT_KIND,
+                "gradle/verification-metadata.xml",
+            ),
+            (
+                OWNED_FILE_KIND,
+                ".socket/gradle/socket-patch.settings.gradle",
+            ),
+            (OWNED_FILE_KIND, ".socket/vendor/maven2/.gitattributes"),
+            (
+                TREE_KIND,
+                ".socket/vendor/maven2/g/a/1-socket.1d3c1fd2/a-1-socket.1d3c1fd2.jar",
+            ),
+            (TREE_KIND, ".socket/vendor/gradle/g/a/1/a-1.jar"),
+            (CREATED_DIR_KIND, ".mvn"),
+            (CREATED_DIR_KIND, ".socket/vendor/maven2/g"),
+        ];
+        for (kind, file) in ok {
+            assert!(record_allowed(&record(kind, file), &c), "{kind} {file}");
+        }
+        let bad = [
+            (POM_FRAGMENT_KIND, ".git/config"),
+            (POM_FRAGMENT_KIND, "src/Main.java"),
+            (POM_FRAGMENT_KIND, ".GIT/x.xml"),
+            (POM_FRAGMENT_KIND, "a/.git/x.xml"),
+            (POM_FRAGMENT_KIND, ".socket/vendor/x.xml"),
+            (POM_FRAGMENT_KIND, "../x/pom.xml"),
+            (POM_FRAGMENT_KIND, "/etc/pom.xml"),
+            (CONFIG_LINE_KIND, ".mvn/jvm.config"),
+            (SETTINGS_FRAGMENT_KIND, "build.gradle"),
+            (VERIFICATION_FRAGMENT_KIND, "gradle/other.xml"),
+            (OWNED_FILE_KIND, ".socket/vendor/state.json"),
+            (
+                TREE_KIND,
+                ".socket/vendor/maven2/g/a/1-socket.99999999/a.jar",
+            ),
+            (
+                TREE_KIND,
+                ".socket/vendor/maven2/g/a/1-socket.1d3c1fd2/x/a.jar",
+            ),
+            (TREE_KIND, ".socket/vendor/gradle/g/b/1/b-1.jar"),
+            (TREE_KIND, "src/Main.java"),
+            (CREATED_DIR_KIND, "src"),
+            (CREATED_DIR_KIND, ".git"),
+            ("jvm_file_snapshot", "pom.xml"),
+        ];
+        for (kind, file) in bad {
+            assert!(!record_allowed(&record(kind, file), &c), "{kind} {file}");
+        }
+    }
+
+    #[test]
+    fn jvm_entries_need_only_jvm_kinds_and_a_canonical_uuid() {
+        let tree = WiringRecord {
+            kind: TREE_KIND.into(),
+            ..record(TREE_KIND, &tree_file("a-1-socket.1d3c1fd2.jar"))
+        };
+        assert!(is_jvm_entry(&entry(vec![tree.clone()])));
+        assert!(!is_jvm_entry(&entry(vec![])));
+        let legacy = record("maven_pom_repository", "pom.xml");
+        assert!(!is_jvm_entry(&entry(vec![tree.clone(), legacy])));
+        let mut bad = entry(vec![tree]);
+        bad.uuid = "../../../NOT-A-UUID".into();
+        assert!(entry_gav(&bad).is_err());
+        bad.uuid = UUID.into();
+        bad.base_purl = "pkg:maven/com.ex&ample/a@1".into();
+        assert!(entry_gav(&bad).is_err());
+    }
+
+    #[tokio::test]
+    async fn tampered_records_fail_closed_before_any_write() {
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path();
+        std::fs::create_dir_all(root.join(".git")).unwrap();
+        std::fs::write(root.join(".git/config"), "[core]\n").unwrap();
+        std::fs::create_dir_all(root.join("src")).unwrap();
+        std::fs::write(root.join("src/Main.java"), "class Main {}\n").unwrap();
+        let forged = [
+            WiringRecord {
+                new: Some(Value::String(sha256_hex(b"class Main {}\n"))),
+                ..record(TREE_KIND, "src/Main.java")
+            },
+            WiringRecord {
+                original: Some(Value::String("[core]\n\tfsmonitor = x\n".into())),
+                new: Some(serde_json::json!({ "op": "replace", "from": "x", "to": "[core]\n" })),
+                ..record(POM_FRAGMENT_KIND, ".git/config")
+            },
+        ];
+        for w in forged {
+            let out = revert(root, &entry(vec![w]), RevertOpts::new(false)).await;
+            assert!(!out.success, "{out:?}");
+        }
+        assert_eq!(
+            std::fs::read(root.join(".git/config")).unwrap(),
+            b"[core]\n"
+        );
+        assert!(root.join("src/Main.java").is_file());
+        let mut e = entry(vec![record(
+            OWNED_FILE_KIND,
+            ".socket/gradle/socket-patch.settings.gradle",
+        )]);
+        e.uuid = "../../../NOT-A-UUID".into();
+        assert!(!revert(root, &e, RevertOpts::new(false)).await.success);
+    }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn symlinks_leaving_the_checkout_are_never_followed() {
+        let dir = tempfile::tempdir().unwrap();
+        let outside = tempfile::tempdir().unwrap();
+        let root = dir.path();
+        std::fs::write(outside.path().join("pom.xml"), "<project/>").unwrap();
+        std::os::unix::fs::symlink(outside.path(), root.join("lnk")).unwrap();
+        std::os::unix::fs::symlink(outside.path(), root.join(".mvn")).unwrap();
+        let reader = ProjectReader::new(root);
+        assert_eq!(reader.read("lnk/pom.xml"), None);
+        assert_eq!(reader.escaped().as_deref(), Some("lnk"));
+        // Writing through a symlinked `.mvn` or `.socket` is refused.
+        let p = plan(vec![FileWrite {
+            rel: ".mvn/maven.config".into(),
+            bytes: b"-Da=b\n".to_vec(),
+            tree: false,
+        }]);
+        assert!(write_plan(root, &p).await.is_err());
+        assert!(!outside.path().join("maven.config").exists());
+        std::os::unix::fs::symlink(outside.path(), root.join(".socket")).unwrap();
+        let p = plan(vec![FileWrite {
+            rel: ".socket/vendor/maven2/g/a/1/a.jar".into(),
+            bytes: b"JAR".to_vec(),
+            tree: true,
+        }]);
+        assert!(write_plan(root, &p).await.is_err());
+        assert!(!outside.path().join("vendor").exists());
+    }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn an_in_checkout_symlinked_file_is_edited_through_its_link() {
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path();
+        std::fs::create_dir_all(root.join("a")).unwrap();
+        std::fs::write(root.join("a/real.xml"), "<project/>\n").unwrap();
+        std::os::unix::fs::symlink("real.xml", root.join("a/pom.xml")).unwrap();
+        let reader = ProjectReader::new(root);
+        assert_eq!(
+            reader.read("a/pom.xml").as_deref(),
+            Some(&b"<project/>\n"[..])
+        );
+        assert_eq!(reader.escaped(), None);
+        let p = plan(vec![FileWrite {
+            rel: "a/pom.xml".into(),
+            bytes: b"<project><x/></project>\n".to_vec(),
+            tree: false,
+        }]);
+        write_plan(root, &p).await.unwrap();
+        let meta = std::fs::symlink_metadata(root.join("a/pom.xml")).unwrap();
+        assert!(meta.file_type().is_symlink());
+        assert_eq!(
+            std::fs::read(root.join("a/real.xml")).unwrap(),
+            b"<project><x/></project>\n"
+        );
+    }
+
+    #[tokio::test]
+    async fn unresolved_root_never_disables_confinement() {
+        let temp = tempfile::tempdir().unwrap();
+        let root = temp.path().join("missing");
+        let reader = ProjectReader::new(&root);
+        assert!(reader.resolve("pom.xml").is_err());
+        let p = plan(vec![FileWrite {
+            rel: "pom.xml".into(),
+            bytes: b"<project/>".to_vec(),
+            tree: false,
+        }]);
+        assert!(write_plan(&root, &p).await.is_err());
+        assert!(!root.exists());
+    }
+
+    #[tokio::test]
+    async fn dry_run_reports_tree_retained_for_live_drift() {
+        let temp = tempfile::tempdir().unwrap();
+        let path = temp.path().join(gradle::INDEX_REL);
+        std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+        std::fs::write(&path, "MALFORMED\n").unwrap();
+        let out = revert(
+            temp.path(),
+            &entry(vec![record(OWNED_FILE_KIND, gradle::INDEX_REL)]),
+            RevertOpts::new(true),
+        )
+        .await;
+        assert!(
+            out.success && out.kept_artifact && out.drift_skipped(),
+            "{out:?}"
+        );
+        assert_eq!(std::fs::read_to_string(path).unwrap(), "MALFORMED\n");
+    }
+
+    #[tokio::test]
+    async fn write_plan_rejects_paths_outside_the_vendoring_set() {
+        let dir = tempfile::tempdir().unwrap();
+        for (rel, tree) in [
+            ("../evil", false),
+            ("src/Main.java", false),
+            (".git/config", false),
+            ("src/lib.jar", true),
+            (".socket/vendor/state.json", false),
+            ("newdir/pom.xml", false),
+        ] {
+            let p = plan(vec![FileWrite {
+                rel: rel.into(),
+                bytes: Vec::new(),
+                tree,
+            }]);
+            assert!(write_plan(dir.path(), &p).await.is_err(), "{rel}");
+        }
+        assert!(!dir.path().join("newdir").exists());
+    }
+
+    #[tokio::test]
+    async fn tree_files_never_overwrite_foreign_bytes() {
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path();
+        let jar = tree_file("a-1-socket.1d3c1fd2.jar");
+        std::fs::create_dir_all(root.join(&jar).parent().unwrap()).unwrap();
+        std::fs::write(root.join(&jar), b"FOREIGN").unwrap();
+        let p = plan(vec![FileWrite {
+            rel: jar.clone(),
+            bytes: b"JAR".to_vec(),
+            tree: true,
+        }]);
+        assert!(write_plan(root, &p).await.is_err());
+        assert_eq!(std::fs::read(root.join(&jar)).unwrap(), b"FOREIGN");
+        // Listed in the directory's marker: an earlier vendoring's bytes.
+        let marker = serde_json::json!({
+            "files": { "a-1-socket.1d3c1fd2.jar": { "sha256": sha256_hex(b"FOREIGN"), "size": 7 } },
+            "schema": 1,
+            "uuid": UUID,
+        });
+        std::fs::write(
+            root.join(tree_file("socket-patch.vendor.json")),
+            serde_json::to_vec(&marker).unwrap(),
+        )
+        .unwrap();
+        write_plan(root, &p).await.unwrap();
+        assert_eq!(std::fs::read(root.join(&jar)).unwrap(), b"JAR");
+    }
+
+    #[test]
+    fn peer_records_fill_adopts_originals_and_created_dirs() {
+        let created = WiringRecord {
+            file: ".mvn/maven.config".into(),
+            kind: CONFIG_LINE_KIND.into(),
+            action: WiringAction::Added,
+            key: Some("config".into()),
+            original: None,
+            new: Some(serde_json::json!({ "op": "config", "created": true, "appended": "x\n" })),
+        };
+        let version = |original: Option<&str>| WiringRecord {
+            file: "a/pom.xml".into(),
+            kind: POM_FRAGMENT_KIND.into(),
+            action: WiringAction::Rewritten,
+            key: Some("version:g:a:dependencies:0".into()),
+            original: original.map(|o| Value::String(o.into())),
+            new: Some(serde_json::json!({ "op": "version", "to": "1-socket.1d3c1fd2" })),
+        };
+        let mvn_dir = WiringRecord {
+            file: ".mvn".into(),
+            kind: CREATED_DIR_KIND.into(),
+            action: WiringAction::Added,
+            key: None,
+            original: None,
+            new: None,
+        };
+        let other_dir = WiringRecord {
+            file: ".socket/gradle".into(),
+            ..mvn_dir.clone()
+        };
+        let peer = entry(vec![
+            created.clone(),
+            version(Some("${ct}")),
+            mvn_dir.clone(),
+            other_dir,
+        ]);
+        let mut records = vec![
+            super::super::adopt(".mvn/maven.config", CONFIG_LINE_KIND, "config"),
+            super::super::adopt("pom.xml", POM_FRAGMENT_KIND, "repository"),
+            version(None),
+        ];
+        inherit_peer_records(&mut records, [&peer]);
+        assert_eq!(records[0], created);
+        assert_eq!(op_of(&records[1]), "adopt", "no peer wrote it");
+        assert_eq!(records[2], version(Some("${ct}")));
+        assert_eq!(records[3], mvn_dir);
+        assert_eq!(
+            records.len(),
+            4,
+            "a directory this entry does not use is not inherited"
+        );
+    }
+
+    #[tokio::test]
+    async fn revert_of_a_tree_keeps_modified_files_and_prunes_empty_dirs() {
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path();
+        let p = plan(vec![
+            FileWrite {
+                rel: tree_file("a-1-socket.1d3c1fd2.jar"),
+                bytes: b"JAR".to_vec(),
+                tree: true,
+            },
+            FileWrite {
+                rel: tree_file("a-1-socket.1d3c1fd2.pom"),
+                bytes: b"POM".to_vec(),
+                tree: true,
+            },
+        ]);
+        let records = write_plan(root, &p).await.unwrap();
+        // Created dirs listed first (as a carried-forward entry would):
+        // they are still pruned after the files.
+        let mut first_dirs = records.clone();
+        first_dirs.sort_by_key(|r| r.kind != CREATED_DIR_KIND);
+        let out = revert(root, &entry(first_dirs.clone()), RevertOpts::new(false)).await;
+        assert!(out.success && out.warnings.is_empty(), "{out:?}");
+        assert!(!root.join(".socket").exists());
+
+        write_plan(root, &p).await.unwrap();
+        std::fs::write(root.join(tree_file("a-1-socket.1d3c1fd2.pom")), b"EDITED").unwrap();
+        let out = revert(root, &entry(first_dirs.clone()), RevertOpts::new(false)).await;
+        assert!(
+            out.success && out.drift_skipped() && out.kept_artifact,
+            "{out:?}"
+        );
+        assert!(root.join(tree_file("a-1-socket.1d3c1fd2.pom")).is_file());
+
+        let out = revert(
+            root,
+            &entry(first_dirs),
+            RevertOpts {
+                dry_run: false,
+                keep_artifact: true,
+            },
+        )
+        .await;
+        assert!(out.success && !out.kept_artifact, "{out:?}");
+        assert!(
+            root.join(tree_file("a-1-socket.1d3c1fd2.jar")).is_file(),
+            "--preserve-state keeps the tree"
+        );
+    }
+
+    #[tokio::test]
+    async fn sweep_replaced_tree_spares_live_paths() {
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path();
+        let p = plan(vec![
+            FileWrite {
+                rel: tree_file("a-1-socket.1d3c1fd2.jar"),
+                bytes: b"JAR".to_vec(),
+                tree: true,
+            },
+            FileWrite {
+                rel: tree_file("a-1-socket.1d3c1fd2.pom"),
+                bytes: b"POM".to_vec(),
+                tree: true,
+            },
+        ]);
+        let records = write_plan(root, &p).await.unwrap();
+        let prev = entry(records.clone());
+        let live = entry(
+            records
+                .into_iter()
+                .filter(|r| r.file.ends_with(".pom"))
+                .collect(),
+        );
+        assert!(sweep_replaced_tree(root, &prev, [&live]).await.unwrap());
+        assert!(!root.join(tree_file("a-1-socket.1d3c1fd2.jar")).exists());
+        assert!(root.join(tree_file("a-1-socket.1d3c1fd2.pom")).is_file());
+        assert!(!sweep_replaced_tree(root, &prev, [&live]).await.unwrap());
+    }
+}
diff --git a/crates/socket-patch-core/src/vendor/jvm/archive.rs b/crates/socket-patch-core/src/vendor/jvm/archive.rs
new file mode 100644
index 00000000..c8df0f6a
--- /dev/null
+++ b/crates/socket-patch-core/src/vendor/jvm/archive.rs
@@ -0,0 +1,140 @@
+//! Server-compatible JAR encoding (archiver 7's stored ZIP format).
+//! Keep upstream entry order and executable bits; append new entries in name
+//! order, drop signature metadata, and write fixed timestamps without extras.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::io::Cursor;
+
+pub(crate) fn is_signature(name: &str) -> bool {
+    let upper = name.to_ascii_uppercase();
+    upper == ".SIGNATURE.P7S"
+        || upper.strip_prefix("META-INF/").is_some_and(|n| {
+            !n.contains('/')
+                && [".SF", ".RSA", ".DSA", ".EC"]
+                    .iter()
+                    .any(|ext| n.ends_with(ext))
+        })
+}
+
+/// Canonicalize a locally patched JAR using the upstream archive's ordering.
+/// Both archives are decoded with the vendor verifier's size/entry limits.
+pub(crate) fn canonical_jar(upstream: &[u8], patched: &[u8]) -> Result<Vec<u8>, String> {
+    super::super::verify::read_zip_bytes_to_map(upstream)?;
+    let mut bodies = super::super::verify::read_zip_bytes_to_map(patched)?;
+    let mut original = zip::ZipArchive::new(Cursor::new(upstream)).map_err(|e| e.to_string())?;
+    let mut order = Vec::new();
+    let mut seen = BTreeSet::new();
+    for i in 0..original.len() {
+        let file = original.by_index(i).map_err(|e| e.to_string())?;
+        if file.is_dir() {
+            continue;
+        }
+        let name = file.name().to_string();
+        if !seen.insert(name.clone()) {
+            return Err(format!("duplicate upstream JAR entry: {name}"));
+        }
+        let mode = if file.unix_mode().is_some_and(|m| m & 0o111 != 0) {
+            0o100755
+        } else {
+            0o100644
+        };
+        order.push((name, mode));
+    }
+    let mut additions: Vec<_> = bodies
+        .keys()
+        .filter(|name| !seen.contains(*name))
+        .cloned()
+        .collect();
+    additions.sort();
+    order.extend(additions.into_iter().map(|name| (name, 0o100644)));
+    let mut patched_zip = zip::ZipArchive::new(Cursor::new(patched)).map_err(|e| e.to_string())?;
+    let mut crcs = BTreeMap::new();
+    for i in 0..patched_zip.len() {
+        let file = patched_zip.by_index(i).map_err(|e| e.to_string())?;
+        crcs.insert(file.name().to_string(), file.crc32());
+    }
+    let mut out = Vec::new();
+    let mut directory = Vec::new();
+    let mut count = 0u16;
+    for (name, mode) in order {
+        let Some(bytes) = bodies.remove(&name) else {
+            continue;
+        };
+        if is_signature(&name) {
+            continue;
+        }
+        let offset = u32::try_from(out.len()).map_err(|_| "JAR exceeds ZIP32 limits")?;
+        let size = u32::try_from(bytes.len()).map_err(|_| "JAR member exceeds ZIP32 limits")?;
+        let len = u16::try_from(name.len()).map_err(|_| "JAR member name too long")?;
+        let flags = if name.is_ascii() { 0 } else { 0x800 };
+        let crc = crcs[&name];
+        u32s(&mut out, &[0x04034b50]);
+        u16s(&mut out, &[10, flags, 0, 0, 33]);
+        u32s(&mut out, &[crc, size, size]);
+        u16s(&mut out, &[len, 0]);
+        out.extend_from_slice(name.as_bytes());
+        out.extend_from_slice(&bytes);
+        u32s(&mut directory, &[0x02014b50]);
+        u16s(&mut directory, &[0x032d, 10, flags, 0, 0, 33]);
+        u32s(&mut directory, &[crc, size, size]);
+        u16s(&mut directory, &[len, 0, 0, 0, 0]);
+        u32s(&mut directory, &[(mode << 16) | 0x20, offset]);
+        directory.extend_from_slice(name.as_bytes());
+        count = count.checked_add(1).ok_or("too many JAR members")?;
+    }
+    let offset = u32::try_from(out.len()).map_err(|_| "JAR exceeds ZIP32 limits")?;
+    let size = u32::try_from(directory.len()).map_err(|_| "JAR directory exceeds ZIP32 limits")?;
+    out.extend_from_slice(&directory);
+    u32s(&mut out, &[0x06054b50]);
+    u16s(&mut out, &[0, 0, count, count]);
+    u32s(&mut out, &[size, offset]);
+    u16s(&mut out, &[0]);
+    Ok(out)
+}
+
+fn u16s(out: &mut Vec<u8>, values: &[u16]) {
+    for v in values {
+        out.extend_from_slice(&v.to_le_bytes());
+    }
+}
+fn u32s(out: &mut Vec<u8>, values: &[u32]) {
+    for v in values {
+        out.extend_from_slice(&v.to_le_bytes());
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::Write;
+
+    #[test]
+    fn matches_archiver_7_byte_for_byte() {
+        // Fixture generated by fixtures/repack/generate.cjs.
+        let expected = include_bytes!("fixtures/repack/archiver-7.0.1.jar");
+        let mut upstream = zip::ZipWriter::new(Cursor::new(Vec::new()));
+        for (name, bytes, mode) in [
+            ("z.txt", "first\n", 0o644),
+            ("META-INF/NOTICE.txt", "original\n", 0o644),
+            ("bin/run", "exec\n", 0o755),
+            ("café.txt", "unicode\n", 0o644),
+            ("META-INF/SIGN.RSA", "signature", 0o644),
+        ] {
+            upstream
+                .start_file(
+                    name,
+                    zip::write::SimpleFileOptions::default().unix_permissions(mode),
+                )
+                .unwrap();
+            upstream.write_all(bytes.as_bytes()).unwrap();
+        }
+        let upstream = upstream.finish().unwrap().into_inner();
+        let mut bodies = super::super::super::verify::read_zip_bytes_to_map(&upstream).unwrap();
+        bodies.insert("META-INF/NOTICE.txt".into(), b"patched\n".to_vec());
+        let mut entries: Vec<_> = bodies.into_iter().map(|(n, b)| (n, b, 0o644)).collect();
+        entries.sort_by(|a, b| a.0.cmp(&b.0));
+        let rebuilt = super::super::super::common::write_zip_entries(&entries).unwrap();
+        assert_eq!(canonical_jar(&upstream, &rebuilt).unwrap(), expected);
+        assert_eq!(canonical_jar(expected, expected).unwrap(), expected);
+    }
+}
diff --git a/crates/socket-patch-core/src/vendor/jvm/fixtures/repack/archiver-7.0.1.jar b/crates/socket-patch-core/src/vendor/jvm/fixtures/repack/archiver-7.0.1.jar
new file mode 100644
index 0000000000000000000000000000000000000000..4fabed191b56031f2e24306957d117e7c2b83f1a
GIT binary patch
literal 433
zcmWIWW@h1HfB;1Xt<7G?*?=4nW(DFZy^@NOw9KO760QIgg%!6Vescg7fUqzS`?`iW
z>U#RQ>HGPIcsjd+v=t<lBxj_iplN&*pL7#sG6=H+aZ+ZUeo<*&YDH=?OeM%n21SPY
zYuoB!R&WAEk`vPouLK!fnwOcJpOOkx&d8+8jN9=bV;C3|7?w1GXs}n%wV-<gq!6M-
z6G&t66uJTE-T~_e+WEFI3CM(c4z3A@&tRICH1+_QaDN7Pvx4G*fdvR30O{Qz4g&xz
Cph~*{

literal 0
HcmV?d00001

diff --git a/crates/socket-patch-core/src/vendor/jvm/fixtures/repack/generate.cjs b/crates/socket-patch-core/src/vendor/jvm/fixtures/repack/generate.cjs
new file mode 100644
index 00000000..ddc9a055
--- /dev/null
+++ b/crates/socket-patch-core/src/vendor/jvm/fixtures/repack/generate.cjs
@@ -0,0 +1,17 @@
+// Regenerate with archiver@7.0.1, the patch server's repackDirToZip encoder.
+// npm install --prefix /tmp/jvm-repack --ignore-scripts archiver@7.0.1
+// NODE_PATH=/tmp/jvm-repack/node_modules node generate.cjs
+const fs = require('node:fs');
+const path = require('node:path');
+const archiver = require('archiver');
+(async () => {
+  const zip = archiver('zip', { zlib: { level: 0 }, store: true });
+  const chunks = [];
+  zip.on('data', chunk => chunks.push(chunk));
+  zip.on('error', error => { throw error; });
+  zip.on('end', () => fs.writeFileSync(path.join(__dirname, 'archiver-7.0.1.jar'), Buffer.concat(chunks)));
+  for (const [name, body, mode] of [['z.txt', 'first\n', 0o644], ['META-INF/NOTICE.txt', 'patched\n', 0o644], ['bin/run', 'exec\n', 0o755], ['café.txt', 'unicode\n', 0o644]]) {
+    zip.append(Buffer.from(body), { name, date: new Date(0), mode });
+  }
+  await zip.finalize();
+})();
diff --git a/crates/socket-patch-core/src/vendor/jvm/gradle.rs b/crates/socket-patch-core/src/vendor/jvm/gradle.rs
new file mode 100644
index 00000000..9b22cf98
--- /dev/null
+++ b/crates/socket-patch-core/src/vendor/jvm/gradle.rs
@@ -0,0 +1,2935 @@
+//! Gradle planner. See the module doc of [`super`] and
+//! `docs/design/maven-vendoring.md`.
+//!
+//! The patched artifact keeps its GAV in `.socket/vendor/gradle/`,
+//! listed with its sha256 in `.socket/vendor/gradle-index.tsv`. The
+//! owned static script [`SCRIPT`] reads the index, checks every hash at
+//! configuration time (index verification) and routes the GAV to the tree with
+//! `exclusiveContent`. Each wired settings file gets one apply line, plus an
+//! in-block `pluginManagement` entry when it has settings-level `plugins{}`.
+//! An existing `gradle/verification-metadata.xml` gets the patched jar hash.
+
+use std::collections::{BTreeMap, BTreeSet};
+
+use serde_json::json;
+
+use super::super::state::{WiringAction, WiringRecord};
+use super::{
+    adopt, changes_between, finish_writes, fragment, op_of, op_str, owned_file, replace_op,
+    sha256_hex, undo_replace, Coords, FileWrite, JvmPatch, JvmPlan, JvmRefusal, JvmUnplan,
+    JvmWarning, ReadFn, OWNED_FILE_KIND, SETTINGS_FRAGMENT_KIND, VERIFICATION_FRAGMENT_KIND,
+};
+
+pub use super::safe_coordinates;
+
+/// The owned settings script. Its bytes change only with a CLI release.
+pub const SCRIPT: &str = include_str!("socket-patch.settings.gradle");
+/// Where [`SCRIPT`] lives, project-relative.
+pub const SCRIPT_REL: &str = ".socket/gradle/socket-patch.settings.gradle";
+/// The Gradle-only artifact tree root.
+pub const TREE_ROOT: &str = ".socket/vendor/gradle";
+/// The tree root's `.gitattributes`, shared by every Gradle patch.
+pub const GITATTRIBUTES_REL: &str = ".socket/vendor/gradle/.gitattributes";
+/// The derived index the script reads.
+pub const INDEX_REL: &str = ".socket/vendor/gradle-index.tsv";
+pub const INDEX_HEADER: &str = "#socket-patch-gradle-index 1";
+pub const VERIFICATION_REL: &str = "gradle/verification-metadata.xml";
+pub const MARKER_NAME: &str = "socket-patch.vendor.json";
+/// Repository name shared by the script and the in-block entry: the script
+/// skips a handler that already holds it.
+const REPO_NAME: &str = "socketPatchVendor";
+/// Upstream poms of Gradle-published modules carry this; Gradle then follows
+/// the `.module`, so vendoring the pom alone changes the graph.
+const GRADLE_METADATA_MARKER: &str = "published-with-gradle-metadata";
+
+/// The tree directory of `c` (same GAV).
+pub fn tree_dir(c: &Coords<'_>) -> String {
+    format!(
+        "{TREE_ROOT}/{}/{}/{}",
+        c.group_path(),
+        c.artifact_id,
+        c.version
+    )
+}
+
+/// The committed tree of `c` as `(jar, pom, module)`: the tree holds the
+/// upstream pom and module verbatim. `None` when the jar or pom is missing.
+pub fn committed(read: ReadFn<'_>, c: &Coords<'_>) -> Option<super::CommittedTree> {
+    let dir = tree_dir(c);
+    let (a, v) = (c.artifact_id, c.version);
+    Some((
+        read(&format!("{dir}/{a}-{v}.jar"))?,
+        read(&format!("{dir}/{a}-{v}.pom"))?,
+        read(&format!("{dir}/{a}-{v}.module")),
+    ))
+}
+
+/// Plan vendoring `patch` into the Gradle build rooted at the project root.
+pub fn plan(read: ReadFn<'_>, patch: &JvmPatch<'_>) -> Result<JvmPlan, JvmRefusal> {
+    if super::wrapper_version(read, "gradle").is_some_and(|v| v < (6, 8, 0)) {
+        return Err(shape_refusal(
+            "gradle_below_6_8",
+            "vendored dependencies require Gradle 6.8 or newer".into(),
+        ));
+    }
+    let (g, a, v) = (patch.group_id, patch.artifact_id, patch.version);
+    if !safe_coordinates(g, a, v) {
+        return Err(JvmRefusal {
+            code: "unsafe_coordinates",
+            detail: format!("unsafe gradle coordinates `{g}:{a}:{v}`"),
+        });
+    }
+    if patch.uuid.is_empty()
+        || !patch
+            .uuid
+            .chars()
+            .all(|c| c.is_ascii_alphanumeric() || c == '-')
+    {
+        return Err(JvmRefusal {
+            code: "unsafe_coordinates",
+            detail: format!("non-canonical patch uuid {:?}", patch.uuid),
+        });
+    }
+    let pom_text = String::from_utf8_lossy(patch.upstream_pom);
+    if patch.upstream_module.is_none() && pom_text.contains(GRADLE_METADATA_MARKER) {
+        return Err(JvmRefusal {
+            code: "vendor_jvm_upstream_unavailable",
+            detail: format!(
+                "reason: module_unavailable: {a}-{v}.pom declares Gradle module metadata but no \
+                 {a}-{v}.module was found; run one online build (`./gradlew dependencies`)"
+            ),
+        });
+    }
+    if let Some(module) = patch.upstream_module {
+        if String::from_utf8_lossy(module).contains("\"available-at\"") {
+            return Err(shape_refusal(
+                "android_or_kmp",
+                format!("{a}-{v}.module redirects with available-at (a multiplatform module); use hosted mode"),
+            ));
+        }
+    }
+
+    let mut warnings = Vec::new();
+    let mut writes = Vec::new();
+    let mut records = Vec::new();
+
+    let root = read_settings(read, "")?;
+    let root_build = read_build_script(read, "")?;
+    if let Some((rel, text)) = &root_build {
+        check_android(rel, text)?;
+        check_exclusive_content(rel, text, patch)?;
+    }
+
+    let mut targets = vec![root];
+    if let Some(bs) = read_buildsrc(read)? {
+        targets.push(bs);
+    }
+    // Literal includeBuild targets, found recursively from the root settings.
+    let mut seen: BTreeSet<String> = targets.iter().map(|t| t.dir.clone()).collect();
+    let mut i = 0;
+    while i < targets.len() {
+        if targets[i].dir != "buildSrc" {
+            let text = targets[i].text.clone().unwrap_or_default();
+            let (found, warns) = included_builds(&targets[i].rel, &targets[i].dir, &text);
+            warnings.extend(warns);
+            for dir in found {
+                if !seen.insert(dir.clone()) {
+                    continue;
+                }
+                match read_included(read, &dir)? {
+                    Some(t) => targets.push(t),
+                    None => warnings.push(degraded(
+                        "unwired_build_logic",
+                        format!(
+                            "{}: includeBuild('{dir}') has no settings or build script in the \
+                             checkout; that build stays unpatched",
+                            targets[i].rel
+                        ),
+                    )),
+                }
+            }
+        }
+        i += 1;
+    }
+
+    for t in &targets {
+        let Some(text) = &t.text else { continue };
+        check_android(&t.rel, text)?;
+        check_exclusive_content(&t.rel, text, patch)?;
+    }
+
+    let coords = patch.coords();
+    for t in &targets {
+        let prefix = prefix_of(&t.dir);
+        let mut text = t.text.clone().unwrap_or_default();
+        if t.text.is_some() {
+            for (scope, key_prefix, section) in [
+                ("pluginManagement", "in_block", "in_block_section"),
+                ("buildscript", "buildscript", "buildscript_section"),
+            ] {
+                match scoped_in_block_entry(&text, t.kotlin, &prefix, &coords, scope) {
+                    InBlock::Unneeded => {}
+                    InBlock::Present => {
+                        let key = format!("{key_prefix}:{g}:{a}:{v}");
+                        records.push(adopt(&t.rel, SETTINGS_FRAGMENT_KIND, &key));
+                        records.push(adopt(&t.rel, SETTINGS_FRAGMENT_KIND, section));
+                    }
+                    InBlock::Edited {
+                        start,
+                        end,
+                        text: inserted,
+                    } => {
+                        let mut added = in_block_records(
+                            &t.rel, &text, start, end, &inserted, t.kotlin, &prefix, &coords,
+                        );
+                        if scope == "buildscript" {
+                            for w in &mut added {
+                                w.key =
+                                    w.key.as_ref().map(|k| k.replace("in_block", "buildscript"));
+                            }
+                        }
+                        records.extend(added);
+                        text = format!("{}{inserted}{}", &text[..start], &text[end..]);
+                    }
+                    InBlock::Unwired(why) => warnings.push(degraded(
+                        "settings_plugins_unwired",
+                        format!(
+                            "{}: {why}; settings plugins may resolve the unpatched {g}:{a}:{v}",
+                            t.rel
+                        ),
+                    )),
+                }
+            }
+        }
+        let line = apply_line(t.kotlin, &prefix);
+        if has_apply_line(&text, &prefix) {
+            records.push(adopt(&t.rel, SETTINGS_FRAGMENT_KIND, "apply"));
+        } else {
+            let appended = append_line(&text, &line);
+            let op = match &t.text {
+                None => json!({ "op": "create", "text": appended }),
+                Some(_) => json!({
+                    "op": "line",
+                    "text": &appended[text.len()..],
+                    "line": line,
+                }),
+            };
+            records.push(fragment(
+                &t.rel,
+                SETTINGS_FRAGMENT_KIND,
+                "apply",
+                WiringAction::Added,
+                None,
+                op,
+            ));
+            text = appended;
+        }
+        writes.push(text_write(&t.rel, text.into_bytes()));
+    }
+
+    let tree_dir = tree_dir(&coords);
+    let jar_name = format!("{a}-{v}.jar");
+    let pom_name = format!("{a}-{v}.pom");
+    let module_name = format!("{a}-{v}.module");
+    let mut files: Vec<(&str, &[u8])> =
+        vec![(&jar_name, patch.jar), (&pom_name, patch.upstream_pom)];
+    if let Some(module) = patch.upstream_module {
+        files.push((&module_name, module));
+    }
+    files.sort_by(|x, y| x.0.cmp(y.0));
+    let gav = format!("{g}:{a}:{v}");
+    let mut rows = Vec::new();
+    for (name, bytes) in &files {
+        writes.push(FileWrite {
+            rel: format!("{tree_dir}/{name}"),
+            bytes: bytes.to_vec(),
+            tree: true,
+        });
+        rows.push(format!(
+            "{gav}\t{}/{}/{v}/{name}\t{}\t{}",
+            patch.group_path(),
+            a,
+            sha256_hex(bytes),
+            patch.uuid
+        ));
+    }
+    writes.push(FileWrite {
+        rel: format!("{tree_dir}/{MARKER_NAME}"),
+        bytes: marker_json(patch, &files).into_bytes(),
+        tree: true,
+    });
+    let existing_index = read(INDEX_REL);
+    let index = merge_index(existing_index.as_deref(), &gav, rows)?;
+    records.push(created_or_adopted(INDEX_REL, existing_index.is_some()));
+    writes.push(text_write(INDEX_REL, index.into_bytes()));
+    records.push(created_or_adopted(SCRIPT_REL, read(SCRIPT_REL).is_some()));
+    writes.push(text_write(SCRIPT_REL, SCRIPT.as_bytes().to_vec()));
+    records.push(owned_file(read, GITATTRIBUTES_REL, &mut writes));
+
+    if let Some(bytes) = read(VERIFICATION_REL) {
+        let text = String::from_utf8(bytes).map_err(|_| {
+            shape_refusal(
+                "gradle_verification_unparseable",
+                format!("{VERIFICATION_REL} is not UTF-8"),
+            )
+        })?;
+        let hashes = ArtifactHashes {
+            jar: sha256_hex(patch.jar),
+            pom: sha256_hex(patch.upstream_pom),
+            module: patch.upstream_module.map(sha256_hex),
+        };
+        let (start, end, replacement) = update_verification(&text, patch, &hashes)?;
+        if unverified_parent_chain(&text, &pom_text, patch.upstream_module) {
+            warnings.push(degraded(
+                "verification_parent_chain_unhandled",
+                format!(
+                    "{VERIFICATION_REL}: {a}-{v}.pom has a parent or imported platform the file \
+                     may not list, and those entries are not added; run `./gradlew --write-verification-metadata sha256 help` \
+                     if verification fails"
+                ),
+            ));
+        }
+        let new = format!("{}{replacement}{}", &text[..start], &text[end..]);
+        records.push(adopt(
+            VERIFICATION_REL,
+            VERIFICATION_FRAGMENT_KIND,
+            "components_section",
+        ));
+        if new != text {
+            // Replacing an earlier patch's hash for this GAV: the user's
+            // element is in that patch's record, which the caller carries.
+            let mut from =
+                Some(&text[start..end]).filter(|f| !f.contains("origin=\"socket-patch\""));
+            let mut replacement = replacement;
+            if text[start..end].starts_with("<components") && text[start..end].ends_with("/>") {
+                let nl = newline_of(&text);
+                let indent = line_indent(&text, start);
+                let shell = format!("<components>{nl}{indent}</components>");
+                records.pop();
+                records.push(fragment(
+                    VERIFICATION_REL,
+                    VERIFICATION_FRAGMENT_KIND,
+                    "components_section",
+                    WiringAction::Rewritten,
+                    None,
+                    replace_op(&text[start..end], &shell),
+                ));
+                replacement = replacement["<components>".len() + nl.len()
+                    ..replacement.len() - indent.len() - "</components>".len()]
+                    .to_string();
+                from = Some("");
+            }
+            let action = if from == Some("") {
+                WiringAction::Added
+            } else {
+                WiringAction::Rewritten
+            };
+            records.push(fragment(
+                VERIFICATION_REL,
+                VERIFICATION_FRAGMENT_KIND,
+                &format!("hash:{gav}"),
+                action,
+                None,
+                json!({ "op": "replace", "from": from, "to": replacement }),
+            ));
+        }
+        writes.push(text_write(VERIFICATION_REL, new.into_bytes()));
+    }
+
+    Ok(JvmPlan {
+        tree_files: super::tree_files(&writes),
+        writes: finish_writes(read, writes),
+        records,
+        warnings,
+        jar_rel: format!("{tree_dir}/{jar_name}"),
+        tree_dir,
+    })
+}
+
+/// `../` once per segment of `dir`: the script path from that build.
+fn prefix_of(dir: &str) -> String {
+    "../".repeat(if dir.is_empty() {
+        0
+    } else {
+        dir.split('/').count()
+    })
+}
+
+fn created_or_adopted(rel: &str, existed: bool) -> WiringRecord {
+    if existed {
+        adopt(rel, OWNED_FILE_KIND, "owned")
+    } else {
+        fragment(
+            rel,
+            OWNED_FILE_KIND,
+            "owned",
+            WiringAction::Added,
+            None,
+            json!({ "op": "create" }),
+        )
+    }
+}
+
+/// The records of an in-block insertion replacing `text[start..end]` with
+/// `inserted`: the per-patch entry line, and the shell around it when the
+/// insertion created one (`in_block_section`, with the rest of the lines
+/// it touches as context so a lone `gradlePluginPortal()` stays unique).
+#[allow(clippy::too_many_arguments)]
+fn in_block_records(
+    rel: &str,
+    text: &str,
+    start: usize,
+    end: usize,
+    inserted: &str,
+    kotlin: bool,
+    prefix: &str,
+    c: &Coords<'_>,
+) -> Vec<WiringRecord> {
+    let entry = in_block_line(kotlin, prefix, c);
+    let key = format!("in_block:{}:{}:{}", c.group_id, c.artifact_id, c.version);
+    let from = &text[start..end];
+    let Some(at) = inserted.find(&entry) else {
+        return Vec::new();
+    };
+    let line_start = inserted[..at].rfind('\n').map_or(0, |n| n + 1);
+    let line_end = inserted[at..]
+        .find('\n')
+        .map_or(inserted.len(), |n| at + n + 1);
+    let shell = format!("{}{}", &inserted[..line_start], &inserted[line_end..]);
+    if shell == from {
+        return vec![
+            fragment(
+                rel,
+                SETTINGS_FRAGMENT_KIND,
+                &key,
+                WiringAction::Added,
+                None,
+                json!({ "op": "in_block", "line": entry, "from": from, "to": inserted }),
+            ),
+            adopt(rel, SETTINGS_FRAGMENT_KIND, "in_block_section"),
+        ];
+    }
+    let new = format!("{}{inserted}{}", &text[..start], &text[end..]);
+    let ctx_start = new[..start].rfind('\n').map_or(0, |n| n + 1);
+    let after = start + inserted.len();
+    let ctx_end = new[after..].find('\n').map_or(new.len(), |n| after + n);
+    let (left, right) = (&new[ctx_start..start], &new[after..ctx_end]);
+    vec![
+        fragment(
+            rel,
+            SETTINGS_FRAGMENT_KIND,
+            &key,
+            WiringAction::Added,
+            None,
+            json!({ "op": "in_block", "line": entry }),
+        ),
+        fragment(
+            rel,
+            SETTINGS_FRAGMENT_KIND,
+            "in_block_section",
+            WiringAction::Added,
+            None,
+            replace_op(
+                &format!("{left}{from}{right}"),
+                &format!("{left}{shell}{right}"),
+            ),
+        ),
+    ]
+}
+
+/// Plan the revert of `c`'s wiring: its in-block entries, index
+/// rows and verification hash go now; apply lines, the script, the index
+/// and the tree `.gitattributes` once no other patch has an index row.
+pub fn unplan(read: ReadFn<'_>, c: &Coords<'_>, records: &[WiringRecord]) -> JvmUnplan {
+    let mut drifted = Vec::new();
+    let mut files: BTreeSet<String> = records
+        .iter()
+        .filter(|w| {
+            matches!(
+                w.kind.as_str(),
+                SETTINGS_FRAGMENT_KIND | VERIFICATION_FRAGMENT_KIND
+            )
+        })
+        .map(|w| w.file.clone())
+        .collect();
+    files.insert(INDEX_REL.to_string());
+    let mut before: BTreeMap<String, Option<String>> = files
+        .into_iter()
+        .filter_map(|rel| {
+            let text = match read(&rel) {
+                None => None,
+                Some(bytes) => Some(String::from_utf8(bytes).ok()?),
+            };
+            Some((rel, text))
+        })
+        .collect();
+    let mut after = before.clone();
+    let recs = |rel: &str| {
+        records
+            .iter()
+            .filter(move |w| w.file == rel && w.kind == SETTINGS_FRAGMENT_KIND)
+            .collect::<Vec<_>>()
+    };
+    let in_block_key = format!("in_block:{}:{}:{}", c.group_id, c.artifact_id, c.version);
+    for (rel, text) in after.iter_mut() {
+        let Some(t) = text.as_mut() else { continue };
+        if !is_settings_file(rel) {
+            continue;
+        }
+        let dir = rel.rsplit_once('/').map_or("", |(d, _)| d);
+        let entry = in_block_line(rel.ends_with(".kts"), &prefix_of(dir), c);
+        for w in recs(rel) {
+            if w.key.as_deref() != Some(in_block_key.as_str())
+                && w.key.as_deref()
+                    != Some(in_block_key.replace("in_block:", "buildscript:").as_str())
+            {
+                continue;
+            }
+            if let (Some(from), Some(to)) = (op_str(w, "from"), op_str(w, "to")) {
+                if let Some(undone) = undo_replace(t, from, to) {
+                    *t = undone;
+                }
+            }
+        }
+        while let Some(cut) = remove_line(t, &entry) {
+            *t = cut;
+        }
+        for w in recs(rel) {
+            if matches!(
+                w.key.as_deref(),
+                Some("in_block_section" | "buildscript_section")
+            ) {
+                if let (Some(from), Some(to)) = (op_str(w, "from"), op_str(w, "to")) {
+                    if let Some(undone) = undo_replace(t, from, to) {
+                        *t = undone;
+                    }
+                }
+            }
+        }
+    }
+    for w in records
+        .iter()
+        .rev()
+        .filter(|w| {
+            w.kind == VERIFICATION_FRAGMENT_KIND && w.key.as_deref() != Some("components_section")
+        })
+        .chain(records.iter().filter(|w| {
+            w.kind == VERIFICATION_FRAGMENT_KIND && w.key.as_deref() == Some("components_section")
+        }))
+    {
+        let Some(Some(t)) = after.get_mut(&w.file) else {
+            continue;
+        };
+        let Some(to) = op_str(w, "to") else {
+            continue;
+        };
+        let Some(from) = op_str(w, "from") else {
+            if t.contains(to) {
+                drifted.push(format!(
+                    "{}: no pre-vendor entry is recorded for {}:{}:{}",
+                    w.file, c.group_id, c.artifact_id, c.version
+                ));
+            }
+            continue;
+        };
+        match undo_replace(t, from, to) {
+            Some(undone) => *t = undone,
+            None if t.contains(to) => drifted.push(format!(
+                "{} holds the patched hash for {}:{}:{} in an unexpected shape",
+                w.file, c.group_id, c.artifact_id, c.version
+            )),
+            None => {}
+        }
+    }
+
+    let rows: Option<Vec<String>> = match after.get(INDEX_REL) {
+        Some(Some(index)) => index_rows(index),
+        _ => Some(Vec::new()),
+    };
+    let Some(rows) = rows else {
+        drifted.push(format!(
+            "{INDEX_REL} is malformed; its rows were left alone"
+        ));
+        return JvmUnplan {
+            changes: changes_between(&before, &after),
+            drifted,
+            still_wired: true,
+        };
+    };
+    let others: Vec<String> = rows
+        .into_iter()
+        .filter(|r| r.split('\t').nth(3) != Some(c.uuid))
+        .collect();
+    if others.is_empty() {
+        after.insert(INDEX_REL.to_string(), None);
+        for (rel, text) in after.iter_mut() {
+            if !is_settings_file(rel) {
+                continue;
+            }
+            for w in recs(rel)
+                .into_iter()
+                .filter(|w| w.key.as_deref() == Some("apply"))
+            {
+                let Some(t) = text.as_deref() else { break };
+                let written = op_str(w, "text").unwrap_or_default();
+                *text = match op_of(w) {
+                    "create" if t == written => None,
+                    "create" => {
+                        Some(remove_line(t, written.trim()).unwrap_or_else(|| t.to_string()))
+                    }
+                    "line" => Some(
+                        match t.strip_suffix(written).filter(|_| !written.is_empty()) {
+                            Some(cut) => cut.to_string(),
+                            None => remove_line(t, op_str(w, "line").unwrap_or_default())
+                                .unwrap_or_else(|| t.to_string()),
+                        },
+                    ),
+                    _ => Some(t.to_string()),
+                };
+            }
+        }
+        for rel in [SCRIPT_REL, GITATTRIBUTES_REL] {
+            let created = records
+                .iter()
+                .any(|w| w.kind == OWNED_FILE_KIND && w.file == rel && op_of(w) == "create");
+            let current = read(rel);
+            let expected = if rel == SCRIPT_REL {
+                SCRIPT
+            } else {
+                super::TREE_GITATTRIBUTES
+            };
+            let ours = current.as_deref() == Some(expected.as_bytes());
+            if created && ours && current.is_some() {
+                before.insert(rel.to_string(), Some(String::new()));
+                after.insert(rel.to_string(), None);
+            } else if created && current.is_some() && !ours {
+                drifted.push(format!("{rel} was modified"));
+            }
+        }
+    } else {
+        let mut index = format!("{INDEX_HEADER}\n");
+        for row in &others {
+            index.push_str(row);
+            index.push('\n');
+        }
+        after.insert(INDEX_REL.to_string(), Some(index));
+    }
+    JvmUnplan {
+        changes: changes_between(&before, &after),
+        drifted,
+        still_wired: false,
+    }
+}
+
+/// Whether the root settings file applies the script and the index lists
+/// `c`'s rows: the liveness proof `vex` needs for this layout.
+pub fn wired(read: ReadFn<'_>, c: &Coords<'_>) -> bool {
+    let gav = format!("{}:{}:{}", c.group_id, c.artifact_id, c.version);
+    let indexed = read(INDEX_REL)
+        .and_then(|b| String::from_utf8(b).ok())
+        .and_then(|index| index_rows(&index))
+        .is_some_and(|rows| {
+            rows.iter().any(|r| {
+                let cols: Vec<&str> = r.split('\t').collect();
+                cols.first() == Some(&gav.as_str()) && cols.get(3) == Some(&c.uuid)
+            })
+        });
+    let applied = ["settings.gradle", "settings.gradle.kts"]
+        .iter()
+        .any(|rel| {
+            read(rel)
+                .and_then(|b| String::from_utf8(b).ok())
+                .is_some_and(|text| has_apply_line(&text, ""))
+        });
+    indexed && applied
+}
+
+pub fn wired_checked(read: ReadFn<'_>, c: &Coords<'_>) -> Result<bool, JvmRefusal> {
+    read_settings(read, "")?;
+    if let Some(bytes) = read(INDEX_REL) {
+        let index = std::str::from_utf8(&bytes).ok().and_then(index_rows);
+        if index.is_none() {
+            return Err(shape_refusal(
+                "gradle_index_unreadable",
+                "the vendored Gradle index is malformed".into(),
+            ));
+        }
+    }
+    Ok(wired(read, c))
+}
+
+fn is_settings_file(rel: &str) -> bool {
+    let name = rel.rsplit('/').next().unwrap_or(rel);
+    name == "settings.gradle" || name == "settings.gradle.kts"
+}
+
+/// `text` without its first whole line whose trimmed body is `line`.
+fn remove_line(text: &str, line: &str) -> Option<String> {
+    let lines: Vec<&str> = text.split_inclusive('\n').collect();
+    let i = lines.iter().position(|l| l.trim() == line)?;
+    Some(format!(
+        "{}{}",
+        lines[..i].concat(),
+        lines[i + 1..].concat()
+    ))
+}
+
+/// The rows of an index, `None` when it is malformed.
+fn index_rows(index: &str) -> Option<Vec<String>> {
+    let mut lines = index.lines().map(|l| l.strip_suffix('\r').unwrap_or(l));
+    if lines.next() != Some(INDEX_HEADER) {
+        return None;
+    }
+    let mut rows = Vec::new();
+    for line in lines.filter(|l| !l.is_empty()) {
+        if !valid_index_row(line) {
+            return None;
+        }
+        rows.push(line.to_string());
+    }
+    Some(rows)
+}
+
+fn text_write(rel: &str, bytes: Vec<u8>) -> FileWrite {
+    FileWrite {
+        rel: rel.to_string(),
+        bytes,
+        tree: false,
+    }
+}
+
+fn shape_refusal(reason: &str, msg: String) -> JvmRefusal {
+    JvmRefusal {
+        code: "vendor_jvm_shape_unsupported",
+        detail: format!("reason: {reason}: {msg}"),
+    }
+}
+
+fn degraded(reason: &str, msg: String) -> JvmWarning {
+    JvmWarning {
+        code: "vendor_jvm_degraded",
+        detail: format!("reason: {reason}: {msg}"),
+    }
+}
+
+// ── settings files ──────────────────────────────────────────────────────────────
+
+/// One settings file to wire: `dir` is the build directory ("" = root).
+#[derive(Debug, Clone)]
+struct Target {
+    dir: String,
+    rel: String,
+    /// Current text; `None` when vendor creates the file.
+    text: Option<String>,
+    kotlin: bool,
+}
+
+fn join_rel(dir: &str, name: &str) -> String {
+    if dir.is_empty() {
+        name.to_string()
+    } else {
+        format!("{dir}/{name}")
+    }
+}
+
+fn read_text(read: ReadFn<'_>, rel: &str) -> Result<Option<String>, JvmRefusal> {
+    match read(rel) {
+        None => Ok(None),
+        Some(bytes) => String::from_utf8(bytes)
+            .map(Some)
+            .map_err(|_| shape_refusal("build_file_unreadable", format!("{rel} is not UTF-8"))),
+    }
+}
+
+/// Gradle's own lookup order: the Groovy name wins over the Kotlin one.
+fn read_script(
+    read: ReadFn<'_>,
+    dir: &str,
+    stem: &str,
+) -> Result<Option<(String, String)>, JvmRefusal> {
+    for ext in [".gradle", ".gradle.kts"] {
+        let rel = join_rel(dir, &format!("{stem}{ext}"));
+        if let Some(text) = read_text(read, &rel)? {
+            return Ok(Some((rel, text)));
+        }
+    }
+    Ok(None)
+}
+
+fn read_build_script(read: ReadFn<'_>, dir: &str) -> Result<Option<(String, String)>, JvmRefusal> {
+    read_script(read, dir, "build")
+}
+
+/// The settings file of `dir`, or the one to create there. A created file
+/// takes its DSL from the build's own build script, else `default_kotlin`.
+fn settings_target(
+    read: ReadFn<'_>,
+    dir: &str,
+    default_kotlin: bool,
+) -> Result<Target, JvmRefusal> {
+    if let Some((rel, text)) = read_script(read, dir, "settings")? {
+        let kotlin = rel.ends_with(".kts");
+        return Ok(Target {
+            dir: dir.to_string(),
+            rel,
+            text: Some(text),
+            kotlin,
+        });
+    }
+    let kotlin = match read_build_script(read, dir)? {
+        Some((rel, _)) => rel.ends_with(".kts"),
+        None => default_kotlin,
+    };
+    Ok(Target {
+        dir: dir.to_string(),
+        rel: join_rel(
+            dir,
+            if kotlin {
+                "settings.gradle.kts"
+            } else {
+                "settings.gradle"
+            },
+        ),
+        text: None,
+        kotlin,
+    })
+}
+
+fn read_settings(read: ReadFn<'_>, dir: &str) -> Result<Target, JvmRefusal> {
+    settings_target(read, dir, false)
+}
+
+fn read_buildsrc(read: ReadFn<'_>) -> Result<Option<Target>, JvmRefusal> {
+    let present = [
+        "build.gradle",
+        "build.gradle.kts",
+        "settings.gradle",
+        "settings.gradle.kts",
+    ]
+    .iter()
+    .any(|f| read(&format!("buildSrc/{f}")).is_some());
+    if !present {
+        return Ok(None);
+    }
+    settings_target(read, "buildSrc", false).map(Some)
+}
+
+/// The settings target of an included build, `None` when the directory
+/// holds neither a settings nor a build script (nothing to wire, and no
+/// directory is created for it).
+fn read_included(read: ReadFn<'_>, dir: &str) -> Result<Option<Target>, JvmRefusal> {
+    if read_script(read, dir, "settings")?.is_none() && read_build_script(read, dir)?.is_none() {
+        return Ok(None);
+    }
+    settings_target(read, dir, false).map(Some)
+}
+
+fn apply_line(kotlin: bool, prefix: &str) -> String {
+    if kotlin {
+        format!("apply(from = \"{prefix}{SCRIPT_REL}\") // socket-patch")
+    } else {
+        format!("apply from: '{prefix}{SCRIPT_REL}' // socket-patch")
+    }
+}
+
+/// Any live `apply from` naming our script at this prefix, in either DSL,
+/// counts (a user who reformatted the line keeps it); one inside a comment
+/// does not.
+fn has_apply_line(text: &str, prefix: &str) -> bool {
+    let path = format!("{prefix}{SCRIPT_REL}");
+    let toks = lex(text);
+    (0..toks.len()).any(|i| {
+        if !is_ident(toks.get(i), "apply") {
+            return false;
+        }
+        let mut j = i + 1;
+        if is_punct(toks.get(j), b'(') {
+            j += 1;
+        }
+        is_ident(toks.get(j), "from")
+            && (is_punct(toks.get(j + 1), b':') || is_punct(toks.get(j + 1), b'='))
+            && matches!(toks.get(j + 2), Some(Token { tok: Tok::Str { value, .. }, .. }) if *value == path)
+    })
+}
+
+/// The newline the file already uses (CRLF when its first line ends so).
+fn newline_of(text: &str) -> &'static str {
+    match text.find('\n') {
+        Some(i) if i > 0 && text.as_bytes()[i - 1] == b'\r' => "\r\n",
+        _ => "\n",
+    }
+}
+
+fn append_line(text: &str, line: &str) -> String {
+    let nl = newline_of(text);
+    let mut out = text.to_string();
+    if !out.is_empty() && !out.ends_with('\n') {
+        out.push_str(nl);
+    }
+    out.push_str(line);
+    out.push_str(nl);
+    out
+}
+
+// ── a small Groovy/Kotlin lexer ─────────────────────────────────────────────────
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+enum Tok {
+    Ident(String),
+    /// A string literal. `literal` is false when it interpolates (`$`) or
+    /// uses an escape we do not decode.
+    Str {
+        value: String,
+        literal: bool,
+    },
+    Punct(u8),
+}
+
+#[derive(Debug, Clone)]
+struct Token {
+    tok: Tok,
+    start: usize,
+    end: usize,
+}
+
+/// Tokenize enough of a build script to find blocks, calls and string
+/// literals: comments are skipped, strings (including triple-quoted) are one
+/// token, everything else is an identifier or a single punctuation byte.
+/// Slashy strings are not recognised (a `/` is punctuation).
+fn lex(src: &str) -> Vec<Token> {
+    let b = src.as_bytes();
+    let mut out = Vec::new();
+    let mut i = 0;
+    while i < b.len() {
+        let c = b[i];
+        if c.is_ascii_whitespace() {
+            i += 1;
+        } else if b[i..].starts_with(b"//") {
+            while i < b.len() && b[i] != b'\n' {
+                i += 1;
+            }
+        } else if b[i..].starts_with(b"/*") {
+            i = src[i + 2..].find("*/").map_or(b.len(), |j| i + 2 + j + 2);
+        } else if c == b'\'' || c == b'"' {
+            let start = i;
+            let triple = b[i..].starts_with(&[c, c, c]);
+            i += if triple { 3 } else { 1 };
+            let mut value = String::new();
+            let mut literal = true;
+            loop {
+                if i >= b.len() {
+                    literal = false;
+                    break;
+                }
+                if triple {
+                    if b[i..].starts_with(&[c, c, c]) {
+                        i += 3;
+                        break;
+                    }
+                } else if b[i] == c {
+                    i += 1;
+                    break;
+                } else if b[i] == b'\n' {
+                    literal = false;
+                    break;
+                }
+                if b[i] == b'\\' && !triple {
+                    match b.get(i + 1) {
+                        Some(&e @ (b'\\' | b'\'' | b'"')) => value.push(e as char),
+                        _ => literal = false,
+                    }
+                    i += 2;
+                    continue;
+                }
+                if b[i] == b'$' && c == b'"' {
+                    literal = false;
+                }
+                let ch = src[i..].chars().next().unwrap_or('\u{fffd}');
+                value.push(ch);
+                i += ch.len_utf8().max(1);
+            }
+            out.push(Token {
+                tok: Tok::Str { value, literal },
+                start,
+                end: i.min(b.len()),
+            });
+        } else if c.is_ascii_alphabetic() || c == b'_' || c == b'$' {
+            let start = i;
+            while i < b.len() && (b[i].is_ascii_alphanumeric() || b[i] == b'_' || b[i] == b'$') {
+                i += 1;
+            }
+            out.push(Token {
+                tok: Tok::Ident(src[start..i].to_string()),
+                start,
+                end: i,
+            });
+        } else if c.is_ascii() {
+            out.push(Token {
+                tok: Tok::Punct(c),
+                start: i,
+                end: i + 1,
+            });
+            i += 1;
+        } else {
+            i += src[i..].chars().next().map_or(1, char::len_utf8);
+        }
+    }
+    out
+}
+
+fn is_ident(t: Option<&Token>, name: &str) -> bool {
+    matches!(t, Some(Token { tok: Tok::Ident(n), .. }) if n == name)
+}
+
+fn is_punct(t: Option<&Token>, p: u8) -> bool {
+    matches!(t, Some(Token { tok: Tok::Punct(c), .. }) if *c == p)
+}
+
+/// Index of the `}` matching the `{` at `open`.
+fn matching_close(toks: &[Token], open: usize) -> Option<usize> {
+    let mut depth = 0usize;
+    for (i, t) in toks.iter().enumerate().skip(open) {
+        match t.tok {
+            Tok::Punct(b'{') => depth += 1,
+            Tok::Punct(b'}') => {
+                depth = depth.checked_sub(1)?;
+                if depth == 0 {
+                    return Some(i);
+                }
+            }
+            _ => {}
+        }
+    }
+    None
+}
+
+/// A `name {` block directly inside `toks[from..to]` (brace depth 0 there):
+/// `(name index, open index, close index)`.
+fn find_block(toks: &[Token], from: usize, to: usize, name: &str) -> Option<(usize, usize, usize)> {
+    let mut depth = 0usize;
+    let mut i = from;
+    while i < to {
+        match toks[i].tok {
+            Tok::Punct(b'{') => depth += 1,
+            Tok::Punct(b'}') => depth = depth.saturating_sub(1),
+            Tok::Ident(ref n) if depth == 0 && n == name && is_punct(toks.get(i + 1), b'{') => {
+                let close = matching_close(toks, i + 1)?;
+                return Some((i, i + 1, close));
+            }
+            _ => {}
+        }
+        i += 1;
+    }
+    None
+}
+
+/// Every `name {` block at any depth: `(open index, close index)`.
+fn all_blocks(toks: &[Token], name: &str) -> Vec<(usize, usize)> {
+    (0..toks.len())
+        .filter(|&i| is_ident(toks.get(i), name) && is_punct(toks.get(i + 1), b'{'))
+        .filter_map(|i| matching_close(toks, i + 1).map(|c| (i + 1, c)))
+        .collect()
+}
+
+fn strings(toks: &[Token]) -> impl Iterator<Item = &str> {
+    toks.iter().filter_map(|t| match &t.tok {
+        Tok::Str { value, .. } => Some(value.as_str()),
+        _ => None,
+    })
+}
+
+// ── refusals ────────────────────────────────────────────────────────────────────
+
+fn check_android(rel: &str, text: &str) -> Result<(), JvmRefusal> {
+    let toks = lex(text);
+    let hit = strings(&toks)
+        .find(|s| {
+            s.starts_with("com.android.") || s.starts_with("org.jetbrains.kotlin.multiplatform")
+        })
+        .map(str::to_string)
+        .or_else(|| {
+            toks.windows(4).find_map(|w| {
+                let kmp = is_ident(Some(&w[0]), "kotlin")
+                    && is_punct(Some(&w[1]), b'(')
+                    && matches!(&w[2].tok, Tok::Str { value, .. } if value == "multiplatform")
+                    && is_punct(Some(&w[3]), b')');
+                kmp.then(|| "kotlin(\"multiplatform\")".to_string())
+            })
+        });
+    match hit {
+        Some(id) => Err(shape_refusal(
+            "android_or_kmp",
+            format!("{rel} uses {id}; Android and Kotlin Multiplatform builds need hosted mode"),
+        )),
+        None => Ok(()),
+    }
+}
+
+/// A user `exclusiveContent` that claims the patched group for another
+/// repository would make ours unreachable ("Could not find").
+fn check_exclusive_content(rel: &str, text: &str, patch: &JvmPatch<'_>) -> Result<(), JvmRefusal> {
+    let toks = lex(text);
+    for (open, close) in all_blocks(&toks, "exclusiveContent") {
+        let body = &toks[open..close];
+        if strings(body).any(|s| s == REPO_NAME || s.starts_with(&format!("{REPO_NAME}_"))) {
+            continue;
+        }
+        let g = patch.group_id;
+        if strings(body).any(|s| s == g || s.starts_with(&format!("{g}:"))) {
+            return Err(shape_refusal(
+                "gradle_exclusive_content_conflict",
+                format!(
+                    "{rel} has an exclusiveContent rule for {g}; drop {g}:{} from it",
+                    patch.artifact_id
+                ),
+            ));
+        }
+    }
+    Ok(())
+}
+
+// ── includeBuild ────────────────────────────────────────────────────────────────
+
+/// Literal `includeBuild` targets of the settings file of `dir`, as
+/// project-relative directories; non-literal or escaping ones are warned.
+fn included_builds(rel: &str, dir: &str, text: &str) -> (Vec<String>, Vec<JvmWarning>) {
+    let toks = lex(text);
+    let mut found = Vec::new();
+    let mut warns = Vec::new();
+    for (i, t) in toks.iter().enumerate() {
+        if !matches!(&t.tok, Tok::Ident(n) if n == "includeBuild") {
+            continue;
+        }
+        // `x.includeBuild(…)` on anything but `settings` is not this build's.
+        let prev = |k: usize| i.checked_sub(k).and_then(|p| toks.get(p));
+        if is_punct(prev(1), b'.') && !is_ident(prev(2), "settings") {
+            continue;
+        }
+        // `includeBuild('p')`, `includeBuild("p") { … }` or Groovy `includeBuild 'p'`.
+        let arg = if is_punct(toks.get(i + 1), b'(') {
+            match (toks.get(i + 2), toks.get(i + 3)) {
+                (
+                    Some(Token {
+                        tok:
+                            Tok::Str {
+                                value,
+                                literal: true,
+                            },
+                        ..
+                    }),
+                    Some(close),
+                ) if is_punct(Some(close), b')') => Some(value.clone()),
+                _ => None,
+            }
+        } else {
+            match toks.get(i + 1) {
+                Some(Token {
+                    tok:
+                        Tok::Str {
+                            value,
+                            literal: true,
+                        },
+                    ..
+                }) => Some(value.clone()),
+                _ => None,
+            }
+        };
+        let snippet = &text[t.start..toks.get(i + 3).map_or(t.end, |x| x.end).min(text.len())];
+        match arg.as_deref().map(|p| resolve_dir(dir, p)) {
+            Some(Some(target)) if !target.is_empty() => found.push(target),
+            Some(Some(_)) => {}
+            Some(None) => warns.push(degraded(
+                "unwired_build_logic",
+                format!(
+                    "{rel}: {snippet} points outside the project root; that build stays unpatched"
+                ),
+            )),
+            None => warns.push(degraded(
+                "unwired_build_logic",
+                format!("{rel}: {snippet} is not a literal path; that build stays unpatched"),
+            )),
+        }
+    }
+    (found, warns)
+}
+
+/// `base` joined with the relative path `p`, normalised; `None` when `p` is
+/// absolute or leaves the root.
+fn resolve_dir(base: &str, p: &str) -> Option<String> {
+    if p.starts_with('/') || p.contains('\\') || p.contains(':') {
+        return None;
+    }
+    let mut parts: Vec<&str> = base.split('/').filter(|s| !s.is_empty()).collect();
+    for seg in p.split('/') {
+        match seg {
+            "" | "." => {}
+            ".." => {
+                parts.pop()?;
+            }
+            s => parts.push(s),
+        }
+    }
+    Some(parts.join("/"))
+}
+
+// ── in-block pluginManagement entry ──────────────────────────────────────
+
+enum InBlock {
+    Unneeded,
+    /// The entry is already there (a re-run, or a patch update of the GAV).
+    Present,
+    /// Replace `text[start..end]` with `text`.
+    Edited {
+        start: usize,
+        end: usize,
+        text: String,
+    },
+    Unwired(String),
+}
+
+fn in_block_line(kotlin: bool, prefix: &str, c: &Coords<'_>) -> String {
+    let (g, a, v) = (c.group_id, c.artifact_id, c.version);
+    let suffix = &sha256_hex(format!("{g}:{a}:{v}").as_bytes())[..16];
+    let name = format!("{REPO_NAME}_{suffix}");
+    if kotlin {
+        format!(
+            "exclusiveContent {{ forRepository {{ maven {{ name = \"{name}\"; url = File(settingsDir, \"{prefix}{TREE_ROOT}\").toURI() }} }}; filter {{ includeVersion(\"{g}\", \"{a}\", \"{v}\") }} }} // socket-patch"
+        )
+    } else {
+        format!(
+            "exclusiveContent {{ forRepository {{ maven {{ name = '{name}'; url = new File(settingsDir, '{prefix}{TREE_ROOT}').toURI() }} }}; filter {{ includeVersion('{g}', '{a}', '{v}') }} }} // socket-patch"
+        )
+    }
+}
+
+/// Settings-level `plugins{}` resolves before the apply line runs, so the
+/// patched GAV gets its own first entry in `pluginManagement.repositories`.
+fn scoped_in_block_entry(
+    text: &str,
+    kotlin: bool,
+    prefix: &str,
+    patch: &Coords<'_>,
+    scope: &str,
+) -> InBlock {
+    let toks = lex(text);
+    if scope == "pluginManagement" && find_block(&toks, 0, toks.len(), "plugins").is_none() {
+        return InBlock::Unneeded;
+    }
+    let entry = in_block_line(kotlin, prefix, patch);
+    let nl = newline_of(text);
+    let unit = indent_unit(text);
+    let Some((pm_name, pm_open, pm_close)) = find_block(&toks, 0, toks.len(), scope) else {
+        if scope == "buildscript" {
+            return InBlock::Unneeded;
+        }
+        // pluginManagement must be the first statement: after imports only.
+        let at = first_statement_offset(text, &toks);
+        let block = format!(
+            "pluginManagement {{{nl}{unit}repositories {{{nl}{unit}{unit}{entry}{nl}{unit}{unit}gradlePluginPortal(){nl}{unit}}}{nl}}}{nl}"
+        );
+        return InBlock::Edited {
+            start: at,
+            end: at,
+            text: block,
+        };
+    };
+    if text[toks[pm_open].end..toks[pm_close].start]
+        .lines()
+        .any(|l| l.trim() == entry)
+    {
+        return InBlock::Present;
+    }
+    let pm_indent = line_indent(text, toks[pm_name].start);
+    let repos_ref = (pm_open + 1..pm_close).find(|&i| {
+        is_ident(toks.get(i), "repositories") && depth_between(&toks, pm_open + 1, i) == 0
+    });
+    match repos_ref {
+        Some(r) if is_punct(toks.get(r + 1), b'{') => {
+            let Some(close) = matching_close(&toks, r + 1) else {
+                return InBlock::Unwired(
+                    "unbalanced pluginManagement.repositories block".to_string(),
+                );
+            };
+            let r_indent = line_indent(text, toks[r].start);
+            let inner = format!("{r_indent}{}", nested_unit(&r_indent, &pm_indent, unit));
+            let empty = close == r + 2;
+            let body = if empty && scope == "pluginManagement" {
+                format!("{inner}{entry}{nl}{inner}gradlePluginPortal(){nl}")
+            } else {
+                format!("{inner}{entry}{nl}")
+            };
+            insert_after_brace(text, toks[r + 1].end, &body, &r_indent, nl)
+        }
+        Some(_) => {
+            InBlock::Unwired("pluginManagement.repositories is not a literal block".to_string())
+        }
+        None => {
+            let inner = format!("{pm_indent}{}", nested_unit(&pm_indent, "", unit));
+            let default_repo = if scope == "pluginManagement" {
+                format!("{inner}{unit}gradlePluginPortal(){nl}")
+            } else {
+                String::new()
+            };
+            let body = format!(
+                "{inner}repositories {{{nl}{inner}{unit}{entry}{nl}{default_repo}{inner}}}{nl}"
+            );
+            insert_after_brace(text, toks[pm_open].end, &body, &pm_indent, nl)
+        }
+    }
+}
+
+fn depth_between(toks: &[Token], from: usize, to: usize) -> isize {
+    toks[from..to].iter().fold(0, |d, t| match t.tok {
+        Tok::Punct(b'{') => d + 1,
+        Tok::Punct(b'}') => d - 1,
+        _ => d,
+    })
+}
+
+/// Insert `body` (whole lines) right after the `{` ending at `brace_end`.
+/// When code follows the brace on its line, that code moves to its own line.
+fn insert_after_brace(text: &str, brace_end: usize, body: &str, indent: &str, nl: &str) -> InBlock {
+    let eol = text[brace_end..]
+        .find('\n')
+        .map_or(text.len(), |j| brace_end + j);
+    let rest = text[brace_end..eol].trim_end_matches('\r').trim();
+    if rest.is_empty() || rest.starts_with("//") {
+        let at = if eol < text.len() { eol + 1 } else { eol };
+        let lead = if eol == text.len() { nl } else { "" };
+        return InBlock::Edited {
+            start: at,
+            end: at,
+            text: format!("{lead}{body}"),
+        };
+    }
+    let code_at = brace_end
+        + (text[brace_end..].len() - text[brace_end..].trim_start_matches([' ', '\t']).len());
+    let unit = indent_unit(text);
+    InBlock::Edited {
+        start: brace_end,
+        end: code_at,
+        text: format!("{nl}{body}{indent}{unit}"),
+    }
+}
+
+/// The indentation step a nested block uses, from the enclosing two.
+fn nested_unit<'a>(inner: &'a str, outer: &str, fallback: &'a str) -> &'a str {
+    match inner.strip_prefix(outer) {
+        Some(step) if !step.is_empty() => step,
+        _ => fallback,
+    }
+}
+
+/// The file's indentation unit: a tab when some line starts with one, else
+/// the smallest non-zero leading-space run (4 when none).
+fn indent_unit(text: &str) -> &'static str {
+    if text.lines().any(|l| l.starts_with('\t')) {
+        return "\t";
+    }
+    let min = text
+        .lines()
+        .filter(|l| !l.trim().is_empty())
+        .map(|l| l.len() - l.trim_start_matches(' ').len())
+        .filter(|&n| n > 0)
+        .min()
+        .unwrap_or(4);
+    ["  ", "  ", "  ", "   ", "    "][min.clamp(2, 4)]
+}
+
+fn line_indent(text: &str, at: usize) -> String {
+    let start = text[..at].rfind('\n').map_or(0, |i| i + 1);
+    text[start..at]
+        .chars()
+        .take_while(|c| *c == ' ' || *c == '\t')
+        .collect()
+}
+
+/// Byte offset of the start of the first line holding code other than an
+/// `import` (Kotlin and Groovy both require imports first).
+fn first_statement_offset(text: &str, toks: &[Token]) -> usize {
+    let mut i = 0;
+    while is_ident(toks.get(i), "import") {
+        let line_end = text[toks[i].start..]
+            .find('\n')
+            .map_or(text.len(), |j| toks[i].start + j);
+        while i < toks.len() && toks[i].start < line_end {
+            i += 1;
+        }
+    }
+    match toks.get(i) {
+        Some(t) => text[..t.start].rfind('\n').map_or(0, |j| j + 1),
+        None => text.len(),
+    }
+}
+
+// ── tree marker and index ───────────────────────────────────────────────────────
+
+fn json_str(s: &str) -> String {
+    serde_json::to_string(s).unwrap_or_else(|_| "\"\"".to_string())
+}
+
+/// The marker: sorted keys, 2-space indent, trailing newline.
+fn marker_json(patch: &JvmPatch<'_>, files: &[(&str, &[u8])]) -> String {
+    let mut out = String::from("{\n  \"files\": {");
+    for (n, (name, bytes)) in files.iter().enumerate() {
+        out.push_str(if n == 0 { "\n" } else { ",\n" });
+        out.push_str(&format!(
+            "    {}: {{\n      \"sha256\": \"{}\",\n      \"size\": {}\n    }}",
+            json_str(name),
+            sha256_hex(bytes),
+            bytes.len()
+        ));
+    }
+    let purl = format!(
+        "pkg:maven/{}/{}@{}",
+        patch.group_id, patch.artifact_id, patch.version
+    );
+    out.push_str(&format!(
+        "\n  }},\n  \"purl\": {},\n  \"schema\": 1,\n  \"tool\": \"gradle\",\n  \"uuid\": {},\n  \"version\": {}\n}}\n",
+        json_str(&purl),
+        json_str(patch.uuid),
+        json_str(patch.version)
+    ));
+    out
+}
+
+/// Whether an existing index row is one the script would accept.
+fn valid_index_row(row: &str) -> bool {
+    let cols: Vec<&str> = row.split('\t').collect();
+    let [gav, path, sha, uuid] = cols.as_slice() else {
+        return false;
+    };
+    let parts: Vec<&str> = gav.split(':').collect();
+    let [g, a, v] = parts.as_slice() else {
+        return false;
+    };
+    let dir = format!("{}/{a}/{v}/", g.replace('.', "/"));
+    safe_coordinates(g, a, v)
+        && path
+            .strip_prefix(&dir)
+            .is_some_and(|n| n.starts_with(&format!("{a}-{v}")) && !n.contains('/'))
+        && sha.len() == 64
+        && sha
+            .bytes()
+            .all(|c| c.is_ascii_digit() || (b'a'..=b'f').contains(&c))
+        && !uuid.is_empty()
+        && !uuid.chars().any(char::is_whitespace)
+}
+
+/// Merge `rows` for `gav` into the existing index, replacing that GAV's
+/// rows. A malformed existing index is refused rather than rewritten.
+fn merge_index(
+    existing: Option<&[u8]>,
+    gav: &str,
+    rows: Vec<String>,
+) -> Result<String, JvmRefusal> {
+    let bad = |why: String| {
+        shape_refusal(
+            "build_file_unreadable",
+            format!("{INDEX_REL}: {why}; restore it from git"),
+        )
+    };
+    let mut all: BTreeSet<String> = BTreeSet::new();
+    if let Some(bytes) = existing {
+        let text = std::str::from_utf8(bytes).map_err(|_| bad("not UTF-8".to_string()))?;
+        let mut lines = text.lines().map(|l| l.strip_suffix('\r').unwrap_or(l));
+        if lines.next() != Some(INDEX_HEADER) {
+            return Err(bad("unknown header".to_string()));
+        }
+        for (n, line) in lines.enumerate() {
+            if line.is_empty() {
+                continue;
+            }
+            if !valid_index_row(line) {
+                return Err(bad(format!("malformed row {}", n + 2)));
+            }
+            if line.split('\t').next() != Some(gav) {
+                all.insert(line.to_string());
+            }
+        }
+    }
+    all.extend(rows);
+    let mut out = format!("{INDEX_HEADER}\n");
+    for row in all {
+        out.push_str(&row);
+        out.push('\n');
+    }
+    Ok(out)
+}
+
+// ── gradle/verification-metadata.xml ─────────────────────────────────────
+
+struct ArtifactHashes {
+    jar: String,
+    pom: String,
+    module: Option<String>,
+}
+
+/// Whether Gradle may verify metadata of the vendored pom's parent chain or
+/// imported platforms that the file does not list (read from the file
+/// repository, the pom is parsed before the `.module` redirect). A parent
+/// the file already lists is fine; imports and platforms always warn.
+pub(crate) fn verifies_metadata(verification: &str) -> bool {
+    let masked = mask_xml_comments(verification);
+    !xml_elements(&masked, 0, masked.len(), "verify-metadata")
+        .iter()
+        .any(|&(_, tag_end, end)| {
+            end > tag_end && masked[tag_end..end - "</verify-metadata>".len()].trim() == "false"
+        })
+}
+
+fn unverified_parent_chain(verification: &str, pom: &str, module: Option<&[u8]>) -> bool {
+    let vm = mask_xml_comments(verification);
+    if !verifies_metadata(&vm) {
+        return false;
+    }
+    let masked = mask_xml_comments(pom);
+    if masked.contains("<scope>import</scope>")
+        || module.is_some_and(|m| String::from_utf8_lossy(m).contains("\"platform\""))
+    {
+        return true;
+    }
+    let Some(&(_, tag_end, end)) = xml_elements(&masked, 0, masked.len(), "parent").first() else {
+        return false;
+    };
+    let child = |name: &str| {
+        let (open, close) = (format!("<{name}>"), format!("</{name}>"));
+        let body = &masked[tag_end..end];
+        let s = body.find(&open)? + open.len();
+        body[s..]
+            .find(&close)
+            .map(|e| body[s..s + e].trim().to_string())
+    };
+    let (Some(g), Some(a), Some(v)) = (child("groupId"), child("artifactId"), child("version"))
+    else {
+        return true;
+    };
+    !xml_elements(&vm, 0, vm.len(), "component")
+        .iter()
+        .any(|&(s, t, _)| {
+            let tag = &vm[s..t];
+            xml_attr(tag, "group") == Some(g.as_str())
+                && xml_attr(tag, "name") == Some(a.as_str())
+                && xml_attr(tag, "version") == Some(v.as_str())
+        })
+}
+
+/// `text` with every `<!-- … -->` replaced by spaces (same byte offsets), so
+/// commented-out elements are never matched.
+fn mask_xml_comments(text: &str) -> String {
+    let mut bytes = text.as_bytes().to_vec();
+    let mut from = 0;
+    while let Some(j) = text[from..].find("<!--") {
+        let start = from + j;
+        let end = text[start..]
+            .find("-->")
+            .map_or(text.len(), |k| start + k + 3);
+        for b in &mut bytes[start..end] {
+            if *b != b'\n' && *b != b'\r' {
+                *b = b' ';
+            }
+        }
+        from = end;
+    }
+    String::from_utf8(bytes).unwrap_or_default()
+}
+
+/// The value of attribute `name` in the start tag `tag`.
+fn xml_attr<'a>(tag: &'a str, name: &str) -> Option<&'a str> {
+    let mut rest = tag;
+    loop {
+        let at = rest.find(name)?;
+        let before = rest[..at].chars().last();
+        let after = rest[at + name.len()..].trim_start();
+        rest = &rest[at + name.len()..];
+        if !before.is_some_and(char::is_whitespace) {
+            continue;
+        }
+        let Some(after) = after.strip_prefix('=') else {
+            continue;
+        };
+        let after = after.trim_start();
+        let quote = after.chars().next()?;
+        if quote != '"' && quote != '\'' {
+            return None;
+        }
+        let body = &after[1..];
+        return body.find(quote).map(|e| &body[..e]);
+    }
+}
+
+/// Elements named `name` inside `masked[from..to]`: (start, end of start
+/// tag, end of element). Self-closing elements end with their start tag.
+fn xml_elements(masked: &str, from: usize, to: usize, name: &str) -> Vec<(usize, usize, usize)> {
+    let open = format!("<{name}");
+    let close = format!("</{name}>");
+    let mut out = Vec::new();
+    let mut i = from;
+    while let Some(j) = masked[i..to].find(&open) {
+        let s = i + j;
+        let next = masked.as_bytes().get(s + open.len()).copied();
+        if !matches!(next, Some(b' ' | b'\t' | b'\r' | b'\n' | b'>' | b'/')) {
+            i = s + open.len();
+            continue;
+        }
+        let Some(tag_end) = masked[s..to].find('>').map(|k| s + k + 1) else {
+            break;
+        };
+        let end = if masked[..tag_end].ends_with("/>") {
+            tag_end
+        } else {
+            match masked[tag_end..to].find(&close) {
+                Some(k) => tag_end + k + close.len(),
+                None => break,
+            }
+        };
+        out.push((s, tag_end, end));
+        i = end;
+    }
+    out
+}
+
+fn artifact_element(name: &str, sha: &str, indent: &str, unit: &str, nl: &str) -> String {
+    format!("<artifact name=\"{name}\">{nl}{indent}{unit}<sha256 value=\"{sha}\" origin=\"socket-patch\"/>{nl}{indent}</artifact>")
+}
+
+/// Replace the patched jar's hash in an existing verification file, or add
+/// a component for the GAV, as the edit `(start, end, replacement)`.
+/// Trusted artifacts and keys are never touched.
+fn update_verification(
+    text: &str,
+    patch: &JvmPatch<'_>,
+    h: &ArtifactHashes,
+) -> Result<(usize, usize, String), JvmRefusal> {
+    update_verification_component(text, patch, h, None)
+}
+
+fn update_verification_component(
+    text: &str,
+    patch: &JvmPatch<'_>,
+    h: &ArtifactHashes,
+    metadata_extension: Option<&str>,
+) -> Result<(usize, usize, String), JvmRefusal> {
+    let unparseable = |why: &str| {
+        shape_refusal(
+            "gradle_verification_unparseable",
+            format!("{VERIFICATION_REL}: {why}"),
+        )
+    };
+    let masked = mask_xml_comments(text);
+    let nl = newline_of(text);
+    const UNIT: &str = "   ";
+    let (a, v) = (patch.artifact_id, patch.version);
+    let jar_name = format!("{a}-{v}.{}", metadata_extension.unwrap_or("jar"));
+
+    let Some(&(cs_start, cs_tag_end, cs_end)) =
+        xml_elements(&masked, 0, masked.len(), "components").first()
+    else {
+        return Err(unparseable("no <components> element"));
+    };
+    let self_closing = cs_tag_end == cs_end;
+    let comps = if self_closing {
+        Vec::new()
+    } else {
+        xml_elements(&masked, cs_tag_end, cs_end, "component")
+    };
+    let key = (patch.group_id, a, v);
+    for &(s, tag_end, end) in &comps {
+        let tag = &masked[s..tag_end];
+        let (Some(g), Some(n), Some(ver)) = (
+            xml_attr(tag, "group"),
+            xml_attr(tag, "name"),
+            xml_attr(tag, "version"),
+        ) else {
+            return Err(unparseable("a <component> lacks group, name or version"));
+        };
+        if (g, n, ver) != key {
+            continue;
+        }
+        if tag_end == end {
+            return Err(unparseable("the patched component is empty"));
+        }
+        let arts = xml_elements(&masked, tag_end, end, "artifact");
+        let comp_indent = line_indent(text, s);
+        for &(as_, at_end, ae) in &arts {
+            if xml_attr(&masked[as_..at_end], "name") == Some(jar_name.as_str()) {
+                if metadata_extension.is_some() {
+                    return Ok((as_, ae, text[as_..ae].to_string()));
+                }
+                let indent = line_indent(text, as_);
+                let el = artifact_element(&jar_name, &h.jar, &indent, UNIT, nl);
+                return Ok((as_, ae, el));
+            }
+        }
+        // No jar entry: insert one in name order, as Gradle writes them.
+        let indent = format!("{comp_indent}{UNIT}");
+        let el = artifact_element(&jar_name, &h.jar, &indent, UNIT, nl);
+        let before = arts
+            .iter()
+            .find(|&&(as_, at_end, _)| {
+                xml_attr(&masked[as_..at_end], "name").is_some_and(|n| n > jar_name.as_str())
+            })
+            .map(|&(as_, _, _)| as_);
+        let at = before.map_or_else(
+            || line_start(text, end - "</component>".len()),
+            |as_| line_start(text, as_),
+        );
+        return Ok((at, at, format!("{indent}{el}{nl}")));
+    }
+
+    let cs_indent = line_indent(text, cs_start);
+    let comp_indent = comps.first().map_or_else(
+        || format!("{cs_indent}{UNIT}"),
+        |&(s, _, _)| line_indent(text, s),
+    );
+    let art_indent = format!("{comp_indent}{UNIT}");
+    let mut arts = vec![
+        (jar_name.clone(), h.jar.clone()),
+        (format!("{a}-{v}.pom"), h.pom.clone()),
+    ];
+    if metadata_extension.is_some() {
+        arts.truncate(1);
+    }
+    if let Some(m) = &h.module {
+        arts.push((format!("{a}-{v}.module"), m.clone()));
+    }
+    arts.sort();
+    let mut comp = format!(
+        "{comp_indent}<component group=\"{}\" name=\"{a}\" version=\"{v}\">{nl}",
+        patch.group_id
+    );
+    for (name, sha) in &arts {
+        comp.push_str(&format!(
+            "{art_indent}{}{nl}",
+            artifact_element(name, sha, &art_indent, UNIT, nl)
+        ));
+    }
+    comp.push_str(&format!("{comp_indent}</component>{nl}"));
+    if self_closing {
+        let el = format!("<components>{nl}{comp}{cs_indent}</components>");
+        return Ok((cs_start, cs_end, el));
+    }
+    let before = comps.iter().find(|&&(s, tag_end, _)| {
+        let tag = &masked[s..tag_end];
+        (
+            xml_attr(tag, "group").unwrap_or(""),
+            xml_attr(tag, "name").unwrap_or(""),
+            xml_attr(tag, "version").unwrap_or(""),
+        ) > key
+    });
+    let at = match before {
+        Some(&(s, _, _)) => line_start(text, s),
+        None => line_start(text, cs_end - "</components>".len()),
+    };
+    Ok((at, at, comp))
+}
+
+/// One upstream parent or BOM whose metadata Gradle must verify.
+pub(crate) struct MetadataArtifact {
+    pub group: String,
+    pub artifact: String,
+    pub version: String,
+    pub bytes: Vec<u8>,
+    pub extension: &'static str,
+}
+
+/// A recorded parent/BOM must still have its POM verification entry. For entries
+/// we inserted, require the recorded checksum; pre-existing policy stays user-owned.
+pub(crate) fn metadata_record_present(text: &str, record: &WiringRecord) -> bool {
+    let Some(gav) = record
+        .key
+        .as_deref()
+        .and_then(|k| k.strip_prefix("metadata:"))
+    else {
+        return false;
+    };
+    let parts: Vec<_> = gav.split(':').collect();
+    if parts.len() != 3 && parts.len() != 4 {
+        return false;
+    }
+    let masked = mask_xml_comments(text);
+    let name = format!(
+        "{}-{}.{}",
+        parts[1],
+        parts[2],
+        parts.get(3).unwrap_or(&"pom")
+    );
+    xml_elements(&masked, 0, masked.len(), "component")
+        .iter()
+        .any(|&(start, tag_end, end)| {
+            let tag = &masked[start..tag_end];
+            if xml_attr(tag, "group") != Some(parts[0])
+                || xml_attr(tag, "name") != Some(parts[1])
+                || xml_attr(tag, "version") != Some(parts[2])
+            {
+                return false;
+            }
+            xml_elements(&masked, tag_end, end, "artifact")
+                .iter()
+                .any(|&(s, t, e)| {
+                    if xml_attr(&masked[s..t], "name") != Some(name.as_str()) {
+                        return false;
+                    }
+                    match op_str(record, "to") {
+                        None => true,
+                        Some(to) => {
+                            xml_elements(to, 0, to.len(), "sha256")
+                                .iter()
+                                .all(|&(hs, ht, _)| {
+                                    xml_attr(&to[hs..ht], "value").is_some_and(|hash| {
+                                        xml_elements(&masked, t, e, "sha256").iter().any(
+                                            |&(cs, ct, _)| {
+                                                xml_attr(&masked[cs..ct], "value") == Some(hash)
+                                            },
+                                        )
+                                    })
+                                })
+                        }
+                    }
+                })
+        })
+}
+
+/// Add only missing parent/BOM metadata to an existing verification file.
+pub(crate) fn add_verification_metadata(
+    read: ReadFn<'_>,
+    plan: &mut JvmPlan,
+    metadata: &[MetadataArtifact],
+) -> Result<(), JvmRefusal> {
+    let Some(original) = read(VERIFICATION_REL) else {
+        return Ok(());
+    };
+    let mut bytes = plan
+        .writes
+        .iter()
+        .find(|w| w.rel == VERIFICATION_REL)
+        .map(|w| w.bytes.clone())
+        .unwrap_or(original);
+    for m in metadata {
+        let text = String::from_utf8(bytes).map_err(|_| {
+            shape_refusal(
+                "gradle_verification_unparseable",
+                "metadata is not UTF-8".into(),
+            )
+        })?;
+        let patch = JvmPatch {
+            group_id: &m.group,
+            artifact_id: &m.artifact,
+            version: &m.version,
+            uuid: "",
+            jar: &[],
+            upstream_pom: &m.bytes,
+            upstream_module: None,
+        };
+        let sha = sha256_hex(&m.bytes);
+        let h = ArtifactHashes {
+            jar: sha.clone(),
+            pom: sha,
+            module: None,
+        };
+        let (start, end, to) = update_verification_component(&text, &patch, &h, Some(m.extension))?;
+        let key = format!(
+            "metadata:{}:{}:{}:{}",
+            m.group, m.artifact, m.version, m.extension
+        );
+        if to == text[start..end] {
+            plan.records
+                .push(adopt(VERIFICATION_REL, VERIFICATION_FRAGMENT_KIND, &key));
+        } else {
+            plan.records.push(fragment(
+                VERIFICATION_REL,
+                VERIFICATION_FRAGMENT_KIND,
+                &key,
+                WiringAction::Added,
+                None,
+                replace_op(&text[start..end], &to),
+            ));
+        }
+        bytes = format!("{}{to}{}", &text[..start], &text[end..]).into_bytes();
+    }
+    plan.writes.retain(|w| w.rel != VERIFICATION_REL);
+    if read(VERIFICATION_REL).as_deref() != Some(bytes.as_slice()) {
+        plan.writes.push(text_write(VERIFICATION_REL, bytes));
+    }
+    plan.warnings.retain(|w| {
+        !w.detail
+            .starts_with("reason: verification_parent_chain_unhandled:")
+    });
+    Ok(())
+}
+
+/// Start of the line holding `at`, when only whitespace precedes `at` on it;
+/// else `at` itself.
+fn line_start(text: &str, at: usize) -> usize {
+    let start = text[..at].rfind('\n').map_or(0, |i| i + 1);
+    if text[start..at].chars().all(|c| c == ' ' || c == '\t') {
+        start
+    } else {
+        at
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::collections::BTreeMap;
+
+    use super::super::{apply, detect, Shape};
+    use super::*;
+
+    const UUID: &str = "5e6f7081-92a3-4b4c-8d5e-6f708192a3b4";
+    const GSON_POM: &[u8] =
+        b"<project><parent><groupId>com.google.code.gson</groupId><artifactId>gson-parent</artifactId><version>2.10.1</version></parent></project>\n";
+
+    fn patch() -> JvmPatch<'static> {
+        JvmPatch {
+            group_id: "com.google.code.gson",
+            artifact_id: "gson",
+            version: "2.10.1",
+            uuid: UUID,
+            jar: b"PATCHED-JAR",
+            upstream_pom: b"<project></project>\n",
+            upstream_module: None,
+        }
+    }
+
+    fn fs(files: &[(&str, &str)]) -> BTreeMap<String, Vec<u8>> {
+        files
+            .iter()
+            .map(|(k, v)| (k.to_string(), v.as_bytes().to_vec()))
+            .collect()
+    }
+
+    fn run(files: &BTreeMap<String, Vec<u8>>, p: &JvmPatch<'_>) -> Result<JvmPlan, JvmRefusal> {
+        let read = |rel: &str| files.get(rel).cloned();
+        plan(&read, p)
+    }
+
+    /// Apply `plan` onto `files`, returning the new file map.
+    fn applied(files: &BTreeMap<String, Vec<u8>>, plan: &JvmPlan) -> BTreeMap<String, Vec<u8>> {
+        let mut out = files.clone();
+        for w in &plan.writes {
+            out.insert(w.rel.clone(), w.bytes.clone());
+        }
+        out
+    }
+
+    fn text_of<'a>(plan: &'a JvmPlan, rel: &str) -> &'a str {
+        let w = plan
+            .writes
+            .iter()
+            .find(|w| w.rel == rel)
+            .unwrap_or_else(|| panic!("no write for {rel}"));
+        std::str::from_utf8(&w.bytes).unwrap()
+    }
+
+    fn assert_idempotent(
+        files: &BTreeMap<String, Vec<u8>>,
+        p: &JvmPatch<'_>,
+    ) -> BTreeMap<String, Vec<u8>> {
+        let first = run(files, p).unwrap();
+        let after = applied(files, &first);
+        let again = run(&after, p).unwrap();
+        assert!(
+            again.writes.is_empty(),
+            "re-plan wrote {:?}",
+            again.writes.iter().map(|w| &w.rel).collect::<Vec<_>>()
+        );
+        after
+    }
+
+    fn reasons(plan: &JvmPlan) -> Vec<String> {
+        plan.warnings
+            .iter()
+            .map(|w| w.detail.split(':').nth(1).unwrap_or("").trim().to_string())
+            .collect()
+    }
+
+    #[test]
+    fn script_asset_is_sane() {
+        assert!(SCRIPT.starts_with("// Generated by socket-patch (vendored mode). Do not edit.\n"));
+        assert!(SCRIPT.contains(&format!("'{INDEX_HEADER}'")));
+        assert!(SCRIPT.contains(&format!("'{REPO_NAME}'")));
+        assert!(SCRIPT.contains(&format!("'{MARKER_NAME}'")));
+        assert!(SCRIPT.ends_with("}\n"));
+        assert!(!SCRIPT.contains('\t') && !SCRIPT.contains('\r'));
+        assert!(SCRIPT.lines().all(|l| l == l.trim_end()));
+        assert_eq!(SCRIPT.matches('{').count(), SCRIPT.matches('}').count());
+    }
+
+    #[test]
+    fn groovy_settings_gets_the_apply_line_and_the_tree() {
+        let files = fs(&[("settings.gradle", "rootProject.name = 'x'\ninclude 'app'\n")]);
+        let plan = run(&files, &patch()).unwrap();
+        assert_eq!(
+            text_of(&plan, "settings.gradle"),
+            "rootProject.name = 'x'\ninclude 'app'\napply from: '.socket/gradle/socket-patch.settings.gradle' // socket-patch\n"
+        );
+        let rels: Vec<(&str, bool)> = plan
+            .writes
+            .iter()
+            .map(|w| (w.rel.as_str(), w.tree))
+            .collect();
+        assert_eq!(
+            rels,
+            vec![
+                (".socket/gradle/socket-patch.settings.gradle", false),
+                (".socket/vendor/gradle-index.tsv", false),
+                (".socket/vendor/gradle/.gitattributes", false),
+                (".socket/vendor/gradle/com/google/code/gson/gson/2.10.1/gson-2.10.1.jar", true),
+                (".socket/vendor/gradle/com/google/code/gson/gson/2.10.1/gson-2.10.1.pom", true),
+                (".socket/vendor/gradle/com/google/code/gson/gson/2.10.1/socket-patch.vendor.json", true),
+                ("settings.gradle", false),
+            ]
+        );
+        assert_eq!(
+            plan.tree_dir,
+            ".socket/vendor/gradle/com/google/code/gson/gson/2.10.1"
+        );
+        assert_eq!(plan.jar_rel, format!("{}/gson-2.10.1.jar", plan.tree_dir));
+        assert_eq!(text_of(&plan, SCRIPT_REL), SCRIPT);
+        assert_eq!(
+            text_of(&plan, ".socket/vendor/gradle/.gitattributes"),
+            "* -text\n"
+        );
+        assert!(plan.warnings.is_empty(), "{:?}", plan.warnings);
+    }
+
+    #[test]
+    fn kotlin_settings_crlf_and_missing_newline_are_preserved() {
+        let files = fs(&[(
+            "settings.gradle.kts",
+            "rootProject.name = \"x\"\r\ninclude(\"app\")",
+        )]);
+        let plan = run(&files, &patch()).unwrap();
+        assert_eq!(
+            text_of(&plan, "settings.gradle.kts"),
+            "rootProject.name = \"x\"\r\ninclude(\"app\")\r\napply(from = \".socket/gradle/socket-patch.settings.gradle\") // socket-patch\r\n"
+        );
+        assert_idempotent(&files, &patch());
+    }
+
+    #[test]
+    fn tabs_comments_and_unrelated_content_are_untouched() {
+        let src = "// apply from: '.socket/gradle/socket-patch.settings.gradle'\n\tinclude 'a' /* x */\n\n";
+        let files = fs(&[("settings.gradle", src)]);
+        let plan = run(&files, &patch()).unwrap();
+        let out = text_of(&plan, "settings.gradle");
+        assert_eq!(out, format!("{src}{}\n", apply_line(false, "")));
+    }
+
+    #[test]
+    fn missing_settings_is_created_in_the_build_script_dsl() {
+        let files = fs(&[("build.gradle.kts", "plugins { java }\n")]);
+        let plan = run(&files, &patch()).unwrap();
+        assert_eq!(
+            text_of(&plan, "settings.gradle.kts"),
+            format!("{}\n", apply_line(true, ""))
+        );
+        let files = fs(&[("build.gradle", "apply plugin: 'java'\n")]);
+        let plan = run(&files, &patch()).unwrap();
+        assert_eq!(
+            text_of(&plan, "settings.gradle"),
+            format!("{}\n", apply_line(false, ""))
+        );
+        assert!(!plan.writes.iter().any(|w| w.rel == "settings.gradle.kts"));
+    }
+
+    #[test]
+    fn groovy_settings_wins_over_kotlin_like_gradle() {
+        let files = fs(&[("settings.gradle", "x\n"), ("settings.gradle.kts", "y\n")]);
+        let plan = run(&files, &patch()).unwrap();
+        assert!(plan.writes.iter().any(|w| w.rel == "settings.gradle"));
+        assert!(!plan.writes.iter().any(|w| w.rel == "settings.gradle.kts"));
+    }
+
+    #[test]
+    fn replan_is_idempotent_and_keeps_a_reformatted_line() {
+        let files = fs(&[
+            ("settings.gradle", "include 'a'\n"),
+            ("buildSrc/build.gradle", ""),
+        ]);
+        assert_idempotent(&files, &patch());
+        let files = fs(&[(
+            "settings.gradle",
+            "apply   from: '.socket/gradle/socket-patch.settings.gradle'\ninclude 'a'\n",
+        )]);
+        let plan = run(&files, &patch()).unwrap();
+        assert!(!plan.writes.iter().any(|w| w.rel == "settings.gradle"));
+    }
+
+    #[test]
+    fn buildsrc_is_wired_with_a_parent_prefix() {
+        let files = fs(&[
+            ("settings.gradle", ""),
+            ("buildSrc/build.gradle.kts", "plugins { `kotlin-dsl` }\n"),
+        ]);
+        let plan = run(&files, &patch()).unwrap();
+        assert_eq!(
+            text_of(&plan, "buildSrc/settings.gradle.kts"),
+            "apply(from = \"../.socket/gradle/socket-patch.settings.gradle\") // socket-patch\n"
+        );
+        let files = fs(&[
+            ("settings.gradle", ""),
+            ("buildSrc/settings.gradle", "rootProject.name = 'bs'"),
+        ]);
+        let plan = run(&files, &patch()).unwrap();
+        assert_eq!(
+            text_of(&plan, "buildSrc/settings.gradle"),
+            "rootProject.name = 'bs'\napply from: '../.socket/gradle/socket-patch.settings.gradle' // socket-patch\n"
+        );
+        let files = fs(&[("settings.gradle", "")]);
+        let plan = run(&files, &patch()).unwrap();
+        assert!(!plan.writes.iter().any(|w| w.rel.starts_with("buildSrc/")));
+    }
+
+    #[test]
+    fn literal_include_builds_are_wired_recursively() {
+        let files = fs(&[
+            (
+                "settings.gradle",
+                "pluginManagement {\n  includeBuild('build-logic')\n}\nincludeBuild \"tools/./gen/\"\n// includeBuild('commented')\n/* includeBuild('block') */\ndef s = \"includeBuild('in-string')\"\n",
+            ),
+            ("build-logic/settings.gradle.kts", "includeBuild(\"../nested\")\n"),
+            ("nested/build.gradle.kts", ""),
+            ("tools/gen/build.gradle", ""),
+        ]);
+        let plan = run(&files, &patch()).unwrap();
+        assert_eq!(
+            text_of(&plan, "build-logic/settings.gradle.kts"),
+            "includeBuild(\"../nested\")\napply(from = \"../.socket/gradle/socket-patch.settings.gradle\") // socket-patch\n"
+        );
+        assert_eq!(
+            text_of(&plan, "tools/gen/settings.gradle"),
+            "apply from: '../../.socket/gradle/socket-patch.settings.gradle' // socket-patch\n"
+        );
+        assert_eq!(
+            text_of(&plan, "nested/settings.gradle.kts"),
+            format!("{}\n", apply_line(true, "../"))
+        );
+        for bogus in ["commented", "block", "in-string"] {
+            assert!(
+                !plan.writes.iter().any(|w| w.rel.starts_with(bogus)),
+                "{bogus}"
+            );
+        }
+        assert!(plan.warnings.is_empty(), "{:?}", plan.warnings);
+        assert_idempotent(&files, &patch());
+    }
+
+    #[test]
+    fn non_literal_or_escaping_include_builds_warn() {
+        let files = fs(&[(
+            "settings.gradle.kts",
+            "includeBuild(file(\"x\"))\nincludeBuild(\"$dir/y\")\nincludeBuild(\"../outside\")\nincludeBuild(\"/abs\")\nincludeBuild(\".\")\n",
+        )]);
+        let plan = run(&files, &patch()).unwrap();
+        assert_eq!(reasons(&plan), vec!["unwired_build_logic"; 4]);
+        assert!(plan.warnings.iter().all(|w| w.code == "vendor_jvm_degraded"
+            && w.detail.starts_with("reason: unwired_build_logic: ")));
+        let wired: Vec<&str> = plan
+            .writes
+            .iter()
+            .filter(|w| !w.rel.starts_with(".socket") && w.rel.contains("settings.gradle"))
+            .map(|w| w.rel.as_str())
+            .collect();
+        assert_eq!(wired, vec!["settings.gradle.kts"]);
+    }
+
+    #[test]
+    fn resolve_dir_normalises() {
+        assert_eq!(resolve_dir("", "a/./b/"), Some("a/b".into()));
+        assert_eq!(resolve_dir("x", "../y"), Some("y".into()));
+        assert_eq!(resolve_dir("x", "../.."), None);
+        assert_eq!(resolve_dir("", "C:/y"), None);
+        assert_eq!(resolve_dir("", "a\\b"), None);
+        assert_eq!(resolve_dir("", "."), Some(String::new()));
+    }
+
+    #[test]
+    fn in_block_entry_goes_first_in_plugin_management_repositories() {
+        let src = "pluginManagement {\n  repositories {\n    gradlePluginPortal()\n  }\n}\nplugins {\n  id 'org.gradle.toolchains.foojay-resolver-convention' version '0.8.0'\n}\n";
+        let files = fs(&[("settings.gradle", src)]);
+        let plan = run(&files, &patch()).unwrap();
+        let expect = format!(
+            "pluginManagement {{\n  repositories {{\n    {}\n    gradlePluginPortal()\n  }}\n}}\nplugins {{\n  id 'org.gradle.toolchains.foojay-resolver-convention' version '0.8.0'\n}}\n{}\n",
+            in_block_line(false, "", &patch().coords()),
+            apply_line(false, "")
+        );
+        assert_eq!(text_of(&plan, "settings.gradle"), expect);
+        assert!(plan.warnings.is_empty());
+        assert_idempotent(&files, &patch());
+    }
+
+    #[test]
+    fn in_block_entry_on_a_one_line_repositories_block() {
+        let src = "pluginManagement {\r\n    repositories { gradlePluginPortal(); mavenCentral() }\r\n}\r\nplugins { id(\"x\") version \"1\" }\r\n";
+        let files = fs(&[("settings.gradle.kts", src)]);
+        let plan = run(&files, &patch()).unwrap();
+        let out = text_of(&plan, "settings.gradle.kts");
+        let entry = in_block_line(true, "", &patch().coords());
+        assert!(
+            out.starts_with(&format!(
+                "pluginManagement {{\r\n    repositories {{\r\n        {entry}\r\n        gradlePluginPortal(); mavenCentral() }}\r\n}}\r\n"
+            )),
+            "{out}"
+        );
+        assert!(entry.contains("includeVersion(\"com.google.code.gson\", \"gson\", \"2.10.1\")"));
+        assert_idempotent(&files, &patch());
+    }
+
+    #[test]
+    fn in_block_creates_plugin_management_after_imports() {
+        let src = "import java.io.File\n\nplugins {\n  id(\"x\") version \"1\"\n}\nrootProject.name = \"r\"\n";
+        let files = fs(&[("settings.gradle.kts", src)]);
+        let plan = run(&files, &patch()).unwrap();
+        let entry = in_block_line(true, "", &patch().coords());
+        let expect = format!(
+            "import java.io.File\n\npluginManagement {{\n  repositories {{\n    {entry}\n    gradlePluginPortal()\n  }}\n}}\nplugins {{\n  id(\"x\") version \"1\"\n}}\nrootProject.name = \"r\"\n{}\n",
+            apply_line(true, "")
+        );
+        assert_eq!(text_of(&plan, "settings.gradle.kts"), expect);
+        assert_idempotent(&files, &patch());
+    }
+
+    #[test]
+    fn in_block_adds_repositories_to_plugin_management_and_keeps_the_portal() {
+        let src =
+            "pluginManagement {\n    includeBuild('logic')\n}\nplugins { id 'a' version '1' }\n";
+        let files = fs(&[("settings.gradle", src), ("logic/settings.gradle", "")]);
+        let plan = run(&files, &patch()).unwrap();
+        let entry = in_block_line(false, "", &patch().coords());
+        assert!(text_of(&plan, "settings.gradle").starts_with(&format!(
+            "pluginManagement {{\n    repositories {{\n        {entry}\n        gradlePluginPortal()\n    }}\n    includeBuild('logic')\n}}\n"
+        )));
+        let src = "pluginManagement { repositories { } }\nplugins { id 'a' version '1' }\n";
+        let files = fs(&[("settings.gradle", src)]);
+        let out = run(&files, &patch()).unwrap();
+        assert!(text_of(&out, "settings.gradle").contains(&format!("{entry}\n")));
+        assert!(text_of(&out, "settings.gradle").contains("gradlePluginPortal()"));
+        assert_idempotent(&files, &patch());
+    }
+
+    #[test]
+    fn in_block_entry_in_an_included_build_uses_its_prefix() {
+        let files = fs(&[
+            ("settings.gradle", "includeBuild('a/b')\n"),
+            ("a/b/settings.gradle", "plugins { id 'p' version '1' }\n"),
+        ]);
+        let plan = run(&files, &patch()).unwrap();
+        assert!(text_of(&plan, "a/b/settings.gradle")
+            .contains("new File(settingsDir, '../../.socket/vendor/gradle')"));
+        assert!(!text_of(&plan, "settings.gradle").contains("pluginManagement"));
+    }
+
+    #[test]
+    fn project_level_or_commented_plugins_need_no_in_block_entry() {
+        let files = fs(&[(
+            "settings.gradle",
+            "// plugins { id 'x' }\ndef s = 'plugins {'\ngradle.beforeProject { plugins { } }\n",
+        )]);
+        let plan = run(&files, &patch()).unwrap();
+        assert!(!text_of(&plan, "settings.gradle").contains("exclusiveContent"));
+    }
+
+    #[test]
+    fn non_literal_plugin_management_repositories_warn() {
+        let files = fs(&[("settings.gradle", "pluginManagement { repositories.gradlePluginPortal() }\nplugins { id 'a' version '1' }\n")]);
+        let plan = run(&files, &patch()).unwrap();
+        assert_eq!(reasons(&plan), vec!["settings_plugins_unwired"]);
+        assert!(
+            text_of(&plan, "settings.gradle").ends_with(&format!("{}\n", apply_line(false, "")))
+        );
+    }
+
+    #[test]
+    fn index_rows_merge_sorted_and_replace_the_same_gav() {
+        let other = format!("org.a:b:1\torg/a/b/1/b-1.jar\t{}\tu1", "a".repeat(64));
+        let stale = format!("com.google.code.gson:gson:2.10.1\tcom/google/code/gson/gson/2.10.1/gson-2.10.1.jar\t{}\told", "b".repeat(64));
+        let existing = format!("{INDEX_HEADER}\r\n{stale}\r\n\r\n{other}\r\n");
+        let files = fs(&[("settings.gradle", ""), (INDEX_REL, &existing)]);
+        let plan = run(&files, &patch()).unwrap();
+        let idx = text_of(&plan, INDEX_REL);
+        let lines: Vec<&str> = idx.lines().collect();
+        assert_eq!(lines[0], INDEX_HEADER);
+        assert_eq!(lines.len(), 4);
+        assert!(lines[1].starts_with(
+            "com.google.code.gson:gson:2.10.1\tcom/google/code/gson/gson/2.10.1/gson-2.10.1.jar\t"
+        ));
+        assert!(lines[1].ends_with(&format!("\t{UUID}")));
+        assert!(lines[1].contains(&sha256_hex(b"PATCHED-JAR")));
+        assert!(lines[2].contains("gson-2.10.1.pom"));
+        assert_eq!(lines[3], other);
+        assert!(!idx.contains('\r') && idx.ends_with('\n'));
+        assert!(!idx.contains("\told"));
+    }
+
+    #[test]
+    fn index_rows_include_the_module() {
+        let p = JvmPatch {
+            upstream_pom: b"<!-- do_not_remove: published-with-gradle-metadata -->",
+            upstream_module: Some(b"{\"formatVersion\":\"1.1\"}"),
+            ..patch()
+        };
+        let files = fs(&[("settings.gradle", "")]);
+        let plan = run(&files, &p).unwrap();
+        let idx = text_of(&plan, INDEX_REL);
+        assert_eq!(idx.lines().count(), 4);
+        assert!(idx.contains("gson-2.10.1.module"));
+        assert!(plan
+            .writes
+            .iter()
+            .any(|w| w.rel.ends_with("gson-2.10.1.module")
+                && w.tree
+                && w.bytes == b"{\"formatVersion\":\"1.1\"}"));
+    }
+
+    #[test]
+    fn malformed_indexes_are_refused() {
+        let sha = "c".repeat(64);
+        for bad in [
+            "garbage\n".to_string(),
+            format!("{INDEX_HEADER}\nonly\ttwo\n"),
+            format!("{INDEX_HEADER}\ng:a:1+\tg/a/1+/a-1+.jar\t{sha}\tu\n"),
+            format!("{INDEX_HEADER}\ng:a:1\tg/a/2/a-1.jar\t{sha}\tu\n"),
+            format!("{INDEX_HEADER}\ng:a:1\tg/a/1/../a-1.jar\t{sha}\tu\n"),
+            format!(
+                "{INDEX_HEADER}\ng:a:1\tg/a/1/a-1.jar\t{}\tu\n",
+                "C".repeat(64)
+            ),
+            format!("{INDEX_HEADER}\ng:a:1\tg/a/1/a-1.jar\t{sha}\t\n"),
+        ] {
+            let files = fs(&[("settings.gradle", ""), (INDEX_REL, &bad)]);
+            let err = run(&files, &patch()).unwrap_err();
+            assert_eq!(err.code, "vendor_jvm_shape_unsupported", "{bad}");
+            assert!(
+                err.detail.starts_with("reason: build_file_unreadable: "),
+                "{bad}"
+            );
+        }
+    }
+
+    #[test]
+    fn marker_is_sorted_pretty_json() {
+        let files = fs(&[("settings.gradle", "")]);
+        let plan = run(&files, &patch()).unwrap();
+        let rel = format!("{}/{MARKER_NAME}", plan.tree_dir);
+        let text = text_of(&plan, &rel);
+        let v: serde_json::Value = serde_json::from_str(text).unwrap();
+        assert_eq!(v["schema"], 1);
+        assert_eq!(v["tool"], "gradle");
+        assert_eq!(v["uuid"], UUID);
+        assert_eq!(v["purl"], "pkg:maven/com.google.code.gson/gson@2.10.1");
+        assert_eq!(v["version"], "2.10.1");
+        assert_eq!(v["files"]["gson-2.10.1.jar"]["size"], 11);
+        assert_eq!(
+            v["files"]["gson-2.10.1.jar"]["sha256"],
+            sha256_hex(b"PATCHED-JAR")
+        );
+        let keys: Vec<&String> = v.as_object().unwrap().keys().collect();
+        let mut sorted = keys.clone();
+        sorted.sort();
+        assert_eq!(keys, sorted);
+        assert_eq!(serde_json::to_string_pretty(&v).unwrap() + "\n", text);
+    }
+
+    #[test]
+    fn unsafe_coordinates_are_refused() {
+        let files = fs(&[("settings.gradle", "")]);
+        for (g, a, v) in [
+            ("com.google", "gson", "2.+"),
+            ("com.google", "gson", "latest.release"),
+            ("com.google", "gson", "[1,2)"),
+            ("com.google", "gson", "1 2"),
+            ("com.google", "gson", "1\t2"),
+            ("com.google", "gson", "1:2"),
+            ("com.google", "gson", ".."),
+            ("com.google", "..", "1"),
+            ("com..google", "gson", "1"),
+            (".com", "gson", "1"),
+            ("com/google", "gson", "1"),
+            ("com.google", "gs$on", "1"),
+            ("", "gson", "1"),
+        ] {
+            let p = JvmPatch {
+                group_id: g,
+                artifact_id: a,
+                version: v,
+                ..patch()
+            };
+            assert_eq!(
+                run(&files, &p).unwrap_err().code,
+                "unsafe_coordinates",
+                "{g}:{a}:{v}"
+            );
+        }
+        assert!(safe_coordinates(
+            "org.apache_x-y",
+            "commons.text-2",
+            "1.0.0-rc_1+build.2"
+        ));
+        let p = JvmPatch {
+            uuid: "a\tb",
+            ..patch()
+        };
+        assert_eq!(run(&files, &p).unwrap_err().code, "unsafe_coordinates");
+    }
+
+    #[test]
+    fn module_less_gradle_published_pom_is_refused() {
+        let files = fs(&[("settings.gradle", "")]);
+        let p = JvmPatch {
+            upstream_pom: b"<!-- do_not_remove: published-with-gradle-metadata -->",
+            ..patch()
+        };
+        let err = run(&files, &p).unwrap_err();
+        assert_eq!(err.code, "vendor_jvm_upstream_unavailable");
+        assert!(err.detail.starts_with("reason: module_unavailable: "));
+        let p = JvmPatch {
+            upstream_module: Some(b"{\"variants\":[{\"available-at\":{}}]}"),
+            ..patch()
+        };
+        assert!(run(&files, &p)
+            .unwrap_err()
+            .detail
+            .starts_with("reason: android_or_kmp: "));
+    }
+
+    #[test]
+    fn android_and_kmp_are_refused() {
+        for (rel, src) in [
+            ("build.gradle", "plugins { id 'com.android.application' version '8.0.0' apply false }"),
+            ("build.gradle.kts", "buildscript { dependencies { classpath(\"com.android.tools.build:gradle:8.0.0\") } }"),
+            ("settings.gradle.kts", "plugins { kotlin(\"multiplatform\") version \"2.0.0\" apply false }"),
+            ("settings.gradle", "plugins { id 'org.jetbrains.kotlin.multiplatform' version '2.0.0' }"),
+        ] {
+            let files = fs(&[(rel, src)]);
+            let err = run(&files, &patch()).unwrap_err();
+            assert_eq!(err.code, "vendor_jvm_shape_unsupported", "{rel}");
+            assert!(err.detail.starts_with("reason: android_or_kmp: "), "{}", err.detail);
+        }
+        let files = fs(&[(
+            "build.gradle",
+            "// id 'com.android.application'\nplugins { id 'java' }\n",
+        )]);
+        assert!(run(&files, &patch()).is_ok());
+    }
+
+    #[test]
+    fn user_exclusive_content_for_the_group_is_refused() {
+        let files = fs(&[(
+            "build.gradle",
+            "repositories { exclusiveContent { forRepository { mavenCentral() }\n filter { includeGroup \"com.google.code.gson\" } } }",
+        )]);
+        let err = run(&files, &patch()).unwrap_err();
+        assert!(
+            err.detail
+                .starts_with("reason: gradle_exclusive_content_conflict: "),
+            "{}",
+            err.detail
+        );
+        let files = fs(&[(
+            "settings.gradle",
+            "dependencyResolutionManagement { repositories { exclusiveContent { forRepository { maven { url 'x' } }; filter { includeGroup 'org.other' } } } }",
+        )]);
+        assert!(run(&files, &patch()).is_ok());
+    }
+
+    #[test]
+    fn settings_buildscript_classpath_on_the_ga_is_wired() {
+        for src in [
+            "buildscript { dependencies { classpath 'com.google.code.gson:gson:2.10.1' } }",
+            "buildscript { dependencies { classpath(group = \"com.google.code.gson\", name = \"gson\", version = \"2.10.1\") } }",
+        ] {
+            let files = fs(&[("settings.gradle", src)]);
+            let plan = run(&files, &patch()).unwrap();
+            assert!(text_of(&plan, "settings.gradle").contains("exclusiveContent"));
+            assert_idempotent(&files, &patch());
+        }
+        let files = fs(&[(
+            "settings.gradle",
+            "buildscript { dependencies { classpath 'org.x:y:1' } }",
+        )]);
+        assert!(run(&files, &patch()).is_ok());
+    }
+
+    const VM_HEAD: &str = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<verification-metadata xmlns=\"https://schema.gradle.org/dependency-verification\">\n   <configuration>\n      <verify-metadata>true</verify-metadata>\n      <verify-signatures>false</verify-signatures>\n      <trusted-artifacts>\n         <trust group=\"com.google.code.gson\"/>\n      </trusted-artifacts>\n   </configuration>\n   <components>\n";
+    const VM_TAIL: &str = "   </components>\n</verification-metadata>\n";
+
+    fn vm_component(g: &str, a: &str, v: &str, arts: &[(&str, &str)]) -> String {
+        let mut s = format!("      <component group=\"{g}\" name=\"{a}\" version=\"{v}\">\n");
+        for (n, sha) in arts {
+            s.push_str(&format!("         <artifact name=\"{n}\">\n            <sha256 value=\"{sha}\" origin=\"Generated by Gradle\"/>\n         </artifact>\n"));
+        }
+        s.push_str("      </component>\n");
+        s
+    }
+
+    #[test]
+    fn verification_jar_entry_is_replaced_in_canonical_form() {
+        let before = format!(
+            "{VM_HEAD}{}{}{}{VM_TAIL}",
+            vm_component("com.google.code.gson", "gson", "2.10.1", &[("gson-2.10.1.jar", "old"), ("gson-2.10.1.pom", "pomsha")]),
+            "      <!-- <component group=\"com.google.code.gson\" name=\"gson\" version=\"2.10.1\"> -->\n",
+            vm_component("org.z", "z", "1", &[("z-1.jar", "zsha")]),
+        );
+        let files = fs(&[("settings.gradle", ""), (VERIFICATION_REL, &before)]);
+        let p = JvmPatch {
+            upstream_pom: GSON_POM,
+            ..patch()
+        };
+        let plan = run(&files, &p).unwrap();
+        let after = text_of(&plan, VERIFICATION_REL);
+        let expect = before.replace(
+            "         <artifact name=\"gson-2.10.1.jar\">\n            <sha256 value=\"old\" origin=\"Generated by Gradle\"/>\n         </artifact>",
+            &format!(
+                "         <artifact name=\"gson-2.10.1.jar\">\n            <sha256 value=\"{}\" origin=\"socket-patch\"/>\n         </artifact>",
+                sha256_hex(b"PATCHED-JAR")
+            ),
+        );
+        assert_ne!(expect, before);
+        assert_eq!(after, expect);
+        assert!(after.contains("<trust group=\"com.google.code.gson\"/>"));
+        assert_eq!(reasons(&plan), vec!["verification_parent_chain_unhandled"]);
+        assert_idempotent(&files, &p);
+    }
+
+    #[test]
+    fn parent_chain_warning_only_when_the_file_may_lack_entries() {
+        let listed = vm_component(
+            "com.google.code.gson",
+            "gson-parent",
+            "2.10.1",
+            &[("gson-parent-2.10.1.pom", "x")],
+        );
+        let vm = format!("{VM_HEAD}{listed}{VM_TAIL}");
+        assert!(!unverified_parent_chain(
+            &vm,
+            std::str::from_utf8(GSON_POM).unwrap(),
+            None
+        ));
+        let bare = format!("{VM_HEAD}{VM_TAIL}");
+        assert!(unverified_parent_chain(
+            &bare,
+            std::str::from_utf8(GSON_POM).unwrap(),
+            None
+        ));
+        let off = bare.replace("<verify-metadata>true", "<verify-metadata>false");
+        assert!(!unverified_parent_chain(
+            &off,
+            std::str::from_utf8(GSON_POM).unwrap(),
+            None
+        ));
+        assert!(unverified_parent_chain(&vm, "<project><parent><groupId>g</groupId><artifactId>p</artifactId><version>${v}</version></parent></project>", None));
+        assert!(unverified_parent_chain(
+            &vm,
+            "<project><dependency><scope>import</scope></dependency></project>",
+            None
+        ));
+        assert!(unverified_parent_chain(
+            &vm,
+            "<project/>",
+            Some(b"{\"attributes\":{\"org.gradle.category\":\"platform\"}}")
+        ));
+        assert!(!unverified_parent_chain(
+            &vm,
+            "<project><!-- <parent></parent> --></project>",
+            None
+        ));
+    }
+
+    #[test]
+    fn verification_component_is_inserted_sorted() {
+        let before = format!(
+            "{VM_HEAD}{}{}{VM_TAIL}",
+            vm_component("com.a", "a", "1", &[("a-1.jar", "x")]),
+            vm_component("org.z", "z", "1", &[("z-1.jar", "zsha")]),
+        )
+        .replace('\n', "\r\n");
+        let p = JvmPatch {
+            upstream_pom: b"<!-- do_not_remove: published-with-gradle-metadata -->",
+            upstream_module: Some(b"{}"),
+            ..patch()
+        };
+        let files = fs(&[("settings.gradle", ""), (VERIFICATION_REL, &before)]);
+        let plan = run(&files, &p).unwrap();
+        let after = text_of(&plan, VERIFICATION_REL);
+        let comp = vm_component(
+            "com.google.code.gson",
+            "gson",
+            "2.10.1",
+            &[
+                ("gson-2.10.1.jar", &sha256_hex(b"PATCHED-JAR")),
+                ("gson-2.10.1.module", &sha256_hex(b"{}")),
+                ("gson-2.10.1.pom", &sha256_hex(p.upstream_pom)),
+            ],
+        )
+        .replace("Generated by Gradle", "socket-patch")
+        .replace('\n', "\r\n");
+        let at = before.find("      <component group=\"org.z\"").unwrap();
+        assert_eq!(after, format!("{}{comp}{}", &before[..at], &before[at..]));
+        assert!(plan.warnings.is_empty(), "{:?}", plan.warnings);
+        assert_idempotent(&files, &p);
+    }
+
+    #[test]
+    fn verification_component_appended_last_or_into_empty_components() {
+        let before = format!(
+            "{VM_HEAD}{}{VM_TAIL}",
+            vm_component("com.a", "a", "1", &[("a-1.jar", "x")])
+        );
+        let files = fs(&[("settings.gradle", ""), (VERIFICATION_REL, &before)]);
+        let after = assert_idempotent(&files, &patch());
+        let text = String::from_utf8(after[VERIFICATION_REL].clone()).unwrap();
+        assert!(text.contains("      </component>\n      <component group=\"com.google.code.gson\" name=\"gson\" version=\"2.10.1\">\n         <artifact name=\"gson-2.10.1.jar\">\n"));
+        assert!(text.ends_with("      </component>\n   </components>\n</verification-metadata>\n"));
+
+        let before = "<verification-metadata>\n   <components/>\n</verification-metadata>\n";
+        let files = fs(&[("settings.gradle", ""), (VERIFICATION_REL, before)]);
+        let after = assert_idempotent(&files, &patch());
+        let text = String::from_utf8(after[VERIFICATION_REL].clone()).unwrap();
+        assert!(text.starts_with("<verification-metadata>\n   <components>\n      <component group=\"com.google.code.gson\""));
+        assert!(text.ends_with("      </component>\n   </components>\n</verification-metadata>\n"));
+    }
+
+    #[test]
+    fn verification_jar_entry_added_to_a_component_without_one() {
+        let before = format!(
+            "{VM_HEAD}{}{VM_TAIL}",
+            vm_component(
+                "com.google.code.gson",
+                "gson",
+                "2.10.1",
+                &[("gson-2.10.1.pom", "p")]
+            )
+        );
+        let files = fs(&[("settings.gradle", ""), (VERIFICATION_REL, &before)]);
+        let after = assert_idempotent(&files, &patch());
+        let text = String::from_utf8(after[VERIFICATION_REL].clone()).unwrap();
+        let jar = text.find("gson-2.10.1.jar").unwrap();
+        assert!(jar < text.find("gson-2.10.1.pom").unwrap());
+        assert!(text
+            .contains("         <artifact name=\"gson-2.10.1.jar\">\n            <sha256 value="));
+    }
+
+    #[test]
+    fn unparseable_verification_is_refused() {
+        for bad in ["<verification-metadata/>", "<verification-metadata><components><component name=\"x\"></component></components></verification-metadata>"] {
+            let files = fs(&[("settings.gradle", ""), (VERIFICATION_REL, bad)]);
+            let err = run(&files, &patch()).unwrap_err();
+            assert!(err.detail.starts_with("reason: gradle_verification_unparseable: "), "{}", err.detail);
+        }
+    }
+
+    #[test]
+    fn no_verification_file_is_created() {
+        let files = fs(&[("settings.gradle", "")]);
+        let plan = run(&files, &patch()).unwrap();
+        assert!(!plan.writes.iter().any(|w| w.rel == VERIFICATION_REL));
+    }
+
+    #[test]
+    fn detect_routes_gradle_only_roots_here() {
+        let files = fs(&[("build.gradle", "")]);
+        let read = |rel: &str| files.get(rel).cloned();
+        assert_eq!(detect(&read), Shape::Gradle);
+    }
+
+    #[test]
+    fn lexer_handles_strings_comments_and_escapes() {
+        let toks = lex("a '''x\n'y''' \"\\\"q\" /* } */ 'it\\'s' \"${b}\" // }\n{");
+        let kinds: Vec<Tok> = toks.into_iter().map(|t| t.tok).collect();
+        assert_eq!(
+            kinds,
+            vec![
+                Tok::Ident("a".into()),
+                Tok::Str {
+                    value: "x\n'y".into(),
+                    literal: true
+                },
+                Tok::Str {
+                    value: "\"q".into(),
+                    literal: true
+                },
+                Tok::Str {
+                    value: "it's".into(),
+                    literal: true
+                },
+                Tok::Str {
+                    value: "${b}".into(),
+                    literal: false
+                },
+                Tok::Punct(b'{'),
+            ]
+        );
+    }
+
+    #[tokio::test]
+    async fn written_plan_reverts_byte_exact() {
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path();
+        std::fs::write(root.join("settings.gradle"), "rootProject.name = 'x'\r\n").unwrap();
+        let read = |rel: &str| apply::read_project_file(root, rel);
+        let p = plan(&read, &patch()).unwrap();
+        let records = apply::write_plan(root, &p).await.unwrap();
+        assert!(root.join(&p.jar_rel).is_file());
+        let again = plan(&read, &patch()).unwrap();
+        assert!(again.writes.is_empty());
+        let entry = super::super::testing::entry(&patch(), records);
+        let out = apply::revert(root, &entry, crate::vendor::RevertOpts::new(false)).await;
+        assert!(out.success && out.warnings.is_empty(), "{:?}", out);
+        assert_eq!(
+            std::fs::read(root.join("settings.gradle")).unwrap(),
+            b"rootProject.name = 'x'\r\n"
+        );
+        assert!(!root.join(".socket").exists());
+    }
+
+    // ── revert, peers and patch updates (disk round-trips) ──
+
+    use super::super::testing;
+
+    const UUID_B: &str = "abcdef01-92a3-4b4c-8d5e-6f708192a3b4";
+
+    fn patch_b() -> JvmPatch<'static> {
+        JvmPatch {
+            group_id: "org.example",
+            artifact_id: "lib",
+            version: "2.0",
+            uuid: UUID_B,
+            jar: b"B-JAR",
+            upstream_pom: b"<project></project>\n",
+            upstream_module: None,
+        }
+    }
+
+    fn replan_writes(root: &std::path::Path, p: &JvmPatch<'_>) -> Vec<String> {
+        let reader = apply::ProjectReader::new(root);
+        plan(&|rel: &str| reader.read(rel), p)
+            .unwrap()
+            .writes
+            .into_iter()
+            .map(|w| w.rel)
+            .collect()
+    }
+
+    /// Reverting either of two patches leaves the other fully wired (apply
+    /// line, script, index rows, in-block shell, `.gitattributes`: a re-plan
+    /// writes nothing), and reverting both restores every byte and
+    /// directory — for plain, settings-`plugins{}`, one-line
+    /// `pluginManagement` and verification-file shapes.
+    #[tokio::test]
+    async fn two_patches_revert_in_either_order_byte_exact() {
+        let vm = format!(
+            "{VM_HEAD}{}{}{VM_TAIL}",
+            vm_component(
+                "com.google.code.gson",
+                "gson",
+                "2.10.1",
+                &[("gson-2.10.1.jar", "old"), ("gson-2.10.1.pom", "p")]
+            ),
+            vm_component("org.z", "z", "1", &[("z-1.jar", "zsha")]),
+        );
+        let shapes: Vec<Vec<(&str, String)>> = vec![
+            vec![("settings.gradle", "rootProject.name = 'x'\r\n".to_string())],
+            vec![(
+                "settings.gradle.kts",
+                "import java.io.File\n\nplugins {\n    id(\"org.gradle.toolchains.foojay-resolver-convention\") version \"0.8.0\"\n}\nrootProject.name = \"x\"".to_string(),
+            )],
+            vec![(
+                "settings.gradle",
+                "pluginManagement { repositories { mavenCentral() } }\nplugins { id 'x' version '1' }\n".to_string(),
+            )],
+            vec![
+                ("settings.gradle", "plugins {\n\tid 'x' version '1'\n}\n".to_string()),
+                (VERIFICATION_REL, vm.clone()),
+                ("buildSrc/build.gradle.kts", String::new()),
+            ],
+        ];
+        for files in &shapes {
+            for first_a in [true, false] {
+                let dir = tempfile::tempdir().unwrap();
+                let root = dir.path();
+                let borrowed: Vec<(&str, &str)> =
+                    files.iter().map(|(r, b)| (*r, b.as_str())).collect();
+                testing::populate(root, &borrowed);
+                let (pristine, pristine_dirs) = (testing::snapshot(root), testing::dirs(root));
+                let mut ledger = BTreeMap::new();
+                let (pa, pb) = (patch(), patch_b());
+                let plan_a = testing::vendor(root, Shape::Gradle, &pa, &mut ledger)
+                    .await
+                    .unwrap();
+                let plan_b = testing::vendor(root, Shape::Gradle, &pb, &mut ledger)
+                    .await
+                    .unwrap();
+                let (first, second, second_plan) = if first_a {
+                    (&pa, &pb, &plan_b)
+                } else {
+                    (&pb, &pa, &plan_a)
+                };
+                let out = testing::revert(root, first, &mut ledger).await;
+                assert!(
+                    out.success && out.warnings.is_empty() && !out.kept_artifact,
+                    "{out:?}"
+                );
+                assert!(
+                    replan_writes(root, second).is_empty(),
+                    "{files:?} first_a={first_a}: the remaining patch lost wiring: {:?}",
+                    replan_writes(root, second)
+                );
+                assert!(root.join(&second_plan.jar_rel).is_file());
+                let index = std::fs::read_to_string(root.join(INDEX_REL)).unwrap();
+                assert!(!index.contains(first.uuid), "{index}");
+                let out = testing::revert(root, second, &mut ledger).await;
+                assert!(out.success && out.warnings.is_empty(), "{out:?}");
+                assert_eq!(
+                    testing::snapshot(root),
+                    pristine,
+                    "{files:?} first_a={first_a}"
+                );
+                assert_eq!(
+                    testing::dirs(root),
+                    pristine_dirs,
+                    "{files:?} first_a={first_a}"
+                );
+            }
+        }
+    }
+
+    /// A patch update (same GAV, new uuid) rewrites the tree in place, the
+    /// index rows and the verification hash, keeps the wiring (the in-block
+    /// shell and the user's verification element carried from the earlier
+    /// entry), and reverts to pristine.
+    #[tokio::test]
+    async fn patch_update_keeps_the_wiring_and_reverts_pristine() {
+        let vm = format!(
+            "{VM_HEAD}{}{VM_TAIL}",
+            vm_component(
+                "com.google.code.gson",
+                "gson",
+                "2.10.1",
+                &[("gson-2.10.1.jar", "old")]
+            ),
+        );
+        let shapes: [&[(&str, &str)]; 3] = [
+            &[("settings.gradle", "rootProject.name = 'x'\n")],
+            &[("settings.gradle", "plugins {\n  id 'x' version '1'\n}\n")],
+            &[("settings.gradle", ""), (VERIFICATION_REL, &vm)],
+        ];
+        for files in shapes {
+            let dir = tempfile::tempdir().unwrap();
+            let root = dir.path();
+            testing::populate(root, files);
+            let pristine = testing::snapshot(root);
+            let mut ledger = BTreeMap::new();
+            testing::vendor(root, Shape::Gradle, &patch(), &mut ledger)
+                .await
+                .unwrap();
+            let p2 = JvmPatch {
+                uuid: UUID_B,
+                jar: b"PATCHED-JAR-2",
+                ..patch()
+            };
+            let plan2 = testing::vendor(root, Shape::Gradle, &p2, &mut ledger)
+                .await
+                .unwrap();
+            assert_eq!(
+                std::fs::read(root.join(&plan2.jar_rel)).unwrap(),
+                b"PATCHED-JAR-2"
+            );
+            let index = std::fs::read_to_string(root.join(INDEX_REL)).unwrap();
+            assert!(index.contains(UUID_B) && !index.contains(UUID), "{index}");
+            assert!(replan_writes(root, &p2).is_empty());
+            let out = testing::revert(root, &p2, &mut ledger).await;
+            assert!(out.success && out.warnings.is_empty(), "{files:?}: {out:?}");
+            assert_eq!(testing::snapshot(root), pristine, "{files:?}");
+            assert!(!root.join(".socket").exists());
+        }
+    }
+
+    #[test]
+    fn an_apply_line_inside_a_comment_does_not_count() {
+        let line = apply_line(false, "");
+        for commented in [
+            format!("rootProject.name = 'x'\n/*\n{line}\n*/\n"),
+            format!("// {line}\n"),
+            format!("def s = \"{}\"\n", line.replace('\'', "\\'")),
+        ] {
+            let files = fs(&[("settings.gradle", &commented)]);
+            let plan = run(&files, &patch()).unwrap();
+            assert!(
+                text_of(&plan, "settings.gradle").ends_with(&format!("{line}\n")),
+                "{commented}"
+            );
+        }
+        for live in [
+            "apply from: '.socket/gradle/socket-patch.settings.gradle'\n",
+            "apply(from = \".socket/gradle/socket-patch.settings.gradle\")\n",
+            "apply   from :  \".socket/gradle/socket-patch.settings.gradle\" // mine\n",
+        ] {
+            assert!(has_apply_line(live, ""), "{live}");
+        }
+        assert!(!has_apply_line(
+            "apply from: '../.socket/gradle/socket-patch.settings.gradle'\n",
+            ""
+        ));
+    }
+
+    #[tokio::test]
+    async fn an_included_build_without_build_files_is_warned_not_created() {
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path();
+        testing::populate(root, &[("settings.gradle", "includeBuild('missing')\n")]);
+        let mut ledger = BTreeMap::new();
+        let plan = testing::vendor(root, Shape::Gradle, &patch(), &mut ledger)
+            .await
+            .unwrap();
+        assert_eq!(reasons(&plan), ["unwired_build_logic"]);
+        assert!(!root.join("missing").exists());
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn an_included_build_symlinked_outside_the_checkout_is_reported() {
+        let dir = tempfile::tempdir().unwrap();
+        let outside = tempfile::tempdir().unwrap();
+        testing::populate(
+            dir.path(),
+            &[("settings.gradle", "includeBuild('build-logic')\n")],
+        );
+        testing::populate(
+            outside.path(),
+            &[("settings.gradle", "rootProject.name = 'bl'\n")],
+        );
+        std::os::unix::fs::symlink(outside.path(), dir.path().join("build-logic")).unwrap();
+        let reader = apply::ProjectReader::new(dir.path());
+        let _ = plan(&|rel: &str| reader.read(rel), &patch());
+        assert_eq!(reader.escaped().as_deref(), Some("build-logic"));
+    }
+
+    #[test]
+    fn unplan_preserves_a_modified_shared_script() {
+        let files = fs(&[("settings.gradle", "")]);
+        let p = patch();
+        let plan = run(&files, &p).unwrap();
+        let mut after = applied(&files, &plan);
+        after
+            .get_mut(SCRIPT_REL)
+            .unwrap()
+            .extend_from_slice(b"// user edit\n");
+        let undo = unplan(&|rel| after.get(rel).cloned(), &p.coords(), &plan.records);
+        assert!(!undo.changes.iter().any(|(rel, _)| rel == SCRIPT_REL));
+        assert!(undo.drifted.iter().any(|d| d.contains(SCRIPT_REL)));
+    }
+
+    #[test]
+    fn unplan_leaves_a_malformed_index_and_keeps_the_tree() {
+        let files = fs(&[
+            ("settings.gradle", ""),
+            (INDEX_REL, "#socket-patch-gradle-index 1\nnot a row\n"),
+        ]);
+        let read = |rel: &str| files.get(rel).cloned();
+        let undo = unplan(&read, &patch().coords(), &[]);
+        assert!(undo.still_wired && !undo.drifted.is_empty());
+        assert!(undo.changes.is_empty(), "{:?}", undo.changes);
+    }
+}
diff --git a/crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs b/crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs
new file mode 100644
index 00000000..8bc21ecd
--- /dev/null
+++ b/crates/socket-patch-core/src/vendor/jvm/maven_reactor.rs
@@ -0,0 +1,3949 @@
+//! Multi-module Maven reactor planner. See the module doc of
+//! [`super`] and `docs/design/maven-vendoring.md` (the v5 behavior: 2-line `maven.config`, a fallback repository and a pin per local
+//! root, declaration rewrites; no build-time checksum pins).
+//!
+//! Every pom is edited by splicing at byte offsets found on a masked copy
+//! (comments, CDATA and processing instructions blanked), so line endings,
+//! tabs, comments and unrelated content survive untouched.
+
+use std::collections::{BTreeMap, BTreeSet};
+use std::ops::Range;
+
+use serde_json::{json, Value};
+
+use super::super::state::{WiringAction, WiringRecord};
+use super::{
+    adopt, changes_between, finish_writes, fragment, op_of, op_str, owned_file, replace_op,
+    safe_coordinates, sha1_hex, sha256_hex, undo_replace, Coords, FileWrite, JvmPatch, JvmPlan,
+    JvmRefusal, JvmUnplan, JvmWarning, ReadFn, CONFIG_LINE_KIND, OWNED_FILE_KIND,
+    POM_FRAGMENT_KIND, TREE_GITATTRIBUTES,
+};
+
+/// The committed maven2 tree.
+pub const TREE_ROOT: &str = ".socket/vendor/maven2";
+pub const MAVEN_CONFIG: &str = ".mvn/maven.config";
+/// The tree root's `.gitattributes`, shared by every Maven patch.
+pub const GITATTRIBUTES_REL: &str = ".socket/vendor/maven2/.gitattributes";
+const OFFLINE_LINE: &str = "-Daether.offline.protocols=file";
+const OFFLINE_KEY: &str = "-Daether.offline.protocols=";
+const TAIL_KEY: &str = "-Dmaven.repo.local.tail=";
+const TAIL_DIR: &str = "${session.rootDirectory}/.socket/vendor/maven2";
+pub const REPO_ID: &str = "socket-patch-vendor";
+pub const REPO_URL: &str = "file://${maven.multiModuleProjectDirectory}/.socket/vendor/maven2";
+const BEGIN_MARKER: &str = "<!-- socket-patch:begin -->";
+const END_MARKER: &str = "<!-- socket-patch:end -->";
+/// Prefix of the comment tagging a pin: `<!-- socket-patch <uuid>: g:a:v -->`.
+const PIN_TAG: &str = "<!-- socket-patch ";
+pub const MARKER_FILE: &str = "socket-patch.vendor.json";
+/// Files whose presence makes a module directory a Maven root of its own,
+/// which would move `${maven.multiModuleProjectDirectory}` under `cd module`.
+const NESTED_MVN_FILES: &[&str] = &[
+    "maven.config",
+    "extensions.xml",
+    "jvm.config",
+    "wrapper/maven-wrapper.properties",
+];
+const SHAPE_UNSUPPORTED: &str = "vendor_jvm_shape_unsupported";
+const UPSTREAM_UNAVAILABLE: &str = "vendor_jvm_upstream_unavailable";
+const DEGRADED: &str = "vendor_jvm_degraded";
+/// Property interpolation depth cap (Maven itself fails on cycles).
+const MAX_INTERPOLATION_DEPTH: usize = 16;
+
+/// Whether the pom declares a `<modules>` or `<subprojects>` of the project
+/// or of a profile (plugin configuration, comments and CDATA do not count).
+pub fn declares_modules(pom: &str) -> bool {
+    match Doc::parse(pom.to_string()) {
+        Ok(doc) => doc.nodes.iter().any(|n| {
+            matches!(n.name.as_str(), "modules" | "subprojects")
+                && n.parent.is_some_and(|p| doc.is_model_root(p))
+        }),
+        // An unparseable pom: the masked scan decides, and the reactor
+        // planner then refuses it as unreadable.
+        Err(_) => {
+            let (masked, _) = mask(pom);
+            has_open_tag(&masked, "modules") || has_open_tag(&masked, "subprojects")
+        }
+    }
+}
+
+/// The tree directory of `c`'s suffixed version.
+pub fn tree_dir(c: &Coords<'_>) -> String {
+    format!(
+        "{TREE_ROOT}/{}/{}/{}",
+        c.group_path(),
+        c.artifact_id,
+        c.suffixed_version()
+    )
+}
+
+/// The committed tree of `c`, as the [`JvmPatch`] bytes that re-plan it
+/// unchanged: `(jar, upstream pom)`, the pom un-suffixed. `None` when a
+/// file is missing or the pom does not carry the suffixed version.
+pub fn committed(read: ReadFn<'_>, c: &Coords<'_>) -> Option<(Vec<u8>, Vec<u8>)> {
+    let sv = c.suffixed_version();
+    let dir = tree_dir(c);
+    let a = c.artifact_id;
+    let jar = read(&format!("{dir}/{a}-{sv}.jar"))?;
+    let pom = String::from_utf8(read(&format!("{dir}/{a}-{sv}.pom"))?).ok()?;
+    let children = scan_pom_project(&pom)?;
+    let version = scan_find(&children, "version")?;
+    if pom[version.inner_start..version.inner_end].trim() != sv {
+        return None;
+    }
+    let upstream = format!(
+        "{}{}{}",
+        &pom[..version.inner_start],
+        c.version,
+        &pom[version.inner_end..]
+    );
+    Some((jar, upstream.into_bytes()))
+}
+
+/// Plan vendoring `patch` into the reactor rooted at `pom.xml`.
+pub fn plan(read: ReadFn<'_>, patch: &JvmPatch<'_>) -> Result<JvmPlan, JvmRefusal> {
+    plan_with_config(read, patch, true)
+}
+
+/// Plan with an explicit Maven config policy. A disabled policy is recorded for re-runs.
+pub fn plan_with_config(
+    read: ReadFn<'_>,
+    patch: &JvmPatch<'_>,
+    config_enabled: bool,
+) -> Result<JvmPlan, JvmRefusal> {
+    let (g, a, v) = (patch.group_id, patch.artifact_id, patch.version);
+    if !safe_coordinates(g, a, v) {
+        return Err(JvmRefusal {
+            code: "unsafe_coordinates",
+            detail: format!("unsafe maven coordinates `{g}:{a}:{v}`"),
+        });
+    }
+    let sv = patch.suffixed_version();
+    let suffixed_pom = std::str::from_utf8(patch.upstream_pom)
+        .ok()
+        .and_then(|pom| suffix_maven_pom(pom, patch.version, &sv))
+        .ok_or_else(|| JvmRefusal {
+            code: UPSTREAM_UNAVAILABLE,
+            detail: format!(
+                "reason: suffix_unavailable: the upstream pom of {g}:{a}:{v} computes its own \
+                 version, so it cannot be served as {sv}"
+            ),
+        })?;
+
+    let reactor = Reactor::discover(read)?;
+    let mut warnings = Vec::new();
+    let wrapper = super::wrapper_version(read, "maven");
+    if config_enabled && wrapper.is_none_or(|v| ((3, 9, 2)..(3, 9, 9)).contains(&v)) {
+        warnings.push(degraded("maven_f_outside_root", "Maven 3.9.2–3.9.8 cannot interpolate the repository tail with -f from outside the project; run Maven from this root or vendor with --maven-config=none"));
+    }
+    if !config_enabled || wrapper.is_none_or(|v| v < (3, 9, 2)) {
+        warnings.push(degraded("maven_mirror_of_all", "Maven before 3.9.2, or --maven-config=none, relies on the file repository; exclude socket-patch-vendor from mirrorOf=* in your Maven settings"));
+    }
+
+    let mut edits: BTreeMap<String, Vec<Edit>> = BTreeMap::new();
+    let mut unpinned: BTreeSet<String> = BTreeSet::new();
+    let mut managed_roots: BTreeSet<String> = BTreeSet::new();
+    for rel in &reactor.scope {
+        reactor.rewrite_declarations(
+            rel,
+            patch,
+            &sv,
+            &mut edits,
+            &mut warnings,
+            &mut unpinned,
+            &mut managed_roots,
+        );
+    }
+
+    let banning = reactor
+        .scope
+        .iter()
+        .find(|rel| bans_repositories(&reactor.poms[*rel].doc.masked));
+    if let Some(rel) = banning {
+        warnings.push(degraded(
+            "maven_fallback_omitted",
+            format!(
+                "{rel} configures a maven-enforcer repository ban; no fallback repository is \
+                 written, so the build needs Maven 3.9.2+ (maven.repo.local.tail)"
+            ),
+        ));
+    }
+    let mut records: Vec<WiringRecord> = Vec::new();
+    for root in reactor.wired_roots() {
+        let doc = &reactor.poms[&root].doc;
+        let file_edits = edits.entry(root.clone()).or_default();
+        let pinned = !unpinned.contains(&root) && !managed_roots.contains(&root);
+        match pin_of(doc, patch) {
+            Some(pin) if !pinned => file_edits.push(Edit::plain(pin.start, pin.end, "")),
+            Some(pin) if pin.uuid == patch.uuid => {}
+            Some(pin) => {
+                records.push(adopt(&root, POM_FRAGMENT_KIND, "pin_section"));
+                file_edits.push(pin_update(doc, &pin, patch));
+            }
+            None if pinned => {
+                let (edit, section) = pin_edit(doc, patch, &sv);
+                if !section {
+                    records.push(adopt(&root, POM_FRAGMENT_KIND, "pin_section"));
+                }
+                file_edits.push(edit);
+            }
+            None => {}
+        }
+        if banning.is_none() {
+            if has_fallback_repository(doc) {
+                records.push(adopt(&root, POM_FRAGMENT_KIND, "repository"));
+            } else {
+                file_edits.push(repository_edit(doc));
+            }
+        }
+    }
+    if let Some(rel) = edits
+        .iter()
+        .filter(|(_, e)| !e.is_empty())
+        .map(|(rel, _)| rel)
+        .find(|rel| reactor.chain(rel).any(|p| reactor.poms[p].deploys()))
+    {
+        warnings.push(degraded(
+            "publishes_suffixed_poms",
+            format!("{rel} is deployed (<distributionManagement>) and will publish {sv}"),
+        ));
+    }
+
+    let mut writes = Vec::new();
+    for (rel, file_edits) in edits {
+        if file_edits.is_empty() {
+            continue;
+        }
+        let text = &reactor.poms[&rel].doc.text;
+        records.extend(
+            file_edits
+                .iter()
+                .filter_map(|e| e.record(&rel, text))
+                .flatten(),
+        );
+        writes.push(FileWrite {
+            rel,
+            bytes: apply_edits(text, file_edits).into_bytes(),
+            tree: false,
+        });
+    }
+    if config_enabled {
+        let (config, config_op) = merge_maven_config(read(MAVEN_CONFIG).as_deref());
+        let action = match op_of_value(&config_op) {
+            "config" if read(MAVEN_CONFIG).is_some() => WiringAction::Rewritten,
+            _ => WiringAction::Added,
+        };
+        records.push(fragment(
+            MAVEN_CONFIG,
+            CONFIG_LINE_KIND,
+            "config",
+            action,
+            None,
+            config_op,
+        ));
+        writes.push(FileWrite {
+            rel: MAVEN_CONFIG.to_string(),
+            bytes: config,
+            tree: false,
+        });
+    } else {
+        if banning.is_some() {
+            return Err(JvmRefusal { code: SHAPE_UNSUPPORTED, detail: "reason: maven_repository_banned: --maven-config=none requires the fallback file repository".into() });
+        }
+        records.push(fragment(
+            MAVEN_CONFIG,
+            CONFIG_LINE_KIND,
+            "disabled",
+            WiringAction::Added,
+            None,
+            json!({"op": "config_none"}),
+        ));
+    }
+    records.push(owned_file(read, GITATTRIBUTES_REL, &mut writes));
+    let (tree_dir, jar_rel, tree) = tree_writes(patch, &sv, suffixed_pom);
+    writes.extend(tree);
+
+    Ok(JvmPlan {
+        tree_files: super::tree_files(&writes),
+        writes: finish_writes(read, writes),
+        records,
+        warnings,
+        tree_dir,
+        jar_rel,
+    })
+}
+
+fn op_of_value(op: &Value) -> &str {
+    op.get("op").and_then(Value::as_str).unwrap_or_default()
+}
+
+/// Plan the revert of `c`'s wiring. The pin and the rewritten
+/// versions go now; `pin_section` shells once empty; the repository block,
+/// the `maven.config` lines and the tree `.gitattributes` only once no pom
+/// references another patch.
+pub fn unplan(read: ReadFn<'_>, c: &Coords<'_>, records: &[WiringRecord]) -> JvmUnplan {
+    let sv = c.suffixed_version();
+    let mut files: BTreeSet<String> = records
+        .iter()
+        .filter(|w| w.kind == POM_FRAGMENT_KIND)
+        .map(|w| w.file.clone())
+        .collect();
+    if let Ok(reactor) = Reactor::discover(read) {
+        files.extend(reactor.scope);
+    }
+    let mut before: BTreeMap<String, Option<String>> = files
+        .into_iter()
+        .filter_map(|rel| {
+            let text = String::from_utf8(read(&rel)?).ok()?;
+            Some((rel, Some(text)))
+        })
+        .collect();
+    let mut after = before.clone();
+    let mut drifted = Vec::new();
+    for (rel, text) in after.iter_mut() {
+        let Some(t) = text.as_mut() else { continue };
+        let recs: Vec<&WiringRecord> = records
+            .iter()
+            .filter(|w| w.kind == POM_FRAGMENT_KIND && w.file == *rel)
+            .collect();
+        *t = cut_pin(rel, t, c, &recs, &mut drifted);
+        *t = restore_versions(rel, t, c, &sv, &recs, &mut drifted);
+        for w in recs
+            .iter()
+            .filter(|w| w.key.as_deref() == Some("pin_section"))
+        {
+            if let (Some(from), Some(to)) = (op_str(w, "from"), op_str(w, "to")) {
+                if let Some(undone) = undo_replace(t, from, to) {
+                    *t = undone;
+                }
+            }
+        }
+    }
+    let mut still_wired = false;
+    let mut live = false;
+    for (rel, text) in &after {
+        let Some(t) = text else { continue };
+        let (masked, _) = mask(t);
+        if t.contains(&pin_tag(c)) || masked.contains(&sv) {
+            still_wired = true;
+            if !drifted.iter().any(|d| d.starts_with(rel.as_str())) {
+                drifted.push(format!("{rel} still references {sv}"));
+            }
+        }
+        live |= references_other_patch(t, &masked, c);
+    }
+    live |= still_wired;
+    if !live {
+        for (rel, text) in after.iter_mut() {
+            let Some(t) = text.as_mut() else { continue };
+            let repo = records.iter().find(|w| {
+                w.kind == POM_FRAGMENT_KIND
+                    && w.file == *rel
+                    && w.key.as_deref() == Some("repository")
+                    && op_of(w) == "replace"
+            });
+            if let Some(w) = repo {
+                let undone = match (op_str(w, "from"), op_str(w, "to")) {
+                    (Some(from), Some(to)) => undo_replace(t, from, to),
+                    _ => None,
+                };
+                if let Some(undone) = undone.or_else(|| cut_marked_block(t)) {
+                    *t = undone;
+                }
+            }
+        }
+        if let Some(w) = records
+            .iter()
+            .find(|w| w.kind == CONFIG_LINE_KIND && w.file == MAVEN_CONFIG && op_of(w) == "config")
+        {
+            if let Some(text) = read(MAVEN_CONFIG).and_then(|b| String::from_utf8(b).ok()) {
+                after.insert(MAVEN_CONFIG.to_string(), undo_config(&text, w));
+                before.insert(MAVEN_CONFIG.to_string(), Some(text));
+            }
+        }
+        let created = records.iter().any(|w| {
+            w.kind == OWNED_FILE_KIND && w.file == GITATTRIBUTES_REL && op_of(w) == "create"
+        });
+        if created && read(GITATTRIBUTES_REL).as_deref() == Some(TREE_GITATTRIBUTES.as_bytes()) {
+            before.insert(
+                GITATTRIBUTES_REL.to_string(),
+                Some(TREE_GITATTRIBUTES.to_string()),
+            );
+            after.insert(GITATTRIBUTES_REL.to_string(), None);
+        }
+    }
+    JvmUnplan {
+        changes: changes_between(&before, &after),
+        drifted,
+        still_wired,
+    }
+}
+
+/// Whether a pom of the reactor still declares `c`'s suffixed version
+/// (outside comments): the liveness proof `vex` needs for this layout.
+pub fn wired(read: ReadFn<'_>, c: &Coords<'_>) -> bool {
+    wired_checked(read, c).unwrap_or(false)
+}
+
+pub fn wired_checked(read: ReadFn<'_>, c: &Coords<'_>) -> Result<bool, JvmRefusal> {
+    let sv = c.suffixed_version();
+    Reactor::discover(read).map(|reactor| {
+        reactor
+            .scope
+            .iter()
+            .any(|rel| reactor.poms[rel].doc.masked.contains(&sv))
+    })
+}
+
+/// `<!-- socket-patch <uuid>:` — the start of `c`'s pin comment.
+fn pin_tag(c: &Coords<'_>) -> String {
+    format!("{PIN_TAG}{}:", c.uuid)
+}
+
+/// Whether `text` (masked: `masked`) holds another patch's pin comment or,
+/// outside comments, its suffixed version.
+fn references_other_patch(text: &str, masked: &str, c: &Coords<'_>) -> bool {
+    let tags = text.match_indices(PIN_TAG).any(|(at, _)| {
+        let rest = &text[at + PIN_TAG.len()..];
+        rest.get(..36).is_some_and(|uuid| uuid != c.uuid) && rest.get(36..37) == Some(":")
+    });
+    let hex8 = c.hex8();
+    tags || masked.match_indices("-socket.").any(|(at, _)| {
+        masked.get(at + 8..at + 16).is_some_and(|h| {
+            h != hex8
+                && h.bytes()
+                    .all(|b| b.is_ascii_digit() || (b'a'..=b'f').contains(&b))
+        })
+    })
+}
+
+/// `text` with `c`'s pin cut: the recorded text when it is there once, else
+/// the tagged `<dependency>` by its lines.
+fn cut_pin(
+    rel: &str,
+    text: &str,
+    c: &Coords<'_>,
+    recs: &[&WiringRecord],
+    drifted: &mut Vec<String>,
+) -> String {
+    if !text.contains(&pin_tag(c)) {
+        return text.to_string();
+    }
+    let key = format!("pin:{}:{}", c.group_id, c.artifact_id);
+    if let Some(p) = recs
+        .iter()
+        .find(|w| w.key.as_deref() == Some(key.as_str()))
+        .and_then(|w| op_str(w, "text"))
+    {
+        if let Some(cut) = undo_replace(text, "", p) {
+            return cut;
+        }
+    }
+    let Ok(doc) = Doc::parse(text.to_string()) else {
+        drifted.push(format!(
+            "{rel} is not parseable; its socket-patch pin was left alone"
+        ));
+        return text.to_string();
+    };
+    let mut pins: Vec<Pin> = doc
+        .declarations()
+        .into_iter()
+        .filter_map(|dep| doc.pin_at(dep))
+        .filter(|p| p.uuid == c.uuid)
+        .collect();
+    match pins.pop() {
+        Some(pin) if pins.is_empty() => {
+            format!("{}{}", &text[..pin.start], &text[pin.end..])
+        }
+        _ => {
+            drifted.push(format!(
+                "{rel}: the socket-patch pin comment for {} no longer tags one <dependency>",
+                c.uuid
+            ));
+            text.to_string()
+        }
+    }
+}
+
+/// `text` with every g:a declaration at `sv` back at its recorded original
+/// (else the base version).
+fn restore_versions(
+    rel: &str,
+    text: &str,
+    c: &Coords<'_>,
+    sv: &str,
+    recs: &[&WiringRecord],
+    drifted: &mut Vec<String>,
+) -> String {
+    if !text.contains(sv) {
+        return text.to_string();
+    }
+    let Ok(doc) = Doc::parse(text.to_string()) else {
+        drifted.push(format!(
+            "{rel} is not parseable; its {sv} versions were left alone"
+        ));
+        return text.to_string();
+    };
+    let mut edits = Vec::new();
+    for (dep, key) in doc.keyed_declarations(c.group_id, c.artifact_id) {
+        let Some(version) = doc.child(dep, "version") else {
+            continue;
+        };
+        if doc.text_of(version) != sv {
+            continue;
+        }
+        let original = recs
+            .iter()
+            .find(|w| w.key.as_deref() == Some(key.as_str()))
+            .and_then(|w| w.original.as_ref())
+            .and_then(Value::as_str)
+            .unwrap_or(c.version);
+        let span = doc.value_span(version);
+        edits.push(Edit::plain(span.start, span.end, original));
+    }
+    apply_edits(text, edits)
+}
+
+/// `text` with the marked fallback repository cut by its lines.
+fn cut_marked_block(text: &str) -> Option<String> {
+    let begin = text.find(BEGIN_MARKER)?;
+    let end = begin + text[begin..].find(END_MARKER)? + END_MARKER.len();
+    if !text[begin..end].contains(&format!("<id>{REPO_ID}</id>")) {
+        return None;
+    }
+    let (start, end) = line_span(text, begin, end);
+    Some(format!("{}{}", &text[..start], &text[end..]))
+}
+
+/// `[start, end)` widened to whole lines when only blanks surround it there.
+fn line_span(text: &str, start: usize, end: usize) -> (usize, usize) {
+    let ls = text[..start].rfind('\n').map_or(0, |n| n + 1);
+    let lead_blank = text[ls..start].bytes().all(|b| b == b' ' || b == b'\t');
+    let rest = &text[end..];
+    let trail = rest.len() - rest.trim_start_matches([' ', '\t']).len();
+    let nl = match &rest.as_bytes()[trail..] {
+        [b'\r', b'\n', ..] => Some(2),
+        [b'\n', ..] => Some(1),
+        _ => None,
+    };
+    match (lead_blank, nl) {
+        (true, Some(n)) => (ls, end + trail + n),
+        _ => (start, end),
+    }
+}
+
+/// Undo a `config` op: rewritten lines back, appended text cut, a file
+/// vendor created and left empty deleted (`None`).
+fn undo_config(text: &str, w: &WiringRecord) -> Option<String> {
+    let op = w.new.as_ref();
+    let mut out = text.to_string();
+    for pair in op
+        .and_then(|o| o.get("rewritten"))
+        .and_then(Value::as_array)
+        .into_iter()
+        .flatten()
+    {
+        let (Some(from), Some(to)) = (
+            pair.get("from").and_then(Value::as_str),
+            pair.get("to").and_then(Value::as_str),
+        ) else {
+            continue;
+        };
+        out = rewrite_line(&out, to, from);
+    }
+    if let Some(appended) = op_str(w, "appended").filter(|a| !a.is_empty()) {
+        match out.strip_suffix(appended) {
+            Some(cut) => out = cut.to_string(),
+            None => {
+                for line in appended.lines().map(str::trim).filter(|l| !l.is_empty()) {
+                    out = remove_last_line(&out, line);
+                }
+            }
+        }
+    }
+    let created = op
+        .and_then(|o| o.get("created"))
+        .and_then(Value::as_bool)
+        .unwrap_or(false);
+    (!(created && out.trim().is_empty())).then_some(out)
+}
+
+/// `text` with the last line whose body is `from` rewritten to `to`.
+fn rewrite_line(text: &str, from: &str, to: &str) -> String {
+    let lines: Vec<&str> = text.split_inclusive('\n').collect();
+    let Some(i) = lines
+        .iter()
+        .rposition(|l| l.trim_end_matches(['\r', '\n']) == from)
+    else {
+        return text.to_string();
+    };
+    let ending = &lines[i][from.len()..];
+    let mut out: String = lines[..i].concat();
+    out.push_str(to);
+    out.push_str(ending);
+    out.push_str(&lines[i + 1..].concat());
+    out
+}
+
+/// `text` without the last whole line whose trimmed body is `line`.
+pub(crate) fn remove_last_line(text: &str, line: &str) -> String {
+    let lines: Vec<&str> = text.split_inclusive('\n').collect();
+    match lines.iter().rposition(|l| l.trim() == line) {
+        Some(i) => format!("{}{}", lines[..i].concat(), lines[i + 1..].concat()),
+        None => text.to_string(),
+    }
+}
+
+fn shape_refusal(reason: &str, detail: impl std::fmt::Display) -> JvmRefusal {
+    JvmRefusal {
+        code: SHAPE_UNSUPPORTED,
+        detail: format!("reason: {reason}: {detail}"),
+    }
+}
+
+fn degraded(reason: &str, detail: impl std::fmt::Display) -> JvmWarning {
+    JvmWarning {
+        code: DEGRADED,
+        detail: format!("reason: {reason}: {detail}"),
+    }
+}
+
+/// Whether an ancestor reactor owns the requested pom. Used to reject partial vendoring.
+pub fn contains_module(read: ReadFn<'_>, rel: &str) -> bool {
+    Reactor::discover(read).is_ok_and(|r| r.reactor.iter().any(|p| p == rel))
+}
+
+pub(crate) type Gav = (String, String, String);
+
+/// Metadata needed to verify upstream parents and imported BOMs in Gradle.
+pub(crate) struct MetadataModel {
+    pub parent: Option<Gav>,
+    pub imports: Vec<Gav>,
+    pub properties: BTreeMap<String, String>,
+}
+
+pub(crate) fn metadata_model(
+    bytes: &[u8],
+    inherited: &BTreeMap<String, String>,
+    descendant: &BTreeMap<String, String>,
+    include_imports: bool,
+) -> Result<MetadataModel, String> {
+    let pom = Pom::parse("upstream.pom", bytes.to_vec()).map_err(|e| e.detail)?;
+    let mut properties = inherited.clone();
+    properties.extend(pom.props.clone());
+    properties.extend(descendant.clone());
+    for (key, value) in [
+        ("project.version", pom.effective_version()),
+        ("project.groupId", pom.effective_group()),
+        ("project.artifactId", pom.artifact.as_deref()),
+    ] {
+        if let Some(v) = value {
+            properties.insert(key.into(), v.into());
+        }
+    }
+    let resolve = |value: &str| -> Result<String, String> {
+        let mut value = value.to_string();
+        for _ in 0..MAX_INTERPOLATION_DEPTH {
+            let Some(start) = value.find("${") else {
+                return Ok(value);
+            };
+            let end = value[start..]
+                .find('}')
+                .map(|n| start + n)
+                .ok_or("invalid metadata property")?;
+            let key = &value[start + 2..end];
+            let replacement = properties
+                .get(key)
+                .ok_or_else(|| format!("unresolved metadata property {key}"))?;
+            value.replace_range(start..=end, replacement);
+        }
+        Err("cyclic metadata property".into())
+    };
+    let gav = |g: Option<String>, a: Option<String>, v: Option<String>| -> Result<Gav, String> {
+        let (g, a, v) = (
+            resolve(&g.ok_or("missing groupId")?)?,
+            resolve(&a.ok_or("missing artifactId")?)?,
+            resolve(&v.ok_or("missing version")?)?,
+        );
+        if !safe_coordinates(&g, &a, &v) {
+            return Err("unsafe metadata coordinates".into());
+        }
+        Ok((g, a, v))
+    };
+    let parent = pom
+        .parent
+        .as_ref()
+        .map(|p| gav(p.group.clone(), p.artifact.clone(), p.version.clone()))
+        .transpose()?;
+    let mut imports = Vec::new();
+    if include_imports {
+        for dep in pom.doc.declarations() {
+            if pom.doc.is_top_level_managed(dep)
+                && pom.doc.child_text(dep, "scope").as_deref() == Some("import")
+                && pom.doc.child_text(dep, "type").as_deref() == Some("pom")
+            {
+                imports.push(gav(
+                    pom.doc.child_text(dep, "groupId"),
+                    pom.doc.child_text(dep, "artifactId"),
+                    pom.doc.child_text(dep, "version"),
+                )?);
+            }
+        }
+    }
+    Ok(MetadataModel {
+        parent,
+        imports,
+        properties,
+    })
+}
+
+// ── reactor discovery ─────────────────────────────────────────────
+
+/// One loaded pom.
+struct Pom {
+    doc: Doc,
+    /// Directory of the pom (`""` for the project root).
+    dir: String,
+    group: Option<String>,
+    artifact: Option<String>,
+    version: Option<String>,
+    packaging: String,
+    parent: Option<ParentRef>,
+    /// Top-level `<properties>` (profiles excluded).
+    props: BTreeMap<String, String>,
+}
+
+struct ParentRef {
+    group: Option<String>,
+    artifact: Option<String>,
+    version: Option<String>,
+    /// `None` = the default `../pom.xml`; `Some("")` = `<relativePath/>`
+    /// (the parent is remote).
+    relative_path: Option<String>,
+}
+
+impl Pom {
+    fn parse(rel: &str, bytes: Vec<u8>) -> Result<Pom, JvmRefusal> {
+        let text = String::from_utf8(bytes)
+            .map_err(|_| shape_refusal("build_file_unreadable", format!("{rel} is not UTF-8")))?;
+        let doc = Doc::parse(text)
+            .map_err(|e| shape_refusal("build_file_unreadable", format!("{rel}: {e}")))?;
+        let project = doc.project;
+        let parent = doc.child(project, "parent").map(|p| ParentRef {
+            group: doc.child_text(p, "groupId"),
+            artifact: doc.child_text(p, "artifactId"),
+            version: doc.child_text(p, "version"),
+            relative_path: doc.child(p, "relativePath").map(|r| doc.text_of(r)),
+        });
+        let mut props = BTreeMap::new();
+        if let Some(p) = doc.child(project, "properties") {
+            for &c in &doc.nodes[p].children {
+                props.insert(doc.nodes[c].name.clone(), doc.text_of(c));
+            }
+        }
+        Ok(Pom {
+            dir: rel.rsplit_once('/').map_or("", |(d, _)| d).to_string(),
+            group: doc.child_text(project, "groupId"),
+            artifact: doc.child_text(project, "artifactId"),
+            version: doc.child_text(project, "version"),
+            packaging: doc
+                .child_text(project, "packaging")
+                .unwrap_or_else(|| "jar".to_string()),
+            parent,
+            props,
+            doc,
+        })
+    }
+
+    fn effective_group(&self) -> Option<&str> {
+        self.group
+            .as_deref()
+            .or_else(|| self.parent.as_ref()?.group.as_deref())
+    }
+
+    fn effective_version(&self) -> Option<&str> {
+        self.version
+            .as_deref()
+            .or_else(|| self.parent.as_ref()?.version.as_deref())
+    }
+
+    /// Whether the pom declares any dependency or dependency management
+    /// (top-level or in a profile).
+    fn declares_dependencies(&self) -> bool {
+        let doc = &self.doc;
+        doc.nodes.iter().enumerate().any(|(i, n)| {
+            n.name == "dependencies"
+                && n.parent.is_some_and(|p| {
+                    doc.is_model_root(p) || {
+                        doc.nodes[p].name == "dependencyManagement"
+                            && doc.nodes[p].parent.is_some_and(|gp| doc.is_model_root(gp))
+                    }
+                })
+                && !doc.nodes[i].children.is_empty()
+        })
+    }
+
+    /// A top-level `<distributionManagement>`: the reactor is deployed.
+    fn deploys(&self) -> bool {
+        self.doc
+            .child(self.doc.project, "distributionManagement")
+            .is_some()
+    }
+}
+
+struct Reactor {
+    poms: BTreeMap<String, Pom>,
+    /// Reactor poms in discovery order.
+    reactor: Vec<String>,
+    /// Reactor poms plus every in-checkout pom on a reactor parent chain.
+    scope: Vec<String>,
+    /// pom → its local parent pom.
+    local_parent: BTreeMap<String, String>,
+    /// `-Dk=v` user properties from `.mvn/maven.config`.
+    cli_props: BTreeMap<String, String>,
+}
+
+impl Reactor {
+    fn discover(read: ReadFn<'_>) -> Result<Reactor, JvmRefusal> {
+        let root = read("pom.xml")
+            .ok_or_else(|| shape_refusal("no_build_file", "no pom.xml at the project root"))?;
+        let mut poms = BTreeMap::new();
+        poms.insert("pom.xml".to_string(), Pom::parse("pom.xml", root)?);
+        let mut reactor = vec!["pom.xml".to_string()];
+        let mut next = 0;
+        while next < reactor.len() {
+            let rel = reactor[next].clone();
+            next += 1;
+            for module in module_refs(&poms[&rel].doc) {
+                let (module_rel, bytes) = resolve_module(read, &poms[&rel].dir, &rel, &module)?;
+                if poms.contains_key(&module_rel) {
+                    if !reactor.contains(&module_rel) {
+                        reactor.push(module_rel);
+                    }
+                    continue;
+                }
+                let pom = Pom::parse(&module_rel, bytes)?;
+                let nested = NESTED_MVN_FILES.iter().find(|f| {
+                    !pom.dir.is_empty() && read(&format!("{}/.mvn/{f}", pom.dir)).is_some()
+                });
+                if let Some(f) = nested {
+                    return Err(shape_refusal(
+                        "nested_mvn_dir",
+                        format!(
+                            "module {} has its own .mvn/{f}; remove or merge {}/.mvn",
+                            pom.dir, pom.dir
+                        ),
+                    ));
+                }
+                poms.insert(module_rel.clone(), pom);
+                reactor.push(module_rel);
+            }
+        }
+
+        let mut scope = reactor.clone();
+        let mut local_parent = BTreeMap::new();
+        for rel in &reactor {
+            let mut cur = rel.clone();
+            while !local_parent.contains_key(&cur) {
+                let Some(parent_rel) = local_parent_of(read, &mut poms, &cur)? else {
+                    break;
+                };
+                local_parent.insert(cur.clone(), parent_rel.clone());
+                if !scope.contains(&parent_rel) {
+                    scope.push(parent_rel.clone());
+                }
+                cur = parent_rel;
+            }
+        }
+
+        let cli_props = read(MAVEN_CONFIG)
+            .map(|bytes| cli_properties(&String::from_utf8_lossy(&bytes)))
+            .unwrap_or_default();
+        Ok(Reactor {
+            poms,
+            reactor,
+            scope,
+            local_parent,
+            cli_props,
+        })
+    }
+
+    /// `rel`, then each local ancestor, nearest first.
+    fn chain<'s>(&'s self, rel: &'s str) -> impl Iterator<Item = &'s str> + 's {
+        let mut seen = BTreeSet::new();
+        std::iter::successors(Some(rel), move |cur| {
+            let next = self.local_parent.get(*cur).map(String::as_str)?;
+            seen.insert(*cur).then_some(next)
+        })
+    }
+
+    /// The topmost local ancestor of `rel`.
+    fn local_root(&self, rel: &str) -> String {
+        self.chain(rel).last().unwrap_or(rel).to_string()
+    }
+
+    /// Local roots that get a pin and the fallback repository. A root that
+    /// no other pom inherits from, packaged `pom` and declaring no
+    /// dependencies, is a pure aggregator: nothing resolves through it, so
+    /// it stays untouched.
+    fn wired_roots(&self) -> Vec<String> {
+        let mut roots: Vec<String> = Vec::new();
+        for rel in &self.reactor {
+            let root = self.local_root(rel);
+            if !roots.contains(&root) {
+                roots.push(root);
+            }
+        }
+        roots.retain(|root| {
+            let pom = &self.poms[root];
+            let inherited = self
+                .scope
+                .iter()
+                .any(|rel| rel != root && self.local_root(rel) == *root);
+            inherited || pom.packaging != "pom" || pom.declares_dependencies()
+        });
+        roots
+    }
+
+    /// Interpolate every `${name}` in `value` in the context of `rel`;
+    /// `None` when any name is undefined in the checkout.
+    fn interpolate(&self, rel: &str, value: &str, depth: usize) -> Option<String> {
+        if depth > MAX_INTERPOLATION_DEPTH {
+            return None;
+        }
+        let mut out = String::new();
+        let mut rest = value;
+        while let Some(at) = rest.find("${") {
+            out.push_str(&rest[..at]);
+            let after = &rest[at + 2..];
+            let close = after.find('}')?;
+            let raw = self.lookup(rel, &after[..close])?;
+            out.push_str(&self.interpolate(rel, &raw, depth + 1)?);
+            rest = &after[close + 1..];
+        }
+        out.push_str(rest);
+        Some(out)
+    }
+
+    /// User properties win over model properties, as in Maven; then the
+    /// model's own version expressions, then `<properties>` up the local
+    /// chain.
+    fn lookup(&self, rel: &str, name: &str) -> Option<String> {
+        let pom = &self.poms[rel];
+        match name {
+            "project.version" | "pom.version" => {
+                return pom.effective_version().map(str::to_string);
+            }
+            "project.parent.version" => return pom.parent.as_ref()?.version.clone(),
+            _ => {}
+        }
+        if let Some(v) = self.cli_props.get(name) {
+            return Some(v.clone());
+        }
+        if let Some(v) = self.chain(rel).find_map(|p| self.poms[p].props.get(name)) {
+            return Some(v.clone());
+        }
+        (name == "version")
+            .then(|| pom.effective_version().map(str::to_string))
+            .flatten()
+    }
+
+    /// Every pom in scope that inherits from `rel` (has it on its chain).
+    fn inheritors<'s>(&'s self, rel: &'s str) -> impl Iterator<Item = &'s str> + 's {
+        self.scope
+            .iter()
+            .map(String::as_str)
+            .filter(move |p| *p != rel && self.chain(p).any(|a| a == rel))
+    }
+
+    /// Rewrite the base declarations of `rel` and record the
+    /// warnings, the local roots not to pin, and the local roots whose own
+    /// top-level management already covers g:a.
+    #[allow(clippy::too_many_arguments)]
+    fn rewrite_declarations(
+        &self,
+        rel: &str,
+        patch: &JvmPatch<'_>,
+        sv: &str,
+        edits: &mut BTreeMap<String, Vec<Edit>>,
+        warnings: &mut Vec<JvmWarning>,
+        unpinned: &mut BTreeSet<String>,
+        managed_roots: &mut BTreeSet<String>,
+    ) {
+        let doc = &self.poms[rel].doc;
+        let ga = format!("{}:{}", patch.group_id, patch.artifact_id);
+        for (dep, key) in doc.keyed_declarations(patch.group_id, patch.artifact_id) {
+            if doc
+                .child_text(dep, "type")
+                .is_some_and(|t| !t.is_empty() && t != "jar")
+            {
+                continue;
+            }
+            let at = format!("{rel}:{}", doc.line_of(doc.nodes[dep].start));
+            if doc
+                .child_text(dep, "classifier")
+                .is_some_and(|c| !c.is_empty())
+            {
+                warnings.push(degraded(
+                    "classifier_declared",
+                    format!("{at}: a classifier variant of {ga} bypasses the pin"),
+                ));
+                continue;
+            }
+            let top_managed = doc.is_top_level_managed(dep);
+            let root = self.local_root(rel);
+            if top_managed && root == rel {
+                managed_roots.insert(root.clone());
+            }
+            let Some(version) = doc.child(dep, "version") else {
+                continue;
+            };
+            let declared = doc.text_of(version);
+            let resolved = if declared.contains("${") {
+                match self.interpolate(rel, &declared, 0) {
+                    Some(v) => v,
+                    None => {
+                        warnings.push(degraded(
+                            "property_unresolved",
+                            format!(
+                                "{at}: {ga} version {declared} is not defined in the checkout; \
+                                 left as is, probably unpatched"
+                            ),
+                        ));
+                        continue;
+                    }
+                }
+            } else {
+                declared.clone()
+            };
+            if resolved == sv {
+                continue;
+            }
+            if is_base_like(&resolved, patch.version) {
+                // Maven interpolates after inheritance: a pom that inherits
+                // this declaration and overrides the property must keep its
+                // own version, so the literal SV cannot go here.
+                let overridden = declared.contains("${").then(|| {
+                    self.inheritors(rel).find_map(|p| {
+                        let v = self.interpolate(p, &declared, 0)?;
+                        (!is_base_like(&v, patch.version) && v != sv).then(|| (p.to_string(), v))
+                    })
+                });
+                if let Some((p, v)) = overridden.flatten() {
+                    warnings.push(degraded(
+                        "conflicting_literal_version",
+                        format!(
+                            "{at}: {ga} version {declared} resolves to {v} in {p}, not {}; \
+                             left as is and {root} is not pinned",
+                            patch.version
+                        ),
+                    ));
+                    unpinned.insert(root);
+                    continue;
+                }
+                let span = doc.value_span(version);
+                // An earlier patch's suffixed version: its pristine value is
+                // in that patch's record, which the caller carries over.
+                let original =
+                    (resolved == patch.version).then(|| doc.text[span.clone()].to_string());
+                edits.entry(rel.to_string()).or_default().push(Edit {
+                    start: span.start,
+                    end: span.end,
+                    text: sv.to_string(),
+                    role: Role::Version { key, original },
+                });
+            } else if is_range(&resolved) {
+                warnings.push(degraded(
+                    "range",
+                    format!("{at}: {ga} version {declared} is left as is, probably unpatched"),
+                ));
+            } else {
+                warnings.push(degraded(
+                    "conflicting_literal_version",
+                    format!(
+                        "{at}: {ga} is declared at {declared}, not {}; {root} is not pinned",
+                        patch.version
+                    ),
+                ));
+                unpinned.insert(root);
+            }
+        }
+    }
+}
+
+/// The base version, or a suffixed version of it from any patch uuid.
+fn is_base_like(version: &str, base: &str) -> bool {
+    version == base
+        || version
+            .strip_prefix(base)
+            .and_then(|rest| rest.strip_prefix("-socket."))
+            .is_some_and(|hex| {
+                hex.len() == 8
+                    && hex
+                        .bytes()
+                        .all(|b| b.is_ascii_digit() || (b'a'..=b'f').contains(&b))
+            })
+}
+
+/// `<modules>`/`<subprojects>` entries of the project and of every profile.
+fn module_refs(doc: &Doc) -> Vec<String> {
+    let mut out = Vec::new();
+    for (i, n) in doc.nodes.iter().enumerate() {
+        let item = match n.name.as_str() {
+            "modules" => "module",
+            "subprojects" => "subproject",
+            _ => continue,
+        };
+        if !n.parent.is_some_and(|p| doc.is_model_root(p)) {
+            continue;
+        }
+        out.extend(doc.children(i, item).map(|m| doc.text_of(m)));
+    }
+    out
+}
+
+/// `module` of the pom at `dir` → the module pom's path and bytes.
+fn resolve_module(
+    read: ReadFn<'_>,
+    dir: &str,
+    declaring: &str,
+    module: &str,
+) -> Result<(String, Vec<u8>), JvmRefusal> {
+    if module.is_empty() || module.contains("${") {
+        return Err(shape_refusal(
+            "module_path_unresolvable",
+            format!("{declaring}: <module>{module}</module>; make the module a literal path"),
+        ));
+    }
+    let Some(path) = normalize(dir, module) else {
+        return Err(shape_refusal(
+            "module_outside_root",
+            format!("{declaring}: <module>{module}</module> leaves the project root"),
+        ));
+    };
+    let candidates = if path.is_empty() {
+        vec!["pom.xml".to_string()]
+    } else {
+        vec![format!("{path}/pom.xml"), path]
+    };
+    candidates
+        .into_iter()
+        .find_map(|c| read(&c).map(|bytes| (c, bytes)))
+        .ok_or_else(|| {
+            shape_refusal(
+                "module_path_unresolvable",
+                format!("{declaring}: <module>{module}</module> has no pom"),
+            )
+        })
+}
+
+/// The local parent of `rel`: its `<parent>` file exists in the checkout
+/// and names the same groupId/artifactId (and version, when both are
+/// literal). Loads the parent into `poms`.
+fn local_parent_of(
+    read: ReadFn<'_>,
+    poms: &mut BTreeMap<String, Pom>,
+    rel: &str,
+) -> Result<Option<String>, JvmRefusal> {
+    let pom = &poms[rel];
+    let Some(parent) = &pom.parent else {
+        return Ok(None);
+    };
+    let relative = match parent.relative_path.as_deref() {
+        Some("") => return Ok(None),
+        Some(p) => p,
+        None => "../pom.xml",
+    };
+    let Some(path) = normalize(&pom.dir, relative) else {
+        return Ok(None);
+    };
+    let (want_group, want_artifact, want_version) = (
+        parent.group.clone(),
+        parent.artifact.clone(),
+        parent.version.clone(),
+    );
+    let candidates = [
+        path.clone(),
+        if path.is_empty() {
+            "pom.xml".to_string()
+        } else {
+            format!("{path}/pom.xml")
+        },
+    ];
+    let Some(parent_rel) = candidates
+        .into_iter()
+        .find(|c| poms.contains_key(c) || read(c).is_some())
+    else {
+        return Ok(None);
+    };
+    if !poms.contains_key(&parent_rel) {
+        let bytes = read(&parent_rel).unwrap_or_default();
+        let parsed = Pom::parse(&parent_rel, bytes)?;
+        poms.insert(parent_rel.clone(), parsed);
+    }
+    let candidate = &poms[&parent_rel];
+    let literal = |v: &Option<String>| {
+        v.as_deref()
+            .filter(|v| !v.contains("${"))
+            .map(str::to_string)
+    };
+    let versions_agree = match (literal(&want_version), literal(&candidate.version)) {
+        (Some(a), Some(b)) => a == b,
+        _ => true,
+    };
+    let matches = want_group.as_deref() == candidate.effective_group()
+        && want_artifact == candidate.artifact
+        && versions_agree;
+    Ok(matches.then_some(parent_rel))
+}
+
+/// `base_dir` joined with `rel`, normalized; `None` when it leaves the
+/// project root or is absolute. `""` is the root itself.
+fn normalize(base_dir: &str, rel: &str) -> Option<String> {
+    if rel.starts_with('/') || rel.starts_with('\\') || rel.contains(':') {
+        return None;
+    }
+    let mut segments: Vec<&str> = base_dir.split('/').filter(|s| !s.is_empty()).collect();
+    for segment in rel.split(['/', '\\']) {
+        match segment {
+            "" | "." => {}
+            ".." => {
+                segments.pop()?;
+            }
+            s => segments.push(s),
+        }
+    }
+    Some(segments.join("/"))
+}
+
+fn is_range(version: &str) -> bool {
+    version.starts_with('[')
+        || version.starts_with('(')
+        || version == "LATEST"
+        || version == "RELEASE"
+}
+
+/// Whether a pom configures the enforcer rules that forbid POM
+/// repositories (by rule element or by implementation class name).
+fn bans_repositories(masked: &str) -> bool {
+    ["requireNoRepositories", "bannedRepositories"]
+        .iter()
+        .any(|rule| {
+            has_open_tag(masked, rule) || {
+                let mut class = rule.to_string();
+                class[..1].make_ascii_uppercase();
+                masked.contains(&class)
+            }
+        })
+}
+
+fn has_fallback_repository(doc: &Doc) -> bool {
+    if doc.text.contains(BEGIN_MARKER) {
+        return true;
+    }
+    doc.child(doc.project, "repositories").is_some_and(|r| {
+        doc.children(r, "repository")
+            .any(|repo| doc.child_text(repo, "id").as_deref() == Some(REPO_ID))
+    })
+}
+
+/// `-Dk=v` tokens of a `maven.config`.
+fn cli_properties(config: &str) -> BTreeMap<String, String> {
+    config
+        .split_whitespace()
+        .filter_map(|t| t.strip_prefix("-D")?.split_once('='))
+        .map(|(k, v)| (k.to_string(), v.to_string()))
+        .collect()
+}
+
+// ── pom edits ───────────────────────────────────────────────────
+
+/// Replace `text[start..end]` with `text` (an insertion when `start == end`).
+#[derive(Debug)]
+struct Edit {
+    start: usize,
+    end: usize,
+    text: String,
+    role: Role,
+}
+
+/// What an [`Edit`] records.
+#[derive(Debug)]
+enum Role {
+    /// Recorded by nobody (removing a stale pin).
+    Plain,
+    /// The pin; `mark` is its byte range in the edit text when the edit also
+    /// creates the sections around it (`pin_section`).
+    Pin {
+        mark: Option<Range<usize>>,
+    },
+    Repository,
+    /// A declaration's version; `original` is `None` when it held another
+    /// patch's suffixed version.
+    Version {
+        key: String,
+        original: Option<String>,
+    },
+}
+
+impl Edit {
+    fn plain(start: usize, end: usize, text: &str) -> Edit {
+        Edit {
+            start,
+            end,
+            text: text.to_string(),
+            role: Role::Plain,
+        }
+    }
+
+    /// The fragment records of this edit of `rel` (whose old text is `old`).
+    fn record(&self, rel: &str, old: &str) -> Option<Vec<WiringRecord>> {
+        let replaced = &old[self.start..self.end];
+        let action = if replaced.is_empty() {
+            WiringAction::Added
+        } else {
+            WiringAction::Rewritten
+        };
+        match &self.role {
+            Role::Plain => None,
+            Role::Pin { mark } => {
+                let (pin, section) = match mark {
+                    Some(r) => (
+                        &self.text[r.clone()],
+                        Some(format!("{}{}", &self.text[..r.start], &self.text[r.end..])),
+                    ),
+                    None => (self.text.as_str(), None),
+                };
+                let key = pin_key_of(pin)?;
+                let mut out = vec![fragment(
+                    rel,
+                    POM_FRAGMENT_KIND,
+                    &key,
+                    WiringAction::Added,
+                    None,
+                    json!({ "op": "pin", "text": pin }),
+                )];
+                if let Some(section) = section {
+                    out.push(fragment(
+                        rel,
+                        POM_FRAGMENT_KIND,
+                        "pin_section",
+                        action,
+                        None,
+                        replace_op(replaced, &section),
+                    ));
+                }
+                Some(out)
+            }
+            Role::Repository => Some(vec![fragment(
+                rel,
+                POM_FRAGMENT_KIND,
+                "repository",
+                action,
+                None,
+                replace_op(replaced, &self.text),
+            )]),
+            Role::Version { key, original } => Some(vec![fragment(
+                rel,
+                POM_FRAGMENT_KIND,
+                key,
+                WiringAction::Rewritten,
+                original.clone(),
+                json!({ "op": "version", "to": self.text }),
+            )]),
+        }
+    }
+}
+
+/// `pin:<g>:<a>` from the pin comment inside `pin`.
+fn pin_key_of(pin: &str) -> Option<String> {
+    let at = pin.find(PIN_TAG)? + PIN_TAG.len();
+    let rest = &pin[at..];
+    let gav = rest.get(36..)?.strip_prefix(": ")?;
+    let gav = &gav[..gav.find(" -->")?];
+    let mut parts = gav.split(':');
+    let (g, a) = (parts.next()?, parts.next()?);
+    Some(format!("pin:{g}:{a}"))
+}
+
+/// Splice non-overlapping edits; insertions at one offset keep their order.
+fn apply_edits(text: &str, mut edits: Vec<Edit>) -> String {
+    edits.sort_by_key(|e| e.start);
+    let mut out =
+        String::with_capacity(text.len() + edits.iter().map(|e| e.text.len()).sum::<usize>());
+    let mut at = 0;
+    for e in edits {
+        debug_assert!(e.start >= at, "overlapping pom edits");
+        out.push_str(&text[at..e.start]);
+        out.push_str(&e.text);
+        at = e.end;
+    }
+    out.push_str(&text[at..]);
+    out
+}
+
+/// Lines of the pin entry, relative to the `<dependency>` indent.
+fn pin_lines(doc: &Doc, patch: &JvmPatch<'_>, sv: &str) -> Vec<String> {
+    let u = &doc.unit;
+    vec![
+        format!(
+            "{PIN_TAG}{}: {}:{}:{} -->",
+            patch.uuid, patch.group_id, patch.artifact_id, patch.version
+        ),
+        "<dependency>".to_string(),
+        format!("{u}<groupId>{}</groupId>", patch.group_id),
+        format!("{u}<artifactId>{}</artifactId>", patch.artifact_id),
+        format!("{u}<version>{sv}</version>"),
+        "</dependency>".to_string(),
+    ]
+}
+
+fn nest(unit: &str, open: &str, inner: Vec<String>, close: &str) -> Vec<String> {
+    let mut lines = vec![open.to_string()];
+    lines.extend(inner.into_iter().map(|l| format!("{unit}{l}")));
+    lines.push(close.to_string());
+    lines
+}
+
+/// The pin as the first child of the top-level
+/// `<dependencyManagement><dependencies>`, creating the sections when
+/// absent (before `<dependencies>`, else `<build>`, else `</project>`).
+/// `true` when the edit creates (or expands) a section.
+fn pin_edit(doc: &Doc, patch: &JvmPatch<'_>, sv: &str) -> (Edit, bool) {
+    let u = doc.unit.as_str();
+    let entry = pin_lines(doc, patch, sv);
+    let n = entry.len();
+    let project = doc.project;
+    let Some(dm) = doc.child(project, "dependencyManagement") else {
+        let lines = nest(
+            u,
+            "<dependencyManagement>",
+            nest(u, "<dependencies>", entry, "</dependencies>"),
+            "</dependencyManagement>",
+        );
+        let edit = match doc
+            .child(project, "dependencies")
+            .or_else(|| doc.child(project, "build"))
+        {
+            Some(anchor) => doc.insert_before(
+                doc.nodes[anchor].start,
+                &doc.indent_of(anchor),
+                &lines,
+                Some(2..2 + n),
+            ),
+            None => doc.insert_before(
+                doc.nodes[project].inner_end,
+                &doc.child_indent(project),
+                &lines,
+                Some(2..2 + n),
+            ),
+        };
+        return (edit, true);
+    };
+    match doc.child(dm, "dependencies") {
+        Some(deps) if !doc.is_self_closing(deps) => {
+            (doc.insert_first_child(deps, &entry, None), false)
+        }
+        Some(deps) => (doc.insert_first_child(deps, &entry, Some(0..n)), true),
+        None => (
+            doc.insert_first_child(
+                dm,
+                &nest(u, "<dependencies>", entry, "</dependencies>"),
+                Some(1..1 + n),
+            ),
+            true,
+        ),
+    }
+}
+
+/// An existing pin of g:a:v from another patch uuid, updated in place to
+/// this patch's uuid and suffixed version.
+fn pin_update(doc: &Doc, pin: &Pin, patch: &JvmPatch<'_>) -> Edit {
+    let sv = patch.suffixed_version();
+    let mut text = doc.text[pin.start..pin.end].to_string();
+    if let Some(version) = &pin.version {
+        text.replace_range(version.start - pin.start..version.end - pin.start, &sv);
+    }
+    let text = text.replacen(
+        &format!("{PIN_TAG}{}:", pin.uuid),
+        &format!("{PIN_TAG}{}:", patch.uuid),
+        1,
+    );
+    Edit {
+        start: pin.start,
+        end: pin.end,
+        text,
+        role: Role::Pin { mark: None },
+    }
+}
+
+/// The marked fallback repository, last in the top-level `<repositories>`
+/// or in a new section before `</project>`.
+fn repository_edit(doc: &Doc) -> Edit {
+    let u = doc.unit.as_str();
+    let block = vec![
+        BEGIN_MARKER.to_string(),
+        "<repository>".to_string(),
+        format!("{u}<id>{REPO_ID}</id>"),
+        format!("{u}<url>{REPO_URL}</url>"),
+        format!(
+            "{u}<releases><enabled>true</enabled><updatePolicy>always</updatePolicy>\
+             <checksumPolicy>fail</checksumPolicy></releases>"
+        ),
+        format!("{u}<snapshots><enabled>false</enabled></snapshots>"),
+        "</repository>".to_string(),
+        END_MARKER.to_string(),
+    ];
+    let project = doc.project;
+    let mut edit = match doc.child(project, "repositories") {
+        Some(r) if doc.is_self_closing(r) => doc.insert_first_child(r, &block, None),
+        Some(r) => doc.insert_before(doc.nodes[r].inner_end, &doc.child_indent(r), &block, None),
+        None => doc.insert_before(
+            doc.nodes[project].inner_end,
+            &doc.child_indent(project),
+            &nest(u, "<repositories>", block, "</repositories>"),
+            None,
+        ),
+    };
+    edit.role = Role::Repository;
+    edit
+}
+
+// ── .mvn/maven.config ─────────────────────────────────
+
+/// `config` with the offline-protocols and tail lines present, and the
+/// `config` op recording what changed (`adopt` when nothing did):
+/// identical lines are adopted, the last (effective) tail gets our
+/// directory appended to its list, the last protocol list gets `file`.
+fn merge_maven_config(config: Option<&[u8]>) -> (Vec<u8>, Value) {
+    let text = config.map(String::from_utf8_lossy).unwrap_or_default();
+    let nl = if text.contains("\r\n") { "\r\n" } else { "\n" };
+    let lines: Vec<&str> = text.split_inclusive('\n').collect();
+    let arg_of = |line: &str| line.trim().to_string();
+    let last = |key: &str| lines.iter().rposition(|l| arg_of(l).starts_with(key));
+    let (last_tail, last_offline) = (last(TAIL_KEY), last(OFFLINE_KEY));
+    let mut out = String::new();
+    let mut rewritten = Vec::new();
+    for (i, line) in lines.iter().enumerate() {
+        let body = line.trim_end_matches(['\r', '\n']);
+        let ending = &line[body.len()..];
+        let arg = arg_of(line);
+        let extended = if Some(i) == last_tail {
+            extend_list(&arg, TAIL_KEY, TAIL_DIR)
+        } else if Some(i) == last_offline {
+            extend_list(&arg, OFFLINE_KEY, "file")
+        } else {
+            None
+        };
+        match extended {
+            Some(new_arg) => {
+                let new_body = body.replacen(&arg, &new_arg, 1);
+                out.push_str(&new_body);
+                out.push_str(ending);
+                rewritten.push(json!({ "from": body, "to": new_body }));
+            }
+            None => out.push_str(line),
+        }
+    }
+    let mut appended = String::new();
+    if !out.is_empty() && !out.ends_with('\n') && (last_offline.is_none() || last_tail.is_none()) {
+        appended.push_str(nl);
+    }
+    if last_offline.is_none() {
+        appended.push_str(&format!("{OFFLINE_LINE}{nl}"));
+    }
+    if last_tail.is_none() {
+        appended.push_str(&format!("{TAIL_KEY}{TAIL_DIR}{nl}"));
+    }
+    out.push_str(&appended);
+    let op = if rewritten.is_empty() && appended.is_empty() {
+        json!({ "op": "adopt" })
+    } else {
+        json!({
+            "op": "config",
+            "created": config.is_none(),
+            "appended": appended,
+            "rewritten": rewritten,
+        })
+    };
+    (out.into_bytes(), op)
+}
+
+/// `arg` (`<key><list>`) with `item` appended to its comma list, `None`
+/// when already listed.
+fn extend_list(arg: &str, key: &str, item: &str) -> Option<String> {
+    let list = arg.strip_prefix(key)?;
+    if list.split(',').any(|p| p == item) {
+        return None;
+    }
+    let sep = if list.is_empty() { "" } else { "," };
+    Some(format!("{key}{list}{sep}{item}"))
+}
+
+// ── vendored tree ───────────────────────────────────────────────────────
+
+/// `(tree_dir, jar_rel, writes)` of the version directory.
+fn tree_writes(
+    patch: &JvmPatch<'_>,
+    sv: &str,
+    suffixed_pom: String,
+) -> (String, String, Vec<FileWrite>) {
+    let a = patch.artifact_id;
+    let dir = tree_dir(&patch.coords());
+    let jar_name = format!("{a}-{sv}.jar");
+    let pom_name = format!("{a}-{sv}.pom");
+    let pom = suffixed_pom.into_bytes();
+    let mut files: BTreeMap<String, Vec<u8>> = BTreeMap::new();
+    files.insert(format!("{jar_name}.sha1"), sha1_hex(patch.jar).into_bytes());
+    files.insert(format!("{pom_name}.sha1"), sha1_hex(&pom).into_bytes());
+    files.insert(jar_name.clone(), patch.jar.to_vec());
+    files.insert(pom_name, pom);
+
+    let mut listed = serde_json::Map::new();
+    for (name, bytes) in &files {
+        listed.insert(
+            name.clone(),
+            serde_json::json!({ "sha256": sha256_hex(bytes), "size": bytes.len() }),
+        );
+    }
+    // Keys inserted in sorted order: serde_json keeps insertion order here.
+    let marker = serde_json::json!({
+        "files": listed,
+        "purl": format!("pkg:maven/{}/{a}@{}", patch.group_id, patch.version),
+        "schema": 1,
+        "tool": "maven",
+        "uuid": patch.uuid,
+        "version": sv,
+    });
+    let mut marker = serde_json::to_string_pretty(&marker).expect("marker serializes");
+    marker.push('\n');
+    files.insert(MARKER_FILE.to_string(), marker.into_bytes());
+
+    let writes: Vec<FileWrite> = files
+        .into_iter()
+        .map(|(name, bytes)| FileWrite {
+            rel: format!("{dir}/{name}"),
+            bytes,
+            tree: true,
+        })
+        .collect();
+    let jar_rel = format!("{dir}/{jar_name}");
+    (dir, jar_rel, writes)
+}
+
+// ── XML scanning ─────────────────────────────────────────────────────────────
+
+/// `text` with comments, CDATA sections and processing instructions blanked
+/// byte-for-byte (offsets kept); `false` when one is unterminated (it is
+/// blanked through EOF).
+fn mask(text: &str) -> (String, bool) {
+    const SPANS: [(&str, &str); 3] = [("<!--", "-->"), ("<![CDATA[", "]]>"), ("<?", "?>")];
+    let mut bytes = text.as_bytes().to_vec();
+    let mut complete = true;
+    let mut from = 0;
+    while let Some(rel) = text[from..].find('<') {
+        let lt = from + rel;
+        let Some((open, close)) = SPANS.iter().find(|(o, _)| text[lt..].starts_with(o)) else {
+            from = lt + 1;
+            continue;
+        };
+        let body = lt + open.len();
+        let end = match text[body..].find(close) {
+            Some(r) => body + r + close.len(),
+            None => {
+                complete = false;
+                text.len()
+            }
+        };
+        bytes[lt..end].fill(b' ');
+        from = end;
+    }
+    let masked =
+        String::from_utf8(bytes).expect("blanking whole ASCII-delimited spans keeps UTF-8");
+    (masked, complete)
+}
+
+/// A real `<name …>` open tag (the next byte is a tag boundary).
+fn has_open_tag(masked: &str, name: &str) -> bool {
+    let needle = format!("<{name}");
+    masked.match_indices(&needle).any(|(at, _)| {
+        masked[at + needle.len()..]
+            .chars()
+            .next()
+            .is_none_or(|c| c == '>' || c == '/' || c.is_whitespace())
+    })
+}
+
+#[derive(Debug)]
+struct Node {
+    name: String,
+    /// The `<` of the open tag.
+    start: usize,
+    /// Just past the open tag's `>`.
+    inner_start: usize,
+    /// The `<` of the close tag (`== inner_start` for `<x/>`).
+    inner_end: usize,
+    /// Just past the close tag's `>`.
+    end: usize,
+    parent: Option<usize>,
+    children: Vec<usize>,
+}
+
+/// A parsed pom: the original text, its masked copy and the element tree.
+struct Doc {
+    text: String,
+    masked: String,
+    nodes: Vec<Node>,
+    project: usize,
+    /// One indentation step, detected from the file.
+    unit: String,
+    /// The file's line ending.
+    nl: &'static str,
+}
+
+impl Doc {
+    fn parse(text: String) -> Result<Doc, String> {
+        let (masked, complete) = mask(&text);
+        if !complete {
+            return Err("unterminated comment, CDATA section or processing instruction".into());
+        }
+        let bytes = masked.as_bytes();
+        let mut nodes: Vec<Node> = Vec::new();
+        let mut stack: Vec<usize> = Vec::new();
+        let mut tops: Vec<usize> = Vec::new();
+        let mut from = 0;
+        while let Some(rel) = masked[from..].find('<') {
+            let lt = from + rel;
+            match bytes.get(lt + 1) {
+                Some(b'/') => {
+                    let gt = masked[lt..]
+                        .find('>')
+                        .map(|r| lt + r)
+                        .ok_or("unterminated close tag")?;
+                    let name = masked[lt + 2..gt].trim();
+                    let open = stack.pop().ok_or_else(|| format!("unexpected </{name}>"))?;
+                    if nodes[open].name != name {
+                        return Err(format!("<{}> closed by </{name}>", nodes[open].name));
+                    }
+                    nodes[open].inner_end = lt;
+                    nodes[open].end = gt + 1;
+                    from = gt + 1;
+                }
+                Some(b'!') => {
+                    let gt = declaration_end(&masked, lt).ok_or("unterminated <! declaration")?;
+                    from = gt + 1;
+                }
+                _ => {
+                    let gt = tag_end(&masked, lt).ok_or("unterminated open tag")?;
+                    let raw = &masked[lt + 1..gt];
+                    let self_closing = raw.ends_with('/');
+                    let name = raw
+                        .split(|c: char| c.is_whitespace() || c == '/')
+                        .next()
+                        .unwrap_or_default();
+                    if name.is_empty() {
+                        return Err(format!("malformed tag at line {}", line_at(&masked, lt)));
+                    }
+                    let index = nodes.len();
+                    let parent = stack.last().copied();
+                    nodes.push(Node {
+                        name: name.to_string(),
+                        start: lt,
+                        inner_start: gt + 1,
+                        inner_end: gt + 1,
+                        end: gt + 1,
+                        parent,
+                        children: Vec::new(),
+                    });
+                    match parent {
+                        Some(p) => nodes[p].children.push(index),
+                        None => tops.push(index),
+                    }
+                    if !self_closing {
+                        stack.push(index);
+                    }
+                    from = gt + 1;
+                }
+            }
+        }
+        if let Some(&open) = stack.last() {
+            return Err(format!("unclosed <{}>", nodes[open].name));
+        }
+        let project = match tops.as_slice() {
+            [p] if nodes[*p].name == "project" && nodes[*p].inner_start != nodes[*p].end => *p,
+            _ => return Err("no single <project> element".to_string()),
+        };
+        let unit = indent_unit(&masked);
+        let nl = if text.contains("\r\n") { "\r\n" } else { "\n" };
+        Ok(Doc {
+            text,
+            masked,
+            nodes,
+            project,
+            unit,
+            nl,
+        })
+    }
+
+    fn children<'d>(&'d self, n: usize, name: &'d str) -> impl Iterator<Item = usize> + 'd {
+        self.nodes[n]
+            .children
+            .iter()
+            .copied()
+            .filter(move |&c| self.nodes[c].name == name)
+    }
+
+    fn child(&self, n: usize, name: &str) -> Option<usize> {
+        self.children(n, name).next()
+    }
+
+    fn is_self_closing(&self, n: usize) -> bool {
+        self.nodes[n].inner_start == self.nodes[n].end
+    }
+
+    /// Trimmed character data: comments and PIs dropped, CDATA unwrapped.
+    fn text_of(&self, n: usize) -> String {
+        let node = &self.nodes[n];
+        let mut out = String::new();
+        let mut rest = &self.text[node.inner_start..node.inner_end];
+        while let Some(lt) = rest.find('<') {
+            out.push_str(&rest[..lt]);
+            let tail = &rest[lt..];
+            let (skip_to, keep) = if let Some(body) = tail.strip_prefix("<![CDATA[") {
+                let end = body.find("]]>").unwrap_or(body.len());
+                (9 + end + 3, Some(&body[..end]))
+            } else if let Some(body) = tail.strip_prefix("<!--") {
+                (body.find("-->").map_or(tail.len(), |r| 4 + r + 3), None)
+            } else if let Some(body) = tail.strip_prefix("<?") {
+                (body.find("?>").map_or(tail.len(), |r| 2 + r + 2), None)
+            } else {
+                (1, Some("<"))
+            };
+            out.push_str(keep.unwrap_or_default());
+            rest = tail.get(skip_to..).unwrap_or_default();
+        }
+        out.push_str(rest);
+        out.trim().to_string()
+    }
+
+    fn child_text(&self, n: usize, name: &str) -> Option<String> {
+        self.child(n, name).map(|c| self.text_of(c))
+    }
+
+    /// The span of a text element's value: the trimmed text outside
+    /// comments, or the whole content when it holds CDATA (whose masked
+    /// copy is blank).
+    fn value_span(&self, n: usize) -> Range<usize> {
+        let node = &self.nodes[n];
+        if self.text[node.inner_start..node.inner_end].contains("<![CDATA[") {
+            return node.inner_start..node.inner_end;
+        }
+        let inner = &self.masked[node.inner_start..node.inner_end];
+        let lead = inner.len() - inner.trim_start().len();
+        let start = node.inner_start + lead;
+        start..start + inner.trim().len()
+    }
+
+    /// The `socket-patch` pin `dep` is, when a pin comment directly precedes
+    /// it: its whole-line region, the tagged uuid and gav.
+    fn pin_at(&self, dep: usize) -> Option<Pin> {
+        let node = &self.nodes[dep];
+        let before = self.text[..node.start].trim_end();
+        let comment_end = before.len();
+        if !before.ends_with("-->") {
+            return None;
+        }
+        let comment_start = before.rfind("<!--")?;
+        let body = before[comment_start..].strip_prefix(PIN_TAG)?;
+        let uuid = body.get(..36)?.to_string();
+        let gav = body.get(36..)?.strip_prefix(": ")?.strip_suffix(" -->")?;
+        if uuid.contains(char::is_whitespace) || comment_end > node.start {
+            return None;
+        }
+        let (start, end) = line_span(&self.text, comment_start, node.end);
+        let version = self.child(dep, "version").map(|v| self.value_span(v));
+        Some(Pin {
+            start,
+            end,
+            uuid,
+            gav: gav.to_string(),
+            version,
+        })
+    }
+
+    /// The top-level managed pin of `patch`'s g:a:v, from any patch uuid.
+    fn pin_of_gav(&self, gav: &str) -> Option<Pin> {
+        let deps = self.child(
+            self.child(self.project, "dependencyManagement")?,
+            "dependencies",
+        )?;
+        self.children(deps, "dependency")
+            .filter_map(|d| self.pin_at(d))
+            .find(|p| p.gav == gav)
+    }
+
+    /// The g:a declarations that are not pins, with their record key
+    /// `version:<g>:<a>:<section>:<ordinal>`.
+    fn keyed_declarations(&self, g: &str, a: &str) -> Vec<(usize, String)> {
+        let mut seen: BTreeMap<String, usize> = BTreeMap::new();
+        let mut out = Vec::new();
+        for dep in self.declarations() {
+            if self.child_text(dep, "groupId").as_deref() != Some(g)
+                || self.child_text(dep, "artifactId").as_deref() != Some(a)
+                || self.pin_at(dep).is_some()
+            {
+                continue;
+            }
+            let section = self.section_of(dep);
+            let ordinal = seen.entry(section.clone()).or_default();
+            out.push((dep, format!("version:{g}:{a}:{section}:{ordinal}")));
+            *ordinal += 1;
+        }
+        out
+    }
+
+    /// `dependencies` / `dependencyManagement`, prefixed with
+    /// `profile:<id>:` inside a profile.
+    fn section_of(&self, dep: usize) -> String {
+        let up = |n: usize| self.nodes[n].parent;
+        let Some(owner) = up(dep).and_then(up) else {
+            return String::new();
+        };
+        let (section, model) = if self.nodes[owner].name == "dependencyManagement" {
+            ("dependencyManagement", up(owner))
+        } else {
+            ("dependencies", Some(owner))
+        };
+        match model {
+            Some(m) if self.is_profile(m) => {
+                let id = self.child_text(m, "id").unwrap_or_default();
+                format!("profile:{id}:{section}")
+            }
+            _ => section.to_string(),
+        }
+    }
+
+    /// `profiles/profile` directly under the project.
+    fn is_profile(&self, n: usize) -> bool {
+        self.nodes[n].name == "profile"
+            && self.nodes[n].parent.is_some_and(|p| {
+                self.nodes[p].name == "profiles" && self.nodes[p].parent == Some(self.project)
+            })
+    }
+
+    /// The project or one of its profiles: where a model section lives.
+    fn is_model_root(&self, n: usize) -> bool {
+        n == self.project || self.is_profile(n)
+    }
+
+    /// `<dependency>` elements of the model: `dependencies` and
+    /// `dependencyManagement` of the project and of each profile. Plugin
+    /// dependencies and exclusions are not declarations.
+    fn declarations(&self) -> Vec<usize> {
+        (0..self.nodes.len())
+            .filter(|&i| {
+                let Some(deps) = self.nodes[i].parent else {
+                    return false;
+                };
+                let Some(owner) = self.nodes[deps].parent else {
+                    return false;
+                };
+                self.nodes[i].name == "dependency"
+                    && self.nodes[deps].name == "dependencies"
+                    && (self.is_model_root(owner)
+                        || (self.nodes[owner].name == "dependencyManagement"
+                            && self.nodes[owner]
+                                .parent
+                                .is_some_and(|p| self.is_model_root(p))))
+            })
+            .collect()
+    }
+
+    /// `project/dependencyManagement/dependencies/dependency`.
+    fn is_top_level_managed(&self, dep: usize) -> bool {
+        let up = |n: usize| self.nodes[n].parent;
+        up(dep).and_then(up).is_some_and(|dm| {
+            self.nodes[dm].name == "dependencyManagement" && up(dm) == Some(self.project)
+        })
+    }
+
+    fn line_of(&self, pos: usize) -> usize {
+        line_at(&self.text, pos)
+    }
+
+    fn line_start(&self, pos: usize) -> usize {
+        self.text[..pos].rfind('\n').map_or(0, |n| n + 1)
+    }
+
+    fn starts_line(&self, pos: usize) -> bool {
+        self.masked[self.line_start(pos)..pos]
+            .bytes()
+            .all(|b| b == b' ' || b == b'\t')
+    }
+
+    /// The blanks before `n` when it starts its line (a comment before it
+    /// is not indentation), else one step deeper than its parent.
+    fn indent_of(&self, n: usize) -> String {
+        let start = self.nodes[n].start;
+        if self.starts_line(start) {
+            return self.text[self.line_start(start)..start]
+                .chars()
+                .take_while(|c| *c == ' ' || *c == '\t')
+                .collect();
+        }
+        match self.nodes[n].parent {
+            Some(p) => format!("{}{}", self.indent_of(p), self.unit),
+            None => String::new(),
+        }
+    }
+
+    /// The indentation of `n`'s children: that of its first child on a
+    /// line of its own, else one step deeper than `n`.
+    fn child_indent(&self, n: usize) -> String {
+        self.nodes[n]
+            .children
+            .iter()
+            .find(|&&c| self.starts_line(self.nodes[c].start))
+            .map(|&c| self.indent_of(c))
+            .unwrap_or_else(|| format!("{}{}", self.indent_of(n), self.unit))
+    }
+
+    /// Insert `lines` (relative to `indent`) before the element starting at
+    /// `pos`: as whole lines when `pos` starts its line, else inline. `mark`
+    /// (a range of `lines`) becomes the pin's byte range in the edit.
+    fn insert_before(
+        &self,
+        pos: usize,
+        indent: &str,
+        lines: &[String],
+        mark: Option<Range<usize>>,
+    ) -> Edit {
+        let nl = self.nl;
+        if self.starts_line(pos) {
+            let pieces: Vec<String> = lines.iter().map(|l| format!("{indent}{l}{nl}")).collect();
+            let at = self.line_start(pos);
+            return Edit {
+                start: at,
+                end: at,
+                role: Role::Pin {
+                    mark: mark.map(|m| byte_range(&pieces, 0, m)),
+                },
+                text: pieces.concat(),
+            };
+        }
+        let pieces: Vec<String> = lines.iter().map(|l| format!("{nl}{indent}{l}")).collect();
+        let mut text = pieces.concat();
+        text.push_str(nl);
+        text.push_str(
+            &self.text[self.line_start(pos)..pos]
+                .chars()
+                .take_while(|c| *c == ' ' || *c == '\t')
+                .collect::<String>(),
+        );
+        Edit {
+            start: pos,
+            end: pos,
+            text,
+            role: Role::Pin {
+                mark: mark.map(|m| byte_range(&pieces, 0, m)),
+            },
+        }
+    }
+
+    /// Insert `lines` as the first children of `n` (expanding `<n/>`); see
+    /// [`Doc::insert_before`] for `mark`.
+    fn insert_first_child(&self, n: usize, lines: &[String], mark: Option<Range<usize>>) -> Edit {
+        let nl = self.nl;
+        let node = &self.nodes[n];
+        let indent = self.child_indent(n);
+        let pieces: Vec<String> = lines.iter().map(|l| format!("{nl}{indent}{l}")).collect();
+        let body = pieces.concat();
+        if self.is_self_closing(n) {
+            let open = format!("<{}>", node.name);
+            let text = format!("{open}{body}{nl}{}</{}>", self.indent_of(n), node.name);
+            return Edit {
+                start: node.start,
+                end: node.end,
+                text,
+                role: Role::Pin {
+                    mark: mark.map(|m| byte_range(&pieces, open.len(), m)),
+                },
+            };
+        }
+        let after = &self.masked[node.inner_start..];
+        let same_line = !after
+            .trim_start_matches([' ', '\t'])
+            .starts_with(['\r', '\n']);
+        let tail = if !same_line {
+            String::new()
+        } else if after.trim_start_matches([' ', '\t']).starts_with("</") {
+            format!("{nl}{}", self.indent_of(n))
+        } else {
+            format!("{nl}{indent}")
+        };
+        Edit {
+            start: node.inner_start,
+            end: node.inner_start,
+            text: format!("{body}{tail}"),
+            role: Role::Pin {
+                mark: mark.map(|m| byte_range(&pieces, 0, m)),
+            },
+        }
+    }
+}
+
+/// The byte range of `pieces[lines]` in `pieces.concat()`, offset by `base`.
+fn byte_range(pieces: &[String], base: usize, lines: Range<usize>) -> Range<usize> {
+    let start = base + pieces[..lines.start].iter().map(String::len).sum::<usize>();
+    let len: usize = pieces[lines].iter().map(String::len).sum();
+    start..start + len
+}
+
+/// A `socket-patch` pin in a pom.
+#[derive(Debug)]
+struct Pin {
+    /// The pin comment and its `<dependency>`, widened to whole lines.
+    start: usize,
+    end: usize,
+    uuid: String,
+    gav: String,
+    /// The value span of its `<version>`.
+    version: Option<Range<usize>>,
+}
+
+/// The pin of `patch`'s g:a:v in `doc`, from any patch uuid.
+fn pin_of(doc: &Doc, patch: &JvmPatch<'_>) -> Option<Pin> {
+    doc.pin_of_gav(&format!(
+        "{}:{}:{}",
+        patch.group_id, patch.artifact_id, patch.version
+    ))
+}
+
+fn line_at(text: &str, pos: usize) -> usize {
+    text[..pos].matches('\n').count() + 1
+}
+
+/// Past-the-end `>` of the open tag at `lt`, skipping quoted attributes.
+fn tag_end(masked: &str, lt: usize) -> Option<usize> {
+    let mut quote = None;
+    for (i, b) in masked.bytes().enumerate().skip(lt + 1) {
+        match (quote, b) {
+            (None, b'"' | b'\'') => quote = Some(b),
+            (Some(q), _) if b == q => quote = None,
+            (None, b'>') => return Some(i),
+            (None, b'<') => return None,
+            _ => {}
+        }
+    }
+    None
+}
+
+/// The closing `>` of a `<!DOCTYPE …>` (with an optional `[…]` subset).
+fn declaration_end(masked: &str, lt: usize) -> Option<usize> {
+    let gt = masked[lt..].find('>')? + lt;
+    match masked[lt..gt].find('[') {
+        Some(_) => masked[lt..].find("]>").map(|r| lt + r + 1),
+        None => Some(gt),
+    }
+}
+
+/// One indentation step: a tab when indented lines start with tabs, else
+/// the smallest space indent (default two spaces).
+fn indent_unit(masked: &str) -> String {
+    let (mut tabs, mut spaces, mut min_spaces) = (0, 0, usize::MAX);
+    for line in masked.split('\n').skip(1) {
+        let ws: &str = &line[..line.len() - line.trim_start_matches([' ', '\t']).len()];
+        if ws.is_empty() || !line[ws.len()..].starts_with('<') {
+            continue;
+        }
+        if ws.starts_with('\t') {
+            tabs += 1;
+        } else {
+            spaces += 1;
+            let n = ws.bytes().take_while(|b| *b == b' ').count();
+            min_spaces = min_spaces.min(n);
+        }
+    }
+    if tabs > spaces {
+        "\t".to_string()
+    } else if min_spaces == usize::MAX {
+        "  ".to_string()
+    } else {
+        " ".repeat(min_spaces)
+    }
+}
+
+// ── suffixed pom: a port of depscan's `suffixMavenPom` ─────────────────
+
+/// An element of the depscan pom scan (`maven-pom-scan.ts`).
+#[derive(Debug, Clone)]
+struct ScanEl {
+    name: String,
+    end_tag_close: usize,
+    inner_start: usize,
+    inner_end: usize,
+    self_closing: bool,
+}
+
+/// `None`: `lt` opens a tag; `Some(None)`: the skipped construct is
+/// unterminated; `Some(Some(end))`: resume at `end`.
+fn scan_skip_markup(text: &str, lt: usize) -> Option<Option<usize>> {
+    const SKIPPED: [(&str, &str); 3] = [("<!--", "-->"), ("<![CDATA[", "]]>"), ("<?", "?>")];
+    SKIPPED
+        .iter()
+        .find(|(open, _)| text[lt..].starts_with(open))
+        .map(|(open, close)| {
+            text[lt + open.len()..]
+                .find(close)
+                .map(|r| lt + open.len() + r + close.len())
+        })
+}
+
+fn scan_tag_name(text: &str, from: usize) -> &str {
+    let rest = &text[from..];
+    let end = rest
+        .find(|c: char| c.is_whitespace() || c == '/' || c == '>')
+        .unwrap_or(rest.len());
+    &rest[..end]
+}
+
+fn find_from(text: &str, needle: char, from: usize) -> Option<usize> {
+    text.get(from..)?.find(needle).map(|r| from + r)
+}
+
+fn byte_at(text: &str, i: usize) -> Option<u8> {
+    text.as_bytes().get(i).copied()
+}
+
+/// `(inner_end, end_tag_close)` of the element whose content starts at
+/// `inner_start` (depth counting, names unchecked, as in depscan).
+fn scan_subtree_end(text: &str, inner_start: usize) -> Option<(usize, usize)> {
+    let mut depth = 1usize;
+    let mut cursor = inner_start;
+    while cursor < text.len() {
+        let lt = find_from(text, '<', cursor)?;
+        match scan_skip_markup(text, lt) {
+            Some(None) => return None,
+            Some(Some(end)) => {
+                cursor = end;
+                continue;
+            }
+            None => {}
+        }
+        let gt = find_from(text, '>', lt)?;
+        if byte_at(text, lt + 1) == Some(b'/') {
+            depth -= 1;
+            if depth == 0 {
+                return Some((lt, gt + 1));
+            }
+        } else if gt == 0 || byte_at(text, gt - 1) != Some(b'/') {
+            depth += 1;
+        }
+        cursor = gt + 1;
+    }
+    None
+}
+
+fn scan_children_from(text: &str, content_start: usize) -> Option<Vec<ScanEl>> {
+    let mut children = Vec::new();
+    let mut cursor = content_start;
+    while cursor < text.len() {
+        let lt = find_from(text, '<', cursor)?;
+        match scan_skip_markup(text, lt) {
+            Some(None) => return None,
+            Some(Some(end)) => {
+                cursor = end;
+                continue;
+            }
+            None => {}
+        }
+        if text[lt..].starts_with("</") {
+            return Some(children);
+        }
+        let name = scan_tag_name(text, lt + 1);
+        if name.is_empty() {
+            return None;
+        }
+        let tag_end = find_from(text, '>', lt)?;
+        if byte_at(text, tag_end - 1) == Some(b'/') {
+            children.push(ScanEl {
+                name: name.to_string(),
+                end_tag_close: tag_end + 1,
+                inner_start: tag_end + 1,
+                inner_end: tag_end + 1,
+                self_closing: true,
+            });
+            cursor = tag_end + 1;
+            continue;
+        }
+        let (inner_end, end_tag_close) = scan_subtree_end(text, tag_end + 1)?;
+        children.push(ScanEl {
+            name: name.to_string(),
+            end_tag_close,
+            inner_start: tag_end + 1,
+            inner_end,
+            self_closing: false,
+        });
+        cursor = end_tag_close;
+    }
+    None
+}
+
+/// The depth-1 children of the single `<project>` element.
+fn scan_pom_project(text: &str) -> Option<Vec<ScanEl>> {
+    let mut cursor = 0;
+    while cursor < text.len() {
+        let lt = find_from(text, '<', cursor)?;
+        match scan_skip_markup(text, lt) {
+            Some(None) => return None,
+            Some(Some(end)) => {
+                cursor = end;
+                continue;
+            }
+            None => {}
+        }
+        if text[lt..].starts_with("<!") {
+            cursor = find_from(text, '>', lt + 2)? + 1;
+            continue;
+        }
+        if scan_tag_name(text, lt + 1) != "project" {
+            return None;
+        }
+        let gt = find_from(text, '>', lt)?;
+        if byte_at(text, gt - 1) == Some(b'/') {
+            return None;
+        }
+        return scan_children_from(text, gt + 1);
+    }
+    None
+}
+
+fn scan_find<'e>(children: &'e [ScanEl], name: &str) -> Option<&'e ScanEl> {
+    children.iter().find(|c| c.name == name)
+}
+
+/// Trimmed inner text of the first direct child `name` of `el`.
+fn scan_child_text(text: &str, el: &ScanEl, name: &str) -> Option<String> {
+    let children = if el.self_closing {
+        Vec::new()
+    } else {
+        scan_children_from(text, el.inner_start)?
+    };
+    scan_find(&children, name).map(|c| text[c.inner_start..c.inner_end].trim().to_string())
+}
+
+fn literalize_project_version_refs(pom: &str, base: &str) -> String {
+    let literal = pom
+        .replace("${project.version}", base)
+        .replace("${pom.version}", base);
+    let declares_version_property = scan_pom_project(&literal)
+        .and_then(|children| {
+            let properties = scan_find(&children, "properties")?.clone();
+            scan_child_text(&literal, &properties, "version")
+        })
+        .is_some();
+    if declares_version_property {
+        literal
+    } else {
+        literal.replace("${version}", base)
+    }
+}
+
+/// The upstream pom rewritten to advertise `suffixed` instead of `base`, or
+/// `None` to refuse: byte-for-byte the semantics of depscan's
+/// `suffixMavenPom` (`workspaces/app/src/patches/maven-suffix.ts`), so an
+/// offline build serves the pom the service would.
+fn suffix_maven_pom(pom: &str, base: &str, suffixed: &str) -> Option<String> {
+    let children = scan_pom_project(pom)?;
+    if let Some(version) = scan_find(&children, "version") {
+        let inner = &pom[version.inner_start..version.inner_end];
+        if inner.contains("${") || inner.trim() != base {
+            return None;
+        }
+        let spliced = format!(
+            "{}{suffixed}{}",
+            &pom[..version.inner_start],
+            &pom[version.inner_end..]
+        );
+        return Some(literalize_project_version_refs(&spliced, base));
+    }
+    let parent = scan_find(&children, "parent")?;
+    if scan_child_text(pom, parent, "version").as_deref() != Some(base) {
+        return None;
+    }
+    let at = scan_find(&children, "artifactId")?.end_tag_close;
+    let spliced = format!(
+        "{}\n  <version>{suffixed}</version>{}",
+        &pom[..at],
+        &pom[at..]
+    );
+    Some(literalize_project_version_refs(&spliced, base))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const UUID: &str = "1d3c1fd2-5e6f-4a7b-8c9d-0e1f2a3b4c5d";
+    const SV: &str = "1.10.0-socket.1d3c1fd2";
+    const TREE: &str =
+        ".socket/vendor/maven2/org/apache/commons/commons-text/1.10.0-socket.1d3c1fd2";
+    const UPSTREAM_POM: &str = "<?xml version=\"1.0\"?>\n<project>\n  <parent>\n    \
+        <groupId>org.apache.commons</groupId>\n    <artifactId>commons-parent</artifactId>\n    \
+        <version>54</version>\n  </parent>\n  <artifactId>commons-text</artifactId>\n  \
+        <version>1.10.0</version>\n</project>\n";
+
+    fn patch_with(pom: &'static str) -> JvmPatch<'static> {
+        JvmPatch {
+            group_id: "org.apache.commons",
+            artifact_id: "commons-text",
+            version: "1.10.0",
+            uuid: UUID,
+            jar: b"PK\x03\x04patched",
+            upstream_pom: pom.as_bytes(),
+            upstream_module: None,
+        }
+    }
+
+    fn patch() -> JvmPatch<'static> {
+        patch_with(UPSTREAM_POM)
+    }
+
+    type Fs = BTreeMap<String, Vec<u8>>;
+
+    fn fs(files: &[(&str, &str)]) -> Fs {
+        let mut defaults = BTreeMap::from([(
+            ".mvn/wrapper/maven-wrapper.properties".to_string(),
+            b"distributionUrl=https://repo.maven.apache.org/apache-maven-3.9.16-bin.zip\n".to_vec(),
+        )]);
+        defaults.extend(
+            files
+                .iter()
+                .map(|(p, c)| (p.to_string(), c.as_bytes().to_vec())),
+        );
+        defaults
+    }
+
+    fn run(files: &Fs) -> Result<JvmPlan, JvmRefusal> {
+        let read = |p: &str| files.get(p).cloned();
+        plan(&read, &patch())
+    }
+
+    fn applied(files: &Fs, plan: &JvmPlan) -> Fs {
+        let mut out = files.clone();
+        for w in &plan.writes {
+            out.insert(w.rel.clone(), w.bytes.clone());
+        }
+        out
+    }
+
+    /// Plan, check that re-planning the result writes nothing, and return
+    /// the post-plan files.
+    fn vendor(files: &Fs) -> (JvmPlan, Fs) {
+        let plan = run(files).expect("plan");
+        let after = applied(files, &plan);
+        let again = run(&after).expect("re-plan");
+        assert!(
+            again.writes.is_empty(),
+            "not idempotent: {:?}",
+            again.writes.iter().map(|w| &w.rel).collect::<Vec<_>>()
+        );
+        (plan, after)
+    }
+
+    fn text(files: &Fs, rel: &str) -> String {
+        String::from_utf8(files[rel].clone()).unwrap()
+    }
+
+    fn reasons(plan: &JvmPlan) -> Vec<String> {
+        plan.warnings
+            .iter()
+            .map(|w| {
+                assert_eq!(w.code, "vendor_jvm_degraded");
+                w.detail
+                    .strip_prefix("reason: ")
+                    .unwrap()
+                    .split(':')
+                    .next()
+                    .unwrap()
+                    .to_string()
+            })
+            .collect()
+    }
+
+    fn refusal_reason(r: &JvmRefusal) -> &str {
+        r.detail
+            .strip_prefix("reason: ")
+            .unwrap()
+            .split(':')
+            .next()
+            .unwrap()
+    }
+
+    fn pom_rels(plan: &JvmPlan) -> Vec<&str> {
+        plan.writes
+            .iter()
+            .filter(|w| !w.tree && w.rel.ends_with(".xml"))
+            .map(|w| w.rel.as_str())
+            .collect()
+    }
+
+    fn dep(version: &str) -> String {
+        format!(
+            "<dependency><groupId>org.apache.commons</groupId>\
+             <artifactId>commons-text</artifactId><version>{version}</version></dependency>"
+        )
+    }
+
+    const ROOT: &str = r#"<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0">
+  <modelVersion>4.0.0</modelVersion>
+  <groupId>t</groupId>
+  <artifactId>root</artifactId>
+  <version>1-SNAPSHOT</version>
+  <packaging>pom</packaging>
+  <modules>
+    <module>a</module>
+    <module>b</module>
+  </modules>
+  <build>
+    <plugins/>
+  </build>
+</project>
+"#;
+
+    fn module(name: &str, deps: &str) -> String {
+        format!(
+            "<project>\n  <modelVersion>4.0.0</modelVersion>\n  <parent>\n    \
+             <groupId>t</groupId>\n    <artifactId>root</artifactId>\n    \
+             <version>1-SNAPSHOT</version>\n  </parent>\n  <artifactId>{name}</artifactId>\n  \
+             <dependencies>\n    {deps}\n  </dependencies>\n</project>\n"
+        )
+    }
+
+    // ── declares_modules ──
+
+    #[test]
+    fn declares_modules_masks_comments_and_cdata() {
+        assert!(declares_modules(
+            "<project><modules><module>a</module></modules></project>"
+        ));
+        assert!(declares_modules("<project><modules/></project>"));
+        assert!(declares_modules(
+            "<project><subprojects><subproject>a</subproject></subprojects></project>"
+        ));
+        assert!(declares_modules(
+            "<project><profiles><profile><modules><module>a</module></modules></profile></profiles></project>"
+        ));
+        assert!(!declares_modules(
+            "<project><!-- <modules><module>a</module></modules> --></project>"
+        ));
+        assert!(!declares_modules(
+            "<project><description><![CDATA[<modules>]]></description></project>"
+        ));
+        assert!(!declares_modules("<project><modulesInfo/></project>"));
+        assert!(!declares_modules("<project><!-- <modules>"));
+        assert!(!declares_modules("<project></project>"));
+    }
+
+    // ── shapes ──
+
+    #[test]
+    fn reactor_with_parent_root_pins_root_and_rewrites_literal() {
+        let files = fs(&[
+            ("pom.xml", ROOT),
+            ("a/pom.xml", &module("a", &dep("1.10.0"))),
+            ("b/pom.xml", &module("b", "")),
+        ]);
+        let (plan, after) = vendor(&files);
+        assert!(plan.warnings.is_empty(), "{:?}", plan.warnings);
+        assert_eq!(plan.tree_dir, TREE);
+        assert_eq!(plan.jar_rel, format!("{TREE}/commons-text-{SV}.jar"));
+        assert_eq!(pom_rels(&plan), ["a/pom.xml", "pom.xml"]);
+
+        let root = text(&after, "pom.xml");
+        let expected_root = ROOT
+            .replace(
+                "  <build>\n",
+                &format!(
+                    "  <dependencyManagement>\n    <dependencies>\n      \
+                 <!-- socket-patch {UUID}: org.apache.commons:commons-text:1.10.0 -->\n      \
+                 <dependency>\n        <groupId>org.apache.commons</groupId>\n        \
+                 <artifactId>commons-text</artifactId>\n        <version>{SV}</version>\n      \
+                 </dependency>\n    </dependencies>\n  </dependencyManagement>\n  <build>\n"
+                ),
+            )
+            .replace(
+                "</project>\n",
+                &format!(
+                    "  <repositories>\n    {BEGIN_MARKER}\n    <repository>\n      \
+                 <id>socket-patch-vendor</id>\n      <url>{REPO_URL}</url>\n      \
+                 <releases><enabled>true</enabled><updatePolicy>always</updatePolicy>\
+                 <checksumPolicy>fail</checksumPolicy></releases>\n      \
+                 <snapshots><enabled>false</enabled></snapshots>\n    </repository>\n    \
+                 {END_MARKER}\n  </repositories>\n</project>\n"
+                ),
+            );
+        assert_eq!(root, expected_root);
+        assert_eq!(
+            text(&after, "a/pom.xml"),
+            module("a", &dep("1.10.0")).replace("1.10.0", SV)
+        );
+        assert!(!plan.writes.iter().any(|w| w.rel == "b/pom.xml"));
+    }
+
+    #[test]
+    fn plan_writes_tree_and_config() {
+        let files = fs(&[
+            ("pom.xml", ROOT),
+            ("a/pom.xml", &module("a", "")),
+            ("b/pom.xml", &module("b", "")),
+        ]);
+        let (plan, after) = vendor(&files);
+        let tree: Vec<&str> = plan
+            .writes
+            .iter()
+            .filter(|w| w.tree)
+            .map(|w| w.rel.as_str())
+            .collect();
+        assert_eq!(
+            tree,
+            [
+                format!("{TREE}/commons-text-{SV}.jar"),
+                format!("{TREE}/commons-text-{SV}.jar.sha1"),
+                format!("{TREE}/commons-text-{SV}.pom"),
+                format!("{TREE}/commons-text-{SV}.pom.sha1"),
+                format!("{TREE}/socket-patch.vendor.json"),
+            ]
+        );
+        assert_eq!(
+            text(&after, ".socket/vendor/maven2/.gitattributes"),
+            "* -text\n"
+        );
+        assert!(
+            plan.writes
+                .iter()
+                .any(|w| w.rel == GITATTRIBUTES_REL && !w.tree),
+            "the shared .gitattributes is an owned file, not one patch's tree file"
+        );
+        let jar_sha1 = text(&after, &format!("{TREE}/commons-text-{SV}.jar.sha1"));
+        assert_eq!(jar_sha1, sha1_hex(b"PK\x03\x04patched"));
+        assert_eq!(jar_sha1.len(), 40);
+        let pom = text(&after, &format!("{TREE}/commons-text-{SV}.pom"));
+        assert_eq!(
+            pom,
+            UPSTREAM_POM.replace(
+                "<version>1.10.0</version>",
+                &format!("<version>{SV}</version>")
+            )
+        );
+        assert_eq!(
+            text(&after, &format!("{TREE}/commons-text-{SV}.pom.sha1")),
+            sha1_hex(pom.as_bytes())
+        );
+
+        let marker = text(&after, &format!("{TREE}/socket-patch.vendor.json"));
+        assert!(marker.ends_with("}\n"));
+        let json: serde_json::Value = serde_json::from_str(&marker).unwrap();
+        let keys: Vec<&String> = json.as_object().unwrap().keys().collect();
+        assert_eq!(keys, ["files", "purl", "schema", "tool", "uuid", "version"]);
+        assert_eq!(
+            json["purl"],
+            "pkg:maven/org.apache.commons/commons-text@1.10.0"
+        );
+        assert_eq!(json["version"], SV);
+        assert_eq!(json["schema"], 1);
+        assert_eq!(json["tool"], "maven");
+        assert_eq!(json["uuid"], UUID);
+        let jar_entry = &json["files"][format!("commons-text-{SV}.jar")];
+        assert_eq!(jar_entry["size"], 11);
+        assert_eq!(jar_entry["sha256"], sha256_hex(b"PK\x03\x04patched"));
+        assert_eq!(json["files"].as_object().unwrap().len(), 4);
+        assert!(marker.contains("\n  \"files\": {\n    \"commons-text-"));
+
+        assert_eq!(
+            text(&after, ".mvn/maven.config"),
+            format!("{OFFLINE_LINE}\n{TAIL_KEY}{TAIL_DIR}\n")
+        );
+    }
+
+    #[test]
+    fn aggregator_with_separate_parent_pins_parent_only() {
+        let aggregator = "<project>\n  <groupId>t</groupId>\n  <artifactId>agg</artifactId>\n  \
+            <version>1</version>\n  <packaging>pom</packaging>\n  <modules>\n    \
+            <module>parent</module>\n    <module>a</module>\n  </modules>\n</project>\n";
+        let parent = "<project>\n  <groupId>t</groupId>\n  <artifactId>corp</artifactId>\n  \
+            <version>1</version>\n  <packaging>pom</packaging>\n</project>\n";
+        let a = format!(
+            "<project>\n  <parent>\n    <groupId>t</groupId>\n    <artifactId>corp</artifactId>\n    \
+             <version>1</version>\n    <relativePath>../parent/pom.xml</relativePath>\n  </parent>\n  \
+             <artifactId>a</artifactId>\n  <dependencies>\n    {}\n  </dependencies>\n</project>\n",
+            "<dependency><groupId>org.apache.commons</groupId><artifactId>commons-text</artifactId></dependency>"
+        );
+        let files = fs(&[
+            ("pom.xml", aggregator),
+            ("parent/pom.xml", parent),
+            ("a/pom.xml", &a),
+        ]);
+        let (plan, after) = vendor(&files);
+        assert_eq!(pom_rels(&plan), ["parent/pom.xml"]);
+        let p = text(&after, "parent/pom.xml");
+        assert!(p.contains(&format!("<version>{SV}</version>")));
+        assert!(p.contains(BEGIN_MARKER));
+        assert!(p.starts_with("<project>\n  <groupId>t</groupId>"));
+    }
+
+    #[test]
+    fn remote_parent_modules_are_their_own_local_roots() {
+        let root = "<project>\n  <groupId>t</groupId>\n  <artifactId>agg</artifactId>\n  <version>1</version>\n  \
+            <packaging>pom</packaging>\n  <modules>\n    <module>a</module>\n    <module>b</module>\n  \
+            </modules>\n</project>\n";
+        let boot = |name: &str, deps: &str| {
+            format!(
+                "<project>\n  <parent>\n    <groupId>org.springframework.boot</groupId>\n    \
+                 <artifactId>spring-boot-starter-parent</artifactId>\n    <version>3.2.0</version>\n    \
+                 <relativePath/>\n  </parent>\n  <groupId>t</groupId>\n  <artifactId>{name}</artifactId>\n  \
+                 <properties>\n    <ct.version>1.10.0</ct.version>\n  </properties>\n  \
+                 <dependencies>\n    {deps}\n  </dependencies>\n</project>\n"
+            )
+        };
+        let files = fs(&[
+            ("pom.xml", root),
+            ("a/pom.xml", &boot("a", &dep("${ct.version}"))),
+            ("b/pom.xml", &boot("b", "")),
+        ]);
+        let (plan, after) = vendor(&files);
+        assert!(plan.warnings.is_empty(), "{:?}", plan.warnings);
+        assert_eq!(pom_rels(&plan), ["a/pom.xml", "b/pom.xml"]);
+        for m in ["a", "b"] {
+            let t = text(&after, &format!("{m}/pom.xml"));
+            assert!(t.contains("<dependencyManagement>"), "{m}");
+            assert!(t.contains(BEGIN_MARKER), "{m}");
+        }
+        let a = text(&after, "a/pom.xml");
+        assert!(
+            a.contains("<ct.version>1.10.0</ct.version>"),
+            "property left alone"
+        );
+        assert_eq!(a.matches(&format!("<version>{SV}</version>")).count(), 2);
+    }
+
+    #[test]
+    fn middle_local_parent_outside_modules_is_rewritten() {
+        let root = "<project>\n  <groupId>t</groupId>\n  <artifactId>root</artifactId>\n  <version>1</version>\n  \
+            <packaging>pom</packaging>\n  <modules>\n    <module>x</module>\n  </modules>\n</project>\n";
+        let mid = format!(
+            "<project>\n  <parent>\n    <groupId>t</groupId>\n    <artifactId>root</artifactId>\n    \
+             <version>1</version>\n  </parent>\n  <artifactId>mid</artifactId>\n  <packaging>pom</packaging>\n  \
+             <dependencyManagement>\n    <dependencies>\n      {}\n    </dependencies>\n  \
+             </dependencyManagement>\n</project>\n",
+            dep("1.10.0")
+        );
+        let x = "<project>\n  <parent>\n    <groupId>t</groupId>\n    <artifactId>mid</artifactId>\n    \
+            <version>1</version>\n    <relativePath>../mid</relativePath>\n  </parent>\n  \
+            <artifactId>x</artifactId>\n</project>\n";
+        let files = fs(&[("pom.xml", root), ("mid/pom.xml", &mid), ("x/pom.xml", x)]);
+        let (plan, after) = vendor(&files);
+        assert_eq!(pom_rels(&plan), ["mid/pom.xml", "pom.xml"]);
+        assert_eq!(text(&after, "mid/pom.xml"), mid.replace("1.10.0", SV));
+        assert!(text(&after, "pom.xml").contains("<dependencyManagement>"));
+    }
+
+    #[test]
+    fn profile_literal_and_management_are_rewritten() {
+        let a = format!(
+            "<project>\n  <parent><groupId>t</groupId><artifactId>root</artifactId><version>1-SNAPSHOT</version></parent>\n  \
+             <artifactId>a</artifactId>\n  <profiles>\n    <profile>\n      <id>p</id>\n      \
+             <dependencies>{}</dependencies>\n      <dependencyManagement><dependencies>{}</dependencies></dependencyManagement>\n    \
+             </profile>\n  </profiles>\n</project>\n",
+            dep("1.10.0"),
+            dep("1.10.0")
+        );
+        let files = fs(&[
+            ("pom.xml", ROOT),
+            ("a/pom.xml", &a),
+            ("b/pom.xml", &module("b", "")),
+        ]);
+        let (_, after) = vendor(&files);
+        assert_eq!(text(&after, "a/pom.xml"), a.replace("1.10.0", SV));
+    }
+
+    #[test]
+    fn property_resolved_through_parent_chain() {
+        let root = ROOT.replace(
+            "  <modules>",
+            "  <properties>\n    <ct.major>1.10</ct.major>\n    <ct.version>${ct.major}.0</ct.version>\n  </properties>\n  <modules>",
+        );
+        let a = module("a", &dep("${ct.version}"));
+        let files = fs(&[
+            ("pom.xml", &root),
+            ("a/pom.xml", &a),
+            ("b/pom.xml", &module("b", "")),
+        ]);
+        let (plan, after) = vendor(&files);
+        assert!(plan.warnings.is_empty(), "{:?}", plan.warnings);
+        assert_eq!(text(&after, "a/pom.xml"), a.replace("${ct.version}", SV));
+        assert!(text(&after, "pom.xml").contains("<ct.version>${ct.major}.0</ct.version>"));
+    }
+
+    #[test]
+    fn maven_config_user_property_wins() {
+        let root = ROOT.replace(
+            "  <modules>",
+            "  <properties>\n    <ct.version>1.9</ct.version>\n  </properties>\n  <modules>",
+        );
+        let a = module("a", &dep("${ct.version}"));
+        let files = fs(&[
+            ("pom.xml", &root),
+            ("a/pom.xml", &a),
+            ("b/pom.xml", &module("b", "")),
+            (".mvn/maven.config", "-Dct.version=1.10.0\n"),
+        ]);
+        let (plan, after) = vendor(&files);
+        assert!(plan.warnings.is_empty(), "{:?}", plan.warnings);
+        assert_eq!(text(&after, "a/pom.xml"), a.replace("${ct.version}", SV));
+    }
+
+    #[test]
+    fn project_version_expression_resolves() {
+        let root = ROOT.replace("<version>1-SNAPSHOT</version>", "<version>1.10.0</version>");
+        let a = module("a", &dep("${project.version}")).replace("1-SNAPSHOT", "1.10.0");
+        let files = fs(&[
+            ("pom.xml", &root),
+            ("a/pom.xml", &a),
+            (
+                "b/pom.xml",
+                &module("b", "").replace("1-SNAPSHOT", "1.10.0"),
+            ),
+        ]);
+        let (_, after) = vendor(&files);
+        assert_eq!(
+            text(&after, "a/pom.xml"),
+            a.replace("${project.version}", SV)
+        );
+    }
+
+    #[test]
+    fn unresolvable_property_and_range_warn() {
+        let a = module(
+            "a",
+            &format!("{}\n    {}", dep("${remote.prop}"), dep("[1.9,2.0)")),
+        );
+        let b = module("b", &dep("LATEST"));
+        let files = fs(&[("pom.xml", ROOT), ("a/pom.xml", &a), ("b/pom.xml", &b)]);
+        let (plan, after) = vendor(&files);
+        assert_eq!(reasons(&plan), ["property_unresolved", "range", "range"]);
+        assert!(
+            plan.warnings[0].detail.contains("a/pom.xml:10:"),
+            "{}",
+            plan.warnings[0].detail
+        );
+        assert_eq!(text(&after, "a/pom.xml"), a);
+        assert!(
+            text(&after, "pom.xml").contains("<dependencyManagement>"),
+            "still pinned"
+        );
+    }
+
+    #[test]
+    fn conflicting_literal_unpins_local_root_but_keeps_other_rewrites() {
+        let a = module("a", &dep("1.9"));
+        let b = module("b", &dep("1.10.0"));
+        let files = fs(&[("pom.xml", ROOT), ("a/pom.xml", &a), ("b/pom.xml", &b)]);
+        let (plan, after) = vendor(&files);
+        assert_eq!(reasons(&plan), ["conflicting_literal_version"]);
+        let root = text(&after, "pom.xml");
+        assert!(!root.contains("<dependencyManagement>"));
+        assert!(
+            root.contains(BEGIN_MARKER),
+            "the repository still serves SV"
+        );
+        assert_eq!(text(&after, "a/pom.xml"), a);
+        assert_eq!(text(&after, "b/pom.xml"), b.replace("1.10.0", SV));
+    }
+
+    #[test]
+    fn plugin_dependencies_exclusions_and_other_types_are_untouched() {
+        let a = format!(
+            "<project>\n  <parent><groupId>t</groupId><artifactId>root</artifactId><version>1-SNAPSHOT</version></parent>\n  \
+             <artifactId>a</artifactId>\n  <dependencies>\n    \
+             <dependency><groupId>x</groupId><artifactId>y</artifactId><version>1</version>\
+             <exclusions><exclusion><groupId>org.apache.commons</groupId><artifactId>commons-text</artifactId></exclusion></exclusions></dependency>\n    \
+             <dependency><groupId>org.apache.commons</groupId><artifactId>commons-text</artifactId><version>1.10.0</version><type>test-jar</type></dependency>\n  \
+             </dependencies>\n  <build><plugins><plugin><artifactId>p</artifactId><dependencies>{}</dependencies></plugin></plugins></build>\n</project>\n",
+            dep("1.10.0")
+        );
+        let files = fs(&[
+            ("pom.xml", ROOT),
+            ("a/pom.xml", &a),
+            ("b/pom.xml", &module("b", "")),
+        ]);
+        let (plan, after) = vendor(&files);
+        assert!(plan.warnings.is_empty());
+        assert_eq!(text(&after, "a/pom.xml"), a);
+    }
+
+    #[test]
+    fn classifier_declaration_warns() {
+        let a = module(
+            "a",
+            "<dependency><groupId>org.apache.commons</groupId><artifactId>commons-text</artifactId>\
+             <version>1.10.0</version><classifier>sources</classifier></dependency>",
+        );
+        let files = fs(&[
+            ("pom.xml", ROOT),
+            ("a/pom.xml", &a),
+            ("b/pom.xml", &module("b", "")),
+        ]);
+        let (plan, after) = vendor(&files);
+        assert_eq!(reasons(&plan), ["classifier_declared"]);
+        assert_eq!(text(&after, "a/pom.xml"), a);
+    }
+
+    #[test]
+    fn existing_repositories_and_management_are_extended() {
+        let root = ROOT.replace(
+            "  <build>",
+            "  <dependencyManagement>\n    <dependencies>\n      <dependency><groupId>x</groupId><artifactId>y</artifactId><version>1</version></dependency>\n    </dependencies>\n  </dependencyManagement>\n  \
+             <repositories>\n    <repository>\n      <id>corp</id>\n      <url>https://corp</url>\n    </repository>\n  </repositories>\n  <profiles><profile><id>p</id><repositories/></profile></profiles>\n  <build>",
+        );
+        let files = fs(&[
+            ("pom.xml", &root),
+            ("a/pom.xml", &module("a", "")),
+            ("b/pom.xml", &module("b", "")),
+        ]);
+        let (_, after) = vendor(&files);
+        let out = text(&after, "pom.xml");
+        assert!(out.contains(&format!(
+            "    <dependencies>\n      <!-- socket-patch {UUID}: org.apache.commons:commons-text:1.10.0 -->\n      <dependency>\n        <groupId>org.apache.commons</groupId>"
+        )));
+        assert!(out.contains(&format!(
+            "      <url>https://corp</url>\n    </repository>\n    {BEGIN_MARKER}\n    <repository>\n      <id>socket-patch-vendor</id>"
+        )));
+        assert!(out.contains(&format!(
+            "    {END_MARKER}\n  </repositories>\n  <profiles>"
+        )));
+        assert_eq!(out.matches("<repositories>").count(), 1);
+    }
+
+    #[test]
+    fn existing_base_management_is_rewritten_not_duplicated() {
+        let root = ROOT.replace(
+            "  <build>",
+            &format!("  <dependencyManagement><dependencies>{}</dependencies></dependencyManagement>\n  <build>", dep("1.10.0")),
+        );
+        let files = fs(&[
+            ("pom.xml", &root),
+            ("a/pom.xml", &module("a", "")),
+            ("b/pom.xml", &module("b", "")),
+        ]);
+        let (_, after) = vendor(&files);
+        let out = text(&after, "pom.xml");
+        assert!(!out.contains("socket-patch 1d3c"), "no second entry");
+        assert!(out.contains(&dep(SV)));
+    }
+
+    #[test]
+    fn crlf_and_tabs_are_preserved() {
+        let root = "<project>\r\n\t<groupId>t</groupId>\r\n\t<artifactId>root</artifactId>\r\n\t<version>1</version>\r\n\t\
+            <packaging>pom</packaging>\r\n\t<!-- keep me -->\r\n\t<modules>\r\n\t\t<module>a</module>\r\n\t</modules>\r\n\t\
+            <dependencies>\r\n\t</dependencies>\r\n</project>\r\n";
+        let a = "<project>\r\n\t<parent>\r\n\t\t<groupId>t</groupId>\r\n\t\t<artifactId>root</artifactId>\r\n\t\t<version>1</version>\r\n\t</parent>\r\n\t\
+            <artifactId>a</artifactId>\r\n\t<dependencies>\r\n\t\t<dependency>\r\n\t\t\t<groupId>org.apache.commons</groupId>\r\n\t\t\t\
+            <artifactId>commons-text</artifactId>\r\n\t\t\t<version>1.10.0</version>\r\n\t\t</dependency>\r\n\t</dependencies>\r\n</project>\r\n";
+        let files = fs(&[("pom.xml", root), ("a/pom.xml", a)]);
+        let (_, after) = vendor(&files);
+        let out = text(&after, "pom.xml");
+        assert!(
+            !out.replace("\r\n", "").contains('\n'),
+            "only CRLF: {out:?}"
+        );
+        assert!(out.starts_with("<project>\r\n\t<groupId>t</groupId>\r\n\t<artifactId>root</artifactId>\r\n\t<version>1</version>\r\n\t<packaging>pom</packaging>\r\n\t<!-- keep me -->"));
+        assert!(out
+            .contains("\t<dependencyManagement>\r\n\t\t<dependencies>\r\n\t\t\t<!-- socket-patch"));
+        assert!(
+            out.contains("\t\t\t<dependency>\r\n\t\t\t\t<groupId>org.apache.commons</groupId>\r\n")
+        );
+        assert!(out.contains("\t</dependencyManagement>\r\n\t<dependencies>\r\n\t</dependencies>\r\n\t<repositories>\r\n\t\t<!-- socket-patch:begin -->\r\n\t\t<repository>\r\n\t\t\t<id>"));
+        assert!(out.ends_with("\t</repositories>\r\n</project>\r\n"));
+        assert_eq!(text(&after, "a/pom.xml"), a.replace("1.10.0", SV));
+    }
+
+    #[test]
+    fn single_line_poms_and_self_closing_sections() {
+        let root = "<project><groupId>t</groupId><artifactId>r</artifactId><version>1</version><packaging>pom</packaging>\
+            <modules><module>a</module></modules><dependencyManagement/><repositories/></project>";
+        let a = "<project><parent><groupId>t</groupId><artifactId>r</artifactId><version>1</version></parent><artifactId>a</artifactId></project>";
+        let files = fs(&[("pom.xml", root), ("a/pom.xml", a)]);
+        let (_, after) = vendor(&files);
+        let out = text(&after, "pom.xml");
+        let doc = Doc::parse(out.clone()).expect("well-formed");
+        let dm = doc.child(doc.project, "dependencyManagement").unwrap();
+        let deps = doc.child(dm, "dependencies").unwrap();
+        assert_eq!(doc.children(deps, "dependency").count(), 1);
+        let repos = doc.child(doc.project, "repositories").unwrap();
+        assert_eq!(
+            doc.child_text(doc.child(repos, "repository").unwrap(), "id")
+                .as_deref(),
+            Some(REPO_ID)
+        );
+        assert_eq!(out.matches("<repositories>").count(), 1);
+    }
+
+    #[test]
+    fn enforcer_repository_ban_omits_fallback() {
+        let root = ROOT.replace(
+            "<plugins/>",
+            "<plugins><plugin><artifactId>maven-enforcer-plugin</artifactId><configuration><rules><requireNoRepositories/></rules></configuration></plugin></plugins>",
+        );
+        let files = fs(&[
+            ("pom.xml", &root),
+            ("a/pom.xml", &module("a", "")),
+            ("b/pom.xml", &module("b", "")),
+        ]);
+        let (plan, after) = vendor(&files);
+        assert_eq!(reasons(&plan), ["maven_fallback_omitted"]);
+        let out = text(&after, "pom.xml");
+        assert!(!out.contains(BEGIN_MARKER));
+        assert!(out.contains("<dependencyManagement>"));
+        assert!(after.contains_key(".mvn/maven.config"));
+    }
+
+    #[test]
+    fn commented_enforcer_rule_does_not_ban() {
+        let root = ROOT.replace("<plugins/>", "<plugins/><!-- <bannedRepositories/> -->");
+        let files = fs(&[
+            ("pom.xml", &root),
+            ("a/pom.xml", &module("a", "")),
+            ("b/pom.xml", &module("b", "")),
+        ]);
+        let (plan, _) = vendor(&files);
+        assert!(plan.warnings.is_empty());
+    }
+
+    #[test]
+    fn deployed_reactor_warns() {
+        let root = ROOT.replace("  <build>", "  <distributionManagement><repository><id>r</id><url>https://r</url></repository></distributionManagement>\n  <build>");
+        let files = fs(&[
+            ("pom.xml", &root),
+            ("a/pom.xml", &module("a", &dep("1.10.0"))),
+            ("b/pom.xml", &module("b", "")),
+        ]);
+        let (plan, after) = vendor(&files);
+        assert_eq!(reasons(&plan), ["publishes_suffixed_poms"]);
+        let out = text(&after, "pom.xml");
+        let doc = Doc::parse(out).unwrap();
+        let dist = doc.child(doc.project, "distributionManagement").unwrap();
+        assert!(doc.child(dist, "repository").is_some());
+        assert!(
+            doc.child(doc.project, "repositories").is_some(),
+            "top-level repositories, not in distributionManagement"
+        );
+    }
+
+    #[test]
+    fn nested_modules_custom_files_and_normalized_paths() {
+        let root = ROOT.replace(
+            "<module>b</module>",
+            "<module>./b/</module>\n    <module>c/custom.xml</module>",
+        );
+        let b = "<project>\n  <parent><groupId>t</groupId><artifactId>root</artifactId><version>1-SNAPSHOT</version></parent>\n  \
+            <artifactId>b</artifactId>\n  <packaging>pom</packaging>\n  <modules><module>../b/inner</module></modules>\n</project>\n";
+        let inner = "<project>\n  <parent><groupId>t</groupId><artifactId>b</artifactId><version>1-SNAPSHOT</version></parent>\n  \
+            <artifactId>inner</artifactId>\n  <dependencies>DEPS</dependencies>\n</project>\n"
+            .replace("DEPS", &dep("1.10.0"));
+        let c = module("c", &dep("1.10.0")).replace(
+            "<parent>",
+            "<parent><relativePath>../pom.xml</relativePath>",
+        );
+        let files = fs(&[
+            ("pom.xml", &root),
+            ("a/pom.xml", &module("a", "")),
+            ("b/pom.xml", b),
+            ("b/inner/pom.xml", &inner),
+            ("c/custom.xml", &c),
+        ]);
+        let (plan, after) = vendor(&files);
+        assert_eq!(
+            pom_rels(&plan),
+            ["b/inner/pom.xml", "c/custom.xml", "pom.xml"]
+        );
+        assert_eq!(text(&after, "b/inner/pom.xml"), inner.replace("1.10.0", SV));
+    }
+
+    #[test]
+    fn mismatched_or_missing_parent_is_remote() {
+        let root = ROOT.to_string();
+        // `a` names a parent that is not the root pom: it is its own local root.
+        let a = module("a", &dep("1.10.0")).replace(
+            "<artifactId>root</artifactId>",
+            "<artifactId>other</artifactId>",
+        );
+        let b = module("b", "").replace(
+            "<version>1-SNAPSHOT</version>\n  </parent>",
+            "<version>2</version>\n  </parent>",
+        );
+        let files = fs(&[("pom.xml", &root), ("a/pom.xml", &a), ("b/pom.xml", &b)]);
+        let (plan, after) = vendor(&files);
+        assert_eq!(pom_rels(&plan), ["a/pom.xml", "b/pom.xml"]);
+        assert!(text(&after, "a/pom.xml").contains("<dependencyManagement>"));
+        assert!(text(&after, "b/pom.xml").contains(BEGIN_MARKER));
+        assert!(
+            !after["pom.xml"].windows(3).any(|w| w == b"soc"),
+            "aggregator untouched"
+        );
+    }
+
+    #[test]
+    fn inherited_group_id_counts_for_parent_match() {
+        let root = ROOT.replace("<module>b</module>", "");
+        let a = "<project>\n  <parent><groupId>t</groupId><artifactId>root</artifactId><version>1-SNAPSHOT</version></parent>\n  \
+            <artifactId>a</artifactId>\n  <packaging>pom</packaging>\n  <modules><module>x</module></modules>\n</project>\n";
+        let x = format!(
+            "<project>\n  <parent><groupId>t</groupId><artifactId>a</artifactId><version>1-SNAPSHOT</version></parent>\n  \
+             <artifactId>x</artifactId>\n  <dependencies>{}</dependencies>\n</project>\n",
+            dep("1.10.0")
+        );
+        let files = fs(&[("pom.xml", &root), ("a/pom.xml", a), ("a/x/pom.xml", &x)]);
+        let (plan, _) = vendor(&files);
+        assert_eq!(pom_rels(&plan), ["a/x/pom.xml", "pom.xml"]);
+    }
+
+    // ── refusals ──
+
+    fn refused(files: &[(&str, &str)]) -> JvmRefusal {
+        run(&fs(files)).expect_err("refused")
+    }
+
+    #[test]
+    fn refusals() {
+        let with = |m: &str| ROOT.replace("<module>b</module>", &format!("<module>{m}</module>"));
+        let a = module("a", "");
+        let r = refused(&[("pom.xml", &with("../elsewhere")), ("a/pom.xml", &a)]);
+        assert_eq!(
+            (r.code, refusal_reason(&r)),
+            (SHAPE_UNSUPPORTED, "module_outside_root")
+        );
+        let r = refused(&[("pom.xml", &with("/abs")), ("a/pom.xml", &a)]);
+        assert_eq!(refusal_reason(&r), "module_outside_root");
+        let r = refused(&[("pom.xml", &with("${m}")), ("a/pom.xml", &a)]);
+        assert_eq!(refusal_reason(&r), "module_path_unresolvable");
+        let r = refused(&[("pom.xml", &with("missing")), ("a/pom.xml", &a)]);
+        assert_eq!(refusal_reason(&r), "module_path_unresolvable");
+        for f in NESTED_MVN_FILES {
+            let r = refused(&[
+                ("pom.xml", &with("a")),
+                ("a/pom.xml", &a),
+                (&format!("a/.mvn/{f}"), ""),
+            ]);
+            assert_eq!(refusal_reason(&r), "nested_mvn_dir", "{f}");
+        }
+        let mut files = fs(&[("pom.xml", ROOT), ("b/pom.xml", &module("b", ""))]);
+        files.insert("a/pom.xml".into(), vec![0xff, 0xfe]);
+        let r = run(&files).unwrap_err();
+        assert_eq!(refusal_reason(&r), "build_file_unreadable");
+        let r = refused(&[
+            ("pom.xml", ROOT),
+            ("a/pom.xml", "<project><a></b></project>"),
+            ("b/pom.xml", &a),
+        ]);
+        assert_eq!(refusal_reason(&r), "build_file_unreadable");
+        let r = refused(&[]);
+        assert_eq!(refusal_reason(&r), "no_build_file");
+    }
+
+    #[test]
+    fn root_mvn_dir_is_not_nested() {
+        let files = fs(&[
+            ("pom.xml", ROOT),
+            ("a/pom.xml", &module("a", "")),
+            ("b/pom.xml", &module("b", "")),
+            (".mvn/extensions.xml", "<extensions/>"),
+        ]);
+        vendor(&files);
+    }
+
+    #[test]
+    fn suffix_unavailable_refuses() {
+        let files = fs(&[
+            ("pom.xml", ROOT),
+            ("a/pom.xml", &module("a", "")),
+            ("b/pom.xml", &module("b", "")),
+        ]);
+        let read = |p: &str| files.get(p).cloned();
+        let r = plan(
+            &read,
+            &patch_with("<project><version>${revision}</version></project>"),
+        )
+        .unwrap_err();
+        assert_eq!(r.code, UPSTREAM_UNAVAILABLE);
+        assert_eq!(refusal_reason(&r), "suffix_unavailable");
+    }
+
+    // ── maven.config ──
+
+    fn config(before: &str) -> String {
+        String::from_utf8(merge_maven_config(Some(before.as_bytes())).0).unwrap()
+    }
+
+    #[test]
+    fn maven_config_merges() {
+        let ours = format!("{OFFLINE_LINE}\n{TAIL_KEY}{TAIL_DIR}\n");
+        assert_eq!(String::from_utf8(merge_maven_config(None).0).unwrap(), ours);
+        assert_eq!(config(""), ours);
+        assert_eq!(config(&ours), ours);
+        assert_eq!(config("-T4\n-ntp"), format!("-T4\n-ntp\n{ours}"));
+        assert_eq!(
+            config("-T4\r\n"),
+            format!("-T4\r\n{OFFLINE_LINE}\r\n{TAIL_KEY}{TAIL_DIR}\r\n")
+        );
+        assert_eq!(
+            config(&format!("{TAIL_KEY}/opt/repo\n-T4\n{OFFLINE_LINE}\n")),
+            format!("{TAIL_KEY}/opt/repo,{TAIL_DIR}\n-T4\n{OFFLINE_LINE}\n")
+        );
+        assert_eq!(
+            config(&format!("{TAIL_KEY}/opt/repo,{TAIL_DIR}\n{OFFLINE_LINE}\n")),
+            format!("{TAIL_KEY}/opt/repo,{TAIL_DIR}\n{OFFLINE_LINE}\n")
+        );
+        assert_eq!(
+            config("-Daether.offline.protocols=http\n"),
+            format!("-Daether.offline.protocols=http,file\n{TAIL_KEY}{TAIL_DIR}\n")
+        );
+        assert_eq!(config(OFFLINE_LINE), ours);
+    }
+
+    // ── suffixMavenPom port (goldens shared with depscan's maven-suffix.test.ts) ──
+
+    const DS_SV: &str = "2.1.0-socket.3fa85f64";
+
+    #[test]
+    fn suffix_replaces_literal_version_only() {
+        let pom = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project xmlns=\"http://maven.apache.org/POM/4.0.0\">\n  \
+            <modelVersion>4.0.0</modelVersion>\n  <groupId>com.acme</groupId>\n  <artifactId>widget</artifactId>\n  \
+            <version>2.1.0</version>\n  <packaging>jar</packaging>\n  <dependencies>\n    <dependency>\n      \
+            <groupId>com.google.guava</groupId>\n      <artifactId>guava</artifactId>\n      \
+            <version>32.1.3-jre</version>\n    </dependency>\n  </dependencies>\n</project>\n";
+        let out = suffix_maven_pom(pom, "2.1.0", DS_SV).unwrap();
+        assert_eq!(out.replace(DS_SV, "2.1.0"), pom);
+        assert!(out.contains("<version>32.1.3-jre</version>"));
+    }
+
+    #[test]
+    fn suffix_trims_version_whitespace() {
+        let pom = "<project>\n  <groupId>g</groupId>\n  <artifactId>a</artifactId>\n  <version>\n    1.4.2\n  </version>\n</project>\n";
+        let out = suffix_maven_pom(pom, "1.4.2", "1.4.2-socket.3fa85f64").unwrap();
+        assert!(out.contains("<version>1.4.2-socket.3fa85f64</version>"));
+    }
+
+    #[test]
+    fn suffix_inserts_inherited_version_after_artifact_id() {
+        let pom = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<project xmlns=\"http://maven.apache.org/POM/4.0.0\">\n  \
+            <modelVersion>4.0.0</modelVersion>\n  <parent>\n    <groupId>org.slf4j</groupId>\n    \
+            <artifactId>slf4j-parent</artifactId>\n    <version>2.0.9</version>\n  </parent>\n  \
+            <artifactId>slf4j-api</artifactId>\n  <packaging>jar</packaging>\n</project>\n";
+        let sv = "2.0.9-socket.3fa85f64";
+        let out = suffix_maven_pom(pom, "2.0.9", sv).unwrap();
+        assert!(out.contains(&format!(
+            "<artifactId>slf4j-api</artifactId>\n  <version>{sv}</version>"
+        )));
+        assert_eq!(
+            out.replace(&format!("\n  <version>{sv}</version>"), ""),
+            pom
+        );
+        // The inserted line is LF even in a CRLF pom, exactly as the server does.
+        let crlf = pom.replace('\n', "\r\n");
+        let out = suffix_maven_pom(&crlf, "2.0.9", sv).unwrap();
+        assert!(out.contains(&format!("</artifactId>\n  <version>{sv}</version>\r\n")));
+    }
+
+    #[test]
+    fn suffix_refusals() {
+        let sv = "1.0.0-socket.3fa85f64";
+        for pom in [
+            "<project>\n  <groupId>g</groupId>\n  <artifactId>a</artifactId>\n  <version>${revision}</version>\n</project>\n",
+            "<project>\n  <groupId>g</groupId>\n  <artifactId>a</artifactId>\n  <version>9.9.9</version>\n</project>\n",
+            "<project>\n  <groupId>g</groupId>\n  <artifactId>a</artifactId>\n  <dependencies>\n    <dependency>\n      \
+             <groupId>x</groupId>\n      <artifactId>y</artifactId>\n      <version>1.0.0</version>\n    </dependency>\n  \
+             </dependencies>\n</project>\n",
+            "<project>\n  <parent>\n    <groupId>g</groupId>\n    <artifactId>p</artifactId>\n    <version>1.0.0</version>\n  \
+             </parent>\n  <packaging>jar</packaging>\n</project>\n",
+            "<project>\n  <parent>\n    <groupId>g</groupId>\n    <artifactId>p</artifactId>\n    <version>2.0.0</version>\n  \
+             </parent>\n  <artifactId>a</artifactId>\n</project>\n",
+            "<notproject/>",
+            "<project/>",
+            "<project><version>1.0.0</version><!-- unterminated",
+            "",
+        ] {
+            assert_eq!(suffix_maven_pom(pom, "1.0.0", sv), None, "{pom}");
+        }
+    }
+
+    #[test]
+    fn suffix_ignores_commented_version() {
+        let pom = "<project>\n  <groupId>g</groupId>\n  <artifactId>a</artifactId>\n  \
+            <!-- old <version>0.0.1</version> for reference -->\n  <version>2.1.0</version>\n</project>\n";
+        let out = suffix_maven_pom(pom, "2.1.0", DS_SV).unwrap();
+        assert!(out.contains(&format!("<version>{DS_SV}</version>")));
+        assert!(out.contains("<!-- old <version>0.0.1</version> for reference -->"));
+    }
+
+    #[test]
+    fn suffix_literalizes_project_version_refs() {
+        let sv = "1.0.0-socket.3fa85f64";
+        let pom = "<project>\n  <groupId>com.example</groupId>\n  <artifactId>widget</artifactId>\n  <version>1.0.0</version>\n  \
+            <properties>\n    <api.version>${pom.version}</api.version>\n  </properties>\n  <dependencies>\n    <dependency>\n      \
+            <groupId>com.example</groupId>\n      <artifactId>widget-api</artifactId>\n      <version>${project.version}</version>\n    \
+            </dependency>\n  </dependencies>\n</project>\n";
+        assert_eq!(
+            suffix_maven_pom(pom, "1.0.0", sv).unwrap(),
+            pom.replace(
+                "<version>1.0.0</version>",
+                &format!("<version>{sv}</version>")
+            )
+            .replace("${pom.version}", "1.0.0")
+            .replace("${project.version}", "1.0.0")
+        );
+        let legacy = "<project>\n  <groupId>c</groupId>\n  <artifactId>w</artifactId>\n  <version>1.0.0</version>\n  \
+            <dependencies>\n    <dependency>\n      <version>${version}</version>\n    </dependency>\n  </dependencies>\n</project>\n";
+        assert_eq!(
+            suffix_maven_pom(legacy, "1.0.0", sv).unwrap(),
+            legacy
+                .replacen(
+                    "<version>1.0.0</version>",
+                    &format!("<version>{sv}</version>"),
+                    1
+                )
+                .replace("${version}", "1.0.0")
+        );
+        let declared = legacy.replace(
+            "  <dependencies>",
+            "  <properties>\n    <version>2.0.0</version>\n  </properties>\n  <dependencies>",
+        );
+        assert_eq!(
+            suffix_maven_pom(&declared, "1.0.0", sv).unwrap(),
+            declared.replacen(
+                "<version>1.0.0</version>",
+                &format!("<version>{sv}</version>"),
+                1
+            )
+        );
+    }
+
+    #[test]
+    fn suffix_multi_module_pom_keeps_modules() {
+        let pom = "<project>\n  <groupId>com.acme</groupId>\n  <artifactId>parent</artifactId>\n  <version>5.0.0</version>\n  \
+            <packaging>pom</packaging>\n  <modules>\n    <module>core</module>\n  </modules>\n</project>\n";
+        let out = suffix_maven_pom(pom, "5.0.0", "5.0.0-socket.3fa85f64").unwrap();
+        assert!(out.contains("<version>5.0.0-socket.3fa85f64</version>"));
+        assert!(out.contains("<module>core</module>"));
+    }
+
+    // ── scanner ──
+
+    #[test]
+    fn doc_parse_handles_prolog_doctype_attributes_and_cdata() {
+        let doc = Doc::parse(
+            "\u{feff}<?xml version=\"1.0\"?>\n<!DOCTYPE project [<!ENTITY x \"y\">]>\n<project a=\"x>y\">\
+             <name><![CDATA[a <b> c]]></name><v> 1 <!-- c --> </v></project>"
+                .to_string(),
+        )
+        .unwrap();
+        assert_eq!(
+            doc.child_text(doc.project, "name").as_deref(),
+            Some("a <b> c")
+        );
+        let v = doc.child(doc.project, "v").unwrap();
+        assert_eq!(doc.text_of(v), "1");
+        assert_eq!(&doc.text[doc.value_span(v)], "1");
+        for bad in [
+            "<project>",
+            "<project></other>",
+            "<a/><project></project>",
+            "<project><!-- x</project>",
+            "</project>",
+        ] {
+            assert!(Doc::parse(bad.to_string()).is_err(), "{bad}");
+        }
+    }
+
+    #[test]
+    fn indent_unit_detection() {
+        assert_eq!(indent_unit("<p>\n    <a/>\n        <b/>\n</p>"), "    ");
+        assert_eq!(indent_unit("<p>\n\t<a/>\n</p>"), "\t");
+        assert_eq!(indent_unit("<p><a/></p>"), "  ");
+    }
+
+    #[test]
+    fn normalize_paths() {
+        assert_eq!(normalize("", "a/./b/"), Some("a/b".into()));
+        assert_eq!(normalize("a", "../b"), Some("b".into()));
+        assert_eq!(normalize("a", ".."), Some(String::new()));
+        assert_eq!(normalize("a", "..\\b"), Some("b".into()));
+        assert_eq!(normalize("", "../x"), None);
+        assert_eq!(normalize("", "C:/x"), None);
+        assert_eq!(normalize("", "/x"), None);
+    }
+
+    // ── revert, peers and patch updates (disk round-trips) ──
+
+    use super::super::{testing, Shape};
+
+    const UUID_B: &str = "abcdef01-5e6f-4a7b-8c9d-0e1f2a3b4c5d";
+    const UUID_2: &str = "99999999-5e6f-4a7b-8c9d-0e1f2a3b4c5d";
+    const SV_2: &str = "1.10.0-socket.99999999";
+
+    fn patch_b() -> JvmPatch<'static> {
+        JvmPatch {
+            group_id: "org.example",
+            artifact_id: "lib",
+            version: "2.0",
+            uuid: UUID_B,
+            jar: b"PK\x03\x04B",
+            upstream_pom: b"<project><groupId>org.example</groupId><artifactId>lib</artifactId><version>2.0</version></project>\n",
+            upstream_module: None,
+        }
+    }
+
+    fn lib_dep(version: &str) -> String {
+        format!(
+            "<dependency><groupId>org.example</groupId><artifactId>lib</artifactId>\
+             <version>{version}</version></dependency>"
+        )
+    }
+
+    fn disk(files: &[(&str, &str)]) -> tempfile::TempDir {
+        let dir = tempfile::tempdir().unwrap();
+        testing::populate(dir.path(), files);
+        dir
+    }
+
+    fn replan_writes(root: &std::path::Path, p: &JvmPatch<'_>) -> Vec<String> {
+        let reader = super::super::apply::ProjectReader::new(root);
+        plan(&|rel: &str| reader.read(rel), p)
+            .unwrap()
+            .writes
+            .into_iter()
+            .map(|w| w.rel)
+            .collect()
+    }
+
+    fn all_text(root: &std::path::Path) -> String {
+        testing::snapshot(root)
+            .into_iter()
+            .filter(|(rel, _)| rel.ends_with(".xml") || rel.ends_with(".config"))
+            .map(|(_, b)| String::from_utf8(b).unwrap())
+            .collect()
+    }
+
+    /// Reverting either of two patches that share the repository block,
+    /// the created management section, `maven.config` and the tree
+    /// `.gitattributes` leaves the other fully wired (re-planning it writes
+    /// nothing); reverting both restores every byte and directory.
+    #[tokio::test]
+    async fn two_patches_revert_in_either_order_byte_exact() {
+        for first_a in [true, false] {
+            let a_pom = module("a", &format!("{}\n    {}", dep("1.10.0"), lib_dep("2.0")));
+            let dir = disk(&[
+                ("pom.xml", ROOT),
+                ("a/pom.xml", &a_pom),
+                ("b/pom.xml", &module("b", "")),
+            ]);
+            let root = dir.path();
+            let (pristine, pristine_dirs) = (testing::snapshot(root), testing::dirs(root));
+            let mut ledger = BTreeMap::new();
+            let (pa, pb) = (patch(), patch_b());
+            let plan_a = testing::vendor(root, Shape::MavenReactor, &pa, &mut ledger)
+                .await
+                .unwrap();
+            let plan_b = testing::vendor(root, Shape::MavenReactor, &pb, &mut ledger)
+                .await
+                .unwrap();
+            assert!(!plan_b.writes.iter().any(|w| w.rel == GITATTRIBUTES_REL));
+            let (first, second, second_plan) = if first_a {
+                (&pa, &pb, &plan_b)
+            } else {
+                (&pb, &pa, &plan_a)
+            };
+            let out = testing::revert(root, first, &mut ledger).await;
+            assert!(
+                out.success && out.warnings.is_empty() && !out.kept_artifact,
+                "{out:?}"
+            );
+            assert!(
+                replan_writes(root, second).is_empty(),
+                "the remaining patch lost wiring: {:?}",
+                replan_writes(root, second)
+            );
+            assert!(root.join(&second_plan.jar_rel).is_file());
+            assert!(root.join(GITATTRIBUTES_REL).is_file());
+            assert!(!all_text(root).contains(&first.suffixed_version()));
+            let out = testing::revert(root, second, &mut ledger).await;
+            assert!(out.success && out.warnings.is_empty(), "{out:?}");
+            assert_eq!(testing::snapshot(root), pristine, "first_a={first_a}");
+            assert_eq!(testing::dirs(root), pristine_dirs, "first_a={first_a}");
+        }
+    }
+
+    /// The same on single-line poms whose sections are self-closing (every
+    /// insertion is inline, and the created shells expand `<x/>`).
+    #[tokio::test]
+    async fn two_patches_on_single_line_poms_revert_in_either_order_byte_exact() {
+        let root_pom = "<project><modelVersion>4.0.0</modelVersion><groupId>t</groupId>\
+            <artifactId>root</artifactId><version>1</version><packaging>pom</packaging>\
+            <modules><module>a</module></modules><dependencyManagement/><repositories/></project>";
+        let a_pom = format!(
+            "<project><parent><groupId>t</groupId><artifactId>root</artifactId>\
+             <version>1</version></parent><artifactId>a</artifactId><dependencies>{}{}\
+             </dependencies></project>",
+            dep("1.10.0"),
+            lib_dep("2.0")
+        );
+        for first_a in [true, false] {
+            let dir = disk(&[("pom.xml", root_pom), ("a/pom.xml", &a_pom)]);
+            let root = dir.path();
+            let pristine = testing::snapshot(root);
+            let mut ledger = BTreeMap::new();
+            let (pa, pb) = (patch(), patch_b());
+            testing::vendor(root, Shape::MavenReactor, &pa, &mut ledger)
+                .await
+                .unwrap();
+            testing::vendor(root, Shape::MavenReactor, &pb, &mut ledger)
+                .await
+                .unwrap();
+            let (first, second) = if first_a { (&pa, &pb) } else { (&pb, &pa) };
+            let out = testing::revert(root, first, &mut ledger).await;
+            assert!(out.success && out.warnings.is_empty(), "{out:?}");
+            assert!(replan_writes(root, second).is_empty());
+            let out = testing::revert(root, second, &mut ledger).await;
+            assert!(out.success && out.warnings.is_empty(), "{out:?}");
+            assert_eq!(testing::snapshot(root), pristine, "first_a={first_a}");
+        }
+    }
+
+    /// A same-uuid re-run that edits a file again keeps the first run's
+    /// records (carried-forward fragments), so revert still restores
+    /// the pristine pom and deletes the tree only once nothing names it.
+    #[tokio::test]
+    async fn same_uuid_rerun_keeps_the_first_runs_originals() {
+        let dir = disk(&[
+            ("pom.xml", ROOT),
+            ("a/pom.xml", &module("a", &dep("1.10.0"))),
+            ("b/pom.xml", &module("b", "")),
+        ]);
+        let root = dir.path();
+        let mut ledger = BTreeMap::new();
+        let p = patch();
+        testing::vendor(root, Shape::MavenReactor, &p, &mut ledger)
+            .await
+            .unwrap();
+        let test_dep = dep("1.10.0").replace("<dependency>", "<dependency><scope>test</scope>");
+        let added = |pom: &str| {
+            pom.replace(
+                "  </dependencies>",
+                &format!("    {test_dep}\n  </dependencies>"),
+            )
+        };
+        let a1 = std::fs::read_to_string(root.join("a/pom.xml")).unwrap();
+        std::fs::write(root.join("a/pom.xml"), added(&a1)).unwrap();
+        let run2 = testing::vendor(root, Shape::MavenReactor, &p, &mut ledger)
+            .await
+            .unwrap();
+        assert_eq!(pom_rels(&run2), ["a/pom.xml"]);
+        let out = testing::revert(root, &p, &mut ledger).await;
+        assert!(out.success && out.warnings.is_empty(), "{out:?}");
+        assert_eq!(
+            std::fs::read_to_string(root.join("a/pom.xml")).unwrap(),
+            added(&module("a", &dep("1.10.0")))
+        );
+        assert_eq!(std::fs::read_to_string(root.join("pom.xml")).unwrap(), ROOT);
+        assert!(!root.join(".socket").exists() && !root.join(".mvn").exists());
+    }
+
+    /// A patch update (same GAV, new uuid) re-points the pin and every
+    /// rewritten declaration at the new suffixed version, sweeps the old
+    /// tree, and still reverts to the pristine poms, `${p}` included.
+    #[tokio::test]
+    async fn patch_update_rewires_to_the_new_uuid_and_reverts_pristine() {
+        let root_pom = ROOT.replace(
+            "  <modules>",
+            "  <properties>\n    <ct.version>1.10.0</ct.version>\n  </properties>\n  <modules>",
+        );
+        let dir = disk(&[
+            ("pom.xml", &root_pom),
+            ("a/pom.xml", &module("a", &dep("${ct.version}"))),
+            ("b/pom.xml", &module("b", &dep("1.10.0"))),
+        ]);
+        let root = dir.path();
+        std::fs::create_dir_all(root.join(".mvn/wrapper")).unwrap();
+        std::fs::write(
+            root.join(".mvn/wrapper/maven-wrapper.properties"),
+            "distributionUrl=https://example.test/apache-maven-3.9.16-bin.zip\n",
+        )
+        .unwrap();
+        let pristine = testing::snapshot(root);
+        let mut ledger = BTreeMap::new();
+        let p1 = patch();
+        let plan1 = testing::vendor(root, Shape::MavenReactor, &p1, &mut ledger)
+            .await
+            .unwrap();
+        let mut p2 = patch();
+        p2.uuid = UUID_2;
+        let plan2 = testing::vendor(root, Shape::MavenReactor, &p2, &mut ledger)
+            .await
+            .unwrap();
+        assert!(plan2.warnings.is_empty(), "{:?}", plan2.warnings);
+        let poms = all_text(root);
+        assert!(!poms.contains("1d3c1fd2"), "old uuid left behind:\n{poms}");
+        assert_eq!(poms.matches(SV_2).count(), 3, "pin + a + b:\n{poms}");
+        assert!(poms.contains(&format!("{PIN_TAG}{UUID_2}:")));
+        assert!(!root.join(&plan1.tree_dir).exists(), "old tree swept");
+        assert!(root.join(&plan2.jar_rel).is_file());
+        assert!(replan_writes(root, &p2).is_empty());
+        let out = testing::revert(root, &p2, &mut ledger).await;
+        assert!(out.success && out.warnings.is_empty(), "{out:?}");
+        assert_eq!(testing::snapshot(root), pristine);
+    }
+
+    /// Without a ledger original (the peer entry is gone), a declaration at
+    /// the suffixed version reverts to the base literal.
+    #[test]
+    fn unplan_without_records_restores_the_base_version() {
+        let files = fs(&[
+            ("pom.xml", ROOT),
+            ("a/pom.xml", &module("a", &dep("1.10.0"))),
+            ("b/pom.xml", &module("b", "")),
+        ]);
+        let (_, after) = vendor(&files);
+        let read = |rel: &str| after.get(rel).cloned();
+        let undo = unplan(&read, &patch().coords(), &[]);
+        let changed: BTreeMap<String, Option<Vec<u8>>> = undo.changes.into_iter().collect();
+        assert_eq!(
+            changed["a/pom.xml"].as_deref(),
+            Some(module("a", &dep("1.10.0")).as_bytes())
+        );
+        assert!(!undo.still_wired && undo.drifted.is_empty());
+        // Without records nothing proves vendor created the shared lines.
+        assert!(!changed.contains_key(MAVEN_CONFIG));
+    }
+
+    #[tokio::test]
+    async fn revert_is_idempotent_and_a_dry_run_writes_nothing() {
+        let dir = disk(&[
+            ("pom.xml", ROOT),
+            ("a/pom.xml", &module("a", &dep("1.10.0"))),
+            ("b/pom.xml", &module("b", "")),
+        ]);
+        let root = dir.path();
+        let pristine = testing::snapshot(root);
+        let mut ledger = BTreeMap::new();
+        testing::vendor(root, Shape::MavenReactor, &patch(), &mut ledger)
+            .await
+            .unwrap();
+        let entry = ledger.values().next().unwrap().clone();
+        let vendored = testing::snapshot(root);
+        let dry =
+            super::super::apply::revert(root, &entry, crate::vendor::RevertOpts::new(true)).await;
+        assert!(dry.success && dry.warnings.is_empty());
+        assert_eq!(testing::snapshot(root), vendored);
+        for _ in 0..2 {
+            let out =
+                super::super::apply::revert(root, &entry, crate::vendor::RevertOpts::new(false))
+                    .await;
+            assert!(
+                out.success && out.warnings.is_empty() && !out.kept_artifact,
+                "{out:?}"
+            );
+            assert_eq!(testing::snapshot(root), pristine);
+        }
+    }
+
+    /// A pin whose comment no longer tags a `<dependency>` is drift: the
+    /// tree stays while the pom still names the suffixed version.
+    #[tokio::test]
+    async fn drifted_pin_keeps_the_tree() {
+        let dir = disk(&[
+            ("pom.xml", ROOT),
+            ("a/pom.xml", &module("a", "")),
+            ("b/pom.xml", &module("b", "")),
+        ]);
+        let root = dir.path();
+        let mut ledger = BTreeMap::new();
+        let plan = testing::vendor(root, Shape::MavenReactor, &patch(), &mut ledger)
+            .await
+            .unwrap();
+        let pom = std::fs::read_to_string(root.join("pom.xml")).unwrap();
+        let broken = pom.replacen(
+            "-->\n      <dependency>",
+            "-->\n      <exclusion/><dependency>",
+            1,
+        );
+        assert_ne!(broken, pom);
+        std::fs::write(root.join("pom.xml"), &broken).unwrap();
+        let out = testing::revert(root, &patch(), &mut ledger).await;
+        assert!(
+            out.success && out.drift_skipped() && out.kept_artifact,
+            "{out:?}"
+        );
+        assert!(root.join(&plan.jar_rel).is_file());
+        assert!(
+            root.join(MAVEN_CONFIG).is_file(),
+            "still referenced: shared lines stay"
+        );
+    }
+
+    #[test]
+    fn cdata_version_is_replaced_whole_and_restored() {
+        let cdata = "<dependency><groupId>org.apache.commons</groupId>\
+             <artifactId>commons-text</artifactId><version><![CDATA[1.10.0]]></version></dependency>";
+        let files = fs(&[
+            ("pom.xml", ROOT),
+            ("a/pom.xml", &module("a", cdata)),
+            ("b/pom.xml", &module("b", "")),
+        ]);
+        let (plan, after) = vendor(&files);
+        assert_eq!(
+            text(&after, "a/pom.xml"),
+            module("a", &cdata.replace("<![CDATA[1.10.0]]>", SV))
+        );
+        let read = |rel: &str| after.get(rel).cloned();
+        let undo = unplan(&read, &patch().coords(), &plan.records);
+        let a = undo.changes.iter().find(|(r, _)| r == "a/pom.xml").unwrap();
+        assert_eq!(a.1.as_deref(), Some(module("a", cdata).as_bytes()));
+    }
+
+    #[test]
+    fn a_comment_before_the_anchor_is_not_indentation() {
+        let root = ROOT.replace("  <build>", "  <!-- b --><build>");
+        let files = fs(&[
+            ("pom.xml", &root),
+            ("a/pom.xml", &module("a", "")),
+            ("b/pom.xml", &module("b", "")),
+        ]);
+        let (_, after) = vendor(&files);
+        let out = text(&after, "pom.xml");
+        assert_eq!(out.matches("<!-- b -->").count(), 1, "{out}");
+        assert!(
+            out.contains("\n  <dependencyManagement>\n    <dependencies>\n"),
+            "{out}"
+        );
+        assert!(
+            out.contains("</dependencyManagement>\n  <!-- b --><build>"),
+            "{out}"
+        );
+    }
+
+    /// Maven interpolates after inheritance: a module overriding the
+    /// property keeps its own version, so the inherited `${p}` stays and
+    /// the root is not pinned.
+    #[test]
+    fn inherited_property_overridden_by_a_module_is_left_alone() {
+        let root = ROOT.replace(
+            "  <build>",
+            "  <properties><ct.version>1.10.0</ct.version></properties>\n  \
+             <dependencyManagement>\n    <dependencies>\n      \
+             <dependency><groupId>org.apache.commons</groupId><artifactId>commons-text</artifactId>\
+             <version>${ct.version}</version></dependency>\n    </dependencies>\n  \
+             </dependencyManagement>\n  <build>",
+        );
+        let bare = "<dependency><groupId>org.apache.commons</groupId>\
+                    <artifactId>commons-text</artifactId></dependency>";
+        let a = module("a", bare).replace(
+            "  <dependencies>",
+            "  <properties><ct.version>1.12.0</ct.version></properties>\n  <dependencies>",
+        );
+        let files = fs(&[
+            ("pom.xml", &root),
+            ("a/pom.xml", &a),
+            ("b/pom.xml", &module("b", bare)),
+        ]);
+        let plan = run(&files).unwrap();
+        assert_eq!(reasons(&plan), ["conflicting_literal_version"]);
+        assert!(
+            plan.warnings[0].detail.contains("1.12.0 in a/pom.xml"),
+            "{:?}",
+            plan.warnings
+        );
+        let after = applied(&files, &plan);
+        assert!(
+            !text(&after, "pom.xml").contains(SV),
+            "{}",
+            text(&after, "pom.xml")
+        );
+        assert!(text(&after, "pom.xml").contains("<version>${ct.version}</version>"));
+        // Without the override the inherited declaration is rewritten.
+        let files = fs(&[
+            ("pom.xml", &root),
+            ("a/pom.xml", &module("a", bare)),
+            ("b/pom.xml", &module("b", bare)),
+        ]);
+        let (plan, after) = vendor(&files);
+        assert!(plan.warnings.is_empty(), "{:?}", plan.warnings);
+        assert!(text(&after, "pom.xml").contains(&format!("<version>{SV}</version></dependency>")));
+    }
+
+    #[test]
+    fn plugin_configuration_modules_do_not_make_a_reactor() {
+        let ear = "<project><modelVersion>4.0.0</modelVersion><groupId>t</groupId>\
+            <artifactId>app</artifactId><version>1</version><packaging>ear</packaging>\
+            <build><plugins><plugin><artifactId>maven-ear-plugin</artifactId><configuration>\
+            <modules><jarModule><groupId>x</groupId><artifactId>y</artifactId></jarModule></modules>\
+            </configuration></plugin></plugins></build></project>";
+        assert!(!declares_modules(ear));
+        let read = |p: &str| (p == "pom.xml").then(|| ear.as_bytes().to_vec());
+        assert_eq!(super::super::detect(&read), Shape::Other);
+    }
+
+    #[test]
+    fn maven_config_extends_the_last_tail_and_protocol_lines() {
+        let out = config("-Dmaven.repo.local.tail=/a\n-Daether.offline.protocols=http\n-Dmaven.repo.local.tail=/b\n-Daether.offline.protocols=https\n");
+        assert_eq!(
+            out,
+            format!(
+                "-Dmaven.repo.local.tail=/a\n-Daether.offline.protocols=http\n\
+                 -Dmaven.repo.local.tail=/b,{TAIL_DIR}\n-Daether.offline.protocols=https,file\n"
+            )
+        );
+        let (_, op) = merge_maven_config(Some(out.as_bytes()));
+        assert_eq!(op_of_value(&op), "adopt");
+    }
+
+    #[test]
+    fn maven_config_undo_restores_every_shape() {
+        for before in [
+            None,
+            Some(""),
+            Some("-T4"),
+            Some("-T4\r\n"),
+            Some("  -Dmaven.repo.local.tail=/a  \n-ntp\n"),
+            Some("-Daether.offline.protocols=http\n-Dmaven.repo.local.tail=\n"),
+        ] {
+            let (after, op) = merge_maven_config(before.map(str::as_bytes));
+            let w = fragment(
+                MAVEN_CONFIG,
+                CONFIG_LINE_KIND,
+                "config",
+                WiringAction::Added,
+                None,
+                op,
+            );
+            let undone = undo_config(&String::from_utf8(after).unwrap(), &w);
+            assert_eq!(undone.as_deref(), before, "{before:?}");
+        }
+    }
+
+    #[test]
+    fn unsafe_coordinates_are_refused_before_any_xml_is_written() {
+        for (g, a, v) in [
+            ("com.ex&ample", "a", "1"),
+            ("g", "a<b", "1"),
+            ("g", "a", "1.0--x"),
+        ] {
+            let files = fs(&[("pom.xml", ROOT)]);
+            let read = |rel: &str| files.get(rel).cloned();
+            let p = JvmPatch {
+                group_id: g,
+                artifact_id: a,
+                version: v,
+                ..patch()
+            };
+            assert_eq!(
+                plan(&read, &p).unwrap_err().code,
+                "unsafe_coordinates",
+                "{g}:{a}:{v}"
+            );
+        }
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn a_module_symlinked_outside_the_checkout_is_reported() {
+        let dir = disk(&[("pom.xml", ROOT), ("b/pom.xml", &module("b", ""))]);
+        let outside = disk(&[("pom.xml", &module("a", &dep("1.10.0")))]);
+        std::os::unix::fs::symlink(outside.path(), dir.path().join("a")).unwrap();
+        let reader = super::super::apply::ProjectReader::new(dir.path());
+        let _ = plan(&|rel: &str| reader.read(rel), &patch());
+        assert_eq!(reader.escaped().as_deref(), Some("a"));
+    }
+
+    #[test]
+    fn committed_tree_round_trips_to_an_unchanged_plan() {
+        let files = fs(&[
+            ("pom.xml", ROOT),
+            ("a/pom.xml", &module("a", &dep("1.10.0"))),
+            ("b/pom.xml", &module("b", "")),
+        ]);
+        let (_, after) = vendor(&files);
+        let read = |rel: &str| after.get(rel).cloned();
+        let (jar, pom) = committed(&read, &patch().coords()).unwrap();
+        let p = JvmPatch {
+            jar: &jar,
+            upstream_pom: &pom,
+            ..patch()
+        };
+        assert!(plan(&read, &p).unwrap().writes.is_empty());
+        // A parent-inherited upstream version (inserted by the suffixing).
+        let parent_only = "<project>\n  <parent>\n    <groupId>org.apache.commons</groupId>\n    \
+            <artifactId>commons-parent</artifactId>\n    <version>1.10.0</version>\n  </parent>\n  \
+            <artifactId>commons-text</artifactId>\n</project>\n";
+        let files = fs(&[
+            ("pom.xml", ROOT),
+            ("a/pom.xml", &module("a", "")),
+            ("b/pom.xml", &module("b", "")),
+        ]);
+        let first = plan(
+            &|rel: &str| files.get(rel).cloned(),
+            &patch_with(parent_only),
+        )
+        .unwrap();
+        let after = applied(&files, &first);
+        let read = |rel: &str| after.get(rel).cloned();
+        let (jar, pom) = committed(&read, &patch().coords()).unwrap();
+        let p = JvmPatch {
+            jar: &jar,
+            upstream_pom: &pom,
+            ..patch()
+        };
+        assert!(plan(&read, &p).unwrap().writes.is_empty());
+        assert!(committed(&|_: &str| None, &patch().coords()).is_none());
+    }
+
+    #[test]
+    fn other_patch_references_are_recognised() {
+        let c = patch().coords();
+        let refs = |t: &str| references_other_patch(t, &mask(t).0, &c);
+        assert!(!refs(&format!("<version>{SV}</version>{BEGIN_MARKER}")));
+        assert!(refs("<version>2.0-socket.abcdef01</version>"));
+        assert!(!refs("<!-- was 2.0-socket.abcdef01 -->"));
+        assert!(refs(&format!("{PIN_TAG}{UUID_B}: g:a:1 -->")));
+        assert!(!refs(&format!("{PIN_TAG}{UUID}: g:a:1 -->")));
+        assert!(!refs("<version>1-socket.xyz</version>"));
+    }
+
+    /// A comment naming the suffixed version is not a reference: revert
+    /// completes and deletes the tree.
+    #[tokio::test]
+    async fn a_comment_naming_the_suffixed_version_does_not_keep_the_tree() {
+        let dir = disk(&[
+            ("pom.xml", ROOT),
+            (
+                "a/pom.xml",
+                &module(
+                    "a",
+                    &format!("<!-- pinned to {SV} by socket -->{}", dep("1.10.0")),
+                ),
+            ),
+            ("b/pom.xml", &module("b", "")),
+        ]);
+        let root = dir.path();
+        let pristine = testing::snapshot(root);
+        let mut ledger = BTreeMap::new();
+        testing::vendor(root, Shape::MavenReactor, &patch(), &mut ledger)
+            .await
+            .unwrap();
+        let out = testing::revert(root, &patch(), &mut ledger).await;
+        assert!(
+            out.success && out.warnings.is_empty() && !out.kept_artifact,
+            "{out:?}"
+        );
+        assert_eq!(testing::snapshot(root), pristine);
+    }
+}
diff --git a/crates/socket-patch-core/src/vendor/jvm/mod.rs b/crates/socket-patch-core/src/vendor/jvm/mod.rs
new file mode 100644
index 00000000..7b834e89
--- /dev/null
+++ b/crates/socket-patch-core/src/vendor/jvm/mod.rs
@@ -0,0 +1,609 @@
+//! The v5 vendored JVM backend (`docs/design/maven-vendoring.md`).
+//!
+//! Handles multi-module Maven reactors and Gradle builds automatically.
+//! Single-POM builds retain the legacy backend.
+//!
+//! The planners are pure: they read project files through a [`ReadFn`] and
+//! return the full post-vendor bytes of every file they touch plus one
+//! fragment record per edit (never a whole file). Revert is planned the
+//! same way ([`maven_reactor::unplan`], [`gradle::unplan`]): per-patch
+//! fragments are cut by their exact text or their `socket-patch` tag, and a
+//! shared fragment (repository block, `maven.config` lines, apply lines,
+//! owned files) goes only once no other patch's reference is left in the
+//! project, so the result does not depend on revert order. [`apply`]
+//! does the disk side.
+
+pub mod apply;
+pub(crate) mod archive;
+pub mod gradle;
+pub mod maven_reactor;
+
+use serde_json::{json, Value};
+
+use super::state::{WiringAction, WiringRecord};
+
+/// Fragment of a reactor pom: `pin`, `version:…` (per patch),
+/// `pin_section`, `repository` (shared).
+pub const POM_FRAGMENT_KIND: &str = "maven_pom_fragment";
+/// The shared `.mvn/maven.config` lines.
+pub const CONFIG_LINE_KIND: &str = "maven_config_line";
+/// Fragment of a settings file: `apply`, `in_block_section` (shared),
+/// `in_block:<gav>` (per patch).
+pub const SETTINGS_FRAGMENT_KIND: &str = "gradle_settings_fragment";
+/// The patched hash in an existing `gradle/verification-metadata.xml`.
+pub const VERIFICATION_FRAGMENT_KIND: &str = "gradle_verification_fragment";
+/// A file the backend owns outright (script, index, tree `.gitattributes`).
+pub const OWNED_FILE_KIND: &str = "jvm_owned_file";
+/// One vendored artifact file; `new` = its sha256.
+pub const TREE_KIND: &str = "jvm_vendor_tree";
+/// A directory vendor created; removed on revert once empty.
+pub const CREATED_DIR_KIND: &str = "jvm_created_dir";
+/// Whether upstream metadata was verified against registry checksums.
+pub const UPSTREAM_KIND: &str = "jvm_upstream_status";
+/// Every kind this backend records.
+pub const KINDS: &[&str] = &[
+    POM_FRAGMENT_KIND,
+    CONFIG_LINE_KIND,
+    SETTINGS_FRAGMENT_KIND,
+    VERIFICATION_FRAGMENT_KIND,
+    OWNED_FILE_KIND,
+    TREE_KIND,
+    CREATED_DIR_KIND,
+    UPSTREAM_KIND,
+];
+
+/// Parse the distribution version from a checked-in wrapper only; never runs the build tool.
+pub fn wrapper_version(read: ReadFn<'_>, tool: &str) -> Option<(u32, u32, u32)> {
+    let path = match tool {
+        "maven" => ".mvn/wrapper/maven-wrapper.properties",
+        "gradle" => "gradle/wrapper/gradle-wrapper.properties",
+        _ => return None,
+    };
+    let bytes = read(path)?;
+    let text = std::str::from_utf8(&bytes).ok()?;
+    let url = text
+        .lines()
+        .find_map(|line| line.trim().strip_prefix("distributionUrl="))?;
+    let re = regex::Regex::new(&format!(r"{tool}-(\d+)\.(\d+)(?:\.(\d+))?")).ok()?;
+    let caps = re.captures(url)?;
+    Some((
+        caps[1].parse().ok()?,
+        caps[2].parse().ok()?,
+        caps.get(3).map_or(Some(0), |m| m.as_str().parse().ok())?,
+    ))
+}
+
+/// Reads a project-relative, forward-slash path. `None` = missing or
+/// unreadable.
+pub type ReadFn<'a> = &'a dyn Fn(&str) -> Option<Vec<u8>>;
+
+/// The identity of one patch: enough to find (and revert) its wiring.
+#[derive(Debug, Clone, Copy)]
+pub struct Coords<'a> {
+    pub group_id: &'a str,
+    pub artifact_id: &'a str,
+    /// The upstream (base) version.
+    pub version: &'a str,
+    pub uuid: &'a str,
+}
+
+impl Coords<'_> {
+    /// `org.apache.commons` → `org/apache/commons`.
+    pub fn group_path(&self) -> String {
+        self.group_id.replace('.', "/")
+    }
+
+    /// First 8 lowercase hex of the uuid.
+    pub fn hex8(&self) -> String {
+        self.uuid
+            .chars()
+            .filter(|c| *c != '-')
+            .take(8)
+            .collect::<String>()
+            .to_ascii_lowercase()
+    }
+
+    /// The Maven suffixed version: `<base>-socket.<first 8 hex of the uuid>`,
+    /// the same rule as the patch server's `mavenSuffixedVersion`.
+    pub fn suffixed_version(&self) -> String {
+        format!("{}-socket.{}", self.version, self.hex8())
+    }
+}
+
+/// One patched artifact, fully materialised.
+#[derive(Debug, Clone)]
+pub struct JvmPatch<'a> {
+    pub group_id: &'a str,
+    pub artifact_id: &'a str,
+    /// The upstream (base) version.
+    pub version: &'a str,
+    pub uuid: &'a str,
+    /// The patched jar bytes.
+    pub jar: &'a [u8],
+    /// The upstream pom, verbatim.
+    pub upstream_pom: &'a [u8],
+    /// The upstream Gradle module metadata, verbatim, when published.
+    pub upstream_module: Option<&'a [u8]>,
+}
+
+impl<'a> JvmPatch<'a> {
+    pub fn coords(&self) -> Coords<'a> {
+        Coords {
+            group_id: self.group_id,
+            artifact_id: self.artifact_id,
+            version: self.version,
+            uuid: self.uuid,
+        }
+    }
+
+    pub fn group_path(&self) -> String {
+        self.coords().group_path()
+    }
+
+    pub fn suffixed_version(&self) -> String {
+        self.coords().suffixed_version()
+    }
+}
+
+/// Which JVM build the project root holds.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Shape {
+    /// A root `pom.xml` that declares `<modules>`.
+    MavenReactor,
+    /// No root `pom.xml`, and a Gradle settings or build script.
+    Gradle,
+    /// Anything else (including a single-module pom, which stays legacy).
+    Other,
+}
+
+/// A planned file: project-relative forward-slash path and its full new
+/// bytes.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct FileWrite {
+    pub rel: String,
+    pub bytes: Vec<u8>,
+    /// Vendored artifact tree file (jar, pom, sidecar, marker): recorded by
+    /// hash and deleted on revert; every other write is described by the
+    /// plan's fragment records.
+    pub tree: bool,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct JvmWarning {
+    pub code: &'static str,
+    pub detail: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct JvmRefusal {
+    pub code: &'static str,
+    pub detail: String,
+}
+
+#[derive(Debug, Clone, Default, PartialEq)]
+pub struct JvmPlan {
+    /// Sorted by `rel`, no duplicates. Files whose new bytes equal their
+    /// current bytes are omitted.
+    pub writes: Vec<FileWrite>,
+    /// One record per text fragment the patch relies on, including shared
+    /// fragments another patch already wrote (`op: adopt`, which the caller
+    /// replaces with that patch's creation record).
+    pub records: Vec<WiringRecord>,
+    /// Every file of the patch's tree with its sha256, whether this plan
+    /// writes it or it is already in place (a patch update recording only
+    /// what changed would let the stale sweep delete the rest).
+    pub tree_files: Vec<(String, String)>,
+    pub warnings: Vec<JvmWarning>,
+    /// The tree directory holding the vendored artifact (project-relative).
+    pub tree_dir: String,
+    /// The vendored jar (project-relative).
+    pub jar_rel: String,
+}
+
+/// A committed tree as planner input: `(jar, upstream pom, module)`.
+pub type CommittedTree = (Vec<u8>, Vec<u8>, Option<Vec<u8>>);
+
+/// A planned revert.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct JvmUnplan {
+    /// Sorted by path: the new bytes, or `None` to delete the file.
+    pub changes: Vec<(String, Option<Vec<u8>>)>,
+    /// `vendor_lock_entry_drifted` details: a fragment that is still there
+    /// but no longer has the shape vendor wrote.
+    pub drifted: Vec<String>,
+    /// The project still references this patch's tree (a drifted fragment),
+    /// so the tree must stay.
+    pub still_wired: bool,
+}
+
+/// Classify the project root.
+pub fn detect(read: ReadFn<'_>) -> Shape {
+    if let Some(pom) = read("pom.xml") {
+        let text = String::from_utf8_lossy(&pom);
+        // Single-pom projects stay on the legacy path until Phase 4.
+        return if maven_reactor::declares_modules(&text) {
+            Shape::MavenReactor
+        } else {
+            Shape::Other
+        };
+    }
+    const GRADLE_FILES: &[&str] = &[
+        "settings.gradle",
+        "settings.gradle.kts",
+        "build.gradle",
+        "build.gradle.kts",
+    ];
+    if GRADLE_FILES.iter().any(|f| read(f).is_some()) {
+        Shape::Gradle
+    } else {
+        Shape::Other
+    }
+}
+
+/// Plan the vendoring of `patch` for a project of `shape`.
+pub fn plan(shape: Shape, read: ReadFn<'_>, patch: &JvmPatch<'_>) -> Result<JvmPlan, JvmRefusal> {
+    match shape {
+        Shape::MavenReactor => maven_reactor::plan(read, patch),
+        Shape::Gradle => gradle::plan(read, patch),
+        Shape::Other => Err(JvmRefusal {
+            code: "vendor_jvm_shape_unsupported",
+            detail: "reason: no_build_file: not a multi-module Maven reactor or a Gradle build"
+                .to_string(),
+        }),
+    }
+}
+
+/// Safe coordinates that every written file accepts unescaped: g is
+/// dot-separated `[A-Za-z0-9_-]` segments, a is `[A-Za-z0-9_.-]`, v is
+/// `[A-Za-z0-9_.+-]` not ending in `+` nor starting with `latest.`; neither a
+/// nor v is all dots, and none holds `--` (it ends an XML comment).
+pub fn safe_coordinates(g: &str, a: &str, v: &str) -> bool {
+    let seg = |s: &str, extra: &str| {
+        !s.is_empty()
+            && s.chars()
+                .all(|c| c.is_ascii_alphanumeric() || "_-".contains(c) || extra.contains(c))
+    };
+    g.split('.').all(|s| seg(s, ""))
+        && seg(a, ".")
+        && seg(v, ".+")
+        && !a.chars().all(|c| c == '.')
+        && !v.chars().all(|c| c == '.')
+        && !v.ends_with('+')
+        && !v.starts_with("latest.")
+        && ![g, a, v].iter().any(|s| s.contains("--"))
+}
+
+/// A fragment record. `op` (a JSON object with an `"op"` field) goes in
+/// `new`; `original` is the text a rewrite replaced, when known.
+pub(crate) fn fragment(
+    file: &str,
+    kind: &str,
+    key: &str,
+    action: WiringAction,
+    original: Option<String>,
+    op: Value,
+) -> WiringRecord {
+    WiringRecord {
+        file: file.to_string(),
+        kind: kind.to_string(),
+        action,
+        key: Some(key.to_string()),
+        original: original.map(Value::String),
+        new: Some(op),
+    }
+}
+
+/// A tree root's owned `.gitattributes`: created when absent,
+/// adopted (never overwritten) when present.
+pub(crate) fn owned_file(read: ReadFn<'_>, rel: &str, writes: &mut Vec<FileWrite>) -> WiringRecord {
+    if read(rel).is_some() {
+        return adopt(rel, OWNED_FILE_KIND, "owned");
+    }
+    writes.push(FileWrite {
+        rel: rel.to_string(),
+        bytes: TREE_GITATTRIBUTES.as_bytes().to_vec(),
+        tree: false,
+    });
+    fragment(
+        rel,
+        OWNED_FILE_KIND,
+        "owned",
+        WiringAction::Added,
+        None,
+        json!({ "op": "create" }),
+    )
+}
+
+/// A shared fragment another patch (or the user) already put in place.
+pub(crate) fn adopt(file: &str, kind: &str, key: &str) -> WiringRecord {
+    fragment(
+        file,
+        kind,
+        key,
+        WiringAction::Added,
+        None,
+        json!({ "op": "adopt" }),
+    )
+}
+
+/// A `replace` op: revert swaps `to` back to `from` where `to` occurs once.
+pub(crate) fn replace_op(from: &str, to: &str) -> Value {
+    json!({ "op": "replace", "from": from, "to": to })
+}
+
+/// The `op` of a record, `""` when malformed.
+pub(crate) fn op_of(w: &WiringRecord) -> &str {
+    w.new
+        .as_ref()
+        .and_then(|n| n.get("op"))
+        .and_then(Value::as_str)
+        .unwrap_or_default()
+}
+
+/// String field `name` of a record's op.
+pub(crate) fn op_str<'w>(w: &'w WiringRecord, name: &str) -> Option<&'w str> {
+    w.new.as_ref()?.get(name)?.as_str()
+}
+
+/// `text` with the only occurrence of `to` replaced by `from`; `None` when
+/// `to` is empty, absent or ambiguous.
+pub(crate) fn undo_replace(text: &str, from: &str, to: &str) -> Option<String> {
+    if to.is_empty() {
+        return None;
+    }
+    let mut hits = text.match_indices(to);
+    let (at, _) = hits.next()?;
+    if hits.next().is_some() {
+        return None;
+    }
+    Some(format!("{}{from}{}", &text[..at], &text[at + to.len()..]))
+}
+
+/// The changed files between `before` and `after` (both path → text, `None`
+/// = absent), in [`JvmUnplan::changes`] form.
+pub(crate) fn changes_between(
+    before: &std::collections::BTreeMap<String, Option<String>>,
+    after: &std::collections::BTreeMap<String, Option<String>>,
+) -> Vec<(String, Option<Vec<u8>>)> {
+    after
+        .iter()
+        .filter(|(rel, text)| before.get(*rel) != Some(*text))
+        .map(|(rel, text)| (rel.clone(), text.clone().map(String::into_bytes)))
+        .collect()
+}
+
+/// `(rel, sha256)` of every tree write in `writes`.
+pub(crate) fn tree_files(writes: &[FileWrite]) -> Vec<(String, String)> {
+    let mut out: Vec<(String, String)> = writes
+        .iter()
+        .filter(|w| w.tree)
+        .map(|w| (w.rel.clone(), sha256_hex(&w.bytes)))
+        .collect();
+    out.sort();
+    out.dedup();
+    out
+}
+
+/// Keep only writes that change a file, sorted and de-duplicated by path
+/// (the last write for a path wins).
+pub(crate) fn finish_writes(read: ReadFn<'_>, writes: Vec<FileWrite>) -> Vec<FileWrite> {
+    let mut by_rel = std::collections::BTreeMap::new();
+    for w in writes {
+        by_rel.insert(w.rel.clone(), w);
+    }
+    by_rel
+        .into_values()
+        .filter(|w| read(&w.rel).as_deref() != Some(w.bytes.as_slice()))
+        .collect()
+}
+
+/// `sha1` hex of `bytes`, the bare-40-hex sidecar body Maven reads.
+pub(crate) fn sha1_hex(bytes: &[u8]) -> String {
+    use sha1::{Digest as _, Sha1};
+    hex::encode(Sha1::digest(bytes))
+}
+
+/// `sha256` hex of `bytes`.
+pub(crate) fn sha256_hex(bytes: &[u8]) -> String {
+    use sha2::{Digest as _, Sha256};
+    hex::encode(Sha256::digest(bytes))
+}
+
+/// `.gitattributes` for an owned tree root: keeps git from rewriting line
+/// endings in vendored poms and module files (layer-1 hashes are exact).
+pub(crate) const TREE_GITATTRIBUTES: &str = "* -text\n";
+
+/// A disk round-trip harness for the planners' tests: vendor and revert
+/// the way the CLI does (ledger peers, carry-forward, stale sweep).
+#[cfg(test)]
+pub(crate) mod testing {
+    use std::collections::BTreeMap;
+    use std::path::Path;
+
+    use super::super::state::{carry_forward_wiring, VendorEntry};
+    use super::super::{RevertOpts, RevertOutcome};
+    use super::{apply, JvmPatch, JvmPlan, JvmRefusal, Shape};
+
+    /// A ledger entry for `patch` holding `wiring`.
+    pub fn entry(patch: &JvmPatch<'_>, wiring: Vec<super::WiringRecord>) -> VendorEntry {
+        serde_json::from_value(serde_json::json!({
+            "ecosystem": "maven",
+            "basePurl": format!("pkg:maven/{}/{}@{}", patch.group_id, patch.artifact_id, patch.version),
+            "uuid": patch.uuid,
+            "artifact": { "path": "", "sha256": "" },
+            "wiring": serde_json::to_value(wiring).unwrap(),
+        }))
+        .unwrap()
+    }
+
+    /// Vendor `patch` under `root` and record it in `ledger` (keyed by purl).
+    pub async fn vendor(
+        root: &Path,
+        shape: Shape,
+        patch: &JvmPatch<'_>,
+        ledger: &mut BTreeMap<String, VendorEntry>,
+    ) -> Result<JvmPlan, JvmRefusal> {
+        let reader = apply::ProjectReader::new(root);
+        let plan = super::plan(shape, &|rel: &str| reader.read(rel), patch)?;
+        assert_eq!(reader.escaped(), None);
+        if plan.writes.is_empty() {
+            return Ok(plan);
+        }
+        let mut wiring = apply::write_plan(root, &plan).await.expect("write plan");
+        apply::inherit_peer_records(&mut wiring, ledger.values());
+        let mut fresh = entry(patch, wiring);
+        let key = fresh.base_purl.clone();
+        let prev = ledger.get(&key).cloned();
+        if let Some(prev) = &prev {
+            carry_forward_wiring(prev, &mut fresh);
+        }
+        ledger.insert(key, fresh);
+        if let Some(prev) = prev.filter(|p| p.uuid != patch.uuid) {
+            apply::sweep_replaced_tree(root, &prev, ledger.values())
+                .await
+                .expect("sweep");
+        }
+        Ok(plan)
+    }
+
+    /// Revert `patch`'s ledger entry, dropping it unless kept.
+    pub async fn revert(
+        root: &Path,
+        patch: &JvmPatch<'_>,
+        ledger: &mut BTreeMap<String, VendorEntry>,
+    ) -> RevertOutcome {
+        let key = format!(
+            "pkg:maven/{}/{}@{}",
+            patch.group_id, patch.artifact_id, patch.version
+        );
+        let e = ledger.get(&key).expect("ledger entry").clone();
+        let out = apply::revert(root, &e, RevertOpts::new(false)).await;
+        if out.success && !out.kept_artifact {
+            ledger.remove(&key);
+        }
+        out
+    }
+
+    /// Every file under `root` (relative path → bytes).
+    pub fn snapshot(root: &Path) -> BTreeMap<String, Vec<u8>> {
+        fn walk(root: &Path, dir: &Path, out: &mut BTreeMap<String, Vec<u8>>) {
+            for e in std::fs::read_dir(dir).unwrap() {
+                let p = e.unwrap().path();
+                let meta = std::fs::symlink_metadata(&p).unwrap();
+                if meta.is_dir() {
+                    walk(root, &p, out);
+                } else {
+                    let rel = p
+                        .strip_prefix(root)
+                        .unwrap()
+                        .to_string_lossy()
+                        .replace('\\', "/");
+                    out.insert(rel, std::fs::read(&p).unwrap());
+                }
+            }
+        }
+        let mut out = BTreeMap::new();
+        walk(root, root, &mut out);
+        out
+    }
+
+    /// Every directory under `root`, relative.
+    pub fn dirs(root: &Path) -> Vec<String> {
+        fn walk(root: &Path, dir: &Path, out: &mut Vec<String>) {
+            for e in std::fs::read_dir(dir).unwrap() {
+                let p = e.unwrap().path();
+                if std::fs::symlink_metadata(&p).unwrap().is_dir() {
+                    out.push(p.strip_prefix(root).unwrap().to_string_lossy().into_owned());
+                    walk(root, &p, out);
+                }
+            }
+        }
+        let mut out = Vec::new();
+        walk(root, root, &mut out);
+        out
+    }
+
+    /// Write `files` under `root`.
+    pub fn populate(root: &Path, files: &[(&str, &str)]) {
+        for (rel, body) in files {
+            let path = root.join(rel);
+            std::fs::create_dir_all(path.parent().unwrap()).unwrap();
+            std::fs::write(path, body).unwrap();
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn patch() -> JvmPatch<'static> {
+        JvmPatch {
+            group_id: "org.apache.commons",
+            artifact_id: "commons-text",
+            version: "1.10.0",
+            uuid: "5E6F7081-92a3-4b4c-8d5e-6f708192a3b4",
+            jar: b"jar",
+            upstream_pom: b"pom",
+            upstream_module: None,
+        }
+    }
+
+    #[test]
+    fn suffixed_version_uses_first_eight_lowercase_hex() {
+        assert_eq!(patch().suffixed_version(), "1.10.0-socket.5e6f7081");
+        assert_eq!(patch().coords().hex8(), "5e6f7081");
+    }
+
+    #[test]
+    fn safe_coordinates_follow_d15_and_forbid_comment_dashes() {
+        assert!(safe_coordinates(
+            "org.apache.commons",
+            "commons-text",
+            "1.10.0"
+        ));
+        assert!(safe_coordinates("g", "a.b_c", "1.0+build.2-rc_1"));
+        for (g, a, v) in [
+            ("com.ex&ample", "a", "1"),
+            ("g", "a<b", "1"),
+            ("g", "a", "1.0--x"),
+            ("g--h", "a", "1"),
+            ("g", "a--b", "1"),
+            ("g", "a", "1 0"),
+            ("g", "a", "1+"),
+            ("g", "a", "latest.release"),
+            ("g", "a", "[1,2)"),
+            ("g..h", "a", "1"),
+            ("g", "..", "1"),
+            ("g", "a", "..."),
+            ("", "a", "1"),
+            ("g", "a", "1'"),
+            ("g", "a", "1\\"),
+        ] {
+            assert!(!safe_coordinates(g, a, v), "{g}:{a}:{v}");
+        }
+    }
+
+    #[test]
+    fn undo_replace_needs_one_occurrence() {
+        assert_eq!(undo_replace("a[x]b", "", "[x]").as_deref(), Some("ab"));
+        assert_eq!(undo_replace("[x][x]", "", "[x]"), None);
+        assert_eq!(undo_replace("ab", "", "[x]"), None);
+        assert_eq!(undo_replace("ab", "q", ""), None);
+    }
+
+    #[test]
+    fn detect_classifies_roots() {
+        let reactor = |p: &str| {
+            (p == "pom.xml")
+                .then(|| b"<project><modules><module>a</module></modules></project>".to_vec())
+        };
+        assert_eq!(detect(&reactor), Shape::MavenReactor);
+        let single = |p: &str| (p == "pom.xml").then(|| b"<project></project>".to_vec());
+        assert_eq!(detect(&single), Shape::Other);
+        let gradle = |p: &str| (p == "settings.gradle.kts").then(Vec::new);
+        assert_eq!(detect(&gradle), Shape::Gradle);
+        let empty = |_: &str| None;
+        assert_eq!(detect(&empty), Shape::Other);
+    }
+}
diff --git a/crates/socket-patch-core/src/vendor/jvm/socket-patch.settings.gradle b/crates/socket-patch-core/src/vendor/jvm/socket-patch.settings.gradle
new file mode 100644
index 00000000..b7c0203d
--- /dev/null
+++ b/crates/socket-patch-core/src/vendor/jvm/socket-patch.settings.gradle
@@ -0,0 +1,66 @@
+// Generated by socket-patch (vendored mode). Do not edit.
+// Data: .socket/vendor/gradle-index.tsv. Remove with `socket-patch vendor --revert`.
+import java.security.MessageDigest
+if (org.gradle.util.GradleVersion.current() < org.gradle.util.GradleVersion.version('6.8')) {
+  throw new GradleException('socket-patch: vendored dependencies need Gradle 6.8+')
+}
+def socketDir = buildscript.sourceFile.parentFile.parentFile
+def socketRepoDir = new File(socketDir, 'vendor/gradle')
+def socketIndex = new File(socketDir, 'vendor/gradle-index.tsv')
+def socketFail = { String m ->
+  throw new GradleException("socket-patch: ${m}. Restore it from git or re-run `socket-patch vendor`.")
+}
+if (!socketIndex.isFile()) { socketFail("${socketIndex} missing") }
+def socketRows = socketIndex.readLines('UTF-8')
+if (socketRows.isEmpty() || socketRows[0] != '#socket-patch-gradle-index 1') { socketFail("${socketIndex} has an unknown header") }
+def socketModules = [:] as LinkedHashMap
+def socketListed = [:]
+socketRows.drop(1).each { String row ->
+  if (row.isEmpty()) { return }
+  def c = row.split('\t', -1)
+  def gav = c.length == 4 ? c[0].split(':', -1) : [] as String[]
+  if (gav.length != 3 || !(gav[0] ==~ /[A-Za-z0-9_-]+(\.[A-Za-z0-9_-]+)*/) || !(gav[1] ==~ /[A-Za-z0-9_.-]+/) ||
+      !(gav[2] ==~ /[A-Za-z0-9_.+-]+/) || gav[2].endsWith('+') || gav[2].startsWith('latest.') ||
+      gav[1] ==~ /\.+/ || gav[2] ==~ /\.+/ || !(c[2] ==~ /[0-9a-f]{64}/)) {
+    socketFail("malformed row in ${socketIndex}: ${row}")
+  }
+  def dir = "${gav[0].replace('.', '/')}/${gav[1]}/${gav[2]}".toString()
+  def name = c[1].startsWith(dir + '/') ? c[1].substring(dir.length() + 1) : ''
+  if (!name.startsWith("${gav[1]}-${gav[2]}".toString()) || name.contains('/')) { socketFail("row path ${c[1]} does not match ${c[0]}") }
+  def f = new File(socketRepoDir, c[1])
+  if (!f.isFile()) { socketFail("vendored file missing: ${f}") }
+  def md = MessageDigest.getInstance('SHA-256')
+  f.withInputStream { s -> byte[] b = new byte[65536]; int n; while ((n = s.read(b)) > 0) { md.update(b, 0, n) } }
+  def got = md.digest().encodeHex().toString()
+  if (got != c[2]) { socketFail("${f} has sha256 ${got}, pinned ${c[2]}") }
+  socketModules[c[0]] = gav
+  socketListed.get(dir, [] as Set) << name
+}
+socketListed.each { String dir, Set names ->
+  def (a, v) = dir.split('/')[-2..-1]
+  if (!names.contains("${a}-${v}.jar".toString()) || !names.contains("${a}-${v}.pom".toString())) { socketFail("jar or pom row missing for ${dir}") }
+  def extra = new File(socketRepoDir, dir).list().findAll { it != 'socket-patch.vendor.json' && !names.contains(it) }
+  if (extra) { socketFail("unindexed files in ${dir}: ${extra}") }
+}
+def socketName = 'socketPatchVendor'
+def socketOwned = { ArtifactRepository r -> r.name == socketName || r.name.startsWith(socketName + '_') }
+def socketWire = { RepositoryHandler repos ->
+  if (repos.any(socketOwned)) { return }
+  repos.exclusiveContent {
+    forRepository { repos.maven { name = socketName; url = socketRepoDir.toURI() } }
+    filter { socketModules.values().each { m -> includeVersion(m[0], m[1], m[2]) } }
+  }
+}
+def socketFollow = { RepositoryHandler repos ->
+  if (repos.any { !socketOwned(it) }) { socketWire(repos) }
+  repos.whenObjectAdded { ArtifactRepository r -> if (!socketOwned(r)) { socketWire(repos) } }
+}
+def socketDrm = settings.dependencyResolutionManagement
+socketWire(socketDrm.repositories)
+socketFollow(settings.pluginManagement.repositories)
+settings.gradle.beforeProject { Project p ->
+  socketFollow(p.buildscript.repositories)
+  if (socketDrm.repositoriesMode.getOrElse(RepositoriesMode.PREFER_PROJECT) == RepositoriesMode.PREFER_PROJECT) {
+    socketFollow(p.repositories)
+  }
+}
diff --git a/crates/socket-patch-core/src/vendor/maven_repo.rs b/crates/socket-patch-core/src/vendor/maven_repo.rs
index 2c98c664..2e09f183 100644
--- a/crates/socket-patch-core/src/vendor/maven_repo.rs
+++ b/crates/socket-patch-core/src/vendor/maven_repo.rs
@@ -301,10 +301,17 @@ pub(crate) async fn service_preflight(
     project_root: &Path,
     record: &PatchRecord,
 ) -> Option<crate::api::client::PlannedDownload> {
-    maven_prelude(purl, project_root, record)
-        .await
-        .ok()
-        .filter(|p| !p.in_sync)?;
+    if let Some(shape) = jvm_shape(project_root).await {
+        jvm_committed_patch(shape, purl, project_root, record)
+            .await
+            .is_none()
+            .then_some(())?;
+    } else {
+        maven_prelude(purl, project_root, record)
+            .await
+            .ok()
+            .filter(|p| !p.in_sync)?;
+    }
     // `service_archive_copy` checks the archive's members against the
     // afterHashes before writing it verbatim.
     Some(crate::api::client::PlannedDownload {
@@ -333,6 +340,43 @@ pub async fn vendor_maven(
     force: bool,
     service: Option<&VendorServiceConfig>,
 ) -> VendorOutcome {
+    for ancestor in project_root.ancestors().skip(1) {
+        let reader = super::jvm::apply::ProjectReader::new(ancestor);
+        let rel = project_root
+            .join("pom.xml")
+            .strip_prefix(ancestor)
+            .ok()
+            .map(|p| p.to_string_lossy().replace('\\', "/"));
+        if rel
+            .as_ref()
+            .is_some_and(|rel| super::jvm::maven_reactor::contains_module(&|p| reader.read(p), rel))
+        {
+            return refused(
+                "vendor_jvm_shape_unsupported",
+                format!(
+                    "reason: not_build_root: run vendor from reactor root {}",
+                    ancestor.display()
+                ),
+            );
+        }
+        if ancestor.join(".git").exists() {
+            break;
+        }
+    }
+    if let Some(shape) = jvm_shape(project_root).await {
+        return vendor_maven_jvm(
+            shape,
+            purl,
+            installed_dir,
+            project_root,
+            record,
+            sources,
+            dry_run,
+            force,
+            service,
+        )
+        .await;
+    }
     let MavenPrelude {
         group_id,
         artifact_id,
@@ -599,6 +643,12 @@ pub async fn revert_maven_opts(
         dry_run,
         keep_artifact,
     } = opts;
+    // Routed only when EVERY record is a JVM kind; the JVM revert validates
+    // the uuid, the coordinates and each recorded path before any disk
+    // access (state.json is tamper-able).
+    if super::jvm::apply::is_jvm_entry(entry) {
+        return super::jvm::apply::revert(project_root, entry, opts).await;
+    }
     // SECURITY: state.json is committed and tamper-able; the uuid keys the
     // directory we are about to delete. Anything but the canonical uuid grammar
     // is rejected fail-closed before any disk access.
@@ -681,6 +731,679 @@ pub async fn revert_maven_opts(
     outcome
 }
 
+// ── v5 JVM backend (reactors, Gradle) ─────────────────────────────────
+
+/// Route reactors and Gradle builds to the JVM backend.
+async fn jvm_shape(project_root: &Path) -> Option<super::jvm::Shape> {
+    let reader = super::jvm::apply::ProjectReader::new(project_root);
+    let shape = super::jvm::detect(&|rel: &str| reader.read(rel));
+    (shape != super::jvm::Shape::Other).then_some(shape)
+}
+
+/// The committed tree bytes for `record` (jar, upstream pom, module) when
+/// the jar's patched members hash to the record's `afterHash`es: a re-run
+/// then needs no jar source at all (the in-sync hot path).
+async fn jvm_committed_patch(
+    shape: super::jvm::Shape,
+    purl: &str,
+    project_root: &Path,
+    record: &PatchRecord,
+) -> Option<super::jvm::CommittedTree> {
+    let (g, a, v) = parse_maven_purl(purl)?;
+    let coords = super::jvm::Coords {
+        group_id: &g,
+        artifact_id: &a,
+        version: &v,
+        uuid: &record.uuid,
+    };
+    let reader = super::jvm::apply::ProjectReader::new(project_root);
+    let read = |rel: &str| reader.read(rel);
+    let dir = match shape {
+        super::jvm::Shape::MavenReactor => super::jvm::maven_reactor::tree_dir(&coords),
+        super::jvm::Shape::Gradle => super::jvm::gradle::tree_dir(&coords),
+        super::jvm::Shape::Other => return None,
+    };
+    let marker: serde_json::Value =
+        serde_json::from_slice(&read(&format!("{dir}/socket-patch.vendor.json"))?).ok()?;
+    if marker.get("uuid")?.as_str()? != record.uuid {
+        return None;
+    }
+    let files = marker.get("files")?.as_object()?;
+    let tree_version = match shape {
+        super::jvm::Shape::MavenReactor => coords.suffixed_version(),
+        _ => v.to_string(),
+    };
+    for ext in ["jar", "pom"] {
+        files.get(&format!("{a}-{tree_version}.{ext}"))?;
+    }
+    for (name, file) in files {
+        if name.contains('/') || name.contains('\\') || name == ".." {
+            return None;
+        }
+        let bytes = read(&format!("{dir}/{name}"))?;
+        if file.get("sha256")?.as_str()? != super::jvm::sha256_hex(&bytes) {
+            return None;
+        }
+    }
+    let committed = match shape {
+        super::jvm::Shape::MavenReactor => {
+            super::jvm::maven_reactor::committed(&read, &coords).map(|(jar, pom)| (jar, pom, None))
+        }
+        super::jvm::Shape::Gradle => super::jvm::gradle::committed(&read, &coords),
+        super::jvm::Shape::Other => None,
+    }?;
+    (!record.files.is_empty() && zip_bytes_match_after_hashes(&committed.0, &record.files))
+        .then_some(committed)
+}
+
+/// Vendor into a multi-module reactor or a Gradle build through the
+/// [`super::jvm`] backend. The jar and pom come from the committed
+/// tree when it already holds this patch, else from the same service /
+/// local-rebuild rungs as the legacy path; nothing is written for a
+/// refused plan.
+#[allow(clippy::too_many_arguments)]
+async fn vendor_maven_jvm(
+    shape: super::jvm::Shape,
+    purl: &str,
+    installed_dir: &Path,
+    project_root: &Path,
+    record: &PatchRecord,
+    sources: &PatchSources<'_>,
+    dry_run: bool,
+    force: bool,
+    service: Option<&VendorServiceConfig>,
+) -> VendorOutcome {
+    let Some((group_id, artifact_id, version)) = parse_maven_purl(purl) else {
+        return refused("unsafe_coordinates", format!("not a maven purl: {purl}"));
+    };
+    let (group_id, artifact_id, version) = (
+        group_id.to_string(),
+        artifact_id.to_string(),
+        version.to_string(),
+    );
+    if vendor_uuid_dir_rel("maven", &record.uuid).is_none() {
+        return refused(
+            "unsafe_coordinates",
+            format!("non-canonical patch uuid {:?}", record.uuid),
+        );
+    }
+    if !super::jvm::safe_coordinates(&group_id, &artifact_id, &version) {
+        return refused(
+            "unsafe_coordinates",
+            format!("unsafe maven coordinates `{group_id}:{artifact_id}` @ `{version}`"),
+        );
+    }
+    let state = match super::state::load_state(project_root).await {
+        Ok(state) => Some(state),
+        Err(e) => return refused("vendor_state_unreadable", e.to_string()),
+    };
+    let display_path = project_root.join(".socket/vendor");
+    if record.files.is_empty() {
+        let reader = super::jvm::apply::ProjectReader::new(project_root);
+        let probe_pom = format!("<project><groupId>{group_id}</groupId><artifactId>{artifact_id}</artifactId><version>{version}</version></project>");
+        let patch = super::jvm::JvmPatch {
+            group_id: &group_id,
+            artifact_id: &artifact_id,
+            version: &version,
+            uuid: &record.uuid,
+            jar: &[],
+            upstream_pom: probe_pom.as_bytes(),
+            upstream_module: None,
+        };
+        let plan = super::jvm::plan(shape, &|rel| reader.read(rel), &patch);
+        if let Some(rel) = reader.escaped() {
+            return refused(
+                "vendor_jvm_shape_unsupported",
+                super::jvm::apply::outside_root_detail(&rel),
+            );
+        }
+        if let Err(e) = plan {
+            return refused(e.code, e.detail);
+        }
+        return done(
+            synthesized_result(purl, &display_path, Vec::new(), true, None),
+            None,
+            Vec::new(),
+        );
+    }
+
+    let mut warnings: Vec<VendorWarning> = Vec::new();
+    let committed = jvm_committed_patch(shape, purl, project_root, record).await;
+    let was_committed = committed.is_some();
+    let (jar_bytes, mut pom_bytes, mut module_bytes, mut result) = match committed {
+        Some((jar, pom, module)) => (
+            jar,
+            pom,
+            module,
+            already_patched_result(purl, &display_path, &record.files),
+        ),
+        None => {
+            let (jar, result) =
+                match service_archive_copy(service, record, &artifact_id, ".jar", &mut warnings)
+                    .await
+                {
+                    ServiceCopy::Used(bytes) => (
+                        bytes,
+                        already_patched_result(purl, &display_path, &record.files),
+                    ),
+                    ServiceCopy::HardFail(outcome) => return *outcome,
+                    ServiceCopy::FallBack => {
+                        match local_rebuild_jar(
+                            purl,
+                            installed_dir,
+                            &display_path,
+                            &artifact_id,
+                            &version,
+                            record,
+                            sources,
+                            force,
+                            &mut warnings,
+                        )
+                        .await
+                        {
+                            Ok((bytes, result)) if result.success => {
+                                let upstream = match read_regular_to_bytes(
+                                    &installed_dir.join(format!("{artifact_id}-{version}.jar")),
+                                )
+                                .await
+                                {
+                                    Ok(bytes) => bytes,
+                                    Err(e) => {
+                                        return refused(
+                                            "vendor_jvm_upstream_unavailable",
+                                            e.to_string(),
+                                        )
+                                    }
+                                };
+                                if let Err(e) = verify_jvm_upstream(
+                                    &upstream,
+                                    &group_id,
+                                    &artifact_id,
+                                    &version,
+                                    "jar",
+                                    service,
+                                )
+                                .await
+                                {
+                                    return refused("vendor_prebuilt_integrity_mismatch", e);
+                                }
+                                match super::jvm::archive::canonical_jar(&upstream, &bytes) {
+                                    Ok(bytes) => (bytes, result),
+                                    Err(e) => return refused("vendor_jvm_upstream_unavailable", e),
+                                }
+                            }
+                            Ok(pair) => pair,
+                            Err(outcome) => return jvm_refusal(*outcome),
+                        }
+                    }
+                };
+            if !result.success {
+                return done(result, None, warnings);
+            }
+            let pom = match acquire_jvm_metadata(
+                installed_dir,
+                &group_id,
+                &artifact_id,
+                &version,
+                "pom",
+                service,
+            )
+            .await
+            {
+                Ok(bytes) => bytes,
+                Err(detail) => {
+                    return refused(
+                        "vendor_jvm_upstream_unavailable",
+                        format!("reason: pom_unavailable: {detail}"),
+                    )
+                }
+            };
+            let module = read_regular_to_bytes(
+                &installed_dir.join(format!("{artifact_id}-{version}.module")),
+            )
+            .await
+            .ok();
+            (jar, pom, module, result)
+        }
+    };
+
+    let online = service.is_some_and(|s| !s.offline);
+    if online && was_committed {
+        let upstream = match acquire_jvm_metadata(
+            installed_dir,
+            &group_id,
+            &artifact_id,
+            &version,
+            "jar",
+            service,
+        )
+        .await
+        {
+            Ok(bytes) => bytes,
+            Err(e) => return refused("vendor_jvm_upstream_unavailable", e),
+        };
+        if let Err(e) = verify_unpatched_jar_members(&upstream, &jar_bytes, record) {
+            return refused("vendor_prebuilt_integrity_mismatch", e);
+        }
+        pom_bytes = match acquire_jvm_metadata(
+            installed_dir,
+            &group_id,
+            &artifact_id,
+            &version,
+            "pom",
+            service,
+        )
+        .await
+        {
+            Ok(bytes) => bytes,
+            Err(e) => return refused("vendor_jvm_upstream_unavailable", e),
+        };
+    }
+    if shape == super::jvm::Shape::Gradle
+        && (module_bytes.is_some()
+            || String::from_utf8_lossy(&pom_bytes).contains("published-with-gradle-metadata"))
+        && (module_bytes.is_none() || online)
+    {
+        module_bytes = match acquire_jvm_metadata(
+            installed_dir,
+            &group_id,
+            &artifact_id,
+            &version,
+            "module",
+            service,
+        )
+        .await
+        {
+            Ok(bytes) => Some(bytes),
+            Err(e) => return refused("vendor_jvm_upstream_unavailable", e),
+        };
+    }
+    let patch = super::jvm::JvmPatch {
+        group_id: &group_id,
+        artifact_id: &artifact_id,
+        version: &version,
+        uuid: &record.uuid,
+        jar: &jar_bytes,
+        upstream_pom: &pom_bytes,
+        upstream_module: module_bytes.as_deref(),
+    };
+    let reader = super::jvm::apply::ProjectReader::new(project_root);
+    let prior_disabled = state.as_ref().is_some_and(|s| {
+        s.entries.values().any(|e| {
+            e.wiring
+                .iter()
+                .any(|w| super::jvm::op_of(w) == "config_none")
+        })
+    });
+    let config_enabled = service
+        .and_then(|s| s.maven_config)
+        .unwrap_or(!prior_disabled);
+    if !config_enabled
+        && state.as_ref().is_some_and(|s| {
+            s.entries.values().any(|e| {
+                e.wiring.iter().any(|w| {
+                    w.kind == super::jvm::CONFIG_LINE_KIND && super::jvm::op_of(w) == "config"
+                })
+            })
+        })
+    {
+        return refused("vendor_jvm_shape_unsupported", "reason: maven_config_changed: revert the existing Maven wiring before selecting --maven-config=none");
+    }
+    let read = |rel: &str| reader.read(rel);
+    let planned = match shape {
+        super::jvm::Shape::MavenReactor => {
+            super::jvm::maven_reactor::plan_with_config(&read, &patch, config_enabled)
+        }
+        _ => super::jvm::plan(shape, &read, &patch),
+    };
+    if let Some(rel) = reader.escaped() {
+        return refused(
+            "vendor_jvm_shape_unsupported",
+            super::jvm::apply::outside_root_detail(&rel),
+        );
+    }
+    let mut plan = match planned {
+        Ok(plan) => plan,
+        Err(refusal) => return refused(refusal.code, refusal.detail),
+    };
+    if shape == super::jvm::Shape::Gradle
+        && reader
+            .read(super::jvm::gradle::VERIFICATION_REL)
+            .is_some_and(|b| super::jvm::gradle::verifies_metadata(&String::from_utf8_lossy(&b)))
+    {
+        // An in-sync run can reuse the already recorded metadata edits offline.
+        let previous = state.as_ref().and_then(|s| {
+            s.entries.values().find(|e| {
+                e.uuid == record.uuid
+                    && e.base_purl == build_maven_purl(&group_id, &artifact_id, &version)
+            })
+        });
+        let metadata_records: Vec<_> = previous
+            .into_iter()
+            .flat_map(|e| &e.wiring)
+            .filter(|w| {
+                w.kind == super::jvm::VERIFICATION_FRAGMENT_KIND
+                    && w.key.as_deref().is_some_and(|k| k.starts_with("metadata:"))
+            })
+            .cloned()
+            .collect();
+        let text = reader
+            .read(super::jvm::gradle::VERIFICATION_REL)
+            .unwrap_or_default();
+        let reusable = !online
+            && !metadata_records.is_empty()
+            && metadata_records.iter().all(|w| {
+                super::jvm::gradle::metadata_record_present(&String::from_utf8_lossy(&text), w)
+            });
+        if reusable {
+            plan.records.extend(metadata_records);
+            plan.warnings.retain(|w| {
+                !w.detail
+                    .starts_with("reason: verification_parent_chain_unhandled:")
+            });
+        } else {
+            let mut repo = installed_dir.to_path_buf();
+            for _ in 0..group_id.split('.').count() + 2 {
+                repo.pop();
+            }
+            let mut metadata = vec![super::jvm::gradle::MetadataArtifact {
+                group: group_id.clone(),
+                artifact: artifact_id.clone(),
+                version: version.clone(),
+                extension: "pom",
+                bytes: pom_bytes.clone(),
+            }];
+            if let Some(module) = &module_bytes {
+                metadata.push(super::jvm::gradle::MetadataArtifact {
+                    group: group_id.clone(),
+                    artifact: artifact_id.clone(),
+                    version: version.clone(),
+                    extension: "module",
+                    bytes: module.clone(),
+                });
+            }
+            // Gradle verifies both the parent's standalone model and the
+            // child's effective imports, which can select different BOM versions.
+            for propagate_properties in [false, true] {
+                if let Err(e) = collect_gradle_metadata(
+                    &pom_bytes,
+                    &repo,
+                    service,
+                    &mut metadata,
+                    0,
+                    &std::collections::BTreeMap::new(),
+                    propagate_properties,
+                )
+                .await
+                {
+                    return refused(
+                        "vendor_jvm_upstream_unavailable",
+                        format!("reason: verification_metadata_unavailable: {e}"),
+                    );
+                }
+            }
+            if let Err(e) =
+                super::jvm::gradle::add_verification_metadata(&read, &mut plan, &metadata)
+            {
+                return refused(e.code, e.detail);
+            }
+        }
+    }
+    let previous = state.as_ref().and_then(|s| {
+        s.entries.values().find(|e| {
+            e.uuid == record.uuid
+                && e.base_purl == build_maven_purl(&group_id, &artifact_id, &version)
+        })
+    });
+    let prior_verified = previous.is_some_and(|e| !super::jvm::apply::upstream_unverified(e));
+    let registry_verified = online || (was_committed && prior_verified);
+    plan.records.push(WiringRecord {file: plan.jar_rel.clone(), kind: super::jvm::UPSTREAM_KIND.into(), action: WiringAction::Added, key: Some("upstream".into()), original: None, new: Some(serde_json::json!({"op": if registry_verified {"registry_verified"} else {"local_unverified"}}))});
+    warnings.extend(
+        plan.warnings
+            .iter()
+            .map(|w| VendorWarning::new(w.code, w.detail.clone())),
+    );
+    let jar_path = project_root.join(&plan.jar_rel);
+    result.package_path = jar_path.display().to_string();
+    if plan.writes.is_empty() && (previous.is_none() || registry_verified == prior_verified) {
+        return done(
+            already_patched_result(purl, &jar_path, &record.files),
+            None,
+            warnings,
+        );
+    }
+    if dry_run {
+        return done(result, None, warnings);
+    }
+    let mut wiring = match super::jvm::apply::write_plan(project_root, &plan).await {
+        Ok(records) => records,
+        Err(e) => return done(failed_result(purl, &jar_path, e), None, warnings),
+    };
+    // Shared fragments another JVM entry wrote, and the pristine originals
+    // of a patch update, come from the ledger.
+    if let Some(state) = &state {
+        super::jvm::apply::inherit_peer_records(&mut wiring, state.entries.values());
+    }
+    let mut entry = maven_entry(
+        build_maven_purl(&group_id, &artifact_id, &version),
+        record,
+        plan.jar_rel.clone(),
+        &jar_bytes,
+        wiring,
+    );
+    entry.ecosystem = "jvm".to_string();
+    done(result, Some(entry), warnings)
+}
+
+/// Verify upstream cache/registry bytes against checksums fetched independently over TLS.
+fn verify_unpatched_jar_members(
+    upstream: &[u8],
+    patched: &[u8],
+    record: &PatchRecord,
+) -> Result<(), String> {
+    let mut original = super::verify::read_zip_bytes_to_map(upstream)?;
+    let mut committed = super::verify::read_zip_bytes_to_map(patched)?;
+    let retain = |name: &String, _: &mut Vec<u8>| {
+        !record.files.contains_key(name) && !super::jvm::archive::is_signature(name)
+    };
+    original.retain(retain);
+    committed.retain(retain);
+    if original != committed {
+        return Err(
+            "committed jar's unpatched members differ from the verified upstream jar".into(),
+        );
+    }
+    Ok(())
+}
+
+/// Check registry sidecars independently of any checksum in the local cache.
+async fn verify_jvm_upstream(
+    bytes: &[u8],
+    g: &str,
+    a: &str,
+    v: &str,
+    ext: &str,
+    service: Option<&VendorServiceConfig>,
+) -> Result<(), String> {
+    if service.is_none_or(|s| s.offline) {
+        return Ok(());
+    }
+    use sha2::Digest;
+    let url = format!(
+        "{}/{gpath}/{a}/{v}/{a}-{v}.{ext}",
+        maven_registry_base(),
+        gpath = group_id_to_path(g)
+    );
+    let (checksum, actual) = match fetch_pom_bytes(&format!("{url}.sha512")).await {
+        Ok(sum) => (sum, hex::encode(sha2::Sha512::digest(bytes))),
+        Err(_) => (
+            fetch_pom_bytes(&format!("{url}.sha1")).await?,
+            sha1_hex(bytes),
+        ),
+    };
+    let expected = std::str::from_utf8(&checksum)
+        .map_err(|_| "upstream checksum is not UTF-8")?
+        .split_whitespace()
+        .next()
+        .ok_or("upstream checksum is empty")?;
+    if !expected.eq_ignore_ascii_case(&actual) {
+        return Err(format!("upstream checksum mismatch for {g}:{a}:{v}.{ext}"));
+    }
+    Ok(())
+}
+
+async fn acquire_jvm_metadata(
+    dir: &Path,
+    g: &str,
+    a: &str,
+    v: &str,
+    ext: &str,
+    service: Option<&VendorServiceConfig>,
+) -> Result<Vec<u8>, String> {
+    let path = dir.join(format!("{a}-{v}.{ext}"));
+    let bytes = match read_regular_to_bytes(&path).await {
+        Ok(bytes) => bytes,
+        Err(e)
+            if e.kind() == std::io::ErrorKind::NotFound && service.is_some_and(|s| !s.offline) =>
+        {
+            fetch_registry_bytes(
+                &format!(
+                    "{}/{}/{a}/{v}/{a}-{v}.{ext}",
+                    maven_registry_base(),
+                    group_id_to_path(g)
+                ),
+                if ext == "jar" {
+                    super::registry_fetch::MAX_DOWNLOAD_BYTES
+                } else {
+                    MAX_POM_BYTES as u64
+                },
+            )
+            .await?
+        }
+        Err(e) => return Err(format!("upstream {g}:{a}:{v}.{ext} unavailable: {e}")),
+    };
+    verify_jvm_upstream(&bytes, g, a, v, ext, service).await?;
+    Ok(bytes)
+}
+
+/// Collect effective parent/BOM metadata. Descendant properties override parent
+/// import versions, but do not leak into a separately imported BOM's own model.
+async fn collect_gradle_metadata(
+    bytes: &[u8],
+    repo: &Path,
+    service: Option<&VendorServiceConfig>,
+    out: &mut Vec<super::jvm::gradle::MetadataArtifact>,
+    depth: usize,
+    descendant: &std::collections::BTreeMap<String, String>,
+    propagate_properties: bool,
+) -> Result<std::collections::BTreeMap<String, String>, String> {
+    use super::jvm::maven_reactor::metadata_model;
+    if depth > 32 || out.len() > 128 {
+        return Err("upstream metadata graph exceeds the depth or size limit".into());
+    }
+    let empty = std::collections::BTreeMap::new();
+    let model = metadata_model(bytes, &empty, descendant, false)?;
+    let mut properties = empty;
+    if let Some((g, a, v)) = model.parent {
+        let path = repo.join(group_id_to_path(&g)).join(&a).join(&v);
+        let parent = acquire_jvm_metadata(&path, &g, &a, &v, "pom", service).await?;
+        let child_properties = model
+            .properties
+            .into_iter()
+            .filter(|(key, _)| {
+                propagate_properties
+                    && !matches!(
+                        key.as_str(),
+                        "project.groupId" | "project.artifactId" | "project.version"
+                    )
+            })
+            .collect();
+        properties = Box::pin(collect_gradle_metadata(
+            &parent,
+            repo,
+            service,
+            out,
+            depth + 1,
+            &child_properties,
+            propagate_properties,
+        ))
+        .await?;
+        collect_metadata_artifacts(repo, &g, &a, &v, parent, service, out).await?;
+    }
+    let model = metadata_model(bytes, &properties, descendant, true)?;
+    for (g, a, v) in model.imports {
+        if out
+            .iter()
+            .any(|m| m.group == g && m.artifact == a && m.version == v && m.extension == "pom")
+        {
+            continue;
+        }
+        let path = repo.join(group_id_to_path(&g)).join(&a).join(&v);
+        let bom = acquire_jvm_metadata(&path, &g, &a, &v, "pom", service).await?;
+        Box::pin(collect_gradle_metadata(
+            &bom,
+            repo,
+            service,
+            out,
+            depth + 1,
+            &std::collections::BTreeMap::new(),
+            propagate_properties,
+        ))
+        .await?;
+        collect_metadata_artifacts(repo, &g, &a, &v, bom, service, out).await?;
+    }
+    Ok(model.properties)
+}
+
+async fn collect_metadata_artifacts(
+    repo: &Path,
+    g: &str,
+    a: &str,
+    v: &str,
+    pom: Vec<u8>,
+    service: Option<&VendorServiceConfig>,
+    out: &mut Vec<super::jvm::gradle::MetadataArtifact>,
+) -> Result<(), String> {
+    if out
+        .iter()
+        .any(|m| m.group == g && m.artifact == a && m.version == v)
+    {
+        return Ok(());
+    }
+    let module = if String::from_utf8_lossy(&pom).contains("published-with-gradle-metadata") {
+        let path = repo.join(group_id_to_path(g)).join(a).join(v);
+        Some(acquire_jvm_metadata(&path, g, a, v, "module", service).await?)
+    } else {
+        None
+    };
+    for (extension, bytes) in [("pom", Some(pom)), ("module", module)] {
+        if let Some(bytes) = bytes {
+            out.push(super::jvm::gradle::MetadataArtifact {
+                group: g.into(),
+                artifact: a.into(),
+                version: v.into(),
+                extension,
+                bytes,
+            });
+        }
+    }
+    Ok(())
+}
+
+/// A legacy jar refusal in the JVM backend's codes.
+fn jvm_refusal(outcome: VendorOutcome) -> VendorOutcome {
+    match outcome {
+        VendorOutcome::Refused {
+            code: "vendor_maven_jar_not_found",
+            detail,
+        } => refused(
+            "vendor_jvm_upstream_unavailable",
+            format!("reason: no_base_jar: {detail}"),
+        ),
+        other => other,
+    }
+}
+
 // ── materialisation (service download / local rebuild) ──────────────────────────
 
 /// Produce the patched jar bytes + the real upstream pom, then write both (with
@@ -908,6 +1631,10 @@ async fn acquire_upstream_pom(
 
 /// Bounded HTTP GET of a pom from the maven2 registry.
 async fn fetch_pom_bytes(url: &str) -> Result<Vec<u8>, String> {
+    fetch_registry_bytes(url, MAX_POM_BYTES as u64).await
+}
+
+async fn fetch_registry_bytes(url: &str, cap: u64) -> Result<Vec<u8>, String> {
     let client = reqwest::Client::builder()
         .user_agent(MAVEN_USER_AGENT)
         .timeout(Duration::from_secs(60))
@@ -925,7 +1652,7 @@ async fn fetch_pom_bytes(url: &str) -> Result<Vec<u8>, String> {
     // bytes (the shared reader every other registry download uses): a
     // mirror serving a huge body is refused mid-stream instead of being
     // buffered whole before the size check.
-    crate::utils::http::read_capped(resp, MAX_POM_BYTES as u64, "pom")
+    crate::utils::http::read_capped(resp, cap, "Maven artifact")
         .await
         .map_err(|e| format!("{url}: {e}"))
 }
@@ -1950,7 +2677,7 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn refuses_multimodule_root() {
+    async fn missing_reactor_module_is_refused_without_writes() {
         let multimodule = "<project xmlns=\"http://maven.apache.org/POM/4.0.0\">\n\
              \x20 <modelVersion>4.0.0</modelVersion>\n\
              \x20 <groupId>com.example</groupId>\n\
@@ -1964,7 +2691,7 @@ mod tests {
         let (dir, blobs, installed, record) = fixture(Some(multimodule), true, true).await;
         let root = dir.path();
         let (code, _d) = unwrap_refused(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert_eq!(code, "vendor_maven_multimodule_unsupported");
+        assert_eq!(code, "vendor_jvm_shape_unsupported");
         assert!(!root.join(".socket").exists(), "refusal writes nothing");
     }
 
@@ -1990,16 +2717,18 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn refuses_gradle_only_project() {
+    async fn vendors_gradle_only_project_by_default() {
         // build.gradle but no pom.xml → gradle-only.
         let (dir, blobs, installed, record) = fixture(None, true, true).await;
         let root = dir.path();
         tokio::fs::write(root.join("build.gradle"), b"plugins { id 'java' }\n")
             .await
             .unwrap();
-        let (code, _d) = unwrap_refused(run_vendor(root, &blobs, &installed, &record, false).await);
-        assert_eq!(code, "vendor_gradle_unsupported");
-        assert!(!root.join(".socket").exists());
+        let (result, entry, _) =
+            unwrap_done(run_vendor(root, &blobs, &installed, &record, false).await);
+        assert!(result.success, "{:?}", result.error);
+        assert_eq!(entry.unwrap().ecosystem, "jvm");
+        assert!(root.join(".socket/vendor/gradle-index.tsv").is_file());
     }
 
     #[tokio::test]
@@ -2833,6 +3562,7 @@ mod tests {
     ) -> VendorServiceConfig {
         use crate::api::client::{ApiClient, ApiClientOptions};
         VendorServiceConfig {
+            maven_config: None,
             source,
             client: api_url.map(|uri| {
                 ApiClient::new(ApiClientOptions {
@@ -4266,4 +4996,306 @@ mod tests {
         assert_eq!(code, "vendor_prebuilt_required");
         assert!(!root.join(".socket").exists(), "nothing written");
     }
+
+    #[tokio::test]
+    #[serial_test::serial]
+    async fn jvm_upstream_checksums_are_independent_of_cache_sidecars() {
+        use wiremock::matchers::{method, path};
+        use wiremock::{Mock, MockServer, ResponseTemplate};
+        let server = MockServer::start().await;
+        let _reg = EnvGuard::set("SOCKET_MAVEN_REGISTRY", &server.uri());
+        let cfg = service_cfg(None, crate::vendor::VendorSource::Build, false);
+        let bytes = b"upstream";
+        let route = "/org/example/foo/1/foo-1.jar";
+        Mock::given(method("GET"))
+            .and(path(format!("{route}.sha512")))
+            .respond_with(
+                ResponseTemplate::new(200)
+                    .set_body_string(hex::encode(sha2::Sha512::digest(bytes))),
+            )
+            .mount(&server)
+            .await;
+        assert!(
+            verify_jvm_upstream(bytes, "org.example", "foo", "1", "jar", Some(&cfg))
+                .await
+                .is_ok()
+        );
+        assert!(
+            verify_jvm_upstream(b"corrupt", "org.example", "foo", "1", "jar", Some(&cfg))
+                .await
+                .unwrap_err()
+                .contains("checksum mismatch")
+        );
+        server.reset().await;
+        Mock::given(method("GET"))
+            .and(path(format!("{route}.sha1")))
+            .respond_with(ResponseTemplate::new(200).set_body_string(sha1_hex(bytes)))
+            .mount(&server)
+            .await;
+        assert!(
+            verify_jvm_upstream(bytes, "org.example", "foo", "1", "jar", Some(&cfg))
+                .await
+                .is_ok()
+        );
+        server.reset().await;
+        assert!(
+            verify_jvm_upstream(bytes, "org.example", "foo", "1", "jar", Some(&cfg))
+                .await
+                .is_err()
+        );
+        let mut offline = cfg;
+        offline.offline = true;
+        assert!(
+            verify_jvm_upstream(bytes, "org.example", "foo", "1", "jar", Some(&offline))
+                .await
+                .is_ok()
+        );
+    }
+
+    // ── JVM backend glue ──
+
+    const REACTOR_ROOT: &str = "<project>\n  <modelVersion>4.0.0</modelVersion>\n  \
+        <groupId>t</groupId>\n  <artifactId>root</artifactId>\n  <version>1</version>\n  \
+        <packaging>pom</packaging>\n  <modules>\n    <module>a</module>\n  </modules>\n</project>\n";
+
+    fn reactor_module() -> String {
+        "<project>\n  <parent>\n    <groupId>t</groupId>\n    <artifactId>root</artifactId>\n    \
+         <version>1</version>\n  </parent>\n  <artifactId>a</artifactId>\n  <dependencies>\n    \
+         <dependency><groupId>org.apache.commons</groupId><artifactId>commons-text</artifactId>\
+         <version>1.10.0</version></dependency>\n  </dependencies>\n</project>\n"
+            .to_string()
+    }
+
+    async fn reactor_fixture(
+        with_local_jar: bool,
+    ) -> (tempfile::TempDir, PathBuf, PathBuf, PatchRecord) {
+        let fx = fixture(Some(REACTOR_ROOT), with_local_jar, true).await;
+        let a = fx.0.path().join("a");
+        tokio::fs::create_dir_all(&a).await.unwrap();
+        tokio::fs::write(a.join("pom.xml"), reactor_module())
+            .await
+            .unwrap();
+        fx
+    }
+
+    #[tokio::test]
+    async fn corrupt_jvm_ledger_refuses_without_losing_revert_records() {
+        let (dir, blobs, installed, record) = reactor_fixture(true).await;
+        let root = dir.path();
+        std::fs::create_dir_all(root.join(".socket/vendor")).unwrap();
+        std::fs::write(root.join(".socket/vendor/state.json"), "{corrupt").unwrap();
+        let (code, _) = unwrap_refused(run_jvm(root, &blobs, &installed, &record, None).await);
+        assert_eq!(code, "vendor_state_unreadable");
+        assert_eq!(
+            std::fs::read_to_string(root.join("pom.xml")).unwrap(),
+            REACTOR_ROOT
+        );
+        assert_eq!(
+            std::fs::read_to_string(root.join(".socket/vendor/state.json")).unwrap(),
+            "{corrupt"
+        );
+        assert!(!root.join(".socket/vendor/maven2").exists());
+    }
+
+    #[tokio::test]
+    async fn empty_jvm_patch_still_validates_the_reactor_layout() {
+        let (dir, blobs, installed, mut record) = reactor_fixture(true).await;
+        record.files.clear();
+        std::fs::remove_file(dir.path().join("a/pom.xml")).unwrap();
+        let (code, detail) =
+            unwrap_refused(run_jvm(dir.path(), &blobs, &installed, &record, None).await);
+        assert_eq!(code, "vendor_jvm_shape_unsupported");
+        assert!(detail.contains("module"), "{detail}");
+        assert!(!dir.path().join(".socket").exists());
+    }
+
+    async fn run_jvm(
+        root: &Path,
+        blobs: &Path,
+        installed: &Path,
+        record: &PatchRecord,
+        service: Option<&VendorServiceConfig>,
+    ) -> VendorOutcome {
+        let sources = PatchSources::blobs_only(blobs);
+        vendor_maven_jvm(
+            super::super::jvm::Shape::MavenReactor,
+            PURL,
+            installed,
+            root,
+            record,
+            &sources,
+            false,
+            false,
+            service,
+        )
+        .await
+    }
+
+    /// A re-run over a committed tree that holds this patch needs no jar
+    /// source: no cached jar, and `--vendor-source=service --offline`.
+    #[tokio::test]
+    async fn jvm_rerun_is_in_sync_without_any_jar_source() {
+        let (dir, blobs, installed, record) = reactor_fixture(true).await;
+        let root = dir.path();
+        let (result, entry, _) =
+            unwrap_done(run_jvm(root, &blobs, &installed, &record, None).await);
+        assert!(result.success, "{result:?}");
+        let entry = entry.expect("ledger entry");
+        assert!(super::super::jvm::apply::is_jvm_entry(&entry));
+        tokio::fs::remove_file(installed.join("commons-text-1.10.0.jar"))
+            .await
+            .unwrap();
+        tokio::fs::remove_file(installed.join("commons-text-1.10.0.pom"))
+            .await
+            .unwrap();
+        let cfg = crate::vendor::test_support::service_cfg(
+            "http://127.0.0.1:9",
+            crate::vendor::VendorSource::Service,
+            true,
+        );
+        let (result, again, _) =
+            unwrap_done(run_jvm(root, &blobs, &installed, &record, Some(&cfg)).await);
+        assert!(result.success && again.is_none(), "{result:?}");
+        assert!(
+            jvm_committed_patch(super::super::jvm::Shape::MavenReactor, PURL, root, &record)
+                .await
+                .is_some(),
+            "the service prefetch plan skips an in-sync JVM entry"
+        );
+        // A tampered committed jar is not in sync: the jar source is needed.
+        let jar = root.join(&entry.artifact.path);
+        tokio::fs::write(&jar, make_jar(PRISTINE)).await.unwrap();
+        let (code, detail) = unwrap_refused(run_jvm(root, &blobs, &installed, &record, None).await);
+        assert_eq!(code, "vendor_jvm_upstream_unavailable");
+        assert!(detail.starts_with("reason: no_base_jar: "), "{detail}");
+    }
+
+    #[tokio::test]
+    async fn jvm_revert_honours_keep_artifact_and_restores_the_poms() {
+        let (dir, blobs, installed, record) = reactor_fixture(true).await;
+        let root = dir.path();
+        let (_, entry, _) = unwrap_done(run_jvm(root, &blobs, &installed, &record, None).await);
+        let entry = entry.unwrap();
+        let out = revert_maven_opts(
+            &entry,
+            root,
+            RevertOpts {
+                dry_run: false,
+                keep_artifact: true,
+            },
+        )
+        .await;
+        assert!(
+            out.success && !out.kept_artifact && out.warnings.is_empty(),
+            "{out:?}"
+        );
+        assert!(
+            root.join(&entry.artifact.path).is_file(),
+            "--preserve-state keeps the jar"
+        );
+        assert_eq!(
+            std::fs::read_to_string(root.join("pom.xml")).unwrap(),
+            REACTOR_ROOT
+        );
+        assert_eq!(
+            std::fs::read_to_string(root.join("a/pom.xml")).unwrap(),
+            reactor_module()
+        );
+        assert!(!root.join(".mvn").exists());
+    }
+
+    /// A forged JVM entry (tamper-able state.json) is refused before any
+    /// disk access.
+    #[tokio::test]
+    async fn jvm_revert_refuses_forged_entries() {
+        let dir = tempfile::tempdir().unwrap();
+        let root = dir.path();
+        tokio::fs::create_dir_all(root.join("src")).await.unwrap();
+        tokio::fs::write(root.join("src/Main.java"), "class Main {}\n")
+            .await
+            .unwrap();
+        let tree = |file: &str| WiringRecord {
+            file: file.to_string(),
+            kind: super::super::jvm::TREE_KIND.to_string(),
+            action: WiringAction::Added,
+            key: None,
+            original: None,
+            new: Some(Value::String(hex::encode(Sha256::digest(
+                b"class Main {}\n",
+            )))),
+        };
+        let forged = |uuid: &str, file: &str| VendorEntry {
+            uuid: uuid.to_string(),
+            wiring: vec![tree(file)],
+            ..maven_entry(
+                PURL.to_string(),
+                &PatchRecord {
+                    uuid: UUID.to_string(),
+                    ..fixture_record()
+                },
+                String::new(),
+                b"",
+                Vec::new(),
+            )
+        };
+        for entry in [
+            forged("../../../NOT-A-UUID", "src/Main.java"),
+            forged(UUID, "src/Main.java"),
+        ] {
+            let out = revert_maven_opts(&entry, root, RevertOpts::new(false)).await;
+            assert!(!out.success, "{out:?}");
+        }
+        assert!(root.join("src/Main.java").is_file());
+    }
+
+    fn fixture_record() -> PatchRecord {
+        PatchRecord {
+            uuid: UUID.to_string(),
+            exported_at: String::new(),
+            files: HashMap::new(),
+            vulnerabilities: HashMap::new(),
+            description: String::new(),
+            license: String::new(),
+            tier: String::new(),
+        }
+    }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn jvm_refuses_a_module_symlinked_outside_the_checkout() {
+        let (dir, blobs, installed, record) = fixture(Some(REACTOR_ROOT), true, true).await;
+        let root = dir.path();
+        let outside = tempfile::tempdir().unwrap();
+        tokio::fs::write(outside.path().join("pom.xml"), reactor_module())
+            .await
+            .unwrap();
+        std::os::unix::fs::symlink(outside.path(), root.join("a")).unwrap();
+        let (code, detail) = unwrap_refused(run_jvm(root, &blobs, &installed, &record, None).await);
+        assert_eq!(code, "vendor_jvm_shape_unsupported");
+        assert!(
+            detail.starts_with("reason: build_file_outside_root: a "),
+            "{detail}"
+        );
+        assert_eq!(
+            std::fs::read_to_string(outside.path().join("pom.xml")).unwrap(),
+            reactor_module()
+        );
+    }
+
+    /// A previously vendored project keeps routing to the JVM backend when the
+    /// switch is unset (its ledger names a JVM entry).
+    #[tokio::test]
+    async fn jvm_routing_follows_the_ledger() {
+        let (dir, blobs, installed, record) = reactor_fixture(true).await;
+        let root = dir.path();
+        assert!(jvm_shape(root).await.is_some());
+        let (_, entry, _) = unwrap_done(run_jvm(root, &blobs, &installed, &record, None).await);
+        let mut state = super::super::state::VendorState::new();
+        state.entries.insert(PURL.to_string(), entry.unwrap());
+        super::super::state::save_state(root, &state).await.unwrap();
+        assert_eq!(
+            jvm_shape(root).await,
+            Some(super::super::jvm::Shape::MavenReactor)
+        );
+    }
 }
diff --git a/crates/socket-patch-core/src/vendor/mod.rs b/crates/socket-patch-core/src/vendor/mod.rs
index 0ab48d9f..1fc2f979 100644
--- a/crates/socket-patch-core/src/vendor/mod.rs
+++ b/crates/socket-patch-core/src/vendor/mod.rs
@@ -65,6 +65,7 @@ pub mod gem;
 pub mod go_mod_edit;
 pub mod go_sum_edit;
 pub mod golang;
+pub mod jvm;
 pub(crate) mod ledger_snapshots;
 pub mod lock_inventory;
 pub mod maven_repo;
@@ -264,6 +265,8 @@ impl VendorSource {
 /// "build-only".
 #[derive(Debug, Clone)]
 pub struct VendorServiceConfig {
+    /// Override Maven config wiring; None preserves the recorded choice (auto for new projects).
+    pub maven_config: Option<bool>,
     /// The `auto` / `service` / `build` policy.
     pub source: VendorSource,
     /// The run-level API client (reused from the CLI). `None` disables the
diff --git a/crates/socket-patch-core/src/vendor/npm_common.rs b/crates/socket-patch-core/src/vendor/npm_common.rs
index 0fd4315e..479302ed 100644
--- a/crates/socket-patch-core/src/vendor/npm_common.rs
+++ b/crates/socket-patch-core/src/vendor/npm_common.rs
@@ -1286,6 +1286,7 @@ mod tests {
 
     fn service_cfg(server_uri: &str, source: VendorSource) -> VendorServiceConfig {
         VendorServiceConfig {
+            maven_config: None,
             source,
             client: Some(
                 ApiClient::new(ApiClientOptions {
diff --git a/crates/socket-patch-core/src/vendor/npm_lock.rs b/crates/socket-patch-core/src/vendor/npm_lock.rs
index c518e9c1..6f32ff94 100644
--- a/crates/socket-patch-core/src/vendor/npm_lock.rs
+++ b/crates/socket-patch-core/src/vendor/npm_lock.rs
@@ -3707,6 +3707,7 @@ mod tests {
 
     fn service_cfg(server_uri: &str, source: VendorSource, offline: bool) -> VendorServiceConfig {
         VendorServiceConfig {
+            maven_config: None,
             source,
             client: Some(
                 ApiClient::new(ApiClientOptions {
diff --git a/crates/socket-patch-core/src/vendor/nuget_feed.rs b/crates/socket-patch-core/src/vendor/nuget_feed.rs
index ba8a4b25..371482ec 100644
--- a/crates/socket-patch-core/src/vendor/nuget_feed.rs
+++ b/crates/socket-patch-core/src/vendor/nuget_feed.rs
@@ -4437,6 +4437,7 @@ mod tests {
             .mount(&server)
             .await;
         let cfg = VendorServiceConfig {
+            maven_config: None,
             source: VendorSource::Service,
             client: Some(
                 ApiClient::new(ApiClientOptions {
@@ -4518,6 +4519,7 @@ mod tests {
             .mount(&server)
             .await;
         let cfg = VendorServiceConfig {
+            maven_config: None,
             source: VendorSource::Service,
             client: Some(
                 ApiClient::new(ApiClientOptions {
@@ -5008,6 +5010,7 @@ mod tests {
             .mount(&server)
             .await;
         let cfg = VendorServiceConfig {
+            maven_config: None,
             source: VendorSource::Service,
             client: Some(
                 ApiClient::new(ApiClientOptions {
@@ -5224,6 +5227,7 @@ mod tests {
     ) -> VendorServiceConfig {
         use crate::api::client::{ApiClient, ApiClientOptions};
         VendorServiceConfig {
+            maven_config: None,
             source,
             client: server.map(|s| {
                 ApiClient::new(ApiClientOptions {
diff --git a/crates/socket-patch-core/src/vendor/pypi.rs b/crates/socket-patch-core/src/vendor/pypi.rs
index 5b3cb18f..54bc00b0 100644
--- a/crates/socket-patch-core/src/vendor/pypi.rs
+++ b/crates/socket-patch-core/src/vendor/pypi.rs
@@ -2909,6 +2909,7 @@ wheels = [
         offline: bool,
     ) -> VendorServiceConfig {
         VendorServiceConfig {
+            maven_config: None,
             source,
             client: Some(
                 ApiClient::new(ApiClientOptions {
diff --git a/crates/socket-patch-core/src/vendor/service_fetch.rs b/crates/socket-patch-core/src/vendor/service_fetch.rs
index cbde546a..3975db26 100644
--- a/crates/socket-patch-core/src/vendor/service_fetch.rs
+++ b/crates/socket-patch-core/src/vendor/service_fetch.rs
@@ -412,6 +412,7 @@ mod tests {
 
     fn cfg_for(server: &MockServer) -> VendorServiceConfig {
         VendorServiceConfig {
+            maven_config: None,
             source: VendorSource::Service,
             client: Some(
                 ApiClient::new(ApiClientOptions {
@@ -577,6 +578,7 @@ mod tests {
     #[tokio::test]
     async fn unavailable_when_client_absent() {
         let cfg = VendorServiceConfig {
+            maven_config: None,
             source: VendorSource::Auto,
             client: None,
             use_public_proxy: false,
diff --git a/crates/socket-patch-core/src/vendor/test_support.rs b/crates/socket-patch-core/src/vendor/test_support.rs
index 66c1f8e5..95f11389 100644
--- a/crates/socket-patch-core/src/vendor/test_support.rs
+++ b/crates/socket-patch-core/src/vendor/test_support.rs
@@ -49,6 +49,7 @@ pub(crate) fn service_cfg(
     offline: bool,
 ) -> VendorServiceConfig {
     VendorServiceConfig {
+        maven_config: None,
         source,
         client: Some(
             ApiClient::new(ApiClientOptions {
diff --git a/crates/socket-patch-core/src/vendor/verify.rs b/crates/socket-patch-core/src/vendor/verify.rs
index f9080b61..cf5d7e48 100644
--- a/crates/socket-patch-core/src/vendor/verify.rs
+++ b/crates/socket-patch-core/src/vendor/verify.rs
@@ -50,6 +50,13 @@ pub(crate) fn checked_artifact_path(
     entry: &VendorEntry,
     record: &PatchRecord,
 ) -> Result<PathBuf, String> {
+    // The JVM trees are not `<eco>/<uuid>` dirs: the jar must be the
+    // entry's own tree jar for this uuid (checked against the layout and
+    // the marker).
+    if super::jvm::apply::is_jvm_entry(entry) {
+        return super::jvm::apply::checked_tree_jar(project_root, entry, &record.uuid)
+            .map(|rel| project_root.join(rel));
+    }
     let rel = &entry.artifact.path;
     let parts = parse_vendor_path(rel).ok_or_else(|| "vendor_path_unsafe".to_string())?;
     let norm = rel.replace('\\', "/");
@@ -391,7 +398,6 @@ fn read_wheel_to_map(whl: &Path) -> Result<HashMap<String, Vec<u8>>, String> {
 /// [`read_wheel_to_map`] over in-memory zip bytes — the same entry and
 /// decompressed-size caps — for callers that hash and decode the SAME
 /// buffer (a committed wheel read exactly once).
-#[cfg(test)]
 pub(crate) fn read_zip_bytes_to_map(bytes: &[u8]) -> Result<HashMap<String, Vec<u8>>, String> {
     read_zip_to_map(std::io::Cursor::new(bytes), false)
 }
diff --git a/crates/socket-patch-core/src/vex/discover/maven.rs b/crates/socket-patch-core/src/vex/discover/maven.rs
index d90720e7..734f3e61 100644
--- a/crates/socket-patch-core/src/vex/discover/maven.rs
+++ b/crates/socket-patch-core/src/vex/discover/maven.rs
@@ -245,6 +245,15 @@ async fn extract_hosted(
             .map(String::as_str)
             .filter(|uuid| uuid.starts_with(hex8))
             .collect();
+        // A JVM-backend pin: its committed maven2 tree serves it.
+        let jvm_tree = candidates.is_empty()
+            && ctx
+                .exists(&format!(
+                    "{}/{}/{artifact}/{pinned}/{artifact}-{pinned}.jar",
+                    crate::vendor::jvm::maven_reactor::TREE_ROOT,
+                    group.replace('.', "/")
+                ))
+                .await;
         match candidates.as_slice() {
             [uuid] => {
                 ties.entry(*uuid).or_default().insert((
@@ -254,6 +263,7 @@ async fn extract_hosted(
                     pinned.clone(),
                 ));
             }
+            [] if jvm_tree => {}
             [] => out.diag(
                 DIAG_REF_UNATTRIBUTABLE,
                 POM,
@@ -488,6 +498,13 @@ fn classify_repo(ctx: &DiscoverCtx<'_>, repo: &PomRepo, out: &mut Discovery) ->
     if !id_socket && url_hosted.is_none() && !url_vendor_text {
         return RepoKind::NotOurs;
     }
+    // The JVM backend's one shared fallback repository names no patch; its
+    // ledger entries prove their own liveness.
+    if id == crate::vendor::jvm::maven_reactor::REPO_ID
+        && url == crate::vendor::jvm::maven_reactor::REPO_URL
+    {
+        return RepoKind::NotOurs;
+    }
     let invalid = |out: &mut Discovery, why: &str| {
         out.diag(
             DIAG_REF_INVALID,
diff --git a/crates/socket-patch-core/src/vex/discover/mod.rs b/crates/socket-patch-core/src/vex/discover/mod.rs
index 2f36169f..11a585f0 100644
--- a/crates/socket-patch-core/src/vex/discover/mod.rs
+++ b/crates/socket-patch-core/src/vex/discover/mod.rs
@@ -1513,6 +1513,11 @@ impl Discovery {
     /// files still naming the uuid dir (or, with none recorded, the
     /// ecosystem's root locks — [`vendored_wiring_live`]).
     pub async fn vendor_entry_live(&self, root: &Path, entry: &VendorEntry) -> bool {
+        // The JVM backend's trees are not `<eco>/<uuid>` dirs its refs could
+        // name: its own layout decides.
+        if crate::vendor::jvm::apply::is_jvm_entry(entry) {
+            return crate::vendor::jvm::apply::entry_wired(root, entry);
+        }
         if let Some(live) = self.vendored_claim(&entry.base_purl, &entry.uuid, &entry.artifact.path)
         {
             return live;
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/composer/composer-lock/dist-mirrors-before-url/restored/composer.lock b/crates/socket-patch-core/tests/fixtures/redirect/composer/composer-lock/dist-mirrors-before-url/restored/composer.lock
new file mode 100644
index 00000000..6f1b07d3
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/composer/composer-lock/dist-mirrors-before-url/restored/composer.lock
@@ -0,0 +1,39 @@
+{
+    "_readme": [
+        "This file locks the dependencies of your project to a known state"
+    ],
+    "content-hash": "abc123def456abc123def456abc1",
+    "packages": [
+        {
+            "name": "monolog/monolog",
+            "version": "2.0.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/Seldaek/monolog.git",
+                "reference": "abc123def456"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/Seldaek/monolog/zipball/abc123",
+                "reference": "abc123def456",
+                "shasum": ""
+            }
+        },
+        {
+            "name": "psr/log",
+            "version": "1.1.4",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/php-fig/log.git",
+                "reference": "d49695b909c3b7628b6289db5479a1c204601f11"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/php-fig/log/zipball/d49695b909c3b7628b6289db5479a1c204601f11",
+                "reference": "d49695b909c3b7628b6289db5479a1c204601f11",
+                "shasum": ""
+            }
+        }
+    ],
+    "packages-dev": []
+}
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/composer/composer-lock/dist-mirrors/restored/composer.lock b/crates/socket-patch-core/tests/fixtures/redirect/composer/composer-lock/dist-mirrors/restored/composer.lock
new file mode 100644
index 00000000..6f1b07d3
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/composer/composer-lock/dist-mirrors/restored/composer.lock
@@ -0,0 +1,39 @@
+{
+    "_readme": [
+        "This file locks the dependencies of your project to a known state"
+    ],
+    "content-hash": "abc123def456abc123def456abc1",
+    "packages": [
+        {
+            "name": "monolog/monolog",
+            "version": "2.0.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/Seldaek/monolog.git",
+                "reference": "abc123def456"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/Seldaek/monolog/zipball/abc123",
+                "reference": "abc123def456",
+                "shasum": ""
+            }
+        },
+        {
+            "name": "psr/log",
+            "version": "1.1.4",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/php-fig/log.git",
+                "reference": "d49695b909c3b7628b6289db5479a1c204601f11"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/php-fig/log/zipball/d49695b909c3b7628b6289db5479a1c204601f11",
+                "reference": "d49695b909c3b7628b6289db5479a1c204601f11",
+                "shasum": ""
+            }
+        }
+    ],
+    "packages-dev": []
+}
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/composer/composer-lock/source-after-dist/restored/composer.lock b/crates/socket-patch-core/tests/fixtures/redirect/composer/composer-lock/source-after-dist/restored/composer.lock
new file mode 100644
index 00000000..ab77a76a
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/composer/composer-lock/source-after-dist/restored/composer.lock
@@ -0,0 +1,42 @@
+{
+    "_readme": [
+        "This file locks the dependencies of your project to a known state"
+    ],
+    "content-hash": "abc123def456abc123def456abc1",
+    "packages": [
+        {
+            "name": "monolog/monolog",
+            "version": "2.0.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/Seldaek/monolog.git",
+                "reference": "abc123def456"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/Seldaek/monolog/zipball/abc123",
+                "reference": "abc123def456",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=7.2"
+            }
+        },
+        {
+            "name": "psr/log",
+            "version": "1.1.4",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/php-fig/log.git",
+                "reference": "d49695b909c3b7628b6289db5479a1c204601f11"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/php-fig/log/zipball/d49695b909c3b7628b6289db5479a1c204601f11",
+                "reference": "d49695b909c3b7628b6289db5479a1c204601f11",
+                "shasum": ""
+            }
+        }
+    ],
+    "packages-dev": []
+}
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/composer/composer-lock/source-before-name/restored/composer.lock b/crates/socket-patch-core/tests/fixtures/redirect/composer/composer-lock/source-before-name/restored/composer.lock
new file mode 100644
index 00000000..6f1b07d3
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/composer/composer-lock/source-before-name/restored/composer.lock
@@ -0,0 +1,39 @@
+{
+    "_readme": [
+        "This file locks the dependencies of your project to a known state"
+    ],
+    "content-hash": "abc123def456abc123def456abc1",
+    "packages": [
+        {
+            "name": "monolog/monolog",
+            "version": "2.0.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/Seldaek/monolog.git",
+                "reference": "abc123def456"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/Seldaek/monolog/zipball/abc123",
+                "reference": "abc123def456",
+                "shasum": ""
+            }
+        },
+        {
+            "name": "psr/log",
+            "version": "1.1.4",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/php-fig/log.git",
+                "reference": "d49695b909c3b7628b6289db5479a1c204601f11"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/php-fig/log/zipball/d49695b909c3b7628b6289db5479a1c204601f11",
+                "reference": "d49695b909c3b7628b6289db5479a1c204601f11",
+                "shasum": ""
+            }
+        }
+    ],
+    "packages-dev": []
+}
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/composer/composer-lock/source-last-key/restored/composer.lock b/crates/socket-patch-core/tests/fixtures/redirect/composer/composer-lock/source-last-key/restored/composer.lock
new file mode 100644
index 00000000..6f1b07d3
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/composer/composer-lock/source-last-key/restored/composer.lock
@@ -0,0 +1,39 @@
+{
+    "_readme": [
+        "This file locks the dependencies of your project to a known state"
+    ],
+    "content-hash": "abc123def456abc123def456abc1",
+    "packages": [
+        {
+            "name": "monolog/monolog",
+            "version": "2.0.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/Seldaek/monolog.git",
+                "reference": "abc123def456"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/Seldaek/monolog/zipball/abc123",
+                "reference": "abc123def456",
+                "shasum": ""
+            }
+        },
+        {
+            "name": "psr/log",
+            "version": "1.1.4",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/php-fig/log.git",
+                "reference": "d49695b909c3b7628b6289db5479a1c204601f11"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/php-fig/log/zipball/d49695b909c3b7628b6289db5479a1c204601f11",
+                "reference": "d49695b909c3b7628b6289db5479a1c204601f11",
+                "shasum": ""
+            }
+        }
+    ],
+    "packages-dev": []
+}
diff --git a/crates/socket-patch-core/tests/fixtures/redirect/composer/composer-lock/source-not-adjacent/restored/composer.lock b/crates/socket-patch-core/tests/fixtures/redirect/composer/composer-lock/source-not-adjacent/restored/composer.lock
new file mode 100644
index 00000000..05f65449
--- /dev/null
+++ b/crates/socket-patch-core/tests/fixtures/redirect/composer/composer-lock/source-not-adjacent/restored/composer.lock
@@ -0,0 +1,42 @@
+{
+    "_readme": [
+        "This file locks the dependencies of your project to a known state"
+    ],
+    "content-hash": "abc123def456abc123def456abc1",
+    "packages": [
+        {
+            "name": "monolog/monolog",
+            "version": "2.0.0",
+            "require": {
+                "php": ">=7.2"
+            },
+            "source": {
+                "type": "git",
+                "url": "https://github.com/Seldaek/monolog.git",
+                "reference": "abc123def456"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/Seldaek/monolog/zipball/abc123",
+                "reference": "abc123def456",
+                "shasum": ""
+            }
+        },
+        {
+            "name": "psr/log",
+            "version": "1.1.4",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/php-fig/log.git",
+                "reference": "d49695b909c3b7628b6289db5479a1c204601f11"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/php-fig/log/zipball/d49695b909c3b7628b6289db5479a1c204601f11",
+                "reference": "d49695b909c3b7628b6289db5479a1c204601f11",
+                "shasum": ""
+            }
+        }
+    ],
+    "packages-dev": []
+}
diff --git a/crates/socket-patch-core/tests/upstream_restore_golden.rs b/crates/socket-patch-core/tests/upstream_restore_golden.rs
index 4cf52500..373e0bc0 100644
--- a/crates/socket-patch-core/tests/upstream_restore_golden.rs
+++ b/crates/socket-patch-core/tests/upstream_restore_golden.rs
@@ -749,10 +749,14 @@ async fn composer_run(
 #[tokio::test]
 #[serial]
 async fn composer_goldens_round_trip() {
-    // Every composer golden with a rewrite is invertible.
+    // Restore registry fields byte for byte. A hosted rewrite removes local
+    // mirror settings and the source block's original position, neither of
+    // which Packagist can reconstruct without a ledger. Those cases record
+    // the canonical upstream result in `restored/`.
     let mut ran = 0;
-    for case in load("composer/composer-lock") {
+    for mut case in load("composer/composer-lock") {
         let (after, statuses) = composer_run(&case, |_| {}).await;
+        case.input.extend(walk(&case.dir.join("restored")));
         assert_round_trip(&case, &after, &statuses);
         ran += 1;
     }
diff --git a/docs/design/maven-vendoring.md b/docs/design/maven-vendoring.md
new file mode 100644
index 00000000..8b77abf5
--- /dev/null
+++ b/docs/design/maven-vendoring.md
@@ -0,0 +1,176 @@
+# Vendored Maven reactors and Gradle in v5
+
+The JVM backend in `crates/socket-patch-core/src/vendor/jvm/` is enabled by
+build shape. No experimental environment variable is required. Maven reactors
+use suffixed coordinates; Gradle keeps the original coordinates. Both commit a
+local repository so another checkout can build without socket-patch or the
+Socket service.
+
+The existing single-POM backend remains supported. This change adds reactor and
+Gradle support without automatically migrating existing single-POM repositories.
+Hosted mode keeps its existing behavior.
+
+## Commands
+
+```sh
+socket-patch vendor
+socket-patch vendor --offline
+socket-patch vendor --check
+socket-patch vendor --check --local-repo /path/to/maven/repository
+socket-patch vendor --maven-config=none
+socket-patch vendor --revert
+```
+
+`scan --mode vendored`, `get --mode vendored`, `vendor`, `repair`, `remove` and
+`rollback` share the v5 vendored backend. Maven discovery still uses the Maven
+local repository; a Gradle-only cache is not a Maven discovery source. An online
+service-backed vendoring request can obtain the upstream POM and Gradle module
+metadata from the registry when they are not cached locally.
+
+`vendor --check` is read-only and offline even without `--offline`. It checks
+artifact hashes, recorded tree files, wiring, Gradle's index and script, and
+unindexed files. `--local-repo` also detects a suffixed Maven jar or POM whose
+bytes conflict with the committed copy. Failures produce per-package
+`vendor_check_failed` events and exit 1. A patch without a ledger entry fails
+with `vendor_ledger_missing`. Offline upstream metadata is identified by the
+`vendor_jvm_upstream_unverified` warning; run vendor online to authenticate it
+against registry checksums.
+
+## Maven
+
+Supported reactors have an explicit root `pom.xml` and `<modules>` or
+`<subprojects>` declarations, including declarations in profiles. Run vendoring
+from the reactor root. A discovered ancestor reactor produces `not_build_root`
+instead of allowing a partial submodule edit.
+
+The patched version is `<base>-socket.<first-eight-uuid-hex>`, matching the patch
+service. A warm cache of the original version cannot shadow that coordinate.
+The backend writes:
+
+- `.socket/vendor/maven2/<group-path>/<artifact>/<suffixed-version>/`: patched
+  jar, suffixed POM, SHA-1 sidecars, and an ownership marker.
+- `.socket/vendor/maven2/.gitattributes`: disables line-ending conversion of
+  committed repository bytes.
+- A shared file repository and dependency-management pins in each local root.
+- Rewrites of conflicting base-version literals and resolved local properties,
+  including profiles and local parent POMs outside the module list.
+- Two lines in `.mvn/maven.config`: offline file protocol access and the local
+  repository tail at `${session.rootDirectory}/.socket/vendor/maven2`.
+
+Parent chains must remain within the checkout. Local parent coordinates are
+checked before using their properties. Range selectors, unresolved properties,
+classifier declarations, conflicting explicit versions and publishing POMs
+produce specific warnings; the backend does not silently claim those
+unsupported declarations are patched. An enforcer repository ban omits the
+fallback repository and warns that the tail requires Maven 3.9.2 or newer.
+
+Maven 3.9.2+ can read the repository tail without copying jars into `~/.m2` and
+without routing through mirrors. Older Maven versions use the fallback file
+repository, which copies the suffixed artifact into the local cache. A
+`mirrorOf=*` configuration must exclude `socket-patch-vendor` on that fallback
+path.
+
+Maven 3.9.2–3.9.8 has a known interpolation limitation when `-f` is invoked from
+outside the root. Use Maven from the root or select `--maven-config=none` on the
+first vendoring run. That option uses the fallback file repository only, is
+recorded in the ledger, and remains in effect on later runs and repair. Revert
+existing auto-config wiring before changing to `none`. Combining `none` with a
+repository ban is refused. Version detection reads wrapper properties only;
+it never executes Maven.
+
+## Gradle
+
+Gradle 6.8+ is supported, including Groovy and Kotlin settings, multi-project
+builds, buildSrc, and literal `includeBuild` paths inside the checkout. A
+wrapper proving a version below 6.8 is refused before writes; the generated
+script also checks the running Gradle version.
+
+The original GAV is retained under
+`.socket/vendor/gradle/<group-path>/<artifact>/<version>/`. Lockfiles, version
+catalogs and project build scripts stay unchanged. Settings files receive an
+apply line for `.socket/gradle/socket-patch.settings.gradle`. Settings plugin
+and buildscript classpaths receive an in-block exclusive repository entry
+because those classpaths resolve before the apply line runs.
+
+The static script:
+
+- Reads `.socket/vendor/gradle-index.tsv`, with sorted GAV/path/SHA-256/UUID rows.
+- Hashes files as streams and requires jar and POM rows for every GAV.
+- Rejects unsafe coordinates, selectors, mismatched paths and unindexed files.
+- Adds an `exclusiveContent` file repository for the patched coordinates to
+  the relevant repository handlers while respecting repository mode.
+- Fails configuration if a vendored artifact no longer matches its index.
+
+When `gradle/verification-metadata.xml` already exists, vendoring updates the
+patched jar's checksum and, when metadata verification is enabled, adds missing
+POM and module entries for the artifact, its parents and imported BOMs.
+Metadata traversal is bounded and covers parent defaults and child property overrides. The backend
+records supplementary entries as shared fragments so either patch can be
+reverted first. Existing verification policy and unrelated checksums are kept.
+A verification file is never created automatically.
+
+Android, Kotlin Multiplatform, `available-at` module redirects, conflicting
+exclusive-content rules and paths leaving the checkout are refused. Nonliteral
+included builds are warned about rather than evaluated. The backend never
+executes user build code to discover settings or metadata.
+
+## Artifact identity and integrity
+
+Service artifacts pass the existing download-integrity and patched-member
+checks. Local jar rebuilds reproduce the server's stored ZIP encoding: upstream
+entry order, executable bits, fixed 1980 timestamps, no directory entries or
+extra fields, sorted additions, and stripped signature metadata. A checked-in
+fixture generated by archiver 7.0.1 tests byte identity, including Unicode paths
+and executable entries. The generator is beside the fixture under
+`src/vendor/jvm/fixtures/repack/`.
+
+Online JVM vendoring checks upstream jar and metadata bytes against registry
+SHA-512 sidecars, falling back to SHA-1, independently of local cache sidecars.
+Offline metadata is accepted with its trust status recorded in the ledger.
+Registry metadata fetches use a separate HTTP client and never send Socket API
+credentials. `SOCKET_MAVEN_REGISTRY` supports a private mirror.
+
+Maven v5 does not enable Resolver trusted-checksum processors at build time.
+Those processors crash some release reactors and system-scope dependencies,
+and do not reliably enforce pins on all supported Resolver versions.
+`vendor --check` supplies the offline integrity audit. Gradle always performs
+its index check at configuration time; this is separate from Gradle's own
+optional dependency-verification policy.
+
+## Transactions, state and reversal
+
+New entries use ecosystem `jvm` with Maven PURLs. Old binaries refuse their
+revert rather than interpreting them as legacy whole-POM edits. Existing
+prototype entries identified by their JVM wiring kinds remain readable.
+
+The planners return complete file writes and fragment records. The v5 group
+commit captures build-file edits, the Gradle index, the owned settings script,
+repository `.gitattributes`, and the vendor ledger. Artifact bytes are made
+durable before those commit points. All vendor entry points use the same
+transaction and recovery mechanism. Ordinary vendoring retains v5's per-patch
+success/failure contract; hosted ejection retains its all-or-nothing contract.
+
+Revert restores per-patch fragments, keeps shared wiring while other patches
+still consume it, and preserves user edits that no longer match recorded
+fragments. `--preserve-state` restores wiring while retaining artifacts and the
+ledger. Patch updates remove superseded Maven trees after the new wiring is
+committed. Gradle updates keep the same artifact paths. Unrecognized or forged
+paths cannot direct writes outside the backend's allowed files.
+
+`repair` reconstructs missing/corrupt artifacts using the same backend. The
+ledger is required for exact reversal; restore a deleted ledger from version
+control. In-place ledger reconstruction remains outside v5's repair contract.
+
+## Validation and remaining scope
+
+The implementation is covered by planner, disk-safety, lifecycle and command
+integration tests. Real-tool capstones exercise a Maven reactor from fresh
+checkouts, root and module invocations, Gradle strict locking and repository
+mode, existing verification metadata, offline builds, tamper detection and
+byte-exact revert. CI pins Maven 3.6.3, 3.8.9, 3.9.2, 3.9.16 and 4.0.0-rc-6,
+and Gradle 6.9.4, 7.6.4, 8.14.3 and 9.8.0, with macOS and Windows coverage.
+
+Automatic single-POM migration, Maven 4 implicit subproject discovery,
+build-time Maven strict pins, dynamic-version repository metadata, classifier
+artifacts, creating Gradle verification policy, and online dependency-graph
+resolution checks remain separate work. They are not enabled by this release.
diff --git a/docs/ecosystems.md b/docs/ecosystems.md
index a9048866..8ab95c89 100644
--- a/docs/ecosystems.md
+++ b/docs/ecosystems.md
@@ -19,7 +19,7 @@ The backticked slug in each row is the value `-e`/`--ecosystems` accepts (e.g.
 | Cargo (`cargo`) | ✅ in-place + `.cargo-checksum.json` rewrite (shared registry-cache caveat — see [Cargo: shared registry cache](#cargo-shared-registry-cache)) | ✅ `[patch.crates-io]` path entry in the root `Cargo.toml` (v5; per-version Socket keys; pre-v5 `.cargo/config*` wiring migrates on re-run) | ✅ per-patch sparse registry (`[registries.socket-patch-<uuid>]` + Cargo.lock source/checksum); direct dependencies only — a crate another dependency also pulls in is refused, use `--mode vendored`; with no `Cargo.lock` the graph is unknown, so only a project whose sole dependency is the patched crate is redirected |
 | RubyGems (`gem`) | ✅ in place | ✅ Gemfile + Gemfile.lock path pair (`Gemfile` spelling only — a `gems.rb` project cannot vendor yet) | ✅ per-dep `source` block — edits `gems.rb` + `gems.locked` when present (bundler prefers them over `Gemfile`; spellings that diverge beyond Socket's own edits fail closed with `redirect_gem_gemfile_spellings_diverge`); the `CHECKSUMS` pin needs bundler ≥ 2.6 (older locks get a `redirect_gem_no_checksums_section` warning); a stale pre-redirect materialization that `bundle install` would reuse instead of refetching is flagged `redirect_gem_stale_install` with a prescriptive remedy (see CLI_CONTRACT.md's "Gem stale-install guard") |
 | Go (`golang`) | ✅ `go.mod` `replace` → `.socket/go-patches/` — see [Go: directory replaces and go.sum](#go-directory-replaces-and-gosum) | ✅ `replace` → the committed vendor tree | ✅ (free tier) fork-style `replace` → `patch.socket.dev/gopatch/<uuid>` + committed `go.sum` pin; see [Go notes](#go-directory-replaces-and-gosum). Paid hosted patches are unsupported; `redirect_golang_unsupported` names the vendored remedy |
-| Maven (`maven`) | ✅ in-place jar patching leaves the `~/.m2` checksum sidecars stale — prefer vendored / hosted, see [Maven & NuGet caveats](#maven--nuget-caveats) | ✅ committed maven2 `file://` repository. A root pom declaring `<modules>` (multi-module aggregator) is refused (`vendor_maven_multimodule_unsupported`), and a gradle-only project is refused (`vendor_gradle_unsupported`) | ✅ **pom projects only, fail-closed** — the patched jar is pinned at a Socket-only `<version>-socket.<hex8>` suffix; `${property}` versions are refused; Gradle gets a manual `exclusiveContent` snippet — see [Maven & NuGet caveats](#maven--nuget-caveats) |
+| Maven (`maven`) | ✅ in-place jar patching leaves the `~/.m2` checksum sidecars stale — prefer vendored / hosted, see [Maven & NuGet caveats](#maven--nuget-caveats) | ✅ single-POM repository, suffixed Maven reactor repository, or Gradle 6.8+ same-GAV repository with settings wiring and SHA-256 checks; see [JVM vendoring](design/maven-vendoring.md) | ✅ **pom projects only, fail-closed** — the patched jar is pinned at a Socket-only `<version>-socket.<hex8>` suffix; `${property}` versions are refused; Gradle gets a manual `exclusiveContent` snippet — see [Maven & NuGet caveats](#maven--nuget-caveats) |
 | NuGet (`nuget`) | ✅ in-place patching deletes `.nupkg.metadata` and advises on the `.nupkg.sha512` tamper-evidence sidecar — prefer vendored / hosted, see [Maven & NuGet caveats](#maven--nuget-caveats) | ✅ committed folder feed + `packageSourceMapping` + `packages.lock.json` contentHash pin | ✅ `nuget.config` source + source-mapping, `packages.lock.json` contentHash rewrite. See the locked-mode note in [Maven & NuGet caveats](#maven--nuget-caveats) |
 | Composer (`composer`) | ✅ in place (`vendor/`) | ✅ `composer.lock` `dist: path` rewrite | ✅ `composer.lock` dist url + shasum rewrite; the entry's `source` and `dist.mirrors` are removed. See [composer-compatibility.md](testing/composer-compatibility.md) |
 | Deno (`deno`) | ✅ in place (the only mode for Deno) | ❌ refused (`vendor_unsupported_ecosystem`) | ❌ not supported |
@@ -355,14 +355,15 @@ Honest limits of the Maven and NuGet flows — documented behavior, not bugs:
   confirmed directory, a POM at a canonical path whose contents disagree with its
   directory (hand-placed, or a legacy upstream POM with mismatched coordinates) reports
   the directory's coordinates.
-* **Warm `~/.m2` shadowing (vendored Maven only).** Maven consults the *local repository*
+* **Warm `~/.m2` shadowing (legacy single-POM vendoring).** Maven consults the *local repository*
   before any configured `<repository>`, so with vendored mode a warm `~/.m2` copy of the
   same GAV silently wins over the committed `file://` repository — the build succeeds
   with **unpatched** bytes. Purge it with:
   `mvn dependency:purge-local-repository -DmanualInclude=<groupId>:<artifactId>`
   (the always-on `vendor_maven_local_cache_shadow` warning carries the same one-liner).
-  Hosted mode is **not** affected: the patched jar lives at the suffixed version, which
-  no warm `~/.m2` entry can hold.
+  Reactor vendoring and hosted mode use a suffixed version, so a cached original
+  version cannot shadow it. Audit conflicting copies of that suffix with
+  `vendor --check --local-repo <path>`.
 * **`mirrorOf` mirrors (hosted Maven).** A `settings.xml` `<mirror>` with
   `<mirrorOf>*</mirrorOf>` (common in corporate environments) reroutes *all* repositories
   — including the injected `socket-patch-<uuid>` repository — through the mirror. Because
diff --git a/docs/testing/README.md b/docs/testing/README.md
index c6970a50..43438c44 100644
--- a/docs/testing/README.md
+++ b/docs/testing/README.md
@@ -27,6 +27,7 @@ setting when that toolchain is required for the check.
 | npm family | [npm](npm-compatibility.md), [pnpm](pnpm-compatibility.md), [Yarn Berry](yarn-berry-compatibility.md), [Bun](bun-compatibility.md), [vlt](vlt-compatibility.md) |
 | Python | [uv](uv-compatibility.md), [Poetry](poetry-compatibility.md), [PDM](pdm-compatibility.md), [Pipenv](pipenv-compatibility.md), [Hatch](hatch.md) |
 | PHP | [Composer](composer-compatibility.md) |
+| JVM | [Maven reactor and Gradle vendoring](../design/maven-vendoring.md#validation-and-remaining-scope) |
 
 Other ecosystems have Rust and container suites listed in
 [ecosystem support](../ecosystems.md) and the Docker guide.
diff --git a/docs/usage.md b/docs/usage.md
index f9d92256..26012371 100644
--- a/docs/usage.md
+++ b/docs/usage.md
@@ -105,6 +105,24 @@ operation never fetches missing inputs. `repair` can restore missing or corrupt
 artifacts from a valid ledger when sufficient inputs are available; it cannot
 reconstruct a lost vendor ledger. Restore a lost ledger from version control.
 
+### Maven reactors and Gradle
+
+Maven reactors use suffixed versions in `.socket/vendor/maven2`; Gradle 6.8+
+keeps its coordinates and lockfiles, with settings wiring and a configuration-time
+SHA-256 check. Existing Gradle verification files are updated. Single-POM Maven
+projects retain their existing vendoring behavior.
+
+```sh
+socket-patch vendor --check                       # read-only offline artifact and wiring audit
+socket-patch vendor --check --local-repo ~/.m2/repository  # also check Maven cache conflicts
+socket-patch scan --mode vendored --maven-config=none     # use only the fallback file repository
+```
+
+`--maven-config=auto` (the default) writes a Maven repository tail; `none` disables
+that tail. The choice persists in the ledger. See [JVM vendoring](design/maven-vendoring.md)
+for supported shapes, committed files, Maven mirror and `-f` limitations, and
+offline operation.
+
 ## OpenVEX
 
 Generate an attestation after installing the patched dependencies: